# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1117 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1118 --- ## [How to process csv data from multiple folders using file beat and create separate index and move it to elastic search](https://discuss.elastic.co/t/how-to-process-csv-data-from-multiple-folders-using-file-beat-and-create-separate-index-and-move-it-to-elastic-search/292641)
**Author:** [@data123](https://discuss.elastic.co/u/data123)\ **Replies:** 1\ **Last updated:** [December 22, 2021, 6:52am UTC](https://discuss.elastic.co/t/how-to-process-csv-data-from-multiple-folders-using-file-beat-and-create-separate-index-and-move-it-to-elastic-search/292641 "2021-12-22T06:52:49Z")
Hi Team, Our requirement is like this... we have log files stored in different folders under master folder as csv format. we want to send this to Elasticsearch using file beats as a part of automation. we cant find s… --- ## [Urgent - Incomplete fix for Apache Log4j vulnerability v2.15.0](https://discuss.elastic.co/t/urgent-incomplete-fix-for-apache-log4j-vulnerability-v2-15-0/291893)
**Author:** [@ppafford](https://discuss.elastic.co/u/ppafford)\ **Replies:** 2\ **Last updated:** [December 22, 2021, 4:58am UTC](https://discuss.elastic.co/t/urgent-incomplete-fix-for-apache-log4j-vulnerability-v2-15-0/291893 "2021-12-22T04:58:48Z")
Looks like there is another issue and another fix And the release of Logstash 7.16.1 Release Notes | Logstash Reference \[7.16\] | Elastic has the incomplete fix. When can this be addressed? --- ## [How to make a plugin for elasticsearch 5.6.16?](https://discuss.elastic.co/t/how-to-make-a-plugin-for-elasticsearch-5-6-16/292561)
**Author:** [@dishant](https://discuss.elastic.co/u/dishant)\ **Replies:** 2\ **Last updated:** [December 22, 2021, 4:44am UTC](https://discuss.elastic.co/t/how-to-make-a-plugin-for-elasticsearch-5-6-16/292561 "2021-12-22T04:44:15Z")
I tried a lot finding about it on the internet but not getting anything that works. I have been able to build a plugin for Elasticsearch 7.11.1 and used gradle 6.8.2 for that. But not able to make the same for Elasticsea… --- ## [Displaying the application log data in Kibana - Log file content field is missing in Elasticsearch](https://discuss.elastic.co/t/displaying-the-application-log-data-in-kibana-log-file-content-field-is-missing-in-elasticsearch/292448)
**Author:** [@online](https://discuss.elastic.co/u/online)\ **Replies:** 1\ **Last updated:** [December 22, 2021, 2:58am UTC](https://discuss.elastic.co/t/displaying-the-application-log-data-in-kibana-log-file-content-field-is-missing-in-elasticsearch/292448 "2021-12-22T02:58:50Z")
Hello Friends, I am trying to setup an Elasticsearch index to display log contents from an application using Kibana. I setup the Filebeat on my application server and it created an index with 25 fields in Elasticsearch.… --- ## [Metricbeat sql module with dynamic database values](https://discuss.elastic.co/t/metricbeat-sql-module-with-dynamic-database-values/292623)
**Author:** [@nsharath](https://discuss.elastic.co/u/nsharath)\ **Replies:** 0\ **Last updated:** [December 22, 2021, 12:29am UTC](https://discuss.elastic.co/t/metricbeat-sql-module-with-dynamic-database-values/292623 "2021-12-22T00:29:32Z")
I am using metricbeat 7.15 version with sql module enabled. I have a huge list of databases and currently my sql module config size is very big. I would like to know how to send the database name (e.g. database1, databa… --- ## [Filter a field](https://discuss.elastic.co/t/filter-a-field/292549)
