# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=868 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 869 --- ## [Filebeat cannt connect to kibana](https://discuss.elastic.co/t/filebeat-cannt-connect-to-kibana/309433)
**Author:** [@matin44](https://discuss.elastic.co/u/matin44)\ **Replies:** 2\ **Last updated:** [July 13, 2022, 7:29am UTC](https://discuss.elastic.co/t/filebeat-cannt-connect-to-kibana/309433 "2022-07-13T07:29:39Z")
i try to setup filebeat on redhat when i run the command "filebeat setup -e" i get error message "Exiting: error connecting to Kibana: fail to get the Kibana version ....." i changed the kibana host name at filebeat.y… --- ## [Error on starting elasticsearch](https://discuss.elastic.co/t/error-on-starting-elasticsearch/309493)
**Author:** [@fransrampai](https://discuss.elastic.co/u/fransrampai)\ **Replies:** 0\ **Last updated:** [July 13, 2022, 7:13am UTC](https://discuss.elastic.co/t/error-on-starting-elasticsearch/309493 "2022-07-13T07:13:05Z")
Hi I am having error when start elasticsearch.8.3.2, please see my logs: Jul 13 09:06:22 rnb03-sbices1 systemd-entrypoint\[22381\]: /usr/share/elasticsearch/bin/systemd-entrypoint: line 7: my\_pwd\_file.tmp: No such file or… --- ## [Watcher fails to send email](https://discuss.elastic.co/t/watcher-fails-to-send-email/309490)
**Author:** [@Jacky\_Kwok](https://discuss.elastic.co/u/Jacky_Kwok)\ **Replies:** 0\ **Last updated:** [July 13, 2022, 7:05am UTC](https://discuss.elastic.co/t/watcher-fails-to-send-email/309490 "2022-07-13T07:05:08Z")
Hi. I am currently using the trial version of elastic cloud. I have setup a watch alert which will send email daily. I have whitelisted my email address. But still, it shows execution failing. My actual mail address i… --- ## [Query two Indexes, only get results which match in both indexes](https://discuss.elastic.co/t/query-two-indexes-only-get-results-which-match-in-both-indexes/309480)
**Author:** [@manoj-manoharan](https://discuss.elastic.co/u/manoj-manoharan)\ **Replies:** 0\ **Last updated:** [July 13, 2022, 6:41am UTC](https://discuss.elastic.co/t/query-two-indexes-only-get-results-which-match-in-both-indexes/309480 "2022-07-13T06:41:07Z")
I have a use case in Elasticsearch. I want to search two indexes containing different schemas and get result which matches the query An example of what i want to achieve is here : Query Multiple Indexes, but apply queri… --- ## [How to compare data to find missing one](https://discuss.elastic.co/t/how-to-compare-data-to-find-missing-one/308924)
**Author:** [@josephLiu](https://discuss.elastic.co/u/josephLiu)\ **Replies:** 15\ **Last updated:** [July 13, 2022, 6:37am UTC](https://discuss.elastic.co/t/how-to-compare-data-to-find-missing-one/308924 "2022-07-13T06:37:31Z")
I need to use ES to realize an automatic function of detecting lost logs，Company don't want to write extra code The method is as follows： Through filebeat, log is continuously sent to two indexes from different source… --- ## [Mapper\_parsing\_Exception\\", \\"reason\\"=\>\\"failed to parse field \[service\] of type \[text\] in document](https://discuss.elastic.co/t/mapper-parsing-exception-reason-failed-to-parse-field-service-of-type-text-in-document/309476)
**Author:** [@skumarp7](https://discuss.elastic.co/u/skumarp7)\ **Replies:** 0\ **Last updated:** [July 13, 2022, 5:47am UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-failed-to-parse-field-service-of-type-text-in-document/309476 "2022-07-13T05:47:28Z")
Hi Team, Elasticsearch is throwing mapper\_parsing\_exception when we try to push logs to an index from different applications. As different applications generates logs with same field \[whose type might differ\], there are… --- ## [How many Log's supports Elasticsearch version Free](https://discuss.elastic.co/t/how-many-logs-supports-elasticsearch-version-free/309466)
