# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=967 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 968 --- ## [Logstash - java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit](https://discuss.elastic.co/t/logstash-java-lang-illegalstateexception-logstash-stopped-processing-because-of-an-error-systemexit-exit/302879)
**Author:** [@sahir](https://discuss.elastic.co/u/sahir)\ **Replies:** 0\ **Last updated:** [April 21, 2022, 7:38am UTC](https://discuss.elastic.co/t/logstash-java-lang-illegalstateexception-logstash-stopped-processing-because-of-an-error-systemexit-exit/302879 "2022-04-21T07:38:46Z")
Hello team, I try to run the logstash.conf file im facing the error like WARNING: An illegal reflective access operation has occurred WARNING: Illegal reflective access by com.headius.backport9.modules.Modules (file:/us… --- ## [Average of a metric](https://discuss.elastic.co/t/average-of-a-metric/302783)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 2\ **Last updated:** [April 21, 2022, 6:58am UTC](https://discuss.elastic.co/t/average-of-a-metric/302783 "2022-04-21T06:58:38Z")
hello! I am currently ingesting metrics to Elasticsearch and I was interested in calculating a daily average of a specific metric via Rollup. After reading some discussions I saw that it was normal to perform the sum (… --- ## [How to Stack Cardinality Transforms](https://discuss.elastic.co/t/how-to-stack-cardinality-transforms/302851)
**Author:** [@Ashfur](https://discuss.elastic.co/u/Ashfur)\ **Replies:** 1\ **Last updated:** [April 21, 2022, 6:07am UTC](https://discuss.elastic.co/t/how-to-stack-cardinality-transforms/302851 "2022-04-21T06:07:52Z")
Hello, This is a followup question for: In order to delete old raw data without impacting the continuous lifetime cardinality aggregation transform, I was suggested to stack 2 transforms together. The first transfo… --- ## [Could not index event to Elasticsearch DataStream](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-datastream/302722)
**Author:** [@wcpoon](https://discuss.elastic.co/u/wcpoon)\ **Replies:** 5\ **Last updated:** [April 21, 2022, 5:55am UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-datastream/302722 "2022-04-21T05:55:06Z")
Hi, I'm having warning to ingest data to Data Stream from winlogbeat \> logstash then output to Elasticsearch. Below is the warning message, any one can assist me? what should I do to resolve it? Apr 19 21:34:10 z3lynx… --- ## [Jira logs not getting every events using http poller](https://discuss.elastic.co/t/jira-logs-not-getting-every-events-using-http-poller/302671)
**Author:** [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\ **Replies:** 1\ **Last updated:** [April 21, 2022, 5:28am UTC](https://discuss.elastic.co/t/jira-logs-not-getting-every-events-using-http-poller/302671 "2022-04-21T05:28:24Z")
Hello Every one I am using http poller to get issue event from jira but i am not getting every event like update create delete logs off issue any one please help .. please follow my configuration input { http\_poller { … --- ## [There is data, but it is not shown on the dashboard](https://discuss.elastic.co/t/there-is-data-but-it-is-not-shown-on-the-dashboard/302167)
**Author:** [@inwoo1](https://discuss.elastic.co/u/inwoo1)\ **Replies:** 2\ **Last updated:** [April 21, 2022, 4:52am UTC](https://discuss.elastic.co/t/there-is-data-but-it-is-not-shown-on-the-dashboard/302167 "2022-04-21T04:52:39Z")
Take a closer look. Obviously there is data. However, it is not graphed as in the last screenshot. Please help. You always work hard. thank you. --- ## [Logstash Postgresql error](https://discuss.elastic.co/t/logstash-postgresql-error/302864)
**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Replies:** 2\ **Last updated:** [April 21, 2022, 4:44am UTC](https://discuss.elastic.co/t/logstash-postgresql-error/302864 "2022-04-21T04:44:29Z")
Dear Team, I faced the below error while fetching logs from postgresql DB ERROR\] 2022-04-20 10:26:51.485 \[Converge PipelineAction::Create\] jdbc - Missing a required setting for the jdbc input plugin: input { jdbc { … --- ## [Restore backup taken from other elasticsearch to new one](https://discuss.elastic.co/t/restore-backup-taken-from-other-elasticsearch-to-new-one/302867)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 1\ **Last updated:** [April 21, 2022, 4:39am UTC](https://discuss.elastic.co/t/restore-backup-taken-from-other-elasticsearch-to-new-one/302867 "2022-04-21T04:39:36Z")
