# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1062 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1063 --- ## [Removing non-numeric characters from a field not working in logstash](https://discuss.elastic.co/t/removing-non-numeric-characters-from-a-field-not-working-in-logstash/296648)
**Author:** [@curiousmind](https://discuss.elastic.co/u/curiousmind)\ **Replies:** 1\ **Last updated:** [February 8, 2022, 6:49pm UTC](https://discuss.elastic.co/t/removing-non-numeric-characters-from-a-field-not-working-in-logstash/296648 "2022-02-08T18:49:42Z")
need an urgent help.I am getting this error \[2022-02-08T18:25:01,995\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\] Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>"xjmdwt2/wbqlYsoFmJO31K… --- ## [ECK Deployment on Openshift using https://www.elastic.co/guide/en/cloud-on-k8s/1.9/k8s-openshift-deploy-elasticsearch.html](https://discuss.elastic.co/t/eck-deployment-on-openshift-using-https-www-elastic-co-guide-en-cloud-on-k8s-1-9-k8s-openshift-deploy-elasticsearch-html/296644)
**Author:** [@Ganesh\_Sharma](https://discuss.elastic.co/u/Ganesh_Sharma)\ **Replies:** 2\ **Last updated:** [February 8, 2022, 6:35pm UTC](https://discuss.elastic.co/t/eck-deployment-on-openshift-using-https-www-elastic-co-guide-en-cloud-on-k8s-1-9-k8s-openshift-deploy-elasticsearch-html/296644 "2022-02-08T18:35:37Z")
Please can someone confirm if this is a valid Elasticsearch deployment for Openshift? Please advise as I am stuck since couple of days. --- apiVersion: route.openshift.io/v1 kind: Route metadata: name: elasticsearch … --- ## [Pipeline with id \[y\] does not exist](https://discuss.elastic.co/t/pipeline-with-id-y-does-not-exist/296625)
**Author:** [@Jarbird](https://discuss.elastic.co/u/Jarbird)\ **Replies:** 4\ **Last updated:** [February 8, 2022, 5:53pm UTC](https://discuss.elastic.co/t/pipeline-with-id-y-does-not-exist/296625 "2022-02-08T17:53:29Z")
Hello, I've found multiple topics about this very issue however I don't really see a solution. I'm also having a little difficulty understanding it all as I'm fairly new at this. I have each of the ELK components runni… --- ## [I am trying to create a custom function, how to multiply and sum two vectors in painless](https://discuss.elastic.co/t/i-am-trying-to-create-a-custom-function-how-to-multiply-and-sum-two-vectors-in-painless/296647)
**Author:** [@Marco\_Ramos](https://discuss.elastic.co/u/Marco_Ramos)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 5:46pm UTC](https://discuss.elastic.co/t/i-am-trying-to-create-a-custom-function-how-to-multiply-and-sum-two-vectors-in-painless/296647 "2022-02-08T17:46:44Z")
vector a = \[1,2,3,4,5\] vector b=\[2,2,2,2,2\] result =sum(a\*b) --- ## [Extracting some JSON fields from the message](https://discuss.elastic.co/t/extracting-some-json-fields-from-the-message/296479)
**Author:** [@hs\_shaikh](https://discuss.elastic.co/u/hs_shaikh)\ **Replies:** 6\ **Last updated:** [February 8, 2022, 5:37pm UTC](https://discuss.elastic.co/t/extracting-some-json-fields-from-the-message/296479 "2022-02-08T17:37:21Z")
Hello there, I want to extract "applicationOwner" and "proxyResponseCode" JSON fields from my message My message filed look like this: message": "TID: \[-1234\] \[2022-02-07 18:59:15,667\] INFO {org.wso2.am.analytics.pub… --- ## [How to filter single line json?](https://discuss.elastic.co/t/how-to-filter-single-line-json/296242)
