# Latest **URL:** https://discuss.elastic.co/latest.md?page=1104 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1105 --- ## [Hardware requirement for my server ELK](https://discuss.elastic.co/t/hardware-requirement-for-my-server-elk/306229)
**Author:** [@Big\_Mara](https://discuss.elastic.co/u/Big_Mara)\ **Replies:** 4\ **Last updated:** [June 3, 2022, 12:05pm UTC](https://discuss.elastic.co/t/hardware-requirement-for-my-server-elk/306229 "2022-06-03T12:05:26Z")
Hi I am new in ELK and I wonder with what can I start if I have many firewalls and I get 200gb of logs per day. The deal is ELK is already installed but the server capacity is not enough so we need to resize it and upgr… --- ## [How to make nodes forget about the old/previous cluster?](https://discuss.elastic.co/t/how-to-make-nodes-forget-about-the-old-previous-cluster/306315)
**Author:** [@AS11](https://discuss.elastic.co/u/AS11)\ **Replies:** 3\ **Last updated:** [June 3, 2022, 12:04pm UTC](https://discuss.elastic.co/t/how-to-make-nodes-forget-about-the-old-previous-cluster/306315 "2022-06-03T12:04:49Z")
I had (and still have) a running 3-node cluster C1. C1 has all 3 nodes (es0,es1,es2) as master nodes. Then, accessible within the same network, I wanted to set up a second cluster C2 (nodes es3,es4,es5), to which I would… --- ## [Need daily data report](https://discuss.elastic.co/t/need-daily-data-report/305913)
**Author:** [@Poojan](https://discuss.elastic.co/u/Poojan)\ **Replies:** 4\ **Last updated:** [June 3, 2022, 11:30am UTC](https://discuss.elastic.co/t/need-daily-data-report/305913 "2022-06-03T11:30:57Z")
Hello guys, I have one question related to kibana alert feature. I want to send daily mail which includes excel sheet shows how much data we are getting daily in Elasticsearch index? is it possible without using any sc… --- ## [ML - Anomaly Detection - Weight Rare against Entity AND Population](https://discuss.elastic.co/t/ml-anomaly-detection-weight-rare-against-entity-and-population/306273)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 1\ **Last updated:** [June 3, 2022, 11:08am UTC](https://discuss.elastic.co/t/ml-anomaly-detection-weight-rare-against-entity-and-population/306273 "2022-06-03T11:08:21Z")
Hi All, I'm attempting to find a way to find anomalies within some data, but I'm having some trouble understanding the correct way to go about it. I want to effectively determine the weight of an anomaly by comparing t… --- ## [Vietnamese support](https://discuss.elastic.co/t/vietnamese-support/305037)
**Author:** [@Jean-Marc\_Autexier](https://discuss.elastic.co/u/Jean-Marc_Autexier)\ **Replies:** 2\ **Last updated:** [June 3, 2022, 10:50am UTC](https://discuss.elastic.co/t/vietnamese-support/305037 "2022-06-03T10:50:49Z")
Hi, the documentation \[1\] does mention the Vietnamese analysis plugin: I already do use the ICU plugin \[2\] for multi language support. How much better is the Vietnamese Plugin compared to ICU for Vietnamese language? … --- ## [Elastic agent indices - ILM Policy Changes](https://discuss.elastic.co/t/elastic-agent-indices-ilm-policy-changes/306320)
**Author:** [@praveen\_raju](https://discuss.elastic.co/u/praveen_raju)\ **Replies:** 0\ **Last updated:** [June 3, 2022, 10:03am UTC](https://discuss.elastic.co/t/elastic-agent-indices-ilm-policy-changes/306320 "2022-06-03T10:03:20Z")
Hello, We have deployed Elastic Agent on 1000+ VM's, i see default ILM policy is being used "metrics" for all the indices created by the elastic agent. Questions: Can we change the settings directly on the ILM polic… --- ## [Kibana Email Alert](https://discuss.elastic.co/t/kibana-email-alert/303013)
**Author:** [@\_Thomas](https://discuss.elastic.co/u/_Thomas)\ **Replies:** 7\ **Last updated:** [June 3, 2022, 9:42am UTC](https://discuss.elastic.co/t/kibana-email-alert/303013 "2022-06-03T09:42:48Z")
Hi Guys, I hope someone can shed some light on a strange thing. Long story short: I would like to receive Email-alerts whenever a certain Event-ID has been triggered. In my case Event ID: 4672 (with this information pa… --- ## [Taxonmy in ES 7.10 using search-time analyzer](https://discuss.elastic.co/t/taxonmy-in-es-7-10-using-search-time-analyzer/306312)
