# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=273 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 274 --- ## [Filebeat output to custom index name not working when a template is used](https://discuss.elastic.co/t/filebeat-output-to-custom-index-name-not-working-when-a-template-is-used/356510)
**Author:** [@DazzleNovak](https://discuss.elastic.co/u/DazzleNovak)\ **Replies:** 1\ **Last updated:** [April 1, 2024, 8:31am UTC](https://discuss.elastic.co/t/filebeat-output-to-custom-index-name-not-working-when-a-template-is-used/356510 "2024-04-01T08:31:23Z")
Hello all, The goal is to get data to go from filebeat \> elasticsearch from custom app JSON logs and then add client.geo coordinates into the index for dashboard maps. Originally, filebeat was sending all syslog and my… --- ## [Possible ways to allow write on restricted indies in v8.x](https://discuss.elastic.co/t/possible-ways-to-allow-write-on-restricted-indies-in-v8-x/356508)
**Author:** [@Mahdi\_Moazami](https://discuss.elastic.co/u/Mahdi_Moazami)\ **Replies:** 3\ **Last updated:** [April 1, 2024, 6:18am UTC](https://discuss.elastic.co/t/possible-ways-to-allow-write-on-restricted-indies-in-v8-x/356508 "2024-04-01T06:18:54Z")
Hi there, I have migrated my data from cluster version 7.8 to new cluster version 8. now I want to transfer my pipelines from old cluster to new one. the problem is that in version 8 the .logstash index is restricted an… --- ## [I want to combine all the order that has same type of fingerprint in one doc](https://discuss.elastic.co/t/i-want-to-combine-all-the-order-that-has-same-type-of-fingerprint-in-one-doc/356043)
**Author:** [@kishorkumar](https://discuss.elastic.co/u/kishorkumar)\ **Replies:** 1\ **Last updated:** [March 23, 2024, 9:13pm UTC](https://discuss.elastic.co/t/i-want-to-combine-all-the-order-that-has-same-type-of-fingerprint-in-one-doc/356043 "2024-03-23T21:13:15Z")
Hello everyone i am trying to combine all the same type of fingerprint doc in one doc is it possible with logstash pure no ruby here is my ndjson file {"userId":"33a4-1ff9-d8-a7fb-d1257","id":"48-0d-44e7-bc-b11","key":… --- ## [Running Elasticsearch locally in cloned repository \[Ubuntu\]](https://discuss.elastic.co/t/running-elasticsearch-locally-in-cloned-repository-ubuntu/356491)
**Author:** [@Renato\_Marques](https://discuss.elastic.co/u/Renato_Marques)\ **Replies:** 3\ **Last updated:** [March 31, 2024, 7:15pm UTC](https://discuss.elastic.co/t/running-elasticsearch-locally-in-cloned-repository-ubuntu/356491 "2024-03-31T19:15:28Z")
I recently started working on fixing a bug mentioned in the Elasticsearch GitHub repository issues. After installing Elasticsearch and reproducing the bug with the downloaded version from the website, I had an idea of ho… --- ## [Kibana Email Alert/Connectors](https://discuss.elastic.co/t/kibana-email-alert-connectors/356266)
**Author:** [@Maria\_Dalavagka](https://discuss.elastic.co/u/Maria_Dalavagka)\ **Replies:** 1\ **Last updated:** [March 31, 2024, 6:51pm UTC](https://discuss.elastic.co/t/kibana-email-alert-connectors/356266 "2024-03-31T18:51:28Z")
Hi everyone! I'd like to know how I connect Kibana with MailCatcher since the organization I work for does not allow to send emails to our personal mailboxes. We have a cloud dev environment (AWS) where we have created… --- ## [Parsing Data in message field](https://discuss.elastic.co/t/parsing-data-in-message-field/356300)
**Author:** [@Sheperd403](https://discuss.elastic.co/u/Sheperd403)\ **Replies:** 1\ **Last updated:** [March 28, 2024, 6:29am UTC](https://discuss.elastic.co/t/parsing-data-in-message-field/356300 "2024-03-28T06:29:10Z")
I am quite new to Elastic altogether, namely elastic agent, so looking for some guidance! To further preface, I am calling this parsing, but based on what I am requesting, that may not be the correct term for what I am a… --- ## [Filebeat is not polling the logs in the order of their time stamp](https://discuss.elastic.co/t/filebeat-is-not-polling-the-logs-in-the-order-of-their-time-stamp/356467)
