# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1646 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1647 --- ## [Forming Index name for Elasticsearch plugin](https://discuss.elastic.co/t/forming-index-name-for-elasticsearch-plugin/258398)
**Author:** [@s0umen](https://discuss.elastic.co/u/s0umen)\ **Replies:** 6\ **Last updated:** [December 14, 2020, 6:18am UTC](https://discuss.elastic.co/t/forming-index-name-for-elasticsearch-plugin/258398 "2020-12-14T06:18:20Z")
I am sending Linux system logs using filebeat to logstash. my "logstash.conf" file is something like below (within double Line). I am trying to name index dynamically using "type" variable. But when I view it in Kibana… --- ## [Ingest timestamp](https://discuss.elastic.co/t/ingest-timestamp/258526)
**Author:** [@hs01](https://discuss.elastic.co/u/hs01)\ **Replies:** 1\ **Last updated:** [December 14, 2020, 6:08am UTC](https://discuss.elastic.co/t/ingest-timestamp/258526 "2020-12-14T06:08:23Z")
Is it possible for ingest timestamp (introduced via ingest pipeline) to be out of order with respect to actual index time (when a document becomes queryable) i.e., doc\_1 =\> ingest\_time\_t1 doc\_2 =\> ingest\_time\_t2 ingest… --- ## [Is it possible to build elasticsearch-range-aggretaion-of-aggregation](https://discuss.elastic.co/t/is-it-possible-to-build-elasticsearch-range-aggretaion-of-aggregation/258537)
**Author:** [@Ju\_Cheng](https://discuss.elastic.co/u/Ju_Cheng)\ **Replies:** 0\ **Last updated:** [December 14, 2020, 5:34am UTC](https://discuss.elastic.co/t/is-it-possible-to-build-elasticsearch-range-aggretaion-of-aggregation/258537 "2020-12-14T05:34:42Z")
I am new to elasticsearch and my log are about users and the conferences they participate, like {"userid": "user1", "conferencesId": "c2", "action":"blabla" ... } {"userid": "user2", "conferencesId": "c2", "action":"bla… --- ## [Change index file name from logstash command](https://discuss.elastic.co/t/change-index-file-name-from-logstash-command/258532)
**Author:** [@Aryaman\_Gupta](https://discuss.elastic.co/u/Aryaman_Gupta)\ **Replies:** 0\ **Last updated:** [December 14, 2020, 4:54am UTC](https://discuss.elastic.co/t/change-index-file-name-from-logstash-command/258532 "2020-12-14T04:54:46Z")
Is there any way to give custom name to index file in logstash config file every-time I run log-stash command? output { elasticsearch { hosts =\> \["localhost:9200"\] index =\> "global7679-%{+YYYY.MM.dd}" \<----- Need to … --- ## [Need help in writing DSL](https://discuss.elastic.co/t/need-help-in-writing-dsl/258451)
**Author:** [@Vikas\_Rathore](https://discuss.elastic.co/u/Vikas_Rathore)\ **Replies:** 1\ **Last updated:** [December 13, 2020, 1:47pm UTC](https://discuss.elastic.co/t/need-help-in-writing-dsl/258451 "2020-12-13T13:47:31Z")
I searched a lot but couldn't able to write a proper KQL. I am trying to search a string "error" in message field AND field kubernetes.pod.name must contain test-\* I tried this but it's not working { "size": 1, "qu… --- ## [How to deploy logstash with persistent volume on kubernetes?](https://discuss.elastic.co/t/how-to-deploy-logstash-with-persistent-volume-on-kubernetes/258505)
**Author:** [@iooi](https://discuss.elastic.co/u/iooi)\ **Replies:** 0\ **Last updated:** [December 13, 2020, 1:17pm UTC](https://discuss.elastic.co/t/how-to-deploy-logstash-with-persistent-volume-on-kubernetes/258505 "2020-12-13T13:17:59Z")
Using GKE to deploy logstash by statefulset kind with pvc. Also need to install an output plugin. When don't use while true; do sleep 1000; done; in container's command args, it can't deploy with pvc successfully. The … --- ## [Null and nil](https://discuss.elastic.co/t/null-and-nil/258507)
**Author:** [@rojin](https://discuss.elastic.co/u/rojin)\ **Replies:** 0\ **Last updated:** [December 13, 2020, 1:25pm UTC](https://discuss.elastic.co/t/null-and-nil/258507 "2020-12-13T13:25:44Z")
Hello everyone! I have a grok pattern which some of its fields may include "null" values. How am I supposed to show null in kibana? or logstash output? I have defined the pattern as number for those fields. input { … --- ## [Stop Words something missing](https://discuss.elastic.co/t/stop-words-something-missing/258504)
