# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=946 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 947 --- ## [Why is Kibana page refreshing/reloading after few minutes?](https://discuss.elastic.co/t/why-is-kibana-page-refreshing-reloading-after-few-minutes/304045)
**Author:** [@NadyLeez123](https://discuss.elastic.co/u/NadyLeez123)\ **Replies:** 2\ **Last updated:** [May 9, 2022, 6:13pm UTC](https://discuss.elastic.co/t/why-is-kibana-page-refreshing-reloading-after-few-minutes/304045 "2022-05-09T18:13:23Z")
Hi! We just upgraded kibana from 7.6.2 to 7.15.1. We noticed that the kibana page is refreshing/reloading every 1,2 or 3 minutes. Any idea about? I’m not finding any topic related to that. Thanks --- ## [How to perform a search query on an indexed document using Java](https://discuss.elastic.co/t/how-to-perform-a-search-query-on-an-indexed-document-using-java/304259)
**Author:** [@Tasdiq\_Shaikh](https://discuss.elastic.co/u/Tasdiq_Shaikh)\ **Replies:** 5\ **Last updated:** [May 9, 2022, 4:30pm UTC](https://discuss.elastic.co/t/how-to-perform-a-search-query-on-an-indexed-document-using-java/304259 "2022-05-09T16:30:40Z")
Hello, I'm using Elasticsearch 17.12.0 and Java 1.8. I am able to perform a search operation on an indexed document via Kibana, I want to know how I can perform this task using my Java Springboot app which is already c… --- ## [How to use variable in canvas](https://discuss.elastic.co/t/how-to-use-variable-in-canvas/303842)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 1\ **Last updated:** [May 9, 2022, 3:05pm UTC](https://discuss.elastic.co/t/how-to-use-variable-in-canvas/303842 "2022-05-09T15:05:12Z")
Hi, I am trying to use canvas variable's within ESQL query and cannot work out the syntax, I have it working within Markdown but cannot work it out within my query, I've searched the support and discuss and tried a numb… --- ## [\[Bucket max\] cardinality estimate required for \[influencers\] \[host.name\] but not supplied](https://discuss.elastic.co/t/bucket-max-cardinality-estimate-required-for-influencers-host-name-but-not-supplied/304103)
**Author:** [@anddam](https://discuss.elastic.co/u/anddam)\ **Replies:** 11\ **Last updated:** [May 9, 2022, 3:44pm UTC](https://discuss.elastic.co/t/bucket-max-cardinality-estimate-required-for-influencers-host-name-but-not-supplied/304103 "2022-05-09T15:44:39Z")
I'm currently setting up a machine learning job to detect rare events for host names. However I get the following error on the validation page of the job: This is the full error: { "statusCode": 400, "error": "B… --- ## [Java multiline stack trace log shipping with filebeat](https://discuss.elastic.co/t/java-multiline-stack-trace-log-shipping-with-filebeat/304170)
**Author:** [@Alireza\_Zabihi](https://discuss.elastic.co/u/Alireza_Zabihi)\ **Replies:** 5\ **Last updated:** [May 9, 2022, 2:43pm UTC](https://discuss.elastic.co/t/java-multiline-stack-trace-log-shipping-with-filebeat/304170 "2022-05-09T14:43:56Z")
Hi, Please help me for creating a pattern for this log \[2022-05-07 13:20:53,621\] \[WARN\] \[gateway\_service\] \[reactor.util.Loggers$Slf4JLogger\] \[warn:295\] message: \[b17d8e8c-1, L:/192.168.149.185:33094 - R:orderscl.sepanta… --- ## [JSON codec plugin - target option (http input)](https://discuss.elastic.co/t/json-codec-plugin-target-option-http-input/304217)
