# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1121 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1122 --- ## [Elastic search docker image upgrade not working from elasticsearch:7.1.1 to elasticsearch:7.16.1](https://discuss.elastic.co/t/elastic-search-docker-image-upgrade-not-working-from-elasticsearch-7-1-1-to-elasticsearch-7-16-1/292380)
**Author:** [@Vivek\_Karthik](https://discuss.elastic.co/u/Vivek_Karthik)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 12:46am UTC](https://discuss.elastic.co/t/elastic-search-docker-image-upgrade-not-working-from-elasticsearch-7-1-1-to-elasticsearch-7-16-1/292380 "2021-12-20T00:46:55Z")
docker logs elk \[0.001s\]\[warning\]\[os,container\] Duplicate cpuset controllers detected. Picking /sys/fs/cgroup/cpuset, skipping /usr/share/Elasticsearch/data/docker/overlay2/d2423a7f9ac4e46ec2d069481b10def8db07a9b348a078… --- ## [Elasticsearch-oss:6.6.2 Java Security Manager enabled by default?](https://discuss.elastic.co/t/elasticsearch-oss-6-6-2-java-security-manager-enabled-by-default/292364)
**Author:** [@tjemmettal](https://discuss.elastic.co/u/tjemmettal)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 12:40am UTC](https://discuss.elastic.co/t/elasticsearch-oss-6-6-2-java-security-manager-enabled-by-default/292364 "2021-12-20T00:40:22Z")
Hello, I'm trying to verify that Java Security Manager is enabled by default in oss images, particularly in: docker.elastic.co/elasticsearch/elasticsearch-oss:6.6.2 and docker.elastic.co/elasticsearch/elasticsearch-oss… --- ## [DockerHub showing Log4Shell vulnerability on supported version](https://discuss.elastic.co/t/dockerhub-showing-log4shell-vulnerability-on-supported-version/292202)
**Author:** [@cruizba](https://discuss.elastic.co/u/cruizba)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 12:25am UTC](https://discuss.elastic.co/t/dockerhub-showing-log4shell-vulnerability-on-supported-version/292202 "2021-12-20T00:25:21Z")
Despite official announcement saying that supported versions of Elasticsearch (6.8.9+, 7.8+) can not be exploited because of Elasticsearch’s usage of the Java Security Manager, dockerhub is showing images as "Log4Shell"… --- ## [JMSAppender used on Logstash 2.3.4 and Elasticsearch 2.3.4](https://discuss.elastic.co/t/jmsappender-used-on-logstash-2-3-4-and-elasticsearch-2-3-4/292127)
**Author:** [@angshuman.ray](https://discuss.elastic.co/u/angshuman.ray)\ **Replies:** 1\ **Last updated:** [December 19, 2021, 11:12pm UTC](https://discuss.elastic.co/t/jmsappender-used-on-logstash-2-3-4-and-elasticsearch-2-3-4/292127 "2021-12-19T23:12:02Z")
Can anyone confirm whether JMSAppender is used in Logstash 2.3.4 and Elasticsearch 2.3.4 ? --- ## [Log4j vulnerability threat impact on Elasticsearch and Logstash versions below 5](https://discuss.elastic.co/t/log4j-vulnerability-threat-impact-on-elasticsearch-and-logstash-versions-below-5/292140)
**Author:** [@angshuman.ray](https://discuss.elastic.co/u/angshuman.ray)\ **Replies:** 1\ **Last updated:** [December 19, 2021, 11:12pm UTC](https://discuss.elastic.co/t/log4j-vulnerability-threat-impact-on-elasticsearch-and-logstash-versions-below-5/292140 "2021-12-19T23:12:53Z")
Can anyone please confirm whether Elasticsearch and Logstash versions below 5 are also impacted with Log4j vulnerability threat ? --- ## [Does Log4j vulnerability (CVE-2021-44228) is impacted for ES v7.5.2?](https://discuss.elastic.co/t/does-log4j-vulnerability-cve-2021-44228-is-impacted-for-es-v7-5-2/292128)
**Author:** [@Anuroop1](https://discuss.elastic.co/u/Anuroop1)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 12:17am UTC](https://discuss.elastic.co/t/does-log4j-vulnerability-cve-2021-44228-is-impacted-for-es-v7-5-2/292128 "2021-12-20T00:17:51Z")
We are using Elasticsearch v7.5.2 along with OpenJDK 11.0.11 in on-premise servers and I just need to know from Elasticsearch Team support if this version is impacted by Log4j vulnerability (CVE-2021-44228) or not. The … --- ## [Log4j in Elasticsearch prerequisites in Azure DevOps environment](https://discuss.elastic.co/t/log4j-in-elasticsearch-prerequisites-in-azure-devops-environment/292158)
