# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1048 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1049 --- ## [\[ES 8.0.0\] Index Template ".monitoring-logstash-mb" has a missing field](https://discuss.elastic.co/t/es-8-0-0-index-template-monitoring-logstash-mb-has-a-missing-field/297544)
**Author:** [@nikAizuddin](https://discuss.elastic.co/u/nikAizuddin)\ **Replies:** 0\ **Last updated:** [February 17, 2022, 8:45pm UTC](https://discuss.elastic.co/t/es-8-0-0-index-template-monitoring-logstash-mb-has-a-missing-field/297544 "2022-02-17T20:45:01Z")
Hi, I'm using Elastic Stack and Beats version 8.0.0. I noticed Index Template .monitoring-logstash-mb is missing a mapping for logstash.node.stats.pipelines.queue.capacity.queue\_size\_in\_bytes field. My setup for Stack … --- ## [How to parse the multiline and nested json file](https://discuss.elastic.co/t/how-to-parse-the-multiline-and-nested-json-file/297542)
**Author:** [@ycui56](https://discuss.elastic.co/u/ycui56)\ **Replies:** 1\ **Last updated:** [February 17, 2022, 8:22pm UTC](https://discuss.elastic.co/t/how-to-parse-the-multiline-and-nested-json-file/297542 "2022-02-17T20:22:31Z")
Hi, I read lots of posts on the similar topics, but I still have problems to figure it out. So I have to post this one and hopefully get help from here. Thanks a lot in advance. Jason file: { "lable1": { d1: 0, d2… --- ## [Problem in phrase\_prefix with filter](https://discuss.elastic.co/t/problem-in-phrase-prefix-with-filter/297538)
**Author:** [@Kalavero](https://discuss.elastic.co/u/Kalavero)\ **Replies:** 0\ **Last updated:** [February 17, 2022, 7:17pm UTC](https://discuss.elastic.co/t/problem-in-phrase-prefix-with-filter/297538 "2022-02-17T19:17:17Z")
I have a query that I use for a search\_as\_you\_type field that is not returning the expected value. The query looks something like this: GET users/\_search { "\_source": \["first\_name","full\_name","last\_name","marketplac… --- ## [Unable to Migrate Custom Index to Cloud Through Logstash](https://discuss.elastic.co/t/unable-to-migrate-custom-index-to-cloud-through-logstash/297419)
**Author:** [@daniel.talbot](https://discuss.elastic.co/u/daniel.talbot)\ **Replies:** 4\ **Last updated:** [February 17, 2022, 6:08pm UTC](https://discuss.elastic.co/t/unable-to-migrate-custom-index-to-cloud-through-logstash/297419 "2022-02-17T18:08:24Z")
Trying to use a basic configuration to write a custom index to a cloud instance but upon doing so I keep getting an error addressing Ruby. Posting the config and results of starting with systemctl betlow: Config: inpu… --- ## [Kibana Tables colors](https://discuss.elastic.co/t/kibana-tables-colors/297356)
**Author:** [@aaron1](https://discuss.elastic.co/u/aaron1)\ **Replies:** 1\ **Last updated:** [February 17, 2022, 5:04pm UTC](https://discuss.elastic.co/t/kibana-tables-colors/297356 "2022-02-17T17:04:05Z")
I want to create a table that has severity levels of high medium and low and I want the words High medium and low to be in different colors. Is that possible in Kibana? --- ## [Variable in setup.template.json.path file not work?](https://discuss.elastic.co/t/variable-in-setup-template-json-path-file-not-work/297520)
**Author:** [@acidborn601](https://discuss.elastic.co/u/acidborn601)\ **Replies:** 0\ **Last updated:** [February 17, 2022, 4:36pm UTC](https://discuss.elastic.co/t/variable-in-setup-template-json-path-file-not-work/297520 "2022-02-17T16:36:01Z")
Hello! I use Elasticsearch 7.15.1 with filebeat 7.15.1 and have some questions: First: i use this config on filebeat and work fine: setup.template: enabled: true settings: index.number\_of\_shards: 5 index.n… --- ## ["Module elasticsearch doesn't exist!" Error in FileBeat](https://discuss.elastic.co/t/module-elasticsearch-doesnt-exist-error-in-filebeat/297518)
