# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1073 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1074 --- ## [\[JAVA\] Unexpected JSON event 'VALUE\_TRUE' instead of '\[KEY\_NAME, VALUE\_STRING\]'](https://discuss.elastic.co/t/java-unexpected-json-event-value-true-instead-of-key-name-value-string/295740)
**Author:** [@wxh](https://discuss.elastic.co/u/wxh)\ **Replies:** 10\ **Last updated:** [January 31, 2022, 5:43pm UTC](https://discuss.elastic.co/t/java-unexpected-json-event-value-true-instead-of-key-name-value-string/295740 "2022-01-31T17:43:53Z")
I am writing some code to manage Elasticsearch templates. When running the code snippet below I am getting co.elastic.clients.json.UnexpectedJsonEventException: Unexpected JSON event 'VALUE\_FALSE' instead of '\[KEY\_NAME,… --- ## [Snapshots occasionally fail](https://discuss.elastic.co/t/snapshots-occasionally-fail/295866)
**Author:** [@AnotherCorpoDrone](https://discuss.elastic.co/u/AnotherCorpoDrone)\ **Replies:** 0\ **Last updated:** [January 31, 2022, 5:20pm UTC](https://discuss.elastic.co/t/snapshots-occasionally-fail/295866 "2022-01-31T17:20:24Z")
Hi all, We're having fairly frequent issues with our pre-prod environment snapshots failing. We're using Azure as our repo, all nodes can see it and it passes the normal validation steps. I can only see a couple of lin… --- ## [7.16 Java Client - UpdateRequest example](https://discuss.elastic.co/t/7-16-java-client-updaterequest-example/295846)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 3\ **Last updated:** [January 31, 2022, 4:25pm UTC](https://discuss.elastic.co/t/7-16-java-client-updaterequest-example/295846 "2022-01-31T16:25:35Z")
Hi, I'm struggling to understand how to do an UpdateRequest with the latest java client. For example, this: client.update(new UpdateRequest.Builder\<\>() .index(index) .id(id) … --- ## [Error restoring state from URL when Opening Dashboards](https://discuss.elastic.co/t/error-restoring-state-from-url-when-opening-dashboards/295471)
**Author:** [@chjimenez](https://discuss.elastic.co/u/chjimenez)\ **Replies:** 3\ **Last updated:** [January 31, 2022, 3:31pm UTC](https://discuss.elastic.co/t/error-restoring-state-from-url-when-opening-dashboards/295471 "2022-01-31T15:31:20Z")
Hello, Since I updated from 6.8.0 to 7.16,3 always get this error " Error restoring state from URL Unable to completely restore the URL, be sure to use the share functionality." when opening any Dashboard. BUT dashboard… --- ## [Elasticsearch warning logs while stopping tomcat](https://discuss.elastic.co/t/elasticsearch-warning-logs-while-stopping-tomcat/295845)
**Author:** [@Ram\_N](https://discuss.elastic.co/u/Ram_N)\ **Replies:** 1\ **Last updated:** [January 31, 2022, 3:21pm UTC](https://discuss.elastic.co/t/elasticsearch-warning-logs-while-stopping-tomcat/295845 "2022-01-31T15:21:39Z")
Hi Im using ELK 7.10.2 and uses below code to connect to Elasticsearch using java Settings settings = Settings.builder() .put("cluster.name", elkUtil.getClusterName(Constants.ELASTICSEARCH\_YAML\_PATH)).build(); … --- ## [Only String and Array types are splittable. field:\[array\]\[method\] is of type = NilClass"](https://discuss.elastic.co/t/only-string-and-array-types-are-splittable-field-array-method-is-of-type-nilclass/295861)
