# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=927

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 928

---

## [Questions on migrating 8.2 for templates in Java](https://discuss.elastic.co/t/questions-on-migrating-8-2-for-templates-in-java/305507)

<div class="topic-metadata">

**Author:** [@Raushan](https://discuss.elastic.co/u/Raushan)\
**Replies:** 0\
**Last updated:** [May 24, 2022, 1:15pm UTC](https://discuss.elastic.co/t/questions-on-migrating-8-2-for-templates-in-java/305507 "2022-05-24T13:15:05Z")

</div>

Hi, I'm migrating from elastic client 7.5.2 to 8.2. From HLRC to RestClient I used to create Index template like this: PutIndexTemplateRequest request = new PutIndexTemplateRequest(templateName); request.source…

---

## [Error while upgrading cluster with helm](https://discuss.elastic.co/t/error-while-upgrading-cluster-with-helm/305562)

<div class="topic-metadata">

**Author:** [@akshay\_singh2](https://discuss.elastic.co/u/akshay_singh2)\
**Replies:** 0\
**Last updated:** [May 25, 2022, 6:42am UTC](https://discuss.elastic.co/t/error-while-upgrading-cluster-with-helm/305562 "2022-05-25T06:42:17Z")

</div>

I'm trying to upgrade Elasticsearch from 7.17.3 to 8.1.0 with helm chart, but with new helm chart its giving me error. Error: UPGRADE FAILED: template: elasticsearch/templates/statefulset.yaml:303:27: executing "elastic…

---

## [How do I read basic fields and apply them to a mark using Vega? (not vega-lite)](https://discuss.elastic.co/t/how-do-i-read-basic-fields-and-apply-them-to-a-mark-using-vega-not-vega-lite/305553)

<div class="topic-metadata">

**Author:** [@irwazr](https://discuss.elastic.co/u/irwazr)\
**Replies:** 0\
**Last updated:** [May 25, 2022, 3:52am UTC](https://discuss.elastic.co/t/how-do-i-read-basic-fields-and-apply-them-to-a-mark-using-vega-not-vega-lite/305553 "2022-05-25T03:52:08Z")

</div>

Hi everyone, We have a requirement to build a custom Vega visualisation, and I've read the Vega and Vega-Lite documentation on github through and through. I understand how to create amazing looking dashboards with it n…

---

## [Fail to read ssl configuration](https://discuss.elastic.co/t/fail-to-read-ssl-configuration/305477)

<div class="topic-metadata">

**Author:** [@devikingno](https://discuss.elastic.co/u/devikingno)\
**Replies:** 1\
**Last updated:** [May 25, 2022, 3:52am UTC](https://discuss.elastic.co/t/fail-to-read-ssl-configuration/305477 "2022-05-25T03:52:04Z")

</div>

Hi all!! I have problem when try to configure ssl and https for Elasticsearch, i have Elasticsearch container in my localhost. I use "docker-compose up -d" for start Elasticsearch container and exec to it by root user. …

---

## [Copying saved objects from ES 5 to 7](https://discuss.elastic.co/t/copying-saved-objects-from-es-5-to-7/305519)

<div class="topic-metadata">

**Author:** [@rsk0](https://discuss.elastic.co/u/rsk0)\
**Replies:** 4\
**Last updated:** [May 25, 2022, 3:01am UTC](https://discuss.elastic.co/t/copying-saved-objects-from-es-5-to-7/305519 "2022-05-25T03:01:10Z")

</div>

I see there's a process to upgrade from 5.6 to 6.8 to 7.17, but I need to keep this 5 cluster running while I build out our new 7; I'd like to be able to copy over any newly created 5 analysis content. I think trying to…

---

## [How do I generate a new CA with hostname?](https://discuss.elastic.co/t/how-do-i-generate-a-new-ca-with-hostname/305489)

<div class="topic-metadata">

**Author:** [@McLaine](https://discuss.elastic.co/u/McLaine)\
**Replies:** 2\
**Last updated:** [May 25, 2022, 3:16am UTC](https://discuss.elastic.co/t/how-do-i-generate-a-new-ca-with-hostname/305489 "2022-05-25T03:16:12Z")

</div>

Hello! I need a new http\_ca.crt file with the CN=hostname.net Instead of Subject: CN=Elasticsearch security auto-configuration HTTP CA. But how? Best Andy

