# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1131 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1132 --- ## [Elasticsearch Scoring Inconsistency](https://discuss.elastic.co/t/elasticsearch-scoring-inconsistency/291488)
**Author:** [@powerte](https://discuss.elastic.co/u/powerte)\ **Replies:** 0\ **Last updated:** [December 11, 2021, 12:30am UTC](https://discuss.elastic.co/t/elasticsearch-scoring-inconsistency/291488 "2021-12-11T00:30:31Z")
Our API uses Elasticsearch to return results based on scoring (relevance). In our use case, it's important we consistently return documents in the same sort order. We currently see that queries with larger result sets … --- ## [GROK Filter - Extract Year and Month](https://discuss.elastic.co/t/grok-filter-extract-year-and-month/291470)
**Author:** [@JeremyP](https://discuss.elastic.co/u/JeremyP)\ **Replies:** 1\ **Last updated:** [December 10, 2021, 10:01pm UTC](https://discuss.elastic.co/t/grok-filter-extract-year-and-month/291470 "2021-12-10T22:01:45Z")
Hi.... I'm looking for some help on creating a new field based on a grok pattern. Here is the field in question: "last\_assessed\_for\_vulnerabilities": "2021-12-10T07:05:41.154Z" I'm looking to create the following fiel… --- ## [Filter out documents in Discover view that match a set of saved queries/searches?](https://discuss.elastic.co/t/filter-out-documents-in-discover-view-that-match-a-set-of-saved-queries-searches/291339)
**Author:** [@CoaxVex](https://discuss.elastic.co/u/CoaxVex)\ **Replies:** 1\ **Last updated:** [December 10, 2021, 9:46pm UTC](https://discuss.elastic.co/t/filter-out-documents-in-discover-view-that-match-a-set-of-saved-queries-searches/291339 "2021-12-10T21:46:09Z")
My team is running a logging stack, where they need to follow up on error events in Kibana. Unfortunately, some errors take a while to get fixed, and some actually never get fixed because they are caused by external eve… --- ## [Error installing logstash codec plugin](https://discuss.elastic.co/t/error-installing-logstash-codec-plugin/291472)
**Author:** [@lucky7s](https://discuss.elastic.co/u/lucky7s)\ **Replies:** 0\ **Last updated:** [December 10, 2021, 9:16pm UTC](https://discuss.elastic.co/t/error-installing-logstash-codec-plugin/291472 "2021-12-10T21:16:59Z")
I downloaded the logstash-codec-leef plugin from github and successfully ran 'build install' using jruby. All rspec tests succeed. When I try to install this plugin using 'sudo logstash-plugin install' I get the followi… --- ## [Filebeat Tomcat module Access logs](https://discuss.elastic.co/t/filebeat-tomcat-module-access-logs/291468)
**Author:** [@searchtool](https://discuss.elastic.co/u/searchtool)\ **Replies:** 0\ **Last updated:** [December 10, 2021, 9:01pm UTC](https://discuss.elastic.co/t/filebeat-tomcat-module-access-logs/291468 "2021-12-10T21:01:11Z")
In response to this previous topic. Documentation mentions tomcat Access logs. This is a module for receiving Apache Tomcat access logs over Syslog or a file. I believe this is not correct and should just be just to… --- ## [In which conditions does bootstrap.password actually work?](https://discuss.elastic.co/t/in-which-conditions-does-bootstrap-password-actually-work/291465)
**Author:** [@Niwa\_7](https://discuss.elastic.co/u/Niwa_7)\ **Replies:** 0\ **Last updated:** [December 10, 2021, 8:29pm UTC](https://discuss.elastic.co/t/in-which-conditions-does-bootstrap-password-actually-work/291465 "2021-12-10T20:29:53Z")
Hi, I am trying to automate Elasticsearch 7.16 cluster deployment, including system user passwords. For that I'd add bootstrap.password to elastic keystore and use that password to set the permanent password for elastic … --- ## [SSL certificate issues after partial cluster migration \[ES 7.14\]](https://discuss.elastic.co/t/ssl-certificate-issues-after-partial-cluster-migration-es-7-14/291463)
