# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=698 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 699 --- ## [Logstash convert existing timestamp format in message](https://discuss.elastic.co/t/logstash-convert-existing-timestamp-format-in-message/321309)
**Author:** [@Groove](https://discuss.elastic.co/u/Groove)\ **Replies:** 0\ **Last updated:** [December 15, 2022, 1:10pm UTC](https://discuss.elastic.co/t/logstash-convert-existing-timestamp-format-in-message/321309 "2022-12-15T13:10:09Z")
Hello, I have 2 different application logs. OUTPUT: \<135\>1 2022-12-12T16:28:02Z HOSTNAME EvntSLog - - - Le service Service de licences de client (ClipSVC) est entré dans l’état : arrêté. \<134\>Dec 12 16:28:02 HOSTNAME… --- ## [Best strategy for re-indexing?](https://discuss.elastic.co/t/best-strategy-for-re-indexing/320567)
**Author:** [@Michal\_Stefaniuk](https://discuss.elastic.co/u/Michal_Stefaniuk)\ **Replies:** 5\ **Last updated:** [December 15, 2022, 11:56am UTC](https://discuss.elastic.co/t/best-strategy-for-re-indexing/320567 "2022-12-15T11:56:15Z")
Hey guys! I have an index in my ES and apparently I've added a new fields in the mapping (on the spring boot application side). Now the application will be released to the client and on the client side we will have to c… --- ## [Different Query format for wildcard query and term query](https://discuss.elastic.co/t/different-query-format-for-wildcard-query-and-term-query/321250)
**Author:** [@adholpuria](https://discuss.elastic.co/u/adholpuria)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 10:50am UTC](https://discuss.elastic.co/t/different-query-format-for-wildcard-query-and-term-query/321250 "2022-12-15T10:50:59Z")
Hey community, I am currently using below mentioned query format for term query { "query": { "term": { "core.externalId": "Kimchy" } } Below is the query format described in Elasticsearch Document Ter… --- ## [Transforms combining pivot & latest](https://discuss.elastic.co/t/transforms-combining-pivot-latest/321193)
**Author:** [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Replies:** 5\ **Last updated:** [December 15, 2022, 10:35am UTC](https://discuss.elastic.co/t/transforms-combining-pivot-latest/321193 "2022-12-15T10:35:17Z")
Hello, I have a case where i pivot data based on : @timestamp (interval of 1 day) Entity (let say customer\_account) A customer\_account can order items any time, so raw data are like : order\_id @timestamp product\_i… --- ## [Sort bucket and metrics columns in Data table](https://discuss.elastic.co/t/sort-bucket-and-metrics-columns-in-data-table/319130)
**Author:** [@karlanakamura](https://discuss.elastic.co/u/karlanakamura)\ **Replies:** 1\ **Last updated:** [December 15, 2022, 10:22am UTC](https://discuss.elastic.co/t/sort-bucket-and-metrics-columns-in-data-table/319130 "2022-12-15T10:22:23Z")
Hello, I'm using version 8.4.3 of elastic cloud. I have a data table with 5 butckets (split row) and 4 metrics. From what I understand, the buckets columns are always before and the metrics columns are after. I would l… --- ## [Forward logs from Kafka to Elastic](https://discuss.elastic.co/t/forward-logs-from-kafka-to-elastic/320075)
**Author:** [@Deepika1](https://discuss.elastic.co/u/Deepika1)\ **Replies:** 3\ **Last updated:** [December 15, 2022, 10:10am UTC](https://discuss.elastic.co/t/forward-logs-from-kafka-to-elastic/320075 "2022-12-15T10:10:44Z")
Hello, I'm trying to forward logs from Kafka machine to Elasticsearch machine using kafka elastic connect referring below document configurations are: name=elasticsearch-sink connector.class=io.confluent.connect.ela… --- ## [Can't get started with the ElasticSearch Java API classes](https://discuss.elastic.co/t/cant-get-started-with-the-elasticsearch-java-api-classes/320951)
**Author:** [@Alain\_Desilets](https://discuss.elastic.co/u/Alain_Desilets)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 10:10am UTC](https://discuss.elastic.co/t/cant-get-started-with-the-elasticsearch-java-api-classes/320951 "2022-12-15T10:10:02Z")
I am am having a hell of a time trying to get started with the ES Java API using the instructions on the official doc I install it as instructed here, i.e., I put this in my pom.xml file: \ \ **Author:** [@swethanannam1325](https://discuss.elastic.co/u/swethanannam1325)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 10:09am UTC](https://discuss.elastic.co/t/how-to-enable-https-and-security-for-my-dev-elk-stack-cluster/321222 "2022-12-15T10:09:35Z") Hi, I'm new to Elastic Stack and I've setup Dev environment in my local machine. Can someone guide me on how to enable security for my Elasticsearch and Kibana. Also, do share me any documentation if available. --- ## [Kibana 8.2.3 "Donut chart can't render with negative values"](https://discuss.elastic.co/t/kibana-8-2-3-donut-chart-cant-render-with-negative-values/314508)
