# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1355 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1356 --- ## [Rolling to 7.13](https://discuss.elastic.co/t/rolling-to-7-13/276165)
**Author:** [@geomario](https://discuss.elastic.co/u/geomario)\ **Replies:** 4\ **Last updated:** [June 22, 2021, 1:45pm UTC](https://discuss.elastic.co/t/rolling-to-7-13/276165 "2021-06-22T13:45:31Z")
Hola, I am pretty new to ElasticSearch. I am trying to upgrade my node from 7.6 to 7.13. It happened that when I run my new node with 7.13, the console throws a mistake. I have searched without success on how to solve i… --- ## [Winlogbeat Services v. Command Line Implementation](https://discuss.elastic.co/t/winlogbeat-services-v-command-line-implementation/276630)
**Author:** [@chris\_ts24](https://discuss.elastic.co/u/chris_ts24)\ **Replies:** 2\ **Last updated:** [June 22, 2021, 1:44pm UTC](https://discuss.elastic.co/t/winlogbeat-services-v-command-line-implementation/276630 "2021-06-22T13:44:26Z")
Hi all, I'm sending windows logs via winlogbeat (v.7.13.2) to a logstash instance (v.7.13.0), which processes the logs and sends them to an ES index "winlogs" (v.7.13.0). I've set up the pipeline (no logstash filter yet… --- ## [How to create a kind of ID card in visualisation with value of different field](https://discuss.elastic.co/t/how-to-create-a-kind-of-id-card-in-visualisation-with-value-of-different-field/276656)
**Author:** [@chriselk](https://discuss.elastic.co/u/chriselk)\ **Replies:** 1\ **Last updated:** [June 22, 2021, 1:41pm UTC](https://discuss.elastic.co/t/how-to-create-a-kind-of-id-card-in-visualisation-with-value-of-different-field/276656 "2021-06-22T13:41:07Z")
I'm trying to create a visualization that look like an ID card for example for a servers (a custom text list of Field : Value from a document ) SERVER: myservername CPU : 8 MEM: 24GB REGION: APAC I see… --- ## [How to deploy an elastic-agent in fleet against an elasticsearch with a self-signed certificate?](https://discuss.elastic.co/t/how-to-deploy-an-elastic-agent-in-fleet-against-an-elasticsearch-with-a-self-signed-certificate/276575)
**Author:** [@leprovokateur](https://discuss.elastic.co/u/leprovokateur)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 7:31pm UTC](https://discuss.elastic.co/t/how-to-deploy-an-elastic-agent-in-fleet-against-an-elasticsearch-with-a-self-signed-certificate/276575 "2021-06-21T19:31:58Z")
Hi, I deployed a fleet server using elastic-agent, which runs fine. For the deployment of an elastic-agent I use --insecure, because the fleet server, Kibana, and elasticsearch use a self-signed certificate. I get a c… --- ## [Logstash\_7.5.2\_ Encountered a retryable error. Will Retry with exponential backoff {:code=\>400, :url=\>"https://host:9200/\_bulk"}](https://discuss.elastic.co/t/logstash-7-5-2-encountered-a-retryable-error-will-retry-with-exponential-backoff-code-400-url-https-host-9200-bulk/276635)
**Author:** [@anburethy](https://discuss.elastic.co/u/anburethy)\ **Replies:** 2\ **Last updated:** [June 22, 2021, 1:16pm UTC](https://discuss.elastic.co/t/logstash-7-5-2-encountered-a-retryable-error-will-retry-with-exponential-backoff-code-400-url-https-host-9200-bulk/276635 "2021-06-22T13:16:25Z")
Hi Team, We use an ELK stack and I actually ran into login issue for which I deleted some existing indexes which are old and the login issue sorted but I ran into another issue. I wasnt able to reindex not the new index… --- ## [Error in Databricks 7.6 and Elastic 7.1.1 \*\*java.lang.ClassNotFoundException: Failed to find data source: org.elasticsearch.spark.sql.\*\*](https://discuss.elastic.co/t/error-in-databricks-7-6-and-elastic-7-1-1-java-lang-classnotfoundexception-failed-to-find-data-source-org-elasticsearch-spark-sql/274272)
