# Latest **URL:** https://discuss.elastic.co/latest.md?page=1260 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1261 --- ## [Display a Value from a JSON Field](https://discuss.elastic.co/t/display-a-value-from-a-json-field/297178)
**Author:** [@jamiejackson](https://discuss.elastic.co/u/jamiejackson)\ **Replies:** 1\ **Last updated:** [February 15, 2022, 5:10pm UTC](https://discuss.elastic.co/t/display-a-value-from-a-json-field/297178 "2022-02-15T17:10:19Z")
I see several related forums posts for this but as far as I can tell, nobody had any success. In Elasticsearch/Kibana 6.7 (AWS-managed, for now). Say I have a field, httpRequest.headers, which has the following contents… --- ## [Ingest pipeline: run uri\_parts on all fields ending in "url"](https://discuss.elastic.co/t/ingest-pipeline-run-uri-parts-on-all-fields-ending-in-url/297231)
**Author:** [@louic](https://discuss.elastic.co/u/louic)\ **Replies:** 0\ **Last updated:** [February 15, 2022, 10:52am UTC](https://discuss.elastic.co/t/ingest-pipeline-run-uri-parts-on-all-fields-ending-in-url/297231 "2022-02-15T10:52:11Z")
How to define an ingest pipeline that runs the uri\_parts processor on all fields that match "\*.url" and output to "\*.parsed\_url" ? (without using logstash or beats) The URI parts documentation does not list any support … --- ## [Logstash remove field](https://discuss.elastic.co/t/logstash-remove-field/297209)
**Author:** [@chandima\_jayamina](https://discuss.elastic.co/u/chandima_jayamina)\ **Replies:** 3\ **Last updated:** [February 15, 2022, 4:54pm UTC](https://discuss.elastic.co/t/logstash-remove-field/297209 "2022-02-15T16:54:10Z")
Hi I am new to ELK. I am thinking what is the best way to remove field. Just use mutate filter and remove field First set field to nil and then use mutate filter and remove What is the best way to remove the field. An… --- ## [Upgrading elasticsearch through Helm](https://discuss.elastic.co/t/upgrading-elasticsearch-through-helm/297274)
**Author:** [@tom4](https://discuss.elastic.co/u/tom4)\ **Replies:** 0\ **Last updated:** [February 15, 2022, 4:53pm UTC](https://discuss.elastic.co/t/upgrading-elasticsearch-through-helm/297274 "2022-02-15T16:53:19Z")
Hi Guys, Is there a way to upgrade Elasticsearch via rolling upgrade if deployed in k8s using helm? --- ## [Installation d'un agent Elastic sur VM Azure Windows et avec une configuration Private Link](https://discuss.elastic.co/t/installation-dun-agent-elastic-sur-vm-azure-windows-et-avec-une-configuration-private-link/297269)
**Author:** [@Ced](https://discuss.elastic.co/u/Ced)\ **Replies:** 0\ **Last updated:** [February 15, 2022, 4:10pm UTC](https://discuss.elastic.co/t/installation-dun-agent-elastic-sur-vm-azure-windows-et-avec-une-configuration-private-link/297269 "2022-02-15T16:10:19Z")
Bonjour, Je suis nouveau sur le produit Elastic et j'ai commencé un projet d'intégration consistant à utiliser la solution Elastic Cloud sur Azure. Le déploiement s'est parfaitement bien passé mais la seconde étape étai… --- ## [Kibana Visualizing Array fields in Dashboards](https://discuss.elastic.co/t/kibana-visualizing-array-fields-in-dashboards/297141)
**Author:** [@chandima\_jayamina](https://discuss.elastic.co/u/chandima_jayamina)\ **Replies:** 1\ **Last updated:** [February 15, 2022, 3:56pm UTC](https://discuss.elastic.co/t/kibana-visualizing-array-fields-in-dashboards/297141 "2022-02-15T15:56:21Z")
Hi I have created an array for family details. filter { mutate { add\_field =\> {"employee.family"=\>"%{familyMember}"} } } So in here employee.family =\["mom", "son", "daughter"\] I created Visualisation on how many e… --- ## [Query\_string query operator precedence](https://discuss.elastic.co/t/query-string-query-operator-precedence/297183)
