# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1035 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1036 --- ## [How to setup pipline to extract file using grok in Elastic if the timestamp format is "20Aug21 20:36:07.058931 @fsafsasfdasdsadasd"](https://discuss.elastic.co/t/how-to-setup-pipline-to-extract-file-using-grok-in-elastic-if-the-timestamp-format-is-20aug21-2007-058931-fsafsasfdasdsadasd/298108)
**Author:** [@chenx319](https://discuss.elastic.co/u/chenx319)\ **Replies:** 8\ **Last updated:** [February 27, 2022, 12:30pm UTC](https://discuss.elastic.co/t/how-to-setup-pipline-to-extract-file-using-grok-in-elastic-if-the-timestamp-format-is-20aug21-2007-058931-fsafsasfdasdsadasd/298108 "2022-02-27T12:30:06Z")
one of my log ,and the format is like as follows: 20Aug21 20:36:07.058931 @fsafsasfdasdsadasd I want to extract 20Aug21 20:36:07.058931 to a date type field. I tried: PUT /\_ingest/pipeline/xxx-log { "processors":\[ … --- ## [DEPRECATED: CommonName field on X.509 certificates](https://discuss.elastic.co/t/deprecated-commonname-field-on-x-509-certificates/298310)
**Author:** [@ariverol](https://discuss.elastic.co/u/ariverol)\ **Replies:** 1\ **Last updated:** [February 27, 2022, 6:38am UTC](https://discuss.elastic.co/t/deprecated-commonname-field-on-x-509-certificates/298310 "2022-02-27T06:38:00Z")
Hi, I'm having a problem receiving data from a 7.17.0 filebeat to Logstash. If I run filebeat -e test config I see a warning lscommon/config.go:100 DEPRECATED: Treating the CommonName field on X.509 certificates as a h… --- ## [Age from year of birth](https://discuss.elastic.co/t/age-from-year-of-birth/298280)
**Author:** [@Anand\_p\_s](https://discuss.elastic.co/u/Anand_p_s)\ **Replies:** 3\ **Last updated:** [February 26, 2022, 7:05pm UTC](https://discuss.elastic.co/t/age-from-year-of-birth/298280 "2022-02-26T19:05:29Z")
Sir, I need to do a range aggeration for age ,from year of birth field. How it possible . Pls help --- ## [Failed to start Elasticsearch, error code status 143](https://discuss.elastic.co/t/failed-to-start-elasticsearch-error-code-status-143/298303)
**Author:** [@shiva1](https://discuss.elastic.co/u/shiva1)\ **Replies:** 2\ **Last updated:** [February 26, 2022, 11:42am UTC](https://discuss.elastic.co/t/failed-to-start-elasticsearch-error-code-status-143/298303 "2022-02-26T11:42:42Z")
Hi, I am new to installing Elasticsearch, I did install Elasticsearch in debian buster 10, and when trying to start the Elasticsearch have the issue, it fails to start with (code=exited, status=143) Output : root@ip… --- ## [Parsing Json logs separtly](https://discuss.elastic.co/t/parsing-json-logs-separtly/298329)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 0\ **Last updated:** [February 26, 2022, 11:08am UTC](https://discuss.elastic.co/t/parsing-json-logs-separtly/298329 "2022-02-26T11:08:22Z")
Hello every body, I want to send the results of this json file to ELK through Logstash, \` {“logsourcetypename\_deviceType": "Stonesoft Management Center", "High Level Category": "Access"}, {"logsourcetypename\_deviceTy… --- ## [Document level security alternatives for indexing requests](https://discuss.elastic.co/t/document-level-security-alternatives-for-indexing-requests/298328)
