# Latest **URL:** https://discuss.elastic.co/latest.md?page=1380 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1381 --- ## [Elastic SIEM Network Map Layers Issues](https://discuss.elastic.co/t/elastic-siem-network-map-layers-issues/289782)
**Author:** [@fmaginga](https://discuss.elastic.co/u/fmaginga)\ **Replies:** 0\ **Last updated:** [November 22, 2021, 8:14am UTC](https://discuss.elastic.co/t/elastic-siem-network-map-layers-issues/289782 "2021-11-22T08:14:41Z")
Hello, I have been experiencing some issues with Elastic SIEM Network Map Layers. I have configured only indices corporatepfw-ecs-\* from which the SIEM app collects events. See the image below. However, In the SIEM \>… --- ## [Logstsash is running pipelines in parallel](https://discuss.elastic.co/t/logstsash-is-running-pipelines-in-parallel/289614)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 4\ **Last updated:** [November 22, 2021, 8:15am UTC](https://discuss.elastic.co/t/logstsash-is-running-pipelines-in-parallel/289614 "2021-11-22T08:15:38Z")
Hello! I have a divided pipeline that generates 2 indices that enrich each other. I would like to know how I can make it do one etl first and when it finishes the other. my logstash filter wich enrichs has this filter… --- ## [Why we can not edit transform after creating](https://discuss.elastic.co/t/why-we-can-not-edit-transform-after-creating/289764)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 1\ **Last updated:** [November 22, 2021, 7:12am UTC](https://discuss.elastic.co/t/why-we-can-not-edit-transform-after-creating/289764 "2021-11-22T07:12:27Z")
Hi every body! I want to edit transform jobs after creation, but according to the Elasticsearch documents, we can edit only some restricted fields. is there a way to edit trasnform scripts? like group by section? or a… --- ## [Delete file in ruby filter logstash](https://discuss.elastic.co/t/delete-file-in-ruby-filter-logstash/289671)
**Author:** [@Hertz\_Drive](https://discuss.elastic.co/u/Hertz_Drive)\ **Replies:** 6\ **Last updated:** [November 22, 2021, 4:28am UTC](https://discuss.elastic.co/t/delete-file-in-ruby-filter-logstash/289671 "2021-11-22T04:28:53Z")
my code in ruby filter def register(params) print "heello ruby come in" end def filter(event) Dir.glob('/home/hz/COM.txt').each { |file| File.chmod(0777, file) File.delete(file) print(file) } #return… --- ## [Ignore\_malformed broken for geo\_shape](https://discuss.elastic.co/t/ignore-malformed-broken-for-geo-shape/289771)
**Author:** [@corndog](https://discuss.elastic.co/u/corndog)\ **Replies:** 4\ **Last updated:** [November 22, 2021, 3:48am UTC](https://discuss.elastic.co/t/ignore-malformed-broken-for-geo-shape/289771 "2021-11-22T03:48:49Z")
I have set mappings for my index as such: "geometry": { "type": "geo\_shape", "ignore\_malformed": true } When I Bulk POST documents, 1 fails due to malformed geometry. I have set the "ignore\_malformed" parameter… --- ## [Watcher alert email action is not working](https://discuss.elastic.co/t/watcher-alert-email-action-is-not-working/289737)
**Author:** [@George\_Lee](https://discuss.elastic.co/u/George_Lee)\ **Replies:** 6\ **Last updated:** [November 22, 2021, 3:19am UTC](https://discuss.elastic.co/t/watcher-alert-email-action-is-not-working/289737 "2021-11-22T03:19:27Z")
Deal all, ECK version 1.7.1 Elasticsearch version 7.10.1 My Elasticsearch configuration is apiVersion: elasticsearch.k8s.elastic.co/v1 kind: Elasticsearch metadata: name: elastic005 namespace: elastic-system spec… --- ## [Fetch 1M records using aggregation in a single call](https://discuss.elastic.co/t/fetch-1m-records-using-aggregation-in-a-single-call/289399)
