# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=224 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 225 --- ## [Custom sorting](https://discuss.elastic.co/t/custom-sorting/360530)
**Author:** [@alexander.korkhov](https://discuss.elastic.co/u/alexander.korkhov)\ **Replies:** 1\ **Last updated:** [June 7, 2024, 10:56pm UTC](https://discuss.elastic.co/t/custom-sorting/360530 "2024-06-07T22:56:39Z")
Good afternoon! We need to do custom sorting in elastic. You need to give elastic a list of document IDs as input, according to which you need to sort the output. That is, we first sort by this list (to the top of the o… --- ## [Determine count of fields in a document](https://discuss.elastic.co/t/determine-count-of-fields-in-a-document/360946)
**Author:** [@lolabam](https://discuss.elastic.co/u/lolabam)\ **Replies:** 1\ **Last updated:** [June 7, 2024, 10:39pm UTC](https://discuss.elastic.co/t/determine-count-of-fields-in-a-document/360946 "2024-06-07T22:39:56Z")
I'm new to painless scripts. I'd like to create a runtime field that returns the count of fields in a document. Can anyone help with the right script to use? --- ## [Incomplete jdk.app in the installation package｜Unable to start Elasticsearch｜macOS x86\_64 | elasticsearch-8.13.2](https://discuss.elastic.co/t/incomplete-jdk-app-in-the-installation-package-unable-to-start-elasticsearch-macos-x86-64-elasticsearch-8-13-2/357275)
**Author:** [@Joanna\_Chang](https://discuss.elastic.co/u/Joanna_Chang)\ **Replies:** 4\ **Last updated:** [June 7, 2024, 10:19pm UTC](https://discuss.elastic.co/t/incomplete-jdk-app-in-the-installation-package-unable-to-start-elasticsearch-macos-x86-64-elasticsearch-8-13-2/357275 "2024-06-07T22:19:10Z")
Downloaded the installation package, elasticsearch-8.13.2, several times, but the system indicates that jdk.app is incomplete. Privacy and security settings are configured to allow open. Unable to start Elasticse… --- ## [Write to TSDS index via python](https://discuss.elastic.co/t/write-to-tsds-index-via-python/361001)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 9\ **Last updated:** [June 7, 2024, 7:53pm UTC](https://discuss.elastic.co/t/write-to-tsds-index-via-python/361001 "2024-06-07T19:53:42Z")
I create ILM/Template and Index when I try to write via python it errors but same record works via dev tool POST sachin\_test/\_doc { "@timestamp": "2024-06-06T19:21:15.000Z", --\> this part I did manually "system\_ty… --- ## [Filebeat 8.X slow "memory leak" from kubernetes watcher](https://discuss.elastic.co/t/filebeat-8-x-slow-memory-leak-from-kubernetes-watcher/361060)
**Author:** [@Marcos\_Toledo](https://discuss.elastic.co/u/Marcos_Toledo)\ **Replies:** 0\ **Last updated:** [June 7, 2024, 7:51pm UTC](https://discuss.elastic.co/t/filebeat-8-x-slow-memory-leak-from-kubernetes-watcher/361060 "2024-06-07T19:51:42Z")
Hi, After upgrading from filebeat 7 we've observed memory usage of certain daemons continuosly increasing until around 90% of the defined limits, and sometimes OOMing. After every restart the memory usage goes down to n… --- ## [Question about parsing log.file.path field](https://discuss.elastic.co/t/question-about-parsing-log-file-path-field/360872)
**Author:** [@Borja](https://discuss.elastic.co/u/Borja)\ **Replies:** 3\ **Last updated:** [June 7, 2024, 7:35pm UTC](https://discuss.elastic.co/t/question-about-parsing-log-file-path-field/360872 "2024-06-07T19:35:19Z")
Hi all, we are trying to ingest from filebeat some differents apache logs from diffent apps and different directories. So we have this input structure (this are the log.file.path fields ingested) /home/E879365/logs/ap… --- ## [\_dateparsefailure when trying to overwrite @timestamp](https://discuss.elastic.co/t/dateparsefailure-when-trying-to-overwrite-timestamp/360814)