**Author:** [@jeromeat](https://discuss.elastic.co/u/jeromeat)\ **Replies:** 4\ **Last updated:** [February 8, 2022, 5:21pm UTC](https://discuss.elastic.co/t/how-to-filter-single-line-json/296242 "2022-02-08T17:21:28Z")
I am trying to figure out how to filter this single line of json data I have been able to pull via http\_poller. I've obfuscated the data, but this is the format it's coming in as. I've never utilized a filter before, so… --- ## [Filebeat 8.0.0-rc2 dynamic data stream name](https://discuss.elastic.co/t/filebeat-8-0-0-rc2-dynamic-data-stream-name/296397)
**Author:** [@WouterAA](https://discuss.elastic.co/u/WouterAA)\ **Replies:** 7\ **Last updated:** [February 8, 2022, 4:53pm UTC](https://discuss.elastic.co/t/filebeat-8-0-0-rc2-dynamic-data-stream-name/296397 "2022-02-08T16:53:14Z")
Hello, we use filebeat on a k8s cluster to store logs per namespace. On filebeat 7 we create an index per namespace. Filebeat 8.0.0-rc2 uses data streams by default, which we think is a more elegant solution. However it … --- ## [Filebeat multiple index + ilm + index\_template](https://discuss.elastic.co/t/filebeat-multiple-index-ilm-index-template/296638)
**Author:** [@cedricHA](https://discuss.elastic.co/u/cedricHA)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 4:52pm UTC](https://discuss.elastic.co/t/filebeat-multiple-index-ilm-index-template/296638 "2022-02-08T16:52:40Z")
Hello, In filebeat I use several indexes depending on the module. I use the basic filebeat model based on the indexes to keep the field architecture. filebeat-7.16.2-\* setup.template.enabled: true setup.template.nam… --- ## [How to run fleet server in insecure mode?](https://discuss.elastic.co/t/how-to-run-fleet-server-in-insecure-mode/296610)
**Author:** [@gabrielfsousa](https://discuss.elastic.co/u/gabrielfsousa)\ **Replies:** 1\ **Last updated:** [February 8, 2022, 4:48pm UTC](https://discuss.elastic.co/t/how-to-run-fleet-server-in-insecure-mode/296610 "2022-02-08T16:48:12Z")
Im running fleet server in docker with this env --env FLEET\_ENROLL=1\\ --env FLEET\_SERVER\_ENABLE=1\\ --env FLEET\_SERVER\_ELASTICSEARCH\_HOST=$(ELASTICSEARCHHOST)\\ --env FLEET\_SERVER\_SERVICE\_TOKEN=$(SERVICETOKEN)\\ --env FLEE… --- ## [Server Requirements](https://discuss.elastic.co/t/server-requirements/296341)
**Author:** [@mstarkie](https://discuss.elastic.co/u/mstarkie)\ **Replies:** 2\ **Last updated:** [February 8, 2022, 3:33pm UTC](https://discuss.elastic.co/t/server-requirements/296341 "2022-02-08T15:33:31Z")
Hi, I am new to Elasticsearch and we are planning on using it to capture all of our order flow for analytics purposes. I anticipate a data rate of about 2.1 to 3 mb/seconds with a total of 5 to 7 gb/day of data. I wan… --- ## [Filter documents that contain array with empty string](https://discuss.elastic.co/t/filter-documents-that-contain-array-with-empty-string/296562)
**Author:** [@Muhammad\_Ahmad](https://discuss.elastic.co/u/Muhammad_Ahmad)\ **Replies:** 5\ **Last updated:** [February 8, 2022, 3:54pm UTC](https://discuss.elastic.co/t/filter-documents-that-contain-array-with-empty-string/296562 "2022-02-08T15:54:14Z")
I've documents in Elasticsearch and I want to filter out the documents that contain an array of only empty strings or have nothing / empty array. #doc 1 { "\_index": "my-index-000001", "\_type": "\_doc", "\_id": "0", … --- ## [Elasticsearch-certutil http command not founds](https://discuss.elastic.co/t/elasticsearch-certutil-http-command-not-founds/296626)
**Author:** [@legos765](https://discuss.elastic.co/u/legos765)\ **Replies:** 1\ **Last updated:** [February 8, 2022, 3:45pm UTC](https://discuss.elastic.co/t/elasticsearch-certutil-http-command-not-founds/296626 "2022-02-08T15:45:25Z")
Hello, Following this instruction: I should be able to run command /bin/Elasticsearch-certutil http but it says, that only 3 commands are available: adam@ubuntu1:/etc/elasticsearch$ sudo /usr/share/elasticsearch/bin/… --- ## [ConfigurationError: Could not connect to a compatible version of Elasticsearch](https://discuss.elastic.co/t/configurationerror-could-not-connect-to-a-compatible-version-of-elasticsearch/296624)
