# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=861 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 862 --- ## [Check agent status with api](https://discuss.elastic.co/t/check-agent-status-with-api/309640)
**Author:** [@ericdb](https://discuss.elastic.co/u/ericdb)\ **Replies:** 0\ **Last updated:** [July 14, 2022, 12:00pm UTC](https://discuss.elastic.co/t/check-agent-status-with-api/309640 "2022-07-14T12:00:49Z")
Is it possible to get the status from fleet agents with api using the hostname? document says there is a request with agentID https://petstore.swagger.io/?url=https://raw.githubusercontent.com/elastic/kibana/master/x-p… --- ## [Setup.template.enabled: false. not work for disable default mapping](https://discuss.elastic.co/t/setup-template-enabled-false-not-work-for-disable-default-mapping/309720)
**Author:** [@sinbargit](https://discuss.elastic.co/u/sinbargit)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 2:08am UTC](https://discuss.elastic.co/t/setup-template-enabled-false-not-work-for-disable-default-mapping/309720 "2022-07-19T02:08:40Z")
filebeat version 7.1.1. I set setup.template.enabled: false. but there are still other fields like network.\* in my index. And after I set my own template, the template is used, but still certain fields in my index. J… --- ## [Is there a section in the documentation that breaks down all available subcommands for a command?](https://discuss.elastic.co/t/is-there-a-section-in-the-documentation-that-breaks-down-all-available-subcommands-for-a-command/309601)
**Author:** [@pushshift](https://discuss.elastic.co/u/pushshift)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 2:08am UTC](https://discuss.elastic.co/t/is-there-a-section-in-the-documentation-that-breaks-down-all-available-subcommands-for-a-command/309601 "2022-07-19T02:08:00Z")
When you do: curl -XGET https://localhost:9200/\_cat/ You get a nice little directory of available subcommands beneath \_cat. However, when I try to do the same for other sections like "\_cluster", I get the following: c… --- ## [ElasticSearch-Service install is not working](https://discuss.elastic.co/t/elasticsearch-service-install-is-not-working/309676)
**Author:** [@Muhammad\_Umair\_Sheik](https://discuss.elastic.co/u/Muhammad_Umair_Sheik)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 2:04am UTC](https://discuss.elastic.co/t/elasticsearch-service-install-is-not-working/309676 "2022-07-19T02:04:45Z")
I am not able to install elastic as a windows service when there is space in the path. Without space, it is working fine. In the past, I was using version 6 which was working perfectly fine with both options. I have att… --- ## [Trying to run all tests on my app yields "too many open files" error](https://discuss.elastic.co/t/trying-to-run-all-tests-on-my-app-yields-too-many-open-files-error/309759)
**Author:** [@juno](https://discuss.elastic.co/u/juno)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 2:01am UTC](https://discuss.elastic.co/t/trying-to-run-all-tests-on-my-app-yields-too-many-open-files-error/309759 "2022-07-19T02:01:22Z")
I'm building a reasonably small web app in Clojure and trying to run all the tests in order to get code coverage, but if I try to run them all, I get "too many open files" errors from elasticsearch. I have already tried… --- ## [Possible to scroll call ES v. 1.7 - how? I get errors](https://discuss.elastic.co/t/possible-to-scroll-call-es-v-1-7-how-i-get-errors/309653)
