# Latest **URL:** https://discuss.elastic.co/latest.md?page=1184 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1185 --- ## [Error creating new field with the valu of a nested field](https://discuss.elastic.co/t/error-creating-new-field-with-the-valu-of-a-nested-field/301505)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 3\ **Last updated:** [April 5, 2022, 5:13pm UTC](https://discuss.elastic.co/t/error-creating-new-field-with-the-valu-of-a-nested-field/301505 "2022-04-05T17:13:26Z")
Hello! im reciving a json with the next format: "field": \[ { "context": "CONTEXTLESS", "value": "x", "key": "subfield1" }, { "context": "CONTEXTLESS", "valu… --- ## [Pipeline/output.go:180 failed to publish events: temporary bulk send failure](https://discuss.elastic.co/t/pipeline-output-go-180-failed-to-publish-events-temporary-bulk-send-failure/299453)
**Author:** [@anubisg1](https://discuss.elastic.co/u/anubisg1)\ **Replies:** 6\ **Last updated:** [April 5, 2022, 4:58pm UTC](https://discuss.elastic.co/t/pipeline-output-go-180-failed-to-publish-events-temporary-bulk-send-failure/299453 "2022-04-05T16:58:00Z")
i have defined the following pipeline called "suzieq" and tested it against 2 documents PUT \_ingest/pipeline/suzieq { "version": 2, "processors": \[ { "dissect": { "field": "message", "patte… --- ## [I am trying to uninstall elastic search MSI but can't find the elasticsearch-service.bat file](https://discuss.elastic.co/t/i-am-trying-to-uninstall-elastic-search-msi-but-cant-find-the-elasticsearch-service-bat-file/301447)
**Author:** [@Pierre\_Abi\_Chedid](https://discuss.elastic.co/u/Pierre_Abi_Chedid)\ **Replies:** 4\ **Last updated:** [April 5, 2022, 3:45pm UTC](https://discuss.elastic.co/t/i-am-trying-to-uninstall-elastic-search-msi-but-cant-find-the-elasticsearch-service-bat-file/301447 "2022-04-05T15:45:31Z")
Hello, I have been trying to install Elasticsearch using the msi version: https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.10.0.msi But I have been encountering problems with setting up the passwor… --- ## [Elasticsearch 8.1.1 error](https://discuss.elastic.co/t/elasticsearch-8-1-1-error/301126)
**Author:** [@andrewm659](https://discuss.elastic.co/u/andrewm659)\ **Replies:** 9\ **Last updated:** [April 5, 2022, 2:41pm UTC](https://discuss.elastic.co/t/elasticsearch-8-1-1-error/301126 "2022-04-05T14:41:29Z")
I am trying to upgrade from 7.17.1 to 8.1.1 and getting the following error on RHEL 7.x latest with Java 17 from RHEL: \[2022-03-30T11:51:49,898\]\[INFO \]\[o.e.n.Node \] \[elasticsearch01.internaldomain.com\] ver… --- ## [Logstash pipeline to pipeline - send\_to field variable](https://discuss.elastic.co/t/logstash-pipeline-to-pipeline-send-to-field-variable/301625)
**Author:** [@ahmed\_charafouddine](https://discuss.elastic.co/u/ahmed_charafouddine)\ **Replies:** 2\ **Last updated:** [April 5, 2022, 2:10pm UTC](https://discuss.elastic.co/t/logstash-pipeline-to-pipeline-send-to-field-variable/301625 "2022-04-05T14:10:30Z")
Hello, I am working on the use of pipeline-to-pipeline. I wanted to value a variable and then use it in send\_to of the pipeline plugin. idea to avoid the use of several if..else conditions which surely have an impact o… --- ## [Connection timeout when resthighlevel client is called from spark mapPartitions method](https://discuss.elastic.co/t/connection-timeout-when-resthighlevel-client-is-called-from-spark-mappartitions-method/301492)
