# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=769 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 770 --- ## [Group by query with select case when gives error: Connot use non-grouped column (Canvas elasticsearch sql)](https://discuss.elastic.co/t/group-by-query-with-select-case-when-gives-error-connot-use-non-grouped-column-canvas-elasticsearch-sql/315880)
**Author:** [@Houssam](https://discuss.elastic.co/u/Houssam)\ **Replies:** 4\ **Last updated:** [October 10, 2022, 7:04am UTC](https://discuss.elastic.co/t/group-by-query-with-select-case-when-gives-error-connot-use-non-grouped-column-canvas-elasticsearch-sql/315880 "2022-10-10T07:04:39Z")
Hello everyone I face a problem with a certain group by elasticsearch sql query when i try to use a field in select case condition but not group by it because it doubles my rows and leaves null values, i get the followin… --- ## [Not Able to see Indexes in Kibana, nor in logs of Elastic Search](https://discuss.elastic.co/t/not-able-to-see-indexes-in-kibana-nor-in-logs-of-elastic-search/316178)
**Author:** [@shivamec92](https://discuss.elastic.co/u/shivamec92)\ **Replies:** 0\ **Last updated:** [October 10, 2022, 6:48am UTC](https://discuss.elastic.co/t/not-able-to-see-indexes-in-kibana-nor-in-logs-of-elastic-search/316178 "2022-10-10T06:48:05Z")
This is the logs that i am getting from Debug mode of Elastic Search Authentication of \[elastic\] using realm \[reserved/reserved\] with token \[UsernamePasswordToken\] was \[AuthenticationResult{status=SUCCESS, value=User\[us… --- ## [Doubts about building a relationship master detail](https://discuss.elastic.co/t/doubts-about-building-a-relationship-master-detail/316170)
**Author:** [@abkrim](https://discuss.elastic.co/u/abkrim)\ **Replies:** 2\ **Last updated:** [October 10, 2022, 6:27am UTC](https://discuss.elastic.co/t/doubts-about-building-a-relationship-master-detail/316170 "2022-10-10T06:27:09Z")
Currently, I have an index that collects the logs of a series of control centers, and obtain from them the technical data of their electrical consumption, on and off status, and other kinds of data that allow me to know … --- ## [System.AggregateException: One or more errors occurred. ---\> Elasticsearch.Net.ElasticsearchClientException: The client is unable to verify that the server is Elasticsearch due to an unsuccessful product check call](https://discuss.elastic.co/t/system-aggregateexception-one-or-more-errors-occurred-elasticsearch-net-elasticsearchclientexception-the-client-is-unable-to-verify-that-the-server-is-elasticsearch-due-to-an-unsuccessful-product-check-call/315970)
**Author:** [@arulmani](https://discuss.elastic.co/u/arulmani)\ **Replies:** 2\ **Last updated:** [October 10, 2022, 6:00am UTC](https://discuss.elastic.co/t/system-aggregateexception-one-or-more-errors-occurred-elasticsearch-net-elasticsearchclientexception-the-client-is-unable-to-verify-that-the-server-is-elasticsearch-due-to-an-unsuccessful-product-check-call/315970 "2022-10-10T06:00:25Z")
The below specified two different errors are logged intermittently during the bulk delete operation on a 3 million data. The cron job to delete the records in bulk runs from 8 seconds to 15 seconds on every 2 minutes in… --- ## [Combine Metricbeat events into one with Logstash](https://discuss.elastic.co/t/combine-metricbeat-events-into-one-with-logstash/315896)
**Author:** [@bg4erem](https://discuss.elastic.co/u/bg4erem)\ **Replies:** 5\ **Last updated:** [October 10, 2022, 3:21am UTC](https://discuss.elastic.co/t/combine-metricbeat-events-into-one-with-logstash/315896 "2022-10-10T03:21:15Z")
Dear community I have spent several days trying to combine Metricbeat events into one with Logstash. I understand it should be done with the aggregate filter of Logstash. Still, I haven't figured it out. I use Logstas… --- ## [Dead letter queue not working with logtash output mongo](https://discuss.elastic.co/t/dead-letter-queue-not-working-with-logtash-output-mongo/316030)
