# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1428 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1429 --- ## [Rollover illegal\_state\_exception and illegal\_argument\_exception](https://discuss.elastic.co/t/rollover-illegal-state-exception-and-illegal-argument-exception/272197)
**Author:** [@dorinand](https://discuss.elastic.co/u/dorinand)\ **Replies:** 0\ **Last updated:** [May 5, 2021, 1:45pm UTC](https://discuss.elastic.co/t/rollover-illegal-state-exception-and-illegal-argument-exception/272197 "2021-05-05T13:45:45Z")
I implemented rollover index myapp ant it works like a charm for a long time. Today, I find out in Kibana that two of my indices encounter errors: 2 indices have lifecycle errors. GET /\_cat/aliases/myapp?v=true alias in… --- ## [How to run multiple logstash config in parallel](https://discuss.elastic.co/t/how-to-run-multiple-logstash-config-in-parallel/272198)
**Author:** [@ullasrao](https://discuss.elastic.co/u/ullasrao)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 12:20am UTC](https://discuss.elastic.co/t/how-to-run-multiple-logstash-config-in-parallel/272198 "2021-05-06T00:20:05Z")
hi , i am new to ELK and I am setting up the pipelines for the data. i have a requirement where i have to read data from 2 different kafka topics and load them to 2 different elastic search tables respectively. I hav… --- ## [Issues with starting Filebeat 7.9.1](https://discuss.elastic.co/t/issues-with-starting-filebeat-7-9-1/272215)
**Author:** [@OtienoC](https://discuss.elastic.co/u/OtienoC)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 12:11am UTC](https://discuss.elastic.co/t/issues-with-starting-filebeat-7-9-1/272215 "2021-05-06T00:11:33Z")
Having issues starting filebeat installed in RHEL8 . Error is related to kibana wanting permissions. Output error is below: Last login: Tue Apr 27 14:39:31 2021 from 10.147.4.244 # ausearch -c 'filebeat' --raw | audit2… --- ## [Filebeat Syslog isn't Opening Port](https://discuss.elastic.co/t/filebeat-syslog-isnt-opening-port/272126)
**Author:** [@odin-bb](https://discuss.elastic.co/u/odin-bb)\ **Replies:** 4\ **Last updated:** [May 5, 2021, 11:59pm UTC](https://discuss.elastic.co/t/filebeat-syslog-isnt-opening-port/272126 "2021-05-05T23:59:37Z")
Good Afternoon, First off, thank you for whatever help/suggestions you provide. I recently posted in the r/elasticsearch trying to understand the difference between logstash and filebeat and was greatly helped by someo… --- ## [Is it possible to adjust the point to point settings?](https://discuss.elastic.co/t/is-it-possible-to-adjust-the-point-to-point-settings/272124)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 2\ **Last updated:** [May 5, 2021, 11:36pm UTC](https://discuss.elastic.co/t/is-it-possible-to-adjust-the-point-to-point-settings/272124 "2021-05-05T23:36:47Z")
I'm a bit confused at the aggregation feature of the point to point functionality. I am showing connections between nodes in a network of about 20 machines and I would like the lines to terminate on the node so I can un… --- ## [How to get License for on-premise stack](https://discuss.elastic.co/t/how-to-get-license-for-on-premise-stack/271799)
**Author:** [@twilight](https://discuss.elastic.co/u/twilight)\ **Replies:** 2\ **Last updated:** [May 5, 2021, 10:46pm UTC](https://discuss.elastic.co/t/how-to-get-license-for-on-premise-stack/271799 "2021-05-05T22:46:43Z")
Hello, I have been using some Gold features on trial and now we have decided to buy and implement the license into our on-prem ES and Kibana setup. I have been trying to find where do we select the license type, pay an… --- ## [Query sem dados](https://discuss.elastic.co/t/query-sem-dados/272017)
