# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=901 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 902 --- ## [Kibana upgrade failed\[8 -\> 8.2.2\]](https://discuss.elastic.co/t/kibana-upgrade-failed-8-8-2-2/305862)
**Author:** [@swchandu](https://discuss.elastic.co/u/swchandu)\ **Replies:** 4\ **Last updated:** [June 16, 2022, 8:40am UTC](https://discuss.elastic.co/t/kibana-upgrade-failed-8-8-2-2/305862 "2022-06-16T08:40:49Z")
Hi, I tried to migrate from 8 to 8.2.2 today on a dev machine. This is having lot of spaces and objects. As soon as I attempt, I landed into issues. The kibana migration has failed in mid. I have tried to search the d… --- ## [Set up Repository on multi-node Cluster via Ansible](https://discuss.elastic.co/t/set-up-repository-on-multi-node-cluster-via-ansible/307358)
**Author:** [@A\_j\_xx](https://discuss.elastic.co/u/A_j_xx)\ **Replies:** 0\ **Last updated:** [June 16, 2022, 8:27am UTC](https://discuss.elastic.co/t/set-up-repository-on-multi-node-cluster-via-ansible/307358 "2022-06-16T08:27:58Z")
Hi all, There are some doubts which i need to clarify on urgent basis : I know we can easily setup snapshot repository via kibana but what about from curl request ? Let us say i have multi node cluster , do i need to… --- ## [\[Urgent\] How to fix host issue in filebeat-7.17.4 without drop\_fields](https://discuss.elastic.co/t/urgent-how-to-fix-host-issue-in-filebeat-7-17-4-without-drop-fields/307353)
**Author:** [@mbmannubisht](https://discuss.elastic.co/u/mbmannubisht)\ **Replies:** 1\ **Last updated:** [June 16, 2022, 8:11am UTC](https://discuss.elastic.co/t/urgent-how-to-fix-host-issue-in-filebeat-7-17-4-without-drop-fields/307353 "2022-06-16T08:11:58Z")
Hi Team, Stuck in one issue if I drop\_fields of host then it will work otherwise not working Working condition code: - drop\_fields: fields: \["beat", "offset", "source", "type", "input\_type", "host"\] ignore… --- ## [Filter applied to specific data view (index pattern)](https://discuss.elastic.co/t/filter-applied-to-specific-data-view-index-pattern/304669)
**Author:** [@andersg](https://discuss.elastic.co/u/andersg)\ **Replies:** 4\ **Last updated:** [June 16, 2022, 7:58am UTC](https://discuss.elastic.co/t/filter-applied-to-specific-data-view-index-pattern/304669 "2022-06-16T07:58:22Z")
Hi, I find it powerful to mix content from different types of indexes in Kibana dashboards, but have a difficult time setting up useful dashboards because of global filtering. I do however want to use filters and add co… --- ## [Migrate Datastreams](https://discuss.elastic.co/t/migrate-datastreams/307357)
**Author:** [@EllBil](https://discuss.elastic.co/u/EllBil)\ **Replies:** 0\ **Last updated:** [June 16, 2022, 7:54am UTC](https://discuss.elastic.co/t/migrate-datastreams/307357 "2022-06-16T07:54:09Z")
Hello, I'm trying to migrate to a new server and a new cluster. My Data pipeline's output is being now on the new server, and I'm starting to receive data. However I can't restore my old data using \_reindex neither Ela… --- ## [GC issues causing high CPU](https://discuss.elastic.co/t/gc-issues-causing-high-cpu/307341)
**Author:** [@Shubham\_Singh](https://discuss.elastic.co/u/Shubham_Singh)\ **Replies:** 8\ **Last updated:** [June 16, 2022, 7:46am UTC](https://discuss.elastic.co/t/gc-issues-causing-high-cpu/307341 "2022-06-16T07:46:26Z")
Hello, I have setup a 2 node cluster for our production environment. We are using t3a.xlarge instance type. APM and log analysis is currently enabled for our cluster, observing high CPU frequently. Upon checking the log… --- ## [How to add multiple fields in cardinality](https://discuss.elastic.co/t/how-to-add-multiple-fields-in-cardinality/307274)
