# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1301 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1302 --- ## [Logstash. Mutate's split doesn't split string](https://discuss.elastic.co/t/logstash-mutates-split-doesnt-split-string/280035)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 1\ **Last updated:** [July 30, 2021, 9:28am UTC](https://discuss.elastic.co/t/logstash-mutates-split-doesnt-split-string/280035 "2021-07-30T09:28:14Z")
Hi, community. I have field "temp" with this value: "2.4.3-371989". I want split it by dots. With this purpose I use mutate filter this way: mutate { split =\> \["temp", "."\] } But after split "temp" field still equals… --- ## [Unknown setting \[index.lifecycl.parse\_origination\_date\]](https://discuss.elastic.co/t/unknown-setting-index-lifecycl-parse-origination-date/279937)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [July 30, 2021, 9:17am UTC](https://discuss.elastic.co/t/unknown-setting-index-lifecycl-parse-origination-date/279937 "2021-07-30T09:17:36Z")
I wan to reindex my old index.If i do reindexing it will create new index and the old index which should be deleted on 30 days of rollover (that time) and new index will delete after 30 days even if delete old index man… --- ## [What is the highest version of Elasticsearch Sentinl can currently support? 7. X support?](https://discuss.elastic.co/t/what-is-the-highest-version-of-elasticsearch-sentinl-can-currently-support-7-x-support/278605)
**Author:** [@liuliugang](https://discuss.elastic.co/u/liuliugang)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 9:38am UTC](https://discuss.elastic.co/t/what-is-the-highest-version-of-elasticsearch-sentinl-can-currently-support-7-x-support/278605 "2021-07-22T09:38:18Z")
sentinl: thanks --- ## [Logstash stopped due to an error in one of the pipeline configurations](https://discuss.elastic.co/t/logstash-stopped-due-to-an-error-in-one-of-the-pipeline-configurations/279574)
**Author:** [@subash](https://discuss.elastic.co/u/subash)\ **Replies:** 5\ **Last updated:** [July 30, 2021, 7:25am UTC](https://discuss.elastic.co/t/logstash-stopped-due-to-an-error-in-one-of-the-pipeline-configurations/279574 "2021-07-30T07:25:20Z")
We have 10 conf files running in pipeline. The problem is, if any one of the pipeline configurations has some errors then the entire Logstash instance stops though the other pipeline configurations has no errors. How do … --- ## [API Authorization](https://discuss.elastic.co/t/api-authorization/280033)
**Author:** [@shashikant.deshmukh](https://discuss.elastic.co/u/shashikant.deshmukh)\ **Replies:** 2\ **Last updated:** [July 30, 2021, 6:14am UTC](https://discuss.elastic.co/t/api-authorization/280033 "2021-07-30T06:14:18Z")
Dear Expert, I am new to ELK. I need your help to achieve below Request API 1 =\> https://\*\*\*\*\*\*\*\*\*\*\*/api/Account/Authenticate Parameter to pass { "tenancyName": "", "usernameOrEmailAddress": "", "password": "\*\*\*\*… --- ## [How to calculate the elapsed time of a flag status per day?](https://discuss.elastic.co/t/how-to-calculate-the-elapsed-time-of-a-flag-status-per-day/279494)
**Author:** [@MaximeG](https://discuss.elastic.co/u/MaximeG)\ **Replies:** 11\ **Last updated:** [July 30, 2021, 6:35am UTC](https://discuss.elastic.co/t/how-to-calculate-the-elapsed-time-of-a-flag-status-per-day/279494 "2021-07-30T06:35:11Z")
I'd like to figure out the elapsed time between flag status changes. Simplified example : a person can only be sad or happy. I'd like to know how long each mood was active until it changed. I'm looking for a general be… --- ## [Seeing if its possible to add a timeout to the sample web session detail script](https://discuss.elastic.co/t/seeing-if-its-possible-to-add-a-timeout-to-the-sample-web-session-detail-script/279737)
