# Latest **URL:** https://discuss.elastic.co/latest.md?page=1154 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1155 --- ## [Java Client API: FieldValue vs JsonData](https://discuss.elastic.co/t/java-client-api-fieldvalue-vs-jsondata/303476)
**Author:** [@sbrunot](https://discuss.elastic.co/u/sbrunot)\ **Replies:** 0\ **Last updated:** [April 28, 2022, 8:04am UTC](https://discuss.elastic.co/t/java-client-api-fieldvalue-vs-jsondata/303476 "2022-04-28T08:04:32Z")
Hello, with the new Java Client API, some queries takes a FieldValue parameter (exemple: term query) and some other takes a JsonData parameter (exemple: range queries). One issue that I have with FieldValue parameters … --- ## [Failed to retrieve password hash for reserved user \[elastic\]](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-elastic/303475)
**Author:** [@Balaji\_Arumugam](https://discuss.elastic.co/u/Balaji_Arumugam)\ **Replies:** 2\ **Last updated:** [April 28, 2022, 7:57am UTC](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-elastic/303475 "2022-04-28T07:57:41Z")
Hi Team, We have facing an issue while we start the Elasticsearch master node with the following errors \[2022-04-28T07:40:11,318\]\[INFO \]\[o.e.x.s.a.AuthenticationService\] \[master\] Authentication of \[elastic\] was termina… --- ## [Access to elasticsearch host from kibana in other host](https://discuss.elastic.co/t/access-to-elasticsearch-host-from-kibana-in-other-host/303353)
**Author:** [@Firas\_Bougrine](https://discuss.elastic.co/u/Firas_Bougrine)\ **Replies:** 8\ **Last updated:** [April 28, 2022, 7:43am UTC](https://discuss.elastic.co/t/access-to-elasticsearch-host-from-kibana-in-other-host/303353 "2022-04-28T07:43:09Z")
hi I can't access to Elasticsearch host from kibana host , i tested this command and it not work this cmd : curl -XGET es-ip-or-hostname:9200/ , the response of the command : kibana@kibana:~$ curl -XGET 172.19.14.67:9… --- ## [Authenticate using google firebase](https://discuss.elastic.co/t/authenticate-using-google-firebase/303469)
**Author:** [@Krishna\_Teja](https://discuss.elastic.co/u/Krishna_Teja)\ **Replies:** 0\ **Last updated:** [April 28, 2022, 6:57am UTC](https://discuss.elastic.co/t/authenticate-using-google-firebase/303469 "2022-04-28T06:57:09Z")
Hi I am working on an app that needs user to login to kibana using GCP firebase as my application runs on GCP and users are already imported to firebase. I was considering to use SAML method. There are a few issues I ne… --- ## [Issue with multiple instances of the same token](https://discuss.elastic.co/t/issue-with-multiple-instances-of-the-same-token/303467)
**Author:** [@dishant.sharma](https://discuss.elastic.co/u/dishant.sharma)\ **Replies:** 0\ **Last updated:** [April 28, 2022, 6:43am UTC](https://discuss.elastic.co/t/issue-with-multiple-instances-of-the-same-token/303467 "2022-04-28T06:43:34Z")
I am getting a token multiple times after the analysis process. I am using the pattern token filter and using different regexes with different instances of token filter on the same input string. In some cases, I'm gettin… --- ## [Term Aggregation on sorted data](https://discuss.elastic.co/t/term-aggregation-on-sorted-data/303361)
**Author:** [@dev\_test](https://discuss.elastic.co/u/dev_test)\ **Replies:** 2\ **Last updated:** [April 28, 2022, 6:36am UTC](https://discuss.elastic.co/t/term-aggregation-on-sorted-data/303361 "2022-04-28T06:36:58Z")
Hi, i want to run some term aggregations on sorted data and i want these changes to be reflected inside the buckets. Suppose i have an order\_id field inside my document. I query over the index with size 0, while sort m… --- ## [High CPU, search intensive indices, course of action?](https://discuss.elastic.co/t/high-cpu-search-intensive-indices-course-of-action/303431)
