# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1342 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1343 --- ## [Grok Pattern for line - custom date](https://discuss.elastic.co/t/grok-pattern-for-line-custom-date/277412)
**Author:** [@Kamikaze\_K](https://discuss.elastic.co/u/Kamikaze_K)\ **Replies:** 1\ **Last updated:** [June 30, 2021, 12:27pm UTC](https://discuss.elastic.co/t/grok-pattern-for-line-custom-date/277412 "2021-06-30T12:27:12Z")
I am trying to use a grok pattern to get the fields from the following. any help with this especially with the custom date? 0E7 10JUN21 23:37:53.8 Track 1 EZ: 100 EX: 72 Speed: 36 mph I need to get the fields; "date" … --- ## [\[savedobjects-service\] Unable to retrieve version information from Elasticsearch nodes](https://discuss.elastic.co/t/savedobjects-service-unable-to-retrieve-version-information-from-elasticsearch-nodes/277416)
**Author:** [@ibreighith](https://discuss.elastic.co/u/ibreighith)\ **Replies:** 1\ **Last updated:** [June 30, 2021, 12:26pm UTC](https://discuss.elastic.co/t/savedobjects-service-unable-to-retrieve-version-information-from-elasticsearch-nodes/277416 "2021-06-30T12:26:31Z")
Kibana.yml # Kibana is served by a back end server. This setting specifies the port to use. #server.port: 5601 # Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid va… --- ## [Index lifecycle policy - warm phase not readonly](https://discuss.elastic.co/t/index-lifecycle-policy-warm-phase-not-readonly/275698)
**Author:** [@calauzon\_genetec](https://discuss.elastic.co/u/calauzon_genetec)\ **Replies:** 2\ **Last updated:** [June 30, 2021, 12:14pm UTC](https://discuss.elastic.co/t/index-lifecycle-policy-warm-phase-not-readonly/275698 "2021-06-30T12:14:08Z")
Hello, I am confused about an index I created. I have a template, which uses a lifecycle policy as follows: { "policy": { "phases": { "hot": { "actions": { "set\_priority": { "p… --- ## [How to add Windows service name in the alert](https://discuss.elastic.co/t/how-to-add-windows-service-name-in-the-alert/277451)
**Author:** [@Manan](https://discuss.elastic.co/u/Manan)\ **Replies:** 0\ **Last updated:** [June 30, 2021, 11:27am UTC](https://discuss.elastic.co/t/how-to-add-windows-service-name-in-the-alert/277451 "2021-06-30T11:27:38Z")
Hi, I am monitoring windows services and using metricbeat 7.12. I have created an alert which works fine. But I would like to add name of the service in the alert message. How can I add the service name in the alert … --- ## [How to quote/escape esQuery when it contains quotes?](https://discuss.elastic.co/t/how-to-quote-escape-esquery-when-it-contains-quotes/277384)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 2\ **Last updated:** [June 30, 2021, 11:26am UTC](https://discuss.elastic.co/t/how-to-quote-escape-esquery-when-it-contains-quotes/277384 "2021-06-30T11:26:31Z")
Dear all =) I am using the Create Rule API with the Elasticsearch query action. It works perfectly until I need to query something that includes quotes. Example host:"10.250.11.11". Ideally I would like to write it as … --- ## [Filebeat tcp and Udp error](https://discuss.elastic.co/t/filebeat-tcp-and-udp-error/277087)
**Author:** [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\ **Replies:** 6\ **Last updated:** [June 30, 2021, 11:14am UTC](https://discuss.elastic.co/t/filebeat-tcp-and-udp-error/277087 "2021-06-30T11:14:43Z")
Am getting the following error, can anyone please help? Exiting: Failed to start crawler: starting input failed: Error while initializing input: you must choose between TCP or UDP. Where do I configure the TCP and UDP… --- ## [Parsing data presented in the form of a table](https://discuss.elastic.co/t/parsing-data-presented-in-the-form-of-a-table/273143)
**Author:** [@San9](https://discuss.elastic.co/u/San9)\ **Replies:** 8\ **Last updated:** [June 30, 2021, 9:58am UTC](https://discuss.elastic.co/t/parsing-data-presented-in-the-form-of-a-table/273143 "2021-06-30T09:58:12Z")
Hello team. More and more often you have to work with logos that come to logstash in the form of a table: Network Management Card AOS v3.7.3 Symmetra APP v1.1.2 Date Time Name Contact Location System IP 23.0… --- ## [Metricbeat internal collection not sending data to elasticsearch](https://discuss.elastic.co/t/metricbeat-internal-collection-not-sending-data-to-elasticsearch/277441)
