# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=188 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 189 --- ## [Can't see Jolokia integration on Elastic Agent](https://discuss.elastic.co/t/cant-see-jolokia-integration-on-elastic-agent/364775)
**Author:** [@Ronaldo\_Lanhellas](https://discuss.elastic.co/u/Ronaldo_Lanhellas)\ **Replies:** 1\ **Last updated:** [August 12, 2024, 1:11pm UTC](https://discuss.elastic.co/t/cant-see-jolokia-integration-on-elastic-agent/364775 "2024-08-12T13:11:33Z")
I'm using Jolokia (JMX) for a log time with vanilla metricbeat, now migrating to elastic agent I can't find the Jolokia on Kibana, in Fleet menu. (Jolokia Input | Documentation) --- ## [Creating a seperate index for conflicting logs](https://discuss.elastic.co/t/creating-a-seperate-index-for-conflicting-logs/364563)
**Author:** [@calbertan](https://discuss.elastic.co/u/calbertan)\ **Replies:** 2\ **Last updated:** [August 12, 2024, 1:01pm UTC](https://discuss.elastic.co/t/creating-a-seperate-index-for-conflicting-logs/364563 "2024-08-12T13:01:01Z")
log a has field "ts" of type float log b has field "ts" of type date This is causing a WARN - cannot create index Ideally, I don't want to have to drop one of the logs, so I wanted to create a index specifically for l… --- ## [Automating Rule Creation for Kibana](https://discuss.elastic.co/t/automating-rule-creation-for-kibana/361603)
**Author:** [@Emin](https://discuss.elastic.co/u/Emin)\ **Replies:** 14\ **Last updated:** [August 12, 2024, 12:45pm UTC](https://discuss.elastic.co/t/automating-rule-creation-for-kibana/361603 "2024-08-12T12:45:23Z")
I am trying to automate rule creation, updating and deletion via a Python script. I have tried both using curl and Python I use curl to create the rule: curl -k -X POST "https://192.168.10.131:5601/api/detection\_engine/… --- ## [Boolean Queries in Net Client](https://discuss.elastic.co/t/boolean-queries-in-net-client/364337)
**Author:** [@alikleitcr7](https://discuss.elastic.co/u/alikleitcr7)\ **Replies:** 5\ **Last updated:** [August 12, 2024, 11:07am UTC](https://discuss.elastic.co/t/boolean-queries-in-net-client/364337 "2024-08-12T11:07:59Z")
Hello, As pointed out by @flobernd in my Github Issue related to working with the latest net client that the documentation for the latest is very sparse. Therefore, I'm trying to manage the AND operator in the Bool que… --- ## [403 Forbidden\\nPOST when verifying the repository of the snapshot](https://discuss.elastic.co/t/403-forbidden-npost-when-verifying-the-repository-of-the-snapshot/364768)
**Author:** [@tfkben](https://discuss.elastic.co/u/tfkben)\ **Replies:** 0\ **Last updated:** [August 12, 2024, 9:44am UTC](https://discuss.elastic.co/t/403-forbidden-npost-when-verifying-the-repository-of-the-snapshot/364768 "2024-08-12T09:44:33Z")
i have Elasticsearch and kibana installed in kubernetes (GKE) cluster with eck-operator i have a snapshots in GCS created from my old infrastructure in docker before adding the repository i create a service account wii… --- ## [Elasticsearch 8.14 Upgrade: Resource Already exists exception](https://discuss.elastic.co/t/elasticsearch-8-14-upgrade-resource-already-exists-exception/364765)
**Author:** [@Abhishek\_Soni1](https://discuss.elastic.co/u/Abhishek_Soni1)\ **Replies:** 3\ **Last updated:** [August 12, 2024, 9:34am UTC](https://discuss.elastic.co/t/elasticsearch-8-14-upgrade-resource-already-exists-exception/364765 "2024-08-12T09:34:17Z")
Hi I am trying to upgrade elasticsearch from 7.17 to 8.14.3, during upgrade, I found these exceptions, I don't know how to solve it. \[2024-08-12T03:31:11,986\]\[DEBUG\]\[o.e.a.s.m.TransportMasterNodeAction\] \[achillelheel01\]… --- ## [Any default processor running in Filebeat?](https://discuss.elastic.co/t/any-default-processor-running-in-filebeat/364040)
