# Latest **URL:** https://discuss.elastic.co/latest.md?page=1736 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1737 --- ## [ILM Policy not sticking to index template](https://discuss.elastic.co/t/ilm-policy-not-sticking-to-index-template/269940)
**Author:** [@leemase004](https://discuss.elastic.co/u/leemase004)\ **Replies:** 1\ **Last updated:** [April 12, 2021, 9:36pm UTC](https://discuss.elastic.co/t/ilm-policy-not-sticking-to-index-template/269940 "2021-04-12T21:36:59Z")
We have created an ILM (ex. ILM-1) and have attached it to an index-template (ex. Index-1). However, whenever the index rolls over it for some reason grabs a different, random ILM policy. We will go back to attach the … --- ## [Multiple pipeline](https://discuss.elastic.co/t/multiple-pipeline/269907)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 2\ **Last updated:** [April 12, 2021, 9:35pm UTC](https://discuss.elastic.co/t/multiple-pipeline/269907 "2021-04-12T21:35:53Z")
hi I have 2 servers , the first is DHCP server and the second is DNS server so for shipping the logs to logstash i installed filebeats so in logstash I will apply the differents filtres on DNS and DHCP so how can do th… --- ## ['search\_phase\_execution\_exception', 'action \[indices:data/read/search\[phase/query\]\] is unauthorized for user](https://discuss.elastic.co/t/search-phase-execution-exception-action-indices-data-read-search-phase-query-is-unauthorized-for-user/269657)
**Author:** [@sair\_ramos](https://discuss.elastic.co/u/sair_ramos)\ **Replies:** 1\ **Last updated:** [April 12, 2021, 8:41pm UTC](https://discuss.elastic.co/t/search-phase-execution-exception-action-indices-data-read-search-phase-query-is-unauthorized-for-user/269657 "2021-04-12T20:41:59Z")
i use a script in python to search, index and uptade data and everything works but sometimes give this error many times in a row \*\*'search\_phase\_execution\_exception', 'action \[indices:data/read/search\[phase/query\]\] is un… --- ## [Translate filter regex capture grouping](https://discuss.elastic.co/t/translate-filter-regex-capture-grouping/269922)
**Author:** [@aap323](https://discuss.elastic.co/u/aap323)\ **Replies:** 4\ **Last updated:** [April 12, 2021, 7:55pm UTC](https://discuss.elastic.co/t/translate-filter-regex-capture-grouping/269922 "2021-04-12T19:55:42Z")
Hi, I am using Logstash to parse and enter graphite metrics into InfluxDB. However, I wanted to create a large dictionary source where it can match certain metric lines based on their pattern and reorganize the string ba… --- ## [Logstash 7.12.0 High CPU usage](https://discuss.elastic.co/t/logstash-7-12-0-high-cpu-usage/269851)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 5\ **Last updated:** [April 12, 2021, 7:41pm UTC](https://discuss.elastic.co/t/logstash-7-12-0-high-cpu-usage/269851 "2021-04-12T19:41:21Z")
Hi All, I know that there are several open discussions on the topic already but nothing in there helped me resolving my situation. #1 I installed Logstash on Ubuntu 20.04 for testing purposes and enabling it to run with… --- ## [Where are shard relocations and failures logged?](https://discuss.elastic.co/t/where-are-shard-relocations-and-failures-logged/269942)
