# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1098 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1099 --- ## [Are we forced to data streams in 8.0?](https://discuss.elastic.co/t/are-we-forced-to-data-streams-in-8-0/294090)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 0\ **Last updated:** [January 11, 2022, 10:58pm UTC](https://discuss.elastic.co/t/are-we-forced-to-data-streams-in-8-0/294090 "2022-01-11T22:58:52Z")
I'm researching what we need to do to get off legacy templates. For example, we have several indices like filebeat-7.14.0-index-a, filebeat-7.14.0-index-b, etc. They are different apps and different access rules. Now … --- ## [Query String Regex/WildCard Search](https://discuss.elastic.co/t/query-string-regex-wildcard-search/293845)
**Author:** [@Sahil5](https://discuss.elastic.co/u/Sahil5)\ **Replies:** 15\ **Last updated:** [January 11, 2022, 10:36pm UTC](https://discuss.elastic.co/t/query-string-regex-wildcard-search/293845 "2022-01-11T22:36:13Z")
Hi Team, Problem Statement Search String - "Hello \* World" Expected Output - 1. "Hello First World" 2. "Hello Second World" I need results that contain one word in place of \*. I have tried using query string regex … --- ## [Failed to Start Kibana 7.16.1](https://discuss.elastic.co/t/failed-to-start-kibana-7-16-1/293900)
**Author:** [@abhayamishra](https://discuss.elastic.co/u/abhayamishra)\ **Replies:** 8\ **Last updated:** [January 11, 2022, 10:06pm UTC](https://discuss.elastic.co/t/failed-to-start-kibana-7-16-1/293900 "2022-01-11T22:06:56Z")
After Upgrading from 7.5.2or with fresh installation of Kibana 7.16.1 - it is failed to start. 7.5.2 version was working well. ROR plugin is used for authentication. This is also upgraded to readonlyrest\_kbn\_enterprise… --- ## [Fleet Apache access log integration - adding extra data from logs](https://discuss.elastic.co/t/fleet-apache-access-log-integration-adding-extra-data-from-logs/294048)
**Author:** [@ChrisTB](https://discuss.elastic.co/u/ChrisTB)\ **Replies:** 1\ **Last updated:** [January 11, 2022, 10:04pm UTC](https://discuss.elastic.co/t/fleet-apache-access-log-integration-adding-extra-data-from-logs/294048 "2022-01-11T22:04:32Z")
Hi, We have set up an integration via Fleet/Elastic Agent for Apache. I was wondering if it is possible to add extra data that is present in the access log files, to the data stream, so we can query and visualize it in… --- ## [Elastic Agent SQL Integration](https://discuss.elastic.co/t/elastic-agent-sql-integration/294043)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 1\ **Last updated:** [January 11, 2022, 10:03pm UTC](https://discuss.elastic.co/t/elastic-agent-sql-integration/294043 "2022-01-11T22:03:33Z")
Hi All, I was wondering if there is or are plans to have an SQL integration for the Elastic Agent that is basically (SQL module | Metricbeat Reference \[7.16\] | Elastic)? I'm looking have a recurring query to collect som… --- ## [\[Help\] Understanding routing to an index partition](https://discuss.elastic.co/t/help-understanding-routing-to-an-index-partition/293812)
**Author:** [@Radaeld](https://discuss.elastic.co/u/Radaeld)\ **Replies:** 2\ **Last updated:** [January 11, 2022, 9:34pm UTC](https://discuss.elastic.co/t/help-understanding-routing-to-an-index-partition/293812 "2022-01-11T21:34:10Z")
Hey all I have some questions regarding routing\_partition\_size field. Not sure but upon reading the documentation , this is what i understood: By default, using a routing key will access only 1 primary shard, for inde… --- ## [Options available for storing data beyond a limit](https://discuss.elastic.co/t/options-available-for-storing-data-beyond-a-limit/294080)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 1\ **Last updated:** [January 11, 2022, 9:31pm UTC](https://discuss.elastic.co/t/options-available-for-storing-data-beyond-a-limit/294080 "2022-01-11T21:31:02Z")
Hello. We have a hard limit of 4TB of disk storage that can be allocated to individual nodes in a cluster. My question is what happens when we start nearing the threshold of 4TB? Is there a way we could archive data o… --- ## [Upgrade log4j to version 2.17](https://discuss.elastic.co/t/upgrade-log4j-to-version-2-17/294058)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 1\ **Last updated:** [January 11, 2022, 9:04pm UTC](https://discuss.elastic.co/t/upgrade-log4j-to-version-2-17/294058 "2022-01-11T21:04:16Z")