**Author:** [@hjazz6](https://discuss.elastic.co/u/hjazz6)\ **Replies:** 2\ **Last updated:** [August 12, 2024, 8:57am UTC](https://discuss.elastic.co/t/any-default-processor-running-in-filebeat/364040 "2024-08-12T08:57:51Z")
Hi, I was reading this Github thread, and the writer mentioned running netflow/filebeat through agent (aka default processors enabled) increases each event by 80% in size. Thus a good performance optimisation, when w… --- ## [Very slow aggregate query with 15 M of records](https://discuss.elastic.co/t/very-slow-aggregate-query-with-15-m-of-records/364742)
**Author:** [@DevYSM](https://discuss.elastic.co/u/DevYSM)\ **Replies:** 6\ **Last updated:** [August 12, 2024, 8:21am UTC](https://discuss.elastic.co/t/very-slow-aggregate-query-with-15-m-of-records/364742 "2024-08-12T08:21:35Z")
Hello, I have an index that has more than 15M records of website logs but while I'm trying to do an aggregation to sum the total of some fields the request takes a long time more than 10 seconds and after that gives me a… --- ## [Logstash Vulnerability scanner, High CPU utilization](https://discuss.elastic.co/t/logstash-vulnerability-scanner-high-cpu-utilization/363042)
**Author:** [@amaljoy](https://discuss.elastic.co/u/amaljoy)\ **Replies:** 4\ **Last updated:** [August 12, 2024, 6:44am UTC](https://discuss.elastic.co/t/logstash-vulnerability-scanner-high-cpu-utilization/363042 "2024-08-12T06:44:42Z")
There is a vulnerability scan and penetration testing done from tenable.io / nessus server in our logstash server. This is my input plugin config in logstash. input { syslog { id =\> "idsyslog" host =\> "0.0.0.0" … --- ## [Received an event that has a different character encoding than you configured - Logstash CPU](https://discuss.elastic.co/t/received-an-event-that-has-a-different-character-encoding-than-you-configured-logstash-cpu/361297)
**Author:** [@amaljoy](https://discuss.elastic.co/u/amaljoy)\ **Replies:** 9\ **Last updated:** [August 12, 2024, 6:42am UTC](https://discuss.elastic.co/t/received-an-event-that-has-a-different-character-encoding-than-you-configured-logstash-cpu/361297 "2024-08-12T06:42:35Z")
Hi Guys, I received an unknown event from the syslog server. Received an event that has a different character encoding than you configured. {:text=\>"\\\\xC0\\\\u0014\\\\u00009\\\\u00008\\\\u0000\\\\x88\\\\u0000\\\\x87\\\\xC0\\\\u0019\\\\u0… --- ## [Elastic Search Regex are not working as expected](https://discuss.elastic.co/t/elastic-search-regex-are-not-working-as-expected/364651)
**Author:** [@Akesh\_Jadhav](https://discuss.elastic.co/u/Akesh_Jadhav)\ **Replies:** 5\ **Last updated:** [August 12, 2024, 5:02am UTC](https://discuss.elastic.co/t/elastic-search-regex-are-not-working-as-expected/364651 "2024-08-12T05:02:38Z")
have go the problem in making Elasticsearch regex work. I have a document that looks like this: {"content": "My name is Akesh Jadhav."} I have tried the following regex "Akesh\\sJadhav" to match the Akesh Jadhav with th… --- ## [Phrase prefix query is not working with pagination](https://discuss.elastic.co/t/phrase-prefix-query-is-not-working-with-pagination/364657)
**Author:** [@Aryan11](https://discuss.elastic.co/u/Aryan11)\ **Replies:** 2\ **Last updated:** [August 12, 2024, 4:39am UTC](https://discuss.elastic.co/t/phrase-prefix-query-is-not-working-with-pagination/364657 "2024-08-12T04:39:09Z")
The following query does not give any results when the from parameter is greater than 50. The number of hits also reduces as this parameter is gradulaly increased from 0. This works as expected if the query type is bool\_… --- ## [Unable to set \_id in bulk index with raw source documents](https://discuss.elastic.co/t/unable-to-set-id-in-bulk-index-with-raw-source-documents/364737)
