# Latest **URL:** https://discuss.elastic.co/latest.md?page=1933 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1934 --- ## [Relationship between hot-warm arch and node roles](https://discuss.elastic.co/t/relationship-between-hot-warm-arch-and-node-roles/258977)
**Author:** [@hiruni.insyncit.net](https://discuss.elastic.co/u/hiruni.insyncit.net)\ **Replies:** 4\ **Last updated:** [December 17, 2020, 12:18pm UTC](https://discuss.elastic.co/t/relationship-between-hot-warm-arch-and-node-roles/258977 "2020-12-17T12:18:33Z")
when a node config as a hot node, then what should be the node role such as master, ingest, data? also when a node is warm what should be the node role? what is the relationship? between hot-warm arch and node roles? T… --- ## [Visualize 2 lines - 2 nodes with 1 parameter per time](https://discuss.elastic.co/t/visualize-2-lines-2-nodes-with-1-parameter-per-time/256240)
**Author:** [@avovana](https://discuss.elastic.co/u/avovana)\ **Replies:** 16\ **Last updated:** [December 17, 2020, 12:17pm UTC](https://discuss.elastic.co/t/visualize-2-lines-2-nodes-with-1-parameter-per-time/256240 "2020-12-17T12:17:47Z")
Good morning! After intensive search It seems to me that it is impossible. Anyway, maybe someone have an idea to implement it(with Kibana, or, maybe Zabbix + prometheus)... The case is I have a system consists of many … --- ## [Underlying file changed by an external force](https://discuss.elastic.co/t/underlying-file-changed-by-an-external-force/258648)
**Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Replies:** 2\ **Last updated:** [December 17, 2020, 12:13pm UTC](https://discuss.elastic.co/t/underlying-file-changed-by-an-external-force/258648 "2020-12-17T12:13:10Z")
Hi Team, Of late, I've started seeing these errors in ES 6.8.6 cluster. I have this cluster since March but these errors started appearing only recently: \[2020-12-14T00:00:04,122\]\[WARN \]\[o.e.c.r.a.AllocationService\] \[n… --- ## [Geo\_shape, geo\_point - Can they be added on the fly?](https://discuss.elastic.co/t/geo-shape-geo-point-can-they-be-added-on-the-fly/258910)
**Author:** [@vmanohar1](https://discuss.elastic.co/u/vmanohar1)\ **Replies:** 2\ **Last updated:** [December 17, 2020, 11:32am UTC](https://discuss.elastic.co/t/geo-shape-geo-point-can-they-be-added-on-the-fly/258910 "2020-12-17T11:32:54Z")
If the original index has just lat/lon values, is it possible to create additional columns of type geo\_shape and geo\_point using values from lat/lon column in the elastic query itself? I am curious to know.. Thanks. --- ## [Problem login dashboards after copying the iframe address in the html](https://discuss.elastic.co/t/problem-login-dashboards-after-copying-the-iframe-address-in-the-html/258693)
**Author:** [@Sarahabbasi](https://discuss.elastic.co/u/Sarahabbasi)\ **Replies:** 1\ **Last updated:** [December 17, 2020, 11:29am UTC](https://discuss.elastic.co/t/problem-login-dashboards-after-copying-the-iframe-address-in-the-html/258693 "2020-12-17T11:29:52Z")
Hello Masters : I will copy the iframe in the HTML tags on a html page, but Elastic login page not working and i got this error in browser console : Refused to execute inline script because it violates the following … --- ## [Image Cloud in Kibana](https://discuss.elastic.co/t/image-cloud-in-kibana/258370)
**Author:** [@Abhishek5](https://discuss.elastic.co/u/Abhishek5)\ **Replies:** 2\ **Last updated:** [December 17, 2020, 11:29am UTC](https://discuss.elastic.co/t/image-cloud-in-kibana/258370 "2020-12-17T11:29:27Z")
Hello All, I am thinking to create a image cloud (similar to tag cloud, using images instead) in Kibana. I could not find any visualization in Kibana 7.0. I am exploring markdowns to display static images for now, is the… --- ## [Kibana is not allowing to select data of more than 35 days, for Predictions using Machine Learning](https://discuss.elastic.co/t/kibana-is-not-allowing-to-select-data-of-more-than-35-days-for-predictions-using-machine-learning/258951)
