# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1816 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1817 --- ## [Large data migration failure](https://discuss.elastic.co/t/large-data-migration-failure/246901)
**Author:** [@chen\_steven](https://discuss.elastic.co/u/chen_steven)\ **Replies:** 13\ **Last updated:** [September 9, 2020, 8:20pm UTC](https://discuss.elastic.co/t/large-data-migration-failure/246901 "2020-09-09T20:20:01Z")
Background: I need to migrate my data from 1 cloud service provider to another, and I pick the solution of add new nodes in current cluster, wait for data copy and rebalance and separate them into 2 clusters. But after… --- ## [Using the Filebeat Suricata Module for EVE-Logs in Syslog messages](https://discuss.elastic.co/t/using-the-filebeat-suricata-module-for-eve-logs-in-syslog-messages/248064)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 0\ **Last updated:** [September 9, 2020, 8:15pm UTC](https://discuss.elastic.co/t/using-the-filebeat-suricata-module-for-eve-logs-in-syslog-messages/248064 "2020-09-09T20:15:51Z")
Hey, Filebeat supports extensive Suricata EVE log parsing through the "suricata" module. The assumption of the module is that these logs are present in a file on disk. In my case, they arrive via Syslog. Also, that Sysl… --- ## [Indexing the query reslut directly to the same elasticsearch](https://discuss.elastic.co/t/indexing-the-query-reslut-directly-to-the-same-elasticsearch/247953)
**Author:** [@Mohammadreza\_Niknam](https://discuss.elastic.co/u/Mohammadreza_Niknam)\ **Replies:** 3\ **Last updated:** [September 9, 2020, 10:49pm UTC](https://discuss.elastic.co/t/indexing-the-query-reslut-directly-to-the-same-elasticsearch/247953 "2020-09-09T22:49:56Z")
Hi all, I have only access to the Kibana (I don't have access to ES) and I was wondering whether it is possible to index the result of my query into a new index directly into the same ES? or I need to have access to ES … --- ## [Index Lifecycle Error index.lifecycle.rollover\_alias \[\< beat \>-\< version \>\] does not point to index issue](https://discuss.elastic.co/t/index-lifecycle-error-index-lifecycle-rollover-alias-beat-version-does-not-point-to-index-issue/241029)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 4\ **Last updated:** [September 9, 2020, 8:02pm UTC](https://discuss.elastic.co/t/index-lifecycle-error-index-lifecycle-rollover-alias-beat-version-does-not-point-to-index-issue/241029 "2020-09-09T20:02:46Z")
A while back I posted Index Lifecycle Management “does not point to index” error. I never did fully resolve my issue, and thanks to other work priorities, my dev stack I was working on died. Now, on a new stack that's a… --- ## [Maximum length of Grok pattern?](https://discuss.elastic.co/t/maximum-length-of-grok-pattern/248062)
**Author:** [@anda](https://discuss.elastic.co/u/anda)\ **Replies:** 0\ **Last updated:** [September 9, 2020, 7:55pm UTC](https://discuss.elastic.co/t/maximum-length-of-grok-pattern/248062 "2020-09-09T19:55:30Z")
Hello, I am trying to parse a very long log line that contains 294 fields and 11,500 characters. I've had some difficulties testing the grok pattern because it's so long. When trying to use the grok debugger in Kibana,… --- ## [Logstash cannot connect to Oracle cloud using wallet key](https://discuss.elastic.co/t/logstash-cannot-connect-to-oracle-cloud-using-wallet-key/248059)
**Author:** [@Otomar\_Jupiter](https://discuss.elastic.co/u/Otomar_Jupiter)\ **Replies:** 1\ **Last updated:** [September 9, 2020, 7:55pm UTC](https://discuss.elastic.co/t/logstash-cannot-connect-to-oracle-cloud-using-wallet-key/248059 "2020-09-09T19:55:28Z")
Hello community, I'm having hard time to establish Logstash connection towards Oracle cloud autonomous db. I have suspicion that it is connected to wallet key. I was able to connect to Oracle cloud using Ubuntu/sql dev… --- ## [Trying to add an alias on Index Template using kibana Wizard](https://discuss.elastic.co/t/trying-to-add-an-alias-on-index-template-using-kibana-wizard/248037)
