# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1855 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1856 --- ## [Reindexing packetbeats](https://discuss.elastic.co/t/reindexing-packetbeats/245511)
**Author:** [@Zead](https://discuss.elastic.co/u/Zead)\ **Replies:** 5\ **Last updated:** [August 19, 2020, 10:58pm UTC](https://discuss.elastic.co/t/reindexing-packetbeats/245511 "2020-08-19T22:58:43Z")
Ok i have been following this tutorial and i have almost completed it to predict. but when i am trying to reindex the packetbeat i am only reindexing the previous data not actually live. so how can i capture the pa… --- ## [Rest API version compatibility](https://discuss.elastic.co/t/rest-api-version-compatibility/245679)
**Author:** [@Musfiqur\_Siddique](https://discuss.elastic.co/u/Musfiqur_Siddique)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 9:18pm UTC](https://discuss.elastic.co/t/rest-api-version-compatibility/245679 "2020-08-19T21:18:07Z")
Will we see this feature while upgrading to ES 8? I am asking this because we were in the process of creating a version independent rest adapter for upgrades. If this feature becomes available, we no longer need it. --- ## [Can't figure out how to wildcard fields](https://discuss.elastic.co/t/cant-figure-out-how-to-wildcard-fields/245106)
**Author:** [@Rhysyrhys](https://discuss.elastic.co/u/Rhysyrhys)\ **Replies:** 2\ **Last updated:** [August 19, 2020, 9:27pm UTC](https://discuss.elastic.co/t/cant-figure-out-how-to-wildcard-fields/245106 "2020-08-19T21:27:55Z")
Hi, I have my Celery workers reporting their status to Kibana via logstash. When I get a snapshot the document Kibana receives is similar to this truncated doc: { "tasks\_total\_processed": 2, "worker\_count": 2, "wo… --- ## [Loaderror: rubygems/security - config file testing](https://discuss.elastic.co/t/loaderror-rubygems-security-config-file-testing/245677)
**Author:** [@biggtimber](https://discuss.elastic.co/u/biggtimber)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 9:00pm UTC](https://discuss.elastic.co/t/loaderror-rubygems-security-config-file-testing/245677 "2020-08-19T21:00:31Z")
I'm running 7.8 that was installed from the ansible-elasticsearch repo. After trying to put in and or/test a logstash config. The test return with this error. (LoadError) load error: rubygems/security -- java.lang.Excep… --- ## [Failed build Metricbeat 7.9.0 from source](https://discuss.elastic.co/t/failed-build-metricbeat-7-9-0-from-source/245675)
**Author:** [@mladen](https://discuss.elastic.co/u/mladen)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 8:50pm UTC](https://discuss.elastic.co/t/failed-build-metricbeat-7-9-0-from-source/245675 "2020-08-19T20:50:37Z")
Hello, for some time I build metricbeat agent because I have a lot of custom fields. Process is the following: make make update make release Everything was working fine until version 7.9.0. When I try to run make … --- ## [Failed to execute action](https://discuss.elastic.co/t/failed-to-execute-action/245517)
**Author:** [@Feedy](https://discuss.elastic.co/u/Feedy)\ **Replies:** 5\ **Last updated:** [August 19, 2020, 7:51pm UTC](https://discuss.elastic.co/t/failed-to-execute-action/245517 "2020-08-19T19:51:19Z")
Recently upgraded Logstash to 7.8.1 and unable to start Logstash. The error message I am getting: \[2020-08-18T22:56:00,488\]\[ERROR\]\[logstash.agent \] Failed to execute action {:id=\>:main, :action\_type=\>LogStash:… --- ## [Import CSV on basic license \[7.9.0\]](https://discuss.elastic.co/t/import-csv-on-basic-license-7-9-0/245624)
