# Latest **URL:** https://discuss.elastic.co/latest.md?page=1441 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1442 --- ## [Why can't metric UI use apm metric data?](https://discuss.elastic.co/t/why-cant-metric-ui-use-apm-metric-data/286290)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 7\ **Last updated:** [October 11, 2021, 3:51am UTC](https://discuss.elastic.co/t/why-cant-metric-ui-use-apm-metric-data/286290 "2021-10-11T03:51:58Z")
I did not deploy metricbeat. I saw that the apm agent collects some basic indicators (CPU, memory) of the system, I set the Metrics indices to "apm-\*-metric-\*", but the page did not show the results. Is there something w… --- ## [Index size is different from ILM index size](https://discuss.elastic.co/t/index-size-is-different-from-ilm-index-size/286000)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 6\ **Last updated:** [October 11, 2021, 1:41am UTC](https://discuss.elastic.co/t/index-size-is-different-from-ilm-index-size/286000 "2021-10-11T01:41:57Z")
Why my index size is different from ilm index size property health status index uuid pri rep docs.count docs.deleted store.size pri.store.size green open log-wlb-sysmon-20… --- ## [Is Elasticsearch the right solution for regularly updated content search?](https://discuss.elastic.co/t/is-elasticsearch-the-right-solution-for-regularly-updated-content-search/286322)
**Author:** [@renegademarketer](https://discuss.elastic.co/u/renegademarketer)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 1:24am UTC](https://discuss.elastic.co/t/is-elasticsearch-the-right-solution-for-regularly-updated-content-search/286322 "2021-10-11T01:24:26Z")
I have the following use case and I'm not sure if Elasticsearch/Elasticpress is the right solution. I want to do the following: User will search WordPress custom post types (CPT), its taxonomies, custom fields (CF), an… --- ## [What is proper index naming policy for log monitoring?](https://discuss.elastic.co/t/what-is-proper-index-naming-policy-for-log-monitoring/285898)
**Author:** [@Hur](https://discuss.elastic.co/u/Hur)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 1:14am UTC](https://discuss.elastic.co/t/what-is-proper-index-naming-policy-for-log-monitoring/285898 "2021-10-11T01:14:09Z")
Hello, I have an question about the index naming policy for log monitoring. As a purpose of saving log, what is the recommended index naming policy? Are there any good ES skills to handle a number of indices? Simply, … --- ## [No alive nodes found in your cluster](https://discuss.elastic.co/t/no-alive-nodes-found-in-your-cluster/285946)
**Author:** [@dreamte](https://discuss.elastic.co/u/dreamte)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 1:13am UTC](https://discuss.elastic.co/t/no-alive-nodes-found-in-your-cluster/285946 "2021-10-11T01:13:05Z")
Hello, periodically (with an increase in the frequency of the number of additions to the index) an error occurs - no active nodes were found in your cluster. My configuration: cluster.name: elk\_test node.name: elk\_tes… --- ## [ES Migrated from 7.7.0 to 7.15.0 - all application 'logs-\*' legacy templates superseded by new managed logs index](https://discuss.elastic.co/t/es-migrated-from-7-7-0-to-7-15-0-all-application-logs-legacy-templates-superseded-by-new-managed-logs-index/285913)
**Author:** [@Nazar\_Aziz](https://discuss.elastic.co/u/Nazar_Aziz)\ **Replies:** 2\ **Last updated:** [October 11, 2021, 1:12am UTC](https://discuss.elastic.co/t/es-migrated-from-7-7-0-to-7-15-0-all-application-logs-legacy-templates-superseded-by-new-managed-logs-index/285913 "2021-10-11T01:12:38Z")
Greetings! We have a simple Elasticsearch/Kibana cloud deployment primarily used for application logs against which we generate graphs and dashboard. Logs are shipped directly from applications directly to ES search, i.… --- ## [Using Elastic Services with XenForo Forum software](https://discuss.elastic.co/t/using-elastic-services-with-xenforo-forum-software/285960)
**Author:** [@tommythejoat](https://discuss.elastic.co/u/tommythejoat)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 1:10am UTC](https://discuss.elastic.co/t/using-elastic-services-with-xenforo-forum-software/285960 "2021-10-11T01:10:27Z")
Does anyone have experience using Elastic services like Eastic Cloud with third party products like the Extended Search facility for XenForo forum system? We are currently running Elasticsearch 7.14.0 on an in house sys… --- ## [Logstash change port](https://discuss.elastic.co/t/logstash-change-port/285895)
