# Latest **URL:** https://discuss.elastic.co/latest.md?page=1657 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1658 --- ## [Does Kibana Alerting API also configure Elastic Stack Monitoring Alerts?](https://discuss.elastic.co/t/does-kibana-alerting-api-also-configure-elastic-stack-monitoring-alerts/273776)
**Author:** [@Sumit\_Gupta2](https://discuss.elastic.co/u/Sumit_Gupta2)\ **Replies:** 4\ **Last updated:** [May 26, 2021, 11:55pm UTC](https://discuss.elastic.co/t/does-kibana-alerting-api-also-configure-elastic-stack-monitoring-alerts/273776 "2021-05-26T23:55:07Z")
I have been using Kibana Alert API to create stack monitoring alerts for elastic search cluster, however, it doesn't work: POST /api/alerts/alert { "params":{ "aggType":"avg", "termSize":6, "threshol… --- ## [Logstash stdout output Module](https://discuss.elastic.co/t/logstash-stdout-output-module/274127)
**Author:** [@vishakh](https://discuss.elastic.co/u/vishakh)\ **Replies:** 0\ **Last updated:** [May 26, 2021, 11:45pm UTC](https://discuss.elastic.co/t/logstash-stdout-output-module/274127 "2021-05-26T23:45:54Z")
ELK Stack-7.10.0 Filebeat-7.10.0 I've configured the filebeat output to logstash. From the Kibana-UI, I've configured the logstash pipeline as below. Objective: Print the log from filebeat on the stdout input { b… --- ## [Actions & alerts - suppress + using to alert on security detections](https://discuss.elastic.co/t/actions-alerts-suppress-using-to-alert-on-security-detections/274021)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 0\ **Last updated:** [May 26, 2021, 8:02am UTC](https://discuss.elastic.co/t/actions-alerts-suppress-using-to-alert-on-security-detections/274021 "2021-05-26T08:02:46Z")
Hi, Looking at the guide for Alerts & Actions there is mention of suppressing alerts - However i just cannot seem to find this option. Also i am trying to find a better way to manage the detection alerts, on prem i u… --- ## [How to decide storage size of an index in Elasticsearch](https://discuss.elastic.co/t/how-to-decide-storage-size-of-an-index-in-elasticsearch/274076)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 1\ **Last updated:** [May 26, 2021, 11:10pm UTC](https://discuss.elastic.co/t/how-to-decide-storage-size-of-an-index-in-elasticsearch/274076 "2021-05-26T23:10:06Z")
I want to ask, How should i decide storage size for an index ? Is there any storage limit for shards or am i able to store 20 gb per shard and will it perform same ? Thanks for answering and explaining --- ## [Elasticsearch gc overhead](https://discuss.elastic.co/t/elasticsearch-gc-overhead/274089)
**Author:** [@muralikri32](https://discuss.elastic.co/u/muralikri32)\ **Replies:** 1\ **Last updated:** [May 26, 2021, 11:09pm UTC](https://discuss.elastic.co/t/elasticsearch-gc-overhead/274089 "2021-05-26T23:09:08Z")
Hi team, i am using ES 6.6.X version in K8 environment and running as 3 node cluster. each node has 64GB ram and i configured heap memory as 32GB. it is quite running fine for 2 months and recently i could see lot of gc… --- ## [Unable to post data via ElasticLowLevelClient](https://discuss.elastic.co/t/unable-to-post-data-via-elasticlowlevelclient/274078)
**Author:** [@NeilRedfern](https://discuss.elastic.co/u/NeilRedfern)\ **Replies:** 0\ **Last updated:** [May 26, 2021, 2:42pm UTC](https://discuss.elastic.co/t/unable-to-post-data-via-elasticlowlevelclient/274078 "2021-05-26T14:42:54Z")
Hello, I'm attempting to add data into our Elastic cloud instance following the examples within the post Exporting Azure Log data to the ELK stack with Azure Functions and Event Hubs However despite my best efforts I r… --- ## [Legacy index templates](https://discuss.elastic.co/t/legacy-index-templates/273763)