**Author:** [@nesretep](https://discuss.elastic.co/u/nesretep)\ **Replies:** 20\ **Last updated:** [October 20, 2022, 4:08pm UTC](https://discuss.elastic.co/t/kibana-8-2-3-donut-chart-cant-render-with-negative-values/314508 "2022-10-20T16:08:21Z")
Previously donuts and pies just rendered. Now this message is shown when negative values exist on buckets. How can this message be turned off, and thereby achieve the rendering of all buckets which are in fact positive. … --- ## [\[7.5\] How to grant a user permission to create an index pattern?](https://discuss.elastic.co/t/7-5-how-to-grant-a-user-permission-to-create-an-index-pattern/319588)
**Author:** [@mpniel](https://discuss.elastic.co/u/mpniel)\ **Replies:** 9\ **Last updated:** [December 15, 2022, 9:15am UTC](https://discuss.elastic.co/t/7-5-how-to-grant-a-user-permission-to-create-an-index-pattern/319588 "2022-12-15T09:15:37Z")
Hi \[7.5\] How to grant a user permission to create an index pattern? --- ## [Unrecognized function: kibanaRemoveFilter](https://discuss.elastic.co/t/unrecognized-function-kibanaremovefilter/321274)
**Author:** [@Jaro](https://discuss.elastic.co/u/Jaro)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 8:56am UTC](https://discuss.elastic.co/t/unrecognized-function-kibanaremovefilter/321274 "2022-12-15T08:56:01Z")
Hello, I get a visualisation error in Kibana: Unrecognized function: kibanaRemoveFilter The Vega code for the visualisation is below. It worked before we upgraded Kibana to OpenSearch 2.2.1 Would anyone know why is … --- ## [Grok Pattern](https://discuss.elastic.co/t/grok-pattern/321273)
**Author:** [@imdroid](https://discuss.elastic.co/u/imdroid)\ **Replies:** 0\ **Last updated:** [December 15, 2022, 8:33am UTC](https://discuss.elastic.co/t/grok-pattern/321273 "2022-12-15T08:33:10Z")
Hello, I'm trying to configure an ingest pipeline for my apache tomcat logs, need some help in generating a grok pattern for the below stack trace. \< 2022-12-15 06:24:37,468 \[DiscoveryClient-2\] ERROR \[/\] com.netflix.d… --- ## [Socket timeout using the v8 driver](https://discuss.elastic.co/t/socket-timeout-using-the-v8-driver/321197)
**Author:** [@Mhanna\_Abu\_Tareef](https://discuss.elastic.co/u/Mhanna_Abu_Tareef)\ **Replies:** 1\ **Last updated:** [December 15, 2022, 8:14am UTC](https://discuss.elastic.co/t/socket-timeout-using-the-v8-driver/321197 "2022-12-15T08:14:15Z")
Just moved to the new elastic client v8, but not able to overcome this annoying issue. a single request - create index - fails by timeout in the server log i can see the index got created the delete index right after … --- ## [Problem configure output Email in logstash.conf?](https://discuss.elastic.co/t/problem-configure-output-email-in-logstash-conf/321269)
**Author:** [@tpot\_IT](https://discuss.elastic.co/u/tpot_IT)\ **Replies:** 0\ **Last updated:** [December 15, 2022, 8:07am UTC](https://discuss.elastic.co/t/problem-configure-output-email-in-logstash-conf/321269 "2022-12-15T08:07:10Z")
Hello, My goal is to get email alerts from the Tpot . Do I need to install alerta before configure the logstash.conf to send emails ? I'm trying to follow those instructions: (gitHub) and insert the Email output to… --- ## [Shard size increase right after rollover](https://discuss.elastic.co/t/shard-size-increase-right-after-rollover/321261)
**Author:** [@nairobi](https://discuss.elastic.co/u/nairobi)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 7:48am UTC](https://discuss.elastic.co/t/shard-size-increase-right-after-rollover/321261 "2022-12-15T07:48:01Z")
I have index that primaries 3 replicas 1 ilm: roll over when any primary shard reaches 50gb (hot to warm) So when it reached to 300gb, it roll over to warm phase. But after it roll over, size of shard increase to abo… --- ## [Show first record of each group](https://discuss.elastic.co/t/show-first-record-of-each-group/319446)
