# Latest **URL:** https://discuss.elastic.co/latest.md?page=1153 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1154 --- ## [Aggregation Response Bucket Order](https://discuss.elastic.co/t/aggregation-response-bucket-order/303544)
**Author:** [@EricPSU](https://discuss.elastic.co/u/EricPSU)\ **Replies:** 0\ **Last updated:** [April 28, 2022, 5:12pm UTC](https://discuss.elastic.co/t/aggregation-response-bucket-order/303544 "2022-04-28T17:12:57Z")
I'm looking to understand the order of the buckets returned when using aggs in my query. I do not want to sort the bucket values, rather I want to sort the buckets themselves. Regardless of the order of the aggs in the… --- ## [Logstash-forwarder-java gives SSL handshake error with Logstash v7.16.1 and higher](https://discuss.elastic.co/t/logstash-forwarder-java-gives-ssl-handshake-error-with-logstash-v7-16-1-and-higher/303510)
**Author:** [@preetish\_P](https://discuss.elastic.co/u/preetish_P)\ **Replies:** 2\ **Last updated:** [April 28, 2022, 5:11pm UTC](https://discuss.elastic.co/t/logstash-forwarder-java-gives-ssl-handshake-error-with-logstash-v7-16-1-and-higher/303510 "2022-04-28T17:11:53Z")
Hi folks, We are in the process of upgrading ELK stack from v7.11.2 to v7.17.2 to fix the log4j2 vulnerability due to JNDI lookup. Most of the our servers are on AIX so we use logstash-forwarder-java utility. We observ… --- ## [Parsing multiple json in a file](https://discuss.elastic.co/t/parsing-multiple-json-in-a-file/303446)
**Author:** [@stemons](https://discuss.elastic.co/u/stemons)\ **Replies:** 3\ **Last updated:** [April 28, 2022, 4:35pm UTC](https://discuss.elastic.co/t/parsing-multiple-json-in-a-file/303446 "2022-04-28T16:35:06Z")
Hello! I'm trying to parse a file that contains multiple json. Each json is not delimited by a new line or comma separated. e.g. {"version":"0",....}{"version":"0",...}{"version":"0",...} parsing with the following cod… --- ## [Easy Install](https://discuss.elastic.co/t/easy-install/303451)
**Author:** [@Dan\_Lange](https://discuss.elastic.co/u/Dan_Lange)\ **Replies:** 2\ **Last updated:** [April 28, 2022, 4:18pm UTC](https://discuss.elastic.co/t/easy-install/303451 "2022-04-28T16:18:10Z")
Hi, I need an easy and repeatable way to install Elasticsearch, Kibana, and Elastic Agent for a demo. I don't care about security or scalability. Can anyone point me to directions for how to do that? I tried using th… --- ## [User messages\* Database is empty in Lab](https://discuss.elastic.co/t/user-messages-database-is-empty-in-lab/303436)
**Author:** [@Silverquick](https://discuss.elastic.co/u/Silverquick)\ **Replies:** 3\ **Last updated:** [April 28, 2022, 4:17pm UTC](https://discuss.elastic.co/t/user-messages-database-is-empty-in-lab/303436 "2022-04-28T16:17:20Z")
After creating the Index Pattern of user messages\* it reads as a blank database. I successfully created the users\* Index pattern, but when creating the "user messages\*" index pattern even though it finds a database, it … --- ## [Import a saved dashboard into Elasticsearch using Java](https://discuss.elastic.co/t/import-a-saved-dashboard-into-elasticsearch-using-java/303536)
**Author:** [@bob4](https://discuss.elastic.co/u/bob4)\ **Replies:** 0\ **Last updated:** [April 28, 2022, 3:25pm UTC](https://discuss.elastic.co/t/import-a-saved-dashboard-into-elasticsearch-using-java/303536 "2022-04-28T15:25:56Z")
I am trying to import a saved dashboard into Elasticsearch using HttpURLConnection. I can successfully execute the following taken from the saved objects api example in Elasticsearch documentation. $ curl -X POST api/s… --- ## [Error when I wanted to try to create a CBOR object from the content of a PDF file and insert it into an ingest-attachment](https://discuss.elastic.co/t/error-when-i-wanted-to-try-to-create-a-cbor-object-from-the-content-of-a-pdf-file-and-insert-it-into-an-ingest-attachment/303535)
