# Latest

**URL:** https://discuss.elastic.co/latest.md?page=1039

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1040

---

## [MapperParsingException only when using the Java API Client](https://discuss.elastic.co/t/mapperparsingexception-only-when-using-the-java-api-client/310182)

<div class="topic-metadata">

**Author:** [@Jacob\_Durgin](https://discuss.elastic.co/u/Jacob_Durgin)\
**Replies:** 0\
**Last updated:** [July 20, 2022, 4:51pm UTC](https://discuss.elastic.co/t/mapperparsingexception-only-when-using-the-java-api-client/310182 "2022-07-20T16:51:40Z")

</div>

I am running into an issue that I believe has to do with the ES Java API client. I can make the following request to my ES cluster in Postman and receive the intended results: GET resumes/\_search?pretty=true { "…

---

## [Watcher delete document action](https://discuss.elastic.co/t/watcher-delete-document-action/310140)

<div class="topic-metadata">

**Author:** [@Anna\_Foxx](https://discuss.elastic.co/u/Anna_Foxx)\
**Replies:** 1\
**Last updated:** [July 20, 2022, 4:47pm UTC](https://discuss.elastic.co/t/watcher-delete-document-action/310140 "2022-07-20T16:47:54Z")

</div>

Hi! Is there possibility to delete index document from watcher as action? I haven't found a guide or documentation of how to do it. Maybe scripts can invoke elastic API, can't they? My case is I want to have a static l…

---

## [Segregate Multiple Applications per each ELK Instance](https://discuss.elastic.co/t/segregate-multiple-applications-per-each-elk-instance/310019)

<div class="topic-metadata">

**Author:** [@amseshadri](https://discuss.elastic.co/u/amseshadri)\
**Replies:** 5\
**Last updated:** [July 20, 2022, 4:25pm UTC](https://discuss.elastic.co/t/segregate-multiple-applications-per-each-elk-instance/310019 "2022-07-20T16:25:37Z")

</div>

Hi, I am a newbie to ELK, exploring the things from few days. Using the ELK 8.1.4 version We recently got the ELK Stack installed as a SaaS in our Azure Cloud Subscription. So we have one instance of ELK in each envir…

---

## [Minimum access required by developer to ELK tool](https://discuss.elastic.co/t/minimum-access-required-by-developer-to-elk-tool/310024)

<div class="topic-metadata">

**Author:** [@amseshadri](https://discuss.elastic.co/u/amseshadri)\
**Replies:** 4\
**Last updated:** [July 20, 2022, 4:06pm UTC](https://discuss.elastic.co/t/minimum-access-required-by-developer-to-elk-tool/310024 "2022-07-20T16:06:01Z")

</div>

Hi, We are using ELK 8.1.4 running on cluster. Setting up the roles and permissions for users utilising spaces and all. Just want to know what is minimum level of access privilege required by a developer? Thanks Ses…

---

## [Inter-node transfer is 25% of the Elastic Cloud bill](https://discuss.elastic.co/t/inter-node-transfer-is-25-of-the-elastic-cloud-bill/306892)

<div class="topic-metadata">

**Author:** [@schapman](https://discuss.elastic.co/u/schapman)\
**Replies:** 10\
**Last updated:** [July 20, 2022, 3:30pm UTC](https://discuss.elastic.co/t/inter-node-transfer-is-25-of-the-elastic-cloud-bill/306892 "2022-07-20T15:30:28Z")

</div>

This is a small Elastic Cloud deployment with 3 Hot Nodes (2GB RAM / 30GB Disk each) and a single Frozen node (4GB RAM, 320GB Disk cache), plus we have a small (single hot node) monitoring deployment. The May bill (when …

---

## [Monitoring synthetic](https://discuss.elastic.co/t/monitoring-synthetic/310042)

<div class="topic-metadata">

**Author:** [@renato473](https://discuss.elastic.co/u/renato473)\
**Replies:** 4\
**Last updated:** [July 20, 2022, 3:17pm UTC](https://discuss.elastic.co/t/monitoring-synthetic/310042 "2022-07-20T15:17:48Z")

</div>

I have a question related to synthetic monitoring. the structure I have and fleet agent in docker environment and I wanted to know if only that is necessary to use the agent browser function or do I need something else. …

