# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=185 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 186 --- ## [Apm-server not getting connected to kibana. Using v 7.17.1 for all](https://discuss.elastic.co/t/apm-server-not-getting-connected-to-kibana-using-v-7-17-1-for-all/364888)
**Author:** [@Amol\_Nagotkar](https://discuss.elastic.co/u/Amol_Nagotkar)\ **Replies:** 2\ **Last updated:** [August 16, 2024, 11:24am UTC](https://discuss.elastic.co/t/apm-server-not-getting-connected-to-kibana-using-v-7-17-1-for-all/364888 "2024-08-16T11:24:42Z")
Hi all, issue is cant see index here http://127.0.0.1:9200/\_cat/indices ------------docker-compose file--------------- version: '3' services: elasticsearch: container\_name: elasticsearch image: docker.elastic.co/e… --- ## [Can't modify the @timestamp field via logstash](https://discuss.elastic.co/t/cant-modify-the-timestamp-field-via-logstash/364009)
**Author:** [@Gur-Sin](https://discuss.elastic.co/u/Gur-Sin)\ **Replies:** 2\ **Last updated:** [August 16, 2024, 7:03am UTC](https://discuss.elastic.co/t/cant-modify-the-timestamp-field-via-logstash/364009 "2024-08-16T07:03:57Z")
Hi, I recently had to migrate data from one index to another and wanted to maintain the original timestamps as in the original index. I have used the date plugin to achieve the same and it seems to work when I pipe the … --- ## [Logstash: configure multiline configuration for specific type of logs only](https://discuss.elastic.co/t/logstash-configure-multiline-configuration-for-specific-type-of-logs-only/364700)
**Author:** [@pix9](https://discuss.elastic.co/u/pix9)\ **Replies:** 6\ **Last updated:** [August 9, 2024, 6:32pm UTC](https://discuss.elastic.co/t/logstash-configure-multiline-configuration-for-specific-type-of-logs-only/364700 "2024-08-09T18:32:44Z")
Hey Folks, We've an existing Logstash configuration where we use fields "logs\_type" to separate the different types of logs and parse them with their respective grok patterns into multiple respective indexes. Now we a… --- ## [Logstash tcp output plugin](https://discuss.elastic.co/t/logstash-tcp-output-plugin/364933)
**Author:** [@pradeep-logstashuser](https://discuss.elastic.co/u/pradeep-logstashuser)\ **Replies:** 2\ **Last updated:** [August 16, 2024, 6:09am UTC](https://discuss.elastic.co/t/logstash-tcp-output-plugin/364933 "2024-08-16T06:09:39Z")
Hi, I am using the Logstash TCP output plugin, and even though I removed the host field from my event, I still receive the %host string at the beginning of the event string. Is there any option to remove that? When I pr… --- ## [8.14.1 KQL facing an index（message&event.original） that cannot display all characters](https://discuss.elastic.co/t/8-14-1-kql-facing-an-index-message-event-original-that-cannot-display-all-characters/364994)
**Author:** [@dobixu](https://discuss.elastic.co/u/dobixu)\ **Replies:** 0\ **Last updated:** [August 16, 2024, 3:23am UTC](https://discuss.elastic.co/t/8-14-1-kql-facing-an-index-message-event-original-that-cannot-display-all-characters/364994 "2024-08-16T03:23:47Z")
Elasticsearch Version 8.14.1 Installed Plugins No response Java Version openjdk 22.0.1 2024-04-16 OS Version CentOS Linux release 7.9.2009 (Core) Problem Description Problem Description Kibana KQL query index " inter… --- ## [Error displaying meerkat data in filebeat](https://discuss.elastic.co/t/error-displaying-meerkat-data-in-filebeat/364992)
