# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1127 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1128 --- ## [Problem with "\\n" character with tcp output plugin](https://discuss.elastic.co/t/problem-with-n-character-with-tcp-output-plugin/291822)
**Author:** [@lemahdois](https://discuss.elastic.co/u/lemahdois)\ **Replies:** 1\ **Last updated:** [December 14, 2021, 5:55pm UTC](https://discuss.elastic.co/t/problem-with-n-character-with-tcp-output-plugin/291822 "2021-12-14T17:55:59Z")
Hello, on my logstash pipeline I receive logs that contain "\\n" character as follows "message" : "aaaa\\nbbbbb" When sending this log using tcp output plugin, the destination receives the log on two lines aaaa bb… --- ## [How to update log4j jar in logstash installed in ubuntu VM](https://discuss.elastic.co/t/how-to-update-log4j-jar-in-logstash-installed-in-ubuntu-vm/291830)
**Author:** [@Rughma\_Sussan\_Renji](https://discuss.elastic.co/u/Rughma_Sussan_Renji)\ **Replies:** 2\ **Last updated:** [December 14, 2021, 5:47pm UTC](https://discuss.elastic.co/t/how-to-update-log4j-jar-in-logstash-installed-in-ubuntu-vm/291830 "2021-12-14T17:47:38Z")
how will I upgrade my logstash version in ubuntu to 2.15.0, currently it is 2.14.0, but due to the vulnerability issue I need to update it to 2.15.0. can anyone tell me the command to update it to the latest version --- ## [Create tab delimited string for output](https://discuss.elastic.co/t/create-tab-delimited-string-for-output/291840)
**Author:** [@trwillis](https://discuss.elastic.co/u/trwillis)\ **Replies:** 1\ **Last updated:** [December 14, 2021, 5:40pm UTC](https://discuss.elastic.co/t/create-tab-delimited-string-for-output/291840 "2021-12-14T17:40:52Z")
I need to construct a string with tab as delimiters for downstream consumption. I don't want to create a csv file because I am sending it over the network somewhere else. example input: field1: timestamp field2: host… --- ## [CSV Export - Kibana.log error - TypeError: Cannot read property 'convert' of undefined](https://discuss.elastic.co/t/csv-export-kibana-log-error-typeerror-cannot-read-property-convert-of-undefined/289480)
**Author:** [@hocho](https://discuss.elastic.co/u/hocho)\ **Replies:** 4\ **Last updated:** [December 14, 2021, 5:27pm UTC](https://discuss.elastic.co/t/csv-export-kibana-log-error-typeerror-cannot-read-property-convert-of-undefined/289480 "2021-12-14T17:27:19Z")
Hello, I recently updated Kibana 7.10.2 to 7.15.0 and with the update/upgrade of Kibana I started noticing the below error in kibana.log when an CSV export running and missing data in the exported CSV file. This error … --- ## [Can't delete the reports file on kibana server](https://discuss.elastic.co/t/cant-delete-the-reports-file-on-kibana-server/291385)
**Author:** [@Hello-Linux](https://discuss.elastic.co/u/Hello-Linux)\ **Replies:** 1\ **Last updated:** [December 14, 2021, 5:25pm UTC](https://discuss.elastic.co/t/cant-delete-the-reports-file-on-kibana-server/291385 "2021-12-14T17:25:43Z")
The report document generated by kibana is always kept on the server, how to delete it? and ook at can't delete the reports on kibana · Issue #119420 · elastic/kibana · GitHub --- ## [Missing Field Value For Nested Field - Function Score Query | v7.10.2](https://discuss.elastic.co/t/missing-field-value-for-nested-field-function-score-query-v7-10-2/291365)
**Author:** [@gursahibsahni](https://discuss.elastic.co/u/gursahibsahni)\ **Replies:** 3\ **Last updated:** [December 14, 2021, 4:51pm UTC](https://discuss.elastic.co/t/missing-field-value-for-nested-field-function-score-query-v7-10-2/291365 "2021-12-14T16:51:22Z")
I have been trying for a long time now but the nested field value is always saying missing field value while calculating the score. Mapping: { "main\_idx" : { "mappings" : { "properties" : { "\_class"… --- ## [Aggregation buckets custom order](https://discuss.elastic.co/t/aggregation-buckets-custom-order/291838)
