# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1110 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1111 --- ## [Logstash not start after upgrade to new version](https://discuss.elastic.co/t/logstash-not-start-after-upgrade-to-new-version/291849)
**Author:** [@Alexander\_Popov](https://discuss.elastic.co/u/Alexander_Popov)\ **Replies:** 9\ **Last updated:** [December 30, 2021, 4:48pm UTC](https://discuss.elastic.co/t/logstash-not-start-after-upgrade-to-new-version/291849 "2021-12-30T16:48:35Z")
was 7.10.2, upgrade to 7.16.1 but it not start: 21-12-14T17:31:17,721\]\[ERROR\]\[logstash.javapipeline \]\[main\] Pipeline error {:pipeline\_id=\>"main", :exception=\>#\ **Author:** [@sbemiller](https://discuss.elastic.co/u/sbemiller)\ **Replies:** 9\ **Last updated:** [December 30, 2021, 4:30pm UTC](https://discuss.elastic.co/t/issue-with-keystore-on-winlogbeat/293138 "2021-12-30T16:30:55Z") Elastic 7.15.1 I have read through a lot of discussions on how to solve this issue but nothing is working. I am working on an install process for the winlogbeat service. The Service installs and starts with no issues … --- ## [Kibana Plugin development: Search strategy vs. custom API route](https://discuss.elastic.co/t/kibana-plugin-development-search-strategy-vs-custom-api-route/293152)
**Author:** [@Specialist](https://discuss.elastic.co/u/Specialist)\ **Replies:** 2\ **Last updated:** [December 30, 2021, 4:19pm UTC](https://discuss.elastic.co/t/kibana-plugin-development-search-strategy-vs-custom-api-route/293152 "2021-12-30T16:19:44Z")
Hello, I am starting to develop a Kibana plugin, which is supposed to retrieve data from Elasticsearch and present it to the user in tabular form. I had a look at the "search\_examples" plugin, which exposes an aggregati… --- ## [Ability to change self passsword](https://discuss.elastic.co/t/ability-to-change-self-passsword/293086)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 4\ **Last updated:** [December 30, 2021, 3:51pm UTC](https://discuss.elastic.co/t/ability-to-change-self-passsword/293086 "2021-12-30T15:51:24Z")
I am setting up file based auth for the users using the below link , however it appears the user is not able to update the password by self. Am i missing anything ? --- ## [Enabling SSL Security between Elasticsearch & Kibana when both are on the same server](https://discuss.elastic.co/t/enabling-ssl-security-between-elasticsearch-kibana-when-both-are-on-the-same-server/293141)
**Author:** [@byoungman](https://discuss.elastic.co/u/byoungman)\ **Replies:** 5\ **Last updated:** [December 30, 2021, 3:41pm UTC](https://discuss.elastic.co/t/enabling-ssl-security-between-elasticsearch-kibana-when-both-are-on-the-same-server/293141 "2021-12-30T15:41:49Z")
I am trying to enable security and SSL for my Elastic Stack so that I can't take advantage of the additional functionality and protection that this affords us (e.g. Endpoint Security, Fleet, Integration, etc.) Earlier i… --- ## [Mlcategory -1 in 7.12](https://discuss.elastic.co/t/mlcategory-1-in-7-12/293212)
**Author:** [@evan2424](https://discuss.elastic.co/u/evan2424)\ **Replies:** 1\ **Last updated:** [December 30, 2021, 3:36pm UTC](https://discuss.elastic.co/t/mlcategory-1-in-7-12/293212 "2021-12-30T15:36:32Z")
We are using Elastic Stack 7.12, and have set up some machine learning jobs. When we visit the Anomaly Explorer for one of these jobs, there is a mlcategory -1 that does not have any category examples. I have tried runni… --- ## [Problem with pipeline, grok and dashboards](https://discuss.elastic.co/t/problem-with-pipeline-grok-and-dashboards/292818)
**Author:** [@roonick](https://discuss.elastic.co/u/roonick)\ **Replies:** 7\ **Last updated:** [December 30, 2021, 3:04pm UTC](https://discuss.elastic.co/t/problem-with-pipeline-grok-and-dashboards/292818 "2021-12-30T15:04:53Z")
Good day! I had following task. There was necessary to add additional field of client ip address from nginx logs. I composed next pipeline: filebeat -\> logstash (beats pipeline, frok) -\> Elasticsearch. Grok pattern wo… --- ## [Completion suggester high memory usage](https://discuss.elastic.co/t/completion-suggester-high-memory-usage/293209)
