# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=774 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 775 --- ## [Plugins on multi-node cluster](https://discuss.elastic.co/t/plugins-on-multi-node-cluster/315821)
**Author:** [@danskiyq](https://discuss.elastic.co/u/danskiyq)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 8:38pm UTC](https://discuss.elastic.co/t/plugins-on-multi-node-cluster/315821 "2022-10-04T20:38:39Z")
If I want to upgrade or push custom plugins on multi node cluster, eg. 1 master, 3 data/inject nodes. Do I have to do it on one of the nodes using bin/opensearch-plugins and it will synchronise automatically or I have to… --- ## [Elastic Search Update Operation not working when using nodejs client](https://discuss.elastic.co/t/elastic-search-update-operation-not-working-when-using-nodejs-client/315811)
**Author:** [@Atul\_Joshi1](https://discuss.elastic.co/u/Atul_Joshi1)\ **Replies:** 2\ **Last updated:** [October 4, 2022, 7:17pm UTC](https://discuss.elastic.co/t/elastic-search-update-operation-not-working-when-using-nodejs-client/315811 "2022-10-04T19:17:33Z")
I am updating the existing document in Elasticsearch by below update query. const result = await client.update({ index, id, body: { script: { lang: "painless", … --- ## [How can I increase the size of bytes that a log can have?](https://discuss.elastic.co/t/how-can-i-increase-the-size-of-bytes-that-a-log-can-have/315702)
**Author:** [@erwin339](https://discuss.elastic.co/u/erwin339)\ **Replies:** 9\ **Last updated:** [October 4, 2022, 6:16pm UTC](https://discuss.elastic.co/t/how-can-i-increase-the-size-of-bytes-that-a-log-can-have/315702 "2022-10-04T18:16:02Z")
I need help, I am receiving a log of 1300 lines, I am receiving a parse error, for this I did tests and these logs were significantly reduced and with that the error disappears since what I am removing does not affect th… --- ## [Using JSON filter to expand the field created by terms aggregation in transform](https://discuss.elastic.co/t/using-json-filter-to-expand-the-field-created-by-terms-aggregation-in-transform/315759)
**Author:** [@Hemabh\_Ravee\_Fox](https://discuss.elastic.co/u/Hemabh_Ravee_Fox)\ **Replies:** 2\ **Last updated:** [October 4, 2022, 12:25pm UTC](https://discuss.elastic.co/t/using-json-filter-to-expand-the-field-created-by-terms-aggregation-in-transform/315759 "2022-10-04T12:25:02Z")
I am using transforms to aggregate a field event by terms so I get a count for each event for all sessionIds. This seems to be working fine and I get a JSON string as a new field events. But i can't query for the individ… --- ## [Rollover "Transform" indices](https://discuss.elastic.co/t/rollover-transform-indices/315799)
**Author:** [@Otto\_F](https://discuss.elastic.co/u/Otto_F)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 4:29pm UTC](https://discuss.elastic.co/t/rollover-transform-indices/315799 "2022-10-04T16:29:56Z")
Hi all, Is any way to rollover for "Transform" indices? If I use ILM policy, I'm getting error: "illegal\_argument\_exception: index.lifecycle.rollover\_alias \[test-summary\] does not point to index \[test-summary\]". Templa… --- ## [NoClassDef org.apache.lucene.util.Version](https://discuss.elastic.co/t/noclassdef-org-apache-lucene-util-version/315787)
**Author:** [@aaron-mcgrath](https://discuss.elastic.co/u/aaron-mcgrath)\ **Replies:** 6\ **Last updated:** [October 4, 2022, 3:22pm UTC](https://discuss.elastic.co/t/noclassdef-org-apache-lucene-util-version/315787 "2022-10-04T15:22:28Z")
I'm using the java client 7.17.6, with gradle to build the project; implementation ("co.elastic.clients:elasticsearch-java:$elasticVersion") implementation ("org.elasticsearch:elasticsearch-x-content:$elasticVersion") G… --- ## [Log4j2.properties doubt](https://discuss.elastic.co/t/log4j2-properties-doubt/315796)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 3:11pm UTC](https://discuss.elastic.co/t/log4j2-properties-doubt/315796 "2022-10-04T15:11:54Z")
