# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1148 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1149 --- ## [Logstash doc has same breaking changes across multiple versions](https://discuss.elastic.co/t/logstash-doc-has-same-breaking-changes-across-multiple-versions/290259)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 2\ **Last updated:** [November 29, 2021, 2:52am UTC](https://discuss.elastic.co/t/logstash-doc-has-same-breaking-changes-across-multiple-versions/290259 "2021-11-29T02:52:35Z")
Hello. I was reviewing breaking changes on doc for my upgrade but realized all the changes are same from 7.13 to 7.15 . Should I interpret as "these changes should be aware between ANY version" or something else ? … --- ## [Mutiple - files in tmp](https://discuss.elastic.co/t/mutiple-files-in-tmp/290358)
**Author:** [@msalem](https://discuss.elastic.co/u/msalem)\ **Replies:** 1\ **Last updated:** [November 28, 2021, 11:03pm UTC](https://discuss.elastic.co/t/mutiple-files-in-tmp/290358 "2021-11-28T23:03:32Z")
Hello support, I have a folder with mutiple files generated there. -folder1 ---- tmp1 ---- tmp2 ---- etc. each file like tmp1, will have mutiple lines. how do Load each file as a message instead of reading each li… --- ## [Looking for a way to ingest a file and remove it](https://discuss.elastic.co/t/looking-for-a-way-to-ingest-a-file-and-remove-it/290343)
**Author:** [@hagaluly](https://discuss.elastic.co/u/hagaluly)\ **Replies:** 3\ **Last updated:** [November 28, 2021, 10:38pm UTC](https://discuss.elastic.co/t/looking-for-a-way-to-ingest-a-file-and-remove-it/290343 "2021-11-28T22:38:40Z")
i created a logstash conf file while back and it ingest the filr and removed it. back at the time i did not wanted this behavior but now i do... i only forgot how to do it :slight\_smile: can someone direct me to the c… --- ## [How to check the user details who delete the pipeline from Kibana or elasticseach](https://discuss.elastic.co/t/how-to-check-the-user-details-who-delete-the-pipeline-from-kibana-or-elasticseach/290276)
**Author:** [@muralikrishna](https://discuss.elastic.co/u/muralikrishna)\ **Replies:** 1\ **Last updated:** [November 28, 2021, 9:43pm UTC](https://discuss.elastic.co/t/how-to-check-the-user-details-who-delete-the-pipeline-from-kibana-or-elasticseach/290276 "2021-11-28T21:43:01Z")
Hello Everyone, We have situation that someone has deleted one of our Logstash pipeline from kibana (centrally managing from kibana) around 30 days back but we have noticed recently. Is there a possibility to check the… --- ## [How to get service status information from kafka connectors](https://discuss.elastic.co/t/how-to-get-service-status-information-from-kafka-connectors/290289)
**Author:** [@can.ozdemir](https://discuss.elastic.co/u/can.ozdemir)\ **Replies:** 0\ **Last updated:** [November 26, 2021, 1:13pm UTC](https://discuss.elastic.co/t/how-to-get-service-status-information-from-kafka-connectors/290289 "2021-11-26T13:13:16Z")
Hello, I have three kafka brokers take/ write data from everywhere into topics, after that filebeat kafka-connectors index all topics data into Elasticsearch indexes. My question is, are there any easy ways to get logs … --- ## [Indexing large number of transcripts](https://discuss.elastic.co/t/indexing-large-number-of-transcripts/290373)
