# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=999 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1000 --- ## [Error accessing elastic monitoring tab on kibana](https://discuss.elastic.co/t/error-accessing-elastic-monitoring-tab-on-kibana/300620)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 5\ **Last updated:** [March 27, 2022, 12:16pm UTC](https://discuss.elastic.co/t/error-accessing-elastic-monitoring-tab-on-kibana/300620 "2022-03-27T12:16:43Z")
Hi all After upgraded my cluster to version 8.1 now i cannot access the tab stack monitoring anymore it keep give me this error Access Denied You are not authorized to access Monitoring. To use Monitoring, you need th… --- ## [There is no option to download the amd64.deb file](https://discuss.elastic.co/t/there-is-no-option-to-download-the-amd64-deb-file/300777)
**Author:** [@alah64](https://discuss.elastic.co/u/alah64)\ **Replies:** 0\ **Last updated:** [March 27, 2022, 9:52am UTC](https://discuss.elastic.co/t/there-is-no-option-to-download-the-amd64-deb-file/300777 "2022-03-27T09:52:36Z")
hi Why is there no download address for the amd64.deb file from the pages related to downloading stack beats files? For example, see the filebeat download page: Download Filebeat • Lightweight Log Analysis | Elastic T… --- ## [Elastic java client 8.1 - create index from json example](https://discuss.elastic.co/t/elastic-java-client-8-1-create-index-from-json-example/300324)
**Author:** [@Anna\_Mikhilev](https://discuss.elastic.co/u/Anna_Mikhilev)\ **Replies:** 3\ **Last updated:** [March 24, 2022, 10:03pm UTC](https://discuss.elastic.co/t/elastic-java-client-8-1-create-index-from-json-example/300324 "2022-03-24T22:03:37Z")
In https://www.elastic.co/guide/en/elasticsearch/client/java-api-client/current/loading-json.html There is an create index example using the .withJson(input) method CreateIndexRequest req = CreateIndexRequest.of(b -\>… --- ## [S3 output plugin exception exception=\>#\ **Author:** [@Juda\_Barnes](https://discuss.elastic.co/u/Juda_Barnes)\ **Replies:** 0\ **Last updated:** [March 27, 2022, 7:19am UTC](https://discuss.elastic.co/t/s3-output-plugin-exception-exception-errno-no-such-file-or-directory-no-such-file-or-directory/300775 "2022-03-27T07:19:09Z") Getting the following exception and then pipeline being terminated, :error=\>"(IOError) closed stream", :exception=\>Java::OrgJrubyExceptions::IOError, :backtrace=\>\["org.jruby.RubyIO.write(org/jruby/RubyIO.java:1467)", "o… --- ## [Errors indexing binary attachment using ingest-attachment pipeline](https://discuss.elastic.co/t/errors-indexing-binary-attachment-using-ingest-attachment-pipeline/300766)
**Author:** [@Enxiad](https://discuss.elastic.co/u/Enxiad)\ **Replies:** 5\ **Last updated:** [March 27, 2022, 6:37am UTC](https://discuss.elastic.co/t/errors-indexing-binary-attachment-using-ingest-attachment-pipeline/300766 "2022-03-27T06:37:30Z")
Hi all, I am ingesting a document A and I receive the error: "Last unit does not have enough valid bits" when the document contains only the word "Lorem". For document B which contains the words "Lorem ipsum" then I get… --- ## [License page not visible in kibana](https://discuss.elastic.co/t/license-page-not-visible-in-kibana/300585)
**Author:** [@NerdSec](https://discuss.elastic.co/u/NerdSec)\ **Replies:** 2\ **Last updated:** [March 27, 2022, 6:15am UTC](https://discuss.elastic.co/t/license-page-not-visible-in-kibana/300585 "2022-03-27T06:15:33Z")
Hi Team, Trying to setup an ECK cluster on a local k8s environment with the 7.17.1 images (tested with the 8.1.1 image as well) and I am facing an issue. I can't seem the find the license management screen or any port… --- ## [How to dissect/script/grok a long number into different fields using regex in an ingest pipeline?](https://discuss.elastic.co/t/how-to-dissect-script-grok-a-long-number-into-different-fields-using-regex-in-an-ingest-pipeline/300653)
