# Latest **URL:** https://discuss.elastic.co/latest.md?page=1793 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1794 --- ## [Strange error - 'provisioner-\*' index pattern doesn't have a scripted field called 'kubernetes.labels.eks\_amazonaws\_com'](https://discuss.elastic.co/t/strange-error-provisioner-index-pattern-doesnt-have-a-scripted-field-called-kubernetes-labels-eks-amazonaws-com/266621)
**Author:** [@pingz](https://discuss.elastic.co/u/pingz)\ **Replies:** 0\ **Last updated:** [March 9, 2021, 12:13am UTC](https://discuss.elastic.co/t/strange-error-provisioner-index-pattern-doesnt-have-a-scripted-field-called-kubernetes-labels-eks-amazonaws-com/266621 "2021-03-09T00:13:52Z")
I have an elastic index pattern named "provisoner-\*" that contains field "kubernetes.labels.eks\_amazonaws\_com/component" I noticed that whenever I tried to edit a field that contains character '/', in Kinana index patter… --- ## [How to automatically delete documents older than 3 months](https://discuss.elastic.co/t/how-to-automatically-delete-documents-older-than-3-months/265851)
**Author:** [@kate\_yxy](https://discuss.elastic.co/u/kate_yxy)\ **Replies:** 7\ **Last updated:** [March 9, 2021, 10:22pm UTC](https://discuss.elastic.co/t/how-to-automatically-delete-documents-older-than-3-months/265851 "2021-03-09T22:22:06Z")
Hey, I want to delete documents older than 3 months in my index. And I have read the doc here about using ILM to create time-based indices and apply ILM policies. However, this doesn't seem to fit our use case. We're us… --- ## [I downloaded and installed elasticsearch](https://discuss.elastic.co/t/i-downloaded-and-installed-elasticsearch/266623)
**Author:** [@PaulGureghian](https://discuss.elastic.co/u/PaulGureghian)\ **Replies:** 4\ **Last updated:** [March 9, 2021, 10:21pm UTC](https://discuss.elastic.co/t/i-downloaded-and-installed-elasticsearch/266623 "2021-03-09T22:21:54Z")
\*\*On Linux Mint. I extracted the archive tar.gz and cd into elasticsearch dir and ran ./bin/elasticsearch, \*\* The error message was: could not find java in the bundled jdk dir. I have Open JDK already installed on my s… --- ## [Snapshot and restore users, spaces and aliases](https://discuss.elastic.co/t/snapshot-and-restore-users-spaces-and-aliases/264200)
**Author:** [@martinsz](https://discuss.elastic.co/u/martinsz)\ **Replies:** 2\ **Last updated:** [March 9, 2021, 9:34pm UTC](https://discuss.elastic.co/t/snapshot-and-restore-users-spaces-and-aliases/264200 "2021-03-09T21:34:53Z")
Hello, we are finally moving ahead with STIRing our data (earlier post for context https://discuss.elastic.co/t/help-a-non-profit-stir-the-data/251589 ) And we have now found challenges while moving data to the main clus… --- ## [REST API for setting default landing page and index pattern for a space](https://discuss.elastic.co/t/rest-api-for-setting-default-landing-page-and-index-pattern-for-a-space/266412)
**Author:** [@umesh2020](https://discuss.elastic.co/u/umesh2020)\ **Replies:** 6\ **Last updated:** [March 9, 2021, 8:45pm UTC](https://discuss.elastic.co/t/rest-api-for-setting-default-landing-page-and-index-pattern-for-a-space/266412 "2021-03-09T20:45:24Z")
Hi Is there a REST API for setting the default landing page and index pattern for a space ? I want to programatically create a space and set these attributes. Thanks Umesha --- ## ["enabing" security on an existing multinode cluster with multiple clients](https://discuss.elastic.co/t/enabing-security-on-an-existing-multinode-cluster-with-multiple-clients/266753)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 0\ **Last updated:** [March 9, 2021, 8:19pm UTC](https://discuss.elastic.co/t/enabing-security-on-an-existing-multinode-cluster-with-multiple-clients/266753 "2021-03-09T20:19:41Z")
