# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=280 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 281 --- ## [Logstash split event messages to different syslog servers](https://discuss.elastic.co/t/logstash-split-event-messages-to-different-syslog-servers/355917)
**Author:** [@Forsaken\_Sherbert\_81](https://discuss.elastic.co/u/Forsaken_Sherbert_81)\ **Replies:** 0\ **Last updated:** [March 21, 2024, 3:11pm UTC](https://discuss.elastic.co/t/logstash-split-event-messages-to-different-syslog-servers/355917 "2024-03-21T15:11:05Z")
Hi all I have an specific use-case scenario were I'm testing out Elastic Agent on windows clients. Some of these logs will be sent to the ELK SIEM for analysis, more debuging and version related information. Other logs… --- ## [Java Client Library - ELSER](https://discuss.elastic.co/t/java-client-library-elser/355905)
**Author:** [@sivagurlinka](https://discuss.elastic.co/u/sivagurlinka)\ **Replies:** 1\ **Last updated:** [March 21, 2024, 2:57pm UTC](https://discuss.elastic.co/t/java-client-library-elser/355905 "2024-03-21T14:57:10Z")
We are trying to leverage ELSER search functionalities within our Java application. we would like to know How to use Java client library for performing ELSER Search ? RestHighLevelClient seems to be one solution we obse… --- ## [ElasticSearch Version Upgrade and OS migration](https://discuss.elastic.co/t/elasticsearch-version-upgrade-and-os-migration/355820)
**Author:** [@mukularora89](https://discuss.elastic.co/u/mukularora89)\ **Replies:** 4\ **Last updated:** [March 21, 2024, 2:56pm UTC](https://discuss.elastic.co/t/elasticsearch-version-upgrade-and-os-migration/355820 "2024-03-21T14:56:28Z")
Hi, We have a requirement where we need to upgrade OS and for Elasticsearch to run properly on new OS we need to upgrade ES version too. Here we have two options Option 1 - Upgrade Elasticsearch version on all nodes… --- ## [Metricbeat can't output to logstash](https://discuss.elastic.co/t/metricbeat-cant-output-to-logstash/355491)
**Author:** [@h.d.intodata](https://discuss.elastic.co/u/h.d.intodata)\ **Replies:** 6\ **Last updated:** [March 21, 2024, 2:55pm UTC](https://discuss.elastic.co/t/metricbeat-cant-output-to-logstash/355491 "2024-03-21T14:55:04Z")
Hi team, I had my metricbeat configured to elasticsearch, everything was working fine. I now need to include logstash, however, after changing the metricbeat output to logstash with my host, "http://\:5044"(e… --- ## [How to check if a string is in an array element's property - no ruby](https://discuss.elastic.co/t/how-to-check-if-a-string-is-in-an-array-elements-property-no-ruby/355907)
**Author:** [@richfish](https://discuss.elastic.co/u/richfish)\ **Replies:** 0\ **Last updated:** [March 21, 2024, 1:33pm UTC](https://discuss.elastic.co/t/how-to-check-if-a-string-is-in-an-array-elements-property-no-ruby/355907 "2024-03-21T13:33:39Z")
Without Ruby, I would like to find if a string is in a particular property of any of the elements of an array. Is there any way to do this without using Ruby? Let's say an array contains objects each with a 'name' prope… --- ## [Is there any way to remove log.syslog.structured\_data](https://discuss.elastic.co/t/is-there-any-way-to-remove-log-syslog-structured-data/355899)
**Author:** [@Madiha\_Samad](https://discuss.elastic.co/u/Madiha_Samad)\ **Replies:** 2\ **Last updated:** [March 21, 2024, 1:00pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-remove-log-syslog-structured-data/355899 "2024-03-21T13:00:30Z")
I am trying to parse checkpoint and fortinet logs through logstash and get log.syslog.structured\_data field in kibana/logscale .Is there any way to remove it ? I know it represents structured data expressed in RFC 5424 … --- ## [Grok parse failure](https://discuss.elastic.co/t/grok-parse-failure/355882)
