# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1118 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1119 --- ## [How to resolve "Failed to poll for work. Work has timed out" error](https://discuss.elastic.co/t/how-to-resolve-failed-to-poll-for-work-work-has-timed-out-error/291538)
**Author:** [@mertkaant](https://discuss.elastic.co/u/mertkaant)\ **Replies:** 3\ **Last updated:** [December 21, 2021, 12:02pm UTC](https://discuss.elastic.co/t/how-to-resolve-failed-to-poll-for-work-work-has-timed-out-error/291538 "2021-12-21T12:02:27Z")
Hello, dear elastic community, We recently upgraded our ELK stack to 7.15.2 from 7.7.0. All my nodes are on the same version (7.15.2) After the upgrade, our Kibana's status goes yellow repeatedly. When it goes yellow … --- ## [No signature of method: java.util.ArrayList.get() is applicable for argument types: (org.codehaus.groovy.runtime.GStringImpl)](https://discuss.elastic.co/t/no-signature-of-method-java-util-arraylist-get-is-applicable-for-argument-types-org-codehaus-groovy-runtime-gstringimpl/292554)
**Author:** [@dishant](https://discuss.elastic.co/u/dishant)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 11:51am UTC](https://discuss.elastic.co/t/no-signature-of-method-java-util-arraylist-get-is-applicable-for-argument-types-org-codehaus-groovy-runtime-gstringimpl/292554 "2021-12-21T11:51:53Z")
I am trying to make an Elasticsearch plugin for Elasticsearch version 5.6.16 and using the gradle version 4.7. I am using oracle jdk9. Whenever, I'm trying to create the project build, it is giving me an error. I have su… --- ## [Esrally warmup explaination](https://discuss.elastic.co/t/esrally-warmup-explaination/291307)
**Author:** [@fentom](https://discuss.elastic.co/u/fentom)\ **Replies:** 2\ **Last updated:** [December 21, 2021, 11:13am UTC](https://discuss.elastic.co/t/esrally-warmup-explaination/291307 "2021-12-21T11:13:54Z")
Hi, I'm new to Elasticsearch and ESRally. I want to run some benchmarks but I don't understand how the warmup-iterations parameter for tracks works. Documentation says "Number of iterations that each client should execu… --- ## [Run Winlogbeat service under a custom account](https://discuss.elastic.co/t/run-winlogbeat-service-under-a-custom-account/292465)
**Author:** [@a.gavric](https://discuss.elastic.co/u/a.gavric)\ **Replies:** 1\ **Last updated:** [December 21, 2021, 11:11am UTC](https://discuss.elastic.co/t/run-winlogbeat-service-under-a-custom-account/292465 "2021-12-21T11:11:17Z")
Hi, I've been having some difficulties setting up winglobeat to run as a service under a custom domain account with logon as a service rights on a windows 2016 server. The reason we are doing that is to be compliant with… --- ## [Problem with Refresh button for visualizations in Kibana 7.16.1](https://discuss.elastic.co/t/problem-with-refresh-button-for-visualizations-in-kibana-7-16-1/292469)
**Author:** [@Fer\_dominguez](https://discuss.elastic.co/u/Fer_dominguez)\ **Replies:** 3\ **Last updated:** [December 21, 2021, 10:47am UTC](https://discuss.elastic.co/t/problem-with-refresh-button-for-visualizations-in-kibana-7-16-1/292469 "2021-12-21T10:47:16Z")
Hi, In Kibana v7.16.1 inside a vertical bar visualization (didn't test on other types), when I click the Refresh button, the graph is not updated, and I know the data is being updated. I can see that the data is actuall… --- ## [Manage Thread Pool in Elasticsearch](https://discuss.elastic.co/t/manage-thread-pool-in-elasticsearch/292493)
**Author:** [@yash\_196](https://discuss.elastic.co/u/yash_196)\ **Replies:** 6\ **Last updated:** [December 21, 2021, 10:22am UTC](https://discuss.elastic.co/t/manage-thread-pool-in-elasticsearch/292493 "2021-12-21T10:22:48Z")
Hi Team, Is there any way to increase the queue size for write and search using JAVA API's / High Level Rest Client? --- ## [Save a field into another index](https://discuss.elastic.co/t/save-a-field-into-another-index/292455)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 2\ **Last updated:** [December 21, 2021, 10:18am UTC](https://discuss.elastic.co/t/save-a-field-into-another-index/292455 "2021-12-21T10:18:55Z")