**Author:** [@Javier\_Alberto\_Ameli](https://discuss.elastic.co/u/Javier_Alberto_Ameli)\ **Replies:** 1\ **Last updated:** [July 12, 2022, 11:38pm UTC](https://discuss.elastic.co/t/how-many-logs-supports-elasticsearch-version-free/309466 "2022-07-12T23:38:57Z")
How many machines sending log's simultaneously, does Elasticksearch Stack support the Free version, not licensed? --- ## [Filebeat central log server and hostname](https://discuss.elastic.co/t/filebeat-central-log-server-and-hostname/308832)
**Author:** [@parisila](https://discuss.elastic.co/u/parisila)\ **Replies:** 1\ **Last updated:** [July 12, 2022, 10:51pm UTC](https://discuss.elastic.co/t/filebeat-central-log-server-and-hostname/308832 "2022-07-12T22:51:52Z")
I have a central log server receiving all system and audit logs. The system logs all go into the same log file and have the host name in the message. I only have filebeat running on the central log server processing lo… --- ## [Elasticsearch.service failing on Debian](https://discuss.elastic.co/t/elasticsearch-service-failing-on-debian/309366)
**Author:** [@kamie](https://discuss.elastic.co/u/kamie)\ **Replies:** 21\ **Last updated:** [July 12, 2022, 9:25pm UTC](https://discuss.elastic.co/t/elasticsearch-service-failing-on-debian/309366 "2022-07-12T21:25:07Z")
My operating system is Debian 11 (Bullseye), it runs on a Pentium E5800 I've installed JDK/Java 11 (and set the path), apt-transport-https, the Elasticsearch keys and repo, and have updated my system multiple times. I'v… --- ## [Failed to filter using following grok pattern](https://discuss.elastic.co/t/failed-to-filter-using-following-grok-pattern/309116)
**Author:** [@Rao\_Nelakurti](https://discuss.elastic.co/u/Rao_Nelakurti)\ **Replies:** 2\ **Last updated:** [July 12, 2022, 8:06pm UTC](https://discuss.elastic.co/t/failed-to-filter-using-following-grok-pattern/309116 "2022-07-12T20:06:15Z")
Hi Team, I'm trying filter following log message, \[2022-07-06T20:54:20.471-0700\] \[LogLevel:INFO\] \[ServerName:xyz.vcn.com\] \[IP:10.x.x.66\]\[AppName:IoT\] \[FlowName: updateDevice\] \[ID:2022-07-06 20:54:20.471\] \[ECID:yja\_Y1eg… --- ## [Timestamp in Windows event message encoded ANSI/Windows-12 adds garbage value when converted in utf8 by winlogbeat](https://discuss.elastic.co/t/timestamp-in-windows-event-message-encoded-ansi-windows-12-adds-garbage-value-when-converted-in-utf8-by-winlogbeat/299069)
**Author:** [@Raunak17](https://discuss.elastic.co/u/Raunak17)\ **Replies:** 1\ **Last updated:** [July 12, 2022, 8:00pm UTC](https://discuss.elastic.co/t/timestamp-in-windows-event-message-encoded-ansi-windows-12-adds-garbage-value-when-converted-in-utf8-by-winlogbeat/299069 "2022-07-12T20:00:41Z")
The windows event message is below when converted to utf8, it is adding garbage value "The system time has changed to ‎2022‎-‎03‎-‎08T09:51:08.763000000Z from ‎2022‎-‎03‎-‎08T09:50:14.842044400Z.… --- ## [LogStash::Json::ParserError: Unexpected character ('(' (code 40))](https://discuss.elastic.co/t/logstash-unexpected-character-code-40/309438)
