# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=881

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 882

---

## [Regarding Split filter in mutate](https://discuss.elastic.co/t/regarding-split-filter-in-mutate/308540)

<div class="topic-metadata">

**Author:** [@suresh\_u](https://discuss.elastic.co/u/suresh_u)\
**Replies:** 3\
**Last updated:** [June 30, 2022, 8:29am UTC](https://discuss.elastic.co/t/regarding-split-filter-in-mutate/308540 "2022-06-30T08:29:07Z")

</div>

Hi team, I have one roll number like 1071-P56790-345. First number is 1071. Remaining fields in future can be added. So I need to extract 1071 and P56790-345 into 2 seperate fields. I tried using filter by delimeter …

---

## [Elastic agent upgrade error](https://discuss.elastic.co/t/elastic-agent-upgrade-error/308250)

<div class="topic-metadata">

**Author:** [@Guncixx](https://discuss.elastic.co/u/Guncixx)\
**Replies:** 6\
**Last updated:** [June 30, 2022, 8:20am UTC](https://discuss.elastic.co/t/elastic-agent-upgrade-error/308250 "2022-06-30T08:20:06Z")

</div>

There are similar topics in forum but already closed so opening a new one. After upgrading stack from 8.1.1 to 8.2.3 we are unable to upgrade agents using fleet. When I trigger upgrade function it changes state to upgrad…

---

## [New elasticsearch-java client needs to initialize in springboot?](https://discuss.elastic.co/t/new-elasticsearch-java-client-needs-to-initialize-in-springboot/308451)

<div class="topic-metadata">

**Author:** [@the-worm](https://discuss.elastic.co/u/the-worm)\
**Replies:** 1\
**Last updated:** [June 30, 2022, 8:05am UTC](https://discuss.elastic.co/t/new-elasticsearch-java-client-needs-to-initialize-in-springboot/308451 "2022-06-30T08:05:47Z")

</div>

Do we always need to initialize elasticsearch-java to use port 9200 or other custom ports and other setings? Previous high level REST client(HLRC) does not need the initialization in springboot. You just declare it and …

---

## [Failed to download database GeoLite2-City.mmdb](https://discuss.elastic.co/t/failed-to-download-database-geolite2-city-mmdb/308491)

<div class="topic-metadata">

**Author:** [@Ravi\_S1](https://discuss.elastic.co/u/Ravi_S1)\
**Replies:** 4\
**Last updated:** [June 30, 2022, 7:54am UTC](https://discuss.elastic.co/t/failed-to-download-database-geolite2-city-mmdb/308491 "2022-06-30T07:54:21Z")

</div>

{"type": "server", "timestamp": "2022-06-29T06:19:15,707Z", "level": "ERROR", "component": "o.e.i.g.DatabaseNodeService", "cluster.name": "elasticsearch-prod", "node.name": "elasticsearch-XXXXXXXXXXXXXXXXX", "message": "…

---

## [Parse date and time to timestamp using grok pattern](https://discuss.elastic.co/t/parse-date-and-time-to-timestamp-using-grok-pattern/308481)

<div class="topic-metadata">

**Author:** [@zain.jutt](https://discuss.elastic.co/u/zain.jutt)\
**Replies:** 5\
**Last updated:** [June 30, 2022, 7:42am UTC](https://discuss.elastic.co/t/parse-date-and-time-to-timestamp-using-grok-pattern/308481 "2022-06-30T07:42:39Z")

</div>

Hi, i am trying to extract the information to timestamp from the following log event for that I tried it as 20220628 11:44:29.887 - DEBUG - Trying to connect to the target: I created the pattern this way %{YEAR}%{MONT…

---

## [Blacklisting(restricting) fields from elasticsearch query to be search](https://discuss.elastic.co/t/blacklisting-restricting-fields-from-elasticsearch-query-to-be-search/308539)

<div class="topic-metadata">

**Author:** [@deepak\_prem](https://discuss.elastic.co/u/deepak_prem)\
**Replies:** 3\
**Last updated:** [June 30, 2022, 7:32am UTC](https://discuss.elastic.co/t/blacklisting-restricting-fields-from-elasticsearch-query-to-be-search/308539 "2022-06-30T07:32:00Z")

</div>

Hi, friends am new to Elasticsearch. I want to know if I can exclude certain fields from search from Elasticsearch. To elaborate I want to ignore it from my search. It should not search that field when we specify but sho…

