# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1309 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1310 --- ## [Reflect changes made on one dashboard on one space to be reflected on the dashboard on another space](https://discuss.elastic.co/t/reflect-changes-made-on-one-dashboard-on-one-space-to-be-reflected-on-the-dashboard-on-another-space/279469)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 1\ **Last updated:** [July 24, 2021, 12:14am UTC](https://discuss.elastic.co/t/reflect-changes-made-on-one-dashboard-on-one-space-to-be-reflected-on-the-dashboard-on-another-space/279469 "2021-07-24T00:14:27Z")
Hello, I have two spaces on kibana, one for admin user and one for the rest of the users (with limited privileges) . I had a couple of dashboards on the admin space that were exported to the user space , and was wonderi… --- ## [Perfomance optimization for nested aggregations](https://discuss.elastic.co/t/perfomance-optimization-for-nested-aggregations/279518)
**Author:** [@treasures78](https://discuss.elastic.co/u/treasures78)\ **Replies:** 0\ **Last updated:** [July 23, 2021, 11:45pm UTC](https://discuss.elastic.co/t/perfomance-optimization-for-nested-aggregations/279518 "2021-07-23T23:45:41Z")
Hi, please help me figure out, is there any way to optimize this request? At the moment, the request is being executed for about 30-40 seconds. The index stores information about the call history. The query builds a re… --- ## [Can't generate .csv report](https://discuss.elastic.co/t/cant-generate-csv-report/279465)
**Author:** [@bnk](https://discuss.elastic.co/u/bnk)\ **Replies:** 1\ **Last updated:** [July 23, 2021, 11:45pm UTC](https://discuss.elastic.co/t/cant-generate-csv-report/279465 "2021-07-23T23:45:24Z")
Hi, I'm unable to generate .csv report. I ran Reporting diagnosis. It verdict: "Everything looks good for reporting to function." Maybe someone has any ideas what is wrong? Regards Ema --- ## [Can Kibana Visualise Data in Cold/Frozen Tier?](https://discuss.elastic.co/t/can-kibana-visualise-data-in-cold-frozen-tier/279453)
**Author:** [@peteryann](https://discuss.elastic.co/u/peteryann)\ **Replies:** 1\ **Last updated:** [July 23, 2021, 11:40pm UTC](https://discuss.elastic.co/t/can-kibana-visualise-data-in-cold-frozen-tier/279453 "2021-07-23T23:40:02Z")
I understand data in the cold/frozen tiers are still searchable by Elasticsearch. Can Kibana visualisations visualise data that span indices across multiple tiers (e.g. warm/cold/frozen)? Is this transparent to the Kiban… --- ## [\[error\]\[data\]\[elasticsearch\] \[version\_conflict\_engine\_exception\]: \[search-telemetry:search-telemetry\]: version conflict, required seqNo \[14477\], primary term \[48\]. current document has seqNo \[14478\] and primary term \[48\]](https://discuss.elastic.co/t/error-data-elasticsearch-version-conflict-engine-exception-search-telemetry-search-telemetry-version-conflict-required-seqno-14477-primary-term-48-current-document-has-seqno-14478-and-primary-term-48/279447)
**Author:** [@hardik.rapidops](https://discuss.elastic.co/u/hardik.rapidops)\ **Replies:** 1\ **Last updated:** [July 23, 2021, 11:29pm UTC](https://discuss.elastic.co/t/error-data-elasticsearch-version-conflict-engine-exception-search-telemetry-search-telemetry-version-conflict-required-seqno-14477-primary-term-48-current-document-has-seqno-14478-and-primary-term-48/279447 "2021-07-23T23:29:30Z")
I am using kibana 7.10.2 and I can see the following error in logs. Is there any way to fix it? server log \[06:30:40.197\] \[error\]\[data\]\[elasticsearch\] \[version\_conflict\_engine\_exception\]: \[search-telemetry:search-t… --- ## [Filebeat and apache logs](https://discuss.elastic.co/t/filebeat-and-apache-logs/279473)