**Author:** [@olg32](https://discuss.elastic.co/u/olg32)\ **Replies:** 1\ **Last updated:** [September 9, 2020, 7:32pm UTC](https://discuss.elastic.co/t/trying-to-add-an-alias-on-index-template-using-kibana-wizard/248037 "2020-09-09T19:32:22Z")
Hi, I just created an index template. Now, in order to to configure a lifecycle policy for rolling indices, I need to define an alias, so I'm using the Kibana Create template wizard to add it. I went to the "Aliases" … --- ## [Large amount of terms in Lucene query](https://discuss.elastic.co/t/large-amount-of-terms-in-lucene-query/248057)
**Author:** [@wpearson4](https://discuss.elastic.co/u/wpearson4)\ **Replies:** 0\ **Last updated:** [September 9, 2020, 7:24pm UTC](https://discuss.elastic.co/t/large-amount-of-terms-in-lucene-query/248057 "2020-09-09T19:24:12Z")
Hello, I am using a Lucene query for building dynamic search queries. Let's assume a sample search will take the following format: Blockquote (Gender:"Female" AND AgeRange:\[17 TO 24\] AND Sports:"YES" AND State:"TX")… --- ## [Detecting Master\_Not\_Discovered faster](https://discuss.elastic.co/t/detecting-master-not-discovered-faster/248047)
**Author:** [@nicolaet](https://discuss.elastic.co/u/nicolaet)\ **Replies:** 1\ **Last updated:** [September 9, 2020, 7:16pm UTC](https://discuss.elastic.co/t/detecting-master-not-discovered-faster/248047 "2020-09-09T19:16:30Z")
Hello, I have a 2 node cluster - and that means that there is a chance, that i will run into the situation where one node remains but it can't elect a master. That's OK. But what i want is to be able to detect this fas… --- ## [Logstash missing XML records](https://discuss.elastic.co/t/logstash-missing-xml-records/248044)
**Author:** [@stevedbarnes](https://discuss.elastic.co/u/stevedbarnes)\ **Replies:** 0\ **Last updated:** [September 9, 2020, 4:49pm UTC](https://discuss.elastic.co/t/logstash-missing-xml-records/248044 "2020-09-09T16:49:50Z")
Hi, I am consuming large (~600Mb) XML files with one line of data in the file. I am able to (mostly) consume the data using Logstash using xpath to extract fields from the XML and I am stuck on an issue I can't get arou… --- ## [Elasticsearch SSL certificate error - javax.crypto.BadPaddingException: Given final block not properly padded](https://discuss.elastic.co/t/elasticsearch-ssl-certificate-error-javax-crypto-badpaddingexception-given-final-block-not-properly-padded/247783)
**Author:** [@fgomes](https://discuss.elastic.co/u/fgomes)\ **Replies:** 2\ **Last updated:** [September 9, 2020, 5:10pm UTC](https://discuss.elastic.co/t/elasticsearch-ssl-certificate-error-javax-crypto-badpaddingexception-given-final-block-not-properly-padded/247783 "2020-09-09T17:10:10Z")
I'm trying to get user management and authentication in Kibana. For that it is required to enable the security module, and since we're running a 3 node cluster, SSL security must be enabled as well. I tried to use Docke… --- ## [Query on a date field that contains only a time value](https://discuss.elastic.co/t/query-on-a-date-field-that-contains-only-a-time-value/246823)
**Author:** [@rastro](https://discuss.elastic.co/u/rastro)\ **Replies:** 3\ **Last updated:** [September 9, 2020, 4:30pm UTC](https://discuss.elastic.co/t/query-on-a-date-field-that-contains-only-a-time-value/246823 "2020-09-09T16:30:08Z")
I have a full date field (epoch\_second), but I also want to be able to query based on the just the time, so I made another date field ("time" with "hour\_minute\_second" format). By default, Kibana shows this "time" field… --- ## [Indexing weighted terms (or fake term frequency)](https://discuss.elastic.co/t/indexing-weighted-terms-or-fake-term-frequency/248034)
