# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=789 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 790 --- ## [Need to Parse a nested JSON message in #Logstash](https://discuss.elastic.co/t/need-to-parse-a-nested-json-message-in-logstash/312979)
**Author:** [@pavanKumar2K](https://discuss.elastic.co/u/pavanKumar2K)\ **Replies:** 2\ **Last updated:** [September 20, 2022, 7:29am UTC](https://discuss.elastic.co/t/need-to-parse-a-nested-json-message-in-logstash/312979 "2022-09-20T07:29:00Z")
Hello , I am trying to send my logs files ( .txt / json files ) to Logstash via Filebeat my sample log structure is as below : {"LogDetails":{"transaction-id":"1234","channel-id":"abc","APIName":"testapi","OperationNa… --- ## [Add fields to traefik module output](https://discuss.elastic.co/t/add-fields-to-traefik-module-output/314740)
**Author:** [@titiyoyo](https://discuss.elastic.co/u/titiyoyo)\ **Replies:** 0\ **Last updated:** [September 20, 2022, 6:30am UTC](https://discuss.elastic.co/t/add-fields-to-traefik-module-output/314740 "2022-09-20T06:30:54Z")
Hello, I'm trying to add fields to logs parsed by the traefik module but I can't get it to work. I tried various syntaxes without luck. By my understanding of the documenation, the following should be working... but is… --- ## [Fetch Last 15 minute of data](https://discuss.elastic.co/t/fetch-last-15-minute-of-data/314695)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 4\ **Last updated:** [September 20, 2022, 6:56am UTC](https://discuss.elastic.co/t/fetch-last-15-minute-of-data/314695 "2022-09-20T06:56:58Z")
Here is my query for fetching the result of today last 15 minutes { "query": { "bool": { "filter": \[ { "bool": { "should": \[ { "match\_phrase": { … --- ## [8.2 S3 SETUP](https://discuss.elastic.co/t/8-2-s3-setup/314345)
**Author:** [@Harper\_S1](https://discuss.elastic.co/u/Harper_S1)\ **Replies:** 6\ **Last updated:** [September 20, 2022, 6:56am UTC](https://discuss.elastic.co/t/8-2-s3-setup/314345 "2022-09-20T06:56:25Z")
Hi Everyone, I have installed the ELK 8.2 stack but getting issue while setting up the s3 repo. Its our internal repo which works as a S3 and it worked fine till 7.16 version. but for this 8.2 version getting the follo… --- ## [Kibana Dashboard ElastiFlow 4.0.1 issue](https://discuss.elastic.co/t/kibana-dashboard-elastiflow-4-0-1-issue/311797)
**Author:** [@boot4root](https://discuss.elastic.co/u/boot4root)\ **Replies:** 7\ **Last updated:** [September 20, 2022, 6:45am UTC](https://discuss.elastic.co/t/kibana-dashboard-elastiflow-4-0-1-issue/311797 "2022-09-20T06:45:56Z")
Good afternoon, I ran into a problem, for some reason, after using ElastiFlow 4.0.1 on Dash Board for a while, the circles on dashboard began to distort, unfortunately ElastiFlow switched to the commercial version and cl… --- ## [How do I parse CEF messages comprises of json fields in between?](https://discuss.elastic.co/t/how-do-i-parse-cef-messages-comprises-of-json-fields-in-between/314718)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 4\ **Last updated:** [September 20, 2022, 6:36am UTC](https://discuss.elastic.co/t/how-do-i-parse-cef-messages-comprises-of-json-fields-in-between/314718 "2022-09-20T06:36:03Z")
Hi Team, I am accepting Cisco Ironport messages into elasticsearch using logstash cef plugin. However certain messages comprises of json fields in between and those are not getting parsed. Can someone please help me abo… --- ## [Access aggregation key inside script](https://discuss.elastic.co/t/access-aggregation-key-inside-script/314739)
