# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=921 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 922 --- ## [Kubernetes filebeat best practices](https://discuss.elastic.co/t/kubernetes-filebeat-best-practices/305270)
**Author:** [@lbchv](https://discuss.elastic.co/u/lbchv)\ **Replies:** 1\ **Last updated:** [May 31, 2022, 2:31am UTC](https://discuss.elastic.co/t/kubernetes-filebeat-best-practices/305270 "2022-05-31T02:31:55Z")
The documentation says to avoid harvesting symlinks when dialing with file rotation (link): When dealing with file rotation, avoid harvesting symlinks. Instead use the paths setting to point to the original file, and s… --- ## [How search in datastream by timestamp works?](https://discuss.elastic.co/t/how-search-in-datastream-by-timestamp-works/305694)
**Author:** [@Chanturia\_Dmitry](https://discuss.elastic.co/u/Chanturia_Dmitry)\ **Replies:** 4\ **Last updated:** [May 31, 2022, 2:10am UTC](https://discuss.elastic.co/t/how-search-in-datastream-by-timestamp-works/305694 "2022-05-31T02:10:35Z")
Hello. Can U explain how works search in datastream by timestamp field? For example: I have a datastream with two indexes. Each Index have 10 primary shards. What happens when I search by timestamp? Elastic will be s… --- ## [How to use maximum bm25 score among original term and its synonyms?](https://discuss.elastic.co/t/how-to-use-maximum-bm25-score-among-original-term-and-its-synonyms/305986)
**Author:** [@Junhyeok](https://discuss.elastic.co/u/Junhyeok)\ **Replies:** 0\ **Last updated:** [May 31, 2022, 2:08am UTC](https://discuss.elastic.co/t/how-to-use-maximum-bm25-score-among-original-term-and-its-synonyms/305986 "2022-05-31T02:08:31Z")
Hi, I am a newbie in Elasticsearch. I'm using synonym filters in analyzer. e.g. air conditioner -\> "air", "conditioner", "circulator" (synonym) When i use match query, it will calculate bm25 score for every matching t… --- ## [Kibana crashing when storing complex items on Elasticsearch](https://discuss.elastic.co/t/kibana-crashing-when-storing-complex-items-on-elasticsearch/305984)
**Author:** [@robjennings](https://discuss.elastic.co/u/robjennings)\ **Replies:** 6\ **Last updated:** [May 31, 2022, 1:32am UTC](https://discuss.elastic.co/t/kibana-crashing-when-storing-complex-items-on-elasticsearch/305984 "2022-05-31T01:32:31Z")
Hello, This is my first post in the community. I've been following this forum over the last months as I started to use more and more Elasticsearch on my day to day. I've been using Elasticsearch to store data from sever… --- ## [How to change Lucene version?](https://discuss.elastic.co/t/how-to-change-lucene-version/305959)
**Author:** [@Seo](https://discuss.elastic.co/u/Seo)\ **Replies:** 4\ **Last updated:** [May 31, 2022, 12:29am UTC](https://discuss.elastic.co/t/how-to-change-lucene-version/305959 "2022-05-31T00:29:48Z")
Hello. I have some questions about Lucene version. Are there any methods to change version of Lucene without change of Elasticsearch version? I want to apply the modified Lucene code(without version change) to my Elas… --- ## [License on a self-managed elasticsearch cluster](https://discuss.elastic.co/t/license-on-a-self-managed-elasticsearch-cluster/305975)
