# Latest **URL:** https://discuss.elastic.co/latest.md?page=1429 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1430 --- ## [Alert when no data on an index](https://discuss.elastic.co/t/alert-when-no-data-on-an-index/286977)
**Author:** [@ansarpalakottal](https://discuss.elastic.co/u/ansarpalakottal)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 1:28pm UTC](https://discuss.elastic.co/t/alert-when-no-data-on-an-index/286977 "2021-10-18T13:28:58Z")
How can I create alerts when no data is there on an index/index pattern ? The Kibana version which I am using is 7.12.1 and having Platinum License. --- ## [How can I match on all log files except ones containing a string](https://discuss.elastic.co/t/how-can-i-match-on-all-log-files-except-ones-containing-a-string/286415)
**Author:** [@dsdameron](https://discuss.elastic.co/u/dsdameron)\ **Replies:** 2\ **Last updated:** [October 18, 2021, 1:20pm UTC](https://discuss.elastic.co/t/how-can-i-match-on-all-log-files-except-ones-containing-a-string/286415 "2021-10-18T13:20:35Z")
We are ingesting the our CPanel system's Apache logs with Filebeat's handy apache module. Our configuration is as follows: var.paths: - "/var/log/apache2/domlogs/\*" However, I've hit a snag. I need to grab a… --- ## [Logs from different sources in single txt file, to be stored in different indices using logstash](https://discuss.elastic.co/t/logs-from-different-sources-in-single-txt-file-to-be-stored-in-different-indices-using-logstash/286694)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 3\ **Last updated:** [October 18, 2021, 1:19pm UTC](https://discuss.elastic.co/t/logs-from-different-sources-in-single-txt-file-to-be-stored-in-different-indices-using-logstash/286694 "2021-10-18T13:19:35Z")
Hi, I am having txt file consist of 3 different logs coming from 3 sources collated into single text file. I want to separate out logs and stored them in a respective index. Sample Logs- 10/12/2021 8:54:00 AM,MSGID: \<… --- ## [Clarification on Output Supported by Elastic Agents - Is Output to Logstash Supported?](https://discuss.elastic.co/t/clarification-on-output-supported-by-elastic-agents-is-output-to-logstash-supported/286777)
**Author:** [@Log\_Gobbler](https://discuss.elastic.co/u/Log_Gobbler)\ **Replies:** 5\ **Last updated:** [October 18, 2021, 1:08pm UTC](https://discuss.elastic.co/t/clarification-on-output-supported-by-elastic-agents-is-output-to-logstash-supported/286777 "2021-10-18T13:08:07Z")
I apologize ahead of time for posting this in the Beats sub, but it appears there isn't a sub for Elastic Agent. Near the top of this page, it states that "Beats and Elastic Agent can both send data directly to Elastics… --- ## [Unable to setup kibana](https://discuss.elastic.co/t/unable-to-setup-kibana/286983)
**Author:** [@mohammed.sabil](https://discuss.elastic.co/u/mohammed.sabil)\ **Replies:** 4\ **Last updated:** [October 18, 2021, 1:00pm UTC](https://discuss.elastic.co/t/unable-to-setup-kibana/286983 "2021-10-18T13:00:52Z")
Hello Team, I am using ansible playbook to run all three Elasticsearch, Kibana and logstash containers in one go. After running the ansible playbook I can see all three containers are up and running. Following is the … --- ## [Beats can't reach Elastic Service](https://discuss.elastic.co/t/beats-cant-reach-elastic-service/286851)
**Author:** [@\_bugc4t](https://discuss.elastic.co/u/_bugc4t)\ **Replies:** 2\ **Last updated:** [October 18, 2021, 12:54pm UTC](https://discuss.elastic.co/t/beats-cant-reach-elastic-service/286851 "2021-10-18T12:54:02Z")
I've been running my ECK (elastic cloud on kubernetes) cluster for a couple of weeks with no issues. However, 3 days ago filebeat stopped being able to connect to my ES service. All pods are up and running (Elastic, Beat… --- ## [Why is 7.15 not available in docker hub yet?](https://discuss.elastic.co/t/why-is-7-15-not-available-in-docker-hub-yet/286930)
