# Latest **URL:** https://discuss.elastic.co/latest.md?page=936 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 937 --- ## [Delete actual config of snapshot](https://discuss.elastic.co/t/delete-actual-config-of-snapshot/316295)
**Author:** [@abkrim](https://discuss.elastic.co/u/abkrim)\ **Replies:** 0\ **Last updated:** [October 11, 2022, 9:05am UTC](https://discuss.elastic.co/t/delete-actual-config-of-snapshot/316295 "2022-10-11T09:05:35Z")
After working for a while in test mode, I wanted to start using NFS as a mount point for snapshots. I had a configuration in the elasticsearch.yml file \`path.repo:/snapshot\_elk I remember creating the snapshot with Kib… --- ## [Polygon storage failed](https://discuss.elastic.co/t/polygon-storage-failed/316162)
**Author:** [@baiwenbo1997](https://discuss.elastic.co/u/baiwenbo1997)\ **Replies:** 12\ **Last updated:** [October 11, 2022, 8:42am UTC](https://discuss.elastic.co/t/polygon-storage-failed/316162 "2022-10-11T08:42:40Z")
POLYGON((38591455.29279993 3341853.182999084,38591450.89579993 3341845.826799084,38591447.82339992 3341841.763499084,38591444.25549993 3341839.186599084,38591438.30899993 3341835.420499084,38591431.17329992 3341830.66319… --- ## [Logstash Pipeline getting Terminated due to avro format of kakfka topic](https://discuss.elastic.co/t/logstash-pipeline-getting-terminated-due-to-avro-format-of-kakfka-topic/316276)
**Author:** [@Akumar22](https://discuss.elastic.co/u/Akumar22)\ **Replies:** 0\ **Last updated:** [October 11, 2022, 6:45am UTC](https://discuss.elastic.co/t/logstash-pipeline-getting-terminated-due-to-avro-format-of-kakfka-topic/316276 "2022-10-11T06:45:24Z")
Hi, I have a topic in kafka which has messages in avro format, pasting a part of message below .. We are using this avro schema format, pasting a part of schema { "type" : "record", "name" : "ProductDetailsSc… --- ## [Install Elastic Agent on Windows from a read-only smb share](https://discuss.elastic.co/t/install-elastic-agent-on-windows-from-a-read-only-smb-share/316287)
**Author:** [@moschur](https://discuss.elastic.co/u/moschur)\ **Replies:** 0\ **Last updated:** [October 11, 2022, 8:35am UTC](https://discuss.elastic.co/t/install-elastic-agent-on-windows-from-a-read-only-smb-share/316287 "2022-10-11T08:35:34Z")
Hello! we are trying to install Elastic Agent (fleet-managed) on Windows using our software distribution tool. For this, we place the installation files on a read-only smb share. During installation, this share is mount… --- ## [CCS results sorting](https://discuss.elastic.co/t/ccs-results-sorting/316285)
**Author:** [@Ong](https://discuss.elastic.co/u/Ong)\ **Replies:** 0\ **Last updated:** [October 11, 2022, 8:29am UTC](https://discuss.elastic.co/t/ccs-results-sorting/316285 "2022-10-11T08:29:35Z")
I am setting up CCS with a remote cluster that contains 2 indexes using Kibana's data (kibana\_sample\_data\_ecommerce and kibana\_sample\_data\_flights). When performing a search across these 2 indexes, I noticed that the da… --- ## [Reset lab environment and training](https://discuss.elastic.co/t/reset-lab-environment-and-training/316259)
**Author:** [@deccman](https://discuss.elastic.co/u/deccman)\ **Replies:** 1\ **Last updated:** [October 11, 2022, 8:26am UTC](https://discuss.elastic.co/t/reset-lab-environment-and-training/316259 "2022-10-11T08:26:13Z")
Hi, Please could someone reset my Strigo lab environment and training progress for the Observability Engineer course, as I would like to a re-run of the course before doing the exam. This is the same/similar request as… --- ## [Can Filebeat access certs within a docker container?](https://discuss.elastic.co/t/can-filebeat-access-certs-within-a-docker-container/316004)
