# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1404 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1405 --- ## [CSV Input - Some fields are multiline - LR vs CRLF](https://discuss.elastic.co/t/csv-input-some-fields-are-multiline-lr-vs-crlf/273691)
**Author:** [@uklipse](https://discuss.elastic.co/u/uklipse)\ **Replies:** 0\ **Last updated:** [May 21, 2021, 7:28pm UTC](https://discuss.elastic.co/t/csv-input-some-fields-are-multiline-lr-vs-crlf/273691 "2021-05-21T19:28:29Z")
I am trying input a csv file that certain fields can be multiline. When I paste the sample data into Notepad++ and display end of line characters, I can see the actual csv line separates using CRLF but the new lines with… --- ## [Translation EUI in kibana plugin](https://discuss.elastic.co/t/translation-eui-in-kibana-plugin/273682)
**Author:** [@kirienko.m](https://discuss.elastic.co/u/kirienko.m)\ **Replies:** 3\ **Last updated:** [May 21, 2021, 7:26pm UTC](https://discuss.elastic.co/t/translation-eui-in-kibana-plugin/273682 "2021-05-21T19:26:23Z")
Hello! I am created plugin with translations ru-RU. I want to translate the core.euiSuperUpdateButton.refreshButtonLabel, but i translate only in kibana Discover and not in my plugin. The EuiSuperDatePicker translating o… --- ## [Problem with elastic in grafana](https://discuss.elastic.co/t/problem-with-elastic-in-grafana/273578)
**Author:** [@Luis\_Garavatti](https://discuss.elastic.co/u/Luis_Garavatti)\ **Replies:** 2\ **Last updated:** [May 21, 2021, 6:36pm UTC](https://discuss.elastic.co/t/problem-with-elastic-in-grafana/273578 "2021-05-21T18:36:35Z")
Hi guys today I found a problem when adding my elasticsearch to graphana, besides it takes a while to load the reports, several times I get this error message and I need to delete my pod and recreate it, has anyone been … --- ## [Querying API On Input With Variables](https://discuss.elastic.co/t/querying-api-on-input-with-variables/273688)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 1\ **Last updated:** [May 21, 2021, 5:30pm UTC](https://discuss.elastic.co/t/querying-api-on-input-with-variables/273688 "2021-05-21T17:30:33Z")
I am trying to hit a HTTP API with time constraints included. The API allows you to pull results since a specified time in the format of yyyy-MM-dd'T'HH:mm:ss:SSS z. Is there an input that would allow me to specify thi… --- ## [Maximums for searchAfter (and scroll) size parameter?](https://discuss.elastic.co/t/maximums-for-searchafter-and-scroll-size-parameter/273591)
**Author:** [@elastic\_yogi](https://discuss.elastic.co/u/elastic_yogi)\ **Replies:** 3\ **Last updated:** [May 21, 2021, 5:23pm UTC](https://discuss.elastic.co/t/maximums-for-searchafter-and-scroll-size-parameter/273591 "2021-05-21T17:23:24Z")
Hi, I'm curious about ES 7.12 searchAfter and scroll. Both of these have a size parameter. What's the recommended limit to this parameter? I see none given, so I take it's a function of memory and cluster capacity someho… --- ## [Csv header skip\_header =\> "true" not working](https://discuss.elastic.co/t/csv-header-skip-header-true-not-working/273100)
**Author:** [@Bugsbee](https://discuss.elastic.co/u/Bugsbee)\ **Replies:** 2\ **Last updated:** [May 21, 2021, 4:50pm UTC](https://discuss.elastic.co/t/csv-header-skip-header-true-not-working/273100 "2021-05-21T16:50:31Z")
hello all, Im trying to use skip\_header =\> "true", this is because in kibana/discover the header is also coming out as a value. so i tried to add this parameter and it does not seem to working. In my case, this header… --- ## [Updating index gives number of documents in the index cannot exceed 2147483519](https://discuss.elastic.co/t/updating-index-gives-number-of-documents-in-the-index-cannot-exceed-2147483519/273547)
