# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=766 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 767 --- ## [Match and replace in logstash](https://discuss.elastic.co/t/match-and-replace-in-logstash/316406)
**Author:** [@tegerei](https://discuss.elastic.co/u/tegerei)\ **Replies:** 1\ **Last updated:** [October 12, 2022, 7:21am UTC](https://discuss.elastic.co/t/match-and-replace-in-logstash/316406 "2022-10-12T07:21:54Z")
Hello, I have a setup where I collect PfSense VPN logs and pass them through Logstash to extract some fields. My VPN logs have LDAP usernames such as doejo, which implies the full name of John Doe. Now I need the logs … --- ## [Fleet enroll error unknown resource](https://discuss.elastic.co/t/fleet-enroll-error-unknown-resource/316402)
**Author:** [@Alexej\_Gerstmaier](https://discuss.elastic.co/u/Alexej_Gerstmaier)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 6:59am UTC](https://discuss.elastic.co/t/fleet-enroll-error-unknown-resource/316402 "2022-10-12T06:59:51Z")
I have the same problem as this guy: Elastic-agent install: Unknown resource --- ## [Is any Java client V7 working with ES V8?](https://discuss.elastic.co/t/is-any-java-client-v7-working-with-es-v8/316325)
**Author:** [@Eduardo\_Montes](https://discuss.elastic.co/u/Eduardo_Montes)\ **Replies:** 3\ **Last updated:** [October 12, 2022, 6:56am UTC](https://discuss.elastic.co/t/is-any-java-client-v7-working-with-es-v8/316325 "2022-10-12T06:56:26Z")
Hello, I'm trying to make upgrade from ES V6 to V8. Unfortunately I have to use Java 8 only (on client side). I found out that compatible (it means supported) Java 8 client (TransportClient) for ES V8 is also V7.17.6. … --- ## [Policy is not getting applied to the particular index in elastic](https://discuss.elastic.co/t/policy-is-not-getting-applied-to-the-particular-index-in-elastic/316399)
**Author:** [@AnandRajalingam](https://discuss.elastic.co/u/AnandRajalingam)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 6:39am UTC](https://discuss.elastic.co/t/policy-is-not-getting-applied-to-the-particular-index-in-elastic/316399 "2022-10-12T06:39:08Z")
We have upgraded our elastic from 6.xxx to 7.17.15 version recently. Our elastic policy was working fine in the old instances but not working in the new server. Please find below steps which are performed while creating… --- ## [Logstash service discover\_files {:count=\>0}](https://discuss.elastic.co/t/logstash-service-discover-files-count-0/316376)
**Author:** [@fantastas](https://discuss.elastic.co/u/fantastas)\ **Replies:** 5\ **Last updated:** [October 12, 2022, 6:33am UTC](https://discuss.elastic.co/t/logstash-service-discover-files-count-0/316376 "2022-10-12T06:33:30Z")
hello, i have an issue i can't figure out. I am also not sure how logstash sincedb\_path works too so if someone could help me understand - I'd highly appreciate. I am running ELK on RedHat Linux virtual machine. If i … --- ## [Is Rolling restart documentation correct?](https://discuss.elastic.co/t/is-rolling-restart-documentation-correct/316338)
**Author:** [@landychev](https://discuss.elastic.co/u/landychev)\ **Replies:** 2\ **Last updated:** [October 12, 2022, 6:33am UTC](https://discuss.elastic.co/t/is-rolling-restart-documentation-correct/316338 "2022-10-12T06:33:05Z")
I have read the documentation for rolling restart at. and more about cluster.routing.allocation.enable What i am confused about is step 7, Re-enable shard allocation . Why would you set it to null when the default v… --- ## [Read data from postgres and calling external api in Logstash](https://discuss.elastic.co/t/read-data-from-postgres-and-calling-external-api-in-logstash/316398)
