# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=186 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 187 --- ## [Unassigned shards with reason "ElasticSearch can allocate shards"](https://discuss.elastic.co/t/unassigned-shards-with-reason-elasticsearch-can-allocate-shards/364724)
**Author:** [@mukularora89](https://discuss.elastic.co/u/mukularora89)\ **Replies:** 8\ **Last updated:** [August 15, 2024, 6:27am UTC](https://discuss.elastic.co/t/unassigned-shards-with-reason-elasticsearch-can-allocate-shards/364724 "2024-08-15T06:27:07Z")
We have recently upgraded our cluster to ES 8.12.2. We are observing unassigned shards and on further looking cluster allocation explain API we could see that can\_allocate="yes" and allocate\_explanation "Elasticsearch ca… --- ## [Cannot setup winlogbeat error x509: certificate signed by unknown authority](https://discuss.elastic.co/t/cannot-setup-winlogbeat-error-x509-certificate-signed-by-unknown-authority/364937)
**Author:** [@Tola-Tole](https://discuss.elastic.co/u/Tola-Tole)\ **Replies:** 0\ **Last updated:** [August 15, 2024, 2:20am UTC](https://discuss.elastic.co/t/cannot-setup-winlogbeat-error-x509-certificate-signed-by-unknown-authority/364937 "2024-08-15T02:20:04Z")
currently i cant setup winlogbeat because error x509: certificate signed by unknown authority. just info i not using ssl / xpack. can i bypas this ssl on winlogbeat? Thanks --- ## [Cisco FTD Integration](https://discuss.elastic.co/t/cisco-ftd-integration/364935)
**Author:** [@checo2024](https://discuss.elastic.co/u/checo2024)\ **Replies:** 0\ **Last updated:** [August 14, 2024, 10:22pm UTC](https://discuss.elastic.co/t/cisco-ftd-integration/364935 "2024-08-14T22:22:35Z")
Hello, I've installed a Cisco FTD integration in Fleet Manager. While the integration went well, I am not receiving any logs from the Cisco FTD Firewall. Any advice in how to make it work? For that purpose, I have an… --- ## [Best way to deal with empty fields?](https://discuss.elastic.co/t/best-way-to-deal-with-empty-fields/364806)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 4\ **Last updated:** [August 14, 2024, 10:07pm UTC](https://discuss.elastic.co/t/best-way-to-deal-with-empty-fields/364806 "2024-08-14T22:07:42Z")
Hello, I have a field that seems to come in as "--" so I removed it. The due to removing it, the field now its "(empty)". The issue I want to filter out these fields but both appear: I even did "exists" and they bo… --- ## [ELK stack production servers for configurations](https://discuss.elastic.co/t/elk-stack-production-servers-for-configurations/364926)
**Author:** [@BevisDev](https://discuss.elastic.co/u/BevisDev)\ **Replies:** 1\ **Last updated:** [August 14, 2024, 7:05pm UTC](https://discuss.elastic.co/t/elk-stack-production-servers-for-configurations/364926 "2024-08-14T19:05:09Z")
Hi everyone, i am new in ELK Stack, i am interested to use ELK in production environment with purpose centralize logs all my application I need to your help to configure production server for below requirement. all my… --- ## [Elasticsearch rolling upgrade failed](https://discuss.elastic.co/t/elasticsearch-rolling-upgrade-failed/364907)
**Author:** [@rachelyang](https://discuss.elastic.co/u/rachelyang)\ **Replies:** 9\ **Last updated:** [August 14, 2024, 6:20pm UTC](https://discuss.elastic.co/t/elasticsearch-rolling-upgrade-failed/364907 "2024-08-14T18:20:58Z")
I did rolling upgrade for my cluster with two nodes from 8.8 to 8.15. I got 503 error. Here is the result. curl -X GET -k -u elastic:PASSWORD 'https://localhost:9200' {"error":{"root\_cause":\[{"type":"status\_exception","… --- ## [Adjusting Field Boost Based on Indexed Scores in Elasticsearch](https://discuss.elastic.co/t/adjusting-field-boost-based-on-indexed-scores-in-elasticsearch/364826)