I am trying to plan how to "enable security" on my cluster with the minimum of disruption to data collection. Most of the documentation focuses on how to do this when starting up a new installation (unsurprisingly). In… --- ## [Increase elasticsearch version when importing resthighlevelclient](https://discuss.elastic.co/t/increase-elasticsearch-version-when-importing-resthighlevelclient/266735)
**Author:** [@Carlos\_Fernando\_Palm](https://discuss.elastic.co/u/Carlos_Fernando_Palm)\ **Replies:** 2\ **Last updated:** [March 9, 2021, 8:14pm UTC](https://discuss.elastic.co/t/increase-elasticsearch-version-when-importing-resthighlevelclient/266735 "2021-03-09T20:14:32Z")
Hello people. I am using resthighlevelclient to connect to elasticsearch 7.9.3. Now I have done by importing all of this: \ \org.elasticsearch.client\ \ela… --- ## [How to limit the Relate search terms suggestion](https://discuss.elastic.co/t/how-to-limit-the-relate-search-terms-suggestion/266752)
**Author:** [@RKSKirpalani](https://discuss.elastic.co/u/RKSKirpalani)\ **Replies:** 0\ **Last updated:** [March 9, 2021, 8:14pm UTC](https://discuss.elastic.co/t/how-to-limit-the-relate-search-terms-suggestion/266752 "2021-03-09T20:14:11Z")
I use ES 6.5 in my Magento 2.3 website, when i search anything on my website, The search terms are appearing many line that full my mobile view website. how i can limit this to 2 suggestion. with regards, R.Sahu --- ## [Ingest pipeline script field math](https://discuss.elastic.co/t/ingest-pipeline-script-field-math/265136)
**Author:** [@gentle\_ghost](https://discuss.elastic.co/u/gentle_ghost)\ **Replies:** 6\ **Last updated:** [March 9, 2021, 7:54pm UTC](https://discuss.elastic.co/t/ingest-pipeline-script-field-math/265136 "2021-03-09T19:54:48Z")
Hello, I'm trying to create a ingest processor pipeline in kibana and could use some help. I'm trying to divide 2 values by each other which is the problem. Value 1 is an integer and Value 2 is a string. I'd like to … --- ## [Stop exporting logs after file reaches a certain size](https://discuss.elastic.co/t/stop-exporting-logs-after-file-reaches-a-certain-size/266652)
**Author:** [@agushchin](https://discuss.elastic.co/u/agushchin)\ **Replies:** 1\ **Last updated:** [March 9, 2021, 7:49pm UTC](https://discuss.elastic.co/t/stop-exporting-logs-after-file-reaches-a-certain-size/266652 "2021-03-09T19:49:03Z")
Hi, I have the following question/problem: is there a way to stop exporting/propagating logs (either by filebeat or logstash) after the log file reaches a certain size limit? Asking because recently faced an issue caused… --- ## [Filebeat and IIS W3C dynamic headers support](https://discuss.elastic.co/t/filebeat-and-iis-w3c-dynamic-headers-support/265519)
**Author:** [@BkQc](https://discuss.elastic.co/u/BkQc)\ **Replies:** 1\ **Last updated:** [March 9, 2021, 7:25pm UTC](https://discuss.elastic.co/t/filebeat-and-iis-w3c-dynamic-headers-support/265519 "2021-03-09T19:25:45Z")
Is there any existing module that is enable to automatically account for fields definition in the W3C logs? If not, would it be possible to consider developping one? I know there already is an IIS module but it is based … --- ## [KV Filter Regex](https://discuss.elastic.co/t/kv-filter-regex/266730)
**Author:** [@lumi](https://discuss.elastic.co/u/lumi)\ **Replies:** 1\ **Last updated:** [March 9, 2021, 6:13pm UTC](https://discuss.elastic.co/t/kv-filter-regex/266730 "2021-03-09T18:13:28Z")
Hello I have the following message getting from Qradar: ( I have changed some things like ID, logon etc...) A network share object was accessed. Subject: Security ID: ELK\\\\test-test$ Account Name: test-test$ Acc… --- ## [Best layout for inventory Data](https://discuss.elastic.co/t/best-layout-for-inventory-data/266542)
