# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1891 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1892 --- ## [Vega transform dynamic groupby aggregate](https://discuss.elastic.co/t/vega-transform-dynamic-groupby-aggregate/243504)
**Author:** [@dataplatform12345](https://discuss.elastic.co/u/dataplatform12345)\ **Replies:** 1\ **Last updated:** [August 3, 2020, 1:44pm UTC](https://discuss.elastic.co/t/vega-transform-dynamic-groupby-aggregate/243504 "2020-08-03T13:44:21Z")
Is It possible to keep the groupby field list dynamic in transform type “aggregate” and allow the user to pass one or more fields to groupby operation during usage time ? --- ## [File path in connection string](https://discuss.elastic.co/t/file-path-in-connection-string/243578)
**Author:** [@Bob\_Schmidt](https://discuss.elastic.co/u/Bob_Schmidt)\ **Replies:** 0\ **Last updated:** [August 3, 2020, 1:26pm UTC](https://discuss.elastic.co/t/file-path-in-connection-string/243578 "2020-08-03T13:26:22Z")
We are trying to connect to a derby database that has a file path in the conncetion string jdbc:derby://host:port/c:path\_to\_database. We have a successfull connection when using datagrip but with logstash we are getting … --- ## [How to reference filebeat module fields in logstash filter?](https://discuss.elastic.co/t/how-to-reference-filebeat-module-fields-in-logstash-filter/242001)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 5\ **Last updated:** [August 3, 2020, 1:18pm UTC](https://discuss.elastic.co/t/how-to-reference-filebeat-module-fields-in-logstash-filter/242001 "2020-08-03T13:18:53Z")
We have filebeat apache module enabled which sends to data to logstash for further enrichment (geoip, add more fields for our visualizations etc). I tried this one but im not sure if its possible. this is what we're … --- ## [How to Replace a failed node with new node with same name and IP](https://discuss.elastic.co/t/how-to-replace-a-failed-node-with-new-node-with-same-name-and-ip/243518)
**Author:** [@Shoaib\_Rashid](https://discuss.elastic.co/u/Shoaib_Rashid)\ **Replies:** 6\ **Last updated:** [August 3, 2020, 1:18pm UTC](https://discuss.elastic.co/t/how-to-replace-a-failed-node-with-new-node-with-same-name-and-ip/243518 "2020-08-03T13:18:51Z")
Hello Everyone I Just want to know is there any way to replace an elasticsearch node with a new node having same name and IP in case of node failure. I have 3 dedicated master nodes and 3 Separate data nodes with repil… --- ## [Scripted field](https://discuss.elastic.co/t/scripted-field/242881)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 4\ **Last updated:** [August 3, 2020, 1:09pm UTC](https://discuss.elastic.co/t/scripted-field/242881 "2020-08-03T13:09:44Z")
Hi everyone I created a scripted field to extract the hour of the week from @timestamp doc\['@timestamp'\].value.hour and its working fine. But when i try to extract the day of week using this query in dev tools GET f… --- ## [Import csv files to two different index](https://discuss.elastic.co/t/import-csv-files-to-two-different-index/242456)
**Author:** [@peretz\_shlomi](https://discuss.elastic.co/u/peretz_shlomi)\ **Replies:** 5\ **Last updated:** [August 3, 2020, 1:09pm UTC](https://discuss.elastic.co/t/import-csv-files-to-two-different-index/242456 "2020-08-03T13:09:25Z")
hello I want to import two different CSV file types into two different index. What is the right way to do it ? --- ## [Winlogbeat not writing all events to Elasticsearch](https://discuss.elastic.co/t/winlogbeat-not-writing-all-events-to-elasticsearch/243559)
