# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=177 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 178 --- ## [Invalid FieldReference: \`\[\]\` for CSV somehow persists even after using mutate gsub](https://discuss.elastic.co/t/invalid-fieldreference-for-csv-somehow-persists-even-after-using-mutate-gsub/365763)
**Author:** [@canifer](https://discuss.elastic.co/u/canifer)\ **Replies:** 4\ **Last updated:** [August 29, 2024, 11:02pm UTC](https://discuss.elastic.co/t/invalid-fieldreference-for-csv-somehow-persists-even-after-using-mutate-gsub/365763 "2024-08-29T23:02:28Z")
Hello, I need help about sending CSV from filebeat into logstash. The error is "Invalid FieldReference: \[\]" I tried this solution but it doesn't work. (the thread is closed so I ma sorry for opening new topic) This is… --- ## [ELK stack 8 - Kibana - Filebeat](https://discuss.elastic.co/t/elk-stack-8-kibana-filebeat/365104)
**Author:** [@alrightbabyboy](https://discuss.elastic.co/u/alrightbabyboy)\ **Replies:** 7\ **Last updated:** [August 29, 2024, 7:01pm UTC](https://discuss.elastic.co/t/elk-stack-8-kibana-filebeat/365104 "2024-08-29T19:01:48Z")
Hello, I installed the ELK Stack 8 on debian 12. In the virtual machine i have Elasticsearch/Kibana/Logstash. On my-srv-ip:5601, in the elastic dashboard, just below home, i dont have the menu : -kibana. I just have … --- ## [Docker-compose.yml only es01 can connect es02 and es03 "unable to authenticate user \[elastic\] for REST request"](https://discuss.elastic.co/t/docker-compose-yml-only-es01-can-connect-es02-and-es03-unable-to-authenticate-user-elastic-for-rest-request/365784)
**Author:** [@ygqygq2](https://discuss.elastic.co/u/ygqygq2)\ **Replies:** 0\ **Last updated:** [August 29, 2024, 3:38pm UTC](https://discuss.elastic.co/t/docker-compose-yml-only-es01-can-connect-es02-and-es03-unable-to-authenticate-user-elastic-for-rest-request/365784 "2024-08-29T15:38:31Z")
Isn't that a problem ? --- ## [Logstash-input-azureblob Fails to Install with Error](https://discuss.elastic.co/t/logstash-input-azureblob-fails-to-install-with-error/364854)
**Author:** [@nickcat](https://discuss.elastic.co/u/nickcat)\ **Replies:** 6\ **Last updated:** [August 29, 2024, 3:01pm UTC](https://discuss.elastic.co/t/logstash-input-azureblob-fails-to-install-with-error/364854 "2024-08-29T15:01:11Z")
$ sudo /usr/share/logstash/bin/logstash-plugin install logstash-input-azureblob Using bundled JDK: /usr/share/logstash/jdk Validating logstash-input-azureblob Resolving mixin dependencies WARN: Unresolved or ambiguou… --- ## [Provided expression do not match field value filebeat 8.15.0 fortinet module](https://discuss.elastic.co/t/provided-expression-do-not-match-field-value-filebeat-8-15-0-fortinet-module/365612)
**Author:** [@fracorbas](https://discuss.elastic.co/u/fracorbas)\ **Replies:** 1\ **Last updated:** [August 29, 2024, 2:21pm UTC](https://discuss.elastic.co/t/provided-expression-do-not-match-field-value-filebeat-8-15-0-fortinet-module/365612 "2024-08-29T14:21:56Z")
I'm trying to analyze Fortinet FortiGate logs with the filebeat module "Fortinet". The only informations and solutions I found about this was Topics from 2019-2020 with a filebeat version 7.5 which was way too long ago. … --- ## [Prometheus Exporter](https://discuss.elastic.co/t/prometheus-exporter/365711)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 0\ **Last updated:** [August 28, 2024, 4:32pm UTC](https://discuss.elastic.co/t/prometheus-exporter/365711 "2024-08-28T16:32:25Z")
Hello, I been getting started with leveraging Prometheus Exporter from Elastic Agent integrations. I am use node exporter and able to collect the data. I am not too familar with Prometheus' data structure but is there … --- ## [Removing second S3 repository causes "Connection Pool Shutdown" in 8.13.2](https://discuss.elastic.co/t/removing-second-s3-repository-causes-connection-pool-shutdown-in-8-13-2/364797)
