# Latest **URL:** https://discuss.elastic.co/latest.md?page=1523 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1524 --- ## [How to extract a substring](https://discuss.elastic.co/t/how-to-extract-a-substring/281578)
**Author:** [@dvrla](https://discuss.elastic.co/u/dvrla)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 7:10am UTC](https://discuss.elastic.co/t/how-to-extract-a-substring/281578 "2021-08-17T07:10:56Z")
Hi, I would like to extract the value of a cookie from an HTTP request but up until now I can´t make it work. I´m trying to get from a request field like this GET /trading/css/main.css?version=4.4.0 HTTP/1.1, Host: ex… --- ## [Kibana canvas filter](https://discuss.elastic.co/t/kibana-canvas-filter/277043)
**Author:** [@xquest](https://discuss.elastic.co/u/xquest)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 7:01am UTC](https://discuss.elastic.co/t/kibana-canvas-filter/277043 "2021-08-17T07:01:35Z")
What is alternative for "level, rownum" in Kibana sql?? I need to build my filter like: select (case LEVEL when 1 then 'xyz' when 2 then 'xzt' ... end) as D, select (case LEVEL when 1 then '1' when 2 then '2'… --- ## [Kibana essql - select from select](https://discuss.elastic.co/t/kibana-essql-select-from-select/277044)
**Author:** [@xquest](https://discuss.elastic.co/u/xquest)\ **Replies:** 3\ **Last updated:** [August 17, 2021, 7:00am UTC](https://discuss.elastic.co/t/kibana-essql-select-from-select/277044 "2021-08-17T07:00:47Z")
I know that it is limitation in regular SQL in Kibana, but ESSQL is more like script than single query, so: Is it possible in ESSQL to use select from select?. For example, saving result from first select as table int… --- ## [App Search - Listing out Categories with Image and Item counts](https://discuss.elastic.co/t/app-search-listing-out-categories-with-image-and-item-counts/281358)
**Author:** [@selectedpixel](https://discuss.elastic.co/u/selectedpixel)\ **Replies:** 2\ **Last updated:** [August 16, 2021, 12:20pm UTC](https://discuss.elastic.co/t/app-search-listing-out-categories-with-image-and-item-counts/281358 "2021-08-16T12:20:10Z")
I have an Elasticsearch Index setup with the following document structure. NOTE: THIS IS BEING DONE USING APP SEARCH SO I'm UNABLE TO USE NESTED FIELDS \[ { "id":id, "title: "Sample Title… --- ## [How to set up security for elasticsearch cluster](https://discuss.elastic.co/t/how-to-set-up-security-for-elasticsearch-cluster/281552)
**Author:** [@0d153a83fd88577dba87](https://discuss.elastic.co/u/0d153a83fd88577dba87)\ **Replies:** 10\ **Last updated:** [August 17, 2021, 6:42am UTC](https://discuss.elastic.co/t/how-to-set-up-security-for-elasticsearch-cluster/281552 "2021-08-17T06:42:34Z")
network.host: ip1 discovery.seed\_hosts: \["ip1", "ip2"\] cluster.initial\_master\_nodes: \["ip1"\] network.host: ip2 discovery.seed\_hosts: \["ip1", "ip2"\] cluster.initial\_master\_nodes: \["ip1"\] these are two yml files o… --- ## [\[KIBANA\]\[Rules and Connectors\] You must enable Transport Layer Security](https://discuss.elastic.co/t/kibana-rules-and-connectors-you-must-enable-transport-layer-security/281350)
**Author:** [@Patrick57](https://discuss.elastic.co/u/Patrick57)\ **Replies:** 4\ **Last updated:** [August 17, 2021, 6:14am UTC](https://discuss.elastic.co/t/kibana-rules-and-connectors-you-must-enable-transport-layer-security/281350 "2021-08-17T06:14:18Z")
Dear Elastic Community, I am writing to request for your help. I am currently running an ELK stack on latest version (7.14) on a standalone CentOS 7 server. I would like to use the Rules and Connectors functionality b… --- ## [NO such file or directory](https://discuss.elastic.co/t/no-such-file-or-directory/281632)
**Author:** [@naaviin](https://discuss.elastic.co/u/naaviin)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 6:12am UTC](https://discuss.elastic.co/t/no-such-file-or-directory/281632 "2021-08-17T06:12:03Z")
Can i know why i am hitting this. i am using docker. what i did wrong? /usr/share/logstash/elastic-certificates.p12 (No such file or directory)" --- ## [Filebeat harvests system logs even when not specified](https://discuss.elastic.co/t/filebeat-harvests-system-logs-even-when-not-specified/281626)
