# Latest

**URL:** https://discuss.elastic.co/latest.md?page=1079

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1080

---

## [While connecting elasticSearch Getting this Exception through java api](https://discuss.elastic.co/t/while-connecting-elasticsearch-getting-this-exception-through-java-api/307764)

<div class="topic-metadata">

**Author:** [@Udayaprakash\_S\_10d](https://discuss.elastic.co/u/Udayaprakash_S_10d)\
**Replies:** 5\
**Last updated:** [June 22, 2022, 2:24am UTC](https://discuss.elastic.co/t/while-connecting-elasticsearch-getting-this-exception-through-java-api/307764 "2022-06-22T02:24:12Z")

</div>

SLF4J: Failed toString() invocation on an object of type \[org.elasticsearch.search.builder.SearchSourceBuilder\] Reported exception: java.lang.NullPointerException at org.elasticsearch.index.query.BoolQueryBuilder.doXArr…

---

## [Regarding count lookup of newly defined fields with log stash](https://discuss.elastic.co/t/regarding-count-lookup-of-newly-defined-fields-with-log-stash/307814)

<div class="topic-metadata">

**Author:** [@inwoo1](https://discuss.elastic.co/u/inwoo1)\
**Replies:** 3\
**Last updated:** [June 22, 2022, 2:32am UTC](https://discuss.elastic.co/t/regarding-count-lookup-of-newly-defined-fields-with-log-stash/307814 "2022-06-22T02:32:04Z")

</div>

I am collecting SNMP through logstash and creating a new field forti\_fw\_sessioncount through mutate-rename function. Looking at the log, 791 cases of forti\_fw\_sessioncount came in, but only 29 cases were shown when I ch…

---

## [Middleware Logic Layer](https://discuss.elastic.co/t/middleware-logic-layer/307817)

<div class="topic-metadata">

**Author:** [@randomusername001](https://discuss.elastic.co/u/randomusername001)\
**Replies:** 0\
**Last updated:** [June 22, 2022, 1:15am UTC](https://discuss.elastic.co/t/middleware-logic-layer/307817 "2022-06-22T01:15:45Z")

</div>

Hi All, Apologies if this is the wrong section to be posting in. Hoping to get some advice / insights if there is anything available in market to use for our use case. We have an ELK cluster that is running our site se…

---

## [Null results from search](https://discuss.elastic.co/t/null-results-from-search/307800)

<div class="topic-metadata">

**Author:** [@EnJay](https://discuss.elastic.co/u/EnJay)\
**Replies:** 2\
**Last updated:** [June 22, 2022, 12:49am UTC](https://discuss.elastic.co/t/null-results-from-search/307800 "2022-06-22T00:49:29Z")

</div>

Hello dear community :hugs: I record the price of bitcoin in ElasticSearch every 5 minutes. Today there was a problem, the server was down for a while, because of which the price was not recorded. Because of this, I sta…

---

## [How to config kibana if xpack.security.http.ssl.enabled is false](https://discuss.elastic.co/t/how-to-config-kibana-if-xpack-security-http-ssl-enabled-is-false/307350)

<div class="topic-metadata">

**Author:** [@yjm17865195865](https://discuss.elastic.co/u/yjm17865195865)\
**Replies:** 7\
**Last updated:** [June 21, 2022, 11:55pm UTC](https://discuss.elastic.co/t/how-to-config-kibana-if-xpack-security-http-ssl-enabled-is-false/307350 "2022-06-21T23:55:22Z")

</div>

I'm starting a Elasticsearch v8.2.2 throuth docker images. After started i found that TLS/SSL is enabled in default and I want to disable that( however it's fine that between es'node keep using the TLS/SSL to communicate…

---

## [How do I host an Elasticsearch server on a local machine and allow other machines to access that data?](https://discuss.elastic.co/t/how-do-i-host-an-elasticsearch-server-on-a-local-machine-and-allow-other-machines-to-access-that-data/307766)

<div class="topic-metadata">

**Author:** [@DataStorageMuse](https://discuss.elastic.co/u/DataStorageMuse)\
**Replies:** 18\
**Last updated:** [June 21, 2022, 11:42pm UTC](https://discuss.elastic.co/t/how-do-i-host-an-elasticsearch-server-on-a-local-machine-and-allow-other-machines-to-access-that-data/307766 "2022-06-21T23:42:59Z")