**Author:** [@ZombCry](https://discuss.elastic.co/u/ZombCry)\ **Replies:** 0\ **Last updated:** [August 16, 2024, 3:23am UTC](https://discuss.elastic.co/t/error-displaying-meerkat-data-in-filebeat/364992 "2024-08-16T03:23:31Z")
Good day, I have suricata installed on an Ubuntu server, I already installed kibana and filebeat and suricata is sending me logs but it does not show me any information in filebeat, what can I do? --- ## [How to close the auto fetch request?](https://discuss.elastic.co/t/how-to-close-the-auto-fetch-request/364938)
**Author:** [@jevonsnotes](https://discuss.elastic.co/u/jevonsnotes)\ **Replies:** 4\ **Last updated:** [August 16, 2024, 1:45am UTC](https://discuss.elastic.co/t/how-to-close-the-auto-fetch-request/364938 "2024-08-16T01:45:56Z")
\[2024-08-15T10:55:50.769+08:00\]\[ERROR\]\[plugins.fleet\] Failed to fetch latest version of synthetics from registry: Error connecting to package registry: request to http://10.26.22.25:8080/search?package=synthetics&prerele… --- ## [Logstash fails 409 conflict unknown column: 'type'\\"](https://discuss.elastic.co/t/logstash-fails-409-conflict-unknown-column-type/364886)
**Author:** [@ridish](https://discuss.elastic.co/u/ridish)\ **Replies:** 5\ **Last updated:** [August 16, 2024, 12:10am UTC](https://discuss.elastic.co/t/logstash-fails-409-conflict-unknown-column-type/364886 "2024-08-16T00:10:29Z")
Hello Everyone, I'm a newbie to logstash and i'm trying to configure logstash with manticore which is based on elasticsearch 6.3.2. And i have the following config input { # Input for the first log file file { … --- ## [Prometheus module : Query\_range not exporting to ES](https://discuss.elastic.co/t/prometheus-module-query-range-not-exporting-to-es/364988)
**Author:** [@Nidhi\_Batra](https://discuss.elastic.co/u/Nidhi_Batra)\ **Replies:** 0\ **Last updated:** [August 15, 2024, 11:47pm UTC](https://discuss.elastic.co/t/prometheus-module-query-range-not-exporting-to-es/364988 "2024-08-15T23:47:26Z")
Hi. I am trying to run a range query with Prometheus module enabled. I have enabled the debug logs. I can see that the query is running and giving the correct output in the console logs. But I cant see docs in kibana. … --- ## [Http\_poller and ignore SSL Validation](https://discuss.elastic.co/t/http-poller-and-ignore-ssl-validation/364986)
**Author:** [@rmoss25](https://discuss.elastic.co/u/rmoss25)\ **Replies:** 0\ **Last updated:** [August 15, 2024, 9:18pm UTC](https://discuss.elastic.co/t/http-poller-and-ignore-ssl-validation/364986 "2024-08-15T21:18:32Z")
Hi, How do you ignore the SSL validation when using the http\_poller plugin? I get the following error when I try to pull API events from a reputable sites REST API. The site is using a valid certificate as its a well … --- ## [Elastic Search is giving same score for all parent document which has nested documents](https://discuss.elastic.co/t/elastic-search-is-giving-same-score-for-all-parent-document-which-has-nested-documents/364931)
**Author:** [@Santanu112](https://discuss.elastic.co/u/Santanu112)\ **Replies:** 2\ **Last updated:** [August 15, 2024, 8:24pm UTC](https://discuss.elastic.co/t/elastic-search-is-giving-same-score-for-all-parent-document-which-has-nested-documents/364931 "2024-08-15T20:24:27Z")
I am trying elstic search query and all my search results is showing same \_score. For that i am not getting the appropriate result. GET my\_index/\_search { "from": 0, "size": 10, "query": { "bool": { "mu… --- ## [License clarification](https://discuss.elastic.co/t/license-clarification/364934)