**Author:** [@djordan66](https://discuss.elastic.co/u/djordan66)\ **Replies:** 0\ **Last updated:** [December 10, 2021, 7:54pm UTC](https://discuss.elastic.co/t/ssl-certificate-issues-after-partial-cluster-migration-es-7-14/291463 "2021-12-10T19:54:59Z")
Hi all, I'm running into an issue migrating machines in a cluster. Quick breakdown of the setup: We had a cluster running in one site on one network subnet (network a). We are being ushered out of the building, so we b… --- ## [Problems with Logstash Pipeline to ElasticSearch](https://discuss.elastic.co/t/problems-with-logstash-pipeline-to-elasticsearch/290936)
**Author:** [@Leandro\_Valim](https://discuss.elastic.co/u/Leandro_Valim)\ **Replies:** 12\ **Last updated:** [December 10, 2021, 7:51pm UTC](https://discuss.elastic.co/t/problems-with-logstash-pipeline-to-elasticsearch/290936 "2021-12-10T19:51:48Z")
Hi i have some erros to up my logstash service as bellows \[2021-12-03T19:44:46,535\]\[INFO \]\[logstash.javapipeline \]\[KSC\] Pipeline terminated {"pipeline.id"=\>"KSC"} \[2021-12-03T19:44:46,550\]\[ERROR\]\[logstash.agent … --- ## [Heartbeat config files fail when path variables passed](https://discuss.elastic.co/t/heartbeat-config-files-fail-when-path-variables-passed/289890)
**Author:** [@DPattee](https://discuss.elastic.co/u/DPattee)\ **Replies:** 3\ **Last updated:** [December 10, 2021, 6:42pm UTC](https://discuss.elastic.co/t/heartbeat-config-files-fail-when-path-variables-passed/289890 "2021-12-10T18:42:18Z")
In order to get my Kibana https heartbeat working, I had to add the standard ssl blob. I used the same blob that I have in all my .yml's that lets everything successfully (mostly) talk over https: ssl.enabled: true … --- ## [Error retrieving database names from Mongo instance: command listDatabases requires authentication](https://discuss.elastic.co/t/error-retrieving-database-names-from-mongo-instance-command-listdatabases-requires-authentication/290779)
**Author:** [@Abhishek\_Sarkate](https://discuss.elastic.co/u/Abhishek_Sarkate)\ **Replies:** 1\ **Last updated:** [December 10, 2021, 6:23pm UTC](https://discuss.elastic.co/t/error-retrieving-database-names-from-mongo-instance-command-listdatabases-requires-authentication/290779 "2021-12-10T18:23:16Z")
I am trying to integrate elastic-agent in MongoDB replica-set and show mongo metrics on kibana , while trying with below code on mongo.conf security: authorization: enabled keyFile: /etc/keyfile MongoDb version u… --- ## [Configure logstash to receive different csv files with different fields](https://discuss.elastic.co/t/configure-logstash-to-receive-different-csv-files-with-different-fields/291451)
**Author:** [@sanchez](https://discuss.elastic.co/u/sanchez)\ **Replies:** 1\ **Last updated:** [December 10, 2021, 6:16pm UTC](https://discuss.elastic.co/t/configure-logstash-to-receive-different-csv-files-with-different-fields/291451 "2021-12-10T18:16:08Z")
Hello good mornig for everyone I'm a beginner at Elasticsearch, Kibana, and Logstash I am trying to configure logstash to receive different csv files with different fields, how can I configure logstash to be able to de… --- ## [State metric for a Java Tomcat process always reporting as "sleeping"](https://discuss.elastic.co/t/state-metric-for-a-java-tomcat-process-always-reporting-as-sleeping/291077)
