# Latest **URL:** https://discuss.elastic.co/latest.md?page=1042 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1043 --- ## [JSON file parse error](https://discuss.elastic.co/t/json-file-parse-error/309869)
**Author:** [@ichasco\_heytrade](https://discuss.elastic.co/u/ichasco_heytrade)\ **Replies:** 2\ **Last updated:** [July 19, 2022, 8:58am UTC](https://discuss.elastic.co/t/json-file-parse-error/309869 "2022-07-19T08:58:44Z")
Hi, I am trying to parse a JSON file with this structure: \[ { "plugin": "cloudtrailBucketAccessLogging", "category": "CloudTrail", "title": "CloudTrail Bucket Access Logging", "description": "Ensures C… --- ## [Collect logs from external deployments exposing a domain](https://discuss.elastic.co/t/collect-logs-from-external-deployments-exposing-a-domain/309746)
**Author:** [@thahgr](https://discuss.elastic.co/u/thahgr)\ **Replies:** 4\ **Last updated:** [July 19, 2022, 7:33am UTC](https://discuss.elastic.co/t/collect-logs-from-external-deployments-exposing-a-domain/309746 "2022-07-19T07:33:48Z")
TL;DR I want to ship logs from remote deployments via filebeat or logstash to a central Elastic/Elastic stack via HTTP exposing just domains I have considered two solutions, cant get any to work The setup is as follow… --- ## [New Elasticsearch Java API: Source is null when search is execute](https://discuss.elastic.co/t/new-elasticsearch-java-api-source-is-null-when-search-is-execute/309980)
**Author:** [@ALX\_DM](https://discuss.elastic.co/u/ALX_DM)\ **Replies:** 2\ **Last updated:** [July 19, 2022, 7:30am UTC](https://discuss.elastic.co/t/new-elasticsearch-java-api-source-is-null-when-search-is-execute/309980 "2022-07-19T07:30:56Z")
I want to implement this command using the new ES Java API client but the result shows source as null POST /test\_event\_202207/\_search?typed\_keys=true { "sort":\[{"time":{"order":"desc"}}\] } If I excecute this in Kiban… --- ## [Create Alert from index data](https://discuss.elastic.co/t/create-alert-from-index-data/309745)
**Author:** [@DILIP\_SHARMA](https://discuss.elastic.co/u/DILIP_SHARMA)\ **Replies:** 4\ **Last updated:** [July 19, 2022, 7:19am UTC](https://discuss.elastic.co/t/create-alert-from-index-data/309745 "2022-07-19T07:19:50Z")
Hi i am using ES Cloud 7.15.1 i am getting log data from my website . now i want to write alert for that data , for example if status code =500 and error = xyz , send the email . i trying using alert from security… --- ## [Elastic Agent Kubernetes integration doesn't send container logs](https://discuss.elastic.co/t/elastic-agent-kubernetes-integration-doesnt-send-container-logs/309983)
**Author:** [@bucknerm](https://discuss.elastic.co/u/bucknerm)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 7:04am UTC](https://discuss.elastic.co/t/elastic-agent-kubernetes-integration-doesnt-send-container-logs/309983 "2022-07-19T07:04:24Z")
I'm running into an issue where I can't collect any of my custom Kubernetes container logs using the Kubernetes integration with the elastic agent. Elastic provided containers appear to ship logs correctly. I'm looking … --- ## [How to pin elasticsearch version using “ec” Terraform provider?](https://discuss.elastic.co/t/how-to-pin-elasticsearch-version-using-ec-terraform-provider/307812)
**Author:** [@amruth](https://discuss.elastic.co/u/amruth)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 6:41am UTC](https://discuss.elastic.co/t/how-to-pin-elasticsearch-version-using-ec-terraform-provider/307812 "2022-07-19T06:41:47Z")
Hello Everyone, how to pin elasticsearch version using “ec” Terraform provider? I am using the following data "ec\_stack" "latest" { version\_regex = "8.2.1" region = var.region } but it throws “Error: failed… --- ## [Heartbeat on elastic agent](https://discuss.elastic.co/t/heartbeat-on-elastic-agent/309570)
