# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1258 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1259 --- ## [Logstash filter file issue](https://discuss.elastic.co/t/logstash-filter-file-issue/282993)
**Author:** [@Nazakat](https://discuss.elastic.co/u/Nazakat)\ **Replies:** 0\ **Last updated:** [September 1, 2021, 6:25am UTC](https://discuss.elastic.co/t/logstash-filter-file-issue/282993 "2021-09-01T06:25:17Z")
My winlogbeat new version is not parsing. new version is 7.14.0 and old version is same filter files is parse. --- ## [GEO data losing definition after changing index name](https://discuss.elastic.co/t/geo-data-losing-definition-after-changing-index-name/282917)
**Author:** [@john12](https://discuss.elastic.co/u/john12)\ **Replies:** 2\ **Last updated:** [September 1, 2021, 5:17am UTC](https://discuss.elastic.co/t/geo-data-losing-definition-after-changing-index-name/282917 "2021-09-01T05:17:21Z")
Hello , i was having geo data with no problems and visualize it on maps, after changing the index name then it not appeared as geo data. would u help me solve this? --- ## [Making a new field indexable on a index under rollover policy](https://discuss.elastic.co/t/making-a-new-field-indexable-on-a-index-under-rollover-policy/282931)
**Author:** [@Baygon](https://discuss.elastic.co/u/Baygon)\ **Replies:** 3\ **Last updated:** [September 1, 2021, 2:07am UTC](https://discuss.elastic.co/t/making-a-new-field-indexable-on-a-index-under-rollover-policy/282931 "2021-09-01T02:07:13Z")
Hi, We have an index under rollover policy/index template for which we need to update the mapping to make a field searchable (initially set up to index: false but now needed). What would be the right process? I'm thin… --- ## [Simple full search](https://discuss.elastic.co/t/simple-full-search/282939)
**Author:** [@Chen\_Shacham](https://discuss.elastic.co/u/Chen_Shacham)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 12:46am UTC](https://discuss.elastic.co/t/simple-full-search/282939 "2021-09-01T00:46:04Z")
Hi I am using REST api to search my index. How can i use search api to look for phrase: "My name" in all fields? --- ## [Cross Cluster Replication query](https://discuss.elastic.co/t/cross-cluster-replication-query/282906)
**Author:** [@Bryce\_Fernandes](https://discuss.elastic.co/u/Bryce_Fernandes)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 12:45am UTC](https://discuss.elastic.co/t/cross-cluster-replication-query/282906 "2021-09-01T00:45:15Z")
Hi, For CCR when a leader index is created in cluster A will replica be created in cluster A as well as cluster B or only cluster B considering replicas set to 1. Regards, Bryce Fernandes. --- ## [TSVB - Sum of value for unique records](https://discuss.elastic.co/t/tsvb-sum-of-value-for-unique-records/282967)
**Author:** [@Athul\_Devkar](https://discuss.elastic.co/u/Athul_Devkar)\ **Replies:** 2\ **Last updated:** [September 1, 2021, 12:29am UTC](https://discuss.elastic.co/t/tsvb-sum-of-value-for-unique-records/282967 "2021-09-01T00:29:39Z")
Is there anyway I can filter unique records and then find the sum of value for those unique records? Data example: Order# - TotalMRC O101 - $120 O101 - $120(duplicate record) O102 - $130 O103 - $120 Expected resul… --- ## [How to make alerts with telegram bot?](https://discuss.elastic.co/t/how-to-make-alerts-with-telegram-bot/282794)
**Author:** [@sevenout](https://discuss.elastic.co/u/sevenout)\ **Replies:** 1\ **Last updated:** [August 31, 2021, 10:48pm UTC](https://discuss.elastic.co/t/how-to-make-alerts-with-telegram-bot/282794 "2021-08-31T22:48:10Z")
hi guys, i'm learning Elasticsearch but i stumble in this problem. i want to send an alert from elastic to telegram. In short this is the result that i expect: i use webhook connector and this is the config b… --- ## [Is there a converter from a search in kibana to query language?](https://discuss.elastic.co/t/is-there-a-converter-from-a-search-in-kibana-to-query-language/282954)
**Author:** [@Dovan](https://discuss.elastic.co/u/Dovan)\ **Replies:** 1\ **Last updated:** [August 31, 2021, 10:15pm UTC](https://discuss.elastic.co/t/is-there-a-converter-from-a-search-in-kibana-to-query-language/282954 "2021-08-31T22:15:52Z")
I would like to know if there is any program or some type of converter from a search to a query language in kibana --- ## [Migrating indices after adding warm and cold nodes to an existing cluster](https://discuss.elastic.co/t/migrating-indices-after-adding-warm-and-cold-nodes-to-an-existing-cluster/282830)
