# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=991 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 992 --- ## [:client:rest-high-level:qa does not exist](https://discuss.elastic.co/t/rest-high-level-qa-does-not-exist/301255)
**Author:** [@erdemtuna](https://discuss.elastic.co/u/erdemtuna)\ **Replies:** 0\ **Last updated:** [March 31, 2022, 8:36pm UTC](https://discuss.elastic.co/t/rest-high-level-qa-does-not-exist/301255 "2022-03-31T20:36:51Z")
I am using SonarQube - \* Community Edition Version 9.3 (build 51899). I wanted to run SonarQube (SonarScanner) on Elasticsearch. I could build the project (Elasticsearch) with its native gradle command ./gradlew localDis… --- ## [Logstash conf file is not creating an index in ES](https://discuss.elastic.co/t/logstash-conf-file-is-not-creating-an-index-in-es/301243)
**Author:** [@yash\_196](https://discuss.elastic.co/u/yash_196)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 6:42pm UTC](https://discuss.elastic.co/t/logstash-conf-file-is-not-creating-an-index-in-es/301243 "2022-03-31T18:42:31Z")
Logstash conf file is not creating an index in ES when using docker-compose. This is my logstash.conf code, can anyone help me figure out the solution? input{ elasticsearch { hosts =\> "elasticsearch:9200" … --- ## [Transform group by showing data that's not in the original index](https://discuss.elastic.co/t/transform-group-by-showing-data-thats-not-in-the-original-index/301239)
**Author:** [@Matt\_McGovern](https://discuss.elastic.co/u/Matt_McGovern)\ **Replies:** 0\ **Last updated:** [March 31, 2022, 5:51pm UTC](https://discuss.elastic.co/t/transform-group-by-showing-data-thats-not-in-the-original-index/301239 "2022-03-31T17:51:56Z")
I've got a tranform set up that has multiple group fields and aggregations. The first group by field shows data in the resulting index that is not anywhere in the original index. It starts with the text: deleterulebyrule… --- ## [No Result from osquery elastic agent 7.14.0](https://discuss.elastic.co/t/no-result-from-osquery-elastic-agent-7-14-0/281097)
**Author:** [@cheapsupps](https://discuss.elastic.co/u/cheapsupps)\ **Replies:** 12\ **Last updated:** [March 31, 2022, 5:26pm UTC](https://discuss.elastic.co/t/no-result-from-osquery-elastic-agent-7-14-0/281097 "2022-03-31T17:26:36Z")
I have tried to run the query using osquery manager on one of my agent select \* from users However, no result is returned. I got the below message from my agent logs {"log.level":"warn","@timestamp":"2021-08-11T08:27… --- ## [Detect\_Failed\_Logon](https://discuss.elastic.co/t/detect-failed-logon/301230)
**Author:** [@mohamed\_hamham](https://discuss.elastic.co/u/mohamed_hamham)\ **Replies:** 0\ **Last updated:** [March 31, 2022, 5:15pm UTC](https://discuss.elastic.co/t/detect-failed-logon/301230 "2022-03-31T17:15:01Z")
Hello Community; Please show me some help on writing a rule on Kibana interface. I want to detect users who are failed to logon 5 times to their account. i've already detect failed logon attempt based on EventID = 462… --- ## [Multiple grok pattern, really multiple?](https://discuss.elastic.co/t/multiple-grok-pattern-really-multiple/301166)
**Author:** [@lgllrd](https://discuss.elastic.co/u/lgllrd)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 5:05pm UTC](https://discuss.elastic.co/t/multiple-grok-pattern-really-multiple/301166 "2022-03-31T17:05:04Z")
Hello, I'm trying to use the multiple grok pattern as in the documentation ( Grok filter plugin | Logstash Reference \[8.1\] | Elastic ) but I notice that it only handles the first two patterns. Here is my filter : { … --- ## [Geoip\_databases index allocation failed](https://discuss.elastic.co/t/geoip-databases-index-allocation-failed/300783)
