# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1112 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1113 --- ## [ElasticSeach SSL Signed overrun error](https://discuss.elastic.co/t/elasticseach-ssl-signed-overrun-error/293071)
**Author:** [@a09hopper](https://discuss.elastic.co/u/a09hopper)\ **Replies:** 2\ **Last updated:** [December 28, 2021, 10:39pm UTC](https://discuss.elastic.co/t/elasticseach-ssl-signed-overrun-error/293071 "2021-12-28T22:39:31Z")
Searching around I have not seen anyone run into this error. I am using Elasticsearch 7.16.2 with a Windows CA, I request a CSR and then sign it with the Windows web enrolment under the web server setting, the followin… --- ## [Configuring auth with AD users](https://discuss.elastic.co/t/configuring-auth-with-ad-users/293007)
**Author:** [@Kirill\_Gofman](https://discuss.elastic.co/u/Kirill_Gofman)\ **Replies:** 1\ **Last updated:** [December 28, 2021, 9:34pm UTC](https://discuss.elastic.co/t/configuring-auth-with-ad-users/293007 "2021-12-28T21:34:14Z")
Hey, we are currently have elastic cloud with Elasticsearch and kibana on it. The login process atm is via deployments. We are looking to configure AD auth to kibana. I'm a little bit confused with all the guides. What … --- ## [Daily index vs hourly index, which is better for Search in period of month?](https://discuss.elastic.co/t/daily-index-vs-hourly-index-which-is-better-for-search-in-period-of-month/293026)
**Author:** [@jr2001](https://discuss.elastic.co/u/jr2001)\ **Replies:** 1\ **Last updated:** [December 28, 2021, 9:33pm UTC](https://discuss.elastic.co/t/daily-index-vs-hourly-index-which-is-better-for-search-in-period-of-month/293026 "2021-12-28T21:33:25Z")
Hi There, We have an indexing which is growing around 1.4 TB per day. this daily index have 4 million documents almost. each daily index has 6 primary shards and no replicas. we have 2 physical server (Ubuntu 20.04.2… --- ## [Issue securing Elasticsearch : elasticsearch-setup-passwords not installed](https://discuss.elastic.co/t/issue-securing-elasticsearch-elasticsearch-setup-passwords-not-installed/292821)
**Author:** [@dannymccaslin](https://discuss.elastic.co/u/dannymccaslin)\ **Replies:** 3\ **Last updated:** [December 28, 2021, 9:17pm UTC](https://discuss.elastic.co/t/issue-securing-elasticsearch-elasticsearch-setup-passwords-not-installed/292821 "2021-12-28T21:17:15Z")
I have a three-node Elasticsearch cluster running 6.8.22 and I'm trying to add passwords following the instructions here: https://www.elastic.co/guide/en/elasticsearch/reference/current/security-minimal-setup.html. Howev… --- ## [Help with my first elasticsearch mapping](https://discuss.elastic.co/t/help-with-my-first-elasticsearch-mapping/292358)
**Author:** [@4art4](https://discuss.elastic.co/u/4art4)\ **Replies:** 3\ **Last updated:** [December 28, 2021, 9:16pm UTC](https://discuss.elastic.co/t/help-with-my-first-elasticsearch-mapping/292358 "2021-12-28T21:16:25Z")
What I have is elasticserach ingesting something like: { "policy": { "name": "account-cloudtrail-enabled", "resource": "account" }, "metrics": \[{ "MetricName": "ResourceCount", "Timestamp": "2021-12-06T11:29:… --- ## [Need help to setup Data curation layer for Elastic stack](https://discuss.elastic.co/t/need-help-to-setup-data-curation-layer-for-elastic-stack/293037)
**Author:** [@aayu\_ssh](https://discuss.elastic.co/u/aayu_ssh)\ **Replies:** 1\ **Last updated:** [December 28, 2021, 8:58pm UTC](https://discuss.elastic.co/t/need-help-to-setup-data-curation-layer-for-elastic-stack/293037 "2021-12-28T20:58:31Z")
i am trying to setup a curation layer for my current existing elastic cloud cluster, but am not sure how to implement this, could nod find much help over the web. can someone help ? with curation layer, we are trying to… --- ## [How to send Custom Logs Agent to Logstash?](https://discuss.elastic.co/t/how-to-send-custom-logs-agent-to-logstash/293065)
