# Latest **URL:** https://discuss.elastic.co/latest.md?page=1094 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1095 --- ## [Possible to redirect Data Visualizer to existing ingest pipeline for import?](https://discuss.elastic.co/t/possible-to-redirect-data-visualizer-to-existing-ingest-pipeline-for-import/306063)
**Author:** [@fl33t](https://discuss.elastic.co/u/fl33t)\ **Replies:** 1\ **Last updated:** [June 10, 2022, 7:51pm UTC](https://discuss.elastic.co/t/possible-to-redirect-data-visualizer-to-existing-ingest-pipeline-for-import/306063 "2022-06-10T19:51:41Z")
In the ML section, if we know the type of log file that we want to upload for visualization and analysis, would it be possible to redirect it to an existing ingest pipeline (with associated mappings and index settings) i… --- ## [Detection rule testing](https://discuss.elastic.co/t/detection-rule-testing/306911)
**Author:** [@kjjacobs57](https://discuss.elastic.co/u/kjjacobs57)\ **Replies:** 0\ **Last updated:** [June 10, 2022, 7:39pm UTC](https://discuss.elastic.co/t/detection-rule-testing/306911 "2022-06-10T19:39:15Z")
What is the process for testing detection rules that are part of the prebuilt detection rules? Does Elastic certify that prebuilt detections have been tested and work? --- ## [Поиск по началу строки](https://discuss.elastic.co/t/topic/305784)
**Author:** [@yemcoder](https://discuss.elastic.co/u/yemcoder)\ **Replies:** 1\ **Last updated:** [June 10, 2022, 7:25pm UTC](https://discuss.elastic.co/t/topic/305784 "2022-06-10T19:25:25Z")
Здравствуйте Исходные данные POST test/\_bulk { "index" : { "\_id" : "1" } } {"localizedName": {"name": "iPhone 12"} } { "index" : { "\_id" : "2" } } {"localizedName": {"name": "Чехол для iPhone 12 Pro"} } Поисковый за… --- ## [Последовательный запрос к нескольким индексам](https://discuss.elastic.co/t/topic/306184)
**Author:** [@Evgeny\_Antipin](https://discuss.elastic.co/u/Evgeny_Antipin)\ **Replies:** 1\ **Last updated:** [June 10, 2022, 7:20pm UTC](https://discuss.elastic.co/t/topic/306184 "2022-06-10T19:20:44Z")
Доброго дня! Я создал индекс некой информации по потребителям. Одно из полей индекса - "Подразделение". Тип keyword, пишу просто код записи. Ищу по точному соответствию. Появилась необходимость наложить фильтр доступны… --- ## [Protocol Analysis Lab](https://discuss.elastic.co/t/protocol-analysis-lab/306844)
**Author:** [@chmeza](https://discuss.elastic.co/u/chmeza)\ **Replies:** 1\ **Last updated:** [June 10, 2022, 6:43pm UTC](https://discuss.elastic.co/t/protocol-analysis-lab/306844 "2022-06-10T18:43:28Z")
Hello I have started this course but I can't find the labs instructions . I got the protocol-analysis-lab-guide.pdf following the instructions I logged in the CTF and unlocked the “Challenges” then I got new sections a… --- ## [Filebeat not reading logs from subdirectories](https://discuss.elastic.co/t/filebeat-not-reading-logs-from-subdirectories/306905)
**Author:** [@garry12](https://discuss.elastic.co/u/garry12)\ **Replies:** 3\ **Last updated:** [June 10, 2022, 6:42pm UTC](https://discuss.elastic.co/t/filebeat-not-reading-logs-from-subdirectories/306905 "2022-06-10T18:42:03Z")
Hey team, I am relatively new to ELK stack and I am trying to send logs from a linux servers to Elasticsearch. The path I am choosing is - I have installed the filebeat on linux server where my application logs are gett… --- ## [Case insensitive wildcard search in 7.17.0](https://discuss.elastic.co/t/case-insensitive-wildcard-search-in-7-17-0/306903)