**Author:** [@rutika\_kamble](https://discuss.elastic.co/u/rutika_kamble)\ **Replies:** 0\ **Last updated:** [January 31, 2022, 3:21pm UTC](https://discuss.elastic.co/t/only-string-and-array-types-are-splittable-field-array-method-is-of-type-nilclass/295861 "2022-01-31T15:21:39Z")
I am trying to input JSON data from logs through logstash to Elasticsearch but I am getting this error field:\[array\]\[method\] is of type = NilClass" Preformatted text Please find my logstash conf file- input { http { … --- ## [Iptables module not working - filebeat or elastic?](https://discuss.elastic.co/t/iptables-module-not-working-filebeat-or-elastic/295788)
**Author:** [@mevan](https://discuss.elastic.co/u/mevan)\ **Replies:** 1\ **Last updated:** [January 31, 2022, 2:13pm UTC](https://discuss.elastic.co/t/iptables-module-not-working-filebeat-or-elastic/295788 "2022-01-31T14:13:50Z")
I'm using filebeat/elastic/kibana 7.16.3 all on the same Ubuntu 20.04.3. I am receiving logs from a number of clients using the filebeat nginx and system modules but I'm having trouble with the iptables module. \*\*\* I do … --- ## [How to add field that is only present in some documents?](https://discuss.elastic.co/t/how-to-add-field-that-is-only-present-in-some-documents/295283)
**Author:** [@katja1](https://discuss.elastic.co/u/katja1)\ **Replies:** 8\ **Last updated:** [January 31, 2022, 12:38pm UTC](https://discuss.elastic.co/t/how-to-add-field-that-is-only-present-in-some-documents/295283 "2022-01-31T12:38:47Z")
Hi, I have the following situation: Logs with the same ID \[grouping ID\] and different fields. grouping ID: 1 organization: xyz message: abc grouping ID: 1 organization: xyz message: abc grouping ID: 1 … --- ## [Bulk API - can't add more than one row](https://discuss.elastic.co/t/bulk-api-cant-add-more-than-one-row/295718)
**Author:** [@yamaga](https://discuss.elastic.co/u/yamaga)\ **Replies:** 3\ **Last updated:** [January 31, 2022, 12:34pm UTC](https://discuss.elastic.co/t/bulk-api-cant-add-more-than-one-row/295718 "2022-01-31T12:34:35Z")
Hi I am trying to add some data with Bulk API, but it takes only the last record of my JSON input data. Here an example with 3 record: input data: \[ { "ID\_PROD": "15136", "UNIT": "UN", "RATE": 1 }, … --- ## [Getting separate values from single variable value in logstash](https://discuss.elastic.co/t/getting-separate-values-from-single-variable-value-in-logstash/295806)
**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\ **Replies:** 4\ **Last updated:** [January 31, 2022, 11:50am UTC](https://discuss.elastic.co/t/getting-separate-values-from-single-variable-value-in-logstash/295806 "2022-01-31T11:50:16Z")
I have log line as follows file\_name,file\_id,size,file\_owner,folder\_id,folder\_name,path\_ids,folder\_owner,deleted,date\_modified,date\_uploaded,folder\_paths nash+animal models.docx,884054786846,20068,xyz@123.com,1499863948… --- ## [Store binary files in elastic search](https://discuss.elastic.co/t/store-binary-files-in-elastic-search/295805)
**Author:** [@Arpita11](https://discuss.elastic.co/u/Arpita11)\ **Replies:** 8\ **Last updated:** [January 31, 2022, 11:36am UTC](https://discuss.elastic.co/t/store-binary-files-in-elastic-search/295805 "2022-01-31T11:36:19Z")
For my project, we are storing the data in Elasticsearch. I have new requirement regarding documents (i.e. the actual binaries): Store documents and be able to search the text within the document binary. Allow the use… --- ## [How do I use match query inside a nested aggregation?](https://discuss.elastic.co/t/how-do-i-use-match-query-inside-a-nested-aggregation/295811)
**Author:** [@dotel](https://discuss.elastic.co/u/dotel)\ **Replies:** 2\ **Last updated:** [January 31, 2022, 11:17am UTC](https://discuss.elastic.co/t/how-do-i-use-match-query-inside-a-nested-aggregation/295811 "2022-01-31T11:17:06Z")
Is there a way to do a match query inside nested aggregation? The query below works fine for my use case but it uses a term filter instead of a match. So searching for "nursery" will result in 0 buckets. GET sushant-ten… --- ## [Filebeat as DaemonSet in k8s cluser](https://discuss.elastic.co/t/filebeat-as-daemonset-in-k8s-cluser/295821)
