# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=450 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 451 --- ## [Encountering 'Name must match one or more data streams, indices, or index aliases' error when creating a data view in Kibana 8 Discover section](https://discuss.elastic.co/t/encountering-name-must-match-one-or-more-data-streams-indices-or-index-aliases-error-when-creating-a-data-view-in-kibana-8-discover-section/339589)
**Author:** [@abntkpi](https://discuss.elastic.co/u/abntkpi)\ **Replies:** 4\ **Last updated:** [August 16, 2023, 11:51am UTC](https://discuss.elastic.co/t/encountering-name-must-match-one-or-more-data-streams-indices-or-index-aliases-error-when-creating-a-data-view-in-kibana-8-discover-section/339589 "2023-08-16T11:51:52Z")
Hello, hope you're doing well. When I try to create a data view in the Discover section of Kibana 8, I encounter the following error message for any index pattern I write in the index pattern field: "Name must match on… --- ## [ES S3 plugin](https://discuss.elastic.co/t/es-s3-plugin/340892)
**Author:** [@EshaSingh32000](https://discuss.elastic.co/u/EshaSingh32000)\ **Replies:** 4\ **Last updated:** [August 16, 2023, 10:44am UTC](https://discuss.elastic.co/t/es-s3-plugin/340892 "2023-08-16T10:44:23Z")
Currently my Es Version is 7.17.1, and i want to download s3 plugin for same, can anyone provide me link to download s3 plugin for es version 7.17.1 --- ## [Changing password of elasticsearch user after expiration of x-pack](https://discuss.elastic.co/t/changing-password-of-elasticsearch-user-after-expiration-of-x-pack/340638)
**Author:** [@Kartik101](https://discuss.elastic.co/u/Kartik101)\ **Replies:** 2\ **Last updated:** [August 16, 2023, 9:53am UTC](https://discuss.elastic.co/t/changing-password-of-elasticsearch-user-after-expiration-of-x-pack/340638 "2023-08-16T09:53:52Z")
Can we change password of elasticsearch user after expiration of x-pack (installed using basic configuration) for Elasticsearch v5.6.2? --- ## [Java API Timeout connection](https://discuss.elastic.co/t/java-api-timeout-connection/340867)
**Author:** [@hld942614](https://discuss.elastic.co/u/hld942614)\ **Replies:** 3\ **Last updated:** [August 16, 2023, 9:39am UTC](https://discuss.elastic.co/t/java-api-timeout-connection/340867 "2023-08-16T09:39:59Z")
I am using Elastic Java API to write some data into elastic，but I occasionally get some error like this: "java.net.ConnectException: Timeout connecting to \[gt7-elk001.es.asia-east1.gcp.elastic-cloud.com/XX.XX.XXX.XXX:XX… --- ## [Excessive RAM usage, gets OOM killed in logstash](https://discuss.elastic.co/t/excessive-ram-usage-gets-oom-killed-in-logstash/340716)
**Author:** [@tanveer14](https://discuss.elastic.co/u/tanveer14)\ **Replies:** 4\ **Last updated:** [August 16, 2023, 9:05am UTC](https://discuss.elastic.co/t/excessive-ram-usage-gets-oom-killed-in-logstash/340716 "2023-08-16T09:05:30Z")
Hi! I'm running pipelines on logstash. Everything ran smoothly, but the POD went down for a certain amount of time. In values.yml ll set JVM option as "logstashJavaOpts: "-Xmx5g -Xms3g" still end up getting killed by… --- ## [Logstash ruby code plugin validate JSON](https://discuss.elastic.co/t/logstash-ruby-code-plugin-validate-json/340889)
**Author:** [@z\_z](https://discuss.elastic.co/u/z_z)\ **Replies:** 0\ **Last updated:** [August 16, 2023, 9:01am UTC](https://discuss.elastic.co/t/logstash-ruby-code-plugin-validate-json/340889 "2023-08-16T09:01:42Z")
My logstash.conf is as follows, it is used to read data from events.txt and use ruby code plugin to add tag to non json event. input { file { path =\> \["/home/events.txt"\] start\_position =\> "beginning… --- ## [Not setting the elasticsearchRef for setting beat output](https://discuss.elastic.co/t/not-setting-the-elasticsearchref-for-setting-beat-output/340878)
