# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=893 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 894 --- ## [Grok error filter json](https://discuss.elastic.co/t/grok-error-filter-json/307352)
**Author:** [@Roshan1](https://discuss.elastic.co/u/Roshan1)\ **Replies:** 7\ **Last updated:** [June 22, 2022, 8:16am UTC](https://discuss.elastic.co/t/grok-error-filter-json/307352 "2022-06-22T08:16:58Z")
Hello Team, can you please help me with error below? Error: \[WARN \] 2022-06-16 11:02:33.814 \[\[main\]-pipeline-manager\] grok - ECS v8 support is a preview of the unreleased ECS v8, and uses the v1 patterns. When Version… --- ## [Exception in thread "main" java.lang.NoClassDefFoundError](https://discuss.elastic.co/t/exception-in-thread-main-java-lang-noclassdeffounderror/307246)
**Author:** [@Ashutosh](https://discuss.elastic.co/u/Ashutosh)\ **Replies:** 2\ **Last updated:** [June 22, 2022, 8:08am UTC](https://discuss.elastic.co/t/exception-in-thread-main-java-lang-noclassdeffounderror/307246 "2022-06-22T08:08:44Z")
Hi Team, I am a beginner in Elasticsearch. We have a wazuh cluster running which use Elasticsearch for storing alerts. Since few days, the Elasticsearch is not starting at al. Whenever we try to use "systemctl start ela… --- ## [Calculate Error Budget Metric](https://discuss.elastic.co/t/calculate-error-budget-metric/307507)
**Author:** [@EllBil](https://discuss.elastic.co/u/EllBil)\ **Replies:** 3\ **Last updated:** [June 22, 2022, 8:07am UTC](https://discuss.elastic.co/t/calculate-error-budget-metric/307507 "2022-06-22T08:07:57Z")
Hello Elastic team, I'm actually working on SLI/SLO visualization on Kibana. My request is a bit complexe : I need to visualize the remaining error budget using this formula : EB = 436 minutes IF (not status = "500"… --- ## [Remove\_field not working](https://discuss.elastic.co/t/remove-field-not-working/307716)
**Author:** [@Naman1](https://discuss.elastic.co/u/Naman1)\ **Replies:** 2\ **Last updated:** [June 22, 2022, 7:59am UTC](https://discuss.elastic.co/t/remove-field-not-working/307716 "2022-06-22T07:59:01Z")
I am using remove\_field , but it is still showing that field in kibana. For eg- tags --- ## [Index Policy not taking effect on the specified indexes](https://discuss.elastic.co/t/index-policy-not-taking-effect-on-the-specified-indexes/307796)
**Author:** [@Yashwant\_Shettigar](https://discuss.elastic.co/u/Yashwant_Shettigar)\ **Replies:** 5\ **Last updated:** [June 22, 2022, 6:04am UTC](https://discuss.elastic.co/t/index-policy-not-taking-effect-on-the-specified-indexes/307796 "2022-06-22T06:04:09Z")
Hey Guys, I tried applying default 90\_days\_log\_retention policy to my monitoring-es indexes, but it gets deleted after the 7th day. Not sure where it went wrong. This is settings as per ILM policy for 90 days : { "… --- ## [Notification for unenrollment](https://discuss.elastic.co/t/notification-for-unenrollment/307828)
**Author:** [@jongpil.won](https://discuss.elastic.co/u/jongpil.won)\ **Replies:** 0\ **Last updated:** [June 22, 2022, 5:03am UTC](https://discuss.elastic.co/t/notification-for-unenrollment/307828 "2022-06-22T05:03:18Z")
Unenrollment can be automatically performed through the unenrollment timeout setting in the Fleet UI, so can I get a notification for the event where the unenrollment operates? I'd like to set the result of automaticall… --- ## [Date time issue while sync up using Logstash from Oracle DB to Elasticsearch](https://discuss.elastic.co/t/date-time-issue-while-sync-up-using-logstash-from-oracle-db-to-elasticsearch/307824)
