# Latest **URL:** https://discuss.elastic.co/latest.md?page=1649 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1650 --- ## [Elasticsearch 7.x with Curator -- close replicas older than N days to reduce shard count](https://discuss.elastic.co/t/elasticsearch-7-x-with-curator-close-replicas-older-than-n-days-to-reduce-shard-count/274560)
**Author:** [@cknz](https://discuss.elastic.co/u/cknz)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 3:33am UTC](https://discuss.elastic.co/t/elasticsearch-7-x-with-curator-close-replicas-older-than-n-days-to-reduce-shard-count/274560 "2021-06-01T03:33:48Z")
I bumped against the cluster shard limit recently, and am trying to find useful ways to manage this. I'm dealling with logs as my primary use-case, and some of these logs are very high volume. By default, I've generally… --- ## [Mutate rename issue after upgrade](https://discuss.elastic.co/t/mutate-rename-issue-after-upgrade/274558)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 2\ **Last updated:** [June 1, 2021, 2:27am UTC](https://discuss.elastic.co/t/mutate-rename-issue-after-upgrade/274558 "2021-06-01T02:27:50Z")
Hello, I have a pipeline where that receives data from a F5 load balancer and parses it with the cef codec, in the filters I have a series of mutate using rename to change the name of some fields to their ecs correspond… --- ## [Showing newsfeed posts based on friends' list](https://discuss.elastic.co/t/showing-newsfeed-posts-based-on-friends-list/274557)
**Author:** [@m-asfour](https://discuss.elastic.co/u/m-asfour)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 2:01am UTC](https://discuss.elastic.co/t/showing-newsfeed-posts-based-on-friends-list/274557 "2021-06-01T02:01:47Z")
Hi, I'm trying to build a social network app similar to Facebook which shows each user their friends' posts on their feed. What is the best way to implement this using Elasticsearch? --- ## [Find IP in between two ranges](https://discuss.elastic.co/t/find-ip-in-between-two-ranges/274104)
**Author:** [@Sarthak\_Mishra](https://discuss.elastic.co/u/Sarthak_Mishra)\ **Replies:** 4\ **Last updated:** [June 1, 2021, 1:53am UTC](https://discuss.elastic.co/t/find-ip-in-between-two-ranges/274104 "2021-06-01T01:53:34Z")
Hello Community, I have two indexes. Index 1 contains a column of IP address. Index 2 contains 2 columns: the start subnet and end IP Address column. I want to find in which subnet range does the particular IP belong to… --- ## [Elasticsearch 2021 License](https://discuss.elastic.co/t/elasticsearch-2021-license/274559)
**Author:** [@xodn0812](https://discuss.elastic.co/u/xodn0812)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 1:38am UTC](https://discuss.elastic.co/t/elasticsearch-2021-license/274559 "2021-06-01T01:38:21Z")
Hi. I am asking a question because the elasticsearch license changed in 2021 is not well understood. It cannot be provided as a managed-service to other users. Our company develops a system called “A” and sells “A” … --- ## [Logstash aggregation overwrite](https://discuss.elastic.co/t/logstash-aggregation-overwrite/274556)
**Author:** [@fuzes](https://discuss.elastic.co/u/fuzes)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 1:13am UTC](https://discuss.elastic.co/t/logstash-aggregation-overwrite/274556 "2021-06-01T01:13:42Z")
I don't know why aggregation is overwritten by last one following is my logstash code filter { aggregate { task\_id =\> "%{code}" code =\> " map\['code'\] = event.get('code') map\[event.get('langu… --- ## [KIbana - How do I point to remote instance of Elasticsearch](https://discuss.elastic.co/t/kibana-how-do-i-point-to-remote-instance-of-elasticsearch/274550)
**Author:** [@debasisc](https://discuss.elastic.co/u/debasisc)\ **Replies:** 3\ **Last updated:** [June 1, 2021, 12:36am UTC](https://discuss.elastic.co/t/kibana-how-do-i-point-to-remote-instance-of-elasticsearch/274550 "2021-06-01T00:36:42Z")
Locally I have installed Elasticsearch and KIbana (version 7.8, OS = Windows 10). Using KIbana console and I can type in commands in left-hand-side, click "arrow" to execute command and see results in right-hand side. … --- ## [Elasticsearch Cluster Status is RED](https://discuss.elastic.co/t/elasticsearch-cluster-status-is-red/274129)
