# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1789 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1790 --- ## [Parsing date\_field with date plugin and set it as @timestamp](https://discuss.elastic.co/t/parsing-date-field-with-date-plugin-and-set-it-as-timestamp/249701)
**Author:** [@nino](https://discuss.elastic.co/u/nino)\ **Replies:** 2\ **Last updated:** [September 23, 2020, 8:03pm UTC](https://discuss.elastic.co/t/parsing-date-field-with-date-plugin-and-set-it-as-timestamp/249701 "2020-09-23T20:03:38Z")
Hello all, i am having problems trying to parse this date field and set as @timestamp { "field\_date" =\> "2020-09-08 0:00:00.0" } This try is not running date { timezone =\> "UCT" match =\> \["field\_date", "… --- ## [Curator filtertype:alias matching an alias from the list](https://discuss.elastic.co/t/curator-filtertype-alias-matching-an-alias-from-the-list/249694)
**Author:** [@ebru](https://discuss.elastic.co/u/ebru)\ **Replies:** 0\ **Last updated:** [September 23, 2020, 6:47pm UTC](https://discuss.elastic.co/t/curator-filtertype-alias-matching-an-alias-from-the-list/249694 "2020-09-23T18:47:35Z")
Hi all, I have a few delete indices actions as part of curator cleanup but I am having trouble with this one. action: delete\_indices description: \>- BIG INDICES - Keep at least 3 indices at all times. Exclude indic… --- ## [Event.set and nested filed](https://discuss.elastic.co/t/event-set-and-nested-filed/249684)
**Author:** [@arp220](https://discuss.elastic.co/u/arp220)\ **Replies:** 4\ **Last updated:** [September 23, 2020, 6:47pm UTC](https://discuss.elastic.co/t/event-set-and-nested-filed/249684 "2020-09-23T18:47:24Z")
Hi. I have this config: input { file { path =\> "/opt/logs/sb\_log.json" sincedb\_path =\> "/etc/logstash/.sincedb\_sblog" start\_position =\> "beginning" } } filter{ json { source =\> "message" … --- ## [Transforms - How to check next run time](https://discuss.elastic.co/t/transforms-how-to-check-next-run-time/249150)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 20\ **Last updated:** [September 23, 2020, 6:34pm UTC](https://discuss.elastic.co/t/transforms-how-to-check-next-run-time/249150 "2020-09-23T18:34:56Z")
Hi, I created a continuous Transforms to run once a day and calculate the P95 of some fields for the previous 24hrs. When I initially created and started this Transform it created the daily P95 values from all the previo… --- ## [Best logstash plugin or advice to ingest this csv file on elasticsearch](https://discuss.elastic.co/t/best-logstash-plugin-or-advice-to-ingest-this-csv-file-on-elasticsearch/249686)
**Author:** [@nino](https://discuss.elastic.co/u/nino)\ **Replies:** 2\ **Last updated:** [September 23, 2020, 6:12pm UTC](https://discuss.elastic.co/t/best-logstash-plugin-or-advice-to-ingest-this-csv-file-on-elasticsearch/249686 "2020-09-23T18:12:05Z")
Hello all, i have this csv file that i need to send to elastic: alwats the same csv structure field\_1,field\_2,field\_3,field\_4,field\_5,field\_6 888,0000000A,S,4,2020-09-08 00:00:00.0,name 999,0000000C,S,4,2020-09-08 00:… --- ## [Elasticsearch 7.8 worse heap management](https://discuss.elastic.co/t/elasticsearch-7-8-worse-heap-management/240996)
**Author:** [@Carlos\_Moya](https://discuss.elastic.co/u/Carlos_Moya)\ **Replies:** 39\ **Last updated:** [September 23, 2020, 5:50pm UTC](https://discuss.elastic.co/t/elasticsearch-7-8-worse-heap-management/240996 "2020-09-23T17:50:26Z")
Hello, We have an Elasticsearch cluster of 94 servers and last Wednesday we updated it from 7.6.2 to 7.8.0. On Friday one of our teams reported that a nightly process reduced its performance dramatically. We verified i… --- ## [Log message encoding of \\n for multiline output](https://discuss.elastic.co/t/log-message-encoding-of-n-for-multiline-output/249687)
