# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=682 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 683 --- ## [Saving documents in multiple indexes/Retention policy based on documents fields (Looking for ideas)](https://discuss.elastic.co/t/saving-documents-in-multiple-indexes-retention-policy-based-on-documents-fields-looking-for-ideas/299482)
**Author:** [@scott\_stash](https://discuss.elastic.co/u/scott_stash)\ **Replies:** 0\ **Last updated:** [March 11, 2022, 5:31pm UTC](https://discuss.elastic.co/t/saving-documents-in-multiple-indexes-retention-policy-based-on-documents-fields-looking-for-ideas/299482 "2022-03-11T17:31:23Z")
Using 7.17.. currently I read log files in with filebeat or filebeat/logstash saving in ES. Log lines are dissected and we have a field called loglevel, for ERROR, WARN and INFO. If the message is an ERROR a field call… --- ## [Elasticsearch 8.1 normalizer in strings error](https://discuss.elastic.co/t/elasticsearch-8-1-normalizer-in-strings-error/299476)
**Author:** [@willypol](https://discuss.elastic.co/u/willypol)\ **Replies:** 7\ **Last updated:** [March 11, 2022, 5:30pm UTC](https://discuss.elastic.co/t/elasticsearch-8-1-normalizer-in-strings-error/299476 "2022-03-11T17:30:17Z")
Hello, I've been using the next component template in elastic 7. I recently upgraded to elastic 8.1 and it won't let me create the template like before. PUT \_component\_template/keywords { "template": { "mappings":… --- ## [Grok pattern for stashing Ansible logs](https://discuss.elastic.co/t/grok-pattern-for-stashing-ansible-logs/299227)
**Author:** [@santy1](https://discuss.elastic.co/u/santy1)\ **Replies:** 6\ **Last updated:** [March 11, 2022, 4:06pm UTC](https://discuss.elastic.co/t/grok-pattern-for-stashing-ansible-logs/299227 "2022-03-11T16:06:57Z")
Hello, I am new to Elasticsearch. I am on Elasticsearch 7.17.1. Below are the logs that I am trying to parse. 2022-03-08 14:52:50,672 p=1654827 u=ansible n=ansible | TASK \[lvm : Formatting xfs filesystem\] \*\* 2022-03-… --- ## [How to read group by buckets key values using "ctx" from below query](https://discuss.elastic.co/t/how-to-read-group-by-buckets-key-values-using-ctx-from-below-query/299383)
**Author:** [@srinivasa\_adaboina](https://discuss.elastic.co/u/srinivasa_adaboina)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 4:23pm UTC](https://discuss.elastic.co/t/how-to-read-group-by-buckets-key-values-using-ctx-from-below-query/299383 "2022-03-11T16:23:48Z")
{ "\_shards": { "total": 155, "failed": 0, "successful": 155, "skipped": 0 }, "hits": { "hits": , "total": { "value": 5535, "relation": "eq" }, "max\_score": null }, "took": 44, "timed\_out": false, "aggreg… --- ## [Logstash crashes when kafka producer sends less fields than excepted](https://discuss.elastic.co/t/logstash-crashes-when-kafka-producer-sends-less-fields-than-excepted/299475)
**Author:** [@guriv](https://discuss.elastic.co/u/guriv)\ **Replies:** 0\ **Last updated:** [March 11, 2022, 3:48pm UTC](https://discuss.elastic.co/t/logstash-crashes-when-kafka-producer-sends-less-fields-than-excepted/299475 "2022-03-11T15:48:15Z")
Hello we are using logstash-kafka-integration plugin to read messages from a kafka topic using avro encoding If my logstash consumer refers to a schema registry file that defines 2 optional fields but receive a message… --- ## [Turn off sending time range filter when using drilldown](https://discuss.elastic.co/t/turn-off-sending-time-range-filter-when-using-drilldown/298632)
**Author:** [@Rick\_V](https://discuss.elastic.co/u/Rick_V)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 3:58pm UTC](https://discuss.elastic.co/t/turn-off-sending-time-range-filter-when-using-drilldown/298632 "2022-03-11T15:58:27Z")
Hi, I'm using drilldowns in dashboards to give a deeper detail into the visualization. I use several visualizations like line and area graph to give an insight over time like the derivative. However when i click on a do… --- ## [Create new file every 60seconds in Logstash CSV output](https://discuss.elastic.co/t/create-new-file-every-60seconds-in-logstash-csv-output/299380)
**Author:** [@gnam](https://discuss.elastic.co/u/gnam)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 2:01pm UTC](https://discuss.elastic.co/t/create-new-file-every-60seconds-in-logstash-csv-output/299380 "2022-03-11T14:01:31Z")
I have following filter configuration in my logstatsh pipeline. What it does is, at the start of the event first filter creates a CSV file with header and sets the file name to metadata. Second filter writes the output … --- ## [Use of ELK to implement AI Algorithm](https://discuss.elastic.co/t/use-of-elk-to-implement-ai-algorithm/299235)