**Author:** [@suresh\_u](https://discuss.elastic.co/u/suresh_u)\ **Replies:** 0\ **Last updated:** [June 22, 2022, 4:05am UTC](https://discuss.elastic.co/t/date-time-issue-while-sync-up-using-logstash-from-oracle-db-to-elasticsearch/307824 "2022-06-22T04:05:41Z")
Hi team, I am using logstash for sync up data from Oracle Db to ElasticSearch index. I am able to sync data but the issue is : In Oracle db, I have 3 date fields. while syncing in ES index, they are storing as UTC. I… --- ## [Memcached not working](https://discuss.elastic.co/t/memcached-not-working/307822)
**Author:** [@paulohperes](https://discuss.elastic.co/u/paulohperes)\ **Replies:** 0\ **Last updated:** [June 22, 2022, 3:57am UTC](https://discuss.elastic.co/t/memcached-not-working/307822 "2022-06-22T03:57:26Z")
I am trying to create a pipeline using the memcached plugin, however it is not working when I create a key in the cache in dictionary format. Here's my pipeline: input { udp { port =\> 514 type =\> sy… --- ## [Where could I find all fields content in event.action?](https://discuss.elastic.co/t/where-could-i-find-all-fields-content-in-event-action/307718)
**Author:** [@Shadow\_CHN](https://discuss.elastic.co/u/Shadow_CHN)\ **Replies:** 4\ **Last updated:** [June 22, 2022, 3:28am UTC](https://discuss.elastic.co/t/where-could-i-find-all-fields-content-in-event-action/307718 "2022-06-22T03:28:56Z")
field event.action can be found in Discover and Security module, my question is where can I find a document explains event.action includes how many and what actions? Like Winlogbeat\\module\\security\\ingest\\security.yml, e… --- ## [While connecting elasticSearch Getting this Exception through java api](https://discuss.elastic.co/t/while-connecting-elasticsearch-getting-this-exception-through-java-api/307764)
**Author:** [@Udayaprakash\_S\_10d](https://discuss.elastic.co/u/Udayaprakash_S_10d)\ **Replies:** 5\ **Last updated:** [June 22, 2022, 2:24am UTC](https://discuss.elastic.co/t/while-connecting-elasticsearch-getting-this-exception-through-java-api/307764 "2022-06-22T02:24:12Z")
SLF4J: Failed toString() invocation on an object of type \[org.elasticsearch.search.builder.SearchSourceBuilder\] Reported exception: java.lang.NullPointerException at org.elasticsearch.index.query.BoolQueryBuilder.doXArr… --- ## [Regarding count lookup of newly defined fields with log stash](https://discuss.elastic.co/t/regarding-count-lookup-of-newly-defined-fields-with-log-stash/307814)
**Author:** [@inwoo1](https://discuss.elastic.co/u/inwoo1)\ **Replies:** 3\ **Last updated:** [June 22, 2022, 2:32am UTC](https://discuss.elastic.co/t/regarding-count-lookup-of-newly-defined-fields-with-log-stash/307814 "2022-06-22T02:32:04Z")
I am collecting SNMP through logstash and creating a new field forti\_fw\_sessioncount through mutate-rename function. Looking at the log, 791 cases of forti\_fw\_sessioncount came in, but only 29 cases were shown when I ch… --- ## [Middleware Logic Layer](https://discuss.elastic.co/t/middleware-logic-layer/307817)
**Author:** [@randomusername001](https://discuss.elastic.co/u/randomusername001)\ **Replies:** 0\ **Last updated:** [June 22, 2022, 1:15am UTC](https://discuss.elastic.co/t/middleware-logic-layer/307817 "2022-06-22T01:15:45Z")
Hi All, Apologies if this is the wrong section to be posting in. Hoping to get some advice / insights if there is anything available in market to use for our use case. We have an ELK cluster that is running our site se… --- ## [Null results from search](https://discuss.elastic.co/t/null-results-from-search/307800)
