# Latest **URL:** https://discuss.elastic.co/latest.md?page=1543 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1544 --- ## [ILM Questions](https://discuss.elastic.co/t/ilm-questions/205298)
**Author:** [@Wayne\_Taylor](https://discuss.elastic.co/u/Wayne_Taylor)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 11:29pm UTC](https://discuss.elastic.co/t/ilm-questions/205298 "2021-08-03T23:29:52Z")
Hi Elastic Team, I know there is a lot of questions on ILM which encompasses both the Elasticsearch aspects as well as Kibana. Background: We use Fluentd for our log ingestion framework developed by our DevOps teams t… --- ## [ILM Error](https://discuss.elastic.co/t/ilm-error/192773)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 10\ **Last updated:** [August 3, 2021, 11:22pm UTC](https://discuss.elastic.co/t/ilm-error/192773 "2021-08-03T23:22:50Z")
Started getting the following error for multiple indices a few days ago, not just Winlogbeat indices. I'm running Elastic Stack 7.2.0, how do I resolve this? illegal\_argument\_exception: index.lifecycle.rollover\_alias \[… --- ## [Using ILM: error's on more then one write index](https://discuss.elastic.co/t/using-ilm-errors-on-more-then-one-write-index/272804)
**Author:** [@robbert](https://discuss.elastic.co/u/robbert)\ **Replies:** 3\ **Last updated:** [August 3, 2021, 11:15pm UTC](https://discuss.elastic.co/t/using-ilm-errors-on-more-then-one-write-index/272804 "2021-08-03T23:15:21Z")
Greetings, Currently i am in the process of migrating our ELK instance from manual index deletion to using ILM policy, however filebeat is sending logs to logstash but the following error is shown in the logs of logstas… --- ## [IllegalStateException: alias has more than one write index](https://discuss.elastic.co/t/illegalstateexception-alias-has-more-than-one-write-index/254065)
**Author:** [@exper0](https://discuss.elastic.co/u/exper0)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 11:08pm UTC](https://discuss.elastic.co/t/illegalstateexception-alias-has-more-than-one-write-index/254065 "2021-08-03T23:08:39Z")
Hello, I'm getting the same error on all ES data nodes saying that alias has more than one write index so none of data nodes can actually start, cluster is dead. Is there any way to fix the problem without deleting all … --- ## [ES fails to start with error index has more than one write index](https://discuss.elastic.co/t/es-fails-to-start-with-error-index-has-more-than-one-write-index/245828)
**Author:** [@Prashant\_Agrawal](https://discuss.elastic.co/u/Prashant_Agrawal)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 11:07pm UTC](https://discuss.elastic.co/t/es-fails-to-start-with-error-index-has-more-than-one-write-index/245828 "2021-08-03T23:07:20Z")
There was an ES cluster which was running for a while but suddenly docker got restarted and all nodes started to fail with below error: "stacktrace": \["org.elasticsearch.bootstrap.StartupException: java.lang.IllegalSta… --- ## [IllegalStateException: Alias has more than one write index](https://discuss.elastic.co/t/illegalstateexception-alias-has-more-than-one-write-index/210771)
**Author:** [@tami](https://discuss.elastic.co/u/tami)\ **Replies:** 3\ **Last updated:** [August 3, 2021, 11:05pm UTC](https://discuss.elastic.co/t/illegalstateexception-alias-has-more-than-one-write-index/210771 "2021-08-03T23:05:58Z")
We are running version 6.8.3 with a 3.2.2 (master.client.data) setup. Our cluster is currently in the reds state: curl -X GET '$HOST/\_cat/health' 1575572989 19:09:49 es-cluster-dogfood red 6 1 1050 1050 0 0 1116 0 - 48… --- ## [Vega-lite: Able to set href on text mark?](https://discuss.elastic.co/t/vega-lite-able-to-set-href-on-text-mark/280345)
**Author:** [@todd-symmetry](https://discuss.elastic.co/u/todd-symmetry)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 10:57pm UTC](https://discuss.elastic.co/t/vega-lite-able-to-set-href-on-text-mark/280345 "2021-08-03T22:57:37Z")
I'm using vega-lite in a self-hosted Kibana to create a basic visualization -- just a text mark that shows a number plus the title. The whole point of this is to make the text link to another dashboard. I'm having no suc… --- ## [Tanium Configuring Elasticsearch destinations](https://discuss.elastic.co/t/tanium-configuring-elasticsearch-destinations/280291)