**Author:** [@6NMgfDwZ3](https://discuss.elastic.co/u/6NMgfDwZ3)\ **Replies:** 0\ **Last updated:** [May 23, 2021, 3:48pm UTC](https://discuss.elastic.co/t/legacy-index-templates/273763 "2021-05-23T15:48:21Z")
Hello, Environment: Elasticsearch 7.12.1 (Basic License) Kibana 7.12.1 (Basic License) Filebeat 7.12.1 (Basic License) Ubuntu 21.04 I have an index template named myapp the index pattern myapp-\*. This index template… --- ## [Make all current indexes use another Index Lifecycle Management policy that has a hot-delete phase?](https://discuss.elastic.co/t/make-all-current-indexes-use-another-index-lifecycle-management-policy-that-has-a-hot-delete-phase/273444)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 5\ **Last updated:** [May 26, 2021, 10:57pm UTC](https://discuss.elastic.co/t/make-all-current-indexes-use-another-index-lifecycle-management-policy-that-has-a-hot-delete-phase/273444 "2021-05-26T22:57:36Z")
Hello Piggybacking on my previous topic, Implement Hot-Warm-Cold-Frozen-Delete phases with only one node but multiple storage destinations? I created a Index Lifecycle Management policy that has a hot phase, rollsover t… --- ## [Strange reindex behaviour](https://discuss.elastic.co/t/strange-reindex-behaviour/274108)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 0\ **Last updated:** [May 26, 2021, 6:38pm UTC](https://discuss.elastic.co/t/strange-reindex-behaviour/274108 "2021-05-26T18:38:04Z")
I'm doing some reindex of daily index to monthly ones and sometimes the reindex process enters in a loop and starts again after it already reindexed the documents. For example, considering the index indexName-2021.05.01 … --- ## [GET \_nodes/stats in 7.13 includes large amount of potentially unwanted "clients" information by default](https://discuss.elastic.co/t/get-nodes-stats-in-7-13-includes-large-amount-of-potentially-unwanted-clients-information-by-default/274090)
**Author:** [@Presence](https://discuss.elastic.co/u/Presence)\ **Replies:** 3\ **Last updated:** [May 26, 2021, 10:36pm UTC](https://discuss.elastic.co/t/get-nodes-stats-in-7-13-includes-large-amount-of-potentially-unwanted-clients-information-by-default/274090 "2021-05-26T22:36:16Z")
Having just upgraded our Elastic Cloud cluster from 7.12.1 to 7.13.0 we've found that GET \_nodes/stats now includes a fairly large chunk of data about "clients" which wasn't present before. This could be useful, but I'm … --- ## [GET \_snapshot/\_status returns 404 "repository\_missing\_exception" even though the repository exists and works](https://discuss.elastic.co/t/get-snapshot-status-returns-404-repository-missing-exception-even-though-the-repository-exists-and-works/274098)
**Author:** [@BradVido](https://discuss.elastic.co/u/BradVido)\ **Replies:** 3\ **Last updated:** [May 26, 2021, 9:52pm UTC](https://discuss.elastic.co/t/get-snapshot-status-returns-404-repository-missing-exception-even-though-the-repository-exists-and-works/274098 "2021-05-26T21:52:13Z")
I'm using Elasticsearch 6.8.3 The reason I discovered this is because curator calls GET \_snapshot/\_status before it starts doing snapshots, and it is failing with a 404 response. I've confirmed that the response to tha… --- ## [How to Generate report with in kibana with kibana\_all\_read permission using Opendistro plugin](https://discuss.elastic.co/t/how-to-generate-report-with-in-kibana-with-kibana-all-read-permission-using-opendistro-plugin/274117)
