# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1596 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1597 --- ## [Failed to parse date field, date\_time\_parse\_exception](https://discuss.elastic.co/t/failed-to-parse-date-field-date-time-parse-exception/261492)
**Author:** [@yulaika](https://discuss.elastic.co/u/yulaika)\ **Replies:** 6\ **Last updated:** [January 20, 2021, 1:02am UTC](https://discuss.elastic.co/t/failed-to-parse-date-field-date-time-parse-exception/261492 "2021-01-20T01:02:59Z")
Here is my configuration: "\[log\]\[timestamp\]" =\> "%{\[yearinlog\]}-%{\[monthinlog\]}-%{\[dateinlog\]} %{\[hourinlog\]}:%{\[minuteinlog\]}:%{\[secondinlog\]}" } } date { match =\> \[ "\[log\]\[timestamp\]", "yyyy-MM-dd HH:mm:ss.SSS00… --- ## [\_update\_by\_query column.column](https://discuss.elastic.co/t/update-by-query-column-column/261605)
**Author:** [@jcornejo](https://discuss.elastic.co/u/jcornejo)\ **Replies:** 5\ **Last updated:** [January 20, 2021, 12:41am UTC](https://discuss.elastic.co/t/update-by-query-column-column/261605 "2021-01-20T00:41:12Z")
I have this example mapping. I need to update the field "shirt.color" mapping { "shirts" : { "mappings" : { "properties" : { "shirt" : { "properties" : { "brand" : { "type" : "keyword" }, "color" : { "… --- ## [Is that possible to replace @timestamp during parse data via Filebeat](https://discuss.elastic.co/t/is-that-possible-to-replace-timestamp-during-parse-data-via-filebeat/261500)
**Author:** [@GL\_Choong](https://discuss.elastic.co/u/GL_Choong)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 11:57pm UTC](https://discuss.elastic.co/t/is-that-possible-to-replace-timestamp-during-parse-data-via-filebeat/261500 "2021-01-19T23:57:03Z")
Would like to get advise from all expert. Currently I\`m working on a project. But having issue on @Timestamp that generated by Kibana is event\_timestamp which expected the timestamp grab from log which example as below … --- ## [Datestamp to @timestamp](https://discuss.elastic.co/t/datestamp-to-timestamp/261604)
**Author:** [@cyberd](https://discuss.elastic.co/u/cyberd)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 11:21pm UTC](https://discuss.elastic.co/t/datestamp-to-timestamp/261604 "2021-01-19T23:21:34Z")
Hi, So i need to parse this date format from my log: 01/19/21-15:00:26.308390 to the @timestamp so i can filter it in Kibana. So far it looks like this: match =\> { "message" =\> "%{DATESTAMP:mystamp} date { m… --- ## [Canvas showing error instead of 0](https://discuss.elastic.co/t/canvas-showing-error-instead-of-0/261068)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 8\ **Last updated:** [January 19, 2021, 11:21pm UTC](https://discuss.elastic.co/t/canvas-showing-error-instead-of-0/261068 "2021-01-19T23:21:03Z")
Hello, I have a query that returns 0 records. The query is also using a filter of "The last 12 hours". I have 0 documents in the index, for the past 2 weeks, so the query is querying NULL(?). SELECT COUNT(DISTINCT uu… --- ## [INITIALIZING shard with REALLOCATED\_REPLICA reason](https://discuss.elastic.co/t/initializing-shard-with-reallocated-replica-reason/261590)
**Author:** [@cmusser](https://discuss.elastic.co/u/cmusser)\ **Replies:** 1\ **Last updated:** [January 19, 2021, 11:03pm UTC](https://discuss.elastic.co/t/initializing-shard-with-reallocated-replica-reason/261590 "2021-01-19T23:03:33Z")
Hi, Our 5 node cluster (this is ES 7.10.1 on Ubuntu 18.04) went yellow last night and when we investigated it this morning, there is shard in the INITIALIZING state, with a "reason" of REALLOCATED\_REPLICA. The shard see… --- ## [Is it possible to convert input to a scaled float with the covert processor of an ingest node?](https://discuss.elastic.co/t/is-it-possible-to-convert-input-to-a-scaled-float-with-the-covert-processor-of-an-ingest-node/261598)
**Author:** [@kristall](https://discuss.elastic.co/u/kristall)\ **Replies:** 0\ **Last updated:** [January 19, 2021, 10:28pm UTC](https://discuss.elastic.co/t/is-it-possible-to-convert-input-to-a-scaled-float-with-the-covert-processor-of-an-ingest-node/261598 "2021-01-19T22:28:17Z")
is it possible to scale a float while converting? --- ## [Elasticsearch 7.7 - all shards failed and task cancelled with channel closed](https://discuss.elastic.co/t/elasticsearch-7-7-all-shards-failed-and-task-cancelled-with-channel-closed/261184)
