# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=712 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 713 --- ## [Delete old logs files](https://discuss.elastic.co/t/delete-old-logs-files/318317)
**Author:** [@Ludovic9](https://discuss.elastic.co/u/Ludovic9)\ **Replies:** 3\ **Last updated:** [December 2, 2022, 11:14am UTC](https://discuss.elastic.co/t/delete-old-logs-files/318317 "2022-12-02T11:14:52Z")
Hi I'm using an old version of elasticsearch (6.4.1). In /var/log/elasticsearch I have a lot of logs file since 2018 with log.gz extension. It seems using logrotate is not a good option, but instead, using the paramet… --- ## [Logstash ConfigurationError - Expect character](https://discuss.elastic.co/t/logstash-configurationerror-expect-character/320355)
**Author:** [@stefanocog](https://discuss.elastic.co/u/stefanocog)\ **Replies:** 1\ **Last updated:** [December 2, 2022, 10:47am UTC](https://discuss.elastic.co/t/logstash-configurationerror-expect-character/320355 "2022-12-02T10:47:23Z")
Hi, I've this pattern that match correctly on https://grokconstructor.appspot.com "%{TIMESTAMP\_ISO8601:timestamp}"\\|"%{DATA:tz}"\\|"%{GREEDYDATA:trans}\\: %{GREEDYDATA:transId}"\\|"%{GREEDYDATA:req}\\: %{GREEDYDATA:reqId}"\\… --- ## [Drop\_event from Win firewall](https://discuss.elastic.co/t/drop-event-from-win-firewall/320334)
**Author:** [@vabe](https://discuss.elastic.co/u/vabe)\ **Replies:** 0\ **Last updated:** [December 2, 2022, 8:16am UTC](https://discuss.elastic.co/t/drop-event-from-win-firewall/320334 "2022-12-02T08:16:38Z")
Hey guys, I'm looking for help here as a last resort. Can't find a solution.. I want to drop events from Win firewall log the line is: message 2022-12-02 08:53:10 ALLOW TCP 127.0.0.1 127.0.0.1 50740 389 0 - 0 0 0 - … --- ## [Multiline logs into one event using logstash?](https://discuss.elastic.co/t/multiline-logs-into-one-event-using-logstash/320005)
**Author:** [@kurdit](https://discuss.elastic.co/u/kurdit)\ **Replies:** 9\ **Last updated:** [December 2, 2022, 10:14am UTC](https://discuss.elastic.co/t/multiline-logs-into-one-event-using-logstash/320005 "2022-12-02T10:14:08Z")
hi all! I have these logs: Nov 23 18:57:14 mx.host.cloud 18:57:14.756 2 SIPS-072111 SIPDATA-124634 REGISTER sip:111.222.333.444:65110 from udp\[555.666.777.888\]:65111 Nov 23 18:57:14 mx.host.cloud 18:57:14.756 2 SIPS-072… --- ## [Usually data are not enriched](https://discuss.elastic.co/t/usually-data-are-not-enriched/316435)
**Author:** [@Marcin\_Frankiewicz](https://discuss.elastic.co/u/Marcin_Frankiewicz)\ **Replies:** 10\ **Last updated:** [December 2, 2022, 10:04am UTC](https://discuss.elastic.co/t/usually-data-are-not-enriched/316435 "2022-12-02T10:04:59Z")
Hi, Does exists some situactions, when data are not enriched ? (i'm excluding scenario when there are no matching data) Example : Can be skipped for perfomance reasons? It is possible that enrich processor in pipeline… --- ## [Need help for creating filter pattern based on custom logs](https://discuss.elastic.co/t/need-help-for-creating-filter-pattern-based-on-custom-logs/320347)
**Author:** [@Shrikant\_Dhawale](https://discuss.elastic.co/u/Shrikant_Dhawale)\ **Replies:** 0\ **Last updated:** [December 2, 2022, 10:02am UTC](https://discuss.elastic.co/t/need-help-for-creating-filter-pattern-based-on-custom-logs/320347 "2022-12-02T10:02:55Z")
Hi All, I am new to this technology started learning, need help in writing filter plugin which will parse custom logs from the server. External User(dummy-user) is Mapped to Temp User(dummy-user) with Role(s): role1 ro… --- ## [Dashboard table: color boolean cell](https://discuss.elastic.co/t/dashboard-table-color-boolean-cell/320274)
