# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=191 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 192 --- ## [Email Connector: Multiple Responses In the Body, How to Separate](https://discuss.elastic.co/t/email-connector-multiple-responses-in-the-body-how-to-separate/363666)
**Author:** [@dune](https://discuss.elastic.co/u/dune)\ **Replies:** 2\ **Last updated:** [August 6, 2024, 6:37pm UTC](https://discuss.elastic.co/t/email-connector-multiple-responses-in-the-body-how-to-separate/363666 "2024-08-06T18:37:12Z")
Hello Elastic Team Member We have configured an Alert from a saved search. Job Runs every 15 minutes per 15 minutes of query history to retrieve document information. How can I space out each document entry response wh… --- ## [Tier Preference is not using the secondary option for replica](https://discuss.elastic.co/t/tier-preference-is-not-using-the-secondary-option-for-replica/364008)
**Author:** [@jsheely](https://discuss.elastic.co/u/jsheely)\ **Replies:** 4\ **Last updated:** [August 6, 2024, 5:55pm UTC](https://discuss.elastic.co/t/tier-preference-is-not-using-the-secondary-option-for-replica/364008 "2024-08-06T17:55:13Z")
I am trying to utilize the \_tier\_preference setting of "data\_hot,data\_warm" so that all of my new indexes primary goes onto the HOT node and the replica for that index goes onto the WARM node. However it ups the data on… --- ## [Working with dates](https://discuss.elastic.co/t/working-with-dates/364491)
**Author:** [@UMUT\_CAN\_ARGUN](https://discuss.elastic.co/u/UMUT_CAN_ARGUN)\ **Replies:** 1\ **Last updated:** [August 6, 2024, 5:32pm UTC](https://discuss.elastic.co/t/working-with-dates/364491 "2024-08-06T17:32:30Z")
Hello Everyone I have a csv file(uploaded successfully into the elastic): but I cannot create a visualisation of how many companies founded in each year. I'm completely new to the ELK, can you help me? --- ## [Data stream index template is resetting](https://discuss.elastic.co/t/data-stream-index-template-is-resetting/363307)
**Author:** [@jsheely](https://discuss.elastic.co/u/jsheely)\ **Replies:** 1\ **Last updated:** [August 4, 2024, 11:28pm UTC](https://discuss.elastic.co/t/data-stream-index-template-is-resetting/363307 "2024-08-04T23:28:14Z")
One of my data stream index templates settings and mappings keeps resetting to the default values and I can't figure out why The primary setting I've changed is total\_fields limit from 2,000 to 10,000 but for some reaso… --- ## [Can I get refund by a mistake in the Elastic Cloud Platform?](https://discuss.elastic.co/t/can-i-get-refund-by-a-mistake-in-the-elastic-cloud-platform/364292)
**Author:** [@Luis\_Felipe\_Antunes](https://discuss.elastic.co/u/Luis_Felipe_Antunes)\ **Replies:** 4\ **Last updated:** [August 6, 2024, 4:25pm UTC](https://discuss.elastic.co/t/can-i-get-refund-by-a-mistake-in-the-elastic-cloud-platform/364292 "2024-08-06T16:25:35Z")
Hey everyone, I'm looking for some help with a billing issue on Elastic Cloud. I received an email notification that my credit card was charged $407.23, but I didn't mean to incur any costs. I was just exploring the pla… --- ## [Logstash--Exception caught in json filter](https://discuss.elastic.co/t/logstash-exception-caught-in-json-filter/364174)
**Author:** [@Bhanu\_Praveen](https://discuss.elastic.co/u/Bhanu_Praveen)\ **Replies:** 9\ **Last updated:** [August 6, 2024, 3:35pm UTC](https://discuss.elastic.co/t/logstash-exception-caught-in-json-filter/364174 "2024-08-06T15:35:05Z")
Logstash--Exception caught in json filter Below is my json log string: { "traceId": "o0uyveRU/8BkjL+lbpDlnQ==", "spanId": "73rmqIRmo34=", "operationName": "ProcessWorkItem", "startTime": "2024-07-22T06:07:12.650881… --- ## [Understanding operations\_behind in transform stats](https://discuss.elastic.co/t/understanding-operations-behind-in-transform-stats/363281)