**Author:** [@Scott\_Merritt](https://discuss.elastic.co/u/Scott_Merritt)\ **Replies:** 1\ **Last updated:** [April 12, 2021, 7:26pm UTC](https://discuss.elastic.co/t/where-are-shard-relocations-and-failures-logged/269942 "2021-04-12T19:26:21Z")
Hi, We would like to detect when a shard fails, begins relocating off of a node, and finishes relocating. We do use the metrics that show the count of these active operations, but would like to additionally know the spe… --- ## [Display only most recent log per host - Complete Newb](https://discuss.elastic.co/t/display-only-most-recent-log-per-host-complete-newb/269712)
**Author:** [@Jspang01](https://discuss.elastic.co/u/Jspang01)\ **Replies:** 4\ **Last updated:** [April 12, 2021, 7:18pm UTC](https://discuss.elastic.co/t/display-only-most-recent-log-per-host-complete-newb/269712 "2021-04-12T19:18:54Z")
Hello There All, This is my first post. I fully admit that I am a total newb to Kibana. Up until this past month I was only using it to view data that we have. But I am slowly starting to be tasked with making up new v… --- ## [\_id value is getting changed in elastic](https://discuss.elastic.co/t/id-value-is-getting-changed-in-elastic/268905)
**Author:** [@gbandasha](https://discuss.elastic.co/u/gbandasha)\ **Replies:** 12\ **Last updated:** [April 12, 2021, 5:52pm UTC](https://discuss.elastic.co/t/id-value-is-getting-changed-in-elastic/268905 "2021-04-12T17:52:45Z")
I have a unique\_id value in my index and that is also used as the document\_id, but as my document count is increasing drastically I had changed the type from double because that was causing truncation of my values. I cha… --- ## [Logstash fell under load](https://discuss.elastic.co/t/logstash-fell-under-load/269766)
**Author:** [@Andrey\_RF](https://discuss.elastic.co/u/Andrey_RF)\ **Replies:** 14\ **Last updated:** [April 12, 2021, 4:54pm UTC](https://discuss.elastic.co/t/logstash-fell-under-load/269766 "2021-04-12T16:54:31Z")
Hello. I have three clients. They send logs via filebeat to main server with logstash. A few days ago there are a lot of logs somewhere around 12 M in an amount. The logstash couldn't process all this logs and it fell. … --- ## [Watcher Help](https://discuss.elastic.co/t/watcher-help/269711)
**Author:** [@mdamera](https://discuss.elastic.co/u/mdamera)\ **Replies:** 4\ **Last updated:** [April 12, 2021, 4:53pm UTC](https://discuss.elastic.co/t/watcher-help/269711 "2021-04-12T16:53:04Z")
Team, I have a need to monitor "code \[" in the filebeat logs and it should trigger an email alert when it find the word "code \[" I have tried with below string, but it did not helped me, instead of looking for "code \["… --- ## [Visualizing Weighted Average Aggregation in Kibana](https://discuss.elastic.co/t/visualizing-weighted-average-aggregation-in-kibana/269901)
**Author:** [@connersexton](https://discuss.elastic.co/u/connersexton)\ **Replies:** 1\ **Last updated:** [April 12, 2021, 3:55pm UTC](https://discuss.elastic.co/t/visualizing-weighted-average-aggregation-in-kibana/269901 "2021-04-12T15:55:42Z")
I've read a lot of documentation regarding single-value weighted average aggregation in Kibana, but can't seem to find anything on the actual application of this in a dashboard or visualization. My knowledge of Kibana sy… --- ## [Logstash with elasticsearch input](https://discuss.elastic.co/t/logstash-with-elasticsearch-input/269783)
**Author:** [@Kfiro](https://discuss.elastic.co/u/Kfiro)\ **Replies:** 5\ **Last updated:** [April 12, 2021, 3:50pm UTC](https://discuss.elastic.co/t/logstash-with-elasticsearch-input/269783 "2021-04-12T15:50:41Z")
Hi Masters, I'm trying to use Logsash with "elasticsearch" input for taking specific events from winlogbeat Index and write them to another Index, I have a problem with the "query" on the input section, when I'm tryi… --- ## [RemoteTransportException cannot be cast to class org.elasticsearch.index.IndexNotFoundException after upgrade to 7.11.2 from 7.6.0](https://discuss.elastic.co/t/remotetransportexception-cannot-be-cast-to-class-org-elasticsearch-index-indexnotfoundexception-after-upgrade-to-7-11-2-from-7-6-0/268121)
