# Latest **URL:** https://discuss.elastic.co/latest.md?page=1655 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1656 --- ## [Problem with Index Life cycle policy](https://discuss.elastic.co/t/problem-with-index-life-cycle-policy/273698)
**Author:** [@Luis\_Garavatti](https://discuss.elastic.co/u/Luis_Garavatti)\ **Replies:** 2\ **Last updated:** [May 28, 2021, 12:43am UTC](https://discuss.elastic.co/t/problem-with-index-life-cycle-policy/273698 "2021-05-28T00:43:13Z")
Hi Guys! I'm have a problem with my lifecycle policy in apm index, Look this pic! How to fix this? --- ## [\[bug\] setup.dashboards.index not working for filebeat nor winlogbeat](https://discuss.elastic.co/t/bug-setup-dashboards-index-not-working-for-filebeat-nor-winlogbeat/274260)
**Author:** [@gschanuel](https://discuss.elastic.co/u/gschanuel)\ **Replies:** 2\ **Last updated:** [May 27, 2021, 11:45pm UTC](https://discuss.elastic.co/t/bug-setup-dashboards-index-not-working-for-filebeat-nor-winlogbeat/274260 "2021-05-27T23:45:25Z")
Hello there! I'm using ELK 7.13.0. After setting setup.dashboards.index and setup.dashboards.enabled: true, Dashboards, searches and visualizations are loaded, but Dashboads shows Could not locate that index-pattern (… --- ## [Ingesting evtx logs - error on setup.template.patterns](https://discuss.elastic.co/t/ingesting-evtx-logs-error-on-setup-template-patterns/274123)
**Author:** [@mikecmelanson](https://discuss.elastic.co/u/mikecmelanson)\ **Replies:** 3\ **Last updated:** [May 27, 2021, 11:51pm UTC](https://discuss.elastic.co/t/ingesting-evtx-logs-error-on-setup-template-patterns/274123 "2021-05-27T23:51:36Z")
I've been trying to make use of winlogbeats to ingest static event logs we get from various clients as we perform forensic investigations for them. I have a pretty nice little solution from Manually upload EVTX log file… --- ## [Need help with filebeat and Kibana index pattern creation](https://discuss.elastic.co/t/need-help-with-filebeat-and-kibana-index-pattern-creation/274243)
**Author:** [@byoungman](https://discuss.elastic.co/u/byoungman)\ **Replies:** 1\ **Last updated:** [May 27, 2021, 11:42pm UTC](https://discuss.elastic.co/t/need-help-with-filebeat-and-kibana-index-pattern-creation/274243 "2021-05-27T23:42:07Z")
I was out on vacation last week and while I was out there was an issue with one of our kibana index patterns getting corrupted (for lack of a better term). We have a 'responseTime' stamp in our incoming payload that we … --- ## [Unassigned shards with new frozen tier](https://discuss.elastic.co/t/unassigned-shards-with-new-frozen-tier/274265)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 4\ **Last updated:** [May 27, 2021, 11:37pm UTC](https://discuss.elastic.co/t/unassigned-shards-with-new-frozen-tier/274265 "2021-05-27T23:37:45Z")
I have spun up a brand new cluster on elastic cloud to test 7.13 and I have data\_hot and data\_frozen tiers. I've changed ILM policy for logs and metrics so that data that is older than a few hours (just to test) is move… --- ## [Limiting the scope of permissions for GCS backups](https://discuss.elastic.co/t/limiting-the-scope-of-permissions-for-gcs-backups/274166)
**Author:** [@pkaramol](https://discuss.elastic.co/u/pkaramol)\ **Replies:** 0\ **Last updated:** [May 27, 2021, 9:11am UTC](https://discuss.elastic.co/t/limiting-the-scope-of-permissions-for-gcs-backups/274166 "2021-05-27T09:11:55Z")
According to the docs, the storage.Admin role needs to be granted to the GCP service account that will be used for GCS snapshotting. However, (unless I am mistaken) this is a rather broad role giving full access to all … --- ## [How to create multiple index in logstash?](https://discuss.elastic.co/t/how-to-create-multiple-index-in-logstash/274212)