**Author:** [@wardyard](https://discuss.elastic.co/u/wardyard)\ **Replies:** 0\ **Last updated:** [June 3, 2022, 9:31am UTC](https://discuss.elastic.co/t/taxonmy-in-es-7-10-using-search-time-analyzer/306312 "2022-06-03T09:31:32Z")
Hi all! Since I've been struggling with this for quite a while now, I decided to try my luck here :wink: I'm working on a taxonomy search using managed vocabularies, as described in this article: Patterns for Elasticse… --- ## [Installation erreur Localhost:9200](https://discuss.elastic.co/t/installation-erreur-localhost-9200/305957)
**Author:** [@Merveille\_Kimfuta](https://discuss.elastic.co/u/Merveille_Kimfuta)\ **Replies:** 4\ **Last updated:** [June 3, 2022, 9:11am UTC](https://discuss.elastic.co/t/installation-erreur-localhost-9200/305957 "2022-06-03T09:11:17Z")
Bonjour, Etant novice, J'ai suivi ce tutoriel https://www.youtube.com/watch?v=4BtAuGcUjCo&t=93s pour installer ELK sur Windows 10 mais je rencontre ce message d'erreur en pièce jointe. Avez-vous une idée de comment je p… --- ## [Grok pattern construction](https://discuss.elastic.co/t/grok-pattern-construction/305850)
**Author:** [@anushka1203](https://discuss.elastic.co/u/anushka1203)\ **Replies:** 6\ **Last updated:** [June 3, 2022, 9:09am UTC](https://discuss.elastic.co/t/grok-pattern-construction/305850 "2022-06-03T09:09:02Z")
Hi, i need help in constructing the grok pattern for the following logs. had asked the same question earlier here- this pattern %{HTTPDERROR\_DATE:date}\\s:\\s%{LOGLEVEL:log}:%{GREEDYDATA:message} works for the following… --- ## [Licence Upgrade: From Gold to Platinum](https://discuss.elastic.co/t/licence-upgrade-from-gold-to-platinum/306183)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 3\ **Last updated:** [June 3, 2022, 8:47am UTC](https://discuss.elastic.co/t/licence-upgrade-from-gold-to-platinum/306183 "2022-06-03T08:47:54Z")
Hi there, are there any issues to be excted while upgrading out licence from gold to platinum? Thanks and kind regards! --- ## [Threat Intel module with Fleet?](https://discuss.elastic.co/t/threat-intel-module-with-fleet/306112)
**Author:** [@slash24](https://discuss.elastic.co/u/slash24)\ **Replies:** 4\ **Last updated:** [June 3, 2022, 8:44am UTC](https://discuss.elastic.co/t/threat-intel-module-with-fleet/306112 "2022-06-03T08:44:30Z")
Hi, Im only using Fleet-managed workloads in my 7.17-cluster, using Windows, System and Endpoint-integrations. (so filebeat is being utilized on the workloads) Can I use the Threat Intel-module to enrich alerts, and if … --- ## [Unassigned shards after upgrade to 8.2](https://discuss.elastic.co/t/unassigned-shards-after-upgrade-to-8-2/304717)
**Author:** [@Ian\_Simpson](https://discuss.elastic.co/u/Ian_Simpson)\ **Replies:** 6\ **Last updated:** [June 3, 2022, 8:09am UTC](https://discuss.elastic.co/t/unassigned-shards-after-upgrade-to-8-2/304717 "2022-06-03T08:09:45Z")
I am managing an Elasticsearch cluster deployed to our Azure environment. I am trying to upgrade our test single-node cluster from 7.x to 8.2. I have done the following: Upgraded to 7.17.3 and confirmed all shards were… --- ## [Store max value of a metric in a week in elasticsearch](https://discuss.elastic.co/t/store-max-value-of-a-metric-in-a-week-in-elasticsearch/306209)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 2\ **Last updated:** [June 3, 2022, 7:36am UTC](https://discuss.elastic.co/t/store-max-value-of-a-metric-in-a-week-in-elasticsearch/306209 "2022-06-03T07:36:41Z")
Hello! I am currently collecting the metrics of certain services and I am interested in storing the maximum value of a week. I know how to do it with the tsvb visualization but I don't know how to store it in the elasti… --- ## [Disable Replicate Data on Elasticsearch Cluster](https://discuss.elastic.co/t/disable-replicate-data-on-elasticsearch-cluster/306202)
**Author:** [@Xenial](https://discuss.elastic.co/u/Xenial)\ **Replies:** 4\ **Last updated:** [June 3, 2022, 7:34am UTC](https://discuss.elastic.co/t/disable-replicate-data-on-elasticsearch-cluster/306202 "2022-06-03T07:34:20Z")
Hello Elastic Team, I've create Elasticsearch with 3 node, when i send the data, Elasticsearch replicate my original data and consume more storage. How to disable replicated data on Elasticsearch Cluster? Thankyou --- ## [NESTされたフィールドに対するwhitelistの適用について](https://discuss.elastic.co/t/nest-whitelist/306282)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 4\ **Last updated:** [June 3, 2022, 7:08am UTC](https://discuss.elastic.co/t/nest-whitelist/306282 "2022-06-03T07:08:06Z")
