# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1115 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1116 --- ## [How to whitelist again a email which is unsubscribed by the end user in Elastic Cloud?](https://discuss.elastic.co/t/how-to-whitelist-again-a-email-which-is-unsubscribed-by-the-end-user-in-elastic-cloud/292784)
**Author:** [@Gaurav2](https://discuss.elastic.co/u/Gaurav2)\ **Replies:** 0\ **Last updated:** [December 23, 2021, 9:03am UTC](https://discuss.elastic.co/t/how-to-whitelist-again-a-email-which-is-unsubscribed-by-the-end-user-in-elastic-cloud/292784 "2021-12-23T09:03:41Z")
Hello, we are using Elastic Cloud. we have configured alerts with the Elastic SMTP (preconfigure one which comes with Elastic Cloud default). It works fine. but one of our users has clicked on un-subscribe to the email … --- ## [How to send watcher alert email via gmail SMTP in Elastic Cloud?](https://discuss.elastic.co/t/how-to-send-watcher-alert-email-via-gmail-smtp-in-elastic-cloud/292783)
**Author:** [@Gaurav2](https://discuss.elastic.co/u/Gaurav2)\ **Replies:** 0\ **Last updated:** [December 23, 2021, 9:00am UTC](https://discuss.elastic.co/t/how-to-send-watcher-alert-email-via-gmail-smtp-in-elastic-cloud/292783 "2021-12-23T09:00:03Z")
Hello, we are trying to set watcher alerts via Gmail SMTP. we found some references in the official documentation and that seems to be of on-prem ELK Step. it is possible to do in Elastic Cloud? --- ## [Autoscaling on hosted elastic](https://discuss.elastic.co/t/autoscaling-on-hosted-elastic/292764)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 2\ **Last updated:** [December 23, 2021, 8:58am UTC](https://discuss.elastic.co/t/autoscaling-on-hosted-elastic/292764 "2021-12-23T08:58:53Z")
Hi, I am using hosted es with v 11.1.2. I am having two nodes with 1 primary shard and 1 replica shard in each node. (for 1 index- 1 primary and 1 replica shard) Autoscaling is enabled for clusters. During autoscaling… --- ## [Logstash new connection and connection reset](https://discuss.elastic.co/t/logstash-new-connection-and-connection-reset/292782)
**Author:** [@alfianaf](https://discuss.elastic.co/u/alfianaf)\ **Replies:** 0\ **Last updated:** [December 23, 2021, 8:35am UTC](https://discuss.elastic.co/t/logstash-new-connection-and-connection-reset/292782 "2021-12-23T08:35:38Z")
Hello, I was looking for explanation on the logstash logs about "new connection" and "connection reset", and I couldn't find any clue. Does "new connection" mean that a new connection has been established from client to… --- ## [Failed to connect to backoff while connecting Winlogbeat with Logstash](https://discuss.elastic.co/t/failed-to-connect-to-backoff-while-connecting-winlogbeat-with-logstash/292781)
**Author:** [@risshukla](https://discuss.elastic.co/u/risshukla)\ **Replies:** 0\ **Last updated:** [December 23, 2021, 8:35am UTC](https://discuss.elastic.co/t/failed-to-connect-to-backoff-while-connecting-winlogbeat-with-logstash/292781 "2021-12-23T08:35:06Z")
Hello Everyone, I am trying to update Winlogbeat to 7.16.2 to make it compatible with Logstash 7.16.2. Our configuration was already working between two stack on version 7.6.0, so we are upgrading just the minor versio… --- ## [Can't select data by time on time picker. See all data only](https://discuss.elastic.co/t/cant-select-data-by-time-on-time-picker-see-all-data-only/292771)
