# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=722 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 723 --- ## [Retrieve records and update a field at the same time](https://discuss.elastic.co/t/retrieve-records-and-update-a-field-at-the-same-time/319465)
**Author:** [@xef](https://discuss.elastic.co/u/xef)\ **Replies:** 8\ **Last updated:** [November 23, 2022, 5:35pm UTC](https://discuss.elastic.co/t/retrieve-records-and-update-a-field-at-the-same-time/319465 "2022-11-23T17:35:38Z")
Is there anyway when making a query in Elasticsearch, to update a field (such as say a counter++) in each record that is selected by the query. Thanks --- ## [Include session variables in the connection string for jdbc\_static fails](https://discuss.elastic.co/t/include-session-variables-in-the-connection-string-for-jdbc-static-fails/319631)
**Author:** [@Muecker](https://discuss.elastic.co/u/Muecker)\ **Replies:** 1\ **Last updated:** [November 23, 2022, 4:24pm UTC](https://discuss.elastic.co/t/include-session-variables-in-the-connection-string-for-jdbc-static-fails/319631 "2022-11-23T16:24:05Z")
Hello, i want to use the jdbc\_static plugin from logstash, but it throws an error: \[2022-11-22T13:36:19,153\]\[WARN \]\[org.mariadb.jdbc.message.server.ErrorPacket\]\[pipeline\_name\] Error: 1064-42000: You have an error in you… --- ## [Kibana start but not accessible](https://discuss.elastic.co/t/kibana-start-but-not-accessible/319666)
**Author:** [@mohamedjmal](https://discuss.elastic.co/u/mohamedjmal)\ **Replies:** 2\ **Last updated:** [November 23, 2022, 3:13pm UTC](https://discuss.elastic.co/t/kibana-start-but-not-accessible/319666 "2022-11-23T15:13:10Z")
elasticsearch and kibana started successfully but the kibana interface does not show anything this is the kibana log , tell me that the host is "elastic1.sifast.local" but it is the ip adress in the kibana.yml ela… --- ## [Split filepath to a new field](https://discuss.elastic.co/t/split-filepath-to-a-new-field/319657)
**Author:** [@nestro](https://discuss.elastic.co/u/nestro)\ **Replies:** 2\ **Last updated:** [November 23, 2022, 2:51pm UTC](https://discuss.elastic.co/t/split-filepath-to-a-new-field/319657 "2022-11-23T14:51:56Z")
Hi! I use Filebeat on a central Syslog server which collects logs from all network devices. Filebeat is configured to collect the logs (which are arrenged by days in the month) from this server and sends them to Logstash… --- ## [Fleet server goes down when elastic search node used to enroll the fleet server goes down](https://discuss.elastic.co/t/fleet-server-goes-down-when-elastic-search-node-used-to-enroll-the-fleet-server-goes-down/317162)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 1\ **Last updated:** [October 26, 2022, 6:23pm UTC](https://discuss.elastic.co/t/fleet-server-goes-down-when-elastic-search-node-used-to-enroll-the-fleet-server-goes-down/317162 "2022-10-26T18:23:09Z")
We have 3 elasticsearch nodes and a client node. node 1, node 2, node 3 We added all the elasticsearch nodes as output in fleet settings so that even when one elasticsearch node goes down, the fleet will sent the dat… --- ## [Forward logs from rsyslog to Elasticsearch](https://discuss.elastic.co/t/forward-logs-from-rsyslog-to-elasticsearch/319597)
**Author:** [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\ **Replies:** 2\ **Last updated:** [November 23, 2022, 1:18pm UTC](https://discuss.elastic.co/t/forward-logs-from-rsyslog-to-elasticsearch/319597 "2022-11-23T13:18:52Z")
Hi! Need to use rsyslog to send data to Elasticsearh. Could you provide link to documentation? Manual? Thank you, Regards, Vassiliy --- ## [Seccomp default policy is missing clock\_nanosleep](https://discuss.elastic.co/t/seccomp-default-policy-is-missing-clock-nanosleep/319637)
