# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1005 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1006 --- ## [Configure Let's Encrypt with Nginx to act as Reverse Proxy for Logstash](https://discuss.elastic.co/t/configure-lets-encrypt-with-nginx-to-act-as-reverse-proxy-for-logstash/300277)
**Author:** [@scottfred](https://discuss.elastic.co/u/scottfred)\ **Replies:** 0\ **Last updated:** [March 22, 2022, 6:51am UTC](https://discuss.elastic.co/t/configure-lets-encrypt-with-nginx-to-act-as-reverse-proxy-for-logstash/300277 "2022-03-22T06:51:55Z")
I have Logstash running in a Docker container in a private subnet on AWS. We are able to use Logstash's HTTP Plugin to read and process Multi-line ASCII data before sending it on to Elasticsearch for storage. All of th… --- ## [Partial field value matching post Winlogbeat upgrade to 8.1](https://discuss.elastic.co/t/partial-field-value-matching-post-winlogbeat-upgrade-to-8-1/300222)
**Author:** [@Psyhil](https://discuss.elastic.co/u/Psyhil)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 1:24pm UTC](https://discuss.elastic.co/t/partial-field-value-matching-post-winlogbeat-upgrade-to-8-1/300222 "2022-03-22T13:24:07Z")
Hi All, We are using elk 7.17.1 with winlogbeat version 7.8 version with ECS version 1.5. While testing out winlogbeat 8.1.0 with ECS version 8.0.0, now my lucene queries are now doing partial matches. A simple exampl… --- ## [Index filled EC2 completely, manually deleted nodes, no longer able to start Elasticsearch](https://discuss.elastic.co/t/index-filled-ec2-completely-manually-deleted-nodes-no-longer-able-to-start-elasticsearch/300221)
**Author:** [@pritster5](https://discuss.elastic.co/u/pritster5)\ **Replies:** 7\ **Last updated:** [March 22, 2022, 2:18pm UTC](https://discuss.elastic.co/t/index-filled-ec2-completely-manually-deleted-nodes-no-longer-able-to-start-elasticsearch/300221 "2022-03-22T14:18:02Z")
I recently had an issue where I was ingesting data from S3 via Logstash and the S3 Input Plugin (aka the pipeline feature) into my AWS EC2 instance running ELK 7.5.2. Overnight, the index filled up my entire EC2 storage… --- ## [Model used in anomaly detection](https://discuss.elastic.co/t/model-used-in-anomaly-detection/300264)
**Author:** [@zanattabruno](https://discuss.elastic.co/u/zanattabruno)\ **Replies:** 2\ **Last updated:** [March 22, 2022, 2:00pm UTC](https://discuss.elastic.co/t/model-used-in-anomaly-detection/300264 "2022-03-22T14:00:46Z")
Guys, can you let me know when I use the following options to enable anomaly detection in Elasticsearch. Analytics\>Machine Learning\>Anomaly Detection\>Create job\> Categorization Which algorithm/model would the implement… --- ## [Cummulative date sum in Kibana Console](https://discuss.elastic.co/t/cummulative-date-sum-in-kibana-console/300315)
**Author:** [@The-morpho](https://discuss.elastic.co/u/The-morpho)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 2:04pm UTC](https://discuss.elastic.co/t/cummulative-date-sum-in-kibana-console/300315 "2022-03-22T14:04:49Z")
I'm working with a log file,I have a field for timestamp ==\> "timestamp":"2021-12-15T16:06:27.269303Z". I want to perform a cummulative sum on this field in all the document. I have done this aggregation, but the resul… --- ## [Plugin unable to find classes in ES 7.12 and newer](https://discuss.elastic.co/t/plugin-unable-to-find-classes-in-es-7-12-and-newer/299890)
**Author:** [@brian8371](https://discuss.elastic.co/u/brian8371)\ **Replies:** 2\ **Last updated:** [March 22, 2022, 1:41pm UTC](https://discuss.elastic.co/t/plugin-unable-to-find-classes-in-es-7-12-and-newer/299890 "2022-03-22T13:41:31Z")
I'm new to ES plugin development and I'm trying to change an ES plugin that worked with ES v7.3.0 to work with ES v7.13.4 or newer, but it seems like both index.query.QueryShardContext and index.search.MatchQuery were re… --- ## [Send GeoPoint data to elastic Search using client.index method](https://discuss.elastic.co/t/send-geopoint-data-to-elastic-search-using-client-index-method/300345)