**Author:** [@hunsw](https://discuss.elastic.co/u/hunsw)\ **Replies:** 2\ **Last updated:** [April 28, 2022, 6:15am UTC](https://discuss.elastic.co/t/high-cpu-search-intensive-indices-course-of-action/303431 "2022-04-28T06:15:22Z")
I have a 7.17 cluster with 6 data nodes. There's a website using this ES cluster with a dashboard that customers are constantly querying... It has data for the last 2 months exceeding 300 GB in only 2 indices (2 pri, 1 … --- ## [Match two tags in same time (not one at the time)](https://discuss.elastic.co/t/match-two-tags-in-same-time-not-one-at-the-time/303438)
**Author:** [@eugenci](https://discuss.elastic.co/u/eugenci)\ **Replies:** 2\ **Last updated:** [April 28, 2022, 4:05am UTC](https://discuss.elastic.co/t/match-two-tags-in-same-time-not-one-at-the-time/303438 "2022-04-28T04:05:20Z")
I folders index with following mapping: { "mappings": { "\_doc": { "properties": { "tags": { "type": "nested", "properties": { "bg\_color": { "type": "keyw… --- ## [如何将data节点中的node目录（包含源数据）恢复至新的es集群中。](https://discuss.elastic.co/t/data-node-es/303455)
**Author:** [@joh-zhang](https://discuss.elastic.co/u/joh-zhang)\ **Replies:** 0\ **Last updated:** [April 28, 2022, 3:02am UTC](https://discuss.elastic.co/t/data-node-es/303455 "2022-04-28T03:02:27Z")
我用ECK（Elasticsearch7.7.0）部署了3个master节点，3个data节点。由于特殊原因，现在我只有3个data节点的node目录中的数据，我应该如何恢复至新的集群中？ 我尝试使用将3个node目录分别存储在新建的3个master节点的data目录中，但是master节点启动时报错如图 我应该如何操作？ --- ## [Failed to authenticate user \[elastic\] after changing environment](https://discuss.elastic.co/t/failed-to-authenticate-user-elastic-after-changing-environment/303319)
**Author:** [@Jasper\_Tan](https://discuss.elastic.co/u/Jasper_Tan)\ **Replies:** 5\ **Last updated:** [April 28, 2022, 2:26am UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-elastic-after-changing-environment/303319 "2022-04-28T02:26:58Z")
I am aware that there are multiple post on this issue already but my situation is kinda unique. Back story: I have provisioned a VM on an offline server with Elasticsearch, Logstash and Kibana running fine on it for the… --- ## [Stack Monitoring with elastic agent / fleet?](https://discuss.elastic.co/t/stack-monitoring-with-elastic-agent-fleet/303266)
**Author:** [@gabrielfsousa](https://discuss.elastic.co/u/gabrielfsousa)\ **Replies:** 1\ **Last updated:** [April 28, 2022, 2:19am UTC](https://discuss.elastic.co/t/stack-monitoring-with-elastic-agent-fleet/303266 "2022-04-28T02:19:29Z")
Can we Stack Monitoring with elastic agent / fleet ? --- ## [How to reindex data from 5 to six to upgrade ES to 7](https://discuss.elastic.co/t/how-to-reindex-data-from-5-to-six-to-upgrade-es-to-7/303386)
**Author:** [@sameer\_khamkar](https://discuss.elastic.co/u/sameer_khamkar)\ **Replies:** 1\ **Last updated:** [April 28, 2022, 12:56am UTC](https://discuss.elastic.co/t/how-to-reindex-data-from-5-to-six-to-upgrade-es-to-7/303386 "2022-04-28T00:56:18Z")
I want to do reindex data which is created in version 5 to version 6 so that we can upgrade ES to version 7 so we are following below curl 'localhost:9200/\_cat/indices?v' -- list all curl -X PUT "localhost:9200/my\_… --- ## [Kibana HeatMap Layer not displaying](https://discuss.elastic.co/t/kibana-heatmap-layer-not-displaying/303288)