**Author:** [@userR](https://discuss.elastic.co/u/userR)\ **Replies:** 3\ **Last updated:** [October 11, 2022, 8:09am UTC](https://discuss.elastic.co/t/can-filebeat-access-certs-within-a-docker-container/316004 "2022-10-11T08:09:42Z")
Hi, we are currently running an application on a server through Docker. Unfortunately, the certs and logs are within the container itself. When setting up Filebeat, I was wondering if there was a way to access those cer… --- ## [Scripted metric not working inside transform](https://discuss.elastic.co/t/scripted-metric-not-working-inside-transform/316061)
**Author:** [@Hemabh\_Ravee\_Fox](https://discuss.elastic.co/u/Hemabh_Ravee_Fox)\ **Replies:** 2\ **Last updated:** [October 11, 2022, 8:06am UTC](https://discuss.elastic.co/t/scripted-metric-not-working-inside-transform/316061 "2022-10-11T08:06:52Z")
Hi, I have an index which contains events as documents and I'm trying to aggregate them by sessionId. I created the following transform and so far I have been able to generate the startTime, endTime, and sessionDuration,… --- ## [Cannot connect to Elasticsearch cluster using cloud\_id](https://discuss.elastic.co/t/cannot-connect-to-elasticsearch-cluster-using-cloud-id/316203)
**Author:** [@h.allaoui](https://discuss.elastic.co/u/h.allaoui)\ **Replies:** 8\ **Last updated:** [October 11, 2022, 7:57am UTC](https://discuss.elastic.co/t/cannot-connect-to-elasticsearch-cluster-using-cloud-id/316203 "2022-10-11T07:57:00Z")
Hi All, I have an issue, I cannot to connect to my Elasticsearch cluster from python client using its cloud\_id. I am getting following error: File "D:\\Data\\Hamid\\Workspace\\Python\\MyTools\\venv\\lib\\site-packages\\elast… --- ## [Trying to build index template from dynamicly generated template](https://discuss.elastic.co/t/trying-to-build-index-template-from-dynamicly-generated-template/315943)
**Author:** [@fribse](https://discuss.elastic.co/u/fribse)\ **Replies:** 2\ **Last updated:** [October 11, 2022, 7:52am UTC](https://discuss.elastic.co/t/trying-to-build-index-template-from-dynamicly-generated-template/315943 "2022-10-11T07:52:15Z")
I want to apply lifecycle policy on some of the indexes. So I think I need to create an index template, otherwise I will have to contiunally apply the policy to newly created indexes. I pulled an index template from a … --- ## [Aggregate + sort + paginate on nested documents](https://discuss.elastic.co/t/aggregate-sort-paginate-on-nested-documents/314715)
**Author:** [@t0mer](https://discuss.elastic.co/u/t0mer)\ **Replies:** 1\ **Last updated:** [October 11, 2022, 7:44am UTC](https://discuss.elastic.co/t/aggregate-sort-paginate-on-nested-documents/314715 "2022-10-11T07:44:19Z")
Hi, I'm managing a product index, with product sales and other KPIs under a nested field. Trying to sort based on nested aggregation, and paginate - with no success. Below is a simplified version of my mapping, for th… --- ## [Elasticsearch 7.17.4 crashes without an error message, while indexing large chunks of data on Windows](https://discuss.elastic.co/t/elasticsearch-7-17-4-crashes-without-an-error-message-while-indexing-large-chunks-of-data-on-windows/314690)
