# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1779 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1780 --- ## [Date freeze in index after rollover (only in windows) logstah 7.9.2](https://discuss.elastic.co/t/date-freeze-in-index-after-rollover-only-in-windows-logstah-7-9-2/250300)
**Author:** [@benji\_c](https://discuss.elastic.co/u/benji_c)\ **Replies:** 3\ **Last updated:** [September 29, 2020, 5:36pm UTC](https://discuss.elastic.co/t/date-freeze-in-index-after-rollover-only-in-windows-logstah-7-9-2/250300 "2020-09-29T17:36:17Z")
Hi! After a few hours reviewing configurations and creating and deleting index and creating ILM noticed an issue with the logstash 7.9.2 windows version, that freezes date fields in new index when doing rollover. Let … --- ## [Multiline Codec Pattern Match if String Exists](https://discuss.elastic.co/t/multiline-codec-pattern-match-if-string-exists/250225)
**Author:** [@NomadicCodeGuy](https://discuss.elastic.co/u/NomadicCodeGuy)\ **Replies:** 1\ **Last updated:** [September 29, 2020, 4:49pm UTC](https://discuss.elastic.co/t/multiline-codec-pattern-match-if-string-exists/250225 "2020-09-29T16:49:23Z")
Is it possible to configure the multiline codec to match a pattern if a message contains a certain string? If yes, what would this pattern look like? For example, if a message contains the string "Finished scenario" I wo… --- ## [Heartbeat Auto-discovery not working for AWS ELB](https://discuss.elastic.co/t/heartbeat-auto-discovery-not-working-for-aws-elb/250302)
**Author:** [@Ayush\_Agrahari](https://discuss.elastic.co/u/Ayush_Agrahari)\ **Replies:** 1\ **Last updated:** [September 29, 2020, 4:13pm UTC](https://discuss.elastic.co/t/heartbeat-auto-discovery-not-working-for-aws-elb/250302 "2020-09-29T16:13:20Z")
We are trying setup for AWS ELB Heartbeats. We got way to do in document https://www.elastic.co/guide/en/beats/heartbeat/current/configuration-autodiscover.html but when we tried the same then not getting any beats from … --- ## [Creating ES Node Certs Without CA Key?](https://discuss.elastic.co/t/creating-es-node-certs-without-ca-key/250065)
**Author:** [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\ **Replies:** 1\ **Last updated:** [September 29, 2020, 4:07pm UTC](https://discuss.elastic.co/t/creating-es-node-certs-without-ca-key/250065 "2020-09-29T16:07:56Z")
Hello, I was wondering if it was possible to create ES node certs using an existing CA without a CA key? The only thing I have found in the documentation is that you can only create ES node certs with existing CA if it … --- ## [Adding warm node to existing cluster, how to avoid existing indices to spread to these nodes](https://discuss.elastic.co/t/adding-warm-node-to-existing-cluster-how-to-avoid-existing-indices-to-spread-to-these-nodes/250239)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 5\ **Last updated:** [September 29, 2020, 4:05pm UTC](https://discuss.elastic.co/t/adding-warm-node-to-existing-cluster-how-to-avoid-existing-indices-to-spread-to-these-nodes/250239 "2020-09-29T16:05:16Z")
I plan to add 3 warm nodes into my cluster. (version 7.9 and 15 hot nodes) I modified elasticsearch.yml with these new lines: node.attr.data: hot # on existing nodes node.attr.data: warm # on new nodes when I s… --- ## [Mapping elasticsearch](https://discuss.elastic.co/t/mapping-elasticsearch/250392)
**Author:** [@Bengagi\_Foued](https://discuss.elastic.co/u/Bengagi_Foued)\ **Replies:** 1\ **Last updated:** [September 29, 2020, 3:48pm UTC](https://discuss.elastic.co/t/mapping-elasticsearch/250392 "2020-09-29T15:48:42Z")
hello is there a way to make elasticsearch store a field (which is not declared in the mapping) by default with type keyword instead of text ? --- ## [Is there a way to validate or dry run the index templates config before applying?](https://discuss.elastic.co/t/is-there-a-way-to-validate-or-dry-run-the-index-templates-config-before-applying/250244)
**Author:** [@ShenWan](https://discuss.elastic.co/u/ShenWan)\ **Replies:** 2\ **Last updated:** [September 29, 2020, 3:07pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-validate-or-dry-run-the-index-templates-config-before-applying/250244 "2020-09-29T15:07:58Z")
We plan to store index templates in Phabricator and would like to validate a diff before landing it and HTTP PUT to ES. --- ## [Multiline filter failure](https://discuss.elastic.co/t/multiline-filter-failure/250354)
