# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=890 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 891 --- ## [Update data in Elastic with Filebeats](https://discuss.elastic.co/t/update-data-in-elastic-with-filebeats/308019)
**Author:** [@Worlock](https://discuss.elastic.co/u/Worlock)\ **Replies:** 0\ **Last updated:** [June 23, 2022, 1:48pm UTC](https://discuss.elastic.co/t/update-data-in-elastic-with-filebeats/308019 "2022-06-23T13:48:45Z")
I have some data from our Monitoring tool that is uploaded to Elastic with Filebeats. When the monitoring alert is closed, I get a new entry with "Resolution state: Closed" I would like to update the Resolution state in … --- ## [Logstash http\_poller input body](https://discuss.elastic.co/t/logstash-http-poller-input-body/308034)
**Author:** [@mfrg85](https://discuss.elastic.co/u/mfrg85)\ **Replies:** 0\ **Last updated:** [June 23, 2022, 3:15pm UTC](https://discuss.elastic.co/t/logstash-http-poller-input-body/308034 "2022-06-23T15:15:15Z")
I'm trying to POST to an external API that requires authorization headers and a query. Here is the configuration that I have so far and the error that I am receiving. I'm not sure if the body portion of the config is for… --- ## [How to Improve ELK Performance](https://discuss.elastic.co/t/how-to-improve-elk-performance/307092)
**Author:** [@truptir](https://discuss.elastic.co/u/truptir)\ **Replies:** 8\ **Last updated:** [June 23, 2022, 3:07pm UTC](https://discuss.elastic.co/t/how-to-improve-elk-performance/307092 "2022-06-23T15:07:44Z")
Hi Team, My flow is, JSON Logs files will be processed from FileBeat \> Logstash \> Elasticsearch. But it skips some data. In thread\_pool It shows below many rejected write requests. node-1 write 0 0 0 … --- ## [Setting mapping limits using java api in 8.2 fails due to wrong config name creation](https://discuss.elastic.co/t/setting-mapping-limits-using-java-api-in-8-2-fails-due-to-wrong-config-name-creation/305107)
**Author:** [@Rodrigo\_Kapobel](https://discuss.elastic.co/u/Rodrigo_Kapobel)\ **Replies:** 2\ **Last updated:** [June 23, 2022, 2:24pm UTC](https://discuss.elastic.co/t/setting-mapping-limits-using-java-api-in-8-2-fails-due-to-wrong-config-name-creation/305107 "2022-06-23T14:24:37Z")
Hi, I'm currently using the new version of java api 8.2 with also ES 8.2 in a dockerized instance. I'm creating indexes through the API and using IndexSettings to add custom setting. One of them is the total fields limi… --- ## [Missing documents during bulk insert](https://discuss.elastic.co/t/missing-documents-during-bulk-insert/307802)
**Author:** [@EsraKahraman](https://discuss.elastic.co/u/EsraKahraman)\ **Replies:** 4\ **Last updated:** [June 23, 2022, 2:02pm UTC](https://discuss.elastic.co/t/missing-documents-during-bulk-insert/307802 "2022-06-23T14:02:29Z")
Hi there, I am using bulk API to load data in Elasticsearch. I need to load millions of documents to an elastic index; my ETL job breaks the whole set down to 10K record chunks. And then, it splits each chunk into the JS… --- ## [Deprecation.logstash.codecs.plain](https://discuss.elastic.co/t/deprecation-logstash-codecs-plain/308005)
**Author:** [@Stevenpoot](https://discuss.elastic.co/u/Stevenpoot)\ **Replies:** 1\ **Last updated:** [June 23, 2022, 1:59pm UTC](https://discuss.elastic.co/t/deprecation-logstash-codecs-plain/308005 "2022-06-23T13:59:23Z")
How do I solve this. Logstash is working but the message is repeating all the time \[deprecation.logstash.codecs.plain\] Relying on default value of pipeline.ecs\_compatibility, which may change in a future maj or release … --- ## [Awsfargate metricbeat module not working?](https://discuss.elastic.co/t/awsfargate-metricbeat-module-not-working/307990)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 1\ **Last updated:** [June 23, 2022, 1:59pm UTC](https://discuss.elastic.co/t/awsfargate-metricbeat-module-not-working/307990 "2022-06-23T13:59:20Z")
