# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1878 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1879 --- ## [Wild card query to match the multiple field values](https://discuss.elastic.co/t/wild-card-query-to-match-the-multiple-field-values/244351)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 0\ **Last updated:** [August 10, 2020, 6:48am UTC](https://discuss.elastic.co/t/wild-card-query-to-match-the-multiple-field-values/244351 "2020-08-10T06:48:02Z")
How to frame the wildcard query which can search for the match in all searchable fields. I have already checked the following. https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-wildcard-query.ht… --- ## [Logstash Error](https://discuss.elastic.co/t/logstash-error/244343)
**Author:** [@Amantha](https://discuss.elastic.co/u/Amantha)\ **Replies:** 1\ **Last updated:** [August 10, 2020, 6:26am UTC](https://discuss.elastic.co/t/logstash-error/244343 "2020-08-10T06:26:54Z")
I run bin/logstash -e 'input { stdin { } } output { stdout {} }' command in linux terminal. But it give the following error. OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and … --- ## [Elasticsearch use case implementation help](https://discuss.elastic.co/t/elasticsearch-use-case-implementation-help/244300)
**Author:** [@ocmvin](https://discuss.elastic.co/u/ocmvin)\ **Replies:** 6\ **Last updated:** [August 10, 2020, 5:18am UTC](https://discuss.elastic.co/t/elasticsearch-use-case-implementation-help/244300 "2020-08-10T05:18:32Z")
I was wondering about elastic search use case where as per current implementation we have to search best wholeseller for a shopkeeper where Currently we are executing individual 3 queries agains relational DB (postgre… --- ## [Upgrading 1.x to 7.x](https://discuss.elastic.co/t/upgrading-1-x-to-7-x/244284)
**Author:** [@Tulasinadh\_V](https://discuss.elastic.co/u/Tulasinadh_V)\ **Replies:** 8\ **Last updated:** [August 10, 2020, 5:18am UTC](https://discuss.elastic.co/t/upgrading-1-x-to-7-x/244284 "2020-08-10T05:18:11Z")
Hi Team, My current organization using the Elastic Search 1.x and there was a plan to upgrade it to the latest stable version(7.x). Please suggest the better way to handle this without any downtime Thanks in advance --- ## [Visualization - field not available for selection - Kibana](https://discuss.elastic.co/t/visualization-field-not-available-for-selection-kibana/244226)
**Author:** [@al-yakubovich](https://discuss.elastic.co/u/al-yakubovich)\ **Replies:** 1\ **Last updated:** [August 10, 2020, 4:57am UTC](https://discuss.elastic.co/t/visualization-field-not-available-for-selection-kibana/244226 "2020-08-10T04:57:26Z")
Hello. I have problem with visualization of a filed. I am trying to import the csv file via Kibana. I am getting the next results: As you can see a filed "Test" in some reason is red. After I've imported it I wanted… --- ## [How to retrieve the last page of my documents even if it is more than 10,000th document?](https://discuss.elastic.co/t/how-to-retrieve-the-last-page-of-my-documents-even-if-it-is-more-than-10-000th-document/244331)
**Author:** [@Noctis17](https://discuss.elastic.co/u/Noctis17)\ **Replies:** 1\ **Last updated:** [August 10, 2020, 4:38am UTC](https://discuss.elastic.co/t/how-to-retrieve-the-last-page-of-my-documents-even-if-it-is-more-than-10-000th-document/244331 "2020-08-10T04:38:57Z")
Hello and good day! As the title says, we're expecting that we're able to get the last page of our search. But unfortunately, we're encountering an error message: Things beforehand: We're aware the with the relations… --- ## [Convert epoch time columns to date in lostash config file](https://discuss.elastic.co/t/convert-epoch-time-columns-to-date-in-lostash-config-file/244122)
