# Latest **URL:** https://discuss.elastic.co/latest.md?page=1941 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1942 --- ## [Kubernetes metadata not showing (add\_kubernetes\_metadata)](https://discuss.elastic.co/t/kubernetes-metadata-not-showing-add-kubernetes-metadata/255538)
**Author:** [@humartinez](https://discuss.elastic.co/u/humartinez)\ **Replies:** 5\ **Last updated:** [December 14, 2020, 10:24am UTC](https://discuss.elastic.co/t/kubernetes-metadata-not-showing-add-kubernetes-metadata/255538 "2020-12-14T10:24:00Z")
Hi, Im currently having issues with the add\_kubernetes\_metadata processor. Im adding a simple config and I've configured a service account to have permissions to query the cluster, but I cant get any metadata entry with… --- ## [ILM Delete Phase not working](https://discuss.elastic.co/t/ilm-delete-phase-not-working/258559)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 4\ **Last updated:** [December 14, 2020, 10:21am UTC](https://discuss.elastic.co/t/ilm-delete-phase-not-working/258559 "2020-12-14T10:21:47Z")
Hi All, I have defined an ILM policy with hot, warm and delete phase. Hot are warm phase are working as expected, but in spite of the delete phase says "complete", the index is still there... Am I misunderstanding som… --- ## [Tag Cloud to only show current value](https://discuss.elastic.co/t/tag-cloud-to-only-show-current-value/258165)
**Author:** [@fastxl](https://discuss.elastic.co/u/fastxl)\ **Replies:** 7\ **Last updated:** [December 14, 2020, 9:52am UTC](https://discuss.elastic.co/t/tag-cloud-to-only-show-current-value/258165 "2020-12-14T09:52:53Z")
I am reading data in from a machine tool and I would like to visualize the current status. My document looks like this @timestamp Dec 9, 2020 @ 10:44:00.867 @version 1 Events.Execution.@@data INTERRUPTED Events.Execut… --- ## [ElasticsearchException: Concurrent modification of alias \[datastream\] during rollover](https://discuss.elastic.co/t/elasticsearchexception-concurrent-modification-of-alias-datastream-during-rollover/258547)
**Author:** [@altuhovsu](https://discuss.elastic.co/u/altuhovsu)\ **Replies:** 0\ **Last updated:** [December 14, 2020, 8:15am UTC](https://discuss.elastic.co/t/elasticsearchexception-concurrent-modification-of-alias-datastream-during-rollover/258547 "2020-12-14T08:15:20Z")
Hello. We have a datastream with ILM policy (50gb or 30 days). It works, but when rollover occurs we see some errors in a logs and some indices created! This problem occurs only with datastreams and not with simple ind… --- ## [Replace Old Data From Logstash](https://discuss.elastic.co/t/replace-old-data-from-logstash/258538)
**Author:** [@rehannali](https://discuss.elastic.co/u/rehannali)\ **Replies:** 1\ **Last updated:** [December 14, 2020, 8:36am UTC](https://discuss.elastic.co/t/replace-old-data-from-logstash/258538 "2020-12-14T08:36:30Z")
Hi, I using MySql to dumb data into elasticsearch. It runs every 5 mins and got duplicate results. I want to replace data so there will be no duplicate entries in it. How can i achieve this? P.S. I need to replace who… --- ## [Scan Snapshot Repository](https://discuss.elastic.co/t/scan-snapshot-repository/257511)
**Author:** [@EnriqueM](https://discuss.elastic.co/u/EnriqueM)\ **Replies:** 5\ **Last updated:** [December 14, 2020, 7:59am UTC](https://discuss.elastic.co/t/scan-snapshot-repository/257511 "2020-12-14T07:59:45Z")
Good morning. After a data corruption in a server we have the path of the Snapshots repository. When adding the repository on a new cluster, the Snapshots it contains do not appear. Is there any way to recover the inf… --- ## [Elasticsearch repositoryが作成できない](https://discuss.elastic.co/t/elasticsearch-repository/258383)
**Author:** [@\_Username](https://discuss.elastic.co/u/_Username)\ **Replies:** 2\ **Last updated:** [December 14, 2020, 7:19am UTC](https://discuss.elastic.co/t/elasticsearch-repository/258383 "2020-12-14T07:19:06Z")
【問合せ内容】 Elasticsearchのsnapshot取得のため、リポジトリを作成しようとしているが、【現象】エラーが発生してリポジトリを作成できない。 同じ事象の情報や、原因調査方法など、助言をいただきたく、宜しくお願いいたします。 【環境】 Windows10 PRO(バージョン 1909)(※開発環境のため、スタンドアロン) Elasticsearch 7.9.2 kibana 7.9.2 【参考】 スナップシ… --- ## [How to enable SO\_KEEPALIVE with the Java HighLevel Rest client](https://discuss.elastic.co/t/how-to-enable-so-keepalive-with-the-java-highlevel-rest-client/188979)
