# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=326 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 327 --- ## [Watcher pulling \_cat/indices and splitting results on newline to create multiple documents?](https://discuss.elastic.co/t/watcher-pulling-cat-indices-and-splitting-results-on-newline-to-create-multiple-documents/351003)
**Author:** [@dreynolds](https://discuss.elastic.co/u/dreynolds)\ **Replies:** 2\ **Last updated:** [January 22, 2024, 6:54pm UTC](https://discuss.elastic.co/t/watcher-pulling-cat-indices-and-splitting-results-on-newline-to-create-multiple-documents/351003 "2024-01-22T18:54:10Z")
I'm successfully pulling \_cat/indices with a watcher but can't get the results split based on each line. The below works, but the output is all one document. { "trigger": { "schedule": { "interval": "12h" … --- ## [Index deleted by lifecycle after snapshot restore](https://discuss.elastic.co/t/index-deleted-by-lifecycle-after-snapshot-restore/351569)
**Author:** [@lee.clemens](https://discuss.elastic.co/u/lee.clemens)\ **Replies:** 1\ **Last updated:** [January 22, 2024, 6:46pm UTC](https://discuss.elastic.co/t/index-deleted-by-lifecycle-after-snapshot-restore/351569 "2024-01-22T18:46:26Z")
Hello, I recently struggled with waking up to see a restore completed, but the restored index was missing. Is there a way to remove the lifecycle policy after the restore (I resorted to a script to do so after waiting f… --- ## [Copy\_fields and Syslog parsing out of order](https://discuss.elastic.co/t/copy-fields-and-syslog-parsing-out-of-order/350418)
**Author:** [@Hythloday-zero](https://discuss.elastic.co/u/Hythloday-zero)\ **Replies:** 1\ **Last updated:** [January 22, 2024, 6:39pm UTC](https://discuss.elastic.co/t/copy-fields-and-syslog-parsing-out-of-order/350418 "2024-01-22T18:39:14Z")
When I use a Custom TCP Logs integration with Syslog parsing, I expect that Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent bef… --- ## [Re-Allow Write After Index Shrink](https://discuss.elastic.co/t/re-allow-write-after-index-shrink/351568)
**Author:** [@ktbishop](https://discuss.elastic.co/u/ktbishop)\ **Replies:** 3\ **Last updated:** [January 22, 2024, 6:36pm UTC](https://discuss.elastic.co/t/re-allow-write-after-index-shrink/351568 "2024-01-22T18:36:57Z")
Hello all! Currently on Elasticsearch 7.17. I have a data stream with an ILM policy that rolls data over from Hot to Warm after a period of time. Once an index rolls over to the Warm phase it is shrunk, which I understa… --- ## [Use watcher index action with multiple documents](https://discuss.elastic.co/t/use-watcher-index-action-with-multiple-documents/351503)
**Author:** [@lizozom](https://discuss.elastic.co/u/lizozom)\ **Replies:** 3\ **Last updated:** [January 22, 2024, 6:35pm UTC](https://discuss.elastic.co/t/use-watcher-index-action-with-multiple-documents/351503 "2024-01-22T18:35:54Z")
I have an index and I am using a watcher to monitor it. When a condition is met, I want to copy each document to a different index. I'm following the example here: "index\_payload": { "transform": { "script… --- ## [One search in discover being used for different visualisation](https://discuss.elastic.co/t/one-search-in-discover-being-used-for-different-visualisation/351543)
**Author:** [@skshandilya69](https://discuss.elastic.co/u/skshandilya69)\ **Replies:** 4\ **Last updated:** [January 22, 2024, 5:47pm UTC](https://discuss.elastic.co/t/one-search-in-discover-being-used-for-different-visualisation/351543 "2024-01-22T17:47:10Z")
I have many nodes, and each node sends an event that happens repeatedly every 12 hours. all nodes do not send this at the same time. I need one saved search which is very generic, I want to visualise this through variou… --- ## [Elastic agent installation: 502 Bad Gateway](https://discuss.elastic.co/t/elastic-agent-installation-502-bad-gateway/351013)