**Author:** [@alexns](https://discuss.elastic.co/u/alexns)\ **Replies:** 0\ **Last updated:** [August 16, 2023, 7:44am UTC](https://discuss.elastic.co/t/not-setting-the-elasticsearchref-for-setting-beat-output/340878 "2023-08-16T07:44:42Z")
Hello, We have a k8s cluster dedicated running monitoring software. Elastic Search is installed here using the ECK operator and the CRD's. On another cluster, we have filebeat running using the deprecated helm charts. … --- ## [Kibana Error Messages](https://discuss.elastic.co/t/kibana-error-messages/340823)
**Author:** [@Ruwi](https://discuss.elastic.co/u/Ruwi)\ **Replies:** 2\ **Last updated:** [August 16, 2023, 7:11am UTC](https://discuss.elastic.co/t/kibana-error-messages/340823 "2023-08-16T07:11:39Z")
Hello, Elasticsearch-Kibana: 7.10.2 As can be seen from the error messages in Kibana below It is seen that a critical level of information about the system is revealed. Is there any way to close these error messag… --- ## [ES replica creation](https://discuss.elastic.co/t/es-replica-creation/340872)
**Author:** [@khubaibathar](https://discuss.elastic.co/u/khubaibathar)\ **Replies:** 1\ **Last updated:** [August 16, 2023, 7:07am UTC](https://discuss.elastic.co/t/es-replica-creation/340872 "2023-08-16T07:07:00Z")
Hi, Can someone tell me if ES is able to create a replica while still in use. Would it affect the performance of the cluster or does this mechanism run in the background. We have an ES cluster which has six nodes. --- ## [Log Filtration Issue with Filebeat and Logstash Configuration](https://discuss.elastic.co/t/log-filtration-issue-with-filebeat-and-logstash-configuration/340609)
**Author:** [@Priyaansh\_Dwivedi](https://discuss.elastic.co/u/Priyaansh_Dwivedi)\ **Replies:** 18\ **Last updated:** [August 16, 2023, 6:02am UTC](https://discuss.elastic.co/t/log-filtration-issue-with-filebeat-and-logstash-configuration/340609 "2023-08-16T06:02:59Z")
Hello everyone, I'm using Filebeat to send three different logs to Logstash, where I'm applying parsing through filters. In the parsing process, I've taken into consideration the logs that are visible in the observation… --- ## [Getting 'Badly formatted index, after interpolation still contains placeholder' error when trying to ingest AWS WAF logs](https://discuss.elastic.co/t/getting-badly-formatted-index-after-interpolation-still-contains-placeholder-error-when-trying-to-ingest-aws-waf-logs/340862)
**Author:** [@feo13](https://discuss.elastic.co/u/feo13)\ **Replies:** 3\ **Last updated:** [August 16, 2023, 4:38am UTC](https://discuss.elastic.co/t/getting-badly-formatted-index-after-interpolation-still-contains-placeholder-error-when-trying-to-ingest-aws-waf-logs/340862 "2023-08-16T04:38:19Z")
Hi there, I'm trying to ingest AWS WAF logs with logstash-8.9.0 and send them to my local ELK stack but am getting a 'Badly formatted index, after interpolation still contains placeholder' error. Here's my logstash co… --- ## [Filter combined\_fields result](https://discuss.elastic.co/t/filter-combined-fields-result/340812)
**Author:** [@Samuel\_Litvack](https://discuss.elastic.co/u/Samuel_Litvack)\ **Replies:** 3\ **Last updated:** [August 15, 2023, 5:13pm UTC](https://discuss.elastic.co/t/filter-combined-fields-result/340812 "2023-08-15T17:13:03Z")
Hi I'm working on a people search website. I already have my databases indexed and it is currently possible to search for a person by fullname using combined\_fields query like this. { "query":{ "combined\_field… --- ## [Kibana watcher alerting for Elastic agents](https://discuss.elastic.co/t/kibana-watcher-alerting-for-elastic-agents/340865)