---

## [Filebeat not read log, log msg "File didn't change"](https://discuss.elastic.co/t/filebeat-not-read-log-log-msg-file-didnt-change/305545)

<div class="topic-metadata">

**Author:** [@pi314](https://discuss.elastic.co/u/pi314)\
**Replies:** 1\
**Last updated:** [May 25, 2022, 2:37am UTC](https://discuss.elastic.co/t/filebeat-not-read-log-log-msg-file-didnt-change/305545 "2022-05-25T02:37:50Z")

</div>

Hi, I have configured filebeat to send a file to elastic but it is not happening, for some reason which I can not discover is not reading the file. This is my config: logging.level: debug logging.metrics.period: 1m log…

---

## [Upgrade Elastic Cloud 7.8.0 - 7.17.3](https://discuss.elastic.co/t/upgrade-elastic-cloud-7-8-0-7-17-3/305543)

<div class="topic-metadata">

**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Replies:** 2\
**Last updated:** [May 25, 2022, 1:23am UTC](https://discuss.elastic.co/t/upgrade-elastic-cloud-7-8-0-7-17-3/305543 "2022-05-25T01:23:55Z")

</div>

good day to all I have some doubts about updating the version of elastic cloud (Elasticsearch, kibana) from version 7.8.0 to 7.17.3, I would like to know if there are no problems with this extensive update to move from …

---

## [Aggregating matched tokens](https://discuss.elastic.co/t/aggregating-matched-tokens/305458)

<div class="topic-metadata">

**Author:** [@Pyppe](https://discuss.elastic.co/u/Pyppe)\
**Replies:** 3\
**Last updated:** [May 25, 2022, 12:23am UTC](https://discuss.elastic.co/t/aggregating-matched-tokens/305458 "2022-05-25T00:23:26Z")

</div>

Hi! Is there anyway to aggregate the "matched" tokens only for a particular field? Let's say we have a field where we tokenize it using whitespaces, and we have documents such as: "THE PINK PANTHER" "THE PUNK BAND" A…

---

## [Add a time field in elasticsearch and calculate time between two event](https://discuss.elastic.co/t/add-a-time-field-in-elasticsearch-and-calculate-time-between-two-event/305536)

<div class="topic-metadata">

**Author:** [@The-morpho](https://discuss.elastic.co/u/The-morpho)\
**Replies:** 0\
**Last updated:** [May 24, 2022, 6:25pm UTC](https://discuss.elastic.co/t/add-a-time-field-in-elasticsearch-and-calculate-time-between-two-event/305536 "2022-05-24T18:25:31Z")

</div>

I'm new to elasticsearch. I’m working with log files stored in Elasticsearch, that contains information about some operations on differents levels, I have a field timestamp that represents the time when each operation h…

---

## [Share dashboard](https://discuss.elastic.co/t/share-dashboard/305528)

<div class="topic-metadata">

**Author:** [@The-morpho](https://discuss.elastic.co/u/The-morpho)\
**Replies:** 6\
**Last updated:** [May 24, 2022, 10:48pm UTC](https://discuss.elastic.co/t/share-dashboard/305528 "2022-05-24T22:48:49Z")

</div>

Hello, I want to share a dashboard with a colleague who has not installed elk on his pc, is this possible. I have already sent him the link generated from the share option, but he can't access it.

---

## [I can't load all documents from csv file using python](https://discuss.elastic.co/t/i-cant-load-all-documents-from-csv-file-using-python/305419)

<div class="topic-metadata">

**Author:** [@safaeaz](https://discuss.elastic.co/u/safaeaz)\
**Replies:** 3\
**Last updated:** [May 24, 2022, 10:45pm UTC](https://discuss.elastic.co/t/i-cant-load-all-documents-from-csv-file-using-python/305419 "2022-05-24T22:45:40Z")

</div>

i'm trying to load csv file to Elasticsearch using python from elasticsearch import Elasticsearch, helpers import csv # Elastic search configuation es = Elasticsearch('http://IP:8081') # Creating index es.indices.cre…

---

## [How to enable Stack Monitoring option in current PROD env of Kibana 7.1.1?](https://discuss.elastic.co/t/how-to-enable-stack-monitoring-option-in-current-prod-env-of-kibana-7-1-1/305537)

