# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=961 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 962 --- ## [Failing to index geo\_shape data into Elasticsearch from Logstash (nil values)](https://discuss.elastic.co/t/failing-to-index-geo-shape-data-into-elasticsearch-from-logstash-nil-values/303193)
**Author:** [@scottfred](https://discuss.elastic.co/u/scottfred)\ **Replies:** 2\ **Last updated:** [April 26, 2022, 9:22pm UTC](https://discuss.elastic.co/t/failing-to-index-geo-shape-data-into-elasticsearch-from-logstash-nil-values/303193 "2022-04-26T21:22:50Z")
I have Ruby code in Logstash that parses a CSV file and reads the data. Some fields of the data can be empty (e.g. ,,,). When the data is empty, Ruby's CSV parse converts the data to an empty string, (e.g. ""). I also… --- ## [Permission denied when starting Elasticsearch 7.17.0 installed via RPM](https://discuss.elastic.co/t/permission-denied-when-starting-elasticsearch-7-17-0-installed-via-rpm/303192)
**Author:** [@ed\_vf](https://discuss.elastic.co/u/ed_vf)\ **Replies:** 11\ **Last updated:** [April 26, 2022, 8:10pm UTC](https://discuss.elastic.co/t/permission-denied-when-starting-elasticsearch-7-17-0-installed-via-rpm/303192 "2022-04-26T20:10:31Z")
We are trying to expand our cluster size from 3 nodes to 5 nodes. After installing Elasticsearch via RPM on the new nodes we receive the following 'Permission denied' error when starting the service. \[root@host user\]# s… --- ## [How to join values from 2 different fields to one and manage it further?](https://discuss.elastic.co/t/how-to-join-values-from-2-different-fields-to-one-and-manage-it-further/303050)
**Author:** [@Stek\_new](https://discuss.elastic.co/u/Stek_new)\ **Replies:** 3\ **Last updated:** [April 26, 2022, 7:09pm UTC](https://discuss.elastic.co/t/how-to-join-values-from-2-different-fields-to-one-and-manage-it-further/303050 "2022-04-26T19:09:37Z")
Hello, I am curious if anybody faced the issue I have I have 5 documents with the following fields and values in table view: +++++++++++++++++++++++++++++++++ | src\_ch | tgt\_ch | extra\_field | ++++++++++++++++++++++++… --- ## [Attempting to Connect Fluentd with Elastic8.1.2 gives an error for Developing an ingestion pipeline](https://discuss.elastic.co/t/attempting-to-connect-fluentd-with-elastic8-1-2-gives-an-error-for-developing-an-ingestion-pipeline/301991)
**Author:** [@fallenreaper](https://discuss.elastic.co/u/fallenreaper)\ **Replies:** 5\ **Last updated:** [April 26, 2022, 6:28pm UTC](https://discuss.elastic.co/t/attempting-to-connect-fluentd-with-elastic8-1-2-gives-an-error-for-developing-an-ingestion-pipeline/301991 "2022-04-26T18:28:41Z")
So i saw the example Elastic8.1.2 cluster set up with Kibana on the website. I liked it, though i wanted to add an ingestion pipe and added a FluentD container to the mix in order to manage ingestion a bit more. The b… --- ## [How to break down a multiline entry with nested json - File input plugin](https://discuss.elastic.co/t/how-to-break-down-a-multiline-entry-with-nested-json-file-input-plugin/303245)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 4\ **Last updated:** [April 26, 2022, 6:28pm UTC](https://discuss.elastic.co/t/how-to-break-down-a-multiline-entry-with-nested-json-file-input-plugin/303245 "2022-04-26T18:28:03Z")
Hi All, I have the following multiline log in json. My setup is that I read from a file (where my events are in embedded json) and the events gets broken down (each row is a treated as a single entry) wrongly. How can… --- ## [Elasticsearch automatically closes connection as soon as I run my Java Springboot program](https://discuss.elastic.co/t/elasticsearch-automatically-closes-connection-as-soon-as-i-run-my-java-springboot-program/303069)