**Author:** [@EnJay](https://discuss.elastic.co/u/EnJay)\ **Replies:** 2\ **Last updated:** [June 22, 2022, 12:49am UTC](https://discuss.elastic.co/t/null-results-from-search/307800 "2022-06-22T00:49:29Z")
Hello dear community :hugs: I record the price of bitcoin in ElasticSearch every 5 minutes. Today there was a problem, the server was down for a while, because of which the price was not recorded. Because of this, I sta… --- ## [How to config kibana if xpack.security.http.ssl.enabled is false](https://discuss.elastic.co/t/how-to-config-kibana-if-xpack-security-http-ssl-enabled-is-false/307350)
**Author:** [@yjm17865195865](https://discuss.elastic.co/u/yjm17865195865)\ **Replies:** 7\ **Last updated:** [June 21, 2022, 11:55pm UTC](https://discuss.elastic.co/t/how-to-config-kibana-if-xpack-security-http-ssl-enabled-is-false/307350 "2022-06-21T23:55:22Z")
I'm starting a Elasticsearch v8.2.2 throuth docker images. After started i found that TLS/SSL is enabled in default and I want to disable that( however it's fine that between es'node keep using the TLS/SSL to communicate… --- ## [How do I host an Elasticsearch server on a local machine and allow other machines to access that data?](https://discuss.elastic.co/t/how-do-i-host-an-elasticsearch-server-on-a-local-machine-and-allow-other-machines-to-access-that-data/307766)
**Author:** [@DataStorageMuse](https://discuss.elastic.co/u/DataStorageMuse)\ **Replies:** 18\ **Last updated:** [June 21, 2022, 11:42pm UTC](https://discuss.elastic.co/t/how-do-i-host-an-elasticsearch-server-on-a-local-machine-and-allow-other-machines-to-access-that-data/307766 "2022-06-21T23:42:59Z")
I have an Elasticsearch server running on a local machine with an ip address: {local\_machine\_ip}. I have another computer that has an ip {client\_ip}. How do I allow the client computer to access the Elasticsearch server … --- ## [Painless scipt](https://discuss.elastic.co/t/painless-scipt/307524)
**Author:** [@Soren\_vdc](https://discuss.elastic.co/u/Soren_vdc)\ **Replies:** 1\ **Last updated:** [June 21, 2022, 11:19pm UTC](https://discuss.elastic.co/t/painless-scipt/307524 "2022-06-21T23:19:10Z")
Hi, I have query with aggregation and as result I receive the buckets with the "key" and "doc\_count". I want to send mail for each bucket that is find in the output. I have this: "transform": { "script": { … --- ## [Export huge amount of data converted to csv format](https://discuss.elastic.co/t/export-huge-amount-of-data-converted-to-csv-format/307779)
**Author:** [@Tony79](https://discuss.elastic.co/u/Tony79)\ **Replies:** 1\ **Last updated:** [June 21, 2022, 10:28pm UTC](https://discuss.elastic.co/t/export-huge-amount-of-data-converted-to-csv-format/307779 "2022-06-21T22:28:04Z")
Hi, I want to export a huge amount of structured data to a csv formatted file. What is the most "production friendly" way to do this? I'm thinking of running elasticdump from a system with enough disk but I'm not sure… --- ## [ALLOCATION\_FAILED needed explain Elastic 8.1.1](https://discuss.elastic.co/t/allocation-failed-needed-explain-elastic-8-1-1/307778)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 2\ **Last updated:** [June 21, 2022, 10:25pm UTC](https://discuss.elastic.co/t/allocation-failed-needed-explain-elastic-8-1-1/307778 "2022-06-21T22:25:16Z")
Hi I'm facing with ALLOCATION\_FAILED, and I want to know what was the reason. My cluster consists with 51 node on 3 hosts under docker swarm, and I have also configured data tier. Can You explain how I can recover throu… --- ## [How to retrieve data aws Lambda](https://discuss.elastic.co/t/how-to-retrieve-data-aws-lambda/307781)
