# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=972 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 973 --- ## [Incorrect time in @timestamp field](https://discuss.elastic.co/t/incorrect-time-in-timestamp-field/302489)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 4\ **Last updated:** [April 15, 2022, 11:43am UTC](https://discuss.elastic.co/t/incorrect-time-in-timestamp-field/302489 "2022-04-15T11:43:25Z")
Dears, I have some odd problem with @timestamp field in my indices which include incorrect time i.e. minus two hours. Logstash should populate time to @timestamp from logs on the base of this: if ("" in \[hi.my\_date\]) {… --- ## [Is there another way to import template at boot?](https://discuss.elastic.co/t/is-there-another-way-to-import-template-at-boot/301544)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 4\ **Last updated:** [April 15, 2022, 10:35am UTC](https://discuss.elastic.co/t/is-there-another-way-to-import-template-at-boot/301544 "2022-04-15T10:35:06Z")
Hey there, I am configuring several Beats with a custom mapping. I would just to know if there is another way to load custom template (setup.template.\*) at startup or I must use the fields.yml file. I mean, if I have hu… --- ## [Problems when importing ml models with eland\_import\_hub\_model](https://discuss.elastic.co/t/problems-when-importing-ml-models-with-eland-import-hub-model/302499)
**Author:** [@cman](https://discuss.elastic.co/u/cman)\ **Replies:** 0\ **Last updated:** [April 15, 2022, 10:24am UTC](https://discuss.elastic.co/t/problems-when-importing-ml-models-with-eland-import-hub-model/302499 "2022-04-15T10:24:20Z")
I have got some errors while trying to import a couple of ml models by the command "eland\_import\_hub\_model". In the one case I would like to import this model: sentence-transformers/paraphrase-multilingual-MiniLM-L12-v2 … --- ## [Monitor logs and create alert](https://discuss.elastic.co/t/monitor-logs-and-create-alert/302495)
**Author:** [@bdaniel7](https://discuss.elastic.co/u/bdaniel7)\ **Replies:** 1\ **Last updated:** [April 15, 2022, 10:04am UTC](https://discuss.elastic.co/t/monitor-logs-and-create-alert/302495 "2022-04-15T10:04:52Z")
Hi, Is there a way to monitor incoming logs (from fluent-bit, in my case) and trigger an alert when specific keywords appear in logs? I'm just beginning to use the ELK stack, so forgive me if I say silly things. --- ## [Parse Haproxy Log](https://discuss.elastic.co/t/parse-haproxy-log/302494)
**Author:** [@Serge\_Reynier](https://discuss.elastic.co/u/Serge_Reynier)\ **Replies:** 0\ **Last updated:** [April 15, 2022, 9:40am UTC](https://discuss.elastic.co/t/parse-haproxy-log/302494 "2022-04-15T09:40:38Z")
Hi, I actually testing "elastic.co" to store and parse my haproxy logs, but I can't parse them properly. I use Haproxy 2.2 and elastic-agent to send logs and i installed Haproxy Integration to parse log. Lots of field … --- ## [Logstash Queues Management](https://discuss.elastic.co/t/logstash-queues-management/302493)
**Author:** [@ivanchak](https://discuss.elastic.co/u/ivanchak)\ **Replies:** 0\ **Last updated:** [April 15, 2022, 9:14am UTC](https://discuss.elastic.co/t/logstash-queues-management/302493 "2022-04-15T09:14:50Z")
Hi, I'm wondering if there is a way to gracefully purge all events in either DLQ (Dead Letter Queue) / PQ (Persistent Queue)? By purging, I mean to drop all those pending events so that I could bring up a dead Logstash A… --- ## [Create Coordinate nodes on existing cluster on Kubernetes](https://discuss.elastic.co/t/create-coordinate-nodes-on-existing-cluster-on-kubernetes/302432)
**Author:** [@mitesh.gangaramani](https://discuss.elastic.co/u/mitesh.gangaramani)\ **Replies:** 1\ **Last updated:** [April 15, 2022, 9:10am UTC](https://discuss.elastic.co/t/create-coordinate-nodes-on-existing-cluster-on-kubernetes/302432 "2022-04-15T09:10:12Z")
We want to add coordinate nodes to increase the performance. We have tried adding role : {} along with pod-affinity : {} but it doesn't create the coordinate nodes and marking yaml invalid. 3 master and 3 data nodes are… --- ## [Logstash Http poller plugin for JIRA](https://discuss.elastic.co/t/logstash-http-poller-plugin-for-jira/302486)