**Author:** [@RJ96](https://discuss.elastic.co/u/RJ96)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 12:17am UTC](https://discuss.elastic.co/t/log4j-in-elasticsearch-prerequisites-in-azure-devops-environment/292158 "2021-12-20T00:17:25Z")
Hello, i am very new to the Elastic world, in fact i've started working with Elastic after the log4j security alert had happened so i am a beginner. i have a azure devops environment where i have Elasticsearch installed… --- ## [Log4Shell comprehensive fix for Elastic Search](https://discuss.elastic.co/t/log4shell-comprehensive-fix-for-elastic-search/292106)
**Author:** [@rencytl](https://discuss.elastic.co/u/rencytl)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 12:06am UTC](https://discuss.elastic.co/t/log4shell-comprehensive-fix-for-elastic-search/292106 "2021-12-20T00:06:38Z")
Appreciate the efforts having Log4Shell mitigated in versions 7.16.1 and 6.8.21. Is the team working towards providing a comprehensive fix for this upgrading the Log4j library to 2.16.0 version? If yes, knowing the ETA w… --- ## [Kibana is not ready yet](https://discuss.elastic.co/t/kibana-is-not-ready-yet/292404)
**Author:** [@nNeroche](https://discuss.elastic.co/u/nNeroche)\ **Replies:** 1\ **Last updated:** [December 19, 2021, 11:52pm UTC](https://discuss.elastic.co/t/kibana-is-not-ready-yet/292404 "2021-12-19T23:52:07Z")
Hi everyone, I just installed wazuh-manager on a vm, Ubuntu LTS 20.04. The problem is when I try to connect to the web page, I am getting "Kibana is not ready yet" text. I checked IP addresses on both Elasticsearch.yml… --- ## [How to add "index.mapping.total\_fields.limit" in command prompt](https://discuss.elastic.co/t/how-to-add-index-mapping-total-fields-limit-in-command-prompt/292415)
**Author:** [@Suparna\_Shankar](https://discuss.elastic.co/u/Suparna_Shankar)\ **Replies:** 1\ **Last updated:** [December 19, 2021, 8:51pm UTC](https://discuss.elastic.co/t/how-to-add-index-mapping-total-fields-limit-in-command-prompt/292415 "2021-12-19T20:51:29Z")
HI, am trying to add "index.mapping.total\_fields.limit" to 2000 using cmdline but getting below exception "curl -XPUT http://127.0.0.1:9200/log4j-2021.12.19/\_settings -H 'Content-Type: application/json' -d '{ "index.map… --- ## [Grok to multiline ingestion does not handle rows](https://discuss.elastic.co/t/grok-to-multiline-ingestion-does-not-handle-rows/292412)
**Author:** [@tjswe](https://discuss.elastic.co/u/tjswe)\ **Replies:** 2\ **Last updated:** [December 19, 2021, 8:17pm UTC](https://discuss.elastic.co/t/grok-to-multiline-ingestion-does-not-handle-rows/292412 "2021-12-19T20:17:56Z")
Hi! Im ingesting .txt-files containing navtex-messages (see example below). Each message comes in a separate .txt-file appearing continuously over 24h landning in a sub-directory with the current date. input { file… --- ## [Monitor if a process is running or stopped](https://discuss.elastic.co/t/monitor-if-a-process-is-running-or-stopped/292411)
**Author:** [@Kevin\_Brunette](https://discuss.elastic.co/u/Kevin_Brunette)\ **Replies:** 1\ **Last updated:** [December 19, 2021, 6:40pm UTC](https://discuss.elastic.co/t/monitor-if-a-process-is-running-or-stopped/292411 "2021-12-19T18:40:41Z")
Hi! I'm trying to do a seemingly simple task of monitoring whether a process is running or stopped on an Ubuntu host. For example I want to know if a Java and Python based app are running or down. I'm aware there are so… --- ## [Is elasticsearch verison 7.16.2 released?](https://discuss.elastic.co/t/is-elasticsearch-verison-7-16-2-released/292390)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 1\ **Last updated:** [December 19, 2021, 2:14pm UTC](https://discuss.elastic.co/t/is-elasticsearch-verison-7-16-2-released/292390 "2021-12-19T14:14:41Z")
