# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1442 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1443 --- ## [Date Histogram Aggregation with Empty Days](https://discuss.elastic.co/t/date-histogram-aggregation-with-empty-days/271436)
**Author:** [@TomTom](https://discuss.elastic.co/u/TomTom)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 8:10pm UTC](https://discuss.elastic.co/t/date-histogram-aggregation-with-empty-days/271436 "2021-04-27T20:10:12Z")
With the Date Histogram Aggregation is it possible to return a complete list of days, even if none of them have found results? I am using a query to look for sales that occurred in a range of days, but in some cases the… --- ## [Filter by count of inner\_hits?](https://discuss.elastic.co/t/filter-by-count-of-inner-hits/271298)
**Author:** [@bkazez](https://discuss.elastic.co/u/bkazez)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 7:16pm UTC](https://discuss.elastic.co/t/filter-by-count-of-inner-hits/271298 "2021-04-27T19:16:36Z")
I'm using ES to search movements of baroque music, so someone can find e.g. music for flute, violin, and soprano or for 2 violins and soprano. The following works: Multilingual instrument names flûte à bec should find… --- ## [Juniper log ingestion](https://discuss.elastic.co/t/juniper-log-ingestion/270964)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 7\ **Last updated:** [April 27, 2021, 7:15pm UTC](https://discuss.elastic.co/t/juniper-log-ingestion/270964 "2021-04-27T19:15:24Z")
I am trying to ingest juniper log via filebeat using juniper module but it does not give me systemname and RT\_FLOW anywhere in my ELK data. how do I get that? source = dc-fw1 Can I modify this module and add my own p… --- ## [Need help aggregating strings from logs](https://discuss.elastic.co/t/need-help-aggregating-strings-from-logs/271428)
**Author:** [@nitishj](https://discuss.elastic.co/u/nitishj)\ **Replies:** 0\ **Last updated:** [April 27, 2021, 6:12pm UTC](https://discuss.elastic.co/t/need-help-aggregating-strings-from-logs/271428 "2021-04-27T18:12:03Z")
I wish to create a dashboard with a dataset consisting of 3 variables out of which I want to see average values of 2 (after theyr're grouped the third variable). For example, I would like to see the solverObjVal and Solv… --- ## [ECK showInSelector causes infinite 302 and kibana pod fails](https://discuss.elastic.co/t/eck-showinselector-causes-infinite-302-and-kibana-pod-fails/271321)
**Author:** [@ewolfman](https://discuss.elastic.co/u/ewolfman)\ **Replies:** 3\ **Last updated:** [April 27, 2021, 6:07pm UTC](https://discuss.elastic.co/t/eck-showinselector-causes-infinite-302-and-kibana-pod-fails/271321 "2021-04-27T18:07:29Z")
Hi, Kibana 7.10.2. My goal is to either completely hide the provider selector screen or hide the providers. When settings xpack showInSelector to 'false', Kibana pod fails to load with what looks like an infinite loop… --- ## [Timestamp - Filebeat](https://discuss.elastic.co/t/timestamp-filebeat/270900)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 7\ **Last updated:** [April 27, 2021, 4:34pm UTC](https://discuss.elastic.co/t/timestamp-filebeat/270900 "2021-04-27T16:34:26Z")
Hello everyone, Hope you are doing well! I am exploring the possibilities of log viewing through Kibana. I am using version 7.9.2 for ELK and filebeat as well. so I am sending logs through filebeat directly to Elasticse… --- ## [Can Elasticsearch on Kubernetes safely reuse data from PVs that were detached after a node went down?](https://discuss.elastic.co/t/can-elasticsearch-on-kubernetes-safely-reuse-data-from-pvs-that-were-detached-after-a-node-went-down/271207)
**Author:** [@mattwelke](https://discuss.elastic.co/u/mattwelke)\ **Replies:** 3\ **Last updated:** [April 27, 2021, 3:52pm UTC](https://discuss.elastic.co/t/can-elasticsearch-on-kubernetes-safely-reuse-data-from-pvs-that-were-detached-after-a-node-went-down/271207 "2021-04-27T15:52:51Z")
I'm looking into different ways to deploy Elasticsearch on Kubernetes. My understanding so far is that it's normal to use the ECK operator pattern to deploy if you're deploying to Kubernetes, and that this causes Statef… --- ## [Kibana maps type - search\_as\_you\_type as unknown in the index pattern](https://discuss.elastic.co/t/kibana-maps-type-search-as-you-type-as-unknown-in-the-index-pattern/271399)
