# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=812 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 813 --- ## [Logstash CSV filter plugins](https://discuss.elastic.co/t/logstash-csv-filter-plugins/313327)
**Author:** [@priyankamondalhcl](https://discuss.elastic.co/u/priyankamondalhcl)\ **Replies:** 1\ **Last updated:** [August 31, 2022, 8:19am UTC](https://discuss.elastic.co/t/logstash-csv-filter-plugins/313327 "2022-08-31T08:19:18Z")
Hi Team, I am trying to read csv file and storing it in elasticsearch. Is there any way to read column from file itself (header of csv file ) in logstash "csv filter plugins". currently I am manually setting up the co… --- ## [SNAPSHOT AND RESTORE](https://discuss.elastic.co/t/snapshot-and-restore/313320)
**Author:** [@Milan\_Dangol](https://discuss.elastic.co/u/Milan_Dangol)\ **Replies:** 2\ **Last updated:** [August 31, 2022, 8:07am UTC](https://discuss.elastic.co/t/snapshot-and-restore/313320 "2022-08-31T08:07:45Z")
Hey there i am back with another question :sweat\_smile: So i was fooling around with snap and restore and i created a dummy index name "elastic\_snapshot\_demo" and after taking the backup of the index i came back to my el… --- ## [Getting aggregate statistics about a dense\_vector field](https://discuss.elastic.co/t/getting-aggregate-statistics-about-a-dense-vector-field/268694)
**Author:** [@MaJaHa95](https://discuss.elastic.co/u/MaJaHa95)\ **Replies:** 2\ **Last updated:** [August 31, 2022, 8:04am UTC](https://discuss.elastic.co/t/getting-aggregate-statistics-about-a-dense-vector-field/268694 "2022-08-31T08:04:51Z")
Hey, I'm making lots of great use of the dense\_vector field type, but I've hit a bit of a wall now. Is there any way I can get the "average" from a vector field? Context My real use-case is a bit more complex, but imag… --- ## [Doing a significant text aggregation with a custom analyzer](https://discuss.elastic.co/t/doing-a-significant-text-aggregation-with-a-custom-analyzer/313059)
**Author:** [@Ivo\_Tavares](https://discuss.elastic.co/u/Ivo_Tavares)\ **Replies:** 5\ **Last updated:** [August 31, 2022, 7:09am UTC](https://discuss.elastic.co/t/doing-a-significant-text-aggregation-with-a-custom-analyzer/313059 "2022-08-31T07:09:51Z")
I have an ES index with a mapping like this: {'texts-temp': {'aliases': {}, 'mappings': {'properties': {'data': {'properties': (...) 'user\_text': {'type': 'text', 'fields… --- ## [Unable to rollout Elastic-Agent (Windows) to fleet](https://discuss.elastic.co/t/unable-to-rollout-elastic-agent-windows-to-fleet/313315)
**Author:** [@nlstbv-winter](https://discuss.elastic.co/u/nlstbv-winter)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 6:34am UTC](https://discuss.elastic.co/t/unable-to-rollout-elastic-agent-windows-to-fleet/313315 "2022-08-31T06:34:13Z")
Hi, since updating Elastic to 8.4 (coming from 8.3), I'm unable to rollout elastic-agent for windows to one client. I've checked the token, it's valid and I'm able to rollout elastic-agent to other clients with this tok… --- ## [I can't find logs on elasticsearch](https://discuss.elastic.co/t/i-cant-find-logs-on-elasticsearch/313224)
**Author:** [@mammodde](https://discuss.elastic.co/u/mammodde)\ **Replies:** 8\ **Last updated:** [August 31, 2022, 6:49am UTC](https://discuss.elastic.co/t/i-cant-find-logs-on-elasticsearch/313224 "2022-08-31T06:49:30Z")
Hi, I have a problem on finding the logs on the elasticsearch docker. I can see them on kibana but I don't know where to find them. this is the docker-compose.yml that I used in order to create all the containers versi… --- ## [Java api client - range query](https://discuss.elastic.co/t/java-api-client-range-query/313317)
**Author:** [@Deepa\_Das](https://discuss.elastic.co/u/Deepa_Das)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 6:53am UTC](https://discuss.elastic.co/t/java-api-client-range-query/313317 "2022-08-31T06:53:10Z")
Hi, I am migrating a java application from Elasticsearch high level client to java api client. There is a range query like this in the code. QueryBuilders.rangeQuery("startDate").lte(dateUtils.today()) Need to change t… --- ## [Squid module does not parse logs](https://discuss.elastic.co/t/squid-module-does-not-parse-logs/313088)
