# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=163 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 164 --- ## [Filebeat Fails to Process Symlinked Log Files Despite Symlink Configuration Enabled](https://discuss.elastic.co/t/filebeat-fails-to-process-symlinked-log-files-despite-symlink-configuration-enabled/367159)
**Author:** [@bhautik](https://discuss.elastic.co/u/bhautik)\ **Replies:** 1\ **Last updated:** [September 26, 2024, 1:01pm UTC](https://discuss.elastic.co/t/filebeat-fails-to-process-symlinked-log-files-despite-symlink-configuration-enabled/367159 "2024-09-26T13:01:18Z")
I am encountering an issue with Filebeat where it fails to process symlinked log files, even though I have configured the symlink handling to be enabled. Below are the details of my configuration and the error messages I… --- ## [Canvas joining data from two different index/data view into one to show in dropdown](https://discuss.elastic.co/t/canvas-joining-data-from-two-different-index-data-view-into-one-to-show-in-dropdown/367171)
**Author:** [@aman\_kumar4](https://discuss.elastic.co/u/aman_kumar4)\ **Replies:** 1\ **Last updated:** [September 26, 2024, 12:50pm UTC](https://discuss.elastic.co/t/canvas-joining-data-from-two-different-index-data-view-into-one-to-show-in-dropdown/367171 "2024-09-26T12:50:01Z")
I want to join fields from two indexes/data views into one to show them in canvas dropdown, or want essql version of below sql code SELECT "client\_id" AS id FROM "client\_data\*" UNION SELECT "identifient\_id" AS id FR… --- ## [Reshuffling of columns is not resolved as per the ticket #164413](https://discuss.elastic.co/t/reshuffling-of-columns-is-not-resolved-as-per-the-ticket-164413/366977)
**Author:** [@Arshukla](https://discuss.elastic.co/u/Arshukla)\ **Replies:** 3\ **Last updated:** [September 26, 2024, 12:12pm UTC](https://discuss.elastic.co/t/reshuffling-of-columns-is-not-resolved-as-per-the-ticket-164413/366977 "2024-09-26T12:12:39Z")
Hello Team, As per the below two pull and github the issue is marked resolved. However when I checked the same in v8.14 of Kibana. the issue is still there... Can you please explain what needs to be done, to avoid colum… --- ## [Help with Converting Kibana Query to .NET Elastic Client Code](https://discuss.elastic.co/t/help-with-converting-kibana-query-to-net-elastic-client-code/367163)
**Author:** [@K\_Rohit](https://discuss.elastic.co/u/K_Rohit)\ **Replies:** 1\ **Last updated:** [September 26, 2024, 9:21am UTC](https://discuss.elastic.co/t/help-with-converting-kibana-query-to-net-elastic-client-code/367163 "2024-09-26T09:21:37Z")
I'm currently working on an Elasticsearch query in Kibana, and I need help converting it to .NET Elastic client code. Below is my Kibana query and the partial .NET code I've written so far. I'm using Elasticsearch versio… --- ## [Logstash helm chart for copying data from elasticsearch to opensearch](https://discuss.elastic.co/t/logstash-helm-chart-for-copying-data-from-elasticsearch-to-opensearch/367143)
**Author:** [@Deepa\_Karthika](https://discuss.elastic.co/u/Deepa_Karthika)\ **Replies:** 3\ **Last updated:** [September 26, 2024, 8:49am UTC](https://discuss.elastic.co/t/logstash-helm-chart-for-copying-data-from-elasticsearch-to-opensearch/367143 "2024-09-26T08:49:07Z")
0 We were using ELK cluster for observability log monitoring in our current project and now we are moving that to opensearch tool. So we need to copy data from current ECK cluster( indices data ) to Opensearch indices. … --- ## [Kibana pivot table with expandable rows](https://discuss.elastic.co/t/kibana-pivot-table-with-expandable-rows/359345)