hello, I have to upgrade log4j to version 2.17 I have elastic with version 7.11.1 and 7.8.0 My question is - can I do it manually on current version on ES or I need to upgrade ES to version 7.16 with log4j installed ? … --- ## [Systemd to elasticseaech](https://discuss.elastic.co/t/systemd-to-elasticseaech/294020)
**Author:** [@aviad.co1](https://discuss.elastic.co/u/aviad.co1)\ **Replies:** 2\ **Last updated:** [January 11, 2022, 6:58pm UTC](https://discuss.elastic.co/t/systemd-to-elasticseaech/294020 "2022-01-11T18:58:23Z")
Hi, I just install Elasticsearch with tar file... there is a link that define how to add systemd to run Elasticsearch for this installation method.... Thanks --- ## [How display documents with missing date field](https://discuss.elastic.co/t/how-display-documents-with-missing-date-field/294065)
**Author:** [@dandcp](https://discuss.elastic.co/u/dandcp)\ **Replies:** 5\ **Last updated:** [January 11, 2022, 6:31pm UTC](https://discuss.elastic.co/t/how-display-documents-with-missing-date-field/294065 "2022-01-11T18:31:54Z")
I have what I think is an easy question, but for some reason I can't get a straight answer. I am using Kibana with another tool. The tool has documents in it that have 10 fields. 3 of those fields are date fields. If… --- ## [Best way to migrate data disk](https://discuss.elastic.co/t/best-way-to-migrate-data-disk/293213)
**Author:** [@grumo35](https://discuss.elastic.co/u/grumo35)\ **Replies:** 4\ **Last updated:** [January 11, 2022, 4:23pm UTC](https://discuss.elastic.co/t/best-way-to-migrate-data-disk/293213 "2022-01-11T16:23:48Z")
Hi, Today i was wondering what would be the best way to migrate disks ( dedicated data disk for Elasticsearch ) from one virtual machine to another. The disks are directly attached to the vms, could i stop the node and… --- ## [Boosting documents where more than one field matches terms](https://discuss.elastic.co/t/boosting-documents-where-more-than-one-field-matches-terms/294059)
**Author:** [@tensor](https://discuss.elastic.co/u/tensor)\ **Replies:** 0\ **Last updated:** [January 11, 2022, 4:13pm UTC](https://discuss.elastic.co/t/boosting-documents-where-more-than-one-field-matches-terms/294059 "2022-01-11T16:13:34Z")
Hi We have a question regarding how to do some ranking on our queries, which may also fall back on to how to best index our data. Our scenario is that we have documents something along the lines of a Model, which then … --- ## [Devtools show all content docs on the index blogs](https://discuss.elastic.co/t/devtools-show-all-content-docs-on-the-index-blogs/293802)
**Author:** [@Glardz](https://discuss.elastic.co/u/Glardz)\ **Replies:** 1\ **Last updated:** [January 11, 2022, 3:59pm UTC](https://discuss.elastic.co/t/devtools-show-all-content-docs-on-the-index-blogs/293802 "2022-01-11T15:59:45Z")
Hello, i try to do the paractice exam of Elasticsearch, i have a task wich is: Find the number of unique authors for each calendar year of blogs on cluster1 with the phrase "open source" in that order in the content fi… --- ## [Maps, Geoshapes, Geopoints](https://discuss.elastic.co/t/maps-geoshapes-geopoints/293906)
**Author:** [@androsteve](https://discuss.elastic.co/u/androsteve)\ **Replies:** 4\ **Last updated:** [January 11, 2022, 3:36pm UTC](https://discuss.elastic.co/t/maps-geoshapes-geopoints/293906 "2022-01-11T15:36:46Z")
I'm new to Elasticsearch and Kibana. I've created 2 indexes. 1 - Customers containing geo\_point and name of location they purchased from 2 - Locations containing geo\_point and name of location I'm able to plot 2 laye… --- ## [Metricbeat cpu](https://discuss.elastic.co/t/metricbeat-cpu/294052)
**Author:** [@joaosf](https://discuss.elastic.co/u/joaosf)\ **Replies:** 0\ **Last updated:** [January 11, 2022, 3:11pm UTC](https://discuss.elastic.co/t/metricbeat-cpu/294052 "2022-01-11T15:11:33Z")
help, Is there any explication for this kind of values? system.cpu.system.norm.pct=111,851,835.7% metricbeat 7.14 --- ## [Importing file to an existing index](https://discuss.elastic.co/t/importing-file-to-an-existing-index/293932)
