# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=793 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 794 --- ## [Install Elasticsearch 8.4. on windows](https://discuss.elastic.co/t/install-elasticsearch-8-4-on-windows/314347)
**Author:** [@Isay](https://discuss.elastic.co/u/Isay)\ **Replies:** 3\ **Last updated:** [September 15, 2022, 4:01am UTC](https://discuss.elastic.co/t/install-elasticsearch-8-4-on-windows/314347 "2022-09-15T04:01:28Z")
I did the installation of Elasticsearch 8.4 on windows but when executing elasticsearch.bat it runs the command, but it does not show the configuration information and it also does not save information in the elasticsear… --- ## [Create a watcher alert - extract a field and to compare](https://discuss.elastic.co/t/create-a-watcher-alert-extract-a-field-and-to-compare/314140)
**Author:** [@sree3](https://discuss.elastic.co/u/sree3)\ **Replies:** 2\ **Last updated:** [September 15, 2022, 3:10am UTC](https://discuss.elastic.co/t/create-a-watcher-alert-extract-a-field-and-to-compare/314140 "2022-09-15T03:10:52Z")
Hi Team, I am trying to create a new thershold watcher alert for a value that is present inside the "message" field. But i was unable to get it right. Someone could please help to resolve the issue. Below is the JSON … --- ## [Unable to find valid certification path logstash](https://discuss.elastic.co/t/unable-to-find-valid-certification-path-logstash/314358)
**Author:** [@rt\_888](https://discuss.elastic.co/u/rt_888)\ **Replies:** 0\ **Last updated:** [September 14, 2022, 3:17am UTC](https://discuss.elastic.co/t/unable-to-find-valid-certification-path-logstash/314358 "2022-09-14T03:17:17Z")
I am running ELK version 8.3.3 on docker and Logstash seperately . After I edit my logstash config file and running the Logstash, i got the error with "unable to find valid certification path to request target" . I think… --- ## [Parsing LEEF data](https://discuss.elastic.co/t/parsing-leef-data/314448)
**Author:** [@sta02](https://discuss.elastic.co/u/sta02)\ **Replies:** 1\ **Last updated:** [September 14, 2022, 11:48pm UTC](https://discuss.elastic.co/t/parsing-leef-data/314448 "2022-09-14T23:48:31Z")
Hello, How can I parse LEEF data. The format includes | separation in the heard and SPACE separation in Body. Below is a sample event, please advise. The objective is to parse both the LEEF header (LEEF:1.0|Cyber-Ark|V… --- ## [Logstash cli with file option issue](https://discuss.elastic.co/t/logstash-cli-with-file-option-issue/314349)
**Author:** [@karlkras](https://discuss.elastic.co/u/karlkras)\ **Replies:** 6\ **Last updated:** [September 14, 2022, 11:05pm UTC](https://discuss.elastic.co/t/logstash-cli-with-file-option-issue/314349 "2022-09-14T23:05:43Z")
Windows 10 Logstash for Windows 8.4.1 Good afternoon. I've been working through some courseware on using logstash and have run into a problem while attempting to use the -f option with the logstash.bat file. The fi… --- ## [Filter XML plugin namespace available?](https://discuss.elastic.co/t/filter-xml-plugin-namespace-available/314463)
**Author:** [@erwin339](https://discuss.elastic.co/u/erwin339)\ **Replies:** 0\ **Last updated:** [September 14, 2022, 9:37pm UTC](https://discuss.elastic.co/t/filter-xml-plugin-namespace-available/314463 "2022-09-14T21:37:30Z")
When using the namespace =\> { or the remove\_namespace I don't get any positive response when wanting to assign or remove the namespace, since I am getting this error Error parsing xml with XmlSimple \ **Author:** [@Mary2022](https://discuss.elastic.co/u/Mary2022)\ **Replies:** 5\ **Last updated:** [September 14, 2022, 9:01pm UTC](https://discuss.elastic.co/t/drilldown-option-not-showing/314442 "2022-09-14T21:01:35Z") Hi I still new to elasticsearch. I am trying to fix my dashboard. Every time someone click on one of the visualization it will zoom in but the other visualizations will change to not data. I started reading about drilld… --- ## [Filebeat v Logstash handling when Elastic endpoint is down](https://discuss.elastic.co/t/filebeat-v-logstash-handling-when-elastic-endpoint-is-down/314460)
