# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1278 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1279 --- ## [Events beat](https://discuss.elastic.co/t/events-beat/281666)
**Author:** [@jubin03](https://discuss.elastic.co/u/jubin03)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 11:22am UTC](https://discuss.elastic.co/t/events-beat/281666 "2021-08-17T11:22:12Z")
Is it possible to fetch events via API to beats and shipped to log stash or elastic search --- ## [CITRIX NETSCALER](https://discuss.elastic.co/t/citrix-netscaler/281663)
**Author:** [@Hoffmann\_Patrick](https://discuss.elastic.co/u/Hoffmann_Patrick)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 10:14am UTC](https://discuss.elastic.co/t/citrix-netscaler/281663 "2021-08-17T10:14:08Z")
Bonjour, J'ai un soucis pour parser les logs (file depuis un syslog server) d'un netscaler Citrix (Citrix VDA et loadbalancer https/smtp via logstash et grok, personne n'aurait une petite idée ou piste. J'ai … --- ## [Alert in single node](https://discuss.elastic.co/t/alert-in-single-node/281595)
**Author:** [@quyennguyen](https://discuss.elastic.co/u/quyennguyen)\ **Replies:** 13\ **Last updated:** [August 16, 2021, 11:36pm UTC](https://discuss.elastic.co/t/alert-in-single-node/281595 "2021-08-16T23:36:46Z")
I'm using Machine learning 7.13 and planning to create alert rule for warning. But I saw this After searching I found these steps to enable TLS. But I saw in Set up minimal security for Elasticsearch | Elasticsearch … --- ## [Attempted to resurrect connection to dead ES instance, but got an error](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance-but-got-an-error/281657)
**Author:** [@naaviin](https://discuss.elastic.co/u/naaviin)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 9:45am UTC](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance-but-got-an-error/281657 "2021-08-17T09:45:30Z")
Hi friends, i configured accordingly. However i am getting error logstash.yml http.host: '0.0.0.0' xpack.monitoring.elasticsearch.hosts: \["https://es1:9200","https://es2:9200","https://es3:9200"\] xpack.monitoring.elast… --- ## [Update given indices by index template](https://discuss.elastic.co/t/update-given-indices-by-index-template/281645)
**Author:** [@Rammi22](https://discuss.elastic.co/u/Rammi22)\ **Replies:** 3\ **Last updated:** [August 17, 2021, 8:57am UTC](https://discuss.elastic.co/t/update-given-indices-by-index-template/281645 "2021-08-17T08:57:05Z")
Hi, i've created a index\_template. There exist a lot of indices with more than 40 million documents. Is it possible update existing index by the template instaed to reindex all? The \_update\_by\_query doesn't do the jo… --- ## [Nest always maps values in Dictionary to string](https://discuss.elastic.co/t/nest-always-maps-values-in-dictionary-to-string/281652)
**Author:** [@AaronAlluyn](https://discuss.elastic.co/u/AaronAlluyn)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 8:56am UTC](https://discuss.elastic.co/t/nest-always-maps-values-in-dictionary-to-string/281652 "2021-08-17T08:56:16Z")
I've been trying to figure out how the dynamic mapping and templates work but not having much luck. I have a simple app that loads in data file and maps it to a Dictionary\ the values are all technically… --- ## [Rollover policy with date math not work.Date stay "old" and not changed to next day](https://discuss.elastic.co/t/rollover-policy-with-date-math-not-work-date-stay-old-and-not-changed-to-next-day/281158)
**Author:** [@anna.kuranda](https://discuss.elastic.co/u/anna.kuranda)\ **Replies:** 3\ **Last updated:** [August 17, 2021, 8:23am UTC](https://discuss.elastic.co/t/rollover-policy-with-date-math-not-work-date-stay-old-and-not-changed-to-next-day/281158 "2021-08-17T08:23:35Z")
I have issue with rollover using date math Elastic ver 7.13. Tried all recommendations from this site but it still not rollover using new date.Please tell me what wrong configured? My configuration: Template: Preforma… --- ## [Unassigned shards Inquiry](https://discuss.elastic.co/t/unassigned-shards-inquiry/281477)
