# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=688 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 689 --- ## [6.8 to 7.x - This index has date fields with deprecated formats](https://discuss.elastic.co/t/6-8-to-7-x-this-index-has-date-fields-with-deprecated-formats/298865)
**Author:** [@MatthiasLenhardt](https://discuss.elastic.co/u/MatthiasLenhardt)\ **Replies:** 0\ **Last updated:** [March 4, 2022, 4:42pm UTC](https://discuss.elastic.co/t/6-8-to-7-x-this-index-has-date-fields-with-deprecated-formats/298865 "2022-03-04T16:42:03Z")
Hi, we are planing to upgrade Elasticsearch from 6.8 to 7.x. Kibana " 7.0 Upgrade Assistant" tells us for some indices "Date field format uses patterns which may change meaning in 7.0", e.g.: This index has date field… --- ## [Aggregation on Multisearch responses](https://discuss.elastic.co/t/aggregation-on-multisearch-responses/298862)
**Author:** [@hbot](https://discuss.elastic.co/u/hbot)\ **Replies:** 0\ **Last updated:** [March 4, 2022, 4:29pm UTC](https://discuss.elastic.co/t/aggregation-on-multisearch-responses/298862 "2022-03-04T16:29:02Z")
Hi, Is it possible to run an aggregation on multiple response sets returned by the multisearch API? As an example, say I execute 10 different queries through the multisearch API, and each query returns 10 documents with… --- ## [Event aggregation with logstash error due to mixed task\_id](https://discuss.elastic.co/t/event-aggregation-with-logstash-error-due-to-mixed-task-id/298705)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 3\ **Last updated:** [March 4, 2022, 4:02pm UTC](https://discuss.elastic.co/t/event-aggregation-with-logstash-error-due-to-mixed-task-id/298705 "2022-03-04T16:02:53Z")
Hi all I have a case like this: my email log has a task\_id i called it event.id due to how the log was configed now all the log are seperated and only joined by the event.id field. Now i've tried to use the aggregate … --- ## [Logstash 8.0 is adding extra field](https://discuss.elastic.co/t/logstash-8-0-is-adding-extra-field/297594)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 3\ **Last updated:** [March 4, 2022, 3:50pm UTC](https://discuss.elastic.co/t/logstash-8-0-is-adding-extra-field/297594 "2022-03-04T15:50:19Z")
logstash consuming JSON messages from Kafka and indexing them into Elasticsearch. we found that logstash version 8.0 is adding the additional field event with the value of the actual message. could you please let me kno… --- ## [Set custom Transform schedule time in kibana](https://discuss.elastic.co/t/set-custom-transform-schedule-time-in-kibana/298794)
**Author:** [@dash5000](https://discuss.elastic.co/u/dash5000)\ **Replies:** 3\ **Last updated:** [March 4, 2022, 3:01pm UTC](https://discuss.elastic.co/t/set-custom-transform-schedule-time-in-kibana/298794 "2022-03-04T15:01:12Z")
Hello Everyone, I just started using transform in kibana UI to aggregate data and also to have a longer retention period for visualization. The data collections work fine, my transform basically collectors two fields w… --- ## [Deserialization of results in the Output section](https://discuss.elastic.co/t/deserialization-of-results-in-the-output-section/298634)
**Author:** [@puneet\_makhija](https://discuss.elastic.co/u/puneet_makhija)\ **Replies:** 6\ **Last updated:** [March 4, 2022, 2:43pm UTC](https://discuss.elastic.co/t/deserialization-of-results-in-the-output-section/298634 "2022-03-04T14:43:22Z")
@DavidTurner hope you are doing well can you please assist me into this one , I am stuck in this one I successfully implemented LogStash, here below is my logstash.conf code which is working perfectly input { kafka {… --- ## [TSVB "Your query attempted to fetch too much data."](https://discuss.elastic.co/t/tsvb-your-query-attempted-to-fetch-too-much-data/298620)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 1\ **Last updated:** [March 4, 2022, 2:23pm UTC](https://discuss.elastic.co/t/tsvb-your-query-attempted-to-fetch-too-much-data/298620 "2022-03-04T14:23:38Z")