**Author:** [@benvl](https://discuss.elastic.co/u/benvl)\ **Replies:** 3\ **Last updated:** [August 31, 2021, 10:15pm UTC](https://discuss.elastic.co/t/migrating-indices-after-adding-warm-and-cold-nodes-to-an-existing-cluster/282830 "2021-08-31T22:15:22Z")
Hi all, following situation : we have an existing 7.12 ES cluster in Elastic Cloud, with 2 hot data nodes. Multiple indices exist which were following an hot-warm-cold ILM policy and are already in a hot, warm or cold p… --- ## [Filter out signals that are produced too often by one user](https://discuss.elastic.co/t/filter-out-signals-that-are-produced-too-often-by-one-user/282553)
**Author:** [@lina1](https://discuss.elastic.co/u/lina1)\ **Replies:** 3\ **Last updated:** [August 31, 2021, 9:49pm UTC](https://discuss.elastic.co/t/filter-out-signals-that-are-produced-too-often-by-one-user/282553 "2021-08-31T21:49:19Z")
Hi all, I am working for a software company and we use Elasticsearch and Kibana to monitor the signals that our clients send. For that we implemented signals, that include a UserID and unique errorcodes. The problem is… --- ## [Set ilm , rollup in curator](https://discuss.elastic.co/t/set-ilm-rollup-in-curator/282749)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 5\ **Last updated:** [August 31, 2021, 9:47pm UTC](https://discuss.elastic.co/t/set-ilm-rollup-in-curator/282749 "2021-08-31T21:47:42Z")
I want to do some actions like: create ilm set ilm for indices create rollup jobs for indices Is this possible to do with elsaticsearch-curator? --- ## [Parsing JSON objects within Square Brackets](https://discuss.elastic.co/t/parsing-json-objects-within-square-brackets/282953)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 1\ **Last updated:** [August 31, 2021, 9:46pm UTC](https://discuss.elastic.co/t/parsing-json-objects-within-square-brackets/282953 "2021-08-31T21:46:59Z")
I'm using an API to get JSON objects, but the API formats the JSON objects within square brackets as an array and splits the objects within the array by commas. Can anyone help me with parsing this JSON with Logstash. I'… --- ## [GKE cos\_containerd node make filebeat unable to sending logs out](https://discuss.elastic.co/t/gke-cos-containerd-node-make-filebeat-unable-to-sending-logs-out/282961)
**Author:** [@Vincent\_Ngai](https://discuss.elastic.co/u/Vincent_Ngai)\ **Replies:** 0\ **Last updated:** [August 31, 2021, 8:33pm UTC](https://discuss.elastic.co/t/gke-cos-containerd-node-make-filebeat-unable-to-sending-logs-out/282961 "2021-08-31T20:33:58Z")
Hi All We are using GKE , however after 1.19 version gke side will default select cos\_containerd as their new node image type( for remove the docker stuff) We afraid the docker version node will remove in future time … --- ## [How to change routing value for existed routed data?](https://discuss.elastic.co/t/how-to-change-routing-value-for-existed-routed-data/280689)
**Author:** [@judy\_gao](https://discuss.elastic.co/u/judy_gao)\ **Replies:** 4\ **Last updated:** [August 31, 2021, 8:00pm UTC](https://discuss.elastic.co/t/how-to-change-routing-value-for-existed-routed-data/280689 "2021-08-31T20:00:56Z")
I have an existed index which is "\_routing" required as true. So all data is already routed to particular shards based on "\_routing" value. Right now we're using a customized routing value like "organization id" to route… --- ## [Azure event hub azure.activitylogs.properties](https://discuss.elastic.co/t/azure-event-hub-azure-activitylogs-properties/282907)
**Author:** [@graimato](https://discuss.elastic.co/u/graimato)\ **Replies:** 1\ **Last updated:** [August 31, 2021, 7:13pm UTC](https://discuss.elastic.co/t/azure-event-hub-azure-activitylogs-properties/282907 "2021-08-31T19:13:53Z")
Hello, I'm trying to analyze the information from cloud Azure. I have activated the EventHub and I receive the log, but i have data form Azure Appgataway like azure.activitylogs.properties { "receivedBytes": 65, "s… --- ## [Caused by: org.elasticsearch.action.search.SearchPhaseExecutionException](https://discuss.elastic.co/t/caused-by-org-elasticsearch-action-search-searchphaseexecutionexception/282914)