**Author:** [@mmoreram](https://discuss.elastic.co/u/mmoreram)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 4:24pm UTC](https://discuss.elastic.co/t/aggregation-buckets-custom-order/291838 "2021-12-14T16:24:09Z")
I'd like to define by hand the order of a term aggregation. Of course, these values should appear only when they are part of the result. Is there a way this can be done? Custom agg1 (x) Custom agg2 (x) Other1 (x) Oth… --- ## [Elasticsearch 5.6.6 security vulnerability log4j](https://discuss.elastic.co/t/elasticsearch-5-6-6-security-vulnerability-log4j/291821)
**Author:** [@William1](https://discuss.elastic.co/u/William1)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 3:01pm UTC](https://discuss.elastic.co/t/elasticsearch-5-6-6-security-vulnerability-log4j/291821 "2021-12-14T15:01:08Z")
Hello all, I would like to ask if we can keep our current version 5.6.6 and setting the JVM option, in order to mitigate this vulnerability? This since upgrading is not possible. Thanks for your help! --- ## [Enable X\_pack Watcher not showingup Watcher in elasticsearch](https://discuss.elastic.co/t/enable-x-pack-watcher-not-showingup-watcher-in-elasticsearch/291516)
**Author:** [@DoDuyen162000](https://discuss.elastic.co/u/DoDuyen162000)\ **Replies:** 2\ **Last updated:** [December 14, 2021, 3:24pm UTC](https://discuss.elastic.co/t/enable-x-pack-watcher-not-showingup-watcher-in-elasticsearch/291516 "2021-12-14T15:24:25Z")
Hello!! Currently I am using Elasticsearch, kibana, logstash version 7.5.2. I want to enable X-pack Watcher on Elasticsearch. Can someone show me how to turn on Watcher? This is what I added in file /etc/Elasticsearc… --- ## [How to visualise nested time series data](https://discuss.elastic.co/t/how-to-visualise-nested-time-series-data/291445)
**Author:** [@wfhartford](https://discuss.elastic.co/u/wfhartford)\ **Replies:** 2\ **Last updated:** [December 14, 2021, 3:17pm UTC](https://discuss.elastic.co/t/how-to-visualise-nested-time-series-data/291445 "2021-12-14T15:17:33Z")
I have an interesting data structure and I'm looking for advice on how to store it in Elasticsearch and visualise in kibana. The data is statistics related to queries to a separate time series database. Each document sum… --- ## [Index rollover issues](https://discuss.elastic.co/t/index-rollover-issues/290669)
**Author:** [@sandeepmuthathi](https://discuss.elastic.co/u/sandeepmuthathi)\ **Replies:** 7\ **Last updated:** [December 14, 2021, 2:31pm UTC](https://discuss.elastic.co/t/index-rollover-issues/290669 "2021-12-14T14:31:19Z")
Suppose I'm creating the ES index using beat system or logstash with date time interpolation. how do I configure rolling over of index if size reaches at certain GBs in a single day? I did the following but I'm doing … --- ## [7.16.1: Interacting with a cell on a 'Discovery' pane in a dashboard results in a blank page being displayed](https://discuss.elastic.co/t/7-16-1-interacting-with-a-cell-on-a-discovery-pane-in-a-dashboard-results-in-a-blank-page-being-displayed/291780)
