# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1120 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1121 --- ## [Elastic Inconsistent log rotation(log4j2)](https://discuss.elastic.co/t/elastic-inconsistent-log-rotation-log4j2/292459)
**Author:** [@anandd4](https://discuss.elastic.co/u/anandd4)\ **Replies:** 0\ **Last updated:** [December 20, 2021, 11:55am UTC](https://discuss.elastic.co/t/elastic-inconsistent-log-rotation-log4j2/292459 "2021-12-20T11:55:36Z")
Problem Statement - Elastic log rotation(rolling.old & rolling) is inconsistent and displays random behavior across different nodes. We have noticed 3 main issues - log rotation doesn't happen daily as configured via … --- ## [Sudden unexplained increase in system load and read operations resulting in very slow indexing](https://discuss.elastic.co/t/sudden-unexplained-increase-in-system-load-and-read-operations-resulting-in-very-slow-indexing/292456)
**Author:** [@dd76](https://discuss.elastic.co/u/dd76)\ **Replies:** 0\ **Last updated:** [December 20, 2021, 11:40am UTC](https://discuss.elastic.co/t/sudden-unexplained-increase-in-system-load-and-read-operations-resulting-in-very-slow-indexing/292456 "2021-12-20T11:40:23Z")
We are running Elasticsearch 7.12.0 and have recently seen system load and read operations suddenly increase significantly on one data node despite there being no change to the number of query/index operations being exec… --- ## [Kibana timestamp shows incorrect time](https://discuss.elastic.co/t/kibana-timestamp-shows-incorrect-time/292193)
**Author:** [@peterreji94](https://discuss.elastic.co/u/peterreji94)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 10:58am UTC](https://discuss.elastic.co/t/kibana-timestamp-shows-incorrect-time/292193 "2021-12-20T10:58:19Z")
The kibana is not showing the actual time of log. It's delayed by a few milliseconds (at least 500ms) when compared to the actual timestamp of the log on the server. One of the discussions mentioned the use of @logtimest… --- ## [Query index patterns using ES nodejs client lib](https://discuss.elastic.co/t/query-index-patterns-using-es-nodejs-client-lib/292282)
**Author:** [@hamzahda](https://discuss.elastic.co/u/hamzahda)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 10:54am UTC](https://discuss.elastic.co/t/query-index-patterns-using-es-nodejs-client-lib/292282 "2021-12-20T10:54:13Z")
Hi, I wanted to know know if it's also possible to do this query GET \:\/api/index\_patterns/index\_pattern/\ in a script using the es client lib and thanks --- ## [Logstash CSV Timestamp extract](https://discuss.elastic.co/t/logstash-csv-timestamp-extract/292188)
**Author:** [@Robsen\_Inc](https://discuss.elastic.co/u/Robsen_Inc)\ **Replies:** 5\ **Last updated:** [December 20, 2021, 9:38am UTC](https://discuss.elastic.co/t/logstash-csv-timestamp-extract/292188 "2021-12-20T09:38:42Z")
Hello everyone, I have a problem with my log data. After hours of try-and-error I am now looking for help from you. An exemplary line looks like this: 09/04/2021 11:30:53 0 0 0 0 0 0 0 0 false false false false false … --- ## [Need help to evaluate Logstash for syncing Oracle data into Elasticsearch (combining multiple 25+ table records into single nested document)](https://discuss.elastic.co/t/need-help-to-evaluate-logstash-for-syncing-oracle-data-into-elasticsearch-combining-multiple-25-table-records-into-single-nested-document/292430)
