# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1650 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1651 --- ## [Timezone problem/question again](https://discuss.elastic.co/t/timezone-problem-question-again/258180)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 2:40pm UTC](https://discuss.elastic.co/t/timezone-problem-question-again/258180 "2020-12-10T14:40:22Z")
In past I had problem with datestamp field but resolve by using this same index read data from source -\> logstash -\> send Field1 to ELK as is and it will be converted to UTC and convert it back to local time via Kibana … --- ## [No configuration found in the configured sources](https://discuss.elastic.co/t/no-configuration-found-in-the-configured-sources/258029)
**Author:** [@djb000m](https://discuss.elastic.co/u/djb000m)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 2:28pm UTC](https://discuss.elastic.co/t/no-configuration-found-in-the-configured-sources/258029 "2020-12-10T14:28:27Z")
Hi, I am running the standard 7.10.0 Logstash docker container and I want to use it to do its thing and send data on to an ECE elastic deployment. I'm running into an odd error that I cannot find a solution for. When I… --- ## [Filebeat "Provided Grok expressions do not match field value"](https://discuss.elastic.co/t/filebeat-provided-grok-expressions-do-not-match-field-value/258288)
**Author:** [@Taufik\_Maulana](https://discuss.elastic.co/u/Taufik_Maulana)\ **Replies:** 0\ **Last updated:** [December 10, 2020, 2:24pm UTC](https://discuss.elastic.co/t/filebeat-provided-grok-expressions-do-not-match-field-value/258288 "2020-12-10T14:24:02Z")
Hello everyone, i'm having issue where Filebeat cant extract (idk if its the right word) data from apache2 log. So, i have my ES and Grafana in the same server, then Filebeat on the other server. I didn't use Logstash a… --- ## [Auditbeat: monitoring of single files fails with 'recursive: true'](https://discuss.elastic.co/t/auditbeat-monitoring-of-single-files-fails-with-recursive-true/258287)
**Author:** [@matletix](https://discuss.elastic.co/u/matletix)\ **Replies:** 0\ **Last updated:** [December 10, 2020, 2:23pm UTC](https://discuss.elastic.co/t/auditbeat-monitoring-of-single-files-fails-with-recursive-true/258287 "2020-12-10T14:23:40Z")
Let's say I want to monitor the /watch\_me.txt file with auditbeat file\_integrity module. The following configuration do work and send events on modifications of this file : - module: file\_integrity enabled: true pat… --- ## [New filebeat instance does not add docker metadata to logs in elastic](https://discuss.elastic.co/t/new-filebeat-instance-does-not-add-docker-metadata-to-logs-in-elastic/256147)
**Author:** [@LudoNew](https://discuss.elastic.co/u/LudoNew)\ **Replies:** 5\ **Last updated:** [December 10, 2020, 1:57pm UTC](https://discuss.elastic.co/t/new-filebeat-instance-does-not-add-docker-metadata-to-logs-in-elastic/256147 "2020-12-10T13:57:24Z")
Hi there elastic community! This is my first post here, I hope it is according to standards. Recently, I've stumbled into a mysterious issue whose solution I cannot find. It is about docker metadata not being added to … --- ## [Shards are UNASSIGNED state in ES 7.7 version](https://discuss.elastic.co/t/shards-are-unassigned-state-in-es-7-7-version/256808)
**Author:** [@nikhilesh](https://discuss.elastic.co/u/nikhilesh)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 12:45pm UTC](https://discuss.elastic.co/t/shards-are-unassigned-state-in-es-7-7-version/256808 "2020-12-10T12:45:55Z")
Hi Team, Frequently, i can see the some shards are unassigned state. can any please help me how to fix the issue? Thanks Nikhilesh Gade --- ## [Display multiple values as one](https://discuss.elastic.co/t/display-multiple-values-as-one/257993)
**Author:** [@Shay\_Levy](https://discuss.elastic.co/u/Shay_Levy)\ **Replies:** 4\ **Last updated:** [December 10, 2020, 12:30pm UTC](https://discuss.elastic.co/t/display-multiple-values-as-one/257993 "2020-12-10T12:30:23Z")
I'm indexing computer hardware related info, one of the fields is called Vendor. Example values of Vendor: Intel INTEL\_ HP Hewlett Packard Microsoft Microsoft Corporation And so on... I want to unify and display… --- ## [NEST Elasticsearch Query](https://discuss.elastic.co/t/nest-elasticsearch-query/258254)
