# Latest **URL:** https://discuss.elastic.co/latest.md?page=1293 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1294 --- ## [Watcher: http input specify current date in path](https://discuss.elastic.co/t/watcher-http-input-specify-current-date-in-path/293391)
**Author:** [@Kevin\_Gonzalez](https://discuss.elastic.co/u/Kevin_Gonzalez)\ **Replies:** 7\ **Last updated:** [January 25, 2022, 12:36pm UTC](https://discuss.elastic.co/t/watcher-http-input-specify-current-date-in-path/293391 "2022-01-25T12:36:15Z")
I'm trying to create a watcher that monitors the size of a specific index. I have daily indices with this naming convention: "indexname-YYYY.MM.dd", example: "test-index-2022.01.03". I want to monitor the size of that s… --- ## [Convert Timestamp to milliseconds in ingest pipeline](https://discuss.elastic.co/t/convert-timestamp-to-milliseconds-in-ingest-pipeline/294602)
**Author:** [@Rakesh\_Rayabarapu](https://discuss.elastic.co/u/Rakesh_Rayabarapu)\ **Replies:** 9\ **Last updated:** [January 25, 2022, 11:47am UTC](https://discuss.elastic.co/t/convert-timestamp-to-milliseconds-in-ingest-pipeline/294602 "2022-01-25T11:47:26Z")
Hi, I am trying to find a way to get millis from string date time field using ingest pipeline and getting following error. please help me to correct the script. POST /\_ingest/pipeline/\_simulate { "pipeline": { "des… --- ## [Exact match on log message field](https://discuss.elastic.co/t/exact-match-on-log-message-field/295228)
**Author:** [@melkamar](https://discuss.elastic.co/u/melkamar)\ **Replies:** 5\ **Last updated:** [January 25, 2022, 11:27am UTC](https://discuss.elastic.co/t/exact-match-on-log-message-field/295228 "2022-01-25T11:27:05Z")
Hi, I am evaluating the Alerts feature in the latest Kibana version. We are collecting logs from our server and I want to set up exact-match alerting rules. When creating an alert and setting up a condition on the messag… --- ## [Delete by Query Impact in terms of Data size vs Time taken](https://discuss.elastic.co/t/delete-by-query-impact-in-terms-of-data-size-vs-time-taken/295339)
**Author:** [@yash\_196](https://discuss.elastic.co/u/yash_196)\ **Replies:** 0\ **Last updated:** [January 25, 2022, 11:17am UTC](https://discuss.elastic.co/t/delete-by-query-impact-in-terms-of-data-size-vs-time-taken/295339 "2022-01-25T11:17:05Z")
Hi Everyone, I am trying to understand the impact of using delete by query API in Elasticsearch. I am looking for some formula/metrics in terms of the time taken to delete a certain amount of data. Can anyone please hel… --- ## [Fetch installed software details in Elasticsearch using elastic beats](https://discuss.elastic.co/t/fetch-installed-software-details-in-elasticsearch-using-elastic-beats/294527)
**Author:** [@Tirtharaj\_Karbotkar1](https://discuss.elastic.co/u/Tirtharaj_Karbotkar1)\ **Replies:** 3\ **Last updated:** [January 25, 2022, 11:13am UTC](https://discuss.elastic.co/t/fetch-installed-software-details-in-elasticsearch-using-elastic-beats/294527 "2022-01-25T11:13:27Z")
Hi all, I am trying to fetch installed software details from my system (windows) into the Elasticsearch. Does any one have idea how to do the same? I have tried using metricbeat but at most I can get the running proce… --- ## [Repository creation fails (disk quota)](https://discuss.elastic.co/t/repository-creation-fails-disk-quota/295328)
**Author:** [@pszemesy](https://discuss.elastic.co/u/pszemesy)\ **Replies:** 0\ **Last updated:** [January 25, 2022, 10:24am UTC](https://discuss.elastic.co/t/repository-creation-fails-disk-quota/295328 "2022-01-25T10:24:14Z")
Hi All, I have an issue with creation of snapshot repository. PUT \_snapshot/test-repo { "type": "fs", "settings": { "location": "test\_repo" } } The reply was this: { "error" : { "root\_cause" : \[ … --- ## [Helm chart - readinessProbe failure without errors](https://discuss.elastic.co/t/helm-chart-readinessprobe-failure-without-errors/295091)