**Author:** [@simon137](https://discuss.elastic.co/u/simon137)\ **Replies:** 7\ **Last updated:** [October 11, 2022, 7:38am UTC](https://discuss.elastic.co/t/elasticsearch-7-17-4-crashes-without-an-error-message-while-indexing-large-chunks-of-data-on-windows/314690 "2022-10-11T07:38:34Z")
Hello, I tried multiple java heap configurations for both logstash and elasticsearch, and also using a persisted queue (with space up to 40gb) instead of a memory queue, but it's always the same: If I take a large chun… --- ## [Search UI Set Sort Dynamically](https://discuss.elastic.co/t/search-ui-set-sort-dynamically/316020)
**Author:** [@tchocky](https://discuss.elastic.co/u/tchocky)\ **Replies:** 3\ **Last updated:** [October 11, 2022, 7:05am UTC](https://discuss.elastic.co/t/search-ui-set-sort-dynamically/316020 "2022-10-11T07:05:36Z")
Hi all - I am using the React Search UI with Elastic Cloud. I am looking for a way to set the search results order dynamically based on if the search box is populated. The logic is: Always default to a sort of date des… --- ## [Duplicate : Scripted metric not working inside transform](https://discuss.elastic.co/t/duplicate-scripted-metric-not-working-inside-transform/316269)
**Author:** [@Hemabh\_Ravee](https://discuss.elastic.co/u/Hemabh_Ravee)\ **Replies:** 4\ **Last updated:** [October 11, 2022, 6:40am UTC](https://discuss.elastic.co/t/duplicate-scripted-metric-not-working-inside-transform/316269 "2022-10-11T06:40:23Z")
First of all, I'd like to clarify that the reason I'm posting this question because I am unable to add any replies or edits to the original one. I'm finding myself unable to post questions as well using that account(err… --- ## [Alert: Large shard size](https://discuss.elastic.co/t/alert-large-shard-size/316184)
**Author:** [@Michele\_De\_Benedet](https://discuss.elastic.co/u/Michele_De_Benedet)\ **Replies:** 3\ **Last updated:** [October 11, 2022, 6:18am UTC](https://discuss.elastic.co/t/alert-large-shard-size/316184 "2022-10-11T06:18:39Z")
Hi, I am using Logstash to feed an index. Current index size is 60GB and I'm expecting it to grow to at most 100GB, so I set it to use 6 shards. Elasticsearch is ran on a single node. The status of the index in Kibana … --- ## [Logstash was having pipeline error: event executor terminated. What would possibly be the problem?](https://discuss.elastic.co/t/logstash-was-having-pipeline-error-event-executor-terminated-what-would-possibly-be-the-problem/316212)
**Author:** [@prashanthk](https://discuss.elastic.co/u/prashanthk)\ **Replies:** 5\ **Last updated:** [October 11, 2022, 3:52am UTC](https://discuss.elastic.co/t/logstash-was-having-pipeline-error-event-executor-terminated-what-would-possibly-be-the-problem/316212 "2022-10-11T03:52:28Z")
input { http { host =\> "0.0.0.0" port =\> 8443 user =\> provider password =\> "c6N65uxZ$M5@" # ssl =\> true # keystore =\> "/etc/logstash/keystore.jks" # keystore\_password =\> "password" } } filter { mutate { add\_f… --- ## [Bootstrap check failure](https://discuss.elastic.co/t/bootstrap-check-failure/316025)
**Author:** [@rt\_888](https://discuss.elastic.co/u/rt_888)\ **Replies:** 4\ **Last updated:** [October 11, 2022, 3:46am UTC](https://discuss.elastic.co/t/bootstrap-check-failure/316025 "2022-10-11T03:46:54Z")
I tried using ES on AWS server of ubutu image, and modify the elasticsearch.yml file of node, discovery.seed\_hosts, master node . But got error with bootstrap node validation exception and it shows "at least one of \[dis… --- ## [Logstash auto reload the pipeline?](https://discuss.elastic.co/t/logstash-auto-reload-the-pipeline/316152)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 1\ **Last updated:** [October 11, 2022, 1:38am UTC](https://discuss.elastic.co/t/logstash-auto-reload-the-pipeline/316152 "2022-10-11T01:38:02Z")
