# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=775 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 776 --- ## [Field level security based on the value of another field in the document](https://discuss.elastic.co/t/field-level-security-based-on-the-value-of-another-field-in-the-document/315356)
**Author:** [@Ram\_Rana](https://discuss.elastic.co/u/Ram_Rana)\ **Replies:** 4\ **Last updated:** [October 4, 2022, 5:58am UTC](https://discuss.elastic.co/t/field-level-security-based-on-the-value-of-another-field-in-the-document/315356 "2022-10-04T05:58:46Z")
We have one use case where we need to put some field level security based on another field in the document. We have some documents, each document contain one field called type and based on that type we want to put restr… --- ## [How does the GET API function internally in real time?](https://discuss.elastic.co/t/how-does-the-get-api-function-internally-in-real-time/315734)
**Author:** [@bhavya](https://discuss.elastic.co/u/bhavya)\ **Replies:** 0\ **Last updated:** [October 4, 2022, 5:54am UTC](https://discuss.elastic.co/t/how-does-the-get-api-function-internally-in-real-time/315734 "2022-10-04T05:54:46Z")
Under the hood of the most recent operation, Elasticsearch records the value of the \_version meta field, primary term, and sequence number. We may use the GET API to obtain these meta field values and add them to the sea… --- ## [Elasticsearch do not shows passwords and token when start](https://discuss.elastic.co/t/elasticsearch-do-not-shows-passwords-and-token-when-start/315338)
**Author:** [@Kostyantyn\_Dobriohlo](https://discuss.elastic.co/u/Kostyantyn_Dobriohlo)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 5:41am UTC](https://discuss.elastic.co/t/elasticsearch-do-not-shows-passwords-and-token-when-start/315338 "2022-10-04T05:41:14Z")
I am starting ELK with enabled xpack.security, and as I know elasticsearch shoud display passwords, enrollment token for kibana and other nodes and sha fingerprint. But there is no such information in logs. I am sure of … --- ## [Writing to two data streams](https://discuss.elastic.co/t/writing-to-two-data-streams/315493)
**Author:** [@Ulrik](https://discuss.elastic.co/u/Ulrik)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 5:19am UTC](https://discuss.elastic.co/t/writing-to-two-data-streams/315493 "2022-10-04T05:19:02Z")
We are collecting logs and uses fleet with agents. I would like to configure some agents to write data in two data streams instead of just one. As far as I can understand you specify the data stream to use in the integ… --- ## [503 Service Unavailable in Docker kibana (ELK Stack)](https://discuss.elastic.co/t/503-service-unavailable-in-docker-kibana-elk-stack/315268)
**Author:** [@MdRashid](https://discuss.elastic.co/u/MdRashid)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 5:17am UTC](https://discuss.elastic.co/t/503-service-unavailable-in-docker-kibana-elk-stack/315268 "2022-10-04T05:17:26Z")
Hi, Need help not able to access kibana in browser All container is running kibana, elasticsearch and logstash as ELK Stack docker logs KIBANA-CONTAINER {"type":"log","@timestamp":"2022-09-27T13:52:24Z","tags":\["info… --- ## [Different ILM-Policies for "some" Elastic Agents](https://discuss.elastic.co/t/different-ilm-policies-for-some-elastic-agents/315348)
