# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=45 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 46 --- ## [Logstash dont do anything but received lines](https://discuss.elastic.co/t/logstash-dont-do-anything-but-received-lines/381258)
**Author:** [@trenhard](https://discuss.elastic.co/u/trenhard)\ **Replies:** 8\ **Last updated:** [August 23, 2025, 8:42pm UTC](https://discuss.elastic.co/t/logstash-dont-do-anything-but-received-lines/381258 "2025-08-23T20:42:38Z")
Hello cyberbrothers. I came across the fact that the logtash successfully reads the lines, but does nothing further. I've spent two sleepless days on this, please take a look at it with a clear eye. My logstash conf in… --- ## [Shared file system repository and Roles](https://discuss.elastic.co/t/shared-file-system-repository-and-roles/381283)
**Author:** [@GiorgioS13](https://discuss.elastic.co/u/GiorgioS13)\ **Replies:** 6\ **Last updated:** [August 23, 2025, 5:58pm UTC](https://discuss.elastic.co/t/shared-file-system-repository-and-roles/381283 "2025-08-23T17:58:05Z")
Hi I have a cold node with the appropriate roles, but it does not include the data role. My goal is to set up a Shared File System repository. I have a dedicated disk attached to the cold node, but I cannot create the … --- ## [Make a duration field based of field's value](https://discuss.elastic.co/t/make-a-duration-field-based-of-fields-value/381058)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 3\ **Last updated:** [August 23, 2025, 5:48am UTC](https://discuss.elastic.co/t/make-a-duration-field-based-of-fields-value/381058 "2025-08-23T05:48:16Z")
Hello, I am ingesting a field that changes value and I would like to capture a duration of the value, is this possible with Elastic? For example: 13:00 - 1 document - field1: “Offline” , newfield\_duration: 0min 13:0… --- ## [Elastic Jira Connector](https://discuss.elastic.co/t/elastic-jira-connector/381254)
**Author:** [@kash1](https://discuss.elastic.co/u/kash1)\ **Replies:** 2\ **Last updated:** [August 23, 2025, 4:00am UTC](https://discuss.elastic.co/t/elastic-jira-connector/381254 "2025-08-23T04:00:12Z")
Having trouble with elastic jira connector i receive following error when trying to test setup: \[Action\]\[Jira\]: Unable to get issue types. Error: timeout of 60000ms exceeded. Reason: unknown: errorResponse was null whe… --- ## [Elasticsearch index creation from Python, results in error, for known mapping](https://discuss.elastic.co/t/elasticsearch-index-creation-from-python-results-in-error-for-known-mapping/381271)
**Author:** [@dave\_espinosa\_qs](https://discuss.elastic.co/u/dave_espinosa_qs)\ **Replies:** 1\ **Last updated:** [August 23, 2025, 3:18am UTC](https://discuss.elastic.co/t/elasticsearch-index-creation-from-python-results-in-error-for-known-mapping/381271 "2025-08-23T03:18:04Z")
I am trying to create an index from a Python script, but I am getting an error. Find the whole description here. (IMPORTANT! I have not uploaded anything in this website, as every time I attempted, the attachments kept … --- ## [Lifecycle Policy](https://discuss.elastic.co/t/lifecycle-policy/381211)
**Author:** [@GiorgioS13](https://discuss.elastic.co/u/GiorgioS13)\ **Replies:** 10\ **Last updated:** [August 22, 2025, 10:08pm UTC](https://discuss.elastic.co/t/lifecycle-policy/381211 "2025-08-22T22:08:22Z")
I created a lifecycle policy in Kibana and attached it to a data stream, for example: logs-system.syslog-default However, the indices it created, such as: .ds-logs-system.syslog-default-2025.08.21-000001 are still sh… --- ## [Logstash dont do anything after received lines](https://discuss.elastic.co/t/logstash-dont-do-anything-after-received-lines/381260)