---

## [My use case : Joining indices?](https://discuss.elastic.co/t/my-use-case-joining-indices/308476)

<div class="topic-metadata">

**Author:** [@Vincent\_Enjalbert](https://discuss.elastic.co/u/Vincent_Enjalbert)\
**Replies:** 4\
**Last updated:** [June 30, 2022, 7:21am UTC](https://discuss.elastic.co/t/my-use-case-joining-indices/308476 "2022-06-30T07:21:45Z")

</div>

Hi there, I have an issue, and I'm considering using ES to solve it. I will try to simplify the use case at maximum (context = ecommerce) : I have currently two tables in my mysql database. One is a product table. T…

---

## [Filebeat installation using tar and configurations](https://discuss.elastic.co/t/filebeat-installation-using-tar-and-configurations/308536)

<div class="topic-metadata">

**Author:** [@navin1093](https://discuss.elastic.co/u/navin1093)\
**Replies:** 1\
**Last updated:** [June 30, 2022, 7:00am UTC](https://discuss.elastic.co/t/filebeat-installation-using-tar-and-configurations/308536 "2022-06-30T07:00:51Z")

</div>

Hi all, I installed filebeat using tar. Can I know where it is configure for the registry and config files. For example the location of below fields --path.config -- path.data -- path.logs How should i start the file…

---

## [Kibana Dashboard Integration](https://discuss.elastic.co/t/kibana-dashboard-integration/308538)

<div class="topic-metadata">

**Author:** [@Aseem\_Mangla](https://discuss.elastic.co/u/Aseem_Mangla)\
**Replies:** 2\
**Last updated:** [June 30, 2022, 6:59am UTC](https://discuss.elastic.co/t/kibana-dashboard-integration/308538 "2022-06-30T06:59:57Z")

</div>

Hi, I want to integrate the Kibana Open Search Dashboard with the front-end but facing difficulty. I did these below-mentioned steps Created and saved a dashboard. Clicked "Share" at the top Copied the iframe code fro…

---

## [Do i need to install tika myself?](https://discuss.elastic.co/t/do-i-need-to-install-tika-myself/308521)

<div class="topic-metadata">

**Author:** [@aakerbeere](https://discuss.elastic.co/u/aakerbeere)\
**Replies:** 2\
**Last updated:** [June 30, 2022, 6:39am UTC](https://discuss.elastic.co/t/do-i-need-to-install-tika-myself/308521 "2022-06-30T06:39:37Z")

</div>

I am running elasticsearch on my nextcloud instance. As of Ingest Plugins | Elasticsearch Plugins and Integrations \[8.3\] | Elastic Ingest makes use of "tika". Does installing Ingest also install tika or do i need to do …

---

## [Prevent logstash from adding additional data on output](https://discuss.elastic.co/t/prevent-logstash-from-adding-additional-data-on-output/307834)

<div class="topic-metadata">

**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\
**Replies:** 6\
**Last updated:** [June 30, 2022, 6:11am UTC](https://discuss.elastic.co/t/prevent-logstash-from-adding-additional-data-on-output/307834 "2022-06-30T06:11:12Z")

</div>

Hello, i am using the kafka output and input plugins in logstash. The log route is like this: logstash -\> kafka -\> logstash (indexing) -\> elasticsearch. logstash encodes additional data (such as file path, hostname, etc)…

---

## [Dissect failed finding my field in event](https://discuss.elastic.co/t/dissect-failed-finding-my-field-in-event/308515)

<div class="topic-metadata">

**Author:** [@vincent2mots](https://discuss.elastic.co/u/vincent2mots)\
**Replies:** 2\
**Last updated:** [June 30, 2022, 5:13am UTC](https://discuss.elastic.co/t/dissect-failed-finding-my-field-in-event/308515 "2022-06-30T05:13:22Z")

</div>

Hi experts!! I have an index mapping like this : { "talend-esb-dev-2022.06" : { "mappings" : { "properties" : { "customInfo" : { "properties" : { "camel" : { "pro…

---

## [How to change ctx.trigger.trigerred\_time to CST](https://discuss.elastic.co/t/how-to-change-ctx-trigger-trigerred-time-to-cst/308525)

<div class="topic-metadata">

**Author:** [@ABHISHEK\_NEGI](https://discuss.elastic.co/u/ABHISHEK_NEGI)\
**Replies:** 1\
**Last updated:** [June 30, 2022, 1:06am UTC](https://discuss.elastic.co/t/how-to-change-ctx-trigger-trigerred-time-to-cst/308525 "2022-06-30T01:06:51Z")

</div>

I'm passing the ctx.trigger.trigerred\_time in subject of my email in kibana watcher but it is showing time is UTC when i receive the email. how to chane it to CST?

