# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1113 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1114 --- ## [Query multiple indices with different fields to sort](https://discuss.elastic.co/t/query-multiple-indices-with-different-fields-to-sort/292969)
**Author:** [@jlp1](https://discuss.elastic.co/u/jlp1)\ **Replies:** 0\ **Last updated:** [December 27, 2021, 12:07pm UTC](https://discuss.elastic.co/t/query-multiple-indices-with-different-fields-to-sort/292969 "2021-12-27T12:07:26Z")
Hello I am using Elasticsearch 7.10.0 and trying to solve following problem: I have several indices and need to get documents from all of them matching different queries (5-15 queries against each index). However, depen… --- ## [Url kibana still charging](https://discuss.elastic.co/t/url-kibana-still-charging/292966)
**Author:** [@Aouatif\_Bouka](https://discuss.elastic.co/u/Aouatif_Bouka)\ **Replies:** 0\ **Last updated:** [December 27, 2021, 10:54am UTC](https://discuss.elastic.co/t/url-kibana-still-charging/292966 "2021-12-27T10:54:39Z")
hi, i have setup Elasticsearch, kibana and logstash version 7.16.2 and the UrL kibana works fine the firts day. second day, when i need to access to my kibana URL it still serach without any result. in the console of … --- ## [UiPath older robot logs/indices not appearing after upgrade](https://discuss.elastic.co/t/uipath-older-robot-logs-indices-not-appearing-after-upgrade/292968)
**Author:** [@Aakash\_Sinha](https://discuss.elastic.co/u/Aakash_Sinha)\ **Replies:** 0\ **Last updated:** [December 27, 2021, 11:46am UTC](https://discuss.elastic.co/t/uipath-older-robot-logs-indices-not-appearing-after-upgrade/292968 "2021-12-27T11:46:48Z")
Due to the unavoidable vulnerability on log4j, we upgraded our Elasticsearch to 7.16.x. After the upgrade, the old uipath robot logs were not visible. Only the current executions of the robot logs were visible. Can someo… --- ## [Elastic Agent/Fleet Server cannot connect to elasticsearch](https://discuss.elastic.co/t/elastic-agent-fleet-server-cannot-connect-to-elasticsearch/292418)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 6\ **Last updated:** [December 27, 2021, 11:36am UTC](https://discuss.elastic.co/t/elastic-agent-fleet-server-cannot-connect-to-elasticsearch/292418 "2021-12-27T11:36:05Z")
Hello, I recently deployed Fleet Server with this command. sudo elastic-agent enroll --url=https://fqdn:8220 \\ --fleet-server-es=https://other-fqdn:9200 \\ --fleet-server-service-token=token \\ --fleet-server-polic… --- ## [Discover and transform don't show the same format on the same date field](https://discuss.elastic.co/t/discover-and-transform-dont-show-the-same-format-on-the-same-date-field/290718)
**Author:** [@Liangliang\_Qiu](https://discuss.elastic.co/u/Liangliang_Qiu)\ **Replies:** 3\ **Last updated:** [December 27, 2021, 10:52am UTC](https://discuss.elastic.co/t/discover-and-transform-dont-show-the-same-format-on-the-same-date-field/290718 "2021-12-27T10:52:46Z")
When i discover the index pattern=shopee\_smart\_sorting\_my\_db\_\_address\_match\_result\_tab\* in Discover, it show the right format of "ctime" field While when i use transform, it looks totally wrong, What happened? a… --- ## [Rollbar and SendGrid integration](https://discuss.elastic.co/t/rollbar-and-sendgrid-integration/292666)
**Author:** [@Gomathi\_Natarajan](https://discuss.elastic.co/u/Gomathi_Natarajan)\ **Replies:** 1\ **Last updated:** [December 27, 2021, 9:05am UTC](https://discuss.elastic.co/t/rollbar-and-sendgrid-integration/292666 "2021-12-27T09:05:39Z")
Hi Team, We are trying to integrate our third party services we are using in a ruby on rails application at one place for monitoring in Elastic. We are using the services Rollbar(Error tracking tool https://rollbar.com/)… --- ## [Elasticsearch using eland for python fails to write when having nan in the dataset](https://discuss.elastic.co/t/elasticsearch-using-eland-for-python-fails-to-write-when-having-nan-in-the-dataset/292958)
