# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=865 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 866 --- ## [Set Limit for Date Filter in Elastic cluster](https://discuss.elastic.co/t/set-limit-for-date-filter-in-elastic-cluster/309247)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 2\ **Last updated:** [July 14, 2022, 11:28pm UTC](https://discuss.elastic.co/t/set-limit-for-date-filter-in-elastic-cluster/309247 "2022-07-14T23:28:17Z")
Hi I have a general question! I have a elastic with a lot of docs in index! I want to set threshold on datetime filter and not allow users to execute heavy queries on cluster. for example i set datetime\_max\_filter = … --- ## [Sort script input needed](https://discuss.elastic.co/t/sort-script-input-needed/309527)
**Author:** [@ansamHox](https://discuss.elastic.co/u/ansamHox)\ **Replies:** 8\ **Last updated:** [July 14, 2022, 10:40pm UTC](https://discuss.elastic.co/t/sort-script-input-needed/309527 "2022-07-14T22:40:15Z")
I have a dataset like this (sometimes Source field does not exist): Id Source Sender -------------------------------------------------------------------- 1 … --- ## [How to get and post kibana spaces by api call?](https://discuss.elastic.co/t/how-to-get-and-post-kibana-spaces-by-api-call/308684)
**Author:** [@Gabriel\_Vasconcelos](https://discuss.elastic.co/u/Gabriel_Vasconcelos)\ **Replies:** 2\ **Last updated:** [July 14, 2022, 9:40pm UTC](https://discuss.elastic.co/t/how-to-get-and-post-kibana-spaces-by-api-call/308684 "2022-07-14T21:40:21Z")
Hello everyone, I would like to know how I can return kibana spaces via api, I tried from the documentation: Kibana spaces APIs | Kibana Guide \[8.3\] | Elastic, but when I give a get , I don't get the default spaces and s… --- ## [How to check the status of application pools](https://discuss.elastic.co/t/how-to-check-the-status-of-application-pools/309537)
**Author:** [@Anagha\_nambiar](https://discuss.elastic.co/u/Anagha_nambiar)\ **Replies:** 8\ **Last updated:** [July 14, 2022, 9:14pm UTC](https://discuss.elastic.co/t/how-to-check-the-status-of-application-pools/309537 "2022-07-14T21:14:08Z")
Hi Team, Can you please guide how to check the status of IIS application pools whether it is "started" or "stopped" in Kibana using metricbeat? --- ## [KIbana not showing kube-state-metrics](https://discuss.elastic.co/t/kibana-not-showing-kube-state-metrics/309689)
**Author:** [@Lucas\_Roberto](https://discuss.elastic.co/u/Lucas_Roberto)\ **Replies:** 0\ **Last updated:** [July 14, 2022, 9:09pm UTC](https://discuss.elastic.co/t/kibana-not-showing-kube-state-metrics/309689 "2022-07-14T21:09:04Z")
Hello, everyone. I'm deploying our monitoring system, with ES, Metricbeat and Kibana. We have a GCP cluster, with some pods to monitor the metrics. I followed the guide provided by Kibana's dashboard Kubernetes metrics,… --- ## [Multiple Stomp servers](https://discuss.elastic.co/t/multiple-stomp-servers/309686)
**Author:** [@luv4diamonds](https://discuss.elastic.co/u/luv4diamonds)\ **Replies:** 2\ **Last updated:** [July 14, 2022, 8:03pm UTC](https://discuss.elastic.co/t/multiple-stomp-servers/309686 "2022-07-14T20:03:16Z")
Hi, I am trying to configure Stomp input with 3 servers but this doesn't appear to work in ES 7.17.3. I have tried host =\> "host1", "host2", "host3" which does not work. Does anyone know how to configure this or is it… --- ## [Remove Spaces and text between these \<\> brackets](https://discuss.elastic.co/t/remove-spaces-and-text-between-these-brackets/309683)