**Author:** [@mej101](https://discuss.elastic.co/u/mej101)\ **Replies:** 2\ **Last updated:** [June 10, 2022, 6:33pm UTC](https://discuss.elastic.co/t/case-insensitive-wildcard-search-in-7-17-0/306903 "2022-06-10T18:33:27Z")
I'm running Elasticsearch 7.17.0, and when I try to run the following query: GET index\_name/\_search { "query": { "wildcard": { "fieldName.subfield": "\*view", "case\_insensitive": true } } } I get… --- ## [Creating a watcher to check for no data in all the indices](https://discuss.elastic.co/t/creating-a-watcher-to-check-for-no-data-in-all-the-indices/306808)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 2\ **Last updated:** [June 10, 2022, 3:57pm UTC](https://discuss.elastic.co/t/creating-a-watcher-to-check-for-no-data-in-all-the-indices/306808 "2022-06-10T15:57:47Z")
Hello team, I need to create watcher to check for no data in all the indices. I have total 100+ indices. I am using below script. in indices, i am putting \* is this work? I need all index name in body which have 0 re… --- ## ["Unable to lock JVM Memory: error=12, reason=Cannot allocate memory"](https://discuss.elastic.co/t/unable-to-lock-jvm-memory-error-12-reason-cannot-allocate-memory/306000)
**Author:** [@amitsa](https://discuss.elastic.co/u/amitsa)\ **Replies:** 7\ **Last updated:** [June 10, 2022, 3:40pm UTC](https://discuss.elastic.co/t/unable-to-lock-jvm-memory-error-12-reason-cannot-allocate-memory/306000 "2022-06-10T15:40:37Z")
I have enabled bootstrap.memory\_lock: true ERROR: \[1\] bootstrap checks failed. You must address the points described in the following \[1\] lines before starting Elasticsearch. bootstrap check failure \[1\] of \[1\]: memory… --- ## [Can't use variables in containing a slash in elastic-agent configuration](https://discuss.elastic.co/t/cant-use-variables-in-containing-a-slash-in-elastic-agent-configuration/306902)
**Author:** [@antex](https://discuss.elastic.co/u/antex)\ **Replies:** 0\ **Last updated:** [June 10, 2022, 3:39pm UTC](https://discuss.elastic.co/t/cant-use-variables-in-containing-a-slash-in-elastic-agent-configuration/306902 "2022-06-10T15:39:09Z")
I'm trying to define a condition in an elastic-agent configuration where the variable contains a slash, e.g.: streams: - id: \>- filestream-kubernetes.container\_logs-catchall d… --- ## [ILM policy: Document count reduced but Index count unchanged](https://discuss.elastic.co/t/ilm-policy-document-count-reduced-but-index-count-unchanged/306899)
**Author:** [@Chris\_Stone](https://discuss.elastic.co/u/Chris_Stone)\ **Replies:** 0\ **Last updated:** [June 10, 2022, 3:15pm UTC](https://discuss.elastic.co/t/ilm-policy-document-count-reduced-but-index-count-unchanged/306899 "2022-06-10T15:15:12Z")
A timeline of events: At some point, I inadvertently changed max index size changed from 50GB to 1GB. After some time, I began getting circuit-breaker errors about maxing out the Java heap (31GB on each of the 4 nodes)… --- ## [How to get the time a query spends in the queue before the shards receives the query](https://discuss.elastic.co/t/how-to-get-the-time-a-query-spends-in-the-queue-before-the-shards-receives-the-query/306897)
**Author:** [@shivam\_agrawal1](https://discuss.elastic.co/u/shivam_agrawal1)\ **Replies:** 0\ **Last updated:** [June 10, 2022, 1:58pm UTC](https://discuss.elastic.co/t/how-to-get-the-time-a-query-spends-in-the-queue-before-the-shards-receives-the-query/306897 "2022-06-10T13:58:34Z")
The took\_millis in Elasticsearch slow logs tells the time it takes on execution on the shard level, it does not encounter the time it spends in the queue. How to get the time. a query spends in the queue before it is pas… --- ## [How to insert the labels inside the pie chart](https://discuss.elastic.co/t/how-to-insert-the-labels-inside-the-pie-chart/306154)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 3\ **Last updated:** [June 10, 2022, 1:25pm UTC](https://discuss.elastic.co/t/how-to-insert-the-labels-inside-the-pie-chart/306154 "2022-06-10T13:25:11Z")
