# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=828 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 829 --- ## [Add \[ \] to codec =\> json](https://discuss.elastic.co/t/add-to-codec-json/312104)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 4\ **Last updated:** [August 16, 2022, 5:49pm UTC](https://discuss.elastic.co/t/add-to-codec-json/312104 "2022-08-16T17:49:27Z")
Hi, can i add \[ \] to json file ? because output{ file { codec =\> json path =\> \["D:/elastic\_stack/test/temp.json"\] } } it gives me { 'a':'a','b':'b'}{'c':'c'} i want to add \[ \] so i wanted like this \[{ 'a' : 'a','b':'… --- ## [Logstash rabbitmq input plugin doesn't read "host" value](https://discuss.elastic.co/t/logstash-rabbitmq-input-plugin-doesnt-read-host-value/312204)
**Author:** [@thinkorhiking](https://discuss.elastic.co/u/thinkorhiking)\ **Replies:** 0\ **Last updated:** [August 16, 2022, 5:01pm UTC](https://discuss.elastic.co/t/logstash-rabbitmq-input-plugin-doesnt-read-host-value/312204 "2022-08-16T17:01:42Z")
I'm having trouble to setup logstash rabbitmq input plugin, to connect to the rabbitmq pod host name. Why it still tries to connect @localhost. logstash does not read the config correctly. Is this a bug or is there any … --- ## [Shards failed in kibana](https://discuss.elastic.co/t/shards-failed-in-kibana/310559)
**Author:** [@OoO](https://discuss.elastic.co/u/OoO)\ **Replies:** 3\ **Last updated:** [August 16, 2022, 4:27pm UTC](https://discuss.elastic.co/t/shards-failed-in-kibana/310559 "2022-08-16T16:27:34Z")
Hello world, Since I upgraded filebeat from 7.x to 8.x ( the version of my ELK and filebeat is 8.2.3 now), I can't see the dashboard anymore, I have encountered this problem on kibana: 1 of 8 shards failed The data y… --- ## [Connection Closed Error](https://discuss.elastic.co/t/connection-closed-error/310980)
**Author:** [@Reskun](https://discuss.elastic.co/u/Reskun)\ **Replies:** 7\ **Last updated:** [August 16, 2022, 4:22pm UTC](https://discuss.elastic.co/t/connection-closed-error/310980 "2022-08-16T16:22:50Z")
Hi I've successfully created a multinode elasticsearch cluster using a docker-compose.yml file by following the steps in the link: Install Elasticsearch with Docker | Elasticsearch Guide \[8.3\] | Elastic localhost:9200… --- ## [Alerts on derivatives in elastic](https://discuss.elastic.co/t/alerts-on-derivatives-in-elastic/312170)
**Author:** [@Anmol\_Dubey](https://discuss.elastic.co/u/Anmol_Dubey)\ **Replies:** 1\ **Last updated:** [August 16, 2022, 4:03pm UTC](https://discuss.elastic.co/t/alerts-on-derivatives-in-elastic/312170 "2022-08-16T16:03:08Z")
I am trying to create an alert when average of my derivative data exceeds a threshold, but am not able to figure out how to do calculations on returned values in kibana Grafana graph of the data looks like this , i am t… --- ## [Could not index event to Elasticsearch](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch/312023)
**Author:** [@syedabdullah](https://discuss.elastic.co/u/syedabdullah)\ **Replies:** 6\ **Last updated:** [August 16, 2022, 3:57pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch/312023 "2022-08-16T15:57:58Z")
Hi I am getting this error in Elasticsearch (Please look at the bolded statements), any sort of help will be welcome. Thank you so much in advance: \[2022-05-03T12:41:26,871\]\[WARN \]\[logstash.outputs.elasticsearch\]\[rtt\_kf… --- ## [Kibana Table visualization for different weeks,showing reports for current date](https://discuss.elastic.co/t/kibana-table-visualization-for-different-weeks-showing-reports-for-current-date/311485)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 2\ **Last updated:** [August 16, 2022, 2:34pm UTC](https://discuss.elastic.co/t/kibana-table-visualization-for-different-weeks-showing-reports-for-current-date/311485 "2022-08-16T14:34:45Z")