**Author:** [@Tasdiq\_Shaikh](https://discuss.elastic.co/u/Tasdiq_Shaikh)\ **Replies:** 7\ **Last updated:** [April 26, 2022, 3:35pm UTC](https://discuss.elastic.co/t/elasticsearch-automatically-closes-connection-as-soon-as-i-run-my-java-springboot-program/303069 "2022-04-26T15:35:58Z")
\*\[WARN \]\[o.e.x.c.s.t.n.SecurityNetty4Transport\] \[DESKTOP-ADQ0I0S\] received plaintext traffic on an encrypted channel, closing connection Netty4TcpChannel{localAddress=/127.0.0.1:9300, remoteAddress=/127.0.0.1:59255, prof… --- ## [How to use match and term in DSL Query?](https://discuss.elastic.co/t/how-to-use-match-and-term-in-dsl-query/303248)
**Author:** [@Fosiul\_Alam](https://discuss.elastic.co/u/Fosiul_Alam)\ **Replies:** 5\ **Last updated:** [April 26, 2022, 2:47pm UTC](https://discuss.elastic.co/t/how-to-use-match-and-term-in-dsl-query/303248 "2022-04-26T14:47:57Z")
Hi, bellow query runs fine in older version of kibana 7.10.1, however same query does not work in 8.1.3, can any one please tell me what i need to change to make it work ? Thanks for the help GET \_search { "query"… --- ## [Unable to start filebeat service](https://discuss.elastic.co/t/unable-to-start-filebeat-service/303089)
**Author:** [@Bhagavat\_Bhise](https://discuss.elastic.co/u/Bhagavat_Bhise)\ **Replies:** 2\ **Last updated:** [April 26, 2022, 2:36pm UTC](https://discuss.elastic.co/t/unable-to-start-filebeat-service/303089 "2022-04-26T14:36:56Z")
Hi Team, I am facing an issue while starting filebeat service, getting below error. Would you please help me on this? Please find below details for your help. Apr 24 08:45:55 elku systemd\[1\]: filebeat.service: Main p… --- ## [Aggregations taking way too long?](https://discuss.elastic.co/t/aggregations-taking-way-too-long/303171)
**Author:** [@ChamMach](https://discuss.elastic.co/u/ChamMach)\ **Replies:** 6\ **Last updated:** [April 26, 2022, 12:57pm UTC](https://discuss.elastic.co/t/aggregations-taking-way-too-long/303171 "2022-04-26T12:57:22Z")
Hello, I would like to have your opinion on these aggregations. Currently, these can take up to 5 mins to run on my ES cluster (7.17.1) for ~ 2 years of data (~ 1 billion of documents / 100GB data spread over 2 data nod… --- ## [Spring4Shell ::Spring Framework Remote Code Execution Vulnerability](https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability/303282)
**Author:** [@hank80](https://discuss.elastic.co/u/hank80)\ **Replies:** 1\ **Last updated:** [April 26, 2022, 12:24pm UTC](https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability/303282 "2022-04-26T12:24:52Z")
Hello, We are using Elasticsearch 7.6.1 Please let us know, whether Elasticsearch is impacted any way by the reported spring4shell vulnerability. --- ## [Index template](https://discuss.elastic.co/t/index-template/303280)
**Author:** [@hebph001](https://discuss.elastic.co/u/hebph001)\ **Replies:** 0\ **Last updated:** [April 26, 2022, 12:22pm UTC](https://discuss.elastic.co/t/index-template/303280 "2022-04-26T12:22:15Z")
Hi Elastic community, I've enabled mapper size plugin to help me with the sizing of my cloud cluster. I tried to modify an existing Index template with this API by adding a component template to enable the new meta fiel… --- ## [Update index pattern fields via Kibana REST API fails](https://discuss.elastic.co/t/update-index-pattern-fields-via-kibana-rest-api-fails/303035)
**Author:** [@mpjjonker](https://discuss.elastic.co/u/mpjjonker)\ **Replies:** 1\ **Last updated:** [April 26, 2022, 12:14pm UTC](https://discuss.elastic.co/t/update-index-pattern-fields-via-kibana-rest-api-fails/303035 "2022-04-26T12:14:30Z")
Hi We are using Kibana version 7.17. When I follow the instructions here (Update index pattern fields API | Kibana Guide \[7.17\] | Elastic) to update fields via the REST API , I get the error \[request.body.fields\]: de… --- ## [Filter\_path support in Java Client](https://discuss.elastic.co/t/filter-path-support-in-java-client/303258)