**Author:** [@travlest](https://discuss.elastic.co/u/travlest)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 10:45pm UTC](https://discuss.elastic.co/t/tanium-configuring-elasticsearch-destinations/280291 "2021-08-03T22:45:02Z")
Hi, I am new to ELK. I have deployed an ELK stack with Filebeat. Right now I would like to connect my ELK to Tanium using this documentation tanium. But I am encountering this error. I tried to find the solutions onl… --- ## [Http input plugin, url with param from field](https://discuss.elastic.co/t/http-input-plugin-url-with-param-from-field/280365)
**Author:** [@cibernicola](https://discuss.elastic.co/u/cibernicola)\ **Replies:** 6\ **Last updated:** [August 3, 2021, 10:32pm UTC](https://discuss.elastic.co/t/http-input-plugin-url-with-param-from-field/280365 "2021-08-03T22:32:25Z")
I have a standard logstash config, where I store several fields form a log. With one field I need to "ask something" to an external API with an specific url pattern, which is: staticString+variableField+staticString S… --- ## [Resolve one of the index in cluster is with Yellow status](https://discuss.elastic.co/t/resolve-one-of-the-index-in-cluster-is-with-yellow-status/280274)
**Author:** [@SabirPiludiya](https://discuss.elastic.co/u/SabirPiludiya)\ **Replies:** 3\ **Last updated:** [August 3, 2021, 9:24pm UTC](https://discuss.elastic.co/t/resolve-one-of-the-index-in-cluster-is-with-yellow-status/280274 "2021-08-03T21:24:15Z")
We are running HA Elasticsearch in k8s. Recently we found one of the indexes in the Yellow status due to Unassigned shards which leads the whole cluster state to yellow. Shard of that index status in NODE-A is STARTED a… --- ## [Put the x bar at the top](https://discuss.elastic.co/t/put-the-x-bar-at-the-top/279700)
**Author:** [@Lisouu\_13](https://discuss.elastic.co/u/Lisouu_13)\ **Replies:** 5\ **Last updated:** [August 3, 2021, 9:06pm UTC](https://discuss.elastic.co/t/put-the-x-bar-at-the-top/279700 "2021-08-03T21:06:20Z")
Hello hello, is it possible to do something like that in kibana 7.13, and if so, how to do please ? --- ## [Multiple Sql Server DB mapping with Elasticsearch Index for data transfer using Logstash](https://discuss.elastic.co/t/multiple-sql-server-db-mapping-with-elasticsearch-index-for-data-transfer-using-logstash/280364)
**Author:** [@vikashmarwal](https://discuss.elastic.co/u/vikashmarwal)\ **Replies:** 0\ **Last updated:** [August 3, 2021, 7:52pm UTC](https://discuss.elastic.co/t/multiple-sql-server-db-mapping-with-elasticsearch-index-for-data-transfer-using-logstash/280364 "2021-08-03T19:52:30Z")
We are having multiple databases in SQL Server, those are created dynamically for specific workspace. In these databases we have a DocumentDetail table. If there is one DB then I am able to map it in config to transfer t… --- ## [Restore from snapshot fails with no recovery information](https://discuss.elastic.co/t/restore-from-snapshot-fails-with-no-recovery-information/280355)
**Author:** [@bill\_d](https://discuss.elastic.co/u/bill_d)\ **Replies:** 2\ **Last updated:** [August 3, 2021, 7:43pm UTC](https://discuss.elastic.co/t/restore-from-snapshot-fails-with-no-recovery-information/280355 "2021-08-03T19:43:25Z")
I have 2 similarly configured 3 node elasticsearch clusters. Both run 7.10.2, but one is bigger than the other. I'm trying to restore an index from a snapshot. In the small cluster, the restore takes about 3 minutes, … --- ## [Logstash write to json no comma separator](https://discuss.elastic.co/t/logstash-write-to-json-no-comma-separator/280302)
**Author:** [@Hamza\_El\_Aouane](https://discuss.elastic.co/u/Hamza_El_Aouane)\ **Replies:** 3\ **Last updated:** [August 3, 2021, 7:18pm UTC](https://discuss.elastic.co/t/logstash-write-to-json-no-comma-separator/280302 "2021-08-03T19:18:57Z")
Hello everyone. I am saving my logstash events to a json file as follow: file { path =\> "path\\event-%{+yyyy.MM.dd}.json" codec =\> json everything is fine, until today that I realised that the file is not form… --- ## [Fetching listing failed](https://discuss.elastic.co/t/fetching-listing-failed/280283)
**Author:** [@Prasanth\_V](https://discuss.elastic.co/u/Prasanth_V)\ **Replies:** 2\ **Last updated:** [August 3, 2021, 7:08pm UTC](https://discuss.elastic.co/t/fetching-listing-failed/280283 "2021-08-03T19:08:52Z")
Could you pls suggest on below error?.. --- ## [Unable to see file system metrics in kibana even the data present](https://discuss.elastic.co/t/unable-to-see-file-system-metrics-in-kibana-even-the-data-present/280253)
