# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1736 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1737 --- ## [Source.ip.keyword insted of source.ip](https://discuss.elastic.co/t/source-ip-keyword-insted-of-source-ip/251803)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 3\ **Last updated:** [October 22, 2020, 2:09pm UTC](https://discuss.elastic.co/t/source-ip-keyword-insted-of-source-ip/251803 "2020-10-22T14:09:47Z")
Hello, I have recently updated my elastic stack from 7.8 to 7.9.2 I had to make something wrong because when I try to do some data visualization when I choose Field for aggregation i see source.ip.keyword instead of sou… --- ## [Canvas timefilter epoch ms compatibility](https://discuss.elastic.co/t/canvas-timefilter-epoch-ms-compatibility/252967)
**Author:** [@fredeil](https://discuss.elastic.co/u/fredeil)\ **Replies:** 1\ **Last updated:** [October 22, 2020, 2:01pm UTC](https://discuss.elastic.co/t/canvas-timefilter-epoch-ms-compatibility/252967 "2020-10-22T14:01:36Z")
Documents using linux epoch as the date format is not compatible with the time filter dropdown in Canvas Is there a workaround for this? I tried using a scripted field that converted it to a "normal" date time but scr… --- ## [No ingest node in the cluster](https://discuss.elastic.co/t/no-ingest-node-in-the-cluster/252952)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [October 22, 2020, 1:41pm UTC](https://discuss.elastic.co/t/no-ingest-node-in-the-cluster/252952 "2020-10-22T13:41:54Z")
I am using elasticsearch cluster of 6 node 3 master 2 data node 1 coordinate node.The data nodes and coordinate node throwing the exception of no ingest node in this cluster and i am using logstash for processing the dat… --- ## [Graph not comparing dates correctly but compares them correctly in Discover window](https://discuss.elastic.co/t/graph-not-comparing-dates-correctly-but-compares-them-correctly-in-discover-window/252287)
**Author:** [@mike\_sag](https://discuss.elastic.co/u/mike_sag)\ **Replies:** 2\ **Last updated:** [October 22, 2020, 1:22pm UTC](https://discuss.elastic.co/t/graph-not-comparing-dates-correctly-but-compares-them-correctly-in-discover-window/252287 "2020-10-22T13:22:05Z")
content\_metadata.tag\_keyword.keyword : "Date of Note" and Date of Note \< "2014-01-01" Date of note is a date datatype, and this query I am using above works perfectly in the Discover window, yet most of the nodes that … --- ## [Kibana shuts down in elasticsearch clustering with master not discovered exception](https://discuss.elastic.co/t/kibana-shuts-down-in-elasticsearch-clustering-with-master-not-discovered-exception/252348)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 1\ **Last updated:** [October 22, 2020, 1:19pm UTC](https://discuss.elastic.co/t/kibana-shuts-down-in-elasticsearch-clustering-with-master-not-discovered-exception/252348 "2020-10-22T13:19:01Z")
Kibana stopped with below logs. I dont see any error in OS logs {"type":"log","@timestamp":"2020-10-16T08:56:57Z","tags":\["server","uuid","uuid"\],"pid":14524,"message":"Resuming persistent Kibana instance UUID: 9087ad45… --- ## [Configure ILM in filebeat](https://discuss.elastic.co/t/configure-ilm-in-filebeat/252954)
**Author:** [@gizem](https://discuss.elastic.co/u/gizem)\ **Replies:** 7\ **Last updated:** [October 22, 2020, 1:16pm UTC](https://discuss.elastic.co/t/configure-ilm-in-filebeat/252954 "2020-10-22T13:16:19Z")
Hello, I was using 7.0.1 version of filebeat before, and my index configuration line this: setup.template.name: "index" setup.template.pattern: "index-\*" output.elasticsearch: index: "index-%{\[fields.type\]:other}-%{… --- ## [Kubernetes Metricbeat](https://discuss.elastic.co/t/kubernetes-metricbeat/252666)