is version 7.16.2 released? release notes have information about version 7.16.2 but unable to find the version for download --- ## [Logstash filter CSV inside email content](https://discuss.elastic.co/t/logstash-filter-csv-inside-email-content/292244)
**Author:** [@pcpdoc02](https://discuss.elastic.co/u/pcpdoc02)\ **Replies:** 2\ **Last updated:** [December 19, 2021, 8:08am UTC](https://discuss.elastic.co/t/logstash-filter-csv-inside-email-content/292244 "2021-12-19T08:08:13Z")
I would like to use Logstash to stream CSV data in email to Elasticsearch. IMAP and CSV filter seems suitable to extract email content and parse the CSV contents respectively. How can I use both filter together to output… --- ## [How to make Dev tools request automatic using the Pipeline?](https://discuss.elastic.co/t/how-to-make-dev-tools-request-automatic-using-the-pipeline/292377)
**Author:** [@Angad\_Panesar1](https://discuss.elastic.co/u/Angad_Panesar1)\ **Replies:** 1\ **Last updated:** [December 18, 2021, 6:14pm UTC](https://discuss.elastic.co/t/how-to-make-dev-tools-request-automatic-using-the-pipeline/292377 "2021-12-18T18:14:39Z")
Hi, I tried to create an ingest pipeline to run every time new data is ingested but unfortunately it still does not work. Here is what I have done: The create pipeline method: PUT \_ingest/pipeline/set\_place { "descri… --- ## [Escaping special characters to search for latest log4j exploit payload](https://discuss.elastic.co/t/escaping-special-characters-to-search-for-latest-log4j-exploit-payload/292369)
**Author:** [@RedInDisguise](https://discuss.elastic.co/u/RedInDisguise)\ **Replies:** 1\ **Last updated:** [December 18, 2021, 3:50pm UTC](https://discuss.elastic.co/t/escaping-special-characters-to-search-for-latest-log4j-exploit-payload/292369 "2021-12-18T15:50:37Z")
Hi all, Would anyone have ideas how to search for the latest log4j DOS exploit, example payload: "${${::-${::-$${::-j}}}}"? We are having trouble escaping the characters in a KQL search however open to a EQL search acro… --- ## [No results when searching by a null value](https://discuss.elastic.co/t/no-results-when-searching-by-a-null-value/292385)
**Author:** [@AlexBulls20](https://discuss.elastic.co/u/AlexBulls20)\ **Replies:** 1\ **Last updated:** [December 18, 2021, 3:23pm UTC](https://discuss.elastic.co/t/no-results-when-searching-by-a-null-value/292385 "2021-12-18T15:23:15Z")
I'm trying to fill some value for an autocomplete search box and I had this old code (from Elasticsearch 1.5) and I want to implement it into Elasticsearch 7.16 When I use this sentence curl -H 'Content-Type: applicati… --- ## [\#! Deprecation: \[types removal\] Specifying types in a watcher index action is deprecated](https://discuss.elastic.co/t/deprecation-types-removal-specifying-types-in-a-watcher-index-action-is-deprecated/291815)
**Author:** [@DoDuyen162000](https://discuss.elastic.co/u/DoDuyen162000)\ **Replies:** 2\ **Last updated:** [December 18, 2021, 4:47am UTC](https://discuss.elastic.co/t/deprecation-types-removal-specifying-types-in-a-watcher-index-action-is-deprecated/291815 "2021-12-18T04:47:22Z")
I'm having trouble creating a watcher. I don't know what I was wrong about? Here's my fault: --- ## [Issector mapping, pattern not found error in Logstash](https://discuss.elastic.co/t/issector-mapping-pattern-not-found-error-in-logstash/292226)