**Author:** [@elastic\_noob1](https://discuss.elastic.co/u/elastic_noob1)\ **Replies:** 4\ **Last updated:** [August 15, 2024, 8:14pm UTC](https://discuss.elastic.co/t/license-clarification/364934 "2024-08-15T20:14:22Z")
We have a platinum license that will expire in Oct 2024. We are running 6.8 and plan to upgrade to 7.17. This upgrade will be a 2 step process: 6.8 \> 7.3 \> 7.17 I upgraded from 6.8 to 7.3 with the platinum license. I de… --- ## [How to test filebeat authentication to Azure Eventhub with a connection string in the filebeat vault?](https://discuss.elastic.co/t/how-to-test-filebeat-authentication-to-azure-eventhub-with-a-connection-string-in-the-filebeat-vault/364914)
**Author:** [@Dave\_Houser](https://discuss.elastic.co/u/Dave_Houser)\ **Replies:** 0\ **Last updated:** [August 14, 2024, 2:43pm UTC](https://discuss.elastic.co/t/how-to-test-filebeat-authentication-to-azure-eventhub-with-a-connection-string-in-the-filebeat-vault/364914 "2024-08-14T14:43:00Z")
I have Filebeat set up on a Linux forwarder. It currently connects back to an Azure Eventhub instance using the Eventhub connection string. The string is stored in the Filebeat keystore. Then I reference it in the fileb… --- ## [Remote Monitoring Cluster - No Monitoring Data Found](https://discuss.elastic.co/t/remote-monitoring-cluster-no-monitoring-data-found/364976)
**Author:** [@axvfvv79zcx57xv7k](https://discuss.elastic.co/u/axvfvv79zcx57xv7k)\ **Replies:** 0\ **Last updated:** [August 15, 2024, 4:45pm UTC](https://discuss.elastic.co/t/remote-monitoring-cluster-no-monitoring-data-found/364976 "2024-08-15T16:45:06Z")
Hey there, I'm currently trying to set up a remote monitoring cluster for my production cluster using Elastic Agent and Fleet. I am using the Elasticsearch integration with my agent, which is installed on my production … --- ## [Learning resources for ES Java client](https://discuss.elastic.co/t/learning-resources-for-es-java-client/364953)
**Author:** [@UMUT\_CAN\_ARGUN](https://discuss.elastic.co/u/UMUT_CAN_ARGUN)\ **Replies:** 1\ **Last updated:** [August 15, 2024, 3:45pm UTC](https://discuss.elastic.co/t/learning-resources-for-es-java-client/364953 "2024-08-15T15:45:50Z")
Do you know any resources (other than official documentation) for learning Java client for ES? --- ## [Pass the data into alert actions](https://discuss.elastic.co/t/pass-the-data-into-alert-actions/364962)
**Author:** [@yar](https://discuss.elastic.co/u/yar)\ **Replies:** 0\ **Last updated:** [August 15, 2024, 2:24pm UTC](https://discuss.elastic.co/t/pass-the-data-into-alert-actions/364962 "2024-08-15T14:24:13Z")
Hi, I have created the Threshold based alert. It is executing a query against staging\_logs and production\_logs indices. How can I pass down the index in actions? I mean if the rule got triggered on some log in staging\_l… --- ## [Optimal Cluster for Production](https://discuss.elastic.co/t/optimal-cluster-for-production/364618)
**Author:** [@fatima1](https://discuss.elastic.co/u/fatima1)\ **Replies:** 6\ **Last updated:** [August 15, 2024, 2:53pm UTC](https://discuss.elastic.co/t/optimal-cluster-for-production/364618 "2024-08-15T14:53:17Z")
I am overseeing a production cluster consisting of approximately 83 nodes, and we are handling nearly a million of data points daily . To optimize the production environment, what are the recommended best practices regar… --- ## [@timestamp not working in filesystem input](https://discuss.elastic.co/t/timestamp-not-working-in-filesystem-input/364920)