**Author:** [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\ **Replies:** 0\ **Last updated:** [April 15, 2022, 7:09am UTC](https://discuss.elastic.co/t/logstash-http-poller-plugin-for-jira/302486 "2022-04-15T07:09:51Z")
Hello Guys I want All Jira Issue Action Report to Elasticsearch my requirement is for full issue traking in to Elasticsearch please help me ASAP. --- ## [Deployment of ElasticCloud turned pending status suddenly](https://discuss.elastic.co/t/deployment-of-elasticcloud-turned-pending-status-suddenly/302485)
**Author:** [@m-amano](https://discuss.elastic.co/u/m-amano)\ **Replies:** 0\ **Last updated:** [April 15, 2022, 7:05am UTC](https://discuss.elastic.co/t/deployment-of-elasticcloud-turned-pending-status-suddenly/302485 "2022-04-15T07:05:53Z")
I am using ElasticCloud v.7.12.1 and it's status suddenly turned pending status. Why does that happen and not able to access Kibana during that time? This is the Summary of Activity during the time of pending. Additio… --- ## [Master\_not\_discovered\_exception](https://discuss.elastic.co/t/master-not-discovered-exception/301925)
**Author:** [@flavono123](https://discuss.elastic.co/u/flavono123)\ **Replies:** 19\ **Last updated:** [April 15, 2022, 6:20am UTC](https://discuss.elastic.co/t/master-not-discovered-exception/301925 "2022-04-15T06:20:21Z")
With the version 7.15.2 from ubuntu package, I deployed 4 ES nodes in 2 VMs, so 2 nodes fo r each VM. Names of nodes(node.name) are following: es-01-1(9301) es-01-2(9302) es-02-1(9301) es-02-2(9302) Where the prefix, … --- ## [Index aliases is missing](https://discuss.elastic.co/t/index-aliases-is-missing/302483)
**Author:** [@wcpoon](https://discuss.elastic.co/u/wcpoon)\ **Replies:** 0\ **Last updated:** [April 15, 2022, 6:04am UTC](https://discuss.elastic.co/t/index-aliases-is-missing/302483 "2022-04-15T06:04:11Z")
Hi, My winlogbeat index aliases is empty, any idea why it is empty and how to include aliases in every new index? { "winlogbeat-8.1.2-2022.04.15" : { "aliases" : { }, "mappings" : { "\_meta" : { … --- ## [Facing error - Creation from saved object not supported by type dashboard](https://discuss.elastic.co/t/facing-error-creation-from-saved-object-not-supported-by-type-dashboard/300302)
**Author:** [@Shreeya\_Rajguru](https://discuss.elastic.co/u/Shreeya_Rajguru)\ **Replies:** 7\ **Last updated:** [April 15, 2022, 5:26am UTC](https://discuss.elastic.co/t/facing-error-creation-from-saved-object-not-supported-by-type-dashboard/300302 "2022-04-15T05:26:02Z")
Hi, I am trying to embed an existing dashboard in a custom plugin using its id as savedObjectID. I have referred the example plugin dashboard\_embeddable\_examples for the same. But I am facing the error - Creation from … --- ## [Count query over the date range doesn't return proper results](https://discuss.elastic.co/t/count-query-over-the-date-range-doesnt-return-proper-results/302476)
**Author:** [@stecino](https://discuss.elastic.co/u/stecino)\ **Replies:** 1\ **Last updated:** [April 15, 2022, 4:51am UTC](https://discuss.elastic.co/t/count-query-over-the-date-range-doesnt-return-proper-results/302476 "2022-04-15T04:51:56Z")
Executing following query curl -s -XGET http://blah:9200/kgacrm-2022.04.15/\_count?pretty=true {"query": {"range" : {"timestamp": { "gte" : "now-15m", "lt" : "now"}}}} { "count" : 1725, "\_shards" : { "total" : 5… --- ## [Kibana asking for Enrollment Token when xpack.security.enabled: false in Elasticsearch](https://discuss.elastic.co/t/kibana-asking-for-enrollment-token-when-xpack-security-enabled-false-in-elasticsearch/302118)
**Author:** [@AdmiralGT](https://discuss.elastic.co/u/AdmiralGT)\ **Replies:** 1\ **Last updated:** [April 15, 2022, 4:12am UTC](https://discuss.elastic.co/t/kibana-asking-for-enrollment-token-when-xpack-security-enabled-false-in-elasticsearch/302118 "2022-04-15T04:12:13Z")
I have Kibana and Elasticsearch running in a kubernetes cluster, both v8.1.2 In my Elasticsearch.yml I have xpack.security.enabled: false This is confirmed by trying to create the enrollment token in Elasticsearch … --- ## [Elastic Agent and Tagging](https://discuss.elastic.co/t/elastic-agent-and-tagging/302165)
**Author:** [@MarcomPrintable](https://discuss.elastic.co/u/MarcomPrintable)\ **Replies:** 2\ **Last updated:** [April 14, 2022, 11:08pm UTC](https://discuss.elastic.co/t/elastic-agent-and-tagging/302165 "2022-04-14T23:08:58Z")
Greetings, I have an EC account and I have been really enjoying using the elastic agent. However, I am hitting a few rough spots. I am trying to tag in a general sense in the Elasticsearch output but I notice that -… --- ## [Unable to get autodiscover to play nice with mongodb using a kubernetes provider](https://discuss.elastic.co/t/unable-to-get-autodiscover-to-play-nice-with-mongodb-using-a-kubernetes-provider/302474)
