# Latest **URL:** https://discuss.elastic.co/latest.md?page=1442 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1443 --- ## [Memory, storage and CPU requirements depending on node roles](https://discuss.elastic.co/t/memory-storage-and-cpu-requirements-depending-on-node-roles/286294)
**Author:** [@flavienbwk](https://discuss.elastic.co/u/flavienbwk)\ **Replies:** 3\ **Last updated:** [October 10, 2021, 2:58pm UTC](https://discuss.elastic.co/t/memory-storage-and-cpu-requirements-depending-on-node-roles/286294 "2021-10-10T14:58:38Z")
Hi, Has anyone any intuition about what are the memory, storage and CPU requirements depending on node roles ? Is the following intuition right ? Coordinating nodes : high CPU, low memory Master-only nodes : high CPU… --- ## [How to do monitor third part applications using elastic APM](https://discuss.elastic.co/t/how-to-do-monitor-third-part-applications-using-elastic-apm/286131)
**Author:** [@AnishAnil](https://discuss.elastic.co/u/AnishAnil)\ **Replies:** 4\ **Last updated:** [October 10, 2021, 2:19pm UTC](https://discuss.elastic.co/t/how-to-do-monitor-third-part-applications-using-elastic-apm/286131 "2021-10-10T14:19:56Z")
I'm using Cloud Instance and all the version are the latest. NOTE: This is a trail version hosted on AWS. We are using external application --\>Gerrit and we would like to know how to use the Elastic APM to monitor the … --- ## [Some thoughts on adding new Analyzer to existing Index without reindex or close](https://discuss.elastic.co/t/some-thoughts-on-adding-new-analyzer-to-existing-index-without-reindex-or-close/285242)
**Author:** [@garyzjq](https://discuss.elastic.co/u/garyzjq)\ **Replies:** 5\ **Last updated:** [October 10, 2021, 12:19pm UTC](https://discuss.elastic.co/t/some-thoughts-on-adding-new-analyzer-to-existing-index-without-reindex-or-close/285242 "2021-10-10T12:19:57Z")
Hi team, (Elasticsearch 7.5) My scenario is to add a new custom Analyzer to an existing Index. Analyzer definition may like below: { "analyzer": { "ngram\_analyzer": { "type": "custom", … --- ## [Add a node to elastic running on docker from another server](https://discuss.elastic.co/t/add-a-node-to-elastic-running-on-docker-from-another-server/285156)
**Author:** [@kakigadol](https://discuss.elastic.co/u/kakigadol)\ **Replies:** 9\ **Last updated:** [October 10, 2021, 11:38am UTC](https://discuss.elastic.co/t/add-a-node-to-elastic-running-on-docker-from-another-server/285156 "2021-10-10T11:38:48Z")
I have an Elasticsearch 6.6 cluster with two nodes running on the first server using docker-compose I want to add another node running on a separate server to get more physical resources. I configured everything the sa… --- ## [Get a count of buckets from a terms agg, but not the buckets themselves](https://discuss.elastic.co/t/get-a-count-of-buckets-from-a-terms-agg-but-not-the-buckets-themselves/286259)
**Author:** [@annmarie-switzer](https://discuss.elastic.co/u/annmarie-switzer)\ **Replies:** 1\ **Last updated:** [October 10, 2021, 7:58am UTC](https://discuss.elastic.co/t/get-a-count-of-buckets-from-a-terms-agg-but-not-the-buckets-themselves/286259 "2021-10-10T07:58:40Z")
Is there any way to get the bucket count from a terms agg, but just the count, not the buckets themselves? I have a scenario where I want to display a table (with pagination) of all the non-unique values (buckets) for … --- ## [Error: Unknown key for a VALUE\_STRING in \[analyzer\]](https://discuss.elastic.co/t/error-unknown-key-for-a-value-string-in-analyzer/286105)