**Author:** [@wiistriker](https://discuss.elastic.co/u/wiistriker)\ **Replies:** 2\ **Last updated:** [August 15, 2024, 2:49pm UTC](https://discuss.elastic.co/t/timestamp-not-working-in-filesystem-input/364920 "2024-08-15T14:49:06Z")
Hello! I have same issue as described in Timestamp not being overwriten (ECS) Solution is use deprecated input log, but what can we do with filesystem input? I have such setup - type: filestream id: some-log paths… --- ## [How can I delete a document when it is X month old?](https://discuss.elastic.co/t/how-can-i-delete-a-document-when-it-is-x-month-old/364958)
**Author:** [@Arkapravo\_Das](https://discuss.elastic.co/u/Arkapravo_Das)\ **Replies:** 1\ **Last updated:** [August 15, 2024, 2:40pm UTC](https://discuss.elastic.co/t/how-can-i-delete-a-document-when-it-is-x-month-old/364958 "2024-08-15T14:40:57Z")
I have an index and document gets added to that index everyday ,lets say with a frequency of 10,000 daily. I want to delete the documents which are 5 month old from that index and want to run this deletion process daily … --- ## [What means a hits.total.value of -1](https://discuss.elastic.co/t/what-means-a-hits-total-value-of-1/364961)
**Author:** [@Voidi](https://discuss.elastic.co/u/Voidi)\ **Replies:** 0\ **Last updated:** [August 15, 2024, 2:14pm UTC](https://discuss.elastic.co/t/what-means-a-hits-total-value-of-1/364961 "2024-08-15T14:14:05Z")
When hits.total.value is 0 there are no matching documents for the query ( in my case a simple multi\_match query over a three text fields with Fuzziness.AUTO). But what does it mean if hits.total.value is -1? --- ## [Retrieve length of array which is part of object present in map](https://discuss.elastic.co/t/retrieve-length-of-array-which-is-part-of-object-present-in-map/364960)
**Author:** [@Abhi1984](https://discuss.elastic.co/u/Abhi1984)\ **Replies:** 0\ **Last updated:** [August 15, 2024, 2:12pm UTC](https://discuss.elastic.co/t/retrieve-length-of-array-which-is-part-of-object-present-in-map/364960 "2024-08-15T14:12:00Z")
Hi, I'm need to write a query which provides the length of array fields inside an object which is stored as value in a map. E.g. { "id":1, "data": { { "2023": { "array1" : \["A","B"\], "array2" : \["A","B","C"\] "a… --- ## [Kibana fails to start](https://discuss.elastic.co/t/kibana-fails-to-start/364771)
**Author:** [@UMUT\_CAN\_ARGUN](https://discuss.elastic.co/u/UMUT_CAN_ARGUN)\ **Replies:** 9\ **Last updated:** [August 15, 2024, 12:20pm UTC](https://discuss.elastic.co/t/kibana-fails-to-start/364771 "2024-08-15T12:20:56Z")
The cmd stucks at this stage: Kibana is currently running with legacy OpenSSL providers enabled! For details and instructions on how to disable see https://www.elastic.co/guide/en/kibana/8.14/production.html#openssl-leg… --- ## [Incorrect query and I don't understand why](https://discuss.elastic.co/t/incorrect-query-and-i-dont-understand-why/364936)
**Author:** [@Yoann\_Buzenet](https://discuss.elastic.co/u/Yoann_Buzenet)\ **Replies:** 1\ **Last updated:** [August 15, 2024, 11:58am UTC](https://discuss.elastic.co/t/incorrect-query-and-i-dont-understand-why/364936 "2024-08-15T11:58:38Z")
Hello, I created a query that doesn't work and the kibana devtools is not showing me a syntax error. There must be something logical I missed. I wonder if it comes from the multiples "should" clauses I am using. Could y… --- ## [Behaviour of elastic when using EBS snapshotted data in kubernetes](https://discuss.elastic.co/t/behaviour-of-elastic-when-using-ebs-snapshotted-data-in-kubernetes/364949)
**Author:** [@eeijlar](https://discuss.elastic.co/u/eeijlar)\ **Replies:** 4\ **Last updated:** [August 15, 2024, 11:40am UTC](https://discuss.elastic.co/t/behaviour-of-elastic-when-using-ebs-snapshotted-data-in-kubernetes/364949 "2024-08-15T11:40:41Z")
We are running elastic on a kubernetes cluster in AWS. We have created a volume snapshot of elastic pvcs using the amazon volume snapshotting method: There are 7 nodes in the cluster running in kubernetes. Each node is… --- ## ["kubectl patch" on Elastic ECK](https://discuss.elastic.co/t/kubectl-patch-on-elastic-eck/364950)