**Author:** [@SergioRodenas](https://discuss.elastic.co/u/SergioRodenas)\ **Replies:** 0\ **Last updated:** [December 10, 2020, 10:52am UTC](https://discuss.elastic.co/t/nest-elasticsearch-query/258254 "2020-12-10T10:52:55Z")
Hi, I would like to replicate this query using .NET Core 3.1, Nest 7.10.0 and Elasticsearch 7.9.3 SELECT name, lat, lon, (6371 \* acos(cos(radians(41.671958)) \* cos(radians(lat)) \* cos(radians(lon) - radians(-3.685049)) … --- ## [Heartbeat not starting](https://discuss.elastic.co/t/heartbeat-not-starting/256994)
**Author:** [@PraveenKT](https://discuss.elastic.co/u/PraveenKT)\ **Replies:** 2\ **Last updated:** [December 10, 2020, 11:50am UTC](https://discuss.elastic.co/t/heartbeat-not-starting/256994 "2020-12-10T11:50:39Z")
Heartbeat not starting. Throwing below log. Please help me? Heartbeat version is 7.10 2020-11-29T07:52:16.218-0800 ERROR instance/beat.go:956 Exiting: could not create monitor: Monitor not loaded, plugin is dis… --- ## [Elasticsearch 7.9.3 - exceptions of data insertions](https://discuss.elastic.co/t/elasticsearch-7-9-3-exceptions-of-data-insertions/257052)
**Author:** [@Lior\_Yakobov](https://discuss.elastic.co/u/Lior_Yakobov)\ **Replies:** 8\ **Last updated:** [December 10, 2020, 11:22am UTC](https://discuss.elastic.co/t/elasticsearch-7-9-3-exceptions-of-data-insertions/257052 "2020-12-10T11:22:01Z")
Hello, Recently I have upgraded our cluster from 7.5.2 to 7.9.3, and I noticed that there are some exceptions which were available in the elasticsearch log before the upgrade but now are gone. Some examples: \[2020-11-… --- ## [Create visualization using response from Search API](https://discuss.elastic.co/t/create-visualization-using-response-from-search-api/258103)
**Author:** [@Kapila](https://discuss.elastic.co/u/Kapila)\ **Replies:** 6\ **Last updated:** [December 10, 2020, 11:04am UTC](https://discuss.elastic.co/t/create-visualization-using-response-from-search-api/258103 "2020-12-10T11:04:20Z")
Is it possible to create visualizations in Kibana using response received in SearchAPI in Dev Tools? --- ## [Synthetic Monitoring](https://discuss.elastic.co/t/synthetic-monitoring/257829)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 10:51am UTC](https://discuss.elastic.co/t/synthetic-monitoring/257829 "2020-12-10T10:51:53Z")
Hi, I've been trying to use elastic synthetic monitoring for testing. when i tried to validate the heartbeat.docker.yml file, it failed. The script is causing this. I wasnt able to run the docker image because yaml is… --- ## [Kibana Visualisation](https://discuss.elastic.co/t/kibana-visualisation/258251)
**Author:** [@michaelpietzsch](https://discuss.elastic.co/u/michaelpietzsch)\ **Replies:** 5\ **Last updated:** [December 10, 2020, 10:50am UTC](https://discuss.elastic.co/t/kibana-visualisation/258251 "2020-12-10T10:50:48Z")
Hi good People of the Elastic Community! I am wondering on how to create a visualisation that has exactly the same overview like the hits counter graphic in the discover section of kibana? Can anyone provide insights to… --- ## [Authentication is not working after it got enabled](https://discuss.elastic.co/t/authentication-is-not-working-after-it-got-enabled/257611)
**Author:** [@luok0](https://discuss.elastic.co/u/luok0)\ **Replies:** 7\ **Last updated:** [December 10, 2020, 9:53am UTC](https://discuss.elastic.co/t/authentication-is-not-working-after-it-got-enabled/257611 "2020-12-10T09:53:48Z")
I enabled the authentication in elasticsearch.yml as below: # http.enabled: false xpack.security.enabled: true It worked well with below: curl -u elastic:xxoo 'http://localhost:9200/?pretty' { "name" : "kkj6-5Y", … --- ## [Manage ldap users from Kibana](https://discuss.elastic.co/t/manage-ldap-users-from-kibana/256892)
**Author:** [@Brolantor](https://discuss.elastic.co/u/Brolantor)\ **Replies:** 2\ **Last updated:** [December 10, 2020, 9:07am UTC](https://discuss.elastic.co/t/manage-ldap-users-from-kibana/256892 "2020-12-10T09:07:12Z")
Hello there! Is there a way to manage ldap users from within Kibana? In our production environment we have some (many) restriction of how users are deployd on the systems. So using an ldap for user authentication where … --- ## [My packetbeat memory is growing continuously](https://discuss.elastic.co/t/my-packetbeat-memory-is-growing-continuously/258221)