Hi folks, I am using the mapper size plugin to save the size of the document to be able to create dashboards, so a developer can see how much log data he produces within his containers in kubernetes/openshift. I am usin… --- ## [Elasticsearch 7.3.2 log4j2 properties changes](https://discuss.elastic.co/t/elasticsearch-7-3-2-log4j2-properties-changes/292242)
**Author:** [@Siva\_Karan](https://discuss.elastic.co/u/Siva_Karan)\ **Replies:** 2\ **Last updated:** [December 21, 2021, 10:18am UTC](https://discuss.elastic.co/t/elasticsearch-7-3-2-log4j2-properties-changes/292242 "2021-12-21T10:18:24Z")
Hi , we are using the Elasticsearch 7.3.2 it runs on jdk8, for log4j2 properties changes what are the things need to do in JVM file. --- ## [Use processor like translate plugin in logstash for filebeat](https://discuss.elastic.co/t/use-processor-like-translate-plugin-in-logstash-for-filebeat/291987)
**Author:** [@Paf](https://discuss.elastic.co/u/Paf)\ **Replies:** 2\ **Last updated:** [December 21, 2021, 9:40am UTC](https://discuss.elastic.co/t/use-processor-like-translate-plugin-in-logstash-for-filebeat/291987 "2021-12-21T09:40:29Z")
Hi, I want to use processor like translate plugin in Logstash for Filebeat, to compare a field value with a list from file and add another field if matched. I search processor in Filbeat documentation, but I did not fi… --- ## [Logstash Rspec Test Library, how does it fundamentally work when creating pipelines?](https://discuss.elastic.co/t/logstash-rspec-test-library-how-does-it-fundamentally-work-when-creating-pipelines/292537)
**Author:** [@UXabre](https://discuss.elastic.co/u/UXabre)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 8:54am UTC](https://discuss.elastic.co/t/logstash-rspec-test-library-how-does-it-fundamentally-work-when-creating-pipelines/292537 "2021-12-21T08:54:33Z")
So, I've been using rspec for a while now while testing my "simple" pipeline configs. However, as of recent, I'd like to use "complex" filters like "aggregate" and "memcached" but it is hard, if not impossible to find t… --- ## [Logstash pipelines failing after JNDI lookup class removed from version 7.4.2](https://discuss.elastic.co/t/logstash-pipelines-failing-after-jndi-lookup-class-removed-from-version-7-4-2/292539)
**Author:** [@Rahul\_Dey](https://discuss.elastic.co/u/Rahul_Dey)\ **Replies:** 1\ **Last updated:** [December 21, 2021, 9:07am UTC](https://discuss.elastic.co/t/logstash-pipelines-failing-after-jndi-lookup-class-removed-from-version-7-4-2/292539 "2021-12-21T09:07:11Z")
For threat mitigation of log4j vulnerability in Logstash, I have removed that JNDI look up class from Logstash docker image by adding the below lines in Dockerfile as advised by Elastic team. RUN bin/ruby -rzip -e \\ '… --- ## [Addressing log4j vulnerability for 1.x and 2.x elasticsearch](https://discuss.elastic.co/t/addressing-log4j-vulnerability-for-1-x-and-2-x-elasticsearch/292531)
**Author:** [@stecino](https://discuss.elastic.co/u/stecino)\ **Replies:** 1\ **Last updated:** [December 21, 2021, 8:47am UTC](https://discuss.elastic.co/t/addressing-log4j-vulnerability-for-1-x-and-2-x-elasticsearch/292531 "2021-12-21T08:47:07Z")
I am sure there are still people out there who are using this. Anyone with 1.7 and/or 2.3 that have to deal with this? --- ## [URI Parts Processor decodes an encoded & in URL query](https://discuss.elastic.co/t/uri-parts-processor-decodes-an-encoded-in-url-query/292534)