**Author:** [@sectex](https://discuss.elastic.co/u/sectex)\ **Replies:** 4\ **Last updated:** [May 9, 2022, 3:12pm UTC](https://discuss.elastic.co/t/json-codec-plugin-target-option-http-input/304217 "2022-05-09T15:12:02Z")
I am having some issues using the JSON codec plugin in my Logstash (v8.1.2) pipeline. pipeline.conf: input { http { codec =\> json port =\> 5046 } } output { stdout { codec =\> rubydebu… --- ## [Logstash ECS Compatiblity Issues](https://discuss.elastic.co/t/logstash-ecs-compatiblity-issues/304260)
**Author:** [@teamomni](https://discuss.elastic.co/u/teamomni)\ **Replies:** 5\ **Last updated:** [May 9, 2022, 2:54pm UTC](https://discuss.elastic.co/t/logstash-ecs-compatiblity-issues/304260 "2022-05-09T14:54:16Z")
We have moved our Logstash indices to data stream recently but are having issues with the geopoints. As a result, the geofencing for everything including the Elastic agents are broken. At first there was the error: Pi… --- ## [Java API: aggregation builder for normalize aggregation](https://discuss.elastic.co/t/java-api-aggregation-builder-for-normalize-aggregation/304224)
**Author:** [@frankmontyne](https://discuss.elastic.co/u/frankmontyne)\ **Replies:** 2\ **Last updated:** [May 9, 2022, 2:43pm UTC](https://discuss.elastic.co/t/java-api-aggregation-builder-for-normalize-aggregation/304224 "2022-05-09T14:43:51Z")
I'm using the Elasticsearch 7.17.2 High Level REST client. I'm looking for a java builder for the normalize aggregation (Normalize aggregation | Elasticsearch Guide \[7.17\] | Elastic) I can't find a builder for it. Is th… --- ## [Filebeat 8.1.1 Custom Index](https://discuss.elastic.co/t/filebeat-8-1-1-custom-index/302736)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 4\ **Last updated:** [May 9, 2022, 2:25pm UTC](https://discuss.elastic.co/t/filebeat-8-1-1-custom-index/302736 "2022-05-09T14:25:16Z")
So the same index that has worked for over a year now seems to have stopped when we moved to Elasticsearch v8. Custom index for filebeat. filebeat.inputs: - type: log paths: - LogPathGoeshere:Expired.csv exclude\_… --- ## [Unable to access into \ after installation of elastic search](https://discuss.elastic.co/t/unable-to-access-into-ipaddress-9200-after-installation-of-elastic-search/304019)
**Author:** [@fanfan01127](https://discuss.elastic.co/u/fanfan01127)\ **Replies:** 7\ **Last updated:** [May 9, 2022, 1:53pm UTC](https://discuss.elastic.co/t/unable-to-access-into-ipaddress-9200-after-installation-of-elastic-search/304019 "2022-05-09T13:53:30Z")
Installed version: Elasticsearch-8.2.0 OS: RedHat 8.2 on Azure Hello all I am a new starter to use Elasticsearch and linux. Just tried to install the Elasticsearch 8.2. After I configured the yml file, allow the fir… --- ## [Unable to add tag with filename](https://discuss.elastic.co/t/unable-to-add-tag-with-filename/304113)
**Author:** [@Fico125](https://discuss.elastic.co/u/Fico125)\ **Replies:** 4\ **Last updated:** [May 9, 2022, 1:50pm UTC](https://discuss.elastic.co/t/unable-to-add-tag-with-filename/304113 "2022-05-09T13:50:37Z")
Hey everyone, I'm quite stuck trying to add a custom field to my parsed data. Basically, I have a path from where I'm reading the content of csv files, and sending it to elastic. I'd like that content of .csv files rece… --- ## [Remove\_Field json path on logstash](https://discuss.elastic.co/t/remove-field-json-path-on-logstash/304146)
**Author:** [@adxalex](https://discuss.elastic.co/u/adxalex)\ **Replies:** 5\ **Last updated:** [May 9, 2022, 1:44pm UTC](https://discuss.elastic.co/t/remove-field-json-path-on-logstash/304146 "2022-05-09T13:44:52Z")
Hi comunity, I'm trying to remove some fileds into a json. The json is: {"recode":"VZ##","response-code":"4000","response":{"result":\[{"DetailsPageURL":"idsource":"0""Attribute":\[{"DISPLAYNAME":"Tiempo de respuesta ser… --- ## [ECS compatibility target info message](https://discuss.elastic.co/t/ecs-compatibility-target-info-message/304244)
