# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1387 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1388 --- ## [Cross Cluster search, switching to an empty backup cluster](https://discuss.elastic.co/t/cross-cluster-search-switching-to-an-empty-backup-cluster/274601)
**Author:** [@driveirk](https://discuss.elastic.co/u/driveirk)\ **Replies:** 7\ **Last updated:** [June 2, 2021, 4:59am UTC](https://discuss.elastic.co/t/cross-cluster-search-switching-to-an-empty-backup-cluster/274601 "2021-06-02T04:59:37Z")
Hello, I want to make a backup cluster for Cross Cluster search. I selected proxy\_mod, I use Haproxy as a proxy Haproxy configuration example: server work 1.1.1.1:9300 check on-marked-up shutdown-backup-sessions on-m… --- ## [How to edit the type of an existing fiend in an index](https://discuss.elastic.co/t/how-to-edit-the-type-of-an-existing-fiend-in-an-index/274694)
**Author:** [@sunoj\_vijayan](https://discuss.elastic.co/u/sunoj_vijayan)\ **Replies:** 1\ **Last updated:** [June 2, 2021, 4:06am UTC](https://discuss.elastic.co/t/how-to-edit-the-type-of-an-existing-fiend-in-an-index/274694 "2021-06-02T04:06:04Z")
Is there any way to edit an existing type. I have a field "calculated\_weight" which is currently a string. I want it to be long so that i can calculate the sum. I tried this PUT /mm-logs-\* { "mappings": { "proper… --- ## [Logstash not showing generated output](https://discuss.elastic.co/t/logstash-not-showing-generated-output/274677)
**Author:** [@Ashwani\_Shukla](https://discuss.elastic.co/u/Ashwani_Shukla)\ **Replies:** 2\ **Last updated:** [June 2, 2021, 3:50am UTC](https://discuss.elastic.co/t/logstash-not-showing-generated-output/274677 "2021-06-02T03:50:50Z")
The pipeline file name is newstash.conf input{ file{ path =\> \[ "/etc/logstash/sample.txt" \] } } output { stdout{ } } The sample.txt file has some string only. The output is l… --- ## [Secure settings kibana](https://discuss.elastic.co/t/secure-settings-kibana/274684)
**Author:** [@mohamed\_el\_mannouti](https://discuss.elastic.co/u/mohamed_el_mannouti)\ **Replies:** 6\ **Last updated:** [June 2, 2021, 2:44am UTC](https://discuss.elastic.co/t/secure-settings-kibana/274684 "2021-06-02T02:44:31Z")
How can I hide the password in kibana.yml --- ## [Date in runtime fields](https://discuss.elastic.co/t/date-in-runtime-fields/274692)
**Author:** [@IGB042](https://discuss.elastic.co/u/IGB042)\ **Replies:** 0\ **Last updated:** [June 2, 2021, 1:16am UTC](https://discuss.elastic.co/t/date-in-runtime-fields/274692 "2021-06-02T01:16:34Z")
I currently have an issue with calculating the day of week in a runtime field. My time field is stored in UTC "isotimestamp": \["2021-06-01T23:55:38.726Z"\] and displays correctly according to my TZ (UTC+10) isotimesta… --- ## [How to join two index](https://discuss.elastic.co/t/how-to-join-two-index/274572)
**Author:** [@jium](https://discuss.elastic.co/u/jium)\ **Replies:** 3\ **Last updated:** [June 2, 2021, 2:21am UTC](https://discuss.elastic.co/t/how-to-join-two-index/274572 "2021-06-02T02:21:34Z")
Hi, I want to join two indexes or merge them into one index. One index is being collected from the apache log and the other from mysql. I have to join the data through common key in two indexes and visualize it thro… --- ## [Watcher alerts issue with weekly date histogram](https://discuss.elastic.co/t/watcher-alerts-issue-with-weekly-date-histogram/274642)
**Author:** [@Roy\_Levy](https://discuss.elastic.co/u/Roy_Levy)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 2:05pm UTC](https://discuss.elastic.co/t/watcher-alerts-issue-with-weekly-date-histogram/274642 "2021-06-01T14:05:57Z")
Hey, I'm trying to simulate a custom watcher alert on an index - it creates index with some aggregations on the given index in order to add only those that pass some threshold. The watcher uses date histogram on the key… --- ## [Correct way to use the mutate rename filter](https://discuss.elastic.co/t/correct-way-to-use-the-mutate-rename-filter/274683)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 4\ **Last updated:** [June 2, 2021, 12:23am UTC](https://discuss.elastic.co/t/correct-way-to-use-the-mutate-rename-filter/274683 "2021-06-02T00:23:25Z")