hello i've installed elk on cloud but the image have the original configuration pipeline if change the config and reload the image all file is reset with originals exist a method with modify pipeline and reload logstas… --- ## [How to search for username that logged in to install a specific app](https://discuss.elastic.co/t/how-to-search-for-username-that-logged-in-to-install-a-specific-app/316249)
**Author:** [@BabyElkUser](https://discuss.elastic.co/u/BabyElkUser)\ **Replies:** 1\ **Last updated:** [October 11, 2022, 12:20am UTC](https://discuss.elastic.co/t/how-to-search-for-username-that-logged-in-to-install-a-specific-app/316249 "2022-10-11T00:20:51Z")
Hi folks, I'm very new to Elk and am attempting to help our Information Security office with a few tasks. Per our Information Security Office, applications must be approved prior to being installed on a computer. Unfort… --- ## [Uptime in Cross-Cluster Search](https://discuss.elastic.co/t/uptime-in-cross-cluster-search/316256)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 1\ **Last updated:** [October 11, 2022, 12:02am UTC](https://discuss.elastic.co/t/uptime-in-cross-cluster-search/316256 "2022-10-11T00:02:46Z")
We recently set-up Heartbeat for two ES clusters (everything running version 8.3.2). However, data from these clusters are viewed from a Cross-Cluster Search (CCS) instance. When I view Uptime from the local cluster Kiba… --- ## [Best security pratice for elastich search?](https://discuss.elastic.co/t/best-security-pratice-for-elastich-search/316251)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 1\ **Last updated:** [October 10, 2022, 11:47pm UTC](https://discuss.elastic.co/t/best-security-pratice-for-elastich-search/316251 "2022-10-10T23:47:16Z")
hello what is best security pratice for elk? --- ## [Elastic docker restart](https://discuss.elastic.co/t/elastic-docker-restart/314582)
**Author:** [@Isekai](https://discuss.elastic.co/u/Isekai)\ **Replies:** 3\ **Last updated:** [October 10, 2022, 10:29pm UTC](https://discuss.elastic.co/t/elastic-docker-restart/314582 "2022-10-10T22:29:14Z")
Hi everyone, We have an elastic instance that we feed data from CI jobs. It is single node instance. Maybe some data from the cluster: "cluster\_name" : "docker-cluster", "status" : "yellow", "timed\_out" : false… --- ## [Automatically move old documents from a index, to a new index, without deleting the original index](https://discuss.elastic.co/t/automatically-move-old-documents-from-a-index-to-a-new-index-without-deleting-the-original-index/316161)
**Author:** [@jinlauter94](https://discuss.elastic.co/u/jinlauter94)\ **Replies:** 1\ **Last updated:** [October 10, 2022, 10:24pm UTC](https://discuss.elastic.co/t/automatically-move-old-documents-from-a-index-to-a-new-index-without-deleting-the-original-index/316161 "2022-10-10T22:24:12Z")
There is a lot of helpful documents showing how to turn a hot index into a warm or cold one. But, in my case, I have a lot of independent applications that do the "same" thing, and can be very different. I would like to … --- ## [Cross Cluster Replication between AWS Opensearch and Elastic Cloud it is possibile?](https://discuss.elastic.co/t/cross-cluster-replication-between-aws-opensearch-and-elastic-cloud-it-is-possibile/315947)
**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\ **Replies:** 3\ **Last updated:** [October 10, 2022, 10:20pm UTC](https://discuss.elastic.co/t/cross-cluster-replication-between-aws-opensearch-and-elastic-cloud-it-is-possibile/315947 "2022-10-10T22:20:18Z")
Hi, as already mentioned in the title, is it possibile to use Cross Cluster Replication between AWS Opensearch and Elastic Cloud. My goal is to migrate from AWS OpenSearch to Elastic Cloud using CCR, and then dismiss t… --- ## [Tail-based sampling](https://discuss.elastic.co/t/tail-based-sampling/316177)
