# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=104 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 105 --- ## [Transforms - IP Ranges](https://discuss.elastic.co/t/transforms-ip-ranges/374237)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 2\ **Last updated:** [February 7, 2025, 7:40pm UTC](https://discuss.elastic.co/t/transforms-ip-ranges/374237 "2025-02-07T19:40:00Z")
Hello I was attempting to use range aggregation with Transforms and noticed that it doesn't seem to allow IP address as an input: Is this a bug? --- ## [Logstash to Logstash with Lumbejack to Beats and SSL issue](https://discuss.elastic.co/t/logstash-to-logstash-with-lumbejack-to-beats-and-ssl-issue/374236)
**Author:** [@ottobus](https://discuss.elastic.co/u/ottobus)\ **Replies:** 0\ **Last updated:** [February 7, 2025, 5:36pm UTC](https://discuss.elastic.co/t/logstash-to-logstash-with-lumbejack-to-beats-and-ssl-issue/374236 "2025-02-07T17:36:55Z")
Hi, I'm trying to connect two Logsatsh with Lumberjack output plugin and Beats input plugin But I'm getting an error on ssl verify... Let's give more context ! First I'm using Logstash 8.5 on both side (I also tried wi… --- ## [Read/write consistency](https://discuss.elastic.co/t/read-write-consistency/374223)
**Author:** [@ailin](https://discuss.elastic.co/u/ailin)\ **Replies:** 3\ **Last updated:** [February 7, 2025, 3:47pm UTC](https://discuss.elastic.co/t/read-write-consistency/374223 "2025-02-07T15:47:37Z")
Hello. I guess questions about read/write consistency in Elasticsearch is a never ending story. I've been ES user for at least 7 years and still struggle with those. My team uses Elasticsearch 6.8, we will update it ev… --- ## [Natural Language Search with Elastic Search](https://discuss.elastic.co/t/natural-language-search-with-elastic-search/374098)
**Author:** [@Pavit\_Kaur1](https://discuss.elastic.co/u/Pavit_Kaur1)\ **Replies:** 1\ **Last updated:** [February 7, 2025, 2:39pm UTC](https://discuss.elastic.co/t/natural-language-search-with-elastic-search/374098 "2025-02-07T14:39:51Z")
Elastic Search Version: 8.11.0 I am trying to build a natural language search with a programming questions dataset and tried with the ELSER model of elastic first where text expansion query was performed with embeddings… --- ## [Input CEF Codec output Rubydebug (Multiple use of codec)](https://discuss.elastic.co/t/input-cef-codec-output-rubydebug-multiple-use-of-codec/374213)
**Author:** [@moomoo21](https://discuss.elastic.co/u/moomoo21)\ **Replies:** 0\ **Last updated:** [February 7, 2025, 9:27am UTC](https://discuss.elastic.co/t/input-cef-codec-output-rubydebug-multiple-use-of-codec/374213 "2025-02-07T09:27:43Z")
Hello, I have a logstash config that goes something like: input{ pipeline { address =\> "output1" codec =\> cef{ ecs\_compatibility =\> disabled } } } output { stdout {codec =\> rubydebug} } The… --- ## [How to Handle different Log in Clustering Openshift](https://discuss.elastic.co/t/how-to-handle-different-log-in-clustering-openshift/374211)
**Author:** [@zerratriani](https://discuss.elastic.co/u/zerratriani)\ **Replies:** 0\ **Last updated:** [February 7, 2025, 9:10am UTC](https://discuss.elastic.co/t/how-to-handle-different-log-in-clustering-openshift/374211 "2025-02-07T09:10:22Z")
Hello, so I have an openshift environment and the logs are monitored to elasticsearch. But there is one log that is of a different type. That is a JAVA-based backend log. Can I configure it in logstash? Because if I cha… --- ## [Parsing JSON Log and adding to root level](https://discuss.elastic.co/t/parsing-json-log-and-adding-to-root-level/373555)