**Author:** [@Guhan\_S](https://discuss.elastic.co/u/Guhan_S)\ **Replies:** 1\ **Last updated:** [May 27, 2021, 11:16pm UTC](https://discuss.elastic.co/t/how-to-create-multiple-index-in-logstash/274212 "2021-05-27T23:16:49Z")
Am running 2 applications in same AWS ec2 instance as docker-containers.. now I want to create separate index for both application. Filebeat is running on application server. And elk is running on another instance. fi… --- ## [Performance implications of multiple primary shards for one index on the same data node](https://discuss.elastic.co/t/performance-implications-of-multiple-primary-shards-for-one-index-on-the-same-data-node/273859)
**Author:** [@dotjim](https://discuss.elastic.co/u/dotjim)\ **Replies:** 3\ **Last updated:** [May 27, 2021, 10:49pm UTC](https://discuss.elastic.co/t/performance-implications-of-multiple-primary-shards-for-one-index-on-the-same-data-node/273859 "2021-05-27T22:49:34Z")
Hi there, I have an Elastic Cloud cluster running v7.10.2 with three data nodes, three dedicated masters and three coordinates nodes. One index is currently 150GB, spanning three primary shards (one per data node) with… --- ## [Code Contribution - cannot import into IntelliJ](https://discuss.elastic.co/t/code-contribution-cannot-import-into-intellij/274187)
**Author:** [@VJvaLbhYbfr](https://discuss.elastic.co/u/VJvaLbhYbfr)\ **Replies:** 0\ **Last updated:** [May 27, 2021, 11:10am UTC](https://discuss.elastic.co/t/code-contribution-cannot-import-into-intellij/274187 "2021-05-27T11:10:52Z")
Hello everyone, I wanted to contribute to Elastic project. I did read CONTRIBUTING.md and followed it both on Ubuntu 20.04 (in VirtualBox) and on Windows 10. Ubuntu 20.04: Importing project into IntelliJ (version 2021… --- ## [Logstash stopped processing because of an error: (SystemExit)](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error-systemexit/274267)
**Author:** [@soldider1621](https://discuss.elastic.co/u/soldider1621)\ **Replies:** 0\ **Last updated:** [May 27, 2021, 9:35pm UTC](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error-systemexit/274267 "2021-05-27T21:35:31Z")
Hi, I am trying to run the logstash service but it always stops due to error, below I share the log. I can't find the reason for the error, has it happened to you? If I use the program directly from command, it works w… --- ## [Timeline result of events not showing](https://discuss.elastic.co/t/timeline-result-of-events-not-showing/273930)
**Author:** [@Kupauw](https://discuss.elastic.co/u/Kupauw)\ **Replies:** 8\ **Last updated:** [May 27, 2021, 8:54pm UTC](https://discuss.elastic.co/t/timeline-result-of-events-not-showing/273930 "2021-05-27T20:54:38Z")
Hi everyone. Today i upgraded my ELK stack to 7.12.1 and everything seems to be working fine except for the SIEM timeline. I ingest logs from Cisco FTD firewalls, F5 loadbalancers and our infoblox (DHCP/DNS). When i s… --- ## [Mutate Lowercase Issue](https://discuss.elastic.co/t/mutate-lowercase-issue/274247)
