# Latest **URL:** https://discuss.elastic.co/latest.md?page=1887 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1888 --- ## [How to check monitoring logs of kibana](https://discuss.elastic.co/t/how-to-check-monitoring-logs-of-kibana/261388)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 3\ **Last updated:** [January 19, 2021, 4:11am UTC](https://discuss.elastic.co/t/how-to-check-monitoring-logs-of-kibana/261388 "2021-01-19T04:11:29Z")
Hi, I have a cluster of 3 master + data nodes and 1 kibana of 7.10.0v. I have enabled SSL and monitoring of the cluster. Now my requirement is:- When I go to stack monitoring page -\> overview of kibana I want to see… --- ## [How to collect \`log.error\`(slf4j) into the Elastic APM "Error" app?](https://discuss.elastic.co/t/how-to-collect-log-error-slf4j-into-the-elastic-apm-error-app/260009)
**Author:** [@fzyzcjy](https://discuss.elastic.co/u/fzyzcjy)\ **Replies:** 7\ **Last updated:** [January 19, 2021, 3:59am UTC](https://discuss.elastic.co/t/how-to-collect-log-error-slf4j-into-the-elastic-apm-error-app/260009 "2021-01-19T03:59:10Z")
If you are asking about a problem you are experiencing, please use the following template, as it will help us help you. If you have a different problem, please delete all of this text :slight\_smile: TIP 1: select at lea… --- ## [Dec 14th, 2020 \[CN\] 如何成为一名 Elastic 认证工程师](https://discuss.elastic.co/t/dec-14th-2020-cn-elastic/257010)
**Author:** [@xiaoguo.liu](https://discuss.elastic.co/u/xiaoguo.liu)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 3:01am UTC](https://discuss.elastic.co/t/dec-14th-2020-cn-elastic/257010 "2021-01-19T03:01:32Z")
Elasticsearch 无疑是是目前世界上最为流行的大数据搜索引擎。世界上很多著名的 IT 公司都是我们的客户。这些客户包括微软，甲骨文，Adobe，Salesforce, Uber，苹果，沃尔玛等等这些跨国公司。在中国也有很多的用户，比如腾讯，阿里，360，滴滴，抖音，美团，联想，CCTV，银行公司，保险公司，电信公司，汽车制造商，手机制造商等等。我们常用到的 github，linkedin，wikipedia 等上面的搜索都是使… --- ## [APM agent crashes NodeJs after reporting exception in tedious instrumentation code](https://discuss.elastic.co/t/apm-agent-crashes-nodejs-after-reporting-exception-in-tedious-instrumentation-code/259851)
**Author:** [@rodbil](https://discuss.elastic.co/u/rodbil)\ **Replies:** 4\ **Last updated:** [January 19, 2021, 2:28am UTC](https://discuss.elastic.co/t/apm-agent-crashes-nodejs-after-reporting-exception-in-tedious-instrumentation-code/259851 "2021-01-19T02:28:57Z")
Kibana version: 7.8.1 (flavor:default, type:docker) Elasticsearch version: 7.8.1 (flavor:default, type:docker) APM Server version: 7.8.1 (flavor:default, type:docker) APM Agent language and version: Elastic-apm-node … --- ## [Docker logs to elastic by filebeat](https://discuss.elastic.co/t/docker-logs-to-elastic-by-filebeat/261372)
**Author:** [@sungjin.kim](https://discuss.elastic.co/u/sungjin.kim)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 2:03am UTC](https://discuss.elastic.co/t/docker-logs-to-elastic-by-filebeat/261372 "2021-01-19T02:03:30Z")
Hi, This is docker logs I tried to send docker logs to elasticsearch by using filebeat however, in elasticsearch, I can't find docker logs. Please let me know how to load stdout load of docker Regards, Sungji… --- ## [How can I stop cluster from filling my cold nodes with hot data?](https://discuss.elastic.co/t/how-can-i-stop-cluster-from-filling-my-cold-nodes-with-hot-data/261044)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 5\ **Last updated:** [January 19, 2021, 1:11am UTC](https://discuss.elastic.co/t/how-can-i-stop-cluster-from-filling-my-cold-nodes-with-hot-data/261044 "2021-01-19T01:11:56Z")
title really says it all. I just added two cold nodes to my cluster -- these have slow disks and I don't want active indexes on them but I find that ES is treating them the same as the other nodes. both nodes have node… --- ## [I can't edit my deployment because I have too many shards in my cluster](https://discuss.elastic.co/t/i-cant-edit-my-deployment-because-i-have-too-many-shards-in-my-cluster/260774)
**Author:** [@daniel\_at\_gus](https://discuss.elastic.co/u/daniel_at_gus)\ **Replies:** 7\ **Last updated:** [January 19, 2021, 12:32am UTC](https://discuss.elastic.co/t/i-cant-edit-my-deployment-because-i-have-too-many-shards-in-my-cluster/260774 "2021-01-19T00:32:21Z")
Hi, community. Recently I have talked to Elastic Cloud support team and they told me that my cluster fails to edit my deployment because I have too many shards in my cluster. They suggested me to delete unused indexes. … --- ## [Filebeat Cloudtrail metricset breaks and stops returning "s3 log info" when upgrading past 7.9.1](https://discuss.elastic.co/t/filebeat-cloudtrail-metricset-breaks-and-stops-returning-s3-log-info-when-upgrading-past-7-9-1/261302)