**Author:** [@John\_snow](https://discuss.elastic.co/u/John_snow)\ **Replies:** 9\ **Last updated:** [July 12, 2022, 7:59pm UTC](https://discuss.elastic.co/t/logstash-unexpected-character-code-40/309438 "2022-07-12T19:59:26Z")
I'm getting following error Error: :exception=\>#\ **Author:** [@wes.campbell](https://discuss.elastic.co/u/wes.campbell)\ **Replies:** 0\ **Last updated:** [July 12, 2022, 7:57pm UTC](https://discuss.elastic.co/t/do-applications-need-login-info-in-config-to-log-to-elasticsearch-in-7-17-and-later/309457 "2022-07-12T19:57:19Z") Do applications need login info in config to log to Elasticsearch in 7.17 and later --- ## [Dashboard / Pb with global filter](https://discuss.elastic.co/t/dashboard-pb-with-global-filter/307578)
**Author:** [@Phildefer](https://discuss.elastic.co/u/Phildefer)\ **Replies:** 3\ **Last updated:** [July 12, 2022, 7:54pm UTC](https://discuss.elastic.co/t/dashboard-pb-with-global-filter/307578 "2022-07-12T19:54:14Z")
Hi i have several questions about the filters and the controls in the dashboard : I would like to know if it is possible to disable some filters. I have a map and a table.The map and the table are linked to different i… --- ## [Downsize Elastic Cluster](https://discuss.elastic.co/t/downsize-elastic-cluster/309454)
**Author:** [@marshall99](https://discuss.elastic.co/u/marshall99)\ **Replies:** 0\ **Last updated:** [July 12, 2022, 6:44pm UTC](https://discuss.elastic.co/t/downsize-elastic-cluster/309454 "2022-07-12T18:44:10Z")
We have a 6 node elastic cluster on bare metal that was installed by way of helm 7.10.0 We are looking to downsize the cluster from 6 nodes to 3. The 3 that are being decommissioned have the master pods on them along wi… --- ## [How to force a node to become master?](https://discuss.elastic.co/t/how-to-force-a-node-to-become-master/309444)
**Author:** [@pushshift](https://discuss.elastic.co/u/pushshift)\ **Replies:** 0\ **Last updated:** [July 12, 2022, 5:44pm UTC](https://discuss.elastic.co/t/how-to-force-a-node-to-become-master/309444 "2022-07-12T17:44:47Z")
I upgrades a cluster from version 7.17.5 to 8.3.2 and I'm having issues with master discovery. The node that is set to be the master continues to log this: \[2022-07-12T17:39:00,115\]\[WARN \]\[o.e.c.c.ClusterFormationFailur… --- ## [Kibana : communication with cluster elasticsearch](https://discuss.elastic.co/t/kibana-communication-with-cluster-elasticsearch/308754)
**Author:** [@emmanuel\_stevens\_LED](https://discuss.elastic.co/u/emmanuel_stevens_LED)\ **Replies:** 2\ **Last updated:** [July 12, 2022, 5:17pm UTC](https://discuss.elastic.co/t/kibana-communication-with-cluster-elasticsearch/308754 "2022-07-12T17:17:33Z")
Hello, I am brand new to ELK, i try to make a test environnement at home. I just set up a elastic cluster, it works fine. All my three noeuds connetcts to each other. I installed a kibana server, and i follow the guid… --- ## [Using cosineSimilarity function inside aggregation scripts](https://discuss.elastic.co/t/using-cosinesimilarity-function-inside-aggregation-scripts/308046)
**Author:** [@lonewolf](https://discuss.elastic.co/u/lonewolf)\ **Replies:** 2\ **Last updated:** [July 12, 2022, 5:10pm UTC](https://discuss.elastic.co/t/using-cosinesimilarity-function-inside-aggregation-scripts/308046 "2022-07-12T17:10:16Z")
I am trying to use cosineSimilarity function inside in aggregation script but getting Unknown call \[cosine Similarity\] with \[2\] arguments { "query": { "match\_all": {} }, "aggs": { "group":… --- ## [Failed to set monitoring pipeline](https://discuss.elastic.co/t/failed-to-set-monitoring-pipeline/309346)
**Author:** [@pabloochoa](https://discuss.elastic.co/u/pabloochoa)\ **Replies:** 0\ **Last updated:** [July 11, 2022, 4:28pm UTC](https://discuss.elastic.co/t/failed-to-set-monitoring-pipeline/309346 "2022-07-11T16:28:05Z")
I am deploying ES v7.16.3 in Docker. I have been deploying ES with this version without mapping /usr/share/elasticsearch/data and haven't been getting errors, but when I have done the mapping I keep getting this errors: … --- ## [How to remove/drop entire logs after checking a condition in nested json fields](https://discuss.elastic.co/t/how-to-remove-drop-entire-logs-after-checking-a-condition-in-nested-json-fields/309322)