**Author:** [@Alex\_C](https://discuss.elastic.co/u/Alex_C)\ **Replies:** 1\ **Last updated:** [December 23, 2021, 8:24am UTC](https://discuss.elastic.co/t/cant-select-data-by-time-on-time-picker-see-all-data-only/292771 "2021-12-23T08:24:15Z")
Hi. I use Kibana 7.16.1 I'm trying to analyze the log that comes from a CSV file (Windows File bat --\> Logstash --\> Elastic) There is a date and time of events in the log During processing in Logstash, I add this dat… --- ## [CICD pipeline for testing the logstash config](https://discuss.elastic.co/t/cicd-pipeline-for-testing-the-logstash-config/292778)
**Author:** [@WimDH](https://discuss.elastic.co/u/WimDH)\ **Replies:** 0\ **Last updated:** [December 23, 2021, 8:24am UTC](https://discuss.elastic.co/t/cicd-pipeline-for-testing-the-logstash-config/292778 "2021-12-23T08:24:12Z")
Dears, I have my logstash config in gitlab, from where I deploy it on my production machines. As the config grows, and others contribute to it, the risk of getting errors is becoming bigger. Therefore, I would like to … --- ## [7.15.2 is also very slow](https://discuss.elastic.co/t/7-15-2-is-also-very-slow/290596)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 17\ **Last updated:** [December 23, 2021, 7:23am UTC](https://discuss.elastic.co/t/7-15-2-is-also-very-slow/290596 "2021-12-23T07:23:37Z")
following thread is close hence open new one. https://discuss.elastic.co/t/7-15-1-is-extremely-slow/287617/10 I show 7.15.2 is out hence decided to test in this setup I have Elasticsearch -\> 7.15.1 and kibane 7.15.2. … --- ## [EQL scenario doesn't match](https://discuss.elastic.co/t/eql-scenario-doesnt-match/292765)
**Author:** [@ateethrigvedi](https://discuss.elastic.co/u/ateethrigvedi)\ **Replies:** 0\ **Last updated:** [December 23, 2021, 6:20am UTC](https://discuss.elastic.co/t/eql-scenario-doesnt-match/292765 "2021-12-23T06:20:53Z")
I was trying to match some lines using EQL, but no match was found in-spite of having lines which matches the criteria in Elasticsearch. Kindly provide some leads about the same. Thanks in advance EQL QUERY: GET /inde… --- ## [Filebeat kafka input using multiline parser gives no output](https://discuss.elastic.co/t/filebeat-kafka-input-using-multiline-parser-gives-no-output/292290)
**Author:** [@rsniper](https://discuss.elastic.co/u/rsniper)\ **Replies:** 1\ **Last updated:** [December 23, 2021, 5:27am UTC](https://discuss.elastic.co/t/filebeat-kafka-input-using-multiline-parser-gives-no-output/292290 "2021-12-23T05:27:39Z")
I have posted the issue on stackoverflow as well Filebeat kafka input using multiline parser gives no output Filebeat is configured to use input from kafka and output to file When the multiline setting is turned off, … --- ## [Is it possible to use secrets from Elasticsearch keystore in ES Watcher actions?](https://discuss.elastic.co/t/is-it-possible-to-use-secrets-from-elasticsearch-keystore-in-es-watcher-actions/292755)
**Author:** [@andrewthetack](https://discuss.elastic.co/u/andrewthetack)\ **Replies:** 1\ **Last updated:** [December 23, 2021, 4:08am UTC](https://discuss.elastic.co/t/is-it-possible-to-use-secrets-from-elasticsearch-keystore-in-es-watcher-actions/292755 "2021-12-23T04:08:02Z")
I use watchers that call custom webhooks in their actions sections. Can I refer keystore values in the Authorization headers similar to variables? I need something similar to: "actions": { "my-api-notification": { … --- ## [Elastic Stack upgradation from 7.13.4 to 7.16.2](https://discuss.elastic.co/t/elastic-stack-upgradation-from-7-13-4-to-7-16-2/292703)