**Author:** [@emmanuel\_t](https://discuss.elastic.co/u/emmanuel_t)\ **Replies:** 2\ **Last updated:** [December 2, 2022, 9:18am UTC](https://discuss.elastic.co/t/dashboard-table-color-boolean-cell/320274 "2022-12-02T09:18:12Z")
Hello, I have boolean data in my index, that I'm rendering in a dashboard table (currently lens, but I could change to another system, as long as the final rendering looks like a table). I would like to color the boolea… --- ## [Separate filtered queries for source and destination fields in vega sankey visualization](https://discuss.elastic.co/t/separate-filtered-queries-for-source-and-destination-fields-in-vega-sankey-visualization/320251)
**Author:** [@Senol\_Kurt](https://discuss.elastic.co/u/Senol_Kurt)\ **Replies:** 1\ **Last updated:** [December 2, 2022, 8:54am UTC](https://discuss.elastic.co/t/separate-filtered-queries-for-source-and-destination-fields-in-vega-sankey-visualization/320251 "2022-12-02T08:54:01Z")
I want to create a sankey chart using a single field. Both my source and destination data are stored in that field. Is it possible to use separate filters for source and destination data? --- ## [BadRequestError(400, 'search\_phase\_execution\_exception', 'runtime error')](https://discuss.elastic.co/t/badrequesterror-400-search-phase-execution-exception-runtime-error/320340)
**Author:** [@sanjayk1241](https://discuss.elastic.co/u/sanjayk1241)\ **Replies:** 0\ **Last updated:** [December 2, 2022, 8:40am UTC](https://discuss.elastic.co/t/badrequesterror-400-search-phase-execution-exception-runtime-error/320340 "2022-12-02T08:40:20Z")
I am trying to implement the search functionality using the elasticsearch concept. I am getting the following error: BadRequestError(400, 'search\_phase\_execution\_exception', 'runtime error') I am not sure where I am d… --- ## [Filebeat Error](https://discuss.elastic.co/t/filebeat-error/320316)
**Author:** [@lucas.Jung](https://discuss.elastic.co/u/lucas.Jung)\ **Replies:** 2\ **Last updated:** [December 2, 2022, 8:30am UTC](https://discuss.elastic.co/t/filebeat-error/320316 "2022-12-02T08:30:05Z")
I set filebeat to use the ingest node of okta, but an error occurs and filebit does not run. ERROR \[esclientleg\] transport/logging.go:37 Error dialing x509: certificate signed by unknown authority {"network": "t… --- ## [Error parsing datetime using Script Processor](https://discuss.elastic.co/t/error-parsing-datetime-using-script-processor/320332)
**Author:** [@m14](https://discuss.elastic.co/u/m14)\ **Replies:** 0\ **Last updated:** [December 2, 2022, 8:02am UTC](https://discuss.elastic.co/t/error-parsing-datetime-using-script-processor/320332 "2022-12-02T08:02:34Z")
Hi, I need to get the date and time from the log record. In JavaScript I can just do the following: var d = new Date("Oct 27, 2022 1:39:57 PM"); But the script processor seems nto to be able to do this. When I try (… --- ## [Multiple ingest pipeline in index template](https://discuss.elastic.co/t/multiple-ingest-pipeline-in-index-template/319793)
**Author:** [@kmz161](https://discuss.elastic.co/u/kmz161)\ **Replies:** 2\ **Last updated:** [December 2, 2022, 7:28am UTC](https://discuss.elastic.co/t/multiple-ingest-pipeline-in-index-template/319793 "2022-12-02T07:28:14Z")
Hello! I have index template and need attach 2 ingest pipelines to him. How I can do it? My current config { "index": { "default\_pipeline": "netflow-pipeline" } } --- ## [Is this a bug of Elasticsearch sorting?](https://discuss.elastic.co/t/is-this-a-bug-of-elasticsearch-sorting/320317)
