# Latest **URL:** https://discuss.elastic.co/latest.md?page=1559 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1560 --- ## [Problem after upgrade to 7.13.3 "source primary is allocated on another node" and CLONE\_TEMP\_TO\_TARGET -\> CLONE\_TEMP\_TO\_TARGET](https://discuss.elastic.co/t/problem-after-upgrade-to-7-13-3-source-primary-is-allocated-on-another-node-and-clone-temp-to-target-clone-temp-to-target/279404)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 1\ **Last updated:** [July 23, 2021, 8:48am UTC](https://discuss.elastic.co/t/problem-after-upgrade-to-7-13-3-source-primary-is-allocated-on-another-node-and-clone-temp-to-target-clone-temp-to-target/279404 "2021-07-23T08:48:23Z")
After we upgraded Elastic from 7.9 to 7.13.3 (on VM Centos7) all elasticsearch nodes has started but we couldnt start kibana the reason was it tries to migrate .kibana which si blocked by error "source primary is all… --- ## [ElasticSearch doesn't support date math for alias when create index template yet?](https://discuss.elastic.co/t/elasticsearch-doesnt-support-date-math-for-alias-when-create-index-template-yet/279368)
**Author:** [@JohnPhilip](https://discuss.elastic.co/u/JohnPhilip)\ **Replies:** 3\ **Last updated:** [July 23, 2021, 8:27am UTC](https://discuss.elastic.co/t/elasticsearch-doesnt-support-date-math-for-alias-when-create-index-template-yet/279368 "2021-07-23T08:27:19Z")
It seems that date math support index alias names in 7.13, but using date math when creating index template is still wrong, here is the curl cmd and result I get when create template with date math alias #cmd curl -XPUT… --- ## [Unable to print Error message into a watcher alert](https://discuss.elastic.co/t/unable-to-print-error-message-into-a-watcher-alert/278765)
**Author:** [@Diyatom](https://discuss.elastic.co/u/Diyatom)\ **Replies:** 3\ **Last updated:** [July 23, 2021, 8:04am UTC](https://discuss.elastic.co/t/unable-to-print-error-message-into-a-watcher-alert/278765 "2021-07-23T08:04:33Z")
Hi, I want to print out the error message from my logs into my mail. However, its giving me this error. Below is the alert jason code i am using: Can you please help. I am new in elastic search and am trying to pr… --- ## [Error handling geopoint values](https://discuss.elastic.co/t/error-handling-geopoint-values/279337)
**Author:** [@anon17386273](https://discuss.elastic.co/u/anon17386273)\ **Replies:** 3\ **Last updated:** [July 23, 2021, 7:53am UTC](https://discuss.elastic.co/t/error-handling-geopoint-values/279337 "2021-07-23T07:53:06Z")
Hi all For geopoint fields, is ignore\_malformed option the proper way to keep non-geopoint formats not indexed? My concern is whether there is any performance impact if my data has a lot of null and out of range latl… --- ## [Winlogbeat disable IPv6 parsing](https://discuss.elastic.co/t/winlogbeat-disable-ipv6-parsing/279450)
**Author:** [@yango](https://discuss.elastic.co/u/yango)\ **Replies:** 0\ **Last updated:** [July 23, 2021, 7:22am UTC](https://discuss.elastic.co/t/winlogbeat-disable-ipv6-parsing/279450 "2021-07-23T07:22:35Z")
Is it possible to parse only ipv4 formatted field without including ipv6? Right now my host.ip field in elasticsearch includes multiple values of ipv6 and ipv4 at once. I'm using Winlogbeat 7.10.2 OSS. --- ## [LOGSTASH - GSUB - DOESN'T MATCH](https://discuss.elastic.co/t/logstash-gsub-doesnt-match/279227)
