# Latest **URL:** https://discuss.elastic.co/latest.md?page=1972 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1973 --- ## [Monitoring older stack in a the newer one (Logstash Version Mismatch)](https://discuss.elastic.co/t/monitoring-older-stack-in-a-the-newer-one-logstash-version-mismatch/256918)
**Author:** [@ffknob](https://discuss.elastic.co/u/ffknob)\ **Replies:** 1\ **Last updated:** [November 27, 2020, 10:53pm UTC](https://discuss.elastic.co/t/monitoring-older-stack-in-a-the-newer-one-logstash-version-mismatch/256918 "2020-11-27T22:53:51Z")
Hello, I'm trying to set a monitoring cluster up to monitor Elastic Stacks from our different customers. Each stack is in a different version. To begin with, I tried to set a 7.10 Metricbeat to send data for a 7.3 Logs… --- ## [Problem with WinlogBeat Dashboard ECS](https://discuss.elastic.co/t/problem-with-winlogbeat-dashboard-ecs/256848)
**Author:** [@tesla](https://discuss.elastic.co/u/tesla)\ **Replies:** 1\ **Last updated:** [November 27, 2020, 9:42pm UTC](https://discuss.elastic.co/t/problem-with-winlogbeat-dashboard-ecs/256848 "2020-11-27T21:42:03Z")
Hi Guys I have node Centos 8 kibana version 7.10.0, nano /etc/kibana/kibana.yml server.port: 5601 server.host: 0.0.0.0 elasticsearch.hosts: \["http://elasticsearch:9200"\] kibana.index: ".kibana" I have node Cento… --- ## [Logstash does not forget the previous csv header coming from filebeat](https://discuss.elastic.co/t/logstash-does-not-forget-the-previous-csv-header-coming-from-filebeat/256910)
**Author:** [@jason.greffier](https://discuss.elastic.co/u/jason.greffier)\ **Replies:** 2\ **Last updated:** [November 27, 2020, 8:36pm UTC](https://discuss.elastic.co/t/logstash-does-not-forget-the-previous-csv-header-coming-from-filebeat/256910 "2020-11-27T20:36:40Z")
Hi, My issue: When I pass csv files from filebeat with different header, csv output does not match the right column with the right value. Does someone know to manage that, forget the previous csv header read by log … --- ## [Ingesting O365 logs but having issues with specific mappings](https://discuss.elastic.co/t/ingesting-o365-logs-but-having-issues-with-specific-mappings/256081)
**Author:** [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\ **Replies:** 5\ **Last updated:** [November 27, 2020, 8:33pm UTC](https://discuss.elastic.co/t/ingesting-o365-logs-but-having-issues-with-specific-mappings/256081 "2020-11-27T20:33:52Z")
Hi, We are using Filebeat with the O365 module. These events get shipped to Redis which then Logstash fetches from. The logs are getting ingested but some of the events are having mapping issues with the field "o365.aud… --- ## [Having an issue while trying to reindex using a script](https://discuss.elastic.co/t/having-an-issue-while-trying-to-reindex-using-a-script/256915)
**Author:** [@tarek](https://discuss.elastic.co/u/tarek)\ **Replies:** 1\ **Last updated:** [November 27, 2020, 8:29pm UTC](https://discuss.elastic.co/t/having-an-issue-while-trying-to-reindex-using-a-script/256915 "2020-11-27T20:29:38Z")
Hello, So, I'm trying to reindex documents into a new index with a stored script. the used script has a parameter called "increment". when I start reindexing, I get a null pointer exception. This is my code. POST \_sc… --- ## [Kibana Canvas - Time Filter for previous month](https://discuss.elastic.co/t/kibana-canvas-time-filter-for-previous-month/256810)