**Author:** [@Doc\_Kaos](https://discuss.elastic.co/u/Doc_Kaos)\ **Replies:** 8\ **Last updated:** [August 29, 2024, 2:08pm UTC](https://discuss.elastic.co/t/removing-second-s3-repository-causes-connection-pool-shutdown-in-8-13-2/364797 "2024-08-29T14:08:45Z")
We upgraded to 8.13.2 after having issues in 8.10 with Elasticsearch does not refresh AWS Web Identity Token file when changed on disk · Issue #101828 · elastic/elasticsearch · GitHub We just had a cluster running 8.13.… --- ## [Static text in table visualization](https://discuss.elastic.co/t/static-text-in-table-visualization/365544)
**Author:** [@Bartek\_Kujda](https://discuss.elastic.co/u/Bartek_Kujda)\ **Replies:** 2\ **Last updated:** [August 29, 2024, 1:53pm UTC](https://discuss.elastic.co/t/static-text-in-table-visualization/365544 "2024-08-29T13:53:34Z")
Hey, i have a table visualization in Kibana (8.12.1) to display some batch job metrics. I have a field that holds batch job name, and i put that onto a table together with some statistics like average execution time, amo… --- ## [Change field type, don't need to reindex](https://discuss.elastic.co/t/change-field-type-dont-need-to-reindex/365710)
**Author:** [@wmei](https://discuss.elastic.co/u/wmei)\ **Replies:** 2\ **Last updated:** [August 29, 2024, 1:30pm UTC](https://discuss.elastic.co/t/change-field-type-dont-need-to-reindex/365710 "2024-08-29T13:30:36Z")
I have this field that I want to change to timestamp. I have no need to reindex the old data as the old data drops after 5 days. I am confused as instructions I have found involve a reindex. Thanks! Wei --- ## [Retry on failure mechanism in logstash-bigquery filter plugin](https://discuss.elastic.co/t/retry-on-failure-mechanism-in-logstash-bigquery-filter-plugin/365719)
**Author:** [@Deena\_Dayalan](https://discuss.elastic.co/u/Deena_Dayalan)\ **Replies:** 4\ **Last updated:** [August 29, 2024, 12:45pm UTC](https://discuss.elastic.co/t/retry-on-failure-mechanism-in-logstash-bigquery-filter-plugin/365719 "2024-08-29T12:45:35Z")
Recently, I encountered an issue where events uploads to BigQuery from Logstash failed with a BigQueryException: The service is currently unavailable error. My concern is that valid events might fail due to BigQuery ser… --- ## [Logstash config parameter to handle large messages from rsyslog server](https://discuss.elastic.co/t/logstash-config-parameter-to-handle-large-messages-from-rsyslog-server/365757)
**Author:** [@mansoorpn](https://discuss.elastic.co/u/mansoorpn)\ **Replies:** 6\ **Last updated:** [August 29, 2024, 12:29pm UTC](https://discuss.elastic.co/t/logstash-config-parameter-to-handle-large-messages-from-rsyslog-server/365757 "2024-08-29T12:29:26Z")
Hello Team Developers use on the device a conf with a max size of 65MB because of bigger core dumps. $MaxMessageSize 65536k What will be the logstash configuration parameter to handle these big-size messages? our curr… --- ## [Search at specific index of array of objects](https://discuss.elastic.co/t/search-at-specific-index-of-array-of-objects/365753)
**Author:** [@ducky1](https://discuss.elastic.co/u/ducky1)\ **Replies:** 4\ **Last updated:** [August 29, 2024, 12:12pm UTC](https://discuss.elastic.co/t/search-at-specific-index-of-array-of-objects/365753 "2024-08-29T12:12:18Z")
Hello, I'm new to Elasticsearch and I'm exploring ways to search for a specific index within an array of objects. For instance, I've indexed the following document, but I want to perform a query that matches the author… --- ## [Bar chart with percentage labels on top of the bar](https://discuss.elastic.co/t/bar-chart-with-percentage-labels-on-top-of-the-bar/365629)