**Author:** [@lineconnect](https://discuss.elastic.co/u/lineconnect)\ **Replies:** 4\ **Last updated:** [July 19, 2022, 6:29am UTC](https://discuss.elastic.co/t/heartbeat-on-elastic-agent/309570 "2022-07-19T06:29:28Z")
Hi there, we're using EFK in k8s and beats for a while now and want to migrate our beats to elastic agent. I've setup the agents to use the fleet server and i'm also able to configure the inputs trough Kibana. But i'm… --- ## [Elastic-agent index](https://discuss.elastic.co/t/elastic-agent-index/309981)
**Author:** [@Mohsin\_Ashraf](https://discuss.elastic.co/u/Mohsin_Ashraf)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 6:24am UTC](https://discuss.elastic.co/t/elastic-agent-index/309981 "2022-07-19T06:24:44Z")
Hi. is it possible we can create different index names for different elastic-agent? because in my case I want to create different spaces and want to show different data in these spaces but all data is coming in the sam… --- ## [Transform aggregation creates flattened record](https://discuss.elastic.co/t/transform-aggregation-creates-flattened-record/309657)
**Author:** [@dimuskin](https://discuss.elastic.co/u/dimuskin)\ **Replies:** 4\ **Last updated:** [July 19, 2022, 6:09am UTC](https://discuss.elastic.co/t/transform-aggregation-creates-flattened-record/309657 "2022-07-19T06:09:31Z")
I use transformation for data preprocessing, in my case every second rps are created for each host { "id": "appgw-rps-host", "source": { "index": \[ "logs-azure.platformlogs-default" \] }, "dest": { … --- ## [More like this query using an existing document, but I don't know its ID](https://discuss.elastic.co/t/more-like-this-query-using-an-existing-document-but-i-dont-know-its-id/309843)
**Author:** [@catmanjan](https://discuss.elastic.co/u/catmanjan)\ **Replies:** 4\ **Last updated:** [July 19, 2022, 5:29am UTC](https://discuss.elastic.co/t/more-like-this-query-using-an-existing-document-but-i-dont-know-its-id/309843 "2022-07-19T05:29:39Z")
I want to do a more like this query to return similar documents to a document that already exists in my index. I don't know the documents ID ahead of time, but I do know a term value that I can use to look it up (also, … --- ## [Elasticsearch ILM Policy](https://discuss.elastic.co/t/elasticsearch-ilm-policy/309974)
**Author:** [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 5:26am UTC](https://discuss.elastic.co/t/elasticsearch-ilm-policy/309974 "2022-07-19T05:26:42Z")
Hello Every One I have one elasticsearch cluster and Version is 7.10.2 I want to setup some of the index delete after week and after month automatically can you suggest how we can setup this cluster design is there are … --- ## [Indexes cannot be referenced after cluster configuration](https://discuss.elastic.co/t/indexes-cannot-be-referenced-after-cluster-configuration/309970)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 12\ **Last updated:** [July 19, 2022, 5:15am UTC](https://discuss.elastic.co/t/indexes-cannot-be-referenced-after-cluster-configuration/309970 "2022-07-19T05:15:08Z")
I am creating an Elasticsearch cluster. I am deleting the Elasticsearch node configuration that was already running on a single node and configuring a cluster with two newly created Elasticsearch nodes. Here, the clust… --- ## [Elasticsearch complaining about space issues when there is plenty of space available](https://discuss.elastic.co/t/elasticsearch-complaining-about-space-issues-when-there-is-plenty-of-space-available/309844)
