# Latest **URL:** https://discuss.elastic.co/latest.md?page=943 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 944 --- ## [FSCrawler and frozen indicies](https://discuss.elastic.co/t/fscrawler-and-frozen-indicies/314997)
**Author:** [@cheshirecat](https://discuss.elastic.co/u/cheshirecat)\ **Replies:** 13\ **Last updated:** [October 5, 2022, 8:27am UTC](https://discuss.elastic.co/t/fscrawler-and-frozen-indicies/314997 "2022-10-05T08:27:21Z")
Hello There! I have downloaded ans successfully started FSCrawler for my Elasticsearch cluster. This is how I start an instance: 08:11:23,753 INFO \[f.p.e.c.f.c.BootstrapChecks\] Memory \[Free/Total=Percent\]: HEAP \[83.3… --- ## [Metricbeat not able to recognise AWS modules](https://discuss.elastic.co/t/metricbeat-not-able-to-recognise-aws-modules/315661)
**Author:** [@Hasnain\_Raza](https://discuss.elastic.co/u/Hasnain_Raza)\ **Replies:** 4\ **Last updated:** [October 5, 2022, 7:17am UTC](https://discuss.elastic.co/t/metricbeat-not-able-to-recognise-aws-modules/315661 "2022-10-05T07:17:46Z")
Problem statement: Need to fetch logs from AWS resources ELB, cloudwatch, ecs etc. Need help in understanding the configs and why this error is coming. Metricbeat returns error Elastic version: 7.6.2 Exiting: 1 error:… --- ## [Automatically increase number of shards](https://discuss.elastic.co/t/automatically-increase-number-of-shards/315749)
**Author:** [@MaVa](https://discuss.elastic.co/u/MaVa)\ **Replies:** 5\ **Last updated:** [October 5, 2022, 6:43am UTC](https://discuss.elastic.co/t/automatically-increase-number-of-shards/315749 "2022-10-05T06:43:07Z")
Hi! I have few indices where all the data is equally relevant no matter how old it is. Over time these indices will increase in size (from 5-10MB to 1000GB). I want to optimize the number of shards in these indices, and … --- ## [Snapshot failed for a shard](https://discuss.elastic.co/t/snapshot-failed-for-a-shard/315794)
**Author:** [@DineshNaik](https://discuss.elastic.co/u/DineshNaik)\ **Replies:** 2\ **Last updated:** [October 5, 2022, 6:32am UTC](https://discuss.elastic.co/t/snapshot-failed-for-a-shard/315794 "2022-10-05T06:32:23Z")
Hi all, I am trying to take a one time backup and was planning to restore it to other cluster. During snapshot , i see one failed shard , is there a way to handle this ? { "snapshots" : \[ { "snapshot" : "s… --- ## [Role Mapping via App Role in Azure SSO](https://discuss.elastic.co/t/role-mapping-via-app-role-in-azure-sso/315831)
**Author:** [@Zesty\_Lemon](https://discuss.elastic.co/u/Zesty_Lemon)\ **Replies:** 3\ **Last updated:** [October 5, 2022, 5:35am UTC](https://discuss.elastic.co/t/role-mapping-via-app-role-in-azure-sso/315831 "2022-10-05T05:35:57Z")
Hi, New to Elastic here; seeking information on how to use a App Role on the Enterprise Application for Elastic SSO to assign a user to a particular role mapping; We are using instructions; I can see in the SAML resp… --- ## [Adding a node to cluster](https://discuss.elastic.co/t/adding-a-node-to-cluster/315239)
**Author:** [@rahulgupta18](https://discuss.elastic.co/u/rahulgupta18)\ **Replies:** 1\ **Last updated:** [October 5, 2022, 5:24am UTC](https://discuss.elastic.co/t/adding-a-node-to-cluster/315239 "2022-10-05T05:24:15Z")
Hi , I am looking to add one more node to our existing 2-node ELK cluster running in production. We're running version 8.1. I was looking at the elasticsearch documents, for 8.1, it says just to add the cluster name a… --- ## [Can logstash\_admin built-in role make indices?](https://discuss.elastic.co/t/can-logstash-admin-built-in-role-make-indices/315834)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 0\ **Last updated:** [October 5, 2022, 4:36am UTC](https://discuss.elastic.co/t/can-logstash-admin-built-in-role-make-indices/315834 "2022-10-05T04:36:38Z")
Hello, i'm planning to add a new user in kibana for logstash operation. I noticed the role logstash\_admin which is alerady built-in. My question is, can the logstash\_admin role make new indices (as configured in logstash… --- ## [Restoring snapshots of observability indexes](https://discuss.elastic.co/t/restoring-snapshots-of-observability-indexes/315813)
