# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=697 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 698 --- ## [Elasticsearch 7.17.8 mvnrepository artifact](https://discuss.elastic.co/t/elasticsearch-7-17-8-mvnrepository-artifact/320775)
**Author:** [@Charis\_Yfantis](https://discuss.elastic.co/u/Charis_Yfantis)\ **Replies:** 4\ **Last updated:** [December 16, 2022, 8:27am UTC](https://discuss.elastic.co/t/elasticsearch-7-17-8-mvnrepository-artifact/320775 "2022-12-16T08:27:59Z")
Hello everyone, I just upgraded elasticsearch to 7.17.8 and i need to build a plugin for that version, but it seems https://mvnrepository.com/artifact/org.elasticsearch/elasticsearch does not have the artifact for 7.17… --- ## [One line per year with monthly buckets in line chart](https://discuss.elastic.co/t/one-line-per-year-with-monthly-buckets-in-line-chart/321294)
**Author:** [@Jonas\_S](https://discuss.elastic.co/u/Jonas_S)\ **Replies:** 13\ **Last updated:** [December 15, 2022, 5:41pm UTC](https://discuss.elastic.co/t/one-line-per-year-with-monthly-buckets-in-line-chart/321294 "2022-12-15T17:41:47Z")
Hello, i have a line chart with a date histogram with monthly buckets on the horizontal axis. And a proportion of two cumulative sums on the vertical axis. Is there a way to overlay all years to have only a single y… --- ## [If statement not working as expected](https://discuss.elastic.co/t/if-statement-not-working-as-expected/321054)
**Author:** [@Mistral](https://discuss.elastic.co/u/Mistral)\ **Replies:** 3\ **Last updated:** [December 16, 2022, 7:49am UTC](https://discuss.elastic.co/t/if-statement-not-working-as-expected/321054 "2022-12-16T07:49:45Z")
Hi guys, I know this topic has been posted a few times, but I'm unable to find any tracks to help me since a few days. I'm trying to adapt the logstash 5.8 configuration provided by stormshield to a higher (latest) vers… --- ## [How to use custom ID for inserting document using java sdk](https://discuss.elastic.co/t/how-to-use-custom-id-for-inserting-document-using-java-sdk/321380)
**Author:** [@suresh\_chaudhari](https://discuss.elastic.co/u/suresh_chaudhari)\ **Replies:** 1\ **Last updated:** [December 16, 2022, 7:44am UTC](https://discuss.elastic.co/t/how-to-use-custom-id-for-inserting-document-using-java-sdk/321380 "2022-12-16T07:44:32Z")
Hi I want to use java sdk to insert document using ID .I will have custom my own IDs to insert docs. Thanks Suresh --- ## [Elastic Agent System integration not collecting Windows Event Log](https://discuss.elastic.co/t/elastic-agent-system-integration-not-collecting-windows-event-log/320344)
**Author:** [@username11](https://discuss.elastic.co/u/username11)\ **Replies:** 1\ **Last updated:** [December 16, 2022, 7:32am UTC](https://discuss.elastic.co/t/elastic-agent-system-integration-not-collecting-windows-event-log/320344 "2022-12-16T07:32:08Z")
Hi. I am testing Elastic Agent (v8.0.1) + Fleet (v.8.5.2), and I'm currently having a problem with collecting Windows Event Log on a test machine. I have set up the agent and it does connect to Fleet and Elasticsearch, a… --- ## [Log requests](https://discuss.elastic.co/t/log-requests/321216)
**Author:** [@lubosvr](https://discuss.elastic.co/u/lubosvr)\ **Replies:** 2\ **Last updated:** [December 16, 2022, 7:29am UTC](https://discuss.elastic.co/t/log-requests/321216 "2022-12-16T07:29:00Z")
Hi, I'm migrating from the High Level Rest Client to Java Client and have problem to log the requests that are sent to ES. I'm not using direct query, but somethink like this: final var countRequest = new CountRequest… --- ## [Does elastic support transfer old data to ecs format?](https://discuss.elastic.co/t/does-elastic-support-transfer-old-data-to-ecs-format/321378)
