# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=949 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 950 --- ## [Output elasticsearch of filebeat](https://discuss.elastic.co/t/output-elasticsearch-of-filebeat/304075)
**Author:** [@zfx](https://discuss.elastic.co/u/zfx)\ **Replies:** 6\ **Last updated:** [May 6, 2022, 5:42am UTC](https://discuss.elastic.co/t/output-elasticsearch-of-filebeat/304075 "2022-05-06T05:42:58Z")
If I want to use filebeat of metadata fields to instead of es of document id. What should i d --- ## [Dictionary decompounder: only longest match doesn't work](https://discuss.elastic.co/t/dictionary-decompounder-only-longest-match-doesnt-work/303598)
**Author:** [@Arisara\_Pornwattanav](https://discuss.elastic.co/u/Arisara_Pornwattanav)\ **Replies:** 2\ **Last updated:** [May 6, 2022, 5:29am UTC](https://discuss.elastic.co/t/dictionary-decompounder-only-longest-match-doesnt-work/303598 "2022-05-06T05:29:34Z")
Hi I have problem with analyzer: dictionary decompounder. I need the analyzer output as the longest word that match the dictionary. So, I set the word\_list: theredapple, redapple, apple and I also set only\_longest\_matc… --- ## [Connectivity issue in Filebeat and kafka server](https://discuss.elastic.co/t/connectivity-issue-in-filebeat-and-kafka-server/304037)
**Author:** [@shivendra95](https://discuss.elastic.co/u/shivendra95)\ **Replies:** 2\ **Last updated:** [May 6, 2022, 5:17am UTC](https://discuss.elastic.co/t/connectivity-issue-in-filebeat-and-kafka-server/304037 "2022-05-06T05:17:25Z")
Hi, I'm using filebeat to send logs to Kafka topic. The source system is a server with an IP that is not static and it's an on-prem server. The destination server is a AWS Ec2 instance. Currently I'm not able to make co… --- ## [Prometheus module URL encoding](https://discuss.elastic.co/t/prometheus-module-url-encoding/304083)
**Author:** [@Yuvaraj1](https://discuss.elastic.co/u/Yuvaraj1)\ **Replies:** 0\ **Last updated:** [May 6, 2022, 4:12am UTC](https://discuss.elastic.co/t/prometheus-module-url-encoding/304083 "2022-05-06T04:12:40Z")
Version: 8.2.0 docker image The problem faced is that the url https://api.telemetry.confluent.cloud/v2/metrics/cloud/export?resource.kafka.id=AAABBBCCC when encoded ? as %3F causing a 404 error. How to pass query param… --- ## [Logs are not in correct order and timestamp mismatch](https://discuss.elastic.co/t/logs-are-not-in-correct-order-and-timestamp-mismatch/303715)
**Author:** [@yasar](https://discuss.elastic.co/u/yasar)\ **Replies:** 2\ **Last updated:** [May 6, 2022, 4:55am UTC](https://discuss.elastic.co/t/logs-are-not-in-correct-order-and-timestamp-mismatch/303715 "2022-05-06T04:55:23Z")
Hello team, We could see the logs flowing in kibana are not in correct order if the multiple logs are having same timestamp. In below mentioned case, the timestamp of three logs were in same timestamp as "14:40:13,117" … --- ## [OCR highlighter for Alto or hOCR formats](https://discuss.elastic.co/t/ocr-highlighter-for-alto-or-hocr-formats/304051)
**Author:** [@evelix](https://discuss.elastic.co/u/evelix)\ **Replies:** 1\ **Last updated:** [May 6, 2022, 4:49am UTC](https://discuss.elastic.co/t/ocr-highlighter-for-alto-or-hocr-formats/304051 "2022-05-06T04:49:31Z")
We use an OCR software to extract the fulltext from scanned images in Alto or hOCR format. These formats basically know the coordinates of each word on the scanned image. When doing a search against the fulltext, a requ… --- ## [Index Lifecycle Rollover Alias is Empty in Winlogbeat Indices](https://discuss.elastic.co/t/index-lifecycle-rollover-alias-is-empty-in-winlogbeat-indices/302415)
**Author:** [@wcpoon](https://discuss.elastic.co/u/wcpoon)\ **Replies:** 5\ **Last updated:** [May 6, 2022, 2:11am UTC](https://discuss.elastic.co/t/index-lifecycle-rollover-alias-is-empty-in-winlogbeat-indices/302415 "2022-05-06T02:11:54Z")
Hi, I'm having below errors "index.lifecycle.rollover\_alias" in winlogbeats indices. Index lifecycle error illegal\_argument\_exception: setting \[index.lifecycle.rollover\_alias\] for index \[winlogbeat-8.1.2-2022.04.14\] is… --- ## [What does this alert mean and how to prevent it?](https://discuss.elastic.co/t/what-does-this-alert-mean-and-how-to-prevent-it/304060)
