# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=825 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 826 --- ## [RELP plugin does not parse syslogs](https://discuss.elastic.co/t/relp-plugin-does-not-parse-syslogs/312365)
**Author:** [@Fastfox](https://discuss.elastic.co/u/Fastfox)\ **Replies:** 2\ **Last updated:** [August 18, 2022, 4:51pm UTC](https://discuss.elastic.co/t/relp-plugin-does-not-parse-syslogs/312365 "2022-08-18T16:51:30Z")
Hi there, Getting to know Elastic stack here and I noticed that normal TCP reliability is not enough for my usecase where the device will be powered off suddenly at at arbitrary times. It looks like rsyslog RELP protoco… --- ## [Grok Pattern for java duration](https://discuss.elastic.co/t/grok-pattern-for-java-duration/312386)
**Author:** [@rokka](https://discuss.elastic.co/u/rokka)\ **Replies:** 1\ **Last updated:** [August 18, 2022, 4:45pm UTC](https://discuss.elastic.co/t/grok-pattern-for-java-duration/312386 "2022-08-18T16:45:02Z")
Hi, how can I parse the Java duration format like "PT20M36.4402321S"? https://docs.oracle.com/javase/8/docs/api/java/time/Duration.html#parse-java.lang.CharSequence- I can´t find an existing pattern on logstash-patter… --- ## [Aggregating child highlights into parent's score and result](https://discuss.elastic.co/t/aggregating-child-highlights-into-parents-score-and-result/312224)
**Author:** [@nickchomey](https://discuss.elastic.co/u/nickchomey)\ **Replies:** 1\ **Last updated:** [August 18, 2022, 4:35pm UTC](https://discuss.elastic.co/t/aggregating-child-highlights-into-parents-score-and-result/312224 "2022-08-18T16:35:29Z")
I am trying to implement Elasticsearch for a forum (among other things), where we have Forum, Topics and Replies, each being a child of the previous. We can ignore Forum for now and just focus on the Topics and Replies a… --- ## [Update enrich index from logstash](https://discuss.elastic.co/t/update-enrich-index-from-logstash/312378)
**Author:** [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\ **Replies:** 2\ **Last updated:** [August 18, 2022, 4:12pm UTC](https://discuss.elastic.co/t/update-enrich-index-from-logstash/312378 "2022-08-18T16:12:22Z")
I have a logstash jdbc pull that updates an index of device information at hourly intervals. That index is used by an enrich processor to add the device information, like sector, country, lat/long, to the data we ingest… --- ## [Tomcat filebeat module expected log format?](https://discuss.elastic.co/t/tomcat-filebeat-module-expected-log-format/272450)
**Author:** [@sarahw](https://discuss.elastic.co/u/sarahw)\ **Replies:** 2\ **Last updated:** [August 17, 2022, 1:20pm UTC](https://discuss.elastic.co/t/tomcat-filebeat-module-expected-log-format/272450 "2022-08-17T13:20:24Z")
I have been trying to use the Tomcat module for filebeat 7.9 (Tomcat module | Filebeat Reference \[7.9\] | Elastic) to ingest tomcat access logs from files but my log files are producing errors. I'd like to know what forma… --- ## [Can't use elasticsearch connector properly](https://discuss.elastic.co/t/cant-use-elasticsearch-connector-properly/312392)
**Author:** [@Sarindra\_Therese](https://discuss.elastic.co/u/Sarindra_Therese)\ **Replies:** 0\ **Last updated:** [August 18, 2022, 2:18pm UTC](https://discuss.elastic.co/t/cant-use-elasticsearch-connector-properly/312392 "2022-08-18T14:18:23Z")
Hey, I need to use source connector elasticsearch to send data from elasticsearch to kafka. Unfortunately, i Have some trouble in elasticsearch, maybe i don't configure elasticsearch properly. when i go to this link h… --- ## [Controls on Dashboards not showing all the options](https://discuss.elastic.co/t/controls-on-dashboards-not-showing-all-the-options/312115)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 4\ **Last updated:** [August 18, 2022, 2:02pm UTC](https://discuss.elastic.co/t/controls-on-dashboards-not-showing-all-the-options/312115 "2022-08-18T14:02:33Z")