**Author:** [@Fabrizio\_Fortino](https://discuss.elastic.co/u/Fabrizio_Fortino)\ **Replies:** 1\ **Last updated:** [April 26, 2022, 12:07pm UTC](https://discuss.elastic.co/t/filter-path-support-in-java-client/303258 "2022-04-26T12:07:02Z")
We would like to reduce the response size of search requests by removing stuff we don't need (eg: index name since we are pointing to a single index or score). Elastic supports this through filter\_path. Both RHLC and EJ… --- ## [Mapper size plugin on Elastic Cloud](https://discuss.elastic.co/t/mapper-size-plugin-on-elastic-cloud/303161)
**Author:** [@hebph001](https://discuss.elastic.co/u/hebph001)\ **Replies:** 3\ **Last updated:** [April 26, 2022, 11:15am UTC](https://discuss.elastic.co/t/mapper-size-plugin-on-elastic-cloud/303161 "2022-04-26T11:15:51Z")
Hello, I've enabled the mapper size plugin on my Elastic Cloud cluster and would like to know how can I add that new field mapping to my existing indices? I know that I have to modify my index templates to add the mappi… --- ## [Reduce the metadata generated by filebeat while pulling logs in Kubernetes](https://discuss.elastic.co/t/reduce-the-metadata-generated-by-filebeat-while-pulling-logs-in-kubernetes/303267)
**Author:** [@prity-k](https://discuss.elastic.co/u/prity-k)\ **Replies:** 0\ **Last updated:** [April 26, 2022, 10:53am UTC](https://discuss.elastic.co/t/reduce-the-metadata-generated-by-filebeat-while-pulling-logs-in-kubernetes/303267 "2022-04-26T10:53:23Z")
I am using filebeat(v 8.1.0) to pull logs from microservices deployed in kubernetes env. Right now, there is a huge amount of meta data generated by filebeat apart from the actual log message. Is there a way cut it sort … --- ## [Metric value issue in Point to Point map](https://discuss.elastic.co/t/metric-value-issue-in-point-to-point-map/303146)
**Author:** [@ahmad\_amir](https://discuss.elastic.co/u/ahmad_amir)\ **Replies:** 3\ **Last updated:** [April 26, 2022, 10:16am UTC](https://discuss.elastic.co/t/metric-value-issue-in-point-to-point-map/303146 "2022-04-26T10:16:47Z")
Hi everyone! I am facing issue while showing metric value on a point to point map in Kibana. On point to point map the metric value is not displayed, however the value exists and can be seen in Kibana's index pattern. T… --- ## [\[BUG\] filebeat becomes totally unreliable with --once option](https://discuss.elastic.co/t/bug-filebeat-becomes-totally-unreliable-with-once-option/303183)
**Author:** [@kRs](https://discuss.elastic.co/u/kRs)\ **Replies:** 5\ **Last updated:** [April 26, 2022, 10:10am UTC](https://discuss.elastic.co/t/bug-filebeat-becomes-totally-unreliable-with-once-option/303183 "2022-04-26T10:10:53Z")
Hi, by using a config as simple as this one: filebeat.inputs: # filestream is an input for collecting log messages from files. - type: filestream id: "test" enabled: true paths: - /home/krs/elasticsearch/\*.log… --- ## [How many metricbeat and filebeat instances should I have in a docker swarm?](https://discuss.elastic.co/t/how-many-metricbeat-and-filebeat-instances-should-i-have-in-a-docker-swarm/302694)
**Author:** [@UchihaYuki](https://discuss.elastic.co/u/UchihaYuki)\ **Replies:** 4\ **Last updated:** [April 26, 2022, 9:46am UTC](https://discuss.elastic.co/t/how-many-metricbeat-and-filebeat-instances-should-i-have-in-a-docker-swarm/302694 "2022-04-26T09:46:17Z")
I'm still pretty new to elastic stack. And I'm come from prometheus and grafana, and I'd like to substitute them for metricbeat, filebeat and kibana. As a newbie, I always wonder, what is the best practice to deploy fil… --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/303178)