**Author:** [@Renato\_Souza](https://discuss.elastic.co/u/Renato_Souza)\ **Replies:** 0\ **Last updated:** [June 21, 2022, 4:23pm UTC](https://discuss.elastic.co/t/how-to-retrieve-data-aws-lambda/307781 "2022-06-21T16:23:37Z")
How to retrieve data from AWS Lambda. I'm using functionbeat, but even with SAR I only retrieve CloudWatch logs as well. I would like support to know how to use these elastic integrations with AWS and I was able to dire… --- ## [How do I publish Elasticsearch cluster run on a remote machine (via its public IP address) and access it from another machine with Python Client?](https://discuss.elastic.co/t/how-do-i-publish-elasticsearch-cluster-run-on-a-remote-machine-via-its-public-ip-address-and-access-it-from-another-machine-with-python-client/307798)
**Author:** [@DataStorageMuse](https://discuss.elastic.co/u/DataStorageMuse)\ **Replies:** 1\ **Last updated:** [June 21, 2022, 10:18pm UTC](https://discuss.elastic.co/t/how-do-i-publish-elasticsearch-cluster-run-on-a-remote-machine-via-its-public-ip-address-and-access-it-from-another-machine-with-python-client/307798 "2022-06-21T22:18:21Z")
Hi, I was wondering if anyone could give me concrete instructions (or point me to where in the documentation there are specific instructions) for publishing an Elasticsearch cluster on the host machine (via the public IP… --- ## [Logstash Startup 401 error on Windows 10](https://discuss.elastic.co/t/logstash-startup-401-error-on-windows-10/307806)
**Author:** [@AE2000](https://discuss.elastic.co/u/AE2000)\ **Replies:** 0\ **Last updated:** [June 21, 2022, 9:55pm UTC](https://discuss.elastic.co/t/logstash-startup-401-error-on-windows-10/307806 "2022-06-21T21:55:32Z")
I'm installing ELK on my windows 10 workstation and I've gone through the steps to install all three; although there was a few issues with authorization during the process, Elasticsearch and Kibana are working perfectly … --- ## [Is there a way to efficiently get three layer aggrigations result in elasticsearch, where each layer is conditioned by above one](https://discuss.elastic.co/t/is-there-a-way-to-efficiently-get-three-layer-aggrigations-result-in-elasticsearch-where-each-layer-is-conditioned-by-above-one/307788)
**Author:** [@Robin\_Rawat](https://discuss.elastic.co/u/Robin_Rawat)\ **Replies:** 0\ **Last updated:** [June 21, 2022, 5:35pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-efficiently-get-three-layer-aggrigations-result-in-elasticsearch-where-each-layer-is-conditioned-by-above-one/307788 "2022-06-21T17:35:41Z")
I am trying to get composite aggregation for certain feilds which are present in each document. These documents are stored in elastic. Format of each document is a json with below mentioned keys. {"id","name","topic","bu… --- ## [Challenges with date/time range selection when combining snapshot and timeseries data](https://discuss.elastic.co/t/challenges-with-date-time-range-selection-when-combining-snapshot-and-timeseries-data/304997)
**Author:** [@Sadia\_Mukhtar](https://discuss.elastic.co/u/Sadia_Mukhtar)\ **Replies:** 17\ **Last updated:** [June 21, 2022, 9:17pm UTC](https://discuss.elastic.co/t/challenges-with-date-time-range-selection-when-combining-snapshot-and-timeseries-data/304997 "2022-06-21T21:17:48Z")
Hi there, My organization is very new to Elasticsearch and Kibana. Historically we were using sql server for our analytics. We are doing a PoC to determine if Elastic and Kibana will with our scenario. We have 12 months… --- ## [Unnasigned shards for replica](https://discuss.elastic.co/t/unnasigned-shards-for-replica/307792)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 1\ **Last updated:** [June 21, 2022, 7:43pm UTC](https://discuss.elastic.co/t/unnasigned-shards-for-replica/307792 "2022-06-21T19:43:15Z")
