# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=210 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 211 --- ## [Issues Encountered During Elasticsearch plugin Upgrade from 8.9 to 8.14](https://discuss.elastic.co/t/issues-encountered-during-elasticsearch-plugin-upgrade-from-8-9-to-8-14/362454)
**Author:** [@ramsankar](https://discuss.elastic.co/u/ramsankar)\ **Replies:** 6\ **Last updated:** [July 4, 2024, 10:54am UTC](https://discuss.elastic.co/t/issues-encountered-during-elasticsearch-plugin-upgrade-from-8-9-to-8-14/362454 "2024-07-04T10:54:48Z")
We are working on upgrading Elasticsearch plugin from version 8.9 to 8.14 and encountering issues. We have modified the following constructor: In 8.9: highlighter = new CustomUnifiedHighlighter( searcher, analy… --- ## [CorruptIndexException: docs out of order](https://discuss.elastic.co/t/corruptindexexception-docs-out-of-order/362536)
**Author:** [@maroe](https://discuss.elastic.co/u/maroe)\ **Replies:** 0\ **Last updated:** [July 4, 2024, 9:59am UTC](https://discuss.elastic.co/t/corruptindexexception-docs-out-of-order/362536 "2024-07-04T09:59:45Z")
Hi, I am running elasticsearch v8.2.2 as part of our ELK stack on a Windows Server 2019. I seem to have a corrupt index. Health status has been red due to an unassigned shard. I have no snapshot or replica. Data is not … --- ## [How can I query Elasticsearch to join or correlate data between two indices that have different field names but contain the same values?](https://discuss.elastic.co/t/how-can-i-query-elasticsearch-to-join-or-correlate-data-between-two-indices-that-have-different-field-names-but-contain-the-same-values/362448)
**Author:** [@anguri\_sudhakar](https://discuss.elastic.co/u/anguri_sudhakar)\ **Replies:** 2\ **Last updated:** [July 4, 2024, 10:17am UTC](https://discuss.elastic.co/t/how-can-i-query-elasticsearch-to-join-or-correlate-data-between-two-indices-that-have-different-field-names-but-contain-the-same-values/362448 "2024-07-04T10:17:19Z")
1.I have two indices, index1 and index2, and they have different field names but the values in these fields are the same. For example: index1 has a field named name1 with values like "value1", "value2", etc. index2 has… --- ## [Moving Average in Lens](https://discuss.elastic.co/t/moving-average-in-lens/362487)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 6\ **Last updated:** [July 4, 2024, 8:59am UTC](https://discuss.elastic.co/t/moving-average-in-lens/362487 "2024-07-04T08:59:28Z")
Hello, I created this TVSB visualization using a moving average to show the line: I clicked on convert to lens and it turns it like this: The issue I think is that TVSB allows you choose the style per layer whil… --- ## [Graphs do not load in Kibana dashboard after edit](https://discuss.elastic.co/t/graphs-do-not-load-in-kibana-dashboard-after-edit/362509)
**Author:** [@Varun\_Tokas](https://discuss.elastic.co/u/Varun_Tokas)\ **Replies:** 1\ **Last updated:** [July 4, 2024, 8:27am UTC](https://discuss.elastic.co/t/graphs-do-not-load-in-kibana-dashboard-after-edit/362509 "2024-07-04T08:27:24Z")
While working with Kibana 8.14.1, I have noticed a recurring error. When editing visualizations loaded into a dashboard, Kibana gives us the option to edit the chart in Lens, or directly edit it within the dashboard usin… --- ## [upsert operation and refresh set to 3s](https://discuss.elastic.co/t/upsert-operation-and-refresh-set-to-3s/362526)
