# Latest **URL:** https://discuss.elastic.co/latest.md?page=1402 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1403 --- ## [ELK capabilities to replace traditional monitoring](https://discuss.elastic.co/t/elk-capabilities-to-replace-traditional-monitoring/288445)
**Author:** [@gbeltramelli](https://discuss.elastic.co/u/gbeltramelli)\ **Replies:** 3\ **Last updated:** [November 5, 2021, 1:11am UTC](https://discuss.elastic.co/t/elk-capabilities-to-replace-traditional-monitoring/288445 "2021-11-05T01:11:09Z")
Hi, I am new to Elastic and in my organization we are thinking of eliminating NAGIOS as a monitoring tool so we are investigating the capabilities that this stack can give us. I have not been able to find how to replace… --- ## [Update mapping fails for the elastic (superuser)](https://discuss.elastic.co/t/update-mapping-fails-for-the-elastic-superuser/288450)
**Author:** [@dimitris\_sb](https://discuss.elastic.co/u/dimitris_sb)\ **Replies:** 2\ **Last updated:** [November 5, 2021, 12:31am UTC](https://discuss.elastic.co/t/update-mapping-fails-for-the-elastic-superuser/288450 "2021-11-05T00:31:11Z")
Dear All, We tried to update mapping of an existing field Request: PUT index-name\* { "mappings": { "properties": { "index\_field": { "type": "text", "fields": { "keyword": { … --- ## [7.15 auto heap for none data node](https://discuss.elastic.co/t/7-15-auto-heap-for-none-data-node/288446)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 1\ **Last updated:** [November 4, 2021, 11:11pm UTC](https://discuss.elastic.co/t/7-15-auto-heap-for-none-data-node/288446 "2021-11-04T23:11:23Z")
I have noticed that none data node still allocates half of system RAM. Wouldn't it make more sense to allocate more RAM for ES heap in such node? We don't really need to leave too much RAM for the system since there's … --- ## [Azure event hub plugin modify offset](https://discuss.elastic.co/t/azure-event-hub-plugin-modify-offset/288452)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 3\ **Last updated:** [November 4, 2021, 10:27pm UTC](https://discuss.elastic.co/t/azure-event-hub-plugin-modify-offset/288452 "2021-11-04T22:27:59Z")
Hi where is the offset of the Azure event hub plugin is located? and if si located in the blob storage can you give me some reference where to find it? I dont have access to Azure and have to give directions to a cowor… --- ## [Recommended node hardware/settings for warm data](https://discuss.elastic.co/t/recommended-node-hardware-settings-for-warm-data/288447)
**Author:** [@Maycon\_Santos](https://discuss.elastic.co/u/Maycon_Santos)\ **Replies:** 1\ **Last updated:** [November 4, 2021, 7:02pm UTC](https://discuss.elastic.co/t/recommended-node-hardware-settings-for-warm-data/288447 "2021-11-04T19:02:33Z")
Hello, I am looking at an allocation strategy to move around 2800 indices that are mostly idle with few reads per week to slower nodes and with this, clean a bit of space in our high-performance nodes. These indices acc… --- ## [Group identical alerts in Elastic Security \[7.14.2\]](https://discuss.elastic.co/t/group-identical-alerts-in-elastic-security-7-14-2/288424)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 0\ **Last updated:** [November 4, 2021, 3:00pm UTC](https://discuss.elastic.co/t/group-identical-alerts-in-elastic-security-7-14-2/288424 "2021-11-04T15:00:47Z")
Hi, everyone I would like to know whether it is possible to group several occurrences of same alerts in Elastic Security. For instance, we have configured a detection rule which has generated many alerts in a short per… --- ## [Agent "Unhealthy". "Error while dialing open \\\\\\.\\\\pipe\\\\elastic-agent-\[...\]"](https://discuss.elastic.co/t/agent-unhealthy-error-while-dialing-open-pipe-elastic-agent/285814)