**Author:** [@AddChickpeas](https://discuss.elastic.co/u/AddChickpeas)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 12:23am UTC](https://discuss.elastic.co/t/filebeat-cloudtrail-metricset-breaks-and-stops-returning-s3-log-info-when-upgrading-past-7-9-1/261302 "2021-01-19T00:23:51Z")
I was attempting to upgrade filebeat to the latest release from 7.9.0, but am unable to get any version past 7.9.1 to work. Starting with 7.9.2, debug shows filebeat receiving the SQS message, but it doesn't return any … --- ## [Kibana Intensif](https://discuss.elastic.co/t/kibana-intensif/260185)
**Author:** [@rbeg](https://discuss.elastic.co/u/rbeg)\ **Replies:** 4\ **Last updated:** [January 19, 2021, 12:09am UTC](https://discuss.elastic.co/t/kibana-intensif/260185 "2021-01-19T00:09:51Z")
Bonjour, Lorsqu'ELK commence à contenir beaucoup de données, ça se ressent dans les temps de réaction sur Kibana qui commencent à devenir plus longs. J'aimerai savoir s'il existe une fonctionnalité, un plugin, ou autre… --- ## [Cannot start filebeat because of instance/beat.go error](https://discuss.elastic.co/t/cannot-start-filebeat-because-of-instance-beat-go-error/261472)
**Author:** [@jfasajr](https://discuss.elastic.co/u/jfasajr)\ **Replies:** 9\ **Last updated:** [January 18, 2021, 11:32pm UTC](https://discuss.elastic.co/t/cannot-start-filebeat-because-of-instance-beat-go-error/261472 "2021-01-18T23:32:56Z")
When I run filebeat setup -e It runs through and it is able to get through to the point of installing dashboard for kibana, but then fails due to an error, below: Index setup finished. Loading dashboards (Kibana must b… --- ## [Query on multiple indices and covariance using NEST 7.9+](https://discuss.elastic.co/t/query-on-multiple-indices-and-covariance-using-nest-7-9/261474)
**Author:** [@bramford](https://discuss.elastic.co/u/bramford)\ **Replies:** 0\ **Last updated:** [January 18, 2021, 9:09pm UTC](https://discuss.elastic.co/t/query-on-multiple-indices-and-covariance-using-nest-7-9/261474 "2021-01-18T21:09:00Z")
I'm attempting to search multiple indices using NEST while providing covariance in the same way this topic describes: Query on multiple index using NEST Unfortunately the .Type() method no longer exists in the SearchDes… --- ## [How many RAM does lucene occupy](https://discuss.elastic.co/t/how-many-ram-does-lucene-occupy/261437)
**Author:** [@Hungming\_Chiu](https://discuss.elastic.co/u/Hungming_Chiu)\ **Replies:** 1\ **Last updated:** [January 18, 2021, 10:15pm UTC](https://discuss.elastic.co/t/how-many-ram-does-lucene-occupy/261437 "2021-01-18T22:15:00Z")
Hi there, Any way to know how many RAM does lucene occupy? Thank you --- ## [SQL to ElasticSearch, only new rows?](https://discuss.elastic.co/t/sql-to-elasticsearch-only-new-rows/261476)
**Author:** [@sath](https://discuss.elastic.co/u/sath)\ **Replies:** 2\ **Last updated:** [January 18, 2021, 9:43pm UTC](https://discuss.elastic.co/t/sql-to-elasticsearch-only-new-rows/261476 "2021-01-18T21:43:28Z")
Hello, I'm relatively new to the ELK stack. I'm wondering how I could send data from a SQL table to Elasticsearch in a way that every time it runs, it only sends the rows that are new since the last time it ran. The SQL… --- ## [How to change index status from warm to hot](https://discuss.elastic.co/t/how-to-change-index-status-from-warm-to-hot/261398)
**Author:** [@opouwels](https://discuss.elastic.co/u/opouwels)\ **Replies:** 2\ **Last updated:** [January 18, 2021, 9:24pm UTC](https://discuss.elastic.co/t/how-to-change-index-status-from-warm-to-hot/261398 "2021-01-18T21:24:38Z")
Hi How can I change the index from warm to hot? Regards Oscar --- ## [Delete old Elasticsearch Data Automatically](https://discuss.elastic.co/t/delete-old-elasticsearch-data-automatically/261464)
**Author:** [@Amantha](https://discuss.elastic.co/u/Amantha)\ **Replies:** 1\ **Last updated:** [January 18, 2021, 9:20pm UTC](https://discuss.elastic.co/t/delete-old-elasticsearch-data-automatically/261464 "2021-01-18T21:20:43Z")
I want to delete old elasticserach data automatically. Is there any proper method to do it? Can we delete those data within a preferred time period? --- ## [Need help figuring out AWS role for functionbeat](https://discuss.elastic.co/t/need-help-figuring-out-aws-role-for-functionbeat/261297)