**Author:** [@arunpmohan](https://discuss.elastic.co/u/arunpmohan)\ **Replies:** 2\ **Last updated:** [December 18, 2021, 1:45am UTC](https://discuss.elastic.co/t/issector-mapping-pattern-not-found-error-in-logstash/292226 "2021-12-18T01:45:07Z")
I have an log message which I split using grok and then use an if conditional to parse a field using dissect filter. But it is giving me Dissector mapping, pattern not found error. I tried the dissect pattern with http… --- ## [Heartbeat Browser Monitor Zip URL: not a valid zip file](https://discuss.elastic.co/t/heartbeat-browser-monitor-zip-url-not-a-valid-zip-file/292222)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 9\ **Last updated:** [December 18, 2021, 12:23am UTC](https://discuss.elastic.co/t/heartbeat-browser-monitor-zip-url-not-a-valid-zip-file/292222 "2021-12-18T00:23:42Z")
Hi, I'm trying to use the Heartbeat Browser monitor with the Zip URL source, but am running into a weird issue. Has anyone gotten Zip URL to work with GitLab zip urls? I get the following error when Heartbeat tries to… --- ## [Is index\_prefixes intended to be used with text fields only?](https://discuss.elastic.co/t/is-index-prefixes-intended-to-be-used-with-text-fields-only/292366)
**Author:** [@mp3000](https://discuss.elastic.co/u/mp3000)\ **Replies:** 0\ **Last updated:** [December 17, 2021, 11:07pm UTC](https://discuss.elastic.co/t/is-index-prefixes-intended-to-be-used-with-text-fields-only/292366 "2021-12-17T23:07:31Z")
Hello, It seems index\_prefixes mapping parameter is only available for text fields but it is not really obvious in the doc. Why this parameter is not available for keyword fields ? Is it because the performance on sma… --- ## [Tracking Containment Alerts](https://discuss.elastic.co/t/tracking-containment-alerts/291872)
**Author:** [@lmoore2210](https://discuss.elastic.co/u/lmoore2210)\ **Replies:** 4\ **Last updated:** [December 17, 2021, 8:03pm UTC](https://discuss.elastic.co/t/tracking-containment-alerts/291872 "2021-12-17T20:03:26Z")
Hey Elastic Crew, Right now I'm using a NiFi flow to push static GEOJSON data using now() timestamps to an Elasticsearch. The following file is an example: I've set up an alert that "should" trigger when my GEOJSON … --- ## [How to make Dev tools request automatic?](https://discuss.elastic.co/t/how-to-make-dev-tools-request-automatic/292308)
**Author:** [@Angad\_Panesar1](https://discuss.elastic.co/u/Angad_Panesar1)\ **Replies:** 3\ **Last updated:** [December 17, 2021, 7:46pm UTC](https://discuss.elastic.co/t/how-to-make-dev-tools-request-automatic/292308 "2021-12-17T19:46:38Z")
How would I make a request automatically update the data over time instead of just manually going into dev tools and running the request every time. e.g. after 1 hour. See the request below. POST compair\_\*/\_update\_by\_q… --- ## [Can elasticsearch incorrectly show search threadpool rejected count](https://discuss.elastic.co/t/can-elasticsearch-incorrectly-show-search-threadpool-rejected-count/291343)
**Author:** [@taugusti](https://discuss.elastic.co/u/taugusti)\ **Replies:** 1\ **Last updated:** [December 17, 2021, 7:04pm UTC](https://discuss.elastic.co/t/can-elasticsearch-incorrectly-show-search-threadpool-rejected-count/291343 "2021-12-17T19:04:39Z")
I have been load testing my elastic cluster by sending a large number of search requests. I see a lot of "rejected" when I do GET /\_cat/thread\_pool/search in kibana. However, I see that all the queries got successful re… --- ## [Tried "mutate" convert", logstash getting error from elasticsearch: "type \[float\] to \[long\]"](https://discuss.elastic.co/t/tried-mutate-convert-logstash-getting-error-from-elasticsearch-type-float-to-long/292356)