**Author:** [@KevSex](https://discuss.elastic.co/u/KevSex)\ **Replies:** 1\ **Last updated:** [November 27, 2020, 8:16pm UTC](https://discuss.elastic.co/t/kibana-canvas-time-filter-for-previous-month/256810 "2020-11-27T20:16:44Z")
Is there a way to use the time filter in canvas to filter a month regardless of the current date/time. Just now, the only thing close is to create a relative time filter for 1 Months ago however this only really works w… --- ## [Perform search on ES but limit to hot nodes only?](https://discuss.elastic.co/t/perform-search-on-es-but-limit-to-hot-nodes-only/256782)
**Author:** [@smlbiobot](https://discuss.elastic.co/u/smlbiobot)\ **Replies:** 8\ **Last updated:** [November 27, 2020, 8:16pm UTC](https://discuss.elastic.co/t/perform-search-on-es-but-limit-to-hot-nodes-only/256782 "2020-11-27T20:16:34Z")
We have employed a hot-warm architecture in our cluster, and the indices share the same prefix. Right now, to keep our process sane, we do this to our indices: Reindex the original index named name-YYYY.MM into a new i… --- ## [Can any one tell me to make aggregation on dynamic field\_name or restructure data](https://discuss.elastic.co/t/can-any-one-tell-me-to-make-aggregation-on-dynamic-field-name-or-restructure-data/255412)
**Author:** [@tushar.sharma.cse](https://discuss.elastic.co/u/tushar.sharma.cse)\ **Replies:** 2\ **Last updated:** [November 27, 2020, 6:54pm UTC](https://discuss.elastic.co/t/can-any-one-tell-me-to-make-aggregation-on-dynamic-field-name-or-restructure-data/255412 "2020-11-27T18:54:58Z")
{"updated\_on":"2020-11-15","journal":{"2020-10-20":"a","2020-10-21":"b"}} {"updated\_on":"2020-11-14","journal":{"2020-10-21":"c","2020-10-23":"b"}} How to form aggregation query based on “journal” hash key’s(where k… --- ## [Kibana Canvas - Markdown date format](https://discuss.elastic.co/t/kibana-canvas-markdown-date-format/256807)
**Author:** [@KevSex](https://discuss.elastic.co/u/KevSex)\ **Replies:** 1\ **Last updated:** [November 27, 2020, 7:50pm UTC](https://discuss.elastic.co/t/kibana-canvas-markdown-date-format/256807 "2020-11-27T19:50:08Z")
Is there a way to use the markdown content to write the previous month? Just now, I use {date | formatdate "MMMM YYYY"} which produces November 2020 however I'm wondering if there's a way to write the last months date. … --- ## [Kibana: Configure Security - missing authentication credentials for REST request](https://discuss.elastic.co/t/kibana-configure-security-missing-authentication-credentials-for-rest-request/256790)
**Author:** [@Jurilz](https://discuss.elastic.co/u/Jurilz)\ **Replies:** 7\ **Last updated:** [November 27, 2020, 7:06pm UTC](https://discuss.elastic.co/t/kibana-configure-security-missing-authentication-credentials-for-rest-request/256790 "2020-11-27T19:06:43Z")
Good day, I'm curious about the alert-functionality in Kibana. Therefore I'm setting up the security in Kibana. I already set the elasticsearch passwords (interactive). This are my configs kibana.yml server.name: ki… --- ## [Filter Aggregation on nested object ... not working as expected!](https://discuss.elastic.co/t/filter-aggregation-on-nested-object-not-working-as-expected/256718)
**Author:** [@Guillaume\_R](https://discuss.elastic.co/u/Guillaume_R)\ **Replies:** 6\ **Last updated:** [November 27, 2020, 6:53pm UTC](https://discuss.elastic.co/t/filter-aggregation-on-nested-object-not-working-as-expected/256718 "2020-11-27T18:53:08Z")
Hello, I have some product like this { "id\_product" : "180", "name" : "Domane AL 3 femme", "manufacturer" : "TREK", "cat\_path" : "Product\>377~velos~Vélos\>35~route~Route\>44~course… --- ## [Network.host or http.host - documentation problem?](https://discuss.elastic.co/t/network-host-or-http-host-documentation-problem/64179)
