# Latest **URL:** https://discuss.elastic.co/latest.md?page=1514 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1515 --- ## [Searchable snapshots - cold phase - not working as expected](https://discuss.elastic.co/t/searchable-snapshots-cold-phase-not-working-as-expected/282143)
**Author:** [@Kannappan\_Somu](https://discuss.elastic.co/u/Kannappan_Somu)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 1:44am UTC](https://discuss.elastic.co/t/searchable-snapshots-cold-phase-not-working-as-expected/282143 "2021-08-23T01:44:10Z")
INDEX TEMPLATE PUT \_template/cold-demo { "index\_patterns": \["cold-demo\*"\], "settings": { "index" : { "lifecycle" : { "name" : "cold\_retention\_prod", "rollover\_alias" : "… --- ## [I think in elasticsearch it shows the size of 10 by default but instead of 10 i want to set the size to total hits value that i am getting after running the query. I am attaching my query Please help me out](https://discuss.elastic.co/t/i-think-in-elasticsearch-it-shows-the-size-of-10-by-default-but-instead-of-10-i-want-to-set-the-size-to-total-hits-value-that-i-am-getting-after-running-the-query-i-am-attaching-my-query-please-help-me-out/282157)
**Author:** [@ashurajchandra](https://discuss.elastic.co/u/ashurajchandra)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 1:39am UTC](https://discuss.elastic.co/t/i-think-in-elasticsearch-it-shows-the-size-of-10-by-default-but-instead-of-10-i-want-to-set-the-size-to-total-hits-value-that-i-am-getting-after-running-the-query-i-am-attaching-my-query-please-help-me-out/282157 "2021-08-23T01:39:40Z")
GET /\_search { "sort": \[{ "date": { "order": "desc" } }\], "track\_total\_hits": true, "query": { "bool": { "must": \[ { … --- ## [TOO\_MANY\_REQUESTS/12/disk usage exceeded](https://discuss.elastic.co/t/too-many-requests-12-disk-usage-exceeded/280753)
**Author:** [@mfisher](https://discuss.elastic.co/u/mfisher)\ **Replies:** 3\ **Last updated:** [August 23, 2021, 1:29am UTC](https://discuss.elastic.co/t/too-many-requests-12-disk-usage-exceeded/280753 "2021-08-23T01:29:42Z")
Recently credentials are failing in the Kibana web interface. Checking the logs there is an error indicating disk usage is exceeded. {"type":"log","@timestamp":"2021-08-08T20:41:52-05:00","tags":\["error","plugins","apm… --- ## [Having 0 shard for cluster elastisearch](https://discuss.elastic.co/t/having-0-shard-for-cluster-elastisearch/282150)
**Author:** [@selin](https://discuss.elastic.co/u/selin)\ **Replies:** 3\ **Last updated:** [August 23, 2021, 1:24am UTC](https://discuss.elastic.co/t/having-0-shard-for-cluster-elastisearch/282150 "2021-08-23T01:24:25Z")
Hi friend, i have 3 container elasticsearch. I am assuming it should crete 5 shard for each container as 1 index in each container and each container have multiple shard/ When I fired shards api, i getting 0. Please advi… --- ## [Error fetching fields for index pattern file\*](https://discuss.elastic.co/t/error-fetching-fields-for-index-pattern-file/282120)
**Author:** [@\_bugc4t](https://discuss.elastic.co/u/_bugc4t)\ **Replies:** 2\ **Last updated:** [August 23, 2021, 12:22am UTC](https://discuss.elastic.co/t/error-fetching-fields-for-index-pattern-file/282120 "2021-08-23T00:22:53Z")
Helo, bit new to elastic but I'm trying to get data into my ECK deployment. I'm using Filebeat to do this. I've got one option on the index patterns page with my File name but and I selected file\*. I'm worried that not a… --- ## [Ceph s3 as snapshot and backup](https://discuss.elastic.co/t/ceph-s3-as-snapshot-and-backup/282168)
