# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=982 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 983 --- ## [Logstash is stopping becuase SystemExit Error](https://discuss.elastic.co/t/logstash-is-stopping-becuase-systemexit-error/299746)
**Author:** [@goutham\_eai](https://discuss.elastic.co/u/goutham_eai)\ **Replies:** 1\ **Last updated:** [April 7, 2022, 8:28am UTC](https://discuss.elastic.co/t/logstash-is-stopping-becuase-systemexit-error/299746 "2022-04-07T08:28:47Z")
Hi All, I have upgraded the log stash from 7.8.0 to 7.16.2,After upgrading i am getting below error. \[2022-03-15T13:51:28,568\]\[DEBUG\]\[logstash.modules.scaffold\] Found module {:module\_name=\>"fb\_apache", :directory=\>"/us… --- ## [Logstash-plugin command does not work as expected](https://discuss.elastic.co/t/logstash-plugin-command-does-not-work-as-expected/300857)
**Author:** [@mpride63](https://discuss.elastic.co/u/mpride63)\ **Replies:** 1\ **Last updated:** [April 7, 2022, 7:51am UTC](https://discuss.elastic.co/t/logstash-plugin-command-does-not-work-as-expected/300857 "2022-04-07T07:51:49Z")
I have Logstash working in a basic test scenario on a Windows server but I need to install a plugin. The problem is that the plugin command doesn't seem to work. No matter what option I run the logstash-plugin.bat with… --- ## [Collapse with point in time feature](https://discuss.elastic.co/t/collapse-with-point-in-time-feature/301535)
**Author:** [@nabhan\_karmi](https://discuss.elastic.co/u/nabhan_karmi)\ **Replies:** 1\ **Last updated:** [April 7, 2022, 7:35am UTC](https://discuss.elastic.co/t/collapse-with-point-in-time-feature/301535 "2022-04-07T07:35:17Z")
I'm trying to use the collapse feature with the point in time, I successfully make the two features run together as per documentation, but the problem is with the result, in my case I have 3 documents has the same value … --- ## [Sub query using over order by in elasticsearch](https://discuss.elastic.co/t/sub-query-using-over-order-by-in-elasticsearch/301658)
**Author:** [@willers](https://discuss.elastic.co/u/willers)\ **Replies:** 1\ **Last updated:** [April 7, 2022, 7:32am UTC](https://discuss.elastic.co/t/sub-query-using-over-order-by-in-elasticsearch/301658 "2022-04-07T07:32:05Z")
I need to transform the query to a query in Elasticsearch, but I didn't find a solution in my searches. Has anyone had this problem? SELECT \* FROM ( SELECT coalesce(open.day, close.day) as da… --- ## [Is there a way to read a dumped Elasticsearch index with Java?](https://discuss.elastic.co/t/is-there-a-way-to-read-a-dumped-elasticsearch-index-with-java/301654)
**Author:** [@MikeThomsen](https://discuss.elastic.co/u/MikeThomsen)\ **Replies:** 1\ **Last updated:** [April 7, 2022, 7:30am UTC](https://discuss.elastic.co/t/is-there-a-way-to-read-a-dumped-elasticsearch-index-with-java/301654 "2022-04-07T07:30:34Z")
Is there a Java API for reading the contents of an Elasticsearch index that has been dumped to disk with the 2.X backup tools? We'd prefer to not set up a 2.X cluster and do rolling upgrades and unfortunately, the folks … --- ## [Error message: org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:82](https://discuss.elastic.co/t/error-message-org-elasticsearch-bootstrap-elasticsearch-main-elasticsearch-java-82/301715)