**Author:** [@Bucky101](https://discuss.elastic.co/u/Bucky101)\ **Replies:** 2\ **Last updated:** [August 10, 2020, 4:35am UTC](https://discuss.elastic.co/t/convert-epoch-time-columns-to-date-in-lostash-config-file/244122 "2020-08-10T04:35:26Z")
Hey as per below, i have am polling a http and passing through the csv filter pulling date which works fine. However I need to convert the epoch timestamp to readable date and time. I have tried a few different ways wi… --- ## [How to manage phisycal logs file after moving to ELK 5:12 if we want to delete text files](https://discuss.elastic.co/t/how-to-manage-phisycal-logs-file-after-moving-to-elk-5-12-if-we-want-to-delete-text-files/243555)
**Author:** [@Puneeth\_S\_B\_Gowda1](https://discuss.elastic.co/u/Puneeth_S_B_Gowda1)\ **Replies:** 2\ **Last updated:** [August 10, 2020, 4:18am UTC](https://discuss.elastic.co/t/how-to-manage-phisycal-logs-file-after-moving-to-elk-5-12-if-we-want-to-delete-text-files/243555 "2020-08-10T04:18:29Z")
how to manage physical logs file after moving to ELK if we want to delete text files after moving to ELK how do we do? --- ## [Delete raw text files once file beat forwarded to ELK](https://discuss.elastic.co/t/delete-raw-text-files-once-file-beat-forwarded-to-elk/244332)
**Author:** [@Puneeth\_S\_B\_Gowda1](https://discuss.elastic.co/u/Puneeth_S_B_Gowda1)\ **Replies:** 1\ **Last updated:** [August 10, 2020, 4:17am UTC](https://discuss.elastic.co/t/delete-raw-text-files-once-file-beat-forwarded-to-elk/244332 "2020-08-10T04:17:09Z")
Yes it's outside file beat function but is there any way or tool to delete these files from window OS server once file beat forward to Elastic search as we don't need these physical files anymore as we have these logs in… --- ## [ES Snapshot Delete](https://discuss.elastic.co/t/es-snapshot-delete/243902)
**Author:** [@bhuvaneshdct](https://discuss.elastic.co/u/bhuvaneshdct)\ **Replies:** 5\ **Last updated:** [August 10, 2020, 3:37am UTC](https://discuss.elastic.co/t/es-snapshot-delete/243902 "2020-08-10T03:37:23Z")
Elasticsearch backups are always incremental. Let's say I have a daily backup job. After one week I have 7 snapshots. On the 8th day if Im going to delete the day1's snapshot, then the rest of the snapshots will become … --- ## [Looking for recommendations on elasticsearch set up for logging](https://discuss.elastic.co/t/looking-for-recommendations-on-elasticsearch-set-up-for-logging/243947)
**Author:** [@sbk-elk](https://discuss.elastic.co/u/sbk-elk)\ **Replies:** 9\ **Last updated:** [August 10, 2020, 2:38am UTC](https://discuss.elastic.co/t/looking-for-recommendations-on-elasticsearch-set-up-for-logging/243947 "2020-08-10T02:38:58Z")
Hi, I am looking for recommendations on spanning my cluster on cloud across multi region. Any sample ideas? The problem statement is as below and i don't see much info on a set up like this: -- Need to connect my apps… --- ## [Export raw data of Kibana dashboard shot to CSV](https://discuss.elastic.co/t/export-raw-data-of-kibana-dashboard-shot-to-csv/244322)
**Author:** [@liron\_gofberg](https://discuss.elastic.co/u/liron_gofberg)\ **Replies:** 1\ **Last updated:** [August 9, 2020, 11:29pm UTC](https://discuss.elastic.co/t/export-raw-data-of-kibana-dashboard-shot-to-csv/244322 "2020-08-09T23:29:29Z")
I want to get csv report with all the raw data of a specific shot of dashboard visualizations ? do I need to create a script for that? and how can I do that from Kibana dashboard? (without script, raw data for specif… --- ## [Search query for Address Search](https://discuss.elastic.co/t/search-query-for-address-search/243912)
