# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1047 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1048 --- ## [SSL Subject Missing on TCP Input Plugin](https://discuss.elastic.co/t/ssl-subject-missing-on-tcp-input-plugin/297632)
**Author:** [@gharryg](https://discuss.elastic.co/u/gharryg)\ **Replies:** 1\ **Last updated:** [February 18, 2022, 10:31pm UTC](https://discuss.elastic.co/t/ssl-subject-missing-on-tcp-input-plugin/297632 "2022-02-18T22:31:18Z")
I am working with Logstash (8.0.0) and using the TCP input plugin with SSL enabled. According the documentation, there should be a field that contains the subject of the certificate for the connecting client. However, it… --- ## [Watcher: discover report url not updating data](https://discuss.elastic.co/t/watcher-discover-report-url-not-updating-data/297650)
**Author:** [@Angad\_Panesar1](https://discuss.elastic.co/u/Angad_Panesar1)\ **Replies:** 0\ **Last updated:** [February 18, 2022, 9:56pm UTC](https://discuss.elastic.co/t/watcher-discover-report-url-not-updating-data/297650 "2022-02-18T21:56:14Z")
I have created a watcher action in dev tools and I want it to update it's data that displays the last 24 hours from the discover tab every hour meaning I want it to see new data that has recently been added in the hour. … --- ## [Logstash thread using high CPU usage](https://discuss.elastic.co/t/logstash-thread-using-high-cpu-usage/297634)
**Author:** [@jestin.varghese](https://discuss.elastic.co/u/jestin.varghese)\ **Replies:** 1\ **Last updated:** [February 18, 2022, 8:32pm UTC](https://discuss.elastic.co/t/logstash-thread-using-high-cpu-usage/297634 "2022-02-18T20:32:33Z")
Hi, Following threads in our logstash is using high CPU usage ====================== bash-4.2$ curl -XGET 'localhost:9600/\_node/hot\_threads?human=true' ::: {} Hot threads at 2022-02-18T19:50:45+01:00, busiestThreads… --- ## [Log type Filebeat deprectaed and Filestream multiline doesn't works](https://discuss.elastic.co/t/log-type-filebeat-deprectaed-and-filestream-multiline-doesnt-works/297577)
**Author:** [@retina](https://discuss.elastic.co/u/retina)\ **Replies:** 1\ **Last updated:** [February 18, 2022, 8:08pm UTC](https://discuss.elastic.co/t/log-type-filebeat-deprectaed-and-filestream-multiline-doesnt-works/297577 "2022-02-18T20:08:03Z")
I upgrade one filebeat to 7.16.3 version. When i config my filebeat as always with this config: - type: log enabled: true paths: - xx/yy.log - xx/yy.log - xx/yy.log tags: \["1","2"\] encoding: ISO-8… --- ## [External Kibana Server Plugin Get Route request.body is Always An Empty Object](https://discuss.elastic.co/t/external-kibana-server-plugin-get-route-request-body-is-always-an-empty-object/297638)
**Author:** [@mnickerson](https://discuss.elastic.co/u/mnickerson)\ **Replies:** 0\ **Last updated:** [February 18, 2022, 7:43pm UTC](https://discuss.elastic.co/t/external-kibana-server-plugin-get-route-request-body-is-always-an-empty-object/297638 "2022-02-18T19:43:07Z")
The plugin I'm working on is for Kibana 7.16.3. The server side code currently looks like the following: import { schema } from '@kbn/config-schema'; import { logger } from 'elastic-apm-node'; import { IRouter } from '… --- ## [NAS drive mount give not able to obtain lock](https://discuss.elastic.co/t/nas-drive-mount-give-not-able-to-obtain-lock/297636)
**Author:** [@Uma\_Nath\_Jha](https://discuss.elastic.co/u/Uma_Nath_Jha)\ **Replies:** 0\ **Last updated:** [February 18, 2022, 7:27pm UTC](https://discuss.elastic.co/t/nas-drive-mount-give-not-able-to-obtain-lock/297636 "2022-02-18T19:27:44Z")
Hi Team, I have Elasticsearch running within a docker container and I have created a volume for my NAS drive which I mount for elastic data but it fails and gives me " \`\`\` Caused by: java.lang.IllegalStateException: fa… --- ## [Issue with logstash then elasticsearch : message (from grok) not creating fields?](https://discuss.elastic.co/t/issue-with-logstash-then-elasticsearch-message-from-grok-not-creating-fields/297555)