**Author:** [@Tejas\_Damle](https://discuss.elastic.co/u/Tejas_Damle)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 9:38am UTC](https://discuss.elastic.co/t/need-help-to-evaluate-logstash-for-syncing-oracle-data-into-elasticsearch-combining-multiple-25-table-records-into-single-nested-document/292430 "2021-12-20T09:38:25Z")
Requirement: We are planning to use Logstash to sync data from Oracle to Elasticsearch. There are around 25+ tables in Oracle. Plan is to to have single index in Elasticsearch with nested/flattened documents which will… --- ## [CSV Reporting Truncating Results in 7.15.x](https://discuss.elastic.co/t/csv-reporting-truncating-results-in-7-15-x/288142)
**Author:** [@skoldrh](https://discuss.elastic.co/u/skoldrh)\ **Replies:** 5\ **Last updated:** [December 20, 2021, 8:13am UTC](https://discuss.elastic.co/t/csv-reporting-truncating-results-in-7-15-x/288142 "2021-12-20T08:13:27Z")
Using Elastic Kibana 7.13.3 (and previous versions) I was able to Save and Share/CSV reports with a maximum size of around 500 MBs (We have a Security requirement to archive off logs from Windows (WinLogBeat), Linux (Fil… --- ## [No monitoring data found version 7.16.1](https://discuss.elastic.co/t/no-monitoring-data-found-version-7-16-1/292113)
**Author:** [@marek.vesely](https://discuss.elastic.co/u/marek.vesely)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 7:58am UTC](https://discuss.elastic.co/t/no-monitoring-data-found-version-7-16-1/292113 "2021-12-20T07:58:08Z")
Hello, today i updated to latest version of ELK stack because of log4j... I updated from version 7.15.0 which works perfect, but no i don't see monitoring data. In metricbeat logs i see this error: (status=400): {"type… --- ## [Elastic Search, logstash and filebeat OSS 7.10.2 - Log4j Patch](https://discuss.elastic.co/t/elastic-search-logstash-and-filebeat-oss-7-10-2-log4j-patch/292425)
**Author:** [@marisubu](https://discuss.elastic.co/u/marisubu)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 7:48am UTC](https://discuss.elastic.co/t/elastic-search-logstash-and-filebeat-oss-7-10-2-log4j-patch/292425 "2021-12-20T07:48:56Z")
Hi We are currently using the OSS 7.10.2 version elastic stack in our product. Will there be any Patch(log4j upgrade to latest version) for this version for elastic stack? Thanks --- ## [Elastic Agent Minimum System Requirements](https://discuss.elastic.co/t/elastic-agent-minimum-system-requirements/292340)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 7:39am UTC](https://discuss.elastic.co/t/elastic-agent-minimum-system-requirements/292340 "2021-12-20T07:39:58Z")
Does anyone know what the minimum system requirements (CPU/RAM/Disk) are for Elastic Agent to properly function? I'm running into some issues with some of the smaller systems I manage, and suspect the issues are caused … --- ## [Help me! Search kanji and hikarana (kuromoji and Fuzziness)](https://discuss.elastic.co/t/help-me-search-kanji-and-hikarana-kuromoji-and-fuzziness/292272)
**Author:** [@mai\_quoc\_son](https://discuss.elastic.co/u/mai_quoc_son)\ **Replies:** 2\ **Last updated:** [December 20, 2021, 6:05am UTC](https://discuss.elastic.co/t/help-me-search-kanji-and-hikarana-kuromoji-and-fuzziness/292272 "2021-12-20T06:05:50Z")
I setting Index : mapping : Data : Create Index: Query search : Result : Please help me , i want result 3 row by query. Thanks I read info and demo in --- ## [Mirgation guide from 6.2.3 to 6.8.21?](https://discuss.elastic.co/t/mirgation-guide-from-6-2-3-to-6-8-21/291990)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 2\ **Last updated:** [December 20, 2021, 6:02am UTC](https://discuss.elastic.co/t/mirgation-guide-from-6-2-3-to-6-8-21/291990 "2021-12-20T06:02:37Z")