**Author:** [@roman.huesler](https://discuss.elastic.co/u/roman.huesler)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 3:52pm UTC](https://discuss.elastic.co/t/geoip-databases-index-allocation-failed/300783 "2022-03-31T15:52:17Z")
Im learning and playing around with Elasticsearch. Just setup a new local test cluster with 3 nodes on kubernetes (Elasticsearch 8.1.0) and also set up kibana 8.1.0. In kubernetes its a StateFulset with storage on NFS. T… --- ## [Group\_concat equivalent](https://discuss.elastic.co/t/group-concat-equivalent/301222)
**Author:** [@en666](https://discuss.elastic.co/u/en666)\ **Replies:** 0\ **Last updated:** [March 31, 2022, 3:42pm UTC](https://discuss.elastic.co/t/group-concat-equivalent/301222 "2022-03-31T15:42:46Z")
Hi all, I've noticed that this very question was asked a number of times and always closed without an answer. I am new to Elasticsearch and I've managed to GROUP the hits of a query BY multiple fields, which is good ne… --- ## [Kibana region value is misspelt (SJÆLLAND NOT SJAÆLLAND)](https://discuss.elastic.co/t/kibana-region-value-is-misspelt-sjaelland-not-sjaaelland/300805)
**Author:** [@Sinchana\_P](https://discuss.elastic.co/u/Sinchana_P)\ **Replies:** 3\ **Last updated:** [March 31, 2022, 3:31pm UTC](https://discuss.elastic.co/t/kibana-region-value-is-misspelt-sjaelland-not-sjaaelland/300805 "2022-03-31T15:31:52Z")
The region name is spelt wrong in https://maps.elastic.co/v7.10/index.html?locale=en#file/administrative\_regions\_lvl2 This causes region map filter also to have wrong spelling and hence difficult to find the name. Ple… --- ## [HTTP Filter --- Body Syntax](https://discuss.elastic.co/t/http-filter-body-syntax/301217)
**Author:** [@JeremyP](https://discuss.elastic.co/u/JeremyP)\ **Replies:** 0\ **Last updated:** [March 31, 2022, 2:59pm UTC](https://discuss.elastic.co/t/http-filter-body-syntax/301217 "2022-03-31T14:59:21Z")
Hello, I'm trying to use an HTTP filter with a POST and body and I'm having a hard time nailing down the syntax. The JSON body which I can get working using postman is as follows: { "filters": \[ { "day… --- ## [Kinaba runs an error](https://discuss.elastic.co/t/kinaba-runs-an-error/299809)
**Author:** [@spoilsme](https://discuss.elastic.co/u/spoilsme)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 2:48pm UTC](https://discuss.elastic.co/t/kinaba-runs-an-error/299809 "2022-03-31T14:48:44Z")
machine learning --- ## [How to implement Search using Java API Client 8.1](https://discuss.elastic.co/t/how-to-implement-search-using-java-api-client-8-1/301153)
**Author:** [@ksuren](https://discuss.elastic.co/u/ksuren)\ **Replies:** 2\ **Last updated:** [March 31, 2022, 2:24pm UTC](https://discuss.elastic.co/t/how-to-implement-search-using-java-api-client-8-1/301153 "2022-03-31T14:24:23Z")
The docs here Elasticsearch Java API Client \[8.1\] | Elastic do not have clear examples of using the Java API Client. Although I can view the docs for all the available classes Overview (java-client 8.1.1 API) but not sur… --- ## [Failed to start elasticsearch 7.16.2 after upgrade from 6.8.8](https://discuss.elastic.co/t/failed-to-start-elasticsearch-7-16-2-after-upgrade-from-6-8-8/301192)