**Author:** [@van\_le1](https://discuss.elastic.co/u/van_le1)\ **Replies:** 2\ **Last updated:** [October 10, 2022, 1:04am UTC](https://discuss.elastic.co/t/dead-letter-queue-not-working-with-logtash-output-mongo/316030 "2022-10-10T01:04:20Z")
Hi everyone, I intend to use dead letter queue on log event failure from sending log into mongodb use logtash. My config includes: logtash.yml http.host: "0.0.0.0" pipeline.batch.delay: 10 pipeline.batch.size: 10… --- ## [Openshift problem with logstash in other server](https://discuss.elastic.co/t/openshift-problem-with-logstash-in-other-server/316157)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 4\ **Last updated:** [October 9, 2022, 10:21pm UTC](https://discuss.elastic.co/t/openshift-problem-with-logstash-in-other-server/316157 "2022-10-09T22:21:44Z")
2022-10-09T19:03:48,320\]\[WARN \]\[logstash.outputs.elasticsearch\]\[openshift1\] Attempted to resurrect connection to dead ES instance, but got an error {:url=\>"http://elastichttp2-n-turri-dev.apps.sandbox-m2.ll9k.p1.openshif… --- ## [File Mirroring via FileBeat or Logstash](https://discuss.elastic.co/t/file-mirroring-via-filebeat-or-logstash/315973)
**Author:** [@shocko](https://discuss.elastic.co/u/shocko)\ **Replies:** 8\ **Last updated:** [October 9, 2022, 9:45pm UTC](https://discuss.elastic.co/t/file-mirroring-via-filebeat-or-logstash/315973 "2022-10-09T21:45:48Z")
I have the following use case for several directories containing log files: Tail these files and write out to another location with the same filename For example, our app is creating files names myapp\_.log and we need… --- ## [Force index rollover with a new index name](https://discuss.elastic.co/t/force-index-rollover-with-a-new-index-name/315983)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 2\ **Last updated:** [October 9, 2022, 8:35pm UTC](https://discuss.elastic.co/t/force-index-rollover-with-a-new-index-name/315983 "2022-10-09T20:35:05Z")
Hello, I was configured filebeat agent to send data directly to elasticsearch from multiples agent. afterwards I added the index to a have a problem with the rollover I added the index to the retention policy test0. T… --- ## [Scripted Field Help](https://discuss.elastic.co/t/scripted-field-help/316156)
**Author:** [@snkhan](https://discuss.elastic.co/u/snkhan)\ **Replies:** 11\ **Last updated:** [October 9, 2022, 6:44pm UTC](https://discuss.elastic.co/t/scripted-field-help/316156 "2022-10-09T18:44:40Z")
Hello, I am trying to use a scripted field to compare the value of one field against another. A sample document extract is below: Field1 C2\_Host: \["check.example.workers.dev"\] Field2 HostHeader: "Host: check.example.w… --- ## [Upgrade from 7.x to 8.4.1](https://discuss.elastic.co/t/upgrade-from-7-x-to-8-4-1/316027)
**Author:** [@Ravi\_S1](https://discuss.elastic.co/u/Ravi_S1)\ **Replies:** 3\ **Last updated:** [October 9, 2022, 2:36pm UTC](https://discuss.elastic.co/t/upgrade-from-7-x-to-8-4-1/316027 "2022-10-09T14:36:47Z")
After upgrade from 7.7.1 to 8.4.1, Kibana 8.4.1 is showing down.. "{"statusCode":503,"error":"Service Unavailable","message":"\[No shard available for \[get \[.kibana\_8.4.1\]\[space:default\]: routing \[null\]\]: no\_shard\_availab… --- ## [Elasticsearch Highlight the result of script fields](https://discuss.elastic.co/t/elasticsearch-highlight-the-result-of-script-fields/316121)