Hi How can I reassign (UNASSIGNED) shards for replica ? logstash-prod1-2022.06.21 3 p STARTED 2833524 es\_data\_ssd\_5\_1 logstash-prod1-2022.06.21 3 r UNASSIGNED I have tried through below req: POS… --- ## [Parse JSON array with nested objects](https://discuss.elastic.co/t/parse-json-array-with-nested-objects/307770)
**Author:** [@eliz](https://discuss.elastic.co/u/eliz)\ **Replies:** 2\ **Last updated:** [June 21, 2022, 6:37pm UTC](https://discuss.elastic.co/t/parse-json-array-with-nested-objects/307770 "2022-06-21T18:37:09Z")
Hi there! I am receiving an array of nested JSON elements and I would like to build a logic capable of transforming the following input { "devices": \[ { "device": { "device\_name": "printer\_1", … --- ## [Elastic Agent with fleet policy refuses to start properly](https://discuss.elastic.co/t/elastic-agent-with-fleet-policy-refuses-to-start-properly/307700)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 1\ **Last updated:** [June 21, 2022, 6:14pm UTC](https://discuss.elastic.co/t/elastic-agent-with-fleet-policy-refuses-to-start-properly/307700 "2022-06-21T18:14:54Z")
My Elastic Agent that runs the Fleet policy stopped working a week or two ago. As it cannot start the Fleet server. # elastic-agent status Status: FAILED Message: (no message) Applications: \* filebeat (C… --- ## [Azure Availability not showing on any event](https://discuss.elastic.co/t/azure-availability-not-showing-on-any-event/307790)
**Author:** [@Thuunder7](https://discuss.elastic.co/u/Thuunder7)\ **Replies:** 0\ **Last updated:** [June 21, 2022, 6:06pm UTC](https://discuss.elastic.co/t/azure-availability-not-showing-on-any-event/307790 "2022-06-21T18:06:52Z")
Hey guys, I have a metricbeat that is collecting metrics from azure, like for example, databases and storage accounts. It is working fine, but i would like to create an alert to check when a database is down, but unfort… --- ## [Getting slow logs on kibana with an hour delay time](https://discuss.elastic.co/t/getting-slow-logs-on-kibana-with-an-hour-delay-time/307645)
**Author:** [@Milad\_Akhlaghi](https://discuss.elastic.co/u/Milad_Akhlaghi)\ **Replies:** 6\ **Last updated:** [June 21, 2022, 6:06pm UTC](https://discuss.elastic.co/t/getting-slow-logs-on-kibana-with-an-hour-delay-time/307645 "2022-06-21T18:06:34Z")
Hi friends, i have elk cluster that includes: 20 filebeats , 6 logstash, 9 elasticsearches and 2 kibanas Elasticsearch node roles are : 3 x \[ data\_hot, data\_content \] 3 x \[ data\_warm, ingest, master \] 1x \[ master \] … --- ## [c.a.a.p.i.BasicProfileConfigFileLoader noise](https://discuss.elastic.co/t/c-a-a-p-i-basicprofileconfigfileloader-noise/307630)
**Author:** [@Anarhyst266](https://discuss.elastic.co/u/Anarhyst266)\ **Replies:** 6\ **Last updated:** [June 21, 2022, 5:55pm UTC](https://discuss.elastic.co/t/c-a-a-p-i-basicprofileconfigfileloader-noise/307630 "2022-06-21T17:55:38Z")
When I'm trying to set logger.level to warn in my ES 8.1.3(also checked on 8.2.3) I've got the noise WARN message "message":"Unable to load config file null", "ecs.version": "1.2.0","service.name":"ES\_ECS","event.datase… --- ## [Stress testing the Logstash service](https://discuss.elastic.co/t/stress-testing-the-logstash-service/306815)
**Author:** [@olivierots](https://discuss.elastic.co/u/olivierots)\ **Replies:** 13\ **Last updated:** [June 21, 2022, 4:46pm UTC](https://discuss.elastic.co/t/stress-testing-the-logstash-service/306815 "2022-06-21T16:46:09Z")
Hello there, I wonder whether someone can help me with this I am looking at ways to load stress test the Logstash service that sits on an ec2 instance I am looking at implementing some scaling policies for our ASGs bu… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=892) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=894)