# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=806 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 807 --- ## [Error fetching data for metricset logstash.node: Could not find field 'id' in Logstash API response](https://discuss.elastic.co/t/error-fetching-data-for-metricset-logstash-node-could-not-find-field-id-in-logstash-api-response/311717)
**Author:** [@andreastoom](https://discuss.elastic.co/u/andreastoom)\ **Replies:** 5\ **Last updated:** [September 6, 2022, 4:29am UTC](https://discuss.elastic.co/t/error-fetching-data-for-metricset-logstash-node-could-not-find-field-id-in-logstash-api-response/311717 "2022-09-06T04:29:01Z")
Hi, I have just upgraded our ELK-stack to 8.3.3 and I am migrating the monitoring to use Metricbeat. Elasticsearch and Kibana works without any issues. However for Logstash I'm seeing the following in the logs { "l… --- ## [What difference does it make to add the "\_all": { "enabled": false } to the \_default\_ section rather in the specifiec index\_name section?](https://discuss.elastic.co/t/what-difference-does-it-make-to-add-the-all-enabled-false-to-the-default-section-rather-in-the-specifiec-index-name-section/313571)
**Author:** [@S\_W\_A\_T\_7](https://discuss.elastic.co/u/S_W_A_T_7)\ **Replies:** 1\ **Last updated:** [September 6, 2022, 3:50am UTC](https://discuss.elastic.co/t/what-difference-does-it-make-to-add-the-all-enabled-false-to-the-default-section-rather-in-the-specifiec-index-name-section/313571 "2022-09-06T03:50:30Z")
What difference does it make to add the "\_all": { "enabled": false } to the default section rather in the specifiec index\_name section ? "mappings": { "\_default\_": { "\_all": { "enabled": false … --- ## [Kibana query Error loading gateway out](https://discuss.elastic.co/t/kibana-query-error-loading-gateway-out/313724)
**Author:** [@liucx1201](https://discuss.elastic.co/u/liucx1201)\ **Replies:** 3\ **Last updated:** [September 6, 2022, 3:29am UTC](https://discuss.elastic.co/t/kibana-query-error-loading-gateway-out/313724 "2022-09-06T03:29:22Z")
Recently, cold and hot data wind separation was operated。 Data writing is normal, but query error occurs in the afternoon of the third day An error is reported through kibana query:Kibana query Error loading gateway ou… --- ## [The logs aren't read by Logstash deployed with Docker after rotating](https://discuss.elastic.co/t/the-logs-arent-read-by-logstash-deployed-with-docker-after-rotating/311685)
**Author:** [@kent010341](https://discuss.elastic.co/u/kent010341)\ **Replies:** 4\ **Last updated:** [September 6, 2022, 2:54am UTC](https://discuss.elastic.co/t/the-logs-arent-read-by-logstash-deployed-with-docker-after-rotating/311685 "2022-09-06T02:54:00Z")
I'm using log4j to write logs to files, and whenever the log rotates (compressed to a .gz file), the new log file is never read by Logstash (using version 7.14.4, on MacOS 12.5). I think it's important to track the inod… --- ## [Cloudflare integration not working](https://discuss.elastic.co/t/cloudflare-integration-not-working/312631)
**Author:** [@Guncixx](https://discuss.elastic.co/u/Guncixx)\ **Replies:** 1\ **Last updated:** [September 6, 2022, 2:00am UTC](https://discuss.elastic.co/t/cloudflare-integration-not-working/312631 "2022-09-06T02:00:39Z")
I have set up cloudflare integration already some time time ago, at first it was working without any issue but after recent version updates it's not getting either audit or logpull logs. I have configured everything acco… --- ## [Can somebody share the Documents and templates dump for Splunk to ELK migration?](https://discuss.elastic.co/t/can-somebody-share-the-documents-and-templates-dump-for-splunk-to-elk-migration/313441)