**Author:** [@blueren](https://discuss.elastic.co/u/blueren)\ **Replies:** 6\ **Last updated:** [October 18, 2021, 12:53pm UTC](https://discuss.elastic.co/t/why-is-7-15-not-available-in-docker-hub-yet/286930 "2021-10-18T12:53:08Z")
Why is 7.15 of Elasticsearch / kibana not available in dockerhub yet? When is it likely to be made available? At the moment, I only see 7.14.2 as the latest available tag. https://hub.docker.com/\_/elasticsearch --- ## [How to get score aggregations on the scores after rescore phase?](https://discuss.elastic.co/t/how-to-get-score-aggregations-on-the-scores-after-rescore-phase/286984)
**Author:** [@Igor\_L](https://discuss.elastic.co/u/Igor_L)\ **Replies:** 0\ **Last updated:** [October 18, 2021, 11:32am UTC](https://discuss.elastic.co/t/how-to-get-score-aggregations-on-the-scores-after-rescore-phase/286984 "2021-10-18T11:32:53Z")
org/Elasticsearch/search/query/QueryPhase.java: // Pre-process aggregations as late as possible. In the case of a DFS\_Q\_T\_F // request, preProcess is called on the DFS phase phase, this is why we pre-process them // her… --- ## [Substract 2 fields from different indexes and plot on Kibana](https://discuss.elastic.co/t/substract-2-fields-from-different-indexes-and-plot-on-kibana/286572)
**Author:** [@pr1yadarshan](https://discuss.elastic.co/u/pr1yadarshan)\ **Replies:** 2\ **Last updated:** [October 18, 2021, 11:02am UTC](https://discuss.elastic.co/t/substract-2-fields-from-different-indexes-and-plot-on-kibana/286572 "2021-10-18T11:02:35Z")
I have 2 indexes (sys-1-logs, sys-2-logs), I want to get the difference of count of both and plot on Kibana. Is this possible to do ? If yes then how to do it ? --- ## [EQL query help](https://discuss.elastic.co/t/eql-query-help/286974)
**Author:** [@Billz1026](https://discuss.elastic.co/u/Billz1026)\ **Replies:** 0\ **Last updated:** [October 18, 2021, 10:35am UTC](https://discuss.elastic.co/t/eql-query-help/286974 "2021-10-18T10:35:46Z")
Hi All, I am using EQL to write detection rues. I have a sequence of evens as follows. Event A Event B Event C I want to raise an alert if the time between Event A and Event C exceeds 30 seconds. I tried with maxspa… --- ## [Show records based on last modified date in Kibana](https://discuss.elastic.co/t/show-records-based-on-last-modified-date-in-kibana/286959)
**Author:** [@Farah\_Zaidi](https://discuss.elastic.co/u/Farah_Zaidi)\ **Replies:** 10\ **Last updated:** [October 18, 2021, 10:34am UTC](https://discuss.elastic.co/t/show-records-based-on-last-modified-date-in-kibana/286959 "2021-10-18T10:34:46Z")
Hi All , I have a requirement where we have same ids with different status but we need to show only the last status of the id based on last modified date . For Example {id : 123, status:validated, modifiedAt:Oct… --- ## [Elastic watcher webhook - lack of retry mechanism](https://discuss.elastic.co/t/elastic-watcher-webhook-lack-of-retry-mechanism/286973)
**Author:** [@hcdmonitor](https://discuss.elastic.co/u/hcdmonitor)\ **Replies:** 0\ **Last updated:** [October 18, 2021, 10:27am UTC](https://discuss.elastic.co/t/elastic-watcher-webhook-lack-of-retry-mechanism/286973 "2021-10-18T10:27:36Z")
We use Elastic watcher webhook actions to post event information to an external system using an API. This works fine most of the time but there are occasions when the action fails, seemingly due to the endpoint not respo… --- ## [Kibana POD is in not ready after enabling the https traffic from Kiabna to Elasticsearch](https://discuss.elastic.co/t/kibana-pod-is-in-not-ready-after-enabling-the-https-traffic-from-kiabna-to-elasticsearch/285118)