**Author:** [@Anca\_Linca](https://discuss.elastic.co/u/Anca_Linca)\ **Replies:** 2\ **Last updated:** [March 21, 2024, 12:44pm UTC](https://discuss.elastic.co/t/grok-parse-failure/355882 "2024-03-21T12:44:09Z")
Hi! I am trying to parse a log that looks like this: 2024-03-21T09:33:14.187Z\\t77bfdcb9-15439-5d254-96r4a-12c543f7\\tDEBUG\\t\[logMetrics\] \[171101645.89459\] Metrics: {\\n fieldOne: 311,\\n fieldTwo: 36,\\n fieldThree: 34… --- ## [Aggregate by multiple fields of object in array](https://discuss.elastic.co/t/aggregate-by-multiple-fields-of-object-in-array/355830)
**Author:** [@Kaustav\_Shouvik](https://discuss.elastic.co/u/Kaustav_Shouvik)\ **Replies:** 3\ **Last updated:** [March 21, 2024, 12:01pm UTC](https://discuss.elastic.co/t/aggregate-by-multiple-fields-of-object-in-array/355830 "2024-03-21T12:01:37Z")
My data looks like this - \[ { "orderId": "1", "items": \[ {"id": "1", "name": "Item1"}, {"id": "2", "name": "Item2"} \] }, { "orderId": "2", "items": \[ {"id": "1", "name": "Item… --- ## [Sync multiple mysql tables with logstash](https://discuss.elastic.co/t/sync-multiple-mysql-tables-with-logstash/355810)
**Author:** [@abhinavtyagi](https://discuss.elastic.co/u/abhinavtyagi)\ **Replies:** 4\ **Last updated:** [March 21, 2024, 11:25am UTC](https://discuss.elastic.co/t/sync-multiple-mysql-tables-with-logstash/355810 "2024-03-21T11:25:22Z")
Hello, please take a look at my conf file for logstash: input { jdbc { jdbc\_driver\_library =\> "/usr/share/logstash/mysql-connector-java-8.0.22.jar" jdbc\_driver\_class =\> "com.mysql.cj.jdbc.Driver" jdbc\_conn… --- ## [ILM shrink prevent write on the shrinked index](https://discuss.elastic.co/t/ilm-shrink-prevent-write-on-the-shrinked-index/354848)
**Author:** [@voharunado](https://discuss.elastic.co/u/voharunado)\ **Replies:** 1\ **Last updated:** [March 13, 2024, 3:18pm UTC](https://discuss.elastic.co/t/ilm-shrink-prevent-write-on-the-shrinked-index/354848 "2024-03-13T15:18:01Z")
I noticed that the Shrink ILM operation makes the source & target index read only, which make sense because that's a requirement for a shrink even if done manually. The issue is that my shrinked index remains read only a… --- ## [How to update logstash 8.9.1 to 8.12.2](https://discuss.elastic.co/t/how-to-update-logstash-8-9-1-to-8-12-2/355891)
**Author:** [@Michael\_Mathan\_S](https://discuss.elastic.co/u/Michael_Mathan_S)\ **Replies:** 0\ **Last updated:** [March 21, 2024, 10:30am UTC](https://discuss.elastic.co/t/how-to-update-logstash-8-9-1-to-8-12-2/355891 "2024-03-21T10:30:55Z")
Here's the corrected text: "Hi, this is Michael Mathan S. I'm trying to upgrade Logstash from version 8.9.1 to 8.12.2, but I'm encountering several errors. Could you please advise me on how to fix the following errors? … --- ## [Kibana nodejs vul](https://discuss.elastic.co/t/kibana-nodejs-vul/355785)
**Author:** [@Ekta](https://discuss.elastic.co/u/Ekta)\ **Replies:** 5\ **Last updated:** [March 21, 2024, 10:10am UTC](https://discuss.elastic.co/t/kibana-nodejs-vul/355785 "2024-03-21T10:10:40Z")
Hi OS: Linux 22.04 Kibana version : 7.17.18 we are getting Node.js 18.x \< 18.19.1 / 20.x \< 20.11.1 / 21.x \< 21.6.2 Multiple Vulnerabilities in our older kibana 7.17.16. for resolve nodejs vulnerability we have upgrad… --- ## [Filebeat.netflow parse NAT log](https://discuss.elastic.co/t/filebeat-netflow-parse-nat-log/355887)
