# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=674 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 675 --- ## [Error: \[config validation of \[elasticsearch\].serviceAccountToken\]: serviceAccountToken cannot be specified when "username" is also set](https://discuss.elastic.co/t/error-config-validation-of-elasticsearch-serviceaccounttoken-serviceaccounttoken-cannot-be-specified-when-username-is-also-set/321020)
**Author:** [@iLucas.Bechlte.exe](https://discuss.elastic.co/u/iLucas.Bechlte.exe)\ **Replies:** 0\ **Last updated:** [December 12, 2022, 11:04am UTC](https://discuss.elastic.co/t/error-config-validation-of-elasticsearch-serviceaccounttoken-serviceaccounttoken-cannot-be-specified-when-username-is-also-set/321020 "2022-12-12T11:04:39Z")
Hello, when I try to follow this instruction to secure my Elastic Stack, I will get this error: Error: \[config validation of \[elasticsearch\].serviceAccountToken\]: serviceAccountToken cannot be specified when "username"… --- ## [All request sent to the same host while init RestHighLevelClient with domain](https://discuss.elastic.co/t/all-request-sent-to-the-same-host-while-init-resthighlevelclient-with-domain/321803)
**Author:** [@DJ\_Zhu](https://discuss.elastic.co/u/DJ_Zhu)\ **Replies:** 2\ **Last updated:** [January 9, 2023, 6:42am UTC](https://discuss.elastic.co/t/all-request-sent-to-the-same-host-while-init-resthighlevelclient-with-domain/321803 "2023-01-09T06:42:38Z")
I have an es cluster with multiple node. Recently I found that the bulk requests to the cluster seems uneven. Here is the demo code: import org.apache.http.HttpHost; import org.elasticsearch.action.ActionListener; imp… --- ## [Moving license from old cluster nodes to new ones](https://discuss.elastic.co/t/moving-license-from-old-cluster-nodes-to-new-ones/322592)
**Author:** [@Nick.Evans](https://discuss.elastic.co/u/Nick.Evans)\ **Replies:** 7\ **Last updated:** [January 9, 2023, 6:27am UTC](https://discuss.elastic.co/t/moving-license-from-old-cluster-nodes-to-new-ones/322592 "2023-01-09T06:27:48Z")
We have a 3 node elasticsearch cluster. (node-1, node-2, node-3) We have a need to introduce 3 new nodes and fail out the original 3. I have built nodes 4, 5 and 6 and successfully added them to cluster. Once the clus… --- ## [Why translog\_ops still greater than 0 after flush](https://discuss.elastic.co/t/why-translog-ops-still-greater-than-0-after-flush/322095)
**Author:** [@DJ\_Zhu](https://discuss.elastic.co/u/DJ_Zhu)\ **Replies:** 1\ **Last updated:** [January 9, 2023, 6:26am UTC](https://discuss.elastic.co/t/why-translog-ops-still-greater-than-0-after-flush/322095 "2023-01-09T06:26:53Z")
I want to move shards between different kind of nodes in my cluster. First, I stop write any docs into index and invoked POST my\_idx/\_flush to commit translog to lucene. Then change the index.routing.allocation.require … --- ## [Wildcard Queries Vs Query\_string Queries](https://discuss.elastic.co/t/wildcard-queries-vs-query-string-queries/322692)
**Author:** [@Sheharyar\_Khalid](https://discuss.elastic.co/u/Sheharyar_Khalid)\ **Replies:** 1\ **Last updated:** [January 9, 2023, 5:21am UTC](https://discuss.elastic.co/t/wildcard-queries-vs-query-string-queries/322692 "2023-01-09T05:21:39Z")
Hello, I am looking for wildcard matching of events on log data in elasticsearch. For example i want to match IP addresses in my data but I only know the ending address (i want to match to 192.100.1.1 but i search for \*… --- ## [Communications link failure\\n\\nThe last packet successfully received from the server was 50,079 milliseconds ago. The last packet sent successfully to the server was 50,080 milliseconds ago.",](https://discuss.elastic.co/t/communications-link-failure-n-nthe-last-packet-successfully-received-from-the-server-was-50-079-milliseconds-ago-the-last-packet-sent-successfully-to-the-server-was-50-080-milliseconds-ago/322698)