**Author:** [@Celiken](https://discuss.elastic.co/u/Celiken)\ **Replies:** 3\ **Last updated:** [August 19, 2020, 7:09pm UTC](https://discuss.elastic.co/t/import-csv-on-basic-license-7-9-0/245624 "2020-08-19T19:09:00Z")
Hello, As the 7.9.0 elastic stack has been released, and I was waiting for one of its feature, I got it today on my dev env to set it up. I was under 7.8.0 with a Basic license, and the Import CSV were really useful. … --- ## [Solved: removing domain name from hostname (host.name) with Logstash mutate split and replace filter](https://discuss.elastic.co/t/solved-removing-domain-name-from-hostname-host-name-with-logstash-mutate-split-and-replace-filter/245661)
**Author:** [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 6:29pm UTC](https://discuss.elastic.co/t/solved-removing-domain-name-from-hostname-host-name-with-logstash-mutate-split-and-replace-filter/245661 "2020-08-19T18:29:20Z")
I ran into an issue in Kibana where the logs for a server were not showing up after I clicked on a server in the Metrics -\> Inventory -\> Host logs. There were however logs in the Winlogbeat index that were specific to e… --- ## [Logstash node is missing from Monitoring in Kibana](https://discuss.elastic.co/t/logstash-node-is-missing-from-monitoring-in-kibana/244789)
**Author:** [@ELK\_User\_Arun](https://discuss.elastic.co/u/ELK_User_Arun)\ **Replies:** 5\ **Last updated:** [August 19, 2020, 6:13pm UTC](https://discuss.elastic.co/t/logstash-node-is-missing-from-monitoring-in-kibana/244789 "2020-08-19T18:13:26Z")
Hi All, We have two logstash nodes running in our DEV cluster and only one is visible in Kibana under monitoring. I compared the logstash.yml file of both the nodes side-by-side but I could not find any differences bet… --- ## [Apply Filter on a field of array values](https://discuss.elastic.co/t/apply-filter-on-a-field-of-array-values/245660)
**Author:** [@aniaks](https://discuss.elastic.co/u/aniaks)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 5:53pm UTC](https://discuss.elastic.co/t/apply-filter-on-a-field-of-array-values/245660 "2020-08-19T17:53:15Z")
How do we filter values for the field containing the values as arrays. Applying query and aggregation level filter still returns all the values in the doc and not the values only in the filters. is there a way to do this… --- ## [Elastic field include exclude performance](https://discuss.elastic.co/t/elastic-field-include-exclude-performance/245255)
**Author:** [@aniaks](https://discuss.elastic.co/u/aniaks)\ **Replies:** 2\ **Last updated:** [August 19, 2020, 5:51pm UTC](https://discuss.elastic.co/t/elastic-field-include-exclude-performance/245255 "2020-08-19T17:51:29Z")
Is performance bad when applying include or exclude on a field? currently we apply top filter and then apply include or exclude on a field , in this situation is it going to affect the performance? --- ## [Getting query and responses from TSVB Visualizations](https://discuss.elastic.co/t/getting-query-and-responses-from-tsvb-visualizations/245651)
**Author:** [@jonatelo](https://discuss.elastic.co/u/jonatelo)\ **Replies:** 3\ **Last updated:** [August 19, 2020, 5:47pm UTC](https://discuss.elastic.co/t/getting-query-and-responses-from-tsvb-visualizations/245651 "2020-08-19T17:47:49Z")
Continuing the discussion from How to get the query for a visualization created using Visual Builder: Hi, Is there a way to get the query or responses from a TSVB visualization? --- ## [Secured connection from FIlebeat to Logstash (remote error: tls: handshake failure)](https://discuss.elastic.co/t/secured-connection-from-filebeat-to-logstash-remote-error-tls-handshake-failure/245652)
