# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=300

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 301

---

## [ValueError "ca\_certs parameter is not a path"](https://discuss.elastic.co/t/valueerror-ca-certs-parameter-is-not-a-path/353874)

<div class="topic-metadata">

**Author:** [@rue1](https://discuss.elastic.co/u/rue1)\
**Replies:** 0\
**Last updated:** [February 22, 2024, 10:07am UTC](https://discuss.elastic.co/t/valueerror-ca-certs-parameter-is-not-a-path/353874 "2024-02-22T10:07:03Z")

</div>

So im trying to set up a Sharepoint Online Connector in Docker and when i do Docker run, i get following Error and logs: ~/connectors-config$ docker run -v ~/connectors-config:/config --network "elastic" --tty --rm dock…

---

## [Backward compatibility while upgrding major version of elastic search](https://discuss.elastic.co/t/backward-compatibility-while-upgrding-major-version-of-elastic-search/353858)

<div class="topic-metadata">

**Author:** [@abhadauria](https://discuss.elastic.co/u/abhadauria)\
**Replies:** 3\
**Last updated:** [February 22, 2024, 10:02am UTC](https://discuss.elastic.co/t/backward-compatibility-while-upgrding-major-version-of-elastic-search/353858 "2024-02-22T10:02:35Z")

</div>

We are upgrading the major version of Elasticsearch from 7.x to 8.x, is there any guideline/documentation for the same as there are no changes for the same in NEST client for this version upgrade but there are changes in…

---

## [How to use cummulative sum correctly for a machine learning job?](https://discuss.elastic.co/t/how-to-use-cummulative-sum-correctly-for-a-machine-learning-job/352659)

<div class="topic-metadata">

**Author:** [@Rick\_V](https://discuss.elastic.co/u/Rick_V)\
**Replies:** 11\
**Last updated:** [February 22, 2024, 9:59am UTC](https://discuss.elastic.co/t/how-to-use-cummulative-sum-correctly-for-a-machine-learning-job/352659 "2024-02-22T09:59:48Z")

</div>

Hi all, I want to create a ml job which analyses the trend in a cumulative value. So, I created the following aggregation which calculates the sum of a field every day, and then calculates the cumulative sum with the va…

---

## [Modifying Refresh Settings for BulkIngester Instances](https://discuss.elastic.co/t/modifying-refresh-settings-for-bulkingester-instances/353699)

<div class="topic-metadata">

**Author:** [@Ivelin\_Yanev](https://discuss.elastic.co/u/Ivelin_Yanev)\
**Replies:** 10\
**Last updated:** [February 22, 2024, 9:49am UTC](https://discuss.elastic.co/t/modifying-refresh-settings-for-bulkingester-instances/353699 "2024-02-22T09:49:49Z")

</div>

Hi team, I'm currently working with the BulkIngester in my Elasticsearch project and I have a question regarding the refresh setting. After creating the BulkIngester instance using the following code snippet: ingester…

---

## [How to save "total hits" results from a query, in a field](https://discuss.elastic.co/t/how-to-save-total-hits-results-from-a-query-in-a-field/353807)

<div class="topic-metadata">

**Author:** [@Andex](https://discuss.elastic.co/u/Andex)\
**Replies:** 3\
**Last updated:** [February 22, 2024, 8:26am UTC](https://discuss.elastic.co/t/how-to-save-total-hits-results-from-a-query-in-a-field/353807 "2024-02-22T08:26:00Z")

</div>

Hi, i 'm trying to using Logstash to send email. I configure the input pipeline filter witha a query, i need to find all the document that contain ERROR in the message. I do that. in the output i want to user the tota…

---

## [Changing the precision of the @timestamp field](https://discuss.elastic.co/t/changing-the-precision-of-the-timestamp-field/353728)

<div class="topic-metadata">

**Author:** [@ankh](https://discuss.elastic.co/u/ankh)\
**Replies:** 8\
**Last updated:** [February 22, 2024, 8:23am UTC](https://discuss.elastic.co/t/changing-the-precision-of-the-timestamp-field/353728 "2024-02-22T08:23:50Z")

</div>

I have been using the generated @timestamp field in our documents as a record of when a document was sent to Elastic. I have been renaming the field in Logstash to suit our document structure. rename =\> { "@timestamp" =\>…

