# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=321 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 322 --- ## [Deleting array fields logstash](https://discuss.elastic.co/t/deleting-array-fields-logstash/351790)
**Author:** [@andrejcoliveira](https://discuss.elastic.co/u/andrejcoliveira)\ **Replies:** 6\ **Last updated:** [January 29, 2024, 11:37am UTC](https://discuss.elastic.co/t/deleting-array-fields-logstash/351790 "2024-01-29T11:37:43Z")
Hi, In my company we're trying to process a json array sent by filiebeat to logstash. The json that logstash receives is: { "logFile": \[ { "line": 2, "elements": \[ { "line": 4, "name": "", "description": "", "type": ""… --- ## [RestHighLevelClient, warning "Deprecated field \[type\] used"](https://discuss.elastic.co/t/resthighlevelclient-warning-deprecated-field-type-used/351870)
**Author:** [@antoinelefloch](https://discuss.elastic.co/u/antoinelefloch)\ **Replies:** 4\ **Last updated:** [January 29, 2024, 10:47am UTC](https://discuss.elastic.co/t/resthighlevelclient-warning-deprecated-field-type-used/351870 "2024-01-29T10:47:59Z")
Hello, I am using RestHighLevelClient (elasticsearch-rest-high-level-client-7.17.16.jar) and I get a warning from our 7.17.13 server Warning: 299 Elasticsearch-7.17.13-2b211dbb8bfdecaf7f5b44d356bdfe54b1050c13 "Depre… --- ## [Term aggregation ordering within a pivot transform](https://discuss.elastic.co/t/term-aggregation-ordering-within-a-pivot-transform/351754)
**Author:** [@nicole.oresme](https://discuss.elastic.co/u/nicole.oresme)\ **Replies:** 4\ **Last updated:** [January 29, 2024, 9:12am UTC](https://discuss.elastic.co/t/term-aggregation-ordering-within-a-pivot-transform/351754 "2024-01-29T09:12:38Z")
I'm running a pivot transform in which I have a terms aggregation that I'm trying to order, roughly: "items": { "terms": { "field": "item\_id", "order": { "value": "desc" } }, … --- ## [No output shown in Metric Explorer or Inventory but Metricbeat is running](https://discuss.elastic.co/t/no-output-shown-in-metric-explorer-or-inventory-but-metricbeat-is-running/351871)
**Author:** [@Swathi12](https://discuss.elastic.co/u/Swathi12)\ **Replies:** 2\ **Last updated:** [January 29, 2024, 9:10am UTC](https://discuss.elastic.co/t/no-output-shown-in-metric-explorer-or-inventory-but-metricbeat-is-running/351871 "2024-01-29T09:10:21Z")
Hi, i deployed metricbeat on Kubernetes Cluster but when i want to see metrics in Metric Explorer or Inventory it's showing nothing But metricbeat is still running without error --- ## [How to deploy and update metricbeat on several k8s cluster?](https://discuss.elastic.co/t/how-to-deploy-and-update-metricbeat-on-several-k8s-cluster/351970)
**Author:** [@Swathi12](https://discuss.elastic.co/u/Swathi12)\ **Replies:** 0\ **Last updated:** [January 29, 2024, 9:00am UTC](https://discuss.elastic.co/t/how-to-deploy-and-update-metricbeat-on-several-k8s-cluster/351970 "2024-01-29T09:00:35Z")
Hi, we have one Elasticsearch Cluster. There is running our ECK and Kibana. Now i try to deploy metricbeat on multiple cluster ( around 15-20 clusters) My question Do i have to run yaml file individually for cluster … --- ## [Kibana server is not ready](https://discuss.elastic.co/t/kibana-server-is-not-ready/351652)
**Author:** [@prajeet](https://discuss.elastic.co/u/prajeet)\ **Replies:** 1\ **Last updated:** [January 29, 2024, 8:31am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready/351652 "2024-01-29T08:31:02Z")
Hi, I have created a new elastic, Kibana and logstash instances on RHEL. They are not clustered and elastic responds to curl. I have used server host name for elastic server.hostname with port 9200. But when it comes to … --- ## [Output to more than one Kafka topics](https://discuss.elastic.co/t/output-to-more-than-one-kafka-topics/351929)