I've been trying to make use of the Controls in the Kibana Dashboards but it keeps eliminating some information. It's saying to change the configuration on Kibana.yml but I'm using the Elastic Cloud so I'm not sure what … --- ## [Is there something to Filter metrics on Lens?](https://discuss.elastic.co/t/is-there-something-to-filter-metrics-on-lens/312319)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 1\ **Last updated:** [August 18, 2022, 1:54pm UTC](https://discuss.elastic.co/t/is-there-something-to-filter-metrics-on-lens/312319 "2022-08-18T13:54:22Z")
I've been exploring some data on Lens and got to the point where negative values ended up showing up on my data, I just want to pick the ones with "1" on it. I know that in canvas a simple "WHERE" would work but I don't … --- ## [Controlling Elasticsearch hidden indices .kibana\*](https://discuss.elastic.co/t/controlling-elasticsearch-hidden-indices-kibana/312391)
**Author:** [@Mark\_S](https://discuss.elastic.co/u/Mark_S)\ **Replies:** 0\ **Last updated:** [August 18, 2022, 1:31pm UTC](https://discuss.elastic.co/t/controlling-elasticsearch-hidden-indices-kibana/312391 "2022-08-18T13:31:24Z")
Elasticsearch hidden indices .kibana\_task\_manager and .kibana\_event\_logs are periodically updated. How to change this frequency? Maybe it is some index setting e.g. translog {sync\_interval : "5s"}, or maybe "refresh\_int… --- ## [Grok formatting](https://discuss.elastic.co/t/grok-formatting/312312)
**Author:** [@Paulo\_Neto](https://discuss.elastic.co/u/Paulo_Neto)\ **Replies:** 6\ **Last updated:** [August 18, 2022, 1:17pm UTC](https://discuss.elastic.co/t/grok-formatting/312312 "2022-08-18T13:17:12Z")
I am trying to format the text according to the example below: %{TIMESTAMP\_ISO8601:time} %{WORD:method} %{URIPATH:uri\_requested} %{NUMBER:port} %{NOTSPACE:username} %{IPORHOST:client\_ip} %{NOTSPACE:http\_version} %{NOTSP… --- ## [\[7.10.1\] Elasticsearch java client InterruptedException](https://discuss.elastic.co/t/7-10-1-elasticsearch-java-client-interruptedexception/312389)
**Author:** [@thiago123789](https://discuss.elastic.co/u/thiago123789)\ **Replies:** 0\ **Last updated:** [August 18, 2022, 1:05pm UTC](https://discuss.elastic.co/t/7-10-1-elasticsearch-java-client-interruptedexception/312389 "2022-08-18T13:05:07Z")
I am using elasticsearch-rest-client version 7.10.1 with spring boot actuator to provide health check but sometimes elasticsearch is returning a null value with InterruptedException in a Future on RestClient. Caused by:… --- ## [\[Elastic Cloud\] Configuring trust with clusters in a self-managed environment](https://discuss.elastic.co/t/elastic-cloud-configuring-trust-with-clusters-in-a-self-managed-environment/311035)
**Author:** [@Simone\_Scarduzio](https://discuss.elastic.co/u/Simone_Scarduzio)\ **Replies:** 8\ **Last updated:** [August 18, 2022, 12:52pm UTC](https://discuss.elastic.co/t/elastic-cloud-configuring-trust-with-clusters-in-a-self-managed-environment/311035 "2022-08-18T12:52:33Z")
I have two ES clusters: Elastic Cloud (all the data is here) Self-managed cluster (no data, will use for cross-cluster-search in Elastic Cloud) I want the cluster #1 to trust #2, so I can use CSS. So I'm following you… --- ## [Filebeat setup: 400 Bad Request no handler found for uri \[//\_ilm/policy/filebeat\]](https://discuss.elastic.co/t/filebeat-setup-400-bad-request-no-handler-found-for-uri-ilm-policy-filebeat/311900)
