# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=860 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 861 --- ## [Kibana Server is not ready yet after deletion of indeces inside /var/lib/nodes/0/indeces](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-after-deletion-of-indeces-inside-var-lib-nodes-0-indeces/309995)
**Author:** [@rrrrrrrrrrr](https://discuss.elastic.co/u/rrrrrrrrrrr)\ **Replies:** 3\ **Last updated:** [July 19, 2022, 11:58am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-after-deletion-of-indeces-inside-var-lib-nodes-0-indeces/309995 "2022-07-19T11:58:45Z")
Hello, I'm unable to access my Kibana Dashboard after deleting some of the indeces directory inside /var/lib/nodes/0/indeces/. Before this I had an error regarding Low disk space that's preventing the elasticsearch to s… --- ## [Kibana doesn't start properly at upgrade from 7.17.1 to 8.3.2](https://discuss.elastic.co/t/kibana-doesnt-start-properly-at-upgrade-from-7-17-1-to-8-3-2/309586)
**Author:** [@gerib](https://discuss.elastic.co/u/gerib)\ **Replies:** 3\ **Last updated:** [July 19, 2022, 11:12am UTC](https://discuss.elastic.co/t/kibana-doesnt-start-properly-at-upgrade-from-7-17-1-to-8-3-2/309586 "2022-07-19T11:12:01Z")
Log message(s): ... ... \[ERROR\]\[savedobjects-service\] \[.kibana\] Action failed with 'security\_exception: \[security\_exception\] Reason: action \[indices:admin/create\] is unauthorized for user \[kibanaserver\] with roles \[… --- ## [\[8.3.2\] Message at Kibana's login page "Please upgrade your browser" when applying a Tampermonkey userscript](https://discuss.elastic.co/t/8-3-2-message-at-kibanas-login-page-please-upgrade-your-browser-when-applying-a-tampermonkey-userscript/309796)
**Author:** [@gerib](https://discuss.elastic.co/u/gerib)\ **Replies:** 2\ **Last updated:** [July 19, 2022, 10:51am UTC](https://discuss.elastic.co/t/8-3-2-message-at-kibanas-login-page-please-upgrade-your-browser-when-applying-a-tampermonkey-userscript/309796 "2022-07-19T10:51:49Z")
When applying the following userscript in Tampermonkey: // ==UserScript== // @name tab-size: 2 // @description Sets the tab (U+9) character's display size to 2. // @version 22.07.16-1645 // @author G… --- ## [\[metricbeat\] - Prometheus module - invalid escape sequence '\\"'](https://discuss.elastic.co/t/metricbeat-prometheus-module-invalid-escape-sequence/308421)
**Author:** [@harikvemula](https://discuss.elastic.co/u/harikvemula)\ **Replies:** 2\ **Last updated:** [July 19, 2022, 10:30am UTC](https://discuss.elastic.co/t/metricbeat-prometheus-module-invalid-escape-sequence/308421 "2022-07-19T10:30:41Z")
Hi, Metricbeat: 7.10.2 I am trying to use Metricbeat prometheus module to pull metrics from Spring boot application with micrometer prometheus format . It fails with the following error 2022-06-29T12:21:37.658 +0000 … --- ## [Logstash JDBC connection for 3000 databases](https://discuss.elastic.co/t/logstash-jdbc-connection-for-3000-databases/310004)
**Author:** [@Poojan](https://discuss.elastic.co/u/Poojan)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 10:17am UTC](https://discuss.elastic.co/t/logstash-jdbc-connection-for-3000-databases/310004 "2022-07-19T10:17:54Z")
Hello guys, I want to connect to 3000 databases which are on the same host using logstash. how can I connect those dbs and push data to elasticsearch? --- ## [Kibana Alert variable declaration](https://discuss.elastic.co/t/kibana-alert-variable-declaration/309316)
