# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1841 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1842 --- ## [Scroll API with SearchTemplateRequest](https://discuss.elastic.co/t/scroll-api-with-searchtemplaterequest/246510)
**Author:** [@ljr9600](https://discuss.elastic.co/u/ljr9600)\ **Replies:** 0\ **Last updated:** [August 26, 2020, 8:50pm UTC](https://discuss.elastic.co/t/scroll-api-with-searchtemplaterequest/246510 "2020-08-26T20:50:39Z")
There doesn't seem to be a way to use the scroll api with SearchTemplateRequest() from the Java high level client. Is this a feature request, or a bug/miss? I use moustache to expand complex json queries. So I could d… --- ## [ML job rare function to detect anomaly on IP address will report IP on same network as anomaly](https://discuss.elastic.co/t/ml-job-rare-function-to-detect-anomaly-on-ip-address-will-report-ip-on-same-network-as-anomaly/246213)
**Author:** [@nameisnotimportant](https://discuss.elastic.co/u/nameisnotimportant)\ **Replies:** 2\ **Last updated:** [August 27, 2020, 2:05am UTC](https://discuss.elastic.co/t/ml-job-rare-function-to-detect-anomaly-on-ip-address-will-report-ip-on-same-network-as-anomaly/246213 "2020-08-27T02:05:55Z")
Hi, Referring to https://discuss.elastic.co/t/ml-how-to-find-anomaly-from-ip-address/239996 I found that IP address on same network will be detected as anomaly. e.g. let say 10.180.1.161 is the regularly used IP addre… --- ## [Delete Index after x amount of days](https://discuss.elastic.co/t/delete-index-after-x-amount-of-days/246492)
**Author:** [@userR](https://discuss.elastic.co/u/userR)\ **Replies:** 10\ **Last updated:** [August 27, 2020, 1:49am UTC](https://discuss.elastic.co/t/delete-index-after-x-amount-of-days/246492 "2020-08-27T01:49:48Z")
Currently reading logs from Logstash to Elasticsearch and creating daily indexes. Is there a way to delete each of these indexes after an X amount of days? Also, is there an auto delete feature when my elasticsearch clu… --- ## [Logstash JDBC input for oracle SSL connections](https://discuss.elastic.co/t/logstash-jdbc-input-for-oracle-ssl-connections/246528)
**Author:** [@erickgvsat](https://discuss.elastic.co/u/erickgvsat)\ **Replies:** 0\ **Last updated:** [August 27, 2020, 1:10am UTC](https://discuss.elastic.co/t/logstash-jdbc-input-for-oracle-ssl-connections/246528 "2020-08-27T01:10:04Z")
I am trying to connect to Oracle database with JDBC input plugin using SSL (TCPS) connection. I am able to connect with regular connection (non SSL). However when thin URL with SSL TCPS, it doesn't work. Here is examp… --- ## [Logstash KV Filter Help](https://discuss.elastic.co/t/logstash-kv-filter-help/246199)
**Author:** [@kopacko](https://discuss.elastic.co/u/kopacko)\ **Replies:** 1\ **Last updated:** [August 27, 2020, 1:07am UTC](https://discuss.elastic.co/t/logstash-kv-filter-help/246199 "2020-08-27T01:07:42Z")
I am working on a project and I have setup a chatbot that connects to Twitch chat channels. I am trying to parse chat messages and having some issues related to a KV filter. An example log looks like this: @badge-info… --- ## [Boolean MUST Match in "Nested" type Not working for timestamp - precisely](https://discuss.elastic.co/t/boolean-must-match-in-nested-type-not-working-for-timestamp-precisely/246514)
**Author:** [@baig](https://discuss.elastic.co/u/baig)\ **Replies:** 0\ **Last updated:** [August 26, 2020, 9:22pm UTC](https://discuss.elastic.co/t/boolean-must-match-in-nested-type-not-working-for-timestamp-precisely/246514 "2020-08-26T21:22:53Z")
Hi, couldn't find a matching topic to continue so opening a new issue. I am currently using ES version 7.6.2. I have a list of similar json objects where one of each objects also contains a field timestamp. When I do a… --- ## [Index not created using log stash](https://discuss.elastic.co/t/index-not-created-using-log-stash/246443)
