# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=937 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 938 --- ## [Logstash bulk request to ElasticSearch error - may be due to old indexes](https://discuss.elastic.co/t/logstash-bulk-request-to-elasticsearch-error-may-be-due-to-old-indexes/304943)
**Author:** [@DenSeb](https://discuss.elastic.co/u/DenSeb)\ **Replies:** 0\ **Last updated:** [May 17, 2022, 12:26pm UTC](https://discuss.elastic.co/t/logstash-bulk-request-to-elasticsearch-error-may-be-due-to-old-indexes/304943 "2022-05-17T12:26:23Z")
If you get these errors in LogStash : Attempted to send a bulk request to elasticsearch' but Elasticsearch appears to be unreachable or down! {:error\_message=\>"Elasticsearch Unreachable: \[http://localhost:9200/\]\[Mantico… --- ## [Why can't I use user.name as field in machine learning job, but the standard jobs can?](https://discuss.elastic.co/t/why-cant-i-use-user-name-as-field-in-machine-learning-job-but-the-standard-jobs-can/304245)
**Author:** [@anddam](https://discuss.elastic.co/u/anddam)\ **Replies:** 24\ **Last updated:** [May 17, 2022, 11:58am UTC](https://discuss.elastic.co/t/why-cant-i-use-user-name-as-field-in-machine-learning-job-but-the-standard-jobs-can/304245 "2022-05-17T11:58:17Z")
Why is it not possible for me to use the user.name field in the "by field" section of a machine learning job, but the standard jobs have no problem with it? As you can see it is not an option for me: But the standar… --- ## [Grok pattern Syslog auth](https://discuss.elastic.co/t/grok-pattern-syslog-auth/304911)
**Author:** [@CemG](https://discuss.elastic.co/u/CemG)\ **Replies:** 2\ **Last updated:** [May 17, 2022, 11:47am UTC](https://discuss.elastic.co/t/grok-pattern-syslog-auth/304911 "2022-05-17T11:47:51Z")
Hello, I have to grok my syslog auth logs from Linux, I have a pattern, but it still nonmatch with the logs, can someone help me to see if there is an error in my gros pattern ? My filter filter { json { … --- ## [Update by Query insert new child document](https://discuss.elastic.co/t/update-by-query-insert-new-child-document/304928)
**Author:** [@Daniel\_Debray](https://discuss.elastic.co/u/Daniel_Debray)\ **Replies:** 0\ **Last updated:** [May 17, 2022, 11:39am UTC](https://discuss.elastic.co/t/update-by-query-insert-new-child-document/304928 "2022-05-17T11:39:30Z")
Hi, i would like to know whether its possible to insert a new child document during a Update by Query task. Our situation (simplified): A product has n attributes modeled using a join field. Index template: { "m… --- ## [Match financial transactions and merchants](https://discuss.elastic.co/t/match-financial-transactions-and-merchants/304588)
**Author:** [@fabiobozzo](https://discuss.elastic.co/u/fabiobozzo)\ **Replies:** 0\ **Last updated:** [May 12, 2022, 2:35pm UTC](https://discuss.elastic.co/t/match-financial-transactions-and-merchants/304588 "2022-05-12T14:35:58Z")
I have an Elastic index with billions of transactions. An example tx: { "id": "54bfa9af-009a-437d-bd21-caaf651f7218", "amount": 100.0, "currency": "EUR", "type": "expense", ... "note": "CARD PAYMENT … --- ## [Map MySQL columns into nested fields Elastic using Logstash](https://discuss.elastic.co/t/map-mysql-columns-into-nested-fields-elastic-using-logstash/304820)
**Author:** [@Alrote](https://discuss.elastic.co/u/Alrote)\ **Replies:** 4\ **Last updated:** [May 17, 2022, 11:20am UTC](https://discuss.elastic.co/t/map-mysql-columns-into-nested-fields-elastic-using-logstash/304820 "2022-05-17T11:20:03Z")
Hello, I am struggling getting done some filtering to get in Elastic the information in the format I want. First, I have a MySQL table that I process in the input (no problem in that part). I want some of the columns t… --- ## [Response time logs](https://discuss.elastic.co/t/response-time-logs/304918)
**Author:** [@The-morpho](https://discuss.elastic.co/u/The-morpho)\ **Replies:** 0\ **Last updated:** [May 17, 2022, 10:16am UTC](https://discuss.elastic.co/t/response-time-logs/304918 "2022-05-17T10:16:42Z")
Hello, I'm working on log files that contains information about some operations on differents levels, I have a field timestamp that representsthe time when each operation has occured on each level. I want to calculate … --- ## [SSL configuration assistance](https://discuss.elastic.co/t/ssl-configuration-assistance/304778)
