# Latest **URL:** https://discuss.elastic.co/latest.md?page=1381 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1382 --- ## [How can I delete remote index via Kibana's "Index Management" feature?](https://discuss.elastic.co/t/how-can-i-delete-remote-index-via-kibanas-index-management-feature/289719)
**Author:** [@jwmocs](https://discuss.elastic.co/u/jwmocs)\ **Replies:** 0\ **Last updated:** [November 19, 2021, 8:34pm UTC](https://discuss.elastic.co/t/how-can-i-delete-remote-index-via-kibanas-index-management-feature/289719 "2021-11-19T20:34:39Z")
Is it possible to remove old index data on a remote cluster using Kibana? I can delete indices on the local cluster fine in Kibana UI, but do I have to resort to the API to do the same for indices on a remote cluster? --- ## [APM fields doesn't exist in kibana APM observability and empty values in errors and metrics](https://discuss.elastic.co/t/apm-fields-doesnt-exist-in-kibana-apm-observability-and-empty-values-in-errors-and-metrics/289711)
**Author:** [@Sergio\_Ferreyra](https://discuss.elastic.co/u/Sergio_Ferreyra)\ **Replies:** 0\ **Last updated:** [November 19, 2021, 4:37pm UTC](https://discuss.elastic.co/t/apm-fields-doesnt-exist-in-kibana-apm-observability-and-empty-values-in-errors-and-metrics/289711 "2021-11-19T16:37:36Z")
Hi team, I am newbie using apm, using apm-server and apm-agent php, apm-server 7.12 apm-aget-php v1.3 The problem here is there are some fields that don't exist in the index, for example: http.response.status\_code … --- ## [Apply best\_compression to save disk space](https://discuss.elastic.co/t/apply-best-compression-to-save-disk-space/289705)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 2\ **Last updated:** [November 19, 2021, 7:27pm UTC](https://discuss.elastic.co/t/apply-best-compression-to-save-disk-space/289705 "2021-11-19T19:27:41Z")
Hi All, We are struggling with disk space issues on the Elasticsearch nodes. I came across the best\_compression option and the suggested way is as follows using dev tools: 1. Close all indices: POST \_all/\_close 2. A… --- ## [Kibana log to cloud storage](https://discuss.elastic.co/t/kibana-log-to-cloud-storage/289692)
**Author:** [@aditi\_salunke](https://discuss.elastic.co/u/aditi_salunke)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 7:04pm UTC](https://discuss.elastic.co/t/kibana-log-to-cloud-storage/289692 "2021-11-19T19:04:43Z")
Hello, Can we have direct connectivity to upload kibana.log file after reaching to specific size of file to cloud storage? Or Can we specify cloud uploading path in kibana.yml itself for log.path setting? Because aft… --- ## [Logstash rewrite value for the same key instead of append](https://discuss.elastic.co/t/logstash-rewrite-value-for-the-same-key-instead-of-append/289702)
**Author:** [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 6:30pm UTC](https://discuss.elastic.co/t/logstash-rewrite-value-for-the-same-key-instead-of-append/289702 "2021-11-19T18:30:08Z")
Hello! I'm trying to parse CheckPoint log which contains data like this \_\_policy\_id\_tag:"product=APP1 & APP2\[db\_tag={ABCDEF};mgmt=abcd;date=123456789;policy\_name=foo\]";product:"APP3" I use the filter filter { kv { … --- ## [Add json object](https://discuss.elastic.co/t/add-json-object/289682)
**Author:** [@Roberto\_B](https://discuss.elastic.co/u/Roberto_B)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 6:08pm UTC](https://discuss.elastic.co/t/add-json-object/289682 "2021-11-19T18:08:15Z")
Hi there, I would like to add a field liek this: field : {sub1 : null} which is the best way to do that? Kind Regards Roberto --- ## [Logstash information](https://discuss.elastic.co/t/logstash-information/289595)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 3\ **Last updated:** [November 19, 2021, 6:00pm UTC](https://discuss.elastic.co/t/logstash-information/289595 "2021-11-19T18:00:55Z")
I am really struggling to understand the documentation, and as such cannot work out what I need to do to get logstash to work. So logstash arrives as a zip (Is there an msi?) But nothing configured. The documentation … --- ## [Painless max script size limit?](https://discuss.elastic.co/t/painless-max-script-size-limit/289707)
