# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1988 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1989 --- ## [\_dateparsefailure csv date time YYYY-MM-dd HH:mm:ss](https://discuss.elastic.co/t/dateparsefailure-csv-date-time-yyyy-mm-dd-hhss/237725)
**Author:** [@gonzapata](https://discuss.elastic.co/u/gonzapata)\ **Replies:** 0\ **Last updated:** [June 19, 2020, 3:53am UTC](https://discuss.elastic.co/t/dateparsefailure-csv-date-time-yyyy-mm-dd-hhss/237725 "2020-06-19T03:53:55Z")
Hi, I manage to parse message field from a csv to several fields from filebeat to logstash, I want to match a date format (like 2020-06-18 22:36:21) but when I use date and match filter it give me \_dateparsefailure I tr… --- ## [Customize ESJsonLayout](https://discuss.elastic.co/t/customize-esjsonlayout/237724)
**Author:** [@casparxu](https://discuss.elastic.co/u/casparxu)\ **Replies:** 0\ **Last updated:** [June 19, 2020, 3:47am UTC](https://discuss.elastic.co/t/customize-esjsonlayout/237724 "2020-06-19T03:47:12Z")
Hi experts, I'm trying to add some field to es json log output to meet some my owner log collector. Any idea how can I do this? Or I can only user patternLayout by manually making it looks like json? Thanks --- ## [Migrate data from current production Elasticsearch nodes to a new hardware](https://discuss.elastic.co/t/migrate-data-from-current-production-elasticsearch-nodes-to-a-new-hardware/237682)
**Author:** [@kaushalshriyan](https://discuss.elastic.co/u/kaushalshriyan)\ **Replies:** 3\ **Last updated:** [June 19, 2020, 3:35am UTC](https://discuss.elastic.co/t/migrate-data-from-current-production-elasticsearch-nodes-to-a-new-hardware/237682 "2020-06-19T03:35:42Z")
Hi, I am currently running ES (version 7.5.1) three nodes in the cluster mode. ES Node1:- 192.168.0.10 ES Node2 :- 192.168.0.11 ES Node3 :- 192.168.0.12 I want to migrate the data from the above running production clu… --- ## [Add Nested document into the elasticsearch via logstash](https://discuss.elastic.co/t/add-nested-document-into-the-elasticsearch-via-logstash/237660)
**Author:** [@Siva\_Samraj](https://discuss.elastic.co/u/Siva_Samraj)\ **Replies:** 1\ **Last updated:** [June 19, 2020, 3:20am UTC](https://discuss.elastic.co/t/add-nested-document-into-the-elasticsearch-via-logstash/237660 "2020-06-19T03:20:58Z")
\` I have a problem, multiple events will come from Kafka for the same message-id. I want to use logstash to push the events into elastic search in a nested documents. How we can push the data into elasticsearch via logst… --- ## [Logstash Hangs After Too Many 400's on Bulk Requests to ES](https://discuss.elastic.co/t/logstash-hangs-after-too-many-400s-on-bulk-requests-to-es/237612)
**Author:** [@scott\_stash](https://discuss.elastic.co/u/scott_stash)\ **Replies:** 2\ **Last updated:** [June 19, 2020, 2:53am UTC](https://discuss.elastic.co/t/logstash-hangs-after-too-many-400s-on-bulk-requests-to-es/237612 "2020-06-19T02:53:35Z")
Intermittently I ran into an issue where Logstash will hang. I think what is happening is that for some reason I start logging "Encountered a returnable error. Will Retry with exponential backoff" and the code is 400. … --- ## [Assitance required in a Grok pattern](https://discuss.elastic.co/t/assitance-required-in-a-grok-pattern/237388)