**Author:** [@pushshift](https://discuss.elastic.co/u/pushshift)\ **Replies:** 7\ **Last updated:** [July 19, 2022, 5:11am UTC](https://discuss.elastic.co/t/elasticsearch-complaining-about-space-issues-when-there-is-plenty-of-space-available/309844 "2022-07-19T05:11:09Z")
I received the following error this evening while indexing a large dataset: WARNING:root:{'create': {'\_index': 'fh\_hot\_en\_2021-05-05', '\_id': '1390039787566821378', 'status': 429, 'error': {'type': 'cluster\_block\_except… --- ## [Logstash stuck at stage pipelines running](https://discuss.elastic.co/t/logstash-stuck-at-stage-pipelines-running/309951)
**Author:** [@sridharnetha](https://discuss.elastic.co/u/sridharnetha)\ **Replies:** 4\ **Last updated:** [July 19, 2022, 4:46am UTC](https://discuss.elastic.co/t/logstash-stuck-at-stage-pipelines-running/309951 "2022-07-19T04:46:14Z")
I am trying to ingest a csv file to include data on the elasticsearch server on the existing index. The csv file contains whitespaces in header column names. Here is an example "MOBILE NO" should be renamed to "MOBILE\_N… --- ## [Checked Exception "reference to termsQuery is ambiguous \[ERROR\]"](https://discuss.elastic.co/t/checked-exception-reference-to-termsquery-is-ambiguous-error/309969)
**Author:** [@willowHB](https://discuss.elastic.co/u/willowHB)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 3:17am UTC](https://discuss.elastic.co/t/checked-exception-reference-to-termsquery-is-ambiguous-error/309969 "2022-07-19T03:17:03Z")
version：elasticsearch-7.15.2.jar 1、I think this is an api method error.When you use “QueryBuilders.termsQuery("status", 3,4)” query, an error “reference to termsQuery is ambiguous \[ERROR\] both method termsQuery(java.… --- ## [Sort by time received instead of timestamp](https://discuss.elastic.co/t/sort-by-time-received-instead-of-timestamp/308992)
**Author:** [@MADxHAWK](https://discuss.elastic.co/u/MADxHAWK)\ **Replies:** 7\ **Last updated:** [July 19, 2022, 2:16am UTC](https://discuss.elastic.co/t/sort-by-time-received-instead-of-timestamp/308992 "2022-07-19T02:16:59Z")
Hello, im using ELK-Stack to search through Cisco logs received by filebeat from our loghost. the problem is, i only can sort the discover by Timestamp from Elasticsearch and not by the timestamp the message was receiv… --- ## [Check agent status with api](https://discuss.elastic.co/t/check-agent-status-with-api/309640)
**Author:** [@ericdb](https://discuss.elastic.co/u/ericdb)\ **Replies:** 0\ **Last updated:** [July 14, 2022, 12:00pm UTC](https://discuss.elastic.co/t/check-agent-status-with-api/309640 "2022-07-14T12:00:49Z")
Is it possible to get the status from fleet agents with api using the hostname? document says there is a request with agentID https://petstore.swagger.io/?url=https://raw.githubusercontent.com/elastic/kibana/master/x-p… --- ## [Setup.template.enabled: false. not work for disable default mapping](https://discuss.elastic.co/t/setup-template-enabled-false-not-work-for-disable-default-mapping/309720)
**Author:** [@sinbargit](https://discuss.elastic.co/u/sinbargit)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 2:08am UTC](https://discuss.elastic.co/t/setup-template-enabled-false-not-work-for-disable-default-mapping/309720 "2022-07-19T02:08:40Z")
filebeat version 7.1.1. I set setup.template.enabled: false. but there are still other fields like network.\* in my index. And after I set my own template, the template is used, but still certain fields in my index. J… --- ## [Is there a section in the documentation that breaks down all available subcommands for a command?](https://discuss.elastic.co/t/is-there-a-section-in-the-documentation-that-breaks-down-all-available-subcommands-for-a-command/309601)