**Author:** [@Shrimad\_Mishra](https://discuss.elastic.co/u/Shrimad_Mishra)\ **Replies:** 14\ **Last updated:** [March 31, 2024, 4:05pm UTC](https://discuss.elastic.co/t/filebeat-is-not-polling-the-logs-in-the-order-of-their-time-stamp/356467 "2024-03-31T16:05:37Z")
My usecase is that I am sending the logs from one server to another server and pushing it to logstash. But what is happening is that logs are not getting pushed in the order they are means sometimes the logs at 15:21:17 … --- ## [When is it safe to delete a log file from a machine that runs Fleet Agent?](https://discuss.elastic.co/t/when-is-it-safe-to-delete-a-log-file-from-a-machine-that-runs-fleet-agent/356257)
**Author:** [@lizozom](https://discuss.elastic.co/u/lizozom)\ **Replies:** 2\ **Last updated:** [March 31, 2024, 4:22pm UTC](https://discuss.elastic.co/t/when-is-it-safe-to-delete-a-log-file-from-a-machine-that-runs-fleet-agent/356257 "2024-03-31T16:22:42Z")
I have several machines that run an Elastic Agent on them. One of the integrations I used is Custom Logs. Logs are written to a file with a rotating date (my-logs-DATE.log). When is a safe time to delete an old log fi… --- ## [Cassandra database tls connection issue on logstash](https://discuss.elastic.co/t/cassandra-database-tls-connection-issue-on-logstash/356367)
**Author:** [@gadde36256](https://discuss.elastic.co/u/gadde36256)\ **Replies:** 9\ **Last updated:** [March 31, 2024, 11:28am UTC](https://discuss.elastic.co/t/cassandra-database-tls-connection-issue-on-logstash/356367 "2024-03-31T11:28:02Z")
Hello All, Recently we made changes on Cassandra database to connect with tls, I don't find much details to configuring tls on logstash. Can you pls share the any help link for configuring the ssl with logstash. Thanks… --- ## [How to create add link in the format template of field?](https://discuss.elastic.co/t/how-to-create-add-link-in-the-format-template-of-field/356498)
**Author:** [@kishorkumar](https://discuss.elastic.co/u/kishorkumar)\ **Replies:** 0\ **Last updated:** [March 31, 2024, 9:51am UTC](https://discuss.elastic.co/t/how-to-create-add-link-in-the-format-template-of-field/356498 "2024-03-31T09:51:13Z")
Hello, i have columns in he index with order ID (contains the order id) and linktoOrder (contains the link to order ). So i actually want to add the link on the order id . link this so text will will be order id but t… --- ## [Dynamic watcher/alerting... without creating 100+ watchers](https://discuss.elastic.co/t/dynamic-watcher-alerting-without-creating-100-watchers/356408)
**Author:** [@eStrux-MAB](https://discuss.elastic.co/u/eStrux-MAB)\ **Replies:** 1\ **Last updated:** [March 30, 2024, 4:52pm UTC](https://discuss.elastic.co/t/dynamic-watcher-alerting-without-creating-100-watchers/356408 "2024-03-30T16:52:31Z")
Here's one for the "is this possible?" category. Is it possible to alert on specific conditions and aggregations of data within one index, without having to create an enormous number of watchers? Consider this: I have … --- ## [Issue getting logs to flow into Kibana (Windows OS)](https://discuss.elastic.co/t/issue-getting-logs-to-flow-into-kibana-windows-os/356466)
**Author:** [@w0mbat](https://discuss.elastic.co/u/w0mbat)\ **Replies:** 1\ **Last updated:** [March 30, 2024, 3:32pm UTC](https://discuss.elastic.co/t/issue-getting-logs-to-flow-into-kibana-windows-os/356466 "2024-03-30T15:32:26Z")
Cannot seem to get syslogs to flow from our vPAN Palo appliance to Kibana. I verified the logs were indeed being sent from our appliance to the OS using Kiwi Syslog. Have completed the following steps...What am i missi… --- ## [Trial license expires the next day after activation](https://discuss.elastic.co/t/trial-license-expires-the-next-day-after-activation/355716)
