# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=757 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 758 --- ## [Is there a library/API in Java to connect and fetch data from Elasticsearch](https://discuss.elastic.co/t/is-there-a-library-api-in-java-to-connect-and-fetch-data-from-elasticsearch/317069)
**Author:** [@pravu](https://discuss.elastic.co/u/pravu)\ **Replies:** 1\ **Last updated:** [October 20, 2022, 5:30am UTC](https://discuss.elastic.co/t/is-there-a-library-api-in-java-to-connect-and-fetch-data-from-elasticsearch/317069 "2022-10-20T05:30:58Z")
Is there a library/API in Java to connect and fetch data from Elasticsearch --- ## [Is it possible to add multiple outputs for elastic agents?](https://discuss.elastic.co/t/is-it-possible-to-add-multiple-outputs-for-elastic-agents/316891)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 5\ **Last updated:** [October 20, 2022, 4:20am UTC](https://discuss.elastic.co/t/is-it-possible-to-add-multiple-outputs-for-elastic-agents/316891 "2022-10-20T04:20:29Z")
We have 3 elasticsearch nodes and a client node. node 1, node 2, node 3 The current output of elastic agent is node 1. If the node 1 goes down is there a way for elastic agent to automatically sent its output to node 2… --- ## [Can ELK configure Remote Syslog Forwarding to Third party syslog server?](https://discuss.elastic.co/t/can-elk-configure-remote-syslog-forwarding-to-third-party-syslog-server/316953)
**Author:** [@wcpoon](https://discuss.elastic.co/u/wcpoon)\ **Replies:** 5\ **Last updated:** [October 20, 2022, 3:30am UTC](https://discuss.elastic.co/t/can-elk-configure-remote-syslog-forwarding-to-third-party-syslog-server/316953 "2022-10-20T03:30:26Z")
Hi All, Can ELK Stack able to configure remote syslog forwarding to another syslog server? Kindly please advise. Thanks. --- ## [A node cannot be upgraded directly from version \[7.10.2\] to version \[8.4.3\], it must first be upgraded to version \[7.17.0\]](https://discuss.elastic.co/t/a-node-cannot-be-upgraded-directly-from-version-7-10-2-to-version-8-4-3-it-must-first-be-upgraded-to-version-7-17-0/317036)
**Author:** [@SUNA](https://discuss.elastic.co/u/SUNA)\ **Replies:** 6\ **Last updated:** [October 20, 2022, 3:27am UTC](https://discuss.elastic.co/t/a-node-cannot-be-upgraded-directly-from-version-7-10-2-to-version-8-4-3-it-must-first-be-upgraded-to-version-7-17-0/317036 "2022-10-20T03:27:11Z")
Hi Team, I'm not sure how elastic verion managed to upgrade the major version without tried anyone. Did the stack try to upgrade itself? Kindly help how can i fix this error. my kibana down due to this error --- ## [Watcher: same query two different ranges (times)](https://discuss.elastic.co/t/watcher-same-query-two-different-ranges-times/316982)
**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\ **Replies:** 1\ **Last updated:** [October 20, 2022, 2:43am UTC](https://discuss.elastic.co/t/watcher-same-query-two-different-ranges-times/316982 "2022-10-20T02:43:47Z")
Hi, it's possible to create a watcher with a single query on two different times? Ex. If a certain threshold is exceeded between 10-11 and 11-12 and so on. So the alert would trigger only if the two conditions are met … --- ## [Filebeat monitoring metrics not visible in ElasticSearch](https://discuss.elastic.co/t/filebeat-monitoring-metrics-not-visible-in-elasticsearch/315596)