**Author:** [@Kevin\_Brunette](https://discuss.elastic.co/u/Kevin_Brunette)\ **Replies:** 2\ **Last updated:** [December 10, 2021, 5:50pm UTC](https://discuss.elastic.co/t/state-metric-for-a-java-tomcat-process-always-reporting-as-sleeping/291077 "2021-12-10T17:50:20Z")
I'm running metricbeat oss 7.14.0 on Ubuntu 18.04.6 (Bionic Beaver) LTS and attempting to tell if my Java Tomcat is running or down however; the "state" of the process always reports as "sleeping" regardless of whether t… --- ## [Rolling upgrade from 7.8.0-OSS to 7.15.2](https://discuss.elastic.co/t/rolling-upgrade-from-7-8-0-oss-to-7-15-2/291448)
**Author:** [@s.moran](https://discuss.elastic.co/u/s.moran)\ **Replies:** 0\ **Last updated:** [December 10, 2021, 5:50pm UTC](https://discuss.elastic.co/t/rolling-upgrade-from-7-8-0-oss-to-7-15-2/291448 "2021-12-10T17:50:00Z")
We are trying to upgrade our 7.8.0-OSS cluster to 7.15.2 using an automated deployment method where all new nodes are added to the cluster before the old nodes are taken down 1-by-1. We have noticed that during deployme… --- ## [How to hide all the 'getting started/add data/' links](https://discuss.elastic.co/t/how-to-hide-all-the-getting-started-add-data-links/291285)
**Author:** [@sentient](https://discuss.elastic.co/u/sentient)\ **Replies:** 2\ **Last updated:** [December 10, 2021, 5:25pm UTC](https://discuss.elastic.co/t/how-to-hide-all-the-getting-started-add-data-links/291285 "2021-12-10T17:25:10Z")
just trying to configure the system (kibana/elastic) for endusers. how can I avoid all the links to 'add data', links to '/home/app#' and everything else that is nice to have in a 'how to get started' mode. but I am … --- ## [EC2 cURL localhost:9200 - security\_exception](https://discuss.elastic.co/t/ec2-curl-localhost-9200-security-exception/291441)
**Author:** [@kmiklas](https://discuss.elastic.co/u/kmiklas)\ **Replies:** 2\ **Last updated:** [December 10, 2021, 5:21pm UTC](https://discuss.elastic.co/t/ec2-curl-localhost-9200-security-exception/291441 "2021-12-10T17:21:37Z")
What is the simplest way to enable the health check of Elasticsearch? Do I have to set up AWS authentication, or can I bypass it for troubleshooting? Connected to an AWS EC2 instance using a .pem file. Elasticsearch is… --- ## [Rollup feature can't create job - Index pattern must match indices that contain time fields](https://discuss.elastic.co/t/rollup-feature-cant-create-job-index-pattern-must-match-indices-that-contain-time-fields/291436)
**Author:** [@cjabrantes](https://discuss.elastic.co/u/cjabrantes)\ **Replies:** 2\ **Last updated:** [December 10, 2021, 5:07pm UTC](https://discuss.elastic.co/t/rollup-feature-cant-create-job-index-pattern-must-match-indices-that-contain-time-fields/291436 "2021-12-10T17:07:16Z")
Hi, I was exploring the rollup data feature, but i m not able to create a job via kibana UI, but i get the following error: Nevertheless i have date fields in the indice. Any ideas? Thanks, --- ## [Could not index event to Elasticsearch](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch/291397)
**Author:** [@bropid](https://discuss.elastic.co/u/bropid)\ **Replies:** 2\ **Last updated:** [December 10, 2021, 4:53pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch/291397 "2021-12-10T16:53:15Z")
Hi, i'm try to parse the ngfw event with logstash in tcp port 5000 to Elasticsearch but the logstash-plain.log always said: "status"=\>400, "error"=\>{"type"=\>"ma … --- ## [Discrepancy between CPU usage shown in Kibana vs AWS cloud watch metrics](https://discuss.elastic.co/t/discrepancy-between-cpu-usage-shown-in-kibana-vs-aws-cloud-watch-metrics/291346)
**Author:** [@taugusti](https://discuss.elastic.co/u/taugusti)\ **Replies:** 5\ **Last updated:** [December 10, 2021, 3:24pm UTC](https://discuss.elastic.co/t/discrepancy-between-cpu-usage-shown-in-kibana-vs-aws-cloud-watch-metrics/291346 "2021-12-10T15:24:49Z")
I run Elasticsearch on EC2 instances launched in AWS. I use version 7.11.2. I've been load testing searches and I see CPU spikes up to 100% on data nodes when I look in Kibana. However, in AWS cloud watch I never see CPU… --- ## [Encountered a retryable error (will retry with exponential backoff) {:code=\>413,](https://discuss.elastic.co/t/encountered-a-retryable-error-will-retry-with-exponential-backoff-code-413/291417)
