# Latest **URL:** https://discuss.elastic.co/latest.md?page=1078 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1079 --- ## [Alert when data is missing?](https://discuss.elastic.co/t/alert-when-data-is-missing/307886)
**Author:** [@LionsELK](https://discuss.elastic.co/u/LionsELK)\ **Replies:** 3\ **Last updated:** [June 22, 2022, 2:07pm UTC](https://discuss.elastic.co/t/alert-when-data-is-missing/307886 "2022-06-22T14:07:13Z")
Hi all, Is there some form of functionality built into the ELK stack that can automatically alert me when data is missing? i.e. if we're missing a chunk of time like the image below. Currently, we're only made aware… --- ## [Logstash tcp input CPU perfomance](https://discuss.elastic.co/t/logstash-tcp-input-cpu-perfomance/307759)
**Author:** [@perezdev](https://discuss.elastic.co/u/perezdev)\ **Replies:** 9\ **Last updated:** [June 22, 2022, 1:49pm UTC](https://discuss.elastic.co/t/logstash-tcp-input-cpu-perfomance/307759 "2022-06-22T13:49:26Z")
Hello, I have configured logstash using one tcp input as follows: input { #logs01 tcp { type =\> "logs" codec =\> "line" port =\> 9916 add\_field =\> { "event\_dataset" =\> "logs\_01" } } } With this co… --- ## [How to identify and remove duplicates in Elasticsearch index](https://discuss.elastic.co/t/how-to-identify-and-remove-duplicates-in-elasticsearch-index/307866)
**Author:** [@Sowmya1](https://discuss.elastic.co/u/Sowmya1)\ **Replies:** 3\ **Last updated:** [June 22, 2022, 1:35pm UTC](https://discuss.elastic.co/t/how-to-identify-and-remove-duplicates-in-elasticsearch-index/307866 "2022-06-22T13:35:56Z")
we are using elasticsearch 7.11.1 recently we observed an issue and below are the points for it. we store data for every 15 mins interval and we get time stamp from our input file (ex: 05:00, 23:15, 20:30, 11:45 ) rece… --- ## [Kibana 7.16.3 installing/using jsPDF for custom plugins](https://discuss.elastic.co/t/kibana-7-16-3-installing-using-jspdf-for-custom-plugins/306725)
**Author:** [@ssimmons](https://discuss.elastic.co/u/ssimmons)\ **Replies:** 1\ **Last updated:** [June 22, 2022, 12:56pm UTC](https://discuss.elastic.co/t/kibana-7-16-3-installing-using-jspdf-for-custom-plugins/306725 "2022-06-22T12:56:39Z")
We are in the process of converting our Kibana 7.10.2 custom plugins into Kibana 7.16.3 custom plugins. We use the jsPDF module for creating pdfs of our dashboards for downloading. We are having issues using jsPDF in Kib… --- ## [Change error message in Kibana widgets](https://discuss.elastic.co/t/change-error-message-in-kibana-widgets/307848)
**Author:** [@Avarjana](https://discuss.elastic.co/u/Avarjana)\ **Replies:** 3\ **Last updated:** [June 22, 2022, 12:45pm UTC](https://discuss.elastic.co/t/change-error-message-in-kibana-widgets/307848 "2022-06-22T12:45:16Z")
Is there a way to change these error messages to something like "No results found"? --- ## [Nested aggregation in Kibana Dashboard](https://discuss.elastic.co/t/nested-aggregation-in-kibana-dashboard/307871)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 3\ **Last updated:** [June 22, 2022, 12:30pm UTC](https://discuss.elastic.co/t/nested-aggregation-in-kibana-dashboard/307871 "2022-06-22T12:30:04Z")
Hi all, Let's say there is Fruits database Based on terms aggregation we have count of Oranges - 5 & Pears -3 & Apples - 3. Now 2 fruit categories (Pears & Apples ) have 3 as count. So here I have nested aggregation o… --- ## [ElasticSearch as primary DB for document library](https://discuss.elastic.co/t/elasticsearch-as-primary-db-for-document-library/307852)
