# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1949 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1950 --- ## [Upgrade elasticsearch from 6.8 to 7.8 date format](https://discuss.elastic.co/t/upgrade-elasticsearch-from-6-8-to-7-8-date-format/240072)
**Author:** [@krishm](https://discuss.elastic.co/u/krishm)\ **Replies:** 0\ **Last updated:** [July 7, 2020, 1:18am UTC](https://discuss.elastic.co/t/upgrade-elasticsearch-from-6-8-to-7-8-date-format/240072 "2020-07-07T01:18:25Z")
Hello There, I am working on elasticsearch upgrade from 6.8 to 7.x. i have a date field using format below and i understand that i need to change the mapping to "uuuu-MM-dd HH:mm:ss" before upgrading to elasticsearch 7.… --- ## [Using other than comma as separator in csv filter](https://discuss.elastic.co/t/using-other-than-comma-as-separator-in-csv-filter/240067)
**Author:** [@Shipper01](https://discuss.elastic.co/u/Shipper01)\ **Replies:** 4\ **Last updated:** [July 7, 2020, 12:53am UTC](https://discuss.elastic.co/t/using-other-than-comma-as-separator-in-csv-filter/240067 "2020-07-07T00:53:01Z")
I have files that has either a semi-colon or pipe as separator. The values within the fields can have commas, so I can't use a commas as separator. I have tried using the csv filter and altering the separator. My conf… --- ## [Alerting Webhook](https://discuss.elastic.co/t/alerting-webhook/240023)
**Author:** [@Rushabh\_Doshi](https://discuss.elastic.co/u/Rushabh_Doshi)\ **Replies:** 1\ **Last updated:** [July 7, 2020, 12:48am UTC](https://discuss.elastic.co/t/alerting-webhook/240023 "2020-07-07T00:48:26Z")
Need to send alert email to my gmail account , what should i set in the host, port, path and key/value Would like to know what values can i enter in these fields, so that an alert email is sent to my gmail account pl… --- ## [Kibana: How to get raw data and aggregate in KQL in a serial fashion?](https://discuss.elastic.co/t/kibana-how-to-get-raw-data-and-aggregate-in-kql-in-a-serial-fashion/239930)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 3\ **Last updated:** [July 7, 2020, 12:23am UTC](https://discuss.elastic.co/t/kibana-how-to-get-raw-data-and-aggregate-in-kql-in-a-serial-fashion/239930 "2020-07-07T00:23:12Z")
I was looking for equivalent of splunk query (i.e. get raw data , then do aggregation on top of that) index=some\_data | stats count by hostname The above will aggregate all the data by hostname and shows the data in n… --- ## [ML jobs with missing documents](https://discuss.elastic.co/t/ml-jobs-with-missing-documents/239966)
**Author:** [@saraKM](https://discuss.elastic.co/u/saraKM)\ **Replies:** 2\ **Last updated:** [July 6, 2020, 11:58pm UTC](https://discuss.elastic.co/t/ml-jobs-with-missing-documents/239966 "2020-07-06T23:58:32Z")
We have some jobs running with high numbers of documents missing. As per elastic ML documents, those checks are done after buckets with the missed documents have been processed and anomaly scores are finalized and “If th… --- ## [Unable to connect to Elasticsearch. Error: Request Timeout after 30000ms another client :)](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-error-request-timeout-after-30000ms-another-client/240022)
