# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1216 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1217 --- ## [ES index date format for date/timezone offset](https://discuss.elastic.co/t/es-index-date-format-for-date-timezone-offset/285718)
**Author:** [@earlsanchez](https://discuss.elastic.co/u/earlsanchez)\ **Replies:** 1\ **Last updated:** [October 2, 2021, 1:06am UTC](https://discuss.elastic.co/t/es-index-date-format-for-date-timezone-offset/285718 "2021-10-02T01:06:10Z")
Hello, We're using Elasticsearch v7.9. The date format of our mongod logs changed to this: 2021-09-26T03:23:46.515-0700 Now we're getting "\_dateparsefailure" during Logstash processing. I can't find a specific examp… --- ## [Ruby filter to extract different data elements from a string based on pattern](https://discuss.elastic.co/t/ruby-filter-to-extract-different-data-elements-from-a-string-based-on-pattern/285717)
**Author:** [@Indigo\_Star](https://discuss.elastic.co/u/Indigo_Star)\ **Replies:** 2\ **Last updated:** [October 2, 2021, 12:32am UTC](https://discuss.elastic.co/t/ruby-filter-to-extract-different-data-elements-from-a-string-based-on-pattern/285717 "2021-10-02T00:32:38Z")
Hi, I need to extract data from a field transaction which contains value as: Transaction = "CHE\_ECSTATE '-259297525' 19802619:-259297525{0}BEACH.TCN4(TCN4)ECN4/UTR023/ECTBR@20210929.162523.985 I need fields like CHE… --- ## [Logstash error - Bundler::GemNotFound: Could not find jar-dependencies-0.4.1 in any of the sources](https://discuss.elastic.co/t/logstash-error-bundler-could-not-find-jar-dependencies-0-4-1-in-any-of-the-sources/285658)
**Author:** [@Mario\_Sabetta](https://discuss.elastic.co/u/Mario_Sabetta)\ **Replies:** 0\ **Last updated:** [October 1, 2021, 8:15am UTC](https://discuss.elastic.co/t/logstash-error-bundler-could-not-find-jar-dependencies-0-4-1-in-any-of-the-sources/285658 "2021-10-01T08:15:08Z")
Hello everyone, I started logstash 7.15.0 and I encountered an event with the following error message and it tells me that the bundler cannot find the gem jar-dependencies-0.4.1. What needs to be done? Thanks for the at… --- ## [How can i parse log file and match specific strings with grok filter](https://discuss.elastic.co/t/how-can-i-parse-log-file-and-match-specific-strings-with-grok-filter/285115)
**Author:** [@hagaluly](https://discuss.elastic.co/u/hagaluly)\ **Replies:** 4\ **Last updated:** [October 1, 2021, 9:57pm UTC](https://discuss.elastic.co/t/how-can-i-parse-log-file-and-match-specific-strings-with-grok-filter/285115 "2021-10-01T21:57:55Z")
i have a log that looks like this BUILD\_DISPLAY\_NAME=#998 BUILD\_NUMBER=998 JENKINS\_URL=https:///jenkins.com BUILD\_ID=998 DEVICE\_CRED\_PSW=pass GIT\_PREVIOUS\_SUCCESSFUL\_COMMIT=f847h56934875f6239487562j3498 JOB\_BASE\_NAME=ma… --- ## [Index template with date attached to end](https://discuss.elastic.co/t/index-template-with-date-attached-to-end/285708)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [October 1, 2021, 7:07pm UTC](https://discuss.elastic.co/t/index-template-with-date-attached-to-end/285708 "2021-10-01T19:07:08Z")
I am trying to put template which can be use to rotate index. these are the steps but not working PUT \_index\_template/system-fs { "template": { "settings": { "index": { "lifecycle": { "name… --- ## [Stream data from elasticsearch](https://discuss.elastic.co/t/stream-data-from-elasticsearch/285710)
**Author:** [@Aswin\_Jose](https://discuss.elastic.co/u/Aswin_Jose)\ **Replies:** 0\ **Last updated:** [October 1, 2021, 7:03pm UTC](https://discuss.elastic.co/t/stream-data-from-elasticsearch/285710 "2021-10-01T19:03:47Z")
How to stream records one by one from Elasticsearch? --- ## [If "keyword" in message not working for logstash](https://discuss.elastic.co/t/if-keyword-in-message-not-working-for-logstash/285622)
**Author:** [@kriss332](https://discuss.elastic.co/u/kriss332)\ **Replies:** 7\ **Last updated:** [October 1, 2021, 6:47pm UTC](https://discuss.elastic.co/t/if-keyword-in-message-not-working-for-logstash/285622 "2021-10-01T18:47:41Z")
Hello all... I am receiving logs from 5 different sources on one single port. In fact it is a collection of files being sent through syslog from a server in realtime. The server stores logs from 4 VPN servers and one DN… --- ## [How to involve KQL search bar in Kibana Plugin](https://discuss.elastic.co/t/how-to-involve-kql-search-bar-in-kibana-plugin/283153)