**Author:** [@Adarsh\_S](https://discuss.elastic.co/u/Adarsh_S)\ **Replies:** 2\ **Last updated:** [August 27, 2020, 12:31am UTC](https://discuss.elastic.co/t/index-not-created-using-log-stash/246443 "2020-08-27T00:31:36Z")
I am using elasticsearch with logstash \[Version : 7.9.0\] to visualize a data set with kibana. I am doing this task on Windows10. Logstash config file - input { jdbc { jdbc\_driver\_library =\> "$PATH\\mysql-connect… --- ## [Nginx-ingress grok expression does not handle multiple upstreams](https://discuss.elastic.co/t/nginx-ingress-grok-expression-does-not-handle-multiple-upstreams/246046)
**Author:** [@chendo](https://discuss.elastic.co/u/chendo)\ **Replies:** 2\ **Last updated:** [August 27, 2020, 12:29am UTC](https://discuss.elastic.co/t/nginx-ingress-grok-expression-does-not-handle-multiple-upstreams/246046 "2020-08-27T00:29:43Z")
If nginx-ingress retries multiple upstreams, the grok expression does not parse it correctly and manifested as missing data when we knew errors were happening. This is on filebeat 7.8.0, but issue does not appear to be … --- ## [How to search (query or filter) on an integer array field](https://discuss.elastic.co/t/how-to-search-query-or-filter-on-an-integer-array-field/246526)
**Author:** [@taichi](https://discuss.elastic.co/u/taichi)\ **Replies:** 0\ **Last updated:** [August 27, 2020, 12:27am UTC](https://discuss.elastic.co/t/how-to-search-query-or-filter-on-an-integer-array-field/246526 "2020-08-27T00:27:11Z")
I have a document mapping like this: { "id": 1, "some\_category\_ids": \[1, 2, 3\] } I would like to search documents which includes specified category\_ids. For example, when I specify in query "some\_category\_ids"… --- ## [Elastic with Traefik xpack security settings?](https://discuss.elastic.co/t/elastic-with-traefik-xpack-security-settings/246524)
**Author:** [@rainfarmer](https://discuss.elastic.co/u/rainfarmer)\ **Replies:** 0\ **Last updated:** [August 26, 2020, 11:41pm UTC](https://discuss.elastic.co/t/elastic-with-traefik-xpack-security-settings/246524 "2020-08-26T23:41:21Z")
I've finally got Elastic cluster and Kibana working on Traefik + Let's Encrypt SSL. But now I need to setup passwords for Elastic and Kibana. Before I decided to use Traefik, I was able to successfully setup passwords … --- ## [ES 7.3 --- date\_time\_parse\_exception: Text '2020-08-25 11:50:00 AM'](https://discuss.elastic.co/t/es-7-3-date-time-parse-exception-text-2020-08-25-1100-am/246523)
**Author:** [@vishal22mehra](https://discuss.elastic.co/u/vishal22mehra)\ **Replies:** 0\ **Last updated:** [August 26, 2020, 11:26pm UTC](https://discuss.elastic.co/t/es-7-3-date-time-parse-exception-text-2020-08-25-1100-am/246523 "2020-08-26T23:26:30Z")
Hi All, I am getting following error message "failed to parse date field \[2020-08-25 11:50:00 AM\] with format \[uuuu-MM-dd HH:mm:ss:SSS||uuuu-MM-dd HH:mm a||uuuu-MM-dd HH:mm:ss||uuuu-MM-dd HH:mm:ss a||uuuu-MM-dd||epoch\_… --- ## [Unable to migrate indices from old 6.1.2 elasticsearch node to 7.8 elasticsearch node](https://discuss.elastic.co/t/unable-to-migrate-indices-from-old-6-1-2-elasticsearch-node-to-7-8-elasticsearch-node/243939)
