# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1070 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1071 --- ## [Body optimisation with nested objects / filter](https://discuss.elastic.co/t/body-optimisation-with-nested-objects-filter/295964)
**Author:** [@Emporea](https://discuss.elastic.co/u/Emporea)\ **Replies:** 5\ **Last updated:** [February 2, 2022, 12:09pm UTC](https://discuss.elastic.co/t/body-optimisation-with-nested-objects-filter/295964 "2022-02-02T12:09:22Z")
I have a working query, what I am asking is if there is a more simple way for my query. I dont understand why using filter has to be so complicated. Am I missing something? I have such a terribly nested body. I have an… --- ## [Repo register issue](https://discuss.elastic.co/t/repo-register-issue/296016)
**Author:** [@Levan\_Medoshvili](https://discuss.elastic.co/u/Levan_Medoshvili)\ **Replies:** 5\ **Last updated:** [February 2, 2022, 11:41am UTC](https://discuss.elastic.co/t/repo-register-issue/296016 "2022-02-02T11:41:26Z")
Hello I have Elasticsearch installed in Windows Server. I want to take snapshot and restore it in another server. I have added in Elasticsearch.yml file path.repo and location path.repo: "D:\\ES\_Backup" When I am try… --- ## [Filebeat filtering, drop event processor script](https://discuss.elastic.co/t/filebeat-filtering-drop-event-processor-script/295538)
**Author:** [@finiteAutomate](https://discuss.elastic.co/u/finiteAutomate)\ **Replies:** 11\ **Last updated:** [February 2, 2022, 10:58am UTC](https://discuss.elastic.co/t/filebeat-filtering-drop-event-processor-script/295538 "2022-02-02T10:58:57Z")
Hello team, Im new on filebeat and i want to ask about processor script on filebeat. I have a log file that contains some event.code. i want to exclude 3 event code based on this condition below from my log event.code… --- ## [Split and get part of a long string in painless](https://discuss.elastic.co/t/split-and-get-part-of-a-long-string-in-painless/295575)
**Author:** [@auato](https://discuss.elastic.co/u/auato)\ **Replies:** 17\ **Last updated:** [February 2, 2022, 10:36am UTC](https://discuss.elastic.co/t/split-and-get-part-of-a-long-string-in-painless/295575 "2022-02-02T10:36:49Z")
Hi, I would like to get from the following examples of string a specific part (in bold) in painless script in Kibana: APAC42\_OM/VM:Virtual machine name=APAC42\_ELETYPE\_\*\*CSBBU\*\*\_0 APAC42\_OM/VM:Virtual machine name=APAC42… --- ## [Elasticsearch upgrade 7.16.2](https://discuss.elastic.co/t/elasticsearch-upgrade-7-16-2/296042)
**Author:** [@Vaibhav\_Yadav](https://discuss.elastic.co/u/Vaibhav_Yadav)\ **Replies:** 3\ **Last updated:** [February 2, 2022, 10:31am UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-7-16-2/296042 "2022-02-02T10:31:53Z")
How to upgrade Elasticsearch 7.10 to Elasticsearch 7.16.2 on the Windows platform? --- ## [Filebeat: Exiting: Error while initializing input: Error creating input. No such input type exist: 'aws-cloudwatch'](https://discuss.elastic.co/t/filebeat-exiting-error-while-initializing-input-error-creating-input-no-such-input-type-exist-aws-cloudwatch/295942)
**Author:** [@h4rdl0ck](https://discuss.elastic.co/u/h4rdl0ck)\ **Replies:** 7\ **Last updated:** [February 2, 2022, 10:24am UTC](https://discuss.elastic.co/t/filebeat-exiting-error-while-initializing-input-error-creating-input-no-such-input-type-exist-aws-cloudwatch/295942 "2022-02-02T10:24:30Z")
Hello everyone, filebeat stopped because it supposedly doesn't exist for the input type aws-cloudwatch. That's the error-messsage: 2022-02-01T11:02:36.673Z ERROR instance/beat.go:933 Exiting: Error while initializing i… --- ## [Upgrading NGINX for Elasticsearch server vulnerability](https://discuss.elastic.co/t/upgrading-nginx-for-elasticsearch-server-vulnerability/296046)
