# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1103 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1104 --- ## [Unable to Start Elastic Search from Windows Service : Using MSI](https://discuss.elastic.co/t/unable-to-start-elastic-search-from-windows-service-using-msi/293752)
**Author:** [@dkris1](https://discuss.elastic.co/u/dkris1)\ **Replies:** 0\ **Last updated:** [January 7, 2022, 2:37pm UTC](https://discuss.elastic.co/t/unable-to-start-elastic-search-from-windows-service-using-msi/293752 "2022-01-07T14:37:57Z")
Hi All, Unable to start windows Elasticsearch service. Event viewer shows below. Using Version 7.16.1 Service cannot be started. Elastic.ProcessHosts.Process.StartupException: Could not evaluate jvm.options file. result… --- ## [Filebeat HAProxy module exported fields](https://discuss.elastic.co/t/filebeat-haproxy-module-exported-fields/293749)
**Author:** [@dicko](https://discuss.elastic.co/u/dicko)\ **Replies:** 0\ **Last updated:** [January 7, 2022, 2:26pm UTC](https://discuss.elastic.co/t/filebeat-haproxy-module-exported-fields/293749 "2022-01-07T14:26:00Z")
I've set up the HAProxy module as per the manuals on the Elastic site and on this site. Can I view the HAProxy exported fields under Discover? How would I go about that? There's also mention of sample and predefined d… --- ## [How to read log files from remote location](https://discuss.elastic.co/t/how-to-read-log-files-from-remote-location/293746)
**Author:** [@Aamir\_Sheraz](https://discuss.elastic.co/u/Aamir_Sheraz)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 1:58pm UTC](https://discuss.elastic.co/t/how-to-read-log-files-from-remote-location/293746 "2022-01-07T13:58:43Z")
I want to read log files from different location/systems. I am able to read multiple files on the same system but there is requirement to read files from another location/system remotely as well without installing fileb… --- ## [Watcher which tries 2 times before alerting](https://discuss.elastic.co/t/watcher-which-tries-2-times-before-alerting/293128)
**Author:** [@Dimitri2](https://discuss.elastic.co/u/Dimitri2)\ **Replies:** 4\ **Last updated:** [January 7, 2022, 1:08pm UTC](https://discuss.elastic.co/t/watcher-which-tries-2-times-before-alerting/293128 "2022-01-07T13:08:45Z")
Hello everyone, I'm new to Elastic and I'm having trouble. I'm trying to get my Watcher to not return an alert right away but wait a moment to confirm or deny the problem. So instead of sending an alert directly, I wa… --- ## [Is there a way to show nested fields when showing highlight results?](https://discuss.elastic.co/t/is-there-a-way-to-show-nested-fields-when-showing-highlight-results/293740)
**Author:** [@munkyu](https://discuss.elastic.co/u/munkyu)\ **Replies:** 0\ **Last updated:** [January 7, 2022, 12:51pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-show-nested-fields-when-showing-highlight-results/293740 "2022-01-07T12:51:46Z")
nested fields like below. "comments" : \[ { "content" : "apple computer", "votes\_count" : 1 }, { "content" : "apple computer is good", … --- ## [7.16.2 API problem](https://discuss.elastic.co/t/7-16-2-api-problem/293722)
**Author:** [@mengben](https://discuss.elastic.co/u/mengben)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 11:12am UTC](https://discuss.elastic.co/t/7-16-2-api-problem/293722 "2022-01-07T11:12:10Z")
first：how to use SQL query second:How does the new API return some fields --- ## [ILM failing for rollover for Wazuh module / data](https://discuss.elastic.co/t/ilm-failing-for-rollover-for-wazuh-module-data/291781)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 38\ **Last updated:** [January 7, 2022, 9:34am UTC](https://discuss.elastic.co/t/ilm-failing-for-rollover-for-wazuh-module-data/291781 "2022-01-07T09:34:34Z")
I have setup a rollover policy for wazuh index with the below policy defination { "policy": "Wazuh", "phase\_definition": { "min\_age": "0ms", "actions": { "rollover": { "max\_size": "20gb", … --- ## [Kibana server.publicBaseUrl](https://discuss.elastic.co/t/kibana-server-publicbaseurl/293661)
