# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=101 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 102 --- ## [Why can't my logStash account password connect to ES?](https://discuss.elastic.co/t/why-cant-my-logstash-account-password-connect-to-es/373212)
**Author:** [@Jerry\_Williams](https://discuss.elastic.co/u/Jerry_Williams)\ **Replies:** 12\ **Last updated:** [February 14, 2025, 12:33am UTC](https://discuss.elastic.co/t/why-cant-my-logstash-account-password-connect-to-es/373212 "2025-02-14T00:33:04Z")
I cannot connect to my ES in my docker environment. My account and password are configured correctly, but LogStash still cannot be used! Curl Result: logstash@0ef097e0f:~$ curl -u elastic:7z\_xxxxxxx http://elasticsearc… --- ## [Howto config winlogbeat + logstash + elasticsearch?](https://discuss.elastic.co/t/howto-config-winlogbeat-logstash-elasticsearch/374393)
**Author:** [@Lynn\_Karllo](https://discuss.elastic.co/u/Lynn_Karllo)\ **Replies:** 13\ **Last updated:** [February 14, 2025, 12:26am UTC](https://discuss.elastic.co/t/howto-config-winlogbeat-logstash-elasticsearch/374393 "2025-02-14T00:26:10Z")
Config winlogbeat: winlogbeat.event\_logs: - name: Application ignore\_older: 72h - name: System - name: Security - name: Microsoft-Windows-Sysmon/Operational - name: Windows PowerShell event\_id: 400, 403… --- ## [Add nodes to a cluster ES 8.17.1; env RHEL 8.10](https://discuss.elastic.co/t/add-nodes-to-a-cluster-es-8-17-1-env-rhel-8-10/374529)
**Author:** [@latte123](https://discuss.elastic.co/u/latte123)\ **Replies:** 1\ **Last updated:** [February 14, 2025, 12:06am UTC](https://discuss.elastic.co/t/add-nodes-to-a-cluster-es-8-17-1-env-rhel-8-10/374529 "2025-02-14T00:06:15Z")
I built a cluster with two master nodes; two days later, the attempt to add another master node (all on different hosts) failed with error: ./elasticsearch-create-enrollment-token -s node Unable to create enrollment to… --- ## [Your settings are invalid. Reason: Setting "xpack.geoip.downloader.enabled" hasn't been registered](https://discuss.elastic.co/t/your-settings-are-invalid-reason-setting-xpack-geoip-downloader-enabled-hasnt-been-registered/374521)
**Author:** [@mikewillis](https://discuss.elastic.co/u/mikewillis)\ **Replies:** 2\ **Last updated:** [February 13, 2025, 10:47pm UTC](https://discuss.elastic.co/t/your-settings-are-invalid-reason-setting-xpack-geoip-downloader-enabled-hasnt-been-registered/374521 "2025-02-13T22:47:48Z")
says: If you work in air-gapped environment and want to disable the database auto-update feature, set the xpack.geoip.downloader.enabled value to false in logstash.yml. So I set that, and now Logstash won't start a… --- ## [Alert based on a condition](https://discuss.elastic.co/t/alert-based-on-a-condition/374525)
**Author:** [@wmulobole1](https://discuss.elastic.co/u/wmulobole1)\ **Replies:** 0\ **Last updated:** [February 13, 2025, 6:37pm UTC](https://discuss.elastic.co/t/alert-based-on-a-condition/374525 "2025-02-13T18:37:57Z")
Hello. I am trying to set up an alert on the Kibana UI. Its is an elasticsearch query alert where I am matching an error message string. However, I would like only documents with unique device IDS so I have an aggregati… --- ## [Aggregation over array](https://discuss.elastic.co/t/aggregation-over-array/374511)