**Author:** [@Anchit\_Aanand](https://discuss.elastic.co/u/Anchit_Aanand)\ **Replies:** 2\ **Last updated:** [October 22, 2020, 1:12pm UTC](https://discuss.elastic.co/t/kubernetes-metricbeat/252666 "2020-10-22T13:12:45Z")
Hi I'm getting below errors while fetching kubernetes metrices with metricbeat. Error fetching data for metricset kubernetes.pod: error doing HTTP request to fetch 'pod' Metricset data: HTTP error 403 in : 403 Forbidden … --- ## [Creating a watcher with more conditions - how to](https://discuss.elastic.co/t/creating-a-watcher-with-more-conditions-how-to/249815)
**Author:** [@mathric](https://discuss.elastic.co/u/mathric)\ **Replies:** 11\ **Last updated:** [October 22, 2020, 12:48pm UTC](https://discuss.elastic.co/t/creating-a-watcher-with-more-conditions-how-to/249815 "2020-10-22T12:48:39Z")
Hey. Imagine you have the following data set: { "\_index": "myindex", "\_type": "\_doc", "\_id": "0f3e7c49b480a4d7ea2352a424ae8550", "\_version": 1, "\_score": null, "\_source": { "Measurement.Warning": 0.2, … --- ## [How to create docs in index using API?](https://discuss.elastic.co/t/how-to-create-docs-in-index-using-api/252566)
**Author:** [@Gosforth](https://discuss.elastic.co/u/Gosforth)\ **Replies:** 3\ **Last updated:** [October 22, 2020, 12:44pm UTC](https://discuss.elastic.co/t/how-to-create-docs-in-index-using-api/252566 "2020-10-22T12:44:47Z")
What I understand \_type is not required now. So first scenario: POST host/\_bulk { "index":{ "\_index": "myindex"} } { "name":"john doe","age":25 } Does not work Scenario 2: POST host/myindex/\_bulk { "index":{ } } {… --- ## [Metricbeat 7.9.2 is shutdown silently](https://discuss.elastic.co/t/metricbeat-7-9-2-is-shutdown-silently/252945)
**Author:** [@Roy\_Zhang](https://discuss.elastic.co/u/Roy_Zhang)\ **Replies:** 2\ **Last updated:** [October 22, 2020, 12:42pm UTC](https://discuss.elastic.co/t/metricbeat-7-9-2-is-shutdown-silently/252945 "2020-10-22T12:42:27Z")
Dear Metricbeat experts, I found metricbeat 7.9.2 was shutdown sliently, I enable debug log, from log, it said service/service.go:56 Received sighup, stopping. I started metricbeat using root user, I search the histor… --- ## [Elasticsearch bulk rejection error in logstash logs](https://discuss.elastic.co/t/elasticsearch-bulk-rejection-error-in-logstash-logs/249397)
**Author:** [@Kartikey\_Bhatore](https://discuss.elastic.co/u/Kartikey_Bhatore)\ **Replies:** 5\ **Last updated:** [October 22, 2020, 11:58am UTC](https://discuss.elastic.co/t/elasticsearch-bulk-rejection-error-in-logstash-logs/249397 "2020-10-22T11:58:43Z")
Hello, I am using ELK stack v6.5.3. I have a 7 node cluster (5 datanodes \[elasticsearch + logstash \] and 2 coordinator nodes \[elasticsearch + kibana\]) from past some days I am getting below error on one of my logst… --- ## [Fields Coming as unknown in Index](https://discuss.elastic.co/t/fields-coming-as-unknown-in-index/252996)
**Author:** [@Ayush\_Agrahari](https://discuss.elastic.co/u/Ayush_Agrahari)\ **Replies:** 0\ **Last updated:** [October 22, 2020, 11:57am UTC](https://discuss.elastic.co/t/fields-coming-as-unknown-in-index/252996 "2020-10-22T11:57:11Z")
I am getting unknown fields in .monitoring-es-\* Index. I recently enabled stack monitoring in ELK Stack then I am getting data in .monitoring-\* Indices. I wanted to create alerts based on this data but I am unable to us… --- ## [Restore an Elasticsearch 6.2 to Elasticsearch 7.7?](https://discuss.elastic.co/t/restore-an-elasticsearch-6-2-to-elasticsearch-7-7/252995)
