# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=349 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 350 --- ## [Some fields are missing after rename.](https://discuss.elastic.co/t/some-fields-are-missing-after-rename/349459)
**Author:** [@JHub-Wei](https://discuss.elastic.co/u/JHub-Wei)\ **Replies:** 11\ **Last updated:** [December 16, 2023, 2:22am UTC](https://discuss.elastic.co/t/some-fields-are-missing-after-rename/349459 "2023-12-16T02:22:57Z")
After logstash-oss is upgraded from 7.6.0 to 7.12.1, some fields are lost after parsing the nested JSON data of Kafka. Kafka JSON example data: {"timestamp":1702630468791,"region":"cn-north-3","eventId":"QER\_INFO","args… --- ## [Plugin installation issue, probably related to YAML](https://discuss.elastic.co/t/plugin-installation-issue-probably-related-to-yaml/349404)
**Author:** [@jediD83](https://discuss.elastic.co/u/jediD83)\ **Replies:** 4\ **Last updated:** [December 15, 2023, 10:38pm UTC](https://discuss.elastic.co/t/plugin-installation-issue-probably-related-to-yaml/349404 "2023-12-15T22:38:05Z")
Good day. The installation of the Elasticsearch's plugin for Zammad should be straightforward. After apt install elasticsearch using Set up Elasticsearch guide, its just sudo /usr/share/elasticsearch/bin/elasticsearch-p… --- ## [What could be the cause of error ""](https://discuss.elastic.co/t/what-could-be-the-cause-of-error/349436)
**Author:** [@Chen\_Wei](https://discuss.elastic.co/u/Chen_Wei)\ **Replies:** 1\ **Last updated:** [December 15, 2023, 7:07pm UTC](https://discuss.elastic.co/t/what-could-be-the-cause-of-error/349436 "2023-12-15T19:07:29Z")
I recently met a error about timestamp, the error appears after the logstash pipeline start and work for a while. I could not reproduce it. But I wonder where the error could happen. Does it happen in the input plugin?… --- ## [Drop complete row or message](https://discuss.elastic.co/t/drop-complete-row-or-message/349415)
**Author:** [@kundan](https://discuss.elastic.co/u/kundan)\ **Replies:** 1\ **Last updated:** [December 15, 2023, 7:08pm UTC](https://discuss.elastic.co/t/drop-complete-row-or-message/349415 "2023-12-15T19:08:38Z")
Hi, I want to drop full row based on one of the field. I am using following in filter. filter { grok { match =\> {"message" =\> \["%{IP:ip} %{SPACE}\\{user:%{USERNAME:UserId}\\}"\]} } date… --- ## [Show Alerts Data in Custom Dashboard](https://discuss.elastic.co/t/show-alerts-data-in-custom-dashboard/349466)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 2\ **Last updated:** [December 15, 2023, 6:48pm UTC](https://discuss.elastic.co/t/show-alerts-data-in-custom-dashboard/349466 "2023-12-15T18:48:48Z")
Hello, I want to see if its possible to recreate alerts visualizations in a custom dashboard. Currently the alerts are under their areas (like Observability, Security). I wanted to see if I can make a similar visualiz… --- ## [Search any term startswith including special char](https://discuss.elastic.co/t/search-any-term-startswith-including-special-char/349288)
**Author:** [@Sankar\_S](https://discuss.elastic.co/u/Sankar_S)\ **Replies:** 4\ **Last updated:** [December 15, 2023, 4:48pm UTC](https://discuss.elastic.co/t/search-any-term-startswith-including-special-char/349288 "2023-12-15T16:48:45Z")
Hello All, I have a field called title and it has value "title" : "Toddler- $kitkat @taste &roll ^yart !here #you %ice ^oops \*jam (pot) \[beat\] pep |old {jet} \`egg /lol" For given input i would like to match any term s… --- ## [Logstash 8.10.3 ERROR Badly formatted index, after interpolation still contains placeholder](https://discuss.elastic.co/t/logstash-8-10-3-error-badly-formatted-index-after-interpolation-still-contains-placeholder/349377)