**Author:** [@NAVEEN\_MEENA](https://discuss.elastic.co/u/NAVEEN_MEENA)\ **Replies:** 1\ **Last updated:** [June 16, 2022, 7:16am UTC](https://discuss.elastic.co/t/how-to-add-multiple-fields-in-cardinality/307274 "2022-06-16T07:16:30Z")
Hi all , I have created a table visualization in kibana 7.7 and there are 2 metrics of unique count fields present in the table and one bucket .Let's say time1 and time2 are 2 metrics of unique count and let's say the n… --- ## [Log stash pipeline not connecting to Elasticsearch](https://discuss.elastic.co/t/log-stash-pipeline-not-connecting-to-elasticsearch/307259)
**Author:** [@harijld](https://discuss.elastic.co/u/harijld)\ **Replies:** 3\ **Last updated:** [June 16, 2022, 7:07am UTC](https://discuss.elastic.co/t/log-stash-pipeline-not-connecting-to-elasticsearch/307259 "2022-06-16T07:07:49Z")
HI, I am getting below error while establishing connection from logstash pipeline to Elasticsearch. I am able to do the telnet from logstash server to Elasticsearch server but not able to establish the connection. logs… --- ## [Log stash not connecting to Elasticsearch](https://discuss.elastic.co/t/log-stash-not-connecting-to-elasticsearch/307263)
**Author:** [@harijld](https://discuss.elastic.co/u/harijld)\ **Replies:** 4\ **Last updated:** [June 16, 2022, 7:01am UTC](https://discuss.elastic.co/t/log-stash-not-connecting-to-elasticsearch/307263 "2022-06-16T07:01:36Z")
Hi Team, my log stash is unable to connect Elastic search. Telnet is working fine but log stash pipeline is not able to create connection with Elasticsearch. input { stdin{} } output { elasticsearch { hosts =\> … --- ## [Multiple \_id for same document or document alias](https://discuss.elastic.co/t/multiple-id-for-same-document-or-document-alias/307296)
**Author:** [@nerd2000](https://discuss.elastic.co/u/nerd2000)\ **Replies:** 2\ **Last updated:** [June 16, 2022, 7:00am UTC](https://discuss.elastic.co/t/multiple-id-for-same-document-or-document-alias/307296 "2022-06-16T07:00:23Z")
Is it possible to have multiple ids for the same document or have a alias to a document? Already found this topic but a long time ago, checking if it was implemented meanwhile. The use case: I have a sql database with… --- ## [Which is better between Scroll and Search\_After when extract lots of document to other database?](https://discuss.elastic.co/t/which-is-better-between-scroll-and-search-after-when-extract-lots-of-document-to-other-database/307349)
**Author:** [@Haocheng\_Wang](https://discuss.elastic.co/u/Haocheng_Wang)\ **Replies:** 0\ **Last updated:** [June 16, 2022, 6:55am UTC](https://discuss.elastic.co/t/which-is-better-between-scroll-and-search-after-when-extract-lots-of-document-to-other-database/307349 "2022-06-16T06:55:19Z")
Hi community! I note that since 7.0, scroll is deprecated in deep pagination from the document But the document also said : the scroll API can be used to retrieve large numbers of results (or even all results) from a s… --- ## [\[Metricbeat\] metricbeat-metric pod keeps on crashing after deployment in kubernetes](https://discuss.elastic.co/t/metricbeat-metricbeat-metric-pod-keeps-on-crashing-after-deployment-in-kubernetes/307334)
