# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=456 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 457 --- ## [Unable to configure oracle stored procedure in logstash jdbc pipeline](https://discuss.elastic.co/t/unable-to-configure-oracle-stored-procedure-in-logstash-jdbc-pipeline/340369)
**Author:** [@Sreenivas1](https://discuss.elastic.co/u/Sreenivas1)\ **Replies:** 3\ **Last updated:** [August 9, 2023, 7:30am UTC](https://discuss.elastic.co/t/unable-to-configure-oracle-stored-procedure-in-logstash-jdbc-pipeline/340369 "2023-08-09T07:30:43Z")
Hi all, I'm trying to call stored procedure created in oracle database using logstash jdbc pipeline but even I tried with many ways to pass stored procedure in statement it's getting failed with sql error exceptions . … --- ## [Logstash @timestamp in the input file](https://discuss.elastic.co/t/logstash-timestamp-in-the-input-file/340426)
**Author:** [@Tal\_Blat](https://discuss.elastic.co/u/Tal_Blat)\ **Replies:** 0\ **Last updated:** [August 9, 2023, 7:18am UTC](https://discuss.elastic.co/t/logstash-timestamp-in-the-input-file/340426 "2023-08-09T07:18:37Z")
Hello What will happen if my input file contain a field called @timestamp ? will it replace the logstash @timestamp automatically ? thanks --- ## [How to make a text field aggregate-able in Kibana](https://discuss.elastic.co/t/how-to-make-a-text-field-aggregate-able-in-kibana/340107)
**Author:** [@Pratishruti](https://discuss.elastic.co/u/Pratishruti)\ **Replies:** 4\ **Last updated:** [August 9, 2023, 6:25am UTC](https://discuss.elastic.co/t/how-to-make-a-text-field-aggregate-able-in-kibana/340107 "2023-08-09T06:25:24Z")
Hi, I am using Kibana 6.8.1 version. We are using EFK. There is a text field name Message, I want to make visualization by using this field. However the field is not showing in option. I have tried to do it by assignin… --- ## [Synchronize distributed term frequencies on READ ONLY shards?](https://discuss.elastic.co/t/synchronize-distributed-term-frequencies-on-read-only-shards/340420)
**Author:** [@Yukha\_Dharmeswara](https://discuss.elastic.co/u/Yukha_Dharmeswara)\ **Replies:** 0\ **Last updated:** [August 9, 2023, 6:06am UTC](https://discuss.elastic.co/t/synchronize-distributed-term-frequencies-on-read-only-shards/340420 "2023-08-09T06:06:32Z")
Hello, I wonder if it is possible to synchronize shard's distributed term frequencies so we are able to reliably sort data by relevancenes when using search\_type=query\_then\_fetch? query\_then\_fetch vs dfs\_query\_then\_fet… --- ## [Document written by Watcher index action is not visible in KIBANA index](https://discuss.elastic.co/t/document-written-by-watcher-index-action-is-not-visible-in-kibana-index/340290)
**Author:** [@mrunalini](https://discuss.elastic.co/u/mrunalini)\ **Replies:** 3\ **Last updated:** [August 9, 2023, 5:34am UTC](https://discuss.elastic.co/t/document-written-by-watcher-index-action-is-not-visible-in-kibana-index/340290 "2023-08-09T05:34:09Z")
Hi Team, I have created watcher to calculate some time difference and put the document of some fields in index . My watcher is getting executed successfully , fields are created in kibana . but Data is not visible in … --- ## [We are looking for having search solution for platform contain data from multiple application. Our use case is providing exact search and recommendation. We are exploring best to suit and ES/Vespa is what in discussion](https://discuss.elastic.co/t/we-are-looking-for-having-search-solution-for-platform-contain-data-from-multiple-application-our-use-case-is-providing-exact-search-and-recommendation-we-are-exploring-best-to-suit-and-es-vespa-is-what-in-discussion/339984)