**Author:** [@maof97](https://discuss.elastic.co/u/maof97)\ **Replies:** 9\ **Last updated:** [November 4, 2021, 9:30pm UTC](https://discuss.elastic.co/t/agent-unhealthy-error-while-dialing-open-pipe-elastic-agent/285814 "2021-11-04T21:30:51Z")
I've upgraded ELK to 7.15 and had some errors starting up Kibana so I made the mistake to delete the .kibana index (someone wrote it somewhere). So at the end I had to basically set up everything new. Now I have also up… --- ## [How to query all unique IP addresses](https://discuss.elastic.co/t/how-to-query-all-unique-ip-addresses/288420)
**Author:** [@jeromeat](https://discuss.elastic.co/u/jeromeat)\ **Replies:** 6\ **Last updated:** [November 4, 2021, 8:18pm UTC](https://discuss.elastic.co/t/how-to-query-all-unique-ip-addresses/288420 "2021-11-04T20:18:01Z")
I'm looking for help on how to query all unique IP addresses, however, the field types that the IPs get parsed to are setup as "keyword" and not "IP". And they are setup as ip\_src, ip\_dst, dst\_ip, src\_ip. Yes, I unders… --- ## [Elastic won't start on Windows after inserting a single document](https://discuss.elastic.co/t/elastic-wont-start-on-windows-after-inserting-a-single-document/288206)
**Author:** [@lubosvr](https://discuss.elastic.co/u/lubosvr)\ **Replies:** 14\ **Last updated:** [November 4, 2021, 7:00pm UTC](https://discuss.elastic.co/t/elastic-wont-start-on-windows-after-inserting-a-single-document/288206 "2021-11-04T19:00:39Z")
Hi everybody, I've just downloaded ES 7.15.1 and latest Kibana. I was able to start ES for the first time. Then I've added a single document and dtopped the Kibana and ES. Now I'm not able to start ES. In the logs I se… --- ## [Regex query for conexus-al](https://discuss.elastic.co/t/regex-query-for-conexus-al/288437)
**Author:** [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\ **Replies:** 3\ **Last updated:** [November 4, 2021, 6:46pm UTC](https://discuss.elastic.co/t/regex-query-for-conexus-al/288437 "2021-11-04T18:46:24Z")
I am trying to search out the devices with conexus-al in the device name. I can find the conexus devices with ".conexus.", however adding ".conexus-al." finds nothing. I have tried ".conexus.al." and ".conexus\\-al.". I a… --- ## [Can kibana do visualization with multiple indexes at a time?](https://discuss.elastic.co/t/can-kibana-do-visualization-with-multiple-indexes-at-a-time/288406)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 6\ **Last updated:** [November 4, 2021, 5:46pm UTC](https://discuss.elastic.co/t/can-kibana-do-visualization-with-multiple-indexes-at-a-time/288406 "2021-11-04T17:46:17Z")
Can kibana do visualization incorporating multiple indexes at a time in one view? thanks and regards shini --- ## [Uptime Monitor Status not following the greater than logic of the rule](https://discuss.elastic.co/t/uptime-monitor-status-not-following-the-greater-than-logic-of-the-rule/288374)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 2\ **Last updated:** [November 4, 2021, 4:53pm UTC](https://discuss.elastic.co/t/uptime-monitor-status-not-following-the-greater-than-logic-of-the-rule/288374 "2021-11-04T16:53:08Z")
Hi All, Kibana Version: 7.15.1 Elasticsearch Version: 7.15.1 Heartbeat Version: 7.15.1 I have a browser monitor configured and sending data to Elasticsearch. This monitor works fine, but I also have an uptime monitor… --- ## [Kibana spaces and loading of unauthorized index patterns](https://discuss.elastic.co/t/kibana-spaces-and-loading-of-unauthorized-index-patterns/288401)