**Author:** [@howe\_xiao](https://discuss.elastic.co/u/howe_xiao)\ **Replies:** 3\ **Last updated:** [December 2, 2022, 7:25am UTC](https://discuss.elastic.co/t/is-this-a-bug-of-elasticsearch-sorting/320317 "2022-12-02T07:25:46Z")
Problem Description: A field of keyword type causes a shard retrieval failure with differernt size and from value. Environment：Node-4, Shard-8, Version-8.0 This is my query DSL on Kibana: POST myIndex/\_search { "fro… --- ## [Dense vector doesn't support synthetic source](https://discuss.elastic.co/t/dense-vector-doesnt-support-synthetic-source/320321)
**Author:** [@ruslaniv](https://discuss.elastic.co/u/ruslaniv)\ **Replies:** 4\ **Last updated:** [December 2, 2022, 6:42am UTC](https://discuss.elastic.co/t/dense-vector-doesnt-support-synthetic-source/320321 "2022-12-02T06:42:59Z")
According to this: Dense vector field type | Elasticsearch Guide \[8.5\] | Elastic dense\_vector field is supposed to support synthetic source. I just tried to create an index with the mapping like this: "mappings": { … --- ## [Custom TCP server to receive incoming binary data to Elastic?](https://discuss.elastic.co/t/custom-tcp-server-to-receive-incoming-binary-data-to-elastic/320322)
**Author:** [@kumaresanr](https://discuss.elastic.co/u/kumaresanr)\ **Replies:** 1\ **Last updated:** [December 2, 2022, 5:47am UTC](https://discuss.elastic.co/t/custom-tcp-server-to-receive-incoming-binary-data-to-elastic/320322 "2022-12-02T05:47:58Z")
I have the following requirement. I run a traffic proxy and the traffic proxy bundle some stats into a custom binary format and can send them to an endpoint via TCP socket. I cannot install a filebeat or such sort in th… --- ## [Pipeline queue is getting filled and never able to control, using below drop filter plugin](https://discuss.elastic.co/t/pipeline-queue-is-getting-filled-and-never-able-to-control-using-below-drop-filter-plugin/320287)
**Author:** [@rravitech](https://discuss.elastic.co/u/rravitech)\ **Replies:** 2\ **Last updated:** [December 2, 2022, 5:01am UTC](https://discuss.elastic.co/t/pipeline-queue-is-getting-filled-and-never-able-to-control-using-below-drop-filter-plugin/320287 "2022-12-02T05:01:19Z")
I am trying to implement 2 pipelines, when one is about to get blocked, i am trying to drop events form that pipeline. So that the other one, which is half filled or healthy will keep receiving the events. Here in th… --- ## [Pushing of data into elastic search dashboard using Python](https://discuss.elastic.co/t/pushing-of-data-into-elastic-search-dashboard-using-python/320214)
**Author:** [@Shashank02](https://discuss.elastic.co/u/Shashank02)\ **Replies:** 4\ **Last updated:** [December 2, 2022, 4:54am UTC](https://discuss.elastic.co/t/pushing-of-data-into-elastic-search-dashboard-using-python/320214 "2022-12-02T04:54:50Z")
I am working on a project which collects twitter data. So, up until now, what I did is I collected some tweets and then stored them in a CSV format and uploaded it to the elastic cloud. I am now working on automatically … --- ## [How to change scroll time in spring data repository](https://discuss.elastic.co/t/how-to-change-scroll-time-in-spring-data-repository/320314)
