# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=770 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 771 --- ## [Upgrading from ES 6.8 to 7.17 and got MasterNotDiscoveredException](https://discuss.elastic.co/t/upgrading-from-es-6-8-to-7-17-and-got-masternotdiscoveredexception/316108)
**Author:** [@jayp-glb](https://discuss.elastic.co/u/jayp-glb)\ **Replies:** 0\ **Last updated:** [October 7, 2022, 10:07pm UTC](https://discuss.elastic.co/t/upgrading-from-es-6-8-to-7-17-and-got-masternotdiscoveredexception/316108 "2022-10-07T22:07:02Z")
Hello community, In my Elasticsearch upgrade crazyness, I was finally able to reindex my old ES 5.0 cluster into 6.8, though with lots of adjustments because of the only one mapping per index rule, but I digress. I hav… --- ## [Is it possible for Elasticsearch to integration with sophos and watchguard firewall?](https://discuss.elastic.co/t/is-it-possible-for-elasticsearch-to-integration-with-sophos-and-watchguard-firewall/315518)
**Author:** [@vyom](https://discuss.elastic.co/u/vyom)\ **Replies:** 0\ **Last updated:** [September 30, 2022, 6:00am UTC](https://discuss.elastic.co/t/is-it-possible-for-elasticsearch-to-integration-with-sophos-and-watchguard-firewall/315518 "2022-09-30T06:00:06Z")
Hello everyone, I am working on a project "Elastic integration with sophis and watchguard firewall". And i am very confuse about how the logs will come to the elastic. Can someone guide me to this??? --- ## [Unable to retrieve version information from Elasticsearch nodes. unable to get issuer certificate Unable to retrieve version information from Elasticsearch nodes. unable to get issuer certificate](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes-unable-to-get-issuer-certificate-unable-to-retrieve-version-information-from-elasticsearch-nodes-unable-to-get-issuer-certificate/316000)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 8\ **Last updated:** [October 7, 2022, 8:41pm UTC](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes-unable-to-get-issuer-certificate-unable-to-retrieve-version-information-from-elasticsearch-nodes-unable-to-get-issuer-certificate/316000 "2022-10-07T20:41:43Z")
I'm trying to use ssl certificates created by Let's Encrypt for elasticsearch and kibana version 8.4. Kibana fails at start up with this error message: Unable to retrieve version information from Elasticsearch nodes. u… --- ## [Unable to download Kibana Discover logs into csv/excel in Kibana 8.2.2](https://discuss.elastic.co/t/unable-to-download-kibana-discover-logs-into-csv-excel-in-kibana-8-2-2/315966)
**Author:** [@lakshmiD](https://discuss.elastic.co/u/lakshmiD)\ **Replies:** 1\ **Last updated:** [October 7, 2022, 7:44pm UTC](https://discuss.elastic.co/t/unable-to-download-kibana-discover-logs-into-csv-excel-in-kibana-8-2-2/315966 "2022-10-07T19:44:18Z")
Hi Team, How to download kibana discover tab logs into csv/excel when I tired to generate from share--\>csv reports--\>Generate CSV ,getting request timed out error Is there any extensions available in chrome to downloa… --- ## [How to create table by month grouped by year](https://discuss.elastic.co/t/how-to-create-table-by-month-grouped-by-year/316044)
**Author:** [@LucasTavernier](https://discuss.elastic.co/u/LucasTavernier)\ **Replies:** 1\ **Last updated:** [October 7, 2022, 7:39pm UTC](https://discuss.elastic.co/t/how-to-create-table-by-month-grouped-by-year/316044 "2022-10-07T19:39:44Z")
Hello everyone, i'm new in the ELK stack. I have to to make a table but it's really hard can you please help me. To help you understand what i have to do, i will explain my datas. I got bugs tickets with the id/name o… --- ## [Hide value of legend in Timelion](https://discuss.elastic.co/t/hide-value-of-legend-in-timelion/315470)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 2\ **Last updated:** [October 7, 2022, 6:41pm UTC](https://discuss.elastic.co/t/hide-value-of-legend-in-timelion/315470 "2022-10-07T18:41:08Z")