**Author:** [@Drsaud](https://discuss.elastic.co/u/Drsaud)\ **Replies:** 10\ **Last updated:** [October 10, 2021, 7:37am UTC](https://discuss.elastic.co/t/error-unknown-key-for-a-value-string-in-analyzer/286105 "2021-10-10T07:37:23Z")
Hi, I'm having this error in postman Unknown key for a VALUE\_STRING in \[analyzer\]. when I search like this: (note I get this after I add the analyzer) { "query": { "terms": { "username": … --- ## [Parsing nested json with logstash](https://discuss.elastic.co/t/parsing-nested-json-with-logstash/286287)
**Author:** [@diaztech](https://discuss.elastic.co/u/diaztech)\ **Replies:** 3\ **Last updated:** [October 10, 2021, 12:44am UTC](https://discuss.elastic.co/t/parsing-nested-json-with-logstash/286287 "2021-10-10T00:44:57Z")
I'm trying to import a collection from mongo with the following input input { mongodb { uri =\> "uripath" placeholder\_db\_dir =\> "../opt/logstash-mongodb/" placeholder\_db\_name =\> "logstash\_sqli… --- ## [Can Painless script to execute search](https://discuss.elastic.co/t/can-painless-script-to-execute-search/286305)
**Author:** [@Param](https://discuss.elastic.co/u/Param)\ **Replies:** 0\ **Last updated:** [October 9, 2021, 7:29pm UTC](https://discuss.elastic.co/t/can-painless-script-to-execute-search/286305 "2021-10-09T19:29:30Z")
Hi I am using scripted grouping of a index . if any bucket's document count is greater than 0, i want to select description filed from index with all of grouping field using as filter for that query. "query": { … --- ## [Import text file to logstash](https://discuss.elastic.co/t/import-text-file-to-logstash/286303)
**Author:** [@quyennguyen](https://discuss.elastic.co/u/quyennguyen)\ **Replies:** 1\ **Last updated:** [October 9, 2021, 6:45pm UTC](https://discuss.elastic.co/t/import-text-file-to-logstash/286303 "2021-10-09T18:45:24Z")
I had some text files with formats like this. 10/09-22:09:34.989323 \[\*\*\] \[1:100000015:3\] "OR SQL Injection Detected" \[\*\*\] \[Priority: 0\] {TCP} 192.168.186.25:44748 -\> 192.168.186.162:80 10/09-22:09:34.989323 \[\*\*\] \[1:1000… --- ## [Metricbeat from source builds x-pack modules but doesnt contain directories in image](https://discuss.elastic.co/t/metricbeat-from-source-builds-x-pack-modules-but-doesnt-contain-directories-in-image/285752)
**Author:** [@ss\_22](https://discuss.elastic.co/u/ss_22)\ **Replies:** 2\ **Last updated:** [October 9, 2021, 3:46pm UTC](https://discuss.elastic.co/t/metricbeat-from-source-builds-x-pack-modules-but-doesnt-contain-directories-in-image/285752 "2021-10-09T15:46:27Z")
Hello, I have recently built Metricbeat from source code after following the developer guides. I noticed it builds all of the x-pack modules, but at the end of the day the image doesnt contain these module directories. … --- ## [How to remove ipv6 from host.ip](https://discuss.elastic.co/t/how-to-remove-ipv6-from-host-ip/284341)
**Author:** [@xizhimen](https://discuss.elastic.co/u/xizhimen)\ **Replies:** 4\ **Last updated:** [October 9, 2021, 6:40am UTC](https://discuss.elastic.co/t/how-to-remove-ipv6-from-host-ip/284341 "2021-10-09T06:40:59Z")
background: winlogbeat7.3.2 windows2016 winlogbeat.yml: processors: - add\_host\_metadata: netinfo.enabled: true requirement: in kibana: I want to remove this ipv6 info ,How? THANKS! I try to remove ipv… --- ## [Custom Plugin add filter to search query by external access policies](https://discuss.elastic.co/t/custom-plugin-add-filter-to-search-query-by-external-access-policies/285723)