**Author:** [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Replies:** 6\ **Last updated:** [February 13, 2025, 4:36pm UTC](https://discuss.elastic.co/t/aggregation-over-array/374511 "2025-02-13T16:36:32Z")
Hi, I have a document like this { "ip": \[ "192.168.1.1", "192.168.1.2" \] } Is it possible to make aggregation over value at zero position in the array? Something like this? { "aggs": { "my\_aggregati… --- ## [Still unable to install Kibana since "E: Repository 'https://artifacts.elastic.co/packages/8.x/apt stable InRelease' changed its 'Origin' value from 'Artifactory' to 'elastic'"](https://discuss.elastic.co/t/still-unable-to-install-kibana-since-e-repository-https-artifacts-elastic-co-packages-8-x-apt-stable-inrelease-changed-its-origin-value-from-artifactory-to-elastic/374520)
**Author:** [@n89n](https://discuss.elastic.co/u/n89n)\ **Replies:** 0\ **Last updated:** [February 13, 2025, 4:14pm UTC](https://discuss.elastic.co/t/still-unable-to-install-kibana-since-e-repository-https-artifacts-elastic-co-packages-8-x-apt-stable-inrelease-changed-its-origin-value-from-artifactory-to-elastic/374520 "2025-02-13T16:14:21Z")
So I've been trying to install Kibana on Ubuntu: I imported the Elastic PGP key, installed the apt-transport-https package, Saved the repository definition to /etc/apt/sources.list.d/elastic-8.x.list and tried to install… --- ## [Dealing with indexing large singular documents](https://discuss.elastic.co/t/dealing-with-indexing-large-singular-documents/374283)
**Author:** [@catmanjan](https://discuss.elastic.co/u/catmanjan)\ **Replies:** 11\ **Last updated:** [February 13, 2025, 4:00pm UTC](https://discuss.elastic.co/t/dealing-with-indexing-large-singular-documents/374283 "2025-02-13T16:00:48Z")
Hello we are encountering issues with large documents in Elasticsearch, we index text extracted content from PDF/Word documents and then search on those in an enterprise search scenario. We are using Elastic Cloud which… --- ## [No logs coming from AWS integration CloudTrail logs from S3](https://discuss.elastic.co/t/no-logs-coming-from-aws-integration-cloudtrail-logs-from-s3/374517)
**Author:** [@Noj\_Eod](https://discuss.elastic.co/u/Noj_Eod)\ **Replies:** 0\ **Last updated:** [February 13, 2025, 3:56pm UTC](https://discuss.elastic.co/t/no-logs-coming-from-aws-integration-cloudtrail-logs-from-s3/374517 "2025-02-13T15:56:33Z")
I'm experiencing issues with Elastic—I can't see any logs or errors related to AWS, but the agent is healthy. I'm using AWS integration CloudTrail logs from S3 only. The data stream for AWS also disappear. A help will b… --- ## [My Local machine does not recognize the elasticsearch certificate](https://discuss.elastic.co/t/my-local-machine-does-not-recognize-the-elasticsearch-certificate/374458)
**Author:** [@jeanne1](https://discuss.elastic.co/u/jeanne1)\ **Replies:** 2\ **Last updated:** [February 13, 2025, 3:18pm UTC](https://discuss.elastic.co/t/my-local-machine-does-not-recognize-the-elasticsearch-certificate/374458 "2025-02-13T15:18:17Z")
I setup an elasticsearch cluster on EC2 via docker. on EC2 terminal everything working well when I run: curl --cacert http\_ca.crt -u elastic:$Password https://localhost:9200 I got: { "name" : "21frt45422121f", "cluste… --- ## [Visualization Help - Methods to Show Status](https://discuss.elastic.co/t/visualization-help-methods-to-show-status/366689)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 1\ **Last updated:** [February 13, 2025, 2:29pm UTC](https://discuss.elastic.co/t/visualization-help-methods-to-show-status/366689 "2025-02-13T14:29:20Z")
Hello, I was wondering what others are doing to visualize status health? I know this depends on the data but was wondering what others are doing? For example these are what I can do: --- ## [Unable to visualize histogram data](https://discuss.elastic.co/t/unable-to-visualize-histogram-data/372300)