**Author:** [@edwin1](https://discuss.elastic.co/u/edwin1)\ **Replies:** 1\ **Last updated:** [September 6, 2022, 1:56am UTC](https://discuss.elastic.co/t/can-somebody-share-the-documents-and-templates-dump-for-splunk-to-elk-migration/313441 "2022-09-06T01:56:32Z")
I need the standard task list excel/planner/templates and whatever useful documents you have to support Splunk to ELK migration for 10-20 PetaBytes of data. What is the realistic timeline you think it will take. I under… --- ## [Which fields are used for scoring?](https://discuss.elastic.co/t/which-fields-are-used-for-scoring/313365)
**Author:** [@frankmehlhop.com](https://discuss.elastic.co/u/frankmehlhop.com)\ **Replies:** 1\ **Last updated:** [September 6, 2022, 1:49am UTC](https://discuss.elastic.co/t/which-fields-are-used-for-scoring/313365 "2022-09-06T01:49:22Z")
I write doc's into Elastic with different fields. Only certain fields should be used for scoring. Do I need to tell the index while creating it which fields need to be used for scoring or do I include this information… --- ## [What is best node configuration in 3 node](https://discuss.elastic.co/t/what-is-best-node-configuration-in-3-node/313411)
**Author:** [@hyungsun\_lim](https://discuss.elastic.co/u/hyungsun_lim)\ **Replies:** 9\ **Last updated:** [September 6, 2022, 1:35am UTC](https://discuss.elastic.co/t/what-is-best-node-configuration-in-3-node/313411 "2022-09-06T01:35:39Z")
Hello, i have 3 nodes to operate Elasticsearch and Kibana. I have to set role node by node (master? data? ingest?) I heard that node.roles don't need to be configured in small cluster size (smaller than 3 nodes) It me… --- ## [Internal indices list](https://discuss.elastic.co/t/internal-indices-list/313575)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 1\ **Last updated:** [September 6, 2022, 1:19am UTC](https://discuss.elastic.co/t/internal-indices-list/313575 "2022-09-06T01:19:30Z")
I am looking for elasticsearch internal indices list. 1) .kibana 2) .security 3) ... 4)... --- ## [Can Filebeat-OSS send data to Elasticsearch non OSS?](https://discuss.elastic.co/t/can-filebeat-oss-send-data-to-elasticsearch-non-oss/313534)
**Author:** [@SitoRBJ](https://discuss.elastic.co/u/SitoRBJ)\ **Replies:** 1\ **Last updated:** [September 6, 2022, 1:11am UTC](https://discuss.elastic.co/t/can-filebeat-oss-send-data-to-elasticsearch-non-oss/313534 "2022-09-06T01:11:56Z")
Hello everyone! I remember seeing some problems when trying to send data from a Filebeat-OSS to a standard Elasticsearch, i.e. not OSS. Is there any restriction on this or any known problem or can this communication be… --- ## [How to increase elasticsearch update and skip high load?](https://discuss.elastic.co/t/how-to-increase-elasticsearch-update-and-skip-high-load/313680)
**Author:** [@robocon20x](https://discuss.elastic.co/u/robocon20x)\ **Replies:** 0\ **Last updated:** [September 5, 2022, 12:11pm UTC](https://discuss.elastic.co/t/how-to-increase-elasticsearch-update-and-skip-high-load/313680 "2022-09-05T12:11:08Z")
i am using bulk to update 5m doc to an index. I think i could use update\_by\_query to speed up it. in my case: I have an array of id filed value ( it is unique), and I'm going to use bool query to find all document match … --- ## [Azure AD with groups in kibana and role mappings](https://discuss.elastic.co/t/azure-ad-with-groups-in-kibana-and-role-mappings/313688)
**Author:** [@vinvli](https://discuss.elastic.co/u/vinvli)\ **Replies:** 1\ **Last updated:** [September 6, 2022, 12:04am UTC](https://discuss.elastic.co/t/azure-ad-with-groups-in-kibana-and-role-mappings/313688 "2022-09-06T00:04:47Z")
We are currently working with Elastic cloud and Azure AD and trying to login to azure with normal AD groups. This is done via role mappings and OIDC. This seems to work fine. However once we use a native Azure AD group i… --- ## [\[Logstash\] windows logstash plugins](https://discuss.elastic.co/t/logstash-windows-logstash-plugins/313702)
