# Latest **URL:** https://discuss.elastic.co/latest.md?page=1688 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1689 --- ## [Elasticsearch Query Alert](https://discuss.elastic.co/t/elasticsearch-query-alert/272524)
**Author:** [@111387](https://discuss.elastic.co/u/111387)\ **Replies:** 0\ **Last updated:** [May 10, 2021, 12:56am UTC](https://discuss.elastic.co/t/elasticsearch-query-alert/272524 "2021-05-10T00:56:22Z")
I want to create an Alert for a Surikata event. What I want is to generate an alert according to correlation for multiple documents. The problem is that elastalert, KQL, and DSL also seem impossible to query this way. … --- ## [Running elasticsearch 6.x with arm64 architecture](https://discuss.elastic.co/t/running-elasticsearch-6-x-with-arm64-architecture/272287)
**Author:** [@Yugansh\_Marwah](https://discuss.elastic.co/u/Yugansh_Marwah)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 12:46am UTC](https://discuss.elastic.co/t/running-elasticsearch-6-x-with-arm64-architecture/272287 "2021-05-10T00:46:13Z")
We have our application built on elastic 6.x (to be precise 6.8.15), for local development how can we support Elastic 6.x in docker for arm64 architecture, as migration to 7.x and respective library currently is not a fe… --- ## [ES does not push logs to customized \_type . it push logs for \_doc](https://discuss.elastic.co/t/es-does-not-push-logs-to-customized-type-it-push-logs-for-doc/272320)
**Author:** [@Dhiraj](https://discuss.elastic.co/u/Dhiraj)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 12:39am UTC](https://discuss.elastic.co/t/es-does-not-push-logs-to-customized-type-it-push-logs-for-doc/272320 "2021-05-10T00:39:34Z")
we have lots of indexes. some have "\_type" : "logs" & some have "\_type" : "log event" . It pushes logs every month after creating an index with the required \_type. but suddenly it was stopped pushing logs to customized … --- ## [Any Gotcha's I should be aware of when upgrading Docker Cluster Installs](https://discuss.elastic.co/t/any-gotchas-i-should-be-aware-of-when-upgrading-docker-cluster-installs/272371)
**Author:** [@cis4life](https://discuss.elastic.co/u/cis4life)\ **Replies:** 0\ **Last updated:** [May 7, 2021, 6:17am UTC](https://discuss.elastic.co/t/any-gotchas-i-should-be-aware-of-when-upgrading-docker-cluster-installs/272371 "2021-05-07T06:17:26Z")
Hello, I currently have 2 Docker Clusters that are running ES 6.5.1 There are some newer features the team wants to use that in the later / latest version of ES. We have our compose files working and our ES 6.5.1 Dock… --- ## [How do I collect the highest disk active time in Resource Monitor?](https://discuss.elastic.co/t/how-do-i-collect-the-highest-disk-active-time-in-resource-monitor/272398)
**Author:** [@jongpyo.lee](https://discuss.elastic.co/u/jongpyo.lee)\ **Replies:** 0\ **Last updated:** [May 7, 2021, 9:27am UTC](https://discuss.elastic.co/t/how-do-i-collect-the-highest-disk-active-time-in-resource-monitor/272398 "2021-05-07T09:27:29Z")
I want to collect the highest disk active time via Metricbeat. I tried to check the data by adding the PhysicalDisk(\_Total)% Disk Time counter in the Performance Monitor Properties. However, when I display the… --- ## [Need to define a role for Filebet and metricbeat for writing to elasticsearch](https://discuss.elastic.co/t/need-to-define-a-role-for-filebet-and-metricbeat-for-writing-to-elasticsearch/272503)