**Author:** [@scar](https://discuss.elastic.co/u/scar)\ **Replies:** 1\ **Last updated:** [December 21, 2021, 11:59pm UTC](https://discuss.elastic.co/t/filter-a-field/292549 "2021-12-21T23:59:17Z")
I want to filter a field, for example filter an array field by only returning the values I want. i try it using the source filter but don't do what i expected --- ## [ElasticSearch: search\_after with refresh](https://discuss.elastic.co/t/elasticsearch-search-after-with-refresh/292608)
**Author:** [@sag-tobias-frey](https://discuss.elastic.co/u/sag-tobias-frey)\ **Replies:** 1\ **Last updated:** [December 21, 2021, 9:18pm UTC](https://discuss.elastic.co/t/elasticsearch-search-after-with-refresh/292608 "2021-12-21T21:18:17Z")
Hello, I have searched for quite some time but did not find an answer yet. I'm currently looking into doing some pagination over my data. I have stumbled across the search\_after functionality. The queries work quite nic… --- ## [Multi-level graphs with Kibana](https://discuss.elastic.co/t/multi-level-graphs-with-kibana/292599)
**Author:** [@muneebishfaq](https://discuss.elastic.co/u/muneebishfaq)\ **Replies:** 1\ **Last updated:** [December 21, 2021, 9:14pm UTC](https://discuss.elastic.co/t/multi-level-graphs-with-kibana/292599 "2021-12-21T21:14:39Z")
Hello, I was just wondering if Kibana has the ability to create graphs with multiple levels? I want to visualize the data using graphs in a way where I would have as nodes (vertices) the different branches of a company. … --- ## [Unable to migrate from 7.6.1](https://discuss.elastic.co/t/unable-to-migrate-from-7-6-1/292605)
**Author:** [@rhawleyswiss](https://discuss.elastic.co/u/rhawleyswiss)\ **Replies:** 1\ **Last updated:** [December 21, 2021, 9:13pm UTC](https://discuss.elastic.co/t/unable-to-migrate-from-7-6-1/292605 "2021-12-21T21:13:31Z")
How can I find a dashboard by uuid? is there a way? I'm trying to upgrade our stack but getting: \< /\> Trying to open the dashboard via URL displays an empty frame with no controls, all just blank --- ## [Elasticsearch get all unique Ids](https://discuss.elastic.co/t/elasticsearch-get-all-unique-ids/292589)
**Author:** [@iamtheschmitzer](https://discuss.elastic.co/u/iamtheschmitzer)\ **Replies:** 5\ **Last updated:** [December 21, 2021, 9:08pm UTC](https://discuss.elastic.co/t/elasticsearch-get-all-unique-ids/292589 "2021-12-21T21:08:12Z")
Thanks to all who read this for your help. Background: I have a job that when executing inserts a document. The job can fail and run again, inserting a second document. Both have the same linkId- so I know there is o… --- ## [Wildcard query returns 0 result](https://discuss.elastic.co/t/wildcard-query-returns-0-result/290549)
**Author:** [@Wonder\_Garance](https://discuss.elastic.co/u/Wonder_Garance)\ **Replies:** 4\ **Last updated:** [December 21, 2021, 8:07pm UTC](https://discuss.elastic.co/t/wildcard-query-returns-0-result/290549 "2021-12-21T20:07:55Z")
I have a problem with the char '?' in the wildcard query, the query below returns 0 result { "query": { "span\_near": { "clauses": \[ { "span\_multi": { "match": { "w… --- ## [Reindex: how Elastic handle index names](https://discuss.elastic.co/t/reindex-how-elastic-handle-index-names/291336)
**Author:** [@mauog](https://discuss.elastic.co/u/mauog)\ **Replies:** 1\ **Last updated:** [December 21, 2021, 6:59pm UTC](https://discuss.elastic.co/t/reindex-how-elastic-handle-index-names/291336 "2021-12-21T18:59:15Z")
Hello, I read sometime that some operation are impossible on current index and so the strategy is to create a new one an the reindex there all the data stored. I'm a newbie here and this could be a stupid question but … --- ## [Logstash Ruby plugin code block not raising Exception](https://discuss.elastic.co/t/logstash-ruby-plugin-code-block-not-raising-exception/291376)