**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\ **Replies:** 8\ **Last updated:** [October 11, 2021, 1:06am UTC](https://discuss.elastic.co/t/logstash-change-port/285895 "2021-10-11T01:06:54Z")
Logstash is running on 9600 by default and I want to run another logstash on same system Is there opion to change default port for logstash I don't want to use beats for this. beacuse I want to run two logstash with d… --- ## [Indexed documents with composite \_id collide](https://discuss.elastic.co/t/indexed-documents-with-composite-id-collide/286073)
**Author:** [@Jason-Leap](https://discuss.elastic.co/u/Jason-Leap)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 1:02am UTC](https://discuss.elastic.co/t/indexed-documents-with-composite-id-collide/286073 "2021-10-11T01:02:16Z")
Hi guys. I've found some interesting behaviour that I was hoping to get some clarification on. Let's say I perform a bulk index of two documents like so: curl --request POST \\ --url \/\/\_bulk \\ --header… --- ## [Could not find logstash.yml file despite the file being located in the default directory](https://discuss.elastic.co/t/could-not-find-logstash-yml-file-despite-the-file-being-located-in-the-default-directory/286084)
**Author:** [@Johnny\_Cash\_Cow](https://discuss.elastic.co/u/Johnny_Cash_Cow)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 12:52am UTC](https://discuss.elastic.co/t/could-not-find-logstash-yml-file-despite-the-file-being-located-in-the-default-directory/286084 "2021-10-11T00:52:42Z")
Good Evening, Here is the layout of my directory: Within /etc/logstash/ is the following files and directories: conf.d log4j2.properties logstash.yml startup.options jvm.options logstash-sample.conf piple… --- ## [Watcher input search failing due to exceeded dynamic compilation](https://discuss.elastic.co/t/watcher-input-search-failing-due-to-exceeded-dynamic-compilation/286087)
**Author:** [@Munavir\_Chavody](https://discuss.elastic.co/u/Munavir_Chavody)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 12:51am UTC](https://discuss.elastic.co/t/watcher-input-search-failing-due-to-exceeded-dynamic-compilation/286087 "2021-10-11T00:51:53Z")
I'm getting dynamic execution circuit breaking error for many watchers in our environment saying that the input search query failed to compile. What is the reason for the same. How can we avoid such errors at all? Erro… --- ## [Exiting: 9 errors: protocol not available](https://discuss.elastic.co/t/exiting-9-errors-protocol-not-available/286157)
**Author:** [@Johnatan\_Gonzalez\_Ve](https://discuss.elastic.co/u/Johnatan_Gonzalez_Ve)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 12:42am UTC](https://discuss.elastic.co/t/exiting-9-errors-protocol-not-available/286157 "2021-10-11T00:42:45Z")
module: system period: 10s metricsets: - cpu - load - memory - filesystem - fsstat - network - process - process\_summary - socket\_summary - entropy - core - diskio - socket - service - users process.include\_to… --- ## [Add data nodes in peak time](https://discuss.elastic.co/t/add-data-nodes-in-peak-time/286175)
**Author:** [@yukai](https://discuss.elastic.co/u/yukai)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 12:36am UTC](https://discuss.elastic.co/t/add-data-nodes-in-peak-time/286175 "2021-10-11T00:36:34Z")
Hi, I have a self-managed Elasticsearch cluster with 3 dedicated master nodes, in peak time I would simply add data nodes to increase cluster throughput. And I don't think this action would bring any side affects to the… --- ## [Snapshot Lifecycle Management (SLM) in Python 3](https://discuss.elastic.co/t/snapshot-lifecycle-management-slm-in-python-3/286208)
**Author:** [@ttttien](https://discuss.elastic.co/u/ttttien)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 8:57am UTC](https://discuss.elastic.co/t/snapshot-lifecycle-management-slm-in-python-3/286208 "2021-10-08T08:57:28Z")
Hello, I had done "snapshot" for the indexes in an database Elasticsearch by script : es.snapshot.create(repository=repository\_name, snapshot=snapshot\_name) I would like to Automatic backup with SML. I really need you… --- ## [New ElasticSearch Node.js client "@elastic/elasticsearch" slower than legacy ElasticSearch Node.js client "elasticsearch" in searches](https://discuss.elastic.co/t/new-elasticsearch-node-js-client-elastic-elasticsearch-slower-than-legacy-elasticsearch-node-js-client-elasticsearch-in-searches/286216)
