# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=729 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 730 --- ## [Heartbeat 8.5.0 Parsing Errors](https://discuss.elastic.co/t/heartbeat-8-5-0-parsing-errors/318031)
**Author:** [@christophercutajar](https://discuss.elastic.co/u/christophercutajar)\ **Replies:** 5\ **Last updated:** [November 17, 2022, 10:51am UTC](https://discuss.elastic.co/t/heartbeat-8-5-0-parsing-errors/318031 "2022-11-17T10:51:23Z")
Hi team, After upgrading our heartbeat deployment from 8.4.3 to 8.5.0, heartbeat data ingestion stopped. From the logs, we can see that the reason why the event cannot be ingested is due to parsing issues. \\"reason\\":… --- ## [Fleet Server status stuck at updating, but seems to be working normally?!](https://discuss.elastic.co/t/fleet-server-status-stuck-at-updating-but-seems-to-be-working-normally/318193)
**Author:** [@martinm76](https://discuss.elastic.co/u/martinm76)\ **Replies:** 4\ **Last updated:** [November 17, 2022, 10:20am UTC](https://discuss.elastic.co/t/fleet-server-status-stuck-at-updating-but-seems-to-be-working-normally/318193 "2022-11-17T10:20:23Z")
Hello there. I recently updated a client system from 8.4.3 to 8.5.0. Everything was looking good, after the typical reindexing of shards until they were green or at least yellow. I then went to upgrade the Fleet Server… --- ## [Logstash WMI plugin logstash-input-wmi error](https://discuss.elastic.co/t/logstash-wmi-plugin-logstash-input-wmi-error/319163)
**Author:** [@houwenguang](https://discuss.elastic.co/u/houwenguang)\ **Replies:** 0\ **Last updated:** [November 17, 2022, 10:07am UTC](https://discuss.elastic.co/t/logstash-wmi-plugin-logstash-input-wmi-error/319163 "2022-11-17T10:07:12Z")
Hi, I use logstash to collect wmi remotely on linux. input { prueba local input { wmi { query =\> "select \* from Win32\_Process" host =\> "192.168.146.203" user =\> "Administrator" password =\> "1909" } } output { … --- ## [Impossible to pull elastic image because of cloudfront](https://discuss.elastic.co/t/impossible-to-pull-elastic-image-because-of-cloudfront/319094)
**Author:** [@Althea\_Vestrit](https://discuss.elastic.co/u/Althea_Vestrit)\ **Replies:** 3\ **Last updated:** [November 17, 2022, 9:51am UTC](https://discuss.elastic.co/t/impossible-to-pull-elastic-image-because-of-cloudfront/319094 "2022-11-17T09:51:42Z")
Hello, I am trying to install an elastic-agent on a new server but cannot pull the elastic-agent container image (same problem with other elastic images). For example I have the same error with the kibana image, even th… --- ## [Following example to update mappings gives exception](https://discuss.elastic.co/t/following-example-to-update-mappings-gives-exception/319155)
**Author:** [@tinrik](https://discuss.elastic.co/u/tinrik)\ **Replies:** 1\ **Last updated:** [November 17, 2022, 9:50am UTC](https://discuss.elastic.co/t/following-example-to-update-mappings-gives-exception/319155 "2022-11-17T09:50:48Z")
Hi, I'm following this example to bring down the storage usage of my index. However when I try it out: PUT /my\_index/\_mapping { "mappings": { "dynamic\_templates": \[ { "strings": { "match\_… --- ## [ILM errors on shrink index](https://discuss.elastic.co/t/ilm-errors-on-shrink-index/318967)
**Author:** [@sai\_kiran1](https://discuss.elastic.co/u/sai_kiran1)\ **Replies:** 3\ **Last updated:** [November 17, 2022, 9:34am UTC](https://discuss.elastic.co/t/ilm-errors-on-shrink-index/318967 "2022-11-17T09:34:41Z")
I see lifecycle errors on shrink indices with below error. java.lang.IllegalStateException: no rollover info found for \[shrink-wmgr-.ds-linux-audit-2022.08.24-000156\] with rollover target \[linux-audit\], the index has no… --- ## [Search combined/JOIN indexes](https://discuss.elastic.co/t/search-combined-join-indexes/318907)
