# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1411 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1412 --- ## [Watcher alerts null pointer error](https://discuss.elastic.co/t/watcher-alerts-null-pointer-error/273268)
**Author:** [@Roy\_Levy](https://discuss.elastic.co/u/Roy_Levy)\ **Replies:** 2\ **Last updated:** [May 18, 2021, 11:17am UTC](https://discuss.elastic.co/t/watcher-alerts-null-pointer-error/273268 "2021-05-18T11:17:55Z")
Hey, I'm trying to get Kibana Watcher alerts to insert documents to new index. When simulating the script I'm getting the following error: The error seems to be with the aggregations field - null pointer. But I did… --- ## [Local install with ansible role](https://discuss.elastic.co/t/local-install-with-ansible-role/273274)
**Author:** [@uysalnet\_io](https://discuss.elastic.co/u/uysalnet_io)\ **Replies:** 0\ **Last updated:** [May 18, 2021, 11:47am UTC](https://discuss.elastic.co/t/local-install-with-ansible-role/273274 "2021-05-18T11:47:06Z")
Hi, I am using official ansible role to deploy cluster but I didn't understand if this role supports local installation of elasticsearch packages. By default this role using official elasticsearch repos to download pack… --- ## [Error xpack monitoring elasticsearch password hasn't been registered and elastalert-kibana-plugin.serverHost and serverPort" settings were not applied](https://discuss.elastic.co/t/error-xpack-monitoring-elasticsearch-password-hasnt-been-registered-and-elastalert-kibana-plugin-serverhost-and-serverport-settings-were-not-applied/273214)
**Author:** [@MdRashid](https://discuss.elastic.co/u/MdRashid)\ **Replies:** 2\ **Last updated:** [May 18, 2021, 11:38am UTC](https://discuss.elastic.co/t/error-xpack-monitoring-elasticsearch-password-hasnt-been-registered-and-elastalert-kibana-plugin-serverhost-and-serverport-settings-were-not-applied/273214 "2021-05-18T11:38:59Z")
Hi All, I have all the yaml file and config file with me but i want to deploy through docker stack like docker stack deploy -c docker-compose.yaml test After deploy only elasticsearch container is working and logstash… --- ## [Logstash Syslog input plugin | @timestamp issue](https://discuss.elastic.co/t/logstash-syslog-input-plugin-timestamp-issue/273244)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 1\ **Last updated:** [May 18, 2021, 11:04am UTC](https://discuss.elastic.co/t/logstash-syslog-input-plugin-timestamp-issue/273244 "2021-05-18T11:04:13Z")
Hi, I faced a brick wall and I seem to not be able to overcome it. My scenario FW logs coming to a server where they are caught by Syslog-ng Syslog-ng passes the logs to Logstash on the same server Currently, as a test… --- ## [Elastic search duplicate document with same Id and different routing](https://discuss.elastic.co/t/elastic-search-duplicate-document-with-same-id-and-different-routing/273242)
**Author:** [@Mohanapriya\_Gopal1](https://discuss.elastic.co/u/Mohanapriya_Gopal1)\ **Replies:** 2\ **Last updated:** [May 18, 2021, 10:39am UTC](https://discuss.elastic.co/t/elastic-search-duplicate-document-with-same-id-and-different-routing/273242 "2021-05-18T10:39:55Z")
While indexing using logstash from db to elastic, we got duplicate documents with same Id and different routing.how canwe fix this --- ## [Kibana Watcher action failed: specified foreach object was null](https://discuss.elastic.co/t/kibana-watcher-action-failed-specified-foreach-object-was-null/272817)
