# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=197 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 198 --- ## [How to send wazuh logs to elastic trough logstash](https://discuss.elastic.co/t/how-to-send-wazuh-logs-to-elastic-trough-logstash/363750)
**Author:** [@Felipe\_Medina](https://discuss.elastic.co/u/Felipe_Medina)\ **Replies:** 2\ **Last updated:** [July 28, 2024, 11:17pm UTC](https://discuss.elastic.co/t/how-to-send-wazuh-logs-to-elastic-trough-logstash/363750 "2024-07-28T23:17:40Z")
Hi I want to sent wazug logs to elastic I found this documentation: But, when I execute the following command to verify my logstash configuration, I obtain errors: Can someone help me? Thank you --- ## [Validation Failed: 1: id is too long, must be no longer than 512 bytes but was: 548;](https://discuss.elastic.co/t/validation-failed-1-id-is-too-long-must-be-no-longer-than-512-bytes-but-was-548/363875)
**Author:** [@sibasish.palo](https://discuss.elastic.co/u/sibasish.palo)\ **Replies:** 1\ **Last updated:** [July 28, 2024, 10:20pm UTC](https://discuss.elastic.co/t/validation-failed-1-id-is-too-long-must-be-no-longer-than-512-bytes-but-was-548/363875 "2024-07-28T22:20:46Z")
we are migrating from an old elasticsearch version to 8.12 and for some documents we are seeing validation error like Validation Failed: 1: id is too long, must be no longer than 512 bytes but was: 548; i know its a che… --- ## [Filebeat not working even after doing the configuration and setup](https://discuss.elastic.co/t/filebeat-not-working-even-after-doing-the-configuration-and-setup/363795)
**Author:** [@ananya\_yechuri](https://discuss.elastic.co/u/ananya_yechuri)\ **Replies:** 1\ **Last updated:** [July 25, 2024, 4:00pm UTC](https://discuss.elastic.co/t/filebeat-not-working-even-after-doing-the-configuration-and-setup/363795 "2024-07-25T16:00:47Z")
I have downloaded filebeat and configured the file and did the setup as in the installation and while running the error I haven't gotten any errors but when I go to my stack monitoring it says download fileabeat to view … --- ## [Logstash--Ruby exception occurred: no implicit conversion of nil into String](https://discuss.elastic.co/t/logstash-ruby-exception-occurred-no-implicit-conversion-of-nil-into-string/363889)
**Author:** [@Bhanu\_Praveen](https://discuss.elastic.co/u/Bhanu_Praveen)\ **Replies:** 4\ **Last updated:** [July 28, 2024, 12:47pm UTC](https://discuss.elastic.co/t/logstash-ruby-exception-occurred-no-implicit-conversion-of-nil-into-string/363889 "2024-07-28T12:47:06Z")
Hello, Below is my json log string: { "traceId": "o0uyveRU/8BkjL+lbpDlnQ==", "spanId": "73rmqIRmo34=", "operationName": "ProcessWorkItem", "startTime": "2024-07-22T06:07:12.650881409Z", "duration": "0.256620153s",… --- ## [Index aliases vs index templates, what to use?](https://discuss.elastic.co/t/index-aliases-vs-index-templates-what-to-use/363923)
**Author:** [@Carl\_jo](https://discuss.elastic.co/u/Carl_jo)\ **Replies:** 2\ **Last updated:** [July 28, 2024, 12:27pm UTC](https://discuss.elastic.co/t/index-aliases-vs-index-templates-what-to-use/363923 "2024-07-28T12:27:11Z")
Can anybody tell me the difference between index aliases and index templates. When to use each one, and what are their main advantages? Will it work for an9 whatsapp? --- ## [ElasticSearch query not working](https://discuss.elastic.co/t/elasticsearch-query-not-working/363913)
**Author:** [@Liam\_Young](https://discuss.elastic.co/u/Liam_Young)\ **Replies:** 0\ **Last updated:** [July 27, 2024, 10:00pm UTC](https://discuss.elastic.co/t/elasticsearch-query-not-working/363913 "2024-07-27T22:00:51Z")
Hi, I am trying to use logstash to make a 1 minute aggregation, when I run the query I've made in postman, I get expected result: { "took": 14, "timed\_out": false, "\_shards": { "total": 1, "s… --- ## [The search for full words or terms does not work correctly](https://discuss.elastic.co/t/the-search-for-full-words-or-terms-does-not-work-correctly/363527)