**Author:** [@Johanna12221](https://discuss.elastic.co/u/Johanna12221)\ **Replies:** 5\ **Last updated:** [November 17, 2022, 9:19am UTC](https://discuss.elastic.co/t/search-combined-join-indexes/318907 "2022-11-17T09:19:15Z")
Hello, We are working on setting up a search with document contents (pdf/docx etc.) where permissions comes from a database. I've gotten all the data into Elastic with the help of Logstash and FSCrawler. However they… --- ## [Alias APIs in ElasticSearch](https://discuss.elastic.co/t/alias-apis-in-elasticsearch/319140)
**Author:** [@manikanta](https://discuss.elastic.co/u/manikanta)\ **Replies:** 3\ **Last updated:** [November 17, 2022, 8:55am UTC](https://discuss.elastic.co/t/alias-apis-in-elasticsearch/319140 "2022-11-17T08:55:20Z")
I have a doubt in Alias APIs. Can Elasticsearch itself creates alias when a new value is added for a field? alias-name : {value} { "filter": { "term": { "fieldname": {value} } } } --- ## [Breaking index into small indices with duplicates items across indices](https://discuss.elastic.co/t/breaking-index-into-small-indices-with-duplicates-items-across-indices/319097)
**Author:** [@x41lakazam](https://discuss.elastic.co/u/x41lakazam)\ **Replies:** 4\ **Last updated:** [November 17, 2022, 8:33am UTC](https://discuss.elastic.co/t/breaking-index-into-small-indices-with-duplicates-items-across-indices/319097 "2022-11-17T08:33:22Z")
I am facing a problem that look pretty popular from what I saw on the forum, but always different from mine. I currently have one big index (actually one big alias split into several ILM indices) which contain data avai… --- ## [Kibana logs are not showing in DIscover page](https://discuss.elastic.co/t/kibana-logs-are-not-showing-in-discover-page/319054)
**Author:** [@yasar](https://discuss.elastic.co/u/yasar)\ **Replies:** 2\ **Last updated:** [November 17, 2022, 8:20am UTC](https://discuss.elastic.co/t/kibana-logs-are-not-showing-in-discover-page/319054 "2022-11-17T08:20:18Z")
Hi team, We are injected the logs by manually for few testing and we have done the filebeat, and logstash pipeline and Logstash config file as well as the same. But after configured and pushed the logs by manually, it … --- ## [Problem when installing elk 8.5.1](https://discuss.elastic.co/t/problem-when-installing-elk-8-5-1/319072)
**Author:** [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\ **Replies:** 5\ **Last updated:** [November 17, 2022, 7:32am UTC](https://discuss.elastic.co/t/problem-when-installing-elk-8-5-1/319072 "2022-11-17T07:32:46Z")
Hi i am trying to install elk stack 8.5.1 on amazon linux 2 redhat. When i try to start the service getting the following error I have set xpack.security.enabled: true discovery-type: single-node xpack.security.tra… --- ## [How do I extend the SSL Certificate expiry period?s](https://discuss.elastic.co/t/how-do-i-extend-the-ssl-certificate-expiry-period-s/318922)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 4\ **Last updated:** [November 17, 2022, 7:05am UTC](https://discuss.elastic.co/t/how-do-i-extend-the-ssl-certificate-expiry-period-s/318922 "2022-11-17T07:05:43Z")
Hi everyone. I have an ES Cluster(ES version 7.4.2) that has been running for 3 years. when I run the following query. GET \_ssl/certificates I'm getting the output. "expiry" : "2022-11-20T07:27:29.000Z" My cluster … --- ## [Increment custom field ID on certain event using logstash conf file](https://discuss.elastic.co/t/increment-custom-field-id-on-certain-event-using-logstash-conf-file/317839)