Hello! could anyone tell me how can i hide the value of the legend without hide the whole legend? Thanks in advanced! --- ## [Alert Message Data Kibana 8.3](https://discuss.elastic.co/t/alert-message-data-kibana-8-3/315876)
**Author:** [@quixter](https://discuss.elastic.co/u/quixter)\ **Replies:** 0\ **Last updated:** [October 5, 2022, 12:34pm UTC](https://discuss.elastic.co/t/alert-message-data-kibana-8-3/315876 "2022-10-05T12:34:47Z")
I'm creating alerts using the new Alert GUI. Wondering how I would add available fields from the log entries. For an example we have a field called rcm.serverdesc that provided the friendly name of the server the error w… --- ## [FORCE index rollover](https://discuss.elastic.co/t/force-index-rollover/315958)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 5\ **Last updated:** [October 7, 2022, 5:33pm UTC](https://discuss.elastic.co/t/force-index-rollover/315958 "2022-10-07T17:33:40Z")
Hello, I sheep logs from multiples servers via the winlogbeat agent that are stored with index name ecs-agent-windows. This index is managed by a test0 policy (ILM) and configured with the agent-wingbeat template. The … --- ## [Filebeat ILM policy question](https://discuss.elastic.co/t/filebeat-ilm-policy-question/316077)
**Author:** [@Mark\_Visser](https://discuss.elastic.co/u/Mark_Visser)\ **Replies:** 8\ **Last updated:** [October 7, 2022, 5:11pm UTC](https://discuss.elastic.co/t/filebeat-ilm-policy-question/316077 "2022-10-07T17:11:57Z")
Hello, For my filebeat rollover to work it expects an alias to be set on the index. In the past you were able to pass along a rollover\_alias in the filebeat config but that is not possible anymore. I found you can manu… --- ## [Problem with geoip plugin and IP whitelist filtering](https://discuss.elastic.co/t/problem-with-geoip-plugin-and-ip-whitelist-filtering/316051)
**Author:** [@Lynow](https://discuss.elastic.co/u/Lynow)\ **Replies:** 2\ **Last updated:** [October 7, 2022, 4:46pm UTC](https://discuss.elastic.co/t/problem-with-geoip-plugin-and-ip-whitelist-filtering/316051 "2022-10-07T16:46:45Z")
Good morning ! I am using Logstash to fetch data by Wazuh (HIDS) and Suricata (NIDS). So I use the Geoip plugin to geolocate the IPs that connect to my server. My first problem is this: When I do a test by connecting … --- ## [Logstash pipeline.workers](https://discuss.elastic.co/t/logstash-pipeline-workers/316053)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 1\ **Last updated:** [October 7, 2022, 4:31pm UTC](https://discuss.elastic.co/t/logstash-pipeline-workers/316053 "2022-10-07T16:31:47Z")
Hello! Currently we have our pipeline.yml without defined workers. We understand that we take by default the number of cpu cores of the machine. Should we define all in pipeline.worker: 1 ? How do we decide which work… --- ## [How to reset the kibana fleet settings](https://discuss.elastic.co/t/how-to-reset-the-kibana-fleet-settings/316056)
**Author:** [@lordcosmos1978](https://discuss.elastic.co/u/lordcosmos1978)\ **Replies:** 0\ **Last updated:** [October 7, 2022, 9:47am UTC](https://discuss.elastic.co/t/how-to-reset-the-kibana-fleet-settings/316056 "2022-10-07T09:47:17Z")
Somehow I messed up the fleet setup. I am now unable to start the rollout of a new fleet server. Is there a way ( perhaps deleting the fleet indexes but it wont allow me ) to get back at the first step where you get the… --- ## [Remote\_addr showing 127.0.01](https://discuss.elastic.co/t/remote-addr-showing-127-0-01/315738)