**Author:** [@blqck](https://discuss.elastic.co/u/blqck)\ **Replies:** 0\ **Last updated:** [July 4, 2024, 8:20am UTC](https://discuss.elastic.co/t/upsert-operation-and-refresh-set-to-3s/362526 "2024-07-04T08:20:49Z")
i'm doing upsert like this public async Task AddOrUpdate(Car car, CancellationToken cancellationToken) { await \_client.IndexAsync(user, i =\> i .Index(latestIndexName) .Id(car.Id), cancellationToken); } and i set refres… --- ## [Grokparsefailure](https://discuss.elastic.co/t/grokparsefailure/362450)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 8\ **Last updated:** [July 4, 2024, 5:59am UTC](https://discuss.elastic.co/t/grokparsefailure/362450 "2024-07-04T05:59:35Z")
Hi there, i'm trying to use grok pattern here and as you can see my pattern is already match the log but when I see in kibana, idk why the tags always show \_grokparsefailure this is my code in pipeline if \[kuberne… --- ## [Unable to get deployment users through the API](https://discuss.elastic.co/t/unable-to-get-deployment-users-through-the-api/362411)
**Author:** [@Gustavo\_Valente](https://discuss.elastic.co/u/Gustavo_Valente)\ **Replies:** 1\ **Last updated:** [July 4, 2024, 2:39am UTC](https://discuss.elastic.co/t/unable-to-get-deployment-users-through-the-api/362411 "2024-07-04T02:39:15Z")
Hi team, I am trying to create a script to get all users and roles from a specific Elasticsearch deployment instance. I have prepared the API call as "{deployment\_URL}/\_security/user", but I am getting this 401 error. I… --- ## [AD Entity Analytics - invalid Base DN](https://discuss.elastic.co/t/ad-entity-analytics-invalid-base-dn/362071)
**Author:** [@PhilA](https://discuss.elastic.co/u/PhilA)\ **Replies:** 10\ **Last updated:** [July 3, 2024, 10:16pm UTC](https://discuss.elastic.co/t/ad-entity-analytics-invalid-base-dn/362071 "2024-07-03T22:16:00Z")
I'm aware that the Active Directory Entity Analytics is new and Technical Preview but wanted to check if its me doing something wrong and if not, perhaps it is worth raising for the developers feedback. During configura… --- ## [\_geoip\_lookup\_failure](https://discuss.elastic.co/t/geoip-lookup-failure/362491)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 3\ **Last updated:** [July 3, 2024, 10:07pm UTC](https://discuss.elastic.co/t/geoip-lookup-failure/362491 "2024-07-03T22:07:15Z")
Hello, I am trying to use geoip but I get the error message "\_geoip\_lookup\_failure". I have looked at several forum threads, I don't know if I am missing something or if I need to install something. input { tcp { … --- ## [\_stats failing probably due to query cache overflow](https://discuss.elastic.co/t/stats-failing-probably-due-to-query-cache-overflow/362492)
**Author:** [@psmit](https://discuss.elastic.co/u/psmit)\ **Replies:** 0\ **Last updated:** [July 3, 2024, 7:44pm UTC](https://discuss.elastic.co/t/stats-failing-probably-due-to-query-cache-overflow/362492 "2024-07-03T19:44:19Z")
We've been running into periodic issues essentially trying to do a GET on m3\*/\_stats , with the error from ES being: elastic: Error 400 (Bad Request): Values less than -1 bytes are not supported: -9223372036826080625b \[… --- ## [Elasticsearch container spends 6 minutes in limbo before proceeding with startup](https://discuss.elastic.co/t/elasticsearch-container-spends-6-minutes-in-limbo-before-proceeding-with-startup/362484)
**Author:** [@shockdm](https://discuss.elastic.co/u/shockdm)\ **Replies:** 0\ **Last updated:** [July 3, 2024, 5:08pm UTC](https://discuss.elastic.co/t/elasticsearch-container-spends-6-minutes-in-limbo-before-proceeding-with-startup/362484 "2024-07-03T17:08:04Z")
Hi folks, I am hitting a very strange issue when running an Elasticsearch container in an Openshift environment. Basically when the container spins up - our init scripts run - and then trigger /usr/share/elasticsearch/bi… --- ## [Recovery failed](https://discuss.elastic.co/t/recovery-failed/362440)
