# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=941 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 942 --- ## [Count occurrences of a variable term](https://discuss.elastic.co/t/count-occurrences-of-a-variable-term/304511)
**Author:** [@MobileOne](https://discuss.elastic.co/u/MobileOne)\ **Replies:** 6\ **Last updated:** [May 13, 2022, 6:24am UTC](https://discuss.elastic.co/t/count-occurrences-of-a-variable-term/304511 "2022-05-13T06:24:55Z")
In my logs I have a field "message" that has in it among other strings one term "UserID:" followed by a value. This value is mostly different in each document, but sometimes the same UserID is logged. I am trying to fi… --- ## [Select only buckets of working day](https://discuss.elastic.co/t/select-only-buckets-of-working-day/304553)
**Author:** [@imad\_orange](https://discuss.elastic.co/u/imad_orange)\ **Replies:** 1\ **Last updated:** [May 13, 2022, 6:04am UTC](https://discuss.elastic.co/t/select-only-buckets-of-working-day/304553 "2022-05-13T06:04:17Z")
Hello, I'm trying to calculate the average of documents by day (24h) for working days, i found that elastic calculate the average by this formula : avg = sum(docs of working days) / numberOfDays, and what i want is the … --- ## [Beats setup.template date format only accepts string, url, or date](https://discuss.elastic.co/t/beats-setup-template-date-format-only-accepts-string-url-or-date/304636)
**Author:** [@eddyariki](https://discuss.elastic.co/u/eddyariki)\ **Replies:** 0\ **Last updated:** [May 13, 2022, 5:46am UTC](https://discuss.elastic.co/t/beats-setup-template-date-format-only-accepts-string-url-or-date/304636 "2022-05-13T05:46:12Z")
In my filebeat configuration, I am trying to append a field of type date with a format specified. setup.template: overwrite: false append\_fields: - name: testfield type: date format: "dd/MMM/yyyy:HH:mm:ss … --- ## [Create Dashboards Dropdown](https://discuss.elastic.co/t/create-dashboards-dropdown/304574)
**Author:** [@dheeru11](https://discuss.elastic.co/u/dheeru11)\ **Replies:** 2\ **Last updated:** [May 13, 2022, 5:31am UTC](https://discuss.elastic.co/t/create-dashboards-dropdown/304574 "2022-05-13T05:31:04Z")
Hi I have around 10 dashboards already created. I want to have 1 single dashboard which has a dropdown option to select 1 dashboard name and display relevant dashboard data. How to design this ? Thanks, Dheeru --- ## [Change default timestamp field of Index](https://discuss.elastic.co/t/change-default-timestamp-field-of-index/304522)
**Author:** [@shivendra95](https://discuss.elastic.co/u/shivendra95)\ **Replies:** 2\ **Last updated:** [May 13, 2022, 3:20am UTC](https://discuss.elastic.co/t/change-default-timestamp-field-of-index/304522 "2022-05-13T03:20:03Z")
I have an index pattern in kibana whose timestamp is in UTC, I want to change this default timestamp to another date field. Is there a way to achieve this? --- ## [Logstash config Alertmanager](https://discuss.elastic.co/t/logstash-config-alertmanager/304483)
**Author:** [@linuxxin](https://discuss.elastic.co/u/linuxxin)\ **Replies:** 3\ **Last updated:** [May 13, 2022, 2:53am UTC](https://discuss.elastic.co/t/logstash-config-alertmanager/304483 "2022-05-13T02:53:19Z")
Log resolution using logstash configure keywords to send alarms to Alertmanager for email or Webhook notification --- ## [Cluster reovery failed and data node is not reachability](https://discuss.elastic.co/t/cluster-reovery-failed-and-data-node-is-not-reachability/304630)
