# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=463 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 464 --- ## [Can I update ES mappings to exclude copy\_to?](https://discuss.elastic.co/t/can-i-update-es-mappings-to-exclude-copy-to/339834)
**Author:** [@Vlado](https://discuss.elastic.co/u/Vlado)\ **Replies:** 1\ **Last updated:** [August 1, 2023, 6:34pm UTC](https://discuss.elastic.co/t/can-i-update-es-mappings-to-exclude-copy-to/339834 "2023-08-01T18:34:48Z")
Hi, What are ES back-compat rules around directives? Say, I have a copy\_to mapping on several fields with data already indexed and wanted to remove the "copy\_to" directive on some of those. Is this allowed? Or is it an… --- ## [How to filter a table based on another table's contents](https://discuss.elastic.co/t/how-to-filter-a-table-based-on-another-tables-contents/338965)
**Author:** [@Dillard\_Coffey](https://discuss.elastic.co/u/Dillard_Coffey)\ **Replies:** 3\ **Last updated:** [August 1, 2023, 6:32pm UTC](https://discuss.elastic.co/t/how-to-filter-a-table-based-on-another-tables-contents/338965 "2023-08-01T18:32:45Z")
Hello, I am using Kibana 7.10 and am trying to find a way to visualize the relationship that is between two tables of data I have. Table 1 is similar to: +-------------+-------------+------------+---------------+------… --- ## [Separate ELK pattern for log files](https://discuss.elastic.co/t/separate-elk-pattern-for-log-files/339817)
**Author:** [@sanjeev1895](https://discuss.elastic.co/u/sanjeev1895)\ **Replies:** 4\ **Last updated:** [August 1, 2023, 6:14pm UTC](https://discuss.elastic.co/t/separate-elk-pattern-for-log-files/339817 "2023-08-01T18:14:09Z")
Hi team, Can any one help me to find the solution for my below requirement. I have two apache server and I want to send the apache access and error logs to elk server via filebeat apache module to logstash. I configure… --- ## [Aggregation in Elasticserach Query Alert](https://discuss.elastic.co/t/aggregation-in-elasticserach-query-alert/339429)
**Author:** [@Dasher](https://discuss.elastic.co/u/Dasher)\ **Replies:** 1\ **Last updated:** [August 1, 2023, 6:11pm UTC](https://discuss.elastic.co/t/aggregation-in-elasticserach-query-alert/339429 "2023-08-01T18:11:23Z")
Hi All, If we go in the rules and select rule as elasticsearch query. Can we do an aggregation in the elasticsearch query. --- ## [Filebeat timestamp not working](https://discuss.elastic.co/t/filebeat-timestamp-not-working/339827)
**Author:** [@McJava1967](https://discuss.elastic.co/u/McJava1967)\ **Replies:** 1\ **Last updated:** [August 1, 2023, 6:05pm UTC](https://discuss.elastic.co/t/filebeat-timestamp-not-working/339827 "2023-08-01T18:05:53Z")
Hi all. I'm trying to tell Filebeat to use my timestamp, rather than creating one. I'm getting this error: "error": "failed parsing time field \_app.ACTUAL\_TIME='2023-08-01T11:49:09.386Z'", "errorCauses": \[{"error": "f… --- ## [Retrieving stored fields using java client](https://discuss.elastic.co/t/retrieving-stored-fields-using-java-client/339812)
**Author:** [@Jagadeesh12](https://discuss.elastic.co/u/Jagadeesh12)\ **Replies:** 2\ **Last updated:** [August 1, 2023, 5:37pm UTC](https://discuss.elastic.co/t/retrieving-stored-fields-using-java-client/339812 "2023-08-01T17:37:21Z")
Hi, I am facing issues while retrieving stored fields from Elasticsearch using java client. creating template: PUT \_index\_template/test\_tf\_template { "index\_patterns": \["test-tf-\*"\], "template": { "mappings":… --- ## [Need help in configuring filebeat 8.9 on windows server 2012 R2](https://discuss.elastic.co/t/need-help-in-configuring-filebeat-8-9-on-windows-server-2012-r2/339836)