**Author:** [@Asmaa\_Oufkir](https://discuss.elastic.co/u/Asmaa_Oufkir)\ **Replies:** 0\ **Last updated:** [April 28, 2022, 3:25pm UTC](https://discuss.elastic.co/t/error-when-i-wanted-to-try-to-create-a-cbor-object-from-the-content-of-a-pdf-file-and-insert-it-into-an-ingest-attachment/303535 "2022-04-28T15:25:56Z")
File IN\_FILE = ResourceUtils.getFile("classpath:test.pdf"); int length = (int) IN\_FILE.length(); RandomAccessFile aFile = new RandomAccessFile(IN\_FILE, "r"); System.out.println("aFile :"+aFile); FileCh… --- ## [Kibana can't connect apm-server](https://discuss.elastic.co/t/kibana-cant-connect-apm-server/303354)
**Author:** [@111443](https://discuss.elastic.co/u/111443)\ **Replies:** 1\ **Last updated:** [April 28, 2022, 1:44pm UTC](https://discuss.elastic.co/t/kibana-cant-connect-apm-server/303354 "2022-04-28T13:44:14Z")
Kibana version: Kibana version 7.12.1 Elasticsearch version: Elasticsearch version 7.12.1 APM Server version: apm-server 7.12.1 --- ## [Helm logstash elasticSearch plugin does not work with custom user except if supersuer](https://discuss.elastic.co/t/helm-logstash-elasticsearch-plugin-does-not-work-with-custom-user-except-if-supersuer/303520)
**Author:** [@stoza](https://discuss.elastic.co/u/stoza)\ **Replies:** 0\ **Last updated:** [April 28, 2022, 1:35pm UTC](https://discuss.elastic.co/t/helm-logstash-elasticsearch-plugin-does-not-work-with-custom-user-except-if-supersuer/303520 "2022-04-28T13:35:11Z")
Hi, I'm testing the to install logstash with helm from https://github.com/elastic/helm-charts. Everything works fine except that logstash is not able to query index and get a 403 forbidden when another user than elasti… --- ## [Refresh Search result without altering the state](https://discuss.elastic.co/t/refresh-search-result-without-altering-the-state/303392)
**Author:** [@Mohamed\_Lemine\_Ahmed](https://discuss.elastic.co/u/Mohamed_Lemine_Ahmed)\ **Replies:** 8\ **Last updated:** [April 28, 2022, 1:17pm UTC](https://discuss.elastic.co/t/refresh-search-result-without-altering-the-state/303392 "2022-04-28T13:17:42Z")
Hi everyone Is there any way I can refresh the search results without altering the search state, it would great if such feature would exist, As I tried to do it by exporting the SearchDriver but I didn't succeed. Pleas… --- ## [Aggregation with collapsed query](https://discuss.elastic.co/t/aggregation-with-collapsed-query/303380)
**Author:** [@Ibrahim\_Z\_HIDIR](https://discuss.elastic.co/u/Ibrahim_Z_HIDIR)\ **Replies:** 3\ **Last updated:** [April 28, 2022, 1:11pm UTC](https://discuss.elastic.co/t/aggregation-with-collapsed-query/303380 "2022-04-28T13:11:50Z")
Hi I just want to apply aggregation on a query result. My query is eleminating the double documents keeping last one according to a clumn. But the aggragation doesn't care the actual result. I've read that the collapse … --- ## [JSON log parse to separate fields](https://discuss.elastic.co/t/json-log-parse-to-separate-fields/303511)
**Author:** [@Dmitriy\_Esin](https://discuss.elastic.co/u/Dmitriy_Esin)\ **Replies:** 0\ **Last updated:** [April 28, 2022, 1:08pm UTC](https://discuss.elastic.co/t/json-log-parse-to-separate-fields/303511 "2022-04-28T13:08:18Z")
Hi all! I have a question about implementing JSON log parsing to separated fields in Kibana. I use fluend to get logs from my k8s cluster. See the config: containers.input.conf: |- \ @id fluentd-co… --- ## [Need to parse xml by logstash and create an event only if a field value is non zero](https://discuss.elastic.co/t/need-to-parse-xml-by-logstash-and-create-an-event-only-if-a-field-value-is-non-zero/303306)
