# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=940 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 941 --- ## [Substring logstash](https://discuss.elastic.co/t/substring-logstash/304710)
**Author:** [@mvasqueznr](https://discuss.elastic.co/u/mvasqueznr)\ **Replies:** 1\ **Last updated:** [May 13, 2022, 6:53pm UTC](https://discuss.elastic.co/t/substring-logstash/304710 "2022-05-13T18:53:52Z")
Hi. Im use grok patterns to extract info from Palo Alto log. But im try to extract a substring on description field like this authenticated for user 'newUser'. auth profile 'D', server profile 'LTY', server address … --- ## [How do I transfer certificate from one cluster to another?](https://discuss.elastic.co/t/how-do-i-transfer-certificate-from-one-cluster-to-another/304703)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 1\ **Last updated:** [May 13, 2022, 6:21pm UTC](https://discuss.elastic.co/t/how-do-i-transfer-certificate-from-one-cluster-to-another/304703 "2022-05-13T18:21:57Z")
Hi Team, I need to move data from my single node cluster to another. I have around 80 Windows servers which are connected to Elasticsearch through elastic agent and this communication I believe happens through certifica… --- ## [ElasticSearch cluster design](https://discuss.elastic.co/t/elasticsearch-cluster-design/304707)
**Author:** [@Rayyanalbaz](https://discuss.elastic.co/u/Rayyanalbaz)\ **Replies:** 1\ **Last updated:** [May 13, 2022, 6:11pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-design/304707 "2022-05-13T18:11:49Z")
Hello Elastic Team/Community I’m currently in the process of designing a cluster that has 3 nodes. I was a bit confused on how will the requests be sent to the cluster. Should I be targeting the master node? Or split … --- ## [Help me under lifecycle policies with namespaces](https://discuss.elastic.co/t/help-me-under-lifecycle-policies-with-namespaces/304704)
**Author:** [@ARDiver86](https://discuss.elastic.co/u/ARDiver86)\ **Replies:** 0\ **Last updated:** [May 13, 2022, 5:49pm UTC](https://discuss.elastic.co/t/help-me-under-lifecycle-policies-with-namespaces/304704 "2022-05-13T17:49:41Z")
I am having a very difficult time understanding the workflow with index aliases. I understand ILM as what it is doing with the indexes with shrinking shards, moving to warm/cold/frozen tiers and deleting after X amount o… --- ## [Logstash parse PDF from S3](https://discuss.elastic.co/t/logstash-parse-pdf-from-s3/304700)
**Author:** [@vsangam](https://discuss.elastic.co/u/vsangam)\ **Replies:** 0\ **Last updated:** [May 13, 2022, 4:56pm UTC](https://discuss.elastic.co/t/logstash-parse-pdf-from-s3/304700 "2022-05-13T16:56:06Z")
Hi, I have few files in s3 bucket. They are all PDF. Can I use S3 plugin to extract content from those PDF files. If not, is there any way to parse the PDF files from S3.... Please help. Thanks, Vsangam --- ## [Using Java API Client with Elasticsearch 7.17.0?](https://discuss.elastic.co/t/using-java-api-client-with-elasticsearch-7-17-0/304680)
**Author:** [@sbrunot](https://discuss.elastic.co/u/sbrunot)\ **Replies:** 1\ **Last updated:** [May 13, 2022, 4:54pm UTC](https://discuss.elastic.co/t/using-java-api-client-with-elasticsearch-7-17-0/304680 "2022-05-13T16:54:08Z")
Hello, is there a way to use the Java API Client 7.17.3 with Elasticsearch 7.17.0 (a backward compatibility mode ?) Thanks for your help. --- ## [Multiline with type filestram](https://discuss.elastic.co/t/multiline-with-type-filestram/304695)
