# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=765 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 766 --- ## [Unreasonable search returns](https://discuss.elastic.co/t/unreasonable-search-returns/315062)
**Author:** [@Leroy\_Livingston](https://discuss.elastic.co/u/Leroy_Livingston)\ **Replies:** 7\ **Last updated:** [October 12, 2022, 10:43pm UTC](https://discuss.elastic.co/t/unreasonable-search-returns/315062 "2022-10-12T22:43:24Z")
I'm getting different results for specific search terms where if I search over a large number of fields it returns the correct number of items, but if I search over a smaller number of fields it returns a different numbe… --- ## [Elasticsearch stateless roadmap](https://discuss.elastic.co/t/elasticsearch-stateless-roadmap/316306)
**Author:** [@Nirdoc](https://discuss.elastic.co/u/Nirdoc)\ **Replies:** 0\ **Last updated:** [October 11, 2022, 9:35am UTC](https://discuss.elastic.co/t/elasticsearch-stateless-roadmap/316306 "2022-10-11T09:35:01Z")
Reading this recently published blog post I wonder how was this indexing improvement achieved. I have two main questions: What kind of storage was used for the stateful cluster? Was it network based storage or local SS… --- ## [Restoring Kibana related indices and users in 7.17?](https://discuss.elastic.co/t/restoring-kibana-related-indices-and-users-in-7-17/316433)
**Author:** [@NetwarSystem](https://discuss.elastic.co/u/NetwarSystem)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 11:57am UTC](https://discuss.elastic.co/t/restoring-kibana-related-indices-and-users-in-7-17/316433 "2022-10-12T11:57:47Z")
I have a system running Elasticsearch and Kibana 7.17.6. This is a single host with roughly 600 million items in 300 indices. The host OS is Ubuntu 22.04. Earlier today a clumsy rsync command on my part stepped on some … --- ## [Error Starting Kibana 8.4.3 Onpremise](https://discuss.elastic.co/t/error-starting-kibana-8-4-3-onpremise/316454)
**Author:** [@LeoCP](https://discuss.elastic.co/u/LeoCP)\ **Replies:** 2\ **Last updated:** [October 12, 2022, 9:26pm UTC](https://discuss.elastic.co/t/error-starting-kibana-8-4-3-onpremise/316454 "2022-10-12T21:26:50Z")
respectful greeting, I am evaluating the onpremise version of elasticsearch & Kibana 8.4.3 on windows 10, starting Elasticsearch, it works ok, I can see it http://localhost:9200/...... but when I try to run kibana. I ge… --- ## [How can I collect Palo Alto firewall metrics (CPU, RAM, Disk usage)](https://discuss.elastic.co/t/how-can-i-collect-palo-alto-firewall-metrics-cpu-ram-disk-usage/316097)
**Author:** [@shortone](https://discuss.elastic.co/u/shortone)\ **Replies:** 1\ **Last updated:** [October 12, 2022, 6:52pm UTC](https://discuss.elastic.co/t/how-can-i-collect-palo-alto-firewall-metrics-cpu-ram-disk-usage/316097 "2022-10-12T18:52:42Z")
Hello! I've recently setup the elastic agent on an intermediate host, I have syslog forwarding from our palo alto firewall to this host which is then shipping to elasticsearch and the palo alto integration seems to be w… --- ## [Group regex while search](https://discuss.elastic.co/t/group-regex-while-search/316461)
**Author:** [@Indeed2000](https://discuss.elastic.co/u/Indeed2000)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 6:09pm UTC](https://discuss.elastic.co/t/group-regex-while-search/316461 "2022-10-12T18:09:27Z")
Hi I have log file that contain lines like this: 08:00:00.032 user parameter: A\[0\]B\[0\]C: Action successful. How can i extract A value, B value while searching with regular expression. FYI:i don't want to change a… --- ## [Why logstash merge index of 3 different config?](https://discuss.elastic.co/t/why-logstash-merge-index-of-3-different-config/316450)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 2\ **Last updated:** [October 12, 2022, 4:12pm UTC](https://discuss.elastic.co/t/why-logstash-merge-index-of-3-different-config/316450 "2022-10-12T16:12:07Z")