---

## [Segregate filebeat log from kubernetes](https://discuss.elastic.co/t/segregate-filebeat-log-from-kubernetes/353855)

<div class="topic-metadata">

**Author:** [@srinikar87](https://discuss.elastic.co/u/srinikar87)\
**Replies:** 0\
**Last updated:** [February 22, 2024, 7:50am UTC](https://discuss.elastic.co/t/segregate-filebeat-log-from-kubernetes/353855 "2024-02-22T07:50:39Z")

</div>

How to segregate log stream messages with kubernetes pod name and namespace and container name Filebeat configuration dnsPolicy: ClusterFirstWithHostNet hostNetwork: true securityContext: runAsUser…

---

## [\[Kafka Input\] Error using Custom Java Assignor class](https://discuss.elastic.co/t/kafka-input-error-using-custom-java-assignor-class/353853)

<div class="topic-metadata">

**Author:** [@samde](https://discuss.elastic.co/u/samde)\
**Replies:** 1\
**Last updated:** [February 22, 2024, 7:42am UTC](https://discuss.elastic.co/t/kafka-input-error-using-custom-java-assignor-class/353853 "2024-02-22T07:42:57Z")

</div>

Trying to use a custom assignor in partition\_assignment\_strategy but getting the following error. Expectation: Logstash is able to run without issues as partition\_assignment\_strategy field still seems to support java c…

---

## [Indexing crashing due to large dataset](https://discuss.elastic.co/t/indexing-crashing-due-to-large-dataset/352715)

<div class="topic-metadata">

**Author:** [@juliebryan](https://discuss.elastic.co/u/juliebryan)\
**Replies:** 7\
**Last updated:** [February 22, 2024, 6:40am UTC](https://discuss.elastic.co/t/indexing-crashing-due-to-large-dataset/352715 "2024-02-22T06:40:58Z")

</div>

I have an Elasticsearch instance running on a docker. I am rootless user. I am also a beginner with Elasticsearch. My data size is 20GB, and they are medical documents. I have 80GB of RAM available. Here is how I configu…

---

## [Does filebeat work on zlinux?](https://discuss.elastic.co/t/does-filebeat-work-on-zlinux/353846)

<div class="topic-metadata">

**Author:** [@PARAS\_PAUL1](https://discuss.elastic.co/u/PARAS_PAUL1)\
**Replies:** 0\
**Last updated:** [February 22, 2024, 6:15am UTC](https://discuss.elastic.co/t/does-filebeat-work-on-zlinux/353846 "2024-02-22T06:15:14Z")

</div>

Hi Elastic Community Could you please confirm if filebeat works on zlinux or has anyone tried installing .deb or .rpm packages on zlinux? Thanks & Regards Paras Paul

---

## [Need to delete the data from Indices A based on Indices B](https://discuss.elastic.co/t/need-to-delete-the-data-from-indices-a-based-on-indices-b/353744)

<div class="topic-metadata">

**Author:** [@Tqvenkata](https://discuss.elastic.co/u/Tqvenkata)\
**Replies:** 2\
**Last updated:** [February 22, 2024, 6:15am UTC](https://discuss.elastic.co/t/need-to-delete-the-data-from-indices-a-based-on-indices-b/353744 "2024-02-22T06:15:10Z")

</div>

HI, Is there any solution to delete the data from Indices A which are not exists(based on key) in Indices B in elasticsearch.

---

## [Unable to read elasticsearch.6.0.1 index data into dataframe using pyspark](https://discuss.elastic.co/t/unable-to-read-elasticsearch-6-0-1-index-data-into-dataframe-using-pyspark/353844)

<div class="topic-metadata">

**Author:** [@vincentnaveen](https://discuss.elastic.co/u/vincentnaveen)\
**Replies:** 0\
**Last updated:** [February 22, 2024, 5:39am UTC](https://discuss.elastic.co/t/unable-to-read-elasticsearch-6-0-1-index-data-into-dataframe-using-pyspark/353844 "2024-02-22T05:39:54Z")

</div>

Hello everyone, I am using elastcisearch version 6.0.1 from AWS service. I am trying to read Es index data into spark dataframe using pyspark. I can read all fields except the fields contain nested arrays. The nested a…

---

## [Getting invalid IPv6 address error while connecting Springboot with elasticsearch over ipv4](https://discuss.elastic.co/t/getting-invalid-ipv6-address-error-while-connecting-springboot-with-elasticsearch-over-ipv4/353840)