**Author:** [@elhog03](https://discuss.elastic.co/u/elhog03)\ **Replies:** 1\ **Last updated:** [January 22, 2024, 4:44pm UTC](https://discuss.elastic.co/t/elastic-agent-installation-502-bad-gateway/351013 "2024-01-22T16:44:32Z")
I try to install the Elastic agent using the following command (as I do not want the publish our token here, I write "OMITTED" instead of the token): sudo ./elastic-agent install --url=https://172.16.201.8:443 --enrollm… --- ## [Does the '--ca-sha256' command line option for Elastic Agent actually work?](https://discuss.elastic.co/t/does-the-ca-sha256-command-line-option-for-elastic-agent-actually-work/351397)
**Author:** [@digital-thought](https://discuss.elastic.co/u/digital-thought)\ **Replies:** 1\ **Last updated:** [January 22, 2024, 4:41pm UTC](https://discuss.elastic.co/t/does-the-ca-sha256-command-line-option-for-elastic-agent-actually-work/351397 "2024-01-22T16:41:07Z")
I have a self-managed fleet server that has a self-signed certificate on it. I can successfully enrol an agent if I use the following command line options: --certificate-authorities=elasticsearch-ca.pem --fleet-server-… --- ## [Elastic agent sending to second node if first node unreachable](https://discuss.elastic.co/t/elastic-agent-sending-to-second-node-if-first-node-unreachable/351564)
**Author:** [@TIT](https://discuss.elastic.co/u/TIT)\ **Replies:** 1\ **Last updated:** [January 22, 2024, 4:37pm UTC](https://discuss.elastic.co/t/elastic-agent-sending-to-second-node-if-first-node-unreachable/351564 "2024-01-22T16:37:10Z")
in fleet outputs settings if modifiying the hosts section and add multiple hosts will that mean that agent will send data the the second hosts only when the first one is unreachable , or data will be sent to the both … --- ## [Can Elastic SIEM alerts be configured to work on a time basis?](https://discuss.elastic.co/t/can-elastic-siem-alerts-be-configured-to-work-on-a-time-basis/351547)
**Author:** [@Kiwisaki](https://discuss.elastic.co/u/Kiwisaki)\ **Replies:** 0\ **Last updated:** [January 22, 2024, 2:12pm UTC](https://discuss.elastic.co/t/can-elastic-siem-alerts-be-configured-to-work-on-a-time-basis/351547 "2024-01-22T14:12:39Z")
Hi, Is it possible to configure alerts to work on a clock ? I.e, i want some alarms to trigger during out of hours or weekends, but not during mon-fri hours. Is this possible ? Additionally, Can you stack events and … --- ## [FSCrawler - Tika Configuration for escape quotes in TextandCSVParser](https://discuss.elastic.co/t/fscrawler-tika-configuration-for-escape-quotes-in-textandcsvparser/351273)
**Author:** [@kamalsharma](https://discuss.elastic.co/u/kamalsharma)\ **Replies:** 4\ **Last updated:** [January 22, 2024, 1:39pm UTC](https://discuss.elastic.co/t/fscrawler-tika-configuration-for-escape-quotes-in-textandcsvparser/351273 "2024-01-22T13:39:25Z")
When I am ingesting a csv file using FSCrawler, I am getting the error "IOException reading next record: java.io.IOException: (line 131664) invalid char between encapsulated token and delimiter -\> (line 131664) invalid c… --- ## [A user who can create, delete their indexes but restricted to deleting others'](https://discuss.elastic.co/t/a-user-who-can-create-delete-their-indexes-but-restricted-to-deleting-others/351296)
