# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=235

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 236

---

## [Encountering NoSuchMethodError when Creating Elasticsearch Client](https://discuss.elastic.co/t/encountering-nosuchmethoderror-when-creating-elasticsearch-client/359763)

<div class="topic-metadata">

**Author:** [@Robin12](https://discuss.elastic.co/u/Robin12)\
**Replies:** 1\
**Last updated:** [May 22, 2024, 12:48pm UTC](https://discuss.elastic.co/t/encountering-nosuchmethoderror-when-creating-elasticsearch-client/359763 "2024-05-22T12:48:01Z")

</div>

I encountered a NoSuchMethodError when attempting to create an Elasticsearch client object in my Spring Boot Maven project. The error occurred specifically at the instantiation of the RestClientTransport object within th…

---

## [Alias Filter with Template Search](https://discuss.elastic.co/t/alias-filter-with-template-search/359983)

<div class="topic-metadata">

**Author:** [@bontempi](https://discuss.elastic.co/u/bontempi)\
**Replies:** 3\
**Last updated:** [May 22, 2024, 12:06pm UTC](https://discuss.elastic.co/t/alias-filter-with-template-search/359983 "2024-05-22T12:06:35Z")

</div>

I have an index pattern with documents that all have an owner field (owner\_username). This field contains the ES username of the person who owns the document. I'd like to set up a templated search alias, by which I mea…

---

## [Infinite Trial For Docker?](https://discuss.elastic.co/t/infinite-trial-for-docker/359987)

<div class="topic-metadata">

**Author:** [@Chenko](https://discuss.elastic.co/u/Chenko)\
**Replies:** 1\
**Last updated:** [May 22, 2024, 11:52am UTC](https://discuss.elastic.co/t/infinite-trial-for-docker/359987 "2024-05-22T11:52:03Z")

</div>

Hi all, I am wondering if there is a way to have an infinite trial for all my docker environments? I currently sometimes spin up a container with the trial license but if I return to that container after 30 days, which …

---

## [DB mapping list fliter](https://discuss.elastic.co/t/db-mapping-list-fliter/359932)

<div class="topic-metadata">

**Author:** [@bp365d](https://discuss.elastic.co/u/bp365d)\
**Replies:** 12\
**Last updated:** [May 22, 2024, 11:08am UTC](https://discuss.elastic.co/t/db-mapping-list-fliter/359932 "2024-05-22T11:08:36Z")

</div>

Team- can you help me in filter sections code, index name is :-esp\_test. input is sql table(esp\_details) and field names are hostname , BDS\_name. hostname BDS\_name --------------------------------------- hostnam…

---

## [Xiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: \[error connecting to Elasticsearch at http://127.0.0.1:9200: Get "http://127.0.0.1:9200": dial tcp 127.0.0.1:9200: connect: connection refused\]](https://discuss.elastic.co/t/xiting-couldnt-connect-to-any-of-the-configured-elasticsearch-hosts-errors-error-connecting-to-elasticsearch-at-http-127-0-0-1-get-http-127-0-0-1-9200-dial-tcp-127-0-0-1-connect-connection-refused/359981)

<div class="topic-metadata">

**Author:** [@tohkoecalo](https://discuss.elastic.co/u/tohkoecalo)\
**Replies:** 2\
**Last updated:** [May 22, 2024, 11:05am UTC](https://discuss.elastic.co/t/xiting-couldnt-connect-to-any-of-the-configured-elasticsearch-hosts-errors-error-connecting-to-elasticsearch-at-http-127-0-0-1-get-http-127-0-0-1-9200-dial-tcp-127-0-0-1-connect-connection-refused/359981 "2024-05-22T11:05:32Z")

</div>

Hi All, I try to run elasticsearch, kibana and filebeat as docker containers but got a problem. I receive a connection refused message while starting filebeat container. My startup command is: docker run docker.elastic…

---

## [Stop sending (duplicate) notification if alert is Active](https://discuss.elastic.co/t/stop-sending-duplicate-notification-if-alert-is-active/359982)

<div class="topic-metadata">

**Author:** [@pras](https://discuss.elastic.co/u/pras)\
**Replies:** 0\
**Last updated:** [May 22, 2024, 10:14am UTC](https://discuss.elastic.co/t/stop-sending-duplicate-notification-if-alert-is-active/359982 "2024-05-22T10:14:26Z")