**Author:** [@Alessandro\_Agnello](https://discuss.elastic.co/u/Alessandro_Agnello)\ **Replies:** 4\ **Last updated:** [April 27, 2022, 10:55pm UTC](https://discuss.elastic.co/t/kibana-heatmap-layer-not-displaying/303288 "2022-04-27T22:55:49Z")
I have tried with version 8.1.2 and upgraded to 8.1.3, I cannot get any heat maps to work. I do have it working for Documents Layer type without any problems. Thanks --- ## [How to send data Weblogic exporter data to logstash](https://discuss.elastic.co/t/how-to-send-data-weblogic-exporter-data-to-logstash/303399)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 1\ **Last updated:** [April 27, 2022, 10:28pm UTC](https://discuss.elastic.co/t/how-to-send-data-weblogic-exporter-data-to-logstash/303399 "2022-04-27T22:28:43Z")
Hello team, We need to send data from Weblogic exporter to logstash is there any wat to send data to logstash. We don't want to send data directly to Elasticsearch. --- ## [Elastic Search v7.17.1 Alias Filtering Performance Issues](https://discuss.elastic.co/t/elastic-search-v7-17-1-alias-filtering-performance-issues/303443)
**Author:** [@mma1](https://discuss.elastic.co/u/mma1)\ **Replies:** 1\ **Last updated:** [April 27, 2022, 9:53pm UTC](https://discuss.elastic.co/t/elastic-search-v7-17-1-alias-filtering-performance-issues/303443 "2022-04-27T21:53:28Z")
Hello, I have recently started using alias filtering with our application and have seen some performance issues. I am using elastic v7.17.1 on a 12 node cluster. The alias looks like the following (the array in terms c… --- ## [Multiple clusters in elastic search](https://discuss.elastic.co/t/multiple-clusters-in-elastic-search/303383)
**Author:** [@sairaj\_dessai](https://discuss.elastic.co/u/sairaj_dessai)\ **Replies:** 1\ **Last updated:** [April 27, 2022, 9:43pm UTC](https://discuss.elastic.co/t/multiple-clusters-in-elastic-search/303383 "2022-04-27T21:43:01Z")
How to create multiple clusters in a single windows machine. Also how to insert , select , update , delete records from multiple clusters. As of now I tried to run 2 Elasticsearch on single server and changed yaml file s… --- ## [NLP models on Elastic 8 Cloud](https://discuss.elastic.co/t/nlp-models-on-elastic-8-cloud/303199)
**Author:** [@Wonder\_Garance](https://discuss.elastic.co/u/Wonder_Garance)\ **Replies:** 3\ **Last updated:** [April 27, 2022, 9:31pm UTC](https://discuss.elastic.co/t/nlp-models-on-elastic-8-cloud/303199 "2022-04-27T21:31:46Z")
Hello, I started a free 14-days trial of Elastic 8 Cloud, to test NLP models. On this page Third party NLP models | Machine Learning in the Elastic Stack \[8.1\] | Elastic there are a lot of models, I just tried sentence-… --- ## [Getting permission denied error after changing data directory for logstash](https://discuss.elastic.co/t/getting-permission-denied-error-after-changing-data-directory-for-logstash/303426)
**Author:** [@cool999](https://discuss.elastic.co/u/cool999)\ **Replies:** 8\ **Last updated:** [April 27, 2022, 6:43pm UTC](https://discuss.elastic.co/t/getting-permission-denied-error-after-changing-data-directory-for-logstash/303426 "2022-04-27T18:43:29Z")
Hi Team, I am getting permission denied error after changing path.data and path.logs in logstash to new path. Same issue is happening for kibana. However for Elasticsearch it is working, i can see elasticsearch folder… --- ## [Parse xml entry with logstash and create a new field with the data](https://discuss.elastic.co/t/parse-xml-entry-with-logstash-and-create-a-new-field-with-the-data/302262)
