gives me both total documents, store.size and pri.store.size. Say if I have an index with 1 primary and 1 replica. say …
---
## [Filebeat output logtash - wrong value in "host" field seen in elasticsearch Index](https://discuss.elastic.co/t/filebeat-output-logtash-wrong-value-in-host-field-seen-in-elasticsearch-index/324493)
**Author:** [@madhu\_sudan](https://discuss.elastic.co/u/madhu_sudan)\
**Replies:** 0\
**Last updated:** [February 2, 2023, 2:31am UTC](https://discuss.elastic.co/t/filebeat-output-logtash-wrong-value-in-host-field-seen-in-elasticsearch-index/324493 "2023-02-02T02:31:08Z")
I see value for "host" field as the container IP, but was expecting the hostname of the docker host. host 192.168.254.4 Also added processors: add\_docker\_metadata: ~
---
## [Latency (No data to display) Stack Monitoring Elasticsearch](https://discuss.elastic.co/t/latency-no-data-to-display-stack-monitoring-elasticsearch/324489)
**Author:** [@jacksparrow414](https://discuss.elastic.co/u/jacksparrow414)\
**Replies:** 1\
**Last updated:** [February 2, 2023, 1:32am UTC](https://discuss.elastic.co/t/latency-no-data-to-display-stack-monitoring-elasticsearch/324489 "2023-02-02T01:32:46Z")
I use Metricbeat to monitor an Elasticsearch node and send metrics to it. The versions of all components are 8.5.3 The Metricbeat configuration file is as follows ## Metricbeat configuration metricbeat.config: modul…
---
## [Syntax error](https://discuss.elastic.co/t/syntax-error/324471)
**Author:** [@moep](https://discuss.elastic.co/u/moep)\
**Replies:** 3\
**Last updated:** [February 2, 2023, 12:32am UTC](https://discuss.elastic.co/t/syntax-error/324471 "2023-02-02T00:32:40Z")
Hey there, I'm working playing with Logstash and wrote alot of grok patterns. But right now, I have a syntax error in this snippet: if \[message\] =~ "SMTP error from remote mail server after RCPT TO" { grok { …
---
## [Rule with index connector - issue with {{alert.id}}](https://discuss.elastic.co/t/rule-with-index-connector-issue-with-alert-id/324459)
**Author:** [@justme123](https://discuss.elastic.co/u/justme123)\
**Replies:** 5\
**Last updated:** [February 1, 2023, 10:38pm UTC](https://discuss.elastic.co/t/rule-with-index-connector-issue-with-alert-id/324459 "2023-02-01T22:38:13Z")
Hello all, I hope that I write in a good place. I'm newbie with ELK and I need help with rule. So I have a rule with index connector, when I add "alert.id": "{{alert.id}}" in index in discover logs show me only : a…
---
## [On-prem Kibana can't join elastic-package-registry (EPR) behind a proxy due to certificate issue - workaround tested](https://discuss.elastic.co/t/on-prem-kibana-cant-join-elastic-package-registry-epr-behind-a-proxy-due-to-certificate-issue-workaround-tested/324486)
**Author:** [@antoine\_duriez](https://discuss.elastic.co/u/antoine_duriez)\
**Replies:** 0\
**Last updated:** [February 1, 2023, 10:20pm UTC](https://discuss.elastic.co/t/on-prem-kibana-cant-join-elastic-package-registry-epr-behind-a-proxy-due-to-certificate-issue-workaround-tested/324486 "2023-02-01T22:20:35Z")
Hi, I have an on-prem stack 8.5.3 on RHEL 8 with high customer's restriction. Access to internet is done throught a proxy. Access to epr. elastic.co was opened and tested well with the command: nc epr.elastic.co 44…
---
## [Combining records that have the same id with a query](https://discuss.elastic.co/t/combining-records-that-have-the-same-id-with-a-query/324479)
**Author:** [@chachew](https://discuss.elastic.co/u/chachew)\
**Replies:** 2\
**Last updated:** [February 1, 2023, 9:24pm UTC](https://discuss.elastic.co/t/combining-records-that-have-the-same-id-with-a-query/324479 "2023-02-01T21:24:45Z")
I have records for call logs that i want to query and combine into 1 result per record instead of 2. This is for logging of calls from one person to another. The person that initiates the call has the 'initiator' flag se…
