# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=873 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 874 --- ## [Help with logstash output](https://discuss.elastic.co/t/help-with-logstash-output/309011)
**Author:** [@PJss](https://discuss.elastic.co/u/PJss)\ **Replies:** 3\ **Last updated:** [July 7, 2022, 12:03pm UTC](https://discuss.elastic.co/t/help-with-logstash-output/309011 "2022-07-07T12:03:55Z")
Hello I'm getting ELK running node in command, that i don't configure, and this string below goes to arcsight: 2022-07-04T12:50:30.046Z {name=TST-FT13} Jul 4 15:50:29 TST-FT13 sshd\[1872\]: Accepted keyboard-interactive/p… --- ## [How to integrate AWS Lambda with plugin Elastic](https://discuss.elastic.co/t/how-to-integrate-aws-lambda-with-plugin-elastic/306506)
**Author:** [@Renato\_Souza](https://discuss.elastic.co/u/Renato_Souza)\ **Replies:** 33\ **Last updated:** [July 7, 2022, 11:57am UTC](https://discuss.elastic.co/t/how-to-integrate-aws-lambda-with-plugin-elastic/306506 "2022-07-07T11:57:37Z")
I am using functions beat to get logs from aws lambda (cloudwatch). But, i know exists an integration ready for AWS Lambda at Browse all integrations in cloud Elastic. I don't find documentation how to use this integrati… --- ## [How to get values from a bucket using the key(s) of that bucket instead of the index - elasticsearch bucket aggregation - watcher?](https://discuss.elastic.co/t/how-to-get-values-from-a-bucket-using-the-key-s-of-that-bucket-instead-of-the-index-elasticsearch-bucket-aggregation-watcher/309107)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 0\ **Last updated:** [July 7, 2022, 11:54am UTC](https://discuss.elastic.co/t/how-to-get-values-from-a-bucket-using-the-key-s-of-that-bucket-instead-of-the-index-elasticsearch-bucket-aggregation-watcher/309107 "2022-07-07T11:54:19Z")
Hi team, I have the below aggregation search query. "aggregations" : { "test\_groups" : { "doc\_count\_error\_upper\_bound" : 0, "sum\_other\_doc\_count" : 0, "buckets" : \[ { "key" : "… --- ## [ElasticSearch Grok Filter](https://discuss.elastic.co/t/elasticsearch-grok-filter/308295)
**Author:** [@HKN\_MZ](https://discuss.elastic.co/u/HKN_MZ)\ **Replies:** 4\ **Last updated:** [July 7, 2022, 11:10am UTC](https://discuss.elastic.co/t/elasticsearch-grok-filter/308295 "2022-07-07T11:10:03Z")
Hi Everyone, I try to apply grok filter for my logs. As you see I am getting some of them. But I don't get first.jobId=0 or first.applicationname=POLY2 How can I get these fields? --- ## [Issue in extracting all available data in index in elastic using python library elasticsearch](https://discuss.elastic.co/t/issue-in-extracting-all-available-data-in-index-in-elastic-using-python-library-elasticsearch/308470)
**Author:** [@aniketdatir](https://discuss.elastic.co/u/aniketdatir)\ **Replies:** 5\ **Last updated:** [July 7, 2022, 10:56am UTC](https://discuss.elastic.co/t/issue-in-extracting-all-available-data-in-index-in-elastic-using-python-library-elasticsearch/308470 "2022-07-07T10:56:10Z")
Hi, I am facing below issue. I want to extract full dump that is all available documents from index "X" using python code and save it to json file. But currently M able to extract few documents only using below command.… --- ## [Zabbix + Logstash = Field referenced by ... is missing](https://discuss.elastic.co/t/zabbix-logstash-field-referenced-by-is-missing/309100)