**Author:** [@irivas95](https://discuss.elastic.co/u/irivas95)\ **Replies:** 2\ **Last updated:** [May 30, 2022, 9:00pm UTC](https://discuss.elastic.co/t/license-on-a-self-managed-elasticsearch-cluster/305975 "2022-05-30T21:00:59Z")
Hi, I have a question about elastic licenses in self-managed clusters. I have seen in this page of elastic Official Elasticsearch Pricing: Elastic Cloud, Managed Elasticsearch | Elastic, the prices for subscriptions fo… --- ## [Cannot able to pull RDS metrics using metricbeat](https://discuss.elastic.co/t/cannot-able-to-pull-rds-metrics-using-metricbeat/305717)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 2\ **Last updated:** [May 30, 2022, 8:08pm UTC](https://discuss.elastic.co/t/cannot-able-to-pull-rds-metrics-using-metricbeat/305717 "2022-05-30T20:08:40Z")
Hi Team, I am trying to pull the AWS RDS metrics from metricbeat using AWS module and i have got the arn\_role to pull the metrics. But when i run metricbeat i am getting below error. Could you please help me to solve th… --- ## [Difference between Elasticsearch and Solr](https://discuss.elastic.co/t/difference-between-elasticsearch-and-solr/305969)
**Author:** [@fizhhh1997](https://discuss.elastic.co/u/fizhhh1997)\ **Replies:** 2\ **Last updated:** [May 30, 2022, 7:15pm UTC](https://discuss.elastic.co/t/difference-between-elasticsearch-and-solr/305969 "2022-05-30T19:15:28Z")
Hello all, how can i use proximity search and relevant score to get data with high accurate, and difference between Elasticsearch and Solr --- ## [RESOURCE\_LOCKED messages](https://discuss.elastic.co/t/resource-locked-messages/305628)
**Author:** [@rnappert](https://discuss.elastic.co/u/rnappert)\ **Replies:** 7\ **Last updated:** [May 30, 2022, 7:02pm UTC](https://discuss.elastic.co/t/resource-locked-messages/305628 "2022-05-30T19:02:27Z")
I have a three Logstash instances running a fairly old release ( 6.2.3). Two are running in a standby mode, and one in a active mode. The node, which has the vip is considered the active node. All this said, all three … --- ## [Trace queries and filters for audit](https://discuss.elastic.co/t/trace-queries-and-filters-for-audit/305821)
**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\ **Replies:** 1\ **Last updated:** [May 30, 2022, 5:57pm UTC](https://discuss.elastic.co/t/trace-queries-and-filters-for-audit/305821 "2022-05-30T17:57:04Z")
Hello, I enabled audit logs in Kibana but I cant find a way to track what is being put in the search bar, and which filters are being applied to dashboards/search sessions. Is there a way to achieve this? Thanks --- ## [Logstash - Parse txt with xml](https://discuss.elastic.co/t/logstash-parse-txt-with-xml/305936)
**Author:** [@Ely\_96](https://discuss.elastic.co/u/Ely_96)\ **Replies:** 4\ **Last updated:** [May 30, 2022, 5:18pm UTC](https://discuss.elastic.co/t/logstash-parse-txt-with-xml/305936 "2022-05-30T17:18:14Z")
Hi guys, I am having trouble reading a txt file that contains free text (tab separated) and xml text that I would like to read. The goal is to read only the content of the xml text, but I have no idea how to reach the g… --- ## [Elastic Agent Elasticsearch output via proxy](https://discuss.elastic.co/t/elastic-agent-elasticsearch-output-via-proxy/305639)
**Author:** [@RLPowellJr](https://discuss.elastic.co/u/RLPowellJr)\ **Replies:** 1\ **Last updated:** [May 30, 2022, 4:47pm UTC](https://discuss.elastic.co/t/elastic-agent-elasticsearch-output-via-proxy/305639 "2022-05-30T16:47:38Z")
Greetings all! I am looking for a sample proxy configuration to use with the Elasticsearch output for Fleet-managed Elastic Agents. I'm working with a group who wants to expose as little as possible of their Elastic St… --- ## [Unable to uninstall elastic-agent](https://discuss.elastic.co/t/unable-to-uninstall-elastic-agent/305347)
