# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1203 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1204 --- ## [Parsing tabular data into canvas](https://discuss.elastic.co/t/parsing-tabular-data-into-canvas/286496)
**Author:** [@Kadhem](https://discuss.elastic.co/u/Kadhem)\ **Replies:** 1\ **Last updated:** [October 12, 2021, 10:54pm UTC](https://discuss.elastic.co/t/parsing-tabular-data-into-canvas/286496 "2021-10-12T22:54:34Z")
hi, how can i parse this output of command to push into into a table in Canvas : prec: rqstd, stored, dropped, retried, rtsfail,rtrydrop, psretry, acked,utlisatn,q length,Data Mbits/s,Phy Mbits/s, %air, %effcy (v5… --- ## [ElasticSearch Data Redirection](https://discuss.elastic.co/t/elasticsearch-data-redirection/286036)
**Author:** [@jrpayne30506](https://discuss.elastic.co/u/jrpayne30506)\ **Replies:** 2\ **Last updated:** [October 13, 2021, 12:58pm UTC](https://discuss.elastic.co/t/elasticsearch-data-redirection/286036 "2021-10-13T12:58:02Z")
Hello All, New to Elasticsearch here and having an issue. I have an Ubuntu server (18.04) that I am using to send some security and firewall logs for period of retentions storage. I found an article on how to redirect t… --- ## [One Index is not recovering from the state INITIALIZING and UNASSIGNED](https://discuss.elastic.co/t/one-index-is-not-recovering-from-the-state-initializing-and-unassigned/286468)
**Author:** [@Programmer](https://discuss.elastic.co/u/Programmer)\ **Replies:** 4\ **Last updated:** [October 13, 2021, 12:46pm UTC](https://discuss.elastic.co/t/one-index-is-not-recovering-from-the-state-initializing-and-unassigned/286468 "2021-10-13T12:46:21Z")
curl -XGET http://localhost:9200/\_cat/shards app-all 1 r INITIALIZING 172.16.4.165 viepevrat02 app-all 1 p STARTED 85125705 67gb 172.16.4.164 viepevrat01 app-all 0 p RELOCATING… --- ## [How to run multiple instances of Filebeat for the same input/output?](https://discuss.elastic.co/t/how-to-run-multiple-instances-of-filebeat-for-the-same-input-output/286539)
**Author:** [@ppine7](https://discuss.elastic.co/u/ppine7)\ **Replies:** 5\ **Last updated:** [October 13, 2021, 12:38pm UTC](https://discuss.elastic.co/t/how-to-run-multiple-instances-of-filebeat-for-the-same-input-output/286539 "2021-10-13T12:38:03Z")
Hi, is there a recommended way to run multiple instances if Filebeat, on different physical servers (VMs) that would process data from the same input and into the same output (ES index)? Basically to have an option to … --- ## [Combination of filter and range](https://discuss.elastic.co/t/combination-of-filter-and-range/286392)
**Author:** [@smit\_vasava](https://discuss.elastic.co/u/smit_vasava)\ **Replies:** 1\ **Last updated:** [October 13, 2021, 12:13pm UTC](https://discuss.elastic.co/t/combination-of-filter-and-range/286392 "2021-10-13T12:13:39Z")
hello everyone , i am newbie to Elasticsearch , i am having some issue with query searching .. here is my code GET /new\_product/\_search { "query": { "bool" : { "filter": \[ { "term": { "ca… --- ## [Auto Authentication using .net](https://discuss.elastic.co/t/auto-authentication-using-net/286462)
**Author:** [@prabha\_karan](https://discuss.elastic.co/u/prabha_karan)\ **Replies:** 2\ **Last updated:** [October 13, 2021, 12:03pm UTC](https://discuss.elastic.co/t/auto-authentication-using-net/286462 "2021-10-13T12:03:03Z")
Hi ,i want to use dashboard inside in our web application .so, i pasted iframe inside Html.it rendered in browser with kibana login page. but after entered login credentials it again shows the login page.how to rectify t… --- ## [Which architecture is better? Should I collect the logs on the server side using rsyslog?](https://discuss.elastic.co/t/which-architecture-is-better-should-i-collect-the-logs-on-the-server-side-using-rsyslog/286589)
