# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1177 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1178 --- ## [Documents \_version changes](https://discuss.elastic.co/t/documents-version-changes/287684)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 13\ **Last updated:** [November 3, 2021, 9:45am UTC](https://discuss.elastic.co/t/documents-version-changes/287684 "2021-11-03T09:45:51Z")
Dears, Does the system problems like missing space on disks or exceeded heap space or network problems can have influence on change documents \_version? What is your experience with that? Why I'm asking about it? Becaus… --- ## [How to provide time +5.30(Time zone value in date format)](https://discuss.elastic.co/t/how-to-provide-time-5-30-time-zone-value-in-date-format/288304)
**Author:** [@gokulnath112](https://discuss.elastic.co/u/gokulnath112)\ **Replies:** 0\ **Last updated:** [November 3, 2021, 9:15am UTC](https://discuss.elastic.co/t/how-to-provide-time-5-30-time-zone-value-in-date-format/288304 "2021-11-03T09:15:58Z")
Hi everyone, I need to provide the date format for the below type of data."2021-10-28 21:16:41.504 +05:30". Kindly help me with that format. Thanks in advance. --- ## [How to create elasticsearch template in logstash pipeline](https://discuss.elastic.co/t/how-to-create-elasticsearch-template-in-logstash-pipeline/287898)
**Author:** [@gokulnath112](https://discuss.elastic.co/u/gokulnath112)\ **Replies:** 3\ **Last updated:** [November 3, 2021, 9:11am UTC](https://discuss.elastic.co/t/how-to-create-elasticsearch-template-in-logstash-pipeline/287898 "2021-11-03T09:11:58Z")
Hi Team, Greetings..! Is there any way to create Elasticsearch index template in logstash pipeline? I want push csv data to Elasticsearch via logstash, but I want to store data in custom data type. Please help me to cr… --- ## [ElasticSearch Error](https://discuss.elastic.co/t/elasticsearch-error/288186)
**Author:** [@Mudit\_Tripathi](https://discuss.elastic.co/u/Mudit_Tripathi)\ **Replies:** 4\ **Last updated:** [November 3, 2021, 8:23am UTC](https://discuss.elastic.co/t/elasticsearch-error/288186 "2021-11-03T08:23:41Z")
Hi All, I was able to start Elasticsearch on my local machine at port 9200 till 2 days back. Now when I am going to the path and executing ./Elasticsearch - It gives me an error: PP-C02Z66G1LVCG:bin mudit.tripathi$ ./E… --- ## [How does Elasticsearch search on multiple fields in the same query?](https://discuss.elastic.co/t/how-does-elasticsearch-search-on-multiple-fields-in-the-same-query/288272)
**Author:** [@Alexical](https://discuss.elastic.co/u/Alexical)\ **Replies:** 2\ **Last updated:** [November 3, 2021, 8:06am UTC](https://discuss.elastic.co/t/how-does-elasticsearch-search-on-multiple-fields-in-the-same-query/288272 "2021-11-03T08:06:03Z")
Hey, I have a decent enough idea of how various indexes work in SQL, how multicolumn index data structures are laid out, and how Postgres can use multiple different indexes by using each individually then doing bitmap op… --- ## [How to collecting specfic logs with filebeat](https://discuss.elastic.co/t/how-to-collecting-specfic-logs-with-filebeat/288280)
**Author:** [@dhody\_rhmd](https://discuss.elastic.co/u/dhody_rhmd)\ **Replies:** 0\ **Last updated:** [November 3, 2021, 4:42am UTC](https://discuss.elastic.co/t/how-to-collecting-specfic-logs-with-filebeat/288280 "2021-11-03T04:42:30Z")
I have Filebeat to collecting logs from my kubernetes cluster. In Filebeat configuration I using autodiscover with type kubernetes which collecting logs from stdout container. This is my filebeat.yml: filebeat.autodisc… --- ## [Help setting up Rally for Performance Benchmarks](https://discuss.elastic.co/t/help-setting-up-rally-for-performance-benchmarks/286766)
**Author:** [@jmathew1279](https://discuss.elastic.co/u/jmathew1279)\ **Replies:** 3\ **Last updated:** [November 3, 2021, 7:21am UTC](https://discuss.elastic.co/t/help-setting-up-rally-for-performance-benchmarks/286766 "2021-11-03T07:21:10Z")
I am trying to setup rally using the docker image rally:2.2.1 When trying to list the tracks, i get this error. How do i get around it. \[WARNING\] No Internet connection detected. Automatic download of track data sets … --- ## [Filebeat Autodiscover template condition is not working](https://discuss.elastic.co/t/filebeat-autodiscover-template-condition-is-not-working/288289)