**Author:** [@Nik\_Ag](https://discuss.elastic.co/u/Nik_Ag)\ **Replies:** 1\ **Last updated:** [August 9, 2023, 2:55am UTC](https://discuss.elastic.co/t/we-are-looking-for-having-search-solution-for-platform-contain-data-from-multiple-application-our-use-case-is-providing-exact-search-and-recommendation-we-are-exploring-best-to-suit-and-es-vespa-is-what-in-discussion/339984 "2023-08-09T02:55:39Z")
What difference between Vespa and ES? For longer term which would be better to choose? Elastic coming up with Elser model will it be available for GA if so, when? --- ## [Rejected execution of primary operation](https://discuss.elastic.co/t/rejected-execution-of-primary-operation/340391)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 4\ **Last updated:** [August 9, 2023, 2:27am UTC](https://discuss.elastic.co/t/rejected-execution-of-primary-operation/340391 "2023-08-09T02:27:23Z")
Hi there, sometimes my logstash had printed the log that said "rejected execution of primary operation" with the error type "es\_rejected\_execution\_exception" can anyone explain to me what's going on actually? Thanks --- ## [Php client 7.17 for elastic 8.9 (client for php 7.2)](https://discuss.elastic.co/t/php-client-7-17-for-elastic-8-9-client-for-php-7-2/340406)
**Author:** [@vt\_g](https://discuss.elastic.co/u/vt_g)\ **Replies:** 0\ **Last updated:** [August 8, 2023, 9:08pm UTC](https://discuss.elastic.co/t/php-client-7-17-for-elastic-8-9-client-for-php-7-2/340406 "2023-08-08T21:08:09Z")
Hello! Who knows if php client 7.17 can work with elastic 8.9? The site works on PHP 7.2, it is not possible to upload more Thank you! --- ## [Why IDs query expands to terms query?](https://discuss.elastic.co/t/why-ids-query-expands-to-terms-query/340410)
**Author:** [@etki](https://discuss.elastic.co/u/etki)\ **Replies:** 0\ **Last updated:** [August 9, 2023, 12:53am UTC](https://discuss.elastic.co/t/why-ids-query-expands-to-terms-query/340410 "2023-08-09T00:53:25Z")
So i was poking around sources and looks like ids query doesn't do much by itself: protected Query doToQuery(SearchExecutionContext context) throws IOException { MappedFieldType idField = context.getFieldTyp… --- ## [Using Fingerprint on metricbeat](https://discuss.elastic.co/t/using-fingerprint-on-metricbeat/339584)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 16\ **Last updated:** [August 9, 2023, 12:16am UTC](https://discuss.elastic.co/t/using-fingerprint-on-metricbeat/339584 "2023-08-09T00:16:12Z")
Hi there i'm trying to send data using metricbeat here v8.8.2 and i'm trying to use fingerprint as replacement of certificate\_authorities but i got an error like this {"log.level":"warn","@timestamp":"2023-07-29T07:26:… --- ## [Curator 7.0](https://discuss.elastic.co/t/curator-7-0/340407)
**Author:** [@Leandro\_Nieva](https://discuss.elastic.co/u/Leandro_Nieva)\ **Replies:** 0\ **Last updated:** [August 8, 2023, 9:11pm UTC](https://discuss.elastic.co/t/curator-7-0/340407 "2023-08-08T21:11:51Z")
Estoy arrancando con Curator y tengo un inconveniente, deseo realizar un snapshot de cada índice de wazuh dia a dia, el cual me esta tomando 36 indices al generar la tarea. Dejo el detalle de mi accion y de lo que realiz… --- ## [Elasticsearch Java API client 8.7.1, No Option available to generate the correct format for source ordering for composition aggregation](https://discuss.elastic.co/t/elasticsearch-java-api-client-8-7-1-no-option-available-to-generate-the-correct-format-for-source-ordering-for-composition-aggregation/337477)