**Author:** [@leemase004](https://discuss.elastic.co/u/leemase004)\ **Replies:** 1\ **Last updated:** [September 14, 2022, 8:58pm UTC](https://discuss.elastic.co/t/filebeat-v-logstash-handling-when-elastic-endpoint-is-down/314460 "2022-09-14T20:58:42Z")
Quick question on how both filebeat and logstash handle data if Elasticsearch is down. In this scenario both would be pulling from a Kafka topic. We are wondering how the two operate if the endpoint is down but data is … --- ## [Executing a search query with 30K+ clauses](https://discuss.elastic.co/t/executing-a-search-query-with-30k-clauses/314441)
**Author:** [@tnitave](https://discuss.elastic.co/u/tnitave)\ **Replies:** 2\ **Last updated:** [September 14, 2022, 8:29pm UTC](https://discuss.elastic.co/t/executing-a-search-query-with-30k-clauses/314441 "2022-09-14T20:29:38Z")
I am interested in executing an Elasticsearch search query with 5000+ terms across 5 different fields which leads to 25K+ clauses. According to documentation default max\_clause\_count limit is set to 1024 and updating thi… --- ## [Elastic Agent outputs to localhost?](https://discuss.elastic.co/t/elastic-agent-outputs-to-localhost/314341)
**Author:** [@simpleman](https://discuss.elastic.co/u/simpleman)\ **Replies:** 1\ **Last updated:** [September 14, 2022, 7:59pm UTC](https://discuss.elastic.co/t/elastic-agent-outputs-to-localhost/314341 "2022-09-14T19:59:51Z")
I have gone the path of install Fleet Server and Agents in my lab server. My setup is: Windows Server 2016 with Symantec Endpoint Protection installed A Linux VM at 192.168.1.10 running ELK stack properly A Linux VM at… --- ## [Graphite Input Logstash](https://discuss.elastic.co/t/graphite-input-logstash/314457)
**Author:** [@elrozario](https://discuss.elastic.co/u/elrozario)\ **Replies:** 0\ **Last updated:** [September 14, 2022, 7:27pm UTC](https://discuss.elastic.co/t/graphite-input-logstash/314457 "2022-09-14T19:27:30Z")
Hello, I am very new to ELK and trying to ingest data from Graphite but its not working. Here is my logstash pipeline: graphite { host =\> "\*\*\*\*" port =\> "\*\*\*\*" mode =\> "client" … --- ## [Cisco Duo Integration not working](https://discuss.elastic.co/t/cisco-duo-integration-not-working/314454)
**Author:** [@jpayne](https://discuss.elastic.co/u/jpayne)\ **Replies:** 0\ **Last updated:** [September 14, 2022, 7:18pm UTC](https://discuss.elastic.co/t/cisco-duo-integration-not-working/314454 "2022-09-14T19:18:25Z")
Continuing the discussion from Cisco Duo Integration not working: I am on an elastic 8.4.1 stack with Duo D249.8. I installed the duo integration and I do see logs showing up: but all of the dashboards just show emp… --- ## [\[ERROR\] \[\[main\]\"incompatible json object type=java.lanString, only hash map or arrays are supported", :exception=\>LogStash::Json::ParserError, data=\>" /"bandwidthLimits](https://discuss.elastic.co/t/error-main-file-json-json-parse-error-original-data-now-in-message-fiel-message-incompatible-json-object-type-java-lanstring-only-hash-map-or-arrays-are-supported-exception-logstash-parsererror-data-bandwidthlimits/314447)
**Author:** [@Queren\_Santos](https://discuss.elastic.co/u/Queren_Santos)\ **Replies:** 0\ **Last updated:** [September 14, 2022, 6:21pm UTC](https://discuss.elastic.co/t/error-main-file-json-json-parse-error-original-data-now-in-message-fiel-message-incompatible-json-object-type-java-lanstring-only-hash-map-or-arrays-are-supported-exception-logstash-parsererror-data-bandwidthlimits/314447 "2022-09-14T18:21:04Z")
My logstash filter code catches incorrect data, can anyone help me with the correct syntax? input { file { path =\> "/var/tmp/wd/accounts/\*.json" codec =\> "json" start\_position =\> "beginning" sincedb\_pa… --- ## [Supplying a config object using an environment variable (especially for anonymous authentication using Docker)](https://discuss.elastic.co/t/supplying-a-config-object-using-an-environment-variable-especially-for-anonymous-authentication-using-docker/314413)
**Author:** [@jonasjancarik](https://discuss.elastic.co/u/jonasjancarik)\ **Replies:** 3\ **Last updated:** [September 14, 2022, 6:12pm UTC](https://discuss.elastic.co/t/supplying-a-config-object-using-an-environment-variable-especially-for-anonymous-authentication-using-docker/314413 "2022-09-14T18:12:21Z")
I know it is possible to submit an array in an environment variable, as described in Install Kibana with Docker | Kibana Guide \[8.4\] | Elastic. I can't, however, figure out how to submit the configuration needed to set u… --- ## [Yet another case of Logstash Delays](https://discuss.elastic.co/t/yet-another-case-of-logstash-delays/314445)
