# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=696 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 697 --- ## [Elasticsearch is incompatible with new versions of openjdk from redhat](https://discuss.elastic.co/t/elasticsearch-is-incompatible-with-new-versions-of-openjdk-from-redhat/318928)
**Author:** [@sayfeddine](https://discuss.elastic.co/u/sayfeddine)\ **Replies:** 11\ **Last updated:** [December 17, 2022, 1:55pm UTC](https://discuss.elastic.co/t/elasticsearch-is-incompatible-with-new-versions-of-openjdk-from-redhat/318928 "2022-12-17T13:55:54Z")
Redhat introduced a new change in their openjdk packages (starting from 1.8.0-345.b01-5.el8\_7) for rhel 8.7 where they check for the system cacert automatically when you initialize a new trustmanager object (even without… --- ## [Logstash Encoding mistach](https://discuss.elastic.co/t/logstash-encoding-mistach/320084)
**Author:** [@SilasMuniz1](https://discuss.elastic.co/u/SilasMuniz1)\ **Replies:** 2\ **Last updated:** [December 17, 2022, 1:43am UTC](https://discuss.elastic.co/t/logstash-encoding-mistach/320084 "2022-12-17T01:43:17Z")
Hello, I am trying resolve an encoding problem using mutate gsub. There are some words that display with error: For instance Confirma\\u00e7\\u00eo, correct is Confirmacao. Then a used the following gsub: mutate { … --- ## [Kibana - A secure connection is required for log in](https://discuss.elastic.co/t/kibana-a-secure-connection-is-required-for-log-in/321311)
**Author:** [@SilasMuniz1](https://discuss.elastic.co/u/SilasMuniz1)\ **Replies:** 2\ **Last updated:** [December 17, 2022, 1:38am UTC](https://discuss.elastic.co/t/kibana-a-secure-connection-is-required-for-log-in/321311 "2022-12-17T01:38:53Z")
Good morning, I am trying setup NGINX to use proxy reverse to access my kibana. The first idea is redirect traffic on http://172.20.6.213:8080 to https://172.20.6.213:5601. My nginx setup below: I received this mes… --- ## [Kibana discover query where two fields are not the same?](https://discuss.elastic.co/t/kibana-discover-query-where-two-fields-are-not-the-same/321431)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 3\ **Last updated:** [December 16, 2022, 10:18pm UTC](https://discuss.elastic.co/t/kibana-discover-query-where-two-fields-are-not-the-same/321431 "2022-12-16T22:18:33Z")
I tried running a query like NOT client.geo.country\_iso\_code: source.geo.country\_iso\_code, but it returned results where client.geo.country\_iso\_code == source.geo.country\_iso\_code Anyone know what's wrong with my que… --- ## [\[Filebeat\] Bug with multiple aws-cloudwatch logs using log\_group\_name\_prefix](https://discuss.elastic.co/t/filebeat-bug-with-multiple-aws-cloudwatch-logs-using-log-group-name-prefix/319683)
**Author:** [@EDzhelyov](https://discuss.elastic.co/u/EDzhelyov)\ **Replies:** 8\ **Last updated:** [December 16, 2022, 10:09pm UTC](https://discuss.elastic.co/t/filebeat-bug-with-multiple-aws-cloudwatch-logs-using-log-group-name-prefix/319683 "2022-12-16T22:09:12Z")
I have a lot of running AWS Lambdas and I'm trying to fetch their logs using Filebeat's aws-cloudwatch input type. I'm using the start\_position: beginning in order to backfill the logs when the filebeat starts. When I s… --- ## [How to get the deleted watcher in kibana](https://discuss.elastic.co/t/how-to-get-the-deleted-watcher-in-kibana/317117)
