# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1662 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1663 --- ## [Can't do rolling upgrade from 7.6.2 to 7.10.0](https://discuss.elastic.co/t/cant-do-rolling-upgrade-from-7-6-2-to-7-10-0/257549)
**Author:** [@rambling](https://discuss.elastic.co/u/rambling)\ **Replies:** 2\ **Last updated:** [December 4, 2020, 7:07am UTC](https://discuss.elastic.co/t/cant-do-rolling-upgrade-from-7-6-2-to-7-10-0/257549 "2020-12-04T07:07:43Z")
Hello. I was trying to do rolling update data node from 7.6.2 to 7.10.0 on Ubuntu 18.04. I followed the instructions: but after the update Elasticsearch can't start with next outputs: Dec 03 17:15:21 test-es-data-… --- ## [No handler for type \[multi\_field\] declared on field,I am using es 7.9.1](https://discuss.elastic.co/t/no-handler-for-type-multi-field-declared-on-field-i-am-using-es-7-9-1/257570)
**Author:** [@sanyoja\_sagare](https://discuss.elastic.co/u/sanyoja_sagare)\ **Replies:** 2\ **Last updated:** [December 4, 2020, 6:19am UTC](https://discuss.elastic.co/t/no-handler-for-type-multi-field-declared-on-field-i-am-using-es-7-9-1/257570 "2020-12-04T06:19:48Z")
No handler for type \[multi\_field\] declared on the field, I am using es 7.9.1 --- ## [Expected one of \[ \\\\t\\\\r\\\\n\], \\"#\\", \\"input\\", \\"filter\\", \\"output\\" at line 1, column 1 (byte 1)](https://discuss.elastic.co/t/expected-one-of-t-r-n-input-filter-output-at-line-1-column-1-byte-1/257612)
**Author:** [@ZoolYe](https://discuss.elastic.co/u/ZoolYe)\ **Replies:** 0\ **Last updated:** [December 4, 2020, 6:09am UTC](https://discuss.elastic.co/t/expected-one-of-t-r-n-input-filter-output-at-line-1-column-1-byte-1/257612 "2020-12-04T06:09:10Z")
docker pull docker.elastic.co/logstash/logstash:7.10.0 docker run --name=logstash-7.10 -v /xxx/logstash.yml:/usr/share/logstash/config/logstash.yml -v /xxx/logstash.conf:/usr/share/logstash/pipeline/logstash.conf -d doc… --- ## [Elasticsearch Reads](https://discuss.elastic.co/t/elasticsearch-reads/257613)
**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Replies:** 0\ **Last updated:** [December 4, 2020, 6:15am UTC](https://discuss.elastic.co/t/elasticsearch-reads/257613 "2020-12-04T06:15:21Z")
Is there a setting in elasticsearch such that reads should be routed to replicas only and if replica isn't available then only it should be directed to primary? I know we have a option \_replica\_first in request body bu… --- ## [Logstash websocket input](https://discuss.elastic.co/t/logstash-websocket-input/257610)
**Author:** [@wpitt13](https://discuss.elastic.co/u/wpitt13)\ **Replies:** 0\ **Last updated:** [December 4, 2020, 5:27am UTC](https://discuss.elastic.co/t/logstash-websocket-input/257610 "2020-12-04T05:27:10Z")
Does the Logstash 'websocket' input plugin support authorization using Bearer tokens? I've tried multiple different syntaxes with no luck. --- ## [Duplicate events even after introducing fingerprint](https://discuss.elastic.co/t/duplicate-events-even-after-introducing-fingerprint/256355)
**Author:** [@Saravana37](https://discuss.elastic.co/u/Saravana37)\ **Replies:** 4\ **Last updated:** [December 4, 2020, 4:53am UTC](https://discuss.elastic.co/t/duplicate-events-even-after-introducing-fingerprint/256355 "2020-12-04T04:53:33Z")
Hello All , We have a weird issue in ELK . We have introduced fingerprint in logstash , But still we can see the duplicates in Kibana. Kindly help how can we improve this . input { beats { port =\> 5044 tags =\> \["… --- ## [Applying platinum license in Kubernetes](https://discuss.elastic.co/t/applying-platinum-license-in-kubernetes/257554)