**Author:** [@nadler](https://discuss.elastic.co/u/nadler)\ **Replies:** 6\ **Last updated:** [August 17, 2021, 8:16am UTC](https://discuss.elastic.co/t/unassigned-shards-inquiry/281477 "2021-08-17T08:16:46Z")
Hi, One of our teams in the company has complained that every week or so they get an alert for unassigned shards on their cluster. They asked me to look for the cause of the issue. My question is: Is there a way to se… --- ## [NetworkError when attempting to fetch resource](https://discuss.elastic.co/t/networkerror-when-attempting-to-fetch-resource/277150)
**Author:** [@iliya](https://discuss.elastic.co/u/iliya)\ **Replies:** 8\ **Last updated:** [August 17, 2021, 7:47am UTC](https://discuss.elastic.co/t/networkerror-when-attempting-to-fetch-resource/277150 "2021-08-17T07:47:26Z")
Hi Kibana version : 7.10.2 Elasticsearch version : 7.10.2 Browser version :Firefox 89.0.2 \*\*Original install method: from manjaro repository When I put in "http://localhost:5601/app/kibana/" in firefox, occur below … --- ## [How to analyze JVM heap memory ？](https://discuss.elastic.co/t/how-to-analyze-jvm-heap-memory/281631)
**Author:** [@casterQ](https://discuss.elastic.co/u/casterQ)\ **Replies:** 4\ **Last updated:** [August 17, 2021, 7:24am UTC](https://discuss.elastic.co/t/how-to-analyze-jvm-heap-memory/281631 "2021-08-17T07:24:29Z")
I want to know where memory used in es, as shown in the following figure：21.3gb memory used now in this node.i know some of them, such as: indices.queries.cache.size indices.fielddata.cache.size index.requests.cache.si… --- ## [How to extract a substring](https://discuss.elastic.co/t/how-to-extract-a-substring/281578)
**Author:** [@dvrla](https://discuss.elastic.co/u/dvrla)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 7:10am UTC](https://discuss.elastic.co/t/how-to-extract-a-substring/281578 "2021-08-17T07:10:56Z")
Hi, I would like to extract the value of a cookie from an HTTP request but up until now I can´t make it work. I´m trying to get from a request field like this GET /trading/css/main.css?version=4.4.0 HTTP/1.1, Host: ex… --- ## [Kibana canvas filter](https://discuss.elastic.co/t/kibana-canvas-filter/277043)
**Author:** [@xquest](https://discuss.elastic.co/u/xquest)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 7:01am UTC](https://discuss.elastic.co/t/kibana-canvas-filter/277043 "2021-08-17T07:01:35Z")
What is alternative for "level, rownum" in Kibana sql?? I need to build my filter like: select (case LEVEL when 1 then 'xyz' when 2 then 'xzt' ... end) as D, select (case LEVEL when 1 then '1' when 2 then '2'… --- ## [Kibana essql - select from select](https://discuss.elastic.co/t/kibana-essql-select-from-select/277044)
**Author:** [@xquest](https://discuss.elastic.co/u/xquest)\ **Replies:** 3\ **Last updated:** [August 17, 2021, 7:00am UTC](https://discuss.elastic.co/t/kibana-essql-select-from-select/277044 "2021-08-17T07:00:47Z")
I know that it is limitation in regular SQL in Kibana, but ESSQL is more like script than single query, so: Is it possible in ESSQL to use select from select?. For example, saving result from first select as table int… --- ## [How to set up security for elasticsearch cluster](https://discuss.elastic.co/t/how-to-set-up-security-for-elasticsearch-cluster/281552)
**Author:** [@0d153a83fd88577dba87](https://discuss.elastic.co/u/0d153a83fd88577dba87)\ **Replies:** 10\ **Last updated:** [August 17, 2021, 6:42am UTC](https://discuss.elastic.co/t/how-to-set-up-security-for-elasticsearch-cluster/281552 "2021-08-17T06:42:34Z")
network.host: ip1 discovery.seed\_hosts: \["ip1", "ip2"\] cluster.initial\_master\_nodes: \["ip1"\] network.host: ip2 discovery.seed\_hosts: \["ip1", "ip2"\] cluster.initial\_master\_nodes: \["ip1"\] these are two yml files o… --- ## [\[KIBANA\]\[Rules and Connectors\] You must enable Transport Layer Security](https://discuss.elastic.co/t/kibana-rules-and-connectors-you-must-enable-transport-layer-security/281350)
**Author:** [@Patrick57](https://discuss.elastic.co/u/Patrick57)\ **Replies:** 4\ **Last updated:** [August 17, 2021, 6:14am UTC](https://discuss.elastic.co/t/kibana-rules-and-connectors-you-must-enable-transport-layer-security/281350 "2021-08-17T06:14:18Z")
Dear Elastic Community, I am writing to request for your help. I am currently running an ELK stack on latest version (7.14) on a standalone CentOS 7 server. I would like to use the Rules and Connectors functionality b… --- ## [NO such file or directory](https://discuss.elastic.co/t/no-such-file-or-directory/281632)