**Author:** [@johand\_erst](https://discuss.elastic.co/u/johand_erst)\ **Replies:** 2\ **Last updated:** [July 19, 2022, 1:54am UTC](https://discuss.elastic.co/t/possible-to-scroll-call-es-v-1-7-how-i-get-errors/309653 "2022-07-19T01:54:12Z")
Can someone help me what to do to call ES v. 1.7 with \_scroll\_id, please? According to the documentation it should be possible. Currently, I get one of these errors trying to pass \_scroll\_id in the payload: I write in… --- ## [Logstash syncing from Mongodb to Elasticsearch - Null values in array data objects](https://discuss.elastic.co/t/logstash-syncing-from-mongodb-to-elasticsearch-null-values-in-array-data-objects/309965)
**Author:** [@bindu1](https://discuss.elastic.co/u/bindu1)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 1:44am UTC](https://discuss.elastic.co/t/logstash-syncing-from-mongodb-to-elasticsearch-null-values-in-array-data-objects/309965 "2022-07-19T01:44:44Z")
Hello Community, I'm using logstash to sync data from Mongdb to Elasticsearch & Kibana using JDBC input plugin. But array data fields are being synced as NULL values in ES/Kibana. Below is logstash.conf: input { … --- ## [Resolve Indices API: Missing documentation for params \`allow\_no\_indices\`, \`ignore\_unavailable\` and target \`\_all\`](https://discuss.elastic.co/t/resolve-indices-api-missing-documentation-for-params-allow-no-indices-ignore-unavailable-and-target-all/309964)
**Author:** [@pavan02](https://discuss.elastic.co/u/pavan02)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 1:38am UTC](https://discuss.elastic.co/t/resolve-indices-api-missing-documentation-for-params-allow-no-indices-ignore-unavailable-and-target-all/309964 "2022-07-19T01:38:11Z")
Resolve index API | Elasticsearch Guide \[8.3\] | Elastic documentation doesn't describe params allow\_no\_indices, ignore\_unavailable and \_all target. However, those params and target is actually working. Does resolve API … --- ## [Installing ELK...Stuck in Elasticsearch not able to get Token and username password on windows 10 pro10](https://discuss.elastic.co/t/installing-elk-stuck-in-elasticsearch-not-able-to-get-token-and-username-password-on-windows-10-pro10/309776)
**Author:** [@sarvesh\_singh](https://discuss.elastic.co/u/sarvesh_singh)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 1:27am UTC](https://discuss.elastic.co/t/installing-elk-stuck-in-elasticsearch-not-able-to-get-token-and-username-password-on-windows-10-pro10/309776 "2022-07-19T01:27:39Z")
\[2022-07-16T04:10:17,949\]\[INFO \]\[o.e.g.GatewayService \] \[DESKTOP-MJL6HRR\] recovered \[1\] indices into cluster\_state \[2022-07-16T04:10:18,325\]\[ERROR\]\[o.e.i.g.GeoIpDownloader \] \[DESKTOP-MJL6HRR\] exception during geoip… --- ## [Logstash fillter](https://discuss.elastic.co/t/logstash-fillter/309846)
**Author:** [@Jathurshan\_Sumandira](https://discuss.elastic.co/u/Jathurshan_Sumandira)\ **Replies:** 0\ **Last updated:** [July 18, 2022, 6:16am UTC](https://discuss.elastic.co/t/logstash-fillter/309846 "2022-07-18T06:16:13Z")
Hi Team, We are using 2 filters. First one is to get the token and by getting the token we are going to call the next url with bearer token First http getting the response but second http method is not giving data ht… --- ## [Multi-Tier Architecture, best configuration for Elasticsearch.output](https://discuss.elastic.co/t/multi-tier-architecture-best-configuration-for-elasticsearch-output/309862)
**Author:** [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 1:25am UTC](https://discuss.elastic.co/t/multi-tier-architecture-best-configuration-for-elasticsearch-output/309862 "2022-07-19T01:25:23Z")
Hello, I hope you are having a good day, I'm trying to migrate to a multi-tier architecture, and I'm confused what should the Elasticsearch.output configuration in beats and Elastic Agent be: Should I configure beats… --- ## [How to safely disable XPack security features](https://discuss.elastic.co/t/how-to-safely-disable-xpack-security-features/309725)
