# Latest **URL:** https://discuss.elastic.co/latest.md?page=1097 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1098 --- ## [Add\_field in logstash does not work](https://discuss.elastic.co/t/add-field-in-logstash-does-not-work/306616)
**Author:** [@PriyaM21](https://discuss.elastic.co/u/PriyaM21)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 2:04am UTC](https://discuss.elastic.co/t/add-field-in-logstash-does-not-work/306616 "2022-06-08T02:04:50Z")
I am trying to add a new custom field from the message but new field do not show up in Kabana. There is no error in logstash logs. Below is my logstash code if \[fields\]\[app\_name\] == "cobra" { if \[source\] =~ /^".\*(\\|/… --- ## [Elasticsearch 6.3.2 rolling upgrade to 6.8.22, should the application elasticsearch-rest-high-level-client be upgraded to 6.8.22](https://discuss.elastic.co/t/elasticsearch-6-3-2-rolling-upgrade-to-6-8-22-should-the-application-elasticsearch-rest-high-level-client-be-upgraded-to-6-8-22/306645)
**Author:** [@qiuxb](https://discuss.elastic.co/u/qiuxb)\ **Replies:** 1\ **Last updated:** [June 8, 2022, 11:55pm UTC](https://discuss.elastic.co/t/elasticsearch-6-3-2-rolling-upgrade-to-6-8-22-should-the-application-elasticsearch-rest-high-level-client-be-upgraded-to-6-8-22/306645 "2022-06-08T23:55:18Z")
Refer to an official article： The 6.0 client is able to communicate with any 6.x Elasticsearch node, while the 6.1 client is for sure able to communicate with 6.1, 6.2 and any later 6.x version, but there may be incomp… --- ## [Repository verification exception while using S3 repo](https://discuss.elastic.co/t/repository-verification-exception-while-using-s3-repo/306649)
**Author:** [@Pallavi\_Chaudhari](https://discuss.elastic.co/u/Pallavi_Chaudhari)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 7:51am UTC](https://discuss.elastic.co/t/repository-verification-exception-while-using-s3-repo/306649 "2022-06-08T07:51:23Z")
Hi All, I am trying to use s3 plugin for backup and restore, please find the details below I have create IBM COS bucket which is s3 compatible and created access and secret key I have added s3.client.default.endpoint … --- ## [Filebeat setup](https://discuss.elastic.co/t/filebeat-setup/306695)
**Author:** [@kaul.abhishek1993](https://discuss.elastic.co/u/kaul.abhishek1993)\ **Replies:** 1\ **Last updated:** [June 8, 2022, 11:43pm UTC](https://discuss.elastic.co/t/filebeat-setup/306695 "2022-06-08T23:43:22Z")
Hello Team, i am running setup for filebeat on haproxy node. For DB nodes i am connecting to kibana with url http://prodkibana.oodi.iq:80 and its successfull but with haproxy its failing with error " Jun 08 15:15:57 ORY… --- ## [Getting this error java.lang.ClassNotFoundException: jakarta.json.JsonException](https://discuss.elastic.co/t/getting-this-error-java-lang-classnotfoundexception-jakarta-json-jsonexception/306734)
**Author:** [@Bhavya\_Dawar](https://discuss.elastic.co/u/Bhavya_Dawar)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 5:55pm UTC](https://discuss.elastic.co/t/getting-this-error-java-lang-classnotfoundexception-jakarta-json-jsonexception/306734 "2022-06-08T17:55:49Z")
Failed to instantiate \[co.elastic.clients.Elasticsearch.ElasticsearchClient\]: Factory method 'client' threw exception; nested exception is java.lang.NoClassDefFoundError: jakarta/json/JsonException @Bean public Elastic… --- ## [Unable to create ingest pipeline. Error 504](https://discuss.elastic.co/t/unable-to-create-ingest-pipeline-error-504/306640)
