# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=990 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 991 --- ## [Access to matched\_queries in Painless script](https://discuss.elastic.co/t/access-to-matched-queries-in-painless-script/301109)
**Author:** [@scurtis\_es](https://discuss.elastic.co/u/scurtis_es)\ **Replies:** 3\ **Last updated:** [April 1, 2022, 3:42pm UTC](https://discuss.elastic.co/t/access-to-matched-queries-in-painless-script/301109 "2022-04-01T15:42:04Z")
I am writing a Painless script in a Java-based search application, and I wondered if it is now possible to access the "matched\_queries" value for named queries in order to better determine which clauses matched in a give… --- ## [Rollup job or transform size of resulting indices - lifecycle?](https://discuss.elastic.co/t/rollup-job-or-transform-size-of-resulting-indices-lifecycle/301213)
**Author:** [@Matt\_McGovern](https://discuss.elastic.co/u/Matt_McGovern)\ **Replies:** 2\ **Last updated:** [April 1, 2022, 2:46pm UTC](https://discuss.elastic.co/t/rollup-job-or-transform-size-of-resulting-indices-lifecycle/301213 "2022-04-01T14:46:43Z")
Do Rollup jobs ever reduce in size on their own? I couldn't find a way to add the index created by a rollup job to a lifecycle policy. The rollup job never seemed to reduce in size so I turned the job off. Need case: we… --- ## [Can't create new 3 node cluster using docker swarm](https://discuss.elastic.co/t/cant-create-new-3-node-cluster-using-docker-swarm/301337)
**Author:** [@chrish1](https://discuss.elastic.co/u/chrish1)\ **Replies:** 0\ **Last updated:** [April 1, 2022, 2:38pm UTC](https://discuss.elastic.co/t/cant-create-new-3-node-cluster-using-docker-swarm/301337 "2022-04-01T14:38:13Z")
I am trying to setup a new 3 node Elasticsearch cluster within a swarm. Docker version: 20.10.12 Elastic version: 7.16.3 When deploying the stack we see the below errors from the docker service logs: elastic\_elastics… --- ## [Cause of i/o timeout errors](https://discuss.elastic.co/t/cause-of-i-o-timeout-errors/301330)
**Author:** [@theMike](https://discuss.elastic.co/u/theMike)\ **Replies:** 0\ **Last updated:** [April 1, 2022, 1:48pm UTC](https://discuss.elastic.co/t/cause-of-i-o-timeout-errors/301330 "2022-04-01T13:48:18Z")
Hi, I'm trying to figure out the root cause of this filebeat issue. Basically filebeat 7.15.2 connecting to Kafka. When filebeat starts it sends for approx 5 to 10 min then, at a certin point the following happens: 69… --- ## [Disable geoip](https://discuss.elastic.co/t/disable-geoip/301297)
**Author:** [@Foggie](https://discuss.elastic.co/u/Foggie)\ **Replies:** 2\ **Last updated:** [April 1, 2022, 1:44pm UTC](https://discuss.elastic.co/t/disable-geoip/301297 "2022-04-01T13:44:37Z")
I am trying to deploy Elasticsearch 7.17.1 on a server behind a very strict firewall (basically no Internet access is allowed. The deployment is via a bat file (not Docker). The Elasticsearch.yml is virtually all comme… --- ## [Filebeat syslog problem](https://discuss.elastic.co/t/filebeat-syslog-problem/301328)
**Author:** [@adis3421](https://discuss.elastic.co/u/adis3421)\ **Replies:** 0\ **Last updated:** [April 1, 2022, 1:43pm UTC](https://discuss.elastic.co/t/filebeat-syslog-problem/301328 "2022-04-01T13:43:12Z")
Hi, I using filebeat via logstash and normaly connect to elasticsearch. In normal connect is ok but via logstash I have a problem: illegal\_argument\_exception at shard 0 index filebeat-8.1.2-2022.04.01 node x1NX6Z2sRz2p… --- ## [Logstash pipeline development tool 2022](https://discuss.elastic.co/t/logstash-pipeline-development-tool-2022/301325)
**Author:** [@epacke](https://discuss.elastic.co/u/epacke)\ **Replies:** 0\ **Last updated:** [April 1, 2022, 1:16pm UTC](https://discuss.elastic.co/t/logstash-pipeline-development-tool-2022/301325 "2022-04-01T13:16:31Z")
Hi there! It's time for the yearly release. :slight\_smile: For those that have not seen it it's a tool to help with the development of logstash filters. You simply enter raw log lines into an input field, choose which … --- ## [1 of 21 shards failed](https://discuss.elastic.co/t/1-of-21-shards-failed/301259)
