# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1348 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1349 --- ## [Date filter problems after upgrade](https://discuss.elastic.co/t/date-filter-problems-after-upgrade/274841)
**Author:** [@Renato](https://discuss.elastic.co/u/Renato)\ **Replies:** 1\ **Last updated:** [June 25, 2021, 4:25pm UTC](https://discuss.elastic.co/t/date-filter-problems-after-upgrade/274841 "2021-06-25T16:25:19Z")
Hey, we are having problems after we upgraded elk to 7.12.1 (I'm not sure which version we previously used 7.xx). The date filter which we previously used is not working anymore. We don't get any logs in elastic. If I w… --- ## [Kibana - Splitting series by field names](https://discuss.elastic.co/t/kibana-splitting-series-by-field-names/276984)
**Author:** [@dineshgaglani](https://discuss.elastic.co/u/dineshgaglani)\ **Replies:** 2\ **Last updated:** [June 25, 2021, 4:06pm UTC](https://discuss.elastic.co/t/kibana-splitting-series-by-field-names/276984 "2021-06-25T16:06:32Z")
I was hoping to find a way to split a series by field names (and not values of a particular field) in kibana I have a data set that looks like below: { { date: 24/06/2021, foo: 12, bar: 20}, { date: 24/06/2021, foo: 16… --- ## [Data Logstash filter not putting month into @timestamp](https://discuss.elastic.co/t/data-logstash-filter-not-putting-month-into-timestamp/277079)
**Author:** [@adwearys](https://discuss.elastic.co/u/adwearys)\ **Replies:** 2\ **Last updated:** [June 25, 2021, 3:46pm UTC](https://discuss.elastic.co/t/data-logstash-filter-not-putting-month-into-timestamp/277079 "2021-06-25T15:46:01Z")
Hi, I'm trying to take the date and time from a syslog message and put it into the @timestamp field (so the @timestamp field has the date and time that the source system created the message, rather than when it arrived … --- ## [Logstash error](https://discuss.elastic.co/t/logstash-error/277048)
**Author:** [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\ **Replies:** 2\ **Last updated:** [June 25, 2021, 3:42pm UTC](https://discuss.elastic.co/t/logstash-error/277048 "2021-06-25T15:42:44Z")
I have installed logstash and the following is the .conf file input { beat { port =\> 5044 type =\> syslog } } filter { if \[type\] == "syslog" { grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} … --- ## [CSV File re-reading/re-parsing issue 7.10](https://discuss.elastic.co/t/csv-file-re-reading-re-parsing-issue-7-10/276940)
**Author:** [@Rajesh\_S](https://discuss.elastic.co/u/Rajesh_S)\ **Replies:** 3\ **Last updated:** [June 25, 2021, 3:36pm UTC](https://discuss.elastic.co/t/csv-file-re-reading-re-parsing-issue-7-10/276940 "2021-06-25T15:36:07Z")
I am trying to re-read a csv file from the beginning using sincedb set to '/dev/null'. logstash is started using --config.reload.automatic. All entries are blank when the file is re-read. This is not consistent, some tim… --- ## [KQL Max query search](https://discuss.elastic.co/t/kql-max-query-search/277061)
**Author:** [@fredrick.bb](https://discuss.elastic.co/u/fredrick.bb)\ **Replies:** 1\ **Last updated:** [June 25, 2021, 3:21pm UTC](https://discuss.elastic.co/t/kql-max-query-search/277061 "2021-06-25T15:21:08Z")
Hello, I need to figure out a KQL query to pick a max value. My data is like below Doc1 =\> AppName: "A" , Revision : 1 then other keys Doc2 =\> AppName: "A" , Revision : 2 \* \* Docn =\> AppName: "A" , Revision : n. R… --- ## [Update Query not working in Elastic 7](https://discuss.elastic.co/t/update-query-not-working-in-elastic-7/277029)