**Author:** [@jjammin92](https://discuss.elastic.co/u/jjammin92)\ **Replies:** 5\ **Last updated:** [July 30, 2021, 6:22am UTC](https://discuss.elastic.co/t/seeing-if-its-possible-to-add-a-timeout-to-the-sample-web-session-detail-script/279737 "2021-07-30T06:22:08Z")
Hello, I've been reviewing different ways to aggregate log messages together that have a start event but no end event. Been struggling with the logstash aggregate filter plugin and was looking at retrofitting an old en… --- ## [How do I set the mandatory insertion of all fields when creating a document](https://discuss.elastic.co/t/how-do-i-set-the-mandatory-insertion-of-all-fields-when-creating-a-document/279849)
**Author:** [@myly-zyr](https://discuss.elastic.co/u/myly-zyr)\ **Replies:** 10\ **Last updated:** [July 30, 2021, 6:00am UTC](https://discuss.elastic.co/t/how-do-i-set-the-mandatory-insertion-of-all-fields-when-creating-a-document/279849 "2021-07-30T06:00:30Z")
In our project, a program does not insert all fields when creating a document, and other programs will report errors when reading the document. I want to set elasticsearch to insert all fields when creating a document. H… --- ## [Timestamp changes in logstash input?](https://discuss.elastic.co/t/timestamp-changes-in-logstash-input/280027)
**Author:** [@jclemons7](https://discuss.elastic.co/u/jclemons7)\ **Replies:** 0\ **Last updated:** [July 30, 2021, 4:28am UTC](https://discuss.elastic.co/t/timestamp-changes-in-logstash-input/280027 "2021-07-30T04:28:37Z")
Hello all, I have had this index going for like at least the last 2 years.. and all of a sudden the timezone seems to not be working correctly. The pipeline has some transforms in it, but nothing touches the @timestamp … --- ## [Is Rust client for Elasticsearch safe for corporation/production use?](https://discuss.elastic.co/t/is-rust-client-for-elasticsearch-safe-for-corporation-production-use/277138)
**Author:** [@odyssey\_2001](https://discuss.elastic.co/u/odyssey_2001)\ **Replies:** 10\ **Last updated:** [July 30, 2021, 2:10am UTC](https://discuss.elastic.co/t/is-rust-client-for-elasticsearch-safe-for-corporation-production-use/277138 "2021-07-30T02:10:48Z")
Hi, I was on Github and I saw that apparently there is an official client for Elasticsearch written in Rust which is a language that I admire a lot. Here is the link. However they say: The project is still very much … --- ## [How to enable Document-level security in Kibana Dashboard](https://discuss.elastic.co/t/how-to-enable-document-level-security-in-kibana-dashboard/279885)
**Author:** [@tong6462](https://discuss.elastic.co/u/tong6462)\ **Replies:** 6\ **Last updated:** [July 30, 2021, 2:03am UTC](https://discuss.elastic.co/t/how-to-enable-document-level-security-in-kibana-dashboard/279885 "2021-07-30T02:03:42Z")
Hi, Is there any way to enable Document-level security in Kibana Dashboard ? --- ## [Error in Elasticsearch cluster on Openshift after restarting nodes](https://discuss.elastic.co/t/error-in-elasticsearch-cluster-on-openshift-after-restarting-nodes/280010)
**Author:** [@fefontana](https://discuss.elastic.co/u/fefontana)\ **Replies:** 7\ **Last updated:** [July 30, 2021, 1:20am UTC](https://discuss.elastic.co/t/error-in-elasticsearch-cluster-on-openshift-after-restarting-nodes/280010 "2021-07-30T01:20:02Z")
Hi there, I have an Elasticsearch cluster 7.13.2 : 2 data nodes 3 master nodes 2 client nodes all of them deployed on Openshift with minimal security enabled. TLS security is not enabled, is not necessary in our case… --- ## [Access Kibana from remote machine](https://discuss.elastic.co/t/access-kibana-from-remote-machine/279924)