**Author:** [@aumthanki](https://discuss.elastic.co/u/aumthanki)\ **Replies:** 2\ **Last updated:** [January 24, 2022, 2:21pm UTC](https://discuss.elastic.co/t/helm-chart-readinessprobe-failure-without-errors/295091 "2022-01-24T14:21:39Z")
Hi, Has anyone been forced to tweak the readinessprobe for the filebeat chart? readinessProbe: exec: command: - sh - -c - | #!/usr/bin/env bash -e filebeat test output failureThreshold: 3 initialDelaySeconds: … --- ## [Elasticsearch7.x have any solutions to replace existing searchAction or override?](https://discuss.elastic.co/t/elasticsearch7-x-have-any-solutions-to-replace-existing-searchaction-or-override/295334)
**Author:** [@Howells](https://discuss.elastic.co/u/Howells)\ **Replies:** 0\ **Last updated:** [January 25, 2022, 10:57am UTC](https://discuss.elastic.co/t/elasticsearch7-x-have-any-solutions-to-replace-existing-searchaction-or-override/295334 "2022-01-25T10:57:08Z")
I want to do some custom function in RestSearchAction.prepareRequest before "request.withContentOrSourceParamParserOrNull(parser -\> parseSearchRequest(searchRequest, request, parser, setSize));" , like verify query stat… --- ## [Pie chart Lens starting position for bigger slices](https://discuss.elastic.co/t/pie-chart-lens-starting-position-for-bigger-slices/295315)
**Author:** [@howai](https://discuss.elastic.co/u/howai)\ **Replies:** 1\ **Last updated:** [January 25, 2022, 10:38am UTC](https://discuss.elastic.co/t/pie-chart-lens-starting-position-for-bigger-slices/295315 "2022-01-25T10:38:03Z")
Hi experts, I'm creating a pie chart as below(labels hidden) but struggling with the following below points. Could you please advise? Pic1. The chart clockwise manner in Aggregation Chart Pic2. The chart clockw… --- ## [Readiness Probe Failing - clusterHealthCheckParams: "wait\_for\_status=yellow&timeout=1s"](https://discuss.elastic.co/t/readiness-probe-failing-clusterhealthcheckparams-wait-for-status-yellow-timeout-1s/295319)
**Author:** [@aniesh.mathew](https://discuss.elastic.co/u/aniesh.mathew)\ **Replies:** 3\ **Last updated:** [January 25, 2022, 10:16am UTC](https://discuss.elastic.co/t/readiness-probe-failing-clusterhealthcheckparams-wait-for-status-yellow-timeout-1s/295319 "2022-01-25T10:16:02Z")
We have a deployed a elastic master with single replica in kubernetes and have added the parameter clusterHealthCheckParams: wait\_for\_status=yellow&timeout=1s as suggested in post. The elastic master was working fine e… --- ## [Debugging root cause for high Purgatory size in Kafka](https://discuss.elastic.co/t/debugging-root-cause-for-high-purgatory-size-in-kafka/295324)
**Author:** [@LHozzan](https://discuss.elastic.co/u/LHozzan)\ **Replies:** 0\ **Last updated:** [January 25, 2022, 9:54am UTC](https://discuss.elastic.co/t/debugging-root-cause-for-high-purgatory-size-in-kafka/295324 "2022-01-25T09:54:34Z")
We using ELK stack (7.10.2) in Kubernetes (1.21.5). After several time our service provider Gardener change OS version (318.9.0 -\> 576.1.0) and our troubles with logging stack started. It seems, that Kafka (v 2.8.1, 2 p… --- ## [Added corp certs instead of self certs now - "Kibana server is not ready yet"](https://discuss.elastic.co/t/added-corp-certs-instead-of-self-certs-now-kibana-server-is-not-ready-yet/295260)