**Author:** [@rajvel](https://discuss.elastic.co/u/rajvel)\ **Replies:** 6\ **Last updated:** [May 17, 2022, 9:51am UTC](https://discuss.elastic.co/t/ssl-configuration-assistance/304778 "2022-05-17T09:51:16Z")
Hello Team, We are having a single node ELK configuration, In the same server we have installed Elasticsearch logstash and kibana (8.0.1) (on-premises) As per the guide if we are installing the elasticsearch generates … --- ## [Can't connecte to elasticsearch using python](https://discuss.elastic.co/t/cant-connecte-to-elasticsearch-using-python/304910)
**Author:** [@safaeaz](https://discuss.elastic.co/u/safaeaz)\ **Replies:** 2\ **Last updated:** [May 17, 2022, 9:39am UTC](https://discuss.elastic.co/t/cant-connecte-to-elasticsearch-using-python/304910 "2022-05-17T09:39:55Z")
i have my Elasticsearch container running on my virtual machine en port 8081:9200 and i need to connect to it using python code when runnnig a script to create index in Elasticsearch # Import packages from elasticsearch… --- ## [How to restrict index pattern list view for a particular role in kibana?](https://discuss.elastic.co/t/how-to-restrict-index-pattern-list-view-for-a-particular-role-in-kibana/304805)
**Author:** [@Yash\_garg](https://discuss.elastic.co/u/Yash_garg)\ **Replies:** 2\ **Last updated:** [May 17, 2022, 9:35am UTC](https://discuss.elastic.co/t/how-to-restrict-index-pattern-list-view-for-a-particular-role-in-kibana/304805 "2022-05-17T09:35:39Z")
Hi there, I am using multiple server to send logs to logstash using filebeat. then i am sending logs from logstash to Elasticsearch to kibana. I defined a user and role in kibana. But I want to restrict each user to vi… --- ## [Querying for length of document](https://discuss.elastic.co/t/querying-for-length-of-document/304833)
**Author:** [@TomZa](https://discuss.elastic.co/u/TomZa)\ **Replies:** 2\ **Last updated:** [May 17, 2022, 9:12am UTC](https://discuss.elastic.co/t/querying-for-length-of-document/304833 "2022-05-17T09:12:14Z")
Hi, I have documents indexed like this: "words": "Yellow dogs are barking" The example above has four tokens. While querying now via matchPhrase, is it possible to set a minimum of tokens which should be in the docu… --- ## [Null id Agent Policy](https://discuss.elastic.co/t/null-id-agent-policy/303837)
**Author:** [@Leandre](https://discuss.elastic.co/u/Leandre)\ **Replies:** 2\ **Last updated:** [May 17, 2022, 8:30am UTC](https://discuss.elastic.co/t/null-id-agent-policy/303837 "2022-05-17T08:30:38Z")
Using the fleet API, I created a new Agent Policy. But by accident, I provided the ID for the new Policy : "null". Now when I try to view my policies using the UI or the API, I get this : {"statusCode":500, "error":"Int… --- ## [Where I set the variable ELASTIC\_CLIENT\_APIVERSIONING?](https://discuss.elastic.co/t/where-i-set-the-variable-elastic-client-apiversioning/304901)
**Author:** [@frankmehlhop](https://discuss.elastic.co/u/frankmehlhop)\ **Replies:** 0\ **Last updated:** [May 17, 2022, 8:29am UTC](https://discuss.elastic.co/t/where-i-set-the-variable-elastic-client-apiversioning/304901 "2022-05-17T08:29:46Z")
At the elastic documentation I read, that I should set the variable ELASTIC\_CLIENT\_APIVERSIONING on true. But where I should set the variable? At my device / Windows 11 as environment variable? Or in which configuration … --- ## [Filebeat rate limiting question](https://discuss.elastic.co/t/filebeat-rate-limiting-question/304898)
**Author:** [@can.ozdemir](https://discuss.elastic.co/u/can.ozdemir)\ **Replies:** 0\ **Last updated:** [May 17, 2022, 8:19am UTC](https://discuss.elastic.co/t/filebeat-rate-limiting-question/304898 "2022-05-17T08:19:46Z")
Hello there, we would like to limit the producer rates from our filebeat into kafka. I found rate\_limit processor from below link can be used, but I am confused about what dropping the events mean. Is filebeat retrying t… --- ## [How to set "enabled":"False" to a field in filebeat](https://discuss.elastic.co/t/how-to-set-enabled-false-to-a-field-in-filebeat/304806)