**Author:** [@sohan](https://discuss.elastic.co/u/sohan)\ **Replies:** 0\ **Last updated:** [January 9, 2023, 4:49am UTC](https://discuss.elastic.co/t/communications-link-failure-n-nthe-last-packet-successfully-received-from-the-server-was-50-079-milliseconds-ago-the-last-packet-sent-successfully-to-the-server-was-50-080-milliseconds-ago/322698 "2023-01-09T04:49:53Z")
jdbc\_driver\_library =\> "/opt/bitnami/logstash/logstash-core/lib/jars/mysql-connector-java.jar" jdbc\_driver\_class =\> "com.mysql.cj.jdbc.Driver" jdbc\_connection\_string =\> "jdbc:mysql://db:3306/dbname?zeroDateTimeBehavior… --- ## [Kubernetes CPU Memory Usage in %](https://discuss.elastic.co/t/kubernetes-cpu-memory-usage-in/322429)
**Author:** [@Ankita\_Pachauri](https://discuss.elastic.co/u/Ankita_Pachauri)\ **Replies:** 1\ **Last updated:** [January 9, 2023, 4:08am UTC](https://discuss.elastic.co/t/kubernetes-cpu-memory-usage-in/322429 "2023-01-09T04:08:56Z")
Hi Team, We need to find the CPU and Memory utilization % of pods in kubernetes through metricbeat. I have used the formula as: CPU: { "aggs": { "timeseries": { "auto\_date\_histogram": {"field": "@timestamp", "buc… --- ## [Elastic won't send data to Kibana](https://discuss.elastic.co/t/elastic-wont-send-data-to-kibana/318833)
**Author:** [@zerratriani](https://discuss.elastic.co/u/zerratriani)\ **Replies:** 3\ **Last updated:** [November 14, 2022, 7:19am UTC](https://discuss.elastic.co/t/elastic-wont-send-data-to-kibana/318833 "2022-11-14T07:19:38Z")
Hallo, I have a configuration like the following, but elastic can't retrieve the logs. And the plain-log .log also doesn't show the activation log. How else can I confirm that logstash and filebeat are connected and tran… --- ## [Wildcard search on all fields](https://discuss.elastic.co/t/wildcard-search-on-all-fields/322693)
**Author:** [@Sheharyar\_Khalid](https://discuss.elastic.co/u/Sheharyar_Khalid)\ **Replies:** 2\ **Last updated:** [January 9, 2023, 2:55am UTC](https://discuss.elastic.co/t/wildcard-search-on-all-fields/322693 "2023-01-09T02:55:08Z")
Hello, I want to search a wildcard string on all fields of a document. Is there any way to do it? I was able to write this query but for some reason it always returns empty. {"bool": {"must" : \[{"wildcard": {"\_all": "… --- ## [Logstash pkg update results log prasing stopped](https://discuss.elastic.co/t/logstash-pkg-update-results-log-prasing-stopped/322542)
**Author:** [@Dilipssn](https://discuss.elastic.co/u/Dilipssn)\ **Replies:** 7\ **Last updated:** [January 9, 2023, 1:57am UTC](https://discuss.elastic.co/t/logstash-pkg-update-results-log-prasing-stopped/322542 "2023-01-09T01:57:50Z")
Hello Team, We have logstash to push the logs from one server to other, where all the traps are collected. Through which we plot graphs in "Grafana". The port number in which logs parsing is "7546". until "logstash-7… --- ## [Date histogram aggregation seems incorrect with calendar\_interval and when offset \>= 30 days](https://discuss.elastic.co/t/date-histogram-aggregation-seems-incorrect-with-calendar-interval-and-when-offset-30-days/322492)
**Author:** [@xiaofei](https://discuss.elastic.co/u/xiaofei)\ **Replies:** 3\ **Last updated:** [January 9, 2023, 1:26am UTC](https://discuss.elastic.co/t/date-histogram-aggregation-seems-incorrect-with-calendar-interval-and-when-offset-30-days/322492 "2023-01-09T01:26:23Z")
Based on this doc, elasticsearch supports Calendar-aware interval on data histogram aggregation. Specially for a "quarter" interval: "One quarter is the interval between the start day of the month and time of day and t… --- ## [How to get average of items in an array of a nested field?](https://discuss.elastic.co/t/how-to-get-average-of-items-in-an-array-of-a-nested-field/322690)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 4\ **Last updated:** [January 9, 2023, 12:32am UTC](https://discuss.elastic.co/t/how-to-get-average-of-items-in-an-array-of-a-nested-field/322690 "2023-01-09T00:32:28Z")