**Author:** [@alex\_su](https://discuss.elastic.co/u/alex_su)\ **Replies:** 0\ **Last updated:** [December 16, 2022, 7:06am UTC](https://discuss.elastic.co/t/does-elastic-support-transfer-old-data-to-ecs-format/321378 "2022-12-16T07:06:30Z")
Hi, I want to know if i have old data (ex: windows event log) as below , does elasitc has package support transfer this format to ecs ? thanks. "{ ""configSource"": ""XXX"", ""\_User"": """", ""@version"": ""1"", … --- ## [Update Fields Based On The Same Value Of The Other Field (Same Index)](https://discuss.elastic.co/t/update-fields-based-on-the-same-value-of-the-other-field-same-index/321376)
**Author:** [@baoletrg](https://discuss.elastic.co/u/baoletrg)\ **Replies:** 0\ **Last updated:** [December 16, 2022, 6:52am UTC](https://discuss.elastic.co/t/update-fields-based-on-the-same-value-of-the-other-field-same-index/321376 "2022-12-16T06:52:29Z")
Hi guys, Im new to ELK and have googled for a solution for this case. For example, in my index, one transaction has 3 records logged, they all has the same ofsID field. Then I want to update a field named durationTime in… --- ## [Logs in discover tab are in ascending order](https://discuss.elastic.co/t/logs-in-discover-tab-are-in-ascending-order/321252)
**Author:** [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\ **Replies:** 2\ **Last updated:** [December 16, 2022, 6:13am UTC](https://discuss.elastic.co/t/logs-in-discover-tab-are-in-ascending-order/321252 "2022-12-16T06:13:28Z")
Hi, As u can see in the image the logs are showing the timestamp of Dec 12 first. The latest one's are of Dec 15. elasticsearch\_syslog is the data view created for indices elasticsearch\_syslog%timestamp. What can i d… --- ## [Confused issue when I search indices using wildcard pattern](https://discuss.elastic.co/t/confused-issue-when-i-search-indices-using-wildcard-pattern/321369)
**Author:** [@Young\_Edmond](https://discuss.elastic.co/u/Young_Edmond)\ **Replies:** 0\ **Last updated:** [December 16, 2022, 6:01am UTC](https://discuss.elastic.co/t/confused-issue-when-i-search-indices-using-wildcard-pattern/321369 "2022-12-16T06:01:14Z")
Hi. I meet such interesting issue, I have created 3 indices named as below es-os-complex-neo-000001 es-os-complex-neo-000002 es-os-complex-neo-yudyang, when I try to get index using the specific name in dev tools, … --- ## [Can I add normalizer in runtime?](https://discuss.elastic.co/t/can-i-add-normalizer-in-runtime/321323)
**Author:** [@Michal\_Stefaniuk](https://discuss.elastic.co/u/Michal_Stefaniuk)\ **Replies:** 1\ **Last updated:** [December 16, 2022, 5:18am UTC](https://discuss.elastic.co/t/can-i-add-normalizer-in-runtime/321323 "2022-12-16T05:18:28Z")
Hey guys! I want to add a new field into my existing mapping (using dynamic templates as well). As far as I understand the best way to do it is to use update mapping API (Update mapping API | Elasticsearch Guide \[8.5\] |… --- ## [Can I use update statement in jdbc output plugin logstash](https://discuss.elastic.co/t/can-i-use-update-statement-in-jdbc-output-plugin-logstash/321358)
**Author:** [@Big\_Man](https://discuss.elastic.co/u/Big_Man)\ **Replies:** 1\ **Last updated:** [December 16, 2022, 4:21am UTC](https://discuss.elastic.co/t/can-i-use-update-statement-in-jdbc-output-plugin-logstash/321358 "2022-12-16T04:21:51Z")
I need to update specific row in my database. Can i use update statement? If yes how do that Or any other solution to achieve that. --- ## [Filebeat reading logs repeatedly](https://discuss.elastic.co/t/filebeat-reading-logs-repeatedly/321364)