---
## [Make a copy of a running Elastic node](https://discuss.elastic.co/t/make-a-copy-of-a-running-elastic-node/324448)
**Author:** [@tmslara.a](https://discuss.elastic.co/u/tmslara.a)\
**Replies:** 8\
**Last updated:** [February 1, 2023, 9:02pm UTC](https://discuss.elastic.co/t/make-a-copy-of-a-running-elastic-node/324448 "2023-02-01T21:02:49Z")
Hi, I have a running Elastic node with an index. I'm constantly inserting documents into the index in a process that I can't stop. The whole process is running in a remote server. I need to make a copy of the index int…
---
## [Elasticsearch 1.7.0 has authentication at all?](https://discuss.elastic.co/t/elasticsearch-1-7-0-has-authentication-at-all/324394)
**Author:** [@RaZzLe](https://discuss.elastic.co/u/RaZzLe)\
**Replies:** 6\
**Last updated:** [February 1, 2023, 8:23pm UTC](https://discuss.elastic.co/t/elasticsearch-1-7-0-has-authentication-at-all/324394 "2023-02-01T20:23:48Z")
Hello all, I have received an e-mail from the security department that one of the machines which is under my administration has a basic authentication on Elasticsearch. I have checked the respective Elasticsearch insta…
---
## [Unable to escape special character using Java REST API](https://discuss.elastic.co/t/unable-to-escape-special-character-using-java-rest-api/324456)
**Author:** [@Avi\_Buk](https://discuss.elastic.co/u/Avi_Buk)\
**Replies:** 3\
**Last updated:** [February 1, 2023, 7:33pm UTC](https://discuss.elastic.co/t/unable-to-escape-special-character-using-java-rest-api/324456 "2023-02-01T19:33:54Z")
Hi, I'm using query\_string which is Lucene-based, and when I'm trying to send a query with "role" field contains the string "INFRA-Server", it cannot find any results because of the "-" sign. I tried to escape it, but …
---
## [OFFSET query \_sql is not recognizing](https://discuss.elastic.co/t/offset-query-sql-is-not-recognizing/324473)
**Author:** [@SergioFF](https://discuss.elastic.co/u/SergioFF)\
**Replies:** 1\
**Last updated:** [February 1, 2023, 7:21pm UTC](https://discuss.elastic.co/t/offset-query-sql-is-not-recognizing/324473 "2023-02-01T19:21:58Z")
Hello, I have version 8.5.2 of Elasticsearch and I am trying to use the OFFSET clause within a query, but it is not recognizing it, can this clause be used in the version we have? The query I am sending is as follows: G…
---
## [Kibana control limitation](https://discuss.elastic.co/t/kibana-control-limitation/323872)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Replies:** 5\
**Last updated:** [February 1, 2023, 5:59pm UTC](https://discuss.elastic.co/t/kibana-control-limitation/323872 "2023-02-01T17:59:08Z")
using Kibana 8.5.3 new control can only show 10 value. How do I change that to see more value? in old control it was working
---
## [Timelion not working at all: "Timelion request error: in cell #1: No such function: es"](https://discuss.elastic.co/t/timelion-not-working-at-all-timelion-request-error-in-cell-1-no-such-function-es/324211)
**Author:** [@matej.szabo](https://discuss.elastic.co/u/matej.szabo)\
**Replies:** 7\
**Last updated:** [February 1, 2023, 5:02pm UTC](https://discuss.elastic.co/t/timelion-not-working-at-all-timelion-request-error-in-cell-1-no-such-function-es/324211 "2023-02-01T17:02:50Z")
Hello everyone, We have just finished building up our ELK stack from the latest pieces of this puzzle (8.6.0): elasticsearch+kibana+filebeat+metricbeat. We are trying to build some timelion visualizations from metricbea…
