# Latest **URL:** https://discuss.elastic.co/latest.md?page=1547 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1548 --- ## [Red indices when restoring from snapshot which contains indices in cold phase](https://discuss.elastic.co/t/red-indices-when-restoring-from-snapshot-which-contains-indices-in-cold-phase/279329)
**Author:** [@dimitris\_sb](https://discuss.elastic.co/u/dimitris_sb)\ **Replies:** 8\ **Last updated:** [August 2, 2021, 6:37am UTC](https://discuss.elastic.co/t/red-indices-when-restoring-from-snapshot-which-contains-indices-in-cold-phase/279329 "2021-08-02T06:37:47Z")
Hi All, I got a snapshot in s3 from cluster A (7.11.x) and tried to restore it in cluster B (7.13.x) and noticed that indices in cold nodes e.g. index-data-2021.03 were restored as e.g. restored-shrink-index-data-2021.0… --- ## [Use web crawler beta app search behind corporate proxy](https://discuss.elastic.co/t/use-web-crawler-beta-app-search-behind-corporate-proxy/279599)
**Author:** [@markn](https://discuss.elastic.co/u/markn)\ **Replies:** 3\ **Last updated:** [August 2, 2021, 6:07am UTC](https://discuss.elastic.co/t/use-web-crawler-beta-app-search-behind-corporate-proxy/279599 "2021-08-02T06:07:57Z")
Hi, we run ECE on premise in our data center. We have deployed an Enterprise Search App Search engine. We want to use the web crawler functionality. But the connection towards public internet pages runs via a corporate … --- ## [How to embed HTML code into Kibana?](https://discuss.elastic.co/t/how-to-embed-html-code-into-kibana/280025)
**Author:** [@tan\_minkee](https://discuss.elastic.co/u/tan_minkee)\ **Replies:** 2\ **Last updated:** [August 2, 2021, 6:08am UTC](https://discuss.elastic.co/t/how-to-embed-html-code-into-kibana/280025 "2021-08-02T06:08:35Z")
Hi, Is there a way to embed HTML code into Kibana? I would like to embed a website by using iframe into Kibana. --- ## [Two-Node cluster, switch master node](https://discuss.elastic.co/t/two-node-cluster-switch-master-node/280117)
**Author:** [@TheWorkingDeveloper](https://discuss.elastic.co/u/TheWorkingDeveloper)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 5:49am UTC](https://discuss.elastic.co/t/two-node-cluster-switch-master-node/280117 "2021-08-02T05:49:24Z")
I have an old R710 that I've used as a server for a long time. It's pretty weak and performance is slow. Now I have a second new server that I added as purely a data-node which is appox 10x stronger. I'd like to switch t… --- ## [Data migration from Old to New Cluster](https://discuss.elastic.co/t/data-migration-from-old-to-new-cluster/280143)
**Author:** [@Imad\_Mekkaoui](https://discuss.elastic.co/u/Imad_Mekkaoui)\ **Replies:** 2\ **Last updated:** [August 2, 2021, 5:47am UTC](https://discuss.elastic.co/t/data-migration-from-old-to-new-cluster/280143 "2021-08-02T05:47:45Z")
Hi, I have a running elaticsearch cluster comprised of two (02) nodes (both master and data). I wish to migrate my database to a new cluster comprised of seven (07) nodes (3 Master nodes, 2 Data nodes, 1 Coordinator no… --- ## [Fields are unknown in de discovery tab kibana and unable to make visualization of field](https://discuss.elastic.co/t/fields-are-unknown-in-de-discovery-tab-kibana-and-unable-to-make-visualization-of-field/279880)
**Author:** [@gregorysanders](https://discuss.elastic.co/u/gregorysanders)\ **Replies:** 3\ **Last updated:** [August 2, 2021, 5:37am UTC](https://discuss.elastic.co/t/fields-are-unknown-in-de-discovery-tab-kibana-and-unable-to-make-visualization-of-field/279880 "2021-08-02T05:37:10Z")
HI everyone, I am unable to make visualizations of certain fields in my index. In the discovery tab, some fields are unknown. I already tried to refresh the index pattern multiple times but this does not solve the prob… --- ## [Filebeat unicode json parse error](https://discuss.elastic.co/t/filebeat-unicode-json-parse-error/280167)