**Author:** [@rgelb](https://discuss.elastic.co/u/rgelb)\ **Replies:** 2\ **Last updated:** [May 6, 2022, 12:46am UTC](https://discuss.elastic.co/t/what-does-this-alert-mean-and-how-to-prevent-it/304060 "2022-05-06T00:46:54Z")
Every day there is this alert: I then click on the Allocate missing replica shards which takes me to the Indices view (e.g. Monitoring/Indices). It says Unassigned Shards: 0, which makes sense since the alert says th… --- ## [Filebeat on RHEL7: Docker input not showing up in Kibana](https://discuss.elastic.co/t/filebeat-on-rhel7-docker-input-not-showing-up-in-kibana/303869)
**Author:** [@paolovalladolid](https://discuss.elastic.co/u/paolovalladolid)\ **Replies:** 3\ **Last updated:** [May 5, 2022, 10:56pm UTC](https://discuss.elastic.co/t/filebeat-on-rhel7-docker-input-not-showing-up-in-kibana/303869 "2022-05-05T22:56:53Z")
I first set up and installed Filebeat, using RPM, on a Red Hat Linux VM with a plain filestream input, with path set to /var/log/redist\_6379.log. I then ran sudo service filebeat start and verified I can see log output … --- ## [Upgrade to Version 8](https://discuss.elastic.co/t/upgrade-to-version-8/304052)
**Author:** [@norgro2601](https://discuss.elastic.co/u/norgro2601)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 10:47pm UTC](https://discuss.elastic.co/t/upgrade-to-version-8/304052 "2022-05-05T22:47:59Z")
Hello, I want to upgrade the Elastic Stack to Version 8. Because we have some AIX Servers in our environment, I used the Beats that were made available by Bull Freeware some years ago and are running version 7.5.x. As … --- ## [Logstash s3 error Failed to open TCP connection](https://discuss.elastic.co/t/logstash-s3-error-failed-to-open-tcp-connection/304068)
**Author:** [@swev](https://discuss.elastic.co/u/swev)\ **Replies:** 0\ **Last updated:** [May 5, 2022, 9:01pm UTC](https://discuss.elastic.co/t/logstash-s3-error-failed-to-open-tcp-connection/304068 "2022-05-05T21:01:27Z")
I have been trying to get the s3 plugin to work have been running into issues connecting to the url. The interest part is the url it reports in the error message is missing the region, which was referenced in the endpo… --- ## [Get consolidated schema of multiple indices in ES](https://discuss.elastic.co/t/get-consolidated-schema-of-multiple-indices-in-es/304061)
**Author:** [@newelastic](https://discuss.elastic.co/u/newelastic)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 8:25pm UTC](https://discuss.elastic.co/t/get-consolidated-schema-of-multiple-indices-in-es/304061 "2022-05-05T20:25:38Z")
Hello, I've multiple indices in Elasticsearch that has similar data. But, each index has new properties added/removed over the period of time. Is there any way to fetch union of all indices schema using KQL? For exampl… --- ## [Document contains at least one immense term error](https://discuss.elastic.co/t/document-contains-at-least-one-immense-term-error/304057)
**Author:** [@VV1002](https://discuss.elastic.co/u/VV1002)\ **Replies:** 2\ **Last updated:** [May 5, 2022, 8:25pm UTC](https://discuss.elastic.co/t/document-contains-at-least-one-immense-term-error/304057 "2022-05-05T20:25:25Z")
Hi, I am trying to add some data to ES using javascript client, I am getting this error ResponseError: illegal\_argument\_exception: \[illegal\_argument\_exception\] Reason: Document contains at least one immense term in fi… --- ## [Udp - Exception in inputworker - Logstash (7.4.2) with netflow plugin](https://discuss.elastic.co/t/udp-exception-in-inputworker-logstash-7-4-2-with-netflow-plugin/304056)
**Author:** [@gurumu](https://discuss.elastic.co/u/gurumu)\ **Replies:** 2\ **Last updated:** [May 5, 2022, 7:58pm UTC](https://discuss.elastic.co/t/udp-exception-in-inputworker-logstash-7-4-2-with-netflow-plugin/304056 "2022-05-05T19:58:39Z")
\[ERROR\] 2022-05-05 09:24:32.009 \[\java.lang.NullPointerException, "backtrace"=\>\["org.jruby.runtime.invokedynamic.InvokeDynamicSupport.callMethodMissing(InvokeDynamicSup… --- ## [Logstash s3 input plugin not working without prefix](https://discuss.elastic.co/t/logstash-s3-input-plugin-not-working-without-prefix/304067)