**Author:** [@lester74](https://discuss.elastic.co/u/lester74)\ **Replies:** 8\ **Last updated:** [February 7, 2025, 7:45am UTC](https://discuss.elastic.co/t/parsing-json-log-and-adding-to-root-level/373555 "2025-02-07T07:45:07Z")
I'm trying to ingest logs to elasticsearch directly using filebeat 8.17.0 I want to separate the json keys from logs and add it to the root level so I can perform analytics based on the fields. sample log: \[23/Jan/2025… --- ## [Output isolator pattern not working as expected when elastic is not reachable](https://discuss.elastic.co/t/output-isolator-pattern-not-working-as-expected-when-elastic-is-not-reachable/374166)
**Author:** [@himans](https://discuss.elastic.co/u/himans)\ **Replies:** 2\ **Last updated:** [February 7, 2025, 7:05am UTC](https://discuss.elastic.co/t/output-isolator-pattern-not-working-as-expected-when-elastic-is-not-reachable/374166 "2025-02-07T07:05:44Z")
Hi, I have implemented output isolator pattern having with 4 pipelines, main, elastic, http and mongodb. Now when the connectivity of elastic is lost, it doesn't push events to http and mongodb also. I have gone throug… --- ## [The doucment is returned even if it does not meet the criteria](https://discuss.elastic.co/t/the-doucment-is-returned-even-if-it-does-not-meet-the-criteria/374145)
**Author:** [@vinitp](https://discuss.elastic.co/u/vinitp)\ **Replies:** 4\ **Last updated:** [February 6, 2025, 9:47pm UTC](https://discuss.elastic.co/t/the-doucment-is-returned-even-if-it-does-not-meet-the-criteria/374145 "2025-02-06T21:47:45Z")
I use the following DSL query "size": 25, "query": { "bool": { "must": \[ { "term": { "hcAccountabilityOfficeCode.keyword": { "value": "550" } } }, { "nested": { "query": { … --- ## [Must\_not does not work in the nested array](https://discuss.elastic.co/t/must-not-does-not-work-in-the-nested-array/374191)
**Author:** [@vinitp](https://discuss.elastic.co/u/vinitp)\ **Replies:** 1\ **Last updated:** [February 6, 2025, 9:43pm UTC](https://discuss.elastic.co/t/must-not-does-not-work-in-the-nested-array/374191 "2025-02-06T21:43:50Z")
I have an application that generates Elasticsearch SQL dynamically based on the client's search criteria. The application then use the "/sql/translate" API to translate to the DSL query which it executes. The sample of t… --- ## [How to alert if two fields match](https://discuss.elastic.co/t/how-to-alert-if-two-fields-match/374143)
**Author:** [@SecurePete](https://discuss.elastic.co/u/SecurePete)\ **Replies:** 9\ **Last updated:** [February 6, 2025, 9:14pm UTC](https://discuss.elastic.co/t/how-to-alert-if-two-fields-match/374143 "2025-02-06T21:14:20Z")
I am very new to messing with Elastic pipelines and I need help. I want to alert based on whether two fields in a log match. I am not sure the correct way to do this. The logs are from a Cisco DUO integration. I want al… --- ## [Filebeat issue with multiple log entries](https://discuss.elastic.co/t/filebeat-issue-with-multiple-log-entries/374108)
**Author:** [@arcsons](https://discuss.elastic.co/u/arcsons)\ **Replies:** 1\ **Last updated:** [February 6, 2025, 9:06pm UTC](https://discuss.elastic.co/t/filebeat-issue-with-multiple-log-entries/374108 "2025-02-06T21:06:33Z")
Hello, I have a Python script that fetches data and writes it to a log file named cb.json. The script runs every 5 minutes and retrieves the last 1,000 log entries. As a result, some log entries may be fetched multiple … --- ## [Read-only file system](https://discuss.elastic.co/t/read-only-file-system/374182)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 7\ **Last updated:** [February 6, 2025, 9:03pm UTC](https://discuss.elastic.co/t/read-only-file-system/374182 "2025-02-06T21:03:25Z")
