# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=857 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 858 --- ## [Adding data after csv filter from rest api using http filter](https://discuss.elastic.co/t/adding-data-after-csv-filter-from-rest-api-using-http-filter/310241)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 0\ **Last updated:** [July 21, 2022, 7:05am UTC](https://discuss.elastic.co/t/adding-data-after-csv-filter-from-rest-api-using-http-filter/310241 "2022-07-21T07:05:56Z")
Hello, i have 2 file: csv and json. i wanted to read the json file to get access token. here is my config: input { # Open csv from path file{ path =\>\["/some/path/log/\*.csv"\] } } filter{ # Parse csv input … --- ## [Winlogbeat data missing](https://discuss.elastic.co/t/winlogbeat-data-missing/310148)
**Author:** [@HTM](https://discuss.elastic.co/u/HTM)\ **Replies:** 5\ **Last updated:** [July 21, 2022, 6:05am UTC](https://discuss.elastic.co/t/winlogbeat-data-missing/310148 "2022-07-21T06:05:44Z")
Hi All, New Elastic user here:) My setup: Ubuntu 22.04 LTS Server, running ELK Stack. My kibana.yml: My Elasticsearch.yml: I Have added our Sophos firewall using the Sophos Filebeat module. I can read a… --- ## [How to send realtime data from csv file to elastiksearch using logstash? How to write logstash.conf file for this task.?](https://discuss.elastic.co/t/how-to-send-realtime-data-from-csv-file-to-elastiksearch-using-logstash-how-to-write-logstash-conf-file-for-this-task/310234)
**Author:** [@bbkunbi](https://discuss.elastic.co/u/bbkunbi)\ **Replies:** 0\ **Last updated:** [July 21, 2022, 5:33am UTC](https://discuss.elastic.co/t/how-to-send-realtime-data-from-csv-file-to-elastiksearch-using-logstash-how-to-write-logstash-conf-file-for-this-task/310234 "2022-07-21T05:33:22Z")
How to do it for multiple .csv file? --- ## [Kibana Service is not ready yet](https://discuss.elastic.co/t/kibana-service-is-not-ready-yet/310017)
**Author:** [@Morne\_Marnewick](https://discuss.elastic.co/u/Morne_Marnewick)\ **Replies:** 8\ **Last updated:** [July 21, 2022, 5:20am UTC](https://discuss.elastic.co/t/kibana-service-is-not-ready-yet/310017 "2022-07-21T05:20:57Z")
Good day, I'm new with ELK and its features. I've recently taken over my predecessors ELK server and it just started giving issues today. "Kibana server is not ready yet" is what it displays. server.port: 5601 server… --- ## [Logstash cannot send output to elasticsearch when elasticsearch not restarted first](https://discuss.elastic.co/t/logstash-cannot-send-output-to-elasticsearch-when-elasticsearch-not-restarted-first/310230)
**Author:** [@RichYaNa](https://discuss.elastic.co/u/RichYaNa)\ **Replies:** 0\ **Last updated:** [July 21, 2022, 4:57am UTC](https://discuss.elastic.co/t/logstash-cannot-send-output-to-elasticsearch-when-elasticsearch-not-restarted-first/310230 "2022-07-21T04:57:36Z")
Hi Everyone, I have a problem here when I run EL (elasticsearch and logstash) as a service in linux the problem is, logstash cannot output to the elasticsearch. But if i restart the elasticsearch service, suddenly all … --- ## [Authorization exception when trying to import model to Elasticsearch cluster](https://discuss.elastic.co/t/authorization-exception-when-trying-to-import-model-to-elasticsearch-cluster/309840)
**Author:** [@green12](https://discuss.elastic.co/u/green12)\ **Replies:** 2\ **Last updated:** [July 21, 2022, 2:04am UTC](https://discuss.elastic.co/t/authorization-exception-when-trying-to-import-model-to-elasticsearch-cluster/309840 "2022-07-21T02:04:51Z")
Hi all. This is my first time using Elasticsearch. Currently I've just deployed a cluster consisted of 3 nodes in my localhost. I'm trying to import a NER NLP model using eland based on https://www.elastic.co/guide/en/e… --- ## [Change Logstash Reindex Time](https://discuss.elastic.co/t/change-logstash-reindex-time/310223)
