# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=848

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 849

---

## [Not able to trigger email from connector](https://discuss.elastic.co/t/not-able-to-trigger-email-from-connector/309672)

<div class="topic-metadata">

**Author:** [@desai.aditya12](https://discuss.elastic.co/u/desai.aditya12)\
**Replies:** 17\
**Last updated:** [July 28, 2022, 10:13am UTC](https://discuss.elastic.co/t/not-able-to-trigger-email-from-connector/309672 "2022-07-28T10:13:47Z")

</div>

I am configuring a connector to send emails when server is down. for that i have done gmail configuration in elasticsearch.yml xpack.notification.email.account: gmail\_account: profile: gmail smtp: auth: true startt…

---

## [Any help to solve these C# NEST (ElasticSearch) errors?](https://discuss.elastic.co/t/any-help-to-solve-these-c-nest-elasticsearch-errors/310772)

<div class="topic-metadata">

**Author:** [@ahmadmd](https://discuss.elastic.co/u/ahmadmd)\
**Replies:** 1\
**Last updated:** [July 28, 2022, 10:09am UTC](https://discuss.elastic.co/t/any-help-to-solve-these-c-nest-elasticsearch-errors/310772 "2022-07-28T10:09:57Z")

</div>

Hello, Recently, I have started to work on C# NEST (ElasticSearch), and having some problems: Error Message: No route taking 1 parameters {index}/\_doc/{id} when using await ESClient.GetAsync(DocumentPath\<TModel\>.Id…

---

## [Output Logstash plugin for Azure Data Explorer (ADX) quickly running out of capacity](https://discuss.elastic.co/t/output-logstash-plugin-for-azure-data-explorer-adx-quickly-running-out-of-capacity/310599)

<div class="topic-metadata">

**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\
**Replies:** 1\
**Last updated:** [July 28, 2022, 9:29am UTC](https://discuss.elastic.co/t/output-logstash-plugin-for-azure-data-explorer-adx-quickly-running-out-of-capacity/310599 "2022-07-28T09:29:03Z")

</div>

Dear All, I use the ADX output plugin to send FW logs to ADX. I first tried it with a stdout{} plugin to massage the data and parse it my way and it was working fine. Now when I enabled the kusto output (That is how i…

---

## [Index rollover malfunctioning](https://discuss.elastic.co/t/index-rollover-malfunctioning/310838)

<div class="topic-metadata">

**Author:** [@AbilashKrishnan](https://discuss.elastic.co/u/AbilashKrishnan)\
**Replies:** 1\
**Last updated:** [July 28, 2022, 9:34am UTC](https://discuss.elastic.co/t/index-rollover-malfunctioning/310838 "2022-07-28T09:34:30Z")

</div>

Hi Team, We are running cron job for index rollover. We have the condition of max\_age set to 1d as shown below , however it is not working as expected. The rollover is working but the index is not generated everyday, we…

---

## [Logstash CEF codec and ECS cannot parse 'rt' field throws an error](https://discuss.elastic.co/t/logstash-cef-codec-and-ecs-cannot-parse-rt-field-throws-an-error/310705)

<div class="topic-metadata">

**Author:** [@wii](https://discuss.elastic.co/u/wii)\
**Replies:** 2\
**Last updated:** [July 28, 2022, 8:54am UTC](https://discuss.elastic.co/t/logstash-cef-codec-and-ecs-cannot-parse-rt-field-throws-an-error/310705 "2022-07-28T08:54:29Z")

</div>

Without ECS, the 'rt' field could be parsed fine and mapped into 'deviceReceiptTime' field. But after enabling ECS in Logstash configuration it throws me an error in log ingesting. Could somebody guide me through this as…

---

## [Synthetic Monitoring in 7.12 version](https://discuss.elastic.co/t/synthetic-monitoring-in-7-12-version/310506)

<div class="topic-metadata">

**Author:** [@Baishali](https://discuss.elastic.co/u/Baishali)\
**Replies:** 2\
**Last updated:** [July 28, 2022, 7:33am UTC](https://discuss.elastic.co/t/synthetic-monitoring-in-7-12-version/310506 "2022-07-28T07:33:54Z")

</div>

I have installed Elasticsearch ver:7.12.1, Kibana ver:7.12.1, Heartbeat ver:7.17 I want to add Synthetic monitoring for a URL. Tried a sample inline code but it was not working. Steps followed: Installed Elasticsearc…