**Author:** [@Charlie\_Guo](https://discuss.elastic.co/u/Charlie_Guo)\ **Replies:** 2\ **Last updated:** [June 16, 2022, 6:14am UTC](https://discuss.elastic.co/t/metricbeat-metricbeat-metric-pod-keeps-on-crashing-after-deployment-in-kubernetes/307334 "2022-06-16T06:14:26Z")
Hi Community, I have deployed the Metricbeat (v7.10.2) helm chart on the kubernetes. The deamonset pods and metricbeat-kube-state-metrics pod are running fine, but the metricbeat-metricbeat-metrics pod is keep on crashi… --- ## [Create drop-down control to select index pattern](https://discuss.elastic.co/t/create-drop-down-control-to-select-index-pattern/307331)
**Author:** [@eddieyee](https://discuss.elastic.co/u/eddieyee)\ **Replies:** 1\ **Last updated:** [June 16, 2022, 6:05am UTC](https://discuss.elastic.co/t/create-drop-down-control-to-select-index-pattern/307331 "2022-06-16T06:05:43Z")
Hi is this possible on the version 7.17.2 which I'm using? Or it can only be use to select the value of the field --- ## [Behavior when changing ILM policy](https://discuss.elastic.co/t/behavior-when-changing-ilm-policy/307344)
**Author:** [@Todd\_Lyons](https://discuss.elastic.co/u/Todd_Lyons)\ **Replies:** 1\ **Last updated:** [June 16, 2022, 5:51am UTC](https://discuss.elastic.co/t/behavior-when-changing-ilm-policy/307344 "2022-06-16T05:51:17Z")
On an ES 7.3 system: I have an index which gets created with 10 primary shards and 1 replica. I have an ILM policy which rolls over at 500GB, and then shrinks 10 days later to 5 shards and 0 replicas, expiring after 60… --- ## [IllegalArgumentException\[Unknown client name \[gcs\]](https://discuss.elastic.co/t/illegalargumentexception-unknown-client-name-gcs/307328)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 1\ **Last updated:** [June 16, 2022, 3:12am UTC](https://discuss.elastic.co/t/illegalargumentexception-unknown-client-name-gcs/307328 "2022-06-16T03:12:51Z")
Hello World! I'm trying to get started with Getting started | Elasticsearch Plugins and Integrations \[6.8\] | Elastic yet running into the following issue: { "error": { "root\_cause": \[ { "type": "rep… --- ## [Filebeat setup x509: certificate signed by unknown authority](https://discuss.elastic.co/t/filebeat-setup-x509-certificate-signed-by-unknown-authority/307068)
**Author:** [@Badr\_Atouhlaten](https://discuss.elastic.co/u/Badr_Atouhlaten)\ **Replies:** 3\ **Last updated:** [June 16, 2022, 3:45am UTC](https://discuss.elastic.co/t/filebeat-setup-x509-certificate-signed-by-unknown-authority/307068 "2022-06-16T03:45:33Z")
can some help i get the error below when i try to run "sudo filebeat setup" Loading dashboards (Kibana must be running and reachable) Exiting: error connecting to Kibana: fail to get the Kibana version: HTTP GET reques… --- ## [How to put ":" into if statement in filter?](https://discuss.elastic.co/t/how-to-put-into-if-statement-in-filter/307319)
**Author:** [@roman-tasi](https://discuss.elastic.co/u/roman-tasi)\ **Replies:** 2\ **Last updated:** [June 15, 2022, 10:59pm UTC](https://discuss.elastic.co/t/how-to-put-into-if-statement-in-filter/307319 "2022-06-15T22:59:32Z")
I am currently trying this: if ":" in dst { I also have tried ":" and ':' (backslash before the colon) but neither worked. Is it possible to still try this? --- ## [Elastic ODBC Driver](https://discuss.elastic.co/t/elastic-odbc-driver/307321)
**Author:** [@wwhcomau](https://discuss.elastic.co/u/wwhcomau)\ **Replies:** 0\ **Last updated:** [June 15, 2022, 9:57pm UTC](https://discuss.elastic.co/t/elastic-odbc-driver/307321 "2022-06-15T21:57:13Z")
What SQL Syntax is used by that driver? I have tried several options - they work, but the syntax does not resemble in full neither T-SQL (SQL Server) or Oracle SQL etc. --- ## [Rollup groups vs terms - how to filter and group by keyword terms?](https://discuss.elastic.co/t/rollup-groups-vs-terms-how-to-filter-and-group-by-keyword-terms/306940)