**Author:** [@johnnyh](https://discuss.elastic.co/u/johnnyh)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 7:41am UTC](https://discuss.elastic.co/t/show-first-record-of-each-group/319446 "2022-12-15T07:41:21Z")
Hi guys, I have been trying to find a way perform group by, and then obtaining the first of each group. This set should also be filterable and sort-able, and should also be able to count each group. Wondering if what I… --- ## [FOR Weekly Index ISM Policy](https://discuss.elastic.co/t/for-weekly-index-ism-policy/321255)
**Author:** [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\ **Replies:** 5\ **Last updated:** [December 15, 2022, 6:43am UTC](https://discuss.elastic.co/t/for-weekly-index-ism-policy/321255 "2022-12-15T06:43:14Z")
Hello Guys I am using Elasticsearch 7.10.2 I have 6 Data node Cluster in this Cluster I am Facing Space Issue so I set Index Policy for Daily Index but I am having Monthly and Weekly Index I want setup Automatically Del… --- ## [Windows event logs into the ECS format](https://discuss.elastic.co/t/windows-event-logs-into-the-ecs-format/321002)
**Author:** [@alex\_su](https://discuss.elastic.co/u/alex_su)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 5:53am UTC](https://discuss.elastic.co/t/windows-event-logs-into-the-ecs-format/321002 "2022-12-15T05:53:57Z")
Hello, I want to ask how to use python convert windows event logs into the ECS format. not use beats or logstash method. --- ## [Unable to Connect to ElasticSearch](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch/321254)
**Author:** [@makarand](https://discuss.elastic.co/u/makarand)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 5:51am UTC](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch/321254 "2022-12-15T05:51:39Z")
Hi guys can you please look into this? It is taking too much of my time. This is an error regarding connection from nodeJs client to Elasticsearch. Trying to connect to elasticsearch domain using lambda and elasticse… --- ## [Authenticating with built-in users](https://discuss.elastic.co/t/authenticating-with-built-in-users/321246)
**Author:** [@zirota](https://discuss.elastic.co/u/zirota)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 4:55am UTC](https://discuss.elastic.co/t/authenticating-with-built-in-users/321246 "2022-12-15T04:55:08Z")
Hello, I ran into some problems with authenticating with built-in users (in this case elastic) on my cluster nodes other than the master. I have a cluster setup on 8.5.3: 3 master nodes 4 data nodes 2 coordinator node… --- ## [Circle radius propblem v8.5.3](https://discuss.elastic.co/t/circle-radius-propblem-v8-5-3/321091)
**Author:** [@Dat\_Le\_Tien](https://discuss.elastic.co/u/Dat_Le_Tien)\ **Replies:** 4\ **Last updated:** [December 15, 2022, 3:08am UTC](https://discuss.elastic.co/t/circle-radius-propblem-v8-5-3/321091 "2022-12-15T03:08:52Z")
I'm trying to insert a location that is using a circle processor to generate the circle points. Location \[30, 10\] in the document is generated with the circle points properly. docs: Circle processor | Elasticsearch Guid… --- ## [\--ca-sha256 not working for Elastic Agent enrollment; error reported: "fail to enroll: fail to execute request to fleet-server: x509: certificate signed by unknown authority"](https://discuss.elastic.co/t/ca-sha256-not-working-for-elastic-agent-enrollment-error-reported-fail-to-enroll-fail-to-execute-request-to-fleet-server-x509-certificate-signed-by-unknown-authority/320270)
**Author:** [@username11](https://discuss.elastic.co/u/username11)\ **Replies:** 3\ **Last updated:** [December 15, 2022, 12:54am UTC](https://discuss.elastic.co/t/ca-sha256-not-working-for-elastic-agent-enrollment-error-reported-fail-to-enroll-fail-to-execute-request-to-fleet-server-x509-certificate-signed-by-unknown-authority/320270 "2022-12-15T00:54:18Z")
Hi. I am currently working on deploying Fleet + Elastic Agent in a test-ish environment. I've had success in enrolling the agents into Fleet as follows: sudo ./elastic-agent install --url=https://fleet1.local:8220 --enr… --- ## [Exporting data from a visualization](https://discuss.elastic.co/t/exporting-data-from-a-visualization/320976)
**Author:** [@zivza](https://discuss.elastic.co/u/zivza)\ **Replies:** 4\ **Last updated:** [December 15, 2022, 12:14am UTC](https://discuss.elastic.co/t/exporting-data-from-a-visualization/320976 "2022-12-15T00:14:52Z")
Hi, I'm new to Kibana, and I need to export some data from a table visualization (pull it once in a while, with the current time), using python. What I actually want, is basically a csv or a JSONI can turn to a pandas … --- ## [Edit protection for Kibana visuals or dashboards](https://discuss.elastic.co/t/edit-protection-for-kibana-visuals-or-dashboards/321238)