**Author:** [@Nick95](https://discuss.elastic.co/u/Nick95)\ **Replies:** 4\ **Last updated:** [August 18, 2022, 12:40pm UTC](https://discuss.elastic.co/t/filebeat-setup-400-bad-request-no-handler-found-for-uri-ilm-policy-filebeat/311900 "2022-08-18T12:40:45Z")
Hi, I try to run a filebeat on a server. Elastic and Kibana are installed on another server and are pushed on 443 port via a nginx reverse proxy. Kibana GUI is working on the IP I set up (https with self-generated certi… --- ## [What governs visibility of configured rules in Rules and Connectors tab?](https://discuss.elastic.co/t/what-governs-visibility-of-configured-rules-in-rules-and-connectors-tab/312297)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 3\ **Last updated:** [August 18, 2022, 12:34pm UTC](https://discuss.elastic.co/t/what-governs-visibility-of-configured-rules-in-rules-and-connectors-tab/312297 "2022-08-18T12:34:03Z")
Hello, I wanted to allow low lvl user to see configured rules. The rules are configured in separated to user main dashboard so I had to start by adding rights to see the rules's dashboard. So I added the right to check … --- ## [Converting React JS website to Kibana plugin](https://discuss.elastic.co/t/converting-react-js-website-to-kibana-plugin/311793)
**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\ **Replies:** 10\ **Last updated:** [August 18, 2022, 11:30am UTC](https://discuss.elastic.co/t/converting-react-js-website-to-kibana-plugin/311793 "2022-08-18T11:30:21Z")
I have developed a small dashboard and website in React JS. I want to insert it as a plugin into Kibana. I have some queries regarding the same. They are: Can I convert a website to a plugin? Or should I start coding … --- ## [Custom domain for deployment - TLS certificate](https://discuss.elastic.co/t/custom-domain-for-deployment-tls-certificate/312376)
**Author:** [@edweis](https://discuss.elastic.co/u/edweis)\ **Replies:** 0\ **Last updated:** [August 18, 2022, 11:26am UTC](https://discuss.elastic.co/t/custom-domain-for-deployment-tls-certificate/312376 "2022-08-18T11:26:58Z")
Hi, I want to have a custom endpoint es.mydomain.com that redirects conditionally to the closest Elasticsearch deployment to improve the latency of my Elasticsearch cluster in different regions. I have deployments in U… --- ## [How to add aggregions in KNN search?](https://discuss.elastic.co/t/how-to-add-aggregions-in-knn-search/310457)
**Author:** [@namespace-Pt](https://discuss.elastic.co/u/namespace-Pt)\ **Replies:** 4\ **Last updated:** [August 18, 2022, 11:21am UTC](https://discuss.elastic.co/t/how-to-add-aggregions-in-knn-search/310457 "2022-08-18T11:21:07Z")
I want to use aggregations over the search result of the knn\_search api (because I need facet search on the user interface), but I cannot pass the agg parameter as in the search api. Any suggestions? --- ## [Failed to deserialize response from handler](https://discuss.elastic.co/t/failed-to-deserialize-response-from-handler/312282)
**Author:** [@pspardeshi](https://discuss.elastic.co/u/pspardeshi)\ **Replies:** 2\ **Last updated:** [August 18, 2022, 10:32am UTC](https://discuss.elastic.co/t/failed-to-deserialize-response-from-handler/312282 "2022-08-18T10:32:17Z")
I am using scala+java application and running it on jdk 11 and calling Elasticsearch api for searching text. Recently upgraded from elasticsearch 5.5 to 7.17 and while search text getting below error. ERROR play.http.D… --- ## [Performance scaling for Logstash and Elasticsearch based solution](https://discuss.elastic.co/t/performance-scaling-for-logstash-and-elasticsearch-based-solution/312367)