**Author:** [@GodSlayer\_Inferno](https://discuss.elastic.co/u/GodSlayer_Inferno)\ **Replies:** 0\ **Last updated:** [December 16, 2022, 4:01am UTC](https://discuss.elastic.co/t/filebeat-reading-logs-repeatedly/321364 "2022-12-16T04:01:37Z")
I am deploying filebeat on a Linux server to manage logs on a webdrive mounted. Filebeat read the logs and send the content to logstash repeatedly, generating duplicated content. The frequency of each line appearing is a… --- ## [Elasticsearch-js ConnectionError: socket hang up](https://discuss.elastic.co/t/elasticsearch-js-connectionerror-socket-hang-up/321359)
**Author:** [@Jinhyuck\_Cha](https://discuss.elastic.co/u/Jinhyuck_Cha)\ **Replies:** 0\ **Last updated:** [December 16, 2022, 2:31am UTC](https://discuss.elastic.co/t/elasticsearch-js-connectionerror-socket-hang-up/321359 "2022-12-16T02:31:50Z")
hi I'm try to make github ci test flow in my project But there are a issue about ConnectionError: socket hang up I don't know what it is happen. Because this docker-file is well work in my local dev environment. How … --- ## [Packet Beats for DNS logs](https://discuss.elastic.co/t/packet-beats-for-dns-logs/321236)
**Author:** [@jrpayne30506](https://discuss.elastic.co/u/jrpayne30506)\ **Replies:** 5\ **Last updated:** [December 16, 2022, 12:32am UTC](https://discuss.elastic.co/t/packet-beats-for-dns-logs/321236 "2022-12-16T00:32:22Z")
I have set up a Graylog server in order to send my DNS logs to and installed Packetbeat on the Windows DNS server. In the instructions I found for configuring the yml file, it said to use either the username and password… --- ## [Index sizes increasing after upgrade from 7.10.2 -\> 7.17.0](https://discuss.elastic.co/t/index-sizes-increasing-after-upgrade-from-7-10-2-7-17-0/321352)
**Author:** [@zfisher](https://discuss.elastic.co/u/zfisher)\ **Replies:** 0\ **Last updated:** [December 15, 2022, 10:24pm UTC](https://discuss.elastic.co/t/index-sizes-increasing-after-upgrade-from-7-10-2-7-17-0/321352 "2022-12-15T22:24:29Z")
We recently upgraded our cluster from version 7.10.2 to version 7.17 and have noticed that, starting on the day of the upgrade, the total storage size for our indices has grown while our event count has stayed relatively… --- ## [Filebeat index ILM error](https://discuss.elastic.co/t/filebeat-index-ilm-error/321320)
**Author:** [@Shalinicts](https://discuss.elastic.co/u/Shalinicts)\ **Replies:** 0\ **Last updated:** [December 15, 2022, 3:01pm UTC](https://discuss.elastic.co/t/filebeat-index-ilm-error/321320 "2022-12-15T15:01:12Z")
Blockquote Hi Team , We are getting below error in elasticsearch ILM error : Blockquote illegal\_argument\_exception: index.lifecycle.rollover\_alias \[filebeat-7.17.1\] does not point to index \[filebeat-7.17.1-o365-… --- ## [Elastcisearch](https://discuss.elastic.co/t/elastcisearch/321319)
**Author:** [@Sarthak\_Agarwal](https://discuss.elastic.co/u/Sarthak_Agarwal)\ **Replies:** 0\ **Last updated:** [December 15, 2022, 2:46pm UTC](https://discuss.elastic.co/t/elastcisearch/321319 "2022-12-15T14:46:51Z")
I am using the last Java Client API for Elasticsearch 7.17.5. I have a boolean query builder and I want to add conditions before checking if a must clause is already there or not. But the issue is that I can build the q… --- ## [TCP-input Receiving an encoding error](https://discuss.elastic.co/t/tcp-input-receiving-an-encoding-error/321344)
