# Latest **URL:** https://discuss.elastic.co/latest.md?page=1732 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1733 --- ## [ElastiCloud Index lifecycle policy error](https://discuss.elastic.co/t/elasticloud-index-lifecycle-policy-error/270121)
**Author:** [@mfa](https://discuss.elastic.co/u/mfa)\ **Replies:** 2\ **Last updated:** [April 14, 2021, 2:19pm UTC](https://discuss.elastic.co/t/elasticloud-index-lifecycle-policy-error/270121 "2021-04-14T14:19:09Z")
I have set up a lifecycle policy in order to delete index data when it is older that 50 gb Here is how it looks like below: PUT \_ilm/policy/deleting\_policy { "policy": { "phases": { "hot… --- ## [Keyword Field Generation](https://discuss.elastic.co/t/keyword-field-generation/269724)
**Author:** [@LED](https://discuss.elastic.co/u/LED)\ **Replies:** 3\ **Last updated:** [April 14, 2021, 2:04pm UTC](https://discuss.elastic.co/t/keyword-field-generation/269724 "2021-04-14T14:04:31Z")
Hi All, I have setup two identical ELK Stacks (in theory) for Dev and Test. We have Metricbeat shipping data into their respective clusters. In our Test environment I've noticed that ".keyword" is being added to the maj… --- ## [Change the labels on Pie in Canvas](https://discuss.elastic.co/t/change-the-labels-on-pie-in-canvas/269458)
**Author:** [@EduardoM](https://discuss.elastic.co/u/EduardoM)\ **Replies:** 5\ **Last updated:** [April 14, 2021, 1:52pm UTC](https://discuss.elastic.co/t/change-the-labels-on-pie-in-canvas/269458 "2021-04-14T13:52:05Z")
How can I change the labels on Pie in Cavas. and I want to have "car" and "bus" instead of 1 and 2. I should change this's : filters | essql query="SELECT SUM(Produced) AS Production,typ FROM \\"data\*\\" WHERE QUE… --- ## [Cannot create index in elastic search kibana](https://discuss.elastic.co/t/cannot-create-index-in-elastic-search-kibana/270017)
**Author:** [@Shoto\_Todoroki](https://discuss.elastic.co/u/Shoto_Todoroki)\ **Replies:** 3\ **Last updated:** [April 14, 2021, 1:33pm UTC](https://discuss.elastic.co/t/cannot-create-index-in-elastic-search-kibana/270017 "2021-04-14T13:33:17Z")
Hello, i am new to elastic search. I followed this below link to get started with elastic search https://www.elastic.co/blog/aftershock-therapy-with-elasticsearch-and-csv-data-import But while creating the index, i am … --- ## [Logstash](https://discuss.elastic.co/t/logstash/270107)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 1:30pm UTC](https://discuss.elastic.co/t/logstash/270107 "2021-04-14T13:30:13Z")
can somebody help me when i excute the logstash this error appear Using bundled JDK: /usr/share/logstash/jdk OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be… --- ## [Canvas Time Filter When Adding Kibana Objects](https://discuss.elastic.co/t/canvas-time-filter-when-adding-kibana-objects/269971)
**Author:** [@azulgrana](https://discuss.elastic.co/u/azulgrana)\ **Replies:** 6\ **Last updated:** [April 14, 2021, 1:29pm UTC](https://discuss.elastic.co/t/canvas-time-filter-when-adding-kibana-objects/269971 "2021-04-14T13:29:03Z")
Hi there, I have a Canvas with a time filter and I'm looking into adding some existing Kibana objects into my new Canvas. I see that each of the Kibana objects I add into my Canvas has line similar to this ... savedVis… --- ## [Filter last result in Kibana table](https://discuss.elastic.co/t/filter-last-result-in-kibana-table/269995)
**Author:** [@artobstrel](https://discuss.elastic.co/u/artobstrel)\ **Replies:** 2\ **Last updated:** [April 14, 2021, 1:16pm UTC](https://discuss.elastic.co/t/filter-last-result-in-kibana-table/269995 "2021-04-14T13:16:06Z")
I have the following data: With "Top Hit" aggregations I can get the latest result of each event: How can I filter Data Table results to get events with the last result is "failed"? Samples under the spoilerThis i… --- ## [Elasticsearch Certificates and Elasticsearch.Net (Could not create SSL/TLS secure channel...)](https://discuss.elastic.co/t/elasticsearch-certificates-and-elasticsearch-net-could-not-create-ssl-tls-secure-channel/270024)
