# Latest **URL:** https://discuss.elastic.co/latest.md?page=1385 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1386 --- ## [Watcher template for terms with no data](https://discuss.elastic.co/t/watcher-template-for-terms-with-no-data/289490)
**Author:** [@GavinBeattie](https://discuss.elastic.co/u/GavinBeattie)\ **Replies:** 0\ **Last updated:** [November 17, 2021, 5:56pm UTC](https://discuss.elastic.co/t/watcher-template-for-terms-with-no-data/289490 "2021-11-17T17:56:38Z")
Hi, I would like a watcher alert (released as an email) that identifies vehicles with no data, for example: vehicles = \["abc", "def", "ghi"\] show vehicles with no data in past 7 days. I could count those that have occ… --- ## [?refresh or block on the Search API](https://discuss.elastic.co/t/refresh-or-block-on-the-search-api/289382)
**Author:** [@Bryji](https://discuss.elastic.co/u/Bryji)\ **Replies:** 0\ **Last updated:** [November 17, 2021, 1:41am UTC](https://discuss.elastic.co/t/refresh-or-block-on-the-search-api/289382 "2021-11-17T01:41:22Z")
It would be nice if the Search API supported ?refresh like the Index/Update/Delete APIs, so that requests could block until a consistent result could be returned. Has this ever been discussed / proposed? Any other sugges… --- ## [SQL histogram returns unexpected offset](https://discuss.elastic.co/t/sql-histogram-returns-unexpected-offset/289187)
**Author:** [@HarmenB](https://discuss.elastic.co/u/HarmenB)\ **Replies:** 2\ **Last updated:** [November 17, 2021, 5:42pm UTC](https://discuss.elastic.co/t/sql-histogram-returns-unexpected-offset/289187 "2021-11-17T17:42:22Z")
I'm trying to create a Histogram query using the SQL language. My goal is to get 3 buckets covering 30 days each. The following query does work but gives me an unexpected offset: POST \_sql?format=txt { "query": "SELE… --- ## [When using live reloading, why doesn't filebeat trigger live reloading immediately on first start?](https://discuss.elastic.co/t/when-using-live-reloading-why-doesnt-filebeat-trigger-live-reloading-immediately-on-first-start/289482)
**Author:** [@zhiyanglee](https://discuss.elastic.co/u/zhiyanglee)\ **Replies:** 0\ **Last updated:** [November 17, 2021, 5:16pm UTC](https://discuss.elastic.co/t/when-using-live-reloading-why-doesnt-filebeat-trigger-live-reloading-immediately-on-first-start/289482 "2021-11-17T17:16:24Z")
In the example below, "reload.period" specifies that the file is checked for changes once every 30 seconds. however, the first time you start filebeat you still have to wait 30 seconds for the configuration file to load,… --- ## [Failed to start Elasticsearch.7.15.2](https://discuss.elastic.co/t/failed-to-start-elasticsearch-7-15-2/289361)
**Author:** [@tranha31](https://discuss.elastic.co/u/tranha31)\ **Replies:** 6\ **Last updated:** [November 17, 2021, 4:52pm UTC](https://discuss.elastic.co/t/failed-to-start-elasticsearch-7-15-2/289361 "2021-11-17T16:52:57Z")
I want to start Elasticsearch v7.12.1. But it is not working. I don't know what is wrong. Someone help me, please!!!!!!!! elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.se… --- ## [Accessing index shard directories via pylucene](https://discuss.elastic.co/t/accessing-index-shard-directories-via-pylucene/289384)
**Author:** [@Ben\_Timby](https://discuss.elastic.co/u/Ben_Timby)\ **Replies:** 4\ **Last updated:** [November 17, 2021, 4:50pm UTC](https://discuss.elastic.co/t/accessing-index-shard-directories-via-pylucene/289384 "2021-11-17T16:50:36Z")
Hi, I have old index files from Elasticsearch 1.7.6. The version of lucene utilized is 4.10.4, I was able to get lucene to open a directory that represents one of the three shards of my index. I can pull the documents fr… --- ## [Jaeger - unexpected HTTP status code received from server: 404](https://discuss.elastic.co/t/jaeger-unexpected-http-status-code-received-from-server-404/289477)