**Author:** [@NLSVTN](https://discuss.elastic.co/u/NLSVTN)\ **Replies:** 7\ **Last updated:** [May 21, 2021, 4:31pm UTC](https://discuss.elastic.co/t/updating-index-gives-number-of-documents-in-the-index-cannot-exceed-2147483519/273547 "2021-05-21T16:31:28Z")
We are trying to write 42522080 documents into Elasticsearch in python using Hail: mt = hl.import\_vcf(dataset\_path, reference\_genome='GRCh' + genome\_version, force\_bgz=True, min\_partitions=500) mt = hl.split\_mul… --- ## [Logstash keystore error after upgrade](https://discuss.elastic.co/t/logstash-keystore-error-after-upgrade/273683)
**Author:** [@gutierrezfj](https://discuss.elastic.co/u/gutierrezfj)\ **Replies:** 0\ **Last updated:** [May 21, 2021, 3:38pm UTC](https://discuss.elastic.co/t/logstash-keystore-error-after-upgrade/273683 "2021-05-21T15:38:47Z")
Hi, I did a deployment and upgrade, from logstash 7.6.2 deployed binary to logstash 7.10.2 dockerized. I used the same logstash.keystore file (copy and paste .keystore from 7.6.2 to /usr/share/logstash/config inside co… --- ## [Using colour values from within the Document itself](https://discuss.elastic.co/t/using-colour-values-from-within-the-document-itself/273094)
**Author:** [@stexxen](https://discuss.elastic.co/u/stexxen)\ **Replies:** 5\ **Last updated:** [May 21, 2021, 2:47pm UTC](https://discuss.elastic.co/t/using-colour-values-from-within-the-document-itself/273094 "2021-05-21T14:47:50Z")
Hi, I have an index containing multipolygons, it renders very well using Kibana maps. However I would like to colour them. Using the colour-by-value works but only for the first x (based on the color bar chosen. (10 or … --- ## [Help needed i m having the issue failed to perform any bulk index operations: 500 Internal Server Error](https://discuss.elastic.co/t/help-needed-i-m-having-the-issue-failed-to-perform-any-bulk-index-operations-500-internal-server-error/273308)
**Author:** [@khanio99](https://discuss.elastic.co/u/khanio99)\ **Replies:** 5\ **Last updated:** [May 21, 2021, 3:33pm UTC](https://discuss.elastic.co/t/help-needed-i-m-having-the-issue-failed-to-perform-any-bulk-index-operations-500-internal-server-error/273308 "2021-05-21T15:33:58Z")
May 18 10:50:36 debian filebeat\[5663\]: 2021-05-18T10:50:36.145-0400 INFO \[license\] licenser/es\_callback.go:51 Elasticsearch license: Basic May 18 10:50:36 debian filebeat\[5663\]: 2021-05-18T10:… --- ## [Monitoring Snowflake with Elastic (EFK on self managed AWS setup)](https://discuss.elastic.co/t/monitoring-snowflake-with-elastic-efk-on-self-managed-aws-setup/273558)
**Author:** [@maheshe](https://discuss.elastic.co/u/maheshe)\ **Replies:** 1\ **Last updated:** [May 21, 2021, 3:25pm UTC](https://discuss.elastic.co/t/monitoring-snowflake-with-elastic-efk-on-self-managed-aws-setup/273558 "2021-05-21T15:25:15Z")
We have a requirement to monitor Snowflake with Elastic stack. We are using a 7.9 self managed EFK stack on EKS-Kubernetes. Any suggestions and guidance to integrate with snowflake will be helpful. Thanks --- ## [Deployement not getting completed error message 0 of 1 pod is not available,](https://discuss.elastic.co/t/deployement-not-getting-completed-error-message-0-of-1-pod-is-not-available/272794)