**Author:** [@Greg12](https://discuss.elastic.co/u/Greg12)\ **Replies:** 1\ **Last updated:** [July 21, 2022, 1:39am UTC](https://discuss.elastic.co/t/change-logstash-reindex-time/310223 "2022-07-21T01:39:14Z")
Logstash is rotating and creating new indexes every day at 7pm, I want to shift this to 2am. Is there a way to do this? --- ## [Space in field reference not working as intended](https://discuss.elastic.co/t/space-in-field-reference-not-working-as-intended/310215)
**Author:** [@BenJeau](https://discuss.elastic.co/u/BenJeau)\ **Replies:** 2\ **Last updated:** [July 21, 2022, 12:20am UTC](https://discuss.elastic.co/t/space-in-field-reference-not-working-as-intended/310215 "2022-07-21T00:20:26Z")
Hi, I'd like to verify if a field (which contains a space) is present or not in a document and to drop it if its present (in the example below I just added a field to debug and see what/which statement works, but turns … --- ## [ILM pattern is incrementing by 2 after using delete phase](https://discuss.elastic.co/t/ilm-pattern-is-incrementing-by-2-after-using-delete-phase/310218)
**Author:** [@cl3dson](https://discuss.elastic.co/u/cl3dson)\ **Replies:** 2\ **Last updated:** [July 20, 2022, 11:17pm UTC](https://discuss.elastic.co/t/ilm-pattern-is-incrementing-by-2-after-using-delete-phase/310218 "2022-07-20T23:17:03Z")
Hey Everyone, I am trying ILM as a possible solution for some project at work, everything was working as expected based on the documentation, until the point I described a delete phase in the ILM policy, the indices are … --- ## [The state of 'types' in elasticsearch 7](https://discuss.elastic.co/t/the-state-of-types-in-elasticsearch-7/310146)
**Author:** [@sbruinsje](https://discuss.elastic.co/u/sbruinsje)\ **Replies:** 0\ **Last updated:** [July 20, 2022, 12:28pm UTC](https://discuss.elastic.co/t/the-state-of-types-in-elasticsearch-7/310146 "2022-07-20T12:28:20Z")
I am using Elasticsearch 7.17 and the corresponding javacript client @elastic/elasticsearch@7.17. My understanding is that only one type of document can be stored in an index and as such specifying explicit types is depr… --- ## [Master has not removed previously failed shard. resending shard failure](https://discuss.elastic.co/t/master-has-not-removed-previously-failed-shard-resending-shard-failure/309737)
**Author:** [@hhalei](https://discuss.elastic.co/u/hhalei)\ **Replies:** 1\ **Last updated:** [July 20, 2022, 10:54pm UTC](https://discuss.elastic.co/t/master-has-not-removed-previously-failed-shard-resending-shard-failure/309737 "2022-07-20T22:54:28Z")
ENV Elasticsearch Version: 7.8.0 Description: We run a cluster with three node, Not long ago, the file system of one node was damaged and forced to go offline. Then the cluster ran with two nodes for a period of time, a… --- ## [What is the best strategy to a continuously running aggregation?](https://discuss.elastic.co/t/what-is-the-best-strategy-to-a-continuously-running-aggregation/310113)
**Author:** [@wintercounter](https://discuss.elastic.co/u/wintercounter)\ **Replies:** 1\ **Last updated:** [July 20, 2022, 10:40pm UTC](https://discuss.elastic.co/t/what-is-the-best-strategy-to-a-continuously-running-aggregation/310113 "2022-07-20T22:40:33Z")
I'm about to implement sorting my data by popularity. I'm creating a separate index to log views of all items. I want to sort the items by Popularity{Today,Week,Month,Year,AllTime}. For this I need a continuously running… --- ## [org.elasticsearch.cluster.block.ClusterBlockException: blocked by: \[SERVICE\_UNAVAILABLE/1/state not recovered / initialized\]](https://discuss.elastic.co/t/org-elasticsearch-cluster-block-clusterblockexception-blocked-by-service-unavailable-1-state-not-recovered-initialized/309992)