**Author:** [@efrainMZ](https://discuss.elastic.co/u/efrainMZ)\ **Replies:** 5\ **Last updated:** [December 15, 2023, 4:33pm UTC](https://discuss.elastic.co/t/logstash-8-10-3-error-badly-formatted-index-after-interpolation-still-contains-placeholder/349377 "2023-12-15T16:33:43Z")
good day! I am trying to extract data from redis using logstash, the data comes from an apm version 8.10.3 but I receive a warining that does not allow me to see the data in kibana. The log I receive is the following: … --- ## [Implementing Custom BERT-Based Text Embedding Model for Semantic Search in Elasticsearch](https://discuss.elastic.co/t/implementing-custom-bert-based-text-embedding-model-for-semantic-search-in-elasticsearch/349434)
**Author:** [@Ali\_Zare](https://discuss.elastic.co/u/Ali_Zare)\ **Replies:** 1\ **Last updated:** [December 15, 2023, 4:10pm UTC](https://discuss.elastic.co/t/implementing-custom-bert-based-text-embedding-model-for-semantic-search-in-elasticsearch/349434 "2023-12-15T16:10:22Z")
Hello everyone, I'm exploring the possibility of setting up a custom text embedding model using the BERT architecture for semantic search within Elasticsearch. I'm curious if it's feasible to integrate a personalized te… --- ## [SNMP uptime monitoring](https://discuss.elastic.co/t/snmp-uptime-monitoring/348827)
**Author:** [@Martin\_Hood](https://discuss.elastic.co/u/Martin_Hood)\ **Replies:** 3\ **Last updated:** [December 15, 2023, 3:59pm UTC](https://discuss.elastic.co/t/snmp-uptime-monitoring/348827 "2023-12-15T15:59:07Z")
Hi, I'm currently in the planning stage of an observability system. For a number of hosts snmp is the most effective way to check status but, as I understand, this isn't currently supported by Heartbeat. Is it possible… --- ## [SystemCallError, :message=\>"Unknown error (SystemCallError)](https://discuss.elastic.co/t/systemcallerror-message-unknown-error-systemcallerror/347909)
**Author:** [@berta](https://discuss.elastic.co/u/berta)\ **Replies:** 5\ **Last updated:** [December 15, 2023, 3:49pm UTC](https://discuss.elastic.co/t/systemcallerror-message-unknown-error-systemcallerror/347909 "2023-12-15T15:49:09Z")
Hello, We have a server RHEL7 running with logstash, sending the logs to an opensearch with elasticsearch engine, and every few seconds the files are not send with this error: 2023-09-28T06:33:37,702\]\[ERROR\]\[filewatch.… --- ## [File sharing between multiple logstash instance](https://discuss.elastic.co/t/file-sharing-between-multiple-logstash-instance/349445)
**Author:** [@kishan\_vadalia](https://discuss.elastic.co/u/kishan_vadalia)\ **Replies:** 1\ **Last updated:** [December 15, 2023, 2:49pm UTC](https://discuss.elastic.co/t/file-sharing-between-multiple-logstash-instance/349445 "2023-12-15T14:49:47Z")
I have 3 logstash instance running on same machine and putting data to same ES index. all 3 are reading file input from same location (/etc/logstash/conf.d). If there are 500 files in that location than on ES index numbe… --- ## [Issue with Date Formatting in Transform Script on Elasticsearch 8.6.1](https://discuss.elastic.co/t/issue-with-date-formatting-in-transform-script-on-elasticsearch-8-6-1/349463)
**Author:** [@Behnam.R](https://discuss.elastic.co/u/Behnam.R)\ **Replies:** 0\ **Last updated:** [December 15, 2023, 2:49pm UTC](https://discuss.elastic.co/t/issue-with-date-formatting-in-transform-script-on-elasticsearch-8-6-1/349463 "2023-12-15T14:49:39Z")
Hello, I'm encountering an issue with date formatting in a transform script on Elasticsearch 8.6.1 (licensed version). My goal is to pivot existing index and store the date as it is. However, the output in the transform… --- ## [Kibana doesn't work due to change ip](https://discuss.elastic.co/t/kibana-doesnt-work-due-to-change-ip/349282)
**Author:** [@Gabin\_17](https://discuss.elastic.co/u/Gabin_17)\ **Replies:** 13\ **Last updated:** [December 15, 2023, 2:47pm UTC](https://discuss.elastic.co/t/kibana-doesnt-work-due-to-change-ip/349282 "2023-12-15T14:47:39Z")
Hi Guys, I need your help ! I installed ELK few days ago, however, my Ip has changed and now i canno't reach the Kibana page. It's write " Kibana server is not ready yet". What's the process to fix it ? I guess, I have… --- ## [License is not available](https://discuss.elastic.co/t/license-is-not-available/349449)