**Author:** [@Chris\_Schutte](https://discuss.elastic.co/u/Chris_Schutte)\ **Replies:** 0\ **Last updated:** [November 28, 2021, 8:07pm UTC](https://discuss.elastic.co/t/indexing-large-number-of-transcripts/290373 "2021-11-28T20:07:13Z")
Hi all, I am new to elastic and have a modelling question. We have a large number of conversation transcripts and would like to index those using elastic. We have the identity of the speaker for each paragraph of the … --- ## [Docker swarm deployment: master\_not\_discovered\_exception](https://discuss.elastic.co/t/docker-swarm-deployment-master-not-discovered-exception/290348)
**Author:** [@AlanSBN](https://discuss.elastic.co/u/AlanSBN)\ **Replies:** 4\ **Last updated:** [November 28, 2021, 7:24pm UTC](https://discuss.elastic.co/t/docker-swarm-deployment-master-not-discovered-exception/290348 "2021-11-28T19:24:14Z")
I am basing my deployment off of the docker-compose.yml file found here. My modified yml file is pasted below. The docker swarm gets all three services running (only one replicated container per service) but the logs … --- ## [Curator Space filter not working correctly on small indexes](https://discuss.elastic.co/t/curator-space-filter-not-working-correctly-on-small-indexes/290370)
**Author:** [@Greg12](https://discuss.elastic.co/u/Greg12)\ **Replies:** 1\ **Last updated:** [November 28, 2021, 5:55pm UTC](https://discuss.elastic.co/t/curator-space-filter-not-working-correctly-on-small-indexes/290370 "2021-11-28T17:55:49Z")
I am trying to avoid reindexing larger indexes but the curator space filter seems to not see the space properly. I think it may have issues with indexes that are less than 1GB. What calls does curator make to get index … --- ## [Why my @timestamp shows wrong hour when overwritten?](https://discuss.elastic.co/t/why-my-timestamp-shows-wrong-hour-when-overwritten/290368)
**Author:** [@elk\_chaser](https://discuss.elastic.co/u/elk_chaser)\ **Replies:** 2\ **Last updated:** [November 28, 2021, 5:32pm UTC](https://discuss.elastic.co/t/why-my-timestamp-shows-wrong-hour-when-overwritten/290368 "2021-11-28T17:32:01Z")
echo "Nov 25 11:12:15 test message goes here" | /usr/share/logstash/bin/logstash -e 'input { stdin {} } filter { grok { keep\_empty\_captures =\> true match =\> { "message" =\> "^(?\%{SYSLOGTIMESTAMP:t… --- ## [Query OK in JDBC\_Stream But Not In JDBC\_Static?](https://discuss.elastic.co/t/query-ok-in-jdbc-stream-but-not-in-jdbc-static/290362)
**Author:** [@rojin](https://discuss.elastic.co/u/rojin)\ **Replies:** 3\ **Last updated:** [November 28, 2021, 5:29pm UTC](https://discuss.elastic.co/t/query-ok-in-jdbc-stream-but-not-in-jdbc-static/290362 "2021-11-28T17:29:40Z")
Hey, I have a query which works fine while using the JDBC steam "statement" but it does not seem to work while using JDBC static. Here's my JDBC\_Stream configuration: filter { jdbc\_streaming { jdbc\_driver\_class =\>… --- ## [Indeces with current date while using Index Life Management with file beat](https://discuss.elastic.co/t/indeces-with-current-date-while-using-index-life-management-with-file-beat/289222)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 5\ **Last updated:** [November 28, 2021, 4:05pm UTC](https://discuss.elastic.co/t/indeces-with-current-date-while-using-index-life-management-with-file-beat/289222 "2021-11-28T16:05:34Z")
For bootstrapping an index for using ILM, with filebeat , the following command was used PUT lp\_index-otherfgtraffull-000001 { "aliases": { "lp\_index-otherfgtraffull": { "is\_write\_index": true } } } … --- ## [Does JDBC Stream Have A Lot Of Cost For The Database?](https://discuss.elastic.co/t/does-jdbc-stream-have-a-lot-of-cost-for-the-database/290361)