**Author:** [@colttt](https://discuss.elastic.co/u/colttt)\ **Replies:** 1\ **Last updated:** [July 23, 2021, 11:26pm UTC](https://discuss.elastic.co/t/filebeat-and-apache-logs/279473 "2021-07-23T23:26:32Z")
Hello, we use filebeat to ship the logs from server to graylog. I saw that filebeat has an apache module, I try that but it looks like that it doesn't work. It looks like that it doesn't parse and add extra fields. I cha… --- ## [How to set auto-generated \_id to json field(csv column) in logstash file](https://discuss.elastic.co/t/how-to-set-auto-generated-id-to-json-field-csv-column-in-logstash-file/279482)
**Author:** [@Ashutosh2808](https://discuss.elastic.co/u/Ashutosh2808)\ **Replies:** 3\ **Last updated:** [July 23, 2021, 10:19pm UTC](https://discuss.elastic.co/t/how-to-set-auto-generated-id-to-json-field-csv-column-in-logstash-file/279482 "2021-07-23T22:19:51Z")
I've csv columns as below in logstash conf file: filter{ csv { columns =\> \["ResolutionId","IssueId"\] separator =\> "," skip\_header =\> "true" } mu… --- ## [Trying to create role for some applications and got error](https://discuss.elastic.co/t/trying-to-create-role-for-some-applications-and-got-error/279365)
**Author:** [@gelfandbein](https://discuss.elastic.co/u/gelfandbein)\ **Replies:** 1\ **Last updated:** [July 23, 2021, 9:17pm UTC](https://discuss.elastic.co/t/trying-to-create-role-for-some-applications-and-got-error/279365 "2021-07-23T21:17:37Z")
Hello! I try to create some basic roles for some application what connecting to ES 6.8.15, but stuck on simple query: curl -XGET http://localhost:9200/images/\_search -u server:password output: { "error" : { "ro… --- ## [Logstash Grok - Extract field if field exists & deleting character](https://discuss.elastic.co/t/logstash-grok-extract-field-if-field-exists-deleting-character/279492)
**Author:** [@gringorion](https://discuss.elastic.co/u/gringorion)\ **Replies:** 2\ **Last updated:** [July 23, 2021, 7:13pm UTC](https://discuss.elastic.co/t/logstash-grok-extract-field-if-field-exists-deleting-character/279492 "2021-07-23T19:13:38Z")
Hello Guys, My case is simple, but can't find the perfect response. I need to extract the field: user@domain into 2 fields. This step is OK: %{WORD:user}%{NOTSPACE:domain}? gives: { "user": "user", "domain": "@… --- ## [Filebeat sending all the lines in a log file as one single entries instead of different entries](https://discuss.elastic.co/t/filebeat-sending-all-the-lines-in-a-log-file-as-one-single-entries-instead-of-different-entries/278816)
**Author:** [@Patr123](https://discuss.elastic.co/u/Patr123)\ **Replies:** 4\ **Last updated:** [July 23, 2021, 6:48pm UTC](https://discuss.elastic.co/t/filebeat-sending-all-the-lines-in-a-log-file-as-one-single-entries-instead-of-different-entries/278816 "2021-07-23T18:48:19Z")
I have installed filebeat on a server to ingest the stderr logs for tomcat instance. When I am trying to send those logs to my logstash instance its sending as one event instead of multiple events. How can I fix that? M… --- ## [How to load json data into another json data structure](https://discuss.elastic.co/t/how-to-load-json-data-into-another-json-data-structure/279512)
**Author:** [@venkataraman](https://discuss.elastic.co/u/venkataraman)\ **Replies:** 1\ **Last updated:** [July 23, 2021, 6:33pm UTC](https://discuss.elastic.co/t/how-to-load-json-data-into-another-json-data-structure/279512 "2021-07-23T18:33:00Z")
Hello Everyone, I just need a help in loading data in a nested json format. I have a output something like this in the below format { "product" : "IPS" "Product\_Country" : "EMEA" "Tracking\_ID": "2335454523" "Start… --- ## [Geoip-info fail on auditbeat, filebeat and packetbeack](https://discuss.elastic.co/t/geoip-info-fail-on-auditbeat-filebeat-and-packetbeack/279497)
