# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=747 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 748 --- ## [No threat intelligence data](https://discuss.elastic.co/t/no-threat-intelligence-data/317638)
**Author:** [@bigverm23](https://discuss.elastic.co/u/bigverm23)\ **Replies:** 4\ **Last updated:** [November 1, 2022, 9:55am UTC](https://discuss.elastic.co/t/no-threat-intelligence-data/317638 "2022-11-01T09:55:39Z")
I have installed multiple threatintel modules through my Filebeats collector, enabled them, and can verify I can view the various assets in Elastic. However the Security - Overview Dashboard still shows "no threat intel… --- ## [Should i use emit() when using runtime field](https://discuss.elastic.co/t/should-i-use-emit-when-using-runtime-field/317861)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 1\ **Last updated:** [November 1, 2022, 9:42am UTC](https://discuss.elastic.co/t/should-i-use-emit-when-using-runtime-field/317861 "2022-11-01T09:42:00Z")
Hello, i'm trying to sum 2 fields in index template using runtime field. Currently, my script is like this: doc\['a'\].value + doc\['b'\].value. Do i need to emit like this: emit(doc\['a'\].value + doc\['b'\].value) so that the … --- ## [Is Filebeat OSS support solaris sparc and AIX servers](https://discuss.elastic.co/t/is-filebeat-oss-support-solaris-sparc-and-aix-servers/317876)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 1\ **Last updated:** [November 1, 2022, 8:57am UTC](https://discuss.elastic.co/t/is-filebeat-oss-support-solaris-sparc-and-aix-servers/317876 "2022-11-01T08:57:56Z")
Hello team Is Filebeat OSS support solaris sparc and AIX servers? If not is there any alternative agent for solaris Sparc to push logs into logstash servers. --- ## [Synonym\_graph token filter and synonyms including comma's](https://discuss.elastic.co/t/synonym-graph-token-filter-and-synonyms-including-commas/316219)
**Author:** [@erikNL](https://discuss.elastic.co/u/erikNL)\ **Replies:** 5\ **Last updated:** [November 1, 2022, 8:52am UTC](https://discuss.elastic.co/t/synonym-graph-token-filter-and-synonyms-including-commas/316219 "2022-11-01T08:52:42Z")
I am trying to create a index that uses a synonym\_graph token filter to search for synonyms of chemical compound. For instance, when I search for "benzene", I also want to find sentences containing the following: "benz… --- ## [Index.lifecycle.rollover\_alias template settings](https://discuss.elastic.co/t/index-lifecycle-rollover-alias-template-settings/317868)
**Author:** [@Mangesh\_Mathe](https://discuss.elastic.co/u/Mangesh_Mathe)\ **Replies:** 4\ **Last updated:** [November 1, 2022, 7:34am UTC](https://discuss.elastic.co/t/index-lifecycle-rollover-alias-template-settings/317868 "2022-11-01T07:34:58Z")
Hello Team, We've scenario where we have multiple index with different names (Example: ordercode-domino , ordercode-ecofee , ordercode-chassis), Earlier we have one template for all these index with pattern as (ordercod… --- ## [Elasticsearch service getting failed on Ubuntu 20.4](https://discuss.elastic.co/t/elasticsearch-service-getting-failed-on-ubuntu-20-4/317677)
**Author:** [@BJawaid](https://discuss.elastic.co/u/BJawaid)\ **Replies:** 37\ **Last updated:** [November 1, 2022, 7:07am UTC](https://discuss.elastic.co/t/elasticsearch-service-getting-failed-on-ubuntu-20-4/317677 "2022-11-01T07:07:59Z")
Hi, I have installed elasticsearch 7.1.0 on Ubuntu 20.4 with java-11-openjdk-amd64. Since I am not a developer hence I expect respect for this post. Elasticsearch service is getting started successfully whenever I run; … --- ## [Sort query in Java](https://discuss.elastic.co/t/sort-query-in-java/317864)
**Author:** [@Apurba](https://discuss.elastic.co/u/Apurba)\ **Replies:** 1\ **Last updated:** [November 1, 2022, 6:20am UTC](https://discuss.elastic.co/t/sort-query-in-java/317864 "2022-11-01T06:20:35Z")
How can I write the below sort query in java - "sort": \[ { "fieldName1": { "order": "desc" }, "fieldName2": { "order": "desc" } } \] I can do that if the query like - "sort": \[ { "… --- ## [Copy multiple document](https://discuss.elastic.co/t/copy-multiple-document/317763)
