# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=823 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 824 --- ## [Elastic ECK Filebeat logs from a pod](https://discuss.elastic.co/t/elastic-eck-filebeat-logs-from-a-pod/312409)
**Author:** [@joepa37](https://discuss.elastic.co/u/joepa37)\ **Replies:** 1\ **Last updated:** [August 22, 2022, 6:22am UTC](https://discuss.elastic.co/t/elastic-eck-filebeat-logs-from-a-pod/312409 "2022-08-22T06:22:28Z")
I have configured a Elastic ECK Beat with autodiscover for all pod logs, but I need to add logs from a specific pod log file. I have tried with module and log config but not working yet. The access.log file exists on th… --- ## [Creating an enrollment token in Elastic fails due to PrivateKey error](https://discuss.elastic.co/t/creating-an-enrollment-token-in-elastic-fails-due-to-privatekey-error/312461)
**Author:** [@Mostafa\_Talebi](https://discuss.elastic.co/u/Mostafa_Talebi)\ **Replies:** 4\ **Last updated:** [August 22, 2022, 5:49am UTC](https://discuss.elastic.co/t/creating-an-enrollment-token-in-elastic-fails-due-to-privatekey-error/312461 "2022-08-22T05:49:17Z")
I have created a three nodes elastic cluster, with two being master nodes. I have created CS, CERT and http.p12 files manually, all placed in their respective machines and when I run elastic, everything boots successful… --- ## [Determining which item in patterns array of a grok plugin was matched](https://discuss.elastic.co/t/determining-which-item-in-patterns-array-of-a-grok-plugin-was-matched/312538)
**Author:** [@who](https://discuss.elastic.co/u/who)\ **Replies:** 0\ **Last updated:** [August 21, 2022, 6:31am UTC](https://discuss.elastic.co/t/determining-which-item-in-patterns-array-of-a-grok-plugin-was-matched/312538 "2022-08-21T06:31:48Z")
Assuming we're using the grok filter plugin in the "multiple patterns for a single field" mode: filter { grok { match =\> { "message" =\> \[ "Duration: %{NUMBER:duration}", … --- ## [Dissectfailure when it shouldn't](https://discuss.elastic.co/t/dissectfailure-when-it-shouldnt/312375)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 3\ **Last updated:** [August 22, 2022, 4:10am UTC](https://discuss.elastic.co/t/dissectfailure-when-it-shouldnt/312375 "2022-08-22T04:10:25Z")
Hi All, I'm puzzled. I have a logstash configuration working on two servers. First is fine, but on the second an error says there is a dissect failure \[2022-08-18T11:13:02,260\]\[WARN \]\[org.logstash.dissect.Dissector\] D… --- ## [Can't run curl in terminal](https://discuss.elastic.co/t/cant-run-curl-in-terminal/312469)
**Author:** [@Sarindra\_Therese](https://discuss.elastic.co/u/Sarindra_Therese)\ **Replies:** 0\ **Last updated:** [August 19, 2022, 12:43pm UTC](https://discuss.elastic.co/t/cant-run-curl-in-terminal/312469 "2022-08-19T12:43:56Z")
Hi Everyone, I don't know what's happen, but i can't run curl cmd in terminal, I've already ran curl -GET https://127.0.0.1:9200 and the response is: curl: (58) could not load PEM client certificate, OpenSSL error e… --- ## [Version history](https://discuss.elastic.co/t/version-history/312463)
**Author:** [@afuente](https://discuss.elastic.co/u/afuente)\ **Replies:** 1\ **Last updated:** [August 22, 2022, 12:27am UTC](https://discuss.elastic.co/t/version-history/312463 "2022-08-22T00:27:32Z")
Hello, guys!! Is it possible to see the version history of a saved query, dashboard, visualization, etc.? I mean, I created a saved query, but another user has changed it without telling me, is it possible to know who c… --- ## [Registry Proxy Authentication](https://discuss.elastic.co/t/registry-proxy-authentication/312460)