**Author:** [@b0r1s](https://discuss.elastic.co/u/b0r1s)\ **Replies:** 2\ **Last updated:** [July 23, 2021, 6:28pm UTC](https://discuss.elastic.co/t/geoip-info-fail-on-auditbeat-filebeat-and-packetbeack/279497 "2021-07-23T18:28:38Z")
Hello everyone o/ I followed this tutorial and after restarting the beats (it's the same steps for all beats) I can't receive any geoip-info fields. Do I need more configs on .yml files? --- ## [Logstash aggregate field and increase count](https://discuss.elastic.co/t/logstash-aggregate-field-and-increase-count/279454)
**Author:** [@Hamza\_El\_Aouane](https://discuss.elastic.co/u/Hamza_El_Aouane)\ **Replies:** 3\ **Last updated:** [July 23, 2021, 6:10pm UTC](https://discuss.elastic.co/t/logstash-aggregate-field-and-increase-count/279454 "2021-07-23T18:10:49Z")
Hello everyone. I am again here. I would like to start thanking every single one one of you for this amazing community. Those days I was testing elasticsearch and logstash and I am just falling in love with how many th… --- ## [Change Timezone for a particular field "calldate"](https://discuss.elastic.co/t/change-timezone-for-a-particular-field-calldate/279493)
**Author:** [@rmartinez.rv](https://discuss.elastic.co/u/rmartinez.rv)\ **Replies:** 3\ **Last updated:** [July 23, 2021, 5:58pm UTC](https://discuss.elastic.co/t/change-timezone-for-a-particular-field-calldate/279493 "2021-07-23T17:58:38Z")
Hi. I'm using logstash jdbc to pull data from a mysql database. So far so good. This is part of the configuration file: input { jdbc { jdbc\_driver\_library =\> "/usr/share/java/mysql-connector-j… --- ## [How to update elasticsearch.yml if I am using Elastic cloud through API](https://discuss.elastic.co/t/how-to-update-elasticsearch-yml-if-i-am-using-elastic-cloud-through-api/279505)
**Author:** [@idelix](https://discuss.elastic.co/u/idelix)\ **Replies:** 5\ **Last updated:** [July 23, 2021, 5:30pm UTC](https://discuss.elastic.co/t/how-to-update-elasticsearch-yml-if-i-am-using-elastic-cloud-through-api/279505 "2021-07-23T17:30:05Z")
Hello, I'm trying to update elasticsearch.yml and kibana.yml in elastic cloud through API but I cannot find any reference. Basically I need to be able to configure it fully through API as it will be done by ci/cd pipel… --- ## [Condition in metricbeat](https://discuss.elastic.co/t/condition-in-metricbeat/279425)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 7\ **Last updated:** [July 23, 2021, 2:52pm UTC](https://discuss.elastic.co/t/condition-in-metricbeat/279425 "2021-07-23T14:52:33Z")
Trying to setup condition in system.yml file for dropping some event when condition meet what I want to do it if this conditions meet drop the event. ( cond1 OR cond2 OR cond3 ) AND ( cond4 OR cond5 ) for example her… --- ## [Are the shingles in the search-as-you-type field type \*words\* or \*letters\*?](https://discuss.elastic.co/t/are-the-shingles-in-the-search-as-you-type-field-type-words-or-letters/279463)
**Author:** [@Markus\_Jevring](https://discuss.elastic.co/u/Markus_Jevring)\ **Replies:** 2\ **Last updated:** [July 23, 2021, 12:24pm UTC](https://discuss.elastic.co/t/are-the-shingles-in-the-search-as-you-type-field-type-words-or-letters/279463 "2021-07-23T12:24:03Z")
I assumed they were letters, but I can't get the field to behave the way I want (which is to have it support infix searches, like searching for "ethylpre" should match "methylprednisolone"). --- ## [How update ILM for exist indexes after changes steps ILM policy?](https://discuss.elastic.co/t/how-update-ilm-for-exist-indexes-after-changes-steps-ilm-policy/279471)