**Author:** [@Mudboyzh](https://discuss.elastic.co/u/Mudboyzh)\ **Replies:** 1\ **Last updated:** [February 13, 2025, 2:26pm UTC](https://discuss.elastic.co/t/unable-to-visualize-histogram-data/372300 "2025-02-13T14:26:13Z")
Hi guys, I tried to visualize the histogram data from Prometheus I checked a few topics or GitHub issues, kibana seems to support histogram data. My Elastic Stack version is 8.15.3. Here is the simplified data. # S… --- ## [Recommended version of Elasticsearch at this point](https://discuss.elastic.co/t/recommended-version-of-elasticsearch-at-this-point/374475)
**Author:** [@Iron](https://discuss.elastic.co/u/Iron)\ **Replies:** 4\ **Last updated:** [February 13, 2025, 1:46pm UTC](https://discuss.elastic.co/t/recommended-version-of-elasticsearch-at-this-point/374475 "2025-02-13T13:46:48Z")
I'm curious to know what the recommended version of Elasticsearch is at this point. And I want you to tell me why you recommend that version. Let's take a look at how to get an Elasticsearch update policy. --- ## [Elastic data strategy](https://discuss.elastic.co/t/elastic-data-strategy/374377)
**Author:** [@Zibamirza](https://discuss.elastic.co/u/Zibamirza)\ **Replies:** 3\ **Last updated:** [February 13, 2025, 1:30pm UTC](https://discuss.elastic.co/t/elastic-data-strategy/374377 "2025-02-13T13:30:03Z")
Hello, I am doing some research for my department on optimizing our use to data in elastic through a data strategy. I am struggling to find resources specific to elastic, I am finding a lot about data strategy in genera… --- ## [Elastic Action plugin](https://discuss.elastic.co/t/elastic-action-plugin/372225)
**Author:** [@regepiyu](https://discuss.elastic.co/u/regepiyu)\ **Replies:** 3\ **Last updated:** [February 13, 2025, 12:57pm UTC](https://discuss.elastic.co/t/elastic-action-plugin/372225 "2025-02-13T12:57:41Z")
I have created Custom Action plugin for elastic in java. This plugin have rest handler for preparing request, action and transport action which has actual business logic for executing request. This plugin was designed t… --- ## [Invalid Literal Value](https://discuss.elastic.co/t/invalid-literal-value/374502)
**Author:** [@furkanuznr](https://discuss.elastic.co/u/furkanuznr)\ **Replies:** 0\ **Last updated:** [February 13, 2025, 12:35pm UTC](https://discuss.elastic.co/t/invalid-literal-value/374502 "2025-02-13T12:35:20Z")
Inventory \> hosts \> agent host I get this error directly when I enter this section: \[ { "code": "invalid\_union", "unionErrors": \[ { "issues": \[ { "received": null, "code": "invalid\_literal", "expected": "metrics", "pat… --- ## [Error in Entity Analytics](https://discuss.elastic.co/t/error-in-entity-analytics/374500)
**Author:** [@pcglr](https://discuss.elastic.co/u/pcglr)\ **Replies:** 0\ **Last updated:** [February 13, 2025, 12:27pm UTC](https://discuss.elastic.co/t/error-in-entity-analytics/374500 "2025-02-13T12:27:52Z")
Hello, I get this error on the Entity Analytics screen. Could you please help me? I could not find a document about this on the web. "An error occurred during entity store resource initialization Failed to authenticat… --- ## [Beats module for JMS queues](https://discuss.elastic.co/t/beats-module-for-jms-queues/374427)
**Author:** [@joaorr13](https://discuss.elastic.co/u/joaorr13)\ **Replies:** 3\ **Last updated:** [February 13, 2025, 12:19pm UTC](https://discuss.elastic.co/t/beats-module-for-jms-queues/374427 "2025-02-13T12:19:26Z")
Hey, I want to send the logs collected by Filebeat to a Solace broker and then to Logstash. I know that there is no module for Solace and for JMS in general. In Logstash there is a JMS inetgration. My question would be,… --- ## [ElasticSearch Transform Not Working](https://discuss.elastic.co/t/elasticsearch-transform-not-working/374123)