**Author:** [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\ **Replies:** 4\ **Last updated:** [May 5, 2021, 6:35pm UTC](https://discuss.elastic.co/t/query-sem-dados/272017 "2021-05-05T18:35:54Z")
Is there a way to do some elasticquery and if it didn't work, it returns something default? --- ## [Converting data type from string to int or from string to date](https://discuss.elastic.co/t/converting-data-type-from-string-to-int-or-from-string-to-date/271879)
**Author:** [@LombardoAndrea195](https://discuss.elastic.co/u/LombardoAndrea195)\ **Replies:** 6\ **Last updated:** [May 5, 2021, 5:35pm UTC](https://discuss.elastic.co/t/converting-data-type-from-string-to-int-or-from-string-to-date/271879 "2021-05-05T17:35:16Z")
Hi all I've doing this call but how can you see data is string but I would like to convert data like ANGLE from text to a double or DATE like data fields, what's the call in order to do that? When data is flushed again … --- ## [Unknown field \[has\_parent\] while parsing valid query using XContentParser](https://discuss.elastic.co/t/unknown-field-has-parent-while-parsing-valid-query-using-xcontentparser/272210)
**Author:** [@avj](https://discuss.elastic.co/u/avj)\ **Replies:** 1\ **Last updated:** [May 5, 2021, 5:34pm UTC](https://discuss.elastic.co/t/unknown-field-has-parent-while-parsing-valid-query-using-xcontentparser/272210 "2021-05-05T17:34:55Z")
ES 7.7.0, Getting the following exception, although "has\_parent" query is valid and works in ES index, getting an exception when trying to parse using ES parser API Output : ssb = {"query":{"term":{"\_tenant\_id":{"value… --- ## [How to create rolling index with date as the index name?](https://discuss.elastic.co/t/how-to-create-rolling-index-with-date-as-the-index-name/272156)
**Author:** [@Sumeet\_Singh](https://discuss.elastic.co/u/Sumeet_Singh)\ **Replies:** 5\ **Last updated:** [May 5, 2021, 4:58pm UTC](https://discuss.elastic.co/t/how-to-create-rolling-index-with-date-as-the-index-name/272156 "2021-05-05T16:58:48Z")
Hi, my elastic search index will ingest thousands of documents per second. The service which puts documents in the index doesn't creates a new index, instead it just gets current data in nodejs and indexes docs in "log-Y… --- ## [Export Over 4M Data to CSV File on Self-Hosted Cluster](https://discuss.elastic.co/t/export-over-4m-data-to-csv-file-on-self-hosted-cluster/272155)
**Author:** [@kemalkolcuoglu](https://discuss.elastic.co/u/kemalkolcuoglu)\ **Replies:** 4\ **Last updated:** [May 5, 2021, 3:16pm UTC](https://discuss.elastic.co/t/export-over-4m-data-to-csv-file-on-self-hosted-cluster/272155 "2021-05-05T15:16:12Z")
Hello Everyone, I have an issue with Reporting. I need to create a CSV file for our customer and they want to see on file over 4 million records. I read the document and it says I may set max. bytes with xpack.reportin… --- ## [Painless is not that painless](https://discuss.elastic.co/t/painless-is-not-that-painless/263982)
**Author:** [@Casper\_Thrane](https://discuss.elastic.co/u/Casper_Thrane)\ **Replies:** 4\ **Last updated:** [May 4, 2021, 3:47pm UTC](https://discuss.elastic.co/t/painless-is-not-that-painless/263982 "2021-05-04T15:47:02Z")
Hi I am a simple thing, like assigning a text to a string variable, and then just return the value. But I keep getting compile error: if (!doc.containsKey("url.query") || doc\["url.query"\].empty) { return null; } St… --- ## [Restore data from 7.12 to 7.10.2](https://discuss.elastic.co/t/restore-data-from-7-12-to-7-10-2/272201)