**Author:** [@ErGeek](https://discuss.elastic.co/u/ErGeek)\ **Replies:** 1\ **Last updated:** [January 29, 2024, 8:23am UTC](https://discuss.elastic.co/t/output-to-more-than-one-kafka-topics/351929 "2024-01-29T08:23:43Z")
Hi, We are trying to send output to more than one Kafka topics using filebeat. It is not working as expected. Output section: output.kafka: enabled: true hosts: \[ "---" \] topic: "%{\[fields.topic\_name\]}" to… --- ## [ODBC Driver for elasticsearch](https://discuss.elastic.co/t/odbc-driver-for-elasticsearch/351783)
**Author:** [@muhammad\_qassem](https://discuss.elastic.co/u/muhammad_qassem)\ **Replies:** 8\ **Last updated:** [January 29, 2024, 8:11am UTC](https://discuss.elastic.co/t/odbc-driver-for-elasticsearch/351783 "2024-01-29T08:11:57Z")
Hi, I am trying to configure the elastic odbc driver for Elasticsearch to then get data to power bi but when i test the connection for that it gives me error i dont know this error is related to what certificate or autho… --- ## [Default search timeout doesn't work](https://discuss.elastic.co/t/default-search-timeout-doesnt-work/350726)
**Author:** [@anon90868141](https://discuss.elastic.co/u/anon90868141)\ **Replies:** 3\ **Last updated:** [January 29, 2024, 7:44am UTC](https://discuss.elastic.co/t/default-search-timeout-doesnt-work/350726 "2024-01-29T07:44:39Z")
Hello, it seems like the following settings do not work for elasticsearch 7.17.10: PUT \_cluster/settings { "persistent": { "search.default\_search\_timeout": "300s", "search.low\_level\_cancellation": "true" } … --- ## [The latest version of logstash 8.12.0. Reports vulnerable](https://discuss.elastic.co/t/the-latest-version-of-logstash-8-12-0-reports-vulnerable/351952)
**Author:** [@ranjini](https://discuss.elastic.co/u/ranjini)\ **Replies:** 2\ **Last updated:** [January 29, 2024, 4:54am UTC](https://discuss.elastic.co/t/the-latest-version-of-logstash-8-12-0-reports-vulnerable/351952 "2024-01-29T04:54:10Z")
How to fix vulnerabilities in the maven-core-3.3.9.jar, maven-compat-3.3.9.jar and derby-10.14.1.0.jar. This is reported vulnerable in the latest Logstash package? DetailedName org.apache.maven:maven-core 3.3.9 … --- ## [Sort terms aggregation by totla sum of 2 nested sum aggregations](https://discuss.elastic.co/t/sort-terms-aggregation-by-totla-sum-of-2-nested-sum-aggregations/351915)
**Author:** [@Assaf\_Cohen](https://discuss.elastic.co/u/Assaf_Cohen)\ **Replies:** 2\ **Last updated:** [January 28, 2024, 7:12pm UTC](https://discuss.elastic.co/t/sort-terms-aggregation-by-totla-sum-of-2-nested-sum-aggregations/351915 "2024-01-28T19:12:04Z")
I have an index which stores all the books and articles read by users. The books and articles are of nested type. I am trying to get the top x users who read the highest number of books and articles which match the speci… --- ## [Contains query in elastic search](https://discuss.elastic.co/t/contains-query-in-elastic-search/351932)
**Author:** [@post90](https://discuss.elastic.co/u/post90)\ **Replies:** 3\ **Last updated:** [January 28, 2024, 12:28pm UTC](https://discuss.elastic.co/t/contains-query-in-elastic-search/351932 "2024-01-28T12:28:43Z")
How do we do a contains string search in elasticsearch in more than 1 field efficiently e.g text "denis tomas" should be searchable by query "tom". I stumbled upon query\_string query but usage of wildcards make it ineffi… --- ## [Filebeat read logs stored in rook cephfs persistent volume](https://discuss.elastic.co/t/filebeat-read-logs-stored-in-rook-cephfs-persistent-volume/351942)
