# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=703 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 704 --- ## [Service fails to start, I don't know why](https://discuss.elastic.co/t/service-fails-to-start-i-dont-know-why/320837)
**Author:** [@ant2ne](https://discuss.elastic.co/u/ant2ne)\ **Replies:** 3\ **Last updated:** [December 11, 2022, 11:48pm UTC](https://discuss.elastic.co/t/service-fails-to-start-i-dont-know-why/320837 "2022-12-11T23:48:01Z")
When security is disabled, they are talking via tcp (10. is the remote host sending rsyslog to elk and the 3. is the elk server)..... 21:50:01.334042 tun0 Out IP 10.226.28.173.53286 \> 3.133.215.55.5044: Flags \[S\], seq … --- ## [Get aggregation labels from another index](https://discuss.elastic.co/t/get-aggregation-labels-from-another-index/320939)
**Author:** [@masoud\_darvishi](https://discuss.elastic.co/u/masoud_darvishi)\ **Replies:** 1\ **Last updated:** [December 11, 2022, 9:51pm UTC](https://discuss.elastic.co/t/get-aggregation-labels-from-another-index/320939 "2022-12-11T21:51:44Z")
hi i have two indexes with below fields roles { id: 1, name: "admin", }, { id: 2, name: "user" }, users { id: 1, name: "a", roles\_id: \[1,2\], }, { id: 2, name: "b", roles\_id: … --- ## [Metricbeat cannot use fields in template name](https://discuss.elastic.co/t/metricbeat-cannot-use-fields-in-template-name/320907)
**Author:** [@errupeshmca](https://discuss.elastic.co/u/errupeshmca)\ **Replies:** 1\ **Last updated:** [December 11, 2022, 8:53pm UTC](https://discuss.elastic.co/t/metricbeat-cannot-use-fields-in-template-name/320907 "2022-12-11T20:53:06Z")
Elasticsearch version 8.5.2 metricbeat version 8.5.2 I am getting this issue when trying to customize template pattern in metricbeat below is my configuration, I want to use data stream and but not the default one, the … --- ## [Filebeat |Microsoft Defender ATP module pull same events multiple times](https://discuss.elastic.co/t/filebeat-microsoft-defender-atp-module-pull-same-events-multiple-times/320980)
**Author:** [@OZGURCE](https://discuss.elastic.co/u/OZGURCE)\ **Replies:** 0\ **Last updated:** [December 11, 2022, 8:56pm UTC](https://discuss.elastic.co/t/filebeat-microsoft-defender-atp-module-pull-same-events-multiple-times/320980 "2022-12-11T20:56:03Z")
I have configured FileBeat Microsoft Defender ATP Module but FileBeat pull same event 20 times. Microsoft module interval time is, var.interval: 5m I couldn't find any variable for this options. Could someone please … --- ## [Elastic Deployment on minukube cluster Failing](https://discuss.elastic.co/t/elastic-deployment-on-minukube-cluster-failing/320928)
**Author:** [@akansha.agarwal1](https://discuss.elastic.co/u/akansha.agarwal1)\ **Replies:** 1\ **Last updated:** [December 11, 2022, 8:50pm UTC](https://discuss.elastic.co/t/elastic-deployment-on-minukube-cluster-failing/320928 "2022-12-11T20:50:55Z")
Hi, I am trying to deploy Elastic 8.5.2 on minukube cluster using: Helm, Statefulset & simple Elasticsearch cluster specification. But all deployments are failing with error: CrashLoopBackOff Although, deployment for… --- ## [CircuitBreakingException: \[parent\] Data too large](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large/320152)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 6\ **Last updated:** [December 11, 2022, 8:39pm UTC](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large/320152 "2022-12-11T20:39:52Z")
Hi All, Today morning, I got an error while checking kibana discover stating that its unable to fetch the result. Then I checked Stack Monitoring and found the below error -- On further investigation, I found that ou… --- ## [Output isolator pattern is not sending logs to Elastic search, when my syslog server is down](https://discuss.elastic.co/t/output-isolator-pattern-is-not-sending-logs-to-elastic-search-when-my-syslog-server-is-down/320977)