**Author:** [@zirota](https://discuss.elastic.co/u/zirota)\ **Replies:** 0\ **Last updated:** [August 19, 2022, 11:22am UTC](https://discuss.elastic.co/t/registry-proxy-authentication/312460 "2022-08-19T11:22:25Z")
Hello, Any idea how I can provide credentials to the proxy specified xpack.fleet.registryProxyUrl? Usually when working with proxies, we make use of the username:password basic authentication in the URL such as "https:… --- ## [How to fix vulnerability(CVE-2001-1199)](https://discuss.elastic.co/t/how-to-fix-vulnerability-cve-2001-1199/312441)
**Author:** [@wilsonyy](https://discuss.elastic.co/u/wilsonyy)\ **Replies:** 5\ **Last updated:** [August 22, 2022, 12:26am UTC](https://discuss.elastic.co/t/how-to-fix-vulnerability-cve-2001-1199/312441 "2022-08-22T00:26:50Z")
A cross-site scripting vulnerability（ CVE-2001-1199） was found in Elasticsearch:9200，I've never seen it before，so how to fix it, anybody helps? --- ## [Elasticsearch -not starting after boot on ubuntu server 22.04.1](https://discuss.elastic.co/t/elasticsearch-not-starting-after-boot-on-ubuntu-server-22-04-1/312528)
**Author:** [@bezder](https://discuss.elastic.co/u/bezder)\ **Replies:** 1\ **Last updated:** [August 22, 2022, 12:24am UTC](https://discuss.elastic.co/t/elasticsearch-not-starting-after-boot-on-ubuntu-server-22-04-1/312528 "2022-08-22T00:24:35Z")
Hello, when i reboot my ubuntu server and run systemctl status elasticsearch i am getting errror as below, when i execute afterward systemctl restart elasticsearch; all works okay ... any idea why its not starting p… --- ## [How to return hour by hour average for the last X days?](https://discuss.elastic.co/t/how-to-return-hour-by-hour-average-for-the-last-x-days/312560)
**Author:** [@Yi\_HAN](https://discuss.elastic.co/u/Yi_HAN)\ **Replies:** 0\ **Last updated:** [August 21, 2022, 10:03pm UTC](https://discuss.elastic.co/t/how-to-return-hour-by-hour-average-for-the-last-x-days/312560 "2022-08-21T22:03:34Z")
I have the following script to return an aggregation hour by hour of last x days on ExecNom: GET /mkt-with-time/\_search { "size": 0, "query": { "range": { "@timestamp": { "gte": "now-7d/d", … --- ## [\[Solved\] Cast/Map IP Field to IP Type](https://discuss.elastic.co/t/solved-cast-map-ip-field-to-ip-type/312558)
**Author:** [@snkhan](https://discuss.elastic.co/u/snkhan)\ **Replies:** 1\ **Last updated:** [August 21, 2022, 9:59pm UTC](https://discuss.elastic.co/t/solved-cast-map-ip-field-to-ip-type/312558 "2022-08-21T21:59:15Z")
Hello, I am a new ELK user, and am trying in vain to cast an existing field containing an IP address to an IP data type. From the copious searches it is clear that I must use mappings, but my attempts to do so have fail… --- ## [Add Runtime Field By UpdateQueryAsync](https://discuss.elastic.co/t/add-runtime-field-by-updatequeryasync/312532)
**Author:** [@Rahma\_Boughale](https://discuss.elastic.co/u/Rahma_Boughale)\ **Replies:** 2\ **Last updated:** [August 21, 2022, 12:19pm UTC](https://discuss.elastic.co/t/add-runtime-field-by-updatequeryasync/312532 "2022-08-21T12:19:45Z")
Hello all, i am new to elasticsearch, i am trying to add a new field(runtime field) by UpdateByQueryAsync in my index(it already created), i did some research and i saw that we can add a new fiel by this syntax : var u… --- ## [How to set up 'allow\_custom\_routing' for data streams?](https://discuss.elastic.co/t/how-to-set-up-allow-custom-routing-for-data-streams/312544)
**Author:** [@dkosenko](https://discuss.elastic.co/u/dkosenko)\ **Replies:** 0\ **Last updated:** [August 21, 2022, 11:43am UTC](https://discuss.elastic.co/t/how-to-set-up-allow-custom-routing-for-data-streams/312544 "2022-08-21T11:43:29Z")
Hi, How do I create a stream with "allow\_custom\_routing": true? I cannot find any documention on it. I have specified: "mappings": { "dynamic": "true", "\_routing": { "required": true }, but it has n… --- ## [Initializing a new grok filter from ruby filter](https://discuss.elastic.co/t/initializing-a-new-grok-filter-from-ruby-filter/311722)