**Author:** [@Renato\_D](https://discuss.elastic.co/u/Renato_D)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 10:48pm UTC](https://discuss.elastic.co/t/unable-to-get-autodiscover-to-play-nice-with-mongodb-using-a-kubernetes-provider/302474 "2022-04-14T22:48:15Z")
Metricbeat: 7.10.2 We have several mongodb instances across many clusters and would like to enhance the metrics output of all our mongo pods so we can start making some pretty graphs. I've been trying, in vein, to get … --- ## [How to extract fields from "message" field in logstash?](https://discuss.elastic.co/t/how-to-extract-fields-from-message-field-in-logstash/302470)
**Author:** [@RaonyO](https://discuss.elastic.co/u/RaonyO)\ **Replies:** 1\ **Last updated:** [April 14, 2022, 9:15pm UTC](https://discuss.elastic.co/t/how-to-extract-fields-from-message-field-in-logstash/302470 "2022-04-14T21:15:44Z")
hello, I need help in extracting the fields that come in the "message" field, in case all the fields need to be extracted, can anyone help? here's the field: "message": "Apr 14 16:11:36 tutorial2022-1 sshd\[8454\]: PAM 2… --- ## [Facing issue in elastic search](https://discuss.elastic.co/t/facing-issue-in-elastic-search/302469)
**Author:** [@Hammadahmed](https://discuss.elastic.co/u/Hammadahmed)\ **Replies:** 3\ **Last updated:** [April 14, 2022, 8:31pm UTC](https://discuss.elastic.co/t/facing-issue-in-elastic-search/302469 "2022-04-14T20:31:23Z")
bin/Elasticsearch \[2022-04-15T00:47:44,478\]\[INFO \]\[o.e.n.Node \] \[ubuntu\] version\[8.1.2\], pid\[11981\], build\[default/tar/31df9689e80bad366ac20176aa7f2371ea5eb4c1/2022-03-29T21:18:59.991429448Z\], OS\[Linux/5.1… --- ## [Elasticsearch run error](https://discuss.elastic.co/t/elasticsearch-run-error/302370)
**Author:** [@dawiddudek](https://discuss.elastic.co/u/dawiddudek)\ **Replies:** 6\ **Last updated:** [April 14, 2022, 7:54pm UTC](https://discuss.elastic.co/t/elasticsearch-run-error/302370 "2022-04-14T19:54:58Z")
Hi, i tried install and run Elasticsearch but service is still failed. I try to run this on Ubuntu 20.04 LTS from apk, dpkg and archive. i found Elasticsearch: Job for elasticsearch.service failed - Stack Overflow but… --- ## [Rules and Connector is not sending ot email;](https://discuss.elastic.co/t/rules-and-connector-is-not-sending-ot-email/301223)
**Author:** [@Amisha\_Thakkar1](https://discuss.elastic.co/u/Amisha_Thakkar1)\ **Replies:** 12\ **Last updated:** [April 14, 2022, 7:48pm UTC](https://discuss.elastic.co/t/rules-and-connector-is-not-sending-ot-email/301223 "2022-04-14T19:48:52Z")
Hi Team I have setup rule under rules and connectors. I am trying to send out an email to my gmail. But its not working. But if i use watcher to send out an email. I am receiving emails. --- ## [Array in Scripted Field](https://discuss.elastic.co/t/array-in-scripted-field/302278)
**Author:** [@Alejandra\_Mata1](https://discuss.elastic.co/u/Alejandra_Mata1)\ **Replies:** 1\ **Last updated:** [April 14, 2022, 7:20pm UTC](https://discuss.elastic.co/t/array-in-scripted-field/302278 "2022-04-14T19:20:17Z")
Hi @LeeDr I saw a publication, the cula you explained how to work with array in a scripted field, I had a question, if I want to pivot in a table, an array so that in each cell a value of the array is assigned, how woul… --- ## [Spring4Shell ::Spring Framework Remote Code Execution Vulnerability for eck operator](https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability-for-eck-operator/302455)
**Author:** [@Sagarika\_Mahalik](https://discuss.elastic.co/u/Sagarika_Mahalik)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 4:31pm UTC](https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability-for-eck-operator/302455 "2022-04-14T16:31:48Z")
Hello, We are using eck operator 1.9.1. I see the code for eck operator is written on go lang. So then is eck operator not affected any way by the reported spring shell vulnerability? Please suggest, whether we need t… --- ## [Kibana server is not ready yet, unavailable\_shards\_exception](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-unavailable-shards-exception/302459)
