# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1074 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1075 --- ## [Replacement of CircleBuilder/PolygonBuilder](https://discuss.elastic.co/t/replacement-of-circlebuilder-polygonbuilder/295676)
**Author:** [@UglyBarnacle](https://discuss.elastic.co/u/UglyBarnacle)\ **Replies:** 3\ **Last updated:** [January 30, 2022, 1:31am UTC](https://discuss.elastic.co/t/replacement-of-circlebuilder-polygonbuilder/295676 "2022-01-30T01:31:00Z")
Since the circle was not supported anymore (I think now it is, atleast on query execution), we approximated a circle with the PolygonBuilder from the main Elasticsearch package. Elasticsearch 7.16 did a cleanup, removin… --- ## [Enrich processor missing some documents](https://discuss.elastic.co/t/enrich-processor-missing-some-documents/295722)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 4\ **Last updated:** [January 30, 2022, 12:54am UTC](https://discuss.elastic.co/t/enrich-processor-missing-some-documents/295722 "2022-01-30T00:54:30Z")
Hello, I have an ingest pipeline that has a simple enrich processor, it basically adds a field named host.type based on the host.name. This enrich processor is part of a final\_pipeline that is set in the index, and I'm… --- ## [Filebeat send json data to Elasticsearch & Use file name as index](https://discuss.elastic.co/t/filebeat-send-json-data-to-elasticsearch-use-file-name-as-index/295763)
**Author:** [@Suat\_Bey](https://discuss.elastic.co/u/Suat_Bey)\ **Replies:** 0\ **Last updated:** [January 29, 2022, 8:51pm UTC](https://discuss.elastic.co/t/filebeat-send-json-data-to-elasticsearch-use-file-name-as-index/295763 "2022-01-29T20:51:51Z")
Is it possible to create a Elasticsearch index using a file name. I have the json file named as daily regex, and want to send this data day by day to elsaticsearch. On the Elasticsearch index I want to use file same as i… --- ## [Issues with apply filters](https://discuss.elastic.co/t/issues-with-apply-filters/295761)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 0\ **Last updated:** [January 29, 2022, 7:51pm UTC](https://discuss.elastic.co/t/issues-with-apply-filters/295761 "2022-01-29T19:51:11Z")
Hello, I upgraded logstash to the latest version 7.16.3 and I have issues with apply required filters, Maybe this is related with specific ports closed, As output I'm receiving below: ./logstash-plugin install logsta… --- ## [Kibana 7.16.3 issues with connecting to elasticsearch](https://discuss.elastic.co/t/kibana-7-16-3-issues-with-connecting-to-elasticsearch/295715)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 2\ **Last updated:** [January 29, 2022, 6:17pm UTC](https://discuss.elastic.co/t/kibana-7-16-3-issues-with-connecting-to-elasticsearch/295715 "2022-01-29T18:17:11Z")
Hello, today I upgraded ES to the latest version and kibana, I see in logs that ES cannot be detected: "message":"Error \[ProductNotSupportedSecurityError\]: The client is unable to verify that the server is Elasticsea… --- ## [Date histogram aggregation issue for arrays fields](https://discuss.elastic.co/t/date-histogram-aggregation-issue-for-arrays-fields/294965)
**Author:** [@Marek\_Siwiec](https://discuss.elastic.co/u/Marek_Siwiec)\ **Replies:** 1\ **Last updated:** [January 29, 2022, 5:13pm UTC](https://discuss.elastic.co/t/date-histogram-aggregation-issue-for-arrays-fields/294965 "2022-01-29T17:13:57Z")
Hello! I trying to update ES from 7.10.2 to 7.16.3 and I encounter an issue with Date histogram aggregation. When I have a document with a date field as an array with date aggregation by month on that field, then I expe… --- ## [Delete registry on fleet filebeat](https://discuss.elastic.co/t/delete-registry-on-fleet-filebeat/295756)
