# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1364

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1365

---

## [Ingestion pipeline milliseconds](https://discuss.elastic.co/t/ingestion-pipeline-milliseconds/275967)

<div class="topic-metadata">

**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\
**Replies:** 10\
**Last updated:** [June 16, 2021, 10:51am UTC](https://discuss.elastic.co/t/ingestion-pipeline-milliseconds/275967 "2021-06-16T10:51:26Z")

</div>

Hi, is it possible to add, via ingestion pipeline, the current timestamp, but, in milliseconds? (Unix time) Thanks

---

## [Not able call SSL configured elasticsearch API from elasticsearch plugin](https://discuss.elastic.co/t/not-able-call-ssl-configured-elasticsearch-api-from-elasticsearch-plugin/275941)

<div class="topic-metadata">

**Author:** [@Rohit\_Sawant1](https://discuss.elastic.co/u/Rohit_Sawant1)\
**Replies:** 5\
**Last updated:** [June 16, 2021, 10:36am UTC](https://discuss.elastic.co/t/not-able-call-ssl-configured-elasticsearch-api-from-elasticsearch-plugin/275941 "2021-06-16T10:36:56Z")

</div>

Hi Team, I am trying to call elasticsearch search ,createindex api from NodeClient but it is giving error message: action \[indices:data/read/search\] is unauthorized for user \[\_system\]. elasticsearch configured with SSL…

---

## [Filter on multiple indice](https://discuss.elastic.co/t/filter-on-multiple-indice/276042)

<div class="topic-metadata">

**Author:** [@dgastudio](https://discuss.elastic.co/u/dgastudio)\
**Replies:** 3\
**Last updated:** [June 16, 2021, 10:31am UTC](https://discuss.elastic.co/t/filter-on-multiple-indice/276042 "2021-06-16T10:31:34Z")

</div>

Hello. i have 2 indices, employee\_profile and employee\_shift a need to create a page, on which one, i have to list all the employees with calendar of shifts for each one right now, i'm doing a request to employee\_prof…

---

## [How to give dashboard filter as input to markdown](https://discuss.elastic.co/t/how-to-give-dashboard-filter-as-input-to-markdown/276016)

<div class="topic-metadata">

**Author:** [@venkatesh\_prasanth](https://discuss.elastic.co/u/venkatesh_prasanth)\
**Replies:** 3\
**Last updated:** [June 16, 2021, 10:01am UTC](https://discuss.elastic.co/t/how-to-give-dashboard-filter-as-input-to-markdown/276016 "2021-06-16T10:01:34Z")

</div>

Hello, I want to automatically update the markdown query input from the filter given in dashboard. what ever i give filter on that dashboard should be automatically given input to markdown so that i cant see the filter …

---

## [Using Cisco Fleet Integration](https://discuss.elastic.co/t/using-cisco-fleet-integration/276094)

<div class="topic-metadata">

**Author:** [@helferlein](https://discuss.elastic.co/u/helferlein)\
**Replies:** 1\
**Last updated:** [June 16, 2021, 9:41am UTC](https://discuss.elastic.co/t/using-cisco-fleet-integration/276094 "2021-06-16T09:41:20Z")

</div>

Hi Elastic Users and Team. I managed to install the fleet-server on prem and added the Cisco Fleet Integration to the fleet-server itself. ELK Stack and also the fleetserver is on one virtual machine. So my thought wa…

---

## [Concatenate log](https://discuss.elastic.co/t/concatenate-log/275968)

<div class="topic-metadata">

**Author:** [@cassiopee](https://discuss.elastic.co/u/cassiopee)\
**Replies:** 4\
**Last updated:** [June 16, 2021, 9:18am UTC](https://discuss.elastic.co/t/concatenate-log/275968 "2021-06-16T09:18:07Z")

</div>

hello, I have a beats log, who are concatenate and special characters. I wanted request one of this field but I supposed my request is blocked because a bad syntax. { "user" =\> { "name" =\> "AD-WSUS…

---

## [Error with HAProxy Dashboards \[ 7.10.2 \]](https://discuss.elastic.co/t/error-with-haproxy-dashboards-7-10-2/275834)

