# Latest **URL:** https://discuss.elastic.co/latest.md?page=1314 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1315 --- ## [What are the permissions necessary to import data in data visualizer? v7.12](https://discuss.elastic.co/t/what-are-the-permissions-necessary-to-import-data-in-data-visualizer-v7-12/293901)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [January 11, 2022, 7:58am UTC](https://discuss.elastic.co/t/what-are-the-permissions-necessary-to-import-data-in-data-visualizer-v7-12/293901 "2022-01-11T07:58:35Z")
Hi Im getting this import persmissions error when I try to upload a file onto elastic the user has his own space and has this privigeles: machine\_learning\_user, ingest\_admin, machine\_learning\_admin the custom rol ha… --- ## [Receiving data to the ELK database using logstash](https://discuss.elastic.co/t/receiving-data-to-the-elk-database-using-logstash/292547)
**Author:** [@San9](https://discuss.elastic.co/u/San9)\ **Replies:** 5\ **Last updated:** [January 11, 2022, 7:56am UTC](https://discuss.elastic.co/t/receiving-data-to-the-elk-database-using-logstash/292547 "2022-01-11T07:56:20Z")
I have a problem with accessing the ELK database and receiving a specific field with a token to form a further request to connect to the o365 api. I can't get data from this particular field. scheme, I connect to the EL… --- ## [How to check Microsoft 365 service health](https://discuss.elastic.co/t/how-to-check-microsoft-365-service-health/290089)
**Author:** [@San9](https://discuss.elastic.co/u/San9)\ **Replies:** 6\ **Last updated:** [January 11, 2022, 7:53am UTC](https://discuss.elastic.co/t/how-to-check-microsoft-365-service-health/290089 "2022-01-11T07:53:08Z")
Hello experts! I have a question - How to check Microsoft 365 service health? As far as I know, there is a module for auditing logs in the filebeat. But I would like to get the status of o365 services. Is there such a … --- ## [Rottating policy Elastic Agent logs](https://discuss.elastic.co/t/rottating-policy-elastic-agent-logs/293880)
**Author:** [@marti1](https://discuss.elastic.co/u/marti1)\ **Replies:** 2\ **Last updated:** [January 11, 2022, 7:24am UTC](https://discuss.elastic.co/t/rottating-policy-elastic-agent-logs/293880 "2022-01-11T07:24:05Z")
Hi, Elastic Agent creates a log for each integration (Ex: /Library/Elastic/Agent/data/elastic-agent-08e204/logs/default/metricbeat-json.log). Is it possible to define rotating policy (reaching specific size or defining … --- ## [Filebeat with GCP module failed to start](https://discuss.elastic.co/t/filebeat-with-gcp-module-failed-to-start/293977)
**Author:** [@NohimX](https://discuss.elastic.co/u/NohimX)\ **Replies:** 0\ **Last updated:** [January 11, 2022, 6:46am UTC](https://discuss.elastic.co/t/filebeat-with-gcp-module-failed-to-start/293977 "2022-01-11T06:46:02Z")
I tried to configure filebeat GCP module to get audit logs from Google Cloud, and it failed to start. Failed to start crawler: creating module reloader failed: error checking input configuration: no authentication crede… --- ## [Filebeat makes too many API calls choking and bringing down the Kubernetes cluster](https://discuss.elastic.co/t/filebeat-makes-too-many-api-calls-choking-and-bringing-down-the-kubernetes-cluster/293797)
**Author:** [@ayush\_mundra](https://discuss.elastic.co/u/ayush_mundra)\ **Replies:** 2\ **Last updated:** [January 11, 2022, 6:21am UTC](https://discuss.elastic.co/t/filebeat-makes-too-many-api-calls-choking-and-bringing-down-the-kubernetes-cluster/293797 "2022-01-11T06:21:30Z")
Hi, We have filebeat version: 7.12.0 running as a daemonset on all our production K8s clusters. Recently, we faced a catastrophic situation where our whole K8s cluster with around 300+ nodes was brought down by filebeat… --- ## [No data showing in SIEM Detection tab](https://discuss.elastic.co/t/no-data-showing-in-siem-detection-tab/293712)