**Author:** [@rojin](https://discuss.elastic.co/u/rojin)\ **Replies:** 0\ **Last updated:** [November 28, 2021, 12:56pm UTC](https://discuss.elastic.co/t/does-jdbc-stream-have-a-lot-of-cost-for-the-database/290361 "2021-11-28T12:56:17Z")
Hi! I have a query that I cannot convert from JDBC\_stream to JDBC\_static. How much cost does the plugin have for the database? I am parsing logs and I want to know is that okay to use this plugin? Does it have to access … --- ## [Logstash 7.5 GC too frequently to work](https://discuss.elastic.co/t/logstash-7-5-gc-too-frequently-to-work/290331)
**Author:** [@chenchuangc](https://discuss.elastic.co/u/chenchuangc)\ **Replies:** 2\ **Last updated:** [November 28, 2021, 8:44am UTC](https://discuss.elastic.co/t/logstash-7-5-gc-too-frequently-to-work/290331 "2021-11-28T08:44:46Z")
thank you for read my problem , sorry for bother you !!! 1. Env logstash version 7.5.0 java version java -version openjdk version "1.8.0\_312" OpenJDK Runtime Environment (build 1.8.0\_312-b07) OpenJDK 64-Bit Server VM … --- ## [JDBC Limit equivalent?](https://discuss.elastic.co/t/jdbc-limit-equivalent/290346)
**Author:** [@rojin](https://discuss.elastic.co/u/rojin)\ **Replies:** 4\ **Last updated:** [November 28, 2021, 6:35am UTC](https://discuss.elastic.co/t/jdbc-limit-equivalent/290346 "2021-11-28T06:35:09Z")
Hi! I was wondering what would be the equivalent of the limit in JDBC static? it does not accept the limit 10 in my query string. --- ## [JDBC - SQL Query Issue](https://discuss.elastic.co/t/jdbc-sql-query-issue/290345)
**Author:** [@rojin](https://discuss.elastic.co/u/rojin)\ **Replies:** 0\ **Last updated:** [November 27, 2021, 8:59pm UTC](https://discuss.elastic.co/t/jdbc-sql-query-issue/290345 "2021-11-27T20:59:52Z")
Hi! I have a database in MySQL and I want to fetch some info based on IP addresses I get from my client logs. There are ip\_from(VARCHAR 50), ip\_to(VARCHAR 50), ip\_from\_int(INT 10), and ip\_to\_int(INT 10) plus a name(VARCH… --- ## [Upgrading Elasticsearch](https://discuss.elastic.co/t/upgrading-elasticsearch/289319)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 7\ **Last updated:** [November 28, 2021, 1:34am UTC](https://discuss.elastic.co/t/upgrading-elasticsearch/289319 "2021-11-28T01:34:02Z")
Dear team, I want to upgrade my ES cluster to a newer version. This is the version I\`m using: According to the bellow page: I just want to know can I upgrade my cluster with Rolling Upgrade ? Or which way should … --- ## [Running FSCrawler in Debian 10, results in \`command not found\`](https://discuss.elastic.co/t/running-fscrawler-in-debian-10-results-in-command-not-found/290095)
**Author:** [@ehsan\_kabiri\_33](https://discuss.elastic.co/u/ehsan_kabiri_33)\ **Replies:** 5\ **Last updated:** [November 28, 2021, 12:05am UTC](https://discuss.elastic.co/t/running-fscrawler-in-debian-10-results-in-command-not-found/290095 "2021-11-28T00:05:22Z")
I'm trying to run fscrawler on Debian 10. I have downloded both fscrawler-es7-2.8-SNAPSHOT.zip and fscrawler-es7-2.7.zip then exctract them to /home/myname/fscrawler, but running these codes always results in command not… --- ## [Point In Time Search using wild card index](https://discuss.elastic.co/t/point-in-time-search-using-wild-card-index/290329)