Hi Team, I have a elastic stack where the indices backup is taken on s3 bucket and it around 5 TB of data. I am planning to copy it to another S3 bucket and will be installing fresh elastic stack. Wondering if I can re… --- ## [Any search\_after performance updated?](https://discuss.elastic.co/t/any-search-after-performance-updated/302809)
**Author:** [@ht.jo](https://discuss.elastic.co/u/ht.jo)\ **Replies:** 2\ **Last updated:** [April 21, 2022, 3:21am UTC](https://discuss.elastic.co/t/any-search-after-performance-updated/302809 "2022-04-21T03:21:36Z")
Hi. I'm using 7.10 and I'm going through exact same situation below link. As the @mayya 's answer (Thx mayya!), I expected search\_after performance has improved at 7.16, so I looked over 7.16 release note, but I can't… --- ## [Using curl to cat indices](https://discuss.elastic.co/t/using-curl-to-cat-indices/302855)
**Author:** [@eh2021-elastic](https://discuss.elastic.co/u/eh2021-elastic)\ **Replies:** 2\ **Last updated:** [April 21, 2022, 1:09am UTC](https://discuss.elastic.co/t/using-curl-to-cat-indices/302855 "2022-04-21T01:09:38Z")
I am trying to use curl to pull back a specific set of indexs based on the date. The curl command I try running is below. curl -X GET -u user -k "http://masterIP:9200/\_cat/indices/\*2202-03-30?bytes=mb&v=true&s=index" … --- ## [Kibana Control Visualization Missing Values](https://discuss.elastic.co/t/kibana-control-visualization-missing-values/302549)
**Author:** [@Xadiq](https://discuss.elastic.co/u/Xadiq)\ **Replies:** 1\ **Last updated:** [April 21, 2022, 12:13am UTC](https://discuss.elastic.co/t/kibana-control-visualization-missing-values/302549 "2022-04-21T00:13:41Z")
Hi All, I am facing issue with Kibana Control Visualization. I have field which shows month/year. The index has data from 2014 to 2021 but still the drop down is not showing some values like 12/2021. However if apply th… --- ## [Need help with snapshot size](https://discuss.elastic.co/t/need-help-with-snapshot-size/302190)
**Author:** [@Vinay\_Menon1](https://discuss.elastic.co/u/Vinay_Menon1)\ **Replies:** 1\ **Last updated:** [April 21, 2022, 12:10am UTC](https://discuss.elastic.co/t/need-help-with-snapshot-size/302190 "2022-04-21T00:10:46Z")
Hi, I need help in checking the size of a snapshot in snapshot and restore option in elastic. Can someone guide me how to do this. I am new to elastic. Please help --- ## [Unable to install logstash kusto plugin using 6.4.2 version](https://discuss.elastic.co/t/unable-to-install-logstash-kusto-plugin-using-6-4-2-version/302857)
**Author:** [@newelastic](https://discuss.elastic.co/u/newelastic)\ **Replies:** 1\ **Last updated:** [April 20, 2022, 11:19pm UTC](https://discuss.elastic.co/t/unable-to-install-logstash-kusto-plugin-using-6-4-2-version/302857 "2022-04-20T23:19:19Z")
Hello, I'm using logstash 6.4.2 version and trying to install kusto plugin. Logstash is throwing an error bin/logstash-plugin install logstash-output-kusto Cannot find Java 1.5 or higher. But, my machine has Java 8. … --- ## [Warm vs. Cold (+ Frozen) for archival](https://discuss.elastic.co/t/warm-vs-cold-frozen-for-archival/302814)
**Author:** [@schapman](https://discuss.elastic.co/u/schapman)\ **Replies:** 8\ **Last updated:** [April 20, 2022, 11:17pm UTC](https://discuss.elastic.co/t/warm-vs-cold-frozen-for-archival/302814 "2022-04-20T23:17:46Z")
First, this is in the context of using Elastic Cloud. Our use case is primarily archiving logs and metrics mostly for compliance and security forensics. We'll be using some of the metrics in the short term (daily basis, … --- ## [URL Drilldown, is it possible to pass field names to the query?](https://discuss.elastic.co/t/url-drilldown-is-it-possible-to-pass-field-names-to-the-query/302839)
**Author:** [@azulgrana](https://discuss.elastic.co/u/azulgrana)\ **Replies:** 1\ **Last updated:** [April 20, 2022, 10:47pm UTC](https://discuss.elastic.co/t/url-drilldown-is-it-possible-to-pass-field-names-to-the-query/302839 "2022-04-20T22:47:24Z")
Hi there! I have a use case for a URL drilldown where I would like to pass field names to the drilldown (a search) and have the search only populate specific field names. Here's how my URL drilldown looks like {{kibana… --- ## [Elastic Agent 8.1.1 fails updates to 8.1.3](https://discuss.elastic.co/t/elastic-agent-8-1-1-fails-updates-to-8-1-3/302850)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 4\ **Last updated:** [April 20, 2022, 9:10pm UTC](https://discuss.elastic.co/t/elastic-agent-8-1-1-fails-updates-to-8-1-3/302850 "2022-04-20T21:10:17Z")