**Author:** [@naaviin](https://discuss.elastic.co/u/naaviin)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 6:12am UTC](https://discuss.elastic.co/t/no-such-file-or-directory/281632 "2021-08-17T06:12:03Z")
Can i know why i am hitting this. i am using docker. what i did wrong? /usr/share/logstash/elastic-certificates.p12 (No such file or directory)" --- ## [Filebeat harvests system logs even when not specified](https://discuss.elastic.co/t/filebeat-harvests-system-logs-even-when-not-specified/281626)
**Author:** [@GitSpree23](https://discuss.elastic.co/u/GitSpree23)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 5:49am UTC](https://discuss.elastic.co/t/filebeat-harvests-system-logs-even-when-not-specified/281626 "2021-08-17T05:49:40Z")
filebeat.yml: path.config: /Users/sp/servers/filebeat-7.14.0-darwin-x86\_64/ filebeat.config: inputs: enabled: false path: /Users/sp/servers/filebeat-7.14.0-darwin-x86\_64/filebeat.yml filebeat.inputs: - type… --- ## [Kibana fails to start](https://discuss.elastic.co/t/kibana-fails-to-start/281562)
**Author:** [@Avnish\_Singh](https://discuss.elastic.co/u/Avnish_Singh)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 5:32am UTC](https://discuss.elastic.co/t/kibana-fails-to-start/281562 "2021-08-17T05:32:46Z")
Failed to start kibana on centos 8 ElasticSearch version: 7.14 Kibana Version: 7.14 the log file looks like: \[root@localhost kibana\]# tail -10f kibana.log {"type":"log","@timestamp":"2021-08-16T19:51:10+05:30","tags"… --- ## [No subsecond precision for apache logs](https://discuss.elastic.co/t/no-subsecond-precision-for-apache-logs/281614)
**Author:** [@rizvaughan](https://discuss.elastic.co/u/rizvaughan)\ **Replies:** 6\ **Last updated:** [August 17, 2021, 4:47am UTC](https://discuss.elastic.co/t/no-subsecond-precision-for-apache-logs/281614 "2021-08-17T04:47:43Z")
Hello all, I have apache logs coming into elasticsearch(aws). The logs are being created in epoch 'format'. I am using td-agent for the transportation. I tried different methods to transform the date to humand readable … --- ## [Error creating runner from config: failed to create input: Can only start an input when all related states are finished:](https://discuss.elastic.co/t/error-creating-runner-from-config-failed-to-create-input-can-only-start-an-input-when-all-related-states-are-finished/281328)
**Author:** [@lilyyy](https://discuss.elastic.co/u/lilyyy)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 4:34am UTC](https://discuss.elastic.co/t/error-creating-runner-from-config-failed-to-create-input-can-only-start-an-input-when-all-related-states-are-finished/281328 "2021-08-17T04:34:50Z")
Hi all I get the logs from suricata(eve.json) so I've enabled suricata module in filebeat. But whenever I start filebeat, I got this error. 2021-08-13T18:11:18.650+0900 ERROR \[reload\] cfgfile/list.go:99 Error creating… --- ## [Data migration between elastic clusters](https://discuss.elastic.co/t/data-migration-between-elastic-clusters/281363)
**Author:** [@shanavas](https://discuss.elastic.co/u/shanavas)\ **Replies:** 3\ **Last updated:** [August 17, 2021, 4:28am UTC](https://discuss.elastic.co/t/data-migration-between-elastic-clusters/281363 "2021-08-17T04:28:04Z")
We have two es clusters, one running on premise and another one on the cloud. The one premise one can't store data for more than a week. The cloud cluster retains the data for a longer duration (a few months). So the … --- ## [Configuring indices for monitoring using new template API](https://discuss.elastic.co/t/configuring-indices-for-monitoring-using-new-template-api/281533)
**Author:** [@aoi1](https://discuss.elastic.co/u/aoi1)\ **Replies:** 6\ **Last updated:** [August 17, 2021, 4:03am UTC](https://discuss.elastic.co/t/configuring-indices-for-monitoring-using-new-template-api/281533 "2021-08-17T04:03:17Z")
Hello! I have a question. In this document, it uses \_template API. But I recognize the \_template API is deprecated in Elasticsearch version 7.8. Is this document correct in the version after 7.8? I am trying to conf… --- ## [How can I log 400 Bad Request when creating documents](https://discuss.elastic.co/t/how-can-i-log-400-bad-request-when-creating-documents/281238)