**Author:** [@luce](https://discuss.elastic.co/u/luce)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 9:36am UTC](https://discuss.elastic.co/t/new-elasticsearch-node-js-client-elastic-elasticsearch-slower-than-legacy-elasticsearch-node-js-client-elasticsearch-in-searches/286216 "2021-10-08T09:36:28Z")
Hi folk, We are using ES version 7.9.0, the application that uses ES is on the NodeJS platform. We have currently replaced the legacy ES client library ("Elasticsearch": "16.7.2"), with the new ES client library "@elast… --- ## [How to assign an Alias in an existing Index](https://discuss.elastic.co/t/how-to-assign-an-alias-in-an-existing-index/286233)
**Author:** [@qttv](https://discuss.elastic.co/u/qttv)\ **Replies:** 5\ **Last updated:** [October 11, 2021, 12:26am UTC](https://discuss.elastic.co/t/how-to-assign-an-alias-in-an-existing-index/286233 "2021-10-11T00:26:22Z")
Good Morning, I'm using Kibana version 7.0, and I need to assign an alias to a filed into an existing Index that i can't delete. This field is named "processName" and I need to rename it as "processname". I read the do… --- ## [Elasticsearch cluster query logic by ElastAlert](https://discuss.elastic.co/t/elasticsearch-cluster-query-logic-by-elastalert/286301)
**Author:** [@josh12](https://discuss.elastic.co/u/josh12)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 12:19am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-query-logic-by-elastalert/286301 "2021-10-11T00:19:45Z")
Hi, I have question. I am planning to use elasticalert for Elasticsearch. I have 1 cluster with 3 node in my docker es01,es02 and es03. Can I know when elasticalert query in es01, if data does not exists will it query in… --- ## [Huge monitoring-es indexes](https://discuss.elastic.co/t/huge-monitoring-es-indexes/285102)
**Author:** [@Daniele\_Renda](https://discuss.elastic.co/u/Daniele_Renda)\ **Replies:** 10\ **Last updated:** [October 10, 2021, 11:06pm UTC](https://discuss.elastic.co/t/huge-monitoring-es-indexes/285102 "2021-10-10T23:06:44Z")
Today my ES cluster on Elastic cloud frozen due to high CPU consumption. There was not too much pressure with requests so I took a look at indexes to check if there is some problem. I found a lot of old indexes from apm… --- ## [Queries about indexing data into elastic search](https://discuss.elastic.co/t/queries-about-indexing-data-into-elastic-search/285542)
**Author:** [@Magesh\_02](https://discuss.elastic.co/u/Magesh_02)\ **Replies:** 3\ **Last updated:** [October 10, 2021, 11:06pm UTC](https://discuss.elastic.co/t/queries-about-indexing-data-into-elastic-search/285542 "2021-10-10T23:06:24Z")
I have some questions regarding indexing the data. In my case, I needed to push 100 million JSON records into a single index on a specific date, and the date had to be included in the JSON field. I imported this data in… --- ## [Functionbeat cannot process more than 1 message from pub/sub](https://discuss.elastic.co/t/functionbeat-cannot-process-more-than-1-message-from-pub-sub/285903)
**Author:** [@Yero\_Me](https://discuss.elastic.co/u/Yero_Me)\ **Replies:** 0\ **Last updated:** [October 5, 2021, 10:30am UTC](https://discuss.elastic.co/t/functionbeat-cannot-process-more-than-1-message-from-pub-sub/285903 "2021-10-05T10:30:57Z")
Hello, Since 7.11 up to 7.15, I cannot configure functionbeat to process more than 1 message. I deploy functionbeat on GCP cloud function. Every first message send to cloud function will be properly traited and sent t… --- ## [Conditional colouring Kibana canvas](https://discuss.elastic.co/t/conditional-colouring-kibana-canvas/285951)
**Author:** [@Mira\_9](https://discuss.elastic.co/u/Mira_9)\ **Replies:** 1\ **Last updated:** [October 10, 2021, 10:52pm UTC](https://discuss.elastic.co/t/conditional-colouring-kibana-canvas/285951 "2021-10-10T22:52:03Z")
Hi, I'm trying to change the color of the bars here depending on the value of "Primary channel " . i may have 12 values in "Primary channel" . the graph is displayed in real time so the color changing must updated th… --- ## [Elastic Agent Enroll](https://discuss.elastic.co/t/elastic-agent-enroll/286026)
**Author:** [@ravenmx](https://discuss.elastic.co/u/ravenmx)\ **Replies:** 0\ **Last updated:** [October 6, 2021, 12:41pm UTC](https://discuss.elastic.co/t/elastic-agent-enroll/286026 "2021-10-06T12:41:08Z")
Good Day. Do not tell me by chance whether it is possible to add any custom field to the elastic agent, where I can leave a record when installing the agent and work with it when searching (it seems that this is impossi… --- ## [Nested condition with double action if returns false or true](https://discuss.elastic.co/t/nested-condition-with-double-action-if-returns-false-or-true/286055)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 0\ **Last updated:** [October 6, 2021, 4:30pm UTC](https://discuss.elastic.co/t/nested-condition-with-double-action-if-returns-false-or-true/286055 "2021-10-06T16:30:27Z")