**Author:** [@chandra\_mohan1](https://discuss.elastic.co/u/chandra_mohan1)\ **Replies:** 2\ **Last updated:** [December 23, 2021, 4:14am UTC](https://discuss.elastic.co/t/elastic-stack-upgradation-from-7-13-4-to-7-16-2/292703 "2021-12-23T04:14:58Z")
We are planning to update elastic stack which contains, Elasticsearch cluster, Logstash, Kibana & Elasticsearch Monitoring cluster. We are not using any beats to ship data to logstash. Data to monitoring cluster is ship… --- ## [How to install Elasticsearch & Logstash using RPM for version 7.13.4](https://discuss.elastic.co/t/how-to-install-elasticsearch-logstash-using-rpm-for-version-7-13-4/292715)
**Author:** [@chandra\_mohan1](https://discuss.elastic.co/u/chandra_mohan1)\ **Replies:** 2\ **Last updated:** [December 23, 2021, 4:13am UTC](https://discuss.elastic.co/t/how-to-install-elasticsearch-logstash-using-rpm-for-version-7-13-4/292715 "2021-12-23T04:13:46Z")
I want install Elasticsearch & Logstash of version 7.13.4 using RPM to perform some testing. I am trying to install using using RPM package mentioned here: \[Installing Logstash | Logstash Reference \[7.16\] | Elastic\](htt… --- ## [How to join two index](https://discuss.elastic.co/t/how-to-join-two-index/292629)
**Author:** [@arisxf](https://discuss.elastic.co/u/arisxf)\ **Replies:** 5\ **Last updated:** [December 23, 2021, 2:11am UTC](https://discuss.elastic.co/t/how-to-join-two-index/292629 "2021-12-23T02:11:36Z")
I've tried using aliases (aliases a and b) the results alert The data you are seeing might be incomplete or wrong. in the field at index b. Please help me POST /\_aliases { "actions" : \[ { "add" : { "index" :… --- ## [Some vulnerabilities in repository S3 plugin for Elasticsearch](https://discuss.elastic.co/t/some-vulnerabilities-in-repository-s3-plugin-for-elasticsearch/292748)
**Author:** [@Sagarika\_Mahalik](https://discuss.elastic.co/u/Sagarika_Mahalik)\ **Replies:** 1\ **Last updated:** [December 23, 2021, 1:17am UTC](https://discuss.elastic.co/t/some-vulnerabilities-in-repository-s3-plugin-for-elasticsearch/292748 "2021-12-23T01:17:52Z")
Hi There are some Vulnerabilities which are coming from repository S3 plugin in these two jar jackson-databind-2.10.4.jar log4j-1.2-api-2.11.1.jar Please have a look into these. --- ## [Zero-day-exploit in log4j2 which is part of elasticsearch](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439)
**Author:** [@spotlight2001](https://discuss.elastic.co/u/spotlight2001)\ **Replies:** 93\ **Last updated:** [December 23, 2021, 12:44am UTC](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439 "2021-12-23T00:44:47Z")
Elasticsearch 7.1.1 seems to contain log4j 2.11.1 So is Elasticsearch affected? Will there be a new 7.1.x? --- ## [Transform not synching](https://discuss.elastic.co/t/transform-not-synching/292699)
**Author:** [@iamtheschmitzer](https://discuss.elastic.co/u/iamtheschmitzer)\ **Replies:** 8\ **Last updated:** [December 22, 2021, 10:20pm UTC](https://discuss.elastic.co/t/transform-not-synching/292699 "2021-12-22T22:20:50Z")
Hi trying to build my first transform - a latest transform. Maybe I misunderstand, but I expect to create and start the transform and it runs continuously - so new documents in the source index are processed and reflec… --- ## [ES transforms behaviour change after upgrading from 7.10.0 to 7.16.1](https://discuss.elastic.co/t/es-transforms-behaviour-change-after-upgrading-from-7-10-0-to-7-16-1/292700)
**Author:** [@brna](https://discuss.elastic.co/u/brna)\ **Replies:** 3\ **Last updated:** [December 22, 2021, 10:05pm UTC](https://discuss.elastic.co/t/es-transforms-behaviour-change-after-upgrading-from-7-10-0-to-7-16-1/292700 "2021-12-22T22:05:38Z")
I am observing a change in the way es transforms work after the cluster upgrade from 7.10.0 to 7.16.1 It is a continuous transform with filter on source index that would get all of the documents from the source index wi… --- ## [MSSQL input hanging after update](https://discuss.elastic.co/t/mssql-input-hanging-after-update/292742)
