# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=874 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 875 --- ## [Java API update index](https://discuss.elastic.co/t/java-api-update-index/308928)
**Author:** [@Dorian](https://discuss.elastic.co/u/Dorian)\ **Replies:** 2\ **Last updated:** [July 6, 2022, 9:18pm UTC](https://discuss.elastic.co/t/java-api-update-index/308928 "2022-07-06T21:18:43Z")
HI everyone, I want to add a new field to a document already indexed. I find this in the documentation: curl -X POST "localhost:9200/home2/\_update/Y\_vIvoEB3cv\_8tuHzt7j?pretty" -H 'Content-Type: application/json' -d' { … --- ## [Manipulate fields in Kibana](https://discuss.elastic.co/t/manipulate-fields-in-kibana/308512)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 2\ **Last updated:** [July 6, 2022, 8:48pm UTC](https://discuss.elastic.co/t/manipulate-fields-in-kibana/308512 "2022-07-06T20:48:23Z")
Hello. We are using ELK 7.6.2 stack. Kibana console shows the fields as follows: I want to introduce/ add a new field displayed as say "sum" and it should display the sum of "before" and "after" (highlighted as yell… --- ## [Logstash isn't starting. Getting a FATAL error](https://discuss.elastic.co/t/logstash-isnt-starting-getting-a-fatal-error/309045)
**Author:** [@kakkarsachin7](https://discuss.elastic.co/u/kakkarsachin7)\ **Replies:** 6\ **Last updated:** [July 6, 2022, 8:40pm UTC](https://discuss.elastic.co/t/logstash-isnt-starting-getting-a-fatal-error/309045 "2022-07-06T20:40:00Z")
I am new to ELK stack. I am able to start Elasticsearch and Kibana but unable to start Logstash using command logstash -f logstash-studio.conf Version 7.14 Java Version 1.8 Here are the logs:- Using JAVA\_HOME defined… --- ## [How can I change my query from \_msearch to \_search using the bucket aggregation?](https://discuss.elastic.co/t/how-can-i-change-my-query-from-msearch-to-search-using-the-bucket-aggregation/309018)
**Author:** [@V\_o](https://discuss.elastic.co/u/V_o)\ **Replies:** 2\ **Last updated:** [July 6, 2022, 7:58pm UTC](https://discuss.elastic.co/t/how-can-i-change-my-query-from-msearch-to-search-using-the-bucket-aggregation/309018 "2022-07-06T19:58:37Z")
Hello, I am new to Elasticsearch. Does anybody have an idea on how to change this query from an currently \_msearch query to an \_search query? It would also be convenient if I didn't have to make a separate query for ev… --- ## [Install elasticsearch plugin in elk docker container with 'elasticsearch-plugins.yml'](https://discuss.elastic.co/t/install-elasticsearch-plugin-in-elk-docker-container-with-elasticsearch-plugins-yml/309039)
**Author:** [@ksuess](https://discuss.elastic.co/u/ksuess)\ **Replies:** 0\ **Last updated:** [July 6, 2022, 6:00pm UTC](https://discuss.elastic.co/t/install-elasticsearch-plugin-in-elk-docker-container-with-elasticsearch-plugins-yml/309039 "2022-07-06T18:00:55Z")
How do I install an elasticsearch plugin like 'ingest-attachment' in an elk docker container? The use of a configuration file like 'elasticsearch-plugins.yml' would be nice. But other suggestions are welcome. Maybe an e… --- ## [Difference between today's sales and yesterday's sales](https://discuss.elastic.co/t/difference-between-todays-sales-and-yesterdays-sales/308223)
**Author:** [@behappy\_alwayz0401](https://discuss.elastic.co/u/behappy_alwayz0401)\ **Replies:** 9\ **Last updated:** [July 6, 2022, 4:54pm UTC](https://discuss.elastic.co/t/difference-between-todays-sales-and-yesterdays-sales/308223 "2022-07-06T16:54:41Z")
We want to calculate the difference between today's sales and yesterday's sales. How can this be done with a Kibana Painless script within the Kibana user interface? Thanks.. --- ## [Broken ES 5.5.1 RPM](https://discuss.elastic.co/t/broken-es-5-5-1-rpm/309035)