**Author:** [@Anusha\_Kusanghi](https://discuss.elastic.co/u/Anusha_Kusanghi)\ **Replies:** 3\ **Last updated:** [July 12, 2022, 1:43pm UTC](https://discuss.elastic.co/t/how-to-remove-drop-entire-logs-after-checking-a-condition-in-nested-json-fields/309322 "2022-07-12T13:43:46Z")
Hie , Im trying to check a condition for nested json fields and if the condition is met I want to drop the entire data , but it is not working Source: "Data" =\> \[ \[0\] { "Scales" =\> \[ \[0\] { "TaskInfos" =\> \[ \[0\] { … --- ## [ES 7.15.1 APM reporting 302 as failure](https://discuss.elastic.co/t/es-7-15-1-apm-reporting-302-as-failure/309425)
**Author:** [@Roger\_Clark](https://discuss.elastic.co/u/Roger_Clark)\ **Replies:** 0\ **Last updated:** [July 12, 2022, 1:37pm UTC](https://discuss.elastic.co/t/es-7-15-1-apm-reporting-302-as-failure/309425 "2022-07-12T13:37:28Z")
We're using a C# APM agent (Elastic.Apm 1.14.0, 1.16.1 current) in some of our code to report into an APM server on Elastic Stack, but we're seeing all of our API call responses that return a 302 (Found) as event.outcome… --- ## [Hi Wanted Some Help](https://discuss.elastic.co/t/hi-wanted-some-help/309370)
**Author:** [@Draco\_King](https://discuss.elastic.co/u/Draco_King)\ **Replies:** 6\ **Last updated:** [July 12, 2022, 1:28pm UTC](https://discuss.elastic.co/t/hi-wanted-some-help/309370 "2022-07-12T13:28:58Z")
The text about {"took":{"total":1,"successful":1,"skipped":1,"failed":1,"max\_score":1,"hits":1},"timed\_out":{"total":false,"successful":false,"skipped":false,"failed":false,"max\_score":false,"hits":false},"\_shards":{"tot… --- ## [Failed to load process information for PID 32338: readlink /proc/32338/exe: permission denied](https://discuss.elastic.co/t/failed-to-load-process-information-for-pid-32338-readlink-proc-32338-exe-permission-denied/309420)
**Author:** [@Maksym\_Postument](https://discuss.elastic.co/u/Maksym_Postument)\ **Replies:** 0\ **Last updated:** [July 12, 2022, 12:47pm UTC](https://discuss.elastic.co/t/failed-to-load-process-information-for-pid-32338-readlink-proc-32338-exe-permission-denied/309420 "2022-07-12T12:47:52Z")
Hello, i have auditbeat version 8.3.2 running in kubernetes and i am getting this kind of error all of the time failed to load process information for PID 32338: readlink /proc/32338/exe: permission denied I am using c… --- ## [Receiving org.elasticsearch.action.search.SearchPhaseExecutionException: all shards failed after 7.17.1 to 8.2.3 upgrade](https://discuss.elastic.co/t/receiving-org-elasticsearch-action-search-searchphaseexecutionexception-all-shards-failed-after-7-17-1-to-8-2-3-upgrade/309419)
**Author:** [@newlife007](https://discuss.elastic.co/u/newlife007)\ **Replies:** 0\ **Last updated:** [July 12, 2022, 12:41pm UTC](https://discuss.elastic.co/t/receiving-org-elasticsearch-action-search-searchphaseexecutionexception-all-shards-failed-after-7-17-1-to-8-2-3-upgrade/309419 "2022-07-12T12:41:47Z")
Receiving org.elasticsearch.action.search.SearchPhaseExecutionException: all shards failed after 7.17.1 to 8.2.3 upgrade. This is causing permission issues in accessing indexes in kibana and API using elastic user statin… --- ## [Logstash with Localstack Kinesis](https://discuss.elastic.co/t/logstash-with-localstack-kinesis/309410)