**Author:** [@Kuo\_Hugo](https://discuss.elastic.co/u/Kuo_Hugo)\ **Replies:** 6\ **Last updated:** [May 17, 2022, 8:15am UTC](https://discuss.elastic.co/t/how-to-set-enabled-false-to-a-field-in-filebeat/304806 "2022-05-17T08:15:34Z")
Add it to setup.template.fields file. But the index template doesn't have the "enabled: false" applied. Is there a way to disable a field from indexing ? - name: message level: core type: text enabled: fa… --- ## [Elasticsearch error when enable ssl/tls](https://discuss.elastic.co/t/elasticsearch-error-when-enable-ssl-tls/304893)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 7\ **Last updated:** [May 17, 2022, 8:08am UTC](https://discuss.elastic.co/t/elasticsearch-error-when-enable-ssl-tls/304893 "2022-05-17T08:08:10Z")
i just enable ssl/tls but i have an error like this Caused by: org.elasticsearch.ElasticsearchException: failed to initialize SSL TrustManager - truststore file \[/etc/elasticsearch/elastic-certificates.p12\] does not exi… --- ## [Why query\_string not worked when used in highlight\_query？](https://discuss.elastic.co/t/why-query-string-not-worked-when-used-in-highlight-query/304897)
**Author:** [@slightKB](https://discuss.elastic.co/u/slightKB)\ **Replies:** 0\ **Last updated:** [May 17, 2022, 7:39am UTC](https://discuss.elastic.co/t/why-query-string-not-worked-when-used-in-highlight-query/304897 "2022-05-17T07:39:11Z")
field "regAggress" is Text type "regContactAddress" : { "type" : "text", "analyzer" : "aliws" } query example: { "\_source": \["regContactAddress","\_id","entName"\], "highlight": { "fields": {… --- ## [Higher search rate when added final data node to cluster](https://discuss.elastic.co/t/higher-search-rate-when-added-final-data-node-to-cluster/302912)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 10\ **Last updated:** [May 17, 2022, 7:32am UTC](https://discuss.elastic.co/t/higher-search-rate-when-added-final-data-node-to-cluster/302912 "2022-05-17T07:32:39Z")
We've got a 5 data node v.6.8.23 cluster in production, that seems to increase search rate and cpu usage when the fifth node (exrhel0212) has joined the cluster, running on four nodes cluster is much calmer. Hints on ho… --- ## [Add a field when a match between an external dictionary and a field from a filebeat document occurrs](https://discuss.elastic.co/t/add-a-field-when-a-match-between-an-external-dictionary-and-a-field-from-a-filebeat-document-occurrs/304894)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 0\ **Last updated:** [May 17, 2022, 7:23am UTC](https://discuss.elastic.co/t/add-a-field-when-a-match-between-an-external-dictionary-and-a-field-from-a-filebeat-document-occurrs/304894 "2022-05-17T07:23:55Z")
Hi, in filebeat can I add a field when a match between an external dictionary and a field from a filebeat document occurrs? Im already doing this with an ingest pipeline and an enrich proccesor, but the ingestion is to … --- ## [Filebeat doesnt capture log file \[8.2\]](https://discuss.elastic.co/t/filebeat-doesnt-capture-log-file-8-2/304889)
**Author:** [@adliazaddin](https://discuss.elastic.co/u/adliazaddin)\ **Replies:** 0\ **Last updated:** [May 17, 2022, 6:33am UTC](https://discuss.elastic.co/t/filebeat-doesnt-capture-log-file-8-2/304889 "2022-05-17T06:33:40Z")
Hello, my filebeat doesnt seem to collect my logs (i have multiple source, and filebeat only capture the most bottom part. and adding file in the module.d doesnt capture either) theres nothing on the filebeat log below… --- ## [Unable to load elasticsearch certificate](https://discuss.elastic.co/t/unable-to-load-elasticsearch-certificate/304821)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 3\ **Last updated:** [May 17, 2022, 6:18am UTC](https://discuss.elastic.co/t/unable-to-load-elasticsearch-certificate/304821 "2022-05-17T06:18:26Z")
Hello team, I am getting below error on while running Elasticsearch. I have added new certificate and error start coming. \[2022-05-16T11:32:39,322\]\[ERROR\]\[o.e.b.ElasticsearchUncaughtExceptionHandler\] \[as-dev-2\] uncaugh… --- ## [Default TimeZone](https://discuss.elastic.co/t/default-timezone/304729)
**Author:** [@M.Naim](https://discuss.elastic.co/u/M.Naim)\ **Replies:** 12\ **Last updated:** [May 17, 2022, 5:18am UTC](https://discuss.elastic.co/t/default-timezone/304729 "2022-05-17T05:18:19Z")
Hi, I am getting issue in Timezone while Querying data on stored index. Issue: We have Dates stored like "2021-10-04T11:11:27-07:00" on server "GMT" but while pulling Data using Aggr it gets converted to "2021-10-04T18… --- ## [Error module logstash with metricbeat](https://discuss.elastic.co/t/error-module-logstash-with-metricbeat/304831)