**Author:** [@Patr123](https://discuss.elastic.co/u/Patr123)\ **Replies:** 2\ **Last updated:** [March 27, 2022, 3:33am UTC](https://discuss.elastic.co/t/how-to-dissect-script-grok-a-long-number-into-different-fields-using-regex-in-an-ingest-pipeline/300653 "2022-03-27T03:33:30Z")
Hello, I have a number which needs to be dissected into different fields using regex. I think It needs to be regex because the first set of number changes in length. I have been struggling to find a similar example any… --- ## [Es-stack 8.1.0 - \[security\_exception\] action \[indices:data/read/search\]](https://discuss.elastic.co/t/es-stack-8-1-0-security-exception-action-indices-data-read-search/300097)
**Author:** [@skahdi12](https://discuss.elastic.co/u/skahdi12)\ **Replies:** 1\ **Last updated:** [March 26, 2022, 8:54pm UTC](https://discuss.elastic.co/t/es-stack-8-1-0-security-exception-action-indices-data-read-search/300097 "2022-03-26T20:54:24Z")
Hello, I'm using Elasticsearch 8.1.0. I configured a es cluster and logged in to kibana as a superuser elastic. However, there is an error that never been seen in the previous version. kibana error message : Respo… --- ## [How to convert all field names starting with string to integer](https://discuss.elastic.co/t/how-to-convert-all-field-names-starting-with-string-to-integer/300728)
**Author:** [@hagaluly](https://discuss.elastic.co/u/hagaluly)\ **Replies:** 4\ **Last updated:** [March 26, 2022, 7:40pm UTC](https://discuss.elastic.co/t/how-to-convert-all-field-names-starting-with-string-to-integer/300728 "2022-03-26T19:40:36Z")
i have tried this block without success i haven't find a proper way how to use wildcards filter { if \[fieldname\] =~ /^STAGED.\*/ { mutate { convert =\> {"\[fieldname\]" =\> "integer"} } }… --- ## [Doubts to enable xpack in elasticsearch 8.x](https://discuss.elastic.co/t/doubts-to-enable-xpack-in-elasticsearch-8-x/300352)
**Author:** [@gustavoluza](https://discuss.elastic.co/u/gustavoluza)\ **Replies:** 8\ **Last updated:** [March 26, 2022, 7:23pm UTC](https://discuss.elastic.co/t/doubts-to-enable-xpack-in-elasticsearch-8-x/300352 "2022-03-26T19:23:22Z")
I'm trying to install Elasticsearch 8 with the xpack module enabled, but I'm facing the errors below when I start the service, could you help me? Mar 22 10:35:11 elk systemd-entrypoint\[748\]: at com.fasterxml.jackson.dat… --- ## [Share sql\_last\_value between two pods](https://discuss.elastic.co/t/share-sql-last-value-between-two-pods/300753)
**Author:** [@Vipul\_Agarwal](https://discuss.elastic.co/u/Vipul_Agarwal)\ **Replies:** 2\ **Last updated:** [March 26, 2022, 5:08pm UTC](https://discuss.elastic.co/t/share-sql-last-value-between-two-pods/300753 "2022-03-26T17:08:41Z")
Hi All, I am trying to run logstash in a multi-pod setup. My sample config is : input { jdbc { jdbc\_driver\_library =\> "${HOME}/postgres/postgresql-42.3.2.jar" jdbc\_driver\_class =\> "org.postgresql.Driver" … --- ## [Filter file.path](https://discuss.elastic.co/t/filter-file-path/300695)
**Author:** [@Arraso26](https://discuss.elastic.co/u/Arraso26)\ **Replies:** 2\ **Last updated:** [March 26, 2022, 4:42pm UTC](https://discuss.elastic.co/t/filter-file-path/300695 "2022-03-26T16:42:09Z")
Hi, I would like to filter the logs by the path /server/www/html/log.es/logs/access.log and I have no idea how to do it if anyone can help. --- ## [Getting right shards and replicas count](https://discuss.elastic.co/t/getting-right-shards-and-replicas-count/300715)