**Author:** [@ilanchezhian](https://discuss.elastic.co/u/ilanchezhian)\ **Replies:** 4\ **Last updated:** [July 19, 2022, 10:28am UTC](https://discuss.elastic.co/t/kibana-alert-variable-declaration/309316 "2022-07-19T10:28:10Z")
Hi All, I'm creating a alert in kibana for IP monitoring, how can I pass the index field values as a parameter in alert body for easy identification @Simon\_Becker --- ## [Discovery.type : single-node but the new indexes are always : index.number\_of\_replicas" : "1"?](https://discuss.elastic.co/t/discovery-type-single-node-but-the-new-indexes-are-always-index-number-of-replicas-1/309318)
**Author:** [@PM75](https://discuss.elastic.co/u/PM75)\ **Replies:** 5\ **Last updated:** [July 19, 2022, 10:21am UTC](https://discuss.elastic.co/t/discovery-type-single-node-but-the-new-indexes-are-always-index-number-of-replicas-1/309318 "2022-07-19T10:21:43Z")
Hello, \[root@STL-SAS-025 ~\]# /usr/share/elasticsearch/bin/elasticsearch --version Version: 8.3.1, Build: rpm/b9a6b2867996ba92ceac66cb5bafc6db25e7910e/2022-06-29T18:39:55.731992798Z, JVM: 18.0.1.1 I'm having trouble und… --- ## [Creating Custom Field in Kibana and fetching the values from a particular line in message](https://discuss.elastic.co/t/creating-custom-field-in-kibana-and-fetching-the-values-from-a-particular-line-in-message/309889)
**Author:** [@Dhinesh\_Prabakaran](https://discuss.elastic.co/u/Dhinesh_Prabakaran)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 10:19am UTC](https://discuss.elastic.co/t/creating-custom-field-in-kibana-and-fetching-the-values-from-a-particular-line-in-message/309889 "2022-07-19T10:19:34Z")
Hi All, We've been using ELK to monitor our network and infrastructure logs. We have a requirement. We need to create a custom field name in filebeat so that we can use it as a unique key to filter the log messages in … --- ## [Forbidden page in Elastic Cloud in Azure](https://discuss.elastic.co/t/forbidden-page-in-elastic-cloud-in-azure/309985)
**Author:** [@arks](https://discuss.elastic.co/u/arks)\ **Replies:** 2\ **Last updated:** [July 19, 2022, 9:50am UTC](https://discuss.elastic.co/t/forbidden-page-in-elastic-cloud-in-azure/309985 "2022-07-19T09:50:24Z")
Hello there, First of all let me start by saying that I feel silly posting a problem like this, because it feels like something particularly easy to solve, but somehow we struggle to find a way of doing it. We have a E… --- ## [Phrase\_query for multiple should and must](https://discuss.elastic.co/t/phrase-query-for-multiple-should-and-must/309998)
**Author:** [@puff2fakie](https://discuss.elastic.co/u/puff2fakie)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 9:44am UTC](https://discuss.elastic.co/t/phrase-query-for-multiple-should-and-must/309998 "2022-07-19T09:44:57Z")
I've indexed my documents as follows: doc = { "\_index": index\_name, "\_source": { "field": "bm25", "passage": passage, "passage\_id": pid, "level1": level1, "level2": level2… --- ## [Upgrading elasticsearch from 5.6 to 6.7 error: The Upgrade API must be run for 6.x nodes to join the cluster](https://discuss.elastic.co/t/upgrading-elasticsearch-from-5-6-to-6-7-error-the-upgrade-api-must-be-run-for-6-x-nodes-to-join-the-cluster/309667)
**Author:** [@Gerardo\_Padierna](https://discuss.elastic.co/u/Gerardo_Padierna)\ **Replies:** 2\ **Last updated:** [July 19, 2022, 9:41am UTC](https://discuss.elastic.co/t/upgrading-elasticsearch-from-5-6-to-6-7-error-the-upgrade-api-must-be-run-for-6-x-nodes-to-join-the-cluster/309667 "2022-07-19T09:41:05Z")
Hello, I'm following the instructions to run an rolling update from a 3-node cluster (elasticsearch, logstash & kibana) as described here. I had just 1 index that was in version 2.3.3 and I have reindexed that one befo… --- ## [Facing Issue while running queries on ElasticSearch](https://discuss.elastic.co/t/facing-issue-while-running-queries-on-elasticsearch/309997)
