# Latest **URL:** https://discuss.elastic.co/latest.md?page=1794 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1795 --- ## [Increase in CPU usage when deleting snapshots](https://discuss.elastic.co/t/increase-in-cpu-usage-when-deleting-snapshots/266682)
**Author:** [@Norman\_Khine](https://discuss.elastic.co/u/Norman_Khine)\ **Replies:** 0\ **Last updated:** [March 9, 2021, 11:29am UTC](https://discuss.elastic.co/t/increase-in-cpu-usage-when-deleting-snapshots/266682 "2021-03-09T11:29:46Z")
Hello, I have a process which deletes outdated ES snapshots which are saved on AWS S3. Currently there are 326 snapshots which are scheduled for deletion. From the docs, https://www.elastic.co/guide/en/elasticsearch/re… --- ## [Logstash - In memory maps/Lookup tables?](https://discuss.elastic.co/t/logstash-in-memory-maps-lookup-tables/266673)
**Author:** [@scott\_stash](https://discuss.elastic.co/u/scott_stash)\ **Replies:** 0\ **Last updated:** [March 9, 2021, 10:56am UTC](https://discuss.elastic.co/t/logstash-in-memory-maps-lookup-tables/266673 "2021-03-09T10:56:44Z")
Filebeat sends data to logstash. I’m reading files that are up to about 500mb, about 2 million lines. On each longline I calculate certain fields based on patterns in the log file name, example, split the path, get the… --- ## [Index store size increased by 4X on new index created using slipt api](https://discuss.elastic.co/t/index-store-size-increased-by-4x-on-new-index-created-using-slipt-api/266633)
**Author:** [@sreekanth](https://discuss.elastic.co/u/sreekanth)\ **Replies:** 3\ **Last updated:** [March 9, 2021, 10:33am UTC](https://discuss.elastic.co/t/index-store-size-increased-by-4x-on-new-index-created-using-slipt-api/266633 "2021-03-09T10:33:47Z")
We had one index with 1 shard/1 replica config. As per /\_cat/indices, it shows docs.count =133213 docs.deleted=2430 store.size=819.1gb pri.store.size=409.5gb now we used split api to create new index with 40 shards. … --- ## [Kibana dashboard recovery](https://discuss.elastic.co/t/kibana-dashboard-recovery/266649)
**Author:** [@tt\_cc](https://discuss.elastic.co/u/tt_cc)\ **Replies:** 1\ **Last updated:** [March 9, 2021, 9:50am UTC](https://discuss.elastic.co/t/kibana-dashboard-recovery/266649 "2021-03-09T09:50:05Z")
When reinstalling elk, how do I apply the existing kibana dashboard visualizations to the newly installed kibana? --- ## [Barracuda WAF Log Parsing](https://discuss.elastic.co/t/barracuda-waf-log-parsing/266665)
**Author:** [@PhilA](https://discuss.elastic.co/u/PhilA)\ **Replies:** 0\ **Last updated:** [March 9, 2021, 9:38am UTC](https://discuss.elastic.co/t/barracuda-waf-log-parsing/266665 "2021-03-09T09:38:29Z")
Hi I would appreciate some guidance on debugging the Barracuda WAF Filebeat module. I am running this with Filebeat rather than fleet at the moment as fleet is still in Beta and when I try running it in Fleet I get zer… --- ## [Rename the index-pattern for sample visualizations](https://discuss.elastic.co/t/rename-the-index-pattern-for-sample-visualizations/266617)
**Author:** [@b133](https://discuss.elastic.co/u/b133)\ **Replies:** 1\ **Last updated:** [March 9, 2021, 9:24am UTC](https://discuss.elastic.co/t/rename-the-index-pattern-for-sample-visualizations/266617 "2021-03-09T09:24:13Z")
Short version: In the new Kibana Lens app, how do you open existing visualizations to edit? Long version: I want to use the sample visualizations/dashboards provided by Filebeat in indices named other than filebeat-\*. … --- ## [Alert on an existing visualization of type "metric"](https://discuss.elastic.co/t/alert-on-an-existing-visualization-of-type-metric/266471)