**Author:** [@tsmori](https://discuss.elastic.co/u/tsmori)\ **Replies:** 28\ **Last updated:** [November 27, 2020, 5:01pm UTC](https://discuss.elastic.co/t/network-host-or-http-host-documentation-problem/64179 "2020-11-27T17:01:04Z")
The default works fine, however it's only binding to localhost. I want to be able to bind elasticsearch to a non-loopback IP. Docs say this is possible, but setting 0.0.0.0 or the actual adapater IP results in the follo… --- ## [Canvas, essql average per minute](https://discuss.elastic.co/t/canvas-essql-average-per-minute/256900)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [November 27, 2020, 4:59pm UTC](https://discuss.elastic.co/t/canvas-essql-average-per-minute/256900 "2020-11-27T16:59:32Z")
Hi, how can I get the average count per minute in ESSQL? I have tried surrounding the COUNT() with AVG() but doesnt work, this Is my query: SELECT COUNT(\*) as count\_documents FROM "my-index\*" WHERE transaction.result I… --- ## [Logstash throwing Failed to execute action java.lang.IllegalStateException: error when starting the agent](https://discuss.elastic.co/t/logstash-throwing-failed-to-execute-action-java-lang-illegalstateexception-error-when-starting-the-agent/256875)
**Author:** [@Rahul\_Ravichandran](https://discuss.elastic.co/u/Rahul_Ravichandran)\ **Replies:** 5\ **Last updated:** [November 27, 2020, 4:41pm UTC](https://discuss.elastic.co/t/logstash-throwing-failed-to-execute-action-java-lang-illegalstateexception-error-when-starting-the-agent/256875 "2020-11-27T16:41:30Z")
Hey guys Im trying to push logs from my server to Elasticsearch endpoint through logstash. My server is running a 2016 server OS and the im using a logstash version 7.9.0 This is my logstsh.conf file input { … --- ## [Date is not being parsed with AM / PM](https://discuss.elastic.co/t/date-is-not-being-parsed-with-am-pm/256852)
**Author:** [@shani](https://discuss.elastic.co/u/shani)\ **Replies:** 3\ **Last updated:** [November 27, 2020, 4:21pm UTC](https://discuss.elastic.co/t/date-is-not-being-parsed-with-am-pm/256852 "2020-11-27T16:21:45Z")
HI, this is my config file. I want to extract date from the log and want to create two field like time\_mentioned\_in\_log time\_when\_log\_was\_received\_at\_logstash Raw Log: 3/2/2020 10:14 AM TYPE=Information USER= COMP=AB… --- ## [Shard hit count & miss count](https://discuss.elastic.co/t/shard-hit-count-miss-count/256896)
**Author:** [@nyquillus](https://discuss.elastic.co/u/nyquillus)\ **Replies:** 0\ **Last updated:** [November 27, 2020, 3:28pm UTC](https://discuss.elastic.co/t/shard-hit-count-miss-count/256896 "2020-11-27T15:28:45Z")
Hi, I've got some instances where i see x hits and y misses on some of my shards. The only question on my mind is what is hit count and miss count. Could someone please explain this to me simply? Thanks in advance. --- ## [Kibana Visualization takes time to load in 6.7.2](https://discuss.elastic.co/t/kibana-visualization-takes-time-to-load-in-6-7-2/256437)
**Author:** [@AnoopKN](https://discuss.elastic.co/u/AnoopKN)\ **Replies:** 8\ **Last updated:** [November 27, 2020, 3:20pm UTC](https://discuss.elastic.co/t/kibana-visualization-takes-time-to-load-in-6-7-2/256437 "2020-11-27T15:20:58Z")
Hi all, I was using Kibana 5.5.2 to create a data table visualization. I am using @timestamp in a terms aggregation. The bucket size was set to 100000. On this version of Kibana the Visualization was rendered in less th… --- ## [KIbana get killed automatically after Job execution completed successfully](https://discuss.elastic.co/t/kibana-get-killed-automatically-after-job-execution-completed-successfully/255850)