Hello, I find using TSVB for my dashboard very handy but there is one drawback that I don't know how to overcome. Your query attempted to fetch too much data. Reducing the time range or changing the interval used usua… --- ## [Unable to form a cluster elasticsearch 8.0.0](https://discuss.elastic.co/t/unable-to-form-a-cluster-elasticsearch-8-0-0/298828)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 0\ **Last updated:** [March 4, 2022, 7:57am UTC](https://discuss.elastic.co/t/unable-to-form-a-cluster-elasticsearch-8-0-0/298828 "2022-03-04T07:57:30Z")
Hi Team, I have downloaded elasticsearch 8.0.0 on windows 2019. I am trying to make a 3 node cluster with master + data eligibility. Below is my Node 1 configuration cluster.name: test node.name: node-1 node.roles: \[… --- ## [Language matters - blacklist\_ and whitelist\_](https://discuss.elastic.co/t/language-matters-blacklist-and-whitelist/298803)
**Author:** [@eclctcjp](https://discuss.elastic.co/u/eclctcjp)\ **Replies:** 2\ **Last updated:** [March 4, 2022, 1:06pm UTC](https://discuss.elastic.co/t/language-matters-blacklist-and-whitelist/298803 "2022-03-04T13:06:10Z")
For the prune filter, please change to more neutral language the 4 values: blacklist\_names blacklist\_values whitelist\_names whitelist\_values I noticed this post, but it looks like we missed the settings in "prune" --- ## [How to audit search on an Elasticsearch indexes](https://discuss.elastic.co/t/how-to-audit-search-on-an-elasticsearch-indexes/298754)
**Author:** [@chriselk](https://discuss.elastic.co/u/chriselk)\ **Replies:** 6\ **Last updated:** [March 4, 2022, 10:50am UTC](https://discuss.elastic.co/t/how-to-audit-search-on-an-elasticsearch-indexes/298754 "2022-03-04T10:50:52Z")
We would like to have report on what type of search we have on some Elastic index, I cannot find the search in the servers logs, not sure how we could audit the search request done on an index ? kind of 10 most field /… --- ## [Kibana Setting "logging.dest" is deprecated can't be fixed](https://discuss.elastic.co/t/kibana-setting-logging-dest-is-deprecated-cant-be-fixed/291424)
**Author:** [@KillianS](https://discuss.elastic.co/u/KillianS)\ **Replies:** 13\ **Last updated:** [March 4, 2022, 10:19am UTC](https://discuss.elastic.co/t/kibana-setting-logging-dest-is-deprecated-cant-be-fixed/291424 "2022-03-04T10:19:48Z")
Hi all, We are facing an issue with Kibana 7.16.0 on Ubuntu 18.04. In Kibana log I can see a warning message \["warning","config","deprecation"\],"pid":24471,"message":""logging.dest" has been deprecated and will be remov… --- ## [Compare fields values in two different documents](https://discuss.elastic.co/t/compare-fields-values-in-two-different-documents/298833)
**Author:** [@elasticity2](https://discuss.elastic.co/u/elasticity2)\ **Replies:** 0\ **Last updated:** [March 4, 2022, 10:18am UTC](https://discuss.elastic.co/t/compare-fields-values-in-two-different-documents/298833 "2022-03-04T10:18:46Z")
Hi All, I am trying to achieve the following search based on the data shown in the screenshot. This is just an example to provide context as to what I am trying to do. For a given PID, in this examples (smss.exe) I nee… --- ## [Logstash + XML + Multiple split](https://discuss.elastic.co/t/logstash-xml-multiple-split/298821)