**Author:** [@duongcongtoai](https://discuss.elastic.co/u/duongcongtoai)\ **Replies:** 0\ **Last updated:** [February 26, 2022, 9:56am UTC](https://discuss.elastic.co/t/document-level-security-alternatives-for-indexing-requests/298328 "2022-02-26T09:56:38Z")
At my company, i use Elasticsearch to store data of multiple tenants, and go with the approach using 1 index to store 1 document type for all tenants. I'm adopting Elasticsearch document level security, and all read req… --- ## [Unable to submit fluentd logs to elasticsearch](https://discuss.elastic.co/t/unable-to-submit-fluentd-logs-to-elasticsearch/298326)
**Author:** [@rugby2312](https://discuss.elastic.co/u/rugby2312)\ **Replies:** 0\ **Last updated:** [February 26, 2022, 6:37am UTC](https://discuss.elastic.co/t/unable-to-submit-fluentd-logs-to-elasticsearch/298326 "2022-02-26T06:37:10Z")
I want to send some nginx logs from fluentd to Elasticsearch , however, fluentd is unable to start due to following error message: The client is unable to verify that the server is Elasticsearch. Some functionality may … --- ## [Elasticsearch Startup Error with NFS repo for backup](https://discuss.elastic.co/t/elasticsearch-startup-error-with-nfs-repo-for-backup/297864)
**Author:** [@Avnish\_Singh](https://discuss.elastic.co/u/Avnish_Singh)\ **Replies:** 5\ **Last updated:** [February 26, 2022, 6:29am UTC](https://discuss.elastic.co/t/elasticsearch-startup-error-with-nfs-repo-for-backup/297864 "2022-02-26T06:29:42Z")
Elasticsearch doesn't start with repo as NFS mount-point. Elasticsearch Version: \[root@ip-10-92-3-133 ~\]# curl -XGET localhost:9200 { "name" : "ip-10-92-3-133.ap-south-1.compute.internal", "cluster\_name" : "elastic… --- ## [Restore an index on single node only](https://discuss.elastic.co/t/restore-an-index-on-single-node-only/298250)
**Author:** [@rihad](https://discuss.elastic.co/u/rihad)\ **Replies:** 4\ **Last updated:** [February 26, 2022, 6:04am UTC](https://discuss.elastic.co/t/restore-an-index-on-single-node-only/298250 "2022-02-26T06:04:20Z")
Hi, we have a 3-node ES cluster. Each node provides both master-eligible & data role. Is it possible to restore an index there temporarily without spreading its contents across all nodes? Just the current node or the cur… --- ## [\[0\] "\_jsonparsefailure" how do you remove this?](https://discuss.elastic.co/t/0-jsonparsefailure-how-do-you-remove-this/298225)
**Author:** [@itschobot](https://discuss.elastic.co/u/itschobot)\ **Replies:** 3\ **Last updated:** [February 26, 2022, 3:41am UTC](https://discuss.elastic.co/t/0-jsonparsefailure-how-do-you-remove-this/298225 "2022-02-26T03:41:51Z")
how do you get rid of the \[0\] "\_jsonparsefailure? { "origin" =\> "some\_platform", "ls-source" =\> "some\_platform", "port" =\> 1234, "event" =\> { … --- ## [How to set up each pipeline for each index in filebeats?](https://discuss.elastic.co/t/how-to-set-up-each-pipeline-for-each-index-in-filebeats/298319)
**Author:** [@chenx319](https://discuss.elastic.co/u/chenx319)\ **Replies:** 1\ **Last updated:** [February 26, 2022, 3:38am UTC](https://discuss.elastic.co/t/how-to-set-up-each-pipeline-for-each-index-in-filebeats/298319 "2022-02-26T03:38:25Z")
I use one filebeats, to ship two log 1 hightec.log 2 ghslog.log they are different format , I want to set up different pipeline for the each log , can you tell me how to config it ? Thanks! - type : log enable… --- ## [I tried to check if the server running by typing "http://localhost:9200/\_status" but i got on the browser "ERR\_EMPTY\_RESPONSE"](https://discuss.elastic.co/t/i-tried-to-check-if-the-server-running-by-typing-http-localhost-9200-status-but-i-got-on-the-browser-err-empty-response/298191)
