# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=787 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 788 --- ## [Elastic-Agent Upgrade missing Version number in Source URI when setting custom Repository](https://discuss.elastic.co/t/elastic-agent-upgrade-missing-version-number-in-source-uri-when-setting-custom-repository/314865)
**Author:** [@matled](https://discuss.elastic.co/u/matled)\ **Replies:** 0\ **Last updated:** [September 21, 2022, 12:19pm UTC](https://discuss.elastic.co/t/elastic-agent-upgrade-missing-version-number-in-source-uri-when-setting-custom-repository/314865 "2022-09-21T12:19:21Z")
Elastic-Stack 8.4.2 Elastic-Agent 8.4.1 -\> Elastic Agent 8.4.2 Upgrade Windows Server 2016 We've encountered an issue with the upgrade of the elastic-agents to the newest version. Looking into the log message from fle… --- ## [Guidance on running Kibana with a CDN](https://discuss.elastic.co/t/guidance-on-running-kibana-with-a-cdn/314598)
**Author:** [@HockeyFan0000](https://discuss.elastic.co/u/HockeyFan0000)\ **Replies:** 4\ **Last updated:** [September 21, 2022, 3:58pm UTC](https://discuss.elastic.co/t/guidance-on-running-kibana-with-a-cdn/314598 "2022-09-21T15:58:59Z")
When we upgraded Kibana recently, the scripts for the plugins stopped working. It seems they were attempting to pull from the CDN but they would fail. We finally cleared the cache on the CDN and everything started work… --- ## [Use of Index Pattern with Canvas](https://discuss.elastic.co/t/use-of-index-pattern-with-canvas/314788)
**Author:** [@hnf](https://discuss.elastic.co/u/hnf)\ **Replies:** 4\ **Last updated:** [September 21, 2022, 3:53pm UTC](https://discuss.elastic.co/t/use-of-index-pattern-with-canvas/314788 "2022-09-21T15:53:56Z")
Hello Everyone, I have an index pattern that I want to use with Canvas. I tried to use poc\_alarms-%{dd-MM-YYYY} in the select request but I get this error I don't have a problem when I try with the full name referenc… --- ## [How to set a schedule on Filter or reuse the content of a event](https://discuss.elastic.co/t/how-to-set-a-schedule-on-filter-or-reuse-the-content-of-a-event/314520)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 4\ **Last updated:** [September 21, 2022, 3:49pm UTC](https://discuss.elastic.co/t/how-to-set-a-schedule-on-filter-or-reuse-the-content-of-a-event/314520 "2022-09-21T15:49:42Z")
Hello everyone, need a share of your help again. This time with Logstash. The context of the problem is: I got a pipeline which goes into an API to retrieve a token with a POST, once I got this token I use it on anothe… --- ## [How to query for getting aggregating count of variable in "Rules and Connectors"](https://discuss.elastic.co/t/how-to-query-for-getting-aggregating-count-of-variable-in-rules-and-connectors/314776)
**Author:** [@girish\_5565](https://discuss.elastic.co/u/girish_5565)\ **Replies:** 0\ **Last updated:** [September 20, 2022, 1:00pm UTC](https://discuss.elastic.co/t/how-to-query-for-getting-aggregating-count-of-variable-in-rules-and-connectors/314776 "2022-09-20T13:00:50Z")
Hi , Please help me in this regard, how to get the aggregated count of one variable by query in Rules. Thanks & Regards, Gireesh --- ## [Sliced scroll returning more hits than normal search (without slice)](https://discuss.elastic.co/t/sliced-scroll-returning-more-hits-than-normal-search-without-slice/314599)
**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Replies:** 3\ **Last updated:** [September 21, 2022, 2:36pm UTC](https://discuss.elastic.co/t/sliced-scroll-returning-more-hits-than-normal-search-without-slice/314599 "2022-09-21T14:36:03Z")
In short, normal search hits \< scroll slice 1 hits + scroll slice 2 hits When I add up sliced scroll hits, it is more than total no of documents returned from single search. Normal search query GET index\*/\_search { … --- ## [Real estate property likes and views](https://discuss.elastic.co/t/real-estate-property-likes-and-views/314758)