---

## [Logstah : nonexistent lob error from jdbc plugin](https://discuss.elastic.co/t/logstah-nonexistent-lob-error-from-jdbc-plugin/310823)

<div class="topic-metadata">

**Author:** [@Venkatesan\_M](https://discuss.elastic.co/u/Venkatesan_M)\
**Replies:** 0\
**Last updated:** [July 28, 2022, 7:33am UTC](https://discuss.elastic.co/t/logstah-nonexistent-lob-error-from-jdbc-plugin/310823 "2022-07-28T07:33:52Z")

</div>

While selecting blob data from input jdbc getting nonexistent lob value error.Could you someone help me on this.

---

## [Unable to Start Elasticserach](https://discuss.elastic.co/t/unable-to-start-elasticserach/310811)

<div class="topic-metadata">

**Author:** [@Zerra\_Triani](https://discuss.elastic.co/u/Zerra_Triani)\
**Replies:** 3\
**Last updated:** [July 28, 2022, 6:57am UTC](https://discuss.elastic.co/t/unable-to-start-elasticserach/310811 "2022-07-28T06:57:48Z")

</div>

Hi I can't turn on elasticsearch services after enabling xpack.security.enable : true and changing master account password. And I tried to disable the xpack but elasticsearch still can't run Here's the journalctl -xe -…

---

## [Illegal\_argument\_exception: index.lifecycle.rollover\_alias \[cisco-switch\] does not point to index \[cisco-switch-2022.07.27\]](https://discuss.elastic.co/t/illegal-argument-exception-index-lifecycle-rollover-alias-cisco-switch-does-not-point-to-index-cisco-switch-2022-07-27/310719)

<div class="topic-metadata">

**Author:** [@MADxHAWK](https://discuss.elastic.co/u/MADxHAWK)\
**Replies:** 7\
**Last updated:** [July 28, 2022, 6:26am UTC](https://discuss.elastic.co/t/illegal-argument-exception-index-lifecycle-rollover-alias-cisco-switch-does-not-point-to-index-cisco-switch-2022-07-27/310719 "2022-07-28T06:26:19Z")

</div>

Hello, after trying to figure out some stuff about ILM i need some help now. I have about 400 Cisco-Devices sending their logs to a syslog-ng server from where they are send to Elasticsearch via Filebeat / Logstash. T…

---

## [Kibana stack monitoring all nodes reported to be master](https://discuss.elastic.co/t/kibana-stack-monitoring-all-nodes-reported-to-be-master/310549)

<div class="topic-metadata">

**Author:** [@Thuunder7](https://discuss.elastic.co/u/Thuunder7)\
**Replies:** 4\
**Last updated:** [July 28, 2022, 6:24am UTC](https://discuss.elastic.co/t/kibana-stack-monitoring-all-nodes-reported-to-be-master/310549 "2022-07-28T06:24:26Z")

</div>

Hello, I recently upgraded my beats, from 7.16.3 to 8.2.3 and after upgrading, for some reason metricbeat is reporting that all elasticsearch nodes are master. Additionally metricbeat is also reporting a wrong elast…

---

## [Logstash not listening port 5044 even when we configured the beats](https://discuss.elastic.co/t/logstash-not-listening-port-5044-even-when-we-configured-the-beats/310792)

<div class="topic-metadata">

**Author:** [@KALAVATHI\_YALAMANCHA](https://discuss.elastic.co/u/KALAVATHI_YALAMANCHA)\
**Replies:** 17\
**Last updated:** [July 28, 2022, 5:34am UTC](https://discuss.elastic.co/t/logstash-not-listening-port-5044-even-when-we-configured-the-beats/310792 "2022-07-28T05:34:16Z")

</div>

input { beats { type =\> beats host =\> "localhost" port =\> 5044 }

---

## [Grokparsefailure for same kind of logs](https://discuss.elastic.co/t/grokparsefailure-for-same-kind-of-logs/310596)

<div class="topic-metadata">

**Author:** [@Priyanka\_chauhan](https://discuss.elastic.co/u/Priyanka_chauhan)\
**Replies:** 1\
**Last updated:** [July 28, 2022, 4:55am UTC](https://discuss.elastic.co/t/grokparsefailure-for-same-kind-of-logs/310596 "2022-07-28T04:55:22Z")

