# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=976 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 977 --- ## [Elasticsearch 8.1 - python security client issues](https://discuss.elastic.co/t/elasticsearch-8-1-python-security-client-issues/302162)
**Author:** [@Aldo2](https://discuss.elastic.co/u/Aldo2)\ **Replies:** 2\ **Last updated:** [April 12, 2022, 3:43pm UTC](https://discuss.elastic.co/t/elasticsearch-8-1-python-security-client-issues/302162 "2022-04-12T15:43:54Z")
Hi Elastic Community, We are having problems trying to connect a python (2.7.5) client to Elasticsearch 8.1 (with security enabled). We have tried the following example code: from elasticsearch import Elasticsearch fr… --- ## [Logstash reading recursively directories](https://discuss.elastic.co/t/logstash-reading-recursively-directories/302213)
**Author:** [@Andrea\_Bozzano](https://discuss.elastic.co/u/Andrea_Bozzano)\ **Replies:** 1\ **Last updated:** [April 12, 2022, 3:30pm UTC](https://discuss.elastic.co/t/logstash-reading-recursively-directories/302213 "2022-04-12T15:30:46Z")
Hi everyone, in my environment I'm trying to read log files that are saved on the file system like this: /home/andrea/mylogs/\[subdir1....subdirN\]/\*.gz /home/andrea/mylogs/\[subdir1...subdirM\]/\*.gz /home/andrea/mylogs/\[s… --- ## [CVE-2022-22965 vulnerability on Elastic Search or Kibana](https://discuss.elastic.co/t/cve-2022-22965-vulnerability-on-elastic-search-or-kibana/302216)
**Author:** [@kavirajansakthivel](https://discuss.elastic.co/u/kavirajansakthivel)\ **Replies:** 1\ **Last updated:** [April 12, 2022, 3:11pm UTC](https://discuss.elastic.co/t/cve-2022-22965-vulnerability-on-elastic-search-or-kibana/302216 "2022-04-12T15:11:46Z")
We are having Elasticsearch and Kibana (7.17.0) in our system. we do not have any spring framework integrated which are mentioned in this link (Integrations | Elasticsearch Plugins and Integrations \[7.17\] | Elastic). Des… --- ## [Failed to parse date field](https://discuss.elastic.co/t/failed-to-parse-date-field/302248)
**Author:** [@Bavaria](https://discuss.elastic.co/u/Bavaria)\ **Replies:** 1\ **Last updated:** [April 12, 2022, 3:01pm UTC](https://discuss.elastic.co/t/failed-to-parse-date-field/302248 "2022-04-12T15:01:16Z")
I want to send Logs from Winlogbeat, via Logstash into Elasticsearch. From Winlogbeat directly to Elasticsearch is it working. However if I put the output to Logstash, I am getting this warning, that the date field cou… --- ## [Elastic agent is unable to enroll to fleet](https://discuss.elastic.co/t/elastic-agent-is-unable-to-enroll-to-fleet/301679)
**Author:** [@spo](https://discuss.elastic.co/u/spo)\ **Replies:** 21\ **Last updated:** [April 12, 2022, 2:59pm UTC](https://discuss.elastic.co/t/elastic-agent-is-unable-to-enroll-to-fleet/301679 "2022-04-12T14:59:21Z")
Hi I have used this documentation to setup fleet but when I try to do the 2nd step in that document to add elastic agent to the fleet am getting an error 2022-04-05T21:42:01.934Z WARN \[tls\] tlscommon/tl… --- ## [High CPU load](https://discuss.elastic.co/t/high-cpu-load/302102)
**Author:** [@hebph001](https://discuss.elastic.co/u/hebph001)\ **Replies:** 9\ **Last updated:** [April 12, 2022, 2:58pm UTC](https://discuss.elastic.co/t/high-cpu-load/302102 "2022-04-12T14:58:25Z")
Hi Elastic community, I have a cloud cluster with 3 hot nodes. Stack monitoring data is showing me that 2 out of 3 are constantly under heavy load. CPU usage is nearly 100% all the time. I would like to know how can I t… --- ## [Percentile after aggregation](https://discuss.elastic.co/t/percentile-after-aggregation/302245)
