# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1126 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1127 --- ## [Filter documents from search result](https://discuss.elastic.co/t/filter-documents-from-search-result/291965)
**Author:** [@dev\_test](https://discuss.elastic.co/u/dev_test)\ **Replies:** 0\ **Last updated:** [December 15, 2021, 12:08pm UTC](https://discuss.elastic.co/t/filter-documents-from-search-result/291965 "2021-12-15T12:08:30Z")
Hi, i have some data on a index in Elasticsearch that it displayed as follow "hits" : { "total" : { "value" : 7, "relation" : "eq" }, "max\_score" : 1.0, "hits" : \[ { "\_index" :… --- ## [Dynamic range in charts and alerts](https://discuss.elastic.co/t/dynamic-range-in-charts-and-alerts/291961)
**Author:** [@vishal\_bisa](https://discuss.elastic.co/u/vishal_bisa)\ **Replies:** 0\ **Last updated:** [December 15, 2021, 11:53am UTC](https://discuss.elastic.co/t/dynamic-range-in-charts-and-alerts/291961 "2021-12-15T11:53:06Z")
Hi Team, I have a query here regarding the Kibana dashboard where I have a guage chart to display the license count for a particular tool and also set up a watcher alert if the count is less than specific value, but now… --- ## [Fleet initialization behind a corporate proxy fails with "unable to get local issuer certificate", ignoring proxy settings](https://discuss.elastic.co/t/fleet-initialization-behind-a-corporate-proxy-fails-with-unable-to-get-local-issuer-certificate-ignoring-proxy-settings/291647)
**Author:** [@soerenkornetzkimiele](https://discuss.elastic.co/u/soerenkornetzkimiele)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 11:18am UTC](https://discuss.elastic.co/t/fleet-initialization-behind-a-corporate-proxy-fails-with-unable-to-get-local-issuer-certificate-ignoring-proxy-settings/291647 "2021-12-15T11:18:58Z")
I am running Elasticsearch and Kibana on Linux (Ubuntu 20.04 LTS) in a corporate environment, which requires an SSL-inspection proxy to access the Internet. Because of the SSL-inspection proxy, the private root certific… --- ## [Unable to allocate index](https://discuss.elastic.co/t/unable-to-allocate-index/291919)
**Author:** [@usrrandom](https://discuss.elastic.co/u/usrrandom)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 10:57am UTC](https://discuss.elastic.co/t/unable-to-allocate-index/291919 "2021-12-15T10:57:22Z")
Hi all, My ES index is showing red. It is a single node and has no replicas. Its running on version 5.5 On checking allocation status, I get the following { "index": "tm", "shard": 0, "primary": true, … --- ## [How to detect log4shell in the application logs?](https://discuss.elastic.co/t/how-to-detect-log4shell-in-the-application-logs/291947)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 0\ **Last updated:** [December 15, 2021, 10:40am UTC](https://discuss.elastic.co/t/how-to-detect-log4shell-in-the-application-logs/291947 "2021-12-15T10:40:21Z")
Hi folks, I wonder if anyone of you guys have already tried to find possible log4shell exploit based on the logs in your elastic cluster using kibana. I am aware that this can be done using the Elastic Security as descr… --- ## [Tracking the cause of write queues](https://discuss.elastic.co/t/tracking-the-cause-of-write-queues/291865)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 5\ **Last updated:** [December 15, 2021, 10:30am UTC](https://discuss.elastic.co/t/tracking-the-cause-of-write-queues/291865 "2021-12-15T10:30:59Z")