**Author:** [@Matt\_McGovern](https://discuss.elastic.co/u/Matt_McGovern)\ **Replies:** 2\ **Last updated:** [November 19, 2021, 5:58pm UTC](https://discuss.elastic.co/t/painless-max-script-size-limit/289707 "2021-11-19T17:58:14Z")
It used to be that the total size of a painless stored script was 16384, from a hard-coded system limit I've seen referenced before as MAXIMUM\_SOURCE\_LENGTH = 16384. I've run into the limit within the last few years and… --- ## [Can't find Pinned Search in Java high level rest client](https://discuss.elastic.co/t/cant-find-pinned-search-in-java-high-level-rest-client/289715)
**Author:** [@sutty100](https://discuss.elastic.co/u/sutty100)\ **Replies:** 0\ **Last updated:** [November 19, 2021, 5:40pm UTC](https://discuss.elastic.co/t/cant-find-pinned-search-in-java-high-level-rest-client/289715 "2021-11-19T17:40:56Z")
I can't seem to find in the Java High level rest client (7.15.2) the pinned search query type. It is not in the QueryBuilders object, am I missing something here or is this just not included in the high level rest client… --- ## [Getting logstash to run](https://discuss.elastic.co/t/getting-logstash-to-run/289673)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 5:37pm UTC](https://discuss.elastic.co/t/getting-logstash-to-run/289673 "2021-11-19T17:37:15Z")
I have downloaded the 7.15 version on logstash and unzipped. Unfortunately the lack of an installer leaves the solution in a non working state. My current - first - challenge is getting logstash to use the bundled jdk.… --- ## [Parsing issues](https://discuss.elastic.co/t/parsing-issues/289681)
**Author:** [@nickel43](https://discuss.elastic.co/u/nickel43)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 5:32pm UTC](https://discuss.elastic.co/t/parsing-issues/289681 "2021-11-19T17:32:13Z")
Hello, I'm new to Elastic and trying to parse JSON files in order to have multiple fields, so that I can make statistics out of it in Kibana. Here is a sample: { "info": { "generated\_on": "2017-12-03 08:41… --- ## [Security dashboard user (7.15)](https://discuss.elastic.co/t/security-dashboard-user-7-15/289592)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 5:05pm UTC](https://discuss.elastic.co/t/security-dashboard-user-7-15/289592 "2021-11-19T17:05:14Z")
I have found some docs that suggests that I need to create a user that has access to spaces, and put my dashboard into that space. My issue here is that that documentation doesn't supply the how! Can someone point me t… --- ## [Kibana not ready yet error after upgrading from 7.6.1 to 7.15.2](https://discuss.elastic.co/t/kibana-not-ready-yet-error-after-upgrading-from-7-6-1-to-7-15-2/289696)
**Author:** [@3c3m](https://discuss.elastic.co/u/3c3m)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 4:10pm UTC](https://discuss.elastic.co/t/kibana-not-ready-yet-error-after-upgrading-from-7-6-1-to-7-15-2/289696 "2021-11-19T16:10:03Z")
Hello, We upgraded our elastic stack to logstash, Elasticsearch and kibana from version 7.6.1 to 7.15.2 respectively. But we get Kibana server is not ready yet error in kibana interface. kibana service is running but … --- ## [Get a number und events per minute](https://discuss.elastic.co/t/get-a-number-und-events-per-minute/289217)
**Author:** [@bitnapper](https://discuss.elastic.co/u/bitnapper)\ **Replies:** 3\ **Last updated:** [November 19, 2021, 3:57pm UTC](https://discuss.elastic.co/t/get-a-number-und-events-per-minute/289217 "2021-11-19T15:57:35Z")
Hi, I tried to figure out how many documents come in per minute. I coulnt find anything useful in stack monitoring so I tried with kibana and failed. I built a query giving me the documents from last 90 days but I cant … --- ## [Logstash not sending syslog to elasticsearch](https://discuss.elastic.co/t/logstash-not-sending-syslog-to-elasticsearch/289020)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 41\ **Last updated:** [November 19, 2021, 3:36pm UTC](https://discuss.elastic.co/t/logstash-not-sending-syslog-to-elasticsearch/289020 "2021-11-19T15:36:16Z")
Hello Elastic team. I have been asking tons of questions and have been slowly making my way through the final part of my ELK SIEM installation. I am running a small environment with Elasticsearch, Logstash and Kibana i… --- ## [Logstash Lookup Fields](https://discuss.elastic.co/t/logstash-lookup-fields/289357)
**Author:** [@John\_snow](https://discuss.elastic.co/u/John_snow)\ **Replies:** 35\ **Last updated:** [November 18, 2021, 6:30pm UTC](https://discuss.elastic.co/t/logstash-lookup-fields/289357 "2021-11-18T18:30:57Z")
i wanted to use a lookup table in Logstash to check if account id exisits in lookub table then it will grab the output location from the lookup file. e--g Lookup File account\_id, output\_location, secrets, 123, s3, abcde… --- ## [Winlogbeat NewProcessFields Function Missing Parent Process](https://discuss.elastic.co/t/winlogbeat-newprocessfields-function-missing-parent-process/289679)
