# Latest **URL:** https://discuss.elastic.co/latest.md?page=1249 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1250 --- ## [Kibana date not showing correctly](https://discuss.elastic.co/t/kibana-date-not-showing-correctly/297652)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 4\ **Last updated:** [February 22, 2022, 2:30pm UTC](https://discuss.elastic.co/t/kibana-date-not-showing-correctly/297652 "2022-02-22T14:30:12Z")
Hi All, We are using ELK 7.6.2 stack. For some reason, all of a sudden Kibana started displaying end date incorrectly. Instead of showing the current time it is stuck to an old time during the same day. Please see bel… --- ## [Logstash seems to copy the index indefinitely](https://discuss.elastic.co/t/logstash-seems-to-copy-the-index-indefinitely/297698)
**Author:** [@pain368](https://discuss.elastic.co/u/pain368)\ **Replies:** 3\ **Last updated:** [February 22, 2022, 2:23pm UTC](https://discuss.elastic.co/t/logstash-seems-to-copy-the-index-indefinitely/297698 "2022-02-22T14:23:00Z")
Hello ELK team, This is my first thread so i hope will be good enough to solve my problem. I have One primary cluster(A), and today i created second cluster(B) only for Machine Learning purpose ( i don;t want to connec… --- ## [Logstash send logs to monitoring cluster](https://discuss.elastic.co/t/logstash-send-logs-to-monitoring-cluster/297798)
**Author:** [@caseydm](https://discuss.elastic.co/u/caseydm)\ **Replies:** 4\ **Last updated:** [February 22, 2022, 2:19pm UTC](https://discuss.elastic.co/t/logstash-send-logs-to-monitoring-cluster/297798 "2022-02-22T14:19:34Z")
Hi all. I'm using logstash to send data from redshift to Elasticsearch. I monitor my pipelines with metricbeats, and am able to see general statistics about logstash within my monitoring cluster. What I can't see is logs… --- ## [Elastic with Azure private link](https://discuss.elastic.co/t/elastic-with-azure-private-link/297910)
**Author:** [@Ced](https://discuss.elastic.co/u/Ced)\ **Replies:** 0\ **Last updated:** [February 22, 2022, 2:17pm UTC](https://discuss.elastic.co/t/elastic-with-azure-private-link/297910 "2022-02-22T14:17:17Z")
Hello everybody, I use this link to secure my deployments on Elastic cloud with Azure private link but I can't deploy my elastic agents (error 404). Everything is correct when I didn't use private link and traffic filte… --- ## [Need help with highlight api performance](https://discuss.elastic.co/t/need-help-with-highlight-api-performance/295381)
**Author:** [@SheetalM](https://discuss.elastic.co/u/SheetalM)\ **Replies:** 1\ **Last updated:** [February 22, 2022, 2:14pm UTC](https://discuss.elastic.co/t/need-help-with-highlight-api-performance/295381 "2022-02-22T14:14:01Z")
We are trying to find which fields matched a given user search string that is sent as a query\_string query. We have been using the explain=true in the request, where the response in the explanation section contains each … --- ## [Rebooting Logstash VM](https://discuss.elastic.co/t/rebooting-logstash-vm/297904)
**Author:** [@Cosmus\_Wright](https://discuss.elastic.co/u/Cosmus_Wright)\ **Replies:** 2\ **Last updated:** [February 22, 2022, 2:11pm UTC](https://discuss.elastic.co/t/rebooting-logstash-vm/297904 "2022-02-22T14:11:30Z")
Hello! If I stop the Logstash service and reboot the the VM, will any incoming events during that time be lost? Currently we have an Azure EventHub that sends the events to Logstash and then onwards to Elasticsearch. I… --- ## [Logstash Oracle 19c - IO Error: Got minus one from a read call](https://discuss.elastic.co/t/logstash-oracle-19c-io-error-got-minus-one-from-a-read-call/297902)