**Author:** [@caseydm](https://discuss.elastic.co/u/caseydm)\ **Replies:** 0\ **Last updated:** [December 30, 2021, 2:26pm UTC](https://discuss.elastic.co/t/completion-suggester-high-memory-usage/293209 "2021-12-30T14:26:51Z")
I am trying to add autocomplete to a field in Elasticsearch. The dataset is 260 million journal articles and I want to autocomplete based off of the title of the article. However, when I get to around 100 million indexed… --- ## [Hi is there any difference between match\_phrase and match\_phrase\_prefix?](https://discuss.elastic.co/t/hi-is-there-any-difference-between-match-phrase-and-match-phrase-prefix/293009)
**Author:** [@cnwdoug23](https://discuss.elastic.co/u/cnwdoug23)\ **Replies:** 3\ **Last updated:** [December 30, 2021, 12:11pm UTC](https://discuss.elastic.co/t/hi-is-there-any-difference-between-match-phrase-and-match-phrase-prefix/293009 "2021-12-30T12:11:25Z")
HI is there a difference between using match\_phrase and match\_phrase\_prefix? When do we use one over the other? thanks in advance. --- ## [Default keyword analyzer not work](https://discuss.elastic.co/t/default-keyword-analyzer-not-work/293194)
**Author:** [@5minutes](https://discuss.elastic.co/u/5minutes)\ **Replies:** 1\ **Last updated:** [December 30, 2021, 11:59am UTC](https://discuss.elastic.co/t/default-keyword-analyzer-not-work/293194 "2021-12-30T11:59:30Z")
Hi, I would like all my fields to be indexed as a keyword. Creating index: PUT abcd { "settings": { "analysis": { "analyzer": { "default": { "type": "keyword" } } } } … --- ## [Cisco Duo Integration not working](https://discuss.elastic.co/t/cisco-duo-integration-not-working/292746)
**Author:** [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Replies:** 9\ **Last updated:** [December 30, 2021, 11:46am UTC](https://discuss.elastic.co/t/cisco-duo-integration-not-working/292746 "2021-12-30T11:46:24Z")
Hello, I'm looking to ingest Cisco Duo logs, I signed up for a trial of Duo to test this out, but when adding the information to the Fleet integration, no logs are coming through to Elastic. I've followed the instructio… --- ## [Functionbeat missing package io/fs](https://discuss.elastic.co/t/functionbeat-missing-package-io-fs/284975)
**Author:** [@Yero\_Me](https://discuss.elastic.co/u/Yero_Me)\ **Replies:** 11\ **Last updated:** [December 30, 2021, 11:34am UTC](https://discuss.elastic.co/t/functionbeat-missing-package-io-fs/284975 "2021-12-30T11:34:18Z")
Hello, Since 7.15, deployment for functionbeat on GCP cloud function leads to an error : Function: functionbeat-XXXXX, could not update, error: error while creating function (code: 3): \[89\](/-/jobs/1615821324#L89)Buil… --- ## [Difference search\_analyzer and search\_quote\_analyzer](https://discuss.elastic.co/t/difference-search-analyzer-and-search-quote-analyzer/293197)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 0\ **Last updated:** [December 30, 2021, 10:40am UTC](https://discuss.elastic.co/t/difference-search-analyzer-and-search-quote-analyzer/293197 "2021-12-30T10:40:11Z")
Hi team, I am learning analyzer in Elasticsearch and i have little confusion what is the use of search\_analyzer and search\_quote\_analyzer i have read the documentation but i couldn't understand. Case 1 PUT my\_index-00… --- ## [Httop Poller Input Plugin - Need help](https://discuss.elastic.co/t/httop-poller-input-plugin-need-help/293107)
**Author:** [@Anusha\_Kusanghi](https://discuss.elastic.co/u/Anusha_Kusanghi)\ **Replies:** 2\ **Last updated:** [December 30, 2021, 10:50am UTC](https://discuss.elastic.co/t/httop-poller-input-plugin-need-help/293107 "2021-12-30T10:50:11Z")
Hie Everyone, HTTP poller plugin when used fetches only 1000 records from the URL triggered even though the actual response has more than 1000 events. ​ here is the config file : input { http\_poller { urls =\> { … --- ## [How can we achive this in elasticsearch](https://discuss.elastic.co/t/how-can-we-achive-this-in-elasticsearch/292594)
**Author:** [@ajeet\_jha1](https://discuss.elastic.co/u/ajeet_jha1)\ **Replies:** 4\ **Last updated:** [December 30, 2021, 9:51am UTC](https://discuss.elastic.co/t/how-can-we-achive-this-in-elasticsearch/292594 "2021-12-30T09:51:46Z")
when I search this "elasticsearchfulltext search" On google I get the result "Showing results for Elasticsearch full text search" --- ## [Couldn't find any elasticsearch data (index pattern) / but index available in index management tab](https://discuss.elastic.co/t/couldnt-find-any-elasticsearch-data-index-pattern-but-index-available-in-index-management-tab/293105)
