# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=333 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 334 --- ## [Time range based on timestamp in DSL query](https://discuss.elastic.co/t/time-range-based-on-timestamp-in-dsl-query/350962)
**Author:** [@LeCalve](https://discuss.elastic.co/u/LeCalve)\ **Replies:** 3\ **Last updated:** [January 12, 2024, 2:57pm UTC](https://discuss.elastic.co/t/time-range-based-on-timestamp-in-dsl-query/350962 "2024-01-12T14:57:31Z")
Hello, I want to make a filter based on the time of a timestamp. I would like to extract all timestamps which have a time \< 8 or time \> 20. I don't know how to make the DSL query for that :slight\_smile: { --- ## [Utilize serilog sinks to elastic search](https://discuss.elastic.co/t/utilize-serilog-sinks-to-elastic-search/350969)
**Author:** [@minh.tran](https://discuss.elastic.co/u/minh.tran)\ **Replies:** 0\ **Last updated:** [January 12, 2024, 2:36pm UTC](https://discuss.elastic.co/t/utilize-serilog-sinks-to-elastic-search/350969 "2024-01-12T14:36:01Z")
Hi there, we are currently using seirlog elastic sink. Details can be found here GitHub - serilog-contrib/serilog-sinks-elasticsearch: A Serilog sink that writes events to Elasticsearch Is there a way we can make the si… --- ## [Mapping conflict](https://discuss.elastic.co/t/mapping-conflict/350919)
**Author:** [@mb19](https://discuss.elastic.co/u/mb19)\ **Replies:** 7\ **Last updated:** [January 12, 2024, 2:30pm UTC](https://discuss.elastic.co/t/mapping-conflict/350919 "2024-01-12T14:30:14Z")
Hello everyone, I am new to using the Elasticsearch and Kiabana stack, I do not currently have Logstash installed and would prefer not to install it. I recently had this error: I don't know how to fix it, I think I… --- ## [Analysis is not available for this field](https://discuss.elastic.co/t/analysis-is-not-available-for-this-field/350965)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 1\ **Last updated:** [January 12, 2024, 2:25pm UTC](https://discuss.elastic.co/t/analysis-is-not-available-for-this-field/350965 "2024-01-12T14:25:19Z")
Kibana for some fields that used to work now returns me a Analysis is not available for this field. message and they do not show up in Discover tables etc. It is also impossible to search using these fields such as field… --- ## [Facing issue in elasticsearch - /usr/share/elasticsearch/config/elasticsearch.keystore: Device or resource busy](https://discuss.elastic.co/t/facing-issue-in-elasticsearch-usr-share-elasticsearch-config-elasticsearch-keystore-device-or-resource-busy/350905)
**Author:** [@Akshay04](https://discuss.elastic.co/u/Akshay04)\ **Replies:** 1\ **Last updated:** [January 12, 2024, 2:23pm UTC](https://discuss.elastic.co/t/facing-issue-in-elasticsearch-usr-share-elasticsearch-config-elasticsearch-keystore-device-or-resource-busy/350905 "2024-01-12T14:23:49Z")
Hello, I'm trying to enable Google OAuth with Elasticsearch using - Set up OpenID Connect with Azure, Google, or Okta | Elasticsearch Service Documentation | Elastic I'm deploying this to Kubernetes and using Elastic … --- ## [Jenkins logstash plugin don't send build log](https://discuss.elastic.co/t/jenkins-logstash-plugin-dont-send-build-log/350967)
**Author:** [@khergner](https://discuss.elastic.co/u/khergner)\ **Replies:** 0\ **Last updated:** [January 12, 2024, 2:09pm UTC](https://discuss.elastic.co/t/jenkins-logstash-plugin-dont-send-build-log/350967 "2024-01-12T14:09:22Z")
Hi everyone I have a problem. ı want to use logstash plugin with jenkins. İt isn't send build log elasticsearch but ı have bellow error. I don't upgrade logstash latest plugin because many plugin must upgrade from jenk… --- ## [Custom logs from Logstash to Cloudwatch](https://discuss.elastic.co/t/custom-logs-from-logstash-to-cloudwatch/350955)