**Author:** [@rravitech](https://discuss.elastic.co/u/rravitech)\ **Replies:** 0\ **Last updated:** [December 11, 2022, 5:51pm UTC](https://discuss.elastic.co/t/output-isolator-pattern-is-not-sending-logs-to-elastic-search-when-my-syslog-server-is-down/320977 "2022-12-11T17:51:39Z")
Here I am trying to isolate the pipelines using output isolator pattern, and when I have rsyslog server and elastic 2 configured under one pipeline. And I have another pipeline which has only elastic 1 alone. When my … --- ## [Timeout error when downloading the artifacts in elastic-agent from kibana UI](https://discuss.elastic.co/t/timeout-error-when-downloading-the-artifacts-in-elastic-agent-from-kibana-ui/320266)
**Author:** [@perea870724](https://discuss.elastic.co/u/perea870724)\ **Replies:** 2\ **Last updated:** [December 11, 2022, 4:54pm UTC](https://discuss.elastic.co/t/timeout-error-when-downloading-the-artifacts-in-elastic-agent-from-kibana-ui/320266 "2022-12-11T16:54:57Z")
Good morning, I am trying to update the elastic-agent from the kibana UI interface, but it is giving me a timeout error when downloading the artifacts, how can I increase the package download timeout? --- ## [Incorrect HTTP method for uri](https://discuss.elastic.co/t/incorrect-http-method-for-uri/320931)
**Author:** [@someusername](https://discuss.elastic.co/u/someusername)\ **Replies:** 5\ **Last updated:** [December 11, 2022, 4:07pm UTC](https://discuss.elastic.co/t/incorrect-http-method-for-uri/320931 "2022-12-11T16:07:53Z")
Hello, I want to connect using the python client but I can't figure out what's wrong. from elasticsearch import Elasticsearch endpoint = 'https://foo.gcp.cloud.es.io:443/search-addresses/\_doc?pipeline=ent-search-gener… --- ## [How to avoid loading all articles from the text](https://discuss.elastic.co/t/how-to-avoid-loading-all-articles-from-the-text/320903)
**Author:** [@ryendluri](https://discuss.elastic.co/u/ryendluri)\ **Replies:** 2\ **Last updated:** [December 11, 2022, 4:19pm UTC](https://discuss.elastic.co/t/how-to-avoid-loading-all-articles-from-the-text/320903 "2022-12-11T16:19:51Z")
how to avoid loading all English language articles such as "And", "Or", "The", "A", "I", "it", "For", etc. so I do not get unnecessary rows during search / retrieval? thanks --- ## [Mixed License Feature Availability](https://discuss.elastic.co/t/mixed-license-feature-availability/318750)
**Author:** [@ss\_22](https://discuss.elastic.co/u/ss_22)\ **Replies:** 1\ **Last updated:** [November 13, 2022, 11:44pm UTC](https://discuss.elastic.co/t/mixed-license-feature-availability/318750 "2022-11-13T23:44:06Z")
Hello, We currently have 3 clusters in our environments using the "Basic" tier/license. One cluster is the primary interface point for users which leverages the other two clusters as a federated datastore through the cr… --- ## [Statically match multiple values depending on matchin regex](https://discuss.elastic.co/t/statically-match-multiple-values-depending-on-matchin-regex/320972)
**Author:** [@pondo\_m](https://discuss.elastic.co/u/pondo_m)\ **Replies:** 0\ **Last updated:** [December 11, 2022, 2:12pm UTC](https://discuss.elastic.co/t/statically-match-multiple-values-depending-on-matchin-regex/320972 "2022-12-11T14:12:50Z")
I want to set a statically defined value depending on the matching regex. Currently Im using the translate filter plugin with a dictionary of 400 entries to set the value depending on the matching regex. Is it possible… --- ## [Elasticsearch 7.10.2](https://discuss.elastic.co/t/elasticsearch-7-10-2/320960)