**Author:** [@Jane\_Garcia](https://discuss.elastic.co/u/Jane_Garcia)\ **Replies:** 1\ **Last updated:** [February 2, 2022, 9:57am UTC](https://discuss.elastic.co/t/upgrading-nginx-for-elasticsearch-server-vulnerability/296046 "2022-02-02T09:57:47Z")
We have nginx 0.6.x \< 1.20.1 1-Byte Memory Overwrite RCE vulnerability for Elasticsearch server (v. 2.4.6) as mentioned in nginx 0.6.x \< 1.20.1 1-Byte Memory Overwrite RCE | Tenable® we need to upgrade to 1.20.1 or late… --- ## [Split chart order by not working anymore?](https://discuss.elastic.co/t/split-chart-order-by-not-working-anymore/295868)
**Author:** [@ncasaux](https://discuss.elastic.co/u/ncasaux)\ **Replies:** 2\ **Last updated:** [February 2, 2022, 9:50am UTC](https://discuss.elastic.co/t/split-chart-order-by-not-working-anymore/295868 "2022-02-02T09:50:33Z")
Hello, I'm using the 7.16.3 versions of Kibana and Elasticsearch. The "order by" of the "split chart" bucket in a bar chart does not seem to work properly anymore. In my usecase, I'm using a "Custom metric" to do the… --- ## [Elastic-agent - Elasticsearch node monitoring with Elasticsearch integration](https://discuss.elastic.co/t/elastic-agent-elasticsearch-node-monitoring-with-elasticsearch-integration/295081)
**Author:** [@fselim](https://discuss.elastic.co/u/fselim)\ **Replies:** 2\ **Last updated:** [February 2, 2022, 9:34am UTC](https://discuss.elastic.co/t/elastic-agent-elasticsearch-node-monitoring-with-elasticsearch-integration/295081 "2022-02-02T09:34:24Z")
Hello, I'm new to the concept of the elastic-agent and I've read through the documentation. With that I've spinned up a fleet server with functioning APM integration and system logs/metrics collection. Now I'm coming t… --- ## [Reset password api is not working](https://discuss.elastic.co/t/reset-password-api-is-not-working/296028)
**Author:** [@Sunil\_Bhakar](https://discuss.elastic.co/u/Sunil_Bhakar)\ **Replies:** 3\ **Last updated:** [February 2, 2022, 9:12am UTC](https://discuss.elastic.co/t/reset-password-api-is-not-working/296028 "2022-02-02T09:12:27Z")
{ "error" : { "root\_cause" : \[ { "type" : "status\_exception", "reason" : "Cluster state has not been recovered yet, cannot write to the \[null\] index" } \], "type" : "status\_exception", "reason" : "Cluster state h… --- ## [How to create grok/json filter to parse the below json format](https://discuss.elastic.co/t/how-to-create-grok-json-filter-to-parse-the-below-json-format/296022)
**Author:** [@Adabi\_Raihan](https://discuss.elastic.co/u/Adabi_Raihan)\ **Replies:** 9\ **Last updated:** [February 2, 2022, 8:49am UTC](https://discuss.elastic.co/t/how-to-create-grok-json-filter-to-parse-the-below-json-format/296022 "2022-02-02T08:49:28Z")
Hi Guys, I want to parse this JSON to Kibana using Logstash { "Format": "IDEA0", "ID": "2b03eb1f-fc4c-4f67-94e5-31c9fb32dccc", "DetectTime": "2022-01-31T08:16:12.600470+07:00", "EventTime": "2022-01-31T01:23:01.637438+… --- ## [Kibana Lens Dashboard new headline with other values/filter](https://discuss.elastic.co/t/kibana-lens-dashboard-new-headline-with-other-values-filter/295950)
**Author:** [@zangero98](https://discuss.elastic.co/u/zangero98)\ **Replies:** 2\ **Last updated:** [February 2, 2022, 8:04am UTC](https://discuss.elastic.co/t/kibana-lens-dashboard-new-headline-with-other-values-filter/295950 "2022-02-02T08:04:58Z")
Hello, i want to add a new headline here, where i can check other fields. But i don't want a new column on the right but a new headline that is independent so I can place customs counts... in it. It should look like… --- ## [Fallback value for a bucket aggregation](https://discuss.elastic.co/t/fallback-value-for-a-bucket-aggregation/295983)