**Author:** [@Molly\_Fraser](https://discuss.elastic.co/u/Molly_Fraser)\ **Replies:** 0\ **Last updated:** [February 17, 2022, 4:27pm UTC](https://discuss.elastic.co/t/module-elasticsearch-doesnt-exist-error-in-filebeat/297518 "2022-02-17T16:27:30Z")
I keep getting the error "Module Elasticsearch doesn't exist!" when running "./filebeat module enable Elasticsearch" in both powershell and cmd using administrator privileges and normal. I am using Windows 10 with 7.15 … --- ## [Phrase Suggester Score](https://discuss.elastic.co/t/phrase-suggester-score/297492)
**Author:** [@mukeshdantuluri15](https://discuss.elastic.co/u/mukeshdantuluri15)\ **Replies:** 0\ **Last updated:** [February 17, 2022, 12:57pm UTC](https://discuss.elastic.co/t/phrase-suggester-score/297492 "2022-02-17T12:57:57Z")
Current Elastic API documentation shows only available options to get best matched suggestion as per below page, where as formulae to calculate score is not mentioned anywhere for understanding Need formulae used for s… --- ## [Which Java client to use for implementing search functionality](https://discuss.elastic.co/t/which-java-client-to-use-for-implementing-search-functionality/297461)
**Author:** [@roulupen](https://discuss.elastic.co/u/roulupen)\ **Replies:** 0\ **Last updated:** [February 17, 2022, 9:17am UTC](https://discuss.elastic.co/t/which-java-client-to-use-for-implementing-search-functionality/297461 "2022-02-17T09:17:27Z")
Hi All, I want to query from my Elasticsearch instance and the queries will be dynamic based on the user selection. Which Java library is best fit for it and is there any example available for the initial setup of the l… --- ## [Elastisearch installation](https://discuss.elastic.co/t/elastisearch-installation/297341)
**Author:** [@Abhi\_Abhishek](https://discuss.elastic.co/u/Abhi_Abhishek)\ **Replies:** 18\ **Last updated:** [February 17, 2022, 3:43pm UTC](https://discuss.elastic.co/t/elastisearch-installation/297341 "2022-02-17T15:43:10Z")
Hello Greetings of the day, I am trying to install Elasticsearch in linux server but its not installing & throwing error & logs are also not generating in var/log/Elasticsearch. Elasticsearch status: journalctl -x… --- ## [Keep differences from going negative](https://discuss.elastic.co/t/keep-differences-from-going-negative/297300)
**Author:** [@agiddens](https://discuss.elastic.co/u/agiddens)\ **Replies:** 3\ **Last updated:** [February 17, 2022, 3:14pm UTC](https://discuss.elastic.co/t/keep-differences-from-going-negative/297300 "2022-02-17T15:14:05Z")
I have a couple of questions and I think they are related but I could be wrong. Currently using Kibana 7.15.0 My data comes in every 5 minutes and looks like this. \[{Server:"id", requests\_since\_server\_started: , times… --- ## [Resolve mapping conflicts (kinda) automatically?](https://discuss.elastic.co/t/resolve-mapping-conflicts-kinda-automatically/297412)
**Author:** [@TheEvilDonut](https://discuss.elastic.co/u/TheEvilDonut)\ **Replies:** 2\ **Last updated:** [February 17, 2022, 2:25pm UTC](https://discuss.elastic.co/t/resolve-mapping-conflicts-kinda-automatically/297412 "2022-02-17T14:25:59Z")
So here's our situation. Most of our applications use an object field named (fictional) "foo" so :slight\_smile: foo.field\_a foo.field\_b foo.field\_c etc... But from time to time a "rogue log" will come in and will c… --- ## [Watch with action webhook status struck in "Firing" state](https://discuss.elastic.co/t/watch-with-action-webhook-status-struck-in-firing-state/297485)