**Author:** [@elkn00b](https://discuss.elastic.co/u/elkn00b)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 3:12pm UTC](https://discuss.elastic.co/t/winlogbeat-newprocessfields-function-missing-parent-process/289679 "2021-11-19T15:12:14Z")
Hi Elastic Team, I'm writing to request an update to the winlogbeat Windows Security module to add the parent process ID value for Windows Security event 4688. Lines 2132 to 2142 handle field renames for parent/child p… --- ## [ILM Policy is not working](https://discuss.elastic.co/t/ilm-policy-is-not-working/289465)
**Author:** [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\ **Replies:** 4\ **Last updated:** [November 19, 2021, 3:00pm UTC](https://discuss.elastic.co/t/ilm-policy-is-not-working/289465 "2021-11-19T15:00:21Z")
I have an Index Lifecycle Management Policy using a Hot Phase with recommended defaults. So Roll over when an index is 30 days old or any primary shard reaches 50 gigabytes. I assume this means that the index is conv… --- ## [Global Ordinals execution hint](https://discuss.elastic.co/t/global-ordinals-execution-hint/289699)
**Author:** [@ananth](https://discuss.elastic.co/u/ananth)\ **Replies:** 0\ **Last updated:** [November 19, 2021, 2:42pm UTC](https://discuss.elastic.co/t/global-ordinals-execution-hint/289699 "2021-11-19T14:42:30Z")
Hi All, I went through all the global ordinal related blogs and previous questions such as Global ordinals performance and size on-heap" Whether execution\_hint = map will operate in segment-private ordinal space ? My … --- ## [Efficient filtering in custom plugin](https://discuss.elastic.co/t/efficient-filtering-in-custom-plugin/289697)
**Author:** [@mjanuszkiewicz-tt](https://discuss.elastic.co/u/mjanuszkiewicz-tt)\ **Replies:** 0\ **Last updated:** [November 19, 2021, 2:40pm UTC](https://discuss.elastic.co/t/efficient-filtering-in-custom-plugin/289697 "2021-11-19T14:40:37Z")
Hello, I'm writing a custom plugin that allows filtering/scoring using an external service. The overhead of calling the service is relatively high: filtering a single document takes 80ms, filtering 10k documents takes 1… --- ## [Send Filebeat Internal Monitoring Via Logstash](https://discuss.elastic.co/t/send-filebeat-internal-monitoring-via-logstash/289468)
**Author:** [@jceddy](https://discuss.elastic.co/u/jceddy)\ **Replies:** 4\ **Last updated:** [November 19, 2021, 2:22pm UTC](https://discuss.elastic.co/t/send-filebeat-internal-monitoring-via-logstash/289468 "2021-11-19T14:22:00Z")
Basic question: Is there a way to configure Filebeat Internal Monitoring via Logstash? I am trying to add monitoring for Filebeat running on some external systems, but can only send it via Logstash (not directly to Elas… --- ## [Rename field problem](https://discuss.elastic.co/t/rename-field-problem/289669)
**Author:** [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Replies:** 2\ **Last updated:** [November 19, 2021, 2:12pm UTC](https://discuss.elastic.co/t/rename-field-problem/289669 "2021-11-19T14:12:09Z")
Hello! I have input data like "abc":"123";"def":"456";"ghi":"789" I use the following filter to parse data and rename "abc" field to "blabla" filter { kv { source =\> "message" field\_split =\> ";" value\_s… --- ## [Network metric when docker network is awsvpc](https://discuss.elastic.co/t/network-metric-when-docker-network-is-awsvpc/289687)
**Author:** [@mancausoft](https://discuss.elastic.co/u/mancausoft)\ **Replies:** 0\ **Last updated:** [November 19, 2021, 1:04pm UTC](https://discuss.elastic.co/t/network-metric-when-docker-network-is-awsvpc/289687 "2021-11-19T13:04:20Z")
I'm using metribeat running on ecs, and i can't get metrics from docker that use as network awsvpc. All docker that use bridge network are working fine. Configuration: module: docker enabled: true metricsets: conta… --- ## [How to get search results with exact matches sorted by popularity within themselves and then partial matches sorted by popularity within themselves?](https://discuss.elastic.co/t/how-to-get-search-results-with-exact-matches-sorted-by-popularity-within-themselves-and-then-partial-matches-sorted-by-popularity-within-themselves/289685)