**Author:** [@WeiJun0827](https://discuss.elastic.co/u/WeiJun0827)\ **Replies:** 0\ **Last updated:** [September 20, 2022, 6:20am UTC](https://discuss.elastic.co/t/access-aggregation-key-inside-script/314739 "2022-09-20T06:20:16Z")
Hello, I'm working on Elasticsearch v7.10. I stored the result of each game as a doc. The players and their scores were stored in users and scores arrays. Sample data : \[ { "gameId": "game01", "users": \[ … --- ## [Parsing IIS Logs](https://discuss.elastic.co/t/parsing-iis-logs/314732)
**Author:** [@smartdave](https://discuss.elastic.co/u/smartdave)\ **Replies:** 0\ **Last updated:** [September 20, 2022, 5:17am UTC](https://discuss.elastic.co/t/parsing-iis-logs/314732 "2022-09-20T05:17:35Z")
I have set up filebeat with the IIS module. I have this sending to Logstash. My probkem is that I have a couple of servers with a couple of different configs for logging. Is there a way to tell filebeats/iis module to… --- ## [Heartbeat container stuck in crashloopbackoff](https://discuss.elastic.co/t/heartbeat-container-stuck-in-crashloopbackoff/314623)
**Author:** [@skander\_khalfet](https://discuss.elastic.co/u/skander_khalfet)\ **Replies:** 1\ **Last updated:** [September 20, 2022, 2:11am UTC](https://discuss.elastic.co/t/heartbeat-container-stuck-in-crashloopbackoff/314623 "2022-09-20T02:11:53Z")
Hey; i'm trying to deploy heartbeat on kubernetes using this configuration file file. as i deployed the file heartbeat pod is stuck in crashloopbackoff with exit code 126. as i searched for the problem i think there's a… --- ## [ODBC failed connection to remote ES server](https://discuss.elastic.co/t/odbc-failed-connection-to-remote-es-server/314659)
**Author:** [@jimmykathuria](https://discuss.elastic.co/u/jimmykathuria)\ **Replies:** 1\ **Last updated:** [September 20, 2022, 2:04am UTC](https://discuss.elastic.co/t/odbc-failed-connection-to-remote-es-server/314659 "2022-09-20T02:04:57Z")
security\_exception: current license is non-compliant for \[odbc\] --- ## [No login with 'elastic' user after upgrading from 7.17.1 to 8.3.2](https://discuss.elastic.co/t/no-login-with-elastic-user-after-upgrading-from-7-17-1-to-8-3-2/314515)
**Author:** [@gerib](https://discuss.elastic.co/u/gerib)\ **Replies:** 10\ **Last updated:** [September 20, 2022, 1:32am UTC](https://discuss.elastic.co/t/no-login-with-elastic-user-after-upgrading-from-7-17-1-to-8-3-2/314515 "2022-09-20T01:32:16Z")
Our Cerebro shows the cluster in green, all of our 9 nodes are there with ES: 8.3.2. There are no \[ERROR\]s in Kibana's log, just \[INFO \]s and \[WARN \]s. This appeared in the process of upgrading our dev cluster and we… --- ## [Showing Error While Setting up winlogbeat in windows](https://discuss.elastic.co/t/showing-error-while-setting-up-winlogbeat-in-windows/314724)
**Author:** [@kibanarockstar](https://discuss.elastic.co/u/kibanarockstar)\ **Replies:** 2\ **Last updated:** [September 20, 2022, 12:44am UTC](https://discuss.elastic.co/t/showing-error-while-setting-up-winlogbeat-in-windows/314724 "2022-09-20T00:44:07Z")
It is showing this error after running command ".\\winlogbeat.exe setup " . Not sure How to resolve this issue. --- ## [Connection refused errror for python elasticsearch client 6.8.22](https://discuss.elastic.co/t/connection-refused-errror-for-python-elasticsearch-client-6-8-22/314504)