**Author:** [@Shan2](https://discuss.elastic.co/u/Shan2)\ **Replies:** 0\ **Last updated:** [August 1, 2023, 4:36pm UTC](https://discuss.elastic.co/t/need-help-in-configuring-filebeat-8-9-on-windows-server-2012-r2/339836 "2023-08-01T16:36:48Z")
Hi All, First time implementing filebeat 8.9 on windows to pick files from Samba share and send it to Elasticsearch. The netwoek firewall rules has been allowed and telnet is also happening from windows server. We are g… --- ## [Is new Geometry simplifier (ES 8.9.0) available for direct use?](https://discuss.elastic.co/t/is-new-geometry-simplifier-es-8-9-0-available-for-direct-use/339832)
**Author:** [@Tomas\_Bartek](https://discuss.elastic.co/u/Tomas_Bartek)\ **Replies:** 0\ **Last updated:** [August 1, 2023, 4:33pm UTC](https://discuss.elastic.co/t/is-new-geometry-simplifier-es-8-9-0-available-for-direct-use/339832 "2023-08-01T16:33:47Z")
Hello ES friends, Is the new Geometry simplifier in ES version 8.9.0. available for direct use or is it only an internally callable feature ? From What's new document, it seems to me that it can be used merely for int… --- ## [Naming convention for ingest pipelines etc](https://discuss.elastic.co/t/naming-convention-for-ingest-pipelines-etc/339480)
**Author:** [@rsk0](https://discuss.elastic.co/u/rsk0)\ **Replies:** 6\ **Last updated:** [August 1, 2023, 3:32pm UTC](https://discuss.elastic.co/t/naming-convention-for-ingest-pipelines-etc/339480 "2023-08-01T15:32:59Z")
Elastic-Provided Naming Convention :question: Is there a naming convention for ingest pipelines, index templates, component templates, or any other such configuration objects? I see in the docs \[1,2,3,4\] there are examp… --- ## [retrieving a date format column in Logstash](https://discuss.elastic.co/t/retrieving-a-date-format-column-in-logstash/339821)
**Author:** [@Amal\_Krizi](https://discuss.elastic.co/u/Amal_Krizi)\ **Replies:** 0\ **Last updated:** [August 1, 2023, 3:22pm UTC](https://discuss.elastic.co/t/retrieving-a-date-format-column-in-logstash/339821 "2023-08-01T15:22:35Z")
good morning, I have a database that contains several columns, including date type columns. I was able to retrieve these date fields via logstach, but one in particular is stuck. This column takes a null date by defaul… --- ## [Elasticsearch for Data Science](https://discuss.elastic.co/t/elasticsearch-for-data-science/339818)
**Author:** [@tmslara.a](https://discuss.elastic.co/u/tmslara.a)\ **Replies:** 0\ **Last updated:** [August 1, 2023, 3:02pm UTC](https://discuss.elastic.co/t/elasticsearch-for-data-science/339818 "2023-08-01T15:02:14Z")
Hi, Some context. I'm using Elasticsearch and filebeat to store documents. I have 6 fields. One field represents the timestamp and the other 5 are keywords. Two fields correspond to IDs (id\_1 and id\_2). The IDs have man… --- ## [Combine data older then x days](https://discuss.elastic.co/t/combine-data-older-then-x-days/339804)
**Author:** [@Soren\_vdc](https://discuss.elastic.co/u/Soren_vdc)\ **Replies:** 0\ **Last updated:** [August 1, 2023, 1:53pm UTC](https://discuss.elastic.co/t/combine-data-older-then-x-days/339804 "2023-08-01T13:53:18Z")
Hi, I want to combine network data (based on scr/dst/port) to an aggregated index after 20 days. This to decrease the disk usage of this indices but still have the combined data available for specific searches. I'm che… --- ## [Iframed url expired after some time](https://discuss.elastic.co/t/iframed-url-expired-after-some-time/339646)
