# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1124 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1125 --- ## [Getting less hits in elasticsearch](https://discuss.elastic.co/t/getting-less-hits-in-elasticsearch/292095)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [December 16, 2021, 10:39am UTC](https://discuss.elastic.co/t/getting-less-hits-in-elasticsearch/292095 "2021-12-16T10:39:10Z")
I have 1000 records but i am just getting 997 records. csv-input.conf input { file { path =\> "/usr/share/logstash/user\_details.csv" start\_position =\> "beginning" #sincedb\_path =\> "/usr/share/logstash/dbteste" } } f… --- ## [Add units to metric visualization in kibana](https://discuss.elastic.co/t/add-units-to-metric-visualization-in-kibana/292098)
**Author:** [@Anton\_Schleenvoigt](https://discuss.elastic.co/u/Anton_Schleenvoigt)\ **Replies:** 1\ **Last updated:** [December 16, 2021, 10:35am UTC](https://discuss.elastic.co/t/add-units-to-metric-visualization-in-kibana/292098 "2021-12-16T10:35:03Z")
Right now I have created a metric that shows maximum value of an power meter value X and after this value i would like to add the measure unit sent i within the same msg. I have a modbus that sends different values and … --- ## [Nested ElasticSeach Aggregation term query help needed different levels](https://discuss.elastic.co/t/nested-elasticseach-aggregation-term-query-help-needed-different-levels/292129)
**Author:** [@Arti\_Sayani](https://discuss.elastic.co/u/Arti_Sayani)\ **Replies:** 0\ **Last updated:** [December 16, 2021, 10:01am UTC](https://discuss.elastic.co/t/nested-elasticseach-aggregation-term-query-help-needed-different-levels/292129 "2021-12-16T10:01:44Z")
If someone can answer this. I need urgent help with this query on raw data for multiple nested aggregations --- ## [Kibana dropdown filter doesn't handle results containing a dash (-)](https://discuss.elastic.co/t/kibana-dropdown-filter-doesnt-handle-results-containing-a-dash/291994)
**Author:** [@vpy](https://discuss.elastic.co/u/vpy)\ **Replies:** 1\ **Last updated:** [December 16, 2021, 9:13am UTC](https://discuss.elastic.co/t/kibana-dropdown-filter-doesnt-handle-results-containing-a-dash/291994 "2021-12-16T09:13:00Z")
Hi I would like to report a this Kibana canvas issue. Let me first describe the test environment: The canvas contains a dropdown filter and a Data table. The kibana index is issued from syslog files. The main index f… --- ## [Dashboard setup fails: Unable to bulk\_create index-pattern](https://discuss.elastic.co/t/dashboard-setup-fails-unable-to-bulk-create-index-pattern/292007)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 4\ **Last updated:** [December 16, 2021, 9:07am UTC](https://discuss.elastic.co/t/dashboard-setup-fails-unable-to-bulk-create-index-pattern/292007 "2021-12-16T09:07:46Z")
Hello, I have encountered the same problem as the user in this post. I configured metricbeat and filebeat with the kibana\_system user. Should I create a new user that runs as a kibana\_system user and add some rights? W… --- ## [Monitoring WIndows Server](https://discuss.elastic.co/t/monitoring-windows-server/292111)
**Author:** [@labate](https://discuss.elastic.co/u/labate)\ **Replies:** 0\ **Last updated:** [December 16, 2021, 8:44am UTC](https://discuss.elastic.co/t/monitoring-windows-server/292111 "2021-12-16T08:44:36Z")
HI everyone, I don't understand why I'm not able to view the monitoring of my Windows server on the Metric menu on Kibana. I see the metric when I go in "Discover" menu but not in the metric menu. After some research I … --- ## [Search response returns empty \_source](https://discuss.elastic.co/t/search-response-returns-empty-source/292108)