**Author:** [@ElGringo](https://discuss.elastic.co/u/ElGringo)\ **Replies:** 0\ **Last updated:** [December 13, 2020, 12:54pm UTC](https://discuss.elastic.co/t/stop-words-something-missing/258504 "2020-12-13T12:54:07Z")
Hi, I'm trying to use stop words with ELK, everything seems ok but when I'm inserting a new value the filter does not apply. Using \_analyze it works ... I think something is wrong in my mapping but I don't find what. Th… --- ## [How should I use keystore?](https://discuss.elastic.co/t/how-should-i-use-keystore/258475)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 3\ **Last updated:** [December 13, 2020, 9:32am UTC](https://discuss.elastic.co/t/how-should-i-use-keystore/258475 "2020-12-13T09:32:47Z")
Hi I am using a cluster and also using x-pack security for passwords and... I have also activate transfer layer security between Elasticsearch nodes and Kibana (HTTPS) My question is: How can I hide all of my passwor… --- ## [No data alert for special field](https://discuss.elastic.co/t/no-data-alert-for-special-field/255070)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 1\ **Last updated:** [December 13, 2020, 6:41am UTC](https://discuss.elastic.co/t/no-data-alert-for-special-field/255070 "2020-12-13T06:41:48Z")
Hi every one, I have 5 machines that send logs into test index without logstash. my test index is like : { "id" : "Machine\_1", "services\_is\_ok" : true, "delta" : 60, "time" : 16… --- ## [Logstash UDP input buffer](https://discuss.elastic.co/t/logstash-udp-input-buffer/258480)
**Author:** [@Hendrik1](https://discuss.elastic.co/u/Hendrik1)\ **Replies:** 7\ **Last updated:** [December 12, 2020, 7:29pm UTC](https://discuss.elastic.co/t/logstash-udp-input-buffer/258480 "2020-12-12T19:29:22Z")
Hi, I am using the logstash UDP input to receive my firewall syslog messages, this seems to work fine. However, I just enabled the reverse dns lookup filter on the ip's, but now I keep wondering what happens when the U… --- ## [Bug: Netflow events takes event.created from flow.timestamp](https://discuss.elastic.co/t/bug-netflow-events-takes-event-created-from-flow-timestamp/258487)
**Author:** [@shanavas786](https://discuss.elastic.co/u/shanavas786)\ **Replies:** 0\ **Last updated:** [December 12, 2020, 6:19pm UTC](https://discuss.elastic.co/t/bug-netflow-events-takes-event-created-from-flow-timestamp/258487 "2020-12-12T18:19:58Z")
As per documentation, event.created is the timestamp at which the event is read by agent/pipeline. Conversely, it is being copied from flow.Timestamp. Shouldn't it be time.Now() ? --- ## [Node joining docker](https://discuss.elastic.co/t/node-joining-docker/257742)
**Author:** [@Bonzo](https://discuss.elastic.co/u/Bonzo)\ **Replies:** 3\ **Last updated:** [December 12, 2020, 3:56pm UTC](https://discuss.elastic.co/t/node-joining-docker/257742 "2020-12-12T15:56:51Z")
Hi I have problem joining a data node to the cluster. I m using docker in 2 separate machines. Both machines can talk to each other. My first docker: -- Master docker run -d --name elastic -p 9200:9200 -p 9300:93… --- ## [Detect epoch as Date field](https://discuss.elastic.co/t/detect-epoch-as-date-field/258477)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 1\ **Last updated:** [December 12, 2020, 3:24pm UTC](https://discuss.elastic.co/t/detect-epoch-as-date-field/258477 "2020-12-12T15:24:17Z")
Hi every one, i have an index (name: x-001) with a date field: { "time": { "type": "date" } } I insert docs into index like this: time: 1607782041000 elasticsearch automatically convert epoch to dateti… --- ## [Aggregate every field](https://discuss.elastic.co/t/aggregate-every-field/258467)
**Author:** [@5minutes](https://discuss.elastic.co/u/5minutes)\ **Replies:** 0\ **Last updated:** [December 12, 2020, 6:14am UTC](https://discuss.elastic.co/t/aggregate-every-field/258467 "2020-12-12T06:14:39Z")
hi, lets consider we have 2 records: { "@timestamp": "2020-12-11T11:13:00", "time": { "a": 200, "b": 2 } } { "@timestamp": "2020-12-11T12:13:00", "time": { … --- ## [Mappings conflict after rollover](https://discuss.elastic.co/t/mappings-conflict-after-rollover/258476)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 1\ **Last updated:** [December 12, 2020, 2:43pm UTC](https://discuss.elastic.co/t/mappings-conflict-after-rollover/258476 "2020-12-12T14:43:07Z")