**Author:** [@mani7](https://discuss.elastic.co/u/mani7)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 6:28am UTC](https://discuss.elastic.co/t/read-data-from-postgres-and-calling-external-api-in-logstash/316398 "2022-10-12T06:28:19Z")
I am looking forward to read data from Postgres using Logstash, taking one value as a input to call one external api. and taking the output results of that. And storing into elastic. Can anyone tell what all can be the … --- ## [Full Text Search Force Find All Tokens](https://discuss.elastic.co/t/full-text-search-force-find-all-tokens/316215)
**Author:** [@Saeed\_Mozaffari](https://discuss.elastic.co/u/Saeed_Mozaffari)\ **Replies:** 4\ **Last updated:** [October 12, 2022, 6:24am UTC](https://discuss.elastic.co/t/full-text-search-force-find-all-tokens/316215 "2022-10-12T06:24:22Z")
I try to implement full text search. I have a question related to this subject. I want to at search time, when i search a text, for example "Hello Saeed", return result only when all tokens of that text exist in a mess… --- ## [Condition filter not working after upgrading to logstash8](https://discuss.elastic.co/t/condition-filter-not-working-after-upgrading-to-logstash8/316300)
**Author:** [@PIYUSH\_MISHRA1](https://discuss.elastic.co/u/PIYUSH_MISHRA1)\ **Replies:** 5\ **Last updated:** [October 12, 2022, 5:35am UTC](https://discuss.elastic.co/t/condition-filter-not-working-after-upgrading-to-logstash8/316300 "2022-10-12T05:35:52Z")
Hi Team, I have following configuration in my logstash.conf file. irresepective of the value in ${ENV}, always else block is getting executed. Same piece of code used to work with logstash older versions (2.X and 6.x)… --- ## [Filebeat modules via Logstash?](https://discuss.elastic.co/t/filebeat-modules-via-logstash/316307)
**Author:** [@dygland](https://discuss.elastic.co/u/dygland)\ **Replies:** 2\ **Last updated:** [October 12, 2022, 5:20am UTC](https://discuss.elastic.co/t/filebeat-modules-via-logstash/316307 "2022-10-12T05:20:55Z")
Hello! TLDR: How do we setup and update module dashboards and pipelines without connectivity between filebeat and Kibana/ES hosts directly? Long version: We're using Filebeat without direct access to ES nor Kibana, ev… --- ## [Aws ecs filebeat log collection stops when the application containers are restarted](https://discuss.elastic.co/t/aws-ecs-filebeat-log-collection-stops-when-the-application-containers-are-restarted/311832)
**Author:** [@vaseem\_tt](https://discuss.elastic.co/u/vaseem_tt)\ **Replies:** 6\ **Last updated:** [October 12, 2022, 5:07am UTC](https://discuss.elastic.co/t/aws-ecs-filebeat-log-collection-stops-when-the-application-containers-are-restarted/311832 "2022-10-12T05:07:45Z")
We collect the logs of the container of our java application on ecs with the container of Filebeat. When any one or multiple container in the AWS ECS intance restart continously, filebeat container stops pushing logs to… --- ## [Documentation for Monitoring Elasticsearch with Metricbeat is outdated](https://discuss.elastic.co/t/documentation-for-monitoring-elasticsearch-with-metricbeat-is-outdated/315804)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 1\ **Last updated:** [October 12, 2022, 2:54am UTC](https://discuss.elastic.co/t/documentation-for-monitoring-elasticsearch-with-metricbeat-is-outdated/315804 "2022-10-12T02:54:20Z")
Hello, I've created a new production cluster on 8.4 and a new monitoring cluster as well, following the documentation to configure monitoring using metricbeat there is this step: Set xpack.monitoring.collection.enable… --- ## [Monitoring indexes size is increasing](https://discuss.elastic.co/t/monitoring-indexes-size-is-increasing/315935)
