# Latest **URL:** https://discuss.elastic.co/latest.md?page=641 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 642 --- ## [Removing text qualifier double quotes from Logstash CSV output](https://discuss.elastic.co/t/removing-text-qualifier-double-quotes-from-logstash-csv-output/335990)
**Author:** [@mhoward](https://discuss.elastic.co/u/mhoward)\ **Replies:** 2\ **Last updated:** [June 14, 2023, 6:35pm UTC](https://discuss.elastic.co/t/removing-text-qualifier-double-quotes-from-logstash-csv-output/335990 "2023-06-14T18:35:18Z")
Not sure if possible but I'm creating a CSV using Logstash. When I open the CSV in Notepad++ it adds double quotations around one specific field. The field itself is a city state zip code field that is created using a … --- ## [I can't reopen a closed index](https://discuss.elastic.co/t/i-cant-reopen-a-closed-index/335895)
**Author:** [@Hatef](https://discuss.elastic.co/u/Hatef)\ **Replies:** 8\ **Last updated:** [June 14, 2023, 6:34pm UTC](https://discuss.elastic.co/t/i-cant-reopen-a-closed-index/335895 "2023-06-14T18:34:15Z")
Hi all, I'm pretty new to ES but have played around with ELK stack a bit and I'm more familiar now to run some API queries and modifying configs. I have closed an index called accelerate which is the main source of our… --- ## [Canvas filters - is it possible to filter a visualization](https://discuss.elastic.co/t/canvas-filters-is-it-possible-to-filter-a-visualization/334165)
**Author:** [@azulgrana](https://discuss.elastic.co/u/azulgrana)\ **Replies:** 5\ **Last updated:** [June 14, 2023, 6:11pm UTC](https://discuss.elastic.co/t/canvas-filters-is-it-possible-to-filter-a-visualization/334165 "2023-06-14T18:11:15Z")
Hi there, I'm playing with Canvas and I have particular use case where I need to place a filter on a kibana object to filter the data out by a range from 3 thru 5 (event severity), I don't want to modify the visualizati… --- ## [Advantages of getting data from Elastic using Python](https://discuss.elastic.co/t/advantages-of-getting-data-from-elastic-using-python/335118)
**Author:** [@Jeferson\_Schiavinato](https://discuss.elastic.co/u/Jeferson_Schiavinato)\ **Replies:** 3\ **Last updated:** [June 14, 2023, 5:16pm UTC](https://discuss.elastic.co/t/advantages-of-getting-data-from-elastic-using-python/335118 "2023-06-14T17:16:31Z")
Hello guys, I am a begginer at ELK and I am studying elasticsearch package in python. I have a shell script which reads large logs, extract data and send them to Zabbix. Theses large log files are now at Elasticsearch. … --- ## [Is there a way to convert a unicode escape sequence within the Logstash pipeline so that the actual emoji icon is show within Elastic?](https://discuss.elastic.co/t/is-there-a-way-to-convert-a-unicode-escape-sequence-within-the-logstash-pipeline-so-that-the-actual-emoji-icon-is-show-within-elastic/336002)
**Author:** [@farnazpatel](https://discuss.elastic.co/u/farnazpatel)\ **Replies:** 0\ **Last updated:** [June 14, 2023, 5:04pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-convert-a-unicode-escape-sequence-within-the-logstash-pipeline-so-that-the-actual-emoji-icon-is-show-within-elastic/336002 "2023-06-14T17:04:38Z")
I am sending messages from Kafka in to Logstash and then through to Elastic, some of the messages contain emojis, these emojis are converted to Unicode escape characters when being stored in Kafka e.g. :blush: ---\> is c… --- ## [Logstash not applying correct system time to ingestion timestamp](https://discuss.elastic.co/t/logstash-not-applying-correct-system-time-to-ingestion-timestamp/335884)