Hello everyone, From Kibana I started to visualize load errors and when checking the cluster I see that one of the servers is outside, I entered by SSH and the server is running and had the elasticsearch service running… --- ## [Multilevel split filter in logstash](https://discuss.elastic.co/t/multilevel-split-filter-in-logstash/374159)
**Author:** [@sravan\_kaheti](https://discuss.elastic.co/u/sravan_kaheti)\ **Replies:** 1\ **Last updated:** [February 6, 2025, 1:27pm UTC](https://discuss.elastic.co/t/multilevel-split-filter-in-logstash/374159 "2025-02-06T13:27:56Z")
Hi everyone, My original raw output for a custom API is like bellow \> '\[{"sourceSystem":"D365","totalCasesReceived":4,"success":{"count":1,"cases":\[{"transactionId":"D0000001775-7","correlationId":"d1c755de-5a03-4dde-a… --- ## [Mapper-Size Plugin Breaks Parsing](https://discuss.elastic.co/t/mapper-size-plugin-breaks-parsing/374074)
**Author:** [@SomeRobot](https://discuss.elastic.co/u/SomeRobot)\ **Replies:** 10\ **Last updated:** [February 6, 2025, 2:11pm UTC](https://discuss.elastic.co/t/mapper-size-plugin-breaks-parsing/374074 "2025-02-06T14:11:27Z")
Hello, We want to enable mapper-size on our cloud clusters (we have done so on a single test cluster), and then we enabled \_size so that we can get ingest metrics for the cluster, but it breaks parsing. As soon as our d… --- ## [CEL input: How to subtract 1day from now()](https://discuss.elastic.co/t/cel-input-how-to-subtract-1day-from-now/351894)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 1\ **Last updated:** [February 6, 2025, 1:00pm UTC](https://discuss.elastic.co/t/cel-input-how-to-subtract-1day-from-now/351894 "2025-02-06T13:00:06Z")
hi, I'm trying to pull data from an api end-point. but it requires a dynamic value to supplied (For instance Date. I want to provide yesterday's date) In the actual go library, there are quite ways eg Go Playground - … --- ## [Wrong data for field iis.application\_pool.process.cpu\_usage\_perc](https://discuss.elastic.co/t/wrong-data-for-field-iis-application-pool-process-cpu-usage-perc/373004)
**Author:** [@cagostinelli](https://discuss.elastic.co/u/cagostinelli)\ **Replies:** 1\ **Last updated:** [February 6, 2025, 12:18pm UTC](https://discuss.elastic.co/t/wrong-data-for-field-iis-application-pool-process-cpu-usage-perc/373004 "2025-02-06T12:18:46Z")
Hi Team, We see wrong data for The CPU usage percentage from the field iis.application\_pool.process.cpu\_usage\_perc images: Can you help me on this? --- ## [Geoip not work with filebeat](https://discuss.elastic.co/t/geoip-not-work-with-filebeat/373637)
**Author:** [@Fernando\_Bertoldi](https://discuss.elastic.co/u/Fernando_Bertoldi)\ **Replies:** 4\ **Last updated:** [February 6, 2025, 12:08pm UTC](https://discuss.elastic.co/t/geoip-not-work-with-filebeat/373637 "2025-02-06T12:08:34Z")
I have Elasticsearch version 8.15.1 and filebat 8.16.1. The filebeat receives logs from a fortigate, and after several dissects it sends to elastic, these logs are received in elastic but without the Geoip enrichment. I… --- ## [Standalone agent is not enrolling with Elastic Cluster](https://discuss.elastic.co/t/standalone-agent-is-not-enrolling-with-elastic-cluster/374171)
**Author:** [@Eshwar\_K](https://discuss.elastic.co/u/Eshwar_K)\ **Replies:** 3\ **Last updated:** [February 6, 2025, 11:40am UTC](https://discuss.elastic.co/t/standalone-agent-is-not-enrolling-with-elastic-cluster/374171 "2025-02-06T11:40:06Z")
Hi Support team, I had configured cluster with default certificates which are created while installing stack. Now, I has installed standalone elastic agent with below command. ./elastic-agent.exe install --insecure Bu… --- ## [Elastic search restore failure](https://discuss.elastic.co/t/elastic-search-restore-failure/374162)