**Author:** [@Sergey\_Kuyanov](https://discuss.elastic.co/u/Sergey_Kuyanov)\ **Replies:** 2\ **Last updated:** [March 30, 2024, 1:39pm UTC](https://discuss.elastic.co/t/trial-license-expires-the-next-day-after-activation/355716 "2024-03-30T13:39:16Z")
Hello everyone. Yesterday, I successfully deployed and configured Elasticsearch on Kubernetes. We need to use cross-cluster replication, so a trial period was activated. Everything was working fine for about 20 hours, th… --- ## [Logstash Jdbc connection error](https://discuss.elastic.co/t/logstash-jdbc-connection-error/356358)
**Author:** [@viera120](https://discuss.elastic.co/u/viera120)\ **Replies:** 4\ **Last updated:** [March 30, 2024, 9:36am UTC](https://discuss.elastic.co/t/logstash-jdbc-connection-error/356358 "2024-03-30T09:36:52Z")
Hi, We are running a 3 node elastic cluster to index logs from a firewall. Filebeat and Redis Queue are used to forward the logs to Logstash for necessary parsing, after which it is indexed in to the Elastic cluster. D… --- ## [Unpivot Causing Logstash Pipeline to Halt](https://discuss.elastic.co/t/unpivot-causing-logstash-pipeline-to-halt/354690)
**Author:** [@Rushil\_Dewaskar](https://discuss.elastic.co/u/Rushil_Dewaskar)\ **Replies:** 1\ **Last updated:** [March 30, 2024, 8:01am UTC](https://discuss.elastic.co/t/unpivot-causing-logstash-pipeline-to-halt/354690 "2024-03-30T08:01:50Z")
I am trying to create an Elasticsearch index from an SQL database. However, whenever our SQL query contains an unpivot operation, the process halts after processing a certain number of records. It then resumes after 30-4… --- ## [Filter HTTP or filter ruby](https://discuss.elastic.co/t/filter-http-or-filter-ruby/356477)
**Author:** [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\ **Replies:** 0\ **Last updated:** [March 29, 2024, 8:55pm UTC](https://discuss.elastic.co/t/filter-http-or-filter-ruby/356477 "2024-03-29T20:55:29Z")
I need to make a new query in an api after INPUT, however the filter is giving an error. ´´´ \[ERROR\] 2024-03-29 17:46:12.286 \[\[main\]\>worker0\] http - error during HTTP request {:url=\>"teste.net", :code=\>500, :headers=\>{… --- ## [Find out when an index has "settled" after a series of bulk inserts?](https://discuss.elastic.co/t/find-out-when-an-index-has-settled-after-a-series-of-bulk-inserts/356475)
**Author:** [@mrodent](https://discuss.elastic.co/u/mrodent)\ **Replies:** 1\ **Last updated:** [March 29, 2024, 8:21pm UTC](https://discuss.elastic.co/t/find-out-when-an-index-has-settled-after-a-series-of-bulk-inserts/356475 "2024-03-29T20:21:08Z")
I am doing multiple bulk inserts using the \_bulk endpoint, using a Rust module (not yet concurrent, but it will be). On my test files this should generate 9264 "Lucene documents", i.e. documents in the index. I check th… --- ## [Default Max date field to be the filter in dashboard](https://discuss.elastic.co/t/default-max-date-field-to-be-the-filter-in-dashboard/356473)
**Author:** [@Liwei\_Zhang](https://discuss.elastic.co/u/Liwei_Zhang)\ **Replies:** 0\ **Last updated:** [March 29, 2024, 7:42pm UTC](https://discuss.elastic.co/t/default-max-date-field-to-be-the-filter-in-dashboard/356473 "2024-03-29T19:42:04Z")
Hello all, My question related to Is it possible today? I want to always have max date field as the default filter for a dashboard, can someone kindly assist please? Thanks!!! --- ## [How does timestamp range work with wildcard index?](https://discuss.elastic.co/t/how-does-timestamp-range-work-with-wildcard-index/356457)