**Author:** [@ibrooes](https://discuss.elastic.co/u/ibrooes)\ **Replies:** 2\ **Last updated:** [November 4, 2021, 4:49pm UTC](https://discuss.elastic.co/t/kibana-spaces-and-loading-of-unauthorized-index-patterns/288401 "2021-11-04T16:49:53Z")
Hello, I am trying to create a solution where users based on their roles would have access to specific spaces and specific indices. I was able to create roles that enable that, and when I log in with my test user I only … --- ## [ECK using Docker for Operator Container Registry docker.instead of elastic.co](https://discuss.elastic.co/t/eck-using-docker-for-operator-container-registry-docker-instead-of-elastic-co/287842)
**Author:** [@cj11](https://discuss.elastic.co/u/cj11)\ **Replies:** 2\ **Last updated:** [November 4, 2021, 4:33pm UTC](https://discuss.elastic.co/t/eck-using-docker-for-operator-container-registry-docker-instead-of-elastic-co/287842 "2021-11-04T16:33:34Z")
I'm using the ECK Stack as described in this tutorial - Deploy an Elasticsearch cluster | Elastic Cloud on Kubernetes \[1.8\] for a basic ECK setup. I want to change the container registry for operator to use the docker h… --- ## [Logstash aggregate task](https://discuss.elastic.co/t/logstash-aggregate-task/288348)
**Author:** [@rosboc](https://discuss.elastic.co/u/rosboc)\ **Replies:** 3\ **Last updated:** [November 4, 2021, 4:06pm UTC](https://discuss.elastic.co/t/logstash-aggregate-task/288348 "2021-11-04T16:06:09Z")
Hi Team, we are using aggregate function to collect all commands for a specific ssh session but recently our vendor changed the way to track session records and right now only start and stop records have the same task\_i… --- ## [Metric On Shard Reads and Writes](https://discuss.elastic.co/t/metric-on-shard-reads-and-writes/287690)
**Author:** [@Nisar\_Adappadathil1](https://discuss.elastic.co/u/Nisar_Adappadathil1)\ **Replies:** 4\ **Last updated:** [November 4, 2021, 3:53pm UTC](https://discuss.elastic.co/t/metric-on-shard-reads-and-writes/287690 "2021-11-04T15:53:14Z")
We have a huge cluster with 250 nodes. Multiple nodes go high load at various times, so want to know which shards are actually having higher READs and WRITEs so that I can see any hot shards are there. How can log coun… --- ## [Kibana plugin certificate error](https://discuss.elastic.co/t/kibana-plugin-certificate-error/288281)
**Author:** [@111505](https://discuss.elastic.co/u/111505)\ **Replies:** 1\ **Last updated:** [November 4, 2021, 3:33pm UTC](https://discuss.elastic.co/t/kibana-plugin-certificate-error/288281 "2021-11-04T15:33:58Z")
Hi :slight\_smile: I need Kibana css plugin. So I wrote the command below. ./kibana-plugin install file:///usr/local/ELK\_7.9.2/kibana-7.9.2-linux-x86\_64/kibana-dashboard-custom-css-master.zip However, I get an authent… --- ## [What do I require to log into the Welcome to Elastic page to complete the Kibana labs?](https://discuss.elastic.co/t/what-do-i-require-to-log-into-the-welcome-to-elastic-page-to-complete-the-kibana-labs/288338)
**Author:** [@Mark3](https://discuss.elastic.co/u/Mark3)\ **Replies:** 1\ **Last updated:** [November 4, 2021, 3:23pm UTC](https://discuss.elastic.co/t/what-do-i-require-to-log-into-the-welcome-to-elastic-page-to-complete-the-kibana-labs/288338 "2021-11-04T15:23:52Z")
As stated, I do not have a PW for logging into this at this time, this is time critical as my subscription runs out for the training on the 15th. Mark --- ## [Lagging in ELK stack](https://discuss.elastic.co/t/lagging-in-elk-stack/288414)