**Author:** [@vinayak\_j](https://discuss.elastic.co/u/vinayak_j)\ **Replies:** 3\ **Last updated:** [April 5, 2022, 1:56pm UTC](https://discuss.elastic.co/t/connection-timeout-when-resthighlevel-client-is-called-from-spark-mappartitions-method/301492 "2022-04-05T13:56:07Z")
Hi Team, We are getting "Connection timed out " while connecting to elastic cluster \[setup on GCP\] through resthighlevel client from spark mapPartitions() \[using dataproc\]. We are using Elasticsearch for lookup; basica… --- ## [Continuous display of time difference](https://discuss.elastic.co/t/continuous-display-of-time-difference/301645)
**Author:** [@santy1](https://discuss.elastic.co/u/santy1)\ **Replies:** 0\ **Last updated:** [April 5, 2022, 1:48pm UTC](https://discuss.elastic.co/t/continuous-display-of-time-difference/301645 "2022-04-05T13:48:02Z")
Hello Team, I have 2 events , START and END, and using elapsed filter I am able to calculate the time difference and display it in Kibana using Metric chart. However, the END event occurs after 3 to 4 hours, and for th… --- ## [Harvester could not be started on existing file due to registry already stopped](https://discuss.elastic.co/t/harvester-could-not-be-started-on-existing-file-due-to-registry-already-stopped/301644)
**Author:** [@mhadidg](https://discuss.elastic.co/u/mhadidg)\ **Replies:** 0\ **Last updated:** [April 5, 2022, 1:47pm UTC](https://discuss.elastic.co/t/harvester-could-not-be-started-on-existing-file-due-to-registry-already-stopped/301644 "2022-04-05T13:47:51Z")
After deploying Elasticsearch, Kibana with FileBeat version 8.1.2 in a Kubernetes Cluster, I've noticed the following error message coming over and over: Harvester could not be started on existing file: /var/log/contain… --- ## [Parse json with filebeat and send to logstash](https://discuss.elastic.co/t/parse-json-with-filebeat-and-send-to-logstash/301643)
**Author:** [@aviad.co1](https://discuss.elastic.co/u/aviad.co1)\ **Replies:** 0\ **Last updated:** [April 5, 2022, 1:35pm UTC](https://discuss.elastic.co/t/parse-json-with-filebeat-and-send-to-logstash/301643 "2022-04-05T13:35:56Z")
Hi, I have the following json : \[{"nqdf": 24, "qqqf": 34}\] and I try to send him to logstash. this is my filebeat.yml : type: log enabled: true paths: C:\\beats\\jsonfiles\*.json json.keys\_under\_root: true json.me… --- ## [Cisco Umbrella logs ingestion - Elastic Cloud](https://discuss.elastic.co/t/cisco-umbrella-logs-ingestion-elastic-cloud/301530)
**Author:** [@misiel](https://discuss.elastic.co/u/misiel)\ **Replies:** 4\ **Last updated:** [April 5, 2022, 1:21pm UTC](https://discuss.elastic.co/t/cisco-umbrella-logs-ingestion-elastic-cloud/301530 "2022-04-05T13:21:02Z")
Hello I started Elastic Cloud service trial period. I want to ingest Cisco Umbrella logs using Cisco Umbrella integration. Documentation says, that I have to install Elastic Agent in order to ship the logs (logs from se… --- ## [Integración en pagina web](https://discuss.elastic.co/t/integracion-en-pagina-web/301518)
**Author:** [@Jaime\_Alvarez\_Medina](https://discuss.elastic.co/u/Jaime_Alvarez_Medina)\ **Replies:** 1\ **Last updated:** [April 5, 2022, 1:08pm UTC](https://discuss.elastic.co/t/integracion-en-pagina-web/301518 "2022-04-05T13:08:39Z")
Hola, necesito integrar una pagina web con Kibana en mi pagina web, pero no se como hacerlo con javascript o php, ¿alguien lo sabe?, todo lo que he encontrado es la transferencia de datos --- ## [Filebeat not reading logs 🤨](https://discuss.elastic.co/t/filebeat-not-reading-logs/301242)
