# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1330 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1331 --- ## [Can No Longer Use Range Condition to Drop Events By Event ID?](https://discuss.elastic.co/t/can-no-longer-use-range-condition-to-drop-events-by-event-id/278206)
**Author:** [@eafrost.cissp](https://discuss.elastic.co/u/eafrost.cissp)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 4:05pm UTC](https://discuss.elastic.co/t/can-no-longer-use-range-condition-to-drop-events-by-event-id/278206 "2021-07-08T16:05:39Z")
This post is a continuation of https://discuss.elastic.co/t/winlogbeat-7-13-0-expected-int-but-got-type-string-in-equals-condition/274273/3, which didn't produce a complete solution for me. With the change of data type f… --- ## [Create a table showing two "sibling" elements](https://discuss.elastic.co/t/create-a-table-showing-two-sibling-elements/278112)
**Author:** [@rgahan5c](https://discuss.elastic.co/u/rgahan5c)\ **Replies:** 7\ **Last updated:** [July 8, 2021, 3:33pm UTC](https://discuss.elastic.co/t/create-a-table-showing-two-sibling-elements/278112 "2021-07-08T15:33:34Z")
I have data that is in the form: { user\_email: "test@example.com", number\_of\_emails\_sent: 100, ... } I would like to display it in a table like: User Email Number of Emails Sent test@examp… --- ## [Node dont start after server crash](https://discuss.elastic.co/t/node-dont-start-after-server-crash/278204)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 3:12pm UTC](https://discuss.elastic.co/t/node-dont-start-after-server-crash/278204 "2021-07-08T15:12:35Z")
We run ES 7.13.2 on k8s, with Docker engine. This is simple 3 nodes cluster with 10 indices and less than 100Go of data. The ES cluster is used to monitore another ES cluster which is working fine (via metricbeat). Our… --- ## [How to create several roles at once](https://discuss.elastic.co/t/how-to-create-several-roles-at-once/278203)
**Author:** [@mcosta](https://discuss.elastic.co/u/mcosta)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 3:12pm UTC](https://discuss.elastic.co/t/how-to-create-several-roles-at-once/278203 "2021-07-08T15:12:34Z")
Hi all, Is there a way to create several roles at once using POST /\_security/role/ API? If so, can someone plz give an example? The ideia here is to first use GET /\_security/role/, remove all reserved roles and then u… --- ## [Data stream tracks generation](https://discuss.elastic.co/t/data-stream-tracks-generation/275729)
**Author:** [@demudrol](https://discuss.elastic.co/u/demudrol)\ **Replies:** 1\ **Last updated:** [July 8, 2021, 3:00pm UTC](https://discuss.elastic.co/t/data-stream-tracks-generation/275729 "2021-07-08T15:00:42Z")
Hi! There is information about following convention: .ds-\-\-\ But when define data stream in index template like this: "index\_patterns": \["my-data-stream-\*"\], "data\_stream": { }, … --- ## [No option for managing index patterns after Kibana Upgrade](https://discuss.elastic.co/t/no-option-for-managing-index-patterns-after-kibana-upgrade/278201)
**Author:** [@Toumal](https://discuss.elastic.co/u/Toumal)\ **Replies:** 1\ **Last updated:** [July 8, 2021, 2:55pm UTC](https://discuss.elastic.co/t/no-option-for-managing-index-patterns-after-kibana-upgrade/278201 "2021-07-08T14:55:31Z")
I've recently upgraded to the latest Kibana version (7.13) and now I don't see any option to manage index patterns. Any hints what I can do here? I have quite a few dashboards set up and simply starting over is not r… --- ## ["allocate\_explanation" : "allocation temporarily throttled"](https://discuss.elastic.co/t/allocate-explanation-allocation-temporarily-throttled/276709)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 0\ **Last updated:** [June 23, 2021, 1:21am UTC](https://discuss.elastic.co/t/allocate-explanation-allocation-temporarily-throttled/276709 "2021-06-23T01:21:10Z")
Hello World! Per Cluster Allocation Explain API | Elasticsearch Guide \[6.8\] | Elastic - I ran and got following: GET /\_cluster/allocation/explain "node\_decision" : "throttled", "deciders" : \[ { … --- ## [Datafeed creation via API](https://discuss.elastic.co/t/datafeed-creation-via-api/278090)
**Author:** [@StephaneB](https://discuss.elastic.co/u/StephaneB)\ **Replies:** 4\ **Last updated:** [July 8, 2021, 2:43pm UTC](https://discuss.elastic.co/t/datafeed-creation-via-api/278090 "2021-07-08T14:43:08Z")
Hi, I have created 2 identical datafeed: 1 datafeed created via Kibana (datafeed\_job\_device1) 1 datafeed created via API (api\_datafeed\_api\_job\_device1) The 2 resulting JSON files related to these 2 datafeed are exact… --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/277844)
