# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=827

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 828

---

## [How to connect Winlogbeat to Elasticsearch using SSL?](https://discuss.elastic.co/t/how-to-connect-winlogbeat-to-elasticsearch-using-ssl/312238)

<div class="topic-metadata">

**Author:** [@Linyilan-zz](https://discuss.elastic.co/u/Linyilan-zz)\
**Replies:** 1\
**Last updated:** [August 17, 2022, 9:29am UTC](https://discuss.elastic.co/t/how-to-connect-winlogbeat-to-elasticsearch-using-ssl/312238 "2022-08-17T09:29:18Z")

</div>

Hello Team： We are having a single node ELK configuration, In the same server we have installed Elasticsearch and kibana (8.3.3) As per the guide if we are installing the Elasticsearch generates own SSL configuration …

---

## [8 node setup , 2 nodes not joining the cluster](https://discuss.elastic.co/t/8-node-setup-2-nodes-not-joining-the-cluster/311806)

<div class="topic-metadata">

**Author:** [@jeevan\_hedge](https://discuss.elastic.co/u/jeevan_hedge)\
**Replies:** 15\
**Last updated:** [August 17, 2022, 9:08am UTC](https://discuss.elastic.co/t/8-node-setup-2-nodes-not-joining-the-cluster/311806 "2022-08-17T09:08:50Z")

</div>

we are running 2 instances of elasticsearch (6.6.1 version) in 4 nodes forming 8 nodes cluster setup. When we check the cluster health , the output showing only 6 nodes. 2 nodes are not joining the cluster . and we see …

---

## [Disable regex in Lucene search](https://discuss.elastic.co/t/disable-regex-in-lucene-search/311907)

<div class="topic-metadata">

**Author:** [@Leventi](https://discuss.elastic.co/u/Leventi)\
**Replies:** 2\
**Last updated:** [August 17, 2022, 9:03am UTC](https://discuss.elastic.co/t/disable-regex-in-lucene-search/311907 "2022-08-17T09:03:31Z")

</div>

Hi How I could disable regex in Lucene search? My problem is when I search something like that 32/22-ЕКТ I cant't find anything. It's working just when I write in quotes like this "32/22-ЕКТ" or 32/22-ЕКТ It's becaus…

---

## [How to upgrade node.js (from v10.23.1 to v16.13.2) in Kibana 7.10.2](https://discuss.elastic.co/t/how-to-upgrade-node-js-from-v10-23-1-to-v16-13-2-in-kibana-7-10-2/307409)

<div class="topic-metadata">

**Author:** [@mridul.tamuli](https://discuss.elastic.co/u/mridul.tamuli)\
**Replies:** 2\
**Last updated:** [August 17, 2022, 9:02am UTC](https://discuss.elastic.co/t/how-to-upgrade-node-js-from-v10-23-1-to-v16-13-2-in-kibana-7-10-2/307409 "2022-08-17T09:02:19Z")

</div>

Hi, We are using Kibana 7.10.2 with Elasticsearch of the same version. Currently we have a urgent need to upgrade the node.js version of Kibana to 16.13.2. We tried but unable to get the desired result. Is it possible t…

---

## [Ratio visualization](https://discuss.elastic.co/t/ratio-visualization/312257)

<div class="topic-metadata">

**Author:** [@Mikhail\_M](https://discuss.elastic.co/u/Mikhail_M)\
**Replies:** 0\
**Last updated:** [August 17, 2022, 8:23am UTC](https://discuss.elastic.co/t/ratio-visualization/312257 "2022-08-17T08:23:57Z")

</div>

Hello! Can you pls give a hint how to create this kind of timeserial visualization. Let's say I've got documents like this: doc1:(term = 'term1', value = 1) doc2:(term = 'term2', value = 2) doc3:(term = 'term3', valu…

---

## [Elasticsearch date-index-name-processor when set to week, always create w52](https://discuss.elastic.co/t/elasticsearch-date-index-name-processor-when-set-to-week-always-create-w52/312255)

<div class="topic-metadata">

**Author:** [@Ioxxy](https://discuss.elastic.co/u/Ioxxy)\
**Replies:** 0\
**Last updated:** [August 17, 2022, 8:19am UTC](https://discuss.elastic.co/t/elasticsearch-date-index-name-processor-when-set-to-week-always-create-w52/312255 "2022-08-17T08:19:03Z")