**Author:** [@Vishnu\_Agarwal](https://discuss.elastic.co/u/Vishnu_Agarwal)\ **Replies:** 0\ **Last updated:** [March 22, 2022, 1:25pm UTC](https://discuss.elastic.co/t/send-geopoint-data-to-elastic-search-using-client-index-method/300345 "2022-03-22T13:25:56Z")
I am trying to send geolocation as location:{"lat": 19.07, "lon": 72.87} , and i have mapped location as geo\_point in index. I am getting following error. reason: "can't merge a non object mapping \[myloc\] with an objec… --- ## [Logstatsh Conditional Filter is not working](https://discuss.elastic.co/t/logstatsh-conditional-filter-is-not-working/300248)
**Author:** [@John\_snow](https://discuss.elastic.co/u/John_snow)\ **Replies:** 2\ **Last updated:** [March 22, 2022, 1:23pm UTC](https://discuss.elastic.co/t/logstatsh-conditional-filter-is-not-working/300248 "2022-03-22T13:23:47Z")
I'm trying to apply condional filtering in logstash but it is not working. My log looks like "record": { "field1": "abc", "field2": "/value" } Filter Condition if \[re… --- ## [LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :message=\>"Got response code '401'](https://discuss.elastic.co/t/logstash-badresponsecodeerror-message-got-response-code-401/299780)
**Author:** [@Diego\_T](https://discuss.elastic.co/u/Diego_T)\ **Replies:** 2\ **Last updated:** [March 22, 2022, 1:20pm UTC](https://discuss.elastic.co/t/logstash-badresponsecodeerror-message-got-response-code-401/299780 "2022-03-22T13:20:15Z")
when I run logstash on my local windows pointing to my remote elastic account I get the following error Using LS\_JAVA\_HOME defined java: C:\\Program Files\\Java\\jdk-17.0.2 WARNING: Using LS\_JAVA\_HOME while Logstash distri… --- ## [Config pipeline logstash with module cisco](https://discuss.elastic.co/t/config-pipeline-logstash-with-module-cisco/300044)
**Author:** [@jojodd](https://discuss.elastic.co/u/jojodd)\ **Replies:** 6\ **Last updated:** [March 22, 2022, 1:08pm UTC](https://discuss.elastic.co/t/config-pipeline-logstash-with-module-cisco/300044 "2022-03-22T13:08:53Z")
Hello, I would like to know if it is possible to use at the same time cisco-asa and cisco-ios in a single pipeline? Is there a method to create several indexes with one for cisco-ios and the other for cisco-asa? --- ## [Environment variable from secrets empty in pipeline](https://discuss.elastic.co/t/environment-variable-from-secrets-empty-in-pipeline/300340)
**Author:** [@pfennema](https://discuss.elastic.co/u/pfennema)\ **Replies:** 0\ **Last updated:** [March 22, 2022, 1:07pm UTC](https://discuss.elastic.co/t/environment-variable-from-secrets-empty-in-pipeline/300340 "2022-03-22T13:07:05Z")
Hi All, I'm trying to use an environment variable in one of my pipeline configs which is defined in a secrets file in kubernetes. When I login into the container and do an 'env' commend, the environment variable is def… --- ## [Unable to see ESquery while creating Rules and Connectors](https://discuss.elastic.co/t/unable-to-see-esquery-while-creating-rules-and-connectors/300195)
**Author:** [@Ankur\_Jain1](https://discuss.elastic.co/u/Ankur_Jain1)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 12:54pm UTC](https://discuss.elastic.co/t/unable-to-see-esquery-while-creating-rules-and-connectors/300195 "2022-03-22T12:54:30Z")
Hello, I have created a user in Kibana with some limited permissions. When I am trying to create Rules using that user I cannot see ESquery option. This option is available for superuser account. The user role have fol… --- ## [Query a specific IP address in Elastic](https://discuss.elastic.co/t/query-a-specific-ip-address-in-elastic/300318)