**Author:** [@plailla](https://discuss.elastic.co/u/plailla)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 8:34am UTC](https://discuss.elastic.co/t/uri-parts-processor-decodes-an-encoded-in-url-query/292534 "2021-12-21T08:34:13Z")
Hello, I'm fairly new to the Elastic Stack. I've set up a cluster that receives Tomcat access logs from Filebeats. I'm using the default Ingest Pipeline created by the Apache module in Filebeat, which uses the processo… --- ## [Unexpected behaviour for auto\_create\_index](https://discuss.elastic.co/t/unexpected-behaviour-for-auto-create-index/292487)
**Author:** [@hapeka](https://discuss.elastic.co/u/hapeka)\ **Replies:** 4\ **Last updated:** [December 21, 2021, 8:15am UTC](https://discuss.elastic.co/t/unexpected-behaviour-for-auto-create-index/292487 "2021-12-21T08:15:53Z")
Hi, I have a question about the cluster setting "action.auto\_create\_index". I set it to "false" to avoid indices from being created automatically when a PUT is sent to index a document. It works without problem when I … --- ## [Receiving "timed out waiting for all nodes to process published state"](https://discuss.elastic.co/t/receiving-timed-out-waiting-for-all-nodes-to-process-published-state/291670)
**Author:** [@pratiksha](https://discuss.elastic.co/u/pratiksha)\ **Replies:** 13\ **Last updated:** [December 21, 2021, 7:44am UTC](https://discuss.elastic.co/t/receiving-timed-out-waiting-for-all-nodes-to-process-published-state/291670 "2021-12-21T07:44:44Z")
I am using Elasticsearch v6.6.1. There are total 16 nodes (10 data, 3 master, 3 client). I see a frequent message in elected master logs: {"type":"log","host":"Elasticsearch-master-55ff74b94d-ckhfw","level":"WARN", "ti… --- ## [Unique Count and Currency Format in Elasticsearch](https://discuss.elastic.co/t/unique-count-and-currency-format-in-elasticsearch/292444)
**Author:** [@arungoel142](https://discuss.elastic.co/u/arungoel142)\ **Replies:** 3\ **Last updated:** [December 21, 2021, 7:14am UTC](https://discuss.elastic.co/t/unique-count-and-currency-format-in-elasticsearch/292444 "2021-12-21T07:14:36Z")
I am facing unique count accuracy issue in Elasticsearch and currency format indian change. Please help. --- ## [Native controller process has stopped - no new native processes can be started and then elasticsearch node stoped](https://discuss.elastic.co/t/native-controller-process-has-stopped-no-new-native-processes-can-be-started-and-then-elasticsearch-node-stoped/292527)
**Author:** [@qinkkai](https://discuss.elastic.co/u/qinkkai)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 6:43am UTC](https://discuss.elastic.co/t/native-controller-process-has-stopped-no-new-native-processes-can-be-started-and-then-elasticsearch-node-stoped/292527 "2021-12-21T06:43:50Z")
I have two nodes in my Elasticsearch cluster and have same configurations and environment. cat /etc/centos-release CentOS Linux release 7.8.2003 (Core) uname -r 3.10.0-1127.8.2.el7.x86\_64 sysctl vm.max\_map\_count vm… --- ## [CVE-2021-44228 - Logstahs - ERROR StatusLogger Log4j2 could not find a logging implementation. Please add log4j-core to the classpath](https://discuss.elastic.co/t/cve-2021-44228-logstahs-error-statuslogger-log4j2-could-not-find-a-logging-implementation-please-add-log4j-core-to-the-classpath/291798)
**Author:** [@prajyodh](https://discuss.elastic.co/u/prajyodh)\ **Replies:** 3\ **Last updated:** [December 21, 2021, 6:41am UTC](https://discuss.elastic.co/t/cve-2021-44228-logstahs-error-statuslogger-log4j2-could-not-find-a-logging-implementation-please-add-log4j-core-to-the-classpath/291798 "2021-12-21T06:41:37Z")
Hi I was checking on impact of CVE-2021-44228 on ELK stack and came across the link When i tried the solution mentioned for logstash to remove the JNDI Class zip -q -d \/logstash-core/lib/jars/log4j-c… --- ## [Elasticsearch MUST query with nestedQuery() ScoreMode.NONE vs FILTER with nested Query SCOREMODE.NONE performance](https://discuss.elastic.co/t/elasticsearch-must-query-with-nestedquery-scoremode-none-vs-filter-with-nested-query-scoremode-none-performance/292524)