**Author:** [@Daniel\_Lopez](https://discuss.elastic.co/u/Daniel_Lopez)\ **Replies:** 13\ **Last updated:** [July 23, 2021, 7:18am UTC](https://discuss.elastic.co/t/logstash-gsub-doesnt-match/279227 "2021-07-23T07:18:27Z")
Hi I tried to change a value in a field for use it like id but i couldn't modify the field value with gsub The data i have in the field is like this: rId = ABC0\_L123456\_789012 and only data i want is 123456 from rId, t… --- ## [TSVB Tophits aggregation for strings doesn't work](https://discuss.elastic.co/t/tsvb-tophits-aggregation-for-strings-doesnt-work/278802)
**Author:** [@BitBucketUser\_user](https://discuss.elastic.co/u/BitBucketUser_user)\ **Replies:** 5\ **Last updated:** [July 23, 2021, 6:31am UTC](https://discuss.elastic.co/t/tsvb-tophits-aggregation-for-strings-doesnt-work/278802 "2021-07-23T06:31:34Z")
Hello, I'm using Kibana 7.13.2. This is my data - POST tsvb/\_bulk?refresh {"index":{}} { "date":"2021-07-14T00:03:13.679+02:00","words":\["rain", "thunder"\],"type":"monsoon"} {"index":{}} {"date":"2021-07-14T00:03:13.… --- ## [Parse springboot logs using logstash](https://discuss.elastic.co/t/parse-springboot-logs-using-logstash/279422)
**Author:** [@Nikparab](https://discuss.elastic.co/u/Nikparab)\ **Replies:** 8\ **Last updated:** [July 23, 2021, 5:44am UTC](https://discuss.elastic.co/t/parse-springboot-logs-using-logstash/279422 "2021-07-23T05:44:25Z")
Hi Team, I need to parse below logs using logstash. I used grok but it is giving parsingerror. Grok- filter { grok { match =\> {"message" =\> "%{TIMESTAMP\_ISO8601:timestamp} %{LOGLEVEL:loglevel} %{JAVACLASS:logclass} … --- ## [Aggregation Pagination](https://discuss.elastic.co/t/aggregation-pagination/279444)
**Author:** [@raonic](https://discuss.elastic.co/u/raonic)\ **Replies:** 0\ **Last updated:** [July 23, 2021, 4:07am UTC](https://discuss.elastic.co/t/aggregation-pagination/279444 "2021-07-23T04:07:53Z")
Hello, I am using ElasticSearch aggregations to group results. More specifically, I am using a composite aggregation at the top level and then using a bucket selector sub-aggregation to determine what buckets are to be … --- ## [Change date format in Timelion](https://discuss.elastic.co/t/change-date-format-in-timelion/279121)
**Author:** [@vikramdayma](https://discuss.elastic.co/u/vikramdayma)\ **Replies:** 2\ **Last updated:** [July 23, 2021, 5:17am UTC](https://discuss.elastic.co/t/change-date-format-in-timelion/279121 "2021-07-23T05:17:21Z")
Hi, I want to change x-axis time format in Timelion visualization like 2021-04-16 to April -2021. Here is a screenshot. --- ## [When I set bootstrap.memory\_lock: true in ES cluster for k8s failed](https://discuss.elastic.co/t/when-i-set-bootstrap-memory-lock-true-in-es-cluster-for-k8s-failed/279441)
**Author:** [@plata37](https://discuss.elastic.co/u/plata37)\ **Replies:** 1\ **Last updated:** [July 23, 2021, 3:31am UTC](https://discuss.elastic.co/t/when-i-set-bootstrap-memory-lock-true-in-es-cluster-for-k8s-failed/279441 "2021-07-23T03:31:25Z")
the k8s yaml is below: ··· apiVersion: v1 kind: Service metadata: name: elasticsearch-headless labels: app: elasticsearch-headless spec: selector: app: elasticsearch ports: protocol: TCP port: 9300 targetP… --- ## [Loosing logs with logstash-trasnfer protocol](https://discuss.elastic.co/t/loosing-logs-with-logstash-trasnfer-protocol/279439)
