# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=255

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 256

---

## [Certificate logstash](https://discuss.elastic.co/t/certificate-logstash/358225)

<div class="topic-metadata">

**Author:** [@samsu](https://discuss.elastic.co/u/samsu)\
**Replies:** 1\
**Last updated:** [April 25, 2024, 4:25pm UTC](https://discuss.elastic.co/t/certificate-logstash/358225 "2024-04-25T16:25:15Z")

</div>

xpack.management.elasticsearch.ssl.certificate\_authority: "/usr/share/logstash/conf.d/ssl/elasticsearch-ca.pem" xpack.management.elasticsearch.ssl.verification\_mode: "certificate" where can i find this certificate plea…

---

## [Extract filed from specific message](https://discuss.elastic.co/t/extract-filed-from-specific-message/358198)

<div class="topic-metadata">

**Author:** [@Omid\_Mosayebi](https://discuss.elastic.co/u/Omid_Mosayebi)\
**Replies:** 2\
**Last updated:** [April 25, 2024, 4:19pm UTC](https://discuss.elastic.co/t/extract-filed-from-specific-message/358198 "2024-04-25T16:19:21Z")

</div>

Hi Everyone. I have a problem. How can I extract statusCodeValue from 2024-04-24 11:02:20 - \[http-nio-8082-exec-6\] - \[2e7e7b76-fbb6-47b2-b07e-7471175aacea\] fiscal-information ResponseData \[{"headers":{},"body":{"timest…

---

## [Extract filed](https://discuss.elastic.co/t/extract-filed/358204)

<div class="topic-metadata">

**Author:** [@Omid\_Mosayebi](https://discuss.elastic.co/u/Omid_Mosayebi)\
**Replies:** 1\
**Last updated:** [April 25, 2024, 4:13pm UTC](https://discuss.elastic.co/t/extract-filed/358204 "2024-04-25T16:13:45Z")

</div>

Hi Everyone. I have a problem. How can I extract statusCodeValue from 2024-04-24 11:02:20 - \[http-nio-8082-exec-6\] - \[2e7e7b76-fbb6-47b2-b07e-7471175aacea\] fiscal-information ResponseData \[{"headers":{},"body":{"timest…

---

## [App Search Like Curations In Elasticsearch](https://discuss.elastic.co/t/app-search-like-curations-in-elasticsearch/358208)

<div class="topic-metadata">

**Author:** [@Chenko](https://discuss.elastic.co/u/Chenko)\
**Replies:** 1\
**Last updated:** [April 25, 2024, 4:09pm UTC](https://discuss.elastic.co/t/app-search-like-curations-in-elasticsearch/358208 "2024-04-25T16:09:33Z")

</div>

Hello. Context: We have prospects asking to combine App Search & Semantic Search. What is the best strategy? Specific Questions: Is there a curation like functionality in Semantic Search, already available today or i…

---

## [Inference API not working](https://discuss.elastic.co/t/inference-api-not-working/358209)

<div class="topic-metadata">

**Author:** [@Chenko](https://discuss.elastic.co/u/Chenko)\
**Replies:** 4\
**Last updated:** [April 25, 2024, 2:49pm UTC](https://discuss.elastic.co/t/inference-api-not-working/358209 "2024-04-25T14:49:48Z")

</div>

Hi, I was trying to embed some text with a model I uploaded in my local docker instance of elastic. I currently have elastic 8.11 here. When trying to do this I receive the following error: API Call (Kibana DevTools) …

---

## [Custom UDP Logs Integration Not Ingesting Data](https://discuss.elastic.co/t/custom-udp-logs-integration-not-ingesting-data/358136)

<div class="topic-metadata">

**Author:** [@callum](https://discuss.elastic.co/u/callum)\
**Replies:** 7\
**Last updated:** [April 25, 2024, 3:21pm UTC](https://discuss.elastic.co/t/custom-udp-logs-integration-not-ingesting-data/358136 "2024-04-25T15:21:46Z")

</div>

I currently have the 'Custom UDP Logs' integration setup on an Elastic Agent. It's configured to listen on all interfaces for port 9514: All other options are left as default, with the Syslog Options and custom pipel…