**Author:** [@mahomedsh](https://discuss.elastic.co/u/mahomedsh)\ **Replies:** 1\ **Last updated:** [May 5, 2021, 2:41pm UTC](https://discuss.elastic.co/t/restore-data-from-7-12-to-7-10-2/272201 "2021-05-05T14:41:40Z")
Hi I am using Graylog with Elasticsearch installed on the same server. Unfortunately I ran an apt upgrade which updated Elasticsearch to 7.12 before I realised that Graylog is currently not compatible with this version.… --- ## [Filebeat - regarding Harvestor & Registry](https://discuss.elastic.co/t/filebeat-regarding-harvestor-registry/272205)
**Author:** [@tushar\_saurabh](https://discuss.elastic.co/u/tushar_saurabh)\ **Replies:** 0\ **Last updated:** [May 5, 2021, 2:23pm UTC](https://discuss.elastic.co/t/filebeat-regarding-harvestor-registry/272205 "2021-05-05T14:23:14Z")
I an new to Elastic world and have been reading the documents and analyzing the current ELK setup. Filebeat version is 6.0. Question # 1: Harvestor is created for each file. Harvestor is closed if it is inactive. The cl… --- ## [Can't use text fields in lens : Kibana](https://discuss.elastic.co/t/cant-use-text-fields-in-lens-kibana/272177)
**Author:** [@Sarra](https://discuss.elastic.co/u/Sarra)\ **Replies:** 2\ **Last updated:** [May 5, 2021, 2:06pm UTC](https://discuss.elastic.co/t/cant-use-text-fields-in-lens-kibana/272177 "2021-05-05T14:06:55Z")
Hello , I am a beginner for Elastic search.I have some difficulties dealing with lens in Kibana. I imported a csv dataset named : 'traces\_data' in Kibana .The main fields are : 'Code Op', 'Pays' ,' Marque' , 'Modèle' … --- ## [Date Plugin doc not visible](https://discuss.elastic.co/t/date-plugin-doc-not-visible/272202)
**Author:** [@Soren\_vdc](https://discuss.elastic.co/u/Soren_vdc)\ **Replies:** 0\ **Last updated:** [May 5, 2021, 2:03pm UTC](https://discuss.elastic.co/t/date-plugin-doc-not-visible/272202 "2021-05-05T14:03:45Z")
Hi, I have this time format in logfile: time\_stamp=\[30/Apr/2021:15:23:46+0200\] When I use the date plugin: kv { source =\> "message" field\_split =\> "|" } date { match =\> \[ "time\_stamp", ,… --- ## [Trouble with Kibana Regex querys](https://discuss.elastic.co/t/trouble-with-kibana-regex-querys/272002)
**Author:** [@lpnewell](https://discuss.elastic.co/u/lpnewell)\ **Replies:** 3\ **Last updated:** [May 5, 2021, 1:31pm UTC](https://discuss.elastic.co/t/trouble-with-kibana-regex-querys/272002 "2021-05-05T13:31:14Z")
I'm trying to write a regex query to pick up on basic ssn and sin data in a query but any time i add a tiny bit of complexity the query can't pick up any data. I've wrote this query in things like devo and syslog(and onl… --- ## [Filebeat stops harvesting files](https://discuss.elastic.co/t/filebeat-stops-harvesting-files/272190)
**Author:** [@boernd](https://discuss.elastic.co/u/boernd)\ **Replies:** 0\ **Last updated:** [May 5, 2021, 1:22pm UTC](https://discuss.elastic.co/t/filebeat-stops-harvesting-files/272190 "2021-05-05T13:22:40Z")
Filebeat vesion: 7.10 Filebeat sometimes throws the following errors and stops harvesting a file: Harvester could not be started on existing file: /var/lib/docker/containers/acaeae7d8182fc7c78a5066a178593640ce4fbc920b4… --- ## [Need help with 6.x Kibana plugin migration to 7.x (embedded dashboard)](https://discuss.elastic.co/t/need-help-with-6-x-kibana-plugin-migration-to-7-x-embedded-dashboard/270977)