**Author:** [@Karthiknathan\_c](https://discuss.elastic.co/u/Karthiknathan_c)\ **Replies:** 1\ **Last updated:** [February 6, 2025, 10:38am UTC](https://discuss.elastic.co/t/elastic-search-restore-failure/374162 "2025-02-06T10:38:55Z")
I was trying to backup and restore ES to new cluster using below commands. //take snapshot curl -u backup:$password -s -XPUT ${endpoint} //restore curl -s -u backup:$password -X POST "${HOSTNAME}:${PORT}/\_snapshot/${BA… --- ## [Filebeat processors not working](https://discuss.elastic.co/t/filebeat-processors-not-working/374164)
**Author:** [@Mysticrunner](https://discuss.elastic.co/u/Mysticrunner)\ **Replies:** 0\ **Last updated:** [February 6, 2025, 7:08am UTC](https://discuss.elastic.co/t/filebeat-processors-not-working/374164 "2025-02-06T07:08:11Z")
Hi , I am new to Elastic stack. I am using filebeat to send logs to ES and using processors in filebeat. When I saw index from Kibana, I noticed that the convert processor is not being applied. Sometimes they work as ex… --- ## [Not being able to receive the verification key to login to Kibana for ElasticSearch](https://discuss.elastic.co/t/not-being-able-to-receive-the-verification-key-to-login-to-kibana-for-elasticsearch/374091)
**Author:** [@remoteconn-7891](https://discuss.elastic.co/u/remoteconn-7891)\ **Replies:** 7\ **Last updated:** [February 5, 2025, 11:41pm UTC](https://discuss.elastic.co/t/not-being-able-to-receive-the-verification-key-to-login-to-kibana-for-elasticsearch/374091 "2025-02-05T23:41:35Z")
Hello guys, I'm relatively new to Elasticsearch and I'm trying to login to the Kibana dashboard, but on the login page, it's asking me to provide the verification code, which I'm not able to find. For some context, I'm … --- ## [How to connect with GLPI API?](https://discuss.elastic.co/t/how-to-connect-with-glpi-api/371242)
**Author:** [@sebastien\_jacques](https://discuss.elastic.co/u/sebastien_jacques)\ **Replies:** 1\ **Last updated:** [February 5, 2025, 6:27pm UTC](https://discuss.elastic.co/t/how-to-connect-with-glpi-api/371242 "2025-02-05T18:27:17Z")
Hi I come to seek your help. I configured my logstash to retrieve data from my "alert2" index. it works. My goal is that when an event from this index arrives with the name "root-connection", it will create a ticket i… --- ## [Disable errors screenshotting in canvas](https://discuss.elastic.co/t/disable-errors-screenshotting-in-canvas/371763)
**Author:** [@Taras\_Mikityuk](https://discuss.elastic.co/u/Taras_Mikityuk)\ **Replies:** 1\ **Last updated:** [February 5, 2025, 6:02pm UTC](https://discuss.elastic.co/t/disable-errors-screenshotting-in-canvas/371763 "2025-02-05T18:02:18Z")
When there is an issue while generating pdf report from canvas, Elasticsearch will put screenshot of an error in pdf report, here is example i want to disable this feature but cant find how to do it, is it even possi… --- ## [Elastic Search 2nd node install is not updating elasticsearch.yml per instructions](https://discuss.elastic.co/t/elastic-search-2nd-node-install-is-not-updating-elasticsearch-yml-per-instructions/374092)