**Author:** [@mhare](https://discuss.elastic.co/u/mhare)\ **Replies:** 8\ **Last updated:** [May 10, 2021, 12:28am UTC](https://discuss.elastic.co/t/need-to-define-a-role-for-filebet-and-metricbeat-for-writing-to-elasticsearch/272503 "2021-05-10T00:28:26Z")
I am running v7.7 of the stack from a ZIP install on Windows. But I have the same issue with v7.12 running as docker container on a Mac. I've searched and searched and either I don't know what to search for, or I don't… --- ## [Kibana failed to load policy issue](https://discuss.elastic.co/t/kibana-failed-to-load-policy-issue/272461)
**Author:** [@Mithoon](https://discuss.elastic.co/u/Mithoon)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 12:28am UTC](https://discuss.elastic.co/t/kibana-failed-to-load-policy-issue/272461 "2021-05-10T00:28:10Z")
Currently using index state management created policy to delete indexes which are older than 5 days. Using templates applying policies to new index creations. The policy works well for few days and later old indexes stop… --- ## [Connecting Elasticsearch to Kibana](https://discuss.elastic.co/t/connecting-elasticsearch-to-kibana/272463)
**Author:** [@jie\_olaf](https://discuss.elastic.co/u/jie_olaf)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 12:27am UTC](https://discuss.elastic.co/t/connecting-elasticsearch-to-kibana/272463 "2021-05-10T00:27:33Z")
I am trying to display the iris data in kibana by connecting to elasticsearch and creating an index called "iris" in R. I am taking the following steps: Execute elasticsearch 5.5.3 batch file (localhost:9200 displays re… --- ## [WinlogBeat - parsing "message" field](https://discuss.elastic.co/t/winlogbeat-parsing-message-field/272497)
**Author:** [@filip.wozniak](https://discuss.elastic.co/u/filip.wozniak)\ **Replies:** 0\ **Last updated:** [May 9, 2021, 11:06am UTC](https://discuss.elastic.co/t/winlogbeat-parsing-message-field/272497 "2021-05-09T11:06:04Z")
Greetings! I'm using basic setup that uses Winlogbeat with configured sysmon. I'm writing some correlation rules and I would like to detect whether powershell command is suspiciously long. The command itself is in "mes… --- ## [Recommendation for number of master nodes in a large cluster having 250 data nodes](https://discuss.elastic.co/t/recommendation-for-number-of-master-nodes-in-a-large-cluster-having-250-data-nodes/272510)
**Author:** [@Praveen\_Atluri](https://discuss.elastic.co/u/Praveen_Atluri)\ **Replies:** 4\ **Last updated:** [May 10, 2021, 12:15am UTC](https://discuss.elastic.co/t/recommendation-for-number-of-master-nodes-in-a-large-cluster-having-250-data-nodes/272510 "2021-05-10T00:15:20Z")
Hi All, Is there any recommendation for how many master nodes must be there for a large cluster containing 250 data nodes? When we monitor the thread pool of each data node in the cluster, I see some tasks that are re… --- ## [Filebeat processor syntax 7.12.1](https://discuss.elastic.co/t/filebeat-processor-syntax-7-12-1/271768)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 12\ **Last updated:** [May 9, 2021, 9:51pm UTC](https://discuss.elastic.co/t/filebeat-processor-syntax-7-12-1/271768 "2021-05-09T21:51:40Z")
Hello, I want to add some fields explanation because names that are provided via logs are not self-explaining enough. I guess It's best to do this operation on filebeat level to not use resources during the pipeline pro… --- ## [Iterate through data in field logstash](https://discuss.elastic.co/t/iterate-through-data-in-field-logstash/272518)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 1\ **Last updated:** [May 9, 2021, 9:33pm UTC](https://discuss.elastic.co/t/iterate-through-data-in-field-logstash/272518 "2021-05-09T21:33:45Z")