<div class="topic-metadata">

**Author:** [@rodrigo.gz](https://discuss.elastic.co/u/rodrigo.gz)\
**Replies:** 2\
**Last updated:** [June 15, 2021, 9:43am UTC](https://discuss.elastic.co/t/error-with-haproxy-dashboards-7-10-2/275834 "2021-06-15T09:43:16Z")

</div>

Hello! I am trying to monitor a HAProxy with metricbeat and filebeat. ( 7.10.2 ) When I do the setup and start the agent , it starts collecting metrics and logs correctly but the dashboards do not show the collected in…

---

## [Filebeat \> Kafka \> ES \> Kibana](https://discuss.elastic.co/t/filebeat-kafka-es-kibana/275995)

<div class="topic-metadata">

**Author:** [@Robsen\_Inc](https://discuss.elastic.co/u/Robsen_Inc)\
**Replies:** 3\
**Last updated:** [June 16, 2021, 9:05am UTC](https://discuss.elastic.co/t/filebeat-kafka-es-kibana/275995 "2021-06-16T09:05:39Z")

</div>

Hi folks, I have a question regarding the Filebeat configuration. Because if I send the syslog data (with the syslog module) directly from Filebeat to Elasticsearch, the ready dashboard works (from the tutorial, see pic…

---

## [How to create autoincremented Id (integer) in Elasticsearch?](https://discuss.elastic.co/t/how-to-create-autoincremented-id-integer-in-elasticsearch/276108)

<div class="topic-metadata">

**Author:** [@zeusfsx](https://discuss.elastic.co/u/zeusfsx)\
**Replies:** 1\
**Last updated:** [June 16, 2021, 8:53am UTC](https://discuss.elastic.co/t/how-to-create-autoincremented-id-integer-in-elasticsearch/276108 "2021-06-16T08:53:06Z")

</div>

Hi, I\`m interested in how to create autoincremented Id (integer) in Elasticsearch, or maybe someone knows how to create autoincrement field with the script when added a new document into the index?

---

## [Jdbc\_streaming parameters on From](https://discuss.elastic.co/t/jdbc-streaming-parameters-on-from/276104)

<div class="topic-metadata">

**Author:** [@charles97](https://discuss.elastic.co/u/charles97)\
**Replies:** 0\
**Last updated:** [June 16, 2021, 8:29am UTC](https://discuss.elastic.co/t/jdbc-streaming-parameters-on-from/276104 "2021-06-16T08:29:37Z")

</div>

I've seen documentation about using parameters as statement =\> "select \* from WORLD.COUNTRY WHERE Code = :code" parameters =\> { "code" =\> "country\_code"} But I'm in situation where I have 9 different cases and …

---

## [CSV reports](https://discuss.elastic.co/t/csv-reports/275796)

<div class="topic-metadata">

**Author:** [@Andrejs\_G](https://discuss.elastic.co/u/Andrejs_G)\
**Replies:** 2\
**Last updated:** [June 16, 2021, 8:15am UTC](https://discuss.elastic.co/t/csv-reports/275796 "2021-06-16T08:15:57Z")

</div>

Hi, I'm new in Elasticsearch, don't know if it is some kind bug or just need to enable something. Problem is that when I generate CSV file it always contains only one row, doesn't mater if I want to export search with 20…

---

## [Filebeat - Saving what files Filebeat has Processed in ES](https://discuss.elastic.co/t/filebeat-saving-what-files-filebeat-has-processed-in-es/276097)

<div class="topic-metadata">

**Author:** [@scott\_stash](https://discuss.elastic.co/u/scott_stash)\
**Replies:** 0\
**Last updated:** [June 16, 2021, 8:03am UTC](https://discuss.elastic.co/t/filebeat-saving-what-files-filebeat-has-processed-in-es/276097 "2021-06-16T08:03:25Z")

</div>

I have a system setup where log files in a folder are processed by FB-\> LS -ES, once they are processed some reports/scripts are ran for the data in ES and the output is sent to a user. To accomplish this I have written…

---

## [Logstash filter jdbc\_streaming : JDBC:AdapterNotFound: Could not load jdbc/mssql adapter: adapter class not registered in ADAPTER\_MAP\>](https://discuss.elastic.co/t/logstash-filter-jdbc-streaming-jdbc-could-not-load-jdbc-mssql-adapter-adapter-class-not-registered-in-adapter-map/275546)