**Author:** [@mjanzen](https://discuss.elastic.co/u/mjanzen)\ **Replies:** 3\ **Last updated:** [February 5, 2025, 5:08pm UTC](https://discuss.elastic.co/t/elastic-search-2nd-node-install-is-not-updating-elasticsearch-yml-per-instructions/374092 "2025-02-05T17:08:07Z")
This category relates to the Enterprise Search set of products - App Search, Site Search and Workplace Search. If your question relates to core Elasticsearch functionality, please head over to the Elasticsearch category… --- ## [ES 7.17: Large cluster with big difference in shard size keeps high disparity between cold nodes sizing](https://discuss.elastic.co/t/es-7-17-large-cluster-with-big-difference-in-shard-size-keeps-high-disparity-between-cold-nodes-sizing/374139)
**Author:** [@carlosmg1](https://discuss.elastic.co/u/carlosmg1)\ **Replies:** 0\ **Last updated:** [February 5, 2025, 4:35pm UTC](https://discuss.elastic.co/t/es-7-17-large-cluster-with-big-difference-in-shard-size-keeps-high-disparity-between-cold-nodes-sizing/374139 "2025-02-05T16:35:04Z")
Hi, we're currently managing a ES cluster with cold/hot architecture, we have 25 cold nodes with 12 TB space each, and 42 hot nodes with 2 TB each. For quite a while a few of our cold nodes are running pretty low in sp… --- ## [Problem configuring/using Uptime Lab](https://discuss.elastic.co/t/problem-configuring-using-uptime-lab/373906)
**Author:** [@elasticrap](https://discuss.elastic.co/u/elasticrap)\ **Replies:** 7\ **Last updated:** [February 5, 2025, 2:50pm UTC](https://discuss.elastic.co/t/problem-configuring-using-uptime-lab/373906 "2025-02-05T14:50:56Z")
I am working on the Uptime lab. Item 4 states - Configure monitors inline heartbeat.monitors: Notice there is a sample monitor of type http with id my-monitor. Comment out or delete this monitor (but leave the heartbea… --- ## [Crowdstrike REST API via Elastic Agent 400 error](https://discuss.elastic.co/t/crowdstrike-rest-api-via-elastic-agent-400-error/360084)
**Author:** [@MrImagine](https://discuss.elastic.co/u/MrImagine)\ **Replies:** 2\ **Last updated:** [February 5, 2025, 1:56pm UTC](https://discuss.elastic.co/t/crowdstrike-rest-api-via-elastic-agent-400-error/360084 "2025-02-05T13:56:55Z")
Hi all, I have an ELK stack running with fleet installed. In our fleet is an elastic agent configured. The current verions are: -Elasticsearch 8.13.2 -Fleet and Agent verions: 8.13.4 -Crowdstrike Integration: 1.34.… --- ## [How Elastic search built vector database](https://discuss.elastic.co/t/how-elastic-search-built-vector-database/374076)
**Author:** [@sumantapakira](https://discuss.elastic.co/u/sumantapakira)\ **Replies:** 4\ **Last updated:** [February 5, 2025, 1:01pm UTC](https://discuss.elastic.co/t/how-elastic-search-built-vector-database/374076 "2025-02-05T13:01:16Z")
I would like to study how Vector database is working using Apache Lucene. So for this I am looking into github GitHub - elastic/elasticsearch: Free and Open Source, Distributed, RESTful Search Engine but could not unders… --- ## [Logstash-input-google\_pubsub performance is throttled after upgrading older versions to anything from 8.4.0 onwards](https://discuss.elastic.co/t/logstash-input-google-pubsub-performance-is-throttled-after-upgrading-older-versions-to-anything-from-8-4-0-onwards/374128)
**Author:** [@nobody](https://discuss.elastic.co/u/nobody)\ **Replies:** 0\ **Last updated:** [February 5, 2025, 12:50pm UTC](https://discuss.elastic.co/t/logstash-input-google-pubsub-performance-is-throttled-after-upgrading-older-versions-to-anything-from-8-4-0-onwards/374128 "2025-02-05T12:50:43Z")
Hello there, I did hit an issue with consuming pubsub messages with most of the 8.x versions of logstash. I tried to rule out every single point of the pipeline, it seems logstash simply does not ingests data fast enoug… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=103) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=105)