**Author:** [@tonibirrer](https://discuss.elastic.co/u/tonibirrer)\ **Replies:** 0\ **Last updated:** [October 22, 2020, 11:55am UTC](https://discuss.elastic.co/t/restore-an-elasticsearch-6-2-to-elasticsearch-7-7/252995 "2020-10-22T11:55:21Z")
Hi, Based on the reference documentation it should be possible to restore a snapshot taken on Elastic 6.x on a 7.x cluster: https://www.elastic.co/guide/en/elasticsearch/reference/current/snapshot-restore.html I've tri… --- ## [Ingest pipeline multiplies processed documents (resulting in three copies)](https://discuss.elastic.co/t/ingest-pipeline-multiplies-processed-documents-resulting-in-three-copies/252002)
**Author:** [@Christos\_Gitsis](https://discuss.elastic.co/u/Christos_Gitsis)\ **Replies:** 4\ **Last updated:** [October 22, 2020, 11:49am UTC](https://discuss.elastic.co/t/ingest-pipeline-multiplies-processed-documents-resulting-in-three-copies/252002 "2020-10-22T11:49:44Z")
I use an ingest pipeline with a grok processor to add some extra fields to my documents. I have noticed however, that when the pipeline is active, in the end there are three copies of the document in ElastcSearch, all i… --- ## [How to update type of existing field to geo\_point?](https://discuss.elastic.co/t/how-to-update-type-of-existing-field-to-geo-point/252988)
**Author:** [@dattack13](https://discuss.elastic.co/u/dattack13)\ **Replies:** 1\ **Last updated:** [October 22, 2020, 11:46am UTC](https://discuss.elastic.co/t/how-to-update-type-of-existing-field-to-geo-point/252988 "2020-10-22T11:46:12Z")
Hi I have an existing index which has location inside the property address which is like below - "location" : { "properties" : { "lat" : { "type" : "float" … --- ## [Visual Builder - Value for template that matches auto-scaled interval](https://discuss.elastic.co/t/visual-builder-value-for-template-that-matches-auto-scaled-interval/252793)
**Author:** [@Marcus\_Webb](https://discuss.elastic.co/u/Marcus_Webb)\ **Replies:** 1\ **Last updated:** [October 22, 2020, 11:37am UTC](https://discuss.elastic.co/t/visual-builder-value-for-template-that-matches-auto-scaled-interval/252793 "2020-10-22T11:37:44Z")
Hi There Hoping someone can help - in Visual Builder there's a Template field to allow you to change or manipulate the values in the Legend on the graph. I'd like to be able to put an auto-scaling value in there which i… --- ## [Can't connect to AWS Elasticsearch from EC2](https://discuss.elastic.co/t/cant-connect-to-aws-elasticsearch-from-ec2/252859)
**Author:** [@CatalinM](https://discuss.elastic.co/u/CatalinM)\ **Replies:** 1\ **Last updated:** [October 22, 2020, 11:17am UTC](https://discuss.elastic.co/t/cant-connect-to-aws-elasticsearch-from-ec2/252859 "2020-10-22T11:17:35Z")
I've did a lot of digging and I learned that I need to use an OSS version of Heartbeat to achieve this. As such, I removed the version I had initially and installed an OSS version (initially 7.9.2, but also tried 7.7.0). … --- ## [Sending logs from Syslog-ng to Logstash with and without TLS](https://discuss.elastic.co/t/sending-logs-from-syslog-ng-to-logstash-with-and-without-tls/252939)
**Author:** [@Vishnuprasad](https://discuss.elastic.co/u/Vishnuprasad)\ **Replies:** 0\ **Last updated:** [October 22, 2020, 6:25am UTC](https://discuss.elastic.co/t/sending-logs-from-syslog-ng-to-logstash-with-and-without-tls/252939 "2020-10-22T06:25:10Z")
Hello Explorers :slightly\_smiling\_face: Hope I could help you if you are looking to set up a Syslog-ng Logstash configuration to transfer logs from a Client server to Master server. Advantage of this setup: If you ha… --- ## [Add Value to New Field](https://discuss.elastic.co/t/add-value-to-new-field/252985)