i ve 3 config but i see the 3 index is similar why ? all index contais info all 3 index this is my type config is different for path and name index in \*\* lines input { file { \*\*path =\> \[ "/logstash\_dir/fede… --- ## [Best solution for Aggregation SUM without losing precision](https://discuss.elastic.co/t/best-solution-for-aggregation-sum-without-losing-precision/316448)
**Author:** [@SooperTee](https://discuss.elastic.co/u/SooperTee)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 3:35pm UTC](https://discuss.elastic.co/t/best-solution-for-aggregation-sum-without-losing-precision/316448 "2022-10-12T15:35:44Z")
Hi All, I think maybe similar subject was brought up here before, however, I was not able to find a satisfactory answer from the past posts in this forum. So I create a post of my own. I would like to state the constra… --- ## [Filebeat-Apache Module- Nodata](https://discuss.elastic.co/t/filebeat-apache-module-nodata/314977)
**Author:** [@emmanuel\_stevens\_LED](https://discuss.elastic.co/u/emmanuel_stevens_LED)\ **Replies:** 5\ **Last updated:** [October 12, 2022, 3:27pm UTC](https://discuss.elastic.co/t/filebeat-apache-module-nodata/314977 "2022-10-12T15:27:56Z")
Hello, I configure filebeat in my system, the probleme is, whaen i configure the modure system , i receive all datas and graphic, it is not the same for apache. We donot receive anaything I have enable the module and c… --- ## [Performance bottleneck enriching documents due to only a single node processing the ingest pipelines](https://discuss.elastic.co/t/performance-bottleneck-enriching-documents-due-to-only-a-single-node-processing-the-ingest-pipelines/315950)
**Author:** [@JvSPV](https://discuss.elastic.co/u/JvSPV)\ **Replies:** 6\ **Last updated:** [October 12, 2022, 3:24pm UTC](https://discuss.elastic.co/t/performance-bottleneck-enriching-documents-due-to-only-a-single-node-processing-the-ingest-pipelines/315950 "2022-10-12T15:24:03Z")
We have a cluster of 4 nodes: A, B, C, and D. All four have all default roles assigned, including the ingest role. We also have a separate master node. We have recently put new ingest pipelines into use with which we en… --- ## [Logstash cut line why?](https://discuss.elastic.co/t/logstash-cut-line-why/316440)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 4\ **Last updated:** [October 12, 2022, 2:51pm UTC](https://discuss.elastic.co/t/logstash-cut-line-why/316440 "2022-10-12T14:51:06Z")
i have this secotion of logs 2022-09-28 16:19:49,383 ERROR \[it.unidoc.cdr.core.route.Iti41MllpSource\] (TcpSocketConsumerRunnable\[mllp://0.0.0.0:9010\] - /192.168.0.7:56372 =\> /192.168.0.32:9010) Conversion error: ca.uhn… --- ## [Enrich execution takes long time (about 3 min)](https://discuss.elastic.co/t/enrich-execution-takes-long-time-about-3-min/316390)
**Author:** [@hyungsun\_lim](https://discuss.elastic.co/u/hyungsun_lim)\ **Replies:** 2\ **Last updated:** [October 12, 2022, 2:15pm UTC](https://discuss.elastic.co/t/enrich-execution-takes-long-time-about-3-min/316390 "2022-10-12T14:15:02Z")
We use elasticsearch 7.5.0 version, and we use enrich pipelint to join two index every 15 min. However, enrich execution time takes about 3-5 min. It's so long time... I don't know the exact cause. What is the altern… --- ## [Kibana 8.4.2 dashboard date filter not working in firefox](https://discuss.elastic.co/t/kibana-8-4-2-dashboard-date-filter-not-working-in-firefox/316437)