**Author:** [@mlo](https://discuss.elastic.co/u/mlo)\ **Replies:** 5\ **Last updated:** [June 22, 2021, 1:12pm UTC](https://discuss.elastic.co/t/error-in-databricks-7-6-and-elastic-7-1-1-java-lang-classnotfoundexception-failed-to-find-data-source-org-elasticsearch-spark-sql/274272 "2021-06-22T13:12:23Z")
We are running Databricks 7.6 (includes Apache Spark 3.0.1, Scala 2.12) and istalled via jip install org.elasticsearch:elasticsearch-spark-30\_2.12:7.12.1 and now I am getting this error java.lang.ClassNotFoundException:… --- ## [Transfer logs from rsyslog to logstash and view those logs in browser](https://discuss.elastic.co/t/transfer-logs-from-rsyslog-to-logstash-and-view-those-logs-in-browser/276140)
**Author:** [@vatsal](https://discuss.elastic.co/u/vatsal)\ **Replies:** 4\ **Last updated:** [June 22, 2021, 1:02pm UTC](https://discuss.elastic.co/t/transfer-logs-from-rsyslog-to-logstash-and-view-those-logs-in-browser/276140 "2021-06-22T13:02:05Z")
Hi , I want to send syslogs from rsyslog to logstash and view those in browser. I want to do this with TLS enabled. I have tried following ways: a. configured all corresponding files. b. configured pipeline for logst… --- ## [Anomalie Detection : Need Help Please](https://discuss.elastic.co/t/anomalie-detection-need-help-please/276359)
**Author:** [@ydr175020221](https://discuss.elastic.co/u/ydr175020221)\ **Replies:** 2\ **Last updated:** [June 22, 2021, 12:59pm UTC](https://discuss.elastic.co/t/anomalie-detection-need-help-please/276359 "2021-06-22T12:59:08Z")
Hello, I'm desperately trying to create a ML job to answer the following question: How to identify a gap for a user based on elements like: Country, City, ... Example if an user "Max" who often connects from FRANCE, … --- ## [Extract exctly/only json docs from ES Index into C# (NEST)](https://discuss.elastic.co/t/extract-exctly-only-json-docs-from-es-index-into-c-nest/273856)
**Author:** [@prgmrESNet](https://discuss.elastic.co/u/prgmrESNet)\ **Replies:** 3\ **Last updated:** [June 22, 2021, 12:55pm UTC](https://discuss.elastic.co/t/extract-exctly-only-json-docs-from-es-index-into-c-nest/273856 "2021-06-22T12:55:07Z")
Hello elastic.co, New user here, hence am learning the forum rules as well. Forum Admins, if this was asked previously, pardon me. I am an intermediate .Net C# programmer and novice ElasticSearch user. Here is my issu… --- ## [File input plugin - Delimiter property not working](https://discuss.elastic.co/t/file-input-plugin-delimiter-property-not-working/276650)
**Author:** [@parosio](https://discuss.elastic.co/u/parosio)\ **Replies:** 0\ **Last updated:** [June 22, 2021, 12:30pm UTC](https://discuss.elastic.co/t/file-input-plugin-delimiter-property-not-working/276650 "2021-06-22T12:30:30Z")
Hello, I have logstash \[6.7\] complaining when I set "\\r\\n" as delimiter for the file input plugin. The file I'd like logstash to handle is file incident\_sample.csv incident\_sample.csv: ASCII text, with very long lines… --- ## [Figure out which pipeline works the most?](https://discuss.elastic.co/t/figure-out-which-pipeline-works-the-most/276645)
**Author:** [@McElroy](https://discuss.elastic.co/u/McElroy)\ **Replies:** 1\ **Last updated:** [June 22, 2021, 12:42pm UTC](https://discuss.elastic.co/t/figure-out-which-pipeline-works-the-most/276645 "2021-06-22T12:42:21Z")
Hi, we have a pretty old ELK-stack (5.5) and since a few weeks our Logstash CPU usage is through the roof. Is there a way to check which pipeline or grok pattern is causing that? --- ## [Painless doc values; how to reference grouped fields](https://discuss.elastic.co/t/painless-doc-values-how-to-reference-grouped-fields/276588)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 2\ **Last updated:** [June 22, 2021, 12:15pm UTC](https://discuss.elastic.co/t/painless-doc-values-how-to-reference-grouped-fields/276588 "2021-06-22T12:15:23Z")
