# Latest **URL:** https://discuss.elastic.co/latest.md?page=1593 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1594 --- ## [Logstash problems with fields (Point to Point)](https://discuss.elastic.co/t/logstash-problems-with-fields-point-to-point/277196)
**Author:** [@Michael\_Dylan\_McAloo](https://discuss.elastic.co/u/Michael_Dylan_McAloo)\ **Replies:** 2\ **Last updated:** [July 1, 2021, 11:23am UTC](https://discuss.elastic.co/t/logstash-problems-with-fields-point-to-point/277196 "2021-07-01T11:23:29Z")
I have a problem, I have two IPs one source and one destination, for the source IP Logstash automatically creates a field called "geoip.location" that contains the latitude and longitude of the specific IP, but for the d… --- ## [Hide time interval text](https://discuss.elastic.co/t/hide-time-interval-text/277431)
**Author:** [@Mik\_a](https://discuss.elastic.co/u/Mik_a)\ **Replies:** 8\ **Last updated:** [July 1, 2021, 11:19am UTC](https://discuss.elastic.co/t/hide-time-interval-text/277431 "2021-07-01T11:19:27Z")
I want to have a table showing the created at date for the data and would like to customize the text for the time interval. How do I hide the "per week", "per month" and so on? I want to only show the label --- ## [Tomcat logs in filebeat](https://discuss.elastic.co/t/tomcat-logs-in-filebeat/277313)
**Author:** [@Prasanth\_V](https://discuss.elastic.co/u/Prasanth_V)\ **Replies:** 5\ **Last updated:** [July 1, 2021, 11:03am UTC](https://discuss.elastic.co/t/tomcat-logs-in-filebeat/277313 "2021-07-01T11:03:26Z")
If I add a tomcat log paths in tomcat.yml..why is it not showing in discover section..could you pls give the solution on this case?? --- ## [Kibana multiple conditions not working](https://discuss.elastic.co/t/kibana-multiple-conditions-not-working/277539)
**Author:** [@PatrikM](https://discuss.elastic.co/u/PatrikM)\ **Replies:** 0\ **Last updated:** [July 1, 2021, 10:25am UTC](https://discuss.elastic.co/t/kibana-multiple-conditions-not-working/277539 "2021-07-01T10:25:56Z")
My Kibana version is 7.9.3 Every 60 seconds I'm sending data to elasticsearch. I can see those logs in the observability log section and the series of logs that should trigger the alert, but when I create the alert it … --- ## [Query\_string with "fields" option behaves unexpectedly](https://discuss.elastic.co/t/query-string-with-fields-option-behaves-unexpectedly/277529)
**Author:** [@andreas123](https://discuss.elastic.co/u/andreas123)\ **Replies:** 1\ **Last updated:** [July 1, 2021, 10:30am UTC](https://discuss.elastic.co/t/query-string-with-fields-option-behaves-unexpectedly/277529 "2021-07-01T10:30:26Z")
Hey, i would like to understand why my search query behaves that unexpectedly. I have an index with 3 docs: { "\_index" : "test\_index", "\_type" : "\_doc", "\_id" : "2", "\_score" : 1.0, … --- ## [Index not deleting according ilm policy](https://discuss.elastic.co/t/index-not-deleting-according-ilm-policy/276265)
**Author:** [@vikramdayma](https://discuss.elastic.co/u/vikramdayma)\ **Replies:** 11\ **Last updated:** [July 1, 2021, 10:30am UTC](https://discuss.elastic.co/t/index-not-deleting-according-ilm-policy/276265 "2021-07-01T10:30:04Z")
Hi, I created an ILM policy and applied to system index (.monitoring-es-7-2021.06.10). But index is not deleting after ILM time. It is showing error. illegal\_argument\_exception: setting \[index.lifecycle.rollover\_alia… --- ## [Flatten Array in Ingest Pipeline with Painless](https://discuss.elastic.co/t/flatten-array-in-ingest-pipeline-with-painless/277383)