**Author:** [@BoKu](https://discuss.elastic.co/u/BoKu)\ **Replies:** 0\ **Last updated:** [September 28, 2022, 9:55am UTC](https://discuss.elastic.co/t/different-ilm-policies-for-some-elastic-agents/315348 "2022-09-28T09:55:32Z")
Hello there, let's say i do have an Department Networking. Their servers get an elastic-agent, like every other non-networking server, but this Department wants to delete their logs after less days then any other depart… --- ## [Watcher webhook issue with call include triple double quote](https://discuss.elastic.co/t/watcher-webhook-issue-with-call-include-triple-double-quote/315387)
**Author:** [@JohnJ\_M](https://discuss.elastic.co/u/JohnJ_M)\ **Replies:** 0\ **Last updated:** [September 28, 2022, 3:43pm UTC](https://discuss.elastic.co/t/watcher-webhook-issue-with-call-include-triple-double-quote/315387 "2022-09-28T15:43:03Z")
I am working on a watcher that create watcher depending an index. I use for that a weebhook call in the watcher. Problem: the webhook call need the use of """ for the body part: "webhook": { "scheme": "h… --- ## [Problem with integration fleet server](https://discuss.elastic.co/t/problem-with-integration-fleet-server/315433)
**Author:** [@sultan2224](https://discuss.elastic.co/u/sultan2224)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 5:13am UTC](https://discuss.elastic.co/t/problem-with-integration-fleet-server/315433 "2022-10-04T05:13:22Z")
problem with integration fleet server and I can't take logs --- ## [Snapshot and Restore from kibana](https://discuss.elastic.co/t/snapshot-and-restore-from-kibana/315432)
**Author:** [@Rakhshunda\_Noorein\_J](https://discuss.elastic.co/u/Rakhshunda_Noorein_J)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 5:12am UTC](https://discuss.elastic.co/t/snapshot-and-restore-from-kibana/315432 "2022-10-04T05:12:47Z")
Hello, I am restoring snapshots from 1 cluster to another cluster. I took a snapshot from 1 cluster including indices and global state and then restore that snapshot to another cluster. Both the clusters sharing the sa… --- ## [Update All by changing data of a field using a function](https://discuss.elastic.co/t/update-all-by-changing-data-of-a-field-using-a-function/315476)
**Author:** [@sadiki-dev](https://discuss.elastic.co/u/sadiki-dev)\ **Replies:** 0\ **Last updated:** [September 29, 2022, 4:05pm UTC](https://discuss.elastic.co/t/update-all-by-changing-data-of-a-field-using-a-function/315476 "2022-09-29T16:05:49Z")
I have some data in an index for example called products. the data stored has structure like this : \[ { "name" : " product A ", "price": 1000, "quantity": 10 }, { "name" : " product B ", "price": 2000, "qua… --- ## [Error create snapshot and restore](https://discuss.elastic.co/t/error-create-snapshot-and-restore/315498)
**Author:** [@user\_redes](https://discuss.elastic.co/u/user_redes)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 5:09am UTC](https://discuss.elastic.co/t/error-create-snapshot-and-restore/315498 "2022-10-04T05:09:59Z")
Hello, I'm trying to create a repository using AWS S3 but I'm getting some errors when performing Verification Status: { "name": "ResponseError", "meta": { "body": { "error": { "root\_cause": \[ { "type": "reposi… --- ## [Use Elastic APM without search.allow\_expensive\_queries config](https://discuss.elastic.co/t/use-elastic-apm-without-search-allow-expensive-queries-config/315499)
**Author:** [@Leonardo\_Henrique](https://discuss.elastic.co/u/Leonardo_Henrique)\ **Replies:** 0\ **Last updated:** [September 29, 2022, 7:58pm UTC](https://discuss.elastic.co/t/use-elastic-apm-without-search-allow-expensive-queries-config/315499 "2022-09-29T19:58:46Z")
Hello, everyone! How have you been? I recently updated a Elastic cluster from 7.9.3 to 8.3.2 (intermediate upgrade to 7.17.5). When I updated the APM Server to 8.3.2 I got the error referred to the APM Integration not … --- ## [How to restore security snapshots?](https://discuss.elastic.co/t/how-to-restore-security-snapshots/315636)
