# Latest **URL:** https://discuss.elastic.co/latest.md?page=1607 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1608 --- ## [Close Detection Alerts After Adding Exceptions - \`winlog.event\_data\`](https://discuss.elastic.co/t/close-detection-alerts-after-adding-exceptions-winlog-event-data/276788)
**Author:** [@inf](https://discuss.elastic.co/u/inf)\ **Replies:** 0\ **Last updated:** [June 23, 2021, 12:33pm UTC](https://discuss.elastic.co/t/close-detection-alerts-after-adding-exceptions-winlog-event-data/276788 "2021-06-23T12:33:27Z")
Hi there, I am looking to see if it there are plans to close detection alerts after adding exceptions (while the detection alert is still open) - specifically for my use-case below? My initial thought was to filter for… --- ## [What causes the count function to return an empty result](https://discuss.elastic.co/t/what-causes-the-count-function-to-return-an-empty-result/276613)
**Author:** [@RhodesOfficial](https://discuss.elastic.co/u/RhodesOfficial)\ **Replies:** 9\ **Last updated:** [June 23, 2021, 12:33pm UTC](https://discuss.elastic.co/t/what-causes-the-count-function-to-return-an-empty-result/276613 "2021-06-23T12:33:08Z")
I have a complex query statement（some data were desensitized）, but count (1) returns an empty result. NPE occurs in my code. So what causes this result？ Thank you for answering my question！ --- ## [After reindex, new index has same documents but data size is much less](https://discuss.elastic.co/t/after-reindex-new-index-has-same-documents-but-data-size-is-much-less/276768)
**Author:** [@Rosita\_Andrade](https://discuss.elastic.co/u/Rosita_Andrade)\ **Replies:** 3\ **Last updated:** [June 23, 2021, 12:06pm UTC](https://discuss.elastic.co/t/after-reindex-new-index-has-same-documents-but-data-size-is-much-less/276768 "2021-06-23T12:06:41Z")
Hi, This seems to be a similar case as After reindex, new index has same documents but data size is much less. I used the Reindex API and my new index is significantly smaller in size. I have a feeling, that it might b… --- ## [Multi fields, multi prefixes search](https://discuss.elastic.co/t/multi-fields-multi-prefixes-search/276504)
**Author:** [@janlmpn](https://discuss.elastic.co/u/janlmpn)\ **Replies:** 3\ **Last updated:** [June 23, 2021, 11:49am UTC](https://discuss.elastic.co/t/multi-fields-multi-prefixes-search/276504 "2021-06-23T11:49:01Z")
Hello All, hope someone can enlighten me on this one. Suppose I have the following data: { "index": { "\_index": "courses\_test", "\_id": 1 } } { "Course Name": "Bachelor of Arts in Music", "Job Role": "Theatre & Media Dir… --- ## [Adding Threat Intel fields in Elasticsearch data](https://discuss.elastic.co/t/adding-threat-intel-fields-in-elasticsearch-data/276782)
**Author:** [@Naveen\_Kumar\_Reddy\_S](https://discuss.elastic.co/u/Naveen_Kumar_Reddy_S)\ **Replies:** 0\ **Last updated:** [June 23, 2021, 11:25am UTC](https://discuss.elastic.co/t/adding-threat-intel-fields-in-elasticsearch-data/276782 "2021-06-23T11:25:15Z")
How we can add threat intel data for elastic agent logs before they are entering into the Elasticsearch cluster? I am trying to add some new fields to each log before based on the details present in that logs. Example:… --- ## [How do I include the date and image without markdown](https://discuss.elastic.co/t/how-do-i-include-the-date-and-image-without-markdown/276142)