**Author:** [@nicjp](https://discuss.elastic.co/u/nicjp)\ **Replies:** 2\ **Last updated:** [July 1, 2021, 10:15am UTC](https://discuss.elastic.co/t/flatten-array-in-ingest-pipeline-with-painless/277383 "2021-07-01T10:15:58Z")
Hi all, I'm working on getting some logs onboarded and I'm having an issue with a field that contains Key/Values inside an array. (For reference please see below) { "redis\_cache\_read\_bytes": 741, "format": "json", … --- ## [\[Auditbeat\] Monitoring of files/folders with a space in the path not possible](https://discuss.elastic.co/t/auditbeat-monitoring-of-files-folders-with-a-space-in-the-path-not-possible/277537)
**Author:** [@SECUINFRA](https://discuss.elastic.co/u/SECUINFRA)\ **Replies:** 0\ **Last updated:** [July 1, 2021, 10:10am UTC](https://discuss.elastic.co/t/auditbeat-monitoring-of-files-folders-with-a-space-in-the-path-not-possible/277537 "2021-07-01T10:10:25Z")
Hi, the monitoring of files/folders with a space in the path was not possible using auditbeat (version 7.13): The following rules all resulted in errors: -w /tmp/folder with space -p r -k test1 -w "/tmp/folder with sp… --- ## [K8S topology for deploying ECK and ELK components](https://discuss.elastic.co/t/k8s-topology-for-deploying-eck-and-elk-components/277295)
**Author:** [@aksh\_18](https://discuss.elastic.co/u/aksh_18)\ **Replies:** 3\ **Last updated:** [July 1, 2021, 9:32am UTC](https://discuss.elastic.co/t/k8s-topology-for-deploying-eck-and-elk-components/277295 "2021-07-01T09:32:37Z")
Hi Team, I want to install ECK on K8s cluster with 2 elasticsearch nodes and 1 deployement of kibana, apm-server and logstash. I have 3 node K8s cluster with all nodes having "Node" as a role. Do I need to define node t… --- ## [Why we need index template?](https://discuss.elastic.co/t/why-we-need-index-template/277523)
**Author:** [@Nisha2297](https://discuss.elastic.co/u/Nisha2297)\ **Replies:** 6\ **Last updated:** [July 1, 2021, 9:26am UTC](https://discuss.elastic.co/t/why-we-need-index-template/277523 "2021-07-01T09:26:51Z")
Why we need to create index template when we can simply define the fields and there datatype in the logstash itself using below syntax: mutate {convert =\> \["field\_name", "data\_type"\] --- ## [Unusual Process For a Windows Host (rare\_process\_by\_host\_windows\_ecs)](https://discuss.elastic.co/t/unusual-process-for-a-windows-host-rare-process-by-host-windows-ecs/277078)
**Author:** [@ARDiver86](https://discuss.elastic.co/u/ARDiver86)\ **Replies:** 4\ **Last updated:** [July 1, 2021, 8:18am UTC](https://discuss.elastic.co/t/unusual-process-for-a-windows-host-rare-process-by-host-windows-ecs/277078 "2021-07-01T08:18:23Z")
This job appears to be looking at a list of process create events to determine if a process is new or existed previously. The issue I think we are having is it is alerting us on a lot of processes that existed previously… --- ## [Kibana advanced search split by](https://discuss.elastic.co/t/kibana-advanced-search-split-by/277473)
**Author:** [@Alex112345](https://discuss.elastic.co/u/Alex112345)\ **Replies:** 2\ **Last updated:** [July 1, 2021, 7:42am UTC](https://discuss.elastic.co/t/kibana-advanced-search-split-by/277473 "2021-07-01T07:42:12Z")
Hi all, I'm quite new to Elastic & Kibana. I've used Splunk in the past and I was wondering if someone could point me in the right direction to do something as below Let's say we have an indexed field called users. The… --- ## [Config Error 403: "error":{"message":"blocked by: \[FORBIDDEN/8/index write (api)\];: \[cluster\_block\_exception\] blocked by: \[FORBIDDEN/8/index write (api)\];","name":"Error","stack":"\[cluster\_block\_exception\] blocked by: \[FORBIDDEN/8/index write (api)\]](https://discuss.elastic.co/t/config-error-403-error-message-blocked-by-forbidden-8-index-write-api-cluster-block-exception-blocked-by-forbidden-8-index-write-api-name-error-stack-cluster-block-exception-blocked-by-forbidden-8-index-write-api/277512)