**Author:** [@tobias\_c](https://discuss.elastic.co/u/tobias_c)\ **Replies:** 0\ **Last updated:** [December 22, 2021, 9:41pm UTC](https://discuss.elastic.co/t/mssql-input-hanging-after-update/292742 "2021-12-22T21:41:45Z")
Hi all After updating from logstash 7.5.1 to 7.16.2 and updating from mssql.jdbc.4.2.jar to mssql.jdbc.9.4 (for jdk11 as the bundled jdk version) I cannot transfer my mssql data to Elasticsearch anymore. Logstash jdbc … --- ## [Apache Log4j2 vulnerability](https://discuss.elastic.co/t/apache-log4j2-vulnerability/292690)
**Author:** [@Amina\_LAARIM-SC](https://discuss.elastic.co/u/Amina_LAARIM-SC)\ **Replies:** 3\ **Last updated:** [December 22, 2021, 9:25pm UTC](https://discuss.elastic.co/t/apache-log4j2-vulnerability/292690 "2021-12-22T21:25:23Z")
Hello community, I am using Elasticsearch 6.2.1 and I can't find any information if this version is impacted with the Apache Log4j2 vulnerability discovered at the begining of this month. Do you have any information pl… --- ## [Is it possible to add custom labels to Maps?](https://discuss.elastic.co/t/is-it-possible-to-add-custom-labels-to-maps/292640)
**Author:** [@Arrick](https://discuss.elastic.co/u/Arrick)\ **Replies:** 1\ **Last updated:** [December 22, 2021, 8:41pm UTC](https://discuss.elastic.co/t/is-it-possible-to-add-custom-labels-to-maps/292640 "2021-12-22T20:41:04Z")
So currently my map shows count of article\* where article is my database name and is counting based on how many data I have; which is alright for me. However, I was wondering is it possible to add more custom labels to m… --- ## [Setup Filebeat to run as a service](https://discuss.elastic.co/t/setup-filebeat-to-run-as-a-service/292726)
**Author:** [@vharabor](https://discuss.elastic.co/u/vharabor)\ **Replies:** 2\ **Last updated:** [December 22, 2021, 8:25pm UTC](https://discuss.elastic.co/t/setup-filebeat-to-run-as-a-service/292726 "2021-12-22T20:25:40Z")
I've setup Filebeat on AWS Amazon Linux 2 AMI using the setup instruction here : (Filebeat quick start: installation and configuration | Filebeat Reference \[7.16\] | Elastic) So basically : curl -L -O https://artifacts.… --- ## [Question regarding the IDF value for the optional fields in a document](https://discuss.elastic.co/t/question-regarding-the-idf-value-for-the-optional-fields-in-a-document/290598)
**Author:** [@kaykanloo](https://discuss.elastic.co/u/kaykanloo)\ **Replies:** 3\ **Last updated:** [December 22, 2021, 8:18pm UTC](https://discuss.elastic.co/t/question-regarding-the-idf-value-for-the-optional-fields-in-a-document/290598 "2021-12-22T20:18:46Z")
Hi, I'm relatively new to Elasticsearch, so I'm probably missing something trivial here, but I'm having issues with the relevancy score of the search results when it comes to optional fields in documents. Consider the f… --- ## [Math computation in TSVB](https://discuss.elastic.co/t/math-computation-in-tsvb/292704)
**Author:** [@Sugand](https://discuss.elastic.co/u/Sugand)\ **Replies:** 1\ **Last updated:** [December 22, 2021, 8:00pm UTC](https://discuss.elastic.co/t/math-computation-in-tsvb/292704 "2021-12-22T20:00:29Z")
Hi ES team, Attached is the screenshot of the computation done using TSVB via filter ratio and TinyMath. The desired output I'm looking at is to filter Total Blanks \> 2 and display only the ID's corresponding to the sa… --- ## [Why is /\_search with scroll different?](https://discuss.elastic.co/t/why-is-search-with-scroll-different/292720)