**Author:** [@marwan](https://discuss.elastic.co/u/marwan)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 3:34pm UTC](https://discuss.elastic.co/t/configurationerror-could-not-connect-to-a-compatible-version-of-elasticsearch/296624 "2022-02-08T15:34:16Z")
Hi guys, I have a subscription to elastic cloud I'm trying to send logs from our Kubernetes on aws to our elastic cloud account. The main image i use is : docker.elastic.co/logstash/logstash-oss:7.17.0 my output o… --- ## [Chart data disappears or shows up very differently when setting smaller timeframe](https://discuss.elastic.co/t/chart-data-disappears-or-shows-up-very-differently-when-setting-smaller-timeframe/296412)
**Author:** [@aqiank](https://discuss.elastic.co/u/aqiank)\ **Replies:** 22\ **Last updated:** [February 8, 2022, 3:12pm UTC](https://discuss.elastic.co/t/chart-data-disappears-or-shows-up-very-differently-when-setting-smaller-timeframe/296412 "2022-02-08T15:12:09Z")
Hi, I'm using Kibana 7.17.0. it seems like the chart area in Kibana disappears when setting timeframe around 5 minutes (2nd screenshot). When I set it slightly longer than that (3rd screenshot), it doesn't seem to show t… --- ## [HA/redundancy on Logstash when pulling data](https://discuss.elastic.co/t/ha-redundancy-on-logstash-when-pulling-data/295754)
**Author:** [@jdswifty](https://discuss.elastic.co/u/jdswifty)\ **Replies:** 2\ **Last updated:** [February 8, 2022, 2:17pm UTC](https://discuss.elastic.co/t/ha-redundancy-on-logstash-when-pulling-data/295754 "2022-02-08T14:17:17Z")
Looking to see how others might have approached this topic in the past. For examples sake I have 2 logstash nodes running in a hot/cold standby mode that run the exact same (centrally managed) pipelines that pull data f… --- ## [Use Case : Records are more than 10000 with pagination](https://discuss.elastic.co/t/use-case-records-are-more-than-10000-with-pagination/296207)
**Author:** [@Swapnil\_Javal](https://discuss.elastic.co/u/Swapnil_Javal)\ **Replies:** 1\ **Last updated:** [February 8, 2022, 2:03pm UTC](https://discuss.elastic.co/t/use-case-records-are-more-than-10000-with-pagination/296207 "2022-02-08T14:03:28Z")
In My use case, We are implementing pagination with Elasticsearch. If the user clicks on any page number then he will get that set of records on UI. e.g. there is page size is 10 and we click on Page number 2 then 11 to… --- ## [How to mock responses in Nest like IndexResponse](https://discuss.elastic.co/t/how-to-mock-responses-in-nest-like-indexresponse/296609)
**Author:** [@Another-Ralf](https://discuss.elastic.co/u/Another-Ralf)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 1:54pm UTC](https://discuss.elastic.co/t/how-to-mock-responses-in-nest-like-indexresponse/296609 "2022-02-08T13:54:35Z")
I'm using the .Net Nest client to connect to an Elasticsearch instance. I want to test my code that is calling Nest and wanted to mock Nest away. Currently fighting with mocking the ElasticClient.IndexAsync method. It… --- ## [GROK Expression Invalid JSON](https://discuss.elastic.co/t/grok-expression-invalid-json/296603)
**Author:** [@jamesm1](https://discuss.elastic.co/u/jamesm1)\ **Replies:** 1\ **Last updated:** [February 8, 2022, 1:39pm UTC](https://discuss.elastic.co/t/grok-expression-invalid-json/296603 "2022-02-08T13:39:40Z")
Hello - I am attempting to create a GROK expression for an APACHE log. I have gotten the expression working in the GROK debugger and other tools - However when i try to add it in as a line into the Ingestion Pipeline i … --- ## [Help: Format The Watcher Email Body Section](https://discuss.elastic.co/t/help-format-the-watcher-email-body-section/295565)