**Author:** [@voidx](https://discuss.elastic.co/u/voidx)\ **Replies:** 0\ **Last updated:** [July 7, 2022, 10:50am UTC](https://discuss.elastic.co/t/zabbix-logstash-field-referenced-by-is-missing/309100 "2022-07-07T10:50:29Z")
I'm trying to configure sending messages from the log to Zabbix, I ran into this problem. When running Logstash, there are a bunch of errors of this type in the log \[logstash.outputs.zabbix\]\[main\]\[2ef3e6f6411863c21dc15… --- ## [Index Rollover not working after reaching maxday](https://discuss.elastic.co/t/index-rollover-not-working-after-reaching-maxday/309066)
**Author:** [@jacky7788](https://discuss.elastic.co/u/jacky7788)\ **Replies:** 7\ **Last updated:** [July 7, 2022, 10:22am UTC](https://discuss.elastic.co/t/index-rollover-not-working-after-reaching-maxday/309066 "2022-07-07T10:22:18Z")
Not able to rollover after 1 day I have set parse\_origination\_date to true the index is like access-log-appname-2022.07.06-000001 { "policy":{ "phases":{ "hot":{ "min\_age":"0ms", "actions… --- ## [Logstash filter is not working ...kindly help](https://discuss.elastic.co/t/logstash-filter-is-not-working-kindly-help/306306)
**Author:** [@aniketdatir](https://discuss.elastic.co/u/aniketdatir)\ **Replies:** 11\ **Last updated:** [July 7, 2022, 10:20am UTC](https://discuss.elastic.co/t/logstash-filter-is-not-working-kindly-help/306306 "2022-07-07T10:20:18Z")
Hi, Need your help I've bunch of messages if kafka. few samples are given below. {"processId":40,"parentProcessId":40,"type":"Info","service":"a-b-c","object":"common\_factory","method":"listUsers","log":"Start listUs… --- ## [Elastalert create index error](https://discuss.elastic.co/t/elastalert-create-index-error/308947)
**Author:** [@tharunkumar](https://discuss.elastic.co/u/tharunkumar)\ **Replies:** 1\ **Last updated:** [July 7, 2022, 9:31am UTC](https://discuss.elastic.co/t/elastalert-create-index-error/308947 "2022-07-07T09:31:16Z")
I have instaled elasticsearch kibana elastalert, when i try to run elastalert-create-index command i am facing this issue. should i run the command from an particular directory ? C:\\Windows\\system32\>elastalert-create-i… --- ## [Search Api doesn't give result of analytics clicks](https://discuss.elastic.co/t/search-api-doesnt-give-result-of-analytics-clicks/309089)
**Author:** [@bilal.shahid](https://discuss.elastic.co/u/bilal.shahid)\ **Replies:** 0\ **Last updated:** [July 7, 2022, 8:55am UTC](https://discuss.elastic.co/t/search-api-doesnt-give-result-of-analytics-clicks/309089 "2022-07-07T08:55:05Z")
I have a table of Search Terms in Analytics of ElasticSearch with the columns of document\_ids of their products, Analytics tags, and clicks. I am searching the query on Postman using Search API of Elasticsearch to get th… --- ## [How to get index rollover last digit](https://discuss.elastic.co/t/how-to-get-index-rollover-last-digit/309010)
**Author:** [@Robina\_Dhingra1](https://discuss.elastic.co/u/Robina_Dhingra1)\ **Replies:** 10\ **Last updated:** [July 7, 2022, 8:47am UTC](https://discuss.elastic.co/t/how-to-get-index-rollover-last-digit/309010 "2022-07-07T08:47:24Z")
Hello team ES, In our project, we have a datename index. Index is using a policy that rolls over daily. Sometimes, we might need to update documents in rolled over indices. For that we have a pipeline, that figures out… --- ## [Kibana index .kibana\_task\_manager goes unassigned after few days and cause Red cluster health](https://discuss.elastic.co/t/kibana-index-kibana-task-manager-goes-unassigned-after-few-days-and-cause-red-cluster-health/309028)
