# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1028 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1029 --- ## [How to get the aggregation value into a field in CSV in logstash configuration file?](https://discuss.elastic.co/t/how-to-get-the-aggregation-value-into-a-field-in-csv-in-logstash-configuration-file/298741)
**Author:** [@Ajay4998](https://discuss.elastic.co/u/Ajay4998)\ **Replies:** 0\ **Last updated:** [March 3, 2022, 12:06pm UTC](https://discuss.elastic.co/t/how-to-get-the-aggregation-value-into-a-field-in-csv-in-logstash-configuration-file/298741 "2022-03-03T12:06:11Z")
Hi All, How to get terms aggregation key into field and value into field value in logstash for a CSV file, i have used Elasticsearch filter and also give the json file for query. can some please help on this Elasticsea… --- ## [\_dateparsefailure Logstash 7.17](https://discuss.elastic.co/t/dateparsefailure-logstash-7-17/298729)
**Author:** [@Daniel\_Lopez](https://discuss.elastic.co/u/Daniel_Lopez)\ **Replies:** 1\ **Last updated:** [March 3, 2022, 11:50am UTC](https://discuss.elastic.co/t/dateparsefailure-logstash-7-17/298729 "2022-03-03T11:50:35Z")
Hi to all! The field I index to Elasticsearch is 03/03/2020 11:11:11 AM. I tried with different filters date { match =\> \["time","dd/MM/YYYY hh:mm:ss a"\] target =\> "time" } date { match =\> \["time","dd/MM/YYYY hh:m… --- ## [Filebeat is down after start](https://discuss.elastic.co/t/filebeat-is-down-after-start/297390)
**Author:** [@ocervera](https://discuss.elastic.co/u/ocervera)\ **Replies:** 2\ **Last updated:** [March 3, 2022, 11:14am UTC](https://discuss.elastic.co/t/filebeat-is-down-after-start/297390 "2022-03-03T11:14:37Z")
Hello, I have installed in a Centos, Wazuh Manager+ Filebeat and the latter seems to work fine but after a while the filebeat.service suddenly stops working. systemctl status filebeat.service shows: × filebeat.service… --- ## [Date format changes and causes an error in a transform](https://discuss.elastic.co/t/date-format-changes-and-causes-an-error-in-a-transform/298643)
**Author:** [@Jker](https://discuss.elastic.co/u/Jker)\ **Replies:** 4\ **Last updated:** [March 3, 2022, 10:49am UTC](https://discuss.elastic.co/t/date-format-changes-and-causes-an-error-in-a-transform/298643 "2022-03-03T10:49:07Z")
Hello! I'm trying to create a transform from two different indices but keep on running to this error and have tried many different solutions but can't get it to work. This is the error: Failed to index documents into… --- ## [Grouping delta](https://discuss.elastic.co/t/grouping-delta/298659)
**Author:** [@danilomendes](https://discuss.elastic.co/u/danilomendes)\ **Replies:** 1\ **Last updated:** [March 3, 2022, 10:30am UTC](https://discuss.elastic.co/t/grouping-delta/298659 "2022-03-03T10:30:23Z")
I have some documents like those: { timestamp: t, player: playerA, team: teamA, totalPoints: 10 }, { timestamp: t, player: playerB, team: teamA, totalPoints: 5 }, { timestamp: t, player: playerc, team: teamA, totalPoint… --- ## [Nested objects? Or not possible in Kibana?](https://discuss.elastic.co/t/nested-objects-or-not-possible-in-kibana/298725)
**Author:** [@glushkov](https://discuss.elastic.co/u/glushkov)\ **Replies:** 0\ **Last updated:** [March 3, 2022, 10:22am UTC](https://discuss.elastic.co/t/nested-objects-or-not-possible-in-kibana/298725 "2022-03-03T10:22:11Z")
Hi, I have an Oracle table with state-change events for each job (these are computing jobs that we are running) in the format: id | timestamp | job\_nr | status | attempt\_nr | 0 |27-NOV-21 01.10.56.678706000 AM|1 | star… --- ## [Metric Beat and Jolokia Module](https://discuss.elastic.co/t/metric-beat-and-jolokia-module/298724)