**Author:** [@Katgust](https://discuss.elastic.co/u/Katgust)\ **Replies:** 0\ **Last updated:** [December 16, 2021, 8:28am UTC](https://discuss.elastic.co/t/search-response-returns-empty-source/292108 "2021-12-16T08:28:12Z")
Similar or almost identical search querys in other files give the right response but now something isn't working. I stripped it down to the smallest query but I still have the same problem. var searchResponse = await Es… --- ## [Log4j vulnerability and Elasticsearch 6.8.21](https://discuss.elastic.co/t/log4j-vulnerability-and-elasticsearch-6-8-21/292088)
**Author:** [@srikanth.puli](https://discuss.elastic.co/u/srikanth.puli)\ **Replies:** 0\ **Last updated:** [December 16, 2021, 6:59am UTC](https://discuss.elastic.co/t/log4j-vulnerability-and-elasticsearch-6-8-21/292088 "2021-12-16T06:59:21Z")
Hi, As per the release notes of Elasticserch 6.8.21, the vulnerability CVE-2021-44228 is addressed by removing the class file JndiLookup.class from the log4j jar. We have upgraded our application with Elasticsearch 6.8.… --- ## [Using pre-configured email connector instead of using configured email connector](https://discuss.elastic.co/t/using-pre-configured-email-connector-instead-of-using-configured-email-connector/291720)
**Author:** [@keyu](https://discuss.elastic.co/u/keyu)\ **Replies:** 4\ **Last updated:** [December 16, 2021, 7:24am UTC](https://discuss.elastic.co/t/using-pre-configured-email-connector-instead-of-using-configured-email-connector/291720 "2021-12-16T07:24:58Z")
Hi, I am working on watcher emails. Configured a connector in "Rules and Connectors" I have validated the connector validation by test email. I am able to receive the email from the Test tab by clicking on the "Run" bu… --- ## [Extract Hashtags and Mentions into separate fields](https://discuss.elastic.co/t/extract-hashtags-and-mentions-into-separate-fields/291656)
**Author:** [@prakhar\_nigam](https://discuss.elastic.co/u/prakhar_nigam)\ **Replies:** 2\ **Last updated:** [December 16, 2021, 6:48am UTC](https://discuss.elastic.co/t/extract-hashtags-and-mentions-into-separate-fields/291656 "2021-12-16T06:48:50Z")
I am doing a DIY Tweet Sentiment analyser, I have an index of tweets like these, "\_source" : { "id" : 26930655, "status" : 1, "title" : "Here’s 5 underrated #BTC and realistic crypto accounts that ever… --- ## [Unable to configure Elasticsearch following the Quickstart guide](https://discuss.elastic.co/t/unable-to-configure-elasticsearch-following-the-quickstart-guide/292076)
**Author:** [@abu.kalna](https://discuss.elastic.co/u/abu.kalna)\ **Replies:** 1\ **Last updated:** [December 16, 2021, 5:43am UTC](https://discuss.elastic.co/t/unable-to-configure-elasticsearch-following-the-quickstart-guide/292076 "2021-12-16T05:43:18Z")
Unable to configure Elasticsearch on Kubernetes 1.22 using the Quickstart guide (Deploy ECK in your Kubernetes cluster | Elastic Cloud on Kubernetes \[1.8\] | Elastic). It is in "ApplyingChanges" for the last 14 hours. $ … --- ## [MISP Configuration issue in Filebeat module](https://discuss.elastic.co/t/misp-configuration-issue-in-filebeat-module/292002)
**Author:** [@tejas.tech](https://discuss.elastic.co/u/tejas.tech)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 3:22pm UTC](https://discuss.elastic.co/t/misp-configuration-issue-in-filebeat-module/292002 "2021-12-15T15:22:36Z")
Error while processing http request: failed to execute http client.Do: failed to execute http client.Do: Post "https://127.0.0.1/events/restSearch": POST https://127.0.0.1/events/restSearch giving up after 6 attempts … --- ## [Elasticsearch 7.10.0, x-pack-core and x-pack-security under which license](https://discuss.elastic.co/t/elasticsearch-7-10-0-x-pack-core-and-x-pack-security-under-which-license/290104)