</div>

I have an Elasticsearch server running on a local machine with an ip address: {local\_machine\_ip}. I have another computer that has an ip {client\_ip}. How do I allow the client computer to access the Elasticsearch server …

---

## [Painless scipt](https://discuss.elastic.co/t/painless-scipt/307524)

<div class="topic-metadata">

**Author:** [@Soren\_vdc](https://discuss.elastic.co/u/Soren_vdc)\
**Replies:** 1\
**Last updated:** [June 21, 2022, 11:19pm UTC](https://discuss.elastic.co/t/painless-scipt/307524 "2022-06-21T23:19:10Z")

</div>

Hi, I have query with aggregation and as result I receive the buckets with the "key" and "doc\_count". I want to send mail for each bucket that is find in the output. I have this: "transform": { "script": { …

---

## [Unable to download getting a 403](https://discuss.elastic.co/t/unable-to-download-getting-a-403/307139)

<div class="topic-metadata">

**Author:** [@abas](https://discuss.elastic.co/u/abas)\
**Replies:** 5\
**Last updated:** [June 21, 2022, 10:43pm UTC](https://discuss.elastic.co/t/unable-to-download-getting-a-403/307139 "2022-06-21T22:43:32Z")

</div>

Hello, We are using Chocolatay to install some packages on our Windows Server. I tried to install winlogbeat, which downloads the file from https://artifacts.elastic.co/downloads/beats/winlogbeat/winlogbeat-7.15.1-windo…

---

## [Export huge amount of data converted to csv format](https://discuss.elastic.co/t/export-huge-amount-of-data-converted-to-csv-format/307779)

<div class="topic-metadata">

**Author:** [@Tony79](https://discuss.elastic.co/u/Tony79)\
**Replies:** 1\
**Last updated:** [June 21, 2022, 10:28pm UTC](https://discuss.elastic.co/t/export-huge-amount-of-data-converted-to-csv-format/307779 "2022-06-21T22:28:04Z")

</div>

Hi, I want to export a huge amount of structured data to a csv formatted file. What is the most "production friendly" way to do this? I'm thinking of running elasticdump from a system with enough disk but I'm not sure…

---

## [ALLOCATION\_FAILED needed explain Elastic 8.1.1](https://discuss.elastic.co/t/allocation-failed-needed-explain-elastic-8-1-1/307778)

<div class="topic-metadata">

**Author:** [@INS](https://discuss.elastic.co/u/INS)\
**Replies:** 2\
**Last updated:** [June 21, 2022, 10:25pm UTC](https://discuss.elastic.co/t/allocation-failed-needed-explain-elastic-8-1-1/307778 "2022-06-21T22:25:16Z")

</div>

Hi I'm facing with ALLOCATION\_FAILED, and I want to know what was the reason. My cluster consists with 51 node on 3 hosts under docker swarm, and I have also configured data tier. Can You explain how I can recover throu…

---

## [How to retrieve data aws Lambda](https://discuss.elastic.co/t/how-to-retrieve-data-aws-lambda/307781)

<div class="topic-metadata">

**Author:** [@Renato\_Souza](https://discuss.elastic.co/u/Renato_Souza)\
**Replies:** 0\
**Last updated:** [June 21, 2022, 4:23pm UTC](https://discuss.elastic.co/t/how-to-retrieve-data-aws-lambda/307781 "2022-06-21T16:23:37Z")

</div>

How to retrieve data from AWS Lambda. I'm using functionbeat, but even with SAR I only retrieve CloudWatch logs as well. I would like support to know how to use these elastic integrations with AWS and I was able to dire…

---

## [How do I publish Elasticsearch cluster run on a remote machine (via its public IP address) and access it from another machine with Python Client?](https://discuss.elastic.co/t/how-do-i-publish-elasticsearch-cluster-run-on-a-remote-machine-via-its-public-ip-address-and-access-it-from-another-machine-with-python-client/307798)

<div class="topic-metadata">

**Author:** [@DataStorageMuse](https://discuss.elastic.co/u/DataStorageMuse)\
**Replies:** 1\
**Last updated:** [June 21, 2022, 10:18pm UTC](https://discuss.elastic.co/t/how-do-i-publish-elasticsearch-cluster-run-on-a-remote-machine-via-its-public-ip-address-and-access-it-from-another-machine-with-python-client/307798 "2022-06-21T22:18:21Z")