**Author:** [@Sreejith\_Ms](https://discuss.elastic.co/u/Sreejith_Ms)\ **Replies:** 1\ **Last updated:** [November 22, 2021, 12:20am UTC](https://discuss.elastic.co/t/fetch-1m-records-using-aggregation-in-a-single-call/289399 "2021-11-22T00:20:57Z")
We have to create some reports based on nearly 100M data and its requires aggregation and the result will be nearly 5M records. So, Can I use Elasticsearch for this report generation and fetch up to 5M records in a sing… --- ## [Lifecycle error](https://discuss.elastic.co/t/lifecycle-error/289533)
**Author:** [@mrchile](https://discuss.elastic.co/u/mrchile)\ **Replies:** 0\ **Last updated:** [November 18, 2021, 6:48am UTC](https://discuss.elastic.co/t/lifecycle-error/289533 "2021-11-18T06:48:33Z")
No rollover info found for \[name\_index-%{+YYYY.MM.dd}-000001\] with rollover target \[index-alias\], the index has not yet rolled over with that target. The next day I get this error. On the first day of operation, no error… --- ## [Changing Unique Key of Elastic Search Index (Id column)](https://discuss.elastic.co/t/changing-unique-key-of-elastic-search-index-id-column/289582)
**Author:** [@amey\_kulkarni](https://discuss.elastic.co/u/amey_kulkarni)\ **Replies:** 1\ **Last updated:** [November 22, 2021, 12:12am UTC](https://discuss.elastic.co/t/changing-unique-key-of-elastic-search-index-id-column/289582 "2021-11-22T00:12:05Z")
We have a requirement to set value of id column (unique key) of an index to values coming from data (values of couple of columns from data). Id column value is set for each document by default. We want to override it wi… --- ## [ERROR: policy for index failed on step \[{"phase":"hot","action":"rollover","name":"check-rollover-ready"}\]](https://discuss.elastic.co/t/error-policy-for-index-failed-on-step-phase-hot-action-rollover-name-check-rollover-ready/289676)
**Author:** [@marti1](https://discuss.elastic.co/u/marti1)\ **Replies:** 0\ **Last updated:** [November 19, 2021, 10:49am UTC](https://discuss.elastic.co/t/error-policy-for-index-failed-on-step-phase-hot-action-rollover-name-check-rollover-ready/289676 "2021-11-19T10:49:35Z")
Hi, I just set up a new cluster, and I'm getting this error. Timestamp Level Type Message Component November 19, 2021 10:32:57 AM INFO Server policy \[metricbeat\] for index \[metricbeat-7.15.2-2021.11.18-000001\] … --- ## [Kibana space port based](https://discuss.elastic.co/t/kibana-space-port-based/289690)
**Author:** [@franckfct](https://discuss.elastic.co/u/franckfct)\ **Replies:** 1\ **Last updated:** [November 22, 2021, 12:06am UTC](https://discuss.elastic.co/t/kibana-space-port-based/289690 "2021-11-22T00:06:33Z")
Hi, Is it possible to specify a port per space For example: http://url:5601/ =\> Default space http://url:5602/ =\> IT space http://url:5603/ =\> HR space etc ... In Kibana or maybe in the web server Thanks --- ## [Kibana a new nodes does not get listed but the total number of nodes is correct](https://discuss.elastic.co/t/kibana-a-new-nodes-does-not-get-listed-but-the-total-number-of-nodes-is-correct/289736)
**Author:** [@luigius](https://discuss.elastic.co/u/luigius)\ **Replies:** 0\ **Last updated:** [November 20, 2021, 5:55am UTC](https://discuss.elastic.co/t/kibana-a-new-nodes-does-not-get-listed-but-the-total-number-of-nodes-is-correct/289736 "2021-11-20T05:55:16Z")
Hi, I added a new node to an elastic cluster with a master node (hot) and a warm node. The cluster status is green and shows 3 nodes. Elastic is on all machine 7.15.2 the nodes are monitor (master hot), monitor-1 (wa… --- ## [Persisting latest state in separated index](https://discuss.elastic.co/t/persisting-latest-state-in-separated-index/289628)