---

## [Filter mutate replace a field for specific value](https://discuss.elastic.co/t/filter-mutate-replace-a-field-for-specific-value/357730)

<div class="topic-metadata">

**Author:** [@Armalyca](https://discuss.elastic.co/u/Armalyca)\
**Replies:** 4\
**Last updated:** [April 25, 2024, 2:51pm UTC](https://discuss.elastic.co/t/filter-mutate-replace-a-field-for-specific-value/357730 "2024-04-25T14:51:00Z")

</div>

Hello, I use logstash 7.17. I want to create (or replace if existing) a field when I have a specific value. Here is a snippet of my code : filter { grok { match =\> { "\[topic\]" =\> "%{GREEDYDATA…

---

## [Dashboard creation](https://discuss.elastic.co/t/dashboard-creation/358125)

<div class="topic-metadata">

**Author:** [@gnatola](https://discuss.elastic.co/u/gnatola)\
**Replies:** 4\
**Last updated:** [April 25, 2024, 2:43pm UTC](https://discuss.elastic.co/t/dashboard-creation/358125 "2024-04-25T14:43:28Z")

</div>

Starting simply. I want to create a dashboard in Table format. All I want is a list of hosts, filtering out non-Windows server hosts. Can anyone help? Thanks

---

## [Im trying to update the elastic version from 5.x to 7.17.0](https://discuss.elastic.co/t/im-trying-to-update-the-elastic-version-from-5-x-to-7-17-0/358221)

<div class="topic-metadata">

**Author:** [@Varun\_Shetty](https://discuss.elastic.co/u/Varun_Shetty)\
**Replies:** 0\
**Last updated:** [April 25, 2024, 1:37pm UTC](https://discuss.elastic.co/t/im-trying-to-update-the-elastic-version-from-5-x-to-7-17-0/358221 "2024-04-25T13:37:57Z")

</div>

import org.elasticsearch.search.aggregations.bucket.significant.SignificantTerms; for this import im getting the error in the significant.what will be the replacement for this import ? SignificantTerms agg = response.g…

---

## [Trying to create a working ILM](https://discuss.elastic.co/t/trying-to-create-a-working-ilm/358200)

<div class="topic-metadata">

**Author:** [@grazingelk](https://discuss.elastic.co/u/grazingelk)\
**Replies:** 1\
**Last updated:** [April 25, 2024, 1:04pm UTC](https://discuss.elastic.co/t/trying-to-create-a-working-ilm/358200 "2024-04-25T13:04:29Z")

</div>

Hi all, I hope you can help me solve what I expect is a trivial issue but that I seem unable to solve. I hve a logstash output configured as: elasticsearch { hosts =\> \["https://elasticsearch-es-http.mynamespace.svc:…

---

## [Kibana (elastic) user login backoff and redirect to login page again](https://discuss.elastic.co/t/kibana-elastic-user-login-backoff-and-redirect-to-login-page-again/358081)

<div class="topic-metadata">

**Author:** [@Sunil\_Jagtap](https://discuss.elastic.co/u/Sunil_Jagtap)\
**Replies:** 3\
**Last updated:** [April 25, 2024, 1:01pm UTC](https://discuss.elastic.co/t/kibana-elastic-user-login-backoff-and-redirect-to-login-page-again/358081 "2024-04-25T13:01:00Z")

</div>

I am trying to consume GitHub - elastic/kibana: Your window into all of your data (branch : v8.13.2) for adding plugins but after adding the plugin using below command : node scripts/generate\_plugin tried to login to …

---

## [How to build a bulk request to post multiple values on a dense\_vector field](https://discuss.elastic.co/t/how-to-build-a-bulk-request-to-post-multiple-values-on-a-dense-vector-field/358147)

<div class="topic-metadata">

**Author:** [@ivanqwam](https://discuss.elastic.co/u/ivanqwam)\
**Replies:** 3\
**Last updated:** [April 25, 2024, 12:44pm UTC](https://discuss.elastic.co/t/how-to-build-a-bulk-request-to-post-multiple-values-on-a-dense-vector-field/358147 "2024-04-25T12:44:15Z")

