# Latest **URL:** https://discuss.elastic.co/latest.md?page=1271 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1272 --- ## [Split message logstash elasticsearch](https://discuss.elastic.co/t/split-message-logstash-elasticsearch/296291)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 2\ **Last updated:** [February 8, 2022, 7:28pm UTC](https://discuss.elastic.co/t/split-message-logstash-elasticsearch/296291 "2022-02-08T19:28:33Z")
Hi, my message it looks like : i want to add field when found the "|" it means to split it with "|" i did it but it looks with a wrong method : imagine that we have a lot of data in one message and in the same f… --- ## [Logstash holding deleted output file](https://discuss.elastic.co/t/logstash-holding-deleted-output-file/296113)
**Author:** [@Xiaochi\_Weng](https://discuss.elastic.co/u/Xiaochi_Weng)\ **Replies:** 7\ **Last updated:** [February 8, 2022, 7:06pm UTC](https://discuss.elastic.co/t/logstash-holding-deleted-output-file/296113 "2022-02-08T19:06:26Z")
I am currently using logstash with version 7.17 in the docker. Here is my output code: output{ file{ path=\>"/tmp/data/output.log" } } Meanwhile, I also have logrotate to keep it rotating: /tmp/data/output.log { si… --- ## [Logstash Ruby error when trying to rename a field the has a hyphen "-" in the value](https://discuss.elastic.co/t/logstash-ruby-error-when-trying-to-rename-a-field-the-has-a-hyphen-in-the-value/296618)
**Author:** [@Bryan\_Hamilton](https://discuss.elastic.co/u/Bryan_Hamilton)\ **Replies:** 4\ **Last updated:** [February 8, 2022, 6:51pm UTC](https://discuss.elastic.co/t/logstash-ruby-error-when-trying-to-rename-a-field-the-has-a-hyphen-in-the-value/296618 "2022-02-08T18:51:14Z")
I have events with nested fields and am trying and am trying the reduce the depth of some nested fields to match ecs and discarding the fields I don't need. Renaning of all other fields word except for one which causes a… --- ## [Removing non-numeric characters from a field not working in logstash](https://discuss.elastic.co/t/removing-non-numeric-characters-from-a-field-not-working-in-logstash/296648)
**Author:** [@curiousmind](https://discuss.elastic.co/u/curiousmind)\ **Replies:** 1\ **Last updated:** [February 8, 2022, 6:49pm UTC](https://discuss.elastic.co/t/removing-non-numeric-characters-from-a-field-not-working-in-logstash/296648 "2022-02-08T18:49:42Z")
need an urgent help.I am getting this error \[2022-02-08T18:25:01,995\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\] Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>"xjmdwt2/wbqlYsoFmJO31K… --- ## [ECK Deployment on Openshift using https://www.elastic.co/guide/en/cloud-on-k8s/1.9/k8s-openshift-deploy-elasticsearch.html](https://discuss.elastic.co/t/eck-deployment-on-openshift-using-https-www-elastic-co-guide-en-cloud-on-k8s-1-9-k8s-openshift-deploy-elasticsearch-html/296644)
**Author:** [@Ganesh\_Sharma](https://discuss.elastic.co/u/Ganesh_Sharma)\ **Replies:** 2\ **Last updated:** [February 8, 2022, 6:35pm UTC](https://discuss.elastic.co/t/eck-deployment-on-openshift-using-https-www-elastic-co-guide-en-cloud-on-k8s-1-9-k8s-openshift-deploy-elasticsearch-html/296644 "2022-02-08T18:35:37Z")
Please can someone confirm if this is a valid Elasticsearch deployment for Openshift? Please advise as I am stuck since couple of days. --- apiVersion: route.openshift.io/v1 kind: Route metadata: name: elasticsearch … --- ## [Pipeline with id \[y\] does not exist](https://discuss.elastic.co/t/pipeline-with-id-y-does-not-exist/296625)