**Author:** [@Rushi\_Bagul](https://discuss.elastic.co/u/Rushi_Bagul)\ **Replies:** 3\ **Last updated:** [August 1, 2023, 1:32pm UTC](https://discuss.elastic.co/t/iframed-url-expired-after-some-time/339646 "2023-08-01T13:32:55Z")
Hi team, I have my kibana dashboard iframed short url in which some words I can't understand what is their meaning and can I used in python application? I am attached this short url please let explain what meaning of … --- ## [Setup a elastic cluster](https://discuss.elastic.co/t/setup-a-elastic-cluster/339741)
**Author:** [@psanggabuana](https://discuss.elastic.co/u/psanggabuana)\ **Replies:** 2\ **Last updated:** [August 1, 2023, 12:50pm UTC](https://discuss.elastic.co/t/setup-a-elastic-cluster/339741 "2023-08-01T12:50:09Z")
Hi everyone, I want to set up my cluster with the right server requirement. My cluster consists of: Master Data Coordinating Transform Ingest Can anyone share with me how much CPU, RAM, and storage for each server? … --- ## [Fleet Server does not come up - ECK](https://discuss.elastic.co/t/fleet-server-does-not-come-up-eck/338966)
**Author:** [@VVK](https://discuss.elastic.co/u/VVK)\ **Replies:** 8\ **Last updated:** [August 1, 2023, 12:31pm UTC](https://discuss.elastic.co/t/fleet-server-does-not-come-up-eck/338966 "2023-08-01T12:31:15Z")
My problem is similar to below. Failed to deploy fleet-server via eck in kubernetes. My K8S Environment: kubectl version command output is here. clientVersion: buildDate: "2022-08-23T17:44:59Z" compiler: gc git… --- ## [Dont work preference in es version 6](https://discuss.elastic.co/t/dont-work-preference-in-es-version-6/339756)
**Author:** [@slowup](https://discuss.elastic.co/u/slowup)\ **Replies:** 2\ **Last updated:** [August 1, 2023, 12:22pm UTC](https://discuss.elastic.co/t/dont-work-preference-in-es-version-6/339756 "2023-08-01T12:22:44Z")
I know that the preference custome string is a function that allows you to search with the same shard, but every time you search, a different shard is searched, so the search results of search after are strange. What sh… --- ## [Configuring Filebeat to pack openresty/nginx logs and visualize in Kibana dashboards](https://discuss.elastic.co/t/configuring-filebeat-to-pack-openresty-nginx-logs-and-visualize-in-kibana-dashboards/339300)
**Author:** [@kpagcha](https://discuss.elastic.co/u/kpagcha)\ **Replies:** 4\ **Last updated:** [August 1, 2023, 12:15pm UTC](https://discuss.elastic.co/t/configuring-filebeat-to-pack-openresty-nginx-logs-and-visualize-in-kibana-dashboards/339300 "2023-08-01T12:15:25Z")
I am totally new with the ELK stack and not really a sysadmin either, just a web developer trying to figure this out. I have two droplets: one where I installed the ELK stack successfully to some extent (managed to vi… --- ## [URGENT: Handshake failed. unexpected remote node](https://discuss.elastic.co/t/urgent-handshake-failed-unexpected-remote-node/339796)
**Author:** [@Piyush\_Goyal1](https://discuss.elastic.co/u/Piyush_Goyal1)\ **Replies:** 0\ **Last updated:** [August 1, 2023, 12:05pm UTC](https://discuss.elastic.co/t/urgent-handshake-failed-unexpected-remote-node/339796 "2023-08-01T12:05:00Z")
Version: 8.5.0 The cluster has 3 nodes: node-001 (master) node-002 (data) node-003 (data) The master node VM crashed and upon restarting the master node, the data nodes are not getting discovered. The cluster was ru… --- ## [Ingest CSVs with filebeat into elastic cloud](https://discuss.elastic.co/t/ingest-csvs-with-filebeat-into-elastic-cloud/339790)
