# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=859 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 860 --- ## [Logstash running without logstash.yml](https://discuss.elastic.co/t/logstash-running-without-logstash-yml/307338)
**Author:** [@vikram\_singh](https://discuss.elastic.co/u/vikram_singh)\ **Replies:** 5\ **Last updated:** [July 20, 2022, 5:47am UTC](https://discuss.elastic.co/t/logstash-running-without-logstash-yml/307338 "2022-07-20T05:47:40Z")
Hi, I am running logstash for a single file by sudo /usr/share/logstash/bin/logstash --path.settings /etc/logstash/ -f /etc/logstash/conf.d/myfile.conf it is running correctly. But when I start logstash as a service… --- ## [Http input plugins is not behaving as expected](https://discuss.elastic.co/t/http-input-plugins-is-not-behaving-as-expected/309982)
**Author:** [@priyankamondalhcl](https://discuss.elastic.co/u/priyankamondalhcl)\ **Replies:** 2\ **Last updated:** [July 20, 2022, 5:20am UTC](https://discuss.elastic.co/t/http-input-plugins-is-not-behaving-as-expected/309982 "2022-07-20T05:20:22Z")
Hi, I am using http input plugins, which should be capable to expect json events, and the amount of data is huge (around 7,00,000 in 30 mins). after processing some data it stopped working and throwing error: \[13004ae0f… --- ## [Copy contents of one field to same field of another row if certain condition matches](https://discuss.elastic.co/t/copy-contents-of-one-field-to-same-field-of-another-row-if-certain-condition-matches/308339)
**Author:** [@Ashutosh\_Vaidya](https://discuss.elastic.co/u/Ashutosh_Vaidya)\ **Replies:** 14\ **Last updated:** [July 20, 2022, 5:20am UTC](https://discuss.elastic.co/t/copy-contents-of-one-field-to-same-field-of-another-row-if-certain-condition-matches/308339 "2022-07-20T05:20:07Z")
I need to copy contents of “Service” field from No. 15256 into the :path field of No.15257 if “Stream\_Identifier” of both lines in 15256 and 15257 are matching. Kindly suggest how to get this done in the conf file of lo… --- ## [Turning a Filebeat Log into a configured index](https://discuss.elastic.co/t/turning-a-filebeat-log-into-a-configured-index/309926)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 8\ **Last updated:** [July 20, 2022, 4:23am UTC](https://discuss.elastic.co/t/turning-a-filebeat-log-into-a-configured-index/309926 "2022-07-20T04:23:53Z")
So I've been using Filebeat for a while and so far it worked fined, but is getting into the cluster a single message; I want to have it setted into the cluster as separate fields in a way that I could manipulate it bet… --- ## [Get previous problem after adding to docker group](https://discuss.elastic.co/t/get-previous-problem-after-adding-to-docker-group/310077)
**Author:** [@m\_pahlevanzadeh](https://discuss.elastic.co/u/m_pahlevanzadeh)\ **Replies:** 1\ **Last updated:** [July 20, 2022, 4:00am UTC](https://discuss.elastic.co/t/get-previous-problem-after-adding-to-docker-group/310077 "2022-07-20T04:00:39Z")
after adding mohsen user to docker group, I get the The UID or GID must not be smaller than 1000. But id mohsen output is: uid=1000(mohsen) gid=143(docker) groups=143(docker),24(cdrom),25(floppy),29(audio),30(dip),44(v… --- ## [This article is outdated, what's the updated article about this?](https://discuss.elastic.co/t/this-article-is-outdated-whats-the-updated-article-about-this/310078)
**Author:** [@davecomputertips](https://discuss.elastic.co/u/davecomputertips)\ **Replies:** 1\ **Last updated:** [July 20, 2022, 2:54am UTC](https://discuss.elastic.co/t/this-article-is-outdated-whats-the-updated-article-about-this/310078 "2022-07-20T02:54:09Z")
Please share a latest updated article about Elasticsearch types of index(same topic mentioned there and many). --- ## [Upgrade ES 6 Index to 7 Without Reindex](https://discuss.elastic.co/t/upgrade-es-6-index-to-7-without-reindex/309940)
**Author:** [@Jerjef](https://discuss.elastic.co/u/Jerjef)\ **Replies:** 5\ **Last updated:** [July 20, 2022, 12:05am UTC](https://discuss.elastic.co/t/upgrade-es-6-index-to-7-without-reindex/309940 "2022-07-20T00:05:35Z")
I know this sounds obvious, but I need to ask to be sure. I have an ES 6 index in an ES 7 instance. I know it's backward compatible, but is there a way or upgrading the index to an ES 7 schema without reindexing due to… --- ## [Problem with docker pull](https://discuss.elastic.co/t/problem-with-docker-pull/310056)