**Author:** [@moazmahmoud\_saad](https://discuss.elastic.co/u/moazmahmoud_saad)\ **Replies:** 2\ **Last updated:** [February 26, 2022, 12:40am UTC](https://discuss.elastic.co/t/i-tried-to-check-if-the-server-running-by-typing-http-localhost-9200-status-but-i-got-on-the-browser-err-empty-response/298191 "2022-02-26T00:40:07Z")
i tried to check if the server running by typing "http://localhost:9200/\_status" but i got on the browser "ERR\_EMPTY\_RESPONSE" and here what is printed on the cmd (windows) \[2022-02-24T18:48:46,917\]\[INFO \]\[o.e.g.Gatewa… --- ## [Accessing end of dataset with search\_after](https://discuss.elastic.co/t/accessing-end-of-dataset-with-search-after/298212)
**Author:** [@TonyxSun](https://discuss.elastic.co/u/TonyxSun)\ **Replies:** 1\ **Last updated:** [February 26, 2022, 2:04am UTC](https://discuss.elastic.co/t/accessing-end-of-dataset-with-search-after/298212 "2022-02-26T02:04:22Z")
Hello, We are using search\_after to populate and paginate a data grid using fetch requests from an index with around 200,000 documents. We would like to include a "jump to last page" button in our table, but search\_afte… --- ## [How to use Dashboards on another machine?](https://discuss.elastic.co/t/how-to-use-dashboards-on-another-machine/298116)
**Author:** [@VibhutiSaxena](https://discuss.elastic.co/u/VibhutiSaxena)\ **Replies:** 8\ **Last updated:** [February 26, 2022, 12:46am UTC](https://discuss.elastic.co/t/how-to-use-dashboards-on-another-machine/298116 "2022-02-26T00:46:55Z")
Hello everyone, I am beginner in elastic and kibana. I created dashboards for logs on a machine, exported them in ndjson files and now I want to use these dashboards on another machine .Is it possible to use them on anot… --- ## [CSV filter not working properly](https://discuss.elastic.co/t/csv-filter-not-working-properly/298274)
**Author:** [@elasticity2](https://discuss.elastic.co/u/elasticity2)\ **Replies:** 2\ **Last updated:** [February 25, 2022, 11:33pm UTC](https://discuss.elastic.co/t/csv-filter-not-working-properly/298274 "2022-02-25T23:33:37Z")
Hi all, I have a folder which contains two different types of CSV files. My logstash config is as below. When I run logstash, it just ingests the csvs as is without the columns getting generated. If I explicitly mention … --- ## [Combining two count select queries to create a data table in canvas essql](https://discuss.elastic.co/t/combining-two-count-select-queries-to-create-a-data-table-in-canvas-essql/298318)
**Author:** [@Moni](https://discuss.elastic.co/u/Moni)\ **Replies:** 0\ **Last updated:** [February 25, 2022, 10:54pm UTC](https://discuss.elastic.co/t/combining-two-count-select-queries-to-create-a-data-table-in-canvas-essql/298318 "2022-02-25T22:54:21Z")
Hello experts, I am following https://www.elastic.co/guide/en/kibana/master/canvas-function-reference.html to create a single data table from two queries. Attached a screenshot of the same page below. However, in m… --- ## [Multiple dropdown filters in kibana canvas - only one populating](https://discuss.elastic.co/t/multiple-dropdown-filters-in-kibana-canvas-only-one-populating/298304)
**Author:** [@Moni](https://discuss.elastic.co/u/Moni)\ **Replies:** 1\ **Last updated:** [February 25, 2022, 8:40pm UTC](https://discuss.elastic.co/t/multiple-dropdown-filters-in-kibana-canvas-only-one-populating/298304 "2022-02-25T20:40:08Z")
I have two dropdowns filters in a single canvas page. For both the drop-downs I verified that the preview data is able to show the required data. However only one (the one I created first time) is able to show the data i… --- ## [Elastic Agents CA questions…](https://discuss.elastic.co/t/elastic-agents-ca-questions/298011)