**Author:** [@Nasri](https://discuss.elastic.co/u/Nasri)\ **Replies:** 1\ **Last updated:** [August 22, 2021, 3:20pm UTC](https://discuss.elastic.co/t/ceph-s3-as-snapshot-and-backup/282168 "2021-08-22T15:20:22Z")
Hi, I have a s3 bucket created on ceph , when It wants to create repository it shows the following error. { "error": { "root\_cause": \[ { "type": "repository\_verification\_exception", "reason… --- ## [How to change type of field in logstash for xml plugin](https://discuss.elastic.co/t/how-to-change-type-of-field-in-logstash-for-xml-plugin/282160)
**Author:** [@Ankit-github-26](https://discuss.elastic.co/u/Ankit-github-26)\ **Replies:** 1\ **Last updated:** [August 22, 2021, 1:00pm UTC](https://discuss.elastic.co/t/how-to-change-type-of-field-in-logstash-for-xml-plugin/282160 "2021-08-22T13:00:20Z")
I want to change some field types from text(by default) to float for aggregation purpose from xml parsed data. kindly find my logstash configuration below xml { source =\> "\[data\]\[cdr\]" target =\> "cdr" } mutate { re… --- ## [\[ERROR\] Cannot race. Error in race control (Could not register track plugin at /Path/To/My/Track)](https://discuss.elastic.co/t/error-cannot-race-error-in-race-control-could-not-register-track-plugin-at-path-to-my-track/282155)
**Author:** [@kingswan](https://discuss.elastic.co/u/kingswan)\ **Replies:** 1\ **Last updated:** [August 22, 2021, 11:21am UTC](https://discuss.elastic.co/t/error-cannot-race-error-in-race-control-could-not-register-track-plugin-at-path-to-my-track/282155 "2021-08-22T11:21:47Z")
Hi, I am a new comer of rally. I created a customized track trademark\_multi, before I created track.py file, it worked well. After I created track.py for vary parameter, it cannot work again. Here are the files I crea… --- ## [Jointure entre deux CSV](https://discuss.elastic.co/t/jointure-entre-deux-csv/282147)
**Author:** [@Hind](https://discuss.elastic.co/u/Hind)\ **Replies:** 2\ **Last updated:** [August 22, 2021, 10:31am UTC](https://discuss.elastic.co/t/jointure-entre-deux-csv/282147 "2021-08-22T10:31:38Z")
Bonsoir, j'ai une question ! J'ai deux fichiers CSV ,qui contiennent des données complémentaires, que je veux injecter dans ElasticSearch, et je voulais savoir est ce qu'il vaut mieux de les joindre dans un même CSV av… --- ## [Not able to monitor windows events on running metricbeat as a container](https://discuss.elastic.co/t/not-able-to-monitor-windows-events-on-running-metricbeat-as-a-container/282161)
**Author:** [@rajesh\_k](https://discuss.elastic.co/u/rajesh_k)\ **Replies:** 0\ **Last updated:** [August 22, 2021, 8:50am UTC](https://discuss.elastic.co/t/not-able-to-monitor-windows-events-on-running-metricbeat-as-a-container/282161 "2021-08-22T08:50:53Z")
Not able to monitor windows events on running metricbeat as a container. Metricbeat is launched as container using below command FROM docker.elastic.co/beats/metricbeat:7.14.0 COPY metricbeat.yml /usr/share/metricbeat… --- ## [Fetch Out data from Index based on condition with VEGA](https://discuss.elastic.co/t/fetch-out-data-from-index-based-on-condition-with-vega/282133)
**Author:** [@Harshal\_Goyal](https://discuss.elastic.co/u/Harshal_Goyal)\ **Replies:** 1\ **Last updated:** [August 22, 2021, 7:16am UTC](https://discuss.elastic.co/t/fetch-out-data-from-index-based-on-condition-with-vega/282133 "2021-08-22T07:16:22Z")
I am trying to fetch the data based on a specific condition say a field that goes by name sym and only has a specific value "X". And use only that data to plot the graphs using vega query. But I am unable to fetch the da… --- ## [Metricbeat cannot setup dashboards to AWS Elasticsearch](https://discuss.elastic.co/t/metricbeat-cannot-setup-dashboards-to-aws-elasticsearch/282135)