**Author:** [@Sagarika\_Mahalik](https://discuss.elastic.co/u/Sagarika_Mahalik)\ **Replies:** 3\ **Last updated:** [December 16, 2021, 5:34am UTC](https://discuss.elastic.co/t/elasticsearch-7-10-0-x-pack-core-and-x-pack-security-under-which-license/290104 "2021-12-16T05:34:53Z")
Hi, I wanted to ask the Elasticsearch 7.10.0 is now under which license and the x-pack-core7.10.0 and x-pack-security7.10.0 which comes with Elasticsearch 7.10.0 is under which license. Thanks --- ## [Logstash and logical or](https://discuss.elastic.co/t/logstash-and-logical-or/291582)
**Author:** [@KaPBaJIOJI](https://discuss.elastic.co/u/KaPBaJIOJI)\ **Replies:** 3\ **Last updated:** [December 16, 2021, 3:43am UTC](https://discuss.elastic.co/t/logstash-and-logical-or/291582 "2021-12-16T03:43:29Z")
Hello everyone I try to started config logstash Work config filter { # grok log lines by program name (listed alpabetically) if \[program\] =~ /^postfix.\*\\/anvil$/ { grok { patterns\_dir =\> … --- ## [Logstash calls flush method multiple times per filter plugin](https://discuss.elastic.co/t/logstash-calls-flush-method-multiple-times-per-filter-plugin/292062)
**Author:** [@vbohata](https://discuss.elastic.co/u/vbohata)\ **Replies:** 0\ **Last updated:** [December 16, 2021, 12:28am UTC](https://discuss.elastic.co/t/logstash-calls-flush-method-multiple-times-per-filter-plugin/292062 "2021-12-16T00:28:29Z")
I am writing some logstash filter plugin and found one weird behaviour. It seems the LS somehow calls flush method multiple times even if I use 1 worker and 1 pipeline called "def". I did some tests and here are parts of… --- ## [Search for unused fields](https://discuss.elastic.co/t/search-for-unused-fields/292060)
**Author:** [@hamzahda](https://discuss.elastic.co/u/hamzahda)\ **Replies:** 3\ **Last updated:** [December 16, 2021, 2:04am UTC](https://discuss.elastic.co/t/search-for-unused-fields/292060 "2021-12-16T02:04:10Z")
I have an index pttern that has a huge number of fields and I want to clean it up by removing the unused fields. The way that I'm using to find out if a field is used or not is by searching for the field in the available… --- ## [Mitigation for Log4j2 vulnerability](https://discuss.elastic.co/t/mitigation-for-log4j2-vulnerability/291938)
**Author:** [@Programmer](https://discuss.elastic.co/u/Programmer)\ **Replies:** 4\ **Last updated:** [December 16, 2021, 1:21am UTC](https://discuss.elastic.co/t/mitigation-for-log4j2-vulnerability/291938 "2021-12-16T01:21:08Z")
Hi, I am using the below ELK stack versions. Might be old version. I would like to know whether these versions of ELK are vulnerable due to the log4j2 issue. Elasticsearch-2.3.3 logstash-2.3.1 kibana-4.5.1 I couldn'… --- ## [CVE-2021-44228 not using XPack, does exposure change?](https://discuss.elastic.co/t/cve-2021-44228-not-using-xpack-does-exposure-change/292022)
**Author:** [@falcon404](https://discuss.elastic.co/u/falcon404)\ **Replies:** 1\ **Last updated:** [December 16, 2021, 1:18am UTC](https://discuss.elastic.co/t/cve-2021-44228-not-using-xpack-does-exposure-change/292022 "2021-12-16T01:18:52Z")
Hi, We are running Elasticsearch and not enabling / installing X-Pack for reasons. With regard to the log4j2 vulnerability CVE-2021-44228, there has been mention of setting property or upgrading to a later version (I … --- ## [Logstash json parse error](https://discuss.elastic.co/t/logstash-json-parse-error/291557)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 11:01pm UTC](https://discuss.elastic.co/t/logstash-json-parse-error/291557 "2021-12-15T23:01:31Z")