**Author:** [@GitSpree23](https://discuss.elastic.co/u/GitSpree23)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 5:49am UTC](https://discuss.elastic.co/t/filebeat-harvests-system-logs-even-when-not-specified/281626 "2021-08-17T05:49:40Z")
filebeat.yml: path.config: /Users/sp/servers/filebeat-7.14.0-darwin-x86\_64/ filebeat.config: inputs: enabled: false path: /Users/sp/servers/filebeat-7.14.0-darwin-x86\_64/filebeat.yml filebeat.inputs: - type… --- ## [Kibana fails to start](https://discuss.elastic.co/t/kibana-fails-to-start/281562)
**Author:** [@Avnish\_Singh](https://discuss.elastic.co/u/Avnish_Singh)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 5:32am UTC](https://discuss.elastic.co/t/kibana-fails-to-start/281562 "2021-08-17T05:32:46Z")
Failed to start kibana on centos 8 ElasticSearch version: 7.14 Kibana Version: 7.14 the log file looks like: \[root@localhost kibana\]# tail -10f kibana.log {"type":"log","@timestamp":"2021-08-16T19:51:10+05:30","tags"… --- ## [No subsecond precision for apache logs](https://discuss.elastic.co/t/no-subsecond-precision-for-apache-logs/281614)
**Author:** [@rizvaughan](https://discuss.elastic.co/u/rizvaughan)\ **Replies:** 6\ **Last updated:** [August 17, 2021, 4:47am UTC](https://discuss.elastic.co/t/no-subsecond-precision-for-apache-logs/281614 "2021-08-17T04:47:43Z")
Hello all, I have apache logs coming into elasticsearch(aws). The logs are being created in epoch 'format'. I am using td-agent for the transportation. I tried different methods to transform the date to humand readable … --- ## [Error creating runner from config: failed to create input: Can only start an input when all related states are finished:](https://discuss.elastic.co/t/error-creating-runner-from-config-failed-to-create-input-can-only-start-an-input-when-all-related-states-are-finished/281328)
**Author:** [@lilyyy](https://discuss.elastic.co/u/lilyyy)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 4:34am UTC](https://discuss.elastic.co/t/error-creating-runner-from-config-failed-to-create-input-can-only-start-an-input-when-all-related-states-are-finished/281328 "2021-08-17T04:34:50Z")
Hi all I get the logs from suricata(eve.json) so I've enabled suricata module in filebeat. But whenever I start filebeat, I got this error. 2021-08-13T18:11:18.650+0900 ERROR \[reload\] cfgfile/list.go:99 Error creating… --- ## [Data migration between elastic clusters](https://discuss.elastic.co/t/data-migration-between-elastic-clusters/281363)
**Author:** [@shanavas](https://discuss.elastic.co/u/shanavas)\ **Replies:** 3\ **Last updated:** [August 17, 2021, 4:28am UTC](https://discuss.elastic.co/t/data-migration-between-elastic-clusters/281363 "2021-08-17T04:28:04Z")
We have two es clusters, one running on premise and another one on the cloud. The one premise one can't store data for more than a week. The cloud cluster retains the data for a longer duration (a few months). So the … --- ## [Configuring indices for monitoring using new template API](https://discuss.elastic.co/t/configuring-indices-for-monitoring-using-new-template-api/281533)
**Author:** [@aoi1](https://discuss.elastic.co/u/aoi1)\ **Replies:** 6\ **Last updated:** [August 17, 2021, 4:03am UTC](https://discuss.elastic.co/t/configuring-indices-for-monitoring-using-new-template-api/281533 "2021-08-17T04:03:17Z")
Hello! I have a question. In this document, it uses \_template API. But I recognize the \_template API is deprecated in Elasticsearch version 7.8. Is this document correct in the version after 7.8? I am trying to conf… --- ## [How to set log's remain time in eck?](https://discuss.elastic.co/t/how-to-set-logs-remain-time-in-eck/281623)
**Author:** [@111501](https://discuss.elastic.co/u/111501)\ **Replies:** 5\ **Last updated:** [August 17, 2021, 3:36am UTC](https://discuss.elastic.co/t/how-to-set-logs-remain-time-in-eck/281623 "2021-08-17T03:36:19Z")
I can't find this parameter in eck official document. --- ## [How can I log 400 Bad Request when creating documents](https://discuss.elastic.co/t/how-can-i-log-400-bad-request-when-creating-documents/281238)
**Author:** [@kiancross](https://discuss.elastic.co/u/kiancross)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 2:20am UTC](https://discuss.elastic.co/t/how-can-i-log-400-bad-request-when-creating-documents/281238 "2021-08-17T02:20:02Z")
When creating documents, I want 400 Bad Requests to be added to the log so I can see clients that are getting errors. Is this possible? --- ## [Unable to revive connection](https://discuss.elastic.co/t/unable-to-revive-connection/281245)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 1:31am UTC](https://discuss.elastic.co/t/unable-to-revive-connection/281245 "2021-08-17T01:31:01Z")