**Author:** [@Narayan\_Banik](https://discuss.elastic.co/u/Narayan_Banik)\ **Replies:** 2\ **Last updated:** [November 4, 2021, 2:53pm UTC](https://discuss.elastic.co/t/lagging-in-elk-stack/288414 "2021-11-04T14:53:50Z")
Hi Experts, I'm using ELK stack in docker environment: logstash\_syslog:7.4.0 Elasticsearch:7.1 kibana:7.1 Sometimes observe lagging of logs in kibana dashboard. After 2/3 hours, it becomes adjusted. Lagging usually… --- ## [Search as you type and highlighter](https://discuss.elastic.co/t/search-as-you-type-and-highlighter/287341)
**Author:** [@mihalikv](https://discuss.elastic.co/u/mihalikv)\ **Replies:** 1\ **Last updated:** [November 4, 2021, 2:49pm UTC](https://discuss.elastic.co/t/search-as-you-type-and-highlighter/287341 "2021-11-04T14:49:07Z")
Hello, Env: ES 7.15.0 PUT my-index-000001 { "mappings": { "properties": { "my\_field": { "type": "search\_as\_you\_type" } } } } PUT my-index-000001/\_doc/1?refresh { "my\_field": "quick b… --- ## [Frozen Tier CPU spikes - in relation to siem alerts](https://discuss.elastic.co/t/frozen-tier-cpu-spikes-in-relation-to-siem-alerts/288214)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 8\ **Last updated:** [November 4, 2021, 2:29pm UTC](https://discuss.elastic.co/t/frozen-tier-cpu-spikes-in-relation-to-siem-alerts/288214 "2021-11-04T14:29:59Z")
I have a been reconfiguring my elastic cloud setup to try and improve performance. I created a frozen tier node, alot of indices have moved from warm to searchable snapshots. However looking at the CPU of the frozen node… --- ## [Node won’t start up due to duplicate alias/index names (HELP)](https://discuss.elastic.co/t/node-won-t-start-up-due-to-duplicate-alias-index-names-help/288123)
**Author:** [@Rabih\_harb](https://discuss.elastic.co/u/Rabih_harb)\ **Replies:** 3\ **Last updated:** [November 4, 2021, 2:08pm UTC](https://discuss.elastic.co/t/node-won-t-start-up-due-to-duplicate-alias-index-names-help/288123 "2021-11-04T14:08:27Z")
Dear community, we have a major issue in our production cluster (2.4.6): previous cluster setup: 4 nodes ( master and data) the upgrade done on the cluster was: 4 nodes---\> set as data only master false. 2 additio… --- ## [How to collect last 10 day debug logs of kibana 7.14.0 to 10 files](https://discuss.elastic.co/t/how-to-collect-last-10-day-debug-logs-of-kibana-7-14-0-to-10-files/288201)
**Author:** [@nuaazt](https://discuss.elastic.co/u/nuaazt)\ **Replies:** 1\ **Last updated:** [November 4, 2021, 2:00pm UTC](https://discuss.elastic.co/t/how-to-collect-last-10-day-debug-logs-of-kibana-7-14-0-to-10-files/288201 "2021-11-04T14:00:49Z")
hi, I have downloaded a kibana 7.14.0 docker image. I noted that there are a lot of introduce about debug log settings. Now I want to collect the last 10 day debug logs of kibana. And the log should be written one f… --- ## [Java APM Agent connecting to SSL APM Server](https://discuss.elastic.co/t/java-apm-agent-connecting-to-ssl-apm-server/288355)
**Author:** [@Trinity\_Rolling](https://discuss.elastic.co/u/Trinity_Rolling)\ **Replies:** 9\ **Last updated:** [November 4, 2021, 1:58pm UTC](https://discuss.elastic.co/t/java-apm-agent-connecting-to-ssl-apm-server/288355 "2021-11-04T13:58:43Z")
Kibana version: 7.15.1 Elasticsearch version: 7.15.1 APM Server version: 7.15.1 APM Agent language and version: Java 1.26.0 Browser version: Chrome 94.0.4606.81 Is there anything special in your setup? Windows base… --- ## [Filtering data before search](https://discuss.elastic.co/t/filtering-data-before-search/288409)