**Author:** [@Tellz](https://discuss.elastic.co/u/Tellz)\ **Replies:** 1\ **Last updated:** [April 5, 2022, 12:47pm UTC](https://discuss.elastic.co/t/filebeat-not-reading-logs/301242 "2022-04-05T12:47:29Z")
Hi, I have a Kubernetes cluster, where in pods I should read logs of one application (Airflow) located in such structure: /usr/local/airflow/logs/{jobname}/{jobname}/{timestamp}/1.log (example: /usr/local/airflow/logs/so… --- ## [How can I debug result score](https://discuss.elastic.co/t/how-can-i-debug-result-score/301637)
**Author:** [@Tyranwyn](https://discuss.elastic.co/u/Tyranwyn)\ **Replies:** 0\ **Last updated:** [April 5, 2022, 12:46pm UTC](https://discuss.elastic.co/t/how-can-i-debug-result-score/301637 "2022-04-05T12:46:14Z")
I would like to debug the query result score. I'm doing the query "24" in a meta engine consisting of 2 source engines. I'm getting results back that should be scored equally, but aren't and I can't tell how they would b… --- ## [Query syntax?](https://discuss.elastic.co/t/query-syntax/301628)
**Author:** [@jze1](https://discuss.elastic.co/u/jze1)\ **Replies:** 1\ **Last updated:** [April 5, 2022, 12:40pm UTC](https://discuss.elastic.co/t/query-syntax/301628 "2022-04-05T12:40:01Z")
Hello, I need to extract certain records from logs and make some grouping based on some fields. It requires that a substring based on regexp is extracted from one of the fields to allow grouping. After some googling I … --- ## [Does metricbeat Redis output support Redis Stream?](https://discuss.elastic.co/t/does-metricbeat-redis-output-support-redis-stream/301634)
**Author:** [@AMBUJ\_DUBEY](https://discuss.elastic.co/u/AMBUJ_DUBEY)\ **Replies:** 1\ **Last updated:** [April 5, 2022, 12:39pm UTC](https://discuss.elastic.co/t/does-metricbeat-redis-output-support-redis-stream/301634 "2022-04-05T12:39:31Z")
The above link says that we can use Redis as an output for metricbeat. But it seems the Redis stream is not supported. Configure the Redis output | Metricbeat Reference \[8.1\] | Elastic Please confirm if we can use Re… --- ## [Painless Script not giving desired output](https://discuss.elastic.co/t/painless-script-not-giving-desired-output/301615)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 11\ **Last updated:** [April 5, 2022, 12:24pm UTC](https://discuss.elastic.co/t/painless-script-not-giving-desired-output/301615 "2022-04-05T12:24:31Z")
Hello, I want to create an additional field in index having combined values of mount point and hostname. ex: /dev/run vxw001m001, / vas002m002 .... when tried to create scripted field in index patter in kibana,gett… --- ## [Fix for CVE-2021-27568 in 8.1.2](https://discuss.elastic.co/t/fix-for-cve-2021-27568-in-8-1-2/301417)
**Author:** [@Fleming7612](https://discuss.elastic.co/u/Fleming7612)\ **Replies:** 1\ **Last updated:** [April 5, 2022, 12:06pm UTC](https://discuss.elastic.co/t/fix-for-cve-2021-27568-in-8-1-2/301417 "2022-04-05T12:06:01Z")
Hi there, There is a critical vulnerability CVE-2021-27568 found in Elasticsearch 8.1.2 image from docker hub. Any suggestion we can fix this issue? Thank you very much --- ## [MultiSearch Indexes different mapping](https://discuss.elastic.co/t/multisearch-indexes-different-mapping/301559)
**Author:** [@RabBit\_BR](https://discuss.elastic.co/u/RabBit_BR)\ **Replies:** 2\ **Last updated:** [April 5, 2022, 11:57am UTC](https://discuss.elastic.co/t/multisearch-indexes-different-mapping/301559 "2022-04-05T11:57:07Z")
Has anyone ever used a search strategy on more than one index? In my case I have different indexes, like a product index and a community index, both with different mappings. In tests using the same alias for both, sort… --- ## [How can I reduce the number of master candidate nodes from 3 to 1?](https://discuss.elastic.co/t/how-can-i-reduce-the-number-of-master-candidate-nodes-from-3-to-1/301612)
