# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=138 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 139 --- ## [Pass additionalFields to ECSlayout](https://discuss.elastic.co/t/pass-additionalfields-to-ecslayout/370479)
**Author:** [@Narsimha\_Raju](https://discuss.elastic.co/u/Narsimha_Raju)\ **Replies:** 0\ **Last updated:** [November 13, 2024, 2:07pm UTC](https://discuss.elastic.co/t/pass-additionalfields-to-ecslayout/370479 "2024-11-13T14:07:14Z")
I was trying this code snippet in my log4j2.propeties file to pass additionalFields but it is failing. Any help on this would be great help! appender.elkRollingFile.layout.additionalFields\[0\].key=abc appender.elkRollin… --- ## [How to create a visualization based on a unique count of an IP field but excluding port number?](https://discuss.elastic.co/t/how-to-create-a-visualization-based-on-a-unique-count-of-an-ip-field-but-excluding-port-number/370470)
**Author:** [@Silvy20](https://discuss.elastic.co/u/Silvy20)\ **Replies:** 1\ **Last updated:** [November 13, 2024, 1:05pm UTC](https://discuss.elastic.co/t/how-to-create-a-visualization-based-on-a-unique-count-of-an-ip-field-but-excluding-port-number/370470 "2024-11-13T13:05:25Z")
Hello, I need to create a visualization based on unique count of IPs, however the field available in kibana is in the following format: xx.xx.xx.xx:xxxx I would like to know if through formulas (fe) I have a way to ca… --- ## [Filebeat Microsoft Module and GCC/GCCHIGH Government Cloud Support](https://discuss.elastic.co/t/filebeat-microsoft-module-and-gcc-gcchigh-government-cloud-support/370476)
**Author:** [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Replies:** 0\ **Last updated:** [November 13, 2024, 1:04pm UTC](https://discuss.elastic.co/t/filebeat-microsoft-module-and-gcc-gcchigh-government-cloud-support/370476 "2024-11-13T13:04:45Z")
Does the Microsoft module support govcloud options like the o365 module does? There is nothing to indicate this in the details: --- ## [2 aliases (read, write) per index pattern with rollover](https://discuss.elastic.co/t/2-aliases-read-write-per-index-pattern-with-rollover/370474)
**Author:** [@RMII](https://discuss.elastic.co/u/RMII)\ **Replies:** 0\ **Last updated:** [November 13, 2024, 11:23am UTC](https://discuss.elastic.co/t/2-aliases-read-write-per-index-pattern-with-rollover/370474 "2024-11-13T11:23:41Z")
Hello hello, good morning and happy Wednesday! May I ask your help and also if this is a common/known issue? This is a production cluster, ES 8.8.0. I am doing tests with a 5min rollover. Due to the nature of our appl… --- ## [WildCard in Exists API does not work as expected](https://discuss.elastic.co/t/wildcard-in-exists-api-does-not-work-as-expected/308554)
**Author:** [@tschodde](https://discuss.elastic.co/u/tschodde)\ **Replies:** 1\ **Last updated:** [November 13, 2024, 10:59am UTC](https://discuss.elastic.co/t/wildcard-in-exists-api-does-not-work-as-expected/308554 "2024-11-13T10:59:46Z")
Dear all, I've tried the Exists API for indices and data-streams ( Exists API | Elasticsearch Guide \[8.3\] | Elastic). If I understand it correction I can use wildcards in the target parameter. However, when using \* the… --- ## [I am unable to use all features of Elasticsearch](https://discuss.elastic.co/t/i-am-unable-to-use-all-features-of-elasticsearch/370448)