**Author:** [@Rohit\_Goel1](https://discuss.elastic.co/u/Rohit_Goel1)\ **Replies:** 32\ **Last updated:** [April 27, 2022, 5:52pm UTC](https://discuss.elastic.co/t/parse-xml-entry-with-logstash-and-create-a-new-field-with-the-data/302262 "2022-04-27T17:52:13Z")
I need to parse below xml file with logstash and filter out status and create a new field with its value. below is the sample xml file: \ \ \SUCCESS\ \ I… --- ## [Winlogbeat experimental api missmatch between paresed fields and rendered event](https://discuss.elastic.co/t/winlogbeat-experimental-api-missmatch-between-paresed-fields-and-rendered-event/303388)
**Author:** [@SH\_HSOC](https://discuss.elastic.co/u/SH_HSOC)\ **Replies:** 4\ **Last updated:** [April 27, 2022, 5:18pm UTC](https://discuss.elastic.co/t/winlogbeat-experimental-api-missmatch-between-paresed-fields-and-rendered-event/303388 "2022-04-27T17:18:49Z")
Hi folks, in Winlogbeat I recently switched from the default windows event log API to the experimental one, because winlogbeat was capping out at roughly 1800 events per second and our Windows event collector getting a … --- ## [Ngram behavior vs wildcard field type](https://discuss.elastic.co/t/ngram-behavior-vs-wildcard-field-type/302762)
**Author:** [@maratusa](https://discuss.elastic.co/u/maratusa)\ **Replies:** 7\ **Last updated:** [April 27, 2022, 4:45pm UTC](https://discuss.elastic.co/t/ngram-behavior-vs-wildcard-field-type/302762 "2022-04-27T16:45:33Z")
Hi, Please help me understand n-gram and wildcard field type behaviors. I am working on an application that offers a search by phone number. It will be a contain search. e.g. search for phone number containing "234890"… --- ## [Logstash Deprecation log JSON Format](https://discuss.elastic.co/t/logstash-deprecation-log-json-format/303155)
**Author:** [@hunsw](https://discuss.elastic.co/u/hunsw)\ **Replies:** 2\ **Last updated:** [April 27, 2022, 4:14pm UTC](https://discuss.elastic.co/t/logstash-deprecation-log-json-format/303155 "2022-04-27T16:14:08Z")
Is it possible to configure the deprecation logs of Logstash as JSON entries? log.format: json works fine for the 'normal' logs, but not for deprecation ones. I've checked log4j2.properties and it seems that some kind … --- ## [Split document into multiple documents](https://discuss.elastic.co/t/split-document-into-multiple-documents/303305)
**Author:** [@ciavam](https://discuss.elastic.co/u/ciavam)\ **Replies:** 12\ **Last updated:** [April 27, 2022, 3:47pm UTC](https://discuss.elastic.co/t/split-document-into-multiple-documents/303305 "2022-04-27T15:47:16Z")
Hello, Through the logstash code I was able to get a result like: {field0 = value field1 = \[value1\_field1; value1\_field1\] field2 = \[value1\_field2; value2\_field2\] } Is it possible through logstash to go to what is w… --- ## [Logstash split filter does not work with match\_only\_text type](https://discuss.elastic.co/t/logstash-split-filter-does-not-work-with-match-only-text-type/303357)
**Author:** [@fgjensen](https://discuss.elastic.co/u/fgjensen)\ **Replies:** 2\ **Last updated:** [April 27, 2022, 2:56pm UTC](https://discuss.elastic.co/t/logstash-split-filter-does-not-work-with-match-only-text-type/303357 "2022-04-27T14:56:18Z")
Dear Community, We use heartbeat to collect http response from some services. The response format is a JSON array and the array is returned in the http.request.body.content field and http.request.body.content.text field… --- ## [Filebeat HAProxy module does not parse tcplog format](https://discuss.elastic.co/t/filebeat-haproxy-module-does-not-parse-tcplog-format/303422)