**Author:** [@matt.snyder](https://discuss.elastic.co/u/matt.snyder)\ **Replies:** 1\ **Last updated:** [October 5, 2022, 3:46am UTC](https://discuss.elastic.co/t/restoring-snapshots-of-observability-indexes/315813 "2022-10-05T03:46:06Z")
I have a snapshot profile created with defaults, which, for observability indexes, results in one snapshot per index, so I have about 100 snapshots from the same minute, each containing one index. If I want to use these… --- ## [Extract originals timestamp from logs?](https://discuss.elastic.co/t/extract-originals-timestamp-from-logs/315798)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 6\ **Last updated:** [October 5, 2022, 3:06am UTC](https://discuss.elastic.co/t/extract-originals-timestamp-from-logs/315798 "2022-10-05T03:06:35Z")
hello i've see with send log with logstash not respect the originals timestamp this is my generic msg builded with spring-boot 2022-09-25 21:19:57,175 INFO \[it.unidoc.cdr.core.bean.ForwardProvideAndRegisterManager\] (C… --- ## [Timestamp pattern not working for logstash filtering](https://discuss.elastic.co/t/timestamp-pattern-not-working-for-logstash-filtering/315827)
**Author:** [@Chma](https://discuss.elastic.co/u/Chma)\ **Replies:** 1\ **Last updated:** [October 5, 2022, 2:53am UTC](https://discuss.elastic.co/t/timestamp-pattern-not-working-for-logstash-filtering/315827 "2022-10-05T02:53:24Z")
I have 3 lines of logs with different structure and i am constructing a grok pattern to filter the logs. But the pattern I have isn't working. Even when I use just the timestamp pattern, it doesn't match. \[2022-10-04 21… --- ## [Why can't the minimum score be changed from the app search?](https://discuss.elastic.co/t/why-cant-the-minimum-score-be-changed-from-the-app-search/315646)
**Author:** [@jameswbush](https://discuss.elastic.co/u/jameswbush)\ **Replies:** 2\ **Last updated:** [October 4, 2022, 11:44pm UTC](https://discuss.elastic.co/t/why-cant-the-minimum-score-be-changed-from-the-app-search/315646 "2022-10-04T23:44:56Z")
I'd like to know why I can't filter by search score, as the headline indicates. This ought to be a pretty simple and practical function, as the fundamental elastic engine already has it. I fail to comprehend this. I'm te… --- ## [Duplicated date in my elastic](https://discuss.elastic.co/t/duplicated-date-in-my-elastic/315506)
**Author:** [@adityak248](https://discuss.elastic.co/u/adityak248)\ **Replies:** 5\ **Last updated:** [October 4, 2022, 10:56pm UTC](https://discuss.elastic.co/t/duplicated-date-in-my-elastic/315506 "2022-10-04T22:56:08Z")
Hello Team, Greeting, I have a situation when the data is being pushing into my elastic twice, a duplicate data. now both of them have different id and other than that everything is same. How do I get over this. My f… --- ## [Hot Nodes + Shards/Node assignment + Routing](https://discuss.elastic.co/t/hot-nodes-shards-node-assignment-routing/315721)
**Author:** [@jc\_es](https://discuss.elastic.co/u/jc_es)\ **Replies:** 6\ **Last updated:** [October 4, 2022, 10:39pm UTC](https://discuss.elastic.co/t/hot-nodes-shards-node-assignment-routing/315721 "2022-10-04T22:39:15Z")
I have a log ingestion use-case and I'm dealing with high JVM heap on 3 out of 24 data nodes in a cluster. Indices are Monthly, with new indices created through the month as indices hit a size threshold, e.g. logs-YYYY-… --- ## [Skipped records with Search/SearchAfter query](https://discuss.elastic.co/t/skipped-records-with-search-searchafter-query/314205)
**Author:** [@kuhu.88](https://discuss.elastic.co/u/kuhu.88)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 9:54pm UTC](https://discuss.elastic.co/t/skipped-records-with-search-searchafter-query/314205 "2022-10-04T21:54:41Z")
Hello folks, Using a non-unique key for sort (in this example - timestamp) can skip over records in a subsequent request when the 10,000 is reached on a previous run and timestamps carry on beyond that cutoff. Take the… --- ## [Plugins on multi-node cluster](https://discuss.elastic.co/t/plugins-on-multi-node-cluster/315821)
**Author:** [@danskiyq](https://discuss.elastic.co/u/danskiyq)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 8:38pm UTC](https://discuss.elastic.co/t/plugins-on-multi-node-cluster/315821 "2022-10-04T20:38:39Z")
If I want to upgrade or push custom plugins on multi node cluster, eg. 1 master, 3 data/inject nodes. Do I have to do it on one of the nodes using bin/opensearch-plugins and it will synchronise automatically or I have to… --- ## [Elastic Search Update Operation not working when using nodejs client](https://discuss.elastic.co/t/elastic-search-update-operation-not-working-when-using-nodejs-client/315811)