**Author:** [@90Pizzaman](https://discuss.elastic.co/u/90Pizzaman)\ **Replies:** 1\ **Last updated:** [November 13, 2024, 10:30am UTC](https://discuss.elastic.co/t/i-am-unable-to-use-all-features-of-elasticsearch/370448 "2024-11-13T10:30:43Z")
I understand that Elasticsearch is planned to offer the APGL v3.0 license. From the source on GitHub, it appears that the APGL v3.0 license is provided, but when I install Elasticsearch version v8.15.3 in a tarball forma… --- ## [Unable to get incident types IBM Resilient Connector](https://discuss.elastic.co/t/unable-to-get-incident-types-ibm-resilient-connector/370469)
**Author:** [@Aliya\_Khalel](https://discuss.elastic.co/u/Aliya_Khalel)\ **Replies:** 0\ **Last updated:** [November 13, 2024, 10:20am UTC](https://discuss.elastic.co/t/unable-to-get-incident-types-ibm-resilient-connector/370469 "2024-11-13T10:20:44Z")
I/m trying to add action for alerting to IBM Resilient and getting error --- ## [How to create links using the values in visualization tooltips?](https://discuss.elastic.co/t/how-to-create-links-using-the-values-in-visualization-tooltips/370088)
**Author:** [@Santiago\_Carnicero](https://discuss.elastic.co/u/Santiago_Carnicero)\ **Replies:** 1\ **Last updated:** [November 13, 2024, 10:15am UTC](https://discuss.elastic.co/t/how-to-create-links-using-the-values-in-visualization-tooltips/370088 "2024-11-13T10:15:50Z")
Dear Elastic Team, In our data analytics setup using Elasticsearch, we utilize visualizations to analyze and present data insights. We’d like to know if it’s possible to format the fields displayed in tooltips within vi… --- ## [Semantic search across multiple fields in the index](https://discuss.elastic.co/t/semantic-search-across-multiple-fields-in-the-index/370359)
**Author:** [@SunnyMentions](https://discuss.elastic.co/u/SunnyMentions)\ **Replies:** 2\ **Last updated:** [November 13, 2024, 7:16am UTC](https://discuss.elastic.co/t/semantic-search-across-multiple-fields-in-the-index/370359 "2024-11-13T07:16:14Z")
I am reviewing the tutorial here to setup semantic search on my index. The tutorial helps to do this on one field. Lets say i want to do the semantic search across multiple fields, how do I achieve that? For example, I h… --- ## [Logs are coming in event.original but no message field | Elastic Agent](https://discuss.elastic.co/t/logs-are-coming-in-event-original-but-no-message-field-elastic-agent/370389)
**Author:** [@Abhishek\_Singh3](https://discuss.elastic.co/u/Abhishek_Singh3)\ **Replies:** 2\ **Last updated:** [November 13, 2024, 6:37am UTC](https://discuss.elastic.co/t/logs-are-coming-in-event-original-but-no-message-field-elastic-agent/370389 "2024-11-13T06:37:17Z")
I've configured the standalone Elastic Agent on EC2 instances to send logs to Logstash. And it is working fine. But all the logs are coming in event.original field and there is no message or log field. Because of this … --- ## [How to Remove Pending Tasks in Elastic Agent Activity Log?](https://discuss.elastic.co/t/how-to-remove-pending-tasks-in-elastic-agent-activity-log/370456)
**Author:** [@Bikash\_Kunwar](https://discuss.elastic.co/u/Bikash_Kunwar)\ **Replies:** 0\ **Last updated:** [November 13, 2024, 5:42am UTC](https://discuss.elastic.co/t/how-to-remove-pending-tasks-in-elastic-agent-activity-log/370456 "2024-11-13T05:42:18Z")
move the I need help with managing the Elastic Agent activity log. As shown in the attached image, there are multiple pending tasks, such as reassigning agents, that are still marked as "pending." Could someone plea… --- ## [How does the "from" parameter work in a rescore query?](https://discuss.elastic.co/t/how-does-the-from-parameter-work-in-a-rescore-query/370357)