**Author:** [@Andrew\_Graham-Yooll](https://discuss.elastic.co/u/Andrew_Graham-Yooll)\ **Replies:** 4\ **Last updated:** [February 2, 2022, 7:51am UTC](https://discuss.elastic.co/t/fallback-value-for-a-bucket-aggregation/295983 "2022-02-02T07:51:22Z")
I know this query works. However it does not work when the value of either "failed" or "declined" is not present. GET /metrics-\*/\_search { "size": 0, "query": { "bool": { "filter": \[ { "t… --- ## [Split fields in different docs](https://discuss.elastic.co/t/split-fields-in-different-docs/295895)
**Author:** [@cris](https://discuss.elastic.co/u/cris)\ **Replies:** 8\ **Last updated:** [February 2, 2022, 6:23am UTC](https://discuss.elastic.co/t/split-fields-in-different-docs/295895 "2022-02-02T06:23:54Z")
Hello friends. I am trying to reindex some data to another index but with a little differences. In the first index I have this kind of hit: { "France": { "Testing": { "status": "passed" } }, "Spain"… --- ## [Logstash is terminating with EACCES Permission denied](https://discuss.elastic.co/t/logstash-is-terminating-with-eacces-permission-denied/296032)
**Author:** [@HELIXInternational](https://discuss.elastic.co/u/HELIXInternational)\ **Replies:** 0\ **Last updated:** [February 2, 2022, 6:48am UTC](https://discuss.elastic.co/t/logstash-is-terminating-with-eacces-permission-denied/296032 "2022-02-02T06:48:00Z")
Hi All, logstash javapipeline is terminating Please can anyone help on this issue, It will be much helpful for us. logstash-plain \[2022-02-01T08:06:01,333\]\[INFO \]\[logstash.runner \] Log4j configuration path u… --- ## [Same IPs are showing in stack monitoring](https://discuss.elastic.co/t/same-ips-are-showing-in-stack-monitoring/295803)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 3\ **Last updated:** [February 2, 2022, 5:37am UTC](https://discuss.elastic.co/t/same-ips-are-showing-in-stack-monitoring/295803 "2022-02-02T05:37:09Z")
Running ELK stack 7.15.2 version I have 3 master node and 3 data nodes and 2 warm nodes.Metricbeat is running in all master nodes.Metricbeat version is 7.15.2. /etc/metricbeat/metricbeat.yml file #####################… --- ## [How to convert transformed index pattern from keyword/string-\>long?](https://discuss.elastic.co/t/how-to-convert-transformed-index-pattern-from-keyword-string-long/295985)
**Author:** [@MLsuper](https://discuss.elastic.co/u/MLsuper)\ **Replies:** 1\ **Last updated:** [February 2, 2022, 3:15am UTC](https://discuss.elastic.co/t/how-to-convert-transformed-index-pattern-from-keyword-string-long/295985 "2022-02-02T03:15:05Z")
I'm trying to convert a field that is a keyword to a long but I cannot edit it, it is fixed in the transform index. So I tried to use a ingest node pipeline which use convert keyword to long but how do I use that ingest… --- ## [Elasticsearch: Configurations when adding new nodes to a running cluster (Discovery)](https://discuss.elastic.co/t/elasticsearch-configurations-when-adding-new-nodes-to-a-running-cluster-discovery/295901)
**Author:** [@ege](https://discuss.elastic.co/u/ege)\ **Replies:** 2\ **Last updated:** [February 2, 2022, 3:05am UTC](https://discuss.elastic.co/t/elasticsearch-configurations-when-adding-new-nodes-to-a-running-cluster-discovery/295901 "2022-02-02T03:05:01Z")
I have an Elastic cluster with 2 dedicated Master nodes and 2 dedicated Data nodes. I'm currently trying to add 4 new nodes to this running cluster. In the documentation, I have seen there should be at least 3 Master no… --- ## [Grok timeout for long messages](https://discuss.elastic.co/t/grok-timeout-for-long-messages/296009)