**Author:** [@Phu\_Van\_Nguyen](https://discuss.elastic.co/u/Phu_Van_Nguyen)\ **Replies:** 2\ **Last updated:** [July 3, 2024, 9:00am UTC](https://discuss.elastic.co/t/recovery-failed/362440 "2024-07-03T09:00:07Z")
Hi team, A few days ago, I encountered a circuite\_breaking\_exception that caused a node on my cluster to break. I increased my node's memory and did a rolling restart for my cluster. After that, everything worked normal… --- ## [elastic agent does not open UDP ports on Linux](https://discuss.elastic.co/t/elastic-agent-does-not-open-udp-ports-on-linux/362369)
**Author:** [@obscure\_light](https://discuss.elastic.co/u/obscure_light)\ **Replies:** 3\ **Last updated:** [July 3, 2024, 4:36pm UTC](https://discuss.elastic.co/t/elastic-agent-does-not-open-udp-ports-on-linux/362369 "2024-07-03T16:36:56Z")
Hi, I installed Elastic Agent on some RHEL 8.10 and 8.9. The agent was working properly and receiving logs from machines sending to it with Syslog taking advantage of the integration to listen to UDP ports. It has stoppe… --- ## [XML parsing is failing with REXML::ParseException: Missing end tag](https://discuss.elastic.co/t/xml-parsing-is-failing-with-rexml-missing-end-tag/362462)
**Author:** [@ayushyadav685](https://discuss.elastic.co/u/ayushyadav685)\ **Replies:** 3\ **Last updated:** [July 3, 2024, 4:16pm UTC](https://discuss.elastic.co/t/xml-parsing-is-failing-with-rexml-missing-end-tag/362462 "2024-07-03T16:16:18Z")
Hi All, I am trying to migrate the XML logs to JSON with Logstash, but the parsing fails due to some unnecessary XML logs. The \ tag is not needed and I attempted to remove it using remove\_tag, but it is not w… --- ## [How to get all data from elasticsearch to Power bi](https://discuss.elastic.co/t/how-to-get-all-data-from-elasticsearch-to-power-bi/362471)
**Author:** [@Ali\_Salim](https://discuss.elastic.co/u/Ali_Salim)\ **Replies:** 0\ **Last updated:** [July 3, 2024, 1:43pm UTC](https://discuss.elastic.co/t/how-to-get-all-data-from-elasticsearch-to-power-bi/362471 "2024-07-03T13:43:00Z")
I am using this query but it returns 10000 let // Define Elasticsearch URL and Credentials baseUrl = "", // Include username and password in the URL indexName = "cube", searchEndpoint = "/cube/\_search", … --- ## [It is possible to change the Kibana Discover placement of the number of returned hits?](https://discuss.elastic.co/t/it-is-possible-to-change-the-kibana-discover-placement-of-the-number-of-returned-hits/362473)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 0\ **Last updated:** [July 3, 2024, 1:53pm UTC](https://discuss.elastic.co/t/it-is-possible-to-change-the-kibana-discover-placement-of-the-number-of-returned-hits/362473 "2024-07-03T13:53:02Z")
Hello, Currently we are running 8.12 in production and are starting to test 8.14, but we noticed that there are some undesired visual changes on Kibana. For example, on discover, the number of hits returned used to be … --- ## [Filebeat 7.17 unable to send logs to logstash on FedoraCoreOS](https://discuss.elastic.co/t/filebeat-7-17-unable-to-send-logs-to-logstash-on-fedoracoreos/362423)
**Author:** [@a.gavric](https://discuss.elastic.co/u/a.gavric)\ **Replies:** 1\ **Last updated:** [July 3, 2024, 1:26pm UTC](https://discuss.elastic.co/t/filebeat-7-17-unable-to-send-logs-to-logstash-on-fedoracoreos/362423 "2024-07-03T13:26:44Z")
Hi Guys i am troubleshooting a filebeat issue on FedoraCoreOS that we have been using as the operating system for OKD deployment (Free version of openshift) i have noticed a strange issue that i have not experienced with… --- ## [elasticsearch regex split into groups 255 characters](https://discuss.elastic.co/t/elasticsearch-regex-split-into-groups-255-characters/362408)