**Author:** [@painless\_elastic](https://discuss.elastic.co/u/painless_elastic)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 9:37am UTC](https://discuss.elastic.co/t/facing-issue-while-running-queries-on-elasticsearch/309997 "2022-07-19T09:37:26Z")
Hi All, When we are making 100TPS queries to elastic and parallelly documents are getting indexed, the response time is good. But when the query rate to our elastic is close to zero and documents are getting indexed pa… --- ## [ESQL for Current Month](https://discuss.elastic.co/t/esql-for-current-month/309915)
**Author:** [@karnamonkster](https://discuss.elastic.co/u/karnamonkster)\ **Replies:** 2\ **Last updated:** [July 19, 2022, 9:33am UTC](https://discuss.elastic.co/t/esql-for-current-month/309915 "2022-07-19T09:33:58Z")
Hi, I need to get data on the Canvas for current month only. Can someone help with the SQL query on Canvas similar to the KQL below. @timestamp \> "now/M" and @timestamp \<= "now" --- ## [How to make logstash filter multiple grok pattern](https://discuss.elastic.co/t/how-to-make-logstash-filter-multiple-grok-pattern/309810)
**Author:** [@lzold\_z](https://discuss.elastic.co/u/lzold_z)\ **Replies:** 2\ **Last updated:** [July 19, 2022, 9:17am UTC](https://discuss.elastic.co/t/how-to-make-logstash-filter-multiple-grok-pattern/309810 "2022-07-19T09:17:56Z")
Hello, im new to the logstash and i want to know how to make logstash filter multiple grok pattern for example from httpd error logs and access logs, im already have those pattern but logstash seem didnt catch the logs, … --- ## [JSON file parse error](https://discuss.elastic.co/t/json-file-parse-error/309869)
**Author:** [@ichasco\_heytrade](https://discuss.elastic.co/u/ichasco_heytrade)\ **Replies:** 2\ **Last updated:** [July 19, 2022, 8:58am UTC](https://discuss.elastic.co/t/json-file-parse-error/309869 "2022-07-19T08:58:44Z")
Hi, I am trying to parse a JSON file with this structure: \[ { "plugin": "cloudtrailBucketAccessLogging", "category": "CloudTrail", "title": "CloudTrail Bucket Access Logging", "description": "Ensures C… --- ## [Collect logs from external deployments exposing a domain](https://discuss.elastic.co/t/collect-logs-from-external-deployments-exposing-a-domain/309746)
**Author:** [@thahgr](https://discuss.elastic.co/u/thahgr)\ **Replies:** 4\ **Last updated:** [July 19, 2022, 7:33am UTC](https://discuss.elastic.co/t/collect-logs-from-external-deployments-exposing-a-domain/309746 "2022-07-19T07:33:48Z")
TL;DR I want to ship logs from remote deployments via filebeat or logstash to a central Elastic/Elastic stack via HTTP exposing just domains I have considered two solutions, cant get any to work The setup is as follow… --- ## [New Elasticsearch Java API: Source is null when search is execute](https://discuss.elastic.co/t/new-elasticsearch-java-api-source-is-null-when-search-is-execute/309980)
**Author:** [@ALX\_DM](https://discuss.elastic.co/u/ALX_DM)\ **Replies:** 2\ **Last updated:** [July 19, 2022, 7:30am UTC](https://discuss.elastic.co/t/new-elasticsearch-java-api-source-is-null-when-search-is-execute/309980 "2022-07-19T07:30:56Z")
I want to implement this command using the new ES Java API client but the result shows source as null POST /test\_event\_202207/\_search?typed\_keys=true { "sort":\[{"time":{"order":"desc"}}\] } If I excecute this in Kiban… --- ## [Create Alert from index data](https://discuss.elastic.co/t/create-alert-from-index-data/309745)
**Author:** [@DILIP\_SHARMA](https://discuss.elastic.co/u/DILIP_SHARMA)\ **Replies:** 4\ **Last updated:** [July 19, 2022, 7:19am UTC](https://discuss.elastic.co/t/create-alert-from-index-data/309745 "2022-07-19T07:19:50Z")
Hi i am using ES Cloud 7.15.1 i am getting log data from my website . now i want to write alert for that data , for example if status code =500 and error = xyz , send the email . i trying using alert from security… --- ## [Elastic Agent Kubernetes integration doesn't send container logs](https://discuss.elastic.co/t/elastic-agent-kubernetes-integration-doesnt-send-container-logs/309983)
