# Latest **URL:** https://discuss.elastic.co/latest.md?page=1415 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1416 --- ## [When is the lifepolicy of DELETE phase is executed?](https://discuss.elastic.co/t/when-is-the-lifepolicy-of-delete-phase-is-executed/287680)
**Author:** [@MinwooKim](https://discuss.elastic.co/u/MinwooKim)\ **Replies:** 5\ **Last updated:** [October 27, 2021, 1:31am UTC](https://discuss.elastic.co/t/when-is-the-lifepolicy-of-delete-phase-is-executed/287680 "2021-10-27T01:31:14Z")
As shown above, the hot phase with 30 day rollover was already in active state, thus I have indexes with indexname-2021.05.10-1 indexname-2021.05.16-000002 indexname-2021.06.15-000003 indexname-2021.07.10-000004 … --- ## [Set a watcher to on 2 conditions if both are met, then 1 action](https://discuss.elastic.co/t/set-a-watcher-to-on-2-conditions-if-both-are-met-then-1-action/287475)
**Author:** [@AAguilarbr](https://discuss.elastic.co/u/AAguilarbr)\ **Replies:** 1\ **Last updated:** [October 26, 2021, 10:43pm UTC](https://discuss.elastic.co/t/set-a-watcher-to-on-2-conditions-if-both-are-met-then-1-action/287475 "2021-10-26T22:43:38Z")
Hello Team, Im trying to setup a Watcher that will have 2 conditions, For exemple: If CPU reaches certain Tresholds, AND If IIS.ent request QUEUE hits a certain treshold. Send an email. How can I set up that IF … --- ## [Sent alert](https://discuss.elastic.co/t/sent-alert/287734)
**Author:** [@AAguilarbr](https://discuss.elastic.co/u/AAguilarbr)\ **Replies:** 1\ **Last updated:** [October 26, 2021, 10:43pm UTC](https://discuss.elastic.co/t/sent-alert/287734 "2021-10-26T22:43:19Z")
Hello, Im wondering How can i set alert, us 2 conditions/input is met. Exemple, If CPU is higher then 80% and ASP.net has 60 requests in the Queue. Then send an Alert. Thanks! --- ## [Multiple conditions watcher](https://discuss.elastic.co/t/multiple-conditions-watcher/287713)
**Author:** [@AAguilarbr](https://discuss.elastic.co/u/AAguilarbr)\ **Replies:** 1\ **Last updated:** [October 26, 2021, 10:43pm UTC](https://discuss.elastic.co/t/multiple-conditions-watcher/287713 "2021-10-26T22:43:09Z")
Hello Team, Im trying to setup a Watcher that will have 2 conditions, For exemple: If CPU reaches certain Tresholds, AND If IIS.ent request QUEUE hits a certain treshold. Send an email. How can I set up that IF bot… --- ## [OpenTelemetry metrics don't have labels](https://discuss.elastic.co/t/opentelemetry-metrics-dont-have-labels/287510)
**Author:** [@benbek](https://discuss.elastic.co/u/benbek)\ **Replies:** 13\ **Last updated:** [October 26, 2021, 10:33pm UTC](https://discuss.elastic.co/t/opentelemetry-metrics-dont-have-labels/287510 "2021-10-26T22:33:55Z")
Hello, I am trying to understand why otel metrics don't display the labels I set in my code. I use: go 1.17 elastic/apm 7.15.1 opentelemetry 1.0.1 native otlp collector 0.6.0 My metrics index has: "apm-7.15.1-metri… --- ## [Tomcat logs are seeing appearing in order in discover section in kibana](https://discuss.elastic.co/t/tomcat-logs-are-seeing-appearing-in-order-in-discover-section-in-kibana/286969)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 31\ **Last updated:** [October 26, 2021, 10:03pm UTC](https://discuss.elastic.co/t/tomcat-logs-are-seeing-appearing-in-order-in-discover-section-in-kibana/286969 "2021-10-26T22:03:55Z")
Hi Team, I have tomcat application running on two servers and sending logs to logstash through filebeat, when checking logs in discover section of kibana, I am not seeing exact sequence of logs in kibana as in server. f… --- ## [Does pagination work with msearch with a HighRestClient in java](https://discuss.elastic.co/t/does-pagination-work-with-msearch-with-a-highrestclient-in-java/287678)