**Author:** [@Snehil03](https://discuss.elastic.co/u/Snehil03)\ **Replies:** 4\ **Last updated:** [May 21, 2021, 3:16pm UTC](https://discuss.elastic.co/t/deployement-not-getting-completed-error-message-0-of-1-pod-is-not-available/272794 "2021-05-21T15:16:56Z")
Hello, I am trying to fix the kibana setup but seems to be it's not working , I have updated the module from 7.6.0 to 7.7.0 but after the update pods does not get started. I am using terraform to do these setup . Kind… --- ## [Same input (beats) in multiples config files](https://discuss.elastic.co/t/same-input-beats-in-multiples-config-files/273675)
**Author:** [@mar-ro](https://discuss.elastic.co/u/mar-ro)\ **Replies:** 0\ **Last updated:** [May 21, 2021, 2:48pm UTC](https://discuss.elastic.co/t/same-input-beats-in-multiples-config-files/273675 "2021-05-21T14:48:06Z")
Good afternoon, I understand that in logstash you cannot have more than one file in /etc/logstash/config.d with the same input (filebeat) ...in this case, if you want to have different files that will receive data from f… --- ## [From text da date ingestion pipeline](https://discuss.elastic.co/t/from-text-da-date-ingestion-pipeline/273263)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 3\ **Last updated:** [May 21, 2021, 2:18pm UTC](https://discuss.elastic.co/t/from-text-da-date-ingestion-pipeline/273263 "2021-05-21T14:18:28Z")
Hi, it's possible to convert a text field in date field, with an ingestion pipeline? Thanks --- ## [Is it possible to upgrade log4j from 2.11.1 to latest non-vul-ner-able version?](https://discuss.elastic.co/t/is-it-possible-to-upgrade-log4j-from-2-11-1-to-latest-non-vul-ner-able-version/273602)
**Author:** [@Elango\_P](https://discuss.elastic.co/u/Elango_P)\ **Replies:** 2\ **Last updated:** [May 21, 2021, 1:03pm UTC](https://discuss.elastic.co/t/is-it-possible-to-upgrade-log4j-from-2-11-1-to-latest-non-vul-ner-able-version/273602 "2021-05-21T13:03:12Z")
Found that ES internally using log4j 2.11.1 which is hitting this NVD - CVE-2020-9488. As we are more concerned about security issues, is there any plan to upgrade this in ES v6.8.x or latest versions of ES ? Or manuall… --- ## [GROK URIPATHPARAM SPLIT](https://discuss.elastic.co/t/grok-uripathparam-split/273662)
**Author:** [@Rahul\_Aggarwal](https://discuss.elastic.co/u/Rahul_Aggarwal)\ **Replies:** 0\ **Last updated:** [May 21, 2021, 12:00pm UTC](https://discuss.elastic.co/t/grok-uripathparam-split/273662 "2021-05-21T12:00:57Z")
I've been searching and reading the documentation but I can't seem to find further split my URIPATH into multiple parts. How this will achieve? My Sample URIPATH's are below: /article/india/13-naxals-were-neutralized-… --- ## [Grok - Value could appear or not. multiple rules?](https://discuss.elastic.co/t/grok-value-could-appear-or-not-multiple-rules/273548)
**Author:** [@legolas\_bilbao](https://discuss.elastic.co/u/legolas_bilbao)\ **Replies:** 2\ **Last updated:** [May 21, 2021, 12:45pm UTC](https://discuss.elastic.co/t/grok-value-could-appear-or-not-multiple-rules/273548 "2021-05-21T12:45:16Z")
I'm working with some logs from squid but one value could appear or not 1621232309.575 1 172.99.6.74 TCP\_MEM\_HIT/206 3096 GET http://storage.googleapis.com/ - HIER\_NONE/- application/octet-stream 1621232309.575 … --- ## [Log file doesnt read](https://discuss.elastic.co/t/log-file-doesnt-read/273665)
**Author:** [@legolas\_bilbao](https://discuss.elastic.co/u/legolas_bilbao)\ **Replies:** 0\ **Last updated:** [May 21, 2021, 12:33pm UTC](https://discuss.elastic.co/t/log-file-doesnt-read/273665 "2021-05-21T12:33:19Z")
HI everybody, I wanna read and deploy data from file logs but when i started the logstash service appears the following data Logstash.log \[2021-05-21T13:50:38,097\]\[INFO \]\[logstash.inputs.file \]\[squid\] No sincedb\_… --- ## [Fortinet module not parsing from file](https://discuss.elastic.co/t/fortinet-module-not-parsing-from-file/273590)