Hello All, I'm not sure how this can be achieved through kibana table visualization,I want to display the converter details in accordance to week wise and the date displayed should always be current date. KW-calendar … --- ## [Sorting a house number field](https://discuss.elastic.co/t/sorting-a-house-number-field/312194)
**Author:** [@Nicolai\_Jee](https://discuss.elastic.co/u/Nicolai_Jee)\ **Replies:** 1\ **Last updated:** [August 16, 2022, 3:05pm UTC](https://discuss.elastic.co/t/sorting-a-house-number-field/312194 "2022-08-16T15:05:18Z")
Hi I have a house number field that contains stringbased data like 1,2A,3,3B,10,100A. Right now it is a basic textfield and it does string sorting, which is not working for me. I need it to sort numerically and then a… --- ## [Fleet agent doesn't work](https://discuss.elastic.co/t/fleet-agent-doesnt-work/312068)
**Author:** [@VitorBarroso](https://discuss.elastic.co/u/VitorBarroso)\ **Replies:** 13\ **Last updated:** [August 16, 2022, 2:55pm UTC](https://discuss.elastic.co/t/fleet-agent-doesnt-work/312068 "2022-08-16T14:55:32Z")
I can't connect my elastic agent to the fleet server I already solved the syslink problem. --- ## [ActionNotFoundTransportException\[No handler for action \[indices:admin/exists\]](https://discuss.elastic.co/t/actionnotfoundtransportexception-no-handler-for-action-indices-admin-exists/312176)
**Author:** [@Sathiya\_Kennady](https://discuss.elastic.co/u/Sathiya_Kennady)\ **Replies:** 1\ **Last updated:** [August 16, 2022, 2:17pm UTC](https://discuss.elastic.co/t/actionnotfoundtransportexception-no-handler-for-action-indices-admin-exists/312176 "2022-08-16T14:17:24Z")
While checking index is exists are not i am getting below error : ClusterConnectionManager:225 - transport connection to \[{lutw}{Bz3WvABkSsuCLyVoF3kDsg}{exNsn6r4TFGF4KrMm4aduw}{192.168.1.84}{192.168.1.84:9300}{cdfhilmrs… --- ## [Wildcard query on text field](https://discuss.elastic.co/t/wildcard-query-on-text-field/311676)
**Author:** [@maxfriz](https://discuss.elastic.co/u/maxfriz)\ **Replies:** 2\ **Last updated:** [August 16, 2022, 2:11pm UTC](https://discuss.elastic.co/t/wildcard-query-on-text-field/311676 "2022-08-16T14:11:41Z")
From a best practice and cautionary perspective, am I missing any other critical information I should be considering specific to a wildcard query on a text field? See bullets below. I have reviewed the documentation i… --- ## [AWS SQS Message how to read through filebeat7.0?](https://discuss.elastic.co/t/aws-sqs-message-how-to-read-through-filebeat7-0/311932)
**Author:** [@HariP](https://discuss.elastic.co/u/HariP)\ **Replies:** 1\ **Last updated:** [August 16, 2022, 2:02pm UTC](https://discuss.elastic.co/t/aws-sqs-message-how-to-read-through-filebeat7-0/311932 "2022-08-16T14:02:58Z")
I need to read AWS SQS or AWS SNS message through filebeat and pass to Elastic Search. Please note my message in JSON format text message .. I changed filebeat yml file below config type: s3 endpoint: https://sqs.us-ea… --- ## [Filter out (drop) a log sent to Logstash, based on the values of its fields](https://discuss.elastic.co/t/filter-out-drop-a-log-sent-to-logstash-based-on-the-values-of-its-fields/310664)