**Author:** [@yasar](https://discuss.elastic.co/u/yasar)\ **Replies:** 1\ **Last updated:** [October 23, 2022, 11:17pm UTC](https://discuss.elastic.co/t/how-to-get-the-deleted-watcher-in-kibana/317117 "2022-10-23T23:17:17Z")
Hi team, We unfortunately deleted the watcher in Kibana. Could you please tell us, how can we retrieve the same watcher script. Thanks, Yasar Arafaath A. --- ## [Understanding the difference between client and source in packetbeat](https://discuss.elastic.co/t/understanding-the-difference-between-client-and-source-in-packetbeat/321430)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 0\ **Last updated:** [December 16, 2022, 8:08pm UTC](https://discuss.elastic.co/t/understanding-the-difference-between-client-and-source-in-packetbeat/321430 "2022-12-16T20:08:10Z")
I'm new to packetbeat and I just got it up and working. When I queried for some data, I noticed situations where the client.geo.country\_iso\_code field did not the same information as the source.geo.country\_iso\_code fie… --- ## [Sum Aggregation using multiple fields](https://discuss.elastic.co/t/sum-aggregation-using-multiple-fields/321357)
**Author:** [@searchwithme](https://discuss.elastic.co/u/searchwithme)\ **Replies:** 5\ **Last updated:** [December 16, 2022, 7:02pm UTC](https://discuss.elastic.co/t/sum-aggregation-using-multiple-fields/321357 "2022-12-16T19:02:00Z")
Hi team! I am indexing the following sample data: travel index Flight price - 550 Hotel price - 220 Meals - 120 (Total Expense - 890) If I query for travel index with total expense \< 1000, it should return result… --- ## [Nested query inside the function\_score](https://discuss.elastic.co/t/nested-query-inside-the-function-score/321428)
**Author:** [@Kankipati\_rajaram](https://discuss.elastic.co/u/Kankipati_rajaram)\ **Replies:** 0\ **Last updated:** [December 16, 2022, 6:28pm UTC](https://discuss.elastic.co/t/nested-query-inside-the-function-score/321428 "2022-12-16T18:28:07Z")
I have the following document schema "properties": { "doc\_id": {"type": "long"}, "cortex\_id": {"type": "long"}, "sentence\_embedding": { … --- ## [Calculate time difference between 2 events with unique id](https://discuss.elastic.co/t/calculate-time-difference-between-2-events-with-unique-id/321388)
**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\ **Replies:** 1\ **Last updated:** [December 16, 2022, 5:48pm UTC](https://discuss.elastic.co/t/calculate-time-difference-between-2-events-with-unique-id/321388 "2022-12-16T17:48:28Z")
Hi, I have two events with same field idRda like the following, I need to calculate the difference between the timestamp "message": "2022-12-13 14:52:00.399 {\[ACTIVE\] ExecuteThread: 5 for queue: weblogic.kernel.Default… --- ## [I started logstash successfully but I don't see anything in my kibana](https://discuss.elastic.co/t/i-started-logstash-successfully-but-i-dont-see-anything-in-my-kibana/321417)
**Author:** [@Whazaza](https://discuss.elastic.co/u/Whazaza)\ **Replies:** 2\ **Last updated:** [December 16, 2022, 5:02pm UTC](https://discuss.elastic.co/t/i-started-logstash-successfully-but-i-dont-see-anything-in-my-kibana/321417 "2022-12-16T17:02:22Z")
I have a problem with logstash it boots with no errors in the logs but I don't see anything in kibana Kibana and elastic are on another node, both apps are running on docker at version 8.5.3 logstash is on a separate … --- ## [Heartbeat monitor for multiple pods inside 1 deployment](https://discuss.elastic.co/t/heartbeat-monitor-for-multiple-pods-inside-1-deployment/321310)
**Author:** [@OlLap](https://discuss.elastic.co/u/OlLap)\ **Replies:** 1\ **Last updated:** [December 16, 2022, 4:47pm UTC](https://discuss.elastic.co/t/heartbeat-monitor-for-multiple-pods-inside-1-deployment/321310 "2022-12-16T16:47:18Z")
Hello, Is is possible with heartbeat configuration monitor all pods (replicas) inside one deployment together to see on Kibana UI something like "3/3 are UP" or "1/3 are UP"? My current configuration creates new entry … --- ## [Arbitrary hash to CEF custom fields?](https://discuss.elastic.co/t/arbitrary-hash-to-cef-custom-fields/321422)