**Author:** [@rohitj559](https://discuss.elastic.co/u/rohitj559)\ **Replies:** 3\ **Last updated:** [June 25, 2021, 3:12pm UTC](https://discuss.elastic.co/t/update-query-not-working-in-elastic-7/277029 "2021-06-25T15:12:00Z")
I am trying to update(POST) a elastic record using below query but i am getting back a weird error. Request: \_update\_by\_query { "script": "{ctx.\_source.orderDocuments\[0\] = newobj};", "params": { "newobj": { … --- ## [Elasticsearch 7.4.1 java stats\_buckets](https://discuss.elastic.co/t/elasticsearch-7-4-1-java-stats-buckets/277055)
**Author:** [@jey](https://discuss.elastic.co/u/jey)\ **Replies:** 0\ **Last updated:** [June 25, 2021, 11:47am UTC](https://discuss.elastic.co/t/elasticsearch-7-4-1-java-stats-buckets/277055 "2021-06-25T11:47:21Z")
I made an elasticsearch request in json with aggregation and stats\_buckets. I have an error: org.elasticsearch.action.ActionRequestValidationException: Validation Failed: 1: No aggregation found for path \[terms\_caller… --- ## [How to make filter in beat on the logstash](https://discuss.elastic.co/t/how-to-make-filter-in-beat-on-the-logstash/276992)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 3\ **Last updated:** [June 25, 2021, 2:48pm UTC](https://discuss.elastic.co/t/how-to-make-filter-in-beat-on-the-logstash/276992 "2021-06-25T14:48:04Z")
Hi, I need to create a filter to avoid duplicating the information that I have from one index to another, in the configuration of the logstash file where the data of the first index that I upload to elastic are, I alread… --- ## [Annotated text highlighter identifies incorrect phrase hit when wrapped in function\_score query](https://discuss.elastic.co/t/annotated-text-highlighter-identifies-incorrect-phrase-hit-when-wrapped-in-function-score-query/277073)
**Author:** [@robmartin11](https://discuss.elastic.co/u/robmartin11)\ **Replies:** 0\ **Last updated:** [June 25, 2021, 2:15pm UTC](https://discuss.elastic.co/t/annotated-text-highlighter-identifies-incorrect-phrase-hit-when-wrapped-in-function-score-query/277073 "2021-06-25T14:15:52Z")
Wondering if the following could be a bug or just user error? Given I create a new index with annotated text fields: PUT test\_index { "mappings": { "properties": { "a": { "type":… --- ## [Logstash Pipeline which works fine for file input but not working when set with filebeats](https://discuss.elastic.co/t/logstash-pipeline-which-works-fine-for-file-input-but-not-working-when-set-with-filebeats/277068)
**Author:** [@MuskanBeig](https://discuss.elastic.co/u/MuskanBeig)\ **Replies:** 1\ **Last updated:** [June 25, 2021, 1:42pm UTC](https://discuss.elastic.co/t/logstash-pipeline-which-works-fine-for-file-input-but-not-working-when-set-with-filebeats/277068 "2021-06-25T13:42:12Z")
My logstash pipeline works fine with the input as file or generator plugin But the same pipeline is not working when i use beats as input plugin the filebeat is working properly --- ## [Data table visualization that shows the end message combined with the start time of a particular case](https://discuss.elastic.co/t/data-table-visualization-that-shows-the-end-message-combined-with-the-start-time-of-a-particular-case/277065)
