# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=764 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 765 --- ## [Opendistro for 8.x](https://discuss.elastic.co/t/opendistro-for-8-x/316534)
**Author:** [@zurrehma](https://discuss.elastic.co/u/zurrehma)\ **Replies:** 4\ **Last updated:** [October 13, 2022, 12:13pm UTC](https://discuss.elastic.co/t/opendistro-for-8-x/316534 "2022-10-13T12:13:09Z")
Hi, We are trying to migrate from Elasticsearch 7.x to 8.x. We were using opendistro security, job scheduler, alerting, anomaly-detection and index management plugins. I am seeing now opendistro doesn't have new version… --- ## [Elastic-Agent - Non-zero metrics in the last 30s](https://discuss.elastic.co/t/elastic-agent-non-zero-metrics-in-the-last-30s/302052)
**Author:** [@zx8086](https://discuss.elastic.co/u/zx8086)\ **Replies:** 1\ **Last updated:** [October 13, 2022, 11:47am UTC](https://discuss.elastic.co/t/elastic-agent-non-zero-metrics-in-the-last-30s/302052 "2022-10-13T11:47:24Z")
Running 8.1.2, is there a way to disable the metrics logging of this within the Elastic-Agent ? This without disabling "Collect Agent Logs"... I want the logs but not the metrics logging. You normally could do this … --- ## [Installing 8.4.x on docker and having issues](https://discuss.elastic.co/t/installing-8-4-x-on-docker-and-having-issues/316530)
**Author:** [@neilwcdl](https://discuss.elastic.co/u/neilwcdl)\ **Replies:** 1\ **Last updated:** [October 13, 2022, 11:34am UTC](https://discuss.elastic.co/t/installing-8-4-x-on-docker-and-having-issues/316530 "2022-10-13T11:34:17Z")
Hi, Sorry I'm very new to logstash and docker and currently looking at installing 8.4.3, as we are currently on 8.3.2. Installing 8.3.3 - no issues Installing 8.4.0 - the issues start ---\> Running in 54f67362af15 Us… --- ## [Telegraf ingested by elastic (via metricbeat?)](https://discuss.elastic.co/t/telegraf-ingested-by-elastic-via-metricbeat/316528)
**Author:** [@A\_Mightiev](https://discuss.elastic.co/u/A_Mightiev)\ **Replies:** 0\ **Last updated:** [October 13, 2022, 11:15am UTC](https://discuss.elastic.co/t/telegraf-ingested-by-elastic-via-metricbeat/316528 "2022-10-13T11:15:04Z")
Hello, I have multiple services that have telegraf exposing the metrics of the service on port 9122 to show the metrics of what is running (sql, mongodb, etc) so basically I get the metrics by simply doing a get on SERVE… --- ## [Calculate duration of transactions](https://discuss.elastic.co/t/calculate-duration-of-transactions/316522)
**Author:** [@Indeed2000](https://discuss.elastic.co/u/Indeed2000)\ **Replies:** 0\ **Last updated:** [October 13, 2022, 10:53am UTC](https://discuss.elastic.co/t/calculate-duration-of-transactions/316522 "2022-10-13T10:53:08Z")
Hi need to calcualte duration bettween each Out/In where A=A+100 B=B IDS=IDS 00:03:02.067 app catZZ\_DDP\_AP: IN\[host\]A\[1000\]B\[123456\]IDS\[123456789987\] 00:03:02.110 app catZZ\_DDP\_AP: OUT\[host\]A\[1100\]B\[123456\]IDS\[1234567… --- ## [Elasticsearch in docker container running as root](https://discuss.elastic.co/t/elasticsearch-in-docker-container-running-as-root/316441)
**Author:** [@HeadScratcher](https://discuss.elastic.co/u/HeadScratcher)\ **Replies:** 1\ **Last updated:** [October 13, 2022, 10:55am UTC](https://discuss.elastic.co/t/elasticsearch-in-docker-container-running-as-root/316441 "2022-10-13T10:55:05Z")
Hi all, I've been wrestling with this problem for a few days now and im scratching my head a bit as i can't figure out what's wrong. I ran a fresh docker pull and install with docker-compose and it ran fine. then i ra… --- ## [\`UseAllElastic\` references a Package that doesn't exist](https://discuss.elastic.co/t/useallelastic-references-a-package-that-doesnt-exist/316511)