**Author:** [@yyyayo](https://discuss.elastic.co/u/yyyayo)\ **Replies:** 5\ **Last updated:** [October 1, 2021, 6:55pm UTC](https://discuss.elastic.co/t/how-to-involve-kql-search-bar-in-kibana-plugin/283153 "2021-10-01T18:55:46Z")
Are there any ways I can have this KQL search bar in my own plugin? By default, the plugin only contains the time filter on the right. --- ## [Syntax error in painless script in watcher](https://discuss.elastic.co/t/syntax-error-in-painless-script-in-watcher/284438)
**Author:** [@bcaillat](https://discuss.elastic.co/u/bcaillat)\ **Replies:** 3\ **Last updated:** [October 1, 2021, 6:53pm UTC](https://discuss.elastic.co/t/syntax-error-in-painless-script-in-watcher/284438 "2021-10-01T18:53:33Z")
Hello! I'm trying to create a watcher with a condition that uses a Map and keep getting a syntax error. For example the following code does not compile: "condition": { "script": { "source": """ Map… --- ## [SLM Policy Not Being Followed?](https://discuss.elastic.co/t/slm-policy-not-being-followed/285700)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 2\ **Last updated:** [October 1, 2021, 6:46pm UTC](https://discuss.elastic.co/t/slm-policy-not-being-followed/285700 "2021-10-01T18:46:57Z")
Hi All, I'm attempting to debug an issue, and while attempting to debug said issue, I noticed potentially another issue where SLM isn't properly cleaning up snapshots. Has anyone seen this issue before or know why it's… --- ## [Strange behavior in logstash after remove field message](https://discuss.elastic.co/t/strange-behavior-in-logstash-after-remove-field-message/285524)
**Author:** [@gbeltramelli](https://discuss.elastic.co/u/gbeltramelli)\ **Replies:** 1\ **Last updated:** [October 1, 2021, 6:11pm UTC](https://discuss.elastic.co/t/strange-behavior-in-logstash-after-remove-field-message/285524 "2021-10-01T18:11:25Z")
Hi, first of all sorry for my english! im using version 7.14 of ELK and i\`m having some strange behavior when using mutate { remove\_field =\> \[ "message" \] } I have some logs from a DataPower then I use GROK to make … --- ## [Elasticsearch seems to redact/obfuscate IP addresses in index names](https://discuss.elastic.co/t/elasticsearch-seems-to-redact-obfuscate-ip-addresses-in-index-names/285704)
**Author:** [@romull](https://discuss.elastic.co/u/romull)\ **Replies:** 0\ **Last updated:** [October 1, 2021, 6:10pm UTC](https://discuss.elastic.co/t/elasticsearch-seems-to-redact-obfuscate-ip-addresses-in-index-names/285704 "2021-10-01T18:10:49Z")
Hi there! I am creating dynamic index names with logstash. The name contains dynamic content such as the date and IP address of the hosts monitored. Everything works. The indices are created with the proper name as I ex… --- ## [Fleet Server - \* missing enrollment api key](https://discuss.elastic.co/t/fleet-server-missing-enrollment-api-key/283339)
**Author:** [@bevano](https://discuss.elastic.co/u/bevano)\ **Replies:** 11\ **Last updated:** [October 1, 2021, 5:22pm UTC](https://discuss.elastic.co/t/fleet-server-missing-enrollment-api-key/283339 "2021-10-01T17:22:13Z")
Hey All, Recently upgraded to 7.14.1 to and am struggling to install fleet server. I am running on-prem and have my self-signed certs setup. Trying to install fleet-server on the same node where elasticsearch is install… --- ## [Grok pattern for IPv6 not working with %{IPORHOST} - Azure Logs - Filebeat 7.14.1](https://discuss.elastic.co/t/grok-pattern-for-ipv6-not-working-with-iporhost-azure-logs-filebeat-7-14-1/285699)
**Author:** [@smandolare](https://discuss.elastic.co/u/smandolare)\ **Replies:** 0\ **Last updated:** [October 1, 2021, 5:09pm UTC](https://discuss.elastic.co/t/grok-pattern-for-ipv6-not-working-with-iporhost-azure-logs-filebeat-7-14-1/285699 "2021-10-01T17:09:11Z")
Elasticsearch is failing to index events with a 400 error attempting to parse an IPv6 event in the Azure Platform Pipeline: "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse field \[… --- ## [How to get related field from highlighting with nested fields in the document](https://discuss.elastic.co/t/how-to-get-related-field-from-highlighting-with-nested-fields-in-the-document/285696)