---
## [Can't Configure or Enable Security Features in Elasticsearch 8.4](https://discuss.elastic.co/t/cant-configure-or-enable-security-features-in-elasticsearch-8-4/323971)
**Author:** [@Joao\_Malebo](https://discuss.elastic.co/u/Joao_Malebo)\
**Replies:** 5\
**Last updated:** [February 1, 2023, 4:15pm UTC](https://discuss.elastic.co/t/cant-configure-or-enable-security-features-in-elasticsearch-8-4/323971 "2023-02-01T16:15:59Z")
Hello dears, I'm having trouble I'm following the tutorial below, and when I finish the configuration, when starting Kibana I get an error: Toturial: https://www.elastic.co/guide/en/elasticsearch/reference/current/sec…
---
## [Any way to migrate Legacy templates to composable templates?](https://discuss.elastic.co/t/any-way-to-migrate-legacy-templates-to-composable-templates/324454)
**Author:** [@Monica\_majua](https://discuss.elastic.co/u/Monica_majua)\
**Replies:** 1\
**Last updated:** [February 1, 2023, 4:01pm UTC](https://discuss.elastic.co/t/any-way-to-migrate-legacy-templates-to-composable-templates/324454 "2023-02-01T16:01:25Z")
I have migrated to elasticsearch 7.8, I was reading that some of the changes include the replacement of Legacy index templates to composable index templates and I would like support to find a guide that can help me to mi…
---
## [Move config folder to another location on Window (v8.6.0)](https://discuss.elastic.co/t/move-config-folder-to-another-location-on-window-v8-6-0/324446)
**Author:** [@ykara84](https://discuss.elastic.co/u/ykara84)\
**Replies:** 0\
**Last updated:** [February 1, 2023, 2:53pm UTC](https://discuss.elastic.co/t/move-config-folder-to-another-location-on-window-v8-6-0/324446 "2023-02-01T14:53:03Z")
Hi, I have ES 8.6.0 on Windows (single-node). I am looking to move the config folder to another location. I have I have added two new environment variables: C:\\Windows\\system32\>echo %ES\_HOME% E:\\elk\\elasticsearch\\8.6.…
---
## [Filebeat log fails to publish events](https://discuss.elastic.co/t/filebeat-log-fails-to-publish-events/324127)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\
**Replies:** 9\
**Last updated:** [February 1, 2023, 2:23pm UTC](https://discuss.elastic.co/t/filebeat-log-fails-to-publish-events/324127 "2023-02-01T14:23:15Z")
Hello, Our ELK cluster has been stable for a long time, but recently we have started seeing the following error in the filebeat log: ERROR logstash/async.go:256 Failed to publish events caused by: write tcp xx.xx.x…
---
## [Which certificate do I need for an external Java client linked to a self-hosted docker Elasticsearch 8.x, since the self-signed http\_ca.crt does not function unless the Java client is installed locally on the same server?](https://discuss.elastic.co/t/which-certificate-do-i-need-for-an-external-java-client-linked-to-a-self-hosted-docker-elasticsearch-8-x-since-the-self-signed-http-ca-crt-does-not-function-unless-the-java-client-is-installed-locally-on-the-same-server/324159)
**Author:** [@m.jaafar](https://discuss.elastic.co/u/m.jaafar)\
**Replies:** 3\
**Last updated:** [February 1, 2023, 2:06pm UTC](https://discuss.elastic.co/t/which-certificate-do-i-need-for-an-external-java-client-linked-to-a-self-hosted-docker-elasticsearch-8-x-since-the-self-signed-http-ca-crt-does-not-function-unless-the-java-client-is-installed-locally-on-the-same-server/324159 "2023-02-01T14:06:41Z")
I understand that when I set up a docker image of elasticsearch version 8.x, the security is automatically activated, and three certificates are produced in the config/certs/ directory, which are: http\_ca.crt: The CA …
