# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=701 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 702 --- ## [Child Documents performance](https://discuss.elastic.co/t/child-documents-performance/321120)
**Author:** [@Emanuel\_Zienecker](https://discuss.elastic.co/u/Emanuel_Zienecker)\ **Replies:** 0\ **Last updated:** [December 13, 2022, 11:43am UTC](https://discuss.elastic.co/t/child-documents-performance/321120 "2022-12-13T11:43:26Z")
Hello, I am planning to change the model from nested of parent-child. The following model: Questions -\> Answer. Currently these were all stored nested, now just as parent-child. My question now is this: What makes more… --- ## [Filebeat internal logs are getting repeated](https://discuss.elastic.co/t/filebeat-internal-logs-are-getting-repeated/321115)
**Author:** [@Nikhitha\_Karennagari](https://discuss.elastic.co/u/Nikhitha_Karennagari)\ **Replies:** 0\ **Last updated:** [December 13, 2022, 11:25am UTC](https://discuss.elastic.co/t/filebeat-internal-logs-are-getting-repeated/321115 "2022-12-13T11:25:48Z")
Filebeat internal logs are repeating which is unwanted. 2022-12-13T11:03:51.516Z INFO log/input.go:157 Configured paths: \[/var/log/pods/7d447f4fea175a79a4bdac6296034497a897f2b94391cc73f7dadc4b5b806624/\*-json.log /var/lo… --- ## [Source.geo.country\_name field is missing](https://discuss.elastic.co/t/source-geo-country-name-field-is-missing/321113)
**Author:** [@udaypatel07](https://discuss.elastic.co/u/udaypatel07)\ **Replies:** 0\ **Last updated:** [December 13, 2022, 11:18am UTC](https://discuss.elastic.co/t/source-geo-country-name-field-is-missing/321113 "2022-12-13T11:18:20Z")
Hi, I have integrated Sonicwall Firewall with ELK for the last 6 months, and I'm receiving logs correctly but suddenly I'm facing a problem in one of the Sonicwall module fields which are the source.geo.country\_name & de… --- ## [Filebeat sends no logs to Kafka](https://discuss.elastic.co/t/filebeat-sends-no-logs-to-kafka/320968)
**Author:** [@nota](https://discuss.elastic.co/u/nota)\ **Replies:** 2\ **Last updated:** [December 13, 2022, 10:41am UTC](https://discuss.elastic.co/t/filebeat-sends-no-logs-to-kafka/320968 "2022-12-13T10:41:44Z")
Running Filebeat 8.5.3 on Ubuntu 20.04. I am trying to send some logs to Kafka using FIlebeat. This is my filebeat.yml filebeat.inputs: - type: filestream id: jenkinsfilestream enabled: true paths: - "/var/log… --- ## [How to update the maapings of a certain index in Elastic Search 8.4.1. using Python?](https://discuss.elastic.co/t/how-to-update-the-maapings-of-a-certain-index-in-elastic-search-8-4-1-using-python/321107)
**Author:** [@Shashank02](https://discuss.elastic.co/u/Shashank02)\ **Replies:** 0\ **Last updated:** [December 13, 2022, 10:13am UTC](https://discuss.elastic.co/t/how-to-update-the-maapings-of-a-certain-index-in-elastic-search-8-4-1-using-python/321107 "2022-12-13T10:13:13Z")
So, I'm pushing CSV Data into Elastic Search using python. I'm able to push the data and an index is getting created but the mappings of the index contain only text and keyword. Even if there is a field with the type "lo… --- ## [Logstash JDBC plugin maintain state in database instead of file](https://discuss.elastic.co/t/logstash-jdbc-plugin-maintain-state-in-database-instead-of-file/321106)
**Author:** [@Thijsvdp](https://discuss.elastic.co/u/Thijsvdp)\ **Replies:** 0\ **Last updated:** [December 13, 2022, 9:50am UTC](https://discuss.elastic.co/t/logstash-jdbc-plugin-maintain-state-in-database-instead-of-file/321106 "2022-12-13T09:50:40Z")
Hi all, I am wondering if it would be possible to maintain the sql\_last\_value in a database instead of a .yml file? This would be beneficial in my case, because it is easier accessible for modification and initializatio… --- ## [Filebeat duplicate logs](https://discuss.elastic.co/t/filebeat-duplicate-logs/321032)