Elastic agent fails to update from 8.1.1 to 8.1.3. On-prim elastic instance. Pulling from elastic directly for software downloads. Start upgrade by selecting agents in Fleet. Fleet policy consist of Endpoint only. Cl… --- ## [Create rule with data from multiple documents](https://discuss.elastic.co/t/create-rule-with-data-from-multiple-documents/302854)
**Author:** [@ChristianOelsner](https://discuss.elastic.co/u/ChristianOelsner)\ **Replies:** 0\ **Last updated:** [April 20, 2022, 8:28pm UTC](https://discuss.elastic.co/t/create-rule-with-data-from-multiple-documents/302854 "2022-04-20T20:28:21Z")
Hi forum, I am trying to setup an alert/rule with audit data from Confluent Cloud. When I invite a user into the organization the following among others are generated and visible in Kibana under discover. { "\_index"… --- ## [Enrich Policy Execute Unable to Find Source Index](https://discuss.elastic.co/t/enrich-policy-execute-unable-to-find-source-index/302750)
**Author:** [@cj\_hillbrand](https://discuss.elastic.co/u/cj_hillbrand)\ **Replies:** 14\ **Last updated:** [April 20, 2022, 6:08pm UTC](https://discuss.elastic.co/t/enrich-policy-execute-unable-to-find-source-index/302750 "2022-04-20T18:08:57Z")
Hello, I am trying to familiarize myself with the Enrich Policy. I have set up a source index and an enrich policy. When I go to execute the enrich policy I receive a "index\_not\_found\_exception". I have posted some sho… --- ## [AWS RDS module does not poll metrics regularly](https://discuss.elastic.co/t/aws-rds-module-does-not-poll-metrics-regularly/302393)
**Author:** [@Ayush\_Mathur](https://discuss.elastic.co/u/Ayush_Mathur)\ **Replies:** 3\ **Last updated:** [April 20, 2022, 5:34pm UTC](https://discuss.elastic.co/t/aws-rds-module-does-not-poll-metrics-regularly/302393 "2022-04-20T17:34:36Z")
Hello Everyone, I have recently upgraded the Elastic Stack from 7.17.1 to 8.1.2. All the metrics are coming in fine except for AWS RDS which is coming very rarely even though the period is set to 60s. The IAM user has … --- ## [TSVB show missing buckets when doing term aggs](https://discuss.elastic.co/t/tsvb-show-missing-buckets-when-doing-term-aggs/302232)
**Author:** [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Replies:** 1\ **Last updated:** [April 20, 2022, 5:26pm UTC](https://discuss.elastic.co/t/tsvb-show-missing-buckets-when-doing-term-aggs/302232 "2022-04-20T17:26:10Z")
Hello, Is there any option, in TSVB, to show missing buckets when doing term aggs ? --- ## [Counting the SEARCH term/phrase in a specific field](https://discuss.elastic.co/t/counting-the-search-term-phrase-in-a-specific-field/302107)
**Author:** [@Navanit\_dubey](https://discuss.elastic.co/u/Navanit_dubey)\ **Replies:** 1\ **Last updated:** [April 20, 2022, 5:19pm UTC](https://discuss.elastic.co/t/counting-the-search-term-phrase-in-a-specific-field/302107 "2022-04-20T17:19:49Z")
Hi, I have this type of data { "name\_id": 2145 "address": "Antartica" "characteristics" : "He is a very nice person with very nice personality. the nicest thing about him is his nice dog" } now I am running this qu… --- ## [Reports Visualizing with Kibana](https://discuss.elastic.co/t/reports-visualizing-with-kibana/302231)
**Author:** [@bhaskar53777](https://discuss.elastic.co/u/bhaskar53777)\ **Replies:** 1\ **Last updated:** [April 20, 2022, 5:15pm UTC](https://discuss.elastic.co/t/reports-visualizing-with-kibana/302231 "2022-04-20T17:15:19Z")
Dear Team, We have 15 reports producing from various tools in Excel /CSV format. How to configure/send these reports every 15 days automatically to Kibana for visualizing/dashboard? What could be the process/Steps? Reg… --- ## [Interesting cardinality aggregation query](https://discuss.elastic.co/t/interesting-cardinality-aggregation-query/302845)