</div>

Hello there, I'm using Elasticsearch v7.16.2. I'm working for a client, and it's impossible for them to change the elastic output to change the index name. My goal is to change the daily format to a weekly one. To do …

---

## [Unable to start elasticsearch service](https://discuss.elastic.co/t/unable-to-start-elasticsearch-service/312083)

<div class="topic-metadata">

**Author:** [@Alice\_Walker](https://discuss.elastic.co/u/Alice_Walker)\
**Replies:** 2\
**Last updated:** [August 17, 2022, 7:50am UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-service/312083 "2022-08-17T07:50:03Z")

</div>

Unable to start elastisearch service on AWS EC2 instances. systemctl start elasticsearch Job for elasticsearch.service failed because a fatal signal was delivered to the control process. See "systemctl status elasticse…

---

## [Comparison of data between two time points](https://discuss.elastic.co/t/comparison-of-data-between-two-time-points/312172)

<div class="topic-metadata">

**Author:** [@RonGros](https://discuss.elastic.co/u/RonGros)\
**Replies:** 3\
**Last updated:** [August 17, 2022, 6:39am UTC](https://discuss.elastic.co/t/comparison-of-data-between-two-time-points/312172 "2022-08-17T06:39:24Z")

</div>

Hi, I think the answer is "no can do" but I will ask anyhow in case I am missing something (and if I'm right it's surprising that I'm the only one to need it) We are monitoring results of tests on a daily basis. we have…

---

## [Logstash DLQ dir empty, but all events end up duplicated in the Elasticsearch's dlq index](https://discuss.elastic.co/t/logstash-dlq-dir-empty-but-all-events-end-up-duplicated-in-the-elasticsearchs-dlq-index/312250)

<div class="topic-metadata">

**Author:** [@kudlatyjoe](https://discuss.elastic.co/u/kudlatyjoe)\
**Replies:** 0\
**Last updated:** [August 17, 2022, 6:22am UTC](https://discuss.elastic.co/t/logstash-dlq-dir-empty-but-all-events-end-up-duplicated-in-the-elasticsearchs-dlq-index/312250 "2022-08-17T06:22:41Z")

</div>

Hi all, I'm currently trying to introduce the dead-letter-plugin to the ELK stack that we use for collecting application logs. We've been having some issues with the logging functionality breaking down and losing some …

---

## [How to configure numeric value file name in filebeat](https://discuss.elastic.co/t/how-to-configure-numeric-value-file-name-in-filebeat/311686)

<div class="topic-metadata">

**Author:** [@rajvel](https://discuss.elastic.co/u/rajvel)\
**Replies:** 2\
**Last updated:** [August 17, 2022, 6:18am UTC](https://discuss.elastic.co/t/how-to-configure-numeric-value-file-name-in-filebeat/311686 "2022-08-17T06:18:35Z")

</div>

Hello Team, I have a filename with numeric value, like 20220809-test.log While configure the same in filebeat.yml, its not sending the logs. I think the filebeat can't read the numeric value. Please help how to confi…

---

## [Elasticsearch snapshot for starting Kibana as a developer](https://discuss.elastic.co/t/elasticsearch-snapshot-for-starting-kibana-as-a-developer/312135)

<div class="topic-metadata">

**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\
**Replies:** 3\
**Last updated:** [August 17, 2022, 5:56am UTC](https://discuss.elastic.co/t/elasticsearch-snapshot-for-starting-kibana-as-a-developer/312135 "2022-08-17T05:56:27Z")

</div>

To create a custom plugin, I 1. I cloned the kibana git hub repo 2. yarn kbn bootstrap ----\> was succesfull The next step as per the documentation, (Getting started | Kibana Guide \[master\] | Elastic) yarn es snapsh…

---

## [Starting Kibana as a developer](https://discuss.elastic.co/t/starting-kibana-as-a-developer/312138)

<div class="topic-metadata">

**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\
**Replies:** 1\
**Last updated:** [August 17, 2022, 5:55am UTC](https://discuss.elastic.co/t/starting-kibana-as-a-developer/312138 "2022-08-17T05:55:44Z")