**Author:** [@Mustafa\_Y](https://discuss.elastic.co/u/Mustafa_Y)\ **Replies:** 5\ **Last updated:** [May 21, 2021, 12:23pm UTC](https://discuss.elastic.co/t/fortinet-module-not-parsing-from-file/273590 "2021-05-21T12:23:16Z")
Hello, I want to parse fortinet logs from file instead of syslog network. There is an option var.paths in Fortinet module | Filebeat Reference \[master\] | Elastic and var.input . I configured it as below: - module: for… --- ## [Filebeat uses process time instead event time](https://discuss.elastic.co/t/filebeat-uses-process-time-instead-event-time/273646)
**Author:** [@nflinenberg](https://discuss.elastic.co/u/nflinenberg)\ **Replies:** 1\ **Last updated:** [May 21, 2021, 12:15pm UTC](https://discuss.elastic.co/t/filebeat-uses-process-time-instead-event-time/273646 "2021-05-21T12:15:38Z")
Hi all, Hope you can help me out for the following. We've setup and Elasticstack and configured filebeat to send json logs to elasticsearch, using this configuration: filebeat.inputs: - type: log enabled: true … --- ## [How to send logs by watchers action](https://discuss.elastic.co/t/how-to-send-logs-by-watchers-action/273530)
**Author:** [@luczajk](https://discuss.elastic.co/u/luczajk)\ **Replies:** 1\ **Last updated:** [May 21, 2021, 11:10am UTC](https://discuss.elastic.co/t/how-to-send-logs-by-watchers-action/273530 "2021-05-21T11:10:26Z")
I'm trying to find a way to send every log which attribute "Exception" includes "statusCode: 500" and word "exception". At this time my watcher send information about 10000 logs every check. But its wrong, if i check it … --- ## [Is there a way to export \_ttl from docs?](https://discuss.elastic.co/t/is-there-a-way-to-export-ttl-from-docs/273028)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 9\ **Last updated:** [May 21, 2021, 10:49am UTC](https://discuss.elastic.co/t/is-there-a-way-to-export-ttl-from-docs/273028 "2021-05-21T10:49:09Z")
Hey there, if \_ttl expiration value is configured within the documents of an index, is there a way to export/reindex those documents with the \_ttl value of that moment? For instance, using Logstash elasticsearch input … --- ## [How can i schedule logstash every two hours for jdbc input plugin?](https://discuss.elastic.co/t/how-can-i-schedule-logstash-every-two-hours-for-jdbc-input-plugin/272973)
**Author:** [@sreedhar1](https://discuss.elastic.co/u/sreedhar1)\ **Replies:** 5\ **Last updated:** [May 21, 2021, 10:40am UTC](https://discuss.elastic.co/t/how-can-i-schedule-logstash-every-two-hours-for-jdbc-input-plugin/272973 "2021-05-21T10:40:01Z")
How can i schedule logstash every two hours for jdbc input plugin? --- ## [Can't use specific date field as primary time field](https://discuss.elastic.co/t/cant-use-specific-date-field-as-primary-time-field/273542)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 3\ **Last updated:** [May 21, 2021, 9:22am UTC](https://discuss.elastic.co/t/cant-use-specific-date-field-as-primary-time-field/273542 "2021-05-21T09:22:35Z")
Hello ! I have the field "Generated Time" in my message. I want to use it as primary date field in Kibana. To do so, I create my index pattern and choose "Generated Time" as primary date field. But once in Discover, no… --- ## [Distinct search using Java API](https://discuss.elastic.co/t/distinct-search-using-java-api/272978)