**Author:** [@pushshift](https://discuss.elastic.co/u/pushshift)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 2:08am UTC](https://discuss.elastic.co/t/is-there-a-section-in-the-documentation-that-breaks-down-all-available-subcommands-for-a-command/309601 "2022-07-19T02:08:00Z")
When you do: curl -XGET https://localhost:9200/\_cat/ You get a nice little directory of available subcommands beneath \_cat. However, when I try to do the same for other sections like "\_cluster", I get the following: c… --- ## [ElasticSearch-Service install is not working](https://discuss.elastic.co/t/elasticsearch-service-install-is-not-working/309676)
**Author:** [@Muhammad\_Umair\_Sheik](https://discuss.elastic.co/u/Muhammad_Umair_Sheik)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 2:04am UTC](https://discuss.elastic.co/t/elasticsearch-service-install-is-not-working/309676 "2022-07-19T02:04:45Z")
I am not able to install elastic as a windows service when there is space in the path. Without space, it is working fine. In the past, I was using version 6 which was working perfectly fine with both options. I have att… --- ## [Trying to run all tests on my app yields "too many open files" error](https://discuss.elastic.co/t/trying-to-run-all-tests-on-my-app-yields-too-many-open-files-error/309759)
**Author:** [@juno](https://discuss.elastic.co/u/juno)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 2:01am UTC](https://discuss.elastic.co/t/trying-to-run-all-tests-on-my-app-yields-too-many-open-files-error/309759 "2022-07-19T02:01:22Z")
I'm building a reasonably small web app in Clojure and trying to run all the tests in order to get code coverage, but if I try to run them all, I get "too many open files" errors from elasticsearch. I have already tried… --- ## [Possible to scroll call ES v. 1.7 - how? I get errors](https://discuss.elastic.co/t/possible-to-scroll-call-es-v-1-7-how-i-get-errors/309653)
**Author:** [@johand\_erst](https://discuss.elastic.co/u/johand_erst)\ **Replies:** 2\ **Last updated:** [July 19, 2022, 1:54am UTC](https://discuss.elastic.co/t/possible-to-scroll-call-es-v-1-7-how-i-get-errors/309653 "2022-07-19T01:54:12Z")
Can someone help me what to do to call ES v. 1.7 with \_scroll\_id, please? According to the documentation it should be possible. Currently, I get one of these errors trying to pass \_scroll\_id in the payload: I write in… --- ## [Logstash syncing from Mongodb to Elasticsearch - Null values in array data objects](https://discuss.elastic.co/t/logstash-syncing-from-mongodb-to-elasticsearch-null-values-in-array-data-objects/309965)
**Author:** [@bindu1](https://discuss.elastic.co/u/bindu1)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 1:44am UTC](https://discuss.elastic.co/t/logstash-syncing-from-mongodb-to-elasticsearch-null-values-in-array-data-objects/309965 "2022-07-19T01:44:44Z")
Hello Community, I'm using logstash to sync data from Mongdb to Elasticsearch & Kibana using JDBC input plugin. But array data fields are being synced as NULL values in ES/Kibana. Below is logstash.conf: input { … --- ## [Resolve Indices API: Missing documentation for params \`allow\_no\_indices\`, \`ignore\_unavailable\` and target \`\_all\`](https://discuss.elastic.co/t/resolve-indices-api-missing-documentation-for-params-allow-no-indices-ignore-unavailable-and-target-all/309964)
**Author:** [@pavan02](https://discuss.elastic.co/u/pavan02)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 1:38am UTC](https://discuss.elastic.co/t/resolve-indices-api-missing-documentation-for-params-allow-no-indices-ignore-unavailable-and-target-all/309964 "2022-07-19T01:38:11Z")
Resolve index API | Elasticsearch Guide \[8.3\] | Elastic documentation doesn't describe params allow\_no\_indices, ignore\_unavailable and \_all target. However, those params and target is actually working. Does resolve API … --- ## [Installing ELK...Stuck in Elasticsearch not able to get Token and username password on windows 10 pro10](https://discuss.elastic.co/t/installing-elk-stuck-in-elasticsearch-not-able-to-get-token-and-username-password-on-windows-10-pro10/309776)