**Author:** [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\ **Replies:** 2\ **Last updated:** [June 23, 2021, 11:11am UTC](https://discuss.elastic.co/t/how-do-i-include-the-date-and-image-without-markdown/276142 "2021-06-23T11:11:42Z")
I need that when I make a filter on the date what is written in the markdown appears with this information, and I would also like to include a logo. follow image --- ## [Elastic Agent vs Fluentd/Fluentbit](https://discuss.elastic.co/t/elastic-agent-vs-fluentd-fluentbit/276762)
**Author:** [@CyberWarriorBob](https://discuss.elastic.co/u/CyberWarriorBob)\ **Replies:** 0\ **Last updated:** [June 23, 2021, 9:31am UTC](https://discuss.elastic.co/t/elastic-agent-vs-fluentd-fluentbit/276762 "2021-06-23T09:31:23Z")
I am unsure if this is the right platform to ask this, but here it goes - I am trying to find out what are the differences between Elastic Agent and Fluentd/Fluentbit, I am trying to find out also if it worth the change… --- ## [Exporting snapshot for security and hot backup](https://discuss.elastic.co/t/exporting-snapshot-for-security-and-hot-backup/276767)
**Author:** [@Bibas](https://discuss.elastic.co/u/Bibas)\ **Replies:** 2\ **Last updated:** [June 23, 2021, 10:14am UTC](https://discuss.elastic.co/t/exporting-snapshot-for-security-and-hot-backup/276767 "2021-06-23T10:14:49Z")
Hello ! I have 2 question : I know that snapshot and restore is the best way to backup an elasticsearch cluster, but since my ES is running inside a docker container which have a named volume, is it possible to back… --- ## [Configure Logstash stdout](https://discuss.elastic.co/t/configure-logstash-stdout/276774)
**Author:** [@Atesrin](https://discuss.elastic.co/u/Atesrin)\ **Replies:** 0\ **Last updated:** [June 23, 2021, 10:42am UTC](https://discuss.elastic.co/t/configure-logstash-stdout/276774 "2021-06-23T10:42:39Z")
Hi, I use Logstash to synchronize a MariaDB to a ES index. But my problem is that I got all the queries, the data in my logstash logs, it becomes quite as big as the index. How can I configure the stdout of Logstash to… --- ## [TimeFilter in Custom Plugin](https://discuss.elastic.co/t/timefilter-in-custom-plugin/276720)
**Author:** [@cjord](https://discuss.elastic.co/u/cjord)\ **Replies:** 1\ **Last updated:** [June 23, 2021, 10:41am UTC](https://discuss.elastic.co/t/timefilter-in-custom-plugin/276720 "2021-06-23T10:41:44Z")
Is there any way to get the values of the time filter in a custom page on a plugin? I would like to be able to read the values to display on the page as well as hook into the refresh event when the time filter is upda… --- ## [Error while trying to start kibana.bat (missing .json file)](https://discuss.elastic.co/t/error-while-trying-to-start-kibana-bat-missing-json-file/276704)
**Author:** [@BaptisteZloch](https://discuss.elastic.co/u/BaptisteZloch)\ **Replies:** 2\ **Last updated:** [June 23, 2021, 10:31am UTC](https://discuss.elastic.co/t/error-while-trying-to-start-kibana-bat-missing-json-file/276704 "2021-06-23T10:31:19Z")
Hi all ! Hope you are all well ! I wanted to start using kibana so yesterday I've downloaded .zip file of kibana and while trying to run bin\\kibana.bat, I got this message Cannot find module './persistence\_google\_works… --- ## [Elasticsearch load through beeline](https://discuss.elastic.co/t/elasticsearch-load-through-beeline/276741)
**Author:** [@praveen2](https://discuss.elastic.co/u/praveen2)\ **Replies:** 0\ **Last updated:** [June 23, 2021, 8:04am UTC](https://discuss.elastic.co/t/elasticsearch-load-through-beeline/276741 "2021-06-23T08:04:54Z")
we see this peculiar issue when loading data through es-hadoop connector es version we use 7.11.2 jars added, we see the same behavior when the jar path is either local or hdfs elasticsearch-hadoop-7.11.2.jar; common… --- ## [Download Error](https://discuss.elastic.co/t/download-error/276643)
