# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=721 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 722 --- ## [How to add token\_chars: symbol using linq notation?](https://discuss.elastic.co/t/how-to-add-token-chars-symbol-using-linq-notation/319736)
**Author:** [@frankmehlhop.com](https://discuss.elastic.co/u/frankmehlhop.com)\ **Replies:** 1\ **Last updated:** [November 24, 2022, 1:30pm UTC](https://discuss.elastic.co/t/how-to-add-token-chars-symbol-using-linq-notation/319736 "2022-11-24T13:30:08Z")
I want that I can also search for symbols like "§123". I find that I should add token\_chars: symbol. (example) "token\_chars": \["letter", "digit", "punctuation", "symbol"\] At my C#-code I'm using elasticClient.Indices… --- ## [How to do calculations in Logstash](https://discuss.elastic.co/t/how-to-do-calculations-in-logstash/319759)
**Author:** [@Rakhshunda\_Noorein\_J](https://discuss.elastic.co/u/Rakhshunda_Noorein_J)\ **Replies:** 0\ **Last updated:** [November 24, 2022, 1:23pm UTC](https://discuss.elastic.co/t/how-to-do-calculations-in-logstash/319759 "2022-11-24T13:23:30Z")
Hello, Please find my configuration file structure input{ http\_poller{ // here I have mentioned API url and authorisation tags =\> \["tag1"\] } http\_poller{ // here I have mentioned API url and authorisation tags =\> \["tag… --- ## [Keystore.password deprecated](https://discuss.elastic.co/t/keystore-password-deprecated/319324)
**Author:** [@EExisT](https://discuss.elastic.co/u/EExisT)\ **Replies:** 7\ **Last updated:** [November 24, 2022, 12:13pm UTC](https://discuss.elastic.co/t/keystore-password-deprecated/319324 "2022-11-24T12:13:24Z")
Hello, i'm triyng to resolve this deprecated setting but i can't rn. I add the secure version(keystore.secure\_password) in the keystore by elasticsearch-keystore add but it didn't work. I tried also to put it in the y… --- ## [Elasticsearch 7.15 Multi terms aggregation with several fields, sort by key](https://discuss.elastic.co/t/elasticsearch-7-15-multi-terms-aggregation-with-several-fields-sort-by-key/319716)
**Author:** [@anna1](https://discuss.elastic.co/u/anna1)\ **Replies:** 0\ **Last updated:** [November 24, 2022, 8:22am UTC](https://discuss.elastic.co/t/elasticsearch-7-15-multi-terms-aggregation-with-several-fields-sort-by-key/319716 "2022-11-24T08:22:38Z")
Hello everyone, I have a question regarding the case of multi terms aggregation with several fields and sort by key. How does the sorting work if the key is an array? According to which field / value is the sorting do… --- ## [How to use WrapperQuery in new Java API client 8.4.3 to fire a raw elasticsearch query?](https://discuss.elastic.co/t/how-to-use-wrapperquery-in-new-java-api-client-8-4-3-to-fire-a-raw-elasticsearch-query/319727)
**Author:** [@p4charu](https://discuss.elastic.co/u/p4charu)\ **Replies:** 0\ **Last updated:** [November 24, 2022, 9:36am UTC](https://discuss.elastic.co/t/how-to-use-wrapperquery-in-new-java-api-client-8-4-3-to-fire-a-raw-elasticsearch-query/319727 "2022-11-24T09:36:53Z")
I'm trying to use WrapperQuery to run a raw query like this String queryStr = "{\\n" + " \\"query\\": {\\n" + " \\"bool\\": {\\n" + " \\"must\\": \[\\n" + " {\\n" + " \\"match\\": {\\n" +… --- ## [Heartbeat in elastic agent](https://discuss.elastic.co/t/heartbeat-in-elastic-agent/319742)
**Author:** [@priti](https://discuss.elastic.co/u/priti)\ **Replies:** 1\ **Last updated:** [November 24, 2022, 11:29am UTC](https://discuss.elastic.co/t/heartbeat-in-elastic-agent/319742 "2022-11-24T11:29:01Z")
We have installed Elastic agent (Fleet) but not able to find how to integrate heartbeat with it. Fleet version 7.10.01 . Please help to find how to configure URL's monitoring with Elastic agent. --- ## [Filebeat is not taking input in regular interval](https://discuss.elastic.co/t/filebeat-is-not-taking-input-in-regular-interval/319732)