**Author:** [@msoufiyan](https://discuss.elastic.co/u/msoufiyan)\ **Replies:** 3\ **Last updated:** [March 31, 2022, 2:17pm UTC](https://discuss.elastic.co/t/failed-to-start-elasticsearch-7-16-2-after-upgrade-from-6-8-8/301192 "2022-03-31T14:17:44Z")
hi, i'm new at ELK, i installed the Elasticsearch version 7.16.2 on centos 8 but i get this error so i disabled machine learning functionality with(xpack.ml.enabled: false) org.elasticsearch.ElasticsearchException: Fai… --- ## [Share Canvas on website](https://discuss.elastic.co/t/share-canvas-on-website/301208)
**Author:** [@AlexM566](https://discuss.elastic.co/u/AlexM566)\ **Replies:** 0\ **Last updated:** [March 31, 2022, 2:16pm UTC](https://discuss.elastic.co/t/share-canvas-on-website/301208 "2022-03-31T14:16:23Z")
Hello everyone, I have a problem, I want to share my canvas on the website, but I have a problem, the canvas is not shared on the website. I followed the instructions given in the documentation, but no success. This is … --- ## [Kibana - ES scroll returned fewer total hits than expected!](https://discuss.elastic.co/t/kibana-es-scroll-returned-fewer-total-hits-than-expected/300931)
**Author:** [@hocho](https://discuss.elastic.co/u/hocho)\ **Replies:** 3\ **Last updated:** [March 31, 2022, 2:16pm UTC](https://discuss.elastic.co/t/kibana-es-scroll-returned-fewer-total-hits-than-expected/300931 "2022-03-31T14:16:05Z")
Hello, I have run into an issue where all the events that are displayed in Discover are not exported to the CSV file. When this happens Kibana generates the following log message in kibana.log: ES scroll returned fewe… --- ## [Elastic agent fiebeat error spam](https://discuss.elastic.co/t/elastic-agent-fiebeat-error-spam/301206)
**Author:** [@daymansiege](https://discuss.elastic.co/u/daymansiege)\ **Replies:** 0\ **Last updated:** [March 31, 2022, 2:11pm UTC](https://discuss.elastic.co/t/elastic-agent-fiebeat-error-spam/301206 "2022-03-31T14:11:11Z")
Hello! I am trying to setup Elastic Agent to monitor Kubernetes cluster (Azure). I have successfully installed and configured agents using this guide (had to change image version to 8.1.1 as 8.1.2 does not exist) But … --- ## [Cluster down after upgrade](https://discuss.elastic.co/t/cluster-down-after-upgrade/301004)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 4\ **Last updated:** [March 31, 2022, 1:46pm UTC](https://discuss.elastic.co/t/cluster-down-after-upgrade/301004 "2022-03-31T13:46:20Z")
I have three Linux container as data node and three as master and it fails with following error. can't figure out why. whole file system /s1/Elasticsearch/ndoes is clean on all container. I can run full find /s1 on all … --- ## [Elasticsearch-Input to File-Output: How to ensure query or index has been fully exported?](https://discuss.elastic.co/t/elasticsearch-input-to-file-output-how-to-ensure-query-or-index-has-been-fully-exported/300973)
**Author:** [@aru](https://discuss.elastic.co/u/aru)\ **Replies:** 2\ **Last updated:** [March 31, 2022, 12:10pm UTC](https://discuss.elastic.co/t/elasticsearch-input-to-file-output-how-to-ensure-query-or-index-has-been-fully-exported/300973 "2022-03-31T12:10:59Z")
We need to extract all documents of an index from Elasticsearch to a file. So our pipeline consists of an Elasticsearch input and a file output. At the time of querying Elasticsearch we know that there will be no further… --- ## [Sorting documents with same multiple fields in one bucket](https://discuss.elastic.co/t/sorting-documents-with-same-multiple-fields-in-one-bucket/301202)