**Author:** [@dannie-ml](https://discuss.elastic.co/u/dannie-ml)\ **Replies:** 8\ **Last updated:** [December 28, 2021, 7:59pm UTC](https://discuss.elastic.co/t/how-to-send-custom-logs-agent-to-logstash/293065 "2021-12-28T19:59:32Z")
Hi, i integrate it an elastics agent 'custom logs' and in the logs section this is the stream Now i want to parse some information in logstash, ¿how i can send that data to logstash? Please provide me a detail expla… --- ## [Read \*.json.gz from AWS S3 bucket](https://discuss.elastic.co/t/read-json-gz-from-aws-s3-bucket/292822)
**Author:** [@Vidya\_Sagar](https://discuss.elastic.co/u/Vidya_Sagar)\ **Replies:** 2\ **Last updated:** [December 28, 2021, 7:24pm UTC](https://discuss.elastic.co/t/read-json-gz-from-aws-s3-bucket/292822 "2021-12-28T19:24:45Z")
Hi All, I am new to ELK Stack and trying to read data from S3 buckets. The json data is in compressed format and the folder structure in the S3 bucket is like YYYY-MM-DD/.json.gz 2021-12-01/A.json.gz 2021-12-02/B.jso… --- ## [Logstash does not use the correct index with Elasticsearch output](https://discuss.elastic.co/t/logstash-does-not-use-the-correct-index-with-elasticsearch-output/293052)
**Author:** [@dat\_tang](https://discuss.elastic.co/u/dat_tang)\ **Replies:** 6\ **Last updated:** [December 28, 2021, 6:39pm UTC](https://discuss.elastic.co/t/logstash-does-not-use-the-correct-index-with-elasticsearch-output/293052 "2021-12-28T18:39:28Z")
Hi, I have an ELK stack which I updated 2 weeks ago from 7.2.0 to 7.16.1. The configuration did not change and is as follow: # all input will come from filebeat, no local logs input { beats { port =\> 5044 } } f… --- ## [Logstash JDBC driver](https://discuss.elastic.co/t/logstash-jdbc-driver/293041)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 1\ **Last updated:** [December 28, 2021, 6:16pm UTC](https://discuss.elastic.co/t/logstash-jdbc-driver/293041 "2021-12-28T18:16:09Z")
Hi dears I have upgraded my cluster form 7.6.2 to 7.16.2 There is only one problem I faced with. My Logstash has some pipelines that need to connect to a sql db and according to a statement, get a SP result from sql d… --- ## [Elasticsearch Flush latency is too high - by Zabbix monitoring](https://discuss.elastic.co/t/elasticsearch-flush-latency-is-too-high-by-zabbix-monitoring/293017)
**Author:** [@KrishnaCh](https://discuss.elastic.co/u/KrishnaCh)\ **Replies:** 6\ **Last updated:** [December 28, 2021, 3:01pm UTC](https://discuss.elastic.co/t/elasticsearch-flush-latency-is-too-high-by-zabbix-monitoring/293017 "2021-12-28T15:01:14Z")
Hi All, I have a 3-node all master-eligible cluster, with 8 cores vCPU and 40GB memory in each node. We have Zabbix monitoring enabled on all the nodes and its frequently triggering "Flush Latency is too high" and its … --- ## [How to calculate the cost of elasticsearch in AWS?](https://discuss.elastic.co/t/how-to-calculate-the-cost-of-elasticsearch-in-aws/292995)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 3\ **Last updated:** [December 28, 2021, 2:46pm UTC](https://discuss.elastic.co/t/how-to-calculate-the-cost-of-elasticsearch-in-aws/292995 "2021-12-28T14:46:13Z")
Hi, we are considering moving , one of our cluster, from on premise to AWS, is there a calculator to get how much it will cost? or a blog page, your personal experiences... the cluster has 3 nodes and 3 teras of data. --- ## [Kibana update from 7.10.2 to 7.16.2](https://discuss.elastic.co/t/kibana-update-from-7-10-2-to-7-16-2/293034)