**Author:** [@buulq90](https://discuss.elastic.co/u/buulq90)\ **Replies:** 1\ **Last updated:** [August 22, 2021, 4:29am UTC](https://discuss.elastic.co/t/metricbeat-cannot-setup-dashboards-to-aws-elasticsearch/282135 "2021-08-22T04:29:36Z")
Hello all, I'm first using of ELK stack and got some issue when trying to connect the Metricbeat to my AWS Elasticsearch. My environment is as below: AWS Elasticsearch 7.10 Metricbeat OSS 7.10.0 - Windows-x86\_64 … --- ## [Elasticsearch Increasing Write rejections](https://discuss.elastic.co/t/elasticsearch-increasing-write-rejections/281882)
**Author:** [@Tombal](https://discuss.elastic.co/u/Tombal)\ **Replies:** 10\ **Last updated:** [August 22, 2021, 2:18am UTC](https://discuss.elastic.co/t/elasticsearch-increasing-write-rejections/281882 "2021-08-22T02:18:51Z")
Hello, I have 20 node platinum licenced ELK cluster. (Version 7.6.1) Setup is stated as below. 16 data nodes --\> each 64GB memory // 32gb allocated as Xms-Xmx jvm . --\> 8TB disk each 3 master nodes --\> 32gb memory ea… --- ## [Questions On Logstash Conf File](https://discuss.elastic.co/t/questions-on-logstash-conf-file/282149)
**Author:** [@Jared9922](https://discuss.elastic.co/u/Jared9922)\ **Replies:** 1\ **Last updated:** [August 22, 2021, 1:05am UTC](https://discuss.elastic.co/t/questions-on-logstash-conf-file/282149 "2021-08-22T01:05:43Z")
Hello I was just wondering if somebody could help clear up some confusion I am having when it comes to logstash. So in my current .conf file I have the output set to elasticsearch. This is where my questions start to po… --- ## [A question on Traffic filtering](https://discuss.elastic.co/t/a-question-on-traffic-filtering/282140)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 2\ **Last updated:** [August 21, 2021, 11:02pm UTC](https://discuss.elastic.co/t/a-question-on-traffic-filtering/282140 "2021-08-21T23:02:22Z")
Hi, I just wanted to check if my understanding is correct on the traffic filtering Suppose someone has put in Traffic filtering via two configured filters: AWS Virtual Private Clouds (VPCs) over AWS PrivateLink filte… --- ## [Fetching error from APM](https://discuss.elastic.co/t/fetching-error-from-apm/264975)
**Author:** [@akoua\_yao\_alex\_didie](https://discuss.elastic.co/u/akoua_yao_alex_didie)\ **Replies:** 2\ **Last updated:** [August 21, 2021, 5:53pm UTC](https://discuss.elastic.co/t/fetching-error-from-apm/264975 "2021-08-21T17:53:06Z")
If you are asking about a problem you are experiencing, please use the following template, as it will help us help you. If you have a different problem, please delete all of this text :slight\_smile: TIP 1: select at lea… --- ## [Extract file name and add as a field](https://discuss.elastic.co/t/extract-file-name-and-add-as-a-field/282105)
**Author:** [@Sherabu](https://discuss.elastic.co/u/Sherabu)\ **Replies:** 2\ **Last updated:** [August 21, 2021, 5:30pm UTC](https://discuss.elastic.co/t/extract-file-name-and-add-as-a-field/282105 "2021-08-21T17:30:50Z")
Hi bro and sis I will be sending file from filebeat to logstash. Is there a way I can extract file name on logstash filter? I want to add as a new field My file name Path/sample.log Path/sample.20210821 Your small a… --- ## [Filebeat Monitor app (Visualize or Tail)](https://discuss.elastic.co/t/filebeat-monitor-app-visualize-or-tail/281920)
**Author:** [@Saleem](https://discuss.elastic.co/u/Saleem)\ **Replies:** 5\ **Last updated:** [August 21, 2021, 2:32pm UTC](https://discuss.elastic.co/t/filebeat-monitor-app-visualize-or-tail/281920 "2021-08-21T14:32:18Z")
Sorry i'm new to the elasticstack, but bear with me I'm trying to setup ES-Kibana-Filebeat for Java application logs processing The specific log files i'm trying to visualize aren't one of the log types with modules T… --- ## [Kibana - Failed to query events data](https://discuss.elastic.co/t/kibana-failed-to-query-events-data/281699)