**Author:** [@cvljayawardana](https://discuss.elastic.co/u/cvljayawardana)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 3:43pm UTC](https://discuss.elastic.co/t/kibana-maps-type-search-as-you-type-as-unknown-in-the-index-pattern/271399 "2021-04-27T15:43:56Z")
I am using elasticsearch/kibana - 7.9.8 and I am trying create a suggestions API using search\_as\_you\_type data type. However, when I add the mapping to the index with certain fields as search\_as\_you\_type kibana index pa… --- ## [Can I trust a PIT id once it has been replaced by a new PIT id?](https://discuss.elastic.co/t/can-i-trust-a-pit-id-once-it-has-been-replaced-by-a-new-pit-id/271054)
**Author:** [@Snav](https://discuss.elastic.co/u/Snav)\ **Replies:** 4\ **Last updated:** [April 27, 2021, 3:39pm UTC](https://discuss.elastic.co/t/can-i-trust-a-pit-id-once-it-has-been-replaced-by-a-new-pit-id/271054 "2021-04-27T15:39:06Z")
Hello there, I was wondering how the Point In Time works internally and if it is trustable for parallelization. Context Given this implementation: I have a search request to retrieve a list of offers. It may return … --- ## [How to print my error stack trace from watchers or/and alerts in an email?](https://discuss.elastic.co/t/how-to-print-my-error-stack-trace-from-watchers-or-and-alerts-in-an-email/270296)
**Author:** [@Rem](https://discuss.elastic.co/u/Rem)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 3:23pm UTC](https://discuss.elastic.co/t/how-to-print-my-error-stack-trace-from-watchers-or-and-alerts-in-an-email/270296 "2021-04-27T15:23:38Z")
The title said it all. "actions": { "email\_action": { "throttle\_period\_in\_millis": 900000, "email": { "profile": "standard", "to": \[ "myEmail@SMTP.com" … --- ## [What is Logstash regex engine?](https://discuss.elastic.co/t/what-is-logstash-regex-engine/271387)
**Author:** [@grumo35](https://discuss.elastic.co/u/grumo35)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 3:10pm UTC](https://discuss.elastic.co/t/what-is-logstash-regex-engine/271387 "2021-04-27T15:10:08Z")
Hi, Just came across some regex in config files today and i cannot figure out which engine it is based on and documentation about the syntax i should use in my config. the thing i've stumbled across : if \[field\] !~ /… --- ## [Ship Kubernenetes events to kibana](https://discuss.elastic.co/t/ship-kubernenetes-events-to-kibana/271389)
**Author:** [@frozen\_walker](https://discuss.elastic.co/u/frozen_walker)\ **Replies:** 4\ **Last updated:** [April 27, 2021, 3:09pm UTC](https://discuss.elastic.co/t/ship-kubernenetes-events-to-kibana/271389 "2021-04-27T15:09:34Z")
How can we ship Kubernetes events logs to kibana. ie: That we can get from kubectl get events command. example output: LAST SEEN TYPE REASON OBJECT MESSAGE 47s Warning Failed p… --- ## [How to change Array(list) to field with filter pipeline of Logstash?](https://discuss.elastic.co/t/how-to-change-array-list-to-field-with-filter-pipeline-of-logstash/271327)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 3:03pm UTC](https://discuss.elastic.co/t/how-to-change-array-list-to-field-with-filter-pipeline-of-logstash/271327 "2021-04-27T15:03:01Z")
Hi there I elaborate my issue with an instance: Imagine bellow log (The field "events" is an array , there are more fields in the log but I ignore them to write and just wrote down the field "events") "events": \[ … --- ## [Mapping template field with keyword suffix](https://discuss.elastic.co/t/mapping-template-field-with-keyword-suffix/270989)
**Author:** [@benschiefer](https://discuss.elastic.co/u/benschiefer)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 2:55pm UTC](https://discuss.elastic.co/t/mapping-template-field-with-keyword-suffix/270989 "2021-04-27T14:55:55Z")
Hello, I am currently running into an issue where I am hitting the max fields for an index. In order to address this issue, I am defining mapping types for the different fields in my index. Many of the fields in my cu… --- ## [Substitution text if value missing](https://discuss.elastic.co/t/substitution-text-if-value-missing/271301)