**Author:** [@allAbout\_Gaming](https://discuss.elastic.co/u/allAbout_Gaming)\ **Replies:** 1\ **Last updated:** [August 9, 2020, 11:14pm UTC](https://discuss.elastic.co/t/search-query-for-address-search/243912 "2020-08-09T23:14:47Z")
Hi All , Need help to frame a search query that will be able to search address. We have fields like House Name , Street Name, City, Country. We have concatenated all fields into a single field. But I am not able to fram… --- ## [A kind of transposition - is it possible](https://discuss.elastic.co/t/a-kind-of-transposition-is-it-possible/243921)
**Author:** [@Raster](https://discuss.elastic.co/u/Raster)\ **Replies:** 1\ **Last updated:** [August 9, 2020, 11:14pm UTC](https://discuss.elastic.co/t/a-kind-of-transposition-is-it-possible/243921 "2020-08-09T23:14:02Z")
Hi, Let's say I have data in a table with columnames of key, col1, col2, col3. Note name of first column is key in this example- could be anything. Can I have this data converted into a table having these columns - key,… --- ## [Cisco ESA-WSA parser](https://discuss.elastic.co/t/cisco-esa-wsa-parser/243917)
**Author:** [@stressedsalmon](https://discuss.elastic.co/u/stressedsalmon)\ **Replies:** 1\ **Last updated:** [August 9, 2020, 11:13pm UTC](https://discuss.elastic.co/t/cisco-esa-wsa-parser/243917 "2020-08-09T23:13:28Z")
Hello, Does the current default Cisco parser have capability of parsing Cisco Web security appliance and Email security appliance? I am trying to log these machines and it seems like the default Cisco parser inst worki… --- ## [Usage of coordinating node for threadpool or http request limits](https://discuss.elastic.co/t/usage-of-coordinating-node-for-threadpool-or-http-request-limits/243964)
**Author:** [@anon17386273](https://discuss.elastic.co/u/anon17386273)\ **Replies:** 1\ **Last updated:** [August 9, 2020, 11:05pm UTC](https://discuss.elastic.co/t/usage-of-coordinating-node-for-threadpool-or-http-request-limits/243964 "2020-08-09T23:05:54Z")
I read through elasticsearch and understood that there is no way to limit the connections by users I came across the topic on threadpool size configuration per nodes. https://www.elastic.co/guide/en/elasticsearch/refer… --- ## [Access to latest version as a DEB](https://discuss.elastic.co/t/access-to-latest-version-as-a-deb/244168)
**Author:** [@cuttlefishjones](https://discuss.elastic.co/u/cuttlefishjones)\ **Replies:** 1\ **Last updated:** [August 9, 2020, 10:56pm UTC](https://discuss.elastic.co/t/access-to-latest-version-as-a-deb/244168 "2020-08-09T22:56:36Z")
Hi, is there anywhere I can get access to the latest version of Filebeat as a DEB file. We don't have access to a toolchain on the machines we are working with to compile our own from source. --- ## [X-pack license issue](https://discuss.elastic.co/t/x-pack-license-issue/244112)
**Author:** [@kittu9999](https://discuss.elastic.co/u/kittu9999)\ **Replies:** 2\ **Last updated:** [August 9, 2020, 10:55pm UTC](https://discuss.elastic.co/t/x-pack-license-issue/244112 "2020-08-09T22:55:18Z")
Hi, we are running elasticsearch 5.2.1 version and our x-pack license was expired. so we want to update the license for one year. We have submitted a request to get the new license, we got an email with the new license… --- ## [Grant access to Stack Monitoring tab](https://discuss.elastic.co/t/grant-access-to-stack-monitoring-tab/244185)