**Author:** [@VenkatSana](https://discuss.elastic.co/u/VenkatSana)\ **Replies:** 3\ **Last updated:** [August 12, 2024, 2:34am UTC](https://discuss.elastic.co/t/unable-to-set-id-in-bulk-index-with-raw-source-documents/364737 "2024-08-12T02:34:42Z")
I've tried to bulk index a bunch of JSON raw records into ES, and I needed to set custom \_id values for them. Individual indexing works by calling "IndexQueryBuilder().withId(some\_id\_value)" and then calling the individu… --- ## [Examples for Elastic Span compression](https://discuss.elastic.co/t/examples-for-elastic-span-compression/364186)
**Author:** [@navya\_k](https://discuss.elastic.co/u/navya_k)\ **Replies:** 2\ **Last updated:** [August 12, 2024, 1:48am UTC](https://discuss.elastic.co/t/examples-for-elastic-span-compression/364186 "2024-08-12T01:48:24Z")
Hello Team, Need help on span compression.currently we are using 8.13 and would like to understand span compression as it reduce overhead on cluster. As part of eligibility I read exit spans are eligible. In elastic h… --- ## [Elasticsearch service not strated](https://discuss.elastic.co/t/elasticsearch-service-not-strated/364699)
**Author:** [@SAMY-ELK](https://discuss.elastic.co/u/SAMY-ELK)\ **Replies:** 1\ **Last updated:** [August 11, 2024, 5:54pm UTC](https://discuss.elastic.co/t/elasticsearch-service-not-strated/364699 "2024-08-11T17:54:27Z")
hello, i cannot start service elasticsearch after unpatch/uninstall readonlyrest Plugin. log Error : Aug 09 10:26:57 SRV027 systemd-entrypoint\[660337\]: Error: Could not find or load main class org.elasticsearch.common… --- ## [How can I use stopFilter for english and french words in a unique match query?](https://discuss.elastic.co/t/how-can-i-use-stopfilter-for-english-and-french-words-in-a-unique-match-query/364741)
**Author:** [@Yoann\_Buzenet](https://discuss.elastic.co/u/Yoann_Buzenet)\ **Replies:** 4\ **Last updated:** [August 11, 2024, 1:56pm UTC](https://discuss.elastic.co/t/how-can-i-use-stopfilter-for-english-and-french-words-in-a-unique-match-query/364741 "2024-08-11T13:56:02Z")
Hello, In my match query, { "query": { "match": { "message": { "query": "Quick foxes", "analyzer": "stop" } } } } I would like to use a stop filter for English AND french words … --- ## [Reconcile data in ElasticSearch using logstash filter or output plugin](https://discuss.elastic.co/t/reconcile-data-in-elasticsearch-using-logstash-filter-or-output-plugin/363317)
**Author:** [@vvavad](https://discuss.elastic.co/u/vvavad)\ **Replies:** 4\ **Last updated:** [August 10, 2024, 11:13am UTC](https://discuss.elastic.co/t/reconcile-data-in-elasticsearch-using-logstash-filter-or-output-plugin/363317 "2024-08-10T11:13:27Z")
I have a Elasticsearch index(index1) with document structure { "id": "id1", "addresses": \[ {"address": "a11","address\_2": "a21","city": "c1","state": "s1","zip": "12345","phone": "9191919191"}, \], "field1": "f1", "fi… --- ## [Kibana doesn't start](https://discuss.elastic.co/t/kibana-doesnt-start/364709)
**Author:** [@UMUT\_CAN\_ARGUN](https://discuss.elastic.co/u/UMUT_CAN_ARGUN)\ **Replies:** 2\ **Last updated:** [August 10, 2024, 9:52am UTC](https://discuss.elastic.co/t/kibana-doesnt-start/364709 "2024-08-10T09:52:46Z")
I got that error when I tried to start the kibana. I reinstalled kibana after i got the error for the first time but it has shown again: --- ## [Why ES doesn't have search-failure-rate metric?](https://discuss.elastic.co/t/why-es-doesnt-have-search-failure-rate-metric/363936)