**Author:** [@luminance](https://discuss.elastic.co/u/luminance)\ **Replies:** 0\ **Last updated:** [June 30, 2021, 9:53am UTC](https://discuss.elastic.co/t/metricbeat-internal-collection-not-sending-data-to-elasticsearch/277441 "2021-06-30T09:53:12Z")
I am running a Metricbeat 7.13.2 (first tried with 7.7.1) on Ubuntu 18.04 which is supposed to send monitoring data to Elastic Cloud instance (7.10.0) using the internal collection, but I don't understand where things ar… --- ## [Difference between log and dashboard](https://discuss.elastic.co/t/difference-between-log-and-dashboard/277066)
**Author:** [@Arethusa](https://discuss.elastic.co/u/Arethusa)\ **Replies:** 2\ **Last updated:** [June 30, 2021, 9:33am UTC](https://discuss.elastic.co/t/difference-between-log-and-dashboard/277066 "2021-06-30T09:33:38Z")
Hello, I'm on Kibana v7.12.0 I have a fied "CommanLine" and in THIS log is very long. And when i want to add it on Dashboard, I have (Missing Value) but only for this field, the other are ok. I supose it's becau… --- ## [Packetbeat index template clone](https://discuss.elastic.co/t/packetbeat-index-template-clone/277437)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 0\ **Last updated:** [June 30, 2021, 9:21am UTC](https://discuss.elastic.co/t/packetbeat-index-template-clone/277437 "2021-06-30T09:21:21Z")
Hello, I would like to run packetbeat in 2 machines, and I would like to create 2 users, where the user 1 can see only logs of the first machine and user 2 can see only the logs of 2nd machine. To do so, I began by clo… --- ## [How to display 0 count field values in Elastic DSL Query](https://discuss.elastic.co/t/how-to-display-0-count-field-values-in-elastic-dsl-query/275137)
**Author:** [@prabhakar\_talari](https://discuss.elastic.co/u/prabhakar_talari)\ **Replies:** 2\ **Last updated:** [June 30, 2021, 8:43am UTC](https://discuss.elastic.co/t/how-to-display-0-count-field-values-in-elastic-dsl-query/275137 "2021-06-30T08:43:32Z")
All, I am trying to find out a way to display input field values in Elastic watcher which are having 0 count records. For example my input fields and values are hostname=sample.com and source=/tmp/sample/log I am usin… --- ## [Search/Filter on exact keyword with email value](https://discuss.elastic.co/t/search-filter-on-exact-keyword-with-email-value/277425)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 2\ **Last updated:** [June 30, 2021, 8:30am UTC](https://discuss.elastic.co/t/search-filter-on-exact-keyword-with-email-value/277425 "2021-06-30T08:30:54Z")
We cannot find documents with an email keyword exact match. Other keywords work so I guess it's the @ symbol. How do we /\_search documents with exact keyword match I thought keywords worked with exact match only (no to… --- ## [If Else condition based on input log lines in logstash](https://discuss.elastic.co/t/if-else-condition-based-on-input-log-lines-in-logstash/277336)
**Author:** [@sudo-ranjith](https://discuss.elastic.co/u/sudo-ranjith)\ **Replies:** 2\ **Last updated:** [June 30, 2021, 8:22am UTC](https://discuss.elastic.co/t/if-else-condition-based-on-input-log-lines-in-logstash/277336 "2021-06-30T08:22:52Z")
Hi There, I would like to write a logstash config file with an if else condition. line 1: "Severity","ThreadID","Date","Time","Application","Message" GROK for Line 1: %{DATA:Severity}","%{DATA:ThreadID}","%{DATA:Dat… --- ## [Filebeat output empty JSON array as "null" instead of "\[\]"](https://discuss.elastic.co/t/filebeat-output-empty-json-array-as-null-instead-of/276604)
**Author:** [@ijingo](https://discuss.elastic.co/u/ijingo)\ **Replies:** 1\ **Last updated:** [June 30, 2021, 7:49am UTC](https://discuss.elastic.co/t/filebeat-output-empty-json-array-as-null-instead-of/276604 "2021-06-30T07:49:23Z")
Filebeat output empty JSON array as "null" instead of \[ \]. The original line of JSON is as follows, in which "array\_field" is an empty array. {"body": {"array\_field": \[\]}} However, after output, the "array\_field" is c… --- ## [Error: can’t merge a non object mapping with an object mapping](https://discuss.elastic.co/t/error-can-t-merge-a-non-object-mapping-with-an-object-mapping/276773)
**Author:** [@jofr](https://discuss.elastic.co/u/jofr)\ **Replies:** 1\ **Last updated:** [June 30, 2021, 7:45am UTC](https://discuss.elastic.co/t/error-can-t-merge-a-non-object-mapping-with-an-object-mapping/276773 "2021-06-30T07:45:50Z")
Somehow I can not define a geo\_point field type in the Elasticsearch mapping and then import data with Logstash. The details are described here in this Stackoverflow question. If I do not define an Elasticsearch mapping… --- ## [Elasticsearch-browser not connecting to remote server](https://discuss.elastic.co/t/elasticsearch-browser-not-connecting-to-remote-server/277417)