**Author:** [@who](https://discuss.elastic.co/u/who)\ **Replies:** 2\ **Last updated:** [August 21, 2022, 6:19am UTC](https://discuss.elastic.co/t/initializing-a-new-grok-filter-from-ruby-filter/311722 "2022-08-21T06:19:00Z")
I'm going to declare and call grok filter from inside a ruby filter like this: ruby { code =\> "@grok = LogStash::Filters::Grok @grok.new(event.get("message"), "\\d+") #call grok plugin for this pipleline " }… --- ## [Vega Pie doesn't show slices with scripted\_metric, only the values in the middle of the chart without a Pie](https://discuss.elastic.co/t/vega-pie-doesnt-show-slices-with-scripted-metric-only-the-values-in-the-middle-of-the-chart-without-a-pie/312265)
**Author:** [@DMinovski](https://discuss.elastic.co/u/DMinovski)\ **Replies:** 1\ **Last updated:** [August 21, 2022, 3:52am UTC](https://discuss.elastic.co/t/vega-pie-doesnt-show-slices-with-scripted-metric-only-the-values-in-the-middle-of-the-chart-without-a-pie/312265 "2022-08-21T03:52:55Z")
I'm using Vega to create a Pie visualization that gets its data from an Elasticsearch index. I used the code for the Radial Plot pie example: Radial Plot Example | Vega, but I changed it to use an index and scripted\_metr… --- ## [Jdbc\_streaming statement using a field from input?](https://discuss.elastic.co/t/jdbc-streaming-statement-using-a-field-from-input/312537)
**Author:** [@deep08](https://discuss.elastic.co/u/deep08)\ **Replies:** 0\ **Last updated:** [August 21, 2022, 2:55am UTC](https://discuss.elastic.co/t/jdbc-streaming-statement-using-a-field-from-input/312537 "2022-08-21T02:55:34Z")
Hello , I have a jdbc\_streaming filter and I want to pass statement as a field value from input . I tried different ways to inject field value in statement but always seeing "exception":"Java::JavaSql::SQLSyntaxErrorEx… --- ## [Options to Create/Add a New Field](https://discuss.elastic.co/t/options-to-create-add-a-new-field/312507)
**Author:** [@Yolanda.darricarrere](https://discuss.elastic.co/u/Yolanda.darricarrere)\ **Replies:** 1\ **Last updated:** [August 21, 2022, 1:53am UTC](https://discuss.elastic.co/t/options-to-create-add-a-new-field/312507 "2022-08-21T01:53:14Z")
Using the ecommerce data, I want to create a new field that is the total of products.taxful\_price minus products.discount\_amount (make it a double), then add the new field to a line graph using data from the past 7-days.… --- ## [Elasticsearch not coming up after restart](https://discuss.elastic.co/t/elasticsearch-not-coming-up-after-restart/310718)
**Author:** [@samee\_alam](https://discuss.elastic.co/u/samee_alam)\ **Replies:** 4\ **Last updated:** [August 20, 2022, 11:51pm UTC](https://discuss.elastic.co/t/elasticsearch-not-coming-up-after-restart/310718 "2022-08-20T23:51:34Z")
After deleting elasticsearch pod, it is not able to come up. (Ready state 0/1) Cluster health is yellow. fluentd is not able to connect to ES. elasticsearch@elasticsearch-master-0:~$ curl -XGET 'http://localhost:9200/… --- ## [How to append the nested fields in already created elasticsearch index using ES API](https://discuss.elastic.co/t/how-to-append-the-nested-fields-in-already-created-elasticsearch-index-using-es-api/312525)