**Author:** [@zakabluk](https://discuss.elastic.co/u/zakabluk)\ **Replies:** 0\ **Last updated:** [July 23, 2021, 10:54am UTC](https://discuss.elastic.co/t/how-update-ilm-for-exist-indexes-after-changes-steps-ilm-policy/279471 "2021-07-23T10:54:28Z")
Hi! I Use ELK 7.13.3. I was updated my cluster from 7.9.3 for fixet bug with datastream deliting. I have datastream which storing 7/14/30/60 days. I was change ILM policy and removed rollover step. Now I have only delet… --- ## [Logstash URL parameter as tags](https://discuss.elastic.co/t/logstash-url-parameter-as-tags/279285)
**Author:** [@juanmav](https://discuss.elastic.co/u/juanmav)\ **Replies:** 7\ **Last updated:** [July 23, 2021, 9:22am UTC](https://discuss.elastic.co/t/logstash-url-parameter-as-tags/279285 "2021-07-23T09:22:28Z")
Hi all, I have this working configuration that receives logs from heroku and process then using grok and add a couple of tags from enviroments vars. input { http { port =\> "${PORT}" tags =\> \["${TAG}… --- ## [Failure load balance](https://discuss.elastic.co/t/failure-load-balance/279373)
**Author:** [@mcosta](https://discuss.elastic.co/u/mcosta)\ **Replies:** 4\ **Last updated:** [July 23, 2021, 9:16am UTC](https://discuss.elastic.co/t/failure-load-balance/279373 "2021-07-23T09:16:10Z")
Hi all, New, RHEL based, 5-node elasticsearch cluster installed here (ver 7.13.3). Elasticsearch clients are Logstash and some In-house applications. My main concern is node failure. I know that logstash would load b… --- ## [How to lower the score of documents that match a specific field and value using ElasticSearch DSL C#](https://discuss.elastic.co/t/how-to-lower-the-score-of-documents-that-match-a-specific-field-and-value-using-elasticsearch-dsl-c/279459)
**Author:** [@Jay2](https://discuss.elastic.co/u/Jay2)\ **Replies:** 0\ **Last updated:** [July 23, 2021, 8:48am UTC](https://discuss.elastic.co/t/how-to-lower-the-score-of-documents-that-match-a-specific-field-and-value-using-elasticsearch-dsl-c/279459 "2021-07-23T08:48:41Z")
When I carry out a search I look for documents with a lang code of 'en' and 'gen', im trying to ensure that the 'en' ones appear before the 'gen' ones do. So after looking around, I found this Boosting that might fit the… --- ## [Problem after upgrade to 7.13.3 "source primary is allocated on another node" and CLONE\_TEMP\_TO\_TARGET -\> CLONE\_TEMP\_TO\_TARGET](https://discuss.elastic.co/t/problem-after-upgrade-to-7-13-3-source-primary-is-allocated-on-another-node-and-clone-temp-to-target-clone-temp-to-target/279404)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 1\ **Last updated:** [July 23, 2021, 8:48am UTC](https://discuss.elastic.co/t/problem-after-upgrade-to-7-13-3-source-primary-is-allocated-on-another-node-and-clone-temp-to-target-clone-temp-to-target/279404 "2021-07-23T08:48:23Z")
After we upgraded Elastic from 7.9 to 7.13.3 (on VM Centos7) all elasticsearch nodes has started but we couldnt start kibana the reason was it tries to migrate .kibana which si blocked by error "source primary is all… --- ## [ElasticSearch doesn't support date math for alias when create index template yet?](https://discuss.elastic.co/t/elasticsearch-doesnt-support-date-math-for-alias-when-create-index-template-yet/279368)
**Author:** [@JohnPhilip](https://discuss.elastic.co/u/JohnPhilip)\ **Replies:** 3\ **Last updated:** [July 23, 2021, 8:27am UTC](https://discuss.elastic.co/t/elasticsearch-doesnt-support-date-math-for-alias-when-create-index-template-yet/279368 "2021-07-23T08:27:19Z")
It seems that date math support index alias names in 7.13, but using date math when creating index template is still wrong, here is the curl cmd and result I get when create template with date math alias #cmd curl -XPUT… --- ## [Unable to print Error message into a watcher alert](https://discuss.elastic.co/t/unable-to-print-error-message-into-a-watcher-alert/278765)