**Author:** [@Robert\_Hornsby](https://discuss.elastic.co/u/Robert_Hornsby)\ **Replies:** 0\ **Last updated:** [April 12, 2022, 2:06pm UTC](https://discuss.elastic.co/t/percentile-after-aggregation/302245 "2022-04-12T14:06:04Z")
My data is a series of document each with a time and a transaction id. I want to group the data by transaction id, from each group select the largest time and then use those times as input to a percentile function. I can… --- ## [Get the number of people who have bought twice](https://discuss.elastic.co/t/get-the-number-of-people-who-have-bought-twice/302211)
**Author:** [@Amir\_Faramarzi](https://discuss.elastic.co/u/Amir_Faramarzi)\ **Replies:** 3\ **Last updated:** [April 12, 2022, 1:52pm UTC](https://discuss.elastic.co/t/get-the-number-of-people-who-have-bought-twice/302211 "2022-04-12T13:52:28Z")
Hello friends I have an index of orders as follows { "offer" : { "type" : "unsigned\_long" }, "order\_number" : { "type" : "keyword" }, "payable" : { … --- ## [Cannot get Elasticsearch version](https://discuss.elastic.co/t/cannot-get-elasticsearch-version/302206)
**Author:** [@Pavlo\_Kovalenko](https://discuss.elastic.co/u/Pavlo_Kovalenko)\ **Replies:** 1\ **Last updated:** [April 12, 2022, 1:39pm UTC](https://discuss.elastic.co/t/cannot-get-elasticsearch-version/302206 "2022-04-12T13:39:46Z")
Hi PLease assist, I want to ingest data from GoogleBigQuery into Elastic using Google DataFlow. I created DataFlow from template, Inserted my Elastic cloudID and API key, setted up table name from BigQuery. But when I … --- ## [Output to Azure Blob Storage](https://discuss.elastic.co/t/output-to-azure-blob-storage/302209)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 2\ **Last updated:** [April 12, 2022, 1:19pm UTC](https://discuss.elastic.co/t/output-to-azure-blob-storage/302209 "2022-04-12T13:19:51Z")
Hi, everyone I have been looking over Internet in order to find a plugin for Logstash or FIlebeat in order to send data to Azure Blob Storage. I have found a plugin on GitHub: Plugin However, it is an unofficial plug… --- ## [Need to create a grok pattern](https://discuss.elastic.co/t/need-to-create-a-grok-pattern/302123)
**Author:** [@amsmzn](https://discuss.elastic.co/u/amsmzn)\ **Replies:** 1\ **Last updated:** [April 12, 2022, 1:18pm UTC](https://discuss.elastic.co/t/need-to-create-a-grok-pattern/302123 "2022-04-12T13:18:42Z")
Hi there, I am new to logstash. I am trying to create a grok pattern for the below line, which would create a field in the Elasticsearch mvn clean deploy -P build -gs ./sd\_tools/config/maven/settings.xml -s ./sd\_tools/… --- ## [Network Interface Monitoring: interface Up/Down alert](https://discuss.elastic.co/t/network-interface-monitoring-interface-up-down-alert/301767)
**Author:** [@700grm](https://discuss.elastic.co/u/700grm)\ **Replies:** 1\ **Last updated:** [April 12, 2022, 12:50pm UTC](https://discuss.elastic.co/t/network-interface-monitoring-interface-up-down-alert/301767 "2022-04-12T12:50:50Z")
Hi, I'm new to Elastic. I'm looking into Beats agents for network interface monitoring: if the interface is up or down. However I don't see any relevant fields that can be used to do this job, I will appreciate any help. … --- ## [Logstash skips first lines and start reading from second line](https://discuss.elastic.co/t/logstash-skips-first-lines-and-start-reading-from-second-line/302121)