**Author:** [@Jaykant\_Prajapati](https://discuss.elastic.co/u/Jaykant_Prajapati)\ **Replies:** 0\ **Last updated:** [December 27, 2021, 8:33am UTC](https://discuss.elastic.co/t/elasticsearch-using-eland-for-python-fails-to-write-when-having-nan-in-the-dataset/292958 "2021-12-27T08:33:41Z")
0 I am creating pandas dataset with such that 'num\_specimen\_seen' is having one value null. I am defining nan using the math.nan. The dataset df is saved in haze.csv file. df = pd.DataFrame({'num\_legs': \[2, 4, 8, 0\], … --- ## [Is there is method to collect multiple types of elasticsearch logs when elasticsearchs and filebeats are deployed with ECK](https://discuss.elastic.co/t/is-there-is-method-to-collect-multiple-types-of-elasticsearch-logs-when-elasticsearchs-and-filebeats-are-deployed-with-eck/292656)
**Author:** [@bruce2](https://discuss.elastic.co/u/bruce2)\ **Replies:** 3\ **Last updated:** [December 27, 2021, 8:13am UTC](https://discuss.elastic.co/t/is-there-is-method-to-collect-multiple-types-of-elasticsearch-logs-when-elasticsearchs-and-filebeats-are-deployed-with-eck/292656 "2021-12-27T08:13:56Z")
I am using ECK1.6 to deploy Elasticsearch cluster 7.15.2 on k8s，and then using ECK to deploy filebeat to collect Elasticsearch server log, gc log, slowlog, deprecation log. There is an error as same as this issue File… --- ## [Logstash memcached plugin does not run in set mode](https://discuss.elastic.co/t/logstash-memcached-plugin-does-not-run-in-set-mode/292894)
**Author:** [@username11](https://discuss.elastic.co/u/username11)\ **Replies:** 2\ **Last updated:** [December 27, 2021, 7:42am UTC](https://discuss.elastic.co/t/logstash-memcached-plugin-does-not-run-in-set-mode/292894 "2021-12-27T07:42:18Z")
I am using Logstash 6.8.22 and logstash-filter-memcached-0.1.2. I cannot, for the life of me, get the memcached plugin to set any values. I checked it through the command line, and memcached itself works fine and can set… --- ## [Failed to establish a new connection: \[Errno 111\] Connection refused')))](https://discuss.elastic.co/t/failed-to-establish-a-new-connection-errno-111-connection-refused/292919)
**Author:** [@DoDuyen162000](https://discuss.elastic.co/u/DoDuyen162000)\ **Replies:** 2\ **Last updated:** [December 27, 2021, 7:27am UTC](https://discuss.elastic.co/t/failed-to-establish-a-new-connection-errno-111-connection-refused/292919 "2021-12-27T07:27:15Z")
Hi. I am having problems creating elastalert in Elasticsearch. When I use the elastalert-create-index command it gives me the error: help me please!!! --- ## [Logstash not writing data to Elasticsearch data streams](https://discuss.elastic.co/t/logstash-not-writing-data-to-elasticsearch-data-streams/292541)
**Author:** [@Rahul\_Dey](https://discuss.elastic.co/u/Rahul_Dey)\ **Replies:** 3\ **Last updated:** [December 27, 2021, 7:09am UTC](https://discuss.elastic.co/t/logstash-not-writing-data-to-elasticsearch-data-streams/292541 "2021-12-27T07:09:54Z")
We are using logstash version 7.4.2 currently. For mitigating threats of log4j vulnerability, I have upgraded the Logstash version to 7.16.1 as advised by the Elastic team. I have also changed the Elasticsearch output p… --- ## [Exporting CSV from save search in dashboard shows blank values](https://discuss.elastic.co/t/exporting-csv-from-save-search-in-dashboard-shows-blank-values/292774)