**Author:** [@AmirMohammad\_Safari](https://discuss.elastic.co/u/AmirMohammad_Safari)\ **Replies:** 2\ **Last updated:** [October 9, 2022, 2:11pm UTC](https://discuss.elastic.co/t/elasticsearch-highlight-the-result-of-script-fields/316121 "2022-10-09T14:11:19Z")
I write out an analyzer to remove the HTML tags in my search results, After that I thought I could highlight the results with a common query, But in the highlighting field I got other html contents that you removed with … --- ## [Switching from platinum to basic](https://discuss.elastic.co/t/switching-from-platinum-to-basic/315856)
**Author:** [@heric](https://discuss.elastic.co/u/heric)\ **Replies:** 4\ **Last updated:** [October 9, 2022, 1:32pm UTC](https://discuss.elastic.co/t/switching-from-platinum-to-basic/315856 "2022-10-09T13:32:20Z")
Hi, Unfortunately our elastic license is going to expired and not going to be extended. Right now i am using some features that is using license such as anomaly detection, SAML authentication and centralized pipeline. … --- ## [Merging two indexes by a column](https://discuss.elastic.co/t/merging-two-indexes-by-a-column/315163)
**Author:** [@Juanfer](https://discuss.elastic.co/u/Juanfer)\ **Replies:** 2\ **Last updated:** [October 9, 2022, 10:38am UTC](https://discuss.elastic.co/t/merging-two-indexes-by-a-column/315163 "2022-10-09T10:38:41Z")
Hello there, I am a beginner in Elasticsearch and I have been reading about how to merge 2 indexes based on two different names columns with the same values. I understand the NoSQL performance of elastic but still havin… --- ## [JSON with comma separated string to multiple tags](https://discuss.elastic.co/t/json-with-comma-separated-string-to-multiple-tags/315111)
**Author:** [@Ranger\_Rick](https://discuss.elastic.co/u/Ranger_Rick)\ **Replies:** 2\ **Last updated:** [October 9, 2022, 1:38am UTC](https://discuss.elastic.co/t/json-with-comma-separated-string-to-multiple-tags/315111 "2022-10-09T01:38:22Z")
Good evening! I really think this should be easy and straightforward but I am having a heck of a time with it so decided to ask the community. My pipeline accepts daily json files and splits it out and further enriches … --- ## [Showing only non-cleared events in a visualization](https://discuss.elastic.co/t/showing-only-non-cleared-events-in-a-visualization/316138)
**Author:** [@DirtyRaven](https://discuss.elastic.co/u/DirtyRaven)\ **Replies:** 0\ **Last updated:** [October 8, 2022, 9:27pm UTC](https://discuss.elastic.co/t/showing-only-non-cleared-events-in-a-visualization/316138 "2022-10-08T21:27:53Z")
I would like to make a visualization that only displays memory, CPU, and file system events. The trick is, I would like the visualization to only display these events if they are still over the threshold, but hosts wher… --- ## [List of Query DSL keywords and additional instructions](https://discuss.elastic.co/t/list-of-query-dsl-keywords-and-additional-instructions/316132)
**Author:** [@Michael\_Gattinger](https://discuss.elastic.co/u/Michael_Gattinger)\ **Replies:** 4\ **Last updated:** [October 8, 2022, 5:49pm UTC](https://discuss.elastic.co/t/list-of-query-dsl-keywords-and-additional-instructions/316132 "2022-10-08T17:49:22Z")
Hello, as i understood Query DSL has in line 1 of the Query spezial keywords that are not part of the JSON. JSON starts at line 2 of the Query and is only one JSON-Object accept BULK-Requests, where multiple JSON Object… --- ## [Conditional IF and ELIF in set processor](https://discuss.elastic.co/t/conditional-if-and-elif-in-set-processor/316123)
**Author:** [@tomx1](https://discuss.elastic.co/u/tomx1)\ **Replies:** 2\ **Last updated:** [October 8, 2022, 5:34pm UTC](https://discuss.elastic.co/t/conditional-if-and-elif-in-set-processor/316123 "2022-10-08T17:34:01Z")
I'm setting the value of a field named "customer" depending on the value of field "destination.ip" via ingest pipeline. Currently I'm using two independent Set processors via ingest pipeline for IPv4 and IPv6. But it wou… --- ## [Unable to Parse AVRO using Kafka Input and Avro Codec](https://discuss.elastic.co/t/unable-to-parse-avro-using-kafka-input-and-avro-codec/316133)