**Author:** [@tmihaldinec](https://discuss.elastic.co/u/tmihaldinec)\ **Replies:** 0\ **Last updated:** [February 22, 2022, 1:38pm UTC](https://discuss.elastic.co/t/logstash-oracle-19c-io-error-got-minus-one-from-a-read-call/297902 "2022-02-22T13:38:18Z")
Hi can you please help what i am doing wrong.. this same config works fine with ver 12 input { jdbc { statement\_filepath =\> "/usr/share/logstash/pipelines/sql/database\_query.sql" #important the driver library must be… --- ## [Add field multiline under multiline filebeat/logstash](https://discuss.elastic.co/t/add-field-multiline-under-multiline-filebeat-logstash/297765)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 1\ **Last updated:** [February 22, 2022, 1:53pm UTC](https://discuss.elastic.co/t/add-field-multiline-under-multiline-filebeat-logstash/297765 "2022-02-22T13:53:15Z")
Hi, I would like to know if I can add a field if I find a word in the message but with just a block of lines. log file example: 2022-01-01 17:27:56 - Starting d........ 2022-12-22 17:27:59 - Run..... . . 2022-01-0… --- ## [Error while running esrally for benchmarking es](https://discuss.elastic.co/t/error-while-running-esrally-for-benchmarking-es/297862)
**Author:** [@amitsa](https://discuss.elastic.co/u/amitsa)\ **Replies:** 2\ **Last updated:** [February 22, 2022, 1:24pm UTC](https://discuss.elastic.co/t/error-while-running-esrally-for-benchmarking-es/297862 "2022-02-22T13:24:06Z")
Hi All, Getting below error while running esrally on Elasticsearch single node \[WARNING\] Error rate is 100.0 for operation 'refresh-after-index'. Please check the logs. \[WARNING\] No throughput metrics available for \[r… --- ## [How to dynamically add fields to index using the Java Client API?](https://discuss.elastic.co/t/how-to-dynamically-add-fields-to-index-using-the-java-client-api/297342)
**Author:** [@vmassol](https://discuss.elastic.co/u/vmassol)\ **Replies:** 2\ **Last updated:** [February 22, 2022, 1:08pm UTC](https://discuss.elastic.co/t/how-to-dynamically-add-fields-to-index-using-the-java-client-api/297342 "2022-02-22T13:08:48Z")
Hi, I'd like to index some data in a modular way using the new Java Client API and I don't see how to achieve this by passing a Java object. The issue is that this object needs to contain all fields and that doesn't mak… --- ## [Terms aggregation with ICU multi-field and arrays](https://discuss.elastic.co/t/terms-aggregation-with-icu-multi-field-and-arrays/297899)
**Author:** [@mhugo](https://discuss.elastic.co/u/mhugo)\ **Replies:** 1\ **Last updated:** [February 22, 2022, 1:07pm UTC](https://discuss.elastic.co/t/terms-aggregation-with-icu-multi-field-and-arrays/297899 "2022-02-22T13:07:12Z")
Hi. I struggle to sort buckets of a terms aggregation based on ICU collation to respect the ordering of accented words. And especially when some the text field to sort is indexed as arrays. I started with a simple term… --- ## [Rollover between lifecycle states](https://discuss.elastic.co/t/rollover-between-lifecycle-states/297860)
**Author:** [@shinobu](https://discuss.elastic.co/u/shinobu)\ **Replies:** 0\ **Last updated:** [February 22, 2022, 8:32am UTC](https://discuss.elastic.co/t/rollover-between-lifecycle-states/297860 "2022-02-22T08:32:31Z")
Hello, I have configured my indexes to work with ILM policy to automatically move between states like hot and warm. Also I want them to get automatically removed when they get too old. For this the default policies are … --- ## [Bucket Aggregation - Using Filters + Date Histo](https://discuss.elastic.co/t/bucket-aggregation-using-filters-date-histo/297350)