**Author:** [@MrFantastic2022](https://discuss.elastic.co/u/MrFantastic2022)\ **Replies:** 2\ **Last updated:** [February 15, 2022, 2:56pm UTC](https://discuss.elastic.co/t/query-string-query-operator-precedence/297183 "2022-02-15T14:56:49Z")
Hello. When constructing a query\_string query, what is the precedence of the operators? For instance, the example given is this AND that OR thus. So does it AND this/that, then OR with thus? Or does it OR then AND? … --- ## [URI parts processor does not process "domain" part containing special letters (öüõä, cyrillic)](https://discuss.elastic.co/t/uri-parts-processor-does-not-process-domain-part-containing-special-letters-ouoa-cyrillic/297261)
**Author:** [@heikis](https://discuss.elastic.co/u/heikis)\ **Replies:** 0\ **Last updated:** [February 15, 2022, 2:56pm UTC](https://discuss.elastic.co/t/uri-parts-processor-does-not-process-domain-part-containing-special-letters-ouoa-cyrillic/297261 "2022-02-15T14:56:36Z")
Hello. What would be the solution to my problem that the ingest pipeline "uri\_parts" does not process the "domain" part of the URL if the domain contains some special letters like öäüõ or letters in cyrillic. What could… --- ## [Possible bug in logstash 7.16.2 with degug](https://discuss.elastic.co/t/possible-bug-in-logstash-7-16-2-with-degug/297260)
**Author:** [@mtudisco](https://discuss.elastic.co/u/mtudisco)\ **Replies:** 0\ **Last updated:** [February 15, 2022, 2:51pm UTC](https://discuss.elastic.co/t/possible-bug-in-logstash-7-16-2-with-degug/297260 "2022-02-15T14:51:36Z")
Hi, We recently upgraded our stack to elastic 7.16.2, and after that I introduced some changes in my configuracion. That configuration worked in test, but when i put it in production it does not get any error, however i… --- ## [Snapshot creation to external fs runs into open file limit](https://discuss.elastic.co/t/snapshot-creation-to-external-fs-runs-into-open-file-limit/297132)
**Author:** [@raulk89](https://discuss.elastic.co/u/raulk89)\ **Replies:** 11\ **Last updated:** [February 15, 2022, 2:51pm UTC](https://discuss.elastic.co/t/snapshot-creation-to-external-fs-runs-into-open-file-limit/297132 "2022-02-15T14:51:20Z")
Hi Elastic 7.16 How can I limit open file descriptors while creating snapshots..? My issue is, the external file share (hpe storeonce nfs share), we are using where to put our snapshots, it has open file handle limit.… --- ## [How to do log parsing](https://discuss.elastic.co/t/how-to-do-log-parsing/297112)
**Author:** [@himmana](https://discuss.elastic.co/u/himmana)\ **Replies:** 1\ **Last updated:** [February 15, 2022, 2:40pm UTC](https://discuss.elastic.co/t/how-to-do-log-parsing/297112 "2022-02-15T14:40:24Z")
This is my log. i used "elastic" and "filebeat" and "kibana" I'm a beginner who just started studying. I want to parse and use the contents of "message". Where should I start and what should we do? --- ## [ElasticSearch 7.16.3 throwing error on shape that is valid geojson](https://discuss.elastic.co/t/elasticsearch-7-16-3-throwing-error-on-shape-that-is-valid-geojson/297161)
**Author:** [@jstone\_b3insight](https://discuss.elastic.co/u/jstone_b3insight)\ **Replies:** 2\ **Last updated:** [February 15, 2022, 2:22pm UTC](https://discuss.elastic.co/t/elasticsearch-7-16-3-throwing-error-on-shape-that-is-valid-geojson/297161 "2022-02-15T14:22:25Z")
Hello, We recently upgraded from ES version 6 to 7.16.3. One of the shapes we have in our index worked fine in version 6 and is currently working fine in version 7 in the index we migrated over from 6, but when trying … --- ## [Schedule not working sometimes | gaps in records](https://discuss.elastic.co/t/schedule-not-working-sometimes-gaps-in-records/296442)