**Author:** [@Gresmir](https://discuss.elastic.co/u/Gresmir)\ **Replies:** 2\ **Last updated:** [June 22, 2022, 12:05pm UTC](https://discuss.elastic.co/t/elasticsearch-as-primary-db-for-document-library/307852 "2022-06-22T12:05:47Z")
My task is a full-text search system for a really large amount of documents (tens of millions). Now I have documents as RTF file and their metadata, so all this will be indexed in Elasticsearch. These documents are uncha… --- ## [The CPU load increases, the CPU utilization decreases, and the Version Map continues to decrease for 30 hours](https://discuss.elastic.co/t/the-cpu-load-increases-the-cpu-utilization-decreases-and-the-version-map-continues-to-decrease-for-30-hours/307618)
**Author:** [@yanha186036](https://discuss.elastic.co/u/yanha186036)\ **Replies:** 1\ **Last updated:** [June 22, 2022, 12:03pm UTC](https://discuss.elastic.co/t/the-cpu-load-increases-the-cpu-utilization-decreases-and-the-version-map-continues-to-decrease-for-30-hours/307618 "2022-06-22T12:03:57Z")
question1：Why are indicators suddenly like this？ java code ex：Exception message failed to refresh index: user\_rank\_total question2：Why is the sharding uneven? node3 is not sharded --- ## [Increase row count in search table in kibana dashboard](https://discuss.elastic.co/t/increase-row-count-in-search-table-in-kibana-dashboard/307864)
**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\ **Replies:** 3\ **Last updated:** [June 22, 2022, 12:02pm UTC](https://discuss.elastic.co/t/increase-row-count-in-search-table-in-kibana-dashboard/307864 "2022-06-22T12:02:16Z")
I have added discover search results in dashboard and changed row count limit to 500 default but it is not reflecting to search table. Row count in search table is limited to 50. How to increase that. --- ## [Return multiple parent documents for each nested object match](https://discuss.elastic.co/t/return-multiple-parent-documents-for-each-nested-object-match/307873)
**Author:** [@dgurusam](https://discuss.elastic.co/u/dgurusam)\ **Replies:** 0\ **Last updated:** [June 22, 2022, 11:59am UTC](https://discuss.elastic.co/t/return-multiple-parent-documents-for-each-nested-object-match/307873 "2022-06-22T11:59:52Z")
Hi All, I have an index which contains a nested object. I would like to return multiple parent documents for each object matched in the nested object. For example: Index Details: "settings": { "number\_of\_sha… --- ## [Filebeat made my disk full in less than one day](https://discuss.elastic.co/t/filebeat-made-my-disk-full-in-less-than-one-day/307856)
**Author:** [@Khalifa\_Khalifi](https://discuss.elastic.co/u/Khalifa_Khalifi)\ **Replies:** 1\ **Last updated:** [June 22, 2022, 11:58am UTC](https://discuss.elastic.co/t/filebeat-made-my-disk-full-in-less-than-one-day/307856 "2022-06-22T11:58:21Z")
Using filebeat made my disk full in less than one day!!! Is there any config I could apply to filebeat.yml to avoid this please? Using this tool is really dangerous. Prod servers are suddenly full for no reason. --- ## [How to make a table like Excel sheet with Kibana?](https://discuss.elastic.co/t/how-to-make-a-table-like-excel-sheet-with-kibana/25687)
**Author:** [@cherah30](https://discuss.elastic.co/u/cherah30)\ **Replies:** 18\ **Last updated:** [June 22, 2022, 11:47am UTC](https://discuss.elastic.co/t/how-to-make-a-table-like-excel-sheet-with-kibana/25687 "2022-06-22T11:47:44Z")
I apologize for my beginner question. starting from "Discover" part of kibana, I could select some fields, filtering, ...etc, then I recorded the resultat of my research. Now, I would like to show the result of my se… --- ## [Elasticsearch SQL query with date and timestamp](https://discuss.elastic.co/t/elasticsearch-sql-query-with-date-and-timestamp/307753)