**Author:** [@febryjose](https://discuss.elastic.co/u/febryjose)\ **Replies:** 1\ **Last updated:** [September 20, 2022, 12:03am UTC](https://discuss.elastic.co/t/connection-refused-errror-for-python-elasticsearch-client-6-8-22/314504 "2022-09-20T00:03:06Z")
Hello Team, I am facing issues related to python elasticsearch client, we have 3 VMs where elasticsearch is installed and we are using python to create elasticsearch client with host \[ip1,ip2,ip3\]. But connection refuse… --- ## [Custom Kibana build on 8.x version with Elastic Cloud](https://discuss.elastic.co/t/custom-kibana-build-on-8-x-version-with-elastic-cloud/314721)
**Author:** [@Venkatesh\_Guruprasad](https://discuss.elastic.co/u/Venkatesh_Guruprasad)\ **Replies:** 3\ **Last updated:** [September 19, 2022, 10:13pm UTC](https://discuss.elastic.co/t/custom-kibana-build-on-8-x-version-with-elastic-cloud/314721 "2022-09-19T22:13:05Z")
We are trying to deploy custom kibana build of 8.x release & connect to an existing elastic cloud deployment. How can we accomplish that? We are using Elastic Cloud connected to GCP currently. We also have an internal o… --- ## [How to achieve Elasticsearch aggregation by grids of specific size?](https://discuss.elastic.co/t/how-to-achieve-elasticsearch-aggregation-by-grids-of-specific-size/314725)
**Author:** [@Daniel\_Garcia](https://discuss.elastic.co/u/Daniel_Garcia)\ **Replies:** 0\ **Last updated:** [September 19, 2022, 10:02pm UTC](https://discuss.elastic.co/t/how-to-achieve-elasticsearch-aggregation-by-grids-of-specific-size/314725 "2022-09-19T22:02:40Z")
Basically, what I have is a polygon that I use to filter my data through a Geoshape query. What I would like to achieve is to apply an Elasticsearch aggregation to that query that gives me a bucket for every grid of an s… --- ## [Elastic Agent \`kubernetes\_leaderelection.leader\` condition with integration](https://discuss.elastic.co/t/elastic-agent-kubernetes-leaderelection-leader-condition-with-integration/314714)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 0\ **Last updated:** [September 19, 2022, 4:51pm UTC](https://discuss.elastic.co/t/elastic-agent-kubernetes-leaderelection-leader-condition-with-integration/314714 "2022-09-19T16:51:58Z")
I'm using ECK to configure a fleet-managed Elastic Agent deployment to monitor some items via API. I would like to have two replicas for failover purposes, but have the various integrations (e.g., Github) run only on a s… --- ## [Install Certificate .PFX](https://discuss.elastic.co/t/install-certificate-pfx/314444)
**Author:** [@ojeffu](https://discuss.elastic.co/u/ojeffu)\ **Replies:** 2\ **Last updated:** [September 19, 2022, 5:16pm UTC](https://discuss.elastic.co/t/install-certificate-pfx/314444 "2022-09-19T17:16:52Z")
Hi, I'm new here and I have some questions. I need to install a client generated certificate on your linux server. Its format is PFX, how do I convert it to an acceptable format? Another point, should it be installed … --- ## [Aggregating an index with parent-child runs forever](https://discuss.elastic.co/t/aggregating-an-index-with-parent-child-runs-forever/313624)
**Author:** [@t0mer](https://discuss.elastic.co/u/t0mer)\ **Replies:** 3\ **Last updated:** [September 19, 2022, 4:45pm UTC](https://discuss.elastic.co/t/aggregating-an-index-with-parent-child-runs-forever/313624 "2022-09-19T16:45:52Z")
Hi, I've recently decided to make an attempt to reindex an existing denormalized index to a new index with parent-chid relation. I've around 14M parent docs, each parent has up to 400 children. (total of around 270M do… --- ## [Synthetics / Heartbeat 8.4.0 Release - New Workflow Video Walkthrough](https://discuss.elastic.co/t/synthetics-heartbeat-8-4-0-release-new-workflow-video-walkthrough/314713)