**Author:** [@jeannshuti](https://discuss.elastic.co/u/jeannshuti)\ **Replies:** 3\ **Last updated:** [January 22, 2024, 1:40pm UTC](https://discuss.elastic.co/t/a-user-who-can-create-delete-their-indexes-but-restricted-to-deleting-others/351296 "2024-01-22T13:40:54Z")
I am new to the ELK stack and I am trying to find a built-in role that could allow a user to create and delete their own indexes but restricted to deleting others' indexes (read-only). Is there any specific role that has… --- ## [How to take backup of specific time range of data from elastic search using Curator](https://discuss.elastic.co/t/how-to-take-backup-of-specific-time-range-of-data-from-elastic-search-using-curator/351542)
**Author:** [@shobana](https://discuss.elastic.co/u/shobana)\ **Replies:** 0\ **Last updated:** [January 22, 2024, 1:39pm UTC](https://discuss.elastic.co/t/how-to-take-backup-of-specific-time-range-of-data-from-elastic-search-using-curator/351542 "2024-01-22T13:39:23Z")
Hello All, I need to take specific time period of data as a backup. in index range what i need to give while taking doing ae elastic backup. --- ## [Building Kibana code in WSL giving error](https://discuss.elastic.co/t/building-kibana-code-in-wsl-giving-error/349790)
**Author:** [@vikas.shirke](https://discuss.elastic.co/u/vikas.shirke)\ **Replies:** 7\ **Last updated:** [January 22, 2024, 1:24pm UTC](https://discuss.elastic.co/t/building-kibana-code-in-wsl-giving-error/349790 "2024-01-22T13:24:28Z")
I am trying to build Kibana code locally in wsl enviroment. I am using version 8.11.3 I have ran below commands: git checkout 8.11.3 nvm use yarn kbn clean yarn cache clean rm yarn.lock yarn kbn bootstrap --force-… --- ## [S3 repository snapshot](https://discuss.elastic.co/t/s3-repository-snapshot/351486)
**Author:** [@Haytham\_Shammout](https://discuss.elastic.co/u/Haytham_Shammout)\ **Replies:** 5\ **Last updated:** [January 22, 2024, 1:04pm UTC](https://discuss.elastic.co/t/s3-repository-snapshot/351486 "2024-01-22T13:04:10Z")
Hello, I am trying to create a s3 repository snapshot that will take 1 exact day which is the day before 7 days, noting that all the indices I have is daily based, and this needs to be done every day at a specific time. … --- ## [/\_security/api\_key timeout](https://discuss.elastic.co/t/security-api-key-timeout/351366)
**Author:** [@seism0saurus](https://discuss.elastic.co/u/seism0saurus)\ **Replies:** 2\ **Last updated:** [January 22, 2024, 12:50pm UTC](https://discuss.elastic.co/t/security-api-key-timeout/351366 "2024-01-22T12:50:15Z")
Hi, I encounter a problem with the API key management in Kibana. The page behind Stack Management -\> Security -\> API keys does not load. After some time it displays "Could not load API keys." Under technical details i… --- ## [Logstash filters not working as expected](https://discuss.elastic.co/t/logstash-filters-not-working-as-expected/351536)
**Author:** [@Mansi\_Kamthane](https://discuss.elastic.co/u/Mansi_Kamthane)\ **Replies:** 0\ **Last updated:** [January 22, 2024, 11:58am UTC](https://discuss.elastic.co/t/logstash-filters-not-working-as-expected/351536 "2024-01-22T11:58:03Z")
I am working with logstash filter no filter works here here is the config file of logstash \` input { tcp { id =\> "\*\*\*" port =\> \*\*\* codec =\> json\_lines } } filter { cipher { algorithm =\> "aes-128-cbc" key =\> … --- ## [How to see Kibana Dashboard after setup winlogbeat](https://discuss.elastic.co/t/how-to-see-kibana-dashboard-after-setup-winlogbeat/351499)
**Author:** [@aguskhohar](https://discuss.elastic.co/u/aguskhohar)\ **Replies:** 1\ **Last updated:** [January 22, 2024, 11:01am UTC](https://discuss.elastic.co/t/how-to-see-kibana-dashboard-after-setup-winlogbeat/351499 "2024-01-22T11:01:58Z")
Hi All, Could you please arrange to see winlogbeat after installing on kibana (os windows) --- ## [Unable to Connect to Server from Spring boot application in es 8.12](https://discuss.elastic.co/t/unable-to-connect-to-server-from-spring-boot-application-in-es-8-12/351494)