**Author:** [@Supelec](https://discuss.elastic.co/u/Supelec)\ **Replies:** 1\ **Last updated:** [April 7, 2022, 7:29am UTC](https://discuss.elastic.co/t/error-message-org-elasticsearch-bootstrap-elasticsearch-main-elasticsearch-java-82/301715 "2022-04-07T07:29:29Z")
Hi, I installed Elasticsearch in Mac OS Monterey 12.3.1 in using brew command. The version installed is for Elasticsearch: 7.10.2/ java -version java version "1.8.0\_321" Java(TM) SE Runtime Environment (build 1.8.0\_… --- ## [Merging two nested fields with update\_by\_query](https://discuss.elastic.co/t/merging-two-nested-fields-with-update-by-query/301797)
**Author:** [@magedmakled](https://discuss.elastic.co/u/magedmakled)\ **Replies:** 1\ **Last updated:** [April 7, 2022, 7:19am UTC](https://discuss.elastic.co/t/merging-two-nested-fields-with-update-by-query/301797 "2022-04-07T07:19:30Z")
Hello elastic community, I'm trying to merge two nested fields from two different documents. The nested fields have objects inside of them. I tried to load the nested array from the first document and add it to the nes… --- ## [A bug with \_bulk endpoint](https://discuss.elastic.co/t/a-bug-with-bulk-endpoint/301776)
**Author:** [@Rithik\_greendeck](https://discuss.elastic.co/u/Rithik_greendeck)\ **Replies:** 4\ **Last updated:** [April 7, 2022, 7:12am UTC](https://discuss.elastic.co/t/a-bug-with-bulk-endpoint/301776 "2022-04-07T07:12:56Z")
\[2022-04-06T07:32:33,436\]\[ERROR\]\[logstash.outputs.elasticsearch\]\[main\]\[1ba476d6d04397ba2f8ff005a1e5552e5a5314abde283c5a9a485566374f1026\] Encountered an unexpected error submitting a bulk request, will retry {:message=\>"S… --- ## [Elastic Maven Repository Down?](https://discuss.elastic.co/t/elastic-maven-repository-down/301589)
**Author:** [@jshyun](https://discuss.elastic.co/u/jshyun)\ **Replies:** 3\ **Last updated:** [April 7, 2022, 7:09am UTC](https://discuss.elastic.co/t/elastic-maven-repository-down/301589 "2022-04-07T07:09:56Z")
Is the Maven repository at https://artifacts.elastic.co/maven still functioning? Index pages do not get served and maven can't seem to use it as a valid repository. From other community board posts it seems Elasticsearch… --- ## [Filebeat multiline Pattern on Apache Logs does not work as expected (Filebeat -\> Logstash -\> ES)](https://discuss.elastic.co/t/filebeat-multiline-pattern-on-apache-logs-does-not-work-as-expected-filebeat-logstash-es/301747)
**Author:** [@Bndlr](https://discuss.elastic.co/u/Bndlr)\ **Replies:** 2\ **Last updated:** [April 7, 2022, 6:23am UTC](https://discuss.elastic.co/t/filebeat-multiline-pattern-on-apache-logs-does-not-work-as-expected-filebeat-logstash-es/301747 "2022-04-07T06:23:13Z")
Hello, if have the following multiline pattern in Filebeat Configuration: multiline.pattern: ^((-)\*\[0-9\]{4}-\[0-9\]{2}-\[0-9\]{2}|\[0-9\]{1,3}\\.\[0-9\]{1,3}\\.\[0-9\]{1,3}\\.\[0-9\]{1,3} ) to handle mulitline Log Patterns that cont… --- ## [Bucket Script and Gaps](https://discuss.elastic.co/t/bucket-script-and-gaps/301619)
**Author:** [@bianca6](https://discuss.elastic.co/u/bianca6)\ **Replies:** 3\ **Last updated:** [April 7, 2022, 7:06am UTC](https://discuss.elastic.co/t/bucket-script-and-gaps/301619 "2022-04-07T07:06:26Z")
Hi, According to the documentation, the bucket script should be able to deal with gaps: https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline.html#gap-policy But in my case, I go… --- ## [Cross cluster index in kibana](https://discuss.elastic.co/t/cross-cluster-index-in-kibana/301833)
**Author:** [@subham](https://discuss.elastic.co/u/subham)\ **Replies:** 0\ **Last updated:** [April 7, 2022, 6:21am UTC](https://discuss.elastic.co/t/cross-cluster-index-in-kibana/301833 "2022-04-07T06:21:11Z")
Hi All, Can someone tell whether we can get indices from cross cluster in Index Management. I am able to get the data of new index from remote cluster in dev tools but not able to see the same index in kibana. Please … --- ## [How to upgrade more than 1 Elastic Agent at the same time](https://discuss.elastic.co/t/how-to-upgrade-more-than-1-elastic-agent-at-the-same-time/301745)