**Author:** [@Colin\_K](https://discuss.elastic.co/u/Colin_K)\ **Replies:** 4\ **Last updated:** [December 21, 2021, 6:57pm UTC](https://discuss.elastic.co/t/logstash-ruby-plugin-code-block-not-raising-exception/291376 "2021-12-21T18:57:35Z")
I have a ruby block. The "happy" path works where I see the expected map output. When I provide an invalid scheme for an Array with a log line and an element that does not contain an object with field, I do not throw the… --- ## [Certificate problems adding node to cluster](https://discuss.elastic.co/t/certificate-problems-adding-node-to-cluster/292511)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 2\ **Last updated:** [December 21, 2021, 6:38pm UTC](https://discuss.elastic.co/t/certificate-problems-adding-node-to-cluster/292511 "2021-12-21T18:38:57Z")
I am preparing to turn on "security" on my production cluster by setting up a test cluster first. I have a single node running fine with security enabled but when I try and bring up a second node with the same configura… --- ## [Sorting on ES does not work on # number field](https://discuss.elastic.co/t/sorting-on-es-does-not-work-on-number-field/292591)
**Author:** [@mclovin](https://discuss.elastic.co/u/mclovin)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 6:14pm UTC](https://discuss.elastic.co/t/sorting-on-es-does-not-work-on-number-field/292591 "2021-12-21T18:14:54Z")
Hi all, I read the multi sort feature document, I have no sorting on either of my two columns. ie. Time and VST. When I try sorting on the vst column it does not do anything. --- ## [Logstash stopped processing because of an error: (SystemExit) exit org.jruby.exceptions.SystemExit: (SystemExit) exit](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error-systemexit-exit-org-jruby-exceptions-systemexit-systemexit-exit/292432)
**Author:** [@tobias.greis](https://discuss.elastic.co/u/tobias.greis)\ **Replies:** 4\ **Last updated:** [December 21, 2021, 5:20pm UTC](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error-systemexit-exit-org-jruby-exceptions-systemexit-systemexit-exit/292432 "2021-12-21T17:20:08Z")
Hi, I have a problem with my Logstash Component. When starting I get the following failure and can't find helpful information online. I use a SLES 15 with Logstash 7.16.1 and OpenJDK11. \[2021-12-20T07:56:23,219\]\[INFO \]… --- ## [Does cluster.routing.allocation.cluster\_concurrent\_rebalance limit the number of reallocation due to a high watermark?](https://discuss.elastic.co/t/does-cluster-routing-allocation-cluster-concurrent-rebalance-limit-the-number-of-reallocation-due-to-a-high-watermark/292555)
**Author:** [@alsyia](https://discuss.elastic.co/u/alsyia)\ **Replies:** 1\ **Last updated:** [December 21, 2021, 5:15pm UTC](https://discuss.elastic.co/t/does-cluster-routing-allocation-cluster-concurrent-rebalance-limit-the-number-of-reallocation-due-to-a-high-watermark/292555 "2021-12-21T17:15:22Z")
Hello, We had an event this morning were a node reached its high watermark. Elasticsearch decided to move 21 of its shards. We didn't modify cluster.routing.allocation.cluster\_concurrent\_rebalance, so it should limit t… --- ## [Logstash update doc fields if exits](https://discuss.elastic.co/t/logstash-update-doc-fields-if-exits/292206)
**Author:** [@patilanna](https://discuss.elastic.co/u/patilanna)\ **Replies:** 3\ **Last updated:** [December 21, 2021, 5:13pm UTC](https://discuss.elastic.co/t/logstash-update-doc-fields-if-exits/292206 "2021-12-21T17:13:26Z")
Blockquote logstash to update doc fields if exits or insert new to ELK stack, sorry if any thing not as per forum I am sending kafka stream of events logs, there was two types of logs, open-event log and close-event l… --- ## [Logstash to logstash not indexing logs when is enabled](https://discuss.elastic.co/t/logstash-to-logstash-not-indexing-logs-when-is-enabled/292546)