**Author:** [@gunnarif](https://discuss.elastic.co/u/gunnarif)\ **Replies:** 1\ **Last updated:** [November 17, 2021, 4:40pm UTC](https://discuss.elastic.co/t/jaeger-unexpected-http-status-code-received-from-server-404/289477 "2021-11-17T16:40:17Z")
APM Server version: 7.11.2 APM Agent language and version: Jaeger 1.28.0 windows Description of the problem including expected versus actual behavior. Please include screenshots (if relevant): Running jager agent an… --- ## [Delete by query?](https://discuss.elastic.co/t/delete-by-query/289472)
**Author:** [@Saliinger](https://discuss.elastic.co/u/Saliinger)\ **Replies:** 2\ **Last updated:** [November 17, 2021, 4:27pm UTC](https://discuss.elastic.co/t/delete-by-query/289472 "2021-11-17T16:27:25Z")
Hello. :slight\_smile: I'm using delete\_by\_query to remove old data from all index. Looks like that: POST \*/\_delete\_by\_query { "query": { "bool": { "filter": \[ { "range": { "@t… --- ## [File Integrity Monitoring for Windows Using Elastic Agent](https://discuss.elastic.co/t/file-integrity-monitoring-for-windows-using-elastic-agent/289476)
**Author:** [@afarley](https://discuss.elastic.co/u/afarley)\ **Replies:** 0\ **Last updated:** [November 17, 2021, 3:46pm UTC](https://discuss.elastic.co/t/file-integrity-monitoring-for-windows-using-elastic-agent/289476 "2021-11-17T15:46:35Z")
Hello all, I have been looking into how to implement Elastic Security most effectively to meet PCI requirements and a snag I've run into with other tools is successfully implementing FIM in a Windows environment. I am n… --- ## [Dashboard TSVB panel item url ignores filter when linked to dashboard](https://discuss.elastic.co/t/dashboard-tsvb-panel-item-url-ignores-filter-when-linked-to-dashboard/289431)
**Author:** [@ella.danielsson](https://discuss.elastic.co/u/ella.danielsson)\ **Replies:** 1\ **Last updated:** [November 17, 2021, 4:17pm UTC](https://discuss.elastic.co/t/dashboard-tsvb-panel-item-url-ignores-filter-when-linked-to-dashboard/289431 "2021-11-17T16:17:17Z")
Hi, I have linked the objects in a TSVB data table to another kibana dashboard via the item URL option. In the link I use the value of the data table as input to a query like: meta:(alias:!n,disabled:!f,index:'5beaebb… --- ## [Origin of Recursive Lookup Not Captured](https://discuss.elastic.co/t/origin-of-recursive-lookup-not-captured/289479)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 0\ **Last updated:** [November 17, 2021, 4:16pm UTC](https://discuss.elastic.co/t/origin-of-recursive-lookup-not-captured/289479 "2021-11-17T16:16:37Z")
I have packetbeat installed on my DNS server. The intent was to capture any DNS traffic from clients on my network. This is working well, I'm seeing client lookups being recorded. However, when my DNS server has to go… --- ## [Rabbit MQ file beat unable to install in ubuntu](https://discuss.elastic.co/t/rabbit-mq-file-beat-unable-to-install-in-ubuntu/289443)
**Author:** [@Anupam\_Mishra](https://discuss.elastic.co/u/Anupam_Mishra)\ **Replies:** 0\ **Last updated:** [November 17, 2021, 12:06pm UTC](https://discuss.elastic.co/t/rabbit-mq-file-beat-unable-to-install-in-ubuntu/289443 "2021-11-17T12:06:32Z")
curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.15.2-linux-x86\_64.tar.gz tar xzvf filebeat-7.15.2-linux-x86\_64.tar.gz Post execution it does create a folder with filebeat-7.15.2-linux-x86\_6… --- ## [Ingest Attachment Plugin update index](https://discuss.elastic.co/t/ingest-attachment-plugin-update-index/289346)