**Author:** [@Akshayyha\_Krishnamur](https://discuss.elastic.co/u/Akshayyha_Krishnamur)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 5:56am UTC](https://discuss.elastic.co/t/elasticsearch-must-query-with-nestedquery-scoremode-none-vs-filter-with-nested-query-scoremode-none-performance/292524 "2021-12-21T05:56:56Z")
I am developing an Elasticsearch logic for searching certain fields and we are not concerned about relevance scoring. I already implemented the logic with MUST queries having nestedQuery ScoreMode.NONE. However, I came a… --- ## [Elasticsearch Re-indexing Issue](https://discuss.elastic.co/t/elasticsearch-re-indexing-issue/289529)
**Author:** [@Akshayyha\_Krishnamur](https://discuss.elastic.co/u/Akshayyha_Krishnamur)\ **Replies:** 7\ **Last updated:** [December 21, 2021, 5:42am UTC](https://discuss.elastic.co/t/elasticsearch-re-indexing-issue/289529 "2021-12-21T05:42:27Z")
We use a single node environment since we have adopted Elasticsearch recently. We are facing Elasticsearch indexing issues when 4 subsequent indexing requests were made at approximately 50 - 100ms interval each. Elastics… --- ## [How to calculate elapsed time between two events in different documents](https://discuss.elastic.co/t/how-to-calculate-elapsed-time-between-two-events-in-different-documents/292522)
**Author:** [@syunusic](https://discuss.elastic.co/u/syunusic)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 5:42am UTC](https://discuss.elastic.co/t/how-to-calculate-elapsed-time-between-two-events-in-different-documents/292522 "2021-12-21T05:42:08Z")
Hi all, If I have a log with: @timestamp EVENTNO (Event number) and DEVICEID (Device ID) and this happen: always when a specific event occurs, it does have a start (EVENTNO="300095") and an end (EVENTNO="300096"). I … --- ## [Caught exception while handling client http traffic, closing connection Netty4HttpChannel{localAddress=/](https://discuss.elastic.co/t/caught-exception-while-handling-client-http-traffic-closing-connection-netty4httpchannel-localaddress/292521)
**Author:** [@haipeng.zhao](https://discuss.elastic.co/u/haipeng.zhao)\ **Replies:** 1\ **Last updated:** [December 21, 2021, 5:35am UTC](https://discuss.elastic.co/t/caught-exception-while-handling-client-http-traffic-closing-connection-netty4httpchannel-localaddress/292521 "2021-12-21T05:35:53Z")
{"type": "server", "timestamp": "2021-12-17T19:45:21,865Z", "level": "WARN", "component": "o.e.h.AbstractHttpServerTransport", "cluster.name": "dev", "node.name": "dev-es-data-node-hot-0", "message": "caught exception wh… --- ## [FATAL Error: Unable to complete saved object migrations for the \[.kibana\] index: Unable to complete the OUTDATED\_DOCUMENTS\_SEARCH\_OPEN\_PIT step after 15 attempts, terminating](https://discuss.elastic.co/t/fatal-error-unable-to-complete-saved-object-migrations-for-the-kibana-index-unable-to-complete-the-outdated-documents-search-open-pit-step-after-15-attempts-terminating/292210)
**Author:** [@user23](https://discuss.elastic.co/u/user23)\ **Replies:** 4\ **Last updated:** [December 21, 2021, 5:17am UTC](https://discuss.elastic.co/t/fatal-error-unable-to-complete-saved-object-migrations-for-the-kibana-index-unable-to-complete-the-outdated-documents-search-open-pit-step-after-15-attempts-terminating/292210 "2021-12-21T05:17:39Z")
HI!HOW CAN I SOLVE THIS PROBLEM? WHEN I OPEN KIBANA 7.15 VERSION FATAL Error: Unable to complete saved object migrations for the \[.kibana\] index: Unable to complete the OUTDATED\_DOCUMENTS\_SEARCH\_OPEN\_PIT step after 15 … --- ## [Watcher for Heartbeat : challenging questions](https://discuss.elastic.co/t/watcher-for-heartbeat-challenging-questions/292454)