**Author:** [@m3bgwad](https://discuss.elastic.co/u/m3bgwad)\ **Replies:** 7\ **Last updated:** [December 13, 2022, 8:46am UTC](https://discuss.elastic.co/t/filebeat-duplicate-logs/321032 "2022-12-13T08:46:57Z")
Hello everyone, for prevent the duplication data that can be received from Filebeat I used this Logstash filtration fingerprint { source =\> "message" target =\> "\[@metadata\]\[fingerprint\]" method =\> "SHA1" key =\> "ke… --- ## [Mail command failed: 530 5.7.57 Client not authenticated to send mail. \[CH2PR15CA0025.namprd15.prod.outlook.com\]](https://discuss.elastic.co/t/mail-command-failed-530-5-7-57-client-not-authenticated-to-send-mail-ch2pr15ca0025-namprd15-prod-outlook-com/318938)
**Author:** [@breakingcode](https://discuss.elastic.co/u/breakingcode)\ **Replies:** 0\ **Last updated:** [November 15, 2022, 8:36am UTC](https://discuss.elastic.co/t/mail-command-failed-530-5-7-57-client-not-authenticated-to-send-mail-ch2pr15ca0025-namprd15-prod-outlook-com/318938 "2022-11-15T08:36:42Z")
Hii, I am trying to setup alerting in Kibana. I started elastic cloud instance with GCP as provider, with version 8.4.3 of stack. When I run test connector configuration I am getting below error I am doing this setu… --- ## [Logstash escaping characters, want to disable](https://discuss.elastic.co/t/logstash-escaping-characters-want-to-disable/318984)
**Author:** [@Johanna12221](https://discuss.elastic.co/u/Johanna12221)\ **Replies:** 2\ **Last updated:** [December 13, 2022, 7:51am UTC](https://discuss.elastic.co/t/logstash-escaping-characters-want-to-disable/318984 "2022-12-13T07:51:32Z")
Hi! I'm having a problem with how Logstash with JDBC input escapes characters. When I run the SQL query in SSMS I get the result fine: "\\publicerat\\IN0022.pdf" The JDBC input looks like this: input { jdbc { … --- ## [Installation on ubantu](https://discuss.elastic.co/t/installation-on-ubantu/316961)
**Author:** [@smitak](https://discuss.elastic.co/u/smitak)\ **Replies:** 15\ **Last updated:** [December 13, 2022, 7:30am UTC](https://discuss.elastic.co/t/installation-on-ubantu/316961 "2022-12-13T07:30:02Z")
Hello Sir, I have done the search functionality with fscrawler on local server. It is working good. Now I am uploading on ubantu server. Elastic search is active. But for fscralwer getting error for file content. Elast… --- ## [Kibana status yellow and taskmanager is unhealth](https://discuss.elastic.co/t/kibana-status-yellow-and-taskmanager-is-unhealth/321092)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 2\ **Last updated:** [December 13, 2022, 7:16am UTC](https://discuss.elastic.co/t/kibana-status-yellow-and-taskmanager-is-unhealth/321092 "2022-12-13T07:16:30Z")
Hi all I have 1 kibana instance running for a elastic cluster. For sometime i have notice that my kibana always from green to yellow in the monitor tab so when i check the status of kibana it said that the taskManager … --- ## [Unable to retrieve version information from elasticsearch nodes](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes/321072)
**Author:** [@Eduard\_Abril](https://discuss.elastic.co/u/Eduard_Abril)\ **Replies:** 1\ **Last updated:** [December 13, 2022, 5:43am UTC](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes/321072 "2022-12-13T05:43:49Z")
Hi guys, I'm using elasticsearch and kibana 7.17.6 and currently I'm facing some problems with the security settings. I'm trying to setup basic security for a 3 nodes elasticsearch cluster and 1 node kibana using certi… --- ## [How to split a message from rabbit?](https://discuss.elastic.co/t/how-to-split-a-message-from-rabbit/321067)