Hello, I've been trying to find the cause of a high load the happens randomly on one of my hot nodes for a couple of months. Currently I have a 25 nodes cluster, with 3 dedicated masters, 18 warm nodes and 4 hot nodes,… --- ## [Exiting: error connecting to Kibana: fail to get the Kibana version: HTTP GET request to http://localhost:5601/api/status fails: fail to execute the HTTP GET request](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-http-get-request-to-http-localhost-5601-api-status-fails-fail-to-execute-the-http-get-request/291933)
**Author:** [@M\_Solis](https://discuss.elastic.co/u/M_Solis)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 9:20am UTC](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-http-get-request-to-http-localhost-5601-api-status-fails-fail-to-execute-the-http-get-request/291933 "2021-12-15T09:20:51Z")
Hello Everyone, I'm new to ELK Stack. Im trying to run the winlogbeat on a windows server but I'm experiencing some issues. Exiting: error connecting to Kibana: fail to get the Kibana version: HTTP GET request to http:/… --- ## [Querying nested objects](https://discuss.elastic.co/t/querying-nested-objects/291850)
**Author:** [@OmarDacca](https://discuss.elastic.co/u/OmarDacca)\ **Replies:** 3\ **Last updated:** [December 15, 2021, 9:17am UTC](https://discuss.elastic.co/t/querying-nested-objects/291850 "2021-12-15T09:17:50Z")
hello, I have an index called session\_details, here is an example of a document: { "clientIdAsString" : "100", "sessionStart" : "2021-12-14T17:14:49.000Z", "user\_id" : "0Bl301Me7x080r5o2K8m9D86Z", "wz\_s… --- ## [Painless - check if string contains word](https://discuss.elastic.co/t/painless-check-if-string-contains-word/291914)
**Author:** [@sagar\_cherukuri](https://discuss.elastic.co/u/sagar_cherukuri)\ **Replies:** 0\ **Last updated:** [December 15, 2021, 7:50am UTC](https://discuss.elastic.co/t/painless-check-if-string-contains-word/291914 "2021-12-15T07:50:32Z")
Is it possible to check if a string contains the word in a nested array? I am accessing the fields through params.\_source and I have created a painless script as below, but it's throwing me errors at contains(). How to c… --- ## [How to remove "Part-of \" columns in Kibana CSV](https://discuss.elastic.co/t/how-to-remove-part-of-func-columns-in-kibana-csv/290861)
**Author:** [@DoesitMatter](https://discuss.elastic.co/u/DoesitMatter)\ **Replies:** 5\ **Last updated:** [December 15, 2021, 7:09am UTC](https://discuss.elastic.co/t/how-to-remove-part-of-func-columns-in-kibana-csv/290861 "2021-12-15T07:09:01Z")
Hi there, I'm wondering how can i remove the "Part of Unique\_count()".... Is there any important information contained in this "Part of..."? Thanks! Regards, Alloy --- ## [CVE-2021-44228 aka log4shell is logstash and/or elasticsearch affected?](https://discuss.elastic.co/t/cve-2021-44228-aka-log4shell-is-logstash-and-or-elasticsearch-affected/291415)
**Author:** [@jzandbergen](https://discuss.elastic.co/u/jzandbergen)\ **Replies:** 14\ **Last updated:** [December 15, 2021, 6:22am UTC](https://discuss.elastic.co/t/cve-2021-44228-aka-log4shell-is-logstash-and-or-elasticsearch-affected/291415 "2021-12-15T06:22:09Z")
Hi All, I was wondering if logstash and/or Elasticsearch is affected by this CVE? More information about this zeroday can be found here: Log4Shell: RCE 0-day exploit found in log4j 2, a popular Java logging package | L… --- ## [Not Able to Open Kibana in Browser due to 'unsafe-eval'](https://discuss.elastic.co/t/not-able-to-open-kibana-in-browser-due-to-unsafe-eval/291833)
