# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1001

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1002

---

## [Unable to import saved objects from Kibana 7.8.0 to 8.1.0](https://discuss.elastic.co/t/unable-to-import-saved-objects-from-kibana-7-8-0-to-8-1-0/300205)

<div class="topic-metadata">

**Author:** [@nandatibco](https://discuss.elastic.co/u/nandatibco)\
**Replies:** 1\
**Last updated:** [March 24, 2022, 9:07pm UTC](https://discuss.elastic.co/t/unable-to-import-saved-objects-from-kibana-7-8-0-to-8-1-0/300205 "2022-03-24T21:07:54Z")

</div>

Hello team, I'm unable to import saved objects (test.ndjson)from Kibana- 7.8.0 to Kibana-8.1.0, getting below error: Sorry, there was an error The file could not be processed due to error: "Internal Server Error" No …

---

## [Kibana status shows yellow because plugins are degraded after upgrading from 7.9 to 7.16.3](https://discuss.elastic.co/t/kibana-status-shows-yellow-because-plugins-are-degraded-after-upgrading-from-7-9-to-7-16-3/300361)

<div class="topic-metadata">

**Author:** [@Bhavb08](https://discuss.elastic.co/u/Bhavb08)\
**Replies:** 2\
**Last updated:** [March 24, 2022, 9:14pm UTC](https://discuss.elastic.co/t/kibana-status-shows-yellow-because-plugins-are-degraded-after-upgrading-from-7-9-to-7-16-3/300361 "2022-03-24T21:14:03Z")

</div>

Hi. I have been looking for answers in various forums for this. I looked into individual plugins dependencies and looks like alerting plugin might be the cause for all this. But I am unable find a solution. There wa…

---

## [How to implement pagination with large dataset](https://discuss.elastic.co/t/how-to-implement-pagination-with-large-dataset/300550)

<div class="topic-metadata">

**Author:** [@achobanov](https://discuss.elastic.co/u/achobanov)\
**Replies:** 4\
**Last updated:** [March 24, 2022, 9:03pm UTC](https://discuss.elastic.co/t/how-to-implement-pagination-with-large-dataset/300550 "2022-03-24T21:03:08Z")

</div>

Environment .Net 5 Elasticsearch.Net.Aws 7.1.0 : NuGet Gallery | Elasticsearch.Net.Aws 7.2.2 Low level client Problem Even with pagination, Elasticsearch's query API does not support more than 10\_000 records by defaul…

---

## [Retrieve all documents with a field value that is included a previous query's field values](https://discuss.elastic.co/t/retrieve-all-documents-with-a-field-value-that-is-included-a-previous-querys-field-values/300639)

<div class="topic-metadata">

**Author:** [@megancooper](https://discuss.elastic.co/u/megancooper)\
**Replies:** 0\
**Last updated:** [March 24, 2022, 8:53pm UTC](https://discuss.elastic.co/t/retrieve-all-documents-with-a-field-value-that-is-included-a-previous-querys-field-values/300639 "2022-03-24T20:53:15Z")

</div>

I have a unique query use case that I can't seem to find covered in the documentation. (I'm using ElasticSearch 7.17) I have documents inside an index that are shaped the following way: { parentName: string childre…

---

## [Elasticsearch Cluster - no node visible](https://discuss.elastic.co/t/elasticsearch-cluster-no-node-visible/300338)

<div class="topic-metadata">

**Author:** [@zicherka](https://discuss.elastic.co/u/zicherka)\
**Replies:** 1\
**Last updated:** [March 24, 2022, 8:27pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-no-node-visible/300338 "2022-03-24T20:27:58Z")

</div>

Hi System: CentOS 8 Stream Elasticsearch ver: 8.1.0 Nodes: node1.test.com 192.168.100.101 node2.test.com 192.168.100.102 node3.test.com 192.168.100.103 All nodes can be pinged by IP and FQDN, Firewalld has open port…

---

## [Mapped\_geo\_shape test error but I don't use any geo code v7.16.3](https://discuss.elastic.co/t/mapped-geo-shape-test-error-but-i-dont-use-any-geo-code-v7-16-3/300634)

<div class="topic-metadata">

**Author:** [@brian8371](https://discuss.elastic.co/u/brian8371)\
**Replies:** 0\
**Last updated:** [March 24, 2022, 8:05pm UTC](https://discuss.elastic.co/t/mapped-geo-shape-test-error-but-i-dont-use-any-geo-code-v7-16-3/300634 "2022-03-24T20:05:58Z")