Hi, we have one instance of elk stack of version 6.2.3. All components are running as docker images. To get rid of log4j CVEs we need to upgrade to latest 6.x version. Can I upgrade to latest 6.x. directly or do I nee… --- ## [How can we delete an index based on a scheduler using JAVA API's?](https://discuss.elastic.co/t/how-can-we-delete-an-index-based-on-a-scheduler-using-java-apis/292396)
**Author:** [@yash\_196](https://discuss.elastic.co/u/yash_196)\ **Replies:** 4\ **Last updated:** [December 20, 2021, 5:54am UTC](https://discuss.elastic.co/t/how-can-we-delete-an-index-based-on-a-scheduler-using-java-apis/292396 "2021-12-20T05:54:17Z")
Can anyone help me with a java code that can delete index based on a schedule? --- ## [CVE-2021-45046 : Incomplete fix for Apache Log4j vulnerability](https://discuss.elastic.co/t/cve-2021-45046-incomplete-fix-for-apache-log4j-vulnerability/291925)
**Author:** [@Ravi\_GH](https://discuss.elastic.co/u/Ravi_GH)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 9:13pm UTC](https://discuss.elastic.co/t/cve-2021-45046-incomplete-fix-for-apache-log4j-vulnerability/291925 "2021-12-15T21:13:46Z")
With respect to "Incomplete fix for Apache Log4j vulnerability" @ Incomplete fix for Apache Log4j vulnerability · CVE-2021-45046 · GitHub Advisory Database · GitHub I have two questions: Q1) is JndiLookup class remova… --- ## [Logstash update log4j version](https://discuss.elastic.co/t/logstash-update-log4j-version/291946)
**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 9:43pm UTC](https://discuss.elastic.co/t/logstash-update-log4j-version/291946 "2021-12-15T21:43:02Z")
I have to change log4j 2.11 to 2.16 so I have replaced all jars. now its saying Problems loading a plugin with {:type=\>"input", :name=\>"beats", :path=\>"logstash/inputs/beats", :error\_message=\>"\\n\\n\\tyou might need to r… --- ## [Filebeat service not starting with nginx, elasticsearch and kibana on aws ec2 instance](https://discuss.elastic.co/t/filebeat-service-not-starting-with-nginx-elasticsearch-and-kibana-on-aws-ec2-instance/292384)
**Author:** [@deepak.tripathi.259](https://discuss.elastic.co/u/deepak.tripathi.259)\ **Replies:** 2\ **Last updated:** [December 20, 2021, 5:10am UTC](https://discuss.elastic.co/t/filebeat-service-not-starting-with-nginx-elasticsearch-and-kibana-on-aws-ec2-instance/292384 "2021-12-20T05:10:20Z")
I want to display nginx logs on kibana. Elasticsearch and kibana are running fine. Nginx logs are stored in /var/log/nginx/\*.log I installed filebeat and enbled the nginx service with it. filebeat.yml #############… --- ## [CVE-2021-45105 for ELK 7.10.2](https://discuss.elastic.co/t/cve-2021-45105-for-elk-7-10-2/292420)
**Author:** [@Ram\_N](https://discuss.elastic.co/u/Ram_N)\ **Replies:** 3\ **Last updated:** [December 20, 2021, 3:51am UTC](https://discuss.elastic.co/t/cve-2021-45105-for-elk-7-10-2/292420 "2021-12-20T03:51:35Z")
Hi Pertaining to 44228, we have deleted the vulnerable class as per ELK suggestion. For this new 45105, do we need to take any action ? I read default Elasticsearch, logstash, Kibana 7.10.2 are not vulnerable. Is that f… --- ## [When will the next patch be released for Elasticsearch](https://discuss.elastic.co/t/when-will-the-next-patch-be-released-for-elasticsearch/292066)
**Author:** [@Aydan](https://discuss.elastic.co/u/Aydan)\ **Replies:** 7\ **Last updated:** [December 20, 2021, 3:41am UTC](https://discuss.elastic.co/t/when-will-the-next-patch-be-released-for-elasticsearch/292066 "2021-12-20T03:41:03Z")
When will be the next patch for Elasticsearch? --- ## [Shard Siem cause cluster red](https://discuss.elastic.co/t/shard-siem-cause-cluster-red/292107)