**Author:** [@gueri](https://discuss.elastic.co/u/gueri)\ **Replies:** 2\ **Last updated:** [August 6, 2024, 2:10pm UTC](https://discuss.elastic.co/t/understanding-operations-behind-in-transform-stats/363281 "2024-08-06T14:10:55Z")
Hello, I have a question about the metric operations\_behind when I call the transform stats API. The elastic doc says the following about operations\_behind : The number of operations that have occurred on the source … --- ## [Check your network connection and try again. Code 413](https://discuss.elastic.co/t/check-your-network-connection-and-try-again-code-413/363568)
**Author:** [@Leomar.V](https://discuss.elastic.co/u/Leomar.V)\ **Replies:** 1\ **Last updated:** [August 6, 2024, 2:03pm UTC](https://discuss.elastic.co/t/check-your-network-connection-and-try-again-code-413/363568 "2024-08-06T14:03:29Z")
Good morning, All good? I wanted to know if you know the cause of this error? This error only happens when I create the dashbords, it gives this error, but if I change the field name it resolves it, but then it gives t… --- ## [Add \`\_id\` field to visualization](https://discuss.elastic.co/t/add-id-field-to-visualization/364415)
**Author:** [@hughes](https://discuss.elastic.co/u/hughes)\ **Replies:** 3\ **Last updated:** [August 6, 2024, 1:46pm UTC](https://discuss.elastic.co/t/add-id-field-to-visualization/364415 "2024-08-06T13:46:34Z")
Is there a way to add the \_id meta field to a table visualization? --- ## [Stackoverflow due to long request string](https://discuss.elastic.co/t/stackoverflow-due-to-long-request-string/364456)
**Author:** [@futonirou.sarami](https://discuss.elastic.co/u/futonirou.sarami)\ **Replies:** 2\ **Last updated:** [August 6, 2024, 12:44pm UTC](https://discuss.elastic.co/t/stackoverflow-due-to-long-request-string/364456 "2024-08-06T12:44:23Z")
Occurrence Throwing a 4000 character query against an Elasticsearch data node causes a Stackoverflow and stops the Elasticsearch service. Elasticsearch Version 8.6.2 Requests 1.Whether or not a similar problem occur… --- ## [Ingest Role - purpose and is it required?](https://discuss.elastic.co/t/ingest-role-purpose-and-is-it-required/364471)
**Author:** [@gkman](https://discuss.elastic.co/u/gkman)\ **Replies:** 1\ **Last updated:** [August 6, 2024, 12:36pm UTC](https://discuss.elastic.co/t/ingest-role-purpose-and-is-it-required/364471 "2024-08-06T12:36:15Z")
I have upgraded my elasticsearch from version 7 to 8 (installed on kubernetes with bitnami helm chart) and now my fluentbit has started throwing exceptions of "illegal\_state\_exception","There are no ingest nodes in this … --- ## [Logstash seems to be working but no indices in Kibana](https://discuss.elastic.co/t/logstash-seems-to-be-working-but-no-indices-in-kibana/364444)
**Author:** [@UMUT\_CAN\_ARGUN](https://discuss.elastic.co/u/UMUT_CAN_ARGUN)\ **Replies:** 4\ **Last updated:** [August 6, 2024, 11:54am UTC](https://discuss.elastic.co/t/logstash-seems-to-be-working-but-no-indices-in-kibana/364444 "2024-08-06T11:54:40Z")
Hi everyone, I am a new learner to the ELK stack Here is my logstash conf file: input { file { path =\> "C:\\Users\\umutc\\Desktop\\kibanaproject\\organisations.csv" start\_position =\> "beginning" sincedb\_path =\> "NUL" } … --- ## [NOT IN replacement in elasticsearch sql query](https://discuss.elastic.co/t/not-in-replacement-in-elasticsearch-sql-query/364463)