**Author:** [@Pranjal\_Sett](https://discuss.elastic.co/u/Pranjal_Sett)\ **Replies:** 3\ **Last updated:** [April 12, 2022, 12:23pm UTC](https://discuss.elastic.co/t/logstash-skips-first-lines-and-start-reading-from-second-line/302121 "2022-04-12T12:23:49Z")
Hi All, This is below my sample logs. \[2022-03-09T22:38:03.296+01:00\] \[String\] \[NOTIFICATION:16\] \[ODL-52001\] \[FileLogWriter\] \[Oracle\] \[host: \*\] \[nwaddr: \*\] \[tid: \[ACTIVE\].ExecuteThread: '157' for queue: 'weblogic.kerne… --- ## [No Detections after the first time zero detection was detected](https://discuss.elastic.co/t/no-detections-after-the-first-time-zero-detection-was-detected/302047)
**Author:** [@Shahzaib\_Abid](https://discuss.elastic.co/u/Shahzaib_Abid)\ **Replies:** 9\ **Last updated:** [April 12, 2022, 12:16pm UTC](https://discuss.elastic.co/t/no-detections-after-the-first-time-zero-detection-was-detected/302047 "2022-04-12T12:16:07Z")
We have created an anomaly detection job using elastic machine learning. For this particular case, our device doing detections failed for electrical issues and stopped doing detection. Previously for cases like these… --- ## [Winlogbeat - not getting all the logs](https://discuss.elastic.co/t/winlogbeat-not-getting-all-the-logs/302222)
**Author:** [@Gadula](https://discuss.elastic.co/u/Gadula)\ **Replies:** 0\ **Last updated:** [April 12, 2022, 12:11pm UTC](https://discuss.elastic.co/t/winlogbeat-not-getting-all-the-logs/302222 "2022-04-12T12:11:11Z")
Hello, I am newbie in Kibana, Elasticsearch and rest of tools in stack. So I'm not sure is the problem with Winlogbeat. I have installed Winlogbeat on my servers and I am getting the logs correctly. They are visible i… --- ## [Authentication Exception](https://discuss.elastic.co/t/authentication-exception/302177)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 2\ **Last updated:** [April 12, 2022, 11:18am UTC](https://discuss.elastic.co/t/authentication-exception/302177 "2022-04-12T11:18:43Z")
Hi dears I have 4nodes of Elasticsearch 7.16.2 and 1node with Kibana, apm-server and Metricbeat. There are 3 instances of Logstash running on Elasticsearch nodes (3 of 4 servers have both ES and Logstash) My cluster wo… --- ## [Collecting logstash stats on K8S with metricbeat](https://discuss.elastic.co/t/collecting-logstash-stats-on-k8s-with-metricbeat/302207)
**Author:** [@gunlomboy](https://discuss.elastic.co/u/gunlomboy)\ **Replies:** 0\ **Last updated:** [April 12, 2022, 10:05am UTC](https://discuss.elastic.co/t/collecting-logstash-stats-on-k8s-with-metricbeat/302207 "2022-04-12T10:05:00Z")
Hi, I am just starting to move our stack to a containerised environment using K8S. It's all going well so far with Elasticsearch, Kibana and Logstash all running. I usually monitor our logstash pipelines with metricbe… --- ## [ILM - How to configure it](https://discuss.elastic.co/t/ilm-how-to-configure-it/302204)
**Author:** [@mgfeal](https://discuss.elastic.co/u/mgfeal)\ **Replies:** 0\ **Last updated:** [April 12, 2022, 9:49am UTC](https://discuss.elastic.co/t/ilm-how-to-configure-it/302204 "2022-04-12T09:49:06Z")
Hi, Our hot storage is almost full. In our deployment in Elastic Cloud, several Index Lifecycle Policies have been created. One of them is perfect for us: "30-days-default" with this settings: But now we don't e… --- ## [Can't get value from hash in XML document](https://discuss.elastic.co/t/cant-get-value-from-hash-in-xml-document/301897)