---

## [8.2.3 Failed to parse field of type text](https://discuss.elastic.co/t/8-2-3-failed-to-parse-field-of-type-text/308168)

<div class="topic-metadata">

**Author:** [@Jack\_Park](https://discuss.elastic.co/u/Jack_Park)\
**Replies:** 12\
**Last updated:** [June 29, 2022, 11:42pm UTC](https://discuss.elastic.co/t/8-2-3-failed-to-parse-field-of-type-text/308168 "2022-06-29T23:42:48Z")

</div>

I created a gist here It could be something as trivial as the way I crafted the mappings. I've been using ES 6 for years, but migrating to 8+ brings on new adventures. The gist gives the json object I am passing in. I…

---

## [Custom time for Kibana count() formula](https://discuss.elastic.co/t/custom-time-for-kibana-count-formula/308302)

<div class="topic-metadata">

**Author:** [@ABHISHEK\_NEGI](https://discuss.elastic.co/u/ABHISHEK_NEGI)\
**Replies:** 2\
**Last updated:** [June 29, 2022, 11:25pm UTC](https://discuss.elastic.co/t/custom-time-for-kibana-count-formula/308302 "2022-06-29T23:25:08Z")

</div>

Hi, i want to set custom time range for kibana while creating bar chart. so in vertical axis i selected count --\> advance option --\> time shift but it has only assigned time. then i went to the formula section and i tr…

---

## [In what folder is the private key that corresponds to the certificate config\\certs\\http\_ca.crt?](https://discuss.elastic.co/t/in-what-folder-is-the-private-key-that-corresponds-to-the-certificate-config-certs-http-ca-crt/308488)

<div class="topic-metadata">

**Author:** [@DataStorageMuse](https://discuss.elastic.co/u/DataStorageMuse)\
**Replies:** 1\
**Last updated:** [June 29, 2022, 10:08pm UTC](https://discuss.elastic.co/t/in-what-folder-is-the-private-key-that-corresponds-to-the-certificate-config-certs-http-ca-crt/308488 "2022-06-29T22:08:40Z")

</div>

I'm trying to modify http\_ca.crt (using the command ./bin/elasticsearch-certutil http), and it asks me for the path to private key corresponding to that file: What is the path to your CA key? elasticsearch-8.2.3-window…

---

## [Is there some parse API in ES Java High Level REST Client?](https://discuss.elastic.co/t/is-there-some-parse-api-in-es-java-high-level-rest-client/308397)

<div class="topic-metadata">

**Author:** [@Bruce\_Zu](https://discuss.elastic.co/u/Bruce_Zu)\
**Replies:** 2\
**Last updated:** [June 29, 2022, 9:35pm UTC](https://discuss.elastic.co/t/is-there-some-parse-api-in-es-java-high-level-rest-client/308397 "2022-06-29T21:35:28Z")

</div>

Hi ES Java High Level REST Client team, I am using ES Java High Level REST Client 6.8.0 version. I want to know whether there is some function, like the JSON parser, to be able to covert String type query to QueryB…

---

## [Error \[ProductNotSupportedSecurityError\]: The client is unable to verify that the server is Elasticsearch due to security privileges on the server side. Some functionality may not be compatible if the server is running an unsupported product](https://discuss.elastic.co/t/error-productnotsupportedsecurityerror-the-client-is-unable-to-verify-that-the-server-is-elasticsearch-due-to-security-privileges-on-the-server-side-some-functionality-may-not-be-compatible-if-the-server-is-running-an-unsupported-product/307554)

<div class="topic-metadata">

**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\
**Replies:** 2\
**Last updated:** [June 29, 2022, 9:24pm UTC](https://discuss.elastic.co/t/error-productnotsupportedsecurityerror-the-client-is-unable-to-verify-that-the-server-is-elasticsearch-due-to-security-privileges-on-the-server-side-some-functionality-may-not-be-compatible-if-the-server-is-running-an-unsupported-product/307554 "2022-06-29T21:24:53Z")

