# Latest **URL:** https://discuss.elastic.co/latest.md?page=1778 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1779 --- ## [Weekly index cleanup using curator 5.8](https://discuss.elastic.co/t/weekly-index-cleanup-using-curator-5-8/267354)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 7\ **Last updated:** [March 18, 2021, 2:40pm UTC](https://discuss.elastic.co/t/weekly-index-cleanup-using-curator-5-8/267354 "2021-03-18T14:40:43Z")
I am trying to clean weekly indexes older than 4 weeks on elasticsearch 7.x however not able to figure out the curator config Current config is - filtertype: period period\_type: relative source: name … --- ## [Oracle DB - JDBC Plugin high load](https://discuss.elastic.co/t/oracle-db-jdbc-plugin-high-load/267680)
**Author:** [@FALEN](https://discuss.elastic.co/u/FALEN)\ **Replies:** 0\ **Last updated:** [March 18, 2021, 2:08pm UTC](https://discuss.elastic.co/t/oracle-db-jdbc-plugin-high-load/267680 "2021-03-18T14:08:06Z")
Hi everyone, I am looking for a way to transfer logs written to the Oracle table to ELK. The plugin seems appropriate, but in the environment I will use, 1tb data per day is written to this Oracle table. In other words,… --- ## [Logstash - Validate the value of a field from the last ingest against the previous one](https://discuss.elastic.co/t/logstash-validate-the-value-of-a-field-from-the-last-ingest-against-the-previous-one/267679)
**Author:** [@Oscar\_Lopez](https://discuss.elastic.co/u/Oscar_Lopez)\ **Replies:** 0\ **Last updated:** [March 18, 2021, 2:06pm UTC](https://discuss.elastic.co/t/logstash-validate-the-value-of-a-field-from-the-last-ingest-against-the-previous-one/267679 "2021-03-18T14:06:55Z")
Good day At the moment in elastic search I am ingesting data from several weblogic servers, and for the data sources I want to make a graph where I can identify when an application changes version. At the moment in a fi… --- ## [ILM delete all indices in X days](https://discuss.elastic.co/t/ilm-delete-all-indices-in-x-days/267127)
**Author:** [@d4nnyx](https://discuss.elastic.co/u/d4nnyx)\ **Replies:** 4\ **Last updated:** [March 18, 2021, 1:35pm UTC](https://discuss.elastic.co/t/ilm-delete-all-indices-in-x-days/267127 "2021-03-18T13:35:25Z")
Hello, I need some help with understanding ILM configuration. Here is my configuration for ILM PUT \_ilm/policy/example { "policy": { "phases": { "hot": { "min\_age": "0ms", "actions": { … --- ## [Monitoring Machine Learning Job States](https://discuss.elastic.co/t/monitoring-machine-learning-job-states/267587)
**Author:** [@saraKM](https://discuss.elastic.co/u/saraKM)\ **Replies:** 1\ **Last updated:** [March 18, 2021, 1:32pm UTC](https://discuss.elastic.co/t/monitoring-machine-learning-job-states/267587 "2021-03-18T13:32:06Z")
Hi, I wonder what would be the best approach to get alerts when a job fails or goes into an unexpected state. I have some failed jobs and some jobs showing closed with started datafeed ( so moving from open/started to c… --- ## [Filebeat iowaits issue?](https://discuss.elastic.co/t/filebeat-iowaits-issue/264663)
**Author:** [@raulgs](https://discuss.elastic.co/u/raulgs)\ **Replies:** 15\ **Last updated:** [March 18, 2021, 1:16pm UTC](https://discuss.elastic.co/t/filebeat-iowaits-issue/264663 "2021-03-18T13:16:57Z")
Hi all, I am running a k8s Cluster that is being suspended every night, due to cost savings, as no one works at this time on the cluster. Unfortunately it seems like fielbeat is not really getting along with that. Ever… --- ## [Need help with aggregation query in ES 6.8](https://discuss.elastic.co/t/need-help-with-aggregation-query-in-es-6-8/267648)