**Author:** [@deralch](https://discuss.elastic.co/u/deralch)\ **Replies:** 0\ **Last updated:** [March 3, 2022, 10:09am UTC](https://discuss.elastic.co/t/metric-beat-and-jolokia-module/298724 "2022-03-03T10:09:43Z")
Hey there, i'm trying to get following metrics out of the tomcat: My config: jmx.mappings: - mbean: 'Catalina:type=Manager,host=localhost,context=/guidemo' attributes: - attr: activeSessions … --- ## [Elasticsearch and hive integration permission issue](https://discuss.elastic.co/t/elasticsearch-and-hive-integration-permission-issue/298723)
**Author:** [@charvi23](https://discuss.elastic.co/u/charvi23)\ **Replies:** 0\ **Last updated:** [March 3, 2022, 10:05am UTC](https://discuss.elastic.co/t/elasticsearch-and-hive-integration-permission-issue/298723 "2022-03-03T10:05:46Z")
While trying to create external table / index via hive connector jars it gives the following error, can you help me point out the issue. I am actually trying to move data from hive to ES index. Following is the error mes… --- ## [Visualization (timeseries) series selection](https://discuss.elastic.co/t/visualization-timeseries-series-selection/298631)
**Author:** [@nickgregz](https://discuss.elastic.co/u/nickgregz)\ **Replies:** 2\ **Last updated:** [March 3, 2022, 10:00am UTC](https://discuss.elastic.co/t/visualization-timeseries-series-selection/298631 "2022-03-03T10:00:01Z")
Hello, is there a way to inverse the series selection on visualizations. Right now when you click on the legend of one series it gets removed from the chart. Is there a way to enable the opposite meaning that only the… --- ## [FVH does not highlight matched search terms on snippets boundary](https://discuss.elastic.co/t/fvh-does-not-highlight-matched-search-terms-on-snippets-boundary/298720)
**Author:** [@Anatoly\_Petkevich](https://discuss.elastic.co/u/Anatoly_Petkevich)\ **Replies:** 0\ **Last updated:** [March 3, 2022, 9:57am UTC](https://discuss.elastic.co/t/fvh-does-not-highlight-matched-search-terms-on-snippets-boundary/298720 "2022-03-03T09:57:23Z")
Looks like there is an issue with highlighting of matched terms on snippets boundary. Steps to reproduce: Create index and field mappings PUT /test { "settings": { "number\_of\_shards": 1 }, "mappings": { … --- ## [Duplicated message in document, grok pattern problem](https://discuss.elastic.co/t/duplicated-message-in-document-grok-pattern-problem/298704)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 2\ **Last updated:** [March 3, 2022, 9:40am UTC](https://discuss.elastic.co/t/duplicated-message-in-document-grok-pattern-problem/298704 "2022-03-03T09:40:13Z")
Dears, Please help me with parsing such multiline log, example one event: 2022-03-03 07:34:45.971 TRACE 865 --- \[nio-5010-exec-7\] rest-server : Request { correlationId = a835e742-635a-4… --- ## [The first connection to logstash is always an error](https://discuss.elastic.co/t/the-first-connection-to-logstash-is-always-an-error/296253)
**Author:** [@driveirk](https://discuss.elastic.co/u/driveirk)\ **Replies:** 7\ **Last updated:** [March 3, 2022, 8:18am UTC](https://discuss.elastic.co/t/the-first-connection-to-logstash-is-always-an-error/296253 "2022-03-03T08:18:51Z")
When running lambda, I always see "retry" first, and then immediately connect to backoff. How to make logs sent on first connection? Is there any way to enable more readable logs? config functionbeat functionbeat:… --- ## [Path.Data partition is going Read-Only periodically](https://discuss.elastic.co/t/path-data-partition-is-going-read-only-periodically/298710)