**Author:** [@sd99](https://discuss.elastic.co/u/sd99)\ **Replies:** 3\ **Last updated:** [July 6, 2020, 11:58pm UTC](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-error-request-timeout-after-30000ms-another-client/240022 "2020-07-06T23:58:00Z")
Hi, I have installed Elasticsearch in my server and now I am installing Kibana, and there is an error appear with me. ( Unable to connect to Elasticsearch. Error: Request Timeout after 30000ms) I'm also trying to alte… --- ## [Elastic agent RPM doesn't work, neither does Fleet anymore](https://discuss.elastic.co/t/elastic-agent-rpm-doesnt-work-neither-does-fleet-anymore/239679)
**Author:** [@sej7278](https://discuss.elastic.co/u/sej7278)\ **Replies:** 1\ **Last updated:** [July 6, 2020, 11:22pm UTC](https://discuss.elastic.co/t/elastic-agent-rpm-doesnt-work-neither-does-fleet-anymore/239679 "2020-07-06T23:22:13Z")
elastic-agent-7.8.0-x86\_64.rpm on centos 8.2 seems to be corrupt, it installs ok, but when you try to enroll it it seems to be looking in the bin directory for the config and all sorts: $ elastic-agent enroll https://el… --- ## [Customized document to term scoring](https://discuss.elastic.co/t/customized-document-to-term-scoring/239559)
**Author:** [@snakeztc](https://discuss.elastic.co/u/snakeztc)\ **Replies:** 0\ **Last updated:** [July 2, 2020, 12:49am UTC](https://discuss.elastic.co/t/customized-document-to-term-scoring/239559 "2020-07-02T00:49:22Z")
Hi, I am using ES to do research for my learning to rank algorithm. Essentially instead of using TF-IDF or BM25, my scoring function looks like: TF(D, t) = model(D, t) where t is each term in the document. Instead of j… --- ## [ILM run after a change](https://discuss.elastic.co/t/ilm-run-after-a-change/239576)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 0\ **Last updated:** [July 2, 2020, 6:50am UTC](https://discuss.elastic.co/t/ilm-run-after-a-change/239576 "2020-07-02T06:50:32Z")
hello, I have changed the ILM policy, and added a warm/cold phases after 30 days. is there a way to run it over all current indices, so they will be moved to warm/cold storage? for example for this one: GET data-8-00… --- ## [Elk API , scheduled task, Empty Response from search](https://discuss.elastic.co/t/elk-api-scheduled-task-empty-response-from-search/239588)
**Author:** [@itamar\_medyoni](https://discuss.elastic.co/u/itamar_medyoni)\ **Replies:** 1\ **Last updated:** [July 6, 2020, 11:19pm UTC](https://discuss.elastic.co/t/elk-api-scheduled-task-empty-response-from-search/239588 "2020-07-06T23:19:23Z")
Hello all, I have created a python script, which receives data from our cluster, calculates it and labels documents. I use the search , and update by query functions in the script. The script runs well, and the functi… --- ## [Snapshot and Restore 6.8.8 - Null Pointer Exception after Upgrade from 6.2.4 to 6.8.8](https://discuss.elastic.co/t/snapshot-and-restore-6-8-8-null-pointer-exception-after-upgrade-from-6-2-4-to-6-8-8/239628)
**Author:** [@Neha\_Wagholikar](https://discuss.elastic.co/u/Neha_Wagholikar)\ **Replies:** 0\ **Last updated:** [July 2, 2020, 12:07pm UTC](https://discuss.elastic.co/t/snapshot-and-restore-6-8-8-null-pointer-exception-after-upgrade-from-6-2-4-to-6-8-8/239628 "2020-07-02T12:07:25Z")
Hi, I have upgraded my ELK from 6.2.4 to 6.8.8. Used Azure plugin for Snapshot Before Upgrade, my backup was working fine on both Public and Azure Stack. After Upgrade ,On public I am able to take backup but on Azure… --- ## [Recomendations to an offline instalation of ElasticStack](https://discuss.elastic.co/t/recomendations-to-an-offline-instalation-of-elasticstack/239722)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 5\ **Last updated:** [July 6, 2020, 11:11pm UTC](https://discuss.elastic.co/t/recomendations-to-an-offline-instalation-of-elasticstack/239722 "2020-07-06T23:11:38Z")