**Author:** [@Anthony\_Zottola](https://discuss.elastic.co/u/Anthony_Zottola)\ **Replies:** 3\ **Last updated:** [June 14, 2023, 4:53pm UTC](https://discuss.elastic.co/t/logstash-not-applying-correct-system-time-to-ingestion-timestamp/335884 "2023-06-14T16:53:50Z")
Hello, I live in the NA East timezone so currently we are 4 hours behind UTC, I understand that logstash puts the @timestamp in UTC but it is putting in the wrong time. Logstash parsed a log at 10:30 am in my timezone … --- ## [Kafka plugin with every new group id it is pointing to old offset and not able to consume events](https://discuss.elastic.co/t/kafka-plugin-with-every-new-group-id-it-is-pointing-to-old-offset-and-not-able-to-consume-events/335994)
**Author:** [@Selim\_Hassan](https://discuss.elastic.co/u/Selim_Hassan)\ **Replies:** 0\ **Last updated:** [June 14, 2023, 3:36pm UTC](https://discuss.elastic.co/t/kafka-plugin-with-every-new-group-id-it-is-pointing-to-old-offset-and-not-able-to-consume-events/335994 "2023-06-14T15:36:18Z")
I have pipeline created as input { kafka { group\_id =\> "3fixed1" client\_id =\> "2fixed1" codec =\> avro{ schema\_uri =\> "C:\\LogStash\\KafkaClient\\topology.avsc" encoding =\> "binary" } bootstrap\_servers =\> "obootstap… --- ## [Expiration date password for kibana users](https://discuss.elastic.co/t/expiration-date-password-for-kibana-users/335989)
**Author:** [@valerio.vigliotta](https://discuss.elastic.co/u/valerio.vigliotta)\ **Replies:** 1\ **Last updated:** [June 14, 2023, 3:34pm UTC](https://discuss.elastic.co/t/expiration-date-password-for-kibana-users/335989 "2023-06-14T15:34:06Z")
Hi, We have an ELK stack on premise V. 8.5.3 with free licence. We need to be able to set the expiration date to users Kibana password every 6 months. The users that i am referred is those from "Menu"--\>"Stack Managamen… --- ## [Unable to Sync Data with MongoDb](https://discuss.elastic.co/t/unable-to-sync-data-with-mongodb/335738)
**Author:** [@bhavya2810](https://discuss.elastic.co/u/bhavya2810)\ **Replies:** 4\ **Last updated:** [June 14, 2023, 2:56pm UTC](https://discuss.elastic.co/t/unable-to-sync-data-with-mongodb/335738 "2023-06-14T14:56:25Z")
Hi there, I have successfully setup enterprise-search and connectors-python in elasticsearch and kibana. I am using MongoDb connector for syncing Data to MongoDb. Elasticsearch and Kibana and connectors-python are init… --- ## [Elastic Agent 8.8.0 disk space requirement](https://discuss.elastic.co/t/elastic-agent-8-8-0-disk-space-requirement/334723)
**Author:** [@schapman](https://discuss.elastic.co/u/schapman)\ **Replies:** 6\ **Last updated:** [June 14, 2023, 2:49pm UTC](https://discuss.elastic.co/t/elastic-agent-8-8-0-disk-space-requirement/334723 "2023-06-14T14:49:08Z")
Just a heads up if installing the latest elastic agent on Linux servers with relatively small free space... It looks like the elastic-agent's requirement for disk space has increased (almost doubled?) over the past year… --- ## [Create ElasticSearch cluster with 2 or 3 nodes](https://discuss.elastic.co/t/create-elasticsearch-cluster-with-2-or-3-nodes/335901)
**Author:** [@TomTom](https://discuss.elastic.co/u/TomTom)\ **Replies:** 4\ **Last updated:** [June 14, 2023, 1:45pm UTC](https://discuss.elastic.co/t/create-elasticsearch-cluster-with-2-or-3-nodes/335901 "2023-06-14T13:45:46Z")
I need to create an Elasticsearch cluster on Ubuntu machines, but to ensure high availability I would like to have more than one node in case I need to update or upgrade the server. Is there any material that teaches ho… --- ## [Elasticsearch: Terms Aggregation Bucket Order is not skipping the unmapped fields](https://discuss.elastic.co/t/elasticsearch-terms-aggregation-bucket-order-is-not-skipping-the-unmapped-fields/335986)
**Author:** [@crchaulagain1](https://discuss.elastic.co/u/crchaulagain1)\ **Replies:** 0\ **Last updated:** [June 14, 2023, 1:45pm UTC](https://discuss.elastic.co/t/elasticsearch-terms-aggregation-bucket-order-is-not-skipping-the-unmapped-fields/335986 "2023-06-14T13:45:04Z")
My Elasticsearch alias is pointed to two different indices where the mapping is of a different type. I want the query to execute and get the response from the index where the given filter matches. But the terms aggregati… --- ## [Spike on CPU usage relates to the increase of fielddata memory](https://discuss.elastic.co/t/spike-on-cpu-usage-relates-to-the-increase-of-fielddata-memory/335303)