**Author:** [@Gokhan\_Gunes](https://discuss.elastic.co/u/Gokhan_Gunes)\ **Replies:** 2\ **Last updated:** [August 14, 2024, 5:49pm UTC](https://discuss.elastic.co/t/adjusting-field-boost-based-on-indexed-scores-in-elasticsearch/364826 "2024-08-14T17:49:25Z")
Description: I’m working on an e-commerce site where products are indexed in Elasticsearch. Users search through fields like brand, publisher, product\_name, and category. I typically give the highest boost to the name f… --- ## [PFsense integration cannot parse OPNSense ISC DHCP logs properly](https://discuss.elastic.co/t/pfsense-integration-cannot-parse-opnsense-isc-dhcp-logs-properly/364916)
**Author:** [@pcollardez](https://discuss.elastic.co/u/pcollardez)\ **Replies:** 1\ **Last updated:** [August 14, 2024, 4:07pm UTC](https://discuss.elastic.co/t/pfsense-integration-cannot-parse-opnsense-isc-dhcp-logs-properly/364916 "2024-08-14T16:07:41Z")
Hello, The PFSense integration cannot parse OPNSense DHCPv4 logs properly. OS: Debian 11.10 (x86\_64) PFSense integration: 1.19.1 ELK: 8.14.3 Elastic Agent: 8.14.3 OPNSense: 24.7\_9 ISC DHCPv4: 4.4.3P1\_1 For exampl… --- ## [Issue during version upgrade from 7.17.8 to 8.12.2](https://discuss.elastic.co/t/issue-during-version-upgrade-from-7-17-8-to-8-12-2/361491)
**Author:** [@mukularora89](https://discuss.elastic.co/u/mukularora89)\ **Replies:** 7\ **Last updated:** [August 14, 2024, 2:52pm UTC](https://discuss.elastic.co/t/issue-during-version-upgrade-from-7-17-8-to-8-12-2/361491 "2024-08-14T14:52:26Z")
Hi, I am trying to upgrade Kibana node from 7.17.8 to 8.12.2. So first we have installed Elasticsearch 8.12.2 on Kibana node and on elasticsearch service start I am getting below error java.lang.NullPointerException: … --- ## [Fleet Logstash resets back to default setting](https://discuss.elastic.co/t/fleet-logstash-resets-back-to-default-setting/364911)
**Author:** [@Matthew\_Wilhelm](https://discuss.elastic.co/u/Matthew_Wilhelm)\ **Replies:** 5\ **Last updated:** [August 14, 2024, 2:45pm UTC](https://discuss.elastic.co/t/fleet-logstash-resets-back-to-default-setting/364911 "2024-08-14T14:45:28Z")
Hello everyone, When I either try to add a row to logstash hosts in the grid-logstash or create my own object with it being the default for agent integrations and agent monitoring. After about 5 minutes it resets to the… --- ## [Runtime Mapping agg query error](https://discuss.elastic.co/t/runtime-mapping-agg-query-error/364883)
**Author:** [@Vivek\_Burman](https://discuss.elastic.co/u/Vivek_Burman)\ **Replies:** 1\ **Last updated:** [August 14, 2024, 2:41pm UTC](https://discuss.elastic.co/t/runtime-mapping-agg-query-error/364883 "2024-08-14T14:41:27Z")
Can you help me the understand the meaning of this error. Added query, response and index mapping Query: { "runtime\_mappings": { "count\_defect": { "type": "long", "script": "emit(doc… --- ## [Watcher - Creating a Payload](https://discuss.elastic.co/t/watcher-creating-a-payload/364909)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 0\ **Last updated:** [August 14, 2024, 1:56pm UTC](https://discuss.elastic.co/t/watcher-creating-a-payload/364909 "2024-08-14T13:56:45Z")
Hello, Is there a way to create a new payload in the condition portion of watcher? I have this watcher that evaluates buckets, it checks to see if the buckets pass a condition. The issue I want to filter out the bucket… --- ## [Vulnerable Java version bundled with 8.14.3 & 8.15](https://discuss.elastic.co/t/vulnerable-java-version-bundled-with-8-14-3-8-15/364861)