**Author:** [@loverissimo](https://discuss.elastic.co/u/loverissimo)\ **Replies:** 4\ **Last updated:** [February 13, 2025, 12:15pm UTC](https://discuss.elastic.co/t/elasticsearch-transform-not-working/374123 "2025-02-13T12:15:28Z")
Hello, hope you can help me with a transform issue. I have this sales index that as an id, timestamp and value fields and Im working on another index (sales-latest) that dynamically searches for unique ids and the most r… --- ## [Convert dense vector to float](https://discuss.elastic.co/t/convert-dense-vector-to-float/374412)
**Author:** [@Aviel\_Bashari](https://discuss.elastic.co/u/Aviel_Bashari)\ **Replies:** 2\ **Last updated:** [February 13, 2025, 11:36am UTC](https://discuss.elastic.co/t/convert-dense-vector-to-float/374412 "2025-02-13T11:36:13Z")
Hi im using ELK stack V 8.13.3 i having an issue in my index: i dont know why but I pushed 8 vectors and the mapper set them as dense\_vector(no activity from my side to set this type was done) now this 8 vectors can c… --- ## [Following documentation for editing the Gemfile breaks Logstash](https://discuss.elastic.co/t/following-documentation-for-editing-the-gemfile-breaks-logstash/374317)
**Author:** [@mikewillis](https://discuss.elastic.co/u/mikewillis)\ **Replies:** 4\ **Last updated:** [February 13, 2025, 11:12am UTC](https://discuss.elastic.co/t/following-documentation-for-editing-the-gemfile-breaks-logstash/374317 "2025-02-13T11:12:29Z")
I need to make Logstash 7 on a server that doesn't have Internet access use a local Gem repository. If I follow the instructions at Private Gem Repositories | Logstash Reference \[7.17\] | Elastic then instead of After … --- ## [Role reporting user is showing deprecated](https://discuss.elastic.co/t/role-reporting-user-is-showing-deprecated/372830)
**Author:** [@Ekta](https://discuss.elastic.co/u/Ekta)\ **Replies:** 4\ **Last updated:** [February 13, 2025, 10:05am UTC](https://discuss.elastic.co/t/role-reporting-user-is-showing-deprecated/372830 "2025-02-13T10:05:53Z")
Hi OS - 22.04 ES - 7.17.0 kibana - 7.17.23 we are working on one requirement for user management so one user it is require to use reporting\_user role for download CSV report. but this role is showing deprecated so w… --- ## [Designing an Index with high Cardinality for a field distributed across multiple shards](https://discuss.elastic.co/t/designing-an-index-with-high-cardinality-for-a-field-distributed-across-multiple-shards/374302)
**Author:** [@Jatin\_Garg1](https://discuss.elastic.co/u/Jatin_Garg1)\ **Replies:** 4\ **Last updated:** [February 13, 2025, 9:42am UTC](https://discuss.elastic.co/t/designing-an-index-with-high-cardinality-for-a-field-distributed-across-multiple-shards/374302 "2025-02-13T09:42:06Z")
Hello, I am designing an index for logs related to some search API which has information like type/count of searches AND type/count of results served in a search response. Sample Information in the Log: { SearchId: "… --- ## [Reindex shrink](https://discuss.elastic.co/t/reindex-shrink/374489)
**Author:** [@rezgui](https://discuss.elastic.co/u/rezgui)\ **Replies:** 0\ **Last updated:** [February 13, 2025, 9:37am UTC](https://discuss.elastic.co/t/reindex-shrink/374489 "2025-02-13T09:37:53Z")
hi i need to reidex shrink to remove conflic . in index i have filed type intger and in shrink type sting . how can i do? --- ## [Journald integration timestamp field](https://discuss.elastic.co/t/journald-integration-timestamp-field/374477)