**Author:** [@ayush28j](https://discuss.elastic.co/u/ayush28j)\ **Replies:** 1\ **Last updated:** [June 30, 2021, 7:32am UTC](https://discuss.elastic.co/t/elasticsearch-browser-not-connecting-to-remote-server/277417 "2021-06-30T07:32:58Z")
Hello everyone, I have a elasticsearch server running on google compute engine at port 9200 with no problems in firewalls. When I run this curl command: curl -u elastic:passwordChanged -H "User-Agent: Mozilla" -H "Ori… --- ## [TSVB Time Series](https://discuss.elastic.co/t/tsvb-time-series/277351)
**Author:** [@Krunal](https://discuss.elastic.co/u/Krunal)\ **Replies:** 6\ **Last updated:** [June 30, 2021, 7:22am UTC](https://discuss.elastic.co/t/tsvb-time-series/277351 "2021-06-30T07:22:24Z")
I have created Time series chart and now I would like to implement alert on it. Is there any possibility? if yes, then pls give me some idea regarding it. Thanks --- ## [Super slow dashboard](https://discuss.elastic.co/t/super-slow-dashboard/277206)
**Author:** [@Mik\_a](https://discuss.elastic.co/u/Mik_a)\ **Replies:** 5\ **Last updated:** [June 30, 2021, 6:55am UTC](https://discuss.elastic.co/t/super-slow-dashboard/277206 "2021-06-30T06:55:12Z")
It takes many minutes to update data in Kibana dashboard. How can I know if it is kibana or elasticsearch that I need to upgrade? Both have 2Gb ram and 2 zones --- ## [Elasticsearch CCR. Role mappings](https://discuss.elastic.co/t/elasticsearch-ccr-role-mappings/277413)
**Author:** [@Armen\_Petrosyan](https://discuss.elastic.co/u/Armen_Petrosyan)\ **Replies:** 0\ **Last updated:** [June 30, 2021, 6:25am UTC](https://discuss.elastic.co/t/elasticsearch-ccr-role-mappings/277413 "2021-06-30T06:25:48Z")
I configured Elasticsearch to work with mutual TLS authentication and authorization is done using pki realm. While replication data between clusters (CCR) it uses transport layer, I have the same CA on both clusters, so… --- ## [How to force filebeat to send older logs to logstash without duplication](https://discuss.elastic.co/t/how-to-force-filebeat-to-send-older-logs-to-logstash-without-duplication/277405)
**Author:** [@rojin](https://discuss.elastic.co/u/rojin)\ **Replies:** 0\ **Last updated:** [June 30, 2021, 4:27am UTC](https://discuss.elastic.co/t/how-to-force-filebeat-to-send-older-logs-to-logstash-without-duplication/277405 "2021-06-30T04:27:29Z")
Hello, I have set up the Filebeat to send logs to Logstash. How can I make it send older logs that had not been parsed, to Logstash? Will the logs that have been parsed up to now be duplicated? Can I specify a period of… --- ## [Shrinked ip address field](https://discuss.elastic.co/t/shrinked-ip-address-field/277376)
**Author:** [@roonick](https://discuss.elastic.co/u/roonick)\ **Replies:** 2\ **Last updated:** [June 30, 2021, 4:39am UTC](https://discuss.elastic.co/t/shrinked-ip-address-field/277376 "2021-06-30T04:39:47Z")
Good day! I want to create additional field for nginx access log. This field must contain left octets of IP-address. For examle. If remote IP is 192.168.1.10, field will contain only 192.168.1. Sorry, my English is not… --- ## [Gsub - Replace windows line terminators (\\r\\n) with unix (\\n)](https://discuss.elastic.co/t/gsub-replace-windows-line-terminators-r-n-with-unix-n/277394)
**Author:** [@metalshanked](https://discuss.elastic.co/u/metalshanked)\ **Replies:** 2\ **Last updated:** [June 30, 2021, 2:50am UTC](https://discuss.elastic.co/t/gsub-replace-windows-line-terminators-r-n-with-unix-n/277394 "2021-06-30T02:50:59Z")
Hi, I am trying to format a csv file so that it can be used in the translate filter. the csv file has only two columns (comma separated) with windows line ending format (CRLF) which somehow causes the translate filter… --- ## [Translate filter multiple values in same label ECS field](https://discuss.elastic.co/t/translate-filter-multiple-values-in-same-label-ecs-field/277391)