**Author:** [@MinwooKim](https://discuss.elastic.co/u/MinwooKim)\ **Replies:** 0\ **Last updated:** [October 26, 2021, 10:34am UTC](https://discuss.elastic.co/t/does-pagination-work-with-msearch-with-a-highrestclient-in-java/287678 "2021-10-26T10:34:32Z")
Hi I have some questions based on pagination for reading an index. (by the way, FIFO doesn't need to be guranteed, just need a bulk reading process with speed) obviously in java using the HighRestClient, I have heard t… --- ## [Handle event if http output finally fails](https://discuss.elastic.co/t/handle-event-if-http-output-finally-fails/287727)
**Author:** [@jporzelt](https://discuss.elastic.co/u/jporzelt)\ **Replies:** 1\ **Last updated:** [October 26, 2021, 9:50pm UTC](https://discuss.elastic.co/t/handle-event-if-http-output-finally-fails/287727 "2021-10-26T21:50:11Z")
Hi all, we are using Logstash for first time in a project and we are using it to process e-mails (imap input), transform some fields and send the event to an http output (Http output plugin | Logstash Reference \[7.15\] |… --- ## [Implicit search terms](https://discuss.elastic.co/t/implicit-search-terms/287710)
**Author:** [@Ramzay](https://discuss.elastic.co/u/Ramzay)\ **Replies:** 1\ **Last updated:** [October 26, 2021, 9:44pm UTC](https://discuss.elastic.co/t/implicit-search-terms/287710 "2021-10-26T21:44:01Z")
Our index contains documents with the optional field Category. We need to search by default only the documents that have no category, and search for the documents with category only if the specific category provided exp… --- ## [Output When Data in Field is a Specific Value](https://discuss.elastic.co/t/output-when-data-in-field-is-a-specific-value/287733)
**Author:** [@Wilks](https://discuss.elastic.co/u/Wilks)\ **Replies:** 1\ **Last updated:** [October 26, 2021, 9:43pm UTC](https://discuss.elastic.co/t/output-when-data-in-field-is-a-specific-value/287733 "2021-10-26T21:43:49Z")
Hi, I want to know only output a field called network.application when it contains the value ALPHA but I am getting an error that Expected one of \[ \\t\\r\\n\], "#", "{" at line 152, column 7 (byte 3941) after output { if… --- ## [General elastic performance when search\_after with PIT sorted by score is used for UI pagination](https://discuss.elastic.co/t/general-elastic-performance-when-search-after-with-pit-sorted-by-score-is-used-for-ui-pagination/287238)
**Author:** [@vjgorla](https://discuss.elastic.co/u/vjgorla)\ **Replies:** 1\ **Last updated:** [October 26, 2021, 9:17pm UTC](https://discuss.elastic.co/t/general-elastic-performance-when-search-after-with-pit-sorted-by-score-is-used-for-ui-pagination/287238 "2021-10-26T21:17:13Z")
We are integrating search\_after query to our UI pagination. If we use PIT and keep the search context alive between UI page fetches, which could be minutes depending on user think time, would that scale well?. We have to… --- ## [Inconsistent results when search\_after is used for pagination sorted by score and id](https://discuss.elastic.co/t/inconsistent-results-when-search-after-is-used-for-pagination-sorted-by-score-and-id/286554)
**Author:** [@vjgorla](https://discuss.elastic.co/u/vjgorla)\ **Replies:** 3\ **Last updated:** [October 26, 2021, 7:14pm UTC](https://discuss.elastic.co/t/inconsistent-results-when-search-after-is-used-for-pagination-sorted-by-score-and-id/286554 "2021-10-26T19:14:28Z")
We have implemented pagination using search\_after and sorting the results by \_score and a unique id field as a tie-breaker. However sometimes we are getting duplicate results across pages, and other times matches do not … --- ## [Opentelemetry nodejs: cannot set language nor service.environment](https://discuss.elastic.co/t/opentelemetry-nodejs-cannot-set-language-nor-service-environment/287227)