**Author:** [@ngilmore](https://discuss.elastic.co/u/ngilmore)\ **Replies:** 1\ **Last updated:** [December 4, 2020, 4:51am UTC](https://discuss.elastic.co/t/applying-platinum-license-in-kubernetes/257554 "2020-12-04T04:51:19Z")
Hello, I am trying to apply the platinum license in code versus adding it through Kibana. How is this done? I know the standard of setting up the trial license first is - xpack.license.self\_generated.type: trial I wa… --- ## [Field not match error with default apache access logs](https://discuss.elastic.co/t/field-not-match-error-with-default-apache-access-logs/257608)
**Author:** [@ravindra2](https://discuss.elastic.co/u/ravindra2)\ **Replies:** 0\ **Last updated:** [December 4, 2020, 4:46am UTC](https://discuss.elastic.co/t/field-not-match-error-with-default-apache-access-logs/257608 "2020-12-04T04:46:14Z")
Hi, I am using file-beat default apache access pipeline. And I am facing field not match error while parsing my log events. and for same logs it is parsing correctly in kibana dev console while passing my log data wi… --- ## [Achieving resilience for logstash database pipeline](https://discuss.elastic.co/t/achieving-resilience-for-logstash-database-pipeline/257607)
**Author:** [@adityaPsl](https://discuss.elastic.co/u/adityaPsl)\ **Replies:** 0\ **Last updated:** [December 4, 2020, 4:41am UTC](https://discuss.elastic.co/t/achieving-resilience-for-logstash-database-pipeline/257607 "2020-12-04T04:41:13Z")
Hello Team, I am new to docker and just wanted to understand if i can achieve this, I have 3 node cluster and i am running logstash on one node , if that node goes down i want to start logstash on second node with last… --- ## [Accessing the logstash\_sqlite in logstash-input-mongodb plugin](https://discuss.elastic.co/t/accessing-the-logstash-sqlite-in-logstash-input-mongodb-plugin/257606)
**Author:** [@Durga\_AK](https://discuss.elastic.co/u/Durga_AK)\ **Replies:** 0\ **Last updated:** [December 4, 2020, 4:41am UTC](https://discuss.elastic.co/t/accessing-the-logstash-sqlite-in-logstash-input-mongodb-plugin/257606 "2020-12-04T04:41:06Z")
Hello, Im using the logstash-input-mongodb plugin to ingest data into Elastic Search from MongoDB, using logstash. I would like to know if the logstash\_sqlite can be accessed to know what in the latest \_id and also if t… --- ## [How to filter field with count in datatable](https://discuss.elastic.co/t/how-to-filter-field-with-count-in-datatable/257462)
**Author:** [@tungpzostar](https://discuss.elastic.co/u/tungpzostar)\ **Replies:** 2\ **Last updated:** [December 4, 2020, 4:25am UTC](https://discuss.elastic.co/t/how-to-filter-field-with-count-in-datatable/257462 "2020-12-04T04:25:47Z")
I have field state which has 2 values "BEGIN" and "END", I want to show count when state is "BEGIN" so I've tried { "query": { "match\_phrase": { "state": "BEGIN" } } } but nothing works, any idea how … --- ## [Setup SSO with Azure](https://discuss.elastic.co/t/setup-sso-with-azure/257591)
**Author:** [@Ej\_Eric\_H](https://discuss.elastic.co/u/Ej_Eric_H)\ **Replies:** 1\ **Last updated:** [December 4, 2020, 4:18am UTC](https://discuss.elastic.co/t/setup-sso-with-azure/257591 "2020-12-04T04:18:31Z")
Hello, I am trying to setup SSO on elastic cloud using the instructions below. How do i complete the "create a role Mapping" step? I am new to this program, sorry if this is basic knowledge. Is the API the only way? If… --- ## [Heartbeat-Elastic unable to get data](https://discuss.elastic.co/t/heartbeat-elastic-unable-to-get-data/256463)