**Author:** [@thibveni](https://discuss.elastic.co/u/thibveni)\ **Replies:** 1\ **Last updated:** [May 9, 2022, 1:28pm UTC](https://discuss.elastic.co/t/ecs-compatibility-target-info-message/304244 "2022-05-09T13:28:46Z")
Hello, i'm using logstash in v8.1.3 and since the upgrade in v8 i have this info message: logstash\_1 | \[2022-05-09T09:57:59,861\]\[INFO \]\[logstash.codecs.jsonlines\] ECS compatibility is enabled but \`target\` option was no… --- ## [Can't find elasticsearch.yml](https://discuss.elastic.co/t/cant-find-elasticsearch-yml/304177)
**Author:** [@safaeaz](https://discuss.elastic.co/u/safaeaz)\ **Replies:** 4\ **Last updated:** [May 9, 2022, 1:17pm UTC](https://discuss.elastic.co/t/cant-find-elasticsearch-yml/304177 "2022-05-09T13:17:57Z")
i installed elk using docker compose my kibana works well but elasticsarch and logstash doesn't work and i cant find Elasticsearch.yml and logstash.yml to chande configuration and see what's the probleme --- ## [Azure Module - Multiple event hubs?](https://discuss.elastic.co/t/azure-module-multiple-event-hubs/303850)
**Author:** [@chris.murray](https://discuss.elastic.co/u/chris.murray)\ **Replies:** 11\ **Last updated:** [May 9, 2022, 12:57pm UTC](https://discuss.elastic.co/t/azure-module-multiple-event-hubs/303850 "2022-05-09T12:57:26Z")
Can't seem to find a solution for this. Here's the situation: I am setting up a PoC environment, which has two Azure event hubs configured to input Azure AD data (which themselves are coming from separate environments)… --- ## [Error at IndexDocument()](https://discuss.elastic.co/t/error-at-indexdocument/304131)
**Author:** [@frankmehlhop](https://discuss.elastic.co/u/frankmehlhop)\ **Replies:** 1\ **Last updated:** [May 9, 2022, 12:52pm UTC](https://discuss.elastic.co/t/error-at-indexdocument/304131 "2022-05-09T12:52:36Z")
I want to inject a data set using C# and elastic + kibana version 8.x. On console at Kibana it works fine. At the C# code at the indexResponse I get the error message: The client is unable to verify that the server i… --- ## [Timeout in Logstash Elasticsearch Filter and Elasticsearch Output](https://discuss.elastic.co/t/timeout-in-logstash-elasticsearch-filter-and-elasticsearch-output/304253)
**Author:** [@sagarpatel](https://discuss.elastic.co/u/sagarpatel)\ **Replies:** 0\ **Last updated:** [May 9, 2022, 12:46pm UTC](https://discuss.elastic.co/t/timeout-in-logstash-elasticsearch-filter-and-elasticsearch-output/304253 "2022-05-09T12:46:00Z")
Elasticsearch version: 7.16 (running as elastic cloud) Logstash version: 7.16 I am using http\_poller input plugin which is scheduled every 15 mins. Based on the http\_poller API response I need to execute Elasticsearch … --- ## [How to start a machine learning job to check if a user starts an application they normally do not use with Kibana](https://discuss.elastic.co/t/how-to-start-a-machine-learning-job-to-check-if-a-user-starts-an-application-they-normally-do-not-use-with-kibana/304094)
**Author:** [@anddam](https://discuss.elastic.co/u/anddam)\ **Replies:** 9\ **Last updated:** [May 9, 2022, 11:44am UTC](https://discuss.elastic.co/t/how-to-start-a-machine-learning-job-to-check-if-a-user-starts-an-application-they-normally-do-not-use-with-kibana/304094 "2022-05-09T11:44:22Z")
I am trying to set up a machine learning job to detect when non admin users who normally do not use powershell start powershell. I already saved a search function that shows powershell started logs, and filters the unim… --- ## [Transform -\> Field Extraction Example to GroupBy](https://discuss.elastic.co/t/transform-field-extraction-example-to-groupby/304155)