**Author:** [@Eric007](https://discuss.elastic.co/u/Eric007)\ **Replies:** 2\ **Last updated:** [March 9, 2021, 6:13pm UTC](https://discuss.elastic.co/t/best-layout-for-inventory-data/266542 "2021-03-09T18:13:15Z")
Hi, I am realatively new to the topic of Elasticsearch and Kibana. I have set up a small infrastructure with Logstash, Elastisearch and Kibana. Currently, files are successfully routed to my custom index via Logsatash a… --- ## [Elk stack for Network Management - Use Case Confirmation - Discussion](https://discuss.elastic.co/t/elk-stack-for-network-management-use-case-confirmation-discussion/266732)
**Author:** [@marc1](https://discuss.elastic.co/u/marc1)\ **Replies:** 0\ **Last updated:** [March 9, 2021, 5:58pm UTC](https://discuss.elastic.co/t/elk-stack-for-network-management-use-case-confirmation-discussion/266732 "2021-03-09T17:58:05Z")
Hello, I had worked pretty extensively with ELK version 6.x a couple of years ago. I tried out version 7.1x yesterday and was blown away by the improvements that have been added to the platform. Truly great stuff. The … --- ## [I need to transform String field with numbers in format (yyyyddmmHHMM) to a Date field](https://discuss.elastic.co/t/i-need-to-transform-string-field-with-numbers-in-format-yyyyddmmhhmm-to-a-date-field/266727)
**Author:** [@jonhmb](https://discuss.elastic.co/u/jonhmb)\ **Replies:** 2\ **Last updated:** [March 9, 2021, 5:44pm UTC](https://discuss.elastic.co/t/i-need-to-transform-string-field-with-numbers-in-format-yyyyddmmhhmm-to-a-date-field/266727 "2021-03-09T17:44:38Z")
I have logs from a Jenkins application and I need this LastCommitDate to be really a date, but it is a String How can i transform it to a Date field? I need to transform even the past logs, so it will propably be need… --- ## [Convert field containing a timestamp from string to a date / time or timestamp?](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 47\ **Last updated:** [March 9, 2021, 5:34pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594 "2021-03-09T17:34:55Z")
Hello As you can observe here, I have a two fields containing date and time: Id like to change it so Elastic stores it as a date/time and maybe even change the order (yyyy/mm/dd hh/mm ) How can I change this? My lo… --- ## [Wildcard index pattern matching non-system indices, 7.10.2 edition](https://discuss.elastic.co/t/wildcard-index-pattern-matching-non-system-indices-7-10-2-edition/263934)
**Author:** [@Supermathie](https://discuss.elastic.co/u/Supermathie)\ **Replies:** 4\ **Last updated:** [March 9, 2021, 5:30pm UTC](https://discuss.elastic.co/t/wildcard-index-pattern-matching-non-system-indices-7-10-2-edition/263934 "2021-03-09T17:30:12Z")
Allegedly in Kibana 7.10.2 this pattern is supposed to match only user indices: but it's definitely picking up fields from system indices: Is this supposed to work now in 7+ or do we need to keep using this w… --- ## [Logstash ternary condition when a winlogbeat field doesn't exist](https://discuss.elastic.co/t/logstash-ternary-condition-when-a-winlogbeat-field-doesnt-exist/266721)
**Author:** [@mguttula](https://discuss.elastic.co/u/mguttula)\ **Replies:** 4\ **Last updated:** [March 9, 2021, 5:17pm UTC](https://discuss.elastic.co/t/logstash-ternary-condition-when-a-winlogbeat-field-doesnt-exist/266721 "2021-03-09T17:17:04Z")
Logstash is sending winlogbeat fields to Spunk and when the fields don't exist it is send something like %{\[winlog\]\[event\_data\]\[AuthenticationPackageName\]} I am trying to find a way to either not send the field if it do… --- ## [Reindex w/field collapsing](https://discuss.elastic.co/t/reindex-w-field-collapsing/266725)