**Author:** [@hyungsun\_lim](https://discuss.elastic.co/u/hyungsun_lim)\ **Replies:** 1\ **Last updated:** [April 5, 2022, 11:31am UTC](https://discuss.elastic.co/t/how-can-i-reduce-the-number-of-master-candidate-nodes-from-3-to-1/301612 "2022-04-05T11:31:22Z")
There are a total of 4 nodes, of which 3 are master candidate nodes. I would like to specify one master candidate node for testing, but the operation does not proceed with the error below. "\[2019-06-19T20:16:12,366\]\[WA… --- ## [Thinking out loud, I have a large disk enclosure and want to use it for Elastic](https://discuss.elastic.co/t/thinking-out-loud-i-have-a-large-disk-enclosure-and-want-to-use-it-for-elastic/300681)
**Author:** [@UPPERCASE](https://discuss.elastic.co/u/UPPERCASE)\ **Replies:** 1\ **Last updated:** [April 5, 2022, 11:26am UTC](https://discuss.elastic.co/t/thinking-out-loud-i-have-a-large-disk-enclosure-and-want-to-use-it-for-elastic/300681 "2022-04-05T11:26:24Z")
I've got a 84x 16Tb in a disk enclosure that can be attached with SAS, all details can be read here. This is not a disk array, so it doesn't have its own cache, hardware RAID controller or ways to export the data via e.g… --- ## [Http.max\_content\_length update on cluster](https://discuss.elastic.co/t/http-max-content-length-update-on-cluster/301476)
**Author:** [@gerasimysys](https://discuss.elastic.co/u/gerasimysys)\ **Replies:** 4\ **Last updated:** [April 5, 2022, 11:19am UTC](https://discuss.elastic.co/t/http-max-content-length-update-on-cluster/301476 "2022-04-05T11:19:24Z")
Hello. On the logstash, have error \[ERROR\]\[logstash.outputs.elasticsearch\]\[main\]\[4662344eb1eeab4baf336e2996a14ddadf8c61b8943c6e31c68cb582d77f72de\] Encountered a retryable error (will retry with exponential ba ckoff) {:… --- ## [Disable security or change password on elastic and kibana](https://discuss.elastic.co/t/disable-security-or-change-password-on-elastic-and-kibana/301536)
**Author:** [@The-morpho](https://discuss.elastic.co/u/The-morpho)\ **Replies:** 4\ **Last updated:** [April 5, 2022, 11:17am UTC](https://discuss.elastic.co/t/disable-security-or-change-password-on-elastic-and-kibana/301536 "2022-04-05T11:17:53Z")
Hello i'am new with elastic stack. I followed this documentation bellow in order to enable security, i set a password with only number. I found the problem when i wanted to login in kibana . image|690x33 This is th… --- ## [Persistent queue back pressure](https://discuss.elastic.co/t/persistent-queue-back-pressure/301570)
**Author:** [@Ahmad\_Manzoor](https://discuss.elastic.co/u/Ahmad_Manzoor)\ **Replies:** 0\ **Last updated:** [April 5, 2022, 12:26am UTC](https://discuss.elastic.co/t/persistent-queue-back-pressure/301570 "2022-04-05T00:26:50Z")
I am using logstash with jdbc input plugin and elastic app search output plugin. I have around 9,600,000 records. Out of which around 8,700,000 records are successfully uploaded to app search but remaining are pending si… --- ## [Update a variable in a scripted field definition](https://discuss.elastic.co/t/update-a-variable-in-a-scripted-field-definition/301350)
**Author:** [@uncleAlbert](https://discuss.elastic.co/u/uncleAlbert)\ **Replies:** 5\ **Last updated:** [April 5, 2022, 10:57am UTC](https://discuss.elastic.co/t/update-a-variable-in-a-scripted-field-definition/301350 "2022-04-05T10:57:10Z")
Is there a way to update a variable within a scripted field in Kibana? Say I had the following scripted field. MAP car \["bob":"toyota"\]; if (car.containsKey(doc\["owner"\].value)){ return car.get(doc\["owner"\].value); … --- ## [Elasticsearch-service.bat start (from GUI) fails](https://discuss.elastic.co/t/elasticsearch-service-bat-start-from-gui-fails/301521)