**Author:** [@Cara410](https://discuss.elastic.co/u/Cara410)\ **Replies:** 8\ **Last updated:** [June 7, 2024, 7:05pm UTC](https://discuss.elastic.co/t/dateparsefailure-when-trying-to-overwrite-timestamp/360814 "2024-06-07T19:05:55Z")
Hello, I have been trying to get the timestamp to match the log entry and not the time it was ingested. I am using logstash 8.12.2 My log lines look like this: {"Timestamp":"2024-06-03 20:18:59.2251", "Message":"BLAH"}… --- ## [Filter Synthetics Tests for Synthetics Alert](https://discuss.elastic.co/t/filter-synthetics-tests-for-synthetics-alert/361054)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 0\ **Last updated:** [June 7, 2024, 5:17pm UTC](https://discuss.elastic.co/t/filter-synthetics-tests-for-synthetics-alert/361054 "2024-06-07T17:17:18Z")
I updated our Elastic stack to 8.14.0 earlier this week when it became available. As I was working with our synthetics, I observed that it is now possible to create a new Synthetics alert rule in addition to the default … --- ## [Searching from keyword field in Logstash with query](https://discuss.elastic.co/t/searching-from-keyword-field-in-logstash-with-query/361048)
**Author:** [@Ma\_G](https://discuss.elastic.co/u/Ma_G)\ **Replies:** 0\ **Last updated:** [June 7, 2024, 3:20pm UTC](https://discuss.elastic.co/t/searching-from-keyword-field-in-logstash-with-query/361048 "2024-06-07T15:20:42Z")
I would like to filter out the string "Alert" in the message field of my index. The field is a keyword field. To achieve this, I have written the following: filter { mutate { add\_field =\> {"secret" =\> "\ **Author:** [@Mansoor\_Ur\_Rehman](https://discuss.elastic.co/u/Mansoor_Ur_Rehman)\ **Replies:** 13\ **Last updated:** [June 7, 2024, 3:51pm UTC](https://discuss.elastic.co/t/logstash-output-date-using-timestamp-of-filebeat-instead-of-server-time/360845 "2024-06-07T15:51:41Z") I have setup a cluster filebeat -\> logstash -\> elasticsearch, i have a lifecycle policy that makes the indexes readonly after 7 days. i have out for logsatash index =\> "log-%{\[fields\]\[log\_name\]}-%{+YYYY.MM.dd}" … --- ## [Filebeat not able to read logs from kubernetes pod](https://discuss.elastic.co/t/filebeat-not-able-to-read-logs-from-kubernetes-pod/360966)
**Author:** [@snappie](https://discuss.elastic.co/u/snappie)\ **Replies:** 0\ **Last updated:** [June 6, 2024, 12:57pm UTC](https://discuss.elastic.co/t/filebeat-not-able-to-read-logs-from-kubernetes-pod/360966 "2024-06-06T12:57:01Z")
I am trying to input logs from Azure file share, so I created a volume mount in the Beats yaml file and was able to get the logs mounted under "/mnt/smbshare/Logs/\*.log". But filebeat is not able to read those logs with… --- ## [Kibana upgrade failed with v8](https://discuss.elastic.co/t/kibana-upgrade-failed-with-v8/361034)
**Author:** [@padmavathi](https://discuss.elastic.co/u/padmavathi)\ **Replies:** 2\ **Last updated:** [June 7, 2024, 12:18pm UTC](https://discuss.elastic.co/t/kibana-upgrade-failed-with-v8/361034 "2024-06-07T12:18:59Z")
Hi, I have upgraded kibana v8 from 7.17.16. I am getting the below error . Error: \[config validation of \[elasticsearch\].preserveHost\]: definition for this key is missing could you please help me. Thanks. --- ## [Connect remote cluster between a cluster disabled TLS/SSL and a cluster enabled TLS/SSL](https://discuss.elastic.co/t/connect-remote-cluster-between-a-cluster-disabled-tls-ssl-and-a-cluster-enabled-tls-ssl/361005)