Hello! does elasticsearch keep any change in log4j2.properties until a restart ? im changing Logging to delete the logs by time not by size: appender.rolling.strategy.action.condition.nested\_condition.type = IfLastMod… --- ## [Mutate convert multiple fields at once](https://discuss.elastic.co/t/mutate-convert-multiple-fields-at-once/315730)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 3:09pm UTC](https://discuss.elastic.co/t/mutate-convert-multiple-fields-at-once/315730 "2022-10-04T15:09:58Z")
Hello, can i mutate convert multiple fields to a data type at once, without putting it one by one? something like: filter{ mutate{ convert(\["someField1","someField2","someField3"\] =\> "integer") } } I have a lar… --- ## [Shipping Logs out of Elasticsearch](https://discuss.elastic.co/t/shipping-logs-out-of-elasticsearch/315786)
**Author:** [@secopsgeek](https://discuss.elastic.co/u/secopsgeek)\ **Replies:** 4\ **Last updated:** [October 4, 2022, 3:09pm UTC](https://discuss.elastic.co/t/shipping-logs-out-of-elasticsearch/315786 "2022-10-04T15:09:06Z")
Morning, I am trying to figure out a way to ship my elasticseach logs from one location to another syslog system. Is there a way for me to configure Elastic to handle shipping out a certain Index of log to another syslo… --- ## [Metricbeat is getting failed when we enable aws metricbeat moulde](https://discuss.elastic.co/t/metricbeat-is-getting-failed-when-we-enable-aws-metricbeat-moulde/315434)
**Author:** [@samadhan](https://discuss.elastic.co/u/samadhan)\ **Replies:** 2\ **Last updated:** [October 4, 2022, 3:07pm UTC](https://discuss.elastic.co/t/metricbeat-is-getting-failed-when-we-enable-aws-metricbeat-moulde/315434 "2022-10-04T15:07:32Z")
Hi Team, We have installed ELK monitoring with following beats version metricbeat version 7.9.0 (amd64), libbeat 7.9.0 \[b2ee705fc4a59c023136c046803b56bc82a16c8d built 2020-08-11 19:30:31 +0000 UTC\] packetbeat version p… --- ## [Handling unmapped fields with Suggest feature](https://discuss.elastic.co/t/handling-unmapped-fields-with-suggest-feature/314937)
**Author:** [@schawla](https://discuss.elastic.co/u/schawla)\ **Replies:** 3\ **Last updated:** [October 4, 2022, 2:36pm UTC](https://discuss.elastic.co/t/handling-unmapped-fields-with-suggest-feature/314937 "2022-10-04T14:36:45Z")
I am trying to implement suggest feature - Suggest Usage | Elasticsearch .NET Client \[8.4\] | Elastic for handling misspelled words in my search implementation. My search query is executed across multiple indices but whi… --- ## [Sql query with like in "elasticSearch Sql" bugs?](https://discuss.elastic.co/t/sql-query-with-like-in-elasticsearch-sql-bugs/315621)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 17\ **Last updated:** [October 4, 2022, 2:22pm UTC](https://discuss.elastic.co/t/sql-query-with-like-in-elasticsearch-sql-bugs/315621 "2022-10-04T14:22:41Z")
i' ve simple query but not have resulset with SELECT \* FROM "errors\_prima\*" where message like '%fiscal%' (sorry is closed on test not is the problem) but if use SELECT \* FROM "errors\_prima\*" where message like '%… --- ## [Body size limitation for webhook in watcher](https://discuss.elastic.co/t/body-size-limitation-for-webhook-in-watcher/315779)