**Author:** [@ramyogi](https://discuss.elastic.co/u/ramyogi)\ **Replies:** 12\ **Last updated:** [August 8, 2023, 8:39pm UTC](https://discuss.elastic.co/t/elasticsearch-java-api-client-8-7-1-no-option-available-to-generate-the-correct-format-for-source-ordering-for-composition-aggregation/337477 "2023-08-08T20:39:45Z")
Elasticsearch Java API client 8.7.1 does not have option to supply order for the composite term aggregation but it was available server lib. Query runs fine in KIBANA but cannot build same in Java client library {"from… --- ## [Logstash: MalformedCSVError](https://discuss.elastic.co/t/logstash-malformedcsverror/340330)
**Author:** [@benhartwich](https://discuss.elastic.co/u/benhartwich)\ **Replies:** 9\ **Last updated:** [August 8, 2023, 8:20pm UTC](https://discuss.elastic.co/t/logstash-malformedcsverror/340330 "2023-08-08T20:20:56Z")
Hi, can anybody help me to find the right mutate =\> gsub definition to avoid these warnings / errors: \[WARN \] 2023-08-08 07:05:15.003 \[\[main\]\>worker20\] csv - Error parsing csv {:field=\>"message", :source=\>"16600,26200,… --- ## [Create empty field in report / upload comments from excel](https://discuss.elastic.co/t/create-empty-field-in-report-upload-comments-from-excel/340006)
**Author:** [@Valerija](https://discuss.elastic.co/u/Valerija)\ **Replies:** 6\ **Last updated:** [August 8, 2023, 8:00pm UTC](https://discuss.elastic.co/t/create-empty-field-in-report-upload-comments-from-excel/340006 "2023-08-08T20:00:04Z")
Hello, I am supposed to create three empty columns in existing report and give possibility to users to upload comments in those columns from excel. I would appreciate if someone could tell me if this is feasible and… --- ## [Search where inside array ( like , search where in ) inside nested](https://discuss.elastic.co/t/search-where-inside-array-like-search-where-in-inside-nested/340307)
**Author:** [@Murilo\_Livorato](https://discuss.elastic.co/u/Murilo_Livorato)\ **Replies:** 2\ **Last updated:** [August 8, 2023, 7:10pm UTC](https://discuss.elastic.co/t/search-where-inside-array-like-search-where-in-inside-nested/340307 "2023-08-08T19:10:59Z")
hello , I have a nested search . It is working like this - GET /products/\_search { "size": 100, "query": { "bool": { "must": \[ { "nested": { "path": "owner", "query": { … --- ## [Query Kibana for strings WITHOUT commas?](https://discuss.elastic.co/t/query-kibana-for-strings-without-commas/340396)
**Author:** [@LogsandParsers](https://discuss.elastic.co/u/LogsandParsers)\ **Replies:** 1\ **Last updated:** [August 8, 2023, 7:22pm UTC](https://discuss.elastic.co/t/query-kibana-for-strings-without-commas/340396 "2023-08-08T19:22:25Z")
Hi all, I have a field on Kibana that has long text string values. Sometimes, these values contain commas and sometimes they do not. I want to search on Kibana for any of these values that DO NOT contain commas in the s… --- ## [XContentBuilder](https://discuss.elastic.co/t/xcontentbuilder/340399)
**Author:** [@toddcarv](https://discuss.elastic.co/u/toddcarv)\ **Replies:** 0\ **Last updated:** [August 8, 2023, 7:19pm UTC](https://discuss.elastic.co/t/xcontentbuilder/340399 "2023-08-08T19:19:00Z")
With the HLRC we were able to use XContentBuilder. For example: XContentBuilder xContentBuilder = // create XContentBuilder; IndexRequest request = new IndexRequest("index").id(id).source(xContentBuilder); Basically we… --- ## [If statement in winlogbeat configuration](https://discuss.elastic.co/t/if-statement-in-winlogbeat-configuration/340393)