**Author:** [@mozam](https://discuss.elastic.co/u/mozam)\ **Replies:** 2\ **Last updated:** [August 3, 2020, 12:42pm UTC](https://discuss.elastic.co/t/winlogbeat-not-writing-all-events-to-elasticsearch/243559 "2020-08-03T12:42:24Z")
Hello, I'm using the Elastic Stack version 7.8.0 ( Winlogbeat -\> Elasticsearch pipeline) in Windows 10 Operating System . Issue : Winlogbeat not capturing all the events generated in Windows Machine. For eg: (Audit tri… --- ## [Filebeat struggles](https://discuss.elastic.co/t/filebeat-struggles/243523)
**Author:** [@vladtepes](https://discuss.elastic.co/u/vladtepes)\ **Replies:** 5\ **Last updated:** [August 3, 2020, 12:24pm UTC](https://discuss.elastic.co/t/filebeat-struggles/243523 "2020-08-03T12:24:04Z")
I must say, that I am confident it is something simple, but am struggling to make the iis module work in filebeat. :confused: After you enable the iis module and set a custom path, it is throwing an error that Blockqu… --- ## [Using snapshots for replication](https://discuss.elastic.co/t/using-snapshots-for-replication/243520)
**Author:** [@eaa](https://discuss.elastic.co/u/eaa)\ **Replies:** 5\ **Last updated:** [August 3, 2020, 12:20pm UTC](https://discuss.elastic.co/t/using-snapshots-for-replication/243520 "2020-08-03T12:20:58Z")
Hi everyone, Say I can't afford the license required for the CCR feature (https://www.elastic.co/guide/en/elasticsearch/reference/current/xpack-ccr.html) but have two Elasticsearch dbs and need to replicate one into ano… --- ## [Failed to execute \[SearchRequest](https://discuss.elastic.co/t/failed-to-execute-searchrequest/243149)
**Author:** [@jie.li](https://discuss.elastic.co/u/jie.li)\ **Replies:** 5\ **Last updated:** [August 3, 2020, 12:19pm UTC](https://discuss.elastic.co/t/failed-to-execute-searchrequest/243149 "2020-08-03T12:19:02Z")
Hi Guys, i hava issues with qurrey, client is timed out. I am still new to Elasticsearch, please correct me if any wrong. Thanks \[2020-07-30T03:40:04,998\]\[DEBUG\]\[o.e.a.s.TransportSearchAction\] \[node-02\] \[goods04\]\[3\], … --- ## [How to add multiple logstash filter](https://discuss.elastic.co/t/how-to-add-multiple-logstash-filter/243554)
**Author:** [@Puneeth\_S\_B\_Gowda1](https://discuss.elastic.co/u/Puneeth_S_B_Gowda1)\ **Replies:** 0\ **Last updated:** [August 3, 2020, 12:06pm UTC](https://discuss.elastic.co/t/how-to-add-multiple-logstash-filter/243554 "2020-08-03T12:06:11Z")
how to add multiple logstash filter example my source file will come with JSON & XML i have 2 different logstash.conf for xml and JSON log so how do i add two logstash,conf? 5:16 JSON logs will parse from JSON filter a… --- ## [Filebeat configmap change reload](https://discuss.elastic.co/t/filebeat-configmap-change-reload/243548)
**Author:** [@raulgs](https://discuss.elastic.co/u/raulgs)\ **Replies:** 0\ **Last updated:** [August 3, 2020, 11:46am UTC](https://discuss.elastic.co/t/filebeat-configmap-change-reload/243548 "2020-08-03T11:46:53Z")
Hi guys, I would be interesting in how you perform an update on filebeat. From what I have seen the live config reloading is not supported for the filebeat.yml. This means currently that after every change to that fil… --- ## [Can't send csv with watcher](https://discuss.elastic.co/t/cant-send-csv-with-watcher/243323)