**Author:** [@muns](https://discuss.elastic.co/u/muns)\ **Replies:** 0\ **Last updated:** [October 1, 2021, 4:57pm UTC](https://discuss.elastic.co/t/how-to-get-related-field-from-highlighting-with-nested-fields-in-the-document/285696 "2021-10-01T16:57:16Z")
I search for the contents of a book, which is in an array of books and the array is part of a bookstore. I have the highlighting working, however it does not tell me which book was hit. How do I get the book id? index: … --- ## [Failed to start logstash](https://discuss.elastic.co/t/failed-to-start-logstash/285278)
**Author:** [@ts5366](https://discuss.elastic.co/u/ts5366)\ **Replies:** 6\ **Last updated:** [October 1, 2021, 4:27pm UTC](https://discuss.elastic.co/t/failed-to-start-logstash/285278 "2021-10-01T16:27:11Z")
input { kinesis { application\_name =\> "stat\_events" kinesis\_stream\_name =\> "events" region =\> "us-east-1" codec =\> gzip\_lines {} initial\_position\_in\_stream =\> "LATEST" } } output { stdout { … --- ## [200 primary shards 200 unassigned](https://discuss.elastic.co/t/200-primary-shards-200-unassigned/285688)
**Author:** [@sebux](https://discuss.elastic.co/u/sebux)\ **Replies:** 1\ **Last updated:** [October 1, 2021, 3:00pm UTC](https://discuss.elastic.co/t/200-primary-shards-200-unassigned/285688 "2021-10-01T15:00:12Z")
Hello I'm new to ES. I'm trying to understand what does this mean . When I curl the cluster health status I'm seing 200 primary shards and 200 unassigned shards. Does this have an impact on my cluster? Sebux --- ## [Possibility to update global variables](https://discuss.elastic.co/t/possibility-to-update-global-variables/284359)
**Author:** [@CalvinHobbes](https://discuss.elastic.co/u/CalvinHobbes)\ **Replies:** 1\ **Last updated:** [October 1, 2021, 2:57pm UTC](https://discuss.elastic.co/t/possibility-to-update-global-variables/284359 "2021-10-01T14:57:57Z")
Is there a possibility to update global variables in Canvas so that these can be referenced (and updated) between elements? --- ## [Does ES support array of dense vectors?](https://discuss.elastic.co/t/does-es-support-array-of-dense-vectors/285687)
**Author:** [@Fred\_Kufner](https://discuss.elastic.co/u/Fred_Kufner)\ **Replies:** 0\ **Last updated:** [October 1, 2021, 2:46pm UTC](https://discuss.elastic.co/t/does-es-support-array-of-dense-vectors/285687 "2021-10-01T14:46:45Z")
I am having problems updating a document with an array of dense vectors. According to the documentation (and empirically by my code in other areas) , In Elasticsearch, there is no dedicated array data type. Any field can… --- ## [Curator stopped working after 7.14.0 upgrade (KeyError: indices)](https://discuss.elastic.co/t/curator-stopped-working-after-7-14-0-upgrade-keyerror-indices/285578)
**Author:** [@hunsw](https://discuss.elastic.co/u/hunsw)\ **Replies:** 5\ **Last updated:** [October 1, 2021, 2:02pm UTC](https://discuss.elastic.co/t/curator-stopped-working-after-7-14-0-upgrade-keyerror-indices/285578 "2021-10-01T14:02:06Z")
After upgrading Elasticsearch from 7.10 to 7.14, Curator 5.4.8 has stopped working: simple delete jobs, create alias jobs, etc. that previously worked fine are now throwing this error: 2021-09-29 15:12:25,343 DEBUG … --- ## [Passing essql statements in Workpad Variables](https://discuss.elastic.co/t/passing-essql-statements-in-workpad-variables/284367)
**Author:** [@CalvinHobbes](https://discuss.elastic.co/u/CalvinHobbes)\ **Replies:** 1\ **Last updated:** [October 1, 2021, 1:59pm UTC](https://discuss.elastic.co/t/passing-essql-statements-in-workpad-variables/284367 "2021-10-01T13:59:29Z")
I am trying to pass essql statements in Workpad variables, but the elements are not recoqnizing it as valid essql statements. I suspect it has to do with escaping of special characters: is this possible to do? --- ## [How can i check if the value of the field is an array?](https://discuss.elastic.co/t/how-can-i-check-if-the-value-of-the-field-is-an-array/285087)
**Author:** [@Aurel\_Drejta](https://discuss.elastic.co/u/Aurel_Drejta)\ **Replies:** 1\ **Last updated:** [October 1, 2021, 1:22pm UTC](https://discuss.elastic.co/t/how-can-i-check-if-the-value-of-the-field-is-an-array/285087 "2021-10-01T13:22:48Z")
Hi everyone, By accident i inserted some values as arrays inside the index, when the actual value should have been a string. This is the wrong value : { "hits" : \[ { "\_index" : "en\_file", "\_type"… --- ## [Index Stats kibana](https://discuss.elastic.co/t/index-stats-kibana/283688)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 1\ **Last updated:** [October 1, 2021, 1:13pm UTC](https://discuss.elastic.co/t/index-stats-kibana/283688 "2021-10-01T13:13:50Z")
