# Latest **URL:** https://discuss.elastic.co/latest.md?page=1121 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1122 --- ## [Why there are 20 documents diff (cat vs count)?](https://discuss.elastic.co/t/why-there-are-20-documents-diff-cat-vs-count/305341)
**Author:** [@asil](https://discuss.elastic.co/u/asil)\ **Replies:** 2\ **Last updated:** [May 22, 2022, 3:50pm UTC](https://discuss.elastic.co/t/why-there-are-20-documents-diff-cat-vs-count/305341 "2022-05-22T15:50:16Z")
I try to compare results of count and cat for the amount of documents and I'm getting different results: GET /my\_index/\_count gives: { "count": 4020199, "\_shards": { "total": 1, "successful": 1, … --- ## [Sort in Java API client](https://discuss.elastic.co/t/sort-in-java-api-client/305368)
**Author:** [@vishalop0993](https://discuss.elastic.co/u/vishalop0993)\ **Replies:** 0\ **Last updated:** [May 23, 2022, 4:59am UTC](https://discuss.elastic.co/t/sort-in-java-api-client/305368 "2022-05-23T04:59:21Z")
Hi Experts, I am using new java API client to connect with Elasticsearch. My requirement is to search documents in sorted order of given parameters. I have written the below code to search and sort by "customer". … --- ## [S3 snapshot repository cooldown period unnecessary?](https://discuss.elastic.co/t/s3-snapshot-repository-cooldown-period-unnecessary/304297)
**Author:** [@bpiper](https://discuss.elastic.co/u/bpiper)\ **Replies:** 5\ **Last updated:** [May 23, 2022, 3:36am UTC](https://discuss.elastic.co/t/s3-snapshot-repository-cooldown-period-unnecessary/304297 "2022-05-23T03:36:18Z")
I'm currently looking at upgrading some 6.8 clusters to 7.17, and noticed the artificial 3 minute wait on create/delete snapshot operations on an S3 repository that appears to have been added sometime in early 2020. I d… --- ## [How to change an agent name](https://discuss.elastic.co/t/how-to-change-an-agent-name/305091)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 5\ **Last updated:** [May 23, 2022, 1:01am UTC](https://discuss.elastic.co/t/how-to-change-an-agent-name/305091 "2022-05-23T01:01:45Z")
So, I've been looking for a way to change the Java agent name. Silly thing but still would help a lot in situations like "group by agent.name". While is not on topic it would be awsome to see how this is made with Django… --- ## [Failed to add field from ECS](https://discuss.elastic.co/t/failed-to-add-field-from-ecs/305342)
**Author:** [@Arunas\_Saltis](https://discuss.elastic.co/u/Arunas_Saltis)\ **Replies:** 1\ **Last updated:** [May 22, 2022, 4:30pm UTC](https://discuss.elastic.co/t/failed-to-add-field-from-ecs/305342 "2022-05-22T16:30:59Z")
Hi all, I am trying to add information about TLS session state between filebeats and logstash into logstash beats input from ECS, but no success. I tested all the described ECS fields of the beats input module, only one… --- ## [Copy metricbeat data from one elasticsearch to another on different machines](https://discuss.elastic.co/t/copy-metricbeat-data-from-one-elasticsearch-to-another-on-different-machines/304813)
**Author:** [@aviral\_srivastava](https://discuss.elastic.co/u/aviral_srivastava)\ **Replies:** 2\ **Last updated:** [May 22, 2022, 9:03am UTC](https://discuss.elastic.co/t/copy-metricbeat-data-from-one-elasticsearch-to-another-on-different-machines/304813 "2022-05-22T09:03:00Z")
Hi, source: Elasticsearch-8.1.0 destination: Elasticsearch-8.1.0 Both the source and destination are on different machines. In the source metricbeat indices are created daily. metricbeat.yml configuration: output.e… --- ## [Logstash problems with splitting on field value](https://discuss.elastic.co/t/logstash-problems-with-splitting-on-field-value/305328)
**Author:** [@edwardc](https://discuss.elastic.co/u/edwardc)\ **Replies:** 2\ **Last updated:** [May 22, 2022, 4:14am UTC](https://discuss.elastic.co/t/logstash-problems-with-splitting-on-field-value/305328 "2022-05-22T04:14:17Z")
Hi All, i have a problem with the logstash split filter. Any advice or input is greatly appreciated. I have the input as such: {"SONG\_A":\[ { "MD5":"a", "filename": "x.txt" }, { "MD5":"b", "filename": "y.txt" } \] } I a… --- ## [Issues with Filebeat, how to debug?](https://discuss.elastic.co/t/issues-with-filebeat-how-to-debug/304754)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 4\ **Last updated:** [May 22, 2022, 4:03am UTC](https://discuss.elastic.co/t/issues-with-filebeat-how-to-debug/304754 "2022-05-22T04:03:18Z")