**Author:** [@labate](https://discuss.elastic.co/u/labate)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 1:17am UTC](https://discuss.elastic.co/t/shard-siem-cause-cluster-red/292107 "2021-12-20T01:17:36Z")
Hello everyone, I have a problem with my .siem-signals-default index. The shard goes to red status and I can't reallocate the shard to another node. Because the shard seems to not be in my cluster and I can't get it bac… --- ## [Elastic SearchResponse - How to get raw response result](https://discuss.elastic.co/t/elastic-searchresponse-how-to-get-raw-response-result/291999)
**Author:** [@thadc](https://discuss.elastic.co/u/thadc)\ **Replies:** 0\ **Last updated:** [December 15, 2021, 2:56pm UTC](https://discuss.elastic.co/t/elastic-searchresponse-how-to-get-raw-response-result/291999 "2021-12-15T14:56:19Z")
I have a need to get the raw response from the Elasticsearch SearchResponse object. We have situations where navigating the hits/aggregations-based structure is too rigid for our formatting the response back to user. Gra… --- ## [Oracle DB performance monitoring with ELK (MetricBeat)](https://discuss.elastic.co/t/oracle-db-performance-monitoring-with-elk-metricbeat/292000)
**Author:** [@tonypro](https://discuss.elastic.co/u/tonypro)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 1:14am UTC](https://discuss.elastic.co/t/oracle-db-performance-monitoring-with-elk-metricbeat/292000 "2021-12-20T01:14:48Z")
Greetings buddy! Please, I have been struggle on how to monitored an oracle DB instance, using the ELK stack. I read that you can use the metric beat's oracle module to ship data to the Elasticsearch engine. But I am st… --- ## [Elasti search reindexing indexes only few 1000 or more documents but not to the original count of orginal index](https://discuss.elastic.co/t/elasti-search-reindexing-indexes-only-few-1000-or-more-documents-but-not-to-the-original-count-of-orginal-index/292044)
**Author:** [@Darshan\_R](https://discuss.elastic.co/u/Darshan_R)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 1:12am UTC](https://discuss.elastic.co/t/elasti-search-reindexing-indexes-only-few-1000-or-more-documents-but-not-to-the-original-count-of-orginal-index/292044 "2021-12-20T01:12:40Z")
Elasti csearch reindexing indexes only few 1000 or more documents but not to the original count of orginal index I am using using AWS step functions with lambda to run reindexing for all 33 index paralley out of 33 onl… --- ## [Adds a new field inside in the existing index](https://discuss.elastic.co/t/adds-a-new-field-inside-in-the-existing-index/292030)
**Author:** [@rav3n](https://discuss.elastic.co/u/rav3n)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 1:12am UTC](https://discuss.elastic.co/t/adds-a-new-field-inside-in-the-existing-index/292030 "2021-12-20T01:12:16Z")
Hey there, I'm trying to add a new field to the already existing index but every time I get this error : { "error" : { "root\_cause" : \[ { "type" : "mapper\_exception", "reason" : "the \[includ… --- ## [Get role mapping created with configmaps](https://discuss.elastic.co/t/get-role-mapping-created-with-configmaps/292097)
**Author:** [@gerardgorrion](https://discuss.elastic.co/u/gerardgorrion)\ **Replies:** 0\ **Last updated:** [December 16, 2021, 7:39am UTC](https://discuss.elastic.co/t/get-role-mapping-created-with-configmaps/292097 "2021-12-16T07:39:25Z")
We are deploying Elasticsearch 7.15.2 on kubernetes. To configuring roles\_mappings, we configure configmaps with a "role-mapping.yml" file with the rights, and seem working fine. The problem is: we cant check if some rig… --- ## [Limit "Watcher" user roles rights by workspace?](https://discuss.elastic.co/t/limit-watcher-user-roles-rights-by-workspace/292100)