**Author:** [@subrata7](https://discuss.elastic.co/u/subrata7)\ **Replies:** 0\ **Last updated:** [November 24, 2022, 10:15am UTC](https://discuss.elastic.co/t/filebeat-is-not-taking-input-in-regular-interval/319732 "2022-11-24T10:15:43Z")
A node js application is writing on a JSON file in a interval of 30s from where Filebeat is supposed to take input and send to elasticsearch through logstash.But filebeat is not reading the input until I open the file in… --- ## [Create custom index while sending logs from filebeat to elasticsearch](https://discuss.elastic.co/t/create-custom-index-while-sending-logs-from-filebeat-to-elasticsearch/319747)
**Author:** [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\ **Replies:** 0\ **Last updated:** [November 24, 2022, 11:24am UTC](https://discuss.elastic.co/t/create-custom-index-while-sending-logs-from-filebeat-to-elasticsearch/319747 "2022-11-24T11:24:08Z")
Hi i've setup filebeat(7.17.7) to send logs to elasticsearch(8.5.1) The logs are getting shipped but to the default index that is filebeat 7.17 Here is my filebeat.yml output.elasticsearch: # Array of hosts to conne… --- ## [Conditional formatting of the header of a table](https://discuss.elastic.co/t/conditional-formatting-of-the-header-of-a-table/319745)
**Author:** [@Gianluca\_De\_Pasquale](https://discuss.elastic.co/u/Gianluca_De_Pasquale)\ **Replies:** 0\ **Last updated:** [November 24, 2022, 11:21am UTC](https://discuss.elastic.co/t/conditional-formatting-of-the-header-of-a-table/319745 "2022-11-24T11:21:06Z")
Hi team, with the following code I obtained the conditional formatting of a table based on the value of the field "vendor\_name". Is it possible to format header separately from the data in the table? thanks, g kibana… --- ## [Logstash Shutiing Down](https://discuss.elastic.co/t/logstash-shutiing-down/319744)
**Author:** [@ChinigamiHunter](https://discuss.elastic.co/u/ChinigamiHunter)\ **Replies:** 0\ **Last updated:** [November 24, 2022, 11:19am UTC](https://discuss.elastic.co/t/logstash-shutiing-down/319744 "2022-11-24T11:19:38Z")
i'm new to ELK i have a folder contient json files and i'm using logstash for indexing sometimes i get this error \[2022-11-24T11:08:58,748\]\[WARN \]\[logstash.runner \] SIGINT received. Shutting down. \[2022-11-24… --- ## [TVSB Markdown visualization null values](https://discuss.elastic.co/t/tvsb-markdown-visualization-null-values/319718)
**Author:** [@Alice\_Ionescu](https://discuss.elastic.co/u/Alice_Ionescu)\ **Replies:** 2\ **Last updated:** [November 24, 2022, 11:01am UTC](https://discuss.elastic.co/t/tvsb-markdown-visualization-null-values/319718 "2022-11-24T11:01:18Z")
Hello, How can I display null values using each\_all in a markdown visualization? I have this until now {{#each \_all}} {{#with office as myoffice Office {{../label}} {{/with}} {{/each}} wher… --- ## [Data stream in filebeat 8.1.0](https://discuss.elastic.co/t/data-stream-in-filebeat-8-1-0/319596)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 1\ **Last updated:** [November 24, 2022, 10:35am UTC](https://discuss.elastic.co/t/data-stream-in-filebeat-8-1-0/319596 "2022-11-24T10:35:46Z")
Hi I'm using filebeat in 8.1.0 on docker below is my filebeat.yml But I'm able to reach data stream option how i should enable it? The second thing how to under docker image force enable dedicated module for example ap… --- ## [Filebeat k8s annotations](https://discuss.elastic.co/t/filebeat-k8s-annotations/319587)