**Author:** [@dan\_walker](https://discuss.elastic.co/u/dan_walker)\ **Replies:** 5\ **Last updated:** [August 14, 2024, 1:37pm UTC](https://discuss.elastic.co/t/vulnerable-java-version-bundled-with-8-14-3-8-15/364861 "2024-08-14T13:37:14Z")
Java 22.0.1 contains a HIGH vulnerability, as indicated by CVEs reported in July 2024. This version is/was bundled with ES 8.14.3. I was expecting a version patch to be included in the next ES release, but looking at th… --- ## [Merge entries of data view](https://discuss.elastic.co/t/merge-entries-of-data-view/364841)
**Author:** [@sz118](https://discuss.elastic.co/u/sz118)\ **Replies:** 1\ **Last updated:** [August 14, 2024, 12:05pm UTC](https://discuss.elastic.co/t/merge-entries-of-data-view/364841 "2024-08-14T12:05:50Z")
Hello everyone, I’m new to Kibana and I’d like to find a way to merge the entries of my data view. The data view contains field2 with the values “Verification passed…” or “Verification failed…” and a following string. … --- ## [Elasticsearch snapshot issue in kubernets](https://discuss.elastic.co/t/elasticsearch-snapshot-issue-in-kubernets/364878)
**Author:** [@Nauman\_Kyani](https://discuss.elastic.co/u/Nauman_Kyani)\ **Replies:** 17\ **Last updated:** [August 14, 2024, 11:57am UTC](https://discuss.elastic.co/t/elasticsearch-snapshot-issue-in-kubernets/364878 "2024-08-14T11:57:54Z")
Hi , I am currently running an Elasticsearch cluster on Kubernetes using the Elastic Operator. My setup includes 3 master nodes, 2 client nodes, and 3 worker nodes. I have configured the cluster to use an NFS path for s… --- ## [ElasticSearch Highlighting not doing what I would expect](https://discuss.elastic.co/t/elasticsearch-highlighting-not-doing-what-i-would-expect/364831)
**Author:** [@Akesh\_Jadhav](https://discuss.elastic.co/u/Akesh_Jadhav)\ **Replies:** 3\ **Last updated:** [August 14, 2024, 10:07am UTC](https://discuss.elastic.co/t/elasticsearch-highlighting-not-doing-what-i-would-expect/364831 "2024-08-14T10:07:56Z")
Hi, I am performing one regex query on the keyword field POST 1101741821\_mails/\_search { "query": { "regexp": { "body.not\_analyzed": ".hello my." } }, "highlight": { "fields": { "body.not\_analyzed": { "pre\_ta… --- ## [Is it possible to use ScoreFunctionBuilder/ScoreFunction plugin within script\_score query?](https://discuss.elastic.co/t/is-it-possible-to-use-scorefunctionbuilder-scorefunction-plugin-within-script-score-query/364904)
**Author:** [@maartenkroon](https://discuss.elastic.co/u/maartenkroon)\ **Replies:** 0\ **Last updated:** [August 14, 2024, 10:03am UTC](https://discuss.elastic.co/t/is-it-possible-to-use-scorefunctionbuilder-scorefunction-plugin-within-script-score-query/364904 "2024-08-14T10:03:28Z")
Hi, I have developed a custom ScoreFunctionBuilder / ScoreFunction as part of Elasticsearch SearchPlugin. I now can use this function "my\_function" within an Elasticsearch query as part of a function\_score query like: {… --- ## [Security Warning: Multiple Node.js Vulnerabilities Detected in Elasticsearch](https://discuss.elastic.co/t/security-warning-multiple-node-js-vulnerabilities-detected-in-elasticsearch/364895)
**Author:** [@letsdiscusselasticse](https://discuss.elastic.co/u/letsdiscusselasticse)\ **Replies:** 0\ **Last updated:** [August 14, 2024, 8:13am UTC](https://discuss.elastic.co/t/security-warning-multiple-node-js-vulnerabilities-detected-in-elasticsearch/364895 "2024-08-14T08:13:43Z")
Hello everyone, I've run into a security issue flagged by my Nessus scanner related to the version of Node.js installed on my Elasticsearch server. According to the scan, several vulnerabilities have been detected, affe… --- ## [Ingest data from AWS Kinesis Data Firehose](https://discuss.elastic.co/t/ingest-data-from-aws-kinesis-data-firehose/363540)