**Author:** [@sagar.pattnayak](https://discuss.elastic.co/u/sagar.pattnayak)\ **Replies:** 7\ **Last updated:** [July 8, 2021, 2:17pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/277844 "2021-07-08T14:17:09Z")
Hi There, I have recently enabled SSL for my elastic instance using out company provided SSL certificate. The elasticsearch is running fine and i can query it using https url. However when I open Kibana it says "Kibana … --- ## [Elasticsearch 7.13](https://discuss.elastic.co/t/elasticsearch-7-13/278193)
**Author:** [@Krunal](https://discuss.elastic.co/u/Krunal)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 2:01pm UTC](https://discuss.elastic.co/t/elasticsearch-7-13/278193 "2021-07-08T14:01:05Z")
Hello Expert, I have installed ELK stack on rhel and Power BI on window 10. But by which ways I can do the connectivity ? is there any plugin through which it can be connected. --- ## [Get grouped results along with siblings not matching the filter criteria](https://discuss.elastic.co/t/get-grouped-results-along-with-siblings-not-matching-the-filter-criteria/278003)
**Author:** [@Federico\_Martinez](https://discuss.elastic.co/u/Federico_Martinez)\ **Replies:** 5\ **Last updated:** [July 8, 2021, 1:21pm UTC](https://discuss.elastic.co/t/get-grouped-results-along-with-siblings-not-matching-the-filter-criteria/278003 "2021-07-08T13:21:00Z")
Hi, is it possible to query elastic for documents matching a filter criteria, grouped by a field and also get any sibling documents not matching the filter criteria? By siblings I mean documents having the same value on… --- ## [Kibana custome timestamp and @timeestamp are different](https://discuss.elastic.co/t/kibana-custome-timestamp-and-timeestamp-are-different/277561)
**Author:** [@mrunalini](https://discuss.elastic.co/u/mrunalini)\ **Replies:** 22\ **Last updated:** [July 8, 2021, 1:14pm UTC](https://discuss.elastic.co/t/kibana-custome-timestamp-and-timeestamp-are-different/277561 "2021-07-08T13:14:00Z")
Hi Team, I am using below xml/xpath statement to convert my string timestamp to date type timestamp in logstash input - 2021-06-30-20:11:23 xpath - xpath =\>\[ "concat(substring(/AdMsg/AdLels/AuditLevel/TS/text(), 1,10)… --- ## [Break in Cluster Overview Graph](https://discuss.elastic.co/t/break-in-cluster-overview-graph/277224)
**Author:** [@mani1](https://discuss.elastic.co/u/mani1)\ **Replies:** 2\ **Last updated:** [July 8, 2021, 12:59pm UTC](https://discuss.elastic.co/t/break-in-cluster-overview-graph/277224 "2021-07-08T12:59:44Z")
In my Cluster Overview graph of Kibana Monitor, sometime there are breaks in the graph. I have checked that during this time there is not any Node, Logstash down, no error found in logs. Can somebody suggest what are the… --- ## [Changing Time Format](https://discuss.elastic.co/t/changing-time-format/278115)
**Author:** [@Wilks](https://discuss.elastic.co/u/Wilks)\ **Replies:** 3\ **Last updated:** [July 8, 2021, 12:53pm UTC](https://discuss.elastic.co/t/changing-time-format/278115 "2021-07-08T12:53:25Z")
I have a filter that is reading 2 fields (STARTTIME and ENDTIME) from a CSV file and then changing to deviceCustomString1 and deviceCustomString2 and I need to change the time layout. I am trying to change the time form… --- ## [Unable to send email alert using email connector in kibana](https://discuss.elastic.co/t/unable-to-send-email-alert-using-email-connector-in-kibana/278059)
**Author:** [@cuongnp](https://discuss.elastic.co/u/cuongnp)\ **Replies:** 5\ **Last updated:** [July 8, 2021, 12:15pm UTC](https://discuss.elastic.co/t/unable-to-send-email-alert-using-email-connector-in-kibana/278059 "2021-07-08T12:15:39Z")
Hi Community, After enable TLS connection between kibana and Elasticsearch ,I'm unable to send email alert using email connector. When send test mail, the result is "Error upgrading connection with STARTTLS: 454 4.7.0 … --- ## [This version of the JDBC driver is only compatible with Elasticsearch version 7.13 or newer; attempting to connect to a server version 7.4.2](https://discuss.elastic.co/t/this-version-of-the-jdbc-driver-is-only-compatible-with-elasticsearch-version-7-13-or-newer-attempting-to-connect-to-a-server-version-7-4-2/278135)