**Author:** [@CaptAintHere](https://discuss.elastic.co/u/CaptAintHere)\ **Replies:** 0\ **Last updated:** [April 27, 2022, 2:55pm UTC](https://discuss.elastic.co/t/filebeat-haproxy-module-does-not-parse-tcplog-format/303422 "2022-04-27T14:55:18Z")
Hi, I'm trying to use the HAProxy module of Filebeat with a TCP frontend in HAProxy but the grok does not seem to work with the log lines generated by the option tcplog of HAProxy. This GitHub issue mentions that the o… --- ## [Best practices on generating queries with SDK vs storing queries as files](https://discuss.elastic.co/t/best-practices-on-generating-queries-with-sdk-vs-storing-queries-as-files/303328)
**Author:** [@darrenoc3](https://discuss.elastic.co/u/darrenoc3)\ **Replies:** 2\ **Last updated:** [April 27, 2022, 2:05pm UTC](https://discuss.elastic.co/t/best-practices-on-generating-queries-with-sdk-vs-storing-queries-as-files/303328 "2022-04-27T14:05:24Z")
Hi there, I was wondering what the communities opinion was on best practices for generating queries in a complex application. For our date histogram queries we have tried both: Store DSL queries as text files, use str… --- ## [Default values for missing fields](https://discuss.elastic.co/t/default-values-for-missing-fields/303333)
**Author:** [@tfinan](https://discuss.elastic.co/u/tfinan)\ **Replies:** 6\ **Last updated:** [April 27, 2022, 1:47pm UTC](https://discuss.elastic.co/t/default-values-for-missing-fields/303333 "2022-04-27T13:47:00Z")
Can I create a field in a mapping that will be indexed with some default value if that field is not present in the document being indexed? In other words, if I have a mapping with the field {"Rating": "integer"}, and th… --- ## [Replace value from one field in another field using an Elasticsearch Ingest Pipeline](https://discuss.elastic.co/t/replace-value-from-one-field-in-another-field-using-an-elasticsearch-ingest-pipeline/302963)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 3\ **Last updated:** [April 27, 2022, 1:27pm UTC](https://discuss.elastic.co/t/replace-value-from-one-field-in-another-field-using-an-elasticsearch-ingest-pipeline/302963 "2022-04-27T13:27:03Z")
I need to remove a substring contained in one field from another field. However, I don't seem to be able to use the gsub or grok processors to accomplish this. E.g., I have the following fields: { "foo": "foo", … --- ## [Filebeat Harvester not starting](https://discuss.elastic.co/t/filebeat-harvester-not-starting/302891)
**Author:** [@Bhanu\_Praveen](https://discuss.elastic.co/u/Bhanu_Praveen)\ **Replies:** 3\ **Last updated:** [April 27, 2022, 1:05pm UTC](https://discuss.elastic.co/t/filebeat-harvester-not-starting/302891 "2022-04-27T13:05:36Z")
Hello, We have installed Filebeat on docker container connecting to logstah on linux server. It was working fine till a week back. AWS machine got restarted and post that, logstash is not harvesting new files. Harvester… --- ## [Parse Mcafee audit log file with Logstash](https://discuss.elastic.co/t/parse-mcafee-audit-log-file-with-logstash/302946)
**Author:** [@Xor44](https://discuss.elastic.co/u/Xor44)\ **Replies:** 4\ **Last updated:** [April 27, 2022, 12:46pm UTC](https://discuss.elastic.co/t/parse-mcafee-audit-log-file-with-logstash/302946 "2022-04-27T12:46:59Z")
Hi Folks , I need your help to find a right way to parse this non-structured file \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ Timestamp : 19/Apr/2022:05:50:02.771 +0200 User … [Previous page](https://discuss.elastic.co/latest.md?page=1153) [Next page](https://discuss.elastic.co/latest.md?page=1155)