**Author:** [@Vog93](https://discuss.elastic.co/u/Vog93)\ **Replies:** 1\ **Last updated:** [August 1, 2023, 11:34am UTC](https://discuss.elastic.co/t/ingest-csvs-with-filebeat-into-elastic-cloud/339790 "2023-08-01T11:34:07Z")
I was able to import a csv using filebeat to elastic cloud. I did the following: First i uploaded the csv to elastic in order to have the filebeat yml configuration. Then I modified the filebeat.yml and installed fileb… --- ## [Rack Awarness and Node Aware](https://discuss.elastic.co/t/rack-awarness-and-node-aware/339786)
**Author:** [@mannoj87](https://discuss.elastic.co/u/mannoj87)\ **Replies:** 0\ **Last updated:** [August 1, 2023, 11:00am UTC](https://discuss.elastic.co/t/rack-awarness-and-node-aware/339786 "2023-08-01T11:00:23Z")
I'm in 7.17.7 ES. I have 6BareMetal(BM), each BM will have 4VirtualMachines(VM), each VM's having ES service running and all 5BM are in 3 Physical Racks. Reason: I dont want Primary and Replica to reside on same BM as … --- ## [Pivot Table](https://discuss.elastic.co/t/pivot-table/339318)
**Author:** [@sbottura](https://discuss.elastic.co/u/sbottura)\ **Replies:** 4\ **Last updated:** [August 1, 2023, 10:40am UTC](https://discuss.elastic.co/t/pivot-table/339318 "2023-08-01T10:40:29Z")
Hello, I am fairly new to the Elastic Stack and I was wondering whether it would be possible to create a pivot table in Kibana. Thanks, S. --- ## [How to query 3 indexes in logstash](https://discuss.elastic.co/t/how-to-query-3-indexes-in-logstash/339785)
**Author:** [@willsy](https://discuss.elastic.co/u/willsy)\ **Replies:** 0\ **Last updated:** [August 1, 2023, 10:41am UTC](https://discuss.elastic.co/t/how-to-query-3-indexes-in-logstash/339785 "2023-08-01T10:41:50Z")
In logstash i am trying to forward all of the logs in elasticsearch into logstash and then to a third party. What is the correct configuration for the index query? # Sample Logstash configuration for creating a simple #… --- ## [Lens formula conditionals](https://discuss.elastic.co/t/lens-formula-conditionals/339784)
**Author:** [@davidleongz](https://discuss.elastic.co/u/davidleongz)\ **Replies:** 0\ **Last updated:** [August 1, 2023, 10:36am UTC](https://discuss.elastic.co/t/lens-formula-conditionals/339784 "2023-08-01T10:36:16Z")
I want to use conditional on Lens Formula but I have this message "Operations if, eq not found" I'm using 7.16.2 version. What do I have to do to be able to use conditionals? Is possible? --- ## [EsHadoopIllegalArgumentException: Detected type name in resource On elastic 8.8.2](https://discuss.elastic.co/t/eshadoopillegalargumentexception-detected-type-name-in-resource-on-elastic-8-8-2/339660)
**Author:** [@Joachim\_Rodrigues](https://discuss.elastic.co/u/Joachim_Rodrigues)\ **Replies:** 1\ **Last updated:** [July 31, 2023, 9:27pm UTC](https://discuss.elastic.co/t/eshadoopillegalargumentexception-detected-type-name-in-resource-on-elastic-8-8-2/339660 "2023-07-31T21:27:19Z")
Hi I upgraded my elastic server fom 7.9.3 to 8.8.2 With my previous configuration : implementation("org.elasticsearch:elasticsearch-spark-20\_2.11:7.9.3") { exclude("org.apache.spark") } This code was … --- ## [How can I reindex TSDB enabled data stream?](https://discuss.elastic.co/t/how-can-i-reindex-tsdb-enabled-data-stream/339774)