<div class="topic-metadata">

**Author:** [@Roman\_Kagan](https://discuss.elastic.co/u/Roman_Kagan)\
**Replies:** 1\
**Last updated:** [May 24, 2022, 10:43pm UTC](https://discuss.elastic.co/t/how-to-enable-stack-monitoring-option-in-current-prod-env-of-kibana-7-1-1/305537 "2022-05-24T22:43:33Z")

</div>

Hello: I inherited the PROD environment of ELK 7.1.1. I do not see the Stack Monitoring option in Kibana. If I'd have the fresh install of the same version of ELK then I do see such an option. What am I missing or wh…

---

## [Uptime donut visualization monitor in canvas](https://discuss.elastic.co/t/uptime-donut-visualization-monitor-in-canvas/305542)

<div class="topic-metadata">

**Author:** [@dannie-ml](https://discuss.elastic.co/u/dannie-ml)\
**Replies:** 0\
**Last updated:** [May 24, 2022, 8:48pm UTC](https://discuss.elastic.co/t/uptime-donut-visualization-monitor-in-canvas/305542 "2022-05-24T20:48:47Z")

</div>

I want to retrieve something like we have in Uptime screen: I want to replicate in canvas in something like a wheel progress chart. I'm thinking firstly with 3 querys in the expression editor: based on the image: 1…

---

## [Error fetching data for metricset linux.pageinfo: error reading pagetypeinfo](https://discuss.elastic.co/t/error-fetching-data-for-metricset-linux-pageinfo-error-reading-pagetypeinfo/305104)

<div class="topic-metadata">

**Author:** [@jplindquist](https://discuss.elastic.co/u/jplindquist)\
**Replies:** 1\
**Last updated:** [May 24, 2022, 6:07pm UTC](https://discuss.elastic.co/t/error-fetching-data-for-metricset-linux-pageinfo-error-reading-pagetypeinfo/305104 "2022-05-24T18:07:13Z")

</div>

We are using metricbeat 7.17.3 as of this post, and are receiving an error on several systems which are configured to use the linux.pageinfo metricset, also reported here, but has since auto closed. May 17 15:38:58 exam…

---

## [Absolute newbee](https://discuss.elastic.co/t/absolute-newbee/304432)

<div class="topic-metadata">

**Author:** [@abls1](https://discuss.elastic.co/u/abls1)\
**Replies:** 3\
**Last updated:** [May 24, 2022, 5:53pm UTC](https://discuss.elastic.co/t/absolute-newbee/304432 "2022-05-24T17:53:00Z")

</div>

I need to connect the Elasticsearch to the indexes created by my crawler, then I need to be able to do searches on my main website, basically im building a general search website. Thanks for reading this

---

## [Elasticsearch Large Cluster Configuration Requirments](https://discuss.elastic.co/t/elasticsearch-large-cluster-configuration-requirments/305512)

<div class="topic-metadata">

**Author:** [@yangesh4u1](https://discuss.elastic.co/u/yangesh4u1)\
**Replies:** 4\
**Last updated:** [May 24, 2022, 4:33pm UTC](https://discuss.elastic.co/t/elasticsearch-large-cluster-configuration-requirments/305512 "2022-05-24T16:33:38Z")

</div>

Hi Team, I want to set up a new Elasticsearch cluster on-premises of minimum 3 master nodes and more than 6 data nodes . In our cluster we are ingesting around 100 GB of data per daily basis. And We want to keep 30 days…

---

## [Reindex Data Stream](https://discuss.elastic.co/t/reindex-data-stream/305529)

<div class="topic-metadata">

**Author:** [@teamomni](https://discuss.elastic.co/u/teamomni)\
**Replies:** 2\
**Last updated:** [May 24, 2022, 5:00pm UTC](https://discuss.elastic.co/t/reindex-data-stream/305529 "2022-05-24T17:00:40Z")

</div>

We have recently moved all of our Logstash indices to the current data stream, but we are getting errors using the same ingest pipeline to fix the variable types of the original data stream. The reindex command given: P…

---

## [Kibana create script field : concatenated strings with IF conditions](https://discuss.elastic.co/t/kibana-create-script-field-concatenated-strings-with-if-conditions/304955)

