# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=798 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 799 --- ## [Best way to reindex text to keyword](https://discuss.elastic.co/t/best-way-to-reindex-text-to-keyword/314119)
**Author:** [@Mark\_S](https://discuss.elastic.co/u/Mark_S)\ **Replies:** 2\ **Last updated:** [September 12, 2022, 6:35am UTC](https://discuss.elastic.co/t/best-way-to-reindex-text-to-keyword/314119 "2022-09-12T06:35:20Z")
I want to re-index a text field to keyword. I have multiple indices (myindex-000001, myindex-000002, etc) In order to reindex I must: a) get the mapping b) create a new index mynewindex-000001 same field name but diffe… --- ## [How get the \_source data when the \_source is disabled?](https://discuss.elastic.co/t/how-get-the-source-data-when-the-source-is-disabled/314160)
**Author:** [@Sarthak\_Agarwal](https://discuss.elastic.co/u/Sarthak_Agarwal)\ **Replies:** 2\ **Last updated:** [September 12, 2022, 6:07am UTC](https://discuss.elastic.co/t/how-get-the-source-data-when-the-source-is-disabled/314160 "2022-09-12T06:07:47Z")
I have one index whose \_source is disabled. Now I want to migrate data from this index to a different elasticsearch cluster ? The issue is I only get metadata fields while searching. How can I retrieve and transfer \_sour… --- ## [Filebeat output to file](https://discuss.elastic.co/t/filebeat-output-to-file/314135)
**Author:** [@sriramb12](https://discuss.elastic.co/u/sriramb12)\ **Replies:** 17\ **Last updated:** [September 12, 2022, 2:58am UTC](https://discuss.elastic.co/t/filebeat-output-to-file/314135 "2022-09-12T02:58:16Z")
New to the filebeat and to elastic. I need to fetch o365 logs from azure tenant. I dont want to use ELK stack but just get the json files I configured /etc/filebeat/modules.d/o365.yml also file output under /etc/file… --- ## [How to switch between multiple ES cluster from local kibana](https://discuss.elastic.co/t/how-to-switch-between-multiple-es-cluster-from-local-kibana/314081)
**Author:** [@pkv1982](https://discuss.elastic.co/u/pkv1982)\ **Replies:** 2\ **Last updated:** [September 12, 2022, 2:35am UTC](https://discuss.elastic.co/t/how-to-switch-between-multiple-es-cluster-from-local-kibana/314081 "2022-09-12T02:35:27Z")
is there a way to switch between multiple remote ES cluster from my local kibana? any documentation would be helpful. --- ## [ICU Analysis Plugin doesn't normalize some characters like other languages(PHP, Python)](https://discuss.elastic.co/t/icu-analysis-plugin-doesnt-normalize-some-characters-like-other-languages-php-python/314155)
**Author:** [@mictsai](https://discuss.elastic.co/u/mictsai)\ **Replies:** 0\ **Last updated:** [September 12, 2022, 2:15am UTC](https://discuss.elastic.co/t/icu-analysis-plugin-doesnt-normalize-some-characters-like-other-languages-php-python/314155 "2022-09-12T02:15:43Z")
Elasticsearch version: 7.10.1 Installed plugins: \[analysis-icu, analysis-kuromoji, analysis-nori\] 그래비티 and 그래비티 looks the same. When encoding to URL, 그래비티 is %EA%B7%B8%EB%9E%98%EB%B9%84%ED%8B%B0%20 and 그래비티 is … --- ## [Can we have 800 synonym in single synonym.txt file](https://discuss.elastic.co/t/can-we-have-800-synonym-in-single-synonym-txt-file/314150)
**Author:** [@pavithra\_arul](https://discuss.elastic.co/u/pavithra_arul)\ **Replies:** 1\ **Last updated:** [September 12, 2022, 1:52am UTC](https://discuss.elastic.co/t/can-we-have-800-synonym-in-single-synonym-txt-file/314150 "2022-09-12T01:52:34Z")
Hi Team, Need help Urgent ! I'm trying to add 800 synonym via synonym.txt file in elasticsearch. file got uploaded to server but results are not getting fetched. PFB for the seetings and mapping PUT synonym\_sample\_upd… --- ## [Scripts for fix unassigned shards](https://discuss.elastic.co/t/scripts-for-fix-unassigned-shards/314019)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 6\ **Last updated:** [September 12, 2022, 1:20am UTC](https://discuss.elastic.co/t/scripts-for-fix-unassigned-shards/314019 "2022-09-12T01:20:30Z")