**Author:** [@duanra22](https://discuss.elastic.co/u/duanra22)\ **Replies:** 4\ **Last updated:** [April 12, 2022, 7:06am UTC](https://discuss.elastic.co/t/cant-get-value-from-hash-in-xml-document/301897 "2022-04-12T07:06:02Z")
Hello, I'm struggling with an XML document that I am processing The part that is annoying me is something like \ \ \ \code1\ \value1\ \ \ \c… --- ## [Execute enrich policy always blocks until complete. Improve documentation or bug?](https://discuss.elastic.co/t/execute-enrich-policy-always-blocks-until-complete-improve-documentation-or-bug/302196)
**Author:** [@Baard](https://discuss.elastic.co/u/Baard)\ **Replies:** 0\ **Last updated:** [April 12, 2022, 9:01am UTC](https://discuss.elastic.co/t/execute-enrich-policy-always-blocks-until-complete-improve-documentation-or-bug/302196 "2022-04-12T09:01:25Z")
See execute-enrich-policy-api-query-params wait\_for\_completion I am running Elasticsearch version 7.17.2 and this part of the documentation is a bit confusing wait\_for\_completion (Required, Boolean) If true, the re… --- ## [Can logstash parsing port number with service name?](https://discuss.elastic.co/t/can-logstash-parsing-port-number-with-service-name/302080)
**Author:** [@111401](https://discuss.elastic.co/u/111401)\ **Replies:** 2\ **Last updated:** [April 12, 2022, 8:39am UTC](https://discuss.elastic.co/t/can-logstash-parsing-port-number-with-service-name/302080 "2022-04-12T08:39:40Z")
Hi, I wonder that is there any plugin or tools to help logstash use the port field to parsing corresponding service name? Like 53/tcp it will parsing the service name "DNS". Or I need to create a list of port/service, … --- ## [Completeness rate](https://discuss.elastic.co/t/completeness-rate/302189)
**Author:** [@meyer1](https://discuss.elastic.co/u/meyer1)\ **Replies:** 0\ **Last updated:** [April 12, 2022, 8:22am UTC](https://discuss.elastic.co/t/completeness-rate/302189 "2022-04-12T08:22:24Z")
Hello everyone, I need help with an Elastic query I want to get the completeness rate of the fields in my index. And then integrate it in a Vega visualization. Someone could help me for the Elastic query to realize? T… --- ## [Unable to create geo points](https://discuss.elastic.co/t/unable-to-create-geo-points/302130)
**Author:** [@Dhinesh\_Kumar\_N](https://discuss.elastic.co/u/Dhinesh_Kumar_N)\ **Replies:** 2\ **Last updated:** [April 12, 2022, 7:56am UTC](https://discuss.elastic.co/t/unable-to-create-geo-points/302130 "2022-04-12T07:56:10Z")
Hi, Can any one help to configure geo points for the data which I have, I'm using live data streaming(filebeat), I the logstash configuration I have added location feed, config: geoip { database =\> "GeoIP2-City.mmdb… --- ## [Normal for node to be RED after reboot; standalone environment](https://discuss.elastic.co/t/normal-for-node-to-be-red-after-reboot-standalone-environment/300630)
**Author:** [@aleding](https://discuss.elastic.co/u/aleding)\ **Replies:** 9\ **Last updated:** [April 12, 2022, 7:18am UTC](https://discuss.elastic.co/t/normal-for-node-to-be-red-after-reboot-standalone-environment/300630 "2022-04-12T07:18:39Z")
Hello - first time poster here and new ES user. Been troubleshooting for a couple days now and after reading numerous posts and ES docs, I must say this is pretty amazing stuff and the ES team + community seem quite ama… --- ## [Kibana does not start on Debian10](https://discuss.elastic.co/t/kibana-does-not-start-on-debian10/302108)
