# Latest **URL:** https://discuss.elastic.co/latest.md?page=1633 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1634 --- ## [Rally offline with my own tracks](https://discuss.elastic.co/t/rally-offline-with-my-own-tracks/275252)
**Author:** [@Lasse\_Nedergaard](https://discuss.elastic.co/u/Lasse_Nedergaard)\ **Replies:** 4\ **Last updated:** [June 9, 2021, 8:53am UTC](https://discuss.elastic.co/t/rally-offline-with-my-own-tracks/275252 "2021-06-09T08:53:05Z")
Hi I want to test our internal cluster and don’t have internet access and running on windows is it possible to use the rally container instead off offline install package as it’s for Linux/Mac and change rally.ini to po… --- ## [Automatic data ingestion in logstash](https://discuss.elastic.co/t/automatic-data-ingestion-in-logstash/275071)
**Author:** [@Kanishk\_Madan](https://discuss.elastic.co/u/Kanishk_Madan)\ **Replies:** 5\ **Last updated:** [June 9, 2021, 8:44am UTC](https://discuss.elastic.co/t/automatic-data-ingestion-in-logstash/275071 "2021-06-09T08:44:00Z")
Hello community, This thread is regarding the automate of ingestion of data in logstash. I have created a python script in which I have written the command for the logstash data ingestion. The python script is also auto… --- ## [Hi, I want to ask a thing in Elasticsearch. If I want to ignore a document based on a certain field value, how can I do that in the flatmap function of javascript](https://discuss.elastic.co/t/hi-i-want-to-ask-a-thing-in-elasticsearch-if-i-want-to-ignore-a-document-based-on-a-certain-field-value-how-can-i-do-that-in-the-flatmap-function-of-javascript/275401)
**Author:** [@appydam](https://discuss.elastic.co/u/appydam)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 8:43am UTC](https://discuss.elastic.co/t/hi-i-want-to-ask-a-thing-in-elasticsearch-if-i-want-to-ignore-a-document-based-on-a-certain-field-value-how-can-i-do-that-in-the-flatmap-function-of-javascript/275401 "2021-06-09T08:43:47Z")
Hi, I want to ask a thing in Elasticsearch. If I want to ignore a document based on a certain field value, how can I do that in the flatmap function of javascript const body = datajson.flatMap((doc: Resource) =\> \[ … --- ## [Logstash not able to connect to Elasticsearch deployed through Kubernetes pod](https://discuss.elastic.co/t/logstash-not-able-to-connect-to-elasticsearch-deployed-through-kubernetes-pod/275400)
**Author:** [@Shubham\_Dhote](https://discuss.elastic.co/u/Shubham_Dhote)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 8:34am UTC](https://discuss.elastic.co/t/logstash-not-able-to-connect-to-elasticsearch-deployed-through-kubernetes-pod/275400 "2021-06-09T08:34:59Z")
Hi, I have deployed Logstash and elasticsearch pod on EKS cluster. When I am checking the logs for logstash pod it is showing unreachable elasticserach server. Though my elasticsearch is up and running. Please find below… --- ## [How searching over multiple indices using alias work internally, is it faster that having one index having all the documents](https://discuss.elastic.co/t/how-searching-over-multiple-indices-using-alias-work-internally-is-it-faster-that-having-one-index-having-all-the-documents/275372)
**Author:** [@code\_merchant](https://discuss.elastic.co/u/code_merchant)\ **Replies:** 1\ **Last updated:** [June 9, 2021, 7:56am UTC](https://discuss.elastic.co/t/how-searching-over-multiple-indices-using-alias-work-internally-is-it-faster-that-having-one-index-having-all-the-documents/275372 "2021-06-09T07:56:37Z")
I have 2 clusters. Cluster A: have 1 big index storing 500 GB of data Cluster B: have monthly indices of 30GB for 15 months There is a search query which search over a single index in cluster A and over read-alias \[im… --- ## [Exclude\_Files not working in Filebeat](https://discuss.elastic.co/t/exclude-files-not-working-in-filebeat/275392)