**Author:** [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\ **Replies:** 3\ **Last updated:** [June 23, 2021, 10:20am UTC](https://discuss.elastic.co/t/download-error/276643 "2021-06-23T10:20:30Z")
I am not able to download elasticsearch, But am able to ping www.elastic.co. Please refer the image --- ## [No logstash pipeline](https://discuss.elastic.co/t/no-logstash-pipeline/276620)
**Author:** [@diegz](https://discuss.elastic.co/u/diegz)\ **Replies:** 4\ **Last updated:** [June 23, 2021, 9:55am UTC](https://discuss.elastic.co/t/no-logstash-pipeline/276620 "2021-06-23T09:55:33Z")
Hello everyone, I followed this tutorial to enable tls on elasticsearch, kibana, logstash and filebeat : I think logstash don't send logs to kibana but I don't know where to find the information Thank you in advance … --- ## [Dotnet version support for elastic apm](https://discuss.elastic.co/t/dotnet-version-support-for-elastic-apm/276766)
**Author:** [@Bryce\_Fernandes](https://discuss.elastic.co/u/Bryce_Fernandes)\ **Replies:** 1\ **Last updated:** [June 23, 2021, 9:53am UTC](https://discuss.elastic.co/t/dotnet-version-support-for-elastic-apm/276766 "2021-06-23T09:53:57Z")
Hi, I want to implement apm for dotnet 4.5 framework. Have found from below link that its not supported by agent. https://www.elastic.co/guide/en/apm/agent/dotnet/current/supported-technologies.html Is there anyway to… --- ## [AWS ELB ingest pipeline bug](https://discuss.elastic.co/t/aws-elb-ingest-pipeline-bug/276356)
**Author:** [@stephank](https://discuss.elastic.co/u/stephank)\ **Replies:** 7\ **Last updated:** [June 23, 2021, 9:53am UTC](https://discuss.elastic.co/t/aws-elb-ingest-pipeline-bug/276356 "2021-06-23T09:53:23Z")
I believe there is a bug in the Filebeat AWS ELB ingest pipeline. In Kibana Logs, they show up as: \[aws\]\[access\] 1.2.3.4 "GET HTTP/2.0" 200 152966 Clearly missing the request path. I was able to fix this with the fol… --- ## [How could I restore snapshot from another elasticsearch server's repository?](https://discuss.elastic.co/t/how-could-i-restore-snapshot-from-another-elasticsearch-servers-repository/276731)
**Author:** [@soohyun](https://discuss.elastic.co/u/soohyun)\ **Replies:** 1\ **Last updated:** [June 23, 2021, 9:50am UTC](https://discuss.elastic.co/t/how-could-i-restore-snapshot-from-another-elasticsearch-servers-repository/276731 "2021-06-23T09:50:00Z")
I have two different Elasticsearch clusters (for example, the name of the server is test-elk-ver6 and test-elk-ver7) which has run on the different server. I want to migrate the data from test-elk-ver6 to test-elk-ver7,… --- ## [Documents doesn't get updated after the version is updated & response is successful in ES](https://discuss.elastic.co/t/documents-doesnt-get-updated-after-the-version-is-updated-response-is-successful-in-es/276742)
**Author:** [@Farah\_Zaidi](https://discuss.elastic.co/u/Farah_Zaidi)\ **Replies:** 13\ **Last updated:** [June 23, 2021, 9:22am UTC](https://discuss.elastic.co/t/documents-doesnt-get-updated-after-the-version-is-updated-response-is-successful-in-es/276742 "2021-06-23T09:22:34Z")
Hi , I am facing an issue on AWS Elastic search instance. I am sending POST api request to create/update the document in ES , somehow the version gets updated but on querying the record , it still shows the old re… --- ## [Index document with double nested property using Logstash](https://discuss.elastic.co/t/index-document-with-double-nested-property-using-logstash/276755)