**Author:** [@faen](https://discuss.elastic.co/u/faen)\ **Replies:** 4\ **Last updated:** [December 11, 2022, 2:00pm UTC](https://discuss.elastic.co/t/elasticsearch-7-10-2/320960 "2022-12-11T14:00:49Z")
I am trying to install Elasticsearch 7.10.2 though the Elastic repository. I'm getting an error: "The repository ‘https://artifacts.elastic.co/packages/oss-7.10.2/apt stable Release’ does not have a Release file.” Has… --- ## [Vega chart Only 11 data are visible](https://discuss.elastic.co/t/vega-chart-only-11-data-are-visible/320949)
**Author:** [@Cusis\_Eel](https://discuss.elastic.co/u/Cusis_Eel)\ **Replies:** 1\ **Last updated:** [December 10, 2022, 11:53pm UTC](https://discuss.elastic.co/t/vega-chart-only-11-data-are-visible/320949 "2022-12-10T23:53:57Z")
There are dozens of data, but only 11 are visible. { $schema: https://vega.github.io/schema/vega-lite/v4.json data: { url: { %context%: true %timefield%: input\_date index: veg… --- ## [Understanding what value will be used for sorting by nested field if field has a several nested values](https://discuss.elastic.co/t/understanding-what-value-will-be-used-for-sorting-by-nested-field-if-field-has-a-several-nested-values/320956)
**Author:** [@Yuri\_Khmelevsky](https://discuss.elastic.co/u/Yuri_Khmelevsky)\ **Replies:** 0\ **Last updated:** [December 10, 2022, 10:51pm UTC](https://discuss.elastic.co/t/understanding-what-value-will-be-used-for-sorting-by-nested-field-if-field-has-a-several-nested-values/320956 "2022-12-10T22:51:17Z")
I have the following mapping { "mappings": { "properties": { "rank-by-views": { "type": "nested", "properties": { "id": {"type": "keyword"}, "value": {"type": "keyword"} … --- ## [High load issues on node (related to shard allocation)](https://discuss.elastic.co/t/high-load-issues-on-node-related-to-shard-allocation/320922)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 1\ **Last updated:** [December 10, 2022, 10:01pm UTC](https://discuss.elastic.co/t/high-load-issues-on-node-related-to-shard-allocation/320922 "2022-12-10T22:01:30Z")
I have a "warm" node with spinning disks which is experiencing high loads due to io waits. The problem is that some very active hot ingestion shards are being allocated to this node. Is there anyway I can stop ES from … --- ## [Filebeat in Container mode + multiline Parser](https://discuss.elastic.co/t/filebeat-in-container-mode-multiline-parser/320945)
**Author:** [@fidelgonzo](https://discuss.elastic.co/u/fidelgonzo)\ **Replies:** 1\ **Last updated:** [December 10, 2022, 5:47pm UTC](https://discuss.elastic.co/t/filebeat-in-container-mode-multiline-parser/320945 "2022-12-10T17:47:32Z")
I have a problem with Filebeat (7.17) that when trying to read multiline Java Stacktrace logs, it works without problems when input.type: filestream but when running the same in our Kubernetes stack, as input.type: conta… --- ## [Why don't I see version java client 8.5.3 in the maven repository?](https://discuss.elastic.co/t/why-dont-i-see-version-java-client-8-5-3-in-the-maven-repository/320947)
**Author:** [@nocode2k](https://discuss.elastic.co/u/nocode2k)\ **Replies:** 1\ **Last updated:** [December 10, 2022, 5:27pm UTC](https://discuss.elastic.co/t/why-dont-i-see-version-java-client-8-5-3-in-the-maven-repository/320947 "2022-12-10T17:27:18Z")
has been distributed. The version was updated on December 7th. Why doesn't the java client 8.5.3 version appear in the maven repository? --- ## [Two pipelines for single filebeat input | ELK version (6.5.4)](https://discuss.elastic.co/t/two-pipelines-for-single-filebeat-input-elk-version-6-5-4/320950)