**Author:** [@noor.muradi](https://discuss.elastic.co/u/noor.muradi)\ **Replies:** 1\ **Last updated:** [August 14, 2024, 7:32am UTC](https://discuss.elastic.co/t/ingest-data-from-aws-kinesis-data-firehose/363540 "2024-08-14T07:32:41Z")
I have ECK cluster, and I want to ingest AWS WAF logs to elastic using Kineses Data Firehose, created encoded api key in Kibana with superuser role, in Kenises data firehose, have configured destination endpoint with ela… --- ## [Two string fields, one with .text suffix](https://discuss.elastic.co/t/two-string-fields-one-with-text-suffix/364682)
**Author:** [@Rihards](https://discuss.elastic.co/u/Rihards)\ **Replies:** 3\ **Last updated:** [August 14, 2024, 6:51am UTC](https://discuss.elastic.co/t/two-string-fields-one-with-text-suffix/364682 "2024-08-14T06:51:47Z")
In Kibana, viewing security alerts, presumably from an Elastic-defined rule. There are some fields that seem to be duplicated, just with a .text suffix added. They both seem to be of the same type, "String field" (no… --- ## [.NET new client migration issue](https://discuss.elastic.co/t/net-new-client-migration-issue/364774)
**Author:** [@jahedi](https://discuss.elastic.co/u/jahedi)\ **Replies:** 3\ **Last updated:** [August 14, 2024, 5:14am UTC](https://discuss.elastic.co/t/net-new-client-migration-issue/364774 "2024-08-14T05:14:15Z")
Hi, I am currently using v7 Elastic .NET client Nest. I want to migrate to the new Elastic.Client.Elasticsearch package v8. I have problems with this package's documentations and I can not find proper docs to use this … --- ## [On premise elasticsearch and kibana license](https://discuss.elastic.co/t/on-premise-elasticsearch-and-kibana-license/364866)
**Author:** [@TheGreatBaldOne](https://discuss.elastic.co/u/TheGreatBaldOne)\ **Replies:** 2\ **Last updated:** [August 14, 2024, 4:08am UTC](https://discuss.elastic.co/t/on-premise-elasticsearch-and-kibana-license/364866 "2024-08-14T04:08:50Z")
Ok so i read here that elasticsearch, with the basic license is free if self managed. I understand if i am a cloud provider( which i am not ) that does not apply for me. Are there other maybe limits in total cpu or ram… --- ## [Hi i have question about cancel\_after\_time\_interval option](https://discuss.elastic.co/t/hi-i-have-question-about-cancel-after-time-interval-option/364877)
**Author:** [@slowup](https://discuss.elastic.co/u/slowup)\ **Replies:** 0\ **Last updated:** [August 14, 2024, 2:48am UTC](https://discuss.elastic.co/t/hi-i-have-question-about-cancel-after-time-interval-option/364877 "2024-08-14T02:48:27Z")
i have any question The timeout option removes the output of a specific shard and responds within the exception time if a specific shard does not respond for more than that number of seconds. What is the cancel\_after\_t… --- ## [Synonyms returning no\_such\_file\_exception exceptin](https://discuss.elastic.co/t/synonyms-returning-no-such-file-exception-exceptin/364875)
**Author:** [@ryoga](https://discuss.elastic.co/u/ryoga)\ **Replies:** 0\ **Last updated:** [August 14, 2024, 1:54am UTC](https://discuss.elastic.co/t/synonyms-returning-no-such-file-exception-exceptin/364875 "2024-08-14T01:54:43Z")
Elasticsearch 8.15. Followed the instructions to upload synonyms file inside a zip file /dictionaries/synonyms.txt using custom bundles ( Upload custom plugins and bundles | Elasticsearch Service Documentation | Elastic)… --- ## [Alerting Issue - Can't Save Rule after turning off Match Query](https://discuss.elastic.co/t/alerting-issue-cant-save-rule-after-turning-off-match-query/364856)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 0\ **Last updated:** [August 13, 2024, 7:17pm UTC](https://discuss.elastic.co/t/alerting-issue-cant-save-rule-after-turning-off-match-query/364856 "2024-08-13T19:17:08Z")