---

## [Fleet server certificate problem (I think)](https://discuss.elastic.co/t/fleet-server-certificate-problem-i-think/310168)

<div class="topic-metadata">

**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Replies:** 0\
**Last updated:** [July 20, 2022, 2:40pm UTC](https://discuss.elastic.co/t/fleet-server-certificate-problem-i-think/310168 "2022-07-20T14:40:33Z")

</div>

I see posts similar, people point to the problem, but none point to the fix. I installed an 8.3.1 fleet server. when trying to enroll the first host, I get error Error: fail to enroll: fail to execute request to fleet…

---

## [Failed to publish events: connect: connection refused](https://discuss.elastic.co/t/failed-to-publish-events-connect-connection-refused/309785)

<div class="topic-metadata">

**Author:** [@knitehias](https://discuss.elastic.co/u/knitehias)\
**Replies:** 3\
**Last updated:** [July 20, 2022, 2:31pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-connect-connection-refused/309785 "2022-07-20T14:31:35Z")

</div>

Hi Experts, I am using beats-\>logstash-\>elasticsearch-kibana stack. Every now and then my file beat will log error log then no other logging at all 2022-07-16T10:04:26.148Z ERROR \[publisher\_pipeline\_output\] pipeli…

---

## [Top\_metric for Geo\_Point](https://discuss.elastic.co/t/top-metric-for-geo-point/310164)

<div class="topic-metadata">

**Author:** [@bianca6](https://discuss.elastic.co/u/bianca6)\
**Replies:** 0\
**Last updated:** [July 20, 2022, 2:15pm UTC](https://discuss.elastic.co/t/top-metric-for-geo-point/310164 "2022-07-20T14:15:50Z")

</div>

Hi, In the Transform examples we can find the top\_metrics aggregation. Here is an example: POST \_transform/\_preview { "source": { "index": "kibana\_sample\_data\_ecommerce" }, "pivot": { "group\_by": { …

---

## [JSON ingestion for logs picked up elastic fleet agent ECK operator](https://discuss.elastic.co/t/json-ingestion-for-logs-picked-up-elastic-fleet-agent-eck-operator/310160)

<div class="topic-metadata">

**Author:** [@Sagar\_Gulabani](https://discuss.elastic.co/u/Sagar_Gulabani)\
**Replies:** 0\
**Last updated:** [July 20, 2022, 1:54pm UTC](https://discuss.elastic.co/t/json-ingestion-for-logs-picked-up-elastic-fleet-agent-eck-operator/310160 "2022-07-20T13:54:22Z")

</div>

Hi, We are using the elastic operator for Kubernetes. We are using the fleet managed elastic agent We are giving the fleet agent configuration using the kibana CRD as show below. Our logs from our applications are JSO…

---

## [Average per day for a period](https://discuss.elastic.co/t/average-per-day-for-a-period/308942)

<div class="topic-metadata">

**Author:** [@Igor-lkm](https://discuss.elastic.co/u/Igor-lkm)\
**Replies:** 1\
**Last updated:** [July 20, 2022, 12:53pm UTC](https://discuss.elastic.co/t/average-per-day-for-a-period/308942 "2022-07-20T12:53:20Z")

</div>

Hello, I have a quite simple aggregation to get sum and average total price for a period (1 day, 7 days, 30 days etc.) from my index. That works quite good. Aggregation for 30 days looks like this: { "size": 10000, …

---

## [Replace a value to another value logstash](https://discuss.elastic.co/t/replace-a-value-to-another-value-logstash/310129)

<div class="topic-metadata">

**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\
**Replies:** 1\
**Last updated:** [July 20, 2022, 12:47pm UTC](https://discuss.elastic.co/t/replace-a-value-to-another-value-logstash/310129 "2022-07-20T12:47:42Z")

</div>

Hello, i have a log with an id. In another file, i have list file of the id mapping. for example id 1 has a name, description, etc in the list file. I want to replace the id in that log to the data in the list file. Log…

---

## [Pipeline containsKey check fails when top-level object does not exist](https://discuss.elastic.co/t/pipeline-containskey-check-fails-when-top-level-object-does-not-exist/310130)