**Author:** [@tflorac](https://discuss.elastic.co/u/tflorac)\ **Replies:** 6\ **Last updated:** [March 26, 2022, 1:57pm UTC](https://discuss.elastic.co/t/getting-right-shards-and-replicas-count/300715 "2022-03-26T13:57:02Z")
Hi, I'm building a new application using Elasticsearch. This application will have to manage a relatively low number of documents (10.000 at start!), but many of these documents are quite huge and can contain multiple b… --- ## [Elasticsearch does not listen on ipv4](https://discuss.elastic.co/t/elasticsearch-does-not-listen-on-ipv4/300748)
**Author:** [@sharbich](https://discuss.elastic.co/u/sharbich)\ **Replies:** 1\ **Last updated:** [March 26, 2022, 10:15am UTC](https://discuss.elastic.co/t/elasticsearch-does-not-listen-on-ipv4/300748 "2022-03-26T10:15:34Z")
Hello, my dears, I installed Elasticsearch on my Debian Buster Server. The following ports have been opened. root@dsme01:~# netstat -tulpen | grep 192.168.150.20 tcp6 0 0 192.168.150.20:9200 :::\* … --- ## [Elastic 8.1 installation on windows with HTTPS and wild card certificates](https://discuss.elastic.co/t/elastic-8-1-installation-on-windows-with-https-and-wild-card-certificates/300703)
**Author:** [@thomasbosa](https://discuss.elastic.co/u/thomasbosa)\ **Replies:** 1\ **Last updated:** [March 26, 2022, 8:38am UTC](https://discuss.elastic.co/t/elastic-8-1-installation-on-windows-with-https-and-wild-card-certificates/300703 "2022-03-26T08:38:36Z")
Hi All, I'm trying to setup an elastic-search cluster, on Windows machines (all windows server 2019). When i run the Elasticsearch.bat for the first time, it configures the node with a default configuration, which is n… --- ## [Slow response time even though slow logs show fast (query+fetch)](https://discuss.elastic.co/t/slow-response-time-even-though-slow-logs-show-fast-query-fetch/300742)
**Author:** [@Abhishek\_Singh2](https://discuss.elastic.co/u/Abhishek_Singh2)\ **Replies:** 0\ **Last updated:** [March 26, 2022, 6:41am UTC](https://discuss.elastic.co/t/slow-response-time-even-though-slow-logs-show-fast-query-fetch/300742 "2022-03-26T06:41:59Z")
I am having trouble with my Elasticsearch nodes/queries ……. I have 3 physical nodes in which all 3 are master + data nodes. I am running a simple filter query in slow logs I see query +fetch time as 8 millisec sometimes … --- ## [How to determine elected master from INodesStatsResponse with the Nest client](https://discuss.elastic.co/t/how-to-determine-elected-master-from-inodesstatsresponse-with-the-nest-client/300739)
**Author:** [@jthoni](https://discuss.elastic.co/u/jthoni)\ **Replies:** 0\ **Last updated:** [March 26, 2022, 5:08am UTC](https://discuss.elastic.co/t/how-to-determine-elected-master-from-inodesstatsresponse-with-the-nest-client/300739 "2022-03-26T05:08:32Z")
I am using the Nest client to monitor my cluster. One thing I can't seem to figure out is how to determine if a given master-eligible node is the elected master. I am running this code on the physical VM where Elasticsea… --- ## [Unknown beats protocol version: 22, 3, 71, 69](https://discuss.elastic.co/t/unknown-beats-protocol-version-22-3-71-69/300730)
**Author:** [@Uzmasaman\_Chanderki](https://discuss.elastic.co/u/Uzmasaman_Chanderki)\ **Replies:** 1\ **Last updated:** [March 26, 2022, 3:02am UTC](https://discuss.elastic.co/t/unknown-beats-protocol-version-22-3-71-69/300730 "2022-03-26T03:02:37Z")
Hello, I am new to Elasticsearch and Graylog. I have implemented Beats (filebeat heartbeat and metricbeat) on Remote Nomad cluster. I am shipping logs and metric to a centralised server. Everything seems to work fine unt… --- ## [Question on Shipping logs from multiple microservice to Elasticsearch](https://discuss.elastic.co/t/question-on-shipping-logs-from-multiple-microservice-to-elasticsearch/300738)