**Author:** [@appleyin1](https://discuss.elastic.co/u/appleyin1)\ **Replies:** 1\ **Last updated:** [February 8, 2022, 1:36pm UTC](https://discuss.elastic.co/t/help-format-the-watcher-email-body-section/295565 "2022-02-08T13:36:04Z")
Hi there: I'm currently using this code {{ctx.payload.payload\_result}} in my email body to print out the health check status but the format is not ideal (see below), is there a way I can organize it nicely(see proposed … --- ## [Use JSON in Watcher webhook body](https://discuss.elastic.co/t/use-json-in-watcher-webhook-body/295349)
**Author:** [@rosaLux161](https://discuss.elastic.co/u/rosaLux161)\ **Replies:** 1\ **Last updated:** [February 8, 2022, 1:35pm UTC](https://discuss.elastic.co/t/use-json-in-watcher-webhook-body/295349 "2022-02-08T13:35:03Z")
How is it possible to use plain JSON in Watcher webhook body? Just putting the plain JSON in the body { \[...\] "actions":{ "opsgenie":{ "webhook":{ "method":"POST", "ho… --- ## [Access denied error message for mail IDs](https://discuss.elastic.co/t/access-denied-error-message-for-mail-ids/295540)
**Author:** [@Diyatom](https://discuss.elastic.co/u/Diyatom)\ **Replies:** 1\ **Last updated:** [February 8, 2022, 1:34pm UTC](https://discuss.elastic.co/t/access-denied-error-message-for-mail-ids/295540 "2022-02-08T13:34:17Z")
Hi Everyone, I am trying to send a mail from a watcher alert to my personal mail iD but it gives the following error : "type": "s\_m\_t\_p\_address\_failed\_exception", "reason": "554 5.7.1 \:… --- ## [Unable to monitor all logstash pipelines](https://discuss.elastic.co/t/unable-to-monitor-all-logstash-pipelines/296491)
**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Replies:** 3\ **Last updated:** [February 8, 2022, 1:33pm UTC](https://discuss.elastic.co/t/unable-to-monitor-all-logstash-pipelines/296491 "2022-02-08T13:33:23Z")
Dears, I have 7 logstash and deployed metricbeat on all of them for monitoring purpose. out of all these on one logstash i am getting only pipeline in monitoring (5 pipelines are present on this logstash node) all the … --- ## [Limit privileges for ElasticSearch Service API Key](https://discuss.elastic.co/t/limit-privileges-for-elasticsearch-service-api-key/296599)
**Author:** [@sz\_bb](https://discuss.elastic.co/u/sz_bb)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 1:21pm UTC](https://discuss.elastic.co/t/limit-privileges-for-elasticsearch-service-api-key/296599 "2022-02-08T13:21:35Z")
Elastic Cloud. need to be able to register secrets in the Elasticsearch Keystore. This can be done with the ElasticSearch Service API. However, in order to use this API you create an Api Key. The API key has no expira… --- ## [Index Frequency & Rollover](https://discuss.elastic.co/t/index-frequency-rollover/296598)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 1:17pm UTC](https://discuss.elastic.co/t/index-frequency-rollover/296598 "2022-02-08T13:17:33Z")
If you have an ILM policy set to the default rollover settings (30 days or 50 GB), how should you configure your indexing in the LogStash output to align with that? Here's what I mean... if you have the following output … --- ## [Aggregating object keys to achieve a sum](https://discuss.elastic.co/t/aggregating-object-keys-to-achieve-a-sum/296193)