**Author:** [@Ashish\_Manjrekar](https://discuss.elastic.co/u/Ashish_Manjrekar)\ **Replies:** 2\ **Last updated:** [July 1, 2021, 7:31am UTC](https://discuss.elastic.co/t/config-error-403-error-message-blocked-by-forbidden-8-index-write-api-cluster-block-exception-blocked-by-forbidden-8-index-write-api-name-error-stack-cluster-block-exception-blocked-by-forbidden-8-index-write-api/277512 "2021-07-01T07:31:58Z")
Can someone help me understand the below issue. Also, if any resolution available. {"type":"error","@timestamp":"2021-04-25T01:41:28Z","tags":,"pid":3076,"level":"error","error":{"message":"blocked by: \[FORBIDDEN/8/inde… --- ## [Resolved attribute is missing ... but is not!](https://discuss.elastic.co/t/resolved-attribute-is-missing-but-is-not/277510)
**Author:** [@priamai](https://discuss.elastic.co/u/priamai)\ **Replies:** 1\ **Last updated:** [July 1, 2021, 6:07am UTC](https://discuss.elastic.co/t/resolved-attribute-is-missing-but-is-not/277510 "2021-07-01T06:07:53Z")
I am on ELK 7.13.0 with the Hadoop 7.13.0 library. I have the following schema: root |-- @timestamp: timestamp (nullable = true) |-- AuthenticationPackage: string (nullable = true) |-- Destination: string (nullable … --- ## [Monitoring API query](https://discuss.elastic.co/t/monitoring-api-query/277200)
**Author:** [@priamai](https://discuss.elastic.co/u/priamai)\ **Replies:** 3\ **Last updated:** [July 1, 2021, 5:30am UTC](https://discuss.elastic.co/t/monitoring-api-query/277200 "2021-07-01T05:30:31Z")
Hi there, I am with ELK 7.13.0 the basic free licence. Is there a way to monitor the queries that are performed via the Elastic API? Even to keep the last N most recent ones for example. I basically have different pyt… --- ## [Kibana dashboard shards failed](https://discuss.elastic.co/t/kibana-dashboard-shards-failed/277285)
**Author:** [@Amudhan\_P](https://discuss.elastic.co/u/Amudhan_P)\ **Replies:** 5\ **Last updated:** [July 1, 2021, 5:28am UTC](https://discuss.elastic.co/t/kibana-dashboard-shards-failed/277285 "2021-07-01T05:28:25Z")
Hi, I am running an ELK cluster in Elastic.io I am having a problem in Kibana, visualization it's showing shards failed. Visualization is been configured to show a field from my APM data. I don't find any error msg fr… --- ## [Unable to install kibana-plugin](https://discuss.elastic.co/t/unable-to-install-kibana-plugin/277304)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 4\ **Last updated:** [July 1, 2021, 5:27am UTC](https://discuss.elastic.co/t/unable-to-install-kibana-plugin/277304 "2021-07-01T05:27:28Z")
Hello team, I am unable to install kibana plugin on my local. Can you please help me on this OS: Windows Kiban Version: 7.9 Below is the error: PS C:\\WINDOWS\\system32\> cd C:\\Users\\mangeshsuresh.jadhav\\Downloads\\EKL\\… --- ## [Logstash not listening to 5044](https://discuss.elastic.co/t/logstash-not-listening-to-5044/277432)