</div>

Hi, I was wondering if anyone could give me concrete instructions (or point me to where in the documentation there are specific instructions) for publishing an Elasticsearch cluster on the host machine (via the public IP…

---

## [Logstash Startup 401 error on Windows 10](https://discuss.elastic.co/t/logstash-startup-401-error-on-windows-10/307806)

<div class="topic-metadata">

**Author:** [@AE2000](https://discuss.elastic.co/u/AE2000)\
**Replies:** 0\
**Last updated:** [June 21, 2022, 9:55pm UTC](https://discuss.elastic.co/t/logstash-startup-401-error-on-windows-10/307806 "2022-06-21T21:55:32Z")

</div>

I'm installing ELK on my windows 10 workstation and I've gone through the steps to install all three; although there was a few issues with authorization during the process, Elasticsearch and Kibana are working perfectly …

---

## [Is there a way to efficiently get three layer aggrigations result in elasticsearch, where each layer is conditioned by above one](https://discuss.elastic.co/t/is-there-a-way-to-efficiently-get-three-layer-aggrigations-result-in-elasticsearch-where-each-layer-is-conditioned-by-above-one/307788)

<div class="topic-metadata">

**Author:** [@Robin\_Rawat](https://discuss.elastic.co/u/Robin_Rawat)\
**Replies:** 0\
**Last updated:** [June 21, 2022, 5:35pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-efficiently-get-three-layer-aggrigations-result-in-elasticsearch-where-each-layer-is-conditioned-by-above-one/307788 "2022-06-21T17:35:41Z")

</div>

I am trying to get composite aggregation for certain feilds which are present in each document. These documents are stored in elastic. Format of each document is a json with below mentioned keys. {"id","name","topic","bu…

---

## [Challenges with date/time range selection when combining snapshot and timeseries data](https://discuss.elastic.co/t/challenges-with-date-time-range-selection-when-combining-snapshot-and-timeseries-data/304997)

<div class="topic-metadata">

**Author:** [@Sadia\_Mukhtar](https://discuss.elastic.co/u/Sadia_Mukhtar)\
**Replies:** 17\
**Last updated:** [June 21, 2022, 9:17pm UTC](https://discuss.elastic.co/t/challenges-with-date-time-range-selection-when-combining-snapshot-and-timeseries-data/304997 "2022-06-21T21:17:48Z")

</div>

Hi there, My organization is very new to Elasticsearch and Kibana. Historically we were using sql server for our analytics. We are doing a PoC to determine if Elastic and Kibana will with our scenario. We have 12 months…

---

## [Unnasigned shards for replica](https://discuss.elastic.co/t/unnasigned-shards-for-replica/307792)

<div class="topic-metadata">

**Author:** [@INS](https://discuss.elastic.co/u/INS)\
**Replies:** 1\
**Last updated:** [June 21, 2022, 7:43pm UTC](https://discuss.elastic.co/t/unnasigned-shards-for-replica/307792 "2022-06-21T19:43:15Z")

</div>

Hi How can I reassign (UNASSIGNED) shards for replica ? logstash-prod1-2022.06.21 3 p STARTED 2833524 es\_data\_ssd\_5\_1 logstash-prod1-2022.06.21 3 r UNASSIGNED I have tried through below req: POS…

---

## [Getting 403 denied to https://artifacts.elastic.co/packages/8.x/apt](https://discuss.elastic.co/t/getting-403-denied-to-https-artifacts-elastic-co-packages-8-x-apt/306956)

<div class="topic-metadata">

**Author:** [@dramis](https://discuss.elastic.co/u/dramis)\
**Replies:** 2\
**Last updated:** [June 21, 2022, 7:27pm UTC](https://discuss.elastic.co/t/getting-403-denied-to-https-artifacts-elastic-co-packages-8-x-apt/306956 "2022-06-21T19:27:52Z")

</div>

Since a few day I got error when trying to update elastic on one of my server: apt update Hit:1 Index of /debian-security bullseye-security InRelease Hit:2 Index of /debian bullseye InRelease Hit:3 Index of /debian b…

---

## [App Search - How to add "multi field", a field with array of values (like color)](https://discuss.elastic.co/t/app-search-how-to-add-multi-field-a-field-with-array-of-values-like-color/307443)