**Author:** [@rohith511](https://discuss.elastic.co/u/rohith511)\ **Replies:** 0\ **Last updated:** [November 27, 2021, 9:36am UTC](https://discuss.elastic.co/t/point-in-time-search-using-wild-card-index/290329 "2021-11-27T09:36:02Z")
Sometime back when we created elastic we created multiple indexes with same initial pattern and these are dynamic suffix. (eg : microservice\_logs\_XYZ , microservice\_logs\_abc , microservice\_logs\_pqr etc..) Not sure the… --- ## [NotSslRecordException: not an SSL/TLS record while adding New Node to Cluster](https://discuss.elastic.co/t/notsslrecordexception-not-an-ssl-tls-record-while-adding-new-node-to-cluster/289334)
**Author:** [@ankurthakur](https://discuss.elastic.co/u/ankurthakur)\ **Replies:** 2\ **Last updated:** [November 27, 2021, 6:44pm UTC](https://discuss.elastic.co/t/notsslrecordexception-not-an-ssl-tls-record-while-adding-new-node-to-cluster/289334 "2021-11-27T18:44:03Z")
Hi, Hope everyone is doing well! We are having trouble adding a New Node to a Cluster which has SSL enabled using XPack Security. Before I write further, please keep the below things in mind: Installed same version o… --- ## [Email alerts on kibana dashboard](https://discuss.elastic.co/t/email-alerts-on-kibana-dashboard/290312)
**Author:** [@Prasanth\_V](https://discuss.elastic.co/u/Prasanth_V)\ **Replies:** 1\ **Last updated:** [November 27, 2021, 5:44pm UTC](https://discuss.elastic.co/t/email-alerts-on-kibana-dashboard/290312 "2021-11-27T17:44:49Z")
Hi Team, Is it possible to implement email alerts on community edition. Kindly, suggest . Thanks! --- ## [Should I keep beat version in index-template?](https://discuss.elastic.co/t/should-i-keep-beat-version-in-index-template/290335)
**Author:** [@noFancyStuff](https://discuss.elastic.co/u/noFancyStuff)\ **Replies:** 0\ **Last updated:** [November 27, 2021, 4:27pm UTC](https://discuss.elastic.co/t/should-i-keep-beat-version-in-index-template/290335 "2021-11-27T16:27:37Z")
Hi there, Hi have a very basic ES setup with winlogbeat configured with default options everywhere. By default, Winlogbeat loads index templates named winlogbeat-%{\[agent.version\]}-\* in ES. Because of that, any changes… --- ## [Elasticsearch as a primary storage](https://discuss.elastic.co/t/elasticsearch-as-a-primary-storage/290196)
**Author:** [@xtapodi](https://discuss.elastic.co/u/xtapodi)\ **Replies:** 5\ **Last updated:** [November 26, 2021, 4:17am UTC](https://discuss.elastic.co/t/elasticsearch-as-a-primary-storage/290196 "2021-11-26T04:17:42Z")
We have lots of users(30-200 million). Each user has N(30-100) attributes. The attribute can be of type integer, text, timestamp or counter. Schema is not defined. We are looking for a database to which we can index and… --- ## [Getting a filebeat error when trying to send filebeat logs to elasticsearch](https://discuss.elastic.co/t/getting-a-filebeat-error-when-trying-to-send-filebeat-logs-to-elasticsearch/290319)
**Author:** [@mandude77](https://discuss.elastic.co/u/mandude77)\ **Replies:** 6\ **Last updated:** [November 26, 2021, 10:23pm UTC](https://discuss.elastic.co/t/getting-a-filebeat-error-when-trying-to-send-filebeat-logs-to-elasticsearch/290319 "2021-11-26T22:23:57Z")
Please advise --- ## [Filebeat fails when I configure an ingest-pipeline on filebeat.yml](https://discuss.elastic.co/t/filebeat-fails-when-i-configure-an-ingest-pipeline-on-filebeat-yml/290314)
**Author:** [@feliperuiz](https://discuss.elastic.co/u/feliperuiz)\ **Replies:** 15\ **Last updated:** [November 26, 2021, 9:59pm UTC](https://discuss.elastic.co/t/filebeat-fails-when-i-configure-an-ingest-pipeline-on-filebeat-yml/290314 "2021-11-26T21:59:27Z")
Hi. I have a filebeat working OK and shipping csv logs to ELK cloud. I have created a new ingest-pipeline on ELK, that takes the message and create some fields: \[ { "csv": { "field": "message", "targe… --- ## [Elastic node can't start due to removed index setting](https://discuss.elastic.co/t/elastic-node-cant-start-due-to-removed-index-setting/290115)