**Author:** [@Saravana37](https://discuss.elastic.co/u/Saravana37)\ **Replies:** 4\ **Last updated:** [June 19, 2020, 2:50am UTC](https://discuss.elastic.co/t/assitance-required-in-a-grok-pattern/237388 "2020-06-19T02:50:28Z")
Hello All , I am facing some challenges in building the below Grok pattern. %{WORD:Server}%{SPACE}%{WORD:Component}%{SPACE}%{NOTSPACE:ComponentStatus}%{SPACE}%{WORD:CG\_ALIAS}%{SPACE}%{WORD:CompStartMode}%{SPACE}%{NUMBE… --- ## [Trying to rename a field, getting "object mapping for \[\\] tried to parse field \[\\] as object, but found a concrete value](https://discuss.elastic.co/t/trying-to-rename-a-field-getting-object-mapping-for-name-of-field-tried-to-parse-field-name-of-field-as-object-but-found-a-concrete-value/237719)
**Author:** [@Casie\_Schuller](https://discuss.elastic.co/u/Casie_Schuller)\ **Replies:** 0\ **Last updated:** [June 19, 2020, 1:47am UTC](https://discuss.elastic.co/t/trying-to-rename-a-field-getting-object-mapping-for-name-of-field-tried-to-parse-field-name-of-field-as-object-but-found-a-concrete-value/237719 "2020-06-19T01:47:39Z")
Hi, I'm trying to rename data that is in this shape: using this: POST r\_xair\_signals-2020-06/\_update/2020-06-15T22:23:00Z\_-1344027716 { "doc" : { "Customer ImpactedNested" : "CustomerImpactedNested" } … --- ## [Stopping logstash always enters failed status](https://discuss.elastic.co/t/stopping-logstash-always-enters-failed-status/237713)
**Author:** [@azteker](https://discuss.elastic.co/u/azteker)\ **Replies:** 0\ **Last updated:** [June 19, 2020, 1:28am UTC](https://discuss.elastic.co/t/stopping-logstash-always-enters-failed-status/237713 "2020-06-19T01:28:01Z")
I stop logstash with "systemctl stop logstash" This is what "systemctl status logstash" returns ● logstash.service - logstash Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: disabled) Ac… --- ## [Is there a GUI / tool that visualizes explained queries?](https://discuss.elastic.co/t/is-there-a-gui-tool-that-visualizes-explained-queries/237711)
**Author:** [@username1234](https://discuss.elastic.co/u/username1234)\ **Replies:** 0\ **Last updated:** [June 19, 2020, 12:58am UTC](https://discuss.elastic.co/t/is-there-a-gui-tool-that-visualizes-explained-queries/237711 "2020-06-19T00:58:24Z")
When setting explain: true, the results can be very hard to read even with JSON pretty printing. Are there any tools to help visualize and make sense of the data that explain adds? --- ## [How does winlogbeat handle different OS languages](https://discuss.elastic.co/t/how-does-winlogbeat-handle-different-os-languages/233437)
**Author:** [@hilo21](https://discuss.elastic.co/u/hilo21)\ **Replies:** 3\ **Last updated:** [June 18, 2020, 11:44pm UTC](https://discuss.elastic.co/t/how-does-winlogbeat-handle-different-os-languages/233437 "2020-06-18T23:44:07Z")
Hello, We use QRadar's wincollect for collecting windows event logs. During the process of windows server integration and since we might have different languages depend on the location (English, spanish or french) we en… --- ## [Ingest SQL Server data on another server through logstash](https://discuss.elastic.co/t/ingest-sql-server-data-on-another-server-through-logstash/237697)
**Author:** [@FernandoMOTA](https://discuss.elastic.co/u/FernandoMOTA)\ **Replies:** 4\ **Last updated:** [June 18, 2020, 11:12pm UTC](https://discuss.elastic.co/t/ingest-sql-server-data-on-another-server-through-logstash/237697 "2020-06-18T23:12:26Z")
I want to send data from my DB Sql server to ES, the database is on another server, only the local host I received --- ## [Winlogbeat Service won't start error 1067](https://discuss.elastic.co/t/winlogbeat-service-wont-start-error-1067/236688)
