# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=771 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 772 --- ## [Service token causes index\_not\_found\_exception](https://discuss.elastic.co/t/service-token-causes-index-not-found-exception/315900)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 5\ **Last updated:** [October 6, 2022, 11:42pm UTC](https://discuss.elastic.co/t/service-token-causes-index-not-found-exception/315900 "2022-10-06T23:42:44Z")
I want to learn to use service tokens. I followed the instructions here: Specifically, I ran this command from bash CLI of the server 139.177.199.119 bin/elasticsearch-service-tokens create elastic/kibana my-token W… --- ## [COMPOSITE NESTED AGGREGATIONS](https://discuss.elastic.co/t/composite-nested-aggregations/316013)
**Author:** [@Vinicius\_Serafim](https://discuss.elastic.co/u/Vinicius_Serafim)\ **Replies:** 0\ **Last updated:** [October 6, 2022, 9:42pm UTC](https://discuss.elastic.co/t/composite-nested-aggregations/316013 "2022-10-06T21:42:12Z")
Hi, i hope that someone can help me. Supose that i have the following mapping to my index: PUT test-index { "mappings": { "properties": { "nestedOBJField": { "type": "nested", "index": true… --- ## [Grok pattern for suricata/barnyard alert in COMPLETE mode](https://discuss.elastic.co/t/grok-pattern-for-suricata-barnyard-alert-in-complete-mode/316009)
**Author:** [@mvrk](https://discuss.elastic.co/u/mvrk)\ **Replies:** 2\ **Last updated:** [October 6, 2022, 9:12pm UTC](https://discuss.elastic.co/t/grok-pattern-for-suricata-barnyard-alert-in-complete-mode/316009 "2022-10-06T21:12:37Z")
Hi, I have my suricata in pfsense sending the alerts using barnyard in COMPLETE mode to my greylog server. Example message: | \[SNORTIDS\[ALERT\]: \[pfsense.local\] \] || 2022-10-06 19:13:55.186+001 2 \[1:2403344:77870\] ET C… --- ## [Make Single output call with multiple events](https://discuss.elastic.co/t/make-single-output-call-with-multiple-events/315808)
**Author:** [@LJ\_LongWing](https://discuss.elastic.co/u/LJ_LongWing)\ **Replies:** 7\ **Last updated:** [October 6, 2022, 9:11pm UTC](https://discuss.elastic.co/t/make-single-output-call-with-multiple-events/315808 "2022-10-06T21:11:42Z")
I've done a few days of searching but can't find what I'm looking for....the closest I've found is this topic (How to aggregate multiple events into single output) I'll state that I'm starting with a functional pipeline… --- ## [Uptades to template not being applied](https://discuss.elastic.co/t/uptades-to-template-not-being-applied/315606)
**Author:** [@somatusjn](https://discuss.elastic.co/u/somatusjn)\ **Replies:** 9\ **Last updated:** [October 6, 2022, 6:25pm UTC](https://discuss.elastic.co/t/uptades-to-template-not-being-applied/315606 "2022-10-06T18:25:41Z")
I'm getting an error when trying to post a document. The error I think is that the format I used for a date property is incorrect. I initially used YYYY-MM-DD'T'hh:mm:ssZ, but since then I have made like 10 calls to upda… --- ## [8.4.3 canvas and sql problems](https://discuss.elastic.co/t/8-4-3-canvas-and-sql-problems/315986)
**Author:** [@Ibrahim\_Z\_HIDIR](https://discuss.elastic.co/u/Ibrahim_Z_HIDIR)\ **Replies:** 1\ **Last updated:** [October 6, 2022, 6:16pm UTC](https://discuss.elastic.co/t/8-4-3-canvas-and-sql-problems/315986 "2022-10-06T18:16:39Z")
Hi All After upgrade from 8.3.1 to 8.4.1 Canvas reveal images only displaying exclamation mark. I've tried many different ways to fix this but nothing worked. All my reveal images using sql like select case when count… --- ## [Invalid version of beats protocol integration with spring boot](https://discuss.elastic.co/t/invalid-version-of-beats-protocol-integration-with-spring-boot/315997)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 0\ **Last updated:** [October 6, 2022, 5:31pm UTC](https://discuss.elastic.co/t/invalid-version-of-beats-protocol-integration-with-spring-boot/315997 "2022-10-06T17:31:09Z")
i used a test with integrated log with spring-boot and logstash this is xml configuration \ \ \ **Author:** [@txmrlevine](https://discuss.elastic.co/u/txmrlevine)\ **Replies:** 6\ **Last updated:** [October 6, 2022, 4:30pm UTC](https://discuss.elastic.co/t/when-i-add-xpack-to-stack-it-is-not-working/314522 "2022-10-06T16:30:58Z") When trying to implement xpack on my stack I get an "error loading data" message in Cerebro and it does not let me login. when set to false all works - when set to true it does not. here is info on the stack { "nam… --- ## [Structure of document affect speed?](https://discuss.elastic.co/t/structure-of-document-affect-speed/315897)
