# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1114 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1115 --- ## [Mapping null values](https://discuss.elastic.co/t/mapping-null-values/292900)
**Author:** [@Emile\_Plas](https://discuss.elastic.co/u/Emile_Plas)\ **Replies:** 1\ **Last updated:** [December 24, 2021, 4:02pm UTC](https://discuss.elastic.co/t/mapping-null-values/292900 "2021-12-24T16:02:17Z")
Hey everyone! I am quite new to Elasticsearch so feel free to criticize my work method. I am currently working on a project in which multiple pdf documents (a series of court decisions) need to be searched. The PDF docu… --- ## [How to divide and visualize two aggregated data？](https://discuss.elastic.co/t/how-to-divide-and-visualize-two-aggregated-data/292758)
**Author:** [@wsysx123](https://discuss.elastic.co/u/wsysx123)\ **Replies:** 4\ **Last updated:** [December 24, 2021, 3:50pm UTC](https://discuss.elastic.co/t/how-to-divide-and-visualize-two-aggregated-data/292758 "2021-12-24T15:50:25Z")
As a beginner of Kibana, I feel very powerful. However, there is a problem that cannot be realized at present, so I hereby ask for advice. Suppose I have two fields, named 'key1' and 'key2', and aggregation them by 1 mi… --- ## [Filebeat config check isn't reliable](https://discuss.elastic.co/t/filebeat-config-check-isnt-reliable/292807)
**Author:** [@javond](https://discuss.elastic.co/u/javond)\ **Replies:** 1\ **Last updated:** [December 24, 2021, 3:06pm UTC](https://discuss.elastic.co/t/filebeat-config-check-isnt-reliable/292807 "2021-12-24T15:06:27Z")
With that config fields: domain: XXXXXXXXX filebeat: config: inputs: enabled: true path: /etc/filebeat/inputs.d/\*.yaml reload: enabled: true period: 30s modules: path:… --- ## [GROK Filter not working as expected](https://discuss.elastic.co/t/grok-filter-not-working-as-expected/292796)
**Author:** [@KVerbeeck](https://discuss.elastic.co/u/KVerbeeck)\ **Replies:** 2\ **Last updated:** [December 24, 2021, 3:04pm UTC](https://discuss.elastic.co/t/grok-filter-not-working-as-expected/292796 "2021-12-24T15:04:56Z")
Hello, While applying custom GROK filters to my sample data, i get unexpected results. Sample Data: hotspot offering lease x.x.x.x for xx:xx:xx:xx:xx:xx without success Grok Pattern: %{WORD:network.name} (?\ **Author:** [@denizzengin](https://discuss.elastic.co/u/denizzengin)\ **Replies:** 0\ **Last updated:** [December 24, 2021, 1:29pm UTC](https://discuss.elastic.co/t/elastic-search-1-7-1-log4j2-vulnerability-fix/292899 "2021-12-24T13:29:07Z") Hi, How to fix security problem for 1.7.1 version without upgrade our Elasticsearch version ? --- ## [Cloudflare Logs via Logstash](https://discuss.elastic.co/t/cloudflare-logs-via-logstash/291743)
**Author:** [@ZiaulAfiq](https://discuss.elastic.co/u/ZiaulAfiq)\ **Replies:** 5\ **Last updated:** [December 24, 2021, 1:24pm UTC](https://discuss.elastic.co/t/cloudflare-logs-via-logstash/291743 "2021-12-24T13:24:43Z")
Hello & Greetings all! I'm doing some testing to retrieve Cloudflare logs using Logstash. My approach in retrieving the Cloudflare logs are by using Bash script to pull the logs from cloudflare then push them to logstas… --- ## [Parse json data](https://discuss.elastic.co/t/parse-json-data/292893)