**Author:** [@trak](https://discuss.elastic.co/u/trak)\ **Replies:** 0\ **Last updated:** [March 18, 2021, 11:53am UTC](https://discuss.elastic.co/t/need-help-with-aggregation-query-in-es-6-8/267648 "2021-03-18T11:53:30Z")
I try to make aggregation query with ElasticSearch 6.8: I want to find last documents for specific date, and last documents before specific date, group by documents fields. curl -X PUT "http://localhost:9200/test/x… --- ## [FSCrawler: Error while crawling - Invalid UTF-8 start byte 0xff](https://discuss.elastic.co/t/fscrawler-error-while-crawling-invalid-utf-8-start-byte-0xff/267665)
**Author:** [@HaroldH](https://discuss.elastic.co/u/HaroldH)\ **Replies:** 0\ **Last updated:** [March 18, 2021, 1:08pm UTC](https://discuss.elastic.co/t/fscrawler-error-while-crawling-invalid-utf-8-start-byte-0xff/267665 "2021-03-18T13:08:49Z")
Continuing the discussion from FSCrawler: Error while crawling - Invalid UTF-8 start byte 0xb5: Hi, I have a recent version of fscrawler-es7-2.7-SNAPSHOT installed. I have a folder containing a wide range of document t… --- ## [What snapshot data should I copy from one cluster to another for a migration?](https://discuss.elastic.co/t/what-snapshot-data-should-i-copy-from-one-cluster-to-another-for-a-migration/266969)
**Author:** [@juang](https://discuss.elastic.co/u/juang)\ **Replies:** 2\ **Last updated:** [March 18, 2021, 1:03pm UTC](https://discuss.elastic.co/t/what-snapshot-data-should-i-copy-from-one-cluster-to-another-for-a-migration/266969 "2021-03-18T13:03:46Z")
Hi, I'm trying to migrate some indices from one Elasticsearch cluster to another in a completely different datacenter. They share basically no common infrastructure. Both clusters are on version 1.6.0 and the latter clus… --- ## [Changing the shard size](https://discuss.elastic.co/t/changing-the-shard-size/267359)
**Author:** [@sagar\_rao](https://discuss.elastic.co/u/sagar_rao)\ **Replies:** 7\ **Last updated:** [March 18, 2021, 12:48pm UTC](https://discuss.elastic.co/t/changing-the-shard-size/267359 "2021-03-18T12:48:16Z")
Hi, I have Aws elastic search cluster with two nodes. The data is being pushed from fluentd to elastic search. By default all the indexs have 5 primary shards and 1 replica. And i want to resize the no of primary shard… --- ## [Use case - Rules-Based Pricing with ElasticSearch - Tips](https://discuss.elastic.co/t/use-case-rules-based-pricing-with-elasticsearch-tips/267655)
**Author:** [@Julian\_Alexis\_Correa](https://discuss.elastic.co/u/Julian_Alexis_Correa)\ **Replies:** 0\ **Last updated:** [March 18, 2021, 12:25pm UTC](https://discuss.elastic.co/t/use-case-rules-based-pricing-with-elasticsearch-tips/267655 "2021-03-18T12:25:35Z")
I am implementing a search for products whose prices are calculated based on rules based on the quantity requested. For example: 1 to 5 units -\> price = units \* X + Y 6 to 10 units $ 8 -\> price = units \* Z 11 to 15 un… --- ## [How to fetch substring from an input in logstash](https://discuss.elastic.co/t/how-to-fetch-substring-from-an-input-in-logstash/267035)
**Author:** [@John\_sams](https://discuss.elastic.co/u/John_sams)\ **Replies:** 0\ **Last updated:** [March 12, 2021, 5:23am UTC](https://discuss.elastic.co/t/how-to-fetch-substring-from-an-input-in-logstash/267035 "2021-03-12T05:23:16Z")
"tags":{ "container\_image":"confluentinc/cp-zookeeper:5.4.0@sha256" } How can I fetch docker image tag that is 5.4.0 ? The above is an input log from telegraf. --- ## [Synthetic Monitoring browser timeout](https://discuss.elastic.co/t/synthetic-monitoring-browser-timeout/267620)