**Author:** [@Siavash\_Fazli](https://discuss.elastic.co/u/Siavash_Fazli)\ **Replies:** 0\ **Last updated:** [October 2, 2022, 2:52pm UTC](https://discuss.elastic.co/t/how-to-restore-security-snapshots/315636 "2022-10-02T14:52:52Z")
Hi Guys. I upgraded my ELK stack version 7.16.2 to 8.4.2. I need to restore my security settings (users, roles,...) In the last step of restoring I got this message: Unable to restore snapshot \[es.sec\_daily\_2022.09.… --- ## [Monthly rolling index with custom routing](https://discuss.elastic.co/t/monthly-rolling-index-with-custom-routing/315706)
**Author:** [@PV2000](https://discuss.elastic.co/u/PV2000)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 5:02am UTC](https://discuss.elastic.co/t/monthly-rolling-index-with-custom-routing/315706 "2022-10-04T05:02:55Z")
Hi, I am trying to figure out the how to create a monthly rolling index with custom routing (multi-tenancy scenario) , with these requirements : WRITE flow : Each document will have a timestamp and the document shoul… --- ## [Got error in elastic search](https://discuss.elastic.co/t/got-error-in-elastic-search/315718)
**Author:** [@Rahul1300](https://discuss.elastic.co/u/Rahul1300)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 5:01am UTC](https://discuss.elastic.co/t/got-error-in-elastic-search/315718 "2022-10-04T05:01:09Z")
i started new cluster i got this error plz help me to resolve this address \[127.0.0.1:9302\], node \[null\], requesting \[false\] discovery result: \[127.0.0.1:9302\] connect\_exception: Connection refused: /127.0.0.1:9302: Con… --- ## [Renaming Nodes and Clusters in Elastic Cloud](https://discuss.elastic.co/t/renaming-nodes-and-clusters-in-elastic-cloud/315729)
**Author:** [@mpky](https://discuss.elastic.co/u/mpky)\ **Replies:** 4\ **Last updated:** [October 4, 2022, 4:59am UTC](https://discuss.elastic.co/t/renaming-nodes-and-clusters-in-elastic-cloud/315729 "2022-10-04T04:59:05Z")
How do you go about renaming nodes and clusters in Elastic Cloud since there is no YML file to edit? I tried in the deployment settings but was getting errors and am wondering if there's a way to do this in Dev Tools? --- ## [Primary term and sequence number VS \_version meta field](https://discuss.elastic.co/t/primary-term-and-sequence-number-vs-version-meta-field/315733)
**Author:** [@bhavya](https://discuss.elastic.co/u/bhavya)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 4:58am UTC](https://discuss.elastic.co/t/primary-term-and-sequence-number-vs-version-meta-field/315733 "2022-10-04T04:58:50Z")
Consider that there are three primary shards in my index. For indexing and update requests, the primary shards are used. Elasticsearch can distribute incoming requests (such as massive bulk requests) to various primary s… --- ## [Nested Aggregation with AND always return 0 match](https://discuss.elastic.co/t/nested-aggregation-with-and-always-return-0-match/315722)
**Author:** [@chattes](https://discuss.elastic.co/u/chattes)\ **Replies:** 3\ **Last updated:** [October 4, 2022, 1:26am UTC](https://discuss.elastic.co/t/nested-aggregation-with-and-always-return-0-match/315722 "2022-10-04T01:26:03Z")
Mapping { "example-profiles" : { "mappings" : { "dynamic" : "false", "properties" : { "organization" : { "properties" : { "enabled" : { "type" : "boolean" … --- ## [Java client put logstash pipeline last\_modified error](https://discuss.elastic.co/t/java-client-put-logstash-pipeline-last-modified-error/313425)