**Author:** [@JimG](https://discuss.elastic.co/u/JimG)\ **Replies:** 2\ **Last updated:** [April 7, 2022, 6:14am UTC](https://discuss.elastic.co/t/how-to-upgrade-more-than-1-elastic-agent-at-the-same-time/301745 "2022-04-07T06:14:19Z")
Hi, Is it possible to upgrade more than 1 Elastic agent at a time? I dont know if it is a missing feature or if i just dont have the knowledge how to do this. With 750+ enrolled agents, it's a long proces to manual upg… --- ## [Fields not coming in discover](https://discuss.elastic.co/t/fields-not-coming-in-discover/301181)
**Author:** [@Shubham\_Singh](https://discuss.elastic.co/u/Shubham_Singh)\ **Replies:** 7\ **Last updated:** [April 7, 2022, 6:11am UTC](https://discuss.elastic.co/t/fields-not-coming-in-discover/301181 "2022-04-07T06:11:16Z")
I have a stack\_trace field in log file but in kibana it turn out to be in hidden field with no value. Rest other fields are coming as expected. I can see the field in vizualization but not in discover . The field type is… --- ## [Index Data Ingestion](https://discuss.elastic.co/t/index-data-ingestion/301830)
**Author:** [@vikasp](https://discuss.elastic.co/u/vikasp)\ **Replies:** 1\ **Last updated:** [April 7, 2022, 5:36am UTC](https://discuss.elastic.co/t/index-data-ingestion/301830 "2022-04-07T05:36:23Z")
Hi, I am trying to understand how the ingestion works. Lets say I created an index with 6 primary shards, 1 replica. and I am ingesting to the cluster (say logstash is continuously pushing data) to a coordinating only… --- ## [Logstash-input-file scans non latin character file name cause InvalidPathException and stopped working](https://discuss.elastic.co/t/logstash-input-file-scans-non-latin-character-file-name-cause-invalidpathexception-and-stopped-working/301818)
**Author:** [@lixplor](https://discuss.elastic.co/u/lixplor)\ **Replies:** 1\ **Last updated:** [April 7, 2022, 3:37am UTC](https://discuss.elastic.co/t/logstash-input-file-scans-non-latin-character-file-name-cause-invalidpathexception-and-stopped-working/301818 "2022-04-07T03:37:14Z")
Hi, I'm using Logstash 6.8.23 with file input plugin 4.1.18 on a JRE 8 env. OS is suse11 and system default locale is zh\_CN.gbk. When Logstash collecting logs, it reached a file with non-latin name. eg. 你好.xml. Then Lo… --- ## [Bulk Import of data for different indices in presence of enrich ingest pipeline](https://discuss.elastic.co/t/bulk-import-of-data-for-different-indices-in-presence-of-enrich-ingest-pipeline/301689)
**Author:** [@Matthew\_Dominic\_Ramp](https://discuss.elastic.co/u/Matthew_Dominic_Ramp)\ **Replies:** 4\ **Last updated:** [April 7, 2022, 3:21am UTC](https://discuss.elastic.co/t/bulk-import-of-data-for-different-indices-in-presence-of-enrich-ingest-pipeline/301689 "2022-04-07T03:21:12Z")
Context: I have two indices: devices and events devices has an enrich policy associated with it and a pipeline was created to enable this data enrichment. This pipeline works fine. i want to bulk import JSON objects fo… --- ## [Best ElasticSearch configuration mode](https://discuss.elastic.co/t/best-elasticsearch-configuration-mode/301566)