**Author:** [@AaronSarkissian](https://discuss.elastic.co/u/AaronSarkissian)\ **Replies:** 2\ **Last updated:** [July 7, 2022, 8:37am UTC](https://discuss.elastic.co/t/kibana-index-kibana-task-manager-goes-unassigned-after-few-days-and-cause-red-cluster-health/309028 "2022-07-07T08:37:44Z")
I'm setting up a cluster on Azure using ECK. The specifications are following: ECK version: 2.2, 2.3 (tried both) Elastic version: 8.0, 8.1.0, 8.2.0, 8.3.1 (tried all versions) K8s version: 1.23.5 Node size: Standard… --- ## [Transform exception stop and expect auto restart](https://discuss.elastic.co/t/transform-exception-stop-and-expect-auto-restart/309069)
**Author:** [@yitiao\_feiyu](https://discuss.elastic.co/u/yitiao_feiyu)\ **Replies:** 1\ **Last updated:** [July 7, 2022, 8:27am UTC](https://discuss.elastic.co/t/transform-exception-stop-and-expect-auto-restart/309069 "2022-07-07T08:27:18Z")
I use transform to filter and move index data. the transforom task run smoothly in nomal status. but in some case, I try to change the index setting e.g. set "number\_of\_replicas" : 0, the transtorm got exception and sto… --- ## [Docker fleet server binding error](https://discuss.elastic.co/t/docker-fleet-server-binding-error/309086)
**Author:** [@swchandu](https://discuss.elastic.co/u/swchandu)\ **Replies:** 0\ **Last updated:** [July 7, 2022, 7:58am UTC](https://discuss.elastic.co/t/docker-fleet-server-binding-error/309086 "2022-07-07T07:58:53Z")
Hi, I am using containerized fleet server on another machine and getting the following error. \[elastic\_agent\]\[error\] 2022-07-07T07:24:31Z - message: Application: fleet-server--8.3.0\[68af02f0-da42-4b33-b6e0-5264fcf0d72e… --- ## [Can search\_as\_you\_type field show the prefix match results firstly](https://discuss.elastic.co/t/can-search-as-you-type-field-show-the-prefix-match-results-firstly/309083)
**Author:** [@zhengpq](https://discuss.elastic.co/u/zhengpq)\ **Replies:** 0\ **Last updated:** [July 7, 2022, 7:29am UTC](https://discuss.elastic.co/t/can-search-as-you-type-field-show-the-prefix-match-results-firstly/309083 "2022-07-07T07:29:47Z")
i am using the search\_as\_you\_type to auto complete, it is good, but i find the result is sorted by the score, now i need the prefix match results to come firstly, look the example blow: POST page-new/\_search { "\_sour… --- ## [How to send multiple email attachments to multiple recipients from single watcher](https://discuss.elastic.co/t/how-to-send-multiple-email-attachments-to-multiple-recipients-from-single-watcher/309009)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 1\ **Last updated:** [July 7, 2022, 7:07am UTC](https://discuss.elastic.co/t/how-to-send-multiple-email-attachments-to-multiple-recipients-from-single-watcher/309009 "2022-07-07T07:07:06Z")
Hi, The objective is to send multiple email attachments to multiple groups of recipients from a single watcher script. I want to achieve the below but getting error. "actions": { "email\_admin": { "email": {… --- ## [Edge-ngram not working for single edge case!](https://discuss.elastic.co/t/edge-ngram-not-working-for-single-edge-case/309059)
**Author:** [@corndog](https://discuss.elastic.co/u/corndog)\ **Replies:** 1\ **Last updated:** [July 7, 2022, 7:06am UTC](https://discuss.elastic.co/t/edge-ngram-not-working-for-single-edge-case/309059 "2022-07-07T07:06:49Z")
My edge-ngram solution does not return any results for the following search: "10th A" Where 3 documents exist with the field values: "10th Avenue, Red Beach, New Zealand", "4 10th Avenue, Red Beach, New Zealand", … --- ## [Sorting on nested field and then apply aggregation](https://discuss.elastic.co/t/sorting-on-nested-field-and-then-apply-aggregation/309078)
