# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=717

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 718

---

## [Mirror Kibanas on separate clusters](https://discuss.elastic.co/t/mirror-kibanas-on-separate-clusters/319814)

<div class="topic-metadata">

**Author:** [@lduvnjak](https://discuss.elastic.co/u/lduvnjak)\
**Replies:** 9\
**Last updated:** [November 29, 2022, 9:50am UTC](https://discuss.elastic.co/t/mirror-kibanas-on-separate-clusters/319814 "2022-11-29T09:50:59Z")

</div>

Hey Everyone, Is there any way to sync Kibanas across multiple clusters? Essentially, a way to sync all visualizations, dashboards, queries, etc. from one Kibana to another. I'm aware that you can use remote reindex, an…

---

## [Install Elasticsearch as a service - Windows](https://discuss.elastic.co/t/install-elasticsearch-as-a-service-windows/319463)

<div class="topic-metadata">

**Author:** [@Clonky](https://discuss.elastic.co/u/Clonky)\
**Replies:** 4\
**Last updated:** [November 29, 2022, 9:41am UTC](https://discuss.elastic.co/t/install-elasticsearch-as-a-service-windows/319463 "2022-11-29T09:41:19Z")

</div>

HI all, I have a fresh installation of Elasticsearch 8.5 and Kibana 8.5 on my Windows Server. I would like to install Elasticsearch as a Service that it gets started as soon as the Server starts and Kibana as well. Ho…

---

## [How to convert this ES querry into java?](https://discuss.elastic.co/t/how-to-convert-this-es-querry-into-java/320019)

<div class="topic-metadata">

**Author:** [@Ali5](https://discuss.elastic.co/u/Ali5)\
**Replies:** 0\
**Last updated:** [November 29, 2022, 9:37am UTC](https://discuss.elastic.co/t/how-to-convert-this-es-querry-into-java/320019 "2022-11-29T09:37:33Z")

</div>

GET products/\_search { "query": { "multi\_match" : { "query": "novel", "fields": \[ "description", "name","id" ,"price"\] } } } \`\`\`\`\`\`\`\`\`\`\`\`\`\`\`\`\`

---

## [Runtime field issue creating a date/time field](https://discuss.elastic.co/t/runtime-field-issue-creating-a-date-time-field/317551)

<div class="topic-metadata">

**Author:** [@Garry](https://discuss.elastic.co/u/Garry)\
**Replies:** 5\
**Last updated:** [November 2, 2022, 11:24am UTC](https://discuss.elastic.co/t/runtime-field-issue-creating-a-date-time-field/317551 "2022-11-02T11:24:12Z")

</div>

I am creating a new date field through Lens. The original field is coming through as text in the format '2022-10-25T16:04:35.320' In the Set Value field i have... if (doc.containsKey('sql.metrics.string.starttime')) { …

---

## [Multiple URL links in one field](https://discuss.elastic.co/t/multiple-url-links-in-one-field/319965)

<div class="topic-metadata">

**Author:** [@Harold\_Van\_der\_Veken](https://discuss.elastic.co/u/Harold_Van_der_Veken)\
**Replies:** 3\
**Last updated:** [November 29, 2022, 9:15am UTC](https://discuss.elastic.co/t/multiple-url-links-in-one-field/319965 "2022-11-29T09:15:00Z")

</div>

Is there a way to create a field that has more than 1 link to another resource. Can I create (and format) a string that holds 2 urls. E.g. "Goto \<this url\> or \<another url\>" \<this url\> can be selected to open the url. \<…

---

## [Collector \[cluster\_stats\] timed out when collecting data: node](https://discuss.elastic.co/t/collector-cluster-stats-timed-out-when-collecting-data-node/319955)

<div class="topic-metadata">

**Author:** [@rh05](https://discuss.elastic.co/u/rh05)\
**Replies:** 3\
**Last updated:** [November 29, 2022, 9:12am UTC](https://discuss.elastic.co/t/collector-cluster-stats-timed-out-when-collecting-data-node/319955 "2022-11-29T09:12:54Z")

</div>

Hello everyone, I have a problem if someone can help me it would be very appreciated. For several weeks I have noticed that my elastic cluster is unavailable for about 1 hour almost all the time at the same time on Sun…