**Author:** [@jamesp](https://discuss.elastic.co/u/jamesp)\ **Replies:** 5\ **Last updated:** [January 19, 2021, 7:57pm UTC](https://discuss.elastic.co/t/elasticsearch-7-7-all-shards-failed-and-task-cancelled-with-channel-closed/261184 "2021-01-19T19:57:24Z")
Hello all, I set up a 3 node cluster using the included JRE on Windows 2016 servers with 12 GB RAM (java min/max 6GB) which seemed to be running fine without a lot of traffic. After hooking it up to a search GUI I start… --- ## [Circuit Breaking Exception](https://discuss.elastic.co/t/circuit-breaking-exception/259405)
**Author:** [@gorek](https://discuss.elastic.co/u/gorek)\ **Replies:** 10\ **Last updated:** [January 19, 2021, 7:06pm UTC](https://discuss.elastic.co/t/circuit-breaking-exception/259405 "2021-01-19T19:06:20Z")
Hello, we using Elasticsearch for a while and we current have few hundred indices with about 120 millions documents in each index. From some days we often see warnings in elasticsearch logs: org.elasticsearch.common.b… --- ## [Cross Cluster Search horizontal scaling](https://discuss.elastic.co/t/cross-cluster-search-horizontal-scaling/261218)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 7\ **Last updated:** [January 19, 2021, 7:02pm UTC](https://discuss.elastic.co/t/cross-cluster-search-horizontal-scaling/261218 "2021-01-19T19:02:16Z")
We have cross cluster search running as a separate cluster with two nodes, and cross cluster search is connected to multiple remote clusters. We have an issue with cross cluster search that all search quires are getting… --- ## [Edit Hardware Profile in Elasticsearch Instance](https://discuss.elastic.co/t/edit-hardware-profile-in-elasticsearch-instance/261562)
**Author:** [@antony\_kavin](https://discuss.elastic.co/u/antony_kavin)\ **Replies:** 3\ **Last updated:** [January 19, 2021, 6:46pm UTC](https://discuss.elastic.co/t/edit-hardware-profile-in-elasticsearch-instance/261562 "2021-01-19T18:46:33Z")
Hi, Is it possible to edit the Hardware Profile Configuration? I would like to change my Hardware Profile from I/O Optimized to Memory Optimized. Is that possible? Thanks, Antony. --- ## [Logstash battle scars - metricbeat config and duplicate output](https://discuss.elastic.co/t/logstash-battle-scars-metricbeat-config-and-duplicate-output/261581)
**Author:** [@Declan\_at\_rm](https://discuss.elastic.co/u/Declan_at_rm)\ **Replies:** 0\ **Last updated:** [January 19, 2021, 6:14pm UTC](https://discuss.elastic.co/t/logstash-battle-scars-metricbeat-config-and-duplicate-output/261581 "2021-01-19T18:14:47Z")
Not so much a question but just wanted to share some things to look out for. I should start by saying that overall by experience of ELK is good and I'm certainly sticking with it. Just wanted to share a few details of … --- ## [Azure instance type for logstash](https://discuss.elastic.co/t/azure-instance-type-for-logstash/261580)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 0\ **Last updated:** [January 19, 2021, 6:05pm UTC](https://discuss.elastic.co/t/azure-instance-type-for-logstash/261580 "2021-01-19T18:05:21Z")
Any recommendation of Azure instance type for logstash? --- ## [Make ES Queries from my Custom Kibana Plugin](https://discuss.elastic.co/t/make-es-queries-from-my-custom-kibana-plugin/261416)
**Author:** [@xenon-xenon](https://discuss.elastic.co/u/xenon-xenon)\ **Replies:** 7\ **Last updated:** [January 19, 2021, 5:10pm UTC](https://discuss.elastic.co/t/make-es-queries-from-my-custom-kibana-plugin/261416 "2021-01-19T17:10:49Z")
I'm looking for best way of create ES queries from my plugin like : without ES authentication stuff I mean best and recommended way --- ## [Message looks like it is binary when using inputs.d](https://discuss.elastic.co/t/message-looks-like-it-is-binary-when-using-inputs-d/261559)
**Author:** [@gungazoo](https://discuss.elastic.co/u/gungazoo)\ **Replies:** 1\ **Last updated:** [January 19, 2021, 4:57pm UTC](https://discuss.elastic.co/t/message-looks-like-it-is-binary-when-using-inputs-d/261559 "2021-01-19T16:57:44Z")
If I have filebeat.yml file follow a file and send it to Elasticsearch it seems to work fine but if I use the inputs.d format then the message looks like it is binary. It could just be a font problem. I don't understan… --- ## [Parse JSON input file, extract fields and write them in output file](https://discuss.elastic.co/t/parse-json-input-file-extract-fields-and-write-them-in-output-file/261543)