**Author:** [@RRE](https://discuss.elastic.co/u/RRE)\ **Replies:** 3\ **Last updated:** [July 20, 2022, 10:36pm UTC](https://discuss.elastic.co/t/org-elasticsearch-cluster-block-clusterblockexception-blocked-by-service-unavailable-1-state-not-recovered-initialized/309992 "2022-07-20T22:36:26Z")
Hi, after a server reboot when I try to start elasticsearch I get the following error: org.elasticsearch.cluster.block.ClusterBlockException: blocked by: \[SERVICE\_UNAVAILABLE/1/state not recovered / initialized\] this i… --- ## [Can we find any indications of DNS failures in kibana for a worker nodes of kubernetees?](https://discuss.elastic.co/t/can-we-find-any-indications-of-dns-failures-in-kibana-for-a-worker-nodes-of-kubernetees/310204)
**Author:** [@chebrve](https://discuss.elastic.co/u/chebrve)\ **Replies:** 7\ **Last updated:** [July 20, 2022, 10:33pm UTC](https://discuss.elastic.co/t/can-we-find-any-indications-of-dns-failures-in-kibana-for-a-worker-nodes-of-kubernetees/310204 "2022-07-20T22:33:46Z")
Hello all, can we find any indications of DNS failures in grafana for a worker nodes of kubernetees --- ## [Questions on space info](https://discuss.elastic.co/t/questions-on-space-info/309758)
**Author:** [@swchandu](https://discuss.elastic.co/u/swchandu)\ **Replies:** 3\ **Last updated:** [July 20, 2022, 10:33pm UTC](https://discuss.elastic.co/t/questions-on-space-info/309758 "2022-07-20T22:33:17Z")
Hi, I have 2 basic questions. Can some one try to answer these Where does the kibana space info stored? any specific index like .kibana? Is namespace(apm) and kibana spaces same or different? Thanks in advance --- ## [Scheduled Email notifications (Alerts) with aggregated results in the form of excel sheets](https://discuss.elastic.co/t/scheduled-email-notifications-alerts-with-aggregated-results-in-the-form-of-excel-sheets/309552)
**Author:** [@Muhammed\_Ashique](https://discuss.elastic.co/u/Muhammed_Ashique)\ **Replies:** 3\ **Last updated:** [July 20, 2022, 10:19pm UTC](https://discuss.elastic.co/t/scheduled-email-notifications-alerts-with-aggregated-results-in-the-form-of-excel-sheets/309552 "2022-07-20T22:19:10Z")
How can i create rules and send mail in certain condition . also i need to attach excel sheet along with this mail --- ## [Downgrade 7.16.1 to 7.10](https://discuss.elastic.co/t/downgrade-7-16-1-to-7-10/310144)
**Author:** [@sameer\_khamkar](https://discuss.elastic.co/u/sameer_khamkar)\ **Replies:** 2\ **Last updated:** [July 20, 2022, 9:46pm UTC](https://discuss.elastic.co/t/downgrade-7-16-1-to-7-10/310144 "2022-07-20T21:46:24Z")
Hello Team, We are in situation where we want to downgrade from7.16.1 to 7.10.2 , we are using Graylog 4 , Mongodb & Elasticsearch Do I need to downgrade the whole stack, or can I downgrade partly? Please guide, Reg… --- ## [Does Filebeat's timestamp processor need the source field to only contain the time?](https://discuss.elastic.co/t/does-filebeats-timestamp-processor-need-the-source-field-to-only-contain-the-time/309130)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 6\ **Last updated:** [July 20, 2022, 8:20pm UTC](https://discuss.elastic.co/t/does-filebeats-timestamp-processor-need-the-source-field-to-only-contain-the-time/309130 "2022-07-20T20:20:01Z")
What my subject says. I'm currently telling timestamp to use the message field as the source, and I'm not sure it's actually working. Do I need to parse out the time from the message before using the timestamp processor? … --- ## [How to find number of characters in a text field](https://discuss.elastic.co/t/how-to-find-number-of-characters-in-a-text-field/310189)