**Author:** [@it\_dev](https://discuss.elastic.co/u/it_dev)\ **Replies:** 22\ **Last updated:** [August 31, 2022, 6:05am UTC](https://discuss.elastic.co/t/squid-module-does-not-parse-logs/313088 "2022-08-31T06:05:03Z")
I have Linux syslog server. My squid server (separate from Linux syslog) sends all its access.log files to Linux syslog server into /var/log/squid/\*.log There, on my Linux syslog server I have installed filebeat 8.4. I … --- ## [How to change indexing\_pressure.memory.limit configuration](https://discuss.elastic.co/t/how-to-change-indexing-pressure-memory-limit-configuration/312444)
**Author:** [@DesireWithin](https://discuss.elastic.co/u/DesireWithin)\ **Replies:** 5\ **Last updated:** [August 31, 2022, 5:56am UTC](https://discuss.elastic.co/t/how-to-change-indexing-pressure-memory-limit-configuration/312444 "2022-08-31T05:56:22Z")
My es version is 7.17.5, single node. I notice that my fluent-bit return following error log: {"log":"{\\"error\\":{\\"root\_cause\\":\[{\\"type\\":\\"es\_rejected\_execution\_exception\\",\\"reason\\":\\"rejected execution of coordin… --- ## [\_update Object filed with json or flattened](https://discuss.elastic.co/t/update-object-filed-with-json-or-flattened/313308)
**Author:** [@liurui](https://discuss.elastic.co/u/liurui)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 4:57am UTC](https://discuss.elastic.co/t/update-object-filed-with-json-or-flattened/313308 "2022-08-31T04:57:13Z")
hello~ I have an index with mapping like this: "test" : { "aliases" : { }, "mappings" : { "properties" : { "out" : { "properties" : { "in" : { "type" : "keywor… --- ## [Logstash import XML/ HTTP fails](https://discuss.elastic.co/t/logstash-import-xml-http-fails/313305)
**Author:** [@phamquenhu95](https://discuss.elastic.co/u/phamquenhu95)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 4:02am UTC](https://discuss.elastic.co/t/logstash-import-xml-http-fails/313305 "2022-08-31T04:02:53Z")
I am new in this field. I have the following XML file, I want to separate the fields eg "so2Grade", "coFlag",... into rows one by one. My conf file is as follows: input { http\_poller { urls =\> { urlname =\> … --- ## [Elastic Cloud/Kibana Embed Authentication](https://discuss.elastic.co/t/elastic-cloud-kibana-embed-authentication/313289)
**Author:** [@Donnie\_Kerr](https://discuss.elastic.co/u/Donnie_Kerr)\ **Replies:** 5\ **Last updated:** [August 31, 2022, 4:14am UTC](https://discuss.elastic.co/t/elastic-cloud-kibana-embed-authentication/313289 "2022-08-31T04:14:29Z")
I would like the users of my web app to access Kibana Cloud dashboard by embedding them into the app. Users access my app via Auth0. I am using Elastic Cloud with Kibana. I need help understanding how to implement thes… --- ## [Upgrade ELK on docker from 7.10 to 7.17](https://discuss.elastic.co/t/upgrade-elk-on-docker-from-7-10-to-7-17/312839)
**Author:** [@Boodle](https://discuss.elastic.co/u/Boodle)\ **Replies:** 9\ **Last updated:** [August 31, 2022, 3:30am UTC](https://discuss.elastic.co/t/upgrade-elk-on-docker-from-7-10-to-7-17/312839 "2022-08-31T03:30:51Z")
Need to upgrade Elasticsearch , Kibana installed with docker compose from 7.10 to 7.17 This document shares other methods but not containers installed/started with docker compose - swarm. Is their a steps by step docu… --- ## [S3 input plugin point to today's date or skip old data](https://discuss.elastic.co/t/s3-input-plugin-point-to-todays-date-or-skip-old-data/313304)
**Author:** [@sw0701](https://discuss.elastic.co/u/sw0701)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 2:33am UTC](https://discuss.elastic.co/t/s3-input-plugin-point-to-todays-date-or-skip-old-data/313304 "2022-08-31T02:33:18Z")
Hi, I want to ignore the old data in the bucket and point to start from today's date for example: 2022-08-31T01:00:\* Please let me know how i can point to that timestamp or latest timestamp. bash-4.2$ cat sincedb\_3109… --- ## [Any suggestions for creating logstash pipeline by REST APIs](https://discuss.elastic.co/t/any-suggestions-for-creating-logstash-pipeline-by-rest-apis/313219)
**Author:** [@jskuo](https://discuss.elastic.co/u/jskuo)\ **Replies:** 0\ **Last updated:** [August 30, 2022, 7:02am UTC](https://discuss.elastic.co/t/any-suggestions-for-creating-logstash-pipeline-by-rest-apis/313219 "2022-08-30T07:02:17Z")
platform: es/logstash 7.17.5 on centos 7 I intend to create a logstash pipeline, named test, by REST APIs curl -XPUT localhost:9600/\_logstash/pipeline/test?pretty -H "content-type:application/json" -d '{"pipeline": "in… --- ## [Version conflict (409) question](https://discuss.elastic.co/t/version-conflict-409-question/311335)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 10\ **Last updated:** [August 30, 2022, 11:43pm UTC](https://discuss.elastic.co/t/version-conflict-409-question/311335 "2022-08-30T23:43:48Z")