**Author:** [@Victor\_Dusautois](https://discuss.elastic.co/u/Victor_Dusautois)\ **Replies:** 1\ **Last updated:** [November 4, 2021, 1:45pm UTC](https://discuss.elastic.co/t/filtering-data-before-search/288409 "2021-11-04T13:45:53Z")
Hello, I am trying what I thought was going to be an easy fix with Elasticsearch. It appears I'm stumbling on achieving a sort on a simple name field containing civility: Here is some sample (fake) data: \[ { "name… --- ## [How can i get more documents about how to build a kibana glugin?](https://discuss.elastic.co/t/how-can-i-get-more-documents-about-how-to-build-a-kibana-glugin/288396)
**Author:** [@qinzehua](https://discuss.elastic.co/u/qinzehua)\ **Replies:** 1\ **Last updated:** [November 4, 2021, 1:43pm UTC](https://discuss.elastic.co/t/how-can-i-get-more-documents-about-how-to-build-a-kibana-glugin/288396 "2021-11-04T13:43:24Z")
I have read the deveoper guid, but it seems too concise. Is there any more documentation about the development interface? For example, the introduction of files in the directories src/core/server and src/core/public. --- ## [Logstash - parse/ filter lines having a specific string](https://discuss.elastic.co/t/logstash-parse-filter-lines-having-a-specific-string/288103)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 4\ **Last updated:** [November 4, 2021, 1:35pm UTC](https://discuss.elastic.co/t/logstash-parse-filter-lines-having-a-specific-string/288103 "2021-11-04T13:35:26Z")
Hi All, We are running ELK 7.6.2 stack in our environment. The log generated by our application throws out messages with different Log Levels. Please see below example: 2021-10-31 19:00:01,062|DEBUG|DispatcherServlet… --- ## [ECE Deployment within 2 Zones failed: "Plan change failed: Failed to validate cluster health/prerequisites."](https://discuss.elastic.co/t/ece-deployment-within-2-zones-failed-plan-change-failed-failed-to-validate-cluster-health-prerequisites/287807)
**Author:** [@Icaka](https://discuss.elastic.co/u/Icaka)\ **Replies:** 3\ **Last updated:** [November 4, 2021, 1:28pm UTC](https://discuss.elastic.co/t/ece-deployment-within-2-zones-failed-plan-change-failed-failed-to-validate-cluster-health-prerequisites/287807 "2021-11-04T13:28:36Z")
Hi, I've spin up new ECE cluster with 6 VMs (2 Controll Plane, 2 Allocators for Hot data and 2 Allocators for Warm data) as half of them are in Zone-1 others in Zone-2 repectively per roles. I've setup tags for all my … --- ## [Elasticsearch filter failing to start with logstash because of cluster not being available yet](https://discuss.elastic.co/t/elasticsearch-filter-failing-to-start-with-logstash-because-of-cluster-not-being-available-yet/287843)
**Author:** [@Mrizzi](https://discuss.elastic.co/u/Mrizzi)\ **Replies:** 1\ **Last updated:** [November 4, 2021, 1:18pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-failing-to-start-with-logstash-because-of-cluster-not-being-available-yet/287843 "2021-11-04T13:18:59Z")
Hi everyone! Hope you're doing okay, i'm making this post because I couldn't find anything online about the following issue and I wanted to make sure i'm not overlooking something simple. I have the stack installed in … --- ## [Esrally "Could not connect to your Elasticsearch metrics store."](https://discuss.elastic.co/t/esrally-could-not-connect-to-your-elasticsearch-metrics-store/288403)
**Author:** [@gabbar](https://discuss.elastic.co/u/gabbar)\ **Replies:** 3\ **Last updated:** [November 4, 2021, 12:48pm UTC](https://discuss.elastic.co/t/esrally-could-not-connect-to-your-elasticsearch-metrics-store/288403 "2021-11-04T12:48:39Z")
Hello Elasticworld, I'm striving to run a race on my test cluster, but it's apparently not able to connect to ES I'm running 2 ES 6.8.18 nodes running on RH 7.9 rally runs from RH 8.4 \[esrally@uttest01 ~\]$ esrally --… [Previous page](https://discuss.elastic.co/latest.md?page=1401) [Next page](https://discuss.elastic.co/latest.md?page=1403)