<div class="topic-metadata">

**Author:** [@Arthur\_Parkopoly](https://discuss.elastic.co/u/Arthur_Parkopoly)\
**Replies:** 4\
**Last updated:** [May 24, 2022, 2:58pm UTC](https://discuss.elastic.co/t/kibana-create-script-field-concatenated-strings-with-if-conditions/304955 "2022-05-24T14:58:35Z")

</div>

Hello to the community, I try to combine 2 date fields into a more meaning ful STRING scripted field based on conditions on the date to add "0" before 1 digit numbers ( May 2nd =\> 05-02). This script is refused and I d…

---

## [Logstash reads file with multiple lines as "1 hit"](https://discuss.elastic.co/t/logstash-reads-file-with-multiple-lines-as-1-hit/301191)

<div class="topic-metadata">

**Author:** [@RomanKau](https://discuss.elastic.co/u/RomanKau)\
**Replies:** 18\
**Last updated:** [May 24, 2022, 2:02pm UTC](https://discuss.elastic.co/t/logstash-reads-file-with-multiple-lines-as-1-hit/301191 "2022-05-24T14:02:21Z")

</div>

Running Windows 10, Logstash 8.1.0, Elasticsearch, kibana and filebeat 8.0.0 all on the same machine. Getting the data from logstash into elasticsearch and kibana works but when multiple files get read at the same time …

---

## [Logstash service started but no input](https://discuss.elastic.co/t/logstash-service-started-but-no-input/305472)

<div class="topic-metadata">

**Author:** [@CemG](https://discuss.elastic.co/u/CemG)\
**Replies:** 2\
**Last updated:** [May 24, 2022, 1:54pm UTC](https://discuss.elastic.co/t/logstash-service-started-but-no-input/305472 "2022-05-24T13:54:54Z")

</div>

Hello, I have tested Logstash with debug, every thing worked fine. Also tried to start logstash with /usr/share/logstash/bin/logstash and it worked. I have changed the logstash.service file to use pipeline because it wo…

---

## [Substring does not match with in a string](https://discuss.elastic.co/t/substring-does-not-match-with-in-a-string/305470)

<div class="topic-metadata">

**Author:** [@vinayrordev](https://discuss.elastic.co/u/vinayrordev)\
**Replies:** 1\
**Last updated:** [May 24, 2022, 1:27pm UTC](https://discuss.elastic.co/t/substring-does-not-match-with-in-a-string/305470 "2022-05-24T13:27:28Z")

</div>

I am working on search functionality using the Elasticsearch, I need to show result in dropdown if string or substring is match. right now query result be like if I type in input box test so result is test-load-1 te…

---

## [How to invert the y axis to start from 100% in bottom to 0% in top](https://discuss.elastic.co/t/how-to-invert-the-y-axis-to-start-from-100-in-bottom-to-0-in-top/305505)

<div class="topic-metadata">

**Author:** [@AlaaElbahrawy](https://discuss.elastic.co/u/AlaaElbahrawy)\
**Replies:** 0\
**Last updated:** [May 24, 2022, 12:51pm UTC](https://discuss.elastic.co/t/how-to-invert-the-y-axis-to-start-from-100-in-bottom-to-0-in-top/305505 "2022-05-24T12:51:13Z")

</div>

Hi, I'm facing a graph where data is almost near 100%. And i need a stacked bar chart to start from 100 in bottom to 0 in top just like the image is that possible?

---

## [Aggregating multiple values from single fields](https://discuss.elastic.co/t/aggregating-multiple-values-from-single-fields/305176)

<div class="topic-metadata">

**Author:** [@MarioRojas](https://discuss.elastic.co/u/MarioRojas)\
**Replies:** 4\
**Last updated:** [May 24, 2022, 12:43pm UTC](https://discuss.elastic.co/t/aggregating-multiple-values-from-single-fields/305176 "2022-05-24T12:43:10Z")

</div>

Hi all, I have some documents, where a given field can have one or several values (strings or numerical, not mixed though) and I wanted to know if it's possible to operate these, like count the number of values of one t…