</div>

I have applied grokpattern to parsed logs,but it happens at kibana that some logs are parsed and some are unparsed while unparsed message is same for both,Kindly help me to find out the issue. sample of parsed and unpar…

---

## [Elasticsearch 8 new Java client - How to convert UpdateResponse to POJO](https://discuss.elastic.co/t/elasticsearch-8-new-java-client-how-to-convert-updateresponse-to-pojo/310810)

<div class="topic-metadata">

**Author:** [@zxuz111](https://discuss.elastic.co/u/zxuz111)\
**Replies:** 0\
**Last updated:** [July 28, 2022, 2:47am UTC](https://discuss.elastic.co/t/elasticsearch-8-new-java-client-how-to-convert-updateresponse-to-pojo/310810 "2022-07-28T02:47:58Z")

</div>

I am using the new Java client (v8.3.1) for Elasticsearch 8, and I could not find a way to convert the update response (UpdataResponse) to a POJO. The example code is as following: UpdateResponse response = esClient.upd…

---

## [Pass extra params in url while using elasticsearch ui](https://discuss.elastic.co/t/pass-extra-params-in-url-while-using-elasticsearch-ui/310711)

<div class="topic-metadata">

**Author:** [@manojxumulus](https://discuss.elastic.co/u/manojxumulus)\
**Replies:** 2\
**Last updated:** [July 28, 2022, 4:01am UTC](https://discuss.elastic.co/t/pass-extra-params-in-url-while-using-elasticsearch-ui/310711 "2022-07-28T04:01:31Z")

</div>

Hello, I want to pass some extra parameters to the Elasticsearch UI app, the passed parameter will not have any effect on the filter, and those parameters are for some extra requirements. if anyone can help then it wil…

---

## [Kibana server is not ready yet - Unable to retrieve version information from Elasticsearch nodes. security\_exception](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-unable-to-retrieve-version-information-from-elasticsearch-nodes-security-exception/310757)

<div class="topic-metadata">

**Author:** [@ShaheerBadar](https://discuss.elastic.co/u/ShaheerBadar)\
**Replies:** 4\
**Last updated:** [July 28, 2022, 3:12am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-unable-to-retrieve-version-information-from-elasticsearch-nodes-security-exception/310757 "2022-07-28T03:12:39Z")

</div>

Hi All, I am new in ELK stack. I have installed elasticsearch & Kibana version 8.3.2 on RedHat Linux 8.6. Elasticsearch configured properly and running fine. But while starting up Kibana we see "Unable to retrieve versi…

---

## [Issue when switch trial license to basic license on Azure self-manage](https://discuss.elastic.co/t/issue-when-switch-trial-license-to-basic-license-on-azure-self-manage/310724)

<div class="topic-metadata">

**Author:** [@wl02302677](https://discuss.elastic.co/u/wl02302677)\
**Replies:** 3\
**Last updated:** [July 28, 2022, 2:28am UTC](https://discuss.elastic.co/t/issue-when-switch-trial-license-to-basic-license-on-azure-self-manage/310724 "2022-07-28T02:28:06Z")

</div>

Hi, I build my elasticsearch cluster by Azure - self-manage. And when I want to switch my ES license to basic, I follow below step and went some cluster error issue Switch license on kibana license management page Che…

---

## [Files Details Monitoring](https://discuss.elastic.co/t/files-details-monitoring/310809)

<div class="topic-metadata">

**Author:** [@KrishnaCh](https://discuss.elastic.co/u/KrishnaCh)\
**Replies:** 1\
**Last updated:** [July 28, 2022, 1:39am UTC](https://discuss.elastic.co/t/files-details-monitoring/310809 "2022-07-28T01:39:30Z")

</div>

Hi All, We have a requirement to monitor files details like file name, file size, file created date, file ownership, etc, all within a particular directory. Is there any beats agent that can be used for this monitoring…

---

## [Can anyone guide me to correct autodiscover condition?](https://discuss.elastic.co/t/can-anyone-guide-me-to-correct-autodiscover-condition/310359)

<div class="topic-metadata">

**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\
**Replies:** 8\
**Last updated:** [July 28, 2022, 1:07am UTC](https://discuss.elastic.co/t/can-anyone-guide-me-to-correct-autodiscover-condition/310359 "2022-07-28T01:07:00Z")