**Author:** [@Hannes\_Korte](https://discuss.elastic.co/u/Hannes_Korte)\ **Replies:** 0\ **Last updated:** [September 9, 2020, 3:21pm UTC](https://discuss.elastic.co/t/indexing-weighted-terms-or-fake-term-frequency/248034 "2020-09-09T15:21:09Z")
Hi, I am looking for a way to fake the frequency of terms in a field at index time. It's kind of a boost for a specific term in a specific document. Imagine your docs are people with each having a map of weighted skill… --- ## [How to take snapshot of one elasticsearch instance and restore into another instance](https://discuss.elastic.co/t/how-to-take-snapshot-of-one-elasticsearch-instance-and-restore-into-another-instance/248030)
**Author:** [@aman97](https://discuss.elastic.co/u/aman97)\ **Replies:** 0\ **Last updated:** [September 9, 2020, 2:48pm UTC](https://discuss.elastic.co/t/how-to-take-snapshot-of-one-elasticsearch-instance-and-restore-into-another-instance/248030 "2020-09-09T14:48:10Z")
hello, Everyone, I am trying to take a snapshot of an elasticsearch instance and restore on another elasticsearch instance for that, I followed the standard steps elastic\_01 and elastic\_02 have this folder "/elastics… --- ## [Elastic Ingestion problem](https://discuss.elastic.co/t/elastic-ingestion-problem/248022)
**Author:** [@Anthony\_Pope](https://discuss.elastic.co/u/Anthony_Pope)\ **Replies:** 2\ **Last updated:** [September 9, 2020, 2:50pm UTC](https://discuss.elastic.co/t/elastic-ingestion-problem/248022 "2020-09-09T14:50:31Z")
Hi, I have a problem about ingestion process in elasticsearch. I use a Java program to ingest some documents in elasticsearch using HTTP node as a claster entry (I send request to an HTTP node). I have noticed that th… --- ## [Filebeat Cisco Module Trouble](https://discuss.elastic.co/t/filebeat-cisco-module-trouble/248028)
**Author:** [@aparkinson\_merrimac](https://discuss.elastic.co/u/aparkinson_merrimac)\ **Replies:** 0\ **Last updated:** [September 9, 2020, 2:34pm UTC](https://discuss.elastic.co/t/filebeat-cisco-module-trouble/248028 "2020-09-09T14:34:06Z")
I am struggling to get the filebeat cisco module to report correctly. The pipeline appears to be broken, but I am not proficient enough to discover the problem. What can I provide other than the below to assist in discov… --- ## [How to setup data validation functionalities in Kibana and Elasticsearch](https://discuss.elastic.co/t/how-to-setup-data-validation-functionalities-in-kibana-and-elasticsearch/247903)
**Author:** [@Artur\_Bartosik](https://discuss.elastic.co/u/Artur_Bartosik)\ **Replies:** 3\ **Last updated:** [September 9, 2020, 2:25pm UTC](https://discuss.elastic.co/t/how-to-setup-data-validation-functionalities-in-kibana-and-elasticsearch/247903 "2020-09-09T14:25:13Z")
We have installed ELK stack in our env and we use it to monitoring and log viewing. For now, we try to find new usages for ELK stack. We are using ELK in 7.8 version and we see in Kibana UI a lot of new functionalities l… --- ## [Examples/help please - how to query arrays of data in TSVB tables?](https://discuss.elastic.co/t/examples-help-please-how-to-query-arrays-of-data-in-tsvb-tables/247922)