**Author:** [@mohammedsajidkhaleel](https://discuss.elastic.co/u/mohammedsajidkhaleel)\ **Replies:** 3\ **Last updated:** [September 21, 2022, 2:20pm UTC](https://discuss.elastic.co/t/real-estate-property-likes-and-views/314758 "2022-09-21T14:20:06Z")
Am working on a property finder project. We are using Elasticsearch to enable flexibility for user to search property. We have option in our app to show whether a user viewed a property before or no while its listed and … --- ## [Java API Client - GetResponse source null values converted to String "null"](https://discuss.elastic.co/t/java-api-client-getresponse-source-null-values-converted-to-string-null/314808)
**Author:** [@nsorauf](https://discuss.elastic.co/u/nsorauf)\ **Replies:** 2\ **Last updated:** [September 21, 2022, 1:32pm UTC](https://discuss.elastic.co/t/java-api-client-getresponse-source-null-values-converted-to-string-null/314808 "2022-09-21T13:32:25Z")
Hi, I'm working with the new Java client, v8.3.3. I'm trying to do the following: take a source from a GetResponse\ create a Jakarta JsonObjectBuilder from that JsonData source use an ObjectMapper to convert… --- ## [Pipelines.yml ignored on logstash](https://discuss.elastic.co/t/pipelines-yml-ignored-on-logstash/314807)
**Author:** [@reswob](https://discuss.elastic.co/u/reswob)\ **Replies:** 9\ **Last updated:** [September 21, 2022, 1:17pm UTC](https://discuss.elastic.co/t/pipelines-yml-ignored-on-logstash/314807 "2022-09-21T13:17:28Z")
I have looked at the following: I have LS 8.3.3 and here is version 1 of pipelines.yml located in /opt/logstash/config/pipelines.yml - pipeline.id: main path.config: "/opt/logstash/lab\_conf/\*.conf" - pipeline.id:… --- ## [Filebeat.input and filebeat.config.modules:](https://discuss.elastic.co/t/filebeat-input-and-filebeat-config-modules/314773)
**Author:** [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\ **Replies:** 7\ **Last updated:** [September 21, 2022, 1:16pm UTC](https://discuss.elastic.co/t/filebeat-input-and-filebeat-config-modules/314773 "2022-09-21T13:16:32Z")
Hello, First I don't understand the role of this option in the config of filebeat , i read the docuentation but i don't understand exactly the fonction of it because i let it false and i receive the logs of the ubuntu in… --- ## [S3 snapshot failing with error Member must have length greater than or equal to 20](https://discuss.elastic.co/t/s3-snapshot-failing-with-error-member-must-have-length-greater-than-or-equal-to-20/314866)
**Author:** [@Maksym\_Postument](https://discuss.elastic.co/u/Maksym_Postument)\ **Replies:** 1\ **Last updated:** [September 21, 2022, 12:29pm UTC](https://discuss.elastic.co/t/s3-snapshot-failing-with-error-member-must-have-length-greater-than-or-equal-to-20/314866 "2022-09-21T12:29:39Z")
Hello, i m trying to configure s3 backup on cluster created with eck. I createad iam role and service account. Specified pods to use this service account. Then i added initcontainer initContainers: … --- ## [Using Java api client with json method not found error in 7.17.1](https://discuss.elastic.co/t/using-java-api-client-with-json-method-not-found-error-in-7-17-1/314825)
