# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=995 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 996 --- ## [Possible to search multiple indices in one rule?](https://discuss.elastic.co/t/possible-to-search-multiple-indices-in-one-rule/301010)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 0\ **Last updated:** [March 29, 2022, 9:59pm UTC](https://discuss.elastic.co/t/possible-to-search-multiple-indices-in-one-rule/301010 "2022-03-29T21:59:14Z")
Dear all =) When I read this it doesn't mention, if I just can add multiple indices in the index array, and the rule will search them all? Does anyone know this? Hugs Sandra =) --- ## [Service Failed to Run: Failed to find metadata for existing index \>\> Failed to bind service \>\> Failed to read or upgrade local state](https://discuss.elastic.co/t/service-failed-to-run-failed-to-find-metadata-for-existing-index-failed-to-bind-service-failed-to-read-or-upgrade-local-state/300836)
**Author:** [@tgs.vaibhav](https://discuss.elastic.co/u/tgs.vaibhav)\ **Replies:** 3\ **Last updated:** [March 29, 2022, 9:58pm UTC](https://discuss.elastic.co/t/service-failed-to-run-failed-to-find-metadata-for-existing-index-failed-to-bind-service-failed-to-read-or-upgrade-local-state/300836 "2022-03-29T21:58:20Z")
\[2022-03-28T06:42:22,558\]\[INFO \]\[o.e.x.m.p.l.CppLogMessageHandler\] \[SYSTNAME\] \[controller/13524\] \[Main.cc@110\] controller (64 bit): Version 7.3.2 (Build 265429af874fbe) Copyright (c) 2019 Elasticsearch BV \[2022-03-28T06:… --- ## [Frozen Tier](https://discuss.elastic.co/t/frozen-tier/299368)
**Author:** [@tmahany419](https://discuss.elastic.co/u/tmahany419)\ **Replies:** 4\ **Last updated:** [March 29, 2022, 8:49pm UTC](https://discuss.elastic.co/t/frozen-tier/299368 "2022-03-29T20:49:39Z")
What's the difference between searchable snapshots and the frozen tier? Reading the documentation is looks like Frozen tier uses searchable snapshots and reading the searchable snapshot documentation it looks like the o… --- ## [Moving over snapshot to another system doesn't get added to registered repo](https://discuss.elastic.co/t/moving-over-snapshot-to-another-system-doesnt-get-added-to-registered-repo/300892)
**Author:** [@hishamnajem](https://discuss.elastic.co/u/hishamnajem)\ **Replies:** 5\ **Last updated:** [March 29, 2022, 8:31pm UTC](https://discuss.elastic.co/t/moving-over-snapshot-to-another-system-doesnt-get-added-to-registered-repo/300892 "2022-03-29T20:31:49Z")
I am taking a snapshot on system 1 and transferring the index-X, index.latest, meta-... and snap-.... over to system 2 under the same registered repo. System 2 does not find snapshot for restore. On SYSTEM 1: --\> curl … --- ## [Failing to parse datestamp](https://discuss.elastic.co/t/failing-to-parse-datestamp/301005)
**Author:** [@stevedwray](https://discuss.elastic.co/u/stevedwray)\ **Replies:** 2\ **Last updated:** [March 29, 2022, 8:25pm UTC](https://discuss.elastic.co/t/failing-to-parse-datestamp/301005 "2022-03-29T20:25:05Z")
I'm using Integrations/Upload file, something I've done many times before with CSV files. I have a CSV file that has a datestamp field like this: 11/01/2022 06:00:06 PM which is from January, so the 01 is the month an… --- ## [Logtash Giving : : Expected one of #, input, filter, output at line 1, column 1 (byte 1) Error in syntax checking](https://discuss.elastic.co/t/logtash-giving-expected-one-of-input-filter-output-at-line-1-column-1-byte-1-error-in-syntax-checking/300987)