**Author:** [@vijayebpzr](https://discuss.elastic.co/u/vijayebpzr)\ **Replies:** 0\ **Last updated:** [November 3, 2021, 7:21am UTC](https://discuss.elastic.co/t/filebeat-autodiscover-template-condition-is-not-working/288289 "2021-11-03T07:21:00Z")
I am trying to get logs from specific container in a kubernetes cluster using filebeat auto discover feature. But the condition is not working. IS there a way to apply the filter condition? filebeat.autodiscover: … --- ## [Grok filter in logstash for more than one different lines](https://discuss.elastic.co/t/grok-filter-in-logstash-for-more-than-one-different-lines/288108)
**Author:** [@root\_linux](https://discuss.elastic.co/u/root_linux)\ **Replies:** 5\ **Last updated:** [November 3, 2021, 6:37am UTC](https://discuss.elastic.co/t/grok-filter-in-logstash-for-more-than-one-different-lines/288108 "2021-11-03T06:37:56Z")
I have logs in which there are different types of lines are present. And I want to write grok filter for each line. How I can I achieve it? My logs are as given below: Oct 5 14:05:53 centos-8gb-nbg1-1 openvpn: Tue Oct … --- ## [Sum of Averages of individual in lens visualization](https://discuss.elastic.co/t/sum-of-averages-of-individual-in-lens-visualization/287574)
**Author:** [@Prasanth\_V](https://discuss.elastic.co/u/Prasanth_V)\ **Replies:** 8\ **Last updated:** [November 3, 2021, 5:39am UTC](https://discuss.elastic.co/t/sum-of-averages-of-individual-in-lens-visualization/287574 "2021-11-03T05:39:47Z")
Dear Team, Is it possible to calculate sum of averages of each individual(nodes) apache workers in single lens visualization? Kindly suggest us --- ## [Kibana cannot automatically recover when elasticsearch restarts](https://discuss.elastic.co/t/kibana-cannot-automatically-recover-when-elasticsearch-restarts/288194)
**Author:** [@nuaazt](https://discuss.elastic.co/u/nuaazt)\ **Replies:** 3\ **Last updated:** [November 3, 2021, 2:42am UTC](https://discuss.elastic.co/t/kibana-cannot-automatically-recover-when-elasticsearch-restarts/288194 "2021-11-03T02:42:18Z")
hi，I build a docker image of kibana from the code. Then I start the kibana container. I find that when I restart Elasticsearch, kibana also turns error and cannot recover. I must restart kibana manually. So does kibana … --- ## [Thread Pool Management](https://discuss.elastic.co/t/thread-pool-management/288275)
**Author:** [@tsousahs](https://discuss.elastic.co/u/tsousahs)\ **Replies:** 0\ **Last updated:** [November 3, 2021, 12:33am UTC](https://discuss.elastic.co/t/thread-pool-management/288275 "2021-11-03T00:33:34Z")
Hello, We are seeing a lot of CPU processing without much indexing activity. I have run the following command to see the hot thread: GET \_nodes/hot\_threads which i got the following output. 100.5% (502.6ms out of 500… --- ## [Kibana time series visual](https://discuss.elastic.co/t/kibana-time-series-visual/288195)
**Author:** [@Nisha2297](https://discuss.elastic.co/u/Nisha2297)\ **Replies:** 1\ **Last updated:** [November 2, 2021, 11:26pm UTC](https://discuss.elastic.co/t/kibana-time-series-visual/288195 "2021-11-02T23:26:07Z")
Hi, I am trying to build a time series chart to get the stages of my pipeline(status getting updated) on the basis of a timestamp field "status.created\_at". The status of a particular pipeline changes in seconds/minute… --- ## [How to get logstash logs in stack monitoring (k8s)](https://discuss.elastic.co/t/how-to-get-logstash-logs-in-stack-monitoring-k8s/288159)
**Author:** [@antondubek](https://discuss.elastic.co/u/antondubek)\ **Replies:** 0\ **Last updated:** [November 1, 2021, 4:03pm UTC](https://discuss.elastic.co/t/how-to-get-logstash-logs-in-stack-monitoring-k8s/288159 "2021-11-01T16:03:21Z")
We run our elastic stack utilising ECK however have run into an issue when it comes to Logstash logs. Our Logstash's are deployed using the official helm chart - Logstash Helm We expected, as outlined with the Elastics… --- ## [Replace my \\r\\n with a new line using mutate gsub](https://discuss.elastic.co/t/replace-my-r-n-with-a-new-line-using-mutate-gsub/288240)
**Author:** [@rkhapre](https://discuss.elastic.co/u/rkhapre)\ **Replies:** 6\ **Last updated:** [November 2, 2021, 9:35pm UTC](https://discuss.elastic.co/t/replace-my-r-n-with-a-new-line-using-mutate-gsub/288240 "2021-11-02T21:35:49Z")
Hi All I have a csv data in this format { "message" : "value1,value2,value3\\r\\nvalue4,value5,value6" } My expected result is { "message" : "value1,value2,value3 value4,value5,value6" } I have tried mutate g… --- ## [Couldn't login to Kibana URL](https://discuss.elastic.co/t/couldnt-login-to-kibana-url/288217)