I've declared a metricbeat container in an AWS ECS task definition so that it runs as a "sidecar" container to my main application and uses the awsfargate module to index task stats (CPU, memory etc) into my monitoring c… --- ## [NOT Queries documents returning no highlight fragment](https://discuss.elastic.co/t/not-queries-documents-returning-no-highlight-fragment/308016)
**Author:** [@jcmiron](https://discuss.elastic.co/u/jcmiron)\ **Replies:** 4\ **Last updated:** [June 23, 2022, 1:46pm UTC](https://discuss.elastic.co/t/not-queries-documents-returning-no-highlight-fragment/308016 "2022-06-23T13:46:58Z")
If I do a query like "NOT (CANADA)" or something like that it'll return the documents that don't include that word in it, but not return any highlight fragment. Is this the default behavior for a query like that? --- ## [Filter dashboard based on bounds drawn on chloropleth map](https://discuss.elastic.co/t/filter-dashboard-based-on-bounds-drawn-on-chloropleth-map/307978)
**Author:** [@NiklasHBB](https://discuss.elastic.co/u/NiklasHBB)\ **Replies:** 2\ **Last updated:** [June 23, 2022, 1:45pm UTC](https://discuss.elastic.co/t/filter-dashboard-based-on-bounds-drawn-on-chloropleth-map/307978 "2022-06-23T13:45:43Z")
I have followed the reverse geocoding example and the basics work great using Kibana 7.16. I have left the 'apply global search to layer data' option turned off so that the map updates when I filter observations in a das… --- ## [Office 365 Logs - Struggling to get data in](https://discuss.elastic.co/t/office-365-logs-struggling-to-get-data-in/308015)
**Author:** [@rosssymons](https://discuss.elastic.co/u/rosssymons)\ **Replies:** 0\ **Last updated:** [June 23, 2022, 1:32pm UTC](https://discuss.elastic.co/t/office-365-logs-struggling-to-get-data-in/308015 "2022-06-23T13:32:01Z")
I've configured the Office 365 Logs integration but I'm struggling to get the data in. In my logs I'm seeing these lines: I'm not sure what 'currently in use, waiting...' is in reference to. I think all my config is… --- ## [Not able to download track](https://discuss.elastic.co/t/not-able-to-download-track/305712)
**Author:** [@amitsa](https://discuss.elastic.co/u/amitsa)\ **Replies:** 10\ **Last updated:** [June 23, 2022, 1:15pm UTC](https://discuss.elastic.co/t/not-able-to-download-track/305712 "2022-06-23T13:15:59Z")
Hi i am using below script to download track https://raw.githubusercontent.com/elastic/rally-tracks/master/download.sh i am able to download tracks on ubuntu 20.04 Cloning into '/home/user/.rally/benchmarks/tracks/def… --- ## [Unable to verify that the server is ElasticSearch due to unsuccesful product check call](https://discuss.elastic.co/t/unable-to-verify-that-the-server-is-elasticsearch-due-to-unsuccesful-product-check-call/308000)
**Author:** [@charlot\_Attard](https://discuss.elastic.co/u/charlot_Attard)\ **Replies:** 2\ **Last updated:** [June 23, 2022, 1:20pm UTC](https://discuss.elastic.co/t/unable-to-verify-that-the-server-is-elasticsearch-due-to-unsuccesful-product-check-call/308000 "2022-06-23T13:20:31Z")
Hello, We have an application connecting with NEST to ES Version 7.17. Intermitently we are facing this issue Unable to verify that the server is ElasticSearch due to unsuccesful product check call. Some functionality … --- ## [Enable debug logging on metricbeat using a docker CMD](https://discuss.elastic.co/t/enable-debug-logging-on-metricbeat-using-a-docker-cmd/308006)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 1\ **Last updated:** [June 23, 2022, 1:07pm UTC](https://discuss.elastic.co/t/enable-debug-logging-on-metricbeat-using-a-docker-cmd/308006 "2022-06-23T13:07:40Z")