**Author:** [@mastersmit](https://discuss.elastic.co/u/mastersmit)\ **Replies:** 0\ **Last updated:** [October 8, 2022, 4:23pm UTC](https://discuss.elastic.co/t/unable-to-parse-avro-using-kafka-input-and-avro-codec/316133 "2022-10-08T16:23:09Z")
Hi, I am trying to use Kafka Input and Codec Avro, to read the messages but unable to do so. In Kafka, { "id": 5839355690199358000, "name": "VOH\*a|\[RF6y?" } In Logstash Output: "@timestamp" =\> 2022-10-08T14:… --- ## [Is Elastic Java Client actually communicating with Query DSL?](https://discuss.elastic.co/t/is-elastic-java-client-actually-communicating-with-query-dsl/316128)
**Author:** [@Michael\_Gattinger](https://discuss.elastic.co/u/Michael_Gattinger)\ **Replies:** 2\ **Last updated:** [October 8, 2022, 3:31pm UTC](https://discuss.elastic.co/t/is-elastic-java-client-actually-communicating-with-query-dsl/316128 "2022-10-08T15:31:55Z")
Hello, writing my master thesis. So a) if we are in Kibana we can open the dev console and type Query DSL (formatted in JSON) to send it to Elasticsearch. b) additionally we can send Query DSL (formatted in JSON) fro… --- ## [Elk on openshift server have limit?](https://discuss.elastic.co/t/elk-on-openshift-server-have-limit/316124)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 6\ **Last updated:** [October 8, 2022, 3:00pm UTC](https://discuss.elastic.co/t/elk-on-openshift-server-have-limit/316124 "2022-10-08T15:00:09Z")
hello i' ve mounted elk vers 7.16.2 but in console i see this logs \[2022-10-08T11:59:14,859\]\[ERROR\]\[logstash.licensechecker.licensereader\] Unable to retrieve license information from license server {:message=\>"No Avail… --- ## [Remove / using logstash filter](https://discuss.elastic.co/t/remove-using-logstash-filter/316106)
**Author:** [@Giridharan\_C](https://discuss.elastic.co/u/Giridharan_C)\ **Replies:** 3\ **Last updated:** [October 8, 2022, 1:52pm UTC](https://discuss.elastic.co/t/remove-using-logstash-filter/316106 "2022-10-08T13:52:32Z")
I used multiple mutate filters to remove the / in the message field, which is not working. Also, I want to parse these message fields into valid JSON. Please suggest and help. { "host" =\> "mylocalhost.mydomain.com", … --- ## [Store multiple values using ruby in multivalue field](https://discuss.elastic.co/t/store-multiple-values-using-ruby-in-multivalue-field/316059)
**Author:** [@bertr](https://discuss.elastic.co/u/bertr)\ **Replies:** 2\ **Last updated:** [October 8, 2022, 1:40pm UTC](https://discuss.elastic.co/t/store-multiple-values-using-ruby-in-multivalue-field/316059 "2022-10-08T13:40:57Z")
By nature all fields in elasticsearch are multivalue-enabled, i.e. they can have multiple values in one document. Using mutate filter it is easy to add multiple values, but I need to use ruby. I am trying to add multiple… --- ## [Handling changes between Kibana instances](https://discuss.elastic.co/t/handling-changes-between-kibana-instances/315640)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 2\ **Last updated:** [October 8, 2022, 11:25am UTC](https://discuss.elastic.co/t/handling-changes-between-kibana-instances/315640 "2022-10-08T11:25:14Z")
I have a dozen or so Kibans with the same basic configuration, but they differ slightly from one another (e.g. the selected queries are slightly altered). Is there a good option for handling this? What I have in mind, fo… --- ## [Elastic Search and Python pushing error](https://discuss.elastic.co/t/elastic-search-and-python-pushing-error/316105)
