# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1095 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1096 --- ## [How to remove date and time in message](https://discuss.elastic.co/t/how-to-remove-date-and-time-in-message/294280)
**Author:** [@Roccof97](https://discuss.elastic.co/u/Roccof97)\ **Replies:** 3\ **Last updated:** [January 13, 2022, 2:59pm UTC](https://discuss.elastic.co/t/how-to-remove-date-and-time-in-message/294280 "2022-01-13T14:59:56Z")
Hi, how can i remove the date and time from the message field? and above all is it possible? example screen shot: --- ## [Delete value from filed in recursive way](https://discuss.elastic.co/t/delete-value-from-filed-in-recursive-way/294088)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 4\ **Last updated:** [January 13, 2022, 2:44pm UTC](https://discuss.elastic.co/t/delete-value-from-filed-in-recursive-way/294088 "2022-01-13T14:44:29Z")
Hi I need to remove from a few fields in the recursive way some value so I've tried in two steps but without success, can You check what's wrong input data: "ue\_stat" =\> "undefined-undefined", "s\_gw" =\> "122.123.205… --- ## [Cisco module in FIlbeat - General doubt](https://discuss.elastic.co/t/cisco-module-in-filbeat-general-doubt/294212)
**Author:** [@arunhk3](https://discuss.elastic.co/u/arunhk3)\ **Replies:** 2\ **Last updated:** [January 13, 2022, 2:41pm UTC](https://discuss.elastic.co/t/cisco-module-in-filbeat-general-doubt/294212 "2022-01-13T14:41:10Z")
I have to enable multiple filesets in the Cisco Module of Filebeat. Is that possible? Can I set a document\_type for each fileset such as ASA, IOS, NEXUS, etc while configuring the modules? It is required for me to fil… --- ## [Grok error with filebeat's nginx module while parsing default nginx logs](https://discuss.elastic.co/t/grok-error-with-filebeats-nginx-module-while-parsing-default-nginx-logs/294286)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 1\ **Last updated:** [January 13, 2022, 2:25pm UTC](https://discuss.elastic.co/t/grok-error-with-filebeats-nginx-module-while-parsing-default-nginx-logs/294286 "2022-01-13T14:25:59Z")
Hi, I am trying to setup filebeat in a kubernetes cluster. I only want to gather logs from specific pods. I decided to run filebeat as daemonset and use the autodiscover and hints. So I can decide by setting pod annotat… --- ## [Elasticsearch - Attempted to send a bulk request to elasticsearch' but Elasticsearch appears to be unreachable or down!](https://discuss.elastic.co/t/elasticsearch-attempted-to-send-a-bulk-request-to-elasticsearch-but-elasticsearch-appears-to-be-unreachable-or-down/294287)
**Author:** [@makeshkumar](https://discuss.elastic.co/u/makeshkumar)\ **Replies:** 0\ **Last updated:** [January 13, 2022, 2:00pm UTC](https://discuss.elastic.co/t/elasticsearch-attempted-to-send-a-bulk-request-to-elasticsearch-but-elasticsearch-appears-to-be-unreachable-or-down/294287 "2022-01-13T14:00:12Z")
Hi Team, We are using the ELK stack and we are getting the below error in our logstash pods logs . Logs are sending slowly or some time it is not at all processing the logs . Note: We checked the elasatic search servi… --- ## [Kibana was available (Was degraded)](https://discuss.elastic.co/t/kibana-was-available-was-degraded/294193)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 2\ **Last updated:** [January 13, 2022, 1:55pm UTC](https://discuss.elastic.co/t/kibana-was-available-was-degraded/294193 "2022-01-13T13:55:56Z")
Hello all, I am using version 7.16.2 for my elastic stack. I have a three node cluster implementation. when I updated the stack to 7.16.2, I noticed following in my logs log \[12:00:44.067\] \[info\]\[status\] Kibana is… --- ## [Is it possible to connect Logstash 7.16 with Elasticsearch "8.1.0-SNAPSHOT"](https://discuss.elastic.co/t/is-it-possible-to-connect-logstash-7-16-with-elasticsearch-8-1-0-snapshot/294272)