**Author:** [@pavank](https://discuss.elastic.co/u/pavank)\ **Replies:** 4\ **Last updated:** [May 18, 2021, 10:35am UTC](https://discuss.elastic.co/t/kibana-watcher-action-failed-specified-foreach-object-was-null/272817 "2021-05-18T10:35:27Z")
I'm using ELK 7.9. I have configured Watchers to trigger Webhook action. I'm trying to add a foreach function to trigger webhooks for each recorded application errors. I'm getting error when trying to execute. Watcher … --- ## [Influence of Master Nodes and Large Cluster State on Search](https://discuss.elastic.co/t/influence-of-master-nodes-and-large-cluster-state-on-search/273103)
**Author:** [@itays](https://discuss.elastic.co/u/itays)\ **Replies:** 7\ **Last updated:** [May 18, 2021, 10:35am UTC](https://discuss.elastic.co/t/influence-of-master-nodes-and-large-cluster-state-on-search/273103 "2021-05-18T10:35:06Z")
Hey, We are running in production an elasticsearch cluster. The setup is: 10 data nodes - 8 cpus and 64G ram, half is heap 3 master nodes - 4 cpus and 16g ram, half is heap In our cluster we have large number of indi… --- ## [Invalid NEST response built from a successful (200) low level call on PUT](https://discuss.elastic.co/t/invalid-nest-response-built-from-a-successful-200-low-level-call-on-put/273266)
**Author:** [@niaz](https://discuss.elastic.co/u/niaz)\ **Replies:** 0\ **Last updated:** [May 18, 2021, 10:13am UTC](https://discuss.elastic.co/t/invalid-nest-response-built-from-a-successful-200-low-level-call-on-put/273266 "2021-05-18T10:13:49Z")
I am running with elasticsearch 7.12.1 on Ubuntu 20.04.2 LTS. Only elasticsearch is running on port 9200. Kibana is also installed on the same VM, port 5601 but its service is currently stopped. I am using NEST to conn… --- ## [Want to create an index already present in index management using API](https://discuss.elastic.co/t/want-to-create-an-index-already-present-in-index-management-using-api/273212)
**Author:** [@Changra](https://discuss.elastic.co/u/Changra)\ **Replies:** 3\ **Last updated:** [May 18, 2021, 10:03am UTC](https://discuss.elastic.co/t/want-to-create-an-index-already-present-in-index-management-using-api/273212 "2021-05-18T10:03:11Z")
Hi Team, I am trying to create index which is already present in the index management using API . But I am unable to execute any API . Please Help me with it. --- ## [Elastic Agent removes all metricbeat unix-sock endpoint when any metricbeat is killed](https://discuss.elastic.co/t/elastic-agent-removes-all-metricbeat-unix-sock-endpoint-when-any-metricbeat-is-killed/271581)
**Author:** [@buptubuntu](https://discuss.elastic.co/u/buptubuntu)\ **Replies:** 1\ **Last updated:** [May 18, 2021, 9:58am UTC](https://discuss.elastic.co/t/elastic-agent-removes-all-metricbeat-unix-sock-endpoint-when-any-metricbeat-is-killed/271581 "2021-05-18T09:58:16Z")
Hi, all We try to use elastic agent to manage beats, and configured agent.monitoring to use a sidecar metricbeat to monitor the managed beats，after all the beats are started，if we kill the sidecar metricbeat process，the… --- ## [Split data into into two sets (test/train)](https://discuss.elastic.co/t/split-data-into-into-two-sets-test-train/273236)
**Author:** [@eliase](https://discuss.elastic.co/u/eliase)\ **Replies:** 3\ **Last updated:** [May 18, 2021, 9:01am UTC](https://discuss.elastic.co/t/split-data-into-into-two-sets-test-train/273236 "2021-05-18T09:01:49Z")
Hi, for machine learning validation I would like to split the data in elastic search into two sets. The random score in combination with the size parameter would give me one set but how can I obtain all other documents… --- ## [Geo\_point automatically](https://discuss.elastic.co/t/geo-point-automatically/273183)