**Author:** [@Hella\_Konnecker](https://discuss.elastic.co/u/Hella_Konnecker)\ **Replies:** 0\ **Last updated:** [March 31, 2022, 1:38pm UTC](https://discuss.elastic.co/t/sorting-documents-with-same-multiple-fields-in-one-bucket/301202 "2022-03-31T13:38:47Z")
Hello, I have a dataset with 3 000 000 indices from a shipping platform. Each index describes one product, and I would like to put similar products in one bucket. To be considered “similar” five fields have to be the sa… --- ## [Json split multiple event in Logstash Pipeline](https://discuss.elastic.co/t/json-split-multiple-event-in-logstash-pipeline/301080)
**Author:** [@Purushottam22](https://discuss.elastic.co/u/Purushottam22)\ **Replies:** 3\ **Last updated:** [March 31, 2022, 1:05pm UTC](https://discuss.elastic.co/t/json-split-multiple-event-in-logstash-pipeline/301080 "2022-03-31T13:05:40Z")
Hi All, I am trying to ingest the python script output using exec input plugin filter but i am facing issue while performing split operation on message. I am not sure how can I split into fields, below sample output whi… --- ## [Kibana: Unable to calculate average](https://discuss.elastic.co/t/kibana-unable-to-calculate-average/300847)
**Author:** [@sravanreddy.t](https://discuss.elastic.co/u/sravanreddy.t)\ **Replies:** 5\ **Last updated:** [March 31, 2022, 12:41pm UTC](https://discuss.elastic.co/t/kibana-unable-to-calculate-average/300847 "2022-03-31T12:41:14Z")
Hi, Need your help to calculate the average for the test cases. For Ex: No of test cases executed: 0,0,1,2 Total Builds : 4 My requirement is to calculate the average only for the no of test cases are more than zero.… --- ## [Nested multiple date-range intervals](https://discuss.elastic.co/t/nested-multiple-date-range-intervals/301121)
**Author:** [@TheGreatBaldOne](https://discuss.elastic.co/u/TheGreatBaldOne)\ **Replies:** 2\ **Last updated:** [March 31, 2022, 11:57am UTC](https://discuss.elastic.co/t/nested-multiple-date-range-intervals/301121 "2022-03-31T11:57:02Z")
I have an index, that will hold a 'job' and each job will have a couple of date-intervals where that job can be performed. In our case it a plumbing job :slight\_smile: These date-intervals are limited, so they do not ex… --- ## [TransportError(503, 'search\_phase\_execution\_exception') only while using python but not in kibana?](https://discuss.elastic.co/t/transporterror-503-search-phase-execution-exception-only-while-using-python-but-not-in-kibana/301164)
**Author:** [@Harish\_fragger](https://discuss.elastic.co/u/Harish_fragger)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 11:50am UTC](https://discuss.elastic.co/t/transporterror-503-search-phase-execution-exception-only-while-using-python-but-not-in-kibana/301164 "2022-03-31T11:50:03Z")
I am using python to extract data from my Elasticsearch but suddenly started to get this error : TransportError(503, 'search\_phase\_execution\_exception'). I also have kibana working with the same Elasticsearch and I am ab… --- ## [New Java API with Credentials and SSL certificates](https://discuss.elastic.co/t/new-java-api-with-credentials-and-ssl-certificates/301173)
**Author:** [@ivanqwam](https://discuss.elastic.co/u/ivanqwam)\ **Replies:** 2\ **Last updated:** [March 31, 2022, 11:33am UTC](https://discuss.elastic.co/t/new-java-api-with-credentials-and-ssl-certificates/301173 "2022-03-31T11:33:55Z")
To connect to new Java API, this url: https://www.elastic.co/guide/en/elasticsearch/client/java-api-client/8.1/connecting.html explains to do this : // Create the low-level client RestClient restClient = RestClient.bu… --- ## [Docker - Setup Generated Certs - Logstash Permission Denied](https://discuss.elastic.co/t/docker-setup-generated-certs-logstash-permission-denied/301133)