**Author:** [@Marvin66](https://discuss.elastic.co/u/Marvin66)\ **Replies:** 3\ **Last updated:** [August 3, 2020, 11:46am UTC](https://discuss.elastic.co/t/cant-send-csv-with-watcher/243323 "2020-08-03T11:46:25Z")
Hi, I've just created my first watcher for sending a pdf report via email and it works fine. When I replace the URL for the pdf report with an URL for a csv file I get the following response: {"statusCode":502,"error":"… --- ## [Messages that contain more than 32766 bytes in a field](https://discuss.elastic.co/t/messages-that-contain-more-than-32766-bytes-in-a-field/243545)
**Author:** [@sarabande](https://discuss.elastic.co/u/sarabande)\ **Replies:** 0\ **Last updated:** [August 3, 2020, 11:36am UTC](https://discuss.elastic.co/t/messages-that-contain-more-than-32766-bytes-in-a-field/243545 "2020-08-03T11:36:20Z")
Hi, I have a general question. What happens with messages that contain fields longer than 32766 bytes? They will cause the error saying something like "Could not index event to Elasticsearch" and "caused\_by"=\>{"type"=\>"… --- ## [Timeout exception when connecting to the Elastic search deployed in K8s cluster](https://discuss.elastic.co/t/timeout-exception-when-connecting-to-the-elastic-search-deployed-in-k8s-cluster/243498)
**Author:** [@vanikr](https://discuss.elastic.co/u/vanikr)\ **Replies:** 5\ **Last updated:** [August 3, 2020, 11:12am UTC](https://discuss.elastic.co/t/timeout-exception-when-connecting-to-the-elastic-search-deployed-in-k8s-cluster/243498 "2020-08-03T11:12:52Z")
Error 'Exception in thread "main" java.net.ConnectException: Timeout connecting to \[/IP:80\] at org.elasticsearch.client.RestClient.extractAndWrapCause(RestClient.java:823) at org.elasticsearch.client.RestClient.perfor… --- ## [Does early termination (sorted index) kick in in this case?](https://discuss.elastic.co/t/does-early-termination-sorted-index-kick-in-in-this-case/243370)
**Author:** [@jmlucjav](https://discuss.elastic.co/u/jmlucjav)\ **Replies:** 2\ **Last updated:** [August 3, 2020, 11:27am UTC](https://discuss.elastic.co/t/does-early-termination-sorted-index-kick-in-in-this-case/243370 "2020-08-03T11:27:34Z")
I have such an index (ES 7.4): "index": { "sort.field": "date", "sort.order": "desc", And I query like this: { "sort": \[ "\_score", { "date": { "o… --- ## [How to access ES from hosts other than localhost?](https://discuss.elastic.co/t/how-to-access-es-from-hosts-other-than-localhost/243513)
**Author:** [@Aj\_t](https://discuss.elastic.co/u/Aj_t)\ **Replies:** 2\ **Last updated:** [August 3, 2020, 11:09am UTC](https://discuss.elastic.co/t/how-to-access-es-from-hosts-other-than-localhost/243513 "2020-08-03T11:09:26Z")
I just have one node where I am running ES and Kibana. In addition to the localhost, I would like to access ES from another host (remote\_ip1) as well. But, I would like to avoid setting the network.host to 0.0.0.0. When … --- ## [Kv split into next row](https://discuss.elastic.co/t/kv-split-into-next-row/241024)
**Author:** [@Puneeth\_S\_B\_Gowda1](https://discuss.elastic.co/u/Puneeth_S_B_Gowda1)\ **Replies:** 1\ **Last updated:** [August 3, 2020, 11:08am UTC](https://discuss.elastic.co/t/kv-split-into-next-row/241024 "2020-08-03T11:08:18Z")
input { beats { port =\> 5044 } } filter { kv {field\_split =\> "message" } kv { source =\> "n id" field\_split =\> "," }} output { elasticsearch { hosts =\> \["http://localhost:9200"\] index =\> "atpidev1" } } 11:… --- ## [How to select only one branch in bool query](https://discuss.elastic.co/t/how-to-select-only-one-branch-in-bool-query/242877)