If I'm running metricbeat in docker, how can I enable debug logging? So far I've tried ./metricbeat setup -E logging.level="debug" && ./metricbeat ./metricbeat -d "\*" but I can't get it to work. I'm expecting the lo… --- ## [Defined time for custom action interval](https://discuss.elastic.co/t/defined-time-for-custom-action-interval/308011)
**Author:** [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\ **Replies:** 0\ **Last updated:** [June 23, 2022, 12:48pm UTC](https://discuss.elastic.co/t/defined-time-for-custom-action-interval/308011 "2022-06-23T12:48:43Z")
Hi all, We are ingesting application errors into Elasticsearch and created an alert for that which sends an email to the administrators. We use an Elasticsearch query and run the check every hour but configured the aler… --- ## [Logstash parse multiline logging](https://discuss.elastic.co/t/logstash-parse-multiline-logging/307995)
**Author:** [@Ceesz](https://discuss.elastic.co/u/Ceesz)\ **Replies:** 1\ **Last updated:** [June 23, 2022, 12:36pm UTC](https://discuss.elastic.co/t/logstash-parse-multiline-logging/307995 "2022-06-23T12:36:43Z")
Hi all, I am trying to parse the following log file with multi-log lines: Benutzerkennung: test1 Uhrzeit: 20:53:54 14.05.2022 Version: Microsoft Dynamics AX 6.2 (Erstellungsnummer 3000.5768) Datenbank: Microsoft SQL Se… --- ## [Empty output when extracting field](https://discuss.elastic.co/t/empty-output-when-extracting-field/307514)
**Author:** [@sigizmynd](https://discuss.elastic.co/u/sigizmynd)\ **Replies:** 6\ **Last updated:** [June 23, 2022, 12:24pm UTC](https://discuss.elastic.co/t/empty-output-when-extracting-field/307514 "2022-06-23T12:24:17Z")
Hello I want to extract some value from my log: { "\_index": ".ds-filebeat-8.2.2-2022.06.14-000002", "\_id": "veGbcYEBr3mqBf4wJF1j", "\_version": 1, "\_score": null, "fields": { "host.os.name.text": \[ "AlmaLinux" \]… --- ## [Received an event that has a different character encoding from DLP software](https://discuss.elastic.co/t/received-an-event-that-has-a-different-character-encoding-from-dlp-software/308004)
**Author:** [@Stevenpoot](https://discuss.elastic.co/u/Stevenpoot)\ **Replies:** 0\ **Last updated:** [June 23, 2022, 12:11pm UTC](https://discuss.elastic.co/t/received-an-event-that-has-a-different-character-encoding-from-dlp-software/308004 "2022-06-23T12:11:08Z")
{:text=\>"\\u0000\\x FF\\u0001\\u0000\\u0000$\\u0000\\r\\u0000 \\u0000\\u001E\\u0006\\u0001\\u0006\\ u0002\\u0006\\u0003\\u0005\\u0001\\u0005\\u0002\\u0005\\u0003\\u0004\\u0001\\u0 004\\u0002\\u0004\\u0003\\u0003\\u0001\\u0003\\u0002\\u0003\\u0003\\u0002\\u… --- ## [LDAP Elasticserch without license](https://discuss.elastic.co/t/ldap-elasticserch-without-license/307917)
**Author:** [@diegoneto](https://discuss.elastic.co/u/diegoneto)\ **Replies:** 2\ **Last updated:** [June 23, 2022, 11:56am UTC](https://discuss.elastic.co/t/ldap-elasticserch-without-license/307917 "2022-06-23T11:56:30Z")
Hello guys. Good evening! Configure an Elasticsearch Cluster with a basic license. However, I would like to authenticate via LDAP. Is doing this setup with the basic license possible? It would also accept login via SSO… --- ## [Use threshold on minimum number of observations for showing data on chloropleth map](https://discuss.elastic.co/t/use-threshold-on-minimum-number-of-observations-for-showing-data-on-chloropleth-map/307980)