**Author:** [@Stefano\_Sorgente](https://discuss.elastic.co/u/Stefano_Sorgente)\ **Replies:** 2\ **Last updated:** [September 26, 2024, 8:48am UTC](https://discuss.elastic.co/t/kibana-pivot-table-with-expandable-rows/359345 "2024-09-26T08:48:07Z")
Hello, I'm using Kibana and the enhanced table plugin but I'm not able to get what I want from it. I upload this screen to help me explain. I would love to get something similar, with all the data aggregated. For exa… --- ## [Add status field for kibana alerts in elastic index](https://discuss.elastic.co/t/add-status-field-for-kibana-alerts-in-elastic-index/367155)
**Author:** [@Tural\_Mirzayev](https://discuss.elastic.co/u/Tural_Mirzayev)\ **Replies:** 0\ **Last updated:** [September 26, 2024, 7:19am UTC](https://discuss.elastic.co/t/add-status-field-for-kibana-alerts-in-elastic-index/367155 "2024-09-26T07:19:20Z")
Hello, i want to send kibana alerts to the index in elasticsearch. For this purpose i created rule and select index type connector. But i need also alerts status,but when i tried some variables for visible alerts status… --- ## [Elasticsearch binaries and images be coverd by the AGPL license?](https://discuss.elastic.co/t/elasticsearch-binaries-and-images-be-coverd-by-the-agpl-license/367084)
**Author:** [@dikesGearing](https://discuss.elastic.co/u/dikesGearing)\ **Replies:** 4\ **Last updated:** [September 26, 2024, 7:06am UTC](https://discuss.elastic.co/t/elasticsearch-binaries-and-images-be-coverd-by-the-agpl-license/367084 "2024-09-26T07:06:56Z")
If I use the prebuilt binaries or docker image distributed by the elastic team will those also be covered by the AGPL license or do I need to build the binary/image from source? --- ## [Poor performance - SQS / S3](https://discuss.elastic.co/t/poor-performance-sqs-s3/367111)
**Author:** [@ps-e](https://discuss.elastic.co/u/ps-e)\ **Replies:** 6\ **Last updated:** [September 26, 2024, 7:02am UTC](https://discuss.elastic.co/t/poor-performance-sqs-s3/367111 "2024-09-26T07:02:58Z")
I'm using elastic agents on k8s - managed with elastic operator. I have very poor performance for ingesting flow logs via SQS from S3. In the debug logs for elastic agent I can see a lot of logs like this: \[elastic\_ag… --- ## [Repository verification of s3 failing with IRSA](https://discuss.elastic.co/t/repository-verification-of-s3-failing-with-irsa/367122)
**Author:** [@Dharani1](https://discuss.elastic.co/u/Dharani1)\ **Replies:** 0\ **Last updated:** [September 25, 2024, 5:55pm UTC](https://discuss.elastic.co/t/repository-verification-of-s3-failing-with-irsa/367122 "2024-09-25T17:55:18Z")
inital connection with IRSA following the documentation worked. Later the connection is failing and the authentication is falling back to default method rather than IRSA and hence failing. Restarting all the ES nodes is… --- ## [Calculate Daily Log Ingestion](https://discuss.elastic.co/t/calculate-daily-log-ingestion/367148)
**Author:** [@amalkrish](https://discuss.elastic.co/u/amalkrish)\ **Replies:** 0\ **Last updated:** [September 26, 2024, 4:51am UTC](https://discuss.elastic.co/t/calculate-daily-log-ingestion/367148 "2024-09-26T04:51:29Z")
Hi Team, I am currently working on calculating the daily ingested data into hot storage and displaying it on the dashboard. While we have successfully captured the storage variations in hot storage, we're encountering a… --- ## [Increased speed elasticsearch](https://discuss.elastic.co/t/increased-speed-elasticsearch/367112)