**Author:** [@royalE](https://discuss.elastic.co/u/royalE)\ **Replies:** 0\ **Last updated:** [December 24, 2021, 12:57pm UTC](https://discuss.elastic.co/t/parse-json-data/292893 "2021-12-24T12:57:21Z")
Parsing nested json in Logstash below is a sample of my file , I am not able to read the json files in logstash since it has nested json field inside the message.I need to know what is the best way to read file in logst… --- ## [How to sort on second same (field) value](https://discuss.elastic.co/t/how-to-sort-on-second-same-field-value/292888)
**Author:** [@Wilco\_R](https://discuss.elastic.co/u/Wilco_R)\ **Replies:** 0\ **Last updated:** [December 24, 2021, 11:57am UTC](https://discuss.elastic.co/t/how-to-sort-on-second-same-field-value/292888 "2021-12-24T11:57:50Z")
Hi people, I ran into an sorting problem, which is very hard for me to find out how to do it. What i want to achieve is to query the data to sort it in a way that the second(or higher) of the same configuration\_id is a… --- ## [Elastic Agent is healthy but no datastream display in Fleet Server](https://discuss.elastic.co/t/elastic-agent-is-healthy-but-no-datastream-display-in-fleet-server/292879)
**Author:** [@ZiaulAfiq](https://discuss.elastic.co/u/ZiaulAfiq)\ **Replies:** 1\ **Last updated:** [December 24, 2021, 11:32am UTC](https://discuss.elastic.co/t/elastic-agent-is-healthy-but-no-datastream-display-in-fleet-server/292879 "2021-12-24T11:32:29Z")
Hello & Greetings all! I have successfully install Elastic agent (7.16.2) inside my Elasticsearch cluster but did not receive data stream output from the Elastic agent itself. After some troubleshooting for the install… --- ## [Load multiple tables data from oltp to elasticsearch using logstash](https://discuss.elastic.co/t/load-multiple-tables-data-from-oltp-to-elasticsearch-using-logstash/292886)
**Author:** [@umang\_t](https://discuss.elastic.co/u/umang_t)\ **Replies:** 0\ **Last updated:** [December 24, 2021, 11:17am UTC](https://discuss.elastic.co/t/load-multiple-tables-data-from-oltp-to-elasticsearch-using-logstash/292886 "2021-12-24T11:17:19Z")
What is the efficient way to load data from multiple tables (e.g. 10 to 15 tables from RDBMS) in to Elasticsearch . Note the RDBMS has records in millions so idea is to flatten the resultset and load in Elasticsearch . H… --- ## [KIBANA Visualization](https://discuss.elastic.co/t/kibana-visualization/292859)
**Author:** [@vikram\_singh](https://discuss.elastic.co/u/vikram_singh)\ **Replies:** 1\ **Last updated:** [December 24, 2021, 7:09am UTC](https://discuss.elastic.co/t/kibana-visualization/292859 "2021-12-24T07:09:31Z")
Hi, I am visualizing dat in kibana bar Chart ( Horizontal and vertical). I showed data (numeric value) in stack view on a bar. I am getting all values of that bar on hover. I Also want to show sum of stack values on … --- ## [How to use painless BigDecimal in java code?](https://discuss.elastic.co/t/how-to-use-painless-bigdecimal-in-java-code/292780)
**Author:** [@xiaozhiliaoo](https://discuss.elastic.co/u/xiaozhiliaoo)\ **Replies:** 1\ **Last updated:** [December 24, 2021, 6:20am UTC](https://discuss.elastic.co/t/how-to-use-painless-bigdecimal-in-java-code/292780 "2021-12-24T06:20:58Z")
I use painless to update doc. how to use BigDecimal to finish it ? Using Elasticsearch 6.8.1. Script JavaDoc Script construtor is: public Script (ScriptType type, java.lang.String lang, ja… --- ## [Unit logstash.service entered failed state](https://discuss.elastic.co/t/unit-logstash-service-entered-failed-state/292865)