**Author:** [@Nasser](https://discuss.elastic.co/u/Nasser)\ **Replies:** 1\ **Last updated:** [February 15, 2022, 1:53pm UTC](https://discuss.elastic.co/t/schedule-not-working-sometimes-gaps-in-records/296442 "2022-02-15T13:53:44Z")
Hi i have 10 jdbc.conf files when i start the logstash all queries executed successfully but after the first shot some of the queries not execute. i tried to find the reason in logstash.log but nothing show PFB screen… --- ## [Fleet Server Settings Elasticsearch CA Fingerprint Rejected](https://discuss.elastic.co/t/fleet-server-settings-elasticsearch-ca-fingerprint-rejected/297218)
**Author:** [@ddth\_2022](https://discuss.elastic.co/u/ddth_2022)\ **Replies:** 3\ **Last updated:** [February 15, 2022, 1:46pm UTC](https://discuss.elastic.co/t/fleet-server-settings-elasticsearch-ca-fingerprint-rejected/297218 "2022-02-15T13:46:10Z")
I tried entering the base64 encoded Fingerprint of the CA certificate in the Output section of Fleet settings, but I get the error below - The string is most definitely base64 encoded. What can I do to get past this i… --- ## [How to keep EnterpriseSearch running all the time](https://discuss.elastic.co/t/how-to-keep-enterprisesearch-running-all-the-time/274448)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 24\ **Last updated:** [February 15, 2022, 1:25pm UTC](https://discuss.elastic.co/t/how-to-keep-enterprisesearch-running-all-the-time/274448 "2022-02-15T13:25:24Z")
I have an SSL connection to the server where EnterpriseSearch is set up, and start EnterpriseSearch from the command line with the following command. $ ENT\_SEARCH\_DEFAULT\_PASSWORD=\[REDACTED\] bin/enterprise-search After… --- ## [How to calculate gauss value](https://discuss.elastic.co/t/how-to-calculate-gauss-value/297106)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [February 15, 2022, 11:13am UTC](https://discuss.elastic.co/t/how-to-calculate-gauss-value/297106 "2022-02-15T11:13:13Z")
I want to know how this gauss value is calculated. POST sneaker/\_search { "query": { "function\_score": { "functions": \[ { "gauss": { "price": { "origin": "300", … --- ## [Trying to create rules on elastic siem to map AD user information on another index](https://discuss.elastic.co/t/trying-to-create-rules-on-elastic-siem-to-map-ad-user-information-on-another-index/297230)
**Author:** [@sriramdas89](https://discuss.elastic.co/u/sriramdas89)\ **Replies:** 0\ **Last updated:** [February 15, 2022, 10:28am UTC](https://discuss.elastic.co/t/trying-to-create-rules-on-elastic-siem-to-map-ad-user-information-on-another-index/297230 "2022-02-15T10:28:37Z")
Hello All, I am importing event code 6273 from our NPS server and we have a rule set to alert us for the below condition. hosted on index: ds-logs-system.security-default.xxxxx 5 Failed logins with in a span for 5 minu… --- ## [Ratio of different event count](https://discuss.elastic.co/t/ratio-of-different-event-count/296976)
**Author:** [@Dror\_Tirosh](https://discuss.elastic.co/u/Dror_Tirosh)\ **Replies:** 2\ **Last updated:** [February 15, 2022, 10:31am UTC](https://discuss.elastic.co/t/ratio-of-different-event-count/296976 "2022-02-15T10:31:44Z")
I have a log of various event I need to find the ratio of "good events" from "bad events". I want to graph it over time. For the "vertical axis formula", I need something like count(eventName=="bad) / count(eventName=… --- ## [Configuring Elasticsearch on K8s](https://discuss.elastic.co/t/configuring-elasticsearch-on-k8s/297229)