**Author:** [@christopher.farmer](https://discuss.elastic.co/u/christopher.farmer)\ **Replies:** 0\ **Last updated:** [April 13, 2021, 3:03pm UTC](https://discuss.elastic.co/t/elasticsearch-certificates-and-elasticsearch-net-could-not-create-ssl-tls-secure-channel/270024 "2021-04-13T15:03:26Z")
I would think this would be a common and a straight-forward situation as I am using certificates generated by the elasticsearch-certutil tool for setting up transport and client SSL/TLS communication. The problem I am h… --- ## [Ingestion have been stoped at 70%, would my ingested data will get lost when I reingest?](https://discuss.elastic.co/t/ingestion-have-been-stoped-at-70-would-my-ingested-data-will-get-lost-when-i-reingest/270099)
**Author:** [@sanjaysh](https://discuss.elastic.co/u/sanjaysh)\ **Replies:** 14\ **Last updated:** [April 14, 2021, 12:49pm UTC](https://discuss.elastic.co/t/ingestion-have-been-stoped-at-70-would-my-ingested-data-will-get-lost-when-i-reingest/270099 "2021-04-14T12:49:21Z")
I am ingesting data on EC and I have almost ingested my 70% of data but the ingestion process have suddenly got stopped, and now I have to ingest again with the remaining data so would the remaining data will lost or wou… --- ## [Apikeys and elastic cloud](https://discuss.elastic.co/t/apikeys-and-elastic-cloud/269856)
**Author:** [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Replies:** 6\ **Last updated:** [April 14, 2021, 12:30pm UTC](https://discuss.elastic.co/t/apikeys-and-elastic-cloud/269856 "2021-04-14T12:30:42Z")
Hi all. We use elastic cloud 7.12. We have also metricbeat and filebeat running on node and k8s cluster and for their configurations I use cloud.id and cloud.auth has ta user (beats\_setup) with those privileges. Now I'… --- ## [Header transform concern need help](https://discuss.elastic.co/t/header-transform-concern-need-help/269064)
**Author:** [@jkaufmanlr](https://discuss.elastic.co/u/jkaufmanlr)\ **Replies:** 22\ **Last updated:** [April 14, 2021, 12:00pm UTC](https://discuss.elastic.co/t/header-transform-concern-need-help/269064 "2021-04-14T12:00:51Z")
I have an API POST that I want filebeat to contact. This API calls for having in the header the value: x-api-key : apiToken I have attempted the following \> request.transforms: - set: target: header … --- ## [Issues trying to search with ngram tokenizer](https://discuss.elastic.co/t/issues-trying-to-search-with-ngram-tokenizer/269946)
**Author:** [@nealdan0](https://discuss.elastic.co/u/nealdan0)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 12:00pm UTC](https://discuss.elastic.co/t/issues-trying-to-search-with-ngram-tokenizer/269946 "2021-04-14T12:00:43Z")
Hi, Recently we upgraded our version of elastic search to 7.10. Since then I've had issues querying with an ngram tokenizer from the java api. Specifically, searching for a text value only returns results if using a… --- ## [Is there any way to redo the input of beats?](https://discuss.elastic.co/t/is-there-any-way-to-redo-the-input-of-beats/268863)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 2\ **Last updated:** [April 14, 2021, 10:50am UTC](https://discuss.elastic.co/t/is-there-any-way-to-redo-the-input-of-beats/268863 "2021-04-14T10:50:23Z")
I am sending logs from filebeat to logstash. However, when I added filebeat to a new server and restarted logstash, some kind of failure caused most of the logs to be thrown away. I would like to start logging again fr… --- ## [How to use filebeat to collect only the day's logs](https://discuss.elastic.co/t/how-to-use-filebeat-to-collect-only-the-days-logs/269409)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 16\ **Last updated:** [April 14, 2021, 10:37am UTC](https://discuss.elastic.co/t/how-to-use-filebeat-to-collect-only-the-days-logs/269409 "2021-04-14T10:37:21Z")
I'm using filebeat to collect logs. The name of the target log is "api-yyyy-mm-dd.log". If you set the paths setting of filebeat as follows, all files will be collected. - type: log paths: - /var/log/api/api-\*.l… --- ## [Ingestion doc to index template](https://discuss.elastic.co/t/ingestion-doc-to-index-template/270093)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 2\ **Last updated:** [April 14, 2021, 10:21am UTC](https://discuss.elastic.co/t/ingestion-doc-to-index-template/270093 "2021-04-14T10:21:50Z")
Hi, I've created a index template in Kibana: { "properties": { "date": { "type": "date" }, "formatDate": { "type": "text" }, "temp": { "type":… --- ## [Hot/Warm/Cold storage architecture 1 node](https://discuss.elastic.co/t/hot-warm-cold-storage-architecture-1-node/270102)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 3\ **Last updated:** [April 14, 2021, 10:21am UTC](https://discuss.elastic.co/t/hot-warm-cold-storage-architecture-1-node/270102 "2021-04-14T10:21:02Z")