**Author:** [@Mohammed.Asaduzzaman](https://discuss.elastic.co/u/Mohammed.Asaduzzaman)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 6:23am UTC](https://discuss.elastic.co/t/not-able-to-open-kibana-in-browser-due-to-unsafe-eval/291833 "2021-12-15T06:23:45Z")
All, I am not able to open Elastic Kibana Dashboard on my browser. The browser states "Something went wrong" and to try to refresh the page. Refreshing the page does not do anything. I get the following error: Refused … --- ## [Kibana 5.6.16 Internal error](https://discuss.elastic.co/t/kibana-5-6-16-internal-error/291874)
**Author:** [@chateesh](https://discuss.elastic.co/u/chateesh)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 6:19am UTC](https://discuss.elastic.co/t/kibana-5-6-16-internal-error/291874 "2021-12-15T06:19:18Z")
We've an ES cluster version 5.6.16 running on docker and kibana version 5.6.16. When running "Indices" under "monitoring" tab on kibana getting Internal server error as below. Monitoring: Error 500 Internal Server Erro… --- ## [Auditbeat update document\_id](https://discuss.elastic.co/t/auditbeat-update-document-id/291902)
**Author:** [@cva](https://discuss.elastic.co/u/cva)\ **Replies:** 0\ **Last updated:** [December 15, 2021, 6:18am UTC](https://discuss.elastic.co/t/auditbeat-update-document-id/291902 "2021-12-15T06:18:01Z")
Good day! I am sending auditbeat logs to elasticserch via logstash. In logstash output, added document\_id parameter to update document id in elasticserch: if "xml" in \[tags\] { elasticsearch { hosts =\> \[ "loc… --- ## [Native memory leak with frequent index delete/create](https://discuss.elastic.co/t/native-memory-leak-with-frequent-index-delete-create/290070)
**Author:** [@sreekanth](https://discuss.elastic.co/u/sreekanth)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 5:36am UTC](https://discuss.elastic.co/t/native-memory-leak-with-frequent-index-delete-create/290070 "2021-12-15T05:36:54Z")
As part of some flow, we used to create and delete an index just to do smoke test kind of regularly. Over months, we saw native memory is growing very badly. And finally, it touches max limits of OS memory and crashes. … --- ## [NGINX Ingress controller + Filebeat with NGINX module](https://discuss.elastic.co/t/nginx-ingress-controller-filebeat-with-nginx-module/291824)
**Author:** [@anton-johansson](https://discuss.elastic.co/u/anton-johansson)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 5:26am UTC](https://discuss.elastic.co/t/nginx-ingress-controller-filebeat-with-nginx-module/291824 "2021-12-15T05:26:33Z")
Hey! We're using the NGINX Ingress Controller (GitHub - kubernetes/ingress-nginx: NGINX Ingress Controller for Kubernetes), hosted in our Kubernetes cluster. We're using Filebeat deployed as a DaemonSet that parses logs … --- ## [Map unable to show result when filters are applied](https://discuss.elastic.co/t/map-unable-to-show-result-when-filters-are-applied/290625)
**Author:** [@Arrick](https://discuss.elastic.co/u/Arrick)\ **Replies:** 6\ **Last updated:** [December 15, 2021, 4:25am UTC](https://discuss.elastic.co/t/map-unable-to-show-result-when-filters-are-applied/290625 "2021-12-15T04:25:13Z")
Hello, I just started using Kibana not long ago and encounter some problems. For my current dataset, I do not have any map geo data but only country names. So I had to do a terms join method with an external map geo data… --- ## [Input 'aws-s3' failed with: failed to initialize s3 poller](https://discuss.elastic.co/t/input-aws-s3-failed-with-failed-to-initialize-s3-poller/288130)
**Author:** [@Ayush\_Mathur](https://discuss.elastic.co/u/Ayush_Mathur)\ **Replies:** 50\ **Last updated:** [December 15, 2021, 3:05am UTC](https://discuss.elastic.co/t/input-aws-s3-failed-with-failed-to-initialize-s3-poller/288130 "2021-12-15T03:05:25Z")
Hi, I've been trying to setup AWS module on 7.15 Elastic Stack cluster running as containers to ingest cloudtrail, cloudwatch, elb, s3access and vpcflow events (configured only for cloudtrail atm). However, there seems… --- ## [Kibana Uptime Monitor](https://discuss.elastic.co/t/kibana-uptime-monitor/289151)