**Author:** [@j00bar](https://discuss.elastic.co/u/j00bar)\ **Replies:** 1\ **Last updated:** [December 16, 2022, 4:37pm UTC](https://discuss.elastic.co/t/arbitrary-hash-to-cef-custom-fields/321422 "2022-12-16T16:37:14Z")
I'm using the cef codec for encoding data. CEF lets you add custom attributes with a series of deviceCustom\* fields. If you've got an attribute confidence and its value is high, you can say in CEF: deviceCustomString1La… --- ## [Shard Failed. Null Node](https://discuss.elastic.co/t/shard-failed-null-node/317204)
**Author:** [@Shep](https://discuss.elastic.co/u/Shep)\ **Replies:** 1\ **Last updated:** [October 23, 2022, 11:07pm UTC](https://discuss.elastic.co/t/shard-failed-null-node/317204 "2022-10-23T23:07:29Z")
Kibana 7.14 I am getting a "no\_shard\_available\_action\_exception". It seems to be suggesting the reason is because the node is "null". Any Advice? { "took": 65, "timed\_out": false, "\_shards": { "total": 13… --- ## [Duplication Due to rollover policy in kibana,data coming from logstash pipeline](https://discuss.elastic.co/t/duplication-due-to-rollover-policy-in-kibana-data-coming-from-logstash-pipeline/319959)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 9\ **Last updated:** [December 5, 2022, 5:52pm UTC](https://discuss.elastic.co/t/duplication-due-to-rollover-policy-in-kibana-data-coming-from-logstash-pipeline/319959 "2022-12-05T17:52:25Z")
Hello All, I am ingesting data into a rollover index. The data comes from perl scripts running every 15 min,20 min,4hour,12 hour,16 hour etc and gives updates on previously ingested events through doc\_as\_upsert used in … --- ## [Multiple configurations to be enabled for filebeat](https://discuss.elastic.co/t/multiple-configurations-to-be-enabled-for-filebeat/321303)
**Author:** [@tejal\_kubde](https://discuss.elastic.co/u/tejal_kubde)\ **Replies:** 2\ **Last updated:** [December 16, 2022, 2:36pm UTC](https://discuss.elastic.co/t/multiple-configurations-to-be-enabled-for-filebeat/321303 "2022-12-16T14:36:42Z")
Hi, I have a multiple types of log files which requires different configurations such as includes for one type of file and exclude for other file type. I generally used to do my configuration in filebeat.yml, which requ… --- ## [Enrich processor is sometimes not enriching](https://discuss.elastic.co/t/enrich-processor-is-sometimes-not-enriching/321188)
**Author:** [@siginigin](https://discuss.elastic.co/u/siginigin)\ **Replies:** 1\ **Last updated:** [December 16, 2022, 2:06pm UTC](https://discuss.elastic.co/t/enrich-processor-is-sometimes-not-enriching/321188 "2022-12-16T14:06:55Z")
Hi, I have pipeline with enrich processor for user enriching and another pipeline with enrich processor for vulnerability enriching. Both pipelines are in parent logs\_syslog pipeline. I noticed some events are not enri… --- ## [ElasticSearch pri.store.size](https://discuss.elastic.co/t/elasticsearch-pri-store-size/321397)
**Author:** [@gjahagir](https://discuss.elastic.co/u/gjahagir)\ **Replies:** 2\ **Last updated:** [December 16, 2022, 1:43pm UTC](https://discuss.elastic.co/t/elasticsearch-pri-store-size/321397 "2022-12-16T13:43:58Z")
Hi, We are performing capacity planning in elastic to evaluate the storage sizes. For this we indexed one doc with dummy fields (7 simple fields and 13 nested) took the size of the doc which is 1148 bytes. Then we ex… --- ## [Parse context\_hits](https://discuss.elastic.co/t/parse-context-hits/321299)