**Author:** [@kbrisso](https://discuss.elastic.co/u/kbrisso)\ **Replies:** 0\ **Last updated:** [September 23, 2020, 5:35pm UTC](https://discuss.elastic.co/t/log-message-encoding-of-n-for-multiline-output/249687 "2020-09-23T17:35:21Z")
Hello All- In my messages, some of the log messages actually have \\n in the log output itself along with other random characters like XML tags. Is there a way to encode \\n in file beat before shipping to log stash so th… --- ## [Message not splitting into events on new line](https://discuss.elastic.co/t/message-not-splitting-into-events-on-new-line/249399)
**Author:** [@kbrisso](https://discuss.elastic.co/u/kbrisso)\ **Replies:** 3\ **Last updated:** [September 23, 2020, 5:24pm UTC](https://discuss.elastic.co/t/message-not-splitting-into-events-on-new-line/249399 "2020-09-23T17:24:27Z")
Hello- I have a message that looks like below: \[INFO\] 2020-09-21 09:40:21,476\[ajp-nio-9031-exec-1\] com.gts.ci.jws.filter.ValidationFilter - Validation Filter URL /jsp\_web/access/app\_logout.jsp\\n\[DEBUG\] 2020-09-21 09:4… --- ## [Is there a way to choose the other master eligible node as master automatically if the elected master node goes down (in unexpected sceanrio's)?](https://discuss.elastic.co/t/is-there-a-way-to-choose-the-other-master-eligible-node-as-master-automatically-if-the-elected-master-node-goes-down-in-unexpected-sceanrios/249607)
**Author:** [@Elango\_P](https://discuss.elastic.co/u/Elango_P)\ **Replies:** 7\ **Last updated:** [September 23, 2020, 4:17pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-choose-the-other-master-eligible-node-as-master-automatically-if-the-elected-master-node-goes-down-in-unexpected-sceanrios/249607 "2020-09-23T16:17:56Z")
Hi, We are facing some issues while upgrading ES from 5.5.2 -\> 7.8.1. We have two nodes deployment setup. ES is installed in both nodes and both are master eligible. In earlier version we used to have two master nodes… --- ## [Grok processor to parse specific fields of IIS Logs message field](https://discuss.elastic.co/t/grok-processor-to-parse-specific-fields-of-iis-logs-message-field/249346)
**Author:** [@chand](https://discuss.elastic.co/u/chand)\ **Replies:** 1\ **Last updated:** [September 23, 2020, 4:25pm UTC](https://discuss.elastic.co/t/grok-processor-to-parse-specific-fields-of-iis-logs-message-field/249346 "2020-09-23T16:25:32Z")
Hi, I've the following grok processor, which basically splits message field data into multiple fields. In my case message field data changes every time for each log entry. How would I pass the message field data dynamic… --- ## [ERROR Index management Winlogbeat 7.9.0](https://discuss.elastic.co/t/error-index-management-winlogbeat-7-9-0/249229)
**Author:** [@zombietek](https://discuss.elastic.co/u/zombietek)\ **Replies:** 9\ **Last updated:** [September 23, 2020, 4:10pm UTC](https://discuss.elastic.co/t/error-index-management-winlogbeat-7-9-0/249229 "2020-09-23T16:10:16Z")
Hi, I saw this old thread(https://discuss.elastic.co/t/error-index-management-filebeat-to-logstash/218849) though it was for filebeat and my issue is for winlogbeat, I'll give it a try. I have winlogbeat version 7.9.0 … --- ## [Is there a way to look at data for a specific time daily on a kibana time series visualization](https://discuss.elastic.co/t/is-there-a-way-to-look-at-data-for-a-specific-time-daily-on-a-kibana-time-series-visualization/249679)