**Author:** [@Sagimb](https://discuss.elastic.co/u/Sagimb)\ **Replies:** 3\ **Last updated:** [October 13, 2021, 9:34am UTC](https://discuss.elastic.co/t/which-architecture-is-better-should-i-collect-the-logs-on-the-server-side-using-rsyslog/286589 "2021-10-13T09:34:35Z")
I am trying to understand which architecture is better for me. I have a few hundreds of instances that I want to send their logs to one central server. Should I got with A (run rsyslog on the central server to collec… --- ## [Moving ML jobs and their data](https://discuss.elastic.co/t/moving-ml-jobs-and-their-data/136635)
**Author:** [@blueren](https://discuss.elastic.co/u/blueren)\ **Replies:** 7\ **Last updated:** [October 13, 2021, 11:38am UTC](https://discuss.elastic.co/t/moving-ml-jobs-and-their-data/136635 "2021-10-13T11:38:55Z")
I have a a few ml jobs saved and running in my local build. I would like to somehow export the same jobs on to another build that is running in a different machine. Is this possible? If so, how? Also, assuming that I've… --- ## [Migrating ML jobs to production environment?](https://discuss.elastic.co/t/migrating-ml-jobs-to-production-environment/286531)
**Author:** [@MLsuper](https://discuss.elastic.co/u/MLsuper)\ **Replies:** 1\ **Last updated:** [October 13, 2021, 11:36am UTC](https://discuss.elastic.co/t/migrating-ml-jobs-to-production-environment/286531 "2021-10-13T11:36:46Z")
From 2018 Moving ML jobs and their data it was not possible, but now is it possible? looking at this However when i go to stack management -\> machine learning (jobs list) there is no option to export, or even in the … --- ## [Can't connect hosts to the Fleet Server](https://discuss.elastic.co/t/cant-connect-hosts-to-the-fleet-server/286450)
**Author:** [@Dmitriy\_Esin](https://discuss.elastic.co/u/Dmitriy_Esin)\ **Replies:** 17\ **Last updated:** [October 13, 2021, 11:26am UTC](https://discuss.elastic.co/t/cant-connect-hosts-to-the-fleet-server/286450 "2021-10-13T11:26:17Z")
Hi all! I need your help! I have a self-hosted ELK (not cloud) I've enrolled the Fleet Server for SIEM using this manual for a self-managed server with default parameters in elastic-agent.yml I need to connect hosts … --- ## [Kibana standard security and reverse proxy requires login multiple times](https://discuss.elastic.co/t/kibana-standard-security-and-reverse-proxy-requires-login-multiple-times/286404)
**Author:** [@mrybinski](https://discuss.elastic.co/u/mrybinski)\ **Replies:** 2\ **Last updated:** [October 13, 2021, 11:23am UTC](https://discuss.elastic.co/t/kibana-standard-security-and-reverse-proxy-requires-login-multiple-times/286404 "2021-10-13T11:23:14Z")
Hello! I'm using basic Elastic Stack version 7.15 (Elasticsearch, Kibana, Logstash, Filebeat). To access Kibana I use IIS's URL Rewrite and reverse proxy. I wanted to deal with security warning by setting up minimal sec… --- ## [Elastic cluster,set up security,password setup all collide-native authentication](https://discuss.elastic.co/t/elastic-cluster-set-up-security-password-setup-all-collide-native-authentication/286448)