**Author:** [@Sabaridass10](https://discuss.elastic.co/u/Sabaridass10)\ **Replies:** 0\ **Last updated:** [August 20, 2022, 7:51pm UTC](https://discuss.elastic.co/t/how-to-append-the-nested-fields-in-already-created-elasticsearch-index-using-es-api/312525 "2022-08-20T19:51:48Z")
I tried to append the nested field using below syntax but showing some error. Can anyone please help me on this? PUT url : es\_index/\_mappings { "properties": { "assignee": { "properties": { "components": { "proper… --- ## [Fiels does not contain any data after loading data using bulk](https://discuss.elastic.co/t/fiels-does-not-contain-any-data-after-loading-data-using-bulk/312510)
**Author:** [@SofiaContreras](https://discuss.elastic.co/u/SofiaContreras)\ **Replies:** 5\ **Last updated:** [August 20, 2022, 6:14pm UTC](https://discuss.elastic.co/t/fiels-does-not-contain-any-data-after-loading-data-using-bulk/312510 "2022-08-20T18:14:44Z")
I'm trying to make some visualizations using kibana, but the fields have any data. I thought that if I fill up an index in dev ops using bulk, then I would be able to interact with the data using kibana. Here is the cod… --- ## [Right structure for index](https://discuss.elastic.co/t/right-structure-for-index/312515)
**Author:** [@Kimblis](https://discuss.elastic.co/u/Kimblis)\ **Replies:** 3\ **Last updated:** [August 20, 2022, 3:28pm UTC](https://discuss.elastic.co/t/right-structure-for-index/312515 "2022-08-20T15:28:04Z")
Hello, in my application I have registered users (Users), unregistered users (Guests) and service providers (Providers). Provider can have clients, it's either Users or Guests. I want to have autosuggest and search for s… --- ## [Is it possible to pass a large amount of parameters to painless script to perform sort?](https://discuss.elastic.co/t/is-it-possible-to-pass-a-large-amount-of-parameters-to-painless-script-to-perform-sort/312519)
**Author:** [@Lee\_JW](https://discuss.elastic.co/u/Lee_JW)\ **Replies:** 0\ **Last updated:** [August 20, 2022, 12:23pm UTC](https://discuss.elastic.co/t/is-it-possible-to-pass-a-large-amount-of-parameters-to-painless-script-to-perform-sort/312519 "2022-08-20T12:23:08Z")
Say there is a field that can be one of 200 distinct values (keyword). Every 2 different values are associated by a custom relevant score (it is a statistical data that cannot be mathematically calculted). For example, … --- ## [Shard reroute and exchange Primary and Replica on a node](https://discuss.elastic.co/t/shard-reroute-and-exchange-primary-and-replica-on-a-node/312514)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 1\ **Last updated:** [August 20, 2022, 10:45am UTC](https://discuss.elastic.co/t/shard-reroute-and-exchange-primary-and-replica-on-a-node/312514 "2022-08-20T10:45:30Z")
Hi dears I have a cluster with 2 nodes. one of them is master and another is replica Bellow is all shards in monitor-node-01 : As you see, all of shards in this node is "Primary" and all "Replica" shards are on m… --- ## [Logstash http input fails](https://discuss.elastic.co/t/logstash-http-input-fails/312268)
**Author:** [@cihady](https://discuss.elastic.co/u/cihady)\ **Replies:** 3\ **Last updated:** [August 20, 2022, 6:56am UTC](https://discuss.elastic.co/t/logstash-http-input-fails/312268 "2022-08-20T06:56:27Z")
I am trying to api call logstash by using http input but when I send request I got error below Here is my config file input { http { host=\>"0.0.0.0" port =\>"2020" } } output { elasticsearch { hosts =\> … --- ## [KIbana Status is Yellow and I the pods become unavailable](https://discuss.elastic.co/t/kibana-status-is-yellow-and-i-the-pods-become-unavailable/312512)