**Author:** [@stevedearl](https://discuss.elastic.co/u/stevedearl)\ **Replies:** 2\ **Last updated:** [December 14, 2021, 2:26pm UTC](https://discuss.elastic.co/t/7-16-1-interacting-with-a-cell-on-a-discovery-pane-in-a-dashboard-results-in-a-blank-page-being-displayed/291780 "2021-12-14T14:26:01Z")
Hi All, After upgrading to from 7.15.2 to 7.16.1 yesterday I've noticed that when I try to view the contents of any cell within a 'discovery' view on a dashboard it now results in a blank page being displayed, rather th… --- ## [Painless: How to simulate a hashmap as a variable for painless lab?](https://discuss.elastic.co/t/painless-how-to-simulate-a-hashmap-as-a-variable-for-painless-lab/291813)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 2:24pm UTC](https://discuss.elastic.co/t/painless-how-to-simulate-a-hashmap-as-a-variable-for-painless-lab/291813 "2021-12-14T14:24:29Z")
Hi, I've got below painless snippet // define sample data as hashmap (similar to Elastic output) def buy\_list = ' \[{doc\_count=13, category={buckets=\[{doc\_count=11, key=apple}, {doc\_count=12, key=mango}, {doc\_count=13, … --- ## [How convert Hashmap to JSON string in painless script?](https://discuss.elastic.co/t/how-convert-hashmap-to-json-string-in-painless-script/291812)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 2:20pm UTC](https://discuss.elastic.co/t/how-convert-hashmap-to-json-string-in-painless-script/291812 "2021-12-14T14:20:22Z")
Hi , this is very same question : How convert Hashmap to JSON string in painless script? Just checking is this possible in Logstash 7.x? Mostly wanted to convert a hashmap format to pure JSON for output purposes --- ## [Vega-lite histogram](https://discuss.elastic.co/t/vega-lite-histogram/291539)
**Author:** [@Shalhevet](https://discuss.elastic.co/u/Shalhevet)\ **Replies:** 3\ **Last updated:** [December 14, 2021, 2:12pm UTC](https://discuss.elastic.co/t/vega-lite-histogram/291539 "2021-12-14T14:12:08Z")
Hi, I would like to plot a histogram from a data set that includes many documents, and in each document there is an error value. the histogram should display the count of documents per each binned error values. I trie… --- ## [Logstash starts but doesn’t do anything](https://discuss.elastic.co/t/logstash-starts-but-doesn-t-do-anything/291637)
**Author:** [@sama.sowjanya](https://discuss.elastic.co/u/sama.sowjanya)\ **Replies:** 4\ **Last updated:** [December 14, 2021, 2:06pm UTC](https://discuss.elastic.co/t/logstash-starts-but-doesn-t-do-anything/291637 "2021-12-14T14:06:51Z")
Im trying to get some data in my logstash but my service doesn't seem to work properly. When I check my logstash status I get the following: ● logstash.service - logstash Loaded: loaded (/etc/systemd/system/logstash.se… --- ## [Log4j 2 delete action error](https://discuss.elastic.co/t/log4j-2-delete-action-error/291807)
**Author:** [@Jeffy](https://discuss.elastic.co/u/Jeffy)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 1:38pm UTC](https://discuss.elastic.co/t/log4j-2-delete-action-error/291807 "2021-12-14T13:38:32Z")
when I configured action delete policy for rolling over log, logger alerts error said: access denied(UserInformation related) and the rolling log shows file permission as rwx---r-- can further advise? --- ## [Elastic cloud on Azure, coworkers can't reach my deployment in cloud.elastic.co](https://discuss.elastic.co/t/elastic-cloud-on-azure-coworkers-cant-reach-my-deployment-in-cloud-elastic-co/291752)
**Author:** [@rebeccabl](https://discuss.elastic.co/u/rebeccabl)\ **Replies:** 4\ **Last updated:** [December 14, 2021, 1:31pm UTC](https://discuss.elastic.co/t/elastic-cloud-on-azure-coworkers-cant-reach-my-deployment-in-cloud-elastic-co/291752 "2021-12-14T13:31:57Z")
Hello there! We are having several issues, but the most problematic at this point is that only I am able to see the cluster in cloud.elastic.co where as my coworkers cannot. All of us can get into the Kibana, and we ha… --- ## [Does 7.16.1 work for anyone?](https://discuss.elastic.co/t/does-7-16-1-work-for-anyone/291767)