**Author:** [@liuhuang9492](https://discuss.elastic.co/u/liuhuang9492)\ **Replies:** 0\ **Last updated:** [May 13, 2022, 2:02am UTC](https://discuss.elastic.co/t/cluster-reovery-failed-and-data-node-is-not-reachability/304630 "2022-05-13T02:02:26Z")
hi, I have run a Elasticsearch cluster in prd. it has 3 master node and 4 data node for version 2.1.1 it has a big index ,about 2.5TB and it only has 5 shards. The index is in translog state for a long time during inde… --- ## [Kibana not sorting by descending order](https://discuss.elastic.co/t/kibana-not-sorting-by-descending-order/304527)
**Author:** [@Jonas1](https://discuss.elastic.co/u/Jonas1)\ **Replies:** 3\ **Last updated:** [May 13, 2022, 1:18am UTC](https://discuss.elastic.co/t/kibana-not-sorting-by-descending-order/304527 "2022-05-13T01:18:02Z")
I clicked the arrow thats facing down but why is it not still in descending order? Please help --- ## [Logstash KV filter escape ":"](https://discuss.elastic.co/t/logstash-kv-filter-escape/304624)
**Author:** [@Jim\_Thunder](https://discuss.elastic.co/u/Jim_Thunder)\ **Replies:** 1\ **Last updated:** [May 12, 2022, 10:54pm UTC](https://discuss.elastic.co/t/logstash-kv-filter-escape/304624 "2022-05-12T22:54:26Z")
Hello, I have a message here (all message will be like this): {"Time": "2022-05-12T04:18:46.077", "HostName": "IBMNOAH", "Cat": "JOBLOG", "Severity": "Err", "SAF": 1, "SAFD": "RACF", "Name": "TEST", "JobName": "DBS1MST… --- ## [Date not converting to different timezone in painless](https://discuss.elastic.co/t/date-not-converting-to-different-timezone-in-painless/304535)
**Author:** [@shivendra95](https://discuss.elastic.co/u/shivendra95)\ **Replies:** 1\ **Last updated:** [May 12, 2022, 9:52pm UTC](https://discuss.elastic.co/t/date-not-converting-to-different-timezone-in-painless/304535 "2022-05-12T21:52:35Z")
Hi there, I have date field in UTC and want to convert that date in to a different timezone and display it. I created a new runtime field and made the type as date, but when I convert the date and emit it, the displaye… --- ## [Elasticsearch Watcher Painless error when trying to send email](https://discuss.elastic.co/t/elasticsearch-watcher-painless-error-when-trying-to-send-email/304614)
**Author:** [@Elasti\_Newbie](https://discuss.elastic.co/u/Elasti_Newbie)\ **Replies:** 1\ **Last updated:** [May 12, 2022, 8:56pm UTC](https://discuss.elastic.co/t/elasticsearch-watcher-painless-error-when-trying-to-send-email/304614 "2022-05-12T20:56:27Z")
Hi, I really need help at this point, I'm trying to set up a watcher that triggers an email alert whenever a file is changed (file integrity). The issue I'm having is trying to use a for loop on the script intended to … --- ## [How to disable kibana 7.17.3 TLS version 1.1](https://discuss.elastic.co/t/how-to-disable-kibana-7-17-3-tls-version-1-1/304437)
**Author:** [@Oskars\_Apinis](https://discuss.elastic.co/u/Oskars_Apinis)\ **Replies:** 1\ **Last updated:** [May 12, 2022, 9:30pm UTC](https://discuss.elastic.co/t/how-to-disable-kibana-7-17-3-tls-version-1-1/304437 "2022-05-12T21:30:58Z")
Hello! How to disable Kibana 7.17.3 TLS 1.1 ? I tryed to use this kibana configuration option server.ssl.supportedProtocols : \["TLSv1.2"\] and this not working. --- ## [Java API: how to access sub aggregations from FilterAggregate objects](https://discuss.elastic.co/t/java-api-how-to-access-sub-aggregations-from-filteraggregate-objects/301936)