**Author:** [@harijld](https://discuss.elastic.co/u/harijld)\ **Replies:** 1\ **Last updated:** [October 12, 2022, 2:52am UTC](https://discuss.elastic.co/t/monitoring-indexes-size-is-increasing/315935 "2022-10-12T02:52:19Z")
HI Team, I am facing disk slowness issue in our non prod environment when we process some huge data. when i verified indexes. .monitoring index is also increasing continuously whenever we insert data into actual index. … --- ## [Must\_not with exists query on nested object returns excluded field](https://discuss.elastic.co/t/must-not-with-exists-query-on-nested-object-returns-excluded-field/316289)
**Author:** [@myx](https://discuss.elastic.co/u/myx)\ **Replies:** 1\ **Last updated:** [October 12, 2022, 2:45am UTC](https://discuss.elastic.co/t/must-not-with-exists-query-on-nested-object-returns-excluded-field/316289 "2022-10-12T02:45:36Z")
Hi all, I am querying using search API and tried a query using must\_not exists to get documents where there is no list of emails in a group within a class. However, it still returns documents with email\_list inside the g… --- ## [Aggregation is not working occasionally](https://discuss.elastic.co/t/aggregation-is-not-working-occasionally/316392)
**Author:** [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 2:01am UTC](https://discuss.elastic.co/t/aggregation-is-not-working-occasionally/316392 "2022-10-12T02:01:15Z")
Hi, I'm using Elasticsearch 7.16.2 and posting query by Dev Tools of Kibana 7.16.2. I got strange results from an aggregation query. When I repeat completely the same query: GET ss-mix2\_omp-01\_active/\_search { "siz… --- ## [Filebeat module enable](https://discuss.elastic.co/t/filebeat-module-enable/316389)
**Author:** [@gunlomboy](https://discuss.elastic.co/u/gunlomboy)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 12:19am UTC](https://discuss.elastic.co/t/filebeat-module-enable/316389 "2022-10-12T00:19:05Z")
Hi, Does anyone know if the "filebeat module enable" command does anything other than remove the .disabled from the file name? I am deploying via Ansible, so would like to just rename/overwrite the file without running… --- ## [Logstash with the cloud version / "Could not connect to a compatible version of Elasticsearch\>, "](https://discuss.elastic.co/t/logstash-with-the-cloud-version-could-not-connect-to-a-compatible-version-of-elasticsearch/316363)
**Author:** [@LeoCP](https://discuss.elastic.co/u/LeoCP)\ **Replies:** 2\ **Last updated:** [October 11, 2022, 9:18pm UTC](https://discuss.elastic.co/t/logstash-with-the-cloud-version-could-not-connect-to-a-compatible-version-of-elasticsearch/316363 "2022-10-11T21:18:19Z")
Greeting, I am evaluating the cloud version of Elasticsearch, and I want to mount some test data, using logstash (version 8.4.3), but I get an error telling me the following: "Could not connect to a compatible version… --- ## [Elasticsearch, Kibana, Apache-Nifi](https://discuss.elastic.co/t/elasticsearch-kibana-apache-nifi/316382)
**Author:** [@sytherin](https://discuss.elastic.co/u/sytherin)\ **Replies:** 0\ **Last updated:** [October 11, 2022, 8:49pm UTC](https://discuss.elastic.co/t/elasticsearch-kibana-apache-nifi/316382 "2022-10-11T20:49:35Z")
Hi! so I am trying to build a log with Apache Nifi and send it to Elasticsearch, and Kibana on ubuntu. After downloading the Apache Nifi, i ran the \ to verify he integrity of the files, i got \ **Author:** [@matled](https://discuss.elastic.co/u/matled)\ **Replies:** 2\ **Last updated:** [October 11, 2022, 7:38pm UTC](https://discuss.elastic.co/t/osquery-view-in-discover-issue/315367 "2022-10-11T19:38:56Z") We are running Elastic-Stack 8.4.2 (All components, inclusive the agents) and started to use Osquery. It is a great technology, however there are some problems we've encountered: Displaying the Data in Discover with the… --- ## [Elasticsearch Search Query](https://discuss.elastic.co/t/elasticsearch-search-query/316372)