**Author:** [@richard.penarroya](https://discuss.elastic.co/u/richard.penarroya)\ **Replies:** 1\ **Last updated:** [December 14, 2021, 1:05pm UTC](https://discuss.elastic.co/t/does-7-16-1-work-for-anyone/291767 "2021-12-14T13:05:29Z")
Following the latest announcements regarding log4j vulnerabilities, we have updated our Elastic platform from 7.16.0 to 7.16.1. Just after this update, Elasticsearch failed to index anything.... be it data coming from … --- ## [Help with Grok pattern with space in field?](https://discuss.elastic.co/t/help-with-grok-pattern-with-space-in-field/291695)
**Author:** [@vladislav](https://discuss.elastic.co/u/vladislav)\ **Replies:** 5\ **Last updated:** [December 14, 2021, 1:03pm UTC](https://discuss.elastic.co/t/help-with-grok-pattern-with-space-in-field/291695 "2021-12-14T13:03:56Z")
I have the following logs looks like: query: s03.amazon.com IN A + (21.12.21.21) query: s2.tabtest.com IN AAAA +++ (213.12.21.21) query: t4.asaptest.com OUT TD OP- (21.124.21.21) I need output to look like this: hos… --- ## [Kibana Canvas Shape On Top](https://discuss.elastic.co/t/kibana-canvas-shape-on-top/291782)
**Author:** [@rusty\_cole](https://discuss.elastic.co/u/rusty_cole)\ **Replies:** 1\ **Last updated:** [December 14, 2021, 12:39pm UTC](https://discuss.elastic.co/t/kibana-canvas-shape-on-top/291782 "2021-12-14T12:39:30Z")
Hello everyone! I have a canvas dashboard with hyperlinks. I used a square shape with transparent background and white borders, and put the hyperlinks inside. The problem is, when the links are behind the square, you … --- ## [Elastic data nodes are randomly getting unresponsive](https://discuss.elastic.co/t/elastic-data-nodes-are-randomly-getting-unresponsive/291793)
**Author:** [@fschoell](https://discuss.elastic.co/u/fschoell)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 12:21pm UTC](https://discuss.elastic.co/t/elastic-data-nodes-are-randomly-getting-unresponsive/291793 "2021-12-14T12:21:21Z")
Hello, we run an Elasticsearch cluster with 12 data nodes of which groups of 4 share a larger dom server and are run in linux containers (dom servers are currently 48 core CPUs with 1.5 TB of memory and large SSD arrays)… --- ## [Logstash - comparison 2 fields](https://discuss.elastic.co/t/logstash-comparison-2-fields/291692)
**Author:** [@Christophe\_Journel](https://discuss.elastic.co/u/Christophe_Journel)\ **Replies:** 2\ **Last updated:** [December 14, 2021, 11:47am UTC](https://discuss.elastic.co/t/logstash-comparison-2-fields/291692 "2021-12-14T11:47:48Z")
Hello. I would like to compare 2 fields using logstash. To be more precise, i would like to know id the content of one field is included into the other one, using ( regex) i tried this configuration if ( \[test\]\[fi… --- ## [Message field not searchable in container logs from Kubernetes integration](https://discuss.elastic.co/t/message-field-not-searchable-in-container-logs-from-kubernetes-integration/290443)
**Author:** [@Nico\_Krijnen](https://discuss.elastic.co/u/Nico_Krijnen)\ **Replies:** 1\ **Last updated:** [December 14, 2021, 11:10am UTC](https://discuss.elastic.co/t/message-field-not-searchable-in-container-logs-from-kubernetes-integration/290443 "2021-12-14T11:10:11Z")
We are using Elatic Cloud to collect logs from a Kubernetes cluster using fleet-managed Elastic Agents. When enabling the Kubernetes integration in a policy, the Agents automatically pick up container logs. That is real… --- ## [Is that possible to use certificates signed by openssl instead of elasticsearch-certutil?](https://discuss.elastic.co/t/is-that-possible-to-use-certificates-signed-by-openssl-instead-of-elasticsearch-certutil/291724)