**Author:** [@cva](https://discuss.elastic.co/u/cva)\ **Replies:** 0\ **Last updated:** [December 24, 2021, 6:02am UTC](https://discuss.elastic.co/t/unit-logstash-service-entered-failed-state/292865 "2021-12-24T06:02:28Z")
Hi! OS Centos 7, java -version openjdk version "1.8.0\_252" Updated the version of logstash to 7.16.2, now at startup I get the following systemctl status logstash: Dec 24 01:27:08 elk systemd\[1\]: Unit logstash.servic… --- ## [Some vulnerabilities in Elasticsearch v7.10.0 x-pack, Elasticsearch sql cli 7.10.0, plugin cli, security cli](https://discuss.elastic.co/t/some-vulnerabilities-in-elasticsearch-v7-10-0-x-pack-elasticsearch-sql-cli-7-10-0-plugin-cli-security-cli/292745)
**Author:** [@Sagarika\_Mahalik](https://discuss.elastic.co/u/Sagarika_Mahalik)\ **Replies:** 1\ **Last updated:** [December 24, 2021, 5:30am UTC](https://discuss.elastic.co/t/some-vulnerabilities-in-elasticsearch-v7-10-0-x-pack-elasticsearch-sql-cli-7-10-0-plugin-cli-security-cli/292745 "2021-12-24T05:30:22Z")
Hi, There are some Vulnerabilities in Elasticsearch 7.10.0 version. Some vulnerabilities in Elasticsearch v7.10.0 x-pack, Elasticsearch sql cli 7.10.0, plugin cli, security cli. While installing Elasticsearch all of t… --- ## [Track frontend application UI events? Better way?](https://discuss.elastic.co/t/track-frontend-application-ui-events-better-way/292861)
**Author:** [@nagendrahk](https://discuss.elastic.co/u/nagendrahk)\ **Replies:** 2\ **Last updated:** [December 24, 2021, 4:58am UTC](https://discuss.elastic.co/t/track-frontend-application-ui-events-better-way/292861 "2021-12-24T04:58:05Z")
I want to build ELK application to track frontend events from my react application. I having two approaches in mind Store events in log file using winston package and later push it to logstash and elastic with filebeat… --- ## [7.16.2 triggering Google Cloud security alert](https://discuss.elastic.co/t/7-16-2-triggering-google-cloud-security-alert/292618)
**Author:** [@gehgerds](https://discuss.elastic.co/u/gehgerds)\ **Replies:** 7\ **Last updated:** [December 23, 2021, 11:16pm UTC](https://discuss.elastic.co/t/7-16-2-triggering-google-cloud-security-alert/292618 "2021-12-23T23:16:53Z")
After bumping the docker image version to elasticsearch:7.16.2 in GKE, whenever I start elasticsearch pod, it immediately triggers a security alert Added Library Loaded Added\_Library\_Fullpath: /tmp/twIW2T (deleted) de… --- ## [Backup to s3 repo from elasticsearch 6.8.22](https://discuss.elastic.co/t/backup-to-s3-repo-from-elasticsearch-6-8-22/292836)
**Author:** [@zorruch](https://discuss.elastic.co/u/zorruch)\ **Replies:** 2\ **Last updated:** [December 23, 2021, 9:33pm UTC](https://discuss.elastic.co/t/backup-to-s3-repo-from-elasticsearch-6-8-22/292836 "2021-12-23T21:33:05Z")
hi I am using elasticsearch 6.8.22 with plugin repository-s3 I also use ceph s3 storage running on rook(k8s) I'm trying to set up a snapshot backup for it: I create a repository command: curl -sk -X PUT "https://lo… --- ## [Index alias](https://discuss.elastic.co/t/index-alias/292829)
**Author:** [@iamtheschmitzer](https://discuss.elastic.co/u/iamtheschmitzer)\ **Replies:** 1\ **Last updated:** [December 23, 2021, 4:13pm UTC](https://discuss.elastic.co/t/index-alias/292829 "2021-12-23T16:13:03Z")
If I have a rollover index foo-000001, which rolls over to foo-N and alias index foo for them, is foo equivalent to the "latest" of those rollovers or the "union" of them? Thanks --- ## [Multiple Conditions in Elastic Watcher](https://discuss.elastic.co/t/multiple-conditions-in-elastic-watcher/292716)