**Author:** [@Abhishek\_Gautam](https://discuss.elastic.co/u/Abhishek_Gautam)\ **Replies:** 1\ **Last updated:** [January 13, 2022, 1:55pm UTC](https://discuss.elastic.co/t/is-it-possible-to-connect-logstash-7-16-with-elasticsearch-8-1-0-snapshot/294272 "2022-01-13T13:55:30Z")
is it possible to connect Logstash 7.16 with Elasticsearch "8.1.0-SNAPSHOT" --- ## [Trying to use our own certificates for kibana/elasticsearch but page doesn't load after](https://discuss.elastic.co/t/trying-to-use-our-own-certificates-for-kibana-elasticsearch-but-page-doesnt-load-after/293729)
**Author:** [@g0nz0](https://discuss.elastic.co/u/g0nz0)\ **Replies:** 5\ **Last updated:** [January 13, 2022, 1:51pm UTC](https://discuss.elastic.co/t/trying-to-use-our-own-certificates-for-kibana-elasticsearch-but-page-doesnt-load-after/293729 "2022-01-13T13:51:34Z")
Hello, I've manage to build our ELK environment on Ubuntu 20.0.4 (not Docker) and setup Elastiflow, it works great and I followed this guide which also uses self certs, so we just access using https://1.2.3.4:5601 for e… --- ## [Logstash with docker logs and tags](https://discuss.elastic.co/t/logstash-with-docker-logs-and-tags/294278)
**Author:** [@Spyros\_Agriopoulos](https://discuss.elastic.co/u/Spyros_Agriopoulos)\ **Replies:** 0\ **Last updated:** [January 13, 2022, 1:33pm UTC](https://discuss.elastic.co/t/logstash-with-docker-logs-and-tags/294278 "2022-01-13T13:33:57Z")
Hello, I am trying to send a docker log from one machine with filebeat and add a tag to it, and when it reaches logstash it should mutate it and the give it an ilm\_rollover\_alias. The log appears in kibana, but with the … --- ## [How to enable cache in logstash](https://discuss.elastic.co/t/how-to-enable-cache-in-logstash/294126)
**Author:** [@Roccof97](https://discuss.elastic.co/u/Roccof97)\ **Replies:** 2\ **Last updated:** [January 13, 2022, 1:29pm UTC](https://discuss.elastic.co/t/how-to-enable-cache-in-logstash/294126 "2022-01-13T13:29:33Z")
Hello, I currently have an elk cluster composed as follows: Beats= is the agent installed in linux machine and send logs to Logstash Logstash= filter logs and send logs to elk -Beats --\> Logstash --\> Elasticsearch m… --- ## [Unable to retrieve version information from Elasticsearch nodes. connect ECONNREFUSED 172.19.0.3:9200](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes-connect-econnrefused-172-19-0-3-9200/294182)
**Author:** [@Spyros\_Agriopoulos](https://discuss.elastic.co/u/Spyros_Agriopoulos)\ **Replies:** 6\ **Last updated:** [January 13, 2022, 1:22pm UTC](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes-connect-econnrefused-172-19-0-3-9200/294182 "2022-01-13T13:22:14Z")
Hello guys, I am trying to setup an ELK stack with docker compose and TLS, and I get this message from kibana's logs. Unable to retrieve version information from Elasticsearch nodes. connect ECONNREFUSED 172.19.0.3:920… --- ## [Script Query - Returning multiple values on aggregation](https://discuss.elastic.co/t/script-query-returning-multiple-values-on-aggregation/294095)
**Author:** [@hyun](https://discuss.elastic.co/u/hyun)\ **Replies:** 7\ **Last updated:** [January 13, 2022, 1:19pm UTC](https://discuss.elastic.co/t/script-query-returning-multiple-values-on-aggregation/294095 "2022-01-13T13:19:49Z")
Aggregation Result "aggregations": { "649": { "doc\_count\_error\_upper\_bound": 0, "sum\_other\_doc\_count": 0, "buckets": \[ { "key": "ALLOGENE THERAPEUTICS", … --- ## [Exiting: 1 error: error loading config file: invalid config: yaml: line 13: did not find expected key](https://discuss.elastic.co/t/exiting-1-error-error-loading-config-file-invalid-config-yaml-line-13-did-not-find-expected-key/294162)