**Author:** [@richard.andersson](https://discuss.elastic.co/u/richard.andersson)\ **Replies:** 1\ **Last updated:** [June 18, 2020, 9:24pm UTC](https://discuss.elastic.co/t/winlogbeat-service-wont-start-error-1067/236688 "2020-06-18T21:24:42Z")
Hi, Version we have tested with winlogbeat-7.7.1 and winlogbeat-6.8.10 and winlogbeat-7.6.0 and winlogbeat-6.5.0 OS: Windows Server 2016. We have problem to start winlogbeat Service with error 1067 We have test start… --- ## [Add geo\_shape polygon coordinates with Logstash](https://discuss.elastic.co/t/add-geo-shape-polygon-coordinates-with-logstash/237651)
**Author:** [@Attic](https://discuss.elastic.co/u/Attic)\ **Replies:** 1\ **Last updated:** [June 18, 2020, 9:38pm UTC](https://discuss.elastic.co/t/add-geo-shape-polygon-coordinates-with-logstash/237651 "2020-06-18T21:38:39Z")
Hello everyone, I'm using the JDBC connector to read IDs from a DB. These IDs are spots around the world that mark the center of a polygon. Is it possible to bind the polygon edge coodinates to a spot-id using Logstas… --- ## [Merging documents in elasticsearch](https://discuss.elastic.co/t/merging-documents-in-elasticsearch/237704)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 0\ **Last updated:** [June 18, 2020, 9:27pm UTC](https://discuss.elastic.co/t/merging-documents-in-elasticsearch/237704 "2020-06-18T21:27:35Z")
Hi All, We are pulling data from servicenow using logstash http poller. The rest api which I am using has a field call location, which is a location name(chennai, India) I doesnot have latitude and longitude field. We … --- ## [How to setup an alert which checks for a keyword](https://discuss.elastic.co/t/how-to-setup-an-alert-which-checks-for-a-keyword/237325)
**Author:** [@Vikas\_Rathore](https://discuss.elastic.co/u/Vikas_Rathore)\ **Replies:** 1\ **Last updated:** [June 18, 2020, 6:49pm UTC](https://discuss.elastic.co/t/how-to-setup-an-alert-which-checks-for-a-keyword/237325 "2020-06-18T18:49:12Z")
I am trying to add an alert on Kibana. The destination is created but I am not able to understand how to create a monitor to check for this key "setException MongoDB Generic Error" and when the count is greater than 1. t… --- ## [Zipkin UI taking lot of time to load](https://discuss.elastic.co/t/zipkin-ui-taking-lot-of-time-to-load/237569)
**Author:** [@ishan\_ji\_Gupta](https://discuss.elastic.co/u/ishan_ji_Gupta)\ **Replies:** 7\ **Last updated:** [June 18, 2020, 6:37pm UTC](https://discuss.elastic.co/t/zipkin-ui-taking-lot-of-time-to-load/237569 "2020-06-18T18:37:39Z")
Zipkin UI taking lot of time to load when increasing the limit to more than 100 and beyond 300 it is showing timeout. --- ## [How to exclude doc\_count value in result? Kibana Query](https://discuss.elastic.co/t/how-to-exclude-doc-count-value-in-result-kibana-query/235657)
**Author:** [@vdalvi](https://discuss.elastic.co/u/vdalvi)\ **Replies:** 1\ **Last updated:** [June 18, 2020, 6:36pm UTC](https://discuss.elastic.co/t/how-to-exclude-doc-count-value-in-result-kibana-query/235657 "2020-06-18T18:36:17Z")
Hi, I have a question, I am not sure if this is technically possible however. I want to exclude/not display the "doc\_count:value" in my result. Below is a snippet of my result { "key\_as\_string" : "2020-06-04… --- ## [Generate grok custom pattern to message filed](https://discuss.elastic.co/t/generate-grok-custom-pattern-to-message-filed/237400)
**Author:** [@Mohan\_vel](https://discuss.elastic.co/u/Mohan_vel)\ **Replies:** 8\ **Last updated:** [June 18, 2020, 6:12pm UTC](https://discuss.elastic.co/t/generate-grok-custom-pattern-to-message-filed/237400 "2020-06-18T18:12:40Z")
Hi All, I am having a query related to grok processor. For example this is my message filed { "message":"agentId:agent003" } I want to Grok this and my output should me something like this { "message":"agentId:agent0… --- ## [High CPU after data loaded into memory](https://discuss.elastic.co/t/high-cpu-after-data-loaded-into-memory/237689)