I'm trying to create a scripted field but can't get the doc value. I have: def fpath = doc\['winlog.user\_data.FilePath'\].value; def first = fpath.indexOf("\\\\"); def second = first + 1 + fpath.substring(first + 1).indexO… --- ## [How do you search for many IP addresses and output only the source IP and destination IP in Dev Tools \[Kibana\]](https://discuss.elastic.co/t/how-do-you-search-for-many-ip-addresses-and-output-only-the-source-ip-and-destination-ip-in-dev-tools-kibana/276542)
**Author:** [@kanrab](https://discuss.elastic.co/u/kanrab)\ **Replies:** 1\ **Last updated:** [June 22, 2021, 11:29am UTC](https://discuss.elastic.co/t/how-do-you-search-for-many-ip-addresses-and-output-only-the-source-ip-and-destination-ip-in-dev-tools-kibana/276542 "2021-06-22T11:29:38Z")
So the query to search for a single IP is: GET \_search { "query": { "term": { "ip\_addr": "43.225.52.0/23" } } } But this is only able to search for one IP address My original query was: GET \_… --- ## [Canvas - Render a metric generated based in other two metrics](https://discuss.elastic.co/t/canvas-render-a-metric-generated-based-in-other-two-metrics/276558)
**Author:** [@clino](https://discuss.elastic.co/u/clino)\ **Replies:** 1\ **Last updated:** [June 22, 2021, 11:27am UTC](https://discuss.elastic.co/t/canvas-render-a-metric-generated-based-in-other-two-metrics/276558 "2021-06-22T11:27:13Z")
I am looking to have configure a metric in Canvas to cover the following scenario: Calculate the total amount of sales all time divided by total sales in specific timeframe (i.e. first 3 months). I see within TSVB I can … --- ## [Kibana build taking forever to complete](https://discuss.elastic.co/t/kibana-build-taking-forever-to-complete/275297)
**Author:** [@niravk](https://discuss.elastic.co/u/niravk)\ **Replies:** 5\ **Last updated:** [June 22, 2021, 11:13am UTC](https://discuss.elastic.co/t/kibana-build-taking-forever-to-complete/275297 "2021-06-22T11:13:27Z")
I am trying to build the Kibana locally in my CentOS VM using the yarn build command. However, it is taking too long for the build process to complete(~13 hours). I am wondering, if I am doing something wrong or is there… --- ## [Follow-up from "Unable to avoid JSON parsing errors in logstash log-file"](https://discuss.elastic.co/t/follow-up-from-unable-to-avoid-json-parsing-errors-in-logstash-log-file/276641)
**Author:** [@es-gabriele](https://discuss.elastic.co/u/es-gabriele)\ **Replies:** 0\ **Last updated:** [June 22, 2021, 11:02am UTC](https://discuss.elastic.co/t/follow-up-from-unable-to-avoid-json-parsing-errors-in-logstash-log-file/276641 "2021-06-22T11:02:13Z")
Hi everyone, I am using ELK 7.2. I did read from a past answer here and I found it useful, as what I need to do is to make logstash correctly parse json data, and also an array of nested json objects. However, if I ne… --- ## [Aggregate Query Results](https://discuss.elastic.co/t/aggregate-query-results/276570)
**Author:** [@usman1](https://discuss.elastic.co/u/usman1)\ **Replies:** 5\ **Last updated:** [June 22, 2021, 10:39am UTC](https://discuss.elastic.co/t/aggregate-query-results/276570 "2021-06-22T10:39:15Z")
I am fetching timestamp and data against that timestamp with my search query to Elasticsearch node. The result being fetched contains multiple values against the same timeframe and I want Elasticsearch to return the aggr… --- ## [Kibana Alerts and Actions - Index and Server Log connectors disabled](https://discuss.elastic.co/t/kibana-alerts-and-actions-index-and-server-log-connectors-disabled/276545)
**Author:** [@wsnet](https://discuss.elastic.co/u/wsnet)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 1:45pm UTC](https://discuss.elastic.co/t/kibana-alerts-and-actions-index-and-server-log-connectors-disabled/276545 "2021-06-21T13:45:34Z")
Hello, I am trying to use Kibana Alerts and Actions with the built-in index connector (xpack.actions.preconfiguredAlertHistoryEsIndex), yet when I try to create a rule and an action there is no option to choose the inde… --- ## [Kibana logstash pipeline management UI fails to switch pipeline versions](https://discuss.elastic.co/t/kibana-logstash-pipeline-management-ui-fails-to-switch-pipeline-versions/274656)