</div>

To create a custom plugin, I I cloned the kibana git hub repo yarn kbn bootstrap ----\> was successful Now to connect to Elasticsearch, I can either use Option: 1 yarn es snapshot -\> results in error (Elasticsearc…

---

## [Search-ui Issues with Elastic search connector and boolean aggregations](https://discuss.elastic.co/t/search-ui-issues-with-elastic-search-connector-and-boolean-aggregations/312183)

<div class="topic-metadata">

**Author:** [@Gorelldk](https://discuss.elastic.co/u/Gorelldk)\
**Replies:** 4\
**Last updated:** [August 17, 2022, 5:35am UTC](https://discuss.elastic.co/t/search-ui-issues-with-elastic-search-connector-and-boolean-aggregations/312183 "2022-08-17T05:35:54Z")

</div>

We are using Elastic Search-ui to connect to an on premise elastic installation. We are also using Facets, and most is working perfectly. However, when we want to use a boolean facet, out issues starts. Elastic provides…

---

## [Unable to use OpenJDK distribution with Elasticsearch](https://discuss.elastic.co/t/unable-to-use-openjdk-distribution-with-elasticsearch/312239)

<div class="topic-metadata">

**Author:** [@Fasil](https://discuss.elastic.co/u/Fasil)\
**Replies:** 4\
**Last updated:** [August 17, 2022, 5:06am UTC](https://discuss.elastic.co/t/unable-to-use-openjdk-distribution-with-elasticsearch/312239 "2022-08-17T05:06:28Z")

</div>

Trying to run elasticsearch-8.3.3-windows-x86\_64 release with OpenJDK 19 Early Access Build 35. But my locally installed OpenJDK 19 is ignored and used bundled Oracle JDK version 18 while starting elasticsearch for the …

---

## [Obtaining shard lock for \[read metadata snapshot\] timed out after \[5000ms\], lock already held for \[closing shard\] with age \[24721ms\]"](https://discuss.elastic.co/t/obtaining-shard-lock-for-read-metadata-snapshot-timed-out-after-5000ms-lock-already-held-for-closing-shard-with-age-24721ms/312169)

<div class="topic-metadata">

**Author:** [@RaviS](https://discuss.elastic.co/u/RaviS)\
**Replies:** 1\
**Last updated:** [August 17, 2022, 3:39am UTC](https://discuss.elastic.co/t/obtaining-shard-lock-for-read-metadata-snapshot-timed-out-after-5000ms-lock-already-held-for-closing-shard-with-age-24721ms/312169 "2022-08-17T03:39:25Z")

</div>

obtaining shard lock for \[read metadata snapshot\] timed out after \[5000ms\], lock already held for \[closing shard\] with age \[24721ms\]" Is there any reason for this message ?

---

## [Can't start fleet server](https://discuss.elastic.co/t/cant-start-fleet-server/312210)

<div class="topic-metadata">

**Author:** [@chaishiqi1](https://discuss.elastic.co/u/chaishiqi1)\
**Replies:** 2\
**Last updated:** [August 17, 2022, 1:45am UTC](https://discuss.elastic.co/t/cant-start-fleet-server/312210 "2022-08-17T01:45:13Z")

</div>

I want to start fleet server as the command generated by kibana. The CA files I have filled, but when execute this command, it failed with the information {"log.level":"info","@timestamp":"2022-08-16T18:32:24.…

---

## [Python Driver and Elastic Docs Parity](https://discuss.elastic.co/t/python-driver-and-elastic-docs-parity/312228)

<div class="topic-metadata">

**Author:** [@codewriterguy](https://discuss.elastic.co/u/codewriterguy)\
**Replies:** 0\
**Last updated:** [August 16, 2022, 10:53pm UTC](https://discuss.elastic.co/t/python-driver-and-elastic-docs-parity/312228 "2022-08-16T22:53:45Z")

</div>

Hi, I work with the python driver fairly often and love it. One challenge is documentation. After the v8 release there have been some challenges. One example is with request body requirements differing between the dri…

---

## [Documentation Error RE: elasticsearch multi-target syntax](https://discuss.elastic.co/t/documentation-error-re-elasticsearch-multi-target-syntax/312233)