**Author:** [@ledufakademy](https://discuss.elastic.co/u/ledufakademy)\ **Replies:** 8\ **Last updated:** [February 18, 2022, 6:24pm UTC](https://discuss.elastic.co/t/issue-with-logstash-then-elasticsearch-message-from-grok-not-creating-fields/297555 "2022-02-18T18:24:56Z")
First i 'm trying to add my HAPROXY ALOHA 13.5 LTS (we cannot install nothing on this appliance, so FileBeat ... not for us , but perhaps i'm wrong ?) syslog to Elasticsearch (Kiban gui). So i decide to send syslog dat… --- ## [How convert needed SQL query to Elastic DSL](https://discuss.elastic.co/t/how-convert-needed-sql-query-to-elastic-dsl/297585)
**Author:** [@alessio-hermes](https://discuss.elastic.co/u/alessio-hermes)\ **Replies:** 0\ **Last updated:** [February 18, 2022, 9:53am UTC](https://discuss.elastic.co/t/how-convert-needed-sql-query-to-elastic-dsl/297585 "2022-02-18T09:53:38Z")
Hello everyone, I have an index with 19 mapped fields and I need to query it with query like this: SELECT \* FROM my-index WHERE field1 IN (value1, value2) AND field2 IN (valueX, valueY, valueZ) AND \*anyOfThe19Fields\* C… --- ## [Java API client 7.16.3 : handling for loops in terms aggregations](https://discuss.elastic.co/t/java-api-client-7-16-3-handling-for-loops-in-terms-aggregations/297616)
**Author:** [@Scylanth](https://discuss.elastic.co/u/Scylanth)\ **Replies:** 1\ **Last updated:** [February 18, 2022, 5:09pm UTC](https://discuss.elastic.co/t/java-api-client-7-16-3-handling-for-loops-in-terms-aggregations/297616 "2022-02-18T17:09:52Z")
Hello. I struggle to do aggregations on multiple terms using the new Java API, whenever using loops. I have a map of terms I need to aggregate on with their renamed value that I need to loop on. I have tried the follo… --- ## [Error : \[LogStash::Runner\] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified \[FATAL\] 2022-02-18 16:47:25.987 \[LogStash::Runner\] runner - The given configuration is invalid](https://discuss.elastic.co/t/error-logstash-runner-multilocal-ignoring-the-pipelines-yml-file-because-modules-or-command-line-options-are-specified-fatal-2022-02-18-1625-987-logstash-runner-runner-the-given-configuration-is-invalid/297628)
**Author:** [@d6036de2b54af16665f4](https://discuss.elastic.co/u/d6036de2b54af16665f4)\ **Replies:** 0\ **Last updated:** [February 18, 2022, 4:53pm UTC](https://discuss.elastic.co/t/error-logstash-runner-multilocal-ignoring-the-pipelines-yml-file-because-modules-or-command-line-options-are-specified-fatal-2022-02-18-1625-987-logstash-runner-runner-the-given-configuration-is-invalid/297628 "2022-02-18T16:53:19Z")
I am getting this error Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console \[WARN \] 2022-02-18 16:47:25.536 \[LogStash::Runner\]… --- ## [S3 connection with logstash file |||||I get a input from S3 bucket in my Logstash .conf files](https://discuss.elastic.co/t/s3-connection-with-logstash-file-i-get-a-input-from-s3-bucket-in-my-logstash-conf-files/297626)
**Author:** [@d6036de2b54af16665f4](https://discuss.elastic.co/u/d6036de2b54af16665f4)\ **Replies:** 2\ **Last updated:** [February 18, 2022, 4:45pm UTC](https://discuss.elastic.co/t/s3-connection-with-logstash-file-i-get-a-input-from-s3-bucket-in-my-logstash-conf-files/297626 "2022-02-18T16:45:55Z")
In one of .conf file i received No files found is s3 bucket . So is this is error of my connection with S3 bucket is wrong. How i can check this that is problem is their or not ? var/log/logstash Logs \[2022-02-18T16:… --- ## [ERROR Index lifecycle management (ILM): listener failed while handling triggered event \[ilm\]](https://discuss.elastic.co/t/error-index-lifecycle-management-ilm-listener-failed-while-handling-triggered-event-ilm/297622)