**Author:** [@Elena\_K](https://discuss.elastic.co/u/Elena_K)\ **Replies:** 1\ **Last updated:** [March 29, 2024, 5:48pm UTC](https://discuss.elastic.co/t/how-does-timestamp-range-work-with-wildcard-index/356457 "2024-03-29T17:48:43Z")
I'm trying to understand how search with a timestamp range works and whether I should use a specific index to make the search faster or if I can use a wildcard. The performance test didn't show any difference. So I have… --- ## [Elasticsearch filter comparison with "preserve\_original": true](https://discuss.elastic.co/t/elasticsearch-filter-comparison-with-preserve-original-true/356468)
**Author:** [@nkachami](https://discuss.elastic.co/u/nkachami)\ **Replies:** 0\ **Last updated:** [March 29, 2024, 5:30pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-comparison-with-preserve-original-true/356468 "2024-03-29T17:30:35Z")
Hello, I am testing the outputs of different analyzer configurations and found one that does not seem to make much sense. Lets imagine we have two settings blocks: { "settings": { "analysis": { "analyzer":… --- ## [Master node discovery problem](https://discuss.elastic.co/t/master-node-discovery-problem/356415)
**Author:** [@esrcon](https://discuss.elastic.co/u/esrcon)\ **Replies:** 6\ **Last updated:** [March 29, 2024, 5:10pm UTC](https://discuss.elastic.co/t/master-node-discovery-problem/356415 "2024-03-29T17:10:22Z")
Hello, My cluster has 3 master nodes. But during deployment, two nodes are not able to join cluster. Their log says "an election requires at least 2 nodes with ids" but only one is discovered and "not a quorum". Then I… --- ## [KNN search with Function score or Scoring script](https://discuss.elastic.co/t/knn-search-with-function-score-or-scoring-script/356432)
**Author:** [@Yevgeny\_Yurgenson](https://discuss.elastic.co/u/Yevgeny_Yurgenson)\ **Replies:** 3\ **Last updated:** [March 29, 2024, 4:59pm UTC](https://discuss.elastic.co/t/knn-search-with-function-score-or-scoring-script/356432 "2024-03-29T16:59:45Z")
I would like to incorporate a decay function based off of a time field attached to a vector when conducting a KNN search. I am using the Kotlin client. WIth a regular query, this would be done through the function score … --- ## [How to convert string encoding of a keyword field](https://discuss.elastic.co/t/how-to-convert-string-encoding-of-a-keyword-field/356463)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 0\ **Last updated:** [March 29, 2024, 12:25pm UTC](https://discuss.elastic.co/t/how-to-convert-string-encoding-of-a-keyword-field/356463 "2024-03-29T12:25:46Z")
Considering if it may be better to convert hardwired input string encoding to ie. UTF8 for possible better displaying a long the way, eg. like: if (ctx.containsKey('epj.role')) { String utf8String = new String(ctx.epj… --- ## [Not possible to reorder sequence of processors in ingest pipelines v.8.12.2](https://discuss.elastic.co/t/not-possible-to-reorder-sequence-of-processors-in-ingest-pipelines-v-8-12-2/356461)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 2\ **Last updated:** [March 29, 2024, 4:31pm UTC](https://discuss.elastic.co/t/not-possible-to-reorder-sequence-of-processors-in-ingest-pipelines-v-8-12-2/356461 "2024-03-29T16:31:37Z")
Seems I've lost the ability to reorder the sequence of my processors in an ingest pipeline after updating to v.8.12.2 from v.8.10.2, tried both via a filefox and chrome browser on Window$ 10, is this just me or a bug/fea… --- ## [Kibana Node.js - JavaScript run-time environment is affected by multiple vulnerabilities](https://discuss.elastic.co/t/kibana-node-js-javascript-run-time-environment-is-affected-by-multiple-vulnerabilities/356380)