**Author:** [@kiancross](https://discuss.elastic.co/u/kiancross)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 2:20am UTC](https://discuss.elastic.co/t/how-can-i-log-400-bad-request-when-creating-documents/281238 "2021-08-17T02:20:02Z")
When creating documents, I want 400 Bad Requests to be added to the log so I can see clients that are getting errors. Is this possible? --- ## [Unable to revive connection](https://discuss.elastic.co/t/unable-to-revive-connection/281245)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 1:31am UTC](https://discuss.elastic.co/t/unable-to-revive-connection/281245 "2021-08-17T01:31:01Z")
I'm working on a new proof-of-concept deployment with a self-managed, single-node cluster. After encrypting traffic between Kibana and Elasticsearch (using this documentation), I'm now unable to access Kibana. When att… --- ## [All shards being reassigned from one of our Warm nodes](https://discuss.elastic.co/t/all-shards-being-reassigned-from-one-of-our-warm-nodes/281203)
**Author:** [@TheEvilDonut](https://discuss.elastic.co/u/TheEvilDonut)\ **Replies:** 3\ **Last updated:** [August 17, 2021, 1:29am UTC](https://discuss.elastic.co/t/all-shards-being-reassigned-from-one-of-our-warm-nodes/281203 "2021-08-17T01:29:59Z")
Good day all. We have noticed a few days ago that all shards from one of our warm data nodes are being rebalanced and reassigned to the other warm nodes. We are currently at a loss at finding the reason. The node itsel… --- ## [Unable to take snapshot - Version 5.6.12](https://discuss.elastic.co/t/unable-to-take-snapshot-version-5-6-12/281262)
**Author:** [@sridharparepalli](https://discuss.elastic.co/u/sridharparepalli)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 1:24am UTC](https://discuss.elastic.co/t/unable-to-take-snapshot-version-5-6-12/281262 "2021-08-17T01:24:24Z")
Hello, I was able to register the snapshot successfully. However, when I try to take a backup I'm getting this error message. "No matches found..." Any help is greatly appreciated. Register Snapshot (works fine): sudo … --- ## [Aggregation with different timezones](https://discuss.elastic.co/t/aggregation-with-different-timezones/281305)
**Author:** [@scorona85](https://discuss.elastic.co/u/scorona85)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 1:22am UTC](https://discuss.elastic.co/t/aggregation-with-different-timezones/281305 "2021-08-17T01:22:03Z")
How can I create an aggregation of datas aquired from different part of Timezones (example New York -6.00 and Rome +2.00). In the document I have a field 'timestamp' defined as "data". I have to create a "date\_histogram"… --- ## [Unrecognized VM option 'UseConcMarkSweepGC' while trying to install ES 7.13.0](https://discuss.elastic.co/t/unrecognized-vm-option-useconcmarksweepgc-while-trying-to-install-es-7-13-0/281307)
**Author:** [@babai7](https://discuss.elastic.co/u/babai7)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 1:20am UTC](https://discuss.elastic.co/t/unrecognized-vm-option-useconcmarksweepgc-while-trying-to-install-es-7-13-0/281307 "2021-08-17T01:20:55Z")
Aug 13 09:16:10 \*\*\*\*\*\*\*\*\* elasticsearch\[1120000\]: error: Aug 13 09:16:10 \*\*\*\*\*\*\*\*\* elasticsearch\[1120000\]: Unrecognized VM option 'UseConcMarkSweepGC' Aug 13 09:16:10 \*\*\*\*\*\*\*\*\* elasticsearch\[1120000\]: Error: Could not … --- ## [Kibana Dashboard compare fields from filebeat and Heartbeat](https://discuss.elastic.co/t/kibana-dashboard-compare-fields-from-filebeat-and-heartbeat/281343)
**Author:** [@newbie5](https://discuss.elastic.co/u/newbie5)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 1:19am UTC](https://discuss.elastic.co/t/kibana-dashboard-compare-fields-from-filebeat-and-heartbeat/281343 "2021-08-17T01:19:42Z")
Hi, I have filed "name" in filebeat - type: log enabled: true paths: - C:\\Desktop\\ELK4\\aplikacja\\macro.log fields: log\_type: app name: BYD1 multiline.type: pattern multiline.pattern: '^\\\*' m… --- ## [Get the full date format in elasticsearch](https://discuss.elastic.co/t/get-the-full-date-format-in-elasticsearch/281310)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 1:18am UTC](https://discuss.elastic.co/t/get-the-full-date-format-in-elasticsearch/281310 "2021-08-17T01:18:09Z")
Hi all, In an old project, the date fields have been mapped and data is present. Now in Kibana, I can see human readable format of date When i Use GET API to get format of date in devtools, i get ony format of date fi… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1277) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1279)