**Author:** [@Thomas74](https://discuss.elastic.co/u/Thomas74)\ **Replies:** 1\ **Last updated:** [August 9, 2020, 10:54pm UTC](https://discuss.elastic.co/t/grant-access-to-stack-monitoring-tab/244185 "2020-08-09T22:54:10Z")
Hi, I would like to grant access to Stack monitoring for --- ## [Unable to get Suricata dashboards](https://discuss.elastic.co/t/unable-to-get-suricata-dashboards/244326)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 0\ **Last updated:** [August 9, 2020, 10:11pm UTC](https://discuss.elastic.co/t/unable-to-get-suricata-dashboards/244326 "2020-08-09T22:11:21Z")
Hi there guys. Im new to Elastic and im getting a problem. I have an ELK and suricata on the same machine. I use filebeats to collect the suricata logs directly to elastic. In kibana i can see all the logs in the discove… --- ## [Dockerizing a working ELK project, 'Dead ES instance'](https://discuss.elastic.co/t/dockerizing-a-working-elk-project-dead-es-instance/243639)
**Author:** [@kl29](https://discuss.elastic.co/u/kl29)\ **Replies:** 6\ **Last updated:** [August 9, 2020, 10:18pm UTC](https://discuss.elastic.co/t/dockerizing-a-working-elk-project-dead-es-instance/243639 "2020-08-09T22:18:09Z")
My setup works without Dockerizing. Now, making a Dockerized project, logstash cannot connect to the ES instance. I set http.host: "0.0.0.0" in logstash.yml, and my pipeline.conf is: input { exec { command =\> "loc… --- ## [How to upload a file into ElastiSearch](https://discuss.elastic.co/t/how-to-upload-a-file-into-elastisearch/243491)
**Author:** [@noor\_basha](https://discuss.elastic.co/u/noor_basha)\ **Replies:** 11\ **Last updated:** [August 9, 2020, 9:35pm UTC](https://discuss.elastic.co/t/how-to-upload-a-file-into-elastisearch/243491 "2020-08-09T21:35:39Z")
Hi I am new to ELK, I need to upload different types of files into ELASTIC SEARCH, is it possible to do that. if it is anyone can please help me how to do with sample code. As of now, I am doing with reading the file an… --- ## [Not able to see all fields when trying to create visualisation](https://discuss.elastic.co/t/not-able-to-see-all-fields-when-trying-to-create-visualisation/244058)
**Author:** [@Dinesh\_Potey](https://discuss.elastic.co/u/Dinesh_Potey)\ **Replies:** 3\ **Last updated:** [August 9, 2020, 8:09pm UTC](https://discuss.elastic.co/t/not-able-to-see-all-fields-when-trying-to-create-visualisation/244058 "2020-08-09T20:09:29Z")
Hi , I am trying to create error dashboard for which firstly I have to create a visualization out of my Index pattern. I am not able to see all the elements of my xml when I am trying to filter out to create the visuali… --- ## [Get service-now.com data](https://discuss.elastic.co/t/get-service-now-com-data/244320)
**Author:** [@netscape](https://discuss.elastic.co/u/netscape)\ **Replies:** 1\ **Last updated:** [August 9, 2020, 6:53pm UTC](https://discuss.elastic.co/t/get-service-now-com-data/244320 "2020-08-09T18:53:28Z")
Hi, we´re using servicenow.com system and I want to have stats of service-now tickets (INC|REQ) in our ELK. Service-now have an API, but how can I retrieve only new tickets since last sync? Anybody got an idea? --- ## [Logstash timestamp issue - the log line date is one hour ahead the actual date](https://discuss.elastic.co/t/logstash-timestamp-issue-the-log-line-date-is-one-hour-ahead-the-actual-date/244303)