**Author:** [@v\_melnyk](https://discuss.elastic.co/u/v_melnyk)\ **Replies:** 1\ **Last updated:** [December 14, 2021, 10:51am UTC](https://discuss.elastic.co/t/is-that-possible-to-use-certificates-signed-by-openssl-instead-of-elasticsearch-certutil/291724 "2021-12-14T10:51:06Z")
Hello, I'd like to sign the nodes' certificates by openssl (instead of Elasticsearch-certutil). Is that ever possible? When I have a PKCS12 keystore made by Elasticsearch-certutil, everything works like a charm. Here's… --- ## [Input Duration Reverting back to Picosecs after changing to Secs](https://discuss.elastic.co/t/input-duration-reverting-back-to-picosecs-after-changing-to-secs/291081)
**Author:** [@Matt.Wash](https://discuss.elastic.co/u/Matt.Wash)\ **Replies:** 4\ **Last updated:** [December 14, 2021, 10:48am UTC](https://discuss.elastic.co/t/input-duration-reverting-back-to-picosecs-after-changing-to-secs/291081 "2021-12-14T10:48:26Z")
After I have updated pico to secs and saved. Upon editing the field it does not retain the update to seconds. I am running kibana v 7.14.0 Anyone have any ideas what I might be doing wrong? Thanks in advance --- ## [Secure log4j for elasticsearch](https://discuss.elastic.co/t/secure-log4j-for-elasticsearch/291684)
**Author:** [@beci](https://discuss.elastic.co/u/beci)\ **Replies:** 1\ **Last updated:** [December 14, 2021, 10:47am UTC](https://discuss.elastic.co/t/secure-log4j-for-elasticsearch/291684 "2021-12-14T10:47:12Z")
Hello, We have a server with logstash and Elasticsearch installed on it, I updated these two items to 7.16.1. When I search for files that say "\* log4j \*", there are always items mentioning version 2.11.1 of log4j : /… --- ## [Scripted Field on Date in Kibana?](https://discuss.elastic.co/t/scripted-field-on-date-in-kibana/291754)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 4\ **Last updated:** [December 14, 2021, 10:44am UTC](https://discuss.elastic.co/t/scripted-field-on-date-in-kibana/291754 "2021-12-14T10:44:40Z")
Is there any way to create scripted field on Empty Date field? I want to find pending number of SMS when message Submitted but not Delivered. I am getting Submitted date but delivered Date Empty. if (doc\['SubmittedOn'\].… --- ## [Auditbeat scan rate setting module: file\_integrity](https://discuss.elastic.co/t/auditbeat-scan-rate-setting-module-file-integrity/291756)
**Author:** [@cva](https://discuss.elastic.co/u/cva)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 7:29am UTC](https://discuss.elastic.co/t/auditbeat-scan-rate-setting-module-file-integrity/291756 "2021-12-14T07:29:00Z")
My goal is to get the exact number of logs along the path specified in auditbeat in elastic to build a schedule for receiving logs by day in kibana. The problem is that I get several duplicates of the same log in elasti… --- ## [Infinite extent for field "times": \[Infinity, -Infinity\] when data size set as 0 or larger than 10000](https://discuss.elastic.co/t/infinite-extent-for-field-times-infinity-infinity-when-data-size-set-as-0-or-larger-than-10000/291775)
**Author:** [@sunryan](https://discuss.elastic.co/u/sunryan)\ **Replies:** 1\ **Last updated:** [December 14, 2021, 10:25am UTC](https://discuss.elastic.co/t/infinite-extent-for-field-times-infinity-infinity-when-data-size-set-as-0-or-larger-than-10000/291775 "2021-12-14T10:25:25Z")
I am trying to use Vega to plot a scatter drawing, but always get a warning "Infinite extent for field "times": \[Infinity, -Infinity\]" when I set the data size as 0 or a number larger than 10000.Any help would be appreci… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1126) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1128)