**Author:** [@azid](https://discuss.elastic.co/u/azid)\ **Replies:** 2\ **Last updated:** [July 1, 2021, 4:21am UTC](https://discuss.elastic.co/t/logstash-not-listening-to-5044/277432 "2021-07-01T04:21:54Z")
Hi Im new to ELK, when I try to transfert data filebeat -\>logstash I got my logstash not listening to port 5044 any help would be appreciated Pipeline : input { beats { port =\> 5044 } } filter { gro… --- ## [Max number of shard a elastic node can hold](https://discuss.elastic.co/t/max-number-of-shard-a-elastic-node-can-hold/277434)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 5\ **Last updated:** [July 1, 2021, 4:17am UTC](https://discuss.elastic.co/t/max-number-of-shard-a-elastic-node-can-hold/277434 "2021-07-01T04:17:59Z")
Hi all What is the max number of shard that an elastic node can hold. and i dont mean per index or anything i mean the max number of shard for all index that a node can hold. --- ## [Jdbc\_static prepared statement error](https://discuss.elastic.co/t/jdbc-static-prepared-statement-error/277507)
**Author:** [@metalshanked](https://discuss.elastic.co/u/metalshanked)\ **Replies:** 0\ **Last updated:** [July 1, 2021, 3:37am UTC](https://discuss.elastic.co/t/jdbc-static-prepared-statement-error/277507 "2021-07-01T03:37:51Z")
Hello, I have the below jdbc\_static lookup statement but it seems to fail with the error:- exception=\>#\,… --- ## [Elasticsearch is down and data are messing, how to recover it!](https://discuss.elastic.co/t/elasticsearch-is-down-and-data-are-messing-how-to-recover-it/277202)
**Author:** [@bab](https://discuss.elastic.co/u/bab)\ **Replies:** 3\ **Last updated:** [July 1, 2021, 2:06am UTC](https://discuss.elastic.co/t/elasticsearch-is-down-and-data-are-messing-how-to-recover-it/277202 "2021-07-01T02:06:31Z")
Hey, how can I recover data that I lost while my Elasticsearch was down. see the screen below. thank you. --- ## [Add date math support in index-pattern for rollup job](https://discuss.elastic.co/t/add-date-math-support-in-index-pattern-for-rollup-job/277321)
**Author:** [@wangqinghuan](https://discuss.elastic.co/u/wangqinghuan)\ **Replies:** 0\ **Last updated:** [June 29, 2021, 8:31am UTC](https://discuss.elastic.co/t/add-date-math-support-in-index-pattern-for-rollup-job/277321 "2021-06-29T08:31:37Z")
Currently, we can specify index-pattern to match a series of daily indices when create a rollup job. However, when a lot of indices exists in Elasticsearch, rollup job will scan all exists indices to filter data although… --- ## [Delete Index from Cluster State](https://discuss.elastic.co/t/delete-index-from-cluster-state/277343)
**Author:** [@daksh0225](https://discuss.elastic.co/u/daksh0225)\ **Replies:** 1\ **Last updated:** [July 1, 2021, 2:02am UTC](https://discuss.elastic.co/t/delete-index-from-cluster-state/277343 "2021-07-01T02:02:05Z")
Hello!! I am trying to ensure that indices created during testing do not persist in elasticsearch when it is restarted. To achieve this, I have modiifed the doStop() function of IndicesService in the following manner: … --- ## [Elasticsearch heap Memory WARNING in elk docker](https://discuss.elastic.co/t/elasticsearch-heap-memory-warning-in-elk-docker/277419)
**Author:** [@ranu\_shekhar](https://discuss.elastic.co/u/ranu_shekhar)\ **Replies:** 4\ **Last updated:** [July 1, 2021, 1:53am UTC](https://discuss.elastic.co/t/elasticsearch-heap-memory-warning-in-elk-docker/277419 "2021-07-01T01:53:15Z")
Hi, I am using elasticsearch 7.10.0. I have 3 nodes in my cluster. But in one of the node among 3, we are receiving given below warning logs: \*\*{"type": "server", "timestamp": "2021-06-30T04:01:53,805Z", "level": "WAR… --- ## [Removing subfield in the elasticsearch output display](https://discuss.elastic.co/t/removing-subfield-in-the-elasticsearch-output-display/277494)