<div class="topic-metadata">

**Author:** [@Andrew\_DS](https://discuss.elastic.co/u/Andrew_DS)\
**Replies:** 0\
**Last updated:** [August 17, 2022, 1:11am UTC](https://discuss.elastic.co/t/documentation-error-re-elasticsearch-multi-target-syntax/312233 "2022-08-17T01:11:14Z")

</div>

In the API Conventions Documentation, you state: Aliases are resolved after wildcard expressions. This can result in a request that targets an excluded alias. For example, if test3 is an index alias, the pattern test\*,…

---

## [Java API Client 8.x SettingsSimilarity doesnt have field 'type' for correct request completion](https://discuss.elastic.co/t/java-api-client-8-x-settingssimilarity-doesnt-have-field-type-for-correct-request-completion/311464)

<div class="topic-metadata">

**Author:** [@notricky](https://discuss.elastic.co/u/notricky)\
**Replies:** 6\
**Last updated:** [August 16, 2022, 11:42pm UTC](https://discuss.elastic.co/t/java-api-client-8-x-settingssimilarity-doesnt-have-field-type-for-correct-request-completion/311464 "2022-08-16T23:42:30Z")

</div>

When you use 8.x Java Client to create an index within CreateIndexRequest.Builder and specify similarity in settings builder, there is no field type, which Elasticsearch server waits for and it returns an error, pointing…

---

## [Elasticsearch platinum license](https://discuss.elastic.co/t/elasticsearch-platinum-license/312187)

<div class="topic-metadata">

**Author:** [@vnaresh666666](https://discuss.elastic.co/u/vnaresh666666)\
**Replies:** 1\
**Last updated:** [August 16, 2022, 10:32pm UTC](https://discuss.elastic.co/t/elasticsearch-platinum-license/312187 "2022-08-16T22:32:15Z")

</div>

I am planning to buy elasticsearch platinum license. I have one question that if I buy one license, can I use the same license for dev, UAT, Prod or should I take three licenses for three environments. Please provide the…

---

## [Python and kibana](https://discuss.elastic.co/t/python-and-kibana/312212)

<div class="topic-metadata">

**Author:** [@5k\_pwc](https://discuss.elastic.co/u/5k_pwc)\
**Replies:** 1\
**Last updated:** [August 16, 2022, 10:27pm UTC](https://discuss.elastic.co/t/python-and-kibana/312212 "2022-08-16T22:27:27Z")

</div>

Hi all , as a beginner, I would like to know in what condition I use python and kibana together.

---

## [How to divide two doc\_count values in aggregations](https://discuss.elastic.co/t/how-to-divide-two-doc-count-values-in-aggregations/312035)

<div class="topic-metadata">

**Author:** [@Chandana\_P](https://discuss.elastic.co/u/Chandana_P)\
**Replies:** 5\
**Last updated:** [August 16, 2022, 10:26pm UTC](https://discuss.elastic.co/t/how-to-divide-two-doc-count-values-in-aggregations/312035 "2022-08-16T22:26:44Z")

</div>

I want to perform division between two doc\_count values of unique fields obtained through "terms" bucket aggregation. Is there a way to do that?

---

## [Found not working footnote in docs. Can't fix it](https://discuss.elastic.co/t/found-not-working-footnote-in-docs-cant-fix-it/312177)

<div class="topic-metadata">

**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\
**Replies:** 1\
**Last updated:** [August 16, 2022, 10:13pm UTC](https://discuss.elastic.co/t/found-not-working-footnote-in-docs-cant-fix-it/312177 "2022-08-16T22:13:25Z")

</div>

Hey, hope this is the right forum to post this. The references in here Snapshot and restore | Elasticsearch Guide \[8.3\] | Elastic dont work. (You cant click the small '2') Tried to fix it via a pull request in git…

---

## [Elastic Agent Causing CPU High Utilization](https://discuss.elastic.co/t/elastic-agent-causing-cpu-high-utilization/312217)

<div class="topic-metadata">

**Author:** [@daniel.talbot](https://discuss.elastic.co/u/daniel.talbot)\
**Replies:** 0\
**Last updated:** [August 16, 2022, 7:56pm UTC](https://discuss.elastic.co/t/elastic-agent-causing-cpu-high-utilization/312217 "2022-08-16T19:56:48Z")