**Author:** [@zoug](https://discuss.elastic.co/u/zoug)\ **Replies:** 5\ **Last updated:** [July 28, 2022, 1:47pm UTC](https://discuss.elastic.co/t/filter-out-drop-a-log-sent-to-logstash-based-on-the-values-of-its-fields/310664 "2022-07-28T13:47:15Z")
Hello, I use a pipeline to ingest logs generated by suricata, everything set up with filebeat setup --pipelines --modules suricata,\. I don't want to ingest any "event" logs, only "alert" logs. So I added … --- ## [Problem with an implementation on my array in a Pie Chart](https://discuss.elastic.co/t/problem-with-an-implementation-on-my-array-in-a-pie-chart/311145)
**Author:** [@Dave23](https://discuss.elastic.co/u/Dave23)\ **Replies:** 2\ **Last updated:** [August 16, 2022, 1:33pm UTC](https://discuss.elastic.co/t/problem-with-an-implementation-on-my-array-in-a-pie-chart/311145 "2022-08-16T13:33:30Z")
Hello everyone, I have the following array and I want to make a pie chart with each of the "holders.address" and the "amount" of each of them, but I can't get that information, I don't know what calculation field to use … --- ## [Elasticsearch does not load ES\_PATH\_CONF or any values that are present in sysconfig](https://discuss.elastic.co/t/elasticsearch-does-not-load-es-path-conf-or-any-values-that-are-present-in-sysconfig/311411)
**Author:** [@nightwatch92](https://discuss.elastic.co/u/nightwatch92)\ **Replies:** 2\ **Last updated:** [August 16, 2022, 1:16pm UTC](https://discuss.elastic.co/t/elasticsearch-does-not-load-es-path-conf-or-any-values-that-are-present-in-sysconfig/311411 "2022-08-16T13:16:07Z")
Hi, ES version: 8.3.3 OS: CENTOS 8 We are using packages to distribute our config files in custom directory for the ES service. We can't replace /etc/sysconfig/elasticsearch, because it is owned by the elasticsearch p… --- ## [Any new possibilities to display raw, un-aggregated time series data in kibana?](https://discuss.elastic.co/t/any-new-possibilities-to-display-raw-un-aggregated-time-series-data-in-kibana/312158)
**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\ **Replies:** 3\ **Last updated:** [August 16, 2022, 1:07pm UTC](https://discuss.elastic.co/t/any-new-possibilities-to-display-raw-un-aggregated-time-series-data-in-kibana/312158 "2022-08-16T13:07:38Z")
Hello :wave:, I asked the same question about 2 years ago and only found the same questions (and answers) in the forum from around 2018-2019 so I want to ask if something changed with the new Kibana and Elastic versions… --- ## [Kibana 7.16.3 Create Index patter API doesn't recognize field](https://discuss.elastic.co/t/kibana-7-16-3-create-index-patter-api-doesnt-recognize-field/312185)
**Author:** [@Enrique\_Flores](https://discuss.elastic.co/u/Enrique_Flores)\ **Replies:** 0\ **Last updated:** [August 16, 2022, 12:56pm UTC](https://discuss.elastic.co/t/kibana-7-16-3-create-index-patter-api-doesnt-recognize-field/312185 "2022-08-16T12:56:33Z")
Im trying to create a index pattern via POST /api/index\_patterns/index\_pattern using a json already parsed, that json was generate with a kibana used in PRO via GET /api/index\_patterns/index\_pattern/, i don't know what i… --- ## [Elastic Search - QueryBuilder JAVA](https://discuss.elastic.co/t/elastic-search-querybuilder-java/312148)
**Author:** [@Parva\_Gurav](https://discuss.elastic.co/u/Parva_Gurav)\ **Replies:** 1\ **Last updated:** [August 16, 2022, 12:27pm UTC](https://discuss.elastic.co/t/elastic-search-querybuilder-java/312148 "2022-08-16T12:27:24Z")
I'm currently working on elasticsearch where I've created a query : "query": { "bool": { "must": \[ {"match": { "companyId": 35 }}, { "multi\_match": { "q… --- ## [Kibana - aggregation in graphs (average number of things per bucket)](https://discuss.elastic.co/t/kibana-aggregation-in-graphs-average-number-of-things-per-bucket/311291)