**Author:** [@Tim\_Harbers](https://discuss.elastic.co/u/Tim_Harbers)\ **Replies:** 8\ **Last updated:** [May 12, 2022, 8:46pm UTC](https://discuss.elastic.co/t/java-api-how-to-access-sub-aggregations-from-filteraggregate-objects/301936 "2022-05-12T20:46:34Z")
I am in the process of migrating from the High Level REST API to the Java API. Although it is going ok despite not having many examples in the docs, there is one problem I can't figure out. When you send a search reques… --- ## [Expensive aggregation puts load onto a single data node](https://discuss.elastic.co/t/expensive-aggregation-puts-load-onto-a-single-data-node/304607)
**Author:** [@a06ced31bae02498a46d](https://discuss.elastic.co/u/a06ced31bae02498a46d)\ **Replies:** 0\ **Last updated:** [May 12, 2022, 4:32pm UTC](https://discuss.elastic.co/t/expensive-aggregation-puts-load-onto-a-single-data-node/304607 "2022-05-12T16:32:52Z")
Hello team! I've been trying to test our effective timeouts and crafted a special expensive query for that purpose. customer\_id field cardinality is hundreds of thousands – so you can imagine how expensive this aggregat… --- ## [Custom logs alert](https://discuss.elastic.co/t/custom-logs-alert/304357)
**Author:** [@Dhia\_Saibi](https://discuss.elastic.co/u/Dhia_Saibi)\ **Replies:** 4\ **Last updated:** [May 12, 2022, 8:08pm UTC](https://discuss.elastic.co/t/custom-logs-alert/304357 "2022-05-12T20:08:56Z")
Hi, I want to create a rule in kibana that checks if there is a new ip address (like in the picture) in the log file and sends an alert to mail if there is a new one --- ## [How to add custom Kibana Plugin App as Visualization Plugin in a Dashboard](https://discuss.elastic.co/t/how-to-add-custom-kibana-plugin-app-as-visualization-plugin-in-a-dashboard/303993)
**Author:** [@kashifqazi](https://discuss.elastic.co/u/kashifqazi)\ **Replies:** 1\ **Last updated:** [May 12, 2022, 7:25pm UTC](https://discuss.elastic.co/t/how-to-add-custom-kibana-plugin-app-as-visualization-plugin-in-a-dashboard/303993 "2022-05-12T19:25:06Z")
Hi all, I developed a custom Kibana Plugin App. It's a React App which is visualizing data queried from an Elasticsearch index in its React components. It also has buttons in it, e.g. for filtering and updating data. N… --- ## [I am getting an error with sharding along with some exceptions](https://discuss.elastic.co/t/i-am-getting-an-error-with-sharding-along-with-some-exceptions/304618)
**Author:** [@Rayhan\_Shaik](https://discuss.elastic.co/u/Rayhan_Shaik)\ **Replies:** 7\ **Last updated:** [May 12, 2022, 6:58pm UTC](https://discuss.elastic.co/t/i-am-getting-an-error-with-sharding-along-with-some-exceptions/304618 "2022-05-12T18:58:29Z")
Hi guys, I am new to ELK stack, I am getting an error in the Elasticsearch, and I am not sure how to fix this issue. can someone help me. thanks, Rayhan. --- ## [Field Parse Issue](https://discuss.elastic.co/t/field-parse-issue/304596)
**Author:** [@hasnainNM](https://discuss.elastic.co/u/hasnainNM)\ **Replies:** 4\ **Last updated:** [May 12, 2022, 6:43pm UTC](https://discuss.elastic.co/t/field-parse-issue/304596 "2022-05-12T18:43:20Z")
I have CSV field & logstash ins't parsing it entirely, i have the first few fields parsed correctly yet once it comes across console it seems to stop parsing. Any idea of fixes? Here is my code filter { csv { … --- ## [WARN \]\[logstash.inputs.rabbitmq \] Error while setting up connection for rabbitmq input!](https://discuss.elastic.co/t/warn-logstash-inputs-rabbitmq-error-while-setting-up-connection-for-rabbitmq-input/304611)