**Author:** [@liwenbo97](https://discuss.elastic.co/u/liwenbo97)\ **Replies:** 1\ **Last updated:** [May 30, 2022, 4:43pm UTC](https://discuss.elastic.co/t/unable-to-uninstall-elastic-agent/305347 "2022-05-30T16:43:43Z")
n227-012-170 ➜ ~ sudo elastic-agent uninstall Error: can only be uninstall by executing the installed Elastic Agent at: /usr/bin/elastic-agent For help, please see our troubleshooting guide at Troubleshoot common probl… --- ## [Ruby filter in logstash](https://discuss.elastic.co/t/ruby-filter-in-logstash/305952)
**Author:** [@Iss](https://discuss.elastic.co/u/Iss)\ **Replies:** 1\ **Last updated:** [May 30, 2022, 4:18pm UTC](https://discuss.elastic.co/t/ruby-filter-in-logstash/305952 "2022-05-30T16:18:31Z")
Hi! I have a list of geo\_points coverage: \[{"lon": \*\*\* , "lat": \*\*\*} , {"lon": \*\*\*, "lat": \*\*\*},...\] in a field (coverage) but logstash reads them as text. I put a new location (type geo\_point) tremplate PUT logsta… --- ## [Could not start some language models for NLP tasks](https://discuss.elastic.co/t/could-not-start-some-language-models-for-nlp-tasks/297888)
**Author:** [@Ilia](https://discuss.elastic.co/u/Ilia)\ **Replies:** 7\ **Last updated:** [May 30, 2022, 3:52pm UTC](https://discuss.elastic.co/t/could-not-start-some-language-models-for-nlp-tasks/297888 "2022-05-30T15:52:47Z")
I've installed Eland and have imported a model from huggingface as follows: eland\_import\_hub\_model --url http://localhost:9200/ \\ --hub-model-id HooshvareLab/bert-fa-zwnj-base-ner \\ --task-type ner I can see it in h… --- ## [Filebeat 8.2.1 kubernetes autodiscover template with multiple conditions doesn't work](https://discuss.elastic.co/t/filebeat-8-2-1-kubernetes-autodiscover-template-with-multiple-conditions-doesnt-work/305693)
**Author:** [@codrut\_alexandru](https://discuss.elastic.co/u/codrut_alexandru)\ **Replies:** 1\ **Last updated:** [May 30, 2022, 3:16pm UTC](https://discuss.elastic.co/t/filebeat-8-2-1-kubernetes-autodiscover-template-with-multiple-conditions-doesnt-work/305693 "2022-05-30T15:16:12Z")
Hi, Configuring filebeat version 8.2.1 autodiscover template with multiple conditions doesn't work: This works: templates: - condition.or: - not.equals: … --- ## [Can ElasticAgent/filebeat ingest a log/filestream input metadata as document data?](https://discuss.elastic.co/t/can-elasticagent-filebeat-ingest-a-log-filestream-input-metadata-as-document-data/305734)
**Author:** [@bunjamins](https://discuss.elastic.co/u/bunjamins)\ **Replies:** 1\ **Last updated:** [May 30, 2022, 3:12pm UTC](https://discuss.elastic.co/t/can-elasticagent-filebeat-ingest-a-log-filestream-input-metadata-as-document-data/305734 "2022-05-30T15:12:35Z")
specifically we have a legacy app that doesn't log a timestamp but logs to new files, is it possible to read file ctime as @timestamp? --- ## [Can documents returned during fetch phase have changed since query phase](https://discuss.elastic.co/t/can-documents-returned-during-fetch-phase-have-changed-since-query-phase/305773)
**Author:** [@davidbkemp](https://discuss.elastic.co/u/davidbkemp)\ **Replies:** 1\ **Last updated:** [May 30, 2022, 3:08pm UTC](https://discuss.elastic.co/t/can-documents-returned-during-fetch-phase-have-changed-since-query-phase/305773 "2022-05-30T15:08:46Z")
Our system assumes the documents returned by a search actually satisfy the query. Is it possible that, if a document is modified between the query and fetch phases of a search that the returned document doesn’t actually … --- ## [Script exception runtime error](https://discuss.elastic.co/t/script-exception-runtime-error/305689)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 3\ **Last updated:** [May 30, 2022, 3:07pm UTC](https://discuss.elastic.co/t/script-exception-runtime-error/305689 "2022-05-30T15:07:19Z")
