# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=944 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 945 --- ## [Merging 2 log lines into 1](https://discuss.elastic.co/t/merging-2-log-lines-into-1/304370)
**Author:** [@hNiven](https://discuss.elastic.co/u/hNiven)\ **Replies:** 5\ **Last updated:** [May 11, 2022, 8:31am UTC](https://discuss.elastic.co/t/merging-2-log-lines-into-1/304370 "2022-05-11T08:31:20Z")
Hi, I am looking at 2 indices that have 1 field in common and then different fields. Would it be possible to merge them into 1 log line using the similar field? Using the example above, both lines have the same value… --- ## [Multiple Dashboards for real time data](https://discuss.elastic.co/t/multiple-dashboards-for-real-time-data/303372)
**Author:** [@anushka1203](https://discuss.elastic.co/u/anushka1203)\ **Replies:** 5\ **Last updated:** [May 11, 2022, 8:42am UTC](https://discuss.elastic.co/t/multiple-dashboards-for-real-time-data/303372 "2022-05-11T08:42:36Z")
I have a multiple units numbered (1,2,3...) each unit has multiple type of log files(such as opereational, selinux audit, access & error) is it possible to create a UI on kibana that has a dashboard displaying all these… --- ## [How to add Document View to a Dashboard](https://discuss.elastic.co/t/how-to-add-document-view-to-a-dashboard/304072)
**Author:** [@paolovalladolid](https://discuss.elastic.co/u/paolovalladolid)\ **Replies:** 5\ **Last updated:** [May 11, 2022, 8:41am UTC](https://discuss.elastic.co/t/how-to-add-document-view-to-a-dashboard/304072 "2022-05-11T08:41:24Z")
In Discover, there is a document table that always appears. It never appears on my Dashboard even though I saved the query in Discover, and loaded the query for my Dashboard. What else must I do? I set doc\_table:lega… --- ## [Metricbeat sql module - specify database name when connecting to MSSQL](https://discuss.elastic.co/t/metricbeat-sql-module-specify-database-name-when-connecting-to-mssql/304336)
**Author:** [@ianufurnish.com](https://discuss.elastic.co/u/ianufurnish.com)\ **Replies:** 8\ **Last updated:** [May 11, 2022, 8:35am UTC](https://discuss.elastic.co/t/metricbeat-sql-module-specify-database-name-when-connecting-to-mssql/304336 "2022-05-11T08:35:26Z")
According to the documentation, it doesn't appear to be possible to specify the database name when connecting to Microsoft SQL. I'd like to use this module to connect to Azure SQL in order to run a query against a databa… --- ## [Logstash Multi Output and selective Information](https://discuss.elastic.co/t/logstash-multi-output-and-selective-information/304431)
**Author:** [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\ **Replies:** 0\ **Last updated:** [May 11, 2022, 8:25am UTC](https://discuss.elastic.co/t/logstash-multi-output-and-selective-information/304431 "2022-05-11T08:25:40Z")
input { http { host =\> "0.0.0.0" # default: 0.0.0.0 port =\> 0000 # default: 8080 } } filter { urldecode { all\_fields =\> true } } filter { mutate { gsub =\> \[ "message", "\\\]", "}", "message", "\\\[", "{" \] } … --- ## [\_tier\_preference setting](https://discuss.elastic.co/t/tier-preference-setting/303907)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 2\ **Last updated:** [May 11, 2022, 8:03am UTC](https://discuss.elastic.co/t/tier-preference-setting/303907 "2022-05-11T08:03:14Z")
Hi Can You explain me why below index showing \_tier\_preference": "data\_cold,data\_warm,data\_hot" after moving from data warm to data cold tier? I need to store such kind of index due to life policy only in particular dat… --- ## [.Net client socket error after many inserts](https://discuss.elastic.co/t/net-client-socket-error-after-many-inserts/304088)
**Author:** [@r03](https://discuss.elastic.co/u/r03)\ **Replies:** 3\ **Last updated:** [May 10, 2022, 3:47pm UTC](https://discuss.elastic.co/t/net-client-socket-error-after-many-inserts/304088 "2022-05-10T15:47:35Z")
I'm trying to create documents in Elastic with the .Net client. (7.17.1 on server 8.1.3) This works, but on the first sync I have many documents and after a lot of successul inserts the elastic client stops working. I … --- ## [Dashboard with a graph problem with datetime axis](https://discuss.elastic.co/t/dashboard-with-a-graph-problem-with-datetime-axis/304316)