**Author:** [@danushkalakmina](https://discuss.elastic.co/u/danushkalakmina)\ **Replies:** 1\ **Last updated:** [December 10, 2021, 2:36pm UTC](https://discuss.elastic.co/t/encountered-a-retryable-error-will-retry-with-exponential-backoff-code-413/291417 "2021-12-10T14:36:20Z")
Hi there i got this error in my logstash while sending logs to the Elasticsearch cluster.When i restarted the logstash service it got fix. But after 1-2 days it will happen recursively. \[2021-12-10T10:17:52,948\]\[ERROR\]… --- ## [Logs not being sent to logstash from .net application](https://discuss.elastic.co/t/logs-not-being-sent-to-logstash-from-net-application/291401)
**Author:** [@Murad000](https://discuss.elastic.co/u/Murad000)\ **Replies:** 1\ **Last updated:** [December 10, 2021, 2:31pm UTC](https://discuss.elastic.co/t/logs-not-being-sent-to-logstash-from-net-application/291401 "2021-12-10T14:31:48Z")
Hello, I launched elk stack on docker but logstash isn't receiving any logs from my application. I cloned this repo,added RUN logstash-plugin install logstash-input-http to the logstash's Dockerfile and changed the con… --- ## [Sequence number for ECS Events received by TCP?](https://discuss.elastic.co/t/sequence-number-for-ecs-events-received-by-tcp/291348)
**Author:** [@Matthias\_W](https://discuss.elastic.co/u/Matthias_W)\ **Replies:** 4\ **Last updated:** [December 10, 2021, 2:27pm UTC](https://discuss.elastic.co/t/sequence-number-for-ecs-events-received-by-tcp/291348 "2021-12-10T14:27:58Z")
Hi, I have configured my application server (JBoss) to format log messages using the ECS formatter and directly send them to Filebeat via TCP. This works mostly fine - however, there is one issue: Log entries having th… --- ## [Error while sniffing nodes](https://discuss.elastic.co/t/error-while-sniffing-nodes/291186)
**Author:** [@Hayk\_Hovhanisyan](https://discuss.elastic.co/u/Hayk_Hovhanisyan)\ **Replies:** 2\ **Last updated:** [December 10, 2021, 2:04pm UTC](https://discuss.elastic.co/t/error-while-sniffing-nodes/291186 "2021-12-10T14:04:00Z")
Environment: JDK 1.8.0\_301 Grails 5.0.2 Spring Boot 2.5.7 Groovy 3.0.7 Elasticsearch 7.10.2 (also tried 7.12.1) Situation: Hi dear colleagues, could you please clarify the error while sniffing nodes. Task: Running … --- ## [Using a bucket key for filtering in the according aggregation](https://discuss.elastic.co/t/using-a-bucket-key-for-filtering-in-the-according-aggregation/291423)
**Author:** [@Marc\_Zahn](https://discuss.elastic.co/u/Marc_Zahn)\ **Replies:** 0\ **Last updated:** [December 10, 2021, 12:27pm UTC](https://discuss.elastic.co/t/using-a-bucket-key-for-filtering-in-the-according-aggregation/291423 "2021-12-10T12:27:10Z")
Hello, maybe I searched for the wrong things, but I have a problem and don't know if it is possible to solve it: I have a terms aggregation where I need to filter the documents by matching the bucket keys against an inp… --- ## [Prune filter - Whitelist JSON subfields & per-pipeline log file](https://discuss.elastic.co/t/prune-filter-whitelist-json-subfields-per-pipeline-log-file/291298)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 2\ **Last updated:** [December 10, 2021, 11:49am UTC](https://discuss.elastic.co/t/prune-filter-whitelist-json-subfields-per-pipeline-log-file/291298 "2021-12-10T11:49:06Z")
Hi All, I've got a couple of questions! Can I whitelist only certain field from JSON using Prune? I saw similar topics suggesting ruby but wanted to avoid this as its a bit too complicated for me. For instance I'd li… --- ## [Not able to save Visualize or Query](https://discuss.elastic.co/t/not-able-to-save-visualize-or-query/291358)