<div class="topic-metadata">

**Author:** [@SecretSquizza](https://discuss.elastic.co/u/SecretSquizza)\
**Replies:** 1\
**Last updated:** [July 20, 2022, 12:34pm UTC](https://discuss.elastic.co/t/pipeline-containskey-check-fails-when-top-level-object-does-not-exist/310130 "2022-07-20T12:34:58Z")

</div>

Hi everyone! I'm struggling to find an answer to this issue and i keep receiving the error Cannot invoke "Object.getClass()" because "value" is null The problem occurs when I have an object - in this case error - th…

---

## [Include Fields in Watcher Email Alert](https://discuss.elastic.co/t/include-fields-in-watcher-email-alert/309821)

<div class="topic-metadata">

**Author:** [@rshetty89](https://discuss.elastic.co/u/rshetty89)\
**Replies:** 3\
**Last updated:** [July 20, 2022, 12:33pm UTC](https://discuss.elastic.co/t/include-fields-in-watcher-email-alert/309821 "2022-07-20T12:33:45Z")

</div>

From the below API output of my watcher i can only include {{ctx.metadata.name}} in email subject and body . If i try to include any other feild such as {{ctx.payload.hits.total}},{{ctx.metadata.name.xpack.type}} , {{#c…

---

## [Format array object in watcher email body](https://discuss.elastic.co/t/format-array-object-in-watcher-email-body/310080)

<div class="topic-metadata">

**Author:** [@rshetty89](https://discuss.elastic.co/u/rshetty89)\
**Replies:** 1\
**Last updated:** [July 20, 2022, 12:30pm UTC](https://discuss.elastic.co/t/format-array-object-in-watcher-email-body/310080 "2022-07-20T12:30:32Z")

</div>

HI, I have an array as output of watcher and i need to include this array in watcher body. the result sample of my wathcer is as follows. . . . . "payload": { "results": \[ { "value": 319…

---

## [Where can I find the docs on "question\_answering"?](https://discuss.elastic.co/t/where-can-i-find-the-docs-on-question-answering/310060)

<div class="topic-metadata">

**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\
**Replies:** 2\
**Last updated:** [July 20, 2022, 12:13pm UTC](https://discuss.elastic.co/t/where-can-i-find-the-docs-on-question-answering/310060 "2022-07-20T12:13:51Z")

</div>

Hi All, Elasticsearch added question\_answering in 8.3, but I can't seem to find any documentation on how to use/test it. I've looked here: Natural language processing | Machine Learning in the Elastic Stack \[8.3\] | Elas…

---

## [Set cluster name when creating connection | ES 8.2.3](https://discuss.elastic.co/t/set-cluster-name-when-creating-connection-es-8-2-3/310139)

<div class="topic-metadata">

**Author:** [@Akshat\_Gupta](https://discuss.elastic.co/u/Akshat_Gupta)\
**Replies:** 0\
**Last updated:** [July 20, 2022, 12:10pm UTC](https://discuss.elastic.co/t/set-cluster-name-when-creating-connection-es-8-2-3/310139 "2022-07-20T12:10:07Z")

</div>

How to set cluster name in new ES 8.2.3 java API ? Earlier I was using: private Client client = new PreBuiltTransportClient(Settings.builder().put("cluster.name", esClusterName).build()).addTransportAddress(new Transpo…

---

## [Ilm policy error](https://discuss.elastic.co/t/ilm-policy-error/310135)

<div class="topic-metadata">

**Author:** [@HeTvaM](https://discuss.elastic.co/u/HeTvaM)\
**Replies:** 0\
**Last updated:** [July 20, 2022, 11:36am UTC](https://discuss.elastic.co/t/ilm-policy-error/310135 "2022-07-20T11:36:58Z")

</div>

I have been trying to set up ilm policy for my indexes for several weeks now. I use filebeat in conjunction with logstash and my indexes end up being created every day. An example of my index name: 'filebeat-7.7.1-2022…

---

## [ECK - quickstart - heartbeat example disrupts filebeat example](https://discuss.elastic.co/t/eck-quickstart-heartbeat-example-disrupts-filebeat-example/310026)