**Author:** [@haopv](https://discuss.elastic.co/u/haopv)\ **Replies:** 2\ **Last updated:** [June 8, 2022, 11:40pm UTC](https://discuss.elastic.co/t/unable-to-create-ingest-pipeline-error-504/306640 "2022-06-08T23:40:06Z")
When I try to create a new pipeline or update an old pipeline there's the response from UI says "Unable to create pipeline 504 Gateway timeout" although any other function in the cluster like indexing and searching w… --- ## [Logstash connectivity from aws to on-premise](https://discuss.elastic.co/t/logstash-connectivity-from-aws-to-on-premise/306638)
**Author:** [@narasingarao.katta](https://discuss.elastic.co/u/narasingarao.katta)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 7:04am UTC](https://discuss.elastic.co/t/logstash-connectivity-from-aws-to-on-premise/306638 "2022-06-08T07:04:42Z")
Hi i want move my cloud watch logs to elk which is hosted out of aws . can any one give some inputs in this --- ## [How to solve elastic error of "Readiness probe failed: Error: Got HTTP code 503 but expected a 200" in GKE?](https://discuss.elastic.co/t/how-to-solve-elastic-error-of-readiness-probe-failed-error-got-http-code-503-but-expected-a-200-in-gke/306726)
**Author:** [@Samuel\_Arogbonlo](https://discuss.elastic.co/u/Samuel_Arogbonlo)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 4:22pm UTC](https://discuss.elastic.co/t/how-to-solve-elastic-error-of-readiness-probe-failed-error-got-http-code-503-but-expected-a-200-in-gke/306726 "2022-06-08T16:22:02Z")
0 I am installing Elastic on GKE with the helm chart here. But after running this command helm upgrade kibana elastic/kibana --values kibana.yaml , it runs successfully but the pod gives this error Readiness probe faile… --- ## [So many layers with same data in MAP](https://discuss.elastic.co/t/so-many-layers-with-same-data-in-map/306676)
**Author:** [@akshay\_bhardwaj](https://discuss.elastic.co/u/akshay_bhardwaj)\ **Replies:** 3\ **Last updated:** [June 8, 2022, 9:25pm UTC](https://discuss.elastic.co/t/so-many-layers-with-same-data-in-map/306676 "2022-06-08T21:25:57Z")
When i draw a map with data there are so many layers on hover showing same data how i can reduce the same. --- ## [Filebeat and GLIBC Errors on Ubuntu 22.04](https://discuss.elastic.co/t/filebeat-and-glibc-errors-on-ubuntu-22-04/306653)
**Author:** [@mibeyki](https://discuss.elastic.co/u/mibeyki)\ **Replies:** 2\ **Last updated:** [June 8, 2022, 8:13pm UTC](https://discuss.elastic.co/t/filebeat-and-glibc-errors-on-ubuntu-22-04/306653 "2022-06-08T20:13:26Z")
Hello, We just deployed filebeat both Ubuntu 22.04 server and Ubuntu 22.04 desktop. However, we cannot be able to get Filebeat connect to Elasticsearch. Both versions of Filebeat and ES is 7.10.1; When you run; file… --- ## [Reverse DNS processor multiple nameservers problem](https://discuss.elastic.co/t/reverse-dns-processor-multiple-nameservers-problem/306704)
**Author:** [@unknotted-evacuee](https://discuss.elastic.co/u/unknotted-evacuee)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 1:56pm UTC](https://discuss.elastic.co/t/reverse-dns-processor-multiple-nameservers-problem/306704 "2022-06-08T13:56:48Z")
Hey filebeat version 8.0.1 I'm suspecting a problem with using multiple namespaces for the DNS processor. My config looks like this (with dummy ip addresses, and I was testing with a low ttl in failure\_cache): … --- ## [Modify the string into another form in Logstash](https://discuss.elastic.co/t/modify-the-string-into-another-form-in-logstash/306732)
**Author:** [@Pranjal\_Sett](https://discuss.elastic.co/u/Pranjal_Sett)\ **Replies:** 1\ **Last updated:** [June 8, 2022, 6:35pm UTC](https://discuss.elastic.co/t/modify-the-string-into-another-form-in-logstash/306732 "2022-06-08T18:35:10Z")
Hello, I am having one csv file, in that csv file there is a attribute named as Time field. And the format of that time field is not as a standard format. Here is the format: \[30/Nov/2017:15:28:27 And I want to change… --- ## [Drop filter to avoid documents to be sent to ES not working](https://discuss.elastic.co/t/drop-filter-to-avoid-documents-to-be-sent-to-es-not-working/306584)