**Author:** [@secsec](https://discuss.elastic.co/u/secsec)\ **Replies:** 2\ **Last updated:** [December 15, 2023, 1:55pm UTC](https://discuss.elastic.co/t/license-is-not-available/349449 "2023-12-15T13:55:28Z")
Hello im using ELK 8.11 version, only one node and under tail -f /var/log/syslog | grep license i can see this so many problems with licence (im using basic): Dec 15 12:37:03 SPTWS-ELK-NODE01 metricbeat\[607\]: {"log.l… --- ## [I Want to remove the duplicate events inside Logstash filter how could I do that? I mention the events below please have a look and suggest](https://discuss.elastic.co/t/i-want-to-remove-the-duplicate-events-inside-logstash-filter-how-could-i-do-that-i-mention-the-events-below-please-have-a-look-and-suggest/349175)
**Author:** [@Subrato1](https://discuss.elastic.co/u/Subrato1)\ **Replies:** 6\ **Last updated:** [December 15, 2023, 1:35pm UTC](https://discuss.elastic.co/t/i-want-to-remove-the-duplicate-events-inside-logstash-filter-how-could-i-do-that-i-mention-the-events-below-please-have-a-look-and-suggest/349175 "2023-12-15T13:35:00Z")
{ "date" =\> 2023-12-12T00:00:00.000Z, "category" =\> "AUTH", "username" =\> "cassandra", "event\_time" =\> "ab390a7b-98e7-11ee-af20-4b75abbb029d", "node" =\> "172.31.57.239",… --- ## [Fatal exception while booting Elasticsearchorg.elasticsearch.ElasticsearchSecurityException: failed to load SSL configuration \[xpack.security.transport.ssl\] - cannot read configured \[PKCS12\] keystore](https://discuss.elastic.co/t/fatal-exception-while-booting-elasticsearchorg-elasticsearch-elasticsearchsecurityexception-failed-to-load-ssl-configuration-xpack-security-transport-ssl-cannot-read-configured-pkcs12-keystore/349427)
**Author:** [@9631](https://discuss.elastic.co/u/9631)\ **Replies:** 7\ **Last updated:** [December 15, 2023, 10:58am UTC](https://discuss.elastic.co/t/fatal-exception-while-booting-elasticsearchorg-elasticsearch-elasticsearchsecurityexception-failed-to-load-ssl-configuration-xpack-security-transport-ssl-cannot-read-configured-pkcs12-keystore/349427 "2023-12-15T10:58:50Z")
\[2023-12-15T12:36:37,084\]\[ERROR\]\[o.e.b.Elasticsearch \] \[LAPTOP-ECGDD83N\] fatal exception while booting Elasticsearchorg.elasticsearch.ElasticsearchSecurityException: failed to load SSL configuration \[xpack.security.… --- ## [Searchable Snapshot - S3 - Object Lock](https://discuss.elastic.co/t/searchable-snapshot-s3-object-lock/349418)
**Author:** [@digital-thought](https://discuss.elastic.co/u/digital-thought)\ **Replies:** 3\ **Last updated:** [December 15, 2023, 10:45am UTC](https://discuss.elastic.co/t/searchable-snapshot-s3-object-lock/349418 "2023-12-15T10:45:22Z")
I have implemented a Frozen Tier with Searchable Snapshots within AWS S3. To further protect the data and prevent deletion, I am looking to setup "Object Lock". Will the use of "Object Lock" interfere in anyway with El… --- ## [How bad is it for Elasticsearch peformance to use external disk storage?](https://discuss.elastic.co/t/how-bad-is-it-for-elasticsearch-peformance-to-use-external-disk-storage/349442)
**Author:** [@mtovmassian](https://discuss.elastic.co/u/mtovmassian)\ **Replies:** 0\ **Last updated:** [December 15, 2023, 9:36am UTC](https://discuss.elastic.co/t/how-bad-is-it-for-elasticsearch-peformance-to-use-external-disk-storage/349442 "2023-12-15T09:36:45Z")
I am currently running a small cluster of 3 nodes with a size (shards considered) of =~ 200GB. But disk usage keeps increasing and hard drives are about to reach saturation. I know that Elasticsearch need to be as clo… --- ## [Problems with simple python Elastic connection. Documentation Wrong?](https://discuss.elastic.co/t/problems-with-simple-python-elastic-connection-documentation-wrong/349400)