**Author:** [@trenhard](https://discuss.elastic.co/u/trenhard)\ **Replies:** 1\ **Last updated:** [August 22, 2025, 5:01pm UTC](https://discuss.elastic.co/t/logstash-dont-do-anything-after-received-lines/381260 "2025-08-22T17:01:44Z")
Hello everyone. My logstash conf input { file { path =\> \["/usr/local/airflow/logs/\*/\*/\*/\*.log"\] codec =\> "line" } } filter { grok { match =\> { "path" =\> "/usr/local/airflow/logs/(?\.\*?)/(?\ **Author:** [@rodrigopaulodecastro](https://discuss.elastic.co/u/rodrigopaulodecastro)\ **Replies:** 8\ **Last updated:** [August 22, 2025, 4:54pm UTC](https://discuss.elastic.co/t/kibana-runtime-url-field-use-different-values-for-the-url-template-e-for-the-label-template/381206 "2025-08-22T16:54:53Z") I know this was limitation in the past, but still is? Its odd to display the full URL as a field label, is there any way to acomplish a label different the URL? Tks. --- ## [How to query a sum and it's percentage in the same query?](https://discuss.elastic.co/t/how-to-query-a-sum-and-its-percentage-in-the-same-query/381229)
**Author:** [@khat33b](https://discuss.elastic.co/u/khat33b)\ **Replies:** 4\ **Last updated:** [August 22, 2025, 2:49pm UTC](https://discuss.elastic.co/t/how-to-query-a-sum-and-its-percentage-in-the-same-query/381229 "2025-08-22T14:49:44Z")
I am writing an ES|QL to find out the sum and of a field grouped by another field and also it’s percentage by other sums of that field. How do I write the query? FROM test\_index | WHERE start\_time \>= DATE\_PARSE("yyyy-M… --- ## [Cisco Meraki Integration](https://discuss.elastic.co/t/cisco-meraki-integration/381226)
**Author:** [@Pradeep\_sahani](https://discuss.elastic.co/u/Pradeep_sahani)\ **Replies:** 1\ **Last updated:** [August 22, 2025, 11:49am UTC](https://discuss.elastic.co/t/cisco-meraki-integration/381226 "2025-08-22T11:49:50Z")
Hi Team, Elasticsearch version :- 9.0 Kibana :- 9.0 I am attempting to configure the Cisco Meraki integration (version 1.28) and am currently facing an issue. My Elastic Stack is hosted in the cloud. To test the inte… --- ## [Kibana 9.1.2 doesn't like false as a value in pipelines, but true is ok](https://discuss.elastic.co/t/kibana-9-1-2-doesnt-like-false-as-a-value-in-pipelines-but-true-is-ok/381210)
**Author:** [@Aaron\_C\_de\_Bruyn](https://discuss.elastic.co/u/Aaron_C_de_Bruyn)\ **Replies:** 1\ **Last updated:** [August 22, 2025, 3:41am UTC](https://discuss.elastic.co/t/kibana-9-1-2-doesnt-like-false-as-a-value-in-pipelines-but-true-is-ok/381210 "2025-08-22T03:41:08Z")
Toss this into the developer console and run it to create a pipeline: PUT \_ingest/pipeline/my-test-pipeline { "description": "Just testing...", "processors": \[ { "set": { "field": "my\_custom\_field", "value": tru… --- ## [Inconsistent behavior when querying host.ip field: ORDER BY ASC and WHERE IS NOT NULL fail with "Arrays not supported"](https://discuss.elastic.co/t/inconsistent-behavior-when-querying-host-ip-field-order-by-asc-and-where-is-not-null-fail-with-arrays-not-supported/381187)
**Author:** [@wwxb](https://discuss.elastic.co/u/wwxb)\ **Replies:** 5\ **Last updated:** [August 22, 2025, 3:16am UTC](https://discuss.elastic.co/t/inconsistent-behavior-when-querying-host-ip-field-order-by-asc-and-where-is-not-null-fail-with-arrays-not-supported/381187 "2025-08-22T03:16:56Z")
Hello Elasticsearch team, I encountered an unexpected issue when querying a field in my index using the SQL API. Index: xuji\_test Mapping excerpt (simplified): POST /\_sql?format=json { "query": """ DESCRIBE xuji\_… --- ## [Error building Custom beats](https://discuss.elastic.co/t/error-building-custom-beats/381220)