**Author:** [@skyluke.1987](https://discuss.elastic.co/u/skyluke.1987)\ **Replies:** 13\ **Last updated:** [December 4, 2020, 2:22am UTC](https://discuss.elastic.co/t/heartbeat-elastic-unable-to-get-data/256463 "2020-12-04T02:22:23Z")
Hi I have upgraded my Heartbeat-elastic to 7.9.1. But later on all the data are not coming in. Below are the ELSK version I am having: Kibana - 7.7.0 Filebeat - 7.7.0 Logstash - 7.9.1 Please advise how can I debug a… --- ## [ES snapshot fails on Azure - even though repository is fine and working](https://discuss.elastic.co/t/es-snapshot-fails-on-azure-even-though-repository-is-fine-and-working/257393)
**Author:** [@spdoes](https://discuss.elastic.co/u/spdoes)\ **Replies:** 1\ **Last updated:** [December 4, 2020, 2:02am UTC](https://discuss.elastic.co/t/es-snapshot-fails-on-azure-even-though-repository-is-fine-and-working/257393 "2020-12-04T02:02:32Z")
Verification status says connected I already did clean up When I try to list the repo in DevTools (in Kibana), it gives me timeout All directories and files permission are fine (I am comparing to another worki… --- ## [Simultaneous Filebeats to handle high load](https://discuss.elastic.co/t/simultaneous-filebeats-to-handle-high-load/257498)
**Author:** [@talsh87](https://discuss.elastic.co/u/talsh87)\ **Replies:** 1\ **Last updated:** [December 4, 2020, 1:59am UTC](https://discuss.elastic.co/t/simultaneous-filebeats-to-handle-high-load/257498 "2020-12-04T01:59:10Z")
I'd like to leverage Filebeat so it'd fetch our o365\\azure\\aws logs using the various modules. I'd like to understand how would it handle with very high volumes? Any way to maintain a cluster of Filebeat clusters? Did… --- ## [Kibana Elasticsearch does not recognize repository snapshots created for retrieval](https://discuss.elastic.co/t/kibana-elasticsearch-does-not-recognize-repository-snapshots-created-for-retrieval/257518)
**Author:** [@Nacho\_Revilla](https://discuss.elastic.co/u/Nacho_Revilla)\ **Replies:** 1\ **Last updated:** [December 4, 2020, 1:53am UTC](https://discuss.elastic.co/t/kibana-elasticsearch-does-not-recognize-repository-snapshots-created-for-retrieval/257518 "2020-12-04T01:53:38Z")
Hello everybody, I have a problem when recovering a snapshot from kibana, apparently it does not recognize the repository for its recovery. somebody could help me? Thanks a lot --- ## [One ES container with n search threads is slower than two containers with n/2 search threads](https://discuss.elastic.co/t/one-es-container-with-n-search-threads-is-slower-than-two-containers-with-n-2-search-threads/256965)
**Author:** [@alexklibisz](https://discuss.elastic.co/u/alexklibisz)\ **Replies:** 18\ **Last updated:** [December 4, 2020, 12:42am UTC](https://discuss.elastic.co/t/one-es-container-with-n-search-threads-is-slower-than-two-containers-with-n-2-search-threads/256965 "2020-12-04T00:42:46Z")
I'm running a benchmark to optimize for search throughput (i.e. queries/second). The query I'm profiling is a custom query in an Elasticsearch plugin. The query is very similar to the Terms Set Query. I tried one setup … --- ## [Consolidating/aggregating ES documents on one ELK stack](https://discuss.elastic.co/t/consolidating-aggregating-es-documents-on-one-elk-stack/257428)
**Author:** [@Asher](https://discuss.elastic.co/u/Asher)\ **Replies:** 8\ **Last updated:** [December 3, 2020, 10:17pm UTC](https://discuss.elastic.co/t/consolidating-aggregating-es-documents-on-one-elk-stack/257428 "2020-12-03T22:17:09Z")
Hi all, I'm trying to solve the following problem: I have data in RDSs (Aurora MySQL), a subset of which I'm going to map to Elasticsearch using the AWS Database Migration Service. Unfortunately, we have full deployment… --- ## [How to Disable SSL Certificate Verification for Logstash-Plugin (installing plugins)](https://discuss.elastic.co/t/how-to-disable-ssl-certificate-verification-for-logstash-plugin-installing-plugins/257590)