**Author:** [@Amy\_Peng](https://discuss.elastic.co/u/Amy_Peng)\ **Replies:** 2\ **Last updated:** [December 27, 2021, 6:47am UTC](https://discuss.elastic.co/t/exporting-csv-from-save-search-in-dashboard-shows-blank-values/292774 "2021-12-27T06:47:17Z")
Hello Team, I was using kibana 7.13.1 and wanted to export CSV from saved search in dashboard. But the exported CSV file only showed timestamp and column fields name but with blank values. I also tried Discover -- ope… --- ## [Winlogbeat does not start](https://discuss.elastic.co/t/winlogbeat-does-not-start/292952)
**Author:** [@George\_Thomas](https://discuss.elastic.co/u/George_Thomas)\ **Replies:** 1\ **Last updated:** [December 27, 2021, 5:57am UTC](https://discuss.elastic.co/t/winlogbeat-does-not-start/292952 "2021-12-27T05:57:22Z")
Hey All, I can't seem to start winlogbeat from c:\\programdata\\winlogbeat. It does not work on programfiles either so following a post here i tried it in programdata and still the same. any help would be appreciated. --- ## [Logstash 7.16.2(fixed Log4j2 Vulnerability) connected to ElasticSearch 7.6.2 failed](https://discuss.elastic.co/t/logstash-7-16-2-fixed-log4j2-vulnerability-connected-to-elasticsearch-7-6-2-failed/292945)
**Author:** [@swxEmily](https://discuss.elastic.co/u/swxEmily)\ **Replies:** 3\ **Last updated:** [December 27, 2021, 4:24am UTC](https://discuss.elastic.co/t/logstash-7-16-2-fixed-log4j2-vulnerability-connected-to-elasticsearch-7-6-2-failed/292945 "2021-12-27T04:24:16Z")
Third party Elasticsearch: 7.6.2 Logstash: updated from 7.10.1 to 7.16.2(fixed Log4j2 Vulnerability) logstash.conf: output { Elasticsearch{ hosts =\> \["https://10.33.27.xxx:9200","https://10.33.27.xxy:9200","https://… --- ## [Curly ’ or straight ' quote inside text affect the search result](https://discuss.elastic.co/t/curly-or-straight-quote-inside-text-affect-the-search-result/292926)
**Author:** [@eliezra236](https://discuss.elastic.co/u/eliezra236)\ **Replies:** 1\ **Last updated:** [December 26, 2021, 3:40pm UTC](https://discuss.elastic.co/t/curly-or-straight-quote-inside-text-affect-the-search-result/292926 "2021-12-26T15:40:57Z")
Hi, I have records that use either ’ or ' or \` And they can't find eachother. For example if I have: name: A Bastard's Tale And I will try to search for "A Bastard’s Tale" it wouldn't find it. How can I make it s… --- ## [How to find text contains special chars in a in a field?](https://discuss.elastic.co/t/how-to-find-text-contains-special-chars-in-a-in-a-field/292932)
**Author:** [@ShayWeizman](https://discuss.elastic.co/u/ShayWeizman)\ **Replies:** 5\ **Last updated:** [December 26, 2021, 2:06pm UTC](https://discuss.elastic.co/t/how-to-find-text-contains-special-chars-in-a-in-a-field/292932 "2021-12-26T14:06:28Z")
Hi All, I'm using 7.16.1 I have a log field that contains a lot of text, I want to find this log by looking part of his long text... For example, this is the field content: strong texttestcaseFailedReason" : """Test … --- ## [Synchronized time scales for Vega chart and others on Dashboard](https://discuss.elastic.co/t/synchronized-time-scales-for-vega-chart-and-others-on-dashboard/291313)
**Author:** [@Michael\_Ubry](https://discuss.elastic.co/u/Michael_Ubry)\ **Replies:** 1\ **Last updated:** [December 26, 2021, 1:05pm UTC](https://discuss.elastic.co/t/synchronized-time-scales-for-vega-chart-and-others-on-dashboard/291313 "2021-12-26T13:05:52Z")
Hi, I created Vega scatterplot chart using this code { $schema: "https://vega.github.io/schema/vega-lite/v2.json" // Use points for drawing to actually create a scatterplot mark: { type: point tooltip: { field: \_… --- ## [What is the maximum text size that can be indexed as a single term?](https://discuss.elastic.co/t/what-is-the-maximum-text-size-that-can-be-indexed-as-a-single-term/292697)