Hello Can You point me out what's wrong in below short script #!/bin/bash NODE="es\_data\_1" IFS=$'\\n' for line in $(curl -u elastic:pass 'http://10.220.111.200:9200/\_cat/shards' | fgrep UNASSIGNED); do INDEX=$(echo $l… --- ## [Grok date filter problem with french timestamp](https://discuss.elastic.co/t/grok-date-filter-problem-with-french-timestamp/314151)
**Author:** [@marwen](https://discuss.elastic.co/u/marwen)\ **Replies:** 4\ **Last updated:** [September 12, 2022, 12:13am UTC](https://discuss.elastic.co/t/grok-date-filter-problem-with-french-timestamp/314151 "2022-09-12T00:13:15Z")
good day everyone, using elastic stack 17.7.5 I'm parsing log events to logstash the problem is date filter not working with my logs (catalina) here is example: avr. 23, 2022 1:46:19 PM org.apache.coyote.AbstractProtoc… --- ## [How can we provide and configure our own certificate which is in .crt ( base64 ) format](https://discuss.elastic.co/t/how-can-we-provide-and-configure-our-own-certificate-which-is-in-crt-base64-format/314073)
**Author:** [@nikhil\_earni](https://discuss.elastic.co/u/nikhil_earni)\ **Replies:** 1\ **Last updated:** [September 11, 2022, 11:53pm UTC](https://discuss.elastic.co/t/how-can-we-provide-and-configure-our-own-certificate-which-is-in-crt-base64-format/314073 "2022-09-11T23:53:57Z")
I am building the Elasticsearch from scratch. I changed the passkey using the below lines.... /bin/elasticsearch-keystore add xpack.security.http.ssl.keystore.secure\_password /bin/elasticsearch-keystore add xpack.secu… --- ## [Calcul producing a negative result](https://discuss.elastic.co/t/calcul-producing-a-negative-result/314141)
**Author:** [@hnf](https://discuss.elastic.co/u/hnf)\ **Replies:** 3\ **Last updated:** [September 11, 2022, 11:47pm UTC](https://discuss.elastic.co/t/calcul-producing-a-negative-result/314141 "2022-09-11T23:47:43Z")
Hello Everyone. I'm facing to a negative value while calculting a value from a field. After creating the index, I add a new field using the path Data Views -\> "index\_name" in Kibana and set value for this new field lik… --- ## [Missing authentication credentials for REST request](https://discuss.elastic.co/t/missing-authentication-credentials-for-rest-request/313588)
**Author:** [@Sher\_Khan](https://discuss.elastic.co/u/Sher_Khan)\ **Replies:** 29\ **Last updated:** [September 11, 2022, 6:19pm UTC](https://discuss.elastic.co/t/missing-authentication-credentials-for-rest-request/313588 "2022-09-11T18:19:34Z")
Hi, I'm new to ELK Stack. So far I have configured \[Elasticsearch - Kibana - Logstash\] but the Filebeat configuration is causing issues. Note: All four services are running fine When I run the following command \ s… --- ## [Disable adding match\_field when enriching data in ingest pipeline?](https://discuss.elastic.co/t/disable-adding-match-field-when-enriching-data-in-ingest-pipeline/314132)
**Author:** [@lubosvr](https://discuss.elastic.co/u/lubosvr)\ **Replies:** 1\ **Last updated:** [September 11, 2022, 3:06pm UTC](https://discuss.elastic.co/t/disable-adding-match-field-when-enriching-data-in-ingest-pipeline/314132 "2022-09-11T15:06:50Z")
I'm trying to use reindex with help of ingest pipeline to enrich my data. I have problem with enrich processor. I have created this policy PUT /\_enrich/policy/ingest-policy { "match": { "indices": "ingest\_two", … --- ## [Adding Leading Zeros To Lens Metric](https://discuss.elastic.co/t/adding-leading-zeros-to-lens-metric/313210)