Hello, I am using Metric Threshold and I noticed that everytime I create a rule. I see that if I deselect the "If alert matches a query" It stops me from saving my rule. The there's no way to stop this unless I add… --- ## [Icu\_normalizer is not working](https://discuss.elastic.co/t/icu-normalizer-is-not-working/364858)
**Author:** [@Aliaksandr\_Khramtsov](https://discuss.elastic.co/u/Aliaksandr_Khramtsov)\ **Replies:** 0\ **Last updated:** [August 13, 2024, 7:26pm UTC](https://discuss.elastic.co/t/icu-normalizer-is-not-working/364858 "2024-08-13T19:26:10Z")
GET /\_cat/plugins?v=true&s=component&h=name,component,version,description name component version description es01 analysis-icu 8.12.2 The ICU Analysis plugin integrates the Lucene ICU module into Elastics… --- ## [o.e.d.HandshakingTransportAddressConnector](https://discuss.elastic.co/t/o-e-d-handshakingtransportaddressconnector/364855)
**Author:** [@Varinder](https://discuss.elastic.co/u/Varinder)\ **Replies:** 0\ **Last updated:** [August 13, 2024, 6:55pm UTC](https://discuss.elastic.co/t/o-e-d-handshakingtransportaddressconnector/364855 "2024-08-13T18:55:56Z")
\[WARN \]\[o.e.d.HandshakingTransportAddressConnector\] \[localhost.localdomain\] handshake to \[127.0.0.1:9300\] failed org.elasticsearch.transport.RemoteTransportException: \[localhost.localdomain\]\[127.0.0.1:9300\]\[internal:tra… --- ## [Regarding the error message when clicking the Validate Repository button in Elasticsearch snapshot function](https://discuss.elastic.co/t/regarding-the-error-message-when-clicking-the-validate-repository-button-in-elasticsearch-snapshot-function/363333)
**Author:** [@YUUTA.INOUE-JPN](https://discuss.elastic.co/u/YUUTA.INOUE-JPN)\ **Replies:** 4\ **Last updated:** [August 13, 2024, 6:11pm UTC](https://discuss.elastic.co/t/regarding-the-error-message-when-clicking-the-validate-repository-button-in-elasticsearch-snapshot-function/363333 "2024-08-13T18:11:14Z")
Hello from Japan I have a question for all the dear Elastic engineers I want to use the snapshot function to save a snapshot on one node in a cluster. \*I have configured a cluster of three Elasticsearch machines. I h… --- ## [Logstash Stops Very Frequently](https://discuss.elastic.co/t/logstash-stops-very-frequently/364843)
**Author:** [@awesomeparam](https://discuss.elastic.co/u/awesomeparam)\ **Replies:** 2\ **Last updated:** [August 13, 2024, 5:49pm UTC](https://discuss.elastic.co/t/logstash-stops-very-frequently/364843 "2024-08-13T17:49:45Z")
Using the version 5.6.2 of Logstash, and I see lot of times the following message in the logstash-json.log file {"level":"ERROR","loggerName":"logstash.shutdownwatcher","timeMillis":1723464009728,"thread":"Ruby-0-Thread… --- ## [Elatic Search Index ILM Policies comfigs](https://discuss.elastic.co/t/elatic-search-index-ilm-policies-comfigs/364837)
**Author:** [@RAVI\_GOPALANI](https://discuss.elastic.co/u/RAVI_GOPALANI)\ **Replies:** 3\ **Last updated:** [August 13, 2024, 5:34pm UTC](https://discuss.elastic.co/t/elatic-search-index-ilm-policies-comfigs/364837 "2024-08-13T17:34:45Z")
Hi Elastic search team, We want implement hot, cold , warm tier in index ILM. So, we know how ro define cofigs but how we can map those tier with storage Lets say hot tier keep index data for initially 30 days with sto… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=185) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=187)