**Author:** [@Brady\_Davis](https://discuss.elastic.co/u/Brady_Davis)\ **Replies:** 4\ **Last updated:** [April 12, 2021, 3:46pm UTC](https://discuss.elastic.co/t/remotetransportexception-cannot-be-cast-to-class-org-elasticsearch-index-indexnotfoundexception-after-upgrade-to-7-11-2-from-7-6-0/268121 "2021-04-12T15:46:19Z")
Hello, We recently upgraded our elasticsearch stack to 7.11.2 from 7.6.0 and are seeing an issue when attempting PUTS on indexes that don't exist: "message": "failed to handle exception response \[org.elasticsearch.tran… --- ## [Logstash jdbc input plugin mongodb driver can not query time range](https://discuss.elastic.co/t/logstash-jdbc-input-plugin-mongodb-driver-can-not-query-time-range/269879)
**Author:** [@john.zhang](https://discuss.elastic.co/u/john.zhang)\ **Replies:** 1\ **Last updated:** [April 12, 2021, 3:43pm UTC](https://discuss.elastic.co/t/logstash-jdbc-input-plugin-mongodb-driver-can-not-query-time-range/269879 "2021-04-12T15:43:43Z")
Hi, Please help . I want to search records in mongodb during 3 days. this is my logstash conf: input { jdbc { jdbc\_driver\_class =\> "com.dbschema.MongoJdbcDriver" jdbc\_driver\_library =\> "/usr/share/logstash/logstas… --- ## [Дублирование документов](https://discuss.elastic.co/t/topic/269805)
**Author:** [@frostwar](https://discuss.elastic.co/u/frostwar)\ **Replies:** 1\ **Last updated:** [April 12, 2021, 3:13pm UTC](https://discuss.elastic.co/t/topic/269805 "2021-04-12T15:13:35Z")
Добрый день. У нас Logstash забирает данные из стороннего ELK стека. Появилось "задваивание" данных на нашей стороне. На стороне первоистоника все данные уникальны. Грубо говоря вижу одинаковые документы, которые проду… --- ## [Collapsible TreeFlow](https://discuss.elastic.co/t/collapsible-treeflow/269283)
**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\ **Replies:** 2\ **Last updated:** [April 12, 2021, 3:05pm UTC](https://discuss.elastic.co/t/collapsible-treeflow/269283 "2021-04-12T15:05:38Z")
Kibana version : 7.9 Elasticsearch version : 7.9 APM Server version : 7.9 APM Agent language and version : java 1.8 Fresh install or upgraded from other version? fresh install Is there anything special in your setup… --- ## [Перепарсинг существующих индексов Logstash](https://discuss.elastic.co/t/logstash/269025)
**Author:** [@frostwar](https://discuss.elastic.co/u/frostwar)\ **Replies:** 11\ **Last updated:** [April 12, 2021, 2:58pm UTC](https://discuss.elastic.co/t/logstash/269025 "2021-04-12T14:58:48Z")
Как перепарсить через Logstash существующие индексы? У меня в Logstash приходили FileBeat какое-то время. Потом появилась задача выделять отдельные поля. Изменил конфиг, но применяется только ко вновь поступившим данным… --- ## [Is there any alternate way for connecting Elasticsearch from C++ code except ODBC?](https://discuss.elastic.co/t/is-there-any-alternate-way-for-connecting-elasticsearch-from-c-code-except-odbc/269837)