**Author:** [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)\ **Replies:** 0\ **Last updated:** [September 19, 2022, 4:28pm UTC](https://discuss.elastic.co/t/synthetics-heartbeat-8-4-0-release-new-workflow-video-walkthrough/314713 "2022-09-19T16:28:18Z")
Hey all, it's a little late in coming seeing as 8.4.0 was released almost a month ago, but we wanted to give you a walkthrough of what's new with the Elastic Uptime / Synthetics workflow in 8.4.0. We're trying something … --- ## [Elasticsearch 6 to 7 scoring change](https://discuss.elastic.co/t/elasticsearch-6-to-7-scoring-change/314709)
**Author:** [@mask](https://discuss.elastic.co/u/mask)\ **Replies:** 1\ **Last updated:** [September 19, 2022, 3:40pm UTC](https://discuss.elastic.co/t/elasticsearch-6-to-7-scoring-change/314709 "2022-09-19T15:40:47Z")
My service which run with Elasticsearch 6.4 has a function score query with boost and weight to find the most match document for user. After migrate to Elasticsearch 7.10 (same mapping, number of shards, data count) I fo… --- ## [Certificate error -javax.net.ssl.SSLHandshakeException: Received fatal alert: decrypt\_error](https://discuss.elastic.co/t/certificate-error-javax-net-ssl-sslhandshakeexception-received-fatal-alert-decrypt-error/314524)
**Author:** [@elkstack1](https://discuss.elastic.co/u/elkstack1)\ **Replies:** 1\ **Last updated:** [September 19, 2022, 3:19pm UTC](https://discuss.elastic.co/t/certificate-error-javax-net-ssl-sslhandshakeexception-received-fatal-alert-decrypt-error/314524 "2022-09-19T15:19:13Z")
Getting the below error while trying to access elasticsearch https://\/9200 and it says connection is not secure DecoderException: javax.net.ssl.SSLHandshakeException: Received fatal alert: decrypt\_error … --- ## [Heartbeat error "error when creating "heartbeat-kubernetes.yaml": Deployment in version "v1" cannot be handled as a Deployment: unable to parse quantity's suffix" when deploying on kubernetes](https://discuss.elastic.co/t/heartbeat-error-error-when-creating-heartbeat-kubernetes-yaml-deployment-in-version-v1-cannot-be-handled-as-a-deployment-unable-to-parse-quantitys-suffix-when-deploying-on-kubernetes/314597)
**Author:** [@alexander2](https://discuss.elastic.co/u/alexander2)\ **Replies:** 1\ **Last updated:** [September 19, 2022, 3:05pm UTC](https://discuss.elastic.co/t/heartbeat-error-error-when-creating-heartbeat-kubernetes-yaml-deployment-in-version-v1-cannot-be-handled-as-a-deployment-unable-to-parse-quantitys-suffix-when-deploying-on-kubernetes/314597 "2022-09-19T15:05:29Z")
Hello everyone, i'm trying to deploy heartbeat on kubernetes to monitor kubernetes pods and services. i used the elastic official documentation yaml file. this is the full configuration file apiVersion: v1 kind: Config… --- ## [Fleet Agent: Logstash output: Invalid version of beats protocol](https://discuss.elastic.co/t/fleet-agent-logstash-output-invalid-version-of-beats-protocol/314624)
**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\ **Replies:** 11\ **Last updated:** [September 19, 2022, 2:32pm UTC](https://discuss.elastic.co/t/fleet-agent-logstash-output-invalid-version-of-beats-protocol/314624 "2022-09-19T14:32:19Z")
This is my Logstash config input { elastic\_agent { port =\> 5044 ssl =\> false } } filter { mutate { add\_field =\> { "foo" =\> "bar gustavito" } } } output { elasticsear… --- ## [Couldn't find Kibana verification code](https://discuss.elastic.co/t/couldnt-find-kibana-verification-code/314402)
