# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1044 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1045 --- ## [Apache logs using Kibana](https://discuss.elastic.co/t/apache-logs-using-kibana/297774)
**Author:** [@karewise\_tech](https://discuss.elastic.co/u/karewise_tech)\ **Replies:** 1\ **Last updated:** [February 21, 2022, 9:42pm UTC](https://discuss.elastic.co/t/apache-logs-using-kibana/297774 "2022-02-21T21:42:30Z")
I tried getting the Apache logs using filebeat to Elasticsearch kibana. but iam unable to get the logs. when i click on check data it shows : No data has been received from this module yet Versions: filebeat : 7.17.… --- ## [Histogram range aggragation keys](https://discuss.elastic.co/t/histogram-range-aggragation-keys/297453)
**Author:** [@Akaren](https://discuss.elastic.co/u/Akaren)\ **Replies:** 6\ **Last updated:** [February 21, 2022, 9:01pm UTC](https://discuss.elastic.co/t/histogram-range-aggragation-keys/297453 "2022-02-21T21:01:48Z")
Hi, after update to latest ES version, my range aggregation query started to work weird way. I need histogram with predefine range values. My query looks like: "aggs" : { "agg" : { … --- ## [Too many shards?](https://discuss.elastic.co/t/too-many-shards/297226)
**Author:** [@Samir\_Sabri](https://discuss.elastic.co/u/Samir_Sabri)\ **Replies:** 7\ **Last updated:** [February 21, 2022, 8:25pm UTC](https://discuss.elastic.co/t/too-many-shards/297226 "2022-02-21T20:25:15Z")
Hello We are having unhealthy deployment, I tried to check the shards state, it seems we have too many shards ?? /\_cat/shards?h=index,shard,prirep,state,unassigned.reason The head size we have: "jvm": { "mem":… --- ## [Crash after upgrading to es 8.0.0](https://discuss.elastic.co/t/crash-after-upgrading-to-es-8-0-0/297728)
**Author:** [@ilkkao](https://discuss.elastic.co/u/ilkkao)\ **Replies:** 6\ **Last updated:** [February 21, 2022, 7:47pm UTC](https://discuss.elastic.co/t/crash-after-upgrading-to-es-8-0-0/297728 "2022-02-21T19:47:41Z")
I was about to add a github issue but as I'm not sure what counts as a confirmed bug I report my issue here: I was running es & kibana 7.17.0 and used kibana migration assistant to re-index my main index called "message… --- ## [Node Auto Configuration](https://discuss.elastic.co/t/node-auto-configuration/297543)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 8\ **Last updated:** [February 21, 2022, 7:42pm UTC](https://discuss.elastic.co/t/node-auto-configuration/297543 "2022-02-21T19:42:28Z")
Hi there, I´m trying to deploy a new cluster using Elasticsearch 8 but it seens that is not working the way I expected. 4 Servers: 3 Elasticsearch 1 kibana All in the same network. I´m following the steps using the … --- ## [Search Query Parameter Preference Custom-ID](https://discuss.elastic.co/t/search-query-parameter-preference-custom-id/297807)
**Author:** [@RabBit\_BR](https://discuss.elastic.co/u/RabBit_BR)\ **Replies:** 0\ **Last updated:** [February 21, 2022, 6:53pm UTC](https://discuss.elastic.co/t/search-query-parameter-preference-custom-id/297807 "2022-02-21T18:53:09Z")
I have the same problem as the stackoverflow guy. I'm using the custom-session-id preference so that after executing the same query several times, keep the same score in each execution but this strategy is not working. … --- ## [Logstash - org.jruby.exceptions.SystemExit: (SystemExit) exit](https://discuss.elastic.co/t/logstash-org-jruby-exceptions-systemexit-systemexit-exit/297801)
**Author:** [@dontusk1980](https://discuss.elastic.co/u/dontusk1980)\ **Replies:** 1\ **Last updated:** [February 21, 2022, 6:16pm UTC](https://discuss.elastic.co/t/logstash-org-jruby-exceptions-systemexit-systemexit-exit/297801 "2022-02-21T18:16:02Z")
Hi Team, tried to create one logstash instance from the existing ( with same user data like the other one) but weird message when starting the logstash, details are as below, Could you please help me out with the fix … --- ## [Updating indices.query.bool.max\_clause\_count in k8s environment](https://discuss.elastic.co/t/updating-indices-query-bool-max-clause-count-in-k8s-environment/295999)