**Author:** [@d6036de2b54af16665f4](https://discuss.elastic.co/u/d6036de2b54af16665f4)\ **Replies:** 14\ **Last updated:** [March 29, 2022, 7:54pm UTC](https://discuss.elastic.co/t/logtash-giving-expected-one-of-input-filter-output-at-line-1-column-1-byte-1-error-in-syntax-checking/300987 "2022-03-29T19:54:03Z")
\[WARN \] 2022-03-29 15:12:27.166 \[LogStash::Runner\] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified \[FATAL\] 2022-03-29 15:12:27.560 \[LogStash::Runner\] runner - The giv… --- ## [How to change replica for system indices](https://discuss.elastic.co/t/how-to-change-replica-for-system-indices/300415)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 7\ **Last updated:** [March 29, 2022, 6:08pm UTC](https://discuss.elastic.co/t/how-to-change-replica-for-system-indices/300415 "2022-03-29T18:08:32Z")
Hi all, I wanted to change the number of replicas for Elasticsearch system indices. I know that the forbit it but is there a way to override that to increase the number of indices or replicas for elastic system indices… --- ## [ElasticSearch 8.1.1 Java API - Sort doesn't work](https://discuss.elastic.co/t/elasticsearch-8-1-1-java-api-sort-doesnt-work/301003)
**Author:** [@AKDAS\_System](https://discuss.elastic.co/u/AKDAS_System)\ **Replies:** 1\ **Last updated:** [March 29, 2022, 7:06pm UTC](https://discuss.elastic.co/t/elasticsearch-8-1-1-java-api-sort-doesnt-work/301003 "2022-03-29T19:06:19Z")
Hello, I'm currently in the process of migrating from Elasticsearch 6.8 to the new Java API in 8.1.1. So far everything is going well but the only problem that is left is that adding sort to SearchRequest breaks everythi… --- ## [Doubts for SSL certs renew on ELK stack v8](https://discuss.elastic.co/t/doubts-for-ssl-certs-renew-on-elk-stack-v8/300959)
**Author:** [@gustavoluza](https://discuss.elastic.co/u/gustavoluza)\ **Replies:** 3\ **Last updated:** [March 29, 2022, 6:37pm UTC](https://discuss.elastic.co/t/doubts-for-ssl-certs-renew-on-elk-stack-v8/300959 "2022-03-29T18:37:49Z")
i have an ELK stack version 8 environment and i use the default security configuration for Elasticsearch, with the default certificates (http\_ca.crt, http.p12, transport.p12), at the moment the environment works fine wit… --- ## [Trying to convert JSON to new JSON outputs quoted JSON](https://discuss.elastic.co/t/trying-to-convert-json-to-new-json-outputs-quoted-json/300998)
**Author:** [@geena.rollins](https://discuss.elastic.co/u/geena.rollins)\ **Replies:** 2\ **Last updated:** [March 29, 2022, 6:12pm UTC](https://discuss.elastic.co/t/trying-to-convert-json-to-new-json-outputs-quoted-json/300998 "2022-03-29T18:12:20Z")
On my macbook monterey 12.2.1, I get quoted JSON. I'm hoping for plain JSON. logstash.yml is node.name: tester file.conf is input { file { path =\> \["/Users/geena.rollins/ws/hello.json"\] start\_position =\> … --- ## [Default install of logstash 8.1 results in error](https://discuss.elastic.co/t/default-install-of-logstash-8-1-results-in-error/300854)
**Author:** [@Louis\_Bohm](https://discuss.elastic.co/u/Louis_Bohm)\ **Replies:** 5\ **Last updated:** [March 29, 2022, 4:50pm UTC](https://discuss.elastic.co/t/default-install-of-logstash-8-1-results-in-error/300854 "2022-03-29T16:50:12Z")
I am running Centos 7.9 and followed the directions on this web to install logstash. After doing a yum -y install logstash to get logstash 8.1 installed did the following: Removed the logstash-sample.conf. Ran the fol… --- ## [Plugin root dir issues](https://discuss.elastic.co/t/plugin-root-dir-issues/300990)
**Author:** [@WhatImIDoing](https://discuss.elastic.co/u/WhatImIDoing)\ **Replies:** 0\ **Last updated:** [March 29, 2022, 4:18pm UTC](https://discuss.elastic.co/t/plugin-root-dir-issues/300990 "2022-03-29T16:18:05Z")
I am developing a plugin for 8.1 and am having trouble setting up the tsconfig.json I am refencing an interface at /src/plugins/discover/public/application/doc\_views\_types and getting this error '/home/user/Desktop/kib… --- ## [JSON logs in filestream input not added correctly on Elasticsearch](https://discuss.elastic.co/t/json-logs-in-filestream-input-not-added-correctly-on-elasticsearch/300989)