**Author:** [@TirathS](https://discuss.elastic.co/u/TirathS)\ **Replies:** 0\ **Last updated:** [August 16, 2023, 4:03am UTC](https://discuss.elastic.co/t/kibana-watcher-alerting-for-elastic-agents/340865 "2023-08-16T04:03:17Z")
Hello All, I am looking for a possible way to create a custom threshold alert that will monitor if the elastic agent goes down and doesn't come back up in 5-10mins, it should send us an email. Have anyone done it befor… --- ## [How to search and display log events linked through a series of UUIDs](https://discuss.elastic.co/t/how-to-search-and-display-log-events-linked-through-a-series-of-uuids/340854)
**Author:** [@tolland](https://discuss.elastic.co/u/tolland)\ **Replies:** 1\ **Last updated:** [August 16, 2023, 2:43am UTC](https://discuss.elastic.co/t/how-to-search-and-display-log-events-linked-through-a-series-of-uuids/340854 "2023-08-16T02:43:27Z")
Hi, We have an application which communicates with various microservices. Some initial request to an endpoint /api on A might generate several requests to systems B and C, and they themselves might generate further req… --- ## [Error when Setting up Email Alert in Kibana](https://discuss.elastic.co/t/error-when-setting-up-email-alert-in-kibana/340850)
**Author:** [@elastic12](https://discuss.elastic.co/u/elastic12)\ **Replies:** 0\ **Last updated:** [August 15, 2023, 9:31pm UTC](https://discuss.elastic.co/t/error-when-setting-up-email-alert-in-kibana/340850 "2023-08-15T21:31:39Z")
We are trying to setup an email alert for Elasticsearch query regarding log threshold in Kibana. We are using Microsoft Email and using Outlook as Service. For username and password, we are using Kibana's username and p… --- ## [Attempting to create a Double Field, Changes to keyword when data is imported](https://discuss.elastic.co/t/attempting-to-create-a-double-field-changes-to-keyword-when-data-is-imported/340848)
**Author:** [@aelam](https://discuss.elastic.co/u/aelam)\ **Replies:** 0\ **Last updated:** [August 15, 2023, 7:52pm UTC](https://discuss.elastic.co/t/attempting-to-create-a-double-field-changes-to-keyword-when-data-is-imported/340848 "2023-08-15T19:52:27Z")
Hello, I've got an empty dev index that I'm attempting to test some aggregations and a dashboard on. The problem I'm encountering is that when I push logs through to the index via a filebeat collector node the type for … --- ## [Elasticsearch + filebeat + apache on docker environment](https://discuss.elastic.co/t/elasticsearch-filebeat-apache-on-docker-environment/340842)
**Author:** [@Jackson\_Luz](https://discuss.elastic.co/u/Jackson_Luz)\ **Replies:** 0\ **Last updated:** [August 15, 2023, 5:07pm UTC](https://discuss.elastic.co/t/elasticsearch-filebeat-apache-on-docker-environment/340842 "2023-08-15T17:07:20Z")
Hello! Newbie here. Imagine the following scenario: a Docker environment where there are 3 containers. One is running Elasticsearch, another has Filebeat, and the third one contains Apache. All of them are on the same ne… --- ## [How to change the field types of a index pattern?](https://discuss.elastic.co/t/how-to-change-the-field-types-of-a-index-pattern/340838)