**Author:** [@Pranjal\_Sett](https://discuss.elastic.co/u/Pranjal_Sett)\ **Replies:** 3\ **Last updated:** [June 22, 2022, 11:47am UTC](https://discuss.elastic.co/t/elasticsearch-sql-query-with-date-and-timestamp/307753 "2022-06-22T11:47:26Z")
Hi, As per specification I want to get the data as per logic given. Here is the logic below: sum(QUANTITY) where FILE\_CREATION\_DATE = TODAY() and INDEX\_NUMBER in (2, 4) and SUBINVENTORY = \[x,y,z\] I have transferred t… --- ## [Filebeat system pipeline setup fails](https://discuss.elastic.co/t/filebeat-system-pipeline-setup-fails/307872)
**Author:** [@dmgeurts](https://discuss.elastic.co/u/dmgeurts)\ **Replies:** 0\ **Last updated:** [June 22, 2022, 11:30am UTC](https://discuss.elastic.co/t/filebeat-system-pipeline-setup-fails/307872 "2022-06-22T11:30:18Z")
I've enabled the system module, enabled syslog and auth in system.yml. Yet for some reason I still get this error: $ sudo filebeat setup --pipelines --modules system Exiting: module system is configured but has no enabl… --- ## [Conditionally Apply Attachment Processor](https://discuss.elastic.co/t/conditionally-apply-attachment-processor/307867)
**Author:** [@jasmoon](https://discuss.elastic.co/u/jasmoon)\ **Replies:** 0\ **Last updated:** [June 22, 2022, 10:43am UTC](https://discuss.elastic.co/t/conditionally-apply-attachment-processor/307867 "2022-06-22T10:43:39Z")
Hi all, first time posting in this forum. I have trouble writing the condition to apply the attachment processor. Below is the wrong configuration of the pipeline: PUT \_ingest/pipeline/attachment { "description" : "Ex… --- ## [@elastic/elasticsearch](https://discuss.elastic.co/t/elastic-elasticsearch/307829)
**Author:** [@Rajan\_Devkota](https://discuss.elastic.co/u/Rajan_Devkota)\ **Replies:** 2\ **Last updated:** [June 22, 2022, 10:16am UTC](https://discuss.elastic.co/t/elastic-elasticsearch/307829 "2022-06-22T10:16:30Z")
Hello everyone. I am using elasticsearch client(@elastic/elasticsearch) version 7.13.0 and my elasticsearch server version is 7.10.0. And I am using typescript and node js in my backend. While using the elasticsearch c… --- ## [Filebeat writting on 2 different indices](https://discuss.elastic.co/t/filebeat-writting-on-2-different-indices/307859)
**Author:** [@Elie\_Sbat](https://discuss.elastic.co/u/Elie_Sbat)\ **Replies:** 0\ **Last updated:** [June 22, 2022, 9:49am UTC](https://discuss.elastic.co/t/filebeat-writting-on-2-different-indices/307859 "2022-06-22T09:49:00Z")
Hello, I am ELK cluster v8 with filebeat v8.1.0 ot ship application logs. I have 2 different indices one for proxy and the other for owa. The name of the indices are: filebeat-8.1.0 for proxy logs filebeat-8.1.0-owa… --- ## [Snapshots on datastream](https://discuss.elastic.co/t/snapshots-on-datastream/306779)
**Author:** [@Bilanda](https://discuss.elastic.co/u/Bilanda)\ **Replies:** 2\ **Last updated:** [June 22, 2022, 9:46am UTC](https://discuss.elastic.co/t/snapshots-on-datastream/306779 "2022-06-22T09:46:48Z")
Hello, I recently decided to moove from traditionals index to datastream. Everything goes fine, template and ILM are working fine, my backing index (.ds-logs......) are daily rotated. I've just got two issues with dat… --- ## [How to identify and remove duplicates in Elasticsearch index](https://discuss.elastic.co/t/how-to-identify-and-remove-duplicates-in-elasticsearch-index/307842)