**Author:** [@fml2](https://discuss.elastic.co/u/fml2)\ **Replies:** 1\ **Last updated:** [March 9, 2021, 9:18am UTC](https://discuss.elastic.co/t/alert-on-an-existing-visualization-of-type-metric/266471 "2021-03-09T09:18:35Z")
Hello, I've created a dashboard with a visualization of type "metric". The visualization displays the number of the log entries of type "ERROR" in the selected time span. Is it possible to define an alert on this visual… --- ## [Alert When - system\_fails\_to\_provide\_data - dynamic group of sending hosts](https://discuss.elastic.co/t/alert-when-system-fails-to-provide-data-dynamic-group-of-sending-hosts/265094)
**Author:** [@bbek](https://discuss.elastic.co/u/bbek)\ **Replies:** 5\ **Last updated:** [March 9, 2021, 9:08am UTC](https://discuss.elastic.co/t/alert-when-system-fails-to-provide-data-dynamic-group-of-sending-hosts/265094 "2021-03-09T09:08:48Z")
I have a use case to alert when a host fails to send logs. There is a watcher configured here, which is similar to what I'm trying to achieve: I like the logic, aggregate hosts on last 24 hours, then check for last 5 … --- ## [Ruby script and boolean](https://discuss.elastic.co/t/ruby-script-and-boolean/266535)
**Author:** [@logger](https://discuss.elastic.co/u/logger)\ **Replies:** 2\ **Last updated:** [March 9, 2021, 8:25am UTC](https://discuss.elastic.co/t/ruby-script-and-boolean/266535 "2021-03-09T08:25:43Z")
Hi there, I have a question about the ruby filter. I am getting logs in Json they are working quite good, but ofcourse I have inconsistence in the mapping. Usually the logs arrive with the fields arg0, arg1, arg,2 T… --- ## [Pipeline computed Field](https://discuss.elastic.co/t/pipeline-computed-field/266558)
**Author:** [@graimato](https://discuss.elastic.co/u/graimato)\ **Replies:** 2\ **Last updated:** [March 9, 2021, 8:18am UTC](https://discuss.elastic.co/t/pipeline-computed-field/266558 "2021-03-09T08:18:28Z")
Hello, I wrote a pipeline to parse log files, I'm trying to create a computed field I have es. timerequest timeresponse It is possible to create a new field latency { "set" : { "field" : "latency… --- ## [Schema design and query - aggregation within nested document](https://discuss.elastic.co/t/schema-design-and-query-aggregation-within-nested-document/266629)
**Author:** [@cuongthamhl](https://discuss.elastic.co/u/cuongthamhl)\ **Replies:** 1\ **Last updated:** [March 9, 2021, 8:14am UTC](https://discuss.elastic.co/t/schema-design-and-query-aggregation-within-nested-document/266629 "2021-03-09T08:14:32Z")
I have a simple schema with a nested field. A sample product document look like this: { "name": "product name", "events": \[ { "startDate": "2021-01-01 00:00:00", "endDate": "2021-01-01 00:00:00", … --- ## [Date timezone issue](https://discuss.elastic.co/t/date-timezone-issue/266644)
**Author:** [@Priyank07](https://discuss.elastic.co/u/Priyank07)\ **Replies:** 3\ **Last updated:** [March 9, 2021, 8:04am UTC](https://discuss.elastic.co/t/date-timezone-issue/266644 "2021-03-09T08:04:39Z")
Hi, I am pushing some documents to elastic and passing time as local time. So my question is.. Will that time converts to utc or it will be in local only. --- ## [How can I split string in Elasticsearch](https://discuss.elastic.co/t/how-can-i-split-string-in-elasticsearch/266576)