**Author:** [@AkankshaSS](https://discuss.elastic.co/u/AkankshaSS)\ **Replies:** 21\ **Last updated:** [October 7, 2022, 4:20pm UTC](https://discuss.elastic.co/t/remote-addr-showing-127-0-01/315738 "2022-10-07T16:20:46Z")
Hi,I am able to see only 127.0.01 in http-x\_forwarded\_for.Can someone please help me what's the changes required. --- ## [Switch from Watchers to Rules and Connectors](https://discuss.elastic.co/t/switch-from-watchers-to-rules-and-connectors/316088)
**Author:** [@federica.forti](https://discuss.elastic.co/u/federica.forti)\ **Replies:** 0\ **Last updated:** [October 7, 2022, 2:05pm UTC](https://discuss.elastic.co/t/switch-from-watchers-to-rules-and-connectors/316088 "2022-10-07T14:05:40Z")
Hi, we would like to move from watchers to rules (Rule and connectors section). In particular, in the past, we have defined a watcher that performs the following queries / aggregations: { "query": { "bool": { … --- ## [Failed to create query: maxClauseCount is set to 1024](https://discuss.elastic.co/t/failed-to-create-query-maxclausecount-is-set-to-1024/316089)
**Author:** [@GuillermoDelaGala](https://discuss.elastic.co/u/GuillermoDelaGala)\ **Replies:** 1\ **Last updated:** [October 7, 2022, 2:51pm UTC](https://discuss.elastic.co/t/failed-to-create-query-maxclausecount-is-set-to-1024/316089 "2022-10-07T14:51:32Z")
Hi everyone, first of all, saying that I'm quite new with Elasticsearch. I was diving into other similar issues related with my problem, but none of the solutions worked for me. My code has a query which says: failed… --- ## [Elasticsearch 8 Java Client ResponseException status line \[HTTP/1.1 404 Not Found\] {"statusCode":404,"error":"Not Found","message":"Not Found"}](https://discuss.elastic.co/t/elasticsearch-8-java-client-responseexception-status-line-http-1-1-404-not-found-statuscode-404-error-not-found-message-not-found/316019)
**Author:** [@Michael\_Gattinger](https://discuss.elastic.co/u/Michael_Gattinger)\ **Replies:** 3\ **Last updated:** [October 7, 2022, 2:44pm UTC](https://discuss.elastic.co/t/elasticsearch-8-java-client-responseexception-status-line-http-1-1-404-not-found-statuscode-404-error-not-found-message-not-found/316019 "2022-10-07T14:44:11Z")
Hello, this is Michael from germany and i am reaching out to you because i have to finish my master thesis before 31.10.2022. I had working code in july 2022 which i didn't touch since then. I used the online 2 weeks t… --- ## [“The file could not be processed due to error: “Gateway Timeout”"](https://discuss.elastic.co/t/the-file-could-not-be-processed-due-to-error-gateway-timeout/316079)
**Author:** [@Veera\_V](https://discuss.elastic.co/u/Veera_V)\ **Replies:** 2\ **Last updated:** [October 7, 2022, 1:46pm UTC](https://discuss.elastic.co/t/the-file-could-not-be-processed-due-to-error-gateway-timeout/316079 "2022-10-07T13:46:55Z")
Hi Team, Getting "Gateway Timeout" while importing ES 6.3 dashboard file to OS 1.3, Can any one help here is the time out is due to large json file size ? --- ## [Aggregate whole groups when search machtes only a few items of that group](https://discuss.elastic.co/t/aggregate-whole-groups-when-search-machtes-only-a-few-items-of-that-group/316082)
**Author:** [@lanwin](https://discuss.elastic.co/u/lanwin)\ **Replies:** 0\ **Last updated:** [October 7, 2022, 1:30pm UTC](https://discuss.elastic.co/t/aggregate-whole-groups-when-search-machtes-only-a-few-items-of-that-group/316082 "2022-10-07T13:30:02Z")
Hi, i am looking for a solution of the following problem. I have 20 million "Item" objects. Each Item Object have a GroupId property where 1-5000 Items a grouped together. Each Item has some other properties we can use … --- ## [ILM index rollover error](https://discuss.elastic.co/t/ilm-index-rollover-error/315938)