**Author:** [@jojodd](https://discuss.elastic.co/u/jojodd)\ **Replies:** 1\ **Last updated:** [May 17, 2022, 2:09am UTC](https://discuss.elastic.co/t/error-module-logstash-with-metricbeat/304831 "2022-05-17T02:09:06Z")
I don't understand why I get this error after configuring the logstash module in metricbeat. logstash.node\_stats: json: cannot unmarshal object into Go struct field --- ## [How to switch from Kibana dashboard to Elastic dashboard](https://discuss.elastic.co/t/how-to-switch-from-kibana-dashboard-to-elastic-dashboard/304876)
**Author:** [@amenbs](https://discuss.elastic.co/u/amenbs)\ **Replies:** 6\ **Last updated:** [May 17, 2022, 1:04am UTC](https://discuss.elastic.co/t/how-to-switch-from-kibana-dashboard-to-elastic-dashboard/304876 "2022-05-17T01:04:11Z")
I have Elasticsearch , Logstash and Kibana version 6.8 on centos 7 VM and i want to access to elastic dashboard but every time i go to ip:5601 Kibana dashboard opens. what should i do to access this dashboard : this … --- ## [Kibana + Elasticsearch add active directory](https://discuss.elastic.co/t/kibana-elasticsearch-add-active-directory/304834)
**Author:** [@Dmitrymig](https://discuss.elastic.co/u/Dmitrymig)\ **Replies:** 1\ **Last updated:** [May 17, 2022, 12:30am UTC](https://discuss.elastic.co/t/kibana-elasticsearch-add-active-directory/304834 "2022-05-17T00:30:11Z")
hello guys, I've been trying to set up authorization for a domain controller for a very long time and everything has failed, I've read a lot of topics and can't find an answer, help me) telnet domain:389 successful log… --- ## [Logstash Docker Container Syslog input](https://discuss.elastic.co/t/logstash-docker-container-syslog-input/304874)
**Author:** [@doublejz](https://discuss.elastic.co/u/doublejz)\ **Replies:** 2\ **Last updated:** [May 16, 2022, 10:30pm UTC](https://discuss.elastic.co/t/logstash-docker-container-syslog-input/304874 "2022-05-16T22:30:18Z")
I've been fighting this the last couple days and well, I give up and need help. So I have an ELK stack docker setup and I'm simply trying to setup logstash to accept syslog directly to it. I pictured random port 5514 and… --- ## [Filebeat Azure Module - Config without Storage Account](https://discuss.elastic.co/t/filebeat-azure-module-config-without-storage-account/304878)
**Author:** [@bashurst](https://discuss.elastic.co/u/bashurst)\ **Replies:** 0\ **Last updated:** [May 16, 2022, 10:14pm UTC](https://discuss.elastic.co/t/filebeat-azure-module-config-without-storage-account/304878 "2022-05-16T22:14:14Z")
For one of our use cases we are looking to setup a filebeats azure module to pull without using a storage account. As the storage account is only used to hold the pointer and we can handle our own splitting of the refer… --- ## [Disable authentification for elasticsearch](https://discuss.elastic.co/t/disable-authentification-for-elasticsearch/304862)
**Author:** [@Ines\_ZAYANI](https://discuss.elastic.co/u/Ines_ZAYANI)\ **Replies:** 7\ **Last updated:** [May 16, 2022, 10:03pm UTC](https://discuss.elastic.co/t/disable-authentification-for-elasticsearch/304862 "2022-05-16T22:03:32Z")
hi everyone, can i delete my user elastic and the password and make kibana and elastic accessible without any authentication needed. if so send me an article or a tutorial, thanks. --- ## [Can filebeat ingest a JSON-format file as a single document?](https://discuss.elastic.co/t/can-filebeat-ingest-a-json-format-file-as-a-single-document/304872)
**Author:** [@kmp](https://discuss.elastic.co/u/kmp)\ **Replies:** 0\ **Last updated:** [May 16, 2022, 9:29pm UTC](https://discuss.elastic.co/t/can-filebeat-ingest-a-json-format-file-as-a-single-document/304872 "2022-05-16T21:29:11Z")
I'm guessing this is really simple or ... not so much: we have an application deployed on a number of hosts that has a configuration file in JSON. We'd like to ingest the file as a single document using filebeat, in or… --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/303491)
**Author:** [@MAD\_MIkE](https://discuss.elastic.co/u/MAD_MIkE)\ **Replies:** 6\ **Last updated:** [May 16, 2022, 7:32pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/303491 "2022-05-16T19:32:11Z")
In order to install ELK in offline mode. I download all three rm package of Elasticsearch, kibana, logstash version 8.1.3 Elasticsearchsearch is installed successefully and service is running. Kibana is installed eithe… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=936) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=938)