**Author:** [@piyoketa](https://discuss.elastic.co/u/piyoketa)\ **Replies:** 1\ **Last updated:** [November 13, 2024, 4:48am UTC](https://discuss.elastic.co/t/how-does-the-from-parameter-work-in-a-rescore-query/370357 "2024-11-13T04:48:20Z")
I want to do paging in a query with "rescore", but I don't understand the behavior of the "from" parameter. I would like to process the following in this order. Keyword search Sort the top 100 results using embedding S… --- ## [A curator\_cli show-indices KeyError question](https://discuss.elastic.co/t/a-curator-cli-show-indices-keyerror-question/365667)
**Author:** [@bus102](https://discuss.elastic.co/u/bus102)\ **Replies:** 7\ **Last updated:** [November 13, 2024, 3:20am UTC](https://discuss.elastic.co/t/a-curator-cli-show-indices-keyerror-question/365667 "2024-11-13T03:20:26Z")
Hi there, I've installed elasticsearch 8.14.3 on RHEL 8 and am testing elasticsearch-curator 8.0.16. When I try to run the show-indices command I get the following error: \[root@elasticsearch ~\]# /usr/local/bin/curator… --- ## [Problem with updating Filebeat 8.11.4 to 8.13.4 - unwanted retransmision of all files](https://discuss.elastic.co/t/problem-with-updating-filebeat-8-11-4-to-8-13-4-unwanted-retransmision-of-all-files/368615)
**Author:** [@elk1985](https://discuss.elastic.co/u/elk1985)\ **Replies:** 4\ **Last updated:** [November 12, 2024, 10:49pm UTC](https://discuss.elastic.co/t/problem-with-updating-filebeat-8-11-4-to-8-13-4-unwanted-retransmision-of-all-files/368615 "2024-11-12T22:49:25Z")
Hello. I have a problem with updating Filebeat 8.11.4 to 8.13.4 - when I do the upgrade by downloading zip package for Windows, I do just like it is described in documentation: stop filebeat service (old version) down… --- ## [Disk space usage, missing free space](https://discuss.elastic.co/t/disk-space-usage-missing-free-space/370440)
**Author:** [@viniton](https://discuss.elastic.co/u/viniton)\ **Replies:** 0\ **Last updated:** [November 12, 2024, 10:31pm UTC](https://discuss.elastic.co/t/disk-space-usage-missing-free-space/370440 "2024-11-12T22:31:37Z")
Hi, I am using ELK 8.3 , 3 servers. 2 storage servers and one for cluster. Initially I've got one server, when I've run out of free space I've added another one server for storage and third, because you need 3 servers … --- ## [Elastic Version Release Cycle?](https://discuss.elastic.co/t/elastic-version-release-cycle/370429)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 2\ **Last updated:** [November 12, 2024, 9:54pm UTC](https://discuss.elastic.co/t/elastic-version-release-cycle/370429 "2024-11-12T21:54:30Z")
Random question, How often does elastic release a new major version? When is 8.16.0 coming out? What is the release cycle on minor versions? Also when is version 9.0 coming out? --- ## [No\_shard\_available\_action\_exception](https://discuss.elastic.co/t/no-shard-available-action-exception/370412)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 1\ **Last updated:** [November 12, 2024, 9:17pm UTC](https://discuss.elastic.co/t/no-shard-available-action-exception/370412 "2024-11-12T21:17:51Z")
Hello My test server is generating an error which does not allow me to continue with the ingestion, it is a single server, in it is all the ELK solution. initially this is the error message With this I find the … --- ## [Elastic apt repo is broken](https://discuss.elastic.co/t/elastic-apt-repo-is-broken/370435)