**Author:** [@bechir-jamoussi](https://discuss.elastic.co/u/bechir-jamoussi)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 2:01pm UTC](https://discuss.elastic.co/t/use-of-elk-to-implement-ai-algorithm/299235 "2022-03-11T14:01:14Z")
Dear Community, I want to use only Beats + Logstash (for collecting and processing the data) and Elasticsearch(as a database) and then based on that data, I need to use AI to make a decision, it is not log analysis or a… --- ## [How to find all the queries terminated by elasticsearch when it reaches requestTimeout](https://discuss.elastic.co/t/how-to-find-all-the-queries-terminated-by-elasticsearch-when-it-reaches-requesttimeout/299145)
**Author:** [@jatin\_gupta](https://discuss.elastic.co/u/jatin_gupta)\ **Replies:** 5\ **Last updated:** [March 11, 2022, 1:31pm UTC](https://discuss.elastic.co/t/how-to-find-all-the-queries-terminated-by-elasticsearch-when-it-reaches-requesttimeout/299145 "2022-03-11T13:31:59Z")
We have specified request\_timeout while creating Elasticsearch client using javascript library. Whenever the timeout is reached our understanding is that the query is terminated by Elasticsearch as it does not appear in … --- ## [After adding Nodes to a Cluster - common Users cannot authenticate on said nodes](https://discuss.elastic.co/t/after-adding-nodes-to-a-cluster-common-users-cannot-authenticate-on-said-nodes/299419)
**Author:** [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 1:05pm UTC](https://discuss.elastic.co/t/after-adding-nodes-to-a-cluster-common-users-cannot-authenticate-on-said-nodes/299419 "2022-03-11T13:05:51Z")
Hi Everyone, i'm currently running a 3 Node Cluster, each Node is running CentOS 7. The Version of all the components is 7.15. We added 2 new nodes - because the old "Data Storing" Nodes were set up without lvm and t… --- ## [Hadoop env Hive Connectivity through logstash](https://discuss.elastic.co/t/hadoop-env-hive-connectivity-through-logstash/299452)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 0\ **Last updated:** [March 11, 2022, 1:02pm UTC](https://discuss.elastic.co/t/hadoop-env-hive-connectivity-through-logstash/299452 "2022-03-11T13:02:37Z")
Is it possible to connect to Hadoop hive environment using hive jdbc driver, through logstash jdbc connector? --- ## [Metricbeat for NGINX : HTTP error 502 in : 502 Bad Gateway](https://discuss.elastic.co/t/metricbeat-for-nginx-http-error-502-in-502-bad-gateway/299155)
**Author:** [@elasticmind](https://discuss.elastic.co/u/elasticmind)\ **Replies:** 6\ **Last updated:** [March 11, 2022, 11:08am UTC](https://discuss.elastic.co/t/metricbeat-for-nginx-http-error-502-in-502-bad-gateway/299155 "2022-03-11T11:08:48Z")
Hello, I'm going through the observability fundamentals training and for the NGINX metrics section i'm getting this error: {"log.level":"error","@timestamp":"2022-03-09T00:57:04.303Z","log.origin":{"file.name":"module/… --- ## [Master not discovred ( multi-nodes cluster )](https://discuss.elastic.co/t/master-not-discovred-multi-nodes-cluster/299422)
**Author:** [@Achraf\_MENSI](https://discuss.elastic.co/u/Achraf_MENSI)\ **Replies:** 5\ **Last updated:** [March 11, 2022, 10:20am UTC](https://discuss.elastic.co/t/master-not-discovred-multi-nodes-cluster/299422 "2022-03-11T10:20:49Z")
my nodes can’t see each other on my Elasticsearch cluster on vm azure \`{"error":{"root\_cause":\[{"type":"master\_not\_discovered\_exception","reason":null}\],"type":"master\_not\_discovered\_exception","reason":null},"status":5… --- ## [Connecting to the Teradata Data Source through logstash](https://discuss.elastic.co/t/connecting-to-the-teradata-data-source-through-logstash/299420)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 0\ **Last updated:** [March 11, 2022, 9:22am UTC](https://discuss.elastic.co/t/connecting-to-the-teradata-data-source-through-logstash/299420 "2022-03-11T09:22:07Z")
Is it possible to use the logstash JDBC connector to connect to the Teradata data platform? --- ## [Can't run Logstash as a Service](https://discuss.elastic.co/t/cant-run-logstash-as-a-service/299202)