**Author:** [@mysqldba](https://discuss.elastic.co/u/mysqldba)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 7:38am UTC](https://discuss.elastic.co/t/my-packetbeat-memory-is-growing-continuously/258221 "2020-12-10T07:38:57Z")
could anyone help me on this problem? thanks in advance. --- ## [Could I move legacy indexes data to data stream](https://discuss.elastic.co/t/could-i-move-legacy-indexes-data-to-data-stream/257951)
**Author:** [@zakabluk](https://discuss.elastic.co/u/zakabluk)\ **Replies:** 4\ **Last updated:** [December 10, 2020, 7:37am UTC](https://discuss.elastic.co/t/could-i-move-legacy-indexes-data-to-data-stream/257951 "2020-12-10T07:37:45Z")
I have ELK in aws elasticsearch 6.8. Now a created new ELK cluster 7.9. I want move some indexes by snapshots to cluster 7.9 . But new cluster use data stream for store indexes. How I can did it? Why? I have indexes whic… --- ## [How to set week start day in elastic Aggregation](https://discuss.elastic.co/t/how-to-set-week-start-day-in-elastic-aggregation/258226)
**Author:** [@hyonee](https://discuss.elastic.co/u/hyonee)\ **Replies:** 0\ **Last updated:** [December 10, 2020, 7:32am UTC](https://discuss.elastic.co/t/how-to-set-week-start-day-in-elastic-aggregation/258226 "2020-12-10T07:32:57Z")
I want to set Sunday as the first of the week.... request { "size":0, "query":{ "bool":{ "filter":\[ { "range":{ "@timestamp":{ … --- ## [Why tags has different behavior in version 6.8 and 7.10](https://discuss.elastic.co/t/why-tags-has-different-behavior-in-version-6-8-and-7-10/258218)
**Author:** [@AmitC](https://discuss.elastic.co/u/AmitC)\ **Replies:** 4\ **Last updated:** [December 10, 2020, 7:21am UTC](https://discuss.elastic.co/t/why-tags-has-different-behavior-in-version-6-8-and-7-10/258218 "2020-12-10T07:21:05Z")
When I inserted below json in 6.8 and 7.10 PUT zipkin-span-2020-12-11/\_doc/123 { "traceId": "6ba4cc20cc46a65b", "duration": 1665151, "remoteEndpoint": { "ipv4": "127.0.0.1",… --- ## [Sending metadata with external users (OIDC)](https://discuss.elastic.co/t/sending-metadata-with-external-users-oidc/258223)
**Author:** [@mahi2](https://discuss.elastic.co/u/mahi2)\ **Replies:** 0\ **Last updated:** [December 10, 2020, 7:04am UTC](https://discuss.elastic.co/t/sending-metadata-with-external-users-oidc/258223 "2020-12-10T07:04:50Z")
Hi, I have a scenario where the oidc users (external users) login to elastic search cloud. My question is , is there a way to add some metadata using an API along with the external user? --- ## [Slack notifications](https://discuss.elastic.co/t/slack-notifications/258104)
**Author:** [@werner.fletcher](https://discuss.elastic.co/u/werner.fletcher)\ **Replies:** 4\ **Last updated:** [December 10, 2020, 6:50am UTC](https://discuss.elastic.co/t/slack-notifications/258104 "2020-12-10T06:50:47Z")
Good day, I am trying to set up Watcher Slack notifications, but I have some questions that your documentation are not clear on. According to this article I am supposed to use the keystore tool to add the account name … --- ## [Geoip.location not Auto Generated](https://discuss.elastic.co/t/geoip-location-not-auto-generated/257935)
**Author:** [@Boris\_Joseph](https://discuss.elastic.co/u/Boris_Joseph)\ **Replies:** 5\ **Last updated:** [December 10, 2020, 6:45am UTC](https://discuss.elastic.co/t/geoip-location-not-auto-generated/257935 "2020-12-10T06:45:00Z")
hi, I am shipping & Parsing access logs for Apache webserver using beats and logstash. Added webUserID as source for GeoIP in logstash and refreshed index pattern. But geoip.location with geoPoint datatype is not show… --- ## [Fields count in elasticsearch indice](https://discuss.elastic.co/t/fields-count-in-elasticsearch-indice/258138)
**Author:** [@malcolm666](https://discuss.elastic.co/u/malcolm666)\ **Replies:** 9\ **Last updated:** [December 10, 2020, 6:42am UTC](https://discuss.elastic.co/t/fields-count-in-elasticsearch-indice/258138 "2020-12-10T06:42:52Z")
Hi. I have elasticsearch, Grafana and some beats deployed in k8s. Version is 7.6.1. There are some fields from my configuration: # env values - env: - name: cluster.name value: k8s-logs … --- ## [Is there a way to send logs from Elasticsearch to multiple Qradar IPs?](https://discuss.elastic.co/t/is-there-a-way-to-send-logs-from-elasticsearch-to-multiple-qradar-ips/258136)