**Author:** [@acc23](https://discuss.elastic.co/u/acc23)\ **Replies:** 0\ **Last updated:** [April 20, 2022, 5:13pm UTC](https://discuss.elastic.co/t/interesting-cardinality-aggregation-query/302845 "2022-04-20T17:13:31Z")
I am new to writing ES queries. I have an index that contains log data for thousands of nodes and I need to query the following: Aggregate request source IP addresses that are matched in at least X number of nodes ("age… --- ## [Logstash pipeline date filter doesn't work](https://discuss.elastic.co/t/logstash-pipeline-date-filter-doesnt-work/302386)
**Author:** [@zerojin63](https://discuss.elastic.co/u/zerojin63)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 2:23am UTC](https://discuss.elastic.co/t/logstash-pipeline-date-filter-doesnt-work/302386 "2022-04-14T02:23:21Z")
Hi, I wanted to display timestamp of a certain index in two ways, one in my local timezone (in evt\_time field) and the other in Los Angeles timezone (in evt\_time\_america field). So I added 'date' filter to my logstash … --- ## [Missing event field from filebeat via docker autodiscovery](https://discuss.elastic.co/t/missing-event-field-from-filebeat-via-docker-autodiscovery/302843)
**Author:** [@galkinrost](https://discuss.elastic.co/u/galkinrost)\ **Replies:** 0\ **Last updated:** [April 20, 2022, 5:06pm UTC](https://discuss.elastic.co/t/missing-event-field-from-filebeat-via-docker-autodiscovery/302843 "2022-04-20T17:06:46Z")
Hi! I'm trying to set up filebeat with docker autodiscovery. But for some reason the event field is missing in documents. Here the config: filebeat.config: modules: path: ${path.config}/modules.d/\*.yml reloa… --- ## [Unable to view elastic-agent(Zeek) & (windows) logs in Fleet](https://discuss.elastic.co/t/unable-to-view-elastic-agent-zeek-windows-logs-in-fleet/302574)
**Author:** [@Mayuresh\_More](https://discuss.elastic.co/u/Mayuresh_More)\ **Replies:** 1\ **Last updated:** [April 20, 2022, 4:49pm UTC](https://discuss.elastic.co/t/unable-to-view-elastic-agent-zeek-windows-logs-in-fleet/302574 "2022-04-20T16:49:24Z")
Hello all, I have successfully configured the Fleet-server A fleet of ELK(Fleet-server), Linux(Zeek-elastic agent), Windows (-elastic-agent) however unable to view logs of elastic-agent in Fleet \> Agents \> osboxes & F… --- ## [How can use patterns\_files\_glob in grok？](https://discuss.elastic.co/t/how-can-use-patterns-files-glob-in-grok/302792)
**Author:** [@lingminzeng](https://discuss.elastic.co/u/lingminzeng)\ **Replies:** 1\ **Last updated:** [April 20, 2022, 4:47pm UTC](https://discuss.elastic.co/t/how-can-use-patterns-files-glob-in-grok/302792 "2022-04-20T16:47:28Z")
My config: patterns\_files\_glob =\> "test.txt" But it not working and output error --- ## [Error when building logstash-filter-elasticsearch plugin](https://discuss.elastic.co/t/error-when-building-logstash-filter-elasticsearch-plugin/302838)
**Author:** [@jong99](https://discuss.elastic.co/u/jong99)\ **Replies:** 0\ **Last updated:** [April 20, 2022, 4:29pm UTC](https://discuss.elastic.co/t/error-when-building-logstash-filter-elasticsearch-plugin/302838 "2022-04-20T16:29:48Z")
I'm trying to track down an issue I'm having with the logstash-filter-elasticsearch plugin so I've checked out the code and am trying to build from source. Running inside a ruby:9.2 docker container I'm checking out the… --- ## [Optimize / combine number of watcher](https://discuss.elastic.co/t/optimize-combine-number-of-watcher/302670)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 1\ **Last updated:** [April 20, 2022, 4:22pm UTC](https://discuss.elastic.co/t/optimize-combine-number-of-watcher/302670 "2022-04-20T16:22:34Z")
Hello all, We have created lots of alerts in our cluster and we are unbale to manage those alerts. Requirement: We need to 2 or more than 2 watcher in one watch. Like: for index Metrickbeat-\* we have 3 alerts for if: … --- ## [Exclude\_files param not working](https://discuss.elastic.co/t/exclude-files-param-not-working/302803)
**Author:** [@yyovchev](https://discuss.elastic.co/u/yyovchev)\ **Replies:** 1\ **Last updated:** [April 20, 2022, 4:05pm UTC](https://discuss.elastic.co/t/exclude-files-param-not-working/302803 "2022-04-20T16:05:15Z")
Hello, I try to exclude only one log file from filebeat, but the records are still sent to Elasticsearch. Here is my /etc/filebeat/modules.d/nginx.yml file: # Module: nginx # Docs: https://www.elastic.co/guide/en/beats… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=966) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=968)