**Author:** [@shan1](https://discuss.elastic.co/u/shan1)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 7:06pm UTC](https://discuss.elastic.co/t/unable-to-see-file-system-metrics-in-kibana-even-the-data-present/280253 "2021-08-03T19:06:24Z")
There is file system data present in indexes but not showing up in dashboard when we query. Except filesystem metrics it's fetching all metrics like cpu, memory and IOps. Please provide some suggestion --- ## [Elastic Cloud Trial Unable to remove greyed out Agent](https://discuss.elastic.co/t/elastic-cloud-trial-unable-to-remove-greyed-out-agent/279666)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 4\ **Last updated:** [August 3, 2021, 7:04pm UTC](https://discuss.elastic.co/t/elastic-cloud-trial-unable-to-remove-greyed-out-agent/279666 "2021-08-03T19:04:13Z")
Hello, Playing around with Elastic Cloud trial and noticed I have an Agent in Fleet which I cannot remove: The offline agent seems to remain unselectable and offline. How can I remove it? Grtz Willem --- ## [How can I avoid alerts for an instance of a rule in advance?](https://discuss.elastic.co/t/how-can-i-avoid-alerts-for-an-instance-of-a-rule-in-advance/280231)
**Author:** [@norgro2601](https://discuss.elastic.co/u/norgro2601)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 7:02pm UTC](https://discuss.elastic.co/t/how-can-i-avoid-alerts-for-an-instance-of-a-rule-in-advance/280231 "2021-08-03T19:02:57Z")
Hi, I have rules that run and create an alert for several hosts. When there is a planned maintenance window, I cannot mute the rule for one alert/instance, because the alert instance for that host is only visible when t… --- ## [Alerts - Kibana vs Watcher - Elasticsearch](https://discuss.elastic.co/t/alerts-kibana-vs-watcher-elasticsearch/280311)
**Author:** [@GavinBeattie](https://discuss.elastic.co/u/GavinBeattie)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 7:02pm UTC](https://discuss.elastic.co/t/alerts-kibana-vs-watcher-elasticsearch/280311 "2021-08-03T19:02:21Z")
In the Alerts connector options for email, is there a way to use the same inbuilt email account options e.g. noreply@watcheralert.found.io? We are using the hosted Elasticsearch environment. --- ## [Vega - show Gantt](https://discuss.elastic.co/t/vega-show-gantt/280212)
**Author:** [@Guy\_Levinhr](https://discuss.elastic.co/u/Guy_Levinhr)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 6:55pm UTC](https://discuss.elastic.co/t/vega-show-gantt/280212 "2021-08-03T18:55:59Z")
Hii, I have index with data and I want to show the data as Gantt. The data contains : session\_id - Unique Id for the session date\_created/time - When the session start (same for all the rows of the session) … --- ## [How to pass data to custom plugin in Kibana](https://discuss.elastic.co/t/how-to-pass-data-to-custom-plugin-in-kibana/280139)
**Author:** [@aza-zil](https://discuss.elastic.co/u/aza-zil)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 6:50pm UTC](https://discuss.elastic.co/t/how-to-pass-data-to-custom-plugin-in-kibana/280139 "2021-08-03T18:50:13Z")
I created a new plugin. on a button click, I want to redirect to the plugin page, I did that by doing the following: const urlToplugin= "/app/myScheduler"; window.location.href = urlToplugin , but I want to pass some d… --- ## [Extend Wazuh OVA storage](https://discuss.elastic.co/t/extend-wazuh-ova-storage/280085)
**Author:** [@Barry\_Dupont](https://discuss.elastic.co/u/Barry_Dupont)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 6:42pm UTC](https://discuss.elastic.co/t/extend-wazuh-ova-storage/280085 "2021-08-03T18:42:26Z")
I was wondering what is the proper way to extend VM storage(40Gb): I already have a root partition under "/". can i extend this partition or should i add a new partition and mount than just change log file path in elast… --- ## [Index templates](https://discuss.elastic.co/t/index-templates/279952)
**Author:** [@ailengcon](https://discuss.elastic.co/u/ailengcon)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 6:35pm UTC](https://discuss.elastic.co/t/index-templates/279952 "2021-08-03T18:35:25Z")
When I ingest my index from MongoDb via monstache, the indexing is causing some of the documents not being indexed because it can't map the fields right. I have being trying (for days) to figure out the index template o… --- ## [Watcher - CSV URL](https://discuss.elastic.co/t/watcher-csv-url/279890)