**Author:** [@subham](https://discuss.elastic.co/u/subham)\ **Replies:** 4\ **Last updated:** [January 11, 2022, 6:03am UTC](https://discuss.elastic.co/t/no-data-showing-in-siem-detection-tab/293712 "2022-01-11T06:03:26Z")
Hi Everyone, We have create a detection rule threshold in SIEM but it's not showing any output or alerts. We can see the results in Preview Results but no alert is scene. Please check the image below for reference and su… --- ## [Use other query next to suggester](https://discuss.elastic.co/t/use-other-query-next-to-suggester/293921)
**Author:** [@Amir\_Faramarzi](https://discuss.elastic.co/u/Amir_Faramarzi)\ **Replies:** 2\ **Last updated:** [January 11, 2022, 5:13am UTC](https://discuss.elastic.co/t/use-other-query-next-to-suggester/293921 "2022-01-11T05:13:22Z")
How to use other query next to suggester that affects the score of the data obtained from suggester For example, I want to search for products that are active ?? --- ## [Grok Pattern not working](https://discuss.elastic.co/t/grok-pattern-not-working/293159)
**Author:** [@Pranav\_M](https://discuss.elastic.co/u/Pranav_M)\ **Replies:** 5\ **Last updated:** [January 11, 2022, 4:50am UTC](https://discuss.elastic.co/t/grok-pattern-not-working/293159 "2022-01-11T04:50:00Z")
Hey Community, Received packet: Type = N5abcde8AbcAbcde9AbcdAbcde15AbcdefghAbcdefA, xx = 95, xxx = 441, xxxXxo = 2, xXxxXxx = 1, xxxx = 9 accepted. The above line is a message from my log and I want to seperate each da… --- ## [Daily indices or monthly indices for storing data?](https://discuss.elastic.co/t/daily-indices-or-monthly-indices-for-storing-data/293967)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 0\ **Last updated:** [January 11, 2022, 4:37am UTC](https://discuss.elastic.co/t/daily-indices-or-monthly-indices-for-storing-data/293967 "2022-01-11T04:37:01Z")
Hi all I have a question regarding the storage comparision between having daily indices or monthly indices. The question is very simple: is the daily indices tooks more storage space than the monthly indices. Somehow i… --- ## [Latitude and Longitude Error in logstash?](https://discuss.elastic.co/t/latitude-and-longitude-error-in-logstash/293855)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 11\ **Last updated:** [January 11, 2022, 4:35am UTC](https://discuss.elastic.co/t/latitude-and-longitude-error-in-logstash/293855 "2022-01-11T04:35:23Z")
Hello Everyone, I am trying to convert PostalCode to lat and long, I have done this task but Now I am confuse how to convert it into geopoint field I have tried in logstash but no success so for, getting error. My con… --- ## [Reduce (shrink) primary shards on older data indices of a data stream](https://discuss.elastic.co/t/reduce-shrink-primary-shards-on-older-data-indices-of-a-data-stream/293963)
**Author:** [@adriaan](https://discuss.elastic.co/u/adriaan)\ **Replies:** 0\ **Last updated:** [January 11, 2022, 2:27am UTC](https://discuss.elastic.co/t/reduce-shrink-primary-shards-on-older-data-indices-of-a-data-stream/293963 "2022-01-11T02:27:57Z")
I have a data stream with page views of multiple websites of customers. I allow customers to delete their data (this is important). When they do I remove all the documents with a certain hostname. At the same time, I wa… --- ## [Heartbeat (7.15.2) - aws\_elb autodiscover only sends data for single listener while more should be included](https://discuss.elastic.co/t/heartbeat-7-15-2-aws-elb-autodiscover-only-sends-data-for-single-listener-while-more-should-be-included/293757)