**Author:** [@Dave\_G](https://discuss.elastic.co/u/Dave_G)\ **Replies:** 1\ **Last updated:** [April 14, 2022, 5:24pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-unavailable-shards-exception/302459 "2022-04-14T17:24:58Z")
We have a four-node Elasticsearch cluster running ES 7.16.2 and Kibana 7.16.2. Since the last upgrade, our Kibana page is showing Kibana server is not ready yet The Kibana log shows this error repeated numerous times: … --- ## [v8.X Docker image does not accept bin/elasticsearch env variables](https://discuss.elastic.co/t/v8-x-docker-image-does-not-accept-bin-elasticsearch-env-variables/302446)
**Author:** [@violetaria](https://discuss.elastic.co/u/violetaria)\ **Replies:** 2\ **Last updated:** [April 14, 2022, 4:56pm UTC](https://discuss.elastic.co/t/v8-x-docker-image-does-not-accept-bin-elasticsearch-env-variables/302446 "2022-04-14T16:56:31Z")
Using the existing docker image does not accept positional arguments for Elasticsearch environment variables correctly. The documentation states that we should be able to pass the arguments in with this command docker … --- ## [Not fetching Data streams](https://discuss.elastic.co/t/not-fetching-data-streams/302448)
**Author:** [@spo](https://discuss.elastic.co/u/spo)\ **Replies:** 1\ **Last updated:** [April 14, 2022, 3:46pm UTC](https://discuss.elastic.co/t/not-fetching-data-streams/302448 "2022-04-14T15:46:24Z")
Hi I have a fleet server , status : healthy. I have added AWS and IIS integrations to the agent policy( Default Fleet Server policy) of the fleet server but I do not see any logs pulling in the data stream pane from th… --- ## [Fleet-server failed: context canceled](https://discuss.elastic.co/t/fleet-server-failed-context-canceled/302348)
**Author:** [@spo](https://discuss.elastic.co/u/spo)\ **Replies:** 2\ **Last updated:** [April 14, 2022, 3:00pm UTC](https://discuss.elastic.co/t/fleet-server-failed-context-canceled/302348 "2022-04-14T15:00:01Z")
Hi Having trouble enrolling fleet server Elasticsearch kibana and elastic agent versions 7.17.2 command I used is .\\elastic-agent.exe install --url=https://fleet server ip:8220 --fleet-server-es=https://elasticsearch… --- ## [Extracting data between two phrases with GROK](https://discuss.elastic.co/t/extracting-data-between-two-phrases-with-grok/302269)
**Author:** [@ARDiver86](https://discuss.elastic.co/u/ARDiver86)\ **Replies:** 3\ **Last updated:** [April 14, 2022, 2:31pm UTC](https://discuss.elastic.co/t/extracting-data-between-two-phrases-with-grok/302269 "2022-04-14T14:31:27Z")
I'm trying to extract a powershell signature block from powershell scripts that are being ran in our environment. At the end of the powershell.file.script\_block\_text field there is sometimes a signature in this format: #… --- ## [Installation of ELK on Windows help](https://discuss.elastic.co/t/installation-of-elk-on-windows-help/302333)
**Author:** [@insurin](https://discuss.elastic.co/u/insurin)\ **Replies:** 5\ **Last updated:** [April 14, 2022, 1:39pm UTC](https://discuss.elastic.co/t/installation-of-elk-on-windows-help/302333 "2022-04-14T13:39:39Z")
Hi all, need some help with Windows install. Windows Server 2022, ELK 8.12. I am trying to install everything on the 1 box. Steps for far Installed Elasticsearch using Elasticsearch.bat. This creates the elastic passwo… --- ## [Snort with Elastic Cloud](https://discuss.elastic.co/t/snort-with-elastic-cloud/302436)
**Author:** [@kesako](https://discuss.elastic.co/u/kesako)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 1:31pm UTC](https://discuss.elastic.co/t/snort-with-elastic-cloud/302436 "2022-04-14T13:31:19Z")
Hi, I'm trying to configure Snort to send his logs to Elastic cloud but the Snort integration doesn't work. What other way do I have to get those logs automatically ? Thanks Have a nice day --- ## [Advice to get different unstrctured log data into structured format](https://discuss.elastic.co/t/advice-to-get-different-unstrctured-log-data-into-structured-format/302433)
**Author:** [@Bavaria](https://discuss.elastic.co/u/Bavaria)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 1:08pm UTC](https://discuss.elastic.co/t/advice-to-get-different-unstrctured-log-data-into-structured-format/302433 "2022-04-14T13:08:17Z")
I am new to Logstash. I have a processing question. I am getting these kind of logs with Filebeat on the "mmesage" field, from the same host. Sometimes different Files. How would I process to make those Messages I am get… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=971) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=973)