**Author:** [@michael\_c\_michael](https://discuss.elastic.co/u/michael_c_michael)\ **Replies:** 1\ **Last updated:** [August 15, 2023, 4:27pm UTC](https://discuss.elastic.co/t/how-to-change-the-field-types-of-a-index-pattern/340838 "2023-08-15T16:27:25Z")
I am using a dis-logger that accepts the raw logs, and transforms them into a more useful form. For a given field, I might first transform it from int to string in the dis-logger python file, say ForceID might go from \[1… --- ## [XContentBuilder](https://discuss.elastic.co/t/xcontentbuilder/340839)
**Author:** [@toddcarv](https://discuss.elastic.co/u/toddcarv)\ **Replies:** 0\ **Last updated:** [August 15, 2023, 4:02pm UTC](https://discuss.elastic.co/t/xcontentbuilder/340839 "2023-08-15T16:02:02Z")
Referencing this post - Ways to build Json doc in ES8 Java API client Is it advised not to use XContentBuilder with the new Java API Client? Will that be deprecated? Thanks. --- ## [How to parse array of objects into separate field](https://discuss.elastic.co/t/how-to-parse-array-of-objects-into-separate-field/340692)
**Author:** [@Subhashini](https://discuss.elastic.co/u/Subhashini)\ **Replies:** 3\ **Last updated:** [August 15, 2023, 4:01pm UTC](https://discuss.elastic.co/t/how-to-parse-array-of-objects-into-separate-field/340692 "2023-08-15T16:01:00Z")
I have some log look like ########2023-08-12######### {‘crewrosters’: \[ { ‘crew\_roster’ : ‘det1’, 'empno': 1} , {‘crew\_roster’ : ‘det2’, 'empno': 2} , {‘crew\_roster’ : ‘det3’, 'empno': 3} \] } I need to parse the data … --- ## [Filebeat Cisco module Nexus fileset dissect\_parsing\_error flag](https://discuss.elastic.co/t/filebeat-cisco-module-nexus-fileset-dissect-parsing-error-flag/340548)
**Author:** [@obol89](https://discuss.elastic.co/u/obol89)\ **Replies:** 2\ **Last updated:** [August 15, 2023, 1:45pm UTC](https://discuss.elastic.co/t/filebeat-cisco-module-nexus-fileset-dissect-parsing-error-flag/340548 "2023-08-15T13:45:04Z")
I'm trying to use Filebeat with Cisco module and Nexus fileset, but it seems like these logs aren't parsed properly. In every document I see - dissect\_parsing\_error in log.flags. It looks like that: filebeat versio… --- ## [I have a problem with deployment of a dockerized Django/Elasticsearch website](https://discuss.elastic.co/t/i-have-a-problem-with-deployment-of-a-dockerized-django-elasticsearch-website/340828)
**Author:** [@Mostafa\_Mohamed](https://discuss.elastic.co/u/Mostafa_Mohamed)\ **Replies:** 0\ **Last updated:** [August 15, 2023, 10:48am UTC](https://discuss.elastic.co/t/i-have-a-problem-with-deployment-of-a-dockerized-django-elasticsearch-website/340828 "2023-08-15T10:48:19Z")
I have a dockerized web application that contains 3 containers (Django/ PostgreSQL/Elasticsearch), The indices of the Elasticsearch are indexed depending on the Django database models using a library called Django-Elasti… --- ## [Erro ao executar o logstash](https://discuss.elastic.co/t/erro-ao-executar-o-logstash/340664)
**Author:** [@Gustavo](https://discuss.elastic.co/u/Gustavo)\ **Replies:** 14\ **Last updated:** [August 14, 2023, 6:24pm UTC](https://discuss.elastic.co/t/erro-ao-executar-o-logstash/340664 "2023-08-14T18:24:15Z")
This error persists and I don't know how to solve it anymore. Can someone help me. Follow my .conf files input { file { path =\> "C:/Elastic/logstash-8.9.0/config/logs.log" start\_position =\> "beginning" } } filter … --- ## [Can ILM policy be created on an existing set of indexes?](https://discuss.elastic.co/t/can-ilm-policy-be-created-on-an-existing-set-of-indexes/340809)
**Author:** [@Ong](https://discuss.elastic.co/u/Ong)\ **Replies:** 1\ **Last updated:** [August 15, 2023, 12:42pm UTC](https://discuss.elastic.co/t/can-ilm-policy-be-created-on-an-existing-set-of-indexes/340809 "2023-08-15T12:42:39Z")
Currently, i am have a FluentD daemon writing app logs to Elasticsearch. The index names have the naming convention "logstash-(date)" e.g. logstash-2023-08-15. Is it possible to create an ILM policy that applies to thes… --- ## [Privileges to run Kibana rules manually](https://discuss.elastic.co/t/privileges-to-run-kibana-rules-manually/340718)