**Author:** [@Ferrari248](https://discuss.elastic.co/u/Ferrari248)\ **Replies:** 1\ **Last updated:** [August 10, 2024, 4:48am UTC](https://discuss.elastic.co/t/why-es-doesnt-have-search-failure-rate-metric/363936 "2024-08-10T04:48:58Z")
Now I have a requirement: to get the real-time indexing and search statistics of failure rate, prefer to call ES server API. I have tried ES 7.X and 8.X, found that we have indexing-failure-rate metric, but doesn't have… --- ## [Not send logs to elasticsearch](https://discuss.elastic.co/t/not-send-logs-to-elasticsearch/363017)
**Author:** [@Prabhath\_samarasingh](https://discuss.elastic.co/u/Prabhath_samarasingh)\ **Replies:** 9\ **Last updated:** [August 9, 2024, 10:53pm UTC](https://discuss.elastic.co/t/not-send-logs-to-elasticsearch/363017 "2024-08-09T22:53:19Z")
filebeat.yml filebeat.inputs: - type: container enabled: true paths: - /var/lib/docker/containers/\*/\*.log processors: - add\_docker\_metadata: ~ output.elasticsearch: hosts: \["172.20.111.199:9200"\] pipe… --- ## [Logstash 8.14.3 not logging to /var/log/logstash](https://discuss.elastic.co/t/logstash-8-14-3-not-logging-to-var-log-logstash/364721)
**Author:** [@apal](https://discuss.elastic.co/u/apal)\ **Replies:** 2\ **Last updated:** [August 9, 2024, 9:08pm UTC](https://discuss.elastic.co/t/logstash-8-14-3-not-logging-to-var-log-logstash/364721 "2024-08-09T21:08:10Z")
Hi, This is my log4j2.properties: # status = error status = info name = LogstashPropertiesConfig appender.console.type = Console appender.console.name = plain\_console appender.console.layout.type = PatternLayout appen… --- ## [Metricbeat inside a podman container](https://discuss.elastic.co/t/metricbeat-inside-a-podman-container/364717)
**Author:** [@mommo](https://discuss.elastic.co/u/mommo)\ **Replies:** 0\ **Last updated:** [August 9, 2024, 7:24pm UTC](https://discuss.elastic.co/t/metricbeat-inside-a-podman-container/364717 "2024-08-09T19:24:38Z")
when inserting the following line in podman-compose.yml I'm getting this error: Exiting: could not initialize the keystore: open /usr/share/metricbeat/data/metricbeat.keystore: permission denied And the container doesn… --- ## [Consistent Query Impact on Sharding and Health in Elasticsearch](https://discuss.elastic.co/t/consistent-query-impact-on-sharding-and-health-in-elasticsearch/364707)
**Author:** [@sanjaygorur](https://discuss.elastic.co/u/sanjaygorur)\ **Replies:** 4\ **Last updated:** [August 9, 2024, 6:21pm UTC](https://discuss.elastic.co/t/consistent-query-impact-on-sharding-and-health-in-elasticsearch/364707 "2024-08-09T18:21:30Z")
We are using elasticsearch version 1.4, and have a looping pagination query used to collect docs from one index. How does querying an entry in elasticsearch repeatedly have an impact on sharding, and why would it have a… --- ## [How to configure filbeat to forward data/syslogs to logstash on 2 different ports](https://discuss.elastic.co/t/how-to-configure-filbeat-to-forward-data-syslogs-to-logstash-on-2-different-ports/364506)
**Author:** [@hydroponics](https://discuss.elastic.co/u/hydroponics)\ **Replies:** 3\ **Last updated:** [August 9, 2024, 6:16pm UTC](https://discuss.elastic.co/t/how-to-configure-filbeat-to-forward-data-syslogs-to-logstash-on-2-different-ports/364506 "2024-08-09T18:16:16Z")
I've a device syslogs where its being sent to filebeat on 2different ports, as its planned to forward from logstash to 2 different places like DataCenter-1 Elastic search and other place like external server as syslog it… --- ## [JDBC input has irregular schedule intervals](https://discuss.elastic.co/t/jdbc-input-has-irregular-schedule-intervals/364252)