**Author:** [@rblob](https://discuss.elastic.co/u/rblob)\ **Replies:** 7\ **Last updated:** [September 11, 2022, 1:55pm UTC](https://discuss.elastic.co/t/adding-leading-zeros-to-lens-metric/313210 "2022-09-11T13:55:08Z")
Could anyone enlighten me as to whether it is possible to add leading zeros to the Metric Visualisation? I am trying to get the count of all records from a specific query and I would like to add zeros before that value … --- ## [Add life cycle policy on metricbeat indices](https://discuss.elastic.co/t/add-life-cycle-policy-on-metricbeat-indices/313905)
**Author:** [@Idan\_Ahal](https://discuss.elastic.co/u/Idan_Ahal)\ **Replies:** 4\ **Last updated:** [September 11, 2022, 10:53am UTC](https://discuss.elastic.co/t/add-life-cycle-policy-on-metricbeat-indices/313905 "2022-09-11T10:53:45Z")
I'm trying to add a life cycle policy to my indices through Kibana. I created an index template and a lifecycle policy but I get this error: setting \[index.lifecycle.rollover\_alias\] for index \[jobmetrics-preprod-2022.09.… --- ## [Heartbeat auto discover not working](https://discuss.elastic.co/t/heartbeat-auto-discover-not-working/314136)
**Author:** [@sanjaychahar](https://discuss.elastic.co/u/sanjaychahar)\ **Replies:** 0\ **Last updated:** [September 11, 2022, 10:45am UTC](https://discuss.elastic.co/t/heartbeat-auto-discover-not-working/314136 "2022-09-11T10:45:46Z")
Hello everyone I have recently deploy heartbeat 7.16.3 in my k8s cluster and after deployment I am not able see heartbeat.autodiscover config inside pod config yaml but its there in my deployment yaml file. Can you ple… --- ## [How to solve issue when change type from log to filestream in filebeat and duplication?](https://discuss.elastic.co/t/how-to-solve-issue-when-change-type-from-log-to-filestream-in-filebeat-and-duplication/314133)
**Author:** [@alex\_petrov](https://discuss.elastic.co/u/alex_petrov)\ **Replies:** 0\ **Last updated:** [September 11, 2022, 9:19am UTC](https://discuss.elastic.co/t/how-to-solve-issue-when-change-type-from-log-to-filestream-in-filebeat-and-duplication/314133 "2022-09-11T09:19:17Z")
filestream ,the successor of log input, is now generally available in Filebeat and the version I use is 7.15. I have a single active log and I am using log as input type in filebeat.yml .and I found it is better to chang… --- ## [New install Metricbeat failing to run setup](https://discuss.elastic.co/t/new-install-metricbeat-failing-to-run-setup/314127)
**Author:** [@alexsamad](https://discuss.elastic.co/u/alexsamad)\ **Replies:** 2\ **Last updated:** [September 11, 2022, 5:55am UTC](https://discuss.elastic.co/t/new-install-metricbeat-failing-to-run-setup/314127 "2022-09-11T05:55:19Z")
Hi got a new install, looking at metricbeat, I have it monitoring the ELK cluster, but I want the system plugin to work. I noticed the dashboards where missing so I tried metricbeat setup --dashboards --index-manageme… --- ## [Create an alert on a process\\service that stopped running](https://discuss.elastic.co/t/create-an-alert-on-a-process-service-that-stopped-running/314125)
**Author:** [@Mor123460](https://discuss.elastic.co/u/Mor123460)\ **Replies:** 0\ **Last updated:** [September 10, 2022, 9:24pm UTC](https://discuss.elastic.co/t/create-an-alert-on-a-process-service-that-stopped-running/314125 "2022-09-10T21:24:51Z")
Hey. As i understand, there isn't a log created when a process stop running, because it's simply disappearing. So, how can i create an alert on a log with specific command line that stopped arriving from a metricbeat? … --- ## [How to grok those multiline log syntax?](https://discuss.elastic.co/t/how-to-grok-those-multiline-log-syntax/314118)