**Author:** [@TomTom](https://discuss.elastic.co/u/TomTom)\ **Replies:** 9\ **Last updated:** [April 7, 2022, 2:28am UTC](https://discuss.elastic.co/t/best-elasticsearch-configuration-mode/301566 "2022-04-07T02:28:32Z")
Years ago I configured a server\* with Elasticsearch, however, until today my knowledge to configure, manage, define nodes, is totally 0. I don't have nodes for ingest, digest, etc, as I have no idea what they do. Even m… --- ## [Close/flush/reset syslog input connection on logstash](https://discuss.elastic.co/t/close-flush-reset-syslog-input-connection-on-logstash/301813)
**Author:** [@alfianaf](https://discuss.elastic.co/u/alfianaf)\ **Replies:** 2\ **Last updated:** [April 7, 2022, 2:07am UTC](https://discuss.elastic.co/t/close-flush-reset-syslog-input-connection-on-logstash/301813 "2022-04-07T02:07:42Z")
Hello, I'm handling logstash syslog input from pcf, the log can be ingested, and there is no problem with that, but when I check the file descriptor and open connection on the specific port, they kept increasing is th… --- ## [Filebeat - Kubernetes Autodiscovery with ElasticSearch Module](https://discuss.elastic.co/t/filebeat-kubernetes-autodiscovery-with-elasticsearch-module/301815)
**Author:** [@Jonathan\_Mabrito](https://discuss.elastic.co/u/Jonathan_Mabrito)\ **Replies:** 0\ **Last updated:** [April 7, 2022, 1:50am UTC](https://discuss.elastic.co/t/filebeat-kubernetes-autodiscovery-with-elasticsearch-module/301815 "2022-04-07T01:50:45Z")
Hi There, Hoping someone might be able to help with getting Filebeats Autodiscovery up. I am trying to detect my Elasticsearch containers in my Kubernetes Cluster (using vanilla K8's). Here is my proposed K8's file: a… --- ## [Elastic Search Logstash how to query all fields and get all fields into pipeline?](https://discuss.elastic.co/t/elastic-search-logstash-how-to-query-all-fields-and-get-all-fields-into-pipeline/301810)
**Author:** [@MLsuper](https://discuss.elastic.co/u/MLsuper)\ **Replies:** 0\ **Last updated:** [April 7, 2022, 12:19am UTC](https://discuss.elastic.co/t/elastic-search-logstash-how-to-query-all-fields-and-get-all-fields-into-pipeline/301810 "2022-04-07T00:19:22Z")
So I have a logstash pipeline that is currently setup with this: for a query input { hosts =\> ... query =\> '{ "query": { "match\_all": {} }}' target =\> "\[@metasource\]\[\_source\]" index… --- ## [Is default dynamic mapping of documents okay?](https://discuss.elastic.co/t/is-default-dynamic-mapping-of-documents-okay/301784)
**Author:** [@ksuren](https://discuss.elastic.co/u/ksuren)\ **Replies:** 2\ **Last updated:** [April 6, 2022, 11:39pm UTC](https://discuss.elastic.co/t/is-default-dynamic-mapping-of-documents-okay/301784 "2022-04-06T23:39:12Z")
While creating a business listing data store, so far added Business and Categories to an index. The mappings show as: Q1: Is this okay? And/or referring to Mapping | Elasticsearch Guide \[8.1\] | Elastic should I crea… --- ## [Does elastic master node really delete or create an index?](https://discuss.elastic.co/t/does-elastic-master-node-really-delete-or-create-an-index/301661)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 3\ **Last updated:** [April 6, 2022, 10:49pm UTC](https://discuss.elastic.co/t/does-elastic-master-node-really-delete-or-create-an-index/301661 "2022-04-06T22:49:35Z")
I am just confuse that what exactly does master node do in cluster According to my understanding it just maintain cluster state and each data node have cluster state information. From this documentation https://www.el… --- ## [Upgrade of elastic search version](https://discuss.elastic.co/t/upgrade-of-elastic-search-version/301620)