**Author:** [@RonGros](https://discuss.elastic.co/u/RonGros)\ **Replies:** 7\ **Last updated:** [August 16, 2022, 10:57am UTC](https://discuss.elastic.co/t/kibana-aggregation-in-graphs-average-number-of-things-per-bucket/311291 "2022-08-16T10:57:53Z")
Hi, I have a situation and I am stuck, I think what I want to do is not currently achievable but I hope I'm wrong. Let's assume I have the following data about people going to the movies: Name of person Which movies … --- ## [Percolator query fields migration from version 6 to version 8 using reindex](https://discuss.elastic.co/t/percolator-query-fields-migration-from-version-6-to-version-8-using-reindex/312168)
**Author:** [@CamiloPDL](https://discuss.elastic.co/u/CamiloPDL)\ **Replies:** 0\ **Last updated:** [August 16, 2022, 10:22am UTC](https://discuss.elastic.co/t/percolator-query-fields-migration-from-version-6-to-version-8-using-reindex/312168 "2022-08-16T10:22:11Z")
Hello community I would like to use reindex functionality from elasticsearch to move data from a version 6 cluster to a version 8 cluster. The reindex is working well, the issue is the migration of percolator query fiel… --- ## [Sort data in sub level](https://discuss.elastic.co/t/sort-data-in-sub-level/312166)
**Author:** [@aneesh](https://discuss.elastic.co/u/aneesh)\ **Replies:** 0\ **Last updated:** [August 16, 2022, 10:11am UTC](https://discuss.elastic.co/t/sort-data-in-sub-level/312166 "2022-08-16T10:11:04Z")
i am doing a sorting for a column that is in sub level. The issue there is , the sub level contains an array and i want to sort the data depending on the condition. My data looks like below I need to do sorting on colu… --- ## [Sudo docker-compose up -d ERROR: Invalid interpolation format for "environment" option in service "setup": "${KIBANA\_SYSTEM\_PASSWORD:-}"](https://discuss.elastic.co/t/sudo-docker-compose-up-d-error-invalid-interpolation-format-for-environment-option-in-service-setup-kibana-system-password/312156)
**Author:** [@Alex\_Trasias](https://discuss.elastic.co/u/Alex_Trasias)\ **Replies:** 0\ **Last updated:** [August 16, 2022, 9:28am UTC](https://discuss.elastic.co/t/sudo-docker-compose-up-d-error-invalid-interpolation-format-for-environment-option-in-service-setup-kibana-system-password/312156 "2022-08-16T09:28:09Z")
I'm using GitHub - deviantony/docker-elk: The Elastic stack (ELK) powered by Docker and Compose. but when I type sudo docker-compose up -d i get this error mefssage ERROR: Invalid interpolation format for "environme… --- ## [Ability to search ES based on the result of previous search in the query](https://discuss.elastic.co/t/ability-to-search-es-based-on-the-result-of-previous-search-in-the-query/312093)
**Author:** [@Ananya\_Chowdhury](https://discuss.elastic.co/u/Ananya_Chowdhury)\ **Replies:** 4\ **Last updated:** [August 16, 2022, 8:36am UTC](https://discuss.elastic.co/t/ability-to-search-es-based-on-the-result-of-previous-search-in-the-query/312093 "2022-08-16T08:36:14Z")
Hi, We want to build a query which will search for a particular string and then it will perform a search based on the result that we have received from previous result. Can any one help us how we can achieve this. How … --- ## [Filebeat error](https://discuss.elastic.co/t/filebeat-error/311946)