**Author:** [@shubham.tawde](https://discuss.elastic.co/u/shubham.tawde)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 7:51am UTC](https://discuss.elastic.co/t/exclude-files-not-working-in-filebeat/275392 "2021-06-09T07:51:13Z")
Hi there! I have been trying to exclude a file from a directory, here's the dir structure which I have- var/logs/domain-a/HSC1/HSC1/logger.log var/logs/domain-b/HSC2/HSC2/logger.log var/logs/domain-c/HSC3/HSC3/logger… --- ## [Embed custom plugin in another custom plugin](https://discuss.elastic.co/t/embed-custom-plugin-in-another-custom-plugin/275165)
**Author:** [@jackson123](https://discuss.elastic.co/u/jackson123)\ **Replies:** 4\ **Last updated:** [June 9, 2021, 7:47am UTC](https://discuss.elastic.co/t/embed-custom-plugin-in-another-custom-plugin/275165 "2021-06-09T07:47:15Z")
Hi, I need help in a use case. I am developing two custom plugins (say P1 & P2) . And I want to embed P2 into P1. (May be multiple plugins also). Can you please help me how to do this? --- ## [SelectedFilter & ResetSearchButton](https://discuss.elastic.co/t/selectedfilter-resetsearchbutton/275284)
**Author:** [@mariobg](https://discuss.elastic.co/u/mariobg)\ **Replies:** 2\ **Last updated:** [June 9, 2021, 7:24am UTC](https://discuss.elastic.co/t/selectedfilter-resetsearchbutton/275284 "2021-06-09T07:24:50Z")
Hello, is there some provision to make the a SelectedFilter components where the selected filters are easily seen and from where they can be deselected. And a ResetSearchButton component with which to clean all filters e… --- ## [Document and field level security not supported in trial license](https://discuss.elastic.co/t/document-and-field-level-security-not-supported-in-trial-license/275248)
**Author:** [@boskjoett](https://discuss.elastic.co/u/boskjoett)\ **Replies:** 7\ **Last updated:** [June 9, 2021, 6:58am UTC](https://discuss.elastic.co/t/document-and-field-level-security-not-supported-in-trial-license/275248 "2021-06-09T06:58:57Z")
I have just made a trial installation of the Elastic Cloud to test out document level security. But when I configure document level security via the Elasticsearch API I get an error message saying that "Document and fiel… --- ## [Problems in Elasticsearch combining two types of logs using two pipelines (Logstash)](https://discuss.elastic.co/t/problems-in-elasticsearch-combining-two-types-of-logs-using-two-pipelines-logstash/273900)
**Author:** [@francesco96](https://discuss.elastic.co/u/francesco96)\ **Replies:** 1\ **Last updated:** [June 9, 2021, 6:51am UTC](https://discuss.elastic.co/t/problems-in-elasticsearch-combining-two-types-of-logs-using-two-pipelines-logstash/273900 "2021-06-09T06:51:43Z")
Hi everyone, I need some help. I have configured my ES stack inside a docker. I need to show two types of logs (syslog, log), in an Elastic index. I have created two configuration files logstash.cong logstash-syslog.c… --- ## [Failed to connect AWS ES cluster](https://discuss.elastic.co/t/failed-to-connect-aws-es-cluster/275314)
**Author:** [@richzw](https://discuss.elastic.co/u/richzw)\ **Replies:** 3\ **Last updated:** [June 9, 2021, 6:13am UTC](https://discuss.elastic.co/t/failed-to-connect-aws-es-cluster/275314 "2021-06-09T06:13:58Z")
Hi We try to connect to AWS ES through file beat, However, the following errors comes up pipeline/output.go:100 Failed to connect to backoff(elasticsearch(https://xxx.us-east-1.es.amazonaws.com:443)): Connection marke… --- ## [Logstash elasticsearch output, expand variables in data stream parameters](https://discuss.elastic.co/t/logstash-elasticsearch-output-expand-variables-in-data-stream-parameters/275276)