**Author:** [@daniele.saccon](https://discuss.elastic.co/u/daniele.saccon)\ **Replies:** 0\ **Last updated:** [February 18, 2022, 3:28pm UTC](https://discuss.elastic.co/t/error-index-lifecycle-management-ilm-listener-failed-while-handling-triggered-event-ilm/297622 "2022-02-18T15:28:49Z")
Hi, in my cluster the index lifecycle management (ILM) has stopped working, In detail there is only the cancellation that has not been done for a few days and this error appeared in the logs: \[2022-02-18T15: 36: 31,58… --- ## [Pass dissect results to next event](https://discuss.elastic.co/t/pass-dissect-results-to-next-event/297507)
**Author:** [@Dancho](https://discuss.elastic.co/u/Dancho)\ **Replies:** 3\ **Last updated:** [February 18, 2022, 3:25pm UTC](https://discuss.elastic.co/t/pass-dissect-results-to-next-event/297507 "2022-02-18T15:25:19Z")
we use dissect to find some keys, can we pass those fields to the next events till the key will be overwritten? our use case: log file structure contains a header and a body. we need to dissect some values from the hea… --- ## [Kibana server is not ready yet on elastic 8.0](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-on-elastic-8-0/297418)
**Author:** [@auasad](https://discuss.elastic.co/u/auasad)\ **Replies:** 12\ **Last updated:** [February 18, 2022, 3:06pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-on-elastic-8-0/297418 "2022-02-18T15:06:09Z")
Hello community, first of all many many congrats on elastic 8.0 release. I have setup Elasticsearch and kibana 8.0, Elasticsearch is running perfectly fine, below is the output of curl -X GET https://localhost:9200 -u e… --- ## [What is the point of the match\_all and match\_none queries?](https://discuss.elastic.co/t/what-is-the-point-of-the-match-all-and-match-none-queries/297618)
**Author:** [@MrFantastic2022](https://discuss.elastic.co/u/MrFantastic2022)\ **Replies:** 0\ **Last updated:** [February 18, 2022, 2:15pm UTC](https://discuss.elastic.co/t/what-is-the-point-of-the-match-all-and-match-none-queries/297618 "2022-02-18T14:15:56Z")
When would these queries be used and why? Thanks in advance to all who respond. --- ## [Not in other index](https://discuss.elastic.co/t/not-in-other-index/297588)
**Author:** [@Loic\_Bajard](https://discuss.elastic.co/u/Loic_Bajard)\ **Replies:** 4\ **Last updated:** [February 18, 2022, 1:15pm UTC](https://discuss.elastic.co/t/not-in-other-index/297588 "2022-02-18T13:15:29Z")
Considering these two indices: ## Mappings PUT breeds { "mappings": { "properties": { "size": { "type": "keyword" }, "guarding\_skills": { "type": "keyword" } } } } PUT dogs { "mappings": { … --- ## [Kibana error](https://discuss.elastic.co/t/kibana-error/297575)
**Author:** [@Abhi\_Abhishek](https://discuss.elastic.co/u/Abhi_Abhishek)\ **Replies:** 1\ **Last updated:** [February 18, 2022, 11:32am UTC](https://discuss.elastic.co/t/kibana-error/297575 "2022-02-18T11:32:19Z")
I am trying to install Kibana by rpm package but getting an error like this, can somebody help me with this please warning: kibana-7.16.2-x86\_64.rpm: Header V4 RSA/SHA512 Signature, key ID d88e42b4: NOKEY error: Failed … --- ## [Repository\_verification\_exception while creating new repository in snapshot](https://discuss.elastic.co/t/repository-verification-exception-while-creating-new-repository-in-snapshot/297483)
**Author:** [@Darshil\_Shah](https://discuss.elastic.co/u/Darshil_Shah)\ **Replies:** 14\ **Last updated:** [February 18, 2022, 10:55am UTC](https://discuss.elastic.co/t/repository-verification-exception-while-creating-new-repository-in-snapshot/297483 "2022-02-18T10:55:35Z")
we are running 3 node Elasticsearch setup where all of the nodes are master in kubernetes . i have installed s3 plugin for Elasticsearch and provided access key and secret key . whenever i create a repository and verif… --- ## [How to select the newest rows in an ordered result set?](https://discuss.elastic.co/t/how-to-select-the-newest-rows-in-an-ordered-result-set/297598)