</div>

I have an alert rule which monitor filesystem used for all of the hosts in our server farm and windows drives on those host. I want to stop sending repeat notification if an Alert/Warning is active for a specific host an…

---

## [Java.exe consuming lot of memory and eventually Elasticsearch searches start failing](https://discuss.elastic.co/t/java-exe-consuming-lot-of-memory-and-eventually-elasticsearch-searches-start-failing/359960)

<div class="topic-metadata">

**Author:** [@Kalidastate](https://discuss.elastic.co/u/Kalidastate)\
**Replies:** 3\
**Last updated:** [May 22, 2024, 9:58am UTC](https://discuss.elastic.co/t/java-exe-consuming-lot-of-memory-and-eventually-elasticsearch-searches-start-failing/359960 "2024-05-22T09:58:30Z")

</div>

It has observed in the production environment. When a search is fired, memory consumption of Java.exe increases and it does not reduce even after the search is finished. Eventually the memory consumption reaches to above…

---

## [Getting wrong\_method\_type\_exception](https://discuss.elastic.co/t/getting-wrong-method-type-exception/359905)

<div class="topic-metadata">

**Author:** [@Aditya\_Teltia](https://discuss.elastic.co/u/Aditya_Teltia)\
**Replies:** 15\
**Last updated:** [May 22, 2024, 9:54am UTC](https://discuss.elastic.co/t/getting-wrong-method-type-exception/359905 "2024-05-22T09:54:11Z")

</div>

Query - {"timeout":"900000ms","query":{"constant\_score":{"filter":{"bool":{"must":{"bool":{"must":\[{"bool":{"should":\[{"terms":{"addI.sem.data.sentiment\_polarity":\["-1","-2","-1.0","-2.0","negative"\]}},{"terms":{"addI.s…

---

## [Convert in pipeline is not converting](https://discuss.elastic.co/t/convert-in-pipeline-is-not-converting/359964)

<div class="topic-metadata">

**Author:** [@Balu](https://discuss.elastic.co/u/Balu)\
**Replies:** 3\
**Last updated:** [May 22, 2024, 9:25am UTC](https://discuss.elastic.co/t/convert-in-pipeline-is-not-converting/359964 "2024-05-22T09:25:37Z")

</div>

Hello folks, I created an Ingest Pipeline that uses some grok patterns to split up fields. In the end I do a few converts to change the type of the fields. For example I am converting this field into an IP: { "c…

---

## [How to add an additional field in elastic search ?I want to create an additional field to show time difference between two events in the new created field](https://discuss.elastic.co/t/how-to-add-an-additional-field-in-elastic-search-i-want-to-create-an-additional-field-to-show-time-difference-between-two-events-in-the-new-created-field/359957)

<div class="topic-metadata">

**Author:** [@gaurow.deshmukh](https://discuss.elastic.co/u/gaurow.deshmukh)\
**Replies:** 1\
**Last updated:** [May 22, 2024, 8:41am UTC](https://discuss.elastic.co/t/how-to-add-an-additional-field-in-elastic-search-i-want-to-create-an-additional-field-to-show-time-difference-between-two-events-in-the-new-created-field/359957 "2024-05-22T08:41:05Z")

</div>

I want to create an additional field to show time difference between two events..

---

## [Kibana -Couldn't configure Elastic,Retry or update the kibana.yml file manually](https://discuss.elastic.co/t/kibana-couldnt-configure-elastic-retry-or-update-the-kibana-yml-file-manually/359958)

<div class="topic-metadata">

**Author:** [@herobaozheng](https://discuss.elastic.co/u/herobaozheng)\
**Replies:** 2\
**Last updated:** [May 22, 2024, 8:35am UTC](https://discuss.elastic.co/t/kibana-couldnt-configure-elastic-retry-or-update-the-kibana-yml-file-manually/359958 "2024-05-22T08:35:34Z")

</div>

i am using Docker to setup the elasticsearch env(which set up in a cloud server) by using the following shell docker run --name es813 -e "discovery.type=single-node" \\ -e "ES\_JAVA\_OPTS=-Xms512m -Xmx512m" \\ -p 11111:920…

---

## [Rollover runs earlier than expected](https://discuss.elastic.co/t/rollover-runs-earlier-than-expected/359925)

<div class="topic-metadata">

**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\
**Replies:** 1\
**Last updated:** [May 22, 2024, 8:09am UTC](https://discuss.elastic.co/t/rollover-runs-earlier-than-expected/359925 "2024-05-22T08:09:24Z")