**Author:** [@nestor1](https://discuss.elastic.co/u/nestor1)\ **Replies:** 1\ **Last updated:** [November 21, 2021, 11:39pm UTC](https://discuss.elastic.co/t/persisting-latest-state-in-separated-index/289628 "2021-11-21T23:39:30Z")
I have stream of data like this: userid: 1, taskid: 1, start\_time: 01:00:00, completed: 10 userid: 1, taskid: 1, start\_time: 02:00:00, completed: 30 userid: 1, taskid: 1, start\_time: 03:00:00, completed: 70 userid: 1, t… --- ## [Metric beats and WMI](https://discuss.elastic.co/t/metric-beats-and-wmi/289063)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 5\ **Last updated:** [November 21, 2021, 10:09pm UTC](https://discuss.elastic.co/t/metric-beats-and-wmi/289063 "2021-11-21T22:09:12Z")
It has been suggested that it is possible to configure beats to collect data based on a WMI query. Is this true, and if so is there any useful documentation that you might be able to point me towards? thanks --- ## [Configuring SSL with Letsencrypt and sym links](https://discuss.elastic.co/t/configuring-ssl-with-letsencrypt-and-sym-links/289241)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 8\ **Last updated:** [November 21, 2021, 8:30pm UTC](https://discuss.elastic.co/t/configuring-ssl-with-letsencrypt-and-sym-links/289241 "2021-11-21T20:30:47Z")
I am setting up and Elasticsearch server on a system that uses letsencrypt certificates. The certificates and keys live under /etc/letsencrypt. There are several applications that need to access those key and rather th… --- ## [Changed layout of coordinates (geopoint) after upgrade 7.10 to 7.15](https://discuss.elastic.co/t/changed-layout-of-coordinates-geopoint-after-upgrade-7-10-to-7-15/287365)
**Author:** [@tjswe](https://discuss.elastic.co/u/tjswe)\ **Replies:** 5\ **Last updated:** [November 21, 2021, 5:57pm UTC](https://discuss.elastic.co/t/changed-layout-of-coordinates-geopoint-after-upgrade-7-10-to-7-15/287365 "2021-11-21T17:57:11Z")
Hi! Did an upgrade of the ELK-stack from 7.10 to 7.15 and in that jump the format of coordinates in Kibana changed Previously it was just like any other field in the discovery view location : 11.111 , 22.222 now it… --- ## [Not able to upload file in elastic cloud](https://discuss.elastic.co/t/not-able-to-upload-file-in-elastic-cloud/289759)
**Author:** [@anju\_rawat](https://discuss.elastic.co/u/anju_rawat)\ **Replies:** 2\ **Last updated:** [November 21, 2021, 4:25pm UTC](https://discuss.elastic.co/t/not-able-to-upload-file-in-elastic-cloud/289759 "2021-11-21T16:25:09Z")
I was trying to upload csv & json file in kibana but in both case getting same error. Please refere below attached picture for reference. --- ## [MONGODB | Error checking \:\: Mongo::Error::MaxMessageSize: Message exceeds allowed max message size. The max is 50331648](https://discuss.elastic.co/t/mongodb-error-checking-ip-port-mongo-message-exceeds-allowed-max-message-size-the-max-is-50331648/289750)
**Author:** [@Bugsbee](https://discuss.elastic.co/u/Bugsbee)\ **Replies:** 2\ **Last updated:** [November 21, 2021, 2:18am UTC](https://discuss.elastic.co/t/mongodb-error-checking-ip-port-mongo-message-exceeds-allowed-max-message-size-the-max-is-50331648/289750 "2021-11-21T02:18:54Z")
hello, any idea as to why i get the error below? my ELK has been working on. its just today i chnaged he password.. and nothing else. however this time when i start elk , i get the error below anything else i need t… --- ## [Questions about using must, should words together and Turkish char problem](https://discuss.elastic.co/t/questions-about-using-must-should-words-together-and-turkish-char-problem/289755)