**Author:** [@fantonio](https://discuss.elastic.co/u/fantonio)\ **Replies:** 1\ **Last updated:** [January 19, 2021, 4:29pm UTC](https://discuss.elastic.co/t/parse-json-input-file-extract-fields-and-write-them-in-output-file/261543 "2021-01-19T16:29:34Z")
I have an input file where each line is a JSON object like the following: { "status\_code" =\> "200", "method" =\> "GET", "country" =\> "US", "field" =\> "something", } T… --- ## [How do I keep my log level field from wrapping?](https://discuss.elastic.co/t/how-do-i-keep-my-log-level-field-from-wrapping/261479)
**Author:** [@Robert\_DiFalco](https://discuss.elastic.co/u/Robert_DiFalco)\ **Replies:** 3\ **Last updated:** [January 19, 2021, 4:25pm UTC](https://discuss.elastic.co/t/how-do-i-keep-my-log-level-field-from-wrapping/261479 "2021-01-19T16:25:39Z")
How do I prevent Kibana from wrapping the level field? I am using filebeat to post data. I'm assuming the only way is to make the field name longer? Really? --- ## [Filebeat is not reading the log file in real time](https://discuss.elastic.co/t/filebeat-is-not-reading-the-log-file-in-real-time/261270)
**Author:** [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\ **Replies:** 13\ **Last updated:** [January 19, 2021, 4:00pm UTC](https://discuss.elastic.co/t/filebeat-is-not-reading-the-log-file-in-real-time/261270 "2021-01-19T16:00:40Z")
Hello Team, We setup new elasticsearch cluster with version 7.10 and beats version is also 7.10. When we setup the cluster it was working fine and we were getting the logs on kibana dashboard in real time. But now we … --- ## [Elasticsearch raw events](https://discuss.elastic.co/t/elasticsearch-raw-events/261052)
**Author:** [@karanp](https://discuss.elastic.co/u/karanp)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 3:41pm UTC](https://discuss.elastic.co/t/elasticsearch-raw-events/261052 "2021-01-19T15:41:08Z")
So we have to create visualizations on raw event data in Elasticsearch. The data would include all the stages for that data in the same index for historical uses. The question is how do we look at data and only get the m… --- ## [Logstash text to array conversion](https://discuss.elastic.co/t/logstash-text-to-array-conversion/261393)
**Author:** [@thotakura2](https://discuss.elastic.co/u/thotakura2)\ **Replies:** 1\ **Last updated:** [January 19, 2021, 3:30pm UTC](https://discuss.elastic.co/t/logstash-text-to-array-conversion/261393 "2021-01-19T15:30:38Z")
Hi all, I am trying to index data from MySQL and one of the fields is delimited by ; and ,. I want to convert it into array by delimiting it with both the characters. Currently i am using the following filter: filt… --- ## [\[Winlogbeat 7.10.1 dashboards\]: could not locate some index pattern fields](https://discuss.elastic.co/t/winlogbeat-7-10-1-dashboards-could-not-locate-some-index-pattern-fields/259961)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 5\ **Last updated:** [January 19, 2021, 3:28pm UTC](https://discuss.elastic.co/t/winlogbeat-7-10-1-dashboards-could-not-locate-some-index-pattern-fields/259961 "2021-01-19T15:28:17Z")
Hello, I am using Elasticsearch, kibana and winlogbeat, all version 7.10.1 I configured winlogbeat and run: .\\winlogbeat.exe setup -e and I had no error in my winlogbeat logs, but in kibana there are some dashboards wo… --- ## [Multiple field formatters](https://discuss.elastic.co/t/multiple-field-formatters/261468)
**Author:** [@pfennema](https://discuss.elastic.co/u/pfennema)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 9:53am UTC](https://discuss.elastic.co/t/multiple-field-formatters/261468 "2021-01-19T09:53:58Z")
I currently have a dashboard (thanks to the enhanced table plugin) which shows a percentage in the table. The percentage is calculated by combining 2 fields into a scripted field ('percentage'). If the percentage is belo… --- ## [Restrict the kibana user for one machine only](https://discuss.elastic.co/t/restrict-the-kibana-user-for-one-machine-only/261546)
**Author:** [@mrunalini](https://discuss.elastic.co/u/mrunalini)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 3:10pm UTC](https://discuss.elastic.co/t/restrict-the-kibana-user-for-one-machine-only/261546 "2021-01-19T15:10:23Z")
HI , My basic requirement here is to restrict any Kibana user for one machine only ,so that same user can not login from different machine at the same time. is there any setting needs to modify in kibana.yml file or an… --- ## [Cron+curator+logrotate are not work?](https://discuss.elastic.co/t/cron-curator-logrotate-are-not-work/261409)