**Author:** [@gvslim](https://discuss.elastic.co/u/gvslim)\ **Replies:** 1\ **Last updated:** [February 21, 2022, 5:23pm UTC](https://discuss.elastic.co/t/updating-indices-query-bool-max-clause-count-in-k8s-environment/295999 "2022-02-21T17:23:02Z")
I tried to run a query on a recently updated 7.16.3 environment and got the following error ""field expansion matches too many fields, limit: 1024, got: 1328". I then went to set indices.query.bool.max\_clause\_count to 20… --- ## [Filebeat Threat Intel module, multiple Anomali filesets](https://discuss.elastic.co/t/filebeat-threat-intel-module-multiple-anomali-filesets/297761)
**Author:** [@Rob3](https://discuss.elastic.co/u/Rob3)\ **Replies:** 7\ **Last updated:** [February 21, 2022, 5:20pm UTC](https://discuss.elastic.co/t/filebeat-threat-intel-module-multiple-anomali-filesets/297761 "2022-02-21T17:20:15Z")
How can multiple Anomali filsets be enabled? For example, if I want to enable both collections 135 and 136 as per below, seems that the last read wins and only collection 136 will be configured. Is this possible? Can'… --- ## [Kibana Security Exception When Viewing Rules/Alerts](https://discuss.elastic.co/t/kibana-security-exception-when-viewing-rules-alerts/297174)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 1\ **Last updated:** [February 21, 2022, 4:49pm UTC](https://discuss.elastic.co/t/kibana-security-exception-when-viewing-rules-alerts/297174 "2022-02-21T16:49:33Z")
I'm configuring Elastic Security with for Elastic Stack 7.16.3. When I visit Stack Management-\>Rules and Connectors in Kibana, I see the following: ...and this is the specific error that shows up when I hover over th… --- ## [Logstash - REGEX to change a field](https://discuss.elastic.co/t/logstash-regex-to-change-a-field/297769)
**Author:** [@Sylvain\_Renard](https://discuss.elastic.co/u/Sylvain_Renard)\ **Replies:** 1\ **Last updated:** [February 21, 2022, 5:00pm UTC](https://discuss.elastic.co/t/logstash-regex-to-change-a-field/297769 "2022-02-21T17:00:42Z")
Hello, I'm receiving snmptraps from an equipement with a sequence ID at the end. The sequence ID increase at every new trap. This is normaly considered as a new field and after a while the max of field is reached and I … --- ## [Logstash stopped processing because of an error: (SystemExit) exit](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error-systemexit-exit/297790)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 0\ **Last updated:** [February 21, 2022, 4:35pm UTC](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error-systemexit-exit/297790 "2022-02-21T16:35:33Z")
Hello all, I am using ELK version 7.16.2 and my Elasticsearch cluster is healthy. when I tried to ingest data through Logstash, it gave me the following error. Am I missing any bundles from setup? "Using bundled JDK: … --- ## [Elasticsearch service not running after downgrade from 7.16.2 to old version 6.4.2](https://discuss.elastic.co/t/elasticsearch-service-not-running-after-downgrade-from-7-16-2-to-old-version-6-4-2/295666)
**Author:** [@rahulbansal](https://discuss.elastic.co/u/rahulbansal)\ **Replies:** 14\ **Last updated:** [February 21, 2022, 4:34pm UTC](https://discuss.elastic.co/t/elasticsearch-service-not-running-after-downgrade-from-7-16-2-to-old-version-6-4-2/295666 "2022-02-21T16:34:05Z")
Hi Everyone, We were trying to upgrade our Elasticsearch from the 6.4.2 version to 7.16.2 due to log4j vulnerability but after the upgrade directly from 6.4.2 to 7.16.2 the Elasticsearch service was not running so we tr… --- ## [Logstash Running Error](https://discuss.elastic.co/t/logstash-running-error/297601)
**Author:** [@Simone1](https://discuss.elastic.co/u/Simone1)\ **Replies:** 4\ **Last updated:** [February 21, 2022, 4:29pm UTC](https://discuss.elastic.co/t/logstash-running-error/297601 "2022-02-21T16:29:28Z")
I'm trying to run logstash with a new .conf file and i riceve this error: \[ERROR\] 2022-02-18 12:40:51.495 \[Converge PipelineAction::Create\] agent - Failed to execute action {:id=\>:main, :action\_type=\>LogStash::ConvergeR… --- ## [Different results in Discover and Dev Console](https://discuss.elastic.co/t/different-results-in-discover-and-dev-console/297784)
**Author:** [@bitnapper](https://discuss.elastic.co/u/bitnapper)\ **Replies:** 0\ **Last updated:** [February 21, 2022, 4:15pm UTC](https://discuss.elastic.co/t/different-results-in-discover-and-dev-console/297784 "2022-02-21T16:15:01Z")
Hi, I'm still confused when elaticsearch is the right tool to use. As a exercise I imported editions from the OpenLibrary and tried to do some searches. I wrote a mapping and tried to filter out any prvious unicode issu… --- ## [Logstash JDBC input using wrong timezone](https://discuss.elastic.co/t/logstash-jdbc-input-using-wrong-timezone/297621)