**Author:** [@ishyherts](https://discuss.elastic.co/u/ishyherts)\ **Replies:** 3\ **Last updated:** [December 23, 2021, 4:11pm UTC](https://discuss.elastic.co/t/multiple-conditions-in-elastic-watcher/292716 "2021-12-23T16:11:42Z")
Hi, I am using a watcher to alert via email if "tracking.softQuota.percentageUsed" \> 50(%) - this record (hit) also comes with a field meta.application which identifies a certain client or customer. This watcher runs m… --- ## [High CPU utilization on two nodes due to DSL Queries and slower query response](https://discuss.elastic.co/t/high-cpu-utilization-on-two-nodes-due-to-dsl-queries-and-slower-query-response/292535)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 5\ **Last updated:** [December 23, 2021, 3:45pm UTC](https://discuss.elastic.co/t/high-cpu-utilization-on-two-nodes-due-to-dsl-queries-and-slower-query-response/292535 "2021-12-23T15:45:41Z")
Hi, I am using elastic version 7.11.2. I am observing that two nodes that contain an index of 102Gb (51+51), multiple DSL queries are running in the background resulting in high CPU utilization. Enabled autoscaling on … --- ## [Disable specific deprecation warnings](https://discuss.elastic.co/t/disable-specific-deprecation-warnings/292678)
**Author:** [@joschi](https://discuss.elastic.co/u/joschi)\ **Replies:** 8\ **Last updated:** [December 23, 2021, 3:16pm UTC](https://discuss.elastic.co/t/disable-specific-deprecation-warnings/292678 "2021-12-23T15:16:24Z")
Hey folks, after upgrading to Elasticsearch 7.16.2, we receive the following deprecation warning in our clients (Java High-Level REST client): org.elasticsearch.client.RestClient - request \[POST http://example.com:9200… --- ## [Performance issues even with only text TSBV](https://discuss.elastic.co/t/performance-issues-even-with-only-text-tsbv/292815)
**Author:** [@mdgdeveloper](https://discuss.elastic.co/u/mdgdeveloper)\ **Replies:** 0\ **Last updated:** [December 23, 2021, 2:49pm UTC](https://discuss.elastic.co/t/performance-issues-even-with-only-text-tsbv/292815 "2021-12-23T14:49:33Z")
We have been facing several performance issues with dashboards in Kibana 7.13 Multiple data requests to /api/metrics/vis/data stay in "pending" status and the dashboard takes more than 30/40 seconds to render. Even in … --- ## [Logstash configuration file in joining two csv files based on primary key](https://discuss.elastic.co/t/logstash-configuration-file-in-joining-two-csv-files-based-on-primary-key/292792)
**Author:** [@Dhamu-143](https://discuss.elastic.co/u/Dhamu-143)\ **Replies:** 1\ **Last updated:** [December 23, 2021, 2:36pm UTC](https://discuss.elastic.co/t/logstash-configuration-file-in-joining-two-csv-files-based-on-primary-key/292792 "2021-12-23T14:36:03Z")
Hi, I'm not able to join the two csv files based on the primary key(same value or same field). I'm taking two csv input files that are shown below Student Table(Table 1) Stdid,sname,fee 121,john,10000 123,glenn,120… --- ## [Xml input messy fields](https://discuss.elastic.co/t/xml-input-messy-fields/292812)
**Author:** [@abdullah144](https://discuss.elastic.co/u/abdullah144)\ **Replies:** 2\ **Last updated:** [December 23, 2021, 2:29pm UTC](https://discuss.elastic.co/t/xml-input-messy-fields/292812 "2021-12-23T14:29:52Z")
Hey Guys , I already can sent a log to my logstash as my log is xml format , but the issue is logstash creating a new fields from tag as below : I want to stop him creating the new fields from logMessage tag . My … --- ## [How to consume Logstash through the Postman](https://discuss.elastic.co/t/how-to-consume-logstash-through-the-postman/292702)
