# Latest **URL:** https://discuss.elastic.co/latest.md?page=1256 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1257 --- ## [Index pattern issue](https://discuss.elastic.co/t/index-pattern-issue/297339)
**Author:** [@Barak\_Katz](https://discuss.elastic.co/u/Barak_Katz)\ **Replies:** 3\ **Last updated:** [February 17, 2022, 12:57pm UTC](https://discuss.elastic.co/t/index-pattern-issue/297339 "2022-02-17T12:57:17Z")
Hi, I am using Kibana: v 7.9.1. After I created an index pattern I am navigating to a blank page, in other words I can't see the configuration of the inext pattern. Moreover I tried to delete that specific index patte… --- ## [Forcasting reindexing](https://discuss.elastic.co/t/forcasting-reindexing/297433)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 2\ **Last updated:** [February 17, 2022, 11:53am UTC](https://discuss.elastic.co/t/forcasting-reindexing/297433 "2022-02-17T11:53:45Z")
Good morning I need to know if there is a way to reindex the data in the forcasting module of machinelearning - kibana, I need to extract the data and index it in another index or reindex it. I look forward to your pro… --- ## [Cutoff Frequency for match queries](https://discuss.elastic.co/t/cutoff-frequency-for-match-queries/296529)
**Author:** [@Brodin](https://discuss.elastic.co/u/Brodin)\ **Replies:** 5\ **Last updated:** [February 17, 2022, 11:21am UTC](https://discuss.elastic.co/t/cutoff-frequency-for-match-queries/296529 "2022-02-17T11:21:48Z")
According to this Match query | Elasticsearch Guide \[7.17\] | Elastic Cutoff frequency is deprecated and no longer needed, however I am seeing vastly different result for my match query when I remove it. So which one is… --- ## [My cluster keep dropping node and changing master "failed to writeCluster State"](https://discuss.elastic.co/t/my-cluster-keep-dropping-node-and-changing-master-failed-to-writecluster-state/297219)
**Author:** [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\ **Replies:** 8\ **Last updated:** [February 17, 2022, 11:13am UTC](https://discuss.elastic.co/t/my-cluster-keep-dropping-node-and-changing-master-failed-to-writecluster-state/297219 "2022-02-17T11:13:45Z")
Hello, My cluster keep dropping one node randomly everytime, which made the stack instable, sometimes it takes more than 3 hours to rejoin that node and recover. My cluster compose of 4 nodes : 1 coordinator . 3 data… --- ## [Fleet agent custom log integration multiline settings](https://discuss.elastic.co/t/fleet-agent-custom-log-integration-multiline-settings/297124)
**Author:** [@thwint](https://discuss.elastic.co/u/thwint)\ **Replies:** 1\ **Last updated:** [February 17, 2022, 10:02am UTC](https://discuss.elastic.co/t/fleet-agent-custom-log-integration-multiline-settings/297124 "2022-02-17T10:02:55Z")
Hello all, I try to setup a custom log policy for our java logs. Previously we used filebeat and had the following lines in filebeat.yml to configure multiline log entries: multiline: match: after negate: tru… --- ## [Logstash send data to 2 elastic search clusters](https://discuss.elastic.co/t/logstash-send-data-to-2-elastic-search-clusters/297468)
**Author:** [@gangireddy\_l](https://discuss.elastic.co/u/gangireddy_l)\ **Replies:** 0\ **Last updated:** [February 17, 2022, 9:57am UTC](https://discuss.elastic.co/t/logstash-send-data-to-2-elastic-search-clusters/297468 "2022-02-17T09:57:09Z")
HI Team, I have a scenario to send same logs to both production and preproduction elastic cluster, Is there any possibility to do that. Regards, Reddy --- ## [Access to Netty4Plugin(transport-netty4) in custom plugins to run test codes with RestClient and ESIntegTestCase in version 8.0.0](https://discuss.elastic.co/t/access-to-netty4plugin-transport-netty4-in-custom-plugins-to-run-test-codes-with-restclient-and-esintegtestcase-in-version-8-0-0/297288)