---

## [Null values not showing on Dashboard](https://discuss.elastic.co/t/null-values-not-showing-on-dashboard/305503)

<div class="topic-metadata">

**Author:** [@behappy\_alwayz0401](https://discuss.elastic.co/u/behappy_alwayz0401)\
**Replies:** 0\
**Last updated:** [May 24, 2022, 12:31pm UTC](https://discuss.elastic.co/t/null-values-not-showing-on-dashboard/305503 "2022-05-24T12:31:05Z")

</div>

Hi, I have filtered for the same set of data for the same data range on Discover and Dashboard tabs. One of the fields in the data is Region. While Discover shows values for REgion as AMER, EMEA, ASIA and "-", Dashboard…

---

## [Logstash azure log analytics output - Failed to flush outgoing items - block in start\_workers](https://discuss.elastic.co/t/logstash-azure-log-analytics-output-failed-to-flush-outgoing-items-block-in-start-workers/305078)

<div class="topic-metadata">

**Author:** [@pavank](https://discuss.elastic.co/u/pavank)\
**Replies:** 6\
**Last updated:** [May 24, 2022, 12:29pm UTC](https://discuss.elastic.co/t/logstash-azure-log-analytics-output-failed-to-flush-outgoing-items-block-in-start-workers/305078 "2022-05-24T12:29:11Z")

</div>

Hi, I am using the redhat openshift logging operator provided fluentd forward to forward my logs to a Logstash instance, and using the azure log analytics output plugin to forward the logs to an Azure Log Analytics Work…

---

## [Mapping conflict with host.ip in filebeat](https://discuss.elastic.co/t/mapping-conflict-with-host-ip-in-filebeat/305502)

<div class="topic-metadata">

**Author:** [@PJ\_ceSofnI\_tseT](https://discuss.elastic.co/u/PJ_ceSofnI_tseT)\
**Replies:** 0\
**Last updated:** [May 24, 2022, 12:19pm UTC](https://discuss.elastic.co/t/mapping-conflict-with-host-ip-in-filebeat/305502 "2022-05-24T12:19:11Z")

</div>

Hi all, I am using filebeat on different hosts but on one of them a conflict has appeared for the host.ip field. This field appears to have the types: ip and text. This happens because both the IPv4 and IPv6 version…

---

## [Value of "elastic" is forbidden in Kibana 8.2](https://discuss.elastic.co/t/value-of-elastic-is-forbidden-in-kibana-8-2/305501)

<div class="topic-metadata">

**Author:** [@borisr84](https://discuss.elastic.co/u/borisr84)\
**Replies:** 0\
**Last updated:** [May 24, 2022, 12:04pm UTC](https://discuss.elastic.co/t/value-of-elastic-is-forbidden-in-kibana-8-2/305501 "2022-05-24T12:04:18Z")

</div>

Hi, after upgrading to ELK 8.2, I started getting some errors, some of which I was able to resolve for now, however the last error that keeps me stuck is the error of using "elastic" user. I'm getting the following erro…

---

## [Help me in configure filebeat index](https://discuss.elastic.co/t/help-me-in-configure-filebeat-index/305253)

<div class="topic-metadata">

**Author:** [@Rajesh119](https://discuss.elastic.co/u/Rajesh119)\
**Replies:** 21\
**Last updated:** [May 24, 2022, 11:58am UTC](https://discuss.elastic.co/t/help-me-in-configure-filebeat-index/305253 "2022-05-24T11:58:34Z")

</div>

i use this command, it will not shown my filebeat index curl http://localhost:9200/\_cat/indices?v And i use below command to know the status filebeat -e -c /etc/filebeat/filebeat.yml output: {"log.level":"info",…

---

## [Wanted to drop specific syslog message and syslog Client](https://discuss.elastic.co/t/wanted-to-drop-specific-syslog-message-and-syslog-client/305498)

<div class="topic-metadata">

**Author:** [@ashisharyan](https://discuss.elastic.co/u/ashisharyan)\
**Replies:** 0\
**Last updated:** [May 24, 2022, 11:56am UTC](https://discuss.elastic.co/t/wanted-to-drop-specific-syslog-message-and-syslog-client/305498 "2022-05-24T11:56:07Z")

</div>

Hi, I wanted to drop some specific syslog message and syslog client which should not be send to ELK. Below is the Logstash config file. we have tried but it is not working. So request if anyone can help me to get this …

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=926)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=928)