**Author:** [@gitterhh](https://discuss.elastic.co/u/gitterhh)\ **Replies:** 1\ **Last updated:** [August 3, 2020, 11:02am UTC](https://discuss.elastic.co/t/how-to-select-only-one-branch-in-bool-query/242877 "2020-08-03T11:02:20Z")
I have a list of documents \[ { "shortName": "CA", "longName": "California" }, { "shortName": "New York", "longName": "New York" }, \] How to configure the query to select only the first field tha… --- ## [How to filter docs by text field length?](https://discuss.elastic.co/t/how-to-filter-docs-by-text-field-length/242941)
**Author:** [@IlyaEvseev](https://discuss.elastic.co/u/IlyaEvseev)\ **Replies:** 1\ **Last updated:** [August 3, 2020, 10:55am UTC](https://discuss.elastic.co/t/how-to-filter-docs-by-text-field-length/242941 "2020-08-03T10:55:01Z")
There is an ElasticSearch 7.3.2 instance, with index containing "message" field of text type. I need to get all docs with message length longer than 100000 chars (1million): curl -XPOST -H 'Content-Type: application/js… --- ## [Filebeat does not create index template](https://discuss.elastic.co/t/filebeat-does-not-create-index-template/243083)
**Author:** [@snolfi](https://discuss.elastic.co/u/snolfi)\ **Replies:** 10\ **Last updated:** [August 3, 2020, 10:36am UTC](https://discuss.elastic.co/t/filebeat-does-not-create-index-template/243083 "2020-08-03T10:36:39Z")
Hello, as said in the object, i'm using filebeat but for some reason its index template wasn't created on ES, the strange thing is that with the same configuration metricbeat's template was created. I report settings… --- ## [java.io.IOException: An established connection was aborted by the software in your host machine](https://discuss.elastic.co/t/java-io-ioexception-an-established-connection-was-aborted-by-the-software-in-your-host-machine/242658)
**Author:** [@chelawatankit](https://discuss.elastic.co/u/chelawatankit)\ **Replies:** 4\ **Last updated:** [August 3, 2020, 10:35am UTC](https://discuss.elastic.co/t/java-io-ioexception-an-established-connection-was-aborted-by-the-software-in-your-host-machine/242658 "2020-08-03T10:35:10Z")
Hi Team, We are using single node cluster of elasticsearch 7.1.1 version on one of our machine. System details as follow OS : windows server 2012 R2 Xmx : 6GB System RAM : 64 GB We are getting following error freque… --- ## [How do i close async high level rest client](https://discuss.elastic.co/t/how-do-i-close-async-high-level-rest-client/243289)
**Author:** [@prutum](https://discuss.elastic.co/u/prutum)\ **Replies:** 1\ **Last updated:** [August 3, 2020, 10:31am UTC](https://discuss.elastic.co/t/how-do-i-close-async-high-level-rest-client/243289 "2020-08-03T10:31:42Z")
Hi, I am using Async high level rest client. I am pushing 400 requests to elastic search using async client. It is performant and gives me good parallelization. However I am not able to figure out how to close the clien… --- ## [\[HADOOP\]Connection and configuration Elastic- Hadoop](https://discuss.elastic.co/t/hadoop-connection-and-configuration-elastic-hadoop/242888)
**Author:** [@LeonardoC](https://discuss.elastic.co/u/LeonardoC)\ **Replies:** 2\ **Last updated:** [August 3, 2020, 10:25am UTC](https://discuss.elastic.co/t/hadoop-connection-and-configuration-elastic-hadoop/242888 "2020-08-03T10:25:30Z")
Hi all, This is my first message on the elastic community. I'm also new to elasticsearch, and little bit more skilled on Hadoop-Spark system. Now, I need to bind Elasticsearch and logstash wth the Hadoop ecosystem, and… --- ## [Tracking user time that is spent on kibana](https://discuss.elastic.co/t/tracking-user-time-that-is-spent-on-kibana/241512)
