# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=170

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 171

---

## [Error connecting agent to Oracle Database using SQL input integration](https://discuss.elastic.co/t/error-connecting-agent-to-oracle-database-using-sql-input-integration/366532)

<div class="topic-metadata">

**Author:** [@goncalobsantos](https://discuss.elastic.co/u/goncalobsantos)\
**Replies:** 0\
**Last updated:** [September 13, 2024, 12:13pm UTC](https://discuss.elastic.co/t/error-connecting-agent-to-oracle-database-using-sql-input-integration/366532 "2024-09-13T12:13:19Z")

</div>

I'm trying to use the sql input integration to query a database, but keep getting the following error: cannot open connection: testing connection: dpoPool\_create user=METRICBEAT extAuth=0: ORA-12154: TNS:could not resol…

---

## [\[HTTP Output Failure\] Encountered non-2xx HTTP code 413 {:response\_code=\>413, :url=\>"XXXXXX:XX", :event=\>#\<LogStash::Event:0x3b51e9f4\>}](https://discuss.elastic.co/t/http-output-failure-encountered-non-2xx-http-code-413-response-code-413-url-xxxxxx-xx-event-logstash-0x3b51e9f4/366531)

<div class="topic-metadata">

**Author:** [@Rakesh\_Panda](https://discuss.elastic.co/u/Rakesh_Panda)\
**Replies:** 0\
**Last updated:** [September 13, 2024, 11:52am UTC](https://discuss.elastic.co/t/http-output-failure-encountered-non-2xx-http-code-413-response-code-413-url-xxxxxx-xx-event-logstash-0x3b51e9f4/366531 "2024-09-13T11:52:18Z")

</div>

error logs in logstash indicating http Output failure , while using http plugin , any suggestion ? error appearing intermittently in pipeline using simple config output { http { http\_method =\> "post" url =\> "…

---

## [Elasticsearch behind load balancing proxy](https://discuss.elastic.co/t/elasticsearch-behind-load-balancing-proxy/366528)

<div class="topic-metadata">

**Author:** [@VolvoxGlobator](https://discuss.elastic.co/u/VolvoxGlobator)\
**Replies:** 0\
**Last updated:** [September 13, 2024, 11:25am UTC](https://discuss.elastic.co/t/elasticsearch-behind-load-balancing-proxy/366528 "2024-09-13T11:25:19Z")

</div>

Hello, we have on have a little bit more abstraction between cluster setup and our python code and plan on hiding the cluster behind load balancing proxy (nginx), thus just single endpoint from client point of view. I ha…

---

## [Multiple dashboards/spaces through reverse proxy](https://discuss.elastic.co/t/multiple-dashboards-spaces-through-reverse-proxy/366391)

<div class="topic-metadata">

**Author:** [@PMF](https://discuss.elastic.co/u/PMF)\
**Replies:** 0\
**Last updated:** [September 11, 2024, 8:27am UTC](https://discuss.elastic.co/t/multiple-dashboards-spaces-through-reverse-proxy/366391 "2024-09-11T08:27:14Z")

</div>

So, this is our use case: We have multiple dashboards with three levels of access. First, we have dashboards that we want to go public, we aim to embed them onto our webpage and allow everyone to see them. Those dashbo…

---

## [Reindex API does not complete the re-indexing](https://discuss.elastic.co/t/reindex-api-does-not-complete-the-re-indexing/366389)

<div class="topic-metadata">

**Author:** [@abhadauria](https://discuss.elastic.co/u/abhadauria)\
**Replies:** 4\
**Last updated:** [September 13, 2024, 11:19am UTC](https://discuss.elastic.co/t/reindex-api-does-not-complete-the-re-indexing/366389 "2024-09-13T11:19:52Z")

</div>

using ES version 7.17, after triggering the re-index API from query node, it stops re-indexing after some time and does not complete the re-indexing of all the docs in the source index, eg, we have ~110 million docs in t…

---

## [Elastic.Clients.Elasticsearch Version="8.15.6": maxScore is always null](https://discuss.elastic.co/t/elastic-clients-elasticsearch-version-8-15-6-maxscore-is-always-null/366152)