**Author:** [@Emi\_lie](https://discuss.elastic.co/u/Emi_lie)\ **Replies:** 4\ **Last updated:** [May 18, 2021, 8:40am UTC](https://discuss.elastic.co/t/geo-point-automatically/273183 "2021-05-18T08:40:00Z")
Hello, I struggle to add the geo\_point to my index, automatically. All the solutions I found, official and unofficial, indicate that it is necessary to pass by the devTools to make a PUT of the index. But I use elastic… --- ## [Missing Textfield, when creating a Visulization with Lens](https://discuss.elastic.co/t/missing-textfield-when-creating-a-visulization-with-lens/273124)
**Author:** [@BoKu](https://discuss.elastic.co/u/BoKu)\ **Replies:** 3\ **Last updated:** [May 18, 2021, 8:17am UTC](https://discuss.elastic.co/t/missing-textfield-when-creating-a-visulization-with-lens/273124 "2021-05-18T08:17:51Z")
Hello and good morning, since the last update to 7.12.1, Lens replaced the "normal" Visulizations. I have an index (oracle alert logs) which has an message field as text, but it is missing the keyword. Even creating a n… --- ## [Failed to parse date field](https://discuss.elastic.co/t/failed-to-parse-date-field/272657)
**Author:** [@KarlWolf](https://discuss.elastic.co/u/KarlWolf)\ **Replies:** 4\ **Last updated:** [May 18, 2021, 6:09am UTC](https://discuss.elastic.co/t/failed-to-parse-date-field/272657 "2021-05-18T06:09:10Z")
Hello, I'm new in topic ELK stuff and I try to solve my problem with date parsing. I have two fields with date and time stamp which I connected together. Then I want mark that pool as Date and send to Elastic: My Log l… --- ## [Can we connect one Logstash node with Both Licensed & Open source elastic stack?](https://discuss.elastic.co/t/can-we-connect-one-logstash-node-with-both-licensed-open-source-elastic-stack/273162)
**Author:** [@muralikrishna](https://discuss.elastic.co/u/muralikrishna)\ **Replies:** 2\ **Last updated:** [May 18, 2021, 2:51am UTC](https://discuss.elastic.co/t/can-we-connect-one-logstash-node-with-both-licensed-open-source-elastic-stack/273162 "2021-05-18T02:51:51Z")
Hi All, I would like to understand, If we can connect one Logstash node with Both Licensed & Open source elasticsearch nodes at a time ? currently we are using licensed elasticsearch for centralized pipelined managemen… --- ## [Updating OS packages when using ansible role](https://discuss.elastic.co/t/updating-os-packages-when-using-ansible-role/273213)
**Author:** [@biggtimber](https://discuss.elastic.co/u/biggtimber)\ **Replies:** 2\ **Last updated:** [May 18, 2021, 1:53am UTC](https://discuss.elastic.co/t/updating-os-packages-when-using-ansible-role/273213 "2021-05-18T01:53:09Z")
How is it recommended to run OS updates on the ES nodes that are maintained by the ansible role. Should the ES and Java packages be version locked, and will that effect upgrading the nodes later? --- ## [Error retrieving logs when using Defender ATP (under Microsoft Module)](https://discuss.elastic.co/t/error-retrieving-logs-when-using-defender-atp-under-microsoft-module/273225)
**Author:** [@ismyhairnice](https://discuss.elastic.co/u/ismyhairnice)\ **Replies:** 0\ **Last updated:** [May 18, 2021, 1:06am UTC](https://discuss.elastic.co/t/error-retrieving-logs-when-using-defender-atp-under-microsoft-module/273225 "2021-05-18T01:06:16Z")
Hi all I am trying to retrieve some Defender ATP logs from Azure using Microsoft Module and encountered error. Current Filebeat version is 7.12. 2021-05-10T13:01:17.495+0800 ERROR \[input.httpjson-cursor\] v2/reques… --- ## [Easiest Way To Install Elastic... apt-get install or wget](https://discuss.elastic.co/t/easiest-way-to-install-elastic-apt-get-install-or-wget/272879)