**Author:** [@ronaldkonjer](https://discuss.elastic.co/u/ronaldkonjer)\ **Replies:** 3\ **Last updated:** [January 11, 2022, 2:58am UTC](https://discuss.elastic.co/t/heartbeat-7-15-2-aws-elb-autodiscover-only-sends-data-for-single-listener-while-more-should-be-included/293757 "2022-01-11T02:58:26Z")
I try to get heartbeat with aws\_elb autodiscovery to work. Though I'm able to get data visible in kibana, it is always a single listener from a single lb. Whereas I have 3 lb setup and it logs that it fetched 16 listener… --- ## [Why cant Select an Agent policy when Add a Fleet Server](https://discuss.elastic.co/t/why-cant-select-an-agent-policy-when-add-a-fleet-server/293083)
**Author:** [@wo7387196](https://discuss.elastic.co/u/wo7387196)\ **Replies:** 3\ **Last updated:** [January 11, 2022, 2:04am UTC](https://discuss.elastic.co/t/why-cant-select-an-agent-policy-when-add-a-fleet-server/293083 "2022-01-11T02:04:30Z")
the default is not work --- ## [Unable to access snapshot and restore](https://discuss.elastic.co/t/unable-to-access-snapshot-and-restore/293526)
**Author:** [@Apoorva\_21](https://discuss.elastic.co/u/Apoorva_21)\ **Replies:** 1\ **Last updated:** [January 11, 2022, 12:42am UTC](https://discuss.elastic.co/t/unable-to-access-snapshot-and-restore/293526 "2022-01-11T00:42:47Z")
Hi, I am unable to access snapshots and restore it says error loading snapshots . And when trying to run GET \_cat/snapshots command getting the error as Validation Failed : 1: repository missing. Can anyone help me t… --- ## [ElasticSearch for Temporal (version, incident\_raised\_date, auto\_create\_index)](https://discuss.elastic.co/t/elasticsearch-for-temporal-version-incident-raised-date-auto-create-index/293638)
**Author:** [@ridwan.santoso](https://discuss.elastic.co/u/ridwan.santoso)\ **Replies:** 1\ **Last updated:** [January 11, 2022, 12:41am UTC](https://discuss.elastic.co/t/elasticsearch-for-temporal-version-incident-raised-date-auto-create-index/293638 "2022-01-11T00:41:29Z")
Hi, I need to use Elasticsearch for Temporal and have couple question: Will Elasticsearch 7.6 works for Temporal 1.13? If not then what is recommended version? I am using Elasticsearch 7.6 for Temporal 1.13 currently … --- ## [Only able to see 100 index in Create index pattern](https://discuss.elastic.co/t/only-able-to-see-100-index-in-create-index-pattern/293854)
**Author:** [@faisalshah20](https://discuss.elastic.co/u/faisalshah20)\ **Replies:** 1\ **Last updated:** [January 11, 2022, 12:39am UTC](https://discuss.elastic.co/t/only-able-to-see-100-index-in-create-index-pattern/293854 "2022-01-11T00:39:37Z")
Hi Team i am running into problem i am only able to see 100 index in create index pattern. My scenario is to keep last 1 months logs in ELK. But when the 100 index are in create index pattern now new index pattern gets c… --- ## [Painless script not work](https://discuss.elastic.co/t/painless-script-not-work/293957)
**Author:** [@Jongz\_Puangput](https://discuss.elastic.co/u/Jongz_Puangput)\ **Replies:** 0\ **Last updated:** [January 11, 2022, 12:15am UTC](https://discuss.elastic.co/t/painless-script-not-work/293957 "2022-01-11T00:15:05Z")
I try to add runtime field to the current index. Name: store\_hostname Value: if (doc\['message.keyword'\].size() == 0) return; def source = doc\['message.keyword'\].value; if (source != null) { Matcher matcher = /((th… --- ## [Access heartbeat fields on rule action](https://discuss.elastic.co/t/access-heartbeat-fields-on-rule-action/293955)