下記のようなドキュメントをlogstashにて解析し、Elasticsearchに連携しています。 ～省略～ "timestamp\_log": "2022-06-03T09:01:28.000+09:00", "awsRegion": "us-east-1", "requestParameters": { "template": false, "resourceId": "5tfEXAMPLE", "restApiId":… --- ## [Migrate Elasticsearch Data](https://discuss.elastic.co/t/migrate-elasticsearch-data/306291)
**Author:** [@Xenial](https://discuss.elastic.co/u/Xenial)\ **Replies:** 1\ **Last updated:** [June 3, 2022, 7:04am UTC](https://discuss.elastic.co/t/migrate-elasticsearch-data/306291 "2022-06-03T07:04:56Z")
Hello Elastic Team, I've migrate elastic data from old elastic to new elastic, Data from old index have 90.000.000 Data, but after data migrated, total data in new index just 846.000. Please Help Me, Thankyou --- ## [Logstash won't create new index patterns again](https://discuss.elastic.co/t/logstash-wont-create-new-index-patterns-again/306224)
**Author:** [@Tasdiq\_Shaikh](https://discuss.elastic.co/u/Tasdiq_Shaikh)\ **Replies:** 2\ **Last updated:** [June 3, 2022, 7:00am UTC](https://discuss.elastic.co/t/logstash-wont-create-new-index-patterns-again/306224 "2022-06-03T07:00:07Z")
Previously, I have connected my logstash with PostgreSQL and Elasticsearch and it also created new index pattern, but it wouldnt load data properly so I deleted my index and restarted logstash to create a new index patte… --- ## [Kibana and ssl](https://discuss.elastic.co/t/kibana-and-ssl/306188)
**Author:** [@Stefano\_Bossi](https://discuss.elastic.co/u/Stefano_Bossi)\ **Replies:** 4\ **Last updated:** [June 3, 2022, 6:58am UTC](https://discuss.elastic.co/t/kibana-and-ssl/306188 "2022-06-03T06:58:45Z")
Dear forum members, I am trying to configure SSL to access ES. I have this conf in ES: # Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents xpack.security.http.ssl: client\_authen… --- ## [Configure beats to reload certificates?](https://discuss.elastic.co/t/configure-beats-to-reload-certificates/305976)
**Author:** [@fgjensen](https://discuss.elastic.co/u/fgjensen)\ **Replies:** 2\ **Last updated:** [June 3, 2022, 6:25am UTC](https://discuss.elastic.co/t/configure-beats-to-reload-certificates/305976 "2022-06-03T06:25:05Z")
We deploy most beattypes to hosts managed by different service providers. The beats ships data to Logstash beats endpoints protected with TLS and firewalls. This setup works very well. However, changing expired TLS cert… --- ## [Limit JVM heap](https://discuss.elastic.co/t/limit-jvm-heap/305920)
**Author:** [@gerardgorrion](https://discuss.elastic.co/u/gerardgorrion)\ **Replies:** 13\ **Last updated:** [June 3, 2022, 6:12am UTC](https://discuss.elastic.co/t/limit-jvm-heap/305920 "2022-06-03T06:12:26Z")
Good morning, We have a issue with the limit of JVM heap. Our Elasticsearch data nodes have a data, ingest and master role, and the node that allow it have 32gb of memory and 8 cpu. Our configuration of resources on dat… --- ## [Filebeat multiline json](https://discuss.elastic.co/t/filebeat-multiline-json/306287)
**Author:** [@Panda\_Free](https://discuss.elastic.co/u/Panda_Free)\ **Replies:** 0\ **Last updated:** [June 3, 2022, 6:03am UTC](https://discuss.elastic.co/t/filebeat-multiline-json/306287 "2022-06-03T06:03:28Z")
Hi, please help, spent more one week and cannot get correct parse settings. I have file from AWS Athena query, csv, but coverted to pure multiline json. Structure: \[{ "useridentity":"{type=somevalue={attributes={… --- ## [Gracefully restart logstash after adding an additional pipeline](https://discuss.elastic.co/t/gracefully-restart-logstash-after-adding-an-additional-pipeline/306284)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 0\ **Last updated:** [June 3, 2022, 5:15am UTC](https://discuss.elastic.co/t/gracefully-restart-logstash-after-adding-an-additional-pipeline/306284 "2022-06-03T05:15:33Z")