**Author:** [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\ **Replies:** 3\ **Last updated:** [January 7, 2022, 8:38am UTC](https://discuss.elastic.co/t/kibana-server-publicbaseurl/293661 "2022-01-07T08:38:27Z")
I am seeing this error on my Kibana I have several questions Where do I configure that setting? in kibana.yml ? in Elasticsearch.yml ? What should I set the setting to? Kibana.yml # File managed by Puppet. ---… --- ## [Elasticsearch Script Query - Returning multiple values on aggregation](https://discuss.elastic.co/t/elasticsearch-script-query-returning-multiple-values-on-aggregation/293716)
**Author:** [@hyun](https://discuss.elastic.co/u/hyun)\ **Replies:** 0\ **Last updated:** [January 7, 2022, 8:26am UTC](https://discuss.elastic.co/t/elasticsearch-script-query-returning-multiple-values-on-aggregation/293716 "2022-01-07T08:26:07Z")
Aggregation Result "aggregations": { "649": { "doc\_count\_error\_upper\_bound": 0, "sum\_other\_doc\_count": 0, "buckets": \[ { "key": "ALLOGENE THERAPEUTICS", … --- ## [ML datafeed altering - convert text field to integer](https://discuss.elastic.co/t/ml-datafeed-altering-convert-text-field-to-integer/293713)
**Author:** [@zerojin63](https://discuss.elastic.co/u/zerojin63)\ **Replies:** 0\ **Last updated:** [January 7, 2022, 8:03am UTC](https://discuss.elastic.co/t/ml-datafeed-altering-convert-text-field-to-integer/293713 "2022-01-07T08:03:56Z")
Hi, I want to convert keyword format field to integer in runtime mapping. I've tried these code but none of them worked. "runtime\_mappings": { "my\_field.keyword": { "type": "keyword", "script": { … --- ## [Using functionbeat environment variables](https://discuss.elastic.co/t/using-functionbeat-environment-variables/293707)
**Author:** [@Sultan](https://discuss.elastic.co/u/Sultan)\ **Replies:** 0\ **Last updated:** [January 7, 2022, 6:12am UTC](https://discuss.elastic.co/t/using-functionbeat-environment-variables/293707 "2022-01-07T06:12:03Z")
Hi, We are trying to use functionbeat to deploy a lambda function in AWS which eventually would ship kinesis logs to our elastic cloud. We do not want to keep the elastic credentials (ie. cloud.auth, cloud.id etc) in th… --- ## [Error listing bucket contents: Error getting access token for service account: oauth2.googleapis.com](https://discuss.elastic.co/t/error-listing-bucket-contents-error-getting-access-token-for-service-account-oauth2-googleapis-com/293704)
**Author:** [@parmarX](https://discuss.elastic.co/u/parmarX)\ **Replies:** 0\ **Last updated:** [January 7, 2022, 4:56am UTC](https://discuss.elastic.co/t/error-listing-bucket-contents-error-getting-access-token-for-service-account-oauth2-googleapis-com/293704 "2022-01-07T04:56:14Z")
Hello , I am facing this issue while running my pipeline using configmap and deployment in docker. my plugin is unable to get access token for service accound . i am using plugin input\_google\_cloud\_storage to get file… --- ## [Logstash Date Format Failure](https://discuss.elastic.co/t/logstash-date-format-failure/293702)
**Author:** [@insu0929](https://discuss.elastic.co/u/insu0929)\ **Replies:** 2\ **Last updated:** [January 7, 2022, 4:17am UTC](https://discuss.elastic.co/t/logstash-date-format-failure/293702 "2022-01-07T04:17:53Z")
Hi I'm using filebeat to send some session count data to Logstash. The file type is csv and the data looks like this: ... "01/02/2022 00:00:27.837", "0.99961" "01/02/2022 00:00:28.853", "0" "01/02/2022 00:00:29.240", "1… --- ## [Failed to create elasticsearch client, connection refused while running fscrawler pod](https://discuss.elastic.co/t/failed-to-create-elasticsearch-client-connection-refused-while-running-fscrawler-pod/293663)
**Author:** [@Adityadgr8](https://discuss.elastic.co/u/Adityadgr8)\ **Replies:** 0\ **Last updated:** [January 6, 2022, 3:14pm UTC](https://discuss.elastic.co/t/failed-to-create-elasticsearch-client-connection-refused-while-running-fscrawler-pod/293663 "2022-01-06T15:14:08Z")
Hello, our fscrawler is unable to make a connection with Elasticsearch in the linux server. Previously with the same configuration, it was working fine but don't know why suddenly we starts to face this issue -- we ar… --- ## [Continuously read from .evtx logfile?](https://discuss.elastic.co/t/continuously-read-from-evtx-logfile/293658)
**Author:** [@Andreas\_Falk](https://discuss.elastic.co/u/Andreas_Falk)\ **Replies:** 3\ **Last updated:** [January 7, 2022, 3:06am UTC](https://discuss.elastic.co/t/continuously-read-from-evtx-logfile/293658 "2022-01-07T03:06:38Z")
(crosspost from slack) Hi, We are trying to get the logs from our netapp cifs shares. Netapp exports their logs to a smb share and writes .evtx files there. And with the help of mounting and pointing winlogbeat to th… --- ## [Calculating percent](https://discuss.elastic.co/t/calculating-percent/293688)