**Author:** [@alex\_96](https://discuss.elastic.co/u/alex_96)\ **Replies:** 4\ **Last updated:** [April 1, 2022, 12:42pm UTC](https://discuss.elastic.co/t/1-of-21-shards-failed/301259 "2022-04-01T12:42:55Z")
Hello, today I went to my dashboard and saw such an error "1 of 21 shards failed", looking at the details I saw the following Request: { "aggs": { "2": { "terms": { "field": "agent.name", "or… --- ## [elasticsearch.exceptions.ConnectionError](https://discuss.elastic.co/t/elasticsearch-exceptions-connectionerror/301221)
**Author:** [@Hammadi\_Ben\_cheikh1](https://discuss.elastic.co/u/Hammadi_Ben_cheikh1)\ **Replies:** 3\ **Last updated:** [April 1, 2022, 12:35pm UTC](https://discuss.elastic.co/t/elasticsearch-exceptions-connectionerror/301221 "2022-04-01T12:35:23Z")
Hello my friends ! i am working at a Django project , that use Elasticsearch , so when i transfert my project to docker container , i got this error from indexer es = Elasticsearch('http://127.0.0.1:9200/') Plea… --- ## [Huge aggregation triggers CircuitBreaker in loop](https://discuss.elastic.co/t/huge-aggregation-triggers-circuitbreaker-in-loop/299637)
**Author:** [@elephant](https://discuss.elastic.co/u/elephant)\ **Replies:** 4\ **Last updated:** [April 1, 2022, 11:15am UTC](https://discuss.elastic.co/t/huge-aggregation-triggers-circuitbreaker-in-loop/299637 "2022-04-01T11:15:20Z")
Hi, I was trying to make aggregations on a very huge index. The search triggered the circuit breaker which was expected given the size of the index (billion of documents): elastic1\_1 | "Caused by: org.elastics… --- ## [Shard relocation progress, 2022](https://discuss.elastic.co/t/shard-relocation-progress-2022/301314)
**Author:** [@nisow95612](https://discuss.elastic.co/u/nisow95612)\ **Replies:** 1\ **Last updated:** [April 1, 2022, 10:53am UTC](https://discuss.elastic.co/t/shard-relocation-progress-2022/301314 "2022-04-01T10:53:40Z")
What's the best way to monitor shard relocation progress? This is follow-up to Shard relocation progress --- ## [Enrichment via Elasticsearch Lookup](https://discuss.elastic.co/t/enrichment-via-elasticsearch-lookup/301295)
**Author:** [@shinobu](https://discuss.elastic.co/u/shinobu)\ **Replies:** 1\ **Last updated:** [April 1, 2022, 10:37am UTC](https://discuss.elastic.co/t/enrichment-via-elasticsearch-lookup/301295 "2022-04-01T10:37:05Z")
Hello, I tried to enrich alerting information with data from a logindex. In Logstash I configured the following as a filter: elasticsearch { hosts =\> \["http://localhost:9200"\] index =\> "logfile" query =\> … --- ## [No Write Index in Elasticsearch](https://discuss.elastic.co/t/no-write-index-in-elasticsearch/301306)
**Author:** [@wcpoon](https://discuss.elastic.co/u/wcpoon)\ **Replies:** 1\ **Last updated:** [April 1, 2022, 10:23am UTC](https://discuss.elastic.co/t/no-write-index-in-elasticsearch/301306 "2022-04-01T10:23:55Z")
Hi, I accidently deleted the active logstash-xxxxx indices. Now my logs cannot index. I check the logstash logs, below is the warning. \[2022-04-01T18:11:02,900\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\]\[bd7d93f8f… --- ## [Is logstash 7.16.2 effected with CVE-2022-22965.A remote code execution vulnerability](https://discuss.elastic.co/t/is-logstash-7-16-2-effected-with-cve-2022-22965-a-remote-code-execution-vulnerability/301305)
**Author:** [@rama543](https://discuss.elastic.co/u/rama543)\ **Replies:** 0\ **Last updated:** [April 1, 2022, 10:09am UTC](https://discuss.elastic.co/t/is-logstash-7-16-2-effected-with-cve-2022-22965-a-remote-code-execution-vulnerability/301305 "2022-04-01T10:09:54Z")
We deployed Logstash 7.16.2 version in amazon EC2 instances . Is logstash imacted with this new vulnerability CVE-2022-22965(Spring4shell) A remote code execution vulnerability Thanks --- ## [Environment variable to configure elasticsearch.customHeaders for Kibana](https://discuss.elastic.co/t/environment-variable-to-configure-elasticsearch-customheaders-for-kibana/301304)
**Author:** [@duarnad](https://discuss.elastic.co/u/duarnad)\ **Replies:** 0\ **Last updated:** [April 1, 2022, 10:06am UTC](https://discuss.elastic.co/t/environment-variable-to-configure-elasticsearch-customheaders-for-kibana/301304 "2022-04-01T10:06:49Z")
Hello, My goal is to configure elastic.customHeaders for basic auth from an environment variable. I have tried several combinations but it seems that I can't find the right one, and I wonder at what step in the parsing… --- ## [Elasticsearch failed start when enable x-pack security](https://discuss.elastic.co/t/elasticsearch-failed-start-when-enable-x-pack-security/301117)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 12\ **Last updated:** [April 1, 2022, 9:26am UTC](https://discuss.elastic.co/t/elasticsearch-failed-start-when-enable-x-pack-security/301117 "2022-04-01T09:26:02Z")