**Author:** [@4art4](https://discuss.elastic.co/u/4art4)\ **Replies:** 2\ **Last updated:** [December 17, 2021, 6:25pm UTC](https://discuss.elastic.co/t/tried-mutate-convert-logstash-getting-error-from-elasticsearch-type-float-to-long/292356 "2021-12-17T18:25:32Z")
My expectation is that adding the 'convert' would insure that all data for that field will be of type "float", but I guess I did it wrong? relevant part of data: "metrics"=\>\[ { "Unit"=\>"Count", "MetricName"=\>"Res… --- ## [Time elapsed between two events with EQL (and then use that in a visualization)](https://discuss.elastic.co/t/time-elapsed-between-two-events-with-eql-and-then-use-that-in-a-visualization/292355)
**Author:** [@syunusic](https://discuss.elastic.co/u/syunusic)\ **Replies:** 0\ **Last updated:** [December 17, 2021, 6:09pm UTC](https://discuss.elastic.co/t/time-elapsed-between-two-events-with-eql-and-then-use-that-in-a-visualization/292355 "2021-12-17T18:09:32Z")
I have this log that has three relevant fields: @timestamp EVENTNO (Event number) DEVICEID (Device ID) I want to know how much time happens between the start and the end of something specific (start of that something… --- ## [Not able to read indices](https://discuss.elastic.co/t/not-able-to-read-indices/292302)
**Author:** [@AnkitaPujare](https://discuss.elastic.co/u/AnkitaPujare)\ **Replies:** 1\ **Last updated:** [December 17, 2021, 5:58pm UTC](https://discuss.elastic.co/t/not-able-to-read-indices/292302 "2021-12-17T17:58:36Z")
Dear Team, I have ELK stack installed (ELK version-7.8.0) on one Linux server(say host1). Due to high severity vulnerability of apache log4j2, I have tried to install updated ELK stack (ELK version-7.16.1) on new server… --- ## [Why does elasticsearch return inconsistent result on version 7.8.1 and return correct result on 5.6.7 for the same match\_phrase\_prefix query? How can i get consistent result on elasticsearch 7.8.1?](https://discuss.elastic.co/t/why-does-elasticsearch-return-inconsistent-result-on-version-7-8-1-and-return-correct-result-on-5-6-7-for-the-same-match-phrase-prefix-query-how-can-i-get-consistent-result-on-elasticsearch-7-8-1/290722)
**Author:** [@animesh\_dhokare](https://discuss.elastic.co/u/animesh_dhokare)\ **Replies:** 7\ **Last updated:** [December 17, 2021, 1:02pm UTC](https://discuss.elastic.co/t/why-does-elasticsearch-return-inconsistent-result-on-version-7-8-1-and-return-correct-result-on-5-6-7-for-the-same-match-phrase-prefix-query-how-can-i-get-consistent-result-on-elasticsearch-7-8-1/290722 "2021-12-17T13:02:11Z")
Hi there, I have observed inconsistency in the result for the below match\_phrase\_prefix query on elasticsearch 7.8.1. QUERY: { "sort": \[{ "created": { "order": "desc" } … --- ## [Logstash fails to parse valid json, I need a "split" but I get "Only String and Array types are splittable."](https://discuss.elastic.co/t/logstash-fails-to-parse-valid-json-i-need-a-split-but-i-get-only-string-and-array-types-are-splittable/292228)
**Author:** [@4art4](https://discuss.elastic.co/u/4art4)\ **Replies:** 4\ **Last updated:** [December 17, 2021, 5:19pm UTC](https://discuss.elastic.co/t/logstash-fails-to-parse-valid-json-i-need-a-split-but-i-get-only-string-and-array-types-are-splittable/292228 "2021-12-17T17:19:37Z")
The logfile I need to ingest: { "policy": { "name": "account-cloudtrail-enabled", "resource": "account", "description": "Checks to make sure CloudTrail is enabled on the account\\nfor all regions.\\n", "… --- ## [Logstash using multiline for big log file](https://discuss.elastic.co/t/logstash-using-multiline-for-big-log-file/292150)
**Author:** [@pan1](https://discuss.elastic.co/u/pan1)\ **Replies:** 3\ **Last updated:** [December 17, 2021, 5:18pm UTC](https://discuss.elastic.co/t/logstash-using-multiline-for-big-log-file/292150 "2021-12-17T17:18:50Z")
Hello everyone, I have to handle big log-files (arround 50k lines) using ELK and want to extract some information out of it. A long story short, I want to use filter for searching for specific informations, store thos… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1120) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1122)