**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\ **Replies:** 0\ **Last updated:** [January 29, 2022, 3:44pm UTC](https://discuss.elastic.co/t/delete-registry-on-fleet-filebeat/295756 "2022-01-29T15:44:09Z")
Hello, how can I delete the registry to re-index the same log files again? Deleting the integration didnt work. Thanks --- ## [Help on script score query with filter script](https://discuss.elastic.co/t/help-on-script-score-query-with-filter-script/295751)
**Author:** [@scharom16](https://discuss.elastic.co/u/scharom16)\ **Replies:** 7\ **Last updated:** [January 29, 2022, 3:30pm UTC](https://discuss.elastic.co/t/help-on-script-score-query-with-filter-script/295751 "2022-01-29T15:30:57Z")
Hi elastic community, I need some guidance on the following query. I am using the Python Elasticsearch client and when executing the query it returns a 'search\_phase\_execution\_exception' with no further guidance. Can yo… --- ## [Can't use method ensureCapacity for ArrayList](https://discuss.elastic.co/t/cant-use-method-ensurecapacity-for-arraylist/295695)
**Author:** [@arnautov\_evgeny](https://discuss.elastic.co/u/arnautov_evgeny)\ **Replies:** 3\ **Last updated:** [January 29, 2022, 3:08pm UTC](https://discuss.elastic.co/t/cant-use-method-ensurecapacity-for-arraylist/295695 "2022-01-29T15:08:28Z")
Hello. I'm using a script on painless language, and I can't get it working with the ArrayList object. Even example from docs isn't working for me. I've tested it on 7.13.2 and 7.16.3. Thanks in advance for your answer. … --- ## [Filebeat filestream input parsers multiline fails](https://discuss.elastic.co/t/filebeat-filestream-input-parsers-multiline-fails/290543)
**Author:** [@fgjensen](https://discuss.elastic.co/u/fgjensen)\ **Replies:** 18\ **Last updated:** [January 29, 2022, 2:31pm UTC](https://discuss.elastic.co/t/filebeat-filestream-input-parsers-multiline-fails/290543 "2022-01-29T14:31:30Z")
Hello This is filebeat 7.15.0. I have configured several filebeat log inputs with multiline patterns and it works. Next I change the input type to filestream, while following the documentation. However, when starting t… --- ## [Write data that have failed in Logstash filter transforms to file](https://discuss.elastic.co/t/write-data-that-have-failed-in-logstash-filter-transforms-to-file/295649)
**Author:** [@GitSpree23](https://discuss.elastic.co/u/GitSpree23)\ **Replies:** 4\ **Last updated:** [January 29, 2022, 12:38pm UTC](https://discuss.elastic.co/t/write-data-that-have-failed-in-logstash-filter-transforms-to-file/295649 "2022-01-29T12:38:33Z")
My logstash config has a filter performing several transformations. But I see many records failing to get processed because of incorrect format/encoding in source data. I want Logstash to write these failed inputs to a … --- ## [Minimum number of replica shard ? (do we need 2 replica for recovery?)](https://discuss.elastic.co/t/minimum-number-of-replica-shard-do-we-need-2-replica-for-recovery/295741)
**Author:** [@dan\_kim](https://discuss.elastic.co/u/dan_kim)\ **Replies:** 2\ **Last updated:** [January 29, 2022, 7:54am UTC](https://discuss.elastic.co/t/minimum-number-of-replica-shard-do-we-need-2-replica-for-recovery/295741 "2022-01-29T07:54:12Z")
Hello ! our company is trying to building a new Elasticsearch for service and We are studying ES for a proper service . And I have a question about replica shard. Should we set our replica shard more than 2? Here is… --- ## [Include Friend relations in user search](https://discuss.elastic.co/t/include-friend-relations-in-user-search/295632)