**Author:** [@onkark](https://discuss.elastic.co/u/onkark)\ **Replies:** 6\ **Last updated:** [April 12, 2021, 2:47pm UTC](https://discuss.elastic.co/t/is-there-any-alternate-way-for-connecting-elasticsearch-from-c-code-except-odbc/269837 "2021-04-12T14:47:06Z")
I tried fetching data of Elasticsearch from C++ code using Elasticsearch ODBC. As elasticsearch is known for its fast fetching speed, I'm not getting the expected performance using ODBC as compared to other RDBMS. So, ca… --- ## [Dropdown custom field aggregation](https://discuss.elastic.co/t/dropdown-custom-field-aggregation/269596)
**Author:** [@bilel\_meddeb](https://discuss.elastic.co/u/bilel_meddeb)\ **Replies:** 1\ **Last updated:** [April 12, 2021, 2:19pm UTC](https://discuss.elastic.co/t/dropdown-custom-field-aggregation/269596 "2021-04-12T14:19:51Z")
HELLO, i'm new in ELK i have table id | f1 | f2 | f3 0 | 10| 15| 2 1 | 30| 5 | 9 2 | 1 | 75| 6 i want to create a dropdown list. that list contain a multi choice (x1 x2 x3) if i choice x1 so the result should be … --- ## [Exporting search results from appsearch](https://discuss.elastic.co/t/exporting-search-results-from-appsearch/269653)
**Author:** [@Michael\_Sor](https://discuss.elastic.co/u/Michael_Sor)\ **Replies:** 1\ **Last updated:** [April 12, 2021, 2:17pm UTC](https://discuss.elastic.co/t/exporting-search-results-from-appsearch/269653 "2021-04-12T14:17:37Z")
Requirement: Export user's search results to excel/csv format. What's the best method to export a user search results to csv/excel format? We are looking at appsearch and was wondering if there's any apis or plugins tha… --- ## [Enrich policy access "\_id" field](https://discuss.elastic.co/t/enrich-policy-access-id-field/269868)
**Author:** [@sam3546](https://discuss.elastic.co/u/sam3546)\ **Replies:** 1\ **Last updated:** [April 12, 2021, 2:15pm UTC](https://discuss.elastic.co/t/enrich-policy-access-id-field/269868 "2021-04-12T14:15:42Z")
I am trying to use an enrich policy to match on a filename and return the \_id fields of that doc to add in as a field in my secondary index. I have two indexes the first has 1 entry with field 'filename'. The second inde… --- ## [Multiple Tenant in O365 module from Filebeat](https://discuss.elastic.co/t/multiple-tenant-in-o365-module-from-filebeat/269445)
**Author:** [@Sebdb3](https://discuss.elastic.co/u/Sebdb3)\ **Replies:** 3\ **Last updated:** [April 12, 2021, 2:14pm UTC](https://discuss.elastic.co/t/multiple-tenant-in-o365-module-from-filebeat/269445 "2021-04-12T14:14:52Z")
Hello everyone ! I recently added the o365 filebeat module for my tenant to a server. Good news it works perfectly but I wanted to add another tenant o365 on the same server, I didn't find any information about that. … --- ## [Errors with authentication to Active Directory](https://discuss.elastic.co/t/errors-with-authentication-to-active-directory/269835)
**Author:** [@rebirther](https://discuss.elastic.co/u/rebirther)\ **Replies:** 2\ **Last updated:** [April 12, 2021, 2:13pm UTC](https://discuss.elastic.co/t/errors-with-authentication-to-active-directory/269835 "2021-04-12T14:13:54Z")
Hello! Please help with this problem! Objective: to implement login to KIbana through authentication in Active Directory. Version Elasticsearch and Kibana: 7.12.0 elastisearch.yml: node.name: node2 node.roles: \[ mas… --- ## [AnomalyDetection: Last bucket is not processed (bug?)](https://discuss.elastic.co/t/anomalydetection-last-bucket-is-not-processed-bug/268715)