**Author:** [@jhaos](https://discuss.elastic.co/u/jhaos)\ **Replies:** 1\ **Last updated:** [December 21, 2021, 5:12pm UTC](https://discuss.elastic.co/t/logstash-to-logstash-not-indexing-logs-when-is-enabled/292546 "2021-12-21T17:12:27Z")
Hi, we are facing an issue using Logstash to Logstash configuration Logstash-to-Logstash Communication | Logstash Reference \[7.16\] | Elastic. Our architecture is the following using two different inputs in filebeat: Fil… --- ## [Journalbeat can't create an alias and fails to work](https://discuss.elastic.co/t/journalbeat-cant-create-an-alias-and-fails-to-work/201875)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 6\ **Last updated:** [December 21, 2021, 5:09pm UTC](https://discuss.elastic.co/t/journalbeat-cant-create-an-alias-and-fails-to-work/201875 "2021-12-21T17:09:29Z")
Journalbeat is having issues getting started. It seems like it fails to create an alias? journalctl -l --follow -u journalbeat eventually spits this out: Oct 01 15:33:43 hostname journalbeat\[30589\]: 2019-10-01T15:33:43… --- ## [Filebeat Azure plugin parsing error on azure.signinlogs.properties.authentication\_requirement\_policies field](https://discuss.elastic.co/t/filebeat-azure-plugin-parsing-error-on-azure-signinlogs-properties-authentication-requirement-policies-field/292586)
**Author:** [@vgarric](https://discuss.elastic.co/u/vgarric)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 5:08pm UTC](https://discuss.elastic.co/t/filebeat-azure-plugin-parsing-error-on-azure-signinlogs-properties-authentication-requirement-policies-field/292586 "2021-12-21T17:08:20Z")
hi, we get drops with some logs from Azure signinlogs linked to the azure.signinlogs.properties.authentication\_requirement\_policies field parsing. Here is the logs from filebeat with azure module : 2021-12-21T15:24:27… --- ## [Significant text aggregation on multiple fields](https://discuss.elastic.co/t/significant-text-aggregation-on-multiple-fields/292585)
**Author:** [@Manisekhar\_techo](https://discuss.elastic.co/u/Manisekhar_techo)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 5:02pm UTC](https://discuss.elastic.co/t/significant-text-aggregation-on-multiple-fields/292585 "2021-12-21T17:02:19Z")
Hi I'm using the multi\_match query for search with phrase keyword, in the aggregations, I'm using significant\_text aggregation, But I can only specify one field is there any way to perform that aggregation on multiple… --- ## [Elastic Stack Cloud Subscription](https://discuss.elastic.co/t/elastic-stack-cloud-subscription/292449)
**Author:** [@Thamini\_NellaiKumar](https://discuss.elastic.co/u/Thamini_NellaiKumar)\ **Replies:** 3\ **Last updated:** [December 21, 2021, 4:38pm UTC](https://discuss.elastic.co/t/elastic-stack-cloud-subscription/292449 "2021-12-21T16:38:24Z")
Hi, I would like to know the difference between getting elastic cloud subscription separately and hosting elastic from the existing Azure subscription --- ## [Version-specific beats index template for every update required?](https://discuss.elastic.co/t/version-specific-beats-index-template-for-every-update-required/292582)