**Author:** [@allan.silverstein](https://discuss.elastic.co/u/allan.silverstein)\ **Replies:** 2\ **Last updated:** [December 15, 2023, 6:49am UTC](https://discuss.elastic.co/t/problems-with-simple-python-elastic-connection-documentation-wrong/349400 "2023-12-15T06:49:00Z")
I spent about an hour on what seems like a simple getting started exercise. Just connecting to the elastic stack with the python client. Leaving out all of the trial and error detail. The documentation shows that the … --- ## [How to specify a default value for my field in grok pattern match](https://discuss.elastic.co/t/how-to-specify-a-default-value-for-my-field-in-grok-pattern-match/349310)
**Author:** [@ameeto17](https://discuss.elastic.co/u/ameeto17)\ **Replies:** 9\ **Last updated:** [December 15, 2023, 5:53am UTC](https://discuss.elastic.co/t/how-to-specify-a-default-value-for-my-field-in-grok-pattern-match/349310 "2023-12-15T05:53:26Z")
I have a pattern to match using GROK Dec 14 03:13:01 ppddc1kfep302 my-checker: Context SHA of VSP Logger Software da39a3ee5e6b4b0d3255bfef95601890afd80709 I have the format below for the match %{SYSLOGTIMESTAMP}%{SPAC… --- ## [Behaviour of match\_phrase\_prefix in ES ES 8.9.0 is different from that in 7.17.7](https://discuss.elastic.co/t/behaviour-of-match-phrase-prefix-in-es-es-8-9-0-is-different-from-that-in-7-17-7/348283)
**Author:** [@elastic-a](https://discuss.elastic.co/u/elastic-a)\ **Replies:** 1\ **Last updated:** [December 14, 2023, 10:06pm UTC](https://discuss.elastic.co/t/behaviour-of-match-phrase-prefix-in-es-es-8-9-0-is-different-from-that-in-7-17-7/348283 "2023-12-14T22:06:45Z")
ES 8.9.0 With a query having match\_phrase\_prefix of just one term, the search returns expected match; with the same query, percolate by id does not return expected match. The same (both search and percolate) work as ex… --- ## [Please point me to a good article on how to "Optimally size Elasticsearch Thread Pools"](https://discuss.elastic.co/t/please-point-me-to-a-good-article-on-how-to-optimally-size-elasticsearch-thread-pools/349397)
**Author:** [@andrew3](https://discuss.elastic.co/u/andrew3)\ **Replies:** 2\ **Last updated:** [December 14, 2023, 9:38pm UTC](https://discuss.elastic.co/t/please-point-me-to-a-good-article-on-how-to-optimally-size-elasticsearch-thread-pools/349397 "2023-12-14T21:38:33Z")
We're pushing a lot of data in the form of bulk indexing requests and saturating the available thread pools. Can you point me to a good article on optimally sizing ES thread pools? Thanks. --- ## [Logstash runs on the linux container and extremely slow](https://discuss.elastic.co/t/logstash-runs-on-the-linux-container-and-extremely-slow/349249)
**Author:** [@ranjini](https://discuss.elastic.co/u/ranjini)\ **Replies:** 3\ **Last updated:** [December 14, 2023, 6:22pm UTC](https://discuss.elastic.co/t/logstash-runs-on-the-linux-container-and-extremely-slow/349249 "2023-12-14T18:22:56Z")
logstash runs on linux container. Below is my configuration. It is very slow. Sharing my configuration for reference. This is my service configuration. file { path =\> "/common/logs/\*\*/\*.log" start\_posit… --- ## [Running ANN with num\_candidates \> 10000](https://discuss.elastic.co/t/running-ann-with-num-candidates-10000/349387)
**Author:** [@rajivhs](https://discuss.elastic.co/u/rajivhs)\ **Replies:** 1\ **Last updated:** [December 14, 2023, 5:02pm UTC](https://discuss.elastic.co/t/running-ann-with-num-candidates-10000/349387 "2023-12-14T17:02:36Z")
Hi. Given millions of documents in our index, we would like to run ANN in order to get the top-X documents, where X is greater than 10,000. However, we're running into the num\_candidates cannot exceed 10000 error. We do… --- ## [Help for configuring index and query for autocomplete full\_text\_search on addresses](https://discuss.elastic.co/t/help-for-configuring-index-and-query-for-autocomplete-full-text-search-on-addresses/349386)