**Author:** [@Stek\_new](https://discuss.elastic.co/u/Stek_new)\ **Replies:** 1\ **Last updated:** [March 4, 2022, 9:44am UTC](https://discuss.elastic.co/t/logstash-xml-multiple-split/298821 "2022-03-04T09:44:06Z")
Hello! Wonder if someone could help me how to divide my XML into several events for their further parsing I have the following XML file (yes, everything in one row): \\\ **Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 2\ **Last updated:** [March 4, 2022, 7:44am UTC](https://discuss.elastic.co/t/getting-search-phase-execution-exception-in-kibana-discover-pane/298622 "2022-03-04T07:44:43Z") I have many indices such as cloud-audit-aws, cloud-audit-azure, cloud-audit-gsuite, cloud-audit-secret-tools, cloud-audit-github, and many more starting with cloud-audit. I have created an index pattern cloud-audit\* to m… --- ## [Error writing registrar state to statestore: failed in store/get operation on store 'filebeat': rename /var/lib/filebeat/registry/filebeat/checkpoint.new /var/lib/filebeat/registry/filebeat/4102615046.json: no such file or directory](https://discuss.elastic.co/t/error-writing-registrar-state-to-statestore-failed-in-store-get-operation-on-store-filebeat-rename-var-lib-filebeat-registry-filebeat-checkpoint-new-var-lib-filebeat-registry-filebeat-4102615046-json-no-such-file-or-directory/298825)
**Author:** [@lucy0108](https://discuss.elastic.co/u/lucy0108)\ **Replies:** 0\ **Last updated:** [March 4, 2022, 7:36am UTC](https://discuss.elastic.co/t/error-writing-registrar-state-to-statestore-failed-in-store-get-operation-on-store-filebeat-rename-var-lib-filebeat-registry-filebeat-checkpoint-new-var-lib-filebeat-registry-filebeat-4102615046-json-no-such-file-or-directory/298825 "2022-03-04T07:36:22Z")
Hi , I see error as below while running filebeat. 2022-03-03T02:04:20.142Z ERROR \[registrar\] registrar/registrar.go:202 Error writing registrar state to statestore: failed in store/get operation on store… --- ## [Create kibana visualizations using Chart.js or elastic-charts](https://discuss.elastic.co/t/create-kibana-visualizations-using-chart-js-or-elastic-charts/298805)
**Author:** [@frank3nst3in](https://discuss.elastic.co/u/frank3nst3in)\ **Replies:** 1\ **Last updated:** [March 4, 2022, 6:55am UTC](https://discuss.elastic.co/t/create-kibana-visualizations-using-chart-js-or-elastic-charts/298805 "2022-03-04T06:55:07Z")
I want to create the visualization similar to one which are created by kibana (in dashboard). By using chart.js / elastic-charts on frontend and the data present in my Elasticsearch instance. how can I do that ? --- ## [Unable to get local issuer certificate error while building kibana - yarn build](https://discuss.elastic.co/t/unable-to-get-local-issuer-certificate-error-while-building-kibana-yarn-build/298139)
**Author:** [@Shreeya\_Rajguru](https://discuss.elastic.co/u/Shreeya_Rajguru)\ **Replies:** 4\ **Last updated:** [March 4, 2022, 5:34am UTC](https://discuss.elastic.co/t/unable-to-get-local-issuer-certificate-error-while-building-kibana-yarn-build/298139 "2022-03-04T05:34:14Z")
I am facing the unable to get local issuer certificate error when I try to build kibana using the command - yarn build --skip-os-packages I have tried these solutions before which didn't work : disabling TLS connectio… --- ## [How to maintain sql\_last\_value for different source queries](https://discuss.elastic.co/t/how-to-maintain-sql-last-value-for-different-source-queries/298812)
**Author:** [@rbnalluri](https://discuss.elastic.co/u/rbnalluri)\ **Replies:** 0\ **Last updated:** [March 4, 2022, 4:43am UTC](https://discuss.elastic.co/t/how-to-maintain-sql-last-value-for-different-source-queries/298812 "2022-03-04T04:43:31Z")
Hi, I have couple of scripts which reads data from oracle database and creates respective index files on Elasticsearch.I have implemented delta extraction logic by using the inbuilt feature of logstash by using :sql\_las… --- ## [How to change to desc without sorts in es?](https://discuss.elastic.co/t/how-to-change-to-desc-without-sorts-in-es/298801)