**Author:** [@BradVido](https://discuss.elastic.co/u/BradVido)\ **Replies:** 2\ **Last updated:** [June 22, 2021, 10:18am UTC](https://discuss.elastic.co/t/kibana-logstash-pipeline-management-ui-fails-to-switch-pipeline-versions/274656 "2021-06-22T10:18:40Z")
When I load the Logstash pipelines UI in Kibana 7.12.1, it auto-selects the 4th option in the versions dropdown. It then fails to load any data. Worse yet is that I cannot switch the dropdown option (clicking a differe… --- ## [Logstash 'compile\_imperative' error](https://discuss.elastic.co/t/logstash-compile-imperative-error/276625)
**Author:** [@Michael\_Dylan\_McAloo](https://discuss.elastic.co/u/Michael_Dylan_McAloo)\ **Replies:** 2\ **Last updated:** [June 22, 2021, 9:33am UTC](https://discuss.elastic.co/t/logstash-compile-imperative-error/276625 "2021-06-22T09:33:32Z")
Hi, I have Logstash to pick up Snort Alerts, but i have had this error and i don't know why. Error: logstash | \[2021-06-22T08:55:53,809\]\[ERROR\]\[logstash.agent \] Failed to execute action {:action=\>Log… --- ## [Elasticsearch-py urllib3 suppress traceback logs on connection failures](https://discuss.elastic.co/t/elasticsearch-py-urllib3-suppress-traceback-logs-on-connection-failures/276561)
**Author:** [@jratliff](https://discuss.elastic.co/u/jratliff)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 3:49pm UTC](https://discuss.elastic.co/t/elasticsearch-py-urllib3-suppress-traceback-logs-on-connection-failures/276561 "2021-06-21T15:49:00Z")
client = Elasticsearch( hosts=config\['hosts'\], http\_auth=(config\['auth'\]\['user'\], config\['auth'\]\['password'\]), scheme='https', ssl\_context=context, time… --- ## [Are you aware of uncomptability between hibernate-enhance-maven-plugin and elasticsearch?](https://discuss.elastic.co/t/are-you-aware-of-uncomptability-between-hibernate-enhance-maven-plugin-and-elasticsearch/276574)
**Author:** [@guigui0824](https://discuss.elastic.co/u/guigui0824)\ **Replies:** 1\ **Last updated:** [June 22, 2021, 7:53am UTC](https://discuss.elastic.co/t/are-you-aware-of-uncomptability-between-hibernate-enhance-maven-plugin-and-elasticsearch/276574 "2021-06-22T07:53:34Z")
Hi, i work on a spring-boot project (version 2.3.8.RELEASE) with Hibernate (version 5.4.27.Final) and elasticsearch (spring-boot-starter-data-elasticsearch). I want to enable bytecode enhancement lazy loading to increas… --- ## [PacketBeats: Record the request and response of transactions that cannot be identified by a valid protocol under tcp](https://discuss.elastic.co/t/packetbeats-record-the-request-and-response-of-transactions-that-cannot-be-identified-by-a-valid-protocol-under-tcp/276610)
**Author:** [@manning23](https://discuss.elastic.co/u/manning23)\ **Replies:** 0\ **Last updated:** [June 22, 2021, 6:36am UTC](https://discuss.elastic.co/t/packetbeats-record-the-request-and-response-of-transactions-that-cannot-be-identified-by-a-valid-protocol-under-tcp/276610 "2021-06-22T06:36:23Z")
I hope to record the request and response of transactions that cannot be identified by a valid protocol under tcp. :slight\_smile: like this type: unknow-tcp enable: true send\_request: true send\_response: true --- ## [Buy x-pack license for Elasticsearch v5.4](https://discuss.elastic.co/t/buy-x-pack-license-for-elasticsearch-v5-4/276482)