**Author:** [@Rickenson\_Robert](https://discuss.elastic.co/u/Rickenson_Robert)\ **Replies:** 10\ **Last updated:** [July 30, 2021, 12:54am UTC](https://discuss.elastic.co/t/access-kibana-from-remote-machine/279924 "2021-07-30T00:54:27Z")
Hi all, I have Kibana running on one machine and I would like to access that instance of Kibana on another machine. That is to say, I want to host Kibana on on my local computer and access it through the web browser of … --- ## [Circuit Breaker Exception - version 5.2.0](https://discuss.elastic.co/t/circuit-breaker-exception-version-5-2-0/279799)
**Author:** [@chateesh](https://discuss.elastic.co/u/chateesh)\ **Replies:** 5\ **Last updated:** [July 30, 2021, 12:26am UTC](https://discuss.elastic.co/t/circuit-breaker-exception-version-5-2-0/279799 "2021-07-30T00:26:18Z")
Hi, Client node is unresponsive and getting error as below "org.elasticsearch.common.breaker.CircuitBreakingException: \[parent\] Data too large, data for \[\\] would be larger than limit of \[24003005644/22.3g… --- ## [Http Broken Pipe](https://discuss.elastic.co/t/http-broken-pipe/280003)
**Author:** [@tofubeats](https://discuss.elastic.co/u/tofubeats)\ **Replies:** 0\ **Last updated:** [July 29, 2021, 4:12pm UTC](https://discuss.elastic.co/t/http-broken-pipe/280003 "2021-07-29T16:12:36Z")
Hello, I'm new to Elasticstack. I am using HTTP output plugin but am getting the following error: \[\[main\]\>worker2\] http - \[HTTP Output Failure\] Could not fetch URL {:url=\>"https://{{fqdn}}:5059", :method=\>:post, :messa… --- ## [What all shards are included in "open shards": (active / unassigned /relocating / initializing) all of them?](https://discuss.elastic.co/t/what-all-shards-are-included-in-open-shards-active-unassigned-relocating-initializing-all-of-them/279754)
**Author:** [@Bhavik92](https://discuss.elastic.co/u/Bhavik92)\ **Replies:** 2\ **Last updated:** [July 29, 2021, 8:02pm UTC](https://discuss.elastic.co/t/what-all-shards-are-included-in-open-shards-active-unassigned-relocating-initializing-all-of-them/279754 "2021-07-29T20:02:23Z")
I'm trying to build some monitoring to avoid the errors like this: " this cluster currently has \[999\]/\[1000\] maximum shards open Looking at response from cluster\_health I see shards in 4 categories: active / unassigned… --- ## [400 Bad Request when trying to query elasticsearch using HttpClient](https://discuss.elastic.co/t/400-bad-request-when-trying-to-query-elasticsearch-using-httpclient/279898)
**Author:** [@MarkCo](https://discuss.elastic.co/u/MarkCo)\ **Replies:** 5\ **Last updated:** [July 29, 2021, 5:58pm UTC](https://discuss.elastic.co/t/400-bad-request-when-trying-to-query-elasticsearch-using-httpclient/279898 "2021-07-29T17:58:42Z")
I am trying to perform a query searching in elasticsearch using httpclient. Whenever I do so though, I get an error when hitting my HttpResponseMessage response variable. It tells me it is a 400 (Bad request). I checked… --- ## [Drop messages that end with specific substring](https://discuss.elastic.co/t/drop-messages-that-end-with-specific-substring/279994)
**Author:** [@bgingras](https://discuss.elastic.co/u/bgingras)\ **Replies:** 2\ **Last updated:** [July 29, 2021, 5:55pm UTC](https://discuss.elastic.co/t/drop-messages-that-end-with-specific-substring/279994 "2021-07-29T17:55:35Z")
Hello everyone, I'm trying to implement a Logstash filter that drops syslogs messages that end with a specific substring, something like this: filter { if \[message\].endsWith("substring") { drop { } } } Ha… --- ## [Problems with error "File was truncated. Begin reading file from offset 0"](https://discuss.elastic.co/t/problems-with-error-file-was-truncated-begin-reading-file-from-offset-0/279959)