**Author:** [@ifree-zm](https://discuss.elastic.co/u/ifree-zm)\ **Replies:** 8\ **Last updated:** [March 4, 2022, 4:40am UTC](https://discuss.elastic.co/t/how-to-change-to-desc-without-sorts-in-es/298801 "2022-03-04T04:40:45Z")
Sort Orderedit The order option can have the following values: asc Sort in ascending order desc Sort in descending order The order defaults to desc when sorting on the \_score , and defaults to asc when sortin… --- ## [Does Logstash Persistent Queue support Syslog Plugin](https://discuss.elastic.co/t/does-logstash-persistent-queue-support-syslog-plugin/298809)
**Author:** [@ivanchak](https://discuss.elastic.co/u/ivanchak)\ **Replies:** 3\ **Last updated:** [March 4, 2022, 4:30am UTC](https://discuss.elastic.co/t/does-logstash-persistent-queue-support-syslog-plugin/298809 "2022-03-04T04:30:42Z")
Dear all, I have a pipeline that has been configured to use the syslog plugin as its input data source. And I would like to enable the Persistent Queue feature to prevent potential data loss due to a crash on Logstash. … --- ## [ElasticsearchError(error: "Routing Error. The path you have requested is invalid.", status: nil)](https://discuss.elastic.co/t/elasticsearcherror-error-routing-error-the-path-you-have-requested-is-invalid-status-nil/297977)
**Author:** [@tenna.churiki](https://discuss.elastic.co/u/tenna.churiki)\ **Replies:** 14\ **Last updated:** [March 4, 2022, 1:59am UTC](https://discuss.elastic.co/t/elasticsearcherror-error-routing-error-the-path-you-have-requested-is-invalid-status-nil/297977 "2022-03-04T01:59:17Z")
Hi, I am trying to send query with Swift, but it returns error below. Routing Error. The path you have requested is invalid. My code is below (Using ElasticSwift) let host = "myEndPoint" … --- ## [+HeapDumpOnOutOfMemoryError](https://discuss.elastic.co/t/heapdumponoutofmemoryerror/298786)
**Author:** [@d6036de2b54af16665f4](https://discuss.elastic.co/u/d6036de2b54af16665f4)\ **Replies:** 1\ **Last updated:** [March 3, 2022, 11:27pm UTC](https://discuss.elastic.co/t/heapdumponoutofmemoryerror/298786 "2022-03-03T23:27:54Z")
Hello I am getting Heapdump out of memory error on my Production.. DUe to which i am getting incosistant data on kibana Can you please help me to solve this.. I will send you error messages It's Instance type is t3a.… --- ## [Kibana: Unable to retrieve version information from Elasticsearch nodes. error:0909006C:PEM](https://discuss.elastic.co/t/kibana-unable-to-retrieve-version-information-from-elasticsearch-nodes-errorpem/298650)
**Author:** [@GB88](https://discuss.elastic.co/u/GB88)\ **Replies:** 4\ **Last updated:** [March 3, 2022, 11:19pm UTC](https://discuss.elastic.co/t/kibana-unable-to-retrieve-version-information-from-elasticsearch-nodes-errorpem/298650 "2022-03-03T23:19:01Z")
Hello, When starting Kibana, the log shows, amongst other info's, this Error: Unable to retrieve version information from Elasticsearch nodes. error:0909006C:PEM I'm able to browse to https://172.1.1.50:5601, and the … --- ## [Force execute watcher does not stop sending the alerts](https://discuss.elastic.co/t/force-execute-watcher-does-not-stop-sending-the-alerts/298760)
**Author:** [@vee](https://discuss.elastic.co/u/vee)\ **Replies:** 1\ **Last updated:** [March 3, 2022, 10:14pm UTC](https://discuss.elastic.co/t/force-execute-watcher-does-not-stop-sending-the-alerts/298760 "2022-03-03T22:14:49Z")
Hi, running into an issue where when I tried to force execute a watcher - it's supposed to be sending a report and stop. But now, I'm seeing an issue where it just doesn't stop sending the alerts even after deleting the … --- ## [Kibana server is not ready yet error](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-error/298789)