Hi there, i have created scripted field for one of my index and here is the script: def path = doc\['request\_id.keyword'\].value; if (path != null) { def first = path.indexOf("\_"); def second = first + 1 + pat… --- ## [Filebeat unable to recognize the colorful file content](https://discuss.elastic.co/t/filebeat-unable-to-recognize-the-colorful-file-content/305921)
**Author:** [@sujeetkp](https://discuss.elastic.co/u/sujeetkp)\ **Replies:** 1\ **Last updated:** [May 30, 2022, 2:54pm UTC](https://discuss.elastic.co/t/filebeat-unable-to-recognize-the-colorful-file-content/305921 "2022-05-30T14:54:29Z")
I am trying to read a log file using filebeat. The log file looks as below. When filebeat reads it, it is displaying some special characters as below. Looks like filebeat is not able to recognize/ignore the color… --- ## [Localhost:9200 error when installing](https://discuss.elastic.co/t/localhost-9200-error-when-installing/305965)
**Author:** [@Merveille\_Kimfuta](https://discuss.elastic.co/u/Merveille_Kimfuta)\ **Replies:** 1\ **Last updated:** [May 30, 2022, 2:19pm UTC](https://discuss.elastic.co/t/localhost-9200-error-when-installing/305965 "2022-05-30T14:19:42Z")
Hello everyone, I am trying to install ELK using this tutorial https://www.youtube.com/watch?v=4BtAuGcUjCo but i am stuck at a message error when typing localhost:9200 on the web. Can someone have any idea how I can ove… --- ## [Rename Kibana space id](https://discuss.elastic.co/t/rename-kibana-space-id/305941)
**Author:** [@pranay\_jain](https://discuss.elastic.co/u/pranay_jain)\ **Replies:** 1\ **Last updated:** [May 30, 2022, 2:19pm UTC](https://discuss.elastic.co/t/rename-kibana-space-id/305941 "2022-05-30T14:19:35Z")
Hi, I want to rename space name and id in Kibana. I noticed that using update API we can rename the space but not the space id. And if I rename the space, the dashboard title still displays the space id. So my question … --- ## [Logstash password and username authentication](https://discuss.elastic.co/t/logstash-password-and-username-authentication/305786)
**Author:** [@Thuunder7](https://discuss.elastic.co/u/Thuunder7)\ **Replies:** 2\ **Last updated:** [May 30, 2022, 2:15pm UTC](https://discuss.elastic.co/t/logstash-password-and-username-authentication/305786 "2022-05-30T14:15:12Z")
Hi guys, I was searching in the documentation a way to authenticate a client, for example a metricbeat, into a logstash pipeline using an username and a password, but i couldn't find any option for this. Is there any c… --- ## [Secure between Logstash and Filebeat - File does not contain valid private key](https://discuss.elastic.co/t/secure-between-logstash-and-filebeat-file-does-not-contain-valid-private-key/305806)
**Author:** [@Bavaria](https://discuss.elastic.co/u/Bavaria)\ **Replies:** 2\ **Last updated:** [May 30, 2022, 1:20pm UTC](https://discuss.elastic.co/t/secure-between-logstash-and-filebeat-file-does-not-contain-valid-private-key/305806 "2022-05-30T13:20:59Z")
I am trying to secure between Filebeat and Logstash. However, I do encounter some difficulties. Without SSL the connection does work. First I created with the Elasticsearch-certuitil a CA. C:\\PATH\\elasticsearch-8.0.1\>b… --- ## [Inconsistent results when searching/deleting documents containing quotes](https://discuss.elastic.co/t/inconsistent-results-when-searching-deleting-documents-containing-quotes/305698)