**Author:** [@JonasLevin](https://discuss.elastic.co/u/JonasLevin)\ **Replies:** 1\ **Last updated:** [January 29, 2022, 3:17am UTC](https://discuss.elastic.co/t/include-friend-relations-in-user-search/295632 "2022-01-29T03:17:45Z")
I'm working on creating a search feature for a social network like Mobile App. Users can follow each other and search by username, lastname or firstname. Currently we are just indexing username, lastname and firstname i… --- ## [Filebeat with Large Registry/State File Causes \`runtime: program exceeds 10000-thread limit\` on Startup](https://discuss.elastic.co/t/filebeat-with-large-registry-state-file-causes-runtime-program-exceeds-10000-thread-limit-on-startup/295738)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 1\ **Last updated:** [January 29, 2022, 1:29am UTC](https://discuss.elastic.co/t/filebeat-with-large-registry-state-file-causes-runtime-program-exceeds-10000-thread-limit-on-startup/295738 "2022-01-29T01:29:55Z")
Hi All, I'm seeing an issue, where a Filebeat instead with a large registrar (~33k entries). {"level":"info","timestamp":"2022-01-29T00:32:41.799Z","logger":"registrar","caller":"registrar/registrar.go:109","message":"… --- ## [Assign timestamp value to field in filebeat](https://discuss.elastic.co/t/assign-timestamp-value-to-field-in-filebeat/295734)
**Author:** [@jpfreyen](https://discuss.elastic.co/u/jpfreyen)\ **Replies:** 0\ **Last updated:** [January 29, 2022, 12:08am UTC](https://discuss.elastic.co/t/assign-timestamp-value-to-field-in-filebeat/295734 "2022-01-29T00:08:11Z")
Hello, Is there a way for me to assign the timestamp value to an add\_field? Like for example: processors: - add\_fields: fields: collectiontime: "@timestamp" This example doesn't work because when I check th… --- ## [Configure Filebeat to input a specific logs of my app pods in AKS](https://discuss.elastic.co/t/configure-filebeat-to-input-a-specific-logs-of-my-app-pods-in-aks/295737)
**Author:** [@amgmdz](https://discuss.elastic.co/u/amgmdz)\ **Replies:** 0\ **Last updated:** [January 29, 2022, 12:37am UTC](https://discuss.elastic.co/t/configure-filebeat-to-input-a-specific-logs-of-my-app-pods-in-aks/295737 "2022-01-29T00:37:52Z")
I have an application in a kubernetes (AKS) this app generates logs in /logs/\*.log, my problem is that I do not know what configuration to do in Filebeat (this is deployed on AKS nodes) to recognize the logs and send the… --- ## [rollupSearch with new Java Api Client](https://discuss.elastic.co/t/rollupsearch-with-new-java-api-client/295736)
**Author:** [@rfox](https://discuss.elastic.co/u/rfox)\ **Replies:** 0\ **Last updated:** [January 29, 2022, 12:32am UTC](https://discuss.elastic.co/t/rollupsearch-with-new-java-api-client/295736 "2022-01-29T00:32:45Z")
I am struggling to use the new rollupSearch API. I am trying to map this query: GET count\_rollup/\_rollup\_search { "size": 0, "aggregations": { "timeline": { "date\_histogram": { "field": "datetime"… --- ## [ILM Warm Phase Executes on Hot Node](https://discuss.elastic.co/t/ilm-warm-phase-executes-on-hot-node/295727)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 4\ **Last updated:** [January 29, 2022, 12:12am UTC](https://discuss.elastic.co/t/ilm-warm-phase-executes-on-hot-node/295727 "2022-01-29T00:12:46Z")
Hi All, I recently noticed some CPU usage issues on my hot data nodes. When looking at the hot threads (GET /\_nodes/\/hot\_threads). I noticed that the main cause was force merging during rollover from hot -\> war… --- ## [Master not Discovered yet](https://discuss.elastic.co/t/master-not-discovered-yet/295699)