<div class="topic-metadata">

**Author:** [@charles97](https://discuss.elastic.co/u/charles97)\
**Replies:** 7\
**Last updated:** [June 16, 2021, 8:00am UTC](https://discuss.elastic.co/t/logstash-filter-jdbc-streaming-jdbc-could-not-load-jdbc-mssql-adapter-adapter-class-not-registered-in-adapter-map/275546 "2021-06-16T08:00:13Z")

</div>

I'm trying to use logstash filter plugin jdbc\_streaming, my logstash version is 7.13 OS centos 7 openjdk 11.0.11 2021-04-20 LTS jdbc 6.0 : "/home/jdbc/sqljdbc\_6.0/enu/jre7/sqljdbc41.jar" my logstash config input {…

---

## [Auditbeat Process Dashboard](https://discuss.elastic.co/t/auditbeat-process-dashboard/276077)

<div class="topic-metadata">

**Author:** [@yango](https://discuss.elastic.co/u/yango)\
**Replies:** 0\
**Last updated:** [June 16, 2021, 4:22am UTC](https://discuss.elastic.co/t/auditbeat-process-dashboard/276077 "2021-06-16T04:22:46Z")

</div>

I am using auditbeat 7.10.2 OSS, only modules included in auditbeat.yml are audited and file\_integrity. I need to analyze processes and login events, is it possible to add other modules? If yes, how?

---

## [How to export a scripted field in the elasticsearch-output-plugin](https://discuss.elastic.co/t/how-to-export-a-scripted-field-in-the-elasticsearch-output-plugin/276091)

<div class="topic-metadata">

**Author:** [@fidsamurai](https://discuss.elastic.co/u/fidsamurai)\
**Replies:** 0\
**Last updated:** [June 16, 2021, 7:12am UTC](https://discuss.elastic.co/t/how-to-export-a-scripted-field-in-the-elasticsearch-output-plugin/276091 "2021-06-16T07:12:42Z")

</div>

I've written a scripted field to standardise and create a shorthand for URLs. However from what I understood in the docs we can't use it as a keyword field, also it works only on Kibana and not if I try and get data dir…

---

## [Kibana upgrade from 7.12.0 to 7.13.1 is failing](https://discuss.elastic.co/t/kibana-upgrade-from-7-12-0-to-7-13-1-is-failing/275680)

<div class="topic-metadata">

**Author:** [@Vincent\_Uribe](https://discuss.elastic.co/u/Vincent_Uribe)\
**Replies:** 8\
**Last updated:** [June 16, 2021, 6:19am UTC](https://discuss.elastic.co/t/kibana-upgrade-from-7-12-0-to-7-13-1-is-failing/275680 "2021-06-16T06:19:01Z")

</div>

Hi, I have been trying to upgrade kibana for a few days ow and it does not work. I have the following error : {"type":"log","@timestamp":"2021-06-11T10:10:39+00:00","tags":\["info","savedobjects-service"\],"pid":27709,"m…

---

## [Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {:pipeline\_id=\>"main", "exception"=\>"no implicit conversion to rational from nil"](https://discuss.elastic.co/t/exception-in-pipelineworker-the-pipeline-stopped-processing-new-events-please-check-your-filter-configuration-and-restart-logstash-pipeline-id-main-exception-no-implicit-conversion-to-rational-from-nil/275370)

<div class="topic-metadata">

**Author:** [@AmitC](https://discuss.elastic.co/u/AmitC)\
**Replies:** 6\
**Last updated:** [June 16, 2021, 6:00am UTC](https://discuss.elastic.co/t/exception-in-pipelineworker-the-pipeline-stopped-processing-new-events-please-check-your-filter-configuration-and-restart-logstash-pipeline-id-main-exception-no-implicit-conversion-to-rational-from-nil/275370 "2021-06-16T06:00:14Z")

</div>

Logstash Version : 6.1.1 Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {:pipeline\_id=\>"main", "exception"=\>"no implicit conversion…

---

## [Using Windows AD Authentication With NEST](https://discuss.elastic.co/t/using-windows-ad-authentication-with-nest/276085)

<div class="topic-metadata">

**Author:** [@abushokry](https://discuss.elastic.co/u/abushokry)\
**Replies:** 0\
**Last updated:** [June 16, 2021, 5:58am UTC](https://discuss.elastic.co/t/using-windows-ad-authentication-with-nest/276085 "2021-06-16T05:58:26Z")