**Author:** [@Soren\_vdc](https://discuss.elastic.co/u/Soren_vdc)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 6:31pm UTC](https://discuss.elastic.co/t/watcher-csv-url/279890 "2021-08-03T18:31:02Z")
Hi, I want to add an attachment to email with watcher. When I used the "saved object" in discover and then "share" =\> "copy POST URL" .. this URL is not working. I receive parsing exception. Any idea what may cause thi… --- ## [Issue with Automatic CSV Report Generation from Kibana 7.13.4](https://discuss.elastic.co/t/issue-with-automatic-csv-report-generation-from-kibana-7-13-4/279827)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 6:28pm UTC](https://discuss.elastic.co/t/issue-with-automatic-csv-report-generation-from-kibana-7-13-4/279827 "2021-08-03T18:28:53Z")
Hi, In earlier version of kibana I used to decode and encode the post url from Kibana discover tab to change the timestamp to gte: "now-24h" lte: "now" in the url to fetch last 24 hours of data while auto generating the… --- ## [Metadata to be displayed on graph and show all x-axis values](https://discuss.elastic.co/t/metadata-to-be-displayed-on-graph-and-show-all-x-axis-values/279750)
**Author:** [@parinitha.nagaraja](https://discuss.elastic.co/u/parinitha.nagaraja)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 6:24pm UTC](https://discuss.elastic.co/t/metadata-to-be-displayed-on-graph-and-show-all-x-axis-values/279750 "2021-08-03T18:24:32Z")
Hello, How do I add metadata so that it can be seen to the user just by looking at the chart. For example, I want to be able to show version number associated with each build number. (see graph) Also, how can I adj… --- ## [Node Performance - Disable Instrumentation by Function?](https://discuss.elastic.co/t/node-performance-disable-instrumentation-by-function/278179)
**Author:** [@kris3](https://discuss.elastic.co/u/kris3)\ **Replies:** 2\ **Last updated:** [August 3, 2021, 6:22pm UTC](https://discuss.elastic.co/t/node-performance-disable-instrumentation-by-function/278179 "2021-08-03T18:22:37Z")
Hello, We have a Node application instrumented w/ the Elastic APM library and configured to send data to an Elastic Cloud deployment. This has been working just fine for months. Recently, a change was made to our appl… --- ## [Capture Body to Hapi Js](https://discuss.elastic.co/t/capture-body-to-hapi-js/278450)
**Author:** [@guimap](https://discuss.elastic.co/u/guimap)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 6:16pm UTC](https://discuss.elastic.co/t/capture-body-to-hapi-js/278450 "2021-08-03T18:16:03Z")
Hi :slight\_smile: I'm using nodejs agent with hapi framework, i set up captureBody option into config, even with this option enabled my http requests doesnt store payload, after read some issues related with this errors… --- ## [Logstash: добавить новое поле "response\_delay" к логу со значением, где значение - это разница времени ответа и запроса из сообщения лога](https://discuss.elastic.co/t/logstash-response-delay/280336)
**Author:** [@cva](https://discuss.elastic.co/u/cva)\ **Replies:** 2\ **Last updated:** [August 3, 2021, 6:04pm UTC](https://discuss.elastic.co/t/logstash-response-delay/280336 "2021-08-03T18:04:09Z")
Логи собираются при помощи filebeat multiline, далее отправляются в logstash. Как мне "распарсить" сообщение лога, чтобы получить дату запроса (2021-08-03 10:54:36.4512|INFO|logfile|Запрос:slight\_smile: и ответа (2021-08… --- ## [Possible to have elastic security read existing data/index?](https://discuss.elastic.co/t/possible-to-have-elastic-security-read-existing-data-index/280018)
**Author:** [@rconroy](https://discuss.elastic.co/u/rconroy)\ **Replies:** 7\ **Last updated:** [August 3, 2021, 5:39pm UTC](https://discuss.elastic.co/t/possible-to-have-elastic-security-read-existing-data-index/280018 "2021-08-03T17:39:29Z")
I have what is possibly an odd question but I'm new with elastic security/siem and thought I would ask. Is it possible to have the elastic security read a different data stream or ingestion other than the agents? For e… [Previous page](https://discuss.elastic.co/latest.md?page=1542) [Next page](https://discuss.elastic.co/latest.md?page=1544)