**Author:** [@zapatannico](https://discuss.elastic.co/u/zapatannico)\ **Replies:** 1\ **Last updated:** [September 5, 2022, 5:48pm UTC](https://discuss.elastic.co/t/logstash-windows-logstash-plugins/313702 "2022-09-05T17:48:11Z")
Hello, I have some doubts regarding the latest versions of logstash. I am trying to receive syslog events and have them be logged to a .log file My current configuration is the following: input { syslog { por… --- ## [Visualize not showing any values after Upgrading our ELK cluster](https://discuss.elastic.co/t/visualize-not-showing-any-values-after-upgrading-our-elk-cluster/313665)
**Author:** [@Vishnu\_Vijay](https://discuss.elastic.co/u/Vishnu_Vijay)\ **Replies:** 1\ **Last updated:** [September 5, 2022, 3:16pm UTC](https://discuss.elastic.co/t/visualize-not-showing-any-values-after-upgrading-our-elk-cluster/313665 "2022-09-05T15:16:10Z")
Hi All, We have recently upgraded our older ELK cluster which was on 6.3.2 to 6.8.23. We have tested the functionalities and messages are loading, Dashboards are working fine, and search in Discover is also working But… --- ## [Filtering on multiple fields from deep nested object](https://discuss.elastic.co/t/filtering-on-multiple-fields-from-deep-nested-object/313698)
**Author:** [@Ahmed\_EBEN\_HASSINE](https://discuss.elastic.co/u/Ahmed_EBEN_HASSINE)\ **Replies:** 2\ **Last updated:** [September 5, 2022, 5:25pm UTC](https://discuss.elastic.co/t/filtering-on-multiple-fields-from-deep-nested-object/313698 "2022-09-05T17:25:34Z")
I have a complicated object that looks something like this: { "\_type": "\_doc", "\_id": "13", "name": "X", "unitWorkJobRiskWorkingSituations": \[ { unitWork: { "id":… --- ## [Does Elasticsearch lose logs in the event of an unexpected outage?](https://discuss.elastic.co/t/does-elasticsearch-lose-logs-in-the-event-of-an-unexpected-outage/313692)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 2\ **Last updated:** [September 5, 2022, 5:12pm UTC](https://discuss.elastic.co/t/does-elasticsearch-lose-logs-in-the-event-of-an-unexpected-outage/313692 "2022-09-05T17:12:55Z")
I use Filebeat, Logstash, and Elasticsearch to collect logs. If a server with Elasticsearch and Logstash set up goes down unexpectedly, what happens to the logs sent by Filebeat? Will I lose them? If the server on whic… --- ## [Display a metric change over a period of time](https://discuss.elastic.co/t/display-a-metric-change-over-a-period-of-time/312487)
**Author:** [@Marius\_Kunauskas](https://discuss.elastic.co/u/Marius_Kunauskas)\ **Replies:** 1\ **Last updated:** [September 5, 2022, 3:50pm UTC](https://discuss.elastic.co/t/display-a-metric-change-over-a-period-of-time/312487 "2022-09-05T15:50:53Z")
I'm trying to create a single metric visualization, showing the difference between a current period's number vs last week's (or other timeframe's) number. E.g. let's say this week we made a $110 profit, last week we mad… --- ## [Nested SQL Query or Join within an index](https://discuss.elastic.co/t/nested-sql-query-or-join-within-an-index/312207)
**Author:** [@geethajini](https://discuss.elastic.co/u/geethajini)\ **Replies:** 0\ **Last updated:** [August 16, 2022, 5:29pm UTC](https://discuss.elastic.co/t/nested-sql-query-or-join-within-an-index/312207 "2022-08-16T17:29:52Z")
Hi All, I couldn't create a visualization/report for the following scenario in Kibana. We have docs added to an Index as given below. Here one batch (in example below: 20220809.000018), can have many fields like Suppli… --- ## [Fleet Server not starting with Elastic Agent (Error: fleet-server failed: context canceled)](https://discuss.elastic.co/t/fleet-server-not-starting-with-elastic-agent-error-fleet-server-failed-context-canceled/313662)