**Author:** [@orelevi](https://discuss.elastic.co/u/orelevi)\ **Replies:** 4\ **Last updated:** [November 2, 2021, 9:17pm UTC](https://discuss.elastic.co/t/couldnt-login-to-kibana-url/288217 "2021-11-02T21:17:38Z")
I know it's not the best practice but i want to check something, so i manually created opensearch service at AWS and i can't connect through the kibana url (timeout error) i really don't understand why, my security group… --- ## [Filebeat is not sending new events to logstash](https://discuss.elastic.co/t/filebeat-is-not-sending-new-events-to-logstash/288190)
**Author:** [@Mobin](https://discuss.elastic.co/u/Mobin)\ **Replies:** 0\ **Last updated:** [November 2, 2021, 5:56am UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-new-events-to-logstash/288190 "2021-11-02T05:56:56Z")
We have created an elastic stack to monitor logs from the Linux clients. On Linux clients, filebeat is configured to ship the logs to the elastic stack. But our filebeat is not detecting new events in the log file and n… --- ## [ILM policies - fails to move to cold node](https://discuss.elastic.co/t/ilm-policies-fails-to-move-to-cold-node/288252)
**Author:** [@Callahan](https://discuss.elastic.co/u/Callahan)\ **Replies:** 0\ **Last updated:** [November 2, 2021, 5:34pm UTC](https://discuss.elastic.co/t/ilm-policies-fails-to-move-to-cold-node/288252 "2021-11-02T17:34:10Z")
We have a slightly old Elastic stack that I built over 2+ years ago. It ran into some issues a week or so ago and one of the team took a bit of a sledge hammer to the indices to fix it. It's now back up and running but I… --- ## [ELK certificates update](https://discuss.elastic.co/t/elk-certificates-update/288211)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 1\ **Last updated:** [November 2, 2021, 9:13pm UTC](https://discuss.elastic.co/t/elk-certificates-update/288211 "2021-11-02T21:13:10Z")
Hello ! I have my cluster secured and several agents connecting to elastic via https with .pem certificates. When these certificates expire should I update all the certificates of all my agents in all my nodes? thanks… --- ## [Visualize - Change legends font size](https://discuss.elastic.co/t/visualize-change-legends-font-size/288260)
**Author:** [@Silvy20](https://discuss.elastic.co/u/Silvy20)\ **Replies:** 1\ **Last updated:** [November 2, 2021, 8:56pm UTC](https://discuss.elastic.co/t/visualize-change-legends-font-size/288260 "2021-11-02T20:56:41Z")
Hi all, I'm new here and this maybe a stupid question but I didn't found a solution for it. There are a way to increase the size of the text legends in the graphs? I need to work with print screens to put in a PowerPoin… --- ## [Why are my users complaining about the Kibana "Logs" application?](https://discuss.elastic.co/t/why-are-my-users-complaining-about-the-kibana-logs-application/288160)
**Author:** [@cotjoey](https://discuss.elastic.co/u/cotjoey)\ **Replies:** 3\ **Last updated:** [November 2, 2021, 8:51pm UTC](https://discuss.elastic.co/t/why-are-my-users-complaining-about-the-kibana-logs-application/288160 "2021-11-02T20:51:55Z")
Hello, I've implemented filebeat a while ago and started to send log events to Logstash to be inserted into Elasticsearch for viewing in Kibana. Ever since , people (Users of Kibana Logs) have been complaining about it'… --- ## [Renaming fields dinamically](https://discuss.elastic.co/t/renaming-fields-dinamically/288237)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 4\ **Last updated:** [November 2, 2021, 5:57pm UTC](https://discuss.elastic.co/t/renaming-fields-dinamically/288237 "2021-11-02T17:57:12Z")
Hi, I got multiple fields with composed names likes the ones below records.properties.multiVmGroupId records.properties.rpoInSeconds I want to get rid of the records.properties part, and left only the last word. is th… --- ## [Elasticsearch inaccurate shard state when timed\_out is true](https://discuss.elastic.co/t/elasticsearch-inaccurate-shard-state-when-timed-out-is-true/285513)
**Author:** [@niketpatel2525](https://discuss.elastic.co/u/niketpatel2525)\ **Replies:** 14\ **Last updated:** [November 2, 2021, 5:28pm UTC](https://discuss.elastic.co/t/elasticsearch-inaccurate-shard-state-when-timed-out-is-true/285513 "2021-11-02T17:28:09Z")
Hey there, I have an index with 40 shards and I use the timeout feature with my search query. As per the documentation, if request timeout before it completes search on all shards, it will return whatever the results ot… --- ## [Packetbeat Kubernetes metadata processor configuration](https://discuss.elastic.co/t/packetbeat-kubernetes-metadata-processor-configuration/288250)