**Author:** [@gyrao\_72](https://discuss.elastic.co/u/gyrao_72)\ **Replies:** 1\ **Last updated:** [December 10, 2022, 3:29pm UTC](https://discuss.elastic.co/t/two-pipelines-for-single-filebeat-input-elk-version-6-5-4/320950 "2022-12-10T15:29:17Z")
I am trying to create multiple pipelines first-pipeline and second-pipeline in logstash listening to beats events from the same port but getting an error saying the address in use for the second pipeline and the reason w… --- ## [Logstash filter plugin .gem file install on kubernetes Can't file local file](https://discuss.elastic.co/t/logstash-filter-plugin-gem-file-install-on-kubernetes-cant-file-local-file/320948)
**Author:** [@jijesh\_vu](https://discuss.elastic.co/u/jijesh_vu)\ **Replies:** 0\ **Last updated:** [December 10, 2022, 12:46pm UTC](https://discuss.elastic.co/t/logstash-filter-plugin-gem-file-install-on-kubernetes-cant-file-local-file/320948 "2022-12-10T12:46:30Z")
Im trying to install a custom .gem filter plugin using kubernetes StatefulSet. The gem file is in /tmp directory. pod log is showing ERROR: File not found for: file:///tmp/logstash-filter-kubernetes-0.3.1.gem, message: C… --- ## [ElasticSearch 8.5 and Java Client Error ""com.fasterxml.jackson.core.JsonParseException: Unrecognized token 'Client'](https://discuss.elastic.co/t/elasticsearch-8-5-and-java-client-error-com-fasterxml-jackson-core-jsonparseexception-unrecognized-token-client/319700)
**Author:** [@AlwaysBatMan](https://discuss.elastic.co/u/AlwaysBatMan)\ **Replies:** 3\ **Last updated:** [December 10, 2022, 10:34am UTC](https://discuss.elastic.co/t/elasticsearch-8-5-and-java-client-error-com-fasterxml-jackson-core-jsonparseexception-unrecognized-token-client/319700 "2022-12-10T10:34:05Z")
I am trying to use Elasticsearch 8.5 and its associated RestClient.I am having some difficulties using it and I am not able to make sense of this as to why this error message will be thrown.Looking for some guidance on h… --- ## [Kibana alerting](https://discuss.elastic.co/t/kibana-alerting/316785)
**Author:** [@rckvwijk](https://discuss.elastic.co/u/rckvwijk)\ **Replies:** 0\ **Last updated:** [October 17, 2022, 1:17pm UTC](https://discuss.elastic.co/t/kibana-alerting/316785 "2022-10-17T13:17:04Z")
Hi there, I'm trying to configure a couple of alerts but i'm running into a problem which i cannot seem to figure out, even after reading the documentation. I'm trying to create an alert which monitors several IIS websi… --- ## [Different same-field highlighting with alias fields and highlight queries broken](https://discuss.elastic.co/t/different-same-field-highlighting-with-alias-fields-and-highlight-queries-broken/320940)
**Author:** [@Erik\_Fassler](https://discuss.elastic.co/u/Erik_Fassler)\ **Replies:** 1\ **Last updated:** [December 10, 2022, 9:35am UTC](https://discuss.elastic.co/t/different-same-field-highlighting-with-alias-fields-and-highlight-queries-broken/320940 "2022-12-10T09:35:18Z")
I am using alias fields to do different highlighting on basically the same field. I use highlight\_queries to highlight different parts of the same field. This worked fine in ES up to 7.9.1 but changed its behaviour in ne… --- ## [Problem with range search with datetime field](https://discuss.elastic.co/t/problem-with-range-search-with-datetime-field/320878)
**Author:** [@abkrim](https://discuss.elastic.co/u/abkrim)\ **Replies:** 4\ **Last updated:** [December 10, 2022, 9:33am UTC](https://discuss.elastic.co/t/problem-with-range-search-with-datetime-field/320878 "2022-12-10T09:33:36Z")
I have a strange problem when I make queries in date range Mapping index . . . "datetime": { "type": "date", "format": "epoch\_second||yyyy-MM-dd HH:mm:ss", "ignore\_malformed": true … --- ## [Degrading search performance and old recods](https://discuss.elastic.co/t/degrading-search-performance-and-old-recods/320892)