**Author:** [@julianf19](https://discuss.elastic.co/u/julianf19)\ **Replies:** 2\ **Last updated:** [December 30, 2021, 9:05am UTC](https://discuss.elastic.co/t/couldnt-find-any-elasticsearch-data-index-pattern-but-index-available-in-index-management-tab/293105 "2021-12-30T09:05:00Z")
Hi, I am using kibana 7.9.0 and it's the first time I try to create an index pattern. The data is there, I upload it with python and as you can see the data is available in the index management tab: But when I try … --- ## [Error in parsing Pretty Json Data](https://discuss.elastic.co/t/error-in-parsing-pretty-json-data/293103)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 4\ **Last updated:** [December 30, 2021, 6:51am UTC](https://discuss.elastic.co/t/error-in-parsing-pretty-json-data/293103 "2021-12-30T06:51:43Z")
Hi team I have file in json format. \[ { "year": 2013, "title": "Rush", "info": { "directors": \["Ron Howard"\], "release\_date": "2013-09-02T00:00:00Z", "rat… --- ## [Merge 2 index based off fields and not rows](https://discuss.elastic.co/t/merge-2-index-based-off-fields-and-not-rows/292706)
**Author:** [@Sugand](https://discuss.elastic.co/u/Sugand)\ **Replies:** 7\ **Last updated:** [December 30, 2021, 5:36am UTC](https://discuss.elastic.co/t/merge-2-index-based-off-fields-and-not-rows/292706 "2021-12-30T05:36:10Z")
Hi ES team, I'm looking to merge 2 index's based off unique ID which is same across both the index and the desired index should look like, Index 1 Fields ID, Email, Fax Index 2 Fields ID, Email, Fax Now the merge… --- ## [Winlogbeat collect log from difference windows log source](https://discuss.elastic.co/t/winlogbeat-collect-log-from-difference-windows-log-source/293166)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 0\ **Last updated:** [December 30, 2021, 2:55am UTC](https://discuss.elastic.co/t/winlogbeat-collect-log-from-difference-windows-log-source/293166 "2021-12-30T02:55:52Z")
Hi all, In one of my systems i recently change the folder which windows event log get stored. Now i want to know if winlogbeat can collect log from the changed source or i have to change the config file to point to wher… --- ## [BM25 how to scoring ignore idf or set scope for total number of documents with search field](https://discuss.elastic.co/t/bm25-how-to-scoring-ignore-idf-or-set-scope-for-total-number-of-documents-with-search-field/293104)
**Author:** [@wlc015f](https://discuss.elastic.co/u/wlc015f)\ **Replies:** 0\ **Last updated:** [December 29, 2021, 11:03am UTC](https://discuss.elastic.co/t/bm25-how-to-scoring-ignore-idf-or-set-scope-for-total-number-of-documents-with-search-field/293104 "2021-12-29T11:03:34Z")
elasticsearch version 7.16.2 index settings : "similarity" : { "default" : { "type" : "BM25", "b" : "0.75", "k1" : "1.2" } } Data example: { "application" : 110, "… --- ## [Why doesn't DevTool get error "index\_closed\_exception" with same query syntax?](https://discuss.elastic.co/t/why-doesnt-devtool-get-error-index-closed-exception-with-same-query-syntax/293030)
**Author:** [@jenhouwu](https://discuss.elastic.co/u/jenhouwu)\ **Replies:** 1\ **Last updated:** [December 30, 2021, 1:34am UTC](https://discuss.elastic.co/t/why-doesnt-devtool-get-error-index-closed-exception-with-same-query-syntax/293030 "2021-12-30T01:34:37Z")
Hi, I try to prepare a search to query indices name as a-\*, for some reason I closed some of a-\* indices that are one month old. I can get data by Kibana DevTool even if I query closed index. However when I use "curl" … --- ## [KIbana no data over FQDN](https://discuss.elastic.co/t/kibana-no-data-over-fqdn/289416)
**Author:** [@yanick](https://discuss.elastic.co/u/yanick)\ **Replies:** 3\ **Last updated:** [December 15, 2021, 11:48pm UTC](https://discuss.elastic.co/t/kibana-no-data-over-fqdn/289416 "2021-12-15T23:48:44Z")
Hey there, Currently, I have a problem with Kibana, which is behind a proxy. If I log in (over the FQDN) to Kibana there is no data shown in the Tab "Analytics - Discover" and in the Tab "Security" (all sub-tabs). If I… --- ## [Assign completion suggest weight with field value in logstash](https://discuss.elastic.co/t/assign-completion-suggest-weight-with-field-value-in-logstash/293155)