**Author:** [@JohnJ\_M](https://discuss.elastic.co/u/JohnJ_M)\ **Replies:** 0\ **Last updated:** [October 4, 2022, 1:45pm UTC](https://discuss.elastic.co/t/body-size-limitation-for-webhook-in-watcher/315779 "2022-10-04T13:45:09Z")
I have seen a similar request in the forum but without answers so I try my luck: Where can we found the size limitation of the body in the Webhook action of a watcher. I noticed that it seems 1900 char or so on our inst… --- ## [How to include a field value in message body of EMAIL action in Rules and Connectors?](https://discuss.elastic.co/t/how-to-include-a-field-value-in-message-body-of-email-action-in-rules-and-connectors/314209)
**Author:** [@subash](https://discuss.elastic.co/u/subash)\ **Replies:** 2\ **Last updated:** [October 4, 2022, 1:44pm UTC](https://discuss.elastic.co/t/how-to-include-a-field-value-in-message-body-of-email-action-in-rules-and-connectors/314209 "2022-10-04T13:44:56Z")
I want to include only specific fields in the message body of email action. When using the {{context.hits}} it is returning the whole document. But I want to include only specific fields from the document. Thanks in adv… --- ## [How can I encrypt the data stored in indexes?](https://discuss.elastic.co/t/how-can-i-encrypt-the-data-stored-in-indexes/315691)
**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\ **Replies:** 5\ **Last updated:** [October 4, 2022, 1:32pm UTC](https://discuss.elastic.co/t/how-can-i-encrypt-the-data-stored-in-indexes/315691 "2022-10-04T13:32:25Z")
Hi, I am developing my own external custom plugin in React. And I am planning to store personal information of customers and their inventory data as well in Elasticsearch, in addition to logging data. I am planning to … --- ## [Using scroll for very large indices](https://discuss.elastic.co/t/using-scroll-for-very-large-indices/315776)
**Author:** [@SFarhanizade](https://discuss.elastic.co/u/SFarhanizade)\ **Replies:** 0\ **Last updated:** [October 4, 2022, 1:20pm UTC](https://discuss.elastic.co/t/using-scroll-for-very-large-indices/315776 "2022-10-04T13:20:25Z")
Hi. There is an index having arround 200 million documents. I want to scroll over all its documents, so I prefered to use sliced scroll to do so, but every time I use scroll for this index, after some minutes of getting … --- ## [How to get a single count only per document when using nested term aggregation?](https://discuss.elastic.co/t/how-to-get-a-single-count-only-per-document-when-using-nested-term-aggregation/315774)
**Author:** [@binoiii](https://discuss.elastic.co/u/binoiii)\ **Replies:** 0\ **Last updated:** [October 4, 2022, 12:59pm UTC](https://discuss.elastic.co/t/how-to-get-a-single-count-only-per-document-when-using-nested-term-aggregation/315774 "2022-10-04T12:59:17Z")
Mapping "work\_rights": { "type": "nested", "properties": { "country\_tid": { "type": "keyword" }, "work\_right\_type": { "properties": { "tid": { "type": "keyword" } … --- ## [Amazon\_s3\_exception when trying to create repo, even though it still creates test folder](https://discuss.elastic.co/t/amazon-s3-exception-when-trying-to-create-repo-even-though-it-still-creates-test-folder/315728)
**Author:** [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)\ **Replies:** 2\ **Last updated:** [October 4, 2022, 12:23pm UTC](https://discuss.elastic.co/t/amazon-s3-exception-when-trying-to-create-repo-even-though-it-still-creates-test-folder/315728 "2022-10-04T12:23:42Z")
Hi getting the below error, but the funny thing is there's a test folder created in the bucker. For example: tests--v15dKjeS5uBICtqKNVEdg/ and the master.dat file is inside. { "type": "s3", "settings": { "bucket… --- ## [Elasticsearch cluster \[6.8\] becomes unresponsive for a small duration when one of the nodes in the cluster does not respond to any requests & is not part of the cluster. Is this the expected behaviour?](https://discuss.elastic.co/t/elasticsearch-cluster-6-8-becomes-unresponsive-for-a-small-duration-when-one-of-the-nodes-in-the-cluster-does-not-respond-to-any-requests-is-not-part-of-the-cluster-is-this-the-expected-behaviour/315421)