**Author:** [@frank\_2](https://discuss.elastic.co/u/frank_2)\ **Replies:** 0\ **Last updated:** [July 12, 2022, 11:15am UTC](https://discuss.elastic.co/t/logstash-with-localstack-kinesis/309410 "2022-07-12T11:15:56Z")
Hi, Has anyone successfully managed to run Logstash against a Localstack-provided Kinesis stream, or even just a plain kinesis-mock container? I would like very much to test Logstash configurations and throughput local… --- ## [Elastic - Extract index data based on timestamp using python library](https://discuss.elastic.co/t/elastic-extract-index-data-based-on-timestamp-using-python-library/309409)
**Author:** [@aniketdatir](https://discuss.elastic.co/u/aniketdatir)\ **Replies:** 0\ **Last updated:** [July 12, 2022, 11:15am UTC](https://discuss.elastic.co/t/elastic-extract-index-data-based-on-timestamp-using-python-library/309409 "2022-07-12T11:15:29Z")
Hi Elastic team, I want to extract index data based on timestamp using python library where I want to provide custom start time and end time. So want to extract index within start & end time. Please suggest how can I r… --- ## [I have installed fleet server and now i want to install elastic agent but it showing me error like this](https://discuss.elastic.co/t/i-have-installed-fleet-server-and-now-i-want-to-install-elastic-agent-but-it-showing-me-error-like-this/309408)
**Author:** [@Nirmal\_Unagar](https://discuss.elastic.co/u/Nirmal_Unagar)\ **Replies:** 0\ **Last updated:** [July 12, 2022, 11:10am UTC](https://discuss.elastic.co/t/i-have-installed-fleet-server-and-now-i-want-to-install-elastic-agent-but-it-showing-me-error-like-this/309408 "2022-07-12T11:10:40Z")
I have installed fleet server successfully. now i have other windows server and i have created policy for system, elastic endpoint. After downloading elastic agent, it showing me error like this and not able to connect w… --- ## [Real time data not syncing from oracle to Elasticsearch index](https://discuss.elastic.co/t/real-time-data-not-syncing-from-oracle-to-elasticsearch-index/309298)
**Author:** [@suresh\_u](https://discuss.elastic.co/u/suresh_u)\ **Replies:** 2\ **Last updated:** [July 12, 2022, 11:02am UTC](https://discuss.elastic.co/t/real-time-data-not-syncing-from-oracle-to-elasticsearch-index/309298 "2022-07-12T11:02:44Z")
Hi Team, I am using Logstash to sync data from Oracle to ES. When I update in Oracle db the same changes are not reflecting in ES. Could you please help to resolve the issue? Below is the Logstash configuration that … --- ## [Java client put logstash pipeline](https://discuss.elastic.co/t/java-client-put-logstash-pipeline/309345)
**Author:** [@Alain\_Bod](https://discuss.elastic.co/u/Alain_Bod)\ **Replies:** 1\ **Last updated:** [July 12, 2022, 10:29am UTC](https://discuss.elastic.co/t/java-client-put-logstash-pipeline/309345 "2022-07-12T10:29:04Z")
Hi, I'm using the new Java elasticsearch client to PUT a logstash pipeline. client.logstash().putPipeline(b -\> b .id(id) .pipeline(p -\> p … --- ## [Documents not getting udpated as per the pipeline](https://discuss.elastic.co/t/documents-not-getting-udpated-as-per-the-pipeline/309394)
**Author:** [@Apoorv\_Agarwal](https://discuss.elastic.co/u/Apoorv_Agarwal)\ **Replies:** 0\ **Last updated:** [July 12, 2022, 9:29am UTC](https://discuss.elastic.co/t/documents-not-getting-udpated-as-per-the-pipeline/309394 "2022-07-12T09:29:03Z")
I am using one elapsed plugin to calculate the time difference between two events, with the output sending data into a "merged" index. For some reason, at certain times, the merged index is not getting updated in real ti… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=867) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=869)