Hi, Im going to try to install the ElasticStack in an enviroment with no internet access, do you have any recomendation or things to have in mind before the instalation? Thanks. --- ## [Watcher with Heartbeat and monitor status up](https://discuss.elastic.co/t/watcher-with-heartbeat-and-monitor-status-up/239636)
**Author:** [@maadhav](https://discuss.elastic.co/u/maadhav)\ **Replies:** 0\ **Last updated:** [July 2, 2020, 12:52pm UTC](https://discuss.elastic.co/t/watcher-with-heartbeat-and-monitor-status-up/239636 "2020-07-02T12:52:07Z")
Hi Team We've configured Heartbeat to monitor services and got setup Watcher to monitor heartbeat monitor.status to send alert on a Slack channel. Following is the configuration: { "trigger": { "schedule": { … --- ## [Elasticsearch analysis on kibana without logstash ( + alerts or notifications)](https://discuss.elastic.co/t/elasticsearch-analysis-on-kibana-without-logstash-alerts-or-notifications/239613)
**Author:** [@Feriel\_Mufti](https://discuss.elastic.co/u/Feriel_Mufti)\ **Replies:** 11\ **Last updated:** [July 6, 2020, 11:09pm UTC](https://discuss.elastic.co/t/elasticsearch-analysis-on-kibana-without-logstash-alerts-or-notifications/239613 "2020-07-06T23:09:41Z")
Hello, i am using elasticsearch and kibana version 6.8 , and all different other beats , without logstash , so beats passes directly through elasticsearch to visualize the given data on kibana , i want to know how can i… --- ## [GeoIP resolve query in O365 logs](https://discuss.elastic.co/t/geoip-resolve-query-in-o365-logs/239754)
**Author:** [@Ravy](https://discuss.elastic.co/u/Ravy)\ **Replies:** 0\ **Last updated:** [July 3, 2020, 8:27am UTC](https://discuss.elastic.co/t/geoip-resolve-query-in-o365-logs/239754 "2020-07-03T08:27:43Z")
How to fix GeoIP resolve query in O365 logs Error o365, beats\_input\_raw\_event, \_geoip\_lookup\_failure --- ## [How to make elasticsearch turn on automatically](https://discuss.elastic.co/t/how-to-make-elasticsearch-turn-on-automatically/240048)
**Author:** [@Splunk](https://discuss.elastic.co/u/Splunk)\ **Replies:** 5\ **Last updated:** [July 6, 2020, 9:56pm UTC](https://discuss.elastic.co/t/how-to-make-elasticsearch-turn-on-automatically/240048 "2020-07-06T21:56:42Z")
Hi All, I have a prob with elasticsearch, I believe it is installed properly on my mac when I shut down and turn on the laptop it won't turn on again I did installation few time same issues, how u are guys handling this… --- ## [\[FileBeat\] Unable to get X-Pack Monitoring to work](https://discuss.elastic.co/t/filebeat-unable-to-get-x-pack-monitoring-to-work/239721)
**Author:** [@vcc](https://discuss.elastic.co/u/vcc)\ **Replies:** 0\ **Last updated:** [July 3, 2020, 1:41am UTC](https://discuss.elastic.co/t/filebeat-unable-to-get-x-pack-monitoring-to-work/239721 "2020-07-03T01:41:38Z")
Hi All, I'm running into an issue getting X-Pack Monitoring to work with file beat. The setup we have is as follows: Elasticsearch Nodes have security enabled (using self signed certificates via elasticsearch-certutil… --- ## [How to change logstash locale](https://discuss.elastic.co/t/how-to-change-logstash-locale/239729)
**Author:** [@jang](https://discuss.elastic.co/u/jang)\ **Replies:** 1\ **Last updated:** [July 6, 2020, 9:47pm UTC](https://discuss.elastic.co/t/how-to-change-logstash-locale/239729 "2020-07-06T21:47:45Z")
hi. I'm using elastic stack. i want to logstash locale. The default location is 9 hours slower than the area I live in. my logstash.conf index =\> "%{\[@metadata\]\[beat\]}-%{+YYYY.MM.dd}" run it with the above settings… --- ## [Complicated Nested Query](https://discuss.elastic.co/t/complicated-nested-query/239925)