**Author:** [@Balu](https://discuss.elastic.co/u/Balu)\ **Replies:** 1\ **Last updated:** [February 25, 2022, 8:33pm UTC](https://discuss.elastic.co/t/elastic-agents-ca-questions/298011 "2022-02-25T20:33:18Z")
Hello peoples, I have started playing with Fleet/Agents on our just upgraded 8.0 cluster and I am confused about how it works with the authoritative CA. I have created my Elastic CA while installing the cluster using e… --- ## [GeoIP processor / setup?](https://discuss.elastic.co/t/geoip-processor-setup/298227)
**Author:** [@Balu](https://discuss.elastic.co/u/Balu)\ **Replies:** 8\ **Last updated:** [February 25, 2022, 6:27pm UTC](https://discuss.elastic.co/t/geoip-processor-setup/298227 "2022-02-25T18:27:24Z")
My geoip processor doesn't want to download its data? ingest.geoip.downloader.enabled is true by default, otherwise I wouldn't be able to query the following stats, right? I have tried enabling it manually as persistent… --- ## [How to merge two data sets into one with Logstash?](https://discuss.elastic.co/t/how-to-merge-two-data-sets-into-one-with-logstash/298218)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 7\ **Last updated:** [February 25, 2022, 5:24pm UTC](https://discuss.elastic.co/t/how-to-merge-two-data-sets-into-one-with-logstash/298218 "2022-02-25T17:24:56Z")
Hi, I'm trying to merge two data sets into one document that will get stored in ES. My first data set looks like this: "\_source": { "protocol-name": "BGP", "name-tag": "default", "@version": "1", "host… --- ## [Help with Aggregate filter](https://discuss.elastic.co/t/help-with-aggregate-filter/298167)
**Author:** [@BhawanaSharma](https://discuss.elastic.co/u/BhawanaSharma)\ **Replies:** 3\ **Last updated:** [February 25, 2022, 5:23pm UTC](https://discuss.elastic.co/t/help-with-aggregate-filter/298167 "2022-02-25T17:23:32Z")
aggregate { timeout\_tags =\> \['\_aggregatetimeout'\] task\_id =\> "%{\[log\]\[file\]\[path\]}" code =\> 'map\["build\_name"\] = event.get("\[build\_name\_long\]") ; map\["build\_link"\] = event.get("\[build\_name\_start\]") ; event.set("bui… --- ## [Updating logstahs 7.9 to 7.16.2](https://discuss.elastic.co/t/updating-logstahs-7-9-to-7-16-2/298299)
**Author:** [@Faisal\_Malik](https://discuss.elastic.co/u/Faisal_Malik)\ **Replies:** 1\ **Last updated:** [February 25, 2022, 5:06pm UTC](https://discuss.elastic.co/t/updating-logstahs-7-9-to-7-16-2/298299 "2022-02-25T17:06:05Z")
updating logstash from 7.9.0 to 7.16.2 using helm chat. but getting error. :39:59,607\]\[ERROR\]\[logstash.agent \] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>… --- ## [How to reindex only 1 shard of source\_index to a destination\_index?](https://discuss.elastic.co/t/how-to-reindex-only-1-shard-of-source-index-to-a-destination-index/298301)
**Author:** [@ztesky](https://discuss.elastic.co/u/ztesky)\ **Replies:** 0\ **Last updated:** [February 25, 2022, 4:14pm UTC](https://discuss.elastic.co/t/how-to-reindex-only-1-shard-of-source-index-to-a-destination-index/298301 "2022-02-25T16:14:32Z")
Using Re-index API is it possible to incrementally move data only belonging to a certain shard of source\_index (which has routing set up by productId) to another shard of a destination\_index in the same cluster? --- ## [Index does not refresh on time](https://discuss.elastic.co/t/index-does-not-refresh-on-time/298281)