I want to organize these values inside the colored parts of the chart. I know that by Label radius you can set the distance from the center but I wanted a way to organize them so they fit inside the slices...Is it avaiab… --- ## [Java::JavaLang::IllegalStateException\` for \`PipelineAction::Create\\`"](https://discuss.elastic.co/t/java-illegalstateexception-for-pipelineaction-create-main/306871)
**Author:** [@akjain3](https://discuss.elastic.co/u/akjain3)\ **Replies:** 1\ **Last updated:** [June 10, 2022, 12:44pm UTC](https://discuss.elastic.co/t/java-illegalstateexception-for-pipelineaction-create-main/306871 "2022-06-10T12:44:29Z")
Hi, I am new to logstash and using logstash to add my logs with Elasticsearch. But I can't get through this error. Please help. It is urgent. Using bundled JDK: /Users/akjain3cisco.com/Documents/ELK/logstash-7.15.2/jdk.… --- ## [Persistent Volume / Docker installation](https://discuss.elastic.co/t/persistent-volume-docker-installation/306886)
**Author:** [@Phildefer](https://discuss.elastic.co/u/Phildefer)\ **Replies:** 0\ **Last updated:** [June 10, 2022, 12:26pm UTC](https://discuss.elastic.co/t/persistent-volume-docker-installation/306886 "2022-06-10T12:26:10Z")
Hi, I would like how to install Elasticsearch with a persistent volume for the data in order to be able to upgrade Elasticsearch without loosing the indexes. Thank you --- ## [Issue while running the logstash](https://discuss.elastic.co/t/issue-while-running-the-logstash/306884)
**Author:** [@Akanksha2022](https://discuss.elastic.co/u/Akanksha2022)\ **Replies:** 1\ **Last updated:** [June 10, 2022, 12:16pm UTC](https://discuss.elastic.co/t/issue-while-running-the-logstash/306884 "2022-06-10T12:16:09Z")
runner - The given configuration is invalid. Reason: Failed to parse right-hand side of conditional \[file\]/etc/logstash/conf.d/logstash-grok.conf:70:45:\`\`\` --- ## [\[2018-05-27T08:46:23,536\]\[ERROR\]\[logstash.outputs.elasticsearch\] Encountered a retryable error. Will Retry with exponential backoff {:code=\>413, :url=\>"http://elasticsearch\_address:9200/\_bulk"}](https://discuss.elastic.co/t/2018-05-27t0823-536-error-logstash-outputs-elasticsearch-encountered-a-retryable-error-will-retry-with-exponential-backoff-code-413-url-http-elasticsearch-address-9200-bulk/306876)
**Author:** [@Manohar22](https://discuss.elastic.co/u/Manohar22)\ **Replies:** 0\ **Last updated:** [June 10, 2022, 11:37am UTC](https://discuss.elastic.co/t/2018-05-27t0823-536-error-logstash-outputs-elasticsearch-encountered-a-retryable-error-will-retry-with-exponential-backoff-code-413-url-http-elasticsearch-address-9200-bulk/306876 "2022-06-10T11:37:44Z")
Continuing the discussion from Logstash stuck on "Will Retry with exponential backoff": we are seeing below error in logstash logs \[2022-06-10T04:59:38,367\]\[ERROR\]\[logstash.filters.ruby \] Ruby exception occurred: \[… --- ## [Filebeat's harvester cleanup method](https://discuss.elastic.co/t/filebeats-harvester-cleanup-method/306872)
**Author:** [@xiongjunkun](https://discuss.elastic.co/u/xiongjunkun)\ **Replies:** 0\ **Last updated:** [June 10, 2022, 10:59am UTC](https://discuss.elastic.co/t/filebeats-harvester-cleanup-method/306872 "2022-06-10T10:59:57Z")
Ask a question, when Filebeat's harvester is executed, it will call the cleanup method. Why does it need to send an additional state: h.SendStateUpdate()? Is there something wrong with persisting state through events sen… --- ## [\[WARN \]\[o.e.x.s.t.n.SecurityNetty4HttpServerTransport\] \[crud\_node\] http client did not trust this server's certificate, closing connection Netty4HttpChannel{localAddress=/127.0.0.1:9200](https://discuss.elastic.co/t/warn-o-e-x-s-t-n-securitynetty4httpservertransport-crud-node-http-client-did-not-trust-this-servers-certificate-closing-connection-netty4httpchannel-localaddress-127-0-0-1-9200/306859)