**Author:** [@San9](https://discuss.elastic.co/u/San9)\ **Replies:** 4\ **Last updated:** [March 29, 2024, 4:05pm UTC](https://discuss.elastic.co/t/kibana-node-js-javascript-run-time-environment-is-affected-by-multiple-vulnerabilities/356380 "2024-03-29T16:05:00Z")
After scanning it was discovered that Solution: Upgrade to Node.js version 18.19.1 / 20.11.1 / 21.6.2 or later. Path : /usr/share/kibana/node/bin/node Installed version : 18.18.2 Fixed version : 18.… --- ## [Python Elasticsearch client: Unable to get data when \* included in index name](https://discuss.elastic.co/t/python-elasticsearch-client-unable-to-get-data-when-included-in-index-name/356185)
**Author:** [@Akhil\_Sharma](https://discuss.elastic.co/u/Akhil_Sharma)\ **Replies:** 3\ **Last updated:** [March 29, 2024, 2:46pm UTC](https://discuss.elastic.co/t/python-elasticsearch-client-unable-to-get-data-when-included-in-index-name/356185 "2024-03-29T14:46:13Z")
I have written the following code in python to get data from my Elastic deployment: from elasticsearch import Elasticsearch client = Elasticsearch(\,api\_key=(\,\)) client.get(index="abc-001",i… --- ## ["Setting \[xpack.security.transport.ssl.keystore.secure\_password\] is a secure setting and must be stored inside the Elasticsearch keystore, but was found inside elasticsearch.yml](https://discuss.elastic.co/t/setting-xpack-security-transport-ssl-keystore-secure-password-is-a-secure-setting-and-must-be-stored-inside-the-elasticsearch-keystore-but-was-found-inside-elasticsearch-yml/356465)
**Author:** [@Sohaib\_El\_Mediouni](https://discuss.elastic.co/u/Sohaib_El_Mediouni)\ **Replies:** 0\ **Last updated:** [March 29, 2024, 2:42pm UTC](https://discuss.elastic.co/t/setting-xpack-security-transport-ssl-keystore-secure-password-is-a-secure-setting-and-must-be-stored-inside-the-elasticsearch-keystore-but-was-found-inside-elasticsearch-yml/356465 "2024-03-29T14:42:03Z")
Hello, I have Elasticsearch based on a Red Hat image with 3 nodes in a StatefulSet, and Kibana in a deployment. Each Elasticsearch node has a PVC mounted in /usr/share/elasticsearch/data. I have generated the elastic-st… --- ## [Setting a field to either one or another field depending on the existence of one](https://discuss.elastic.co/t/setting-a-field-to-either-one-or-another-field-depending-on-the-existence-of-one/356462)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 1\ **Last updated:** [March 29, 2024, 1:58pm UTC](https://discuss.elastic.co/t/setting-a-field-to-either-one-or-another-field-depending-on-the-existence-of-one/356462 "2024-03-29T13:58:57Z")
Just dipping my toes into painless, only it isn't simple painless :wink: I'm trying to conditionally set a field to either one or another field depending on the existence of one field like this: { "script": { … --- ## [Must clause not working as expected](https://discuss.elastic.co/t/must-clause-not-working-as-expected/356464)
**Author:** [@jo\_dev](https://discuss.elastic.co/u/jo_dev)\ **Replies:** 1\ **Last updated:** [March 29, 2024, 1:08pm UTC](https://discuss.elastic.co/t/must-clause-not-working-as-expected/356464 "2024-03-29T13:08:31Z")
I am executing must clause query on a nested document. I am expecting that it will behave like logical AND, but observing inconsistent behavior. Sample document mappings- "mappings": { "properties": { … --- ## [Upgrade elasticsearch on docker from 8.11.2 to 8.13.0](https://discuss.elastic.co/t/upgrade-elasticsearch-on-docker-from-8-11-2-to-8-13-0/356454)
**Author:** [@greenhand](https://discuss.elastic.co/u/greenhand)\ **Replies:** 0\ **Last updated:** [March 29, 2024, 10:35am UTC](https://discuss.elastic.co/t/upgrade-elasticsearch-on-docker-from-8-11-2-to-8-13-0/356454 "2024-03-29T10:35:44Z")
I'm not using docker-compose. Instead, a separate startup container deployed a two-node es cluster, but I am currently experiencing issues with cpu alert not working properly. The error is "Failed to resolve needed aggre… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=272) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=274)