**Author:** [@g0nz0](https://discuss.elastic.co/u/g0nz0)\ **Replies:** 1\ **Last updated:** [January 25, 2022, 9:44am UTC](https://discuss.elastic.co/t/added-corp-certs-instead-of-self-certs-now-kibana-server-is-not-ready-yet/295260 "2022-01-25T09:44:39Z")
Hello, I'm trying to use our own certs with ELK but when I use them instead of the working self certs I get the error "Kibana server is not ready yet" when I go to the website. With the self certs I just use https://ip… --- ## [Extract the Key from MQTT JSON message](https://discuss.elastic.co/t/extract-the-key-from-mqtt-json-message/295185)
**Author:** [@folderman](https://discuss.elastic.co/u/folderman)\ **Replies:** 11\ **Last updated:** [January 25, 2022, 9:26am UTC](https://discuss.elastic.co/t/extract-the-key-from-mqtt-json-message/295185 "2022-01-25T09:26:11Z")
Hi All, I have a problem with my testing device support MQTT. Here is the MQTT message: {"device\_info": {"uuid": "XXXXXX","fw\_ver": "V1.5.0" },"measures": \[{"n":"co2", "u":"ppm", "v":1155.995},{"n":"voc", "u":"ppm", "v… --- ## [How to build logstash-input-tcp v6.0.3 plugin?](https://discuss.elastic.co/t/how-to-build-logstash-input-tcp-v6-0-3-plugin/295295)
**Author:** [@SHUBHAM\_JAIN1](https://discuss.elastic.co/u/SHUBHAM_JAIN1)\ **Replies:** 1\ **Last updated:** [January 25, 2022, 9:04am UTC](https://discuss.elastic.co/t/how-to-build-logstash-input-tcp-v6-0-3-plugin/295295 "2022-01-25T09:04:54Z")
please mention step for making build gem for logstash-input-tcp plugin for version 6.0.3 --- ## [Data nodes randomly leaving cluster](https://discuss.elastic.co/t/data-nodes-randomly-leaving-cluster/294838)
**Author:** [@jcasals](https://discuss.elastic.co/u/jcasals)\ **Replies:** 11\ **Last updated:** [January 25, 2022, 8:55am UTC](https://discuss.elastic.co/t/data-nodes-randomly-leaving-cluster/294838 "2022-01-25T08:55:30Z")
Hello, I have a problem that I can't seem to be able to fix nor understand. I have an Elasticsearch cluster with three master nodes and 6 (12) data nodes. Master nodes: virtual, with 2CPU and 4GB of memory. Data node… --- ## [Two commands return different segments info of the same index](https://discuss.elastic.co/t/two-commands-return-different-segments-info-of-the-same-index/295151)
**Author:** [@chembohuang](https://discuss.elastic.co/u/chembohuang)\ **Replies:** 1\ **Last updated:** [January 25, 2022, 7:46am UTC](https://discuss.elastic.co/t/two-commands-return-different-segments-info-of-the-same-index/295151 "2022-01-25T07:46:57Z")
ES 7.7.1, jdk 14. A cluster with 3 dedicated master nodes and 100+ data nodes. During the execution of the forcemerge, myindex/\_stats and \_cat/segments/myindex return different segments info. Here is the forcemerge cm… --- ## [Unable to delete index pattern in Kibana 7.15](https://discuss.elastic.co/t/unable-to-delete-index-pattern-in-kibana-7-15/295179)
**Author:** [@abhinav\_chourasia](https://discuss.elastic.co/u/abhinav_chourasia)\ **Replies:** 3\ **Last updated:** [January 25, 2022, 7:00am UTC](https://discuss.elastic.co/t/unable-to-delete-index-pattern-in-kibana-7-15/295179 "2022-01-25T07:00:29Z")
I have moved from ELK 7.9 to ELK 7.15 in an attempt to solve this problem and it looks like all that effort was of no use. I am still unable to delete the index pattern in Kibana, neither through the console, nor through… --- ## [Roles are not working correctly in kibana](https://discuss.elastic.co/t/roles-are-not-working-correctly-in-kibana/295256)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 1\ **Last updated:** [January 25, 2022, 6:52am UTC](https://discuss.elastic.co/t/roles-are-not-working-correctly-in-kibana/295256 "2022-01-25T06:52:27Z")
Hi, I am trying to create a separate space in kibana based on a read only developer role I have created the roles dedicated for the developers that has read access to the indices. However they only see one pattern of in… --- ## [Warning "Unable to acquire permit to use snapshot files during recovery…" when restarting elasticsearch node](https://discuss.elastic.co/t/warning-unable-to-acquire-permit-to-use-snapshot-files-during-recovery-when-restarting-elasticsearch-node/293543)