**Author:** [@shinmaeng](https://discuss.elastic.co/u/shinmaeng)\ **Replies:** 1\ **Last updated:** [March 18, 2021, 11:31am UTC](https://discuss.elastic.co/t/synthetic-monitoring-browser-timeout/267620 "2021-03-18T11:31:50Z")
Hi, Elastic staffs. I'm testing Synthetic monitoring tool to check my company's website uptime and performance. I'm using your code, config and image that you support on github. I have a question about monitoring cofi… --- ## [I faced not configaration found error in logstash](https://discuss.elastic.co/t/i-faced-not-configaration-found-error-in-logstash/267641)
**Author:** [@Utsav\_Jajadiya](https://discuss.elastic.co/u/Utsav_Jajadiya)\ **Replies:** 0\ **Last updated:** [March 18, 2021, 11:01am UTC](https://discuss.elastic.co/t/i-faced-not-configaration-found-error-in-logstash/267641 "2021-03-18T11:01:24Z")
--- ## [Error: Cannot find module '@kbn/utils'](https://discuss.elastic.co/t/error-cannot-find-module-kbn-utils/267469)
**Author:** [@Azeem\_Sarwar](https://discuss.elastic.co/u/Azeem_Sarwar)\ **Replies:** 2\ **Last updated:** [March 18, 2021, 10:53am UTC](https://discuss.elastic.co/t/error-cannot-find-module-kbn-utils/267469 "2021-03-18T10:53:09Z")
while executing command yarn kbn bootstrap I am facing the issue , Error: Cannot find module '@kbn/utils' ----- Complete log is here root@is-OptiPlex-5050:/home/kibana/kibana# yarn kbn bootstrap yarn run v1.22.5 nod… --- ## [Search Multiple Indices using elastic low level client](https://discuss.elastic.co/t/search-multiple-indices-using-elastic-low-level-client/266683)
**Author:** [@schawla](https://discuss.elastic.co/u/schawla)\ **Replies:** 3\ **Last updated:** [March 18, 2021, 10:44am UTC](https://discuss.elastic.co/t/search-multiple-indices-using-elastic-low-level-client/266683 "2021-03-18T10:44:47Z")
I am trying to use elastic low level client to search multiple indices through - client.LowLevel.Search\(PostData.Serializable(new SearchRequest(new\[\] {"Index1", "Index2"}) { Size = 10, From = 0, Query =… --- ## [Metricbeat - SSL Kafka Output (Failed authentication)](https://discuss.elastic.co/t/metricbeat-ssl-kafka-output-failed-authentication/267261)
**Author:** [@marti1](https://discuss.elastic.co/u/marti1)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 12:32pm UTC](https://discuss.elastic.co/t/metricbeat-ssl-kafka-output-failed-authentication/267261 "2021-03-15T12:32:32Z")
Hi, I'm trying to configure a secure connection (SSL) between my beat (metricbeat windows) and kafka server, but the handshake is failing. Is my configuration metricbeat.yml OK? output.kafka: # Active enabled: tr… --- ## [Logstash HTTP Output Plugin Error Could not fetch URL, Network is unreachable (connect failed)](https://discuss.elastic.co/t/logstash-http-output-plugin-error-could-not-fetch-url-network-is-unreachable-connect-failed/267633)
**Author:** [@kumarvijender](https://discuss.elastic.co/u/kumarvijender)\ **Replies:** 0\ **Last updated:** [March 18, 2021, 10:04am UTC](https://discuss.elastic.co/t/logstash-http-output-plugin-error-could-not-fetch-url-network-is-unreachable-connect-failed/267633 "2021-03-18T10:04:08Z")
I have configured a couple of pipelines in logstash, In one of the pipeline I have configured an http out plugin like output { http { url =\> "url" http\_method =\> "post" request\_timeout =\> \ aut… --- ## [Filebeat events doesnt come with ECS compatibility while coming through Logstash](https://discuss.elastic.co/t/filebeat-events-doesnt-come-with-ecs-compatibility-while-coming-through-logstash/266744)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 11\ **Last updated:** [March 18, 2021, 9:52am UTC](https://discuss.elastic.co/t/filebeat-events-doesnt-come-with-ecs-compatibility-while-coming-through-logstash/266744 "2021-03-18T09:52:11Z")