**Author:** [@Simone1](https://discuss.elastic.co/u/Simone1)\ **Replies:** 26\ **Last updated:** [March 11, 2022, 8:06am UTC](https://discuss.elastic.co/t/cant-run-logstash-as-a-service/299202 "2022-03-11T08:06:57Z")
If i run logstash manually it works fine and sends all data in the right way. But when i try to run it as a service it shows this error: Cmd that i use: sudo systemctl start logstash.service OS Ubuntu 20.04.1 Log… --- ## [Can I open a case about logstash in elastic support?](https://discuss.elastic.co/t/can-i-open-a-case-about-logstash-in-elastic-support/299399)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 8:06am UTC](https://discuss.elastic.co/t/can-i-open-a-case-about-logstash-in-elastic-support/299399 "2022-03-11T08:06:16Z")
Hi, our enterprise has 5 different platinium subscriptions, and whe are having a problem with logstash, it is posible to open a case? or the support its only for Elasticsearch? --- ## [Elasticsearch can-match phase](https://discuss.elastic.co/t/elasticsearch-can-match-phase/299331)
**Author:** [@qixian](https://discuss.elastic.co/u/qixian)\ **Replies:** 1\ **Last updated:** [March 11, 2022, 7:24am UTC](https://discuss.elastic.co/t/elasticsearch-can-match-phase/299331 "2022-03-11T07:24:09Z")
hello,who can help me with this question,thanks. I konw that the old version of Elasticsearch before 7.16,during the can-match phase,the search’s coordinating node sent an individual request to each shard checked,is it … --- ## [Elasticsearch restore cluster with TLS enabled](https://discuss.elastic.co/t/elasticsearch-restore-cluster-with-tls-enabled/299392)
**Author:** [@auto\_reply\_007](https://discuss.elastic.co/u/auto_reply_007)\ **Replies:** 3\ **Last updated:** [March 11, 2022, 6:42am UTC](https://discuss.elastic.co/t/elasticsearch-restore-cluster-with-tls-enabled/299392 "2022-03-11T06:42:54Z")
Hello! we have Elasticsearch 7.10.2 cluster in Delhi ( with InterNode tls and users enabled ) and we want to move cluster data onto another location ( Dubai ) and how to backup all data except security indices? because … --- ## [Keycloak with ELK stack](https://discuss.elastic.co/t/keycloak-with-elk-stack/299311)
**Author:** [@shivendra95](https://discuss.elastic.co/u/shivendra95)\ **Replies:** 3\ **Last updated:** [March 11, 2022, 6:23am UTC](https://discuss.elastic.co/t/keycloak-with-elk-stack/299311 "2022-03-11T06:23:17Z")
I'm trying to use Keycloak to login into kibana dashboard. Can anyone help me on this as some of the solutions I found on the forum were not working out for me. --- ## [Want to disable Logstash http://localhost:9600/ URL JSON output](https://discuss.elastic.co/t/want-to-disable-logstash-http-localhost-9600-url-json-output/299352)
**Author:** [@shahidraza](https://discuss.elastic.co/u/shahidraza)\ **Replies:** 6\ **Last updated:** [March 11, 2022, 5:51am UTC](https://discuss.elastic.co/t/want-to-disable-logstash-http-localhost-9600-url-json-output/299352 "2022-03-11T05:51:51Z")
Hi Team, We don't want to see JSON output as it contains Hostname and other sensitive information and it's accessible without user id and password too. Please share details to disable this so that security vulnerabilit… --- ## [Create New Fields from Metricbeat](https://discuss.elastic.co/t/create-new-fields-from-metricbeat/299394)
**Author:** [@personal.riz](https://discuss.elastic.co/u/personal.riz)\ **Replies:** 0\ **Last updated:** [March 11, 2022, 4:37am UTC](https://discuss.elastic.co/t/create-new-fields-from-metricbeat/299394 "2022-03-11T04:37:56Z")
Hi guys, i want to ask how to create new fields from metricbeat value like host.network.in.bytes for network monitoring. i want to create query PPL from metricbeat value but the value is null, i think because the value … --- ## [Not able to create ES cluster with ECK1.9.1](https://discuss.elastic.co/t/not-able-to-create-es-cluster-with-eck1-9-1/299206)
**Author:** [@NK2812](https://discuss.elastic.co/u/NK2812)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 4:22am UTC](https://discuss.elastic.co/t/not-able-to-create-es-cluster-with-eck1-9-1/299206 "2022-03-11T04:22:15Z")
Hi Team, We trying to create ES-7.16.3 version cluster with ECK 1.9 but ECK is not creating the ES cluster. unfortunately I do not see any errors also in the eck logs. I tried to create the es cluster using below confi… --- ## [Can one specify format of datetime in query?](https://discuss.elastic.co/t/can-one-specify-format-of-datetime-in-query/299263)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 5\ **Last updated:** [March 11, 2022, 1:47am UTC](https://discuss.elastic.co/t/can-one-specify-format-of-datetime-in-query/299263 "2022-03-11T01:47:47Z")