**Author:** [@MaVa](https://discuss.elastic.co/u/MaVa)\ **Replies:** 1\ **Last updated:** [October 6, 2022, 4:23pm UTC](https://discuss.elastic.co/t/structure-of-document-affect-speed/315897 "2022-10-06T16:23:10Z")
I have a question out of curiosity. Does the structure of the document have any effect on the indexing and searching speed in an index? Would e.g. "user": { "id":"123", "first\_name":"John", "last\_n… --- ## [How to grok first line from an XML format](https://discuss.elastic.co/t/how-to-grok-first-line-from-an-xml-format/315877)
**Author:** [@anupvtr](https://discuss.elastic.co/u/anupvtr)\ **Replies:** 1\ **Last updated:** [October 6, 2022, 4:19pm UTC](https://discuss.elastic.co/t/how-to-grok-first-line-from-an-xml-format/315877 "2022-10-06T16:19:04Z")
Hi All, I am quite new to the magic world of Grok. Any help will be thankful. I need to apply filter for the following file. 2022-08-22 22:18:59 , 666 INFO @ (blockurcolumn-11) \[rbbit\_MQ\_Versa.appache 75\] start col… --- ## [Restoring snapshot from 5.0 into 6.8 for upgrades](https://discuss.elastic.co/t/restoring-snapshot-from-5-0-into-6-8-for-upgrades/315818)
**Author:** [@jayp-glb](https://discuss.elastic.co/u/jayp-glb)\ **Replies:** 3\ **Last updated:** [October 6, 2022, 4:18pm UTC](https://discuss.elastic.co/t/restoring-snapshot-from-5-0-into-6-8-for-upgrades/315818 "2022-10-06T16:18:07Z")
Hi community, and thanks for all the help you've given everyone for years and years. Today, I'm facing a very interesting situation. I'm finally going around on upgrading a quite old Elasticsearch 5.0 cluster hosted in… --- ## [Is there a way to merge two indices](https://discuss.elastic.co/t/is-there-a-way-to-merge-two-indices/315980)
**Author:** [@Dedsec0](https://discuss.elastic.co/u/Dedsec0)\ **Replies:** 1\ **Last updated:** [October 6, 2022, 4:17pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-merge-two-indices/315980 "2022-10-06T16:17:50Z")
Hi, I want to merge two indices( index 1, index 2) and make as one index( index 3), For instance : let say, I have index 1 and index 2 have matching fields like ... index 1 :(doc count 1) { "operation": "add", "ti… --- ## [Kafka-beats-logstash](https://discuss.elastic.co/t/kafka-beats-logstash/314902)
**Author:** [@emmanuel\_stevens\_LED](https://discuss.elastic.co/u/emmanuel_stevens_LED)\ **Replies:** 1\ **Last updated:** [October 6, 2022, 3:50pm UTC](https://discuss.elastic.co/t/kafka-beats-logstash/314902 "2022-10-06T15:50:42Z")
Hello, I have difficulties with a task. I received help from @stephenb to configure My ELKK, it works fine. https://discuss.elastic.co/t/metribeats-to-kafka-no-dashboard-appear-in-kibana/309688/15 My probleme is for t… --- ## [Kibana data table representaion](https://discuss.elastic.co/t/kibana-data-table-representaion/315988)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 1\ **Last updated:** [October 6, 2022, 3:22pm UTC](https://discuss.elastic.co/t/kibana-data-table-representaion/315988 "2022-10-06T15:22:40Z")
Hello All, I would like to dispaly the data as its shown below table. How can this be achieved best in kibana using enhanced/data table ? Here the challenge is the date fields are dynamice.Would have been only date fi… --- ## [Filter unstructured logs with filebeat before sending to logstash](https://discuss.elastic.co/t/filter-unstructured-logs-with-filebeat-before-sending-to-logstash/315960)
**Author:** [@Ihms](https://discuss.elastic.co/u/Ihms)\ **Replies:** 2\ **Last updated:** [October 6, 2022, 3:05pm UTC](https://discuss.elastic.co/t/filter-unstructured-logs-with-filebeat-before-sending-to-logstash/315960 "2022-10-06T15:05:40Z")
Hello, I'm new to Elasticsearch and have some questions. Filebeat is fetching way too many logs and for the sake of bandwidth, I want to filter the logs at the edge before sending to logstash. The logs don't have the s… --- ## [Remove backslash from xml log](https://discuss.elastic.co/t/remove-backslash-from-xml-log/315891)
