# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1134 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1135 --- ## [No detailed errors in logstash](https://discuss.elastic.co/t/no-detailed-errors-in-logstash/291233)
**Author:** [@SSivaji](https://discuss.elastic.co/u/SSivaji)\ **Replies:** 2\ **Last updated:** [December 9, 2021, 3:05am UTC](https://discuss.elastic.co/t/no-detailed-errors-in-logstash/291233 "2021-12-09T03:05:58Z")
When I try to Index a specific text. Able to index a in devtools, but when the same text is provided via logstash it is not getting Indexed, enabled debug logs it just prints the text to console, but not getting Indexe… --- ## [Clone index failing](https://discuss.elastic.co/t/clone-index-failing/291249)
**Author:** [@madshov](https://discuss.elastic.co/u/madshov)\ **Replies:** 1\ **Last updated:** [December 8, 2021, 10:33pm UTC](https://discuss.elastic.co/t/clone-index-failing/291249 "2021-12-08T22:33:51Z")
Hi all, I'm getting an error when I try to clone my index called myindex into myindex\_clone. I have set up a 3 node cluster on my machine, and I'm using the (Go) SDK client to call the CloneIndex() function. However I'm… --- ## [How to do join field/routing in bigquery to elasticsearch dataflow template?](https://discuss.elastic.co/t/how-to-do-join-field-routing-in-bigquery-to-elasticsearch-dataflow-template/291269)
**Author:** [@rickbenchsci](https://discuss.elastic.co/u/rickbenchsci)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 10:27pm UTC](https://discuss.elastic.co/t/how-to-do-join-field-routing-in-bigquery-to-elasticsearch-dataflow-template/291269 "2021-12-08T22:27:29Z")
Hi, I am using the dataflow template provided by google for importing data from BigQuery to Elasticsearch. see here We managed to get the thing working (sans API key. adding basic auth overwrites the need for it), and … --- ## [TSVB metrics moving around/shaking on screen and strange refresh behaviour](https://discuss.elastic.co/t/tsvb-metrics-moving-around-shaking-on-screen-and-strange-refresh-behaviour/291167)
**Author:** [@Sketchy](https://discuss.elastic.co/u/Sketchy)\ **Replies:** 2\ **Last updated:** [December 8, 2021, 9:59pm UTC](https://discuss.elastic.co/t/tsvb-metrics-moving-around-shaking-on-screen-and-strange-refresh-behaviour/291167 "2021-12-08T21:59:04Z")
Having issues, for a long time now with the TSVB metrics moving around on the screen, shaking about/moving side to side. It used to be much worse in previous versions and I have seen the issue happening again recently on… --- ## [Filebeat service is not stopping](https://discuss.elastic.co/t/filebeat-service-is-not-stopping/291266)
**Author:** [@molasses](https://discuss.elastic.co/u/molasses)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 9:49pm UTC](https://discuss.elastic.co/t/filebeat-service-is-not-stopping/291266 "2021-12-08T21:49:55Z")
From time to time, attempts to stop filebeat are failing. version: 7.11.1 running as a windows service command to stop filebeat: sc stop filebeat filebeat windows service stops fine most of the time. From time to ti… --- ## [Processing Multiple Rows From JDBC Streaming](https://discuss.elastic.co/t/processing-multiple-rows-from-jdbc-streaming/291012)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 22\ **Last updated:** [December 8, 2021, 8:37pm UTC](https://discuss.elastic.co/t/processing-multiple-rows-from-jdbc-streaming/291012 "2021-12-08T20:37:51Z")
I'm querying a database to get questions asked in a ticket. The query asks for all questions asked by the ticket id. So a single query may return multiple rows. I'd like to be able to parse them all into separate fiel… --- ## [CSV Illegal Quoting in Line 1](https://discuss.elastic.co/t/csv-illegal-quoting-in-line-1/289834)