**Author:** [@sejhemming](https://discuss.elastic.co/u/sejhemming)\ **Replies:** 0\ **Last updated:** [October 13, 2022, 9:02am UTC](https://discuss.elastic.co/t/useallelastic-references-a-package-that-doesnt-exist/316511 "2022-10-13T09:02:22Z")
If I add .UseAllElastic() references Microsoft.AspNetCore.Http.Abstractions, Version=5.0.0.0. No such version exists. The latest version of that package is 2.2.0.0 --- ## [Watcher, Convert timestap field in loop](https://discuss.elastic.co/t/watcher-convert-timestap-field-in-loop/316428)
**Author:** [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Replies:** 2\ **Last updated:** [October 13, 2022, 8:36am UTC](https://discuss.elastic.co/t/watcher-convert-timestap-field-in-loop/316428 "2022-10-13T08:36:47Z")
Hi everyone, I' d like to iterate through ctx.payload.hits.hits and convert @timestamp field from ISO8601 to milliseconds. I have the following configuration: "actions": { "log\_hits": { "foreach": "ctx.payload.h… --- ## [Geo Info for Heartbeat](https://discuss.elastic.co/t/geo-info-for-heartbeat/316438)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 1\ **Last updated:** [October 13, 2022, 8:11am UTC](https://discuss.elastic.co/t/geo-info-for-heartbeat/316438 "2022-10-13T08:11:57Z")
I'm trying to set up Heartbeat so that we can use the data on a map in Kibana. What I want is one heartbeat installation to handle various geographic locations. However, the lat/long settings are in the heartbeat.yml fil… --- ## [Fleet - IIS integration](https://discuss.elastic.co/t/fleet-iis-integration/315357)
**Author:** [@tazemeta](https://discuss.elastic.co/u/tazemeta)\ **Replies:** 2\ **Last updated:** [October 13, 2022, 7:56am UTC](https://discuss.elastic.co/t/fleet-iis-integration/315357 "2022-10-13T07:56:02Z")
Hello there, i have fleet server and iis integration on my elk stack. Elastic agent on the iis server ships "../Logfiles/..log" files to elasticsearch but it sends all log files on that folder(est. there are 2 years log… --- ## [Logstash Elasticsearch output - one field only](https://discuss.elastic.co/t/logstash-elasticsearch-output-one-field-only/316395)
**Author:** [@gunlomboy](https://discuss.elastic.co/u/gunlomboy)\ **Replies:** 5\ **Last updated:** [October 13, 2022, 7:49am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-one-field-only/316395 "2022-10-13T07:49:11Z")
Hi, Is it possible to send only the "message" field to elasticsearch from logstash? I have tried codec =\> line { format =\> "%{message}" } but the full beat output is still sent. Thanks. --- ## [Custom text analyzer for url encoded logs](https://discuss.elastic.co/t/custom-text-analyzer-for-url-encoded-logs/316499)
**Author:** [@tarund](https://discuss.elastic.co/u/tarund)\ **Replies:** 0\ **Last updated:** [October 13, 2022, 7:45am UTC](https://discuss.elastic.co/t/custom-text-analyzer-for-url-encoded-logs/316499 "2022-10-13T07:45:12Z")
Hi, I am ingesting log files to Elasticsearch(v7.17.1) and using Kibana(v7.17.1) to search the logs. Some of my log lines have url encoded strings like below. I am trying to use custom text analyzers to be able to sear… --- ## [Bucket aggregation with java api and export in csv](https://discuss.elastic.co/t/bucket-aggregation-with-java-api-and-export-in-csv/314935)
**Author:** [@Rain\_Water](https://discuss.elastic.co/u/Rain_Water)\ **Replies:** 0\ **Last updated:** [September 22, 2022, 11:04am UTC](https://discuss.elastic.co/t/bucket-aggregation-with-java-api-and-export-in-csv/314935 "2022-09-22T11:04:50Z")
I have query below which i want to buckets result, i created the query with the help of grafana but im not able to convert it into java program. GET /\_search { "query": { "bool": { "filter": \[ { … --- ## [Is it possible to get matched\_queries in filter or post\_filter](https://discuss.elastic.co/t/is-it-possible-to-get-matched-queries-in-filter-or-post-filter/316495)