**Author:** [@bizmate](https://discuss.elastic.co/u/bizmate)\ **Replies:** 8\ **Last updated:** [May 30, 2022, 1:02pm UTC](https://discuss.elastic.co/t/inconsistent-results-when-searching-deleting-documents-containing-quotes/305698 "2022-05-30T13:02:11Z")
ES question in my document i have .... "message": "10.42.224.236 - 26/May/2022:06:15:58 +0000 "GET /index.php" 200" and i would like to match from GET to 200. If i query with GET /index\_prod\*/\_search { "query": … --- ## [ElasticSearch.Net Package issue on the Framework 4.8](https://discuss.elastic.co/t/elasticsearch-net-package-issue-on-the-framework-4-8/305950)
**Author:** [@Gopinath\_Basker](https://discuss.elastic.co/u/Gopinath_Basker)\ **Replies:** 0\ **Last updated:** [May 30, 2022, 12:35pm UTC](https://discuss.elastic.co/t/elasticsearch-net-package-issue-on-the-framework-4-8/305950 "2022-05-30T12:35:09Z")
Hi Team, We have Elasticsearch 7.17.3 and tried to query the information. for that we used NEST package 7.15.0 but we faced issue while querying Issue is "Elasticsearch.Net.Utf8Json.JsonParsingException: expected:'Str… --- ## [Duplicated fields in analyze response object when analyzing korean with nori\_tokenizer](https://discuss.elastic.co/t/duplicated-fields-in-analyze-response-object-when-analyzing-korean-with-nori-tokenizer/305943)
**Author:** [@maruoovv](https://discuss.elastic.co/u/maruoovv)\ **Replies:** 0\ **Last updated:** [May 30, 2022, 12:05pm UTC](https://discuss.elastic.co/t/duplicated-fields-in-analyze-response-object-when-analyzing-korean-with-nori-tokenizer/305943 "2022-05-30T12:05:49Z")
Hi, i'm analyzing korean keyword with nori tokenizer and synonym\_graph, i found some field is duplicated in analyze response object. Elasticsearch version : 7.1.1 index settings PUT /test-index { "settings" : { "a… --- ## [Logstash consuming too many resources](https://discuss.elastic.co/t/logstash-consuming-too-many-resources/305201)
**Author:** [@Simone1](https://discuss.elastic.co/u/Simone1)\ **Replies:** 2\ **Last updated:** [May 20, 2022, 6:47am UTC](https://discuss.elastic.co/t/logstash-consuming-too-many-resources/305201 "2022-05-20T06:47:13Z")
Logstash is consuming a lot of memory and there are many hanging processes redirecting output to temporary files that seem to be no longer available. Example of one process: root Ss May01 0:00 sh -c /sbin/blkid \>\>/… --- ## [Authenticate Elasticsearch \<--\> Kibana Client Communication (xpack.security.http.ssl.client\_authentication)s](https://discuss.elastic.co/t/authenticate-elasticsearch-kibana-client-communication-xpack-security-http-ssl-client-authentication-s/305038)
**Author:** [@Lokesh\_Sachdeva](https://discuss.elastic.co/u/Lokesh_Sachdeva)\ **Replies:** 2\ **Last updated:** [May 30, 2022, 10:30am UTC](https://discuss.elastic.co/t/authenticate-elasticsearch-kibana-client-communication-xpack-security-http-ssl-client-authentication-s/305038 "2022-05-30T10:30:04Z")
Hi Team We are configuring ELK Docker 8.0.0 in our system with SSL Configuration. List item SSL Authentication Between Kibana & End User (Host Machine): Its working fine with Elasticsearch generated CA. Kibana is run… --- ## [How to calculate & draw metrics of scripted metrics](https://discuss.elastic.co/t/how-to-calculate-draw-metrics-of-scripted-metrics/305281)
**Author:** [@ultimate](https://discuss.elastic.co/u/ultimate)\ **Replies:** 1\ **Last updated:** [May 30, 2022, 10:07am UTC](https://discuss.elastic.co/t/how-to-calculate-draw-metrics-of-scripted-metrics/305281 "2022-05-30T10:07:26Z")
Problem description we have log files from different devices parsed into our Elasticsearch database, line by line. The log files are built as a ring buffer, so they always have a fixed size of 1000 lines. They can be man… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=920) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=922)