**Author:** [@ppine7](https://discuss.elastic.co/u/ppine7)\ **Replies:** 31\ **Last updated:** [October 20, 2022, 2:41am UTC](https://discuss.elastic.co/t/filebeat-monitoring-metrics-not-visible-in-elasticsearch/315596 "2022-10-20T02:41:58Z")
Hi, I have posted this question on SO but could not get a good answer yet .... Basically I think I have configured Fielbeat + ES according to the docs , to send Filebeat monitored metrics into ES - but nothing is showin… --- ## [Max Function vs High Count](https://discuss.elastic.co/t/max-function-vs-high-count/316498)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [October 20, 2022, 2:20am UTC](https://discuss.elastic.co/t/max-function-vs-high-count/316498 "2022-10-20T02:20:21Z")
Hi Community, The max function detect anomaly when it will max value for a particular field. For example average life of a person can be 60 and if we are applying max function on age and it detect anomaly age can be 90… --- ## [Elastic Search Anomaly Detection - Influencing Anomaly Scoring](https://discuss.elastic.co/t/elastic-search-anomaly-detection-influencing-anomaly-scoring/316797)
**Author:** [@LordMathis](https://discuss.elastic.co/u/LordMathis)\ **Replies:** 1\ **Last updated:** [October 20, 2022, 2:15am UTC](https://discuss.elastic.co/t/elastic-search-anomaly-detection-influencing-anomaly-scoring/316797 "2022-10-20T02:15:29Z")
Hello, I am working with the Elasticsearch anomaly detection tools. I am looking for a way to advance the scoring of an anomaly based off a specific threshold. For instance, lets say we have a max on a number that repre… --- ## [Alert for Elastic-Agent Offline](https://discuss.elastic.co/t/alert-for-elastic-agent-offline/317058)
**Author:** [@perea870724](https://discuss.elastic.co/u/perea870724)\ **Replies:** 0\ **Last updated:** [October 19, 2022, 11:34pm UTC](https://discuss.elastic.co/t/alert-for-elastic-agent-offline/317058 "2022-10-19T23:34:26Z")
Hello, Friends, does anyone know how it is possible to send an alert when an elastic-agent goes down? --- ## [How change pattern of data?](https://discuss.elastic.co/t/how-change-pattern-of-data/317045)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 2\ **Last updated:** [October 19, 2022, 11:08pm UTC](https://discuss.elastic.co/t/how-change-pattern-of-data/317045 "2022-10-19T23:08:23Z")
i have this format in kibana Jul 27, 2022 @ 15:27:26.598 but is have a problem not order correctly with create a field datetime in logstash filter { grok { match =\> \["message", "%{TIMESTAMP\_ISO8601:log… --- ## [Extract datatime in log and convert in datatime field?](https://discuss.elastic.co/t/extract-datatime-in-log-and-convert-in-datatime-field/317021)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 2\ **Last updated:** [October 19, 2022, 11:06pm UTC](https://discuss.elastic.co/t/extract-datatime-in-log-and-convert-in-datatime-field/317021 "2022-10-19T23:06:32Z")
i ve this config in logstash filter { grok { match =\> \["message", "%{TIMESTAMP\_ISO8601:timestamp\_message}"\] } date { match =\> \["timestamp\_message","YYYY-MM-dd HH:mm:ss"\] target =\> "@timesta… --- ## [Elastic Search Slow Response time range filter query](https://discuss.elastic.co/t/elastic-search-slow-response-time-range-filter-query/316936)
**Author:** [@prateek\_shekhar](https://discuss.elastic.co/u/prateek_shekhar)\ **Replies:** 2\ **Last updated:** [October 19, 2022, 10:35pm UTC](https://discuss.elastic.co/t/elastic-search-slow-response-time-range-filter-query/316936 "2022-10-19T22:35:25Z")
Hi Everyone, We a have a use case where we have added a new float field to our Elasticsearch index. The structure of the field is: class Foo { Float x Float y } This is our filter query which uses the above field: {… --- ## [Filebeat on macOS documentation error, breaking change](https://discuss.elastic.co/t/filebeat-on-macos-documentation-error-breaking-change/316996)
