# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=513

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 514

---

## [Elasticsearch Unit test using Test-containers](https://discuss.elastic.co/t/elasticsearch-unit-test-using-test-containers/335831)

<div class="topic-metadata">

**Author:** [@tcpeiris](https://discuss.elastic.co/u/tcpeiris)\
**Replies:** 4\
**Last updated:** [June 13, 2023, 9:44am UTC](https://discuss.elastic.co/t/elasticsearch-unit-test-using-test-containers/335831 "2023-06-13T09:44:07Z")

</div>

@TestConfiguration public class ESRestClientTestConfig { private static final String ELASTICSEARCH\_VERSION = "8.7.0"; private static final DockerImageName ELASTICSEARCH\_IMAGE = DockerImageName .parse(…

---

## [Migration from mysql to elasticsearch](https://discuss.elastic.co/t/migration-from-mysql-to-elasticsearch/335577)

<div class="topic-metadata">

**Author:** [@Omarbek\_Dinassil](https://discuss.elastic.co/u/Omarbek_Dinassil)\
**Replies:** 3\
**Last updated:** [June 13, 2023, 9:24am UTC](https://discuss.elastic.co/t/migration-from-mysql-to-elasticsearch/335577 "2023-06-13T09:24:46Z")

</div>

Hello! Right now I have three tables A, B and C in mysql database: Table A Table B Table C id id id FK\_A FK\_C I should write a service which…

---

## [Elasticsearch synonym mappings - illegal\_argument\_exception](https://discuss.elastic.co/t/elasticsearch-synonym-mappings-illegal-argument-exception/335746)

<div class="topic-metadata">

**Author:** [@Jacques\_du\_Plessis](https://discuss.elastic.co/u/Jacques_du_Plessis)\
**Replies:** 1\
**Last updated:** [June 13, 2023, 8:25am UTC](https://discuss.elastic.co/t/elasticsearch-synonym-mappings-illegal-argument-exception/335746 "2023-06-13T08:25:35Z")

</div>

is there a way to tell the mappings to ignore the synonym file if it does not exist? currently i always have to make sure that the synonym file exist, but just wondering of there is a way to ignore it if its not there, …

---

## [When do the delete happen in the lifecycle policy](https://discuss.elastic.co/t/when-do-the-delete-happen-in-the-lifecycle-policy/335798)

<div class="topic-metadata">

**Author:** [@vinbeau](https://discuss.elastic.co/u/vinbeau)\
**Replies:** 2\
**Last updated:** [June 13, 2023, 8:23am UTC](https://discuss.elastic.co/t/when-do-the-delete-happen-in-the-lifecycle-policy/335798 "2023-06-13T08:23:25Z")

</div>

Hello all, I'm having a hard time finding a clear answer about this, sorry if it was already answered elsewhere: I have an index lifecycle policy setup to rollover the hot phase with a max age of 7 days. There are no …

---

## [Removing redundancy in query](https://discuss.elastic.co/t/removing-redundancy-in-query/335778)

<div class="topic-metadata">

**Author:** [@searchwithme](https://discuss.elastic.co/u/searchwithme)\
**Replies:** 2\
**Last updated:** [June 13, 2023, 7:38am UTC](https://discuss.elastic.co/t/removing-redundancy-in-query/335778 "2023-06-13T07:38:56Z")

</div>

Can this query: { "query": { "bool": { "must": \[ { "match": { "title": "elasticsearch" } }, { "match": { "author": "jondoe" } }, { "range": { "price": { "gte": 10, "lte": 100 } } } \], "must\_not": \[ { "match": {…

---

## [Fluentd pods don't see elasticsearch\[Efk on Kubernetes using Helm\]](https://discuss.elastic.co/t/fluentd-pods-dont-see-elasticsearch-efk-on-kubernetes-using-helm/335830)

<div class="topic-metadata">

**Author:** [@Resul\_Zoroglu](https://discuss.elastic.co/u/Resul_Zoroglu)\
**Replies:** 0\
**Last updated:** [June 13, 2023, 7:39am UTC](https://discuss.elastic.co/t/fluentd-pods-dont-see-elasticsearch-efk-on-kubernetes-using-helm/335830 "2023-06-13T07:39:39Z")