**Author:** [@vikramaddagulla](https://discuss.elastic.co/u/vikramaddagulla)\ **Replies:** 2\ **Last updated:** [September 29, 2020, 3:01pm UTC](https://discuss.elastic.co/t/multiline-filter-failure/250354 "2020-09-29T15:01:36Z")
Hello, I am trying to parse a log file in multiline format and each new linestarts with the date : 28-Sep-2020 18:26:19.982 I tried to configure the config as below : filebeat.inputs: - type: log tags: \["PROD\_CATAL… --- ## [Elastic Agent and Ingest Manager Roadmap](https://discuss.elastic.co/t/elastic-agent-and-ingest-manager-roadmap/250292)
**Author:** [@RichardH](https://discuss.elastic.co/u/RichardH)\ **Replies:** 2\ **Last updated:** [September 29, 2020, 2:32pm UTC](https://discuss.elastic.co/t/elastic-agent-and-ingest-manager-roadmap/250292 "2020-09-29T14:32:52Z")
Hi All, I'm very excited about the new Elastic agent and Ingest Manager. How would I go about finding out roadmap information such as when they are expected to go GA? when is the functionality from other beats (e.g. Hea… --- ## [Datetime format](https://discuss.elastic.co/t/datetime-format/250360)
**Author:** [@RPL\_Developer](https://discuss.elastic.co/u/RPL_Developer)\ **Replies:** 1\ **Last updated:** [September 29, 2020, 2:12pm UTC](https://discuss.elastic.co/t/datetime-format/250360 "2020-09-29T14:12:08Z")
I am using MariaDB database there I have enter simple date without any timestamp but when data is going to Elasticsearch there is some timestamp along with the date. Please someone help me out in this --- ## [Kibana maps Sum Aggregation returns 0](https://discuss.elastic.co/t/kibana-maps-sum-aggregation-returns-0/250367)
**Author:** [@haythem](https://discuss.elastic.co/u/haythem)\ **Replies:** 0\ **Last updated:** [September 29, 2020, 1:48pm UTC](https://discuss.elastic.co/t/kibana-maps-sum-aggregation-returns-0/250367 "2020-09-29T13:48:18Z")
Hi guys , i'm having a problem with sum aggregation on maps , so when i change the time filter to last 100 days it gives me the exact result but any lesser than that the result would be 0 , though i have data on document… --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/250212)
**Author:** [@Israel\_Braga](https://discuss.elastic.co/u/Israel_Braga)\ **Replies:** 6\ **Last updated:** [September 29, 2020, 1:47pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/250212 "2020-09-29T13:47:21Z")
After upgrade elk to 7.9.2: root@log:/# systemctl status kibana ● kibana.service - Kibana Loaded: loaded (/etc/systemd/system/kibana.service; enabled; vendor preset: enabled) Active: active (running) since Mon 2020-0… --- ## [Rolling upgrade from ES 6.8 to ES 7.9](https://discuss.elastic.co/t/rolling-upgrade-from-es-6-8-to-es-7-9/250344)
**Author:** [@amishar](https://discuss.elastic.co/u/amishar)\ **Replies:** 3\ **Last updated:** [September 29, 2020, 1:03pm UTC](https://discuss.elastic.co/t/rolling-upgrade-from-es-6-8-to-es-7-9/250344 "2020-09-29T13:03:13Z")
While performing rolling upgrade from 6.8 to 7.9, the documentation suggest that cluster continue to operate in backward compatibility mode until all nodes are upgraded to newer version. How do we avoid issues with newer… --- ## [Azure Module Metricbeat](https://discuss.elastic.co/t/azure-module-metricbeat/249125)
**Author:** [@wadhah](https://discuss.elastic.co/u/wadhah)\ **Replies:** 7\ **Last updated:** [September 29, 2020, 12:27pm UTC](https://discuss.elastic.co/t/azure-module-metricbeat/249125 "2020-09-29T12:27:21Z")
Hello, I hope you are doing well! I have ELK stack 7.9 running in an AKS alongside metricbeat (which is running as a daemonset). Among the modules configured for metricbeat, I have the azure module which is configured… --- ## [Kibana alerting - how to access log messages](https://discuss.elastic.co/t/kibana-alerting-how-to-access-log-messages/249709)
**Author:** [@carl0s](https://discuss.elastic.co/u/carl0s)\ **Replies:** 4\ **Last updated:** [September 29, 2020, 12:09pm UTC](https://discuss.elastic.co/t/kibana-alerting-how-to-access-log-messages/249709 "2020-09-29T12:09:35Z")
I've set up a Log Threshold alert to match on errors in the message and I'd like to send the matching logs in the webhook action I've created. It doesn't seem like there's a way to get these yet? --- ## [Reducing Index Footprint](https://discuss.elastic.co/t/reducing-index-footprint/250318)