**Author:** [@nabil86](https://discuss.elastic.co/u/nabil86)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 2:20am UTC](https://discuss.elastic.co/t/calculating-percent/293688 "2022-01-07T02:20:57Z")
Hello, I want to calculte the percent of a given type on my index: Ok\_Count/total , I wrote this query But it doesn't work as i excepted , could you help me to correct it { "aggs": { "total":{ "filter":… --- ## [How to split sometimes?](https://discuss.elastic.co/t/how-to-split-sometimes/293484)
**Author:** [@4art4](https://discuss.elastic.co/u/4art4)\ **Replies:** 7\ **Last updated:** [January 6, 2022, 6:00pm UTC](https://discuss.elastic.co/t/how-to-split-sometimes/293484 "2022-01-06T18:00:47Z")
So I have to deal with ingesting logs that a team member is generating. I'm getting json logs, and I think I am very close to getting the data. (So close.) The error I am getting now looks like this: \[2022-01-04T18:0… --- ## [Filters not working when used in actions yaml file, but it works when using the command line filters options](https://discuss.elastic.co/t/filters-not-working-when-used-in-actions-yaml-file-but-it-works-when-using-the-command-line-filters-options/293692)
**Author:** [@pedroplopez](https://discuss.elastic.co/u/pedroplopez)\ **Replies:** 0\ **Last updated:** [January 6, 2022, 9:43pm UTC](https://discuss.elastic.co/t/filters-not-working-when-used-in-actions-yaml-file-but-it-works-when-using-the-command-line-filters-options/293692 "2022-01-06T21:43:32Z")
Elasticsearch: Kibana Version: 7.15 Curator Version: 5.8.4 Hi, I'm working on creating an action file I can use with curator to delete Kibana indices older than 30 days from creation date. I wrote the following action … --- ## [Choosing hot/warm or keep only hot nodes](https://discuss.elastic.co/t/choosing-hot-warm-or-keep-only-hot-nodes/293689)
**Author:** [@nabil86](https://discuss.elastic.co/u/nabil86)\ **Replies:** 0\ **Last updated:** [January 6, 2022, 8:13pm UTC](https://discuss.elastic.co/t/choosing-hot-warm-or-keep-only-hot-nodes/293689 "2022-01-06T20:13:51Z")
Hello, Currently, i want to implement a cluster which can index 650GB of application logs /day with 2 weeks of retention data. I want to decide about cluster typology: Is Hot/wam architecture ⇒ Hot keep data for 2 da… --- ## [Painless Script in Ingest - Rename Field](https://discuss.elastic.co/t/painless-script-in-ingest-rename-field/292587)
**Author:** [@DefensiveDepth](https://discuss.elastic.co/u/DefensiveDepth)\ **Replies:** 3\ **Last updated:** [January 6, 2022, 7:55pm UTC](https://discuss.elastic.co/t/painless-script-in-ingest-rename-field/292587 "2022-01-06T19:55:11Z")
Hello there, Using an ingest pipeline, I am trying to uppercase the first char in a fieldname, for all fields under winlog.event\_data: { "script": { "lang": "painless", "source": "ctx.\_source.winlog.e… --- ## [One logstash pipeline listening multiple formats (same input)](https://discuss.elastic.co/t/one-logstash-pipeline-listening-multiple-formats-same-input/293381)
**Author:** [@vee](https://discuss.elastic.co/u/vee)\ **Replies:** 16\ **Last updated:** [January 6, 2022, 7:33pm UTC](https://discuss.elastic.co/t/one-logstash-pipeline-listening-multiple-formats-same-input/293381 "2022-01-06T19:33:16Z")
Hi - Working on a new requirement to parse through one file containing two different formatted messages and send to different indices on elastic. Filebeat (same file with two different formatted messages) -\> Logstash (… --- ## [Failed to parse field \[\[observer.hostname\]\]](https://discuss.elastic.co/t/failed-to-parse-field-observer-hostname/293676)
**Author:** [@eO2H\_LG](https://discuss.elastic.co/u/eO2H_LG)\ **Replies:** 3\ **Last updated:** [January 6, 2022, 6:48pm UTC](https://discuss.elastic.co/t/failed-to-parse-field-observer-hostname/293676 "2022-01-06T18:48:07Z")
Hello All, Hoping somebody can assist me with the following error. It seems some of my DHCP data is failing to ingest due to a parsing issue with the observer.hostname field. Below is the error output from logstash-pla… --- ## [Does PKI integration work with Basic/Free license?](https://discuss.elastic.co/t/does-pki-integration-work-with-basic-free-license/293671)