**Author:** [@nestor1](https://discuss.elastic.co/u/nestor1)\ **Replies:** 2\ **Last updated:** [July 20, 2022, 7:56pm UTC](https://discuss.elastic.co/t/how-to-find-number-of-characters-in-a-text-field/310189 "2022-07-20T19:56:13Z")
I have an application that is writing many documents in Elasticsearch. After a year or two, I figured out that some of these documents are scams because they contain large strings (more than 10000 characters). E.g. one d… --- ## [Filebeat haproxy module - with custom log\_format - how could it ever work?](https://discuss.elastic.co/t/filebeat-haproxy-module-with-custom-log-format-how-could-it-ever-work/310199)
**Author:** [@jrwren](https://discuss.elastic.co/u/jrwren)\ **Replies:** 0\ **Last updated:** [July 20, 2022, 7:56pm UTC](https://discuss.elastic.co/t/filebeat-haproxy-module-with-custom-log-format-how-could-it-ever-work/310199 "2022-07-20T19:56:07Z")
It isn't clear from the docs here HAproxy module | Filebeat Reference \[master\] | Elastic How the logs are parsed. If I have customized the haproxy logs using a log-format directive in my haproxy.conf, how can filebeat … --- ## [How to do python analysis on elastic dashboard after applying filters using KQL](https://discuss.elastic.co/t/how-to-do-python-analysis-on-elastic-dashboard-after-applying-filters-using-kql/309594)
**Author:** [@Betty\_Tian](https://discuss.elastic.co/u/Betty_Tian)\ **Replies:** 1\ **Last updated:** [July 20, 2022, 6:47pm UTC](https://discuss.elastic.co/t/how-to-do-python-analysis-on-elastic-dashboard-after-applying-filters-using-kql/309594 "2022-07-20T18:47:36Z")
For example, i have created a dashboard with many plots built on index A\*, then i applied one filter by clicking on a bar chart. (1) How can i export the filtered dataset into python and do some NLP analysis there? (2)… --- ## [Facing Internal Server Error while accessing dashboards on Kibana](https://discuss.elastic.co/t/facing-internal-server-error-while-accessing-dashboards-on-kibana/309001)
**Author:** [@prathameshdvk](https://discuss.elastic.co/u/prathameshdvk)\ **Replies:** 3\ **Last updated:** [July 20, 2022, 6:39pm UTC](https://discuss.elastic.co/t/facing-internal-server-error-while-accessing-dashboards-on-kibana/309001 "2022-07-20T18:39:54Z")
Hello Team, We have recently upgraded ELK stack from 7.9.0 to 7.16.3 in order to close log4j vulnerability. However after upgrade while accessing kibana we are getting Internal Server Error. ELK Versions: 7.16.3 Error… --- ## [Logstash cannot retrieve license information from server](https://discuss.elastic.co/t/logstash-cannot-retrieve-license-information-from-server/310161)
**Author:** [@NadyLeez123](https://discuss.elastic.co/u/NadyLeez123)\ **Replies:** 2\ **Last updated:** [July 20, 2022, 6:01pm UTC](https://discuss.elastic.co/t/logstash-cannot-retrieve-license-information-from-server/310161 "2022-07-20T18:01:11Z")
@sscarduzio There is more than a week that we are having issue with our ELK 7.15.1. Before that, everything were working well since months. Here is the problem: when logstash is stopped, the elasticsearch cluster is he… --- ## [MapperParsingException only when using the Java API Client](https://discuss.elastic.co/t/mapperparsingexception-only-when-using-the-java-api-client/310182)
**Author:** [@Jacob\_Durgin](https://discuss.elastic.co/u/Jacob_Durgin)\ **Replies:** 0\ **Last updated:** [July 20, 2022, 4:51pm UTC](https://discuss.elastic.co/t/mapperparsingexception-only-when-using-the-java-api-client/310182 "2022-07-20T16:51:40Z")
I am running into an issue that I believe has to do with the ES Java API client. I can make the following request to my ES cluster in Postman and receive the intended results: GET resumes/\_search?pretty=true { "… --- ## [Watcher delete document action](https://discuss.elastic.co/t/watcher-delete-document-action/310140)