I am pretty sure it is not possible but still would like to know this for sure. It's possible to use 3 types(Martix,SSD,HDD) of storage for one elasticserach node and configure which index should be stored on which stora… --- ## [Filter on array of object](https://discuss.elastic.co/t/filter-on-array-of-object/270004)
**Author:** [@My-project-repositor](https://discuss.elastic.co/u/My-project-repositor)\ **Replies:** 3\ **Last updated:** [April 14, 2021, 10:16am UTC](https://discuss.elastic.co/t/filter-on-array-of-object/270004 "2021-04-14T10:16:39Z")
I have a documents with many nested fields and array of objects inside them. So when I perform search, how can I get only the matching object inside the array of object, not the entire document? { "name": "Olivia", … --- ## [Create visualizations based on Kibana saved objects, including tags?](https://discuss.elastic.co/t/create-visualizations-based-on-kibana-saved-objects-including-tags/270073)
**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\ **Replies:** 2\ **Last updated:** [April 14, 2021, 10:14am UTC](https://discuss.elastic.co/t/create-visualizations-based-on-kibana-saved-objects-including-tags/270073 "2021-04-14T10:14:13Z")
I'm creating dashboards in Kibana 7.11.2 for multiple types of event from a single application. In the data I'm working with, the event types are characterized by different values of a field named tableName. While there … --- ## [Kibana-comments-app-plugin](https://discuss.elastic.co/t/kibana-comments-app-plugin/269049)
**Author:** [@uusername](https://discuss.elastic.co/u/uusername)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 10:06am UTC](https://discuss.elastic.co/t/kibana-comments-app-plugin/269049 "2021-04-14T10:06:49Z")
@gwintzer hello, Very thanks for developed the plugin. I wondering whether I able to install this plugin in Kibana, kibana-7.11.2-windows-x86\_64? I keep getting the installation failure (when install locally ) with th… --- ## [Issue with loading 4-5 kibana dashboards on the page using Iframe](https://discuss.elastic.co/t/issue-with-loading-4-5-kibana-dashboards-on-the-page-using-iframe/269685)
**Author:** [@Srikanth\_V](https://discuss.elastic.co/u/Srikanth_V)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 9:56am UTC](https://discuss.elastic.co/t/issue-with-loading-4-5-kibana-dashboards-on-the-page-using-iframe/269685 "2021-04-14T09:56:26Z")
Hi There. I am having an issue with the loading of kibana dashboards using an iframe on my application. I have 5 dashboards and it seems to be making multiple requests and multiple plugins for each dashboard to be shown… --- ## [Flood storage Disk Watermark exceeded error](https://discuss.elastic.co/t/flood-storage-disk-watermark-exceeded-error/269411)
**Author:** [@Daud\_Ahmed1](https://discuss.elastic.co/u/Daud_Ahmed1)\ **Replies:** 6\ **Last updated:** [April 14, 2021, 9:50am UTC](https://discuss.elastic.co/t/flood-storage-disk-watermark-exceeded-error/269411 "2021-04-14T09:50:54Z")
I am getting the following error Elasticsearch error: cluster\_block\_exception \[FORBIDDEN/12/index read-only / allow delete (api)\], flood stage disk watermark exceeded Even though I have three data nodes each with 1TB s… --- ## [External UAA Authentication for session management and Kibana Authentication](https://discuss.elastic.co/t/external-uaa-authentication-for-session-management-and-kibana-authentication/269700)
**Author:** [@Srinivas\_Alapati](https://discuss.elastic.co/u/Srinivas_Alapati)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 9:50am UTC](https://discuss.elastic.co/t/external-uaa-authentication-for-session-management-and-kibana-authentication/269700 "2021-04-14T09:50:53Z")
Hi! I have been using the iframe to load the kibana dasboard in our angular application. I have external UAA authentication in our web application for security. How can I use external UAA to be used in Kibana and communi… --- ## [Multiple Pipelines - filebeat fails](https://discuss.elastic.co/t/multiple-pipelines-filebeat-fails/270094)