**Author:** [@vvp199303](https://discuss.elastic.co/u/vvp199303)\ **Replies:** 5\ **Last updated:** [November 26, 2021, 6:50pm UTC](https://discuss.elastic.co/t/elastic-node-cant-start-due-to-removed-index-setting/290115 "2021-11-26T18:50:10Z")
Hi. I have a trouble with Elastic cluster (v 7.13.0) . Аfter adding an { "index.mapper.dynamic" : false } option for one index in cluster I was unable to restart cluster node. Also, I can't change "index.mapper.dynamic… --- ## [Is there a procedure on integrating wazuh with ldap?](https://discuss.elastic.co/t/is-there-a-procedure-on-integrating-wazuh-with-ldap/289632)
**Author:** [@nour.megahed](https://discuss.elastic.co/u/nour.megahed)\ **Replies:** 1\ **Last updated:** [November 26, 2021, 6:22pm UTC](https://discuss.elastic.co/t/is-there-a-procedure-on-integrating-wazuh-with-ldap/289632 "2021-11-26T18:22:23Z")
is there a procedure on integrating wazuh with ldap? --- ## [Syslog firewall filter](https://discuss.elastic.co/t/syslog-firewall-filter/290220)
**Author:** [@algira37](https://discuss.elastic.co/u/algira37)\ **Replies:** 2\ **Last updated:** [November 26, 2021, 5:04pm UTC](https://discuss.elastic.co/t/syslog-firewall-filter/290220 "2021-11-26T17:04:48Z")
Hello guys, I'm very new in this field, I would like to filter this log from raspberry pi syslog firewall: Nov 25 22:21:22 raspberrypi kernel: \[26172.577441\] DROP UNMATCHED IN-world:IN=eth0 OUT= MAC=01:00:5e:00:00:fb:a… --- ## [Rename recursively field names in nested structure without changing the structure](https://discuss.elastic.co/t/rename-recursively-field-names-in-nested-structure-without-changing-the-structure/290209)
**Author:** [@Isotta\_Blue](https://discuss.elastic.co/u/Isotta_Blue)\ **Replies:** 2\ **Last updated:** [November 26, 2021, 1:03pm UTC](https://discuss.elastic.co/t/rename-recursively-field-names-in-nested-structure-without-changing-the-structure/290209 "2021-11-26T13:03:26Z")
Hello, I have an event which is nested like this: { "test1": null, "test2": null, "test3": { "test31": null, "test32": null, }, "test4":{ "test5": \[ { … --- ## [Elasticsearch partial update based on Aggregation result](https://discuss.elastic.co/t/elasticsearch-partial-update-based-on-aggregation-result/290198)
**Author:** [@orivard](https://discuss.elastic.co/u/orivard)\ **Replies:** 4\ **Last updated:** [November 26, 2021, 5:03pm UTC](https://discuss.elastic.co/t/elasticsearch-partial-update-based-on-aggregation-result/290198 "2021-11-26T17:03:09Z")
I want to update partially all objects that are based on aggregation result. Here is my object: { "name": "name", "identificationHash": "aslkdakldjka", "isDupe": false, ... } My goal is to set isDupe to "true" for… --- ## [Table visualization: calculate percentage](https://discuss.elastic.co/t/table-visualization-calculate-percentage/290304)
**Author:** [@simonlucalandi](https://discuss.elastic.co/u/simonlucalandi)\ **Replies:** 3\ **Last updated:** [November 26, 2021, 4:49pm UTC](https://discuss.elastic.co/t/table-visualization-calculate-percentage/290304 "2021-11-26T16:49:34Z")
Hi all. Let's say that I have the following documents in an index { "user": "foo", "cost": 10, "revenue": 12 }, { "user": "bar", "cost": 20, "revenue": 25 } { "user": "foo", "cost": 15, "reve… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1147) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1149)