**Author:** [@rakheshkumbi](https://discuss.elastic.co/u/rakheshkumbi)\ **Replies:** 0\ **Last updated:** [August 18, 2022, 9:54am UTC](https://discuss.elastic.co/t/performance-scaling-for-logstash-and-elasticsearch-based-solution/312367 "2022-08-18T09:54:39Z")
Hello everyone, we have a logstash and Elasticsearch-based solution to analyze network protocols, and I am trying to benchmark the whole solution. When I increase the number of Nodes for client/logstash and Elasticsearc… --- ## [Having trouble creating Elasticsearch Snapshot Repository](https://discuss.elastic.co/t/having-trouble-creating-elasticsearch-snapshot-repository/311868)
**Author:** [@yashverma](https://discuss.elastic.co/u/yashverma)\ **Replies:** 9\ **Last updated:** [August 18, 2022, 8:46am UTC](https://discuss.elastic.co/t/having-trouble-creating-elasticsearch-snapshot-repository/311868 "2022-08-18T08:46:44Z")
I want to create snapshot repository in order to backup elasticsearch indices locally. However I am getting error messages, I think I am not giving correct path in location. I have posted screenshots for better explanati… --- ## [Thread Intet MISP](https://discuss.elastic.co/t/thread-intet-misp/312361)
**Author:** [@VitorBarroso](https://discuss.elastic.co/u/VitorBarroso)\ **Replies:** 0\ **Last updated:** [August 18, 2022, 8:37am UTC](https://discuss.elastic.co/t/thread-intet-misp/312361 "2022-08-18T08:37:31Z")
I can't receive misp data on my dashboard but filebeat don't have any error. Any solution for this problem? --- ## [Data Transformation : Create Dynamic field using ruby for array](https://discuss.elastic.co/t/data-transformation-create-dynamic-field-using-ruby-for-array/312249)
**Author:** [@priyankamondalhcl](https://discuss.elastic.co/u/priyankamondalhcl)\ **Replies:** 2\ **Last updated:** [August 18, 2022, 8:11am UTC](https://discuss.elastic.co/t/data-transformation-create-dynamic-field-using-ruby-for-array/312249 "2022-08-18T08:11:25Z")
Hi Team, Hope you doing well! I am facing problem in creating dynamic field for an array in logstash. The list of array is below: \[{"usage\_start\_time": "2022-08-07T22:00:00Z", "usage\_end\_time": "2022-08-07T23:00:00Z… --- ## [Coordonating statistics for coordonating nodes](https://discuss.elastic.co/t/coordonating-statistics-for-coordonating-nodes/311834)
**Author:** [@Nicolaegis](https://discuss.elastic.co/u/Nicolaegis)\ **Replies:** 8\ **Last updated:** [August 18, 2022, 8:02am UTC](https://discuss.elastic.co/t/coordonating-statistics-for-coordonating-nodes/311834 "2022-08-18T08:02:29Z")
Hello, I know that all data nodes (role) have coordinating role as well. If I make a coordinating node in a cluster, how can I check it's statistics and performance from an ordinary data node? Thank you --- ## [What dose "realm\_authentication\_failed" really mean?](https://discuss.elastic.co/t/what-dose-realm-authentication-failed-really-mean/312334)
**Author:** [@ITzhangqiang](https://discuss.elastic.co/u/ITzhangqiang)\ **Replies:** 6\ **Last updated:** [August 18, 2022, 7:59am UTC](https://discuss.elastic.co/t/what-dose-realm-authentication-failed-really-mean/312334 "2022-08-18T07:59:08Z")
In auditlog,I saw the log below, what dose "realm\_authentication\_failed" really mean, this query was normal，why "realm\_authentication\_failed"? { "type":"audit", "timestamp":"2022-08-18T02:35:15,041+0000", "n… --- ## [Upgrade from 5.3.1 to 6.8.23](https://discuss.elastic.co/t/upgrade-from-5-3-1-to-6-8-23/312339)