**Author:** [@hugomeloo](https://discuss.elastic.co/u/hugomeloo)\ **Replies:** 5\ **Last updated:** [February 8, 2022, 1:10pm UTC](https://discuss.elastic.co/t/aggregating-object-keys-to-achieve-a-sum/296193 "2022-02-08T13:10:32Z")
I am trying to make an aggregation in which I can sum a number from a specific key of an object. As an example: curl -XPUT "localhost:9200/products/\_mapping" -H 'Content-Type: application/json' -d' { "properties": { … --- ## [Kibana - maximum amount of values in the DSL terms search](https://discuss.elastic.co/t/kibana-maximum-amount-of-values-in-the-dsl-terms-search/296585)
**Author:** [@InesCM](https://discuss.elastic.co/u/InesCM)\ **Replies:** 2\ **Last updated:** [February 8, 2022, 12:45pm UTC](https://discuss.elastic.co/t/kibana-maximum-amount-of-values-in-the-dsl-terms-search/296585 "2022-02-08T12:45:55Z")
Hi! I'm trying to do a DSL filter in Kibana, in order to filter by a large amount of values on a specific field. For this, I'm using this syntax: { "query": { "bool": { "filter": { "terms": { … --- ## [With final\_pipeline and a pipeline specified, the final pipeline appears to be running twice with index date math processor](https://discuss.elastic.co/t/with-final-pipeline-and-a-pipeline-specified-the-final-pipeline-appears-to-be-running-twice-with-index-date-math-processor/296593)
**Author:** [@ed.yoo](https://discuss.elastic.co/u/ed.yoo)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 12:20pm UTC](https://discuss.elastic.co/t/with-final-pipeline-and-a-pipeline-specified-the-final-pipeline-appears-to-be-running-twice-with-index-date-math-processor/296593 "2022-02-08T12:20:13Z")
Testing on 7.6.2, the following code works fine in using a final\_pipeline and a pipeline for the index. Using the same code and updated index template code, it actually appears to run twice on 7.15.2 (and 7.16.0). The … --- ## [Configuring aerospike metricbeat module with TLS](https://discuss.elastic.co/t/configuring-aerospike-metricbeat-module-with-tls/294729)
**Author:** [@sentient](https://discuss.elastic.co/u/sentient)\ **Replies:** 2\ **Last updated:** [February 8, 2022, 11:45am UTC](https://discuss.elastic.co/t/configuring-aerospike-metricbeat-module-with-tls/294729 "2022-02-08T11:45:19Z")
I am looking at the code and trying to figure out how I should configure TLS certificates to get access to the aerospike service endpoint with TLS configured. Does anybody have a successful module configuration exampl… --- ## [Transforms on data older than a specific timestamp: checkpoints are not created](https://discuss.elastic.co/t/transforms-on-data-older-than-a-specific-timestamp-checkpoints-are-not-created/296483)
**Author:** [@paulov](https://discuss.elastic.co/u/paulov)\ **Replies:** 2\ **Last updated:** [February 8, 2022, 10:29am UTC](https://discuss.elastic.co/t/transforms-on-data-older-than-a-specific-timestamp-checkpoints-are-not-created/296483 "2022-02-08T10:29:09Z")
Continuing the discussion from ES Continuous Transforms Checkpoint not updating: Hi, I'm creating a transform job that transforms data in an index and takes all documents OLDER THAN 6 days (calculating averages etc). … --- ## [Why doesn't we run 'Basic' any longer, but 'Trial'?](https://discuss.elastic.co/t/why-doesnt-we-run-basic-any-longer-but-trial/296572)
**Author:** [@fribse](https://discuss.elastic.co/u/fribse)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 10:10am UTC](https://discuss.elastic.co/t/why-doesnt-we-run-basic-any-longer-but-trial/296572 "2022-02-08T10:10:45Z")
I followed this guide (to set up Elasticsearch with ssl, which I understand is now required for 7.16.+): Encrypting communications in an Elasticsearch Docker Container | Elasticsearch Guide \[7.17\] | Elastic It sets it u… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1061) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1063)