**Author:** [@Dipesh0711192](https://discuss.elastic.co/u/Dipesh0711192)\ **Replies:** 1\ **Last updated:** [May 26, 2021, 8:55pm UTC](https://discuss.elastic.co/t/how-to-generate-report-with-in-kibana-with-kibana-all-read-permission-using-opendistro-plugin/274117 "2021-05-26T20:55:08Z")
Hi, We have created Kibana user with read only permission using opendistro security plugin by adding kibana\_all\_read permission on specific tenant, but we are unable to save data to generate CSV report. is their any wa… --- ## [Failed to connect to App Search. Failed to open TCP connection to https:443 (initialize: name or service not known)](https://discuss.elastic.co/t/failed-to-connect-to-app-search-failed-to-open-tcp-connection-to-https-443-initialize-name-or-service-not-known/274025)
**Author:** [@joeripeeters](https://discuss.elastic.co/u/joeripeeters)\ **Replies:** 9\ **Last updated:** [May 26, 2021, 8:30pm UTC](https://discuss.elastic.co/t/failed-to-connect-to-app-search-failed-to-open-tcp-connection-to-https-443-initialize-name-or-service-not-known/274025 "2021-05-26T20:30:35Z")
I've got a logstash.conf file defining the following: input { jdbc { jdbc\_validate\_connection =\> true jdbc\_driver\_library =\> "" jdbc\_driver\_class =\> "" jdbc\_connection\_stri… --- ## [High Availability for Kibana Console application](https://discuss.elastic.co/t/high-availability-for-kibana-console-application/273751)
**Author:** [@ggio](https://discuss.elastic.co/u/ggio)\ **Replies:** 6\ **Last updated:** [May 26, 2021, 8:27pm UTC](https://discuss.elastic.co/t/high-availability-for-kibana-console-application/273751 "2021-05-26T20:27:38Z")
Hi, Kibana currently can be configured to connect to multiple Elasticsearch nodes in the same cluster. I discovered that Console application is limited to connecting only on the first host defined in elasticsearch.host… --- ## [OS X Filebeats resend on reboot when registry device number changes](https://discuss.elastic.co/t/os-x-filebeats-resend-on-reboot-when-registry-device-number-changes/272949)
**Author:** [@psears](https://discuss.elastic.co/u/psears)\ **Replies:** 1\ **Last updated:** [May 26, 2021, 8:24pm UTC](https://discuss.elastic.co/t/os-x-filebeats-resend-on-reboot-when-registry-device-number-changes/272949 "2021-05-26T20:24:29Z")
We have Macs sending install.log and system.log with filebeat and using the system module. Sometimes on reboot, they will resend everything in one of the log files (usually install.log, which doesn't change as often). Th… --- ## [Osquery Manager Feedback - Live Query - All Agents](https://discuss.elastic.co/t/osquery-manager-feedback-live-query-all-agents/274001)
**Author:** [@n3k0](https://discuss.elastic.co/u/n3k0)\ **Replies:** 2\ **Last updated:** [May 26, 2021, 7:39pm UTC](https://discuss.elastic.co/t/osquery-manager-feedback-live-query-all-agents/274001 "2021-05-26T19:39:53Z")
I upgraded from 7.12 to 7.13 and all of my previous fleet agents were automatically unenrolled. Which is cool. However, when I run a live query and select "All Agents", it shows as if it's going to query the five enroll… --- ## [Hard-Removing Elastic Endpoint](https://discuss.elastic.co/t/hard-removing-elastic-endpoint/274102)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 1\ **Last updated:** [May 26, 2021, 7:27pm UTC](https://discuss.elastic.co/t/hard-removing-elastic-endpoint/274102 "2021-05-26T19:27:42Z")
Hey, after an upgrade to 7.13 and the auto-removal of Kibana-builtin Fleet, i'm now cleaning up in order to re-install Elastic Agents. On Windows Hosts, I'm not able to remove Elastic Endpoint. Unenrolling the agent … --- ## [Auditbeat multiple hosts in one file](https://discuss.elastic.co/t/auditbeat-multiple-hosts-in-one-file/271769)