**Author:** [@mzinboy](https://discuss.elastic.co/u/mzinboy)\ **Replies:** 0\ **Last updated:** [December 2, 2022, 2:54am UTC](https://discuss.elastic.co/t/how-to-change-scroll-time-in-spring-data-repository/320314 "2022-12-02T02:54:54Z")
Dear all, dev info: elasticsearch 7.17.1 spring boot 2.6.12 spring-data-elasticsearch 4.3.7 I have a code as below: public interface LogRepository\ extends ElasticsearchRepository\ Stream\ findScro… --- ## [【Kibana】The line graph problem](https://discuss.elastic.co/t/kibana-the-line-graph-problem/320245)
**Author:** [@ydbdyds](https://discuss.elastic.co/u/ydbdyds)\ **Replies:** 2\ **Last updated:** [December 2, 2022, 2:36am UTC](https://discuss.elastic.co/t/kibana-the-line-graph-problem/320245 "2022-12-02T02:36:11Z")
I had a problem drawing with Kibana ，Every day I generate a document that looks like the following data structure { "reports":\[ { "url":"test1", "method":"get", "val1":40… --- ## [App search Analytics in Kibana (logs-app\_search.analytics-default)](https://discuss.elastic.co/t/app-search-analytics-in-kibana-logs-app-search-analytics-default/317657)
**Author:** [@moassafiri](https://discuss.elastic.co/u/moassafiri)\ **Replies:** 1\ **Last updated:** [November 4, 2022, 3:17am UTC](https://discuss.elastic.co/t/app-search-analytics-in-kibana-logs-app-search-analytics-default/317657 "2022-11-04T03:17:14Z")
Is there a way to Filter based on the Engine name from the logs-app\_search.analytics-default Data stream? I can see labels.engine\_id; but this returns a UUID which is not user-friendly. Especially when doing Drill-downs … --- ## [Math in Metric Visualization](https://discuss.elastic.co/t/math-in-metric-visualization/320249)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 1\ **Last updated:** [December 1, 2022, 11:14pm UTC](https://discuss.elastic.co/t/math-in-metric-visualization/320249 "2022-12-01T23:14:47Z")
I am trying to create a metric visualization that shows the system memory in GB (from Metricbeat's system.memory field). However, I was it to display in GB and the field value is shown in bytes (binary). How/where do I a… --- ## [Elastic search error : bad certificate](https://discuss.elastic.co/t/elastic-search-error-bad-certificate/320212)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 1\ **Last updated:** [December 1, 2022, 11:03pm UTC](https://discuss.elastic.co/t/elastic-search-error-bad-certificate/320212 "2022-12-01T23:03:56Z")
Hello team, We are getting bad certificate issue in 2 elk nodes out of 7. Can you please help me to identify what is exact issue here. \[2022-12-01T14:11:59,261\]\[WARN \]\[o.e.h.AbstractHttpServerTransport\] \[ELKDPCPRD001\] … --- ## [Syntax for Pipeline Processor Condition in Kibana](https://discuss.elastic.co/t/syntax-for-pipeline-processor-condition-in-kibana/320303)
**Author:** [@wpm](https://discuss.elastic.co/u/wpm)\ **Replies:** 1\ **Last updated:** [December 1, 2022, 10:50pm UTC](https://discuss.elastic.co/t/syntax-for-pipeline-processor-condition-in-kibana/320303 "2022-12-01T22:50:52Z")
I would like to write a pipeline that drops the field "A" from a document when its value is the string "None". I want to do this in the Kibana UI. I figure I need a Remove processor when runs on the condition that A == … --- ## [Specific filter for different windows EventID](https://discuss.elastic.co/t/specific-filter-for-different-windows-eventid/320301)
**Author:** [@Marsidi](https://discuss.elastic.co/u/Marsidi)\ **Replies:** 0\ **Last updated:** [December 1, 2022, 10:08pm UTC](https://discuss.elastic.co/t/specific-filter-for-different-windows-eventid/320301 "2022-12-01T22:08:10Z")
Hi all, I am collecting logs from different windows channels, and for different EventID I want to use different filter files. For example: If 'channel' is 'sysmon': If 'EventID' is 1: use sysmon1\_filter fi… --- ## [Elasticsearch cluster setup with 7.5.1](https://discuss.elastic.co/t/elasticsearch-cluster-setup-with-7-5-1/320210)