**Author:** [@sindhu\_vutukuri](https://discuss.elastic.co/u/sindhu_vutukuri)\ **Replies:** 0\ **Last updated:** [May 5, 2022, 7:47pm UTC](https://discuss.elastic.co/t/logstash-s3-input-plugin-not-working-without-prefix/304067 "2022-05-05T19:47:19Z")
I am trying to ingest msk logs from s3 bucket to Elasticsearch via logstash input s3 plugin. S3 bucket holds multiple msk cluster logs. Here is my logstash input config input { s3 { "region" =\> "{{ … --- ## [Query regarding split function and conditionality](https://discuss.elastic.co/t/query-regarding-split-function-and-conditionality/303944)
**Author:** [@ianrobo](https://discuss.elastic.co/u/ianrobo)\ **Replies:** 7\ **Last updated:** [May 5, 2022, 7:06pm UTC](https://discuss.elastic.co/t/query-regarding-split-function-and-conditionality/303944 "2022-05-05T19:06:06Z")
Hi, I am a fairly new user to elastic and trying to develop an ingest pipeline to process Cisco logs. The format of the log is that the log.source.address is 1.1.1.1: I am using the split function to delimit on : and … --- ## [Update/Upgrade?](https://discuss.elastic.co/t/update-upgrade/304059)
**Author:** [@jumpie](https://discuss.elastic.co/u/jumpie)\ **Replies:** 5\ **Last updated:** [May 5, 2022, 5:55pm UTC](https://discuss.elastic.co/t/update-upgrade/304059 "2022-05-05T17:55:57Z")
I don't see directions on how to update/upgrade Elastic. I see 8.2 came out for Linux. --- ## [ILM not deleting upcoming indices(ILM not working)](https://discuss.elastic.co/t/ilm-not-deleting-upcoming-indices-ilm-not-working/303009)
**Author:** [@jisha](https://discuss.elastic.co/u/jisha)\ **Replies:** 4\ **Last updated:** [May 5, 2022, 5:35pm UTC](https://discuss.elastic.co/t/ilm-not-deleting-upcoming-indices-ilm-not-working/303009 "2022-05-05T17:35:06Z")
Hi, I am using elk 8.0.0v in windows. Data deletion of upcoming indices is not happening for the time duration setted in ILM (ex:5mints (for testing purpose)).I have created ILM template and assigned metricbeat 8.0.0. T… --- ## [Logstash user permissions](https://discuss.elastic.co/t/logstash-user-permissions/304049)
**Author:** [@ksobon](https://discuss.elastic.co/u/ksobon)\ **Replies:** 5\ **Last updated:** [May 5, 2022, 5:25pm UTC](https://discuss.elastic.co/t/logstash-user-permissions/304049 "2022-05-05T17:25:06Z")
I have configured a "logstash" user with the following set of permissions: "{ "indices": \[{ "names": \["\*beat\*"\], "privileges": \["create", "create\_index", "view\_index\_metadata"\] } \] }" That however results in … --- ## [How to change style for kibana widgets](https://discuss.elastic.co/t/how-to-change-style-for-kibana-widgets/303994)
**Author:** [@kashifqazi](https://discuss.elastic.co/u/kashifqazi)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 5:04pm UTC](https://discuss.elastic.co/t/how-to-change-style-for-kibana-widgets/303994 "2022-05-05T17:04:20Z")
How to change style(Like colour font etc) of kibana widgets like pie chart bar chart etc. --- ## [Elasticsearch Query Rule Group By](https://discuss.elastic.co/t/elasticsearch-query-rule-group-by/303314)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 0\ **Last updated:** [April 26, 2022, 6:03pm UTC](https://discuss.elastic.co/t/elasticsearch-query-rule-group-by/303314 "2022-04-26T18:03:52Z")
Hi All, (Elasticsearch & Kibana 7.17.2) I'm trying to create an Elasticsearch query rule in Kibana observability which group bys a concept. I have the following rule configured: Index: synthetics-\* Size: 100 { "ag… --- ## [Can't query by IDs using logstash-filter-elasticserach](https://discuss.elastic.co/t/cant-query-by-ids-using-logstash-filter-elasticserach/304024)
**Author:** [@Gerard\_Purra](https://discuss.elastic.co/u/Gerard_Purra)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 4:09pm UTC](https://discuss.elastic.co/t/cant-query-by-ids-using-logstash-filter-elasticserach/304024 "2022-05-05T16:09:11Z")
Hey folks, I’m using the logstash-filter-elasticsearch and I’d like to query using IDs (IDs | Elasticsearch Guide \[8.2\] | Elastic), and I find myself unable. Does anyone have any idea on how to work around that? The pr… --- ## [Logstash Input-Path as Index](https://discuss.elastic.co/t/logstash-input-path-as-index/304030)
**Author:** [@Robsen\_Inc](https://discuss.elastic.co/u/Robsen_Inc)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 4:06pm UTC](https://discuss.elastic.co/t/logstash-input-path-as-index/304030 "2022-05-05T16:06:36Z")
Hi Community, I would like to use the Path as an index. The question has been asked many times in different forums, but unfortunately the solutions presented do not work for me. Maybe you can help me. Specifically, I… --- ## [Grok ignore possible extra word/text at end of the line?](https://discuss.elastic.co/t/grok-ignore-possible-extra-word-text-at-end-of-the-line/304026)