**Author:** [@lls](https://discuss.elastic.co/u/lls)\ **Replies:** 11\ **Last updated:** [June 1, 2021, 12:28am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-status-is-red/274129 "2021-06-01T00:28:34Z")
Hi guys: I need advise to fix the following error after issuing \_cluster/allocation/explain. I did try to fix it by running this \_cluster/reroute?retry\_failed=true but no luck. Appreciate your advise, thanks so much. {… --- ## [Kibana Monitoring says Missing Primary Shards](https://discuss.elastic.co/t/kibana-monitoring-says-missing-primary-shards/274548)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 11:52pm UTC](https://discuss.elastic.co/t/kibana-monitoring-says-missing-primary-shards/274548 "2021-05-31T23:52:44Z")
Hello, I've just update my cluster from 7.9.3 to 7.12.1 and in the monitoring for Kibana it says that the status is Red and that it is Missing Primary Shards. The elasticsearch monitoring part is green, this is the res… --- ## [Best ELK Stack option for AWS centric Team](https://discuss.elastic.co/t/best-elk-stack-option-for-aws-centric-team/274481)
**Author:** [@saif3r](https://discuss.elastic.co/u/saif3r)\ **Replies:** 3\ **Last updated:** [May 31, 2021, 11:38pm UTC](https://discuss.elastic.co/t/best-elk-stack-option-for-aws-centric-team/274481 "2021-05-31T23:38:17Z")
Hello Everyone, I'm a part of team that focuses on creating AI products on AWS Cloud. We are currently looking into what would be the option for setting up Elastic as a part of our stack. Its main job would be to visual… --- ## [KQL : query\_string doesn't work](https://discuss.elastic.co/t/kql-query-string-doesnt-work/274451)
**Author:** [@lls](https://discuss.elastic.co/u/lls)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 9:42pm UTC](https://discuss.elastic.co/t/kql-query-string-doesnt-work/274451 "2021-05-31T21:42:07Z")
Hi there: Interestingly, I'm not sure why the below "query\_string" doesn't returns any hits but it returns hits on 'Discovery UI's Filters section. Please advise, thanks "sql\_string" - This doesn't return any hits GET… --- ## [Having an issue with filebeat pushing to Elasticsearch](https://discuss.elastic.co/t/having-an-issue-with-filebeat-pushing-to-elasticsearch/271822)
**Author:** [@gentle\_ghost](https://discuss.elastic.co/u/gentle_ghost)\ **Replies:** 21\ **Last updated:** [May 31, 2021, 9:24pm UTC](https://discuss.elastic.co/t/having-an-issue-with-filebeat-pushing-to-elasticsearch/271822 "2021-05-31T21:24:25Z")
Hello, I am receiving the following error when attempting to push log files to Elasticsearch: Exiting: error loading config file: yaml: line 2: did not find expected key Here is my .yaml file: filebeat.inputs: - ty… --- ## [Role that would allow a user to create index in ES](https://discuss.elastic.co/t/role-that-would-allow-a-user-to-create-index-in-es/274534)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 4\ **Last updated:** [May 31, 2021, 9:05pm UTC](https://discuss.elastic.co/t/role-that-would-allow-a-user-to-create-index-in-es/274534 "2021-05-31T21:05:02Z")
Hi, I am looking for a role that would allow a user to create indices in ES. Basically I want to avoid assigning "superuser" role. Please guide on what role can I assign? My configuration for ELK7.6.2 stack looks li… --- ## [Text Files received by Logstash from Filebeat is not same as Source Files](https://discuss.elastic.co/t/text-files-received-by-logstash-from-filebeat-is-not-same-as-source-files/274512)
**Author:** [@Resington\_R](https://discuss.elastic.co/u/Resington_R)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 7:32pm UTC](https://discuss.elastic.co/t/text-files-received-by-logstash-from-filebeat-is-not-same-as-source-files/274512 "2021-05-31T19:32:04Z")
Hi everyone... I am transferring text files from my Application Server to Logstash Server using below logstash config file. The files transmitted are received perfectly, but some of the lines in the received text files … --- ## [New Node in Docker Implementation](https://discuss.elastic.co/t/new-node-in-docker-implementation/274536)