**Author:** [@paano](https://discuss.elastic.co/u/paano)\ **Replies:** 3\ **Last updated:** [August 2, 2021, 3:37am UTC](https://discuss.elastic.co/t/filebeat-unicode-json-parse-error/280167 "2021-08-02T03:37:53Z")
I have worked worked with json earlier, but this json output is unique, and filebeat throws error as Error decoding JSON: invalid character 'u' elk\_filebeat | 2021-08-01T23:33:35.056Z ERROR json/json.go:51 Er… --- ## [Wrong hosts last event elastic siem](https://discuss.elastic.co/t/wrong-hosts-last-event-elastic-siem/280176)
**Author:** [@artsius](https://discuss.elastic.co/u/artsius)\ **Replies:** 0\ **Last updated:** [August 2, 2021, 3:32am UTC](https://discuss.elastic.co/t/wrong-hosts-last-event-elastic-siem/280176 "2021-08-02T03:32:48Z")
I've some problem with last event in my elastic siem environment. The date is incorrect and I don't know how to fix this. could anyone give the suggests on this? I'm still new on Elasticsearch. --- ## [How to implement pagination in composite aggregation after removing some buckets based on condition by BucketSelectorAggregation](https://discuss.elastic.co/t/how-to-implement-pagination-in-composite-aggregation-after-removing-some-buckets-based-on-condition-by-bucketselectoraggregation/280168)
**Author:** [@dipuoec](https://discuss.elastic.co/u/dipuoec)\ **Replies:** 0\ **Last updated:** [August 2, 2021, 1:27am UTC](https://discuss.elastic.co/t/how-to-implement-pagination-in-composite-aggregation-after-removing-some-buckets-based-on-condition-by-bucketselectoraggregation/280168 "2021-08-02T01:27:26Z")
I am trying to implement the inbuilt pagination feature available in Elasticsearch composite aggregation on aggregated data. This works perfectly fine until we are not removing certain buckets based on conditions of aggr… --- ## [How to set the index name to the value of tags set by filebeat](https://discuss.elastic.co/t/how-to-set-the-index-name-to-the-value-of-tags-set-by-filebeat/279820)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 6\ **Last updated:** [August 2, 2021, 1:22am UTC](https://discuss.elastic.co/t/how-to-set-the-index-name-to-the-value-of-tags-set-by-filebeat/279820 "2021-08-02T01:22:08Z")
I am using filebeat to collect some logs. I have set the value of tags for each log, and I want to use that value as the name of the index. Is that possible? vi /etc/filebeat/filebeat.yml ... snip ... filebeat.inputs:… --- ## [Benchmarck elastic cluster with rally](https://discuss.elastic.co/t/benchmarck-elastic-cluster-with-rally/279068)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 3\ **Last updated:** [August 1, 2021, 11:53pm UTC](https://discuss.elastic.co/t/benchmarck-elastic-cluster-with-rally/279068 "2021-08-01T23:53:04Z")
Hello, I am going to setup a Prod cluster, I receive 30GB of logs per day (Need to keep the data 1 month in Hot node and 11 months in warm node ) I did some maths, and I am going to use (3 hot nodes and 4 warm nodes ) … --- ## [Create fields when a word followed by ':'](https://discuss.elastic.co/t/create-fields-when-a-word-followed-by/280164)
**Author:** [@Arkapravo\_Das](https://discuss.elastic.co/u/Arkapravo_Das)\ **Replies:** 3\ **Last updated:** [August 1, 2021, 11:15pm UTC](https://discuss.elastic.co/t/create-fields-when-a-word-followed-by/280164 "2021-08-01T23:15:11Z")
Hi, What I am trying to do is , if the unformatted text is like updating demand record with key:202107231924440412212356|current demand quantity:1|quantity getting reduced:1|shipmentno:170801380 then I want to create… --- ## [Ctx.payload.hits NOT working error](https://discuss.elastic.co/t/ctx-payload-hits-not-working-error/280070)