**Author:** [@jrykowski-huron](https://discuss.elastic.co/u/jrykowski-huron)\ **Replies:** 5\ **Last updated:** [June 15, 2022, 8:42pm UTC](https://discuss.elastic.co/t/rollup-groups-vs-terms-how-to-filter-and-group-by-keyword-terms/306940 "2022-06-15T20:42:03Z")
Perhaps I'm not understanding how terms work with rollups. Attempting to summarize metricbeat details into hourly rollup indexes, but when using the rollup index on a Lens the value of host.hostname.terms.value is just … --- ## [Query suggestion api](https://discuss.elastic.co/t/query-suggestion-api/307317)
**Author:** [@usman.os](https://discuss.elastic.co/u/usman.os)\ **Replies:** 0\ **Last updated:** [June 15, 2022, 8:24pm UTC](https://discuss.elastic.co/t/query-suggestion-api/307317 "2022-06-15T20:24:19Z")
I am using query suggestion to show auto complete, I need to pass filter to get more accurate data How i can achieve this? --- ## [Fleet server no data from other elastic agents](https://discuss.elastic.co/t/fleet-server-no-data-from-other-elastic-agents/307315)
**Author:** [@alex\_96](https://discuss.elastic.co/u/alex_96)\ **Replies:** 0\ **Last updated:** [June 15, 2022, 8:00pm UTC](https://discuss.elastic.co/t/fleet-server-no-data-from-other-elastic-agents/307315 "2022-06-15T20:00:27Z")
Hello, I recently installed elastic + kibana + elastic agent (all versions 7.17.4) on ubuntu 20.04, I have a cluster of one node with self-signed certificates, after setting up I installed elastic-agent (fleet server) ev… --- ## [Date Filter - \_dateparsefailure](https://discuss.elastic.co/t/date-filter-dateparsefailure/307199)
**Author:** [@yquirion](https://discuss.elastic.co/u/yquirion)\ **Replies:** 8\ **Last updated:** [June 15, 2022, 6:11pm UTC](https://discuss.elastic.co/t/date-filter-dateparsefailure/307199 "2022-06-15T18:11:46Z")
Dear all, I'm running into a strange problem converting syslogtimestamp field into @timestamp. After reading the thread: https://discuss.elastic.co/t/date-filter--dateparsefailure-solved/64692, I can't make it to work.… --- ## [How to identify source of the PCF logs in elastic stack](https://discuss.elastic.co/t/how-to-identify-source-of-the-pcf-logs-in-elastic-stack/307302)
**Author:** [@gpvikas145](https://discuss.elastic.co/u/gpvikas145)\ **Replies:** 2\ **Last updated:** [June 15, 2022, 5:30pm UTC](https://discuss.elastic.co/t/how-to-identify-source-of-the-pcf-logs-in-elastic-stack/307302 "2022-06-15T17:30:38Z")
Hi, I am trying to implement Elastic Stack for PCF environment where I have to two datacenters SCC, GCC . How to identify whether the log is from SCC or GCC --- ## [Error sql server to elasticsearch TLS10](https://discuss.elastic.co/t/error-sql-server-to-elasticsearch-tls10/307244)
**Author:** [@5k\_pwc](https://discuss.elastic.co/u/5k_pwc)\ **Replies:** 7\ **Last updated:** [June 15, 2022, 5:34pm UTC](https://discuss.elastic.co/t/error-sql-server-to-elasticsearch-tls10/307244 "2022-06-15T17:34:40Z")
I am trying to communicate with sqlserver with logstash, I used : java version "11.0.14" 2022-01-18 LTS Myfile.conf input { jdbc jdbc\_driver\_library =\> "C:\\Users\\Lenovo\\Desktop\\ELK\\logstash-8.1.0\\logstash-core\\lib… --- ## [Connecting to Elasticsearch from GUI using API and http security](https://discuss.elastic.co/t/connecting-to-elasticsearch-from-gui-using-api-and-http-security/307299)