**Author:** [@Miles\_Monteleone](https://discuss.elastic.co/u/Miles_Monteleone)\ **Replies:** 2\ **Last updated:** [November 12, 2024, 8:53pm UTC](https://discuss.elastic.co/t/elastic-apt-repo-is-broken/370435 "2024-11-12T20:53:00Z")
We're trying to update apt sources for filebeat and are getting this error: Failed to fetch https://artifacts.elastic.co/packages/8.x/apt/dists/stable/main/binary-amd64/Packages.bz2 File has unexpected size (117811 != … --- ## [User,Roles and Role\_mapping import to new elastic version](https://discuss.elastic.co/t/user-roles-and-role-mapping-import-to-new-elastic-version/370134)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 1\ **Last updated:** [November 12, 2024, 7:42pm UTC](https://discuss.elastic.co/t/user-roles-and-role-mapping-import-to-new-elastic-version/370134 "2024-11-12T19:42:04Z")
I am trying to upgrade elasticsearch 8.8.2 version to 8.14.3 and I would like to know how can I import user, role and role mapping in latest kibana 8.14.3 version from old one. Let me know some way other than snapshot. … --- ## [Same control for two data views](https://discuss.elastic.co/t/same-control-for-two-data-views/370430)
**Author:** [@juandres117](https://discuss.elastic.co/u/juandres117)\ **Replies:** 0\ **Last updated:** [November 12, 2024, 7:03pm UTC](https://discuss.elastic.co/t/same-control-for-two-data-views/370430 "2024-11-12T19:03:46Z")
Hi everyone! I am willing to create a control button like the ones that exist in Kibana but for 2 data views at the same time. For example, I have two different data views with the same variable called categories. I wan… --- ## [Kibana 7.17.25 on new aws r8g family instances](https://discuss.elastic.co/t/kibana-7-17-25-on-new-aws-r8g-family-instances/370382)
**Author:** [@Alisher\_Nabiev](https://discuss.elastic.co/u/Alisher_Nabiev)\ **Replies:** 1\ **Last updated:** [November 12, 2024, 6:53pm UTC](https://discuss.elastic.co/t/kibana-7-17-25-on-new-aws-r8g-family-instances/370382 "2024-11-12T18:53:19Z")
hi all, i am trying to install Kibana 7.17.25 on the r8g.2xlarge instance and I get a "core dump" error. " kibana.service: Start request repeated too quickly. kibana.service: Failed with result 'core-dump'. Failed t… --- ## [How to convert @timestamp value to yyyyMM in logstash pipeline](https://discuss.elastic.co/t/how-to-convert-timestamp-value-to-yyyymm-in-logstash-pipeline/370408)
**Author:** [@zadkiel\_meta](https://discuss.elastic.co/u/zadkiel_meta)\ **Replies:** 1\ **Last updated:** [November 12, 2024, 3:39pm UTC](https://discuss.elastic.co/t/how-to-convert-timestamp-value-to-yyyymm-in-logstash-pipeline/370408 "2024-11-12T15:39:17Z")
I am very new joiner in logstash pipeline: I want to indexed @timestamp value format as yyyyMM, example "202411" Incomming BillingMonth value ="202411" Logstash Pipeline: filter { event.set("@timestamp", event.get("… --- ## [Logstash errors with writing plugins](https://discuss.elastic.co/t/logstash-errors-with-writing-plugins/370414)
**Author:** [@DOkuwa](https://discuss.elastic.co/u/DOkuwa)\ **Replies:** 0\ **Last updated:** [November 12, 2024, 3:25pm UTC](https://discuss.elastic.co/t/logstash-errors-with-writing-plugins/370414 "2024-11-12T15:25:53Z")
I am creating a logstash plugins while running bundle exec rspec command Failure/Error: raise LogStash::ConfigurationError, I18n.t("logstash.runner.configuration.invalid\_plugin\_settings") LogS… --- ## [Logstash : Invalid FieldReference: \`${http.headers\[\\"User-Agent\\"\]}\`"](https://discuss.elastic.co/t/logstash-invalid-fieldreference-http-headers-user-agent/370403)