**Author:** [@cowderwelsh](https://discuss.elastic.co/u/cowderwelsh)\ **Replies:** 2\ **Last updated:** [September 10, 2022, 7:33pm UTC](https://discuss.elastic.co/t/how-to-grok-those-multiline-log-syntax/314118 "2022-09-10T19:33:02Z")
Hi, I'm new to Elastic and after creating my first pipeline, I'm now trying to process a simple, local multiline Firewall log, it looks like this: Time: 01/28/2022 01:27:22 Event: Traffic IP-Address: 20.199.120.85 … --- ## [Subtract timestamps from logs basis a field and show as a view on dashboard](https://discuss.elastic.co/t/subtract-timestamps-from-logs-basis-a-field-and-show-as-a-view-on-dashboard/314116)
**Author:** [@Murali\_Y](https://discuss.elastic.co/u/Murali_Y)\ **Replies:** 1\ **Last updated:** [September 10, 2022, 7:25pm UTC](https://discuss.elastic.co/t/subtract-timestamps-from-logs-basis-a-field-and-show-as-a-view-on-dashboard/314116 "2022-09-10T19:25:48Z")
Hello all, My logs are having below 2 entries: @timestamp:Sep 10, 2022 @ 20:11:42.677 fingerprint:2222-605819443b6 Item\_Name:069931601477 jobId:4444-ff-4555 level:Info levelOrdinal:2 logF\_BusinessProcessName:Test logTy… --- ## [Kibana dashboard vs discover (top 5 values)](https://discuss.elastic.co/t/kibana-dashboard-vs-discover-top-5-values/314072)
**Author:** [@Mark\_S](https://discuss.elastic.co/u/Mark_S)\ **Replies:** 2\ **Last updated:** [September 10, 2022, 4:38pm UTC](https://discuss.elastic.co/t/kibana-dashboard-vs-discover-top-5-values/314072 "2022-09-10T16:38:35Z")
When using the "discover" mode, I hover over a text field and I can easily see the top 5 values. However when trying to create a dashboard showing exactly the same thing, I cannot find a way to do so since "a text field… --- ## [Error parsing csv](https://discuss.elastic.co/t/error-parsing-csv/314099)
**Author:** [@manuel.urbano](https://discuss.elastic.co/u/manuel.urbano)\ **Replies:** 11\ **Last updated:** [September 10, 2022, 4:06pm UTC](https://discuss.elastic.co/t/error-parsing-csv/314099 "2022-09-10T16:06:35Z")
Hi, I'm reading a CSV file and sending it to Elasticsearch, everything works fine but some rows are throwing an exception: Error parsing csv {:field=\>"message", :source=\>"6123464a-420f-4838-8ecb-fcce87f16297;20878376219… --- ## [Query to return documents with id not in a list](https://discuss.elastic.co/t/query-to-return-documents-with-id-not-in-a-list/314114)
**Author:** [@Ivo\_Tavares](https://discuss.elastic.co/u/Ivo_Tavares)\ **Replies:** 0\ **Last updated:** [September 10, 2022, 2:15pm UTC](https://discuss.elastic.co/t/query-to-return-documents-with-id-not-in-a-list/314114 "2022-09-10T14:15:28Z")
I'm trying to create a query, but I don't want the query to return documents which have already been fetched in a previous query. Here's the JSON {'query': {'bool': {'filter': \[{'term': {'tag': 'name'}}, {'bool': {… --- ## [KQL problem in Kibana APM log](https://discuss.elastic.co/t/kql-problem-in-kibana-apm-log/313751)
**Author:** [@menoen](https://discuss.elastic.co/u/menoen)\ **Replies:** 2\ **Last updated:** [September 10, 2022, 3:05pm UTC](https://discuss.elastic.co/t/kql-problem-in-kibana-apm-log/313751 "2022-09-10T15:05:26Z")
Hi Team, I am using Elastic Cloud and APM, and after sending transactions and spans to APM, the "timeline" and "metadata" shows correctly, but the "log" couldn't show correctly. I wonder if there is a way to set it to c… --- ## [INSTALL ELASTALERT in ubuntu 22.04](https://discuss.elastic.co/t/install-elastalert-in-ubuntu-22-04/314110)