Hi Team, I am facing an weird issue with Filebeat dumping data in Elasticsearch. My filebeat has suddenly stopped the data dumping to Elasticsearch. If we restart the service it starts dumping the data momentarily but s… --- ## [Metricbeat php\_fpm read sockets multiple pools](https://discuss.elastic.co/t/metricbeat-php-fpm-read-sockets-multiple-pools/305340)
**Author:** [@rbos](https://discuss.elastic.co/u/rbos)\ **Replies:** 0\ **Last updated:** [May 22, 2022, 1:17am UTC](https://discuss.elastic.co/t/metricbeat-php-fpm-read-sockets-multiple-pools/305340 "2022-05-22T01:17:21Z")
Hi, I have php-fpm installed on servers configured with multiple pools; I've set them to point to unix socket files, instead of HTTP, so like in the php-fpm.d files: listen = /var/run/php-fpm/php-fpm-web.sock I can fa… --- ## [Parse basic xml file](https://discuss.elastic.co/t/parse-basic-xml-file/305331)
**Author:** [@Ely\_96](https://discuss.elastic.co/u/Ely_96)\ **Replies:** 11\ **Last updated:** [May 21, 2022, 10:42pm UTC](https://discuss.elastic.co/t/parse-basic-xml-file/305331 "2022-05-21T22:42:01Z")
Hi All, Could you please help me? I'm in trouble on parsing a basic xml file. This is an example of my xml: \\Hotel 1\\22\\1\\2\\ \… --- ## ["Kibana is now available (was degraded)"](https://discuss.elastic.co/t/kibana-is-now-available-was-degraded/305335)
**Author:** [@grramaprasad](https://discuss.elastic.co/u/grramaprasad)\ **Replies:** 3\ **Last updated:** [May 21, 2022, 9:03pm UTC](https://discuss.elastic.co/t/kibana-is-now-available-was-degraded/305335 "2022-05-21T21:03:44Z")
Cannot launch kibana but the service is available --- ## [Recommendations on new setup](https://discuss.elastic.co/t/recommendations-on-new-setup/305330)
**Author:** [@tru64gurus](https://discuss.elastic.co/u/tru64gurus)\ **Replies:** 3\ **Last updated:** [May 21, 2022, 7:57pm UTC](https://discuss.elastic.co/t/recommendations-on-new-setup/305330 "2022-05-21T19:57:34Z")
Hello, I am building new ES cluster using free ES offering. I have three physical servers with 1TB each , expected log volume is 20-30 million per hour. I am looking for best practice on how to setup the cluster and t… --- ## [Kibana server is not ready yet error](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-error/305313)
**Author:** [@stramzik](https://discuss.elastic.co/u/stramzik)\ **Replies:** 2\ **Last updated:** [May 21, 2022, 11:57am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-error/305313 "2022-05-21T11:57:41Z")
Hi, I've installed Elasticsearch and Kibana on a windows server and I am trying to access the kibana instance on a different machine. I am able to access Elasticsearch however when I try to access Kibana I get an error … --- ## [Elastic Machine Learning - Pre Built Rules](https://discuss.elastic.co/t/elastic-machine-learning-pre-built-rules/305178)
**Author:** [@geetika\_gopi](https://discuss.elastic.co/u/geetika_gopi)\ **Replies:** 4\ **Last updated:** [May 21, 2022, 10:45am UTC](https://discuss.elastic.co/t/elastic-machine-learning-pre-built-rules/305178 "2022-05-21T10:45:46Z")
Hello, For some of the windows pre-built ML jobs, we noticed the datafeed configured was as follows: { "bool": { "filter": \[ { "term": { "destination.ip": "169.254.169.254" } … --- ## [How to index short sentences for similarity search?](https://discuss.elastic.co/t/how-to-index-short-sentences-for-similarity-search/305302)
**Author:** [@jimw](https://discuss.elastic.co/u/jimw)\ **Replies:** 1\ **Last updated:** [May 21, 2022, 8:22am UTC](https://discuss.elastic.co/t/how-to-index-short-sentences-for-similarity-search/305302 "2022-05-21T08:22:45Z")
I have a huge dataset, each document is the dataset contains some lines of short sentences. My problem is: Given a document, I need search similar documents based on the threshold of how many percentage of short sentenc… --- ## [Kibana role is not working as expected](https://discuss.elastic.co/t/kibana-role-is-not-working-as-expected/305256)