**Author:** [@Diyatom](https://discuss.elastic.co/u/Diyatom)\ **Replies:** 3\ **Last updated:** [July 23, 2021, 8:04am UTC](https://discuss.elastic.co/t/unable-to-print-error-message-into-a-watcher-alert/278765 "2021-07-23T08:04:33Z")
Hi, I want to print out the error message from my logs into my mail. However, its giving me this error. Below is the alert jason code i am using: Can you please help. I am new in elastic search and am trying to pr… --- ## [Error handling geopoint values](https://discuss.elastic.co/t/error-handling-geopoint-values/279337)
**Author:** [@anon17386273](https://discuss.elastic.co/u/anon17386273)\ **Replies:** 3\ **Last updated:** [July 23, 2021, 7:53am UTC](https://discuss.elastic.co/t/error-handling-geopoint-values/279337 "2021-07-23T07:53:06Z")
Hi all For geopoint fields, is ignore\_malformed option the proper way to keep non-geopoint formats not indexed? My concern is whether there is any performance impact if my data has a lot of null and out of range latl… --- ## [Winlogbeat disable IPv6 parsing](https://discuss.elastic.co/t/winlogbeat-disable-ipv6-parsing/279450)
**Author:** [@yango](https://discuss.elastic.co/u/yango)\ **Replies:** 0\ **Last updated:** [July 23, 2021, 7:22am UTC](https://discuss.elastic.co/t/winlogbeat-disable-ipv6-parsing/279450 "2021-07-23T07:22:35Z")
Is it possible to parse only ipv4 formatted field without including ipv6? Right now my host.ip field in elasticsearch includes multiple values of ipv6 and ipv4 at once. I'm using Winlogbeat 7.10.2 OSS. --- ## [LOGSTASH - GSUB - DOESN'T MATCH](https://discuss.elastic.co/t/logstash-gsub-doesnt-match/279227)
**Author:** [@Daniel\_Lopez](https://discuss.elastic.co/u/Daniel_Lopez)\ **Replies:** 13\ **Last updated:** [July 23, 2021, 7:18am UTC](https://discuss.elastic.co/t/logstash-gsub-doesnt-match/279227 "2021-07-23T07:18:27Z")
Hi I tried to change a value in a field for use it like id but i couldn't modify the field value with gsub The data i have in the field is like this: rId = ABC0\_L123456\_789012 and only data i want is 123456 from rId, t… --- ## [TSVB Tophits aggregation for strings doesn't work](https://discuss.elastic.co/t/tsvb-tophits-aggregation-for-strings-doesnt-work/278802)
**Author:** [@BitBucketUser\_user](https://discuss.elastic.co/u/BitBucketUser_user)\ **Replies:** 5\ **Last updated:** [July 23, 2021, 6:31am UTC](https://discuss.elastic.co/t/tsvb-tophits-aggregation-for-strings-doesnt-work/278802 "2021-07-23T06:31:34Z")
Hello, I'm using Kibana 7.13.2. This is my data - POST tsvb/\_bulk?refresh {"index":{}} { "date":"2021-07-14T00:03:13.679+02:00","words":\["rain", "thunder"\],"type":"monsoon"} {"index":{}} {"date":"2021-07-14T00:03:13.… --- ## [Parse springboot logs using logstash](https://discuss.elastic.co/t/parse-springboot-logs-using-logstash/279422)
**Author:** [@Nikparab](https://discuss.elastic.co/u/Nikparab)\ **Replies:** 8\ **Last updated:** [July 23, 2021, 5:44am UTC](https://discuss.elastic.co/t/parse-springboot-logs-using-logstash/279422 "2021-07-23T05:44:25Z")
Hi Team, I need to parse below logs using logstash. I used grok but it is giving parsingerror. Grok- filter { grok { match =\> {"message" =\> "%{TIMESTAMP\_ISO8601:timestamp} %{LOGLEVEL:loglevel} %{JAVACLASS:logclass} … --- ## [Aggregation Pagination](https://discuss.elastic.co/t/aggregation-pagination/279444)
**Author:** [@raonic](https://discuss.elastic.co/u/raonic)\ **Replies:** 0\ **Last updated:** [July 23, 2021, 4:07am UTC](https://discuss.elastic.co/t/aggregation-pagination/279444 "2021-07-23T04:07:53Z")
Hello, I am using ElasticSearch aggregations to group results. More specifically, I am using a composite aggregation at the top level and then using a bucket selector sub-aggregation to determine what buckets are to be … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1308) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1310)