<div class="topic-metadata">

**Author:** [@joachimnielandt](https://discuss.elastic.co/u/joachimnielandt)\
**Replies:** 0\
**Last updated:** [July 19, 2022, 1:14pm UTC](https://discuss.elastic.co/t/eck-quickstart-heartbeat-example-disrupts-filebeat-example/310026 "2022-07-19T13:14:37Z")

</div>

Hello all, I have a question that is more about me trying to understand ECK than it is an issue. In trying to run elastic+kibana+filebeat+heartbeat, I find that I cannot run both beats together. I'm testing out a self-…

---

## [Sourcemaps - not mapping for all errors](https://discuss.elastic.co/t/sourcemaps-not-mapping-for-all-errors/310125)

<div class="topic-metadata">

**Author:** [@Hamunaptroid](https://discuss.elastic.co/u/Hamunaptroid)\
**Replies:** 0\
**Last updated:** [July 20, 2022, 9:45am UTC](https://discuss.elastic.co/t/sourcemaps-not-mapping-for-all-errors/310125 "2022-07-20T09:45:21Z")

</div>

Hello, I would like to follow up with the thread which was closed already - it seemed like problem with sourcemaps was fixed, but it seems it isn't working 100%. I have managed to get it working partially with help of…

---

## [How to add suggestion inside term query in DSL](https://discuss.elastic.co/t/how-to-add-suggestion-inside-term-query-in-dsl/309893)

<div class="topic-metadata">

**Author:** [@sim\_elastic](https://discuss.elastic.co/u/sim_elastic)\
**Replies:** 6\
**Last updated:** [July 20, 2022, 8:51am UTC](https://discuss.elastic.co/t/how-to-add-suggestion-inside-term-query-in-dsl/309893 "2022-07-20T08:51:06Z")

</div>

My DOc is below \[ {'id':1, 'name': 'sachin messi', 'description': 'football@football.com', 'type': 'football', 'var':'sports'}, {'id':2, 'name': 'lionel messi', 'description': 'messi@fifa.com','type': 'soccer','var':'sp…

---

## [IO processing speed requirements for Elastic product line](https://discuss.elastic.co/t/io-processing-speed-requirements-for-elastic-product-line/310108)

<div class="topic-metadata">

**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\
**Replies:** 5\
**Last updated:** [July 20, 2022, 9:47am UTC](https://discuss.elastic.co/t/io-processing-speed-requirements-for-elastic-product-line/310108 "2022-07-20T09:47:41Z")

</div>

We are considering moving Elasticsearch from vsan to fnas or synology nas. We are thinking that the IO processing speed will be reduced, but how much is the impact? Or are there any hardware requirements for IO process…

---

## [How to set node.roles for a coordinating only node via environment variable?](https://discuss.elastic.co/t/how-to-set-node-roles-for-a-coordinating-only-node-via-environment-variable/307860)

<div class="topic-metadata">

**Author:** [@gerib](https://discuss.elastic.co/u/gerib)\
**Replies:** 1\
**Last updated:** [July 20, 2022, 9:30am UTC](https://discuss.elastic.co/t/how-to-set-node-roles-for-a-coordinating-only-node-via-environment-variable/307860 "2022-07-20T09:30:57Z")

</div>

Same as in: (unanswered and closed) question here: Problem with node.roles on latest Elasticsearch docker (7.11.0) question (with an unsatisfying answer) on SO: How to set default value while using env in elasticsearc…

---

## [Set alert based on Visualization](https://discuss.elastic.co/t/set-alert-based-on-visualization/307494)

<div class="topic-metadata">

**Author:** [@mmartinez](https://discuss.elastic.co/u/mmartinez)\
**Replies:** 19\
**Last updated:** [July 20, 2022, 8:37am UTC](https://discuss.elastic.co/t/set-alert-based-on-visualization/307494 "2022-07-20T08:37:31Z")

</div>

Hi, We have created a lens visualization for showing the apdex score of APM traces and we would like to create an alert based on that score. Our knowledge in alerting and monitoring is still limited and we haven't found…

---

## [Update to 8.3.1 from 8.3.0 has broken Fleet - please help!](https://discuss.elastic.co/t/update-to-8-3-1-from-8-3-0-has-broken-fleet-please-help/308654)