**Author:** [@maxried](https://discuss.elastic.co/u/maxried)\ **Replies:** 1\ **Last updated:** [October 19, 2022, 10:20pm UTC](https://discuss.elastic.co/t/filebeat-on-macos-documentation-error-breaking-change/316996 "2022-10-19T22:20:23Z")
Hi all, I'm running filebeat on macOS. It starts as a launchd service. After upgrading from 7 to 8, the daemon didn't run. I investigated this issue, and found that its command-line included --environment macos\_service … --- ## [How to compare 2 values in the only field using elasticsearch on grafana dashboard](https://discuss.elastic.co/t/how-to-compare-2-values-in-the-only-field-using-elasticsearch-on-grafana-dashboard/316932)
**Author:** [@Vitoria\_De\_Lara](https://discuss.elastic.co/u/Vitoria_De_Lara)\ **Replies:** 1\ **Last updated:** [October 19, 2022, 10:00pm UTC](https://discuss.elastic.co/t/how-to-compare-2-values-in-the-only-field-using-elasticsearch-on-grafana-dashboard/316932 "2022-10-19T22:00:11Z")
I need to create a dashboard that shows the two results of my boolean field. --- ## [Scroll in Python Elasticsearch client is not working](https://discuss.elastic.co/t/scroll-in-python-elasticsearch-client-is-not-working/317038)
**Author:** [@Yeashin\_Rabbi](https://discuss.elastic.co/u/Yeashin_Rabbi)\ **Replies:** 0\ **Last updated:** [October 19, 2022, 5:28pm UTC](https://discuss.elastic.co/t/scroll-in-python-elasticsearch-client-is-not-working/317038 "2022-10-19T17:28:41Z")
I tried to scroll all documents with python. it return empty array of hits. Here is my code: es = Elasticsearch(self.source, http\_auth=(self.user, self.password), timeout=80000, request\_timeo… --- ## [Elasticsearch with nmap](https://discuss.elastic.co/t/elasticsearch-with-nmap/316998)
**Author:** [@VitorBarroso](https://discuss.elastic.co/u/VitorBarroso)\ **Replies:** 1\ **Last updated:** [October 19, 2022, 9:47pm UTC](https://discuss.elastic.co/t/elasticsearch-with-nmap/316998 "2022-10-19T21:47:51Z")
Hello, Can my elasticsearch works like nmap, for example, when i add a machine on elasticsearch, the elasticsearch detect the vulnerabilies(cve) for this machine and add on a dashboard? --- ## [Vulnerability (CVE-2022-42889) Apache Commons Text](https://discuss.elastic.co/t/vulnerability-cve-2022-42889-apache-commons-text/317009)
**Author:** [@mduijkers](https://discuss.elastic.co/u/mduijkers)\ **Replies:** 1\ **Last updated:** [October 19, 2022, 8:56pm UTC](https://discuss.elastic.co/t/vulnerability-cve-2022-42889-apache-commons-text/317009 "2022-10-19T20:56:55Z")
Vulnerability (CVE-2022-42889) Apache Commons Text. For this vulnerability ES needs to upgrade to Apache Commons Text 1.10.0 Source: https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om Which version of ES… --- ## [Logstash plugin use @logger in new class](https://discuss.elastic.co/t/logstash-plugin-use-logger-in-new-class/317034)
**Author:** [@tylersiemers](https://discuss.elastic.co/u/tylersiemers)\ **Replies:** 1\ **Last updated:** [October 19, 2022, 8:42pm UTC](https://discuss.elastic.co/t/logstash-plugin-use-logger-in-new-class/317034 "2022-10-19T20:42:34Z")
New to logstash plugins here. How do you pass the @logger reference into another class within a plugin? The example below but trying to call another class outside and logging cause a failure. class SecondClass @logger.… --- ## [Why default index created logstash-2022.01.01-000001](https://discuss.elastic.co/t/why-default-index-created-logstash-2022-01-01-000001/316632)