**Author:** [@aox](https://discuss.elastic.co/u/aox)\ **Replies:** 1\ **Last updated:** [November 20, 2021, 9:06pm UTC](https://discuss.elastic.co/t/questions-about-using-must-should-words-together-and-turkish-char-problem/289755 "2021-11-20T21:06:05Z")
Hello I am using Elasticsearch-oss-7.10.2-1.x86\_64. I have 2 questions: Question 1) I want to combine this query results: GET /turkish\_example/\_search { "query": { "bool": { "should": \[ { "simple\_q… --- ## [How much clusters must I use in elastic stack?](https://discuss.elastic.co/t/how-much-clusters-must-i-use-in-elastic-stack/289735)
**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\ **Replies:** 1\ **Last updated:** [November 20, 2021, 7:10pm UTC](https://discuss.elastic.co/t/how-much-clusters-must-i-use-in-elastic-stack/289735 "2021-11-20T19:10:27Z")
I am confused which approach would be better having single cluster with 12 nodes or having 3 cluster with 4 nodes each in elastic stack. What are the advantages and disadvantages of single cluster? Does elastic charge me… --- ## [Documents are getting duplicated in mongodb](https://discuss.elastic.co/t/documents-are-getting-duplicated-in-mongodb/289745)
**Author:** [@Husnain](https://discuss.elastic.co/u/Husnain)\ **Replies:** 0\ **Last updated:** [November 20, 2021, 3:37pm UTC](https://discuss.elastic.co/t/documents-are-getting-duplicated-in-mongodb/289745 "2021-11-20T15:37:26Z")
Hi, I am trying to fetch data from mysql using logstash and storing them into Elasticsearch and mongodb.Document is getting stored in Elasticsearch properly and no duplicate documents are inserted,but in mongodb same do… --- ## [FIleBeat not pushing few lines to Logstash](https://discuss.elastic.co/t/filebeat-not-pushing-few-lines-to-logstash/289011)
**Author:** [@nandatibco](https://discuss.elastic.co/u/nandatibco)\ **Replies:** 3\ **Last updated:** [November 20, 2021, 3:30pm UTC](https://discuss.elastic.co/t/filebeat-not-pushing-few-lines-to-logstash/289011 "2021-11-20T15:30:05Z")
File beat is not pushing all lines in a file to Logstash, and it is not consistent, it skips 3 lines in between. Im new to File Beat, please suggest if I missed any configuration. For example, my log file looks like thi… --- ## [工作日常：如何从kibana 处转到Elasticsearch Service Console](https://discuss.elastic.co/t/kibana-elasticsearch-service-console/289733)
**Author:** [@monica\_l\_dp](https://discuss.elastic.co/u/monica_l_dp)\ **Replies:** 0\ **Last updated:** [November 20, 2021, 4:46am UTC](https://discuss.elastic.co/t/kibana-elasticsearch-service-console/289733 "2021-11-20T04:46:41Z")
大家好，我的公司给了我kibana的权限。（可以上去进行查询并实验） 但当我去Elasticsearch service console的时候，要求我从新注册一个账号。 我想问问，这两个不是连在一起的吗？ 我的目的是想看一看cluster performance。 尤其是search response times（ms）那个图表。 --- ## [I am confused on backup and restore process, can someone please help?](https://discuss.elastic.co/t/i-am-confused-on-backup-and-restore-process-can-someone-please-help/289729)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 2\ **Last updated:** [November 20, 2021, 4:05am UTC](https://discuss.elastic.co/t/i-am-confused-on-backup-and-restore-process-can-someone-please-help/289729 "2021-11-20T04:05:14Z")
Hi Team, I have single node elastic cluster and my indices are getting created everyday. I do close them manually every after 120 days. So once index is closed would it be possible to take a a backup of those? Or is the… --- ## [New to Logstash - can't get it to connect to my Elasticsearch](https://discuss.elastic.co/t/new-to-logstash-cant-get-it-to-connect-to-my-elasticsearch/289727)