<div class="topic-metadata">

**Author:** [@finbarr996](https://discuss.elastic.co/u/finbarr996)\
**Replies:** 10\
**Last updated:** [July 20, 2022, 8:32am UTC](https://discuss.elastic.co/t/update-to-8-3-1-from-8-3-0-has-broken-fleet-please-help/308654 "2022-07-20T08:32:37Z")

</div>

Upgraded to 8.3 a few days ago - everything working fine. Updated to 8.3.1 this morning and now the elastic-agent service won't start on my single on-prem node - this is also the Fleet Server. Error in the logs is: Er…

---

## [Beats connection to elasticsearch](https://discuss.elastic.co/t/beats-connection-to-elasticsearch/309701)

<div class="topic-metadata">

**Author:** [@Amiya\_Pani](https://discuss.elastic.co/u/Amiya_Pani)\
**Replies:** 8\
**Last updated:** [July 20, 2022, 8:30am UTC](https://discuss.elastic.co/t/beats-connection-to-elasticsearch/309701 "2022-07-20T08:30:07Z")

</div>

I am trying to start a filebeat on docker to point the output to elasticsearch which is on same docker. While giving the command docker run docker.elastic.co/beats/filebeat:8.3.2 setup -E setup.kibana.host=192.168.0.109…

---

## [Stats endpoints response slow](https://discuss.elastic.co/t/stats-endpoints-response-slow/310062)

<div class="topic-metadata">

**Author:** [@scroodj](https://discuss.elastic.co/u/scroodj)\
**Replies:** 3\
**Last updated:** [July 20, 2022, 8:27am UTC](https://discuss.elastic.co/t/stats-endpoints-response-slow/310062 "2022-07-20T08:27:12Z")

</div>

Elasticsearch: 7.5.1 Infrastructure: Azure AKS Storage: Standard SSD \_cat/nodes name m role ip ramMax ramPercent ramCurrent heapMax heapPercent heapCurrent diskTotal diskUsed cpu uptime iic…

---

## [ECK service](https://discuss.elastic.co/t/eck-service/310110)

<div class="topic-metadata">

**Author:** [@Biplab](https://discuss.elastic.co/u/Biplab)\
**Replies:** 0\
**Last updated:** [July 20, 2022, 8:22am UTC](https://discuss.elastic.co/t/eck-service/310110 "2022-07-20T08:22:22Z")

</div>

Hi, We are planning to deploy elastic cluster first on ECK and then will run the service and Ingress configuration file separately to access Elasticsearch from outside kubernetes cluster, Can anyone please help whether …

---

## [Type join,Why do you get no data over 80, but you can get data over 100](https://discuss.elastic.co/t/type-join-why-do-you-get-no-data-over-80-but-you-can-get-data-over-100/310109)

<div class="topic-metadata">

**Author:** [@yangyu](https://discuss.elastic.co/u/yangyu)\
**Replies:** 0\
**Last updated:** [July 20, 2022, 8:18am UTC](https://discuss.elastic.co/t/type-join-why-do-you-get-no-data-over-80-but-you-can-get-data-over-100/310109 "2022-07-20T08:18:38Z")

</div>

Elasticsearch Version 7.17.4 Installed Plugins analysis-ik,analysis-pinyin,analysis-stconvert Java Version 1.8.0\_331-b09 OS Version MacBook-Pro.local 21.5.0 Darwin Kernel Version 21.5.0: Tue Apr 26 21:08:37 PDT 2022; …

---

## [ECE Fundamentals: "Not enough capacity to allocate instance(s)"](https://discuss.elastic.co/t/ece-fundamentals-not-enough-capacity-to-allocate-instance-s/309907)

<div class="topic-metadata">

**Author:** [@rcorfield](https://discuss.elastic.co/u/rcorfield)\
**Replies:** 4\
**Last updated:** [July 20, 2022, 8:15am UTC](https://discuss.elastic.co/t/ece-fundamentals-not-enough-capacity-to-allocate-instance-s/309907 "2022-07-20T08:15:01Z")

</div>

Hi, I'm trying the complete the "ECE Fundamentals" labs, but I've hit a problem when I trying to create a new deployment via the Cloud UI in Lab 3. I receive the following message: Latest change to Elasticsearch config…

[Previous page](https://discuss.elastic.co/latest.md?page=1038)

[Next page](https://discuss.elastic.co/latest.md?page=1040)