**Author:** [@Michael\_Tsikerdekis](https://discuss.elastic.co/u/Michael_Tsikerdekis)\ **Replies:** 2\ **Last updated:** [August 3, 2020, 10:14am UTC](https://discuss.elastic.co/t/tracking-user-time-that-is-spent-on-kibana/241512 "2020-08-03T10:14:57Z")
Is there any way that I can track the amount of user time that is spent on kibana? Even indirectly through events or actions? If this is possible to be stored in elasticsearch and navigated through kibana, then even bet… --- ## [Analysis of identifiers with dashes](https://discuss.elastic.co/t/analysis-of-identifiers-with-dashes/243350)
**Author:** [@romansitina](https://discuss.elastic.co/u/romansitina)\ **Replies:** 1\ **Last updated:** [August 3, 2020, 10:11am UTC](https://discuss.elastic.co/t/analysis-of-identifiers-with-dashes/243350 "2020-08-03T10:11:54Z")
Hello, I'm trying to solve this issue: I have text Information about CD-3568 can be found in document DKF-98346-B-261 and I need to get it analysed as information about cd-3568 can be found in document dkf 98346 … --- ## [Newbie question - need suggestion - NFS share + 1 node](https://discuss.elastic.co/t/newbie-question-need-suggestion-nfs-share-1-node/243534)
**Author:** [@dan00bielb](https://discuss.elastic.co/u/dan00bielb)\ **Replies:** 1\ **Last updated:** [August 3, 2020, 10:00am UTC](https://discuss.elastic.co/t/newbie-question-need-suggestion-nfs-share-1-node/243534 "2020-08-03T10:00:17Z")
Good morning community, i am a newnubbie to ES and i would like a design suggestion from you. We need to index 5 years old logs taken from a SIEM from a subset of applications, we have one server (system spec should be… --- ## [Master not discovered exception for two node cluster](https://discuss.elastic.co/t/master-not-discovered-exception-for-two-node-cluster/243452)
**Author:** [@abi.mc](https://discuss.elastic.co/u/abi.mc)\ **Replies:** 4\ **Last updated:** [August 3, 2020, 9:56am UTC](https://discuss.elastic.co/t/master-not-discovered-exception-for-two-node-cluster/243452 "2020-08-03T09:56:01Z")
I have setup a two node production ELK cluster using 7.8.0 using docker on two hosts VMs. Transport and HTTP encryption has been enabled. Current master node \[elastic@pelk01 ~\]$ curl -k https://127.0.0.1:9200/\_cat/mast… --- ## [Automatic backup like SLM in 6.8 version](https://discuss.elastic.co/t/automatic-backup-like-slm-in-6-8-version/243344)
**Author:** [@Agzem](https://discuss.elastic.co/u/Agzem)\ **Replies:** 1\ **Last updated:** [August 3, 2020, 9:54am UTC](https://discuss.elastic.co/t/automatic-backup-like-slm-in-6-8-version/243344 "2020-08-03T09:54:08Z")
Hi, I'm playing around with snapshot and restore in elasticsearch trying to do automatic backup, but I noticed that in 6.8 version, SLM policy is not available. Is there any methods to automatically take snapshot other… --- ## [ILM Rollover Alias Issues](https://discuss.elastic.co/t/ilm-rollover-alias-issues/243342)
**Author:** [@snolfi](https://discuss.elastic.co/u/snolfi)\ **Replies:** 0\ **Last updated:** [July 31, 2020, 11:22am UTC](https://discuss.elastic.co/t/ilm-rollover-alias-issues/243342 "2020-07-31T11:22:47Z")
Hi all, i discovered a strange error on elk, regarding ILM. Sometimes it happens that on index-management section i see errors logged in this way: illegal\_argument\_exception: index.lifecycle.rollover\_alias \[metric… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1890) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1892)