**Author:** [@Srikanth\_Madiri](https://discuss.elastic.co/u/Srikanth_Madiri)\ **Replies:** 2\ **Last updated:** [June 22, 2021, 5:34am UTC](https://discuss.elastic.co/t/buy-x-pack-license-for-elasticsearch-v5-4/276482 "2021-06-22T05:34:29Z")
Hello, We're using elasticsearch 5.4 version with xpack plugin installed. As we see the license usually expires after trial period, we now have to buy the x-pack license. Can you please provide more steps/insights on ho… --- ## [Es\_rejected\_execution\_exception](https://discuss.elastic.co/t/es-rejected-execution-exception/276472)
**Author:** [@nkarthik](https://discuss.elastic.co/u/nkarthik)\ **Replies:** 12\ **Last updated:** [June 22, 2021, 4:08am UTC](https://discuss.elastic.co/t/es-rejected-execution-exception/276472 "2021-06-22T04:08:51Z")
In Elasticsearch v7.9.3, I'm getting the below shown error while sending Kubernetes Apiserver Audit logs to Elasticsearch. Looks like Elasticsearch is not able to keep up with the number of requests being sent. Can you p… --- ## [Connecting Filebeat-Azure by proxy](https://discuss.elastic.co/t/connecting-filebeat-azure-by-proxy/276514)
**Author:** [@daniele.saccon](https://discuss.elastic.co/u/daniele.saccon)\ **Replies:** 1\ **Last updated:** [June 22, 2021, 3:48am UTC](https://discuss.elastic.co/t/connecting-filebeat-azure-by-proxy/276514 "2021-06-22T03:48:49Z")
Hi everybody, we are trying to use Filebeat's Azure module to extract data from Azure but we are unable to connect to proxy. Filebeat (version 7.9) is installed on Windows Server 2008 in the internal network and to con… --- ## [How to restore index data if I remove all my master nodes accidentally!](https://discuss.elastic.co/t/how-to-restore-index-data-if-i-remove-all-my-master-nodes-accidentally/275109)
**Author:** [@Hiren\_Loong](https://discuss.elastic.co/u/Hiren_Loong)\ **Replies:** 8\ **Last updated:** [June 22, 2021, 3:42am UTC](https://discuss.elastic.co/t/how-to-restore-index-data-if-i-remove-all-my-master-nodes-accidentally/275109 "2021-06-22T03:42:15Z")
There are 3 master nodes and 6 data nodes in my ES Cluster. ES version is 6.7.x. I delete virtual machines accidentally, so 3 master nodes are disappeared forever! But my 6 data nodes are still on. Is any possible to … --- ## [Logstash input plugin bad uri](https://discuss.elastic.co/t/logstash-input-plugin-bad-uri/276592)
**Author:** [@IsAa](https://discuss.elastic.co/u/IsAa)\ **Replies:** 2\ **Last updated:** [June 22, 2021, 2:53am UTC](https://discuss.elastic.co/t/logstash-input-plugin-bad-uri/276592 "2021-06-22T02:53:03Z")
Hi, I am trying to install plugin for logstash. But whenever I execute .\\logstash-plugin list to see a list of available plugins. I keep getting bad uri error Using JAVA\_HOME defined java: C:\\Program Files\\Java\\jdk-14… --- ## [Spark-connector read and write es using ssl with the certificate of pem format](https://discuss.elastic.co/t/spark-connector-read-and-write-es-using-ssl-with-the-certificate-of-pem-format/276594)
**Author:** [@Min\_Zhao](https://discuss.elastic.co/u/Min_Zhao)\ **Replies:** 0\ **Last updated:** [June 22, 2021, 1:33am UTC](https://discuss.elastic.co/t/spark-connector-read-and-write-es-using-ssl-with-the-certificate-of-pem-format/276594 "2021-06-22T01:33:19Z")
The es using ssl by PEM certificate, how to set configs to spark-connector, therer are the java client configs below. --- ## [Grouping of alerts from different sources using machine learning](https://discuss.elastic.co/t/grouping-of-alerts-from-different-sources-using-machine-learning/276565)
**Author:** [@amitsaxena0709](https://discuss.elastic.co/u/amitsaxena0709)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 4:30pm UTC](https://discuss.elastic.co/t/grouping-of-alerts-from-different-sources-using-machine-learning/276565 "2021-06-21T16:30:53Z")
Hi all, Can Elasticsearch alone or with others tools in the Elastic ecosystem intelligently group alerts from multiple sources based some criteria using machine learning? As an example, consider a scenario where if dat… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1354) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1356)