**Author:** [@Vadsgator](https://discuss.elastic.co/u/Vadsgator)\ **Replies:** 1\ **Last updated:** [January 12, 2024, 1:55pm UTC](https://discuss.elastic.co/t/custom-logs-from-logstash-to-cloudwatch/350955 "2024-01-12T13:55:28Z")
Hiya, Currently there is no actual support to send custom logs from Logstash to Cloudwatch. (There is a way to send metrics data using the Cloudwatch Output Plugin) and there was some support for a plugin called logstas… --- ## [How can I implement this with the latest Elasticsearch C# client version, v8?](https://discuss.elastic.co/t/how-can-i-implement-this-with-the-latest-elasticsearch-c-client-version-v8/350951)
**Author:** [@David\_Silwal](https://discuss.elastic.co/u/David_Silwal)\ **Replies:** 0\ **Last updated:** [January 12, 2024, 12:49pm UTC](https://discuss.elastic.co/t/how-can-i-implement-this-with-the-latest-elasticsearch-c-client-version-v8/350951 "2024-01-12T12:49:04Z")
How can I implement this with the latest Elasticsearch C# client version, v8? var searchResponse = elasticClient .Search\(s =\> s .Index(IndexNames.Cases) .Query(q =\> q .Match(m =\> m .Field("Description") .Query(que… --- ## [Transfer indices to new cluster](https://discuss.elastic.co/t/transfer-indices-to-new-cluster/350946)
**Author:** [@JimJ](https://discuss.elastic.co/u/JimJ)\ **Replies:** 0\ **Last updated:** [January 12, 2024, 12:40pm UTC](https://discuss.elastic.co/t/transfer-indices-to-new-cluster/350946 "2024-01-12T12:40:19Z")
I put in place a new Elastic cluster v8.7 to replace an old one in v7.12. In Elastic cluster v8.7, I started using Datastreams. My question: what is the best way to transfer indices' data from old cluster to datastream… --- ## [System indexes stuck initializing state](https://discuss.elastic.co/t/system-indexes-stuck-initializing-state/350937)
**Author:** [@joao-subtil](https://discuss.elastic.co/u/joao-subtil)\ **Replies:** 0\ **Last updated:** [January 12, 2024, 11:24am UTC](https://discuss.elastic.co/t/system-indexes-stuck-initializing-state/350937 "2024-01-12T11:24:58Z")
Hello, I am using Elastic 8.11 and was attempting to setup a cluster with ilm for hot/warm/cold. However after creating the instance and roles and users I get the system indices stuck in initializing state and cannot m… --- ## [Very slow queries always take 1s](https://discuss.elastic.co/t/very-slow-queries-always-take-1s/350933)
**Author:** [@matthijs1](https://discuss.elastic.co/u/matthijs1)\ **Replies:** 0\ **Last updated:** [January 12, 2024, 11:02am UTC](https://discuss.elastic.co/t/very-slow-queries-always-take-1s/350933 "2024-01-12T11:02:06Z")
Hi All, I'm not that experienced in Elastic Search, but I have a problem and I'm out of ideas to try. In a test setup, I have a 3-node cluster running ES6.8.22 on windows. Until a windows reboot (for updates) 2 days a… --- ## [\[Filebeat\] Bug with aws-cloudwatch logs using log\_group\_arn](https://discuss.elastic.co/t/filebeat-bug-with-aws-cloudwatch-logs-using-log-group-arn/350930)
**Author:** [@Blaj\_Dragos](https://discuss.elastic.co/u/Blaj_Dragos)\ **Replies:** 0\ **Last updated:** [January 12, 2024, 10:35am UTC](https://discuss.elastic.co/t/filebeat-bug-with-aws-cloudwatch-logs-using-log-group-arn/350930 "2024-01-12T10:35:48Z")
Hi! I have a filebeat system with the following configuration as an input: filebeat.inputs: - type: aws-cloudwatch log\_group\_arn: arn:aws:logs:eu-west-1:\*:log-group:/ecs/log:\* scan\_frequency: 30s s… --- ## [Configuration fortigate with filebeat](https://discuss.elastic.co/t/configuration-fortigate-with-filebeat/350421)