---

## [How to setup the text of an alert in Kibana?](https://discuss.elastic.co/t/how-to-setup-the-text-of-an-alert-in-kibana/320016)

<div class="topic-metadata">

**Author:** [@alytkowski](https://discuss.elastic.co/u/alytkowski)\
**Replies:** 0\
**Last updated:** [November 29, 2022, 9:05am UTC](https://discuss.elastic.co/t/how-to-setup-the-text-of-an-alert-in-kibana/320016 "2022-11-29T09:05:01Z")

</div>

I have a question which I cannot find the answer for in docs: How t setup the text of an alert in Kibana? In above image, you can see some alerts from my rules. I'd like to change the text of the reason field to som…

---

## [Adding html\_strip filter](https://discuss.elastic.co/t/adding-html-strip-filter/319768)

<div class="topic-metadata">

**Author:** [@Srikanth\_V](https://discuss.elastic.co/u/Srikanth_V)\
**Replies:** 5\
**Last updated:** [November 29, 2022, 8:39am UTC](https://discuss.elastic.co/t/adding-html-strip-filter/319768 "2022-11-29T08:39:57Z")

</div>

Hello all, I would like to eliminate html tags when I am performing search on certain fields in elastic. Can this be achieved using html\_strip filter? If yes, can I have an example on how to add the analyzer and the fil…

---

## [Change timestamp in logstash input](https://discuss.elastic.co/t/change-timestamp-in-logstash-input/319506)

<div class="topic-metadata">

**Author:** [@zerratriani](https://discuss.elastic.co/u/zerratriani)\
**Replies:** 8\
**Last updated:** [November 29, 2022, 8:21am UTC](https://discuss.elastic.co/t/change-timestamp-in-logstash-input/319506 "2022-11-29T08:21:49Z")

</div>

Hi, I have a log like this and want to change the timestamp to the time in the log. Example Log event1: aaaaaaa | event2: xxxxxxx | event3: ccccccc | date : 2022-11-07T21:03:48.9110; The logstash input { file { …

---

## [Delete old document automatically (version 6.5.4)](https://discuss.elastic.co/t/delete-old-document-automatically-version-6-5-4/320007)

<div class="topic-metadata">

**Author:** [@gyrao\_72](https://discuss.elastic.co/u/gyrao_72)\
**Replies:** 1\
**Last updated:** [November 29, 2022, 8:06am UTC](https://discuss.elastic.co/t/delete-old-document-automatically-version-6-5-4/320007 "2022-11-29T08:06:09Z")

</div>

I want to delete old documents from elastic whenever a new record is inserted with the same request\_id through logstash Example: Suppose my first log to be inserted in elastic is 6b06a196-0f9e-4bec-9c2c-17f4f6cdd652 t…

---

## [Date parsing issue After upgrading Elasticsearch JDK](https://discuss.elastic.co/t/date-parsing-issue-after-upgrading-elasticsearch-jdk/320002)

<div class="topic-metadata">

**Author:** [@truptir](https://discuss.elastic.co/u/truptir)\
**Replies:** 0\
**Last updated:** [November 29, 2022, 7:15am UTC](https://discuss.elastic.co/t/date-parsing-issue-after-upgrading-elasticsearch-jdk/320002 "2022-11-29T07:15:43Z")

</div>

After upgrading the Elastic JDK version in the spring boot application, stopped parsing the date type field to Java Date Objects. The date field has a default format: strict\_date\_optional\_time||epoch\_millis Java Code: …

---

## [Kibana console not working](https://discuss.elastic.co/t/kibana-console-not-working/320006)

<div class="topic-metadata">

**Author:** [@Hemabh\_Ravee\_Fox](https://discuss.elastic.co/u/Hemabh_Ravee_Fox)\
**Replies:** 0\
**Last updated:** [November 29, 2022, 7:56am UTC](https://discuss.elastic.co/t/kibana-console-not-working/320006 "2022-11-29T07:56:41Z")

</div>

Hi all, While working on some queries today, all of a sudden my Kibana console stopped working. On inspecting the network console, I found that a request at /api/exception\_lists is failing with the status code 409 Confl…