Hi all I have a field like this field: 10, 20, 30, 40 now that i want to make each of the data in the field to be parse like this: field.1: 10 field.2: 20 ... and then use the translate plugin on each of these field… --- ## [Send all Syslog messages that don't match output to another index?](https://discuss.elastic.co/t/send-all-syslog-messages-that-dont-match-output-to-another-index/272418)
**Author:** [@jeromeat](https://discuss.elastic.co/u/jeromeat)\ **Replies:** 2\ **Last updated:** [May 9, 2021, 9:22pm UTC](https://discuss.elastic.co/t/send-all-syslog-messages-that-dont-match-output-to-another-index/272418 "2021-05-09T21:22:02Z")
Noob here, so don't judge too hard. :wink: However, I am wanting to find out if it's possible to have an output as such that's looking for specific tags and sending those messages to the windows\* index but if they don'… --- ## [Way to place new line space using Webhook request](https://discuss.elastic.co/t/way-to-place-new-line-space-using-webhook-request/272413)
**Author:** [@Suro](https://discuss.elastic.co/u/Suro)\ **Replies:** 1\ **Last updated:** [May 9, 2021, 8:38pm UTC](https://discuss.elastic.co/t/way-to-place-new-line-space-using-webhook-request/272413 "2021-05-09T20:38:43Z")
We are trying to call ServiceNow Webhook API calls via Elastic Security signal actions. For Eg, we are using the following body below - { "short\_description":"{{context.rule.name}}", "description":"""Rule Descri… --- ## [Elasticsearch node stats write threadpool](https://discuss.elastic.co/t/elasticsearch-node-stats-write-threadpool/272516)
**Author:** [@Praveen\_Atluri](https://discuss.elastic.co/u/Praveen_Atluri)\ **Replies:** 1\ **Last updated:** [May 9, 2021, 6:49pm UTC](https://discuss.elastic.co/t/elasticsearch-node-stats-write-threadpool/272516 "2021-05-09T18:49:55Z")
When I checked the node stats for some of my nodes, I see below for write thread pool. "write" : { "threads" : 8, "queue" : 13, "active" : 8, "rejected" : 19958, "large… --- ## [Index lifecycle error](https://discuss.elastic.co/t/index-lifecycle-error/271200)
**Author:** [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Replies:** 4\ **Last updated:** [May 9, 2021, 5:52pm UTC](https://discuss.elastic.co/t/index-lifecycle-error/271200 "2021-05-09T17:52:27Z")
Hi all. We have elastic cloud 7.12 I am getting the following errors on the lifecycle for all the new policy I ve put in place. Any idea? illegal\_argument\_exception: setting \[index.lifecycle.rollover\_alias\] for index … --- ## [How to do log rotation in Elastic Search](https://discuss.elastic.co/t/how-to-do-log-rotation-in-elastic-search/272442)
**Author:** [@german\_83](https://discuss.elastic.co/u/german_83)\ **Replies:** 1\ **Last updated:** [May 9, 2021, 2:34pm UTC](https://discuss.elastic.co/t/how-to-do-log-rotation-in-elastic-search/272442 "2021-05-09T14:34:07Z")
Hi all, I have setup a deployment for elasticsearch and I been able to make it work with winlogbeat to capture specific events, But I'm not sure how to rotate the logs with the index lifecycle management policies I'm no… --- ## [Logstash ambiguous port definition](https://discuss.elastic.co/t/logstash-ambiguous-port-definition/272494)
**Author:** [@Roy\_Levy](https://discuss.elastic.co/u/Roy_Levy)\ **Replies:** 2\ **Last updated:** [May 9, 2021, 2:15pm UTC](https://discuss.elastic.co/t/logstash-ambiguous-port-definition/272494 "2021-05-09T14:15:51Z")
Hey, I am using Logstash in order to push documents to elasticsearch, and when trying to run logstash I'm getting the error: \[2021-05-09T08:45:57,532\]\[DEBUG\]\[logstash.javapipeline \]\[main\] Pipeline terminated by work… --- ## [Goes through data in a field to parse](https://discuss.elastic.co/t/goes-through-data-in-a-field-to-parse/272429)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 2\ **Last updated:** [May 9, 2021, 1:31pm UTC](https://discuss.elastic.co/t/goes-through-data-in-a-field-to-parse/272429 "2021-05-09T13:31:53Z")