**Author:** [@Gregor\_Weckbecker](https://discuss.elastic.co/u/Gregor_Weckbecker)\ **Replies:** 2\ **Last updated:** [January 25, 2022, 6:02am UTC](https://discuss.elastic.co/t/warning-unable-to-acquire-permit-to-use-snapshot-files-during-recovery-when-restarting-elasticsearch-node/293543 "2022-01-25T06:02:12Z")
When upgrading our elasticsearch cluster to version 7.16.1, we performing a rolling upgarde as described in the documentation. Before the restart we trigger a synced flush and increase cluster.routing.allocation.node\_con… --- ## [Metricbeat - Not creating any logfile](https://discuss.elastic.co/t/metricbeat-not-creating-any-logfile/295266)
**Author:** [@sujeetkp](https://discuss.elastic.co/u/sujeetkp)\ **Replies:** 0\ **Last updated:** [January 24, 2022, 5:59pm UTC](https://discuss.elastic.co/t/metricbeat-not-creating-any-logfile/295266 "2022-01-24T17:59:19Z")
I am trying to set up metric beat for my CentOS7 host. I have explictly mentioned the logfile location for the metricbeat and the logging level is debug, but I dont see a log file created. I can see the logs in journalct… --- ## [FileBeats Syslog not being sent to Elastic Cloud](https://discuss.elastic.co/t/filebeats-syslog-not-being-sent-to-elastic-cloud/295300)
**Author:** [@wekimop](https://discuss.elastic.co/u/wekimop)\ **Replies:** 0\ **Last updated:** [January 25, 2022, 4:43am UTC](https://discuss.elastic.co/t/filebeats-syslog-not-being-sent-to-elastic-cloud/295300 "2022-01-25T04:43:11Z")
Hello, i am trying to use the System integration in my Elastic Security agent to capture syslog data from /var/log/syslog file. I am also doing the same on another server but using a FileBeat instance, sending output to … --- ## [DEVELOP JAVA OUTPUT PLUGIN FOR APPLICATION LOG](https://discuss.elastic.co/t/develop-java-output-plugin-for-application-log/295293)
**Author:** [@uday22](https://discuss.elastic.co/u/uday22)\ **Replies:** 0\ **Last updated:** [January 25, 2022, 2:43am UTC](https://discuss.elastic.co/t/develop-java-output-plugin-for-application-log/295293 "2022-01-25T02:43:58Z")
An application log every line of the message is different from another line. In that, need to extract the IP address and username by using the java output plugin. which method and PluginConfigSpec should use in the plugi… --- ## [Ec2 role based access failing for s3-input-plugin if we upgrade ec2 to use metadata v2](https://discuss.elastic.co/t/ec2-role-based-access-failing-for-s3-input-plugin-if-we-upgrade-ec2-to-use-metadata-v2/295271)
**Author:** [@uma\_rengasamy](https://discuss.elastic.co/u/uma_rengasamy)\ **Replies:** 0\ **Last updated:** [January 24, 2022, 6:56pm UTC](https://discuss.elastic.co/t/ec2-role-based-access-failing-for-s3-input-plugin-if-we-upgrade-ec2-to-use-metadata-v2/295271 "2022-01-24T18:56:29Z")
Logstash Version : logstash 7.2.0 aws-cli/1.18.157 Python/3.6.8 Linux/4.18.0-305.12.1.el8\_4.x86\_64 botocore/1.18.16 logstash-input-s3 (3.4.1) aws-cli/1.18.157 Python/3.6.8 Linux/4.18.0-305.12.1.el8\_4.x86\_64 botocore/1… --- ## [401 forbidden from artifacts.elastic.co](https://discuss.elastic.co/t/401-forbidden-from-artifacts-elastic-co/294114)
**Author:** [@hmof](https://discuss.elastic.co/u/hmof)\ **Replies:** 1\ **Last updated:** [January 25, 2022, 1:12am UTC](https://discuss.elastic.co/t/401-forbidden-from-artifacts-elastic-co/294114 "2022-01-25T01:12:20Z")
I am getting a 401 forbidden error trying to access the APT repository but only from one of my hosts. Err:4 https://artifacts.elastic.co/packages/6.x/apt stable InRelease … --- ## [Remove \`\_all\` mapping from older indexes](https://discuss.elastic.co/t/remove-all-mapping-from-older-indexes/295263)