**Author:** [@GustavoSantos](https://discuss.elastic.co/u/GustavoSantos)\ **Replies:** 5\ **Last updated:** [June 14, 2023, 1:43pm UTC](https://discuss.elastic.co/t/spike-on-cpu-usage-relates-to-the-increase-of-fielddata-memory/335303 "2023-06-14T13:43:41Z")
Hi team, We faced a very weird situation in one of our production clusters. Suddenly the CPU utilization of all nodes got 100% after being consistently under 30% for a long time. Looking at Kibana metrics, the only var… --- ## [How to highlight multifields? Iis there a way to highlight all results with the same multifield (same source, different analyzers) Multi-fields with multiple analyzers](https://discuss.elastic.co/t/how-to-highlight-multifields-iis-there-a-way-to-highlight-all-results-with-the-same-multifield-same-source-different-analyzers-multi-fields-with-multiple-analyzers/335985)
**Author:** [@Eduard\_mart](https://discuss.elastic.co/u/Eduard_mart)\ **Replies:** 0\ **Last updated:** [June 14, 2023, 1:41pm UTC](https://discuss.elastic.co/t/how-to-highlight-multifields-iis-there-a-way-to-highlight-all-results-with-the-same-multifield-same-source-different-analyzers-multi-fields-with-multiple-analyzers/335985 "2023-06-14T13:41:05Z")
How to highlight multifield? Is there a way to highlight all results with the same multifield (same source, different analyzers)? Multi-fields with multiple analyzers --- ## [Bool Filter doubt / Match\_all](https://discuss.elastic.co/t/bool-filter-doubt-match-all/335982)
**Author:** [@RabBit\_BR](https://discuss.elastic.co/u/RabBit_BR)\ **Replies:** 0\ **Last updated:** [June 14, 2023, 1:19pm UTC](https://discuss.elastic.co/t/bool-filter-doubt-match-all/335982 "2023-06-14T13:19:32Z")
Hi everybody. Maybe this is a silly doubt but if someone can answer. I have 3 docs, 1 with status:true field, 1 with status:false field and 1 doc without status field. POST idx\_test/\_bulk {"index":{}} {"name":"xpto 1"… --- ## [After restarting the master node, data and client nodes cannot discover the master](https://discuss.elastic.co/t/after-restarting-the-master-node-data-and-client-nodes-cannot-discover-the-master/334804)
**Author:** [@daniela09](https://discuss.elastic.co/u/daniela09)\ **Replies:** 10\ **Last updated:** [June 14, 2023, 1:11pm UTC](https://discuss.elastic.co/t/after-restarting-the-master-node-data-and-client-nodes-cannot-discover-the-master/334804 "2023-06-14T13:11:53Z")
Hi, I am using elasticsearch cluster (8.7.0) on Kubernetes, I have 1 master, 1 client and 3 data nodes. After the restart of my master node, the other nodes cannot discover the master again. This is in the log of the d… --- ## [Specify \`spec.policyID\` with standalone Elastic Agent deployed with ECK](https://discuss.elastic.co/t/specify-spec-policyid-with-standalone-elastic-agent-deployed-with-eck/335910)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 2\ **Last updated:** [June 14, 2023, 12:39pm UTC](https://discuss.elastic.co/t/specify-spec-policyid-with-standalone-elastic-agent-deployed-with-eck/335910 "2023-06-14T12:39:54Z")
TL;DR ECK wants me to specify spec.policyID when deploying Elastic Agent, but I'm deploying a standalone Agent. Can I do this? Details I am using the Elastic Operator (ECK) to deploy standalone Elastic Agent to my clust… --- ## [Need help shipping stdout and stderr logs of docker container to different Elasticsearch/kibana](https://discuss.elastic.co/t/need-help-shipping-stdout-and-stderr-logs-of-docker-container-to-different-elasticsearch-kibana/335978)