**Author:** [@ccontini](https://discuss.elastic.co/u/ccontini)\ **Replies:** 7\ **Last updated:** [October 26, 2021, 6:25pm UTC](https://discuss.elastic.co/t/opentelemetry-nodejs-cannot-set-language-nor-service-environment/287227 "2021-10-26T18:25:07Z")
Kibana version: 7.14.1 Elasticsearch version: 7.14.1 APM Server version: 7.14.1 Open-telemetry collector version: 0.36 Description of the problem including expected versus actual behavior: I am using opentelemetry t… --- ## [Kibana webhook for firewall blacklist update](https://discuss.elastic.co/t/kibana-webhook-for-firewall-blacklist-update/286815)
**Author:** [@algira37](https://discuss.elastic.co/u/algira37)\ **Replies:** 5\ **Last updated:** [October 26, 2021, 5:34pm UTC](https://discuss.elastic.co/t/kibana-webhook-for-firewall-blacklist-update/286815 "2021-10-26T17:34:10Z")
Hello, I would like to use Kibana with the webhook feature to call my microservice to update my firewall blacklist. Unfortunately, I cant find that this feature is free or not, could you please help me? --- ## [Attempted to send a bulk request to elasticsearch' but Elasticsearch appears to be unreachable or down!](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch-but-elasticsearch-appears-to-be-unreachable-or-down/287640)
**Author:** [@hiruni.insyncit.net](https://discuss.elastic.co/u/hiruni.insyncit.net)\ **Replies:** 2\ **Last updated:** [October 26, 2021, 4:31pm UTC](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch-but-elasticsearch-appears-to-be-unreachable-or-down/287640 "2021-10-26T16:31:17Z")
Hi, I have configured logstash conf file to get data from filebeat. Logstash input port 5044 and output to elasticseach as multiple index output. Elasticsearch service is up and running. But logstash can't reach the E… --- ## [Enabling repository-s3 plugin to backup ES snapshots to S3](https://discuss.elastic.co/t/enabling-repository-s3-plugin-to-backup-es-snapshots-to-s3/287639)
**Author:** [@rajsuper2021](https://discuss.elastic.co/u/rajsuper2021)\ **Replies:** 2\ **Last updated:** [October 26, 2021, 4:20pm UTC](https://discuss.elastic.co/t/enabling-repository-s3-plugin-to-backup-es-snapshots-to-s3/287639 "2021-10-26T16:20:55Z")
I am running Elasticsearch on EKS, I have enabled the repository-s3 plugin via efk Elasticsearch resource. I am seeing this in the efk logs though: {"type": "server", "timestamp": "2021-10-26T06:13:18,861Z", "level": … --- ## [Unable to install elastic-logging-plugin (docker plugin) \>= 7.13.0 (beatSocket.sock: connect: no such file or directory)](https://discuss.elastic.co/t/unable-to-install-elastic-logging-plugin-docker-plugin-7-13-0-beatsocket-sock-connect-no-such-file-or-directory/287716)
**Author:** [@Freddyus](https://discuss.elastic.co/u/Freddyus)\ **Replies:** 0\ **Last updated:** [October 26, 2021, 4:19pm UTC](https://discuss.elastic.co/t/unable-to-install-elastic-logging-plugin-docker-plugin-7-13-0-beatsocket-sock-connect-no-such-file-or-directory/287716 "2021-10-26T16:19:52Z")
Error when installing elastic-logging-plugin version higher than 7.12.1. Can you please tell me what could be the problem? #docker plugin install elastic/elastic-logging-plugin:7.15.1 Plugin "elastic/elastic-logging-pl… --- ## [RabbitMQ Module Errors in logs](https://discuss.elastic.co/t/rabbitmq-module-errors-in-logs/287715)
**Author:** [@valleram](https://discuss.elastic.co/u/valleram)\ **Replies:** 0\ **Last updated:** [October 26, 2021, 4:15pm UTC](https://discuss.elastic.co/t/rabbitmq-module-errors-in-logs/287715 "2021-10-26T16:15:14Z")
Hi All, I'm using Metricbeat 7.3, I've enabled the RabbitMQ module and I'm getting below error in logs. I'm running version 3.7.15 of RabbitMQ. 2021-10-26T10:29:19.683-0500 ERROR \[rabbitmq.queue\] queue/data.go:97 erro… --- ## [Replacing hosts in a cluster](https://discuss.elastic.co/t/replacing-hosts-in-a-cluster/287511)