**Author:** [@akasabov](https://discuss.elastic.co/u/akasabov)\ **Replies:** 0\ **Last updated:** [July 6, 2022, 4:50pm UTC](https://discuss.elastic.co/t/broken-es-5-5-1-rpm/309035 "2022-07-06T16:50:16Z")
\# dnf install --assumeyes https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.5.1.rpm Last metadata expiration check: 2:42:12 ago on Wed Jul 6 14:06:00 2022. elasticsearch-5.5.1.rpm … --- ## [Read the value from a file for a variable being used in elasticsearch plugin in input of logstash config file](https://discuss.elastic.co/t/read-the-value-from-a-file-for-a-variable-being-used-in-elasticsearch-plugin-in-input-of-logstash-config-file/309033)
**Author:** [@pooja5](https://discuss.elastic.co/u/pooja5)\ **Replies:** 1\ **Last updated:** [July 6, 2022, 4:35pm UTC](https://discuss.elastic.co/t/read-the-value-from-a-file-for-a-variable-being-used-in-elasticsearch-plugin-in-input-of-logstash-config-file/309033 "2022-07-06T16:35:15Z")
Hello! We are working on a use case where we are trying to read delta load from an elasticsearch index using the elasticsearch plugin in the logstash configuration file. We are using this elasticsearch plugin in the in… --- ## [Insert epoch time as "date" field, without converting to ISO8601 format](https://discuss.elastic.co/t/insert-epoch-time-as-date-field-without-converting-to-iso8601-format/309029)
**Author:** [@Elie](https://discuss.elastic.co/u/Elie)\ **Replies:** 1\ **Last updated:** [July 6, 2022, 4:32pm UTC](https://discuss.elastic.co/t/insert-epoch-time-as-date-field-without-converting-to-iso8601-format/309029 "2022-07-06T16:32:09Z")
Hello, I have an epoch time in the data that I am trying to parse via Logstash that I am trying to insert in a field in ES that represents the type "date". However, if i try to insert it just as it is, ES will assume th… --- ## [ElasticSearch 8 not automatically setting up SSL](https://discuss.elastic.co/t/elasticsearch-8-not-automatically-setting-up-ssl/309020)
**Author:** [@sergio.passalacqua](https://discuss.elastic.co/u/sergio.passalacqua)\ **Replies:** 1\ **Last updated:** [July 6, 2022, 4:09pm UTC](https://discuss.elastic.co/t/elasticsearch-8-not-automatically-setting-up-ssl/309020 "2022-07-06T16:09:50Z")
Very odd...the first time I ran elasticsearch, at the end it showed me what I was expecting..the elastic user password, the encrollment token and cert fingerprint. I wanted to reinstall on a new machine, and no matter … --- ## [Curator: When the disk space used by all indices exceeds a certain limit](https://discuss.elastic.co/t/curator-when-the-disk-space-used-by-all-indices-exceeds-a-certain-limit/308988)
**Author:** [@nkarthik](https://discuss.elastic.co/u/nkarthik)\ **Replies:** 1\ **Last updated:** [July 6, 2022, 4:01pm UTC](https://discuss.elastic.co/t/curator-when-the-disk-space-used-by-all-indices-exceeds-a-certain-limit/308988 "2022-07-06T16:01:00Z")
Hi, Can you please help me with the filter to be used if I need Curator to delete indices based on sized of cumulative limit on all the indices for disk usage --- ## [Elasticsearch node crashed](https://discuss.elastic.co/t/elasticsearch-node-crashed/308889)
**Author:** [@catadetest](https://discuss.elastic.co/u/catadetest)\ **Replies:** 4\ **Last updated:** [July 6, 2022, 3:32pm UTC](https://discuss.elastic.co/t/elasticsearch-node-crashed/308889 "2022-07-06T15:32:26Z")
Hello, I am new to elasticsearch and I'm trying to understand why sometimes our elasticsearch cluster breaks. We have 3 nodes in the cluster running on Ubuntu 20.04 LTS, with 8 cores CPU and 32 GB of RAM, out of which … --- ## [Winlogbeat Drop Event Processor No Longer Working After Update to v8](https://discuss.elastic.co/t/winlogbeat-drop-event-processor-no-longer-working-after-update-to-v8/309026)