**Author:** [@Serhio\_Duran](https://discuss.elastic.co/u/Serhio_Duran)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 10:05pm UTC](https://discuss.elastic.co/t/problem-with-docker-pull/310056 "2022-07-19T22:05:11Z")
I can't download docker pull elastic , my ip address -\> 51.158.163.158, 403 forrbiden (( --- ## [How to create filter for strings with separator and calculate string?](https://discuss.elastic.co/t/how-to-create-filter-for-strings-with-separator-and-calculate-string/310073)
**Author:** [@Bohdan\_Repetskyi](https://discuss.elastic.co/u/Bohdan_Repetskyi)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 9:57pm UTC](https://discuss.elastic.co/t/how-to-create-filter-for-strings-with-separator-and-calculate-string/310073 "2022-07-19T21:57:26Z")
I have a simple config file: input { file{ path =\> "/tmp/data\_for\_logstach" start\_position =\> "beginning" } } filter { } output { file{ path =\> "/tmp/logstash\_convert" action =\> "update" } } H… --- ## [How to setup Ingest Pipeline](https://discuss.elastic.co/t/how-to-setup-ingest-pipeline/310057)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 6:26pm UTC](https://discuss.elastic.co/t/how-to-setup-ingest-pipeline/310057 "2022-07-19T18:26:02Z")
This is not a question but rather a solution. last week I was trying to find some simple to do list of how to setup ingest pipleline and make that for particular index. and was hard to find this info. All elastic docume… --- ## [Logstash kafka](https://discuss.elastic.co/t/logstash-kafka/310064)
**Author:** [@emmanuel\_stevens\_LED](https://discuss.elastic.co/u/emmanuel_stevens_LED)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 7:55pm UTC](https://discuss.elastic.co/t/logstash-kafka/310064 "2022-07-19T19:55:03Z")
Hello, I need some help to understand someting. I am new in elk stack so i will ask a lot of questions for the next weeks. With th persistant queue in logstash and the Filebeat backpressure-sensitive protocol when send… --- ## [Vulnerabilities in latest docker image of Elasticsearch 8.3.1](https://discuss.elastic.co/t/vulnerabilities-in-latest-docker-image-of-elasticsearch-8-3-1/310031)
**Author:** [@chitransh\_1](https://discuss.elastic.co/u/chitransh_1)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 9:30pm UTC](https://discuss.elastic.co/t/vulnerabilities-in-latest-docker-image-of-elasticsearch-8-3-1/310031 "2022-07-19T21:30:13Z")
Hi, We are using Elasticsearch 8.3.1 for one of our projects. While scanning the Elasticsearch 8.3.1 with Aquasec Scanner, we are getting a few CVEs: These CVE are associated with various Java based packages which hav… --- ## [Updating Debian package does not copy state.yml](https://discuss.elastic.co/t/updating-debian-package-does-not-copy-state-yml/310037)
**Author:** [@nessus](https://discuss.elastic.co/u/nessus)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 2:55pm UTC](https://discuss.elastic.co/t/updating-debian-package-does-not-copy-state-yml/310037 "2022-07-19T14:55:46Z")
Hello I just wanted to report a probably not wanted interaction between the elastic-agent debian packages when managed by a fleet Server. We had the problem, that we always needed to enroll an agent again after an upda… --- ## [Why does it need cluster:monitor/main permission](https://discuss.elastic.co/t/why-does-it-need-cluster-monitor-main-permission/310069)
**Author:** [@xliu](https://discuss.elastic.co/u/xliu)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 9:14pm UTC](https://discuss.elastic.co/t/why-does-it-need-cluster-monitor-main-permission/310069 "2022-07-19T21:14:38Z")
ES 7.17 cloud is hosted in https://xxx.elastic-cloud.com:9243 Using Java High Level REST client, I was able to connect to server ES client 7.9.3. Now I update to ES client 7.17.4. But it gives me permission issue. "roo… --- ## [Integrating Serilog with applications](https://discuss.elastic.co/t/integrating-serilog-with-applications/310068)
**Author:** [@wes.campbell](https://discuss.elastic.co/u/wes.campbell)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 9:08pm UTC](https://discuss.elastic.co/t/integrating-serilog-with-applications/310068 "2022-07-19T21:08:56Z")
The logs for our applications are captured by Serilog and sent to Elasticsearch. All of our configuration info for connecting to Elasticsearch is in the application config file. What do I need to enter in the config rega… --- ## [Problem with fleet server, intake/v2/events not found](https://discuss.elastic.co/t/problem-with-fleet-server-intake-v2-events-not-found/310051)