**Author:** [@Poongkuyil\_Muse](https://discuss.elastic.co/u/Poongkuyil_Muse)\ **Replies:** 10\ **Last updated:** [November 17, 2022, 5:48am UTC](https://discuss.elastic.co/t/increment-custom-field-id-on-certain-event-using-logstash-conf-file/317839 "2022-11-17T05:48:32Z")
Problem: I want to increment trap\_id on every process.php request. but in my case, trap\_id is always 0. I dont know why. Please help me My log file is in csv format. I am trying to fetch the periodical logs of a single … --- ## [How to migration frozen index to hot or warm?](https://discuss.elastic.co/t/how-to-migration-frozen-index-to-hot-or-warm/318817)
**Author:** [@InJong\_Park](https://discuss.elastic.co/u/InJong_Park)\ **Replies:** 2\ **Last updated:** [November 17, 2022, 5:38am UTC](https://discuss.elastic.co/t/how-to-migration-frozen-index-to-hot-or-warm/318817 "2022-11-17T05:38:14Z")
Hello I'm InJong from korea. I have a frozen indices with datastream. (in Elastic Cloud) I want to move frozen tier index to another tier. (hot, warm, cold) I checked document -\> "Migrate index allocation filters to … --- ## [Not able to login even after correct credentials in x-pack](https://discuss.elastic.co/t/not-able-to-login-even-after-correct-credentials-in-x-pack/317926)
**Author:** [@Murali\_Krishna2](https://discuss.elastic.co/u/Murali_Krishna2)\ **Replies:** 8\ **Last updated:** [November 17, 2022, 12:28am UTC](https://discuss.elastic.co/t/not-able-to-login-even-after-correct-credentials-in-x-pack/317926 "2022-11-17T00:28:54Z")
Hi Team, I am not able to login to elastic even after typing the correct username and password. Screenshot of the user details : In the above image, role is "viewer". We are able to login to those users whose role… --- ## [Updating two different version of elastic search from one log stash](https://discuss.elastic.co/t/updating-two-different-version-of-elastic-search-from-one-log-stash/319063)
**Author:** [@Rahul\_Gupta1](https://discuss.elastic.co/u/Rahul_Gupta1)\ **Replies:** 2\ **Last updated:** [November 16, 2022, 11:35pm UTC](https://discuss.elastic.co/t/updating-two-different-version-of-elastic-search-from-one-log-stash/319063 "2022-11-16T23:35:23Z")
Hi, i have two different version of Elasticsearch, one is old(6.3.4) and another one as new(8.3.2), currently we are writting into old cluster from logstash, and are willing to miggrate to new cluster, to avoid any data… --- ## [Metricbeat|Kubernetes|](https://discuss.elastic.co/t/metricbeat-kubernetes/319024)
**Author:** [@panditvaddi](https://discuss.elastic.co/u/panditvaddi)\ **Replies:** 0\ **Last updated:** [November 16, 2022, 7:05am UTC](https://discuss.elastic.co/t/metricbeat-kubernetes/319024 "2022-11-16T07:05:50Z")
Hi All, I want to read data from multiple namespaces using single metricbeat. Example: namespace1 namespace2 namespace3 using single metricbeat, i want to read data from all the namespace using wildcards like "name… --- ## [Probleme with attachement file in watcher kibana](https://discuss.elastic.co/t/probleme-with-attachement-file-in-watcher-kibana/318959)
**Author:** [@Mouloud\_Addouche](https://discuss.elastic.co/u/Mouloud_Addouche)\ **Replies:** 0\ **Last updated:** [November 15, 2022, 1:16pm UTC](https://discuss.elastic.co/t/probleme-with-attachement-file-in-watcher-kibana/318959 "2022-11-15T13:16:22Z")
Hello, I have a problem with watcher in elasticsearch, in fact I created a watcher that allows to send a mail with a pdf file ( the pdf file is a dashboard on kibana ) "reporting": { "url": "http://kibana:5601/api/rep… --- ## [BulkIndexError while I try to ingest data from python](https://discuss.elastic.co/t/bulkindexerror-while-i-try-to-ingest-data-from-python/319043)