**Author:** [@Dede\_Pessu](https://discuss.elastic.co/u/Dede_Pessu)\ **Replies:** 0\ **Last updated:** [August 22, 2025, 1:43am UTC](https://discuss.elastic.co/t/error-building-custom-beats/381220 "2025-08-22T01:43:18Z")
Attempting to package my custom beat for distribution but getting errors. WARNING: The requested image's platform (linux/arm64/v8) does not match the detected host platform (linux/amd64/v3) and no specific platform was … --- ## [Kibana Alert Webhook behind proxy with authentication using environment variables](https://discuss.elastic.co/t/kibana-alert-webhook-behind-proxy-with-authentication-using-environment-variables/381181)
**Author:** [@brunobastosg](https://discuss.elastic.co/u/brunobastosg)\ **Replies:** 6\ **Last updated:** [August 21, 2025, 9:51pm UTC](https://discuss.elastic.co/t/kibana-alert-webhook-behind-proxy-with-authentication-using-environment-variables/381181 "2025-08-21T21:51:48Z")
Hello, I'm trying to configure a Kibana alert to send webhooks to Microsoft Teams, but I'm facing an issue with proxy authentication configuration using environment variables. All internet access goes through a corpora… --- ## [Missing documents](https://discuss.elastic.co/t/missing-documents/380946)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 32\ **Last updated:** [August 21, 2025, 7:34pm UTC](https://discuss.elastic.co/t/missing-documents/380946 "2025-08-21T19:34:27Z")
I have following setup and I am missing documents. it is very hard to pinpoint at this time. that is why posting here to get some idea 1000 machine running metricbeat sending metric every min to HA proxy Ha Proxy then … --- ## [Does Elastic offer an WMI Integration?](https://discuss.elastic.co/t/does-elastic-offer-an-wmi-integration/381208)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 2\ **Last updated:** [August 21, 2025, 5:30pm UTC](https://discuss.elastic.co/t/does-elastic-offer-an-wmi-integration/381208 "2025-08-21T17:30:09Z")
I tried the logstash wmi plugin but it doesn’t work anymore. Perhaps not with newer versions and its not supported by elastic. Seems like there’s not a way to leverage WMI with elastic, unless I am wrong? --- ## [Getting errors in rolling-upgrade of elasticsearch and kibana (8.18.4 to 8.19.2)](https://discuss.elastic.co/t/getting-errors-in-rolling-upgrade-of-elasticsearch-and-kibana-8-18-4-to-8-19-2/381202)
**Author:** [@mahesh.hemke24](https://discuss.elastic.co/u/mahesh.hemke24)\ **Replies:** 7\ **Last updated:** [August 21, 2025, 1:53pm UTC](https://discuss.elastic.co/t/getting-errors-in-rolling-upgrade-of-elasticsearch-and-kibana-8-18-4-to-8-19-2/381202 "2025-08-21T13:53:28Z")
Hi Team, Hope you are doing well. We are getting below errors in kibana while performing the rolling-upgrade of elasticsearch and kibana. We are doing this with full Ansible automation and testing it on virt environme… --- ## [Is Logstash 7.4.2 supported on AIX server](https://discuss.elastic.co/t/is-logstash-7-4-2-supported-on-aix-server/381207)
**Author:** [@Shubham.Kumar](https://discuss.elastic.co/u/Shubham.Kumar)\ **Replies:** 1\ **Last updated:** [August 21, 2025, 12:53pm UTC](https://discuss.elastic.co/t/is-logstash-7-4-2-supported-on-aix-server/381207 "2025-08-21T12:53:13Z")
Hi, I'm trying to deploy Logstash version 7.4.2 on an AIX server and wanted to check if this setup is officially supported or if anyone has experience running it in a similar environment. The server runs AIX 7.0.0, and … --- ## [Fleet server issue in cluster](https://discuss.elastic.co/t/fleet-server-issue-in-cluster/381183)