**Author:** [@caseydm](https://discuss.elastic.co/u/caseydm)\ **Replies:** 3\ **Last updated:** [December 29, 2021, 11:19pm UTC](https://discuss.elastic.co/t/assign-completion-suggest-weight-with-field-value-in-logstash/293155 "2021-12-29T23:19:09Z")
I am trying to add a weight to a completion suggest field using logstash, but I'm getting errors. Has anybody done this? The completion suggester field is set up as follows: display\_name": { "type": "text", "fi… --- ## [Under what circumstances can log4j be used to exploit Logstash?](https://discuss.elastic.co/t/under-what-circumstances-can-log4j-be-used-to-exploit-logstash/291886)
**Author:** [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Replies:** 8\ **Last updated:** [December 29, 2021, 9:54pm UTC](https://discuss.elastic.co/t/under-what-circumstances-can-log4j-be-used-to-exploit-logstash/291886 "2021-12-29T21:54:13Z")
Hi, Under what circumstances can the log4j bug be exploited in Logstash? Is it as simple as sending the exploit string an open port Logstash is listening on regardless of whatever input is configured in your Logstash co… --- ## [Integrations Docs](https://discuss.elastic.co/t/integrations-docs/293093)
**Author:** [@Sagi\_Tiger1](https://discuss.elastic.co/u/Sagi_Tiger1)\ **Replies:** 1\ **Last updated:** [December 29, 2021, 8:41pm UTC](https://discuss.elastic.co/t/integrations-docs/293093 "2021-12-29T20:41:42Z")
Im trying to locate some docs or guides on how to setup integrations using Kibana but unable to. Is there a specific area these are located in? Im trying to setup vpc flow logs to ES using an Integration but im stuck on … --- ## [Referencing a value within a bucket within a bucket](https://discuss.elastic.co/t/referencing-a-value-within-a-bucket-within-a-bucket/292823)
**Author:** [@walshe06](https://discuss.elastic.co/u/walshe06)\ **Replies:** 0\ **Last updated:** [December 23, 2021, 3:26pm UTC](https://discuss.elastic.co/t/referencing-a-value-within-a-bucket-within-a-bucket/292823 "2021-12-23T15:26:04Z")
Hi I am looking to create a watcher alert to trigger if the value within a bucket is above a certain threshold. However the value will vary as it is within a bucket within a bucket. The value is shown in (ctx.payload.pe… --- ## [How to visualize a query in kibana](https://discuss.elastic.co/t/how-to-visualize-a-query-in-kibana/293019)
**Author:** [@cva](https://discuss.elastic.co/u/cva)\ **Replies:** 1\ **Last updated:** [December 29, 2021, 6:54pm UTC](https://discuss.elastic.co/t/how-to-visualize-a-query-in-kibana/293019 "2021-12-29T18:54:51Z")
Hello! need help with visualizing this query in kibana: { "size": 0, "aggs": { "orders\_per\_day": { "terms": { "script": { "lang": "painless", "source": "doc\['ctime'\].value.dayOf… --- ## [Json parsing problem](https://discuss.elastic.co/t/json-parsing-problem/293110)
**Author:** [@rusty\_cole](https://discuss.elastic.co/u/rusty_cole)\ **Replies:** 3\ **Last updated:** [December 29, 2021, 6:10pm UTC](https://discuss.elastic.co/t/json-parsing-problem/293110 "2021-12-29T18:10:01Z")
Hi Guys, I have a problem with ingesting json data. I am guessing that the problem is with the structure. I have tried different configurations (with and without the json codec). Any idea? The json data: \[{"name": … --- ## [Date range query returns no hits](https://discuss.elastic.co/t/date-range-query-returns-no-hits/293134)
**Author:** [@knwosu](https://discuss.elastic.co/u/knwosu)\ **Replies:** 5\ **Last updated:** [December 29, 2021, 5:59pm UTC](https://discuss.elastic.co/t/date-range-query-returns-no-hits/293134 "2021-12-29T17:59:55Z")
I am trying to get all the hits from a specific index over the past 24 hours. I entered the following command into the kibana dev console, but no hits are being returned. GET /my-index/\_search { "query": { "range"… --- ## [Nested, flattened or object](https://discuss.elastic.co/t/nested-flattened-or-object/292974)
**Author:** [@ailengcon](https://discuss.elastic.co/u/ailengcon)\ **Replies:** 0\ **Last updated:** [December 27, 2021, 1:30pm UTC](https://discuss.elastic.co/t/nested-flattened-or-object/292974 "2021-12-27T13:30:19Z")
I am trying to figure out if I should use the datatype nested, flattened och object when using an index template to better map my index. I've got some large documents with some arrays and several objects within them. I … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1109) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1111)