**Author:** [@Jeff\_d\_Ambly](https://discuss.elastic.co/u/Jeff_d_Ambly)\ **Replies:** 1\ **Last updated:** [November 24, 2022, 10:23am UTC](https://discuss.elastic.co/t/filebeat-k8s-annotations/319587 "2022-11-24T10:23:48Z")
I'm trying to get filebeat working in kubernetes, I'm wanting to only collect logs for pods in specific namespaces here is my filebeat config filebeat.inputs: - type: log paths: - /var/lib/rancher/rke/log/\*… --- ## [Filebeat start config wrong](https://discuss.elastic.co/t/filebeat-start-config-wrong/319502)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 1\ **Last updated:** [November 24, 2022, 10:14am UTC](https://discuss.elastic.co/t/filebeat-start-config-wrong/319502 "2022-11-24T10:14:22Z")
I've tried to read my nginx logs trough filebeats on Windows (for test) but something goes wrong. Can You suggest? - module: nginx # Access logs access: enabled: true # Set custom paths for the log files. I… --- ## [I get error Unable to configure plugins: (ArgumentError) Cannot determine timezone from nil](https://discuss.elastic.co/t/i-get-error-unable-to-configure-plugins-argumenterror-cannot-determine-timezone-from-nil/319531)
**Author:** [@mdinalova](https://discuss.elastic.co/u/mdinalova)\ **Replies:** 5\ **Last updated:** [November 24, 2022, 9:08am UTC](https://discuss.elastic.co/t/i-get-error-unable-to-configure-plugins-argumenterror-cannot-determine-timezone-from-nil/319531 "2022-11-24T09:08:18Z")
Hello guys! I want to run my logtstash connect to elastic using input jdbc. Then i create conf file to run logstash but i always get this error, i try any changes in conf file but still not working. Anyone can help me t… --- ## [Shipping logs from Logstash to multiple Elasticsearch node in the cluster](https://discuss.elastic.co/t/shipping-logs-from-logstash-to-multiple-elasticsearch-node-in-the-cluster/319708)
**Author:** [@chaunguyen.3979](https://discuss.elastic.co/u/chaunguyen.3979)\ **Replies:** 1\ **Last updated:** [November 24, 2022, 8:43am UTC](https://discuss.elastic.co/t/shipping-logs-from-logstash-to-multiple-elasticsearch-node-in-the-cluster/319708 "2022-11-24T08:43:47Z")
Hello, I create a cluster with 3 Elasticsearch nodes, and intend to ship logs from the Logstash to all Elasticsearch nodes simultaneously (Eg: I have cluster with node A - master node, node B and C - data node, and ever… --- ## [Is it able to freeze other operations during re-index in opensearch/elasticsearch?](https://discuss.elastic.co/t/is-it-able-to-freeze-other-operations-during-re-index-in-opensearch-elasticsearch/319720)
**Author:** [@Daniel\_Gordon](https://discuss.elastic.co/u/Daniel_Gordon)\ **Replies:** 1\ **Last updated:** [November 24, 2022, 8:42am UTC](https://discuss.elastic.co/t/is-it-able-to-freeze-other-operations-during-re-index-in-opensearch-elasticsearch/319720 "2022-11-24T08:42:07Z")
Hi all, I encountered a problem that requiring to freeze other operations(such as create document/update document) during re-index. This is because we worried about the difference between source index's documents and ta… --- ## [Does filebeat transmit data to the master node of the elasticsearch cluster or to the data node](https://discuss.elastic.co/t/does-filebeat-transmit-data-to-the-master-node-of-the-elasticsearch-cluster-or-to-the-data-node/319694)