**Author:** [@Atul\_Joshi1](https://discuss.elastic.co/u/Atul_Joshi1)\ **Replies:** 2\ **Last updated:** [October 4, 2022, 7:17pm UTC](https://discuss.elastic.co/t/elastic-search-update-operation-not-working-when-using-nodejs-client/315811 "2022-10-04T19:17:33Z")
I am updating the existing document in Elasticsearch by below update query. const result = await client.update({ index, id, body: { script: { lang: "painless", … --- ## [How can I increase the size of bytes that a log can have?](https://discuss.elastic.co/t/how-can-i-increase-the-size-of-bytes-that-a-log-can-have/315702)
**Author:** [@erwin339](https://discuss.elastic.co/u/erwin339)\ **Replies:** 9\ **Last updated:** [October 4, 2022, 6:16pm UTC](https://discuss.elastic.co/t/how-can-i-increase-the-size-of-bytes-that-a-log-can-have/315702 "2022-10-04T18:16:02Z")
I need help, I am receiving a log of 1300 lines, I am receiving a parse error, for this I did tests and these logs were significantly reduced and with that the error disappears since what I am removing does not affect th… --- ## [Using JSON filter to expand the field created by terms aggregation in transform](https://discuss.elastic.co/t/using-json-filter-to-expand-the-field-created-by-terms-aggregation-in-transform/315759)
**Author:** [@Hemabh\_Ravee\_Fox](https://discuss.elastic.co/u/Hemabh_Ravee_Fox)\ **Replies:** 2\ **Last updated:** [October 4, 2022, 12:25pm UTC](https://discuss.elastic.co/t/using-json-filter-to-expand-the-field-created-by-terms-aggregation-in-transform/315759 "2022-10-04T12:25:02Z")
I am using transforms to aggregate a field event by terms so I get a count for each event for all sessionIds. This seems to be working fine and I get a JSON string as a new field events. But i can't query for the individ… --- ## [How to delete stale project monitors?](https://discuss.elastic.co/t/how-to-delete-stale-project-monitors/315598)
**Author:** [@djkprojects](https://discuss.elastic.co/u/djkprojects)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 4:58pm UTC](https://discuss.elastic.co/t/how-to-delete-stale-project-monitors/315598 "2022-10-04T16:58:38Z")
Hello guys, We are testing the Project Monitors in 8.4.1 and accidentally deleted the project folder that we generetaed and pushed using NPM/NPX and now can't delete those monitors from Kibana. How can we do it manually… --- ## [Rollover "Transform" indices](https://discuss.elastic.co/t/rollover-transform-indices/315799)
**Author:** [@Otto\_F](https://discuss.elastic.co/u/Otto_F)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 4:29pm UTC](https://discuss.elastic.co/t/rollover-transform-indices/315799 "2022-10-04T16:29:56Z")
Hi all, Is any way to rollover for "Transform" indices? If I use ILM policy, I'm getting error: "illegal\_argument\_exception: index.lifecycle.rollover\_alias \[test-summary\] does not point to index \[test-summary\]". Templa… --- ## [NoClassDef org.apache.lucene.util.Version](https://discuss.elastic.co/t/noclassdef-org-apache-lucene-util-version/315787)
**Author:** [@aaron-mcgrath](https://discuss.elastic.co/u/aaron-mcgrath)\ **Replies:** 6\ **Last updated:** [October 4, 2022, 3:22pm UTC](https://discuss.elastic.co/t/noclassdef-org-apache-lucene-util-version/315787 "2022-10-04T15:22:28Z")
I'm using the java client 7.17.6, with gradle to build the project; implementation ("co.elastic.clients:elasticsearch-java:$elasticVersion") implementation ("org.elasticsearch:elasticsearch-x-content:$elasticVersion") G… --- ## [Log4j2.properties doubt](https://discuss.elastic.co/t/log4j2-properties-doubt/315796)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 3:11pm UTC](https://discuss.elastic.co/t/log4j2-properties-doubt/315796 "2022-10-04T15:11:54Z")
Hello! does elasticsearch keep any change in log4j2.properties until a restart ? im changing Logging to delete the logs by time not by size: appender.rolling.strategy.action.condition.nested\_condition.type = IfLastMod… --- ## [Mutate convert multiple fields at once](https://discuss.elastic.co/t/mutate-convert-multiple-fields-at-once/315730)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 3:09pm UTC](https://discuss.elastic.co/t/mutate-convert-multiple-fields-at-once/315730 "2022-10-04T15:09:58Z")
Hello, can i mutate convert multiple fields to a data type at once, without putting it one by one? something like: filter{ mutate{ convert(\["someField1","someField2","someField3"\] =\> "integer") } } I have a lar… --- ## [Shipping Logs out of Elasticsearch](https://discuss.elastic.co/t/shipping-logs-out-of-elasticsearch/315786)