**Author:** [@lopa](https://discuss.elastic.co/u/lopa)\ **Replies:** 5\ **Last updated:** [May 12, 2022, 6:42pm UTC](https://discuss.elastic.co/t/warn-logstash-inputs-rabbitmq-error-while-setting-up-connection-for-rabbitmq-input/304611 "2022-05-12T18:42:19Z")
Hi, I'm using Logstash6.8.23 and Logstash consumes RabbitMQ message as expected. But Logstash continuously flooding with many warnings as "\[logstash.inputs.rabbitmq \] Error while setting up connection for rabbitmq inp… --- ## [How can I mapping index with nested fields by Java API Client?](https://discuss.elastic.co/t/how-can-i-mapping-index-with-nested-fields-by-java-api-client/304619)
**Author:** [@Anfalov](https://discuss.elastic.co/u/Anfalov)\ **Replies:** 0\ **Last updated:** [May 12, 2022, 6:20pm UTC](https://discuss.elastic.co/t/how-can-i-mapping-index-with-nested-fields-by-java-api-client/304619 "2022-05-12T18:20:35Z")
I'm trying to index simple "forumlike" document: question with list of answers, but in kibana i see that client ignore field of my class with List. I can't find any information about it so can you please give me link to … --- ## [Logstach is broken when using syslog pipeline](https://discuss.elastic.co/t/logstach-is-broken-when-using-syslog-pipeline/304584)
**Author:** [@sbocquet](https://discuss.elastic.co/u/sbocquet)\ **Replies:** 5\ **Last updated:** [May 12, 2022, 4:39pm UTC](https://discuss.elastic.co/t/logstach-is-broken-when-using-syslog-pipeline/304584 "2022-05-12T16:39:13Z")
Hi, I've just installed a brand new ElacticSearch v8.2 with Logstach. Both a talking well together. Kibana is installed too. Background server are Debian 11 up to date. I try to send all the logs I collect with a syslo… --- ## [Issue with restoring S3 snapshots - 403 InvalidObjectState](https://discuss.elastic.co/t/issue-with-restoring-s3-snapshots-403-invalidobjectstate/304608)
**Author:** [@leftyk](https://discuss.elastic.co/u/leftyk)\ **Replies:** 0\ **Last updated:** [May 12, 2022, 4:34pm UTC](https://discuss.elastic.co/t/issue-with-restoring-s3-snapshots-403-invalidobjectstate/304608 "2022-05-12T16:34:58Z")
We are taking snapshots on a Hitach S3 compatible Storage system - lately we are receiving multple errors for missing snapshots the root cause being: com.amazonaws.services.s3.model.AmazonS3Exception: The operation is n… --- ## [Update existing document](https://discuss.elastic.co/t/update-existing-document/304581)
**Author:** [@ChinigamiHunter](https://discuss.elastic.co/u/ChinigamiHunter)\ **Replies:** 2\ **Last updated:** [May 12, 2022, 4:24pm UTC](https://discuss.elastic.co/t/update-existing-document/304581 "2022-05-12T16:24:01Z")
I am facing the following issue with Elasticsearch and logstash. every day logstash create index with current date like : mydata\_2022.05.12 i have a index patterns name: mydata\_\* i get documents from api and index the… --- ## [Snapshot of system indexes no longer working](https://discuss.elastic.co/t/snapshot-of-system-indexes-no-longer-working/304063)
**Author:** [@UweW](https://discuss.elastic.co/u/UweW)\ **Replies:** 4\ **Last updated:** [May 12, 2022, 4:20pm UTC](https://discuss.elastic.co/t/snapshot-of-system-indexes-no-longer-working/304063 "2022-05-12T16:20:44Z")
Hi, I have snapshot which saves the system files like .kibana\* . This is no longer working since one of the latest updates. In my case with a pattern of .kibana\* only .kibana-event\* are saved. Nothing else. I see th… --- ## [Unique metric count status not showing correctly due to duplication of serverid within timerange](https://discuss.elastic.co/t/unique-metric-count-status-not-showing-correctly-due-to-duplication-of-serverid-within-timerange/304604)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 0\ **Last updated:** [May 12, 2022, 3:55pm UTC](https://discuss.elastic.co/t/unique-metric-count-status-not-showing-correctly-due-to-duplication-of-serverid-within-timerange/304604 "2022-05-12T15:55:32Z")