**Author:** [@Huy\_Nguyen](https://discuss.elastic.co/u/Huy_Nguyen)\ **Replies:** 5\ **Last updated:** [June 7, 2024, 12:18pm UTC](https://discuss.elastic.co/t/connect-remote-cluster-between-a-cluster-disabled-tls-ssl-and-a-cluster-enabled-tls-ssl/361005 "2024-06-07T12:18:00Z")
I have a task migrate Elasticsearch from v7 to v8. I'd like new cluster add old cluster as a remote cluster. A cluster Elasticsearch v8 require enable https ssl/tls, however a cluster Elasticsearch v7 in prod environment… --- ## [How can I display visualizations that are specific to each user?](https://discuss.elastic.co/t/how-can-i-display-visualizations-that-are-specific-to-each-user/360915)
**Author:** [@Anupama2262](https://discuss.elastic.co/u/Anupama2262)\ **Replies:** 2\ **Last updated:** [June 7, 2024, 11:11am UTC](https://discuss.elastic.co/t/how-can-i-display-visualizations-that-are-specific-to-each-user/360915 "2024-06-07T11:11:23Z")
I've integrated a dashboard in my application using an iframe. For user-specific visualizations upon user login, I've applied a query parameter like \_a=(query:(language:kuery,query:'user\_id:example\_user\_id')) in iframe e… --- ## [Connection Timeout for AWS-S3 Repository](https://discuss.elastic.co/t/connection-timeout-for-aws-s3-repository/360952)
**Author:** [@Sasan\_Askari](https://discuss.elastic.co/u/Sasan_Askari)\ **Replies:** 1\ **Last updated:** [June 7, 2024, 8:28am UTC](https://discuss.elastic.co/t/connection-timeout-for-aws-s3-repository/360952 "2024-06-07T08:28:16Z")
Hi,I want to save my backups in AWS,below is my elastic for my docker compose that is run and up and work well and i add to enviornment into this configuration: version: '3' services: elasticsearch: image: focker.… --- ## [Filebeat 8.14 not sending data to Elasticsearch self-hosted](https://discuss.elastic.co/t/filebeat-8-14-not-sending-data-to-elasticsearch-self-hosted/360971)
**Author:** [@menzbua](https://discuss.elastic.co/u/menzbua)\ **Replies:** 4\ **Last updated:** [June 7, 2024, 8:26am UTC](https://discuss.elastic.co/t/filebeat-8-14-not-sending-data-to-elasticsearch-self-hosted/360971 "2024-06-07T08:26:45Z")
Problem I want to test our migration from Elastic-Stack 7 to 8. I have set up an elasticserch and kibana server. This is working fine. Now, I try to send docker container logs from a filebeat 8 instance to the elasticsea… --- ## [Impact of CVE-2023-32002,CVE-2023-32003,CVE-2023-32004,CVE-2023-32005,CVE-2023-32006,CVE-2023-32558,CVE-2023-32559 on Kibana v8.6.2](https://discuss.elastic.co/t/impact-of-cve-2023-32002-cve-2023-32003-cve-2023-32004-cve-2023-32005-cve-2023-32006-cve-2023-32558-cve-2023-32559-on-kibana-v8-6-2/360834)
**Author:** [@Ankita\_Pachauri](https://discuss.elastic.co/u/Ankita_Pachauri)\ **Replies:** 1\ **Last updated:** [June 7, 2024, 8:23am UTC](https://discuss.elastic.co/t/impact-of-cve-2023-32002-cve-2023-32003-cve-2023-32004-cve-2023-32005-cve-2023-32006-cve-2023-32558-cve-2023-32559-on-kibana-v8-6-2/360834 "2024-06-07T08:23:29Z")
This is regarding CVE-2023-32002,CVE-2023-32003,CVE-2023-32004,CVE-2023-32005,CVE-2023-32006,CVE-2023-32558,CVE-2023-32559 new vulnerabilities identified by our nessus scanner, we are seeking confirmation on Kibana 8.6.2… --- ## [Is correct way register a snapshot repository for security?](https://discuss.elastic.co/t/is-correct-way-register-a-snapshot-repository-for-security/361013)
**Author:** [@zmaxutbekov](https://discuss.elastic.co/u/zmaxutbekov)\ **Replies:** 2\ **Last updated:** [June 7, 2024, 6:39am UTC](https://discuss.elastic.co/t/is-correct-way-register-a-snapshot-repository-for-security/361013 "2024-06-07T06:39:32Z")
Hello everyone. I have an elastic cluster with version 7.16.2. A crontab script is run on one node, which makes a snapshot. Now, the situation is like this, it was decided to add a repository snapshot registration and de… --- ## [Reindex SentinelOne Agent log through a new ingest pipeline to rename network\_interfaces field](https://discuss.elastic.co/t/reindex-sentinelone-agent-log-through-a-new-ingest-pipeline-to-rename-network-interfaces-field/361014)