**Author:** [@TheZadok42](https://discuss.elastic.co/u/TheZadok42)\ **Replies:** 4\ **Last updated:** [December 13, 2022, 5:31am UTC](https://discuss.elastic.co/t/how-to-split-a-message-from-rabbit/321067 "2022-12-13T05:31:56Z")
Hi! I am trying to split this message: {"test": "Test"} {"test": "Test2"} into two messages using this simple config: input { rabbitmq { … --- ## [Track and show transactions progress based on codes](https://discuss.elastic.co/t/track-and-show-transactions-progress-based-on-codes/318867)
**Author:** [@Murali\_Y](https://discuss.elastic.co/u/Murali_Y)\ **Replies:** 3\ **Last updated:** [November 15, 2022, 3:26am UTC](https://discuss.elastic.co/t/track-and-show-transactions-progress-based-on-codes/318867 "2022-11-15T03:26:28Z")
Hello, We are writing our business flow related transactions start and end state using different state codes i.e. When we pick the transaction it will logged with code 10001 (in progress) and end of it will be logged wi… --- ## [Kubernetes Elasticsearch 8.5.3 Statefulset (not ECK) set up username / password](https://discuss.elastic.co/t/kubernetes-elasticsearch-8-5-3-statefulset-not-eck-set-up-username-password/321081)
**Author:** [@khteh](https://discuss.elastic.co/u/khteh)\ **Replies:** 0\ **Last updated:** [December 13, 2022, 2:54am UTC](https://discuss.elastic.co/t/kubernetes-elasticsearch-8-5-3-statefulset-not-eck-set-up-username-password/321081 "2022-12-13T02:54:22Z")
How to automatically setup the password of the default user elastic and add other username/password for Elasticsearch 8.5.3 running on kubernetes cluster with manifests? I am not using ECK. Setting environment variable E… --- ## [Logstash GeoIP Database Manager: PKIX path building failed, \_geoip\_expired\_database tag](https://discuss.elastic.co/t/logstash-geoip-database-manager-pkix-path-building-failed-geoip-expired-database-tag/321073)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 2\ **Last updated:** [December 12, 2022, 11:31pm UTC](https://discuss.elastic.co/t/logstash-geoip-database-manager-pkix-path-building-failed-geoip-expired-database-tag/321073 "2022-12-12T23:31:24Z")
Hello, I started to get this error on a couple of Logstash nodes. \[2022-12-12T20:10:23,983\]\[ERROR\]\[logstash.filters.geoip.databasemanager\] PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderExc… --- ## [Kibana Dashboard syslog ECS](https://discuss.elastic.co/t/kibana-dashboard-syslog-ecs/318911)
**Author:** [@sharbich](https://discuss.elastic.co/u/sharbich)\ **Replies:** 0\ **Last updated:** [November 14, 2022, 11:54pm UTC](https://discuss.elastic.co/t/kibana-dashboard-syslog-ecs/318911 "2022-11-14T23:54:59Z")
Hello, I get the following message in my Kibana Dashboard. "1 of 2 shards failed. The data you are seeing might be incomplete or wrong." The message disappears after 30 seconds and only comes back when i refresh the D… --- ## [Read from Logstash file and format](https://discuss.elastic.co/t/read-from-logstash-file-and-format/320970)
**Author:** [@mail2shanth](https://discuss.elastic.co/u/mail2shanth)\ **Replies:** 1\ **Last updated:** [December 12, 2022, 6:22pm UTC](https://discuss.elastic.co/t/read-from-logstash-file-and-format/320970 "2022-12-12T18:22:35Z")
Hi, I am new to the Logstash. I've below log that I want to read in from a file, it is basically from another logstash server. Below is just one row from the file, there are millions of such rows. {"@timestamp":"2022-… --- ## [Disable auto refresh for Monitoring dashboards](https://discuss.elastic.co/t/disable-auto-refresh-for-monitoring-dashboards/320965)