I have an index with name X-001 with this mapping: { "time": { "type": "date" } } after linking index to ilm, and rollover action: elastic creates index X-002 but in mapping i see this : { "time": { … --- ## [Index deleted and create weird new index](https://discuss.elastic.co/t/index-deleted-and-create-weird-new-index/258362)
**Author:** [@Junedi\_Rajagukguk](https://discuss.elastic.co/u/Junedi_Rajagukguk)\ **Replies:** 4\ **Last updated:** [December 12, 2020, 6:45am UTC](https://discuss.elastic.co/t/index-deleted-and-create-weird-new-index/258362 "2020-12-12T06:45:16Z")
hi i dont know what is hapening to my indicies, they suddenly got deleted. i lost the data, and so many weird indicies created. please help --- ## [Filebeat folder structured not correct for version 7.10](https://discuss.elastic.co/t/filebeat-folder-structured-not-correct-for-version-7-10/257927)
**Author:** [@kbirhan](https://discuss.elastic.co/u/kbirhan)\ **Replies:** 5\ **Last updated:** [December 12, 2020, 6:18am UTC](https://discuss.elastic.co/t/filebeat-folder-structured-not-correct-for-version-7-10/257927 "2020-12-12T06:18:57Z")
filebeat bin file location in the service file declared might be in the wrong location for debian platform. after moving the filebeat bin file (located in /usr/ share/filebeat/) to /usr/share/filebeat/bin/ folder everyt… --- ## [Deploy Logstash with persistent queue on Docker Swarm](https://discuss.elastic.co/t/deploy-logstash-with-persistent-queue-on-docker-swarm/258465)
**Author:** [@Hung\_Phan\_Huy](https://discuss.elastic.co/u/Hung_Phan_Huy)\ **Replies:** 0\ **Last updated:** [December 12, 2020, 4:30am UTC](https://discuss.elastic.co/t/deploy-logstash-with-persistent-queue-on-docker-swarm/258465 "2020-12-12T04:30:16Z")
Hi, I'm planning to deploy my Logstash on Docker Swarm. My concern is about the persistent queue feature. Should I use persistent queue? Some documents I read show that they might have a great impact on the performanc… --- ## [How to avoid syntax errors when writing DSL statements](https://discuss.elastic.co/t/how-to-avoid-syntax-errors-when-writing-dsl-statements/258463)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 0\ **Last updated:** [December 12, 2020, 3:46am UTC](https://discuss.elastic.co/t/how-to-avoid-syntax-errors-when-writing-dsl-statements/258463 "2020-12-12T03:46:23Z")
GET index/\_search { "query": { "range": { "@timestamp": { "gte": "now-1d/d", "lt": "now/d" } }, "query\_string": { "query": "\*" } } } { "error" : { "… --- ## [Logstash does not index event to elastic due to issue on host field](https://discuss.elastic.co/t/logstash-does-not-index-event-to-elastic-due-to-issue-on-host-field/258171)
**Author:** [@snolfi](https://discuss.elastic.co/u/snolfi)\ **Replies:** 5\ **Last updated:** [December 11, 2020, 9:46pm UTC](https://discuss.elastic.co/t/logstash-does-not-index-event-to-elastic-due-to-issue-on-host-field/258171 "2020-12-11T21:46:31Z")
Hi all, i'm having an issue with my logstash. I updated my infrastructure from elk 5.6 to elk 6.8 and now from elk 6.8 to elk 7.8. We are updating filebeats but logstash is reporting this error on metrics coming from th… --- ## [Grok Pattern against stdout](https://discuss.elastic.co/t/grok-pattern-against-stdout/258195)
**Author:** [@willis](https://discuss.elastic.co/u/willis)\ **Replies:** 4\ **Last updated:** [December 11, 2020, 9:21pm UTC](https://discuss.elastic.co/t/grok-pattern-against-stdout/258195 "2020-12-11T21:21:48Z")
I have a custom log format that is being sent to stdout. Filebeat is correctly capturing this output. I would like to apply a grok pattern against these lines and have them parsed/indexed. Is a pipeline, a processor, or … --- ## [Logstash/ Elastic index date and time match error](https://discuss.elastic.co/t/logstash-elastic-index-date-and-time-match-error/258448)
**Author:** [@Gambit22](https://discuss.elastic.co/u/Gambit22)\ **Replies:** 2\ **Last updated:** [December 11, 2020, 8:45pm UTC](https://discuss.elastic.co/t/logstash-elastic-index-date-and-time-match-error/258448 "2020-12-11T20:45:48Z")
Hello Everyone, this is my first post here so I'll try to provide good specifics. First off, I'm trying to make an ELK stack with Filebeat all hosted on the same VM. It's just a lab environment. Kibana, Elastic, Logsta… --- ## [Restore snapshot with different index name](https://discuss.elastic.co/t/restore-snapshot-with-different-index-name/258450)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 0\ **Last updated:** [December 11, 2020, 8:26pm UTC](https://discuss.elastic.co/t/restore-snapshot-with-different-index-name/258450 "2020-12-11T20:26:38Z")