**Author:** [@Chaviru](https://discuss.elastic.co/u/Chaviru)\ **Replies:** 0\ **Last updated:** [June 7, 2024, 6:31am UTC](https://discuss.elastic.co/t/reindex-sentinelone-agent-log-through-a-new-ingest-pipeline-to-rename-network-interfaces-field/361014 "2024-06-07T06:31:33Z")
I am currently working with SentinelOne agent logs in my Elasticsearch Stack. And I need to reindex my managed SentinelOne agent index to a new index through a pipeline where I need to rename some fields from the log and… --- ## [Elastic agent for aws custom integration](https://discuss.elastic.co/t/elastic-agent-for-aws-custom-integration/360644)
**Author:** [@mealbert23](https://discuss.elastic.co/u/mealbert23)\ **Replies:** 1\ **Last updated:** [June 7, 2024, 5:50am UTC](https://discuss.elastic.co/t/elastic-agent-for-aws-custom-integration/360644 "2024-06-07T05:50:27Z")
Hi, A little background: I have setup elastic and kibana on an aws eks system. I am now trying to setup the aws custom integration piece. I have created the s3 bucket, sqs and a role with all the necessary permission… --- ## [Can't connect graylog client to ElasticSearch cluster](https://discuss.elastic.co/t/cant-connect-graylog-client-to-elasticsearch-cluster/360992)
**Author:** [@stecino](https://discuss.elastic.co/u/stecino)\ **Replies:** 1\ **Last updated:** [June 7, 2024, 5:45am UTC](https://discuss.elastic.co/t/cant-connect-graylog-client-to-elasticsearch-cluster/360992 "2024-06-07T05:45:29Z")
Hello, I have reconfigured graylog client to connect from one Elasticsearch cluster to another. Both clusters are version 2.3.5. But when I try to restart the client, I am getting error On master side \[WARN \]\[discover… --- ## [Create a cluster between elasticsearch nodes](https://discuss.elastic.co/t/create-a-cluster-between-elasticsearch-nodes/361002)
**Author:** [@mario\_kazela](https://discuss.elastic.co/u/mario_kazela)\ **Replies:** 1\ **Last updated:** [June 7, 2024, 5:26am UTC](https://discuss.elastic.co/t/create-a-cluster-between-elasticsearch-nodes/361002 "2024-06-07T05:26:47Z")
Hi, Need your help!!. I got some issue when creating the elasticsearch 7.x cluster. Right now I already created and have 3 elasticsearch nodes. But the issue when I verify my cluster state, it is show the number of no… --- ## [Grok parser incorrectly matches JAVACLASS](https://discuss.elastic.co/t/grok-parser-incorrectly-matches-javaclass/360951)
**Author:** [@Rade\_Pajic](https://discuss.elastic.co/u/Rade_Pajic)\ **Replies:** 4\ **Last updated:** [June 7, 2024, 5:12am UTC](https://discuss.elastic.co/t/grok-parser-incorrectly-matches-javaclass/360951 "2024-06-07T05:12:11Z")
Hello, I'm upgrading ELK from version 7.3.1 to 8.13.4. I have a problem with the Logstash pipeline as it does not work as expected, or I am missing something completely. I have Java logs, and I'm sending them to Logsta… --- ## [How to effectively kill defunct child processes generated by esrally tool?](https://discuss.elastic.co/t/how-to-effectively-kill-defunct-child-processes-generated-by-esrally-tool/361006)
**Author:** [@Andy\_Cong](https://discuss.elastic.co/u/Andy_Cong)\ **Replies:** 0\ **Last updated:** [June 7, 2024, 3:06am UTC](https://discuss.elastic.co/t/how-to-effectively-kill-defunct-child-processes-generated-by-esrally-tool/361006 "2024-06-07T03:06:05Z")
I am using the esrally tool, which generates a large number of child processes. I've noticed that some of these child processes become defunct. I am looking for an effective way to kill these defunct processes. Any sugge… --- ## [ILM policy not applied](https://discuss.elastic.co/t/ilm-policy-not-applied/359780)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 5\ **Last updated:** [June 6, 2024, 8:21pm UTC](https://discuss.elastic.co/t/ilm-policy-not-applied/359780 "2024-06-06T20:21:41Z")