**Author:** [@NiklasHBB](https://discuss.elastic.co/u/NiklasHBB)\ **Replies:** 1\ **Last updated:** [June 23, 2022, 11:35am UTC](https://discuss.elastic.co/t/use-threshold-on-minimum-number-of-observations-for-showing-data-on-chloropleth-map/307980 "2022-06-23T11:35:58Z")
I have followed the reverse geocoding example and the basics work great using Kibana 7.16. I have left the 'apply global search to layer data' option turned off so that the map updates when I filter observations in a das… --- ## [Complex Proximity/Nested/exact-match Queries in Elasticsearch](https://discuss.elastic.co/t/complex-proximity-nested-exact-match-queries-in-elasticsearch/307998)
**Author:** [@jaivikram](https://discuss.elastic.co/u/jaivikram)\ **Replies:** 0\ **Last updated:** [June 23, 2022, 11:33am UTC](https://discuss.elastic.co/t/complex-proximity-nested-exact-match-queries-in-elasticsearch/307998 "2022-06-23T11:33:34Z")
I am looking for proximity (and nested proximity as well) between multiple hetrogeneous groups By hetrogeneous I mean the token in the groups can be: term and term term and phrase phrase and phrase term and wildcard p… --- ## [Collapse, Term Aggregation, Grouping](https://discuss.elastic.co/t/collapse-term-aggregation-grouping/307993)
**Author:** [@dev\_test](https://discuss.elastic.co/u/dev_test)\ **Replies:** 0\ **Last updated:** [June 23, 2022, 11:01am UTC](https://discuss.elastic.co/t/collapse-term-aggregation-grouping/307993 "2022-06-23T11:01:33Z")
Hi there, I am using elasticsearch 7.17 and trying to group result on some field Here is the query which i am trying to run GET content-data/\_search { "\_source": false, "query": { "bool": { "should": \[ … --- ## [Elasticsearch not starting](https://discuss.elastic.co/t/elasticsearch-not-starting/307984)
**Author:** [@Ram3](https://discuss.elastic.co/u/Ram3)\ **Replies:** 2\ **Last updated:** [June 23, 2022, 10:59am UTC](https://discuss.elastic.co/t/elasticsearch-not-starting/307984 "2022-06-23T10:59:02Z")
Hello Everyone so I am very new to elasticsearch and I don't know How it work I had installed it and was working but suddenly today the clients told me that it is not working. I have made sure all the ownership is good … --- ## [Disk space of ELK](https://discuss.elastic.co/t/disk-space-of-elk/307977)
**Author:** [@Gaurav\_kr](https://discuss.elastic.co/u/Gaurav_kr)\ **Replies:** 1\ **Last updated:** [June 23, 2022, 10:36am UTC](https://discuss.elastic.co/t/disk-space-of-elk/307977 "2022-06-23T10:36:38Z")
Hi All, I using docker images for elasticsearch and kinbana on Linux host. And i have limited disk space to manage, so I am using ILM and SLM to delete the old indices so that disk space never reached to threshold. Bu… --- ## [Elasticsearch and NestJs multi cluster](https://discuss.elastic.co/t/elasticsearch-and-nestjs-multi-cluster/307989)
**Author:** [@meyer1](https://discuss.elastic.co/u/meyer1)\ **Replies:** 0\ **Last updated:** [June 23, 2022, 10:23am UTC](https://discuss.elastic.co/t/elasticsearch-and-nestjs-multi-cluster/307989 "2022-06-23T10:23:41Z")
Hello everyone, I have a small problem I want to produce an elasticsearch via an app NestJs. I have 3 hosts but I don't know how to configure my "search.module" "search.providers" and "search.service". Should I do someth… --- ## [Is Pipeline able to enrich data with a field of another line in same index?](https://discuss.elastic.co/t/is-pipeline-able-to-enrich-data-with-a-field-of-another-line-in-same-index/307988)