**Author:** [@RajuParipelly](https://discuss.elastic.co/u/RajuParipelly)\ **Replies:** 3\ **Last updated:** [February 17, 2022, 2:21pm UTC](https://discuss.elastic.co/t/watch-with-action-webhook-status-struck-in-firing-state/297485 "2022-02-17T14:21:41Z")
I Created a watcher with webhook action in it. When the input section matches it should execute the action which is a webook(Sending logs to ScienceLogic). The action state is showing Firing but we didn't see any logs at… --- ## [Cluster.routing.allocation.enable vs planned node outages, eg. rolling node restarts](https://discuss.elastic.co/t/cluster-routing-allocation-enable-vs-planned-node-outages-eg-rolling-node-restarts/297497)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 1\ **Last updated:** [February 17, 2022, 2:14pm UTC](https://discuss.elastic.co/t/cluster-routing-allocation-enable-vs-planned-node-outages-eg-rolling-node-restarts/297497 "2022-02-17T14:14:39Z")
Trying to recapture BCP for doing a planned node outage eg. by rolling restarts. Wouldn't it be good practice to set cluster.routing.allocation.enable transient to 'none' before taking a node offline and the then set it… --- ## [Scheduler Java plugin Logstash](https://discuss.elastic.co/t/scheduler-java-plugin-logstash/297482)
**Author:** [@aalagia](https://discuss.elastic.co/u/aalagia)\ **Replies:** 6\ **Last updated:** [February 17, 2022, 2:07pm UTC](https://discuss.elastic.co/t/scheduler-java-plugin-logstash/297482 "2022-02-17T14:07:42Z")
Hi, I need to use scheduler in custom plugin written in Java for Logstash. How is possible to implement this thing? Thank you Antonio --- ## [Error indexing data in Elasticsearch](https://discuss.elastic.co/t/error-indexing-data-in-elasticsearch/297416)
**Author:** [@Matheus26](https://discuss.elastic.co/u/Matheus26)\ **Replies:** 2\ **Last updated:** [February 17, 2022, 1:55pm UTC](https://discuss.elastic.co/t/error-indexing-data-in-elasticsearch/297416 "2022-02-17T13:55:50Z")
Hi, I'm trying to index datas in Elasticsearch, but I'm getting an error. I'm using the latest Nest release (7.17.0) in C# The error is "Failed to serialize anonymous type". This error message is from an exception af… --- ## [Migration from old ELK to Elastic Cloud](https://discuss.elastic.co/t/migration-from-old-elk-to-elastic-cloud/297369)
**Author:** [@mgfeal](https://discuss.elastic.co/u/mgfeal)\ **Replies:** 3\ **Last updated:** [February 17, 2022, 1:38pm UTC](https://discuss.elastic.co/t/migration-from-old-elk-to-elastic-cloud/297369 "2022-02-17T13:38:55Z")
Hello, We are in the process of migrating an older version of ELK to Elastic Cloud. We are already evaluating pricing, subscription model, etc. and I am getting ahead of the process with some question I have. Right now… --- ## [Aggregation across multiple indexes/indices - significant terms](https://discuss.elastic.co/t/aggregation-across-multiple-indexes-indices-significant-terms/296787)
**Author:** [@anthonyfps](https://discuss.elastic.co/u/anthonyfps)\ **Replies:** 4\ **Last updated:** [February 17, 2022, 1:25pm UTC](https://discuss.elastic.co/t/aggregation-across-multiple-indexes-indices-significant-terms/296787 "2022-02-17T13:25:30Z")
Hi, we have indexes that are split by date for manageability but contain the same mappings. I'm currently trying to use the significant terms aggregation to identify new terms, by specifying the foreground as e.g. the l… --- ## [Index pattern issue](https://discuss.elastic.co/t/index-pattern-issue/297339)