**Author:** [@mohammadawaisjavaid](https://discuss.elastic.co/u/mohammadawaisjavaid)\ **Replies:** 1\ **Last updated:** [December 17, 2020, 11:11am UTC](https://discuss.elastic.co/t/kibana-is-not-allowing-to-select-data-of-more-than-35-days-for-predictions-using-machine-learning/258951 "2020-12-17T11:11:29Z")
Hello all whenever I select more than 35 days of data in Machine Learning feature for the predictions then it is not allowing me to do this? I want to ask that why is this so? Is this the restriction of ML model of Kiban… --- ## [Error elasticsearch/client.go:407](https://discuss.elastic.co/t/error-elasticsearch-client-go-407/258825)
**Author:** [@nuut](https://discuss.elastic.co/u/nuut)\ **Replies:** 1\ **Last updated:** [December 17, 2020, 11:08am UTC](https://discuss.elastic.co/t/error-elasticsearch-client-go-407/258825 "2020-12-17T11:08:48Z")
hi team i ge error like this Dec 16 14:25:16 localhost filebeat\[33713\]: 2020-12-16T14:25:15.598+0700 WARN \[elasticsearch\] elasticsearch/client.go:407 Cannot index event publisher.Event can y… --- ## [Not able to access my Kibana dashboard URL from angular with x-pack security turned on](https://discuss.elastic.co/t/not-able-to-access-my-kibana-dashboard-url-from-angular-with-x-pack-security-turned-on/258390)
**Author:** [@sam189](https://discuss.elastic.co/u/sam189)\ **Replies:** 1\ **Last updated:** [December 17, 2020, 10:55am UTC](https://discuss.elastic.co/t/not-able-to-access-my-kibana-dashboard-url-from-angular-with-x-pack-security-turned-on/258390 "2020-12-17T10:55:45Z")
Disabling x-pack security in kibana alllows me to access the kibana dashboard in my angular application but when i enable xpack i cannot access the kibana dashboard in my angular iframe. I am passing username and passwo… --- ## [Errors in Kibana logs](https://discuss.elastic.co/t/errors-in-kibana-logs/258968)
**Author:** [@aramos](https://discuss.elastic.co/u/aramos)\ **Replies:** 1\ **Last updated:** [December 17, 2020, 10:42am UTC](https://discuss.elastic.co/t/errors-in-kibana-logs/258968 "2020-12-17T10:42:39Z")
Good morning, The first sorry for my English. I am new on Linux, I have to install Kibana. I'm using Ubuntu Server 2004. I installed kibana 7.9.3 from the .tar file following the instructions https://www.elastic.co/gui… --- ## [Kibana Plugin Installation Fails](https://discuss.elastic.co/t/kibana-plugin-installation-fails/258781)
**Author:** [@sukur55](https://discuss.elastic.co/u/sukur55)\ **Replies:** 5\ **Last updated:** [December 17, 2020, 10:28am UTC](https://discuss.elastic.co/t/kibana-plugin-installation-fails/258781 "2020-12-17T10:28:06Z")
Hi, currently I have Kibana 7.10.0 ,I am trying to install logtrail plugin.I have followed documentation and changed Kibana version inside package.json correctly zipped again but when I install it throws following error. … --- ## [APM error Id in email alert](https://discuss.elastic.co/t/apm-error-id-in-email-alert/258803)
**Author:** [@shivasantosh](https://discuss.elastic.co/u/shivasantosh)\ **Replies:** 3\ **Last updated:** [December 17, 2020, 10:27am UTC](https://discuss.elastic.co/t/apm-error-id-in-email-alert/258803 "2020-12-17T10:27:41Z")
Our application is in Java Spring boot. We have integrated with APM during startup of application. APM is showing up health and requests. Recently, we have added email alerts for the exceptions or errors raised in the … --- ## [Logstash not working when started via systemctl, however it work when manually starting](https://discuss.elastic.co/t/logstash-not-working-when-started-via-systemctl-however-it-work-when-manually-starting/258973)