---
## [Combining fields into one for performance?](https://discuss.elastic.co/t/combining-fields-into-one-for-performance/324433)
**Author:** [@ryans](https://discuss.elastic.co/u/ryans)\
**Replies:** 0\
**Last updated:** [February 1, 2023, 1:59pm UTC](https://discuss.elastic.co/t/combining-fields-into-one-for-performance/324433 "2023-02-01T13:59:10Z")
I currently have 140 fields in my Elasticsearch index-based App Search Engine. I realized that 40 of those fields contain data that does not need to be indexed (it's display only data), so I marked them index:false in t…
---
## [Watcher - Actions conditions in foreach](https://discuss.elastic.co/t/watcher-actions-conditions-in-foreach/324349)
**Author:** [@v\_watch](https://discuss.elastic.co/u/v_watch)\
**Replies:** 4\
**Last updated:** [February 1, 2023, 1:56pm UTC](https://discuss.elastic.co/t/watcher-actions-conditions-in-foreach/324349 "2023-02-01T13:56:41Z")
Hello, I am trying to create a watcher that must send a different slack message depending on the field "state" from each log in the hits.hits The slack message must have: "color" = "good" if the state is finished "col…
---
## [Config monitoring moduels for Kind Elasticsearch](https://discuss.elastic.co/t/config-monitoring-moduels-for-kind-elasticsearch/324429)
**Author:** [@Ofir\_Edi](https://discuss.elastic.co/u/Ofir_Edi)\
**Replies:** 0\
**Last updated:** [February 1, 2023, 1:38pm UTC](https://discuss.elastic.co/t/config-monitoring-moduels-for-kind-elasticsearch/324429 "2023-02-01T13:38:39Z")
Hi, I'm configuring Monitoring in ECK using the spec.monitoring as defined here: Stack Monitoring | Elastic Cloud on Kubernetes \[master\] | Elastic I want to be able to better control the period in which metricbeat samp…
---
## [Java heap oom on logstash](https://discuss.elastic.co/t/java-heap-oom-on-logstash/324426)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\
**Replies:** 2\
**Last updated:** [February 1, 2023, 1:21pm UTC](https://discuss.elastic.co/t/java-heap-oom-on-logstash/324426 "2023-02-01T13:21:03Z")
Hi I'm using the latest one version of logstash 8.6.0 I meet the same processing error every day for one of pipeline in the meantime I decreased of count of workers and event and increased heap but still is not enough …
---
## [Passing dotnet APM Agent settings in Docker And Kubernetes](https://discuss.elastic.co/t/passing-dotnet-apm-agent-settings-in-docker-and-kubernetes/324427)
**Author:** [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)\
**Replies:** 0\
**Last updated:** [February 1, 2023, 1:03pm UTC](https://discuss.elastic.co/t/passing-dotnet-apm-agent-settings-in-docker-and-kubernetes/324427 "2023-02-01T13:03:08Z")
Hello I am trying to enable elastic APM with asp dotnet application but not able to find any reference document which says it is possible to enable apm & rum for containerized asp dotnet application Kindly suggest if i…
---
## [Use existing ElasticSearch tar while running integration/functional tests](https://discuss.elastic.co/t/use-existing-elasticsearch-tar-while-running-integration-functional-tests/324425)
**Author:** [@NamB](https://discuss.elastic.co/u/NamB)\
**Replies:** 0\
**Last updated:** [February 1, 2023, 12:48pm UTC](https://discuss.elastic.co/t/use-existing-elasticsearch-tar-while-running-integration-functional-tests/324425 "2023-02-01T12:48:59Z")
While running Kibana integration tests, could see that a daily Elasticsearch snapshot is downloaded and started. Is there some way to avoid this download and use locally built Elasticsearch file?