**Author:** [@GiorgioS13](https://discuss.elastic.co/u/GiorgioS13)\ **Replies:** 4\ **Last updated:** [August 21, 2025, 12:13pm UTC](https://discuss.elastic.co/t/fleet-server-issue-in-cluster/381183 "2025-08-21T12:13:29Z")
Hello, I need your assistance. I set up an Elastic cluster using the enrollment token method, including Kibana, and everything is working correctly the data nodes have their respective roles, etc. The issue is with th… --- ## [PUT mapping doesn't actually replace the mapping but only "updates" it with new fields](https://discuss.elastic.co/t/put-mapping-doesnt-actually-replace-the-mapping-but-only-updates-it-with-new-fields/381203)
**Author:** [@albertino87](https://discuss.elastic.co/u/albertino87)\ **Replies:** 1\ **Last updated:** [August 21, 2025, 11:04am UTC](https://discuss.elastic.co/t/put-mapping-doesnt-actually-replace-the-mapping-but-only-updates-it-with-new-fields/381203 "2025-08-21T11:04:27Z")
good morning, I have elasticsearch 7.17. I noticed that if I have a mapping in an existing index and then i use PUT mapping, it doesn’t replace the mapping with the new one as I would expect, but simply updates it with … --- ## [❗️ Issue: NotEntitledException after upgrading to Elasticsearch 8.18.1](https://discuss.elastic.co/t/issue-notentitledexception-after-upgrading-to-elasticsearch-8-18-1/381148)
**Author:** [@Shubham.Kumar](https://discuss.elastic.co/u/Shubham.Kumar)\ **Replies:** 13\ **Last updated:** [August 21, 2025, 10:09am UTC](https://discuss.elastic.co/t/issue-notentitledexception-after-upgrading-to-elasticsearch-8-18-1/381148 "2025-08-21T10:09:00Z")
Hi everyone, After upgrading to Elasticsearch 8.18.1, I'm encountering the following warning during startup: \[2025-08-20T05:39:57,789\]\[WARN \]\[o.e.e.r.p.P.r.o.e.r.root \] \[node-1\] Not entitled: component \[rest-root\], mod… --- ## [Failed to start elasticsearch|| ssl error](https://discuss.elastic.co/t/failed-to-start-elasticsearch-ssl-error/381173)
**Author:** [@sreya\_14](https://discuss.elastic.co/u/sreya_14)\ **Replies:** 5\ **Last updated:** [August 21, 2025, 7:46am UTC](https://discuss.elastic.co/t/failed-to-start-elasticsearch-ssl-error/381173 "2025-08-21T07:46:47Z")
Unable to start elasticsearch \[2025-08-20T17:16:58,661\]\[ERROR\]\[o.e.b.Elasticsearch \] \[vfralapelkprd01.canoninf.net\] fatal exception while booting Elasticsearchorg.elasticsearch.ElasticsearchSecurityException: faile… --- ## [Logstash bulk request failures: Connection reset by peer / NO\_VALID\_CONNECTION\_AVAILABLE](https://discuss.elastic.co/t/logstash-bulk-request-failures-connection-reset-by-peer-no-valid-connection-available/381133)
**Author:** [@Aswin.r](https://discuss.elastic.co/u/Aswin.r)\ **Replies:** 2\ **Last updated:** [August 21, 2025, 5:42am UTC](https://discuss.elastic.co/t/logstash-bulk-request-failures-connection-reset-by-peer-no-valid-connection-available/381133 "2025-08-21T05:42:48Z")
Hi Team, I am facing repeated bulk request failures in Logstash while sending data to Elasticsearch. Error: Connection reset by peer error.type: Manticore::SocketException error.class: LogStash::Outputs::Elasticsearch… --- ## [Is it possible to skip some watcher inputs if an earlier input returns hits in Elasticsearch?](https://discuss.elastic.co/t/is-it-possible-to-skip-some-watcher-inputs-if-an-earlier-input-returns-hits-in-elasticsearch/381155)
**Author:** [@Simriti\_Bundhoo](https://discuss.elastic.co/u/Simriti_Bundhoo)\ **Replies:** 2\ **Last updated:** [August 21, 2025, 2:41am UTC](https://discuss.elastic.co/t/is-it-possible-to-skip-some-watcher-inputs-if-an-earlier-input-returns-hits-in-elasticsearch/381155 "2025-08-21T02:41:54Z")
Hi all, I’m working on an Elasticsearch Watcher that has multiple search inputs. What I want to do is: Run the first input query. If this query returns more than 0 hits, I want to skip running the other inputs ent… --- ## [Annoying pre filtered tag:("Security Solution")](https://discuss.elastic.co/t/annoying-pre-filtered-tag-security-solution/381159)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [August 20, 2025, 10:11pm UTC](https://discuss.elastic.co/t/annoying-pre-filtered-tag-security-solution/381159 "2025-08-20T22:11:33Z")
