# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1507 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1508 --- ## [Edit field "action"](https://discuss.elastic.co/t/edit-field-action/267291)
**Author:** [@lele15](https://discuss.elastic.co/u/lele15)\ **Replies:** 2\ **Last updated:** [March 16, 2021, 8:33am UTC](https://discuss.elastic.co/t/edit-field-action/267291 "2021-03-16T08:33:08Z")
Hi, i'm new on ES and i have a problem with csv ingestion. I want to edit data on ES when a field has a specific value. Like: Id,Name,Operation 1,Jack,Edit 2,,Delete I want something like this in my Logstash config… --- ## [Why does an enrich policy get executed on the master node?](https://discuss.elastic.co/t/why-does-an-enrich-policy-get-executed-on-the-master-node/263241)
**Author:** [@val](https://discuss.elastic.co/u/val)\ **Replies:** 29\ **Last updated:** [March 16, 2021, 7:56am UTC](https://discuss.elastic.co/t/why-does-an-enrich-policy-get-executed-on-the-master-node/263241 "2021-03-16T07:56:36Z")
I'm trying to create a geo\_match enrich policy based on a not-so-big source index (10GB). The match field is a geo\_shape and there are about half a dozen single-term enrich fields. So nothing extraordinary. When the ind… --- ## [Elasticsearch : Return the value of a field in the latest document created each day for the last one month](https://discuss.elastic.co/t/elasticsearch-return-the-value-of-a-field-in-the-latest-document-created-each-day-for-the-last-one-month/267327)
**Author:** [@Bengagi\_Foued](https://discuss.elastic.co/u/Bengagi_Foued)\ **Replies:** 0\ **Last updated:** [March 16, 2021, 7:51am UTC](https://discuss.elastic.co/t/elasticsearch-return-the-value-of-a-field-in-the-latest-document-created-each-day-for-the-last-one-month/267327 "2021-03-16T07:51:10Z")
I have a collection with documents updating everyday. Can someone provide me some suggestion for returning the value of a field in the latest document for each day for the last one month my document is like the one bello… --- ## [Sophos central endpoint alerts logs](https://discuss.elastic.co/t/sophos-central-endpoint-alerts-logs/267323)
**Author:** [@Ana\_11](https://discuss.elastic.co/u/Ana_11)\ **Replies:** 0\ **Last updated:** [March 16, 2021, 6:45am UTC](https://discuss.elastic.co/t/sophos-central-endpoint-alerts-logs/267323 "2021-03-16T06:45:16Z")
Hi I want to ingest sophos intercept x endpoint logs to elasticsearch. Through API im getting the alerts on syslog but the sophos filebeat module does not support alerts as it says it support only firewall logs. can u t… --- ## [Could'nt set case\_insensitive option in Nest](https://discuss.elastic.co/t/couldnt-set-case-insensitive-option-in-nest/267227)
**Author:** [@Sangeetha-Murugesan](https://discuss.elastic.co/u/Sangeetha-Murugesan)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 8:00am UTC](https://discuss.elastic.co/t/couldnt-set-case-insensitive-option-in-nest/267227 "2021-03-15T08:00:25Z")
Hi, I am using ElasticSearch version 7.11. My TermQuery only returns case-sensitive matching results,to avoid that I set case\_insensitive as true in DSL term query like below and it returns data as expected. { "qu… --- ## [Rally in kubernetes with docker image](https://discuss.elastic.co/t/rally-in-kubernetes-with-docker-image/267234)
**Author:** [@Vineeth\_varma](https://discuss.elastic.co/u/Vineeth_varma)\ **Replies:** 1\ **Last updated:** [March 16, 2021, 6:02am UTC](https://discuss.elastic.co/t/rally-in-kubernetes-with-docker-image/267234 "2021-03-16T06:02:06Z")
Hi Elastic Team, I would like to perform benchmark Testing for Elasticsearch, I have few questions regarding this: Can we use rally as a Kubernetes Deployment. https://github.com/elastic/rally/tree/master/docker - I… --- ## [Filebeat is overwriting the pipeline specified in Elastic on start](https://discuss.elastic.co/t/filebeat-is-overwriting-the-pipeline-specified-in-elastic-on-start/266825)
**Author:** [@JamblaInc](https://discuss.elastic.co/u/JamblaInc)\ **Replies:** 7\ **Last updated:** [March 15, 2021, 2:54pm UTC](https://discuss.elastic.co/t/filebeat-is-overwriting-the-pipeline-specified-in-elastic-on-start/266825 "2021-03-15T14:54:19Z")
I am using Filebeat to collect CloudWatch logs and I have modified the ingest node pipeline to extract and index some more information from the logs. However, when Filebeat has restarted the extra processors that I added… --- ## [Logstash Json Parse Error](https://discuss.elastic.co/t/logstash-json-parse-error/267058)