**Author:** [@yeziblo](https://discuss.elastic.co/u/yeziblo)\ **Replies:** 3\ **Last updated:** [July 19, 2022, 1:24am UTC](https://discuss.elastic.co/t/how-to-safely-disable-xpack-security-features/309725 "2022-07-19T01:24:41Z")
Hi everyone, I need help. In the near future, we plan to enable X-PACK security for our ES cluster，both transport and https. What we need to consider is: once there is a problem in the production environment, we need t… --- ## [Best practices for dynamic expiration](https://discuss.elastic.co/t/best-practices-for-dynamic-expiration/309957)
**Author:** [@terramar](https://discuss.elastic.co/u/terramar)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 12:24am UTC](https://discuss.elastic.co/t/best-practices-for-dynamic-expiration/309957 "2022-07-19T00:24:18Z")
I'm not sure if that title makes much sense. Right now, I have a fair amount of data coming in through logstash - about 7-10GB/day, and it all needs to stick around for 60 days. I currently write it to an index ("index-… --- ## [Documentation for reporting with basic licence is wrong](https://discuss.elastic.co/t/documentation-for-reporting-with-basic-licence-is-wrong/309924)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [July 18, 2022, 10:50pm UTC](https://discuss.elastic.co/t/documentation-for-reporting-with-basic-licence-is-wrong/309924 "2022-07-18T22:50:27Z")
Hi the API call in this section of the documentation doesnt work in the actual version of elasticsearch. what will be the right API call to set reporting with basic licence? --- ## [Heartbeat - Avoid journey timeout](https://discuss.elastic.co/t/heartbeat-avoid-journey-timeout/309421)
**Author:** [@Verdugo\_Gonzalo](https://discuss.elastic.co/u/Verdugo_Gonzalo)\ **Replies:** 1\ **Last updated:** [July 18, 2022, 8:29pm UTC](https://discuss.elastic.co/t/heartbeat-avoid-journey-timeout/309421 "2022-07-18T20:29:58Z")
Hello, I'm working with synthetic monitoring. How can I prevent the journey from finishing when one of the steps throws an error or timeout and 2 steps remain pending? unfortunately I have a small number of logins on a… --- ## [Logstash pipeline DLQ issue](https://discuss.elastic.co/t/logstash-pipeline-dlq-issue/309920)
**Author:** [@Harper\_S1](https://discuss.elastic.co/u/Harper_S1)\ **Replies:** 9\ **Last updated:** [July 18, 2022, 7:31pm UTC](https://discuss.elastic.co/t/logstash-pipeline-dlq-issue/309920 "2022-07-18T19:31:37Z")
Hi, I am upgrading my logstash from 7.x.x to 8.2.0. Problem is, logstash is not able to run the pipeline, showing the following error. \[2022-07-18T11:08:52,606\]\[ERROR\]\[org.logstash.common.io.DeadLetterQueueWriter\]\[main… --- ## [Better to have more indices or more shards per index?](https://discuss.elastic.co/t/better-to-have-more-indices-or-more-shards-per-index/309937)
**Author:** [@Jeremy\_Andrews](https://discuss.elastic.co/u/Jeremy_Andrews)\ **Replies:** 2\ **Last updated:** [July 18, 2022, 6:58pm UTC](https://discuss.elastic.co/t/better-to-have-more-indices-or-more-shards-per-index/309937 "2022-07-18T18:58:35Z")
Let's say I have 200 GB of data and I'll split it between 4 shards of 50 GB each. Is there a difference in terms of performance whether I have 4 indices with 1 shard each, versus having one index with 4 primary shards? --- ## [Logstash syslog input filter default grok patterns](https://discuss.elastic.co/t/logstash-syslog-input-filter-default-grok-patterns/309938)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 1\ **Last updated:** [July 18, 2022, 6:54pm UTC](https://discuss.elastic.co/t/logstash-syslog-input-filter-default-grok-patterns/309938 "2022-07-18T18:54:47Z")