<div class="topic-metadata">

**Author:** [@eliezra236](https://discuss.elastic.co/u/eliezra236)\
**Replies:** 1\
**Last updated:** [June 21, 2022, 7:23pm UTC](https://discuss.elastic.co/t/app-search-how-to-add-multi-field-a-field-with-array-of-values-like-color/307443 "2022-06-21T19:23:50Z")

</div>

Hi everyone, I am trying to use App Search, and when I index a document that looks like: name: 'metalica t-shirt' colors: \['red', 'black'\] The engine removes 'black' and leaves it as: name: 'metalica t-shirt' colors:…

---

## [Search Results Optimization](https://discuss.elastic.co/t/search-results-optimization/307460)

<div class="topic-metadata">

**Author:** [@Himanshu\_Jain4](https://discuss.elastic.co/u/Himanshu_Jain4)\
**Replies:** 1\
**Last updated:** [June 21, 2022, 7:16pm UTC](https://discuss.elastic.co/t/search-results-optimization/307460 "2022-06-21T19:16:55Z")

</div>

Hello, It seems very general question but I have been trying a lot and still not getting appropriate results. We are a mapping company and our user search business place , administrative place or house name in our sea…

---

## [Appsearch on unsecure cluster](https://discuss.elastic.co/t/appsearch-on-unsecure-cluster/307644)

<div class="topic-metadata">

**Author:** [@samiujan](https://discuss.elastic.co/u/samiujan)\
**Replies:** 1\
**Last updated:** [June 21, 2022, 7:11pm UTC](https://discuss.elastic.co/t/appsearch-on-unsecure-cluster/307644 "2022-06-21T19:11:38Z")

</div>

Hi I am trying to set up an unsecured cluster (without auth and TLS) with Appsearch - I can set up an unsecure ES cluster by turning off security in the elasticsearch.yml file using: xpack.security.enabled: false xpack…

---

## [Parse JSON array with nested objects](https://discuss.elastic.co/t/parse-json-array-with-nested-objects/307770)

<div class="topic-metadata">

**Author:** [@eliz](https://discuss.elastic.co/u/eliz)\
**Replies:** 2\
**Last updated:** [June 21, 2022, 6:37pm UTC](https://discuss.elastic.co/t/parse-json-array-with-nested-objects/307770 "2022-06-21T18:37:09Z")

</div>

Hi there! I am receiving an array of nested JSON elements and I would like to build a logic capable of transforming the following input { "devices": \[ { "device": { "device\_name": "printer\_1", …

---

## [App search document ttl](https://discuss.elastic.co/t/app-search-document-ttl/307650)

<div class="topic-metadata">

**Author:** [@frolko](https://discuss.elastic.co/u/frolko)\
**Replies:** 1\
**Last updated:** [June 21, 2022, 6:30pm UTC](https://discuss.elastic.co/t/app-search-document-ttl/307650 "2022-06-21T18:30:55Z")

</div>

Running 8.2 ECK and want to use 'app search' to make things searchable on our site. (using Kibana to configure) How should I handle TTL (time-to-live) to only search for relevant data? what I want To configure app sear…

---

## [Deleting all documents inside an engine 8.2](https://discuss.elastic.co/t/deleting-all-documents-inside-an-engine-8-2/307668)

<div class="topic-metadata">

**Author:** [@frolko](https://discuss.elastic.co/u/frolko)\
**Replies:** 1\
**Last updated:** [June 21, 2022, 6:27pm UTC](https://discuss.elastic.co/t/deleting-all-documents-inside-an-engine-8-2/307668 "2022-06-21T18:27:06Z")

</div>

I would like to delete all documents to app search before repopulate. Is there a newer, better and simpler way than extracting a list of all ids and then looping to delete with 100 at the time? references:

---

## [Elastic Agent with fleet policy refuses to start properly](https://discuss.elastic.co/t/elastic-agent-with-fleet-policy-refuses-to-start-properly/307700)

<div class="topic-metadata">

**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\
**Replies:** 1\
**Last updated:** [June 21, 2022, 6:14pm UTC](https://discuss.elastic.co/t/elastic-agent-with-fleet-policy-refuses-to-start-properly/307700 "2022-06-21T18:14:54Z")

</div>

My Elastic Agent that runs the Fleet policy stopped working a week or two ago. As it cannot start the Fleet server. # elastic-agent status Status: FAILED Message: (no message) Applications: \* filebeat (C…