**Author:** [@MartinNouv](https://discuss.elastic.co/u/MartinNouv)\ **Replies:** 0\ **Last updated:** [March 29, 2022, 4:17pm UTC](https://discuss.elastic.co/t/json-logs-in-filestream-input-not-added-correctly-on-elasticsearch/300989 "2022-03-29T16:17:15Z")
Greetings Elastic Community ! I have an issue about my implementations of some JSON logs into Elasticsearch with a filebeat. First i didn't used the parsers function, and so all the fields was not implemented and all t… --- ## [Collect multiple events for processing in the filter and send to output (bulk)](https://discuss.elastic.co/t/collect-multiple-events-for-processing-in-the-filter-and-send-to-output-bulk/300986)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 1\ **Last updated:** [March 29, 2022, 4:25pm UTC](https://discuss.elastic.co/t/collect-multiple-events-for-processing-in-the-filter-and-send-to-output-bulk/300986 "2022-03-29T16:25:14Z")
Hi folks, I have following use case: I receive events from beat and would like to enrich them with additional information using a filter plugin in logstash. The filter plugin must send a request to an endpoint and retr… --- ## [Requests per second with Kibana Lens](https://discuss.elastic.co/t/requests-per-second-with-kibana-lens/300826)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 2\ **Last updated:** [March 29, 2022, 4:09pm UTC](https://discuss.elastic.co/t/requests-per-second-with-kibana-lens/300826 "2022-03-29T16:09:37Z")
Hello, How can we display a metric showing Requests per \[timeframe\] with a Metric Lens? In older Kibana versions this was possible: It's not a derivative, nor a counter\_rate but rather the average number of recor… --- ## [Kibana windows notifications possibility](https://discuss.elastic.co/t/kibana-windows-notifications-possibility/299957)
**Author:** [@John\_McAfee1](https://discuss.elastic.co/u/John_McAfee1)\ **Replies:** 2\ **Last updated:** [March 29, 2022, 3:19pm UTC](https://discuss.elastic.co/t/kibana-windows-notifications-possibility/299957 "2022-03-29T15:19:04Z")
Good Morning, I know that Kibana/Elasticsearch is capable for providing e-mails by using watches/alerts. But is it possible for Kibana to provide windows notification similar to Slack or other web based tools? Is there… --- ## [When output from logstash to mangodb, can I specify which fields wanted in output?](https://discuss.elastic.co/t/when-output-from-logstash-to-mangodb-can-i-specify-which-fields-wanted-in-output/300817)
**Author:** [@maoxuguang](https://discuss.elastic.co/u/maoxuguang)\ **Replies:** 3\ **Last updated:** [March 29, 2022, 2:56pm UTC](https://discuss.elastic.co/t/when-output-from-logstash-to-mangodb-can-i-specify-which-fields-wanted-in-output/300817 "2022-03-29T14:56:25Z")
I config two destination in logstash output, one is Elasticsearch, the other is mongodb. I only want to out put several fields to mongodb, not all of them. How to config to achieve that? Thanks a lot. --- ## [And/OR DSL Query](https://discuss.elastic.co/t/and-or-dsl-query/300985)
**Author:** [@JeremyP](https://discuss.elastic.co/u/JeremyP)\ **Replies:** 0\ **Last updated:** [March 29, 2022, 2:56pm UTC](https://discuss.elastic.co/t/and-or-dsl-query/300985 "2022-03-29T14:56:08Z")
Hello, I'm having a difficult time getting a DSL query to work right with a combination of an AND and OR. For the OR side, one of the two must be present in the document.... { "state": "active" } { "state": "re-surfa… --- ## [Filebeat ssl issue](https://discuss.elastic.co/t/filebeat-ssl-issue/300984)