**Author:** [@achmad0126](https://discuss.elastic.co/u/achmad0126)\ **Replies:** 0\ **Last updated:** [October 22, 2020, 10:39am UTC](https://discuss.elastic.co/t/add-value-to-new-field/252985 "2020-10-22T10:39:13Z")
i have value from filed name like this. how to make the value become new field? --- ## [Find and replace to a unicode string](https://discuss.elastic.co/t/find-and-replace-to-a-unicode-string/252226)
**Author:** [@Andrew\_Harris](https://discuss.elastic.co/u/Andrew_Harris)\ **Replies:** 2\ **Last updated:** [October 22, 2020, 10:36am UTC](https://discuss.elastic.co/t/find-and-replace-to-a-unicode-string/252226 "2020-10-22T10:36:41Z")
Hi, I am trying to do a find and replace using mutate to replace | (vertical bar) with Unicode u0001 (start of header) anywhere in the source message before being further parsed. I have tried various combinations of fo… --- ## [Disabling Elastic User access in Kibana Dashboard](https://discuss.elastic.co/t/disabling-elastic-user-access-in-kibana-dashboard/252940)
**Author:** [@vijazy](https://discuss.elastic.co/u/vijazy)\ **Replies:** 4\ **Last updated:** [October 22, 2020, 10:22am UTC](https://discuss.elastic.co/t/disabling-elastic-user-access-in-kibana-dashboard/252940 "2020-10-22T10:22:30Z")
HI Elastic Team, I am trying to setup Elastic search log management...I have enabled Xpack for kibana Dashboard authentication and created some users with superuser access.. Now I would like to disable elastic user logi… --- ## [Email ElastAlert Not triggering on Average Aggregation query](https://discuss.elastic.co/t/email-elastalert-not-triggering-on-average-aggregation-query/252948)
**Author:** [@Chennai\_Cheetah](https://discuss.elastic.co/u/Chennai_Cheetah)\ **Replies:** 2\ **Last updated:** [October 22, 2020, 10:20am UTC](https://discuss.elastic.co/t/email-elastalert-not-triggering-on-average-aggregation-query/252948 "2020-10-22T10:20:41Z")
Mail is not triggering for my elast alert aggregator rule. I have a Elastic DSL Query which returns me an average Response time for the API for the last 15 mins. My objective is to fire email if the API average respons… --- ## [Is -Dmapper.allow\_dots\_in\_name=true setting allowed in 7.X version of ES?](https://discuss.elastic.co/t/is-dmapper-allow-dots-in-name-true-setting-allowed-in-7-x-version-of-es/252982)
**Author:** [@Saravana37](https://discuss.elastic.co/u/Saravana37)\ **Replies:** 0\ **Last updated:** [October 22, 2020, 10:17am UTC](https://discuss.elastic.co/t/is-dmapper-allow-dots-in-name-true-setting-allowed-in-7-x-version-of-es/252982 "2020-10-22T10:17:14Z")
Hello All , Is -Dmapper.allow\_dots\_in\_name=true allowed in ES 7.X version ? I am looking for a reference document on this ? Thanks and Regards Saravana S --- ## [MSSQL monitoring with Metricbeat?](https://discuss.elastic.co/t/mssql-monitoring-with-metricbeat/252733)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 5\ **Last updated:** [October 22, 2020, 10:12am UTC](https://discuss.elastic.co/t/mssql-monitoring-with-metricbeat/252733 "2020-10-22T10:12:59Z")
Hi, Note: - Using ELK 7.9.2 in Debian 10 - MS SQL Server 2016 SP2 Standard in Windows Server 2012 I am trying to monitor my MS SQL Server with Elasticsearch and visualize the data in Kibana. After some research I fou… --- ## [Elasticsearch keepalive idle timer for logstash connections via http](https://discuss.elastic.co/t/elasticsearch-keepalive-idle-timer-for-logstash-connections-via-http/252981)