**Author:** [@connectgeeks](https://discuss.elastic.co/u/connectgeeks)\ **Replies:** 7\ **Last updated:** [October 19, 2022, 6:35pm UTC](https://discuss.elastic.co/t/why-default-index-created-logstash-2022-01-01-000001/316632 "2022-10-19T18:35:27Z")
I'm using filebeat for forwarding logs to logstash and creating multiple datastreams in elasticsearch. I noticed one index created with name "logstash-2022.01.01-000001" and storing some of data from different datasteams… --- ## [Send json data with escape character](https://discuss.elastic.co/t/send-json-data-with-escape-character/317041)
**Author:** [@Pratik1](https://discuss.elastic.co/u/Pratik1)\ **Replies:** 0\ **Last updated:** [October 19, 2022, 5:50pm UTC](https://discuss.elastic.co/t/send-json-data-with-escape-character/317041 "2022-10-19T17:50:51Z")
I am using Kapacitor to send alerts via post method to elasticsearch. However, I was unable to do, so to debug further I was using a local django application to read the post response. By using alert template I am able t… --- ## [Filebeat on no internet](https://discuss.elastic.co/t/filebeat-on-no-internet/317022)
**Author:** [@Virendra\_Negi](https://discuss.elastic.co/u/Virendra_Negi)\ **Replies:** 1\ **Last updated:** [October 19, 2022, 5:01pm UTC](https://discuss.elastic.co/t/filebeat-on-no-internet/317022 "2022-10-19T17:01:47Z")
We have our servers located geographically at remote places (where the internet is not as reliable) the Filebeat shipper is responsible to ship the logs to our ELK via KAFKA -\> LOGSTASH -\> ELASTIC The thing I'm unable t… --- ## [Elasticsearch proxy that can proxy searches to mask ES version?](https://discuss.elastic.co/t/elasticsearch-proxy-that-can-proxy-searches-to-mask-es-version/317028)
**Author:** [@Todd\_Lyons](https://discuss.elastic.co/u/Todd_Lyons)\ **Replies:** 0\ **Last updated:** [October 19, 2022, 4:07pm UTC](https://discuss.elastic.co/t/elasticsearch-proxy-that-can-proxy-searches-to-mask-es-version/317028 "2022-10-19T16:07:44Z")
Hi, all! We have used PMM 1.x for quite some time (Percona Monitoring & Management) to monitor our various mysql servers. Under the hood it's grafana and victoriametrics. It can use ES clusters as a data source and we… --- ## [Treating your Cluster like cattle instead of pets](https://discuss.elastic.co/t/treating-your-cluster-like-cattle-instead-of-pets/316930)
**Author:** [@pushshift](https://discuss.elastic.co/u/pushshift)\ **Replies:** 3\ **Last updated:** [October 19, 2022, 3:16pm UTC](https://discuss.elastic.co/t/treating-your-cluster-like-cattle-instead-of-pets/316930 "2022-10-19T15:16:01Z")
Anyone who has managed large server farms soon realizes that treating your servers like cattle instead of pets is the most efficient way to deploy, run, decommission nodes quickly and efficiently. If a server fails you, … --- ## [Update\_by\_query and](https://discuss.elastic.co/t/update-by-query-and/317020)
**Author:** [@reed](https://discuss.elastic.co/u/reed)\ **Replies:** 0\ **Last updated:** [October 19, 2022, 3:13pm UTC](https://discuss.elastic.co/t/update-by-query-and/317020 "2022-10-19T15:13:48Z")
Hi all, I have a problem with update\_by\_query in a pipeline but I noticed that the same query used into dev tools works fine: PIPELINE http { url =\> "http://crsinsightdev.icc.crifnet.com:9200/loyd-crs\_insight\_s1\_a… --- ## [Kibana Elasticearch configuration](https://discuss.elastic.co/t/kibana-elasticearch-configuration/316915)