**Author:** [@cheshirecat](https://discuss.elastic.co/u/cheshirecat)\ **Replies:** 1\ **Last updated:** [September 5, 2022, 2:52pm UTC](https://discuss.elastic.co/t/fleet-server-not-starting-with-elastic-agent-error-fleet-server-failed-context-canceled/313662 "2022-09-05T14:52:04Z")
Hello There! I am trying to set up my fleet server and elastic agent. I am asked to do this: sudo elastic-agent enroll --url=https://{{ip\_address}}:{{port\_number\_1}} \\ --fleet-server-es=https://{{ip\_address}}:{{port… --- ## [Filebeat harvester unable to open file and unable to send logs to logstash](https://discuss.elastic.co/t/filebeat-harvester-unable-to-open-file-and-unable-to-send-logs-to-logstash/313675)
**Author:** [@SumitSingh](https://discuss.elastic.co/u/SumitSingh)\ **Replies:** 1\ **Last updated:** [September 5, 2022, 2:45pm UTC](https://discuss.elastic.co/t/filebeat-harvester-unable-to-open-file-and-unable-to-send-logs-to-logstash/313675 "2022-09-05T14:45:49Z")
Hello Folks, I have installed Elastic filebeat as a sidecar container in kubernetes cluster with main application "Sonarqube". I want to ships the sonarqube logs to logstash. Filebeat container is running and reading so… --- ## [ECK architecture](https://discuss.elastic.co/t/eck-architecture/313679)
**Author:** [@adityaPsl](https://discuss.elastic.co/u/adityaPsl)\ **Replies:** 1\ **Last updated:** [September 5, 2022, 2:28pm UTC](https://discuss.elastic.co/t/eck-architecture/313679 "2022-09-05T14:28:42Z")
Hello Team, I was reading through the ECK. just couple of queries regarding master node and adding new data nodes. When we configure number of master nodes , lets say 3 that means 3 master eligible nodes and only one… --- ## [Elastic search Kotlin Function score query](https://discuss.elastic.co/t/elastic-search-kotlin-function-score-query/313684)
**Author:** [@Meir\_Levi](https://discuss.elastic.co/u/Meir_Levi)\ **Replies:** 1\ **Last updated:** [September 5, 2022, 2:22pm UTC](https://discuss.elastic.co/t/elastic-search-kotlin-function-score-query/313684 "2022-09-05T14:22:17Z")
Hey I'm using kotlin and I want to write a code that run this query: { "query": { "function\_score": { "query": { "match\_all": {} }, "functions": \[ { "random\_score": { … --- ## [mTLS under basic license](https://discuss.elastic.co/t/mtls-under-basic-license/313375)
**Author:** [@Rohit\_Shrivastava](https://discuss.elastic.co/u/Rohit_Shrivastava)\ **Replies:** 10\ **Last updated:** [September 5, 2022, 2:09pm UTC](https://discuss.elastic.co/t/mtls-under-basic-license/313375 "2022-09-05T14:09:29Z")
Hi I am trying to setup mTLS and using basic license. However not able to understand how should I grant access to kibana CN? My goal is to create cert for kibana and use mTLS between elasticsearch and kibana. But for t… --- ## [Event correlation rule for new user creation](https://discuss.elastic.co/t/event-correlation-rule-for-new-user-creation/313690)
**Author:** [@realtech2338](https://discuss.elastic.co/u/realtech2338)\ **Replies:** 0\ **Last updated:** [September 5, 2022, 1:39pm UTC](https://discuss.elastic.co/t/event-correlation-rule-for-new-user-creation/313690 "2022-09-05T13:39:26Z")
Hi Team, I am trying create a new correlation rule for a series of evenid's . I have replicated the scenario in my lab. When a threat actor creates a new account by copying existing admin account and assiging new name e… --- ## [Filebeat 7.17 is not logging to files under Ubuntu](https://discuss.elastic.co/t/filebeat-7-17-is-not-logging-to-files-under-ubuntu/313671)