**Author:** [@VitorBarroso](https://discuss.elastic.co/u/VitorBarroso)\ **Replies:** 6\ **Last updated:** [August 16, 2022, 9:04am UTC](https://discuss.elastic.co/t/filebeat-error/311946 "2022-08-16T09:04:00Z")
Can you help me resolve this problem? Only Threat Intel activated is misp. --- ## [Deleted Docs - SQL SYNC](https://discuss.elastic.co/t/deleted-docs-sql-sync/312153)
**Author:** [@Berat\_Demirci](https://discuss.elastic.co/u/Berat_Demirci)\ **Replies:** 0\ **Last updated:** [August 16, 2022, 8:57am UTC](https://discuss.elastic.co/t/deleted-docs-sql-sync/312153 "2022-08-16T08:57:41Z")
I will sync data from sql to elastic. My config was running a few tries but now It is deleting my docs. Sync is successful and I dont see any error. My config input { jdbc { jdbc\_driver\_library =\> "C:\\Program Files\\… --- ## [Connect autoconfigured clusters for cross-cluster-replication](https://discuss.elastic.co/t/connect-autoconfigured-clusters-for-cross-cluster-replication/312005)
**Author:** [@neox2811](https://discuss.elastic.co/u/neox2811)\ **Replies:** 1\ **Last updated:** [August 16, 2022, 7:42am UTC](https://discuss.elastic.co/t/connect-autoconfigured-clusters-for-cross-cluster-replication/312005 "2022-08-16T07:42:46Z")
Hi, I've got a running production cluster "A" autoconfigured with security on install. The cluster already contains some data / indices. Now I want to add cross-cluster-replication (Simple Leader -\> Follower setup like… --- ## [Kibana filter on dashboard not working for Vega](https://discuss.elastic.co/t/kibana-filter-on-dashboard-not-working-for-vega/311107)
**Author:** [@pranay\_jain](https://discuss.elastic.co/u/pranay_jain)\ **Replies:** 2\ **Last updated:** [August 16, 2022, 7:15am UTC](https://discuss.elastic.co/t/kibana-filter-on-dashboard-not-working-for-vega/311107 "2022-08-16T07:15:53Z")
I have a index named 'employees' with following mapping "properties": { "employee\_id": { "type": "long" }, "employee\_details": { "type": "nested", "dynamic": "false", "properties": { "city": … --- ## [Elastic Data Stream Creation And Search](https://discuss.elastic.co/t/elastic-data-stream-creation-and-search/312044)
**Author:** [@Saeed\_Mozaffari](https://discuss.elastic.co/u/Saeed_Mozaffari)\ **Replies:** 4\ **Last updated:** [August 16, 2022, 7:01am UTC](https://discuss.elastic.co/t/elastic-data-stream-creation-and-search/312044 "2022-08-16T07:01:56Z")
I want to insert about 3 billion record data in elastic. In this migration, data in each backing Indice is not sorted according to time. But when I want to search for data, my search is related to time. According to t… --- ## [Sub Aggregations in java API client](https://discuss.elastic.co/t/sub-aggregations-in-java-api-client/312072)
**Author:** [@Anna\_Mikhilev](https://discuss.elastic.co/u/Anna_Mikhilev)\ **Replies:** 2\ **Last updated:** [August 16, 2022, 6:53am UTC](https://discuss.elastic.co/t/sub-aggregations-in-java-api-client/312072 "2022-08-16T06:53:13Z")
Hi, I am trying to rewrite our code for building multiple aggregations to using the new java API client 7.16.3. I can't find an example for sub aggregations TermsAggregationBuilder aggregationBuilder AggregationBuilde… --- ## [Elasticsearch curator & ES version 8.x](https://discuss.elastic.co/t/elasticsearch-curator-es-version-8-x/312134)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 1\ **Last updated:** [August 16, 2022, 6:15am UTC](https://discuss.elastic.co/t/elasticsearch-curator-es-version-8-x/312134 "2022-08-16T06:15:29Z")
Hi there, am I correct that the latest curatr version does NOT work with ES 8.x., but is limited to / till 7.x? Thanks!! Stefano [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=827) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=829)