**Author:** [@pakwai122](https://discuss.elastic.co/u/pakwai122)\ **Replies:** 5\ **Last updated:** [March 9, 2021, 7:57am UTC](https://discuss.elastic.co/t/how-can-i-split-string-in-elasticsearch/266576 "2021-03-09T07:57:04Z")
I'm using nodejs as the client-side for Elasticsearch and got the following settings for the query. I want to split the text while users input text like "aa123 bb234" into "aa123 bb" "234". Only split the pattern like "b… --- ## [How to get date difference in weeks between today and date\_timestamp field](https://discuss.elastic.co/t/how-to-get-date-difference-in-weeks-between-today-and-date-timestamp-field/266378)
**Author:** [@Rakesh\_Rayabarapu](https://discuss.elastic.co/u/Rakesh_Rayabarapu)\ **Replies:** 4\ **Last updated:** [March 9, 2021, 7:36am UTC](https://discuss.elastic.co/t/how-to-get-date-difference-in-weeks-between-today-and-date-timestamp-field/266378 "2021-03-09T07:36:56Z")
Hello Team, could any one help me to write scripted field to get date difference in weeks between current datetime and doc\['timestamp'\]. to get current date time used datetime.new date().getTime() Used this script. (… --- ## [MultiLine read with File Beat](https://discuss.elastic.co/t/multiline-read-with-file-beat/266642)
**Author:** [@ankitji](https://discuss.elastic.co/u/ankitji)\ **Replies:** 0\ **Last updated:** [March 9, 2021, 6:59am UTC](https://discuss.elastic.co/t/multiline-read-with-file-beat/266642 "2021-03-09T06:59:15Z")
Hi, I am using filebeat on my hdfs root directories which having lots of log file inside that, for this we also using multiline parser of filebeat. So i just want to confirm on some below queries: Since we are readin… --- ## [Elasticsearch](https://discuss.elastic.co/t/elasticsearch/266528)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 5\ **Last updated:** [March 9, 2021, 6:43am UTC](https://discuss.elastic.co/t/elasticsearch/266528 "2021-03-09T06:43:13Z")
what files are pulled from the target server to elastic and where are they stored? how long is the file stored? How do I set the file I want to drag to elastic? --- ## [CSV::MalformedCSVError: Unclosed quoted field on line 1](https://discuss.elastic.co/t/csv-unclosed-quoted-field-on-line-1/266509)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 2\ **Last updated:** [March 9, 2021, 6:10am UTC](https://discuss.elastic.co/t/csv-unclosed-quoted-field-on-line-1/266509 "2021-03-09T06:10:07Z")
After running code, getting this error. How to resolve this error. In front of date I am getting this symbol ∩╗┐ while running my configuration file. It appears once(first line). Error parsing csv {:field=\>"message", :… --- ## [Filebeat AWS Module SQS Queue Configurations Errors](https://discuss.elastic.co/t/filebeat-aws-module-sqs-queue-configurations-errors/266593)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 1\ **Last updated:** [March 9, 2021, 5:37am UTC](https://discuss.elastic.co/t/filebeat-aws-module-sqs-queue-configurations-errors/266593 "2021-03-09T05:37:04Z")
I am configuring filebeat AWS module to fetch Cloudtrail logs from an s3 bucket. I configured my settings from this article. However, somehow filebeat is unable to find SQS queue's region. here is my filebeat.yml input … --- ## [Getting log":{"message":"Exception during establishing a SSL connection: HttpRequestOnTransportException\[This is not an HTTP port\]"}}](https://discuss.elastic.co/t/getting-log-message-exception-during-establishing-a-ssl-connection-httprequestontransportexception-this-is-not-an-http-port/266627)