**Author:** [@Anna\_Foxx](https://discuss.elastic.co/u/Anna_Foxx)\ **Replies:** 1\ **Last updated:** [July 20, 2022, 4:47pm UTC](https://discuss.elastic.co/t/watcher-delete-document-action/310140 "2022-07-20T16:47:54Z")
Hi! Is there possibility to delete index document from watcher as action? I haven't found a guide or documentation of how to do it. Maybe scripts can invoke elastic API, can't they? My case is I want to have a static l… --- ## [Segregate Multiple Applications per each ELK Instance](https://discuss.elastic.co/t/segregate-multiple-applications-per-each-elk-instance/310019)
**Author:** [@amseshadri](https://discuss.elastic.co/u/amseshadri)\ **Replies:** 5\ **Last updated:** [July 20, 2022, 4:25pm UTC](https://discuss.elastic.co/t/segregate-multiple-applications-per-each-elk-instance/310019 "2022-07-20T16:25:37Z")
Hi, I am a newbie to ELK, exploring the things from few days. Using the ELK 8.1.4 version We recently got the ELK Stack installed as a SaaS in our Azure Cloud Subscription. So we have one instance of ELK in each envir… --- ## [Minimum access required by developer to ELK tool](https://discuss.elastic.co/t/minimum-access-required-by-developer-to-elk-tool/310024)
**Author:** [@amseshadri](https://discuss.elastic.co/u/amseshadri)\ **Replies:** 4\ **Last updated:** [July 20, 2022, 4:06pm UTC](https://discuss.elastic.co/t/minimum-access-required-by-developer-to-elk-tool/310024 "2022-07-20T16:06:01Z")
Hi, We are using ELK 8.1.4 running on cluster. Setting up the roles and permissions for users utilising spaces and all. Just want to know what is minimum level of access privilege required by a developer? Thanks Ses… --- ## [Inter-node transfer is 25% of the Elastic Cloud bill](https://discuss.elastic.co/t/inter-node-transfer-is-25-of-the-elastic-cloud-bill/306892)
**Author:** [@schapman](https://discuss.elastic.co/u/schapman)\ **Replies:** 10\ **Last updated:** [July 20, 2022, 3:30pm UTC](https://discuss.elastic.co/t/inter-node-transfer-is-25-of-the-elastic-cloud-bill/306892 "2022-07-20T15:30:28Z")
This is a small Elastic Cloud deployment with 3 Hot Nodes (2GB RAM / 30GB Disk each) and a single Frozen node (4GB RAM, 320GB Disk cache), plus we have a small (single hot node) monitoring deployment. The May bill (when … --- ## [Fleet server certificate problem (I think)](https://discuss.elastic.co/t/fleet-server-certificate-problem-i-think/310168)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 0\ **Last updated:** [July 20, 2022, 2:40pm UTC](https://discuss.elastic.co/t/fleet-server-certificate-problem-i-think/310168 "2022-07-20T14:40:33Z")
I see posts similar, people point to the problem, but none point to the fix. I installed an 8.3.1 fleet server. when trying to enroll the first host, I get error Error: fail to enroll: fail to execute request to fleet… --- ## [Failed to publish events: connect: connection refused](https://discuss.elastic.co/t/failed-to-publish-events-connect-connection-refused/309785)
**Author:** [@knitehias](https://discuss.elastic.co/u/knitehias)\ **Replies:** 3\ **Last updated:** [July 20, 2022, 2:31pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-connect-connection-refused/309785 "2022-07-20T14:31:35Z")
Hi Experts, I am using beats-\>logstash-\>elasticsearch-kibana stack. Every now and then my file beat will log error log then no other logging at all 2022-07-16T10:04:26.148Z ERROR \[publisher\_pipeline\_output\] pipeli… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=856) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=858)