</div>

Hi All, I'm trying to use the NEST .net Client to connect to elastic search using the identity of the App Pool account. i.e. without Basic Auth nor API Keys. I'm unable to find a way to get that done. Generally, when de…

---

## [One configuration file (single pipeline) or mutiple configuration files (various pipelines)?](https://discuss.elastic.co/t/one-configuration-file-single-pipeline-or-mutiple-configuration-files-various-pipelines/276080)

<div class="topic-metadata">

**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\
**Replies:** 0\
**Last updated:** [June 16, 2021, 5:40am UTC](https://discuss.elastic.co/t/one-configuration-file-single-pipeline-or-mutiple-configuration-files-various-pipelines/276080 "2021-06-16T05:40:06Z")

</div>

Hello Currently I have multiple configuration files, each listening on their own port and with their filters. Would it be better to merge it all in one and using conditionals, filter out, do transformations needed and …

---

## [Sort doesn't work with delete by query](https://discuss.elastic.co/t/sort-doesnt-work-with-delete-by-query/276074)

<div class="topic-metadata">

**Author:** [@Deepti](https://discuss.elastic.co/u/Deepti)\
**Replies:** 2\
**Last updated:** [June 16, 2021, 5:33am UTC](https://discuss.elastic.co/t/sort-doesnt-work-with-delete-by-query/276074 "2021-06-16T05:33:01Z")

</div>

Iam trying to delete the oldest document in the alias by using sort ,but this deletes all the documents that matches the query. Is sort not supported by delete by query? Is there any other option to use in the delete by…

---

## [Kibana shows sometimes 503 license not available (due to timeout after 30000ms)](https://discuss.elastic.co/t/kibana-shows-sometimes-503-license-not-available-due-to-timeout-after-30000ms/274726)

<div class="topic-metadata">

**Author:** [@Anatolij](https://discuss.elastic.co/u/Anatolij)\
**Replies:** 1\
**Last updated:** [June 16, 2021, 5:24am UTC](https://discuss.elastic.co/t/kibana-shows-sometimes-503-license-not-available-due-to-timeout-after-30000ms/274726 "2021-06-16T05:24:06Z")

</div>

Hello, I already saw a few errors about 503 license not available. But none of these matched my error. I only see the 503 license not available randomly on a few requests. Sometimes i have to wait the 30000ms loading t…

---

## [Error Loading Data - Authorization Exception (Kibana dashboard)](https://discuss.elastic.co/t/error-loading-data-authorization-exception-kibana-dashboard/274916)

<div class="topic-metadata">

**Author:** [@Sandun\_Akalanka](https://discuss.elastic.co/u/Sandun_Akalanka)\
**Replies:** 1\
**Last updated:** [June 16, 2021, 5:07am UTC](https://discuss.elastic.co/t/error-loading-data-authorization-exception-kibana-dashboard/274916 "2021-06-16T05:07:26Z")

</div>

I have a Kibana dashboard inside an AWS ElasticSearch domain (which includes both ES and Kibana). It used to work fine, until a few days ago. I have been receiving this warning message whenever I try to view data on Kiba…

---

## [When I set up the template file and used logstash to create the index, I got an error](https://discuss.elastic.co/t/when-i-set-up-the-template-file-and-used-logstash-to-create-the-index-i-got-an-error/275913)

<div class="topic-metadata">

**Author:** [@Masanori\_Mishima](https://discuss.elastic.co/u/Masanori_Mishima)\
**Replies:** 6\
**Last updated:** [June 16, 2021, 4:25am UTC](https://discuss.elastic.co/t/when-i-set-up-the-template-file-and-used-logstash-to-create-the-index-i-got-an-error/275913 "2021-06-16T04:25:11Z")

</div>

The execution environment is shown below. I would like to create an index by specifying mapping in a json file with index template set from logstash. How can I do this? logstash-7.13.0 Settings in the conf file inpu…

---

## [Delete from read indexes](https://discuss.elastic.co/t/delete-from-read-indexes/275919)

<div class="topic-metadata">

**Author:** [@Deepti](https://discuss.elastic.co/u/Deepti)\
**Replies:** 11\
**Last updated:** [June 16, 2021, 3:45am UTC](https://discuss.elastic.co/t/delete-from-read-indexes/275919 "2021-06-16T03:45:30Z")