---
## [Logtash copy one field to another in a different log](https://discuss.elastic.co/t/logtash-copy-one-field-to-another-in-a-different-log/324423)
**Author:** [@tegerei](https://discuss.elastic.co/u/tegerei)\
**Replies:** 0\
**Last updated:** [February 1, 2023, 12:39pm UTC](https://discuss.elastic.co/t/logtash-copy-one-field-to-another-in-a-different-log/324423 "2023-02-01T12:39:45Z")
Hello, I have the following sample log. Feb 1 15:30:49 sudo: pam\_unix(sudo-i:auth): authentication failure; logname= uid=10050 euid=0 tty=/dev/pts/2 user=test Feb 1 15:30:50 sudo: pam\_sss(sudo-i:auth): authent…
---
## [Read Oracle Database Table Data vi Logstash to insert into ElasticSearch](https://discuss.elastic.co/t/read-oracle-database-table-data-vi-logstash-to-insert-into-elasticsearch/323717)
**Author:** [@SP003](https://discuss.elastic.co/u/SP003)\
**Replies:** 3\
**Last updated:** [February 1, 2023, 11:32am UTC](https://discuss.elastic.co/t/read-oracle-database-table-data-vi-logstash-to-insert-into-elasticsearch/323717 "2023-02-01T11:32:17Z")
Dear all, I am trying to connect with table from Oracle Database, and read records through logstash, and then to insert into Elastic search. And the same I want to do in a Linux system. So far I understood that I have …
---
## [Shared solution with SQL Server](https://discuss.elastic.co/t/shared-solution-with-sql-server/324416)
**Author:** [@Chen\_Shacham](https://discuss.elastic.co/u/Chen_Shacham)\
**Replies:** 0\
**Last updated:** [February 1, 2023, 11:27am UTC](https://discuss.elastic.co/t/shared-solution-with-sql-server/324416 "2023-02-01T11:27:54Z")
hello. I am trying to connect ELK search with my existing SQL Server ecosystem. I have created a CLR that calls Elastic index with search parameters (using native POST request) and then convert (deseriale) the results…
---
## [Error on running Elasticsearch from the command line](https://discuss.elastic.co/t/error-on-running-elasticsearch-from-the-command-line/324305)
**Author:** [@umairsaeed](https://discuss.elastic.co/u/umairsaeed)\
**Replies:** 9\
**Last updated:** [February 1, 2023, 11:09am UTC](https://discuss.elastic.co/t/error-on-running-elasticsearch-from-the-command-line/324305 "2023-02-01T11:09:12Z")
I downloaded, unzipped, and run Elasticsearch from the command line successfully. But after closing the command line, I am trying to run the Elasticsearch from the command line again, but it is giving me an error "localh…
---
## [How to change start of the week in date\_histogram based on 1w interval in group\_by transformof pivot](https://discuss.elastic.co/t/how-to-change-start-of-the-week-in-date-histogram-based-on-1w-interval-in-group-by-transformof-pivot/323675)
**Author:** [@sagarkhatri0605](https://discuss.elastic.co/u/sagarkhatri0605)\
**Replies:** 4\
**Last updated:** [February 1, 2023, 10:55am UTC](https://discuss.elastic.co/t/how-to-change-start-of-the-week-in-date-histogram-based-on-1w-interval-in-group-by-transformof-pivot/323675 "2023-02-01T10:55:09Z")
I am trying to create a transform with group\_by date\_histogram for interval of 1w (1 week), by default Elasticsearch considers week as Monday-Sunday and aggregates data accordingly, I want the week to start from Sunday i…
[Previous page](https://discuss.elastic.co/latest.md?page=798)
[Next page](https://discuss.elastic.co/latest.md?page=800)