**Author:** [@shmoolik](https://discuss.elastic.co/u/shmoolik)\ **Replies:** 6\ **Last updated:** [September 29, 2020, 11:57am UTC](https://discuss.elastic.co/t/reducing-index-footprint/250318 "2020-09-29T11:57:04Z")
Hi there! My team is looking for ways to optimize large elasticsearch indices by reducing the index footprint. I read this article about Dynamic Mapping and was wondering if it can be used in order to reduce index foot… --- ## [Logstash output not working and not throwing an error](https://discuss.elastic.co/t/logstash-output-not-working-and-not-throwing-an-error/250259)
**Author:** [@frankfoti](https://discuss.elastic.co/u/frankfoti)\ **Replies:** 2\ **Last updated:** [September 29, 2020, 11:50am UTC](https://discuss.elastic.co/t/logstash-output-not-working-and-not-throwing-an-error/250259 "2020-09-29T11:50:48Z")
I have winlogbeat and audit beat working fine for logstash output. I cannot get logstash output from packetbeat (7.9.2 and 7.6.1) and no errors show up in the log. Totally stuck on this and is is a simple config. An… --- ## [Geo-point fields in nested mappings not accessible in Maps](https://discuss.elastic.co/t/geo-point-fields-in-nested-mappings-not-accessible-in-maps/249151)
**Author:** [@bgiordano](https://discuss.elastic.co/u/bgiordano)\ **Replies:** 5\ **Last updated:** [September 29, 2020, 11:32am UTC](https://discuss.elastic.co/t/geo-point-fields-in-nested-mappings-not-accessible-in-maps/249151 "2020-09-29T11:32:33Z")
My index has a nested definition that includes a property of type geo-point. I can see it in Discover but it is not accessible from Documents layer in Maps. Is this the expected behavior or does my mapping need to change… --- ## [Bucket sort aggregation with actual documents](https://discuss.elastic.co/t/bucket-sort-aggregation-with-actual-documents/249751)
**Author:** [@het](https://discuss.elastic.co/u/het)\ **Replies:** 2\ **Last updated:** [September 29, 2020, 11:27am UTC](https://discuss.elastic.co/t/bucket-sort-aggregation-with-actual-documents/249751 "2020-09-29T11:27:54Z")
Hi team, I wanted to get aggegatated data with pagination. So I have tried to use Bucket-Sort. I have referred this URL. Now, I am able to get aggegatated data, but the problem is, I am able to get the only the key… --- ## [Script score query with field value factor from an array of objects](https://discuss.elastic.co/t/script-score-query-with-field-value-factor-from-an-array-of-objects/250334)
**Author:** [@draganmilchevski](https://discuss.elastic.co/u/draganmilchevski)\ **Replies:** 0\ **Last updated:** [September 29, 2020, 10:22am UTC](https://discuss.elastic.co/t/script-score-query-with-field-value-factor-from-an-array-of-objects/250334 "2020-09-29T10:22:33Z")
Hi, I am trying to score the returned documents of a term query based on a score from the term object that was hit. Let me explain with examples. Suppose this is my index mapping: "documents" : { "mappings" : { … --- ## [Kubernetes logs split in kibana](https://discuss.elastic.co/t/kubernetes-logs-split-in-kibana/250339)
**Author:** [@Snir\_ben\_yosf](https://discuss.elastic.co/u/Snir_ben_yosf)\ **Replies:** 0\ **Last updated:** [September 29, 2020, 10:34am UTC](https://discuss.elastic.co/t/kubernetes-logs-split-in-kibana/250339 "2020-09-29T10:34:35Z")
I have Kubernetes system in Azure/eks/gcp and used the following instrustions to install fluent, elasticsearch and kibana: https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/fluentd-elasticsearch I am ab… --- ## [How to build a terms agg with a high cardinate filed and a low cardinate field](https://discuss.elastic.co/t/how-to-build-a-terms-agg-with-a-high-cardinate-filed-and-a-low-cardinate-field/250305)
**Author:** [@zjd-melo](https://discuss.elastic.co/u/zjd-melo)\ **Replies:** 3\ **Last updated:** [September 29, 2020, 10:05am UTC](https://discuss.elastic.co/t/how-to-build-a-terms-agg-with-a-high-cardinate-filed-and-a-low-cardinate-field/250305 "2020-09-29T10:05:30Z")
Hello, there are two fields in my docs, cid and os. Cid is a high cardinate field, while os either android or ios. I want to know the difference between the following aggs, which is better. GET \_search { "size": 0,… --- ## [Painless script, get error dynamic method \[java.lang.Long, getMillis/0\] not found](https://discuss.elastic.co/t/painless-script-get-error-dynamic-method-java-lang-long-getmillis-0-not-found/250240)