I'm trying to get the average price of products that are in stock across my different physical warehouses. I made this index: PUT warehouse POST warehouse/\_mapping { "properties": { "inventory": { "prope… --- ## [PHP Client 8.5 Not Response Data](https://discuss.elastic.co/t/php-client-8-5-not-response-data/322670)
**Author:** [@vcamargo](https://discuss.elastic.co/u/vcamargo)\ **Replies:** 1\ **Last updated:** [January 9, 2023, 12:07am UTC](https://discuss.elastic.co/t/php-client-8-5-not-response-data/322670 "2023-01-09T00:07:05Z")
When try request do elastic using php client response it's returning always null, I've try using "search", "get" methodos and not working, when a try use postman request it's working, sample code below Request Status Co… --- ## [Cluster health status changed from \[YELLOW\] to \[RED\] (reason: \[auto-create\] after changing path.data and path.log](https://discuss.elastic.co/t/cluster-health-status-changed-from-yellow-to-red-reason-auto-create-after-changing-path-data-and-path-log/320864)
**Author:** [@amiraliw](https://discuss.elastic.co/u/amiraliw)\ **Replies:** 1\ **Last updated:** [December 11, 2022, 11:58pm UTC](https://discuss.elastic.co/t/cluster-health-status-changed-from-yellow-to-red-reason-auto-create-after-changing-path-data-and-path-log/320864 "2022-12-11T23:58:12Z")
I have installed elasticsearch-8.4.3-x86\_64 and changed the path.data and path.log before I started the service. Permissions to the new pathes are more than needed as following: drwxrwsrwx. 2 elasticsearch elasticsearc… --- ## [A kibana startup question](https://discuss.elastic.co/t/a-kibana-startup-question/320611)
**Author:** [@laughting](https://discuss.elastic.co/u/laughting)\ **Replies:** 4\ **Last updated:** [December 11, 2022, 8:52pm UTC](https://discuss.elastic.co/t/a-kibana-startup-question/320611 "2022-12-11T20:52:04Z")
Why need to configure elasticsearch.password and elasticsaerch.username to start Kibana? What is initialized? Why not login directly through the account and password from the browser？ --- ## [Using NDJSON for Logstash HTTP Output Plugin](https://discuss.elastic.co/t/using-ndjson-for-logstash-http-output-plugin/322683)
**Author:** [@gs04](https://discuss.elastic.co/u/gs04)\ **Replies:** 0\ **Last updated:** [January 8, 2023, 3:29pm UTC](https://discuss.elastic.co/t/using-ndjson-for-logstash-http-output-plugin/322683 "2023-01-08T15:29:00Z")
I'm looking to use a Logstash http output plugin to send a batch of JSON events where all the events are stored in the HTTP message as new-line delimited JSON events. For example, we'd need the data of the HTTP transmis… --- ## [Kubernetes Logstash statefulset under a Service of type Load Balancer (Amazon EKS) uneven distribution of events between pods](https://discuss.elastic.co/t/kubernetes-logstash-statefulset-under-a-service-of-type-load-balancer-amazon-eks-uneven-distribution-of-events-between-pods/322578)
**Author:** [@vikasp](https://discuss.elastic.co/u/vikasp)\ **Replies:** 3\ **Last updated:** [January 8, 2023, 3:08pm UTC](https://discuss.elastic.co/t/kubernetes-logstash-statefulset-under-a-service-of-type-load-balancer-amazon-eks-uneven-distribution-of-events-between-pods/322578 "2023-01-08T15:08:20Z")
I am working with a self managed elasticsearch cluster hosted in Amazon EKS. The pipeline flow is: filebeat agent is deployed in all ec2 servers seding data to logstash. https://logstash.company.com:5046. Logstash is … --- ## [Json data from Filebeat to Logstash](https://discuss.elastic.co/t/json-data-from-filebeat-to-logstash/322672)