**Author:** [@Victorv18](https://discuss.elastic.co/u/Victorv18)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 11:57pm UTC](https://discuss.elastic.co/t/grok-timeout-for-long-messages/296009 "2022-02-01T23:57:02Z")
I have a grok filter parsing logs from a DB2 AIX server, and the logs are sent to Logstash in the .txt format, the file contains a lot of log messages, separated by a timestamp parameter And i receive a timeout message … --- ## [Elasticsearch 7.16.3 Log4j Vulnerability log4j-core-2.11.1.jar still persists](https://discuss.elastic.co/t/elasticsearch-7-16-3-log4j-vulnerability-log4j-core-2-11-1-jar-still-persists/295184)
**Author:** [@pavank](https://discuss.elastic.co/u/pavank)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 10:02pm UTC](https://discuss.elastic.co/t/elasticsearch-7-16-3-log4j-vulnerability-log4j-core-2-11-1-jar-still-persists/295184 "2022-02-01T22:02:28Z")
Hi Team, In the wake of recent log4j vulnerability, we have update our production stack to version 7.16.3. Post upgrade, under /usr/share/Elasticsearch/lib/ the log4j-core is of version 2.17.1. However in /etc/elastic… --- ## [Cannot search on field \[log.original\] since it is not indexed](https://discuss.elastic.co/t/cannot-search-on-field-log-original-since-it-is-not-indexed/295897)
**Author:** [@mevan](https://discuss.elastic.co/u/mevan)\ **Replies:** 12\ **Last updated:** [February 1, 2022, 9:32pm UTC](https://discuss.elastic.co/t/cannot-search-on-field-log-original-since-it-is-not-indexed/295897 "2022-02-01T21:32:09Z")
Hi --I am not sure how to diagnose this issue. My searching has offered no results. When I try to refine my iptables query with \> log.original: "ID=1234" I get the error: failed to create query: Cannot search on field … --- ## [Highlight exact phrases/keywords](https://discuss.elastic.co/t/highlight-exact-phrases-keywords/295982)
**Author:** [@Fidel\_Perez](https://discuss.elastic.co/u/Fidel_Perez)\ **Replies:** 0\ **Last updated:** [February 1, 2022, 6:40pm UTC](https://discuss.elastic.co/t/highlight-exact-phrases-keywords/295982 "2022-02-01T18:40:50Z")
hello everyone I want to highlight the query match but to be an exact match when words or phrases { "body": { "highlight": { "fields": { "textContent": { "fragment\_size": 150, "n… --- ## [Tagging events with extracts from grok patterns](https://discuss.elastic.co/t/tagging-events-with-extracts-from-grok-patterns/296004)
**Author:** [@zach\_trio](https://discuss.elastic.co/u/zach_trio)\ **Replies:** 0\ **Last updated:** [February 1, 2022, 9:11pm UTC](https://discuss.elastic.co/t/tagging-events-with-extracts-from-grok-patterns/296004 "2022-02-01T21:11:19Z")
Hi all, I am using Filebeat to pass logs to Logstash for parsing and ingestion into Elasticsearch. Take this config extract for example: filebeat.inputs: - type: filestream paths: - /opt/containers/sites/\*/html/var… --- ## [Error when trying to reindex old indices thru Kibana 7.0 Upgrade Assistant](https://discuss.elastic.co/t/error-when-trying-to-reindex-old-indices-thru-kibana-7-0-upgrade-assistant/295362)
**Author:** [@willdennis](https://discuss.elastic.co/u/willdennis)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 8:58pm UTC](https://discuss.elastic.co/t/error-when-trying-to-reindex-old-indices-thru-kibana-7-0-upgrade-assistant/295362 "2022-02-01T20:58:50Z")
Getting this error when trying to reindex old indexes (which were created in 5.6.x) thru Kibana's 7.0 Upgrade Assistant: \[mapper\_parsing\_exception\]\[include\_in\_all\] is not allowed for indices created on or after version … --- ## [Placeholders within \`index.lifecycle.rollover\_alias\` to generalize index templates?](https://discuss.elastic.co/t/placeholders-within-index-lifecycle-rollover-alias-to-generalize-index-templates/296001)