**Author:** [@cmiles](https://discuss.elastic.co/u/cmiles)\ **Replies:** 2\ **Last updated:** [August 26, 2020, 11:13pm UTC](https://discuss.elastic.co/t/unable-to-migrate-indices-from-old-6-1-2-elasticsearch-node-to-7-8-elasticsearch-node/243939 "2020-08-26T23:13:40Z")
Hello, We have a relatively old ELK stack that we're attempting to migrate off. It's been neglected and left running to collect some logs from our F5 load balancers. I'm attempting to migrate the daily f5 indices to … --- ## [How to hide top and side menus](https://discuss.elastic.co/t/how-to-hide-top-and-side-menus/246444)
**Author:** [@User4](https://discuss.elastic.co/u/User4)\ **Replies:** 1\ **Last updated:** [August 26, 2020, 10:58pm UTC](https://discuss.elastic.co/t/how-to-hide-top-and-side-menus/246444 "2020-08-26T22:58:26Z")
Tell me how can I hide the red menus, leaving only the green area? --- ## [How can format json file when using logstash](https://discuss.elastic.co/t/how-can-format-json-file-when-using-logstash/246520)
**Author:** [@bertrand1](https://discuss.elastic.co/u/bertrand1)\ **Replies:** 0\ **Last updated:** [August 26, 2020, 10:29pm UTC](https://discuss.elastic.co/t/how-can-format-json-file-when-using-logstash/246520 "2020-08-26T22:29:20Z")
Hello, I am newby on logstash, i am trying to send a log with the following in ES/kibana ===\> {"Brique":"Echange", "Environnement":"prd", "UUID":"7cc9584f-3e89-4a1c-b62f-bf753a3cf693", "Script":"script\_envoi.ksh How ca… --- ## [Imports Charts From Kibana To PowerPoint](https://discuss.elastic.co/t/imports-charts-from-kibana-to-powerpoint/246438)
**Author:** [@vignesh23041991](https://discuss.elastic.co/u/vignesh23041991)\ **Replies:** 1\ **Last updated:** [August 26, 2020, 10:02pm UTC](https://discuss.elastic.co/t/imports-charts-from-kibana-to-powerpoint/246438 "2020-08-26T22:02:00Z")
We have an option to build the chart in Excel and modify the Data using VBA in Excel.Like wise do we have any option similar to export the charts from kibana to power point and edit the data? --- ## [Securing ES cluster](https://discuss.elastic.co/t/securing-es-cluster/246446)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 1\ **Last updated:** [August 26, 2020, 10:01pm UTC](https://discuss.elastic.co/t/securing-es-cluster/246446 "2020-08-26T22:01:22Z")
Hi As part of ES clustering, I have mapped my ES ip to network.host. After that I see my elasticsearch is accessible for all machines/ip's. How to restrict elasticsearch to be accessible only within cluster nodes, not t… --- ## [Logstash dynamically create field name](https://discuss.elastic.co/t/logstash-dynamically-create-field-name/246326)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 8\ **Last updated:** [August 26, 2020, 10:00pm UTC](https://discuss.elastic.co/t/logstash-dynamically-create-field-name/246326 "2020-08-26T22:00:42Z")
this is my input {"dataflow":\[{"gate": "v204.06", "attrmath":"v206.07"}\]} I want output like dataflow.m1: gate dataflow.m1\_version: v204.06 dataflow.m2: attrmath dataflow.m2\_version: v206.07 I want this m1, m2, m3… --- ## [Can not point Grafana datasource to Elastic search through server(default) mode-Error 503](https://discuss.elastic.co/t/can-not-point-grafana-datasource-to-elastic-search-through-server-default-mode-error-503/246483)
**Author:** [@Moksha20](https://discuss.elastic.co/u/Moksha20)\ **Replies:** 1\ **Last updated:** [August 26, 2020, 9:49pm UTC](https://discuss.elastic.co/t/can-not-point-grafana-datasource-to-elastic-search-through-server-default-mode-error-503/246483 "2020-08-26T21:49:48Z")
Hi, I can point my grafana datasource to elasticsearch through browser mode.But I am not able to do it through server mode as service is unavailable(error 503). Thanks in advance. Regards, Moksha --- ## [Elastic search nodes are going down across multiple instances](https://discuss.elastic.co/t/elastic-search-nodes-are-going-down-across-multiple-instances/246151)