**Author:** [@jmcclure](https://discuss.elastic.co/u/jmcclure)\ **Replies:** 2\ **Last updated:** [May 5, 2021, 1:04pm UTC](https://discuss.elastic.co/t/need-help-with-6-x-kibana-plugin-migration-to-7-x-embedded-dashboard/270977 "2021-05-05T13:04:40Z")
Hi, I have a working Kibana plugin used in 6.7.1 and need to update this plugin or find another mechanism to provide the same functionality as we migrate to 7.x. I have reviewed the legacy plugin migration documentatio… --- ## [Update index patterns automatically - programatically?](https://discuss.elastic.co/t/update-index-patterns-automatically-programatically/271643)
**Author:** [@Paul\_Cardy](https://discuss.elastic.co/u/Paul_Cardy)\ **Replies:** 6\ **Last updated:** [May 5, 2021, 12:43pm UTC](https://discuss.elastic.co/t/update-index-patterns-automatically-programatically/271643 "2021-05-05T12:43:44Z")
A few years ago, this question was asked and at the time it was suggested an API might be forthcoming. Has that happened? If not, what is the normal flow for a pipeline that does not have a fixed set of fields? Paul --- ## [Back up Kibana Cluster Data ? Where and How?](https://discuss.elastic.co/t/back-up-kibana-cluster-data-where-and-how/272095)
**Author:** [@LuigiDelavega](https://discuss.elastic.co/u/LuigiDelavega)\ **Replies:** 2\ **Last updated:** [May 5, 2021, 12:31pm UTC](https://discuss.elastic.co/t/back-up-kibana-cluster-data-where-and-how/272095 "2021-05-05T12:31:39Z")
Hello, I'm trying to migrate my Kibana Data configurations from one server to a new one, with snapshots. I already have a saved objects back up with the API, and now i want to back up my index templates, policies, roll… --- ## [How to handle lots of small indices](https://discuss.elastic.co/t/how-to-handle-lots-of-small-indices/272063)
**Author:** [@fillg1](https://discuss.elastic.co/u/fillg1)\ **Replies:** 8\ **Last updated:** [May 5, 2021, 12:13pm UTC](https://discuss.elastic.co/t/how-to-handle-lots-of-small-indices/272063 "2021-05-05T12:13:31Z")
Hi folks We are using Elasticsearch as a kind of backend for our application. Due to security and privacy reasons, we create a per user index which is opened/ closed by the application. This size of the index is small… --- ## [Parsing logs filebeat](https://discuss.elastic.co/t/parsing-logs-filebeat/272011)
**Author:** [@mostpha456](https://discuss.elastic.co/u/mostpha456)\ **Replies:** 3\ **Last updated:** [May 5, 2021, 12:04pm UTC](https://discuss.elastic.co/t/parsing-logs-filebeat/272011 "2021-05-05T12:04:51Z")
Hello, I m using filebeat to parse my logs I have logs of the following format: ID: xxx Date: xxx Message: xxx is it possible to send the logs to elasticsearch by adding the fields ID, Date, Message and their value… --- ## [Trouble with migrating legacy plugin](https://discuss.elastic.co/t/trouble-with-migrating-legacy-plugin/271635)
**Author:** [@kibanaPluginDev](https://discuss.elastic.co/u/kibanaPluginDev)\ **Replies:** 3\ **Last updated:** [May 5, 2021, 11:47am UTC](https://discuss.elastic.co/t/trouble-with-migrating-legacy-plugin/271635 "2021-05-05T11:47:27Z")
We are really facing problems in implementing elasticsearch requests from Kibana Plugin using the core kibana API for elasticsearch? Also referred migration examples and the legacy to new platform migration document. Cou… --- ## [Curator failed to connect to local Elasticsearch (on Ubuntu VM)](https://discuss.elastic.co/t/curator-failed-to-connect-to-local-elasticsearch-on-ubuntu-vm/272060)