**Author:** [@augandi](https://discuss.elastic.co/u/augandi)\ **Replies:** 0\ **Last updated:** [May 31, 2021, 4:24pm UTC](https://discuss.elastic.co/t/new-node-in-docker-implementation/274536 "2021-05-31T16:24:23Z")
Hi, I am new here and I hope you can help me with a frustrating issue :frowning: I have a Docker-based installation of the Elastic Stack. There were just two containers: es01 and kib01 Here the Docker-Compose yml File: … --- ## [Logstash don't execute my two Pipelines file](https://discuss.elastic.co/t/logstash-dont-execute-my-two-pipelines-file/274400)
**Author:** [@Denilson-Semedo](https://discuss.elastic.co/u/Denilson-Semedo)\ **Replies:** 4\ **Last updated:** [May 31, 2021, 5:49pm UTC](https://discuss.elastic.co/t/logstash-dont-execute-my-two-pipelines-file/274400 "2021-05-31T17:49:59Z")
i thease have two pipeline in the logstash pipeline folder logstash.conf : input { beats { port =\> 5066 } } filter { if \[cloud\]\[account\]\[id\] == "941682856883" { mutate { add\_field =\> { "ambiente" =\> "d… --- ## [Show udp source port](https://discuss.elastic.co/t/show-udp-source-port/274539)
**Author:** [@Alex\_Der](https://discuss.elastic.co/u/Alex_Der)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 5:49pm UTC](https://discuss.elastic.co/t/show-udp-source-port/274539 "2021-05-31T17:49:28Z")
I'm using Logstash to ingest the logs sent (via udp) by 5 different applications running on another machine. Each aplication sends its log to Logstash from a different port (e.g. application\_1 from port 1760, applicatio… --- ## [Node sync fails and cluster goes to "red"](https://discuss.elastic.co/t/node-sync-fails-and-cluster-goes-to-red/274409)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 21\ **Last updated:** [May 31, 2021, 4:58pm UTC](https://discuss.elastic.co/t/node-sync-fails-and-cluster-goes-to-red/274409 "2021-05-31T16:58:37Z")
Hello, I hope you and your loved ones are safe and healthy. I have a 3 node cluster with 2 data nodes and 1 voting only node. I accidentally deleted the separate disk that holds data for one of the data node. I separa… --- ## [Profiling Web Server Applications](https://discuss.elastic.co/t/profiling-web-server-applications/274521)
**Author:** [@ILYASS](https://discuss.elastic.co/u/ILYASS)\ **Replies:** 3\ **Last updated:** [May 31, 2021, 4:15pm UTC](https://discuss.elastic.co/t/profiling-web-server-applications/274521 "2021-05-31T16:15:28Z")
Hello Im New In the forum , I want to Know How to execute Profiling with ELK ? --- ## [Elastalert](https://discuss.elastic.co/t/elastalert/274353)
**Author:** [@Krunal](https://discuss.elastic.co/u/Krunal)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 3:33pm UTC](https://discuss.elastic.co/t/elastalert/274353 "2021-05-31T15:33:47Z")
Hi @Elastalert\_Yelp I would like to use elastalert in kibana 7.13? --- ## [How to change "type" keyword in clone plugin](https://discuss.elastic.co/t/how-to-change-type-keyword-in-clone-plugin/274499)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 3:14pm UTC](https://discuss.elastic.co/t/how-to-change-type-keyword-in-clone-plugin/274499 "2021-05-31T15:14:50Z")
clone plugin default use "type" keyword. In my logstash configuration I use multiple times "type" keyword and now i need to add clone filter plugin in my logstash configuration. How can i use this plugin without using "… --- ## [Else if condition not working](https://discuss.elastic.co/t/else-if-condition-not-working/274383)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [May 29, 2021, 3:31pm UTC](https://discuss.elastic.co/t/else-if-condition-not-working/274383 "2021-05-29T15:31:53Z")
Hi all, I'm trying to write a scripted field. But I"m unable to execute else if condition as below: if (doc.containsKey("report\_card.grade") && !doc\["report\_card.grade"\].empty) { if (doc\["report\_card.grade"\].value ==… --- ## [Lamar Van Dusen](https://discuss.elastic.co/t/lamar-van-dusen/274467)
**Author:** [@lamarvandusen](https://discuss.elastic.co/u/lamarvandusen)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 2:51pm UTC](https://discuss.elastic.co/t/lamar-van-dusen/274467 "2021-05-31T14:51:51Z")
i am Lamar Van Dusen from Alberta Canada. i am reading questions and answers from this website and i am learning so much from this website. I am new to this platform and i hope i will learn a lot from this site in the fu… --- ## [Can't log into Elastic (self hosted) "Oops! Error. Try again."](https://discuss.elastic.co/t/cant-log-into-elastic-self-hosted-oops-error-try-again/274433)