**Author:** [@mojohoho](https://discuss.elastic.co/u/mojohoho)\ **Replies:** 1\ **Last updated:** [January 10, 2022, 11:49pm UTC](https://discuss.elastic.co/t/access-heartbeat-fields-on-rule-action/293955 "2022-01-10T23:49:43Z")
I have a heartbeat monitor with custom fields and fields\_under\_root: true How can I access these custom fields in a rule action? For example, I have the below monitor: - type: http id: dummy-nonexistent-url3 name:… --- ## [Illegal\_argument\_exception: index.lifecycle.rollover\_alias is empty or not defined](https://discuss.elastic.co/t/illegal-argument-exception-index-lifecycle-rollover-alias-is-empty-or-not-defined/293933)
**Author:** [@dev9](https://discuss.elastic.co/u/dev9)\ **Replies:** 0\ **Last updated:** [January 10, 2022, 6:33pm UTC](https://discuss.elastic.co/t/illegal-argument-exception-index-lifecycle-rollover-alias-is-empty-or-not-defined/293933 "2022-01-10T18:33:57Z")
Hi, I noticed this error last week on our elastic illegal\_argument\_exception: setting \[index.lifecycle.rollover\_alias\] for index \[test-2022.01.07\] is empty or not defined I did some research and found this article on t… --- ## [Connection elastic Cloud - Premise](https://discuss.elastic.co/t/connection-elastic-cloud-premise/293953)
**Author:** [@Kirtash](https://discuss.elastic.co/u/Kirtash)\ **Replies:** 0\ **Last updated:** [January 10, 2022, 10:45pm UTC](https://discuss.elastic.co/t/connection-elastic-cloud-premise/293953 "2022-01-10T22:45:11Z")
Good morning! I changed the Elastic cloud on premise to cloud and know I have a question about the security. The problem is that I have a service on premise of redis, and I would like add the integration in elastic Clou… --- ## [Logstash S3 output requires bucket object permissions at the root of the bucket, regardless of prefix config](https://discuss.elastic.co/t/logstash-s3-output-requires-bucket-object-permissions-at-the-root-of-the-bucket-regardless-of-prefix-config/293951)
**Author:** [@mdebord](https://discuss.elastic.co/u/mdebord)\ **Replies:** 0\ **Last updated:** [January 10, 2022, 10:30pm UTC](https://discuss.elastic.co/t/logstash-s3-output-requires-bucket-object-permissions-at-the-root-of-the-bucket-regardless-of-prefix-config/293951 "2022-01-10T22:30:54Z")
Logstash requires write access to the root of the bucket, regardless of the prefix defined in config. There are a few issues to note with this behavior: Logstash should be isolating its work into the defined prefix p… --- ## [Filebeat cannot detect modified ingested files](https://discuss.elastic.co/t/filebeat-cannot-detect-modified-ingested-files/293837)
**Author:** [@park\_rage](https://discuss.elastic.co/u/park_rage)\ **Replies:** 4\ **Last updated:** [January 10, 2022, 10:04pm UTC](https://discuss.elastic.co/t/filebeat-cannot-detect-modified-ingested-files/293837 "2022-01-10T22:04:23Z")
I am configuring the ELK + filebeat environment using docker-compose , but the environment and configuration are as follows. Environment: MacOS Functions to be implemented: Collect the /Users/mymac/dev/logs/app.log… --- ## [Test Elastic Search Cross Cluster Replication in terms of latency and data loss](https://discuss.elastic.co/t/test-elastic-search-cross-cluster-replication-in-terms-of-latency-and-data-loss/293892)
**Author:** [@prasadnewase](https://discuss.elastic.co/u/prasadnewase)\ **Replies:** 1\ **Last updated:** [January 10, 2022, 9:57pm UTC](https://discuss.elastic.co/t/test-elastic-search-cross-cluster-replication-in-terms-of-latency-and-data-loss/293892 "2022-01-10T21:57:05Z")
How to check replication latency and data loss in the Cross Cluster Replication of Elasticsearch? When we implement CCR how we can ensure the accuracy and efficiency of the replication. Please suggest any tool or .Net cl… --- ## [Evacuate node for maintenance](https://discuss.elastic.co/t/evacuate-node-for-maintenance/293914)