**Author:** [@awis](https://discuss.elastic.co/u/awis)\ **Replies:** 4\ **Last updated:** [January 13, 2022, 1:18pm UTC](https://discuss.elastic.co/t/exiting-1-error-error-loading-config-file-invalid-config-yaml-line-13-did-not-find-expected-key/294162 "2022-01-13T13:18:03Z")
Hi there, I'm trying to connect Filebeat Snort module with my Elasticsearch and when i run command .\\filebeat.exe setup -e on Windows 10 Pro VM, I got this error. This is my configuration for filebeat.yml filebeat.in… --- ## [Search DATE between 2 DATE points in data](https://discuss.elastic.co/t/search-date-between-2-date-points-in-data/294265)
**Author:** [@Dvesters](https://discuss.elastic.co/u/Dvesters)\ **Replies:** 1\ **Last updated:** [January 13, 2022, 1:14pm UTC](https://discuss.elastic.co/t/search-date-between-2-date-points-in-data/294265 "2022-01-13T13:14:45Z")
Hi all, I have data from an HR system I have the following dates available for absenteeism (also for holidays) SickLeave\_StartDate 01-01-2021 SickLeave\_EndDate 03-03-2021 So this person is sick from January 1 to Marc… --- ## [Execute sql queries in elassandra \[elastic search\]](https://discuss.elastic.co/t/execute-sql-queries-in-elassandra-elastic-search/294260)
**Author:** [@kvaishnavi97](https://discuss.elastic.co/u/kvaishnavi97)\ **Replies:** 1\ **Last updated:** [January 13, 2022, 1:06pm UTC](https://discuss.elastic.co/t/execute-sql-queries-in-elassandra-elastic-search/294260 "2022-01-13T13:06:12Z")
Hi, I am using Elassandra \[Combination of Elasticsearch + Cassandra\], I want to execute sql queries in Elasticsearch, But I am getting one exception. I gone inside the elassandra pod, tried this cmd \`curl -XPOST http:/… --- ## [How to find empty values in a kibana query](https://discuss.elastic.co/t/how-to-find-empty-values-in-a-kibana-query/293642)
**Author:** [@Nijanthan](https://discuss.elastic.co/u/Nijanthan)\ **Replies:** 3\ **Last updated:** [January 13, 2022, 1:05pm UTC](https://discuss.elastic.co/t/how-to-find-empty-values-in-a-kibana-query/293642 "2022-01-13T13:05:50Z")
I'm getting the logs with statusCode 200 and empty statuscodes , I need to find the logs with empty statuscode I've tried using statusCode:" " but it didn't worked Hint: The statuscode for success can be written as sta… --- ## [Rules don't create alert when value 0 or index not exist](https://discuss.elastic.co/t/rules-dont-create-alert-when-value-0-or-index-not-exist/294251)
**Author:** [@zakabluk](https://discuss.elastic.co/u/zakabluk)\ **Replies:** 3\ **Last updated:** [January 13, 2022, 1:02pm UTC](https://discuss.elastic.co/t/rules-dont-create-alert-when-value-0-or-index-not-exist/294251 "2022-01-13T13:02:58Z")
Kibana v 7.13.3 Hi! I created Rule with "Index threshold". I set INDEX (I chose index pattern for datastream and "Time field") WHEN count() OVER all documents IS BELOW 10000 FOR THE LAST 10 minutes Problem: When e… --- ## [A file written by master to the store cannot be accessed on the node](https://discuss.elastic.co/t/a-file-written-by-master-to-the-store-cannot-be-accessed-on-the-node/294247)
**Author:** [@mihai.prichindel](https://discuss.elastic.co/u/mihai.prichindel)\ **Replies:** 2\ **Last updated:** [January 13, 2022, 12:18pm UTC](https://discuss.elastic.co/t/a-file-written-by-master-to-the-store-cannot-be-accessed-on-the-node/294247 "2022-01-13T12:18:43Z")
I am using Elasticsearch 7.8.0. When I want to make backups, most of the time everything is working fine, but from time to time I am getting the following error and backup fails: \[2021-06-02T09:50:25,297\]\[WARN \]\[r.supp… --- ## [Elastic/fleet-server cannot create/write to index - insufficient permissions](https://discuss.elastic.co/t/elastic-fleet-server-cannot-create-write-to-index-insufficient-permissions/294181)