---

## [Elasticsearch 8.5.1 does not start - “java.security.AccessControlException: access denied”](https://discuss.elastic.co/t/elasticsearch-8-5-1-does-not-start-java-security-accesscontrolexception-access-denied/319969)

<div class="topic-metadata">

**Author:** [@hrQAQ](https://discuss.elastic.co/u/hrQAQ)\
**Replies:** 3\
**Last updated:** [November 29, 2022, 7:43am UTC](https://discuss.elastic.co/t/elasticsearch-8-5-1-does-not-start-java-security-accesscontrolexception-access-denied/319969 "2022-11-29T07:43:18Z")

</div>

Hi, I meet problem while starting elasticsearch. When I start elasticsearch it generates a java.security.AccessControlException: access denied The error log and my elasticsearch.yml are list as follow. Environment OS:…

---

## [Reported CPU usage from Elasticsearch node gets stuck/frozen](https://discuss.elastic.co/t/reported-cpu-usage-from-elasticsearch-node-gets-stuck-frozen/319815)

<div class="topic-metadata">

**Author:** [@noxknock](https://discuss.elastic.co/u/noxknock)\
**Replies:** 5\
**Last updated:** [November 29, 2022, 7:37am UTC](https://discuss.elastic.co/t/reported-cpu-usage-from-elasticsearch-node-gets-stuck-frozen/319815 "2022-11-29T07:37:00Z")

</div>

I have a randomly occuring issue where after being up for some time, nodes stop reporting CPU usage correctly. It seems it starts repeating the same value as right before it stopped working. Visible in the Elastic Monit…

---

## [Centralized pipeline managent or not for new setup](https://discuss.elastic.co/t/centralized-pipeline-managent-or-not-for-new-setup/320003)

<div class="topic-metadata">

**Author:** [@Soren\_vdc](https://discuss.elastic.co/u/Soren_vdc)\
**Replies:** 0\
**Last updated:** [November 29, 2022, 7:30am UTC](https://discuss.elastic.co/t/centralized-pipeline-managent-or-not-for-new-setup/320003 "2022-11-29T07:30:41Z")

</div>

Hi, I have some sources that will sent his data by TCP and not the regular filebeat setup. I will setup logstash to collect the TCP data and send to ES. Now I'm checking to use "Centralized pipeline management" setup in…

---

## [Rolling restart, replica allocation, cluster.routing.allocation.enable vs. index.unassigned.node\_left.delayed\_timeout](https://discuss.elastic.co/t/rolling-restart-replica-allocation-cluster-routing-allocation-enable-vs-index-unassigned-node-left-delayed-timeout/319636)

<div class="topic-metadata">

**Author:** [@lantoniak](https://discuss.elastic.co/u/lantoniak)\
**Replies:** 1\
**Last updated:** [November 29, 2022, 6:41am UTC](https://discuss.elastic.co/t/rolling-restart-replica-allocation-cluster-routing-allocation-enable-vs-index-unassigned-node-left-delayed-timeout/319636 "2022-11-29T06:41:27Z")

</div>

Assume Elastic cluster with 12 data nodes. Index template has 3 replicas (1 primary + 3 replicas copies), and index.write.wait\_for\_active\_shards setting configured to 2. "settings": { "number\_of\_shards": 5, "number\_…

---

## [Consuming Windows events with agent v8.4, getting error: EventHandles returned error The parameter is incorrect](https://discuss.elastic.co/t/consuming-windows-events-with-agent-v8-4-getting-error-eventhandles-returned-error-the-parameter-is-incorrect/319995)

<div class="topic-metadata">

**Author:** [@Michael\_Hyatt](https://discuss.elastic.co/u/Michael_Hyatt)\
**Replies:** 0\
**Last updated:** [November 29, 2022, 6:37am UTC](https://discuss.elastic.co/t/consuming-windows-events-with-agent-v8-4-getting-error-eventhandles-returned-error-the-parameter-is-incorrect/319995 "2022-11-29T06:37:40Z")

</div>

Had Elastic agent 8.4 running consuming windows events using the System integration and the ingest stops with this warning showing right before the ingest stops: I am really keen to know what can be done to debug it fur…