Hello, I have a question, I do not know if you can have a nested condition in an alert in elastisearch, ie I have a condition that if met returns true and send an email, but I also want if it is not met and returns fals… --- ## [How to create an array in logstash with already defined fields](https://discuss.elastic.co/t/how-to-create-an-array-in-logstash-with-already-defined-fields/286086)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 0\ **Last updated:** [October 7, 2021, 2:35am UTC](https://discuss.elastic.co/t/how-to-create-an-array-in-logstash-with-already-defined-fields/286086 "2021-10-07T02:35:28Z")
Good, I have a doubt and is that I have some specific oids already named and I would like to know how I can do to concatenate them, that is to say to put them in an array or table, so that it contains me all the oids tha… --- ## [Measure volume of events we are consuming(Size of all input events arrived)](https://discuss.elastic.co/t/measure-volume-of-events-we-are-consuming-size-of-all-input-events-arrived/286113)
**Author:** [@Dhananjay\_vispute](https://discuss.elastic.co/u/Dhananjay_vispute)\ **Replies:** 0\ **Last updated:** [October 7, 2021, 9:46am UTC](https://discuss.elastic.co/t/measure-volume-of-events-we-are-consuming-size-of-all-input-events-arrived/286113 "2021-10-07T09:46:55Z")
I have added metric to count number events as input, dropped and arrived at output. I also want to measure size of all input events bytes. Is there any way we achieve this through metrics ? --- ## [Creating alerts for logs](https://discuss.elastic.co/t/creating-alerts-for-logs/286205)
**Author:** [@Kapil\_K](https://discuss.elastic.co/u/Kapil_K)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 8:17am UTC](https://discuss.elastic.co/t/creating-alerts-for-logs/286205 "2021-10-08T08:17:55Z")
Hi all. I need to add alerts to my dashboards. I have deployed Elasticsearch helm chart to deploy in my K8s cluster. I find only stateful set has been deployed. How can I work with Elasticsearch.yml? --- ## [Failed to retrieve password hash for reserved user \[elastic\]](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-elastic/286255)
**Author:** [@rachelyang](https://discuss.elastic.co/u/rachelyang)\ **Replies:** 1\ **Last updated:** [October 10, 2021, 10:43pm UTC](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-elastic/286255 "2021-10-10T22:43:06Z")
I have verified the password of user elastic. curl -k -u elastic 'https://localhost:9200/\_xpack/security/\_authenticate?pretty' Enter host password for user 'elastic': { "username" : "elastic", "roles" : \[ "supe… --- ## [Thread pool queue size suddenly spikes to thousands](https://discuss.elastic.co/t/thread-pool-queue-size-suddenly-spikes-to-thousands/286176)
**Author:** [@vibgy](https://discuss.elastic.co/u/vibgy)\ **Replies:** 4\ **Last updated:** [October 10, 2021, 10:16pm UTC](https://discuss.elastic.co/t/thread-pool-queue-size-suddenly-spikes-to-thousands/286176 "2021-10-10T22:16:57Z")
Every once in a while, thread pool queue size suddenly spike to thousands When this happens, users start to notice that kibana becomes pretty much unresponsive, for minutes. In the above case, it became unresponsive … --- ## [Send email alerts if log level == ERROR in more than one index](https://discuss.elastic.co/t/send-email-alerts-if-log-level-error-in-more-than-one-index/285750)
**Author:** [@Chandrakant\_Naik](https://discuss.elastic.co/u/Chandrakant_Naik)\ **Replies:** 5\ **Last updated:** [October 10, 2021, 10:04pm UTC](https://discuss.elastic.co/t/send-email-alerts-if-log-level-error-in-more-than-one-index/285750 "2021-10-10T22:04:52Z")
i have ingested python logs in Elasticsearch. Sample of my logs given below \[2021-10-01 23:54:39,752\] \[INFO\] \[run\]\[MainThread\] \[xxxxxxxxx\] \[function\_name:line no\] : updating user request mapping for the request xxxxxxx … --- ## [How to parse two timestamp fields from one single log line message](https://discuss.elastic.co/t/how-to-parse-two-timestamp-fields-from-one-single-log-line-message/286282)
**Author:** [@Patr123](https://discuss.elastic.co/u/Patr123)\ **Replies:** 6\ **Last updated:** [October 10, 2021, 3:33pm UTC](https://discuss.elastic.co/t/how-to-parse-two-timestamp-fields-from-one-single-log-line-message/286282 "2021-10-10T15:33:30Z")
Hello All, I have log lines coming from K8's to logstash and they have two timestamps back to back. How can I parse those fields in let's say @timestamp field and timestamp2 field? My log lines look like: 2021-10-08 1… [Previous page](https://discuss.elastic.co/latest.md?page=1440) [Next page](https://discuss.elastic.co/latest.md?page=1442)