**Author:** [@dsagent](https://discuss.elastic.co/u/dsagent)\ **Replies:** 6\ **Last updated:** [September 26, 2024, 3:30am UTC](https://discuss.elastic.co/t/increased-speed-elasticsearch/367112 "2024-09-26T03:30:21Z")
Hello I have an ubuntu environment in which there is a 100G SSD and another hard disk size of 3 TB HDD in the 100 GB hard drive in which the system is installed and elasicsearch, but the data path refers to the 3 TB har… --- ## [How can i get the interval and used it into formula](https://discuss.elastic.co/t/how-can-i-get-the-interval-and-used-it-into-formula/367141)
**Author:** [@dreamage](https://discuss.elastic.co/u/dreamage)\ **Replies:** 2\ **Last updated:** [September 26, 2024, 1:51am UTC](https://discuss.elastic.co/t/how-can-i-get-the-interval-and-used-it-into-formula/367141 "2024-09-26T01:51:53Z")
Hello, I set a Customize time interval 1min in x axis，but when i select a long time range such as 10 hours, the x axis per value change to 5 mins. i get a wrong y axis value. how can i get the interval and used it into f… --- ## [Crowdstrike API Integration](https://discuss.elastic.co/t/crowdstrike-api-integration/367132)
**Author:** [@wesleyj-hub](https://discuss.elastic.co/u/wesleyj-hub)\ **Replies:** 0\ **Last updated:** [September 25, 2024, 8:22pm UTC](https://discuss.elastic.co/t/crowdstrike-api-integration/367132 "2024-09-25T20:22:26Z")
I am having an issue with getting the API instance set up to connect Crowdstrike. Crowdstrike seems to need a POST request in order to pull the token, but it doesn't appear to be a way to add that if it is needed. After … --- ## [Getting no overload matches this call in bool query](https://discuss.elastic.co/t/getting-no-overload-matches-this-call-in-bool-query/367129)
**Author:** [@Aniket\_Kumar\_Singh](https://discuss.elastic.co/u/Aniket_Kumar_Singh)\ **Replies:** 0\ **Last updated:** [September 25, 2024, 7:22pm UTC](https://discuss.elastic.co/t/getting-no-overload-matches-this-call-in-bool-query/367129 "2024-09-25T19:22:16Z")
I am getting this no overload matches error in bool query . For single term it works fine: const searchResult = await client.search({ index: 'articles', body: { query: { terms: { articleId: articleIds // Using te… --- ## [Summarizing html content in search results](https://discuss.elastic.co/t/summarizing-html-content-in-search-results/366880)
**Author:** [@Hiru\_Fernando](https://discuss.elastic.co/u/Hiru_Fernando)\ **Replies:** 3\ **Last updated:** [September 25, 2024, 6:01pm UTC](https://discuss.elastic.co/t/summarizing-html-content-in-search-results/366880 "2024-09-25T18:01:51Z")
Hello team, We have created an instance of Elasticsearch and have created an index configuration that will return the fields we need on search. However, one feature we want is a summary of the html content so we can di… --- ## [Must specify numberOfShards for index](https://discuss.elastic.co/t/must-specify-numberofshards-for-index/367120)
**Author:** [@Chris\_Weinhaupl](https://discuss.elastic.co/u/Chris_Weinhaupl)\ **Replies:** 0\ **Last updated:** [September 25, 2024, 5:07pm UTC](https://discuss.elastic.co/t/must-specify-numberofshards-for-index/367120 "2024-09-25T17:07:01Z")
I would like to set the number of shards for the index in the elasticsearch.yml file to prevent these events in the logs. What would be appropriate to put in the yml file? Thank you Ref event: \[2024-08-28 07:56:48,99… --- ## [Java es 8+ client tasks api](https://discuss.elastic.co/t/java-es-8-client-tasks-api/366996)