<div class="topic-metadata">

**Author:** [@JeyakumarKarunanithi](https://discuss.elastic.co/u/JeyakumarKarunanithi)\
**Replies:** 0\
**Last updated:** [February 22, 2024, 5:25am UTC](https://discuss.elastic.co/t/getting-invalid-ipv6-address-error-while-connecting-springboot-with-elasticsearch-over-ipv4/353840 "2024-02-22T05:25:58Z")

</div>

Hello Team , We are using Elasticsearch 7.17.5 docker image and connecting our own java springboot application using IPv4 in docker swarm & Kubernetes. While deploying the same stack in Openshift, We are getting the fo…

---

## [Heartbeat giving data to Logstash but Logstash's data not going to Elasticsearch](https://discuss.elastic.co/t/heartbeat-giving-data-to-logstash-but-logstashs-data-not-going-to-elasticsearch/353271)

<div class="topic-metadata">

**Author:** [@Karan37](https://discuss.elastic.co/u/Karan37)\
**Replies:** 8\
**Last updated:** [February 22, 2024, 5:26am UTC](https://discuss.elastic.co/t/heartbeat-giving-data-to-logstash-but-logstashs-data-not-going-to-elasticsearch/353271 "2024-02-22T05:26:39Z")

</div>

this is my logstash configuration input { beats { port =\> 5044 codec =\> "json\_lines" } } output { if \[type\] == "heartbeat" { elasticsearch { hosts =\> \["https://127.0.0.1:9200"\] index =\> "he…

---

## [Metricbeat module not sending TLS certificate](https://discuss.elastic.co/t/metricbeat-module-not-sending-tls-certificate/353837)

<div class="topic-metadata">

**Author:** [@Pandu\_Purnama](https://discuss.elastic.co/u/Pandu_Purnama)\
**Replies:** 0\
**Last updated:** [February 22, 2024, 4:49am UTC](https://discuss.elastic.co/t/metricbeat-module-not-sending-tls-certificate/353837 "2024-02-22T04:49:59Z")

</div>

Hello, I have Metricbeat 8.9.0 pod trying to scrape Prometheus metrics using this config - module: prometheus hosts: \["https://prometheus.demo.svc:9090"\] ssl.enabled: true ssl.certificate: "/tmp/t…

---

## [Questions about trace logs on RestClient RequestLogger.java](https://discuss.elastic.co/t/questions-about-trace-logs-on-restclient-requestlogger-java/353590)

<div class="topic-metadata">

**Author:** [@HongJian-Yang](https://discuss.elastic.co/u/HongJian-Yang)\
**Replies:** 1\
**Last updated:** [February 22, 2024, 2:40am UTC](https://discuss.elastic.co/t/questions-about-trace-logs-on-restclient-requestlogger-java/353590 "2024-02-22T02:40:52Z")

</div>

Why use LogFactory. getLog ("tracer") instead of the logger passed in by the method when determining whether to print trace logs in the logResponse method of RequestLogger.java? Does this cause logging. level. org. lasti…

---

## [Seeking Advice on Handling Non-UTF-8 Characters in Logs from F5 BIG-IP ASM to Logstash](https://discuss.elastic.co/t/seeking-advice-on-handling-non-utf-8-characters-in-logs-from-f5-big-ip-asm-to-logstash/353827)

<div class="topic-metadata">

**Author:** [@nw-engineer](https://discuss.elastic.co/u/nw-engineer)\
**Replies:** 0\
**Last updated:** [February 22, 2024, 12:55am UTC](https://discuss.elastic.co/t/seeking-advice-on-handling-non-utf-8-characters-in-logs-from-f5-big-ip-asm-to-logstash/353827 "2024-02-22T00:55:01Z")

</div>

Hello everyone, I hope this message finds you well. I am currently using Logstash to process logs from F5 BIG-IP ASM. Initially, I had the input codec set to the default (UTF-8). However, I've encountered an issue wher…

---

## [Fleet server certificate issue](https://discuss.elastic.co/t/fleet-server-certificate-issue/352839)

<div class="topic-metadata">

**Author:** [@Anand\_Hitachi](https://discuss.elastic.co/u/Anand_Hitachi)\
**Replies:** 3\
**Last updated:** [February 22, 2024, 12:29am UTC](https://discuss.elastic.co/t/fleet-server-certificate-issue/352839 "2024-02-22T00:29:38Z")