**Author:** [@ls4074](https://discuss.elastic.co/u/ls4074)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 10:19am UTC](https://discuss.elastic.co/t/kibana-pod-is-in-not-ready-after-enabling-the-https-traffic-from-kiabna-to-elasticsearch/285118 "2021-10-18T10:19:35Z")
Hello, I have enabled the http layer and transport layer (security basic setup plus https) on Elasticsearch. the ES master and data pods are all running fine. I then configured the values.yaml in Kibana helm chart with… --- ## [Memory usage grows in (short-ish) time](https://discuss.elastic.co/t/memory-usage-grows-in-short-ish-time/286817)
**Author:** [@depesz](https://discuss.elastic.co/u/depesz)\ **Replies:** 4\ **Last updated:** [October 18, 2021, 10:15am UTC](https://discuss.elastic.co/t/memory-usage-grows-in-short-ish-time/286817 "2021-10-18T10:15:52Z")
We just recently started trying to use logstash. The problem is that memory usage grows, at least within first 2 days, to the point that we can't use it. I tried reducing Xms and Xmx from default of 1G to 512M. restarte… --- ## [Use logged in users metadata username value in visualisations?](https://discuss.elastic.co/t/use-logged-in-users-metadata-username-value-in-visualisations/285831)
**Author:** [@sam3546](https://discuss.elastic.co/u/sam3546)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 10:12am UTC](https://discuss.elastic.co/t/use-logged-in-users-metadata-username-value-in-visualisations/285831 "2021-10-18T10:12:38Z")
As part of a visualisation i want to show a visualisation that is the number of entries with a specific fields value that is the same as the username of the logged in user to doc that have a different value. Is it possi… --- ## [Logstash can't collected logs of the current day](https://discuss.elastic.co/t/logstash-cant-collected-logs-of-the-current-day/286968)
**Author:** [@lisiyu](https://discuss.elastic.co/u/lisiyu)\ **Replies:** 0\ **Last updated:** [October 18, 2021, 10:10am UTC](https://discuss.elastic.co/t/logstash-cant-collected-logs-of-the-current-day/286968 "2021-10-18T10:10:34Z")
I set FileBeat to pull the log and LogStash to process the log format to es.But today's log does not collect the index. The logs from the last two days are here. filebeat.yaml filebeat.inputs: - type: container … --- ## [ILM shards to be allocated to nodes matching the given filters](https://discuss.elastic.co/t/ilm-shards-to-be-allocated-to-nodes-matching-the-given-filters/286699)
**Author:** [@lisiyu](https://discuss.elastic.co/u/lisiyu)\ **Replies:** 3\ **Last updated:** [October 18, 2021, 9:55am UTC](https://discuss.elastic.co/t/ilm-shards-to-be-allocated-to-nodes-matching-the-given-filters/286699 "2021-10-18T09:55:18Z")
I setting 3 data nodes: one hot;one warm;one cold. The elasticsearch.yaml ： node.master: false node.data: true node.ingest: true node.attr.box\_type: hot The ILM is : PUT \_ilm/policy/k8s-logs { "policy":{ "… --- ## [Sysmon Integration with Linux Elastic Agent?](https://discuss.elastic.co/t/sysmon-integration-with-linux-elastic-agent/286861)
**Author:** [@cheapsupps](https://discuss.elastic.co/u/cheapsupps)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 9:53am UTC](https://discuss.elastic.co/t/sysmon-integration-with-linux-elastic-agent/286861 "2021-10-18T09:53:47Z")
Sysmon for linux is just being released. https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-linux-version-of-the-windows-sysmon-tool/ We all know how the sysmon can be customized to collect useful secur… --- ## [Job for elasticsearch.service failed](https://discuss.elastic.co/t/job-for-elasticsearch-service-failed/286934)