**Author:** [@moranmono](https://discuss.elastic.co/u/moranmono)\ **Replies:** 4\ **Last updated:** [November 1, 2022, 5:53am UTC](https://discuss.elastic.co/t/copy-multiple-document/317763 "2022-11-01T05:53:52Z")
Hi I am using nest client with my application, I am trying to find a way to create a copy of multiple documents and change their properties. So far I have only got to this solution - Bulk api, but this solution requires… --- ## [Configuring Elastic Agent to access artifacts repository via proxy](https://discuss.elastic.co/t/configuring-elastic-agent-to-access-artifacts-repository-via-proxy/317415)
**Author:** [@username11](https://discuss.elastic.co/u/username11)\ **Replies:** 2\ **Last updated:** [November 1, 2022, 4:09am UTC](https://discuss.elastic.co/t/configuring-elastic-agent-to-access-artifacts-repository-via-proxy/317415 "2022-11-01T04:09:55Z")
Hi there. I am currently working on deploying Elastic Agent in our environment, where Elastic Agent hosts and Elastic Stack servers can be assumed to be directly accessible from each other, but internet access requires a… --- ## [Grok ingest pipeline](https://discuss.elastic.co/t/grok-ingest-pipeline/317708)
**Author:** [@Walter\_Hiranpat1](https://discuss.elastic.co/u/Walter_Hiranpat1)\ **Replies:** 5\ **Last updated:** [November 1, 2022, 2:07am UTC](https://discuss.elastic.co/t/grok-ingest-pipeline/317708 "2022-11-01T02:07:25Z")
I was wondering if there a way to accept all patterns excluding a specific regular expression? --- ## [When to use Coordinating only node](https://discuss.elastic.co/t/when-to-use-coordinating-only-node/317774)
**Author:** [@Balesh\_Kumar](https://discuss.elastic.co/u/Balesh_Kumar)\ **Replies:** 6\ **Last updated:** [November 1, 2022, 1:39am UTC](https://discuss.elastic.co/t/when-to-use-coordinating-only-node/317774 "2022-11-01T01:39:19Z")
Hi All, I have read this recommendation Coordinating only nodes can benefit large clusters by offloading the coordinating node role from data and master-eligible nodes.. What is considered a "large cluster"? Do you hav… --- ## [Unable to connect to ES through public IP](https://discuss.elastic.co/t/unable-to-connect-to-es-through-public-ip/317850)
**Author:** [@yadu\_krishna](https://discuss.elastic.co/u/yadu_krishna)\ **Replies:** 2\ **Last updated:** [November 1, 2022, 12:25am UTC](https://discuss.elastic.co/t/unable-to-connect-to-es-through-public-ip/317850 "2022-11-01T00:25:13Z")
Hi, I know this issue has been posted here a few times, but I'm stuck trying to debug what's going on. I have set up elasticsearch with docker following (Install Elasticsearch with Docker | Elasticsearch Guide \[8.4\] | El… --- ## [How to re-run cluster with different cluster uuid](https://discuss.elastic.co/t/how-to-re-run-cluster-with-different-cluster-uuid/317431)
**Author:** [@qksjdhi1212](https://discuss.elastic.co/u/qksjdhi1212)\ **Replies:** 3\ **Last updated:** [October 31, 2022, 11:57pm UTC](https://discuss.elastic.co/t/how-to-re-run-cluster-with-different-cluster-uuid/317431 "2022-10-31T23:57:57Z")
using version 8.4 When I ran es in single-node-cluster on ec2 instance I got this message Fully-formed clusters do not attempt to discover other nodes, and nodes with different cluster UUIDs cannot belong to the same c… --- ## [Reroute API](https://discuss.elastic.co/t/reroute-api/316832)
**Author:** [@wijamw](https://discuss.elastic.co/u/wijamw)\ **Replies:** 20\ **Last updated:** [October 31, 2022, 11:55pm UTC](https://discuss.elastic.co/t/reroute-api/316832 "2022-10-31T23:55:13Z")
I tried to move indices from one node to another using reroute API but I had the following error. type: illegal\_argument\_exception reason: "can't move from node-1 to node-2, , since its not allowed, reason: .. \[NO(the n… --- ## [What are blob keys and blob container in elasticsearch?](https://discuss.elastic.co/t/what-are-blob-keys-and-blob-container-in-elasticsearch/317584)
**Author:** [@selvaraj-sembulingam](https://discuss.elastic.co/u/selvaraj-sembulingam)\ **Replies:** 3\ **Last updated:** [October 31, 2022, 11:40pm UTC](https://discuss.elastic.co/t/what-are-blob-keys-and-blob-container-in-elasticsearch/317584 "2022-10-31T23:40:33Z")
What are blob keys and blob container in elasticsearch? if (blobKeys.isEmpty() == false) { logger.warn("Could not find a readable index-N file in a non-empty shard snapshot directory \[{}\]"; blobContainer… --- ## [Elastic/Kibana Maintenance](https://discuss.elastic.co/t/elastic-kibana-maintenance/317420)