**Author:** [@Barak\_Katz](https://discuss.elastic.co/u/Barak_Katz)\ **Replies:** 3\ **Last updated:** [February 17, 2022, 12:57pm UTC](https://discuss.elastic.co/t/index-pattern-issue/297339 "2022-02-17T12:57:17Z")
Hi, I am using Kibana: v 7.9.1. After I created an index pattern I am navigating to a blank page, in other words I can't see the configuration of the inext pattern. Moreover I tried to delete that specific index patte… --- ## [Forcasting reindexing](https://discuss.elastic.co/t/forcasting-reindexing/297433)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 2\ **Last updated:** [February 17, 2022, 11:53am UTC](https://discuss.elastic.co/t/forcasting-reindexing/297433 "2022-02-17T11:53:45Z")
Good morning I need to know if there is a way to reindex the data in the forcasting module of machinelearning - kibana, I need to extract the data and index it in another index or reindex it. I look forward to your pro… --- ## [Cutoff Frequency for match queries](https://discuss.elastic.co/t/cutoff-frequency-for-match-queries/296529)
**Author:** [@Brodin](https://discuss.elastic.co/u/Brodin)\ **Replies:** 5\ **Last updated:** [February 17, 2022, 11:21am UTC](https://discuss.elastic.co/t/cutoff-frequency-for-match-queries/296529 "2022-02-17T11:21:48Z")
According to this Match query | Elasticsearch Guide \[7.17\] | Elastic Cutoff frequency is deprecated and no longer needed, however I am seeing vastly different result for my match query when I remove it. So which one is… --- ## [My cluster keep dropping node and changing master "failed to writeCluster State"](https://discuss.elastic.co/t/my-cluster-keep-dropping-node-and-changing-master-failed-to-writecluster-state/297219)
**Author:** [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\ **Replies:** 8\ **Last updated:** [February 17, 2022, 11:13am UTC](https://discuss.elastic.co/t/my-cluster-keep-dropping-node-and-changing-master-failed-to-writecluster-state/297219 "2022-02-17T11:13:45Z")
Hello, My cluster keep dropping one node randomly everytime, which made the stack instable, sometimes it takes more than 3 hours to rejoin that node and recover. My cluster compose of 4 nodes : 1 coordinator . 3 data… --- ## [Fleet agent custom log integration multiline settings](https://discuss.elastic.co/t/fleet-agent-custom-log-integration-multiline-settings/297124)
**Author:** [@thwint](https://discuss.elastic.co/u/thwint)\ **Replies:** 1\ **Last updated:** [February 17, 2022, 10:02am UTC](https://discuss.elastic.co/t/fleet-agent-custom-log-integration-multiline-settings/297124 "2022-02-17T10:02:55Z")
Hello all, I try to setup a custom log policy for our java logs. Previously we used filebeat and had the following lines in filebeat.yml to configure multiline log entries: multiline: match: after negate: tru… --- ## [Logstash send data to 2 elastic search clusters](https://discuss.elastic.co/t/logstash-send-data-to-2-elastic-search-clusters/297468)
**Author:** [@gangireddy\_l](https://discuss.elastic.co/u/gangireddy_l)\ **Replies:** 0\ **Last updated:** [February 17, 2022, 9:57am UTC](https://discuss.elastic.co/t/logstash-send-data-to-2-elastic-search-clusters/297468 "2022-02-17T09:57:09Z")
HI Team, I have a scenario to send same logs to both production and preproduction elastic cluster, Is there any possibility to do that. Regards, Reddy --- ## [Access to Netty4Plugin(transport-netty4) in custom plugins to run test codes with RestClient and ESIntegTestCase in version 8.0.0](https://discuss.elastic.co/t/access-to-netty4plugin-transport-netty4-in-custom-plugins-to-run-test-codes-with-restclient-and-esintegtestcase-in-version-8-0-0/297288)