**Author:** [@menardorama](https://discuss.elastic.co/u/menardorama)\ **Replies:** 1\ **Last updated:** [December 14, 2020, 7:05am UTC](https://discuss.elastic.co/t/how-to-enable-so-keepalive-with-the-java-highlevel-rest-client/188979 "2020-12-14T07:05:02Z")
Hi, First of all I am not a Java developper but a Sysadmin. We are hosting an java microservice application that is using Elasticsearch on a Kubernetes platform. We are facing some « Connection Reset » on the client s… --- ## [Hive connection and data ingestion](https://discuss.elastic.co/t/hive-connection-and-data-ingestion/256797)
**Author:** [@irfangk1](https://discuss.elastic.co/u/irfangk1)\ **Replies:** 1\ **Last updated:** [December 14, 2020, 6:37am UTC](https://discuss.elastic.co/t/hive-connection-and-data-ingestion/256797 "2020-12-14T06:37:14Z")
Hi, I want to connect Hive with Elastic and then ingest data into it. Please share the steps/process --- ## [Forming Index name for Elasticsearch plugin](https://discuss.elastic.co/t/forming-index-name-for-elasticsearch-plugin/258398)
**Author:** [@s0umen](https://discuss.elastic.co/u/s0umen)\ **Replies:** 6\ **Last updated:** [December 14, 2020, 6:18am UTC](https://discuss.elastic.co/t/forming-index-name-for-elasticsearch-plugin/258398 "2020-12-14T06:18:20Z")
I am sending Linux system logs using filebeat to logstash. my "logstash.conf" file is something like below (within double Line). I am trying to name index dynamically using "type" variable. But when I view it in Kibana… --- ## [Ingest timestamp](https://discuss.elastic.co/t/ingest-timestamp/258526)
**Author:** [@hs01](https://discuss.elastic.co/u/hs01)\ **Replies:** 1\ **Last updated:** [December 14, 2020, 6:08am UTC](https://discuss.elastic.co/t/ingest-timestamp/258526 "2020-12-14T06:08:23Z")
Is it possible for ingest timestamp (introduced via ingest pipeline) to be out of order with respect to actual index time (when a document becomes queryable) i.e., doc\_1 =\> ingest\_time\_t1 doc\_2 =\> ingest\_time\_t2 ingest… --- ## [Is it possible to build elasticsearch-range-aggretaion-of-aggregation](https://discuss.elastic.co/t/is-it-possible-to-build-elasticsearch-range-aggretaion-of-aggregation/258537)
**Author:** [@Ju\_Cheng](https://discuss.elastic.co/u/Ju_Cheng)\ **Replies:** 0\ **Last updated:** [December 14, 2020, 5:34am UTC](https://discuss.elastic.co/t/is-it-possible-to-build-elasticsearch-range-aggretaion-of-aggregation/258537 "2020-12-14T05:34:42Z")
I am new to elasticsearch and my log are about users and the conferences they participate, like {"userid": "user1", "conferencesId": "c2", "action":"blabla" ... } {"userid": "user2", "conferencesId": "c2", "action":"bla… --- ## [Change index file name from logstash command](https://discuss.elastic.co/t/change-index-file-name-from-logstash-command/258532)
**Author:** [@Aryaman\_Gupta](https://discuss.elastic.co/u/Aryaman_Gupta)\ **Replies:** 0\ **Last updated:** [December 14, 2020, 4:54am UTC](https://discuss.elastic.co/t/change-index-file-name-from-logstash-command/258532 "2020-12-14T04:54:46Z")
Is there any way to give custom name to index file in logstash config file every-time I run log-stash command? output { elasticsearch { hosts =\> \["localhost:9200"\] index =\> "global7679-%{+YYYY.MM.dd}" \<----- Need to … --- ## [What happens if I restart the apm when I still have messages in the queue? Is the messages still there?](https://discuss.elastic.co/t/what-happens-if-i-restart-the-apm-when-i-still-have-messages-in-the-queue-is-the-messages-still-there/258525)
**Author:** [@111395](https://discuss.elastic.co/u/111395)\ **Replies:** 4\ **Last updated:** [December 14, 2020, 4:18am UTC](https://discuss.elastic.co/t/what-happens-if-i-restart-the-apm-when-i-still-have-messages-in-the-queue-is-the-messages-still-there/258525 "2020-12-14T04:18:40Z")
I think messages is there。 --- ## [ES operator log rotation](https://discuss.elastic.co/t/es-operator-log-rotation/256494)
**Author:** [@Ravi\_Gusain](https://discuss.elastic.co/u/Ravi_Gusain)\ **Replies:** 6\ **Last updated:** [December 14, 2020, 4:12am UTC](https://discuss.elastic.co/t/es-operator-log-rotation/256494 "2020-12-14T04:12:54Z")
Hi, What's the by default log rotation policy for ES operator? I have created master node of 1G, want to understand chances of it getting filled with the logs. Thanks Ravi --- ## [What the app domain in workplace search connection to google drive](https://discuss.elastic.co/t/what-the-app-domain-in-workplace-search-connection-to-google-drive/258506)