**Author:** [@tifty](https://discuss.elastic.co/u/tifty)\ **Replies:** 6\ **Last updated:** [October 31, 2022, 11:38pm UTC](https://discuss.elastic.co/t/elastic-kibana-maintenance/317420 "2022-10-31T23:38:07Z")
Hi everyone, I was wondering what steps I should follow for production-grade Elasticsearch maintenance for on-premises deployment. Any resources/idea would be highly appreciated. TIA --- ## [Elasticsearch behind Azure API Management](https://discuss.elastic.co/t/elasticsearch-behind-azure-api-management/317834)
**Author:** [@zxuz111](https://discuss.elastic.co/u/zxuz111)\ **Replies:** 1\ **Last updated:** [October 31, 2022, 11:14pm UTC](https://discuss.elastic.co/t/elasticsearch-behind-azure-api-management/317834 "2022-10-31T23:14:20Z")
We have an Elasticsearch deployed on Azure, and we are planning to protect the access to the Elasticsearch using Azure API Management. When I tried to create API from OpenAPI specification by Elasticsearch (https://cloud… --- ## [Maps icon not showing in the dashboard](https://discuss.elastic.co/t/maps-icon-not-showing-in-the-dashboard/317642)
**Author:** [@pk80103](https://discuss.elastic.co/u/pk80103)\ **Replies:** 2\ **Last updated:** [October 31, 2022, 8:53pm UTC](https://discuss.elastic.co/t/maps-icon-not-showing-in-the-dashboard/317642 "2022-10-31T20:53:45Z")
Hi Everyone, could you please help in the issue. While creating dashboard, I am not getting an option for Maps as attached in the image. Thanks "version" : { "number" : "7.17.2", "build\_flavor" : "default", … --- ## [Understanding Young vs Survivor vs Old in JVM Nodes Stats](https://discuss.elastic.co/t/understanding-young-vs-survivor-vs-old-in-jvm-nodes-stats/317844)
**Author:** [@nola](https://discuss.elastic.co/u/nola)\ **Replies:** 0\ **Last updated:** [October 31, 2022, 7:10pm UTC](https://discuss.elastic.co/t/understanding-young-vs-survivor-vs-old-in-jvm-nodes-stats/317844 "2022-10-31T19:10:10Z")
I have a basic understanding of young vs old, vs permanent in general context of the JVM heap. But I was told when I want to monitor JVM heap pressure and gc, I should run GET \_nodes/stats?filter\_path=nodes.\*.jvm.mem.p… --- ## [Fleet server unable to enroll with a provided CA certificate (Docker)](https://discuss.elastic.co/t/fleet-server-unable-to-enroll-with-a-provided-ca-certificate-docker/317680)
**Author:** [@a.gavric](https://discuss.elastic.co/u/a.gavric)\ **Replies:** 1\ **Last updated:** [October 31, 2022, 7:21pm UTC](https://discuss.elastic.co/t/fleet-server-unable-to-enroll-with-a-provided-ca-certificate-docker/317680 "2022-10-31T19:21:52Z")
Good afternoon, we are attempting to deploy a Docker Container Based Elastic Stack, with a provided publicly signed CA certificate but on each enroll we are coming up with the following: BlockquoteError: enrollment fai… --- ## [Agent Server - cannot enroll with user-provided certificates](https://discuss.elastic.co/t/agent-server-cannot-enroll-with-user-provided-certificates/317528)
**Author:** [@vecjh](https://discuss.elastic.co/u/vecjh)\ **Replies:** 1\ **Last updated:** [October 31, 2022, 7:20pm UTC](https://discuss.elastic.co/t/agent-server-cannot-enroll-with-user-provided-certificates/317528 "2022-10-31T19:20:36Z")
Hi, I'm trying to enroll Agent Server with self-generated cerificates. I'm providing all paths as per this guide. However, the enrollment stops and the last lines in the log are as follows: {"log.level":"info","@timesta… --- ## [Help with conditionals in logstash](https://discuss.elastic.co/t/help-with-conditionals-in-logstash/317836)
**Author:** [@RaonyO](https://discuss.elastic.co/u/RaonyO)\ **Replies:** 2\ **Last updated:** [October 31, 2022, 5:31pm UTC](https://discuss.elastic.co/t/help-with-conditionals-in-logstash/317836 "2022-10-31T17:31:34Z")
hello, I'm trying to perform a filter with some conditions, but when performing as follows, it doesn't work. if "dns\_server\_process\_query\_send" or "Not authoritative" in \[message\] { drop {} } but if I use the followin… --- ## [Index boosting and how the exact matches can rank higher than fuzzy match and phrase match in the elastic search?](https://discuss.elastic.co/t/index-boosting-and-how-the-exact-matches-can-rank-higher-than-fuzzy-match-and-phrase-match-in-the-elastic-search/317835)