**Author:** [@Anu6006](https://discuss.elastic.co/u/Anu6006)\ **Replies:** 2\ **Last updated:** [March 16, 2021, 4:30am UTC](https://discuss.elastic.co/t/logstash-json-parse-error/267058 "2021-03-16T04:30:36Z")
Hi Team, I'm trying to get NSG Flow logs through Azure Blob Storage plugin version: logstash-input-azureblob (0.9.13). logstash-codec-json (3.0.5) I am trying to save my Logstash output in JSON format. But it is sho… --- ## [パスワード変更の禁止](https://discuss.elastic.co/t/topic/264210)
**Author:** [@syogo](https://discuss.elastic.co/u/syogo)\ **Replies:** 3\ **Last updated:** [March 16, 2021, 3:31am UTC](https://discuss.elastic.co/t/topic/264210 "2021-03-16T03:31:11Z")
\[kibana\_dashboard\_only\_user\]を持っているAというアカウントでログインしたとき，図のAccountSettingsページに移動させないためにはどうしたらいいですか？最終的にパスワード変更ができないようにしたいです．また，リバースプロキシでNGINXを使用しています．versinは6.8.13であり，ライセンスはBasicです． --- ## [Elasticsearch as source of Apache Flink?](https://discuss.elastic.co/t/elasticsearch-as-source-of-apache-flink/267317)
**Author:** [@wangqinghuan](https://discuss.elastic.co/u/wangqinghuan)\ **Replies:** 0\ **Last updated:** [March 16, 2021, 3:15am UTC](https://discuss.elastic.co/t/elasticsearch-as-source-of-apache-flink/267317 "2021-03-16T03:15:46Z")
With es-hadoop plugin, we can regard Elasticsearch as source of Hadoop/Spark. Do we have any plugin helping Elasticsearch as source of Apache Flink? --- ## [\[Highlight\] Highlight query doesn't work properly in should query](https://discuss.elastic.co/t/highlight-highlight-query-doesnt-work-properly-in-should-query/267314)
**Author:** [@kwang\_hee\_Han](https://discuss.elastic.co/u/kwang_hee_Han)\ **Replies:** 0\ **Last updated:** [March 16, 2021, 2:34am UTC](https://discuss.elastic.co/t/highlight-highlight-query-doesnt-work-properly-in-should-query/267314 "2021-03-16T02:34:52Z")
GET naver\_article/\_search { "size": 100, "query" : { "function\_score": { "functions": \[ { "weight": 1.8, "gauss": { "format\_date": { "scale": "1d" … --- ## [Artifacts.elastic.co intermittently fails (404, "no longer has a Release file.")](https://discuss.elastic.co/t/artifacts-elastic-co-intermittently-fails-404-no-longer-has-a-release-file/266151)
**Author:** [@tedder](https://discuss.elastic.co/u/tedder)\ **Replies:** 3\ **Last updated:** [March 16, 2021, 1:32am UTC](https://discuss.elastic.co/t/artifacts-elastic-co-intermittently-fails-404-no-longer-has-a-release-file/266151 "2021-03-16T01:32:18Z")
It seems that there are transient failures with artifacts.elastic.co, perhaps servers that are out of sync. We sometimes see this when running apt-get -q update: bad $ sudo apt-get -q update ... Ign:5 https://artifacts… --- ## [How can I check event.field value from a file?](https://discuss.elastic.co/t/how-can-i-check-event-field-value-from-a-file/267292)
**Author:** [@Ishaan](https://discuss.elastic.co/u/Ishaan)\ **Replies:** 4\ **Last updated:** [March 16, 2021, 1:27am UTC](https://discuss.elastic.co/t/how-can-i-check-event-field-value-from-a-file/267292 "2021-03-16T01:27:19Z")
How can I check if the event.field\_name value is present in the file? If yes, drop the event otherwise send the event to elasticsearch. Note: The field\_name could have multiple values in that file, and I want to check i… --- ## [Elasticsearch to Google sheets](https://discuss.elastic.co/t/elasticsearch-to-google-sheets/267173)
**Author:** [@SUMANT\_MISHRA](https://discuss.elastic.co/u/SUMANT_MISHRA)\ **Replies:** 1\ **Last updated:** [March 15, 2021, 10:10pm UTC](https://discuss.elastic.co/t/elasticsearch-to-google-sheets/267173 "2021-03-15T22:10:26Z")
Hi All, Is there any direct way to export data from the Elasticsearch index to Googlesheets (not from google sheets to elasticsearch) based on a defined iterval without using any ETL tool or script? Something like G-conn… --- ## [Filebeat to parse json array](https://discuss.elastic.co/t/filebeat-to-parse-json-array/267301)
**Author:** [@vantoryc](https://discuss.elastic.co/u/vantoryc)\ **Replies:** 2\ **Last updated:** [March 15, 2021, 9:00pm UTC](https://discuss.elastic.co/t/filebeat-to-parse-json-array/267301 "2021-03-15T21:00:08Z")
Hi, We are currently using filebeats to send logs to our Graylog. So far it has worked out fine for as as the logs were single line. Now we want to add logs from another folder but the logs are are multiline json array… --- ## [Send value aggregation.payload with kibana watcher](https://discuss.elastic.co/t/send-value-aggregation-payload-with-kibana-watcher/267124)