**Author:** [@lquin1978](https://discuss.elastic.co/u/lquin1978)\ **Replies:** 4\ **Last updated:** [April 27, 2021, 2:54pm UTC](https://discuss.elastic.co/t/substitution-text-if-value-missing/271301 "2021-04-27T14:54:17Z")
Our firewall is sending log messages to our ELK stack. Most of these messages contain a source and destination IP address.. but occasionally these values are not present. These messages are being forward via email and … --- ## [Button URL when ELK server IP is changed](https://discuss.elastic.co/t/button-url-when-elk-server-ip-is-changed/270959)
**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 2:52pm UTC](https://discuss.elastic.co/t/button-url-when-elk-server-ip-is-changed/270959 "2021-04-27T14:52:12Z")
Kibana version : 7.9 Elasticsearch version : 7.9 APM Server version : 7.9 APM Agent language and version : java 1.8 Fresh install or upgraded from other version? fresh install Is there anything special in your setup… --- ## [If field == IPv6 assign a different value](https://discuss.elastic.co/t/if-field-ipv6-assign-a-different-value/271397)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 0\ **Last updated:** [April 27, 2021, 2:32pm UTC](https://discuss.elastic.co/t/if-field-ipv6-assign-a-different-value/271397 "2021-04-27T14:32:38Z")
I have the following configuration (partial output) # Check if SourceIP address is IPv4 or IPv6. In case SourceIP is IPv6 change its value #if \[SourceIP\] =~ ":" { mutate { rename =\> { "SourceIP" =\> "SourceIP… --- ## [Logstash is failing when running as a service due to logstash-core-plugin-api.gemspec error](https://discuss.elastic.co/t/logstash-is-failing-when-running-as-a-service-due-to-logstash-core-plugin-api-gemspec-error/271385)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 2:26pm UTC](https://discuss.elastic.co/t/logstash-is-failing-when-running-as-a-service-due-to-logstash-core-plugin-api-gemspec-error/271385 "2021-04-27T14:26:23Z")
Hi Team, My logstash was working completely fine till yesterday and suddenly it stopped working, now when I am trying to restart it using systemctl start logstash command , I am getting below error. Check your env for… --- ## [Rollup Error](https://discuss.elastic.co/t/rollup-error/271109)
**Author:** [@hsalim](https://discuss.elastic.co/u/hsalim)\ **Replies:** 3\ **Last updated:** [April 27, 2021, 2:26pm UTC](https://discuss.elastic.co/t/rollup-error/271109 "2021-04-27T14:26:22Z")
Hello, I am using rollups, and now encountering following error. Any help is appreciated. Thanks. ' Rollup job failed with an exception: java.lang.NullPointerException: Cannot invoke "org.elasticsearch.search.aggreg… --- ## [Kibana doesn't show all field form the document](https://discuss.elastic.co/t/kibana-doesnt-show-all-field-form-the-document/271381)
**Author:** [@apox](https://discuss.elastic.co/u/apox)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 2:25pm UTC](https://discuss.elastic.co/t/kibana-doesnt-show-all-field-form-the-document/271381 "2021-04-27T14:25:15Z")
Hi Guy, I have the problem that Kibana me the field what is call "stackTrace". The first JSON is from the index out of elasticsearch: { "\_index" : "filebeat-7.12.0-2021.04.27-000020", "\_type" : "\_doc", "\_id" : "… --- ## [Extract value from a multivalued field](https://discuss.elastic.co/t/extract-value-from-a-multivalued-field/271359)
**Author:** [@chriselk](https://discuss.elastic.co/u/chriselk)\ **Replies:** 3\ **Last updated:** [April 27, 2021, 2:16pm UTC](https://discuss.elastic.co/t/extract-value-from-a-multivalued-field/271359 "2021-04-27T14:16:22Z")
Hi, trying a simple stuff with logstash but could not get the expected result... I have a multivalued Field like: "PUB\_WEIGHT": \[ "3", "4", "6", "8" \] and in want to convert to Field\_1: 3 … --- ## [Date issue](https://discuss.elastic.co/t/date-issue/271322)
**Author:** [@sasvmware](https://discuss.elastic.co/u/sasvmware)\ **Replies:** 6\ **Last updated:** [April 27, 2021, 2:11pm UTC](https://discuss.elastic.co/t/date-issue/271322 "2021-04-27T14:11:46Z")
Log file date is on 26th but in elasticsearch date show as 25th why ? Logstash conf file. input { beats { port =\> 5044 } } filter { grok { match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:timestamp}%{GREEDYDATA:lt\_… --- ## [Elastic monitoring cluster](https://discuss.elastic.co/t/elastic-monitoring-cluster/271266)