**Author:** [@Rainbow\_Sprinkles](https://discuss.elastic.co/u/Rainbow_Sprinkles)\ **Replies:** 14\ **Last updated:** [July 27, 2024, 11:59am UTC](https://discuss.elastic.co/t/the-search-for-full-words-or-terms-does-not-work-correctly/363527 "2024-07-27T11:59:35Z")
Dear talents, I hope everyone is doing well. Could you kindly review the statement below and suggest possible fixes? The keyword is "alt legal". Currently, the search engine is expected to display titles that either c… --- ## [Logstash holds/locks onto files during files rotation](https://discuss.elastic.co/t/logstash-holds-locks-onto-files-during-files-rotation/363723)
**Author:** [@ELKuser24](https://discuss.elastic.co/u/ELKuser24)\ **Replies:** 4\ **Last updated:** [July 27, 2024, 9:53am UTC](https://discuss.elastic.co/t/logstash-holds-locks-onto-files-during-files-rotation/363723 "2024-07-27T09:53:15Z")
I'm running Logstash 7.17.0 on my Windows server to ship data into my Elasticsearch 8.11.0 instance, running on a Linux server. The Logstash instance is set to ingest log files from a folder, which is actively being writ… --- ## [Elasticsearch Failing to start](https://discuss.elastic.co/t/elasticsearch-failing-to-start/363879)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 3\ **Last updated:** [July 26, 2024, 7:57pm UTC](https://discuss.elastic.co/t/elasticsearch-failing-to-start/363879 "2024-07-26T19:57:53Z")
Hello I attempt to install elasticsearch on new node, but its failling to start Any help would be great: Jul 26 09:54:04 \<\> systemd-entrypoint\[1933\]: Exception in thread "main" org.apache.lucene.index.CorruptIndexExcep… --- ## [How can filebeat collect logs current date?](https://discuss.elastic.co/t/how-can-filebeat-collect-logs-current-date/363754)
**Author:** [@BevisDev](https://discuss.elastic.co/u/BevisDev)\ **Replies:** 6\ **Last updated:** [July 26, 2024, 3:18pm UTC](https://discuss.elastic.co/t/how-can-filebeat-collect-logs-current-date/363754 "2024-07-26T15:18:43Z")
Hi everyone, I am new in ELK Stack, I am encountered problems while collecting logs via Filebeat. Specifically I want to collect logs by path for example: /var/logs/\/app.log and how can I collect current da… --- ## [NestedAggregation in co.elastic.clients:elasticsearch-java](https://discuss.elastic.co/t/nestedaggregation-in-co-elastic-clients-elasticsearch-java/363829)
**Author:** [@S\_R](https://discuss.elastic.co/u/S_R)\ **Replies:** 4\ **Last updated:** [July 26, 2024, 1:47pm UTC](https://discuss.elastic.co/t/nestedaggregation-in-co-elastic-clients-elasticsearch-java/363829 "2024-07-26T13:47:08Z")
Hi, I'm currently migrating my project to use the new client co.elastic.clients:elasticsearch-java:7.17.22. Previously, with org.elasticsearch:elasticsearch:7.8.1, I created nested aggregations in my JUnit tests like th… --- ## [Shards are not relocated from excluded data nodes](https://discuss.elastic.co/t/shards-are-not-relocated-from-excluded-data-nodes/363860)
**Author:** [@a06ced31bae02498a46d](https://discuss.elastic.co/u/a06ced31bae02498a46d)\ **Replies:** 2\ **Last updated:** [July 26, 2024, 1:09pm UTC](https://discuss.elastic.co/t/shards-are-not-relocated-from-excluded-data-nodes/363860 "2024-07-26T13:09:00Z")
When excluding certain nodes with cluster.routing.allocation.exclude.\_ip setting most of the shards are moved off of the nodes. However, some nodes are still having a few shards. First 2 nodes here have 1 shard each eve… --- ## [I am not able to get metrics from the machines that enrolled outside the network](https://discuss.elastic.co/t/i-am-not-able-to-get-metrics-from-the-machines-that-enrolled-outside-the-network/363862)