**Author:** [@Eyler\_Rodrigues](https://discuss.elastic.co/u/Eyler_Rodrigues)\ **Replies:** 0\ **Last updated:** [March 12, 2021, 8:53pm UTC](https://discuss.elastic.co/t/send-value-aggregation-payload-with-kibana-watcher/267124 "2021-03-12T20:53:47Z")
Dear, I need help to resolve a question related to the watcher. I created a script with an aggregation and based on a value it sends a message to a webhook. The result of my script is an example below: "aggregations": … --- ## [Detecting date from string input](https://discuss.elastic.co/t/detecting-date-from-string-input/267305)
**Author:** [@macctown](https://discuss.elastic.co/u/macctown)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 7:58pm UTC](https://discuss.elastic.co/t/detecting-date-from-string-input/267305 "2021-03-15T19:58:10Z")
Hi I'm trying to find a way to get possible "date" information from user input string. Input - a string that may contain date information, for example: "UK basketball", "US sports 2019", "sports 2019/12/23" After sendi… --- ## [Log viewing Elastic stack](https://discuss.elastic.co/t/log-viewing-elastic-stack/266598)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 5\ **Last updated:** [March 15, 2021, 7:53pm UTC](https://discuss.elastic.co/t/log-viewing-elastic-stack/266598 "2021-03-15T19:53:07Z")
Hello there, I would like to explore the possibility of log viewing through Elastic stack. I understand that I can use filebeat in order to do that but I already have logs that I would like to view in kibana dashboard … --- ## [How to index null values/ empty array thru Ingest Pipeline](https://discuss.elastic.co/t/how-to-index-null-values-empty-array-thru-ingest-pipeline/267256)
**Author:** [@sravankayitha](https://discuss.elastic.co/u/sravankayitha)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 12:07pm UTC](https://discuss.elastic.co/t/how-to-index-null-values-empty-array-thru-ingest-pipeline/267256 "2021-03-15T12:07:40Z")
Hello, I'm new to ES, Can any one suggest me How to resolve this issue: Pipeline name: cpqtest2602 Actual default index: cpqtest26\* Unformatted index: unformatted2602\* I'm trying to index the null values/empty array… --- ## [Field added by Logstash Grok can't be used in Kibana filters](https://discuss.elastic.co/t/field-added-by-logstash-grok-cant-be-used-in-kibana-filters/267122)
**Author:** [@b133](https://discuss.elastic.co/u/b133)\ **Replies:** 4\ **Last updated:** [March 15, 2021, 7:46pm UTC](https://discuss.elastic.co/t/field-added-by-logstash-grok-cant-be-used-in-kibana-filters/267122 "2021-03-15T19:46:48Z")
I added a hostname field to my index using Logstash Grok: grok { match =\> { "originsicname" =\> "CN=%{HOSTNAME:hostname}," } ... For some reason I cannot use this hostname field as a filter on my dashboards. … --- ## [Elasticsearch indexing strategy for searching multiple entities](https://discuss.elastic.co/t/elasticsearch-indexing-strategy-for-searching-multiple-entities/267300)
**Author:** [@Pravesh\_Jain](https://discuss.elastic.co/u/Pravesh_Jain)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 7:25pm UTC](https://discuss.elastic.co/t/elasticsearch-indexing-strategy-for-searching-multiple-entities/267300 "2021-03-15T19:25:33Z")
My application deals with multiple entities, each having different fields. New entities can be added. New fields may be added in existing entities. I want to search over all of these entities, together, using elasticsea… --- ## [After changing the server ip address , Kibana does not work](https://discuss.elastic.co/t/after-changing-the-server-ip-address-kibana-does-not-work/265840)
**Author:** [@John\_biryon](https://discuss.elastic.co/u/John_biryon)\ **Replies:** 9\ **Last updated:** [March 15, 2021, 7:15pm UTC](https://discuss.elastic.co/t/after-changing-the-server-ip-address-kibana-does-not-work/265840 "2021-03-15T19:15:47Z")
Where do i go about to update the Kibana for the new IP address ? the ip address of the server had to be changed . Microsoft Windows 2012 r2, was working nicly before the change. many thanks John --- ## [Setup filebeat custom nginx access logs path inside docker container](https://discuss.elastic.co/t/setup-filebeat-custom-nginx-access-logs-path-inside-docker-container/267189)