**Author:** [@Jeremy\_A](https://discuss.elastic.co/u/Jeremy_A)\ **Replies:** 0\ **Last updated:** [December 3, 2020, 9:44pm UTC](https://discuss.elastic.co/t/how-to-disable-ssl-certificate-verification-for-logstash-plugin-installing-plugins/257590 "2020-12-03T21:44:34Z")
This is more of an information post than a question, because I noticed several unanswered questions along these lines while searching for a solution myself. The problem occurs when trying to use bin/logstash-plugin to i… --- ## [How to read logs from docker containers running in a docker swarm cluster](https://discuss.elastic.co/t/how-to-read-logs-from-docker-containers-running-in-a-docker-swarm-cluster/257564)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 2\ **Last updated:** [December 3, 2020, 9:28pm UTC](https://discuss.elastic.co/t/how-to-read-logs-from-docker-containers-running-in-a-docker-swarm-cluster/257564 "2020-12-03T21:28:33Z")
Hello, I have several java applications that are running as different services in a docker swarm cluster. I would like filebeat to be able to read the logs of the containers and I can see that it has a docker input but … --- ## [Ansible-elasticsearch es\_api\_basic\_auth\_username as 'elastic' user](https://discuss.elastic.co/t/ansible-elasticsearch-es-api-basic-auth-username-as-elastic-user/257150)
**Author:** [@tummulu](https://discuss.elastic.co/u/tummulu)\ **Replies:** 1\ **Last updated:** [December 3, 2020, 8:32pm UTC](https://discuss.elastic.co/t/ansible-elasticsearch-es-api-basic-auth-username-as-elastic-user/257150 "2020-12-03T20:32:37Z")
I am having two issues using this role with es\_api\_basic\_auth\_username as 'elastic', when I run it first time it updates the elastic user password but fails to update the reserved user passwords but Elasticsearch service… --- ## [Cisco Module/Meraki not properly parsing date on all events](https://discuss.elastic.co/t/cisco-module-meraki-not-properly-parsing-date-on-all-events/257584)
**Author:** [@justinainsworth](https://discuss.elastic.co/u/justinainsworth)\ **Replies:** 0\ **Last updated:** [December 3, 2020, 8:29pm UTC](https://discuss.elastic.co/t/cisco-module-meraki-not-properly-parsing-date-on-all-events/257584 "2020-12-03T20:29:49Z")
I've been playing around with the new Meraki fileset in the Cisco module, and have noticed that for some event types, the date is not properly parsed, and i get a @timestamp of '1970-01-01T00:00:03.000Z'. Here is a samp… --- ## [How to create bar chart with time intervals x axis in kibana?](https://discuss.elastic.co/t/how-to-create-bar-chart-with-time-intervals-x-axis-in-kibana/257359)
**Author:** [@Cristiane\_Marcarini](https://discuss.elastic.co/u/Cristiane_Marcarini)\ **Replies:** 3\ **Last updated:** [December 3, 2020, 6:15pm UTC](https://discuss.elastic.co/t/how-to-create-bar-chart-with-time-intervals-x-axis-in-kibana/257359 "2020-12-03T18:15:57Z")
how to create bar chart with time intervals x axis in kibana? Can be with JSON or grok. --- ## [Upgraded beats (7.10) still writing to old version indices](https://discuss.elastic.co/t/upgraded-beats-7-10-still-writing-to-old-version-indices/257405)
**Author:** [@rgeisman](https://discuss.elastic.co/u/rgeisman)\ **Replies:** 9\ **Last updated:** [December 3, 2020, 6:12pm UTC](https://discuss.elastic.co/t/upgraded-beats-7-10-still-writing-to-old-version-indices/257405 "2020-12-03T18:12:03Z")
Hello all. A maddening problem. We upgraded our cluster to 7.10 (ES, Logstash, Metricbeat, Auditbeat, Filebeat). Since we use Logstash I manually loaded each index template for the beats and default dashboards, then I … --- ## [Error Metricbeats in Kibana](https://discuss.elastic.co/t/error-metricbeats-in-kibana/256402)