</div>

elastic image from helm chart repo I install elasticsearch and kibana without any problem and pods are standing up on kubernetes. helm-charts/charts/fluentd-elasticsearch at main · kokuwaio/helm-charts · GitHub I am i…

---

## [How to describe multiple users in ECS](https://discuss.elastic.co/t/how-to-describe-multiple-users-in-ecs/335448)

<div class="topic-metadata">

**Author:** [@srilumpa](https://discuss.elastic.co/u/srilumpa)\
**Replies:** 4\
**Last updated:** [June 13, 2023, 7:29am UTC](https://discuss.elastic.co/t/how-to-describe-multiple-users-in-ecs/335448 "2023-06-13T07:29:52Z")

</div>

Hello, I have a use case that is not described in the Elastic ECS documentation and I am looking for best practices on how to handle this. So, basically, I have an application where an app admin can change multiple use…

---

## [Understanding Agent Status Value Matching and Check-in Criteria in Elastic Stack](https://discuss.elastic.co/t/understanding-agent-status-value-matching-and-check-in-criteria-in-elastic-stack/335829)

<div class="topic-metadata">

**Author:** [@Erick\_Choi](https://discuss.elastic.co/u/Erick_Choi)\
**Replies:** 0\
**Last updated:** [June 13, 2023, 7:15am UTC](https://discuss.elastic.co/t/understanding-agent-status-value-matching-and-check-in-criteria-in-elastic-stack/335829 "2023-06-13T07:15:00Z")

</div>

Hello, I have several questions regarding the agent status value matching as well as check-in criteria in Elastic Stack. How is the matching process between unit.state field values for agent status information in Inde…

---

## [Unable to install ESRally](https://discuss.elastic.co/t/unable-to-install-esrally/335523)

<div class="topic-metadata">

**Author:** [@Darshan\_J](https://discuss.elastic.co/u/Darshan_J)\
**Replies:** 4\
**Last updated:** [June 13, 2023, 6:14am UTC](https://discuss.elastic.co/t/unable-to-install-esrally/335523 "2023-06-13T06:14:50Z")

</div>

Using cached zipp-3.15.0-py3-none-any.whl (6.8 kB) Building wheels for collected packages: yappi Building wheel for yappi (setup.py) ... error error: subprocess-exited-with-error × python setup.py bdist\_wheel …

---

## [How to set other time zone in rally's log?](https://discuss.elastic.co/t/how-to-set-other-time-zone-in-rallys-log/328683)

<div class="topic-metadata">

**Author:** [@vsop\_479](https://discuss.elastic.co/u/vsop_479)\
**Replies:** 7\
**Last updated:** [June 13, 2023, 6:13am UTC](https://discuss.elastic.co/t/how-to-set-other-time-zone-in-rallys-log/328683 "2023-06-13T06:13:49Z")

</div>

Is there any way to set other time zone in rally's log? I tried modify the format or datefmt in logging.json, but can't figure it out. "normal": { "format": "%(asctime)s,%(msecs)d %(actorAddress)s/PID:%(process)d…

---

## [Get data view api returns 404 even if the data view exists](https://discuss.elastic.co/t/get-data-view-api-returns-404-even-if-the-data-view-exists/335822)

<div class="topic-metadata">

**Author:** [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\
**Replies:** 13\
**Last updated:** [June 13, 2023, 6:08am UTC](https://discuss.elastic.co/t/get-data-view-api-returns-404-even-if-the-data-view-exists/335822 "2023-06-13T06:08:38Z")

</div>

Hi i am using the following command to check if the data view exists curl -X GET "http://demo.icebreaker.minutuscloud.com/kibana/api/data\_views/data\_view/3dxp\_servicetrace" -H 'kbn-xsrf: true' -u elastic:minutus -k E…

---

## [Kibana\_system user ID is unable to connect to elasticsearch](https://discuss.elastic.co/t/kibana-system-user-id-is-unable-to-connect-to-elasticsearch/335623)

<div class="topic-metadata">

**Author:** [@swchandu](https://discuss.elastic.co/u/swchandu)\
**Replies:** 2\
**Last updated:** [June 13, 2023, 4:52am UTC](https://discuss.elastic.co/t/kibana-system-user-id-is-unable-to-connect-to-elasticsearch/335623 "2023-06-13T04:52:10Z")