</div>

I have an index with 2 shards, I configured a policy that performs rollover on max\_primary\_shard\_size=40gb. "policy": { "phases": { "hot": { "min\_age": "0ms", "actions": { "…

---

## [Extracting path fragments from \`log.file.path\` field](https://discuss.elastic.co/t/extracting-path-fragments-from-log-file-path-field/359726)

<div class="topic-metadata">

**Author:** [@neesa](https://discuss.elastic.co/u/neesa)\
**Replies:** 2\
**Last updated:** [May 22, 2024, 8:11am UTC](https://discuss.elastic.co/t/extracting-path-fragments-from-log-file-path-field/359726 "2024-05-22T08:11:30Z")

</div>

Hi, I'm trying to extract two strings from the metadata log.file.path field, and create one or two fields, depending on whether the first of these fields has the appropriate value. Sample log.file.path field content of…

---

## [Ingest pipelines: logstash equivalent template for winlogbeat security](https://discuss.elastic.co/t/ingest-pipelines-logstash-equivalent-template-for-winlogbeat-security/359634)

<div class="topic-metadata">

**Author:** [@s0p4L1n3](https://discuss.elastic.co/u/s0p4L1n3)\
**Replies:** 6\
**Last updated:** [May 22, 2024, 7:58am UTC](https://discuss.elastic.co/t/ingest-pipelines-logstash-equivalent-template-for-winlogbeat-security/359634 "2024-05-22T07:58:15Z")

</div>

Hello, I've just found that there are Ingest Pipelines and I was wondering if there is an equivalent template for logstash or maybe if you know how to convert it to logstash format ? It would be useful especially for t…

---

## [Sorting get Aliases](https://discuss.elastic.co/t/sorting-get-aliases/359927)

<div class="topic-metadata">

**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\
**Replies:** 2\
**Last updated:** [May 22, 2024, 7:15am UTC](https://discuss.elastic.co/t/sorting-get-aliases/359927 "2024-05-22T07:15:39Z")

</div>

Hi, I am looking way to execute cat in the new Java client GET \_cat/aliases/bbb\*/?format=json&s=is\_write\_index:desc I found this way: AliasesRequest request = AliasesRequest.of(ar -\> ar.name(pattern)); var re…

---

## [Logstash STOMP input plugin throws error](https://discuss.elastic.co/t/logstash-stomp-input-plugin-throws-error/359862)

<div class="topic-metadata">

**Author:** [@Askia\_Mohamed\_Kadri](https://discuss.elastic.co/u/Askia_Mohamed_Kadri)\
**Replies:** 6\
**Last updated:** [May 22, 2024, 6:59am UTC](https://discuss.elastic.co/t/logstash-stomp-input-plugin-throws-error/359862 "2024-05-22T06:59:32Z")

</div>

Hi there! I'm having an issue using Logstash STOMP input plugin. When running my configuration file, i get this error and don't have any on why I get it: Pipeline error {:pipeline\_id=\>"server05", :exception=\>#\<NameErr…

---

## [Best load balancing solution for logstash service](https://discuss.elastic.co/t/best-load-balancing-solution-for-logstash-service/359896)

<div class="topic-metadata">

**Author:** [@Saikiran\_Pulijala](https://discuss.elastic.co/u/Saikiran_Pulijala)\
**Replies:** 5\
**Last updated:** [May 22, 2024, 5:40am UTC](https://discuss.elastic.co/t/best-load-balancing-solution-for-logstash-service/359896 "2024-05-22T05:40:51Z")

</div>

Hi Team, Currently we have logstash deployed on AWS ECS with service discovery (DNS), which creates DNS records pointing to task containers, We are pointing filebeat to these Domain names, with this setup Due to DNS TTL…

---

## [Module not found: Error: Can't resolve '@kbn/i18n/react' in public components](https://discuss.elastic.co/t/module-not-found-error-cant-resolve-kbn-i18n-react-in-public-components/359834)

<div class="topic-metadata">

**Author:** [@Sunil\_Jagtap](https://discuss.elastic.co/u/Sunil_Jagtap)\
**Replies:** 2\
**Last updated:** [May 22, 2024, 5:05am UTC](https://discuss.elastic.co/t/module-not-found-error-cant-resolve-kbn-i18n-react-in-public-components/359834 "2024-05-22T05:05:28Z")