**Author:** [@kibanauser4](https://discuss.elastic.co/u/kibanauser4)\ **Replies:** 4\ **Last updated:** [January 11, 2022, 3:11pm UTC](https://discuss.elastic.co/t/importing-file-to-an-existing-index/293932 "2022-01-11T15:11:09Z")
I wanted to update my index by importing a file via Logstash. I used the same logstash file (the input file was updated with new records) cause I thought it's gonna overwrite the existing index. I tested this on a differ… --- ## [Json nested field](https://discuss.elastic.co/t/json-nested-field/293925)
**Author:** [@kvmuralidhar](https://discuss.elastic.co/u/kvmuralidhar)\ **Replies:** 2\ **Last updated:** [January 11, 2022, 3:02pm UTC](https://discuss.elastic.co/t/json-nested-field/293925 "2022-01-11T15:02:30Z")
Hi All, I have a field with value as a json object as follows messageParts="\[{\\"disposition\\":\\"inline\\",\\"sha256\\":\\"f3c958fe6406140b13360a42b3237477dc5bc525f3858f64cca45bf2d02fc771\\",\\"md5\\":\\"c87f14af3c845fc6d8b84b1… --- ## [Canvas data table top hit metric](https://discuss.elastic.co/t/canvas-data-table-top-hit-metric/293995)
**Author:** [@hNiven](https://discuss.elastic.co/u/hNiven)\ **Replies:** 3\ **Last updated:** [January 11, 2022, 2:46pm UTC](https://discuss.elastic.co/t/canvas-data-table-top-hit-metric/293995 "2022-01-11T14:46:25Z")
Hi, I am creating a data table in canvas and was wondering if it is possible to do something similar to the 'top hit' metric you can do in the visualization, but in the canvas data table? For example I have a field cal… --- ## [Fortigate Firewall Logs to Elasticsearch](https://discuss.elastic.co/t/fortigate-firewall-logs-to-elasticsearch/294041)
**Author:** [@yogicd](https://discuss.elastic.co/u/yogicd)\ **Replies:** 2\ **Last updated:** [January 11, 2022, 2:42pm UTC](https://discuss.elastic.co/t/fortigate-firewall-logs-to-elasticsearch/294041 "2022-01-11T14:42:53Z")
Hi Team, I am trying to get the Fortigate firewall logs to elasticsearch via logstash but not able to get the data to elasticsearch, But i can see the data coming via tcpdump udp port 514. and my logstash config as… --- ## [Update to latest version compatibility](https://discuss.elastic.co/t/update-to-latest-version-compatibility/294031)
**Author:** [@FleaLes](https://discuss.elastic.co/u/FleaLes)\ **Replies:** 4\ **Last updated:** [January 11, 2022, 2:36pm UTC](https://discuss.elastic.co/t/update-to-latest-version-compatibility/294031 "2022-01-11T14:36:38Z")
Hi. I've inherited an ELK setup as follows: Elasticsearch / Logstash / Kibana / Filebeat: version 6.3.0 Curator: version 5.5.4 Docker Composer: version 3 HAProxy: version 1.8.12 I'm planning to upgrade the whole stac… --- ## [Problems deploying to azure](https://discuss.elastic.co/t/problems-deploying-to-azure/293954)
**Author:** [@Jorgenv](https://discuss.elastic.co/u/Jorgenv)\ **Replies:** 2\ **Last updated:** [January 11, 2022, 2:33pm UTC](https://discuss.elastic.co/t/problems-deploying-to-azure/293954 "2022-01-11T14:33:00Z")
I'm trying to deploy a test environment on azure and I'm running into all kinds of problems. I first had issues passing self-signed certificates for the application gateway and kibana, but I found some hacky way around t… --- ## [Logstash Input adds data stamp and host](https://discuss.elastic.co/t/logstash-input-adds-data-stamp-and-host/294021)
**Author:** [@pruttle](https://discuss.elastic.co/u/pruttle)\ **Replies:** 7\ **Last updated:** [January 11, 2022, 2:23pm UTC](https://discuss.elastic.co/t/logstash-input-adds-data-stamp-and-host/294021 "2022-01-11T14:23:17Z")
I am using Logstash to receive data from a syslog server and push it into different Kafka topics. Logstash appears to add a data/time stamp and hostname at that start of the raw event. Is there a way stop this happening?… --- ## [Metricbeat collecting mongo-metrics is not updated to elasticsearch](https://discuss.elastic.co/t/metricbeat-collecting-mongo-metrics-is-not-updated-to-elasticsearch/293922)
**Author:** [@smileyvignesh](https://discuss.elastic.co/u/smileyvignesh)\ **Replies:** 2\ **Last updated:** [January 11, 2022, 1:58pm UTC](https://discuss.elastic.co/t/metricbeat-collecting-mongo-metrics-is-not-updated-to-elasticsearch/293922 "2022-01-11T13:58:25Z")
Hello everyone, I'm using the metricbeat to get mongodb metics ("dbstats", "status", "collstats", "metrics") and update it to Elasticsearch via logstash. There is no error seen in the logstash logs or metric beat logs. T… --- ## [IBM HTTP Server](https://discuss.elastic.co/t/ibm-http-server/293862)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 6\ **Last updated:** [January 11, 2022, 1:57pm UTC](https://discuss.elastic.co/t/ibm-http-server/293862 "2022-01-11T13:57:56Z")