I am using the Filebeat AWS module to fetch Cloudtrail logs. To load the dashboards, first I configured Filebet output to Elasticsearch and send some data to test and it was having ECS field names. However, while I sent … --- ## [How to get Elasticsearch query of a kibana visualization](https://discuss.elastic.co/t/how-to-get-elasticsearch-query-of-a-kibana-visualization/267606)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 2\ **Last updated:** [March 18, 2021, 9:03am UTC](https://discuss.elastic.co/t/how-to-get-elasticsearch-query-of-a-kibana-visualization/267606 "2021-03-18T09:03:00Z")
Hi all, I'm trying to get elasticsearch query for a kibana visualization in 7.9 version. When i copy request code present in a visualization and run it in dev tools,i get error. So what is right procedure to fetch ex… --- ## [Inconsistent behaviour of the UAX URL email tokenizer?](https://discuss.elastic.co/t/inconsistent-behaviour-of-the-uax-url-email-tokenizer/267493)
**Author:** [@jakopako](https://discuss.elastic.co/u/jakopako)\ **Replies:** 0\ **Last updated:** [March 17, 2021, 11:59am UTC](https://discuss.elastic.co/t/inconsistent-behaviour-of-the-uax-url-email-tokenizer/267493 "2021-03-17T11:59:05Z")
The following two queries extract urls in different ways and I am wondering whether this is a bug. In the first case the ' following the url is part of the extracted token whereas in the second case it is not. This seems… --- ## [More granular logging](https://discuss.elastic.co/t/more-granular-logging/267099)
**Author:** [@Beltiras](https://discuss.elastic.co/u/Beltiras)\ **Replies:** 2\ **Last updated:** [March 18, 2021, 9:33am UTC](https://discuss.elastic.co/t/more-granular-logging/267099 "2021-03-18T09:33:56Z")
I'm using a really simple setup of APM, Kibana and Elasticsearch to get visibility on a Django webapp running in a container through Gunicorn. It's performance is stuttering once in a while and I can't see a reason for i… --- ## [JVM Consumption continuously increasing](https://discuss.elastic.co/t/jvm-consumption-continuously-increasing/267024)
**Author:** [@cjc](https://discuss.elastic.co/u/cjc)\ **Replies:** 4\ **Last updated:** [March 18, 2021, 9:06am UTC](https://discuss.elastic.co/t/jvm-consumption-continuously-increasing/267024 "2021-03-18T09:06:05Z")
Hi, I'm new in Elasticsearch and I'm encountering a recurring high JVM issue. I don't see anything from the logs aside from a dangled index which keep trying to reimport. just want to know if this dangled index (.watch… --- ## [How To set JAVA\_HOME separately för Elsticsearch](https://discuss.elastic.co/t/how-to-set-java-home-separately-for-elsticsearch/267626)
**Author:** [@Ahmad1](https://discuss.elastic.co/u/Ahmad1)\ **Replies:** 0\ **Last updated:** [March 18, 2021, 8:49am UTC](https://discuss.elastic.co/t/how-to-set-java-home-separately-for-elsticsearch/267626 "2021-03-18T08:49:13Z")
Hi I have an Elasticsearch cluster with four nodes on different servers! I need to customize JAVA\_HOME only for ES, as I have other applications that use different versions of JAVA on the same environment! --- ## [Kibana v7.11.2 not showing the graph and time range for that data](https://discuss.elastic.co/t/kibana-v7-11-2-not-showing-the-graph-and-time-range-for-that-data/267466)