**Author:** [@Francisco\_Yanez](https://discuss.elastic.co/u/Francisco_Yanez)\ **Replies:** 0\ **Last updated:** [August 20, 2022, 5:03am UTC](https://discuss.elastic.co/t/kibana-status-is-yellow-and-i-the-pods-become-unavailable/312512 "2022-08-20T05:03:13Z")
Hello Everyone, I am running the Elastic stack on Kubernetes. Recently I starting having timeouts on my kibana pods, getting alerts and in the kibana dashboard a few of the instances become yellow. I have 4 pods (instan… --- ## [How to iterate through aggregation buckets and send mail corresponding to each bucket using watcher action](https://discuss.elastic.co/t/how-to-iterate-through-aggregation-buckets-and-send-mail-corresponding-to-each-bucket-using-watcher-action/312474)
**Author:** [@bhavya](https://discuss.elastic.co/u/bhavya)\ **Replies:** 2\ **Last updated:** [August 19, 2022, 6:14pm UTC](https://discuss.elastic.co/t/how-to-iterate-through-aggregation-buckets-and-send-mail-corresponding-to-each-bucket-using-watcher-action/312474 "2022-08-19T18:14:12Z")
I am trying to iterate through the aggregation bucket results. The aggregation response is : "aggregations" : { "agg1" : { "doc\_count\_error\_upper\_bound" : 0, "sum\_other\_doc\_count" : 0, "buckets" : … --- ## [How to write a filter for a file containing a mix of xml and non xml messages](https://discuss.elastic.co/t/how-to-write-a-filter-for-a-file-containing-a-mix-of-xml-and-non-xml-messages/312503)
**Author:** [@Patr123](https://discuss.elastic.co/u/Patr123)\ **Replies:** 2\ **Last updated:** [August 19, 2022, 9:46pm UTC](https://discuss.elastic.co/t/how-to-write-a-filter-for-a-file-containing-a-mix-of-xml-and-non-xml-messages/312503 "2022-08-19T21:46:15Z")
Hello, I have a log file which is a mix of xml and regular (non xml) lines. I need to apply grok filer + xml filter to the lines that has xml block and apply only grok filter to the regular lines. For that I need help i… --- ## [Search across different indices with consistent ranking](https://discuss.elastic.co/t/search-across-different-indices-with-consistent-ranking/311916)
**Author:** [@stelitz](https://discuss.elastic.co/u/stelitz)\ **Replies:** 5\ **Last updated:** [August 19, 2022, 8:21pm UTC](https://discuss.elastic.co/t/search-across-different-indices-with-consistent-ranking/311916 "2022-08-19T20:21:32Z")
Hi everyone, I just got started with Elasticsearch and it's really awesome! I am, however, struggling with implementing one specific use case. Let's say I have different logical entities like books and authors and I wan… --- ## [Using event.get to get variable initialized to string](https://discuss.elastic.co/t/using-event-get-to-get-variable-initialized-to-string/312360)
**Author:** [@Mor\_Y](https://discuss.elastic.co/u/Mor_Y)\ **Replies:** 2\ **Last updated:** [August 19, 2022, 6:32pm UTC](https://discuss.elastic.co/t/using-event-get-to-get-variable-initialized-to-string/312360 "2022-08-19T18:32:18Z")
Hi, I want to add some fields that will have the same values of others but with different names: for Example the input json: {"Environment" : "x", "Name" : "y"} The output will be: {"Environment" : "x", "Name" : "y",… --- ## [I'm using "match-Boolean-prefix query but I can't get the exact match of the query](https://discuss.elastic.co/t/im-using-match-boolean-prefix-query-but-i-cant-get-the-exact-match-of-the-query/312492)
**Author:** [@paris1](https://discuss.elastic.co/u/paris1)\ **Replies:** 0\ **Last updated:** [August 19, 2022, 6:18pm UTC](https://discuss.elastic.co/t/im-using-match-boolean-prefix-query-but-i-cant-get-the-exact-match-of-the-query/312492 "2022-08-19T18:18:57Z")
I'm using "match-Boolean-prefix query but I can't get the exact match of the query.I can't use prefix queries because I also need "not exact match" results and I also need the fuzziness and word completion.I get every th… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=822) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=824)