**Author:** [@ianrobo](https://discuss.elastic.co/u/ianrobo)\ **Replies:** 2\ **Last updated:** [March 22, 2022, 12:34pm UTC](https://discuss.elastic.co/t/query-a-specific-ip-address-in-elastic/300318 "2022-03-22T12:34:26Z")
Hi there, I am relatively new to elastic and expanding our ES daily. We are ingesting logs from various network devices but come across a problem in Cisco. They do not send the hostname in their syslog and therefore al… --- ## [Elasticsearch 7.16 installing error](https://discuss.elastic.co/t/elasticsearch-7-16-installing-error/300209)
**Author:** [@Kailas](https://discuss.elastic.co/u/Kailas)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 12:26pm UTC](https://discuss.elastic.co/t/elasticsearch-7-16-installing-error/300209 "2022-03-22T12:26:31Z")
Hi, I am trying to install Elasticsarch 7.16.1 on 3 nodes by following Install Elasticsearch from archive on Linux or MacOS | Elasticsearch Guide \[7.16\] | Elastic . The ES installation needs to be done on Linux. Howeve… --- ## [Rename fields names with logstash](https://discuss.elastic.co/t/rename-fields-names-with-logstash/300321)
**Author:** [@Paf](https://discuss.elastic.co/u/Paf)\ **Replies:** 2\ **Last updated:** [March 22, 2022, 11:53am UTC](https://discuss.elastic.co/t/rename-fields-names-with-logstash/300321 "2022-03-22T11:53:54Z")
Hello, I want to rename the field name "identity.claims.http://schemas.microsoft.com/claims/authnclassreference" to "identity\_claims\_authnclassreference". For this, i use mutate filter with rename as follwing: filter… --- ## [Auto-configuration of ssl certificate](https://discuss.elastic.co/t/auto-configuration-of-ssl-certificate/300306)
**Author:** [@itsecworks](https://discuss.elastic.co/u/itsecworks)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 10:05am UTC](https://discuss.elastic.co/t/auto-configuration-of-ssl-certificate/300306 "2022-03-22T10:05:30Z")
I dont find the CA private key of the transport layer that has been generated by Elasticsearch at first start. I can find the CA private key of the http layer its in the generated http.p12 file, I would expect the simil… --- ## [Logstash working from cli, but not whilst running as a service](https://discuss.elastic.co/t/logstash-working-from-cli-but-not-whilst-running-as-a-service/300309)
**Author:** [@conor\_c](https://discuss.elastic.co/u/conor_c)\ **Replies:** 0\ **Last updated:** [March 22, 2022, 10:02am UTC](https://discuss.elastic.co/t/logstash-working-from-cli-but-not-whilst-running-as-a-service/300309 "2022-03-22T10:02:45Z")
Hi, I'm running Logstash and Filebeat with what I believe to be simple configurations. I have two syslog listeners, one on UDP 9001 and one on UDP 9002. When running Logstash as a service and when sending logs to 9001,… --- ## [Huge indexing (refresh) performance drop when upgrading from ES 2.4 to ES 7.16](https://discuss.elastic.co/t/huge-indexing-refresh-performance-drop-when-upgrading-from-es-2-4-to-es-7-16/299479)
**Author:** [@daniel-kr](https://discuss.elastic.co/u/daniel-kr)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 9:31am UTC](https://discuss.elastic.co/t/huge-indexing-refresh-performance-drop-when-upgrading-from-es-2-4-to-es-7-16/299479 "2022-03-22T09:31:25Z")
Hello, we updated our system from ES 2.4 to ES 7.16 some time ago. Now we recognized that there is a huge indexing performance drop when it comes to a very special use case that we have. The use case is as follows: We … --- ## [Logstash to process multiple files of large size?](https://discuss.elastic.co/t/logstash-to-process-multiple-files-of-large-size/300299)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 0\ **Last updated:** [March 22, 2022, 8:43am UTC](https://discuss.elastic.co/t/logstash-to-process-multiple-files-of-large-size/300299 "2022-03-22T08:43:14Z")