**Author:** [@David\_Sheard](https://discuss.elastic.co/u/David_Sheard)\ **Replies:** 5\ **Last updated:** [October 9, 2021, 12:24am UTC](https://discuss.elastic.co/t/custom-plugin-add-filter-to-search-query-by-external-access-policies/285723 "2021-10-09T00:24:46Z")
Hi, I'm wanting to create a custom plugin. The purpose is to make a rest call to an external service to apply access control polices to search requests. Is there any sample code or an article that would assist? Appreci… --- ## [Searching through every document in ES?](https://discuss.elastic.co/t/searching-through-every-document-in-es/286281)
**Author:** [@bensalerno](https://discuss.elastic.co/u/bensalerno)\ **Replies:** 7\ **Last updated:** [October 8, 2021, 11:13pm UTC](https://discuss.elastic.co/t/searching-through-every-document-in-es/286281 "2021-10-08T23:13:56Z")
My cluster has roughly 300,000 documents in it. Right now, I'm only able to query 10,000 at a time. Is there a way to query through all documents? Or is this bad practice? Many of search queries are returning 0 results … --- ## [Frozen Indices Deprecation](https://discuss.elastic.co/t/frozen-indices-deprecation/286288)
**Author:** [@vthacker](https://discuss.elastic.co/u/vthacker)\ **Replies:** 1\ **Last updated:** [October 9, 2021, 12:06am UTC](https://discuss.elastic.co/t/frozen-indices-deprecation/286288 "2021-10-09T00:06:50Z")
Watching this recent talk frozen indices sounds like a feature recommended to users However when I look at the doc here the feature is deprecated. I'm not sure which one to read into - Is the feature going to exist goi… --- ## [Issue with FSCrawler (fscrawler-es7-2.7) . Refusing to upload new files . Warning: set filename as stored field!](https://discuss.elastic.co/t/issue-with-fscrawler-fscrawler-es7-2-7-refusing-to-upload-new-files-warning-set-filename-as-stored-field/286272)
**Author:** [@Francois\_Saab](https://discuss.elastic.co/u/Francois_Saab)\ **Replies:** 1\ **Last updated:** [October 8, 2021, 11:15pm UTC](https://discuss.elastic.co/t/issue-with-fscrawler-fscrawler-es7-2-7-refusing-to-upload-new-files-warning-set-filename-as-stored-field/286272 "2021-10-08T23:15:06Z")
We are facing an issue with FSCrawler (fscrawler-es7-2.7). FSCrawler is refusing to upload new files and raises the below error: 08:37:04,730 WARN \[f.p.e.c.f.FsParserAbstract\] Error while crawling \\SearchEngineFiles\\D… --- ## [Issue with escaping pipe "|" in Ingest Pipeline](https://discuss.elastic.co/t/issue-with-escaping-pipe-in-ingest-pipeline/286279)
**Author:** [@Thanura\_Kannangara](https://discuss.elastic.co/u/Thanura_Kannangara)\ **Replies:** 7\ **Last updated:** [October 8, 2021, 9:20pm UTC](https://discuss.elastic.co/t/issue-with-escaping-pipe-in-ingest-pipeline/286279 "2021-10-08T21:20:37Z")
Hi Guys, I have a log patern that look like this (windows event log) Dummy request has been approved.|Node=blah-blah.example.net\_iam|BatchSig=jhsdjahsdgsjahdg|Requester=john.test|Recipient=ex0000123456 below grok pat… --- ## [New filebeat module - how to move to production? Template not loading](https://discuss.elastic.co/t/new-filebeat-module-how-to-move-to-production-template-not-loading/285775)
**Author:** [@kelvins](https://discuss.elastic.co/u/kelvins)\ **Replies:** 7\ **Last updated:** [October 8, 2021, 8:18pm UTC](https://discuss.elastic.co/t/new-filebeat-module-how-to-move-to-production-template-not-loading/285775 "2021-10-08T20:18:37Z")
I have created a new module to Filebeat. To be honest I have been struggling with this for a long time, perhaps a blog post somewhere (creating a new filebeat start to finish) I could find could help me immensely. Anyw… --- ## [Warn users when they do unindexed searches](https://discuss.elastic.co/t/warn-users-when-they-do-unindexed-searches/286164)