**Author:** [@marcw](https://discuss.elastic.co/u/marcw)\ **Replies:** 2\ **Last updated:** [May 11, 2022, 7:12am UTC](https://discuss.elastic.co/t/dashboard-with-a-graph-problem-with-datetime-axis/304316 "2022-05-11T07:12:36Z")
I use a dashboard with a graph in an external application via iframe. The datetime range selector is hidden because we don't want that the user changes the settings for the period. Otherwise the user can zoom in (what is… --- ## [Filebeat not picking up logs](https://discuss.elastic.co/t/filebeat-not-picking-up-logs/304407)
**Author:** [@Likhitha\_adulla](https://discuss.elastic.co/u/Likhitha_adulla)\ **Replies:** 0\ **Last updated:** [May 11, 2022, 4:39am UTC](https://discuss.elastic.co/t/filebeat-not-picking-up-logs/304407 "2022-05-11T04:39:41Z")
I have filebeat running as a docker container which is collecting the application logs from the other docker container writing logs to a specified folder on the host. The issue is only some of the logs are missing as fi… --- ## [Wildcards in Document filters](https://discuss.elastic.co/t/wildcards-in-document-filters/304326)
**Author:** [@Anfo](https://discuss.elastic.co/u/Anfo)\ **Replies:** 2\ **Last updated:** [May 11, 2022, 2:39am UTC](https://discuss.elastic.co/t/wildcards-in-document-filters/304326 "2022-05-11T02:39:01Z")
Hi Everything tells me that simple asterisk should work for a wildcard in a filter, but I'm finding it temperamental. Please see picture below. Sometimes it appears to work, other times ignored. Am I merely structur… --- ## [Deleted documents reappearing in searches, how to write unit tests for this?](https://discuss.elastic.co/t/deleted-documents-reappearing-in-searches-how-to-write-unit-tests-for-this/304396)
**Author:** [@catmanjan](https://discuss.elastic.co/u/catmanjan)\ **Replies:** 3\ **Last updated:** [May 11, 2022, 1:48am UTC](https://discuss.elastic.co/t/deleted-documents-reappearing-in-searches-how-to-write-unit-tests-for-this/304396 "2022-05-11T01:48:02Z")
Hello I have a simple CRUD app that reads and writes to Elasticsearch, I am up to writing some unit tests for the app, which involves creating dummy data, checking I can search for the data and then deleting the data. I… --- ## [Can I print all fields in one index?](https://discuss.elastic.co/t/can-i-print-all-fields-in-one-index/304400)
**Author:** [@111418](https://discuss.elastic.co/u/111418)\ **Replies:** 1\ **Last updated:** [May 11, 2022, 1:32am UTC](https://discuss.elastic.co/t/can-i-print-all-fields-in-one-index/304400 "2022-05-11T01:32:13Z")
Can I print all fields in one index in 7.12? I want to know all the name of fields. Thanks --- ## [Unexpected JSON event 'VALUE\_TRUE' instead of '\[KEY\_NAME, VALUE\_STRING\]' on 7.17.3](https://discuss.elastic.co/t/unexpected-json-event-value-true-instead-of-key-name-value-string-on-7-17-3/304398)
**Author:** [@wxh](https://discuss.elastic.co/u/wxh)\ **Replies:** 0\ **Last updated:** [May 11, 2022, 12:38am UTC](https://discuss.elastic.co/t/unexpected-json-event-value-true-instead-of-key-name-value-string-on-7-17-3/304398 "2022-05-11T00:38:20Z")
Hello, Sylvain Wallez, This is to follow up \[JAVA\] Unexpected JSON event 'VALUE\_TRUE' instead of '\[KEY\_NAME, VALUE\_STRING\]' - #12 by swallez which was already closed. Per Serialize DynamicMapping values as booleans ins… --- ## [Create custom beat for drone sensor data](https://discuss.elastic.co/t/create-custom-beat-for-drone-sensor-data/304395)
**Author:** [@gustavofring](https://discuss.elastic.co/u/gustavofring)\ **Replies:** 0\ **Last updated:** [May 10, 2022, 11:21pm UTC](https://discuss.elastic.co/t/create-custom-beat-for-drone-sensor-data/304395 "2022-05-10T23:21:31Z")
Dear contributors, I'd like to visualize drone sensor data through kibana. But, there is no mavlink-beat for it, so I am willing to create it. But, I read that the custom beat is deprecated since ELK stack v7.16. Wha… --- ## [Kibana error: not allowed to use elastic user](https://discuss.elastic.co/t/kibana-error-not-allowed-to-use-elastic-user/304356)
**Author:** [@okopnik](https://discuss.elastic.co/u/okopnik)\ **Replies:** 1\ **Last updated:** [May 10, 2022, 11:15pm UTC](https://discuss.elastic.co/t/kibana-error-not-allowed-to-use-elastic-user/304356 "2022-05-10T23:15:18Z")
The error is: "\[config validation of \[Elasticsearch\].username\]: value of "elastic" is forbidden. This is a superuser account that cannot write to system indices that Kibana needs to function"... I tried making a new us… --- ## [Reindex data streams "in place"](https://discuss.elastic.co/t/reindex-data-streams-in-place/304365)