**Author:** [@Jonathan\_Detert](https://discuss.elastic.co/u/Jonathan_Detert)\ **Replies:** 2\ **Last updated:** [January 18, 2021, 9:16pm UTC](https://discuss.elastic.co/t/need-help-figuring-out-aws-role-for-functionbeat/261297 "2021-01-18T21:16:41Z")
https://www.elastic.co/guide/en/beats/functionbeat/7.x/configuration-functionbeat-options.html#functionbeat-role says that I can add a parameter named role to my functionbeat config. Where to add it? I'm guessing it's… --- ## [Elasticsearch repository-azure kubernetes](https://discuss.elastic.co/t/elasticsearch-repository-azure-kubernetes/261473)
**Author:** [@Pmoraes13](https://discuss.elastic.co/u/Pmoraes13)\ **Replies:** 0\ **Last updated:** [January 18, 2021, 8:44pm UTC](https://discuss.elastic.co/t/elasticsearch-repository-azure-kubernetes/261473 "2021-01-18T20:44:51Z")
Hello, someone has using Elasticsearch with repository-azure or Azure storage account for backup the snapshots? I'm trying to configure my kubernetes yml to install azure plugin before pod start but not success. All good… --- ## [Multi match equal both fields](https://discuss.elastic.co/t/multi-match-equal-both-fields/261463)
**Author:** [@seefor](https://discuss.elastic.co/u/seefor)\ **Replies:** 1\ **Last updated:** [January 18, 2021, 7:32pm UTC](https://discuss.elastic.co/t/multi-match-equal-both-fields/261463 "2021-01-18T19:32:20Z")
New to elastic search I have the following search, which works great but I would like to only return when both "result.confidence", "result.severity" = HIGH instead of when either equal HIGH { "size": 10000, … --- ## [Signal.rule.name empty?](https://discuss.elastic.co/t/signal-rule-name-empty/260823)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 6\ **Last updated:** [January 18, 2021, 7:08pm UTC](https://discuss.elastic.co/t/signal-rule-name-empty/260823 "2021-01-18T19:08:22Z")
Hello, Just noticed signal.rule.name is empty for some rules? Elastic 7.9.2 The above screenshot is from the rule "VNC to the Internet" which I copied from the official " VNC (Virtual Network Computing) to the Intern… --- ## [Elastic Detections permissions issues](https://discuss.elastic.co/t/elastic-detections-permissions-issues/257751)
**Author:** [@yarooski](https://discuss.elastic.co/u/yarooski)\ **Replies:** 6\ **Last updated:** [January 18, 2021, 6:59pm UTC](https://discuss.elastic.co/t/elastic-detections-permissions-issues/257751 "2021-01-18T18:59:29Z")
We are new to elastic and are working to get detections up and running. I created a role with all the required permissions according to the documentation and assigned it to my user, but when going to the detections page … --- ## [Attribute detection to original doc](https://discuss.elastic.co/t/attribute-detection-to-original-doc/261010)
**Author:** [@Samsquantch](https://discuss.elastic.co/u/Samsquantch)\ **Replies:** 1\ **Last updated:** [January 18, 2021, 6:51pm UTC](https://discuss.elastic.co/t/attribute-detection-to-original-doc/261010 "2021-01-18T18:51:53Z")
Is there a way to include the original \_id of the doc that triggered an alert in the metadata of a detection? When working IR, we would like to efficiently trace an alert to an event. I can create a filter based off of … --- ## [Update of field created by ruby script](https://discuss.elastic.co/t/update-of-field-created-by-ruby-script/261459)
**Author:** [@ggab31](https://discuss.elastic.co/u/ggab31)\ **Replies:** 3\ **Last updated:** [January 18, 2021, 6:24pm UTC](https://discuss.elastic.co/t/update-of-field-created-by-ruby-script/261459 "2021-01-18T18:24:33Z")
Hi, I have a logstash ruby filter that creates a few fields composed of two parts in a heartbeat index, this way : ruby { code =\> " temp=Time.new; event.set('time.second', temp.localtime.strftime('%S')); … --- ## [Getting multi-word synonyms used in the search for display](https://discuss.elastic.co/t/getting-multi-word-synonyms-used-in-the-search-for-display/261460)