**Author:** [@apt-get\_install\_skil](https://discuss.elastic.co/u/apt-get_install_skil)\ **Replies:** 1\ **Last updated:** [August 15, 2023, 12:42pm UTC](https://discuss.elastic.co/t/privileges-to-run-kibana-rules-manually/340718 "2023-08-15T12:42:16Z")
I've created a dedicated space for one of our development teams where they can create alert rules of type "Elasticsearch query" themselves. Therefore I also set up a role granting permissions for operating on those rules… --- ## [\_source field storage (\_source Field Overview)](https://discuss.elastic.co/t/source-field-storage-source-field-overview/340729)
**Author:** [@ksaimohan2k](https://discuss.elastic.co/u/ksaimohan2k)\ **Replies:** 8\ **Last updated:** [August 15, 2023, 11:47am UTC](https://discuss.elastic.co/t/source-field-storage-source-field-overview/340729 "2023-08-15T11:47:17Z")
Hello, We just want to have a clear understanding of the \_source field. Is it going to be indexed or stored? if it is stored where it is going to be stored. As an experiment, we disabled the \_source using PUT index\_nam… --- ## [How to automate search template creation?](https://discuss.elastic.co/t/how-to-automate-search-template-creation/338840)
**Author:** [@Prashant\_S](https://discuss.elastic.co/u/Prashant_S)\ **Replies:** 1\ **Last updated:** [August 15, 2023, 9:41am UTC](https://discuss.elastic.co/t/how-to-automate-search-template-creation/338840 "2023-08-15T09:41:18Z")
I am using search templates. How to manage the versioning of my templates and execute them . I am exposing search templates via microservice backed by springboot . Thanks --- ## [Cannot stop winlogbeat service](https://discuss.elastic.co/t/cannot-stop-winlogbeat-service/340653)
**Author:** [@Ptak](https://discuss.elastic.co/u/Ptak)\ **Replies:** 1\ **Last updated:** [August 15, 2023, 8:53am UTC](https://discuss.elastic.co/t/cannot-stop-winlogbeat-service/340653 "2023-08-15T08:53:01Z")
Hello all, I'm facing the following issue: I cannot stop the winlogbeat service either automatically or manually. The service can be stopped only after clicking "End Task" in the Task Manager. I did test the same Ansibl… --- ## [Ingesting Data using Agent (SQL Input Integration)](https://discuss.elastic.co/t/ingesting-data-using-agent-sql-input-integration/340820)
**Author:** [@ksaimohan2k](https://discuss.elastic.co/u/ksaimohan2k)\ **Replies:** 0\ **Last updated:** [August 15, 2023, 8:58am UTC](https://discuss.elastic.co/t/ingesting-data-using-agent-sql-input-integration/340820 "2023-08-15T08:58:29Z")
We just tried to ingest SQL data into Elasticsearch using Agent (SQL Input Integration). What I observed is that it stores the same set of data repeatedly. For Example, if I have 5 rows in the SQL table, the first time… --- ## [HIBP integration](https://discuss.elastic.co/t/hibp-integration/340815)
**Author:** [@viera120](https://discuss.elastic.co/u/viera120)\ **Replies:** 0\ **Last updated:** [August 15, 2023, 7:32am UTC](https://discuss.elastic.co/t/hibp-integration/340815 "2023-08-15T07:32:45Z")
What’s the recommended way to integrate “have I been pwnd” API into elastic? The idea here is to have an index with email IDs in it and to generate alerts based on API calls to HIBP…real time breach monitoring. Search … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=449) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=451)