**Author:** [@errupeshmca](https://discuss.elastic.co/u/errupeshmca)\ **Replies:** 0\ **Last updated:** [July 14, 2022, 7:52pm UTC](https://discuss.elastic.co/t/remove-spaces-and-text-between-these-brackets/309683 "2022-07-14T19:52:11Z")
Hi , I am new to the elasticsearch i have to filter the logs removing larges spaces and less than, greater than signs around the text, \ \ \ \ **Author:** [@paris1](https://discuss.elastic.co/u/paris1)\ **Replies:** 0\ **Last updated:** [July 14, 2022, 7:09pm UTC](https://discuss.elastic.co/t/i-cant-curl-my-elasticsearch-8-on-aws-ec2-ubuntu-20-04/309682 "2022-07-14T19:09:15Z") installed elasticsearch(docker compose) 8.2 on aws ec2(ubuntu 20.04.) Everything is working.My only problem is that I can't reach(curl) it from other instances and my backend server(it is on same vpc). I added my node … --- ## [Two strings with one grok](https://discuss.elastic.co/t/two-strings-with-one-grok/309646)
**Author:** [@PJss](https://discuss.elastic.co/u/PJss)\ **Replies:** 3\ **Last updated:** [July 14, 2022, 6:09pm UTC](https://discuss.elastic.co/t/two-strings-with-one-grok/309646 "2022-07-14T18:09:32Z")
Hello, please help to read this two strings with one grok rule first: mgmgmg : TTY=unknown ; PWD=/usr/local/gtail/basecomps/deploy/cache ; USER=root ; ENV=HEALTHCHECK=no BACKUP=no ; COMMAND=/usr/bin/dpkg --install goser… --- ## [Logstash Ruby filter - init not working](https://discuss.elastic.co/t/logstash-ruby-filter-init-not-working/309670)
**Author:** [@Hichem](https://discuss.elastic.co/u/Hichem)\ **Replies:** 1\ **Last updated:** [July 14, 2022, 6:01pm UTC](https://discuss.elastic.co/t/logstash-ruby-filter-init-not-working/309670 "2022-07-14T18:01:16Z")
I'm trying to initialize a variable in a ruby filter. It works properly with the code tag, but not when using a ruby file. Here is my code: pipeline.conf ruby { init =\> "@val = 5 " path =\> "script.rb" }… --- ## [A question about the Profile API](https://discuss.elastic.co/t/a-question-about-the-profile-api/309680)
**Author:** [@kpachar](https://discuss.elastic.co/u/kpachar)\ **Replies:** 0\ **Last updated:** [July 14, 2022, 5:55pm UTC](https://discuss.elastic.co/t/a-question-about-the-profile-api/309680 "2022-07-14T17:55:31Z")
Hello, I am trying to debug some intermittent slowness in my cluster. I send this simple term query, to a specific shard, which is local to the node. I also enabled the profile option, so that the profile output is ava… --- ## [Problem with date filter](https://discuss.elastic.co/t/problem-with-date-filter/309642)
**Author:** [@Thuunder7](https://discuss.elastic.co/u/Thuunder7)\ **Replies:** 11\ **Last updated:** [July 14, 2022, 5:26pm UTC](https://discuss.elastic.co/t/problem-with-date-filter/309642 "2022-07-14T17:26:24Z")
Hello, I am trying to parse the following message (e.g): 2022-07-14T13:06:16 Using the dissect filter correctly: dissect { mapping =\> { "\[message\]" =\> "%{\[my\]\[date\]}" … --- ## [Index management yellow](https://discuss.elastic.co/t/index-management-yellow/309576)