**Author:** [@fribeiro-keep](https://discuss.elastic.co/u/fribeiro-keep)\ **Replies:** 6\ **Last updated:** [November 17, 2021, 4:00pm UTC](https://discuss.elastic.co/t/ingest-attachment-plugin-update-index/289346 "2021-11-17T16:00:56Z")
Hey there, I'm trying to implement the Ingest Attachment plugin on Elasticsearch 6.8 My goal is to append the document text to an existing index. This is a sample of my current index { "\_index": "koha\_biblios", "\_typ… --- ## [Sort on multiple fields not working](https://discuss.elastic.co/t/sort-on-multiple-fields-not-working/289478)
**Author:** [@Karthikeyan\_Amaresan](https://discuss.elastic.co/u/Karthikeyan_Amaresan)\ **Replies:** 0\ **Last updated:** [November 17, 2021, 3:56pm UTC](https://discuss.elastic.co/t/sort-on-multiple-fields-not-working/289478 "2021-11-17T15:56:22Z")
Query { "size": 20, "query": { "match\_all": {} }, "\_source": \["INBOUND\_CALL\_mod\_date", "OUTBOUND\_CALL\_mod\_date"\], "sort": \[ { "INBOUND\_CALL\_mod\_date": { "order": "desc" } }, … --- ## [Add Data Is Broken?](https://discuss.elastic.co/t/add-data-is-broken/289031)
**Author:** [@corndog](https://discuss.elastic.co/u/corndog)\ **Replies:** 2\ **Last updated:** [November 17, 2021, 3:51pm UTC](https://discuss.elastic.co/t/add-data-is-broken/289031 "2021-11-17T15:51:41Z")
I am at http://localhost:5601/app/home#/tutorial\_directory Specifically Add Data / Upload File. When I Upload my newline delimited JSON file, it is correctly formatted as ndjson. HOWEVER THERE ARE ABSOLUTELY NO ITEMS … --- ## [FILEBEAT: hostname inside message not parsed](https://discuss.elastic.co/t/filebeat-hostname-inside-message-not-parsed/288850)
**Author:** [@Sederfo](https://discuss.elastic.co/u/Sederfo)\ **Replies:** 2\ **Last updated:** [November 17, 2021, 3:50pm UTC](https://discuss.elastic.co/t/filebeat-hostname-inside-message-not-parsed/288850 "2021-11-17T15:50:06Z")
We are using Filebeat for processing Syslog messages sent from switches. We know that the raw Syslog messages contain the hostname of the device (we tested it with RSyslog). The problem is that Filebeat does not read th… --- ## [Adapting ECS process field set for a process tree?](https://discuss.elastic.co/t/adapting-ecs-process-field-set-for-a-process-tree/289374)
**Author:** [@Gerry7](https://discuss.elastic.co/u/Gerry7)\ **Replies:** 1\ **Last updated:** [November 17, 2021, 3:15pm UTC](https://discuss.elastic.co/t/adapting-ecs-process-field-set-for-a-process-tree/289374 "2021-11-17T15:15:06Z")
We have a system sending alerts on process activity. The alert contains an entire process tree related to the offending process - the parent process, grand parent proces, etc. The ECS process field set has a parent node… --- ## [ILM - Delete beat data after 30 days](https://discuss.elastic.co/t/ilm-delete-beat-data-after-30-days/288992)
**Author:** [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\ **Replies:** 12\ **Last updated:** [November 16, 2021, 1:14pm UTC](https://discuss.elastic.co/t/ilm-delete-beat-data-after-30-days/288992 "2021-11-16T13:14:31Z")
Hello Elastic We are ingesting a lot of data into Elastic. We are using index templates. But our servers are filling up. I want to automate the cleaning of old data, instead of having to manually watch when they're fi… --- ## [Elastic Search Not Starting](https://discuss.elastic.co/t/elastic-search-not-starting/289422)