**Author:** [@appleyin1](https://discuss.elastic.co/u/appleyin1)\ **Replies:** 0\ **Last updated:** [December 20, 2021, 11:34am UTC](https://discuss.elastic.co/t/watcher-for-heartbeat-challenging-questions/292454 "2021-12-20T11:34:10Z")
Hi there: Need your advice in the following, “A cluster has configured with the heartbeat check for 10 URL. If 1 out of 10 heartbeat of the URL is down I would like the Watcher to be able send an email with monitor ID … --- ## [Elastic Cluster State Restore never really works for .kibana-x.x.x index (workarounds need to be applied)](https://discuss.elastic.co/t/elastic-cluster-state-restore-never-really-works-for-kibana-x-x-x-index-workarounds-need-to-be-applied/292491)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 0\ **Last updated:** [December 20, 2021, 4:37pm UTC](https://discuss.elastic.co/t/elastic-cluster-state-restore-never-really-works-for-kibana-x-x-x-index-workarounds-need-to-be-applied/292491 "2021-12-20T16:37:04Z")
Hi, when I try to restore cluster state of a cluster with different version (for example right now I want to restore 7.13.2 to 7.16.2) from a snapshot the .kibana instance always crashes with the error: "type":"log","@… --- ## [Search Template : Watcher](https://discuss.elastic.co/t/search-template-watcher/292515)
**Author:** [@appleyin1](https://discuss.elastic.co/u/appleyin1)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 3:36am UTC](https://discuss.elastic.co/t/search-template-watcher/292515 "2021-12-21T03:36:15Z")
Is that possible to create watcher with conditions and send an email if the conditions meet in a search template? Thanks --- ## [Wireshark json file cannot display in separate fields in Elasticsearch](https://discuss.elastic.co/t/wireshark-json-file-cannot-display-in-separate-fields-in-elasticsearch/291381)
**Author:** [@lauyatkin](https://discuss.elastic.co/u/lauyatkin)\ **Replies:** 30\ **Last updated:** [December 21, 2021, 2:38am UTC](https://discuss.elastic.co/t/wireshark-json-file-cannot-display-in-separate-fields-in-elasticsearch/291381 "2021-12-21T02:38:42Z")
I have investigated for a month and still cannot find a solution to structure the json data captured by Wireshark. I am using FileBeat in Elastic to import json data. However, all the json data are packed to the "message… --- ## [What is "score" in elasticsearch](https://discuss.elastic.co/t/what-is-score-in-elasticsearch/292498)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [December 21, 2021, 1:32am UTC](https://discuss.elastic.co/t/what-is-score-in-elasticsearch/292498 "2021-12-21T01:32:55Z")
I want to understand the concept of score in Elasticsearch with an example and how it is work search engine. --- ## [Restoring deleted indexes from a data stream](https://discuss.elastic.co/t/restoring-deleted-indexes-from-a-data-stream/292512)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 0\ **Last updated:** [December 20, 2021, 11:29pm UTC](https://discuss.elastic.co/t/restoring-deleted-indexes-from-a-data-stream/292512 "2021-12-20T23:29:52Z")
I bungled setting up the retention policy for a data stream with the result that a bunch of indexes have been deleted when they should not have been. I have snapshots of most of the indexes scattered across several snap… --- ## [Default language for language detection](https://discuss.elastic.co/t/default-language-for-language-detection/292470)
**Author:** [@uu99ix](https://discuss.elastic.co/u/uu99ix)\ **Replies:** 2\ **Last updated:** [December 21, 2021, 1:01am UTC](https://discuss.elastic.co/t/default-language-for-language-detection/292470 "2021-12-21T01:01:37Z")
I don't know if this is the right category to post under, sorry if it's not. I followed this guide: Language identification | Machine Learning in the Elastic Stack \[7.16\] | Elastic and it seems to return Japanese ("ja")… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1117) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1119)