**Author:** [@MinwooKim](https://discuss.elastic.co/u/MinwooKim)\ **Replies:** 4\ **Last updated:** [July 8, 2021, 11:31am UTC](https://discuss.elastic.co/t/this-version-of-the-jdbc-driver-is-only-compatible-with-elasticsearch-version-7-13-or-newer-attempting-to-connect-to-a-server-version-7-4-2/278135 "2021-07-08T11:31:43Z")
Hello, I am trying to put my elasticsearch in database views, using intellij's Datagrip. this is where I got the jdbc driver source. meanwhile, my elastic search server has 7.4.2 version. Isn't 7.4.2 newer than 7.1… --- ## [Remove first few characters from log file - filebeat](https://discuss.elastic.co/t/remove-first-few-characters-from-log-file-filebeat/277475)
**Author:** [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\ **Replies:** 2\ **Last updated:** [July 1, 2021, 2:27pm UTC](https://discuss.elastic.co/t/remove-first-few-characters-from-log-file-filebeat/277475 "2021-07-01T14:27:54Z")
Hi Team, We are using filbeat as an agent to pull the logs from different servers, a few of the logs have prefixes that get stuck in front of actual log events. In order to parse the log files we need to remove these p… --- ## [Beats with ILM](https://discuss.elastic.co/t/beats-with-ilm/278177)
**Author:** [@Garry](https://discuss.elastic.co/u/Garry)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 11:02am UTC](https://discuss.elastic.co/t/beats-with-ilm/278177 "2021-07-08T11:02:51Z")
I am using Elastic cloud and have configured an Index Lifecycle Policy. We initially had a trial period with Elastic and have started pulling in data via filebeats, winlogbeats etc, which have created their own index te… --- ## [Is it necessary to delete a PIT?](https://discuss.elastic.co/t/is-it-necessary-to-delete-a-pit/277752)
**Author:** [@zhiyazw](https://discuss.elastic.co/u/zhiyazw)\ **Replies:** 1\ **Last updated:** [July 8, 2021, 10:33am UTC](https://discuss.elastic.co/t/is-it-necessary-to-delete-a-pit/277752 "2021-07-08T10:33:17Z")
In search after section, ELasticsearch said, "When you’re finished, you should delete your PIT". Is this necessary? Does a PIT get deleted automatically after timeout? Just as "Scroll" does. It's not easy to find a goo… --- ## [Multi value field different scoring for terms and terms\_set queries](https://discuss.elastic.co/t/multi-value-field-different-scoring-for-terms-and-terms-set-queries/278172)
**Author:** [@zordark](https://discuss.elastic.co/u/zordark)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 10:24am UTC](https://discuss.elastic.co/t/multi-value-field-different-scoring-for-terms-and-terms-set-queries/278172 "2021-07-08T10:24:28Z")
Good day, I have small question regarding scoring. I'm using example from documentation (Terms query). If I query documents by multiple values with 'terms', like: GET my-index-000001/\_search?pretty { "query": { … --- ## [Splitting csv files send to elasticsearch via logstash http input](https://discuss.elastic.co/t/splitting-csv-files-send-to-elasticsearch-via-logstash-http-input/278144)
**Author:** [@reynavan](https://discuss.elastic.co/u/reynavan)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 7:19am UTC](https://discuss.elastic.co/t/splitting-csv-files-send-to-elasticsearch-via-logstash-http-input/278144 "2021-07-08T07:19:45Z")
Hello! I am new to ELK stack and I'm looking for some advice. I have 3 different types of csv's files which are generated every day, I'm sending them to IP address where logstash is configured, than i want to visualize … --- ## [Missing authentication credentials for REST request \[/\_cluster/health?pretty\] In minimal security set up](https://discuss.elastic.co/t/missing-authentication-credentials-for-rest-request-cluster-health-pretty-in-minimal-security-set-up/278162)
**Author:** [@Mamol27](https://discuss.elastic.co/u/Mamol27)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 9:36am UTC](https://discuss.elastic.co/t/missing-authentication-credentials-for-rest-request-cluster-health-pretty-in-minimal-security-set-up/278162 "2021-07-08T09:36:57Z")
Hi! I'm trying to set up basic security on elastic cluster. my elasticsearch.yml: cluster.name: ELK-CLUSTER node.name: $HOSTNAME node.master: true node.data: false node.ingest: false network.host: 0.0.0.0 http.port: … --- ## [Logstash can't write logs in the path](https://discuss.elastic.co/t/logstash-cant-write-logs-in-the-path/278155)