**Author:** [@Animesh\_Agarwal](https://discuss.elastic.co/u/Animesh_Agarwal)\ **Replies:** 1\ **Last updated:** [December 12, 2022, 6:08pm UTC](https://discuss.elastic.co/t/disable-auto-refresh-for-monitoring-dashboards/320965 "2022-12-12T18:08:38Z")
Hi By default the refresh interval is 10s for monitoring dashboards in Kibana. Even though I can disable auto refresh, but if we load the page again, it gets reverted to 10s. How can we set the auto refresh to off per… --- ## [Enrollment Token deletion](https://discuss.elastic.co/t/enrollment-token-deletion/320335)
**Author:** [@FabianEidner](https://discuss.elastic.co/u/FabianEidner)\ **Replies:** 10\ **Last updated:** [December 12, 2022, 5:57pm UTC](https://discuss.elastic.co/t/enrollment-token-deletion/320335 "2022-12-12T17:57:24Z")
Hello, im struggle to delete old enrollment tokens under: Kibana -\> Fleet -\> Enrollment Tokens Neither in the ui nor via the api i'm able to delete them. In the ui they just are flagged as inactive and via the api "ap… --- ## [Can replicas serve kNN search requests?](https://discuss.elastic.co/t/can-replicas-serve-knn-search-requests/321059)
**Author:** [@robertdebug](https://discuss.elastic.co/u/robertdebug)\ **Replies:** 1\ **Last updated:** [December 12, 2022, 5:37pm UTC](https://discuss.elastic.co/t/can-replicas-serve-knn-search-requests/321059 "2022-12-12T17:37:32Z")
Hello, I have a question about kNN search and index replicas. According to the documentation, replicas can increase capacity to serve read requests like searching or retrieving a document. Does this also applies for ap… --- ## [Automating Connectors via Saved Object API](https://discuss.elastic.co/t/automating-connectors-via-saved-object-api/320896)
**Author:** [@Hayden\_WB](https://discuss.elastic.co/u/Hayden_WB)\ **Replies:** 2\ **Last updated:** [December 12, 2022, 5:32pm UTC](https://discuss.elastic.co/t/automating-connectors-via-saved-object-api/320896 "2022-12-12T17:32:10Z")
Hi folks! I'm attempting to automate Dashboards and Alerts for a team within my company. This involves creating a MS Teams Connector. I have written a bash script that posts the Connector NDJSON to the Saved Objects end… --- ## [Manually backup data from frozer tier](https://discuss.elastic.co/t/manually-backup-data-from-frozer-tier/320730)
**Author:** [@dimitris\_sb](https://discuss.elastic.co/u/dimitris_sb)\ **Replies:** 2\ **Last updated:** [December 12, 2022, 5:06pm UTC](https://discuss.elastic.co/t/manually-backup-data-from-frozer-tier/320730 "2022-12-12T17:06:44Z")
Hi All, What would be the correct way to make an independent backup (snapshot) of data in the frozen tier? If I take a snapshot of these indices, will the backup be usable as indices from hot/warm/cold tier or it will a… --- ## [Some stack management tabs missing in kibana after upgrading from 7.6.2 to 7.17.3](https://discuss.elastic.co/t/some-stack-management-tabs-missing-in-kibana-after-upgrading-from-7-6-2-to-7-17-3/316928)
**Author:** [@danksim](https://discuss.elastic.co/u/danksim)\ **Replies:** 0\ **Last updated:** [October 18, 2022, 6:16pm UTC](https://discuss.elastic.co/t/some-stack-management-tabs-missing-in-kibana-after-upgrading-from-7-6-2-to-7-17-3/316928 "2022-10-18T18:16:15Z")
some stack management tabs went missing in elasticsearch/kibana after upgrading from 7.6.2 to 7.17.3 missing ones like index management policies, security, index managment, etc. running the basic version and not the … --- ## [Using Grok filter](https://discuss.elastic.co/t/using-grok-filter/321051)