**Author:** [@Pablo\_Sagrera\_Garcia](https://discuss.elastic.co/u/Pablo_Sagrera_Garcia)\ **Replies:** 1\ **Last updated:** [December 16, 2022, 12:13pm UTC](https://discuss.elastic.co/t/parse-context-hits/321299 "2022-12-16T12:13:13Z")
I've create a rule whose connector is write to index. I wonder if possible to parse context\_hits to create an additional field when hit the rule. For example I would like to create an additional field called message o… --- ## [Cannot pass param in sql command](https://discuss.elastic.co/t/cannot-pass-param-in-sql-command/321398)
**Author:** [@thanhdinh98](https://discuss.elastic.co/u/thanhdinh98)\ **Replies:** 2\ **Last updated:** [December 16, 2022, 12:07pm UTC](https://discuss.elastic.co/t/cannot-pass-param-in-sql-command/321398 "2022-12-16T12:07:52Z")
Hi everyone, I just face a problem in passing a param value in SQL command, The request is something like this { "query": "select \* from index where field in (?)", "params": \[ \[ "value1", "value2" … --- ## [Which codec parameter we can use for logstash http input section](https://discuss.elastic.co/t/which-codec-parameter-we-can-use-for-logstash-http-input-section/321405)
**Author:** [@prashant1](https://discuss.elastic.co/u/prashant1)\ **Replies:** 0\ **Last updated:** [December 16, 2022, 11:30am UTC](https://discuss.elastic.co/t/which-codec-parameter-we-can-use-for-logstash-http-input-section/321405 "2022-12-16T11:30:31Z")
We are sending logs from fluentd with http to logstash having version 7.10.2. But looks like codec =\> fluent does not work for http for logstash as we got some \_fluentparse error. We have tried also using codec =\> json… --- ## [Ldap Authorization from certain OU](https://discuss.elastic.co/t/ldap-authorization-from-certain-ou/321404)
**Author:** [@Aleksei](https://discuss.elastic.co/u/Aleksei)\ **Replies:** 0\ **Last updated:** [December 16, 2022, 11:29am UTC](https://discuss.elastic.co/t/ldap-authorization-from-certain-ou/321404 "2022-12-16T11:29:45Z")
Hi all. The question is how to properly configure the config for authorization through LDAP so that you can specify certain OU ( Organizational Unit ) from which users can log in ? As I understood from the article, thi… --- ## [Upsert a document with unique id but same fields and different values](https://discuss.elastic.co/t/upsert-a-document-with-unique-id-but-same-fields-and-different-values/321403)
**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\ **Replies:** 0\ **Last updated:** [December 16, 2022, 11:24am UTC](https://discuss.elastic.co/t/upsert-a-document-with-unique-id-but-same-fields-and-different-values/321403 "2022-12-16T11:24:08Z")
Hi, I have two events with same id idRda like the following, I need to unify the logs in one document, but adding two fields "timestamp1" and "timestamp2" example: idRda:\[4040477\] timestamp1:\[1670939520399\] timestam… --- ## [Filebeat service failed](https://discuss.elastic.co/t/filebeat-service-failed/321361)
**Author:** [@Mohaiminul\_Islam](https://discuss.elastic.co/u/Mohaiminul_Islam)\ **Replies:** 2\ **Last updated:** [December 16, 2022, 11:22am UTC](https://discuss.elastic.co/t/filebeat-service-failed/321361 "2022-12-16T11:22:37Z")
Hi, I am running the elk stack in EC2 instance. I have installed the filebeat and enable nginx and system. But my filebeat is not starting. Here is the error × filebeat.service - Filebeat sends log files to Logstash or… --- ## [\_id is not unique. is repeated in indexes addressed by a single alias](https://discuss.elastic.co/t/id-is-not-unique-is-repeated-in-indexes-addressed-by-a-single-alias/321386)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 4\ **Last updated:** [December 16, 2022, 10:55am UTC](https://discuss.elastic.co/t/id-is-not-unique-is-repeated-in-indexes-addressed-by-a-single-alias/321386 "2022-12-16T10:55:12Z")