Is version conflict bulk write error (409) only occur when I'm updating the same document from 2 different writers? I am starting to see this error more often in our system and trying to figure out if our data pattern h… --- ## [Executing bash script in logstash's filter and geting data back to field](https://discuss.elastic.co/t/executing-bash-script-in-logstashs-filter-and-geting-data-back-to-field/313297)
**Author:** [@rayg00n](https://discuss.elastic.co/u/rayg00n)\ **Replies:** 3\ **Last updated:** [August 30, 2022, 10:17pm UTC](https://discuss.elastic.co/t/executing-bash-script-in-logstashs-filter-and-geting-data-back-to-field/313297 "2022-08-30T22:17:47Z")
Hello friends! I need some help with my logstash config. I want to get event field "winlog.event\_data.ObjectName" and take it to a bash script. Then I want to get the result back and put it in the "winlog.event\_data.O… --- ## [New cluster -\> single node to cluster](https://discuss.elastic.co/t/new-cluster-single-node-to-cluster/313035)
**Author:** [@PSFletchTheTek](https://discuss.elastic.co/u/PSFletchTheTek)\ **Replies:** 4\ **Last updated:** [August 30, 2022, 10:14pm UTC](https://discuss.elastic.co/t/new-cluster-single-node-to-cluster/313035 "2022-08-30T22:14:47Z")
Hi all, This has been bugging me for ages. I've never been able to get a cluster built using a internal ca. I've used certutil to make the car's. Signed them using my ca. Put all of the certs on the clusters. But n… --- ## [JOIN two indexes using ElasticSearch Node.js client](https://discuss.elastic.co/t/join-two-indexes-using-elasticsearch-node-js-client/313283)
**Author:** [@sadiki-dev](https://discuss.elastic.co/u/sadiki-dev)\ **Replies:** 1\ **Last updated:** [August 30, 2022, 9:36pm UTC](https://discuss.elastic.co/t/join-two-indexes-using-elasticsearch-node-js-client/313283 "2022-08-30T21:36:31Z")
I have two indexes (two collections) , products index and reviews index. The two is linked by productId. The structure of both are : // products.json \[ { "id": 1, "name": "IPhone 11", "quanti… --- ## [Inconsistent first result when changing \`size\` in script sorted search](https://discuss.elastic.co/t/inconsistent-first-result-when-changing-size-in-script-sorted-search/313282)
**Author:** [@\_Matthew\_Pavlinsky](https://discuss.elastic.co/u/_Matthew_Pavlinsky)\ **Replies:** 2\ **Last updated:** [August 30, 2022, 9:31pm UTC](https://discuss.elastic.co/t/inconsistent-first-result-when-changing-size-in-script-sorted-search/313282 "2022-08-30T21:31:55Z")
I am trying to use a painless script sort and am experiencing different results when I change the size value of the query, I would expect that since sort happens before paging that the same query with a different size wo… --- ## [HTML strip pipeline isn't working](https://discuss.elastic.co/t/html-strip-pipeline-isnt-working/313288)
**Author:** [@wpm](https://discuss.elastic.co/u/wpm)\ **Replies:** 1\ **Last updated:** [August 30, 2022, 8:47pm UTC](https://discuss.elastic.co/t/html-strip-pipeline-isnt-working/313288 "2022-08-30T20:47:18Z")
I'm trying to write a pipeline that strips HTML. I can't get it to work, and it's so simple I don't know what could be wrong. GET /\_ingest/pipeline/simple { "simple": { "processors": \[ { "html\_strip"… --- ## [ElasticSearchClient Search function](https://discuss.elastic.co/t/elasticsearchclient-search-function/313290)
**Author:** [@rayyanalbaz1](https://discuss.elastic.co/u/rayyanalbaz1)\ **Replies:** 0\ **Last updated:** [August 30, 2022, 8:22pm UTC](https://discuss.elastic.co/t/elasticsearchclient-search-function/313290 "2022-08-30T20:22:51Z")
Hello, We are trying to implement nested queries like this provided example: And was wondering if it is possible that we can add the query objects dynamically depending on the number of the query objects created. For … --- ## [Deep search, Searching by number](https://discuss.elastic.co/t/deep-search-searching-by-number/313281)