**Author:** [@hafneren](https://discuss.elastic.co/u/hafneren)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 4:14pm UTC](https://discuss.elastic.co/t/version-specific-beats-index-template-for-every-update-required/292582 "2021-12-21T16:14:26Z")
Hi, I'm trying to improve the security of my Elastic Stack through a least privilege architecture consisting of winlogbeat, filebeat, auditbeat -\> logstash -\> Elasticsearch & Kibana. My goal is that the different beats … --- ## [Roadmap / release schedule (8.1.0 when?)](https://discuss.elastic.co/t/roadmap-release-schedule-8-1-0-when/292557)
**Author:** [@Joel\_Hansell](https://discuss.elastic.co/u/Joel_Hansell)\ **Replies:** 2\ **Last updated:** [December 21, 2021, 3:32pm UTC](https://discuss.elastic.co/t/roadmap-release-schedule-8-1-0-when/292557 "2021-12-21T15:32:11Z")
Hi, I tried searching for this on the elastic.co website, here on the Discuss server, and also using Google search, but found nothing current. Is there a planned release date for ELK 8, and specifically 8.1? I am inte… --- ## [Monitor Filebeat's Uptime](https://discuss.elastic.co/t/monitor-filebeats-uptime/292480)
**Author:** [@6igwig](https://discuss.elastic.co/u/6igwig)\ **Replies:** 1\ **Last updated:** [December 21, 2021, 3:26pm UTC](https://discuss.elastic.co/t/monitor-filebeats-uptime/292480 "2021-12-21T15:26:38Z")
Can Heartbeat be configured to monitor a filebeat instance and alert when that beat goes down? Is there another way to determine when a beat is not running when it should be? During version upgrades sometime a beat wil… --- ## [Timestamp entries in cet without time zone are displayed in Kibana as cet +1](https://discuss.elastic.co/t/timestamp-entries-in-cet-without-time-zone-are-displayed-in-kibana-as-cet-1/292571)
**Author:** [@jstricker](https://discuss.elastic.co/u/jstricker)\ **Replies:** 1\ **Last updated:** [December 21, 2021, 2:54pm UTC](https://discuss.elastic.co/t/timestamp-entries-in-cet-without-time-zone-are-displayed-in-kibana-as-cet-1/292571 "2021-12-21T14:54:24Z")
I have several log files with different timestamp formats. A log file like this: In the other file like this: The timestampe entrys with and with out timezone specification. With the following component template … --- ## [ILM shrink and warm node](https://discuss.elastic.co/t/ilm-shrink-and-warm-node/292357)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 8\ **Last updated:** [December 21, 2021, 2:42pm UTC](https://discuss.elastic.co/t/ilm-shrink-and-warm-node/292357 "2021-12-21T14:42:16Z")
I have setup ILM policy with shrink but not working. what am I missing PUT \_ilm/policy/metricbeat { "policy": { "phases": { "hot": { "min\_age": "0ms", "actions": { "rollover": { … --- ## [Field exist query to check nested type field exists for a doc](https://discuss.elastic.co/t/field-exist-query-to-check-nested-type-field-exists-for-a-doc/292152)
**Author:** [@sudheesh](https://discuss.elastic.co/u/sudheesh)\ **Replies:** 0\ **Last updated:** [December 16, 2021, 12:40pm UTC](https://discuss.elastic.co/t/field-exist-query-to-check-nested-type-field-exists-for-a-doc/292152 "2021-12-16T12:40:23Z")
This is the template for my index PUT employee\_index { "mappings":{ "properties": { "role": { "type": "text" }, "Employee": { "type": "nested", "properties": { … --- ## [Filebeat harvesting](https://discuss.elastic.co/t/filebeat-harvesting/292376)
**Author:** [@Milad\_Akhlaghi](https://discuss.elastic.co/u/Milad_Akhlaghi)\ **Replies:** 2\ **Last updated:** [December 21, 2021, 12:44pm UTC](https://discuss.elastic.co/t/filebeat-harvesting/292376 "2021-12-21T12:44:35Z")
Hi everybody , i need some help on filebeat harvesting a log file . i have a problem and i need to know which logfile that already exist is harvesting by filebeat and how can i know that harvest is finished and how i ca… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1116) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1118)