**Author:** [@Francisco\_Yanez](https://discuss.elastic.co/u/Francisco_Yanez)\ **Replies:** 0\ **Last updated:** [July 23, 2021, 3:09am UTC](https://discuss.elastic.co/t/loosing-logs-with-logstash-trasnfer-protocol/279439 "2021-07-23T03:09:34Z")
I recently realized that our replication between our clusters is broken. we loose logs every minute (not a lot but we are loosing data). The way we replicate from master to slave is with Logstash-transfer. I tried to imp… --- ## [Execute reindex and the task is not found](https://discuss.elastic.co/t/execute-reindex-and-the-task-is-not-found/279414)
**Author:** [@asasas234](https://discuss.elastic.co/u/asasas234)\ **Replies:** 4\ **Last updated:** [July 23, 2021, 2:40am UTC](https://discuss.elastic.co/t/execute-reindex-and-the-task-is-not-found/279414 "2021-07-23T02:40:37Z")
First I execute the reindex POST \_reindex?wait\_for\_completion=false { "conflicts": "proceed", "source": { "index": "wh\_crm\_student\_order\_2020.11.09" }, "dest": { "index": "wh\_crm\_student\_order\_new\_2020.1… --- ## [How to show timestamp difference between max and min in data table](https://discuss.elastic.co/t/how-to-show-timestamp-difference-between-max-and-min-in-data-table/279347)
**Author:** [@byun618](https://discuss.elastic.co/u/byun618)\ **Replies:** 0\ **Last updated:** [July 22, 2021, 6:51am UTC](https://discuss.elastic.co/t/how-to-show-timestamp-difference-between-max-and-min-in-data-table/279347 "2021-07-22T06:51:41Z")
hello everyone i did show max timestamp and min stamp of each orderId. i want to show difference of them. i did in dev tools with this query. GET /toss-v2-confirmed-confirm\_response/\_search { "aggs": { "grou… --- ## [Unable To Access Kibana After Enabling Security](https://discuss.elastic.co/t/unable-to-access-kibana-after-enabling-security/279323)
**Author:** [@Jared9922](https://discuss.elastic.co/u/Jared9922)\ **Replies:** 17\ **Last updated:** [July 22, 2021, 11:36pm UTC](https://discuss.elastic.co/t/unable-to-access-kibana-after-enabling-security/279323 "2021-07-22T23:36:24Z")
Hello, I am currently trying to setup detection and monitoring for my self hosted Elasticstack. I have been following the guidelines found in this tutorial: Detections prerequisites and requirements | Elastic Security S… --- ## [How to disable JSON parser](https://discuss.elastic.co/t/how-to-disable-json-parser/279336)
**Author:** [@maxim.mokhov](https://discuss.elastic.co/u/maxim.mokhov)\ **Replies:** 2\ **Last updated:** [July 22, 2021, 11:22pm UTC](https://discuss.elastic.co/t/how-to-disable-json-parser/279336 "2021-07-22T23:22:37Z")
I have different logs from applications, and I want sent it to elasticsearch. In some cases in logs appear JSON. I want to send it in elasticsearch as plaintext. But in log logstash I see "JSON parse failure": \[2021-07… --- ## [Packetbeat 7.13.3 Error parsing handshake message](https://discuss.elastic.co/t/packetbeat-7-13-3-error-parsing-handshake-message/278903)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 9:52pm UTC](https://discuss.elastic.co/t/packetbeat-7-13-3-error-parsing-handshake-message/278903 "2021-07-22T21:52:08Z")
Hello, I am using packetbeat version 7.13.3, I run it since 3 days and it was working, and today I went to check and found out that it stopped since 12 hours, with some warning at the end of the logs and error. Packetb… --- ## [The target principal name is incorrect](https://discuss.elastic.co/t/the-target-principal-name-is-incorrect/279113)
**Author:** [@sunilr](https://discuss.elastic.co/u/sunilr)\ **Replies:** 2\ **Last updated:** [July 22, 2021, 9:48pm UTC](https://discuss.elastic.co/t/the-target-principal-name-is-incorrect/279113 "2021-07-22T21:48:38Z")
I am using these below settings and newly created certificate for setting up Transport and HTTP security. My setting in elasticsearch.yml is as below: xpack.security.enabled : True xpack.security.transport.ssl.enabl… --- ## [How to use kafka output plugin with OAUTH authentication](https://discuss.elastic.co/t/how-to-use-kafka-output-plugin-with-oauth-authentication/279427)