**Author:** [@Muhammad\_Badawy](https://discuss.elastic.co/u/Muhammad_Badawy)\ **Replies:** 7\ **Last updated:** [August 9, 2020, 6:00pm UTC](https://discuss.elastic.co/t/logstash-timestamp-issue-the-log-line-date-is-one-hour-ahead-the-actual-date/244303 "2020-08-09T18:00:37Z")
Hello, I'm trying to read input from JDBC and applied date filter but logstash logs is one hour ahead the actual date. I don't where this difference came from. Logstash conf file input { jdbc { jdbc\_driver\_library =\> "… --- ## [\[ERROR\]\[o.e.x.m.c.n.NodeStatsCollector\] collector \[node\_stats\] timed out when collecting data](https://discuss.elastic.co/t/error-o-e-x-m-c-n-nodestatscollector-collector-node-stats-timed-out-when-collecting-data/244194)
**Author:** [@Burga](https://discuss.elastic.co/u/Burga)\ **Replies:** 6\ **Last updated:** [August 9, 2020, 5:32pm UTC](https://discuss.elastic.co/t/error-o-e-x-m-c-n-nodestatscollector-collector-node-stats-timed-out-when-collecting-data/244194 "2020-08-09T17:32:49Z")
Hi Guys , we just have an issue with part of the logs haven't been indexed , in almost all elastic nodes logs I see error : \[ERROR\]\[o.e.x.m.c.n.NodeStatsCollector\] collector \[node\_stats\] timed out when collecting … --- ## [Transform indices show green but Regular indices shows yellow status](https://discuss.elastic.co/t/transform-indices-show-green-but-regular-indices-shows-yellow-status/243233)
**Author:** [@sanjaysubramanian](https://discuss.elastic.co/u/sanjaysubramanian)\ **Replies:** 4\ **Last updated:** [August 9, 2020, 5:21pm UTC](https://discuss.elastic.co/t/transform-indices-show-green-but-regular-indices-shows-yellow-status/243233 "2020-08-09T17:21:55Z")
Hi all ES and K version = 7.7.0 I am using a one node development machine that has ES and Kibana running. All my indices display a status YELLOW (understandable because I have one node). However ALL my transform indic… --- ## [Kibana dashboard not showing data lower resolution 15 minutes from metricbeat](https://discuss.elastic.co/t/kibana-dashboard-not-showing-data-lower-resolution-15-minutes-from-metricbeat/244243)
**Author:** [@nino](https://discuss.elastic.co/u/nino)\ **Replies:** 1\ **Last updated:** [August 9, 2020, 4:21pm UTC](https://discuss.elastic.co/t/kibana-dashboard-not-showing-data-lower-resolution-15-minutes-from-metricbeat/244243 "2020-08-09T16:21:40Z")
Dear all, kibana is not showing data on tvsb panel if i select a time period lower than \[15 minutes -\> now\] i have an empty chart. 15 min -\> now 5 min -\> now This is happening with all tvsb time series charts --- ## [Increasing heap size - Logstash](https://discuss.elastic.co/t/increasing-heap-size-logstash/244310)
**Author:** [@Natarajan](https://discuss.elastic.co/u/Natarajan)\ **Replies:** 0\ **Last updated:** [August 9, 2020, 4:13pm UTC](https://discuss.elastic.co/t/increasing-heap-size-logstash/244310 "2020-08-09T16:13:12Z")
I am using Logstash 7.6.2 and I set LS\_JAVA\_OPTS="-Xmx2g -Xms2g" as evirnoment variable in docker command. I am not sure it is reflected in docker container . How can we validate this once we set from command. --- ## [Grok filter not adding new fields](https://discuss.elastic.co/t/grok-filter-not-adding-new-fields/240825)
**Author:** [@vamshisiddarth](https://discuss.elastic.co/u/vamshisiddarth)\ **Replies:** 3\ **Last updated:** [August 9, 2020, 1:26pm UTC](https://discuss.elastic.co/t/grok-filter-not-adding-new-fields/240825 "2020-08-09T13:26:02Z")
We have the below grok filter configured for our journlabeat. The same was deployed on our local for filebeat was working fine but isn't adding the new fields on journalbeat. filter { grok { patterns\_dir =\> \[… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1877) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1879)