Hello, this is weird, For the last couple of years I've been using the mutate rename filter in the following way, with one rename option for every field inside the same mutate block. mutate { rename =\> { "field1" =\>… --- ## [Problem with SQL query when using RLIKE or LIKE function](https://discuss.elastic.co/t/problem-with-sql-query-when-using-rlike-or-like-function/274689)
**Author:** [@simran96](https://discuss.elastic.co/u/simran96)\ **Replies:** 5\ **Last updated:** [June 1, 2021, 11:48pm UTC](https://discuss.elastic.co/t/problem-with-sql-query-when-using-rlike-or-like-function/274689 "2021-06-01T23:48:27Z")
Hi I'm trying to write a query where i want to search for a particular pattern but i'm getting errors. I have used the \\ escape as well but still its of no use. My query: curl -XPOST "http://xxxx/\_sql?format=csv" -H 'C… --- ## [Watcher alert for matching multiple fields in same index](https://discuss.elastic.co/t/watcher-alert-for-matching-multiple-fields-in-same-index/273690)
**Author:** [@Patr123](https://discuss.elastic.co/u/Patr123)\ **Replies:** 2\ **Last updated:** [June 1, 2021, 9:17pm UTC](https://discuss.elastic.co/t/watcher-alert-for-matching-multiple-fields-in-same-index/273690 "2021-06-01T21:17:32Z")
Hello, I am trying to match multiple fields in a single index for my watcher alert and having some difficulties doing that. My watcher looks like: { "trigger": { "schedule": { "interval": "15m" } }, … --- ## [Is it ok to have a more then one tie breaker node for less then couple of hours](https://discuss.elastic.co/t/is-it-ok-to-have-a-more-then-one-tie-breaker-node-for-less-then-couple-of-hours/274685)
**Author:** [@Sanjay1](https://discuss.elastic.co/u/Sanjay1)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 9:10pm UTC](https://discuss.elastic.co/t/is-it-ok-to-have-a-more-then-one-tie-breaker-node-for-less-then-couple-of-hours/274685 "2021-06-01T21:10:09Z")
We like to add 2nd tie breaker node along with our existing tiebreaker node. Once the new tie breaker node start working then like to decommission the existing tiebreaker node. For some time less the couple of hours it… --- ## [X of Y shards failed in 7.12](https://discuss.elastic.co/t/x-of-y-shards-failed-in-7-12/271052)
**Author:** [@d4nnyx](https://discuss.elastic.co/u/d4nnyx)\ **Replies:** 4\ **Last updated:** [June 1, 2021, 8:27pm UTC](https://discuss.elastic.co/t/x-of-y-shards-failed-in-7-12/271052 "2021-06-01T20:27:42Z")
Hello there, after upgrade Elastic Stack from 7.10 to 7.12 a lot of dasboards, visualization and searches in discover shows the error message X of Y shards failed. In most cases, reason is that the specific field is not… --- ## [Sort by array values](https://discuss.elastic.co/t/sort-by-array-values/274681)
**Author:** [@romina](https://discuss.elastic.co/u/romina)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 7:29pm UTC](https://discuss.elastic.co/t/sort-by-array-values/274681 "2021-06-01T19:29:36Z")
Hi! I need help with this use case Documents { "values": \["value1", "value3"\], "price": 3 } { "values": \["value1", "value2", "value3"\], "price": 1 } { "values": \["value3"\], … --- ## [V7.13.0 breaks OSS distributions](https://discuss.elastic.co/t/v7-13-0-breaks-oss-distributions/274568)
**Author:** [@Dan\_Bason](https://discuss.elastic.co/u/Dan_Bason)\ **Replies:** 3\ **Last updated:** [June 1, 2021, 7:26pm UTC](https://discuss.elastic.co/t/v7-13-0-breaks-oss-distributions/274568 "2021-06-01T19:26:40Z")
I've only tested with Metricbeat, but I assume most of the beats will be affected in v7.13.0. Connections to OSS distributions of Elasticsearch now fail due to a new license check introduced in libbeat (they throw an er… --- ## [Setting for alerts in elk](https://discuss.elastic.co/t/setting-for-alerts-in-elk/274199)
**Author:** [@varunbsgaur](https://discuss.elastic.co/u/varunbsgaur)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 7:05pm UTC](https://discuss.elastic.co/t/setting-for-alerts-in-elk/274199 "2021-06-01T19:05:32Z")
In order to use alerts in ELK I followed the mentioned steps but always found some error while starting up the local elasticsearch and kibana servers. Kindly help me know where I went wrong . step 1 :creating certifica… --- ## [Mustache Split String](https://discuss.elastic.co/t/mustache-split-string/274347)