</div>

FB: 7.16.3 I try "- and:" and "and:" both get "missing or invalid condition". filebeat.autodiscover.providers: - type: kubernetes node: ${NODE\_NAME} templates: - condition: and: …

---

## [Query to determine http.max\_content\_length prior to sending?](https://discuss.elastic.co/t/query-to-determine-http-max-content-length-prior-to-sending/310803)

<div class="topic-metadata">

**Author:** [@matty\_r](https://discuss.elastic.co/u/matty_r)\
**Replies:** 3\
**Last updated:** [July 28, 2022, 12:15am UTC](https://discuss.elastic.co/t/query-to-determine-http-max-content-length-prior-to-sending/310803 "2022-07-28T00:15:24Z")

</div>

Hi all, Is there a query to return the http.max\_content\_length prior to sending data? Cheers

---

## [How can I check if a log file was analyzed by logstash or not?](https://discuss.elastic.co/t/how-can-i-check-if-a-log-file-was-analyzed-by-logstash-or-not/310375)

<div class="topic-metadata">

**Author:** [@maoxuguang](https://discuss.elastic.co/u/maoxuguang)\
**Replies:** 2\
**Last updated:** [July 27, 2022, 11:56pm UTC](https://discuss.elastic.co/t/how-can-i-check-if-a-log-file-was-analyzed-by-logstash-or-not/310375 "2022-07-27T23:56:28Z")

</div>

I found one of my log is missing in elasticsearch， how can I know if logstash analyzed it or not? or how can I know what problem logstah meet? In logstash-plain.log the information is limited, there is no information a…

---

## [Elasticsearch nodes not running after reboot linux](https://discuss.elastic.co/t/elasticsearch-nodes-not-running-after-reboot-linux/308975)

<div class="topic-metadata">

**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\
**Replies:** 8\
**Last updated:** [July 27, 2022, 6:31pm UTC](https://discuss.elastic.co/t/elasticsearch-nodes-not-running-after-reboot-linux/308975 "2022-07-27T18:31:57Z")

</div>

Hi every one I have a problem with elasticsearch cluster. when the nodes of elasticsearch turned off, i turned on again, the elasticsearch service state is ● elasticsearch.service - Elasticsearch Loaded: loaded (/lib…

---

## [Elasticsearch 8.3.2 docker org.elasticsearch.gateway.CorruptStateException](https://discuss.elastic.co/t/elasticsearch-8-3-2-docker-org-elasticsearch-gateway-corruptstateexception/310765)

<div class="topic-metadata">

**Author:** [@Zelfapp](https://discuss.elastic.co/u/Zelfapp)\
**Replies:** 3\
**Last updated:** [July 27, 2022, 11:39pm UTC](https://discuss.elastic.co/t/elasticsearch-8-3-2-docker-org-elasticsearch-gateway-corruptstateexception/310765 "2022-07-27T23:39:14Z")

</div>

Installed ES 8.3.2 using docker on my local dev machine. Before this installation I had ES 6.3.2 running and I had deleted all my test indices in 6.3.2 before installing 8.3.2 so that I would avoid any v6 issues with 8 o…

---

## [Data stream logs not showing in discover](https://discuss.elastic.co/t/data-stream-logs-not-showing-in-discover/310662)

<div class="topic-metadata">

**Author:** [@metalaarif](https://discuss.elastic.co/u/metalaarif)\
**Replies:** 14\
**Last updated:** [July 27, 2022, 9:12pm UTC](https://discuss.elastic.co/t/data-stream-logs-not-showing-in-discover/310662 "2022-07-27T21:12:26Z")

</div>

So I have a setup where my rabbitmq send logs to logstash and then to elasticsearch and kibana. This is what I have setup in my /etc/logstash/conf.d/rabbitmq.conf input { rabbitmq { host =\> "0.0.0.0" …

---

## [Backward pagination with search\_after when sorting value is null](https://discuss.elastic.co/t/backward-pagination-with-search-after-when-sorting-value-is-null/310799)

<div class="topic-metadata">

**Author:** [@M\_L](https://discuss.elastic.co/u/M_L)\
**Replies:** 0\
**Last updated:** [July 27, 2022, 8:48pm UTC](https://discuss.elastic.co/t/backward-pagination-with-search-after-when-sorting-value-is-null/310799 "2022-07-27T20:48:01Z")

</div>

Hello, I have an application which has a dashboard, basically a table with hundreds of thousands of records. This table has up to 50 different columns. These columns have different types in mapping: keyword, text, bool…