**Author:** [@izaneuski](https://discuss.elastic.co/u/izaneuski)\ **Replies:** 2\ **Last updated:** [November 23, 2022, 1:03pm UTC](https://discuss.elastic.co/t/seccomp-default-policy-is-missing-clock-nanosleep/319637 "2022-11-23T13:03:27Z")
On some ubuntu hosts I'm facing high CPU consumption by auditbeat(7.16.3&8.5.1) and journalbeat(7.15.2) with default config. During investigation with strace found out: clock\_nanosleep(CLOCK\_REALTIME, 0, {tv\_sec=0, tv\_… --- ## [Cyclic reference eror while dissecting source.nat.port](https://discuss.elastic.co/t/cyclic-reference-eror-while-dissecting-source-nat-port/319656)
**Author:** [@GeorgeGkinis](https://discuss.elastic.co/u/GeorgeGkinis)\ **Replies:** 1\ **Last updated:** [November 23, 2022, 12:42pm UTC](https://discuss.elastic.co/t/cyclic-reference-eror-while-dissecting-source-nat-port/319656 "2022-11-23T12:42:47Z")
i all! I get the following output when starting filebeat with one processor: .... {"log.level":"error","@timestamp":"2022-11-23T13:29:24.875+0100","log.origin":{"file.name":"instance/beat.go","file.line":1057},"message… --- ## [Field data type for multi\_match query with type phrase](https://discuss.elastic.co/t/field-data-type-for-multi-match-query-with-type-phrase/319652)
**Author:** [@ChristopherHS](https://discuss.elastic.co/u/ChristopherHS)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 11:44am UTC](https://discuss.elastic.co/t/field-data-type-for-multi-match-query-with-type-phrase/319652 "2022-11-23T11:44:45Z")
Hello, I have the following query: { "size": 40, "from": 0, "query": { "bool": { "must": \[ { "multi\_match": { "query": "my sea… --- ## [Mixed line types JSON and Plain Text in the same file with multiline](https://discuss.elastic.co/t/mixed-line-types-json-and-plain-text-in-the-same-file-with-multiline/319648)
**Author:** [@sirReeall](https://discuss.elastic.co/u/sirReeall)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 10:53am UTC](https://discuss.elastic.co/t/mixed-line-types-json-and-plain-text-in-the-same-file-with-multiline/319648 "2022-11-23T10:53:45Z")
Hello, I've got log files that can contain plain text lines from a Java application and JSON lines. To complicate matters the plain text lines can be multiline , for example a Java stack trace, so I'm using the multili… --- ## [Logstash Not sending data to Elasticsearch](https://discuss.elastic.co/t/logstash-not-sending-data-to-elasticsearch/319643)
**Author:** [@abkonred](https://discuss.elastic.co/u/abkonred)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 10:37am UTC](https://discuss.elastic.co/t/logstash-not-sending-data-to-elasticsearch/319643 "2022-11-23T10:37:41Z")
Hi Team, I have created a pipeline and sending data from filebeat to logstash and to Elasticsearch. and I have created one custom field from filebeat to filter the data. Not sue why it is not sending data to "apa" index… --- ## [HTTPJSON input : get only new records](https://discuss.elastic.co/t/httpjson-input-get-only-new-records/319598)
**Author:** [@djesus](https://discuss.elastic.co/u/djesus)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 12:24am UTC](https://discuss.elastic.co/t/httpjson-input-get-only-new-records/319598 "2022-11-23T00:24:17Z")
hi everyone! im trying to get audit logs from a cloud api, the logs on the api are always the same unless there is a new login happening. while using the httpjson input im always getting all data again, creating multip… --- ## [Elasticsearch disk keep getting full when using data-stream](https://discuss.elastic.co/t/elasticsearch-disk-keep-getting-full-when-using-data-stream/319276)