**Author:** [@julioz](https://discuss.elastic.co/u/julioz)\ **Replies:** 0\ **Last updated:** [January 18, 2021, 6:17pm UTC](https://discuss.elastic.co/t/getting-multi-word-synonyms-used-in-the-search-for-display/261460 "2021-01-18T18:17:20Z")
I am developing a search system using Elasticsearch. In this system, users can register synonyms. When performing a search, in addition to the return of the documents, it is also necessary to display which of the synony… --- ## [Add tag if SNMP poll reaches its timeout](https://discuss.elastic.co/t/add-tag-if-snmp-poll-reaches-its-timeout/261447)
**Author:** [@Andrew22](https://discuss.elastic.co/u/Andrew22)\ **Replies:** 1\ **Last updated:** [January 18, 2021, 6:05pm UTC](https://discuss.elastic.co/t/add-tag-if-snmp-poll-reaches-its-timeout/261447 "2021-01-18T18:05:01Z")
Hello, I have recently started to use the SNMP plugin to poll a few devices and its great the only issue I am having is if the device reaches its timeout Logstash just logs it in its log file and I would like to have it… --- ## [High level rest client aggregations naming](https://discuss.elastic.co/t/high-level-rest-client-aggregations-naming/261458)
**Author:** [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\ **Replies:** 0\ **Last updated:** [January 18, 2021, 5:46pm UTC](https://discuss.elastic.co/t/high-level-rest-client-aggregations-naming/261458 "2021-01-18T17:46:25Z")
I am building a spring boot query builder for my end users. It looks like from the discussions that I am going to have to unpack the search response before sending. It appears the client appends the class info on the agg… --- ## [URL Filed formatter - to get value of other fields using script](https://discuss.elastic.co/t/url-filed-formatter-to-get-value-of-other-fields-using-script/261442)
**Author:** [@gulshann](https://discuss.elastic.co/u/gulshann)\ **Replies:** 2\ **Last updated:** [January 18, 2021, 4:19pm UTC](https://discuss.elastic.co/t/url-filed-formatter-to-get-value-of-other-fields-using-script/261442 "2021-01-18T16:19:54Z")
Continuing the discussion from URL field formatter - get values of other fields: Can You share an example for this. --- ## [Adding buttons in kibana markup visualisations](https://discuss.elastic.co/t/adding-buttons-in-kibana-markup-visualisations/261432)
**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\ **Replies:** 5\ **Last updated:** [January 18, 2021, 4:05pm UTC](https://discuss.elastic.co/t/adding-buttons-in-kibana-markup-visualisations/261432 "2021-01-18T16:05:47Z")
Kibana version : 7.9 I wanted to add button to my mark up visualisation . Is there any short cuts that we add in mark up like square bracket we add to get links . Any way we can bring buttons in that markup visualisati… --- ## [(2021) Can't cURL 9200 from some hosts in network](https://discuss.elastic.co/t/2021-cant-curl-9200-from-some-hosts-in-network/260388)
**Author:** [@brett.b](https://discuss.elastic.co/u/brett.b)\ **Replies:** 8\ **Last updated:** [January 18, 2021, 3:54pm UTC](https://discuss.elastic.co/t/2021-cant-curl-9200-from-some-hosts-in-network/260388 "2021-01-18T15:54:35Z")
Hello everyone, I have seen this question posted in other ways, but a lot of them were about Elasticsearch inside of a docker container. I hope this question is not truly a duplicate. My situation is that I have a DMZ … --- ## [Elasticsearch error](https://discuss.elastic.co/t/elasticsearch-error/260488)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 1\ **Last updated:** [January 9, 2021, 7:08am UTC](https://discuss.elastic.co/t/elasticsearch-error/260488 "2021-01-09T07:08:44Z")
Hello there, I have three node cluster implementation and I have noticed some error when I started elasticsearch for master node. \[2021-01-07T16:07:35,341\]\[WARN \]\[o.e.x.m.e.l.LocalExporter\] \[master\] unexpected error w… --- ## [How to unnest - flatten this answer](https://discuss.elastic.co/t/how-to-unnest-flatten-this-answer/261419)
**Author:** [@brunet](https://discuss.elastic.co/u/brunet)\ **Replies:** 2\ **Last updated:** [January 18, 2021, 3:48pm UTC](https://discuss.elastic.co/t/how-to-unnest-flatten-this-answer/261419 "2021-01-18T15:48:09Z")
Dear community, I need to transform the ES response to flatten the received data, i would like to make a radar type viz but i'm not able to unnest / flatten it. I have this answer (cleaned it a bit)... "aggregations"… [Previous page](https://discuss.elastic.co/latest.md?page=1886) [Next page](https://discuss.elastic.co/latest.md?page=1888)