**Author:** [@Buddha](https://discuss.elastic.co/u/Buddha)\ **Replies:** 1\ **Last updated:** [December 15, 2022, 12:04am UTC](https://discuss.elastic.co/t/edit-protection-for-kibana-visuals-or-dashboards/321238 "2022-12-15T00:04:07Z")
Hello, I was wondering if there was a way to protect Kibana visuals or dashboards from being edited? Even sending a warning if they open the object to not to edit it would be the bare minimal. Mike --- ## [Suricata filebeat logs not real time](https://discuss.elastic.co/t/suricata-filebeat-logs-not-real-time/321045)
**Author:** [@Adilla\_Rhiskani](https://discuss.elastic.co/u/Adilla_Rhiskani)\ **Replies:** 0\ **Last updated:** [December 12, 2022, 2:57pm UTC](https://discuss.elastic.co/t/suricata-filebeat-logs-not-real-time/321045 "2022-12-12T14:57:00Z")
I have setup new cluster elasticsearch for IDS using suricata , I have set JVM for ingest, master, data01, data02 each 2GB. but when I start file beat I got this error {"log.level":"info","@timestamp":"2022-12-12T14:50:… --- ## [Automatically remove old reports](https://discuss.elastic.co/t/automatically-remove-old-reports/321201)
**Author:** [@JohnJ\_M](https://discuss.elastic.co/u/JohnJ_M)\ **Replies:** 2\ **Last updated:** [December 14, 2022, 11:46pm UTC](https://discuss.elastic.co/t/automatically-remove-old-reports/321201 "2022-12-14T23:46:22Z")
Hi the community. I've alerters that generates multiple report once per week sent per mail automatically. Reports older than 2 weeks are not necessary and I want to be able to setup an automatic cleaning of those report… --- ## [Caused by: javax.net.ssl.SSLHandshakeException: No available authentication scheme](https://discuss.elastic.co/t/caused-by-javax-net-ssl-sslhandshakeexception-no-available-authentication-scheme/321207)
**Author:** [@hello5346](https://discuss.elastic.co/u/hello5346)\ **Replies:** 0\ **Last updated:** [December 14, 2022, 10:34am UTC](https://discuss.elastic.co/t/caused-by-javax-net-ssl-sslhandshakeexception-no-available-authentication-scheme/321207 "2022-12-14T10:34:30Z")
we have started a new ealsticsearch 3 node cluster with the following yaml. cluster.name: elk-aws node.name: ip-10-22-221-24 node.master: true node.data: true path.logs: /var/log/elasticsearch network.host: 10.22.221.2… --- ## [Getting data from lagging database](https://discuss.elastic.co/t/getting-data-from-lagging-database/321244)
**Author:** [@raunakraje](https://discuss.elastic.co/u/raunakraje)\ **Replies:** 0\ **Last updated:** [December 14, 2022, 9:46pm UTC](https://discuss.elastic.co/t/getting-data-from-lagging-database/321244 "2022-12-14T21:46:51Z")
Hi Guys, I have 2 MSSQL databases a Production db(A) and a Backup db (B). Data from Production DB gets updated in Backup DB with a lag of 15 mins. I am trying to get data from Backup DB but due to this lag I am unable t… --- ## [IIS module under filebeat not populating fields in discover](https://discuss.elastic.co/t/iis-module-under-filebeat-not-populating-fields-in-discover/321242)
**Author:** [@Priya\_Vardhan](https://discuss.elastic.co/u/Priya_Vardhan)\ **Replies:** 7\ **Last updated:** [December 14, 2022, 11:22pm UTC](https://discuss.elastic.co/t/iis-module-under-filebeat-not-populating-fields-in-discover/321242 "2022-12-14T23:22:40Z")
Hi All, I have enabled IIS module under filebeat after providing the log path for both access and error. I can see the IIS fields getting loaded in filebeat index, but it is not showing in discover. The data is not av… --- ## [Add Metric Aggregation inside the bucket aggregation query to get metrics of all buckets using DSL Query](https://discuss.elastic.co/t/add-metric-aggregation-inside-the-bucket-aggregation-query-to-get-metrics-of-all-buckets-using-dsl-query/321217)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 1\ **Last updated:** [December 14, 2022, 7:27pm UTC](https://discuss.elastic.co/t/add-metric-aggregation-inside-the-bucket-aggregation-query-to-get-metrics-of-all-buckets-using-dsl-query/321217 "2022-12-14T19:27:39Z")
Hi, I am able to get bucket aggregation results for below DSL Query,But I want to get metric aggregation for all buckets inside the same bucket aggregation query. Bucket aggrgation query: { "size": 0, "query":… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=697) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=699)