**Author:** [@F\_Doe\_FW](https://discuss.elastic.co/u/F_Doe_FW)\ **Replies:** 0\ **Last updated:** [March 9, 2021, 4:51pm UTC](https://discuss.elastic.co/t/reindex-w-field-collapsing/266725 "2021-03-09T16:51:58Z")
Is there any way to collapse results with ReIndexing? I have a source index and want to get the most used pieces out, and only return their 'natural' key into a new index. I can't figure out how to stuff the collapse l… --- ## [Sync data from mongodb](https://discuss.elastic.co/t/sync-data-from-mongodb/266719)
**Author:** [@Gharsa\_Khouloud](https://discuss.elastic.co/u/Gharsa_Khouloud)\ **Replies:** 1\ **Last updated:** [March 9, 2021, 4:24pm UTC](https://discuss.elastic.co/t/sync-data-from-mongodb/266719 "2021-03-09T16:24:43Z")
I just want to sync the data from mongodb to elastic using logstash. Its working good, when any new record comes in mongodb, logstash pushes into elastic. But when I update any record in mongodb then it does not change i… --- ## [Aggregation query returning single word results](https://discuss.elastic.co/t/aggregation-query-returning-single-word-results/266718)
**Author:** [@aanders50](https://discuss.elastic.co/u/aanders50)\ **Replies:** 0\ **Last updated:** [March 9, 2021, 4:06pm UTC](https://discuss.elastic.co/t/aggregation-query-returning-single-word-results/266718 "2021-03-09T16:06:54Z")
Hello! Just wanted to preface that I am new to ElasticSearch so I apologize if I am missing any basic concepts. I have an issue and I saw some other similar articles, but they were from quite awhile back and wanted to v… --- ## [Sending data from mongodb to Elasticsearch](https://discuss.elastic.co/t/sending-data-from-mongodb-to-elasticsearch/266706)
**Author:** [@Laetitia\_RICHARD](https://discuss.elastic.co/u/Laetitia_RICHARD)\ **Replies:** 2\ **Last updated:** [March 9, 2021, 3:42pm UTC](https://discuss.elastic.co/t/sending-data-from-mongodb-to-elasticsearch/266706 "2021-03-09T15:42:47Z")
Hello, I would like to send data from mongodb in Elasticsearch, I saw a lot of different plugins like monstache, mongo-connector, but I'd like to have your recommendations for indexing this data, knowing that I will hav… --- ## [How to make difference between 2 source of logs in Logstash input](https://discuss.elastic.co/t/how-to-make-difference-between-2-source-of-logs-in-logstash-input/266709)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 1\ **Last updated:** [March 9, 2021, 3:35pm UTC](https://discuss.elastic.co/t/how-to-make-difference-between-2-source-of-logs-in-logstash-input/266709 "2021-03-09T15:35:50Z")
Hello everyone, I want to send log of the "auth.log" file using system module of filebeat, and I have another file that I want to parse using logstash (as there is no module for that type of log). And as I know, there … --- ## [Metrics: There is no data to display (error while fetching resource)](https://discuss.elastic.co/t/metrics-there-is-no-data-to-display-error-while-fetching-resource/266714)
**Author:** [@feva](https://discuss.elastic.co/u/feva)\ **Replies:** 0\ **Last updated:** [March 9, 2021, 3:27pm UTC](https://discuss.elastic.co/t/metrics-there-is-no-data-to-display-error-while-fetching-resource/266714 "2021-03-09T15:27:16Z")
Hello, I have som troubles with metricbeat and Metrics App in Kibana. I am using metricbeat 7.10 and Kibana 7.10 on a Windows Server 2019. Every now and then I get an error message when I open Metrics App in Kibana: Er… --- ## [No document in index, but index stats reports numerous docs](https://discuss.elastic.co/t/no-document-in-index-but-index-stats-reports-numerous-docs/266708)