**Author:** [@alex\_petrov](https://discuss.elastic.co/u/alex_petrov)\ **Replies:** 0\ **Last updated:** [January 28, 2024, 12:15pm UTC](https://discuss.elastic.co/t/filebeat-read-logs-stored-in-rook-cephfs-persistent-volume/351942 "2024-01-28T12:15:21Z")
I setup kubernetes cluster on bare metal and setup rook cephfs as default storage class.I deployed a pod that store logs in a drirectory inside pod that mapped to a pv(using cephfs pv).so my questions are : is filebeat… --- ## [Logstash JDBC Output to Postgres case-sensitive issue](https://discuss.elastic.co/t/logstash-jdbc-output-to-postgres-case-sensitive-issue/351881)
**Author:** [@h\_ng\_d\_ng](https://discuss.elastic.co/u/h_ng_d_ng)\ **Replies:** 9\ **Last updated:** [January 28, 2024, 9:53am UTC](https://discuss.elastic.co/t/logstash-jdbc-output-to-postgres-case-sensitive-issue/351881 "2024-01-28T09:53:03Z")
Hi, i got issue with logstash when trying to import data to postgres table. here are my output config: and it always show error that :\[ERROR\] 2024-01-26 20:22:38.348 \[\[main\]\>worker0\] jdbc - JDBC - Exception. Not retr… --- ## [401 Unauthorized](https://discuss.elastic.co/t/401-unauthorized/351806)
**Author:** [@Lukasz\_Skrzat](https://discuss.elastic.co/u/Lukasz_Skrzat)\ **Replies:** 1\ **Last updated:** [January 27, 2024, 2:50pm UTC](https://discuss.elastic.co/t/401-unauthorized/351806 "2024-01-27T14:50:49Z")
Hi i trying connect my kubernetes agent to elastic-stack using fleet token but after deployment have error "Failed to connect to backoff(elasticsearch(https://elasticsearch.logging-stack.svc.cluster.local:9200)): 401 U… --- ## [Using one index and constantly removing from it would lead to a problem?](https://discuss.elastic.co/t/using-one-index-and-constantly-removing-from-it-would-lead-to-a-problem/351907)
**Author:** [@m4kkur0](https://discuss.elastic.co/u/m4kkur0)\ **Replies:** 0\ **Last updated:** [January 27, 2024, 6:20am UTC](https://discuss.elastic.co/t/using-one-index-and-constantly-removing-from-it-would-lead-to-a-problem/351907 "2024-01-27T06:20:46Z")
Hello, I wonder if using an index and constantly removing documents from it leads to problems? I upsert, daily, around 10 millions of documents so, there is a chance of removing 10 millions of documents. Why I am doing… --- ## [Converting Timeticks value to Duration value](https://discuss.elastic.co/t/converting-timeticks-value-to-duration-value/351903)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 1\ **Last updated:** [January 26, 2024, 11:34pm UTC](https://discuss.elastic.co/t/converting-timeticks-value-to-duration-value/351903 "2024-01-26T23:34:13Z")
Hello, I am polling snmp using Elastic's SNMP input. I am retrieving two values sysUptimeInstance : 2,029,071,549 ifLastChange: 2,026,800,920 These are time tick values or centiseconds (1/100th of a second). I want … --- ## [Regex not worked with filebeat](https://discuss.elastic.co/t/regex-not-worked-with-filebeat/351901)
**Author:** [@Ahmed\_Alsum](https://discuss.elastic.co/u/Ahmed_Alsum)\ **Replies:** 2\ **Last updated:** [January 26, 2024, 10:02pm UTC](https://discuss.elastic.co/t/regex-not-worked-with-filebeat/351901 "2024-01-26T22:02:58Z")
Hi Dear, I'm trying to exclude any files starting with gc but below regex did not work and regex is verified, myfilebeat version is :8.3.2 filebeat.inputs: # Each - is an input. Most options can be set at the input l… --- ## [Deletion of data within frozen tier](https://discuss.elastic.co/t/deletion-of-data-within-frozen-tier/351828)