---

## [Regarding index.codec](https://discuss.elastic.co/t/regarding-index-codec/319975)

<div class="topic-metadata">

**Author:** [@prat1](https://discuss.elastic.co/u/prat1)\
**Replies:** 3\
**Last updated:** [November 29, 2022, 6:09am UTC](https://discuss.elastic.co/t/regarding-index-codec/319975 "2022-11-29T06:09:31Z")

</div>

Hi Team, Regarding compression in documentation it is mentioned as below, Use best\_compression The \_source and stored fields can easily take a non negligible amount of disk space. They can be compressed more aggressi…

---

## [Unable to make Kafka Integration to work](https://discuss.elastic.co/t/unable-to-make-kafka-integration-to-work/319932)

<div class="topic-metadata">

**Author:** [@natbronislavska](https://discuss.elastic.co/u/natbronislavska)\
**Replies:** 1\
**Last updated:** [November 29, 2022, 5:51am UTC](https://discuss.elastic.co/t/unable-to-make-kafka-integration-to-work/319932 "2022-11-29T05:51:53Z")

</div>

Hello Everyone, I have Elastic Search with fleet, elastic-agent and Kibana, all in version 8.4.3. I am trying to work with integrations and I have successfully enabled few of them. However, I have trouble enabling kafka…

---

## [Bulk Update operation on multi field type and search](https://discuss.elastic.co/t/bulk-update-operation-on-multi-field-type-and-search/319143)

<div class="topic-metadata">

**Author:** [@Sagar\_Viradiya](https://discuss.elastic.co/u/Sagar_Viradiya)\
**Replies:** 17\
**Last updated:** [November 29, 2022, 5:51am UTC](https://discuss.elastic.co/t/bulk-update-operation-on-multi-field-type-and-search/319143 "2022-11-29T05:51:51Z")

</div>

Previously we had mapping in index\_1 Index. { "properties": { "offer\_id":{ "type":long, "fields": { "keyword": { "type": "text" } …

---

## [Restrict permissions in roles to not download data table visualization CSV](https://discuss.elastic.co/t/restrict-permissions-in-roles-to-not-download-data-table-visualization-csv/319711)

<div class="topic-metadata">

**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\
**Replies:** 2\
**Last updated:** [November 29, 2022, 5:03am UTC](https://discuss.elastic.co/t/restrict-permissions-in-roles-to-not-download-data-table-visualization-csv/319711 "2022-11-29T05:03:47Z")

</div>

Hi, I'm Using Kibana 7.10.0 Is there a way(role) to show Dashboard/Visualization & user should not download CSV of the data table visualization ? I'm having dashboard with data table visualizations. I have tried diff…

---

## [Missing .keyword fields](https://discuss.elastic.co/t/missing-keyword-fields/317610)

<div class="topic-metadata">

**Author:** [@khaoz](https://discuss.elastic.co/u/khaoz)\
**Replies:** 2\
**Last updated:** [November 2, 2022, 10:08am UTC](https://discuss.elastic.co/t/missing-keyword-fields/317610 "2022-11-02T10:08:18Z")

</div>

Hello, I am quite new to ELK and I am facing the following issue. For some reason, the .keyword fields (e.g. hostname.keyword) are not being populated in Kibana and I cannot use them in setting up alerts etc. Let's t…

---

## [Elastic Forwarder not decoding json](https://discuss.elastic.co/t/elastic-forwarder-not-decoding-json/319330)

<div class="topic-metadata">

**Author:** [@eyear](https://discuss.elastic.co/u/eyear)\
**Replies:** 4\
**Last updated:** [November 29, 2022, 2:32am UTC](https://discuss.elastic.co/t/elastic-forwarder-not-decoding-json/319330 "2022-11-29T02:32:03Z")

</div>

I'm working on setting up the Elastic Forwarder. The documentation states that it automatically discovers json content - but it's not splitting all of the json content out into fields like it does when using the decode\_…

---

## [Master not discovered yet, this node has not previously joined a bootstrapped (v7+) cluster](https://discuss.elastic.co/t/master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster/319911)

<div class="topic-metadata">

**Author:** [@mumahmoud](https://discuss.elastic.co/u/mumahmoud)\
**Replies:** 1\
**Last updated:** [November 29, 2022, 2:30am UTC](https://discuss.elastic.co/t/master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster/319911 "2022-11-29T02:30:26Z")