</div>

I have a document describing a video in which there are multiple frames/images. The use case is to find the video containing frames/images similar to a given image. An image embedding is computed on each Frame/image an…

---

## [How to change the admin password for opensearch 2.10.0](https://discuss.elastic.co/t/how-to-change-the-admin-password-for-opensearch-2-10-0/358188)

<div class="topic-metadata">

**Author:** [@Sandeep\_Baljepally](https://discuss.elastic.co/u/Sandeep_Baljepally)\
**Replies:** 3\
**Last updated:** [April 25, 2024, 12:26pm UTC](https://discuss.elastic.co/t/how-to-change-the-admin-password-for-opensearch-2-10-0/358188 "2024-04-25T12:26:24Z")

</div>

Hi Im using opensearch 2.10.0 , running as a kubernetes pod with default (demo) certificates for opensearchm, but not sure how to change the password for admin user.

---

## [503 Service Unavailable](https://discuss.elastic.co/t/503-service-unavailable/358206)

<div class="topic-metadata">

**Author:** [@Brian2](https://discuss.elastic.co/u/Brian2)\
**Replies:** 2\
**Last updated:** [April 25, 2024, 11:52am UTC](https://discuss.elastic.co/t/503-service-unavailable/358206 "2024-04-25T11:52:45Z")

</div>

These are the logs that are printed last on ES, but whenever I try to reach host-ip:9290 or 9390 i get failed to connect via curl command, if i try to use rest client in java i get an exception with 503 service unavailab…

---

## [Assistance Needed with TCP Socket Log Transmission to Elastic](https://discuss.elastic.co/t/assistance-needed-with-tcp-socket-log-transmission-to-elastic/358192)

<div class="topic-metadata">

**Author:** [@Kamlesh.Solanki](https://discuss.elastic.co/u/Kamlesh.Solanki)\
**Replies:** 0\
**Last updated:** [April 25, 2024, 9:28am UTC](https://discuss.elastic.co/t/assistance-needed-with-tcp-socket-log-transmission-to-elastic/358192 "2024-04-25T09:28:54Z")

</div>

Subject: Assistance Needed with TCP Socket Log Transmission to Elastic Hello Elastic Community, I'm encountering an issue with sending logs to Elastic's Netskope integration using the Python socket library, and I'd app…

---

## [KnnQuery vs scripts\_score](https://discuss.elastic.co/t/knnquery-vs-scripts-score/358189)

<div class="topic-metadata">

**Author:** [@aj\_stor](https://discuss.elastic.co/u/aj_stor)\
**Replies:** 3\
**Last updated:** [April 25, 2024, 9:49am UTC](https://discuss.elastic.co/t/knnquery-vs-scripts-score/358189 "2024-04-25T09:49:56Z")

</div>

I want to implement a vector search in my application but I am trying to understand the differences between a KnnSearch and using the script\_score query. As far as I can see I only see downsides to the Knn Search: Knn…

---

## [Index Size , Shingle analyzer](https://discuss.elastic.co/t/index-size-shingle-analyzer/358197)

<div class="topic-metadata">

**Author:** [@sravan\_kaheti](https://discuss.elastic.co/u/sravan_kaheti)\
**Replies:** 0\
**Last updated:** [April 25, 2024, 9:43am UTC](https://discuss.elastic.co/t/index-size-shingle-analyzer/358197 "2024-04-25T09:43:56Z")

</div>

Hi Team , I have wet (webpages data)files in json format downloaded in machine, the size of the wet files are 2.5 TB in one machine , when i ingested the data to elastic with given mappings and settings , its becoming …

---

## [How i can iterate over nested propery in painless elasticsearch script](https://discuss.elastic.co/t/how-i-can-iterate-over-nested-propery-in-painless-elasticsearch-script/358186)

<div class="topic-metadata">

**Author:** [@David\_Gegiya](https://discuss.elastic.co/u/David_Gegiya)\
**Replies:** 0\
**Last updated:** [April 25, 2024, 9:05am UTC](https://discuss.elastic.co/t/how-i-can-iterate-over-nested-propery-in-painless-elasticsearch-script/358186 "2024-04-25T09:05:31Z")