**Author:** [@Axel\_Ekenberg](https://discuss.elastic.co/u/Axel_Ekenberg)\ **Replies:** 0\ **Last updated:** [June 10, 2022, 9:05am UTC](https://discuss.elastic.co/t/warn-o-e-x-s-t-n-securitynetty4httpservertransport-crud-node-http-client-did-not-trust-this-servers-certificate-closing-connection-netty4httpchannel-localaddress-127-0-0-1-9200/306859 "2022-06-10T09:05:14Z")
Hi! I just started with the ELK stack and i have downloaded kibana, logstash, Elasticsearch, made a config file in my logstash folder and i start Elasticsearch and it works well and then when i run logstash with "logstas… --- ## [Installing Kibana from source](https://discuss.elastic.co/t/installing-kibana-from-source/306045)
**Author:** [@Amphagory](https://discuss.elastic.co/u/Amphagory)\ **Replies:** 6\ **Last updated:** [June 10, 2022, 10:51am UTC](https://discuss.elastic.co/t/installing-kibana-from-source/306045 "2022-06-10T10:51:50Z")
Hello, I have built Kibana 8.2.0 from source following these instructions. It has made a folder call build with 3 sub folders: default, Kibana, Kibana-docker. I couldn't find documentation on how to install my build o… --- ## [Need to remove first 10 characters using grok](https://discuss.elastic.co/t/need-to-remove-first-10-characters-using-grok/306864)
**Author:** [@Giuse\_Esse](https://discuss.elastic.co/u/Giuse_Esse)\ **Replies:** 0\ **Last updated:** [June 10, 2022, 9:43am UTC](https://discuss.elastic.co/t/need-to-remove-first-10-characters-using-grok/306864 "2022-06-10T09:43:06Z")
Hello i need to remove first 10 char in the grok, I can get first 10 but not exclude... grok { match =\> { "message" =\> "(?\^.{-10})" … --- ## [GeoDistanceQuery Not Working](https://discuss.elastic.co/t/geodistancequery-not-working/306780)
**Author:** [@cugo](https://discuss.elastic.co/u/cugo)\ **Replies:** 1\ **Last updated:** [June 9, 2022, 2:23pm UTC](https://discuss.elastic.co/t/geodistancequery-not-working/306780 "2022-06-09T14:23:05Z")
I am trying to create a Geo Distance filter using Spring Data Elasticsearch like the one below which is a working example created by JSON. "filter":{ "geo\_distance":{ "distance":"32.42742km", … --- ## [Show search result based on keywords](https://discuss.elastic.co/t/show-search-result-based-on-keywords/305617)
**Author:** [@silvermanoj](https://discuss.elastic.co/u/silvermanoj)\ **Replies:** 7\ **Last updated:** [June 10, 2022, 8:48am UTC](https://discuss.elastic.co/t/show-search-result-based-on-keywords/305617 "2022-06-10T08:48:36Z")
I am using Elasticsearch version 8. When I try to query a combination of two words that are stored in two different attributes, I get the search result but the record match with post\_title are not coming first For examp… --- ## [BitSet.or took high cpu usage](https://discuss.elastic.co/t/bitset-or-took-high-cpu-usage/306786)
**Author:** [@chembohuang](https://discuss.elastic.co/u/chembohuang)\ **Replies:** 2\ **Last updated:** [June 10, 2022, 8:35am UTC](https://discuss.elastic.co/t/bitset-or-took-high-cpu-usage/306786 "2022-06-10T08:35:14Z")
Continuing the discussion from BitSet.or consumes almost 60% cpu: We found sth. new here. In fact , we ran into this problem twice after the topic was closed. And We found some similarities in these cases: this proble… --- ## [Getting an idea for resources required to locally deploy the ELK stack](https://discuss.elastic.co/t/getting-an-idea-for-resources-required-to-locally-deploy-the-elk-stack/306853)