**Author:** [@Mayank\_Srivastava](https://discuss.elastic.co/u/Mayank_Srivastava)\ **Replies:** 0\ **Last updated:** [March 9, 2021, 3:56am UTC](https://discuss.elastic.co/t/getting-log-message-exception-during-establishing-a-ssl-connection-httprequestontransportexception-this-is-not-an-http-port/266627 "2021-03-09T03:56:01Z")
Hi , we are getting this ERROR flooding logs in elasticsearch ,Can you please help us on this why its coming. ''' {"type":"log","host":"btel-belk-elasticsearch-master-0","level":"ERROR","systemid":"2106a117733f42d69728… --- ## [I want to output log to elasticsearch index from only specific "host.ip"](https://discuss.elastic.co/t/i-want-to-output-log-to-elasticsearch-index-from-only-specific-host-ip/266494)
**Author:** [@BlackCat](https://discuss.elastic.co/u/BlackCat)\ **Replies:** 4\ **Last updated:** [March 9, 2021, 3:51am UTC](https://discuss.elastic.co/t/i-want-to-output-log-to-elasticsearch-index-from-only-specific-host-ip/266494 "2021-03-09T03:51:57Z")
"host.ip" is at "\_source" displayed on Kibana. Please teach me how to resolve. logstash config input { beats { port =\> 5044 } } filter { grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:Time} %{HO… --- ## [Cannot seem to get ingest pipelines to work, please help!](https://discuss.elastic.co/t/cannot-seem-to-get-ingest-pipelines-to-work-please-help/264259)
**Author:** [@mhare](https://discuss.elastic.co/u/mhare)\ **Replies:** 11\ **Last updated:** [March 9, 2021, 3:16am UTC](https://discuss.elastic.co/t/cannot-seem-to-get-ingest-pipelines-to-work-please-help/264259 "2021-03-09T03:16:25Z")
I am trying to understand ES ingest pipelines and Filebeat. I am using version 7.11 ES and K and FB in docker containers. If I do not add the pipeline, I get the log lines in ES/K from FB, but they are not formatted … --- ## [ES version rollback problem](https://discuss.elastic.co/t/es-version-rollback-problem/266551)
**Author:** [@haipeng.zhao](https://discuss.elastic.co/u/haipeng.zhao)\ **Replies:** 2\ **Last updated:** [March 9, 2021, 2:08am UTC](https://discuss.elastic.co/t/es-version-rollback-problem/266551 "2021-03-09T02:08:11Z")
hi all When I tried to upgrade es to 7.10.2, it was successful, but when I rolled back to my previous version 7.10.1, I found an error. Currently my ECK version 1.4 I also found that someone has opened this issue, but… --- ## [Kibana isnot converting over https in windows](https://discuss.elastic.co/t/kibana-isnot-converting-over-https-in-windows/266562)
**Author:** [@shharukh](https://discuss.elastic.co/u/shharukh)\ **Replies:** 2\ **Last updated:** [March 9, 2021, 1:51am UTC](https://discuss.elastic.co/t/kibana-isnot-converting-over-https-in-windows/266562 "2021-03-09T01:51:18Z")
hello everyone, I have successfully convert http to https in elasticsearch but the communication between elastic search and kibana is having the possible error can you help me out . I'm doing it in windows and on my… --- ## [Elasticsearch SSL/TLS PKI realm setup](https://discuss.elastic.co/t/elasticsearch-ssl-tls-pki-realm-setup/265790)
**Author:** [@anoopkv](https://discuss.elastic.co/u/anoopkv)\ **Replies:** 13\ **Last updated:** [March 9, 2021, 1:18am UTC](https://discuss.elastic.co/t/elasticsearch-ssl-tls-pki-realm-setup/265790 "2021-03-09T01:18:45Z")
Hello, I am trying to setup PKI realm on my onpremise ELK stack on a k8s cluster and I am using helm as the package manager Elasticsearch version: 7.11.1 I have created an organization signed server certificate, using… --- ## [Exclude and include not working on script\_score](https://discuss.elastic.co/t/exclude-and-include-not-working-on-script-score/266498)