**Author:** [@Rohan\_sirohi](https://discuss.elastic.co/u/Rohan_sirohi)\ **Replies:** 0\ **Last updated:** [July 26, 2024, 12:54pm UTC](https://discuss.elastic.co/t/i-am-not-able-to-get-metrics-from-the-machines-that-enrolled-outside-the-network/363862 "2024-07-26T12:54:26Z")
Hi All, I have checked numerous forums but haven't found a solution, so I am raising this question here because of my unique setup. I have Elasticsearch and Kibana running on a Proxmox server inside containers. My entir… --- ## [Logstash plugin error with Tibero DB](https://discuss.elastic.co/t/logstash-plugin-error-with-tibero-db/363832)
**Author:** [@jimmy\_park](https://discuss.elastic.co/u/jimmy_park)\ **Replies:** 2\ **Last updated:** [July 26, 2024, 12:21pm UTC](https://discuss.elastic.co/t/logstash-plugin-error-with-tibero-db/363832 "2024-07-26T12:21:53Z")
I have a problem about using Logstash with Tibero DB I want to extract data using Logstash at Tibero DB But the plugin error is occured My test.conf is: input { jdbc { jdbc\_driver\_library =\> "/home/elastic/tibero6… --- ## [Elastic crash, nodes timed out](https://discuss.elastic.co/t/elastic-crash-nodes-timed-out/363764)
**Author:** [@PustyB](https://discuss.elastic.co/u/PustyB)\ **Replies:** 1\ **Last updated:** [July 26, 2024, 10:34am UTC](https://discuss.elastic.co/t/elastic-crash-nodes-timed-out/363764 "2024-07-26T10:34:33Z")
Hi. I have an elastic cluster on Kubernetes. Since yesterday I am facing the problem of kubernetes nodes stopping. 3 nodes (64GB RAM) The last logs it reads before crashing are: {"@timestamp":"2024-07-25T05:44:12.428Z… --- ## [Elasticsearch opening around 200 ports to communicate internally in single node setup beside http and tcp port configured](https://discuss.elastic.co/t/elasticsearch-opening-around-200-ports-to-communicate-internally-in-single-node-setup-beside-http-and-tcp-port-configured/363821)
**Author:** [@Sheik\_Mohammed\_Shaw](https://discuss.elastic.co/u/Sheik_Mohammed_Shaw)\ **Replies:** 1\ **Last updated:** [July 26, 2024, 9:07am UTC](https://discuss.elastic.co/t/elasticsearch-opening-around-200-ports-to-communicate-internally-in-single-node-setup-beside-http-and-tcp-port-configured/363821 "2024-07-26T09:07:26Z")
Elasticsearch is opening many ports to communicate with itself, in a single-node setup. Is this the expected behavior? If yes kindly mention why around 100 connections established within itself? I tested with various … --- ## [A copy of this shard is already allocated to this node](https://discuss.elastic.co/t/a-copy-of-this-shard-is-already-allocated-to-this-node/362138)
**Author:** [@Sam\_Rybkin](https://discuss.elastic.co/u/Sam_Rybkin)\ **Replies:** 5\ **Last updated:** [July 26, 2024, 8:33am UTC](https://discuss.elastic.co/t/a-copy-of-this-shard-is-already-allocated-to-this-node/362138 "2024-07-26T08:33:47Z")
Hi we have next kibana settings: GET /.kibana/\_settings { ".kibana\_2" : { "settings" : { "index" : { "number\_of\_shards" : "1", "auto\_expand\_replicas" : "false", "provided\_name" : ".ki… --- ## [Global Aggregation on nested fields with filters](https://discuss.elastic.co/t/global-aggregation-on-nested-fields-with-filters/363023)
**Author:** [@Bhavyagc](https://discuss.elastic.co/u/Bhavyagc)\ **Replies:** 3\ **Last updated:** [July 26, 2024, 4:13am UTC](https://discuss.elastic.co/t/global-aggregation-on-nested-fields-with-filters/363023 "2024-07-26T04:13:36Z")
I am facing issues with aggregations on nested field. Below are the mapping fields. { "mappings": { "properties": { "autocomplete": { "type": "text", "analyzer": "autocomplete", "fiel… --- ## [Creating a Geo Enrich Policy for existing Index, encountering error when adding the enriched field to existing documents by Reindexing](https://discuss.elastic.co/t/creating-a-geo-enrich-policy-for-existing-index-encountering-error-when-adding-the-enriched-field-to-existing-documents-by-reindexing/363804)