**Author:** [@ELK\_ftw](https://discuss.elastic.co/u/ELK_ftw)\ **Replies:** 2\ **Last updated:** [February 21, 2022, 4:11pm UTC](https://discuss.elastic.co/t/logstash-jdbc-input-using-wrong-timezone/297621 "2022-02-21T16:11:32Z")
Hi all, At the client we have a setup lets say elk\_server\_DEV (elk version 7.16.2), here we have a logstash config that uses the jdbc input plugin. We noticed that the lastValues are always in UTC, so one hour of for w… --- ## [Calculate timestamp duration to next document](https://discuss.elastic.co/t/calculate-timestamp-duration-to-next-document/297244)
**Author:** [@jannik.b](https://discuss.elastic.co/u/jannik.b)\ **Replies:** 21\ **Last updated:** [February 21, 2022, 4:08pm UTC](https://discuss.elastic.co/t/calculate-timestamp-duration-to-next-document/297244 "2022-02-21T16:08:39Z")
Hi, this is my expected result: A new field "time\_taken" which in best case calculates in "ms" the used time between the timestamp in the documents. I would like to sort them later in a table so that I can analyze w… --- ## [Kibana not starting after making service account changes for upgrade to 8](https://discuss.elastic.co/t/kibana-not-starting-after-making-service-account-changes-for-upgrade-to-8/297406)
**Author:** [@gentle\_ghost](https://discuss.elastic.co/u/gentle_ghost)\ **Replies:** 6\ **Last updated:** [February 21, 2022, 3:49pm UTC](https://discuss.elastic.co/t/kibana-not-starting-after-making-service-account-changes-for-upgrade-to-8/297406 "2022-02-21T15:49:20Z")
Hello, Running into an issue upgrading to elasticsearch/kibana 8. The upgrade assistant had me switch from username/password authentication to service accounts via: https://www.elastic.co/guide/en/elasticsearch//refere… --- ## [Logstash - \_jsonparsefailure on valid json in udp input](https://discuss.elastic.co/t/logstash-jsonparsefailure-on-valid-json-in-udp-input/297753)
**Author:** [@mybyte](https://discuss.elastic.co/u/mybyte)\ **Replies:** 6\ **Last updated:** [February 21, 2022, 3:22pm UTC](https://discuss.elastic.co/t/logstash-jsonparsefailure-on-valid-json-in-udp-input/297753 "2022-02-21T15:22:30Z")
I'm using Logstash 8.0.0 with a fairly straightforward udp pipeline: input { udp { codec =\> json { charset =\> "UTF-8" } port =\> 12200 } } output { stdout {} } The data is being sent from a custo… --- ## [Add\_field with value from message](https://discuss.elastic.co/t/add-field-with-value-from-message/297777)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 0\ **Last updated:** [February 21, 2022, 3:37pm UTC](https://discuss.elastic.co/t/add-field-with-value-from-message/297777 "2022-02-21T15:37:36Z")
Hi, filebeat.yml: multiline.type: pattern multiline.pattern: '^\\d{4}-\\d{2}-\\d{2}\\s\\d{2}:\\d{2}:\\d{2}\\s{3}-\\sStarting' multiline.negate: true multiline.match: after multiline.max\_lines: 140 So in my message fi… --- ## [Fleet Server Integration not listed](https://discuss.elastic.co/t/fleet-server-integration-not-listed/297737)
**Author:** [@fuphil](https://discuss.elastic.co/u/fuphil)\ **Replies:** 2\ **Last updated:** [February 21, 2022, 3:04pm UTC](https://discuss.elastic.co/t/fleet-server-integration-not-listed/297737 "2022-02-21T15:04:07Z")
Hi, I am facing this bug in Elasticsearch 7.16.2 and tried the workaround of the following threads: Bug: Workaround: When I try to add the Fleet Server integration manually, it is not listed... Why? --- ## [Filebeat Checkpoint Module](https://discuss.elastic.co/t/filebeat-checkpoint-module/297773)
**Author:** [@lazyb0nes](https://discuss.elastic.co/u/lazyb0nes)\ **Replies:** 0\ **Last updated:** [February 21, 2022, 3:01pm UTC](https://discuss.elastic.co/t/filebeat-checkpoint-module/297773 "2022-02-21T15:01:35Z")
Hi there, So I am having some issues when sendin syslog with the cp\_log\_exporter to filebeat. I have seen no errors in filebeat but the fields aren't parsed. I am running R81.10 as far as version goes on the logserve… --- ## [Trying to get a fuzziness example to work](https://discuss.elastic.co/t/trying-to-get-a-fuzziness-example-to-work/297402)