**Author:** [@shivabharat](https://discuss.elastic.co/u/shivabharat)\ **Replies:** 1\ **Last updated:** [February 22, 2022, 12:13pm UTC](https://discuss.elastic.co/t/bucket-aggregation-using-filters-date-histo/297350 "2022-02-22T12:13:42Z")
Hi All, I have a kibana visualization in which I use a bucket aggregation with filters. I would like to have data histogram set to this (E.g. retrieve max of a value for a Month based on filters) I would like to know i… --- ## [Manage an Elastic Cloud resource in Azure](https://discuss.elastic.co/t/manage-an-elastic-cloud-resource-in-azure/297240)
**Author:** [@sc12](https://discuss.elastic.co/u/sc12)\ **Replies:** 2\ **Last updated:** [February 22, 2022, 11:59am UTC](https://discuss.elastic.co/t/manage-an-elastic-cloud-resource-in-azure/297240 "2022-02-22T11:59:57Z")
I recently had Elasticsearch deployed on Azure as a marketplace app on a Pay as you go subscription. We were able to install Elastic agents straight from Azure which was a big help for VMs. I have now got the full licens… --- ## [Index does not accept docs from the start](https://discuss.elastic.co/t/index-does-not-accept-docs-from-the-start/296206)
**Author:** [@notgurev](https://discuss.elastic.co/u/notgurev)\ **Replies:** 3\ **Last updated:** [February 22, 2022, 11:44am UTC](https://discuss.elastic.co/t/index-does-not-accept-docs-from-the-start/296206 "2022-02-22T11:44:46Z")
I create indices hourly and bulk insert a lot of data. It usually works well, but I've experienced those spikes where the number of documents just drops to 0. That's when the index is created. What is this? =( The sc… --- ## [Logstash Filter ordering fields](https://discuss.elastic.co/t/logstash-filter-ordering-fields/297877)
**Author:** [@Simone1](https://discuss.elastic.co/u/Simone1)\ **Replies:** 0\ **Last updated:** [February 22, 2022, 10:57am UTC](https://discuss.elastic.co/t/logstash-filter-ordering-fields/297877 "2022-02-22T10:57:52Z")
I pull data from a remote MySQL DB from different columns and tables, i need to reorder the fields, how can i do? Example with stdout it doesn't print in a fixed order but it change every time, i want to see something l… --- ## [Hide search bar KQL and calendar control](https://discuss.elastic.co/t/hide-search-bar-kql-and-calendar-control/296523)
**Author:** [@rituzza](https://discuss.elastic.co/u/rituzza)\ **Replies:** 1\ **Last updated:** [February 22, 2022, 10:25am UTC](https://discuss.elastic.co/t/hide-search-bar-kql-and-calendar-control/296523 "2022-02-22T10:25:30Z")
Hi everyone!! I want hide search bar KQL and calendar control in a specific space of my kibana. i use the version 7.7.1, is it possible? thank you --- ## [Field has a type conflict](https://discuss.elastic.co/t/field-has-a-type-conflict/296331)
**Author:** [@kibanauser4](https://discuss.elastic.co/u/kibanauser4)\ **Replies:** 1\ **Last updated:** [February 22, 2022, 10:21am UTC](https://discuss.elastic.co/t/field-has-a-type-conflict/296331 "2022-02-22T10:21:49Z")
I have a field mapped as geo\_point in my indices. A new index is created every day. In some of the indices the field was saved as a geo\_point field with coordinates, but now instead of a geo\_point, its lon and lat are ge… --- ## [Auditbeat do not delete correctly](https://discuss.elastic.co/t/auditbeat-do-not-delete-correctly/297814)