**Author:** [@Sebastien\_Taniere](https://discuss.elastic.co/u/Sebastien_Taniere)\ **Replies:** 0\ **Last updated:** [June 23, 2022, 10:22am UTC](https://discuss.elastic.co/t/is-pipeline-able-to-enrich-data-with-a-field-of-another-line-in-same-index/307988 "2022-06-23T10:22:17Z")
Hello, I have to ingest this type of data : \[2022-06-23 12:11:53 INF\] \[Env=\] \[Depot=\] \[Activity=\] \[RequestId=0HMIJARNNC6FT:00000002\] Request finished HTTP/1.1 GET http://xxxx.yyyy:5000/api/Weight/GetPickLineSupportWeig… --- ## [Filebeat in HA through active passive](https://discuss.elastic.co/t/filebeat-in-ha-through-active-passive/306987)
**Author:** [@diptesh2007](https://discuss.elastic.co/u/diptesh2007)\ **Replies:** 3\ **Last updated:** [June 23, 2022, 10:18am UTC](https://discuss.elastic.co/t/filebeat-in-ha-through-active-passive/306987 "2022-06-23T10:18:14Z")
I have a requirement to model ELK stack with failover across multiple AWS region. While there are no issues with running multiple instances of Logstash and Elasticsearch in active/active mode, the filebeat is expected t… --- ## [Dashboard Snapshot](https://discuss.elastic.co/t/dashboard-snapshot/307986)
**Author:** [@Gaurav\_kr](https://discuss.elastic.co/u/Gaurav_kr)\ **Replies:** 0\ **Last updated:** [June 23, 2022, 10:17am UTC](https://discuss.elastic.co/t/dashboard-snapshot/307986 "2022-06-23T10:17:33Z")
Hi All, I have created some dashboards and wanted to add in the beats package path kibana/7/dashboard but as we know the dashboard created on elk is exported in .ndjson format and if I put the .ndjson dashboard in beats… --- ## [Nodes getting removed often from the cluster](https://discuss.elastic.co/t/nodes-getting-removed-often-from-the-cluster/307956)
**Author:** [@Giuliano\_Drago](https://discuss.elastic.co/u/Giuliano_Drago)\ **Replies:** 4\ **Last updated:** [June 23, 2022, 9:39am UTC](https://discuss.elastic.co/t/nodes-getting-removed-often-from-the-cluster/307956 "2022-06-23T09:39:13Z")
hello, I have a couple of clusters running: es 6.8.21 es 5.6.16 the machines are Ubuntu VMs and are continuously showing these error in the logs: \[2022-06-23T09:08:46,082\]\[INFO \]\[o.e.c.s.ClusterApplierService\] \[serve… --- ## [Filebeat configuration](https://discuss.elastic.co/t/filebeat-configuration/307974)
**Author:** [@Ronald1](https://discuss.elastic.co/u/Ronald1)\ **Replies:** 0\ **Last updated:** [June 23, 2022, 9:28am UTC](https://discuss.elastic.co/t/filebeat-configuration/307974 "2022-06-23T09:28:25Z")
Hello all, This week I started looking into ELK to monitor our K8s cluster. Sorry if this is a newbie question :slight\_smile: I installed ELK (Elastic and Kibana) on a separate VM (not running on K8s) using Docker Comp… --- ## [Bug? "Could not communicate with the node... from the enrollment token."](https://discuss.elastic.co/t/bug-could-not-communicate-with-the-node-from-the-enrollment-token/306189)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 7\ **Last updated:** [June 23, 2022, 8:57am UTC](https://discuss.elastic.co/t/bug-could-not-communicate-with-the-node-from-the-enrollment-token/306189 "2022-06-23T08:57:01Z")
Hi there, I am making my first steps in Elasticsearch 8.x coming from 7.x. On 2 local virtual box nodes I would like to test / to understand the procedure of how I can let join a second Elasticsearch node to an already… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=889) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=891)