**Author:** [@ShayWeizman](https://discuss.elastic.co/u/ShayWeizman)\ **Replies:** 9\ **Last updated:** [December 26, 2021, 11:32am UTC](https://discuss.elastic.co/t/what-is-the-maximum-text-size-that-can-be-indexed-as-a-single-term/292697 "2021-12-26T11:32:54Z")
Hi, I'm using 7.16.1, When I save to elastic field with large amount of text it is not indexed as a single term. What is the maximum text size for indexing field as a single term? Thanks, Shay --- ## [Testing aggregates =\> LogStash::ConfigurationError: Aggregate plugin: more than one filter which defines timeout options. But only defining once](https://discuss.elastic.co/t/testing-aggregates-logstash-aggregate-plugin-more-than-one-filter-which-defines-timeout-options-but-only-defining-once/289644)
**Author:** [@Colin\_K](https://discuss.elastic.co/u/Colin_K)\ **Replies:** 6\ **Last updated:** [December 26, 2021, 4:33am UTC](https://discuss.elastic.co/t/testing-aggregates-logstash-aggregate-plugin-more-than-one-filter-which-defines-timeout-options-but-only-defining-once/289644 "2021-12-26T04:33:57Z")
I'm trying to test my logstash configurations that use the aggregate plugin. I have not had any issues running them locally against the binary as I write them. But now I want to test the behavior expectations of the aggr… --- ## [Why is there no apmserver module for filebeat?](https://discuss.elastic.co/t/why-is-there-no-apmserver-module-for-filebeat/292850)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 2\ **Last updated:** [December 26, 2021, 1:03am UTC](https://discuss.elastic.co/t/why-is-there-no-apmserver-module-for-filebeat/292850 "2021-12-26T01:03:07Z")
I see that filebeat contains a lot of elastic stack modules, why is there no apmserver? --- ## [Elasticsearch sub agregation](https://discuss.elastic.co/t/elasticsearch-sub-agregation/292920)
**Author:** [@Time\_cool](https://discuss.elastic.co/u/Time_cool)\ **Replies:** 0\ **Last updated:** [December 25, 2021, 6:18pm UTC](https://discuss.elastic.co/t/elasticsearch-sub-agregation/292920 "2021-12-25T18:18:12Z")
With the following query, I get the minimum value in each chunk of 15 minutes. I use the moving\_fn function. Now I need to get the maximum value in each chunk in 1 hour from the previous request. As I understand it canno… --- ## [Elasticsearch indexing with bulkprocessor, got broken pipeline](https://discuss.elastic.co/t/elasticsearch-indexing-with-bulkprocessor-got-broken-pipeline/292918)
**Author:** [@Derrick](https://discuss.elastic.co/u/Derrick)\ **Replies:** 0\ **Last updated:** [December 25, 2021, 5:41pm UTC](https://discuss.elastic.co/t/elasticsearch-indexing-with-bulkprocessor-got-broken-pipeline/292918 "2021-12-25T17:41:46Z")
anyone can tell me why I am getting this error when I index 140K data to Elasticsearch, our document is very huge, maybe 10M/doc, and each document has a few hundres fields. INFO \[12:32:59.351\] \[\]\[User:none\] \[pool-14… --- ## [Increment date](https://discuss.elastic.co/t/increment-date/292911)
**Author:** [@Time\_cool](https://discuss.elastic.co/u/Time_cool)\ **Replies:** 5\ **Last updated:** [December 25, 2021, 5:36pm UTC](https://discuss.elastic.co/t/increment-date/292911 "2021-12-25T17:36:26Z")
How can you make it so that you can move in the time period. For example, there is a segment 00:00 - 00:15 and find a minimum in this segment. The next step is to take the segment 00:01 - 00:16, find the minimum in it, a… --- ## [Elastic authentication error](https://discuss.elastic.co/t/elastic-authentication-error/292830)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 6\ **Last updated:** [December 25, 2021, 3:16pm UTC](https://discuss.elastic.co/t/elastic-authentication-error/292830 "2021-12-25T15:16:31Z")