**Author:** [@bhuvaneshdct](https://discuss.elastic.co/u/bhuvaneshdct)\ **Replies:** 0\ **Last updated:** [June 18, 2020, 6:10pm UTC](https://discuss.elastic.co/t/high-cpu-after-data-loaded-into-memory/237689 "2020-06-18T18:10:14Z")
I have an elastic cluster (7.4). 48 core CPU, 380GB memory, SSD Disk, 2 nodes Total data: 3TB/per node Heal 32GB thread\_pool.search.size: 50 thread\_pool.search.queue\_size: 200 indices.memory.index\_buffer\_size: 10% … --- ## [How to add elasticsearch as datasource in jasper reports tool?](https://discuss.elastic.co/t/how-to-add-elasticsearch-as-datasource-in-jasper-reports-tool/237687)
**Author:** [@Venkat\_Raj](https://discuss.elastic.co/u/Venkat_Raj)\ **Replies:** 0\ **Last updated:** [June 18, 2020, 6:02pm UTC](https://discuss.elastic.co/t/how-to-add-elasticsearch-as-datasource-in-jasper-reports-tool/237687 "2020-06-18T18:02:38Z")
I have a requirement to generate PDF reports of the datas from Elasticsearch indexes. I have seen few blogs about Jasper reports as the widely used tool to generate PDF reports. Is there any plugin to be used to establi… --- ## [Cross cluster: how to list remote cluster indices and get index mapping?](https://discuss.elastic.co/t/cross-cluster-how-to-list-remote-cluster-indices-and-get-index-mapping/237685)
**Author:** [@stoneflower](https://discuss.elastic.co/u/stoneflower)\ **Replies:** 0\ **Last updated:** [June 18, 2020, 5:56pm UTC](https://discuss.elastic.co/t/cross-cluster-how-to-list-remote-cluster-indices-and-get-index-mapping/237685 "2020-06-18T17:56:50Z")
We have two ES clusters, A and B. B has no Kibana, and we set up B as remote cluster. We use cluster A's Kibana to access cluster B. But seems no way to list all indices on remote cluster from this https://github.com/ela… --- ## [Filebeat delay to harvest after restart](https://discuss.elastic.co/t/filebeat-delay-to-harvest-after-restart/236889)
**Author:** [@b0nete](https://discuss.elastic.co/u/b0nete)\ **Replies:** 8\ **Last updated:** [June 18, 2020, 5:42pm UTC](https://discuss.elastic.co/t/filebeat-delay-to-harvest-after-restart/236889 "2020-06-18T17:42:25Z")
Hi, i go to tell about my problem. I have one server with filebeat installed, an this use logstash.output to send logs to graylog. This work, but my problem is that i have a 15/20min delay after apply config changes and… --- ## [Monitor current system resources utilisation of production ES nodes](https://discuss.elastic.co/t/monitor-current-system-resources-utilisation-of-production-es-nodes/237683)
**Author:** [@kaushalshriyan](https://discuss.elastic.co/u/kaushalshriyan)\ **Replies:** 1\ **Last updated:** [June 18, 2020, 5:42pm UTC](https://discuss.elastic.co/t/monitor-current-system-resources-utilisation-of-production-es-nodes/237683 "2020-06-18T17:42:24Z")
Hi, Is there a way to monitor the current system resources like CPU, Computing Load and Memory utilization for the current ES production cluster nodes (3 nodes)? Best Regards, Kaushal --- ## [Security\_exception: action \[indices:admin/rollover\] is unauthorized for user \[\\]](https://discuss.elastic.co/t/security-exception-action-indices-admin-rollover-is-unauthorized-for-user-user-name/237328)