**Author:** [@jlogan](https://discuss.elastic.co/u/jlogan)\ **Replies:** 2\ **Last updated:** [July 26, 2024, 2:25am UTC](https://discuss.elastic.co/t/creating-a-geo-enrich-policy-for-existing-index-encountering-error-when-adding-the-enriched-field-to-existing-documents-by-reindexing/363804 "2024-07-26T02:25:04Z")
Hi there! I'm trying to create an Enrich Policy using geo\_match for the first time and wanted to test it by applying it to an existing index and documents within it. I've added the field that I intend to populate with t… --- ## [When a custom transaction ends, does the prior/parent transaction continue?](https://discuss.elastic.co/t/when-a-custom-transaction-ends-does-the-prior-parent-transaction-continue/363793)
**Author:** [@dantoomey](https://discuss.elastic.co/u/dantoomey)\ **Replies:** 3\ **Last updated:** [July 25, 2024, 5:06pm UTC](https://discuss.elastic.co/t/when-a-custom-transaction-ends-does-the-prior-parent-transaction-continue/363793 "2024-07-25T17:06:35Z")
We have created a custom transaction on part of our code. When the custom transaction ends, does the prior transaction continue operating? --- ## [Logstash Fail to Index Events due to field type](https://discuss.elastic.co/t/logstash-fail-to-index-events-due-to-field-type/363799)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 2\ **Last updated:** [July 25, 2024, 4:33pm UTC](https://discuss.elastic.co/t/logstash-fail-to-index-events-due-to-field-type/363799 "2024-07-25T16:33:42Z")
Hello, I have events not indexing into elastic when passing through logstash. The reason is because sometimes a field like "remoteAddress" (of type ip) contains no values. \]\>worker18","logEvent":{"message":"Could not i… --- ## [Index refresh and replication behaviour](https://discuss.elastic.co/t/index-refresh-and-replication-behaviour/363798)
**Author:** [@Sergii1](https://discuss.elastic.co/u/Sergii1)\ **Replies:** 3\ **Last updated:** [July 25, 2024, 4:19pm UTC](https://discuss.elastic.co/t/index-refresh-and-replication-behaviour/363798 "2024-07-25T16:19:26Z")
I am struggling to understand if the index refresh operation makes data available for search immediately on both primary and replica shards. On one hand, it seems that replication and index refreshing are completely ind… --- ## [How to perform atomic operations using a java client](https://discuss.elastic.co/t/how-to-perform-atomic-operations-using-a-java-client/363769)
**Author:** [@Kotomi\_Ichinose](https://discuss.elastic.co/u/Kotomi_Ichinose)\ **Replies:** 1\ **Last updated:** [July 25, 2024, 3:35pm UTC](https://discuss.elastic.co/t/how-to-perform-atomic-operations-using-a-java-client/363769 "2024-07-25T15:35:06Z")
java client I want to do the following with a java client. I couldn't find a way to do it in the documentation. POST \_aliases { "actions": \[ { "remove": { "index": "logs-nginx.access-prod", … --- ## [Slowlog message's entries grok](https://discuss.elastic.co/t/slowlog-messages-entries-grok/363794)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 0\ **Last updated:** [July 25, 2024, 2:45pm UTC](https://discuss.elastic.co/t/slowlog-messages-entries-grok/363794 "2024-07-25T14:45:52Z")
Hey there, to investigate possible issues I used to collect slowlog entries. Obviously, query field is very important but I saw during these years that there isn't any easy way to analyze it. I mean, generally I use a … --- ## [Create field with condition while looping through an array in ruby](https://discuss.elastic.co/t/create-field-with-condition-while-looping-through-an-array-in-ruby/363444)