**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\ **Replies:** 7\ **Last updated:** [August 21, 2021, 12:22pm UTC](https://discuss.elastic.co/t/kibana-failed-to-query-events-data/281699 "2021-08-21T12:22:01Z")
Here are the full errors: That is the error i see in KIbana when i try to visualize auditbeat data from auditbeat index. i cannot visualize anything in Kibana now from that index. The error states: type": "illeg… --- ## [Populate new field in elastic index using key of the index](https://discuss.elastic.co/t/populate-new-field-in-elastic-index-using-key-of-the-index/279477)
**Author:** [@bipin\_kumar2](https://discuss.elastic.co/u/bipin_kumar2)\ **Replies:** 3\ **Last updated:** [August 21, 2021, 12:09pm UTC](https://discuss.elastic.co/t/populate-new-field-in-elastic-index-using-key-of-the-index/279477 "2021-08-21T12:09:46Z")
Hi , I have index which of very large size and in populate incremental data into this index by using upsert into hive external table using id of index pointing to elastic index , now i have to add a new field into this… --- ## [The unit elasticsearch.service has entered the 'failed' state with result 'exit-code'](https://discuss.elastic.co/t/the-unit-elasticsearch-service-has-entered-the-failed-state-with-result-exit-code/282129)
**Author:** [@Atif\_Hussain](https://discuss.elastic.co/u/Atif_Hussain)\ **Replies:** 2\ **Last updated:** [August 21, 2021, 7:06am UTC](https://discuss.elastic.co/t/the-unit-elasticsearch-service-has-entered-the-failed-state-with-result-exit-code/282129 "2021-08-21T07:06:59Z")
After new installation of 7.14, I am getting this error when I try to start the service. Tried different solutions on from this forum without any luck. I am new to Elasticsearch so need help. Following are the logs fr… --- ## [\_grokparsefailure is occurring even after the grok pattern is success in grokdebugger](https://discuss.elastic.co/t/grokparsefailure-is-occurring-even-after-the-grok-pattern-is-success-in-grokdebugger/280784)
**Author:** [@vaseemQA](https://discuss.elastic.co/u/vaseemQA)\ **Replies:** 19\ **Last updated:** [August 21, 2021, 6:56am UTC](https://discuss.elastic.co/t/grokparsefailure-is-occurring-even-after-the-grok-pattern-is-success-in-grokdebugger/280784 "2021-08-21T06:56:58Z")
Hi Team, I'm using logstash 6.8.3, and I'm trying to parse ES slow logs and my sample field is a ES source\_query which looks like "source\_query":{"from":0,"size":0,"post\_filter":{"bool":{"must":\[{"term":{" \*\*someId\*\* "… --- ## [Elasticsearch performance](https://discuss.elastic.co/t/elasticsearch-performance/282119)
**Author:** [@dgastudio](https://discuss.elastic.co/u/dgastudio)\ **Replies:** 1\ **Last updated:** [August 21, 2021, 6:47am UTC](https://discuss.elastic.co/t/elasticsearch-performance/282119 "2021-08-21T06:47:51Z")
Hello my instance (single node) m6g.large 2cpu 8ram elastic version : 7.14.0 elastic is hiden by nginx proxy when trying to do a batch index operation (about 2000 items in one batch), and, in the same time, i'm doing… --- ## [Docker module metricbeat can't reach docker socket](https://discuss.elastic.co/t/docker-module-metricbeat-cant-reach-docker-socket/282130)