**Author:** [@Aliabbas](https://discuss.elastic.co/u/Aliabbas)\ **Replies:** 0\ **Last updated:** [August 1, 2023, 8:48am UTC](https://discuss.elastic.co/t/how-can-i-reindex-tsdb-enabled-data-stream/339774 "2023-08-01T08:48:24Z")
Hi, I am currently facing conflicts in a fields host.ip. I can resolve that by using an Reindexing API but the problem is the data stream is TSDB enabled. Any idea how can we reindex a TSDB enabled data stream? FYI I am… --- ## [Kibana console is running very slow](https://discuss.elastic.co/t/kibana-console-is-running-very-slow/339766)
**Author:** [@Vartika\_Singh](https://discuss.elastic.co/u/Vartika_Singh)\ **Replies:** 2\ **Last updated:** [August 1, 2023, 10:10am UTC](https://discuss.elastic.co/t/kibana-console-is-running-very-slow/339766 "2023-08-01T10:10:36Z")
in kibana console sub tabs were working very slow...what is reason behind that? --- ## [Getting Null Pointer while using reloadable synonyms](https://discuss.elastic.co/t/getting-null-pointer-while-using-reloadable-synonyms/339775)
**Author:** [@Siddharth\_Gupta1](https://discuss.elastic.co/u/Siddharth_Gupta1)\ **Replies:** 2\ **Last updated:** [August 1, 2023, 10:06am UTC](https://discuss.elastic.co/t/getting-null-pointer-while-using-reloadable-synonyms/339775 "2023-08-01T10:06:17Z")
Hi Team I am currently facing an issue while utilizing readable synonyms from a file with my completion suggestor. The problem seems to be related to the search\_analyzers in my mappings. Strangely, the completion sugges… --- ## [Override filebeat input paths using command line configuration override?](https://discuss.elastic.co/t/override-filebeat-input-paths-using-command-line-configuration-override/339482)
**Author:** [@tolland](https://discuss.elastic.co/u/tolland)\ **Replies:** 2\ **Last updated:** [August 1, 2023, 9:52am UTC](https://discuss.elastic.co/t/override-filebeat-input-paths-using-command-line-configuration-override/339482 "2023-08-01T09:52:00Z")
I have a filebeat filestream input which parses a complicated message format. There are a few edge cases I'd like to create standalone tests for. I'd like to test single instances of the the message format from the comma… --- ## [Standard Cloud Deployment unresponsive +12h](https://discuss.elastic.co/t/standard-cloud-deployment-unresponsive-12h/339765)
**Author:** [@Novel\_one](https://discuss.elastic.co/u/Novel_one)\ **Replies:** 1\ **Last updated:** [August 1, 2023, 9:41am UTC](https://discuss.elastic.co/t/standard-cloud-deployment-unresponsive-12h/339765 "2023-08-01T09:41:12Z")
Hi, thanks for any early response, I have been running a small deployment for almost a year. Yesterday I activated sending the internal logs and metrics to the same deployment, and during the last 12h any attempt on sto… --- ## [Handling of Multiline Scenarios](https://discuss.elastic.co/t/handling-of-multiline-scenarios/339069)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 1\ **Last updated:** [August 1, 2023, 9:32am UTC](https://discuss.elastic.co/t/handling-of-multiline-scenarios/339069 "2023-08-01T09:32:42Z")
Hi, We have a need to add a second multiline block to our filebeat config. What isn't clear to me is the order in which multiline blocks are executed. Am I right to assume that they're executed in the order that the con… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=462) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=464)