**Author:** [@ahamza](https://discuss.elastic.co/u/ahamza)\ **Replies:** 0\ **Last updated:** [June 10, 2022, 8:12am UTC](https://discuss.elastic.co/t/getting-an-idea-for-resources-required-to-locally-deploy-the-elk-stack/306853 "2022-06-10T08:12:56Z")
Hey, I've recently started reading up on the ELK stack and I want to understand what sort of hardware requirements I would have to do an on-premise deployment. I have about 9.5GB + 3.5GB (~13GB total) of log data comi… --- ## [Elasticsearch + Kibana on Docker](https://discuss.elastic.co/t/elasticsearch-kibana-on-docker/306849)
**Author:** [@dandago](https://discuss.elastic.co/u/dandago)\ **Replies:** 0\ **Last updated:** [June 10, 2022, 6:59am UTC](https://discuss.elastic.co/t/elasticsearch-kibana-on-docker/306849 "2022-06-10T06:59:17Z")
I'd like to just quickly run an instance of Elasticsearch and Kibana together using Docker. Having to set up all this seems overkill. Is there an easier way? --- ## [\[SOLVED WITH SADES\] Kibana server is not ready yet. After a reboot it stopped working](https://discuss.elastic.co/t/solved-with-sades-kibana-server-is-not-ready-yet-after-a-reboot-it-stopped-working/306847)
**Author:** [@abkrim](https://discuss.elastic.co/u/abkrim)\ **Replies:** 1\ **Last updated:** [June 10, 2022, 6:30am UTC](https://discuss.elastic.co/t/solved-with-sades-kibana-server-is-not-ready-yet-after-a-reboot-it-stopped-working/306847 "2022-06-10T06:30:37Z")
It is not the first time that I have faced this error, in an operational installation, that after a restart of either the server or a restart of the elasticcsearch + kibana service, has as a result this fatal message tha… --- ## [Exception in Ingest using NEST.Attachment after upgrade to 8.2.2](https://discuss.elastic.co/t/exception-in-ingest-using-nest-attachment-after-upgrade-to-8-2-2/306800)
**Author:** [@mbooh](https://discuss.elastic.co/u/mbooh)\ **Replies:** 6\ **Last updated:** [June 10, 2022, 6:23am UTC](https://discuss.elastic.co/t/exception-in-ingest-using-nest-attachment-after-upgrade-to-8-2-2/306800 "2022-06-10T06:23:29Z")
Hi! I have upgraded Elasticsearch to 8.2.2 from 7.17.3, we are still using Elasticsearch.Net and NEST 7.17.2. To this we use Ingest for file search and we have a field of type NEST.Attachment on our model. Then we have… --- ## [How to configure NEST for separate Elastic and Kibana hosts?](https://discuss.elastic.co/t/how-to-configure-nest-for-separate-elastic-and-kibana-hosts/306834)
**Author:** [@paolovalladolid](https://discuss.elastic.co/u/paolovalladolid)\ **Replies:** 1\ **Last updated:** [June 10, 2022, 6:04am UTC](https://discuss.elastic.co/t/how-to-configure-nest-for-separate-elastic-and-kibana-hosts/306834 "2022-06-10T06:04:46Z")
In Filebeat and Winlogbeat, the configuration files have separate sections for output.Elasticsearch and setup.kibana. It was easy to figure out where to put the Elasticsearch host and the Kibana host - which are 2 dif… --- ## [Generate PDF report not working in Kibana](https://discuss.elastic.co/t/generate-pdf-report-not-working-in-kibana/305674)
**Author:** [@pranay\_jain](https://discuss.elastic.co/u/pranay_jain)\ **Replies:** 11\ **Last updated:** [June 10, 2022, 5:59am UTC](https://discuss.elastic.co/t/generate-pdf-report-not-working-in-kibana/305674 "2022-06-10T05:59:42Z")
Hi, I am trying to generate the PDF report from Kibana dashboard but I end up getting the warning 'The "open URL" phase took longer than 60 seconds. You may need to increase "xpack.reporting.capture.timeouts.openUrl" I… [Previous page](https://discuss.elastic.co/latest.md?page=1093) [Next page](https://discuss.elastic.co/latest.md?page=1095)