**Author:** [@sarvesh\_singh](https://discuss.elastic.co/u/sarvesh_singh)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 1:27am UTC](https://discuss.elastic.co/t/installing-elk-stuck-in-elasticsearch-not-able-to-get-token-and-username-password-on-windows-10-pro10/309776 "2022-07-19T01:27:39Z")
\[2022-07-16T04:10:17,949\]\[INFO \]\[o.e.g.GatewayService \] \[DESKTOP-MJL6HRR\] recovered \[1\] indices into cluster\_state \[2022-07-16T04:10:18,325\]\[ERROR\]\[o.e.i.g.GeoIpDownloader \] \[DESKTOP-MJL6HRR\] exception during geoip… --- ## [Logstash fillter](https://discuss.elastic.co/t/logstash-fillter/309846)
**Author:** [@Jathurshan\_Sumandira](https://discuss.elastic.co/u/Jathurshan_Sumandira)\ **Replies:** 0\ **Last updated:** [July 18, 2022, 6:16am UTC](https://discuss.elastic.co/t/logstash-fillter/309846 "2022-07-18T06:16:13Z")
Hi Team, We are using 2 filters. First one is to get the token and by getting the token we are going to call the next url with bearer token First http getting the response but second http method is not giving data ht… --- ## [Multi-Tier Architecture, best configuration for Elasticsearch.output](https://discuss.elastic.co/t/multi-tier-architecture-best-configuration-for-elasticsearch-output/309862)
**Author:** [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 1:25am UTC](https://discuss.elastic.co/t/multi-tier-architecture-best-configuration-for-elasticsearch-output/309862 "2022-07-19T01:25:23Z")
Hello, I hope you are having a good day, I'm trying to migrate to a multi-tier architecture, and I'm confused what should the Elasticsearch.output configuration in beats and Elastic Agent be: Should I configure beats… --- ## [How to safely disable XPack security features](https://discuss.elastic.co/t/how-to-safely-disable-xpack-security-features/309725)
**Author:** [@yeziblo](https://discuss.elastic.co/u/yeziblo)\ **Replies:** 3\ **Last updated:** [July 19, 2022, 1:24am UTC](https://discuss.elastic.co/t/how-to-safely-disable-xpack-security-features/309725 "2022-07-19T01:24:41Z")
Hi everyone, I need help. In the near future, we plan to enable X-PACK security for our ES cluster，both transport and https. What we need to consider is: once there is a problem in the production environment, we need t… --- ## [Best practices for dynamic expiration](https://discuss.elastic.co/t/best-practices-for-dynamic-expiration/309957)
**Author:** [@terramar](https://discuss.elastic.co/u/terramar)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 12:24am UTC](https://discuss.elastic.co/t/best-practices-for-dynamic-expiration/309957 "2022-07-19T00:24:18Z")
I'm not sure if that title makes much sense. Right now, I have a fair amount of data coming in through logstash - about 7-10GB/day, and it all needs to stick around for 60 days. I currently write it to an index ("index-… --- ## [Documentation for reporting with basic licence is wrong](https://discuss.elastic.co/t/documentation-for-reporting-with-basic-licence-is-wrong/309924)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [July 18, 2022, 10:50pm UTC](https://discuss.elastic.co/t/documentation-for-reporting-with-basic-licence-is-wrong/309924 "2022-07-18T22:50:27Z")
Hi the API call in this section of the documentation doesnt work in the actual version of elasticsearch. what will be the right API call to set reporting with basic licence? [Previous page](https://discuss.elastic.co/latest.md?page=1041) [Next page](https://discuss.elastic.co/latest.md?page=1043)