**Author:** [@nishnath.nandi](https://discuss.elastic.co/u/nishnath.nandi)\ **Replies:** 1\ **Last updated:** [September 23, 2020, 4:05pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-look-at-data-for-a-specific-time-daily-on-a-kibana-time-series-visualization/249679 "2020-09-23T16:05:30Z")
Currently, I am using Kibana visualizations with a date histogram to look at data for last 2 months. But I would like to filter it further and look at only week days and for business hours (9 A.M. to 5 P.M.) --- ## [Watcher Automated Report Failing](https://discuss.elastic.co/t/watcher-automated-report-failing/249669)
**Author:** [@Fesperse](https://discuss.elastic.co/u/Fesperse)\ **Replies:** 4\ **Last updated:** [September 23, 2020, 2:50pm UTC](https://discuss.elastic.co/t/watcher-automated-report-failing/249669 "2020-09-23T14:50:48Z")
I am trying to create a watcher that generates and attaches a CSV file to an email that gets sent out twice weekly. I have previously done this with a different index and it is working for that watcher. I am getting an e… --- ## [How to access a deashboard or view from another php front end](https://discuss.elastic.co/t/how-to-access-a-deashboard-or-view-from-another-php-front-end/249557)
**Author:** [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\ **Replies:** 6\ **Last updated:** [September 23, 2020, 2:33pm UTC](https://discuss.elastic.co/t/how-to-access-a-deashboard-or-view-from-another-php-front-end/249557 "2020-09-23T14:33:39Z")
i am trying to create a php that accesses a kibana deashboard however my kibana needs a user password. what happens is that i would like to access it password need to put username and password. but before that i already … --- ## [How to get field in xml?](https://discuss.elastic.co/t/how-to-get-field-in-xml/249609)
**Author:** [@Luan\_Ph\_m](https://discuss.elastic.co/u/Luan_Ph_m)\ **Replies:** 1\ **Last updated:** [September 23, 2020, 1:57pm UTC](https://discuss.elastic.co/t/how-to-get-field-in-xml/249609 "2020-09-23T13:57:47Z")
Hi I need to get some field in my xml file but i don't know how to get it. Here my xml \ \ \ \ \1027\ \active\ \ \ **Author:** [@parosio](https://discuss.elastic.co/u/parosio)\ **Replies:** 2\ **Last updated:** [September 23, 2020, 1:06pm UTC](https://discuss.elastic.co/t/use-kibana-index-param-as-prefix-for-ancillary-kibana-indices/249639 "2020-09-23T13:06:23Z") Hello, I'm having sort of a problem with a double kibana installation on top of a single Elastic cluster (currently using 6.7 stack, basic license). The second kibana has this setting: kibana.index: ".my-second-app-kib… --- ## [Kibana 403 response for super user elastic](https://discuss.elastic.co/t/kibana-403-response-for-super-user-elastic/249154)
**Author:** [@Seenivasan\_Gopalsamy](https://discuss.elastic.co/u/Seenivasan_Gopalsamy)\ **Replies:** 1\ **Last updated:** [September 23, 2020, 1:49pm UTC](https://discuss.elastic.co/t/kibana-403-response-for-super-user-elastic/249154 "2020-09-23T13:49:15Z")
Hello Team We are getting a 403 response after adding the index patterns. We are trying to move existing licenses to new servers due to disk space issue. Elastic, kibana, x-pack 6.2.2 403 Response Less Info OK Err… --- ## [Visualizing a metric on two unique counts](https://discuss.elastic.co/t/visualizing-a-metric-on-two-unique-counts/249562)