**Author:** [@sunny3794.ad](https://discuss.elastic.co/u/sunny3794.ad)\ **Replies:** 2\ **Last updated:** [February 25, 2022, 4:10pm UTC](https://discuss.elastic.co/t/index-does-not-refresh-on-time/298281 "2022-02-25T16:10:07Z")
Hello everyone. I am using the Python API for Elasticsearch to create indices and insert the data from multiple csv files into those indices. I am also creating the index patterns using python and Kibana API. While ins… --- ## [Query Conditionally Between Fields](https://discuss.elastic.co/t/query-conditionally-between-fields/298294)
**Author:** [@\_PA](https://discuss.elastic.co/u/_PA)\ **Replies:** 4\ **Last updated:** [February 25, 2022, 3:59pm UTC](https://discuss.elastic.co/t/query-conditionally-between-fields/298294 "2022-02-25T15:59:08Z")
Hi, I want to know if it is possible to perform a query in kibana to get the following results. I have a records that have common values between them and I want to query and get the results for the records that have mo… --- ## [Problem Dividing Metrics in TVSB](https://discuss.elastic.co/t/problem-dividing-metrics-in-tvsb/298277)
**Author:** [@\_PA](https://discuss.elastic.co/u/_PA)\ **Replies:** 4\ **Last updated:** [February 25, 2022, 4:00pm UTC](https://discuss.elastic.co/t/problem-dividing-metrics-in-tvsb/298277 "2022-02-25T16:00:17Z")
Hi, I am recent to Kibana and I am having issues displaying a metric which is the result of a division of two fields. I am trying to do this in TVSB and this is the current setup I have: I know the count of device\_i… --- ## [Last value |No result found](https://discuss.elastic.co/t/last-value-no-result-found/297981)
**Author:** [@Nasser](https://discuss.elastic.co/u/Nasser)\ **Replies:** 2\ **Last updated:** [February 25, 2022, 3:57pm UTC](https://discuss.elastic.co/t/last-value-no-result-found/297981 "2022-02-25T15:57:45Z")
hi my field having new value every min, i want to show the latest value of field in Metric regardless of dashboard Time interval but when i choose Last value i got No result found --- ## [Auditing for kibana](https://discuss.elastic.co/t/auditing-for-kibana/298197)
**Author:** [@aman123](https://discuss.elastic.co/u/aman123)\ **Replies:** 6\ **Last updated:** [February 25, 2022, 3:54pm UTC](https://discuss.elastic.co/t/auditing-for-kibana/298197 "2022-02-25T15:54:37Z")
Hi All, I'm trying to enable the auditing for kibana by adding the below configuration in the kibana.yml file xpack.security.audit.enabled: true and setting the logging destination option to the /var/log/kibana.log. A… --- ## [Failed to start Kibana](https://discuss.elastic.co/t/failed-to-start-kibana/296740)
**Author:** [@rportillo](https://discuss.elastic.co/u/rportillo)\ **Replies:** 3\ **Last updated:** [February 25, 2022, 3:51pm UTC](https://discuss.elastic.co/t/failed-to-start-kibana/296740 "2022-02-25T15:51:09Z")
Hi all, I'm new using ELK and i'm working in a project to deploy ELK for collect logs from differents inputs (logstash, syslog, etc..) to generate different alerts for trigger emails to my customer depending on the seve… --- ## [Logstash output loki tcp error](https://discuss.elastic.co/t/logstash-output-loki-tcp-error/298298)
**Author:** [@bianca6](https://discuss.elastic.co/u/bianca6)\ **Replies:** 0\ **Last updated:** [February 25, 2022, 3:44pm UTC](https://discuss.elastic.co/t/logstash-output-loki-tcp-error/298298 "2022-02-25T15:44:41Z")
Hi everyone! I have a first pipeline running well Fileabeat -\> Logstash -\> Elasticsearch. Now I'm trying to run Fileabeat -\> Logstash -\> Loki but there is a connection error, the message come from Filebeat: {"log.leve… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1034) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1036)