**Author:** [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\ **Replies:** 1\ **Last updated:** [September 10, 2022, 12:14pm UTC](https://discuss.elastic.co/t/install-elastalert-in-ubuntu-22-04/314110 "2022-09-10T12:14:34Z")
How to install INSTALL ELASTALERT in ubuntu 22.04 ? i will just use this cmd : sudo apt install elastalert or i will install also python3 and .... --- ## [Indexing html as raw content](https://discuss.elastic.co/t/indexing-html-as-raw-content/313990)
**Author:** [@pcyber](https://discuss.elastic.co/u/pcyber)\ **Replies:** 2\ **Last updated:** [September 10, 2022, 10:28am UTC](https://discuss.elastic.co/t/indexing-html-as-raw-content/313990 "2022-09-10T10:28:45Z")
hi folks, i´m realy new to Elasticsearch and trying to use it for my project. what i want to to in simple form: get html source from website with python push the source to Elasticsearch make it searchable so i´m get… --- ## [Container is unhealthy. Encountered errors while bringing up the project](https://discuss.elastic.co/t/container-is-unhealthy-encountered-errors-while-bringing-up-the-project/314084)
**Author:** [@Boodle](https://discuss.elastic.co/u/Boodle)\ **Replies:** 0\ **Last updated:** [September 9, 2022, 7:29pm UTC](https://discuss.elastic.co/t/container-is-unhealthy-encountered-errors-while-bringing-up-the-project/314084 "2022-09-09T19:29:39Z")
Upgraded Elasticsearch from 7.10.1 to 7.17.6 by changing the version number in .env files. environment is a 3 node cluster (es01, es02, es03) on the same server and 1 kibana kib01 on it. Running the sudo docker-compos… --- ## [Install Fleet Server on same machine as Elasticstack](https://discuss.elastic.co/t/install-fleet-server-on-same-machine-as-elasticstack/314094)
**Author:** [@Hardik\_Sanghavi](https://discuss.elastic.co/u/Hardik_Sanghavi)\ **Replies:** 0\ **Last updated:** [September 9, 2022, 8:49pm UTC](https://discuss.elastic.co/t/install-fleet-server-on-same-machine-as-elasticstack/314094 "2022-09-09T20:49:25Z")
I have installed Elasticsearch 8.1.3 and Kibana on an Ubuntu machine and has been running for a while. I wanted to add Fleet Server to the same machine but when I follow the steps here, it says elastic agent is already … --- ## [\[Kibana timelion\] Error in the continuation of the trend in the future (fit function)](https://discuss.elastic.co/t/kibana-timelion-error-in-the-continuation-of-the-trend-in-the-future-fit-function/313968)
**Author:** [@daniele.saccon](https://discuss.elastic.co/u/daniele.saccon)\ **Replies:** 1\ **Last updated:** [September 9, 2022, 8:32pm UTC](https://discuss.elastic.co/t/kibana-timelion-error-in-the-continuation-of-the-trend-in-the-future-fit-function/313968 "2022-09-09T20:32:04Z")
Hi, I am trying to create a timelion chart with the aim of plotting the trend over time of my size field. I would like the line to continue in the future with the latest available data after today's date. I am using v… --- ## [Saving document selection on table in dashboard session](https://discuss.elastic.co/t/saving-document-selection-on-table-in-dashboard-session/314067)
**Author:** [@Mike42](https://discuss.elastic.co/u/Mike42)\ **Replies:** 1\ **Last updated:** [September 9, 2022, 7:55pm UTC](https://discuss.elastic.co/t/saving-document-selection-on-table-in-dashboard-session/314067 "2022-09-09T19:55:26Z")
Hi, into a dashboard I included a table to list filtered documents. Well, this works as expected. I could also save my filters in a session, and further show just selected documents in a table (part of a dashboard), perf… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=797) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=799)