**Author:** [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\ **Replies:** 4\ **Last updated:** [March 3, 2022, 9:36am UTC](https://discuss.elastic.co/t/path-data-partition-is-going-read-only-periodically/298710 "2022-03-03T09:36:16Z")
Hello, I have a deployed cluster V7.16.1 on Linux platform (ubuntu lts), but what is happening is that every time one of the partitions mapped to path.data is becoming Read-Only until I run file-system check (fsck) on t… --- ## [Filebeat input number fields are recognized as text fields in elastic/kibana](https://discuss.elastic.co/t/filebeat-input-number-fields-are-recognized-as-text-fields-in-elastic-kibana/298717)
**Author:** [@Rick\_Barendse](https://discuss.elastic.co/u/Rick_Barendse)\ **Replies:** 0\ **Last updated:** [March 3, 2022, 9:20am UTC](https://discuss.elastic.co/t/filebeat-input-number-fields-are-recognized-as-text-fields-in-elastic-kibana/298717 "2022-03-03T09:20:28Z")
I am a newbee to elastic I am not able to solve ollowing issue: I try to load a json file with 2 number fields via filebeat in Elasticsearch. When looking into kibana discovery I see the fields with values but the valu… --- ## [No results match your search criteria](https://discuss.elastic.co/t/no-results-match-your-search-criteria/298672)
**Author:** [@Sebastian\_Randoll\_Le](https://discuss.elastic.co/u/Sebastian_Randoll_Le)\ **Replies:** 1\ **Last updated:** [March 3, 2022, 9:07am UTC](https://discuss.elastic.co/t/no-results-match-your-search-criteria/298672 "2022-03-03T09:07:35Z")
Hello I have a problem with kibana version 7.17.0 when displaying the content of an index: My index in Elasticsearch is: It is displayed that it contains docs. My pattern index in kibana is: But when I went… --- ## [How to configure server logs from different server using filebeat and send logs to logstash which installed on other server](https://discuss.elastic.co/t/how-to-configure-server-logs-from-different-server-using-filebeat-and-send-logs-to-logstash-which-installed-on-other-server/298394)
**Author:** [@Dark\_Man](https://discuss.elastic.co/u/Dark_Man)\ **Replies:** 1\ **Last updated:** [March 1, 2022, 9:42am UTC](https://discuss.elastic.co/t/how-to-configure-server-logs-from-different-server-using-filebeat-and-send-logs-to-logstash-which-installed-on-other-server/298394 "2022-03-01T09:42:36Z")
I am probably novice at ELK. I have question how can I configure send logs by filebeat from one server and logstash can collect and show in kibana this logs on other server. ELK installed on one server and filebeat insta… --- ## [Embed Kibana Dashboard in Asp.Net Core Web Application](https://discuss.elastic.co/t/embed-kibana-dashboard-in-asp-net-core-web-application/297488)
**Author:** [@Thirumavalavan](https://discuss.elastic.co/u/Thirumavalavan)\ **Replies:** 3\ **Last updated:** [March 3, 2022, 8:54am UTC](https://discuss.elastic.co/t/embed-kibana-dashboard-in-asp-net-core-web-application/297488 "2022-03-03T08:54:07Z")
Team, Can you please help me to give an idea/sample code on embedding the kibana dashboard into my web application? what are the steps I have to follow? Fyi, I have enabled Elasticsearch cluster setup and configured it… --- ## [Color codes on graph](https://discuss.elastic.co/t/color-codes-on-graph/298702)
**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\ **Replies:** 1\ **Last updated:** [March 3, 2022, 8:35am UTC](https://discuss.elastic.co/t/color-codes-on-graph/298702 "2022-03-03T08:35:40Z")
Version: Kibana 8.0 I would like to have my graphs in a specific color. There is an option to select color form the color palette drop down under panel setting. Even though I change the color it seems to not update all … --- ## [Logstash parse multiple lat lon values](https://discuss.elastic.co/t/logstash-parse-multiple-lat-lon-values/298711)