**Author:** [@Pradeep\_Kumar3](https://discuss.elastic.co/u/Pradeep_Kumar3)\ **Replies:** 1\ **Last updated:** [March 26, 2022, 2:58am UTC](https://discuss.elastic.co/t/question-on-shipping-logs-from-multiple-microservice-to-elasticsearch/300738 "2022-03-26T02:58:29Z")
I am considering pushing the application logs from multiple microservices using filebeats to a remote logstash server. Will the fiebeat acquire the lock on the logstash server to write the file? What are the consideratio… --- ## [Elasticsearch backup](https://discuss.elastic.co/t/elasticsearch-backup/300723)
**Author:** [@Amitabh\_Prasad](https://discuss.elastic.co/u/Amitabh_Prasad)\ **Replies:** 1\ **Last updated:** [March 26, 2022, 1:54am UTC](https://discuss.elastic.co/t/elasticsearch-backup/300723 "2022-03-26T01:54:13Z")
Running into issues where deployment is failing with following error {"@timestamp":"2022-03-24T17:29:14.324Z", "log.level": "INFO", "message":"heap size \[1gb\], compressed ordinary object pointers \[true\]", "ecs.version":… --- ## [Metricbeats using port 9243 instead of 443](https://discuss.elastic.co/t/metricbeats-using-port-9243-instead-of-443/300661)
**Author:** [@alphabet5](https://discuss.elastic.co/u/alphabet5)\ **Replies:** 4\ **Last updated:** [March 26, 2022, 1:40am UTC](https://discuss.elastic.co/t/metricbeats-using-port-9243-instead-of-443/300661 "2022-03-26T01:40:16Z")
Using elastic cloud I am trying to connect metricbeats with the provided cloud.id/auth. I'm seeing this in the logs {"log.level":"info","@timestamp":"2022-03-25T05:56:18.524Z","log.logger":"publisher\_pipeline\_output","… --- ## [.ds-.fleet-actions-results can't change settings](https://discuss.elastic.co/t/ds-fleet-actions-results-cant-change-settings/300736)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 0\ **Last updated:** [March 25, 2022, 10:47pm UTC](https://discuss.elastic.co/t/ds-fleet-actions-results-cant-change-settings/300736 "2022-03-25T22:47:08Z")
Hey all, I thought elastic was the superuser account curl -XPUT -k -u elastic:$pass https://localhost:9200/.ds-.fleet-actions-results-2022.03.22-000001/\_settings?pretty -H 'Content-Type: application/json' -d '{"settin… --- ## [All replica shards reside on two nodes, 9 nodes total](https://discuss.elastic.co/t/all-replica-shards-reside-on-two-nodes-9-nodes-total/300513)
**Author:** [@jwcw](https://discuss.elastic.co/u/jwcw)\ **Replies:** 2\ **Last updated:** [March 24, 2022, 8:40pm UTC](https://discuss.elastic.co/t/all-replica-shards-reside-on-two-nodes-9-nodes-total/300513 "2022-03-24T20:40:38Z")
I have an elasticsearch 6.8.23 cluster (we are upgrading to 7.x soon) with 9 data nodes and 3,000 shards where all of the replica shards have allocated to two of the nodes. I have removed all cluster.routing.allocation s… --- ## [Logstash ingesting from S3, affecting OTHER indices?](https://discuss.elastic.co/t/logstash-ingesting-from-s3-affecting-other-indices/300726)
**Author:** [@pritster5](https://discuss.elastic.co/u/pritster5)\ **Replies:** 6\ **Last updated:** [March 25, 2022, 8:36pm UTC](https://discuss.elastic.co/t/logstash-ingesting-from-s3-affecting-other-indices/300726 "2022-03-25T20:36:41Z")
I'm having a strange issue. I'm using the pipelines feature of Logstash via 2 config files that look like this: input { s3 { bucket =\> "\" region =\> "us-east-1" codec =\> "json" … --- ## [Winlogbeat Not Logging All Event ID](https://discuss.elastic.co/t/winlogbeat-not-logging-all-event-id/300725)