**Author:** [@mst3r25](https://discuss.elastic.co/u/mst3r25)\ **Replies:** 3\ **Last updated:** [December 15, 2021, 12:49am UTC](https://discuss.elastic.co/t/kibana-uptime-monitor/289151 "2021-12-15T00:49:24Z")
I'm using the Kibana Uptime app to ping all my servers. I have more than 10 locations, but Kibana seems to default to 10 locations. Is there a way to make this dynamic or increase the locations from 10? --- ## [Export Raw CSV (for Kibana read only user)](https://discuss.elastic.co/t/export-raw-csv-for-kibana-read-only-user/291864)
**Author:** [@luca.scarpato](https://discuss.elastic.co/u/luca.scarpato)\ **Replies:** 1\ **Last updated:** [December 14, 2021, 10:45pm UTC](https://discuss.elastic.co/t/export-raw-csv-for-kibana-read-only-user/291864 "2021-12-14T22:45:54Z")
Hi our customers are accessing the kibana dashboard in read only mode and they are trying to download the Raw CSV but they get only 1 number (same as the formatted CSV) It seems like they cannot download the entire raw … --- ## [DeprecationWarning: The 'body' parameter is deprecated for the 'index' API and will be removed in a future version](https://discuss.elastic.co/t/deprecationwarning-the-body-parameter-is-deprecated-for-the-index-api-and-will-be-removed-in-a-future-version/291876)
**Author:** [@ingmar](https://discuss.elastic.co/u/ingmar)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 10:15pm UTC](https://discuss.elastic.co/t/deprecationwarning-the-body-parameter-is-deprecated-for-the-index-api-and-will-be-removed-in-a-future-version/291876 "2021-12-14T22:15:06Z")
Describe the feature: Elasticsearch version 7.15 elasticsearch-py version (elasticsearch.\_\_versionstr\_\_): 7.15.2 Please make sure the major version matches the Elasticsearch server you are running. Description of th… --- ## [Id size check](https://discuss.elastic.co/t/id-size-check/291870)
**Author:** [@thinkdffrnt](https://discuss.elastic.co/u/thinkdffrnt)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 8:39pm UTC](https://discuss.elastic.co/t/id-size-check/291870 "2021-12-14T20:39:09Z")
\_id is limited to 512 bytes in size and larger values will be rejected How can I check the bytes size in Java? Is this UTF 8 encoding? I can't find any info --- ## [Benchmarking ES using Rally store size metric increase and decrease](https://discuss.elastic.co/t/benchmarking-es-using-rally-store-size-metric-increase-and-decrease/291804)
**Author:** [@fargolk](https://discuss.elastic.co/u/fargolk)\ **Replies:** 2\ **Last updated:** [December 14, 2021, 8:25pm UTC](https://discuss.elastic.co/t/benchmarking-es-using-rally-store-size-metric-increase-and-decrease/291804 "2021-12-14T20:25:13Z")
I was benchmarking an ES index with different shard numbers using esrally. to find the shard number with best throughput for the specific index. As I read in documents store size is index size (translog excluded) In … --- ## [Multiple Pipelines throwing errors when enabled](https://discuss.elastic.co/t/multiple-pipelines-throwing-errors-when-enabled/291858)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 9\ **Last updated:** [December 14, 2021, 8:28pm UTC](https://discuss.elastic.co/t/multiple-pipelines-throwing-errors-when-enabled/291858 "2021-12-14T20:28:15Z")
Good Afternoon Elastic Peeps; I have been working with configuring and employing multiple pipelines in my ELK stack. I have implemented ELK 7.13.4 and when I use a simple syslog pipeline I am able to gather the informa… --- ## [Logstash Date filter plugin doesn't work with Java 8 after 7.16.1 upgrade](https://discuss.elastic.co/t/logstash-date-filter-plugin-doesnt-work-with-java-8-after-7-16-1-upgrade/291811)