**Author:** [@morb](https://discuss.elastic.co/u/morb)\ **Replies:** 0\ **Last updated:** [January 31, 2022, 10:39am UTC](https://discuss.elastic.co/t/filebeat-as-daemonset-in-k8s-cluser/295821 "2022-01-31T10:39:39Z")
Hi So I'm using helm to deploy filebeat on k8s cluster. I using bitami helm chart daemonset: Annotations to apply to the daemonset annotations: {} additionals labels labels: {} affinity: {} Include the daemonset e… --- ## [Index Health often red](https://discuss.elastic.co/t/index-health-often-red/294367)
**Author:** [@it-dept](https://discuss.elastic.co/u/it-dept)\ **Replies:** 10\ **Last updated:** [January 31, 2022, 10:24am UTC](https://discuss.elastic.co/t/index-health-often-red/294367 "2022-01-31T10:24:17Z")
Good day. We have Elasticsearch version 7.13.3 on separated server, not a cluster. And often one of the indexes turns red. We are deleting it. But after a while it turns red again. May be there is a solution to how to … --- ## [How to convert String into JSon format?](https://discuss.elastic.co/t/how-to-convert-string-into-json-format/295703)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 3\ **Last updated:** [January 31, 2022, 10:17am UTC](https://discuss.elastic.co/t/how-to-convert-string-into-json-format/295703 "2022-01-31T10:17:20Z")
Hello Friends, Need your help to parse string into Json format in logstash. { "id":"xxx", "MessageCreateDate":"2022-01-20", "Response":"{'Cardholder':{'cards':\[{'isPrimaryCard':'N','cardNumber':'xxxxxxxxxx','r… --- ## [How to make \_id available for aggs?](https://discuss.elastic.co/t/how-to-make-id-available-for-aggs/295814)
**Author:** [@Emporea](https://discuss.elastic.co/u/Emporea)\ **Replies:** 0\ **Last updated:** [January 31, 2022, 10:03am UTC](https://discuss.elastic.co/t/how-to-make-id-available-for-aggs/295814 "2022-01-31T10:03:42Z")
Upon indexing I overwrote \_id with my own unique \_id field filled with integers. How can I aggregate something like max on my \_id field? max\_id: { max: { field: "\_id" } } This only throws an error. Currently I am usi… --- ## [Copy complete event to a field of a new event](https://discuss.elastic.co/t/copy-complete-event-to-a-field-of-a-new-event/295583)
**Author:** [@HansPeterSloot](https://discuss.elastic.co/u/HansPeterSloot)\ **Replies:** 7\ **Last updated:** [January 31, 2022, 9:26am UTC](https://discuss.elastic.co/t/copy-complete-event-to-a-field-of-a-new-event/295583 "2022-01-31T09:26:52Z")
Hi, I want to copy all fields of an event to a field of a new event in a logstash filter This { " agent ": " Mozilla / 5.0(compatible; MSIE 9.0)", " ip ": " 192.168.24.44 ", " request ": " / in… --- ## [Give User access to execute particular query](https://discuss.elastic.co/t/give-user-access-to-execute-particular-query/295742)
**Author:** [@Adityadgr8](https://discuss.elastic.co/u/Adityadgr8)\ **Replies:** 2\ **Last updated:** [January 31, 2022, 8:35am UTC](https://discuss.elastic.co/t/give-user-access-to-execute-particular-query/295742 "2022-01-31T08:35:30Z")
Index Name : sampleindex@timestamp Everyday new index is being created with current date I made one user in kibana and assigned a particular role to the user: I already added sampleindex\* with privilages: monitor, … --- ## [Change default Page size of 50 in dashboard form saved search](https://discuss.elastic.co/t/change-default-page-size-of-50-in-dashboard-form-saved-search/294555)