**Author:** [@Pradeep\_Patil](https://discuss.elastic.co/u/Pradeep_Patil)\ **Replies:** 1\ **Last updated:** [August 31, 2021, 7:12pm UTC](https://discuss.elastic.co/t/caused-by-org-elasticsearch-action-search-searchphaseexecutionexception/282914 "2021-08-31T19:12:09Z")
Caused by: org.elasticsearch.action.search.SearchPhaseExecutionException: Search rejected due to missing shards \[\[.kibana\_task\_manager\_7.14.0\_001\]\[0\]\]. Consider using allow\_partial\_search\_results setting to bypass this e… --- ## [Errors with a "does not exist" query](https://discuss.elastic.co/t/errors-with-a-does-not-exist-query/282846)
**Author:** [@variable](https://discuss.elastic.co/u/variable)\ **Replies:** 2\ **Last updated:** [August 31, 2021, 7:07pm UTC](https://discuss.elastic.co/t/errors-with-a-does-not-exist-query/282846 "2021-08-31T19:07:47Z")
I am trying to determine if this is a bug before opening an Issue. I am trying to create a query to return results when a field does not have any data. These work and return results (but not what I'm looking for): eve… --- ## [TSVB Item URL doesn't work in new Kibana versions](https://discuss.elastic.co/t/tsvb-item-url-doesnt-work-in-new-kibana-versions/282952)
**Author:** [@BitBucketUser\_user](https://discuss.elastic.co/u/BitBucketUser_user)\ **Replies:** 1\ **Last updated:** [August 31, 2021, 6:08pm UTC](https://discuss.elastic.co/t/tsvb-item-url-doesnt-work-in-new-kibana-versions/282952 "2021-08-31T18:08:07Z")
Hello, The ITEM URL option of TSVB Table was working fine in the 7.12 version of Kibana. I'm now using Kibana - 7.13.3 and this option doesn't seem to work. Adding a URL in the ITEM URL section, results in the first co… --- ## [Do I need to follow Full-cluster restart steps for 1 Node](https://discuss.elastic.co/t/do-i-need-to-follow-full-cluster-restart-steps-for-1-node/282269)
**Author:** [@Zabulon](https://discuss.elastic.co/u/Zabulon)\ **Replies:** 4\ **Last updated:** [August 31, 2021, 5:53pm UTC](https://discuss.elastic.co/t/do-i-need-to-follow-full-cluster-restart-steps-for-1-node/282269 "2021-08-31T17:53:37Z")
Hi everyone, We had some discussion at the office about restarting a node or service when there is 1 node only issue. Some people find that it is a bit awkwark to follow the step from "Full-cluster restart" document… --- ## [Did not find the logs in google-cloud-storage pushed by logstash](https://discuss.elastic.co/t/did-not-find-the-logs-in-google-cloud-storage-pushed-by-logstash/282950)
**Author:** [@Xiaochi\_Weng](https://discuss.elastic.co/u/Xiaochi_Weng)\ **Replies:** 0\ **Last updated:** [August 31, 2021, 5:43pm UTC](https://discuss.elastic.co/t/did-not-find-the-logs-in-google-cloud-storage-pushed-by-logstash/282950 "2021-08-31T17:43:07Z")
Hello, I recently opened a google cloud account and installed the plugins. Here is my code: input{ udp{ port=\>55514 type=\>"syslog" } } output{ google\_cloud\_storage { bucket =\> "test-logstash-gcp-send-function" … --- ## [Configure certificate for repository-s3 with ceph](https://discuss.elastic.co/t/configure-certificate-for-repository-s3-with-ceph/282645)
**Author:** [@raphaelSeguin](https://discuss.elastic.co/u/raphaelSeguin)\ **Replies:** 5\ **Last updated:** [August 31, 2021, 5:24pm UTC](https://discuss.elastic.co/t/configure-certificate-for-repository-s3-with-ceph/282645 "2021-08-31T17:24:04Z")
Hi All, I'm having a hard time setting up a repository with repository-s3 plugin and a ceph object store. I'm using elasticsearch:7.13.2 I used the following configurations: in elasticsearch.yml: s3: client: d… --- ## [Logstash plugin exec error: Port number ended with '\\'](https://discuss.elastic.co/t/logstash-plugin-exec-error-port-number-ended-with/282947)
**Author:** [@nayeli\_hernandez](https://discuss.elastic.co/u/nayeli_hernandez)\ **Replies:** 0\ **Last updated:** [August 31, 2021, 4:46pm UTC](https://discuss.elastic.co/t/logstash-plugin-exec-error-port-number-ended-with/282947 "2021-08-31T16:46:48Z")
Hi, I want to execute a CURL aggreation in Logstash & schedule it every 1 mins and store the data in elastic search. I'm using exec logstash plugin to do, here is my code: input{ exec{ codec =\> json command =\>"cu… --- ## [ES 6.8 issue with percolate search on documents with a join field](https://discuss.elastic.co/t/es-6-8-issue-with-percolate-search-on-documents-with-a-join-field/282851)
**Author:** [@noe](https://discuss.elastic.co/u/noe)\ **Replies:** 1\ **Last updated:** [August 31, 2021, 4:13pm UTC](https://discuss.elastic.co/t/es-6-8-issue-with-percolate-search-on-documents-with-a-join-field/282851 "2021-08-31T16:13:03Z")
I'm working on updating ES mappings and searching within an application from 5.6 to 6.8. The relevant change around this is that I merged multi-type mapping of an index into a single type and now use a custom 'type' fiel… --- ## [Timezone parameter has no impact in Date filter plugin](https://discuss.elastic.co/t/timezone-parameter-has-no-impact-in-date-filter-plugin/282935)