</div>

Hello, I have a current write index and multiple read indexes .Is it possible to delete the documents from only the read indexes? Document with same ID will be present in both read and write index but I want the documen…

---

## [Decrease query delay time in ML jobs](https://discuss.elastic.co/t/decrease-query-delay-time-in-ml-jobs/276058)

<div class="topic-metadata">

**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\
**Replies:** 2\
**Last updated:** [June 16, 2021, 2:13am UTC](https://discuss.elastic.co/t/decrease-query-delay-time-in-ml-jobs/276058 "2021-06-16T02:13:40Z")

</div>

Hi, I get data from a database using logstash every 5 minutes. my bucket span is 15 minutes, and, because I was missing documents in the datafeed of the job, my query delay is 23 minutes. What would you recomend to decr…

---

## [Just tried out ELK stack v7.13 but found two issues](https://discuss.elastic.co/t/just-tried-out-elk-stack-v7-13-but-found-two-issues/276068)

<div class="topic-metadata">

**Author:** [@vincetai](https://discuss.elastic.co/u/vincetai)\
**Replies:** 7\
**Last updated:** [June 16, 2021, 1:57am UTC](https://discuss.elastic.co/t/just-tried-out-elk-stack-v7-13-but-found-two-issues/276068 "2021-06-16T01:57:13Z")

</div>

I moved from ELK v6.8.16 to ELK v7.13.2 and found the following issues: - In v6.8.16, when I removed a namespace, Kibana could show such event but it is not happening in v7.13.2 The navigation on Kibana web is faster i…

---

## [Will adding filters make visualizations more responsive?](https://discuss.elastic.co/t/will-adding-filters-make-visualizations-more-responsive/276067)

<div class="topic-metadata">

**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\
**Replies:** 2\
**Last updated:** [June 16, 2021, 1:21am UTC](https://discuss.elastic.co/t/will-adding-filters-make-visualizations-more-responsive/276067 "2021-06-16T01:21:57Z")

</div>

We have a visualization where we are using the term aggregation. Suppose there are 10000 records in the source index and out of that 1000 records have the field on which we will be doing term aggregration. I am just won…

---

## [Snapshot Repository Error](https://discuss.elastic.co/t/snapshot-repository-error/275618)

<div class="topic-metadata">

**Author:** [@leemase004](https://discuss.elastic.co/u/leemase004)\
**Replies:** 1\
**Last updated:** [June 16, 2021, 12:36am UTC](https://discuss.elastic.co/t/snapshot-repository-error/275618 "2021-06-16T00:36:11Z")

</div>

We are attempting to run a snapshot (and/or view the snapshots of the repo) and we keep getting an error. The error reads as follow: Could not read repository data because the contents of the repository do not match its…

---

## [Apply an ILM policy to all indices in cluster](https://discuss.elastic.co/t/apply-an-ilm-policy-to-all-indices-in-cluster/275553)

<div class="topic-metadata">

**Author:** [@elk11](https://discuss.elastic.co/u/elk11)\
**Replies:** 1\
**Last updated:** [June 16, 2021, 12:35am UTC](https://discuss.elastic.co/t/apply-an-ilm-policy-to-all-indices-in-cluster/275553 "2021-06-16T00:35:51Z")

</div>

Elasticsearch and Kibana version: 7.3.1 We host and provide elasticsearch cluster to other teams within our org. We want to delete indices in that cluster after certain days. For that matter we created a policy which ta…

---

## [Frozen Tier index querying off of id implementation](https://discuss.elastic.co/t/frozen-tier-index-querying-off-of-id-implementation/275725)

<div class="topic-metadata">

**Author:** [@tyler-3](https://discuss.elastic.co/u/tyler-3)\
**Replies:** 0\
**Last updated:** [June 11, 2021, 11:22pm UTC](https://discuss.elastic.co/t/frozen-tier-index-querying-off-of-id-implementation/275725 "2021-06-11T23:22:28Z")

</div>

I'm looking at using frozen tier on S3 for around 1-2 TB of an index but this data will mostly be accessed using an id field (with the occasional alternative query). The ILM lifecycle is very convenient operationally as…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1363)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1365)