**Author:** [@Mike\_Williams](https://discuss.elastic.co/u/Mike_Williams)\ **Replies:** 1\ **Last updated:** [May 10, 2022, 10:20pm UTC](https://discuss.elastic.co/t/reindex-data-streams-in-place/304365 "2022-05-10T22:20:59Z")
Hi, I have many data streams totaling... a lot... of space and I need to change the mapping of a few existing fields. What would be a decent strategy for re-indexing several dozen data streams consisting of several hun… --- ## [New line not parsed in grok processor](https://discuss.elastic.co/t/new-line-not-parsed-in-grok-processor/304285)
**Author:** [@NadyLeez123](https://discuss.elastic.co/u/NadyLeez123)\ **Replies:** 2\ **Last updated:** [May 10, 2022, 9:37pm UTC](https://discuss.elastic.co/t/new-line-not-parsed-in-grok-processor/304285 "2022-05-10T21:37:15Z")
Hi We just upgrade our cluster from 7.6.2 to 7.15.1 and pipeline are not working anymore. For example, this grok pattern was working well with the "\\n" to parse the new line in the message. But now, here is what we… --- ## [System Integration not Parsing SSH Failures](https://discuss.elastic.co/t/system-integration-not-parsing-ssh-failures/304394)
**Author:** [@ericbarnes](https://discuss.elastic.co/u/ericbarnes)\ **Replies:** 0\ **Last updated:** [May 10, 2022, 8:52pm UTC](https://discuss.elastic.co/t/system-integration-not-parsing-ssh-failures/304394 "2022-05-10T20:52:52Z")
Elasticsearch/Kibana Version = 8.2 I'm starting a new cluster and want to verify all of the default dashboards and ingest paths are working correctly. I am using Fleet to manage the agents and integrations. For the Sys… --- ## [Terraform + ec2 discovery (AWS) initial master s](https://discuss.elastic.co/t/terraform-ec2-discovery-aws-initial-master-s/304385)
**Author:** [@hunsw](https://discuss.elastic.co/u/hunsw)\ **Replies:** 0\ **Last updated:** [May 10, 2022, 7:00pm UTC](https://discuss.elastic.co/t/terraform-ec2-discovery-aws-initial-master-s/304385 "2022-05-10T19:00:37Z")
I'd like to create a small ES cluster in AWS with Terraform. Does anybody have prior experience/a working example where Terraform instantiates 3 master nodes that can connect to each other? The problem is that for boot… --- ## [Regarding implementing knn for geo-points](https://discuss.elastic.co/t/regarding-implementing-knn-for-geo-points/304384)
**Author:** [@dido](https://discuss.elastic.co/u/dido)\ **Replies:** 0\ **Last updated:** [May 10, 2022, 6:47pm UTC](https://discuss.elastic.co/t/regarding-implementing-knn-for-geo-points/304384 "2022-05-10T18:47:57Z")
Let's say I have an index of geo-json data of restaurants and another index of geo-json data of pharmacies. If I want to get all pharmacies having restaurant with in 100m, How can I do that. Taking each pharmacies coordi… --- ## [Need to delete Elastic search index after 15 days automatically](https://discuss.elastic.co/t/need-to-delete-elastic-search-index-after-15-days-automatically/304266)
**Author:** [@Sam1231](https://discuss.elastic.co/u/Sam1231)\ **Replies:** 2\ **Last updated:** [May 10, 2022, 5:15pm UTC](https://discuss.elastic.co/t/need-to-delete-elastic-search-index-after-15-days-automatically/304266 "2022-05-10T17:15:15Z")
hi, i need to delete Elasticsearch indices after 15 days of creation date. i need to automate this process using python. is there any script for the same ? im running AWS based Elasticsearch. version 6.4 --- ## [Logstash Illegal Argument Exception while parsing date](https://discuss.elastic.co/t/logstash-illegal-argument-exception-while-parsing-date/303142)
**Author:** [@b.ohmer](https://discuss.elastic.co/u/b.ohmer)\ **Replies:** 5\ **Last updated:** [May 10, 2022, 4:24pm UTC](https://discuss.elastic.co/t/logstash-illegal-argument-exception-while-parsing-date/303142 "2022-05-10T16:24:04Z")
Hi there, I've got three questions around Logstash: We're using an older version of Logstash (6.5.4) and experiencing currently an issue while parsing a date. I've got absolutely no idea anymore what I can do to make … --- ## [Incorrectly collected data in Logstash to Elasticsearch](https://discuss.elastic.co/t/incorrectly-collected-data-in-logstash-to-elasticsearch/303910)