**Author:** [@alaine](https://discuss.elastic.co/u/alaine)\ **Replies:** 0\ **Last updated:** [March 29, 2022, 2:45pm UTC](https://discuss.elastic.co/t/filebeat-ssl-issue/300984 "2022-03-29T14:45:30Z")
Hello, I ran into a weird issue where I was getting the following error on one of my logstash servers as I was trying to set up filebeats: ERROR \[esclientleg\] transport/logging.go:37 Error dialing x509: Certificate sig… --- ## [Using DNS processors in built in integration in Kibana](https://discuss.elastic.co/t/using-dns-processors-in-built-in-integration-in-kibana/300863)
**Author:** [@Tom\_Box](https://discuss.elastic.co/u/Tom_Box)\ **Replies:** 0\ **Last updated:** [March 28, 2022, 3:04pm UTC](https://discuss.elastic.co/t/using-dns-processors-in-built-in-integration-in-kibana/300863 "2022-03-28T15:04:11Z")
Hi, I have a built in integration application (for example: Office 365) which has an IP address field in the logs which i would like to reverse using a DNS lookup and i tried to achieve that using the DNS processor unde… --- ## [Terminate user session based on time period](https://discuss.elastic.co/t/terminate-user-session-based-on-time-period/300975)
**Author:** [@dkaflowitz](https://discuss.elastic.co/u/dkaflowitz)\ **Replies:** 2\ **Last updated:** [March 29, 2022, 2:18pm UTC](https://discuss.elastic.co/t/terminate-user-session-based-on-time-period/300975 "2022-03-29T14:18:46Z")
Can Elasticsearch be configured to terminate and log out privileged users after a set period? If so, is it documented anywhere? --- ## [Filebeat using default input path instead of my log path](https://discuss.elastic.co/t/filebeat-using-default-input-path-instead-of-my-log-path/300982)
**Author:** [@benny111](https://discuss.elastic.co/u/benny111)\ **Replies:** 0\ **Last updated:** [March 29, 2022, 2:26pm UTC](https://discuss.elastic.co/t/filebeat-using-default-input-path-instead-of-my-log-path/300982 "2022-03-29T14:26:33Z")
I have a filebeat installed in Ubuntu 20.04. I have changed my input file path to my own log path. But when it starts to service, it seems to collect the default system logs. I tried to use sudo /usr/share/filebeat/b… --- ## [Reindex from AWS elasticsearch to elastic cloud](https://discuss.elastic.co/t/reindex-from-aws-elasticsearch-to-elastic-cloud/300911)
**Author:** [@Vadiraj\_B](https://discuss.elastic.co/u/Vadiraj_B)\ **Replies:** 3\ **Last updated:** [March 29, 2022, 2:02pm UTC](https://discuss.elastic.co/t/reindex-from-aws-elasticsearch-to-elastic-cloud/300911 "2022-03-29T14:02:55Z")
We have a AWS Elasticsearch cluster. We are trying to reindex this onto elastic cloud instance. We have created Elasticsearch intstance on elastic cloud. and from kibana trying to reindex. We have listed remote source (A… --- ## [Create and email report based on query](https://discuss.elastic.co/t/create-and-email-report-based-on-query/300971)
**Author:** [@ddraganp6](https://discuss.elastic.co/u/ddraganp6)\ **Replies:** 0\ **Last updated:** [March 29, 2022, 1:55pm UTC](https://discuss.elastic.co/t/create-and-email-report-based-on-query/300971 "2022-03-29T13:55:02Z")
Hi everyone, I was able to succesfully retrieve the data I need - my top 10 most ERROR log producing applications - using this query : GET \_search { "size": 0, "query": { "bool": { "must": \[ { … --- ## [Permissions issues after upgrading heartbeat to 8.0](https://discuss.elastic.co/t/permissions-issues-after-upgrading-heartbeat-to-8-0/297383)