**Author:** [@eleven\_e](https://discuss.elastic.co/u/eleven_e)\ **Replies:** 1\ **Last updated:** [November 16, 2022, 10:47pm UTC](https://discuss.elastic.co/t/bulkindexerror-while-i-try-to-ingest-data-from-python/319043 "2022-11-16T22:47:10Z")
I try to ingest a csv using python and it raises an error "BulkIndexError". But when I upload it using the UI in kibana it uploads perfectly, so I also tried ingesting in the same index and also tried with the index's ma… --- ## [Can you set partition field and count by as the same field?](https://discuss.elastic.co/t/can-you-set-partition-field-and-count-by-as-the-same-field/316244)
**Author:** [@emi\_rose](https://discuss.elastic.co/u/emi_rose)\ **Replies:** 1\ **Last updated:** [October 20, 2022, 2:27am UTC](https://discuss.elastic.co/t/can-you-set-partition-field-and-count-by-as-the-same-field/316244 "2022-10-20T02:27:57Z")
I have been trying to create a machine learning job that detects that a certain job that has been running for an anomalous amount of time. Sometimes this job runs for much longer than expected and sometimes much shorter.… --- ## [Update index type on field. It is possible?](https://discuss.elastic.co/t/update-index-type-on-field-it-is-possible/319049)
**Author:** [@abkrim](https://discuss.elastic.co/u/abkrim)\ **Replies:** 1\ **Last updated:** [November 16, 2022, 10:06pm UTC](https://discuss.elastic.co/t/update-index-type-on-field-it-is-possible/319049 "2022-11-16T22:06:32Z")
Hi I need change some fields created with index and doc\_valueswith false for new value true. I'm working with Elasticsearch 8.5 { "analyzers": { "mappings": { "properties": { "pf1":{ "ty… --- ## [Elasticsearch: I have a dream](https://discuss.elastic.co/t/elasticsearch-i-have-a-dream/319108)
**Author:** [@asdasd](https://discuss.elastic.co/u/asdasd)\ **Replies:** 1\ **Last updated:** [November 16, 2022, 9:35pm UTC](https://discuss.elastic.co/t/elasticsearch-i-have-a-dream/319108 "2022-11-16T21:35:15Z")
elasticsearch: I have a dream，To improve the comprehensive quality of every beginner, and finally make him a great elastic operation and maintenance personnel, we make it very difficult to connect kibana with Elasticsea… --- ## [Kibana Alerts Table Missing Columns](https://discuss.elastic.co/t/kibana-alerts-table-missing-columns/319122)
**Author:** [@codewriterguy](https://discuss.elastic.co/u/codewriterguy)\ **Replies:** 0\ **Last updated:** [November 16, 2022, 5:42pm UTC](https://discuss.elastic.co/t/kibana-alerts-table-missing-columns/319122 "2022-11-16T17:42:15Z")
Hi, The alerts dashboard is showing alerts but there are no columns/values populating for each alert. I am able to view details for an alert, investigate in the timeline, etc but I am not able to see any alert details i… --- ## [Problem with aggregation returning most popular array entry among all documents](https://discuss.elastic.co/t/problem-with-aggregation-returning-most-popular-array-entry-among-all-documents/319127)
**Author:** [@Karol\_Radomski](https://discuss.elastic.co/u/Karol_Radomski)\ **Replies:** 0\ **Last updated:** [November 16, 2022, 8:52pm UTC](https://discuss.elastic.co/t/problem-with-aggregation-returning-most-popular-array-entry-among-all-documents/319127 "2022-11-16T20:52:20Z")
Please help me solve aggregation issue: Lets say I have mapping (...) "properties": { "kidName": { "type": "keyword", "fields": { "txt": { "type": "text", } … --- ## [Gather AWS tags for host running Elastic Agent](https://discuss.elastic.co/t/gather-aws-tags-for-host-running-elastic-agent/319125)