**Author:** [@Micah\_Barsness](https://discuss.elastic.co/u/Micah_Barsness)\ **Replies:** 13\ **Last updated:** [December 8, 2021, 8:19pm UTC](https://discuss.elastic.co/t/csv-illegal-quoting-in-line-1/289834 "2021-12-08T20:19:33Z")
I'm receiving the following error & some of my incoming logs are being not being parsed and therefore dropped. \[2021-11-22T09:50:11,381\]\[WARN \]\[logstash.filters.csv \]\[MID-CUCM\]\[6a45eeb30e5ba587e03ab6fc5b123b705e6e76… --- ## [No data after CSV Export - Kibana](https://discuss.elastic.co/t/no-data-after-csv-export-kibana/288486)
**Author:** [@krish0608](https://discuss.elastic.co/u/krish0608)\ **Replies:** 5\ **Last updated:** [December 8, 2021, 7:24pm UTC](https://discuss.elastic.co/t/no-data-after-csv-export-kibana/288486 "2021-12-08T19:24:34Z")
Continuing the discussion from Reporting - CSV Export: contains partial data: Hi Team, currently we are facing two issues related to csv Export. If index is frozen then how to export data in csv as we are getting emp… --- ## [Dashboard - Creating a complex graph with 3 metrics](https://discuss.elastic.co/t/dashboard-creating-a-complex-graph-with-3-metrics/291121)
**Author:** [@Alice\_S](https://discuss.elastic.co/u/Alice_S)\ **Replies:** 1\ **Last updated:** [December 8, 2021, 7:10pm UTC](https://discuss.elastic.co/t/dashboard-creating-a-complex-graph-with-3-metrics/291121 "2021-12-08T19:10:26Z")
Hi, I would really appreciate getting some help: I'm trying to visualize my data in a more convenient way and to combine 3 graphs into one. The graph should show distinct users and the sum of a specific column by time… --- ## [How to remove fields not required while sending log data from file beat](https://discuss.elastic.co/t/how-to-remove-fields-not-required-while-sending-log-data-from-file-beat/290484)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 2\ **Last updated:** [December 8, 2021, 6:04pm UTC](https://discuss.elastic.co/t/how-to-remove-fields-not-required-while-sending-log-data-from-file-beat/290484 "2021-12-08T18:04:07Z")
While sending data from a logfile using file beat through ingest pipeline to index in Elasticsearch, some additional fields not present in the concerned log file is also getting populated. These data are mostly relate… --- ## [Exporting large number of objects from Kibana - errors](https://discuss.elastic.co/t/exporting-large-number-of-objects-from-kibana-errors/291158)
**Author:** [@vee](https://discuss.elastic.co/u/vee)\ **Replies:** 2\ **Last updated:** [December 8, 2021, 6:59pm UTC](https://discuss.elastic.co/t/exporting-large-number-of-objects-from-kibana-errors/291158 "2021-12-08T18:59:38Z")
Hi there, We have v7.5 Elasticsearch/Kibana. Trying to export Saved Objects in prod (~12,000 objects). But it's erroring with this reason in Kibana with this error: Unable to generate export. Here are the Kibana logs at… --- ## [How we can attach a document with the alert to teams action?](https://discuss.elastic.co/t/how-we-can-attach-a-document-with-the-alert-to-teams-action/289790)
**Author:** [@ranju](https://discuss.elastic.co/u/ranju)\ **Replies:** 3\ **Last updated:** [December 8, 2021, 6:34pm UTC](https://discuss.elastic.co/t/how-we-can-attach-a-document-with-the-alert-to-teams-action/289790 "2021-12-08T18:34:08Z")
Document means some dashboard as pdf likewise. Currently, We are using webhook for sending alerts to the team's channels from the watcher. same functionality we are able to perform in email action. eg: "actions": { … --- ## [Elasticsearch-PHP requires cURL, or a custom HTTP handler](https://discuss.elastic.co/t/elasticsearch-php-requires-curl-or-a-custom-http-handler/291250)