**Author:** [@eduhernandezm](https://discuss.elastic.co/u/eduhernandezm)\ **Replies:** 11\ **Last updated:** [May 10, 2022, 4:17pm UTC](https://discuss.elastic.co/t/incorrectly-collected-data-in-logstash-to-elasticsearch/303910 "2022-05-10T16:17:53Z")
Hello, I have set up two processes to collect data and present it to ELK. On the one hand I have a process that collects log data from an iis and on the other I have another process that what it does is import the data… --- ## [Monitor urls with Windows Authentication](https://discuss.elastic.co/t/monitor-urls-with-windows-authentication/304337)
**Author:** [@aviral\_srivastava](https://discuss.elastic.co/u/aviral_srivastava)\ **Replies:** 3\ **Last updated:** [May 10, 2022, 2:40pm UTC](https://discuss.elastic.co/t/monitor-urls-with-windows-authentication/304337 "2022-05-10T14:40:41Z")
Hi, I am using heartbeat 6.4.0 I am trying to monitor an https url, below is my configuration: heartbeat.monitors: - type: http urls: - https://myurl.company.com/ schedule: '@every 5m' username: user passw… --- ## [Cannot DELETE Index with Superuser](https://discuss.elastic.co/t/cannot-delete-index-with-superuser/303249)
**Author:** [@GinkoLucas](https://discuss.elastic.co/u/GinkoLucas)\ **Replies:** 2\ **Last updated:** [May 10, 2022, 2:08pm UTC](https://discuss.elastic.co/t/cannot-delete-index-with-superuser/303249 "2022-05-10T14:08:22Z")
Hello, I have a problem on my Elasticsearch, i cannot delete an index with a superuser : I have some .reporting index, and i want to apply an ILM to this index because i dont need the old .reportng index. After changi… --- ## [Unable to Start Logstash with Proxy](https://discuss.elastic.co/t/unable-to-start-logstash-with-proxy/304350)
**Author:** [@hell\_storm2004](https://discuss.elastic.co/u/hell_storm2004)\ **Replies:** 0\ **Last updated:** [May 10, 2022, 1:23pm UTC](https://discuss.elastic.co/t/unable-to-start-logstash-with-proxy/304350 "2022-05-10T13:23:44Z")
I am currently trying to learn about Logstash. So I just download the zip file and put in some basic configuration and ran logstash.bat file. But for some reason I get Proxy Authentication exception. This is console out… --- ## [Query with multiple Should nested](https://discuss.elastic.co/t/query-with-multiple-should-nested/304324)
**Author:** [@Miguel\_BA](https://discuss.elastic.co/u/Miguel_BA)\ **Replies:** 1\ **Last updated:** [May 10, 2022, 12:30pm UTC](https://discuss.elastic.co/t/query-with-multiple-should-nested/304324 "2022-05-10T12:30:40Z")
Hello, I am trying to get a query where I can make a nested should without using nested fields. Example: GET index1/\_search { "query": { "bool": { "should": \[ {"term": {"name": "mike"}}, {… --- ## [Create scrpit to add field calling API](https://discuss.elastic.co/t/create-scrpit-to-add-field-calling-api/303921)
**Author:** [@wdffw](https://discuss.elastic.co/u/wdffw)\ **Replies:** 2\ **Last updated:** [May 10, 2022, 10:11am UTC](https://discuss.elastic.co/t/create-scrpit-to-add-field-calling-api/303921 "2022-05-10T10:11:35Z")
Hello, I wand a add a field by a painless (or another scripting language) to call an API data and show the result in the field by emit for example ??? To be more clearly exactly, for example i have an API http://xxx.xx… --- ## [Write to kafka topic in a secure way](https://discuss.elastic.co/t/write-to-kafka-topic-in-a-secure-way/304309)
**Author:** [@shivendra95](https://discuss.elastic.co/u/shivendra95)\ **Replies:** 1\ **Last updated:** [May 10, 2022, 9:39am UTC](https://discuss.elastic.co/t/write-to-kafka-topic-in-a-secure-way/304309 "2022-05-10T09:39:06Z")
I'm using filebeat to write logs to Kafka topic. My Kafka server is running on a different ec2 server. I want to create a secure connection between the server from which I'm sending logs and the Kafka server. Is there a… --- ## [Check Point Elastic Agent](https://discuss.elastic.co/t/check-point-elastic-agent/304295)
**Author:** [@elasticnoobie](https://discuss.elastic.co/u/elasticnoobie)\ **Replies:** 2\ **Last updated:** [May 10, 2022, 8:58am UTC](https://discuss.elastic.co/t/check-point-elastic-agent/304295 "2022-05-10T08:58:44Z")
I'm working on setting up an elastic installation and forwarding all Check Point logs via Elastic Agent integration. I have setup Fleet, created the Agent Policy and installed the Elastic Agent on the Check Point managem… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=943) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=945)