**Author:** [@harori](https://discuss.elastic.co/u/harori)\ **Replies:** 1\ **Last updated:** [February 17, 2022, 9:42am UTC](https://discuss.elastic.co/t/access-to-netty4plugin-transport-netty4-in-custom-plugins-to-run-test-codes-with-restclient-and-esintegtestcase-in-version-8-0-0/297288 "2022-02-17T09:42:45Z")
Hello! First of all, I'd like to say thank you for maintaining such great projects and communities. I'm big fan of Elasticsearch. I wrote several custom plugins for Elasticsearch, and I have some test codes which use E… --- ## [Logstash could not receive log after several minutes](https://discuss.elastic.co/t/logstash-could-not-receive-log-after-several-minutes/297462)
**Author:** [@Stevenssssss](https://discuss.elastic.co/u/Stevenssssss)\ **Replies:** 1\ **Last updated:** [February 17, 2022, 9:37am UTC](https://discuss.elastic.co/t/logstash-could-not-receive-log-after-several-minutes/297462 "2022-02-17T09:37:02Z")
Hi, my logstash is able to receive the log when the service is started. However after several minutes, it could not receive the log. I could not find any error message in syslog or logstash-plain.log. I then run the /us… --- ## [Adding replicas during forcemerge - is this supposed to happen?](https://discuss.elastic.co/t/adding-replicas-during-forcemerge-is-this-supposed-to-happen/297464)
**Author:** [@nisow95612](https://discuss.elastic.co/u/nisow95612)\ **Replies:** 0\ **Last updated:** [February 17, 2022, 9:36am UTC](https://discuss.elastic.co/t/adding-replicas-during-forcemerge-is-this-supposed-to-happen/297464 "2022-02-17T09:36:53Z")
Hello nice people of Elasticsearch. Recently I accidentally upped the number of replicas from 0 to 1 during a forcemerge. End result: Replica got created from non-merged primary and stayed unmerged. Is this supposed… --- ## ["existing\_package" spam](https://discuss.elastic.co/t/existing-package-spam/297455)
**Author:** [@ziv1](https://discuss.elastic.co/u/ziv1)\ **Replies:** 0\ **Last updated:** [February 17, 2022, 8:55am UTC](https://discuss.elastic.co/t/existing-package-spam/297455 "2022-02-17T08:55:45Z")
Hi, Earlier today from the server I'm testing Auditbeat on, I got a spam of several hundred "existing\_package" events. (For reference, RHEL) I get the exact same spam every day. Considering it was around 5AM, I don't … --- ## [plugins.scanDirs is deprecated and is no longer used](https://discuss.elastic.co/t/plugins-scandirs-is-deprecated-and-is-no-longer-used/297457)
**Author:** [@Usman18](https://discuss.elastic.co/u/Usman18)\ **Replies:** 1\ **Last updated:** [February 17, 2022, 9:04am UTC](https://discuss.elastic.co/t/plugins-scandirs-is-deprecated-and-is-no-longer-used/297457 "2022-02-17T09:04:31Z")
How to get rid of this deprecation warning. I am using kibana 7.15.2 "type":"log","@timestamp":"2022-02-17T08:10:42+00:00","tags":\["warning","config","deprecation"\],"pid":8,"message":"plugins.scanDirs is deprecated and … --- ## [Lucene query syntax won't work](https://discuss.elastic.co/t/lucene-query-syntax-wont-work/296828)