**Author:** [@mark\_vr](https://discuss.elastic.co/u/mark_vr)\ **Replies:** 4\ **Last updated:** [July 29, 2021, 5:32pm UTC](https://discuss.elastic.co/t/problems-with-error-file-was-truncated-begin-reading-file-from-offset-0/279959 "2021-07-29T17:32:17Z")
We use Azure Kubernetes Service, and our HTTP logs are written by the loadbalancer (ingress) to shared Azure storage. I'd like to read these logs and import them to Elasticsearch. I realise reading from shared storage … --- ## [Add geo point in Elastic](https://discuss.elastic.co/t/add-geo-point-in-elastic/280005)
**Author:** [@klynxe](https://discuss.elastic.co/u/klynxe)\ **Replies:** 0\ **Last updated:** [July 29, 2021, 4:52pm UTC](https://discuss.elastic.co/t/add-geo-point-in-elastic/280005 "2021-07-29T16:52:17Z")
Hi everyone, I use ELK and filebeat. I send a lot of logs with different fields. logstash config: input { beats { port =\> 5044 include\_codec\_tag =\> false } } filter { if \[type\] == "json" { j… --- ## [Logstash file input - output to different indices](https://discuss.elastic.co/t/logstash-file-input-output-to-different-indices/279906)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 4\ **Last updated:** [July 29, 2021, 4:02pm UTC](https://discuss.elastic.co/t/logstash-file-input-output-to-different-indices/279906 "2021-07-29T16:02:46Z")
Hello All, I am running ELK 7.6.2 stack. In my current set up, a single file gets ingested in logstash and creates an index successfully as below (only relevant part shown): input { file { path =\> "/opt/gtal/ita… --- ## [Dynamically show or hide visualisation using control](https://discuss.elastic.co/t/dynamically-show-or-hide-visualisation-using-control/278883)
**Author:** [@antongb](https://discuss.elastic.co/u/antongb)\ **Replies:** 2\ **Last updated:** [July 29, 2021, 3:37pm UTC](https://discuss.elastic.co/t/dynamically-show-or-hide-visualisation-using-control/278883 "2021-07-29T15:37:48Z")
Hi, I'm using a pie chart to display the % of counts of items from different categories. However, I don't want to display the chart until a category is first chosen from an options control. E.g. there are 2 categories:… --- ## [Elasticsearch query to return all records](https://discuss.elastic.co/t/elasticsearch-query-to-return-all-records/279998)
**Author:** [@varsha\_dusa](https://discuss.elastic.co/u/varsha_dusa)\ **Replies:** 1\ **Last updated:** [July 29, 2021, 3:27pm UTC](https://discuss.elastic.co/t/elasticsearch-query-to-return-all-records/279998 "2021-07-29T15:27:21Z")
I have a small database in Elasticsearch and for testing purposes would like to pull all records back. I am attempting to use a URL of the form... http://localhost:9200/foo/\_search?pretty=true&q={'matchAll':{''}} Can s… --- ## [Combine 2 types of panels](https://discuss.elastic.co/t/combine-2-types-of-panels/279983)
**Author:** [@AlexM566](https://discuss.elastic.co/u/AlexM566)\ **Replies:** 2\ **Last updated:** [July 29, 2021, 3:23pm UTC](https://discuss.elastic.co/t/combine-2-types-of-panels/279983 "2021-07-29T15:23:12Z")
Hello guys, Is there possible to combine 2 visualization in 1 (like in the image below ). So I have vertical bar visualization of data and I want to add a line visualization over that. I have to mention that the data… --- ## [How to read local0.info and local4.info file content in UNIX server using filebeat configuration](https://discuss.elastic.co/t/how-to-read-local0-info-and-local4-info-file-content-in-unix-server-using-filebeat-configuration/280000)