**Author:** [@burkeg](https://discuss.elastic.co/u/burkeg)\ **Replies:** 0\ **Last updated:** [July 22, 2021, 9:26pm UTC](https://discuss.elastic.co/t/how-to-use-kafka-output-plugin-with-oauth-authentication/279427 "2021-07-22T21:26:44Z")
How do i configure custom login call back handler with kafka output plugin? I'm using oauth authentication to my broker and not sure how to configure. Any leads/suggestions will be helpful --- ## [How to pass urlparam value to KQL](https://discuss.elastic.co/t/how-to-pass-urlparam-value-to-kql/279172)
**Author:** [@tangkalo](https://discuss.elastic.co/u/tangkalo)\ **Replies:** 10\ **Last updated:** [July 22, 2021, 9:01pm UTC](https://discuss.elastic.co/t/how-to-pass-urlparam-value-to-kql/279172 "2021-07-22T21:01:52Z")
Hi, I read about threads related to this need and know that there is currently not a way to directly plug in the value in the KQL using urlparam; however, is there a way to do it indirectly? I am thinking about using var… --- ## [Как донастроить визуализацию, помогите, плиз](https://discuss.elastic.co/t/topic/279247)
**Author:** [@Evgen](https://discuss.elastic.co/u/Evgen)\ **Replies:** 3\ **Last updated:** [July 22, 2021, 8:21pm UTC](https://discuss.elastic.co/t/topic/279247 "2021-07-22T20:21:29Z")
всем привет, помогите визуализировать данные, плиз. Вроде сделал, но чет не могу понять, как дошлифовать отображение. Я отправляю в Elastic много Событий. Каждое Событие содержит: время старта события в виде Long, … --- ## [Same config file for test and development](https://discuss.elastic.co/t/same-config-file-for-test-and-development/279263)
**Author:** [@Loulou](https://discuss.elastic.co/u/Loulou)\ **Replies:** 6\ **Last updated:** [July 22, 2021, 8:15pm UTC](https://discuss.elastic.co/t/same-config-file-for-test-and-development/279263 "2021-07-22T20:15:50Z")
Hi, What I am trying to do is having the same logstash.conf file for my test and deployment/shipping. However for testing I want the output to go to my local elastic search, and for deployment to a http address. I trie… --- ## [Functionbeat not sending data to Kibana](https://discuss.elastic.co/t/functionbeat-not-sending-data-to-kibana/279278)
**Author:** [@sproctor](https://discuss.elastic.co/u/sproctor)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 7:38pm UTC](https://discuss.elastic.co/t/functionbeat-not-sending-data-to-kibana/279278 "2021-07-22T19:38:19Z")
This is my first time using elasticsearch. I'm trying to stream my logs from cloudwatch to elastic cloud. I have functionbeat setup in what seemed like the proper manner, though clearly something is amiss. When my monit… --- ## [How can I pass field reference in ruby filter while constructing a big string](https://discuss.elastic.co/t/how-can-i-pass-field-reference-in-ruby-filter-while-constructing-a-big-string/279419)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 7:16pm UTC](https://discuss.elastic.co/t/how-can-i-pass-field-reference-in-ruby-filter-while-constructing-a-big-string/279419 "2021-07-22T19:16:10Z")