**Author:** [@maher\_ayadi](https://discuss.elastic.co/u/maher_ayadi)\ **Replies:** 3\ **Last updated:** [November 27, 2020, 2:25pm UTC](https://discuss.elastic.co/t/kibana-get-killed-automatically-after-job-execution-completed-successfully/255850 "2020-11-27T14:25:56Z")
Hi guys I'm new in ELS and I'm trying to download some reports but the Kibana Session get killed for some reason that I don't know I will be happy to get some help solving this Problem thx --- ## [Logstash warnings: illegal reflective access & pipelines.yml](https://discuss.elastic.co/t/logstash-warnings-illegal-reflective-access-pipelines-yml/256888)
**Author:** [@jaispirit](https://discuss.elastic.co/u/jaispirit)\ **Replies:** 0\ **Last updated:** [November 27, 2020, 2:15pm UTC](https://discuss.elastic.co/t/logstash-warnings-illegal-reflective-access-pipelines-yml/256888 "2020-11-27T14:15:07Z")
Using latest versions of: Ubuntu 20.04-Server mit 4 GB RAM und 2 CPUs OpenJDK 11 Elasticsearch Version: 7.10.0 Kibana Version: 7.10.0 Logstash Version: 7.10.0 Filebeat Version: 7.10.0 $ sudo /usr/share/logstash/bin/lo… --- ## [Logstash 7.9.2 @Docker doesn't start -](https://discuss.elastic.co/t/logstash-7-9-2-docker-doesnt-start/256806)
**Author:** [@Waxman](https://discuss.elastic.co/u/Waxman)\ **Replies:** 5\ **Last updated:** [November 27, 2020, 2:10pm UTC](https://discuss.elastic.co/t/logstash-7-9-2-docker-doesnt-start/256806 "2020-11-27T14:10:23Z")
I cannot start my logstash service on docker. Here is my config: input { file { path =\> "/usr/share/logstash/messages-host" start\_position =\> "beginning" sincedb\_path =\> "/dev/null" } beats { port… --- ## [Kibana index pattern don't show data with time filter field name](https://discuss.elastic.co/t/kibana-index-pattern-dont-show-data-with-time-filter-field-name/256741)
**Author:** [@gyana\_nayak](https://discuss.elastic.co/u/gyana_nayak)\ **Replies:** 9\ **Last updated:** [November 27, 2020, 2:08pm UTC](https://discuss.elastic.co/t/kibana-index-pattern-dont-show-data-with-time-filter-field-name/256741 "2020-11-27T14:08:13Z")
i am trying to create an index from Java code to index some data but if i am creating index pattern with time filter Kibana never shows any data. Following below order while creating index with some setting and adding an… --- ## [Kibana: add object to existing dashboard](https://discuss.elastic.co/t/kibana-add-object-to-existing-dashboard/256321)
**Author:** [@Eugene\_Dobrovolskyi](https://discuss.elastic.co/u/Eugene_Dobrovolskyi)\ **Replies:** 2\ **Last updated:** [November 27, 2020, 1:33pm UTC](https://discuss.elastic.co/t/kibana-add-object-to-existing-dashboard/256321 "2020-11-27T13:33:25Z")
I am developing a set of scripts to manage Kibana objects, I have created an object and created a dashboard ( with some initial list of objects in it) and now I would like to place/add my new object in this existing dash… --- ## [Outdated logstash plugin](https://discuss.elastic.co/t/outdated-logstash-plugin/256881)
**Author:** [@cactus](https://discuss.elastic.co/u/cactus)\ **Replies:** 0\ **Last updated:** [November 27, 2020, 1:29pm UTC](https://discuss.elastic.co/t/outdated-logstash-plugin/256881 "2020-11-27T13:29:27Z")
Hello, guys! Does it safe to upgrade a particular logstash plugin to the latest version even when logstash itself too far behind the current master? Problem: memory leak on grok pattern Solution: update grok pat… --- ## [Help deciphering "message" field](https://discuss.elastic.co/t/help-deciphering-message-field/256880)
**Author:** [@Jasonespo](https://discuss.elastic.co/u/Jasonespo)\ **Replies:** 0\ **Last updated:** [November 27, 2020, 1:17pm UTC](https://discuss.elastic.co/t/help-deciphering-message-field/256880 "2020-11-27T13:17:19Z")
Hello, What input plugin could I use to decipher the following on logstash? I want to be able to do some grok on the message field and it would be much easier and shorter if I deciphered it first... \\u00002\\u00000\\u000… --- ## [Index doesn't want to be stored in hot node](https://discuss.elastic.co/t/index-doesnt-want-to-be-stored-in-hot-node/256876)