**Author:** [@msylvestre](https://discuss.elastic.co/u/msylvestre)\ **Replies:** 2\ **Last updated:** [August 8, 2023, 6:44pm UTC](https://discuss.elastic.co/t/if-statement-in-winlogbeat-configuration/340393 "2023-08-08T18:44:35Z")
Hello, I'm trying to add an IF statement in my winlogbeat configuration, but I can't figure out how. Basically I have a field named token that I need to changed based on the agent\_name. What am I missing? #############… --- ## [Backfill old data for integration in elastic-agent integration](https://discuss.elastic.co/t/backfill-old-data-for-integration-in-elastic-agent-integration/340387)
**Author:** [@liquidkite](https://discuss.elastic.co/u/liquidkite)\ **Replies:** 1\ **Last updated:** [August 8, 2023, 5:16pm UTC](https://discuss.elastic.co/t/backfill-old-data-for-integration-in-elastic-agent-integration/340387 "2023-08-08T17:16:13Z")
Hello all, I've been using elastic agent to fetch logs from a variety of data sources. We ran into an issue where there was a misconfiguration with the pipeline and that caused to drop logs for that timeframe. Once the … --- ## [NameError with Cloudwatch plugin in logstash](https://discuss.elastic.co/t/nameerror-with-cloudwatch-plugin-in-logstash/340388)
**Author:** [@rmunjuluri](https://discuss.elastic.co/u/rmunjuluri)\ **Replies:** 0\ **Last updated:** [August 8, 2023, 4:13pm UTC](https://discuss.elastic.co/t/nameerror-with-cloudwatch-plugin-in-logstash/340388 "2023-08-08T16:13:33Z")
Hi, I am trying to pull Cloudwatch logs (specifically EC2 status) into Logstash. I can retrieve the status using AWS\_CLI, but the CloudWatch plugin throws the following error: Pipeline\_id:main Plugin: \ **Author:** [@RJC](https://discuss.elastic.co/u/RJC)\ **Replies:** 1\ **Last updated:** [August 8, 2023, 3:45pm UTC](https://discuss.elastic.co/t/need-help-creating-advanced-watcher/340384 "2023-08-08T15:45:15Z") I am new to Watchers and Elasticsearch API. I need to create an email alert that will notify me if someone inserts an unauthorized mass storage device into a USB slot of Windows machines. The watcher needs to query even… --- ## [What is difference between Elastic Agent and Beat?](https://discuss.elastic.co/t/what-is-difference-between-elastic-agent-and-beat/340383)
**Author:** [@musialny](https://discuss.elastic.co/u/musialny)\ **Replies:** 3\ **Last updated:** [August 8, 2023, 3:28pm UTC](https://discuss.elastic.co/t/what-is-difference-between-elastic-agent-and-beat/340383 "2023-08-08T15:28:51Z")
What is difference between Elastic Agent and Beat? --- ## [Run\_from config](https://discuss.elastic.co/t/run-from-config/340378)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 1\ **Last updated:** [August 8, 2023, 2:38pm UTC](https://discuss.elastic.co/t/run-from-config/340378 "2023-08-08T14:38:19Z")
Simple question here, if I have 10 different monitors setup on a single agent, do I have to duplicate the run\_from section (example below) and specify the id for each of them, or if I exclude the id field, will the run\_f… --- ## [I am trying to execute bulk query using Postman but getting an Error](https://discuss.elastic.co/t/i-am-trying-to-execute-bulk-query-using-postman-but-getting-an-error/340332)
**Author:** [@Subrato1](https://discuss.elastic.co/u/Subrato1)\ **Replies:** 3\ **Last updated:** [August 8, 2023, 2:33pm UTC](https://discuss.elastic.co/t/i-am-trying-to-execute-bulk-query-using-postman-but-getting-an-error/340332 "2023-08-08T14:33:05Z")
PUT /library/\_bulk?refresh {"index":{"\_id": "Leviathan Wakes"}} {"name": "Leviathan Wakes", "author": "James S.A. Corey", "release\_date": "2011-06-02", "page\_count": 561} {"index":{"\_id": "Hyperion"}} {"name": "Hyperion"… --- ## [Upgrading to a patch version resulting in replication failure?](https://discuss.elastic.co/t/upgrading-to-a-patch-version-resulting-in-replication-failure/340374)