**Author:** [@rvallel](https://discuss.elastic.co/u/rvallel)\ **Replies:** 3\ **Last updated:** [December 10, 2022, 9:02am UTC](https://discuss.elastic.co/t/degrading-search-performance-and-old-recods/320892 "2022-12-10T09:02:41Z")
Hi! My searches become slower and slower as the number of indexed documents grow. However, we only query the documents that happen to be produced in the last 3 months. I wonder if it is possible to have an alias or an… --- ## [Error: unable to load mongojdbc4.8.jar from :jdbc\_driver\_library, file not readable (please check user and group permissions for the path)](https://discuss.elastic.co/t/error-unable-to-load-mongojdbc4-8-jar-from-jdbc-driver-library-file-not-readable-please-check-user-and-group-permissions-for-the-path/320937)
**Author:** [@Vasanth2](https://discuss.elastic.co/u/Vasanth2)\ **Replies:** 0\ **Last updated:** [December 10, 2022, 6:08am UTC](https://discuss.elastic.co/t/error-unable-to-load-mongojdbc4-8-jar-from-jdbc-driver-library-file-not-readable-please-check-user-and-group-permissions-for-the-path/320937 "2022-12-10T06:08:02Z")
Error: unable to load mongojdbc4.8.jar from :jdbc\_driver\_library, file not readable (please check user and group permissions for the path) --- ## [How to configure 'ls.cgroup.cpu.path.override' in the Logstash JAVA\_OPTS environment variable](https://discuss.elastic.co/t/how-to-configure-ls-cgroup-cpu-path-override-in-the-logstash-java-opts-environment-variable/320880)
**Author:** [@jijesh\_vu](https://discuss.elastic.co/u/jijesh_vu)\ **Replies:** 2\ **Last updated:** [December 10, 2022, 5:46am UTC](https://discuss.elastic.co/t/how-to-configure-ls-cgroup-cpu-path-override-in-the-logstash-java-opts-environment-variable/320880 "2022-12-10T05:46:44Z")
I would like to know how to configure ls.cgroup.cpu.path.override and what this is means actaully? \[DEBUG\] 2022-12-09 12:27:37.592 \[pool-6-thread-1\] cpuresource - File /sys/fs/cgroup/cpu/kubepods.slice/kubepods-burstabl… --- ## [Metricbeat on RHEL 9 / Alma 9 / Rocky 9](https://discuss.elastic.co/t/metricbeat-on-rhel-9-alma-9-rocky-9/320703)
**Author:** [@fieryfly](https://discuss.elastic.co/u/fieryfly)\ **Replies:** 3\ **Last updated:** [December 10, 2022, 5:08am UTC](https://discuss.elastic.co/t/metricbeat-on-rhel-9-alma-9-rocky-9/320703 "2022-12-10T05:08:54Z")
Hello, I was looking through the product compatibility page Support Matrix | Elastic and didn't see a column for RHEL 9 under metricbeat. While running metricbeat, I see an error: runtime/cgo: pthread\_create failed: O… --- ## [Field names not parsing in Auditbeat](https://discuss.elastic.co/t/field-names-not-parsing-in-auditbeat/320914)
**Author:** [@kossde](https://discuss.elastic.co/u/kossde)\ **Replies:** 2\ **Last updated:** [December 10, 2022, 3:17am UTC](https://discuss.elastic.co/t/field-names-not-parsing-in-auditbeat/320914 "2022-12-10T03:17:56Z")
I feel like I'm missing something here. Auditbeat is up and running on an ubunutu server and I'm getting auditd, system, and file integrity logs but some fields referenced by the Elasticsearch prebuilt linux rules aren… --- ## [Logstash Aggregate filter inside Elasticsearch](https://discuss.elastic.co/t/logstash-aggregate-filter-inside-elasticsearch/320934)
**Author:** [@watercannons](https://discuss.elastic.co/u/watercannons)\ **Replies:** 0\ **Last updated:** [December 9, 2022, 9:53pm UTC](https://discuss.elastic.co/t/logstash-aggregate-filter-inside-elasticsearch/320934 "2022-12-09T21:53:11Z")
Hi, first time on this forum, sorry if this is a duplicate. I'm running into some weird hardware-specific issues running LogStash that's causing the aggregate plugin to not apply on certain events. However, all of the da… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=702) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=704)