**Author:** [@Netanelp](https://discuss.elastic.co/u/Netanelp)\ **Replies:** 6\ **Last updated:** [October 13, 2021, 11:08am UTC](https://discuss.elastic.co/t/elastic-cluster-set-up-security-password-setup-all-collide-native-authentication/286448 "2021-10-13T11:08:49Z")
Hey guys, I will start with my main goal here, trying to move my elastic cluster to use native security/authentication. I've recently taken over a project involving an elastic cluster(Gold plan) trying to make it work … --- ## [Tree node clustrering master\_not\_discovered\_exception issue](https://discuss.elastic.co/t/tree-node-clustrering-master-not-discovered-exception-issue/286604)
**Author:** [@Ali\_Panahian](https://discuss.elastic.co/u/Ali_Panahian)\ **Replies:** 1\ **Last updated:** [October 13, 2021, 10:35am UTC](https://discuss.elastic.co/t/tree-node-clustrering-master-not-discovered-exception-issue/286604 "2021-10-13T10:35:37Z")
i have tree node cluster of ES, the issue is: when i stop one node the other nodes work fine and discover master node and everything works fine, but when is stop 2 node, the last one return master\_not\_discovered\_except… --- ## [Upgrade ES to 6.8 and Graylog to 4.0](https://discuss.elastic.co/t/upgrade-es-to-6-8-and-graylog-to-4-0/286586)
**Author:** [@vivir](https://discuss.elastic.co/u/vivir)\ **Replies:** 5\ **Last updated:** [October 13, 2021, 9:03am UTC](https://discuss.elastic.co/t/upgrade-es-to-6-8-and-graylog-to-4-0/286586 "2021-10-13T09:03:26Z")
I’m currently using graylog 3.3 and I’d like to upgrade to version 4.0. It looks like I need to upgrade Elasticsearch first ( currently using version 5.6). I’ve done research online but I can’t seem to find how to re-i… --- ## [Json Parsing](https://discuss.elastic.co/t/json-parsing/286277)
**Author:** [@John\_snow](https://discuss.elastic.co/u/John_snow)\ **Replies:** 7\ **Last updated:** [October 13, 2021, 9:21am UTC](https://discuss.elastic.co/t/json-parsing/286277 "2021-10-13T09:21:29Z")
i have event coming in my logstash as a json {"key1": "value1", "key2": "value2", "key3": {"key4": "value4"}} I wanted too put that event inside a key data like {"data" : { "key1": "value1", "ke… --- ## [Rsyslog, Logstash parse Error when incoming log is too big](https://discuss.elastic.co/t/rsyslog-logstash-parse-error-when-incoming-log-is-too-big/286513)
**Author:** [@Sequa](https://discuss.elastic.co/u/Sequa)\ **Replies:** 0\ **Last updated:** [October 12, 2021, 2:01pm UTC](https://discuss.elastic.co/t/rsyslog-logstash-parse-error-when-incoming-log-is-too-big/286513 "2021-10-12T14:01:30Z")
Hello, I have build a syslog server with web gui for this is use the ELK-Stack and configured Rsyslog. Everything is good and it works but when clients send log files that are more than 7999 characters long, I get the fo… --- ## [Grok pattern](https://discuss.elastic.co/t/grok-pattern/286575)
**Author:** [@Divya\_Bansal](https://discuss.elastic.co/u/Divya_Bansal)\ **Replies:** 2\ **Last updated:** [October 13, 2021, 8:54am UTC](https://discuss.elastic.co/t/grok-pattern/286575 "2021-10-13T08:54:36Z")
I have to parse this log- 05-10-21T13:17:20.457741775|lapideployment-547944bff7-4f2qr|1|iuser|20|0|25.090g|1.378g|68160|S|0.0|1.1|116:20.87|java|265 I am using pattern-%{TIMESTAMP\_ISO8601:timestamp}|%{DATA:pod}| It is… --- ## [Configuration parameter details \[cluster.initial\_master\_nodes\]](https://discuss.elastic.co/t/configuration-parameter-details-cluster-initial-master-nodes/286541)