**Author:** [@Cpt\_Falcon](https://discuss.elastic.co/u/Cpt_Falcon)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 4:41pm UTC](https://discuss.elastic.co/t/problem-with-fleet-server-intake-v2-events-not-found/310051 "2022-07-19T16:41:57Z")
Hello, I'm currently trying to use fleet server locally on docker desktop. I feel like I've almost got it working but there seems to be a bug with the fleet server as intake/v2/events does not exist? I really don't unde… --- ## [Rules API Key](https://discuss.elastic.co/t/rules-api-key/309999)
**Author:** [@robdiluca](https://discuss.elastic.co/u/robdiluca)\ **Replies:** 9\ **Last updated:** [July 19, 2022, 7:20pm UTC](https://discuss.elastic.co/t/rules-api-key/309999 "2022-07-19T19:20:02Z")
Hi all, the Kibana Alerting doc (Alerting set up | Kibana Guide \[8.3\] | Elastic) says rules are authorized using an API Key created internally with the same privileges as the user creating/updating the rule. I wonder if… --- ## [Can I export the agent overview from Fleet](https://discuss.elastic.co/t/can-i-export-the-agent-overview-from-fleet/310059)
**Author:** [@stobbe99](https://discuss.elastic.co/u/stobbe99)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 6:42pm UTC](https://discuss.elastic.co/t/can-i-export-the-agent-overview-from-fleet/310059 "2022-07-19T18:42:27Z")
Hello, Is there an easy way to export the list of agents like the one in the fleet overview? I assume this is not extracted from an index? KR Henk --- ## [ES response shows ~20 secs delay when observed from the browser network logs](https://discuss.elastic.co/t/es-response-shows-20-secs-delay-when-observed-from-the-browser-network-logs/310049)
**Author:** [@kkumar.e](https://discuss.elastic.co/u/kkumar.e)\ **Replies:** 2\ **Last updated:** [July 19, 2022, 6:10pm UTC](https://discuss.elastic.co/t/es-response-shows-20-secs-delay-when-observed-from-the-browser-network-logs/310049 "2022-07-19T18:10:00Z")
Hi All, We are observing a random ~20 sec delay on ES responses on an ES cluster with 2 nodes created on 2 AWS EC2 servers spread across 2 subnets. I followed the steps in the below ref link to generate CA and elastic-s… --- ## [Pushing log to elastic.co and splitting message](https://discuss.elastic.co/t/pushing-log-to-elastic-co-and-splitting-message/310053)
**Author:** [@milosz](https://discuss.elastic.co/u/milosz)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 5:33pm UTC](https://discuss.elastic.co/t/pushing-log-to-elastic-co-and-splitting-message/310053 "2022-07-19T17:33:23Z")
Hi, I'm using elastic.co and filebeat. My config is: cloud.id: cloud.auth: filebeat.inputs: - type: log enabled: true paths: - /var/www/vhosts/doomain/logs/access\_ssl\_log tags: domain fields: log\_type:… --- ## [Incorrect Kibana Mappings From Winlogbeats Setup Command](https://discuss.elastic.co/t/incorrect-kibana-mappings-from-winlogbeats-setup-command/309953)
**Author:** [@Jared9922](https://discuss.elastic.co/u/Jared9922)\ **Replies:** 2\ **Last updated:** [July 19, 2022, 3:47pm UTC](https://discuss.elastic.co/t/incorrect-kibana-mappings-from-winlogbeats-setup-command/309953 "2022-07-19T15:47:24Z")
I have installed Winlogbeat on my computer and data seems to be flowing correctly. My data flows through my stack as shown Winlogbeat -\> logstash -\> elasticsearch I am trying to setup the index templates for Winlogbeat… --- ## [Problem with elasticsearch-certutil http and "ca certificate is not a CA" error](https://discuss.elastic.co/t/problem-with-elasticsearch-certutil-http-and-ca-certificate-is-not-a-ca-error/309949)
**Author:** [@rlatta](https://discuss.elastic.co/u/rlatta)\ **Replies:** 4\ **Last updated:** [July 19, 2022, 3:54pm UTC](https://discuss.elastic.co/t/problem-with-elasticsearch-certutil-http-and-ca-certificate-is-not-a-ca-error/309949 "2022-07-19T15:54:41Z")
Hello, I installed Elasticsearch and Kibana 7.17.5 (windows server 2019). I followed the directions in the "Set up basic security for the Elastic Stack" and didn't run into problems. However, when I move on to the set… --- ## [Painless script throws "illegal tree structure." when using literal with hexadecimal value](https://discuss.elastic.co/t/painless-script-throws-illegal-tree-structure-when-using-literal-with-hexadecimal-value/310007)