**Author:** [@Jarbird](https://discuss.elastic.co/u/Jarbird)\ **Replies:** 4\ **Last updated:** [February 8, 2022, 5:53pm UTC](https://discuss.elastic.co/t/pipeline-with-id-y-does-not-exist/296625 "2022-02-08T17:53:29Z")
Hello, I've found multiple topics about this very issue however I don't really see a solution. I'm also having a little difficulty understanding it all as I'm fairly new at this. I have each of the ELK components runni… --- ## [I am trying to create a custom function, how to multiply and sum two vectors in painless](https://discuss.elastic.co/t/i-am-trying-to-create-a-custom-function-how-to-multiply-and-sum-two-vectors-in-painless/296647)
**Author:** [@Marco\_Ramos](https://discuss.elastic.co/u/Marco_Ramos)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 5:46pm UTC](https://discuss.elastic.co/t/i-am-trying-to-create-a-custom-function-how-to-multiply-and-sum-two-vectors-in-painless/296647 "2022-02-08T17:46:44Z")
vector a = \[1,2,3,4,5\] vector b=\[2,2,2,2,2\] result =sum(a\*b) --- ## [Extracting some JSON fields from the message](https://discuss.elastic.co/t/extracting-some-json-fields-from-the-message/296479)
**Author:** [@hs\_shaikh](https://discuss.elastic.co/u/hs_shaikh)\ **Replies:** 6\ **Last updated:** [February 8, 2022, 5:37pm UTC](https://discuss.elastic.co/t/extracting-some-json-fields-from-the-message/296479 "2022-02-08T17:37:21Z")
Hello there, I want to extract "applicationOwner" and "proxyResponseCode" JSON fields from my message My message filed look like this: message": "TID: \[-1234\] \[2022-02-07 18:59:15,667\] INFO {org.wso2.am.analytics.pub… --- ## [How to filter single line json?](https://discuss.elastic.co/t/how-to-filter-single-line-json/296242)
**Author:** [@jeromeat](https://discuss.elastic.co/u/jeromeat)\ **Replies:** 4\ **Last updated:** [February 8, 2022, 5:21pm UTC](https://discuss.elastic.co/t/how-to-filter-single-line-json/296242 "2022-02-08T17:21:28Z")
I am trying to figure out how to filter this single line of json data I have been able to pull via http\_poller. I've obfuscated the data, but this is the format it's coming in as. I've never utilized a filter before, so… --- ## [Elastic APM java agent could not connect to APM server](https://discuss.elastic.co/t/elastic-apm-java-agent-could-not-connect-to-apm-server/296642)
**Author:** [@ramm](https://discuss.elastic.co/u/ramm)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 5:14pm UTC](https://discuss.elastic.co/t/elastic-apm-java-agent-could-not-connect-to-apm-server/296642 "2022-02-08T17:14:44Z")
Our Java agent could not connect to APM server, seeing the following error 2022-02-08 12:13:32,519 \[elastic-apm-shared\] DEBUG co.elastic.apm.agent.report.ApmServerReporter - Could not add JsonWriter {"metricset":{"times… --- ## [Filebeat 8.0.0-rc2 dynamic data stream name](https://discuss.elastic.co/t/filebeat-8-0-0-rc2-dynamic-data-stream-name/296397)
**Author:** [@WouterAA](https://discuss.elastic.co/u/WouterAA)\ **Replies:** 7\ **Last updated:** [February 8, 2022, 4:53pm UTC](https://discuss.elastic.co/t/filebeat-8-0-0-rc2-dynamic-data-stream-name/296397 "2022-02-08T16:53:14Z")
Hello, we use filebeat on a k8s cluster to store logs per namespace. On filebeat 7 we create an index per namespace. Filebeat 8.0.0-rc2 uses data streams by default, which we think is a more elegant solution. However it … --- ## [Filebeat multiple index + ilm + index\_template](https://discuss.elastic.co/t/filebeat-multiple-index-ilm-index-template/296638)