**Author:** [@cmenuey](https://discuss.elastic.co/u/cmenuey)\ **Replies:** 0\ **Last updated:** [March 25, 2022, 8:12pm UTC](https://discuss.elastic.co/t/winlogbeat-not-logging-all-event-id/300725 "2022-03-25T20:12:16Z")
Hi all, I installed the ELK stack to try it out, all services on the same windows server. I was able to get the winlogbeat on a couple of domain controllers and shipping logs. I enabled advanced logging to get group mem… --- ## [Use nested aggregation based on parent values](https://discuss.elastic.co/t/use-nested-aggregation-based-on-parent-values/299492)
**Author:** [@TomTom](https://discuss.elastic.co/u/TomTom)\ **Replies:** 1\ **Last updated:** [March 25, 2022, 7:48pm UTC](https://discuss.elastic.co/t/use-nested-aggregation-based-on-parent-values/299492 "2022-03-25T19:48:12Z")
I have an aggregation that uses comments nested within a task, the purpose of this aggregation is to count comments that other users who are not responsible for the task have left on the task. Tried using painless for t… --- ## [Metricbeat 7.17.1 error getting filesystem list: open /etc/mtab](https://discuss.elastic.co/t/metricbeat-7-17-1-error-getting-filesystem-list-open-etc-mtab/300625)
**Author:** [@kbujold\_wr](https://discuss.elastic.co/u/kbujold_wr)\ **Replies:** 1\ **Last updated:** [March 25, 2022, 6:25pm UTC](https://discuss.elastic.co/t/metricbeat-7-17-1-error-getting-filesystem-list-open-etc-mtab/300625 "2022-03-25T18:25:37Z")
Hi we have recently upgraded from 7.9.3 to 7.17.1. We now get this error in the Metricbeat logs 2022-03-24T19:02:27.030Z ERROR module/wrapper.go:259 Error fetching data for metricset system.filesystem: error … --- ## [Stuck upgrading elastic search from 6.x to 7.17](https://discuss.elastic.co/t/stuck-upgrading-elastic-search-from-6-x-to-7-17/300393)
**Author:** [@CapitanRedBeard](https://discuss.elastic.co/u/CapitanRedBeard)\ **Replies:** 5\ **Last updated:** [March 25, 2022, 4:53pm UTC](https://discuss.elastic.co/t/stuck-upgrading-elastic-search-from-6-x-to-7-17/300393 "2022-03-25T16:53:17Z")
I have two Elasticsearch deployments hosted on the elastic cloud. My DEV deployment is on v6.8.9 with kibana on v6.6.1 thus it has a "7.0 Upgrade Assistant" in the Management options in kibana. My PROD deployment is on… --- ## [How to get the Greater or Last Value in a Document for doing filter](https://discuss.elastic.co/t/how-to-get-the-greater-or-last-value-in-a-document-for-doing-filter/300246)
**Author:** [@vthiyagarajan](https://discuss.elastic.co/u/vthiyagarajan)\ **Replies:** 2\ **Last updated:** [March 25, 2022, 4:53pm UTC](https://discuss.elastic.co/t/how-to-get-the-greater-or-last-value-in-a-document-for-doing-filter/300246 "2022-03-25T16:53:05Z")
I have a JSON document like this { "EmpDetails" : { "emplid" : "32444" "sickdays" : "3" "batch\_id": "22-04" }, "EmpDetails" : { "emplid" : "32445" "sickdays" : "3" "batch\_id": "22-04" }, "EmpDetails" : { "… --- ## [How to parse timestamp apache access.log](https://discuss.elastic.co/t/how-to-parse-timestamp-apache-access-log/300709)
**Author:** [@Roccof97](https://discuss.elastic.co/u/Roccof97)\ **Replies:** 2\ **Last updated:** [March 25, 2022, 3:39pm UTC](https://discuss.elastic.co/t/how-to-parse-timestamp-apache-access-log/300709 "2022-03-25T15:39:30Z")
Hi, how can i parse this timestamp using grok filter?: x.x.x.x - - \[24/Mar/2022:00:00:04 +0000\] do you have any advice? Thanks [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=998) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1000)