**Author:** [@nnikushkin](https://discuss.elastic.co/u/nnikushkin)\ **Replies:** 0\ **Last updated:** [August 15, 2024, 11:38am UTC](https://discuss.elastic.co/t/kubectl-patch-on-elastic-eck/364950 "2024-08-15T11:38:31Z")
HHello everyone, I noticed something I cannot explain: I deploy Elasticsearch (following the quickstart guide) with the DeleteOnScaledownAndClusterDeletion policy. Then I patch the policy to DeleteOnScaledownOnly and … --- ## [\[I18n\] A \`formats\` must be a non-empty object](https://discuss.elastic.co/t/i18n-a-formats-must-be-a-non-empty-object/364745)
**Author:** [@whanklee](https://discuss.elastic.co/u/whanklee)\ **Replies:** 1\ **Last updated:** [August 15, 2024, 11:23am UTC](https://discuss.elastic.co/t/i18n-a-formats-must-be-a-non-empty-object/364745 "2024-08-15T11:23:44Z")
Hi. I tried to upgrade ELK 8.14.3 to 8.15.0 Ubuntu version 22.04 Using the following command: sudo apt-get update && sudo apt-get upgrade I got this error message on frontend: \[I18n\] A \`formats\` must be a non-empty… --- ## [How to count empty fields zero](https://discuss.elastic.co/t/how-to-count-empty-fields-zero/364945)
**Author:** [@UMUT\_CAN\_ARGUN](https://discuss.elastic.co/u/UMUT_CAN_ARGUN)\ **Replies:** 2\ **Last updated:** [August 15, 2024, 11:08am UTC](https://discuss.elastic.co/t/how-to-count-empty-fields-zero/364945 "2024-08-15T11:08:06Z")
I have a dataset like this: As shown, there are some empty fields on the dataset. While indexing that file onto ES, I want to fill these empty fields with "0" automatically. How could I do that on Logstash? --- ## [Query Terms limit error](https://discuss.elastic.co/t/query-terms-limit-error/364948)
**Author:** [@cahl](https://discuss.elastic.co/u/cahl)\ **Replies:** 0\ **Last updated:** [August 15, 2024, 10:28am UTC](https://discuss.elastic.co/t/query-terms-limit-error/364948 "2024-08-15T10:28:56Z")
I read the terms is limited to around 65k on the default config. However, I am trying to make a query with around 2k values in the terms and it is failing. I notice if I use 665 works fine but if I add an extra value it … --- ## [Backing up Kibana dashboards](https://discuss.elastic.co/t/backing-up-kibana-dashboards/364944)
**Author:** [@it-intelliroad](https://discuss.elastic.co/u/it-intelliroad)\ **Replies:** 1\ **Last updated:** [August 15, 2024, 9:31am UTC](https://discuss.elastic.co/t/backing-up-kibana-dashboards/364944 "2024-08-15T09:31:43Z")
im pretty new to all of this, currently my setup consists of 3 ES instances and dockerized Kibana and Logstash. before i also had ES dockerized but i struggled with the backing FS as i used a networkFS with docker swarm… --- ## [How to load emails into ES instance](https://discuss.elastic.co/t/how-to-load-emails-into-es-instance/364730)
**Author:** [@jaime\_solas](https://discuss.elastic.co/u/jaime_solas)\ **Replies:** 21\ **Last updated:** [August 15, 2024, 8:40am UTC](https://discuss.elastic.co/t/how-to-load-emails-into-es-instance/364730 "2024-08-15T08:40:11Z")
Hello, I am trying to upload emails in xml format, these xml files were obtained using apache tika to convert the .eml files to .xml I'm trying to load the data into ES with logstash but it's not working and I think it'… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=184) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=186)