**Author:** [@Achraf\_MENSI](https://discuss.elastic.co/u/Achraf_MENSI)\ **Replies:** 9\ **Last updated:** [April 26, 2022, 9:33am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/303178 "2022-04-26T09:33:25Z")
Hello , i depoyed a multi node cluster with 3 azure vm, the cluster worked on ES and nodes are connected. but i can't work on them with kibana " Kibana server is not ready yet " --- ## [Elasticsearch 7.16 use S3-compatible API setting return Failed to connect to service endpoint](https://discuss.elastic.co/t/elasticsearch-7-16-use-s3-compatible-api-setting-return-failed-to-connect-to-service-endpoint/303208)
**Author:** [@forget6](https://discuss.elastic.co/u/forget6)\ **Replies:** 5\ **Last updated:** [April 26, 2022, 9:32am UTC](https://discuss.elastic.co/t/elasticsearch-7-16-use-s3-compatible-api-setting-return-failed-to-connect-to-service-endpoint/303208 "2022-04-26T09:32:20Z")
elasticsearch version: 7.16.2 s3 setting: elasticsearch.yml s3.client.default.endpoint: ${our own s3} bin/elasticsearch-keystore list keystore.seed s3.client.default.access\_key s3.client.default.secret\_key =========… --- ## [Can I ingest specific log files using winlogbeat?](https://discuss.elastic.co/t/can-i-ingest-specific-log-files-using-winlogbeat/303124)
**Author:** [@rrrrrrrrrrr](https://discuss.elastic.co/u/rrrrrrrrrrr)\ **Replies:** 4\ **Last updated:** [April 26, 2022, 9:31am UTC](https://discuss.elastic.co/t/can-i-ingest-specific-log-files-using-winlogbeat/303124 "2022-04-26T09:31:02Z")
Hello, I would just like to ask if I can ingest a specific logfile using Winlogbeat? If yes, can you provide a structure or link how to do it since I tried researching and no luck finding an answer. Right now here's m… --- ## [Convert a search JSON into a DSL query](https://discuss.elastic.co/t/convert-a-search-json-into-a-dsl-query/303156)
**Author:** [@kelvins](https://discuss.elastic.co/u/kelvins)\ **Replies:** 1\ **Last updated:** [April 26, 2022, 9:19am UTC](https://discuss.elastic.co/t/convert-a-search-json-into-a-dsl-query/303156 "2022-04-26T09:19:22Z")
I have created the following search query in Elastic. I am wanting to using it in a Discover query using the Elasticsearch Query DSL. However, I cannot seem to convert it. This is the query that I have using Kibana D… --- ## [We are setting up 3 node Elasticsearch cluster](https://discuss.elastic.co/t/we-are-setting-up-3-node-elasticsearch-cluster/303181)
**Author:** [@ak9234](https://discuss.elastic.co/u/ak9234)\ **Replies:** 2\ **Last updated:** [April 26, 2022, 9:17am UTC](https://discuss.elastic.co/t/we-are-setting-up-3-node-elasticsearch-cluster/303181 "2022-04-26T09:17:53Z")
We are setting up 3 node Elasticsearch cluster using 7.17, while configuring the cluster we are getting this error message: master not discovered yet, this node has not previously joined a bootstrapped (v7+) cluster, an… --- ## [Hi All I am Getting this error in the kibana log from yesterday 25 April,2022. Version 8.1.2](https://discuss.elastic.co/t/hi-all-i-am-getting-this-error-in-the-kibana-log-from-yesterday-25-april-2022-version-8-1-2/303233)
**Author:** [@srikanth.tekula](https://discuss.elastic.co/u/srikanth.tekula)\ **Replies:** 0\ **Last updated:** [April 26, 2022, 8:15am UTC](https://discuss.elastic.co/t/hi-all-i-am-getting-this-error-in-the-kibana-log-from-yesterday-25-april-2022-version-8-1-2/303233 "2022-04-26T08:15:21Z")
Hi I have installed 8.1.2 version of Elasticsearch and kibana in centos-7 using this command in my AWS ec2 t2.medium instance : wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-$VERSION-x86\_64.rpm … --- ## [Microservices: Decouple sorting from filtering/aggregations](https://discuss.elastic.co/t/microservices-decouple-sorting-from-filtering-aggregations/303232)