**Author:** [@MyNameHasDiactrics](https://discuss.elastic.co/u/MyNameHasDiactrics)\ **Replies:** 2\ **Last updated:** [November 23, 2022, 9:16am UTC](https://discuss.elastic.co/t/elasticsearch-disk-keep-getting-full-when-using-data-stream/319276 "2022-11-23T09:16:50Z")
This morning I woke up to this: This is not the first time that it happens, and when it happens it blocks everything: I cannot access Kibana, Elasticsearch doesn't answer at all, this means I also cannot delete data u… --- ## [And of array items in terms query](https://discuss.elastic.co/t/and-of-array-items-in-terms-query/319633)
**Author:** [@chirag\_bansal](https://discuss.elastic.co/u/chirag_bansal)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 9:07am UTC](https://discuss.elastic.co/t/and-of-array-items-in-terms-query/319633 "2022-11-23T09:07:17Z")
Hi, I need to know that whether an AND functionality of terms query exists or not? For example - { "terms": { "color": \[ blue, red, black \] } } The above query will return all t… --- ## [Authentication of \[elastic\] was terminated by realm \[reserved\]](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved/319621)
**Author:** [@Elitlogik](https://discuss.elastic.co/u/Elitlogik)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 7:32am UTC](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved/319621 "2022-11-23T07:32:57Z")
Authentication of \[elastic\] was terminated by realm \[reserved\] - failed to authenticate user \[elastic\] | @timestamp=2022-11-23T07:21:04.573Z log.level=INFO ecs.version=1.2.0 service.name=ES\_ECS event.dataset=elasticsear… --- ## [\[logstash.outputs.elasticsearch\] Attempted to resurrect connection to dead ES instance - AWS Govcloud](https://discuss.elastic.co/t/logstash-outputs-elasticsearch-attempted-to-resurrect-connection-to-dead-es-instance-aws-govcloud/319572)
**Author:** [@Vtech](https://discuss.elastic.co/u/Vtech)\ **Replies:** 1\ **Last updated:** [November 23, 2022, 7:01am UTC](https://discuss.elastic.co/t/logstash-outputs-elasticsearch-attempted-to-resurrect-connection-to-dead-es-instance-aws-govcloud/319572 "2022-11-23T07:01:27Z")
Getting the following error when attempting to send on-prem logstash to elasticsearch in the cloud The version running in the cloud is 8.2.2 Log file \[2022-11-22T08:24:43,581\]\[INFO \]\[logstash.runner \] Log4j … --- ## [Deleted docs could be still retrieved although refreshed](https://discuss.elastic.co/t/deleted-docs-could-be-still-retrieved-although-refreshed/319609)
**Author:** [@fanqiaoqing](https://discuss.elastic.co/u/fanqiaoqing)\ **Replies:** 14\ **Last updated:** [November 23, 2022, 6:44am UTC](https://discuss.elastic.co/t/deleted-docs-could-be-still-retrieved-although-refreshed/319609 "2022-11-23T06:44:52Z")
Hi Elasticsearch, I have an index with about 2.5 billion documents. The primary has a total of 10 shards, and each shard is about 10G. We have a problem like this: A query will find out the number of documents for som… --- ## [Logstash 7.3.1 with Elasticsearch 7.17.1](https://discuss.elastic.co/t/logstash-7-3-1-with-elasticsearch-7-17-1/319617)
**Author:** [@Wan\_Nur\_Athirah\_Wan](https://discuss.elastic.co/u/Wan_Nur_Athirah_Wan)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 6:30am UTC](https://discuss.elastic.co/t/logstash-7-3-1-with-elasticsearch-7-17-1/319617 "2022-11-23T06:30:02Z")
Hai. one quick question since i already upgrade my Elasticsearch version from 7.3.1 to 7.17.1. Is it compatible to use logstash 7.3.1 with Elasticsearch 7.17.1 and do i also must upgrade logstash? since there still no er… --- ## [Logstash loki standalone setup with input file form /var/log/ dir](https://discuss.elastic.co/t/logstash-loki-standalone-setup-with-input-file-form-var-log-dir/319614)