**Author:** [@Trung\_Dam1](https://discuss.elastic.co/u/Trung_Dam1)\ **Replies:** 0\ **Last updated:** [August 21, 2021, 4:31am UTC](https://discuss.elastic.co/t/docker-module-metricbeat-cant-reach-docker-socket/282130 "2021-08-21T04:31:36Z")
Hi everyone I use metricbeat to get metrics from docker swarm, I have metricbeat on node manager and worker but not getting any index on docker, i tried output metricbeat to file but what i get is only system module wh… --- ## [How to view sql queries in APM](https://discuss.elastic.co/t/how-to-view-sql-queries-in-apm/281388)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 8\ **Last updated:** [August 21, 2021, 2:42am UTC](https://discuss.elastic.co/t/how-to-view-sql-queries-in-apm/281388 "2021-08-21T02:42:00Z")
Hello, how are you? I am having a problem with the SQL queries in APM, what happens is that I am trying to show me the queries that occur in SQL and send to APM. I have already installed the agent 'elastic.apm.sql.clien… --- ## [Visualisation to replay user session/journey](https://discuss.elastic.co/t/visualisation-to-replay-user-session-journey/281052)
**Author:** [@Likewise](https://discuss.elastic.co/u/Likewise)\ **Replies:** 3\ **Last updated:** [August 21, 2021, 2:41am UTC](https://discuss.elastic.co/t/visualisation-to-replay-user-session-journey/281052 "2021-08-21T02:41:04Z")
Hi community! I am a complete newbie to ELK though have been using Discover for a few months to randomly investigate issues experienced by our end users. We currently use ELK to log most of the activity that happens on … --- ## [Master and slave using same index](https://discuss.elastic.co/t/master-and-slave-using-same-index/282084)
**Author:** [@selin](https://discuss.elastic.co/u/selin)\ **Replies:** 6\ **Last updated:** [August 21, 2021, 1:38am UTC](https://discuss.elastic.co/t/master-and-slave-using-same-index/282084 "2021-08-21T01:38:31Z")
I will use filebeat -\> logstash -\> Elasticsearch cluster I have 2 server filebeat installed. Can i use same index name for the 2 server? --- ## [Multiple "-module: auditd" stanzas in config file lead to problems](https://discuss.elastic.co/t/multiple-module-auditd-stanzas-in-config-file-lead-to-problems/282122)
**Author:** [@barely47](https://discuss.elastic.co/u/barely47)\ **Replies:** 0\ **Last updated:** [August 20, 2021, 11:02pm UTC](https://discuss.elastic.co/t/multiple-module-auditd-stanzas-in-config-file-lead-to-problems/282122 "2021-08-20T23:02:03Z")
A user of mine took a provided auditbeat.yml config file and converted it into something that included: - module: auditd enabled: true audit\_rules: "-a always,exit -F arch=b32 -S all -k 32bit-abi" user.det… --- ## [Filebeat Tokenizer Cisco Syslog Problem](https://discuss.elastic.co/t/filebeat-tokenizer-cisco-syslog-problem/282121)
**Author:** [@savethebyte](https://discuss.elastic.co/u/savethebyte)\ **Replies:** 0\ **Last updated:** [August 20, 2021, 10:05pm UTC](https://discuss.elastic.co/t/filebeat-tokenizer-cisco-syslog-problem/282121 "2021-08-20T22:05:09Z")
Hello!, I am receiving the following error when ingesting syslog messages with Filebeat (7.9.3): "error": { "message": "GoError: could not find delimiter: \`\` in remaining: \`\<160\>Aug 20 16:48:25 10.244.127.139 027… --- ## [Alerts dont match time on server](https://discuss.elastic.co/t/alerts-dont-match-time-on-server/281604)
**Author:** [@nwenner76](https://discuss.elastic.co/u/nwenner76)\ **Replies:** 2\ **Last updated:** [August 20, 2021, 9:49pm UTC](https://discuss.elastic.co/t/alerts-dont-match-time-on-server/281604 "2021-08-20T21:49:03Z")
Running Wazuh 7.10.02. Host, Wazuh, and Kibana show the right time, but when I get the alerts in my email, the body of the email shows the wrong time. Setup is all on the same server. All systems are in the same office… [Previous page](https://discuss.elastic.co/latest.md?page=1513) [Next page](https://discuss.elastic.co/latest.md?page=1515)