**Author:** [@jacksonpv](https://discuss.elastic.co/u/jacksonpv)\ **Replies:** 0\ **Last updated:** [July 5, 2020, 1:33pm UTC](https://discuss.elastic.co/t/complicated-nested-query/239925 "2020-07-05T13:33:10Z")
Hi Guys Please suggest a query or approach for this problem below Here I have two records in my type called "journey" Record 1 { "journeyid":1, "journeyname":"test1", "journeydetail:\[ { "pickupcode":"Banglore", "… --- ## [Rescorer plugin. How to parse inner hits with original scores](https://discuss.elastic.co/t/rescorer-plugin-how-to-parse-inner-hits-with-original-scores/239976)
**Author:** [@tarmo](https://discuss.elastic.co/u/tarmo)\ **Replies:** 0\ **Last updated:** [July 6, 2020, 8:41am UTC](https://discuss.elastic.co/t/rescorer-plugin-how-to-parse-inner-hits-with-original-scores/239976 "2020-07-06T08:41:14Z")
I create a query to ES: GET my-index/\_search { "query": { "nested": { "inner\_hits": {}, "score\_mode": "max", "path": "my\_nested\_field", "query": { "bool"… --- ## [Log Ingestion from Splunk](https://discuss.elastic.co/t/log-ingestion-from-splunk/240059)
**Author:** [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Replies:** 0\ **Last updated:** [July 6, 2020, 8:31pm UTC](https://discuss.elastic.co/t/log-ingestion-from-splunk/240059 "2020-07-06T20:31:57Z")
I am trying to get logs from Splunk to Logstash. I first tried straight up syslog output from Splunk heavy forwarders to logstash, but that wrote each Windows Event Viewer line to a separate syslog event. I don't want to… --- ## [Unable to compile auditbeat - failing on librpm-dev:arm64](https://discuss.elastic.co/t/unable-to-compile-auditbeat-failing-on-librpm-dev-arm64/240015)
**Author:** [@wls](https://discuss.elastic.co/u/wls)\ **Replies:** 0\ **Last updated:** [July 6, 2020, 1:54pm UTC](https://discuss.elastic.co/t/unable-to-compile-auditbeat-failing-on-librpm-dev-arm64/240015 "2020-07-06T13:54:33Z")
Greetings, I've compiled metricbeat and filebeat successfully. But, on auditbeat, I'm getting this output with 7.8.0. Wonder if anyone else has seen it, and if there are any suggested work-arounds? user@foo:~/go/… --- ## [Error in Kibana :(](https://discuss.elastic.co/t/error-in-kibana/240033)
**Author:** [@sd99](https://discuss.elastic.co/u/sd99)\ **Replies:** 1\ **Last updated:** [July 6, 2020, 7:34pm UTC](https://discuss.elastic.co/t/error-in-kibana/240033 "2020-07-06T19:34:13Z")
I have a problem with Kibana, can anyone help me here :frowning: --- ## [Disk used space is higher than the indices used space](https://discuss.elastic.co/t/disk-used-space-is-higher-than-the-indices-used-space/240025)
**Author:** [@Oxygen\_13](https://discuss.elastic.co/u/Oxygen_13)\ **Replies:** 5\ **Last updated:** [July 6, 2020, 6:34pm UTC](https://discuss.elastic.co/t/disk-used-space-is-higher-than-the-indices-used-space/240025 "2020-07-06T18:34:51Z")
My elk server is having 1000 GB space. When I check the available space showing 96% utilized. however indices used only 160 GB. Could you please help me how can I clear/delete used space, so that I will have more space. … --- ## [Logstash : jdbc - Unable to connect to database](https://discuss.elastic.co/t/logstash-jdbc-unable-to-connect-to-database/239898)