**Author:** [@Khaled\_Saidi](https://discuss.elastic.co/u/Khaled_Saidi)\ **Replies:** 6\ **Last updated:** [October 7, 2022, 1:10pm UTC](https://discuss.elastic.co/t/ilm-index-rollover-error/315938 "2022-10-07T13:10:06Z")
Hi everyone, Hope you will be able to help me another time. I have an elasticsearch cluster with an ILM Policy to manage the index rollover. The rollover is based on the index size. Everything was running well. The c… --- ## [Cluster state has not been recovered yet, cannot write to the \[null\] index](https://discuss.elastic.co/t/cluster-state-has-not-been-recovered-yet-cannot-write-to-the-null-index/315945)
**Author:** [@iLucas.Bechlte.exe](https://discuss.elastic.co/u/iLucas.Bechlte.exe)\ **Replies:** 1\ **Last updated:** [October 7, 2022, 1:00pm UTC](https://discuss.elastic.co/t/cluster-state-has-not-been-recovered-yet-cannot-write-to-the-null-index/315945 "2022-10-07T13:00:24Z")
Hi, i try to run an elastic stack with the localhost as the only node. I followed the official installation guide, but when I get to the running check it shows me this error after entering the password: {"error":{"root… --- ## [Multi-node backup and restore to GCS bucket](https://discuss.elastic.co/t/multi-node-backup-and-restore-to-gcs-bucket/316064)
**Author:** [@mohan\_s\_b](https://discuss.elastic.co/u/mohan_s_b)\ **Replies:** 0\ **Last updated:** [October 7, 2022, 11:06am UTC](https://discuss.elastic.co/t/multi-node-backup-and-restore-to-gcs-bucket/316064 "2022-10-07T11:06:19Z")
Hi All, I have deployed multi-node elasticsearch cluster in kubernetes and i wanted to take backup and restore. Since i have multi nodes i am not sure where to install google plugins and to upload service account. --- ## [Rollup job date histogram bucket starts at 00.00 for day interval instead of current time](https://discuss.elastic.co/t/rollup-job-date-histogram-bucket-starts-at-00-00-for-day-interval-instead-of-current-time/316063)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 0\ **Last updated:** [October 7, 2022, 11:05am UTC](https://discuss.elastic.co/t/rollup-job-date-histogram-bucket-starts-at-00-00-for-day-interval-instead-of-current-time/316063 "2022-10-07T11:05:45Z")
Hello, i tried using rollup job and set date histogram bucket to interval of 24h. After starting the job, creating data view, and viewing it in kibana, the interval starts at 24h from 7 october at 00.00 until yesterday a… --- ## [Metricbeat 7.17.6 - Cannot index event](https://discuss.elastic.co/t/metricbeat-7-17-6-cannot-index-event/316057)
**Author:** [@jColfej](https://discuss.elastic.co/u/jColfej)\ **Replies:** 0\ **Last updated:** [October 7, 2022, 9:47am UTC](https://discuss.elastic.co/t/metricbeat-7-17-6-cannot-index-event/316057 "2022-10-07T09:47:39Z")
Following our cluster upgrade to Elasticsearch 7.17.6, we had to migrate the monitoring stack using Metricbeat. In Kibana, monitoring is not working, hosts are marked as unmonitored even though Metricbeat is on all host… --- ## [Enrich data using ingest pipeline and enrich policy override data](https://discuss.elastic.co/t/enrich-data-using-ingest-pipeline-and-enrich-policy-override-data/316049)
**Author:** [@Fariddev](https://discuss.elastic.co/u/Fariddev)\ **Replies:** 0\ **Last updated:** [October 7, 2022, 9:07am UTC](https://discuss.elastic.co/t/enrich-data-using-ingest-pipeline-and-enrich-policy-override-data/316049 "2022-10-07T09:07:34Z")
Hi, I want to enrich data in an index (add nationality of authors in books index) using data in another index (authors). I use an ingest pipeline with an enrich policy. Here is a simple example : Indices PUT books { … --- ## [Unable to create token getting below error as Failed to determine the health of the cluster](https://discuss.elastic.co/t/unable-to-create-token-getting-below-error-as-failed-to-determine-the-health-of-the-cluster/316039)