Hi All, in my logstash.yml I enabled the config.reload.automatic: True and doing it every 30s config.reload.interval: 30s. So now I started adding new pipelines in my pipeline.yml. Once I add a pipeline what I usually… --- ## [Documents size vs. indexing size?](https://discuss.elastic.co/t/documents-size-vs-indexing-size/306255)
**Author:** [@Denis\_Haskin](https://discuss.elastic.co/u/Denis_Haskin)\ **Replies:** 1\ **Last updated:** [June 2, 2022, 7:39pm UTC](https://discuss.elastic.co/t/documents-size-vs-indexing-size/306255 "2022-06-02T19:39:56Z")
We have an existing Kibana/Elastic setup ingesting logs from our infrastructure. I'm trying to determine what the actual documents size is, e.g. I want to exclude indices. Basically, what is the volume of logs coming o… --- ## [How to manage multiple virtual machines to send metrics to ELK](https://discuss.elastic.co/t/how-to-manage-multiple-virtual-machines-to-send-metrics-to-elk/306035)
**Author:** [@skander\_khalfet](https://discuss.elastic.co/u/skander_khalfet)\ **Replies:** 6\ **Last updated:** [June 3, 2022, 2:29am UTC](https://discuss.elastic.co/t/how-to-manage-multiple-virtual-machines-to-send-metrics-to-elk/306035 "2022-06-03T02:29:37Z")
Hello guys i'm trying to build a solution where i could monitor a group of virtual machines. i have installed metricbeat on these machines. what i want to do is send these metrics to my ELK stack deployed on a kubernete… --- ## [How can I connect points with null values in a line chart?](https://discuss.elastic.co/t/how-can-i-connect-points-with-null-values-in-a-line-chart/306200)
**Author:** [@Cusis\_Eel](https://discuss.elastic.co/u/Cusis_Eel)\ **Replies:** 2\ **Last updated:** [June 3, 2022, 2:08am UTC](https://discuss.elastic.co/t/how-can-i-connect-points-with-null-values-in-a-line-chart/306200 "2022-06-03T02:08:51Z")
please help this thanks kibana 7.10.1 --- ## [Multiple Heartbeat In One Windows Server](https://discuss.elastic.co/t/multiple-heartbeat-in-one-windows-server/306249)
**Author:** [@Nicole1](https://discuss.elastic.co/u/Nicole1)\ **Replies:** 6\ **Last updated:** [June 2, 2022, 10:47pm UTC](https://discuss.elastic.co/t/multiple-heartbeat-in-one-windows-server/306249 "2022-06-02T22:47:57Z")
can we have multiple heartbeats in one windows server because we want to monitor 3 different series of endpoints(appcodes).with 3 different heartbeat.yml --- ## [Architecture to use dynamic document read permition](https://discuss.elastic.co/t/architecture-to-use-dynamic-document-read-permition/306269)
**Author:** [@jodinathan](https://discuss.elastic.co/u/jodinathan)\ **Replies:** 1\ **Last updated:** [June 2, 2022, 10:39pm UTC](https://discuss.elastic.co/t/architecture-to-use-dynamic-document-read-permition/306269 "2022-06-02T22:39:26Z")
We need to enable our customers to access our Kibana to create sales reports, however, the sale documents they can read can change over time. Each customer would have their own user in Kibana and a sale document can be … --- ## [Endpoint Security Data (Rollup?)](https://discuss.elastic.co/t/endpoint-security-data-rollup/306217)
**Author:** [@forbiddenera](https://discuss.elastic.co/u/forbiddenera)\ **Replies:** 4\ **Last updated:** [June 2, 2022, 8:57pm UTC](https://discuss.elastic.co/t/endpoint-security-data-rollup/306217 "2022-06-02T20:57:26Z")
Hi, Hopefully this is the right place to post; if not, please move/direct me accordingly, :slight\_smile: I've enabled endpoint security on some of our systems, running under a fleet controlled elastic agent. Initially… --- ## [How to filter aggregated data on the nested object](https://discuss.elastic.co/t/how-to-filter-aggregated-data-on-the-nested-object/306264)
**Author:** [@shri\_palchuri](https://discuss.elastic.co/u/shri_palchuri)\ **Replies:** 0\ **Last updated:** [June 2, 2022, 7:26pm UTC](https://discuss.elastic.co/t/how-to-filter-aggregated-data-on-the-nested-object/306264 "2022-06-02T19:26:39Z")
Here is the payload used to filter the data, holdings is a nested type and in the aggregation it includes non matched count. {"size":0,"query":{"bool":{"filter":\[{"bool":{"filter":\[{"bool":{"should":\[{"bool":{"filter":… [Previous page](https://discuss.elastic.co/latest.md?page=1103) [Next page](https://discuss.elastic.co/latest.md?page=1105)