**Author:** [@Raghunandan](https://discuss.elastic.co/u/Raghunandan)\ **Replies:** 3\ **Last updated:** [September 21, 2022, 12:29pm UTC](https://discuss.elastic.co/t/using-java-api-client-with-json-method-not-found-error-in-7-17-1/314825 "2022-09-21T12:29:04Z")
Not able to find withJson method in any of elasticsearch request and response in version 7.17.1 where it is mentioned in all documentation. If there is no way to use it , what alternative can be used in 7.17.1 to use jso… --- ## [DB connection information](https://discuss.elastic.co/t/db-connection-information/314793)
**Author:** [@KiranMohan](https://discuss.elastic.co/u/KiranMohan)\ **Replies:** 0\ **Last updated:** [September 20, 2022, 4:39pm UTC](https://discuss.elastic.co/t/db-connection-information/314793 "2022-09-20T16:39:35Z")
It seems Logstash (7.10) Input JDBC plugin is leaking DB connections in one of the production servers. Is it possible to trace the DB connection information? The underlying Sequel library has an option to log\_connectio… --- ## ["No mapping found for \[@timestamp\] in order to sort on"](https://discuss.elastic.co/t/no-mapping-found-for-timestamp-in-order-to-sort-on/314855)
**Author:** [@Sarindra\_Therese](https://discuss.elastic.co/u/Sarindra_Therese)\ **Replies:** 4\ **Last updated:** [September 21, 2022, 11:56am UTC](https://discuss.elastic.co/t/no-mapping-found-for-timestamp-in-order-to-sort-on/314855 "2022-09-21T11:56:24Z")
Hey, I have this error: {"error":{"root\_cause":\[{"type":"query\_shard\_exception","reason":"No mapping found for \[@timestamp\] in order to sort on","index\_uuid":"0qKrRe3tQbKYhi5ps\_WcCw","index":"products"}\],"type":"search\_… --- ## [Failed on parsing mappings on index creation \[nyc\_taxis\]](https://discuss.elastic.co/t/failed-on-parsing-mappings-on-index-creation-nyc-taxis/313977)
**Author:** [@amitsa](https://discuss.elastic.co/u/amitsa)\ **Replies:** 8\ **Last updated:** [September 21, 2022, 11:03am UTC](https://discuss.elastic.co/t/failed-on-parsing-mappings-on-index-creation-nyc-taxis/313977 "2022-09-21T11:03:49Z")
Hi All, I got below error while running benchmarking with nyc\_taxis track. failed on parsing mappings on index creation \[nyc\_taxis\]", "ecs.version": "1.2.0","service.name":"ES\_ECS","event.dataset":"elasticsearch.server… --- ## [Unbalanced Cluster I/O Operations](https://discuss.elastic.co/t/unbalanced-cluster-i-o-operations/313661)
**Author:** [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\ **Replies:** 3\ **Last updated:** [September 21, 2022, 10:42am UTC](https://discuss.elastic.co/t/unbalanced-cluster-i-o-operations/313661 "2022-09-21T10:42:51Z")
Hello, I have a 3 master/data nodes cluster + 1 kibana client node using elasticsearch version 7.17.4 The cluster is deployed on Nutanix. I'm using auditbeat, packetbeat, filebeat and elastic agent as sources of data. … --- ## [Security index is unavailable](https://discuss.elastic.co/t/security-index-is-unavailable/314824)
**Author:** [@rkulanga](https://discuss.elastic.co/u/rkulanga)\ **Replies:** 12\ **Last updated:** [September 21, 2022, 10:32am UTC](https://discuss.elastic.co/t/security-index-is-unavailable/314824 "2022-09-21T10:32:02Z")
Hi, Due to the low disk space (95% used) on my system goes down. Then I have removed some files from the indices directory and restart both Kibana and Elasticsearch service. But system is not working now. According to… --- ## [Qradar logs to elasticsearch](https://discuss.elastic.co/t/qradar-logs-to-elasticsearch/314853)
**Author:** [@Arslonbek\_Toshev](https://discuss.elastic.co/u/Arslonbek_Toshev)\ **Replies:** 0\ **Last updated:** [September 21, 2022, 10:13am UTC](https://discuss.elastic.co/t/qradar-logs-to-elasticsearch/314853 "2022-09-21T10:13:21Z")
We have couple Sophos FWs sending logs to Qradar SIEM which we plan to extend to Elastic for threat hunting (Log Forwarding from Qradar to Elastic). In Integrations I choose Sophos. but logs don't parse correctly. the pr… --- ## [Display latency, throughput of APM instrumented apps in custom Kibana dashboard](https://discuss.elastic.co/t/display-latency-throughput-of-apm-instrumented-apps-in-custom-kibana-dashboard/314306)