**Author:** [@srivatsa](https://discuss.elastic.co/u/srivatsa)\ **Replies:** 4\ **Last updated:** [October 4, 2022, 11:54am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-6-8-becomes-unresponsive-for-a-small-duration-when-one-of-the-nodes-in-the-cluster-does-not-respond-to-any-requests-is-not-part-of-the-cluster-is-this-the-expected-behaviour/315421 "2022-10-04T11:54:19Z")
Hi Folks, The observation in our ES cluster (6.8 version) consisting of 40 nodes is that when any one of the nodes becomes unresponsive, especially in scenarios where the thread pools on the machine are full & rejection… --- ## [Filter first match only using Grok or ruby code](https://discuss.elastic.co/t/filter-first-match-only-using-grok-or-ruby-code/315758)
**Author:** [@rootk1d](https://discuss.elastic.co/u/rootk1d)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 11:52am UTC](https://discuss.elastic.co/t/filter-first-match-only-using-grok-or-ruby-code/315758 "2022-10-04T11:52:44Z")
I have a field that contains the following data "REQUEST-941-APPLICATION-ATTACK-XSS, REQUEST-941-APPLICATION-ATTACK-XSS, REQUEST-941-APPLICATION-ATTACK-XSS, REQUEST-942-APPLICATION-ATTACK-SQLI, REQUEST-949-BLOCKING-EVAL… --- ## [Help on getting query to count avg, min and max nestings](https://discuss.elastic.co/t/help-on-getting-query-to-count-avg-min-and-max-nestings/315768)
**Author:** [@sreekanth](https://discuss.elastic.co/u/sreekanth)\ **Replies:** 0\ **Last updated:** [October 4, 2022, 11:10am UTC](https://discuss.elastic.co/t/help-on-getting-query-to-count-avg-min-and-max-nestings/315768 "2022-10-04T11:10:04Z")
I have an index with one nested field. Some docs have 10 nested docs and a few may have thousands of nested docs. I want to find the average/min and max count of nested items count across the index. Sample data: in thi… --- ## [Logstash Cloudwatch Input Plugin](https://discuss.elastic.co/t/logstash-cloudwatch-input-plugin/314694)
**Author:** [@connectgeeks](https://discuss.elastic.co/u/connectgeeks)\ **Replies:** 2\ **Last updated:** [October 4, 2022, 11:09am UTC](https://discuss.elastic.co/t/logstash-cloudwatch-input-plugin/314694 "2022-10-04T11:09:23Z")
Hi I'm using input cloudwatch plugin for aws cloudwatch ingestion using logstash. I want to reingest the entire data now. How can I achieve that ? Also, where (path) logstash keeps the registry file to maintain the seq… --- ## [Helm chart - logstash elasticsearch connection configuration?](https://discuss.elastic.co/t/helm-chart-logstash-elasticsearch-connection-configuration/315756)
**Author:** [@tirelibirefe](https://discuss.elastic.co/u/tirelibirefe)\ **Replies:** 0\ **Last updated:** [October 4, 2022, 9:34am UTC](https://discuss.elastic.co/t/helm-chart-logstash-elasticsearch-connection-configuration/315756 "2022-10-04T09:34:01Z")
Hello, I installed Logstash by using Helm Chart here and need to configure Elasticsearch connection. I looked for documentation but couldn't have found... How can I configure elasticsearch connection? Thanks & Regar… --- ## [Sort performance since elastic 7.16](https://discuss.elastic.co/t/sort-performance-since-elastic-7-16/315740)
**Author:** [@vjgorla](https://discuss.elastic.co/u/vjgorla)\ **Replies:** 0\ **Last updated:** [October 4, 2022, 6:51am UTC](https://discuss.elastic.co/t/sort-performance-since-elastic-7-16/315740 "2022-10-04T06:51:43Z")
A query that sorts by a keyword field that we have been using on elastic 7.13.2 now performs quite badly on 8.4.1. There is no change to the query or mappings. Only change is the elastic version. This query is crucial i… --- ## [Configuration for shipping Docker logs to a locally installed Logstash](https://discuss.elastic.co/t/configuration-for-shipping-docker-logs-to-a-locally-installed-logstash/315725)