**Author:** [@gisellecarballo](https://discuss.elastic.co/u/gisellecarballo)\ **Replies:** 3\ **Last updated:** [July 1, 2021, 1:25am UTC](https://discuss.elastic.co/t/removing-subfield-in-the-elasticsearch-output-display/277494 "2021-07-01T01:25:13Z")
Hi, Anyone knows how to remove the subfield alone in the elasticsearch display output. In the output there are fields "host: 192.x.x.x" "host.keyword: 192.x.x.x" I want to remove the host.keyword field. Current filter… --- ## [Loop throught context (ctx) data model result at action template in SLACK text field](https://discuss.elastic.co/t/loop-throught-context-ctx-data-model-result-at-action-template-in-slack-text-field/277406)
**Author:** [@Tania\_Raquel\_Stormov](https://discuss.elastic.co/u/Tania_Raquel_Stormov)\ **Replies:** 0\ **Last updated:** [June 30, 2021, 4:31am UTC](https://discuss.elastic.co/t/loop-throught-context-ctx-data-model-result-at-action-template-in-slack-text-field/277406 "2021-06-30T04:31:27Z")
How can loop over array result when integrate with slack using message template? At kibana monitor to over an array example: {{#ctx.results.0.hits.hits}} // Loop over hits {{\_source.message}} {{\_source.module\_nam… --- ## [Why query works in DevTools but not in a Rule?](https://discuss.elastic.co/t/why-query-works-in-devtools-but-not-in-a-rule/277467)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 3\ **Last updated:** [July 1, 2021, 12:20am UTC](https://discuss.elastic.co/t/why-query-works-in-devtools-but-not-in-a-rule/277467 "2021-07-01T00:20:16Z")
Dear all =) Here is an odd one! If I in Dev Tools do GET \_search { "query": { "query\_string": { "query": "besked:\*" } } } then I get lots of results. If I do the same in a rule, I don't get any results. Are extra… --- ## [Can the rest client be on a lower version than the elastic searver](https://discuss.elastic.co/t/can-the-rest-client-be-on-a-lower-version-than-the-elastic-searver/277501)
**Author:** [@reddroid](https://discuss.elastic.co/u/reddroid)\ **Replies:** 1\ **Last updated:** [June 30, 2021, 11:55pm UTC](https://discuss.elastic.co/t/can-the-rest-client-be-on-a-lower-version-than-the-elastic-searver/277501 "2021-06-30T23:55:11Z")
Hi , Can I use elastic client 7.10 with elastic server 7.10.2 ? --- ## [Search query "5G", returns not results but "5G(space and other key)" shows results](https://discuss.elastic.co/t/search-query-5g-returns-not-results-but-5g-space-and-other-key-shows-results/277387)
**Author:** [@DavidT\_Spark](https://discuss.elastic.co/u/DavidT_Spark)\ **Replies:** 3\ **Last updated:** [June 30, 2021, 9:40pm UTC](https://discuss.elastic.co/t/search-query-5g-returns-not-results-but-5g-space-and-other-key-shows-results/277387 "2021-06-30T21:40:30Z")
Hi, We have a search query "5g", which returns no results on the website, however, the results are showing on the Swiftype dashboard and are not being pulled through. In addition, if we add any character or key at the … --- ## [Metricbeat error fetching kube-state-metrics](https://discuss.elastic.co/t/metricbeat-error-fetching-kube-state-metrics/277493)
**Author:** [@anupshrestha](https://discuss.elastic.co/u/anupshrestha)\ **Replies:** 0\ **Last updated:** [June 30, 2021, 7:31pm UTC](https://discuss.elastic.co/t/metricbeat-error-fetching-kube-state-metrics/277493 "2021-06-30T19:31:42Z")
I am getting the following error in metricbeat deployment that is configured to fetch and push metrics from kube-state-metrics. 2021-06-30T19:25:11.318Z ERROR \[kubernetes.state\_statefulset\] state\_statefulset/state\_state… [Previous page](https://discuss.elastic.co/latest.md?page=1592) [Next page](https://discuss.elastic.co/latest.md?page=1594)