**Author:** [@Hamburglar](https://discuss.elastic.co/u/Hamburglar)\ **Replies:** 4\ **Last updated:** [January 8, 2023, 1:54pm UTC](https://discuss.elastic.co/t/json-data-from-filebeat-to-logstash/322672 "2023-01-08T13:54:35Z")
Json data to be ingested: /var/log/file.json {"event\_type":"temp","time":"2023-01-07 23:30:12","temp":64.0,"fan":2291} {"event\_type":"temp","time":"2023-01-07 23:30:22","temp":63.0,"fan":2308} {"event\_type":"temp","time… --- ## [Illegal\_argument\_exception](https://discuss.elastic.co/t/illegal-argument-exception/320962)
**Author:** [@Jinhyuck\_Cha](https://discuss.elastic.co/u/Jinhyuck_Cha)\ **Replies:** 1\ **Last updated:** [December 11, 2022, 4:38pm UTC](https://discuss.elastic.co/t/illegal-argument-exception/320962 "2022-12-11T16:38:55Z")
Hi i'm try to query to Elasticsearch in kibana But I got some error in there How can I solve it? this is my query POST dingo-dev-images-enriched-index-v1/\_search { "query": { "bool": { "filter": \[ … --- ## [Why elasticsearch search query (when you inspect)on date is different from kibana query on date?](https://discuss.elastic.co/t/why-elasticsearch-search-query-when-you-inspect-on-date-is-different-from-kibana-query-on-date/322676)
**Author:** [@alex\_petrov](https://discuss.elastic.co/u/alex_petrov)\ **Replies:** 4\ **Last updated:** [January 8, 2023, 11:23am UTC](https://discuss.elastic.co/t/why-elasticsearch-search-query-when-you-inspect-on-date-is-different-from-kibana-query-on-date/322676 "2023-01-08T11:23:27Z")
I used date as a field in kibana as shown below and date is between Oct 15, 2022 @ 00:00:00.000 - Oct 16, 2022 @ 00:00:00.000 why it is different from elasticsearch query when you inspect(as shown below)? --- ## [Jdbc mongo plugin](https://discuss.elastic.co/t/jdbc-mongo-plugin/322282)
**Author:** [@reza\_sabz](https://discuss.elastic.co/u/reza_sabz)\ **Replies:** 2\ **Last updated:** [January 8, 2023, 8:58am UTC](https://discuss.elastic.co/t/jdbc-mongo-plugin/322282 "2023-01-08T08:58:46Z")
Hello every one I want to connect mongodb to elastic via logstash. I did a lot of research on this. I checked and tested many methods. Finally, I reached jdbc. I have a problem in configuring this plugin and somehow I i… --- ## [Kibana painless scripted fields](https://discuss.elastic.co/t/kibana-painless-scripted-fields/316762)
**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\ **Replies:** 3\ **Last updated:** [October 18, 2022, 7:58am UTC](https://discuss.elastic.co/t/kibana-painless-scripted-fields/316762 "2022-10-18T07:58:21Z")
Hi elastic Team, I want to calculate the number of adults and children in every room. Below is an example of my document: "rooms": \[ { "pensionId": 16, "LibelleChambre": "Twin GardenView ", "MontantRemise": 0, "N… --- ## [How to encrypt Elasticsearch data path](https://discuss.elastic.co/t/how-to-encrypt-elasticsearch-data-path/322562)
**Author:** [@Naga\_Prudhvi](https://discuss.elastic.co/u/Naga_Prudhvi)\ **Replies:** 3\ **Last updated:** [January 8, 2023, 6:21am UTC](https://discuss.elastic.co/t/how-to-encrypt-elasticsearch-data-path/322562 "2023-01-08T06:21:55Z")
I want to perform dm-crypt encryption at rest for all data path for Elasticsearch but it should be searchable if I try to access data from hadoop/spark/kibana. Any ideas on this would be very appreciated. --- ## [Visualize data by two fields](https://discuss.elastic.co/t/visualize-data-by-two-fields/316819)
**Author:** [@Kohlman](https://discuss.elastic.co/u/Kohlman)\ **Replies:** 1\ **Last updated:** [October 18, 2022, 6:54am UTC](https://discuss.elastic.co/t/visualize-data-by-two-fields/316819 "2022-10-18T06:54:56Z")
We have multiple clients. Each client has there own instance of our database. While there may be subtle differences in schema as we continue to make enhancements. For purposes of this question we can assume they are the … --- ## [Can ES single node use index lifecycle management(ILM)?](https://discuss.elastic.co/t/can-es-single-node-use-index-lifecycle-management-ilm/322664)