**Author:** [@jwetzel](https://discuss.elastic.co/u/jwetzel)\ **Replies:** 2\ **Last updated:** [September 23, 2020, 1:49pm UTC](https://discuss.elastic.co/t/visualizing-a-metric-on-two-unique-counts/249562 "2020-09-23T13:49:05Z")
I am collecting custom logs from a web server. I am trying to summarize what % of unique users encounter an error. I am having trouble finding a visualization that will do a % calculation on two unique (cardinatily) valu… --- ## [Rename field - input syslog](https://discuss.elastic.co/t/rename-field-input-syslog/249575)
**Author:** [@Paulogbr](https://discuss.elastic.co/u/Paulogbr)\ **Replies:** 1\ **Last updated:** [September 23, 2020, 1:25pm UTC](https://discuss.elastic.co/t/rename-field-input-syslog/249575 "2020-09-23T13:25:25Z")
Hello Team, I tried rename field in logstash. I received syslog and save log in file. This is my conf. input { udp { port =\> "5133" type =\> "syslog" } } filter { if \[type\] == "syslog" { grok { … --- ## [CURRENT\_DATE() Wrongggg?](https://discuss.elastic.co/t/current-date-wrongggg/249531)
**Author:** [@Samuel\_Amico](https://discuss.elastic.co/u/Samuel_Amico)\ **Replies:** 3\ **Last updated:** [September 23, 2020, 1:00pm UTC](https://discuss.elastic.co/t/current-date-wrongggg/249531 "2020-09-23T13:00:51Z")
Guys, there is an erro here in the WHERE clause in canvas: SELECT CURRENT\_DATE(),CAST(start\_time AS DATE) FROM "active\_calls", but when I put the where clause to COUT(\*) SELECT CURRENT\_DATE(),CAST(start\_time AS DA… --- ## [XML: converting each tag attribute as the actual keys](https://discuss.elastic.co/t/xml-converting-each-tag-attribute-as-the-actual-keys/249546)
**Author:** [@thdesy](https://discuss.elastic.co/u/thdesy)\ **Replies:** 2\ **Last updated:** [September 23, 2020, 12:34pm UTC](https://discuss.elastic.co/t/xml-converting-each-tag-attribute-as-the-actual-keys/249546 "2020-09-23T12:34:53Z")
Hi, I have a somewhat XML log, where the attributes are the actual keys, e.g., \[1\] each event is in a \ tag and every message key/value is in a \ tag. The actual key name is the n attribute and the value is in a 'f… --- ## [Generate a hash/CRC for part of a document?](https://discuss.elastic.co/t/generate-a-hash-crc-for-part-of-a-document/249641)
**Author:** [@HybridBanana](https://discuss.elastic.co/u/HybridBanana)\ **Replies:** 1\ **Last updated:** [September 23, 2020, 12:29pm UTC](https://discuss.elastic.co/t/generate-a-hash-crc-for-part-of-a-document/249641 "2020-09-23T12:29:41Z")
I need to generate a unique (or almost-certainly-unique) hash/CRC value for part of my ElasticSearch document. The sub-document being hashed can contain arbitrary data types, nested documents, and lists where order is u… --- ## [Multiple bucket filter](https://discuss.elastic.co/t/multiple-bucket-filter/249475)
**Author:** [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Replies:** 3\ **Last updated:** [September 23, 2020, 12:22pm UTC](https://discuss.elastic.co/t/multiple-bucket-filter/249475 "2020-09-23T12:22:18Z")
Hi, Is there a way to use multiple conditions in a stream filter? I tried : transform": { "script": { "source": """ def docs = \[\]; def removes=ctx.payload.aggregations.event\_types.buc… --- ## [Find string in array](https://discuss.elastic.co/t/find-string-in-array/249617)
**Author:** [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Replies:** 2\ **Last updated:** [September 23, 2020, 12:13pm UTC](https://discuss.elastic.co/t/find-string-in-array/249617 "2020-09-23T12:13:29Z")
Hi, I have an array that contains some bucket keys. i want to do something for each bucket if their key is in my array. here is my code so far: "script": { "source": """ def docs = \[\]; d… --- ## [Kibana SQL - How to do where clause for @timestamp?](https://discuss.elastic.co/t/kibana-sql-how-to-do-where-clause-for-timestamp/249651)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 1\ **Last updated:** [September 23, 2020, 12:11pm UTC](https://discuss.elastic.co/t/kibana-sql-how-to-do-where-clause-for-timestamp/249651 "2020-09-23T12:11:51Z")