**Author:** [@hNiven](https://discuss.elastic.co/u/hNiven)\ **Replies:** 0\ **Last updated:** [June 25, 2021, 1:36pm UTC](https://discuss.elastic.co/t/data-table-visualization-that-shows-the-end-message-combined-with-the-start-time-of-a-particular-case/277065 "2021-06-25T13:36:59Z")
Hi, I am looking to create a data table using the visualize section, where I track the outcome of multiple cases. Each case will have its own unique identifier to be able to track its lifecycle. To simplify it, I am loo… --- ## [Signs of too few shards? Number of documents per shard?](https://discuss.elastic.co/t/signs-of-too-few-shards-number-of-documents-per-shard/276972)
**Author:** [@egalpin](https://discuss.elastic.co/u/egalpin)\ **Replies:** 2\ **Last updated:** [June 25, 2021, 1:13pm UTC](https://discuss.elastic.co/t/signs-of-too-few-shards-number-of-documents-per-shard/276972 "2021-06-25T13:13:49Z")
Hi all, I'm experiencing performance challenges with an ES cluster. The cluster consists of 6 data nodes (3 hot w/ ~30GB heap, 3 warm w/ ~15GB heap). The cluster holds around 4TB of data total, with a total of 20,000,00… --- ## [Add\_kubernetes\_metadata : handle logs from containerd and docker](https://discuss.elastic.co/t/add-kubernetes-metadata-handle-logs-from-containerd-and-docker/276390)
**Author:** [@orgoz](https://discuss.elastic.co/u/orgoz)\ **Replies:** 0\ **Last updated:** [June 18, 2021, 12:34pm UTC](https://discuss.elastic.co/t/add-kubernetes-metadata-handle-logs-from-containerd-and-docker/276390 "2021-06-18T12:34:56Z")
Hello, I am using filebeat 7.9.0. I have a k8s cluster with multiple node pools using containerd and docker runtime. I want my logs from these two runtime correctly parsed and with kubernetes metadata. I am using thi… --- ## [Is it possible to reindex using a source index including a wildcard?](https://discuss.elastic.co/t/is-it-possible-to-reindex-using-a-source-index-including-a-wildcard/277059)
**Author:** [@Amphagory](https://discuss.elastic.co/u/Amphagory)\ **Replies:** 0\ **Last updated:** [June 25, 2021, 12:47pm UTC](https://discuss.elastic.co/t/is-it-possible-to-reindex-using-a-source-index-including-a-wildcard/277059 "2021-06-25T12:47:02Z")
Hello, I'm trying to perform a reindex where the source index is split up into a number of indices all starting with my\_index. Also, I'm limiting the data I want between a certain range. The syntax I have is as follow… --- ## [Should I route "get by \_id" queries to improve performance?](https://discuss.elastic.co/t/should-i-route-get-by-id-queries-to-improve-performance/277046)
**Author:** [@Alexander\_Gamanyuk1](https://discuss.elastic.co/u/Alexander_Gamanyuk1)\ **Replies:** 1\ **Last updated:** [June 25, 2021, 12:33pm UTC](https://discuss.elastic.co/t/should-i-route-get-by-id-queries-to-improve-performance/277046 "2021-06-25T12:33:17Z")
I have an Elasticsearch index with hundreds of millions of documents that is used mostly for the "get by id" queries. I consider adding a route to documents when indexing. The route will be a random number from 0 to 9. … --- ## [Unable to use new multi\_terms aggregation via Java Client](https://discuss.elastic.co/t/unable-to-use-new-multi-terms-aggregation-via-java-client/277050)
**Author:** [@IliaIsakhin](https://discuss.elastic.co/u/IliaIsakhin)\ **Replies:** 0\ **Last updated:** [June 25, 2021, 11:19am UTC](https://discuss.elastic.co/t/unable-to-use-new-multi-terms-aggregation-via-java-client/277050 "2021-06-25T11:19:00Z")
Hello! I\`ve updated my ES cluster to the version 7.12 to use brand new multi-terms aggregations I want to do something like this in my Java Rest Client AggregationBuilders.multiTerms(field) But as i see, there is no b… --- ## [Logstash with Point to Point](https://discuss.elastic.co/t/logstash-with-point-to-point/277047)