<div class="topic-metadata">

**Author:** [@PitAttack](https://discuss.elastic.co/u/PitAttack)\
**Replies:** 1\
**Last updated:** [September 13, 2024, 9:24am UTC](https://discuss.elastic.co/t/elastic-clients-elasticsearch-version-8-15-6-maxscore-is-always-null/366152 "2024-09-13T09:24:24Z")

</div>

I have this query, created in C#. { "min\_score": 20, "query": { "bool": { "filter": { "term": { "glnType": { "value": "Company" } } }, "must": { …

---

## [Ingest Pipeline: Compare two arrays with Painless Script](https://discuss.elastic.co/t/ingest-pipeline-compare-two-arrays-with-painless-script/366510)

<div class="topic-metadata">

**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\
**Replies:** 0\
**Last updated:** [September 13, 2024, 7:01am UTC](https://discuss.elastic.co/t/ingest-pipeline-compare-two-arrays-with-painless-script/366510 "2024-09-13T07:01:11Z")

</div>

Hi everyone, I'm working on an ingest pipeline in Elasticsearch where I have two array fields (alfa and beta), both populated by two different enrich processors earlier in the same pipeline. I would like to add a script…

---

## [PacketBeat - Metric Visualization](https://discuss.elastic.co/t/packetbeat-metric-visualization/366267)

<div class="topic-metadata">

**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\
**Replies:** 3\
**Last updated:** [September 13, 2024, 6:07am UTC](https://discuss.elastic.co/t/packetbeat-metric-visualization/366267 "2024-09-13T06:07:52Z")

</div>

Hello, I have question about displaying network data using Packetbeat. I was wondering for starters is there a way to determine the total packets? is that "count" of records in packetbeat?

---

## [Logstash crashes when trying to install cloudwatch\_logs plugin](https://discuss.elastic.co/t/logstash-crashes-when-trying-to-install-cloudwatch-logs-plugin/366499)

<div class="topic-metadata">

**Author:** [@Anca\_Linca](https://discuss.elastic.co/u/Anca_Linca)\
**Replies:** 5\
**Last updated:** [September 13, 2024, 5:44am UTC](https://discuss.elastic.co/t/logstash-crashes-when-trying-to-install-cloudwatch-logs-plugin/366499 "2024-09-13T05:44:05Z")

</div>

Logstash version: 8.15.1 OS: Amazon Linux 2 All packages updated Steps to reproduce: rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch in /etc/yum.repos.d/logstash.repo \[logstash-8.x\] name=Elastic rep…

---

## [How to config Control Button format to base64 decode?](https://discuss.elastic.co/t/how-to-config-control-button-format-to-base64-decode/365937)

<div class="topic-metadata">

**Author:** [@zhangzx1996](https://discuss.elastic.co/u/zhangzx1996)\
**Replies:** 2\
**Last updated:** [September 13, 2024, 2:43am UTC](https://discuss.elastic.co/t/how-to-config-control-button-format-to-base64-decode/365937 "2024-09-13T02:43:46Z")

</div>

I want to build a dashboard on kibana. But my field was base64 encode that I want to search. So I want the Control Button can be format base64 decode, and when I select one element ,kibana can use the base64 value to se…

---

## [HTML text in Kibana](https://discuss.elastic.co/t/html-text-in-kibana/366451)

<div class="topic-metadata">

**Author:** [@juandres117](https://discuss.elastic.co/u/juandres117)\
**Replies:** 1\
**Last updated:** [September 12, 2024, 11:13pm UTC](https://discuss.elastic.co/t/html-text-in-kibana/366451 "2024-09-12T23:13:14Z")

</div>

Hey everyone! I am willing to upload some data which has a field like this: Summary \<html\> \<body\> \<p\> Recent mass casualty attacks by militant groups in Burkina Faso are likely to put the military government under in…

---

## [Logstash ECK Job](https://discuss.elastic.co/t/logstash-eck-job/366498)

<div class="topic-metadata">

**Author:** [@lkouts](https://discuss.elastic.co/u/lkouts)\
**Replies:** 0\
**Last updated:** [September 12, 2024, 8:54pm UTC](https://discuss.elastic.co/t/logstash-eck-job/366498 "2024-09-12T20:54:14Z")

</div>

My ECK implementation uses logstash with a JDBC driver with over 100 Inputs pushing to a 1:1 index. For it's initial crawl of each index we're looking at performing the initial crawl via a logstash job. When the job comp…