**Author:** [@dun7ill](https://discuss.elastic.co/u/dun7ill)\ **Replies:** 2\ **Last updated:** [October 18, 2021, 9:48am UTC](https://discuss.elastic.co/t/job-for-elasticsearch-service-failed/286934 "2021-10-18T09:48:41Z")
Hi All, I've installed Elasticsearch 7 on CentOS 7, I faced a problem when I try to start it. Sometimes it's work fine, then it's failed ! Please find the following code ; ● elasticsearch.service - Elasticsearch L… --- ## [Kibana cannot connect to elastichsearch in https, xpack enabled](https://discuss.elastic.co/t/kibana-cannot-connect-to-elastichsearch-in-https-xpack-enabled/286692)
**Author:** [@Florent\_BITSCHY](https://discuss.elastic.co/u/Florent_BITSCHY)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 9:31am UTC](https://discuss.elastic.co/t/kibana-cannot-connect-to-elastichsearch-in-https-xpack-enabled/286692 "2021-10-18T09:31:03Z")
hello i deploy elastci stack in kubernetes with helm chart i got my elastcisearch runnning with xpack and running well here uis the values node.master: true replicas: 1 minimumMasterNodes: 1 clusterHealthCheckPara… --- ## [How can I force search to look into fields that marked as \_Ignored](https://discuss.elastic.co/t/how-can-i-force-search-to-look-into-fields-that-marked-as-ignored/286915)
**Author:** [@ShayWeizman](https://discuss.elastic.co/u/ShayWeizman)\ **Replies:** 2\ **Last updated:** [October 18, 2021, 9:24am UTC](https://discuss.elastic.co/t/how-can-i-force-search-to-look-into-fields-that-marked-as-ignored/286915 "2021-10-18T09:24:07Z")
Hi All, I'm using 7.15, I'm saving some logs of failed tests, the log contain the test failed reason which I save in fields called: "testcaseFailedReason" I've noticed that I don't get values from this field in visua… --- ## [Running Enterprise Search locally, /manticore.rb:88:in \`block in call'](https://discuss.elastic.co/t/running-enterprise-search-locally-manticore-rbin-block-in-call/286857)
**Author:** [@Martyn\_Ball](https://discuss.elastic.co/u/Martyn_Ball)\ **Replies:** 5\ **Last updated:** [October 18, 2021, 9:12am UTC](https://discuss.elastic.co/t/running-enterprise-search-locally-manticore-rbin-block-in-call/286857 "2021-10-18T09:12:18Z")
Hey, i'm trying to run Elasticsearch locally however seem to be getting an issue with Enterprise Search. It stalls for a while and then gives me this error in docker: \`\[2021-10-15T14:58:40.169+00:00\]\[8\]\[2002\]\[app-server… --- ## [Change kibana welcome logo & text ( 7.15.0 )](https://discuss.elastic.co/t/change-kibana-welcome-logo-text-7-15-0/286830)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 2\ **Last updated:** [October 18, 2021, 9:00am UTC](https://discuss.elastic.co/t/change-kibana-welcome-logo-text-7-15-0/286830 "2021-10-18T09:00:56Z")
Hello! I want to change the logo form the login ui: where are the css or the image to change it? Thanks in advanced! --- ## [How to change kibana logo in Kibana 7.6.2](https://discuss.elastic.co/t/how-to-change-kibana-logo-in-kibana-7-6-2/286912)
**Author:** [@v0landem0rt](https://discuss.elastic.co/u/v0landem0rt)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 8:46am UTC](https://discuss.elastic.co/t/how-to-change-kibana-logo-in-kibana-7-6-2/286912 "2021-10-18T08:46:04Z")
I'm using Kibana 7.6.2, and i want to place custom logo at top left corner of kibana home page. How can i do it? There are many tutors at this forum, but this tutors useless for my case. --- ## [Depending on the restart of the index server, there are cases in which the search is different. Why?](https://discuss.elastic.co/t/depending-on-the-restart-of-the-index-server-there-are-cases-in-which-the-search-is-different-why/286792)