**Author:** [@Rohit\_Goel1](https://discuss.elastic.co/u/Rohit_Goel1)\ **Replies:** 1\ **Last updated:** [April 28, 2022, 1:03pm UTC](https://discuss.elastic.co/t/need-to-parse-xml-by-logstash-and-create-an-event-only-if-a-field-value-is-non-zero/303306 "2022-04-28T13:03:58Z")
Hi Team , I have few Jenkins build xml files generated when jenkins jobs are triggered. I have to read few tags from the xml and create new fields from them by parsing it through logstash. The xml has one tag \… --- ## [Make a custom parameter source send two (related) queries](https://discuss.elastic.co/t/make-a-custom-parameter-source-send-two-related-queries/303403)
**Author:** [@jmlucjav](https://discuss.elastic.co/u/jmlucjav)\ **Replies:** 2\ **Last updated:** [April 28, 2022, 1:00pm UTC](https://discuss.elastic.co/t/make-a-custom-parameter-source-send-two-related-queries/303403 "2022-04-28T13:00:29Z")
Hi, when benchmarking with rally, in order to make it realistic, I want to issue two ES queries (they are related so they need to be created in context) whenever my custom source is invoked. Is there a good way to do t… --- ## [Events time difference between event.created and event.ingested](https://discuss.elastic.co/t/events-time-difference-between-event-created-and-event-ingested/303269)
**Author:** [@Elie\_Sbat](https://discuss.elastic.co/u/Elie_Sbat)\ **Replies:** 12\ **Last updated:** [April 28, 2022, 12:44pm UTC](https://discuss.elastic.co/t/events-time-difference-between-event-created-and-event-ingested/303269 "2022-04-28T12:44:40Z")
Hello, I am using elk stack v8. traffic is flowing winlog-\>kafka - \> logstash -\> Elasticsearch. there is a time difference between "event created" and "event.ingest". the time difference is around 1 hour. Logstash co… --- ## [I lost my 30 day free trail](https://discuss.elastic.co/t/i-lost-my-30-day-free-trail/303441)
**Author:** [@Rayhan\_Shaik](https://discuss.elastic.co/u/Rayhan_Shaik)\ **Replies:** 3\ **Last updated:** [April 28, 2022, 12:39pm UTC](https://discuss.elastic.co/t/i-lost-my-30-day-free-trail/303441 "2022-04-28T12:39:01Z")
Hi Team, I was playing around the kibana, and at some point I saw 30 day free trail option in stack management, and I clicked on that. but then I thought I don't need a 30 day trail right now, I thought to save this tr… --- ## [How to filter search query by repeated words?](https://discuss.elastic.co/t/how-to-filter-search-query-by-repeated-words/303157)
**Author:** [@div927](https://discuss.elastic.co/u/div927)\ **Replies:** 4\ **Last updated:** [April 28, 2022, 12:25pm UTC](https://discuss.elastic.co/t/how-to-filter-search-query-by-repeated-words/303157 "2022-04-28T12:25:49Z")
Hello, I am trying to write a search query which will search by taking input like keywords, example - apple, fruit, summer. After that it should return me the data from the Elasticsearch if all these 3 keywords are pre… --- ## [Elastic Search - 7.16.3 Dependency Boost C++ Libraries - boost Version](https://discuss.elastic.co/t/elastic-search-7-16-3-dependency-boost-c-libraries-boost-version/302894)
**Author:** [@Indranil](https://discuss.elastic.co/u/Indranil)\ **Replies:** 1\ **Last updated:** [April 28, 2022, 12:25pm UTC](https://discuss.elastic.co/t/elastic-search-7-16-3-dependency-boost-c-libraries-boost-version/302894 "2022-04-28T12:25:44Z")
Hi, Please help us to know which Boost C++ Libraries - boost Version is used in Elasticsearch - 7.16.3. We are using this version of Elasticsearch in our product. But binary scan is not able to identify the version of B… --- ## [Elasticsearch 8.1.0 Cluster Issue](https://discuss.elastic.co/t/elasticsearch-8-1-0-cluster-issue/302300)