**Author:** [@mread830](https://discuss.elastic.co/u/mread830)\ **Replies:** 0\ **Last updated:** [September 14, 2022, 6:07pm UTC](https://discuss.elastic.co/t/yet-another-case-of-logstash-delays/314445 "2022-09-14T18:07:11Z")
I’m working on a logging solution that is really nothing more than a forwarder. rsyslog on several servers are sending their logs to Logstash, which then send them out to HEC splunk endpoint. In Logstash, we are using … --- ## [Parsing JSON](https://discuss.elastic.co/t/parsing-json/314435)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [September 14, 2022, 5:39pm UTC](https://discuss.elastic.co/t/parsing-json/314435 "2022-09-14T17:39:21Z")
I want to extract only JSON data but don't know how to do it 2022-09-14 10:08:37,597 DEBUG logging.RequestLoggingAdvice Request received=\[{ "Name" : "John", "var1" : "Value1", "var2" : "Value2", "var3" : "Value3", "var4… --- ## [Snapshot contents](https://discuss.elastic.co/t/snapshot-contents/313576)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 2\ **Last updated:** [September 14, 2022, 5:30pm UTC](https://discuss.elastic.co/t/snapshot-contents/313576 "2022-09-14T17:30:37Z")
Whether snapshot will copy the apm and watcher indices as well? --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/314438)
**Author:** [@Neophyte](https://discuss.elastic.co/u/Neophyte)\ **Replies:** 4\ **Last updated:** [September 14, 2022, 5:05pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/314438 "2022-09-14T17:05:58Z")
I am getting this in the browser. Here are my configs messi@fifa:~$ sudo systemctl status kibana elasticsearch ● kibana.service - Kibana Loaded: loaded (/lib/systemd/system/kibana.service; enabled; vendor preset: e… --- ## [I cannot see local rules](https://discuss.elastic.co/t/i-cannot-see-local-rules/314227)
**Author:** [@Giovanni\_Memoli](https://discuss.elastic.co/u/Giovanni_Memoli)\ **Replies:** 2\ **Last updated:** [September 14, 2022, 4:53pm UTC](https://discuss.elastic.co/t/i-cannot-see-local-rules/314227 "2022-09-14T16:53:15Z")
Hi, an old colleague created a local rule on an old Wazuh server and it worked. Now I created a new wazuh server and copy & paste the rule, under local rule, but I cannot see it under discovery session. Rule is: \ **Author:** [@samjpv](https://discuss.elastic.co/u/samjpv)\ **Replies:** 5\ **Last updated:** [September 8, 2022, 6:10pm UTC](https://discuss.elastic.co/t/new-data-stream-backing-index-dropping-logs/313913 "2022-09-08T18:10:07Z") I currently have microservice logs going from kubernetes -\> confluent kafka -\> elastic via sink connector (I have confirmed that they are reaching kafka but not elastic). On elastic I have a corresponding data stream tha… --- ## [Possibilty to show intime value of fileds in kibana as timseries](https://discuss.elastic.co/t/possibilty-to-show-intime-value-of-fileds-in-kibana-as-timseries/314437)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 0\ **Last updated:** [September 14, 2022, 3:48pm UTC](https://discuss.elastic.co/t/possibilty-to-show-intime-value-of-fileds-in-kibana-as-timseries/314437 "2022-09-14T15:48:25Z")
Continuing the discussion from Kibana visualization to show intime value count of different fieldski: --- ## [Using mutate to parse broken JSON](https://discuss.elastic.co/t/using-mutate-to-parse-broken-json/314436)
**Author:** [@Dan\_Fielder](https://discuss.elastic.co/u/Dan_Fielder)\ **Replies:** 0\ **Last updated:** [September 14, 2022, 3:43pm UTC](https://discuss.elastic.co/t/using-mutate-to-parse-broken-json/314436 "2022-09-14T15:43:09Z")
I have messages arriving with very large blocks of broken JSON. These logs fail to parse when they arrive, so I'm using Filebeat to read from logstash-plain.log and feed them back in for extra processing. Each log cont… --- ## [TSVB Kibana data representation](https://discuss.elastic.co/t/tsvb-kibana-data-representation/311712)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 4\ **Last updated:** [September 14, 2022, 3:38pm UTC](https://discuss.elastic.co/t/tsvb-kibana-data-representation/311712 "2022-09-14T15:38:34Z")