**Author:** [@shandian](https://discuss.elastic.co/u/shandian)\ **Replies:** 0\ **Last updated:** [March 21, 2024, 9:55am UTC](https://discuss.elastic.co/t/filebeat-netflow-parse-nat-log/355887 "2024-03-21T09:55:20Z")
Hello, I am using the netflow input of filebeat to parse data from NAT log. Fields in the NAT log are different from CISCO's netflow 9, so I use ''custom\_definitions''. However, filebeat encountered an error with the me… --- ## [Upgrading Kibana 7.17.6 to 8.12.2 and not logs Index](https://discuss.elastic.co/t/upgrading-kibana-7-17-6-to-8-12-2-and-not-logs-index/355593)
**Author:** [@michael8](https://discuss.elastic.co/u/michael8)\ **Replies:** 6\ **Last updated:** [March 21, 2024, 8:12am UTC](https://discuss.elastic.co/t/upgrading-kibana-7-17-6-to-8-12-2-and-not-logs-index/355593 "2024-03-21T08:12:57Z")
After upgrading Kibana 7.17.6 to 8.12.2, Kibana does not logs. Why? There were no problems before the migration. The indexes were downloading. --- ## [Remote cluster client error on Kubernetes Overview dashboard](https://discuss.elastic.co/t/remote-cluster-client-error-on-kubernetes-overview-dashboard/355874)
**Author:** [@WabWab](https://discuss.elastic.co/u/WabWab)\ **Replies:** 0\ **Last updated:** [March 21, 2024, 7:04am UTC](https://discuss.elastic.co/t/remote-cluster-client-error-on-kubernetes-overview-dashboard/355874 "2024-03-21T07:04:49Z")
We installed the ElasticAgent on Kubernetets as a DeamonSet and everything seems to work fine except a couple of a errors on the Overview dashboard. Yes, the cluster does not have that role because we don't have a re… --- ## [Filebeat recreate Historical Data index After Deleting Old Indexes](https://discuss.elastic.co/t/filebeat-recreate-historical-data-index-after-deleting-old-indexes/355865)
**Author:** [@hnuzhoulin](https://discuss.elastic.co/u/hnuzhoulin)\ **Replies:** 1\ **Last updated:** [March 21, 2024, 6:28am UTC](https://discuss.elastic.co/t/filebeat-recreate-historical-data-index-after-deleting-old-indexes/355865 "2024-03-21T06:28:39Z")
I use filebeat to get k8s logs,then send it to logstash which do some convert then send to different es index. I have tried deleting the k8s-app-{year}-{month}-{day} indexes from Elasticsearch for the year 2023,but they… --- ## [Generate date time string automatically](https://discuss.elastic.co/t/generate-date-time-string-automatically/355853)
**Author:** [@elichai](https://discuss.elastic.co/u/elichai)\ **Replies:** 2\ **Last updated:** [March 21, 2024, 4:16am UTC](https://discuss.elastic.co/t/generate-date-time-string-automatically/355853 "2024-03-21T04:16:20Z")
Hi, I am using Kibana and DSL query. I am searching a range of dates which should be set when I am running the query. For example - setting one date field with the current date and another 6 days earlier than the curren… --- ## [Fleet Server Output Setting](https://discuss.elastic.co/t/fleet-server-output-setting/355859)
**Author:** [@Nau79](https://discuss.elastic.co/u/Nau79)\ **Replies:** 0\ **Last updated:** [March 20, 2024, 11:26pm UTC](https://discuss.elastic.co/t/fleet-server-output-setting/355859 "2024-03-20T23:26:50Z")
Hi There, I am running a elsticsearch cluster with 3 Master Nodes, 3 Data Nodes and 1 Ingest Node. I am setting up the fleet server and I need to add the elasticsearch nodes in the Output section. My question is do I… --- ## [ElasticSearch Match Phrase Query Not returning expected results](https://discuss.elastic.co/t/elasticsearch-match-phrase-query-not-returning-expected-results/355664)