**Author:** [@f3dd3rn](https://discuss.elastic.co/u/f3dd3rn)\ **Replies:** 0\ **Last updated:** [November 19, 2021, 12:49pm UTC](https://discuss.elastic.co/t/how-to-get-search-results-with-exact-matches-sorted-by-popularity-within-themselves-and-then-partial-matches-sorted-by-popularity-within-themselves/289685 "2021-11-19T12:49:06Z")
Hello Elastic community, I am new to Elasticsearch and feel lost as to how to accomplish this. I have tried a lot of different things, but was not able to accomplish this. Let me explain the expected search results wi… --- ## [Split chart with individual y axis?](https://discuss.elastic.co/t/split-chart-with-individual-y-axis/288492)
**Author:** [@NiclasK](https://discuss.elastic.co/u/NiclasK)\ **Replies:** 2\ **Last updated:** [November 19, 2021, 12:40pm UTC](https://discuss.elastic.co/t/split-chart-with-individual-y-axis/288492 "2021-11-19T12:40:52Z")
Hi, I have a field that contains a string representation of a state. Some states are normal which means that there are many documents with these states. Other states represents errors. Usually, the number of documents c… --- ## [Query with wildcard do not return result if the item has data repeat more than 2 times](https://discuss.elastic.co/t/query-with-wildcard-do-not-return-result-if-the-item-has-data-repeat-more-than-2-times/289500)
**Author:** [@Tu\_Phan](https://discuss.elastic.co/u/Tu_Phan)\ **Replies:** 2\ **Last updated:** [November 19, 2021, 11:11am UTC](https://discuss.elastic.co/t/query-with-wildcard-do-not-return-result-if-the-item-has-data-repeat-more-than-2-times/289500 "2021-11-19T11:11:46Z")
Hi Elastic team & community, I got a trouble with wildcard query do not return expected result when having items with repeated data. With the code below I expected that search query returns 2 items but it returns only … --- ## [How to parse duplicated keys with different values](https://discuss.elastic.co/t/how-to-parse-duplicated-keys-with-different-values/288994)
**Author:** [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Replies:** 3\ **Last updated:** [November 19, 2021, 9:33am UTC](https://discuss.elastic.co/t/how-to-parse-duplicated-keys-with-different-values/288994 "2021-11-19T09:33:14Z")
Hello! I'm trying to parse CheckPoint log which contains duplicated keys but with different values. For example ... match\_id:"555"; match\_id:"777"; ... When I use kv plugin kv { source =\> "message" field\_split =\> … --- ## [\[ANNOUCEMENT\] Forest, an Elasticsearch GUI for text search released](https://discuss.elastic.co/t/annoucement-forest-an-elasticsearch-gui-for-text-search-released/289664)
**Author:** [@pnmougel](https://discuss.elastic.co/u/pnmougel)\ **Replies:** 0\ **Last updated:** [November 19, 2021, 7:59am UTC](https://discuss.elastic.co/t/annoucement-forest-an-elasticsearch-gui-for-text-search-released/289664 "2021-11-19T07:59:16Z")
Hello, I've just released a new GUI for Elasticsearch called Forest. It has similar functionalities compared to other Elasticsearch GUI (e.g., Cerebro, ElasticVue) except that it provides a powerful REST query editor wit… --- ## [Elasticsearch files in tmp folder: how to change there location](https://discuss.elastic.co/t/elasticsearch-files-in-tmp-folder-how-to-change-there-location/289543)
**Author:** [@1ac727ff300829bca0fa](https://discuss.elastic.co/u/1ac727ff300829bca0fa)\ **Replies:** 4\ **Last updated:** [November 19, 2021, 7:02am UTC](https://discuss.elastic.co/t/elasticsearch-files-in-tmp-folder-how-to-change-there-location/289543 "2021-11-19T07:02:16Z")
Hello guys, I have set up elk in linx server using tar, but my tmp directory gets filled with files in following formates /tmp/elasticsearch-17741669071348173933 How to change there location? --- ## [Java application using BulkProcessing hangs When "circuit\_breaking\_exception" occurs](https://discuss.elastic.co/t/java-application-using-bulkprocessing-hangs-when-circuit-breaking-exception-occurs/289660)
**Author:** [@Vinay\_Gayki](https://discuss.elastic.co/u/Vinay_Gayki)\ **Replies:** 0\ **Last updated:** [November 19, 2021, 6:27am UTC](https://discuss.elastic.co/t/java-application-using-bulkprocessing-hangs-when-circuit-breaking-exception-occurs/289660 "2021-11-19T06:27:20Z")
Using ES 7.5.1 as the server and RestHighLevelClient in java application. Java application hangs after circuit\_breaking\_exception and becomes unresponsive. We are indexing data using bulk API. Stack trace: Name: Orac… [Previous page](https://discuss.elastic.co/latest.md?page=1380) [Next page](https://discuss.elastic.co/latest.md?page=1382)