**Author:** [@NikiMouse](https://discuss.elastic.co/u/NikiMouse)\ **Replies:** 3\ **Last updated:** [August 29, 2024, 12:00pm UTC](https://discuss.elastic.co/t/bar-chart-with-percentage-labels-on-top-of-the-bar/365629 "2024-08-29T12:00:17Z")
Hi all, there are already a view topics regarding bar charts with percentage labels. But my requirements I didn't found. goal: I want to compare the average response time of different test runs by presenting the times … --- ## [Cannot find live nodes](https://discuss.elastic.co/t/cannot-find-live-nodes/365752)
**Author:** [@R\_U](https://discuss.elastic.co/u/R_U)\ **Replies:** 1\ **Last updated:** [August 29, 2024, 11:52am UTC](https://discuss.elastic.co/t/cannot-find-live-nodes/365752 "2024-08-29T11:52:23Z")
We have Elasticsearch on a Godaddy vps, it's working for the live environment but no live nodes for the staging website. The issue is there when we want to run setup:upgrade in the Magento Dev environment Error notice:… --- ## [Increasing snapshot interval](https://discuss.elastic.co/t/increasing-snapshot-interval/365758)
**Author:** [@hermlam](https://discuss.elastic.co/u/hermlam)\ **Replies:** 1\ **Last updated:** [August 29, 2024, 11:49am UTC](https://discuss.elastic.co/t/increasing-snapshot-interval/365758 "2024-08-29T11:49:33Z")
Hi, I am trying to increase the snapshot interval. Default is 30 minutes. I can't get the value higherv than 45 minutes. With a strange error: Cannot save policy invalid schedule \[0 \*/46 \* \* \* ?\]: schedule would be too… --- ## [Multiple file inputs cause re-reading of file](https://discuss.elastic.co/t/multiple-file-inputs-cause-re-reading-of-file/365276)
**Author:** [@henning\_l](https://discuss.elastic.co/u/henning_l)\ **Replies:** 6\ **Last updated:** [August 29, 2024, 11:18am UTC](https://discuss.elastic.co/t/multiple-file-inputs-cause-re-reading-of-file/365276 "2024-08-29T11:18:21Z")
I am running an ELK stack and tailoring the Logstash configurations to elicit data from several different logs. Because the logs are formatted differently I need to create multiple file inputs. The following is the curre… --- ## [Unable to retrieve version information from Elasticsearch](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch/365657)
**Author:** [@karankamat\_21](https://discuss.elastic.co/u/karankamat_21)\ **Replies:** 4\ **Last updated:** [August 29, 2024, 10:27am UTC](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch/365657 "2024-08-29T10:27:55Z")
Hello, I have freshly installed Elastic Search and Kibana and I'm facing issue while launching Kibana. Can someone help me with the changes I need to make in the yaml files? Also, i have the enrollment token, kindly h… --- ## [Filebeat 8.15.0 output to logstash instead of ES, and Kibana dashboard does not display properly](https://discuss.elastic.co/t/filebeat-8-15-0-output-to-logstash-instead-of-es-and-kibana-dashboard-does-not-display-properly/365746)
**Author:** [@ygqygq2](https://discuss.elastic.co/u/ygqygq2)\ **Replies:** 2\ **Last updated:** [August 29, 2024, 10:16am UTC](https://discuss.elastic.co/t/filebeat-8-15-0-output-to-logstash-instead-of-es-and-kibana-dashboard-does-not-display-properly/365746 "2024-08-29T10:16:54Z")
Filebeat 8.15.0 output to logstash instead of ES, how to set logstash? I tried, but couldn't parse it like a connection to es. --- ## [Cloudflare Logpush integration](https://discuss.elastic.co/t/cloudflare-logpush-integration/364437)
**Author:** [@Alessio\_Creo](https://discuss.elastic.co/u/Alessio_Creo)\ **Replies:** 2\ **Last updated:** [August 29, 2024, 9:16am UTC](https://discuss.elastic.co/t/cloudflare-logpush-integration/364437 "2024-08-29T09:16:02Z")
Hi, we're ingesting data from MinIO bucket using Cloudflare logpush integrations, due to the huge amount of data sometimes the data flow is not "real time" because a single agent can handle the data, using more than one… --- ## [Elastic agent input gives bad\_certificate in Logstash](https://discuss.elastic.co/t/elastic-agent-input-gives-bad-certificate-in-logstash/365748)