**Author:** [@Alexandre.Bernier](https://discuss.elastic.co/u/Alexandre.Bernier)\ **Replies:** 4\ **Last updated:** [May 27, 2021, 7:46pm UTC](https://discuss.elastic.co/t/mutate-lowercase-issue/274247 "2021-05-27T19:46:09Z")
Hi, I'm running Logstash 7.3 and I actually face an issue (or maybe I didn't write the filter correctly) when I apply a lowercase to a new field. The base field is always lowered too. First, I tried this: filter { … --- ## [Is elastichsearch-oss still maintained?](https://discuss.elastic.co/t/is-elastichsearch-oss-still-maintained/274040)
**Author:** [@confuseduser](https://discuss.elastic.co/u/confuseduser)\ **Replies:** 10\ **Last updated:** [May 27, 2021, 7:09pm UTC](https://discuss.elastic.co/t/is-elastichsearch-oss-still-maintained/274040 "2021-05-27T19:09:54Z")
I am really confused at the moment. I have this apt repo config which pulls from: deb https://artifacts.elastic.co/packages/oss-7.x/apt stable main The last update of elastichsearch-oss seems to be from january 2021 w… --- ## [Force insert double quotes in a field value](https://discuss.elastic.co/t/force-insert-double-quotes-in-a-field-value/274144)
**Author:** [@Bryan\_Hamilton](https://discuss.elastic.co/u/Bryan_Hamilton)\ **Replies:** 2\ **Last updated:** [May 27, 2021, 6:41pm UTC](https://discuss.elastic.co/t/force-insert-double-quotes-in-a-field-value/274144 "2021-05-27T18:41:40Z")
Hi all, I have been trying to force wrap double quotes around a field value so it can be used in the query statements of the elasticsearch plugin. the field in question is the network.community\_id which includes a colo… --- ## [Parse logstash file format](https://discuss.elastic.co/t/parse-logstash-file-format/274237)
**Author:** [@sulsulatoff](https://discuss.elastic.co/u/sulsulatoff)\ **Replies:** 1\ **Last updated:** [May 27, 2021, 5:00pm UTC](https://discuss.elastic.co/t/parse-logstash-file-format/274237 "2021-05-27T17:00:47Z")
we have an input file with a format like below. How to process it with logstash? { "message" =\> "test", "@timestamp" =\> "2013-12-23T22:30:01.000Z", "@version" =\> "1", "type" =\> "syslog", "host" =\> "0:0:0:0:0:0:0:1:… --- ## [KubeEdge and monitoring](https://discuss.elastic.co/t/kubeedge-and-monitoring/274067)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 2\ **Last updated:** [May 27, 2021, 4:58pm UTC](https://discuss.elastic.co/t/kubeedge-and-monitoring/274067 "2021-05-27T16:58:36Z")
Any support from Elastic for monitoring within KubeEdge? ( KubeEdge, a Kubernetes Native Edge Computing Framework | Kubernetes --- ## [Advanced watcher to capture JVM thread count from APM Data](https://discuss.elastic.co/t/advanced-watcher-to-capture-jvm-thread-count-from-apm-data/274239)
**Author:** [@mdamera](https://discuss.elastic.co/u/mdamera)\ **Replies:** 0\ **Last updated:** [May 27, 2021, 4:39pm UTC](https://discuss.elastic.co/t/advanced-watcher-to-capture-jvm-thread-count-from-apm-data/274239 "2021-05-27T16:39:18Z")
Team, I have a need to monitor JVM.THREAD count from APM data and need to create a watcher if it exceeds certain value. This to be applied to only few set of hosts on Particular Index, Can you suggest or if have any su… --- ## [Line charts with default values](https://discuss.elastic.co/t/line-charts-with-default-values/273786)
**Author:** [@vikramnr](https://discuss.elastic.co/u/vikramnr)\ **Replies:** 3\ **Last updated:** [May 27, 2021, 3:26pm UTC](https://discuss.elastic.co/t/line-charts-with-default-values/273786 "2021-05-27T15:26:29Z")
I have line chart showing values for couple of year using Histogram. I'm using count as aggregation to display it on the axes. For some number of days there aren't any values returned as count, as a result graph hangs mi… --- ## [Logstash monitoring shows all metrics except pipeline details](https://discuss.elastic.co/t/logstash-monitoring-shows-all-metrics-except-pipeline-details/274223)