</div>

My document mapping looks like this: "\_source": { "id": 60, "price": 60, "locations": \[ { "id": …

---

## [How can I stop filters from following me to other dashboards?](https://discuss.elastic.co/t/how-can-i-stop-filters-from-following-me-to-other-dashboards/357236)

<div class="topic-metadata">

**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\
**Replies:** 5\
**Last updated:** [April 25, 2024, 8:48am UTC](https://discuss.elastic.co/t/how-can-i-stop-filters-from-following-me-to-other-dashboards/357236 "2024-04-25T08:48:56Z")

</div>

Hello, I know that filters can be pinned or unpinned but is there a way to stop the filters from following me to other dashboards? I don't want to always manually pin a filter so it can stay?

---

## [Query non-exist fields exception](https://discuss.elastic.co/t/query-non-exist-fields-exception/358178)

<div class="topic-metadata">

**Author:** [@tengfei225](https://discuss.elastic.co/u/tengfei225)\
**Replies:** 1\
**Last updated:** [April 25, 2024, 8:42am UTC](https://discuss.elastic.co/t/query-non-exist-fields-exception/358178 "2024-04-25T08:42:02Z")

</div>

Hi I have found some inconsistency about querying non-exist fields for most of the cases , exception will be thrown only in nested range aggregation, If I query non-exist fields in query context or other types of agg…

---

## [Which node.roles is responsible for reindex process?](https://discuss.elastic.co/t/which-node-roles-is-responsible-for-reindex-process/358175)

<div class="topic-metadata">

**Author:** [@jfrank](https://discuss.elastic.co/u/jfrank)\
**Replies:** 1\
**Last updated:** [April 25, 2024, 7:58am UTC](https://discuss.elastic.co/t/which-node-roles-is-responsible-for-reindex-process/358175 "2024-04-25T07:58:30Z")

</div>

I wanted to reindex indice which is in warm phase and stays in node with node.roles: \[data\_warm\] but what I see in network statistics the other node's which holds every role network packet increased. So it seems that it …

---

## [Search with word1 and word2 together in Elastic](https://discuss.elastic.co/t/search-with-word1-and-word2-together-in-elastic/358014)

<div class="topic-metadata">

**Author:** [@giribabu\_sunkara](https://discuss.elastic.co/u/giribabu_sunkara)\
**Replies:** 3\
**Last updated:** [April 25, 2024, 6:19am UTC](https://discuss.elastic.co/t/search-with-word1-and-word2-together-in-elastic/358014 "2024-04-25T06:19:08Z")

</div>

Hi, We have a document with words lego(word1) and starwars(word2) with the name of the product when I search for legostarwars as a single word, we are not getting any results. Is there a way to achieve this search?

---

## [Bulk index efficiency advice](https://discuss.elastic.co/t/bulk-index-efficiency-advice/358163)

<div class="topic-metadata">

**Author:** [@Kyle\_Manuel](https://discuss.elastic.co/u/Kyle_Manuel)\
**Replies:** 1\
**Last updated:** [April 25, 2024, 5:17am UTC](https://discuss.elastic.co/t/bulk-index-efficiency-advice/358163 "2024-04-25T05:17:39Z")

</div>

Client: net6.0 v8.13.10 Elastic: v8.13.0 Using .NET TPL I have managed to improve our bulk operation efficiency to the point where Elastic is now our bottleneck. We need to load 250+ million records and the indexing t…

---

## [Can't import filebeat data source in kibana](https://discuss.elastic.co/t/cant-import-filebeat-data-source-in-kibana/358160)

<div class="topic-metadata">

**Author:** [@huanghaiqing1](https://discuss.elastic.co/u/huanghaiqing1)\
**Replies:** 1\
**Last updated:** [April 25, 2024, 5:23am UTC](https://discuss.elastic.co/t/cant-import-filebeat-data-source-in-kibana/358160 "2024-04-25T05:23:59Z")

</div>

Hello, here I create a latest version kibana/elasticsearch/filebeat in one testing server and configure well in related configuration files and services are up with no warnings. When I login kibana and can't see anything…