**Author:** [@tranha31](https://discuss.elastic.co/u/tranha31)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 6:16pm UTC](https://discuss.elastic.co/t/elasticsearch-php-requires-curl-or-a-custom-http-handler/291250 "2021-12-08T18:16:58Z")
I try to connect Elasticsearch from php with Elasticsearch-php Library. But it notices 127.0.0.1:43202 \[500\]: GET /main.php?q=a - Uncaught RuntimeException: Elasticsearch-PHP requires cURL, or a custom HTTP handler. in… --- ## [SORTING, SUM, PAGINATION, and AGGREGATION all in one!](https://discuss.elastic.co/t/sorting-sum-pagination-and-aggregation-all-in-one/291248)
**Author:** [@michael\_jaskiewicz](https://discuss.elastic.co/u/michael_jaskiewicz)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 6:04pm UTC](https://discuss.elastic.co/t/sorting-sum-pagination-and-aggregation-all-in-one/291248 "2021-12-08T18:04:42Z")
'm using Elasticsearch and I see questions now and then about doing some aggregations with sorting or aggregations with paging, but I never see anything GROUP\_BY, SUM, SORT, and PAGINATION together. If I were to write wh… --- ## [Imap input gives weird error](https://discuss.elastic.co/t/imap-input-gives-weird-error/290671)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 6\ **Last updated:** [December 8, 2021, 5:16pm UTC](https://discuss.elastic.co/t/imap-input-gives-weird-error/290671 "2021-12-08T17:16:38Z")
Hello, I want to run imap plugin to load some reporting mails into Elasticsearch. I have it configured as the following: input { imap { check\_interval =\> "10" host =\> "host" port =\> "995" user =\> "em… --- ## [Importing saved objects. - broken index pattern IDs](https://discuss.elastic.co/t/importing-saved-objects-broken-index-pattern-ids/291160)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 1\ **Last updated:** [December 8, 2021, 4:49pm UTC](https://discuss.elastic.co/t/importing-saved-objects-broken-index-pattern-ids/291160 "2021-12-08T16:49:45Z")
I recently moved some objects between kibana instances. I suspect this is the first time since I have done this since I upgraded to 7.14. When I imported them I was surprised not to be prompted to fix broken ids for in… --- ## [PySpark - How to read timestamp date\_nanos from ElasticSearch to Spark?](https://discuss.elastic.co/t/pyspark-how-to-read-timestamp-date-nanos-from-elasticsearch-to-spark/260020)
**Author:** [@ngocdangrby](https://discuss.elastic.co/u/ngocdangrby)\ **Replies:** 1\ **Last updated:** [December 8, 2021, 4:42pm UTC](https://discuss.elastic.co/t/pyspark-how-to-read-timestamp-date-nanos-from-elasticsearch-to-spark/260020 "2021-12-08T16:42:17Z")
Hi all, I need to read the timestamp from ElasticSearch to Spark RDD or DataFrame. I can read other fields (text, interger..) but timestamp i can not. Spark v2.4.7 Python: v3.6.11 ElasticSearch: v7.10.0 Here is my c… --- ## [Parsing issues](https://discuss.elastic.co/t/parsing-issues/291159)
**Author:** [@nickel43](https://discuss.elastic.co/u/nickel43)\ **Replies:** 6\ **Last updated:** [December 8, 2021, 4:32pm UTC](https://discuss.elastic.co/t/parsing-issues/291159 "2021-12-08T16:32:13Z")
Hello, I have an issue with parsing my data. Here is a sample of JSON: { "info": { "generated\_on": "2017-12-03 08:41:42.057563", "slice": "0-999", "version": "v1" }, "playlists":… --- ## [Setup hot-delete policy for Elastichsearch index without using templates](https://discuss.elastic.co/t/setup-hot-delete-policy-for-elastichsearch-index-without-using-templates/291242)