**Author:** [@cedricHA](https://discuss.elastic.co/u/cedricHA)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 4:52pm UTC](https://discuss.elastic.co/t/filebeat-multiple-index-ilm-index-template/296638 "2022-02-08T16:52:40Z")
Hello, In filebeat I use several indexes depending on the module. I use the basic filebeat model based on the indexes to keep the field architecture. filebeat-7.16.2-\* setup.template.enabled: true setup.template.nam… --- ## [How to run fleet server in insecure mode?](https://discuss.elastic.co/t/how-to-run-fleet-server-in-insecure-mode/296610)
**Author:** [@gabrielfsousa](https://discuss.elastic.co/u/gabrielfsousa)\ **Replies:** 1\ **Last updated:** [February 8, 2022, 4:48pm UTC](https://discuss.elastic.co/t/how-to-run-fleet-server-in-insecure-mode/296610 "2022-02-08T16:48:12Z")
Im running fleet server in docker with this env --env FLEET\_ENROLL=1\\ --env FLEET\_SERVER\_ENABLE=1\\ --env FLEET\_SERVER\_ELASTICSEARCH\_HOST=$(ELASTICSEARCHHOST)\\ --env FLEET\_SERVER\_SERVICE\_TOKEN=$(SERVICETOKEN)\\ --env FLEE… --- ## [Server Requirements](https://discuss.elastic.co/t/server-requirements/296341)
**Author:** [@mstarkie](https://discuss.elastic.co/u/mstarkie)\ **Replies:** 2\ **Last updated:** [February 8, 2022, 3:33pm UTC](https://discuss.elastic.co/t/server-requirements/296341 "2022-02-08T15:33:31Z")
Hi, I am new to Elasticsearch and we are planning on using it to capture all of our order flow for analytics purposes. I anticipate a data rate of about 2.1 to 3 mb/seconds with a total of 5 to 7 gb/day of data. I wan… --- ## [Filter documents that contain array with empty string](https://discuss.elastic.co/t/filter-documents-that-contain-array-with-empty-string/296562)
**Author:** [@Muhammad\_Ahmad](https://discuss.elastic.co/u/Muhammad_Ahmad)\ **Replies:** 5\ **Last updated:** [February 8, 2022, 3:54pm UTC](https://discuss.elastic.co/t/filter-documents-that-contain-array-with-empty-string/296562 "2022-02-08T15:54:14Z")
I've documents in Elasticsearch and I want to filter out the documents that contain an array of only empty strings or have nothing / empty array. #doc 1 { "\_index": "my-index-000001", "\_type": "\_doc", "\_id": "0", … --- ## [Elasticsearch-certutil http command not founds](https://discuss.elastic.co/t/elasticsearch-certutil-http-command-not-founds/296626)
**Author:** [@legos765](https://discuss.elastic.co/u/legos765)\ **Replies:** 1\ **Last updated:** [February 8, 2022, 3:45pm UTC](https://discuss.elastic.co/t/elasticsearch-certutil-http-command-not-founds/296626 "2022-02-08T15:45:25Z")
Hello, Following this instruction: I should be able to run command /bin/Elasticsearch-certutil http but it says, that only 3 commands are available: adam@ubuntu1:/etc/elasticsearch$ sudo /usr/share/elasticsearch/bin/… --- ## [ConfigurationError: Could not connect to a compatible version of Elasticsearch](https://discuss.elastic.co/t/configurationerror-could-not-connect-to-a-compatible-version-of-elasticsearch/296624)
**Author:** [@marwan](https://discuss.elastic.co/u/marwan)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 3:34pm UTC](https://discuss.elastic.co/t/configurationerror-could-not-connect-to-a-compatible-version-of-elasticsearch/296624 "2022-02-08T15:34:16Z")
Hi guys, I have a subscription to elastic cloud I'm trying to send logs from our Kubernetes on aws to our elastic cloud account. The main image i use is : docker.elastic.co/logstash/logstash-oss:7.17.0 my output o… --- ## [Chart data disappears or shows up very differently when setting smaller timeframe](https://discuss.elastic.co/t/chart-data-disappears-or-shows-up-very-differently-when-setting-smaller-timeframe/296412)