**Author:** [@windows95](https://discuss.elastic.co/u/windows95)\ **Replies:** 1\ **Last updated:** [January 10, 2022, 9:54pm UTC](https://discuss.elastic.co/t/evacuate-node-for-maintenance/293914 "2022-01-10T21:54:54Z")
Hi, when I have a 3 node cluster and and 3 shards (1 primary, 2 replica) per index, as to my experience it is not possible to evacuate a node completely, which makes sense to me. Is it safe in this case to stop Elastics… --- ## [If i have large amount of data, should i create multi data stream instead of a single data stream](https://discuss.elastic.co/t/if-i-have-large-amount-of-data-should-i-create-multi-data-stream-instead-of-a-single-data-stream/293609)
**Author:** [@Zephery\_Wen](https://discuss.elastic.co/u/Zephery_Wen)\ **Replies:** 2\ **Last updated:** [January 10, 2022, 9:14pm UTC](https://discuss.elastic.co/t/if-i-have-large-amount-of-data-should-i-create-multi-data-stream-instead-of-a-single-data-stream/293609 "2022-01-10T21:14:21Z")
If the storage capacity is about several Trillionbyte, should i use a single data stream? like this: data stream aaa contains index:aaa-2022.01.06-0001,aaa-2022.01.06-0002,aaa-2022.01.07-0003 or several data stream d… --- ## [Monthly indices but ILM on daily basis](https://discuss.elastic.co/t/monthly-indices-but-ilm-on-daily-basis/293458)
**Author:** [@windows95](https://discuss.elastic.co/u/windows95)\ **Replies:** 6\ **Last updated:** [January 10, 2022, 9:06pm UTC](https://discuss.elastic.co/t/monthly-indices-but-ilm-on-daily-basis/293458 "2022-01-10T21:06:52Z")
Hello. I had daily indices and a fixed retention time of 365 days via ILM. Now I changed to monthly indices to increase the index size. The problem now is that when the oldest index will be deleted, all data from now-(3… --- ## [Log4j CVE-2021-44832 (released 28th dec) - is ES vulnerable?](https://discuss.elastic.co/t/log4j-cve-2021-44832-released-28th-dec-is-es-vulnerable/293076)
**Author:** [@Vashiru](https://discuss.elastic.co/u/Vashiru)\ **Replies:** 9\ **Last updated:** [January 10, 2022, 9:04pm UTC](https://discuss.elastic.co/t/log4j-cve-2021-44832-released-28th-dec-is-es-vulnerable/293076 "2022-01-10T21:04:20Z")
As the title states, is Elasticsearch vulnerable for the new Log4j vulnerability CVE-2021-44832? This is a new vulnerability of which the details were released a few hours ago. Or is this prevented by the security manage… --- ## [Question about release scheduling](https://discuss.elastic.co/t/question-about-release-scheduling/293926)
**Author:** [@Miguel\_Lopez1](https://discuss.elastic.co/u/Miguel_Lopez1)\ **Replies:** 1\ **Last updated:** [January 10, 2022, 9:01pm UTC](https://discuss.elastic.co/t/question-about-release-scheduling/293926 "2022-01-10T21:01:54Z")
Hi, As part of a masters degree assignment we need to address some questions about the Elasticsearch to the developers. The question is: How are the release schedule planned in relation to deciding when to increase a … --- ## [Kibana Dashboard Template for ECS](https://discuss.elastic.co/t/kibana-dashboard-template-for-ecs/293656)
**Author:** [@lucas.sampaio](https://discuss.elastic.co/u/lucas.sampaio)\ **Replies:** 1\ **Last updated:** [January 10, 2022, 8:57pm UTC](https://discuss.elastic.co/t/kibana-dashboard-template-for-ecs/293656 "2022-01-10T20:57:11Z")
Is there a dashboard template that follows the ECS specifications? ty. [Previous page](https://discuss.elastic.co/latest.md?page=1313) [Next page](https://discuss.elastic.co/latest.md?page=1315)