---

## [Kibana Integration AWS SQS Error message](https://discuss.elastic.co/t/kibana-integration-aws-sqs-error-message/366497)

<div class="topic-metadata">

**Author:** [@rachelyang](https://discuss.elastic.co/u/rachelyang)\
**Replies:** 0\
**Last updated:** [September 12, 2024, 8:38pm UTC](https://discuss.elastic.co/t/kibana-integration-aws-sqs-error-message/366497 "2024-09-12T20:38:06Z")

</div>

Hi Team, I set up integration of AWS in Kibana with Elastic Agent to collect VPC flow logs from S3 via SQS queue URL. I got this error message: sqs ReceiveMessage failed: operation error SQS: ReceiveMessage, https resp…

---

## [Elastic Integrations - Unmapped Fields](https://discuss.elastic.co/t/elastic-integrations-unmapped-fields/366486)

<div class="topic-metadata">

**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\
**Replies:** 1\
**Last updated:** [September 12, 2024, 3:57pm UTC](https://discuss.elastic.co/t/elastic-integrations-unmapped-fields/366486 "2024-09-12T15:57:32Z")

</div>

Hello, I recently started to use Prometheus integration. I am seeing a good number of fields that were unmapped. What can I do to make these mapped?

---

## [\[ElasticAgent\] failed to publish events: 429 Too Many Requests](https://discuss.elastic.co/t/elasticagent-failed-to-publish-events-429-too-many-requests/366468)

<div class="topic-metadata">

**Author:** [@iamp3](https://discuss.elastic.co/u/iamp3)\
**Replies:** 4\
**Last updated:** [September 12, 2024, 2:22pm UTC](https://discuss.elastic.co/t/elasticagent-failed-to-publish-events-429-too-many-requests/366468 "2024-09-12T14:22:27Z")

</div>

Hi, I have several ELK clusters deployed in Elastic cloud via Azure integration. We decided to start integrating Azure logs and elastic agents to configure some alerts on the resources we need. On sandbox environment I d…

---

## [Increasing resiliency of an on-prem Elastic stack implementation](https://discuss.elastic.co/t/increasing-resiliency-of-an-on-prem-elastic-stack-implementation/366474)

<div class="topic-metadata">

**Author:** [@chen0003](https://discuss.elastic.co/u/chen0003)\
**Replies:** 1\
**Last updated:** [September 12, 2024, 1:37pm UTC](https://discuss.elastic.co/t/increasing-resiliency-of-an-on-prem-elastic-stack-implementation/366474 "2024-09-12T13:37:49Z")

</div>

Hi! We have an on-prem setup running 8.15.1 We use this to index/visualize logs coming off of a firewall The setup is like this - Firewall --(Systlog)--\>Syslog Server--(file input)--\>Filebeat--\>Redis--\>Logstash--\>Ela…

---

## [Default password expiry in Elastic 8.14](https://discuss.elastic.co/t/default-password-expiry-in-elastic-8-14/366467)

<div class="topic-metadata">

**Author:** [@h.d.intodata](https://discuss.elastic.co/u/h.d.intodata)\
**Replies:** 2\
**Last updated:** [September 12, 2024, 1:01pm UTC](https://discuss.elastic.co/t/default-password-expiry-in-elastic-8-14/366467 "2024-09-12T13:01:03Z")

</div>

Hi team, I have a quick question, what is the default password expiry for the super user in Elastic 8.14 Kind regards, Hugo

---

## [Error setting up connection to Salesforce](https://discuss.elastic.co/t/error-setting-up-connection-to-salesforce/366477)

<div class="topic-metadata">

**Author:** [@dwjvaughan](https://discuss.elastic.co/u/dwjvaughan)\
**Replies:** 0\
**Last updated:** [September 12, 2024, 12:58pm UTC](https://discuss.elastic.co/t/error-setting-up-connection-to-salesforce/366477 "2024-09-12T12:58:39Z")

</div>

I keep hitting the following error when trying to use the Salesforce module in filebeat against our sandbox environment: {"function":"github.com/elastic/beats/v7/filebeat/input/v2/compat.(\*runner).Start.func1","file.nam…