**Author:** [@paris1](https://discuss.elastic.co/u/paris1)\ **Replies:** 0\ **Last updated:** [October 31, 2022, 5:07pm UTC](https://discuss.elastic.co/t/index-boosting-and-how-the-exact-matches-can-rank-higher-than-fuzzy-match-and-phrase-match-in-the-elastic-search/317835 "2022-10-31T17:07:02Z")
0 I'm trying to configure Elasticsearch to give me both exact matches and fuzzy matches, and also phrase matches. I'm using Elasticsearch to search names of foods in a database, and I want it to be fuzzy to allow for mi… --- ## [Whitelist nested field](https://discuss.elastic.co/t/whitelist-nested-field/317773)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 5\ **Last updated:** [October 31, 2022, 4:53pm UTC](https://discuss.elastic.co/t/whitelist-nested-field/317773 "2022-10-31T16:53:07Z")
Hi everyone, i plan to whitelist some fields, but they are nested field. i already tried prune to whitelist them and it didn't work. for example: Request Body : {"tipe":"FF","nama":"ABC","nik":"","handphone":"00012","… --- ## [Parsed Multi Object in Json](https://discuss.elastic.co/t/parsed-multi-object-in-json/317705)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 7\ **Last updated:** [October 31, 2022, 4:42pm UTC](https://discuss.elastic.co/t/parsed-multi-object-in-json/317705 "2022-10-31T16:42:38Z")
Hi there, so i have a log look like this: 2022-10-27 08:39:02 \[https-jsse-nio-9078-exec-7\] INFO i.c.p.va.security.LoggerFilter - Response Body : {"responseCode":"00","responseDesc":"Approved","data":"{"vaNumber":"111… --- ## [Fleet and autodiscovery](https://discuss.elastic.co/t/fleet-and-autodiscovery/317284)
**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\ **Replies:** 2\ **Last updated:** [October 31, 2022, 4:42pm UTC](https://discuss.elastic.co/t/fleet-and-autodiscovery/317284 "2022-10-31T16:42:37Z")
Hello All, I have the following docker containers running with Docker Swarm: Elastic Agent Filebeat Traefik service Spring boot app We are trying to obtain the spring boot app/traefik logs via Elastic Agent but it is… --- ## [Error uploading data from PostgresQL to Elasticsearch via logstash](https://discuss.elastic.co/t/error-uploading-data-from-postgresql-to-elasticsearch-via-logstash/317832)
**Author:** [@Evgen\_G](https://discuss.elastic.co/u/Evgen_G)\ **Replies:** 0\ **Last updated:** [October 31, 2022, 4:21pm UTC](https://discuss.elastic.co/t/error-uploading-data-from-postgresql-to-elasticsearch-via-logstash/317832 "2022-10-31T16:21:34Z")
Tell me, please, can anyone come across such a problem: when unloading data from the database in elasticsearch, an error occurs \[ERROR\] 2022-10-31 16:02:14.628 \[\[main\]\>worker1\] elasticsearch - Encountered a retryable er… --- ## [Kibana custom dashboard does not show Filebeat metrics values](https://discuss.elastic.co/t/kibana-custom-dashboard-does-not-show-filebeat-metrics-values/317656)
**Author:** [@ppine7](https://discuss.elastic.co/u/ppine7)\ **Replies:** 8\ **Last updated:** [October 31, 2022, 3:24pm UTC](https://discuss.elastic.co/t/kibana-custom-dashboard-does-not-show-filebeat-metrics-values/317656 "2022-10-31T15:24:54Z")
Hi, Summary of the Issue I'm having: Custom Kibana dashboard I have created to show a few internal Filebeat metrics - does not show their values (just shows zeros for all fields I selected), even though I can see that … --- ## [Concatenation of two fields](https://discuss.elastic.co/t/concatenation-of-two-fields/317691)
**Author:** [@prashantreddy](https://discuss.elastic.co/u/prashantreddy)\ **Replies:** 2\ **Last updated:** [October 31, 2022, 3:20pm UTC](https://discuss.elastic.co/t/concatenation-of-two-fields/317691 "2022-10-31T15:20:16Z")
Hello, I want to concatenate/combine/merge two or three fields and assign this combined value to new field (mapping created for new field) after indexing. could you please suggest how to do this? Thanks! --- ## [How to add parameters to a scripted similarity?](https://discuss.elastic.co/t/how-to-add-parameters-to-a-scripted-similarity/317731)
**Author:** [@fsanzestevez](https://discuss.elastic.co/u/fsanzestevez)\ **Replies:** 1\ **Last updated:** [October 31, 2022, 1:29pm UTC](https://discuss.elastic.co/t/how-to-add-parameters-to-a-scripted-similarity/317731 "2022-10-31T13:29:48Z")
I'm trying to make a parametrized scripted similarity function but I can't get it to work. I have created the script and have it stored. However, when I try to implement it in the similarity score, I keep getting error… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=746) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=748)