**Author:** [@Kapila](https://discuss.elastic.co/u/Kapila)\ **Replies:** 0\ **Last updated:** [February 15, 2022, 10:25am UTC](https://discuss.elastic.co/t/configuring-elasticsearch-on-k8s/297229 "2022-02-15T10:25:54Z")
I'm trying to create 3-node Elasticsearch cluster in K8s. Tried create with helm but it created 3-replicas with same Elasticsearch roles instead 3 pods in K8s. I want to create 1-master and 2-data nodes with 1-replica ea… --- ## [Api python for update with ?pipeline=opennlp-pipeline parameter](https://discuss.elastic.co/t/api-python-for-update-with-pipeline-opennlp-pipeline-parameter/297228)
**Author:** [@zabitelasticsearch](https://discuss.elastic.co/u/zabitelasticsearch)\ **Replies:** 0\ **Last updated:** [February 15, 2022, 10:25am UTC](https://discuss.elastic.co/t/api-python-for-update-with-pipeline-opennlp-pipeline-parameter/297228 "2022-02-15T10:25:29Z")
Hi, I use python library to query Elasticsearch. from elasticsearch import Elasticsearch clearedText = "Kobe Bryant was one of the best basketball players of all times. Not even Michael Jordan has ever scored 81 poin… --- ## [Not able to write into log file on running logstash](https://discuss.elastic.co/t/not-able-to-write-into-log-file-on-running-logstash/296574)
**Author:** [@RaviK](https://discuss.elastic.co/u/RaviK)\ **Replies:** 2\ **Last updated:** [February 15, 2022, 10:06am UTC](https://discuss.elastic.co/t/not-able-to-write-into-log-file-on-running-logstash/296574 "2022-02-15T10:06:07Z")
Hi Can anyone please help. My logstash service is running fine and able to parse the log lines from input files. But i can see due to running logstash service, my logfile is not getting updated. But when i'm stopping… --- ## [How to pass params into script as HashSet](https://discuss.elastic.co/t/how-to-pass-params-into-script-as-hashset/297224)
**Author:** [@megatron90000](https://discuss.elastic.co/u/megatron90000)\ **Replies:** 0\ **Last updated:** [February 15, 2022, 10:00am UTC](https://discuss.elastic.co/t/how-to-pass-params-into-script-as-hashset/297224 "2022-02-15T10:00:39Z")
I want to pass params in my script function as HashSet for fast contains check with complexity O(1). As I know, standart params list is ArrayList. How can I do this? Can I use ScriptEngine java? --- ## [Elastic fork/commit in github, how to apply?](https://discuss.elastic.co/t/elastic-fork-commit-in-github-how-to-apply/297217)
**Author:** [@b.kaliuzhnyi](https://discuss.elastic.co/u/b.kaliuzhnyi)\ **Replies:** 0\ **Last updated:** [February 15, 2022, 9:26am UTC](https://discuss.elastic.co/t/elastic-fork-commit-in-github-how-to-apply/297217 "2022-02-15T09:26:07Z")
Hello! I need a function to add a rollup to ILM. Found something on github: https://github.com/elastic/elasticsearch/issues/48003 . I've never worked with git, I don't know where to start. Is there an instruction to … --- ## [Dependencies "an error happened when trying to fetch data"](https://discuss.elastic.co/t/dependencies-an-error-happened-when-trying-to-fetch-data/296954)
**Author:** [@Bevaldss](https://discuss.elastic.co/u/Bevaldss)\ **Replies:** 4\ **Last updated:** [February 15, 2022, 9:19am UTC](https://discuss.elastic.co/t/dependencies-an-error-happened-when-trying-to-fetch-data/296954 "2022-02-15T09:19:29Z")
APM Server version: 7.16 APM Agent language and version: dotnet 1.8.0+8605545e8cbc5b7d68941354a22099a9c43a4aca Browser version: Same problem with Chrome 98.0.4758.82 as with MS Edge 98.0.1108.43 and also same with F… --- ## [Auto\_flush\_interval in exec module](https://discuss.elastic.co/t/auto-flush-interval-in-exec-module/295863)