**Author:** [@mrchile](https://discuss.elastic.co/u/mrchile)\ **Replies:** 2\ **Last updated:** [October 13, 2021, 8:49am UTC](https://discuss.elastic.co/t/configuration-parameter-details-cluster-initial-master-nodes/286541 "2021-10-13T08:49:50Z")
This is an excerpt from the official documentation and I would like to know. By cluster, I mean a combination of virtual machines on which one instance of elastic is installed. Node is a new instance of a virtual machine… --- ## [Unable to search for a Special Character using query\_string](https://discuss.elastic.co/t/unable-to-search-for-a-special-character-using-query-string/286596)
**Author:** [@paramzvik](https://discuss.elastic.co/u/paramzvik)\ **Replies:** 0\ **Last updated:** [October 13, 2021, 8:42am UTC](https://discuss.elastic.co/t/unable-to-search-for-a-special-character-using-query-string/286596 "2021-10-13T08:42:35Z")
Hi Developers, I am getting zero data after querying for a special character. Can some one help me with this. The query I am using is as follows. "query\_string" : { "query" : ""+"", "fields" : \[ "\_\_title" \], "defau… --- ## [Need to schedule a query](https://discuss.elastic.co/t/need-to-schedule-a-query/286360)
**Author:** [@SRIGURU\_VEL](https://discuss.elastic.co/u/SRIGURU_VEL)\ **Replies:** 2\ **Last updated:** [October 13, 2021, 7:03am UTC](https://discuss.elastic.co/t/need-to-schedule-a-query/286360 "2021-10-13T07:03:27Z")
Hi Experts, I want to schedule a query in kibana . Is any possibility to do that? will share you my query. PUT index/\_delete\_by\_query { "query":{"range":{"createdon":{"lt":"now-1d","format" : "yyyy-MM-dd HH:mm:ss"}… --- ## [Date histogram data precalculation](https://discuss.elastic.co/t/date-histogram-data-precalculation/286574)
**Author:** [@scorona85](https://discuss.elastic.co/u/scorona85)\ **Replies:** 1\ **Last updated:** [October 13, 2021, 6:58am UTC](https://discuss.elastic.co/t/date-histogram-data-precalculation/286574 "2021-10-13T06:58:24Z")
Hi, is there a way to perform operations on the data before creating the aggregation? In my example the aggregation is created and then the aggregate data is multiplied \* 10. I have to multiply the data and than aggrega… --- ## [Logstash plugin install error](https://discuss.elastic.co/t/logstash-plugin-install-error/286571)
**Author:** [@nigel.wadsworth](https://discuss.elastic.co/u/nigel.wadsworth)\ **Replies:** 0\ **Last updated:** [October 13, 2021, 6:19am UTC](https://discuss.elastic.co/t/logstash-plugin-install-error/286571 "2021-10-13T06:19:18Z")
Hi there. I have an on-prem Elastic stack implementation that needed the logstash github plugin. This isn't installed by default, and my stack is in an OT zone so is locked from the internet. To get round this, I foll… --- ## [Date histogram filter different math operations](https://discuss.elastic.co/t/date-histogram-filter-different-math-operations/286569)
**Author:** [@scorona85](https://discuss.elastic.co/u/scorona85)\ **Replies:** 0\ **Last updated:** [October 13, 2021, 6:10am UTC](https://discuss.elastic.co/t/date-histogram-filter-different-math-operations/286569 "2021-10-13T06:10:57Z")
Hi, how can I create a date histogram where I have this source datas: { "\_index" : "test-data-2021-6-24", "\_type" : "\_doc", "\_id" : "wB0PDnwBqyyjw7qp6Ih\_", "\_score" : 1.0, "\_… --- ## [Logstash Process](https://discuss.elastic.co/t/logstash-process/285886)
**Author:** [@adityaPsl](https://discuss.elastic.co/u/adityaPsl)\ **Replies:** 2\ **Last updated:** [October 13, 2021, 5:32am UTC](https://discuss.elastic.co/t/logstash-process/285886 "2021-10-13T05:32:26Z")
Hello Team, Just wanted to understand from logstash processes point , if I configure multiple pipelines on a single node(machine) will all the pipelines run under the single process (my understanding is it will run on s… --- ## [Getting timestamp inside timestamp](https://discuss.elastic.co/t/getting-timestamp-inside-timestamp/286511)