**Author:** [@auasad](https://discuss.elastic.co/u/auasad)\ **Replies:** 3\ **Last updated:** [January 28, 2022, 11:01pm UTC](https://discuss.elastic.co/t/master-not-discovered-yet/295699 "2022-01-28T23:01:40Z")
Hello community, I am facing an issue, I have a cluster consisting 3 nodes in NZ(Master-Data), one node in PK(Data Node) everything is up and running over the public IPs. Now the issue comes when I try to join my new IR… --- ## [Search in Array Field](https://discuss.elastic.co/t/search-in-array-field/295732)
**Author:** [@Sahil5](https://discuss.elastic.co/u/Sahil5)\ **Replies:** 0\ **Last updated:** [January 28, 2022, 8:36pm UTC](https://discuss.elastic.co/t/search-in-array-field/295732 "2022-01-28T20:36:11Z")
Hi Team, I want to enable search on array field but only want to retrieve the value from an array that matches the search query. Example Document 1 - \[A,B\] Document 2 - \[A,C\] Below is the Query { "query": { "… --- ## [Wildcard for source.ip field](https://discuss.elastic.co/t/wildcard-for-source-ip-field/295613)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 4\ **Last updated:** [January 28, 2022, 7:04pm UTC](https://discuss.elastic.co/t/wildcard-for-source-ip-field/295613 "2022-01-28T19:04:51Z")
Hi there, I would like to know how to fix this search (if is possible of course): (winlog.channel:"Security" AND (winlog.event\_id:"4624" AND winlog.event\_data.LogonType:"10") AND (NOT (source.ip:(10.\* OR 192.168.\* OR 1… --- ## [FS Crawler 2.4 on Apache Log4j2 Remote Code Execution (RCE) Vulnerability](https://discuss.elastic.co/t/fs-crawler-2-4-on-apache-log4j2-remote-code-execution-rce-vulnerability/291649)
**Author:** [@joseph-l.amalraj](https://discuss.elastic.co/u/joseph-l.amalraj)\ **Replies:** 16\ **Last updated:** [January 28, 2022, 6:14pm UTC](https://discuss.elastic.co/t/fs-crawler-2-4-on-apache-log4j2-remote-code-execution-rce-vulnerability/291649 "2022-01-28T18:14:21Z")
Hi David, recently we have received about Apache Log4j2 Remote Code Execution (RCE) Vulnerability. I am using FS Crawler 2.4 version along with ELK 6.8.14, we planned to do remediation plan for log4j in ELK. We would l… --- ## [Unified highlighter snippet fragmenter issues](https://discuss.elastic.co/t/unified-highlighter-snippet-fragmenter-issues/295603)
**Author:** [@fsouptes](https://discuss.elastic.co/u/fsouptes)\ **Replies:** 3\ **Last updated:** [January 28, 2022, 6:12pm UTC](https://discuss.elastic.co/t/unified-highlighter-snippet-fragmenter-issues/295603 "2022-01-28T18:12:52Z")
Hello, We are knowing some issues with how snippets are splitted with unified highlighter. We use Elasticsearch in 7.16 Some snippets are very shorts, sometimes the snippet is inconsistent or is only a repetition of u… --- ## [How to list all index patterns using DevTools](https://discuss.elastic.co/t/how-to-list-all-index-patterns-using-devtools/295725)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 1\ **Last updated:** [January 28, 2022, 5:15pm UTC](https://discuss.elastic.co/t/how-to-list-all-index-patterns-using-devtools/295725 "2022-01-28T17:15:36Z")
Hi, Is there a GET command that I can run in Kibana's dev tools console that will list all my index patterns and their IDs? I'm trying to delete some index patterns but I believe I need to delete them by ID. I'm trying… --- ## [\[Winlogbeat\] won't exit; winlogbeat JSON output size is different for same file](https://discuss.elastic.co/t/winlogbeat-wont-exit-winlogbeat-json-output-size-is-different-for-same-file/295706)