**Author:** [@ofer.h](https://discuss.elastic.co/u/ofer.h)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 4:37pm UTC](https://discuss.elastic.co/t/secured-connection-from-filebeat-to-logstash-remote-error-tls-handshake-failure/245652 "2020-08-19T16:37:33Z")
Hi, I'm trying to configure tls for logstash and I'm getting the following error: 2020-08-19T11:56:29.340-0400 ERROR \[publisher\_pipeline\_output\] pipeline/output.go:106 Failed to connect to backoff(async(tcp:/… --- ## [Bug?: nested object mapping won't include both include\_in\_parent and include\_in\_root](https://discuss.elastic.co/t/bug-nested-object-mapping-wont-include-both-include-in-parent-and-include-in-root/245650)
**Author:** [@Luke\_Nezda](https://discuss.elastic.co/u/Luke_Nezda)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 4:17pm UTC](https://discuss.elastic.co/t/bug-nested-object-mapping-wont-include-both-include-in-parent-and-include-in-root/245650 "2020-08-19T16:17:16Z")
When I specify a nested object mapping with both include\_in\_parent and include\_in\_root it only uses include\_in\_parent. This feels like a bug. (Elasticsearch version 7.8.0) Please advise. - Luke Test case PUT bar { … --- ## [How to dynamically pass range query variables](https://discuss.elastic.co/t/how-to-dynamically-pass-range-query-variables/245647)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 4:08pm UTC](https://discuss.elastic.co/t/how-to-dynamically-pass-range-query-variables/245647 "2020-08-19T16:08:53Z")
hi We need to pass dynamic values into the filter range query within watcher, using a "painless" script. something like below "filter": \[ { "range": { "@timestamp": { "lte": "now-{{dynamicValueLte}… --- ## [Remove kibana exported fields from "Add Filter"](https://discuss.elastic.co/t/remove-kibana-exported-fields-from-add-filter/245230)
**Author:** [@gizem](https://discuss.elastic.co/u/gizem)\ **Replies:** 3\ **Last updated:** [August 19, 2020, 4:04pm UTC](https://discuss.elastic.co/t/remove-kibana-exported-fields-from-add-filter/245230 "2020-08-19T16:04:23Z")
I use kibana 7.0.1 and filebeat 7.0.1. There is always "exported fields" in my indexes even if they are empty. And these exported fields are always shown in "Add Filter" part. Why exported fields are always in my indexes… --- ## [Kibana controls and Drill Down](https://discuss.elastic.co/t/kibana-controls-and-drill-down/244491)
**Author:** [@mykael](https://discuss.elastic.co/u/mykael)\ **Replies:** 1\ **Last updated:** [August 19, 2020, 3:49pm UTC](https://discuss.elastic.co/t/kibana-controls-and-drill-down/244491 "2020-08-19T15:49:02Z")
We're creating some dashboards that we sell to other ELK users as a part of our offering. I'm adding some controls to some of our new drill down dashboards - that all seems to work quite nicely - but I've a problem with… --- ## [Error when trying to add documents layer to maps](https://discuss.elastic.co/t/error-when-trying-to-add-documents-layer-to-maps/245500)
**Author:** [@looknleap](https://discuss.elastic.co/u/looknleap)\ **Replies:** 5\ **Last updated:** [August 19, 2020, 3:29pm UTC](https://discuss.elastic.co/t/error-when-trying-to-add-documents-layer-to-maps/245500 "2020-08-19T15:29:30Z")
I am trying to get a map visualization working, but I get the error: "Couldn't find any index patterns with geospatial fields" As shown below, I have have the index template setup with a geoip field mapping (2 actually,… --- ## [Displaying weeks number as X labels](https://discuss.elastic.co/t/displaying-weeks-number-as-x-labels/245606)