**Author:** [@MrFantastic2022](https://discuss.elastic.co/u/MrFantastic2022)\ **Replies:** 4\ **Last updated:** [February 21, 2022, 2:40pm UTC](https://discuss.elastic.co/t/trying-to-get-a-fuzziness-example-to-work/297402 "2022-02-21T14:40:33Z")
Hi, I'm trying to follow the example for fuzziness given here against the sample bank index. Here's the query: GET /bank/\_search?q=employer:Qu~ It returns nothing, but I expect to get 2 records, at least, from what I… --- ## [Parent child boost not working consistently](https://discuss.elastic.co/t/parent-child-boost-not-working-consistently/294808)
**Author:** [@askids](https://discuss.elastic.co/u/askids)\ **Replies:** 9\ **Last updated:** [February 21, 2022, 2:23pm UTC](https://discuss.elastic.co/t/parent-child-boost-not-working-consistently/294808 "2022-02-21T14:23:28Z")
hi, We are using ES 7.10.2 on Windows 2012 R2, using inbuilt OpenJDK packaged with the MSI. We are seeing issues happening randomly with ES query being run on index using parent child relationship. We overwrite the rec… --- ## [S3 output plugin](https://discuss.elastic.co/t/s3-output-plugin/297675)
**Author:** [@brunoof1](https://discuss.elastic.co/u/brunoof1)\ **Replies:** 3\ **Last updated:** [February 21, 2022, 12:59pm UTC](https://discuss.elastic.co/t/s3-output-plugin/297675 "2022-02-21T12:59:28Z")
Hello everyone, everything good ? I have 2 doubts. What are all the file formats supported by the s3 output plugin? I'm using Oracle, kafka and file input and writing to s3 with s3 output. I would like to create Parqu… --- ## [HTTP Filter Assistance](https://discuss.elastic.co/t/http-filter-assistance/297655)
**Author:** [@JeremyP](https://discuss.elastic.co/u/JeremyP)\ **Replies:** 2\ **Last updated:** [February 21, 2022, 2:21pm UTC](https://discuss.elastic.co/t/http-filter-assistance/297655 "2022-02-21T14:21:06Z")
Hello, I have a situation where an API I'm trying to leverage which requires multiple API HTTP calls to generate the right document. I have the following document with multiple "id" in an array which I get from a http\_… --- ## [Reading multiline exceptions - filebeat](https://discuss.elastic.co/t/reading-multiline-exceptions-filebeat/297459)
**Author:** [@Rashmika\_Gamage](https://discuss.elastic.co/u/Rashmika_Gamage)\ **Replies:** 5\ **Last updated:** [February 21, 2022, 1:23pm UTC](https://discuss.elastic.co/t/reading-multiline-exceptions-filebeat/297459 "2022-02-21T13:23:26Z")
I am trying to read IBM websphere logs but as shown in the picture, it is hard to read the logs. since it is hard to find a pattern. Can someone please suggest a method? Also as you can see there are multiple timesta… --- ## [Watcher - Execution history error state](https://discuss.elastic.co/t/watcher-execution-history-error-state/297139)
**Author:** [@Teckinfor](https://discuss.elastic.co/u/Teckinfor)\ **Replies:** 6\ **Last updated:** [February 21, 2022, 1:22pm UTC](https://discuss.elastic.co/t/watcher-execution-history-error-state/297139 "2022-02-21T13:22:13Z")
Hello, I have created a watcher to be alerted when the price of an item goes up too much. It is a piece of information that I receive from enterprise search and that I have already implemented in a dashboard. When… --- ## [Question about pipelines.workers](https://discuss.elastic.co/t/question-about-pipelines-workers/297759)
**Author:** [@Ioxxy](https://discuss.elastic.co/u/Ioxxy)\ **Replies:** 2\ **Last updated:** [February 21, 2022, 1:22pm UTC](https://discuss.elastic.co/t/question-about-pipelines-workers/297759 "2022-02-21T13:22:06Z")
Hello, I'm wondering, when a pipeline.workers is define either in logstash.yml and in pipelines.yml, which configuration is applied ? I found out this setting was different in those 2 files. My guess would be that the… --- ## [Kibana Task Manager Health Output help](https://discuss.elastic.co/t/kibana-task-manager-health-output-help/297760)
**Author:** [@alaine](https://discuss.elastic.co/u/alaine)\ **Replies:** 0\ **Last updated:** [February 21, 2022, 1:21pm UTC](https://discuss.elastic.co/t/kibana-task-manager-health-output-help/297760 "2022-02-21T13:21:07Z")
Good Afternoon, I am doing some troubleshooting and haven't been able to find the following situation in the docs in regards to the print out from the Kibana task manager health print out. I have negative values in my "… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1043) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1045)