**Author:** [@mreeew](https://discuss.elastic.co/u/mreeew)\ **Replies:** 1\ **Last updated:** [September 25, 2024, 4:20pm UTC](https://discuss.elastic.co/t/java-es-8-client-tasks-api/366996 "2024-09-25T16:20:30Z")
How to use tasks api in 8+ client in java? I've seen ElasticSearchTasks client which provides functionality to list/cancel/get tasks. But how to send a task? Previously we could just use submitUpdateByQueryTask method … --- ## [Kibana' Short URLs](https://discuss.elastic.co/t/kibana-short-urls/367117)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 0\ **Last updated:** [September 25, 2024, 4:18pm UTC](https://discuss.elastic.co/t/kibana-short-urls/367117 "2024-09-25T16:18:30Z")
hello world :wink: let me backup a bit and start from the beginning ... it all started when we saw this msg: {"type":"log","@timestamp":"2024-09-24T16:09:22+00:00","tags":\["error","savedobjects-service"\],"pid":7,"mess… --- ## [MS Exchange integration](https://discuss.elastic.co/t/ms-exchange-integration/367113)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 0\ **Last updated:** [September 25, 2024, 3:03pm UTC](https://discuss.elastic.co/t/ms-exchange-integration/367113 "2024-09-25T15:03:59Z")
I'm looking at the Exchange integration to replace what what we developed locally. We are gathering more logs than the new integration gathers, but I'm not an Exchange SME, so I don't know what the SME's will miss. Log… --- ## [Stemming with german2 on hyphenated compound words](https://discuss.elastic.co/t/stemming-with-german2-on-hyphenated-compound-words/367019)
**Author:** [@simon137](https://discuss.elastic.co/u/simon137)\ **Replies:** 2\ **Last updated:** [September 25, 2024, 2:03pm UTC](https://discuss.elastic.co/t/stemming-with-german2-on-hyphenated-compound-words/367019 "2024-09-25T14:03:14Z")
Hello, I have a problem using the german2 stemmer on hyphenated compound words with Elasticsearch. As an example I have 2 words: "Export-Schnittstelle" and "Schnittstelle", for these words the stemmer creates "Export-S… --- ## [Cassandra jdbc drive issue with logstash in docker](https://discuss.elastic.co/t/cassandra-jdbc-drive-issue-with-logstash-in-docker/367105)
**Author:** [@AmritMatti](https://discuss.elastic.co/u/AmritMatti)\ **Replies:** 2\ **Last updated:** [September 25, 2024, 1:33pm UTC](https://discuss.elastic.co/t/cassandra-jdbc-drive-issue-with-logstash-in-docker/367105 "2024-09-25T13:33:13Z")
Hi, I am running logsstash, elasticsearch, kibana in docker 8.15.0 and cassandra 5.0. I want to setup logstash input from cassandra with jdbc. I have downloaded jdbc drivers from Cassandra JDBC Driver Download & Connec… --- ## [How to create a search request with multiple knn fields using the Node Client](https://discuss.elastic.co/t/how-to-create-a-search-request-with-multiple-knn-fields-using-the-node-client/367098)
**Author:** [@Bruce\_Mcpherson](https://discuss.elastic.co/u/Bruce_Mcpherson)\ **Replies:** 4\ **Last updated:** [September 25, 2024, 1:27pm UTC](https://discuss.elastic.co/t/how-to-create-a-search-request-with-multiple-knn-fields-using-the-node-client/367098 "2024-09-25T13:27:33Z")
My first post here - I'm using elasticsearch 8.15.0 Node client. I have an index with multiple dense-vector fields, and I want to search on them all. With the python client, I am able to do this. {query: {bool: {shoul… --- ## [How to migrate properly to filestream (8.15.1)](https://discuss.elastic.co/t/how-to-migrate-properly-to-filestream-8-15-1/367102)