**Author:** [@adrianfusco](https://discuss.elastic.co/u/adrianfusco)\ **Replies:** 0\ **Last updated:** [May 13, 2022, 3:02pm UTC](https://discuss.elastic.co/t/multiline-with-type-filestram/304695 "2022-05-13T15:02:44Z")
Hello, I see type:log is going to be deprecated (Log input | Filebeat Reference \[8.2\] | Elastic) and we should use filestream instead of this one. I'm trying to parse some output from ansible. A very simple basic examp… --- ## [Azure snapshot settings/plugins for elasticsearch version 7.x](https://discuss.elastic.co/t/azure-snapshot-settings-plugins-for-elasticsearch-version-7-x/304617)
**Author:** [@Yashwant\_Shettigar](https://discuss.elastic.co/u/Yashwant_Shettigar)\ **Replies:** 0\ **Last updated:** [May 12, 2022, 6:08pm UTC](https://discuss.elastic.co/t/azure-snapshot-settings-plugins-for-elasticsearch-version-7-x/304617 "2022-05-12T18:08:05Z")
Hi Folks, Recently, I upgraded my elastic cluster to version from 6.8 to 7.17. Now due to deprecation warnings for upgrade, we disabled azure snapshots settings in elasticsearch.yml file and now I am not getting the s… --- ## [Error when accessing Security module on Elasticsearch 8.1 (Error: n is undefined)](https://discuss.elastic.co/t/error-when-accessing-security-module-on-elasticsearch-8-1-error-n-is-undefined/301278)
**Author:** [@aanton](https://discuss.elastic.co/u/aanton)\ **Replies:** 4\ **Last updated:** [May 13, 2022, 2:10pm UTC](https://discuss.elastic.co/t/error-when-accessing-security-module-on-elasticsearch-8-1-error-n-is-undefined/301278 "2022-05-13T14:10:07Z")
Greetings, When trying to access the Security module on Kibana for the Elasticsearch 8.1, I get the following error: Error Error: n is undefined c@http://127.0.0.1:5601/50609/bundles/plugin/securitySolution/8.0.0/sec… --- ## [Index clone v.s. ILM](https://discuss.elastic.co/t/index-clone-v-s-ilm/304135)
**Author:** [@nisow95612](https://discuss.elastic.co/u/nisow95612)\ **Replies:** 1\ **Last updated:** [May 13, 2022, 1:27pm UTC](https://discuss.elastic.co/t/index-clone-v-s-ilm/304135 "2022-05-13T13:27:53Z")
Hello nice people of Elasticsearch, what is the proper way to apply ILM to cloned indices? I know I can set index.lifecycle.origination\_date so ILM knows how old data is, but that often causes the index to go through … --- ## [How to disable geoip usage in 7.16.2](https://discuss.elastic.co/t/how-to-disable-geoip-usage-in-7-16-2/304676)
**Author:** [@rachit\_upadhyay](https://discuss.elastic.co/u/rachit_upadhyay)\ **Replies:** 1\ **Last updated:** [May 13, 2022, 1:13pm UTC](https://discuss.elastic.co/t/how-to-disable-geoip-usage-in-7-16-2/304676 "2022-05-13T13:13:56Z")
Hi, I want to disable the usage of geoip functionality because I have no usage for it. I have a three node cluster, which works fine with one voting only node and two master eligible and data nodes. The Elasticsearch ve… --- ## [Upgrade from version 7.17.3 to 8.1.3 can't get past xpack logging error in upgrade assistant](https://discuss.elastic.co/t/upgrade-from-version-7-17-3-to-8-1-3-cant-get-past-xpack-logging-error-in-upgrade-assistant/304616)
**Author:** [@Moxey](https://discuss.elastic.co/u/Moxey)\ **Replies:** 4\ **Last updated:** [May 13, 2022, 12:10pm UTC](https://discuss.elastic.co/t/upgrade-from-version-7-17-3-to-8-1-3-cant-get-past-xpack-logging-error-in-upgrade-assistant/304616 "2022-05-13T12:10:49Z")
Upgrade deployment Generally available versions 8.1.3 selected Error: Your changes cannot be applied Kibana - 'xpack.security.audit.appender.type' is not allowed Upgrade is greyed out. This is not a just a warning… --- ## [Data Table - Max Bucket Limit - too\_many\_buckets\_exception](https://discuss.elastic.co/t/data-table-max-bucket-limit-too-many-buckets-exception/304342)