**Author:** [@Tester854](https://discuss.elastic.co/u/Tester854)\ **Replies:** 0\ **Last updated:** [February 21, 2022, 9:27pm UTC](https://discuss.elastic.co/t/auditbeat-do-not-delete-correctly/297814 "2022-02-21T21:27:01Z")
Hi, I noticed that deleting auditbeat with the parameter (backspressure\_strategy:kernel) audit rules continue to work. There are events from them in dmesg. How to remove auditbeat using (backspressure\_strategy:kernel)… --- ## [Add field problem logstash](https://discuss.elastic.co/t/add-field-problem-logstash/297858)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 1\ **Last updated:** [February 22, 2022, 10:18am UTC](https://discuss.elastic.co/t/add-field-problem-logstash/297858 "2022-02-22T10:18:52Z")
Hi, I would like to know if I can add field if I find a word in the message but under a block of lines. filebeat.yml: multiline.type: pattern multiline.pattern: '^\\d{4}-\\d{2}-\\d{2}\\s\\d{2}:\\d{2}:\\d{2}\\s{3}-\\sStarti… --- ## [Kibana gauge or goal with range from data in indice](https://discuss.elastic.co/t/kibana-gauge-or-goal-with-range-from-data-in-indice/297672)
**Author:** [@warut](https://discuss.elastic.co/u/warut)\ **Replies:** 1\ **Last updated:** [February 22, 2022, 10:18am UTC](https://discuss.elastic.co/t/kibana-gauge-or-goal-with-range-from-data-in-indice/297672 "2022-02-22T10:18:40Z")
Hello, I use goal to show employee work today compare with total number of employee. It work well if I specify range with static value such as today 24 worker come from total 30 worker but total worker is dynamic so I t… --- ## [Updated dashboard refresh issue](https://discuss.elastic.co/t/updated-dashboard-refresh-issue/296705)
**Author:** [@Osman\_Samil\_AKCELIK](https://discuss.elastic.co/u/Osman_Samil_AKCELIK)\ **Replies:** 1\ **Last updated:** [February 22, 2022, 10:13am UTC](https://discuss.elastic.co/t/updated-dashboard-refresh-issue/296705 "2022-02-22T10:13:55Z")
End users continue to see the previous kibana dashboard when the dashboard is updated via kibana api. Refresh dashboard is not working if we switch mode to edit and go to the view move by discarding changes, we are able… --- ## [Dashboard dark mode options in Kibana 7](https://discuss.elastic.co/t/dashboard-dark-mode-options-in-kibana-7/297472)
**Author:** [@buncieboy](https://discuss.elastic.co/u/buncieboy)\ **Replies:** 1\ **Last updated:** [February 22, 2022, 10:09am UTC](https://discuss.elastic.co/t/dashboard-dark-mode-options-in-kibana-7/297472 "2022-02-22T10:09:13Z")
We are currently migrating from Elastic 6 to 7. We have a internally public dashboard we use to show some metrics from our data, which we then embed in our application. In Elastic 6 we were able to pass the users dark mo… --- ## [Again trying to restore backup from 6.5.11 to 7.16.3](https://discuss.elastic.co/t/again-trying-to-restore-backup-from-6-5-11-to-7-16-3/297863)
**Author:** [@fribse](https://discuss.elastic.co/u/fribse)\ **Replies:** 0\ **Last updated:** [February 22, 2022, 9:27am UTC](https://discuss.elastic.co/t/again-trying-to-restore-backup-from-6-5-11-to-7-16-3/297863 "2022-02-22T09:27:00Z")
So I've finally gotten my Elasticsearch and kibana up and running again, darned that was tough. So I'm back to my real task of trying to figure out how to get my snapshot back into Elasticsearch. I've set up path.repo … --- ## [Kibana 7.16.3 - How to use custom logo and heading in Login page?](https://discuss.elastic.co/t/kibana-7-16-3-how-to-use-custom-logo-and-heading-in-login-page/297837)