</div>

Hello World! I'm trying to follow Install Kibana with Docker | Kibana Guide \[7.17\] | Elastic and running into following error: Error \[ProductNotSupportedSecurityError\]: The client is unable to verify that the server i…

---

## [Office365 ELK STACK integration error](https://discuss.elastic.co/t/office365-elk-stack-integration-error/308463)

<div class="topic-metadata">

**Author:** [@mkibani](https://discuss.elastic.co/u/mkibani)\
**Replies:** 0\
**Last updated:** [June 29, 2022, 11:39am UTC](https://discuss.elastic.co/t/office365-elk-stack-integration-error/308463 "2022-06-29T11:39:36Z")

</div>

hello community, My company is trying to intergrate o365 logs to the SIEM, i have configured the module o365 in filebeat however i keep getting "unable to acquire authentication token for tenant" in logs while reviewing…

---

## [Enrolling a fixed IP server to a server behind a dynamic IP address and a home router with ports forwarded](https://discuss.elastic.co/t/enrolling-a-fixed-ip-server-to-a-server-behind-a-dynamic-ip-address-and-a-home-router-with-ports-forwarded/308393)

<div class="topic-metadata">

**Author:** [@K\_st\_rs](https://discuss.elastic.co/u/K_st_rs)\
**Replies:** 3\
**Last updated:** [June 29, 2022, 9:09pm UTC](https://discuss.elastic.co/t/enrolling-a-fixed-ip-server-to-a-server-behind-a-dynamic-ip-address-and-a-home-router-with-ports-forwarded/308393 "2022-06-29T21:09:00Z")

</div>

I set up two elasticsearch nodes on two computers on my home network which is reachable from the outside via dynamic IP. They seem to see each other. Ports are open in the router Now I want to add a node on a fixed IP …

---

## [No recovered \[0\] indices into cluster\_state](https://discuss.elastic.co/t/no-recovered-0-indices-into-cluster-state/308369)

<div class="topic-metadata">

**Author:** [@jshamili](https://discuss.elastic.co/u/jshamili)\
**Replies:** 3\
**Last updated:** [June 29, 2022, 9:06pm UTC](https://discuss.elastic.co/t/no-recovered-0-indices-into-cluster-state/308369 "2022-06-29T21:06:34Z")

</div>

Can anyone help: This is a prod environment and fresh install. No issue in Dev env its totally working Es version: "name" : "cnfdoqprels01", "cluster\_name" : "bitbucketES", "cluster\_uuid" : "gdT4F-bnS0ifFam9wSOWEQ", …

---

## [Getting routing\_state failed after importing huggingface model](https://discuss.elastic.co/t/getting-routing-state-failed-after-importing-huggingface-model/308505)

<div class="topic-metadata">

**Author:** [@jyang](https://discuss.elastic.co/u/jyang)\
**Replies:** 1\
**Last updated:** [June 29, 2022, 8:15pm UTC](https://discuss.elastic.co/t/getting-routing-state-failed-after-importing-huggingface-model/308505 "2022-06-29T20:15:20Z")

</div>

I'm using elasticsearch 8.2.3, docker version locally with a free trial license. I imported this model with eland: eland\_import\_hub\_model --url http://localhost:9203 --hub-model-id sentence-transformers/distilbert-base…

---

## [Index structure suggestions](https://discuss.elastic.co/t/index-structure-suggestions/308511)

<div class="topic-metadata">

**Author:** [@Jaib](https://discuss.elastic.co/u/Jaib)\
**Replies:** 0\
**Last updated:** [June 29, 2022, 7:04pm UTC](https://discuss.elastic.co/t/index-structure-suggestions/308511 "2022-06-29T19:04:11Z")

</div>

Hi, I would like some advice on how to structure my data. I have some products, approx 37000 { "name": "product1", "sku": "sku\_1", "categories": \["cat1", "cat2"\] } I have some physical stores approx 300 { "id": …

---

## [Sending Data From Oracle to Elastic](https://discuss.elastic.co/t/sending-data-from-oracle-to-elastic/308460)

<div class="topic-metadata">

**Author:** [@Dhruvin.patel001](https://discuss.elastic.co/u/Dhruvin.patel001)\
**Replies:** 5\
**Last updated:** [June 29, 2022, 7:08pm UTC](https://discuss.elastic.co/t/sending-data-from-oracle-to-elastic/308460 "2022-06-29T19:08:47Z")