**Author:** [@Carlos\_T](https://discuss.elastic.co/u/Carlos_T)\ **Replies:** 8\ **Last updated:** [June 8, 2022, 6:29pm UTC](https://discuss.elastic.co/t/drop-filter-to-avoid-documents-to-be-sent-to-es-not-working/306584 "2022-06-08T18:29:50Z")
Hi everybody. I've have a ES + Kib + Logstash + Filebeat environment ready for testing purposes, and after installing Filebeat so it sends the data to Logstash, I've realiced that I'm recieving more documents than necce… --- ## [Index\_out\_of\_bounds\_exception](https://discuss.elastic.co/t/index-out-of-bounds-exception/306736)
**Author:** [@magedmakled](https://discuss.elastic.co/u/magedmakled)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 6:29pm UTC](https://discuss.elastic.co/t/index-out-of-bounds-exception/306736 "2022-06-08T18:29:53Z")
Hello All, I have a query that was working but all the sudden it is returning index\_out\_of\_bounds\_exception. The document has a nested field events . I ran this directly from Kibana Elasticsearch 6. GET event\_lists/\_… --- ## [Insert to elasticsearch from logstash IF NOT EXISTS](https://discuss.elastic.co/t/insert-to-elasticsearch-from-logstash-if-not-exists/306368)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 7\ **Last updated:** [June 8, 2022, 6:09pm UTC](https://discuss.elastic.co/t/insert-to-elasticsearch-from-logstash-if-not-exists/306368 "2022-06-08T18:09:58Z")
Hi, I currently have an index that I set unique ids and sometimes there is replica data. In my use case, older data is often more accurate than newer data. So I would like to have logstash only insert if the \_id current… --- ## [Parse ISO 8601 duration format (PT(n)H(n)M(n)S)](https://discuss.elastic.co/t/parse-iso-8601-duration-format-pt-n-h-n-m-n-s/306605)
**Author:** [@Iss](https://discuss.elastic.co/u/Iss)\ **Replies:** 5\ **Last updated:** [June 8, 2022, 5:53pm UTC](https://discuss.elastic.co/t/parse-iso-8601-duration-format-pt-n-h-n-m-n-s/306605 "2022-06-08T17:53:03Z")
Hi! I have a ISO 8601 duration format P(n)Y(n)M(n)DT(n)H(n)M(n)S fields as "duration"=\>"PT0H0M0S" I have to parse it to get time duration in seconds or in format HH:MM:SS. How can I do it with logstash filter? Than… --- ## [Deloy on AKS Elastic stack](https://discuss.elastic.co/t/deloy-on-aks-elastic-stack/306731)
**Author:** [@vladimir\_petukhov](https://discuss.elastic.co/u/vladimir_petukhov)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 5:40pm UTC](https://discuss.elastic.co/t/deloy-on-aks-elastic-stack/306731 "2022-06-08T17:40:13Z")
I tried to deploy on Azure Kubernetes Elastic stack following this example ELASTIC.IO.I want to get logs from mine.Net6 WebApi.For logger I use Serilog. I was made docker-compose to run the elastic stack on the local doc… --- ## [Using IBM common data provider for z systems](https://discuss.elastic.co/t/using-ibm-common-data-provider-for-z-systems/306723)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 4:05pm UTC](https://discuss.elastic.co/t/using-ibm-common-data-provider-for-z-systems/306723 "2022-06-08T16:05:45Z")
Hello all, Hope you are doing well. I have been using ELK 7.16.2. and I want to use IBM Common Data Provider to stream logs to my Logstash instance. But I have a few questions about installation of IBM CDPz, from where… --- ## [Grok pattern matching in debugger but not on logstash](https://discuss.elastic.co/t/grok-pattern-matching-in-debugger-but-not-on-logstash/306624)