**Author:** [@ravinderk](https://discuss.elastic.co/u/ravinderk)\ **Replies:** 1\ **Last updated:** [February 22, 2022, 10:06am UTC](https://discuss.elastic.co/t/kibana-7-16-3-how-to-use-custom-logo-and-heading-in-login-page/297837 "2022-02-22T10:06:28Z")
Hi All I'm using Kibana 7.16.3 version. I need to use custom logo and custom heading in Kibana login page. But not finding proper instructions to do that. Please let me know if anyone knows the steps for this. Thanks i… --- ## [Change color when timestamp field in doc is older then 10 minutes](https://discuss.elastic.co/t/change-color-when-timestamp-field-in-doc-is-older-then-10-minutes/297080)
**Author:** [@Soren\_vdc](https://discuss.elastic.co/u/Soren_vdc)\ **Replies:** 1\ **Last updated:** [February 22, 2022, 9:42am UTC](https://discuss.elastic.co/t/change-color-when-timestamp-field-in-doc-is-older-then-10-minutes/297080 "2022-02-22T09:42:09Z")
Hi, I'm searching for the best setup to configure a visual to display: green: when timestamp in doc is created in last 5 minutes red: when timestamp in last doc is older then 10 minutes. Anyone any tips wh… --- ## [Fleet server - how to add a fleet server after added one and deleted](https://discuss.elastic.co/t/fleet-server-how-to-add-a-fleet-server-after-added-one-and-deleted/297762)
**Author:** [@gabrielfsousa](https://discuss.elastic.co/u/gabrielfsousa)\ **Replies:** 3\ **Last updated:** [February 22, 2022, 9:41am UTC](https://discuss.elastic.co/t/fleet-server-how-to-add-a-fleet-server-after-added-one-and-deleted/297762 "2022-02-22T09:41:51Z")
i deleted my fleet server, want to add a new feet server, but i dont have the "add a fleet sever" window only the window to add the agent. --- ## [Indexing slowlog investigation](https://discuss.elastic.co/t/indexing-slowlog-investigation/297752)
**Author:** [@Itay\_Bittan](https://discuss.elastic.co/u/Itay_Bittan)\ **Replies:** 7\ **Last updated:** [February 22, 2022, 9:31am UTC](https://discuss.elastic.co/t/indexing-slowlog-investigation/297752 "2022-02-22T09:31:18Z")
Hi! We have a very old Elasticsearch cluster v1.6.0 (we will hopefully upgrade soon) with 20 nodes: 3 master nodes and 17 data nodes. As a B2B service, each index represents a different business (customer). This clust… --- ## [Elasticsearch.service: Main process exited, code=exited, status=1](https://discuss.elastic.co/t/elasticsearch-service-main-process-exited-code-exited-status-1/297845)
**Author:** [@kiran\_t](https://discuss.elastic.co/u/kiran_t)\ **Replies:** 2\ **Last updated:** [February 22, 2022, 8:33am UTC](https://discuss.elastic.co/t/elasticsearch-service-main-process-exited-code-exited-status-1/297845 "2022-02-22T08:33:17Z")
Hello, Elasticsearch starts failing with following error and then GCP node gets restarted. sudo systemctl status Elasticsearch.service ● elasticsearch.service - Elasticsearch Loaded: loaded (/lib/systemd/system/e… --- ## [Hiding Index Patterns](https://discuss.elastic.co/t/hiding-index-patterns/297512)
**Author:** [@shinobu](https://discuss.elastic.co/u/shinobu)\ **Replies:** 2\ **Last updated:** [February 22, 2022, 8:17am UTC](https://discuss.elastic.co/t/hiding-index-patterns/297512 "2022-02-22T08:17:20Z")
Hello, would you know if it is possible to hide certain Index Patterns for users in discovery if they do not have the permission to view the indexes? Thank you. Best Regards. [Previous page](https://discuss.elastic.co/latest.md?page=1248) [Next page](https://discuss.elastic.co/latest.md?page=1250)