**Author:** [@Suraj\_Jannu](https://discuss.elastic.co/u/Suraj_Jannu)\ **Replies:** 1\ **Last updated:** [December 1, 2022, 10:09pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-setup-with-7-5-1/320210 "2022-12-01T22:09:16Z")
Hello, I am trying to set up a 3-node elasticsearch cluster of version 7.5.1. I have 1 master node, 1 data node, and 1 client node. Each instance of elasticsearch.yml configuration is as below. Master node path.data:… --- ## [How to rollback Beats and Apm-server?](https://discuss.elastic.co/t/how-to-rollback-beats-and-apm-server/320279)
**Author:** [@Leonardo\_Henrique](https://discuss.elastic.co/u/Leonardo_Henrique)\ **Replies:** 2\ **Last updated:** [December 1, 2022, 10:05pm UTC](https://discuss.elastic.co/t/how-to-rollback-beats-and-apm-server/320279 "2022-12-01T22:05:55Z")
Hey everyone! I am planning to upgrade my cluster from version 7.3.9 to 8.3 (or the newer) but I have to have a rollback plan in case if things go wrong. I could find the rollback process about Kibana and Elasticsearch… --- ## [Metricbeat Missing Data](https://discuss.elastic.co/t/metricbeat-missing-data/320285)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 5\ **Last updated:** [December 1, 2022, 9:49pm UTC](https://discuss.elastic.co/t/metricbeat-missing-data/320285 "2022-12-01T21:49:37Z")
I have Metricbeat receiving data from Perfmon counters, including Process \> % Processor Time. this is configured to collect every 10 seconds. However, we are missing processes for some reason. In other words, the events … --- ## [Re-configure kibana to new cluster](https://discuss.elastic.co/t/re-configure-kibana-to-new-cluster/318068)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 3\ **Last updated:** [November 3, 2022, 10:04pm UTC](https://discuss.elastic.co/t/re-configure-kibana-to-new-cluster/318068 "2022-11-03T22:04:35Z")
My kibana is already enrolled on a cluster, but the cluster failed to boot (the PC failed to boot and will be reinstalled). Can I reconfigure kibana to a new cluster? I don't care about losing existing data in kibana as … --- ## [Date Format](https://discuss.elastic.co/t/date-format/320296)
**Author:** [@valleram](https://discuss.elastic.co/u/valleram)\ **Replies:** 0\ **Last updated:** [December 1, 2022, 9:13pm UTC](https://discuss.elastic.co/t/date-format/320296 "2022-12-01T21:13:28Z")
Hi All, I'm trying to create a mapping for a date field with following format Sun, 06 Nov 2022 05:30:03 +0060 Can you help me with the correct custom date format I need to use, please. I tried with the following for… --- ## [Kibana stills warns about snapshots with the same Schedule](https://discuss.elastic.co/t/kibana-stills-warns-about-snapshots-with-the-same-schedule/320294)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 2\ **Last updated:** [December 1, 2022, 8:46pm UTC](https://discuss.elastic.co/t/kibana-stills-warns-about-snapshots-with-the-same-schedule/320294 "2022-12-01T20:46:26Z")
Hello, I'm on version 8.5.1 and just saw that Kibana still warns about two or more policies having the same Schedule. From elasticsearch documentation this is not an issue as multiple snapshots can be taken at the sa… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=711) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=713)