**Author:** [@philipschm1tt](https://discuss.elastic.co/u/philipschm1tt)\ **Replies:** 2\ **Last updated:** [April 26, 2022, 9:14am UTC](https://discuss.elastic.co/t/microservices-decouple-sorting-from-filtering-aggregations/303232 "2022-04-26T09:14:37Z")
Context: ecommerce category page We are using Elasticsearch for our product index. On a category page the users can filter products, we show the number of products in each category we sort the products using Elastics… --- ## [How to setup kibana 8.1 with Elastic Search 8.1under Windows](https://discuss.elastic.co/t/how-to-setup-kibana-8-1-with-elastic-search-8-1under-windows/301835)
**Author:** [@aneesh](https://discuss.elastic.co/u/aneesh)\ **Replies:** 2\ **Last updated:** [April 26, 2022, 9:12am UTC](https://discuss.elastic.co/t/how-to-setup-kibana-8-1-with-elastic-search-8-1under-windows/301835 "2022-04-26T09:12:40Z")
Hi , we have installed Elasticsearch 8.1 windows version as a services , here localhost:9200 will be browse with user name and password . and we are not able to run Kibana , and its asking for to generate the Token, i… --- ## [How many master node should be in configuration](https://discuss.elastic.co/t/how-many-master-node-should-be-in-configuration/303198)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 16\ **Last updated:** [April 26, 2022, 8:44am UTC](https://discuss.elastic.co/t/how-many-master-node-should-be-in-configuration/303198 "2022-04-26T08:44:48Z")
Hi I've developed such configuration host1 2 x master node 3x data hot 9x data warm host2 2 x master node 3x data hot 9x data warm in the docker logs I don't see any suspicious but I can't set up a kibana\_system … --- ## [Es service not starting up due to error](https://discuss.elastic.co/t/es-service-not-starting-up-due-to-error/302154)
**Author:** [@cool999](https://discuss.elastic.co/u/cool999)\ **Replies:** 7\ **Last updated:** [April 26, 2022, 8:34am UTC](https://discuss.elastic.co/t/es-service-not-starting-up-due-to-error/302154 "2022-04-26T08:34:15Z")
Hi Team, My cluster was working fine but all of sudden i am getting below errors in elastic log. es service is not getting failed. \[T06:13:20,213\]\[ERROR\]\[o.e.x.s.a.e.ReservedRealm\] \[es\_1\] failed to retrieve password ha… --- ## [Rebalance primary shards, 2022](https://discuss.elastic.co/t/rebalance-primary-shards-2022/302911)
**Author:** [@nisow95612](https://discuss.elastic.co/u/nisow95612)\ **Replies:** 2\ **Last updated:** [April 26, 2022, 8:12am UTC](https://discuss.elastic.co/t/rebalance-primary-shards-2022/302911 "2022-04-26T08:12:58Z")
Hello, I, too, would like my primary shards to be balanced across the cluster. I often reduce the number of replicas on older indices to optimize disk space. When the cluster is reasonably idle, shards will recover fr… --- ## [Kbn webpack compile error and optimization failure](https://discuss.elastic.co/t/kbn-webpack-compile-error-and-optimization-failure/303226)
**Author:** [@HarryX](https://discuss.elastic.co/u/HarryX)\ **Replies:** 0\ **Last updated:** [April 26, 2022, 7:49am UTC](https://discuss.elastic.co/t/kbn-webpack-compile-error-and-optimization-failure/303226 "2022-04-26T07:49:27Z")
I'm on kibana 7.14.2 with wazuh plugin, I got these 2 errors when I started the server. I'm new to this platform please help me with these problems, thank you!!! Here is the log. np bld log \[15:25:12.105\] \[info\]\[@… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=960) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=962)