**Author:** [@Komal\_42](https://discuss.elastic.co/u/Komal_42)\ **Replies:** 2\ **Last updated:** [June 22, 2022, 9:38am UTC](https://discuss.elastic.co/t/how-to-identify-and-remove-duplicates-in-elasticsearch-index/307842 "2022-06-22T09:38:51Z")
we are using elasticsearch 7.11.1 recently we observed an issue and below are the points for it. we store data for every 15 mins interval and we get time stamp from our input file (ex: 05:00, 23:15, 20:30, 11:45 ) rece… --- ## [Llegal\_argument\_exception: index.lifecycle.rollover\_alias \[syslog\] does not point to index \[syslog-2022-06-22\]](https://discuss.elastic.co/t/llegal-argument-exception-index-lifecycle-rollover-alias-syslog-does-not-point-to-index-syslog-2022-06-22/307857)
**Author:** [@Lucy\_S](https://discuss.elastic.co/u/Lucy_S)\ **Replies:** 0\ **Last updated:** [June 22, 2022, 9:24am UTC](https://discuss.elastic.co/t/llegal-argument-exception-index-lifecycle-rollover-alias-syslog-does-not-point-to-index-syslog-2022-06-22/307857 "2022-06-22T09:24:34Z")
Hi all, i got this message on all index llegal\_argument\_exception: index.lifecycle.rollover\_alias \[syslog\] does not point to index \[syslog-2022-06-22\] configs: curl -X POST "localhost:5601/api/index\_patterns/index\_… --- ## [Grok error filter json](https://discuss.elastic.co/t/grok-error-filter-json/307352)
**Author:** [@Roshan1](https://discuss.elastic.co/u/Roshan1)\ **Replies:** 7\ **Last updated:** [June 22, 2022, 8:16am UTC](https://discuss.elastic.co/t/grok-error-filter-json/307352 "2022-06-22T08:16:58Z")
Hello Team, can you please help me with error below? Error: \[WARN \] 2022-06-16 11:02:33.814 \[\[main\]-pipeline-manager\] grok - ECS v8 support is a preview of the unreleased ECS v8, and uses the v1 patterns. When Version… --- ## [Exception in thread "main" java.lang.NoClassDefFoundError](https://discuss.elastic.co/t/exception-in-thread-main-java-lang-noclassdeffounderror/307246)
**Author:** [@Ashutosh](https://discuss.elastic.co/u/Ashutosh)\ **Replies:** 2\ **Last updated:** [June 22, 2022, 8:08am UTC](https://discuss.elastic.co/t/exception-in-thread-main-java-lang-noclassdeffounderror/307246 "2022-06-22T08:08:44Z")
Hi Team, I am a beginner in Elasticsearch. We have a wazuh cluster running which use Elasticsearch for storing alerts. Since few days, the Elasticsearch is not starting at al. Whenever we try to use "systemctl start ela… --- ## [Calculate Error Budget Metric](https://discuss.elastic.co/t/calculate-error-budget-metric/307507)
**Author:** [@EllBil](https://discuss.elastic.co/u/EllBil)\ **Replies:** 3\ **Last updated:** [June 22, 2022, 8:07am UTC](https://discuss.elastic.co/t/calculate-error-budget-metric/307507 "2022-06-22T08:07:57Z")
Hello Elastic team, I'm actually working on SLI/SLO visualization on Kibana. My request is a bit complexe : I need to visualize the remaining error budget using this formula : EB = 436 minutes IF (not status = "500"… --- ## [Remove\_field not working](https://discuss.elastic.co/t/remove-field-not-working/307716)
**Author:** [@Naman1](https://discuss.elastic.co/u/Naman1)\ **Replies:** 2\ **Last updated:** [June 22, 2022, 7:59am UTC](https://discuss.elastic.co/t/remove-field-not-working/307716 "2022-06-22T07:59:01Z")
I am using remove\_field , but it is still showing that field in kibana. For eg- tags --- ## [MySQL tables with foreign key to Elastic App Search](https://discuss.elastic.co/t/mysql-tables-with-foreign-key-to-elastic-app-search/307769)