**Author:** [@aqiank](https://discuss.elastic.co/u/aqiank)\ **Replies:** 22\ **Last updated:** [February 8, 2022, 3:12pm UTC](https://discuss.elastic.co/t/chart-data-disappears-or-shows-up-very-differently-when-setting-smaller-timeframe/296412 "2022-02-08T15:12:09Z")
Hi, I'm using Kibana 7.17.0. it seems like the chart area in Kibana disappears when setting timeframe around 5 minutes (2nd screenshot). When I set it slightly longer than that (3rd screenshot), it doesn't seem to show t… --- ## [HA/redundancy on Logstash when pulling data](https://discuss.elastic.co/t/ha-redundancy-on-logstash-when-pulling-data/295754)
**Author:** [@jdswifty](https://discuss.elastic.co/u/jdswifty)\ **Replies:** 2\ **Last updated:** [February 8, 2022, 2:17pm UTC](https://discuss.elastic.co/t/ha-redundancy-on-logstash-when-pulling-data/295754 "2022-02-08T14:17:17Z")
Looking to see how others might have approached this topic in the past. For examples sake I have 2 logstash nodes running in a hot/cold standby mode that run the exact same (centrally managed) pipelines that pull data f… --- ## [Upgrade APM to Fleet/Elastic Agent- broken Java agents](https://discuss.elastic.co/t/upgrade-apm-to-fleet-elastic-agent-broken-java-agents/296403)
**Author:** [@Matt\_Howard](https://discuss.elastic.co/u/Matt_Howard)\ **Replies:** 3\ **Last updated:** [February 8, 2022, 2:06pm UTC](https://discuss.elastic.co/t/upgrade-apm-to-fleet-elastic-agent-broken-java-agents/296403 "2022-02-08T14:06:10Z")
I tried to upgrade from APM to Fleet / APM Agent following the guide here Switch to the Elastic APM integration | APM User Guide \[7.17\] | Elastic But after switching to the Elastic Agent at: "Elastic Cloud will now cr… --- ## [Use Case : Records are more than 10000 with pagination](https://discuss.elastic.co/t/use-case-records-are-more-than-10000-with-pagination/296207)
**Author:** [@Swapnil\_Javal](https://discuss.elastic.co/u/Swapnil_Javal)\ **Replies:** 1\ **Last updated:** [February 8, 2022, 2:03pm UTC](https://discuss.elastic.co/t/use-case-records-are-more-than-10000-with-pagination/296207 "2022-02-08T14:03:28Z")
In My use case, We are implementing pagination with Elasticsearch. If the user clicks on any page number then he will get that set of records on UI. e.g. there is page size is 10 and we click on Page number 2 then 11 to… --- ## [How to mock responses in Nest like IndexResponse](https://discuss.elastic.co/t/how-to-mock-responses-in-nest-like-indexresponse/296609)
**Author:** [@Another-Ralf](https://discuss.elastic.co/u/Another-Ralf)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 1:54pm UTC](https://discuss.elastic.co/t/how-to-mock-responses-in-nest-like-indexresponse/296609 "2022-02-08T13:54:35Z")
I'm using the .Net Nest client to connect to an Elasticsearch instance. I want to test my code that is calling Nest and wanted to mock Nest away. Currently fighting with mocking the ElasticClient.IndexAsync method. It… --- ## [GROK Expression Invalid JSON](https://discuss.elastic.co/t/grok-expression-invalid-json/296603)
**Author:** [@jamesm1](https://discuss.elastic.co/u/jamesm1)\ **Replies:** 1\ **Last updated:** [February 8, 2022, 1:39pm UTC](https://discuss.elastic.co/t/grok-expression-invalid-json/296603 "2022-02-08T13:39:40Z")
Hello - I am attempting to create a GROK expression for an APACHE log. I have gotten the expression working in the GROK debugger and other tools - However when i try to add it in as a line into the Ingestion Pipeline i … --- ## [Help: Format The Watcher Email Body Section](https://discuss.elastic.co/t/help-format-the-watcher-email-body-section/295565)