**Author:** [@PeterMmm](https://discuss.elastic.co/u/PeterMmm)\ **Replies:** 1\ **Last updated:** [December 22, 2021, 7:56pm UTC](https://discuss.elastic.co/t/why-is-search-with-scroll-different/292720 "2021-12-22T19:56:27Z")
I have this api search (ES 7.10.2) https://host:19102/myindex/cat/\_search?filter\_path=hits.total that returns { "hits": { "total": { "value": 10000, "relation": "gte" } … --- ## [My Kibana is not being able to connect with my Elasticsearch because of Self-Signed Certificate](https://discuss.elastic.co/t/my-kibana-is-not-being-able-to-connect-with-my-elasticsearch-because-of-self-signed-certificate/292730)
**Author:** [@FernandoDurier](https://discuss.elastic.co/u/FernandoDurier)\ **Replies:** 2\ **Last updated:** [December 22, 2021, 7:15pm UTC](https://discuss.elastic.co/t/my-kibana-is-not-being-able-to-connect-with-my-elasticsearch-because-of-self-signed-certificate/292730 "2021-12-22T19:15:11Z")
Good day, everyone! Hope you are doing well. I'm trying to connect my dockerized Kibana service with my IBM Cloud Elasticsearch. In the past, I had no issue with another instance of Elasticsearch running inside a RHOS… --- ## [Logstash - grokparsefailure](https://discuss.elastic.co/t/logstash-grokparsefailure/292705)
**Author:** [@hassen\_k](https://discuss.elastic.co/u/hassen_k)\ **Replies:** 1\ **Last updated:** [December 22, 2021, 6:27pm UTC](https://discuss.elastic.co/t/logstash-grokparsefailure/292705 "2021-12-22T18:27:31Z")
Hi, Logstash version 7.16.2 I am trying to parse the following logs: amAuthWindowsDesktopSSO:12/22/2021 03:55:44:349 PM CET: Thread\[http-nio-8080-exec-3,5,main\]: TransactionId\[b742688f-6089-41c4-925d-ba08dce4d7b7-1491… --- ## [Kibana 7.16 External Plugin creation](https://discuss.elastic.co/t/kibana-7-16-external-plugin-creation/292733)
**Author:** [@ssimmons](https://discuss.elastic.co/u/ssimmons)\ **Replies:** 0\ **Last updated:** [December 22, 2021, 6:08pm UTC](https://discuss.elastic.co/t/kibana-7-16-external-plugin-creation/292733 "2021-12-22T18:08:27Z")
I'm trying to create an external plugin using Kibana 7.16. I've done this with 7.5 and 7.10. I'm hoping I can move our plugins over to 7.16. I ran the kibana generate\_plugin script and created a plugin with a UI componen… --- ## [Cluster re-balancing issue](https://discuss.elastic.co/t/cluster-re-balancing-issue/292685)
**Author:** [@arunpmohan](https://discuss.elastic.co/u/arunpmohan)\ **Replies:** 3\ **Last updated:** [December 22, 2021, 5:34pm UTC](https://discuss.elastic.co/t/cluster-re-balancing-issue/292685 "2021-12-22T17:34:31Z")
We have a cluster with zoning enabled. Zone-A has 15 hot nodes+10 warm nodes and Zone-B has 14 hot nodes + 10 warm nodes (one node was taken out due to repeated issues). The cluster was doing well until the last we… --- ## [One or more required cgroup files or directories not found: /proc/self/cgroup, /sys/fs/cgroup/cpuacct, /sys/fs/cgroup/cpu](https://discuss.elastic.co/t/one-or-more-required-cgroup-files-or-directories-not-found-proc-self-cgroup-sys-fs-cgroup-cpuacct-sys-fs-cgroup-cpu/292689)
**Author:** [@rusty\_cole](https://discuss.elastic.co/u/rusty_cole)\ **Replies:** 6\ **Last updated:** [December 22, 2021, 5:21pm UTC](https://discuss.elastic.co/t/one-or-more-required-cgroup-files-or-directories-not-found-proc-self-cgroup-sys-fs-cgroup-cpuacct-sys-fs-cgroup-cpu/292689 "2021-12-22T17:21:14Z")
Hi Guys, I have logstash running on a windows machine. My inputs and parsers are set up correctly and everything works fine. The only issue I have - when I start the logstash process, it wont ingest files, instead it… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1114) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1116)