**Author:** [@vibgy](https://discuss.elastic.co/u/vibgy)\ **Replies:** 5\ **Last updated:** [October 8, 2021, 6:23pm UTC](https://discuss.elastic.co/t/warn-users-when-they-do-unindexed-searches/286164 "2021-10-08T18:23:58Z")
We have observed in our stack that a lot of the users are making queries without specifying a single indexed field. And we would like to soft-warn our users when they do so. What would be the best way to implement somet… --- ## [Missing delete phase](https://discuss.elastic.co/t/missing-delete-phase/286261)
**Author:** [@ggab31](https://discuss.elastic.co/u/ggab31)\ **Replies:** 2\ **Last updated:** [October 8, 2021, 5:56pm UTC](https://discuss.elastic.co/t/missing-delete-phase/286261 "2021-10-08T17:56:34Z")
Hi, I have cluster with a single node. Today, I upgraded Elasticsearch and Kibana from 7.5 to 7.15. Maybe it's not related to the upgrade but now, the delete phase is missing when I want to create a new Index Lifecycle… --- ## [Fleet agent failed to connect to fleet server after assigning new agent policy](https://discuss.elastic.co/t/fleet-agent-failed-to-connect-to-fleet-server-after-assigning-new-agent-policy/286263)
**Author:** [@pingz](https://discuss.elastic.co/u/pingz)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 4:04pm UTC](https://discuss.elastic.co/t/fleet-agent-failed-to-connect-to-fleet-server-after-assigning-new-agent-policy/286263 "2021-10-08T16:04:54Z")
Hi there: I have fleet agent and fleet server (7.15.0) both running as pods in Kubernetes. After applying new agent policy, fleet agent became offline. I can see the error in fleet agent log |2021-10-08T15:56:56.120Z… --- ## [Append nested variable's value to a string](https://discuss.elastic.co/t/append-nested-variables-value-to-a-string/285470)
**Author:** [@Voolkan](https://discuss.elastic.co/u/Voolkan)\ **Replies:** 6\ **Last updated:** [October 8, 2021, 3:10pm UTC](https://discuss.elastic.co/t/append-nested-variables-value-to-a-string/285470 "2021-10-08T15:10:49Z")
Hello, I'm trying to setup a bit of a dynamic solution to the logstash config, and especially the json filter part. When setting the json part, I need to provide a source and a target fields. With source it's easy, howe… --- ## [Fleet service account permissions for filebeat threat intel](https://discuss.elastic.co/t/fleet-service-account-permissions-for-filebeat-threat-intel/286258)
**Author:** [@albbapm](https://discuss.elastic.co/u/albbapm)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 2:53pm UTC](https://discuss.elastic.co/t/fleet-service-account-permissions-for-filebeat-threat-intel/286258 "2021-10-08T14:53:14Z")
I am trying to use the elastic agent via fleet and filebeat to gather threat intel. I realize this is currently not working out of the box. That being said, I think I can massage it and get it working but I have some q… --- ## [Not able to see APM log on Kibana Cloud dashboard](https://discuss.elastic.co/t/not-able-to-see-apm-log-on-kibana-cloud-dashboard/285945)
**Author:** [@Sharma3007](https://discuss.elastic.co/u/Sharma3007)\ **Replies:** 2\ **Last updated:** [October 8, 2021, 2:52pm UTC](https://discuss.elastic.co/t/not-able-to-see-apm-log-on-kibana-cloud-dashboard/285945 "2021-10-08T14:52:36Z")
Hi Team, We have configured elastic APM Agent with our asp.net application successfully. We have add below configuration in our web.config file: \ \ **Author:** [@Slava\_Gavrilov](https://discuss.elastic.co/u/Slava_Gavrilov)\ **Replies:** 1\ **Last updated:** [October 8, 2021, 2:49pm UTC](https://discuss.elastic.co/t/developing-plugins-for-kibana/285942 "2021-10-08T14:49:34Z") Hi. In my dicovery page of kibana i'm using url format field (kibana format) I want to that ref in field opend in modal window or something, not in new tab or current tab. I met kibana plugin develobment. The command n… --- ## [Subtracting 2 fields different document on Scripted Field / json input](https://discuss.elastic.co/t/subtracting-2-fields-different-document-on-scripted-field-json-input/286203)