**Author:** [@fgjensen](https://discuss.elastic.co/u/fgjensen)\ **Replies:** 0\ **Last updated:** [February 18, 2022, 10:50am UTC](https://discuss.elastic.co/t/how-to-select-the-newest-rows-in-an-ordered-result-set/297598 "2022-02-18T10:50:44Z")
Hello I have an annoying problem with Elasticsearch SQL I hope someone can help me with. Elasticsearch is version 7.17.0 and it will soon be upgraded to 8.0.0. We collect package data from Linux hosts with the auditbea… --- ## [UNASSIGNED replicas after reroute allocate\_stale\_primary](https://discuss.elastic.co/t/unassigned-replicas-after-reroute-allocate-stale-primary/297596)
**Author:** [@tjmartins](https://discuss.elastic.co/u/tjmartins)\ **Replies:** 0\ **Last updated:** [February 18, 2022, 10:45am UTC](https://discuss.elastic.co/t/unassigned-replicas-after-reroute-allocate-stale-primary/297596 "2022-02-18T10:45:07Z")
Hi all, After a node fail in a 3 node cluster, one of our indexes became in red state. My solution to recover, at least a primary shard, was to run: POST /\_cluster/reroute { "commands" : \[ { "allocate\_s… --- ## [MultisearchBody and seq\_no\_primary\_term](https://discuss.elastic.co/t/multisearchbody-and-seq-no-primary-term/297595)
**Author:** [@Pingouin](https://discuss.elastic.co/u/Pingouin)\ **Replies:** 0\ **Last updated:** [February 18, 2022, 10:44am UTC](https://discuss.elastic.co/t/multisearchbody-and-seq-no-primary-term/297595 "2022-02-18T10:44:40Z")
I am currently updating my code from High Level Rest java client to new Java client. It seems that it is no longer possible to activate "seq\_no\_primary\_term" for multi search request. With High Level REST Api, it only … --- ## [Elastic Agent/Elastic Endpoint inconsistent connection although the device is up & running](https://discuss.elastic.co/t/elastic-agent-elastic-endpoint-inconsistent-connection-although-the-device-is-up-running/297568)
**Author:** [@ZiaulAfiq](https://discuss.elastic.co/u/ZiaulAfiq)\ **Replies:** 0\ **Last updated:** [February 18, 2022, 7:21am UTC](https://discuss.elastic.co/t/elastic-agent-elastic-endpoint-inconsistent-connection-although-the-device-is-up-running/297568 "2022-02-18T07:21:16Z")
Hi all! Can I know why does the elastic agent/endpoint sometimes does not shows online although it shows here on the fleet dashboard? Thanks! --- ## [Metricbeat-Kubernetes startup error when upgrading from version 7.2 to 7.16.1](https://discuss.elastic.co/t/metricbeat-kubernetes-startup-error-when-upgrading-from-version-7-2-to-7-16-1/297276)
**Author:** [@cgnusr01](https://discuss.elastic.co/u/cgnusr01)\ **Replies:** 6\ **Last updated:** [February 18, 2022, 8:42am UTC](https://discuss.elastic.co/t/metricbeat-kubernetes-startup-error-when-upgrading-from-version-7-2-to-7-16-1/297276 "2022-02-18T08:42:28Z")
At a recently upgraded cluster from version 7.2 to 7.16.1, we tried to update Metricbeat for Kubernetes PODs. However on startup we got the following error: ERROR metrics/metrics.go:304 error determining cgroups vers… --- ## [Errors with event splitting using the input tcp plugin](https://discuss.elastic.co/t/errors-with-event-splitting-using-the-input-tcp-plugin/296157)
**Author:** [@opajaron](https://discuss.elastic.co/u/opajaron)\ **Replies:** 4\ **Last updated:** [February 18, 2022, 8:30am UTC](https://discuss.elastic.co/t/errors-with-event-splitting-using-the-input-tcp-plugin/296157 "2022-02-18T08:30:11Z")
Hi, we have a problem using the logstash tcp input plugin. What is happening is that it is not splitting correctly with "\\n" each event that arrives. With the tests we are doing, we are sending events with a rate of ~60 … --- ## [Configure deprecation log index properties](https://discuss.elastic.co/t/configure-deprecation-log-index-properties/291342)