**Author:** [@sylar11](https://discuss.elastic.co/u/sylar11)\ **Replies:** 0\ **Last updated:** [March 3, 2022, 8:11am UTC](https://discuss.elastic.co/t/logstash-parse-multiple-lat-lon-values/298711 "2022-03-03T08:11:01Z")
Hi all, I have the following json file: { "station": "A001", "X": 503744.7, "Y": 4726339.0, "Z": 458.84, "LON": -2.954286956913572, "LAT": 42.68952475979137, "dates": \[ "2015-01-01",… --- ## [Elasticsearch query text field by term](https://discuss.elastic.co/t/elasticsearch-query-text-field-by-term/298693)
**Author:** [@jiankunking](https://discuss.elastic.co/u/jiankunking)\ **Replies:** 1\ **Last updated:** [March 3, 2022, 8:04am UTC](https://discuss.elastic.co/t/elasticsearch-query-text-field-by-term/298693 "2022-03-03T08:04:25Z")
I have read the docs，Term query | Elasticsearch Guide \[8.0\] | Elastic I know that the text field should not be queried with term. But there's another sentence in the document The term query does not analyze the searc… --- ## [Lifecycle policy with movement delay option](https://discuss.elastic.co/t/lifecycle-policy-with-movement-delay-option/298588)
**Author:** [@anon17386273](https://discuss.elastic.co/u/anon17386273)\ **Replies:** 2\ **Last updated:** [March 3, 2022, 7:16am UTC](https://discuss.elastic.co/t/lifecycle-policy-with-movement-delay-option/298588 "2022-03-03T07:16:38Z")
Hi I have a lot of different daily indices tagged to the same lifecycle policy. Every day 12am, ilm will start to move several of these daily indices to the different tiers. I was wondering if there is some kind of tim… --- ## [Alerts in kibana](https://discuss.elastic.co/t/alerts-in-kibana/298703)
**Author:** [@tharunkumar](https://discuss.elastic.co/u/tharunkumar)\ **Replies:** 1\ **Last updated:** [March 3, 2022, 6:40am UTC](https://discuss.elastic.co/t/alerts-in-kibana/298703 "2022-03-03T06:40:34Z")
I am facing an issue in kibana.can i know where the below alert is from and how to disable it. log \[12:08:35.877\] \[error\]\[alerting\]\[alerts\]\[plugins\]\[plugins\] Executing Alert "34af2110-24f6-11ec-8071-63a4b456f636" has … --- ## [How to make Average sub aggregation to consider parent aggregation count instead of current aggregation count?](https://discuss.elastic.co/t/how-to-make-average-sub-aggregation-to-consider-parent-aggregation-count-instead-of-current-aggregation-count/298403)
**Author:** [@Nishikant\_Tayade](https://discuss.elastic.co/u/Nishikant_Tayade)\ **Replies:** 5\ **Last updated:** [March 3, 2022, 4:13am UTC](https://discuss.elastic.co/t/how-to-make-average-sub-aggregation-to-consider-parent-aggregation-count-instead-of-current-aggregation-count/298403 "2022-03-03T04:13:09Z")
I am using ES 7.10.2 Mappings for fields are as follows: { "properties": { "ItemInfo": { "type": "nested", "include\_in\_parent": true, "properties": { "ShipInfo": { "type": "nes… --- ## [The active thread always in one dataNode，other dataNodes have very few active thread or no active thread](https://discuss.elastic.co/t/the-active-thread-always-in-one-datanode-other-datanodes-have-very-few-active-thread-or-no-active-thread/298686)
**Author:** [@1506299760](https://discuss.elastic.co/u/1506299760)\ **Replies:** 19\ **Last updated:** [March 3, 2022, 3:15am UTC](https://discuss.elastic.co/t/the-active-thread-always-in-one-datanode-other-datanodes-have-very-few-active-thread-or-no-active-thread/298686 "2022-03-03T03:15:33Z")
I have 3 master nodes,6 data nodes and every dataNode has almost same quantity and size data，I export data to dataNode evenly。 when I send requests to do pressure test(my requests is also random) ，I user the command 'GE… --- ## [Elasticsearch array only contains query](https://discuss.elastic.co/t/elasticsearch-array-only-contains-query/298666)