**Author:** [@Peque](https://discuss.elastic.co/u/Peque)\ **Replies:** 0\ **Last updated:** [April 14, 2021, 9:37am UTC](https://discuss.elastic.co/t/multiple-pipelines-filebeat-fails/270094 "2021-04-14T09:37:31Z")
Hi Forum. Been struggling with my ELK setup, but cannot make it work as I intend - and not sure where I'm going wrong. Using Elasticsearch,Kibana, Logstash and filebeat --\> from this guide: How To Install Elasticsearch… --- ## [How to increase heap size of elasticsearch pod](https://discuss.elastic.co/t/how-to-increase-heap-size-of-elasticsearch-pod/270044)
**Author:** [@Kaustubh20](https://discuss.elastic.co/u/Kaustubh20)\ **Replies:** 5\ **Last updated:** [April 14, 2021, 9:28am UTC](https://discuss.elastic.co/t/how-to-increase-heap-size-of-elasticsearch-pod/270044 "2021-04-14T09:28:41Z")
Hi, I got issue with heap size on elasticsearch pod on production environment, please guide us how to manage or clean heap size of elasticsearch pod. --- ## [Memory problems / Circuit breaking exception with small data](https://discuss.elastic.co/t/memory-problems-circuit-breaking-exception-with-small-data/270091)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 9\ **Last updated:** [April 14, 2021, 8:57am UTC](https://discuss.elastic.co/t/memory-problems-circuit-breaking-exception-with-small-data/270091 "2021-04-14T08:57:04Z")
I am experiencing an odd situation. I have 3 node cluster (two data nodes, one master node) with the following resources node1 24GB RAM, 12CPU node2 16GB RAM, 8CPU master 8GB RAM, 4CPU I am ingesting firewall logs wit… --- ## [Elasticsearch SQL ODBC taking more time than previous version](https://discuss.elastic.co/t/elasticsearch-sql-odbc-taking-more-time-than-previous-version/269442)
**Author:** [@onkark](https://discuss.elastic.co/u/onkark)\ **Replies:** 8\ **Last updated:** [April 14, 2021, 8:39am UTC](https://discuss.elastic.co/t/elasticsearch-sql-odbc-taking-more-time-than-previous-version/269442 "2021-04-14T08:39:29Z")
I'm using SQL ODBC driver to fetch the results from elastic. I'm getting problem while fetching the documents from elastic. The query is as simple as 'select empno, name, address from emp'. In Elasticsearch version 7.6.2… --- ## [ECK operator platforms](https://discuss.elastic.co/t/eck-operator-platforms/269981)
**Author:** [@avili](https://discuss.elastic.co/u/avili)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 8:37am UTC](https://discuss.elastic.co/t/eck-operator-platforms/269981 "2021-04-14T08:37:57Z")
Hi, I am trying to deploy the ECK using eck-operator on IBM PowerPC platform, and it seem that it does not have image for this platform. my question is, is there a way to create such image ? i don't mine to build this… --- ## [Assign Master and ML both roles to same node?](https://discuss.elastic.co/t/assign-master-and-ml-both-roles-to-same-node/270041)
**Author:** [@bharat1](https://discuss.elastic.co/u/bharat1)\ **Replies:** 6\ **Last updated:** [April 14, 2021, 8:36am UTC](https://discuss.elastic.co/t/assign-master-and-ml-both-roles-to-same-node/270041 "2021-04-14T08:36:40Z")
Hi Team, We plan to use Platinum license Can I assign ML and Master both roles on single/same node? From license count perspective, if I use 3 master and 3 ML both roles assigned to those 3 master nodes, will that be … --- ## [Understand "enable: false" mapping setting](https://discuss.elastic.co/t/understand-enable-false-mapping-setting/270084)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 6\ **Last updated:** [April 14, 2021, 8:34am UTC](https://discuss.elastic.co/t/understand-enable-false-mapping-setting/270084 "2021-04-14T08:34:55Z")
Hello all ! I'm trying to understand "enable: false" mapping setting I don't want to index a specific field : syslog\_timestamp To achieve this, I mapped this field with "enabled: false" like this (extract of Index man… --- ## [RegEx in Painless illegal expression](https://discuss.elastic.co/t/regex-in-painless-illegal-expression/270040)
**Author:** [@jamesm1](https://discuss.elastic.co/u/jamesm1)\ **Replies:** 5\ **Last updated:** [April 14, 2021, 8:34am UTC](https://discuss.elastic.co/t/regex-in-painless-illegal-expression/270040 "2021-04-14T08:34:41Z")
Hello - I am using the Dev Tool for painless and i am trying to get a RegEx statement to work. The statement is : def path = "/v3/api/users/stuff./games"; if (path =~ /^\\/v3\\/api\\/users\\/(\[^\\/\]+)$/) { path = "bob"; … [Previous page](https://discuss.elastic.co/latest.md?page=1731) [Next page](https://discuss.elastic.co/latest.md?page=1733)