**Author:** [@Dzious](https://discuss.elastic.co/u/Dzious)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 7:01pm UTC](https://discuss.elastic.co/t/mustache-split-string/274347 "2021-06-01T19:01:43Z")
Hi, I'm currently struggling with kibana alerting. I've made a Log threshold alert that's working fine but i would need, in my final document, to have values from context.group split in multiples fields (split char wou… --- ## [A single log is getting divided into multiple logs in Kibana](https://discuss.elastic.co/t/a-single-log-is-getting-divided-into-multiple-logs-in-kibana/274161)
**Author:** [@prajwalgmpp](https://discuss.elastic.co/u/prajwalgmpp)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 6:46pm UTC](https://discuss.elastic.co/t/a-single-log-is-getting-divided-into-multiple-logs-in-kibana/274161 "2021-06-01T18:46:12Z")
May 27, 2021 @ 12:06:33.318 {"log":{"timestamp":"2021-05-27 08:36:33,317","level":"INFO","transactionId":"","category":"InfoLogger","type":"trace","message":"\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* May 27, 2021 … --- ## [Reading data from winlogbeats](https://discuss.elastic.co/t/reading-data-from-winlogbeats/274673)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 6:27pm UTC](https://discuss.elastic.co/t/reading-data-from-winlogbeats/274673 "2021-06-01T18:27:54Z")
I have been using a single system install of Elastic Stack and have been able to see information come in through my Kibana. I currently have FileBeats, WinlogBeats and MetricBeats installed and working. I am getting in… --- ## [Dashboards with non-uniform indexes in Kibana](https://discuss.elastic.co/t/dashboards-with-non-uniform-indexes-in-kibana/274669)
**Author:** [@obnkf](https://discuss.elastic.co/u/obnkf)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 5:52pm UTC](https://discuss.elastic.co/t/dashboards-with-non-uniform-indexes-in-kibana/274669 "2021-06-01T17:52:35Z")
Here's my problem: I have two indexes that share an ID field of the same name and type (source\_location), but no other fields: Index M contains the source's metadata (e.g. who created the source, digital signature info… --- ## [Looking for documentation on plugin development](https://discuss.elastic.co/t/looking-for-documentation-on-plugin-development/274250)
**Author:** [@mnickerson](https://discuss.elastic.co/u/mnickerson)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 5:39pm UTC](https://discuss.elastic.co/t/looking-for-documentation-on-plugin-development/274250 "2021-06-01T17:39:33Z")
This is for Elasticsearch and Kibana 7.10.2 I'm currently trying to create a plugin in Kibana that will give a user a form, take the data from there as arguments to use in a transform. Then to create a vega visualizatio… --- ## [Parse line error: parsing CRI timestamp with filebeat 7.9.3](https://discuss.elastic.co/t/parse-line-error-parsing-cri-timestamp-with-filebeat-7-9-3/274666)
**Author:** [@Usman18](https://discuss.elastic.co/u/Usman18)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 5:14pm UTC](https://discuss.elastic.co/t/parse-line-error-parsing-cri-timestamp-with-filebeat-7-9-3/274666 "2021-06-01T17:14:14Z")
I am using filebeat 7.9.3. The logs are being transferred to kafka. But I see an error in the logs inside docker container of filebeat. The error details are given below: filebeat\_1 | 2021-06-01T17:10:2… --- ## [Not able to configure Alerts in Kibana](https://discuss.elastic.co/t/not-able-to-configure-alerts-in-kibana/274533)
**Author:** [@Akanksha\_Pandey](https://discuss.elastic.co/u/Akanksha_Pandey)\ **Replies:** 19\ **Last updated:** [June 1, 2021, 5:00pm UTC](https://discuss.elastic.co/t/not-able-to-configure-alerts-in-kibana/274533 "2021-06-01T17:00:22Z")
Hi, I'm using a docker compose file for ELK setup and using the latest version (above 7) for kibana. Now I set the xpack.encryptedSavedObjects.encryptionKey parameter in the kibana.yml so that i can use the alert and a… --- ## [Canvas maps section fullscreen](https://discuss.elastic.co/t/canvas-maps-section-fullscreen/274591)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 2\ **Last updated:** [June 1, 2021, 4:33pm UTC](https://discuss.elastic.co/t/canvas-maps-section-fullscreen/274591 "2021-06-01T16:33:43Z")