</div>

Hi, I have created a new Elasticsearch cluster 8.8.0(on Linux) and tried to start kibana. But found this error for the first time. BTW, kibana\_system/new id's password is set already with APIs. kibana.yml server.port…

---

## [LogStash setting Date error](https://discuss.elastic.co/t/logstash-setting-date-error/335733)

<div class="topic-metadata">

**Author:** [@yy\_isam](https://discuss.elastic.co/u/yy_isam)\
**Replies:** 8\
**Last updated:** [June 13, 2023, 4:46am UTC](https://discuss.elastic.co/t/logstash-setting-date-error/335733 "2023-06-13T04:46:20Z")

</div>

Hello guys! I want to run my logtstash connect to elastic using input jdbc. Then i create conf file to run logstash but i always get this error, i try any changes in conf file but still not working. Anyone can help me t…

---

## [Var/run/elastic-agent.sock: connect: no such file or directory](https://discuss.elastic.co/t/var-run-elastic-agent-sock-connect-no-such-file-or-directory/335817)

<div class="topic-metadata">

**Author:** [@xqaiviwjxzw](https://discuss.elastic.co/u/xqaiviwjxzw)\
**Replies:** 0\
**Last updated:** [June 13, 2023, 3:31am UTC](https://discuss.elastic.co/t/var-run-elastic-agent-sock-connect-no-such-file-or-directory/335817 "2023-06-13T03:31:49Z")

</div>

The installation of the elastic agent is not successful, and the following error is displayed when executing the elastic-agent status query. What is the solution? % sudo /Library/Elastic/Agent/elastic-agent status Error…

---

## [A possible bug about Kafka output ErrBreakerOpen](https://discuss.elastic.co/t/a-possible-bug-about-kafka-output-errbreakeropen/335816)

<div class="topic-metadata">

**Author:** [@Ferrari248](https://discuss.elastic.co/u/Ferrari248)\
**Replies:** 1\
**Last updated:** [June 13, 2023, 3:29am UTC](https://discuss.elastic.co/t/a-possible-bug-about-kafka-output-errbreakeropen/335816 "2023-06-13T03:29:27Z")

</div>

I find an issue which is possibly a bug in kafka output of FIleBeat8.7: libbeat/outputs/kafka/client.go: func (r \*msgRef) fail(msg \*message, err error) { switch err { case sarama.ErrInvalidMessage: ... case sarama…

---

## [There is no "Create Index" Tab](https://discuss.elastic.co/t/there-is-no-create-index-tab/335790)

<div class="topic-metadata">

**Author:** [@Resul\_Zoroglu](https://discuss.elastic.co/u/Resul_Zoroglu)\
**Replies:** 1\
**Last updated:** [June 13, 2023, 1:49am UTC](https://discuss.elastic.co/t/there-is-no-create-index-tab/335790 "2023-06-13T01:49:26Z")

</div>

I installed the latest version of elasticsearch and kibana with helm chart on kubernetes. There is no create index tab in Kibana. Is it up or is there something I missed? helm install elasticsearch elastic/elasticsearch…

---

## [Get list of documents from a specific segment](https://discuss.elastic.co/t/get-list-of-documents-from-a-specific-segment/335663)

<div class="topic-metadata">

**Author:** [@cvarano](https://discuss.elastic.co/u/cvarano)\
**Replies:** 3\
**Last updated:** [June 13, 2023, 1:45am UTC](https://discuss.elastic.co/t/get-list-of-documents-from-a-specific-segment/335663 "2023-06-13T01:45:36Z")

</div>

Is there a way to inspect which documents are stored in a specific segment? I can get the segments from the cat segments api, but it only tells me the total # of docs. I want to perform two functions: Given a segment …

---

## [Authentication of \[elastic\] was terminated by realm \[reserved\] - failed to authenticate user \[elastic\]](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/335744)

<div class="topic-metadata">

**Author:** [@Shreyansh\_Narang](https://discuss.elastic.co/u/Shreyansh_Narang)\
**Replies:** 1\
**Last updated:** [June 13, 2023, 1:27am UTC](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/335744 "2023-06-13T01:27:38Z")

</div>

Getting the authentication error for elastic user. Authentication of \[elastic\] was terminated by realm \[reserved\] - failed to authenticate user \[elastic\] I tried resetting the password using bootstrap but no luck. Ca…