**Author:** [@cis4life](https://discuss.elastic.co/u/cis4life)\ **Replies:** 13\ **Last updated:** [May 18, 2021, 12:13am UTC](https://discuss.elastic.co/t/easiest-way-to-install-elastic-apt-get-install-or-wget/272879 "2021-05-18T00:13:16Z")
Good Day, In your opinion, what is the easiest way to get Elasticsearch 6.18.5 onto Ubuntu 18.04 servers. I'm looking at this ES guide here... Install Elasticsearch with Debian Package | Elasticsearch Guide \[6.8\] | Ela… --- ## [How to avoid jvm error in python elasticsearch rest client](https://discuss.elastic.co/t/how-to-avoid-jvm-error-in-python-elasticsearch-rest-client/273161)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 5\ **Last updated:** [May 17, 2021, 11:13pm UTC](https://discuss.elastic.co/t/how-to-avoid-jvm-error-in-python-elasticsearch-rest-client/273161 "2021-05-17T23:13:28Z")
I have 10 elasticsearch nodes in one server(cluster), all nodes have 2gb jvm heap size. I have a python rest client for elasticsearch. With that client I fetch datas from elasticsearch and re-indexing with new datas. I… --- ## [Possible to only find new entries since last search?](https://discuss.elastic.co/t/possible-to-only-find-new-entries-since-last-search/273173)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 1\ **Last updated:** [May 17, 2021, 11:12pm UTC](https://discuss.elastic.co/t/possible-to-only-find-new-entries-since-last-search/273173 "2021-05-17T23:12:11Z")
Dear all =) Does anyone know if it is possible to make a query that searched for error\_event:1 and the next time I run it, it only shows the new entries since last search? Hugs, Sandra =) --- ## [Create daily index with ILM](https://discuss.elastic.co/t/create-daily-index-with-ilm/273199)
**Author:** [@Matteo\_Rainieri](https://discuss.elastic.co/u/Matteo_Rainieri)\ **Replies:** 1\ **Last updated:** [May 17, 2021, 10:59pm UTC](https://discuss.elastic.co/t/create-daily-index-with-ilm/273199 "2021-05-17T22:59:21Z")
Hello there. I got a simple question: When i'm using filebeat, i would like to create a daily index and use index lifecycle policies. Im currently using ilm with this settings in filebeat.yml: setup.ilm.enabled: auto… --- ## [Combine daily indices into monthly with ILM](https://discuss.elastic.co/t/combine-daily-indices-into-monthly-with-ilm/273185)
**Author:** [@vkatsikaros](https://discuss.elastic.co/u/vkatsikaros)\ **Replies:** 2\ **Last updated:** [May 17, 2021, 10:58pm UTC](https://discuss.elastic.co/t/combine-daily-indices-into-monthly-with-ilm/273185 "2021-05-17T22:58:22Z")
Hi I would like to combine daily indices into monthly. I'd like to ask if this can be performed with Index Lifecycle Management in 7.12. There are reindex related questions, but should be old to include an ILM solution: … --- ## [Endpoint inconsistency in different regions of Elastic Cloud](https://discuss.elastic.co/t/endpoint-inconsistency-in-different-regions-of-elastic-cloud/273202)
**Author:** [@Mkian](https://discuss.elastic.co/u/Mkian)\ **Replies:** 4\ **Last updated:** [May 17, 2021, 9:58pm UTC](https://discuss.elastic.co/t/endpoint-inconsistency-in-different-regions-of-elastic-cloud/273202 "2021-05-17T21:58:43Z")
In Elastic Cloud a custom endpoint alias is recently added which is good and it helps in some automations BUT I see an inconsistency in different regions when I get the endpoints which makes the automation unnecessarily … --- ## [Kql wildcard doesn't seem to work](https://discuss.elastic.co/t/kql-wildcard-doesnt-seem-to-work/273216)