**Author:** [@jaykb77](https://discuss.elastic.co/u/jaykb77)\ **Replies:** 2\ **Last updated:** [August 8, 2023, 1:30pm UTC](https://discuss.elastic.co/t/upgrading-to-a-patch-version-resulting-in-replication-failure/340374 "2023-08-08T13:30:41Z")
Hi all, We recently tried to upgrade from 7.17.0 -\> 7.17.8 in a rolling way, but in the middle of the upgrade we found replication error. explanation" : "cannot allocate replica shard to a node with version \[7.17.0\] si… --- ## [Different Dashboard views for different entities](https://discuss.elastic.co/t/different-dashboard-views-for-different-entities/340375)
**Author:** [@Marian\_Abou\_fares](https://discuss.elastic.co/u/Marian_Abou_fares)\ **Replies:** 0\ **Last updated:** [August 8, 2023, 1:13pm UTC](https://discuss.elastic.co/t/different-dashboard-views-for-different-entities/340375 "2023-08-08T13:13:21Z")
I have different stores that can access only certain parts of a dashboard. for instance each department can view only performance of its employees. How can I implement this authentication on Kibana? I dont have the " cre… --- ## [Elastic Package custom integration testing network issues](https://discuss.elastic.co/t/elastic-package-custom-integration-testing-network-issues/340372)
**Author:** [@popeio](https://discuss.elastic.co/u/popeio)\ **Replies:** 1\ **Last updated:** [August 8, 2023, 1:02pm UTC](https://discuss.elastic.co/t/elastic-package-custom-integration-testing-network-issues/340372 "2023-08-08T13:02:36Z")
Hey Community, I'm facing some issues with testing a simple integration for ingesting logs from a peculiar service into the stack via a custom Elastic Agent integration. I've followed all recommendations, and my custom… --- ## [New Java API Client GetResponse](https://discuss.elastic.co/t/new-java-api-client-getresponse/340287)
**Author:** [@toddcarv](https://discuss.elastic.co/u/toddcarv)\ **Replies:** 8\ **Last updated:** [August 8, 2023, 12:35pm UTC](https://discuss.elastic.co/t/new-java-api-client-getresponse/340287 "2023-08-08T12:35:40Z")
The HLRC provided getSourceAsMap in GetResponse. I'm trying to get the source as a map. How do I do this with the new client? Thanks. --- ## [Logstash troubleshooting](https://discuss.elastic.co/t/logstash-troubleshooting/340115)
**Author:** [@sta02](https://discuss.elastic.co/u/sta02)\ **Replies:** 1\ **Last updated:** [August 8, 2023, 12:33pm UTC](https://discuss.elastic.co/t/logstash-troubleshooting/340115 "2023-08-08T12:33:35Z")
Hello, We have logstash performing dual feed. The first output writes to Elastic and the second output writes to Azure Sentinel. There is a clear delta in number of logs sent to Azure Sentinel and Elastic. Elastic rece… --- ## [Lucene query](https://discuss.elastic.co/t/lucene-query/340367)
**Author:** [@ZahraZare](https://discuss.elastic.co/u/ZahraZare)\ **Replies:** 0\ **Last updated:** [August 8, 2023, 12:18pm UTC](https://discuss.elastic.co/t/lucene-query/340367 "2023-08-08T12:18:41Z")
The following document is from the "mart-index" index in Elasticsearch. I want to use this index as a data source in Grafana 9. I want to have only "IS\_AVAILABLE" and "GPRS\_CNT" values from "DTLS\_MA" object as table colu… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=455) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=457)