**Author:** [@abhijain](https://discuss.elastic.co/u/abhijain)\ **Replies:** 5\ **Last updated:** [March 20, 2024, 11:11pm UTC](https://discuss.elastic.co/t/elasticsearch-match-phrase-query-not-returning-expected-results/355664 "2024-03-20T23:11:48Z")
I have a document with field: "title1" as: "A380 Familiarization". When I run this query: the search results are empty. The document is not returned as part of the search query results. GET index/\_search { "from": … --- ## [Multiline codec behavior on large input files](https://discuss.elastic.co/t/multiline-codec-behavior-on-large-input-files/355838)
**Author:** [@Mahdi\_Moazami](https://discuss.elastic.co/u/Mahdi_Moazami)\ **Replies:** 2\ **Last updated:** [March 20, 2024, 9:31pm UTC](https://discuss.elastic.co/t/multiline-codec-behavior-on-large-input-files/355838 "2024-03-20T21:31:00Z")
Hi there hope you're doing well. I have a question about the details about how multiline codec processes the input file. based on the file input docs, the file is chunked and lines are being read from the chunks. say w… --- ## [Special char is parsing but not searching](https://discuss.elastic.co/t/special-char-is-parsing-but-not-searching/355847)
**Author:** [@nkf\_123](https://discuss.elastic.co/u/nkf_123)\ **Replies:** 0\ **Last updated:** [March 20, 2024, 8:36pm UTC](https://discuss.elastic.co/t/special-char-is-parsing-but-not-searching/355847 "2024-03-20T20:36:16Z")
I have defined my analyzer as below: "analysis": { "analyzer": { "my\_ngram\_analyzer": { "filter": \[ "lowercase" \], "type": "custom", "tokenizer": "my\_ngram\_tokenizer" } }, "tokenizer": { "my\_ngram\_tokenizer":… --- ## [Logstash configuration remove everything after "-"](https://discuss.elastic.co/t/logstash-configuration-remove-everything-after/355672)
**Author:** [@ska](https://discuss.elastic.co/u/ska)\ **Replies:** 3\ **Last updated:** [March 20, 2024, 8:23pm UTC](https://discuss.elastic.co/t/logstash-configuration-remove-everything-after/355672 "2024-03-20T20:23:34Z")
ELK 7.16.x In my logstash file, I have the following configuration: .... if \[kubernetes\]\[namespace\] == 'webservices' or \[kubernetes\]\[namespace\] =~ /webservices-frontend\\d+$/ { mutate { replace =\> { 'p… --- ## [Can I add alerts to a dashboard?](https://discuss.elastic.co/t/can-i-add-alerts-to-a-dashboard/355839)
**Author:** [@vpolius](https://discuss.elastic.co/u/vpolius)\ **Replies:** 4\ **Last updated:** [March 20, 2024, 8:20pm UTC](https://discuss.elastic.co/t/can-i-add-alerts-to-a-dashboard/355839 "2024-03-20T20:20:44Z")
I am creating a dashboard to show stats on a certain event. I was wondering if it is possible to also show any alerts relating to this event in another panel on the dashboard? --- ## [Shard Optimization - Size vs. Count](https://discuss.elastic.co/t/shard-optimization-size-vs-count/355822)
**Author:** [@algo](https://discuss.elastic.co/u/algo)\ **Replies:** 12\ **Last updated:** [March 20, 2024, 7:22pm UTC](https://discuss.elastic.co/t/shard-optimization-size-vs-count/355822 "2024-03-20T19:22:01Z")
Hi, We are looking to optimize the search rate and snapshot rate for two of our large indices. While we are exploring hardware improvements (I know the recommendation is to use locally attached SSDs), I am hoping to dis… --- ## [Proper way to restart elasticsearch in a cluster](https://discuss.elastic.co/t/proper-way-to-restart-elasticsearch-in-a-cluster/355794)