hello, Last time I'm receiving a log of logstash json parse errors, from the error logs I cannot read anything about to what files it is about to, \[ WARN \] 2021-12-12 13:28:20.845 \[\[main\]\>worker6\] json - Error parsing… --- ## [Nested must\_not query does not return expected results](https://discuss.elastic.co/t/nested-must-not-query-does-not-return-expected-results/291944)
**Author:** [@jsjs2](https://discuss.elastic.co/u/jsjs2)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 10:44pm UTC](https://discuss.elastic.co/t/nested-must-not-query-does-not-return-expected-results/291944 "2021-12-15T22:44:54Z")
what is the expected behavior for a nested must\_not query? sample query: { "query": { "bool": { "filter": \[ { "nested": { "path": "par… --- ## [Logstash : Elasticsearch input plugin not working with a remote server](https://discuss.elastic.co/t/logstash-elasticsearch-input-plugin-not-working-with-a-remote-server/291685)
**Author:** [@Bassem\_Wadie](https://discuss.elastic.co/u/Bassem_Wadie)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 9:37pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-input-plugin-not-working-with-a-remote-server/291685 "2021-12-15T21:37:03Z")
Hello, I have logstash installed on my PC and there is a Amazon Linux 2 AMI machine contains Kubernetes ( Elasticsearch and Ngnix) There is ssl installed on the server but i can make queries from postman on my pc usi… --- ## [Logstash.instrument.periodicpoller.jvm remove from log](https://discuss.elastic.co/t/logstash-instrument-periodicpoller-jvm-remove-from-log/291932)
**Author:** [@peledev](https://discuss.elastic.co/u/peledev)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 9:20pm UTC](https://discuss.elastic.co/t/logstash-instrument-periodicpoller-jvm-remove-from-log/291932 "2021-12-15T21:20:11Z")
how do i disable all the logs debug of logstash.instrument.periodicpoller.jvm it is filling my log with junk please assist thanks claudia --- ## [Is it possible to send one email with several Dashboard PDF reports?](https://discuss.elastic.co/t/is-it-possible-to-send-one-email-with-several-dashboard-pdf-reports/291359)
**Author:** [@Luis\_P](https://discuss.elastic.co/u/Luis_P)\ **Replies:** 3\ **Last updated:** [December 15, 2021, 9:16pm UTC](https://discuss.elastic.co/t/is-it-possible-to-send-one-email-with-several-dashboard-pdf-reports/291359 "2021-12-15T21:16:30Z")
I've been building a watcher with the purpose of when the condition is met, it should send one email with several Dashboard PDF reports as attachments, one for each process. So far I've only been able to make it so it se… --- ## [Warning \[org.logstash.instrument.metrics.gauge.LazyDelegatingGauge\] after updating to 7.16.1](https://discuss.elastic.co/t/warning-org-logstash-instrument-metrics-gauge-lazydelegatinggauge-after-updating-to-7-16-1/292049)
**Author:** [@d71247](https://discuss.elastic.co/u/d71247)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 9:07pm UTC](https://discuss.elastic.co/t/warning-org-logstash-instrument-metrics-gauge-lazydelegatinggauge-after-updating-to-7-16-1/292049 "2021-12-15T21:07:37Z")
Hello, I just updated my Logstash to 7.16.1... but I noticed warning in my conf when starting Logstash. the same conf of Logstash works well in version 7.9.1 How do to fix this warning ? I am using a Logstash docker … --- ## [Is it possible to update an index by importing an updated .csv file?](https://discuss.elastic.co/t/is-it-possible-to-update-an-index-by-importing-an-updated-csv-file/292029)