**Author:** [@Moni](https://discuss.elastic.co/u/Moni)\ **Replies:** 3\ **Last updated:** [January 31, 2022, 8:27am UTC](https://discuss.elastic.co/t/change-default-page-size-of-50-in-dashboard-form-saved-search/294555 "2022-01-31T08:27:40Z")
When I try to create a dashboard from an existing saved search result (from discover) the default page size is 50 and there is no option to change this in the dashboard/panel. Atleast I could not locate. Do let me know i… --- ## [Docker logstash keeps heapdumping](https://discuss.elastic.co/t/docker-logstash-keeps-heapdumping/295801)
**Author:** [@RandomRobbie](https://discuss.elastic.co/u/RandomRobbie)\ **Replies:** 3\ **Last updated:** [January 31, 2022, 7:12am UTC](https://discuss.elastic.co/t/docker-logstash-keeps-heapdumping/295801 "2022-01-31T07:12:43Z")
Hey, I am using logstash to load a Elasticsearch full of data from text files that i wish to keep the files afterwards as well. Current Logstash Config. input { beats { port =\> 5044 } tcp { port =\> 5001 } … --- ## [Filtering setup for docker containers not working](https://discuss.elastic.co/t/filtering-setup-for-docker-containers-not-working/295573)
**Author:** [@mitlonik](https://discuss.elastic.co/u/mitlonik)\ **Replies:** 3\ **Last updated:** [January 31, 2022, 6:27am UTC](https://discuss.elastic.co/t/filtering-setup-for-docker-containers-not-working/295573 "2022-01-31T06:27:14Z")
filtering setup for docker containers not working. I started Elastic Stack without anybody additional settings. And here are my filebeat settings: filebeat.yml filebeat.autodiscover: providers: - type: docker … --- ## [Can I use a filebeat server for centralize log collected data from many different devices?](https://discuss.elastic.co/t/can-i-use-a-filebeat-server-for-centralize-log-collected-data-from-many-different-devices/295541)
**Author:** [@siranee.ja](https://discuss.elastic.co/u/siranee.ja)\ **Replies:** 4\ **Last updated:** [January 31, 2022, 6:16am UTC](https://discuss.elastic.co/t/can-i-use-a-filebeat-server-for-centralize-log-collected-data-from-many-different-devices/295541 "2022-01-31T06:16:54Z")
This is my example infra as the question. Fortinet device Haproxy Server Apache Server A filebeat server An ELK stack server device a filebeat server … --- ## [How to use Grok for JSON parsing](https://discuss.elastic.co/t/how-to-use-grok-for-json-parsing/295794)
**Author:** [@Adabi\_Raihan](https://discuss.elastic.co/u/Adabi_Raihan)\ **Replies:** 2\ **Last updated:** [January 31, 2022, 4:58am UTC](https://discuss.elastic.co/t/how-to-use-grok-for-json-parsing/295794 "2022-01-31T04:58:59Z")
Hi, I want to parse this JSON object to ELK { "Format": "IDEA0", "ID": "2b03eb1f-fc4c-4f67-94e5-31c9fb32dccc", "DetectTime": "2022-01-31T08:16:12.600470+07:00", "EventTime": "2022-01-31T01:23:01.637438+00:00", "Categor… --- ## [Hi all, I want to Index data into elasticsearch using PHP. Can anyone guide me?](https://discuss.elastic.co/t/hi-all-i-want-to-index-data-into-elasticsearch-using-php-can-anyone-guide-me/295652)
**Author:** [@Chinmay\_Bhusate](https://discuss.elastic.co/u/Chinmay_Bhusate)\ **Replies:** 4\ **Last updated:** [January 31, 2022, 4:23am UTC](https://discuss.elastic.co/t/hi-all-i-want-to-index-data-into-elasticsearch-using-php-can-anyone-guide-me/295652 "2022-01-31T04:23:45Z")
I want to Index data Using PHP . But not able to configure the settings. --- ## [Cef message split](https://discuss.elastic.co/t/cef-message-split/295797)