</div>

I'm getting this error while installing and enrolling fleet server on a windows host " Error: fleet-server failed: context canceled " (STARTING-\>FAILED): 1 error: file is not a certificate adding C:/elasticstack-ca/ela…

---

## [Recommended procedure for manually upgrading Fleet Managed agents on Windows](https://discuss.elastic.co/t/recommended-procedure-for-manually-upgrading-fleet-managed-agents-on-windows/353821)

<div class="topic-metadata">

**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Replies:** 0\
**Last updated:** [February 21, 2024, 10:41pm UTC](https://discuss.elastic.co/t/recommended-procedure-for-manually-upgrading-fleet-managed-agents-on-windows/353821 "2024-02-21T22:41:05Z")

</div>

Hello, We are starting to deploy thousands of Elastic Agents on our company in Windows and Linux servers, these servers are managed by multiple different infra teams, so every change on the servers needs to be done by t…

---

## [Question for local SSD usage for hot nodes on Elastic Cloud](https://discuss.elastic.co/t/question-for-local-ssd-usage-for-hot-nodes-on-elastic-cloud/353725)

<div class="topic-metadata">

**Author:** [@lzz118](https://discuss.elastic.co/u/lzz118)\
**Replies:** 1\
**Last updated:** [February 21, 2024, 10:37pm UTC](https://discuss.elastic.co/t/question-for-local-ssd-usage-for-hot-nodes-on-elastic-cloud/353725 "2024-02-21T22:37:15Z")

</div>

I heard Local / NVME SSD were used on Elastic Cloud on GCP, I wonder if the local SSDs configured for Elastic Cloud on GCP utilize the LVM to merge individual disks into single logical partition or RAID? I don't seems …

---

## [Metricbeat writing to .ds-metricbeat instead of .ds-.monitoring](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798)

<div class="topic-metadata">

**Author:** [@6igwig](https://discuss.elastic.co/u/6igwig)\
**Replies:** 50\
**Last updated:** [February 21, 2024, 8:12pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798 "2024-02-21T20:12:47Z")

</div>

I have a new elastic cluster on the basic license. I have deployed metricbeat to it and it is pulling data from the new cluster and successfully outputting logs to our monitoring cluster. The new cluster is not showing …

---

## [Not opting out of the query cache; authorization is not allowed](https://discuss.elastic.co/t/not-opting-out-of-the-query-cache-authorization-is-not-allowed/353819)

<div class="topic-metadata">

**Author:** [@SQIGGLES](https://discuss.elastic.co/u/SQIGGLES)\
**Replies:** 0\
**Last updated:** [February 21, 2024, 7:43pm UTC](https://discuss.elastic.co/t/not-opting-out-of-the-query-cache-authorization-is-not-allowed/353819 "2024-02-21T19:43:24Z")

</div>

I'm on a 3-node basic ES cluster and receiving lots of these in the logs: \[Name of our main db\] not opting out of the query cache; authorization is not allowed I'm perusing the logs as we are troubleshooting anything t…

---

## [More Index replicas = faster sync of data?](https://discuss.elastic.co/t/more-index-replicas-faster-sync-of-data/353314)

<div class="topic-metadata">

**Author:** [@SQIGGLES](https://discuss.elastic.co/u/SQIGGLES)\
**Replies:** 3\
**Last updated:** [February 21, 2024, 7:29pm UTC](https://discuss.elastic.co/t/more-index-replicas-faster-sync-of-data/353314 "2024-02-21T19:29:46Z")

</div>

Hello! I have a scenario that seems to function opposite documentation / logic. I hope someone can help me. environment: ES 6.8 3 node cluster on ALMA9 w/basic configuration (We should upgrade but can't at this time) …

---

## [\_reindex has suddenly stopped working inexplicably](https://discuss.elastic.co/t/reindex-has-suddenly-stopped-working-inexplicably/352375)

<div class="topic-metadata">

**Author:** [@mrodent](https://discuss.elastic.co/u/mrodent)\
**Replies:** 3\
**Last updated:** [February 21, 2024, 7:20pm UTC](https://discuss.elastic.co/t/reindex-has-suddenly-stopped-working-inexplicably/352375 "2024-02-21T19:20:16Z")