**Author:** [@aryamansingh888](https://discuss.elastic.co/u/aryamansingh888)\ **Replies:** 0\ **Last updated:** [July 7, 2022, 6:34am UTC](https://discuss.elastic.co/t/sorting-on-nested-field-and-then-apply-aggregation/309078 "2022-07-07T06:34:19Z")
"visitor\_data": \[ { "end\_date": "2021-06-08", "pre\_status": "1", "evisitor": true, "edition\_id": "644659", "flag": "1", "event\_functionality": "o… --- ## [Format issue using http output plugin to send logs from logstash to azure eventhub](https://discuss.elastic.co/t/format-issue-using-http-output-plugin-to-send-logs-from-logstash-to-azure-eventhub/309073)
**Author:** [@Shakib\_farooq](https://discuss.elastic.co/u/Shakib_farooq)\ **Replies:** 1\ **Last updated:** [July 7, 2022, 6:02am UTC](https://discuss.elastic.co/t/format-issue-using-http-output-plugin-to-send-logs-from-logstash-to-azure-eventhub/309073 "2022-07-07T06:02:02Z")
Hello, I am facing an issue in forwarding logs from logstash to the event hub, below is the conf file. the requirement is to forward winlog beats logs to the event hub. I am receiving logs in elastic if I kept the form… --- ## [Send an email when Logstash service is down/not running](https://discuss.elastic.co/t/send-an-email-when-logstash-service-is-down-not-running/309068)
**Author:** [@suresh\_u](https://discuss.elastic.co/u/suresh_u)\ **Replies:** 2\ **Last updated:** [July 7, 2022, 5:56am UTC](https://discuss.elastic.co/t/send-an-email-when-logstash-service-is-down-not-running/309068 "2022-07-07T05:56:33Z")
Hi team, I have run Logstash as a service in Remote windows. It is working fine now. But in case of failure scenario, If Logstash service shuts down unexpectedly, then I need to send(alert) an email to the team. How c… --- ## [Create simulated data for ingestion using Rally](https://discuss.elastic.co/t/create-simulated-data-for-ingestion-using-rally/308392)
**Author:** [@lance.zukel](https://discuss.elastic.co/u/lance.zukel)\ **Replies:** 8\ **Last updated:** [July 7, 2022, 3:14am UTC](https://discuss.elastic.co/t/create-simulated-data-for-ingestion-using-rally/308392 "2022-07-07T03:14:53Z")
I would like to be able to perform the following: Have a sample templated document for ingestion Have a custom class that randomizes data to be inserted into the templated document Be able to specify the number of docu… --- ## [Cannot use scripted field in Elasticsearch query?](https://discuss.elastic.co/t/cannot-use-scripted-field-in-elasticsearch-query/309040)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [July 7, 2022, 2:41am UTC](https://discuss.elastic.co/t/cannot-use-scripted-field-in-elasticsearch-query/309040 "2022-07-07T02:41:11Z")
Hi all, I'm using a scripted field, but I'm unable to query with scripted field. Anyway we can use scripted field in elasticsearch? For ex if I query below in dev tools it always gives count as 0: GET my\_index\_\*/\_sea… --- ## [Node Not Showing in Kibana](https://discuss.elastic.co/t/node-not-showing-in-kibana/309027)
**Author:** [@bkamiche](https://discuss.elastic.co/u/bkamiche)\ **Replies:** 1\ **Last updated:** [July 7, 2022, 2:04am UTC](https://discuss.elastic.co/t/node-not-showing-in-kibana/309027 "2022-07-07T02:04:50Z")
I have a 9 node Cluster (6 data and 3 Masters), with version 7.15.5 (all on Intel platform), the cluster works fine. I've added a new data node, with the same version but in ARM, the node has been recognized by the clus… --- ## [Metricbeat monitoring logstash via kubernetes service endpoint issues](https://discuss.elastic.co/t/metricbeat-monitoring-logstash-via-kubernetes-service-endpoint-issues/309064)
**Author:** [@aaronpjak](https://discuss.elastic.co/u/aaronpjak)\ **Replies:** 0\ **Last updated:** [July 7, 2022, 1:59am UTC](https://discuss.elastic.co/t/metricbeat-monitoring-logstash-via-kubernetes-service-endpoint-issues/309064 "2022-07-07T01:59:18Z")
Hi, I am trying to use metricbeat to monitor my logstash instances. I have logstash deployed using the official helm chart and I am running multiple logstash pods behind the kubernetes service. When I use the service en… --- ## [Block 32844 not found](https://discuss.elastic.co/t/block-32844-not-found/308873)