**Author:** [@rahul.cheekoti](https://discuss.elastic.co/u/rahul.cheekoti)\ **Replies:** 1\ **Last updated:** [December 28, 2021, 11:38am UTC](https://discuss.elastic.co/t/kibana-update-from-7-10-2-to-7-16-2/293034 "2021-12-28T11:38:45Z")
I am trying to upgrade Elasticsearch and kibana from 7.10.2 to 7.16.2 , I have successful updated the Elasticsearch , but while I am updating the kibana I am getting below error : FATAL Error: Unable to complete saved … --- ## [Cannot import name 'Elasticsearch' from 'elasticsearch' (unknown location)](https://discuss.elastic.co/t/cannot-import-name-elasticsearch-from-elasticsearch-unknown-location/292991)
**Author:** [@Divyank\_Garg](https://discuss.elastic.co/u/Divyank_Garg)\ **Replies:** 1\ **Last updated:** [December 28, 2021, 11:20am UTC](https://discuss.elastic.co/t/cannot-import-name-elasticsearch-from-elasticsearch-unknown-location/292991 "2021-12-28T11:20:27Z")
I have installed Elasticsearch library and trying to import Elasticsearch from Elasticsearch library but getting issue: cannot import name 'Elasticsearch' from 'Elasticsearch' (unknown location) --- ## [Why is search\_after preferred over Scroll API?](https://discuss.elastic.co/t/why-is-search-after-preferred-over-scroll-api/292989)
**Author:** [@dandago](https://discuss.elastic.co/u/dandago)\ **Replies:** 1\ **Last updated:** [December 28, 2021, 11:13am UTC](https://discuss.elastic.co/t/why-is-search-after-preferred-over-scroll-api/292989 "2021-12-28T11:13:26Z")
I've read that "We no longer recommend using the scroll API for deep pagination. If you need to preserve the index state while paging through more than 10,000 hits, use the search\_after parameter with a point in time (… --- ## [Bug in Log4j mitigation steps in Logstash 5.x](https://discuss.elastic.co/t/bug-in-log4j-mitigation-steps-in-logstash-5-x/292612)
**Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Replies:** 5\ **Last updated:** [December 21, 2021, 8:38pm UTC](https://discuss.elastic.co/t/bug-in-log4j-mitigation-steps-in-logstash-5-x/292612 "2021-12-21T20:38:23Z")
There's an excellent article on Logstash remediation to protect against Log4jshell vulnerability - Logstash 5.0.0-6.8.20 and 7.0.0-7.16.0: Log4j CVE-2021-44228, CVE-2021-45046 remediation. However, the steps suggested f… --- ## [Internal Server Error : SavedObjectReferenceResolutionError: Failed to resolve Inventory default view "inventory-saved-view-0" (after 7.14.0 -\> 7.16.1 migration)](https://discuss.elastic.co/t/internal-server-error-savedobjectreferenceresolutionerror-failed-to-resolve-inventory-default-view-inventory-saved-view-0-after-7-14-0-7-16-1-migration/292204)
**Author:** [@AmauryB](https://discuss.elastic.co/u/AmauryB)\ **Replies:** 3\ **Last updated:** [December 28, 2021, 9:07am UTC](https://discuss.elastic.co/t/internal-server-error-savedobjectreferenceresolutionerror-failed-to-resolve-inventory-default-view-inventory-saved-view-0-after-7-14-0-7-16-1-migration/292204 "2021-12-28T09:07:27Z")
Before migrating from ELK 7.14.0 to ELK 7.16.1I had configured a specific Default Inventory view in the Observability Metrics App. After migration I get the following error \[2021-12-16T18:31:48.765+01:00\]\[ERROR\]\[http\] … --- ## [While compile my application using gradle, it gives error 'package org.elasticsearch.common.io.stream does not exist'](https://discuss.elastic.co/t/while-compile-my-application-using-gradle-it-gives-error-package-org-elasticsearch-common-io-stream-does-not-exist/293020)