**Author:** [@elrozario](https://discuss.elastic.co/u/elrozario)\ **Replies:** 1\ **Last updated:** [December 15, 2022, 8:49pm UTC](https://discuss.elastic.co/t/tcp-input-receiving-an-encoding-error/321344 "2022-12-15T20:49:24Z")
Hello, I have a TCP input and getting data with some special characters. How do I resolve this issue? Here is my config input { tcp { host =\> "0.0.0.0" port =\> "0000" mode =\> "server" … --- ## [Mapping conflict between object, text, & keyword](https://discuss.elastic.co/t/mapping-conflict-between-object-text-keyword/321343)
**Author:** [@datdoo](https://discuss.elastic.co/u/datdoo)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 8:39pm UTC](https://discuss.elastic.co/t/mapping-conflict-between-object-text-keyword/321343 "2022-12-15T20:39:59Z")
I have this mapping currently "response": { "properties": { "body": { "properties": { "id": { "type": "long" }, "json… --- ## [Not getting output with CEF codec](https://discuss.elastic.co/t/not-getting-output-with-cef-codec/321341)
**Author:** [@j00bar](https://discuss.elastic.co/u/j00bar)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 8:18pm UTC](https://discuss.elastic.co/t/not-getting-output-with-cef-codec/321341 "2022-12-15T20:18:56Z")
I've got a working pipeline in Logstash where non-ECS JSON (I have ecs\_compatibility disabled in my pipeline) is coming in from SQS, getting transformed using mutate filters, and then output using stdout and the rubydebu… --- ## [Unable to use the replace filter on filebeat.yml](https://discuss.elastic.co/t/unable-to-use-the-replace-filter-on-filebeat-yml/321305)
**Author:** [@maviles](https://discuss.elastic.co/u/maviles)\ **Replies:** 4\ **Last updated:** [December 15, 2022, 5:44pm UTC](https://discuss.elastic.co/t/unable-to-use-the-replace-filter-on-filebeat-yml/321305 "2022-12-15T17:44:26Z")
I cannot replace the value of a field using the "replace" processor on filebeat.yml. The service is running but the field returns a null value. See the configuration below: replace: fields: - field: "decoded.cef.sev… --- ## [.net client application log not creating index in elasticsearch](https://discuss.elastic.co/t/net-client-application-log-not-creating-index-in-elasticsearch/321259)
**Author:** [@rajvel](https://discuss.elastic.co/u/rajvel)\ **Replies:** 4\ **Last updated:** [December 15, 2022, 4:41pm UTC](https://discuss.elastic.co/t/net-client-application-log-not-creating-index-in-elasticsearch/321259 "2022-12-15T16:41:38Z")
Hello Team, we have .net application we used .net client elasticsearch to share the log to new index. Recently we haven't received any new index created by .net application. there is no way to find the whether the inde… --- ## [Exclude file types/extensions with Agent Policy](https://discuss.elastic.co/t/exclude-file-types-extensions-with-agent-policy/321326)
**Author:** [@cmminear](https://discuss.elastic.co/u/cmminear)\ **Replies:** 0\ **Last updated:** [December 15, 2022, 3:56pm UTC](https://discuss.elastic.co/t/exclude-file-types-extensions-with-agent-policy/321326 "2022-12-15T15:56:31Z")
I am trying to recusively include a bunch of folders for logs but exclude a few extensions/file types and missing any documentation specific for the agents to do this. I want to get all logs in all folder from /cgilo… --- ## [Migrate from NEST 6.6 to ElasticSearch client 8](https://discuss.elastic.co/t/migrate-from-nest-6-6-to-elasticsearch-client-8/321288)