**Author:** [@baljka](https://discuss.elastic.co/u/baljka)\ **Replies:** 0\ **Last updated:** [December 17, 2020, 10:20am UTC](https://discuss.elastic.co/t/logstash-not-working-when-started-via-systemctl-however-it-work-when-manually-starting/258973 "2020-12-17T10:20:39Z")
Hello, Everything was working fine. However it suddenly stopped working. Now when I try running command "/usr/share/logstash/bin/logstash --path.settings /etc/logstash" manually, it works fine When I run command "syst… --- ## [MSSP SOC - How to ByPass "Cases"](https://discuss.elastic.co/t/mssp-soc-how-to-bypass-cases/255387)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 5\ **Last updated:** [December 17, 2020, 10:01am UTC](https://discuss.elastic.co/t/mssp-soc-how-to-bypass-cases/255387 "2020-12-17T10:01:07Z")
I'm a SOC Engineer at a MSSP SOC and we currently use AlienVault for the majority of our clients, but we started to play around with Elastic SIEM and we just started to work with a potential new client and we have deploy… --- ## [Autogenerating field names from csv headers](https://discuss.elastic.co/t/autogenerating-field-names-from-csv-headers/258638)
**Author:** [@toucan](https://discuss.elastic.co/u/toucan)\ **Replies:** 4\ **Last updated:** [December 17, 2020, 9:27am UTC](https://discuss.elastic.co/t/autogenerating-field-names-from-csv-headers/258638 "2020-12-17T09:27:07Z")
Hi, I'm trying to parse CSV files with Logstash. Some of the files have a column called time, others have two columns called time\_from and time\_to (and they have several other columns). Ideally I'd like to have one pipe… --- ## [Searching Document (NEST) with Selecting fields to return](https://discuss.elastic.co/t/searching-document-nest-with-selecting-fields-to-return/258967)
**Author:** [@mohannad](https://discuss.elastic.co/u/mohannad)\ **Replies:** 0\ **Last updated:** [December 17, 2020, 9:05am UTC](https://discuss.elastic.co/t/searching-document-nest-with-selecting-fields-to-return/258967 "2020-12-17T09:05:43Z")
Hi, I am quite new in Elasticsearch and I have some questions. The case is "FS-Crawler" is used with Elastic to index a group of documents. I am trying to search (using NEST) the content of the documents with filtration… --- ## [Supported output types for elastic agent?](https://discuss.elastic.co/t/supported-output-types-for-elastic-agent/258901)
**Author:** [@slmingol](https://discuss.elastic.co/u/slmingol)\ **Replies:** 1\ **Last updated:** [December 17, 2020, 8:56am UTC](https://discuss.elastic.co/t/supported-output-types-for-elastic-agent/258901 "2020-12-17T08:56:29Z")
Is it safe to assume that given Elastic Agent is built on top of \*beats technology that it'll support the use of different output types such as Kafka? https://www.elastic.co/guide/en/beats/filebeat/master/kafka-output.… --- ## [Snapshot & Restore on Windows can not access directory](https://discuss.elastic.co/t/snapshot-restore-on-windows-can-not-access-directory/257472)
**Author:** [@azeiner](https://discuss.elastic.co/u/azeiner)\ **Replies:** 3\ **Last updated:** [December 17, 2020, 8:04am UTC](https://discuss.elastic.co/t/snapshot-restore-on-windows-can-not-access-directory/257472 "2020-12-17T08:04:23Z")
We've got a 3 Node Elastic Cluster on Windows 10 (Customer Request) and i would like to configure the snapshot restore ability for the cluster. What i've done is to create a share on one of the Node (seperate Harddisk),… --- ## [Dec 17th, 2020: \[KR\] Elastic Cloud 에서 한글 형태소 분석기 사용하기](https://discuss.elastic.co/t/dec-17th-2020-kr-elastic-cloud/258379)