**Author:** [@MinwooKim](https://discuss.elastic.co/u/MinwooKim)\ **Replies:** 22\ **Last updated:** [May 21, 2021, 9:07am UTC](https://discuss.elastic.co/t/distinct-search-using-java-api/272978 "2021-05-21T09:07:09Z")
Inquiry with Java API. Is there any method to configure a search for distinct data? SearchSourceBuilder searchSourceBuilder = new SearchSourceBuilder(); BoolQueryBuilder queryBuilder = QueryBuilders.boolQuery()… --- ## [Ingestion pipeline key value pair](https://discuss.elastic.co/t/ingestion-pipeline-key-value-pair/272811)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 2\ **Last updated:** [May 13, 2021, 7:05am UTC](https://discuss.elastic.co/t/ingestion-pipeline-key-value-pair/272811 "2021-05-13T07:05:37Z")
Hi, I have a index mappings like this: ... "location": { "type": "nested", "properties": { "accuracy": { "type": "float" }, "lat": { "… --- ## [Kibana Lens 7.12 - Mixed Bar/Line Option in Lens to show Daily as Bar and Moving Avg as line](https://discuss.elastic.co/t/kibana-lens-7-12-mixed-bar-line-option-in-lens-to-show-daily-as-bar-and-moving-avg-as-line/273037)
**Author:** [@stevedearl](https://discuss.elastic.co/u/stevedearl)\ **Replies:** 9\ **Last updated:** [May 21, 2021, 8:00am UTC](https://discuss.elastic.co/t/kibana-lens-7-12-mixed-bar-line-option-in-lens-to-show-daily-as-bar-and-moving-avg-as-line/273037 "2021-05-21T08:00:42Z")
Hi All, I'm using Kibana to show the count of events for various services received over time. I've been displaying this as a bar chart no problem but would like to also include a moving 7 day average as a line so that t… --- ## [Snapshot and restore keep reporting 29 number indices](https://discuss.elastic.co/t/snapshot-and-restore-keep-reporting-29-number-indices/272758)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 7\ **Last updated:** [May 21, 2021, 7:56am UTC](https://discuss.elastic.co/t/snapshot-and-restore-keep-reporting-29-number-indices/272758 "2021-05-21T07:56:32Z")
Hi all I have a problem with the snapshot feature. I have a little script that will take snapshot of an indices of my choice in a file. But recently when i upgrade to version 7.12 when i take the snapshot, not only th… --- ## [Load more than 1 million row from SQL Server to ES with Logstash](https://discuss.elastic.co/t/load-more-than-1-million-row-from-sql-server-to-es-with-logstash/273627)
**Author:** [@Dai\_Thai\_Hoa\_Vo](https://discuss.elastic.co/u/Dai_Thai_Hoa_Vo)\ **Replies:** 1\ **Last updated:** [May 21, 2021, 7:48am UTC](https://discuss.elastic.co/t/load-more-than-1-million-row-from-sql-server-to-es-with-logstash/273627 "2021-05-21T07:48:26Z")
Hi every one. I have one case that my table has more 1 million rows in SQL Server and I used logstash JDBC to load them to Elastic Search. It work fine but run very slow. This is my file config. input { jdbc { jdbc\_dr… --- ## [Session lost after log file rotation](https://discuss.elastic.co/t/session-lost-after-log-file-rotation/273531)
**Author:** [@Harm](https://discuss.elastic.co/u/Harm)\ **Replies:** 2\ **Last updated:** [May 21, 2021, 7:02am UTC](https://discuss.elastic.co/t/session-lost-after-log-file-rotation/273531 "2021-05-21T07:02:42Z")
Hi, I have recently upgraded from Kibana 7.10.0 to 7.12.1 and since then I'm observing an issue where all user sessions are getting lost after a logfile rotation. My current logging settings are: logging.dest: "/var/… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1403) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1405)