**Author:** [@Prasang-Biyani](https://discuss.elastic.co/u/Prasang-Biyani)\ **Replies:** 12\ **Last updated:** [October 13, 2021, 5:28am UTC](https://discuss.elastic.co/t/getting-timestamp-inside-timestamp/286511 "2021-10-13T05:28:05Z")
Hi Everyone, I am new to the Logstash, so please forgive me for asking silly question. I am trying to convert timestamp from the log file into @timestamp. Here is my logstash conf file. input { udp { port… --- ## [Elasticsearch ram size](https://discuss.elastic.co/t/elasticsearch-ram-size/286449)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 11\ **Last updated:** [October 13, 2021, 4:47am UTC](https://discuss.elastic.co/t/elasticsearch-ram-size/286449 "2021-10-13T04:47:28Z")
Hi Team, I have installed Elasticsearch on windows 2016 server for the first time with hardware configuration of 16GB ram, 64 - bit OS, 8 core. Now I want set the heap size of the elastic cluster. What heap size shoul… --- ## [Persistent queue corruption](https://discuss.elastic.co/t/persistent-queue-corruption/286412)
**Author:** [@franck.lefebure](https://discuss.elastic.co/u/franck.lefebure)\ **Replies:** 1\ **Last updated:** [October 13, 2021, 3:59am UTC](https://discuss.elastic.co/t/persistent-queue-corruption/286412 "2021-10-13T03:59:32Z")
Hi, I had a disk saturation on a logstash 5.6.8 installation I got to remove the "checkpoint.head" (0 bytes size) file to restart the pipeline Now I have theses files in queue dir : -rw-r--r-- 1 logstash logstash 262… --- ## [Deleted the winlog index by mistake](https://discuss.elastic.co/t/deleted-the-winlog-index-by-mistake/286565)
**Author:** [@Marcelle\_Lic](https://discuss.elastic.co/u/Marcelle_Lic)\ **Replies:** 1\ **Last updated:** [October 13, 2021, 3:49am UTC](https://discuss.elastic.co/t/deleted-the-winlog-index-by-mistake/286565 "2021-10-13T03:49:57Z")
I deleted my winlogbeat index by mistake and I have been trying hard to reindex the events but no luck for the last few weeks, either I get Root-error or code 404 or Invalid index name, an alias exists with the same na… --- ## [Elasticsearch giving creating index, cause \[auto(bulk api)\]](https://discuss.elastic.co/t/elasticsearch-giving-creating-index-cause-auto-bulk-api/286560)
**Author:** [@Aashish\_Goyal](https://discuss.elastic.co/u/Aashish_Goyal)\ **Replies:** 9\ **Last updated:** [October 13, 2021, 2:57am UTC](https://discuss.elastic.co/t/elasticsearch-giving-creating-index-cause-auto-bulk-api/286560 "2021-10-13T02:57:05Z")
I am facing issues that old indices are getting created automatically, as I am using fluentd as a log shipper to Elasticsearch. I am facing this issue since 2 days, dig very much for this but no result till now. I delete… --- ## [The best way to export specific data to lucene file like snapshot file](https://discuss.elastic.co/t/the-best-way-to-export-specific-data-to-lucene-file-like-snapshot-file/286557)
**Author:** [@lec\_ssmi](https://discuss.elastic.co/u/lec_ssmi)\ **Replies:** 2\ **Last updated:** [October 13, 2021, 2:18am UTC](https://discuss.elastic.co/t/the-best-way-to-export-specific-data-to-lucene-file-like-snapshot-file/286557 "2021-10-13T02:18:08Z")
I want to export some data according to specific condititons. But the rest api has a bad performance. In order to export the file as soon as possible, I can use snapshot. But snapshot can only be exported incrementally,… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1202) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1204)