Hi all I have some problems with parse data in logstash i have a field with value like this: testValue: 1,2,3,4 and i have an yaml file to map data like this: 1: some1 2: some2 3: some3 i want to parse the data to … --- ## [Patterns, Best Practices.... for Ingesting large SQL multi-table/multi-relationship data into ES](https://discuss.elastic.co/t/patterns-best-practices-for-ingesting-large-sql-multi-table-multi-relationship-data-into-es/272498)
**Author:** [@lbi2000](https://discuss.elastic.co/u/lbi2000)\ **Replies:** 0\ **Last updated:** [May 9, 2021, 11:55am UTC](https://discuss.elastic.co/t/patterns-best-practices-for-ingesting-large-sql-multi-table-multi-relationship-data-into-es/272498 "2021-05-09T11:55:44Z")
Hi All. Great product. Keep up the great work please and continue to "push" into use cases not just for focus of log analysis...but please push the envelope for those like my project that have dumped SQL databases for … --- ## [How can we use the beats-provided Kibana dashboards but use a custom index-pattern name?](https://discuss.elastic.co/t/how-can-we-use-the-beats-provided-kibana-dashboards-but-use-a-custom-index-pattern-name/271282)
**Author:** [@Husnain](https://discuss.elastic.co/u/Husnain)\ **Replies:** 5\ **Last updated:** [May 9, 2021, 11:26am UTC](https://discuss.elastic.co/t/how-can-we-use-the-beats-provided-kibana-dashboards-but-use-a-custom-index-pattern-name/271282 "2021-05-09T11:26:11Z")
Hii,I am using Filebeat 7.12.0 to ingest netflow flows and store it into elasticsearch.I want to load the example dashboards of filebeat but with an index pattern different than filebeat-\*.How can I do this? I am running… --- ## [How to add data\_hot node type to es cluster using helm?](https://discuss.elastic.co/t/how-to-add-data-hot-node-type-to-es-cluster-using-helm/272495)
**Author:** [@fahem](https://discuss.elastic.co/u/fahem)\ **Replies:** 0\ **Last updated:** [May 9, 2021, 10:11am UTC](https://discuss.elastic.co/t/how-to-add-data-hot-node-type-to-es-cluster-using-helm/272495 "2021-05-09T10:11:50Z")
Hello, I would like to add data\_hot node type to my es cluster (not just data node), i saw https://github.com/elastic/helm-charts/blob/master/elasticsearch/examples/multi/data.yaml page but it implements data node onl… --- ## [Auditbeat system overview ECS](https://discuss.elastic.co/t/auditbeat-system-overview-ecs/272469)
**Author:** [@logger](https://discuss.elastic.co/u/logger)\ **Replies:** 2\ **Last updated:** [May 9, 2021, 8:54am UTC](https://discuss.elastic.co/t/auditbeat-system-overview-ecs/272469 "2021-05-09T08:54:11Z")
Hi there, Running elasticsearch and kibana as a docker with version 7.12.1 and auditbeat on two hosts with also version 7.12.1 Everything is running fine. I just have found an issue in the Auditbeat System Overview Da… --- ## [Kibana Slow Response After Enabling ELK Security](https://discuss.elastic.co/t/kibana-slow-response-after-enabling-elk-security/271182)