**Author:** [@Jonas\_S](https://discuss.elastic.co/u/Jonas_S)\ **Replies:** 1\ **Last updated:** [October 12, 2022, 2:04pm UTC](https://discuss.elastic.co/t/kibana-8-4-2-dashboard-date-filter-not-working-in-firefox/316437 "2022-10-12T14:04:42Z")
Hello, when i try to add a filter for a date field with the add filter menu in firefox, the date given is not recognized. In chrome it works fine. I type for example 1.1.22, press tab and the date is there: Trying … --- ## [Can I convert a string column type to a timestamp?](https://discuss.elastic.co/t/can-i-convert-a-string-column-type-to-a-timestamp/316385)
**Author:** [@wpm](https://discuss.elastic.co/u/wpm)\ **Replies:** 1\ **Last updated:** [October 12, 2022, 1:38pm UTC](https://discuss.elastic.co/t/can-i-convert-a-string-column-type-to-a-timestamp/316385 "2022-10-12T13:38:06Z")
I ingested a bunch of documents. They have a property "time" containing strings of the form "2015-01-20 07:52:05.013047". I let Elastic automatically detect the data types and it treated "time" as a string. The schema ha… --- ## [Warning : regular expression has redundant nested repeat operator](https://discuss.elastic.co/t/warning-regular-expression-has-redundant-nested-repeat-operator/316436)
**Author:** [@PM75](https://discuss.elastic.co/u/PM75)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 12:26pm UTC](https://discuss.elastic.co/t/warning-regular-expression-has-redundant-nested-repeat-operator/316436 "2022-10-12T12:26:51Z")
Hello, After an update to version 8.4.3, I have this warning: regular expression has redundant nested repeat operator I took the time to search for it, but no post was found: \[ES 7.6\] regular expression has redundant… --- ## [I can't use the bulk function on my centos8](https://discuss.elastic.co/t/i-cant-use-the-bulk-function-on-my-centos8/316361)
**Author:** [@Vitoria\_De\_Lara](https://discuss.elastic.co/u/Vitoria_De_Lara)\ **Replies:** 1\ **Last updated:** [October 12, 2022, 12:17pm UTC](https://discuss.elastic.co/t/i-cant-use-the-bulk-function-on-my-centos8/316361 "2022-10-12T12:17:47Z")
{ "error" : { "root\_cause" : \[ { "type" : "illegal\_argument\_exception", "reason" : "Malformed action/metadata line \[3\], expected START\_OBJECT or END\_OBJECT but found \[VALUE\_STRING\]" } \], "type" : "illegal\_argumen… --- ## [How to properly close a connection in a Java API Client?](https://discuss.elastic.co/t/how-to-properly-close-a-connection-in-a-java-api-client/314995)
**Author:** [@jacksparrow414](https://discuss.elastic.co/u/jacksparrow414)\ **Replies:** 5\ **Last updated:** [October 12, 2022, 11:58am UTC](https://discuss.elastic.co/t/how-to-properly-close-a-connection-in-a-java-api-client/314995 "2022-10-12T11:58:10Z")
Configuration Sample Code @ApplicationScoped public class ElasticSearchConfiguration { private static ElasticsearchClient client; private static synchronized void connectElasticSearchCluster() { if (Ob… --- ## [Lucene query for string containing # (hash symbol)](https://discuss.elastic.co/t/lucene-query-for-string-containing-hash-symbol/316429)
**Author:** [@ykara84](https://discuss.elastic.co/u/ykara84)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 11:28am UTC](https://discuss.elastic.co/t/lucene-query-for-string-containing-hash-symbol/316429 "2022-10-12T11:28:42Z")
How to query in Lucene for strings containing special characters such as @ and # for example #rescheduled i.e. it has to have the # in front of the word and not just the word itself, currently getting: Tried all sorts o… --- ## [Enrich processor time range](https://discuss.elastic.co/t/enrich-processor-time-range/316070)