**Author:** [@appleyin1](https://discuss.elastic.co/u/appleyin1)\ **Replies:** 1\ **Last updated:** [February 8, 2022, 1:36pm UTC](https://discuss.elastic.co/t/help-format-the-watcher-email-body-section/295565 "2022-02-08T13:36:04Z")
Hi there: I'm currently using this code {{ctx.payload.payload\_result}} in my email body to print out the health check status but the format is not ideal (see below), is there a way I can organize it nicely(see proposed … --- ## [Use JSON in Watcher webhook body](https://discuss.elastic.co/t/use-json-in-watcher-webhook-body/295349)
**Author:** [@rosaLux161](https://discuss.elastic.co/u/rosaLux161)\ **Replies:** 1\ **Last updated:** [February 8, 2022, 1:35pm UTC](https://discuss.elastic.co/t/use-json-in-watcher-webhook-body/295349 "2022-02-08T13:35:03Z")
How is it possible to use plain JSON in Watcher webhook body? Just putting the plain JSON in the body { \[...\] "actions":{ "opsgenie":{ "webhook":{ "method":"POST", "ho… --- ## [Access denied error message for mail IDs](https://discuss.elastic.co/t/access-denied-error-message-for-mail-ids/295540)
**Author:** [@Diyatom](https://discuss.elastic.co/u/Diyatom)\ **Replies:** 1\ **Last updated:** [February 8, 2022, 1:34pm UTC](https://discuss.elastic.co/t/access-denied-error-message-for-mail-ids/295540 "2022-02-08T13:34:17Z")
Hi Everyone, I am trying to send a mail from a watcher alert to my personal mail iD but it gives the following error : "type": "s\_m\_t\_p\_address\_failed\_exception", "reason": "554 5.7.1 \:… --- ## [Unable to monitor all logstash pipelines](https://discuss.elastic.co/t/unable-to-monitor-all-logstash-pipelines/296491)
**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Replies:** 3\ **Last updated:** [February 8, 2022, 1:33pm UTC](https://discuss.elastic.co/t/unable-to-monitor-all-logstash-pipelines/296491 "2022-02-08T13:33:23Z")
Dears, I have 7 logstash and deployed metricbeat on all of them for monitoring purpose. out of all these on one logstash i am getting only pipeline in monitoring (5 pipelines are present on this logstash node) all the … --- ## [Shading dependencies](https://discuss.elastic.co/t/shading-dependencies/296502)
**Author:** [@amodric](https://discuss.elastic.co/u/amodric)\ **Replies:** 7\ **Last updated:** [February 8, 2022, 1:29pm UTC](https://discuss.elastic.co/t/shading-dependencies/296502 "2022-02-08T13:29:00Z")
apm-agent-java uses shading for some of the dependencies it uses, but it doesn't change package names for them. This caused dependencies to clash with different versions I had in my project, which defeats the purpose of… --- ## [Limit privileges for ElasticSearch Service API Key](https://discuss.elastic.co/t/limit-privileges-for-elasticsearch-service-api-key/296599)
**Author:** [@sz\_bb](https://discuss.elastic.co/u/sz_bb)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 1:21pm UTC](https://discuss.elastic.co/t/limit-privileges-for-elasticsearch-service-api-key/296599 "2022-02-08T13:21:35Z")
Elastic Cloud. need to be able to register secrets in the Elasticsearch Keystore. This can be done with the ElasticSearch Service API. However, in order to use this API you create an Api Key. The API key has no expira… --- ## [Index Frequency & Rollover](https://discuss.elastic.co/t/index-frequency-rollover/296598)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 1:17pm UTC](https://discuss.elastic.co/t/index-frequency-rollover/296598 "2022-02-08T13:17:33Z")
If you have an ILM policy set to the default rollover settings (30 days or 50 GB), how should you configure your indexing in the LogStash output to align with that? Here's what I mean... if you have the following output … [Previous page](https://discuss.elastic.co/latest.md?page=1270) [Next page](https://discuss.elastic.co/latest.md?page=1272)