**Author:** [@jacksparrow414](https://discuss.elastic.co/u/jacksparrow414)\ **Replies:** 2\ **Last updated:** [January 8, 2023, 2:06am UTC](https://discuss.elastic.co/t/can-es-single-node-use-index-lifecycle-management-ilm/322664 "2023-01-08T02:06:56Z")
I checked the official documentation, which only mentioned clusters, I wonder if a single node supports ILM? According to my understanding, a single-node ES has all node roles and all data tiers, so it should support IL… --- ## [Security troubles - java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors (ca.crt matches on all nodes)](https://discuss.elastic.co/t/security-troubles-java-security-cert-certpathvalidatorexception-path-does-not-chain-with-any-of-the-trust-anchors-ca-crt-matches-on-all-nodes/322674)
**Author:** [@emoon](https://discuss.elastic.co/u/emoon)\ **Replies:** 1\ **Last updated:** [January 8, 2023, 1:23am UTC](https://discuss.elastic.co/t/security-troubles-java-security-cert-certpathvalidatorexception-path-does-not-chain-with-any-of-the-trust-anchors-ca-crt-matches-on-all-nodes/322674 "2023-01-08T01:23:01Z")
Note that this entire cluster was working fine up 'til I updated certificates. I'm on Elasticsearch 7.5. I updated my certificates using the certificate-util - created a server.yml with all my servers and the Kibana nod… --- ## [Status of hosts with ELK](https://discuss.elastic.co/t/status-of-hosts-with-elk/318738)
**Author:** [@kurdit](https://discuss.elastic.co/u/kurdit)\ **Replies:** 3\ **Last updated:** [November 13, 2022, 11:08am UTC](https://discuss.elastic.co/t/status-of-hosts-with-elk/318738 "2022-11-13T11:08:03Z")
hello friends! I have the following task: it is necessary to monitor hundreds of hosts (virtual machines). now they are monitored using Nagios, but I want to get a clear visualization of the availability of hosts. ther… --- ## [S3 output: Is there a way to have every event in its own file?](https://discuss.elastic.co/t/s3-output-is-there-a-way-to-have-every-event-in-its-own-file/322663)
**Author:** [@rickfish](https://discuss.elastic.co/u/rickfish)\ **Replies:** 4\ **Last updated:** [January 7, 2023, 6:57pm UTC](https://discuss.elastic.co/t/s3-output-is-there-a-way-to-have-every-event-in-its-own-file/322663 "2023-01-07T18:57:43Z")
I have an unusual requirement to put every event in a separate file in an s3 bucket. I have tried to use this: rotation\_strategy =\> "size" size\_file =\> 1 but that is just an estimate and it still puts multiple events i… --- ## [After 6.8 -\> 7.17 upgrade, logstash not sending data to logstash-\* indexes](https://discuss.elastic.co/t/after-6-8-7-17-upgrade-logstash-not-sending-data-to-logstash-indexes/322479)
**Author:** [@willdennis](https://discuss.elastic.co/u/willdennis)\ **Replies:** 7\ **Last updated:** [January 7, 2023, 4:45pm UTC](https://discuss.elastic.co/t/after-6-8-7-17-upgrade-logstash-not-sending-data-to-logstash-indexes/322479 "2023-01-07T16:45:48Z")
Hi all, Did an upgrade to my single-node cluster yesterday evening, now up on 7.17.8 and everything's basically working, except that it seems that Logstash is no longer creating logstash-\ indexes... I see th… --- ## [Kibana time filter change dynamically API](https://discuss.elastic.co/t/kibana-time-filter-change-dynamically-api/316732)
**Author:** [@PabloCuestaGarcia](https://discuss.elastic.co/u/PabloCuestaGarcia)\ **Replies:** 1\ **Last updated:** [October 17, 2022, 11:48pm UTC](https://discuss.elastic.co/t/kibana-time-filter-change-dynamically-api/316732 "2022-10-17T23:48:21Z")
Hi all. I would like to know if it is possible to dynamically change the time range in Kibana according to the last load data. I mean, I have an ETL loading data every day, but some days the data comes empty, the proce… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=673) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=675)