**Author:** [@Dani\_Perez](https://discuss.elastic.co/u/Dani_Perez)\ **Replies:** 4\ **Last updated:** [September 25, 2024, 1:11pm UTC](https://discuss.elastic.co/t/how-to-migrate-properly-to-filestream-8-15-1/367102 "2024-09-25T13:11:41Z")
Hello, I'm not managing to migrate to filestream instead of log input. Can you give me a hand, please! When I get out of my configuration I stop receiving logs in kibana. My current configuration that is working but … --- ## [Elasticsearch to conditionally match all tags, categories and keywords](https://discuss.elastic.co/t/elasticsearch-to-conditionally-match-all-tags-categories-and-keywords/367095)
**Author:** [@Wilson\_Chen](https://discuss.elastic.co/u/Wilson_Chen)\ **Replies:** 1\ **Last updated:** [September 25, 2024, 1:06pm UTC](https://discuss.elastic.co/t/elasticsearch-to-conditionally-match-all-tags-categories-and-keywords/367095 "2024-09-25T13:06:08Z")
I am trying to build a music search function, using Elasticsearch 9.15. I am currently using .NET client. I am happy to just get the idea how it would look like via DSL, so that I can replicate it for .NET. Every piece… --- ## [ELK – Scraping](https://discuss.elastic.co/t/elk-scraping/367104)
**Author:** [@Marwa\_ZIDI](https://discuss.elastic.co/u/Marwa_ZIDI)\ **Replies:** 2\ **Last updated:** [September 25, 2024, 1:01pm UTC](https://discuss.elastic.co/t/elk-scraping/367104 "2024-09-25T13:01:22Z")
Hello everybody, I got this technical test from an employer, it is about using ELK an integrate a sentiment classification service in it. Here are the questions: install ELK (I have already Ubuntu) Enable authentificati… --- ## [Logstash installation getting failed](https://discuss.elastic.co/t/logstash-installation-getting-failed/366889)
**Author:** [@ErGeek](https://discuss.elastic.co/u/ErGeek)\ **Replies:** 1\ **Last updated:** [September 25, 2024, 12:48pm UTC](https://discuss.elastic.co/t/logstash-installation-getting-failed/366889 "2024-09-25T12:48:23Z")
Hi , I have logstash 7.16.3 installed in my machine. If I try to remove this and install 8.x versions of logstash using the RPM files, the installation is getting failed with the below error. Could anyone please help… --- ## [Parsing logs with a value\_split](https://discuss.elastic.co/t/parsing-logs-with-a-value-split/367059)
**Author:** [@user-27022024](https://discuss.elastic.co/u/user-27022024)\ **Replies:** 3\ **Last updated:** [September 25, 2024, 12:30pm UTC](https://discuss.elastic.co/t/parsing-logs-with-a-value-split/367059 "2024-09-25T12:30:29Z")
"processors" : \[ { "grok": { "field": "log", "patterns": \["%{TIME\_STAMP:ts} %{GREEDYDATA:logtail}"\], "pattern\_definitions" : { "TIME\_STAMP" : "%{YEAR}-%{MONTHNUM… --- ## [ELK Upgradation](https://discuss.elastic.co/t/elk-upgradation/367090)
**Author:** [@Anjali3](https://discuss.elastic.co/u/Anjali3)\ **Replies:** 0\ **Last updated:** [September 25, 2024, 8:35am UTC](https://discuss.elastic.co/t/elk-upgradation/367090 "2024-09-25T08:35:51Z")
Hi Team, We have one ELK Cluster in which we need to upgrade its version from 8.7.1 to 8.14.2. But how to generate certificates between these new containers on docker compose --- ## [Pattern\_replace Token Filter and preserve original tokens](https://discuss.elastic.co/t/pattern-replace-token-filter-and-preserve-original-tokens/367088)
**Author:** [@John.Doe](https://discuss.elastic.co/u/John.Doe)\ **Replies:** 1\ **Last updated:** [September 25, 2024, 8:24am UTC](https://discuss.elastic.co/t/pattern-replace-token-filter-and-preserve-original-tokens/367088 "2024-09-25T08:24:15Z")
Hi, Is there any way how to apply pattern\_replace token filter and preserve original tokens too? I cannot use multifields as a solution. Thanks in advance ! [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=162) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=164)