**Author:** [@Dy\_Vanrith](https://discuss.elastic.co/u/Dy_Vanrith)\ **Replies:** 5\ **Last updated:** [January 12, 2024, 10:11am UTC](https://discuss.elastic.co/t/configuration-fortigate-with-filebeat/350421 "2024-01-12T10:11:51Z")
Hello i have project that work with fortigate and filebeat i want to collect sys\_log from fortigate into filebeat my configuration fortigate config log syslogd setting set status enable set server filebeat\_server s… --- ## [Watcher to index all data from /cat/indices/\*,-.\* each indexname should be inserted as one doc](https://discuss.elastic.co/t/watcher-to-index-all-data-from-cat-indices-each-indexname-should-be-inserted-as-one-doc/350672)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 5\ **Last updated:** [January 12, 2024, 9:38am UTC](https://discuss.elastic.co/t/watcher-to-index-all-data-from-cat-indices-each-indexname-should-be-inserted-as-one-doc/350672 "2024-01-12T09:38:38Z")
Hi team, Can you please help me on below requirement: Get index name and size (in bytes) from GET /cat/indices/,-. Insert this data into new index IDs should be elastic generated. Add timestamp field in every doc Pro… --- ## [Silent failures with delete-by-query](https://discuss.elastic.co/t/silent-failures-with-delete-by-query/350925)
**Author:** [@mrodent](https://discuss.elastic.co/u/mrodent)\ **Replies:** 0\ **Last updated:** [January 12, 2024, 9:38am UTC](https://discuss.elastic.co/t/silent-failures-with-delete-by-query/350925 "2024-01-12T09:38:27Z")
I've examined all the questions on this subject. None seems to address the problem I'm having. I need to loop through doing multiple delete\_by\_queries. As I've set things up for experimenting, just a handful. The proble… --- ## [Transform destination index rollover](https://discuss.elastic.co/t/transform-destination-index-rollover/350578)
**Author:** [@veryelastic](https://discuss.elastic.co/u/veryelastic)\ **Replies:** 2\ **Last updated:** [January 12, 2024, 9:25am UTC](https://discuss.elastic.co/t/transform-destination-index-rollover/350578 "2024-01-12T09:25:38Z")
Hello, It has been a while (I think) since this question came up on here, so I thought I'd check whether the answer had changed or not. I have a transform which produces consolidated data with a time-series element to … --- ## [Visualization (pie) of index with all fields included](https://discuss.elastic.co/t/visualization-pie-of-index-with-all-fields-included/350845)
**Author:** [@Anomalous\_User](https://discuss.elastic.co/u/Anomalous_User)\ **Replies:** 3\ **Last updated:** [January 12, 2024, 9:14am UTC](https://discuss.elastic.co/t/visualization-pie-of-index-with-all-fields-included/350845 "2024-01-12T09:14:07Z")
Hi, I'm using 7.17 (we're upgrading soon). At the moment I have lens/graph/visualize library all open searching for a way to include all fields (many) from an index and display them in a pie chart. I can see how to do th… --- ## [Curl XPOST not working after upgrading from Elastic v7 to Elastic v8](https://discuss.elastic.co/t/curl-xpost-not-working-after-upgrading-from-elastic-v7-to-elastic-v8/350706)
**Author:** [@zeninuxx](https://discuss.elastic.co/u/zeninuxx)\ **Replies:** 3\ **Last updated:** [January 12, 2024, 8:51am UTC](https://discuss.elastic.co/t/curl-xpost-not-working-after-upgrading-from-elastic-v7-to-elastic-v8/350706 "2024-01-12T08:51:00Z")
This is an example of a json file I am trying to POST into elasticsearch: {"index": {}} {"topic": "example1", "size": 2192, "timestamp": "2024-01-10"} {"index": {}} {"topic": "example2", "size": 2052, "timestamp": "2024… --- ## [BigQuery to ElasticSearch using DataFlow template, Not working](https://discuss.elastic.co/t/bigquery-to-elasticsearch-using-dataflow-template-not-working/350759)