</div>

I am trying to send oracle events to Elasticsearch. In oracle DB, we have create\_date column as primary key. Here is the format of create date:- 22-JUL-19 02.22.02.918000000 PM 22-JUL-19 02.22.03.325000000 PM 22-JUL-…

---

## [Logstash: logstash-plugin install logstash-codec-protobuf, message: certificate verify failed](https://discuss.elastic.co/t/logstash-logstash-plugin-install-logstash-codec-protobuf-message-certificate-verify-failed/308504)

<div class="topic-metadata">

**Author:** [@vante](https://discuss.elastic.co/u/vante)\
**Replies:** 0\
**Last updated:** [June 29, 2022, 5:27pm UTC](https://discuss.elastic.co/t/logstash-logstash-plugin-install-logstash-codec-protobuf-message-certificate-verify-failed/308504 "2022-06-29T17:27:17Z")

</div>

Hey, i am trying to install protobuf codec plugin for my logstash but got this //ERROR: Something went wrong when installing logstash-codec-protobuf, message: certificate verify failed. Does anyone know how to go about …

---

## [Username/password prompt 8.3.0](https://discuss.elastic.co/t/username-password-prompt-8-3-0/308494)

<div class="topic-metadata">

**Author:** [@GrahamMarval](https://discuss.elastic.co/u/GrahamMarval)\
**Replies:** 2\
**Last updated:** [June 29, 2022, 4:41pm UTC](https://discuss.elastic.co/t/username-password-prompt-8-3-0/308494 "2022-06-29T16:41:09Z")

</div>

I apologise if this is the wrong place (and a daft question) but I have a question regarding ElasticSearch 8.3.0 and user password. In previous versions, once I have installed the ElasticSearch service ("elasticsearch-s…

---

## [Logstash pipeline for kafka message](https://discuss.elastic.co/t/logstash-pipeline-for-kafka-message/307413)

<div class="topic-metadata">

**Author:** [@harijld](https://discuss.elastic.co/u/harijld)\
**Replies:** 3\
**Last updated:** [June 29, 2022, 4:34pm UTC](https://discuss.elastic.co/t/logstash-pipeline-for-kafka-message/307413 "2022-06-29T16:34:25Z")

</div>

Hi Team, Need some guidance to prepare log stash pipeline for below message. I am getting below message from KAFKA topic and i need to stash it into Elasticsearch though log stash. I am able to do it but I want to inser…

---

## [Access Nested Objects using Painless for Alerting to Create Trigger Condition](https://discuss.elastic.co/t/access-nested-objects-using-painless-for-alerting-to-create-trigger-condition/308500)

<div class="topic-metadata">

**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\
**Replies:** 0\
**Last updated:** [June 29, 2022, 4:26pm UTC](https://discuss.elastic.co/t/access-nested-objects-using-painless-for-alerting-to-create-trigger-condition/308500 "2022-06-29T16:26:40Z")

</div>

I tried creating Trigger condition in Monitor.I was trying to extract fields present in \_source which is giving error "reason" : "Illegal list shortcut value \[\_source\].". DSL Extraction Query- { "size": 1, "sor…

---

## [Certificate Error When Setting Up Winlogbeat](https://discuss.elastic.co/t/certificate-error-when-setting-up-winlogbeat/308414)

<div class="topic-metadata">

**Author:** [@Jared9922](https://discuss.elastic.co/u/Jared9922)\
**Replies:** 2\
**Last updated:** [June 29, 2022, 4:07pm UTC](https://discuss.elastic.co/t/certificate-error-when-setting-up-winlogbeat/308414 "2022-06-29T16:07:00Z")

</div>

I am setting up an elastic stack for my organization and I am running into some issues. The error happens when I try to run the following command .\\winlogbeat.exe setup -e When I run that command, I get the following: …

---

## [How to calculate quantile from histogram bucket metrics?](https://discuss.elastic.co/t/how-to-calculate-quantile-from-histogram-bucket-metrics/308499)

<div class="topic-metadata">

**Author:** [@Nimit\_Batham](https://discuss.elastic.co/u/Nimit_Batham)\
**Replies:** 0\
**Last updated:** [June 29, 2022, 4:20pm UTC](https://discuss.elastic.co/t/how-to-calculate-quantile-from-histogram-bucket-metrics/308499 "2022-06-29T16:20:33Z")

</div>

How to calculate quantile from histogram bucket metrics?

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=880)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=882)