**Author:** [@kimjmin](https://discuss.elastic.co/u/kimjmin)\ **Replies:** 0\ **Last updated:** [December 17, 2020, 8:00am UTC](https://discuss.elastic.co/t/dec-17th-2020-kr-elastic-cloud/258379 "2020-12-17T08:00:00Z")
Elasticsearch 에서는 Elastic 에서 공식으로 제공하는 한글 형태소 분석기인 nori 를 사용할 수 있습니다. 한글은 띄어쓰기가 없는 복합어가 대다수이기 때문에 의도하지 않은 대로 분석이 되는 경우가 많아 nori 를 사용하기 위해서는 목적에 맞는 사용자 사전을 등록해야 할 때가 많습니다. nori\_tokenizer 에서는 사용자 사전을 텍스트 파일로 만들어 등록하거나 인덱스… --- ## [Custom event category in correlation rule](https://discuss.elastic.co/t/custom-event-category-in-correlation-rule/258809)
**Author:** [@msszafar](https://discuss.elastic.co/u/msszafar)\ **Replies:** 4\ **Last updated:** [December 17, 2020, 7:48am UTC](https://discuss.elastic.co/t/custom-event-category-in-correlation-rule/258809 "2020-12-17T07:48:54Z")
Can anyone please explain what does it means I have Symantec antimalware logs on index pattern logstash-sepm\*. In json document I don't have event.category field but I want to create a correlation rule what if the sa… --- ## [Would ES reindex API ignore all updates post reindex is triggered](https://discuss.elastic.co/t/would-es-reindex-api-ignore-all-updates-post-reindex-is-triggered/258948)
**Author:** [@the123saurav](https://discuss.elastic.co/u/the123saurav)\ **Replies:** 3\ **Last updated:** [December 17, 2020, 7:32am UTC](https://discuss.elastic.co/t/would-es-reindex-api-ignore-all-updates-post-reindex-is-triggered/258948 "2020-12-17T07:32:49Z")
I read that ES' reindex API works by taking a snapshot of the source index. So let's say i triggered reindexing at T0 and this finished at T2. So if say any create/update/delete came for any document at T1 (T0 \< T1 \< T… --- ## [Automatically elastic operator pod went down and up](https://discuss.elastic.co/t/automatically-elastic-operator-pod-went-down-and-up/258840)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 4\ **Last updated:** [December 16, 2020, 3:53pm UTC](https://discuss.elastic.co/t/automatically-elastic-operator-pod-went-down-and-up/258840 "2020-12-16T15:53:36Z")
Deployed Elasticsearch cluster in GCP. Without making any changes, operator pod goes down and after sometime pods get restarted. Elastic operator version is 1.1.0 . Below is logs of elastic operator pod . {"log.level":… --- ## [Does close index free up disk or memory](https://discuss.elastic.co/t/does-close-index-free-up-disk-or-memory/258868)
**Author:** [@divya\_lakshmi](https://discuss.elastic.co/u/divya_lakshmi)\ **Replies:** 2\ **Last updated:** [December 17, 2020, 6:40am UTC](https://discuss.elastic.co/t/does-close-index-free-up-disk-or-memory/258868 "2020-12-17T06:40:14Z")
Hi, I am using elasticsearch6.5 as single node, using 8GB of JVM and just 3% of memory is free. Will closing index using close API help to free heap memory .please tell what are the advantages of close index --- ## [Detection Alerts - Creating JIRA Ticket (Automatically)](https://discuss.elastic.co/t/detection-alerts-creating-jira-ticket-automatically/258930)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 3\ **Last updated:** [December 17, 2020, 6:33am UTC](https://discuss.elastic.co/t/detection-alerts-creating-jira-ticket-automatically/258930 "2020-12-17T06:33:20Z")
I need to be able to find a way of using the Elastic SIEM API to create tickets in JIRA everytime a Detection Alert comes in. We are trying to basically skip the "CASE" portion of the SIEM too, because it doesn't work f… --- ## [Understanding RestClient.java and its use of DEFAULT\_MAX\_CONN\_TOTAL](https://discuss.elastic.co/t/understanding-restclient-java-and-its-use-of-default-max-conn-total/258583)