**Author:** [@Jathurshan\_Sumandira](https://discuss.elastic.co/u/Jathurshan_Sumandira)\ **Replies:** 4\ **Last updated:** [October 6, 2022, 12:32pm UTC](https://discuss.elastic.co/t/remove-backslash-from-xml-log/315891 "2022-10-06T12:32:39Z")
\ I wanted to remove the backslashs ("\\") in above xml log-line and I have tried ruby { code =\> ' d= event.… --- ## [Best structure for easy/efficient searching of complex data](https://discuss.elastic.co/t/best-structure-for-easy-efficient-searching-of-complex-data/315990)
**Author:** [@EmaysHRT](https://discuss.elastic.co/u/EmaysHRT)\ **Replies:** 0\ **Last updated:** [October 6, 2022, 2:39pm UTC](https://discuss.elastic.co/t/best-structure-for-easy-efficient-searching-of-complex-data/315990 "2022-10-06T14:39:52Z")
I'm working on exporting result data from our configuration management system into Elasticsearch, so we can more easily understand failures across our fleet. Each run is composed of many "states" that are applied to a ma… --- ## [Can't connect to Elasticsearch at \:9200 - Logs don't show any errors](https://discuss.elastic.co/t/cant-connect-to-elasticsearch-at-publicip-9200-logs-dont-show-any-errors/315920)
**Author:** [@Chma](https://discuss.elastic.co/u/Chma)\ **Replies:** 12\ **Last updated:** [October 6, 2022, 1:53pm UTC](https://discuss.elastic.co/t/cant-connect-to-elasticsearch-at-publicip-9200-logs-dont-show-any-errors/315920 "2022-10-06T13:53:02Z")
This worked, thanks. I am running into a different issue. Elasticsearch status says it's active, but I can't connect at http://:9200. My elasticsearch logs doesn't show any issue. This is the yaml file which was working… --- ## [Watcher Aggregation returning null](https://discuss.elastic.co/t/watcher-aggregation-returning-null/315914)
**Author:** [@serena-skilljar](https://discuss.elastic.co/u/serena-skilljar)\ **Replies:** 1\ **Last updated:** [October 6, 2022, 2:20pm UTC](https://discuss.elastic.co/t/watcher-aggregation-returning-null/315914 "2022-10-06T14:20:40Z")
Hi there - We have a few watchers that were running successfully and suddenly started to error out. Can confirm that nothing was changed on our end. Watch (actions and transform ommited): { "trigger": { "schedul… --- ## [Elasticsearch Upgrade JVM Error](https://discuss.elastic.co/t/elasticsearch-upgrade-jvm-error/315928)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 0\ **Last updated:** [October 6, 2022, 3:31am UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-jvm-error/315928 "2022-10-06T03:31:38Z")
Trying to upgrade Elasticsearch from 8.2 to 8.4.3 running on Windows. I copied the config folder from the old version to the new one, adjusted file paths in elasticsearch.yml, deleted the old service, then ran elasticse… --- ## [Data loss when sending logs to Kibana through Filebeat](https://discuss.elastic.co/t/data-loss-when-sending-logs-to-kibana-through-filebeat/315926)
**Author:** [@xyu](https://discuss.elastic.co/u/xyu)\ **Replies:** 7\ **Last updated:** [October 6, 2022, 1:59pm UTC](https://discuss.elastic.co/t/data-loss-when-sending-logs-to-kibana-through-filebeat/315926 "2022-10-06T13:59:31Z")
Hi, I am new to elastic stalk and currently I am facing some difficulties to read all the logs in JSON format. {"code":"28000","file":"auth.c","length":164,"level":"error","line":"496","message":"no entry for host","na… --- ## [Filebeat setup: error loading index pattern: returned 413 to import file: invalid character ‘\<’ looking for beginning of value](https://discuss.elastic.co/t/filebeat-setup-error-loading-index-pattern-returned-413-to-import-file-invalid-character-looking-for-beginning-of-value/315329)
**Author:** [@Nick95](https://discuss.elastic.co/u/Nick95)\ **Replies:** 1\ **Last updated:** [October 6, 2022, 1:50pm UTC](https://discuss.elastic.co/t/filebeat-setup-error-loading-index-pattern-returned-413-to-import-file-invalid-character-looking-for-beginning-of-value/315329 "2022-10-06T13:50:49Z")
Hi, I try to run a filebeat on a server. Elastic and Kibana are installed on another server and are pushed on 443 port via a Nginx reverse proxy. Kibana GUI is working on the IP I set up (https with self-generated certi… --- ## [Snapshots with a shard failure](https://discuss.elastic.co/t/snapshots-with-a-shard-failure/315838)
**Author:** [@Nicolaegis](https://discuss.elastic.co/u/Nicolaegis)\ **Replies:** 4\ **Last updated:** [October 6, 2022, 12:33pm UTC](https://discuss.elastic.co/t/snapshots-with-a-shard-failure/315838 "2022-10-06T12:33:15Z")
Hello, I would like to know if a snapshot with a failed shard can be retried without restarting the whole process. Thank you --- ## [ElasticSearch 2-out-of-4 Master Replica goes down](https://discuss.elastic.co/t/elasticsearch-2-out-of-4-master-replica-goes-down/315840)