**Author:** [@eafrost.cissp](https://discuss.elastic.co/u/eafrost.cissp)\ **Replies:** 0\ **Last updated:** [July 6, 2022, 3:05pm UTC](https://discuss.elastic.co/t/winlogbeat-drop-event-processor-no-longer-working-after-update-to-v8/309026 "2022-07-06T15:05:50Z")
Prior to updating my Elastic Stack to v8.2.0, the following winlogbeat drop event processor worked as expected. It only kept Windows Security log event.code 4688 events if the process.parent.name equaled cmd.exe or power… --- ## [I can't access to laoclhost:9200 it ask me username and password](https://discuss.elastic.co/t/i-cant-access-to-laoclhost-9200-it-ask-me-username-and-password/309024)
**Author:** [@Akassh\_Mathur](https://discuss.elastic.co/u/Akassh_Mathur)\ **Replies:** 1\ **Last updated:** [July 6, 2022, 3:01pm UTC](https://discuss.elastic.co/t/i-cant-access-to-laoclhost-9200-it-ask-me-username-and-password/309024 "2022-07-06T15:01:51Z")
--- ## [Kibana stopped showing logs; error failed to poll for work](https://discuss.elastic.co/t/kibana-stopped-showing-logs-error-failed-to-poll-for-work/308894)
**Author:** [@Baguette](https://discuss.elastic.co/u/Baguette)\ **Replies:** 10\ **Last updated:** [July 6, 2022, 1:43pm UTC](https://discuss.elastic.co/t/kibana-stopped-showing-logs-error-failed-to-poll-for-work/308894 "2022-07-06T13:43:48Z")
Hello there, I recently have some trouble with my ELK stack which suddently stoppend working since 2022 july 4th. With some research in the logs, i've found somehting strange : {"ecs":{"version":"8.0.0"},"@timestamp":… --- ## [8.2.3 Agent unhealthy, when "Network Packet Capture" integration is enabled in agent policy](https://discuss.elastic.co/t/8-2-3-agent-unhealthy-when-network-packet-capture-integration-is-enabled-in-agent-policy/307396)
**Author:** [@buzzdeee](https://discuss.elastic.co/u/buzzdeee)\ **Replies:** 5\ **Last updated:** [July 6, 2022, 1:35pm UTC](https://discuss.elastic.co/t/8-2-3-agent-unhealthy-when-network-packet-capture-integration-is-enabled-in-agent-policy/307396 "2022-07-06T13:35:57Z")
I created a elastic cloud trial instance yesterday, but my Windows client is unhealthy. elastic-agent status output shows: Status: FAILED Message: (no message) Applications: \* osquerybeat (HEALTHY) … --- ## [Hard drive usage for monitoring logs too high](https://discuss.elastic.co/t/hard-drive-usage-for-monitoring-logs-too-high/309017)
**Author:** [@kristofdc](https://discuss.elastic.co/u/kristofdc)\ **Replies:** 0\ **Last updated:** [July 6, 2022, 1:27pm UTC](https://discuss.elastic.co/t/hard-drive-usage-for-monitoring-logs-too-high/309017 "2022-07-06T13:27:56Z")
Our Azure Elasticsearch instance has a hard disk of 60 Gb. On our dev/acc environments, the hard disk took more than 55 Gb of space. Which resulted into a disk usage exceeded flood-stage-watermark, Kibana was not avail… --- ## [Index problem .keyword](https://discuss.elastic.co/t/index-problem-keyword/308112)
**Author:** [@AnotherGuy](https://discuss.elastic.co/u/AnotherGuy)\ **Replies:** 8\ **Last updated:** [July 6, 2022, 12:32pm UTC](https://discuss.elastic.co/t/index-problem-keyword/308112 "2022-07-06T12:32:00Z")
Hi, I go a big problem today and i don't know how to resolve it. I work on ELK 7.17.1 on the same computer and with filebeat on another computer which sends me log in live with a docker. I import my template Dashboard… --- ## [Problem with the stream log filebeat to logstash](https://discuss.elastic.co/t/problem-with-the-stream-log-filebeat-to-logstash/309007)