**Author:** [@Martin\_Miloshev](https://discuss.elastic.co/u/Martin_Miloshev)\ **Replies:** 2\ **Last updated:** [February 17, 2022, 9:00am UTC](https://discuss.elastic.co/t/lucene-query-syntax-wont-work/296828 "2022-02-17T09:00:21Z")
Hi guys! I am trying to specify a table which I want to meet an amount of logs of three fields. for example: metadata.environment: "prod" and metadata.component: "my-services" and level:"ERROR" Unfortunately, i get n… --- ## [Extra processor in ingest pipeline disappears after upgrade](https://discuss.elastic.co/t/extra-processor-in-ingest-pipeline-disappears-after-upgrade/297290)
**Author:** [@hermlam](https://discuss.elastic.co/u/hermlam)\ **Replies:** 1\ **Last updated:** [February 17, 2022, 8:59am UTC](https://discuss.elastic.co/t/extra-processor-in-ingest-pipeline-disappears-after-upgrade/297290 "2022-02-17T08:59:55Z")
I am looking for a solution for my ingest pipeline, in this case logs-system.syslog-1.6.4. I added a KV-processor for customized syslog of my Raspberry Pies. But with every update of elastic this add processor is gone … --- ## [Elastic Update Script avoid dynamic script compilations](https://discuss.elastic.co/t/elastic-update-script-avoid-dynamic-script-compilations/295236)
**Author:** [@Siegi](https://discuss.elastic.co/u/Siegi)\ **Replies:** 5\ **Last updated:** [February 17, 2022, 8:51am UTC](https://discuss.elastic.co/t/elastic-update-script-avoid-dynamic-script-compilations/295236 "2022-02-17T08:51:42Z")
Hey there, after my elastic usage is growing, I ran into the script.max\_compilations\_rate( TransportError(500, 'general\_script\_exception', '\[script\] Too many dynamic script compilations ) in my updates. I use update… --- ## [Combining Painless and Mustache](https://discuss.elastic.co/t/combining-painless-and-mustache/296209)
**Author:** [@Navanit\_dubey](https://discuss.elastic.co/u/Navanit_dubey)\ **Replies:** 3\ **Last updated:** [February 17, 2022, 8:44am UTC](https://discuss.elastic.co/t/combining-painless-and-mustache/296209 "2022-02-17T08:44:08Z")
Can I make a template using both the painless script and mustache. So as to make a search query where the search is done by mustache template and its done insde the painless language query. --- ## [Remaining shards after using allocation.exclude](https://discuss.elastic.co/t/remaining-shards-after-using-allocation-exclude/297349)
**Author:** [@Angelos](https://discuss.elastic.co/u/Angelos)\ **Replies:** 3\ **Last updated:** [February 17, 2022, 8:39am UTC](https://discuss.elastic.co/t/remaining-shards-after-using-allocation-exclude/297349 "2022-02-17T08:39:46Z")
Hey! I wanted to drain one out of the 9 nodes and I used allocation.exclude attribute: PUT \_cluster/settings { "transient": { "cluster.routing.allocation.exclude.\_ip" : "1.2.3.4" } } The problem is that after … --- ## [How to extend an existing visualisation in a custom plugin](https://discuss.elastic.co/t/how-to-extend-an-existing-visualisation-in-a-custom-plugin/297452)
**Author:** [@Shreeya\_Rajguru](https://discuss.elastic.co/u/Shreeya_Rajguru)\ **Replies:** 0\ **Last updated:** [February 17, 2022, 8:05am UTC](https://discuss.elastic.co/t/how-to-extend-an-existing-visualisation-in-a-custom-plugin/297452 "2022-02-17T08:05:33Z")
Hi, I want to extend the Control Visualisation in my custom plugin and make following changes in its implementation : Add a Sort Field to sort the Options List according to a field, eg. timestamp to get the latest rec… --- ## [Unable to retrieve version information from Elasticsearch nodes. connect ECONNREFUSED ip:9200](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes-connect-econnrefused-ip-9200/297338)