---

## [Azure Availability not showing on any event](https://discuss.elastic.co/t/azure-availability-not-showing-on-any-event/307790)

<div class="topic-metadata">

**Author:** [@Thuunder7](https://discuss.elastic.co/u/Thuunder7)\
**Replies:** 0\
**Last updated:** [June 21, 2022, 6:06pm UTC](https://discuss.elastic.co/t/azure-availability-not-showing-on-any-event/307790 "2022-06-21T18:06:52Z")

</div>

Hey guys, I have a metricbeat that is collecting metrics from azure, like for example, databases and storage accounts. It is working fine, but i would like to create an alert to check when a database is down, but unfort…

---

## [Getting slow logs on kibana with an hour delay time](https://discuss.elastic.co/t/getting-slow-logs-on-kibana-with-an-hour-delay-time/307645)

<div class="topic-metadata">

**Author:** [@Milad\_Akhlaghi](https://discuss.elastic.co/u/Milad_Akhlaghi)\
**Replies:** 6\
**Last updated:** [June 21, 2022, 6:06pm UTC](https://discuss.elastic.co/t/getting-slow-logs-on-kibana-with-an-hour-delay-time/307645 "2022-06-21T18:06:34Z")

</div>

Hi friends, i have elk cluster that includes: 20 filebeats , 6 logstash, 9 elasticsearches and 2 kibanas Elasticsearch node roles are : 3 x \[ data\_hot, data\_content \] 3 x \[ data\_warm, ingest, master \] 1x \[ master \] …

---

## [c.a.a.p.i.BasicProfileConfigFileLoader noise](https://discuss.elastic.co/t/c-a-a-p-i-basicprofileconfigfileloader-noise/307630)

<div class="topic-metadata">

**Author:** [@Anarhyst266](https://discuss.elastic.co/u/Anarhyst266)\
**Replies:** 6\
**Last updated:** [June 21, 2022, 5:55pm UTC](https://discuss.elastic.co/t/c-a-a-p-i-basicprofileconfigfileloader-noise/307630 "2022-06-21T17:55:38Z")

</div>

When I'm trying to set logger.level to warn in my ES 8.1.3(also checked on 8.2.3) I've got the noise WARN message "message":"Unable to load config file null", "ecs.version": "1.2.0","service.name":"ES\_ECS","event.datase…

---

## [Stress testing the Logstash service](https://discuss.elastic.co/t/stress-testing-the-logstash-service/306815)

<div class="topic-metadata">

**Author:** [@olivierots](https://discuss.elastic.co/u/olivierots)\
**Replies:** 13\
**Last updated:** [June 21, 2022, 4:46pm UTC](https://discuss.elastic.co/t/stress-testing-the-logstash-service/306815 "2022-06-21T16:46:09Z")

</div>

Hello there, I wonder whether someone can help me with this I am looking at ways to load stress test the Logstash service that sits on an ec2 instance I am looking at implementing some scaling policies for our ASGs bu…

---

## [Adjusting the Elasticsearch logo/white labeling](https://discuss.elastic.co/t/adjusting-the-elasticsearch-logo-white-labeling/307773)

<div class="topic-metadata">

**Author:** [@gentle\_ghost](https://discuss.elastic.co/u/gentle_ghost)\
**Replies:** 1\
**Last updated:** [June 21, 2022, 4:42pm UTC](https://discuss.elastic.co/t/adjusting-the-elasticsearch-logo-white-labeling/307773 "2022-06-21T16:42:15Z")

</div>

Hello, Has anyone had any success white labeling Kibana? There were some previous guides for version 7.17 but with 8.0 released they no longer apply. Thanks

---

## [Logstash is running on only starts on 127.0.0.1:9600](https://discuss.elastic.co/t/logstash-is-running-on-only-starts-on-127-0-0-1-9600/307710)

<div class="topic-metadata">

**Author:** [@sugriv\_1605](https://discuss.elastic.co/u/sugriv_1605)\
**Replies:** 4\
**Last updated:** [June 21, 2022, 4:38pm UTC](https://discuss.elastic.co/t/logstash-is-running-on-only-starts-on-127-0-0-1-9600/307710 "2022-06-21T16:38:18Z")

</div>

Hi, My Logstash is running but the Port 9600 is not Listening.

[Previous page](https://discuss.elastic.co/latest.md?page=1078)

[Next page](https://discuss.elastic.co/latest.md?page=1080)