**Author:** [@bdbusches](https://discuss.elastic.co/u/bdbusches)\ **Replies:** 4\ **Last updated:** [December 17, 2020, 6:07am UTC](https://discuss.elastic.co/t/understanding-restclient-java-and-its-use-of-default-max-conn-total/258583 "2020-12-17T06:07:13Z")
We're having difficulty with RestClient against a large 700 node ES cluster. Under a moderate search load (47 concurrent searches) we see extensive use of I/O Dispatchers (based on the default I/O Recator configs in th… --- ## [Salesforce Login History into SIEM or Logstash](https://discuss.elastic.co/t/salesforce-login-history-into-siem-or-logstash/258796)
**Author:** [@involuntary-pretzel](https://discuss.elastic.co/u/involuntary-pretzel)\ **Replies:** 1\ **Last updated:** [December 17, 2020, 6:03am UTC](https://discuss.elastic.co/t/salesforce-login-history-into-siem-or-logstash/258796 "2020-12-17T06:03:40Z")
Hi there, I'm trying to get Salesforce Login History into the SIEM or at least into Logstash so I can ship it to Elasticsearch. I notice Logstash has a Salesforce Plugin, do you know if that has the ability to ship Logi… --- ## [How to find Retention Rate of users in kibana](https://discuss.elastic.co/t/how-to-find-retention-rate-of-users-in-kibana/258705)
**Author:** [@dharanesh](https://discuss.elastic.co/u/dharanesh)\ **Replies:** 4\ **Last updated:** [December 17, 2020, 4:23am UTC](https://discuss.elastic.co/t/how-to-find-retention-rate-of-users-in-kibana/258705 "2020-12-17T04:23:01Z")
How to create a chart in kibana to represent Retention Rate. --- ## [Mapping fields xxx cannot be replaced during template composition](https://discuss.elastic.co/t/mapping-fields-xxx-cannot-be-replaced-during-template-composition/258938)
**Author:** [@amingo123](https://discuss.elastic.co/u/amingo123)\ **Replies:** 0\ **Last updated:** [December 17, 2020, 2:44am UTC](https://discuss.elastic.co/t/mapping-fields-xxx-cannot-be-replaced-during-template-composition/258938 "2020-12-17T02:44:06Z")
When i try to create new index as below, PUT /message202010 { "mappings": { "properties": { "CrashStatus": { "type": "keyword"}}}} i got the error message: { "error" : { "root\_cause" : \[ { "type" : "illegal\_a… --- ## [Filebeats with metricbeats data in standalone cluster](https://discuss.elastic.co/t/filebeats-with-metricbeats-data-in-standalone-cluster/258841)
**Author:** [@mutt13y](https://discuss.elastic.co/u/mutt13y)\ **Replies:** 2\ **Last updated:** [December 17, 2020, 1:40am UTC](https://discuss.elastic.co/t/filebeats-with-metricbeats-data-in-standalone-cluster/258841 "2020-12-17T01:40:55Z")
Hello, I am trying to move over to metricbeat monitoring running 7.10 eveywhere I have Filebeat -\> logstash -\> elastic main cluster filebeat node metricbeat -\> monitoring cluster logstash node metricbeat -\> monitorin… --- ## [Docker Metricbeat 7.6.0 doesn't send Host processes](https://discuss.elastic.co/t/docker-metricbeat-7-6-0-doesnt-send-host-processes/257684)
**Author:** [@gregbk](https://discuss.elastic.co/u/gregbk)\ **Replies:** 2\ **Last updated:** [December 17, 2020, 1:38am UTC](https://discuss.elastic.co/t/docker-metricbeat-7-6-0-doesnt-send-host-processes/257684 "2020-12-17T01:38:26Z")
Hello ELK community! I tried to run a basic setup with ELK version 7.6.0 Metricbeat.yml metricbeat.config: modules: path: ${path.config}/modules.d/\*.yml # Reload module configs as they change: reload.ena… [Previous page](https://discuss.elastic.co/latest.md?page=1932) [Next page](https://discuss.elastic.co/latest.md?page=1934)