What are the default grok patterns for the syslog input filter? The data is from old snare, failing messages are formatted something like this: \<135\> 07/18/2022:18:14:52 GMT HOSTNAME syslog\_message. Thanks --- ## [Logstash cannot parse user\_agent field of nginx](https://discuss.elastic.co/t/logstash-cannot-parse-user-agent-field-of-nginx/309934)
**Author:** [@kosmylo](https://discuss.elastic.co/u/kosmylo)\ **Replies:** 3\ **Last updated:** [July 18, 2022, 6:51pm UTC](https://discuss.elastic.co/t/logstash-cannot-parse-user-agent-field-of-nginx/309934 "2022-07-18T18:51:43Z")
I have nginx logs with the following format: 192.168.0.1 - - \[18/Jul/2022:11:20:28 +0000\] "GET / HTTP/1.1" 200 15 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Sa… --- ## [Confirm connection](https://discuss.elastic.co/t/confirm-connection/309498)
**Author:** [@puritymind85](https://discuss.elastic.co/u/puritymind85)\ **Replies:** 1\ **Last updated:** [July 18, 2022, 6:39pm UTC](https://discuss.elastic.co/t/confirm-connection/309498 "2022-07-18T18:39:48Z")
Hello. Configuring ELK it is necessary to configure fleet and agent. The agent is running on the 3rd installation point fleet still shows Confirm connection. Tell me what could be the problem? Everything is installed on… --- ## [Elastic Agent on Amazon Linux 2: "service" executable file not found in $PATH](https://discuss.elastic.co/t/elastic-agent-on-amazon-linux-2-service-executable-file-not-found-in-path/309616)
**Author:** [@ajbailey](https://discuss.elastic.co/u/ajbailey)\ **Replies:** 2\ **Last updated:** [July 18, 2022, 6:29pm UTC](https://discuss.elastic.co/t/elastic-agent-on-amazon-linux-2-service-executable-file-not-found-in-path/309616 "2022-07-18T18:29:47Z")
Hi, Following the installation guidelines for the Elastic Agent, it does not seem possible to run it on Amazon Linux 2. How can we work around this? I believe that AL2 does not use "service". docker run -it --rm amazon… --- ## [Logstash Filter JSON syslog message field is not getting parsed](https://discuss.elastic.co/t/logstash-filter-json-syslog-message-field-is-not-getting-parsed/309864)
**Author:** [@Giridharan\_C](https://discuss.elastic.co/u/Giridharan_C)\ **Replies:** 3\ **Last updated:** [July 18, 2022, 6:12pm UTC](https://discuss.elastic.co/t/logstash-filter-json-syslog-message-field-is-not-getting-parsed/309864 "2022-07-18T18:12:22Z")
I cannot parse the incoming Syslog by JSON. The message field is not getting parsed. I tried JSON filter using addfield and also with mutate but no luck. I used GROK to parse specific fields but the message field has key… --- ## [Logstash grok pattern for custom nginx access log](https://discuss.elastic.co/t/logstash-grok-pattern-for-custom-nginx-access-log/309933)
**Author:** [@kosmylo](https://discuss.elastic.co/u/kosmylo)\ **Replies:** 0\ **Last updated:** [July 18, 2022, 5:46pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-for-custom-nginx-access-log/309933 "2022-07-18T17:46:09Z")
I have a custom format of nginx access.log and I want to parse it with logstash. The format of the access log is the following: log\_format main '$remote\_addr - $remote\_user \[$time\_local\] "$request" ' … --- ## [Unable to deploy elastic agent on kubernetes as daemonset](https://discuss.elastic.co/t/unable-to-deploy-elastic-agent-on-kubernetes-as-daemonset/309931)
**Author:** [@Samuel\_Ho](https://discuss.elastic.co/u/Samuel_Ho)\ **Replies:** 0\ **Last updated:** [July 18, 2022, 5:20pm UTC](https://discuss.elastic.co/t/unable-to-deploy-elastic-agent-on-kubernetes-as-daemonset/309931 "2022-07-18T17:20:38Z")
Hi, I'm having some issue trying to deploy elastic agent to monitor kubernetes as a daemonset. Please see logs from the pod as following. Greatly appreciate some guidance. {"log.level":"warn","@timestamp":"2022-07-18T1… --- ## [Removing special characters](https://discuss.elastic.co/t/removing-special-characters/309766)