**Author:** [@Shobana\_Nagarajan](https://discuss.elastic.co/u/Shobana_Nagarajan)\ **Replies:** 0\ **Last updated:** [June 14, 2023, 12:30pm UTC](https://discuss.elastic.co/t/need-help-shipping-stdout-and-stderr-logs-of-docker-container-to-different-elasticsearch-kibana/335978 "2023-06-14T12:30:31Z")
Hi, I need to separate stdout and stderr streams from my docker container app and ship them to different elasticsearch/kibana hosts. Is it possible? With beats+elasticsearch+kibana, i was not able to get it working. Re… --- ## [Limit a role and API key privledges](https://discuss.elastic.co/t/limit-a-role-and-api-key-privledges/335883)
**Author:** [@alongaks](https://discuss.elastic.co/u/alongaks)\ **Replies:** 2\ **Last updated:** [June 14, 2023, 12:29pm UTC](https://discuss.elastic.co/t/limit-a-role-and-api-key-privledges/335883 "2023-06-14T12:29:22Z")
Hello, I have a use case for creating a 'stack maintenance' user that will be called up with Ansible to perform the cluster.routing.allocation.enable action to limit shard allocation before Elasticsearch is stopped and … --- ## [Elastic Augeas Not Working](https://discuss.elastic.co/t/elastic-augeas-not-working/335718)
**Author:** [@ksaimohan2k](https://discuss.elastic.co/u/ksaimohan2k)\ **Replies:** 4\ **Last updated:** [June 14, 2023, 11:59am UTC](https://discuss.elastic.co/t/elastic-augeas-not-working/335718 "2023-06-14T11:59:40Z")
SELECT value FROM augeas WHERE path = '/etc/resolv.conf' AND label = 'nameserver'; SELECT \* FROM USERS When I am running this command, it's running successfully, but it's not retrieving the results. --- ## [Search by full name](https://discuss.elastic.co/t/search-by-full-name/335960)
**Author:** [@orlenkoda5](https://discuss.elastic.co/u/orlenkoda5)\ **Replies:** 1\ **Last updated:** [June 14, 2023, 11:57am UTC](https://discuss.elastic.co/t/search-by-full-name/335960 "2023-06-14T11:57:40Z")
Hi everyone. I have an index wich consists of 3 fields: sys\_name full\_name man\_id. I want to search by full name wich consists of 3 words: GET managers/\_search { "query": { "match": { "full\_name": "William Garvey J… --- ## [Remove multiple spaces with script](https://discuss.elastic.co/t/remove-multiple-spaces-with-script/335638)
**Author:** [@Ruwi](https://discuss.elastic.co/u/Ruwi)\ **Replies:** 2\ **Last updated:** [June 14, 2023, 11:56am UTC](https://discuss.elastic.co/t/remove-multiple-spaces-with-script/335638 "2023-06-14T11:56:26Z")
Hello, In street fields, the number of spaces has constantly changing values as follows. "street": "YALIM MAH. last/ şajdsj sdkdşfd" I can remove the spaces as follows, bu… --- ## [Elasticsearch snapshots fail everyday](https://discuss.elastic.co/t/elasticsearch-snapshots-fail-everyday/335747)
**Author:** [@ramdas](https://discuss.elastic.co/u/ramdas)\ **Replies:** 5\ **Last updated:** [June 14, 2023, 11:23am UTC](https://discuss.elastic.co/t/elasticsearch-snapshots-fail-everyday/335747 "2023-06-14T11:23:01Z")
Hi, I am using elasticsearch 8.7 in out production cluster on Azure kubernetes platform which has 8 data and master nodes and almost 4TB per node disks being used to store our observability data. we have 699 indexes as … --- ## [How can I show the value of a specific field from the most recent document in a time frame](https://discuss.elastic.co/t/how-can-i-show-the-value-of-a-specific-field-from-the-most-recent-document-in-a-time-frame/335964)
**Author:** [@Harold\_Van\_der\_Veken](https://discuss.elastic.co/u/Harold_Van_der_Veken)\ **Replies:** 2\ **Last updated:** [June 14, 2023, 11:22am UTC](https://discuss.elastic.co/t/how-can-i-show-the-value-of-a-specific-field-from-the-most-recent-document-in-a-time-frame/335964 "2023-06-14T11:22:40Z")
I have an ingest of logs where 1 field gets updated each time. Let say every minute I receive a logline and the count field holds certain value. In Kibana I can select for example the last hour as timeframe. Now I wo… --- ## [Unable to display large text fields in Kibana Markdown visualization](https://discuss.elastic.co/t/unable-to-display-large-text-fields-in-kibana-markdown-visualization/324981)