**Author:** [@xziten](https://discuss.elastic.co/u/xziten)\ **Replies:** 0\ **Last updated:** [November 27, 2020, 12:44pm UTC](https://discuss.elastic.co/t/index-doesnt-want-to-be-stored-in-hot-node/256876 "2020-11-27T12:44:32Z")
Hi, I have an elastic cluster with : 3 master nodes : roles \[ data, master \] 1 hot node : roles \[ data\_hot \] 2 warm nodes : roles \[ data\_warm \] 3 cold nodes : roles \[ data\_cold \] ELK Version : 7.10 I setted up an … --- ## [App search - how to multi value boost](https://discuss.elastic.co/t/app-search-how-to-multi-value-boost/256693)
**Author:** [@colinw90](https://discuss.elastic.co/u/colinw90)\ **Replies:** 1\ **Last updated:** [November 27, 2020, 12:33pm UTC](https://discuss.elastic.co/t/app-search-how-to-multi-value-boost/256693 "2020-11-27T12:33:37Z")
When providing an array of terms to 'value boost' on App search it will boost a document if ANY of the terms are present. How do I boost for EVERY term that is present? For example, a document with 3 matching terms sho… --- ## [Backup and restore of elasticsearch indices](https://discuss.elastic.co/t/backup-and-restore-of-elasticsearch-indices/256855)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 1\ **Last updated:** [November 27, 2020, 11:34am UTC](https://discuss.elastic.co/t/backup-and-restore-of-elasticsearch-indices/256855 "2020-11-27T11:34:40Z")
Hi All, Backup team has taken the backup of path.data folder and provided us the backup. I copied the folder and placed in new server. I have given the same folder in path.data property of elasticsearch.yml in new clus… --- ## [Cannot get scrolling to work when trying to extract more than 10,000 results](https://discuss.elastic.co/t/cannot-get-scrolling-to-work-when-trying-to-extract-more-than-10-000-results/256861)
**Author:** [@terry433iid](https://discuss.elastic.co/u/terry433iid)\ **Replies:** 0\ **Last updated:** [November 27, 2020, 9:56am UTC](https://discuss.elastic.co/t/cannot-get-scrolling-to-work-when-trying-to-extract-more-than-10-000-results/256861 "2020-11-27T09:56:03Z")
I have an index ('jenkins\_job\_logs') that stores console logs from jenkins jobs, the index fields include the actual console data plus a unique ID for the jenkins job ('task\_id'), there are 30k plus documents in the inde… --- ## [ELK - custom time](https://discuss.elastic.co/t/elk-custom-time/256004)
**Author:** [@raj.speed1](https://discuss.elastic.co/u/raj.speed1)\ **Replies:** 4\ **Last updated:** [November 27, 2020, 9:39am UTC](https://discuss.elastic.co/t/elk-custom-time/256004 "2020-11-27T09:39:57Z")
Is there a way to disable relative time or last 1hr & enable user to select available or absolute date/time. Im updating elk every 1hr with some constant parameters, using logstash. eg : now output\_value =101 after 1h… --- ## [\[SOLVED\] Mutate string to integer when field type is already integer](https://discuss.elastic.co/t/solved-mutate-string-to-integer-when-field-type-is-already-integer/256825)
**Author:** [@nnet](https://discuss.elastic.co/u/nnet)\ **Replies:** 5\ **Last updated:** [November 27, 2020, 4:29am UTC](https://discuss.elastic.co/t/solved-mutate-string-to-integer-when-field-type-is-already-integer/256825 "2020-11-27T04:29:27Z")
Hi, using ELK 5.6.16 on Ubuntu 16.04. I'm trying to figure out a way to ingest json where a field learn is of type integer. Once in a while an event will come in and that field's value is not an integer but instead a st… [Previous page](https://discuss.elastic.co/latest.md?page=1971) [Next page](https://discuss.elastic.co/latest.md?page=1973)