**Author:** [@harori](https://discuss.elastic.co/u/harori)\ **Replies:** 1\ **Last updated:** [February 17, 2022, 9:42am UTC](https://discuss.elastic.co/t/access-to-netty4plugin-transport-netty4-in-custom-plugins-to-run-test-codes-with-restclient-and-esintegtestcase-in-version-8-0-0/297288 "2022-02-17T09:42:45Z")
Hello! First of all, I'd like to say thank you for maintaining such great projects and communities. I'm big fan of Elasticsearch. I wrote several custom plugins for Elasticsearch, and I have some test codes which use E… --- ## [Logstash could not receive log after several minutes](https://discuss.elastic.co/t/logstash-could-not-receive-log-after-several-minutes/297462)
**Author:** [@Stevenssssss](https://discuss.elastic.co/u/Stevenssssss)\ **Replies:** 1\ **Last updated:** [February 17, 2022, 9:37am UTC](https://discuss.elastic.co/t/logstash-could-not-receive-log-after-several-minutes/297462 "2022-02-17T09:37:02Z")
Hi, my logstash is able to receive the log when the service is started. However after several minutes, it could not receive the log. I could not find any error message in syslog or logstash-plain.log. I then run the /us… --- ## [Adding replicas during forcemerge - is this supposed to happen?](https://discuss.elastic.co/t/adding-replicas-during-forcemerge-is-this-supposed-to-happen/297464)
**Author:** [@nisow95612](https://discuss.elastic.co/u/nisow95612)\ **Replies:** 0\ **Last updated:** [February 17, 2022, 9:36am UTC](https://discuss.elastic.co/t/adding-replicas-during-forcemerge-is-this-supposed-to-happen/297464 "2022-02-17T09:36:53Z")
Hello nice people of Elasticsearch. Recently I accidentally upped the number of replicas from 0 to 1 during a forcemerge. End result: Replica got created from non-merged primary and stayed unmerged. Is this supposed… --- ## ["existing\_package" spam](https://discuss.elastic.co/t/existing-package-spam/297455)
**Author:** [@ziv1](https://discuss.elastic.co/u/ziv1)\ **Replies:** 0\ **Last updated:** [February 17, 2022, 8:55am UTC](https://discuss.elastic.co/t/existing-package-spam/297455 "2022-02-17T08:55:45Z")
Hi, Earlier today from the server I'm testing Auditbeat on, I got a spam of several hundred "existing\_package" events. (For reference, RHEL) I get the exact same spam every day. Considering it was around 5AM, I don't … --- ## [plugins.scanDirs is deprecated and is no longer used](https://discuss.elastic.co/t/plugins-scandirs-is-deprecated-and-is-no-longer-used/297457)
**Author:** [@Usman18](https://discuss.elastic.co/u/Usman18)\ **Replies:** 1\ **Last updated:** [February 17, 2022, 9:04am UTC](https://discuss.elastic.co/t/plugins-scandirs-is-deprecated-and-is-no-longer-used/297457 "2022-02-17T09:04:31Z")
How to get rid of this deprecation warning. I am using kibana 7.15.2 "type":"log","@timestamp":"2022-02-17T08:10:42+00:00","tags":\["warning","config","deprecation"\],"pid":8,"message":"plugins.scanDirs is deprecated and … --- ## [Lucene query syntax won't work](https://discuss.elastic.co/t/lucene-query-syntax-wont-work/296828)
**Author:** [@Martin\_Miloshev](https://discuss.elastic.co/u/Martin_Miloshev)\ **Replies:** 2\ **Last updated:** [February 17, 2022, 9:00am UTC](https://discuss.elastic.co/t/lucene-query-syntax-wont-work/296828 "2022-02-17T09:00:21Z")
Hi guys! I am trying to specify a table which I want to meet an amount of logs of three fields. for example: metadata.environment: "prod" and metadata.component: "my-services" and level:"ERROR" Unfortunately, i get n… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1047) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1049)