**Author:** [@Luiz](https://discuss.elastic.co/u/Luiz)\ **Replies:** 2\ **Last updated:** [December 10, 2021, 10:52am UTC](https://discuss.elastic.co/t/not-able-to-save-visualize-or-query/291358 "2021-12-10T10:52:09Z")
Hi all, I am not able to save new query or visualize in Kibana, I am getting message "An error occurred while saving. Error: Forbidden" I am using version 7.11.0. I have search about the error here and other forums all… --- ## [OutOfMemoryError after PDTrueTypeFont Using fallback font warnings](https://discuss.elastic.co/t/outofmemoryerror-after-pdtruetypefont-using-fallback-font-warnings/290322)
**Author:** [@Cordobel](https://discuss.elastic.co/u/Cordobel)\ **Replies:** 7\ **Last updated:** [December 10, 2021, 10:04am UTC](https://discuss.elastic.co/t/outofmemoryerror-after-pdtruetypefont-using-fallback-font-warnings/290322 "2021-12-10T10:04:34Z")
I noticed twice that Elasticsearch crashed after some warnings about PDTrueTypeFont Using fallback font. After these warnings, the garbage collector starts to alert about the overload. Then a fatal error - lambda $MaybeD… --- ## [Best way to enrich by IP subnets](https://discuss.elastic.co/t/best-way-to-enrich-by-ip-subnets/232771)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 3\ **Last updated:** [December 10, 2021, 9:34am UTC](https://discuss.elastic.co/t/best-way-to-enrich-by-ip-subnets/232771 "2021-12-10T09:34:40Z")
I want to enrich incoming ECS-compatible documents with a tag if they come from VPN IPs. From my testing, the enrich processor cannot deal with IP-ranges. However, i want to use IP-ranges and not manually (or by a scrip… --- ## [Bulksearch with multiple terms and multiple values](https://discuss.elastic.co/t/bulksearch-with-multiple-terms-and-multiple-values/291407)
**Author:** [@GopiSumanth](https://discuss.elastic.co/u/GopiSumanth)\ **Replies:** 0\ **Last updated:** [December 10, 2021, 9:33am UTC](https://discuss.elastic.co/t/bulksearch-with-multiple-terms-and-multiple-values/291407 "2021-12-10T09:33:22Z")
Hi, Currently, we are using the below JSON for search in the repository index. Here we are using one term with multiple values(list of values). Can we change the JSON to search using multiple terms by passing multiple v… --- ## [Kibana rule auditlogs overwhelm audit logs](https://discuss.elastic.co/t/kibana-rule-auditlogs-overwhelm-audit-logs/291301)
**Author:** [@can.ozdemir](https://discuss.elastic.co/u/can.ozdemir)\ **Replies:** 2\ **Last updated:** [December 10, 2021, 8:26am UTC](https://discuss.elastic.co/t/kibana-rule-auditlogs-overwhelm-audit-logs/291301 "2021-12-10T08:26:49Z")
Hello There, We are trying to single out user actions, which contains update create or delete actions under audit\_logs. Our unix administration trying to catch these logs and produce mail alerts, but since we have rules… --- ## [How could I compare these two time values using painless script?](https://discuss.elastic.co/t/how-could-i-compare-these-two-time-values-using-painless-script/291034)
**Author:** [@Peilin](https://discuss.elastic.co/u/Peilin)\ **Replies:** 6\ **Last updated:** [December 10, 2021, 8:25am UTC](https://discuss.elastic.co/t/how-could-i-compare-these-two-time-values-using-painless-script/291034 "2021-12-10T08:25:59Z")
I am using ES to analysis medical data. how can i using painless script compare these two time values(beginDateTime, endDateTime).deep values. if it's not deep value, i found a solution like this { "query": { … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1130) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1132)