**Author:** [@Bruno\_Sebastian\_Alva](https://discuss.elastic.co/u/Bruno_Sebastian_Alva)\ **Replies:** 7\ **Last updated:** [July 3, 2024, 12:34pm UTC](https://discuss.elastic.co/t/elasticsearch-regex-split-into-groups-255-characters/362408 "2024-07-03T12:34:16Z")
First of all, sorry for my English. I have encountered the following issue when performing a query with regular expressions in Elasticsearch. This index field is a text longer than 255 characters (This is important). F… --- ## [How to programaticaly get data from elastic stack using python](https://discuss.elastic.co/t/how-to-programaticaly-get-data-from-elastic-stack-using-python/362439)
**Author:** [@Bino\_Oetomo](https://discuss.elastic.co/u/Bino_Oetomo)\ **Replies:** 1\ **Last updated:** [July 3, 2024, 12:29pm UTC](https://discuss.elastic.co/t/how-to-programaticaly-get-data-from-elastic-stack-using-python/362439 "2024-07-03T12:29:50Z")
Dear All My co worker deploy an elastc stack to process bunc of Apache access and dom logs. Curently i can see via web ui kind of this: I need to "extract" somedata from that view, minimal of: domain name and reque… --- ## [Add const cell values to Table Visualisation](https://discuss.elastic.co/t/add-const-cell-values-to-table-visualisation/362453)
**Author:** [@cgame](https://discuss.elastic.co/u/cgame)\ **Replies:** 1\ **Last updated:** [July 3, 2024, 12:17pm UTC](https://discuss.elastic.co/t/add-const-cell-values-to-table-visualisation/362453 "2024-07-03T12:17:59Z")
Hi, Is it possible to make a Table visualization where one column have constant values in it, declared at lens-setup time ? It doesn't seem so but I'd like to be sure. Best, --- ## [Adding a field to a metrics event](https://discuss.elastic.co/t/adding-a-field-to-a-metrics-event/362203)
**Author:** [@Jose\_E](https://discuss.elastic.co/u/Jose_E)\ **Replies:** 5\ **Last updated:** [July 3, 2024, 10:27am UTC](https://discuss.elastic.co/t/adding-a-field-to-a-metrics-event/362203 "2024-07-03T10:27:26Z")
Hi there, I am having a big issue with a really simple situation. I am trying to add a custom field to the event generated by the metrics filter plugin, however, it seems that the metrics plugin first creates the event a… --- ## [Help creating a visualization?](https://discuss.elastic.co/t/help-creating-a-visualization/362331)
**Author:** [@amv](https://discuss.elastic.co/u/amv)\ **Replies:** 3\ **Last updated:** [July 3, 2024, 8:45am UTC](https://discuss.elastic.co/t/help-creating-a-visualization/362331 "2024-07-03T08:45:15Z")
Hey everyone, I've stood up Fleet and elastic which i finally got working properly. My question is with the discover / search. I'm trying to create a dashboard from this: agent.name:\* and winlog.event\_id:4624 and winlo… --- ## [Only update selected fields if document alread exists](https://discuss.elastic.co/t/only-update-selected-fields-if-document-alread-exists/362375)
**Author:** [@johanwallenborg](https://discuss.elastic.co/u/johanwallenborg)\ **Replies:** 0\ **Last updated:** [July 2, 2024, 11:43am UTC](https://discuss.elastic.co/t/only-update-selected-fields-if-document-alread-exists/362375 "2024-07-02T11:43:17Z")
I'm using IndexMany-method today and that updates if document with same ID alread exists. Is there any way except try to create and then index, to choose what fields that should be updated if document exists or maybe eve… --- ## [Bar chart won't respect the count of records when interval is by day](https://discuss.elastic.co/t/bar-chart-wont-respect-the-count-of-records-when-interval-is-by-day/362233)