I'm working on a new proof-of-concept deployment with a self-managed, single-node cluster. After encrypting traffic between Kibana and Elasticsearch (using this documentation), I'm now unable to access Kibana. When att… --- ## [All shards being reassigned from one of our Warm nodes](https://discuss.elastic.co/t/all-shards-being-reassigned-from-one-of-our-warm-nodes/281203)
**Author:** [@TheEvilDonut](https://discuss.elastic.co/u/TheEvilDonut)\ **Replies:** 3\ **Last updated:** [August 17, 2021, 1:29am UTC](https://discuss.elastic.co/t/all-shards-being-reassigned-from-one-of-our-warm-nodes/281203 "2021-08-17T01:29:59Z")
Good day all. We have noticed a few days ago that all shards from one of our warm data nodes are being rebalanced and reassigned to the other warm nodes. We are currently at a loss at finding the reason. The node itsel… --- ## [Unable to take snapshot - Version 5.6.12](https://discuss.elastic.co/t/unable-to-take-snapshot-version-5-6-12/281262)
**Author:** [@sridharparepalli](https://discuss.elastic.co/u/sridharparepalli)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 1:24am UTC](https://discuss.elastic.co/t/unable-to-take-snapshot-version-5-6-12/281262 "2021-08-17T01:24:24Z")
Hello, I was able to register the snapshot successfully. However, when I try to take a backup I'm getting this error message. "No matches found..." Any help is greatly appreciated. Register Snapshot (works fine): sudo … --- ## [Aggregation with different timezones](https://discuss.elastic.co/t/aggregation-with-different-timezones/281305)
**Author:** [@scorona85](https://discuss.elastic.co/u/scorona85)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 1:22am UTC](https://discuss.elastic.co/t/aggregation-with-different-timezones/281305 "2021-08-17T01:22:03Z")
How can I create an aggregation of datas aquired from different part of Timezones (example New York -6.00 and Rome +2.00). In the document I have a field 'timestamp' defined as "data". I have to create a "date\_histogram"… --- ## [Unrecognized VM option 'UseConcMarkSweepGC' while trying to install ES 7.13.0](https://discuss.elastic.co/t/unrecognized-vm-option-useconcmarksweepgc-while-trying-to-install-es-7-13-0/281307)
**Author:** [@babai7](https://discuss.elastic.co/u/babai7)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 1:20am UTC](https://discuss.elastic.co/t/unrecognized-vm-option-useconcmarksweepgc-while-trying-to-install-es-7-13-0/281307 "2021-08-17T01:20:55Z")
Aug 13 09:16:10 \*\*\*\*\*\*\*\*\* elasticsearch\[1120000\]: error: Aug 13 09:16:10 \*\*\*\*\*\*\*\*\* elasticsearch\[1120000\]: Unrecognized VM option 'UseConcMarkSweepGC' Aug 13 09:16:10 \*\*\*\*\*\*\*\*\* elasticsearch\[1120000\]: Error: Could not … --- ## [Kibana Dashboard compare fields from filebeat and Heartbeat](https://discuss.elastic.co/t/kibana-dashboard-compare-fields-from-filebeat-and-heartbeat/281343)
**Author:** [@newbie5](https://discuss.elastic.co/u/newbie5)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 1:19am UTC](https://discuss.elastic.co/t/kibana-dashboard-compare-fields-from-filebeat-and-heartbeat/281343 "2021-08-17T01:19:42Z")
Hi, I have filed "name" in filebeat - type: log enabled: true paths: - C:\\Desktop\\ELK4\\aplikacja\\macro.log fields: log\_type: app name: BYD1 multiline.type: pattern multiline.pattern: '^\\\*' m… --- ## [Get the full date format in elasticsearch](https://discuss.elastic.co/t/get-the-full-date-format-in-elasticsearch/281310)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 1:18am UTC](https://discuss.elastic.co/t/get-the-full-date-format-in-elasticsearch/281310 "2021-08-17T01:18:09Z")
Hi all, In an old project, the date fields have been mapped and data is present. Now in Kibana, I can see human readable format of date When i Use GET API to get format of date in devtools, i get ony format of date fi… --- ## [Set elasticsearch initial password via docker-compose](https://discuss.elastic.co/t/set-elasticsearch-initial-password-via-docker-compose/281299)
**Author:** [@naaviin](https://discuss.elastic.co/u/naaviin)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 1:15am UTC](https://discuss.elastic.co/t/set-elasticsearch-initial-password-via-docker-compose/281299 "2021-08-17T01:15:05Z")
Can i know, how to set initial password for elasticsearch database using docker-compose bin/elasticsearch-setup-passwords auto -u "http://192.168.2.120:9200 We can use environment variable however, it will display duri… --- ## [Can't login in kibana on ECK with ldap](https://discuss.elastic.co/t/cant-login-in-kibana-on-eck-with-ldap/281345)