**Author:** [@lupolo](https://discuss.elastic.co/u/lupolo)\ **Replies:** 2\ **Last updated:** [May 9, 2022, 11:50am UTC](https://discuss.elastic.co/t/transform-field-extraction-example-to-groupby/304155 "2022-05-09T11:50:32Z")
Under a transform query one of the results I get is this key value pair :"request\_User-Agent": "idType=drwet; rmtSVer=2.2.2.4; wqHVer=2.3.2.0; idName=swawsw; idRolt=2.85T", I would like to "group\_by" stbName . Could s… --- ## [Download CSV numeric format issue](https://discuss.elastic.co/t/download-csv-numeric-format-issue/304193)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 2\ **Last updated:** [May 9, 2022, 11:44am UTC](https://discuss.elastic.co/t/download-csv-numeric-format-issue/304193 "2022-05-09T11:44:39Z")
Hi all, After creating a data table in kibana with appropriate fields, when I download CSV report, I see numeric values in report be given as 8.1E+11. When I expand the column size , then too the values remains as 8.1E… --- ## [Use Yara custom rules with Osquery-Manager](https://discuss.elastic.co/t/use-yara-custom-rules-with-osquery-manager/302789)
**Author:** [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\ **Replies:** 6\ **Last updated:** [May 9, 2022, 11:23am UTC](https://discuss.elastic.co/t/use-yara-custom-rules-with-osquery-manager/302789 "2022-05-09T11:23:00Z")
Hello Team, Is It possible to use yara custom rules with osquery manager integration ?? I'm using version 7.17.1 Many thanks. --- ## [How to store .pdf or .txt file and search in it using Java](https://discuss.elastic.co/t/how-to-store-pdf-or-txt-file-and-search-in-it-using-java/304025)
**Author:** [@Tasdiq\_Shaikh](https://discuss.elastic.co/u/Tasdiq_Shaikh)\ **Replies:** 8\ **Last updated:** [May 9, 2022, 11:03am UTC](https://discuss.elastic.co/t/how-to-store-pdf-or-txt-file-and-search-in-it-using-java/304025 "2022-05-09T11:03:21Z")
I am trying to save and search a .txt and .pdf file in Elasticsearch using Java code. Maybe i'm able to save the file but unable to fetch it. My controller @GetMapping("/finals") public String trail1() throws IOExcept… --- ## [Winlogbeat output kafka, but not same fields as Elastic output](https://discuss.elastic.co/t/winlogbeat-output-kafka-but-not-same-fields-as-elastic-output/304226)
**Author:** [@CemG](https://discuss.elastic.co/u/CemG)\ **Replies:** 0\ **Last updated:** [May 9, 2022, 9:00am UTC](https://discuss.elastic.co/t/winlogbeat-output-kafka-but-not-same-fields-as-elastic-output/304226 "2022-05-09T09:00:50Z")
Hello, I get Windows logs with Winlogbeat, and I output them to Kafka. The issue is that when I use Winlogbeat dashboard in Elasticsearch, there are missing fields, and I would like to use them. And when I use Elastic… --- ## [How to add certs to hearbeat](https://discuss.elastic.co/t/how-to-add-certs-to-hearbeat/303554)
**Author:** [@Francisco\_Yanez](https://discuss.elastic.co/u/Francisco_Yanez)\ **Replies:** 9\ **Last updated:** [May 9, 2022, 8:48am UTC](https://discuss.elastic.co/t/how-to-add-certs-to-hearbeat/303554 "2022-05-09T08:48:45Z")
Hello Community, I am trying to add to heartbeat (all our infra is running in kubernetes) all our pods that have certs so we can monitor those via https and alert when is time to renew them. To access those via http I n… --- ## [How to remove fields exist in \_source array field using logstash filter](https://discuss.elastic.co/t/how-to-remove-fields-exist-in-source-array-field-using-logstash-filter/303350)