**Author:** [@zarak](https://discuss.elastic.co/u/zarak)\ **Replies:** 4\ **Last updated:** [March 9, 2021, 3:13pm UTC](https://discuss.elastic.co/t/no-document-in-index-but-index-stats-reports-numerous-docs/266708 "2021-03-09T15:13:52Z")
Hi ! I have an index that reports me some documents in Kibana in Index management, as well as in its stats: GET /v2-logs-000003/\_stats { "\_shards" : { "total" : 6, "successful" : 6, "f… --- ## [Filebeat to index with different structures](https://discuss.elastic.co/t/filebeat-to-index-with-different-structures/266565)
**Author:** [@Edi1](https://discuss.elastic.co/u/Edi1)\ **Replies:** 6\ **Last updated:** [March 9, 2021, 2:00pm UTC](https://discuss.elastic.co/t/filebeat-to-index-with-different-structures/266565 "2021-03-09T14:00:01Z")
Hello, newby here, My task is to take multiple (8) logs with different formats and using filebeat send them directly to elastic. They should all end inside the same index and each log should be searchable using "level" … --- ## [Get only one level of documents when using path-hierarchy tokenizer](https://discuss.elastic.co/t/get-only-one-level-of-documents-when-using-path-hierarchy-tokenizer/266704)
**Author:** [@avhvr](https://discuss.elastic.co/u/avhvr)\ **Replies:** 0\ **Last updated:** [March 9, 2021, 1:53pm UTC](https://discuss.elastic.co/t/get-only-one-level-of-documents-when-using-path-hierarchy-tokenizer/266704 "2021-03-09T13:53:01Z")
Hi, I need to search documents (employee details) that are present in a tree structure. The number of levels in the hierarchy could be any. . Using path-hierarchy tokenizer and this post, I was able to index them and… --- ## [Logstash Performance Leak When Consuming Kafka Topic into Elasticsearch](https://discuss.elastic.co/t/logstash-performance-leak-when-consuming-kafka-topic-into-elasticsearch/266685)
**Author:** [@davidb](https://discuss.elastic.co/u/davidb)\ **Replies:** 0\ **Last updated:** [March 9, 2021, 11:39am UTC](https://discuss.elastic.co/t/logstash-performance-leak-when-consuming-kafka-topic-into-elasticsearch/266685 "2021-03-09T11:39:13Z")
Greetings, I am facing a problem regarding logstash perfomance degradation over time. Any advice or hint is welcome. Thanks very much in advance. Short summary Logstash suffers from a perfomance leak over time. The data… --- ## [HPA for clients in helm chart](https://discuss.elastic.co/t/hpa-for-clients-in-helm-chart/266694)
**Author:** [@adrobisch](https://discuss.elastic.co/u/adrobisch)\ **Replies:** 0\ **Last updated:** [March 9, 2021, 12:27pm UTC](https://discuss.elastic.co/t/hpa-for-clients-in-helm-chart/266694 "2021-03-09T12:27:30Z")
Hi, we are running the official k8s helm chart are wondering why there is no HPA support for the client node group? We are aware that it would not be a good idea on the data / master nodes and that the clients also mai… --- ## [Problem with email\_from\_field use in elastalert](https://discuss.elastic.co/t/problem-with-email-from-field-use-in-elastalert/266688)
**Author:** [@LuigiDelavega](https://discuss.elastic.co/u/LuigiDelavega)\ **Replies:** 0\ **Last updated:** [March 9, 2021, 11:54am UTC](https://discuss.elastic.co/t/problem-with-email-from-field-use-in-elastalert/266688 "2021-03-09T11:54:15Z")
Hello, I have an issue using the email\_from\_field ... field. I created a basic alert, which is triggered (i tested without email\_from\_field and with the "email" filled). But i never received any mail on the mail transm… [Previous page](https://discuss.elastic.co/latest.md?page=1792) [Next page](https://discuss.elastic.co/latest.md?page=1794)