**Author:** [@mark8](https://discuss.elastic.co/u/mark8)\ **Replies:** 3\ **Last updated:** [January 13, 2022, 11:57am UTC](https://discuss.elastic.co/t/elastic-fleet-server-cannot-create-write-to-index-insufficient-permissions/294181 "2022-01-13T11:57:18Z")
Hi, I am trying to log a variety of custom metrics to Elasticsearch through TCP, each in their own index. Until now I was working with a custom deployment of the ELK stack, and simply sending these metrics in JSON form … --- ## [Transform API is not updating automaticly when i add some data in the source index](https://discuss.elastic.co/t/transform-api-is-not-updating-automaticly-when-i-add-some-data-in-the-source-index/294263)
**Author:** [@waelboss](https://discuss.elastic.co/u/waelboss)\ **Replies:** 1\ **Last updated:** [January 13, 2022, 11:28am UTC](https://discuss.elastic.co/t/transform-api-is-not-updating-automaticly-when-i-add-some-data-in-the-source-index/294263 "2022-01-13T11:28:47Z")
I am using a API transform to get specific metrics here my query PUT \_transform/index-transform { "description": "Calculate the duration of an event from multiple status updates (based on its uniqueID)", "frequency… --- ## [FSCrawler 2.9 -supported versions of Elastic](https://discuss.elastic.co/t/fscrawler-2-9-supported-versions-of-elastic/294256)
**Author:** [@newschapmj1](https://discuss.elastic.co/u/newschapmj1)\ **Replies:** 3\ **Last updated:** [January 13, 2022, 11:07am UTC](https://discuss.elastic.co/t/fscrawler-2-9-supported-versions-of-elastic/294256 "2022-01-13T11:07:34Z")
We are using FSCrawler 2.7 with Elastics 7.10.2. Does the new version of FSCrawler 2.9 support Elastics 7.10.2 or do we have to upgrade to 7.16.2? --- ## [Value too large to output (49839 bytes) logstash error](https://discuss.elastic.co/t/value-too-large-to-output-49839-bytes-logstash-error/294170)
**Author:** [@ZZ.IT](https://discuss.elastic.co/u/ZZ.IT)\ **Replies:** 2\ **Last updated:** [January 13, 2022, 11:02am UTC](https://discuss.elastic.co/t/value-too-large-to-output-49839-bytes-logstash-error/294170 "2022-01-13T11:02:33Z")
We are using ELK stack on windows server 2016. ELK stack has version 7.16.2. We are sending data from filebeat to logstash using pipeline and the pipeline har grok plugin. On sending the data we are getting the error i… --- ## [Filter single panel using URL parameters](https://discuss.elastic.co/t/filter-single-panel-using-url-parameters/294257)
**Author:** [@vleo](https://discuss.elastic.co/u/vleo)\ **Replies:** 0\ **Last updated:** [January 13, 2022, 10:47am UTC](https://discuss.elastic.co/t/filter-single-panel-using-url-parameters/294257 "2022-01-13T10:47:31Z")
Hi, I'm working on a Kibana dashboard that will be build dynamically based on URL that will depend on some previous user action. The idea is to create the dashboard based on filters. I already know that we can apply fi… --- ## [Elasticsearch - Merge date histogram aggregation](https://discuss.elastic.co/t/elasticsearch-merge-date-histogram-aggregation/294228)
**Author:** [@hyun](https://discuss.elastic.co/u/hyun)\ **Replies:** 3\ **Last updated:** [January 13, 2022, 10:30am UTC](https://discuss.elastic.co/t/elasticsearch-merge-date-histogram-aggregation/294228 "2022-01-13T10:30:50Z")
Query GET /\_search { "size" : 0, "query" : { "ids" : { "types" : \[ \], "values" : \[ "someId1", "someId2", "someId3" ... \] } }, "aggregations" : { "how\_to\_merge" : { "date\_histogram" … --- ## [Linux(centos)+Windows Cluster](https://discuss.elastic.co/t/linux-centos-windows-cluster/294025)