**Author:** [@6igwig](https://discuss.elastic.co/u/6igwig)\ **Replies:** 2\ **Last updated:** [August 31, 2021, 4:10pm UTC](https://discuss.elastic.co/t/timezone-parameter-has-no-impact-in-date-filter-plugin/282935 "2021-08-31T16:10:35Z")
TLDR: my timestamp value is already in UTC, I am trying to prevent elastic from converting it to UTC again. I am using the JDBC input in logstash to query a SQL server database. When I look at a specific record in SQL S… --- ## [Retrieve value & key from json to build data table kibana](https://discuss.elastic.co/t/retrieve-value-key-from-json-to-build-data-table-kibana/282940)
**Author:** [@Mira\_9](https://discuss.elastic.co/u/Mira_9)\ **Replies:** 0\ **Last updated:** [August 31, 2021, 3:37pm UTC](https://discuss.elastic.co/t/retrieve-value-key-from-json-to-build-data-table-kibana/282940 "2021-08-31T15:37:56Z")
hey, i'm extracting data from Json file and displaying it in Kibana. i want to create a data table displaying the details for each id and for each category. How can i extract properly the key and the value from the mes… --- ## [Metricbeat socket stats - metricbeat](https://discuss.elastic.co/t/metricbeat-socket-stats-metricbeat/282936)
**Author:** [@vee](https://discuss.elastic.co/u/vee)\ **Replies:** 0\ **Last updated:** [August 31, 2021, 3:06pm UTC](https://discuss.elastic.co/t/metricbeat-socket-stats-metricbeat/282936 "2021-08-31T15:06:13Z")
hi - trying to enable metricbeat socket stats on linux server (VM). Tried following the documentation steps, but still don't see the socket stats sent to elastic. We are running metricbeat as root and so permissions is n… --- ## [How does elasticsearch query work for an index pattern in a given interval](https://discuss.elastic.co/t/how-does-elasticsearch-query-work-for-an-index-pattern-in-a-given-interval/282877)
**Author:** [@vikasp](https://discuss.elastic.co/u/vikasp)\ **Replies:** 2\ **Last updated:** [August 31, 2021, 3:11pm UTC](https://discuss.elastic.co/t/how-does-elasticsearch-query-work-for-an-index-pattern-in-a-given-interval/282877 "2021-08-31T15:11:56Z")
Hi, I was restoring few indices and then observed some shard errors saying shard should be either started or in POST Recovery state when trying to load some dashboards/visualizations while few indices are being restored… --- ## [Why Rally extract 1001 docs in --test-mode?](https://discuss.elastic.co/t/why-rally-extract-1001-docs-in-test-mode/282836)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 5\ **Last updated:** [August 31, 2021, 3:06pm UTC](https://discuss.elastic.co/t/why-rally-extract-1001-docs-in-test-mode/282836 "2021-08-31T15:06:08Z")
Hey there, extracting a custom track from an existing cluster I faced a strange behaviour. Rally extracts 1001 docs while it should extract exactly 1000 docs. When I try to import it with the flag --test-mode I get thi… --- ## [Parsing duration with 00:00:00 format](https://discuss.elastic.co/t/parsing-duration-with-0000-format/281284)
**Author:** [@Sketchy](https://discuss.elastic.co/u/Sketchy)\ **Replies:** 6\ **Last updated:** [August 31, 2021, 3:00pm UTC](https://discuss.elastic.co/t/parsing-duration-with-0000-format/281284 "2021-08-31T15:00:34Z")
I have a CSV that has multiple durations that are in seconds but one of the columns has the duration as 00:00:30 for 30 seconds for example. I cant work out how to get that into seconds/integer easily. I can think of a f… --- ## [Convert mysql point schema to geo\_point type through logstash please tell me how](https://discuss.elastic.co/t/convert-mysql-point-schema-to-geo-point-type-through-logstash-please-tell-me-how/282879)
**Author:** [@Gi\_seong\_Lee](https://discuss.elastic.co/u/Gi_seong_Lee)\ **Replies:** 1\ **Last updated:** [August 31, 2021, 2:57pm UTC](https://discuss.elastic.co/t/convert-mysql-point-schema-to-geo-point-type-through-logstash-please-tell-me-how/282879 "2021-08-31T14:57:26Z")
In various internets, there are many data that convert longitude and latitude variables to geo\_point by separately specifying them as double type. But I want to convert one Mysql's point type variable to geo\_point. How c… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1257) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1259)