**Author:** [@aman123](https://discuss.elastic.co/u/aman123)\ **Replies:** 3\ **Last updated:** [April 6, 2022, 10:48pm UTC](https://discuss.elastic.co/t/upgrade-of-elastic-search-version/301620 "2022-04-06T22:48:11Z")
hi team, I have 10 node cluster, I upgraded from 10 nodes to 2 nodes now 1 node is master node . Do I need make master node to other node and then upgrade 1 st node or I can directly upgrade the master node. --- ## [Elastic GravityApps Sql Backup Transaction Logs](https://discuss.elastic.co/t/elastic-gravityapps-sql-backup-transaction-logs/301494)
**Author:** [@Techplay27](https://discuss.elastic.co/u/Techplay27)\ **Replies:** 3\ **Last updated:** [April 6, 2022, 10:44pm UTC](https://discuss.elastic.co/t/elastic-gravityapps-sql-backup-transaction-logs/301494 "2022-04-06T22:44:30Z")
I can see quite a few transaction logs dating back to last year June and this is really using a lot of disk space up. I have a scheduled a full backup of the server, so after this successfully completes I will delete all… --- ## [Define custom unique key](https://discuss.elastic.co/t/define-custom-unique-key/301642)
**Author:** [@nn14](https://discuss.elastic.co/u/nn14)\ **Replies:** 3\ **Last updated:** [April 6, 2022, 10:42pm UTC](https://discuss.elastic.co/t/define-custom-unique-key/301642 "2022-04-06T22:42:45Z")
Hi team, Is there a way to define our own custom unique key for the document which is similar to uniqueKey provided in Solr. For e.g I need to define employeeId or a combination of 2 fields as unique id. Any example w… --- ## [Filter Values in Different Streams and Group Them in Data Table](https://discuss.elastic.co/t/filter-values-in-different-streams-and-group-them-in-data-table/301742)
**Author:** [@\_PA](https://discuss.elastic.co/u/_PA)\ **Replies:** 0\ **Last updated:** [April 6, 2022, 10:59am UTC](https://discuss.elastic.co/t/filter-values-in-different-streams-and-group-them-in-data-table/301742 "2022-04-06T10:59:02Z")
I am running ELK 7 and I have the following scenario. I have data in one index that looks like this: |Time|ID|AAA| |Apr 6, 2022 @ 11:48:11.197|300965890|tar1| |Apr 6, 2022 @ 11:48:11.196|300965890|add3| |Apr 6, 2022… --- ## [Logstash input for oracle database](https://discuss.elastic.co/t/logstash-input-for-oracle-database/301683)
**Author:** [@altink](https://discuss.elastic.co/u/altink)\ **Replies:** 2\ **Last updated:** [April 6, 2022, 9:46pm UTC](https://discuss.elastic.co/t/logstash-input-for-oracle-database/301683 "2022-04-06T21:46:29Z")
I have an Bitnami virtual ova distribution, ELK 7.17 on Debian 10. Elastic, Kibana and Logstash run as services (daemons). I have put the logstash config file logstash-ora-01.conf under /opt/bitnami/logstash/config in… --- ## [Consulta no elastic](https://discuss.elastic.co/t/consulta-no-elastic/301792)
**Author:** [@Gabriel\_mec77](https://discuss.elastic.co/u/Gabriel_mec77)\ **Replies:** 4\ **Last updated:** [April 6, 2022, 8:43pm UTC](https://discuss.elastic.co/t/consulta-no-elastic/301792 "2022-04-06T20:43:50Z")
Como procurar apenas indices em vermelho no elastic --- ## [Calculate metric to raise alert in kibana](https://discuss.elastic.co/t/calculate-metric-to-raise-alert-in-kibana/301799)
**Author:** [@waelboss](https://discuss.elastic.co/u/waelboss)\ **Replies:** 0\ **Last updated:** [April 6, 2022, 8:21pm UTC](https://discuss.elastic.co/t/calculate-metric-to-raise-alert-in-kibana/301799 "2022-04-06T20:21:08Z")
i want to fire an alert with a query condition if min value = max value and current value \> 40 then fire alert the purpose is to fire the alert if the queue size doesn't decrease over a time interval of 5 minutes her… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=981) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=983)