**Author:** [@Nimrod\_Karni](https://discuss.elastic.co/u/Nimrod_Karni)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 2:42pm UTC](https://discuss.elastic.co/t/painless-script-throws-illegal-tree-structure-when-using-literal-with-hexadecimal-value/310007 "2022-07-19T14:42:00Z")
Elasticsearch 8.3 Using painless Lab (Kibana 8.3) byte i = 0xc; return i; Works fine - output 12 byte i = 0xd; return i; output - Unhandled Exception illegal\_state\_exception Illegal tree structure. should be … --- ## [Not able to recognize rsyslogs in SIEM](https://discuss.elastic.co/t/not-able-to-recognize-rsyslogs-in-siem/309750)
**Author:** [@Rao\_Nelakurti](https://discuss.elastic.co/u/Rao_Nelakurti)\ **Replies:** 5\ **Last updated:** [July 18, 2022, 2:59pm UTC](https://discuss.elastic.co/t/not-able-to-recognize-rsyslogs-in-siem/309750 "2022-07-18T14:59:08Z")
I'm trying to send rsyslogs to SIEM (rsyslog-\> filebeat-\> logstash-\> siem) filebeat.conf, filebeat.spool\_size: 2048 filebeat.idle\_timeout: 5s output.logstash: hosts: \['10.x.x.5:6045'\] - type: log paths: - /var/l… --- ## [How to update index to allow nested queries?](https://discuss.elastic.co/t/how-to-update-index-to-allow-nested-queries/310027)
**Author:** [@Migodden](https://discuss.elastic.co/u/Migodden)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 1:17pm UTC](https://discuss.elastic.co/t/how-to-update-index-to-allow-nested-queries/310027 "2022-07-19T13:17:28Z")
We have an index with a property that stores an array of objects with properties of strings. I want to be able to query against these array of objects to find a document where the objects properties match certain conditi… --- ## [1 huge pipelines vs 2 medium ones](https://discuss.elastic.co/t/1-huge-pipelines-vs-2-medium-ones/309925)
**Author:** [@anon90868141](https://discuss.elastic.co/u/anon90868141)\ **Replies:** 5\ **Last updated:** [July 19, 2022, 12:28pm UTC](https://discuss.elastic.co/t/1-huge-pipelines-vs-2-medium-ones/309925 "2022-07-19T12:28:41Z")
Hello, let's say I've got a cluster with 10 machines a 12 cores and I see data not being collected fast enough, so I need to raise my threads which is already at 12. Is better to go with the same pipeline and raise the… --- ## [Creating a NOT EQUAL filter in Java Fluent API](https://discuss.elastic.co/t/creating-a-not-equal-filter-in-java-fluent-api/309859)
**Author:** [@bweston](https://discuss.elastic.co/u/bweston)\ **Replies:** 4\ **Last updated:** [July 19, 2022, 12:29pm UTC](https://discuss.elastic.co/t/creating-a-not-equal-filter-in-java-fluent-api/309859 "2022-07-19T12:29:37Z")
Hi, I'm trying to compose a NOT EQUAL filter with the new Java Fluent API, querying Elastic 8.2 and have drawn a blank. The query below returns all documents that have expired according to our company retention policy, … --- ## [Vega visualisation](https://discuss.elastic.co/t/vega-visualisation/309217)
**Author:** [@meyer1](https://discuss.elastic.co/u/meyer1)\ **Replies:** 5\ **Last updated:** [July 19, 2022, 12:22pm UTC](https://discuss.elastic.co/t/vega-visualisation/309217 "2022-07-19T12:22:01Z")
Hello everyone, I would like to make an online visualization using some fields of my document which looks like this: "otherFieldA" : "...", "otherFieldB" : "...", "otherFieldC" : "...", "mainField" : \[ { … --- ## [Java client: Jackson exception: Numeric value out of range of int](https://discuss.elastic.co/t/java-client-jackson-exception-numeric-value-out-of-range-of-int/309673)
**Author:** [@John16](https://discuss.elastic.co/u/John16)\ **Replies:** 3\ **Last updated:** [July 19, 2022, 12:14pm UTC](https://discuss.elastic.co/t/java-client-jackson-exception-numeric-value-out-of-range-of-int/309673 "2022-07-19T12:14:12Z")
Hello, I am using Java client version 7.17.4 (server is 7.17.0). Executing the following code ElasticsearchIndicesClient indicesClient = new ElasticsearchIndicesClient(transport); indicesClient.stats(b -\> b.index("nam… --- ## [Terminate after not working for elasticsearch count ? Count optimization issue](https://discuss.elastic.co/t/terminate-after-not-working-for-elasticsearch-count-count-optimization-issue/310016)
**Author:** [@mehdiz](https://discuss.elastic.co/u/mehdiz)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 12:04pm UTC](https://discuss.elastic.co/t/terminate-after-not-working-for-elasticsearch-count-count-optimization-issue/310016 "2022-07-19T12:04:02Z")
I want to have the total count of documents matching a specific query using the count query api of Elasticsearch on Python. I'm using the count to have a check of maximum documents that we can fetch for one query, somet… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=858) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=860)