**Author:** [@sasank.vemana](https://discuss.elastic.co/u/sasank.vemana)\ **Replies:** 2\ **Last updated:** [May 13, 2022, 11:46am UTC](https://discuss.elastic.co/t/data-table-max-bucket-limit-too-many-buckets-exception/304342 "2022-05-13T11:46:07Z")
"Trying to create too many buckets. Must be less than or equal to: \[65535\] but was \[65536\]. This limit can be set by changing the \[search.max\_buckets\] cluster level setting." When working with a data table, we run into … --- ## [Index paramétrer mais pas fonctionnel](https://discuss.elastic.co/t/index-parametrer-mais-pas-fonctionnel/304573)
**Author:** [@Deix42](https://discuss.elastic.co/u/Deix42)\ **Replies:** 1\ **Last updated:** [May 13, 2022, 10:26am UTC](https://discuss.elastic.co/t/index-parametrer-mais-pas-fonctionnel/304573 "2022-05-13T10:26:44Z")
Bonjour à tous ! Débutant dans Elasticsearch et dans les bases de données, pour un projet j'ai fais une configuration avec filebeat qui envoie les informations directement à Elasticsearch. Le fichier que j'envoie est de… --- ## [ELK Kibana Angular](https://discuss.elastic.co/t/elk-kibana-angular/304555)
**Author:** [@Farah\_Bhr](https://discuss.elastic.co/u/Farah_Bhr)\ **Replies:** 2\ **Last updated:** [May 13, 2022, 10:10am UTC](https://discuss.elastic.co/t/elk-kibana-angular/304555 "2022-05-13T10:10:30Z")
Hello I am a beginner in Elastic I want to ask if I can create an authentication interface with angular , so that an admin add users who can and interact with dashboards of kibana I mean can I integrate elk in a whole… --- ## [How does the kibana "search profiler" "Query Profile" timing work?](https://discuss.elastic.co/t/how-does-the-kibana-search-profiler-query-profile-timing-work/304600)
**Author:** [@stefan.tolksdorf](https://discuss.elastic.co/u/stefan.tolksdorf)\ **Replies:** 2\ **Last updated:** [May 13, 2022, 9:38am UTC](https://discuss.elastic.co/t/how-does-the-kibana-search-profiler-query-profile-timing-work/304600 "2022-05-13T09:38:42Z")
I use version 7.13.1 Query I profile { "query": { "bool": { "must": \[ { "match": { "title": "logstash" } } \], "must\_not": \[ { "m… --- ## [Problem fixing index to realize a scroll with Typescript, node and Express](https://discuss.elastic.co/t/problem-fixing-index-to-realize-a-scroll-with-typescript-node-and-express/304543)
**Author:** [@Vincent92](https://discuss.elastic.co/u/Vincent92)\ **Replies:** 1\ **Last updated:** [May 13, 2022, 8:41am UTC](https://discuss.elastic.co/t/problem-fixing-index-to-realize-a-scroll-with-typescript-node-and-express/304543 "2022-05-13T08:41:32Z")
Hello, I'm new to elastic and I have an issue using scroll method. I've started the development of a small project in Typescript to complete some of Kibana's features and to simplify some actions on the front-end. I u… --- ## [FunctionBeat integration with OpenSearch AWS](https://discuss.elastic.co/t/functionbeat-integration-with-opensearch-aws/304650)