Hi, I added Maps in my canvas page but when I go in fullscreen mode the click on Maps doesn't work... If I return in "normal mode" the Maps works correctly... why? thanks --- ## [Comparing Two Aggregate Buckets](https://discuss.elastic.co/t/comparing-two-aggregate-buckets/274663)
**Author:** [@gshanklin](https://discuss.elastic.co/u/gshanklin)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 3:59pm UTC](https://discuss.elastic.co/t/comparing-two-aggregate-buckets/274663 "2021-06-01T15:59:42Z")
Hello, I am having a difficult time trying to compare the results of two aggerates. More specifically, I want to find unique "keys" between two aggerate buckets. For example, I have the two aggregates on the sample web … --- ## [Logstash](https://discuss.elastic.co/t/logstash/273611)
**Author:** [@httrack](https://discuss.elastic.co/u/httrack)\ **Replies:** 3\ **Last updated:** [June 1, 2021, 4:05pm UTC](https://discuss.elastic.co/t/logstash/273611 "2021-06-01T16:05:29Z")
Hello Team. I am having problems with a client. How can I activate the filebeat-\* index and the Logstash-\* index to have the syslog in the Discover part of Kibana --- ## [Scripted Field EsError in Kibana](https://discuss.elastic.co/t/scripted-field-eserror-in-kibana/274542)
**Author:** [@opdelta](https://discuss.elastic.co/u/opdelta)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 3:38pm UTC](https://discuss.elastic.co/t/scripted-field-eserror-in-kibana/274542 "2021-06-01T15:38:18Z")
Hey there, I have Apache logs imported in ES where the "request.keyword" field contains the path of the accessed document of a server. For example: "/category/path/to/requested/data/xml/file.xml" I want to sort in a da… --- ## [How to call a filter/report in a watcher?](https://discuss.elastic.co/t/how-to-call-a-filter-report-in-a-watcher/274513)
**Author:** [@houjil](https://discuss.elastic.co/u/houjil)\ **Replies:** 5\ **Last updated:** [June 1, 2021, 3:49pm UTC](https://discuss.elastic.co/t/how-to-call-a-filter-report-in-a-watcher/274513 "2021-06-01T15:49:27Z")
Hi, Be indulgent plz this is my first watcher :slight\_smile: I'm trying to create a watcher in where I can: call and fetch a filter/report for a specific index (stream). The idea is to catch from received logs, of a… --- ## [Phrase/ multi-worlds search](https://discuss.elastic.co/t/phrase-multi-worlds-search/274661)
**Author:** [@lalitesh](https://discuss.elastic.co/u/lalitesh)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 3:43pm UTC](https://discuss.elastic.co/t/phrase-multi-worlds-search/274661 "2021-06-01T15:43:01Z")
I am trying to implement a use case wherein a user can make a multi-words/ phrase search for 'product\_name' field. Assuming someone is searching for 'Richest Man', the following results should come: The Richest Man in… --- ## [Extract fields from JSON Flie to Elastic using Logstash filters](https://discuss.elastic.co/t/extract-fields-from-json-flie-to-elastic-using-logstash-filters/274610)
**Author:** [@Sirine](https://discuss.elastic.co/u/Sirine)\ **Replies:** 5\ **Last updated:** [June 1, 2021, 3:18pm UTC](https://discuss.elastic.co/t/extract-fields-from-json-flie-to-elastic-using-logstash-filters/274610 "2021-06-01T15:18:50Z")
Hello, I'm trying to extract fields from my JSON file, but I have \_jsonparsefailure" error, I tried many other filters like grok Split or vk but always the same results, logstash doesn't extract the values of the fields… --- ## [Elasticsearch C# Nest unit tests with Moq : fail to mock concrete class](https://discuss.elastic.co/t/elasticsearch-c-nest-unit-tests-with-moq-fail-to-mock-concrete-class/274657)
**Author:** [@Nicolas\_Rey](https://discuss.elastic.co/u/Nicolas_Rey)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 3:06pm UTC](https://discuss.elastic.co/t/elasticsearch-c-nest-unit-tests-with-moq-fail-to-mock-concrete-class/274657 "2021-06-01T15:06:16Z")
Hi, I need to mock some methods and properties in Nest.IElasticClient interface that is used in my repo. As example I need to stub the Indices.Exists() method to return an ExistsResponse having an Exists property return… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1386) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1388)