Hello, To give a little bit of context, i have 3 VMs , each of 16 CPU cores out of which 2 are of 16GB RAM (they host Elasticsearch and kibana + a flask app, that provides a front end for the user to input the machineip… --- ## [Getting error : jdk-17.0.2 was unexpected at this time](https://discuss.elastic.co/t/getting-error-jdk-17-0-2-was-unexpected-at-this-time/300300)
**Author:** [@yahire](https://discuss.elastic.co/u/yahire)\ **Replies:** 0\ **Last updated:** [March 22, 2022, 8:45am UTC](https://discuss.elastic.co/t/getting-error-jdk-17-0-2-was-unexpected-at-this-time/300300 "2022-03-22T08:45:30Z")
While starting Elasticsearch.bat in my windows system, i am getting following error : D:\\Elastic APM\\Elasticsearch-8.1.0\\Elasticsearch-8.1.0\\bin\>Elasticsearch.bat \\jdk-17.0.2 was unexpected at this time. I am having J… --- ## [Visualization of requirement fulfillment during release tests](https://discuss.elastic.co/t/visualization-of-requirement-fulfillment-during-release-tests/300296)
**Author:** [@nikaes](https://discuss.elastic.co/u/nikaes)\ **Replies:** 0\ **Last updated:** [March 22, 2022, 8:26am UTC](https://discuss.elastic.co/t/visualization-of-requirement-fulfillment-during-release-tests/300296 "2022-03-22T08:26:58Z")
Hi All, I am quite new to Kibana and having some trouble in visualization of a use case. I would like to show a percentage how much of a Requirement is currently covered by tests. Simply I am feeding Elastic with fol… --- ## [Help: Only winlogbeat index with date being created](https://discuss.elastic.co/t/help-only-winlogbeat-index-with-date-being-created/300284)
**Author:** [@roman-tasi](https://discuss.elastic.co/u/roman-tasi)\ **Replies:** 2\ **Last updated:** [March 22, 2022, 8:17am UTC](https://discuss.elastic.co/t/help-only-winlogbeat-index-with-date-being-created/300284 "2022-03-22T08:17:26Z")
This is my current output: output { if \[type\]=="syslog" { elasticsearch { hosts =\> \["localhost:9200"\] index =\> "logstash-%{+yyyy.MM.dd}" } … --- ## [Data extraction, Watcher - CSV export with relative time period](https://discuss.elastic.co/t/data-extraction-watcher-csv-export-with-relative-time-period/300287)
**Author:** [@AQ\_Amra](https://discuss.elastic.co/u/AQ_Amra)\ **Replies:** 0\ **Last updated:** [March 22, 2022, 7:54am UTC](https://discuss.elastic.co/t/data-extraction-watcher-csv-export-with-relative-time-period/300287 "2022-03-22T07:54:42Z")
Hi, I am attempting to extract a CSV of data from ES/Kibana every hour. I've configured a watcher task which runs hourly, and emails a CSV file (based on the discover POST URL form here Automatically generate reports |… --- ## [It was found that users could not generate a report CSV or download logs from the dashboard](https://discuss.elastic.co/t/it-was-found-that-users-could-not-generate-a-report-csv-or-download-logs-from-the-dashboard/298174)
**Author:** [@Bhanuji\_paluri](https://discuss.elastic.co/u/Bhanuji_paluri)\ **Replies:** 2\ **Last updated:** [March 22, 2022, 7:53am UTC](https://discuss.elastic.co/t/it-was-found-that-users-could-not-generate-a-report-csv-or-download-logs-from-the-dashboard/298174 "2022-03-22T07:53:25Z")
HI Team, It was found that users could not generate a report CSV or download logs from the dashboard, teps to Reproduce Search for logs in Kibana Discover dashboard Attempt to download those logs: Click 'Save' to s… --- ## [Kibana start fail with the error \[ERROR\]\[savedobjects-service\] \[.kibana\_task\_manager\] Action failed with 'security\_exception](https://discuss.elastic.co/t/kibana-start-fail-with-the-error-error-savedobjects-service-kibana-task-manager-action-failed-with-security-exception/300286)