</div>

I have a class that extends AbstractQueryTestCase and all of its tests are failing, included ones that I didn't override, with the same stacktrace error: Failed to parse mapping \[\_doc\]: No handler for type \[geo\_shape\] d…

---

## [Incorrect HTTP method for uri \[/\<filebeat-7.16.0-{now/d}-000001\>\] and method \[PUT\], allowed: \[POST\]](https://discuss.elastic.co/t/incorrect-http-method-for-uri-filebeat-7-16-0-now-d-000001-and-method-put-allowed-post/300629)

<div class="topic-metadata">

**Author:** [@claudioemmanuel](https://discuss.elastic.co/u/claudioemmanuel)\
**Replies:** 0\
**Last updated:** [March 24, 2022, 7:41pm UTC](https://discuss.elastic.co/t/incorrect-http-method-for-uri-filebeat-7-16-0-now-d-000001-and-method-put-allowed-post/300629 "2022-03-24T19:41:08Z")

</div>

I'm running on nginx in my docker container, I installed filebeat and configured it so that the nginx access and error logs are sent directly to my elastic/kibana but the logs are not appearing or being sent. Running a …

---

## [Logstash xml parse error](https://discuss.elastic.co/t/logstash-xml-parse-error/300624)

<div class="topic-metadata">

**Author:** [@elwdipath](https://discuss.elastic.co/u/elwdipath)\
**Replies:** 0\
**Last updated:** [March 24, 2022, 7:14pm UTC](https://discuss.elastic.co/t/logstash-xml-parse-error/300624 "2022-03-24T19:14:35Z")

</div>

Hey all, new to logstash. I'm running into an error when trying to parse an empty xml element. failed to parse field \[xml.record.person.agedata.dob\] of type \[text\] in document with id 'DA9jvH8BhCQVGJZR4sKN'. Preview of…

---

## [Cluster Red after system patching forced upgrade 7.16.1 -\> 7.17.1](https://discuss.elastic.co/t/cluster-red-after-system-patching-forced-upgrade-7-16-1-7-17-1/300592)

<div class="topic-metadata">

**Author:** [@thealy](https://discuss.elastic.co/u/thealy)\
**Replies:** 1\
**Last updated:** [March 24, 2022, 7:00pm UTC](https://discuss.elastic.co/t/cluster-red-after-system-patching-forced-upgrade-7-16-1-7-17-1/300592 "2022-03-24T19:00:59Z")

</div>

We have and 8 node cluster where the nodes are all running Centos 7. When they were rebooted for patching, the ES version went to 7.17.1. The master node is periodically scrolling these errors: \[2022-03-24T10:59:50,530…

---

## [Elasticsearch Querying Double Nested Object, Match Multiple Rows in Query Within Parent](https://discuss.elastic.co/t/elasticsearch-querying-double-nested-object-match-multiple-rows-in-query-within-parent/300619)

<div class="topic-metadata">

**Author:** [@CoreyFournier](https://discuss.elastic.co/u/CoreyFournier)\
**Replies:** 0\
**Last updated:** [March 24, 2022, 6:30pm UTC](https://discuss.elastic.co/t/elasticsearch-querying-double-nested-object-match-multiple-rows-in-query-within-parent/300619 "2022-03-24T18:30:26Z")

</div>

My data model is related to patient records. At the highest level is the Patient, then their information such as Lab Panels and the individual rows of the results of the panel. So it looks like this: {Patient:{Labs:\[{Res…

---

## [Filter load monitoring](https://discuss.elastic.co/t/filter-load-monitoring/300461)

<div class="topic-metadata">

**Author:** [@Dargod](https://discuss.elastic.co/u/Dargod)\
**Replies:** 2\
**Last updated:** [March 24, 2022, 5:55pm UTC](https://discuss.elastic.co/t/filter-load-monitoring/300461 "2022-03-24T17:55:53Z")

</div>

I have a lot of filters in logstash that deal with the processing of plain text logs and json. With the linear growth of connected logs, the load increased and there was an increase in the queue. In this connection, th…

---

## [Multiple Filebeat logs path configuration stops the filebeat](https://discuss.elastic.co/t/multiple-filebeat-logs-path-configuration-stops-the-filebeat/300471)