</div>

Hi Everyone, I am facing below error while starting kiban from plugin development environment with "yarn start" ERROR in ./public/components/app.tsx │ Module not found: Error: Can't resolve '@kbn…

---

## [Logstash Grok Parsing multiple lines](https://discuss.elastic.co/t/logstash-grok-parsing-multiple-lines/359948)

<div class="topic-metadata">

**Author:** [@iceman0410](https://discuss.elastic.co/u/iceman0410)\
**Replies:** 0\
**Last updated:** [May 22, 2024, 2:57am UTC](https://discuss.elastic.co/t/logstash-grok-parsing-multiple-lines/359948 "2024-05-22T02:57:50Z")

</div>

Hi everyone, I am new on GROK I have a message log with multiple lines need to parse. Anyone please help me check my Grok and kindly give me advices. Thanks Log message: "INFO 2023-09-12 13:18:22,057 \[\[MuleRuntime\].…

---

## [The difference between the EPR and EAR, do I need both for an air-gapped environment?](https://discuss.elastic.co/t/the-difference-between-the-epr-and-ear-do-i-need-both-for-an-air-gapped-environment/359947)

<div class="topic-metadata">

**Author:** [@sreeves0](https://discuss.elastic.co/u/sreeves0)\
**Replies:** 0\
**Last updated:** [May 22, 2024, 2:35am UTC](https://discuss.elastic.co/t/the-difference-between-the-epr-and-ear-do-i-need-both-for-an-air-gapped-environment/359947 "2024-05-22T02:35:35Z")

</div>

Hello, Sorry if this is a dumb question but I am new to setting up Elastic and hosting my own package registry. When using Elastic Agent do I need to have both the Elastic package registry and artifact registry to be ho…

---

## [History backlog chart of GutHub issues](https://discuss.elastic.co/t/history-backlog-chart-of-guthub-issues/359734)

<div class="topic-metadata">

**Author:** [@oskrdt](https://discuss.elastic.co/u/oskrdt)\
**Replies:** 2\
**Last updated:** [May 21, 2024, 9:51pm UTC](https://discuss.elastic.co/t/history-backlog-chart-of-guthub-issues/359734 "2024-05-21T21:51:56Z")

</div>

I have an index where I'm dumping the information from a GitHub repository that I want to create a chart to view the opened, closed and backlog (opened - closed) issues by date to view the progress. I have the fields cr…

---

## [Determining the count of words in a given field](https://discuss.elastic.co/t/determining-the-count-of-words-in-a-given-field/359578)

<div class="topic-metadata">

**Author:** [@Honestabe](https://discuss.elastic.co/u/Honestabe)\
**Replies:** 10\
**Last updated:** [May 21, 2024, 9:44pm UTC](https://discuss.elastic.co/t/determining-the-count-of-words-in-a-given-field/359578 "2024-05-21T21:44:02Z")

</div>

I wrote a painless script to determine the word count in a particular filed emit (doc\['skus.keyword'\].length) the problem is that it doesn't count duplicates. so if there is more than one of the same keyword it only…

---

## [Filtering by a nested common field](https://discuss.elastic.co/t/filtering-by-a-nested-common-field/359856)

<div class="topic-metadata">

**Author:** [@Fabio\_Bazurto](https://discuss.elastic.co/u/Fabio_Bazurto)\
**Replies:** 2\
**Last updated:** [May 21, 2024, 9:20pm UTC](https://discuss.elastic.co/t/filtering-by-a-nested-common-field/359856 "2024-05-21T21:20:36Z")

</div>

Given I have records with following structure: { ... , "CustomerInfo": { "GasStation": { "cardID": "abc123456" } } } { ... , "CustomerInfo": { "SuperMarket": { "cardID": "…

---

## [Unable to setup alerts through rules in Kibana](https://discuss.elastic.co/t/unable-to-setup-alerts-through-rules-in-kibana/359868)

<div class="topic-metadata">

**Author:** [@swminnick](https://discuss.elastic.co/u/swminnick)\
**Replies:** 1\
**Last updated:** [May 21, 2024, 8:28pm UTC](https://discuss.elastic.co/t/unable-to-setup-alerts-through-rules-in-kibana/359868 "2024-05-21T20:28:16Z")

</div>

I've been using Kibana through Security Onion to collect authorization logs. I have a solid stream of logs and parsing operations. When I create a rule, there is no place to create an action that occurs when that rule is…