**Author:** [@Aditya\_Teltia](https://discuss.elastic.co/u/Aditya_Teltia)\ **Replies:** 2\ **Last updated:** [January 22, 2024, 10:40am UTC](https://discuss.elastic.co/t/unable-to-connect-to-server-from-spring-boot-application-in-es-8-12/351494 "2024-01-22T10:40:15Z")
While I am able to connect for version es 7.17 but when I am doing the same for version 8.x I am unable to connect. I have to connect to 8.x since I want to use KNN query which it seems is only available in 8.x and late… --- ## [OIDC role mapping not working](https://discuss.elastic.co/t/oidc-role-mapping-not-working/350743)
**Author:** [@natharran](https://discuss.elastic.co/u/natharran)\ **Replies:** 2\ **Last updated:** [January 22, 2024, 10:28am UTC](https://discuss.elastic.co/t/oidc-role-mapping-not-working/350743 "2024-01-22T10:28:49Z")
Hello all, I'm experiencing a problem with role mapping after successful OIDC authentication. My OP provides ID Token where the following data about user can be found (copied from ES log): \\"resource\_access\\":{\\"kibana… --- ## [Fail to reset kibana\_system and elastic passwords](https://discuss.elastic.co/t/fail-to-reset-kibana-system-and-elastic-passwords/351525)
**Author:** [@nas](https://discuss.elastic.co/u/nas)\ **Replies:** 1\ **Last updated:** [January 22, 2024, 10:04am UTC](https://discuss.elastic.co/t/fail-to-reset-kibana-system-and-elastic-passwords/351525 "2024-01-22T10:04:27Z")
Hi All, We run elasticsearch in a clustered mode and recently upgraded from 5 through to version 8.2.0 I tried to enable security TLS and minimal security by following these guides Resulting in the following elast… --- ## [Question about issue 99592 fix](https://discuss.elastic.co/t/question-about-issue-99592-fix/351510)
**Author:** [@ycice](https://discuss.elastic.co/u/ycice)\ **Replies:** 1\ **Last updated:** [January 22, 2024, 9:03am UTC](https://discuss.elastic.co/t/question-about-issue-99592-fix/351510 "2024-01-22T09:03:41Z")
Hi, i am using Version 6.8.2 and i am considering version upgrade to 7.17.16 When i checked release note, there is JVM pressure issue due to JDK 21 version : High memory pressure for Elasticsearch versions using JDK 20+… --- ## [How to create index with a date with a template?](https://discuss.elastic.co/t/how-to-create-index-with-a-date-with-a-template/351440)
**Author:** [@emoxam](https://discuss.elastic.co/u/emoxam)\ **Replies:** 3\ **Last updated:** [January 22, 2024, 7:56am UTC](https://discuss.elastic.co/t/how-to-create-index-with-a-date-with-a-template/351440 "2024-01-22T07:56:44Z")
When i start logstash it creates index with a date, but if i delete this index it creates by the template without any date. How to create index with a date with a template ? Thanks --- ## [Repository verification status: Not connected](https://discuss.elastic.co/t/repository-verification-status-not-connected/351425)
**Author:** [@mbathann](https://discuss.elastic.co/u/mbathann)\ **Replies:** 6\ **Last updated:** [January 22, 2024, 7:01am UTC](https://discuss.elastic.co/t/repository-verification-status-not-connected/351425 "2024-01-22T07:01:43Z")
Greeting Elastic Communinity, I have ancountered an issue after creating a repository in kibana, when I click Verify Repository it returns Not connected status. This is a 3 node cluster here is the response error messa… --- ## [MetricBeat Setup](https://discuss.elastic.co/t/metricbeat-setup/351432)