**Author:** [@Foggie](https://discuss.elastic.co/u/Foggie)\ **Replies:** 3\ **Last updated:** [April 5, 2022, 10:49am UTC](https://discuss.elastic.co/t/elasticsearch-service-bat-start-from-gui-fails/301521 "2022-04-05T10:49:06Z")
Trying to use Elasticsearch 7.17.1 as a service on a Windows Server 2016. I run Elasticsearch-service manager and press Start from the GUI. After a short while it stops. here is the debug log: \< \[2022-04-04 14:17:33\]… --- ## [Elasticsearch search document with nested document with optional fields](https://discuss.elastic.co/t/elasticsearch-search-document-with-nested-document-with-optional-fields/301604)
**Author:** [@kemot90](https://discuss.elastic.co/u/kemot90)\ **Replies:** 2\ **Last updated:** [April 5, 2022, 10:21am UTC](https://discuss.elastic.co/t/elasticsearch-search-document-with-nested-document-with-optional-fields/301604 "2022-04-05T10:21:03Z")
I try to create query for nested object that contains year and month. Both of them are optional. If some field not exists we treat them as hit. I found one solution but it causes combinatorial explosion of terms so I'm t… --- ## [Heartbeats / Uptime not visible after upgrade to 8.1](https://discuss.elastic.co/t/heartbeats-uptime-not-visible-after-upgrade-to-8-1/301413)
**Author:** [@gunlomboy](https://discuss.elastic.co/u/gunlomboy)\ **Replies:** 3\ **Last updated:** [April 5, 2022, 10:17am UTC](https://discuss.elastic.co/t/heartbeats-uptime-not-visible-after-upgrade-to-8-1/301413 "2022-04-05T10:17:11Z")
Hi, Heartbeats and the Uptime tool in Kibana were working fine under version 7.x. MY heartbeat agent sits on a remote server, runs it's heartbeat checks and send the results to my Elastic Cloud deployment. After upgra… --- ## [Elastic APM Agent bits sent / received](https://discuss.elastic.co/t/elastic-apm-agent-bits-sent-received/301616)
**Author:** [@apm\_user\_tech](https://discuss.elastic.co/u/apm_user_tech)\ **Replies:** 0\ **Last updated:** [April 5, 2022, 9:49am UTC](https://discuss.elastic.co/t/elastic-apm-agent-bits-sent-received/301616 "2022-04-05T09:49:20Z")
Hi, anyone know how to specify bandwitch usage apm agent, metricbeat, filebeat, heartbeat? --- ## [Functionbeat ingest error handling](https://discuss.elastic.co/t/functionbeat-ingest-error-handling/301617)
**Author:** [@lyson](https://discuss.elastic.co/u/lyson)\ **Replies:** 0\ **Last updated:** [April 5, 2022, 9:57am UTC](https://discuss.elastic.co/t/functionbeat-ingest-error-handling/301617 "2022-04-05T09:57:21Z")
We are using functionbeat to forward CloudWatch logs and some custom events via SQS and we are trying to find the best way to make sure events are not lost. We identified different types of errors that can be handled di… --- ## [Batch size in Logstash](https://discuss.elastic.co/t/batch-size-in-logstash/301487)
**Author:** [@MuthulakshmiS](https://discuss.elastic.co/u/MuthulakshmiS)\ **Replies:** 3\ **Last updated:** [April 5, 2022, 9:57am UTC](https://discuss.elastic.co/t/batch-size-in-logstash/301487 "2022-04-05T09:57:04Z")
Hi Team, There is a confusion regarding the usage of pipeline.batch.size parameter in Logstash. Can anyone please clarify? From the documentations, got to understand that pipeline.batch.size is used to control the num… [Previous page](https://discuss.elastic.co/latest.md?page=1183) [Next page](https://discuss.elastic.co/latest.md?page=1185)