**Author:** [@ukt05](https://discuss.elastic.co/u/ukt05)\ **Replies:** 10\ **Last updated:** [April 12, 2022, 7:10am UTC](https://discuss.elastic.co/t/kibana-does-not-start-on-debian10/302108 "2022-04-12T07:10:16Z")
Hi, I am running Elasticsearch and Kibana on one machine with Debian 10 in a cluster. Elastichsearch runs properly but Kibana doesn't start. When I execute the command "journalctl -f -u kibana the following result is s… --- ## [Data not evenly distributed](https://discuss.elastic.co/t/data-not-evenly-distributed/302179)
**Author:** [@vaclav1](https://discuss.elastic.co/u/vaclav1)\ **Replies:** 0\ **Last updated:** [April 12, 2022, 7:04am UTC](https://discuss.elastic.co/t/data-not-evenly-distributed/302179 "2022-04-12T07:04:14Z")
Dear team, we have enlarged our cluster by adding two nodes to it. However we have ended up with situation that data are not evenly distributed among them. Please check table below: 133 2 .5tb 2 .5tb 1 .4tb 3 .9… --- ## [Mapping Conflict with several types](https://discuss.elastic.co/t/mapping-conflict-with-several-types/301312)
**Author:** [@wcpoon](https://discuss.elastic.co/u/wcpoon)\ **Replies:** 4\ **Last updated:** [April 12, 2022, 7:03am UTC](https://discuss.elastic.co/t/mapping-conflict-with-several-types/301312 "2022-04-12T07:03:41Z")
Hi guys, I'm facing this issues in Data View, Mapping conflict A field is defined as several types (string, integer, etc) across the indices that match this pattern. You may still be able to use these conflict fields… --- ## [Migration from AWS opensearch to self hosted ElasticSearch cluster](https://discuss.elastic.co/t/migration-from-aws-opensearch-to-self-hosted-elasticsearch-cluster/302172)
**Author:** [@rogerlee](https://discuss.elastic.co/u/rogerlee)\ **Replies:** 2\ **Last updated:** [April 12, 2022, 4:36am UTC](https://discuss.elastic.co/t/migration-from-aws-opensearch-to-self-hosted-elasticsearch-cluster/302172 "2022-04-12T04:36:58Z")
Hi guys, Is it possible to migrate data from AWS OpenSearch to a self hosted Elasticsearch cluster with higher version? For example, I want to migrate data from OpenSearch with 6.x to Elasticsearch 8.x -Roger --- ## [Unable to shrink index using curator](https://discuss.elastic.co/t/unable-to-shrink-index-using-curator/299401)
**Author:** [@fidsamuraiCrelio](https://discuss.elastic.co/u/fidsamuraiCrelio)\ **Replies:** 12\ **Last updated:** [April 12, 2022, 4:05am UTC](https://discuss.elastic.co/t/unable-to-shrink-index-using-curator/299401 "2022-04-12T04:05:24Z")
I have an action file with 7 steps. --- actions: 1: action: rollover description: \>- Rollover index \-logs-\* options: name: active-\-logs #Enter alias name not index name cond… --- ## [How to install v8 without any interaction?](https://discuss.elastic.co/t/how-to-install-v8-without-any-interaction/301973)
**Author:** [@tsarajar](https://discuss.elastic.co/u/tsarajar)\ **Replies:** 1\ **Last updated:** [April 12, 2022, 2:15am UTC](https://discuss.elastic.co/t/how-to-install-v8-without-any-interaction/301973 "2022-04-12T02:15:27Z")
I'm trying to install everything non-interactively, so the part where the enrollment token goes into Kibana via the web browser, that's a no-no. I tried to mimic the actions it takes by doing it once and trying to figur… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=975) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=977)