Hello All, Can someone help me with making timeseries visual for below use case: Display the amount value for different state coming from backend script and show in accordance to time. Qsearch index updated,nodes trav… --- ## [Trouble with Filebeat Nginx module](https://discuss.elastic.co/t/trouble-with-filebeat-nginx-module/314434)
**Author:** [@marklad78](https://discuss.elastic.co/u/marklad78)\ **Replies:** 0\ **Last updated:** [September 14, 2022, 3:22pm UTC](https://discuss.elastic.co/t/trouble-with-filebeat-nginx-module/314434 "2022-09-14T15:22:33Z")
Filebeat/ELK version 7.10.2 We're attempting to consume nginx-esque kong logs from /usr/local/kong/logs/access.log through filebeat running on the same machine as the kong instance using the nginx module. The followi… --- ## [Fleet Server is not Healthy](https://discuss.elastic.co/t/fleet-server-is-not-healthy/314359)
**Author:** [@xqaiviwjxzw](https://discuss.elastic.co/u/xqaiviwjxzw)\ **Replies:** 0\ **Last updated:** [September 14, 2022, 3:37am UTC](https://discuss.elastic.co/t/fleet-server-is-not-healthy/314359 "2022-09-14T03:37:19Z")
After I upgraded from 8.3.2 to 8.4.1, my fleet shows Fleet Server is not Healthy, but agent is healthy, how do I need to deal with this problem? --- ## [Check a field contains string using script](https://discuss.elastic.co/t/check-a-field-contains-string-using-script/314424)
**Author:** [@rahulkothanath](https://discuss.elastic.co/u/rahulkothanath)\ **Replies:** 0\ **Last updated:** [September 14, 2022, 2:34pm UTC](https://discuss.elastic.co/t/check-a-field-contains-string-using-script/314424 "2022-09-14T14:34:11Z")
I would like to run a query to check if a field is substring of a query string parameter. if yes , I want to return 1. I am new to scripting and below code is not working. Blockquote GET testspan/\_search { "size": … --- ## [Reindex - Upgrade assistant index data prior to 7.0](https://discuss.elastic.co/t/reindex-upgrade-assistant-index-data-prior-to-7-0/314336)
**Author:** [@elkstack1](https://discuss.elastic.co/u/elkstack1)\ **Replies:** 2\ **Last updated:** [September 14, 2022, 2:32pm UTC](https://discuss.elastic.co/t/reindex-upgrade-assistant-index-data-prior-to-7-0/314336 "2022-09-14T14:32:31Z")
I clicked on the reindexing option on the upgrade assistant for the indexes that are critical and needs to be reindexed prior to upgrade. I do see the reindexing failed but there is no error detailed on the response. Ca… --- ## [ES 6.4.2 - MapperParsingException when performing Bulk requests](https://discuss.elastic.co/t/es-6-4-2-mapperparsingexception-when-performing-bulk-requests/314057)
**Author:** [@JPS\_23](https://discuss.elastic.co/u/JPS_23)\ **Replies:** 3\ **Last updated:** [September 14, 2022, 1:54pm UTC](https://discuss.elastic.co/t/es-6-4-2-mapperparsingexception-when-performing-bulk-requests/314057 "2022-09-14T13:54:40Z")
Hi! I have been experiencing a MapperParsingException when performing Bulk requests on the Elastic Search 6.4.2 instance. This issue is happening on all the environments (development, qa, production). The weird thing is… --- ## [Kibana v7.16.1 login issue. Not able to login (ResponseError: version\_conflict\_engine\_exception)](https://discuss.elastic.co/t/kibana-v7-16-1-login-issue-not-able-to-login-responseerror-version-conflict-engine-exception/308670)
**Author:** [@Avinash\_09](https://discuss.elastic.co/u/Avinash_09)\ **Replies:** 35\ **Last updated:** [September 14, 2022, 1:22pm UTC](https://discuss.elastic.co/t/kibana-v7-16-1-login-issue-not-able-to-login-responseerror-version-conflict-engine-exception/308670 "2022-09-14T13:22:29Z")
Hello, We are on v7.16.1 of Kibana/Elastic and facing issues with Kibana login all of a sudden. It was working fine around couple of hours back When checked in the logs seeing below exceptions. {"type":"log","@times… --- ## [UDP Listener Died](https://discuss.elastic.co/t/udp-listener-died/314339)
**Author:** [@Technolust](https://discuss.elastic.co/u/Technolust)\ **Replies:** 2\ **Last updated:** [September 14, 2022, 12:37pm UTC](https://discuss.elastic.co/t/udp-listener-died/314339 "2022-09-14T12:37:51Z")
I'm seeing this error in my logstash-plain.log file and I ham not sure where to start looking: \[2022-09-13T17:25:47,905\]\[ERROR\]\[logstash.inputs.udp \]\[main\]\[8a46caaeb3cca4377e6163891fd9b8dd48405025c4a31918ce883ba824… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=792) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=794)