**Author:** [@Thuunder7](https://discuss.elastic.co/u/Thuunder7)\ **Replies:** 1\ **Last updated:** [May 13, 2022, 8:32am UTC](https://discuss.elastic.co/t/functionbeat-integration-with-opensearch-aws/304650 "2022-05-13T08:32:51Z")
Hello guys, I want to ask if somebody has used FunctionBeat to ingest/integrate with OpenSearch from AWS? What i want to accomplish is this: OpenSearch -\> logstash -\> Elasticsearch (running on azure) I have no experi… --- ## [Problem with date filter](https://discuss.elastic.co/t/problem-with-date-filter/304261)
**Author:** [@Thuunder7](https://discuss.elastic.co/u/Thuunder7)\ **Replies:** 5\ **Last updated:** [May 13, 2022, 8:29am UTC](https://discuss.elastic.co/t/problem-with-date-filter/304261 "2022-05-13T08:29:08Z")
Hello, I have been trying to use the date filter plugin but without success. I am trying to parse a field and target it into @timestamp field. My message field contains a date string like the following: 2022-05-09 09:… --- ## [Logstash running on machine has high load average](https://discuss.elastic.co/t/logstash-running-on-machine-has-high-load-average/304321)
**Author:** [@Thuunder7](https://discuss.elastic.co/u/Thuunder7)\ **Replies:** 3\ **Last updated:** [May 13, 2022, 8:28am UTC](https://discuss.elastic.co/t/logstash-running-on-machine-has-high-load-average/304321 "2022-05-13T08:28:15Z")
Hello guys, I am currently running into some issues regarding the usage of logstash. I am using the following architecture: kafka -\> logstash -\> elasticsearch We have 3 kafka brokers running on separated machines, 2 l… --- ## [Error upgrade 8.2](https://discuss.elastic.co/t/error-upgrade-8-2/304594)
**Author:** [@jojodd](https://discuss.elastic.co/u/jojodd)\ **Replies:** 2\ **Last updated:** [May 13, 2022, 8:04am UTC](https://discuss.elastic.co/t/error-upgrade-8-2/304594 "2022-05-13T08:04:32Z")
How can I fix this error that occurs after installing the new version of kibana ? \[FATAL\]\[root\] Error: Unable to complete saved object migrations for the \[.kibana\] index: The Elasticsearch cluster has cluster routing al… --- ## [Logstash indexing Error](https://discuss.elastic.co/t/logstash-indexing-error/304627)
**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Replies:** 2\ **Last updated:** [May 13, 2022, 7:57am UTC](https://discuss.elastic.co/t/logstash-indexing-error/304627 "2022-05-13T07:57:32Z")
Dear Team, while indexing the logs from wazuh to logstash and from logstash while indexing to ES getting the error Attempted to send a bulk request but Elasticsearch appears to be unreachable or down {:message=\>"Elasti… --- ## [Is it possible to extract value of data within a field in Kibana?](https://discuss.elastic.co/t/is-it-possible-to-extract-value-of-data-within-a-field-in-kibana/304626)
**Author:** [@thiton](https://discuss.elastic.co/u/thiton)\ **Replies:** 1\ **Last updated:** [May 13, 2022, 7:47am UTC](https://discuss.elastic.co/t/is-it-possible-to-extract-value-of-data-within-a-field-in-kibana/304626 "2022-05-13T07:47:29Z")
Hi, I am trying to extract value of data with a field, but no luck. Please help. Many thanks in advance. For example, I run below script to get the data GET xx-prod-transaction-\*/\_search { "query": { "bool"… --- ## [Reindex text field script manipulation](https://discuss.elastic.co/t/reindex-text-field-script-manipulation/304376)
**Author:** [@Wesley\_Acheson](https://discuss.elastic.co/u/Wesley_Acheson)\ **Replies:** 1\ **Last updated:** [May 13, 2022, 7:37am UTC](https://discuss.elastic.co/t/reindex-text-field-script-manipulation/304376 "2022-05-13T07:37:01Z")
Hi, We have been indexing some documents for some time now. Unfortunately one of the text fields is incorrect. However the correct value of the field does appear as a substring within the document. On a basic level … --- ## [ELastic query](https://discuss.elastic.co/t/elastic-query/304645)