**Author:** [@alex14](https://discuss.elastic.co/u/alex14)\ **Replies:** 1\ **Last updated:** [August 1, 2021, 10:16pm UTC](https://discuss.elastic.co/t/ctx-payload-hits-not-working-error/280070 "2021-08-01T22:16:51Z")
hey there, I´m trying to create a watcher but i need to use some fields from my index to send that information via email but i always get the same error "caused\_by": { "type": "null\_pointer\_exception", "reason": "Cann… --- ## [How to Setup Tenant IDs](https://discuss.elastic.co/t/how-to-setup-tenant-ids/280086)
**Author:** [@Verax](https://discuss.elastic.co/u/Verax)\ **Replies:** 1\ **Last updated:** [August 1, 2021, 10:15pm UTC](https://discuss.elastic.co/t/how-to-setup-tenant-ids/280086 "2021-08-01T22:15:45Z")
Hello, I am looking to create a MSSP and wanted to know the best process for determining whos data is whos and how to see the volume of data ingested by each tenant. Could someone please assist? Many Thanks --- ## [Elasticsearch Plugin Basic Authentication HTTPS Endpoint](https://discuss.elastic.co/t/elasticsearch-plugin-basic-authentication-https-endpoint/280094)
**Author:** [@Chris\_Denneen](https://discuss.elastic.co/u/Chris_Denneen)\ **Replies:** 0\ **Last updated:** [July 30, 2021, 4:05pm UTC](https://discuss.elastic.co/t/elasticsearch-plugin-basic-authentication-https-endpoint/280094 "2021-07-30T16:05:17Z")
As of java 1.8 you can no longer do basic auth against HTTPs endpoint. How can you use creds with bin/elasticsearch-plugin https endpoint? Looks like you need an Authorization header added but how can you do that with … --- ## [Upgrade filebeat and logstash from 5.6 to 6.3](https://discuss.elastic.co/t/upgrade-filebeat-and-logstash-from-5-6-to-6-3/280024)
**Author:** [@KeithTt](https://discuss.elastic.co/u/KeithTt)\ **Replies:** 3\ **Last updated:** [August 1, 2021, 10:03pm UTC](https://discuss.elastic.co/t/upgrade-filebeat-and-logstash-from-5-6-to-6-3/280024 "2021-08-01T22:03:50Z")
I am trying to upgrade the filebeat and logstash from 5.6 to 6.3, there are two logstash and a lot of filebeat agents, what should do to upgrade smoothly? --- ## [Need help - Cisco syslog events matching in GROK debugger but not showing up in](https://discuss.elastic.co/t/need-help-cisco-syslog-events-matching-in-grok-debugger-but-not-showing-up-in/280116)
**Author:** [@Cdnvballer](https://discuss.elastic.co/u/Cdnvballer)\ **Replies:** 7\ **Last updated:** [August 1, 2021, 7:59pm UTC](https://discuss.elastic.co/t/need-help-cisco-syslog-events-matching-in-grok-debugger-but-not-showing-up-in/280116 "2021-08-01T19:59:20Z")
the actual grok pattern(s) used to match Cisco syslog event messages is no longer working despite the match is successful in the grok debugger UI . other pattern is working fine for Juniper routers though... not sure wh… --- ## [Finding missing logs against specific index](https://discuss.elastic.co/t/finding-missing-logs-against-specific-index/280153)
**Author:** [@Bilal\_Malik](https://discuss.elastic.co/u/Bilal_Malik)\ **Replies:** 2\ **Last updated:** [August 1, 2021, 6:57pm UTC](https://discuss.elastic.co/t/finding-missing-logs-against-specific-index/280153 "2021-08-01T18:57:57Z")
Hi All, i have different services, sending logs to elastic search and showing in Kibana. Is there any way to find which service is not sending logs to elastic search? from the existing logs, how i can put filter it show… --- ## [Add timestamp to index created by Watcher action](https://discuss.elastic.co/t/add-timestamp-to-index-created-by-watcher-action/279682)