**Author:** [@Arqam](https://discuss.elastic.co/u/Arqam)\ **Replies:** 0\ **Last updated:** [December 28, 2021, 7:19am UTC](https://discuss.elastic.co/t/while-compile-my-application-using-gradle-it-gives-error-package-org-elasticsearch-common-io-stream-does-not-exist/293020 "2021-12-28T07:19:36Z")
Hi all, I'm new to java/gradle/Elasticsearch/application(crate-db). I am trying to create a development setup of CRATE-DB application. But when I am compiling the application by ./gradlew compilejava command it is return… --- ## [Elasticsearch filter plugin doesn't work when using elasticsearch on cloud](https://discuss.elastic.co/t/elasticsearch-filter-plugin-doesnt-work-when-using-elasticsearch-on-cloud/293008)
**Author:** [@CasMeiron](https://discuss.elastic.co/u/CasMeiron)\ **Replies:** 1\ **Last updated:** [December 28, 2021, 12:39am UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-doesnt-work-when-using-elasticsearch-on-cloud/293008 "2021-12-28T00:39:46Z")
Hi, I've noticed that Elasticsearch filter plugin wont work if you try to connect to a Elasticsearch cloud instance. It seems it tries to append https:// twice (one already exists on cloud host resolution). Seems like … --- ## [Logstash Ruby How to get fields of json array](https://discuss.elastic.co/t/logstash-ruby-how-to-get-fields-of-json-array/292867)
**Author:** [@chandima\_jayamina](https://discuss.elastic.co/u/chandima_jayamina)\ **Replies:** 1\ **Last updated:** [December 27, 2021, 11:07pm UTC](https://discuss.elastic.co/t/logstash-ruby-how-to-get-fields-of-json-array/292867 "2021-12-27T23:07:19Z")
Hi I have an array "testItem":\["test1":"N", "test2":"", "test3":"xyz", "items":{"itemId":"123"},"test4","null"\] In here I want to extract the itemId from Json input through logstash how can i do it. I am new to logstas… --- ## [Logstash CPU gets pegged, all processing stops with Apache logs](https://discuss.elastic.co/t/logstash-cpu-gets-pegged-all-processing-stops-with-apache-logs/292985)
**Author:** [@erihar](https://discuss.elastic.co/u/erihar)\ **Replies:** 10\ **Last updated:** [December 27, 2021, 7:27pm UTC](https://discuss.elastic.co/t/logstash-cpu-gets-pegged-all-processing-stops-with-apache-logs/292985 "2021-12-27T19:27:40Z")
We are doing Apache accesslog ingestion into Logstash, from publicly-facing web servers. These work correctly, however after a day or two, some "crafty" requests come in, either from a security scan or hack attempt, and… --- ## [No data after CSV Export - Kibana](https://discuss.elastic.co/t/no-data-after-csv-export-kibana/290547)
**Author:** [@njain213](https://discuss.elastic.co/u/njain213)\ **Replies:** 10\ **Last updated:** [December 27, 2021, 6:27pm UTC](https://discuss.elastic.co/t/no-data-after-csv-export-kibana/290547 "2021-12-27T18:27:26Z")
Hi Team, On follow up on below issue can anyone help me out? --- ## [Logstash as a parser for data in column](https://discuss.elastic.co/t/logstash-as-a-parser-for-data-in-column/292352)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 21\ **Last updated:** [December 27, 2021, 4:57pm UTC](https://discuss.elastic.co/t/logstash-as-a-parser-for-data-in-column/292352 "2021-12-27T16:57:25Z")
Hi I'm wonder about approach for this specific data constructed in column. How I can parser only through logstash. Some of fields a specially "ENUM" "HEADER", "BLOCK", "DATE" etc, are changing dynamically. One files i… --- ## [Beginner - hoping to show only unique results in Discover search](https://discuss.elastic.co/t/beginner-hoping-to-show-only-unique-results-in-discover-search/292837)