Hello, I have an indice that does not follow the applied lifecycle policy. Other indexes for the indice are rotating correctly. The current size of the index is over 230 GB for the primary shard. Here is the ILM co… --- ## [Hybrid Search Java Api not returning Rank](https://discuss.elastic.co/t/hybrid-search-java-api-not-returning-rank/360700)
**Author:** [@Tommaso\_FAVARON](https://discuss.elastic.co/u/Tommaso_FAVARON)\ **Replies:** 5\ **Last updated:** [June 6, 2024, 5:31pm UTC](https://discuss.elastic.co/t/hybrid-search-java-api-not-returning-rank/360700 "2024-06-06T17:31:54Z")
Hello. I want to perform hybrid search using java client. With elasticsarch-java 8.11 environment, this is my query: SearchResponse\ response = esClient.search(s -\> s .index(index) … --- ## [Unable to generate Reports from Dashboard using both PDF and PNG](https://discuss.elastic.co/t/unable-to-generate-reports-from-dashboard-using-both-pdf-and-png/360947)
**Author:** [@Manoilayans](https://discuss.elastic.co/u/Manoilayans)\ **Replies:** 1\ **Last updated:** [June 6, 2024, 4:44pm UTC](https://discuss.elastic.co/t/unable-to-generate-reports-from-dashboard-using-both-pdf-and-png/360947 "2024-06-06T16:44:11Z")
When we try to generate report from the Dashboard using either PDF or PNG.. failed to generate the report. Please find attached details and let me know what changes required to fix this issue. Kibana and our Elasticsea… --- ## [I try to ingest the data from S3 bucket to opensearch dashboards using logstash](https://discuss.elastic.co/t/i-try-to-ingest-the-data-from-s3-bucket-to-opensearch-dashboards-using-logstash/360781)
**Author:** [@Rathiga\_Thambu](https://discuss.elastic.co/u/Rathiga_Thambu)\ **Replies:** 16\ **Last updated:** [June 6, 2024, 4:32pm UTC](https://discuss.elastic.co/t/i-try-to-ingest-the-data-from-s3-bucket-to-opensearch-dashboards-using-logstash/360781 "2024-06-06T16:32:05Z")
\[2024-06-04T11:09:21,409\]\[INFO \]\[logstash.javapipeline \]\[main\] Pipeline terminated {"pipeline.id"=\>"main"} \[2024-06-04T11:09:21,484\]\[ERROR\]\[logstash.agent \] Failed to execute action {:id=\>:main, :action\_typ… --- ## [Help with Logstash Multiline parsing for Stacktraces](https://discuss.elastic.co/t/help-with-logstash-multiline-parsing-for-stacktraces/360974)
**Author:** [@preguenga](https://discuss.elastic.co/u/preguenga)\ **Replies:** 2\ **Last updated:** [June 6, 2024, 2:27pm UTC](https://discuss.elastic.co/t/help-with-logstash-multiline-parsing-for-stacktraces/360974 "2024-06-06T14:27:28Z")
Hello Elastic Community, I am currently working on configuring Logstash to correctly process error stacktraces from Kubernetes logs. My goal is to ensure that stacktraces are combined into a single event before further … --- ## [Filebeat configuration for handling high file creation rate and small file sizes version 7.17](https://discuss.elastic.co/t/filebeat-configuration-for-handling-high-file-creation-rate-and-small-file-sizes-version-7-17/360955)
**Author:** [@Danyal\_Danish](https://discuss.elastic.co/u/Danyal_Danish)\ **Replies:** 2\ **Last updated:** [June 6, 2024, 1:54pm UTC](https://discuss.elastic.co/t/filebeat-configuration-for-handling-high-file-creation-rate-and-small-file-sizes-version-7-17/360955 "2024-06-06T13:54:04Z")
Can Filebeat be configured for handling high file creation rate (10 - 15 files per second) and for small file sizes of (500kb per file) version 7.17. My actual question is that what specific input type is preferable for … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=223) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=225)