**Author:** [@aji.shinde7](https://discuss.elastic.co/u/aji.shinde7)\ **Replies:** 1\ **Last updated:** [January 12, 2024, 8:19am UTC](https://discuss.elastic.co/t/bigquery-to-elasticsearch-using-dataflow-template-not-working/350759 "2024-01-12T08:19:26Z")
Hello Experts, Please Help, I followed this article to pull data from Google BigQuery into Elastic using Google DataFlow : Ingest data directly from Google BigQuery into Elastic using Google Dataflow | Elastic Blog I … --- ## [Logstash input with beats function is not work good by OCP platform in ingress](https://discuss.elastic.co/t/logstash-input-with-beats-function-is-not-work-good-by-ocp-platform-in-ingress/350915)
**Author:** [@bigwind123](https://discuss.elastic.co/u/bigwind123)\ **Replies:** 0\ **Last updated:** [January 12, 2024, 7:47am UTC](https://discuss.elastic.co/t/logstash-input-with-beats-function-is-not-work-good-by-ocp-platform-in-ingress/350915 "2024-01-12T07:47:36Z")
I am currently facing a problem. I'm planning to set up an ELK service on a redhat ocp platform and install metricbeat on the VM to send the data to a logstash pod in ocp, I'm currently doing the following. a pod -\> e… --- ## [Unable to connect filbeat to logstash](https://discuss.elastic.co/t/unable-to-connect-filbeat-to-logstash/350912)
**Author:** [@dark\_header](https://discuss.elastic.co/u/dark_header)\ **Replies:** 0\ **Last updated:** [January 12, 2024, 7:32am UTC](https://discuss.elastic.co/t/unable-to-connect-filbeat-to-logstash/350912 "2024-01-12T07:32:56Z")
hi team , installed in ELK ( Elasticsearch , logstash , kibana and filebeat ) in same server unable to connect from filebeat to logstash , getting error below {"log.level":"error","timestamp":"2024-01-11T17:49:55.606+0… --- ## [How to pause the logstash output temporarily](https://discuss.elastic.co/t/how-to-pause-the-logstash-output-temporarily/350841)
**Author:** [@jevonsnotes](https://discuss.elastic.co/u/jevonsnotes)\ **Replies:** 3\ **Last updated:** [January 12, 2024, 5:36am UTC](https://discuss.elastic.co/t/how-to-pause-the-logstash-output-temporarily/350841 "2024-01-12T05:36:49Z")
how to keep the logstash accept the input data but pause the output temporarily? --- ## [●\[TLS\] Question: Secure communication between Winlogbeat/ElasticSearch causes an error](https://discuss.elastic.co/t/tls-question-secure-communication-between-winlogbeat-elasticsearch-causes-an-error/350898)
**Author:** [@YUUTA.INOUE-JPN](https://discuss.elastic.co/u/YUUTA.INOUE-JPN)\ **Replies:** 2\ **Last updated:** [January 12, 2024, 3:33am UTC](https://discuss.elastic.co/t/tls-question-secure-communication-between-winlogbeat-elasticsearch-causes-an-error/350898 "2024-01-12T03:33:52Z")
I am configuring "Elastic Stack" using a self-signed certificate. Secure communication between Elasticsearch worked fine, but Secure communication between Winlogbeat/Elasticsearch will result in an error. Please teach… --- ## [Elastic Agent failing to parse valid condition functions](https://discuss.elastic.co/t/elastic-agent-failing-to-parse-valid-condition-functions/349579)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 8\ **Last updated:** [January 12, 2024, 1:34am UTC](https://discuss.elastic.co/t/elastic-agent-failing-to-parse-valid-condition-functions/349579 "2024-01-12T01:34:46Z")
Hi, I'm having an issue where if I try to run elastic-agent inspect with a policy that defines a condition with a function, I get an error, even if the function is valid. Elastic Agent 8.11.3 Example: Use the Kuberne… --- ## [Logstash TCP Input Codecs](https://discuss.elastic.co/t/logstash-tcp-input-codecs/350517)