**Author:** [@secopsgeek](https://discuss.elastic.co/u/secopsgeek)\ **Replies:** 4\ **Last updated:** [October 4, 2022, 3:09pm UTC](https://discuss.elastic.co/t/shipping-logs-out-of-elasticsearch/315786 "2022-10-04T15:09:06Z")
Morning, I am trying to figure out a way to ship my elasticseach logs from one location to another syslog system. Is there a way for me to configure Elastic to handle shipping out a certain Index of log to another syslo… --- ## [Metricbeat is getting failed when we enable aws metricbeat moulde](https://discuss.elastic.co/t/metricbeat-is-getting-failed-when-we-enable-aws-metricbeat-moulde/315434)
**Author:** [@samadhan](https://discuss.elastic.co/u/samadhan)\ **Replies:** 2\ **Last updated:** [October 4, 2022, 3:07pm UTC](https://discuss.elastic.co/t/metricbeat-is-getting-failed-when-we-enable-aws-metricbeat-moulde/315434 "2022-10-04T15:07:32Z")
Hi Team, We have installed ELK monitoring with following beats version metricbeat version 7.9.0 (amd64), libbeat 7.9.0 \[b2ee705fc4a59c023136c046803b56bc82a16c8d built 2020-08-11 19:30:31 +0000 UTC\] packetbeat version p… --- ## [Handling unmapped fields with Suggest feature](https://discuss.elastic.co/t/handling-unmapped-fields-with-suggest-feature/314937)
**Author:** [@schawla](https://discuss.elastic.co/u/schawla)\ **Replies:** 3\ **Last updated:** [October 4, 2022, 2:36pm UTC](https://discuss.elastic.co/t/handling-unmapped-fields-with-suggest-feature/314937 "2022-10-04T14:36:45Z")
I am trying to implement suggest feature - Suggest Usage | Elasticsearch .NET Client \[8.4\] | Elastic for handling misspelled words in my search implementation. My search query is executed across multiple indices but whi… --- ## [Sql query with like in "elasticSearch Sql" bugs?](https://discuss.elastic.co/t/sql-query-with-like-in-elasticsearch-sql-bugs/315621)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 17\ **Last updated:** [October 4, 2022, 2:22pm UTC](https://discuss.elastic.co/t/sql-query-with-like-in-elasticsearch-sql-bugs/315621 "2022-10-04T14:22:41Z")
i' ve simple query but not have resulset with SELECT \* FROM "errors\_prima\*" where message like '%fiscal%' (sorry is closed on test not is the problem) but if use SELECT \* FROM "errors\_prima\*" where message like '%… --- ## [How to disable alerts on no data in Metric Threshold rule](https://discuss.elastic.co/t/how-to-disable-alerts-on-no-data-in-metric-threshold-rule/315751)
**Author:** [@woodywoodsta](https://discuss.elastic.co/u/woodywoodsta)\ **Replies:** 4\ **Last updated:** [October 4, 2022, 2:05pm UTC](https://discuss.elastic.co/t/how-to-disable-alerts-on-no-data-in-metric-threshold-rule/315751 "2022-10-04T14:05:46Z")
Hey. I've set up a Metric Threshold alert on some fairly infrequent metric data (which actually comes from the Kubernetes Elastic Agent integration). The filter on the metric data is: host.name:host\* AND event.dataset:… --- ## [Body size limitation for webhook in watcher](https://discuss.elastic.co/t/body-size-limitation-for-webhook-in-watcher/315779)
**Author:** [@JohnJ\_M](https://discuss.elastic.co/u/JohnJ_M)\ **Replies:** 0\ **Last updated:** [October 4, 2022, 1:45pm UTC](https://discuss.elastic.co/t/body-size-limitation-for-webhook-in-watcher/315779 "2022-10-04T13:45:09Z")
I have seen a similar request in the forum but without answers so I try my luck: Where can we found the size limitation of the body in the Webhook action of a watcher. I noticed that it seems 1900 char or so on our inst… --- ## [How to include a field value in message body of EMAIL action in Rules and Connectors?](https://discuss.elastic.co/t/how-to-include-a-field-value-in-message-body-of-email-action-in-rules-and-connectors/314209)
**Author:** [@subash](https://discuss.elastic.co/u/subash)\ **Replies:** 2\ **Last updated:** [October 4, 2022, 1:44pm UTC](https://discuss.elastic.co/t/how-to-include-a-field-value-in-message-body-of-email-action-in-rules-and-connectors/314209 "2022-10-04T13:44:56Z")
I want to include only specific fields in the message body of email action. When using the {{context.hits}} it is returning the whole document. But I want to include only specific fields from the document. Thanks in adv… [Previous page](https://discuss.elastic.co/latest.md?page=942) [Next page](https://discuss.elastic.co/latest.md?page=944)