**Author:** [@ebourlon](https://discuss.elastic.co/u/ebourlon)\ **Replies:** 2\ **Last updated:** [June 9, 2021, 6:13am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-expand-variables-in-data-stream-parameters/275276 "2021-06-09T06:13:01Z")
Hello, I am using logstash 7.13.1 that has support for datastreams in the elasticsearch output. As far as I looked at it is not possible to specify a variable in one of the datastream related parameter like below: e… --- ## [Top 10 in bar graph in kibana](https://discuss.elastic.co/t/top-10-in-bar-graph-in-kibana/275301)
**Author:** [@abhishek30](https://discuss.elastic.co/u/abhishek30)\ **Replies:** 2\ **Last updated:** [June 9, 2021, 6:11am UTC](https://discuss.elastic.co/t/top-10-in-bar-graph-in-kibana/275301 "2021-06-09T06:11:10Z")
Hi, I have a small setup of elk stack of 7.12.1. I have ingested some data related to candidate examination. I wanted to show top 10 questions for which candidate answered correct. This is shown as such in tag cloud. … --- ## [ILM action status - Waiting for all shard copies to be active](https://discuss.elastic.co/t/ilm-action-status-waiting-for-all-shard-copies-to-be-active/274209)
**Author:** [@braham](https://discuss.elastic.co/u/braham)\ **Replies:** 8\ **Last updated:** [June 9, 2021, 5:27am UTC](https://discuss.elastic.co/t/ilm-action-status-waiting-for-all-shard-copies-to-be-active/274209 "2021-06-09T05:27:19Z")
Hello, We have configured ILM policy but it's changing the phase "hot" to "warm" but after that not changing further phases like "cold" and "delete". We see action status "Waiting for all shard copies to be active". I… --- ## [How to give cluster IP in fluentd/kibana for 3 node Elasticsearch cluster](https://discuss.elastic.co/t/how-to-give-cluster-ip-in-fluentd-kibana-for-3-node-elasticsearch-cluster/275289)
**Author:** [@khgupta3](https://discuss.elastic.co/u/khgupta3)\ **Replies:** 5\ **Last updated:** [June 9, 2021, 5:13am UTC](https://discuss.elastic.co/t/how-to-give-cluster-ip-in-fluentd-kibana-for-3-node-elasticsearch-cluster/275289 "2021-06-09T05:13:13Z")
Hi All, I have 3 node cluster (3 VM with different IPs) . After going thru some documentations and other community questions, I read that in small cluster like if 3, to have redundancy it is good to make all Master as w… --- ## [Send the Ruby Exception message along with the \_rubyException tag](https://discuss.elastic.co/t/send-the-ruby-exception-message-along-with-the-rubyexception-tag/275369)
**Author:** [@mastersmit](https://discuss.elastic.co/u/mastersmit)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 4:40am UTC](https://discuss.elastic.co/t/send-the-ruby-exception-message-along-with-the-rubyexception-tag/275369 "2021-06-09T04:40:25Z")
I have ruby filter processing and for some inputs, I do have ruby-exceptions and they are successfully propogated to elastic search with the tag. (expected). However I do not know why this exceptions are caused i.e the s… --- ## [logstashでindex作成時にtemplateとtemplate-nameを指定するとFailed to install templateになる](https://discuss.elastic.co/t/logstash-index-template-template-name-failed-to-install-template/275368)
**Author:** [@Masanori\_Mishima](https://discuss.elastic.co/u/Masanori_Mishima)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 4:12am UTC](https://discuss.elastic.co/t/logstash-index-template-template-name-failed-to-install-template/275368 "2021-06-09T04:12:30Z")
elasticsearch serviceのインスタンスへ向けて実行しています。 予めtemplateをPUTしておかなくてはならないのでしょうか？ (でもそれだとconfファイルにtemplateのJSONファイルやtemplate\_nameをわざわざ指定する意味はないですよね・・・) 実行環境 mac book pro logstash-7.13.0 confファイルの内容 input { file { … --- ## [Kibana url redirecting to /space/enter and giving 503 error when deployed on Kubernetes cluster](https://discuss.elastic.co/t/kibana-url-redirecting-to-space-enter-and-giving-503-error-when-deployed-on-kubernetes-cluster/275257)