**Author:** [@Slaughter](https://discuss.elastic.co/u/Slaughter)\ **Replies:** 8\ **Last updated:** [May 26, 2021, 7:11pm UTC](https://discuss.elastic.co/t/auditbeat-multiple-hosts-in-one-file/271769 "2021-05-26T19:11:16Z")
I'm not allowed to install beats on every server. I'm using audisp to send audit.log messages to a single host where auditbeat runs. Auditbeat is not using the hostname in the message. Everything is listed as coming f… --- ## [Elasticsearch 7.12.1](https://discuss.elastic.co/t/elasticsearch-7-12-1/273919)
**Author:** [@Krunal](https://discuss.elastic.co/u/Krunal)\ **Replies:** 9\ **Last updated:** [May 26, 2021, 7:01pm UTC](https://discuss.elastic.co/t/elasticsearch-7-12-1/273919 "2021-05-26T19:01:08Z")
● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since mar. 2021-05-25 12:38:45 CEST; 3s ago D… --- ## [Deleting old .reporting-\* index](https://discuss.elastic.co/t/deleting-old-reporting-index/273684)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 2\ **Last updated:** [May 26, 2021, 6:08pm UTC](https://discuss.elastic.co/t/deleting-old-reporting-index/273684 "2021-05-26T18:08:44Z")
Hello, It seems that the .reporting-\* index are created weekly but are not deleted, it is safe to delete it manually? When I create a report I delete it using the Kibana UI after the download, so there is no need to ke… --- ## [ECK with Openshift oauth](https://discuss.elastic.co/t/eck-with-openshift-oauth/224459)
**Author:** [@Mastana\_Guru](https://discuss.elastic.co/u/Mastana_Guru)\ **Replies:** 5\ **Last updated:** [May 26, 2021, 6:01pm UTC](https://discuss.elastic.co/t/eck-with-openshift-oauth/224459 "2021-05-26T18:01:15Z")
I have successfully installed ECK operator in openshift. Now I am trying to add openshift oauth proxy to kibana, so that users can be authenticated with ldap. Created a SA, but when deploy kibana with oaauth-proxy runnin… --- ## [Making Logstash configurations dynamic](https://discuss.elastic.co/t/making-logstash-configurations-dynamic/274095)
**Author:** [@usman1](https://discuss.elastic.co/u/usman1)\ **Replies:** 1\ **Last updated:** [May 26, 2021, 5:31pm UTC](https://discuss.elastic.co/t/making-logstash-configurations-dynamic/274095 "2021-05-26T17:31:34Z")
Is there a way to make Logstash configuration file dynamic by reading attribute names and types from a different text file (or any other input mechanism). To explain, if my logstash configuration file looks something li… --- ## [How to make EUI part of Kibana packages?](https://discuss.elastic.co/t/how-to-make-eui-part-of-kibana-packages/273569)
**Author:** [@danburi](https://discuss.elastic.co/u/danburi)\ **Replies:** 7\ **Last updated:** [May 26, 2021, 5:08pm UTC](https://discuss.elastic.co/t/how-to-make-eui-part-of-kibana-packages/273569 "2021-05-26T17:08:14Z")
Hello, I'm running a development version of Kibana 7.10.2. Currently, I have a fork of EUI 29.3.2, with many custom components (eui/packages/) and themes (eui/src/themes). Ideally, I want to submodule this fork in kiba… --- ## [Kibana filters aggregation using "from" and "to" values from Time Picker](https://discuss.elastic.co/t/kibana-filters-aggregation-using-from-and-to-values-from-time-picker/273952)
**Author:** [@tnarciso](https://discuss.elastic.co/u/tnarciso)\ **Replies:** 3\ **Last updated:** [May 26, 2021, 4:37pm UTC](https://discuss.elastic.co/t/kibana-filters-aggregation-using-from-and-to-values-from-time-picker/273952 "2021-05-26T16:37:44Z")
Hi! Is it possible to use the "from" and "to" values from the Time Picker in a filters aggregation with a date field? I know i can use fixed values like "now-7d" but i'd like to filter accordingly with the period selec… --- ## [Dashboard read only without credentials?](https://discuss.elastic.co/t/dashboard-read-only-without-credentials/274052)