**Author:** [@Mohsin\_Ashraf](https://discuss.elastic.co/u/Mohsin_Ashraf)\ **Replies:** 12\ **Last updated:** [April 28, 2022, 12:16pm UTC](https://discuss.elastic.co/t/elasticsearch-8-1-0-cluster-issue/302300 "2022-04-28T12:16:08Z")
Hi. I trying to build an Elasticsearch cluster. But after generating the enrollment token and making some changes to the configuration file and assigning the role for different nodes it gives me the following error when… --- ## [Is there a solution to get a sum equal to value of multiple field from elasticsearch data](https://discuss.elastic.co/t/is-there-a-solution-to-get-a-sum-equal-to-value-of-multiple-field-from-elasticsearch-data/303490)
**Author:** [@abderrahmen\_fekih](https://discuss.elastic.co/u/abderrahmen_fekih)\ **Replies:** 2\ **Last updated:** [April 28, 2022, 12:10pm UTC](https://discuss.elastic.co/t/is-there-a-solution-to-get-a-sum-equal-to-value-of-multiple-field-from-elasticsearch-data/303490 "2022-04-28T12:10:56Z")
I have an Elasticsearch data (ingredients list). I want to get exactly 4 ingredients where the sum of protein equal to 70 { "\_index" : "sample\_ingredients", "\_id" : "C\_cH-X8BaYOrJWCswgP-", "\_score" : 1.0, … --- ## [Indices stats store values seem not coherent](https://discuss.elastic.co/t/indices-stats-store-values-seem-not-coherent/303507)
**Author:** [@juliana\_cg](https://discuss.elastic.co/u/juliana_cg)\ **Replies:** 0\ **Last updated:** [April 28, 2022, 11:56am UTC](https://discuss.elastic.co/t/indices-stats-store-values-seem-not-coherent/303507 "2022-04-28T11:56:34Z")
Hello, i've been using the /\_stats endpoint to recover the size of my indices, however it seems that the values are not the same between GET /\_stats/store?expand\_wildcards=all and GET /\_stats?expand\_wildcards=all, i'm o… --- ## [Metricbeat on Kubernetes does not work with conditions](https://discuss.elastic.co/t/metricbeat-on-kubernetes-does-not-work-with-conditions/303506)
**Author:** [@melkamar](https://discuss.elastic.co/u/melkamar)\ **Replies:** 0\ **Last updated:** [April 28, 2022, 11:54am UTC](https://discuss.elastic.co/t/metricbeat-on-kubernetes-does-not-work-with-conditions/303506 "2022-04-28T11:54:09Z")
Hi! I want to set up a metricbeat data collection for some pods in my cluster. I already have a working filebeat configuration where I collect logs from certain pods based on autodiscover template conditions. But the sam… --- ## [Kibana - DIscover - Issue "indexing is not supported on a read-only engine"](https://discuss.elastic.co/t/kibana-discover-issue-indexing-is-not-supported-on-a-read-only-engine/303389)
**Author:** [@Penchev](https://discuss.elastic.co/u/Penchev)\ **Replies:** 6\ **Last updated:** [April 28, 2022, 10:51am UTC](https://discuss.elastic.co/t/kibana-discover-issue-indexing-is-not-supported-on-a-read-only-engine/303389 "2022-04-28T10:51:34Z")
Hi, I have an issue with KIbana Disocver module. I cannot search in my indices. The error I see is : "indexing is not supported on a read-only engine". All my indices are with status green. I tried running the followin… --- ## [BulkAllResponse and BulkResponse is not giving failed records](https://discuss.elastic.co/t/bulkallresponse-and-bulkresponse-is-not-giving-failed-records/303501)