**Author:** [@jeleb](https://discuss.elastic.co/u/jeleb)\ **Replies:** 1\ **Last updated:** [February 15, 2022, 9:03am UTC](https://discuss.elastic.co/t/auto-flush-interval-in-exec-module/295863 "2022-02-15T09:03:39Z")
Hi, I have a problem with auto\_flush\_interval I want to check the command result logstash.conf: input { … --- ## [Closed indices do not release shards](https://discuss.elastic.co/t/closed-indices-do-not-release-shards/297142)
**Author:** [@gjulianm](https://discuss.elastic.co/u/gjulianm)\ **Replies:** 4\ **Last updated:** [February 15, 2022, 8:58am UTC](https://discuss.elastic.co/t/closed-indices-do-not-release-shards/297142 "2022-02-15T08:58:06Z")
I am having a problem where closed indices are not releasing shards. I am not sure if this is a configuration problem or a change with respect to previous versions (I am using 7.17.0 right now), because I have been able … --- ## ['You do not have permission to access the requested page' after ELK Docker Compose tutorial](https://discuss.elastic.co/t/you-do-not-have-permission-to-access-the-requested-page-after-elk-docker-compose-tutorial/297171)
**Author:** [@JaspervLeeuwen](https://discuss.elastic.co/u/JaspervLeeuwen)\ **Replies:** 2\ **Last updated:** [February 15, 2022, 8:51am UTC](https://discuss.elastic.co/t/you-do-not-have-permission-to-access-the-requested-page-after-elk-docker-compose-tutorial/297171 "2022-02-15T08:51:27Z")
I have followed the guide on installing the Elastic Stack using Docker Compose (Running the Elastic Stack ("ELK") on Docker | Getting Started \[8.0\] | Elastic). When I try to sign in Kibana using kibana\_system as username… --- ## [ILM rollover on inconsistent docs count rather than configured configuration](https://discuss.elastic.co/t/ilm-rollover-on-inconsistent-docs-count-rather-than-configured-configuration/296432)
**Author:** [@pratikdandavate](https://discuss.elastic.co/u/pratikdandavate)\ **Replies:** 4\ **Last updated:** [February 15, 2022, 8:25am UTC](https://discuss.elastic.co/t/ilm-rollover-on-inconsistent-docs-count-rather-than-configured-configuration/296432 "2022-02-15T08:25:26Z")
I have created ILM policy with following configuration : { "policy": { "phases": { "hot": { "actions": { "rollover": { "max\_docs": 1500… --- ## [Error while executing painless script : Cannot invoke \\"Object.getClass()\\" because \\"receiver\\" is null". Same script is working fine in Dev tools](https://discuss.elastic.co/t/error-while-executing-painless-script-cannot-invoke-object-getclass-because-receiver-is-null-same-script-is-working-fine-in-dev-tools/297128)
**Author:** [@KabirAli07](https://discuss.elastic.co/u/KabirAli07)\ **Replies:** 2\ **Last updated:** [February 15, 2022, 6:29am UTC](https://discuss.elastic.co/t/error-while-executing-painless-script-cannot-invoke-object-getclass-because-receiver-is-null-same-script-is-working-fine-in-dev-tools/297128 "2022-02-15T06:29:35Z")
{ "trigger": { "schedule": { "interval": "30m" } }, "input": { "chain": { "inputs": \[ { "first": { "search": { "request": { "searc… --- ## [Out of memorry Error When Using Java Client API](https://discuss.elastic.co/t/out-of-memorry-error-when-using-java-client-api/297038)
**Author:** [@Gandalf](https://discuss.elastic.co/u/Gandalf)\ **Replies:** 3\ **Last updated:** [February 15, 2022, 6:03am UTC](https://discuss.elastic.co/t/out-of-memorry-error-when-using-java-client-api/297038 "2022-02-15T06:03:04Z")
I'm migrating my code from Java Rest High Level API to Java Client API 7.16 version. Everything goes all right in my local enviroment but got the OutOfMemoryError: Direct buffer memory error when I pull it to the Test E… [Previous page](https://discuss.elastic.co/latest.md?page=1259) [Next page](https://discuss.elastic.co/latest.md?page=1261)