**Author:** [@kbi753](https://discuss.elastic.co/u/kbi753)\ **Replies:** 3\ **Last updated:** [August 17, 2021, 1:10am UTC](https://discuss.elastic.co/t/cant-login-in-kibana-on-eck-with-ldap/281345 "2021-08-17T01:10:41Z")
Hello, We are trying to setup ldap authentication on our elasticsearch infra. Are are using ECK (elastic on kubernetes) I think I did a valid configuration, I don't find any error in the logs.. I even found this in t… --- ## [Sorting the response JSON](https://discuss.elastic.co/t/sorting-the-response-json/281532)
**Author:** [@Anubhav\_Singh1](https://discuss.elastic.co/u/Anubhav_Singh1)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 1:07am UTC](https://discuss.elastic.co/t/sorting-the-response-json/281532 "2021-08-17T01:07:36Z")
I'm using the below synonyms in my elasticsearch index. Road Types avenue,ave,boulevard,blvd,circle,cir,court,ct,drive,dr,highway,hwy,lane,ln,loop,lp,parkway,pkwy,place,pl,road,rd,route,rte,street,st,terrace,ter,trail… --- ## [ELK: NGINX logs analyze](https://discuss.elastic.co/t/elk-nginx-logs-analyze/281545)
**Author:** [@Wilford](https://discuss.elastic.co/u/Wilford)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 1:03am UTC](https://discuss.elastic.co/t/elk-nginx-logs-analyze/281545 "2021-08-17T01:03:40Z")
Hello to everyone, i have an strange issue. I'm running 2 nginx balancing units and it export it logs via filebeat to logstash and to elasticsearch index as a final destination. In a same time im running nignx stats mo… --- ## [Design Decision on Elastic Search - Replace Searchable Entity on Primary DB](https://discuss.elastic.co/t/design-decision-on-elastic-search-replace-searchable-entity-on-primary-db/281551)
**Author:** [@CharlieUPB](https://discuss.elastic.co/u/CharlieUPB)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 1:00am UTC](https://discuss.elastic.co/t/design-decision-on-elastic-search-replace-searchable-entity-on-primary-db/281551 "2021-08-17T01:00:16Z")
Hi guys I cant seem to find an answer to this question, can you please clarify my question. I have a normal database such as mongo where I store my domain related data, customers, products, prices. Now I came with the … --- ## [Elastic Seach: master not discovered or elected yet, an election requires at least 2 nodes with ids from](https://discuss.elastic.co/t/elastic-seach-master-not-discovered-or-elected-yet-an-election-requires-at-least-2-nodes-with-ids-from/281564)
**Author:** [@michelefa1988](https://discuss.elastic.co/u/michelefa1988)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 12:57am UTC](https://discuss.elastic.co/t/elastic-seach-master-not-discovered-or-elected-yet-an-election-requires-at-least-2-nodes-with-ids-from/281564 "2021-08-17T00:57:44Z")
Hello, Elastic search was running 7.10.1 was running successfully (via helm chart, however recently I got the following error The configuration is pretty standard (3 nodes 3x masters I would like to know what the corr… --- ## [Index-Pattern with mask in space, show more indexes that he has access to](https://discuss.elastic.co/t/index-pattern-with-mask-in-space-show-more-indexes-that-he-has-access-to/281613)
**Author:** [@solarcore](https://discuss.elastic.co/u/solarcore)\ **Replies:** 2\ **Last updated:** [August 16, 2021, 11:33pm UTC](https://discuss.elastic.co/t/index-pattern-with-mask-in-space-show-more-indexes-that-he-has-access-to/281613 "2021-08-16T23:33:57Z")
Hello! I have two indexes its "test-index-one" and "test-index-two", and pattern "test-index-" and its placed in the space "One". And i have role on my user, that says i have index "test-index-one" as read, and no mentio… --- ## [Condition Section after Grok section not working](https://discuss.elastic.co/t/condition-section-after-grok-section-not-working/281600)
**Author:** [@Athul\_Devkar](https://discuss.elastic.co/u/Athul_Devkar)\ **Replies:** 4\ **Last updated:** [August 16, 2021, 9:28pm UTC](https://discuss.elastic.co/t/condition-section-after-grok-section-not-working/281600 "2021-08-16T21:28:48Z")
Hello Everyone! I am trying to modify my pipeline to allow me to create few additional fields based on certain conditions. However, that section alone is not working and I don't see any errors in my log. I had used simi… [Previous page](https://discuss.elastic.co/latest.md?page=1522) [Next page](https://discuss.elastic.co/latest.md?page=1524)