**Author:** [@k.karami](https://discuss.elastic.co/u/k.karami)\ **Replies:** 1\ **Last updated:** [May 9, 2021, 5:37am UTC](https://discuss.elastic.co/t/kibana-slow-response-after-enabling-elk-security/271182 "2021-05-09T05:37:53Z")
Hi, We have a basic license single node cluster (elastic 7.12.0 and kibana 7.12.0 ) on premise running on docker in a Linux node using http ( http://localhost:9200 and http://localhost:5601 ). Couple of weeks ago I en… --- ## [Kibana Monitoring Issue and Sharding Problem](https://discuss.elastic.co/t/kibana-monitoring-issue-and-sharding-problem/271219)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 13\ **Last updated:** [May 8, 2021, 8:36am UTC](https://discuss.elastic.co/t/kibana-monitoring-issue-and-sharding-problem/271219 "2021-05-08T08:36:37Z")
Hi there I have 2 problems which is probably related to each other: I have a basic cluster with 2 nodes of data. But my status is always "Yellow" and these 2nodes can not divide the primary shards and replicas: So I … --- ## [LogStash update fields received](https://discuss.elastic.co/t/logstash-update-fields-received/272480)
**Author:** [@Hamza\_El\_Aouane](https://discuss.elastic.co/u/Hamza_El_Aouane)\ **Replies:** 0\ **Last updated:** [May 8, 2021, 10:14pm UTC](https://discuss.elastic.co/t/logstash-update-fields-received/272480 "2021-05-08T22:14:48Z")
Hello guys. I hope everyone is doing well. I am a bit confused about ELK, specifically about LogStash and I hope you can help me to clarify this issue. A couple of weeks ago, one of our clients started forwarding syslo… --- ## [Filebeat not pushing log to Logstash](https://discuss.elastic.co/t/filebeat-not-pushing-log-to-logstash/272478)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 0\ **Last updated:** [May 8, 2021, 10:07pm UTC](https://discuss.elastic.co/t/filebeat-not-pushing-log-to-logstash/272478 "2021-05-08T22:07:11Z")
Hi All, I am using ELK stack 7.6.2. The log does not get pushed from Filebeat to Logstash for some reason. The log /opt/ttcmkts/work/bcdcommoncache/bcd.log is rolling very fast. My logstash conf file looks like bel… --- ## [Dynamically add keyword field to text field](https://discuss.elastic.co/t/dynamically-add-keyword-field-to-text-field/272427)
**Author:** [@peterol](https://discuss.elastic.co/u/peterol)\ **Replies:** 1\ **Last updated:** [May 8, 2021, 6:47pm UTC](https://discuss.elastic.co/t/dynamically-add-keyword-field-to-text-field/272427 "2021-05-08T18:47:47Z")
Hello everyone, I have various fields i want to index as text and keyword from Logstash. I'm using an index template with static mappings to define data types and analyzers for my fields that look like these: "field.n… --- ## [Help with manging storage for a large index](https://discuss.elastic.co/t/help-with-manging-storage-for-a-large-index/272447)
**Author:** [@predev](https://discuss.elastic.co/u/predev)\ **Replies:** 5\ **Last updated:** [May 8, 2021, 5:32pm UTC](https://discuss.elastic.co/t/help-with-manging-storage-for-a-large-index/272447 "2021-05-08T17:32:14Z")
Hi, We are a new start-up going through development with no funding other than out our own pocket, I am hoping to seek some advice from others who are far more experienced than myself given we have only used Elasticsear… --- ## [Importing csv met date format error](https://discuss.elastic.co/t/importing-csv-met-date-format-error/272457)
**Author:** [@Jeff-Tian](https://discuss.elastic.co/u/Jeff-Tian)\ **Replies:** 3\ **Last updated:** [May 8, 2021, 2:38pm UTC](https://discuss.elastic.co/t/importing-csv-met-date-format-error/272457 "2021-05-08T14:38:26Z")
I'm quite new on kibana and I met the following error when importing csv file: File could not be read \[illegal\_argument\_exception\] failed to parse date field \[3/3/2021 21:40:25.76\] with format \[d/M/… [Previous page](https://discuss.elastic.co/latest.md?page=1687) [Next page](https://discuss.elastic.co/latest.md?page=1689)