**Author:** [@smam](https://discuss.elastic.co/u/smam)\ **Replies:** 3\ **Last updated:** [January 13, 2022, 8:13am UTC](https://discuss.elastic.co/t/linux-centos-windows-cluster/294025 "2022-01-13T08:13:47Z")
Hello, Can one have an Cluster with one Windows and one Linux VM Node? I only find information about migrating from one to another. (A yes or no is sufficient, I got the following error which makes me think it may not … --- ## [How do i build spell engine for prefix based search as you type product](https://discuss.elastic.co/t/how-do-i-build-spell-engine-for-prefix-based-search-as-you-type-product/294253)
**Author:** [@Bhagwati\_Malav](https://discuss.elastic.co/u/Bhagwati_Malav)\ **Replies:** 0\ **Last updated:** [January 13, 2022, 9:49am UTC](https://discuss.elastic.co/t/how-do-i-build-spell-engine-for-prefix-based-search-as-you-type-product/294253 "2022-01-13T09:49:07Z")
Hi Need input from community on building spell engine system for search as you type product. Currently running a search as you type product which uses edge ngram approach internally. Have turned off fuzziness setting as… --- ## [Logstash running in openshift is not sending output to NFS](https://discuss.elastic.co/t/logstash-running-in-openshift-is-not-sending-output-to-nfs/294242)
**Author:** [@Ravi\_Sehgal](https://discuss.elastic.co/u/Ravi_Sehgal)\ **Replies:** 0\ **Last updated:** [January 13, 2022, 8:11am UTC](https://discuss.elastic.co/t/logstash-running-in-openshift-is-not-sending-output-to-nfs/294242 "2022-01-13T08:11:41Z")
I have a requirement to send docker container logs to NFS drive. Filebeat installed as daemonset sends logs to single logstash pod which shall write them to NFS. Logstatsh configuration look something like below outpu… --- ## [Return results with match\_phrase if document count is greater than 1](https://discuss.elastic.co/t/return-results-with-match-phrase-if-document-count-is-greater-than-1/294143)
**Author:** [@liam.gallagher](https://discuss.elastic.co/u/liam.gallagher)\ **Replies:** 1\ **Last updated:** [January 13, 2022, 9:42am UTC](https://discuss.elastic.co/t/return-results-with-match-phrase-if-document-count-is-greater-than-1/294143 "2022-01-13T09:42:58Z")
Good morning, Is it possible to use match\_phrase to count the occurrence of the phrase per document and only return results if the phrase count in the document in greater than 1? { "query": { "bool": { "sho… --- ## [Pull data from another elasticsearch cluster using logstash](https://discuss.elastic.co/t/pull-data-from-another-elasticsearch-cluster-using-logstash/293946)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 2\ **Last updated:** [January 13, 2022, 9:16am UTC](https://discuss.elastic.co/t/pull-data-from-another-elasticsearch-cluster-using-logstash/293946 "2022-01-13T09:16:21Z")
Hi folks, I have a use case where I need to pull data from an external Elasticsearch cluster with the following Limitation: It is not allowed to open a conection to my internal elastic cluster (due to compliance regulat… --- ## [Outdated dynamic field mapping](https://discuss.elastic.co/t/outdated-dynamic-field-mapping/294151)
**Author:** [@fede1](https://discuss.elastic.co/u/fede1)\ **Replies:** 3\ **Last updated:** [January 13, 2022, 8:48am UTC](https://discuss.elastic.co/t/outdated-dynamic-field-mapping/294151 "2022-01-13T08:48:41Z")
I have a dynamic field mapping of type X, and when I attempt to index a document with a different type for the same field, I get the following error with a 400 status code, as expected: "type": "mapper\_parsing\_exception… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1094) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1096)