**Author:** [@etaoin](https://discuss.elastic.co/u/etaoin)\ **Replies:** 3\ **Last updated:** [July 3, 2024, 8:16am UTC](https://discuss.elastic.co/t/bar-chart-wont-respect-the-count-of-records-when-interval-is-by-day/362233 "2024-07-03T08:16:53Z")
I'm trying to use a bar chart but the count won't match the actual count or even the day when I use the day interval. As you can see the X axis says 2024-06-28 but when hovering it says 27. The count is 164 When I add t… --- ## [How to monitor Systems Up or Down with ping disabled on them?](https://discuss.elastic.co/t/how-to-monitor-systems-up-or-down-with-ping-disabled-on-them/362428)
**Author:** [@sonirajil](https://discuss.elastic.co/u/sonirajil)\ **Replies:** 0\ **Last updated:** [July 3, 2024, 7:03am UTC](https://discuss.elastic.co/t/how-to-monitor-systems-up-or-down-with-ping-disabled-on-them/362428 "2024-07-03T07:03:53Z")
Hello, For security reasons, ping is disabled across servers in organization, Now in order to monitor system status (up/down) hence Heartbeat or Uptime are ruled out (as both work on ping mechanism) . Currently a basic… --- ## [Empty fields on rule writes to index](https://discuss.elastic.co/t/empty-fields-on-rule-writes-to-index/362424)
**Author:** [@znaskoe](https://discuss.elastic.co/u/znaskoe)\ **Replies:** 0\ **Last updated:** [July 3, 2024, 6:37am UTC](https://discuss.elastic.co/t/empty-fields-on-rule-writes-to-index/362424 "2024-07-03T06:37:20Z")
Hi everyone, I'm having some issues with my Disk Usage rule, more specifically with the document to index part. Some of my fields come out as empty. This is my current 'Document to index': { "doc\_type": "alert", "… --- ## [I have a Sales force Marketing cloud Application , i want to monitor it using elastic search](https://discuss.elastic.co/t/i-have-a-sales-force-marketing-cloud-application-i-want-to-monitor-it-using-elastic-search/362069)
**Author:** [@AKAM14](https://discuss.elastic.co/u/AKAM14)\ **Replies:** 3\ **Last updated:** [July 3, 2024, 5:56am UTC](https://discuss.elastic.co/t/i-have-a-sales-force-marketing-cloud-application-i-want-to-monitor-it-using-elastic-search/362069 "2024-07-03T05:56:45Z")
Hello Team, I want to monitor the Sales force applications (Marketing cloud) using Elasticsearch. i have the API of the Sales force. how can i monitor it using the Elasticsearch. Any documents or reference will be help… --- ## [Shrink issues through ILM](https://discuss.elastic.co/t/shrink-issues-through-ilm/362420)
**Author:** [@albus471105](https://discuss.elastic.co/u/albus471105)\ **Replies:** 0\ **Last updated:** [July 3, 2024, 5:39am UTC](https://discuss.elastic.co/t/shrink-issues-through-ilm/362420 "2024-07-03T05:39:32Z")
hi there, I have some questions about using shrink through ILM. First, I set the index to shrink to 1 shard when it moves to the warm phase. I encountered two issues: When shards relocates (transfer to warm node), it … --- ## [Unable to parse CSP logs with filebeat](https://discuss.elastic.co/t/unable-to-parse-csp-logs-with-filebeat/362279)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 15\ **Last updated:** [July 3, 2024, 3:12am UTC](https://discuss.elastic.co/t/unable-to-parse-csp-logs-with-filebeat/362279 "2024-07-03T03:12:34Z")
Hi Team, I am trying to parse the csp logs with filebeat and I tried numerous option but none of them is working. Can someone please help? Here are the raw csp log {"date":"01/Jul/2024:12:07:00 +0530", "IP address":"1… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=209) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=211)