**Author:** [@loict](https://discuss.elastic.co/u/loict)\ **Replies:** 0\ **Last updated:** [November 2, 2021, 4:52pm UTC](https://discuss.elastic.co/t/packetbeat-kubernetes-metadata-processor-configuration/288250 "2021-11-02T16:52:59Z")
Hi, We're trying to use the add\_kubernetes\_metadata processor in Packetbeat (7.15.1) to be able to identify the flows generated by the pods and possibly filter by Pods metadata such as namespace, labels, or annotations… --- ## [Pdf reports has disapeared in the share menu](https://discuss.elastic.co/t/pdf-reports-has-disapeared-in-the-share-menu/287315)
**Author:** [@RickT](https://discuss.elastic.co/u/RickT)\ **Replies:** 2\ **Last updated:** [November 2, 2021, 4:36pm UTC](https://discuss.elastic.co/t/pdf-reports-has-disapeared-in-the-share-menu/287315 "2021-11-02T16:36:10Z")
Hi, something strange today, in dashboard, the "Pdf reports" choice has disappeared from share menu !? :face\_with\_monocle: Is this normal ? thanks --- ## [Using Logstash HTTP\_poller for NTLM authentication](https://discuss.elastic.co/t/using-logstash-http-poller-for-ntlm-authentication/288249)
**Author:** [@jondayko](https://discuss.elastic.co/u/jondayko)\ **Replies:** 0\ **Last updated:** [November 2, 2021, 4:32pm UTC](https://discuss.elastic.co/t/using-logstash-http-poller-for-ntlm-authentication/288249 "2021-11-02T16:32:55Z")
So, currently I am trying to use the http\_poller input plugin to send OData (JSON) to Kibana using Logstash. However, I keep running into problems trying to authenticate using NTLM. I was able to figure out that you can … --- ## [Nested aggregation](https://discuss.elastic.co/t/nested-aggregation/288061)
**Author:** [@mofaris](https://discuss.elastic.co/u/mofaris)\ **Replies:** 3\ **Last updated:** [November 2, 2021, 4:13pm UTC](https://discuss.elastic.co/t/nested-aggregation/288061 "2021-11-02T16:13:43Z")
Hello guys, I am trying to aggregate some data from my db by Logstash and send them to Elasticsearch. My data looks like this: The table consists of 4 columns. each question\_id may have one or more answer\_id and eac… --- ## [Expand Elasticsearch cluster v6 help](https://discuss.elastic.co/t/expand-elasticsearch-cluster-v6-help/288220)
**Author:** [@Ain\_Ryushika](https://discuss.elastic.co/u/Ain_Ryushika)\ **Replies:** 3\ **Last updated:** [November 2, 2021, 4:11pm UTC](https://discuss.elastic.co/t/expand-elasticsearch-cluster-v6-help/288220 "2021-11-02T16:11:37Z")
Elasticsearch version 6.8.17, all nodes are data and master nodes. Hello, I have a need to expand current Elasticsearch cluster from 3 to 6 nodes. I have a question regarding parameter "discovery.zen.minimum\_master\_no… --- ## [Split and group documents by two conditions in Kibana visualizations or Elasticsearch queries](https://discuss.elastic.co/t/split-and-group-documents-by-two-conditions-in-kibana-visualizations-or-elasticsearch-queries/288227)
**Author:** [@aza-zil](https://discuss.elastic.co/u/aza-zil)\ **Replies:** 3\ **Last updated:** [November 2, 2021, 3:55pm UTC](https://discuss.elastic.co/t/split-and-group-documents-by-two-conditions-in-kibana-visualizations-or-elasticsearch-queries/288227 "2021-11-02T15:55:49Z")
Let's say I have the following data in Elasticsearch: id : id of the document date : date of inserting the document changed : refers that the field 'working' has changed its status from last document inserted. work… --- ## [How to get the total of memory and cpu usage of my cluster](https://discuss.elastic.co/t/how-to-get-the-total-of-memory-and-cpu-usage-of-my-cluster/288170)
**Author:** [@Sergio\_Ferreyra](https://discuss.elastic.co/u/Sergio_Ferreyra)\ **Replies:** 10\ **Last updated:** [November 2, 2021, 2:35pm UTC](https://discuss.elastic.co/t/how-to-get-the-total-of-memory-and-cpu-usage-of-my-cluster/288170 "2021-11-02T14:35:12Z")
Hi team, I am working on Kibana Dashboard trying to get a particular metric. for example, I have 3 kubernetes nodes and I am trying to create a dashboard with the Total of memory and CPU consumption, I am trying with len… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1176) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1178)