**Author:** [@lluked](https://discuss.elastic.co/u/lluked)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 11:28am UTC](https://discuss.elastic.co/t/docker-setup-generated-certs-logstash-permission-denied/301133 "2022-03-31T11:28:32Z")
Hi All, I'm trying to setup the elk stack with docker-compose, however Logstash cannot read the mounted certs directory, I'm guessing this is a permissions issue however I struggle to see why Elasticsearch, Kibana and F… --- ## [Kibana 17.1 restarting after: "TypeError: Cannot read properties of undefined (reading 'isServer')"](https://discuss.elastic.co/t/kibana-17-1-restarting-after-typeerror-cannot-read-properties-of-undefined-reading-isserver/299727)
**Author:** [@ab\_mes](https://discuss.elastic.co/u/ab_mes)\ **Replies:** 3\ **Last updated:** [March 31, 2022, 11:10am UTC](https://discuss.elastic.co/t/kibana-17-1-restarting-after-typeerror-cannot-read-properties-of-undefined-reading-isserver/299727 "2022-03-31T11:10:00Z")
After migrating from a 7.8.1 stack to 7.16.3, Kibana will intermittently restart, with the last log being: TypeError: Cannot read properties of undefined (reading 'isServer') at TLSWrap.onerror (node:\_tls\_wrap:411:2… --- ## [Data\_stream\_namespace ignored?](https://discuss.elastic.co/t/data-stream-namespace-ignored/301183)
**Author:** [@EvertM](https://discuss.elastic.co/u/EvertM)\ **Replies:** 0\ **Last updated:** [March 31, 2022, 10:51am UTC](https://discuss.elastic.co/t/data-stream-namespace-ignored/301183 "2022-03-31T10:51:49Z")
Hi all, I have the following in output: data\_stream =\> "true" data\_stream\_type =\> "logs" data\_stream\_dataset =\> "synology" data\_stream\_namespace =\> "yournamehere" However, I end up with a datastream named logs-synolog… --- ## [Filebeat Cisco Module and IOS fields not showing up as documented](https://discuss.elastic.co/t/filebeat-cisco-module-and-ios-fields-not-showing-up-as-documented/298857)
**Author:** [@ulysse31](https://discuss.elastic.co/u/ulysse31)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 10:26am UTC](https://discuss.elastic.co/t/filebeat-cisco-module-and-ios-fields-not-showing-up-as-documented/298857 "2022-03-31T10:26:36Z")
Hi all, I just started the logging of the syslog data sent by my cisco IOS switches into elastic (with filebeat 7.17.0 and Elasticsearch 7.17.0). I setup a filebeat with "usual config" like: ios: enabled: true … --- ## [How to get the average between two timestamp](https://discuss.elastic.co/t/how-to-get-the-average-between-two-timestamp/301100)
**Author:** [@Roberto\_Mejri](https://discuss.elastic.co/u/Roberto_Mejri)\ **Replies:** 4\ **Last updated:** [March 31, 2022, 10:12am UTC](https://discuss.elastic.co/t/how-to-get-the-average-between-two-timestamp/301100 "2022-03-31T10:12:51Z")
HI, (I'm literally new on Kibana). My Team leader asked to me to do the visualize on Kibana with the count... of the log got on Spring microservice. The problem is now I have to display the average between timestamps of … --- ## [Unable to use grok pattern on GREEDYDATA message](https://discuss.elastic.co/t/unable-to-use-grok-pattern-on-greedydata-message/301086)
**Author:** [@rahulgupta18](https://discuss.elastic.co/u/rahulgupta18)\ **Replies:** 4\ **Last updated:** [March 31, 2022, 10:04am UTC](https://discuss.elastic.co/t/unable-to-use-grok-pattern-on-greedydata-message/301086 "2022-03-31T10:04:32Z")
Hi, I have this log message - 2022-03-08 04:16:04 \[DEBUG\] Creating linked clone: from Template-CentOS, to CentOS-001122 My logstash config. file is as follows - filter { grok { match =\> { "message" … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=990) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=992)