**Author:** [@Balu](https://discuss.elastic.co/u/Balu)\ **Replies:** 0\ **Last updated:** [February 13, 2025, 7:39am UTC](https://discuss.elastic.co/t/journald-integration-timestamp-field/374477 "2025-02-13T07:39:00Z")
Currently I am getting errors like the following quite often: This cluster had issues returning data and results might be incomplete. error fetching \[journald.custom.syslog\_timestamp\]: Field \[journald.custom.syslog\_ti… --- ## [Output.elasticsearch.hosts doe snot exist persisten error](https://discuss.elastic.co/t/output-elasticsearch-hosts-doe-snot-exist-persisten-error/374455)
**Author:** [@latte123](https://discuss.elastic.co/u/latte123)\ **Replies:** 4\ **Last updated:** [February 13, 2025, 6:36am UTC](https://discuss.elastic.co/t/output-elasticsearch-hosts-doe-snot-exist-persisten-error/374455 "2025-02-13T06:36:45Z")
ES, Logstash 8.17.1. I've implemented syslog via conf file in conf.d directory of Logstash to connect to OpenShift in Sandbox/dev environment. It all worked one day. Next day logs stopped with error in /var/log/logstash/… --- ## [HOW TO PARSE OPTIONAL FIELDS ON LOGSTASH?](https://discuss.elastic.co/t/how-to-parse-optional-fields-on-logstash/374476)
**Author:** [@kriti\_dabas](https://discuss.elastic.co/u/kriti_dabas)\ **Replies:** 0\ **Last updated:** [February 13, 2025, 6:34am UTC](https://discuss.elastic.co/t/how-to-parse-optional-fields-on-logstash/374476 "2025-02-13T06:34:14Z")
Unable to parse optional fields in dhcp lease logs. Following is the sample of logs:- lease 1.1.1.1 { starts 4 2025/02/13 06:14:46; ends 6 2025/03/15 06:14:46; cltt 4 2025/02/13 06:14:46; binding state active; next bin… --- ## [Not able to set-up prometheus module with bearer token, getting 401 unauthorised](https://discuss.elastic.co/t/not-able-to-set-up-prometheus-module-with-bearer-token-getting-401-unauthorised/374469)
**Author:** [@Bhanu\_Praveen](https://discuss.elastic.co/u/Bhanu_Praveen)\ **Replies:** 0\ **Last updated:** [February 13, 2025, 2:57am UTC](https://discuss.elastic.co/t/not-able-to-set-up-prometheus-module-with-bearer-token-getting-401-unauthorised/374469 "2025-02-13T02:57:26Z")
Hello, Not able to set-up prometheus module with bearer token, getting 401 unauthorised Below is the config: metricbeat.modules: - module: prometheus period: 10s hosts: \["http://dasda.xde.com:42115"\] metrics\_pat… --- ## [Kibana cannot connect to the Elastic Package Registry](https://discuss.elastic.co/t/kibana-cannot-connect-to-the-elastic-package-registry/374239)
**Author:** [@EkilErif](https://discuss.elastic.co/u/EkilErif)\ **Replies:** 1\ **Last updated:** [February 13, 2025, 2:15am UTC](https://discuss.elastic.co/t/kibana-cannot-connect-to-the-elastic-package-registry/374239 "2025-02-13T02:15:05Z")
I am very new to ELK and after configuring x-pack security to true I am getting the message: Kibana cannot connect to the Elastic Package Registry When I searched this community I found the following post: Is this s… --- ## [How to Parse Interleaved Multi-Service Logs with Filebeat/Logstash - Extracting Complete Transaction Messages](https://discuss.elastic.co/t/how-to-parse-interleaved-multi-service-logs-with-filebeat-logstash-extracting-complete-transaction-messages/374466)
**Author:** [@saderick](https://discuss.elastic.co/u/saderick)\ **Replies:** 0\ **Last updated:** [February 13, 2025, 1:57am UTC](https://discuss.elastic.co/t/how-to-parse-interleaved-multi-service-logs-with-filebeat-logstash-extracting-complete-transaction-messages/374466 "2025-02-13T01:57:31Z")
Hi Guys, I'm new on FileBeat or Logstash, here is my problem, I need to parse log files where multiple applications alternately write entries into the same file using Filebeat or Logstash. Our scenario: Multiple ser… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=100) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=102)