**Author:** [@jack\_jack](https://discuss.elastic.co/u/jack_jack)\ **Replies:** 0\ **Last updated:** [March 22, 2022, 7:48am UTC](https://discuss.elastic.co/t/kibana-start-fail-with-the-error-error-savedobjects-service-kibana-task-manager-action-failed-with-security-exception/300286 "2022-03-22T07:48:09Z")
when i start kibana ,i get the error \[2022-03-22T07:38:57.371+00:00\]\[INFO \]\[savedobjects-service\] \[.kibana\] UPDATE\_TARGET\_MAPPINGS -\> UPDATE\_TARGET\_MAPPINGS. took: 32015ms. \[2022-03-22T07:38:57.372+00:00\]\[ERROR\]\[savedob… --- ## [Load balanced access to fleet servers](https://discuss.elastic.co/t/load-balanced-access-to-fleet-servers/300210)
**Author:** [@fuphil](https://discuss.elastic.co/u/fuphil)\ **Replies:** 2\ **Last updated:** [March 22, 2022, 7:10am UTC](https://discuss.elastic.co/t/load-balanced-access-to-fleet-servers/300210 "2022-03-22T07:10:41Z")
Hi, I have setup 2 fleet servers successfully and want all additional elastic agents to connect to them via loadbalanced IP (haproxy with "round robin" option). Whenever I configure the loadbalanced URL instead of the … --- ## [Logstash count events using ruby filter](https://discuss.elastic.co/t/logstash-count-events-using-ruby-filter/300256)
**Author:** [@gnam](https://discuss.elastic.co/u/gnam)\ **Replies:** 4\ **Last updated:** [March 22, 2022, 4:56am UTC](https://discuss.elastic.co/t/logstash-count-events-using-ruby-filter/300256 "2022-03-22T04:56:58Z")
I have following pipeline (example, not full pipeline) where I need count the number of events for EVERY file I am writing as output. For example, this pipleline creates new file every 30 seconds with the events processe… --- ## [Can't sum bucket after composite](https://discuss.elastic.co/t/cant-sum-bucket-after-composite/300184)
**Author:** [@Techinp](https://discuss.elastic.co/u/Techinp)\ **Replies:** 4\ **Last updated:** [March 22, 2022, 3:21am UTC](https://discuss.elastic.co/t/cant-sum-bucket-after-composite/300184 "2022-03-22T03:21:30Z")
Hi all, How can I sum data after composite stage? What did I do wrong? This is my query GET report-20220316/\_search { "query": { "bool": { "must": \[ { "match": { "parentId.ke… --- ## [How to Identify the Container Name When Collecting Container Logs?](https://discuss.elastic.co/t/how-to-identify-the-container-name-when-collecting-container-logs/300260)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 2:46am UTC](https://discuss.elastic.co/t/how-to-identify-the-container-name-when-collecting-container-logs/300260 "2022-03-22T02:46:32Z")
Currently I use filebeat 7.16.3 and it runs on a kubernetes 1.20 cluster (docker runtime). I use the following configuration to collect container logs, but I found that FB does not recognize the container name correspond… --- ## [ElasticSearch Nest syntax for Script based sorting with SortDescriptor](https://discuss.elastic.co/t/elasticsearch-nest-syntax-for-script-based-sorting-with-sortdescriptor/300255)
**Author:** [@aashini](https://discuss.elastic.co/u/aashini)\ **Replies:** 0\ **Last updated:** [March 21, 2022, 11:55pm UTC](https://discuss.elastic.co/t/elasticsearch-nest-syntax-for-script-based-sorting-with-sortdescriptor/300255 "2022-03-21T23:55:05Z")
I am using Elasticsearch Nest client in .Net application and looking for a syntax to use script based sorting with Sort Descriptor. So what would be the sorting syntax to add Params and painless Language with SortDescri… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1004) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1006)