**Author:** [@Magesh\_02](https://discuss.elastic.co/u/Magesh_02)\ **Replies:** 1\ **Last updated:** [May 9, 2022, 8:39am UTC](https://discuss.elastic.co/t/how-to-remove-fields-exist-in-source-array-field-using-logstash-filter/303350 "2022-05-09T08:39:14Z")
I'm trying to use a logstash filter to remove unwanted fields from the \_source field, but the data isn't being sent to ES. filter { mutate { remove\_field =\> \[ "path", "host","@version","@timestamp","type"\] … --- ## [Filebeat not close delete filehandler](https://discuss.elastic.co/t/filebeat-not-close-delete-filehandler/304221)
**Author:** [@mvasilenko](https://discuss.elastic.co/u/mvasilenko)\ **Replies:** 0\ **Last updated:** [May 9, 2022, 8:32am UTC](https://discuss.elastic.co/t/filebeat-not-close-delete-filehandler/304221 "2022-05-09T08:32:22Z")
we are running filebeat 6.8.22 with inputs as docker containers and it doesn't release file handlers for deleted files filebeat.inputs: - type: docker close\_inactive: 5m close\_removed: true clean\_removed: true c… --- ## [Loading unstructured data](https://discuss.elastic.co/t/loading-unstructured-data/304212)
**Author:** [@Naga\_Prudhvi](https://discuss.elastic.co/u/Naga_Prudhvi)\ **Replies:** 2\ **Last updated:** [May 9, 2022, 8:25am UTC](https://discuss.elastic.co/t/loading-unstructured-data/304212 "2022-05-09T08:25:33Z")
I am getting error while loading below line in elastic using gork filter 192.168.72.177 - - \[22/Dec/2002:23:32:14 -0400\] "GET /news/sports.html HTTP/1.1" 200 3500 www.yahoo.com "http://www.some.com/" "Mozilla/4.0 (com… --- ## [Filebeat can not collect logs data from mounted disk](https://discuss.elastic.co/t/filebeat-can-not-collect-logs-data-from-mounted-disk/303134)
**Author:** [@sahinguler](https://discuss.elastic.co/u/sahinguler)\ **Replies:** 5\ **Last updated:** [May 9, 2022, 8:04am UTC](https://discuss.elastic.co/t/filebeat-can-not-collect-logs-data-from-mounted-disk/303134 "2022-05-09T08:04:04Z")
Hi all, I used filebeat for collecting my logs and my filebeat version is 7.16.3. When I collect my logs from /var/lib/docker/containers/${data.docker.container.id}/\*.log, logs were collected. If I used /mnt/.. (my mou… --- ## [Fleet agent upgrade fails 8.1.2](https://discuss.elastic.co/t/fleet-agent-upgrade-fails-8-1-2/302970)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 12\ **Last updated:** [May 9, 2022, 8:12am UTC](https://discuss.elastic.co/t/fleet-agent-upgrade-fails-8-1-2/302970 "2022-05-09T08:12:41Z")
After the stack upgrade to the latest 8.1.3 the agents are unable to upgrade error: failed verification of agent binary: 2 errors occurred:\\n\\t\* fetching asc file from 'C:\\\\Program Files\\\\Elastic\\\\Agent\\\\data\\\\elastic-… --- ## [Date histogram on objects with a start and end time](https://discuss.elastic.co/t/date-histogram-on-objects-with-a-start-and-end-time/303290)
**Author:** [@Griffures](https://discuss.elastic.co/u/Griffures)\ **Replies:** 5\ **Last updated:** [May 9, 2022, 8:05am UTC](https://discuss.elastic.co/t/date-histogram-on-objects-with-a-start-and-end-time/303290 "2022-05-09T08:05:44Z")
Hello everyone, first time poster here. Please make me aware of any mishaps I might have done. I'll use a specific usecase to illustrate my question, but I would love a more general answer as I just got into Kibana. El… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=945) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=947)