**Author:** [@Rohit\_Mangotra](https://discuss.elastic.co/u/Rohit_Mangotra)\ **Replies:** 5\ **Last updated:** [January 31, 2022, 4:08am UTC](https://discuss.elastic.co/t/cef-message-split/295797 "2022-01-31T04:08:46Z")
Hi, I am new to ELK and learning it now as part of my job. I am getting .cef logs from imperva waf that needs to be split in to fields so that it can be uploaded to the Elastic. Please let me know how I can achieve thi… --- ## [Using document properties in alert index rule](https://discuss.elastic.co/t/using-document-properties-in-alert-index-rule/292972)
**Author:** [@tflorac](https://discuss.elastic.co/u/tflorac)\ **Replies:** 3\ **Last updated:** [January 30, 2022, 11:50pm UTC](https://discuss.elastic.co/t/using-document-properties-in-alert-index-rule/292972 "2022-01-30T23:50:40Z")
Hi, I'm using Elasticsearch and Kibana 7.16.2, and I'm trying to create custom alerts rules. I've created a rule which is using an index action and everything is nearly OK, but my question is: how can I include propert… --- ## [No iptables in elasticsearch](https://discuss.elastic.co/t/no-iptables-in-elasticsearch/295770)
**Author:** [@mevan](https://discuss.elastic.co/u/mevan)\ **Replies:** 1\ **Last updated:** [January 30, 2022, 9:38pm UTC](https://discuss.elastic.co/t/no-iptables-in-elasticsearch/295770 "2022-01-30T21:38:13Z")
I'm very new to filebeat/Elasticsearch so unsure how to debug this. I have filebeat, Elasticsearch and kibana working. I can see many of my logs being ingested from /var/log/syslog. However, although I have the iptables … --- ## [Return documents that matches : Filter nested record with Max Start date and match a keyword : Search for candidate having last job with a keyword](https://discuss.elastic.co/t/return-documents-that-matches-filter-nested-record-with-max-start-date-and-match-a-keyword-search-for-candidate-having-last-job-with-a-keyword/295786)
**Author:** [@aloksharma](https://discuss.elastic.co/u/aloksharma)\ **Replies:** 0\ **Last updated:** [January 30, 2022, 7:51pm UTC](https://discuss.elastic.co/t/return-documents-that-matches-filter-nested-record-with-max-start-date-and-match-a-keyword-search-for-candidate-having-last-job-with-a-keyword/295786 "2022-01-30T19:51:50Z")
Hi, After all tries I am here to seek help. I have following structure of the document: { "candidate\_id" : 1234, "location" : { "city" : "NY", "country" : "US" }, "age" : 32, "highest\_education" : "Graduate", "job\_his… --- ## [Query terms with dash in string?](https://discuss.elastic.co/t/query-terms-with-dash-in-string/295780)
**Author:** [@Emporea](https://discuss.elastic.co/u/Emporea)\ **Replies:** 3\ **Last updated:** [January 30, 2022, 4:01pm UTC](https://discuss.elastic.co/t/query-terms-with-dash-in-string/295780 "2022-01-30T16:01:38Z")
GET /\_search { "query": { "terms": { "user.id": \[ "kimchy", "elkbee-test" \], } } } Result will only include kimchy, because I guess the dash is interpretet as a bool operator. How to fix this? --- ## [How to index anomalous documents in another index?](https://discuss.elastic.co/t/how-to-index-anomalous-documents-in-another-index/295458)
**Author:** [@Ilia](https://discuss.elastic.co/u/Ilia)\ **Replies:** 2\ **Last updated:** [January 30, 2022, 10:11am UTC](https://discuss.elastic.co/t/how-to-index-anomalous-documents-in-another-index/295458 "2022-01-30T10:11:42Z")
It is my first time working with Elasticsearch anomaly detection. I've read the concepts and create a sample index to test it. I've also created these job and datafeed by using kibana for the sample index: { "job\_id"… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1072) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1074)