**Author:** [@gburtenshaw](https://discuss.elastic.co/u/gburtenshaw)\ **Replies:** 0\ **Last updated:** [February 1, 2022, 8:58pm UTC](https://discuss.elastic.co/t/placeholders-within-index-lifecycle-rollover-alias-to-generalize-index-templates/296001 "2022-02-01T20:58:00Z")
Our data is indexed on a per customer basis... for example, customer abc, xyz, etc... We are trying to use ILM rollover on these indices. The data is mutable nor is it strictly time based, so we are not using data strea… --- ## [Watcher works in simulation, but not live](https://discuss.elastic.co/t/watcher-works-in-simulation-but-not-live/296000)
**Author:** [@Mhughes01](https://discuss.elastic.co/u/Mhughes01)\ **Replies:** 0\ **Last updated:** [February 1, 2022, 8:55pm UTC](https://discuss.elastic.co/t/watcher-works-in-simulation-but-not-live/296000 "2022-02-01T20:55:49Z")
Hi Everyone, I'm somewhat new to Kibana and this is my first watcher. It's pretty simple, it looks for a hit on the previous day and if it finds one, it sends an email. When I simulate it, by setting the gte to -2d (the… --- ## [Getting different results for the same query](https://discuss.elastic.co/t/getting-different-results-for-the-same-query/295997)
**Author:** [@hamzahda](https://discuss.elastic.co/u/hamzahda)\ **Replies:** 2\ **Last updated:** [February 1, 2022, 8:53pm UTC](https://discuss.elastic.co/t/getting-different-results-for-the-same-query/295997 "2022-02-01T20:53:24Z")
When I execute this search with Postmn or the Elastic console I get different results as when I do it in a script using axios any ideas.. {"query":{"exists":{"field":"RefreshOrderNo"}}} I can't share the whole data eca… --- ## [Maximum number of concurrent reindexing tasks in ES cluster](https://discuss.elastic.co/t/maximum-number-of-concurrent-reindexing-tasks-in-es-cluster/295949)
**Author:** [@yabhishek](https://discuss.elastic.co/u/yabhishek)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 8:45pm UTC](https://discuss.elastic.co/t/maximum-number-of-concurrent-reindexing-tasks-in-es-cluster/295949 "2022-02-01T20:45:17Z")
Hi I was working with reindexing tasks and wanted to understand if ES sets any restriction on the number of concurrent reindexing tasks that can run in the cluster at any point of time and fails the new tasks if cluster… --- ## [Config logstash with elasticsearch cloud](https://discuss.elastic.co/t/config-logstash-with-elasticsearch-cloud/295962)
**Author:** [@Cheroufa](https://discuss.elastic.co/u/Cheroufa)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 8:34pm UTC](https://discuss.elastic.co/t/config-logstash-with-elasticsearch-cloud/295962 "2022-02-01T20:34:54Z")
hi guys i want to configure logstash with elasticsearch cloud to use the Centralized Pipeline Management but logstash can't reach the cloud elasticsearch cluster. logs : \[2022-02-02T16:19:25,986\]\[ERROR\]\[logstash.lice… --- ## [Failed to start Elasticsearch in AlmaLinux](https://discuss.elastic.co/t/failed-to-start-elasticsearch-in-almalinux/295995)
**Author:** [@MBekhit](https://discuss.elastic.co/u/MBekhit)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 8:24pm UTC](https://discuss.elastic.co/t/failed-to-start-elasticsearch-in-almalinux/295995 "2022-02-01T20:24:07Z")
Elasticsearch stopped working and this is a error log Feb 1 20:17:25 server33 systemd\[1\]: Starting Elasticsearch... Feb 1 20:17:30 server33 systemd-entrypoint\[93293\]: encountered \[2\] errors parsing \[/etc/elasticsearch… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1069) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1071)