---

## [Is there a way to avoid elastic agent installation on host?](https://discuss.elastic.co/t/is-there-a-way-to-avoid-elastic-agent-installation-on-host/335643)

<div class="topic-metadata">

**Author:** [@Marcos\_Ivan\_Robles\_H](https://discuss.elastic.co/u/Marcos_Ivan_Robles_H)\
**Replies:** 0\
**Last updated:** [June 9, 2023, 3:49pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-avoid-elastic-agent-installation-on-host/335643 "2023-06-09T15:49:39Z")

</div>

I wonder if it is possible to enroll to the predefined elastic agent in cloud without having to install it on my local host or any host. So far. I understand elastic agent is installed by default in cloud environments. …

---

## [Can we apply new platinum license be applied before the start date](https://discuss.elastic.co/t/can-we-apply-new-platinum-license-be-applied-before-the-start-date/335593)

<div class="topic-metadata">

**Author:** [@forabraham1](https://discuss.elastic.co/u/forabraham1)\
**Replies:** 1\
**Last updated:** [June 13, 2023, 1:08am UTC](https://discuss.elastic.co/t/can-we-apply-new-platinum-license-be-applied-before-the-start-date/335593 "2023-06-13T01:08:03Z")

</div>

Currently we're using platinum license (in-house) and it is going expire on July 1st 2023 12:59 AM. We have procured new platinum license for this year and its start date is "start\_date\_in\_millis":1656633600000 which is …

---

## [Watcher webhook gives error 401 Authorization after certificate update](https://discuss.elastic.co/t/watcher-webhook-gives-error-401-authorization-after-certificate-update/335457)

<div class="topic-metadata">

**Author:** [@ynassipov](https://discuss.elastic.co/u/ynassipov)\
**Replies:** 1\
**Last updated:** [June 13, 2023, 12:57am UTC](https://discuss.elastic.co/t/watcher-webhook-gives-error-401-authorization-after-certificate-update/335457 "2023-06-13T00:57:33Z")

</div>

Recently upgraded Elasticsearch from 8.3.2 to 8.6.2 we have watcher with webhook posting information to 3rd party application for one of the instances of that 3rd party application we had to update SSL certificate aft…

---

## [Estimate resource usage in ES 6](https://discuss.elastic.co/t/estimate-resource-usage-in-es-6/335803)

<div class="topic-metadata">

**Author:** [@louisdeveloper](https://discuss.elastic.co/u/louisdeveloper)\
**Replies:** 1\
**Last updated:** [June 13, 2023, 12:39am UTC](https://discuss.elastic.co/t/estimate-resource-usage-in-es-6/335803 "2023-06-13T00:39:08Z")

</div>

However I have a self-hosted server with Elasticsearch 6. Does it allow me to get an estimate of how many GB were read during a period and how many API calls were made in a period?

---

## [Need help sending over pfsense syslogs to Elastic Agent (Windows) with Pfsense Integrations](https://discuss.elastic.co/t/need-help-sending-over-pfsense-syslogs-to-elastic-agent-windows-with-pfsense-integrations/335815)

<div class="topic-metadata">

**Author:** [@synthallthetime](https://discuss.elastic.co/u/synthallthetime)\
**Replies:** 0\
**Last updated:** [June 13, 2023, 12:12am UTC](https://discuss.elastic.co/t/need-help-sending-over-pfsense-syslogs-to-elastic-agent-windows-with-pfsense-integrations/335815 "2023-06-13T00:12:44Z")

</div>

Hi all, I've been really enjoying using ELK , I first started off my deploying a fleet and installing an elastic agent on a Windows desktop . I've since enabled Windows sysmon integration from the install list and have …

---

## [How to configure Elastic.Serilog.Sinks librari with appsettings.json?](https://discuss.elastic.co/t/how-to-configure-elastic-serilog-sinks-librari-with-appsettings-json/335635)

<div class="topic-metadata">

**Author:** [@mchudinov](https://discuss.elastic.co/u/mchudinov)\
**Replies:** 1\
**Last updated:** [June 12, 2023, 11:30pm UTC](https://discuss.elastic.co/t/how-to-configure-elastic-serilog-sinks-librari-with-appsettings-json/335635 "2023-06-12T23:30:01Z")