Hello ! I have seen that in kibana you can consult statistics of an index. Can this metadata be consulted as one more field and viewed on a dashboard? i tried this but it only returns empty fields. Thanks in ad… --- ## [Automatically download dashboard csv file by api fail](https://discuss.elastic.co/t/automatically-download-dashboard-csv-file-by-api-fail/284441)
**Author:** [@luckygoodlily](https://discuss.elastic.co/u/luckygoodlily)\ **Replies:** 1\ **Last updated:** [October 1, 2021, 1:05pm UTC](https://discuss.elastic.co/t/automatically-download-dashboard-csv-file-by-api-fail/284441 "2021-10-01T13:05:24Z")
Hello, we are developing a project for company, and we are working with the ELK stack. I have a problem that I have some visualizations in Dashboard and I want to download csv file by shell script (Automatically generat… --- ## [URL drilldown for Count in a visualization](https://discuss.elastic.co/t/url-drilldown-for-count-in-a-visualization/285192)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 3\ **Last updated:** [October 1, 2021, 1:00pm UTC](https://discuss.elastic.co/t/url-drilldown-for-count-in-a-visualization/285192 "2021-10-01T13:00:23Z")
Hi all, I'm trying to give count for a visualization . I want to see which are those count of users. Is there an option to give URl drilldown for count or is there any turnaround? I already have an URL drilldown f… --- ## [ASA Single Grok Filter Not Working](https://discuss.elastic.co/t/asa-single-grok-filter-not-working/285627)
**Author:** [@Micah\_Barsness](https://discuss.elastic.co/u/Micah_Barsness)\ **Replies:** 3\ **Last updated:** [October 1, 2021, 12:51pm UTC](https://discuss.elastic.co/t/asa-single-grok-filter-not-working/285627 "2021-10-01T12:51:31Z")
Hi, so I'm using several grok filters to parse out different messages. My config is a bit messy now because I feel like i've tried everything. Logs are being properly parsed through pre-made filters and one custom one s… --- ## [Elasticsearch and logstash problem](https://discuss.elastic.co/t/elasticsearch-and-logstash-problem/285540)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 2\ **Last updated:** [October 1, 2021, 11:12am UTC](https://discuss.elastic.co/t/elasticsearch-and-logstash-problem/285540 "2021-10-01T11:12:22Z")
Hello everyone. I have a problem with logstash and Elasticsearch. I would like to explain my problem with an example. I have two conf files, first example\_A.conf and second example\_B.conf. I am loading data from example\_… --- ## [Change kibana logo](https://discuss.elastic.co/t/change-kibana-logo/285136)
**Author:** [@byul](https://discuss.elastic.co/u/byul)\ **Replies:** 1\ **Last updated:** [October 1, 2021, 11:03am UTC](https://discuss.elastic.co/t/change-kibana-logo/285136 "2021-10-01T11:03:27Z")
Hello everybody, can someone please help change the kibana logo, I tried changing favicons like it was stated here Custom Logo Kibana 7.9.2 (guide) by replacing the images by my own custom logo but nothing changed (see i… --- ## [Export file inside pod kubernetes](https://discuss.elastic.co/t/export-file-inside-pod-kubernetes/285668)
**Author:** [@fferraro87](https://discuss.elastic.co/u/fferraro87)\ **Replies:** 0\ **Last updated:** [October 1, 2021, 10:48am UTC](https://discuss.elastic.co/t/export-file-inside-pod-kubernetes/285668 "2021-10-01T10:48:38Z")
Hi, i'm trying to export some file from pods inside my cluster k8s. now i've that configmap : apiVersion: v1 kind: ConfigMap metadata: name: filebeat-config namespace: kube-system labels: k8s-app: filebeat d… --- ## [Make Kibana accessible from a path of an existing domain](https://discuss.elastic.co/t/make-kibana-accessible-from-a-path-of-an-existing-domain/285241)
**Author:** [@Satkay](https://discuss.elastic.co/u/Satkay)\ **Replies:** 1\ **Last updated:** [October 1, 2021, 10:23am UTC](https://discuss.elastic.co/t/make-kibana-accessible-from-a-path-of-an-existing-domain/285241 "2021-10-01T10:23:14Z")
Hi Forum, I'm trying to deploy Elastic in Google cloud using ECK and need to expose Kibana UI via Istio Gateway. Something like this. test.com/kibana --\> Should go to Kibana test.com/elastic --\> Should go to elastic. … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1215) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1217)