---

## [Beats 7.17.10 with Elastic Stack 8.15](https://discuss.elastic.co/t/beats-7-17-10-with-elastic-stack-8-15/366476)

<div class="topic-metadata">

**Author:** [@anastasia](https://discuss.elastic.co/u/anastasia)\
**Replies:** 0\
**Last updated:** [September 12, 2024, 12:52pm UTC](https://discuss.elastic.co/t/beats-7-17-10-with-elastic-stack-8-15/366476 "2024-09-12T12:52:14Z")

</div>

Good day to all! I ran into a problem. At work, one of the computers has the Windows 7 operating system installed, due to specific software that is not supported in new versions of Windows. Auditbeat and winlogbeat versi…

---

## [When Rule is disabled, automatically disable alerts?](https://discuss.elastic.co/t/when-rule-is-disabled-automatically-disable-alerts/366454)

<div class="topic-metadata">

**Author:** [@Fiza](https://discuss.elastic.co/u/Fiza)\
**Replies:** 2\
**Last updated:** [September 12, 2024, 10:48am UTC](https://discuss.elastic.co/t/when-rule-is-disabled-automatically-disable-alerts/366454 "2024-09-12T10:48:42Z")

</div>

Hello Elastic Team, I have multiple rules running in Elasticsearch instance. Out of which I stopped one rule which had "Active" alerts. Those alerts are still in active state. I am trying to find a way that when we cha…

---

## [Error getting while adding second repository for snapshot](https://discuss.elastic.co/t/error-getting-while-adding-second-repository-for-snapshot/366450)

<div class="topic-metadata">

**Author:** [@Nikhil\_Borse](https://discuss.elastic.co/u/Nikhil_Borse)\
**Replies:** 0\
**Last updated:** [September 12, 2024, 7:14am UTC](https://discuss.elastic.co/t/error-getting-while-adding-second-repository-for-snapshot/366450 "2024-09-12T07:14:54Z")

</div>

Hi, I am trying to add 2 snapshot repositories as s3. Both the buckets are oci buckets. When I added first Bucket it is working fine as expected but when I am trying to add another bucket with different access key and se…

---

## [Elasticsearch search query returning "empty" response using elasticsearch python API](https://discuss.elastic.co/t/elasticsearch-search-query-returning-empty-response-using-elasticsearch-python-api/365983)

<div class="topic-metadata">

**Author:** [@manropinxu](https://discuss.elastic.co/u/manropinxu)\
**Replies:** 9\
**Last updated:** [September 12, 2024, 7:17am UTC](https://discuss.elastic.co/t/elasticsearch-search-query-returning-empty-response-using-elasticsearch-python-api/365983 "2024-09-12T07:17:40Z")

</div>

I am using elasticsearch py client in my real time application. The application performs search query aggregations like "sum of field settledAmount in last 10 days". Most of queries work without problems. However a tin…

---

## [Logstash - High Network Bandwidth output using S3 Output](https://discuss.elastic.co/t/logstash-high-network-bandwidth-output-using-s3-output/366422)

<div class="topic-metadata">

**Author:** [@iseeldur](https://discuss.elastic.co/u/iseeldur)\
**Replies:** 4\
**Last updated:** [September 12, 2024, 6:29am UTC](https://discuss.elastic.co/t/logstash-high-network-bandwidth-output-using-s3-output/366422 "2024-09-12T06:29:39Z")

</div>

Hi, Thanks in advance. We have two aws logstash instances sending beats traffic to two s3 aws buckets using the s3 output plugin, however are seeing high outbound network traffic. Id expect to see 1:2 inbound to outbo…

---

## [Can we use ILM on the index created by using transform](https://discuss.elastic.co/t/can-we-use-ilm-on-the-index-created-by-using-transform/366445)

<div class="topic-metadata">

**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\
**Replies:** 1\
**Last updated:** [September 12, 2024, 6:15am UTC](https://discuss.elastic.co/t/can-we-use-ilm-on-the-index-created-by-using-transform/366445 "2024-09-12T06:15:42Z")

</div>

Hi Team, we are using 180 days retention for all the data in our Elastic cluster. Now we have some transforms where we are using the transforms retention\_policy to keep the data for 180 days. Now we wanted to remove the…