**Author:** [@Armalyca](https://discuss.elastic.co/u/Armalyca)\ **Replies:** 4\ **Last updated:** [July 25, 2024, 1:59pm UTC](https://discuss.elastic.co/t/create-field-with-condition-while-looping-through-an-array-in-ruby/363444 "2024-07-25T13:59:59Z")
Hello, I use logstash 7.17. I want to create a field while looping through an array in ruby from my data. Here is a snippet of my code which doesn't work : items\_contact = event.get("\[contactMedium\]") if items\_con… --- ## [Elasticsearch spends all CPU time decompressing till restart](https://discuss.elastic.co/t/elasticsearch-spends-all-cpu-time-decompressing-till-restart/363706)
**Author:** [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Replies:** 2\ **Last updated:** [July 25, 2024, 1:46pm UTC](https://discuss.elastic.co/t/elasticsearch-spends-all-cpu-time-decompressing-till-restart/363706 "2024-07-25T13:46:55Z")
Hey, I have a fun issue here, that I am unable to pinpoint. We have a relatively old 7.9.0 cluster (spare me be upgrade preach, I've been doing that for months for this cluster :shushing\_face:), that suddenly jumps from… --- ## [Support for transaction parentIds in Elastic Rum agent](https://discuss.elastic.co/t/support-for-transaction-parentids-in-elastic-rum-agent/363771)
**Author:** [@pedrogranja](https://discuss.elastic.co/u/pedrogranja)\ **Replies:** 2\ **Last updated:** [July 25, 2024, 12:59pm UTC](https://discuss.elastic.co/t/support-for-transaction-parentids-in-elastic-rum-agent/363771 "2024-07-25T12:59:45Z")
Hello Elastic team, In the context of a web extension, we are using the Elastic RUM agent. We created an agent in both the "FE" of the web extension and in the service worker of the web extension and we would now like t… --- ## [Logstash as service not reading log files](https://discuss.elastic.co/t/logstash-as-service-not-reading-log-files/363774)
**Author:** [@Glen\_Elkins](https://discuss.elastic.co/u/Glen_Elkins)\ **Replies:** 2\ **Last updated:** [July 25, 2024, 11:21am UTC](https://discuss.elastic.co/t/logstash-as-service-not-reading-log-files/363774 "2024-07-25T11:21:13Z")
I am running logstash as a service by modifying /etc/systemd/system/logstash.service with: ExecStart=/usr/share/logstash/bin/logstash -f /usr/share/logstash/config/logstash.conf --config.reload.automatic Nothing is bei… --- ## [Logstash not able to get nested json in desired output using ruby](https://discuss.elastic.co/t/logstash-not-able-to-get-nested-json-in-desired-output-using-ruby/363751)
**Author:** [@Bhanu\_Praveen](https://discuss.elastic.co/u/Bhanu_Praveen)\ **Replies:** 3\ **Last updated:** [July 25, 2024, 10:55am UTC](https://discuss.elastic.co/t/logstash-not-able-to-get-nested-json-in-desired-output-using-ruby/363751 "2024-07-25T10:55:25Z")
Below is my sample output log { "traceId": "o0uyveRU/8BkjL+lbpDlnQ==", "spanId": "73rmqIRmo34=", "tags": \[ { "key": "otel.library.name", "vStr": "com.mdi.core.workmgmt.TypedC… --- ## [Kibana Discover and DSL query - unknown field \[aggs\] and unknown field \[size\]](https://discuss.elastic.co/t/kibana-discover-and-dsl-query-unknown-field-aggs-and-unknown-field-size/362913)
**Author:** [@RobertBM](https://discuss.elastic.co/u/RobertBM)\ **Replies:** 6\ **Last updated:** [July 25, 2024, 10:46am UTC](https://discuss.elastic.co/t/kibana-discover-and-dsl-query-unknown-field-aggs-and-unknown-field-size/362913 "2024-07-25T10:46:52Z")
Hello team, I am currently facing an issue while trying to load DSL query result in the Kibana Discover tool. The query was created with the help from this forum , which provided the correct result do a NOT IN case. How… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=196) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=198)