**Author:** [@bucknerm](https://discuss.elastic.co/u/bucknerm)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 7:04am UTC](https://discuss.elastic.co/t/elastic-agent-kubernetes-integration-doesnt-send-container-logs/309983 "2022-07-19T07:04:24Z")
I'm running into an issue where I can't collect any of my custom Kubernetes container logs using the Kubernetes integration with the elastic agent. Elastic provided containers appear to ship logs correctly. I'm looking … --- ## [How to pin elasticsearch version using “ec” Terraform provider?](https://discuss.elastic.co/t/how-to-pin-elasticsearch-version-using-ec-terraform-provider/307812)
**Author:** [@amruth](https://discuss.elastic.co/u/amruth)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 6:41am UTC](https://discuss.elastic.co/t/how-to-pin-elasticsearch-version-using-ec-terraform-provider/307812 "2022-07-19T06:41:47Z")
Hello Everyone, how to pin elasticsearch version using “ec” Terraform provider? I am using the following data "ec\_stack" "latest" { version\_regex = "8.2.1" region = var.region } but it throws “Error: failed… --- ## [Heartbeat on elastic agent](https://discuss.elastic.co/t/heartbeat-on-elastic-agent/309570)
**Author:** [@lineconnect](https://discuss.elastic.co/u/lineconnect)\ **Replies:** 4\ **Last updated:** [July 19, 2022, 6:29am UTC](https://discuss.elastic.co/t/heartbeat-on-elastic-agent/309570 "2022-07-19T06:29:28Z")
Hi there, we're using EFK in k8s and beats for a while now and want to migrate our beats to elastic agent. I've setup the agents to use the fleet server and i'm also able to configure the inputs trough Kibana. But i'm… --- ## [Elastic-agent index](https://discuss.elastic.co/t/elastic-agent-index/309981)
**Author:** [@Mohsin\_Ashraf](https://discuss.elastic.co/u/Mohsin_Ashraf)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 6:24am UTC](https://discuss.elastic.co/t/elastic-agent-index/309981 "2022-07-19T06:24:44Z")
Hi. is it possible we can create different index names for different elastic-agent? because in my case I want to create different spaces and want to show different data in these spaces but all data is coming in the sam… --- ## [Transform aggregation creates flattened record](https://discuss.elastic.co/t/transform-aggregation-creates-flattened-record/309657)
**Author:** [@dimuskin](https://discuss.elastic.co/u/dimuskin)\ **Replies:** 4\ **Last updated:** [July 19, 2022, 6:09am UTC](https://discuss.elastic.co/t/transform-aggregation-creates-flattened-record/309657 "2022-07-19T06:09:31Z")
I use transformation for data preprocessing, in my case every second rps are created for each host { "id": "appgw-rps-host", "source": { "index": \[ "logs-azure.platformlogs-default" \] }, "dest": { … --- ## [More like this query using an existing document, but I don't know its ID](https://discuss.elastic.co/t/more-like-this-query-using-an-existing-document-but-i-dont-know-its-id/309843)
**Author:** [@catmanjan](https://discuss.elastic.co/u/catmanjan)\ **Replies:** 4\ **Last updated:** [July 19, 2022, 5:29am UTC](https://discuss.elastic.co/t/more-like-this-query-using-an-existing-document-but-i-dont-know-its-id/309843 "2022-07-19T05:29:39Z")
I want to do a more like this query to return similar documents to a document that already exists in my index. I don't know the documents ID ahead of time, but I do know a term value that I can use to look it up (also, … --- ## [Elasticsearch ILM Policy](https://discuss.elastic.co/t/elasticsearch-ilm-policy/309974)