**Author:** [@jijesh\_vu](https://discuss.elastic.co/u/jijesh_vu)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 6:11am UTC](https://discuss.elastic.co/t/logstash-loki-standalone-setup-with-input-file-form-var-log-dir/319614 "2022-11-23T06:11:36Z")
Im using logstash client with input file plugin to read the kubernetes logs from /var/log/\*\* directory. I have also a log generator is running on a node, and grafana is unable to detect the log generator logs .Grafana is… --- ## [Automatically create shards](https://discuss.elastic.co/t/automatically-create-shards/319613)
**Author:** [@dms6978](https://discuss.elastic.co/u/dms6978)\ **Replies:** 2\ **Last updated:** [November 23, 2022, 5:54am UTC](https://discuss.elastic.co/t/automatically-create-shards/319613 "2022-11-23T05:54:09Z")
Is there a way to automatically create a shard in one index when the specified shard capacity is full like index rollover? --- ## [Metricbeat unable to find keystore values with \`systemctl\`](https://discuss.elastic.co/t/metricbeat-unable-to-find-keystore-values-with-systemctl/319595)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 5\ **Last updated:** [November 23, 2022, 4:09am UTC](https://discuss.elastic.co/t/metricbeat-unable-to-find-keystore-values-with-systemctl/319595 "2022-11-23T04:09:42Z")
I am having trouble using the /usr/share/metricbeat/bin/metricbeat keystore command to store an api key. Everytime I do a systemctl restart metricbeat.service, I get this error: {"log.level":"error","@timestamp":"2022-… --- ## [Elastic search doesnot bootstrap with 8.5.0](https://discuss.elastic.co/t/elastic-search-doesnot-bootstrap-with-8-5-0/318993)
**Author:** [@smiley\_tamy](https://discuss.elastic.co/u/smiley_tamy)\ **Replies:** 6\ **Last updated:** [November 23, 2022, 3:07am UTC](https://discuss.elastic.co/t/elastic-search-doesnot-bootstrap-with-8-5-0/318993 "2022-11-23T03:07:08Z")
I have Elasticsearch service with version 8.5.0 When I try to invoke Elasticsearch.main from Java class, the following exception is thrown Can you please help me to resolve that Invoked call - Elasticsearch.main(args… --- ## [Access child aggregations from parent](https://discuss.elastic.co/t/access-child-aggregations-from-parent/319607)
**Author:** [@HasiAmarasena](https://discuss.elastic.co/u/HasiAmarasena)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 3:04am UTC](https://discuss.elastic.co/t/access-child-aggregations-from-parent/319607 "2022-11-23T03:04:01Z")
I have below search POST /MY\_ID/\_search?typed\_keys=true { "aggs": { "terms\_agg": { "terms": { "field": "\[RefNumber\]" }, "aggs": { "max\_agg\_startdate": { "max": { … --- ## [Logstash.inputs.jdbc connect to Azure SQL Server throw exception](https://discuss.elastic.co/t/logstash-inputs-jdbc-connect-to-azure-sql-server-throw-exception/319603)
**Author:** [@liuxiao617111](https://discuss.elastic.co/u/liuxiao617111)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 1:59am UTC](https://discuss.elastic.co/t/logstash-inputs-jdbc-connect-to-azure-sql-server-throw-exception/319603 "2022-11-23T01:59:15Z")
when I using "authentication=ActiveDirectoryPassword" to connect Azure SQL server. It throw an exception: "Failed to load MSAL4J Java library for performing ActiveDirectoryPassword authentication.". Logstash Version : … --- ## [Elasticsearch multi-match query using a fuzziness criteria behaves in a strange way](https://discuss.elastic.co/t/elasticsearch-multi-match-query-using-a-fuzziness-criteria-behaves-in-a-strange-way/319498)