**Author:** [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Replies:** 10\ **Last updated:** [January 11, 2024, 11:09pm UTC](https://discuss.elastic.co/t/logstash-tcp-input-codecs/350517 "2024-01-11T23:09:15Z")
Is there a place to undestand exactly what format each of the TCP input codecs are meant to cover? (line vs json vs plain vs cef). I have a situation of a new log source (Sophos firewall). Must use TLS so syslog input i… --- ## [How to parse json from message field](https://discuss.elastic.co/t/how-to-parse-json-from-message-field/350769)
**Author:** [@wrender1](https://discuss.elastic.co/u/wrender1)\ **Replies:** 3\ **Last updated:** [January 11, 2024, 9:59pm UTC](https://discuss.elastic.co/t/how-to-parse-json-from-message-field/350769 "2024-01-11T21:59:07Z")
Hello, I'm looking for help with parsing json data out of a log field. I'm using the elastic agent standalone in Kubernetes and not sure how to configure it for this. I believe the filebeat portion of the elastic agent … --- ## [Collect values from elasticsearch/kibana](https://discuss.elastic.co/t/collect-values-from-elasticsearch-kibana/350886)
**Author:** [@cyberphantom](https://discuss.elastic.co/u/cyberphantom)\ **Replies:** 1\ **Last updated:** [January 11, 2024, 8:54pm UTC](https://discuss.elastic.co/t/collect-values-from-elasticsearch-kibana/350886 "2024-01-11T20:54:08Z")
Hello! I'm trying to retrieve specific values from my Elasticsearch/Kibana graphs to manipulate them in another environment. Initially, I thought I could achieve this using the Elasticsearch API, but being relatively ne… --- ## [Elastic APM Javagent + Elastic search](https://discuss.elastic.co/t/elastic-apm-javagent-elastic-search/350805)
**Author:** [@RavaliJ](https://discuss.elastic.co/u/RavaliJ)\ **Replies:** 8\ **Last updated:** [January 11, 2024, 8:25pm UTC](https://discuss.elastic.co/t/elastic-apm-javagent-elastic-search/350805 "2024-01-11T20:25:44Z")
Hi, I am using elastic-apm-agent-1.45.0.jar to instrument a java spring boot application. I have installed Elasticsearch - 8.8.0 and apm-server-8.8.0 on my local windows machine. Made necessary basic config changes to t… --- ## [Elastic Canvas: Discrepancy on data using ES SQL](https://discuss.elastic.co/t/elastic-canvas-discrepancy-on-data-using-es-sql/350882)
**Author:** [@pikaia](https://discuss.elastic.co/u/pikaia)\ **Replies:** 0\ **Last updated:** [January 11, 2024, 6:35pm UTC](https://discuss.elastic.co/t/elastic-canvas-discrepancy-on-data-using-es-sql/350882 "2024-01-11T18:35:24Z")
Hi, I've been uploading vulnerabilities to Elastic where the fields are already mapped to ECS, and so far, everything has been working fine. Now, I have the need to generate a report at the beginning of each month to pr… --- ## [Normalization or denormalization structure(Notification to multiple recipients - business logic)](https://discuss.elastic.co/t/normalization-or-denormalization-structure-notification-to-multiple-recipients-business-logic/350877)
**Author:** [@Behemo1h](https://discuss.elastic.co/u/Behemo1h)\ **Replies:** 0\ **Last updated:** [January 11, 2024, 6:09pm UTC](https://discuss.elastic.co/t/normalization-or-denormalization-structure-notification-to-multiple-recipients-business-logic/350877 "2024-01-11T18:09:27Z")
Hello all. I can't decide whether to "normalize" the data or not. I have notification datas in my app. When notification can be triggered for whole complay, user, or user in company. My current data looks like: Its o… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=332) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=334)