**Author:** [@111207](https://discuss.elastic.co/u/111207)\ **Replies:** 1\ **Last updated:** [December 14, 2020, 2:52am UTC](https://discuss.elastic.co/t/what-the-app-domain-in-workplace-search-connection-to-google-drive/258506 "2020-12-14T02:52:52Z")
Hi Elastic team I'm tried to used trial Enterprise search select workplace search on cloud I need to connect with my google drive. I'm tried to configuration from document guide. But the document with connection goog… --- ## [Need help in writing DSL](https://discuss.elastic.co/t/need-help-in-writing-dsl/258451)
**Author:** [@Vikas\_Rathore](https://discuss.elastic.co/u/Vikas_Rathore)\ **Replies:** 1\ **Last updated:** [December 13, 2020, 1:47pm UTC](https://discuss.elastic.co/t/need-help-in-writing-dsl/258451 "2020-12-13T13:47:31Z")
I searched a lot but couldn't able to write a proper KQL. I am trying to search a string "error" in message field AND field kubernetes.pod.name must contain test-\* I tried this but it's not working { "size": 1, "qu… --- ## [How to deploy logstash with persistent volume on kubernetes?](https://discuss.elastic.co/t/how-to-deploy-logstash-with-persistent-volume-on-kubernetes/258505)
**Author:** [@iooi](https://discuss.elastic.co/u/iooi)\ **Replies:** 0\ **Last updated:** [December 13, 2020, 1:17pm UTC](https://discuss.elastic.co/t/how-to-deploy-logstash-with-persistent-volume-on-kubernetes/258505 "2020-12-13T13:17:59Z")
Using GKE to deploy logstash by statefulset kind with pvc. Also need to install an output plugin. When don't use while true; do sleep 1000; done; in container's command args, it can't deploy with pvc successfully. The … --- ## [Null and nil](https://discuss.elastic.co/t/null-and-nil/258507)
**Author:** [@rojin](https://discuss.elastic.co/u/rojin)\ **Replies:** 0\ **Last updated:** [December 13, 2020, 1:25pm UTC](https://discuss.elastic.co/t/null-and-nil/258507 "2020-12-13T13:25:44Z")
Hello everyone! I have a grok pattern which some of its fields may include "null" values. How am I supposed to show null in kibana? or logstash output? I have defined the pattern as number for those fields. input { … --- ## [Stop Words something missing](https://discuss.elastic.co/t/stop-words-something-missing/258504)
**Author:** [@ElGringo](https://discuss.elastic.co/u/ElGringo)\ **Replies:** 0\ **Last updated:** [December 13, 2020, 12:54pm UTC](https://discuss.elastic.co/t/stop-words-something-missing/258504 "2020-12-13T12:54:07Z")
Hi, I'm trying to use stop words with ELK, everything seems ok but when I'm inserting a new value the filter does not apply. Using \_analyze it works ... I think something is wrong in my mapping but I don't find what. Th… --- ## [Deploying elasticsearch cluster on kubernetes issue](https://discuss.elastic.co/t/deploying-elasticsearch-cluster-on-kubernetes-issue/258474)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 8\ **Last updated:** [December 13, 2020, 10:24am UTC](https://discuss.elastic.co/t/deploying-elasticsearch-cluster-on-kubernetes-issue/258474 "2020-12-13T10:24:44Z")
Hello, I am trying to deploy elasticsearch 7.7.1 on kubernetes into a 3 node cluster. I have tried following the documentation for it and when I run kubectl apply -f \.yaml I am getting the following error: … --- ## [How should I use keystore?](https://discuss.elastic.co/t/how-should-i-use-keystore/258475)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 3\ **Last updated:** [December 13, 2020, 9:32am UTC](https://discuss.elastic.co/t/how-should-i-use-keystore/258475 "2020-12-13T09:32:47Z")
Hi I am using a cluster and also using x-pack security for passwords and... I have also activate transfer layer security between Elasticsearch nodes and Kibana (HTTPS) My question is: How can I hide all of my passwor… --- ## [Dec 13th, 2020: \[EN\] Making it personal: Tailoring content with signed search keys in App Search](https://discuss.elastic.co/t/dec-13th-2020-en-making-it-personal-tailoring-content-with-signed-search-keys-in-app-search/257827)