**Author:** [@Ivo\_Tavares](https://discuss.elastic.co/u/Ivo_Tavares)\ **Replies:** 2\ **Last updated:** [November 23, 2022, 12:40am UTC](https://discuss.elastic.co/t/elasticsearch-multi-match-query-using-a-fuzziness-criteria-behaves-in-a-strange-way/319498 "2022-11-23T00:40:37Z")
I'm trying to search for some files using the function fetch\_document to fetch a document by its name in the data.name subfield. This function is being used in the following way: fetch\_document( client=server, … --- ## [Elasticsearch not returning larger results (not total result size/length, but size of individual hit](https://discuss.elastic.co/t/elasticsearch-not-returning-larger-results-not-total-result-size-length-but-size-of-individual-hit/319242)
**Author:** [@NickIsWorking](https://discuss.elastic.co/u/NickIsWorking)\ **Replies:** 5\ **Last updated:** [November 22, 2022, 10:59pm UTC](https://discuss.elastic.co/t/elasticsearch-not-returning-larger-results-not-total-result-size-length-but-size-of-individual-hit/319242 "2022-11-22T22:59:25Z")
Hello. I have an Elasticsearch instance, storing objects that contain really large strings. I am trying to make a request to retrieve those objects from elasticsearch, but for whatever reason, elasticsearch will not retu… --- ## [Rsyslog + Elasticsearch + Kibana](https://discuss.elastic.co/t/rsyslog-elasticsearch-kibana/319594)
**Author:** [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\ **Replies:** 0\ **Last updated:** [November 22, 2022, 10:41pm UTC](https://discuss.elastic.co/t/rsyslog-elasticsearch-kibana/319594 "2022-11-22T22:41:56Z")
Hello! Could you give link to rsyslog configuration to work with Elasticsearch and Kibana? Thank you, Vassiliy --- ## [How to Reference field value(s) in Logstash](https://discuss.elastic.co/t/how-to-reference-field-value-s-in-logstash/319593)
**Author:** [@RCooper56](https://discuss.elastic.co/u/RCooper56)\ **Replies:** 2\ **Last updated:** [November 22, 2022, 10:41pm UTC](https://discuss.elastic.co/t/how-to-reference-field-value-s-in-logstash/319593 "2022-11-22T22:41:06Z")
Hey Elastic Team, First time post here so please let me know if you need more detail, I'll try to provide as much context as possible. I am trying to create a visualisation based on snmp data coming from our firewall. … --- ## [Email - Something happen while delivering an email {:exception=\>#\}](https://discuss.elastic.co/t/email-something-happen-while-delivering-an-email-exception-net-execution-expired/319590)
**Author:** [@David\_Graciano](https://discuss.elastic.co/u/David_Graciano)\ **Replies:** 0\ **Last updated:** [November 22, 2022, 9:49pm UTC](https://discuss.elastic.co/t/email-something-happen-while-delivering-an-email-exception-net-execution-expired/319590 "2022-11-22T21:49:03Z")
Attempting to send an email from the logstash output produces the following error in the output. email - Something happen while delivering an email {:exception=\>#\} this is my curren… --- ## [MaxTimeoutReached occurring after failing to connect via sniffing connection pool](https://discuss.elastic.co/t/maxtimeoutreached-occurring-after-failing-to-connect-via-sniffing-connection-pool/318973)
**Author:** [@Hoppities](https://discuss.elastic.co/u/Hoppities)\ **Replies:** 1\ **Last updated:** [November 22, 2022, 7:53pm UTC](https://discuss.elastic.co/t/maxtimeoutreached-occurring-after-failing-to-connect-via-sniffing-connection-pool/318973 "2022-11-22T19:53:45Z")
Whenever we run into this scenario where a sniff happened and elastic was unable to connect, we then see this timeout with a massive negative number. I'm not even sure where to start with this. Any help would be appreci… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=721) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=723)