**Author:** [@Khadija\_BOUDINAR1](https://discuss.elastic.co/u/Khadija_BOUDINAR1)\ **Replies:** 4\ **Last updated:** [July 14, 2022, 5:17pm UTC](https://discuss.elastic.co/t/index-management-yellow/309576 "2022-07-14T17:17:15Z")
hi all, when i create a new index some take yellow health and some take green health what's the probleme in ? --- ## [Elastic Agent fails to parse Auditd logs "Failed to parse value \[yes\] as only \[true\] or \[false\] are allowed."](https://discuss.elastic.co/t/elastic-agent-fails-to-parse-auditd-logs-failed-to-parse-value-yes-as-only-true-or-false-are-allowed/309038)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 1\ **Last updated:** [July 14, 2022, 5:15pm UTC](https://discuss.elastic.co/t/elastic-agent-fails-to-parse-auditd-logs-failed-to-parse-value-yes-as-only-true-or-false-are-allowed/309038 "2022-07-14T17:15:42Z")
When I fixed a different issue, I noticed a bunch of lines show up in the Elastic Agent's Filebeat logs saying it was just dropping them instead of sending them to Elasticsearch. As far as I can tell every line in the a… --- ## [Metricbeat Output to Kafka via Kerberos Error](https://discuss.elastic.co/t/metricbeat-output-to-kafka-via-kerberos-error/309675)
**Author:** [@masonlesser](https://discuss.elastic.co/u/masonlesser)\ **Replies:** 0\ **Last updated:** [July 14, 2022, 5:14pm UTC](https://discuss.elastic.co/t/metricbeat-output-to-kafka-via-kerberos-error/309675 "2022-07-14T17:14:07Z")
Has anyone been able to get Kerberos output to Kafka to work for Metricbeat (v 7.17) on Windows? I've attempted both keytab and password auth types for Kerberos. The initial error I get is: kafka: client has run out of … --- ## [Value ( 1.0. ) ( Notice the last dot after 0 ) getting stored as type Date in Elastic search](https://discuss.elastic.co/t/value-1-0-notice-the-last-dot-after-0-getting-stored-as-type-date-in-elastic-search/309411)
**Author:** [@ajitw](https://discuss.elastic.co/u/ajitw)\ **Replies:** 4\ **Last updated:** [July 14, 2022, 3:43pm UTC](https://discuss.elastic.co/t/value-1-0-notice-the-last-dot-after-0-getting-stored-as-type-date-in-elastic-search/309411 "2022-07-14T15:43:06Z")
We store logs data in Elasticsearch we have added functionality which makes the JSON logs stored in Elasticsearch as seperate fields. In one of the logs appVersion value was coming as - ( 1.0. ) - Notice the last dot a… --- ## [Cloudwatch Output from logstash](https://discuss.elastic.co/t/cloudwatch-output-from-logstash/309661)
**Author:** [@jlbai](https://discuss.elastic.co/u/jlbai)\ **Replies:** 0\ **Last updated:** [July 14, 2022, 2:56pm UTC](https://discuss.elastic.co/t/cloudwatch-output-from-logstash/309661 "2022-07-14T14:56:14Z")
I am looking to out to cloudwatch from logstash. I can not use an IAM user access and secret access key to connect to cloud watch Does anyone have experience or solution so I can talk to my aws cloudwatch input { udp { … --- ## [New ES Java API: Getting index name from alias name](https://discuss.elastic.co/t/new-es-java-api-getting-index-name-from-alias-name/309643)
**Author:** [@ALX\_DM](https://discuss.elastic.co/u/ALX_DM)\ **Replies:** 2\ **Last updated:** [July 14, 2022, 2:26pm UTC](https://discuss.elastic.co/t/new-es-java-api-getting-index-name-from-alias-name/309643 "2022-07-14T14:26:20Z")
I dont really understand how to get index name from alias name looking only at the api code of new elastic Java API. I cannot find any document also. Hope somebody here have tried. Here\`s what I tried so far: final G… --- ## [Transform missing data](https://discuss.elastic.co/t/transform-missing-data/308818)