**Author:** [@gang\_giz](https://discuss.elastic.co/u/gang_giz)\ **Replies:** 9\ **Last updated:** [November 17, 2021, 1:37pm UTC](https://discuss.elastic.co/t/elastic-search-not-starting/289422 "2021-11-17T13:37:37Z")
Hi, We have to install Elasticsearch 7.9 to my Cpanel Server and we have done the install and started to Start the Elasticsearch it is failed when I check the log I see this. Im pasting the Entire log in multiple threds … --- ## [RestHighLevelClient request time out not worked](https://discuss.elastic.co/t/resthighlevelclient-request-time-out-not-worked/289458)
**Author:** [@ertugrul.gamgam](https://discuss.elastic.co/u/ertugrul.gamgam)\ **Replies:** 0\ **Last updated:** [November 17, 2021, 1:35pm UTC](https://discuss.elastic.co/t/resthighlevelclient-request-time-out-not-worked/289458 "2021-11-17T13:35:10Z")
Hello I am using RestHighLevelClient 7.4.2 . I set time outs like below to test: @Bean public RestHighLevelClient restHighLevelClient() { HttpHost\[\] hosts = elasticsearchEnvironmentConfig.getNodes().stre… --- ## [How to parse long numbers?](https://discuss.elastic.co/t/how-to-parse-long-numbers/288783)
**Author:** [@rachelyang](https://discuss.elastic.co/u/rachelyang)\ **Replies:** 1\ **Last updated:** [November 17, 2021, 1:29pm UTC](https://discuss.elastic.co/t/how-to-parse-long-numbers/288783 "2021-11-17T13:29:46Z")
I have set up NUMBER type for item duration in the pattern of Logstash configuration as %{NUMBER:Duration} It can parse most of the numbers in the log files, like 9994568.872 , 20903.23, etc.. But it cannot parse the… --- ## [Logstash not sending data into kibana](https://discuss.elastic.co/t/logstash-not-sending-data-into-kibana/289004)
**Author:** [@sai92](https://discuss.elastic.co/u/sai92)\ **Replies:** 1\ **Last updated:** [November 17, 2021, 1:21pm UTC](https://discuss.elastic.co/t/logstash-not-sending-data-into-kibana/289004 "2021-11-17T13:21:19Z")
Hello everyone I use logstash to read the json file and ingest data into index in Elasticsearch. But it works fine when run the command of /bin/logstash -f /etc/logstash/conf.d/log.test. But when I start it as service wi… --- ## [Import only delta (differences) from csv into mysql](https://discuss.elastic.co/t/import-only-delta-differences-from-csv-into-mysql/289283)
**Author:** [@Mihai\_Stuparu](https://discuss.elastic.co/u/Mihai_Stuparu)\ **Replies:** 1\ **Last updated:** [November 17, 2021, 1:19pm UTC](https://discuss.elastic.co/t/import-only-delta-differences-from-csv-into-mysql/289283 "2021-11-17T13:19:45Z")
Hello, I am using logstash to call an API (input), save it as .csv (filter) and upload it into a mysql table (output). All is good. But I need to do it each day (or each night rather): call that API, get the .csv and u… --- ## [Logstash http\_poller input / http filter design question](https://discuss.elastic.co/t/logstash-http-poller-input-http-filter-design-question/289012)
**Author:** [@byoungman](https://discuss.elastic.co/u/byoungman)\ **Replies:** 1\ **Last updated:** [November 17, 2021, 1:16pm UTC](https://discuss.elastic.co/t/logstash-http-poller-input-http-filter-design-question/289012 "2021-11-17T13:16:52Z")
Good Afternoon, I am starting to pull in AppDynamics metric information into our Elastic stack for persistence purposes. I have 5 metrics from each of 13 servers that I need to capture and my design in my Stage environ… --- ## [Parse one line as two lines](https://discuss.elastic.co/t/parse-one-line-as-two-lines/289073)