**Author:** [@AnotherGuy](https://discuss.elastic.co/u/AnotherGuy)\ **Replies:** 1\ **Last updated:** [July 6, 2022, 12:30pm UTC](https://discuss.elastic.co/t/problem-with-the-stream-log-filebeat-to-logstash/309007 "2022-07-06T12:30:09Z")
Okay ... I'm done i don't know how to resolv my problem with the stream log. I do the all step on the i modif my filebeat.yml like that: filebeat.inputs: - type: log enabled: true paths: - /home/epnp/epnp-d… --- ## [ELASTICSEARCH - Update the value of a field to current date](https://discuss.elastic.co/t/elasticsearch-update-the-value-of-a-field-to-current-date/308931)
**Author:** [@Miguel\_BA](https://discuss.elastic.co/u/Miguel_BA)\ **Replies:** 3\ **Last updated:** [July 6, 2022, 11:06am UTC](https://discuss.elastic.co/t/elasticsearch-update-the-value-of-a-field-to-current-date/308931 "2022-07-06T11:06:53Z")
I'm looking for a way to update the value of a field through update\_by\_query in the field: reviewed\_data in the next document: { "reviewed\_date" : "2022-07-05T09:31:04.742077702Z", "timestamp" : "2022-07… --- ## [Will Filebeat work on Rocky Linux?](https://discuss.elastic.co/t/will-filebeat-work-on-rocky-linux/308875)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 2\ **Last updated:** [July 6, 2022, 10:13am UTC](https://discuss.elastic.co/t/will-filebeat-work-on-rocky-linux/308875 "2022-07-06T10:13:21Z")
Hello, I'm looking for a way to get Filebeat to work on Rocky Linux. I have deployed Filebeat on several servers and have been collecting logs with ElasticSearch. This is the first time I would like to deploy Filebeat o… --- ## [Filter nested objects in document (very hard)](https://discuss.elastic.co/t/filter-nested-objects-in-document-very-hard/308999)
**Author:** [@hookenful](https://discuss.elastic.co/u/hookenful)\ **Replies:** 0\ **Last updated:** [July 6, 2022, 9:58am UTC](https://discuss.elastic.co/t/filter-nested-objects-in-document-very-hard/308999 "2022-07-06T09:58:26Z")
Hello there! I am trying to achieve not common thing and I am struggling with it hard. I have such document: { "\_index": "users", "\_type": "\_doc", "\_id": "07e4588c-6102-4be2-9518-cabaa40726e0", "\_score": 1, … --- ## [Elastic Agent and AWS ECS](https://discuss.elastic.co/t/elastic-agent-and-aws-ecs/308859)
**Author:** [@Nick\_Bolten](https://discuss.elastic.co/u/Nick_Bolten)\ **Replies:** 1\ **Last updated:** [July 6, 2022, 9:56am UTC](https://discuss.elastic.co/t/elastic-agent-and-aws-ecs/308859 "2022-07-06T09:56:19Z")
Hi, I am trying to find a way to use Elastic Agent to monitor containers in AWS ECS. I did not manage to find any official guide by Elastic. Just wondering if anyone have done this before or know how to achieve this. --- ## [Elasticsearch, Kibana, Snapshot and Restore, Registering a Repository, Mount point](https://discuss.elastic.co/t/elasticsearch-kibana-snapshot-and-restore-registering-a-repository-mount-point/308794)
**Author:** [@balasani\_sri](https://discuss.elastic.co/u/balasani_sri)\ **Replies:** 2\ **Last updated:** [July 6, 2022, 9:47am UTC](https://discuss.elastic.co/t/elasticsearch-kibana-snapshot-and-restore-registering-a-repository-mount-point/308794 "2022-07-06T09:47:22Z")
Hello does anyone knows how to add a folder to the default mount point to the shared file system while registering a repository for a snapshot in kibana? Basically, I can keep the path.repo: /opt/elk but it is throwing a… --- ## [Filebeat Error logstash/async.go:280 "client is not connected"](https://discuss.elastic.co/t/filebeat-error-logstash-async-go-280-client-is-not-connected/308874)