**Author:** [@rokcarl](https://discuss.elastic.co/u/rokcarl)\ **Replies:** 2\ **Last updated:** [July 14, 2022, 2:12pm UTC](https://discuss.elastic.co/t/transform-missing-data/308818 "2022-07-14T14:12:08Z")
I have a transform that aggregates my stats index data for long-term storage, but the results are no longer correct. My stats index stores each request (one document = one request) and stores the credits used by that re… --- ## [Can't connect node to cluster on another server](https://discuss.elastic.co/t/cant-connect-node-to-cluster-on-another-server/309432)
**Author:** [@dabit\_coder](https://discuss.elastic.co/u/dabit_coder)\ **Replies:** 9\ **Last updated:** [July 14, 2022, 1:34pm UTC](https://discuss.elastic.co/t/cant-connect-node-to-cluster-on-another-server/309432 "2022-07-14T13:34:30Z")
First of all, I want to be clear that I looked at several guides and suggested similar questions before opening this post, but none of them worked for our case, so I am a bit desperate right now. Here is our situation: … --- ## [Nodes didn't discovery in ElasticSearch Cluster](https://discuss.elastic.co/t/nodes-didnt-discovery-in-elasticsearch-cluster/309560)
**Author:** [@SilasMuniz1](https://discuss.elastic.co/u/SilasMuniz1)\ **Replies:** 5\ **Last updated:** [July 14, 2022, 12:36pm UTC](https://discuss.elastic.co/t/nodes-didnt-discovery-in-elasticsearch-cluster/309560 "2022-07-14T12:36:46Z")
Hello, I am setting up one cluster with two nodes to elasticsearch. I am using virtualbox with ubuntu 22.04 image. I already configurated all nodes with these elasticsearch.yml: Node1: root@osboxes:/var/log/elasticse… --- ## [I have installed File beat 7.17.3 version on a Windows server, it is not getting the logs to the ELK Server](https://discuss.elastic.co/t/i-have-installed-file-beat-7-17-3-version-on-a-windows-server-it-is-not-getting-the-logs-to-the-elk-server/309075)
**Author:** [@AKAM14](https://discuss.elastic.co/u/AKAM14)\ **Replies:** 1\ **Last updated:** [July 14, 2022, 11:55am UTC](https://discuss.elastic.co/t/i-have-installed-file-beat-7-17-3-version-on-a-windows-server-it-is-not-getting-the-logs-to-the-elk-server/309075 "2022-07-14T11:55:12Z")
We re trying to send data from Filebeat to ELastic search directly .. but it is not going .. it says it needs kibana connections and dashboards not loaded ###################### Filebeat Configuration Example ##########… --- ## [Java 17 support for elasticsearch 6.6.0](https://discuss.elastic.co/t/java-17-support-for-elasticsearch-6-6-0/309605)
**Author:** [@gilh](https://discuss.elastic.co/u/gilh)\ **Replies:** 3\ **Last updated:** [July 14, 2022, 11:44am UTC](https://discuss.elastic.co/t/java-17-support-for-elasticsearch-6-6-0/309605 "2022-07-14T11:44:35Z")
Hi. I'm using elasticsearch version 6.6.0. Now I want to upgrade from java 8 to java 17. Can I expect this version to work fine with java 17? Or I would need to upgrade my elasticsearch client before moving to java 17? … --- ## [After exporting to csv getting different value](https://discuss.elastic.co/t/after-exporting-to-csv-getting-different-value/309551)
**Author:** [@Muhammed\_Ashique](https://discuss.elastic.co/u/Muhammed_Ashique)\ **Replies:** 5\ **Last updated:** [July 14, 2022, 11:19am UTC](https://discuss.elastic.co/t/after-exporting-to-csv-getting-different-value/309551 "2022-07-14T11:19:23Z")
I have some filed to export as csv . on elasticsearch it is have proper value. once i export into csv file this field is become rounded value. here attached before exporting and after exporting. --- ## [No data to display for the selected metrics should be shown for IP reputation when it does not have data](https://discuss.elastic.co/t/no-data-to-display-for-the-selected-metrics-should-be-shown-for-ip-reputation-when-it-does-not-have-data/307750)