**Author:** [@Min-Young](https://discuss.elastic.co/u/Min-Young)\ **Replies:** 0\ **Last updated:** [March 8, 2021, 2:12am UTC](https://discuss.elastic.co/t/exclude-and-include-not-working-on-script-score/266498 "2021-03-08T02:12:05Z")
Hi guys, if query is something like that... { "size": 30, "\_source": { "includes": "source\_sentence", "excludes": \["source\_embedding", "target\_embedding"\] }, "query": { "script\_score": { "quer… --- ## [Logstash elastic as input](https://discuss.elastic.co/t/logstash-elastic-as-input/266280)
**Author:** [@Kiyoka](https://discuss.elastic.co/u/Kiyoka)\ **Replies:** 3\ **Last updated:** [March 8, 2021, 11:47pm UTC](https://discuss.elastic.co/t/logstash-elastic-as-input/266280 "2021-03-08T23:47:27Z")
Hi. I am using existing index as input and enriching it with the data from SQL server. This enriching process needs to run weekly for now. Currently I am loading past 10 days, but that cause duplicate. Preformatted … --- ## [Metricbeat autodiscover configuration to create a new index when a new namespace is created](https://discuss.elastic.co/t/metricbeat-autodiscover-configuration-to-create-a-new-index-when-a-new-namespace-is-created/266616)
**Author:** [@umesh2020](https://discuss.elastic.co/u/umesh2020)\ **Replies:** 0\ **Last updated:** [March 8, 2021, 10:54pm UTC](https://discuss.elastic.co/t/metricbeat-autodiscover-configuration-to-create-a-new-index-when-a-new-namespace-is-created/266616 "2021-03-08T22:54:39Z")
Hi I want to crate a new elasticsearch index whenenver a new kubernetes namespace is created. How do I specify this in metricbeat configuration ? For every new namespace created, I need to add some config and also cre… --- ## [Error in APM PHP agent](https://discuss.elastic.co/t/error-in-apm-php-agent/265999)
**Author:** [@rgb3](https://discuss.elastic.co/u/rgb3)\ **Replies:** 2\ **Last updated:** [March 8, 2021, 10:21pm UTC](https://discuss.elastic.co/t/error-in-apm-php-agent/265999 "2021-03-08T22:21:07Z")
Kibana version: 7.11.1 Elasticsearch version: 7.11.1 APM Server version: 7.11.1 APM Agent language and version: PHP 1.0 beta Browser version: N/A, but Firefox 86.0 Original install method (e.g. download page, yum, d… --- ## [Display data with the latest date](https://discuss.elastic.co/t/display-data-with-the-latest-date/266196)
**Author:** [@jazzdorf](https://discuss.elastic.co/u/jazzdorf)\ **Replies:** 5\ **Last updated:** [March 8, 2021, 9:54pm UTC](https://discuss.elastic.co/t/display-data-with-the-latest-date/266196 "2021-03-08T21:54:04Z")
Hi, I'm new to Kibana and I'm trying out some things. Now, I have some dummy data set and I want to filter for some data by a query. How can I get a count for the latest date where data exists? I'm using a metric visu… --- ## [Monitoring Linux System Temperature with Elasticsearch (Tested on Raspberry Pi)](https://discuss.elastic.co/t/monitoring-linux-system-temperature-with-elasticsearch-tested-on-raspberry-pi/266609)
**Author:** [@jamesgarside](https://discuss.elastic.co/u/jamesgarside)\ **Replies:** 0\ **Last updated:** [March 8, 2021, 9:45pm UTC](https://discuss.elastic.co/t/monitoring-linux-system-temperature-with-elasticsearch-tested-on-raspberry-pi/266609 "2021-03-08T21:45:12Z")
Hello all, I have just finished a quick temperature monitoring project for Linux systems using Filebeat and Elasticsearch. The repo can be found here: https://github.com/jamesgarside/linux-temperature-logger I develop… [Previous page](https://discuss.elastic.co/latest.md?page=1793) [Next page](https://discuss.elastic.co/latest.md?page=1795)