**Author:** [@orhantoy](https://discuss.elastic.co/u/orhantoy)\ **Replies:** 0\ **Last updated:** [December 13, 2020, 8:00am UTC](https://discuss.elastic.co/t/dec-13th-2020-en-making-it-personal-tailoring-content-with-signed-search-keys-in-app-search/257827 "2020-12-13T08:00:05Z")
Signed search keys in Elastic App Search give you more control of a user's search experience. You can tailor the experience to show results you know are more relevant to the specific user while also letting you control w… --- ## [Autocomplete search in both title and body](https://discuss.elastic.co/t/autocomplete-search-in-both-title-and-body/258442)
**Author:** [@Ofer\_Ben-Dayan](https://discuss.elastic.co/u/Ofer_Ben-Dayan)\ **Replies:** 2\ **Last updated:** [December 13, 2020, 7:24am UTC](https://discuss.elastic.co/t/autocomplete-search-in-both-title-and-body/258442 "2020-12-13T07:24:26Z")
Hi! We've made a custom implementation of the api, using the "search" endpoint instead of the "suggest", so the autocomplete suggestion mechanism searches both title and body of our documents. The problem - while the … --- ## [No data alert for special field](https://discuss.elastic.co/t/no-data-alert-for-special-field/255070)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 1\ **Last updated:** [December 13, 2020, 6:41am UTC](https://discuss.elastic.co/t/no-data-alert-for-special-field/255070 "2020-12-13T06:41:48Z")
Hi every one, I have 5 machines that send logs into test index without logstash. my test index is like : { "id" : "Machine\_1", "services\_is\_ok" : true, "delta" : 60, "time" : 16… --- ## [App Search - API logs and Analytics are empty](https://discuss.elastic.co/t/app-search-api-logs-and-analytics-are-empty/256141)
**Author:** [@aq1652](https://discuss.elastic.co/u/aq1652)\ **Replies:** 9\ **Last updated:** [December 12, 2020, 10:11pm UTC](https://discuss.elastic.co/t/app-search-api-logs-and-analytics-are-empty/256141 "2020-12-12T22:11:46Z")
Hi, I've been struggling with this for a few days and no luck. As the title suggests, my self-hsoted app search is not displaying any API logs and the analytics are empty! The data is definitely being stored somewhere, … --- ## [Logstash UDP input buffer](https://discuss.elastic.co/t/logstash-udp-input-buffer/258480)
**Author:** [@Hendrik1](https://discuss.elastic.co/u/Hendrik1)\ **Replies:** 7\ **Last updated:** [December 12, 2020, 7:29pm UTC](https://discuss.elastic.co/t/logstash-udp-input-buffer/258480 "2020-12-12T19:29:22Z")
Hi, I am using the logstash UDP input to receive my firewall syslog messages, this seems to work fine. However, I just enabled the reverse dns lookup filter on the ip's, but now I keep wondering what happens when the U… --- ## [Bug: Netflow events takes event.created from flow.timestamp](https://discuss.elastic.co/t/bug-netflow-events-takes-event-created-from-flow-timestamp/258487)
**Author:** [@shanavas786](https://discuss.elastic.co/u/shanavas786)\ **Replies:** 0\ **Last updated:** [December 12, 2020, 6:19pm UTC](https://discuss.elastic.co/t/bug-netflow-events-takes-event-created-from-flow-timestamp/258487 "2020-12-12T18:19:58Z")
As per documentation, event.created is the timestamp at which the event is read by agent/pipeline. Conversely, it is being copied from flow.Timestamp. Shouldn't it be time.Now() ? --- ## [Node joining docker](https://discuss.elastic.co/t/node-joining-docker/257742)
**Author:** [@Bonzo](https://discuss.elastic.co/u/Bonzo)\ **Replies:** 3\ **Last updated:** [December 12, 2020, 3:56pm UTC](https://discuss.elastic.co/t/node-joining-docker/257742 "2020-12-12T15:56:51Z")
Hi I have problem joining a data node to the cluster. I m using docker in 2 separate machines. Both machines can talk to each other. My first docker: -- Master docker run -d --name elastic -p 9200:9200 -p 9300:93… --- ## [Detect epoch as Date field](https://discuss.elastic.co/t/detect-epoch-as-date-field/258477)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 1\ **Last updated:** [December 12, 2020, 3:24pm UTC](https://discuss.elastic.co/t/detect-epoch-as-date-field/258477 "2020-12-12T15:24:17Z")
Hi every one, i have an index (name: x-001) with a date field: { "time": { "type": "date" } } I insert docs into index like this: time: 1607782041000 elasticsearch automatically convert epoch to dateti… [Previous page](https://discuss.elastic.co/latest.md?page=1940) [Next page](https://discuss.elastic.co/latest.md?page=1942)