Hello, Am I really the only one who is annoyed with the new Security Space dashboard tag:("Security Solution") pre-filter? We have to remove this tag continuously to be able to search for our own custom dashboards… Whi… --- ## [After cluster and fleet upgrade to 8.19.x logging of SYSMON events via elastic agent has stopped](https://discuss.elastic.co/t/after-cluster-and-fleet-upgrade-to-8-19-x-logging-of-sysmon-events-via-elastic-agent-has-stopped/381156)
**Author:** [@EvanL](https://discuss.elastic.co/u/EvanL)\ **Replies:** 1\ **Last updated:** [August 20, 2025, 6:09pm UTC](https://discuss.elastic.co/t/after-cluster-and-fleet-upgrade-to-8-19-x-logging-of-sysmon-events-via-elastic-agent-has-stopped/381156 "2025-08-20T18:09:02Z")
As the topic says, we upgraded both our DEV and PROD clusters to ElasticStack 8.19.2 (DEV) or 8.19.0 (PROD) we notice that on all our Windows hosts that run agent version 8.19.x, the logging of SYSMON is no longer forwar… --- ## [Elasticsearch-java api for Slices doesn't have a way to specify 'auto' for reindexing?](https://discuss.elastic.co/t/elasticsearch-java-api-for-slices-doesnt-have-a-way-to-specify-auto-for-reindexing/380004)
**Author:** [@buitcj](https://discuss.elastic.co/u/buitcj)\ **Replies:** 3\ **Last updated:** [August 20, 2025, 4:01pm UTC](https://discuss.elastic.co/t/elasticsearch-java-api-for-slices-doesnt-have-a-way-to-specify-auto-for-reindexing/380004 "2025-08-20T16:01:56Z")
It seems that Slices.java in v8 and v9 of the elasticsearch-java, there is no way to specify slices = 'auto'? The REST API seems to to say 'auto' can be used (Reindex documents | Elasticsearch API documentation) But th… --- ## [Shared File System - Repository Issues](https://discuss.elastic.co/t/shared-file-system-repository-issues/381136)
**Author:** [@Armindo77](https://discuss.elastic.co/u/Armindo77)\ **Replies:** 7\ **Last updated:** [August 20, 2025, 2:28pm UTC](https://discuss.elastic.co/t/shared-file-system-repository-issues/381136 "2025-08-20T14:28:31Z")
Hello, Hope you guys are doing well! During the last few years, we have been using the Snapshot & Restore feature, over a Shared File System via SMB, and everything seemed to work well. We did some restores earlier thi… --- ## [EPM /api/fleet/epm/packages/\_bulk\_uninstall fails in v8.17.4](https://discuss.elastic.co/t/epm-api-fleet-epm-packages-bulk-uninstall-fails-in-v8-17-4/381144)
**Author:** [@Pratiksha\_Aigal](https://discuss.elastic.co/u/Pratiksha_Aigal)\ **Replies:** 4\ **Last updated:** [August 20, 2025, 2:19pm UTC](https://discuss.elastic.co/t/epm-api-fleet-epm-packages-bulk-uninstall-fails-in-v8-17-4/381144 "2025-08-20T14:19:59Z")
Hi, I am trying out the EPM package manager to install and uninstall integration packages in kibana. URL used: :POST kbn:/api/fleet/epm/packages/\_bulk\_uninstall {"force":false,"packages":\[{"name":"mongodb\_atlas","ver… --- ## [Truncated Chunk](https://discuss.elastic.co/t/truncated-chunk/381057)
**Author:** [@cannon707](https://discuss.elastic.co/u/cannon707)\ **Replies:** 3\ **Last updated:** [August 20, 2025, 1:01pm UTC](https://discuss.elastic.co/t/truncated-chunk/381057 "2025-08-20T13:01:19Z")
We are currently upgrading our elastic stack from using the elasticsearch-rest-high-level-client 6.2.4 to elasticsearch-java client 8.19.0 and upgrading the server to match. While upgrading we have run into a problem tha… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=44) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=46)