**Author:** [@Ankita\_Pachauri](https://discuss.elastic.co/u/Ankita_Pachauri)\ **Replies:** 0\ **Last updated:** [October 11, 2022, 7:09pm UTC](https://discuss.elastic.co/t/elasticsearch-search-query/316372 "2022-10-11T19:09:49Z")
Hi Team, I have written a DSL Query as shown below: GET metricbeat\*/\_search { "size": 0, "aggs": { "hosts": { "terms": { "field": "agent.hostname", "size": "100", "order": { "memory": "desc" } }, "aggs": { … --- ## [Continous Alerting without rules](https://discuss.elastic.co/t/continous-alerting-without-rules/316207)
**Author:** [@OmFJ](https://discuss.elastic.co/u/OmFJ)\ **Replies:** 1\ **Last updated:** [October 11, 2022, 6:49pm UTC](https://discuss.elastic.co/t/continous-alerting-without-rules/316207 "2022-10-11T18:49:58Z")
Good evening, everyone. So i just enabled alert rules and connectors to send {{context.reason}} in elasticsearch 8.4. since we know alert only triggers when the requirements are met, is there anyway i could do to send … --- ## [How to set the max file size to unlimited in windows 10?](https://discuss.elastic.co/t/how-to-set-the-max-file-size-to-unlimited-in-windows-10/316366)
**Author:** [@JamesD\_7](https://discuss.elastic.co/u/JamesD_7)\ **Replies:** 0\ **Last updated:** [October 11, 2022, 6:30pm UTC](https://discuss.elastic.co/t/how-to-set-the-max-file-size-to-unlimited-in-windows-10/316366 "2022-10-11T18:30:03Z")
I'm ingesting a single CSV file in ES 8.4 using Kibana, but I found I hit the maximum size limit of 100k rows and had to split the file in two. I saw in the docs that you can set this file: /etc/security/limits.conf usi… --- ## [Multiple syslog input into logstash](https://discuss.elastic.co/t/multiple-syslog-input-into-logstash/316360)
**Author:** [@kazishafiullah](https://discuss.elastic.co/u/kazishafiullah)\ **Replies:** 2\ **Last updated:** [October 11, 2022, 5:24pm UTC](https://discuss.elastic.co/t/multiple-syslog-input-into-logstash/316360 "2022-10-11T17:24:27Z")
Hello, I wanted to parse logs of network devices into logstash. I have configured individual pipeline for cisco and paloalto. I have configured the input as syslog with different ports and output to different index name… --- ## [Filter on Aggragted Result](https://discuss.elastic.co/t/filter-on-aggragted-result/316315)
**Author:** [@ahmet\_erkol](https://discuss.elastic.co/u/ahmet_erkol)\ **Replies:** 1\ **Last updated:** [October 11, 2022, 5:24pm UTC](https://discuss.elastic.co/t/filter-on-aggragted-result/316315 "2022-10-11T17:24:23Z")
Hi, We made a map layer that calculates the average of success. We want to filter the map based on the succes rate. For example we want to show geo fileds only succes rate higher than %70. In the picture we want to fil… --- ## [org.elasticsearch.action.admin.indices.exists.indices.IndicesExistsResponse deprecated in 8.x](https://discuss.elastic.co/t/org-elasticsearch-action-admin-indices-exists-indices-indicesexistsresponse-deprecated-in-8-x/316332)
**Author:** [@Pachidermus](https://discuss.elastic.co/u/Pachidermus)\ **Replies:** 2\ **Last updated:** [October 11, 2022, 5:16pm UTC](https://discuss.elastic.co/t/org-elasticsearch-action-admin-indices-exists-indices-indicesexistsresponse-deprecated-in-8-x/316332 "2022-10-11T17:16:34Z")
Hi, org.elasticsearch.action.admin.indices.exists.indices.IndicesExistsResponse was available in 7.x but no longer in 8.x. What is the replacement for this API (needed to update a plugin to support 8.x)? Thanks. --- ## [Why "View single document" is "button" tag in HTML and not a "a" tag with URL?](https://discuss.elastic.co/t/why-view-single-document-is-button-tag-in-html-and-not-a-a-tag-with-url/315583)