**Author:** [@Alessio\_Creo](https://discuss.elastic.co/u/Alessio_Creo)\ **Replies:** 0\ **Last updated:** [August 29, 2024, 9:13am UTC](https://discuss.elastic.co/t/elastic-agent-input-gives-bad-certificate-in-logstash/365748 "2024-08-29T09:13:47Z")
Hi, following step-by-step the following guide We can't connect the elastic agent to Logstash because of a bad\_certificate error. We have basic License but we set the Logstash output as default. Please let me know w… --- ## [Read performance issues for index using parent child relationship](https://discuss.elastic.co/t/read-performance-issues-for-index-using-parent-child-relationship/365693)
**Author:** [@Neha\_Agarwal1](https://discuss.elastic.co/u/Neha_Agarwal1)\ **Replies:** 9\ **Last updated:** [August 29, 2024, 7:23am UTC](https://discuss.elastic.co/t/read-performance-issues-for-index-using-parent-child-relationship/365693 "2024-08-29T07:23:21Z")
The index uses parent child relationship. On an average a parent can have 2 children. Worst case is 10 children.All fields are indexed. Whenever we have a query that uses "has\_child" or "has\_parent" the query takes mi… --- ## [Error with multiple values in ssl\_certificate\_authorities for elasticsearch output](https://discuss.elastic.co/t/error-with-multiple-values-in-ssl-certificate-authorities-for-elasticsearch-output/365708)
**Author:** [@pk92](https://discuss.elastic.co/u/pk92)\ **Replies:** 2\ **Last updated:** [August 29, 2024, 7:23am UTC](https://discuss.elastic.co/t/error-with-multiple-values-in-ssl-certificate-authorities-for-elasticsearch-output/365708 "2024-08-29T07:23:16Z")
Hi, when I put a list with multiple elements in "ssl\_certificate\_authorities" for the Elasticsearch output of the Logstash pipeline, like this: output { elasticsearch { hosts =\> \["htt… --- ## [Sql api error . status code 500](https://discuss.elastic.co/t/sql-api-error-status-code-500/365731)
**Author:** [@pope](https://discuss.elastic.co/u/pope)\ **Replies:** 3\ **Last updated:** [August 29, 2024, 7:11am UTC](https://discuss.elastic.co/t/sql-api-error-status-code-500/365731 "2024-08-29T07:11:11Z")
when use sql rest api post \_sql { "query": """ select site\_name,projectName,count(\*) from dev\_base\_info where area\_id is not null and dev\_name="ss" group by site\_name,projectName """ } this return : Request f… --- ## [How to block particular user account after enter multiple times of wrong password?](https://discuss.elastic.co/t/how-to-block-particular-user-account-after-enter-multiple-times-of-wrong-password/365736)
**Author:** [@sushants](https://discuss.elastic.co/u/sushants)\ **Replies:** 0\ **Last updated:** [August 29, 2024, 5:57am UTC](https://discuss.elastic.co/t/how-to-block-particular-user-account-after-enter-multiple-times-of-wrong-password/365736 "2024-08-29T05:57:23Z")
We have enter wrong password 25 times, but kibana is still able to login the user. Is there any configuration to block user if user enter wrong password multiple times? --- ## [Import CSV and trigger queries based on the values in it](https://discuss.elastic.co/t/import-csv-and-trigger-queries-based-on-the-values-in-it/365733)
**Author:** [@karankamat\_21](https://discuss.elastic.co/u/karankamat_21)\ **Replies:** 1\ **Last updated:** [August 29, 2024, 5:12am UTC](https://discuss.elastic.co/t/import-csv-and-trigger-queries-based-on-the-values-in-it/365733 "2024-08-29T05:12:44Z")
Hello, I am building a proof of concept using Elasticsearch, Logstash and Kibana for one of my projects. One of the requirements for my project is to search the data in the Elastic Search based on the values based in a … --- ## [How to use Logstash to perform multi-attribute missing tagging on log data?](https://discuss.elastic.co/t/how-to-use-logstash-to-perform-multi-attribute-missing-tagging-on-log-data/365651)