**Author:** [@vicgb](https://discuss.elastic.co/u/vicgb)\ **Replies:** 1\ **Last updated:** [May 26, 2021, 4:34pm UTC](https://discuss.elastic.co/t/dashboard-read-only-without-credentials/274052 "2021-05-26T16:34:50Z")
Hi everyone. I'm using Kibana and ES with Kubernetes in my own cluster. I would like to have an only read dashboard (accessible from outside) without having credentials. All I've read about that is about Roles and xpac… --- ## [Filebeat capacity](https://discuss.elastic.co/t/filebeat-capacity/274096)
**Author:** [@AJ18](https://discuss.elastic.co/u/AJ18)\ **Replies:** 0\ **Last updated:** [May 26, 2021, 4:29pm UTC](https://discuss.elastic.co/t/filebeat-capacity/274096 "2021-05-26T16:29:36Z")
Hey Team Can anyone help me with what the capacity of a filebeat agent is and how much data it can support? I needed to get an idea of the size of the EC2 instance I should have on my AWS Account, and how many instance… --- ## [What is the best approach to combine multiple aggregations based in same key](https://discuss.elastic.co/t/what-is-the-best-approach-to-combine-multiple-aggregations-based-in-same-key/274094)
**Author:** [@jasl](https://discuss.elastic.co/u/jasl)\ **Replies:** 0\ **Last updated:** [May 26, 2021, 4:28pm UTC](https://discuss.elastic.co/t/what-is-the-best-approach-to-combine-multiple-aggregations-based-in-same-key/274094 "2021-05-26T16:28:09Z")
This is the query I am playing with: { "aggs": { "by\_foo": { "terms": { "field": "foo.keyword", "size": 100, "exclude": \[ "Unknown" \] } }, "by\_bar": { … --- ## [Trace.id and transaction.id not being added to log entry](https://discuss.elastic.co/t/trace-id-and-transaction-id-not-being-added-to-log-entry/268838)
**Author:** [@pculebras](https://discuss.elastic.co/u/pculebras)\ **Replies:** 13\ **Last updated:** [May 26, 2021, 4:21pm UTC](https://discuss.elastic.co/t/trace-id-and-transaction-id-not-being-added-to-log-entry/268838 "2021-05-26T16:21:51Z")
Good evening everyone, I was able to set up the APM Java Agent and activated the log\_correlation option without further issues. Next, I got the tool to log into a file by using the ECS Java Logging tool and its standar… --- ## [Context sensitive search - can I modify search results based on where my user is?](https://discuss.elastic.co/t/context-sensitive-search-can-i-modify-search-results-based-on-where-my-user-is/273968)
**Author:** [@Peter\_Graves](https://discuss.elastic.co/u/Peter_Graves)\ **Replies:** 3\ **Last updated:** [May 26, 2021, 3:40pm UTC](https://discuss.elastic.co/t/context-sensitive-search-can-i-modify-search-results-based-on-where-my-user-is/273968 "2021-05-26T15:40:33Z")
I am interested in modifying my search results based on the user's context, specifically using their location. If my user is in the US, is there a way I can prioritize "US" results from my website in the search result? … --- ## [Docker Compose for CRON job](https://discuss.elastic.co/t/docker-compose-for-cron-job/274087)
**Author:** [@Ashish\_Jindal](https://discuss.elastic.co/u/Ashish_Jindal)\ **Replies:** 1\ **Last updated:** [May 26, 2021, 3:33pm UTC](https://discuss.elastic.co/t/docker-compose-for-cron-job/274087 "2021-05-26T15:33:44Z")
We had a task to Create a docker file with ubuntu image Create a print.sh file which has code to print date and time Write a cron file named "hello-cron" which includes the print.sh to run for every 1 min. The docker i… [Previous page](https://discuss.elastic.co/latest.md?page=1656) [Next page](https://discuss.elastic.co/latest.md?page=1658)