**Author:** [@Shreyas\_Bangramanjes](https://discuss.elastic.co/u/Shreyas_Bangramanjes)\ **Replies:** 0\ **Last updated:** [October 13, 2022, 7:10am UTC](https://discuss.elastic.co/t/is-it-possible-to-get-matched-queries-in-filter-or-post-filter/316495 "2022-10-13T07:10:45Z")
{ "\_index" : "testing1", "\_type" : "\_doc", "\_id" : "Ru6Yz4MBTaJ23jzlvcOg", "\_score" : 0.10535768, "\_source" : { "contentH1" : "300 Frågor och svar om Entreprenadjur… --- ## [Filebeat-\* as Index in Elasticsearch Input plugin in Logstash Config](https://discuss.elastic.co/t/filebeat-as-index-in-elasticsearch-input-plugin-in-logstash-config/315273)
**Author:** [@aji.shinde7](https://discuss.elastic.co/u/aji.shinde7)\ **Replies:** 0\ **Last updated:** [September 27, 2022, 2:32pm UTC](https://discuss.elastic.co/t/filebeat-as-index-in-elasticsearch-input-plugin-in-logstash-config/315273 "2022-09-27T14:32:38Z")
Hello Experts, Expecting replies from you :slight\_smile: I have created a Logstash Config file, which takes Elasticsearch Index ( filebeat-7.16.3-2022.09.16-000020) as Input. Now that index is full and new index is cr… --- ## [Unable to index winlogbeat using logstash](https://discuss.elastic.co/t/unable-to-index-winlogbeat-using-logstash/316434)
**Author:** [@bamfery](https://discuss.elastic.co/u/bamfery)\ **Replies:** 2\ **Last updated:** [October 13, 2022, 6:53am UTC](https://discuss.elastic.co/t/unable-to-index-winlogbeat-using-logstash/316434 "2022-10-13T06:53:09Z")
I am trying to set up winlogbeat to ship data to a logstash server, which further forwards to another logstash server and then to elasticsearch. I am seeing that when I add index =\> "%{\[@metadata\]\[beat\]}-%{+YYYY.MM.dd}" … --- ## ['cluster:admin/xpack/monitoring/bulk' privilege for beats\_system](https://discuss.elastic.co/t/cluster-admin-xpack-monitoring-bulk-privilege-for-beats-system/315753)
**Author:** [@NominaSumpta](https://discuss.elastic.co/u/NominaSumpta)\ **Replies:** 1\ **Last updated:** [October 13, 2022, 6:51am UTC](https://discuss.elastic.co/t/cluster-admin-xpack-monitoring-bulk-privilege-for-beats-system/315753 "2022-10-13T06:51:56Z")
On my Elasticsearch 7.x cluster, the beats\_system role has the cluster privileges monitor and cluster:admin/xpack/monitoring/bulk. The cluster:admin/xpack/monitoring/bulk privilege is not mentioned on Security privilege… --- ## ['monitor' privilege for beats\_system](https://discuss.elastic.co/t/monitor-privilege-for-beats-system/315754)
**Author:** [@NominaSumpta](https://discuss.elastic.co/u/NominaSumpta)\ **Replies:** 1\ **Last updated:** [October 13, 2022, 6:40am UTC](https://discuss.elastic.co/t/monitor-privilege-for-beats-system/315754 "2022-10-13T06:40:10Z")
On my Elasticsearch 7.x cluster, the beats\_system role has the cluster privileges monitor and cluster:admin/xpack/monitoring/bulk. According to Grant privileges and roles needed for monitoring | Filebeat Reference \[7.17… --- ## [Update a filed with script, there's error caused by "unsupported\_operation\_exception: null"](https://discuss.elastic.co/t/update-a-filed-with-script-theres-error-caused-by-unsupported-operation-exception-null/316491)