**Author:** [@devopshulk](https://discuss.elastic.co/u/devopshulk)\ **Replies:** 6\ **Last updated:** [February 17, 2022, 7:46am UTC](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes-connect-econnrefused-ip-9200/297338 "2022-02-17T07:46:09Z")
"message":"Unable to retrieve version information from Elasticsearch nodes. self signed certificate in certificate chain","log":{"level":"ERROR","logger":"Elasticsearch-service"}, --- ## [How to compress data when write into es](https://discuss.elastic.co/t/how-to-compress-data-when-write-into-es/297371)
**Author:** [@dalei2019](https://discuss.elastic.co/u/dalei2019)\ **Replies:** 4\ **Last updated:** [February 17, 2022, 7:42am UTC](https://discuss.elastic.co/t/how-to-compress-data-when-write-into-es/297371 "2022-02-17T07:42:20Z")
Hi team, I want to build an ES cluster for services in other regions, so ES needs to be exposed to the public network. The amount of data transferred is 2 T /day , it's huge . So I expect to compress before writing in… --- ## [Rsyslog with redis =\> ELK is not showing any logs](https://discuss.elastic.co/t/rsyslog-with-redis-elk-is-not-showing-any-logs/297285)
**Author:** [@Iggy](https://discuss.elastic.co/u/Iggy)\ **Replies:** 1\ **Last updated:** [February 17, 2022, 7:27am UTC](https://discuss.elastic.co/t/rsyslog-with-redis-elk-is-not-showing-any-logs/297285 "2022-02-17T07:27:50Z")
If anyone here can help a newbie out, I would be so happy! It kind of feels like hitting a brick wall at this point. I am not in the rush, as I am just learning ELK, but any help would lift my spirits. --- ## [Set a global TLS CA for security, snapshot , reindex etc](https://discuss.elastic.co/t/set-a-global-tls-ca-for-security-snapshot-reindex-etc/297389)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 2\ **Last updated:** [February 17, 2022, 7:18am UTC](https://discuss.elastic.co/t/set-a-global-tls-ca-for-security-snapshot-reindex-etc/297389 "2022-02-17T07:18:38Z")
Dont know if this is possible already? How to setup TLS CA for everything: snapshot S3 against custom repositories clustering security TLS --- ## [Weird Elasticsearch version in kibana (cluster overview) after upgrade to 8](https://discuss.elastic.co/t/weird-elasticsearch-version-in-kibana-cluster-overview-after-upgrade-to-8/297360)
**Author:** [@AlexeyZhuravlev](https://discuss.elastic.co/u/AlexeyZhuravlev)\ **Replies:** 4\ **Last updated:** [February 17, 2022, 7:04am UTC](https://discuss.elastic.co/t/weird-elasticsearch-version-in-kibana-cluster-overview-after-upgrade-to-8/297360 "2022-02-17T07:04:46Z")
Hi, Updated a single-node test installation from 7.17 to 8. Almost all went smooth (got minor issues with kibana's logging.dest parameter stuck in the unit file). And now I see this: --- ## [Shard Failed: marking and sending shard failed due to \[failed recovery\]](https://discuss.elastic.co/t/shard-failed-marking-and-sending-shard-failed-due-to-failed-recovery/297352)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 2\ **Last updated:** [February 17, 2022, 6:24am UTC](https://discuss.elastic.co/t/shard-failed-marking-and-sending-shard-failed-due-to-failed-recovery/297352 "2022-02-17T06:24:21Z")
Hi, I've installed a new windows ELK stack for testing, worked once but then got the below errors when trying to run again. I can see that there are issues with shards, but don't know how to fix this. \[2022-02-16T11:… --- ## [Enable Graph in Kibana 7.17.0](https://discuss.elastic.co/t/enable-graph-in-kibana-7-17-0/297437)