**Author:** [@screwyy](https://discuss.elastic.co/u/screwyy)\ **Replies:** 2\ **Last updated:** [March 18, 2021, 7:58am UTC](https://discuss.elastic.co/t/kibana-v7-11-2-not-showing-the-graph-and-time-range-for-that-data/267466 "2021-03-18T07:58:03Z")
Hello, I just upgraded elasticsearch and kibana from v7.10.0 to v7.11.2 and kibana in discover tab does not show the graph and there is no possibility to select a time range Also saved objects were no migrated … --- ## [Can't change a field type](https://discuss.elastic.co/t/cant-change-a-field-type/267382)
**Author:** [@msieumouche](https://discuss.elastic.co/u/msieumouche)\ **Replies:** 3\ **Last updated:** [March 18, 2021, 7:57am UTC](https://discuss.elastic.co/t/cant-change-a-field-type/267382 "2021-03-18T07:57:10Z")
Hello everyone, I have a stack with ELK and wazuh, I'm looking to change the type of some fields ("keyword" to "ip") to personal fields (srcip, dstip, etc.) Their search fields in kibana are data.srcip, etc. I tried t… --- ## [Winlogbeat Parser Modification](https://discuss.elastic.co/t/winlogbeat-parser-modification/267385)
**Author:** [@deeshu](https://discuss.elastic.co/u/deeshu)\ **Replies:** 3\ **Last updated:** [March 18, 2021, 7:09am UTC](https://discuss.elastic.co/t/winlogbeat-parser-modification/267385 "2021-03-18T07:09:39Z")
Hi Experts.. I've to parse some windows security events which are currently not supported by Winlogbeat and looking to modify the existing parsing capability of Winlogbeat. Looking at the file, it seems that "/module/s… --- ## [Elasticsearch process exits abnormally](https://discuss.elastic.co/t/elasticsearch-process-exits-abnormally/267603)
**Author:** [@bxl](https://discuss.elastic.co/u/bxl)\ **Replies:** 1\ **Last updated:** [March 18, 2021, 7:05am UTC](https://discuss.elastic.co/t/elasticsearch-process-exits-abnormally/267603 "2021-03-18T07:05:48Z")
elasticsearch process exits abnormally system：CentOS Linux release 7.4.1708 (Core) 3.10.0-693.el7.x86\_64 #1 SMP Tue Aug 22 21:09:27 UTC 2017 x86\_64 x86\_64 x86\_64 GNU/Linux openjdk version "1.8.0\_252" OpenJDK Runtime … --- ## [Steps to perform for changing the data mount in ES](https://discuss.elastic.co/t/steps-to-perform-for-changing-the-data-mount-in-es/267605)
**Author:** [@Jax\_dev](https://discuss.elastic.co/u/Jax_dev)\ **Replies:** 0\ **Last updated:** [March 18, 2021, 7:02am UTC](https://discuss.elastic.co/t/steps-to-perform-for-changing-the-data-mount-in-es/267605 "2021-03-18T07:02:19Z")
Do we have any recommended approach to change the data mount path ( path.data ) in elastic\_search.yaml ? One of the elastic node in the cluster of 4, have mounted into /var/lib/elastic, I want to change this to /data/el… --- ## [Log message format remove event.dataset](https://discuss.elastic.co/t/log-message-format-remove-event-dataset/267523)
**Author:** [@glucaci](https://discuss.elastic.co/u/glucaci)\ **Replies:** 1\ **Last updated:** [March 18, 2021, 6:38am UTC](https://discuss.elastic.co/t/log-message-format-remove-event-dataset/267523 "2021-03-18T06:38:25Z")
The APM Overview shows the logs graphics only if I set the event.dataset but on the other hand if I set it in all Logs message field I see first the event.dataset. Log message pattern: \[event.dataset\] \[log.level\] \[messa… [Previous page](https://discuss.elastic.co/latest.md?page=1777) [Next page](https://discuss.elastic.co/latest.md?page=1779)