Is there a way of specifying the format of times used in a query? In most of my indexes I convert times to ISO8601 but one data source had a totally non standard format and I decided that it was easier to simply specify… --- ## [Elasticsearch java api tail](https://discuss.elastic.co/t/elasticsearch-java-api-tail/299387)
**Author:** [@111505](https://discuss.elastic.co/u/111505)\ **Replies:** 0\ **Last updated:** [March 11, 2022, 1:35am UTC](https://discuss.elastic.co/t/elasticsearch-java-api-tail/299387 "2022-03-11T01:35:24Z")
Hi. I want to implement the "tail" function with Java. Will the Elasticsearch java API provide similar functions to "tail"? I plan to use it when I look at Log. The Scroll API seems to be difficult to write due to the… --- ## [Renaming multiple fields that are nested](https://discuss.elastic.co/t/renaming-multiple-fields-that-are-nested/299376)
**Author:** [@itschobot](https://discuss.elastic.co/u/itschobot)\ **Replies:** 3\ **Last updated:** [March 11, 2022, 12:05am UTC](https://discuss.elastic.co/t/renaming-multiple-fields-that-are-nested/299376 "2022-03-11T00:05:25Z")
I need help renaming multiple fields that are nested, here is my problem, I can only rename "did" within example.devices but when I attempt to rename others I would assume it's the same pattern but the results are what i… --- ## [How do I logout of Kibana](https://discuss.elastic.co/t/how-do-i-logout-of-kibana/299015)
**Author:** [@codewriterguy](https://discuss.elastic.co/u/codewriterguy)\ **Replies:** 8\ **Last updated:** [March 10, 2022, 11:18pm UTC](https://discuss.elastic.co/t/how-do-i-logout-of-kibana/299015 "2022-03-10T23:18:39Z")
I know this is incredibly basic and I'm not trolling, I can't find a logout button --- ## [Unable to get terminal for logstash 8.0.1](https://discuss.elastic.co/t/unable-to-get-terminal-for-logstash-8-0-1/299370)
**Author:** [@uma\_rengasamy](https://discuss.elastic.co/u/uma_rengasamy)\ **Replies:** 0\ **Last updated:** [March 10, 2022, 9:38pm UTC](https://discuss.elastic.co/t/unable-to-get-terminal-for-logstash-8-0-1/299370 "2022-03-10T21:38:21Z")
Getting below error OCI runtime exec failed: exec failed: container\_linux.go:380: starting container process caused: exec: "/bin/bash": stat /bin/bash: no such file or directory: unknown --- ## [Interested in providing feedback? Let’s chat!](https://discuss.elastic.co/t/interested-in-providing-feedback-let-s-chat/299359)
**Author:** [@daphne](https://discuss.elastic.co/u/daphne)\ **Replies:** 0\ **Last updated:** [March 10, 2022, 5:15pm UTC](https://discuss.elastic.co/t/interested-in-providing-feedback-let-s-chat/299359 "2022-03-10T17:15:40Z")
Hi! My name is Daphne and I am a user experience researcher at Elastic. I’d love to hear from our users about pricing at Elastic. We are working on a few concepts to help you more precisely estimate your costs to use Ela… --- ## [Prune filter does not work](https://discuss.elastic.co/t/prune-filter-does-not-work/299274)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 6\ **Last updated:** [March 10, 2022, 8:15pm UTC](https://discuss.elastic.co/t/prune-filter-does-not-work/299274 "2022-03-10T20:15:00Z")
good morning, hope you are well I have a problem with the "prune" filter in logstash and I have a configuration file in logstash in which the objective is to take the data from filebeat-netflow and go through the pipe i… --- ## [Encountered a retryable error. Will Retry with exponential backoff {:code=\>500,](https://discuss.elastic.co/t/encountered-a-retryable-error-will-retry-with-exponential-backoff-code-500/299138)
**Author:** [@venky123](https://discuss.elastic.co/u/venky123)\ **Replies:** 4\ **Last updated:** [March 10, 2022, 7:26pm UTC](https://discuss.elastic.co/t/encountered-a-retryable-error-will-retry-with-exponential-backoff-code-500/299138 "2022-03-10T19:26:57Z")
Continuing the discussion from Encountered a retryable error. Will Retry with exponential backoff code=\>413: \[2022-03-07T02:18:15,991\]\[ERROR\]\[logstash.outputs.Elasticsearch\] Encountered a retryable error. Will Retry wit… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=681) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=683)