**Author:** [@prasanthpola](https://discuss.elastic.co/u/prasanthpola)\ **Replies:** 6\ **Last updated:** [August 26, 2020, 9:39pm UTC](https://discuss.elastic.co/t/elastic-search-nodes-are-going-down-across-multiple-instances/246151 "2020-08-26T21:39:28Z")
Hi - We have a problem of Elastic nodes going down one by one around the same time frames which are hosted on different VPC's in aws. I could not figure out the pattern, i see these errors in the log files, Appreciate a… --- ## [Could i skip xpack.security.transport.ssl.enabled?](https://discuss.elastic.co/t/could-i-skip-xpack-security-transport-ssl-enabled/246511)
**Author:** [@zakabluk](https://discuss.elastic.co/u/zakabluk)\ **Replies:** 2\ **Last updated:** [August 26, 2020, 9:31pm UTC](https://discuss.elastic.co/t/could-i-skip-xpack-security-transport-ssl-enabled/246511 "2020-08-26T21:31:01Z")
I launch elastic 7.9 by nomad. I have 3 master nodes, 3 data, 1 kibana, 1 ingest and 1 coordinator. I set ELASTIC\_PASSWORD for coordinator & added xpack.security.enabled: true to every config of nodes. I want only have… --- ## [Creating ILM](https://discuss.elastic.co/t/creating-ilm/246304)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 3\ **Last updated:** [August 26, 2020, 9:20pm UTC](https://discuss.elastic.co/t/creating-ilm/246304 "2020-08-26T21:20:59Z")
I want to create an ILM rule that would that would apply to all indices ( I only have auditbeat-\* and filebeat-\*). In ILM, it seems like there's no option to give it an indice, but rather it wants index template. How d… --- ## [TypeError: Cannot read property 'key' of undefined](https://discuss.elastic.co/t/typeerror-cannot-read-property-key-of-undefined/246461)
**Author:** [@balajiduddu](https://discuss.elastic.co/u/balajiduddu)\ **Replies:** 1\ **Last updated:** [August 26, 2020, 9:20pm UTC](https://discuss.elastic.co/t/typeerror-cannot-read-property-key-of-undefined/246461 "2020-08-26T21:20:43Z")
HI , I am new to kibana and in our project we are using kibana of version 6.2.3 while launching kibana dashboard there we are getting error at the top of the page and in developer page could see the below error Prom… --- ## [Performance issue with CoveringQuery with percolate in ES 7.6](https://discuss.elastic.co/t/performance-issue-with-coveringquery-with-percolate-in-es-7-6/246495)
**Author:** [@sb116](https://discuss.elastic.co/u/sb116)\ **Replies:** 0\ **Last updated:** [August 26, 2020, 5:37pm UTC](https://discuss.elastic.co/t/performance-issue-with-coveringquery-with-percolate-in-es-7-6/246495 "2020-08-26T17:37:41Z")
Based on query profiling, we noticed that CoveringQuery is taking most of the time and eventually failed (query.extraction\_result) at TermQuery Any tips on tuning CoveringQuery or disable it? --- ## [Multiple Index Filters](https://discuss.elastic.co/t/multiple-index-filters/246501)
**Author:** [@adwaitjoshi](https://discuss.elastic.co/u/adwaitjoshi)\ **Replies:** 1\ **Last updated:** [August 26, 2020, 9:16pm UTC](https://discuss.elastic.co/t/multiple-index-filters/246501 "2020-08-26T21:16:05Z")
I have two elastic indexes Parent Child I have created a dashboard with visualizations that use both those indexes. Both of the indexes have a field "family\_id". I can apply the family ID filter to filter the entire … --- ## [Filebeat unable obtain kubernetes metadata](https://discuss.elastic.co/t/filebeat-unable-obtain-kubernetes-metadata/245741)