**Author:** [@Shuai\_Yuan](https://discuss.elastic.co/u/Shuai_Yuan)\ **Replies:** 0\ **Last updated:** [October 10, 2022, 6:34am UTC](https://discuss.elastic.co/t/tail-based-sampling/316177 "2022-10-10T06:34:56Z")
Hi there, I'm using elastic and kibana version 8.4.2, and enabled tail-based sampling in the integration policy, also enabled trial on full features in my local (I'm using docker container for kibana) , so I'm expecting… --- ## [Question regarding backup](https://discuss.elastic.co/t/question-regarding-backup/316254)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 1\ **Last updated:** [October 10, 2022, 9:27pm UTC](https://discuss.elastic.co/t/question-regarding-backup/316254 "2022-10-10T21:27:24Z")
Supposed I am running a backup everyday for my entire cluster. I understand that ES does incremental backup, so the first backup would be huge, but subsequent ones would be small. Let's say I have one month worth of ba… --- ## [Elasticsearch Upgrade 7.9.1 to 8.4](https://discuss.elastic.co/t/elasticsearch-upgrade-7-9-1-to-8-4/316229)
**Author:** [@jacknino](https://discuss.elastic.co/u/jacknino)\ **Replies:** 2\ **Last updated:** [October 10, 2022, 8:10pm UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-7-9-1-to-8-4/316229 "2022-10-10T20:10:47Z")
Hi Channel, We are planning to upgrade Elasticsearch opensource 7.9.1 to 8.4. while upgrading we noticed multiple data disk path deprecation warning . Could anyone help us how we can proceed further. FYI, Elasticsearc… --- ## [How to store index in elasticsearch if disk space is full on server](https://discuss.elastic.co/t/how-to-store-index-in-elasticsearch-if-disk-space-is-full-on-server/315520)
**Author:** [@aniketdatir](https://discuss.elastic.co/u/aniketdatir)\ **Replies:** 2\ **Last updated:** [October 10, 2022, 7:21pm UTC](https://discuss.elastic.co/t/how-to-store-index-in-elasticsearch-if-disk-space-is-full-on-server/315520 "2022-10-10T19:21:25Z")
Hi team, I want to store disk space related data in to elastic index through Metricbeat. kindly guide me how to achieve this? --- ## [Ndjson appears to be ignoring my log line](https://discuss.elastic.co/t/ndjson-appears-to-be-ignoring-my-log-line/315971)
**Author:** [@ledzepp4eva](https://discuss.elastic.co/u/ledzepp4eva)\ **Replies:** 1\ **Last updated:** [October 10, 2022, 7:14pm UTC](https://discuss.elastic.co/t/ndjson-appears-to-be-ignoring-my-log-line/315971 "2022-10-10T19:14:47Z")
Hey, I am hoping you can point out my silly mistake here. filebeat.inputs: - type: filestream id: nginx-stream-json-id paths: - /var/log/nginx/\*.stream.access.log parser: - ndjson: t… --- ## [Permissions for ES\_KEYSTORE\_PASSPHRASE\_FILE](https://discuss.elastic.co/t/permissions-for-es-keystore-passphrase-file/314219)
**Author:** [@tepus](https://discuss.elastic.co/u/tepus)\ **Replies:** 2\ **Last updated:** [October 10, 2022, 7:06pm UTC](https://discuss.elastic.co/t/permissions-for-es-keystore-passphrase-file/314219 "2022-10-10T19:06:26Z")
Dear Community, our Keystore is protected with a password. In order to provide the password to the cluster and start it, we created the file /etc/elasticsearch/my\_pwd\_file.tmp under root:elasticsearch containing the pas… [Previous page](https://discuss.elastic.co/latest.md?page=935) [Next page](https://discuss.elastic.co/latest.md?page=937)