**Author:** [@Shubham\_Dhote](https://discuss.elastic.co/u/Shubham_Dhote)\ **Replies:** 2\ **Last updated:** [June 9, 2021, 3:57am UTC](https://discuss.elastic.co/t/kibana-url-redirecting-to-space-enter-and-giving-503-error-when-deployed-on-kubernetes-cluster/275257 "2021-06-09T03:57:17Z")
I have deployed Kibana and elasticsearch pods in Kubernetes cluster, I have created ingress path url for both of them. Elasticsearch is accessible with ingress path url, but when trying to access kibana ui with ingress u… --- ## [Can not go get beats module](https://discuss.elastic.co/t/can-not-go-get-beats-module/275367)
**Author:** [@Montana\_Jony](https://discuss.elastic.co/u/Montana_Jony)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 3:44am UTC](https://discuss.elastic.co/t/can-not-go-get-beats-module/275367 "2021-06-09T03:44:49Z")
ISSUE \[Elastic-Agent\] Can't go get module · Issue #26200 · elastic/beats · GitHub This is because of wrong file name with double dot --- ## [Create event on change of field](https://discuss.elastic.co/t/create-event-on-change-of-field/275363)
**Author:** [@johnwood](https://discuss.elastic.co/u/johnwood)\ **Replies:** 1\ **Last updated:** [June 9, 2021, 3:31am UTC](https://discuss.elastic.co/t/create-event-on-change-of-field/275363 "2021-06-09T03:31:42Z")
Hi All I need some help getting started in the right direction with a logstash configuration please: We have log events coming into logstash right now. From each of the events we currently parse the name of a computer … --- ## [Behaviour of searchable snapshot](https://discuss.elastic.co/t/behaviour-of-searchable-snapshot/275364)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 3:25am UTC](https://discuss.elastic.co/t/behaviour-of-searchable-snapshot/275364 "2021-06-09T03:25:21Z")
Hi, I configured a index lifecycle policy. And at the end of the hot phase I configured a Searchable snapshot backed on a repository hosted on our S3 bucket. I have chosen the convert to fully mounted index option. T… --- ## [Losing logs in ELK](https://discuss.elastic.co/t/losing-logs-in-elk/275356)
**Author:** [@devopscanada](https://discuss.elastic.co/u/devopscanada)\ **Replies:** 2\ **Last updated:** [June 9, 2021, 2:08am UTC](https://discuss.elastic.co/t/losing-logs-in-elk/275356 "2021-06-09T02:08:24Z")
Setup: Kubernetes cluster with filebeat-7.12.0 -\> logstash-7.9. -\> elasticsearch-7.9.1 -\> kibana-7.9.1 Problem: we lose many logs often and sometimes in a massive way, as in we stop seeing logs from one or more pods… --- ## [Auto Delete old indices based on size (on hitting the low watermark setting)](https://discuss.elastic.co/t/auto-delete-old-indices-based-on-size-on-hitting-the-low-watermark-setting/275353)
**Author:** [@rakeshr](https://discuss.elastic.co/u/rakeshr)\ **Replies:** 2\ **Last updated:** [June 9, 2021, 2:04am UTC](https://discuss.elastic.co/t/auto-delete-old-indices-based-on-size-on-hitting-the-low-watermark-setting/275353 "2021-06-09T02:04:46Z")
Hi, Is there any setting which would auto Delete old indices on hitting the lower watermark setting? I could not find much information from the documentation regarding such a setting. If not, how can this be done ? --- ## [Kibana build error](https://discuss.elastic.co/t/kibana-build-error/275261)