<div class="topic-metadata">

**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\
**Replies:** 3\
**Last updated:** [March 24, 2022, 5:54pm UTC](https://discuss.elastic.co/t/multiple-filebeat-logs-path-configuration-stops-the-filebeat/300471 "2022-03-24T17:54:51Z")

</div>

Hello All, 1)After I'm configuring multiple filebeat path in filebeat.yml,filebeat gets stopped with below error: Exiting: data path already locked by another beat. Please make sure that multiple beats are not sharing …

---

## [Problem using input snmp](https://discuss.elastic.co/t/problem-using-input-snmp/300611)

<div class="topic-metadata">

**Author:** [@Ygal\_Mizrachi](https://discuss.elastic.co/u/Ygal_Mizrachi)\
**Replies:** 0\
**Last updated:** [March 24, 2022, 5:16pm UTC](https://discuss.elastic.co/t/problem-using-input-snmp/300611 "2022-03-24T17:16:19Z")

</div>

Hello im using this ultra simple conf file: input { snmp { hosts =\> \[{host =\> "udp:192.168.24.1/161" community =\> "public" version =\> "2c" retries =\> 2 timeout =\> 1000}\] tables =\> \[ {"name" =\> "interfaces" "columns" =\> …

---

## [Stack-monitoring](https://discuss.elastic.co/t/stack-monitoring/300384)

<div class="topic-metadata">

**Author:** [@aviad.co1](https://discuss.elastic.co/u/aviad.co1)\
**Replies:** 4\
**Last updated:** [March 24, 2022, 5:09pm UTC](https://discuss.elastic.co/t/stack-monitoring/300384 "2022-03-24T17:09:47Z")

</div>

Hi, I try to config remote monitoring to my production elk cluster... so I first install metricbeat and then config to ouput to remote monitoring Elasticsearch. I use module Elasticsearch-xpack and kibana-xpack.. I can …

---

## [COMBINEDAPACHELOG grok definition not creating the expected fields](https://discuss.elastic.co/t/combinedapachelog-grok-definition-not-creating-the-expected-fields/300576)

<div class="topic-metadata">

**Author:** [@Patrick\_Lepage](https://discuss.elastic.co/u/Patrick_Lepage)\
**Replies:** 2\
**Last updated:** [March 24, 2022, 5:04pm UTC](https://discuss.elastic.co/t/combinedapachelog-grok-definition-not-creating-the-expected-fields/300576 "2022-03-24T17:04:46Z")

</div>

Complete beginner to logstash here... I'm following the "Parsing Logs with Logstash" tutorial. Input comes from filebeat reading a static log file provided with the tutorial; see example of a sample line below. 83.149.…

---

## [Using scroll API in Kibana](https://discuss.elastic.co/t/using-scroll-api-in-kibana/300558)

<div class="topic-metadata">

**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\
**Replies:** 1\
**Last updated:** [March 24, 2022, 5:01pm UTC](https://discuss.elastic.co/t/using-scroll-api-in-kibana/300558 "2022-03-24T17:01:50Z")

</div>

We can get the large hits of document search and retrieval using scroll API in Elasticsearch. Anyway we can use scroll API in kibana dashboards for downloading reports?

---

## [Strange bad certificate](https://discuss.elastic.co/t/strange-bad-certificate/300552)

<div class="topic-metadata">

**Author:** [@labate](https://discuss.elastic.co/u/labate)\
**Replies:** 13\
**Last updated:** [March 24, 2022, 4:55pm UTC](https://discuss.elastic.co/t/strange-bad-certificate/300552 "2022-03-24T16:55:01Z")

</div>

Dear all, I'm facing to a serious problem. I get this following message: filebeat\[29206\]: 2022-03-24T10:30:37.927+0100 ERROR \[publisher\_pipeline\_output\] pipeline/output.go:154 Failed to conn…

---

## [Drill Down Dashboard with context.panel.filters](https://discuss.elastic.co/t/drill-down-dashboard-with-context-panel-filters/300589)

<div class="topic-metadata">

**Author:** [@rajeev2](https://discuss.elastic.co/u/rajeev2)\
**Replies:** 1\
**Last updated:** [March 24, 2022, 4:54pm UTC](https://discuss.elastic.co/t/drill-down-dashboard-with-context-panel-filters/300589 "2022-03-24T16:54:25Z")

</div>

I wanted to drill down to dashboard using url but i am unable to use context.panel.filter