**Author:** [@roybalderama](https://discuss.elastic.co/u/roybalderama)\ **Replies:** 7\ **Last updated:** [October 6, 2022, 12:18pm UTC](https://discuss.elastic.co/t/elasticsearch-2-out-of-4-master-replica-goes-down/315840 "2022-10-06T12:18:52Z")
Hi, We bootstraped ELK Stack (in kubernetes using helm) to collect all the audit and application logs of the system. This has been running for almost a year now, and we were able to achieve the high-availability using t… --- ## [How to pass pagination to java scroll api](https://discuss.elastic.co/t/how-to-pass-pagination-to-java-scroll-api/315965)
**Author:** [@mahfuj\_asif](https://discuss.elastic.co/u/mahfuj_asif)\ **Replies:** 0\ **Last updated:** [October 6, 2022, 12:10pm UTC](https://discuss.elastic.co/t/how-to-pass-pagination-to-java-scroll-api/315965 "2022-10-06T12:10:40Z")
I am trying to fetch all data from elastic index with scroll id. SearchQuery searchQuery = new NativeSearchQueryBuilder() .withIndices(ELASTIC\_INDEX) .withTypes(DOC\_TYPE) … --- ## [Need to disable idle indices in logstash config](https://discuss.elastic.co/t/need-to-disable-idle-indices-in-logstash-config/315942)
**Author:** [@yasar](https://discuss.elastic.co/u/yasar)\ **Replies:** 0\ **Last updated:** [October 6, 2022, 8:53am UTC](https://discuss.elastic.co/t/need-to-disable-idle-indices-in-logstash-config/315942 "2022-10-06T08:53:33Z")
Hi team, In our TEST Environment, N number of indices are idle in position. Those are unwantedly roll back over itself. Could you giude us, what are the procedure to disable the unwanted indices in logstash config or s… --- ## [Sending logs to a previously created index using Custom Logs integration](https://discuss.elastic.co/t/sending-logs-to-a-previously-created-index-using-custom-logs-integration/315948)
**Author:** [@RP5](https://discuss.elastic.co/u/RP5)\ **Replies:** 0\ **Last updated:** [October 6, 2022, 9:24am UTC](https://discuss.elastic.co/t/sending-logs-to-a-previously-created-index-using-custom-logs-integration/315948 "2022-10-06T09:24:10Z")
I was using filebeat to send data to an index that I had created. (say indextest) Can I send data to the above index (indextest) using Elastic Agent Custom Logs Integration? Thank you --- ## [Anomaly score is changed after few days](https://discuss.elastic.co/t/anomaly-score-is-changed-after-few-days/315937)
**Author:** [@minkiyo](https://discuss.elastic.co/u/minkiyo)\ **Replies:** 1\ **Last updated:** [October 6, 2022, 8:28am UTC](https://discuss.elastic.co/t/anomaly-score-is-changed-after-few-days/315937 "2022-10-06T08:28:58Z")
I am confusing that anomaly score is changed after few days in anomaly explore. First of all, it seems that the anomaly itself is not a cross sign, so it is not a phenomenon for multi-bucket anomaly score. If the anoma… --- ## [Facing issue while starting logstash which connects with Maria Database](https://discuss.elastic.co/t/facing-issue-while-starting-logstash-which-connects-with-maria-database/315233)
**Author:** [@nawaz462](https://discuss.elastic.co/u/nawaz462)\ **Replies:** 2\ **Last updated:** [October 6, 2022, 8:25am UTC](https://discuss.elastic.co/t/facing-issue-while-starting-logstash-which-connects-with-maria-database/315233 "2022-10-06T08:25:23Z")
On linux server, i wanted to have ELK setup with MariaDB through Docker. I want to setup the Elastic search data with indexes for the maria DB tables from scratch and as well as for incremental changes sync. These are d… --- ## [Logstasg ERROR filewatch.tailmode.handlers.grow](https://discuss.elastic.co/t/logstasg-error-filewatch-tailmode-handlers-grow/315550)
**Author:** [@alex\_96](https://discuss.elastic.co/u/alex_96)\ **Replies:** 4\ **Last updated:** [October 6, 2022, 8:12am UTC](https://discuss.elastic.co/t/logstasg-error-filewatch-tailmode-handlers-grow/315550 "2022-10-06T08:12:57Z")
Hi, set up reading mysql logs from nfs using multiline codec and grok filter The first problem is that it doesn’t read the file after rotation, restarting doesn’t help, it still doesn’t seem to see it, there was an erro… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=770) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=772)