**Author:** [@Maryam2021](https://discuss.elastic.co/u/Maryam2021)\ **Replies:** 1\ **Last updated:** [January 6, 2022, 4:52pm UTC](https://discuss.elastic.co/t/does-pki-integration-work-with-basic-free-license/293671 "2022-01-06T16:52:51Z")
Hello All, Can we configure PKI for ELK stack on free tier? --- ## [7.16.2 Lens no showing value in dark mode](https://discuss.elastic.co/t/7-16-2-lens-no-showing-value-in-dark-mode/293665)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [January 6, 2022, 4:44pm UTC](https://discuss.elastic.co/t/7-16-2-lens-no-showing-value-in-dark-mode/293665 "2022-01-06T16:44:26Z")
In lens (pie) value is not readable as it print in dark color in dark mode. And I can't find this setting anywhere. is this bug or some kind of setting that I have to do? here is example. --- ## [Subfield not showing on the left side field after 7.16 upgrade](https://discuss.elastic.co/t/subfield-not-showing-on-the-left-side-field-after-7-16-upgrade/292626)
**Author:** [@isaackuang](https://discuss.elastic.co/u/isaackuang)\ **Replies:** 4\ **Last updated:** [January 6, 2022, 4:24pm UTC](https://discuss.elastic.co/t/subfield-not-showing-on-the-left-side-field-after-7-16-upgrade/292626 "2022-01-06T16:24:26Z")
When Upgrading to 7.16.1 from 7.15.2 The subfields from kubernetes object cannot show and analyze. But it can still searchable. Anyone can tell me how can I do to enable subfield parsing on left field for new ve… --- ## [ECS fields for E-Commerce](https://discuss.elastic.co/t/ecs-fields-for-e-commerce/292987)
**Author:** [@Jannik\_Z](https://discuss.elastic.co/u/Jannik_Z)\ **Replies:** 1\ **Last updated:** [January 6, 2022, 4:23pm UTC](https://discuss.elastic.co/t/ecs-fields-for-e-commerce/292987 "2022-01-06T16:23:23Z")
Hi there, I would like to bring new "non-log" ECS fields to the table and would love to get some feedback from the community. We want to sponsor fields for e-commerce: orders payments products ... I think, the e-comm… --- ## [TCP Input "Too many files open" IOException](https://discuss.elastic.co/t/tcp-input-too-many-files-open-ioexception/293499)
**Author:** [@ddth\_2022](https://discuss.elastic.co/u/ddth_2022)\ **Replies:** 5\ **Last updated:** [January 6, 2022, 4:14pm UTC](https://discuss.elastic.co/t/tcp-input-too-many-files-open-ioexception/293499 "2022-01-06T16:14:58Z")
We're running Logstash 7.16.2. We're using a TCP input that opens up too many sockets without closing them and almost every 24 hours Logstash hangs up. \[2022-01-05T05:10:59,474\]\[WARN \]\[io.netty.channel.DefaultChannelPip… --- ## [Making elastic persistence on Kubernetes env](https://discuss.elastic.co/t/making-elastic-persistence-on-kubernetes-env/293666)
**Author:** [@bargb](https://discuss.elastic.co/u/bargb)\ **Replies:** 0\ **Last updated:** [January 6, 2022, 3:27pm UTC](https://discuss.elastic.co/t/making-elastic-persistence-on-kubernetes-env/293666 "2022-01-06T15:27:16Z")
Hi.. I am running elastic on kubernetes cluster. My Yaml is as below but this is not persisting the data after elastic restarts. What should i do to persist it kind: PersistentVolumeClaim apiVersion: v1 metadata: nam… --- ## [Curl query from json](https://discuss.elastic.co/t/curl-query-from-json/293650)
**Author:** [@rusty\_cole](https://discuss.elastic.co/u/rusty_cole)\ **Replies:** 4\ **Last updated:** [January 6, 2022, 2:48pm UTC](https://discuss.elastic.co/t/curl-query-from-json/293650 "2022-01-06T14:48:57Z")
Hi guys, I have some query(witch works fine in kibana debugger), my goal is to make this query work from curl command line(windows). i have other queries with no issues. I think the problem is with the """ in the "r… --- ## [Kibana UI shows "No records found" message and then data showing](https://discuss.elastic.co/t/kibana-ui-shows-no-records-found-message-and-then-data-showing/293366)
**Author:** [@Kaviraj\_C](https://discuss.elastic.co/u/Kaviraj_C)\ **Replies:** 1\ **Last updated:** [January 6, 2022, 2:45pm UTC](https://discuss.elastic.co/t/kibana-ui-shows-no-records-found-message-and-then-data-showing/293366 "2022-01-06T14:45:06Z")
Hi All, While searching some text am getting initially No Results found msg and then the data showing. Can anyone help me to correct my issue. Elasticsearch version - 2.4.4. Kibana version- 4.6.7. [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1102) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1104)