**Author:** [@BenoitSERRA](https://discuss.elastic.co/u/BenoitSERRA)\ **Replies:** 2\ **Last updated:** [August 19, 2020, 3:10pm UTC](https://discuss.elastic.co/t/displaying-weeks-number-as-x-labels/245606 "2020-08-19T15:10:57Z")
Hello, we are currently in a process of using the ELK stack to create our monthly dashboards for the management. previously, we were using custom Excel workbooks with specials queries. And those workbooks were agregati… --- ## [Strange balancing in 3 node cluster](https://discuss.elastic.co/t/strange-balancing-in-3-node-cluster/245608)
**Author:** [@robertitox](https://discuss.elastic.co/u/robertitox)\ **Replies:** 4\ **Last updated:** [August 19, 2020, 2:57pm UTC](https://discuss.elastic.co/t/strange-balancing-in-3-node-cluster/245608 "2020-08-19T14:57:30Z")
Hi people, I have a 3 node cluster: Node 1 node.master: true node.voting\_only: false node.data: true Node 2 node master: true node.voting\_only: false node.data: true Node 3 node.master: true node.voting\_only:… --- ## [Unable to restore snapshot from URL repository with basic authentication](https://discuss.elastic.co/t/unable-to-restore-snapshot-from-url-repository-with-basic-authentication/245628)
**Author:** [@Aswin\_Kumar](https://discuss.elastic.co/u/Aswin_Kumar)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 2:51pm UTC](https://discuss.elastic.co/t/unable-to-restore-snapshot-from-url-repository-with-basic-authentication/245628 "2020-08-19T14:51:04Z")
Problem: I'm trying to create snapshot on ES instance ES1, and restore to another instance ES2. It fails to restore when the remote URL requires basic authentication. ES version: 6.5.4 Success and failure cases: Succes… --- ## [How to get multiple entries of similar pattern from the same input line using grok pattern?](https://discuss.elastic.co/t/how-to-get-multiple-entries-of-similar-pattern-from-the-same-input-line-using-grok-pattern/245208)
**Author:** [@venkata.kodapaka](https://discuss.elastic.co/u/venkata.kodapaka)\ **Replies:** 8\ **Last updated:** [August 19, 2020, 2:56pm UTC](https://discuss.elastic.co/t/how-to-get-multiple-entries-of-similar-pattern-from-the-same-input-line-using-grok-pattern/245208 "2020-08-19T14:56:17Z")
Hi Team, I'm aware of grok pattern and able to parse and store the data into elastic search using logstash configuration file with filter and grok patterns. For example: If the data input line is: Start-field1|field2… --- ## [Password reset of elastic user](https://discuss.elastic.co/t/password-reset-of-elastic-user/245096)
**Author:** [@bhargav\_bharat](https://discuss.elastic.co/u/bhargav_bharat)\ **Replies:** 3\ **Last updated:** [August 19, 2020, 2:17pm UTC](https://discuss.elastic.co/t/password-reset-of-elastic-user/245096 "2020-08-19T14:17:42Z")
I lost my "elastic" user password and now I am unable to change. Error I am getting when I run below mention command. root@siem:/usr/share/elasticsearch/bin# ./elasticsearch-setup-passwords interactive Failed to auth… --- ## [Elasticsearch index does not recognize date (Logstash pipeline)](https://discuss.elastic.co/t/elasticsearch-index-does-not-recognize-date-logstash-pipeline/245616)
**Author:** [@Luis\_Dieguez](https://discuss.elastic.co/u/Luis_Dieguez)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 1:58pm UTC](https://discuss.elastic.co/t/elasticsearch-index-does-not-recognize-date-logstash-pipeline/245616 "2020-08-19T13:58:56Z")
I've been doing more testing and I'm almost done learning about ELK. But I have a little problem. By creating a pipeline and outputting the elasticsearch cluster as follows: output { elasticsearch { hosts =\> \[… --- ## [How to re-analyze data that has already been ingested?](https://discuss.elastic.co/t/how-to-re-analyze-data-that-has-already-been-ingested/245612)