I would want to construct a sentence having multiple dynamic values, for example ruby { code =\> ' my\_object = { "reason" =\> "I received event.get("baseValueUnitAmount") event.get("currency") having di… --- ## [Updating kibana plugin to 7.13.3](https://discuss.elastic.co/t/updating-kibana-plugin-to-7-13-3/279081)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 3\ **Last updated:** [July 22, 2021, 5:33pm UTC](https://discuss.elastic.co/t/updating-kibana-plugin-to-7-13-3/279081 "2021-07-22T17:33:41Z")
Hello all, First of all, I would like to thank this platform and all the volunteers for helping me getting to know Elasticstack and work with it. My question is, I have a kibana custom plugin that I am using with ver… --- ## [How much data can be recorded by http.request.body.original](https://discuss.elastic.co/t/how-much-data-can-be-recorded-by-http-request-body-original/279217)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 3\ **Last updated:** [July 22, 2021, 5:31pm UTC](https://discuss.elastic.co/t/how-much-data-can-be-recorded-by-http-request-body-original/279217 "2021-07-22T17:31:11Z")
Our backend application uses a lot of parameters, they need to be kept all, I did not find the document mentioned how much length is limited. We use apm .net agent --- ## [Slack notifications timing out](https://discuss.elastic.co/t/slack-notifications-timing-out/279366)
**Author:** [@pup\_seba](https://discuss.elastic.co/u/pup_seba)\ **Replies:** 5\ **Last updated:** [July 22, 2021, 5:10pm UTC](https://discuss.elastic.co/t/slack-notifications-timing-out/279366 "2021-07-22T17:10:44Z")
Hi, We are trying to enable the posibility to send slack messages when a condition is met, by using "Alerts and Actions". We configured the keystore with slack accounts but when testing the slack connector it fails and… --- ## [Split the field and add the fields dynamically in ingest pipeline](https://discuss.elastic.co/t/split-the-field-and-add-the-fields-dynamically-in-ingest-pipeline/279416)
**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\ **Replies:** 0\ **Last updated:** [July 22, 2021, 4:57pm UTC](https://discuss.elastic.co/t/split-the-field-and-add-the-fields-dynamically-in-ingest-pipeline/279416 "2021-07-22T16:57:12Z")
Hi Team, We have scenario like audio files field with the values as path1,path2,path3 ( the number of paths are dynamic), In ingest pipeline need to split this field and create audio1 =path1, audio2=path2, audio3=path3… --- ## [ElasticSearch - Match or less](https://discuss.elastic.co/t/elasticsearch-match-or-less/279341)
**Author:** [@zhadad](https://discuss.elastic.co/u/zhadad)\ **Replies:** 2\ **Last updated:** [July 22, 2021, 4:05pm UTC](https://discuss.elastic.co/t/elasticsearch-match-or-less/279341 "2021-07-22T16:05:25Z")
is there an way to query the following using elasticsearch (version 2) : indexed documents examples : {\_id=1 , "tags": \[ "t1"\]} {\_id=2 , "tags": \[ "t1", "t2" \]} {\_id=3 , "tags": \[ "t1", "t2", "t3" \]} The followin… --- ## [Logstash mutate add field not showing the added field](https://discuss.elastic.co/t/logstash-mutate-add-field-not-showing-the-added-field/279385)
**Author:** [@Hamza\_El\_Aouane](https://discuss.elastic.co/u/Hamza_El_Aouane)\ **Replies:** 3\ **Last updated:** [July 22, 2021, 3:55pm UTC](https://discuss.elastic.co/t/logstash-mutate-add-field-not-showing-the-added-field/279385 "2021-07-22T15:55:51Z")
Hello guys. I am testing some functionalities of logstash but I am a bit confused about the process of implementing a filter mutate. Just for testing purpose I have a kiwi syslog generating random logs. Those logs have… [Previous page](https://discuss.elastic.co/latest.md?page=1558) [Next page](https://discuss.elastic.co/latest.md?page=1560)