**Author:** [@Mahdi\_Moazami](https://discuss.elastic.co/u/Mahdi_Moazami)\ **Replies:** 6\ **Last updated:** [August 9, 2024, 5:21pm UTC](https://discuss.elastic.co/t/jdbc-input-has-irregular-schedule-intervals/364252 "2024-08-09T17:21:47Z")
Hi Elastic team, We have about 300 pipelines setup which have JDBC inputs that fetches data from different databases landed on a central SQL server. All of the JDBC inputs have a schedule set on \*/5 \* \* \* \* (every 5 mi… --- ## [No search context found for id](https://discuss.elastic.co/t/no-search-context-found-for-id/364655)
**Author:** [@yaowenfeng998](https://discuss.elastic.co/u/yaowenfeng998)\ **Replies:** 1\ **Last updated:** [August 9, 2024, 5:19pm UTC](https://discuss.elastic.co/t/no-search-context-found-for-id/364655 "2024-08-09T17:19:21Z")
I have a problem. elasticsearch queries data in batches by scroll. no matter how big the batch number is, only the data of the first batch can be queried. no search context found for id... Is the timeout period of the co… --- ## [Exim\_Main logs ingest pipeline](https://discuss.elastic.co/t/exim-main-logs-ingest-pipeline/364698)
**Author:** [@gareth-armstrong](https://discuss.elastic.co/u/gareth-armstrong)\ **Replies:** 0\ **Last updated:** [August 9, 2024, 3:53pm UTC](https://discuss.elastic.co/t/exim-main-logs-ingest-pipeline/364698 "2024-08-09T15:53:20Z")
Hi guys, I've got 4 exim servers that I want to collect the exim\_main log data from, and then present it in grafana dashboards, or possibly run investigations from the data in support of some email related issues that m… --- ## [Error: EACCES: permission denied, open '/usr/share/kibana/cert/elastic-certificates.key'](https://discuss.elastic.co/t/error-eacces-permission-denied-open-usr-share-kibana-cert-elastic-certificates-key/364690)
**Author:** [@Amol\_Nagotkar](https://discuss.elastic.co/u/Amol_Nagotkar)\ **Replies:** 0\ **Last updated:** [August 9, 2024, 2:39pm UTC](https://discuss.elastic.co/t/error-eacces-permission-denied-open-usr-share-kibana-cert-elastic-certificates-key/364690 "2024-08-09T14:39:14Z")
Hi all, getting error Error: EACCES: permission denied, open '/usr/share/kibana/cert/elastic-certificates.key' -----------------inside docker compose ------------ elasticsearch: image: docker.elastic.co/elasticsearch… --- ## [Rename processor throwing error when trying to rename "level" to "log.level"](https://discuss.elastic.co/t/rename-processor-throwing-error-when-trying-to-rename-level-to-log-level/364639)
**Author:** [@chsing](https://discuss.elastic.co/u/chsing)\ **Replies:** 5\ **Last updated:** [August 9, 2024, 1:57pm UTC](https://discuss.elastic.co/t/rename-processor-throwing-error-when-trying-to-rename-level-to-log-level/364639 "2024-08-09T13:57:49Z")
I am trying to use the rename processor with field: "level" and target\_field: "log.level." I am getting this error: "error": { "type": "illegal\_argument\_exception", "reason": "cannot set \[level\] with… --- ## [A question for the "Stopping watcher service" message](https://discuss.elastic.co/t/a-question-for-the-stopping-watcher-service-message/364642)
**Author:** [@chulkim](https://discuss.elastic.co/u/chulkim)\ **Replies:** 2\ **Last updated:** [August 9, 2024, 1:57pm UTC](https://discuss.elastic.co/t/a-question-for-the-stopping-watcher-service-message/364642 "2024-08-09T13:57:44Z")
Does anyone know what could cause the following message in the log? stopping watch service, reason \[watcher manually marked to shutdown by cluster state update\] The service looks like stopped but not sure what could ca… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=187) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=189)