**Author:** [@CatLoveFishma](https://discuss.elastic.co/u/CatLoveFishma)\ **Replies:** 3\ **Last updated:** [November 24, 2022, 8:27am UTC](https://discuss.elastic.co/t/does-filebeat-transmit-data-to-the-master-node-of-the-elasticsearch-cluster-or-to-the-data-node/319694 "2022-11-24T08:27:59Z")
Hello, If I have a es cluster which has three data nodes (B,C,D) and a master node (A). Now I want to use filebeat to collect logs and directly transfer date to the es cluster.Which node should I transfer the data to？ … --- ## [How to run wildcard queries for long types?](https://discuss.elastic.co/t/how-to-run-wildcard-queries-for-long-types/319706)
**Author:** [@golofetuk](https://discuss.elastic.co/u/golofetuk)\ **Replies:** 0\ **Last updated:** [November 24, 2022, 7:35am UTC](https://discuss.elastic.co/t/how-to-run-wildcard-queries-for-long-types/319706 "2022-11-24T07:35:51Z")
I just run a simple wildcard query on my elasticsearch server. My query is; GET calls-\*/\_search { "query": { "bool": { "filter": \[ { "bool": { "should": \[ { … --- ## [Logstash stopped processing](https://discuss.elastic.co/t/logstash-stopped-processing/319641)
**Author:** [@shubham.s](https://discuss.elastic.co/u/shubham.s)\ **Replies:** 10\ **Last updated:** [November 24, 2022, 7:27am UTC](https://discuss.elastic.co/t/logstash-stopped-processing/319641 "2022-11-24T07:27:29Z")
Hi, The elasticsearch and kibana are working as intentional but after installing and configuring logstash in centos , the service stops \[2022-11-23T15:20:38,842\]\[INFO \]\[logstash.runner \] Log4j configuration pa… --- ## [How will create a global variable in logstash?](https://discuss.elastic.co/t/how-will-create-a-global-variable-in-logstash/319705)
**Author:** [@Rakhshunda\_Noorein\_J](https://discuss.elastic.co/u/Rakhshunda_Noorein_J)\ **Replies:** 0\ **Last updated:** [November 24, 2022, 7:08am UTC](https://discuss.elastic.co/t/how-will-create-a-global-variable-in-logstash/319705 "2022-11-24T07:08:57Z")
Hello, My config is like this - input{ http\_poller{ // here I have mentioned API url and authorisation tags =\> \["tag1"\] } http\_poller{ // here I have mentioned API url and authorisation tags =\> \["tag2"\] } http\_poller{ … --- ## [Ingest only ERROR and warning logs to elastic search](https://discuss.elastic.co/t/ingest-only-error-and-warning-logs-to-elastic-search/319634)
**Author:** [@rahul\_sirugudi](https://discuss.elastic.co/u/rahul_sirugudi)\ **Replies:** 2\ **Last updated:** [November 24, 2022, 4:55am UTC](https://discuss.elastic.co/t/ingest-only-error-and-warning-logs-to-elastic-search/319634 "2022-11-24T04:55:28Z")
Hi I am trying to ingest only ERROR and warning logs to Elasticsearch. Currently filebeat is shipping logs to log stash, i am using grok pattern. grok { match =\> { "message" =\> "%{IPV4:ip} - \\\[%{TIMESTAMP\_ISO8601:timest… --- ## [Logstash tcp plugin](https://discuss.elastic.co/t/logstash-tcp-plugin/319584)
**Author:** [@SilasMuniz1](https://discuss.elastic.co/u/SilasMuniz1)\ **Replies:** 3\ **Last updated:** [November 24, 2022, 12:08am UTC](https://discuss.elastic.co/t/logstash-tcp-plugin/319584 "2022-11-24T00:08:35Z")
Hello, I need convert a data field to date field. I am working in restore processed, where I get an old file and insert into elasticsearch by logstash. I received a file with this date format \[06/Jun/2022:13:20:01 -03… --- ## [Packetbeat Adding Output Fields from YML config file](https://discuss.elastic.co/t/packetbeat-adding-output-fields-from-yml-config-file/319686)
**Author:** [@dbh1985](https://discuss.elastic.co/u/dbh1985)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 9:57pm UTC](https://discuss.elastic.co/t/packetbeat-adding-output-fields-from-yml-config-file/319686 "2022-11-23T21:57:12Z")
How can I configure the packetbeat yml file to add a field "username" if an output field exists "agent.hostname" equal to a specific value? Here's what I got so far, but unable to start service afterwards: I've put thi… --- ## [EQL match event A only if event B does not occur within maxspan](https://discuss.elastic.co/t/eql-match-event-a-only-if-event-b-does-not-occur-within-maxspan/319684)