---

## [How to read a dashboard in kibana with API?](https://discuss.elastic.co/t/how-to-read-a-dashboard-in-kibana-with-api/359740)

<div class="topic-metadata">

**Author:** [@wassidi](https://discuss.elastic.co/u/wassidi)\
**Replies:** 3\
**Last updated:** [May 21, 2024, 8:12pm UTC](https://discuss.elastic.co/t/how-to-read-a-dashboard-in-kibana-with-api/359740 "2024-05-21T20:12:01Z")

</div>

Hello, i'm new to kibana / elasticsearch and i want to extract data from a kibana dashboard using the API ( if possible ) , the kibana dashboard contains multiple graphs , i want to extract data from each graph individua…

---

## [Transform vs update vs recreating index for historical/last values indexes](https://discuss.elastic.co/t/transform-vs-update-vs-recreating-index-for-historical-last-values-indexes/359923)

<div class="topic-metadata">

**Author:** [@PMF](https://discuss.elastic.co/u/PMF)\
**Replies:** 0\
**Last updated:** [May 21, 2024, 1:00pm UTC](https://discuss.elastic.co/t/transform-vs-update-vs-recreating-index-for-historical-last-values-indexes/359923 "2024-05-21T13:00:39Z")

</div>

On our current project we're looking for an approach where we create an index where all of our data is stored in a continuous way, creating a new document for each data change (let's call it "main index"), and another in…

---

## [Kibana data table for user sessions on win10](https://discuss.elastic.co/t/kibana-data-table-for-user-sessions-on-win10/359921)

<div class="topic-metadata">

**Author:** [@Louis\_Lelievre](https://discuss.elastic.co/u/Louis_Lelievre)\
**Replies:** 0\
**Last updated:** [May 21, 2024, 12:52pm UTC](https://discuss.elastic.co/t/kibana-data-table-for-user-sessions-on-win10/359921 "2024-05-21T12:52:13Z")

</div>

Hi, I'm new to the elastic stack, and I'm trying to create a data table with the following information in a single line : date/hour/second of the started win10 session date/hour/second of the ended win10 session sessi…

---

## [How to get the ES node details from plugin to separate nestJS backend](https://discuss.elastic.co/t/how-to-get-the-es-node-details-from-plugin-to-separate-nestjs-backend/357765)

<div class="topic-metadata">

**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\
**Replies:** 2\
**Last updated:** [May 21, 2024, 7:52pm UTC](https://discuss.elastic.co/t/how-to-get-the-es-node-details-from-plugin-to-separate-nestjs-backend/357765 "2024-05-21T19:52:19Z")

</div>

Hi, I am developing an external plugin using React. I have a separate nestJS backend for the same, and would like to have all the data retrieval for the plugin to be done in the Backend. That is, the nestJS backend wi…

---

## [Feasibility of Implementing Advanced Full Text Search Capabilities in Elasticsearch for a Big Data Warehouse](https://discuss.elastic.co/t/feasibility-of-implementing-advanced-full-text-search-capabilities-in-elasticsearch-for-a-big-data-warehouse/359936)

<div class="topic-metadata">

**Author:** [@Sarthak\_Jain](https://discuss.elastic.co/u/Sarthak_Jain)\
**Replies:** 0\
**Last updated:** [May 21, 2024, 4:27pm UTC](https://discuss.elastic.co/t/feasibility-of-implementing-advanced-full-text-search-capabilities-in-elasticsearch-for-a-big-data-warehouse/359936 "2024-05-21T16:27:56Z")

</div>

Hi Folks, I am currently working on a project to build a full text search for scientific research data. I need guidance on the feasibility of implementing the following functionality: Basic Search Operators: AND: Se…

---

## [Are snapshots taken during upgrade backward-compatible?](https://discuss.elastic.co/t/are-snapshots-taken-during-upgrade-backward-compatible/359935)

<div class="topic-metadata">

**Author:** [@shaigbdb](https://discuss.elastic.co/u/shaigbdb)\
**Replies:** 1\
**Last updated:** [May 21, 2024, 4:00pm UTC](https://discuss.elastic.co/t/are-snapshots-taken-during-upgrade-backward-compatible/359935 "2024-05-21T16:00:43Z")

</div>

I have an upgrade planned that will take several days. There is a daily snapshot scheduled in SLM. According to the documentation, "You can’t restore a snapshot to an earlier version of Elasticsearch". According to the…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=234)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=236)