first thing first, i just create ssl/tls certificate using Elasticsearch-certutil cert and then i created this configuration into bottom Elasticsearch.yml #xpack xpack.security.enabled: true xpack.security.transport.ss… --- ## [Dashboard based on data from 2 indexes](https://discuss.elastic.co/t/dashboard-based-on-data-from-2-indexes/300419)
**Author:** [@shinobu](https://discuss.elastic.co/u/shinobu)\ **Replies:** 2\ **Last updated:** [April 1, 2022, 8:57am UTC](https://discuss.elastic.co/t/dashboard-based-on-data-from-2-indexes/300419 "2022-04-01T08:57:25Z")
Hello, I want to create a Dashboard with a table thats showing me every url that does not a specific value in another field. So basically i have 2 indexes: Alert index: { "url": "sometemplateurl.com" } Lookup Inde… --- ## [Doubts about Multifields](https://discuss.elastic.co/t/doubts-about-multifields/301244)
**Author:** [@RabBit\_BR](https://discuss.elastic.co/u/RabBit_BR)\ **Replies:** 1\ **Last updated:** [April 1, 2022, 8:30am UTC](https://discuss.elastic.co/t/doubts-about-multifields/301244 "2022-04-01T08:30:10Z")
Hi! Can anyone tell me if using the multifields strategy (strategy A) would be better than individually separating (strategy B) each field? What would be the advantages between one and the other? Strategy A { "titl… --- ## [Date range matching in ES](https://discuss.elastic.co/t/date-range-matching-in-es/301289)
**Author:** [@TheGreatBaldOne](https://discuss.elastic.co/u/TheGreatBaldOne)\ **Replies:** 0\ **Last updated:** [April 1, 2022, 7:47am UTC](https://discuss.elastic.co/t/date-range-matching-in-es/301289 "2022-04-01T07:47:56Z")
I would like to create a small scheduling app. Lets say we have Joe and he needs to teach online multiple people individually about .. gardening. He cannot teach more than 1 person at a time. He has a calendar of 'ava… --- ## [Logstash.filters.mutate](https://discuss.elastic.co/t/logstash-filters-mutate/301241)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 6\ **Last updated:** [April 1, 2022, 7:17am UTC](https://discuss.elastic.co/t/logstash-filters-mutate/301241 "2022-04-01T07:17:34Z")
Hi I'm facing the problem with filters.mutate \[2022-03-31T17:49:26,980\]\[WARN \]\[logstash.filters.mutate \]\[subscriberstrunk\]\[11ac345049d68c6fc55061d82c036ef3c26cf4e2fe68230c4df255bc3403de66\] Exception caught while apply… --- ## [Is object storage mandatory for new Java API?](https://discuss.elastic.co/t/is-object-storage-mandatory-for-new-java-api/300481)
**Author:** [@ivanqwam](https://discuss.elastic.co/u/ivanqwam)\ **Replies:** 3\ **Last updated:** [April 1, 2022, 7:11am UTC](https://discuss.elastic.co/t/is-object-storage-mandatory-for-new-java-api/300481 "2022-04-01T07:11:25Z")
From this link https://github.com/elastic/elasticsearch-java/blob/main/java-client/src/test/java/co/elastic/clients/elasticsearch/end\_to\_end/RequestTest.java I can see that indexing is using an object storage strategy … --- ## [Logstash 401 error](https://discuss.elastic.co/t/logstash-401-error/301247)
**Author:** [@chaishiqi](https://discuss.elastic.co/u/chaishiqi)\ **Replies:** 2\ **Last updated:** [April 1, 2022, 6:28am UTC](https://discuss.elastic.co/t/logstash-401-error/301247 "2022-04-01T06:28:08Z")
Here is my logstash config: input { file { path =\> "/var/log/nginx/access.log" codec =\> "json" } } output { elasticsearch { hosts =\> \["https://10.0.5.132:9200"\] ssl =\> true cacert =\> "/etc/logs… --- ## [DSL query : How to parse message contain slash](https://discuss.elastic.co/t/dsl-query-how-to-parse-message-contain-slash/300216)
**Author:** [@RickT](https://discuss.elastic.co/u/RickT)\ **Replies:** 7\ **Last updated:** [April 1, 2022, 6:27am UTC](https://discuss.elastic.co/t/dsl-query-how-to-parse-message-contain-slash/300216 "2022-04-01T06:27:56Z")
Hi, How can i parse a message field wich contain slashes ? I'm trying with query regexp, but without result. Thanks all --- ## [Returning the number of results which match a large query?](https://discuss.elastic.co/t/returning-the-number-of-results-which-match-a-large-query/301275)