</div>

Hi, I am getting the following error after installing RPA (automation anywhere A360 and configuring it). i have 2 nodes under WAF cluster f5 Error: \[2022-11-28T10:53:41,329\]\[WARN \]\[o.e.c.c.ClusterFormationFailureHelpe…

---

## [Creating an index pattern](https://discuss.elastic.co/t/creating-an-index-pattern/319799)

<div class="topic-metadata">

**Author:** [@Swathi\_S](https://discuss.elastic.co/u/Swathi_S)\
**Replies:** 1\
**Last updated:** [November 29, 2022, 2:26am UTC](https://discuss.elastic.co/t/creating-an-index-pattern/319799 "2022-11-29T02:26:14Z")

</div>

Need help for creation on index pattern in kibana

---

## [E: The repository 'https://artifacts.elastic.co/packages/7.x/apt stable Release' does not have a Release file](https://discuss.elastic.co/t/e-the-repository-https-artifacts-elastic-co-packages-7-x-apt-stable-release-does-not-have-a-release-file/319947)

<div class="topic-metadata">

**Author:** [@Rohith2](https://discuss.elastic.co/u/Rohith2)\
**Replies:** 1\
**Last updated:** [November 29, 2022, 2:22am UTC](https://discuss.elastic.co/t/e-the-repository-https-artifacts-elastic-co-packages-7-x-apt-stable-release-does-not-have-a-release-file/319947 "2022-11-29T02:22:07Z")

</div>

Hi, When I am giving the "sudo apt update" command I am getting this error: Err:2 https://artifacts.elastic.co/packages/7.x/apt stable Release Certificate verification failed: The certificate is NOT trusted. The certi…

---

## [My advanced watcher is failing](https://discuss.elastic.co/t/my-advanced-watcher-is-failing/319792)

<div class="topic-metadata">

**Author:** [@shivani1](https://discuss.elastic.co/u/shivani1)\
**Replies:** 0\
**Last updated:** [November 25, 2022, 6:59am UTC](https://discuss.elastic.co/t/my-advanced-watcher-is-failing/319792 "2022-11-25T06:59:54Z")

</div>

the state of my advanced watcher is showing error and execution is failed showing in the comment .But when simulating it i can see the state is ok for action and logging both.

---

## [X509 certificate signed by unknown authority - received "bad\_certificate"](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority-received-bad-certificate/319939)

<div class="topic-metadata">

**Author:** [@grumo35](https://discuss.elastic.co/u/grumo35)\
**Replies:** 0\
**Last updated:** [November 28, 2022, 11:11am UTC](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority-received-bad-certificate/319939 "2022-11-28T11:11:45Z")

</div>

Hi, I came across some erros with metricbeat and the elasticsearch-xpack module. Here is the error i get from metricbeat : Nov 28 12:03:27 S0CO000ELS04 metricbeat\[4636\]: 2022-11-28T12:03:27.827+0100#011ERROR#011module…

---

## [Enabling SSL with Elasticsearch cause logstash pipeline error](https://discuss.elastic.co/t/enabling-ssl-with-elasticsearch-cause-logstash-pipeline-error/319131)

<div class="topic-metadata">

**Author:** [@Indigo\_Star](https://discuss.elastic.co/u/Indigo_Star)\
**Replies:** 9\
**Last updated:** [November 29, 2022, 2:05am UTC](https://discuss.elastic.co/t/enabling-ssl-with-elasticsearch-cause-logstash-pipeline-error/319131 "2022-11-29T02:05:32Z")

</div>

hi, I am using 8.4.3, for both elastic and logstash. We have enabled ssl with Elasticsearch. with the ssl our logstash fails to output data there, without ssl it works fine. the output settings: output{ elasticsearch…

---

## [Kibana server is not ready yet 8.5](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-8-5/319786)

<div class="topic-metadata">

**Author:** [@theacodes](https://discuss.elastic.co/u/theacodes)\
**Replies:** 7\
**Last updated:** [November 29, 2022, 1:05am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-8-5/319786 "2022-11-29T01:05:57Z")

</div>

I was using ELK 8.4 and everything was working fine until I saw pending updates on the server which included Elastic and Kibana 8.5 updates. AND after upgrading both services are in active running status but kibana givi…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=716)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=718)