**Author:** [@Poojan](https://discuss.elastic.co/u/Poojan)\ **Replies:** 1\ **Last updated:** [May 21, 2022, 7:16am UTC](https://discuss.elastic.co/t/kibana-role-is-not-working-as-expected/305256 "2022-05-21T07:16:44Z")
Hello there, I have created one space on kibana named "space-a" and have given access to 2 users. both users has access of different index patterns and dashboards. However, when user-1 is trying to open dashboard list p… --- ## [Packebeat Docker Host](https://discuss.elastic.co/t/packebeat-docker-host/305325)
**Author:** [@jam\_mahmoudi](https://discuss.elastic.co/u/jam_mahmoudi)\ **Replies:** 0\ **Last updated:** [May 21, 2022, 5:39am UTC](https://discuss.elastic.co/t/packebeat-docker-host/305325 "2022-05-21T05:39:29Z")
Hi guys I have a question I have 10 containers published on the Internet on one of my Docker hosts and I have to check the traffic of all these 10 containers with one Packetbeat. But I have no idea to run. Thanks for… --- ## [Logstash =\> influxdb authentication failed](https://discuss.elastic.co/t/logstash-influxdb-authentication-failed/305323)
**Author:** [@mibrahim](https://discuss.elastic.co/u/mibrahim)\ **Replies:** 0\ **Last updated:** [May 21, 2022, 3:51am UTC](https://discuss.elastic.co/t/logstash-influxdb-authentication-failed/305323 "2022-05-21T03:51:14Z")
I am trying to make my logstash report matrics to influxdb but i got authentication failed :frowning: Here is my config for logstash.conf: input { exec { command =\> "echo 'Hello'" interval =\> 30 } } output… --- ## [Handle json filter field name cannot be an empty string error](https://discuss.elastic.co/t/handle-json-filter-field-name-cannot-be-an-empty-string-error/304973)
**Author:** [@austin0918](https://discuss.elastic.co/u/austin0918)\ **Replies:** 9\ **Last updated:** [May 21, 2022, 2:39am UTC](https://discuss.elastic.co/t/handle-json-filter-field-name-cannot-be-an-empty-string-error/304973 "2022-05-21T02:39:13Z")
I have some Proofpoint logs in JSON format likes... { "metadata":{ "tzOffsetMins":-240, "tsEpochMs":1650294078380 }, "ts":"2022-05-17T01:02:10.380410-0400", "guid":"T1sZJIJ-YGTdBDzraMXIw6rea9pB78Qw", "msgParts":\[ { … --- ## [ES version 1.7](https://discuss.elastic.co/t/es-version-1-7/305312)
**Author:** [@buddi009](https://discuss.elastic.co/u/buddi009)\ **Replies:** 4\ **Last updated:** [May 21, 2022, 2:00am UTC](https://discuss.elastic.co/t/es-version-1-7/305312 "2022-05-21T02:00:04Z")
Hello, we are on really old version of ES, am trying rehydrate ec2 running, i see only one node from ASG joining ES cluster. validated ES running on each instance My ASG have 3 instances. any help is appreciated {"cl… --- ## [Stopping watch service, reason \[shutdown initiated\]](https://discuss.elastic.co/t/stopping-watch-service-reason-shutdown-initiated/304902)
**Author:** [@amitsa](https://discuss.elastic.co/u/amitsa)\ **Replies:** 4\ **Last updated:** [May 21, 2022, 1:01am UTC](https://discuss.elastic.co/t/stopping-watch-service-reason-shutdown-initiated/304902 "2022-05-21T01:01:25Z")
{"@timestamp":"2022-05-17T07:20:24.445Z", "log.level": "INFO", "message":"license mode is \[basic\], currently licensed security realms are \[reserved/reserved,file/default\_file,native/default\_native\]", "ecs.version": "1.2.… --- ## [Error: unrecognized arguments: refresh\_interval: -1](https://discuss.elastic.co/t/error-unrecognized-arguments-refresh-interval-1/305058)
**Author:** [@amitsa](https://discuss.elastic.co/u/amitsa)\ **Replies:** 6\ **Last updated:** [May 21, 2022, 1:00am UTC](https://discuss.elastic.co/t/error-unrecognized-arguments-refresh-interval-1/305058 "2022-05-21T01:00:41Z")
getting below error while benchmarking with geonames track esrally: error: unrecognized arguments: refresh\_interval: -1}} esrally race --offline --track-params=number\_of\_shards:${ES\_NO\_OF\_SHARDS} --track-params=number\_… --- ## [Rename Field with \[\]](https://discuss.elastic.co/t/rename-field-with/305117)