**Author:** [@Cristiane\_Marcarini](https://discuss.elastic.co/u/Cristiane_Marcarini)\ **Replies:** 2\ **Last updated:** [December 3, 2020, 6:10pm UTC](https://discuss.elastic.co/t/error-metricbeats-in-kibana/256402 "2020-12-03T18:10:34Z")
\[exception\] Security must be explicitly enabled when using a \[basic\] license. Enable security by setting \[xpack.security.enabled\] to \[true\] in the elasticsearch.yml file and restart the node.: Check the Elasticsearch Mon… --- ## [Indexing JSON throws MapperParsingException](https://discuss.elastic.co/t/indexing-json-throws-mapperparsingexception/257563)
**Author:** [@hKerma](https://discuss.elastic.co/u/hKerma)\ **Replies:** 0\ **Last updated:** [December 3, 2020, 6:06pm UTC](https://discuss.elastic.co/t/indexing-json-throws-mapperparsingexception/257563 "2020-12-03T18:06:09Z")
Hi everyone, I created that topic, thinking I had a Logstash issue, but it seems like it's an Elasticsearch indexing issue. Let me recap : I'm trying to parse and index k8s audit logs, which are valid JSONs, with Logst… --- ## [Indexing error "Index -1 out of bounds for length 0"](https://discuss.elastic.co/t/indexing-error-index-1-out-of-bounds-for-length-0/257379)
**Author:** [@hKerma](https://discuss.elastic.co/u/hKerma)\ **Replies:** 9\ **Last updated:** [December 3, 2020, 5:51pm UTC](https://discuss.elastic.co/t/indexing-error-index-1-out-of-bounds-for-length-0/257379 "2020-12-03T17:51:55Z")
Hi everyone, I want to use ELK stack to analyze some Kubernetes audit logs. They're sent to the Logstash webhook as JSON. Here's my config file : input{ http { port =\> 8888 codec =\> "json" type =\> "json" } }… --- ## [Find the unique transactions between passed and failed logs](https://discuss.elastic.co/t/find-the-unique-transactions-between-passed-and-failed-logs/257556)
**Author:** [@kartikr9107](https://discuss.elastic.co/u/kartikr9107)\ **Replies:** 1\ **Last updated:** [December 3, 2020, 5:44pm UTC](https://discuss.elastic.co/t/find-the-unique-transactions-between-passed-and-failed-logs/257556 "2020-12-03T17:44:04Z")
I've created a visualization to show metrics like Total requests, Unique Tests(unique count of test field), Tests failed (Sum bucket with filter for failed tests unique count), Test passed(Sum bucket with filter for pass… --- ## [Upload csv file without timestamp to kibana with ML fails](https://discuss.elastic.co/t/upload-csv-file-without-timestamp-to-kibana-with-ml-fails/257376)
**Author:** [@christophe\_spielmann](https://discuss.elastic.co/u/christophe_spielmann)\ **Replies:** 1\ **Last updated:** [December 3, 2020, 5:02pm UTC](https://discuss.elastic.co/t/upload-csv-file-without-timestamp-to-kibana-with-ml-fails/257376 "2020-12-03T17:02:24Z")
Hello, in the data visualizer of the Machine learning, we used to have a feature to upload a csv. there is blog about that https://www.elastic.co/blog/importing-csv-and-log-data-into-elasticsearch-with-file-data-visual… --- ## [Add value to blank field](https://discuss.elastic.co/t/add-value-to-blank-field/257286)
**Author:** [@errupeshmca](https://discuss.elastic.co/u/errupeshmca)\ **Replies:** 6\ **Last updated:** [December 3, 2020, 4:56pm UTC](https://discuss.elastic.co/t/add-value-to-blank-field/257286 "2020-12-03T16:56:44Z")
Hi, I am running with an issue, I have a shipment date column which is having a blank value until your order is not shipped, so if the order is not shipped (you can say it's pending now) i want to add a value to that f… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1661) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1663)