hi I'm able to successfully do the SQL , but if I need to compare to @timestamp it fails as it doesn't like @ symbol POST \_sql?format=txt { "query": """ SELECT \* from mytable WHERE @timestamp \< TODAY - INTERVAL 1 DAY… --- ## [Installed kibana and elasticsearch from archive](https://discuss.elastic.co/t/installed-kibana-and-elasticsearch-from-archive/249643)
**Author:** [@MOHIT2710](https://discuss.elastic.co/u/MOHIT2710)\ **Replies:** 1\ **Last updated:** [September 23, 2020, 11:53am UTC](https://discuss.elastic.co/t/installed-kibana-and-elasticsearch-from-archive/249643 "2020-09-23T11:53:53Z")
Hi Team, I have installed kibana and elasticsearch version 6.3.2 from archive. Now I want to update them to latest stable version. How can I update both my packages, I don't want to lost my data from elastic, report a… --- ## [FSCrawler Ingestion Issue](https://discuss.elastic.co/t/fscrawler-ingestion-issue/247706)
**Author:** [@Umesh\_S\_Bhimani](https://discuss.elastic.co/u/Umesh_S_Bhimani)\ **Replies:** 4\ **Last updated:** [September 23, 2020, 11:17am UTC](https://discuss.elastic.co/t/fscrawler-ingestion-issue/247706 "2020-09-23T11:17:43Z")
I have installed FSCrawler using a user account on a server and am trying to use a service account later to create a job and ingest the data. Does it require to use the same account used for FSCrawler installation to ing… --- ## [Elastic Search API queries for index logs](https://discuss.elastic.co/t/elastic-search-api-queries-for-index-logs/249635)
**Author:** [@Anand\_219](https://discuss.elastic.co/u/Anand_219)\ **Replies:** 3\ **Last updated:** [September 23, 2020, 11:04am UTC](https://discuss.elastic.co/t/elastic-search-api-queries-for-index-logs/249635 "2020-09-23T11:04:29Z")
We are using EFK as log management for our application. I am playing with API of elastic search, while doing this I have few queries to get clarify. localhost:9200/\_cat/indices?bytes=b&s=store.size:desc&v getting outpu… --- ## [How to add criteria dynamically while searching against elasticsearch](https://discuss.elastic.co/t/how-to-add-criteria-dynamically-while-searching-against-elasticsearch/248333)
**Author:** [@ocmvin](https://discuss.elastic.co/u/ocmvin)\ **Replies:** 3\ **Last updated:** [September 23, 2020, 10:50am UTC](https://discuss.elastic.co/t/how-to-add-criteria-dynamically-while-searching-against-elasticsearch/248333 "2020-09-23T10:50:32Z")
I have a big document with a requirement to dynamically search E.g. Student { id, name, Address, Associated\_Subjects phone, home\_phone, mobile, year, dob, geolocation:(lat/long) height . . . etc } Ho… --- ## [Kibana iframe request origin (client or server side)](https://discuss.elastic.co/t/kibana-iframe-request-origin-client-or-server-side/249368)
**Author:** [@Ayden](https://discuss.elastic.co/u/Ayden)\ **Replies:** 1\ **Last updated:** [September 23, 2020, 10:46am UTC](https://discuss.elastic.co/t/kibana-iframe-request-origin-client-or-server-side/249368 "2020-09-23T10:46:12Z")
Hello, I was recently looking to embed Kibana dashboards in a web application. In my current setup, Kibana is in a private network and the web application will be in a different host publicly accessible. The clients wo… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1788) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1790)