**Author:** [@Alain\_Bod](https://discuss.elastic.co/u/Alain_Bod)\ **Replies:** 5\ **Last updated:** [October 3, 2022, 8:39pm UTC](https://discuss.elastic.co/t/java-client-put-logstash-pipeline-last-modified-error/313425 "2022-10-03T20:39:33Z")
Hi, I'm using the new Java elasticsearch client to PUT a logstash pipeline (client version 8.4.1, server 8.4.1) client.logstash().putPipeline(b -\> b .id(id) .pipeline(p -\>… --- ## [Unable to use msearch with curl](https://discuss.elastic.co/t/unable-to-use-msearch-with-curl/315713)
**Author:** [@Guilherme\_Mello](https://discuss.elastic.co/u/Guilherme_Mello)\ **Replies:** 4\ **Last updated:** [October 3, 2022, 8:25pm UTC](https://discuss.elastic.co/t/unable-to-use-msearch-with-curl/315713 "2022-10-03T20:25:59Z")
I'm trying to use \_msearch like this: curl -XGET "https://host.com/index/\_msearch" -H "Content-Type: application/json" -d' { } {"query" : {"match" : { "title": "vestido"}}, "from":0,"size":2 } ' But I get t… --- ## [Docker-compose: Switching from environment variables to kibana.yml fails during preboot stage](https://discuss.elastic.co/t/docker-compose-switching-from-environment-variables-to-kibana-yml-fails-during-preboot-stage/315674)
**Author:** [@Malec](https://discuss.elastic.co/u/Malec)\ **Replies:** 1\ **Last updated:** [October 3, 2022, 8:00pm UTC](https://discuss.elastic.co/t/docker-compose-switching-from-environment-variables-to-kibana-yml-fails-during-preboot-stage/315674 "2022-10-03T20:00:23Z")
Hi everyone, I have been using the docker-compose file for a while now and it works quite well, but I needed to add some advanced authentication methods (anonymous + basic). So I tried switching to kibana.yml and to vol… --- ## [Getting two intervals in the result for fixed\_interval](https://discuss.elastic.co/t/getting-two-intervals-in-the-result-for-fixed-interval/314754)
**Author:** [@Divin](https://discuss.elastic.co/u/Divin)\ **Replies:** 7\ **Last updated:** [October 3, 2022, 6:05pm UTC](https://discuss.elastic.co/t/getting-two-intervals-in-the-result-for-fixed-interval/314754 "2022-10-03T18:05:22Z")
I have an ES query that search for 2 set of strings and calculating percentage based on the results of the match. This is expected to have work on fixed\_interval \[5 min\]on date histogram. But when I am getting the result… --- ## [Upgrade from ELK 7.7.1 to ELK 8.4.1](https://discuss.elastic.co/t/upgrade-from-elk-7-7-1-to-elk-8-4-1/315423)
**Author:** [@Ravi\_S1](https://discuss.elastic.co/u/Ravi_S1)\ **Replies:** 3\ **Last updated:** [October 3, 2022, 5:46pm UTC](https://discuss.elastic.co/t/upgrade-from-elk-7-7-1-to-elk-8-4-1/315423 "2022-10-03T17:46:24Z")
I upgraded recently ELK 7.7.1 to ELK 8.4.1. I am looking out the logs of ELK 8.4.1, finds the below logs. Is there any view point from these logs. {"@timestamp":"2022-09-15T16:17:36.167Z", "log.level": "WARN", "message… --- ## [Update By Query - status counts do not add up to total](https://discuss.elastic.co/t/update-by-query-status-counts-do-not-add-up-to-total/315709)
**Author:** [@BobH](https://discuss.elastic.co/u/BobH)\ **Replies:** 0\ **Last updated:** [October 3, 2022, 5:15pm UTC](https://discuss.elastic.co/t/update-by-query-status-counts-do-not-add-up-to-total/315709 "2022-10-03T17:15:44Z")
I'm running ES 7.17.3 with an index with 2.1M documents. I executed an update-by-query request with a script to clean up some data (there was no query, so it ran against all documents in the index). The script sets ctx.o… --- ## [Monitor specific AWS Cloudwatch log\_stream](https://discuss.elastic.co/t/monitor-specific-aws-cloudwatch-log-stream/315395)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 0\ **Last updated:** [September 28, 2022, 5:35pm UTC](https://discuss.elastic.co/t/monitor-specific-aws-cloudwatch-log-stream/315395 "2022-09-28T17:35:19Z")