**Author:** [@obadakhalili](https://discuss.elastic.co/u/obadakhalili)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 4:24pm UTC](https://discuss.elastic.co/t/setup-hot-delete-policy-for-elastichsearch-index-without-using-templates/291242 "2021-12-08T16:24:16Z")
I'm trying to setup an ILM policy that deletes my index every 3 days, and creates a new one. Here's my attempt for achieving that: const policyName = "hot\_delete\_twitter\_stream\_indexing\_policy" await ESClient.ilm.p… --- ## [Create an error log with an ingest pipeline when there is an indexing error](https://discuss.elastic.co/t/create-an-error-log-with-an-ingest-pipeline-when-there-is-an-indexing-error/291069)
**Author:** [@GinkoLucas](https://discuss.elastic.co/u/GinkoLucas)\ **Replies:** 6\ **Last updated:** [December 8, 2021, 3:12pm UTC](https://discuss.elastic.co/t/create-an-error-log-with-an-ingest-pipeline-when-there-is-an-indexing-error/291069 "2021-12-08T15:12:48Z")
Hi, I would like to create an error log when a document is not suitable for my mapping. For example if I send a document containing an unknown field in my mapping (dynamic:false), I would like to be able to create an e… --- ## [Partial Legacy Monitoring](https://discuss.elastic.co/t/partial-legacy-monitoring/290967)
**Author:** [@gimpastic](https://discuss.elastic.co/u/gimpastic)\ **Replies:** 1\ **Last updated:** [December 8, 2021, 2:56pm UTC](https://discuss.elastic.co/t/partial-legacy-monitoring/290967 "2021-12-08T14:56:42Z")
I'm getting the notification window "Partial Legacy Monitoring " each time when I open https://kibana.x.com/app/monitoring I'm using metricbeats\\filebeats to monitor the stack Partial Legacy Monitoring Detected It app… --- ## [Event.dataset: login not present](https://discuss.elastic.co/t/event-dataset-login-not-present/291232)
**Author:** [@sadux](https://discuss.elastic.co/u/sadux)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 2:50pm UTC](https://discuss.elastic.co/t/event-dataset-login-not-present/291232 "2021-12-08T14:50:19Z")
Hello! Just install Elaticsearch & Kibana & Auditbeat (Ubuntu Server 20.04). Also install auditbeat dashboard. But \[Auditbeat System\] Login Dashboard ECS is empty. I want to see user login count. Some browsing bring me t… --- ## [Can't put http\_endpoint messages to root](https://discuss.elastic.co/t/cant-put-http-endpoint-messages-to-root/290527)
**Author:** [@uhfath](https://discuss.elastic.co/u/uhfath)\ **Replies:** 5\ **Last updated:** [December 8, 2021, 2:38pm UTC](https://discuss.elastic.co/t/cant-put-http-endpoint-messages-to-root/290527 "2021-12-08T14:38:41Z")
Here is my config: filebeat.inputs: - type: http\_endpoint enabled: true listen\_address: 127.0.0.1 listen\_port: 20000 response\_code: 204 response\_body: null prefix: null fields: app\_name: "MedService.UI… --- ## [URGENT! Elastic search: Unable to perform jdbc query because of Exception when executing JDBC query](https://discuss.elastic.co/t/urgent-elastic-search-unable-to-perform-jdbc-query-because-of-exception-when-executing-jdbc-query/291181)
**Author:** [@Leo\_Baby\_Jacob](https://discuss.elastic.co/u/Leo_Baby_Jacob)\ **Replies:** 1\ **Last updated:** [December 8, 2021, 2:27pm UTC](https://discuss.elastic.co/t/urgent-elastic-search-unable-to-perform-jdbc-query-because-of-exception-when-executing-jdbc-query/291181 "2021-12-08T14:27:24Z")
I have a sample logstash conf file, However when I. run it I can see a logstash error caused Error is \[371de1f7cad8c35c02e4a3047ec831da42b9b5048183b45a3916162ab248f3f7\] Exception when executing JDBC query {:excepti… --- ## [ES Hadoop push down aggregations or not?](https://discuss.elastic.co/t/es-hadoop-push-down-aggregations-or-not/277514)
**Author:** [@priamai](https://discuss.elastic.co/u/priamai)\ **Replies:** 1\ **Last updated:** [December 8, 2021, 2:09pm UTC](https://discuss.elastic.co/t/es-hadoop-push-down-aggregations-or-not/277514 "2021-12-08T14:09:10Z")
I am on ELK 7.13.0 and I have a super very slow query: events\_df = es\_reader.load("priam\_unified\_host-{0}/unified-host".format(date)) counts\_df = events\_df.where('EventID == 4688').groupBy(col("LogHost"),col("ProcessNa… --- ## [Logs Do Not Appear In APM, Although Correlation Info Is Present](https://discuss.elastic.co/t/logs-do-not-appear-in-apm-although-correlation-info-is-present/289720)