**Author:** [@Ansuman\_Satapathy](https://discuss.elastic.co/u/Ansuman_Satapathy)\ **Replies:** 0\ **Last updated:** [April 28, 2022, 10:46am UTC](https://discuss.elastic.co/t/bulkallresponse-and-bulkresponse-is-not-giving-failed-records/303501 "2022-04-28T10:46:04Z")
I am using a NEST package 7.8.2 and trying to use BulkAll method to insert records batchwiseinto Elasticsearch via C#. When I am disconnecting the Elastic Service during the insert operation I don't see the failed items … --- ## [Importing and querying against a list](https://discuss.elastic.co/t/importing-and-querying-against-a-list/301896)
**Author:** [@chin1](https://discuss.elastic.co/u/chin1)\ **Replies:** 1\ **Last updated:** [April 28, 2022, 10:35am UTC](https://discuss.elastic.co/t/importing-and-querying-against-a-list/301896 "2022-04-28T10:35:09Z")
Hey, i'm trying to query against a large list, so apposed to copying and pasting data in KQL, and running something user: ("name","name2","name3") Is there away of importing that list and making it into a variable? the… --- ## [How to compare two aggregations (Apr 2022)](https://discuss.elastic.co/t/how-to-compare-two-aggregations-apr-2022/303480)
**Author:** [@jurisn](https://discuss.elastic.co/u/jurisn)\ **Replies:** 0\ **Last updated:** [April 28, 2022, 8:39am UTC](https://discuss.elastic.co/t/how-to-compare-two-aggregations-apr-2022/303480 "2022-04-28T08:39:24Z")
Three years ago I asked the question: How to compare two aggregations Hi, I have list for 24 hour period: PC1 PC2 PC3 PC4 I have list for 1 hour period: PC3 PC4 as result I will receive such list: PC1 PC2 Do… --- ## [Kibana dashboard with "message" filter as a user input](https://discuss.elastic.co/t/kibana-dashboard-with-message-filter-as-a-user-input/303408)
**Author:** [@melkamar](https://discuss.elastic.co/u/melkamar)\ **Replies:** 2\ **Last updated:** [April 28, 2022, 8:39am UTC](https://discuss.elastic.co/t/kibana-dashboard-with-message-filter-as-a-user-input/303408 "2022-04-28T08:39:32Z")
Hi! I am in the process of setting up Filebeat-based monitoring of our Kubernetes workloads' logs. For starters, I want to have a simple page where devs and PMs can go to to view the logs ingested from our deployments. I… --- ## [Lifecycling of rollup index](https://discuss.elastic.co/t/lifecycling-of-rollup-index/303167)
**Author:** [@sandeepmuthathi](https://discuss.elastic.co/u/sandeepmuthathi)\ **Replies:** 8\ **Last updated:** [April 28, 2022, 8:38am UTC](https://discuss.elastic.co/t/lifecycling-of-rollup-index/303167 "2022-04-28T08:38:46Z")
I would want to lifecycle the rollup index. Is there any way we can do it? --- ## [Kibana gauge visualization](https://discuss.elastic.co/t/kibana-gauge-visualization/303244)
**Author:** [@wagnar](https://discuss.elastic.co/u/wagnar)\ **Replies:** 2\ **Last updated:** [April 28, 2022, 8:25am UTC](https://discuss.elastic.co/t/kibana-gauge-visualization/303244 "2022-04-28T08:25:58Z")
I am trying to achieve one usecase, i want to see the sales per country vs targeted sales for that particular country with the help of guage chart. But I'm not able to see add the targeted value for each country. |Count… --- ## [Ruby Script to rename fields base on a dictionary](https://discuss.elastic.co/t/ruby-script-to-rename-fields-base-on-a-dictionary/303413)
**Author:** [@frank\_esg](https://discuss.elastic.co/u/frank_esg)\ **Replies:** 4\ **Last updated:** [April 28, 2022, 8:23am UTC](https://discuss.elastic.co/t/ruby-script-to-rename-fields-base-on-a-dictionary/303413 "2022-04-28T08:23:27Z")
Hello, we use in a logstash pipeline an external ruby script which contains several methods to process logfiles. now we want to add a new method to rename all top level fields of a document based on a hashtable. I hav… [Previous page](https://discuss.elastic.co/latest.md?page=1152) [Next page](https://discuss.elastic.co/latest.md?page=1154)