**Author:** [@RChan](https://discuss.elastic.co/u/RChan)\ **Replies:** 0\ **Last updated:** [October 7, 2022, 7:10am UTC](https://discuss.elastic.co/t/unable-to-create-token-getting-below-error-as-failed-to-determine-the-health-of-the-cluster/316039 "2022-10-07T07:10:53Z")
WARN org.elasticsearch.common.ssl.DiagnosticTrustManager - failed to establish trust with server at \[x.x.x.x\]; the server provided a certificate with subject name, fingerprint \[629616647bf0e539b0ca8f616b516df4a356f5af… --- ## [Painless script for the average aggregation based on date difference and one of the date is from params maps](https://discuss.elastic.co/t/painless-script-for-the-average-aggregation-based-on-date-difference-and-one-of-the-date-is-from-params-maps/316036)
**Author:** [@rushikeshsabde](https://discuss.elastic.co/u/rushikeshsabde)\ **Replies:** 0\ **Last updated:** [October 7, 2022, 6:45am UTC](https://discuss.elastic.co/t/painless-script-for-the-average-aggregation-based-on-date-difference-and-one-of-the-date-is-from-params-maps/316036 "2022-10-07T06:45:37Z")
I am trying to calculate the average aggregation based on date difference. Earlier both the date were in the same index, so tired this for the average index: "avg": { "script": { … --- ## [Geography failed](https://discuss.elastic.co/t/geography-failed/315944)
**Author:** [@Jimmy\_Escrich](https://discuss.elastic.co/u/Jimmy_Escrich)\ **Replies:** 7\ **Last updated:** [October 7, 2022, 5:46am UTC](https://discuss.elastic.co/t/geography-failed/315944 "2022-10-07T05:46:01Z")
Hi there, I have an issue with GeometricCollection. I have a field location\_geography configured at geo\_shape. I want to update my document and I have this error : failed to parse field \[location\_geography\] of type \[geo… --- ## [Get POST URL for PDF reports with API](https://discuss.elastic.co/t/get-post-url-for-pdf-reports-with-api/315814)
**Author:** [@Saliinger](https://discuss.elastic.co/u/Saliinger)\ **Replies:** 2\ **Last updated:** [October 7, 2022, 4:48am UTC](https://discuss.elastic.co/t/get-post-url-for-pdf-reports-with-api/315814 "2022-10-07T04:48:22Z")
Hello! Hope you are doing good :smiley: I have a question: It is possible get the URL POST for PDF reports using API? Getting the Copy POST URL with cURL or Postman and not doing it manually as always. Is there an… --- ## [How to view contents of heartbeat keystore](https://discuss.elastic.co/t/how-to-view-contents-of-heartbeat-keystore/315933)
**Author:** [@swchandu](https://discuss.elastic.co/u/swchandu)\ **Replies:** 2\ **Last updated:** [October 7, 2022, 4:26am UTC](https://discuss.elastic.co/t/how-to-view-contents-of-heartbeat-keystore/315933 "2022-10-07T04:26:47Z")
Hi, I am trying to check if we can display the contents and values of the heartbeat.keystore. Is there any command to display the entries and values? I am unable to find the documentation on this. can someone help me … --- ## [String comparison inside a update\_by\_query api script](https://discuss.elastic.co/t/string-comparison-inside-a-update-by-query-api-script/316024)
**Author:** [@djoobbani](https://discuss.elastic.co/u/djoobbani)\ **Replies:** 0\ **Last updated:** [October 7, 2022, 12:51am UTC](https://discuss.elastic.co/t/string-comparison-inside-a-update-by-query-api-script/316024 "2022-10-07T00:51:35Z")
I am performing a Update\_by\_query api and inside its script i need to do string comparison of two different parameteres, similar to how u would do it with intgers: So, i need to do something like this with string: str… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=769) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=771)