**Author:** [@Steven\_Richards](https://discuss.elastic.co/u/Steven_Richards)\ **Replies:** 2\ **Last updated:** [January 26, 2024, 9:30pm UTC](https://discuss.elastic.co/t/deletion-of-data-within-frozen-tier/351828 "2024-01-26T21:30:42Z")
Hello, I realize this question goes a bit counter to the usage of a frozen tier, but I'll outline our use-case. We have an ILM policy of 10 days hot, 80 days frozen. Some of our customers have the need to remove data w… --- ## [Generating same token for related words](https://discuss.elastic.co/t/generating-same-token-for-related-words/351902)
**Author:** [@RabBit\_BR](https://discuss.elastic.co/u/RabBit_BR)\ **Replies:** 0\ **Last updated:** [January 26, 2024, 9:15pm UTC](https://discuss.elastic.co/t/generating-same-token-for-related-words/351902 "2024-01-26T21:15:51Z")
Hello everybody. I would like to know if it is possible using analyzer to generate the same token for the following words: "bronzeadora", "bronze", "bronzeado". The token I need for the three words would be "bronz". I … --- ## [Input Varnish Logs to Logstash](https://discuss.elastic.co/t/input-varnish-logs-to-logstash/351898)
**Author:** [@ugola](https://discuss.elastic.co/u/ugola)\ **Replies:** 1\ **Last updated:** [January 26, 2024, 8:54pm UTC](https://discuss.elastic.co/t/input-varnish-logs-to-logstash/351898 "2024-01-26T20:54:23Z")
My goal is to send varnish logs to Logstash, both are running on different servers. Currently I am able to perform this using rsyslog (I also saw examples of FileBeat being used) on the machine where varnish logs are sto… --- ## [Would like to search text and try to identify strings that could be a persons name](https://discuss.elastic.co/t/would-like-to-search-text-and-try-to-identify-strings-that-could-be-a-persons-name/351745)
**Author:** [@warrengoldman](https://discuss.elastic.co/u/warrengoldman)\ **Replies:** 3\ **Last updated:** [January 26, 2024, 8:03pm UTC](https://discuss.elastic.co/t/would-like-to-search-text-and-try-to-identify-strings-that-could-be-a-persons-name/351745 "2024-01-26T20:03:52Z")
Example I have text like the following: Jeremy went to the ice cream shop with David and they met Sharee there. of the above Jeremy, David and Sharee are names. Is there a query I might be able to run that can identify… --- ## [Daily schedule transform from different indices](https://discuss.elastic.co/t/daily-schedule-transform-from-different-indices/351718)
**Author:** [@tmslara.a](https://discuss.elastic.co/u/tmslara.a)\ **Replies:** 2\ **Last updated:** [January 26, 2024, 7:13pm UTC](https://discuss.elastic.co/t/daily-schedule-transform-from-different-indices/351718 "2024-01-26T19:13:31Z")
Hello, We are currently ingesting data to an Elasticsearch cluster using Filebeat. We have configured Filebeat to create a new index every day, so the index template has the form index\_{+yyyymmdd}. We want to schedule … --- ## [Executing JSON query directly using Java API ignore the query algother](https://discuss.elastic.co/t/executing-json-query-directly-using-java-api-ignore-the-query-algother/351897)
**Author:** [@vinitp](https://discuss.elastic.co/u/vinitp)\ **Replies:** 0\ **Last updated:** [January 26, 2024, 6:25pm UTC](https://discuss.elastic.co/t/executing-json-query-directly-using-java-api-ignore-the-query-algother/351897 "2024-01-26T18:25:23Z")
In my application, we build the search query in JSON format.e.g { "query": { "bool": { "must": \[ { "term": { "officeCode.keyword": { "value": "410" } … --- ## [Getting \_grokparsefailure for grok pattern on \[audit\_data\]\[messages\] field for modsecurity json log?](https://discuss.elastic.co/t/getting-grokparsefailure-for-grok-pattern-on-audit-data-messages-field-for-modsecurity-json-log/351831)