**Author:** [@111441](https://discuss.elastic.co/u/111441)\ **Replies:** 4\ **Last updated:** [May 5, 2021, 10:56am UTC](https://discuss.elastic.co/t/curator-failed-to-connect-to-local-elasticsearch-on-ubuntu-vm/272060 "2021-05-05T10:56:23Z")
I have Elasticsearch on Ubuntu VM. I installed curator on the hosting windows server and succeeded to connect to elasticsearch, using the VM IP in the config file (and also succeeded to delete indices) But when I insta… --- ## [EC on k8s - Beats dashboards not showing CPU Usage data](https://discuss.elastic.co/t/ec-on-k8s-beats-dashboards-not-showing-cpu-usage-data/272122)
**Author:** [@rodwastaken](https://discuss.elastic.co/u/rodwastaken)\ **Replies:** 1\ **Last updated:** [May 5, 2021, 10:31am UTC](https://discuss.elastic.co/t/ec-on-k8s-beats-dashboards-not-showing-cpu-usage-data/272122 "2021-05-05T10:31:27Z")
Hello friends, im hoping you can guide me or help with an issue im having with metricbeats dashboard especifically and focusing on -\>""\[Metricbeat System\] Host overview ECS. Some of the gauge visualizations on the dash… --- ## [Understand "reconnect" and "retries" settings in Kafka output](https://discuss.elastic.co/t/understand-reconnect-and-retries-settings-in-kafka-output/272157)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 2\ **Last updated:** [May 5, 2021, 9:52am UTC](https://discuss.elastic.co/t/understand-reconnect-and-retries-settings-in-kafka-output/272157 "2021-05-05T09:52:25Z")
Hello all, With this config : input { tcp { type =\> "NETWORK\_DEVICE" port =\> 1602 } filter{ } output { kafka { topic\_id =\> \["network.device"\] codec =\> json bootstrap\_servers =\> "kafka1:9092,kafka2:9092,k… --- ## [Filebeat Config Failure](https://discuss.elastic.co/t/filebeat-config-failure/272061)
**Author:** [@Himani\_Tawade](https://discuss.elastic.co/u/Himani_Tawade)\ **Replies:** 1\ **Last updated:** [May 5, 2021, 9:58am UTC](https://discuss.elastic.co/t/filebeat-config-failure/272061 "2021-05-05T09:58:42Z")
Hi All, I am pretty new to the ELK stack. I am trying to create multiple indices for different logs coming from the application. I am not using logstash and I am getting json logs from the app. But when I am trying t… --- ## [Is it possible to grant another Elastic Cloud SSO user access to my Elasticsearch instance on Elastic Cloud?](https://discuss.elastic.co/t/is-it-possible-to-grant-another-elastic-cloud-sso-user-access-to-my-elasticsearch-instance-on-elastic-cloud/272069)
**Author:** [@Rich\_Kuzsma](https://discuss.elastic.co/u/Rich_Kuzsma)\ **Replies:** 0\ **Last updated:** [May 4, 2021, 12:50pm UTC](https://discuss.elastic.co/t/is-it-possible-to-grant-another-elastic-cloud-sso-user-access-to-my-elasticsearch-instance-on-elastic-cloud/272069 "2021-05-04T12:50:02Z")
Asking and answering my own question in case it helps others in the future. For now, it is not possible to grant other Elastic Cloud SSO users access to an Elasticsearch instance on Elastic Cloud. However, you can add n… --- ## [How is ES data distributed in each data nodes](https://discuss.elastic.co/t/how-is-es-data-distributed-in-each-data-nodes/272079)
**Author:** [@chaitra\_hegde](https://discuss.elastic.co/u/chaitra_hegde)\ **Replies:** 1\ **Last updated:** [May 5, 2021, 9:57am UTC](https://discuss.elastic.co/t/how-is-es-data-distributed-in-each-data-nodes/272079 "2021-05-05T09:57:56Z")
Hi, I am using Elasticsearch 7.8.0 in k8s environment. I have 20 ES ingest nodes for serving traffic, 25 data nodes , 3 master nodes. How is the data stored getting distributed across all ES data nodes because I see on … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1427) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1429)