**Author:** [@JeremyP](https://discuss.elastic.co/u/JeremyP)\ **Replies:** 6\ **Last updated:** [July 18, 2022, 4:40pm UTC](https://discuss.elastic.co/t/removing-special-characters/309766 "2022-07-18T16:40:07Z")
Hello, I have some special characters in one of my fields which I'm having issues removing. They may be reserved characters so my logstash instance is failing. Here is the event in question... "proof" =\> \[ … --- ## [Implementing Search After to fetch hits greater than 10000](https://discuss.elastic.co/t/implementing-search-after-to-fetch-hits-greater-than-10000/309913)
**Author:** [@Namita\_Jaokar](https://discuss.elastic.co/u/Namita_Jaokar)\ **Replies:** 1\ **Last updated:** [July 18, 2022, 2:59pm UTC](https://discuss.elastic.co/t/implementing-search-after-to-fetch-hits-greater-than-10000/309913 "2022-07-18T14:59:18Z")
Hi team, I am using elasticsearch in java to query hits that are greater than maximum default of 10000. For the same I came across using search after along with sort. I tried the query by sorting it on the basis of @ti… --- ## [Receiving partial messages in elastic](https://discuss.elastic.co/t/receiving-partial-messages-in-elastic/309730)
**Author:** [@ytld](https://discuss.elastic.co/u/ytld)\ **Replies:** 4\ **Last updated:** [July 18, 2022, 2:56pm UTC](https://discuss.elastic.co/t/receiving-partial-messages-in-elastic/309730 "2022-07-18T14:56:03Z")
We have a problem in our ELK-stack of which I'm unsure how to solve. We're running 8.3 version of the ELK-stack on Centos 7 machines and whereas everything worked fine before, since this week we're only seeing partial m… --- ## [Searching on aggregated nested fields](https://discuss.elastic.co/t/searching-on-aggregated-nested-fields/309909)
**Author:** [@Robina\_Dhingra1](https://discuss.elastic.co/u/Robina_Dhingra1)\ **Replies:** 0\ **Last updated:** [July 18, 2022, 1:57pm UTC](https://discuss.elastic.co/t/searching-on-aggregated-nested-fields/309909 "2022-07-18T13:57:23Z")
Hi Team Elastic, We have a requirement where we created continuous transform to keep track of field status of our trades data. The transform aggregates the data and produces documents in this form - { "\_index":… --- ## [Dedicated index logs-ti\* (Threat Intel module) in Filebeat](https://discuss.elastic.co/t/dedicated-index-logs-ti-threat-intel-module-in-filebeat/309908)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 0\ **Last updated:** [July 18, 2022, 1:52pm UTC](https://discuss.elastic.co/t/dedicated-index-logs-ti-threat-intel-module-in-filebeat/309908 "2022-07-18T13:52:26Z")
I have a minor problem, According to the documentation, the logs from the Threat Intel module in Filebeat can reside in a dedicated logs-ti\* index. Quick link to the page: Enable threat intelligence integrations | Elas… --- ## [First filter then run nested query](https://discuss.elastic.co/t/first-filter-then-run-nested-query/309905)
**Author:** [@Michal\_Bogusz](https://discuss.elastic.co/u/Michal_Bogusz)\ **Replies:** 2\ **Last updated:** [July 18, 2022, 1:51pm UTC](https://discuss.elastic.co/t/first-filter-then-run-nested-query/309905 "2022-07-18T13:51:03Z")
I have document with mapping: { "properties": { "title": {"type": "text"}, "added": {"type": "date"}, "pdf\_url": {"type": "text"}, "blocks": {"type": "nested"} } } I plan to have… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=860) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=862)