**Author:** [@maof97](https://discuss.elastic.co/u/maof97)\ **Replies:** 4\ **Last updated:** [May 31, 2021, 2:40pm UTC](https://discuss.elastic.co/t/cant-log-into-elastic-self-hosted-oops-error-try-again/274433 "2021-05-31T14:40:57Z")
If I want to log in it just says "Oops! Error. Try again.". The credentials are definitely right (if I change the password to random it says that the login/password is wrong and doesn't give this error). I can't find a… --- ## [Kibana just shows "Kibana isn't ready yet"](https://discuss.elastic.co/t/kibana-just-shows-kibana-isnt-ready-yet/274372)
**Author:** [@maof97](https://discuss.elastic.co/u/maof97)\ **Replies:** 3\ **Last updated:** [May 28, 2021, 8:42pm UTC](https://discuss.elastic.co/t/kibana-just-shows-kibana-isnt-ready-yet/274372 "2021-05-28T20:42:37Z")
Hello, I have restarted my server the other day but it just shows the message that Kibana isn't ready yet. But Kibana must be ready as this message is showing for hours now. In the Kibana.logs I found this one: index \[… --- ## [Delete docs by date](https://discuss.elastic.co/t/delete-docs-by-date/274493)
**Author:** [@Jose\_Manuel\_Tirado](https://discuss.elastic.co/u/Jose_Manuel_Tirado)\ **Replies:** 9\ **Last updated:** [May 31, 2021, 2:33pm UTC](https://discuss.elastic.co/t/delete-docs-by-date/274493 "2021-05-31T14:33:29Z")
HI! In the following index I have several days of data I want to delete the data from the 29th and 30th of the 5th of 2021 But when I launch the following command I obtain this messages: How cai I delete the dat… --- ## [Plugin build how to allow snake case name of folder](https://discuss.elastic.co/t/plugin-build-how-to-allow-snake-case-name-of-folder/274157)
**Author:** [@masterThomas](https://discuss.elastic.co/u/masterThomas)\ **Replies:** 1\ **Last updated:** [May 28, 2021, 3:39am UTC](https://discuss.elastic.co/t/plugin-build-how-to-allow-snake-case-name-of-folder/274157 "2021-05-28T03:39:16Z")
Hi team, i m building my plugin and want it to be in snake case folder installed after installing on kibana rpm version. How to reach it ? After running bin/kibana-plugin install file:///local/path/to/custom\_plugin.zip i… --- ## [Metricbeat Kubernetes Timeout for all nodes except one](https://discuss.elastic.co/t/metricbeat-kubernetes-timeout-for-all-nodes-except-one/274515)
**Author:** [@kiqo](https://discuss.elastic.co/u/kiqo)\ **Replies:** 0\ **Last updated:** [May 31, 2021, 1:53pm UTC](https://discuss.elastic.co/t/metricbeat-kubernetes-timeout-for-all-nodes-except-one/274515 "2021-05-31T13:53:12Z")
Hi, I’m running Metricbeat in Kubernetes from the yamls here: However I am having an issue where I get these kind of errors on all nodes except one, which work fine, but I get no kubernetes stats on these three nodes … --- ## [Get all fields of the pie chart to one filter](https://discuss.elastic.co/t/get-all-fields-of-the-pie-chart-to-one-filter/274509)
**Author:** [@HieuTranTH](https://discuss.elastic.co/u/HieuTranTH)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 1:50pm UTC](https://discuss.elastic.co/t/get-all-fields-of-the-pie-chart-to-one-filter/274509 "2021-05-31T13:50:53Z")
Hello everybody, I'm having this tedious issue which you may know solution for it. Normally I get this kind of pie chart after some filtering on the data set. And if I click on one of the field, it adds an extra fil… --- ## [Filebeat Multiline.Count\_Lines](https://discuss.elastic.co/t/filebeat-multiline-count-lines/274511)
**Author:** [@Beater](https://discuss.elastic.co/u/Beater)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 1:35pm UTC](https://discuss.elastic.co/t/filebeat-multiline-count-lines/274511 "2021-05-31T13:35:11Z")
Hello Community, I'm currently using Filebeat to stream my logs to Kafka. Everything works as expected besides the multiline option. I'd like to bulk several lines into one event to stream bigger messages to Kafka as th… [Previous page](https://discuss.elastic.co/latest.md?page=1648) [Next page](https://discuss.elastic.co/latest.md?page=1650)