**Author:** [@Alice\_Ionescu](https://discuss.elastic.co/u/Alice_Ionescu)\ **Replies:** 9\ **Last updated:** [June 14, 2023, 10:22am UTC](https://discuss.elastic.co/t/unable-to-display-large-text-fields-in-kibana-markdown-visualization/324981 "2023-06-14T10:22:33Z")
Hello, I have one field store in ES that has a big length, around 35.000 - 40.000 characters. They are stored correctly in ES, I can see them in Discover page, but when I want to use them in a markdown visualization (T… --- ## [Getting HIgh s3 cost on LISTBUCKET OPERATION using logstash s3 pipeline](https://discuss.elastic.co/t/getting-high-s3-cost-on-listbucket-operation-using-logstash-s3-pipeline/335970)
**Author:** [@Dharampal\_Singh](https://discuss.elastic.co/u/Dharampal_Singh)\ **Replies:** 0\ **Last updated:** [June 14, 2023, 9:53am UTC](https://discuss.elastic.co/t/getting-high-s3-cost-on-listbucket-operation-using-logstash-s3-pipeline/335970 "2023-06-14T09:53:45Z")
Hi elastic Team, We have 3 logstash s3 pipeine from buckets(elb,cloudflare,cloudtrail) .Currently we are getting high s3 list bucket operation cost on these buckets.We want to know is there any way so we can minimize … --- ## [Replacing certificates on the server](https://discuss.elastic.co/t/replacing-certificates-on-the-server/335967)
**Author:** [@lolkerz](https://discuss.elastic.co/u/lolkerz)\ **Replies:** 0\ **Last updated:** [June 14, 2023, 9:42am UTC](https://discuss.elastic.co/t/replacing-certificates-on-the-server/335967 "2023-06-14T09:42:38Z")
Hello everyone. Previously, I had a certificate on the Logstash server. At the moment I have created a new certificate. Is it enough for me to simply replace it on the server, or does something need to be done beforehand… --- ## [Checking elasticsearch backups](https://discuss.elastic.co/t/checking-elasticsearch-backups/335955)
**Author:** [@hopa56](https://discuss.elastic.co/u/hopa56)\ **Replies:** 1\ **Last updated:** [June 14, 2023, 9:37am UTC](https://discuss.elastic.co/t/checking-elasticsearch-backups/335955 "2023-06-14T09:37:30Z")
i have Elasticsearch on which snapshots are taken daily, there is also a separately Elasticsearch which every day is restored by a script from the last snapshot and after restoration sends to the mail how much space th… --- ## [Unable to execute commands in Logstash pipeline](https://discuss.elastic.co/t/unable-to-execute-commands-in-logstash-pipeline/335199)
**Author:** [@mr\_ph](https://discuss.elastic.co/u/mr_ph)\ **Replies:** 2\ **Last updated:** [June 14, 2023, 9:25am UTC](https://discuss.elastic.co/t/unable-to-execute-commands-in-logstash-pipeline/335199 "2023-06-14T09:25:28Z")
I have some pipelines in my logstash. In that pipelines i am executing some commands as per some conditions. After creating the pipeline i used the following command to test the pipeline /usr/share/logstash/bin/lo… --- ## [Question about elasticsearch index and logstash ingestion](https://discuss.elastic.co/t/question-about-elasticsearch-index-and-logstash-ingestion/335057)
**Author:** [@Hanni](https://discuss.elastic.co/u/Hanni)\ **Replies:** 20\ **Last updated:** [June 14, 2023, 9:10am UTC](https://discuss.elastic.co/t/question-about-elasticsearch-index-and-logstash-ingestion/335057 "2023-06-14T09:10:27Z")
Hello everyone I'd like to ask you 2 questions. I receive approximately 270 csv per month, 9 of them per day. Each csv is between 1kB and 3MG in size. All these csv are sent to the same index on elasticsearch with log… [Previous page](https://discuss.elastic.co/latest.md?page=640) [Next page](https://discuss.elastic.co/latest.md?page=642)