**Author:** [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\ **Replies:** 1\ **Last updated:** [June 18, 2020, 5:37pm UTC](https://discuss.elastic.co/t/security-exception-action-indices-admin-rollover-is-unauthorized-for-user-user-name/237328 "2020-06-18T17:37:00Z")
What am I missing in this deployment that's throwing this error? The deployment is 7.7.0 and the user and role information is below. security\_exception: action \[indices:admin/rollover\] is unauthorized for user \[\ **Author:** [@marco2005](https://discuss.elastic.co/u/marco2005)\ **Replies:** 7\ **Last updated:** [June 18, 2020, 5:36pm UTC](https://discuss.elastic.co/t/parse-timestamp-using-date-filter-plugin/237641 "2020-06-18T17:36:00Z") I have a log line: test-process 2020/06/04 13:35:42 process.go:646: INFO: GetTest: X-Request-Id: 14242dqdq2aA, status: HTTP 200 OK Below is my filter: filter { dissect { mapping =\> { … --- ## [Dissect processor issue](https://discuss.elastic.co/t/dissect-processor-issue/237278)
**Author:** [@paulkeogh](https://discuss.elastic.co/u/paulkeogh)\ **Replies:** 3\ **Last updated:** [June 18, 2020, 5:31pm UTC](https://discuss.elastic.co/t/dissect-processor-issue/237278 "2020-06-18T17:31:48Z")
v7.2 When setting target\_prefix to "" (empty string) the output from the dissector does not appear in console. When I set it to anything else, including a single whitespace, it does appear. Any suggestions ? --- ## [Add auto-focus to core app searches](https://discuss.elastic.co/t/add-auto-focus-to-core-app-searches/235782)
**Author:** [@AlexH](https://discuss.elastic.co/u/AlexH)\ **Replies:** 2\ **Last updated:** [June 18, 2020, 5:30pm UTC](https://discuss.elastic.co/t/add-auto-focus-to-core-app-searches/235782 "2020-06-18T17:30:33Z")
In Kibana, when navigating to Discover, Visualizations, Dashboards, Canvas, etc., I can choose from existing objects or make a new one. Usually I will choose from existing objects, so I need to now click into the textbox… --- ## [How to suppress Metric Sum(Counts) == 0 in Kibana PIECHART](https://discuss.elastic.co/t/how-to-suppress-metric-sum-counts-0-in-kibana-piechart/236781)
**Author:** [@sanjaysubramanian](https://discuss.elastic.co/u/sanjaysubramanian)\ **Replies:** 1\ **Last updated:** [June 18, 2020, 5:12pm UTC](https://discuss.elastic.co/t/how-to-suppress-metric-sum-counts-0-in-kibana-piechart/236781 "2020-06-18T17:12:07Z")
Hi all My Kibana version is 7.7.0 I am drawing a PIE CHART visualization of the histogram of Devices that users have used to access the website. In this case the values are Other Other = 1318 Chrome Windows = 5 Chr… --- ## [Ingest Pipeline KV processor pattern failures](https://discuss.elastic.co/t/ingest-pipeline-kv-processor-pattern-failures/237558)
**Author:** [@nmoham](https://discuss.elastic.co/u/nmoham)\ **Replies:** 2\ **Last updated:** [June 18, 2020, 4:59pm UTC](https://discuss.elastic.co/t/ingest-pipeline-kv-processor-pattern-failures/237558 "2020-06-18T16:59:26Z")
Trying to parse syslogs with several KV pairs . The values contain special characters & spaces. Examples Events- sev="INFO" msg="Audit access" cat="\\\[AUDIT\\\]" pol="ENC104456DB\_SQL\_Operational" uinfo="SQLService\\\\UnPriv… --- ## [Canvas Element only show 1000 data entry](https://discuss.elastic.co/t/canvas-element-only-show-1000-data-entry/237675)
**Author:** [@luopipi](https://discuss.elastic.co/u/luopipi)\ **Replies:** 2\ **Last updated:** [June 18, 2020, 4:59pm UTC](https://discuss.elastic.co/t/canvas-element-only-show-1000-data-entry/237675 "2020-06-18T16:59:23Z")
I am creating a canvas visualization for a dashboard to show the summary of one data field, for example: total count of a data field from one or multiple index. However, this count is maxed at 1000. Is this any way can… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1987) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1989)