**Author:** [@nandalapadu\_shamriya](https://discuss.elastic.co/u/nandalapadu_shamriya)\ **Replies:** 0\ **Last updated:** [May 13, 2022, 7:18am UTC](https://discuss.elastic.co/t/elastic-query/304645 "2022-05-13T07:18:34Z")
is there a way to acheive this using elastic query builders for java select id1,IF (count(id2)\>0,count(id2),id2\_name) as id2 from index where id1\_name = 'xxxxxx' and id\_code=2 group by id1 --- ## [Avoid multiple indicies due to versions of auditbeat](https://discuss.elastic.co/t/avoid-multiple-indicies-due-to-versions-of-auditbeat/304644)
**Author:** [@Ulrik](https://discuss.elastic.co/u/Ulrik)\ **Replies:** 0\ **Last updated:** [May 13, 2022, 7:08am UTC](https://discuss.elastic.co/t/avoid-multiple-indicies-due-to-versions-of-auditbeat/304644 "2022-05-13T07:08:35Z")
We are using fleet with Endpoint Security and System integrations, both integrations have default namespace, the result from this is that we gets 2 indicies each day auditbeat-6.8.23-2022.05.13 and auditbeat-6.8.11-2022.… --- ## [Your search products doesn't exist](https://discuss.elastic.co/t/your-search-products-doesnt-exist/304531)
**Author:** [@RohitBR\_K](https://discuss.elastic.co/u/RohitBR_K)\ **Replies:** 1\ **Last updated:** [May 13, 2022, 7:05am UTC](https://discuss.elastic.co/t/your-search-products-doesnt-exist/304531 "2022-05-13T07:05:46Z")
I need to show your searched products not found if a product doesn't exist in database .Here , am using Elasticsearch for searching , if I type a product not in database it will show some other words matched product but … --- ## [Multi terms aggregation](https://discuss.elastic.co/t/multi-terms-aggregation/304345)
**Author:** [@meyer1](https://discuss.elastic.co/u/meyer1)\ **Replies:** 5\ **Last updated:** [May 13, 2022, 7:01am UTC](https://discuss.elastic.co/t/multi-terms-aggregation/304345 "2022-05-13T07:01:17Z")
Hello everyone, I need help with an elastic query. My current query is: { "size" : 1, "aggs": { "NAME": { "multi\_terms": { "terms": \[{ "field": "fieldName1.keyword" }, { … --- ## [Cumulative Cardinality](https://discuss.elastic.co/t/cumulative-cardinality/304351)
**Author:** [@walshe06](https://discuss.elastic.co/u/walshe06)\ **Replies:** 1\ **Last updated:** [May 13, 2022, 6:53am UTC](https://discuss.elastic.co/t/cumulative-cardinality/304351 "2022-05-13T06:53:05Z")
Hi all I am looking to count the number of unique referer values over a specified time period (range) so that I can compare that to the count of referer values within a 15 minute interval using a bucket aggregation. I t… --- ## [Terms Aggregation and get latest document](https://discuss.elastic.co/t/terms-aggregation-and-get-latest-document/304453)
**Author:** [@Liam\_B](https://discuss.elastic.co/u/Liam_B)\ **Replies:** 1\ **Last updated:** [May 13, 2022, 6:40am UTC](https://discuss.elastic.co/t/terms-aggregation-and-get-latest-document/304453 "2022-05-13T06:40:31Z")
Hi I am currently performing a search api call and that aggregates on a field and this works great, it gives me a list of terms and a count of those terms. How would I go about supplementing the search response, with a… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=939) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=941)