**Author:** [@viswanathk243](https://discuss.elastic.co/u/viswanathk243)\ **Replies:** 1\ **Last updated:** [March 3, 2022, 3:07am UTC](https://discuss.elastic.co/t/elasticsearch-array-only-contains-query/298666 "2022-03-03T03:07:26Z")
Let's say I've data in this format: { "id": "doc0", "tags": \["a", "b", "c"\] } { "id": "doc1", "tags": \["a", "b", "c", "d"\] } { "id": "doc2", "tags": \["a", "b"\] } I need to form an ES query that fetches on… --- ## [About filebeat delay check](https://discuss.elastic.co/t/about-filebeat-delay-check/298688)
**Author:** [@bae\_park](https://discuss.elastic.co/u/bae_park)\ **Replies:** 0\ **Last updated:** [March 3, 2022, 1:36am UTC](https://discuss.elastic.co/t/about-filebeat-delay-check/298688 "2022-03-03T01:36:19Z")
I am using input as log and output as kafka in filebeat.yml Is the part that is not published in the inflog taken every 30 seconds a delay? If the delay is correct, can you tell how much delay is there? 2022-03-02T17:… --- ## [Newb/learner floundering](https://discuss.elastic.co/t/newb-learner-floundering/298216)
**Author:** [@mrodent](https://discuss.elastic.co/u/mrodent)\ **Replies:** 3\ **Last updated:** [March 2, 2022, 11:44pm UTC](https://discuss.elastic.co/t/newb-learner-floundering/298216 "2022-03-02T23:44:37Z")
When I say newb, I have in fact developed a couple of minor apps which use the most basic aspects of creating an ES index and then searching it (in Python). The resource I might naturally expect to go to, with v 7.16 cu… --- ## [Trying to get my docker-compose to start Kibana with ssl](https://discuss.elastic.co/t/trying-to-get-my-docker-compose-to-start-kibana-with-ssl/296568)
**Author:** [@fribse](https://discuss.elastic.co/u/fribse)\ **Replies:** 8\ **Last updated:** [March 2, 2022, 11:26pm UTC](https://discuss.elastic.co/t/trying-to-get-my-docker-compose-to-start-kibana-with-ssl/296568 "2022-03-02T23:26:44Z")
Hi All I'm trying to set up my kibana to use SSL for 7.16.3, like I set up Elasticsearch. So I used this guide : Encrypting communications in an Elasticsearch Docker Container | Elasticsearch Guide \[7.17\] | Elastic to… --- ## [Update by query with index alias](https://discuss.elastic.co/t/update-by-query-with-index-alias/298610)
**Author:** [@Metheny](https://discuss.elastic.co/u/Metheny)\ **Replies:** 3\ **Last updated:** [March 2, 2022, 11:09pm UTC](https://discuss.elastic.co/t/update-by-query-with-index-alias/298610 "2022-03-02T23:09:09Z")
In the Alias documentation it says that write operations aren't allowed on index alias and that it would return an error: If an alias points to multiple indices or data streams and is\_write\_index isn’t set, the alias r… --- ## [How long does it usually take for another master candidate to be elected?](https://discuss.elastic.co/t/how-long-does-it-usually-take-for-another-master-candidate-to-be-elected/298617)
**Author:** [@hyungsun\_lim](https://discuss.elastic.co/u/hyungsun_lim)\ **Replies:** 1\ **Last updated:** [March 2, 2022, 11:08pm UTC](https://discuss.elastic.co/t/how-long-does-it-usually-take-for-another-master-candidate-to-be-elected/298617 "2022-03-02T23:08:07Z")
I have a cluster like below. node1 master-node : master(true), data(false) data-node-1 : master(true), data(true) node2 data-node-2 : master(true), data(true) node3 data-node-3 : master(false), data(true) When th… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1027) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1029)