**Author:** [@Stephan\_Stachurski](https://discuss.elastic.co/u/Stephan_Stachurski)\ **Replies:** 1\ **Last updated:** [August 19, 2020, 1:44pm UTC](https://discuss.elastic.co/t/how-to-re-analyze-data-that-has-already-been-ingested/245612 "2020-08-19T13:44:02Z")
I was trying to figure out how to extract a field from a set of log messages, and most of the answers online suggest that you should handle this upstream, by using dissect on filebeat or something like that. What do I d… --- ## [\[Kibana\] Index denied but visible and empty](https://discuss.elastic.co/t/kibana-index-denied-but-visible-and-empty/243728)
**Author:** [@Downer](https://discuss.elastic.co/u/Downer)\ **Replies:** 1\ **Last updated:** [August 19, 2020, 1:30pm UTC](https://discuss.elastic.co/t/kibana-index-denied-but-visible-and-empty/243728 "2020-08-19T13:30:43Z")
Hey guys ! I'm learning about kibana security feature and I've seen it's possible to allow only one index. But other still visible but empty so it's ok but not perfect. Can I do better ? Can I remove index than the rol… --- ## [Reason for version downgrade not supported](https://discuss.elastic.co/t/reason-for-version-downgrade-not-supported/245200)
**Author:** [@shivani\_aggarwal](https://discuss.elastic.co/u/shivani_aggarwal)\ **Replies:** 7\ **Last updated:** [August 19, 2020, 1:04pm UTC](https://discuss.elastic.co/t/reason-for-version-downgrade-not-supported/245200 "2020-08-19T13:04:47Z")
Hi, Elastic documentation states that version downgrade is not supported. https://www.elastic.co/guide/en/elasticsearch/reference/7.8/setup-upgrade.html - In-place downgrades to earlier versions are not supported. To … --- ## [(Ingest Pipeline) Grok on an Array using Foreach -\> Pipeline processors](https://discuss.elastic.co/t/ingest-pipeline-grok-on-an-array-using-foreach-pipeline-processors/245436)
**Author:** [@BkQc](https://discuss.elastic.co/u/BkQc)\ **Replies:** 1\ **Last updated:** [August 19, 2020, 1:00pm UTC](https://discuss.elastic.co/t/ingest-pipeline-grok-on-an-array-using-foreach-pipeline-processors/245436 "2020-08-19T13:00:21Z")
Hello, I have a document structure that looks like the example at the end and the pipeline is just after. I tried building a pipeline that would then use a foreach processor to call a pipeline in which I used a grok pr… --- ## [Complex(Dynamic) query - Using the value of a particular field in the logs to filter the logs](https://discuss.elastic.co/t/complex-dynamic-query-using-the-value-of-a-particular-field-in-the-logs-to-filter-the-logs/245025)
**Author:** [@riyag](https://discuss.elastic.co/u/riyag)\ **Replies:** 3\ **Last updated:** [August 19, 2020, 12:56pm UTC](https://discuss.elastic.co/t/complex-dynamic-query-using-the-value-of-a-particular-field-in-the-logs-to-filter-the-logs/245025 "2020-08-19T12:56:52Z")
I have logs in the above format. The 'key1' "A" changes to "B" ('key2') and this change is documented in the log highlighted in green. After this step, "B" becomes the new value of "A" and the further logs have "B" i… --- ## [Unknown Host Exception While running elasticsearch using docker-compose on Mac](https://discuss.elastic.co/t/unknown-host-exception-while-running-elasticsearch-using-docker-compose-on-mac/245596)
**Author:** [@sab20](https://discuss.elastic.co/u/sab20)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 12:19pm UTC](https://discuss.elastic.co/t/unknown-host-exception-while-running-elasticsearch-using-docker-compose-on-mac/245596 "2020-08-19T12:19:28Z")
Hello all, I am pretty new to elasticsearch & docker. I am trying to deploy my application using docker-compose. It seemed to be working fine on Windows. Suddenly, I am facing following issue on Mac Os. My search-label… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1854) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1856)