**Author:** [@CoreyCBurton](https://discuss.elastic.co/u/CoreyCBurton)\ **Replies:** 4\ **Last updated:** [March 3, 2022, 10:04pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-error/298789 "2022-03-03T22:04:21Z")
I am getting an error that is shown below when I visit localhost:5601 Kibana server is not ready yet. When I enter the command curl -cacert /etc/elasticsearch/certs/http\_ca.crt -u Elasticsearch https://localhost:9200,… --- ## [Filter for using a unique value regardless of date](https://discuss.elastic.co/t/filter-for-using-a-unique-value-regardless-of-date/298790)
**Author:** [@pball](https://discuss.elastic.co/u/pball)\ **Replies:** 1\ **Last updated:** [March 3, 2022, 9:57pm UTC](https://discuss.elastic.co/t/filter-for-using-a-unique-value-regardless-of-date/298790 "2022-03-03T21:57:53Z")
Hi All, I have searched and read many articles but have not found an answer or post which matches my criteria. This is a very simplistic example but I hope it makes it clear. I have 5 users and 3 bats. The green bat has… --- ## [Using Search UI directly with Elasticsearch](https://discuss.elastic.co/t/using-search-ui-directly-with-elasticsearch/298787)
**Author:** [@brad-g](https://discuss.elastic.co/u/brad-g)\ **Replies:** 0\ **Last updated:** [March 3, 2022, 8:03pm UTC](https://discuss.elastic.co/t/using-search-ui-directly-with-elasticsearch/298787 "2022-03-03T20:03:21Z")
I have a React/Django site focused on a search application built with Search UI. Right now I have it set up to query an App Search engine with a small test subset (~1000 documents) of the full dataset (~550,000 documents… --- ## [Elastic Search handle out of order updates](https://discuss.elastic.co/t/elastic-search-handle-out-of-order-updates/298571)
**Author:** [@andy4324](https://discuss.elastic.co/u/andy4324)\ **Replies:** 7\ **Last updated:** [March 3, 2022, 7:44pm UTC](https://discuss.elastic.co/t/elastic-search-handle-out-of-order-updates/298571 "2022-03-03T19:44:01Z")
Hi friends, new to ES and need some help from y'all. How can I handle out of order updates? Some context: We're building a custom monitoring system and planning to send events to ES via Kafka. Producers \> Kafka \> Consume… --- ## [ES 7.17 | Exponentially growing query cache](https://discuss.elastic.co/t/es-7-17-exponentially-growing-query-cache/298784)
**Author:** [@shweta.c](https://discuss.elastic.co/u/shweta.c)\ **Replies:** 0\ **Last updated:** [March 3, 2022, 7:29pm UTC](https://discuss.elastic.co/t/es-7-17-exponentially-growing-query-cache/298784 "2022-03-03T19:29:42Z")
We recently migrated our Elastic cluster from version 7.7.1 to 7.17.0, and have been noticing that the query cache keeps growing exponentially if indexing is running on the nodes simultaneously with reasonably high searc… --- ## [LS 7.16.3 OutOfMemory jruby.RubyHash WatchedFilesCollection](https://discuss.elastic.co/t/ls-7-16-3-outofmemory-jruby-rubyhash-watchedfilescollection/298629)
**Author:** [@ld\_pvl](https://discuss.elastic.co/u/ld_pvl)\ **Replies:** 10\ **Last updated:** [March 3, 2022, 7:14pm UTC](https://discuss.elastic.co/t/ls-7-16-3-outofmemory-jruby-rubyhash-watchedfilescollection/298629 "2022-03-03T19:14:43Z")
My Logstash instances recently have started running OutOfMemory and need some help in identifying the cause. My logstash.conf has not been changed for a long time but I did do a few Logstash version upgrades in the past… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=687) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=689)