**Author:** [@Tabriz](https://discuss.elastic.co/u/Tabriz)\ **Replies:** 3\ **Last updated:** [January 19, 2021, 3:05pm UTC](https://discuss.elastic.co/t/cron-curator-logrotate-are-not-work/261409 "2021-01-19T15:05:13Z")
l made a schedule for delete old logs from elasticsearch. The command is that 30 0 \* \* \* curator delete indices --time-unit days --timestring '%Y.%m.%d' --older-than 270 but the command doesn't wokr and even the logrot… --- ## [How can I easily implement pseudo-relevance feedback in a full-text search application?](https://discuss.elastic.co/t/how-can-i-easily-implement-pseudo-relevance-feedback-in-a-full-text-search-application/261564)
**Author:** [@Soumya\_Ranjan\_Sahoo](https://discuss.elastic.co/u/Soumya_Ranjan_Sahoo)\ **Replies:** 0\ **Last updated:** [January 19, 2021, 3:01pm UTC](https://discuss.elastic.co/t/how-can-i-easily-implement-pseudo-relevance-feedback-in-a-full-text-search-application/261564 "2021-01-19T15:01:33Z")
Hi, I want to implement pseudo-relevance feedback, together with a bm25 ranking function, for a full-text search application. Is there any reference that I can look up for implementing this? I have just one field in my … --- ## [Conflicting data between Index Dashboard and ML anomaly detection job](https://discuss.elastic.co/t/conflicting-data-between-index-dashboard-and-ml-anomaly-detection-job/261282)
**Author:** [@emad101](https://discuss.elastic.co/u/emad101)\ **Replies:** 6\ **Last updated:** [January 19, 2021, 2:45pm UTC](https://discuss.elastic.co/t/conflicting-data-between-index-dashboard-and-ml-anomaly-detection-job/261282 "2021-01-19T14:45:06Z")
Hello All, I am trying to create a watcher to detect a high volume of error records. When I check through the index it shows that there are no Data for Dec 20th and Jan 10th, however, the watcher detected that there are… --- ## [Logstash fails to start](https://discuss.elastic.co/t/logstash-fails-to-start/261558)
**Author:** [@karthik\_s2](https://discuss.elastic.co/u/karthik_s2)\ **Replies:** 0\ **Last updated:** [January 19, 2021, 2:32pm UTC](https://discuss.elastic.co/t/logstash-fails-to-start/261558 "2021-01-19T14:32:34Z")
When i tired to start with the command (logstash.bat -f logstash.conf) in the prompt. The below output is written and logstash doesn't start. Using JAVA\_HOME defined java: C:\\Program Files\\Java\\jdk1.8.0\_221; WARNING, … --- ## [Redundancy in logstash for syslog devices](https://discuss.elastic.co/t/redundancy-in-logstash-for-syslog-devices/261557)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 0\ **Last updated:** [January 19, 2021, 2:32pm UTC](https://discuss.elastic.co/t/redundancy-in-logstash-for-syslog-devices/261557 "2021-01-19T14:32:10Z")
We are in process of upgrading our ELK stack to 7.6 and i need suggestions on configuration for network devices ( Big IP LTM ) for example. The current config has one logstash IP as syslog server , in an event of failur… --- ## [Kibana Alerts issue](https://discuss.elastic.co/t/kibana-alerts-issue/261375)
**Author:** [@Sarmad](https://discuss.elastic.co/u/Sarmad)\ **Replies:** 3\ **Last updated:** [January 19, 2021, 2:25pm UTC](https://discuss.elastic.co/t/kibana-alerts-issue/261375 "2021-01-19T14:25:38Z")
Hi, I am trying to setup built-in kibana alerts (Stack management -\> Alerts) and have followed the same steps as mentioned in the documentation, but the kibana service doesn't run again when I reload it. Here are the k… --- ## [Custom Plugin in restricted network](https://discuss.elastic.co/t/custom-plugin-in-restricted-network/261556)
**Author:** [@mastersmit](https://discuss.elastic.co/u/mastersmit)\ **Replies:** 0\ **Last updated:** [January 19, 2021, 2:17pm UTC](https://discuss.elastic.co/t/custom-plugin-in-restricted-network/261556 "2021-01-19T14:17:52Z")
I was trying to write a custom plugin, however when i am trying to build bundle install it is saying unable to connect to online ruby gems. Is there a way to avoid going to the official source of ruby gems, as downloadi… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1595) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1597)