**Author:** [@vee](https://discuss.elastic.co/u/vee)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 2:07pm UTC](https://discuss.elastic.co/t/elastic-monitoring-cluster/271266 "2021-04-27T14:07:23Z")
Hi, starting to look into setting a dedicated monitoring cluster to capture all monitoring data from elasticsearch nodes. We are at v7.11 and I see the .monitoring indices size is about 3.5GB/day/cluster. Trying to seek … --- ## [How do I separate stdout and stderr logs of Logstash service?](https://discuss.elastic.co/t/how-do-i-separate-stdout-and-stderr-logs-of-logstash-service/271393)
**Author:** [@hvardhan](https://discuss.elastic.co/u/hvardhan)\ **Replies:** 0\ **Last updated:** [April 27, 2021, 2:03pm UTC](https://discuss.elastic.co/t/how-do-i-separate-stdout-and-stderr-logs-of-logstash-service/271393 "2021-04-27T14:03:53Z")
Logstash is being run using systemd. I have tried adding: StandardError=/ebs/logs/some\_error.log in logstash.service but it doesn't work. Also added this in pipelines.yml output { if \[level\] == "WARN" { … --- ## [Results are not changed after index updating](https://discuss.elastic.co/t/results-are-not-changed-after-index-updating/271119)
**Author:** [@guilherme\_maranhao](https://discuss.elastic.co/u/guilherme_maranhao)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 1:59pm UTC](https://discuss.elastic.co/t/results-are-not-changed-after-index-updating/271119 "2021-04-27T13:59:41Z")
Hi everyone, I have a bool query: from: 0, size: 10, query: { bool: { must: \[ { term: { boolean\_field: false } }, { term: { integer\_field: \*something\* } }, … --- ## [Forward Logs from Elasticsearch to external destination application](https://discuss.elastic.co/t/forward-logs-from-elasticsearch-to-external-destination-application/271021)
**Author:** [@vishakh](https://discuss.elastic.co/u/vishakh)\ **Replies:** 7\ **Last updated:** [April 27, 2021, 1:59pm UTC](https://discuss.elastic.co/t/forward-logs-from-elasticsearch-to-external-destination-application/271021 "2021-04-27T13:59:34Z")
I'm looking to forward already stored logs from Elasticsearch to an external application-source. We're quite aware that we could leverage Logstash to distribute/split the new future-incoming logs between Elasticsearch a… --- ## [From CloudTrail S3 SQS to Elastic via Logstash](https://discuss.elastic.co/t/from-cloudtrail-s3-sqs-to-elastic-via-logstash/271391)
**Author:** [@Dimitri\_Goldshtein](https://discuss.elastic.co/u/Dimitri_Goldshtein)\ **Replies:** 0\ **Last updated:** [April 27, 2021, 1:58pm UTC](https://discuss.elastic.co/t/from-cloudtrail-s3-sqs-to-elastic-via-logstash/271391 "2021-04-27T13:58:49Z")
Hi all ! I try get logs from my aws s3 via logstash ! I generate get logs from CloudTrail to s3 with format \*\*\*\*.json.gz in logstash i use this input file input { sqs { queue =\> "test\_log… --- ## [How can I set new shard and replica number with re-index?](https://discuss.elastic.co/t/how-can-i-set-new-shard-and-replica-number-with-re-index/271337)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 1:53pm UTC](https://discuss.elastic.co/t/how-can-i-set-new-shard-and-replica-number-with-re-index/271337 "2021-04-27T13:53:51Z")
I have an index consisting of 40 shards and I want to make 50 shards with reindex. How can I determine the new shard and replica number with the reindex? --- ## [Pushing Distinct values from an index to another index](https://discuss.elastic.co/t/pushing-distinct-values-from-an-index-to-another-index/271318)
**Author:** [@CSehra](https://discuss.elastic.co/u/CSehra)\ **Replies:** 3\ **Last updated:** [April 27, 2021, 1:51pm UTC](https://discuss.elastic.co/t/pushing-distinct-values-from-an-index-to-another-index/271318 "2021-04-27T13:51:25Z")
Is there a way to push distinct values of a field from indexA to a new indexB on a regular basis(daily or monthly)? Use Case: I want to create indexB from one of the fields of indexA, and on a daily basis do an update o… --- ## [I can’t install logstash-plug](https://discuss.elastic.co/t/i-can-t-install-logstash-plug/271268)
**Author:** [@Dimitri\_Goldshtein](https://discuss.elastic.co/u/Dimitri_Goldshtein)\ **Replies:** 4\ **Last updated:** [April 27, 2021, 1:45pm UTC](https://discuss.elastic.co/t/i-can-t-install-logstash-plug/271268 "2021-04-27T13:45:13Z")
Hi all gurus ! I can’t install any plugin logstash ! For example this plugin : https://github.com/logstash-plugins/logstash-input-sqs If I run install to plug I get this error : usr/share/logstash/bin/logstash-plugi… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1441) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1443)