**Author:** [@Ted0011](https://discuss.elastic.co/u/Ted0011)\ **Replies:** 5\ **Last updated:** [January 22, 2024, 6:28am UTC](https://discuss.elastic.co/t/metricbeat-setup/351432 "2024-01-22T06:28:34Z")
I am trying to configure my metricbeat on my elasticsearch but I am getting the following error message. "/metricbeat-7.17.16-linux-x86\_64\] Data path: \[/root/metricbeat-7.17.16-linux-x86\_64/data\] Logs path: \[/root/metri… --- ## [Cannot get specific prefix index names with ElasticSearch](https://discuss.elastic.co/t/cannot-get-specific-prefix-index-names-with-elasticsearch/351219)
**Author:** [@Eric\_Chen](https://discuss.elastic.co/u/Eric_Chen)\ **Replies:** 6\ **Last updated:** [January 22, 2024, 6:23am UTC](https://discuss.elastic.co/t/cannot-get-specific-prefix-index-names-with-elasticsearch/351219 "2024-01-22T06:23:19Z")
Hi everyone, I've run into an issue with Elasticsearch on our company's internal network and I'm not sure how to go about troubleshooting it. I need to extract information about indices (not documents) from my ES that ha… --- ## [Passing input value in run time in logstash](https://discuss.elastic.co/t/passing-input-value-in-run-time-in-logstash/351514)
**Author:** [@Sat\_elk](https://discuss.elastic.co/u/Sat_elk)\ **Replies:** 0\ **Last updated:** [January 22, 2024, 5:49am UTC](https://discuss.elastic.co/t/passing-input-value-in-run-time-in-logstash/351514 "2024-01-22T05:49:18Z")
I have a few input parameters like environment, ip\_address, host\_name, path, business\_entity. I have to use this values to validate in my filter plugins. help me. how the input should i store and which format then how t… --- ## [SIGSEGV JVM Crash](https://discuss.elastic.co/t/sigsegv-jvm-crash/351267)
**Author:** [@vladislav](https://discuss.elastic.co/u/vladislav)\ **Replies:** 5\ **Last updated:** [January 22, 2024, 5:00am UTC](https://discuss.elastic.co/t/sigsegv-jvm-crash/351267 "2024-01-22T05:00:23Z")
Hello! Thanks for help in advance I've running a 3-nodes cluster (es1, es2, es3). Recently, after VM restart (es2 node) it constantly crashes after several hours of work with SIGSEGV. Here is full error from journalctl… --- ## [My Kibana Discover or Elasticsearch not displaying documents when adding an index template](https://discuss.elastic.co/t/my-kibana-discover-or-elasticsearch-not-displaying-documents-when-adding-an-index-template/351398)
**Author:** [@Banel\_Angela](https://discuss.elastic.co/u/Banel_Angela)\ **Replies:** 2\ **Last updated:** [January 22, 2024, 2:59am UTC](https://discuss.elastic.co/t/my-kibana-discover-or-elasticsearch-not-displaying-documents-when-adding-an-index-template/351398 "2024-01-22T02:59:18Z")
Hi, My stack version is 8.11.4 When i adding template for analyzing nginx logs.: PUT /\_template/apigw?pretty { "index\_patterns": \[ "api-access-\*", "scoregateway-access-\*" \], "settings": { "number\_of\_… --- ## [Logstash with Kafka input - enable\_auto\_commit settings to minimise data loss?](https://discuss.elastic.co/t/logstash-with-kafka-input-enable-auto-commit-settings-to-minimise-data-loss/351505)
**Author:** [@ankh](https://discuss.elastic.co/u/ankh)\ **Replies:** 0\ **Last updated:** [January 21, 2024, 11:38pm UTC](https://discuss.elastic.co/t/logstash-with-kafka-input-enable-auto-commit-settings-to-minimise-data-loss/351505 "2024-01-21T23:38:47Z")
am using Logstash running in Kubernetes to ingest data from Kafka and write to Elasticsearch. If a Logstash instance ends abnormally while processing data, it can result in data loss. It appears there is no end-to-end a… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=325) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=327)