**Author:** [@not\_correct](https://discuss.elastic.co/u/not_correct)\ **Replies:** 8\ **Last updated:** [October 19, 2022, 2:45pm UTC](https://discuss.elastic.co/t/kibana-elasticearch-configuration/316915 "2022-10-19T14:45:01Z")
Hi, I am trying to configure the Kibana file to talk to ELasticsearch. It is deployed on single node EC2 instance on AWS. Here are my config files: kibana.yml # Kibana is served by a back end server. This setting spe… --- ## [Unable to connect to Elastic search with https from Logstash](https://discuss.elastic.co/t/unable-to-connect-to-elastic-search-with-https-from-logstash/316995)
**Author:** [@Pramod\_Kumar\_G](https://discuss.elastic.co/u/Pramod_Kumar_G)\ **Replies:** 1\ **Last updated:** [October 19, 2022, 2:40pm UTC](https://discuss.elastic.co/t/unable-to-connect-to-elastic-search-with-https-from-logstash/316995 "2022-10-19T14:40:38Z")
I am a new bie to ELK .I was able to start successfully elastic server and kibana.I was trying to start Logstash server but I am getting errors as below when run command logstash -f .\\config\\sample.conf my sample.conf … --- ## [Unable to ship logs from beats to logstash](https://discuss.elastic.co/t/unable-to-ship-logs-from-beats-to-logstash/316048)
**Author:** [@charlot\_Attard](https://discuss.elastic.co/u/charlot_Attard)\ **Replies:** 24\ **Last updated:** [October 19, 2022, 1:29pm UTC](https://discuss.elastic.co/t/unable-to-ship-logs-from-beats-to-logstash/316048 "2022-10-19T13:29:48Z")
I have configured beats to ouput logs to logstash via 2 servers. The problem is that for some reason logs are not being shipped to Logstash, I even ran a tcpdump on logstash servers and can't find anything relevant. What… --- ## [Cannot use own java version in ES 8](https://discuss.elastic.co/t/cannot-use-own-java-version-in-es-8/317007)
**Author:** [@surkovoleg2010](https://discuss.elastic.co/u/surkovoleg2010)\ **Replies:** 0\ **Last updated:** [October 19, 2022, 1:16pm UTC](https://discuss.elastic.co/t/cannot-use-own-java-version-in-es-8/317007 "2022-10-19T13:16:19Z")
Hello, I have ES version 8.1.2 and have env var for ES\_JAVA\_HOME But anyway, when I start ES with systemctl start elasticsearch.service it uses bundled jdk. I found a way how to start it with my own, using override.… --- ## [Convert 2 Node Cluster Into Single Node](https://discuss.elastic.co/t/convert-2-node-cluster-into-single-node/316555)
**Author:** [@rhailey](https://discuss.elastic.co/u/rhailey)\ **Replies:** 7\ **Last updated:** [October 19, 2022, 1:10pm UTC](https://discuss.elastic.co/t/convert-2-node-cluster-into-single-node/316555 "2022-10-19T13:10:27Z")
Hello - I'm currently using Elastic 7.11 (open/communitiy version) as the back-end storage for Graylog (also the open/community version). OS is Oracle Linux v8. I have 2 Graylog servers, clustered, in front of 2 Elast… --- ## [Is there a way to return true/false if documents exists for the given query?](https://discuss.elastic.co/t/is-there-a-way-to-return-true-false-if-documents-exists-for-the-given-query/316965)
**Author:** [@Hamza\_Khalid](https://discuss.elastic.co/u/Hamza_Khalid)\ **Replies:** 5\ **Last updated:** [October 19, 2022, 12:37pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-return-true-false-if-documents-exists-for-the-given-query/316965 "2022-10-19T12:37:47Z")
I have a query: GET users/\_search { "from": 0, "size": 20, "query": { "match\_all": {} } What i want to achieve is if the above query returns even a single document i get the response as true and if no document is r… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=756) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=758)