**Author:** [@BradVido](https://discuss.elastic.co/u/BradVido)\ **Replies:** 1\ **Last updated:** [May 27, 2021, 2:42pm UTC](https://discuss.elastic.co/t/logstash-monitoring-shows-all-metrics-except-pipeline-details/274223 "2021-05-27T14:42:46Z")
I'm using Elastic stack 7.8.1, and have configured X-pack monitoring for Logstash in logstash.yml by setting xpack.monitoring.enabled: true. In the Kibana UI, I see metrics, as expected here: And here: But the da… --- ## [Sorting in Kibana Data Table Visualization](https://discuss.elastic.co/t/sorting-in-kibana-data-table-visualization/274200)
**Author:** [@antony\_kavin](https://discuss.elastic.co/u/antony_kavin)\ **Replies:** 1\ **Last updated:** [May 27, 2021, 2:36pm UTC](https://discuss.elastic.co/t/sorting-in-kibana-data-table-visualization/274200 "2021-05-27T14:36:29Z")
Hi All, I have been using Elastic Cloud for more than 6 months now. The version I am using is 7.12. I am trying to create a data table visualization in Kibana. I have a couple of buckets(Category and Sub-Category) and … --- ## [Config file for multiple multi-line patterns?](https://discuss.elastic.co/t/config-file-for-multiple-multi-line-patterns/273877)
**Author:** [@1steve](https://discuss.elastic.co/u/1steve)\ **Replies:** 8\ **Last updated:** [May 27, 2021, 2:30pm UTC](https://discuss.elastic.co/t/config-file-for-multiple-multi-line-patterns/273877 "2021-05-27T14:30:52Z")
It looks like the configs described here no longer work; Config file for multiple multiline patterns There is now a codec for multiline inputs; Multiline codec plugin | Logstash Reference \[7.12\] | Elastic input { std… --- ## [Snapshot fails on ceph repository](https://discuss.elastic.co/t/snapshot-fails-on-ceph-repository/274197)
**Author:** [@faxm0dem](https://discuss.elastic.co/u/faxm0dem)\ **Replies:** 1\ **Last updated:** [May 27, 2021, 2:25pm UTC](https://discuss.elastic.co/t/snapshot-fails-on-ceph-repository/274197 "2021-05-27T14:25:20Z")
Hi, Using ES 6.8.6 I'm trying to set up a snapshot repository. The type is fs and the underlying filesystem is ceph. The UID/GID of elasticsearch is the same on all nodes. When issuing the standard API call to create… --- ## [How can I get immediate subdirectories using the path hierarchy tokenizer?](https://discuss.elastic.co/t/how-can-i-get-immediate-subdirectories-using-the-path-hierarchy-tokenizer/274099)
**Author:** [@F\_eq\_kx](https://discuss.elastic.co/u/F_eq_kx)\ **Replies:** 4\ **Last updated:** [May 27, 2021, 1:25pm UTC](https://discuss.elastic.co/t/how-can-i-get-immediate-subdirectories-using-the-path-hierarchy-tokenizer/274099 "2021-05-27T13:25:26Z")
I'm using the path hierarchy tokenizer and, using the examples, I would like to give /User/alice/photos/2017/05 to Elasticsearch and have it list the immediate subdirectories (e.g. 15 and 16). How can I do this? --- ## [Monitoring log sources status](https://discuss.elastic.co/t/monitoring-log-sources-status/273492)
**Author:** [@ima](https://discuss.elastic.co/u/ima)\ **Replies:** 1\ **Last updated:** [May 27, 2021, 1:21pm UTC](https://discuss.elastic.co/t/monitoring-log-sources-status/273492 "2021-05-27T13:21:05Z")
Hello, does anybody have an idea on how to create a dashboard to monitor all log sources status observability and know those who stopped sending logs --- ## [Logstash fails to startup after update after update to 6.8.16](https://discuss.elastic.co/t/logstash-fails-to-startup-after-update-after-update-to-6-8-16/274184)