**Author:** [@rehanpfmr](https://discuss.elastic.co/u/rehanpfmr)\ **Replies:** 1\ **Last updated:** [November 12, 2024, 3:23pm UTC](https://discuss.elastic.co/t/logstash-invalid-fieldreference-http-headers-user-agent/370403 "2024-11-12T15:23:21Z")
I'm having difficulty in parsing json object, the json field name is having special characters in it and logstash is showing error as JSON parse error, original data now in message field. ERROR message: JSON parse erro… --- ## [Deadlock in Bulk Ingester using Elastic 8.15.3 in Java](https://discuss.elastic.co/t/deadlock-in-bulk-ingester-using-elastic-8-15-3-in-java/370398)
**Author:** [@Daniel\_Abadi](https://discuss.elastic.co/u/Daniel_Abadi)\ **Replies:** 3\ **Last updated:** [November 12, 2024, 3:22pm UTC](https://discuss.elastic.co/t/deadlock-in-bulk-ingester-using-elastic-8-15-3-in-java/370398 "2024-11-12T15:22:57Z")
Hello, I'm experiencing a deadlock while using the bulk ingester, specifically during the flush operation. Several threads are blocked, each waiting with the following stack trace: java.base/jdk.internal.misc.Unsafe.pa… --- ## [How can i control the structure of Elastic.CommonSchema.NLog](https://discuss.elastic.co/t/how-can-i-control-the-structure-of-elastic-commonschema-nlog/370411)
**Author:** [@Habib\_Khan](https://discuss.elastic.co/u/Habib_Khan)\ **Replies:** 0\ **Last updated:** [November 12, 2024, 2:50pm UTC](https://discuss.elastic.co/t/how-can-i-control-the-structure-of-elastic-commonschema-nlog/370411 "2024-11-12T14:50:05Z")
I have follow xml file \ \ **Author:** [@nikita1234.z.z.z.z](https://discuss.elastic.co/u/nikita1234.z.z.z.z)\ **Replies:** 5\ **Last updated:** [November 12, 2024, 7:57am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/370329 "2024-11-12T07:57:49Z") Good afternoon! Has anyone come across this issue? When xpack is enabled, I get an error, but with xpack disabled, I can use the console without any problems. The certificates are valid, and the login credentials for kib… --- ## [Control Sequence of logstash pipelines](https://discuss.elastic.co/t/control-sequence-of-logstash-pipelines/370318)
**Author:** [@vvavad](https://discuss.elastic.co/u/vvavad)\ **Replies:** 3\ **Last updated:** [November 12, 2024, 12:56pm UTC](https://discuss.elastic.co/t/control-sequence-of-logstash-pipelines/370318 "2024-11-12T12:56:53Z")
I want to write logstash pipelines to process csv files and intermediate Elasticsearch index. Below I have explained exact use case: pipeline 1 starts automatically when a file is detected in specified folder. It shoul… --- ## [Filter ssh events](https://discuss.elastic.co/t/filter-ssh-events/370340)
**Author:** [@mariano\_kabakian](https://discuss.elastic.co/u/mariano_kabakian)\ **Replies:** 2\ **Last updated:** [November 12, 2024, 11:02am UTC](https://discuss.elastic.co/t/filter-ssh-events/370340 "2024-11-12T11:02:49Z")
hi ELK gurus, hope you are having a good day. I'm running ELK inside docker. It's working fine, but I'm having an issue. I have a server that send events using filebeat. The thing is I cannot auth events to create a dash… --- ## [Metricbeat for monitoring Openshift Horizontal Pod Autoscaler](https://discuss.elastic.co/t/metricbeat-for-monitoring-openshift-horizontal-pod-autoscaler/369507)
**Author:** [@fathuriszuldi](https://discuss.elastic.co/u/fathuriszuldi)\ **Replies:** 1\ **Last updated:** [November 12, 2024, 8:43am UTC](https://discuss.elastic.co/t/metricbeat-for-monitoring-openshift-horizontal-pod-autoscaler/369507 "2024-11-12T08:43:07Z")
Hi, i wanted to know if there is a actually a support for monitoring Openshift HPA workload. Due to client request, i need to monitor the HPA workload on the cluster. My Metricbeat collect data from kube-state-metrics i… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=137) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=139)