**Author:** [@Shashank02](https://discuss.elastic.co/u/Shashank02)\ **Replies:** 1\ **Last updated:** [October 8, 2022, 9:07am UTC](https://discuss.elastic.co/t/elastic-search-and-python-pushing-error/316105 "2022-10-08T09:07:33Z")
elasticsearch.BadRequestError: BadRequestError(400, 'illegal\_argument\_exception', 'Action/metadata line \[1\] contains an unknown parameter \[\_type\]') How do you resolve this error? I'm trying to push the data through my p… --- ## [Unable to Tessellate shape. Possible malformed shape detected](https://discuss.elastic.co/t/unable-to-tessellate-shape-possible-malformed-shape-detected/316122)
**Author:** [@baiwenbo1997](https://discuss.elastic.co/u/baiwenbo1997)\ **Replies:** 0\ **Last updated:** [October 8, 2022, 8:58am UTC](https://discuss.elastic.co/t/unable-to-tessellate-shape-possible-malformed-shape-detected/316122 "2022-10-08T08:58:21Z")
Why is this polygon judged to be a self-intersecting figure? If it is the accuracy problem that causes the judgment to be self-intersecting, how can I make the judgment during storage, or please tell me what is the accu… --- ## [Machine learning java api](https://discuss.elastic.co/t/machine-learning-java-api/316119)
**Author:** [@ericdwz](https://discuss.elastic.co/u/ericdwz)\ **Replies:** 0\ **Last updated:** [October 8, 2022, 8:05am UTC](https://discuss.elastic.co/t/machine-learning-java-api/316119 "2022-10-08T08:05:21Z")
Hi there, Is there any document or instruction on how to use the machine learning api in java? For example, how can I convert the following DSL into java POST /\_ml/trained\_models/bert-base-chinese/\_infer { "docs": {… --- ## [Action \[cluster:monitor/nodes/stats\[n\]\] timed out](https://discuss.elastic.co/t/action-cluster-monitor-nodes-stats-n-timed-out/312818)
**Author:** [@dukewrz](https://discuss.elastic.co/u/dukewrz)\ **Replies:** 8\ **Last updated:** [October 8, 2022, 6:56am UTC](https://discuss.elastic.co/t/action-cluster-monitor-nodes-stats-n-timed-out/312818 "2022-10-08T06:56:41Z")
I can't take the log file out. Logs says: Received response for a request that as timed out, sent \[xxx/xxx\] ago..... tells that a timeout occurred when the master tries to collecting node stats info from one particu… --- ## [Why I have log duplication when filebeat read rotating log files and stop filebeat for specific time manually and default close inactive reached](https://discuss.elastic.co/t/why-i-have-log-duplication-when-filebeat-read-rotating-log-files-and-stop-filebeat-for-specific-time-manually-and-default-close-inactive-reached/314663)
**Author:** [@alex\_petrov](https://discuss.elastic.co/u/alex_petrov)\ **Replies:** 6\ **Last updated:** [October 8, 2022, 4:58am UTC](https://discuss.elastic.co/t/why-i-have-log-duplication-when-filebeat-read-rotating-log-files-and-stop-filebeat-for-specific-time-manually-and-default-close-inactive-reached/314663 "2022-10-08T04:58:17Z")
I set filebeat to read logs from rotating logs (rotated when 5 mg is reached) and below is my config : - type: log fields: source: 'filebeat2' logID: logbackup fields\_under\_root: true enabled: true paths: - /… --- ## [Upgrading from ES 6.8 to 7.17 and got MasterNotDiscoveredException](https://discuss.elastic.co/t/upgrading-from-es-6-8-to-7-17-and-got-masternotdiscoveredexception/316108)
**Author:** [@jayp-glb](https://discuss.elastic.co/u/jayp-glb)\ **Replies:** 0\ **Last updated:** [October 7, 2022, 10:07pm UTC](https://discuss.elastic.co/t/upgrading-from-es-6-8-to-7-17-and-got-masternotdiscoveredexception/316108 "2022-10-07T22:07:02Z")
Hello community, In my Elasticsearch upgrade crazyness, I was finally able to reindex my old ES 5.0 cluster into 6.8, though with lots of adjustments because of the only one mapping per index rule, but I digress. I hav… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=768) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=770)