**Author:** [@Sher\_Khan](https://discuss.elastic.co/u/Sher_Khan)\ **Replies:** 1\ **Last updated:** [September 19, 2022, 2:24pm UTC](https://discuss.elastic.co/t/couldnt-find-kibana-verification-code/314402 "2022-09-19T14:24:22Z")
Using ELK Stack version 8.4.1 When i entered http://localhost:5601/ in the address bar following screens occur First I generate an enrollment token by running below command then I pasted it in the enrollment token… --- ## [ES 2.14 search query upgrade to ES 8.x](https://discuss.elastic.co/t/es-2-14-search-query-upgrade-to-es-8-x/314701)
**Author:** [@VV1002](https://discuss.elastic.co/u/VV1002)\ **Replies:** 0\ **Last updated:** [September 19, 2022, 2:13pm UTC](https://discuss.elastic.co/t/es-2-14-search-query-upgrade-to-es-8-x/314701 "2022-09-19T14:13:58Z")
Hi ES Team, I have a search query which is written in ES 2.14. How do I upgrade that query to version 8.X ? I am confused about how to alter the filter bool query(2.14) because its now filter context and not sure how to… --- ## [New Control Filter Version 8](https://discuss.elastic.co/t/new-control-filter-version-8/314654)
**Author:** [@Irwan\_Kurniawan](https://discuss.elastic.co/u/Irwan_Kurniawan)\ **Replies:** 1\ **Last updated:** [September 19, 2022, 2:01pm UTC](https://discuss.elastic.co/t/new-control-filter-version-8/314654 "2022-09-19T14:01:34Z")
Hi, I want to do drilldown with filter. I already apply with filter but when I do drill down, the filter doesn't work. It happen in new control for version 8. It works with old control (version 7). Is it a bug or need di… --- ## ["long objects" json pattern regular expression logstash](https://discuss.elastic.co/t/long-objects-json-pattern-regular-expression-logstash/314700)
**Author:** [@Vitoria\_De\_Lara](https://discuss.elastic.co/u/Vitoria_De_Lara)\ **Replies:** 0\ **Last updated:** [September 19, 2022, 1:56pm UTC](https://discuss.elastic.co/t/long-objects-json-pattern-regular-expression-logstash/314700 "2022-09-19T13:56:02Z")
I have a long json file and I need to capture it in parts for elasticsearch --- ## [Unable to login to kibana with username elastic](https://discuss.elastic.co/t/unable-to-login-to-kibana-with-username-elastic/314681)
**Author:** [@amad](https://discuss.elastic.co/u/amad)\ **Replies:** 1\ **Last updated:** [September 19, 2022, 1:48pm UTC](https://discuss.elastic.co/t/unable-to-login-to-kibana-with-username-elastic/314681 "2022-09-19T13:48:45Z")
Password is working for elasticsearch I can't access kibana dashboard using these creds. Need help. Thanks in advance --- ## [Connection Refused](https://discuss.elastic.co/t/connection-refused/313418)
**Author:** [@ombit](https://discuss.elastic.co/u/ombit)\ **Replies:** 10\ **Last updated:** [September 19, 2022, 1:08pm UTC](https://discuss.elastic.co/t/connection-refused/313418 "2022-09-19T13:08:23Z")
Hi all, I need to create a solution that amends syslogs to be RFC3164 compliant and ultimately send them on to a QRADAR at a customer's site. To test this I have created two linux VMs both of which can ping each other… --- ## [Logstash number of threads keeps increasing until crash](https://discuss.elastic.co/t/logstash-number-of-threads-keeps-increasing-until-crash/313463)
**Author:** [@Alain\_Bod](https://discuss.elastic.co/u/Alain_Bod)\ **Replies:** 13\ **Last updated:** [September 19, 2022, 1:06pm UTC](https://discuss.elastic.co/t/logstash-number-of-threads-keeps-increasing-until-crash/313463 "2022-09-19T13:06:06Z")
Hi, I'm testing the following pipeline (stack version 8.4.1): input { google\_cloud\_storage {...} } filter {csv {...} mutate {...} } output { elasticsearch {...} } with a large number of events (3M+). After a few min… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=788) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=790)