**Author:** [@smtp\_server](https://discuss.elastic.co/u/smtp_server)\ **Replies:** 3\ **Last updated:** [June 8, 2022, 3:44pm UTC](https://discuss.elastic.co/t/grok-pattern-matching-in-debugger-but-not-on-logstash/306624 "2022-06-08T15:44:57Z")
Obvious from question, I've been trying to look for fault for so long but still don't seem to be coming around solution. Here's config filter{ grok{ pattern\_definitions =\> { "CUSTOMMONTH" =\> "(Jan|Feb|Mar|Apr|Ma… --- ## [Logstash not working, if installed in a location where the path contains parentheses (on windows)](https://discuss.elastic.co/t/logstash-not-working-if-installed-in-a-location-where-the-path-contains-parentheses-on-windows/306721)
**Author:** [@simon137](https://discuss.elastic.co/u/simon137)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 3:40pm UTC](https://discuss.elastic.co/t/logstash-not-working-if-installed-in-a-location-where-the-path-contains-parentheses-on-windows/306721 "2022-06-08T15:40:29Z")
Hello together, As the title suggests, with a sample path of "C:\\ProgramData\\Test)Test\\logstash", the call to ".\\bin\\logstash.bat" fails with the message: "Test\\logstash\\jdk\\bin\\java.exe" cannot be processed syntactical… --- ## [Connect Metricbeat to Elasticsearch 8.2.0 with password mode](https://discuss.elastic.co/t/connect-metricbeat-to-elasticsearch-8-2-0-with-password-mode/306311)
**Author:** [@Dreinale](https://discuss.elastic.co/u/Dreinale)\ **Replies:** 13\ **Last updated:** [June 8, 2022, 3:23pm UTC](https://discuss.elastic.co/t/connect-metricbeat-to-elasticsearch-8-2-0-with-password-mode/306311 "2022-06-08T15:23:49Z")
HI, I'm trying to connect metricbeat to my elasticsearch which I have configured yesterday with a password mode. (https://www.youtube.com/watch?v=kkrLanotz1I&t=461s). I have 2 users one is for elasticsearch (elastic) … --- ## [Fscrawler \_settings.yaml nodes settings](https://discuss.elastic.co/t/fscrawler-settings-yaml-nodes-settings/306717)
**Author:** [@newschapmj1](https://discuss.elastic.co/u/newschapmj1)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 2:47pm UTC](https://discuss.elastic.co/t/fscrawler-settings-yaml-nodes-settings/306717 "2022-06-08T14:47:54Z")
We have a cluster of 7 nodes (ES 7.10). We run 5 Fscrawlers on 2 other separate servers. In the nodes section of \_settings.yaml At present we have the 7 IP addresses of the 7 nodes listed in ascending order on each of… --- ## [PIT on alias with filter](https://discuss.elastic.co/t/pit-on-alias-with-filter/306715)
**Author:** [@mhugo](https://discuss.elastic.co/u/mhugo)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 2:42pm UTC](https://discuss.elastic.co/t/pit-on-alias-with-filter/306715 "2022-06-08T14:42:28Z")
Hi, I am trying to understand the resource demand for pagination queries over large datasets using search\_after and a Point-In-Time. The application I work on exposes "datasets" to its customers. These datasets may be … --- ## [esrally.exceptions.LaunchError: Daemon startup failed with exit code \[1\] on Elasticsearch post 8.0.0 version](https://discuss.elastic.co/t/esrally-exceptions-launcherror-daemon-startup-failed-with-exit-code-1-on-elasticsearch-post-8-0-0-version/306714)
**Author:** [@Gsqsf](https://discuss.elastic.co/u/Gsqsf)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 2:40pm UTC](https://discuss.elastic.co/t/esrally-exceptions-launcherror-daemon-startup-failed-with-exit-code-1-on-elasticsearch-post-8-0-0-version/306714 "2022-06-08T14:40:08Z")
Similar to the problem esrally.exceptions.LaunchError: Daemon startup failed with exit code \[1\] I had the error code esrally.exceptions.LaunchError: Daemon startup failed with exit code \[1\] with the command: esrally ra… --- ## [Are these reasonable/expected metrics for an idle cluster?](https://discuss.elastic.co/t/are-these-reasonable-expected-metrics-for-an-idle-cluster/306644)