**Author:** [@dorinand](https://discuss.elastic.co/u/dorinand)\ **Replies:** 1\ **Last updated:** [August 26, 2020, 8:50pm UTC](https://discuss.elastic.co/t/filebeat-unable-obtain-kubernetes-metadata/245741 "2020-08-26T20:50:11Z")
I am running filebeat in my kubernetes cluster. I used this helm chart to deploy filebeat, logstash and elasticsearch. This is my filebeat configuration: filebeatConfig: filebeat.yml: | filebeat.inputs: - type… --- ## [Elastic bootstrap password not picked up by second cluster member](https://discuss.elastic.co/t/elastic-bootstrap-password-not-picked-up-by-second-cluster-member/246508)
**Author:** [@cotjoey](https://discuss.elastic.co/u/cotjoey)\ **Replies:** 0\ **Last updated:** [August 26, 2020, 8:17pm UTC](https://discuss.elastic.co/t/elastic-bootstrap-password-not-picked-up-by-second-cluster-member/246508 "2020-08-26T20:17:39Z")
I enabled security on my ELK stack. I tested the configuration locally several times before going on the dev environment. On the second master node of my cluster, I get the following error: \[2020-08-26T16:54:40,203\]\[INF… --- ## [Getting unauthorized when doing GET on indices with a read-only user](https://discuss.elastic.co/t/getting-unauthorized-when-doing-get-on-indices-with-a-read-only-user/246129)
**Author:** [@cotjoey](https://discuss.elastic.co/u/cotjoey)\ **Replies:** 3\ **Last updated:** [August 26, 2020, 8:07pm UTC](https://discuss.elastic.co/t/getting-unauthorized-when-doing-get-on-indices-with-a-read-only-user/246129 "2020-08-26T20:07:47Z")
Hello, I am using Kibana/Elasticsearch 7.9.0, and testing enabling security on the stack. I am starting with a test user that gets the following on the GET API call: GET \_cat/indices { "error" : { "root\_cause" … --- ## [Kibana 7.9.0 - 403 Forbidden on /api/kibana/settings](https://discuss.elastic.co/t/kibana-7-9-0-403-forbidden-on-api-kibana-settings/246201)
**Author:** [@cotjoey](https://discuss.elastic.co/u/cotjoey)\ **Replies:** 2\ **Last updated:** [August 26, 2020, 8:06pm UTC](https://discuss.elastic.co/t/kibana-7-9-0-403-forbidden-on-api-kibana-settings/246201 "2020-08-26T20:06:31Z")
I've been struggling trying to set up a read-only user for Kibana. It seems like I have it working now, with the exception of an error popping up in the Discover app. It seems to be exactly the issue listed here: https:/… --- ## [Create alert per multiple fields](https://discuss.elastic.co/t/create-alert-per-multiple-fields/242706)
**Author:** [@Sergi](https://discuss.elastic.co/u/Sergi)\ **Replies:** 5\ **Last updated:** [August 26, 2020, 7:59pm UTC](https://discuss.elastic.co/t/create-alert-per-multiple-fields/242706 "2020-08-26T19:59:14Z")
Hi, Currently, when creating an alert, we can set up for example the next scenario: When avg system.cpu.total.pct is above 90% for the last 1 minute. Okey...It will affect to all the hosts which matches this query, th… --- ## [How to use \\n as a delimeter in dissect filter](https://discuss.elastic.co/t/how-to-use-n-as-a-delimeter-in-dissect-filter/246485)
**Author:** [@shani](https://discuss.elastic.co/u/shani)\ **Replies:** 9\ **Last updated:** [August 26, 2020, 7:55pm UTC](https://discuss.elastic.co/t/how-to-use-n-as-a-delimeter-in-dissect-filter/246485 "2020-08-26T19:55:49Z")
Hi All, dissect filter doesn't work when I use \\n as a delimiter, it return error as Dissector mapping, pattern not found {"field"=\>"message", "pattern"=\>"%{test}\\n%{test1}" It works on any other delimeter but \\n does… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1840) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1842)