**Author:** [@Marcin\_Frankiewicz](https://discuss.elastic.co/u/Marcin_Frankiewicz)\ **Replies:** 4\ **Last updated:** [October 12, 2022, 11:02am UTC](https://discuss.elastic.co/t/enrich-processor-time-range/316070 "2022-10-12T11:02:51Z")
Hi, i have a pipeline with enrich processor. When enriching is called.. what time range is used for enrich? All documents in index(defined in enrich policy) will be scanned? or maybe from last 15minutes? Elasticsearc… --- ## [What's the Lucene equivalent of KQL query: now/d](https://discuss.elastic.co/t/whats-the-lucene-equivalent-of-kql-query-now-d/316230)
**Author:** [@ykara84](https://discuss.elastic.co/u/ykara84)\ **Replies:** 3\ **Last updated:** [October 12, 2022, 10:58am UTC](https://discuss.elastic.co/t/whats-the-lucene-equivalent-of-kql-query-now-d/316230 "2022-10-12T10:58:21Z")
Hi I'm trying to filter my data based on a date field to show me everything for today, in Kibana I can use the KQL query using now/d but I need the equivalent for Lucene, any help? I wouldve thought it'd be the same but… --- ## [Debug slow search query](https://discuss.elastic.co/t/debug-slow-search-query/316265)
**Author:** [@Icy\_Goose](https://discuss.elastic.co/u/Icy_Goose)\ **Replies:** 1\ **Last updated:** [October 12, 2022, 10:45am UTC](https://discuss.elastic.co/t/debug-slow-search-query/316265 "2022-10-12T10:45:35Z")
Hi everyone, I'm trying to debug a slow search query in Elasticsearch. Per-shard activities seems healthy but total amount to complete the request is surprisingly high. As I understand, the profile API does not include t… --- ## [Missing Data Nodes on Cluster Monitoring of Kibana](https://discuss.elastic.co/t/missing-data-nodes-on-cluster-monitoring-of-kibana/314546)
**Author:** [@wonderland14](https://discuss.elastic.co/u/wonderland14)\ **Replies:** 10\ **Last updated:** [October 12, 2022, 10:11am UTC](https://discuss.elastic.co/t/missing-data-nodes-on-cluster-monitoring-of-kibana/314546 "2022-10-12T10:11:10Z")
A pleasant day everyone! I have this issue on my Kibana Cluster Monitoring, it happens that my data nodes are missing and only the monitoring nodes is there. I checked the config xpack.monitoring.collection.enabled : tr… --- ## [Elastic agent behind NAT](https://discuss.elastic.co/t/elastic-agent-behind-nat/316424)
**Author:** [@krzychohoho](https://discuss.elastic.co/u/krzychohoho)\ **Replies:** 1\ **Last updated:** [October 12, 2022, 10:05am UTC](https://discuss.elastic.co/t/elastic-agent-behind-nat/316424 "2022-10-12T10:05:45Z")
Hi, I came across some issues while trying to install elastic-agent. The case is I have a fleet server with elastic and kibana on local machine with local IP adres. The problem is that i need to deploy elastic agent on a… --- ## [MYSQL to Elasticsearch via Logstash Problem: incompatible encodings: CP850 and UTF-8](https://discuss.elastic.co/t/mysql-to-elasticsearch-via-logstash-problem-incompatible-encodings-cp850-and-utf-8/314122)
**Author:** [@engineer86](https://discuss.elastic.co/u/engineer86)\ **Replies:** 5\ **Last updated:** [October 12, 2022, 9:57am UTC](https://discuss.elastic.co/t/mysql-to-elasticsearch-via-logstash-problem-incompatible-encodings-cp850-and-utf-8/314122 "2022-10-12T09:57:45Z")
I am using an elk stack via docker-compose with ES version 8.4.0 My goal is to use Logstash to copy an entire table from my MYSQL DB to ES. The connection works and Logstash copies about 30 entries with no problems. But… --- ## [\[Filebeat\]\[xpack\]\[httpjson\] - OAuth2 use without client secret and with url params is not possible](https://discuss.elastic.co/t/filebeat-xpack-httpjson-oauth2-use-without-client-secret-and-with-url-params-is-not-possible/314691)