**Author:** [@Andrea\_Colangelo](https://discuss.elastic.co/u/Andrea_Colangelo)\ **Replies:** 1\ **Last updated:** [July 8, 2021, 9:25am UTC](https://discuss.elastic.co/t/logstash-cant-write-logs-in-the-path/278155 "2021-07-08T09:25:04Z")
Hi, i am having an error on logstash when i start it. that's my log: Using bundled JDK: /usr/share/logstash/jdk OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will like… --- ## [Filebeat CEF Checkpoint errors](https://discuss.elastic.co/t/filebeat-cef-checkpoint-errors/278040)
**Author:** [@rainierwolf](https://discuss.elastic.co/u/rainierwolf)\ **Replies:** 5\ **Last updated:** [July 8, 2021, 8:44am UTC](https://discuss.elastic.co/t/filebeat-cef-checkpoint-errors/278040 "2021-07-08T08:44:03Z")
Hello team, I have been testing this solution for a short time and it seems very powerful. I have enabled Filebeat with the CEF module for the logs of our Checkpoint platform. I have configured filebeat indicated in the… --- ## [Logstash uses current year for timestamp without year and shows events with future dates](https://discuss.elastic.co/t/logstash-uses-current-year-for-timestamp-without-year-and-shows-events-with-future-dates/277877)
**Author:** [@theirfan](https://discuss.elastic.co/u/theirfan)\ **Replies:** 4\ **Last updated:** [July 8, 2021, 8:26am UTC](https://discuss.elastic.co/t/logstash-uses-current-year-for-timestamp-without-year-and-shows-events-with-future-dates/277877 "2021-07-08T08:26:53Z")
Hi Community !! I have logs wherein there's no year mentioned, and while parsing, logstash adds current year and makes the event appear in future dates. i checked on forums for a similar issue but unfortunately, there … --- ## [Deploying New Elastic Cluster and Migrate Live Logs](https://discuss.elastic.co/t/deploying-new-elastic-cluster-and-migrate-live-logs/278092)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 8\ **Last updated:** [July 8, 2021, 8:22am UTC](https://discuss.elastic.co/t/deploying-new-elastic-cluster-and-migrate-live-logs/278092 "2021-07-08T08:22:48Z")
Hi folks, I have following use case: I want to install a new 7.13.2 Elasticsearch cluster on some brand new VMs and migrate the indices and global cluster state from 7.6.2 cluster into it. The challenge is: there are … --- ## [Show fields by eventID](https://discuss.elastic.co/t/show-fields-by-eventid/278149)
**Author:** [@Arethusa](https://discuss.elastic.co/u/Arethusa)\ **Replies:** 1\ **Last updated:** [July 8, 2021, 8:14am UTC](https://discuss.elastic.co/t/show-fields-by-eventid/278149 "2021-07-08T08:14:11Z")
Hello, I'm on Kibana V 7.12.0 I have lot of Fields on Kibana : "Kibana\> Index Patterns" (1500+). I this case the logs are from Windows (nxlog). I have a field with windows event ID (5447 for example). Is it possibl… --- ## [No event collected from Sysmon](https://discuss.elastic.co/t/no-event-collected-from-sysmon/278147)
**Author:** [@bilel\_meddeb](https://discuss.elastic.co/u/bilel_meddeb)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 7:47am UTC](https://discuss.elastic.co/t/no-event-collected-from-sysmon/278147 "2021-07-08T07:47:50Z")
HELLO, I have installed sysmon in a Windows machine using the command: ==\> sysmon.exe -i -accepteula -h md5,sha256,imphash -l -n And then restart winlogbeat. In winlogbeat log everything is working well, and i have lo… --- ## [Kibana lens](https://discuss.elastic.co/t/kibana-lens/277807)
**Author:** [@Krunal](https://discuss.elastic.co/u/Krunal)\ **Replies:** 3\ **Last updated:** [July 8, 2021, 7:39am UTC](https://discuss.elastic.co/t/kibana-lens/277807 "2021-07-08T07:39:56Z")
Hello Expert, Is there any possibility that to do changes in the tool tip... in lens it shows all the values which is correspondence to the data. But i need just focused like in TSVB Thanks --- ## [Kibana dashboard DSL aggregations problem](https://discuss.elastic.co/t/kibana-dashboard-dsl-aggregations-problem/278014)
**Author:** [@harryb](https://discuss.elastic.co/u/harryb)\ **Replies:** 3\ **Last updated:** [July 8, 2021, 7:35am UTC](https://discuss.elastic.co/t/kibana-dashboard-dsl-aggregations-problem/278014 "2021-07-08T07:35:35Z")
I am trying to filter an Elastic index to only return one record per doc\_id and which I want to base the visualization on. If I use this in a Kibana dashboard visualization filter I get an error: '\[size\] query malformed,… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1329) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1331)