**Author:** [@Andrey\_Tyutyunov](https://discuss.elastic.co/u/Andrey_Tyutyunov)\ **Replies:** 1\ **Last updated:** [August 18, 2022, 7:53am UTC](https://discuss.elastic.co/t/upgrade-from-5-3-1-to-6-8-23/312339 "2022-08-18T07:53:52Z")
Good day! I have 3 nodes on 5.3.1 (index"es created in 5" version) and I need to upgrade to 6.8.23 without downtime. My plan is 5.3.1 -\> 5.6.16, 5.6.16 -\> 6.8.23. Can I upgrade according to this scheme? 5.3.1 + 5.3.1… --- ## [Searching array for empty string causes tab lockup and shows garbage](https://discuss.elastic.co/t/searching-array-for-empty-string-causes-tab-lockup-and-shows-garbage/312149)
**Author:** [@nisow95612](https://discuss.elastic.co/u/nisow95612)\ **Replies:** 4\ **Last updated:** [August 18, 2022, 7:52am UTC](https://discuss.elastic.co/t/searching-array-for-empty-string-causes-tab-lockup-and-shows-garbage/312149 "2022-08-18T07:52:35Z")
Hello. I have a keyword field in elastic. I index arrays of string into it. I usually search with KQL like field: value and it works. But how I search for empty string? I tried field:, but that gives Search Error. … --- ## [Elastic Agent - Tagging](https://discuss.elastic.co/t/elastic-agent-tagging/312348)
**Author:** [@praveen\_raju](https://discuss.elastic.co/u/praveen_raju)\ **Replies:** 0\ **Last updated:** [August 18, 2022, 7:00am UTC](https://discuss.elastic.co/t/elastic-agent-tagging/312348 "2022-08-18T07:00:41Z")
Hi, We have 3000 virtual machines where we have installed elastic agent and they are sending metrics. Now we want to tag around 500 VM's as PROD so that we can build dashboards only for this prod vm;s. What is the best… --- ## [关于RestHighLevelClient的DeleteRequest的问题。](https://discuss.elastic.co/t/resthighlevelclient-deleterequest/312351)
**Author:** [@17661977890](https://discuss.elastic.co/u/17661977890)\ **Replies:** 0\ **Last updated:** [August 18, 2022, 7:18am UTC](https://discuss.elastic.co/t/resthighlevelclient-deleterequest/312351 "2022-08-18T07:18:51Z")
删除执行结果返回成功 DeleteResponse\[index=awaitz-prod-goods,type=\_doc,id=712810048943927296,version=1435,result=deleted,shards=ShardInfo{total=1, successful=1, failures=}\] 但是实际数据仍然在es中存在，并且可以查询到。此问题偶现，频率不高。 相关执行代码块：（主体方法是使用异步@A… --- ## [AWS WAF: Further parsing of http\_request in logstash](https://discuss.elastic.co/t/aws-waf-further-parsing-of-http-request-in-logstash/312347)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 0\ **Last updated:** [August 18, 2022, 7:00am UTC](https://discuss.elastic.co/t/aws-waf-further-parsing-of-http-request-in-logstash/312347 "2022-08-18T07:00:24Z")
Further to the query: Writing multiline grok The raw data comes in json, so the NEW line is technically new line but \\r\\n in the json payload. "GET /myapp/health HTTP/1.1\\\\r\\\\nHost: 52.123.133.46\\\\r\\\\nUser-Agent: Mozil… --- ## [Value Mapping in Kibana](https://discuss.elastic.co/t/value-mapping-in-kibana/311902)
**Author:** [@saif.khan](https://discuss.elastic.co/u/saif.khan)\ **Replies:** 17\ **Last updated:** [August 18, 2022, 6:52am UTC](https://discuss.elastic.co/t/value-mapping-in-kibana/311902 "2022-08-18T06:52:42Z")
Hi, I'm setting up a dashboard and receiving data from prometheus through metricbeat, I'm facing problem when it comes to value mapping, in my case for "DoorStatus" i want to map the default integer values in 0 and 1 to… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=824) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=826)