We are trying to remove Readonly Rest from authentication equation and setup x-pack on ( ES 7.15 ) \[2021-12-23T11:08:27,433\]\[INFO \]\[o.e.x.s.a.AuthenticationService\] \[XXXX\] Authentication of \[elastic\] was terminated by r… --- ## [Kibana Unable to retrieve version information from Elasticsearch nodes](https://discuss.elastic.co/t/kibana-unable-to-retrieve-version-information-from-elasticsearch-nodes/292406)
**Author:** [@sahere37](https://discuss.elastic.co/u/sahere37)\ **Replies:** 7\ **Last updated:** [December 25, 2021, 10:10am UTC](https://discuss.elastic.co/t/kibana-unable-to-retrieve-version-information-from-elasticsearch-nodes/292406 "2021-12-25T10:10:11Z")
Hi all, I have a three member cluster version 7.16.1. my elasticsearch.yml config is as following: # ======================== Elasticsearch Configuration ========================= # # NOTE: Elasticsearch comes with re… --- ## [Shipping logs with filebeat and get logs with filebeat](https://discuss.elastic.co/t/shipping-logs-with-filebeat-and-get-logs-with-filebeat/292908)
**Author:** [@Milad\_Akhlaghi](https://discuss.elastic.co/u/Milad_Akhlaghi)\ **Replies:** 0\ **Last updated:** [December 25, 2021, 7:31am UTC](https://discuss.elastic.co/t/shipping-logs-with-filebeat-and-get-logs-with-filebeat/292908 "2021-12-25T07:31:34Z")
Hi everybody I'm working with elk and I need to take out logstash because my logs are too huge and logstash is making my process slow. so I decided to use filebeat instead. but I want to know is it possible to collect a… --- ## [Backup and restore a elasticsearch cluster](https://discuss.elastic.co/t/backup-and-restore-a-elasticsearch-cluster/292740)
**Author:** [@David\_Copperfield](https://discuss.elastic.co/u/David_Copperfield)\ **Replies:** 2\ **Last updated:** [December 25, 2021, 6:21am UTC](https://discuss.elastic.co/t/backup-and-restore-a-elasticsearch-cluster/292740 "2021-12-25T06:21:27Z")
I have a local Elasticsearch cluster consisting of 3 master nodes and 3 data nodes, all the 6 servers are VMs inside Google Cloud. I create a snapshot repository to google GCS bucket, and save snapshots there. The instr… --- ## [Logstash not indexing properly](https://discuss.elastic.co/t/logstash-not-indexing-properly/292853)
**Author:** [@eleong](https://discuss.elastic.co/u/eleong)\ **Replies:** 4\ **Last updated:** [December 25, 2021, 3:50am UTC](https://discuss.elastic.co/t/logstash-not-indexing-properly/292853 "2021-12-25T03:50:07Z")
Hi, I have a single-node Elastic stack running with the following architecture: Filebeat \> Logstash \> Elasticsearch Filebeat is doing the tagging and logstash will point the documents to be indexed on different indice… --- ## [Metricbeat single run](https://discuss.elastic.co/t/metricbeat-single-run/292721)
**Author:** [@tobias\_c](https://discuss.elastic.co/u/tobias_c)\ **Replies:** 5\ **Last updated:** [December 24, 2021, 6:29pm UTC](https://discuss.elastic.co/t/metricbeat-single-run/292721 "2021-12-24T18:29:03Z")
Hi all Is it possible to let run metricbeat once and then terminate? So the service (everlasting process) is not wanted. Thanks Tobias --- ## [Logstash join (aggregate?) two aggregated maps (postfix)](https://discuss.elastic.co/t/logstash-join-aggregate-two-aggregated-maps-postfix/292820)
**Author:** [@rowra](https://discuss.elastic.co/u/rowra)\ **Replies:** 3\ **Last updated:** [December 24, 2021, 5:08pm UTC](https://discuss.elastic.co/t/logstash-join-aggregate-two-aggregated-maps-postfix/292820 "2021-12-24T17:08:02Z")
Hi, I have two postfix servers. Call one 'local' and the other 'dmz'. I collect log from each and I aggregate them with taskid being the queue id postfix gives to each process. All works fine so far, I get one aggregate… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1112) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1114)