**Author:** [@cdalexndr](https://discuss.elastic.co/u/cdalexndr)\ **Replies:** 1\ **Last updated:** [March 15, 2021, 7:13pm UTC](https://discuss.elastic.co/t/setup-filebeat-custom-nginx-access-logs-path-inside-docker-container/267189 "2021-03-15T19:13:05Z")
How to configure a filebeat running inside a docker container to get access logs from nginx running in another container? Nginx access logs are not in default location so the paths must be configured. I've tried using … --- ## [Set order of filebeat inputs](https://discuss.elastic.co/t/set-order-of-filebeat-inputs/267157)
**Author:** [@SKiD](https://discuss.elastic.co/u/SKiD)\ **Replies:** 1\ **Last updated:** [March 15, 2021, 6:26pm UTC](https://discuss.elastic.co/t/set-order-of-filebeat-inputs/267157 "2021-03-15T18:26:09Z")
Hey, I want to ship lines from Filebeat to Logstash in a specific input order. The reason I want to do that is that the documents of the second input are basing on the documents of the second input. This means I update … --- ## [Nested fields in syslog output plugin](https://discuss.elastic.co/t/nested-fields-in-syslog-output-plugin/267268)
**Author:** [@dsv](https://discuss.elastic.co/u/dsv)\ **Replies:** 2\ **Last updated:** [March 15, 2021, 4:54pm UTC](https://discuss.elastic.co/t/nested-fields-in-syslog-output-plugin/267268 "2021-03-15T16:54:33Z")
Hey guys, i'm not able to send a nested field in the syslog output plugin. syslog { host =\> "1.7.3.9" rfc =\> "rfc5424" codec =\> cef … --- ## [Filebeat error during install](https://discuss.elastic.co/t/filebeat-error-during-install/267257)
**Author:** [@Liliana\_Novais](https://discuss.elastic.co/u/Liliana_Novais)\ **Replies:** 5\ **Last updated:** [March 15, 2021, 4:29pm UTC](https://discuss.elastic.co/t/filebeat-error-during-install/267257 "2021-03-15T16:29:00Z")
Hello, I am trying to configure Filebeat. When I input this command: .\\filebeat.exe modules list I am having the following error: Error initializing beat: error loading config file: yaml: line 157: did not find expec… --- ## [Unable to ignore @timestamp in logs](https://discuss.elastic.co/t/unable-to-ignore-timestamp-in-logs/267141)
**Author:** [@Rakesh\_B](https://discuss.elastic.co/u/Rakesh_B)\ **Replies:** 6\ **Last updated:** [March 15, 2021, 4:22pm UTC](https://discuss.elastic.co/t/unable-to-ignore-timestamp-in-logs/267141 "2021-03-15T16:22:59Z")
Hi, We send multiple types of logs to Logstash and one of them uploaded JSON logs with an "@timestamp" field. Logstash tries to parse that field and when it fails it copies the value into "\_@timestamp" and throws a warn… --- ## [Can fields in the mapping be made non sortable](https://discuss.elastic.co/t/can-fields-in-the-mapping-be-made-non-sortable/266461)
**Author:** [@Deepti](https://discuss.elastic.co/u/Deepti)\ **Replies:** 3\ **Last updated:** [March 15, 2021, 3:57pm UTC](https://discuss.elastic.co/t/can-fields-in-the-mapping-be-made-non-sortable/266461 "2021-03-15T15:57:21Z")
Can we make a field in the mapping as non sortable? The way we can make a field unsearchable by setting the mapping parameter "index:false" ,is there a way to make fields non sortable? Is there any mapping parameter t… --- ## [Error Parsing JSON data in Logstash](https://discuss.elastic.co/t/error-parsing-json-data-in-logstash/267249)
**Author:** [@atharvak](https://discuss.elastic.co/u/atharvak)\ **Replies:** 3\ **Last updated:** [March 15, 2021, 3:16pm UTC](https://discuss.elastic.co/t/error-parsing-json-data-in-logstash/267249 "2021-03-15T15:16:18Z")
Hello guys, I am trying to debug this issue showing up related to Json Parsing. When my filebeat sends data to logstash, following error is showing up. My Logstash Filter filter { if "cost\_management" in \[tags\] { f… --- ## [Kibana Tag Description on Hover](https://discuss.elastic.co/t/kibana-tag-description-on-hover/267125)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [March 15, 2021, 3:02pm UTC](https://discuss.elastic.co/t/kibana-tag-description-on-hover/267125 "2021-03-15T15:02:14Z")
Hello, Nice work with the Kibana tags in 7.11, that will be useful. :slight\_smile: But I was thinking that it would be nice if the description was shown when hovering over the tag. For example: In the above screens… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1506) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1508)