**Author:** [@Groove](https://discuss.elastic.co/u/Groove)\ **Replies:** 0\ **Last updated:** [December 12, 2022, 3:31pm UTC](https://discuss.elastic.co/t/using-grok-filter/321051 "2022-12-12T15:31:40Z")
Hello, I am pretty new to ELK stack. Currently I am trying to parse my application log using grok pattern. But since my logs are not structured I may have to use grok conditions, because in output I have windows event an… --- ## [How to send number of shard , activeshard, reallocationg shard every day via watcher](https://discuss.elastic.co/t/how-to-send-number-of-shard-activeshard-reallocationg-shard-every-day-via-watcher/318180)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 2\ **Last updated:** [December 12, 2022, 11:04am UTC](https://discuss.elastic.co/t/how-to-send-number-of-shard-activeshard-reallocationg-shard-every-day-via-watcher/318180 "2022-12-12T11:04:17Z")
Hello team, I need to send email every day with below status. can i know how i can achieve this using watcher. Kibana Health check for \*\*Todays Date\*\* is \*\*Green / Red /Yellow\*\*. PFA for detail log ingestion and clust… --- ## [Add multiple https API in watcher](https://discuss.elastic.co/t/add-multiple-https-api-in-watcher/321033)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 2\ **Last updated:** [December 12, 2022, 3:03pm UTC](https://discuss.elastic.co/t/add-multiple-https-api-in-watcher/321033 "2022-12-12T15:03:43Z")
Hi team, I am able to send cluster health data using GET \_cluster/health using below input and condition. Now in input section I want to use other two more APIs: GET /\_cat/allocation?v=true&s=node GET \_cat/nodes?v=tru… --- ## [Using transform with enrich pipeline to enrich ip with latest vulnerabilities](https://discuss.elastic.co/t/using-transform-with-enrich-pipeline-to-enrich-ip-with-latest-vulnerabilities/320553)
**Author:** [@siginigin](https://discuss.elastic.co/u/siginigin)\ **Replies:** 6\ **Last updated:** [December 12, 2022, 2:51pm UTC](https://discuss.elastic.co/t/using-transform-with-enrich-pipeline-to-enrich-ip-with-latest-vulnerabilities/320553 "2022-12-12T14:51:05Z")
Hi, I want to enrich incoming event that contains local source.ip/destination.ip with vulnerability field with this logic: match source.ip with server.ip, get highest vulnerability.severity\_num from latest vulnerabilit… --- ## [Ctx.payload variable to be used to send nodes and allocation API details](https://discuss.elastic.co/t/ctx-payload-variable-to-be-used-to-send-nodes-and-allocation-api-details/321041)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 0\ **Last updated:** [December 12, 2022, 2:29pm UTC](https://discuss.elastic.co/t/ctx-payload-variable-to-be-used-to-send-nodes-and-allocation-api-details/321041 "2022-12-12T14:29:47Z")
Hello team, I need to send output of below two API in one email . Unable to find which variable used to send below data for below API. Can you please help me with this. GET \_cat/nodes?v=true&s=name : ip he… --- ## [Audit log time based deletion policy not working](https://discuss.elastic.co/t/audit-log-time-based-deletion-policy-not-working/321022)
**Author:** [@irivas95](https://discuss.elastic.co/u/irivas95)\ **Replies:** 3\ **Last updated:** [December 12, 2022, 12:59pm UTC](https://discuss.elastic.co/t/audit-log-time-based-deletion-policy-not-working/321022 "2022-12-12T12:59:00Z")
Hi, I have the following policy for deleting audit logs older than 7 days in my log4j2.properties config file: appender.audit\_rolling.type = RollingFile appender.audit\_rolling.name = audit\_rolling appender.audit\_rollin… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=700) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=702)