---

## [Connect Logstash to SQL by jdbc with AD Account](https://discuss.elastic.co/t/connect-logstash-to-sql-by-jdbc-with-ad-account/310631)

<div class="topic-metadata">

**Author:** [@Oriya](https://discuss.elastic.co/u/Oriya)\
**Replies:** 4\
**Last updated:** [July 27, 2022, 6:34pm UTC](https://discuss.elastic.co/t/connect-logstash-to-sql-by-jdbc-with-ad-account/310631 "2022-07-27T18:34:30Z")

</div>

Hi, we have a new environment with 1 logstash server and 3 node servers. in the logstash i have just only one pipeline that i configured with jdbc to connect to sql server. this is the Input configuration pipeline : i…

---

## [Does min\_doc\_count impact the documents returned?](https://discuss.elastic.co/t/does-min-doc-count-impact-the-documents-returned/310787)

<div class="topic-metadata">

**Author:** [@mattkallo](https://discuss.elastic.co/u/mattkallo)\
**Replies:** 0\
**Last updated:** [July 27, 2022, 6:32pm UTC](https://discuss.elastic.co/t/does-min-doc-count-impact-the-documents-returned/310787 "2022-07-27T18:32:59Z")

</div>

Hi - I have 2 questions regarding term aggregations min\_doc\_count setting. Will min\_doc\_count limit the documents returned or just the bucket/term in aggregation? Say I have 200 documents and 120 of them have the te…

---

## [To identify the elastic search breakup pricing for each resources](https://discuss.elastic.co/t/to-identify-the-elastic-search-breakup-pricing-for-each-resources/310782)

<div class="topic-metadata">

**Author:** [@Aravind1](https://discuss.elastic.co/u/Aravind1)\
**Replies:** 1\
**Last updated:** [July 27, 2022, 6:04pm UTC](https://discuss.elastic.co/t/to-identify-the-elastic-search-breakup-pricing-for-each-resources/310782 "2022-07-27T18:04:14Z")

</div>

Hello, We are from Virtusasystem LLC . We have been utilizing the Elasticsearch facility for quite a while now where we are utilizing approximately around 37 or more operating systems. We are looking for a breakdown of …

---

## [Output jdbc data inserts](https://discuss.elastic.co/t/output-jdbc-data-inserts/310780)

<div class="topic-metadata">

**Author:** [@Calvete](https://discuss.elastic.co/u/Calvete)\
**Replies:** 0\
**Last updated:** [July 27, 2022, 5:33pm UTC](https://discuss.elastic.co/t/output-jdbc-data-inserts/310780 "2022-07-27T17:33:16Z")

</div>

Hello, my input is a file in s3 and I am making insections to an amazon aurora postgresq database. The time is not good to insert more than 1 million records, it takes 1 hour and a half. Help me pipeline: batch: siz…

---

## [JVM Pressure on Cluster Nodes with too many indices](https://discuss.elastic.co/t/jvm-pressure-on-cluster-nodes-with-too-many-indices/310695)

<div class="topic-metadata">

**Author:** [@saelastic](https://discuss.elastic.co/u/saelastic)\
**Replies:** 3\
**Last updated:** [July 27, 2022, 4:36pm UTC](https://discuss.elastic.co/t/jvm-pressure-on-cluster-nodes-with-too-many-indices/310695 "2022-07-27T16:36:23Z")

</div>

My current ES stack(7.17.4) deployment size is 2 nodes across 2 zones with 240 GB disk and 8 GB RAM with 2 CPU's each. I have about 4000 shards present in total in the cluster. This count put the ES hot/data nodes i…

---

## [Drilldown without filtering possible?](https://discuss.elastic.co/t/drilldown-without-filtering-possible/310693)

<div class="topic-metadata">

**Author:** [@paolovalladolid](https://discuss.elastic.co/u/paolovalladolid)\
**Replies:** 1\
**Last updated:** [July 27, 2022, 4:34pm UTC](https://discuss.elastic.co/t/drilldown-without-filtering-possible/310693 "2022-07-27T16:34:40Z")

</div>

We're on Kibana 7.16.3 I have a dashboard with a panel that has a drilldown set up, to go to another dashboard. The panel is a table with two columns. When I hover the cursor over a cell to get the little blue icon (r…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=847)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=849)