**Author:** [@p-leh](https://discuss.elastic.co/u/p-leh)\ **Replies:** 8\ **Last updated:** [October 12, 2022, 9:33am UTC](https://discuss.elastic.co/t/filebeat-xpack-httpjson-oauth2-use-without-client-secret-and-with-url-params-is-not-possible/314691 "2022-10-12T09:33:32Z")
The xpack input module httpjson for filebeat can handle the OAuth2 process. We want to use httpjson against a cloud foundry setup which is not possible. The problem comes up because on two hard coded contraints: the "… --- ## [Filebeat Input Azure Event Hub Private Endpoint](https://discuss.elastic.co/t/filebeat-input-azure-event-hub-private-endpoint/316422)
**Author:** [@Erylis](https://discuss.elastic.co/u/Erylis)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 9:18am UTC](https://discuss.elastic.co/t/filebeat-input-azure-event-hub-private-endpoint/316422 "2022-10-12T09:18:24Z")
Hello, I'm trying to connect filebeat with an azure eventhub using a private endpoint. The connection doesn't work properly because of a certificate issue : 2022-10-11T09:06:38.358+0200 ERROR \[azure-eventhub input… --- ## [Elastic-agent communication error](https://discuss.elastic.co/t/elastic-agent-communication-error/316418)
**Author:** [@Mohsin\_Ashraf](https://discuss.elastic.co/u/Mohsin_Ashraf)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 8:18am UTC](https://discuss.elastic.co/t/elastic-agent-communication-error/316418 "2022-10-12T08:18:54Z")
hi, When I tried to enrol elastic-agent, it was successfully enrolled but after a few time, it give me this error I tried to resolve this but was not able to resolve this error. if anyone has a solution to this please h… --- ## [Logstash http\_poller "read time out" on http 200 response](https://discuss.elastic.co/t/logstash-http-poller-read-time-out-on-http-200-response/316416)
**Author:** [@Marc\_Hoog](https://discuss.elastic.co/u/Marc_Hoog)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 8:11am UTC](https://discuss.elastic.co/t/logstash-http-poller-read-time-out-on-http-200-response/316416 "2022-10-12T08:11:33Z")
So I got this pipeline in logstash using http\_poller and it works when the client is responding with a 401, but It breaks when it responses with a 200 with a little bit of data. These request also do work with curl from… --- ## [Date histogram that doesn't look at the entire date bucket?](https://discuss.elastic.co/t/date-histogram-that-doesnt-look-at-the-entire-date-bucket/316415)
**Author:** [@netzer](https://discuss.elastic.co/u/netzer)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 8:06am UTC](https://discuss.elastic.co/t/date-histogram-that-doesnt-look-at-the-entire-date-bucket/316415 "2022-10-12T08:06:33Z")
I'm wondering if the following is possible. I have events with metrics sent every 10 minutes, so when I create a dashboard looking at the past 15 minutes I can see the "latest status". I can also do a "SUM" of a field o… --- ## [Enrolling fleet using FQDN certificates](https://discuss.elastic.co/t/enrolling-fleet-using-fqdn-certificates/316328)
**Author:** [@krzychohoho](https://discuss.elastic.co/u/krzychohoho)\ **Replies:** 2\ **Last updated:** [October 12, 2022, 7:35am UTC](https://discuss.elastic.co/t/enrolling-fleet-using-fqdn-certificates/316328 "2022-10-12T07:35:15Z")
Hi, I came across some issues during installation of fleet server. First of all i need the server to run on FQDn rather than on IP adress. So I started with generating certificates using dns instead of IP. The command … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=764) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=766)