I'm using a Fleet-managed Elastic Agent with the AWS Custom Log integration to monitor logs from Cloudwatch. My configuration in Fleet generates the following in the policy: - id: aws-cloudwatch-aws\_logs-334607ab-b4fe-4… --- ## [Log events not being recognized as separate events in Microsoft SQL Server Integration](https://discuss.elastic.co/t/log-events-not-being-recognized-as-separate-events-in-microsoft-sql-server-integration/315707)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 0\ **Last updated:** [October 3, 2022, 5:08pm UTC](https://discuss.elastic.co/t/log-events-not-being-recognized-as-separate-events-in-microsoft-sql-server-integration/315707 "2022-10-03T17:08:19Z")
I am using the Microsoft SQL Server Integration, v1.4.0 with a fleet-managed policy running on Elastic Agent 8.4.2. I am noticing two things. First, even with "Preserve original event" set to false, the SQL Server error … --- ## [CSV Filter - Backslash double quote parse failure](https://discuss.elastic.co/t/csv-filter-backslash-double-quote-parse-failure/315703)
**Author:** [@Michele\_De\_Benedet](https://discuss.elastic.co/u/Michele_De_Benedet)\ **Replies:** 1\ **Last updated:** [October 3, 2022, 4:54pm UTC](https://discuss.elastic.co/t/csv-filter-backslash-double-quote-parse-failure/315703 "2022-10-03T16:54:07Z")
Hi, I am using version 7.12.0 I'm parsing a csv which looks like this: colA;colB;colC x;"hello \\"world\\" ";0 y;"hello world";1 I cannot parse the x row because I get the following: Error parsing csv {:field=\>"messag… --- ## [Beats on multiple Cloud environments](https://discuss.elastic.co/t/beats-on-multiple-cloud-environments/314887)
**Author:** [@lcui\_dxc](https://discuss.elastic.co/u/lcui_dxc)\ **Replies:** 2\ **Last updated:** [October 3, 2022, 4:53pm UTC](https://discuss.elastic.co/t/beats-on-multiple-cloud-environments/314887 "2022-10-03T16:53:29Z")
Hello there" Working on a task to setup Elastic Cloud on AWS and some of the beats (meticbeat, heartbeat, filebeat, and packetbeat) are on AWS some of the beats need to be on Azure and GCP. In this situation,should we p… --- ## [Elasticsearch certificate error when access with public ip](https://discuss.elastic.co/t/elasticsearch-certificate-error-when-access-with-public-ip/315213)
**Author:** [@jay.annapureddy](https://discuss.elastic.co/u/jay.annapureddy)\ **Replies:** 13\ **Last updated:** [October 3, 2022, 4:26pm UTC](https://discuss.elastic.co/t/elasticsearch-certificate-error-when-access-with-public-ip/315213 "2022-10-03T16:26:49Z")
Hi, Problem: Elasticsearch cluster url having a certificate error, needed this to configure on beats on other vm. I am experimenting it on Azure VM with ubuntu operating system. Followed this official guide to install… --- ## [Split the Field values by comma](https://discuss.elastic.co/t/split-the-field-values-by-comma/315673)
**Author:** [@Maruthappan\_Muthu](https://discuss.elastic.co/u/Maruthappan_Muthu)\ **Replies:** 1\ **Last updated:** [October 3, 2022, 4:06pm UTC](https://discuss.elastic.co/t/split-the-field-values-by-comma/315673 "2022-10-03T16:06:23Z")
My field contains multiple values, which separated by comma. How can I split the each comma separated values and put on the same filed name. Ex. The consider the below field and values, SerialNumber =\> \[abc23, cde56, … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=774) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=776)