**Author:** [@rikizita3](https://discuss.elastic.co/u/rikizita3)\ **Replies:** 1\ **Last updated:** [October 8, 2021, 2:44pm UTC](https://discuss.elastic.co/t/subtracting-2-fields-different-document-on-scripted-field-json-input/286203 "2021-10-08T14:44:12Z")
I have a set of data below. I want to add the red marker then subtract it to the blue marker. I tried using Scripted Field. But when I go back to discovery I have this error. If I will put it on the line gra… --- ## [Dissect Logs](https://discuss.elastic.co/t/dissect-logs/286048)
**Author:** [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\ **Replies:** 7\ **Last updated:** [October 8, 2021, 2:41pm UTC](https://discuss.elastic.co/t/dissect-logs/286048 "2021-10-08T14:41:53Z")
I simply want to turn key:value data from a message string into fields in Elastic, so I can analyze the logs with Kibana. I'd like to use Dissect to do the following: Dissecting this log: conn=10 op=221996 RESULT err=… --- ## [How do I not send metadata from filebeat to Graylog?](https://discuss.elastic.co/t/how-do-i-not-send-metadata-from-filebeat-to-graylog/286253)
**Author:** [@s79](https://discuss.elastic.co/u/s79)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 2:36pm UTC](https://discuss.elastic.co/t/how-do-i-not-send-metadata-from-filebeat-to-graylog/286253 "2021-10-08T14:36:27Z")
I am using filebeats directly to send json data to graylog. The fields @metadata\_\_id, @metadata\_beat, @metadata\_type, @metadata\_version are constants, and @timestamp is not needed since the time is in the message. All th… --- ## [Metricbeat not creating Index correctly](https://discuss.elastic.co/t/metricbeat-not-creating-index-correctly/285863)
**Author:** [@mhare](https://discuss.elastic.co/u/mhare)\ **Replies:** 4\ **Last updated:** [October 8, 2021, 2:36pm UTC](https://discuss.elastic.co/t/metricbeat-not-creating-index-correctly/285863 "2021-10-08T14:36:25Z")
I am running Stack version 7.13.4 with Metricbeat Everything seemed to be working fine, then we wanted to remove all the metricbeat data and start over. So we stopped metricbeat, and deleted all of the Metricbeat indexe… --- ## [Pipeline error {:pipeline\_id=\>"main", :exception=\>#\ **Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 1\ **Last updated:** [October 8, 2021, 2:35pm UTC](https://discuss.elastic.co/t/pipeline-error-pipeline-id-main-exception-logstash-unexpected-character-code-58-expected-a-valid-value-number-string-array-object-true-false-or-null/286252 "2021-10-08T14:35:30Z") Hello friends, I want to add some data to a new index according to a query from an existing index in elasticsearch. But I am facing a problem while doing this, I would be very happy if you could help me. my conf file: i… --- ## [Mutate gsub - re-using regex](https://discuss.elastic.co/t/mutate-gsub-re-using-regex/286243)
**Author:** [@JimJ](https://discuss.elastic.co/u/JimJ)\ **Replies:** 2\ **Last updated:** [October 8, 2021, 2:13pm UTC](https://discuss.elastic.co/t/mutate-gsub-re-using-regex/286243 "2021-10-08T14:13:06Z")
Hi everybody, I would like to parttially remove the end of a string like that: mutate { gsub =\> \[ "fieldname", "(:\[0-5\]\[0-9\].\\d{3})\\d\*$", "what\_is\_between\_brackets" \] } Context: I parse… [Previous page](https://discuss.elastic.co/latest.md?page=1441) [Next page](https://discuss.elastic.co/latest.md?page=1443)