**Author:** [@twilight](https://discuss.elastic.co/u/twilight)\ **Replies:** 2\ **Last updated:** [August 1, 2021, 6:20pm UTC](https://discuss.elastic.co/t/add-timestamp-to-index-created-by-watcher-action/279682 "2021-08-01T18:20:05Z")
Hello, This is related to Watchers using 'index' action i.e. putting alert info (key, value) to the specified log. However I noticed that the index entries don't have any date/timestamp field, how can I add a new field… --- ## [How to achieve CCR for more than 20 indices at once without snapshot](https://discuss.elastic.co/t/how-to-achieve-ccr-for-more-than-20-indices-at-once-without-snapshot/275404)
**Author:** [@Thesupersoftwareguy](https://discuss.elastic.co/u/Thesupersoftwareguy)\ **Replies:** 4\ **Last updated:** [August 1, 2021, 5:18pm UTC](https://discuss.elastic.co/t/how-to-achieve-ccr-for-more-than-20-indices-at-once-without-snapshot/275404 "2021-08-01T17:18:34Z")
Hello, I have multiple indices already created in cluster A and I want them to be replicated to cluster B , is there a way to create those many follower indices without manual effort as it will increase operational load… --- ## [Securing search-ui and embedding in larger a larger non-React app](https://discuss.elastic.co/t/securing-search-ui-and-embedding-in-larger-a-larger-non-react-app/279506)
**Author:** [@matp](https://discuss.elastic.co/u/matp)\ **Replies:** 7\ **Last updated:** [August 1, 2021, 4:35pm UTC](https://discuss.elastic.co/t/securing-search-ui-and-embedding-in-larger-a-larger-non-react-app/279506 "2021-08-01T16:35:08Z")
Re-posting this question as requested by @JasonStoltz So I have everything working with enterprise-search (app-search) and have customized the generated search-ui. I've loaded in a couple million documents and everythi… --- ## [Complex multi line condition based aggregation - kibana](https://discuss.elastic.co/t/complex-multi-line-condition-based-aggregation-kibana/280054)
**Author:** [@Riyas\_Siddikk](https://discuss.elastic.co/u/Riyas_Siddikk)\ **Replies:** 1\ **Last updated:** [August 1, 2021, 3:24pm UTC](https://discuss.elastic.co/t/complex-multi-line-condition-based-aggregation-kibana/280054 "2021-08-01T15:24:56Z")
0 I have 6 csv documents as below which is marked under same index: Doc 1 - 2021-07-30 11:45:56.731,46,2001,2134566,CHARGEABLE Doc 2 - 2021-07-30 11:45:56.752,67,2001,2134566,XXX Doc 3 - 2021-07-30 11:45:56.754,46,2002… --- ## [Migrating plugin from kibana 7.4.2 to 7.12](https://discuss.elastic.co/t/migrating-plugin-from-kibana-7-4-2-to-7-12/280155)
**Author:** [@ggolpur](https://discuss.elastic.co/u/ggolpur)\ **Replies:** 3\ **Last updated:** [August 1, 2021, 2:25pm UTC](https://discuss.elastic.co/t/migrating-plugin-from-kibana-7-4-2-to-7-12/280155 "2021-08-01T14:25:39Z")
Hi everyone. I developed a local plugin to kibana 7.4.2, work and running without any issues. Currently I am trying to migrate this plugin to kibana 7.12 but there is not enough explanation regarding this subject. Mig… --- ## [APM-Server unable to connect to elasticsearch](https://discuss.elastic.co/t/apm-server-unable-to-connect-to-elasticsearch/280123)
**Author:** [@nitin194](https://discuss.elastic.co/u/nitin194)\ **Replies:** 2\ **Last updated:** [August 1, 2021, 11:13am UTC](https://discuss.elastic.co/t/apm-server-unable-to-connect-to-elasticsearch/280123 "2021-08-01T11:13:19Z")
Kibana version: 7.13.4 Elasticsearch version: 7.13.4 APM Server version: 7.13.4 APM Agent language and version: NA Browser version: NA Original install method (e.g. download page, yum, deb, from source, etc.) a… --- ## [Unable to get Kibana login page after enabling xpack security](https://discuss.elastic.co/t/unable-to-get-kibana-login-page-after-enabling-xpack-security/280115)