**Author:** [@catalin.bulancea](https://discuss.elastic.co/u/catalin.bulancea)\ **Replies:** 5\ **Last updated:** [September 21, 2022, 9:45am UTC](https://discuss.elastic.co/t/display-latency-throughput-of-apm-instrumented-apps-in-custom-kibana-dashboard/314306 "2022-09-21T09:45:28Z")
Hello people, We have instrumented some Java and .NET applications with APM agents. So in Kibana-\>APM -\>Services we can see the apps and all the relevant metrics like Throughput, Latency, Failed transaction rate, etc. … --- ## [How to filter the results based on a condition if there is a whole word match from y attribute in x attribute](https://discuss.elastic.co/t/how-to-filter-the-results-based-on-a-condition-if-there-is-a-whole-word-match-from-y-attribute-in-x-attribute/314843)
**Author:** [@arsoni20](https://discuss.elastic.co/u/arsoni20)\ **Replies:** 0\ **Last updated:** [September 21, 2022, 8:46am UTC](https://discuss.elastic.co/t/how-to-filter-the-results-based-on-a-condition-if-there-is-a-whole-word-match-from-y-attribute-in-x-attribute/314843 "2022-09-21T08:46:07Z")
I want to do filtering based on a whole word match in Elasticsearch. e.g. POST /company/1 { "name": "Hemani", "age" : 23, "experienceInYears" : 2, "role" : "Python developer", "object" :{ "link":"Python, Scala, R" } … --- ## [Elastic Timeout not working](https://discuss.elastic.co/t/elastic-timeout-not-working/314791)
**Author:** [@painless\_elastic](https://discuss.elastic.co/u/painless_elastic)\ **Replies:** 5\ **Last updated:** [September 21, 2022, 7:18am UTC](https://discuss.elastic.co/t/elastic-timeout-not-working/314791 "2022-09-21T07:18:47Z")
When I am passing the timeout value 1ms in the request, still the result is coming with took value being more than 1ms. How does this timeout value work? Request - GET dco-preview/\_search { "timeout": "10ms", "qu… --- ## [For exporting data shoud we use scroll or pit with search after?](https://discuss.elastic.co/t/for-exporting-data-shoud-we-use-scroll-or-pit-with-search-after/314475)
**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Replies:** 4\ **Last updated:** [September 21, 2022, 7:13am UTC](https://discuss.elastic.co/t/for-exporting-data-shoud-we-use-scroll-or-pit-with-search-after/314475 "2022-09-21T07:13:32Z")
For exporting data shoud we use scroll or pit with search after? Documentation says not to use scroll for deep pagination. Assume that the data which we are querying would not change. --- ## [Unknown key for a START\_OBJECT in \[3\]](https://discuss.elastic.co/t/unknown-key-for-a-start-object-in-3/314777)
**Author:** [@Rain\_Water](https://discuss.elastic.co/u/Rain_Water)\ **Replies:** 3\ **Last updated:** [September 21, 2022, 6:31am UTC](https://discuss.elastic.co/t/unknown-key-for-a-start-object-in-3/314777 "2022-09-21T06:31:24Z")
Hi all, im getting this error on aggs query and i want to do multiple aggregation can you pls help here. { "error" : { "root\_cause" : \[ { "type" : "parsing\_exception", "reason" : "Unknown ke… --- ## [How to get aggregation bucket of certain field values use as a key](https://discuss.elastic.co/t/how-to-get-aggregation-bucket-of-certain-field-values-use-as-a-key/314829)
**Author:** [@yuvraj.singh](https://discuss.elastic.co/u/yuvraj.singh)\ **Replies:** 0\ **Last updated:** [September 21, 2022, 6:10am UTC](https://discuss.elastic.co/t/how-to-get-aggregation-bucket-of-certain-field-values-use-as-a-key/314829 "2022-09-21T06:10:09Z")
\let suppose , I have some data like\ document 1 : "\_source": { "custom\_behavior": \[ { "key": "Brand", "value": "HP" … --- ## [Back up data from Elasticsearch and Kibana to another server](https://discuss.elastic.co/t/back-up-data-from-elasticsearch-and-kibana-to-another-server/314826)