**Author:** [@ashimmahara](https://discuss.elastic.co/u/ashimmahara)\ **Replies:** 2\ **Last updated:** [January 28, 2022, 5:03pm UTC](https://discuss.elastic.co/t/winlogbeat-wont-exit-winlogbeat-json-output-size-is-different-for-same-file/295706 "2022-01-28T17:03:17Z")
Program: Winlogbeat Version: 7.16.3 Operating System: Windows 11 Pro Version 21H2 Build 22000.438 I am trying to convert some archived evtx files to JSON using winlogbeat, however, winlogbeat isn't exiting after proce… --- ## [Create dashboard mixing data from indexes](https://discuss.elastic.co/t/create-dashboard-mixing-data-from-indexes/295716)
**Author:** [@javidr](https://discuss.elastic.co/u/javidr)\ **Replies:** 2\ **Last updated:** [January 28, 2022, 4:19pm UTC](https://discuss.elastic.co/t/create-dashboard-mixing-data-from-indexes/295716 "2022-01-28T16:19:44Z")
Hi I would like to know how i can mix data from different indexes in the same visualisation (if it is even possible). Imagine I have an index with some information, as name, dob, NI number etc, and another index with d… --- ## [LogStash::Json::ParserError: Unexpected end-of-input within/between Object entries for curly brace inside string](https://discuss.elastic.co/t/logstash-unexpected-end-of-input-within-between-object-entries-for-curly-brace-inside-string/295659)
**Author:** [@truptir](https://discuss.elastic.co/u/truptir)\ **Replies:** 1\ **Last updated:** [January 28, 2022, 4:05pm UTC](https://discuss.elastic.co/t/logstash-unexpected-end-of-input-within-between-object-entries-for-curly-brace-inside-string/295659 "2022-01-28T16:05:28Z")
When String contains opening curly braces '{' logstash failed to parse that JSON. As per JSON doc, we don't need to escape curly brace. then how can I parse this type of JSON through logstash? JSON file: { "DESCRIPTIO… --- ## [SQL - Perform ORDR BY SUM(col1\*col2)](https://discuss.elastic.co/t/sql-perform-ordr-by-sum-col1-col2/294300)
**Author:** [@yamaga](https://discuss.elastic.co/u/yamaga)\ **Replies:** 2\ **Last updated:** [January 28, 2022, 3:29pm UTC](https://discuss.elastic.co/t/sql-perform-ordr-by-sum-col1-col2/294300 "2022-01-28T15:29:18Z")
Hi I am willing to execute this query, retreive the top products with haghiest value: SELECT ID\_PROD, SUM(PRICE\*VOLUME) AS \*\*VALUE\*\* FROM sales group by ID\_PROD ORDER BY VALUE I receive this error: { "message": "Cl… --- ## [Elastic Agent RPM and Fleet](https://discuss.elastic.co/t/elastic-agent-rpm-and-fleet/294559)
**Author:** [@thleh](https://discuss.elastic.co/u/thleh)\ **Replies:** 1\ **Last updated:** [January 28, 2022, 3:08pm UTC](https://discuss.elastic.co/t/elastic-agent-rpm-and-fleet/294559 "2022-01-28T15:08:31Z")
Hi all, i have installed elastic agent on a couple of linux servers. I used the rpm package from repository as installation source and restired the agend afterwards in fleet management. The status of agents are Healthy… --- ## [Java Api Client RangeQueryBuilder has JsonData as an attribute for gte etc](https://discuss.elastic.co/t/java-api-client-rangequerybuilder-has-jsondata-as-an-attribute-for-gte-etc/293462)
**Author:** [@Piotr\_Idzikowski](https://discuss.elastic.co/u/Piotr_Idzikowski)\ **Replies:** 2\ **Last updated:** [January 28, 2022, 2:58pm UTC](https://discuss.elastic.co/t/java-api-client-rangequerybuilder-has-jsondata-as-an-attribute-for-gte-etc/293462 "2022-01-28T14:58:17Z")
Hello. I am trying to migrate my java application to use new java api client. Today I realized that RangeQUeryBuildar has these strange types for gte, lte, etc methods. Why is it JsonData type? I am using Elasticsear… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1073) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1075)