---

## [Updating the datastream from logstash](https://discuss.elastic.co/t/updating-the-datastream-from-logstash/366446)

<div class="topic-metadata">

**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\
**Replies:** 1\
**Last updated:** [September 12, 2024, 6:13am UTC](https://discuss.elastic.co/t/updating-the-datastream-from-logstash/366446 "2024-09-12T06:13:35Z")

</div>

Hi Team, we are trying to lookup the data in one datastream with anothe data in another datastream based on a key using logstash elasticseach input plugin and elasticsearch filter as shown in the sample config below. M…

---

## [Scheduled CSV Report - Email Body](https://discuss.elastic.co/t/scheduled-csv-report-email-body/366436)

<div class="topic-metadata">

**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\
**Replies:** 1\
**Last updated:** [September 12, 2024, 4:56am UTC](https://discuss.elastic.co/t/scheduled-csv-report-email-body/366436 "2024-09-12T04:56:20Z")

</div>

Hello I created a watcher that sends a csv to email. Here's the watcher: { "trigger" : { "schedule": { "interval": "1h" } }, "actions" : { "email\_admin" : { "email": { "to": "\<red…

---

## [About ETL processing failure (RSYSLOG)](https://discuss.elastic.co/t/about-etl-processing-failure-rsyslog/366438)

<div class="topic-metadata">

**Author:** [@nw-engineer](https://discuss.elastic.co/u/nw-engineer)\
**Replies:** 0\
**Last updated:** [September 12, 2024, 12:40am UTC](https://discuss.elastic.co/t/about-etl-processing-failure-rsyslog/366438 "2024-09-12T00:40:33Z")

</div>

I am using Logstash (version 8.4.3) to process and index log data received via RSYSLOG. RSYSLOG is configured to perform log rotation with the following parameters: hourly missingok compress rotate 1 nocopy nocrea…

---

## [Logstash csv parser with single and double quotes](https://discuss.elastic.co/t/logstash-csv-parser-with-single-and-double-quotes/366437)

<div class="topic-metadata">

**Author:** [@shmesh](https://discuss.elastic.co/u/shmesh)\
**Replies:** 1\
**Last updated:** [September 11, 2024, 11:36pm UTC](https://discuss.elastic.co/t/logstash-csv-parser-with-single-and-double-quotes/366437 "2024-09-11T23:36:47Z")

</div>

I'm having a hard time processing logs with the logstash csv filter, my logs are in a csv format with tab delimited, it has fields which may contain single quotes and also it contains json objects, http://www.example.co…

---

## [Best strategy to "JOIN" data from diferent .json files (Data enrichment? Rollup? Transform? Dictionary?)](https://discuss.elastic.co/t/best-strategy-to-join-data-from-diferent-json-files-data-enrichment-rollup-transform-dictionary/366434)

<div class="topic-metadata">

**Author:** [@syunusic](https://discuss.elastic.co/u/syunusic)\
**Replies:** 4\
**Last updated:** [September 11, 2024, 10:05pm UTC](https://discuss.elastic.co/t/best-strategy-to-join-data-from-diferent-json-files-data-enrichment-rollup-transform-dictionary/366434 "2024-09-11T22:05:32Z")

</div>

Let's say I have three .json files containing this information: employees.json: { "employee\_id":1, "name":"John" }, { "employee\_id":2, "name":"Elton" } companies.json: { "company\_id":1001, "company\_name":"ACME" }, { …

---

## [Configure Winlogbeat to use Logstash and setup kibana dashboards at once](https://discuss.elastic.co/t/configure-winlogbeat-to-use-logstash-and-setup-kibana-dashboards-at-once/366357)

<div class="topic-metadata">

**Author:** [@akabigsmokee](https://discuss.elastic.co/u/akabigsmokee)\
**Replies:** 6\
**Last updated:** [September 11, 2024, 9:24pm UTC](https://discuss.elastic.co/t/configure-winlogbeat-to-use-logstash-and-setup-kibana-dashboards-at-once/366357 "2024-09-11T21:24:16Z")

</div>

Hello everyone, Can you help me with an issue I'm facing? Is it possible to configure Winlogbeat to send output to Logstash while still loading the patterns and dashboards for Kibana? Below is a screenshot showing the e…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=169)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=171)