I have a snapshot and name of the index is my\_index1 I did copy whole tar ball and transfer to new cluster here I put this snpshot. Now I can see that when I do GET status I am trying to restore this index here with n… --- ## [Kibana dont collect app logs after 0:00 in some days on 2 from 3 spaces](https://discuss.elastic.co/t/kibana-dont-collect-app-logs-after-0-00-in-some-days-on-2-from-3-spaces/258446)
**Author:** [@111419](https://discuss.elastic.co/u/111419)\ **Replies:** 0\ **Last updated:** [December 11, 2020, 7:29pm UTC](https://discuss.elastic.co/t/kibana-dont-collect-app-logs-after-0-00-in-some-days-on-2-from-3-spaces/258446 "2020-12-11T19:29:44Z")
I Have 3 spaces. in one i dont have app logs from 0:00 10th dec, in second from 0:00 11th dec, kibana recieved logs from filebeat only php-fpm access.log, all other web app logs in json format not recieved from 10 and 1… --- ## [How to create multiple pipelines with logstash helm chart so they have private data](https://discuss.elastic.co/t/how-to-create-multiple-pipelines-with-logstash-helm-chart-so-they-have-private-data/258444)
**Author:** [@jknott](https://discuss.elastic.co/u/jknott)\ **Replies:** 0\ **Last updated:** [December 11, 2020, 7:16pm UTC](https://discuss.elastic.co/t/how-to-create-multiple-pipelines-with-logstash-helm-chart-so-they-have-private-data/258444 "2020-12-11T19:16:38Z")
I have created a helm chart with multiple pipelines but when I add a field per pipeline for example service\_name, the service name from each pipeline gets added to the field. So instead of one field being added with one … --- ## [My ruby filter doesn't work](https://discuss.elastic.co/t/my-ruby-filter-doesnt-work/258439)
**Author:** [@olegans](https://discuss.elastic.co/u/olegans)\ **Replies:** 6\ **Last updated:** [December 11, 2020, 7:01pm UTC](https://discuss.elastic.co/t/my-ruby-filter-doesnt-work/258439 "2020-12-11T19:01:01Z")
I am trying to use a ruby ​​filter to process incoming json that I receive in the logs. At the beginning, using a grok filter, I receive json, then I try to process it in a ruby ​​filter grok { match =\> { "l… --- ## [Multi Search Elastic](https://discuss.elastic.co/t/multi-search-elastic/257196)
**Author:** [@daviddavid](https://discuss.elastic.co/u/daviddavid)\ **Replies:** 10\ **Last updated:** [December 11, 2020, 6:45pm UTC](https://discuss.elastic.co/t/multi-search-elastic/257196 "2020-12-11T18:45:29Z")
Hi, Is there any way to bring common result from two different indices with search on different fields distributed on these two indices and the fields are different and not linked to each other. --- ## [Index lifecycle error: security\_exception: action \[indices:monitor/stats\] is unauthorized for user \[template\_manager\]](https://discuss.elastic.co/t/index-lifecycle-error-security-exception-action-indices-monitor-stats-is-unauthorized-for-user-template-manager/258334)
**Author:** [@prolbrakels](https://discuss.elastic.co/u/prolbrakels)\ **Replies:** 1\ **Last updated:** [December 11, 2020, 6:06pm UTC](https://discuss.elastic.co/t/index-lifecycle-error-security-exception-action-indices-monitor-stats-is-unauthorized-for-user-template-manager/258334 "2020-12-11T18:06:07Z")
According to Kibana, the wait-for-shard-history-leases step failed when trying to delete an index due to ILM policy. The template\_manager user/role is one I recently created for the purpose of automating updates to the t… --- ## [Running two clusters in a single node](https://discuss.elastic.co/t/running-two-clusters-in-a-single-node/258301)
**Author:** [@Ondescone](https://discuss.elastic.co/u/Ondescone)\ **Replies:** 3\ **Last updated:** [December 11, 2020, 6:05pm UTC](https://discuss.elastic.co/t/running-two-clusters-in-a-single-node/258301 "2020-12-11T18:05:36Z")
Greetings, I'm trying to set up the Cross Cluster Replication locally in a single node. I have been using one elasticsearch/kibana instance running as a service (version 7.9.3) with default settings and everything works… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1645) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1647)