**Author:** [@eudaco](https://discuss.elastic.co/u/eudaco)\ **Replies:** 4\ **Last updated:** [April 12, 2021, 1:48pm UTC](https://discuss.elastic.co/t/anomalydetection-last-bucket-is-not-processed-bug/268715 "2021-04-12T13:48:51Z")
Hello everybody. I have faced, as it seems to me, with strange behavior of anomaly detection jobs. The last bucket is not processed when the model\_plot\_config is enabled. For example, when I use a bucket size "1d", th… --- ## [Unable to install Kibana on Windows](https://discuss.elastic.co/t/unable-to-install-kibana-on-windows/269743)
**Author:** [@hussshe](https://discuss.elastic.co/u/hussshe)\ **Replies:** 4\ **Last updated:** [April 12, 2021, 1:39pm UTC](https://discuss.elastic.co/t/unable-to-install-kibana-on-windows/269743 "2021-04-12T13:39:25Z")
Hello, Kibana Version: 7.12.0- Windows I am unable to install Kibana though the Elastic search is up and running on http://localhost:9200/. The following are the commands I ran in Command prompt C:\>cd C:\\kibana\\kiban… --- ## [Logstash 7.9 high CPU, RAM and hangs when a unicode message is received by syslog input](https://discuss.elastic.co/t/logstash-7-9-high-cpu-ram-and-hangs-when-a-unicode-message-is-received-by-syslog-input/269885)
**Author:** [@ivorthe3ngine](https://discuss.elastic.co/u/ivorthe3ngine)\ **Replies:** 0\ **Last updated:** [April 12, 2021, 1:36pm UTC](https://discuss.elastic.co/t/logstash-7-9-high-cpu-ram-and-hangs-when-a-unicode-message-is-received-by-syslog-input/269885 "2021-04-12T13:36:45Z")
Hi All, any assistance on this issue would be most appreciated. On receiving the following message, logstash stopped processing any further incoming messages and began consuming high CPU. Version: 7.9.0 Operating Syst… --- ## [Elasticsearch connection to kiabana](https://discuss.elastic.co/t/elasticsearch-connection-to-kiabana/269870)
**Author:** [@divakar\_maradana](https://discuss.elastic.co/u/divakar_maradana)\ **Replies:** 4\ **Last updated:** [April 12, 2021, 12:52pm UTC](https://discuss.elastic.co/t/elasticsearch-connection-to-kiabana/269870 "2021-04-12T12:52:04Z")
HI team, I am having 2 instances, elasticsearch on 1 instance and kiabana on another instance. can u please help how to establish a connection between these es and kibana. \[image\] --- ## [Logstash](https://discuss.elastic.co/t/logstash/269583)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 2\ **Last updated:** [April 12, 2021, 12:03pm UTC](https://discuss.elastic.co/t/logstash/269583 "2021-04-12T12:03:12Z")
hi i hope this message finds you well , so how can configure High availibility between 2 logstash ? regards --- ## [Use Existing Claim in Helm chart](https://discuss.elastic.co/t/use-existing-claim-in-helm-chart/269873)
**Author:** [@Balha](https://discuss.elastic.co/u/Balha)\ **Replies:** 0\ **Last updated:** [April 12, 2021, 11:54am UTC](https://discuss.elastic.co/t/use-existing-claim-in-helm-chart/269873 "2021-04-12T11:54:21Z")
Hello, I've installed elastic search with helm chart in k8s and want to specify an existing volume claim as vaules . Dose the chart support this feacher ? Br, Bilel --- ## [PacketBeats Oracle support](https://discuss.elastic.co/t/packetbeats-oracle-support/268582)
**Author:** [@tmihaldinec](https://discuss.elastic.co/u/tmihaldinec)\ **Replies:** 3\ **Last updated:** [April 12, 2021, 11:36am UTC](https://discuss.elastic.co/t/packetbeats-oracle-support/268582 "2021-04-12T11:36:24Z")
Dear all, is there any plan to support Oracle with packetbeat? Most of system we use are using Oracle DB and it would be awesome to have this feature Thanks tomislav [Previous page](https://discuss.elastic.co/latest.md?page=1735) [Next page](https://discuss.elastic.co/latest.md?page=1737)