**Author:** [@YuryShupletsov](https://discuss.elastic.co/u/YuryShupletsov)\ **Replies:** 1\ **Last updated:** [December 14, 2021, 7:40pm UTC](https://discuss.elastic.co/t/logstash-date-filter-plugin-doesnt-work-with-java-8-after-7-16-1-upgrade/291811 "2021-12-14T19:40:15Z")
Hello, We have updated Logstash from 7.10.1 to 7.16.1 and cannot start it with the error: \[2021-12-14T15:35:05,385\]\[ERROR\]\[logstash.agent \] Failed to execute action {:action=\>LogStash::PipelineAction::Create/… --- ## [Multiline pattern not matching in fluentbit](https://discuss.elastic.co/t/multiline-pattern-not-matching-in-fluentbit/291853)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 3\ **Last updated:** [December 14, 2021, 6:55pm UTC](https://discuss.elastic.co/t/multiline-pattern-not-matching-in-fluentbit/291853 "2021-12-14T18:55:32Z")
Hello team, I am ingesting data through fluent bit. we are facing some multiline pattern issu. can any one help me on this. In the message field it is displaying only 1 line. Pattern: (?m-ix)^(?\\\d{4}\\-\\d{2}\\… --- ## [ElasticSearch autocomplete/suggest by token](https://discuss.elastic.co/t/elasticsearch-autocomplete-suggest-by-token/291854)
**Author:** [@abhinav-nath](https://discuss.elastic.co/u/abhinav-nath)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 6:15pm UTC](https://discuss.elastic.co/t/elasticsearch-autocomplete-suggest-by-token/291854 "2021-12-14T18:15:12Z")
I want to create search suggestions based on the tokens (and not full documents) that are present in my index. For example: I have a simple index for movies in which I have these two documents: {"name":"Captain Ameri… --- ## [Search UI sorting by date: No mapping found error](https://discuss.elastic.co/t/search-ui-sorting-by-date-no-mapping-found-error/291857)
**Author:** [@asorondo](https://discuss.elastic.co/u/asorondo)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 6:36pm UTC](https://discuss.elastic.co/t/search-ui-sorting-by-date-no-mapping-found-error/291857 "2021-12-14T18:36:41Z")
Hi! I'm using Elasticsearch and search UI and wish to sort by different fields. I'm using the search UI component "Sorting" as follows: \ **Author:** [@Anusha\_Kusanghi](https://discuss.elastic.co/u/Anusha_Kusanghi)\ **Replies:** 3\ **Last updated:** [December 14, 2021, 6:19pm UTC](https://discuss.elastic.co/t/how-to-re-name-field-names-in-logstash/291803 "2021-12-14T18:19:06Z") Hi all, We have field names like client.geo.name and event.category , how can we re-name the names to this client geo name and event category. "\[event\]\[category\]" =\> "Event category" "\[client\]\[geo\]\[name\]" =\> "client g… --- ## [Logstash sending data to kafka topic at same time which disturbs ordering of log transactions](https://discuss.elastic.co/t/logstash-sending-data-to-kafka-topic-at-same-time-which-disturbs-ordering-of-log-transactions/291848)
**Author:** [@venkataraman](https://discuss.elastic.co/u/venkataraman)\ **Replies:** 1\ **Last updated:** [December 14, 2021, 5:58pm UTC](https://discuss.elastic.co/t/logstash-sending-data-to-kafka-topic-at-same-time-which-disturbs-ordering-of-log-transactions/291848 "2021-12-14T17:58:02Z")
Hello Everyone, My log file transactions look like this as shown below My log file looks like this: start time: 2021-10-11T13:54:34Z category: commercial status: started end time: start time: 2021-10-11T13:54:34Z c… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1125) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1127)