**Author:** [@OrangeDog](https://discuss.elastic.co/u/OrangeDog)\ **Replies:** 9\ **Last updated:** [February 18, 2022, 8:03am UTC](https://discuss.elastic.co/t/configure-deprecation-log-index-properties/291342 "2022-02-18T08:03:17Z")
7.16 adds a new stream/index for deprecation logging. e.g. the first one today is .ds-.logs-deprecation.elasticsearch-default-2021.12.09-000001 However, it is created with "number\_of\_replicas": "1" and I only have one … --- ## [Metricbeat http module query Confluent Cloud Metrics](https://discuss.elastic.co/t/metricbeat-http-module-query-confluent-cloud-metrics/297569)
**Author:** [@henriksped209](https://discuss.elastic.co/u/henriksped209)\ **Replies:** 0\ **Last updated:** [February 18, 2022, 7:22am UTC](https://discuss.elastic.co/t/metricbeat-http-module-query-confluent-cloud-metrics/297569 "2022-02-18T07:22:49Z")
Hi I have a task where I need to figure out how to collect metrics from Confluent Cloud in ELK Stack. I have been looking into metricbeat http module and I'm able to query metrics from the Confluent Cloud API: https://… --- ## [Recent Kibana security update \[7.17\]](https://discuss.elastic.co/t/recent-kibana-security-update-7-17/296219)
**Author:** [@falcantara](https://discuss.elastic.co/u/falcantara)\ **Replies:** 3\ **Last updated:** [February 18, 2022, 2:12am UTC](https://discuss.elastic.co/t/recent-kibana-security-update-7-17/296219 "2022-02-18T02:12:58Z")
I was looking at this update here: https://discuss.elastic.co/t/kibana-7-17-0-security-update/296215 and I saw that this vulnerability had low privileges. I'm assuming that with vulnerability in order to exploit you need… --- ## [Change the default master connection timeout of 30s to 60s](https://discuss.elastic.co/t/change-the-default-master-connection-timeout-of-30s-to-60s/297311)
**Author:** [@elastic78](https://discuss.elastic.co/u/elastic78)\ **Replies:** 15\ **Last updated:** [February 17, 2022, 11:11pm UTC](https://discuss.elastic.co/t/change-the-default-master-connection-timeout-of-30s-to-60s/297311 "2022-02-17T23:11:33Z")
Hi, I am using Elasticsearch 5.5.2 version and when the node 2 is trying to connect to the master node node 1 I am getting the below error. I had opened this thread - Getting ConnectTimeoutException When joining in clust… --- ## [Elasticsearch-sql-cli jar and log4j vulnerabilty](https://discuss.elastic.co/t/elasticsearch-sql-cli-jar-and-log4j-vulnerabilty/297550)
**Author:** [@praveen4bv](https://discuss.elastic.co/u/praveen4bv)\ **Replies:** 1\ **Last updated:** [February 17, 2022, 10:32pm UTC](https://discuss.elastic.co/t/elasticsearch-sql-cli-jar-and-log4j-vulnerabilty/297550 "2022-02-17T22:32:20Z")
We are running Elasticsearch 7.6.2 and have mitigated the log4j by setting the -Dlog4j2.formatMsgNoLookups=true in JVM options. However, our scans are still showing that Elasticsearch-sql-cli-7.6.2.jar file is vulner… --- ## [Apache monitoring on several FreeBSD hosts](https://discuss.elastic.co/t/apache-monitoring-on-several-freebsd-hosts/297479)
**Author:** [@txfz](https://discuss.elastic.co/u/txfz)\ **Replies:** 0\ **Last updated:** [February 17, 2022, 11:22am UTC](https://discuss.elastic.co/t/apache-monitoring-on-several-freebsd-hosts/297479 "2022-02-17T11:22:32Z")
Hi, I'm new to the Elastic Stack. I've only barely managed to get it up and running before, so I may or may not fully understand all the things which I'm asking for here. We have a number of FreeBSD hosts running Apach… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1046) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1048)