**Author:** [@tjswe](https://discuss.elastic.co/u/tjswe)\ **Replies:** 3\ **Last updated:** [May 5, 2022, 4:03pm UTC](https://discuss.elastic.co/t/grok-ignore-possible-extra-word-text-at-end-of-the-line/304026 "2022-05-05T16:03:48Z")
Slightly embarrassed, but i can not find the answer of a what feels like simple question. Data looks like this ABC WORD1 DEF WORD2 GHI WORD3 or ABC WORD1 DEF WORD2 GHI WORD3 (nonimportanttext) This below works with … --- ## [Change Text mapping to Double/Number](https://discuss.elastic.co/t/change-text-mapping-to-double-number/304047)
**Author:** [@AmyMCollins](https://discuss.elastic.co/u/AmyMCollins)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 3:58pm UTC](https://discuss.elastic.co/t/change-text-mapping-to-double-number/304047 "2022-05-05T15:58:03Z")
Hi, I need to change the mapping of a field 'AmountExcVat' from Text to double. I have tried: but I am getting the following error: Can someone help me please? Thanks in advance, Amy --- ## [setCustomContext not showing data after upgrade from 7.9 to 8.1.2](https://discuss.elastic.co/t/setcustomcontext-not-showing-data-after-upgrade-from-7-9-to-8-1-2/304004)
**Author:** [@hertzden](https://discuss.elastic.co/u/hertzden)\ **Replies:** 0\ **Last updated:** [May 5, 2022, 7:56am UTC](https://discuss.elastic.co/t/setcustomcontext-not-showing-data-after-upgrade-from-7-9-to-8-1-2/304004 "2022-05-05T07:56:10Z")
We have setup custom context to fetch session FCP data for all our apps, last month we upgraded elastic version from 7.9 to 8.1.2 on 11th April, 2022. Since that date we are not able to see data in console while running … --- ## [Permission Rules for CSV Export on Basic License](https://discuss.elastic.co/t/permission-rules-for-csv-export-on-basic-license/303979)
**Author:** [@tadgh](https://discuss.elastic.co/u/tadgh)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 3:47pm UTC](https://discuss.elastic.co/t/permission-rules-for-csv-export-on-basic-license/303979 "2022-05-05T15:47:25Z")
Hey there, we run an ECK instance, which runs ES 7.16.2 However recently, users who were previously able to generate CSV reports are no longer able to generate CSV reports. We didn't upgade the stack or anything, just su… --- ## [Use Ingestion Pipeline to split between two indexes](https://discuss.elastic.co/t/use-ingestion-pipeline-to-split-between-two-indexes/303958)
**Author:** [@painless\_elastic](https://discuss.elastic.co/u/painless_elastic)\ **Replies:** 9\ **Last updated:** [May 5, 2022, 3:34pm UTC](https://discuss.elastic.co/t/use-ingestion-pipeline-to-split-between-two-indexes/303958 "2022-05-05T15:34:02Z")
I have documents containing the field "Status", this can have three values "Draft", "In Progress", or "Approved". I am trying to pass this document through a ingest pipeline, and if the status is equal to "Approved" then… --- ## [Packetbeat Version 8.2 file size](https://discuss.elastic.co/t/packetbeat-version-8-2-file-size/304053)
**Author:** [@chinaxushi](https://discuss.elastic.co/u/chinaxushi)\ **Replies:** 0\ **Last updated:** [May 5, 2022, 3:32pm UTC](https://discuss.elastic.co/t/packetbeat-version-8-2-file-size/304053 "2022-05-05T15:32:35Z")
What major changes have been made in version 8.2? The file size has changed from more than 80M in version 8.1.2 to 160M now. --- ## [Rollup job - should and minimum\_should\_match not working](https://discuss.elastic.co/t/rollup-job-should-and-minimum-should-match-not-working/303829)
**Author:** [@hunsw](https://discuss.elastic.co/u/hunsw)\ **Replies:** 5\ **Last updated:** [May 5, 2022, 3:23pm UTC](https://discuss.elastic.co/t/rollup-job-should-and-minimum-should-match-not-working/303829 "2022-05-05T15:23:05Z")
When querying rollup jobs minimum\_should\_match is not working (v7.17) making should clauses useless. Is there a fix/workaround for this? The rollup job limitations page lists compound queries explicitly as allowed ones… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=948) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=950)