**Author:** [@541002492](https://discuss.elastic.co/u/541002492)\ **Replies:** 3\ **Last updated:** [June 9, 2021, 1:36am UTC](https://discuss.elastic.co/t/kibana-build-error/275261 "2021-06-09T01:36:36Z")
info \[ kibana \] Copying source into platform-generic build directory │ERROR failure 13 sec │ERROR Error: EINVAL: invalid argument, utime 'D:\\Desktop\\kibana\\kibana\\kibana-7.10.0.0\\build\\kibana\\yarn.lock' My operating… --- ## [logstashからElasticsearch Serviceへindex作成を実行すると実行ログが途中で止まる](https://discuss.elastic.co/t/logstash-elasticsearch-service-index/275226)
**Author:** [@Masanori\_Mishima](https://discuss.elastic.co/u/Masanori_Mishima)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 3:42am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-service-index/275226 "2021-06-08T03:42:14Z")
試しにindexの作成を行おうと思い、以下の内容で実行したのですがログが途中で止まり、 indexが作成されてるかクエリで確認しても作成されてないという状態で、どこの設定が間違ってるのかわからない状況です。 お手数ですが、ご教示いただけると幸いです。 参考にした記事 使用したconfファイルの内容 input { file { mode =\> "tail" path =\> \["/Use… --- ## [Filebeat messages dropped until 1PM in china zone](https://discuss.elastic.co/t/filebeat-messages-dropped-until-1pm-in-china-zone/274759)
**Author:** [@boba](https://discuss.elastic.co/u/boba)\ **Replies:** 1\ **Last updated:** [June 9, 2021, 12:53am UTC](https://discuss.elastic.co/t/filebeat-messages-dropped-until-1pm-in-china-zone/274759 "2021-06-09T00:53:46Z")
Hello, Messages before 1PM (5AM UTC) china time never appeared in graylog. New messages start piping at 1:00PM. All messages before 1:00 never arrived. I have light setup: linux, filebeat, sidecar, graylog, with just 2… --- ## [Is moving kibana indices to hot node ok?](https://discuss.elastic.co/t/is-moving-kibana-indices-to-hot-node-ok/275305)
**Author:** [@roh](https://discuss.elastic.co/u/roh)\ **Replies:** 1\ **Last updated:** [June 9, 2021, 12:31am UTC](https://discuss.elastic.co/t/is-moving-kibana-indices-to-hot-node-ok/275305 "2021-06-09T00:31:09Z")
Hi all My team is using hot to cold tier architecture for recent projects. There was an interesting opinion about kibana internal system indices. One of my teammates thought that if kibana indices are moved to cold tie… --- ## [Kibana: alert with various fields](https://discuss.elastic.co/t/kibana-alert-with-various-fields/273809)
**Author:** [@Guillermo\_Valles\_Cas](https://discuss.elastic.co/u/Guillermo_Valles_Cas)\ **Replies:** 3\ **Last updated:** [June 9, 2021, 12:03am UTC](https://discuss.elastic.co/t/kibana-alert-with-various-fields/273809 "2021-06-09T00:03:41Z")
This is my scenario: I have two fields (A and B) and I would like to create an alert where if sum(A+B) \> 90% (or A / B \> 1) should trigger the alert. It is possible to do that with alerts with Kibana? --- ## [Error in Vega visual Kibana](https://discuss.elastic.co/t/error-in-vega-visual-kibana/274592)
**Author:** [@Nisha2297](https://discuss.elastic.co/u/Nisha2297)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 10:43pm UTC](https://discuss.elastic.co/t/error-in-vega-visual-kibana/274592 "2021-06-08T22:43:28Z")
Does anybody has any idea of "EsError" in Vega custom visualization in Kibana? What kind of elasticsearch error is this. I'm stuck with this error. Please help me resolving this issue! --- ## [Dashboard deployment process](https://discuss.elastic.co/t/dashboard-deployment-process/274926)
**Author:** [@ITchandj](https://discuss.elastic.co/u/ITchandj)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 10:41pm UTC](https://discuss.elastic.co/t/dashboard-deployment-process/274926 "2021-06-08T22:41:47Z")
Hello!!! please how i can define kibana dashboard deployment process? thank for suggestion in advance. [Previous page](https://discuss.elastic.co/latest.md?page=1632) [Next page](https://discuss.elastic.co/latest.md?page=1634)