---

## [Xml Parsing in logstash using xml & split plugins](https://discuss.elastic.co/t/xml-parsing-in-logstash-using-xml-split-plugins/300515)

<div class="topic-metadata">

**Author:** [@manikandanid](https://discuss.elastic.co/u/manikandanid)\
**Replies:** 1\
**Last updated:** [March 24, 2022, 4:47pm UTC](https://discuss.elastic.co/t/xml-parsing-in-logstash-using-xml-split-plugins/300515 "2022-03-24T16:47:59Z")

</div>

I have a xml which looks like \<Countries\>\<Country\>\<Name\>India\</Name\>\<ISDCode\>+91\</ISDCode\>\<Continent\>Asia\</Continent\>\<geolocationinfo\>\<lattitude\>123129\</lattitude\>\<longititude\>7890890\</longititude\>\</geolocationinfo\>\</Co…

---

## [The login page does not open](https://discuss.elastic.co/t/the-login-page-does-not-open/299141)

<div class="topic-metadata">

**Author:** [@Aynur](https://discuss.elastic.co/u/Aynur)\
**Replies:** 1\
**Last updated:** [March 24, 2022, 4:44pm UTC](https://discuss.elastic.co/t/the-login-page-does-not-open/299141 "2022-03-24T16:44:49Z")

</div>

Version 7.16.3. After updating from version 7.16.2, the login window does not open - it freezes on loading. Errors occur in the browser developer console: login:282 Refused to execute inline script because it violates …

---

## [Issue with activemq module in metricbeat](https://discuss.elastic.co/t/issue-with-activemq-module-in-metricbeat/300499)

<div class="topic-metadata">

**Author:** [@christopherjhachey](https://discuss.elastic.co/u/christopherjhachey)\
**Replies:** 2\
**Last updated:** [March 24, 2022, 4:35pm UTC](https://discuss.elastic.co/t/issue-with-activemq-module-in-metricbeat/300499 "2022-03-24T16:35:00Z")

</div>

Getting the following error trying to use activemq module in metricbeat framework. Exiting: 3 errors: metricset 'activemq/broker' not found; metricset 'activemq/queue' not found; metricset 'activemq/topic' not found I'…

---

## [What are the limitations of array size at document in elastic search?](https://discuss.elastic.co/t/what-are-the-limitations-of-array-size-at-document-in-elastic-search/300602)

<div class="topic-metadata">

**Author:** [@AhmadHamouda](https://discuss.elastic.co/u/AhmadHamouda)\
**Replies:** 0\
**Last updated:** [March 24, 2022, 4:02pm UTC](https://discuss.elastic.co/t/what-are-the-limitations-of-array-size-at-document-in-elastic-search/300602 "2022-03-24T16:02:17Z")

</div>

I have document which have array. { "id" :1, "UserIds":\[1,2,4\] } Given that UserIds is indexed field What are the performance implications of having several elements on UserIds Array on search? Also why when se…

---

## [End to end Testing](https://discuss.elastic.co/t/end-to-end-testing/300598)

<div class="topic-metadata">

**Author:** [@AliBaba](https://discuss.elastic.co/u/AliBaba)\
**Replies:** 0\
**Last updated:** [March 24, 2022, 3:28pm UTC](https://discuss.elastic.co/t/end-to-end-testing/300598 "2022-03-24T15:28:10Z")

</div>

Hi, A quick question relating the end to end testing using Nest in c#. I was able to setup an InMemoryConnection for Elasticsearch and be able to get a mock response when I do the search query. The problem is when I ru…

---

## [Log .NET Runtime source is not recovering](https://discuss.elastic.co/t/log-net-runtime-source-is-not-recovering/300463)

<div class="topic-metadata">

**Author:** [@lsbitri88](https://discuss.elastic.co/u/lsbitri88)\
**Replies:** 2\
**Last updated:** [March 24, 2022, 3:26pm UTC](https://discuss.elastic.co/t/log-net-runtime-source-is-not-recovering/300463 "2022-03-24T15:26:10Z")

</div>

Hi, the winlogs from the .Net Runtime source with the message below are not recovered \<La description de l’ID d’événement 0 dans la source .NET Runtime est introuvable. Le composant qui a déclenché cet événement n’est …

---

## [ECS - Difference between event.id and event.code](https://discuss.elastic.co/t/ecs-difference-between-event-id-and-event-code/299924)