**Author:** [@apokryfos](https://discuss.elastic.co/u/apokryfos)\ **Replies:** 1\ **Last updated:** [December 15, 2022, 3:15pm UTC](https://discuss.elastic.co/t/migrate-from-nest-6-6-to-elasticsearch-client-8/321288 "2022-12-15T15:15:36Z")
I've recently upgraded my Elasticsearch server from 6.6 to 8.5 (quite a jump I know but it was long overdue). The main process to create/updated indexes is written in C# and was previously using NEST. I originally asked… --- ## [Heartbeat issue : Bad Gateway: couldn't connect to any of the configured Elasticsearch hosts](https://discuss.elastic.co/t/heartbeat-issue-bad-gateway-couldnt-connect-to-any-of-the-configured-elasticsearch-hosts/321270)
**Author:** [@aji.shinde7](https://discuss.elastic.co/u/aji.shinde7)\ **Replies:** 3\ **Last updated:** [December 15, 2022, 3:14pm UTC](https://discuss.elastic.co/t/heartbeat-issue-bad-gateway-couldnt-connect-to-any-of-the-configured-elasticsearch-hosts/321270 "2022-12-15T15:14:28Z")
Hello Experts, I am having issue to connect Heartbeat to Elasticsearch instance (Cloud). Background: I have a Linux server, Heartbeat Version 7.5.0 is running on it and sending Data to Elasticsearch instance (Cloud). … --- ## [High cpu usage after ES update to 7.17.7](https://discuss.elastic.co/t/high-cpu-usage-after-es-update-to-7-17-7/321143)
**Author:** [@anon90868141](https://discuss.elastic.co/u/anon90868141)\ **Replies:** 14\ **Last updated:** [December 15, 2022, 2:40pm UTC](https://discuss.elastic.co/t/high-cpu-usage-after-es-update-to-7-17-7/321143 "2022-12-15T14:40:59Z")
Hello, after an update from 7.16.2 to 7.17.7, we're experiencing about double the CPU usage without changing anything else. This happens during all time and the usage basically never dropped below the new baseline. When… --- ## [Learning to Rank not working for nested field type](https://discuss.elastic.co/t/learning-to-rank-not-working-for-nested-field-type/321182)
**Author:** [@varunbharti48](https://discuss.elastic.co/u/varunbharti48)\ **Replies:** 1\ **Last updated:** [December 15, 2022, 2:34pm UTC](https://discuss.elastic.co/t/learning-to-rank-not-working-for-nested-field-type/321182 "2022-12-15T14:34:29Z")
Hi, I am implementing learning to rank on a nested field type. It is working completely fine for object field type(non-nested). But in case of nested field we are using score\_mode : "sum" to cumulate the score of child … --- ## [2 aliases to 1 index with rollover](https://discuss.elastic.co/t/2-aliases-to-1-index-with-rollover/321313)
**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\ **Replies:** 3\ **Last updated:** [December 15, 2022, 2:30pm UTC](https://discuss.elastic.co/t/2-aliases-to-1-index-with-rollover/321313 "2022-12-15T14:30:23Z")
Hi, I want to define two aliases to index with rollover. I have set the following: PUT \_ilm/policy/policy1 { "policy": { "phases": { "hot": { "actions": { "rollover": { "max\_… --- ## [Logstash convert existing timestamp format in message](https://discuss.elastic.co/t/logstash-convert-existing-timestamp-format-in-message/321309)
**Author:** [@Groove](https://discuss.elastic.co/u/Groove)\ **Replies:** 0\ **Last updated:** [December 15, 2022, 1:10pm UTC](https://discuss.elastic.co/t/logstash-convert-existing-timestamp-format-in-message/321309 "2022-12-15T13:10:09Z")
Hello, I have 2 different application logs. OUTPUT: \<135\>1 2022-12-12T16:28:02Z HOSTNAME EvntSLog - - - Le service Service de licences de client (ClipSVC) est entré dans l’état : arrêté. \<134\>Dec 12 16:28:02 HOSTNAME… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=696) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=698)