**Author:** [@HelloWorld3](https://discuss.elastic.co/u/HelloWorld3)\ **Replies:** 4\ **Last updated:** [August 6, 2024, 11:26am UTC](https://discuss.elastic.co/t/not-in-replacement-in-elasticsearch-sql-query/364463 "2024-08-06T11:26:14Z")
I have an sql query which filters tables with conditions like not in, i want the same query for elasticsearch sql access. SELECT TABLE\_SCHEMA, TABLE\_NAME FROM INFORMATION\_SCHEMA.TABLES WHERE TABLE\_TYPE = 'BASE TABLE'AND… --- ## [KNN search no result](https://discuss.elastic.co/t/knn-search-no-result/364460)
**Author:** [@FFFro](https://discuss.elastic.co/u/FFFro)\ **Replies:** 2\ **Last updated:** [August 6, 2024, 11:06am UTC](https://discuss.elastic.co/t/knn-search-no-result/364460 "2024-08-06T11:06:03Z")
ES 8.8 When I write data for a period of time, using knn search results can not be found, but can use term search results; At this time, I put this part of the data to update\_by\_query, and then use the same knn search, … --- ## [O365Beat // Debian 12](https://discuss.elastic.co/t/o365beat-debian-12/364467)
**Author:** [@sec-sh](https://discuss.elastic.co/u/sec-sh)\ **Replies:** 0\ **Last updated:** [August 6, 2024, 10:57am UTC](https://discuss.elastic.co/t/o365beat-debian-12/364467 "2024-08-06T10:57:43Z")
Hello everyone, after upgrading from Debian 11 to Debian 12, the 0365 beat no longer starts. systemd\[1\]: o365beat.service: Failed with result 'exit-code'. systemd\[1\]: o365beat.service could not be started - Shipper for … --- ## [Default connection timeout of Java client (actually MissingRequiredPropertyException for method /nodes/info)](https://discuss.elastic.co/t/default-connection-timeout-of-java-client-actually-missingrequiredpropertyexception-for-method-nodes-info/364377)
**Author:** [@Alexey\_Melnikov](https://discuss.elastic.co/u/Alexey_Melnikov)\ **Replies:** 12\ **Last updated:** [August 6, 2024, 9:28am UTC](https://discuss.elastic.co/t/default-connection-timeout-of-java-client-actually-missingrequiredpropertyexception-for-method-nodes-info/364377 "2024-08-06T09:28:04Z")
Hello! I recently updated project dependency of project from co.elastic.clients:elasticsearch-java:7.17.22 to co.elastic.clients:elasticsearch-java:8.14.3 Everything seems working fine first hour. After an hour exactl… --- ## [Show the difference between aggregated records for two filters in visualization](https://discuss.elastic.co/t/show-the-difference-between-aggregated-records-for-two-filters-in-visualization/363641)
**Author:** [@jvester](https://discuss.elastic.co/u/jvester)\ **Replies:** 1\ **Last updated:** [August 6, 2024, 8:31am UTC](https://discuss.elastic.co/t/show-the-difference-between-aggregated-records-for-two-filters-in-visualization/363641 "2024-08-06T08:31:57Z")
Hi, I use a bargraph visualization to get insights in our logs. I have used a filter to find logs related to a specific event. If an error occurs we log that in a separate line and I used a different filter to find all … --- ## [Ingest log if field exists](https://discuss.elastic.co/t/ingest-log-if-field-exists/364380)
**Author:** [@mmartinez](https://discuss.elastic.co/u/mmartinez)\ **Replies:** 2\ **Last updated:** [August 6, 2024, 7:03am UTC](https://discuss.elastic.co/t/ingest-log-if-field-exists/364380 "2024-08-06T07:03:45Z")
Hello, I'm trying to set a condition in my phpfpm pipeline that sends the log to a different index if field log.context.extra.asyncapi.name exists but is not doing anything. It keeps sending the log to the phpfpm index … --- ## [Building my own custom kibana docker image from source code](https://discuss.elastic.co/t/building-my-own-custom-kibana-docker-image-from-source-code/364436)