**Author:** [@keiransteele](https://discuss.elastic.co/u/keiransteele)\ **Replies:** 0\ **Last updated:** [November 16, 2022, 7:37pm UTC](https://discuss.elastic.co/t/gather-aws-tags-for-host-running-elastic-agent/319125 "2022-11-16T19:37:24Z")
Currently the only identifiable information when viewing a host in the fleet UI is the hostname and OS, there is some metadata available in the Observability UI (I think metrics needs to be enabled for this?) but there a… --- ## [Aggregation only over the search results](https://discuss.elastic.co/t/aggregation-only-over-the-search-results/319012)
**Author:** [@namespace-Pt](https://discuss.elastic.co/u/namespace-Pt)\ **Replies:** 1\ **Last updated:** [November 16, 2022, 6:32pm UTC](https://discuss.elastic.co/t/aggregation-only-over-the-search-results/319012 "2022-11-16T18:32:57Z")
I found that the terms aggregations always inspect the entire collection, for example I use { "query": { "match": { "text field": "some text" } }, "aggs": { "agg-terms": {… --- ## [I see the following message in logstash after enabling security on elaticsearch side](https://discuss.elastic.co/t/i-see-the-following-message-in-logstash-after-enabling-security-on-elaticsearch-side/319120)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 0\ **Last updated:** [November 16, 2022, 5:19pm UTC](https://discuss.elastic.co/t/i-see-the-following-message-in-logstash-after-enabling-security-on-elaticsearch-side/319120 "2022-11-16T17:19:45Z")
Hello, I am running elasticsearch cluster 7.9 with logstash to parse logfiles and ingest. After enabling security on elasticsearch I am seeing the following error messages into the logstash logs. \[ERROR\]\[logstash.licen… --- ## [Use Kibana on my local machine to monitor Metricbeat on a remote VM?](https://discuss.elastic.co/t/use-kibana-on-my-local-machine-to-monitor-metricbeat-on-a-remote-vm/317054)
**Author:** [@nola](https://discuss.elastic.co/u/nola)\ **Replies:** 2\ **Last updated:** [October 19, 2022, 10:25pm UTC](https://discuss.elastic.co/t/use-kibana-on-my-local-machine-to-monitor-metricbeat-on-a-remote-vm/317054 "2022-10-19T22:25:14Z")
I have Metricbeat and Elasticsearch installed and running on an AWS EC2 instance. I have Kibana on my local machine. In kibana.yml, I have the server address for the elastic.hosts parameter, and am able to run queries … --- ## [How to drop DNS event if they are present into top 1 million file](https://discuss.elastic.co/t/how-to-drop-dns-event-if-they-are-present-into-top-1-million-file/318981)
**Author:** [@yquirion](https://discuss.elastic.co/u/yquirion)\ **Replies:** 5\ **Last updated:** [November 16, 2022, 4:55pm UTC](https://discuss.elastic.co/t/how-to-drop-dns-event-if-they-are-present-into-top-1-million-file/318981 "2022-11-16T16:55:32Z")
Dear all, I'm wonderion how to configure a logstash pipeline that will handle my DNS logs. From that logs, there are lots of logs I don't want to see because I know they are legitimate. So I would like to have logstash… --- ## [Latest transform fails to fetch preview after running at 100% CPU for more than an hour](https://discuss.elastic.co/t/latest-transform-fails-to-fetch-preview-after-running-at-100-cpu-for-more-than-an-hour/318742)
**Author:** [@fgjensen](https://discuss.elastic.co/u/fgjensen)\ **Replies:** 4\ **Last updated:** [November 16, 2022, 4:51pm UTC](https://discuss.elastic.co/t/latest-transform-fails-to-fetch-preview-after-running-at-100-cpu-for-more-than-an-hour/318742 "2022-11-16T16:51:26Z")
Hello I am trying to create a transform from a filebeat 7.15 index on a 7.17 cluster with 4 nodes and sufficient RAM and CPU's. During normal operations the cluster runs smoothly with low CPU usages. In fact the setup i… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=728) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=730)