**Author:** [@Michael\_Dylan\_McAloo](https://discuss.elastic.co/u/Michael_Dylan_McAloo)\ **Replies:** 0\ **Last updated:** [June 25, 2021, 11:03am UTC](https://discuss.elastic.co/t/logstash-with-point-to-point/277047 "2021-06-25T11:03:07Z")
In Kibana I try to use the "Point to Point" map but it doesn't show me anything because I only have two fields called "geoip.location" and "location" and I don't have the destination field to filter and "geoip.location" … --- ## [Removing granularity information from a TSVB graph](https://discuss.elastic.co/t/removing-granularity-information-from-a-tsvb-graph/277045)
**Author:** [@mdgElastic](https://discuss.elastic.co/u/mdgElastic)\ **Replies:** 0\ **Last updated:** [June 25, 2021, 11:01am UTC](https://discuss.elastic.co/t/removing-granularity-information-from-a-tsvb-graph/277045 "2021-06-25T11:01:54Z")
Hi all, Is it possible to hide the granularity information of a graph created using a TSBV? As an example: Many thanks in advance! Best! --- ## [Kibana Hyperlink](https://discuss.elastic.co/t/kibana-hyperlink/277042)
**Author:** [@Mathu](https://discuss.elastic.co/u/Mathu)\ **Replies:** 1\ **Last updated:** [June 25, 2021, 10:34am UTC](https://discuss.elastic.co/t/kibana-hyperlink/277042 "2021-06-25T10:34:07Z")
I have a data table. I need to apply hyperlink to values in the table. User Jan Feb March Sam 11 22 33 Rob 44 55 66 Kim 77 88 99 Say for examp… --- ## [Connecting to elasticsearch through kibana using NEST](https://discuss.elastic.co/t/connecting-to-elasticsearch-through-kibana-using-nest/277030)
**Author:** [@mityai013](https://discuss.elastic.co/u/mityai013)\ **Replies:** 0\ **Last updated:** [June 25, 2021, 8:39am UTC](https://discuss.elastic.co/t/connecting-to-elasticsearch-through-kibana-using-nest/277030 "2021-06-25T08:39:02Z")
Hello everyone . We are using a kibana connection to elasticsearch using NEST. This is necessary to monitor the generated indexes. We updated our ELK stack to 7.13.2 and this stopped working. Before the update in version… --- ## [Logstash does not read 1st line of file which the header](https://discuss.elastic.co/t/logstash-does-not-read-1st-line-of-file-which-the-header/277035)
**Author:** [@Julius\_Gamboa](https://discuss.elastic.co/u/Julius_Gamboa)\ **Replies:** 1\ **Last updated:** [June 25, 2021, 9:58am UTC](https://discuss.elastic.co/t/logstash-does-not-read-1st-line-of-file-which-the-header/277035 "2021-06-25T09:58:05Z")
Hi, I am using logstash to ingest a pipe delimited file into elasticsearch. I am using the autodetect\_column\_names in the csv filter. Noticed when I run logstash, I get the following warnings below: \[2021-06-25T16:48:3… --- ## [Index update](https://discuss.elastic.co/t/index-update/277025)
**Author:** [@Abhishek\_Shinde](https://discuss.elastic.co/u/Abhishek_Shinde)\ **Replies:** 1\ **Last updated:** [June 25, 2021, 9:23am UTC](https://discuss.elastic.co/t/index-update/277025 "2021-06-25T09:23:56Z")
I would need to know, if we can take Snapshot of Indices during Index update operation? I know restore demands to keep indices in the close state. --- ## [Last and sum in Kibana ESSQL](https://discuss.elastic.co/t/last-and-sum-in-kibana-essql/277036)