**Author:** [@Ricard-CT](https://discuss.elastic.co/u/Ricard-CT)\ **Replies:** 1\ **Last updated:** [July 6, 2022, 9:45am UTC](https://discuss.elastic.co/t/filebeat-error-logstash-async-go-280-client-is-not-connected/308874 "2022-07-06T09:45:17Z")
Hi, I have installed ELK Stack in my server and all seems to work fine, but when filebeat (installed on another server) tries to send the log to Logstash, an error appears: ERROR \[logstash\] logstash/async… --- ## [Cannot set \_id from \_source during reindex](https://discuss.elastic.co/t/cannot-set-id-from-source-during-reindex/308993)
**Author:** [@ghallas](https://discuss.elastic.co/u/ghallas)\ **Replies:** 1\ **Last updated:** [July 6, 2022, 9:13am UTC](https://discuss.elastic.co/t/cannot-set-id-from-source-during-reindex/308993 "2022-07-06T09:13:13Z")
I am trying to reindex an existing index into a new one, while modifying the document \_id in the process. My new \_id needs to be populated from one of the documents' fields. I am using the following reindex request POS… --- ## [ES cluster (single node ) in RED due to unassigned shards](https://discuss.elastic.co/t/es-cluster-single-node-in-red-due-to-unassigned-shards/308292)
**Author:** [@partha.nayak](https://discuss.elastic.co/u/partha.nayak)\ **Replies:** 7\ **Last updated:** [July 6, 2022, 9:12am UTC](https://discuss.elastic.co/t/es-cluster-single-node-in-red-due-to-unassigned-shards/308292 "2022-07-06T09:12:32Z")
ES cluster (single node ) in RED due to unassigned shards Here are some details 1) List of unassigned shards .ds-.logs-deprecation.elasticsearch-default-2022.06.07-000003 0 p UNASSIGNED CLUSTER\_RECOVERED f… --- ## [\[HAproxy\] log pipeline fails to extract http.request.method for HTTP/2.0 requests](https://discuss.elastic.co/t/haproxy-log-pipeline-fails-to-extract-http-request-method-for-http-2-0-requests/308956)
**Author:** [@Mydayyy](https://discuss.elastic.co/u/Mydayyy)\ **Replies:** 1\ **Last updated:** [July 6, 2022, 9:06am UTC](https://discuss.elastic.co/t/haproxy-log-pipeline-fails-to-extract-http-request-method-for-http-2-0-requests/308956 "2022-07-06T09:06:08Z")
Greetings, in accordance with your Github guideline, I am reporting this issue here. Please post all questions and issues on Beats - Discuss the Elastic Stack before opening a Github Issue. Your questions will reach … --- ## [Nested json field mutate string to number](https://discuss.elastic.co/t/nested-json-field-mutate-string-to-number/308991)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 0\ **Last updated:** [July 6, 2022, 8:32am UTC](https://discuss.elastic.co/t/nested-json-field-mutate-string-to-number/308991 "2022-07-06T08:32:03Z")
Hello, I'm trying to convert a nested json field from a string to an integer. But i am not getting field into Integer. field Name: events.data.custom\_attributes.txn\_total\_time\_to\_complete\_in\_sec Code: mutate {con… --- ## [Lens not running in 8.2.0](https://discuss.elastic.co/t/lens-not-running-in-8-2-0/308647)
**Author:** [@martb](https://discuss.elastic.co/u/martb)\ **Replies:** 4\ **Last updated:** [July 6, 2022, 7:47am UTC](https://discuss.elastic.co/t/lens-not-running-in-8-2-0/308647 "2022-07-06T07:47:11Z")
Hi Recently installed 8.2.0 and everything is working except Lens. You click on the create visualisation and it simply goes to a blank screen. You have the normal kibana gui wrap around, like menus etc. Nothing in the … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=873) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=875)