**Author:** [@Faker](https://discuss.elastic.co/u/Faker)\ **Replies:** 0\ **Last updated:** [August 6, 2024, 6:58am UTC](https://discuss.elastic.co/t/building-my-own-custom-kibana-docker-image-from-source-code/364436 "2024-08-06T06:58:11Z")
hello, i've searched for some ways to build my own kibana docker image from cloned source code using 8.11.4 version i found several links but those are all outdated (kibana 6.xx or 7.xx) and does not work. Is there any… --- ## [Enabling ILM for indices created by UPSERT logstash pipeline](https://discuss.elastic.co/t/enabling-ilm-for-indices-created-by-upsert-logstash-pipeline/364104)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 11\ **Last updated:** [August 6, 2024, 6:10am UTC](https://discuss.elastic.co/t/enabling-ilm-for-indices-created-by-upsert-logstash-pipeline/364104 "2024-08-06T06:10:07Z")
Hi Folks, I need your guidance on the following scenario for ILM Policy implementation - There is a data source for which I am using the UPSERT logstash pipeline because the documents need to be updated based on the tr… --- ## [Evaluating range of values using ES|QL](https://discuss.elastic.co/t/evaluating-range-of-values-using-es-ql/364418)
**Author:** [@Nama\_Chintamani\_Illo](https://discuss.elastic.co/u/Nama_Chintamani_Illo)\ **Replies:** 1\ **Last updated:** [August 6, 2024, 2:35am UTC](https://discuss.elastic.co/t/evaluating-range-of-values-using-es-ql/364418 "2024-08-06T02:35:26Z")
I was wondering if anyone might want to take a stab at this one. I have an ES|QL query I'm trying to get to work. Right now I'm able to get the field "http.status" to "not equal" a value of "200": | eval failures = ca… --- ## [Can't parsing 00 as number](https://discuss.elastic.co/t/cant-parsing-00-as-number/364360)
**Author:** [@zerratriani](https://discuss.elastic.co/u/zerratriani)\ **Replies:** 2\ **Last updated:** [August 6, 2024, 2:35am UTC](https://discuss.elastic.co/t/cant-parsing-00-as-number/364360 "2024-08-06T02:35:13Z")
I have a log like this: 2024-08-05T15:21:55.061+07:00 X-Request-ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx trace-id=xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx span-id= INFO 1 --- \[nio-8080-exec-8\] i.c.p.logging.LoggingServiceImpl… --- ## [Http\_poller input fails authentication](https://discuss.elastic.co/t/http-poller-input-fails-authentication/364429)
**Author:** [@Wilks](https://discuss.elastic.co/u/Wilks)\ **Replies:** 1\ **Last updated:** [August 6, 2024, 1:56am UTC](https://discuss.elastic.co/t/http-poller-input-fails-authentication/364429 "2024-08-06T01:56:15Z")
Hi, I am trying to get logstash to produce the same output as the following curl command that connects to a test server's REST API but it is always failing authentication. curl -H "X-API-KEY: api\_key\_id" -H "X-SECRET: … --- ## [Network Packet Capture/Packetbeat](https://discuss.elastic.co/t/network-packet-capture-packetbeat/364423)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 0\ **Last updated:** [August 5, 2024, 9:58pm UTC](https://discuss.elastic.co/t/network-packet-capture-packetbeat/364423 "2024-08-05T21:58:58Z")
Hello, based on the documentation: Network Packet Capture | Documentation (elastic.co) Field network.application appears only in the SIP section, are there plans to add this field to the Flows dataset? --- ## [Processor to replace numbers in URLs with a fixed value](https://discuss.elastic.co/t/processor-to-replace-numbers-in-urls-with-a-fixed-value/364293)