**Author:** [@gerardgorrion](https://discuss.elastic.co/u/gerardgorrion)\ **Replies:** 0\ **Last updated:** [December 16, 2021, 7:52am UTC](https://discuss.elastic.co/t/limit-watcher-user-roles-rights-by-workspace/292100 "2021-12-16T07:52:55Z")
Hi all, there're some way to configure "watcher" rights (manage\_watcher) by workspace? because an user that only have rights into some namespace should not edit alerts from others workspaces... Thanks! --- ## [Manage error when indexing documents](https://discuss.elastic.co/t/manage-error-when-indexing-documents/292168)
**Author:** [@GinkoLucas](https://discuss.elastic.co/u/GinkoLucas)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 1:04am UTC](https://discuss.elastic.co/t/manage-error-when-indexing-documents/292168 "2021-12-20T01:04:46Z")
Hello, I want to know when a document is dismiss by Elasticsearch in case the mapping is configured with "dynamic : strict". So, when i send a document who got an "unknow fields" in the mapping, Elasticsearch will dism… --- ## [Calculate sum of run\_time without runtime fields?](https://discuss.elastic.co/t/calculate-sum-of-run-time-without-runtime-fields/292267)
**Author:** [@afkbrb](https://discuss.elastic.co/u/afkbrb)\ **Replies:** 0\ **Last updated:** [December 17, 2021, 6:56am UTC](https://discuss.elastic.co/t/calculate-sum-of-run-time-without-runtime-fields/292267 "2021-12-17T06:56:28Z")
I want to get the sum of run\_time variant, by using runtime\_mapping I got mistakes. I know that it'a new feature in ES 7.12, but I can't upgrade it because it's not depend on me. So how could I get the answer without … --- ## [Where to check where the data from generated reports are saved](https://discuss.elastic.co/t/where-to-check-where-the-data-from-generated-reports-are-saved/292287)
**Author:** [@Zarzaparro](https://discuss.elastic.co/u/Zarzaparro)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 12:59am UTC](https://discuss.elastic.co/t/where-to-check-where-the-data-from-generated-reports-are-saved/292287 "2021-12-20T00:59:43Z")
Good Morning. I have a question. I can search and see how big are the index pattern logs that I'm receiving from ELK in Kabana and delete them if they are too big. But I have automated reports from a dashboard that giv… --- ## [Metricbeat Elasticsearch module unexpected memory usage on master](https://discuss.elastic.co/t/metricbeat-elasticsearch-module-unexpected-memory-usage-on-master/292361)
**Author:** [@Charles\_Ferguson](https://discuss.elastic.co/u/Charles_Ferguson)\ **Replies:** 0\ **Last updated:** [December 17, 2021, 9:57pm UTC](https://discuss.elastic.co/t/metricbeat-elasticsearch-module-unexpected-memory-usage-on-master/292361 "2021-12-17T21:57:02Z")
Hello, I am having an issue with trying to configure metricbeats Elasticsearch module. The specific issue I am seeing is that I have configured a daemonset of metricbeats to collect node and nodes\_stats metrics from all … --- ## [How to reset elasticsearch inbuilt users](https://discuss.elastic.co/t/how-to-reset-elasticsearch-inbuilt-users/292351)
**Author:** [@Dhamodharan](https://discuss.elastic.co/u/Dhamodharan)\ **Replies:** 0\ **Last updated:** [December 17, 2021, 5:36pm UTC](https://discuss.elastic.co/t/how-to-reset-elasticsearch-inbuilt-users/292351 "2021-12-17T17:36:15Z")
I have set the Elasticsearch inbuilt users using interactive method. Now i missed the password of kibana\_system user. Is there a way to reset that particular user alone? I tried with bin/elasticsearch-reset-password -u … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1119) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1121)