**Author:** [@tegerei](https://discuss.elastic.co/u/tegerei)\ **Replies:** 4\ **Last updated:** [March 20, 2024, 7:17pm UTC](https://discuss.elastic.co/t/proper-way-to-restart-elasticsearch-in-a-cluster/355794 "2024-03-20T19:17:00Z")
Hello, I have a 3 node ES cluster. Sometimes I do restarts on some or all of the nodes. Despite disabling shard allocation as explained here, I still get failed shards after the restart is complete and shard re-allocati… --- ## [How to send F5 telemetray data to Elesctic Cloud](https://discuss.elastic.co/t/how-to-send-f5-telemetray-data-to-elesctic-cloud/355828)
**Author:** [@ZAN\_YOUSEF](https://discuss.elastic.co/u/ZAN_YOUSEF)\ **Replies:** 2\ **Last updated:** [March 20, 2024, 6:28pm UTC](https://discuss.elastic.co/t/how-to-send-f5-telemetray-data-to-elesctic-cloud/355828 "2024-03-20T18:28:23Z")
Hello Elastic Gurus, I am trying to send F5 telemetry data to Elsaticcloud. The documents even at Elsaticcloud only points to have a JSON file which points to a HOST via http. In my case there is no host since I am usi… --- ## [Performance impact of "named-queries"](https://discuss.elastic.co/t/performance-impact-of-named-queries/355836)
**Author:** [@alliswell](https://discuss.elastic.co/u/alliswell)\ **Replies:** 0\ **Last updated:** [March 20, 2024, 5:19pm UTC](https://discuss.elastic.co/t/performance-impact-of-named-queries/355836 "2024-03-20T17:19:04Z")
Hi Folks, I was going through the documentation of named-queries. In the document, it mentions the following: This functionality reruns each named query on every hit in a search response. Typically, this adds a small … --- ## [Logstash - ES index mixed up](https://discuss.elastic.co/t/logstash-es-index-mixed-up/355796)
**Author:** [@maskrider1111](https://discuss.elastic.co/u/maskrider1111)\ **Replies:** 7\ **Last updated:** [March 20, 2024, 4:49pm UTC](https://discuss.elastic.co/t/logstash-es-index-mixed-up/355796 "2024-03-20T16:49:16Z")
Hey folks, Currently im trying to ingest multiple firewall log source by differencing the folders and index. I created conf file for each source so that it will be ingested separately into different index. However i stu… --- ## [When indices only exist on remote cluster: datafeed \[xxxx\] cannot retrieve data because no index matches datafeed's indices](https://discuss.elastic.co/t/when-indices-only-exist-on-remote-cluster-datafeed-xxxx-cannot-retrieve-data-because-no-index-matches-datafeeds-indices/355718)
**Author:** [@sparrowt](https://discuss.elastic.co/u/sparrowt)\ **Replies:** 1\ **Last updated:** [March 20, 2024, 4:12pm UTC](https://discuss.elastic.co/t/when-indices-only-exist-on-remote-cluster-datafeed-xxxx-cannot-retrieve-data-because-no-index-matches-datafeeds-indices/355718 "2024-03-20T16:12:15Z")
I am getting the following error when trying to start the datafeed of an ML Anomaly Detection Job: mydatafeed failed to start datafeed \[mydatafeed\] cannot retrieve data because no index matches datafeed's indices \[foo.… --- ## [No longer possible to Embed the Discover page?](https://discuss.elastic.co/t/no-longer-possible-to-embed-the-discover-page/355341)
**Author:** [@silentfilm](https://discuss.elastic.co/u/silentfilm)\ **Replies:** 8\ **Last updated:** [March 20, 2024, 3:39pm UTC](https://discuss.elastic.co/t/no-longer-possible-to-embed-the-discover-page/355341 "2024-03-20T15:39:26Z")
My company has been using Elasticsearch and Kibana for years. We are currently running version 8.8.2, but need to upgrade due to CVEs in that version. I've been tasked to upgrade to 8.12.1. In our product, we embed Kiba… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=279) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=281)