**Author:** [@jeongin](https://discuss.elastic.co/u/jeongin)\ **Replies:** 7\ **Last updated:** [October 18, 2021, 8:37am UTC](https://discuss.elastic.co/t/depending-on-the-restart-of-the-index-server-there-are-cases-in-which-the-search-is-different-why/286792 "2021-10-18T08:37:22Z")
We have a separate boxtype index server. Two cases will be described. First Restart. Perform an index. Check the term with '\_termvectors' api. Term 'xxxx' exists. Check the term with '\_explain' api. Receive 'no match… --- ## [Jdbc config not working](https://discuss.elastic.co/t/jdbc-config-not-working/286680)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 2\ **Last updated:** [October 18, 2021, 8:29am UTC](https://discuss.elastic.co/t/jdbc-config-not-working/286680 "2021-10-18T08:29:11Z")
Simple issue in that I have a jdbc config set up, but no output so no idea whats going on. I have changed logstash config to go to debug and can see the config is being consumed without errors. The input is select "tes… --- ## [Host isolation](https://discuss.elastic.co/t/host-isolation/286745)
**Author:** [@wmacleodstrath](https://discuss.elastic.co/u/wmacleodstrath)\ **Replies:** 7\ **Last updated:** [October 18, 2021, 8:12am UTC](https://discuss.elastic.co/t/host-isolation/286745 "2021-10-18T08:12:09Z")
7.14 - when I go to a case, with an alert on it , and click to get the fly out, I'm not seeing an option to "Take Action" and isolate a host. Do you only see the "Take Action" button if there is a certain alert in the ca… --- ## ["Isolate Host" is missing](https://discuss.elastic.co/t/isolate-host-is-missing/286843)
**Author:** [@robert.gleaden](https://discuss.elastic.co/u/robert.gleaden)\ **Replies:** 3\ **Last updated:** [October 18, 2021, 8:04am UTC](https://discuss.elastic.co/t/isolate-host-is-missing/286843 "2021-10-18T08:04:25Z")
Hi All, I have recently installed an ELK stack on Debian 11 v7.150.0 and seem to be having one issue, I've added the "Security Endpoint" as an integration however there is no "Isolate Agent" option under the "Take Actio… --- ## [Does this feature really work as the description? https://github.com/elastic/elasticsearch/pull/59394](https://discuss.elastic.co/t/does-this-feature-really-work-as-the-description-https-github-com-elastic-elasticsearch-pull-59394/286957)
**Author:** [@GrandFisher](https://discuss.elastic.co/u/GrandFisher)\ **Replies:** 3\ **Last updated:** [October 18, 2021, 7:00am UTC](https://discuss.elastic.co/t/does-this-feature-really-work-as-the-description-https-github-com-elastic-elasticsearch-pull-59394/286957 "2021-10-18T07:00:16Z")
Does anyone really observe this feature in the log? We never found this log in our log file.（total circuit breaker has thrown at least an CircuitBreakingException） logger.info("attempting to trigger G1GC due to high he… --- ## [Document timestamp](https://discuss.elastic.co/t/document-timestamp/286955)
**Author:** [@reka.gay](https://discuss.elastic.co/u/reka.gay)\ **Replies:** 0\ **Last updated:** [October 18, 2021, 6:06am UTC](https://discuss.elastic.co/t/document-timestamp/286955 "2021-10-18T06:06:42Z")
I'm updating the index with new/updated documents nightly. After each update, I perform a cleanup: getting all documents currently in the index and checking if they still should be present, based on the path field of eac… [Previous page](https://discuss.elastic.co/latest.md?page=1428) [Next page](https://discuss.elastic.co/latest.md?page=1430)