**Author:** [@Scorpion21](https://discuss.elastic.co/u/Scorpion21)\ **Replies:** 2\ **Last updated:** [February 17, 2022, 5:58am UTC](https://discuss.elastic.co/t/enable-graph-in-kibana-7-17-0/297437 "2022-02-17T05:58:38Z")
I'd like to draw a network topology diagram using Graph According to the configuration guide here, seems I should be able to use graph analytics features straight away after deploying Kibana 7.17. However, I cannot f… --- ## [Include & Exclude of 500k ids in a search query](https://discuss.elastic.co/t/include-exclude-of-500k-ids-in-a-search-query/296428)
**Author:** [@sanders\_2345](https://discuss.elastic.co/u/sanders_2345)\ **Replies:** 4\ **Last updated:** [February 8, 2022, 12:32pm UTC](https://discuss.elastic.co/t/include-exclude-of-500k-ids-in-a-search-query/296428 "2022-02-08T12:32:52Z")
Problem statement: We've millions of ids stored in another Id store. These ids we're generating from the application & will be as same es doc id. Here, for certain use-cases, we want to include & exclude these ids in a … --- ## [Logstash not getting rolled over](https://discuss.elastic.co/t/logstash-not-getting-rolled-over/297022)
**Author:** [@jwilfreds](https://discuss.elastic.co/u/jwilfreds)\ **Replies:** 7\ **Last updated:** [February 16, 2022, 2:47pm UTC](https://discuss.elastic.co/t/logstash-not-getting-rolled-over/297022 "2022-02-16T14:47:40Z")
The logstash file is not getting rolled over. the setup was set for 5 MB and the lifecyle policy added to it. But it grew to 100 GB. No one noticed it until we started getting the server utilization alerts. How do I crea… --- ## [Incomplete/duplicated trace in transaction](https://discuss.elastic.co/t/incomplete-duplicated-trace-in-transaction/296936)
**Author:** [@Evaldo\_Neto](https://discuss.elastic.co/u/Evaldo_Neto)\ **Replies:** 2\ **Last updated:** [February 17, 2022, 2:51am UTC](https://discuss.elastic.co/t/incomplete-duplicated-trace-in-transaction/296936 "2022-02-17T02:51:00Z")
Kibana version: 7.16.3 Elasticsearch version: 7.16.3 APM Server version: 7.16.3 APM Agent language and version: java 1.29.0 Browser version: irrelevant Original install method (e.g. download page, yum, deb, from so… --- ## [Unassigned Shards elastic 7.6.0](https://discuss.elastic.co/t/unassigned-shards-elastic-7-6-0/297431)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 4\ **Last updated:** [February 17, 2022, 1:45am UTC](https://discuss.elastic.co/t/unassigned-shards-elastic-7-6-0/297431 "2022-02-17T01:45:02Z")
So, Here is the condition. some of my index are unassigned and the status is red. then i assign it manually using this command POST \_cluster/reroute { "commands": \[ { "allocate\_empty\_primary": { … --- ## [Control data sampling by netflow](https://discuss.elastic.co/t/control-data-sampling-by-netflow/297425)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 0\ **Last updated:** [February 16, 2022, 11:20pm UTC](https://discuss.elastic.co/t/control-data-sampling-by-netflow/297425 "2022-02-16T23:20:57Z")
Good morning I would like to know how I can control the data that is sent by netflow to filebeat-kibana, since it generates many documents per minute, I want to know if I can configure the data sampling and only send me… --- ## [Elastic pod exit code 60](https://discuss.elastic.co/t/elastic-pod-exit-code-60/297322)
**Author:** [@cps598](https://discuss.elastic.co/u/cps598)\ **Replies:** 1\ **Last updated:** [February 17, 2022, 1:28am UTC](https://discuss.elastic.co/t/elastic-pod-exit-code-60/297322 "2022-02-17T01:28:42Z")
I can't delete one of the indexes and the return value is "60". What is "60" mean in return value? Thanks. [Previous page](https://discuss.elastic.co/latest.md?page=1255) [Next page](https://discuss.elastic.co/latest.md?page=1257)