**Author:** [@cris](https://discuss.elastic.co/u/cris)\ **Replies:** 8\ **Last updated:** [May 20, 2022, 6:04pm UTC](https://discuss.elastic.co/t/rename-field-with/305117 "2022-05-20T18:04:37Z")
Hello I want to rename some field without affect the other data. I tried with. input { elasticsearch { hosts =\> "localhost:9200" index =\> "services" size =\> 1 docinfo =\> true } } filter { … --- ## [GeoJSON Maps color from hex code](https://discuss.elastic.co/t/geojson-maps-color-from-hex-code/305272)
**Author:** [@Quentin\_D](https://discuss.elastic.co/u/Quentin_D)\ **Replies:** 5\ **Last updated:** [May 20, 2022, 8:40pm UTC](https://discuss.elastic.co/t/geojson-maps-color-from-hex-code/305272 "2022-05-20T20:40:32Z")
Hi everyone, I'm a kinda new user of the Elastic Stack and I have a hard time getting what I want from the "maps" visualization. What I'm trying to do is to create a GeoJSON file with colors and display these colors on… --- ## [ILM with existing indices](https://discuss.elastic.co/t/ilm-with-existing-indices/305316)
**Author:** [@lchan](https://discuss.elastic.co/u/lchan)\ **Replies:** 1\ **Last updated:** [May 20, 2022, 7:54pm UTC](https://discuss.elastic.co/t/ilm-with-existing-indices/305316 "2022-05-20T19:54:22Z")
I am following Manage existing indices | Elasticsearch Guide \[8.2\] | Elastic and I am trying to apply all existing indices (that are in hot node) with policy "existing-indices" so it can go through ilm but it the step is… --- ## [Custom Authorization Engine issue](https://discuss.elastic.co/t/custom-authorization-engine-issue/305024)
**Author:** [@ash\_n](https://discuss.elastic.co/u/ash_n)\ **Replies:** 8\ **Last updated:** [May 20, 2022, 7:25pm UTC](https://discuss.elastic.co/t/custom-authorization-engine-issue/305024 "2022-05-20T19:25:49Z")
I'm working on an implementation of a custom authorization engine by following the instructions on this page and using this sample. I'm using Elasticsearch v8.2.0. I've been able to generate the single zip file for my c… --- ## [Configuring Kibana Logging](https://discuss.elastic.co/t/configuring-kibana-logging/305112)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 2\ **Last updated:** [May 20, 2022, 7:16pm UTC](https://discuss.elastic.co/t/configuring-kibana-logging/305112 "2022-05-20T19:16:44Z")
I don't know why this is so hard, but I can't figure out the new way of configuring logging in Kibana. I am trying to output kibana logs to a file, below is what I have. It doesn't throw errors, but it also doesn't log… --- ## [Kibana failed to load CA: PEM routines:get\_name:no start line](https://discuss.elastic.co/t/kibana-failed-to-load-ca-pem-routinesno-start-line/305228)
**Author:** [@rileghft](https://discuss.elastic.co/u/rileghft)\ **Replies:** 2\ **Last updated:** [May 20, 2022, 7:11pm UTC](https://discuss.elastic.co/t/kibana-failed-to-load-ca-pem-routinesno-start-line/305228 "2022-05-20T19:11:54Z")
I setup an Elasticsearch cluster, and the cluster health is green. Elasticsearch cluster can be reached on kibana server, but kibana failed to start, showing PEM error. Environment: OS: Almalinux 8.6 Kibana version: … --- ## [Kibana issue connecting to elasticsearch via https](https://discuss.elastic.co/t/kibana-issue-connecting-to-elasticsearch-via-https/305237)
**Author:** [@GSood1](https://discuss.elastic.co/u/GSood1)\ **Replies:** 1\ **Last updated:** [May 20, 2022, 6:23pm UTC](https://discuss.elastic.co/t/kibana-issue-connecting-to-elasticsearch-via-https/305237 "2022-05-20T18:23:13Z")
So I've been informed by our IT that we need to enable SSL on our setup. Currently, we are using logstash, Elasticsearch, and kibana running via 3 separate docker containers. I got a DoD SSL cert from our IT folks and … --- ## [Error Kibana container is unhealthy](https://discuss.elastic.co/t/error-kibana-container-is-unhealthy/303409)
**Author:** [@Fabian\_Crespo\_Fernan](https://discuss.elastic.co/u/Fabian_Crespo_Fernan)\ **Replies:** 12\ **Last updated:** [May 20, 2022, 5:27pm UTC](https://discuss.elastic.co/t/error-kibana-container-is-unhealthy/303409 "2022-05-20T17:27:13Z")
Hello, We are trying to install and configure an Elasticsearch cluster in Ubuntu 20.04.4 LTS(x86-64) with the docker-compose.yml from https://www.elastic.co/guide/en/elasticsearch/reference/current/docker.html. The comm… [Previous page](https://discuss.elastic.co/latest.md?page=1120) [Next page](https://discuss.elastic.co/latest.md?page=1122)