**Author:** [@joe100](https://discuss.elastic.co/u/joe100)\ **Replies:** 0\ **Last updated:** [June 23, 2021, 9:10am UTC](https://discuss.elastic.co/t/index-document-with-double-nested-property-using-logstash/276755 "2021-06-23T09:10:30Z")
I have my\_index with a double nested property (nested of nested) and i'm looking for the right logshash configuration to correctly index documents with the following mappings: "mappings": { "properties": { "id": {… --- ## [Understanding Jvm memory calculation with docker](https://discuss.elastic.co/t/understanding-jvm-memory-calculation-with-docker/276628)
**Author:** [@marcs42](https://discuss.elastic.co/u/marcs42)\ **Replies:** 2\ **Last updated:** [June 23, 2021, 9:06am UTC](https://discuss.elastic.co/t/understanding-jvm-memory-calculation-with-docker/276628 "2021-06-23T09:06:33Z")
I'm having issues understanding the memory requirements. Hope somebody can shine some lights on this. Situation: 1 single machine with 20GB ram Base OS ubuntu 20.04 LTS Runs docker containers of Elasticsearch, Logstas… --- ## [Elasticsearch mirrors the Data](https://discuss.elastic.co/t/elasticsearch-mirrors-the-data/275844)
**Author:** [@sven\_begis](https://discuss.elastic.co/u/sven_begis)\ **Replies:** 8\ **Last updated:** [June 23, 2021, 9:03am UTC](https://discuss.elastic.co/t/elasticsearch-mirrors-the-data/275844 "2021-06-23T09:03:46Z")
Hello, I have build my first Graylog Cluster based on these Tutorials Now I have added another dater node, this works also, but I found out it just mirrors the Data. What … --- ## [Search as you type vs max expansions](https://discuss.elastic.co/t/search-as-you-type-vs-max-expansions/276752)
**Author:** [@newbees](https://discuss.elastic.co/u/newbees)\ **Replies:** 0\ **Last updated:** [June 23, 2021, 9:01am UTC](https://discuss.elastic.co/t/search-as-you-type-vs-max-expansions/276752 "2021-06-23T09:01:46Z")
While retrieving the results I cant find any major difference between search as you type and max\_expansions while creating the index.. Which scenario should it be used? Does max\_expansion degrades the performance as w… --- ## [Elastic search issues (Synonyms Issue)](https://discuss.elastic.co/t/elastic-search-issues-synonyms-issue/276750)
**Author:** [@newbees](https://discuss.elastic.co/u/newbees)\ **Replies:** 0\ **Last updated:** [June 23, 2021, 8:49am UTC](https://discuss.elastic.co/t/elastic-search-issues-synonyms-issue/276750 "2021-06-23T08:49:40Z")
Hi All We have created a synonym file .. this file contains following contents Create synonym.txt file. apt, unit, apartment, Apt, Apartment, Unit Southeast, SouthEast, se, SE, South East, southeast Southwest, South… --- ## [Is changes number of replicas and mapping in index blocks parallel queries to index?](https://discuss.elastic.co/t/is-changes-number-of-replicas-and-mapping-in-index-blocks-parallel-queries-to-index/276747)
**Author:** [@lotera87](https://discuss.elastic.co/u/lotera87)\ **Replies:** 1\ **Last updated:** [June 23, 2021, 8:45am UTC](https://discuss.elastic.co/t/is-changes-number-of-replicas-and-mapping-in-index-blocks-parallel-queries-to-index/276747 "2021-06-23T08:45:49Z")
Hi, I am want to change number of replicas in index. Is this operation blocks to retrieve documents from this index to time number of replicas changed? And same question. If i add field to mapping in index is this oper… --- ## [Primaries shards not evenly balanced accross the nodes - Is it normal behavior?](https://discuss.elastic.co/t/primaries-shards-not-evenly-balanced-accross-the-nodes-is-it-normal-behavior/276739)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 2\ **Last updated:** [June 23, 2021, 8:45am UTC](https://discuss.elastic.co/t/primaries-shards-not-evenly-balanced-accross-the-nodes-is-it-normal-behavior/276739 "2021-06-23T08:45:47Z")