**Author:** [@jeffkbiz](https://discuss.elastic.co/u/jeffkbiz)\ **Replies:** 4\ **Last updated:** [December 27, 2021, 4:31pm UTC](https://discuss.elastic.co/t/beginner-hoping-to-show-only-unique-results-in-discover-search/292837 "2021-12-27T16:31:12Z")
I'm doing a logstash firewall search with fields for source.ip, destination.ip, rule.name, hostname, action and need to go back one month. The number of hits is huge but so many are identical. Is there a way for me to … --- ## [Failing shard with illegal\_argument\_exception](https://discuss.elastic.co/t/failing-shard-with-illegal-argument-exception/292977)
**Author:** [@obol89](https://discuss.elastic.co/u/obol89)\ **Replies:** 1\ **Last updated:** [December 27, 2021, 2:53pm UTC](https://discuss.elastic.co/t/failing-shard-with-illegal-argument-exception/292977 "2021-12-27T14:53:59Z")
Hi Everyone, When I'm trying to filter some data in Kibana I'm getting this message "1 of 716 shards failed" with this explanation: illegal\_argument\_exception at shard 0 index metricbeat-7.15.0-2021.12.27 node bfnMWOK… --- ## [Scripted fields on large number of data](https://discuss.elastic.co/t/scripted-fields-on-large-number-of-data/292983)
**Author:** [@bazingaa](https://discuss.elastic.co/u/bazingaa)\ **Replies:** 0\ **Last updated:** [December 27, 2021, 2:31pm UTC](https://discuss.elastic.co/t/scripted-fields-on-large-number-of-data/292983 "2021-12-27T14:31:34Z")
I have a ES index with millions of records. Currently records are fetched using scroll api and are paginated. Also all fields are sortable. I have request for new additional fields (dependent on already existing fields)… --- ## [Question about Upgrading a cluster](https://discuss.elastic.co/t/question-about-upgrading-a-cluster/292964)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 2\ **Last updated:** [December 27, 2021, 2:06pm UTC](https://discuss.elastic.co/t/question-about-upgrading-a-cluster/292964 "2021-12-27T14:06:05Z")
Hi dears I have a question about upgrading process. I have already upgraded a dev environment cluster but the concern is about (maybe) some system index of production cluster. I want to know what will happen to my sav… --- ## [Date Module Filebeat](https://discuss.elastic.co/t/date-module-filebeat/292946)
**Author:** [@nurhambali](https://discuss.elastic.co/u/nurhambali)\ **Replies:** 1\ **Last updated:** [December 27, 2021, 1:59pm UTC](https://discuss.elastic.co/t/date-module-filebeat/292946 "2021-12-27T13:59:17Z")
hi, i'm create module fail2ban in filebeat but i have problem in date not match with dicovery kibana: and this is Pipeline module fail2ban: { "date" : { "field" : "fail2ban.date", "target\_… --- ## [Missing url](https://discuss.elastic.co/t/missing-url/292125)
**Author:** [@Nidhal\_Harrathi](https://discuss.elastic.co/u/Nidhal_Harrathi)\ **Replies:** 2\ **Last updated:** [December 27, 2021, 1:46pm UTC](https://discuss.elastic.co/t/missing-url/292125 "2021-12-27T13:46:13Z")
I have a particular http request logged in my access.log. The request is found using the http.referrer, but the corresponding url object is missing. I have the following configuration: Elasticsearch 7.16.1 Filebeat 7… --- ## [Trying to deploy elk as a docker service with certificate](https://discuss.elastic.co/t/trying-to-deploy-elk-as-a-docker-service-with-certificate/292961)
**Author:** [@Spyros\_Agriopoulos](https://discuss.elastic.co/u/Spyros_Agriopoulos)\ **Replies:** 0\ **Last updated:** [December 27, 2021, 8:49am UTC](https://discuss.elastic.co/t/trying-to-deploy-elk-as-a-docker-service-with-certificate/292961 "2021-12-27T08:49:27Z")
Hello all. Here is the problem: I have deployed an elk stack using docker compose, which worked fine up until recently. Now after a while one or more of the containers go down for some reason, and I am guessing it may b… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1111) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1113)