**Author:** [@Queepyl](https://discuss.elastic.co/u/Queepyl)\ **Replies:** 1\ **Last updated:** [December 14, 2023, 4:30pm UTC](https://discuss.elastic.co/t/help-for-configuring-index-and-query-for-autocomplete-full-text-search-on-addresses/349386 "2023-12-14T16:30:15Z")
Hello, I am creating an index to search existing addresses. Unfortunately I don't have some good results at all and I would like to ask for advices on how to improove these results. So the aim is to let a user enter i… --- ## [How to story a JSON Array in an index via the Java client?](https://discuss.elastic.co/t/how-to-story-a-json-array-in-an-index-via-the-java-client/349390)
**Author:** [@Itsman-AT](https://discuss.elastic.co/u/Itsman-AT)\ **Replies:** 0\ **Last updated:** [December 14, 2023, 4:25pm UTC](https://discuss.elastic.co/t/how-to-story-a-json-array-in-an-index-via-the-java-client/349390 "2023-12-14T16:25:45Z")
I am trying to store a JSON array (coming from an SQL Table field) within an Elasticsearch index. The JSON Array coming from the DB looks like this: \["Texas", "Texas", "Sidebet City"\] I get this array as a String from … --- ## [ElasticSearch in WordPress headless setup](https://discuss.elastic.co/t/elasticsearch-in-wordpress-headless-setup/349237)
**Author:** [@andreasdiehl](https://discuss.elastic.co/u/andreasdiehl)\ **Replies:** 2\ **Last updated:** [December 14, 2023, 3:34pm UTC](https://discuss.elastic.co/t/elasticsearch-in-wordpress-headless-setup/349237 "2023-12-14T15:34:24Z")
We are setting up a headless frontend (Nuxt, Vue) for our WordPress site. We pull data via GraphQL. Now we explore if / hot to make use of Elasticsearch. Any experiences / recommendations how to do the setup? So far we… --- ## [Correct way of mapping some structure to Elasticsearch document](https://discuss.elastic.co/t/correct-way-of-mapping-some-structure-to-elasticsearch-document/349379)
**Author:** [@Vadym\_Romanenko](https://discuss.elastic.co/u/Vadym_Romanenko)\ **Replies:** 0\ **Last updated:** [December 14, 2023, 2:54pm UTC](https://discuss.elastic.co/t/correct-way-of-mapping-some-structure-to-elasticsearch-document/349379 "2023-12-14T14:54:18Z")
Good day, community! At this moment we're posting some items from our solution to the ES index. Everything works fine. But we want to enlarge our decision. Our project gives ability to categorize items. We want to have … --- ## ["Multiple mapping types and custom mapping types in index templates" issue when upgrading to v8](https://discuss.elastic.co/t/multiple-mapping-types-and-custom-mapping-types-in-index-templates-issue-when-upgrading-to-v8/349185)
**Author:** [@preetish\_P](https://discuss.elastic.co/u/preetish_P)\ **Replies:** 1\ **Last updated:** [December 14, 2023, 2:46pm UTC](https://discuss.elastic.co/t/multiple-mapping-types-and-custom-mapping-types-in-index-templates-issue-when-upgrading-to-v8/349185 "2023-12-14T14:46:36Z")
Hi folks, We are in the process of upgrading ELK stack from version 7.17.2 to 8.9.2. When going through the list of Elasticsearch deprecation issues I spotted the below in Prod: (not seen in non-prod) Multiple mapping … --- ## [njava.lang.NoClassDefFoundError: Could not initialize class org.elasticsearch.xcontent.json.JsonXContent](https://discuss.elastic.co/t/njava-lang-noclassdeffounderror-could-not-initialize-class-org-elasticsearch-xcontent-json-jsonxcontent/349373)
**Author:** [@Jhalak43](https://discuss.elastic.co/u/Jhalak43)\ **Replies:** 0\ **Last updated:** [December 14, 2023, 2:08pm UTC](https://discuss.elastic.co/t/njava-lang-noclassdeffounderror-could-not-initialize-class-org-elasticsearch-xcontent-json-jsonxcontent/349373 "2023-12-14T14:08:18Z")
Previously we were using 7.17.12 version of below dependency org.elasticsearch elasticsearch But now when i update version from 7.17.12 to 8.6.1 or 8.8.2 i get below exception Could not initialize class org.elast… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=348) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=350)