**Author:** [@Mark\_Duncan](https://discuss.elastic.co/u/Mark_Duncan)\ **Replies:** 3\ **Last updated:** [September 9, 2020, 2:20pm UTC](https://discuss.elastic.co/t/examples-help-please-how-to-query-arrays-of-data-in-tsvb-tables/247922 "2020-09-09T14:20:58Z")
I have a use case, which I need some help with, please. I'd like to create a metric in TSVB Table, where I can report the sum of a field, across a variable number (not fixed number) of documents. i.e. if I have docs wi… --- ## [Grok Ingest Pipeline and the Elastic Common Schema](https://discuss.elastic.co/t/grok-ingest-pipeline-and-the-elastic-common-schema/247917)
**Author:** [@roshanp](https://discuss.elastic.co/u/roshanp)\ **Replies:** 3\ **Last updated:** [September 9, 2020, 2:11pm UTC](https://discuss.elastic.co/t/grok-ingest-pipeline-and-the-elastic-common-schema/247917 "2020-09-09T14:11:42Z")
Hi there, I want to use the Grok patterns already available in the Elastic Ingest pipeline; however, I don't see how I can map the default field names provided to the Elastic common schema? Is there any work towards tha… --- ## [Writing raw mapping\_error events from the Logstash DLQ to Elasticsearch](https://discuss.elastic.co/t/writing-raw-mapping-error-events-from-the-logstash-dlq-to-elasticsearch/248024)
**Author:** [@Yor\_On](https://discuss.elastic.co/u/Yor_On)\ **Replies:** 0\ **Last updated:** [September 9, 2020, 1:59pm UTC](https://discuss.elastic.co/t/writing-raw-mapping-error-events-from-the-logstash-dlq-to-elasticsearch/248024 "2020-09-09T13:59:49Z")
Hi, I'm trying to find a way to get the raw data of messages that fail on mapping errors from my Logstash's Dead Letter Queues to Elasticsearch so I can look into the reasons why the messages ended up in the DLQ in the … --- ## [Generate daily report](https://discuss.elastic.co/t/generate-daily-report/247993)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 6\ **Last updated:** [September 9, 2020, 1:57pm UTC](https://discuss.elastic.co/t/generate-daily-report/247993 "2020-09-09T13:57:34Z")
I have a dashboard in kibana (version 7.9.0). I need the dashboard to be exported to a PDF or an excel spreadsheet daily and emailed to someone. The time for the results should be in the last 24 hours. This doc page sug… --- ## [Es-Sql-Query - http client did not trust this server's certificate](https://discuss.elastic.co/t/es-sql-query-http-client-did-not-trust-this-servers-certificate/248019)
**Author:** [@Jose\_H](https://discuss.elastic.co/u/Jose_H)\ **Replies:** 0\ **Last updated:** [September 9, 2020, 1:46pm UTC](https://discuss.elastic.co/t/es-sql-query-http-client-did-not-trust-this-servers-certificate/248019 "2020-09-09T13:46:41Z")
Hi all, Im having issues with getting data from my index, using elasticsearch-sql-cli: /usr/share/elasticsearch/bin/elasticsearch-sql-cli https://elastic:my-password@elastic.local:9200 ERROR: Cannot communicate with t… --- ## [How to increase the performance of logging in elasticsearch](https://discuss.elastic.co/t/how-to-increase-the-performance-of-logging-in-elasticsearch/248018)
**Author:** [@galet](https://discuss.elastic.co/u/galet)\ **Replies:** 0\ **Last updated:** [September 9, 2020, 1:41pm UTC](https://discuss.elastic.co/t/how-to-increase-the-performance-of-logging-in-elasticsearch/248018 "2020-09-09T13:41:18Z")
I have multiple logs in my elasticsearch plugin app which will be logged during ingest and search. I want to reduce the time taken to log the events in all log files when multiple ingest or bulk ingest happens. Same for… --- ## [Decode Array and Extract](https://discuss.elastic.co/t/decode-array-and-extract/247802)
**Author:** [@Milos](https://discuss.elastic.co/u/Milos)\ **Replies:** 2\ **Last updated:** [September 9, 2020, 1:33pm UTC](https://discuss.elastic.co/t/decode-array-and-extract/247802 "2020-09-09T13:33:36Z")
Hi to All, last few weeks I am getting up to speed with Filebeat and ES, experience is up to now great!! Currently i believe that i am stuck with a small issue: Namely, if i decode array from json, is it possible to ex… --- ## [Mapping Internal Network for SIEM Network Map - Not showing](https://discuss.elastic.co/t/mapping-internal-network-for-siem-network-map-not-showing/247295)