**Author:** [@chocolateBlack](https://discuss.elastic.co/u/chocolateBlack)\ **Replies:** 1\ **Last updated:** [October 13, 2022, 6:19am UTC](https://discuss.elastic.co/t/update-a-filed-with-script-theres-error-caused-by-unsupported-operation-exception-null/316491 "2022-10-13T06:19:56Z")
using script update object field , unsupported\_operation\_exception occors. elasticsearch version 7.10. PUT script\_test/ { "mappings" : { "dynamic" : "strict", "properties" : { "batch\_name" : { … --- ## [Kibana Cannot open monitoring dashboard because remote cluster is not accessable](https://discuss.elastic.co/t/kibana-cannot-open-monitoring-dashboard-because-remote-cluster-is-not-accessable/316028)
**Author:** [@edwardcccc](https://discuss.elastic.co/u/edwardcccc)\ **Replies:** 3\ **Last updated:** [October 13, 2022, 6:17am UTC](https://discuss.elastic.co/t/kibana-cannot-open-monitoring-dashboard-because-remote-cluster-is-not-accessable/316028 "2022-10-13T06:17:05Z")
I have a ELK 8.4.3 Main Cluster I have ELK self-monitoring enabled on this cluster another ELK 8.4.1 Remote Cluster, on a separate machine, which is not online all the time I only use this cluster to offload data from… --- ## [\[SOLVED\]\[ES 8.4.3\] Monitoring metricbeat - Unable to find the cluster in the selected time range](https://discuss.elastic.co/t/solved-es-8-4-3-monitoring-metricbeat-unable-to-find-the-cluster-in-the-selected-time-range/316247)
**Author:** [@mib](https://discuss.elastic.co/u/mib)\ **Replies:** 2\ **Last updated:** [October 13, 2022, 6:04am UTC](https://discuss.elastic.co/t/solved-es-8-4-3-monitoring-metricbeat-unable-to-find-the-cluster-in-the-selected-time-range/316247 "2022-10-13T06:04:12Z")
Hi, I'm having a problem displaying monitoring on an Elasticsearch cluster (3 nodes), with the error message "Unable to find the cluster in the selected time range. UUID: 1xTxMsopToqNnvd\_mbmcHw HTTP 404" when I visit th… --- ## [Handling a JSON key with a name being an empty string ""](https://discuss.elastic.co/t/handling-a-json-key-with-a-name-being-an-empty-string/316486)
**Author:** [@geekpete](https://discuss.elastic.co/u/geekpete)\ **Replies:** 0\ **Last updated:** [October 13, 2022, 4:49am UTC](https://discuss.elastic.co/t/handling-a-json-key-with-a-name-being-an-empty-string/316486 "2022-10-13T04:49:50Z")
Given a block of JSON like: {"":"value1","field2":"value2"} Where the first key has a blank name "" but has a regular looking value of value1, you might want to conditionally handle such data to avoid problems once ind… --- ## [Filebeat version that refreshes service account kubernetes tokens](https://discuss.elastic.co/t/filebeat-version-that-refreshes-service-account-kubernetes-tokens/314489)
**Author:** [@dedimitr](https://discuss.elastic.co/u/dedimitr)\ **Replies:** 1\ **Last updated:** [October 13, 2022, 4:45am UTC](https://discuss.elastic.co/t/filebeat-version-that-refreshes-service-account-kubernetes-tokens/314489 "2022-10-13T04:45:20Z")
Using filebeat version 6.6.2. I went through the docs but I just can't figure out to which version should I update, so that it starts refreshing kubernetes service account tokens? 'Service account tokens have an expirat… --- ## [Enable audit logging (deployment complains about format)](https://discuss.elastic.co/t/enable-audit-logging-deployment-complains-about-format/314478)
**Author:** [@Giorgi\_Jambazishvili](https://discuss.elastic.co/u/Giorgi_Jambazishvili)\ **Replies:** 1\ **Last updated:** [October 13, 2022, 4:10am UTC](https://discuss.elastic.co/t/enable-audit-logging-deployment-complains-about-format/314478 "2022-10-13T04:10:35Z")
I try to enable logging on elastic cloud deployment. For this I change the cluster configuration and my yml looks like this: This configuration complains about the fact that "include" should be type of "text" (" \* Elast… --- ## [Does a Fleet server need to be its own machine?](https://discuss.elastic.co/t/does-a-fleet-server-need-to-be-its-own-machine/315904)