</div>

I've been using the \_reindex endpoint for some time now, about 2 months, without any problems. I'm running ES 8.6.2 on port 9500. The OS is W10. For some reason, as of this morning, any attempts to reindex are just not…

---

## [Adding multiple synonyms sets to a filter](https://discuss.elastic.co/t/adding-multiple-synonyms-sets-to-a-filter/353814)

<div class="topic-metadata">

**Author:** [@dat\_boi](https://discuss.elastic.co/u/dat_boi)\
**Replies:** 0\
**Last updated:** [February 21, 2024, 5:13pm UTC](https://discuss.elastic.co/t/adding-multiple-synonyms-sets-to-a-filter/353814 "2024-02-21T17:13:06Z")

</div>

i successfully created an index which uses a filter that has one synonyms\_set , but right when i try to use multiple synonyms Sets it fails with no error message, it creates an empty index with no status , here are my s…

---

## [Invalidated / Expired API Keys not being cleaned up](https://discuss.elastic.co/t/invalidated-expired-api-keys-not-being-cleaned-up/353806)

<div class="topic-metadata">

**Author:** [@Masok](https://discuss.elastic.co/u/Masok)\
**Replies:** 0\
**Last updated:** [February 21, 2024, 3:56pm UTC](https://discuss.elastic.co/t/invalidated-expired-api-keys-not-being-cleaned-up/353806 "2024-02-21T15:56:57Z")

</div>

Hi Our use case requires us to utilise short(ish) lived API Keys. After reading the documentation I was under the impression that expired / invalidated API Keys would be automatically deleted after a period of time (I t…

---

## [Conditions for external refreshes](https://discuss.elastic.co/t/conditions-for-external-refreshes/353803)

<div class="topic-metadata">

**Author:** [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Replies:** 0\
**Last updated:** [February 21, 2024, 3:41pm UTC](https://discuss.elastic.co/t/conditions-for-external-refreshes/353803 "2024-02-21T15:41:44Z")

</div>

Hey, Elasticsearch has a metric for external refreshes in its RefreshStats, added in #38643, since 7.2. I am wondering what can trigger such an external refresh, if all requests have refresh=false set. Can a refresh b…

---

## [Elasticsearch cluster pricing calculation for on premise deployment](https://discuss.elastic.co/t/elasticsearch-cluster-pricing-calculation-for-on-premise-deployment/353760)

<div class="topic-metadata">

**Author:** [@RajuParipelly](https://discuss.elastic.co/u/RajuParipelly)\
**Replies:** 2\
**Last updated:** [February 21, 2024, 3:27pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-pricing-calculation-for-on-premise-deployment/353760 "2024-02-21T15:27:22Z")

</div>

Hi, How do we calculate elastic cluster license pricing for a on premise deployment?

---

## [Implementing Function Score in Elasticsearch with BM25, Views, and Matching Categories](https://discuss.elastic.co/t/implementing-function-score-in-elasticsearch-with-bm25-views-and-matching-categories/353787)

<div class="topic-metadata">

**Author:** [@dan\_kim](https://discuss.elastic.co/u/dan_kim)\
**Replies:** 3\
**Last updated:** [February 21, 2024, 2:59pm UTC](https://discuss.elastic.co/t/implementing-function-score-in-elasticsearch-with-bm25-views-and-matching-categories/353787 "2024-02-21T14:59:31Z")

</div>

\--in short ----- i want to reflect category mathcing every time it matches document's category field and it is list Hello! I'm in the process of implementing a search functionality using Elasticsearch's function scor…

---

## [Problem with monitoring clast status in the new version 8.12.1](https://discuss.elastic.co/t/problem-with-monitoring-clast-status-in-the-new-version-8-12-1/353474)

<div class="topic-metadata">

**Author:** [@San9](https://discuss.elastic.co/u/San9)\
**Replies:** 1\
**Last updated:** [February 21, 2024, 2:55pm UTC](https://discuss.elastic.co/t/problem-with-monitoring-clast-status-in-the-new-version-8-12-1/353474 "2024-02-21T14:55:50Z")

</div>

Hi, I updated the cluster to 8.12.1 and noticed that the Cluster Monitoring tab was missing. In addition to the console, how can you check the status of the cluster and other parameters in the new versions, for example,…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=299)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=301)