**Author:** [@abdullah144](https://discuss.elastic.co/u/abdullah144)\ **Replies:** 1\ **Last updated:** [December 22, 2021, 3:08pm UTC](https://discuss.elastic.co/t/how-to-consume-logstash-through-the-postman/292702 "2021-12-22T15:08:46Z")
Hey guys, I have a requirement to push data to Logstash through Postman where it will be automatically store it in Elasticsearch , how can I do that ? Best Regards, --- ## [Data not sent to ElasticSearch (with Logstash)](https://discuss.elastic.co/t/data-not-sent-to-elasticsearch-with-logstash/292696)
**Author:** [@Greninja\_San](https://discuss.elastic.co/u/Greninja_San)\ **Replies:** 6\ **Last updated:** [December 23, 2021, 2:03pm UTC](https://discuss.elastic.co/t/data-not-sent-to-elasticsearch-with-logstash/292696 "2021-12-23T14:03:22Z")
Hello! I'm trying to send data to Elasticsearch with logstash on a Linux server. For some reasons, I do not get any error, but nothing is sent. input { file { path =\> \["/srv/XXX/csv\_receivers/XXX\_receiver/\*"\] … --- ## [How can I delete and insert parent document?](https://discuss.elastic.co/t/how-can-i-delete-and-insert-parent-document/292803)
**Author:** [@Ulan\_Zhenisserov](https://discuss.elastic.co/u/Ulan_Zhenisserov)\ **Replies:** 0\ **Last updated:** [December 23, 2021, 12:50pm UTC](https://discuss.elastic.co/t/how-can-i-delete-and-insert-parent-document/292803 "2021-12-23T12:50:33Z")
Hi. Can someone help me with this as i want to delete my parent docs in my parent child relationship and insert it again to the index. How will it work? This again inserted parent document will be in the same shard as it… --- ## [Azure Billing in Fleet integration](https://discuss.elastic.co/t/azure-billing-in-fleet-integration/292797)
**Author:** [@dabo](https://discuss.elastic.co/u/dabo)\ **Replies:** 0\ **Last updated:** [December 23, 2021, 11:09am UTC](https://discuss.elastic.co/t/azure-billing-in-fleet-integration/292797 "2021-12-23T11:09:50Z")
Hi, Any idea when will Azure Billing be added to Azure integration in Fleet (elastic agent). I can see this PR is open: Create Azure billing package by narph · Pull Request #1052 · elastic/integrations · GitHub Kind r… --- ## [Filebeat, different indices from different CSV](https://discuss.elastic.co/t/filebeat-different-indices-from-different-csv/292724)
**Author:** [@giron](https://discuss.elastic.co/u/giron)\ **Replies:** 1\ **Last updated:** [December 23, 2021, 10:29am UTC](https://discuss.elastic.co/t/filebeat-different-indices-from-different-csv/292724 "2021-12-23T10:29:28Z")
Hi all, I need your help to understand where or what is wrong. I need to read different file csv (for now 4 csv) and write the data in 4 indexs on elastic using Filebeat. This configuration with 2 CSV, 2 indexs and 2 p… --- ## [Logstash with two dissect - only the first dissect is used now and then](https://discuss.elastic.co/t/logstash-with-two-dissect-only-the-first-dissect-is-used-now-and-then/292794)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 1\ **Last updated:** [December 23, 2021, 10:09am UTC](https://discuss.elastic.co/t/logstash-with-two-dissect-only-the-first-dissect-is-used-now-and-then/292794 "2021-12-23T10:09:14Z")
Hi All, I have the following conf { syslog { host =\> "127.0.0.1" port =\> 5000 } } filter { if \[program\] == "github\_auth" or \[program == "github\_gitauth"\] or \[progr… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1113) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1115)