**Author:** [@kibanauser4](https://discuss.elastic.co/u/kibanauser4)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 8:35pm UTC](https://discuss.elastic.co/t/is-it-possible-to-update-an-index-by-importing-an-updated-csv-file/292029 "2021-12-15T20:35:24Z")
I want to update my index by importing a .csv file via Logstash. Currently, the plan is to delete all the records from the index and then reimport the new .csv file from scratch. But I was wondering if it's possible to j… --- ## [Found " Nettle Cryptographics Library Vulnerability" in docker.elastic.co/elasticsearch/elasticsearch:7.12.1 image](https://discuss.elastic.co/t/found-nettle-cryptographics-library-vulnerability-in-docker-elastic-co-elasticsearch-elasticsearch-7-12-1-image/292038)
**Author:** [@Ajinkya\_Shinde1](https://discuss.elastic.co/u/Ajinkya_Shinde1)\ **Replies:** 0\ **Last updated:** [December 15, 2021, 6:38pm UTC](https://discuss.elastic.co/t/found-nettle-cryptographics-library-vulnerability-in-docker-elastic-co-elasticsearch-elasticsearch-7-12-1-image/292038 "2021-12-15T18:38:01Z")
We are using Elasticsearch as a log server for Liferay application 7.3-ga1. The recommended version of ELS is 7.12 as per Liferay documentation. Recently I have scanned the docker image with Azure Defender and observed… --- ## [Cannot consume elasticsearch client in angular application](https://discuss.elastic.co/t/cannot-consume-elasticsearch-client-in-angular-application/291029)
**Author:** [@Ola\_Aboamer](https://discuss.elastic.co/u/Ola_Aboamer)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 8:00pm UTC](https://discuss.elastic.co/t/cannot-consume-elasticsearch-client-in-angular-application/291029 "2021-12-15T20:00:39Z")
Hi There I am using Angular10 and "@elastic/Elasticsearch": "^7.15.0", and getting the following dependency errors, ERROR in ./node\_modules/@elastic/elasticsearch/lib/Connection.js Module not found: Error: Can't re… --- ## [CVE-2021-44228 Alternative Mitigation](https://discuss.elastic.co/t/cve-2021-44228-alternative-mitigation/291877)
**Author:** [@boris111](https://discuss.elastic.co/u/boris111)\ **Replies:** 2\ **Last updated:** [December 15, 2021, 7:55pm UTC](https://discuss.elastic.co/t/cve-2021-44228-alternative-mitigation/291877 "2021-12-15T19:55:02Z")
Is it possible to drop the new log4j-core-2.15.0.jar for logstash as an alternative mitigation for the 5.x logstash version? The recommended mitigation step to remove the JndiLookup.class would not be desirable for dep… --- ## [Need to split comma delimited string where one of the fields contains a backslash](https://discuss.elastic.co/t/need-to-split-comma-delimited-string-where-one-of-the-fields-contains-a-backslash/289962)
**Author:** [@trwillis](https://discuss.elastic.co/u/trwillis)\ **Replies:** 2\ **Last updated:** [November 23, 2021, 7:00pm UTC](https://discuss.elastic.co/t/need-to-split-comma-delimited-string-where-one-of-the-fields-contains-a-backslash/289962 "2021-11-23T19:00:48Z")
I have this message string: "foo,bar,domain\\name,blah I need to split it into fields so it looks like this: field\[0\]: foo field\[1\]: bar field\[2\]: domain\\user field\[3\]: blah but the split filter splits the message u… --- ## [Failing to load conf file](https://discuss.elastic.co/t/failing-to-load-conf-file/289811)
**Author:** [@kainan](https://discuss.elastic.co/u/kainan)\ **Replies:** 4\ **Last updated:** [November 23, 2021, 3:28pm UTC](https://discuss.elastic.co/t/failing-to-load-conf-file/289811 "2021-11-23T15:28:02Z")
Hey all, First time poster. I have been struggling for over a week to get the below conf file to compile. I have read through the forums and it always seems to be missing a } however that does not seem to be the case he… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1123) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1125)