**Author:** [@rt\_888](https://discuss.elastic.co/u/rt_888)\ **Replies:** 2\ **Last updated:** [September 21, 2022, 5:49am UTC](https://discuss.elastic.co/t/back-up-data-from-elasticsearch-and-kibana-to-another-server/314826 "2022-09-21T05:49:16Z")
I have read the documentation for Restore and Backup with this link Blockquote But since i am running ELK on docker, is it a good way to migrate all of its data (indice, dashboards) to another server using Docker vol… --- ## [Logstash-extract multiple subfield values in multiple events](https://discuss.elastic.co/t/logstash-extract-multiple-subfield-values-in-multiple-events/314682)
**Author:** [@Akshay\_Kulkarni](https://discuss.elastic.co/u/Akshay_Kulkarni)\ **Replies:** 6\ **Last updated:** [September 21, 2022, 5:27am UTC](https://discuss.elastic.co/t/logstash-extract-multiple-subfield-values-in-multiple-events/314682 "2022-09-21T05:27:33Z")
Hi, I have below type of events(fields value can be dynamic). I'm trying to split field's key, value as new event. I'm able to do it for two fields(TOTAl\_VOLUME, SUCCESS\_VOLUME), but when i try for 3rd field, logstash … --- ## [How to define multiline in filebeat.inputs base on image?](https://discuss.elastic.co/t/how-to-define-multiline-in-filebeat-inputs-base-on-image/314780)
**Author:** [@amir\_Bialek](https://discuss.elastic.co/u/amir_Bialek)\ **Replies:** 2\ **Last updated:** [September 21, 2022, 4:58am UTC](https://discuss.elastic.co/t/how-to-define-multiline-in-filebeat-inputs-base-on-image/314780 "2022-09-21T04:58:31Z")
Hey, in our cluster some apps are sending logs as multiline, and the problem is that the log structure is different from app to app. How can we set up an 'if' condition that will include the multiline.pattern: … --- ## [Label data line as first or last](https://discuss.elastic.co/t/label-data-line-as-first-or-last/314817)
**Author:** [@razmizafiruddin](https://discuss.elastic.co/u/razmizafiruddin)\ **Replies:** 6\ **Last updated:** [September 21, 2022, 2:35am UTC](https://discuss.elastic.co/t/label-data-line-as-first-or-last/314817 "2022-09-21T02:35:36Z")
Hi, i am new to kibana, i have some data loaded into index pattern as below. new data will be uploaded every 30 min. i am having problem to label/determine the first and last data for each serial number. i think it is ac… --- ## [Elastic Agent Tags in Discover](https://discuss.elastic.co/t/elastic-agent-tags-in-discover/314742)
**Author:** [@praveen\_raju](https://discuss.elastic.co/u/praveen_raju)\ **Replies:** 2\ **Last updated:** [September 21, 2022, 2:07am UTC](https://discuss.elastic.co/t/elastic-agent-tags-in-discover/314742 "2022-09-21T02:07:58Z")
Hi, We are creating/updating Tags for VM's from Fleet management UI. But these tags are not available in Discover section. Is this limitation ? Thanks, Praveen --- ## [Error to start elastic search](https://discuss.elastic.co/t/error-to-start-elastic-search/314771)
**Author:** [@tariqali250](https://discuss.elastic.co/u/tariqali250)\ **Replies:** 2\ **Last updated:** [September 21, 2022, 1:06am UTC](https://discuss.elastic.co/t/error-to-start-elastic-search/314771 "2022-09-21T01:06:26Z")
sudo journalctl -f --unit elasticsearch \<-- Logs begin at Tue 2022-09-20 06:33:24 EDT. -- Sep 20 07:11:10 localhost.localdomain systemd-entrypoint\[3613\]: at io.netty.util.concurrent.AbstractEventExecutor.safeExe… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=786) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=788)