**Author:** [@AS11](https://discuss.elastic.co/u/AS11)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 7:30am UTC](https://discuss.elastic.co/t/are-these-reasonable-expected-metrics-for-an-idle-cluster/306644 "2022-06-08T07:30:16Z")
For an idle 3-node cluster (7.17.4), where all nodes are masters, i.e. listed under initial\_master\_nodes, is it normal that: Documents merged rate, red-bordered on the image below, would be on the order of 1000/s on a… --- ## [No alert on missing data - Kibana](https://discuss.elastic.co/t/no-alert-on-missing-data-kibana/305792)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 2\ **Last updated:** [June 8, 2022, 2:16pm UTC](https://discuss.elastic.co/t/no-alert-on-missing-data-kibana/305792 "2022-06-08T14:16:09Z")
Hello, I have set up alerts on the metric threshold like the one below. But when I stop the metricbeat on a server the state from "Active" changes to "Recovered" and no missing data alert is created. I was testin… --- ## [Opendistro Alerting indices retrieves nothing](https://discuss.elastic.co/t/opendistro-alerting-indices-retrieves-nothing/306707)
**Author:** [@noob2](https://discuss.elastic.co/u/noob2)\ **Replies:** 1\ **Last updated:** [June 8, 2022, 2:05pm UTC](https://discuss.elastic.co/t/opendistro-alerting-indices-retrieves-nothing/306707 "2022-06-08T14:05:25Z")
Hi Team, I am facing some issue in opendistro kibana v7.10.2, The created alerts are not stored in Alerting index .opendistro-alerting-config as per opendistro documentation. But i can the see functionality working we… --- ## [Logstash not sending all data to elasti search](https://discuss.elastic.co/t/logstash-not-sending-all-data-to-elasti-search/306699)
**Author:** [@Mary2022](https://discuss.elastic.co/u/Mary2022)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 1:39pm UTC](https://discuss.elastic.co/t/logstash-not-sending-all-data-to-elasti-search/306699 "2022-06-08T13:39:31Z")
Hi, My logstash is getting data continuously. I know this because I can see it at the logs (logstash debugging mode) but the if I go to kibana I see that 8 or 7 hrs ago I got 10 min of data and that was it when it was … --- ## [Remove documents with existing value in given field](https://discuss.elastic.co/t/remove-documents-with-existing-value-in-given-field/306572)
**Author:** [@fran\_hernandez](https://discuss.elastic.co/u/fran_hernandez)\ **Replies:** 4\ **Last updated:** [June 8, 2022, 1:09pm UTC](https://discuss.elastic.co/t/remove-documents-with-existing-value-in-given-field/306572 "2022-06-08T13:09:33Z")
Hello, I am trying to delete or pipe (Delete), an event that already has the same indexed value for a given field. The scenario is as follows: I have a fleet server and an agent to fetch logs from AD Server, Windows f… --- ## [How to update a single field using the Java API Client?](https://discuss.elastic.co/t/how-to-update-a-single-field-using-the-java-api-client/306679)
**Author:** [@dsc](https://discuss.elastic.co/u/dsc)\ **Replies:** 1\ **Last updated:** [June 8, 2022, 12:33pm UTC](https://discuss.elastic.co/t/how-to-update-a-single-field-using-the-java-api-client/306679 "2022-06-08T12:33:34Z")
I'm currently using the deprecated Java High Level REST Client to partially update a document using something similar to the guide: Update API | Java REST Client \[7.17\] | Elastic I'm trying to migrate to the latest Elas… [Previous page](https://discuss.elastic.co/latest.md?page=1096) [Next page](https://discuss.elastic.co/latest.md?page=1098)