Hello ! Does ELK have modules to monitor with metricbeat and obtain logs previously parsed with filebeat from IBM HTTP servers? Thanks in advanced! --- ## [Elasticsearch 7.16 failed install on Unbuntu 20.04 - cannot execute binary file](https://discuss.elastic.co/t/elasticsearch-7-16-failed-install-on-unbuntu-20-04-cannot-execute-binary-file/293777)
**Author:** [@Winston\_Ferguson](https://discuss.elastic.co/u/Winston_Ferguson)\ **Replies:** 3\ **Last updated:** [January 11, 2022, 1:54pm UTC](https://discuss.elastic.co/t/elasticsearch-7-16-failed-install-on-unbuntu-20-04-cannot-execute-binary-file/293777 "2022-01-11T13:54:49Z")
Hi, I'm unable to solve my issue installing Elasticsearch on my new Windows 11 machine running Ubuntu 20.04 (via Windows Subsystem for Linux). The log received is: Reading package lists... Done Building dependency tree… --- ## [Parsing log date into timestamp](https://discuss.elastic.co/t/parsing-log-date-into-timestamp/293966)
**Author:** [@phung025](https://discuss.elastic.co/u/phung025)\ **Replies:** 1\ **Last updated:** [January 11, 2022, 1:31pm UTC](https://discuss.elastic.co/t/parsing-log-date-into-timestamp/293966 "2022-01-11T13:31:07Z")
In the JSON-format logs sent from filebeat to logstash, I have a field named "time". In the logstash.conf, I mutate it to create a field in the kibana log called rawDate logstash.conf: mutate { add\_field =\> {"rawDa… --- ## [Question about data types and adding new data types](https://discuss.elastic.co/t/question-about-data-types-and-adding-new-data-types/293928)
**Author:** [@Miguel\_Lopez1](https://discuss.elastic.co/u/Miguel_Lopez1)\ **Replies:** 3\ **Last updated:** [January 11, 2022, 12:08pm UTC](https://discuss.elastic.co/t/question-about-data-types-and-adding-new-data-types/293928 "2022-01-11T12:08:31Z")
Hi, As part of a masters degree assignment I need to address some questions about the Elasticsearch to the developers. The question is: I saw that Elasticsearch is capable of working with a variety of data types (for i… --- ## [How to parse suricata rules with logstash](https://discuss.elastic.co/t/how-to-parse-suricata-rules-with-logstash/292548)
**Author:** [@karpaz](https://discuss.elastic.co/u/karpaz)\ **Replies:** 7\ **Last updated:** [January 11, 2022, 11:58am UTC](https://discuss.elastic.co/t/how-to-parse-suricata-rules-with-logstash/292548 "2022-01-11T11:58:54Z")
Hi, guys, I've been solving a "parsing" problem for a while now. First I tried it with GROK, then with KV filter. I have not been successful with either method. So I am turning to you for help to see if anyone experien… --- ## [Add link on row table to external application](https://discuss.elastic.co/t/add-link-on-row-table-to-external-application/293996)
**Author:** [@karatsuba](https://discuss.elastic.co/u/karatsuba)\ **Replies:** 2\ **Last updated:** [January 11, 2022, 11:17am UTC](https://discuss.elastic.co/t/add-link-on-row-table-to-external-application/293996 "2022-01-11T11:17:35Z")
Hello, I am trying to display my string field in a row table as a link to external application, i am using URL format for string in index patterns, but when I click on the link "myLink" it's opening it in new window and… --- ## [Unable to access kibana after upgrade 7.13.2 -\> 7.16.2](https://discuss.elastic.co/t/unable-to-access-kibana-after-upgrade-7-13-2-7-16-2/294011)
**Author:** [@mihalikv](https://discuss.elastic.co/u/mihalikv)\ **Replies:** 1\ **Last updated:** [January 11, 2022, 10:56am UTC](https://discuss.elastic.co/t/unable-to-access-kibana-after-upgrade-7-13-2-7-16-2/294011 "2022-01-11T10:56:51Z")
Hello, I have upgraded kibana from 7.13.2 to 7.16.2. No plugins installed. Environment: Error: There was an error in logs: {"type":"log","@timestamp":"2022-01-11T09:22:44+00:00","tags":\["error","plugins","ev… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1097) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1099)