**Author:** [@Sjap1](https://discuss.elastic.co/u/Sjap1)\ **Replies:** 1\ **Last updated:** [November 17, 2021, 1:10pm UTC](https://discuss.elastic.co/t/parse-one-line-as-two-lines/289073 "2021-11-17T13:10:04Z")
Hello, I'm trying to parse multiple items in one line. My grok pattens match but logstash are outputting the data as arrays; How can i make the output look the where are two lines? input data: 2021-11-01 14:09:34 CET … --- ## [How am I supposed to understand why the field is confusing?](https://discuss.elastic.co/t/how-am-i-supposed-to-understand-why-the-field-is-confusing/289132)
**Author:** [@mrchile](https://discuss.elastic.co/u/mrchile)\ **Replies:** 2\ **Last updated:** [November 17, 2021, 1:07pm UTC](https://discuss.elastic.co/t/how-am-i-supposed-to-understand-why-the-field-is-confusing/289132 "2021-11-17T13:07:49Z")
Good afternoon, colleagues. I have been playing for several hours with this incomprehensible error, how can this be - someone can explain the dependencies of fields between different products, you can link to the documen… --- ## [New field in Weblogic access\_log , Logstash and Kibana](https://discuss.elastic.co/t/new-field-in-weblogic-access-log-logstash-and-kibana/288810)
**Author:** [@raultada](https://discuss.elastic.co/u/raultada)\ **Replies:** 1\ **Last updated:** [November 17, 2021, 1:02pm UTC](https://discuss.elastic.co/t/new-field-in-weblogic-access-log-logstash-and-kibana/288810 "2021-11-17T13:02:57Z")
Hello everyone, I´m new in ELK and there is a request to insert a new information came from weblogic access log ==\> "database name" This is the current weblogic log format (logging/tab http/advanced/Extended Logging Fo… --- ## [Trying to fetch documents from Mongodb using jdbc input plugin in logstash but getting this error messages](https://discuss.elastic.co/t/trying-to-fetch-documents-from-mongodb-using-jdbc-input-plugin-in-logstash-but-getting-this-error-messages/289133)
**Author:** [@Husnain](https://discuss.elastic.co/u/Husnain)\ **Replies:** 2\ **Last updated:** [November 17, 2021, 11:36am UTC](https://discuss.elastic.co/t/trying-to-fetch-documents-from-mongodb-using-jdbc-input-plugin-in-logstash-but-getting-this-error-messages/289133 "2021-11-17T11:36:58Z")
Hi All.There are documents in my Mongodb which I am trying to fetch out using logstash input jdbc plugin.I am using mongodb version 4.2.15 and logstash version is 7.10.1.When I run the logstash configuration pipeline I g… --- ## [Do ILM life time policies get reapplied to existing indexes?](https://discuss.elastic.co/t/do-ilm-life-time-policies-get-reapplied-to-existing-indexes/288801)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 5\ **Last updated:** [November 17, 2021, 11:21am UTC](https://discuss.elastic.co/t/do-ilm-life-time-policies-get-reapplied-to-existing-indexes/288801 "2021-11-17T11:21:54Z")
Hello I was using daily named indexes (yyyy.mm.dd) with a 180 day retention period but in august I changed to a monthy (yyyy.mm) and adjusted the retention period to 210ish days in order to keep the 180 retention period… --- ## [Timeout and slow responses](https://discuss.elastic.co/t/timeout-and-slow-responses/289418)
**Author:** [@ook](https://discuss.elastic.co/u/ook)\ **Replies:** 5\ **Last updated:** [November 17, 2021, 11:18am UTC](https://discuss.elastic.co/t/timeout-and-slow-responses/289418 "2021-11-17T11:18:05Z")
Hi, I have a Elasticsearch cluster in my k8s cluster to handle a unique small (451k docs) index (here the stats: ES Cluster stats as at 20211117 · GitHub ), so small (2gb) that I use 1 shard. All 5 nodes pods have 1CPU,… [Previous page](https://discuss.elastic.co/latest.md?page=1384) [Next page](https://discuss.elastic.co/latest.md?page=1386)