**Author:** [@zhilong](https://discuss.elastic.co/u/zhilong)\ **Replies:** 5\ **Last updated:** [July 7, 2022, 1:41am UTC](https://discuss.elastic.co/t/block-32844-not-found/308873 "2022-07-07T01:41:31Z")
This category relates to the Enterprise Search set of products - App Search, Site Search and Workplace Search. If your question relates to core Elasticsearch functionality, please head over to the #elastic-stack:elastic… --- ## [Error deserializing Phrase Suggester - Java API Client](https://discuss.elastic.co/t/error-deserializing-phrase-suggester-java-api-client/309058)
**Author:** [@RabBit\_BR](https://discuss.elastic.co/u/RabBit_BR)\ **Replies:** 0\ **Last updated:** [July 7, 2022, 12:17am UTC](https://discuss.elastic.co/t/error-deserializing-phrase-suggester-java-api-client/309058 "2022-07-07T00:17:01Z")
Hi everyone. I'm implementing the Phrase Suggester in the Java API Client, the error below occurs: \[Request processing failed; nested exception is co.elastic.clients.json.JsonpMappingException: Error deserializing co.e… --- ## [Http input logstash I want filter logs](https://discuss.elastic.co/t/http-input-logstash-i-want-filter-logs/307724)
**Author:** [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\ **Replies:** 1\ **Last updated:** [July 6, 2022, 11:37pm UTC](https://discuss.elastic.co/t/http-input-logstash-i-want-filter-logs/307724 "2022-07-06T23:37:12Z")
Hello Everyone I am using http input plugin in logstash I want to filter only POST request from Perticular URL logs should be input and output to elasticsearch how can I achive this. --- ## [Windows elastic-agent-8.2.3-windows-x86\_64](https://discuss.elastic.co/t/windows-elastic-agent-8-2-3-windows-x86-64/309056)
**Author:** [@mluer](https://discuss.elastic.co/u/mluer)\ **Replies:** 0\ **Last updated:** [July 6, 2022, 11:19pm UTC](https://discuss.elastic.co/t/windows-elastic-agent-8-2-3-windows-x86-64/309056 "2022-07-06T23:19:14Z")
I installed a previous version of this agent without issue. This agent has a problem with the installer and it creates an Agent Folder and copies the files, then creates another agent folder inside this one and copies i… --- ## [Auditd ingest pipeline with forwarded logs](https://discuss.elastic.co/t/auditd-ingest-pipeline-with-forwarded-logs/309054)
**Author:** [@parisila](https://discuss.elastic.co/u/parisila)\ **Replies:** 0\ **Last updated:** [July 6, 2022, 10:23pm UTC](https://discuss.elastic.co/t/auditd-ingest-pipeline-with-forwarded-logs/309054 "2022-07-06T22:23:37Z")
I have a central log server where all my audit logs are sent via rsyslog. I was running into an issue where the standard auditd ingest pipeline didn't properly parse the audit log because when it is sent from a remote h… --- ## [Error while starting logstash 8.3.1](https://discuss.elastic.co/t/error-while-starting-logstash-8-3-1/308811)
**Author:** [@Thuunder7](https://discuss.elastic.co/u/Thuunder7)\ **Replies:** 2\ **Last updated:** [July 6, 2022, 10:01pm UTC](https://discuss.elastic.co/t/error-while-starting-logstash-8-3-1/308811 "2022-07-06T22:01:21Z")
Hello guys, Recently i upgraded my logstash instance from 7.x to 8.3.1. But now when i try to start the logstash service, i get the following log: \[ERROR\]\[logstash.runner \] Logging configuration uses Script … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=872) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=874)