**Author:** [@muralikrishna](https://discuss.elastic.co/u/muralikrishna)\ **Replies:** 1\ **Last updated:** [July 29, 2021, 3:18pm UTC](https://discuss.elastic.co/t/how-to-read-local0-info-and-local4-info-file-content-in-unix-server-using-filebeat-configuration/280000 "2021-07-29T15:18:07Z")
Hello Everyone, I have some applications writing the logs to local0.info & local4.info file in UNIX servers. I have to read the log content from above files using filebeat.yml and send the same to Logstash. Could you … --- ## [How to use string interpolation for query string - Elasticsearch](https://discuss.elastic.co/t/how-to-use-string-interpolation-for-query-string-elasticsearch/280001)
**Author:** [@MarkCo](https://discuss.elastic.co/u/MarkCo)\ **Replies:** 0\ **Last updated:** [July 29, 2021, 2:58pm UTC](https://discuss.elastic.co/t/how-to-use-string-interpolation-for-query-string-elasticsearch/280001 "2021-07-29T14:58:45Z")
I am trying to perform string interpolation to my variable that contains of a string of JSON Objects. Below is my original query: var query = "{\\"size\\": 1000,\\"query\\": {\\"bool\\": {\\"should\\":\[ {\\"match\\": { \\"level\\"… --- ## [XML Filter: How import data from XML file](https://discuss.elastic.co/t/xml-filter-how-import-data-from-xml-file/279969)
**Author:** [@Fabio1](https://discuss.elastic.co/u/Fabio1)\ **Replies:** 1\ **Last updated:** [July 29, 2021, 2:42pm UTC](https://discuss.elastic.co/t/xml-filter-how-import-data-from-xml-file/279969 "2021-07-29T14:42:27Z")
Hello everyone, I'm trying to upload my xml file to logstash/elasticsearch to improve my research capabilites. I already tried a lot of ways but I just can import all the file with the xml tags (very confusing). I woul… --- ## [Snapshot restoration failures - FileAlreadyExistsException](https://discuss.elastic.co/t/snapshot-restoration-failures-filealreadyexistsexception/279976)
**Author:** [@Vamsi\_Htc](https://discuss.elastic.co/u/Vamsi_Htc)\ **Replies:** 3\ **Last updated:** [July 29, 2021, 2:33pm UTC](https://discuss.elastic.co/t/snapshot-restoration-failures-filealreadyexistsexception/279976 "2021-07-29T14:33:18Z")
We are facing issues with restoring a snapshot from s3 bucket and the we are seeing below error. ES version 5.6.3 Two of our nodes went down which got both primary and replicas which resulted in cluster turning into re… --- ## [Add a field to logs between 2 specific logs](https://discuss.elastic.co/t/add-a-field-to-logs-between-2-specific-logs/279743)
**Author:** [@Loulou](https://discuss.elastic.co/u/Loulou)\ **Replies:** 11\ **Last updated:** [July 29, 2021, 2:10pm UTC](https://discuss.elastic.co/t/add-a-field-to-logs-between-2-specific-logs/279743 "2021-07-29T14:10:12Z")
Hi, What I am trying to do is, when I encounter a specific log (with a message including "blockOpened"), I save somewhere the fact that I encountered it, and then for all the following logs I add to them a field or tag.… --- ## [SQL Server data to Elasticsearch using LogStash](https://discuss.elastic.co/t/sql-server-data-to-elasticsearch-using-logstash/279996)
**Author:** [@shharukh](https://discuss.elastic.co/u/shharukh)\ **Replies:** 0\ **Last updated:** [July 29, 2021, 1:50pm UTC](https://discuss.elastic.co/t/sql-server-data-to-elasticsearch-using-logstash/279996 "2021-07-29T13:50:55Z")
hey ELK fam, Im trying to connect SQL sever with logstash, but unable to connect with SQLsever here are log can anyone please help me out. regards shahrukh \*\*\[2021-07-29T18:21:41,590\]\[ERROR\]\[logstash.inputs.jdbc … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1300) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1302)