**Author:** [@rihad](https://discuss.elastic.co/u/rihad)\ **Replies:** 4\ **Last updated:** [October 26, 2021, 3:47pm UTC](https://discuss.elastic.co/t/replacing-hosts-in-a-cluster/287511 "2021-10-26T15:47:09Z")
Hi, we have a 7.9.1 cluster consisting of 3 hosts and we need to replace it with 3 new servers running ES 7.14-7.15. Would it be enough to just start one new server, wait for it to join the cluster, then shut down one ol… --- ## [Logstash azure blob plugin error](https://discuss.elastic.co/t/logstash-azure-blob-plugin-error/287709)
**Author:** [@RS\_D](https://discuss.elastic.co/u/RS_D)\ **Replies:** 0\ **Last updated:** [October 26, 2021, 3:24pm UTC](https://discuss.elastic.co/t/logstash-azure-blob-plugin-error/287709 "2021-10-26T15:24:52Z")
I am trying to install "logstash-input-azureblob" plugin with command as below using docker compose. I am getting the below error. command: bash -c "bin/logstash-plugin install logstash-input-azureblob && logstash -f … --- ## [Log threshold alert with the actual message inside the alert](https://discuss.elastic.co/t/log-threshold-alert-with-the-actual-message-inside-the-alert/287258)
**Author:** [@Ido\_Ilani](https://discuss.elastic.co/u/Ido_Ilani)\ **Replies:** 2\ **Last updated:** [October 26, 2021, 3:01pm UTC](https://discuss.elastic.co/t/log-threshold-alert-with-the-actual-message-inside-the-alert/287258 "2021-10-26T15:01:42Z")
Hi, I set up a Log threshold alert to Slack when number of error log lines exceeds a certain limit. Is there a way to alert to Slack the actual log message body? I searched for a way and the only variables I see I can … --- ## [Canvas Kibana highlight point in bubble chart from dropdown](https://discuss.elastic.co/t/canvas-kibana-highlight-point-in-bubble-chart-from-dropdown/285573)
**Author:** [@MTV](https://discuss.elastic.co/u/MTV)\ **Replies:** 3\ **Last updated:** [October 26, 2021, 3:00pm UTC](https://discuss.elastic.co/t/canvas-kibana-highlight-point-in-bubble-chart-from-dropdown/285573 "2021-10-26T15:00:56Z")
Hi, I am working with canvas in which I have one dropdown which filters for countries. I have a bubble plot (x and y numeric, and countries as text) with the full data (no filters). The goal is to keep the full data in … --- ## [Exiting: Index management requested but the Elasticsearch output is not configured/enabled](https://discuss.elastic.co/t/exiting-index-management-requested-but-the-elasticsearch-output-is-not-configured-enabled/287700)
**Author:** [@Nil\_Battey\_Sannata](https://discuss.elastic.co/u/Nil_Battey_Sannata)\ **Replies:** 0\ **Last updated:** [October 26, 2021, 1:59pm UTC](https://discuss.elastic.co/t/exiting-index-management-requested-but-the-elasticsearch-output-is-not-configured-enabled/287700 "2021-10-26T13:59:18Z")
Hi, I am unable to setup filebeat to send logs to logstash, I followed few solutions of setting up index management using Elasticsearch output then delete old document but the issue is still exist. I have also disabled… --- ## [Can a dedicated coordinator replace a load balancer](https://discuss.elastic.co/t/can-a-dedicated-coordinator-replace-a-load-balancer/287496)
**Author:** [@anon43570709](https://discuss.elastic.co/u/anon43570709)\ **Replies:** 8\ **Last updated:** [October 26, 2021, 1:58pm UTC](https://discuss.elastic.co/t/can-a-dedicated-coordinator-replace-a-load-balancer/287496 "2021-10-26T13:58:27Z")
Can a dedicated coordinator replace a load balancer such as haproxy? --- ## [Illustration of DocValues, Fielddata and Inverted Index](https://discuss.elastic.co/t/illustration-of-docvalues-fielddata-and-inverted-index/287699)