**Author:** [@perezbrandon](https://discuss.elastic.co/u/perezbrandon)\ **Replies:** 1\ **Last updated:** [September 29, 2020, 9:55am UTC](https://discuss.elastic.co/t/painless-script-get-error-dynamic-method-java-lang-long-getmillis-0-not-found/250240 "2020-09-29T09:55:00Z")
So when i run this script, doc\['date\_updated'\].value.getMillis() \> params.one\_day ? 1.9 i get the error dynamic method \[java.lang.Long, getMillis/0\] not found Im not sure what this error means or if im missing somethi… --- ## [Stuck in loading Kibana...!](https://discuss.elastic.co/t/stuck-in-loading-kibana/247875)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 15\ **Last updated:** [September 29, 2020, 9:51am UTC](https://discuss.elastic.co/t/stuck-in-loading-kibana/247875 "2020-09-29T09:51:59Z")
Hello When I start the Kibana service (bin/kibana) it stuck somewhere which the last line is: \[warning\]\[plugins\]\[reporting\] Enabling the Chromium sandbox provides an additional layer of protection. And also I can\`t ac… --- ## [Remote Cluster Index handling](https://discuss.elastic.co/t/remote-cluster-index-handling/250323)
**Author:** [@Amrita\_Mahule](https://discuss.elastic.co/u/Amrita_Mahule)\ **Replies:** 1\ **Last updated:** [September 29, 2020, 9:47am UTC](https://discuss.elastic.co/t/remote-cluster-index-handling/250323 "2020-09-29T09:47:55Z")
Hi Team, We have created a new remote cluster(in addition to one existing cluster) and a new index in it. We are trying to create an alias of that newly created index but getting index not found error(We are able to se… --- ## [Readiness probe failed & Liveness probe failed for elastic search](https://discuss.elastic.co/t/readiness-probe-failed-liveness-probe-failed-for-elastic-search/250330)
**Author:** [@tushar1701](https://discuss.elastic.co/u/tushar1701)\ **Replies:** 0\ **Last updated:** [September 29, 2020, 9:45am UTC](https://discuss.elastic.co/t/readiness-probe-failed-liveness-probe-failed-for-elastic-search/250330 "2020-09-29T09:45:53Z")
Readiness probe failed: Waiting for elasticsearch cluster to become ready (request params: "wait\_for\_status=green&timeout=1s" ) Cluster is not yet ready (request params: "wait\_for\_status=green&timeout=1s" ) Warning Un… --- ## [Conditional grok parsing using elasticsearch processor pipeline](https://discuss.elastic.co/t/conditional-grok-parsing-using-elasticsearch-processor-pipeline/249977)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 3\ **Last updated:** [September 29, 2020, 9:44am UTC](https://discuss.elastic.co/t/conditional-grok-parsing-using-elasticsearch-processor-pipeline/249977 "2020-09-29T09:44:26Z")
We use the default apache error elasticsearch pipeline but, we have the requirement that needs a further parsing. We need an additional grok parsing for message field. How to perform grok parsing when field event\_type i… --- ## [ILM Policy - Help!\>!\>!\>](https://discuss.elastic.co/t/ilm-policy-help/250217)
**Author:** [@Gary\_Wilson1](https://discuss.elastic.co/u/Gary_Wilson1)\ **Replies:** 3\ **Last updated:** [September 29, 2020, 9:34am UTC](https://discuss.elastic.co/t/ilm-policy-help/250217 "2020-09-29T09:34:19Z")
Hello, I have set up an index called filebeat-7-7-1\*, which creates a daily index for my filebeat logs. So far so good - elastic creates a new index daily, which fills up with logs and all the other good stuff I need. H… --- ## [How to add max buckets](https://discuss.elastic.co/t/how-to-add-max-buckets/250304)
**Author:** [@jamesyone](https://discuss.elastic.co/u/jamesyone)\ **Replies:** 2\ **Last updated:** [September 29, 2020, 9:13am UTC](https://discuss.elastic.co/t/how-to-add-max-buckets/250304 "2020-09-29T09:13:23Z")
Hi- I keep getting this error- Is it possible to add the max buckets on kibana? Or do I have to add it on elasticsearch?? Request to Elasticsearch failed: {"error":{"root\_cause":\[{"type":"too\_many\_buckets\_exception","r… --- ## [ES regex match failure](https://discuss.elastic.co/t/es-regex-match-failure/250282)
**Author:** [@f4ct0r](https://discuss.elastic.co/u/f4ct0r)\ **Replies:** 1\ **Last updated:** [September 29, 2020, 9:13am UTC](https://discuss.elastic.co/t/es-regex-match-failure/250282 "2020-09-29T09:13:36Z")
Hey guys, I wanna match some data about form-data in ES like ------WebKitFormBoundary9fB75AOSG0bMs1I4\\x0D\\x0AContent-Disposition: form-data; name=\\x22upload\\x22; filename=\\x22shell.php\\x22\\x0D\\x0AContent-Type: applicat… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1778) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1780)