**Author:** [@Pooja](https://discuss.elastic.co/u/Pooja)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 6:41am UTC](https://discuss.elastic.co/t/is-there-a-way-to-send-logs-from-elasticsearch-to-multiple-qradar-ips/258136 "2020-12-10T06:41:16Z")
Is there a way to send logs from Elasticsearch to multiple Qradar IPs? --- ## [Ignore indexes with no hits during aggregation](https://discuss.elastic.co/t/ignore-indexes-with-no-hits-during-aggregation/258191)
**Author:** [@scarletfever](https://discuss.elastic.co/u/scarletfever)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 6:27am UTC](https://discuss.elastic.co/t/ignore-indexes-with-no-hits-during-aggregation/258191 "2020-12-10T06:27:27Z")
Our ES cluster has a daily index with a field that previously was not saved with type = nested, but now is being saved with type = nested. Our search queries are against a wildcard index, not a specific index. So it's e… --- ## [Pagenation over 10,000 documents](https://discuss.elastic.co/t/pagenation-over-10-000-documents/258205)
**Author:** [@innze](https://discuss.elastic.co/u/innze)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 6:23am UTC](https://discuss.elastic.co/t/pagenation-over-10-000-documents/258205 "2020-12-10T06:23:20Z")
I'm implementing a pagenation with an ElasticSearch over 10,000 documents. It is possible to bring the search results before and after the search by after\_search. But I would like to create a function to bring from a s… --- ## [No handler for type \[flattened\] declared on field \[host\]"](https://discuss.elastic.co/t/no-handler-for-type-flattened-declared-on-field-host/258177)
**Author:** [@voipas](https://discuss.elastic.co/u/voipas)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 6:05am UTC](https://discuss.elastic.co/t/no-handler-for-type-flattened-declared-on-field-host/258177 "2020-12-10T06:05:17Z")
Hello, I'm taking some trainings on Elasticsearch, and I I receive an error if I try use flattened: ../bin/curl -XPUT "http://elastic.192.168.0.1.nip.io/demo-flattened/\_mapping" -d ' { "prope… --- ## [IOException when trying to create snapshot Unexpected end-of-input in VALUE\_STRING](https://discuss.elastic.co/t/ioexception-when-trying-to-create-snapshot-unexpected-end-of-input-in-value-string/258220)
**Author:** [@jbbasson](https://discuss.elastic.co/u/jbbasson)\ **Replies:** 0\ **Last updated:** [December 10, 2020, 5:56am UTC](https://discuss.elastic.co/t/ioexception-when-trying-to-create-snapshot-unexpected-end-of-input-in-value-string/258220 "2020-12-10T05:56:53Z")
We've a 6.8 elastisearch cluster using the gcp plugin to store snapshots running on a cron. We've been running a cron to periodically create snapshots of our elasticseearch 6.8 cluster using: http://...../\_snapshot/ind… --- ## [CircuitBreakingException\[\[parent\] Data too large on upgrading to elasticsearch 7.7 from 5.16](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large-on-upgrading-to-elasticsearch-7-7-from-5-16/258170)
**Author:** [@Rajesh99](https://discuss.elastic.co/u/Rajesh99)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 5:19am UTC](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large-on-upgrading-to-elasticsearch-7-7-from-5-16/258170 "2020-12-10T05:19:13Z")
We have a 3 node elasticsearch cluster (with 16 cores, 64GB RAM) running on 7.7.1 version. Each elasticsearch instance was given heap memory of 4.6GB. We were indexing documents using bulk API. We are encountering the fo… --- ## [Can I combine a single fields search results and get a hash?](https://discuss.elastic.co/t/can-i-combine-a-single-fields-search-results-and-get-a-hash/258212)
**Author:** [@ChristoKiwi](https://discuss.elastic.co/u/ChristoKiwi)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 5:06am UTC](https://discuss.elastic.co/t/can-i-combine-a-single-fields-search-results-and-get-a-hash/258212 "2020-12-10T05:06:59Z")
I have a large ES index (7.7) that has a couple of million rows. I want to be able to pull a days worth of data and using their UUID id values generate a hash (MD5 or SHA1 ideally). I can do this easily using SQL: SEL… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1649) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1651)