**Author:** [@jamesp](https://discuss.elastic.co/u/jamesp)\ **Replies:** 2\ **Last updated:** [June 15, 2022, 5:07pm UTC](https://discuss.elastic.co/t/connecting-to-elasticsearch-from-gui-using-api-and-http-security/307299 "2022-06-15T17:07:09Z")
I am currently running ES 7.11.1 and have set up basic security using a self created ca, certificates for each ES node, and ssl.http for External API access. All nodes and Kibana connect and work without an issue. Howev… --- ## [Field for active/passive?](https://discuss.elastic.co/t/field-for-active-passive/307080)
**Author:** [@rsk0](https://discuss.elastic.co/u/rsk0)\ **Replies:** 2\ **Last updated:** [June 15, 2022, 4:56pm UTC](https://discuss.elastic.co/t/field-for-active-passive/307080 "2022-06-15T16:56:22Z")
In ECS Elastic Common Schema... Is there a field for indicating if a service (or anything) is active or passive? I tried looking through the spec but was unable to find anything. --- ## [Ruby filter to map different array elements into one record](https://discuss.elastic.co/t/ruby-filter-to-map-different-array-elements-into-one-record/307219)
**Author:** [@santhoshi.p](https://discuss.elastic.co/u/santhoshi.p)\ **Replies:** 1\ **Last updated:** [June 15, 2022, 4:48pm UTC](https://discuss.elastic.co/t/ruby-filter-to-map-different-array-elements-into-one-record/307219 "2022-06-15T16:48:58Z")
Hi, I have a response like below I'm unable to figure how i need to proceed further. Kindly provide any solution. Response: { "columns": \[ \[0\] { "label": "ICMP", "ingress": true }, \[1\] { "label": "ICMP", "ingr… --- ## [Number in 0,0a format downloading as text in CSV](https://discuss.elastic.co/t/number-in-0-0a-format-downloading-as-text-in-csv/307216)
**Author:** [@behappy\_alwayz0401](https://discuss.elastic.co/u/behappy_alwayz0401)\ **Replies:** 4\ **Last updated:** [June 15, 2022, 4:26pm UTC](https://discuss.elastic.co/t/number-in-0-0a-format-downloading-as-text-in-csv/307216 "2022-06-15T16:26:15Z")
Hi, this is an important feature request. We observe that Kibana gives the user the flexibility to display number in the format as 100k rather than 100,000. However, when a report of such kind is downloaded to CSV, the … --- ## [Logstash file input to file output is not working. No errors seen in the logs](https://discuss.elastic.co/t/logstash-file-input-to-file-output-is-not-working-no-errors-seen-in-the-logs/307273)
**Author:** [@rajivraghu](https://discuss.elastic.co/u/rajivraghu)\ **Replies:** 1\ **Last updated:** [June 15, 2022, 3:53pm UTC](https://discuss.elastic.co/t/logstash-file-input-to-file-output-is-not-working-no-errors-seen-in-the-logs/307273 "2022-06-15T15:53:55Z")
Hello, I am new to logstash. I am using 8.2.3. I dont have Elasticsearch running. I wanted to see if logstash is able to take log file as input and convert into json and store it in a file . This is my code below . in… --- ## [IDE/editor for logstash .conf files](https://discuss.elastic.co/t/ide-editor-for-logstash-conf-files/307303)
**Author:** [@hsalim](https://discuss.elastic.co/u/hsalim)\ **Replies:** 0\ **Last updated:** [June 15, 2022, 3:50pm UTC](https://discuss.elastic.co/t/ide-editor-for-logstash-conf-files/307303 "2022-06-15T15:50:37Z")
Hello, Is there a IDE or an editor for logstash pipeline development? i am currently using visual studio and was wondering if there is something else out there? i found this so far \[Logstash Editor - Visual Studio Mark… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=900) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=902)