**Author:** [@bryancev](https://discuss.elastic.co/u/bryancev)\ **Replies:** 2\ **Last updated:** [October 11, 2022, 5:04pm UTC](https://discuss.elastic.co/t/why-view-single-document-is-button-tag-in-html-and-not-a-a-tag-with-url/315583 "2022-10-11T17:04:14Z")
Hi all! Why in Kibana version 8.1.2 the "View single document" document view is implemented via the button tag? This is extremely inconvenient, since I would like to open documents in a new tab by clicking the mouse wh… --- ## [Spring + ElasticSearch - How to bulk create or update document with autogenerated string \_id/id](https://discuss.elastic.co/t/spring-elasticsearch-how-to-bulk-create-or-update-document-with-autogenerated-string-id-id/316352)
**Author:** [@Java2avaj](https://discuss.elastic.co/u/Java2avaj)\ **Replies:** 1\ **Last updated:** [October 11, 2022, 4:49pm UTC](https://discuss.elastic.co/t/spring-elasticsearch-how-to-bulk-create-or-update-document-with-autogenerated-string-id-id/316352 "2022-10-11T16:49:00Z")
currently, we are forcing the \_id of the Elasticsearch documents by setting the id field. This simplifies the design, as it allows to perform updates and/or creation of new documents without previously knowing whether a … --- ## [Filebeat doesn't resolve variable set for kubernetes pod](https://discuss.elastic.co/t/filebeat-doesnt-resolve-variable-set-for-kubernetes-pod/316356)
**Author:** [@jmandrive](https://discuss.elastic.co/u/jmandrive)\ **Replies:** 0\ **Last updated:** [October 11, 2022, 4:03pm UTC](https://discuss.elastic.co/t/filebeat-doesnt-resolve-variable-set-for-kubernetes-pod/316356 "2022-10-11T16:03:24Z")
Dears, I want to customize index as per the environment (prod, dev , ...), the filebeat couldn't substitue the value of "kubernetes.labels.env" and put instead "na" The index definiton inside output section in filebea… --- ## [Filebeat Error creating runner from config: failed to initialize condition](https://discuss.elastic.co/t/filebeat-error-creating-runner-from-config-failed-to-initialize-condition/316351)
**Author:** [@juliana\_cg](https://discuss.elastic.co/u/juliana_cg)\ **Replies:** 0\ **Last updated:** [October 11, 2022, 3:37pm UTC](https://discuss.elastic.co/t/filebeat-error-creating-runner-from-config-failed-to-initialize-condition/316351 "2022-10-11T15:37:39Z")
Hello, Got Filebeat installed as a daemonset in Kubernetes cluster, to collect logs from different pods using hint autodiscovery. On filebeat logs we have plenty of errors of this type: ERROR \[autodiscover\] cfg… --- ## [Collapse not working with search\_after with single sort field and PIT](https://discuss.elastic.co/t/collapse-not-working-with-search-after-with-single-sort-field-and-pit/316165)
**Author:** [@Reese\_Allison](https://discuss.elastic.co/u/Reese_Allison)\ **Replies:** 1\ **Last updated:** [October 11, 2022, 3:30pm UTC](https://discuss.elastic.co/t/collapse-not-working-with-search-after-with-single-sort-field-and-pit/316165 "2022-10-11T15:30:06Z")
I have an Elastic query that initially returns results. When I attempt the query again using search\_after for paging, I am getting the error: Cannot use \[collapse\] in conjunction with \[search\_after\] unless the search is … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=765) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=767)