Hello, While doing some tests, I noticed that after creating an index (with no data) in a five (data) nodes cluster, primaries shards are not evenly balanced : GET \_cat/nodes 192.168.2.158 67 96 94 2.47 1.56 0.77 dlmr… --- ## [How to create different kibana users](https://discuss.elastic.co/t/how-to-create-different-kibana-users/273796)
**Author:** [@Saishantan\_goli](https://discuss.elastic.co/u/Saishantan_goli)\ **Replies:** 8\ **Last updated:** [June 23, 2021, 8:44am UTC](https://discuss.elastic.co/t/how-to-create-different-kibana-users/273796 "2021-06-23T08:44:56Z")
Hi, I want to know the steps to create multiple Kibana users and roles according to my use case. Ex: case 1: admin user - who can delete create remove anything from the Kibana case 2: user1 - who can query … --- ## [ILM strategy for filebeat, metricbeat and apm indices](https://discuss.elastic.co/t/ilm-strategy-for-filebeat-metricbeat-and-apm-indices/276008)
**Author:** [@aksh\_18](https://discuss.elastic.co/u/aksh_18)\ **Replies:** 4\ **Last updated:** [June 23, 2021, 8:42am UTC](https://discuss.elastic.co/t/ilm-strategy-for-filebeat-metricbeat-and-apm-indices/276008 "2021-06-23T08:42:04Z")
Hi Team, I have 1 node elasticsearch cluster, which has 60GB RAM , 1.2 TB disk. I have 1 filebeat and 1 metricbeat index each receiving 6 GB data per day and 1 apm index which is receiving 10GB data per day. I want to r… --- ## [Elastic Stack SLES 12 SP5](https://discuss.elastic.co/t/elastic-stack-sles-12-sp5/276724)
**Author:** [@Alessio\_Creo](https://discuss.elastic.co/u/Alessio_Creo)\ **Replies:** 1\ **Last updated:** [June 23, 2021, 8:29am UTC](https://discuss.elastic.co/t/elastic-stack-sles-12-sp5/276724 "2021-06-23T08:29:02Z")
Hi there, in the support matrix there is the compatibily with SLES 12. I wonder if this support is for the SP5 patch too; beacuse is not explicitly indicated. Thank you very much. Alessio --- ## [Unable to create windows distribution for custom filebeat module that I created](https://discuss.elastic.co/t/unable-to-create-windows-distribution-for-custom-filebeat-module-that-i-created/276745)
**Author:** [@suryatheja.katkam](https://discuss.elastic.co/u/suryatheja.katkam)\ **Replies:** 0\ **Last updated:** [June 23, 2021, 8:28am UTC](https://discuss.elastic.co/t/unable-to-create-windows-distribution-for-custom-filebeat-module-that-i-created/276745 "2021-06-23T08:28:29Z")
Hi Team, I have created a custom filebeat on linux server using the below documentation available on elastic. I am able to send the log data using the custom module on linux, and visualize the same on Kibana. But wh… --- ## [CCR user permission issue. \[indices:admin/seq\_no/renew\_retention\_lease\] is unauthorized for user \[ccr\_user\]](https://discuss.elastic.co/t/ccr-user-permission-issue-indices-admin-seq-no-renew-retention-lease-is-unauthorized-for-user-ccr-user/276677)
**Author:** [@Armen\_Petrosyan](https://discuss.elastic.co/u/Armen_Petrosyan)\ **Replies:** 4\ **Last updated:** [June 23, 2021, 8:12am UTC](https://discuss.elastic.co/t/ccr-user-permission-issue-indices-admin-seq-no-renew-retention-lease-is-unauthorized-for-user-ccr-user/276677 "2021-06-23T08:12:31Z")
I have two clusters 7.7.1 deployed, tested CCR, using super user. Now I defined ccr\_user with two newly created roles (ccr\_leader, ccr\_follower), which I am using on both leader and follower clusters. Roles looks like … [Previous page](https://discuss.elastic.co/latest.md?page=1606) [Next page](https://discuss.elastic.co/latest.md?page=1608)