**Author:** [@WeirdorPersist](https://discuss.elastic.co/u/WeirdorPersist)\ **Replies:** 2\ **Last updated:** [August 29, 2024, 2:00am UTC](https://discuss.elastic.co/t/how-to-use-logstash-to-perform-multi-attribute-missing-tagging-on-log-data/365651 "2024-08-29T02:00:51Z")
I want to mark log data with missing attributes, but the results always do not match my expectations. The following is an example of normal log data： 14.49.42.25 - - \[12/May/2019:01:24:44 +0000\] "GET /articles/ppp-over… --- ## [While deploying elasticsearch on kubernetes: Error: persistentvolume-controller no persistent volumes available for this claim and no storage class is set](https://discuss.elastic.co/t/while-deploying-elasticsearch-on-kubernetes-error-persistentvolume-controller-no-persistent-volumes-available-for-this-claim-and-no-storage-class-is-set/365728)
**Author:** [@Anu3](https://discuss.elastic.co/u/Anu3)\ **Replies:** 0\ **Last updated:** [August 29, 2024, 1:35am UTC](https://discuss.elastic.co/t/while-deploying-elasticsearch-on-kubernetes-error-persistentvolume-controller-no-persistent-volumes-available-for-this-claim-and-no-storage-class-is-set/365728 "2024-08-29T01:35:48Z")
I am trying to deploy Elasticsearch and kibana on my kubernetes cluster hosted on my VM following the documentation given by Elasticsearch: i am getting this error "no persistent volumes available for this claim and n… --- ## [Getting Unknown key for a VALUE\_STRING in \[preference\] when trying to set preference with search-ui-elasticsearch-connector](https://discuss.elastic.co/t/getting-unknown-key-for-a-value-string-in-preference-when-trying-to-set-preference-with-search-ui-elasticsearch-connector/365706)
**Author:** [@pdiggins](https://discuss.elastic.co/u/pdiggins)\ **Replies:** 1\ **Last updated:** [August 29, 2024, 12:04am UTC](https://discuss.elastic.co/t/getting-unknown-key-for-a-value-string-in-preference-when-trying-to-set-preference-with-search-ui-elasticsearch-connector/365706 "2024-08-29T00:04:13Z")
I am using React Search UI and the connector from search-ui-elasticsearch-connector and am trying to get more consistent scoring. I believe I need to add a preference based on this document. It looks like the requestBo… --- ## [Cannot Register Snapshot Repository for S3 compliant (backblaze) service](https://discuss.elastic.co/t/cannot-register-snapshot-repository-for-s3-compliant-backblaze-service/365581)
**Author:** [@ivanlawrence](https://discuss.elastic.co/u/ivanlawrence)\ **Replies:** 20\ **Last updated:** [August 28, 2024, 8:56pm UTC](https://discuss.elastic.co/t/cannot-register-snapshot-repository-for-s3-compliant-backblaze-service/365581 "2024-08-28T20:56:13Z")
I've looked at the other tickets for similar issues and have not yet found a solution or even suggestion for a next step. On ElasticCloud 7.15 I have a repo setup to backblaze and it's working well enough (a little slow… --- ## [Inaccurate Elasticsearch scores with custom scoring functions](https://discuss.elastic.co/t/inaccurate-elasticsearch-scores-with-custom-scoring-functions/365681)
**Author:** [@imcarloseme](https://discuss.elastic.co/u/imcarloseme)\ **Replies:** 1\ **Last updated:** [August 28, 2024, 7:05pm UTC](https://discuss.elastic.co/t/inaccurate-elasticsearch-scores-with-custom-scoring-functions/365681 "2024-08-28T19:05:03Z")
My Elasticsearch scores become inaccurate when using big number differences. I'm using Elasticsearch 7.10.1. If I have an index that looks something like this: \[{:index=\> {:\_index=\>"candidates", :\_id=\>"a1786607… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=176) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=178)