**Author:** [@metalshanked](https://discuss.elastic.co/u/metalshanked)\ **Replies:** 3\ **Last updated:** [June 30, 2021, 2:22am UTC](https://discuss.elastic.co/t/translate-filter-multiple-values-in-same-label-ecs-field/277391 "2021-06-30T02:22:31Z")
Hi, I am looking to populate the \[labels\]\[feed\] field (labels is the ECS field) with contents from two separate CSV fields as below. I am hoping to have it as an array. Is this a correct approach? If not, what would be… --- ## [Logstash stopped processing because of an error: (SystemExit) exit](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error-systemexit-exit/275744)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 27\ **Last updated:** [June 30, 2021, 2:20am UTC](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error-systemexit-exit/275744 "2021-06-30T02:20:16Z")
Logstash has suddenly stopped collecting. If you look at the log, you will see the following message Logstash stopped processing because of an error: (SystemExit) exit What does this mean? I have checked that the con… --- ## [Unable to access Kibana with “License is not available.”](https://discuss.elastic.co/t/unable-to-access-kibana-with-license-is-not-available/274323)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 7\ **Last updated:** [June 30, 2021, 2:13am UTC](https://discuss.elastic.co/t/unable-to-access-kibana-with-license-is-not-available/274323 "2021-06-30T02:13:41Z")
I have installed WorkplaceSearch. I added the x-pack configuration to ElasticSearch by referring to the following URL. Specifically, I have made the following statement. $vi /etc/elasticsearch/elasticsearch.yml xpack… --- ## [How to run elasticsearch-head permanently](https://discuss.elastic.co/t/how-to-run-elasticsearch-head-permanently/277320)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 2\ **Last updated:** [June 30, 2021, 12:49am UTC](https://discuss.elastic.co/t/how-to-run-elasticsearch-head-permanently/277320 "2021-06-30T00:49:14Z")
I've cloned git and installed elasticsearch-head. I've been running it in the background while the terminal is running, but I want to keep it running after I close the terminal. I ran the following command, but when I … --- ## [Help with handling errors sent by api](https://discuss.elastic.co/t/help-with-handling-errors-sent-by-api/276421)
**Author:** [@Agustin\_Fernandez](https://discuss.elastic.co/u/Agustin_Fernandez)\ **Replies:** 7\ **Last updated:** [June 29, 2021, 10:42pm UTC](https://discuss.elastic.co/t/help-with-handling-errors-sent-by-api/276421 "2021-06-29T22:42:00Z")
Hi! I am needing help with the rest api schema. I want to make my program send the data to elastic but that it can be seen as is this example. The code that I had thought to use was this { "mappings": { … --- ## [Runtime in Kibana Visualization Only (without using Index Pattern/Index Runtime Field)](https://discuss.elastic.co/t/runtime-in-kibana-visualization-only-without-using-index-pattern-index-runtime-field/276979)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 6\ **Last updated:** [June 29, 2021, 10:29pm UTC](https://discuss.elastic.co/t/runtime-in-kibana-visualization-only-without-using-index-pattern-index-runtime-field/276979 "2021-06-29T22:29:04Z")
Hi All, I was wondering if there is a way to add a runtime field that is only available in a single Kibana visualization. Looking at the runtime field docs it seems possible to add the field at query execution time. Th… --- ## [How to configure syslog (input) in logstash conf file](https://discuss.elastic.co/t/how-to-configure-syslog-input-in-logstash-conf-file/277349)
**Author:** [@MdRashid](https://discuss.elastic.co/u/MdRashid)\ **Replies:** 7\ **Last updated:** [June 29, 2021, 10:26pm UTC](https://discuss.elastic.co/t/how-to-configure-syslog-input-in-logstash-conf-file/277349 "2021-06-29T22:26:30Z")
Hi All, Im new to ELK i have config ELK in ubuntu as a docker container when i check kibana URL No Elasticsearch indices match your pattern. Note: - My VM is store in google cloud Here is my logstash.conf file in… --- ## [Module status](https://discuss.elastic.co/t/module-status/277348)
**Author:** [@viridiana](https://discuss.elastic.co/u/viridiana)\ **Replies:** 0\ **Last updated:** [June 29, 2021, 12:08pm UTC](https://discuss.elastic.co/t/module-status/277348 "2021-06-29T12:08:27Z")
Hello, my problem is that I am generating windows metrics for azure and all the steps are executed correctly but when I want to see the Module status it tells me "No data has been received from this module yet" and cmd a… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1341) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1343)