**Author:** [@jyoung15](https://discuss.elastic.co/u/jyoung15)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 9:17pm UTC](https://discuss.elastic.co/t/eql-match-event-a-only-if-event-b-does-not-occur-within-maxspan/319684 "2022-11-23T21:17:41Z")
Hi, My question is similar to https://discuss.elastic.co/t/creating-alert-when-event-didnt-occur/282195, which was never really resolved. I'm looking to see if there are any other suggestions how to handle this. Basica… --- ## [Possible to hide "panel filters" in Kibana 8.5.x?](https://discuss.elastic.co/t/possible-to-hide-panel-filters-in-kibana-8-5-x/319082)
**Author:** [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Replies:** 3\ **Last updated:** [November 23, 2022, 7:32pm UTC](https://discuss.elastic.co/t/possible-to-hide-panel-filters-in-kibana-8-5-x/319082 "2022-11-23T19:32:12Z")
This "panel filters" thing has been added in Kibana 8.5. Is there any configuration option to hide this? We find that it... does not to add any real value is distracting takes up valuable screen real estate --- ## [Kibana is not starting](https://discuss.elastic.co/t/kibana-is-not-starting/319649)
**Author:** [@venkata\_pavan\_kalyan](https://discuss.elastic.co/u/venkata_pavan_kalyan)\ **Replies:** 1\ **Last updated:** [November 23, 2022, 7:41pm UTC](https://discuss.elastic.co/t/kibana-is-not-starting/319649 "2022-11-23T19:41:18Z")
Kibana is not starting from ansible kibana service is starting when ansible role executed after playbook execution completed automatically kibana service stopping immediately cmd: /usr/bin/nohup ./kibana & --- ## [Failure to change the password to elk](https://discuss.elastic.co/t/failure-to-change-the-password-to-elk/319672)
**Author:** [@jihen\_barbouche](https://discuss.elastic.co/u/jihen_barbouche)\ **Replies:** 1\ **Last updated:** [November 23, 2022, 7:36pm UTC](https://discuss.elastic.co/t/failure-to-change-the-password-to-elk/319672 "2022-11-23T19:36:37Z")
hello there , i enabled the xpack and i want to change the password but i have this error connection failure to https://...:9200/\_security/\_authentication?pretty failed: connection refused --- ## [How to iterate through json array and print a formatted string?](https://discuss.elastic.co/t/how-to-iterate-through-json-array-and-print-a-formatted-string/319676)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 1\ **Last updated:** [November 23, 2022, 6:27pm UTC](https://discuss.elastic.co/t/how-to-iterate-through-json-array-and-print-a-formatted-string/319676 "2022-11-23T18:27:47Z")
I'm learning how to use logstash and I got things to mostly work. But I want to learn how to iterate through a json array and print a formatted result set. For example, I created a file called /root/test.log with the fo… --- ## [Logstash x handling duplicate](https://discuss.elastic.co/t/logstash-x-handling-duplicate/319604)
**Author:** [@lchan](https://discuss.elastic.co/u/lchan)\ **Replies:** 2\ **Last updated:** [November 23, 2022, 5:27pm UTC](https://discuss.elastic.co/t/logstash-x-handling-duplicate/319604 "2022-11-23T17:27:26Z")
Hi all, I am trying to increase number of logstash servers for redundancy and want to know if using fingerprint would achieve it. Does this basically sending the same stream of logs/messages via multiple logstash serve… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=720) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=722)