**Author:** [@Chma](https://discuss.elastic.co/u/Chma)\ **Replies:** 0\ **Last updated:** [October 3, 2022, 10:27pm UTC](https://discuss.elastic.co/t/configuration-for-shipping-docker-logs-to-a-locally-installed-logstash/315725 "2022-10-03T22:27:30Z")
I have my ELK deployed on an ec2 instance and a dockerized application running on a different instance. I am trying to use gelf to collect the different service logs and send to logstash. But my current configuration doe… --- ## [Data management](https://discuss.elastic.co/t/data-management/315371)
**Author:** [@Juanfer](https://discuss.elastic.co/u/Juanfer)\ **Replies:** 2\ **Last updated:** [October 4, 2022, 8:27am UTC](https://discuss.elastic.co/t/data-management/315371 "2022-10-04T08:27:12Z")
Hi there, I have a question regarding the organization in Kibana. Since I am a beginner I want to understand the scope and best practices for my data storage in there. I will have 3 datasets which at some point I will li… --- ## [Elasticsearch Group By](https://discuss.elastic.co/t/elasticsearch-group-by/315360)
**Author:** [@Ashish\_Grover](https://discuss.elastic.co/u/Ashish_Grover)\ **Replies:** 4\ **Last updated:** [October 4, 2022, 7:48am UTC](https://discuss.elastic.co/t/elasticsearch-group-by/315360 "2022-10-04T07:48:19Z")
Hi i want to convert this sql query to elasticsearch " Select field1,field2,field3,field4 From myTable Group By field1; " I want group by on field1 and on the basis of this i want field2, field3, and field4 --- ## [Date diff elasticsearch wrong?](https://discuss.elastic.co/t/date-diff-elasticsearch-wrong/315745)
**Author:** [@robocon20x](https://discuss.elastic.co/u/robocon20x)\ **Replies:** 0\ **Last updated:** [October 4, 2022, 7:18am UTC](https://discuss.elastic.co/t/date-diff-elasticsearch-wrong/315745 "2022-10-04T07:18:36Z")
Hi everyone, i found a different between datediff function on my ES and phoenix,trino. when use SQL below my ES return 4 while phoenix and trino return 5. How this different could happened? POST \_sql?format=json { … --- ## [Trouble with nginx logs - filebeat configured but seeing gork error](https://discuss.elastic.co/t/trouble-with-nginx-logs-filebeat-configured-but-seeing-gork-error/315381)
**Author:** [@sunil106](https://discuss.elastic.co/u/sunil106)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 7:03am UTC](https://discuss.elastic.co/t/trouble-with-nginx-logs-filebeat-configured-but-seeing-gork-error/315381 "2022-10-04T07:03:02Z")
having trouble with parsing nginx logs. I am using nginx and running filebeat to push nginx logs directly to elasticsearch This are nginx caching servers that has following log format nginx log format log\_format cach… --- ## [Method with @async annotation, not getting logged in APM for errors for spring application](https://discuss.elastic.co/t/method-with-async-annotation-not-getting-logged-in-apm-for-errors-for-spring-application/315741)
**Author:** [@Jawed-Aquib](https://discuss.elastic.co/u/Jawed-Aquib)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 7:00am UTC](https://discuss.elastic.co/t/method-with-async-annotation-not-getting-logged-in-apm-for-errors-for-spring-application/315741 "2022-10-04T07:00:52Z")
I have configured the java APM agent through the elastic.apm.service\_name config for my springboot application. When there is any error occurring for my method annotated with @Async the error form this isn't availble… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=773) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=775)