**Author:** [@reykime](https://discuss.elastic.co/u/reykime)\ **Replies:** 0\ **Last updated:** [October 22, 2020, 10:11am UTC](https://discuss.elastic.co/t/elasticsearch-keepalive-idle-timer-for-logstash-connections-via-http/252981 "2020-10-22T10:11:33Z")
Hey Guys I'm currently running into an issue where i see the following messages in logstash: Marking url as dead. Last error: \[LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError\] Elasticsearch Unr… --- ## [Getting doc\_count as zero while aggregation query on index created with type LocalDate in jpa](https://discuss.elastic.co/t/getting-doc-count-as-zero-while-aggregation-query-on-index-created-with-type-localdate-in-jpa/252885)
**Author:** [@daviddavid](https://discuss.elastic.co/u/daviddavid)\ **Replies:** 1\ **Last updated:** [October 22, 2020, 9:55am UTC](https://discuss.elastic.co/t/getting-doc-count-as-zero-while-aggregation-query-on-index-created-with-type-localdate-in-jpa/252885 "2020-10-22T09:55:39Z")
Getting doc\_count as zero while aggregation query on index created with type LocalDate in jpa java. Format is "yyyy-mm-dd". Whatever I try looking here and there as help , doc\_count is coming 0. Olease help Below is qu… --- ## [Wanted to combine two different result set in one query](https://discuss.elastic.co/t/wanted-to-combine-two-different-result-set-in-one-query/252962)
**Author:** [@dattack13](https://discuss.elastic.co/u/dattack13)\ **Replies:** 2\ **Last updated:** [October 22, 2020, 9:50am UTC](https://discuss.elastic.co/t/wanted-to-combine-two-different-result-set-in-one-query/252962 "2020-10-22T09:50:25Z")
Hi There, I have requirement where I need to combine two different result based on different filter criteria for example one query is filtering records based on some true & false indicator and then other query is filter… --- ## [Elasticsearch exception \[type=json\_parse\_exception, reason=Current token (VALUE\_NUMBER\_INT) not of boolean type](https://discuss.elastic.co/t/elasticsearch-exception-type-json-parse-exception-reason-current-token-value-number-int-not-of-boolean-type/252728)
**Author:** [@Giovanni\_Di\_Lembo](https://discuss.elastic.co/u/Giovanni_Di_Lembo)\ **Replies:** 6\ **Last updated:** [October 22, 2020, 9:46am UTC](https://discuss.elastic.co/t/elasticsearch-exception-type-json-parse-exception-reason-current-token-value-number-int-not-of-boolean-type/252728 "2020-10-22T09:46:36Z")
Hi all and sorry for my poor english. I'm using docker docker.elastic.co/elasticsearch/elasticsearch:6.2.1 paired with spring data elasticsearch. The issue does not involve spring for sure. When I try any kind of opera… --- ## [Execution of a watcher when another one has been executed](https://discuss.elastic.co/t/execution-of-a-watcher-when-another-one-has-been-executed/252572)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 5\ **Last updated:** [October 22, 2020, 9:42am UTC](https://discuss.elastic.co/t/execution-of-a-watcher-when-another-one-has-been-executed/252572 "2020-10-22T09:42:31Z")
hello good, I need help with the trigger of an alert, I want it to run when another alert has been executed, I do not know if you explain to me when I detect that another alert has been executed this is executed. I do no… --- ## [Using secrets in the heartbeat http monitor proxy url](https://discuss.elastic.co/t/using-secrets-in-the-heartbeat-http-monitor-proxy-url/252792)
**Author:** [@halltony](https://discuss.elastic.co/u/halltony)\ **Replies:** 2\ **Last updated:** [October 21, 2020, 1:17pm UTC](https://discuss.elastic.co/t/using-secrets-in-the-heartbeat-http-monitor-proxy-url/252792 "2020-10-21T13:17:44Z")
Our proxy server requires credentials. I don't want these in plain text in the heartbeat configuration and would there like to add them to a keystore and use syntax like: proxy\_url: "http://${USER}:${PASS}@myproxy:80" … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1735) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1737)