<div class="topic-metadata">

**Author:** [@Sako](https://discuss.elastic.co/u/Sako)\
**Replies:** 4\
**Last updated:** [March 24, 2022, 3:24pm UTC](https://discuss.elastic.co/t/ecs-difference-between-event-id-and-event-code/299924 "2022-03-24T15:24:35Z")

</div>

Hi, I have a question regarding the usage of the ECS fields event.id and event.code. What is the intended difference between these two fields? Is there any guidance on how to use them? The example for event.code refer…

---

## [How to understand translog stats](https://discuss.elastic.co/t/how-to-understand-translog-stats/300507)

<div class="topic-metadata">

**Author:** [@jthoni](https://discuss.elastic.co/u/jthoni)\
**Replies:** 2\
**Last updated:** [March 24, 2022, 3:12pm UTC](https://discuss.elastic.co/t/how-to-understand-translog-stats/300507 "2022-03-24T15:12:06Z")

</div>

We are seeing the situation where when we restart ES, there is a long recovery time for the shards. The service is down usually for only about 90 seconds, but the recovery can be an hour or so. During my investigation, I…

---

## [How to convert Date to specific format and string to amount conversion](https://discuss.elastic.co/t/how-to-convert-date-to-specific-format-and-string-to-amount-conversion/300591)

<div class="topic-metadata">

**Author:** [@slj](https://discuss.elastic.co/u/slj)\
**Replies:** 0\
**Last updated:** [March 24, 2022, 3:10pm UTC](https://discuss.elastic.co/t/how-to-convert-date-to-specific-format-and-string-to-amount-conversion/300591 "2022-03-24T15:10:46Z")

</div>

I am trying to create a aggregation query to filter data if 2 columns in same index is matching. My InputDate is '2022-03-02T03:33:34.000Z' format and exeDate in '2022-03-02'. if both dates are same then need to sum up t…

---

## [Unable to start filebeat getting Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: \[error connecting to Elasticsearch at http://localhost:5601: Failed to parse JSON response: invalid character '\<' l](https://discuss.elastic.co/t/unable-to-start-filebeat-getting-exiting-couldnt-connect-to-any-of-the-configured-elasticsearch-hosts-errors-error-connecting-to-elasticsearch-at-http-localhost-failed-to-parse-json-response-invalid-character-l/300412)

<div class="topic-metadata">

**Author:** [@sureshaws](https://discuss.elastic.co/u/sureshaws)\
**Replies:** 3\
**Last updated:** [March 24, 2022, 3:01pm UTC](https://discuss.elastic.co/t/unable-to-start-filebeat-getting-exiting-couldnt-connect-to-any-of-the-configured-elasticsearch-hosts-errors-error-connecting-to-elasticsearch-at-http-localhost-failed-to-parse-json-response-invalid-character-l/300412 "2022-03-24T15:01:14Z")

</div>

Getting the below error Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: \[error connecting to Elasticsearch at http://localhost:5601: Failed to parse JSON response: invalid character '\<' l …

---

## [Need Some Advice Regarding Data Ingestion](https://discuss.elastic.co/t/need-some-advice-regarding-data-ingestion/299859)

<div class="topic-metadata">

**Author:** [@tthiry](https://discuss.elastic.co/u/tthiry)\
**Replies:** 1\
**Last updated:** [March 24, 2022, 2:58pm UTC](https://discuss.elastic.co/t/need-some-advice-regarding-data-ingestion/299859 "2022-03-24T14:58:19Z")

</div>

Hello, I am ingesting Windows certificate data via winlogbeat and the "Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational" channel to I can track certificates that are expiring. I am using the "inc…

---

## [Filebeat 8.1 locks renamed rolling logs forever](https://discuss.elastic.co/t/filebeat-8-1-locks-renamed-rolling-logs-forever/300428)

<div class="topic-metadata">

**Author:** [@alytkowski](https://discuss.elastic.co/u/alytkowski)\
**Replies:** 1\
**Last updated:** [March 24, 2022, 2:58pm UTC](https://discuss.elastic.co/t/filebeat-8-1-locks-renamed-rolling-logs-forever/300428 "2022-03-24T14:58:11Z")

</div>

After switching from Filebeat 7.17 to Filebeat 8.1 and introducing type filestream into our configuration, it seems that Filebeat locks renamed logs forever, causing disk space issues. We have a log4j based logs that ro…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1000)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1002)