**Author:** [@Marc-Antoine\_J](https://discuss.elastic.co/u/Marc-Antoine_J)\ **Replies:** 7\ **Last updated:** [March 29, 2022, 1:48pm UTC](https://discuss.elastic.co/t/permissions-issues-after-upgrading-heartbeat-to-8-0/297383 "2022-03-29T13:48:46Z")
Good Day, I recently upgrade my test installation of the Elastic Stack to 8.0. The Elasticsearch and kibana installations went fine. On the heartbeat side I'm getting the following errors: Cannot index event publisher.… --- ## [Logstash: \[ERROR\]\[logstash.javapipeline \]\[main\] Pipeline error | Cannot get new connection from pool](https://discuss.elastic.co/t/logstash-error-logstash-javapipeline-main-pipeline-error-cannot-get-new-connection-from-pool/300696)
**Author:** [@Bavaria](https://discuss.elastic.co/u/Bavaria)\ **Replies:** 11\ **Last updated:** [March 29, 2022, 1:40pm UTC](https://discuss.elastic.co/t/logstash-error-logstash-javapipeline-main-pipeline-error-cannot-get-new-connection-from-pool/300696 "2022-03-29T13:40:02Z")
I am trying to start logstash pipeline. But after long search, I do not know what I am doing wrong. I am getting this output: C:\\Users\\Name\\ElasticStack\\logstash-8.0.1\>.\\bin\\logstash.bat -f erste-pipeline.conf "Using bu… --- ## [\[logstash.config.source.multilocal\] Ignoring the 'pipelines.yml' file because modules or co mmand line options are specified](https://discuss.elastic.co/t/logstash-config-source-multilocal-ignoring-the-pipelines-yml-file-because-modules-or-co-mmand-line-options-are-specified/300852)
**Author:** [@lug-gh](https://discuss.elastic.co/u/lug-gh)\ **Replies:** 6\ **Last updated:** [March 29, 2022, 1:23pm UTC](https://discuss.elastic.co/t/logstash-config-source-multilocal-ignoring-the-pipelines-yml-file-because-modules-or-co-mmand-line-options-are-specified/300852 "2022-03-29T13:23:34Z")
Hi, I wan't to use multiple pipelines, but after some testing I noticed the pipelines.yml won't be loaded. I searched the web and found it's ignored when you specify -f or -e (Multiple Pipelines | Logstash Reference \[8.1… --- ## [Pie chart on accumulated data](https://discuss.elastic.co/t/pie-chart-on-accumulated-data/300545)
**Author:** [@MarioRojas](https://discuss.elastic.co/u/MarioRojas)\ **Replies:** 3\ **Last updated:** [March 29, 2022, 1:25pm UTC](https://discuss.elastic.co/t/pie-chart-on-accumulated-data/300545 "2022-03-29T13:25:38Z")
Hi All, I'm very new to Kibana and I need to create a pie chart based on the sum of the values present in different logs, marginalized from a given term in yet another log... In Discover the data looks like this: W… --- ## [Logstash redundancy and availability in ELK cluster](https://discuss.elastic.co/t/logstash-redundancy-and-availability-in-elk-cluster/300963)
**Author:** [@ELK\_Dummy](https://discuss.elastic.co/u/ELK_Dummy)\ **Replies:** 2\ **Last updated:** [March 29, 2022, 1:15pm UTC](https://discuss.elastic.co/t/logstash-redundancy-and-availability-in-elk-cluster/300963 "2022-03-29T13:15:44Z")
Hi all, The question is about Logstash redundancy and availability. We have an Elasticsearch Cluster running fine with 3 CentOS nodes. One of this nodes hosts Losgstash. Logstash is set to ingest log files sent by SFT… --- ## [Write and then Read consistency](https://discuss.elastic.co/t/write-and-then-read-consistency/300785)
**Author:** [@TheGreatBaldOne](https://discuss.elastic.co/u/TheGreatBaldOne)\ **Replies:** 2\ **Last updated:** [March 29, 2022, 1:11pm UTC](https://discuss.elastic.co/t/write-and-then-read-consistency/300785 "2022-03-29T13:11:59Z")
I am trying to achieve write and then read consistency. In other words, once i update or insert a document, I want to immediately read it correctly. I am getting a a list of a user's posts from ES insert a new pos… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=994) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=996)