**Author:** [@galambo](https://discuss.elastic.co/u/galambo)\ **Replies:** 0\ **Last updated:** [October 26, 2021, 1:18pm UTC](https://discuss.elastic.co/t/illustration-of-docvalues-fielddata-and-inverted-index/287699 "2021-10-26T13:18:19Z")
Hello, I would like to better understand internal Elasticsearch data structures, more specifically 1) inverted index 2) fielddata and 3) DocValues Assume we have the following use case: Sample data 1: We’re given a … --- ## [Results Component not working: Result.id is undefined](https://discuss.elastic.co/t/results-component-not-working-result-id-is-undefined/287696)
**Author:** [@Julian\_Hesse](https://discuss.elastic.co/u/Julian_Hesse)\ **Replies:** 1\ **Last updated:** [October 26, 2021, 1:25pm UTC](https://discuss.elastic.co/t/results-component-not-working-result-id-is-undefined/287696 "2021-10-26T13:25:55Z")
I used the search-ui example "elasticsearch". Then I adjusted everything to the Elasticsearch setup I have (different fields and facets). Mostly everything worked out fine. Except that when I actually get results the ap… --- ## [Using Filebeat to send different logs and differentiating in Kibana](https://discuss.elastic.co/t/using-filebeat-to-send-different-logs-and-differentiating-in-kibana/287580)
**Author:** [@Maduranga](https://discuss.elastic.co/u/Maduranga)\ **Replies:** 1\ **Last updated:** [October 25, 2021, 4:54pm UTC](https://discuss.elastic.co/t/using-filebeat-to-send-different-logs-and-differentiating-in-kibana/287580 "2021-10-25T16:54:06Z")
Hello, I am looking for guidance to get started with ELK stack with Filebeat. I am using Elastic cloud with my servers using Filebeat to send logs directly to the Elastic cloud. I can get the log stream and see the st… --- ## [Problem’s processing or storing decimal starting with 0.0](https://discuss.elastic.co/t/problem-s-processing-or-storing-decimal-starting-with-0-0/287635)
**Author:** [@Hescalona](https://discuss.elastic.co/u/Hescalona)\ **Replies:** 2\ **Last updated:** [October 26, 2021, 1:17pm UTC](https://discuss.elastic.co/t/problem-s-processing-or-storing-decimal-starting-with-0-0/287635 "2021-10-26T13:17:35Z")
Hi, I'm trying to store values like 0.033 but Elasticsearch it's storing just 0. The Log come from a file to LOGSTASH them process with GROK (in https://grokdebug.herokuapp.com/ the debug work fine) and store in Elastic… --- ## [How do I calculate the number of shards I should have?](https://discuss.elastic.co/t/how-do-i-calculate-the-number-of-shards-i-should-have/287561)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 5\ **Last updated:** [October 26, 2021, 12:23pm UTC](https://discuss.elastic.co/t/how-do-i-calculate-the-number-of-shards-i-should-have/287561 "2021-10-26T12:23:50Z")
Hello Following the advice given on this forum (thank you), I have been able to reduce from August to now, shard amount: From 4028 to 3317 That being said, I feel this is a high number. There is a document that says h… --- ## [Choose which date field is used in the dashboard date filter](https://discuss.elastic.co/t/choose-which-date-field-is-used-in-the-dashboard-date-filter/286688)
**Author:** [@ggreystorm26](https://discuss.elastic.co/u/ggreystorm26)\ **Replies:** 10\ **Last updated:** [October 26, 2021, 12:10pm UTC](https://discuss.elastic.co/t/choose-which-date-field-is-used-in-the-dashboard-date-filter/286688 "2021-10-26T12:10:03Z")
I would like to know how to specify which date field is used in the date filter at the top right of the dashboard creation page. I am using only one index, but the two date fields I have were added in the Index Patterns… [Previous page](https://discuss.elastic.co/latest.md?page=1414) [Next page](https://discuss.elastic.co/latest.md?page=1416)