**Author:** [@BalajeP](https://discuss.elastic.co/u/BalajeP)\ **Replies:** 3\ **Last updated:** [July 14, 2022, 10:38am UTC](https://discuss.elastic.co/t/no-data-to-display-for-the-selected-metrics-should-be-shown-for-ip-reputation-when-it-does-not-have-data/307750 "2022-07-14T10:38:40Z")
No data to display for the selected metrics should be shown for IP reputation when it does not have data The graph should be shown when having data ,if there is no data should shown no data to display. for this case not… --- ## [Ingesting surricata logs](https://discuss.elastic.co/t/ingesting-surricata-logs/309437)
**Author:** [@username82](https://discuss.elastic.co/u/username82)\ **Replies:** 12\ **Last updated:** [July 14, 2022, 9:12am UTC](https://discuss.elastic.co/t/ingesting-surricata-logs/309437 "2022-07-14T09:12:26Z")
Hi, I am trying to ingest surricata logs into ElasticStack. The architecture is as follows, Suricata\>\>\>FileBeat\>\>\>ElasticSearch\>\>\>Kibana I have followed this guide to letter. How To Build A SIEM with Suricata and Elas… --- ## [Watcher payload entries group together in the index](https://discuss.elastic.co/t/watcher-payload-entries-group-together-in-the-index/309622)
**Author:** [@Jacky\_Kwok](https://discuss.elastic.co/u/Jacky_Kwok)\ **Replies:** 0\ **Last updated:** [July 14, 2022, 9:12am UTC](https://discuss.elastic.co/t/watcher-payload-entries-group-together-in-the-index/309622 "2022-07-14T09:12:23Z")
I have used the transform which the output looks like this. "payload": { "\_doc": { "TransactionAmount": \[ 50000, 565 \], "CompanyName"… --- ## [Connection refused in cluster configuration](https://discuss.elastic.co/t/connection-refused-in-cluster-configuration/309293)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 1\ **Last updated:** [July 14, 2022, 9:03am UTC](https://discuss.elastic.co/t/connection-refused-in-cluster-configuration/309293 "2022-07-14T09:03:33Z")
I am using elasticsearch and have outgrown one server. Therefore, I would like to create a cluster configuration of two elasticsearch servers with the following manual. I have deployed elasticsearch on two servers, bu… --- ## [Pipeline - Create a delta field](https://discuss.elastic.co/t/pipeline-create-a-delta-field/309618)
**Author:** [@Ely\_96](https://discuss.elastic.co/u/Ely_96)\ **Replies:** 0\ **Last updated:** [July 14, 2022, 8:29am UTC](https://discuss.elastic.co/t/pipeline-create-a-delta-field/309618 "2022-07-14T08:29:50Z")
Hi Guys, I'm trying to study how to create a delta field: I mean a field that should contains a difference between 2 fields inside an existing index. So, I have 2 examples of CSVs: ID;Month;Date;Date\_string;Name;Surna… --- ## [Alternate to multi-terms aggregation in transform](https://discuss.elastic.co/t/alternate-to-multi-terms-aggregation-in-transform/309344)
**Author:** [@Robina\_Dhingra1](https://discuss.elastic.co/u/Robina_Dhingra1)\ **Replies:** 5\ **Last updated:** [July 14, 2022, 8:10am UTC](https://discuss.elastic.co/t/alternate-to-multi-terms-aggregation-in-transform/309344 "2022-07-14T08:10:46Z")
Hello Team ES, We have a use case where this transform works well for us.- PUT \_transform/tradebystatus { "source": { "index": \[ "latest-transactions" \] }, "pivot": { "group\_by": { "tradeD… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=864) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=866)