**Author:** [@willdennis](https://discuss.elastic.co/u/willdennis)\ **Replies:** 5\ **Last updated:** [January 25, 2022, 1:06am UTC](https://discuss.elastic.co/t/remove-all-mapping-from-older-indexes/295263 "2022-01-25T01:06:50Z")
Upgraded to v6.8 recently; trying to ensure I can now upgrade to v7.x Having an issue when trying to reindex my old logstash indexes created on v5.6.x - getting this message when the system goes to create the new index (… --- ## [Get distinct values from a array in ElasticSearch](https://discuss.elastic.co/t/get-distinct-values-from-a-array-in-elasticsearch/295274)
**Author:** [@smkarnan](https://discuss.elastic.co/u/smkarnan)\ **Replies:** 1\ **Last updated:** [January 25, 2022, 12:27am UTC](https://discuss.elastic.co/t/get-distinct-values-from-a-array-in-elasticsearch/295274 "2022-01-25T00:27:04Z")
Hi, How can I retrieve unique values in the array, i just want to get unique lat from the below collection. "hits" { "function": { "geo\_fence: \[ { "lon": 131.… --- ## [Keyboard Shortcuts for Dev Tools](https://discuss.elastic.co/t/keyboard-shortcuts-for-dev-tools/295267)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 1\ **Last updated:** [January 25, 2022, 12:19am UTC](https://discuss.elastic.co/t/keyboard-shortcuts-for-dev-tools/295267 "2022-01-25T00:19:09Z")
This is a simple one - is there a keyboard shortcut for executing an API call in Dev Tools (rather than clicking the little arrow)? It seems like a small thing, but if it exists, it would save a ton of time. --- ## [Error while connecting logstash to kafka](https://discuss.elastic.co/t/error-while-connecting-logstash-to-kafka/295189)
**Author:** [@Avnish\_Singh](https://discuss.elastic.co/u/Avnish_Singh)\ **Replies:** 0\ **Last updated:** [January 24, 2022, 8:16am UTC](https://discuss.elastic.co/t/error-while-connecting-logstash-to-kafka/295189 "2022-01-24T08:16:31Z")
Hi I'm trying to run logstash with input as Kafka and output to file, here is the pipeline config file: input { kafka { bootstrap\_servers =\> "kafka\_server:9092 topics =\> \["Topic1", "Topic2", "Topic3"\] … --- ## [Logstash throughput ramping up too slowly -- throttle filter?](https://discuss.elastic.co/t/logstash-throughput-ramping-up-too-slowly-throttle-filter/295285)
**Author:** [@rsk0](https://discuss.elastic.co/u/rsk0)\ **Replies:** 0\ **Last updated:** [January 24, 2022, 9:43pm UTC](https://discuss.elastic.co/t/logstash-throughput-ramping-up-too-slowly-throttle-filter/295285 "2022-01-24T21:43:42Z")
We have a (Windows) logs stream pulled out of Kafka and pushed into ES. During site events our rate can spike to many multiples. When this happens, Logstash appears to delay messages getting in to ES. It's not due to … --- ## [Functionbeat GCP pub/sub requiring storage entry point when only pub/sub is enabled](https://discuss.elastic.co/t/functionbeat-gcp-pub-sub-requiring-storage-entry-point-when-only-pub-sub-is-enabled/295254)
**Author:** [@Sebastian\_Borys](https://discuss.elastic.co/u/Sebastian_Borys)\ **Replies:** 4\ **Last updated:** [January 24, 2022, 9:24pm UTC](https://discuss.elastic.co/t/functionbeat-gcp-pub-sub-requiring-storage-entry-point-when-only-pub-sub-is-enabled/295254 "2022-01-24T21:24:44Z")
Deploying functionbeat on GCP with entry point RunPubSub returns an error complaining about storage entry point, which I am not using. I get the following error upon deploy Deployment failure: Build failed: # functions… [Previous page](https://discuss.elastic.co/latest.md?page=1292) [Next page](https://discuss.elastic.co/latest.md?page=1294)