**Author:** [@aluminex](https://discuss.elastic.co/u/aluminex)\ **Replies:** 1\ **Last updated:** [November 20, 2021, 3:28am UTC](https://discuss.elastic.co/t/new-to-logstash-cant-get-it-to-connect-to-my-elasticsearch/289727 "2021-11-20T03:28:55Z")
I have Elasticsearch and Kibana on a different host. I'm trying to get my Logstash instance to output to Elasticsearch on a remote host. I can forward my logs to Filebeat and then to Elastic, but I am trying to write/t… --- ## [Faile to start Elasticsearch 7.12.1](https://discuss.elastic.co/t/faile-to-start-elasticsearch-7-12-1/289718)
**Author:** [@tranha31](https://discuss.elastic.co/u/tranha31)\ **Replies:** 2\ **Last updated:** [November 20, 2021, 1:27am UTC](https://discuss.elastic.co/t/faile-to-start-elasticsearch-7-12-1/289718 "2021-11-20T01:27:05Z")
I install vietnamese-analysis for Elasticsearch 7.12.1. But when I restart Elasticsearch, I get the following error: \[2021-11-20T01:56:57,505\]\[ERROR\]\[o.e.b.ElasticsearchUncaughtExceptionHandler\] \[dell-Precision-M4800… --- ## [Elasticsearch Synonyms - can phrases be used?](https://discuss.elastic.co/t/elasticsearch-synonyms-can-phrases-be-used/289723)
**Author:** [@pmono](https://discuss.elastic.co/u/pmono)\ **Replies:** 0\ **Last updated:** [November 19, 2021, 11:08pm UTC](https://discuss.elastic.co/t/elasticsearch-synonyms-can-phrases-be-used/289723 "2021-11-19T23:08:08Z")
Howdy, is it possible to use Phrase Synonyms for indexing? We had issues on ES 7.8 where it would crash indexing. We recently switched to 7.13.2. Are there any changes in terms of synonyms? Can phrases be used? Examp… --- ## [Tuning queries](https://discuss.elastic.co/t/tuning-queries/289721)
**Author:** [@Nick\_Hatfield](https://discuss.elastic.co/u/Nick_Hatfield)\ **Replies:** 0\ **Last updated:** [November 19, 2021, 10:50pm UTC](https://discuss.elastic.co/t/tuning-queries/289721 "2021-11-19T22:50:38Z")
Hey gang is there anyone that can help me with an Elasticsearch query? I'm trying to make the query more efficient by returning only unique hits. My query is structured like this currently: { "query": { "bool":… --- ## [Kibana not showing recent Elasticsearch data](https://discuss.elastic.co/t/kibana-not-showing-recent-elasticsearch-data/289647)
**Author:** [@sanjpatil](https://discuss.elastic.co/u/sanjpatil)\ **Replies:** 2\ **Last updated:** [November 19, 2021, 10:24pm UTC](https://discuss.elastic.co/t/kibana-not-showing-recent-elasticsearch-data/289647 "2021-11-19T22:24:30Z")
Hello, We observed kibana stopped showing recent ES data from 31st October. If i query Elasticsearch index it has all the data its just not displaying on the dashboard. Can some one help with this ? Elasticsearch versi… --- ## [How to monitor events in chain or to detect if transaction was completed or not](https://discuss.elastic.co/t/how-to-monitor-events-in-chain-or-to-detect-if-transaction-was-completed-or-not/289596)
**Author:** [@sagarseth](https://discuss.elastic.co/u/sagarseth)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 9:08pm UTC](https://discuss.elastic.co/t/how-to-monitor-events-in-chain-or-to-detect-if-transaction-was-completed-or-not/289596 "2021-11-19T21:08:54Z")
Hello Friends, lets imagine i have following state , i get a message ordered timeStamp1,transactionA,Status\_ordered I want to check if for this transaction if the order was delivered in the next 15 mins or not,, if no… [Previous page](https://discuss.elastic.co/latest.md?page=1379) [Next page](https://discuss.elastic.co/latest.md?page=1381)