**Author:** [@sadiki-dev](https://discuss.elastic.co/u/sadiki-dev)\ **Replies:** 1\ **Last updated:** [August 30, 2022, 7:42pm UTC](https://discuss.elastic.co/t/deep-search-searching-by-number/313281 "2022-08-30T19:42:50Z")
I have a products index. Its structure is : \[ { "id": 1, "name": "IPhone 11", "quantity\_stock": 100, "description": "description of IPhone 11", "manufacturing": { … --- ## [Ingest Pipeline is not applying tag, what am I missing?](https://discuss.elastic.co/t/ingest-pipeline-is-not-applying-tag-what-am-i-missing/313272)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 1\ **Last updated:** [August 30, 2022, 6:43pm UTC](https://discuss.elastic.co/t/ingest-pipeline-is-not-applying-tag-what-am-i-missing/313272 "2022-08-30T18:43:03Z")
I've set up an ingest pipeline that sends my docker container logs through the appropriate built-in pipeline for the kind of logs the container is outputting. (See: Making Docker container logs go through the right beat… --- ## [How to create a webhook endpoint url in ELK](https://discuss.elastic.co/t/how-to-create-a-webhook-endpoint-url-in-elk/313271)
**Author:** [@srek3502](https://discuss.elastic.co/u/srek3502)\ **Replies:** 1\ **Last updated:** [August 30, 2022, 6:34pm UTC](https://discuss.elastic.co/t/how-to-create-a-webhook-endpoint-url-in-elk/313271 "2022-08-30T18:34:25Z")
Hi, Can anyone please share the relevant document for ELK to create a webhook endpoint url. ? I need to configure this ELK webhook endpoint url to be used in other application to POST a payload. Any useful information … --- ## [Problem with similar terms](https://discuss.elastic.co/t/problem-with-similar-terms/313276)
**Author:** [@Guilherme\_Mello](https://discuss.elastic.co/u/Guilherme_Mello)\ **Replies:** 1\ **Last updated:** [August 30, 2022, 6:22pm UTC](https://discuss.elastic.co/t/problem-with-similar-terms/313276 "2022-08-30T18:22:01Z")
I have a search using term "calca" but the result list contains "calce" Is there a way to avoid this type of behavior? Thanks --- ## [Performance issue running on ECK vs EC2 on AWS](https://discuss.elastic.co/t/performance-issue-running-on-eck-vs-ec2-on-aws/313263)
**Author:** [@PascalB](https://discuss.elastic.co/u/PascalB)\ **Replies:** 2\ **Last updated:** [August 30, 2022, 5:18pm UTC](https://discuss.elastic.co/t/performance-issue-running-on-eck-vs-ec2-on-aws/313263 "2022-08-30T17:18:32Z")
Hello, I am new here and I am trying to understand performance issues. I am running an index on two different deployments of Elasticsearch. The index is the same (I've used the backup/restore operation to make sure I ha… --- ## [Making Docker container logs go through the right beats module for processing?](https://discuss.elastic.co/t/making-docker-container-logs-go-through-the-right-beats-module-for-processing/312126)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 10\ **Last updated:** [August 30, 2022, 5:15pm UTC](https://discuss.elastic.co/t/making-docker-container-logs-go-through-the-right-beats-module-for-processing/312126 "2022-08-30T17:15:29Z")
I've successfully configured Elastic Agent to grab my Docker container logs and send them to an ingest pipeline for processing. I'm using the JSON parser to get my fields and timestamp set up. But now I'm stuck on how t… --- ## [ILM alias errors - illegal\_argument\_exception: index.lifecycle.rollover\_alias](https://discuss.elastic.co/t/ilm-alias-errors-illegal-argument-exception-index-lifecycle-rollover-alias/313167)
**Author:** [@vee](https://discuss.elastic.co/u/vee)\ **Replies:** 2\ **Last updated:** [August 30, 2022, 4:31pm UTC](https://discuss.elastic.co/t/ilm-alias-errors-illegal-argument-exception-index-lifecycle-rollover-alias/313167 "2022-08-30T16:31:46Z")
Hi, am seeing this issue even though I believe the seed index was created with the correct write index: illegal\_argument\_exception: index.lifecycle.rollover\_alias \[test-logs\] does not point to index \[test-logs-2022.08.1… --- ## [Gzip file input failing again in Logstash 8.4](https://discuss.elastic.co/t/gzip-file-input-failing-again-in-logstash-8-4/313255)
**Author:** [@freddyh](https://discuss.elastic.co/u/freddyh)\ **Replies:** 1\ **Last updated:** [August 30, 2022, 4:17pm UTC](https://discuss.elastic.co/t/gzip-file-input-failing-again-in-logstash-8-4/313255 "2022-08-30T16:17:08Z")
There's a few discussion posts (1, 2) and a github issue about a similar issue in the past, but previously it was reported to happen with unsupported Java versions, but I'm now getting this with version 8.4 of the offici… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=811) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=813)