**Author:** [@k1ng87](https://discuss.elastic.co/u/k1ng87)\ **Replies:** 1\ **Last updated:** [May 17, 2021, 9:06pm UTC](https://discuss.elastic.co/t/kql-wildcard-doesnt-seem-to-work/273216 "2021-05-17T21:06:22Z")
I'm trying to use a wildcard for the message field but it doesn't seem to work. I'm trying to look for anything that starts with async and filter them out. In the message field, it can look like this: async.channel.pool… --- ## [Search plugin with custom query getting IllegalAccessError](https://discuss.elastic.co/t/search-plugin-with-custom-query-getting-illegalaccesserror/273221)
**Author:** [@elelliot](https://discuss.elastic.co/u/elelliot)\ **Replies:** 0\ **Last updated:** [May 17, 2021, 8:55pm UTC](https://discuss.elastic.co/t/search-plugin-with-custom-query-getting-illegalaccesserror/273221 "2021-05-17T20:55:00Z")
I'm having an issue with installing a custom query in my elasticsearch plugin. For my use case, I have a custom query PayloadPhraseQuery that uses many of the other existing Lucene phrase query code. However when I run … --- ## [Logstash install and startup error](https://discuss.elastic.co/t/logstash-install-and-startup-error/273208)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 7\ **Last updated:** [May 17, 2021, 7:46pm UTC](https://discuss.elastic.co/t/logstash-install-and-startup-error/273208 "2021-05-17T19:46:19Z")
Good Afternoon; I am new to the ELK tools and am in the midst of a proof of concept using them. I am testing on a Windows 10 Professional box and have been able to install and get running both ElasticSearch and Kibana… --- ## [Analyzing profiling results](https://discuss.elastic.co/t/analyzing-profiling-results/273071)
**Author:** [@alexs1](https://discuss.elastic.co/u/alexs1)\ **Replies:** 4\ **Last updated:** [May 17, 2021, 4:51pm UTC](https://discuss.elastic.co/t/analyzing-profiling-results/273071 "2021-05-17T16:51:26Z")
Hello, I'm migrating a cluster from an old one, and for some reason, after reindexing by best practices (than I know), performance are slower in the new cluster. the first has 500GB- 5 shards and 1 replica the new clu… --- ## [Mapping Winlogbeat old version to newest ECS](https://discuss.elastic.co/t/mapping-winlogbeat-old-version-to-newest-ecs/272625)
**Author:** [@Kambing](https://discuss.elastic.co/u/Kambing)\ **Replies:** 2\ **Last updated:** [May 17, 2021, 7:32pm UTC](https://discuss.elastic.co/t/mapping-winlogbeat-old-version-to-newest-ecs/272625 "2021-05-17T19:32:34Z")
Hi, I have hundreds windows server in production with variety of windows version from windows server 2003 to the windows server 2019 I had tried to install winlogbeat 7.12.1 for windows server 2003 but there's always an… --- ## [How do I disable enterprise search in Kibana 7.10.2?](https://discuss.elastic.co/t/how-do-i-disable-enterprise-search-in-kibana-7-10-2/273147)
**Author:** [@ravi\_yadav2](https://discuss.elastic.co/u/ravi_yadav2)\ **Replies:** 2\ **Last updated:** [May 17, 2021, 5:44pm UTC](https://discuss.elastic.co/t/how-do-i-disable-enterprise-search-in-kibana-7-10-2/273147 "2021-05-17T17:44:49Z")
Are there configuration settings for kibana.yml that we can use to disable this feature? If Not how can I disable it? --- ## [Log4j socket appender - filebeat](https://discuss.elastic.co/t/log4j-socket-appender-filebeat/273205)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 0\ **Last updated:** [May 17, 2021, 5:25pm UTC](https://discuss.elastic.co/t/log4j-socket-appender-filebeat/273205 "2021-05-17T17:25:05Z")
Hello there, I want to use filebeat to collect log4j logs and send directly to Elasticsearch. I tried to find some relevant information but mostly it is about Logstash. can anyone please give me more information on thi… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1410) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1412)