**Author:** [@andreycha](https://discuss.elastic.co/u/andreycha)\ **Replies:** 6\ **Last updated:** [September 5, 2022, 12:55pm UTC](https://discuss.elastic.co/t/filebeat-7-17-is-not-logging-to-files-under-ubuntu/313671 "2022-09-05T12:55:39Z")
Hi, I have a question similar to this one: Filebeat not logging to /var/log/filebeat With the exception that the version I'm using (7.17.6, DEB package) does not use "-e" by default according to documentation: Filebeat… --- ## [Logs don't show up when trying to use logstash](https://discuss.elastic.co/t/logs-dont-show-up-when-trying-to-use-logstash/312937)
**Author:** [@mammodde](https://discuss.elastic.co/u/mammodde)\ **Replies:** 15\ **Last updated:** [September 5, 2022, 12:33pm UTC](https://discuss.elastic.co/t/logs-dont-show-up-when-trying-to-use-logstash/312937 "2022-09-05T12:33:34Z")
when trying to execute winlogbeat.exe from powershell i receive this kind of errors in logs {"log.level":"error","@timestamp":"xxx","log.logger":"publisher\_pipeline\_output","log.origin":{"file.name":"pipeline/client\_wor… --- ## [Can not bulk update with script on index have mapping strict dynamic?](https://discuss.elastic.co/t/can-not-bulk-update-with-script-on-index-have-mapping-strict-dynamic/313132)
**Author:** [@robocon20x](https://discuss.elastic.co/u/robocon20x)\ **Replies:** 4\ **Last updated:** [September 5, 2022, 11:32am UTC](https://discuss.elastic.co/t/can-not-bulk-update-with-script-on-index-have-mapping-strict-dynamic/313132 "2022-09-05T11:32:04Z")
Hi guys, i use bulk request with Http to ES, but the error strict\_dynamic\_mapping\_exception has appear. this error not happening when I use bulk request with index have no dynamic\_strict. in my case, bulk reques… --- ## [Working with messages with string format and split the fields of them in logstash](https://discuss.elastic.co/t/working-with-messages-with-string-format-and-split-the-fields-of-them-in-logstash/313645)
**Author:** [@f.haeri](https://discuss.elastic.co/u/f.haeri)\ **Replies:** 3\ **Last updated:** [September 5, 2022, 10:33am UTC](https://discuss.elastic.co/t/working-with-messages-with-string-format-and-split-the-fields-of-them-in-logstash/313645 "2022-09-05T10:33:05Z")
I have this message: \[ReadDockerQueue\] \[ReadMessageQueue\] message: {"requestType":"PortfolioResponse","parametersJson":"{"algorithmAccessSpecifications":{"dockerName":"D1","xxx":"xxx","userName":"xxx","instanceGuid":"95… --- ## [Json.ignore\_decoding\_error: true automatically enables json processing for everything?](https://discuss.elastic.co/t/json-ignore-decoding-error-true-automatically-enables-json-processing-for-everything/311721)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 2\ **Last updated:** [September 5, 2022, 10:15am UTC](https://discuss.elastic.co/t/json-ignore-decoding-error-true-automatically-enables-json-processing-for-everything/311721 "2022-09-05T10:15:53Z")
Hi folks, On our openshift clusters we have a wide range of applications and workloads running, which write logs in different ways. If some developers write logs in json we want to enable them to annotate their workloa… --- ## [What does mean the "make update" in defining field mapping in filebeat document?](https://discuss.elastic.co/t/what-does-mean-the-make-update-in-defining-field-mapping-in-filebeat-document/313652)
**Author:** [@Siavash\_Fazli](https://discuss.elastic.co/u/Siavash_Fazli)\ **Replies:** 4\ **Last updated:** [September 5, 2022, 9:45am UTC](https://discuss.elastic.co/t/what-does-mean-the-make-update-in-defining-field-mapping-in-filebeat-document/313652 "2022-09-05T09:45:09Z")
Hi guys! I need to change some fields type (event.original) in the fields.yml in the filebeat configuration. But my changes don't apply in indexes after restarting filebeat. there is a command in filebeat documentatio… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=805) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=807)