**Author:** [@Zachary\_Joyner](https://discuss.elastic.co/u/Zachary_Joyner)\ **Replies:** 6\ **Last updated:** [August 5, 2024, 8:17pm UTC](https://discuss.elastic.co/t/processor-to-replace-numbers-in-urls-with-a-fixed-value/364293 "2024-08-05T20:17:06Z")
Hello, I have request to replace the numbers in URL path with a fixed value. So taking something like: /api/sites/42951/shell/navigation And replacing it with: /api/sites/ID/shell/navigation I currently have this as… --- ## [Unexpected Rule Failure](https://discuss.elastic.co/t/unexpected-rule-failure/364137)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 4\ **Last updated:** [August 5, 2024, 7:08pm UTC](https://discuss.elastic.co/t/unexpected-rule-failure/364137 "2024-08-05T19:08:49Z")
Hello, I created a Elasticsearch Query Rule awhile back about 8 months ago. This rule appeared to be working as expected until recently it was brought to my attention that it stopped working. I checked the alert and it… --- ## [Exiting: error importing Kibana dashboards: fail to import the dashboards in Kibana: Error importing directory ...\\packetbeat\\kibana: failed to import Kibana index pattern: 1 error](https://discuss.elastic.co/t/exiting-error-importing-kibana-dashboards-fail-to-import-the-dashboards-in-kibana-error-importing-directory-packetbeat-kibana-failed-to-import-kibana-index-pattern-1-error/364224)
**Author:** [@ppagano91](https://discuss.elastic.co/u/ppagano91)\ **Replies:** 4\ **Last updated:** [August 5, 2024, 6:02pm UTC](https://discuss.elastic.co/t/exiting-error-importing-kibana-dashboards-fail-to-import-the-dashboards-in-kibana-error-importing-directory-packetbeat-kibana-failed-to-import-kibana-index-pattern-1-error/364224 "2024-08-05T18:02:28Z")
Hi! I'm getting the follow error when I try to execute .\\packetbeat -c packetbeat.yml :slight\_smile: Exiting: error importing Kibana dashboards: fail to import the dashboards in Kibana: Error importing directory C:\\Prog… --- ## [Packetbeat error](https://discuss.elastic.co/t/packetbeat-error/364412)
**Author:** [@PAWAN\_KUMAR2](https://discuss.elastic.co/u/PAWAN_KUMAR2)\ **Replies:** 0\ **Last updated:** [August 5, 2024, 4:50pm UTC](https://discuss.elastic.co/t/packetbeat-error/364412 "2024-08-05T16:50:59Z")
I am having issues with packetbeat on Windows. i connected to my wifi and trying run packetbeat and capture the network. but in kibana I am seeing only empty data fields........PS C:\\Program Files\\Elastic\\Beats\\8.14.3\\pa… --- ## [Error failed to obtain node locks on TubeArchivist-ES start](https://discuss.elastic.co/t/error-failed-to-obtain-node-locks-on-tubearchivist-es-start/364403)
**Author:** [@james\_simyery](https://discuss.elastic.co/u/james_simyery)\ **Replies:** 0\ **Last updated:** [August 5, 2024, 3:07pm UTC](https://discuss.elastic.co/t/error-failed-to-obtain-node-locks-on-tubearchivist-es-start/364403 "2024-08-05T15:07:37Z")
Have been getting the following error on start: failed to obtain node locks, tried \[/usr/share/elasticsearch/data\]; maybe these locations are not writable or multiple nodes were started on the same data path? I am runi… --- ## [Uax\_url\_email tokenizer not recognising valid emails with no dots on the email domain](https://discuss.elastic.co/t/uax-url-email-tokenizer-not-recognising-valid-emails-with-no-dots-on-the-email-domain/364166)
**Author:** [@Carlos\_Cambon](https://discuss.elastic.co/u/Carlos_Cambon)\ **Replies:** 2\ **Last updated:** [August 5, 2024, 3:01pm UTC](https://discuss.elastic.co/t/uax-url-email-tokenizer-not-recognising-valid-emails-with-no-dots-on-the-email-domain/364166 "2024-08-05T15:01:30Z")
Using version 7.9. And having the following settings: "email\_filter": { "type": "pattern\_capture", "preserve\_original": "true", … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=190) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=192)