**Author:** [@xquest](https://discuss.elastic.co/u/xquest)\ **Replies:** 0\ **Last updated:** [June 25, 2021, 9:17am UTC](https://discuss.elastic.co/t/last-and-sum-in-kibana-essql/277036 "2021-06-25T09:17:52Z")
Hi! I am using Kiban canvas and sometimes Kibana canvas expression editor. I got some search: SELECT host.name as n, system.diskio.name as s, last(system.diskio.io.time,"@timestamp") as v FROM "\ **Author:** [@ORich](https://discuss.elastic.co/u/ORich)\ **Replies:** 1\ **Last updated:** [June 25, 2021, 9:15am UTC](https://discuss.elastic.co/t/index-lifecycle-error-2-index-templates-matching/276809 "2021-06-25T09:15:58Z") Dear experts, here is my filebeat setup: # Set the prefix used in the index lifecycle write alias name. The default alias # name is 'filebeat-%{\[agent.version\]}'. setup.ilm.rollover\_alias: 'filebeat-%{\[agent.version\]}-… --- ## [Tooltip filter in TSVB](https://discuss.elastic.co/t/tooltip-filter-in-tsvb/277034)
**Author:** [@Krunal](https://discuss.elastic.co/u/Krunal)\ **Replies:** 0\ **Last updated:** [June 25, 2021, 8:54am UTC](https://discuss.elastic.co/t/tooltip-filter-in-tsvb/277034 "2021-06-25T08:54:07Z")
Hello Expert, I would like to remove all the 0% value which shows in the tooltip, means I would like to apply filter not equal to 0. Is it possible to remove it? --- ## [Logstash "Received fatal alert : bad\_certificate"](https://discuss.elastic.co/t/logstash-received-fatal-alert-bad-certificate/277032)
**Author:** [@diegz](https://discuss.elastic.co/u/diegz)\ **Replies:** 1\ **Last updated:** [June 25, 2021, 8:51am UTC](https://discuss.elastic.co/t/logstash-received-fatal-alert-bad-certificate/277032 "2021-06-25T08:51:50Z")
Hello, I setup TLS on Elasticsearch, kibana, logstash and filebeat. I don't know if it comes from the configuration of logstash or filebeat. I have a cluster of 3 elastic nodes, logstash and filebeat are on node1. Th… --- ## [How to obtain the list of \ associated to a \](https://discuss.elastic.co/t/how-to-obtain-the-list-of-forecast-id-associated-to-a-job-name/276942)
**Author:** [@StephaneB](https://discuss.elastic.co/u/StephaneB)\ **Replies:** 2\ **Last updated:** [June 25, 2021, 8:28am UTC](https://discuss.elastic.co/t/how-to-obtain-the-list-of-forecast-id-associated-to-a-job-name/276942 "2021-06-25T08:28:15Z")
Hi, I would like to get the list of all the \ associated to a specific \. I tried: GET \_ml/anomaly\_detectors/\ but I don't obtain any information about associated forecast GET \_ml/anoma… --- ## [Filebeat decode\_json\_fields processor keeps giving convert error for GCP module](https://discuss.elastic.co/t/filebeat-decode-json-fields-processor-keeps-giving-convert-error-for-gcp-module/277024)
**Author:** [@stevensim226](https://discuss.elastic.co/u/stevensim226)\ **Replies:** 0\ **Last updated:** [June 25, 2021, 7:55am UTC](https://discuss.elastic.co/t/filebeat-decode-json-fields-processor-keeps-giving-convert-error-for-gcp-module/277024 "2021-06-25T07:55:06Z")
I keep getting an error that says GoError: failed in processor.convert: conversion of field \[json.protoPayload\] to type \[\[unset\]\] with target field \[json\] failed: field \[json.protoPayload\] is missing: key not found when … --- ## [How can i replace multiple special characters in all fields?](https://discuss.elastic.co/t/how-can-i-replace-multiple-special-characters-in-all-fields/276922)
**Author:** [@alprde](https://discuss.elastic.co/u/alprde)\ **Replies:** 2\ **Last updated:** [June 25, 2021, 7:58am UTC](https://discuss.elastic.co/t/how-can-i-replace-multiple-special-characters-in-all-fields/276922 "2021-06-25T07:58:24Z")
Ç =\> Ç ç =\> ç Ş =\> Ş ş =\> ş İ =\> İ ı =\> ı Ü =\> Ü ü =\> ü Ö =\> Ö ö =\> ö Ğ =\> Ğ ğ =\> ğ I want to replace these characters in all fields. how can I … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1347) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1349)