**Author:** [@Amine\_Aloui](https://discuss.elastic.co/u/Amine_Aloui)\ **Replies:** 2\ **Last updated:** [July 6, 2020, 6:18pm UTC](https://discuss.elastic.co/t/logstash-jdbc-unable-to-connect-to-database/239898 "2020-07-06T18:18:23Z")
this is my file : contact.conf input { jdbc { jdbc\_driver\_library =\> "/tmp/postgresql-42.2.12.jar" jdbc\_driver\_class =\> "org.postgresql.Driver" jdbc\_connection\_st… --- ## [Docker filebeat autodiscover not detecting nginx logs](https://discuss.elastic.co/t/docker-filebeat-autodiscover-not-detecting-nginx-logs/239849)
**Author:** [@Fachtna\_Simi](https://discuss.elastic.co/u/Fachtna_Simi)\ **Replies:** 1\ **Last updated:** [July 6, 2020, 6:05pm UTC](https://discuss.elastic.co/t/docker-filebeat-autodiscover-not-detecting-nginx-logs/239849 "2020-07-06T18:05:16Z")
On my mac I am running nginx in a docker file and filebeat in a docker file. docker run -p 80:80 nginx The above command successfully runs nginx which I can visit in the browser and the output is printed to the console… --- ## [Access denied while opening Stack-Monitoring on Kibana 7.8](https://discuss.elastic.co/t/access-denied-while-opening-stack-monitoring-on-kibana-7-8/239947)
**Author:** [@vishakh](https://discuss.elastic.co/u/vishakh)\ **Replies:** 7\ **Last updated:** [July 6, 2020, 5:37pm UTC](https://discuss.elastic.co/t/access-denied-while-opening-stack-monitoring-on-kibana-7-8/239947 "2020-07-06T17:37:55Z")
Stack Intro: I'm running ELK-Stack 7.8 with 3 Cluster-Nodes Enabled XPack security in elasticsearch yml "xpack.security.enabled: true" and also enabled SSL/TLS on Transport and HTTP with below conf: xpack.security.tran… --- ## [Can some one explain how the transform runs it in this scenario](https://discuss.elastic.co/t/can-some-one-explain-how-the-transform-runs-it-in-this-scenario/238888)
**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\ **Replies:** 4\ **Last updated:** [July 6, 2020, 5:26pm UTC](https://discuss.elastic.co/t/can-some-one-explain-how-the-transform-runs-it-in-this-scenario/238888 "2020-07-06T17:26:11Z")
Hi, I am using transform index, and i am grouping the records by day wise to find out max. but the frequency of the transform can be set maximum as 1hour. if the transform runs at next hour will it consider the record… --- ## [High system load on one node in three node cluster](https://discuss.elastic.co/t/high-system-load-on-one-node-in-three-node-cluster/239552)
**Author:** [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\ **Replies:** 6\ **Last updated:** [July 6, 2020, 5:12pm UTC](https://discuss.elastic.co/t/high-system-load-on-one-node-in-three-node-cluster/239552 "2020-07-06T17:12:33Z")
Hello, I'll detail my cluster specs first Versions: All servers use CentOS 8 and Elasticstack 7.6.1 Logstash nodes: LOGSTASH-BEATS (used for sending beats data to Elasticsearch) LOGSTASH-SYSLOG (used for sending vari… --- ## [Machine Learning Analytics Job error](https://discuss.elastic.co/t/machine-learning-analytics-job-error/239884)
**Author:** [@MisterLamp](https://discuss.elastic.co/u/MisterLamp)\ **Replies:** 1\ **Last updated:** [July 6, 2020, 4:55pm UTC](https://discuss.elastic.co/t/machine-learning-analytics-job-error/239884 "2020-07-06T16:55:56Z")
Hi everyone, I have a question concerning Machine Learning Analytics Jobs. I have already created an auditbeat index and data in it. Created also Machine Learning Jobs which I can browse within the Anomaly Detection. We… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1948) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1950)