**Author:** [@sunnysigara](https://discuss.elastic.co/u/sunnysigara)\ **Replies:** 4\ **Last updated:** [January 26, 2024, 5:52pm UTC](https://discuss.elastic.co/t/getting-grokparsefailure-for-grok-pattern-on-audit-data-messages-field-for-modsecurity-json-log/351831 "2024-01-26T17:52:51Z")
Input Json {"transaction":{"time":"26/Jan/2024:00:54:31 +0530","transaction\_id":"16645304250678661185","remote\_address":"141.98.7.28","remote\_port":80,"local\_address":"127.0.0.1","local\_port":80},"request":{"request\_lin… --- ## [Fuzziness and Levenstein distance](https://discuss.elastic.co/t/fuzziness-and-levenstein-distance/351885)
**Author:** [@alba](https://discuss.elastic.co/u/alba)\ **Replies:** 2\ **Last updated:** [January 26, 2024, 5:46pm UTC](https://discuss.elastic.co/t/fuzziness-and-levenstein-distance/351885 "2024-01-26T17:46:15Z")
Hi guys, I have a multi\_match query with "fuzziness" : 2. When I search for "mexico" I get results with "medical" which have Levenstein distance 3 to "mexico". Could somebody explain it to me? --- ## [Set up remote cluster CA certificate in Elasticsearch 8.8.1](https://discuss.elastic.co/t/set-up-remote-cluster-ca-certificate-in-elasticsearch-8-8-1/351889)
**Author:** [@rachelyang](https://discuss.elastic.co/u/rachelyang)\ **Replies:** 0\ **Last updated:** [January 26, 2024, 2:53pm UTC](https://discuss.elastic.co/t/set-up-remote-cluster-ca-certificate-in-elasticsearch-8-8-1/351889 "2024-01-26T14:53:03Z")
I have a local cluster. Now I would like to set up a remote cluster to connect to the local cluster. How do I set up the CA certificate on the remote cluster node to make these two cluster to trust each other? Here is … --- ## [Packetbeat 7.x not working on Windows](https://discuss.elastic.co/t/packetbeat-7-x-not-working-on-windows/351533)
**Author:** [@eagle840](https://discuss.elastic.co/u/eagle840)\ **Replies:** 7\ **Last updated:** [January 26, 2024, 1:58pm UTC](https://discuss.elastic.co/t/packetbeat-7-x-not-working-on-windows/351533 "2024-01-26T13:58:13Z")
Any version of packetbeat.exe version 7.x on windows returns nothing. eg: user\> packetbeat -v user \> The same effect is seen in powershell and cmdline, and reproduced the effect on different machines. However remov… --- ## [Manage of very updated index through auto force segments](https://discuss.elastic.co/t/manage-of-very-updated-index-through-auto-force-segments/351883)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 0\ **Last updated:** [January 26, 2024, 1:48pm UTC](https://discuss.elastic.co/t/manage-of-very-updated-index-through-auto-force-segments/351883 "2024-01-26T13:48:34Z")
Hi is it possible to set the permanent value for max\_merged\_segment for internal auto force mode in elasticsearch? --- ## [How do I avoid including kubernetes.labels?](https://discuss.elastic.co/t/how-do-i-avoid-including-kubernetes-labels/351874)
**Author:** [@Ananym](https://discuss.elastic.co/u/Ananym)\ **Replies:** 4\ **Last updated:** [January 26, 2024, 1:44pm UTC](https://discuss.elastic.co/t/how-do-i-avoid-including-kubernetes-labels/351874 "2024-01-26T13:44:48Z")
kubernetes.labels represents a lot of clutter that isn't useful to me. Add Kubernetes metadata | Filebeat Reference \[8.12\] | Elastic explains how to drop labels from associated resources, but I can't work out how to avo… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=320) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=322)