**Author:** [@catmanjan](https://discuss.elastic.co/u/catmanjan)\ **Replies:** 3\ **Last updated:** [April 1, 2022, 4:27am UTC](https://discuss.elastic.co/t/returning-the-number-of-results-which-match-a-large-query/301275 "2022-04-01T04:27:33Z")
I have an index with 100 million documents What's the fastest way for me to count the number of documents which meet a certain query? I don't want the documents, just the number of documents that match the query. I am … --- ## [Elastic Agent Heartbeat Folder filled with Core Dumps](https://discuss.elastic.co/t/elastic-agent-heartbeat-folder-filled-with-core-dumps/301262)
**Author:** [@RichiCoder](https://discuss.elastic.co/u/RichiCoder)\ **Replies:** 7\ **Last updated:** [April 1, 2022, 2:50am UTC](https://discuss.elastic.co/t/elastic-agent-heartbeat-folder-filled-with-core-dumps/301262 "2022-04-01T02:50:57Z")
Howdy! We're using the Elastic Agent's synthetic agent running in docker to monitor some web properties. There's no visible issues or errors, but after some time the agent "dies" for lack of a better term. After some inv… --- ## [When \`xpack.ml.enabled\` is set to false, entering Kibana's machine learning page has a error in the log](https://discuss.elastic.co/t/when-xpack-ml-enabled-is-set-to-false-entering-kibanas-machine-learning-page-has-a-error-in-the-log/301158)
**Author:** [@linghengqian](https://discuss.elastic.co/u/linghengqian)\ **Replies:** 4\ **Last updated:** [April 1, 2022, 12:18am UTC](https://discuss.elastic.co/t/when-xpack-ml-enabled-is-set-to-false-entering-kibanas-machine-learning-page-has-a-error-in-the-log/301158 "2022-04-01T00:18:43Z")
I am doing some tests in docker-compose.yml, I noticed that when I set the Elasticsearch environment variable to contain XPACK\_ML\_ENABLED: false, the machine learning page of the Kibana instance will jump to some urls … --- ## [No space left on device - Logstash](https://discuss.elastic.co/t/no-space-left-on-device-logstash/301154)
**Author:** [@Victorv18](https://discuss.elastic.co/u/Victorv18)\ **Replies:** 3\ **Last updated:** [March 31, 2022, 11:18pm UTC](https://discuss.elastic.co/t/no-space-left-on-device-logstash/301154 "2022-03-31T23:18:52Z")
I have an ELK stack, hosted on a Linux, an EC2 VM running at AWS and my logstash works in the background on that same environment I used to start logstash as a service using "systemctl start logstash" and it works norma… --- ## [TSVB links on each\_all](https://discuss.elastic.co/t/tsvb-links-on-each-all/301271)
**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 10:48pm UTC](https://discuss.elastic.co/t/tsvb-links-on-each-all/301271 "2022-03-31T22:48:24Z")
I'm trying to create a list of links based on some fields value, but the markdown syntax is not working. Is there any way to do each\_all links? {{#each \_all}} - \[{{ label }}\](http://google.com) {{/each}} … --- ## [Logstash keystore uninitialized constant I18n](https://discuss.elastic.co/t/logstash-keystore-uninitialized-constant-i18n/301270)
**Author:** [@DonKool](https://discuss.elastic.co/u/DonKool)\ **Replies:** 0\ **Last updated:** [March 31, 2022, 10:08pm UTC](https://discuss.elastic.co/t/logstash-keystore-uninitialized-constant-i18n/301270 "2022-03-31T22:08:31Z")
Running version 8.1.1 of ELK in Docker containers. Trying to secure the Logstash API on port 9600. This requires the creation of a keystore file. When trying to create a Logstash keystore file, get the following error… --- ## [Total Shards Differs (dev console vs. script output)](https://discuss.elastic.co/t/total-shards-differs-dev-console-vs-script-output/301258)
**Author:** [@codewriterguy](https://discuss.elastic.co/u/codewriterguy)\ **Replies:** 2\ **Last updated:** [March 31, 2022, 10:07pm UTC](https://discuss.elastic.co/t/total-shards-differs-dev-console-vs-script-output/301258 "2022-03-31T22:07:44Z")
Hi lovely Elastic folks, I have a script that rolls over a few data streams and my cluster quickly became oversharded. The rollover requests are now failing with: elasticsearch.exceptions.RequestError: RequestError(40… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=989) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=991)