Hello All, I'm doing a use case where in I need to able to diaplay correct "unique count" of "idle" and "Active" session and server session count(IDLE+ACTIVE=Total Session).Here I'm unable to get unique count of "idle"… --- ## [Remove left whitespaces logstash](https://discuss.elastic.co/t/remove-left-whitespaces-logstash/304514)
**Author:** [@dannie-ml](https://discuss.elastic.co/u/dannie-ml)\ **Replies:** 7\ **Last updated:** [May 12, 2022, 4:01pm UTC](https://discuss.elastic.co/t/remove-left-whitespaces-logstash/304514 "2022-05-12T16:01:15Z")
Hi i have the following fields: "delivery\_quantity" : " \\s\\s\\s\\s4", "numerator" : "\\s\\s\\s1", "denominator" : "\\s\\s\\s1" I've tried to use mutate split and gsub but didnt work. I've seen that split works when you ha… --- ## [ILM Error while deleting ES index](https://discuss.elastic.co/t/ilm-error-while-deleting-es-index/304320)
**Author:** [@Aman\_Gupta1](https://discuss.elastic.co/u/Aman_Gupta1)\ **Replies:** 1\ **Last updated:** [May 12, 2022, 3:53pm UTC](https://discuss.elastic.co/t/ilm-error-while-deleting-es-index/304320 "2022-05-12T15:53:20Z")
Hi Team, I'm facing issue while deleteing index via ILM. description: i have index with name $webservicelogs\* ( where $webservice is name of actual services and after rotation it becomes webservicelogs2022.05.10 simila… --- ## [Mappings types](https://discuss.elastic.co/t/mappings-types/304477)
**Author:** [@hebph001](https://discuss.elastic.co/u/hebph001)\ **Replies:** 10\ **Last updated:** [May 12, 2022, 3:30pm UTC](https://discuss.elastic.co/t/mappings-types/304477 "2022-05-12T15:30:56Z")
Hi Elastic community, I'm having a hard time figuring out what is wrong with my index template configuration, but Kibana shows me a message of "mapping types for this template uses types, which have been removed". I don… --- ## [How to set routing allocation on the filebeat template](https://discuss.elastic.co/t/how-to-set-routing-allocation-on-the-filebeat-template/304601)
**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\ **Replies:** 0\ **Last updated:** [May 12, 2022, 3:22pm UTC](https://discuss.elastic.co/t/how-to-set-routing-allocation-on-the-filebeat-template/304601 "2022-05-12T15:22:23Z")
I use ECK and i have filebeat setup. I have 3 nodeset Elasticsearch cluster, one which is named "monitoring" i have defined the node attri according to the following docs (Index-level shard allocation filtering | Elastic… --- ## [Search template can not parser data in geoshape search](https://discuss.elastic.co/t/search-template-can-not-parser-data-in-geoshape-search/304446)
**Author:** [@yeziblo](https://discuss.elastic.co/u/yeziblo)\ **Replies:** 7\ **Last updated:** [May 12, 2022, 2:42pm UTC](https://discuss.elastic.co/t/search-template-can-not-parser-data-in-geoshape-search/304446 "2022-05-12T14:42:51Z")
Hi everyone. I just set a search template like: POST \_scripts/geoshape\_search { "script": { "lang": "mustache", "source": { "query": { "geo\_shape": { "geo\_json": { "shape": { "type": "point", "coordinates": … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=940) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=942)