**Author:** [@bobbyphilip](https://discuss.elastic.co/u/bobbyphilip)\ **Replies:** 2\ **Last updated:** [May 27, 2021, 1:08pm UTC](https://discuss.elastic.co/t/logstash-fails-to-startup-after-update-after-update-to-6-8-16/274184 "2021-05-27T13:08:45Z")
I am running elk on debian. Today there was an update installed, which bumped the logstash version to 6.8.16 from 6.8.15 After this logstash fails to start. I see the following in the logs: \[ 2021-05-27T12:06:38,9… --- ## [Curator action for deletion based on space and oldest data](https://discuss.elastic.co/t/curator-action-for-deletion-based-on-space-and-oldest-data/272362)
**Author:** [@Voula\_Mikr](https://discuss.elastic.co/u/Voula_Mikr)\ **Replies:** 6\ **Last updated:** [May 27, 2021, 12:16pm UTC](https://discuss.elastic.co/t/curator-action-for-deletion-based-on-space-and-oldest-data/272362 "2021-05-27T12:16:14Z")
Hi, I am trying to delete the oldest data based on space. I have two kind of data. The name of the one is \-2021-05-04, for example, and the name of the second type is like \-2021.05.04. My first… --- ## [Custom filebeat index](https://discuss.elastic.co/t/custom-filebeat-index/274063)
**Author:** [@Bryce\_Fernandes](https://discuss.elastic.co/u/Bryce_Fernandes)\ **Replies:** 3\ **Last updated:** [May 27, 2021, 12:03pm UTC](https://discuss.elastic.co/t/custom-filebeat-index/274063 "2021-05-27T12:03:36Z")
Hi, I want to create filebeat index based on event.module and event.dataset, i am using elasticsearch as output. I have tried the following: setup.template.name: "filebeat" setup.template.pattern: "filebeat-\*" index:… --- ## [Unable to view Partition Reassignment Data in Metricbeat Kafka Dashboard](https://discuss.elastic.co/t/unable-to-view-partition-reassignment-data-in-metricbeat-kafka-dashboard/274134)
**Author:** [@metalshanked](https://discuss.elastic.co/u/metalshanked)\ **Replies:** 0\ **Last updated:** [May 27, 2021, 3:43am UTC](https://discuss.elastic.co/t/unable-to-view-partition-reassignment-data-in-metricbeat-kafka-dashboard/274134 "2021-05-27T03:43:04Z")
I am facing the same issue as mentioned in the post below. --- ## [Doubts about Filebeat Threat Intel Module \[7.12.0\]](https://discuss.elastic.co/t/doubts-about-filebeat-threat-intel-module-7-12-0/270810)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 13\ **Last updated:** [May 27, 2021, 11:33am UTC](https://discuss.elastic.co/t/doubts-about-filebeat-threat-intel-module-7-12-0/270810 "2021-05-27T11:33:04Z")
Hi, everyone I have been testing with Filebeat Threat Intel module in order to get events from MISP. I have some doubts regarding configuration: I have to disable every input plugin because they are enabled by defau… --- ## [Fetch only new entries From mssql](https://discuss.elastic.co/t/fetch-only-new-entries-from-mssql/274195)
**Author:** [@akash01](https://discuss.elastic.co/u/akash01)\ **Replies:** 0\ **Last updated:** [May 27, 2021, 11:27am UTC](https://discuss.elastic.co/t/fetch-only-new-entries-from-mssql/274195 "2021-05-27T11:27:08Z")
Hi, I am fetching data from mssql database table which is keep on updating So I want to fetch only the new entries from the table but each time It is fetching all the data. like if there are total 5 records then after… [Previous page](https://discuss.elastic.co/latest.md?page=1654) [Next page](https://discuss.elastic.co/latest.md?page=1656)