</div>

I want to use Elastic.Serilog.Sinks library (created by Elastic co) to submit logs to an Elastic instance inside the Elastic cloud. How to configure logging using appsettings.json for a .NET 7 application? How to confi…

---

## [An issue , in implmenting the scroll function](https://discuss.elastic.co/t/an-issue-in-implmenting-the-scroll-function/335813)

<div class="topic-metadata">

**Author:** [@Bettaieb\_Walid](https://discuss.elastic.co/u/Bettaieb_Walid)\
**Replies:** 0\
**Last updated:** [June 12, 2023, 9:48pm UTC](https://discuss.elastic.co/t/an-issue-in-implmenting-the-scroll-function/335813 "2023-06-12T21:48:43Z")

</div>

hello , i am developing a scroll api , in order to be able to fetch a large amount of data , i am able to console log the scroll id , but i am having an empty response , here is my code snippet \`\`\`const { Client } = req…

---

## [Converting scripted field to runtime field](https://discuss.elastic.co/t/converting-scripted-field-to-runtime-field/335571)

<div class="topic-metadata">

**Author:** [@ccloutr.alex](https://discuss.elastic.co/u/ccloutr.alex)\
**Replies:** 2\
**Last updated:** [June 12, 2023, 6:33pm UTC](https://discuss.elastic.co/t/converting-scripted-field-to-runtime-field/335571 "2023-06-12T18:33:58Z")

</div>

Our stack was updated from version 7.9.3 to version 7.17.9 and I am having to convert some of the scripted fields to the new "runtime" field as it shows scripted fields as depreciated. It looks like some of the time func…

---

## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/335697)

<div class="topic-metadata">

**Author:** [@Fatiha](https://discuss.elastic.co/u/Fatiha)\
**Replies:** 4\
**Last updated:** [June 12, 2023, 6:18pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/335697 "2023-06-12T18:18:25Z")

</div>

hi I run elasticearch 8.7.0 and kibana same version the elastic is running correctly but the kibana when i go to the browser : I have this message Kibana server is not ready yet. when i tap this command : docker …

---

## [Cost of ElasticSearch on Google Cloud Platform](https://discuss.elastic.co/t/cost-of-elasticsearch-on-google-cloud-platform/335799)

<div class="topic-metadata">

**Author:** [@louisdeveloper](https://discuss.elastic.co/u/louisdeveloper)\
**Replies:** 5\
**Last updated:** [June 12, 2023, 6:16pm UTC](https://discuss.elastic.co/t/cost-of-elasticsearch-on-google-cloud-platform/335799 "2023-06-12T18:16:18Z")

</div>

In our company, we chose to use Elasticsearch Cloud on Google Cloud Platform (GCP) due to the ease of updating and scaling our application. However, GCP has a charge for every HTTP access on our VM. Since our other VMs…

---

## [Logstash filter issue](https://discuss.elastic.co/t/logstash-filter-issue/335314)

<div class="topic-metadata">

**Author:** [@namdev](https://discuss.elastic.co/u/namdev)\
**Replies:** 4\
**Last updated:** [June 12, 2023, 5:34pm UTC](https://discuss.elastic.co/t/logstash-filter-issue/335314 "2023-06-12T17:34:55Z")

</div>

Hi team, I am using logstash filter to get the duration between two dates. StartDate =2023-05-23T 10:25:53.123Z EndDate =2023-05-23T 18:25:43.123Z using the code below:-- match =\> \[ "Start Date", "ISO86…

---

## [Three Plots from one Data View With Two Different Split Series Applying Individually](https://discuss.elastic.co/t/three-plots-from-one-data-view-with-two-different-split-series-applying-individually/335647)

<div class="topic-metadata">

**Author:** [@nickbarry](https://discuss.elastic.co/u/nickbarry)\
**Replies:** 21\
**Last updated:** [June 12, 2023, 3:59pm UTC](https://discuss.elastic.co/t/three-plots-from-one-data-view-with-two-different-split-series-applying-individually/335647 "2023-06-12T15:59:43Z")

</div>

I have three data plots I wish to display in one visualization. All data is from one wildcard data view and I have defined three y-axes. I would like to have two stacked data plots (line charts, in this case), split by…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=512)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=514)