I experience the situation that index is having multiple same \_id within the same index I have version 7.17.0 the data are ingested by python requests lib via API this way the uniqueness is broken among multiple inde… --- ## [Order of documents when using a transform](https://discuss.elastic.co/t/order-of-documents-when-using-a-transform/321183)
**Author:** [@Hemabh\_Ravee\_Fox](https://discuss.elastic.co/u/Hemabh_Ravee_Fox)\ **Replies:** 4\ **Last updated:** [December 16, 2022, 10:51am UTC](https://discuss.elastic.co/t/order-of-documents-when-using-a-transform/321183 "2022-12-16T10:51:00Z")
I'm using elasticsearch to store the events data for web sessions. Each event is it's own document. Then I'm using transforms to aggregate this data grouping them by a sessionId key and also creating a field eventFlow wh… --- ## [ElasticSearch Low Level Client search using anonymous type](https://discuss.elastic.co/t/elasticsearch-low-level-client-search-using-anonymous-type/320668)
**Author:** [@gjahagir](https://discuss.elastic.co/u/gjahagir)\ **Replies:** 2\ **Last updated:** [December 16, 2022, 10:13am UTC](https://discuss.elastic.co/t/elasticsearch-low-level-client-search-using-anonymous-type/320668 "2022-12-16T10:13:38Z")
Hi, We are exploring Elastic search to see if it fits into our application requirements. We would want to search using anonymous type, here is what i found in the documentation - var searchResponse = lowlevelClient.Se… --- ## [Filter for specific folder activity](https://discuss.elastic.co/t/filter-for-specific-folder-activity/321395)
**Author:** [@BeyondRAM](https://discuss.elastic.co/u/BeyondRAM)\ **Replies:** 0\ **Last updated:** [December 16, 2022, 10:07am UTC](https://discuss.elastic.co/t/filter-for-specific-folder-activity/321395 "2022-12-16T10:07:18Z")
Hello I wanted to know if it's possible to add a filter in winlogbeat to only have the activity of a specific folder and all it's files inside it, and itself by the way if the folder is renamed, deleted or something else… --- ## [Complex filter query](https://discuss.elastic.co/t/complex-filter-query/321234)
**Author:** [@Henri\_L](https://discuss.elastic.co/u/Henri_L)\ **Replies:** 1\ **Last updated:** [December 15, 2022, 9:38pm UTC](https://discuss.elastic.co/t/complex-filter-query/321234 "2022-12-15T21:38:46Z")
Sorry if it might be obvious but I'm stuck with this query. Here are some example input: { "\_index" : "education", "\_type" : "logs", "\_id" : "educ\_0610426G", "\_score" : 10.917585, … --- ## [Filebeat Failed to connect to backoff(async(tcp:logstash:5044](https://discuss.elastic.co/t/filebeat-failed-to-connect-to-backoff-async-tcp5044/321390)
**Author:** [@Coder\_HK](https://discuss.elastic.co/u/Coder_HK)\ **Replies:** 0\ **Last updated:** [December 16, 2022, 9:27am UTC](https://discuss.elastic.co/t/filebeat-failed-to-connect-to-backoff-async-tcp5044/321390 "2022-12-16T09:27:25Z")
I have set two VMs, one Ubuntu where I've installed ELK and another CentOS where I've installed Filebeat. I want to forward CentOS logs to ELK via filebeat. I have configured all my files correctly (I think) but when I r… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=695) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=697)