**Author:** [@Rustin\_Spencer](https://discuss.elastic.co/u/Rustin_Spencer)\ **Replies:** 2\ **Last updated:** [June 22, 2022, 7:55am UTC](https://discuss.elastic.co/t/mysql-tables-with-foreign-key-to-elastic-app-search/307769 "2022-06-22T07:55:30Z")
How can I manage the relation between 2 tables in Elastic App Search? I have to ingest data from MySQL DB from 2 tables which have foreign key to elastic app search engine. How do I do this? --- ## [Index Policy not taking effect on the specified indexes](https://discuss.elastic.co/t/index-policy-not-taking-effect-on-the-specified-indexes/307796)
**Author:** [@Yashwant\_Shettigar](https://discuss.elastic.co/u/Yashwant_Shettigar)\ **Replies:** 5\ **Last updated:** [June 22, 2022, 6:04am UTC](https://discuss.elastic.co/t/index-policy-not-taking-effect-on-the-specified-indexes/307796 "2022-06-22T06:04:09Z")
Hey Guys, I tried applying default 90\_days\_log\_retention policy to my monitoring-es indexes, but it gets deleted after the 7th day. Not sure where it went wrong. This is settings as per ILM policy for 90 days : { "… --- ## [Notification for unenrollment](https://discuss.elastic.co/t/notification-for-unenrollment/307828)
**Author:** [@jongpil.won](https://discuss.elastic.co/u/jongpil.won)\ **Replies:** 0\ **Last updated:** [June 22, 2022, 5:03am UTC](https://discuss.elastic.co/t/notification-for-unenrollment/307828 "2022-06-22T05:03:18Z")
Unenrollment can be automatically performed through the unenrollment timeout setting in the Fleet UI, so can I get a notification for the event where the unenrollment operates? I'd like to set the result of automaticall… --- ## [Date time issue while sync up using Logstash from Oracle DB to Elasticsearch](https://discuss.elastic.co/t/date-time-issue-while-sync-up-using-logstash-from-oracle-db-to-elasticsearch/307824)
**Author:** [@suresh\_u](https://discuss.elastic.co/u/suresh_u)\ **Replies:** 0\ **Last updated:** [June 22, 2022, 4:05am UTC](https://discuss.elastic.co/t/date-time-issue-while-sync-up-using-logstash-from-oracle-db-to-elasticsearch/307824 "2022-06-22T04:05:41Z")
Hi team, I am using logstash for sync up data from Oracle Db to ElasticSearch index. I am able to sync data but the issue is : In Oracle db, I have 3 date fields. while syncing in ES index, they are storing as UTC. I… --- ## [Memcached not working](https://discuss.elastic.co/t/memcached-not-working/307822)
**Author:** [@paulohperes](https://discuss.elastic.co/u/paulohperes)\ **Replies:** 0\ **Last updated:** [June 22, 2022, 3:57am UTC](https://discuss.elastic.co/t/memcached-not-working/307822 "2022-06-22T03:57:26Z")
I am trying to create a pipeline using the memcached plugin, however it is not working when I create a key in the cache in dictionary format. Here's my pipeline: input { udp { port =\> 514 type =\> sy… --- ## [Where could I find all fields content in event.action?](https://discuss.elastic.co/t/where-could-i-find-all-fields-content-in-event-action/307718)
**Author:** [@Shadow\_CHN](https://discuss.elastic.co/u/Shadow_CHN)\ **Replies:** 4\ **Last updated:** [June 22, 2022, 3:28am UTC](https://discuss.elastic.co/t/where-could-i-find-all-fields-content-in-event-action/307718 "2022-06-22T03:28:56Z")
field event.action can be found in Discover and Security module, my question is where can I find a document explains event.action includes how many and what actions? Like Winlogbeat\\module\\security\\ingest\\security.yml, e… [Previous page](https://discuss.elastic.co/latest.md?page=1077) [Next page](https://discuss.elastic.co/latest.md?page=1079)