**Author:** [@Tucker\_Green](https://discuss.elastic.co/u/Tucker_Green)\ **Replies:** 1\ **Last updated:** [October 13, 2022, 3:49am UTC](https://discuss.elastic.co/t/does-a-fleet-server-need-to-be-its-own-machine/315904 "2022-10-13T03:49:10Z")
Hey guys, I am trying to get the stack up and running, but I am having some trouble with Fleet. My first question is.. does Fleet need to be installed on its own VM, or can it be installed on the same one as elasticsearc… --- ## [Elasticsearch version for master and data node](https://discuss.elastic.co/t/elasticsearch-version-for-master-and-data-node/316480)
**Author:** [@Wan\_Nur\_Athirah\_Wan](https://discuss.elastic.co/u/Wan_Nur_Athirah_Wan)\ **Replies:** 0\ **Last updated:** [October 13, 2022, 3:27am UTC](https://discuss.elastic.co/t/elasticsearch-version-for-master-and-data-node/316480 "2022-10-13T03:27:59Z")
Hai. I have one urgent question where below here is my concern: my client have his own master server where he claimed node and master need to be in same version in order to make Elasticsearch works. do the version nee… --- ## [CircuitBreakingException\[\[fielddata\] Data too large, data for \[\_id\] would be \[3105987990/2.8gb\],](https://discuss.elastic.co/t/circuitbreakingexception-fielddata-data-too-large-data-for-id-would-be-3105987990-2-8gb/316423)
**Author:** [@sasvmware](https://discuss.elastic.co/u/sasvmware)\ **Replies:** 2\ **Last updated:** [October 13, 2022, 2:10am UTC](https://discuss.elastic.co/t/circuitbreakingexception-fielddata-data-too-large-data-for-id-would-be-3105987990-2-8gb/316423 "2022-10-13T02:10:56Z")
Hi team, Getting below error while executing query through api. But query is working fine with postman and kibana. \[2022-10-12T02:09:20,323\]\[WARN \]\[o.e.i.b.fielddata \] \[cpq-xxxx-xxxmd1.xxxxxx.com\] \[fielddata\] Ne… --- ## [How do I copy and modify a schema?](https://discuss.elastic.co/t/how-do-i-copy-and-modify-a-schema/316477)
**Author:** [@wpm](https://discuss.elastic.co/u/wpm)\ **Replies:** 1\ **Last updated:** [October 13, 2022, 12:59am UTC](https://discuss.elastic.co/t/how-do-i-copy-and-modify-a-schema/316477 "2022-10-13T00:59:06Z")
I indexed a bunch of documents and let Elastic automatically pick the field types. It got some of them right and some of them wrong. (e.g. a field is keyword when it should be string and vice versa). My documents have ma… --- ## [More like this query term questions](https://discuss.elastic.co/t/more-like-this-query-term-questions/316163)
**Author:** [@catmanjan](https://discuss.elastic.co/u/catmanjan)\ **Replies:** 1\ **Last updated:** [October 13, 2022, 12:41am UTC](https://discuss.elastic.co/t/more-like-this-query-term-questions/316163 "2022-10-13T00:41:47Z")
We are using the More like this query and we have some questions about its operation (I have read this page More like this query | Elasticsearch Guide \[8.4\] | Elastic) max\_query\_terms: The maximum number of query terms … --- ## [Keystore in Elastic Cloud](https://discuss.elastic.co/t/keystore-in-elastic-cloud/316459)
**Author:** [@rlperry](https://discuss.elastic.co/u/rlperry)\ **Replies:** 1\ **Last updated:** [October 13, 2022, 12:04am UTC](https://discuss.elastic.co/t/keystore-in-elastic-cloud/316459 "2022-10-13T00:04:38Z")
Secrets keystore for secure settings | Logstash Reference \[8.4\] | Elastic outlines how to use environment variables inside pipelines and how to create and maintain a Keystore in the path.settings directory. How does one… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=763) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=765)