**Author:** [@teej](https://discuss.elastic.co/u/teej)\ **Replies:** 2\ **Last updated:** [September 9, 2020, 1:16pm UTC](https://discuss.elastic.co/t/mapping-internal-network-for-siem-network-map-not-showing/247295 "2020-09-09T13:16:30Z")
I am not sure I am making the correct assumption but I thought that if I added processors: - add\_host\_metadata: - add\_cloud\_metadata: ~ - add\_fields: when.network.source.ip: 10.10.10.10/24 fiel… --- ## [Elastic stuck and flooded with "monitoring execution failed"](https://discuss.elastic.co/t/elastic-stuck-and-flooded-with-monitoring-execution-failed/247881)
**Author:** [@ludaca](https://discuss.elastic.co/u/ludaca)\ **Replies:** 9\ **Last updated:** [September 9, 2020, 1:14pm UTC](https://discuss.elastic.co/t/elastic-stuck-and-flooded-with-monitoring-execution-failed/247881 "2020-09-09T13:14:20Z")
Hello, ES 5.6.10 under k8s cluster v1.9 xpack.security disabled 16 data nodes Large number of unassigned shards that do not go down at all. \[2020-09-08T11:15:40,655\]\[WARN \]\[o.e.x.m.MonitoringService\] \[es-data05-0\] … --- ## [502 Bad Gateway](https://discuss.elastic.co/t/502-bad-gateway/247921)
**Author:** [@Jarek](https://discuss.elastic.co/u/Jarek)\ **Replies:** 3\ **Last updated:** [September 9, 2020, 1:12pm UTC](https://discuss.elastic.co/t/502-bad-gateway/247921 "2020-09-09T13:12:15Z")
Hi, We use Elasticsearch 7.8.0. The problem we have is the "502 Bad Gateway" error that appears very often. The problem seems to occur between ms proxy and Kibana, but there is no information in the Kibana logs what cou… --- ## [Xpack computation](https://discuss.elastic.co/t/xpack-computation/248000)
**Author:** [@whiletruelearn](https://discuss.elastic.co/u/whiletruelearn)\ **Replies:** 1\ **Last updated:** [September 9, 2020, 1:03pm UTC](https://discuss.elastic.co/t/xpack-computation/248000 "2020-09-09T13:03:03Z")
Hi, I read about the concept of ml nodes for xpack. But since xpack itself is a form of a plugin , i was curious to know where the actual compute is happening? Is it internally some form of a rest service where data is… --- ## [Only access to Management Kibana: Spaces, Users and Roles](https://discuss.elastic.co/t/only-access-to-management-kibana-spaces-users-and-roles/246615)
**Author:** [@ErwinEnableU](https://discuss.elastic.co/u/ErwinEnableU)\ **Replies:** 8\ **Last updated:** [September 9, 2020, 12:47pm UTC](https://discuss.elastic.co/t/only-access-to-management-kibana-spaces-users-and-roles/246615 "2020-09-09T12:47:28Z")
Hi community, for certain Users I would like to know how to configure Kibana management in such a manner that these Users only have acces in Kibana Management to: Spaces: to create and modify Users: to create and modif… --- ## [Kibana Search from Index using document name rather than the document contents](https://discuss.elastic.co/t/kibana-search-from-index-using-document-name-rather-than-the-document-contents/247755)
**Author:** [@Kushal\_Nekkalapu](https://discuss.elastic.co/u/Kushal_Nekkalapu)\ **Replies:** 8\ **Last updated:** [September 9, 2020, 12:29pm UTC](https://discuss.elastic.co/t/kibana-search-from-index-using-document-name-rather-than-the-document-contents/247755 "2020-09-09T12:29:43Z")
Hi team, I'm trying to retrieve data from Kibana using GET \[Index\_name\]/\_search but from the retrieved data i want all the documents with a particular name without the help of contents in the doc i.e; doc\_name.field\_… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1815) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1817)