</div>

Currently we are running Elastic fleet agent to pick up on all logs as you can see in the picture attached. The problem is on our database nodes we would like to skip it from looking at the postgres process so that it do…

---

## [Autogenerators available to convert Django models to corresponding Document types?](https://discuss.elastic.co/t/autogenerators-available-to-convert-django-models-to-corresponding-document-types/312219)

<div class="topic-metadata">

**Author:** [@scheung38](https://discuss.elastic.co/u/scheung38)\
**Replies:** 0\
**Last updated:** [August 16, 2022, 8:24pm UTC](https://discuss.elastic.co/t/autogenerators-available-to-convert-django-models-to-corresponding-document-types/312219 "2022-08-16T20:24:27Z")

</div>

Hello, new to elasticsearch, I have a Django model and using django-elasticsearch-dsl-drf, are there any auto generators to generate corresponding Document from Django models?

---

## [Decorators: registry.register\_document vs INDEX.doc\_type](https://discuss.elastic.co/t/decorators-registry-register-document-vs-index-doc-type/312218)

<div class="topic-metadata">

**Author:** [@scheung38](https://discuss.elastic.co/u/scheung38)\
**Replies:** 0\
**Last updated:** [August 16, 2022, 8:17pm UTC](https://discuss.elastic.co/t/decorators-registry-register-document-vs-index-doc-type/312218 "2022-08-16T20:17:21Z")

</div>

Sometimes I see decorators: from django\_elasticsearch\_dsl import Index INDEX = Index(settings.ELASTICSEARCH\_INDEX\_NAMES\[\_\_name\_\_\]) @INDEX.doc\_type and from django\_elasticsearch\_dsl.registries import registry from art…

---

## [How to get first file and last file in data?](https://discuss.elastic.co/t/how-to-get-first-file-and-last-file-in-data/311945)

<div class="topic-metadata">

**Author:** [@MLsuper](https://discuss.elastic.co/u/MLsuper)\
**Replies:** 3\
**Last updated:** [August 16, 2022, 7:47pm UTC](https://discuss.elastic.co/t/how-to-get-first-file-and-last-file-in-data/311945 "2022-08-16T19:47:18Z")

</div>

I have a index pattern with data with files for every business day(i have a run time field named business time/day) which is the business day and time everyday. Now I want to show a visualization/dashboard to get the ba…

---

## [Elastic Agent Windows doesn't work](https://discuss.elastic.co/t/elastic-agent-windows-doesnt-work/312206)

<div class="topic-metadata">

**Author:** [@VitorBarroso](https://discuss.elastic.co/u/VitorBarroso)\
**Replies:** 1\
**Last updated:** [August 16, 2022, 6:39pm UTC](https://discuss.elastic.co/t/elastic-agent-windows-doesnt-work/312206 "2022-08-16T18:39:04Z")

</div>

I'm trying to use the elastic Agent on windows 10 and i get this error: fail to execute request to fleet-server: dial tcp 192.168.100.60:8220: connectex: A connection attempt failed because the connected party did not p…

---

## [Splitting table based on text value](https://discuss.elastic.co/t/splitting-table-based-on-text-value/312208)

<div class="topic-metadata">

**Author:** [@Marius\_Kunauskas](https://discuss.elastic.co/u/Marius_Kunauskas)\
**Replies:** 1\
**Last updated:** [August 16, 2022, 6:37pm UTC](https://discuss.elastic.co/t/splitting-table-based-on-text-value/312208 "2022-08-16T18:37:16Z")

</div>

As a complete elastic-newbie, how could I split a column based on its text value? I.e. Instead of splitting rows on different Field values (e.g. country), I want to split it based on WHETHER a field starts with a certai…

---

## [Edit file using logstash](https://discuss.elastic.co/t/edit-file-using-logstash/312157)

<div class="topic-metadata">

**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\
**Replies:** 2\
**Last updated:** [August 16, 2022, 6:08pm UTC](https://discuss.elastic.co/t/edit-file-using-logstash/312157 "2022-08-16T18:08:55Z")

</div>

Hi, I have already created a topic here to add \[\] to the beginning and end of the file and I can't find the solution so I want to ask if I can edit the file using logstash now my file like this: {"field1": "value1","fi…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=826)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=828)