**Author:** [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 5:26am UTC](https://discuss.elastic.co/t/elasticsearch-ilm-policy/309974 "2022-07-19T05:26:42Z")
Hello Every One I have one elasticsearch cluster and Version is 7.10.2 I want to setup some of the index delete after week and after month automatically can you suggest how we can setup this cluster design is there are … --- ## [Indexes cannot be referenced after cluster configuration](https://discuss.elastic.co/t/indexes-cannot-be-referenced-after-cluster-configuration/309970)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 12\ **Last updated:** [July 19, 2022, 5:15am UTC](https://discuss.elastic.co/t/indexes-cannot-be-referenced-after-cluster-configuration/309970 "2022-07-19T05:15:08Z")
I am creating an Elasticsearch cluster. I am deleting the Elasticsearch node configuration that was already running on a single node and configuring a cluster with two newly created Elasticsearch nodes. Here, the clust… --- ## [Elasticsearch complaining about space issues when there is plenty of space available](https://discuss.elastic.co/t/elasticsearch-complaining-about-space-issues-when-there-is-plenty-of-space-available/309844)
**Author:** [@pushshift](https://discuss.elastic.co/u/pushshift)\ **Replies:** 7\ **Last updated:** [July 19, 2022, 5:11am UTC](https://discuss.elastic.co/t/elasticsearch-complaining-about-space-issues-when-there-is-plenty-of-space-available/309844 "2022-07-19T05:11:09Z")
I received the following error this evening while indexing a large dataset: WARNING:root:{'create': {'\_index': 'fh\_hot\_en\_2021-05-05', '\_id': '1390039787566821378', 'status': 429, 'error': {'type': 'cluster\_block\_except… --- ## [Logstash stuck at stage pipelines running](https://discuss.elastic.co/t/logstash-stuck-at-stage-pipelines-running/309951)
**Author:** [@sridharnetha](https://discuss.elastic.co/u/sridharnetha)\ **Replies:** 4\ **Last updated:** [July 19, 2022, 4:46am UTC](https://discuss.elastic.co/t/logstash-stuck-at-stage-pipelines-running/309951 "2022-07-19T04:46:14Z")
I am trying to ingest a csv file to include data on the elasticsearch server on the existing index. The csv file contains whitespaces in header column names. Here is an example "MOBILE NO" should be renamed to "MOBILE\_N… --- ## [Checked Exception "reference to termsQuery is ambiguous \[ERROR\]"](https://discuss.elastic.co/t/checked-exception-reference-to-termsquery-is-ambiguous-error/309969)
**Author:** [@willowHB](https://discuss.elastic.co/u/willowHB)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 3:17am UTC](https://discuss.elastic.co/t/checked-exception-reference-to-termsquery-is-ambiguous-error/309969 "2022-07-19T03:17:03Z")
version：elasticsearch-7.15.2.jar 1、I think this is an api method error.When you use “QueryBuilders.termsQuery("status", 3,4)” query, an error “reference to termsQuery is ambiguous \[ERROR\] both method termsQuery(java.… --- ## [Sort by time received instead of timestamp](https://discuss.elastic.co/t/sort-by-time-received-instead-of-timestamp/308992)
**Author:** [@MADxHAWK](https://discuss.elastic.co/u/MADxHAWK)\ **Replies:** 7\ **Last updated:** [July 19, 2022, 2:16am UTC](https://discuss.elastic.co/t/sort-by-time-received-instead-of-timestamp/308992 "2022-07-19T02:16:59Z")
Hello, im using ELK-Stack to search through Cisco logs received by filebeat from our loghost. the problem is, i only can sort the discover by Timestamp from Elasticsearch and not by the timestamp the message was receiv… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=859) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=861)