---

## [Duplicated logs](https://discuss.elastic.co/t/duplicated-logs/358074)

<div class="topic-metadata">

**Author:** [@cariinaar](https://discuss.elastic.co/u/cariinaar)\
**Replies:** 8\
**Last updated:** [April 25, 2024, 4:02am UTC](https://discuss.elastic.co/t/duplicated-logs/358074 "2024-04-25T04:02:58Z")

</div>

I am streaming logs to Elasticsearch through filebeat and logstash. Supposedly, if the the logs in the file is updated, it will only do subsequent updates and not push the existing logs (before the update). But right now…

---

## [Elastic Watcher Throttle\_Period for action does not work](https://discuss.elastic.co/t/elastic-watcher-throttle-period-for-action-does-not-work/358162)

<div class="topic-metadata">

**Author:** [@JasonREC](https://discuss.elastic.co/u/JasonREC)\
**Replies:** 0\
**Last updated:** [April 25, 2024, 2:16am UTC](https://discuss.elastic.co/t/elastic-watcher-throttle-period-for-action-does-not-work/358162 "2024-04-25T02:16:52Z")

</div>

Hi, Scenario: I have a watcher triggers every 10 mins and if the condition is determined to be true, and it will trigger action to send me an email. Now, what I hope to have is If the email is sent once, I want the next…

---

## [How Elasticsearch Index (Lucene) works under the covers?](https://discuss.elastic.co/t/how-elasticsearch-index-lucene-works-under-the-covers/358159)

<div class="topic-metadata">

**Author:** [@tommyd](https://discuss.elastic.co/u/tommyd)\
**Replies:** 2\
**Last updated:** [April 25, 2024, 2:14am UTC](https://discuss.elastic.co/t/how-elasticsearch-index-lucene-works-under-the-covers/358159 "2024-04-25T02:14:01Z")

</div>

Hello ES gurus, I have been testing ES index by indexing a bunch of JSON files containing many documents (\> 1000 documents per file). I have preprocessed these documents with the Bulk API header ({"index":{}}) so I can…

---

## [No data from my Metricbeat Docker Module](https://discuss.elastic.co/t/no-data-from-my-metricbeat-docker-module/358157)

<div class="topic-metadata">

**Author:** [@morningjacket](https://discuss.elastic.co/u/morningjacket)\
**Replies:** 0\
**Last updated:** [April 24, 2024, 8:09pm UTC](https://discuss.elastic.co/t/no-data-from-my-metricbeat-docker-module/358157 "2024-04-24T20:09:18Z")

</div>

Hello all, I am trying to get my Metricbeat docker module to connect to my ES/Kibana. I believe the issue is isolated to the docker module as I am able to see system module metrics. I have enabled the module root@hos…

---

## [Elasticsearch query performance testing, ignore cache flag/option?](https://discuss.elastic.co/t/elasticsearch-query-performance-testing-ignore-cache-flag-option/358155)

<div class="topic-metadata">

**Author:** [@ppafford](https://discuss.elastic.co/u/ppafford)\
**Replies:** 0\
**Last updated:** [April 24, 2024, 6:15pm UTC](https://discuss.elastic.co/t/elasticsearch-query-performance-testing-ignore-cache-flag-option/358155 "2024-04-24T18:15:43Z")

</div>

I can't find anything in the docs but does Elasticsearch Query API (I Think) have an option to not cache the query results so I can test the query performance? example query: GET my\_index-\*/\_count { "query": { "r…

---

## [Field duplication pod anotation](https://discuss.elastic.co/t/field-duplication-pod-anotation/358137)

<div class="topic-metadata">

**Author:** [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\
**Replies:** 0\
**Last updated:** [April 24, 2024, 2:22pm UTC](https://discuss.elastic.co/t/field-duplication-pod-anotation/358137 "2024-04-24T14:22:45Z")

</div>

Hi, I have the following annotation for my pod co.elastic.logs/enabled: true co.elastic.logs/processors.1.add\_fields.target: '' co.elastic.logs/processors.1.add\_fields.fields.abc: abc\_value co.elastic.logs/processors.2…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=254)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=256)