**Author:** [@nitin194](https://discuss.elastic.co/u/nitin194)\ **Replies:** 2\ **Last updated:** [August 1, 2021, 10:57am UTC](https://discuss.elastic.co/t/unable-to-get-kibana-login-page-after-enabling-xpack-security/280115 "2021-08-01T10:57:47Z")
Hello Team, First I installed unsecured version of Elasticsearch and Kibana on kubernetes using helm charts, which was working fine. Then I enabled security in both of them. Somehow I managed to resolve issues with Elas… --- ## [Cannot find the Api query on Metricbeat dashboards](https://discuss.elastic.co/t/cannot-find-the-api-query-on-metricbeat-dashboards/280144)
**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\ **Replies:** 0\ **Last updated:** [August 1, 2021, 10:10am UTC](https://discuss.elastic.co/t/cannot-find-the-api-query-on-metricbeat-dashboards/280144 "2021-08-01T10:10:53Z")
I'm trying to get the API requests that kibana does to the Elasticsearch in order to get the data to visualize. But for metricbeat i cannot find what i want. Specifically on the ECS dashboard at the Host or System overv… --- ## [APM Java agent not capturing background running details and methods when enable sampling profiler](https://discuss.elastic.co/t/apm-java-agent-not-capturing-background-running-details-and-methods-when-enable-sampling-profiler/278531)
**Author:** [@Bhanu\_Praveen](https://discuss.elastic.co/u/Bhanu_Praveen)\ **Replies:** 13\ **Last updated:** [August 1, 2021, 4:06am UTC](https://discuss.elastic.co/t/apm-java-agent-not-capturing-background-running-details-and-methods-when-enable-sampling-profiler/278531 "2021-08-01T04:06:12Z")
Hello, I have enabled sampling profiler, only UI transactions and its stack trace methods are being captured. But if i have any background schedulers/processes running, those events are not being captured. v 7.8.0: v … --- ## [Limit message visibility for Kibana users based on message fields](https://discuss.elastic.co/t/limit-message-visibility-for-kibana-users-based-on-message-fields/279790)
**Author:** [@beckfoot](https://discuss.elastic.co/u/beckfoot)\ **Replies:** 3\ **Last updated:** [August 1, 2021, 8:56am UTC](https://discuss.elastic.co/t/limit-message-visibility-for-kibana-users-based-on-message-fields/279790 "2021-08-01T08:56:32Z")
Hi everyone. I'm new to the Elastic stack, and I'm trying to find out the best approach for this problem: I'm trying to set message (event) visibility per user in Kibana in order to display only a subset of messages wit… --- ## [After lot of effort my geo\_ip is still not working](https://discuss.elastic.co/t/after-lot-of-effort-my-geo-ip-is-still-not-working/280031)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 2\ **Last updated:** [August 1, 2021, 8:16am UTC](https://discuss.elastic.co/t/after-lot-of-effort-my-geo-ip-is-still-not-working/280031 "2021-08-01T08:16:57Z")
Hi Team, Below is my config and after lot of tries my geo\_ip is still not reflecting in my indices. Am I doing anything wrong here? input { stdin { type =\> "json" codec =\> "json… --- ## [Unable to start Kibana:](https://discuss.elastic.co/t/unable-to-start-kibana/280114)
**Author:** [@Arkapravo\_Das](https://discuss.elastic.co/u/Arkapravo_Das)\ **Replies:** 1\ **Last updated:** [August 1, 2021, 3:30am UTC](https://discuss.elastic.co/t/unable-to-start-kibana/280114 "2021-08-01T03:30:23Z")
I simply downloaded and now trying to start elastic search and Kibana. Kibana getting one error like below: log \[02:42:07.019\] \[info\]\[plugins-service\] Plugin "timelines" is disabled. log \[02:42:07.117\] \[warning\]… [Previous page](https://discuss.elastic.co/latest.md?page=1546) [Next page](https://discuss.elastic.co/latest.md?page=1548)