**Author:** [@Brandon\_Liles](https://discuss.elastic.co/u/Brandon_Liles)\ **Replies:** 13\ **Last updated:** [December 8, 2021, 1:55pm UTC](https://discuss.elastic.co/t/logs-do-not-appear-in-apm-although-correlation-info-is-present/289720 "2021-12-08T13:55:14Z")
Using version 7.15.2 of Elasticsearch, Kibana and APM. I have APM configured and can see transactions/traces. I have Serilog configured with the Elasticsearch sink and I am using the EcsTextFormatter. When I go to Logs \>… --- ## [Elastic Agents, ECK, and Kubernetes namespaces](https://discuss.elastic.co/t/elastic-agents-eck-and-kubernetes-namespaces/291218)
**Author:** [@nuvarov](https://discuss.elastic.co/u/nuvarov)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 1:04pm UTC](https://discuss.elastic.co/t/elastic-agents-eck-and-kubernetes-namespaces/291218 "2021-12-08T13:04:52Z")
I'm setting up elastic stack on our kubernetes cluster using ECK. One of the ideas is to make sure teams have access to the logs and metrics of workloads only from their kubernetes namespace. This seem to map to the nam… --- ## [Logstash Cannot Listen Port 5044 after fresh install](https://discuss.elastic.co/t/logstash-cannot-listen-port-5044-after-fresh-install/291191)
**Author:** [@bropid](https://discuss.elastic.co/u/bropid)\ **Replies:** 2\ **Last updated:** [December 8, 2021, 12:33pm UTC](https://discuss.elastic.co/t/logstash-cannot-listen-port-5044-after-fresh-install/291191 "2021-12-08T12:33:23Z")
Hi, i'am freshly installed logstash but when i'm try to test connect with telnet \ 5044 it says connection refused. Then when i check my network in logstash machine with netstat -plntu | grep 5044 it did… --- ## [Unable to deploy Logstash .. " Unable to configure plugins: Cannot evaluate \`${ELASTIC\_CERTIFICATE}\`. Replacement variable \`ELASTIC\_CERTIFICATE\` is not defined in a Logstash secret store or an environment entry and there is no default value given."](https://discuss.elastic.co/t/unable-to-deploy-logstash-unable-to-configure-plugins-cannot-evaluate-elastic-certificate-replacement-variable-elastic-certificate-is-not-defined-in-a-logstash-secret-store-or-an-environment-entry-and-there-is-no-default-value-given/291216)
**Author:** [@vishnu\_rao](https://discuss.elastic.co/u/vishnu_rao)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 12:29pm UTC](https://discuss.elastic.co/t/unable-to-deploy-logstash-unable-to-configure-plugins-cannot-evaluate-elastic-certificate-replacement-variable-elastic-certificate-is-not-defined-in-a-logstash-secret-store-or-an-environment-entry-and-there-is-no-default-value-given/291216 "2021-12-08T12:29:15Z")
Hello All I am trying to deploy logstash in our environment and I am seeing below error . I have created the secret with the Elastic Certificate ( .cer ) file .. but sill I am seeing the below error. Using bundled JD… --- ## [Filebeat add\_fields processor](https://discuss.elastic.co/t/filebeat-add-fields-processor/290990)
**Author:** [@fgjensen](https://discuss.elastic.co/u/fgjensen)\ **Replies:** 4\ **Last updated:** [December 8, 2021, 12:29pm UTC](https://discuss.elastic.co/t/filebeat-add-fields-processor/290990 "2021-12-08T12:29:04Z")
Hello colleagues; I am trying to add an ECS event.dataset with the add\_fields processor similar to several of the Filebeat modules e.g., the Apache module which add the event datasets apache.access and apache.error. I … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1133) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1135)