# Latest **URL:** https://discuss.elastic.co/latest.md?page=1335 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1336 --- ## [Wildcard query returns 0 result](https://discuss.elastic.co/t/wildcard-query-returns-0-result/290549)
**Author:** [@Wonder\_Garance](https://discuss.elastic.co/u/Wonder_Garance)\ **Replies:** 4\ **Last updated:** [December 21, 2021, 8:07pm UTC](https://discuss.elastic.co/t/wildcard-query-returns-0-result/290549 "2021-12-21T20:07:55Z")
I have a problem with the char '?' in the wildcard query, the query below returns 0 result { "query": { "span\_near": { "clauses": \[ { "span\_multi": { "match": { "w… --- ## [Security Fundamentals: SIEM, Lab 3, Failed to Activate Rule](https://discuss.elastic.co/t/security-fundamentals-siem-lab-3-failed-to-activate-rule/292609)
**Author:** [@csontag](https://discuss.elastic.co/u/csontag)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 7:59pm UTC](https://discuss.elastic.co/t/security-fundamentals-siem-lab-3-failed-to-activate-rule/292609 "2021-12-21T19:59:47Z")
I've made it to the final step of Lab 3 of the "Elastic Security Fundamentals: SIEM". I have been able to successfully complete all of the prior steps up to this point (including installing and configuring the 3 differen… --- ## [Reindex: how Elastic handle index names](https://discuss.elastic.co/t/reindex-how-elastic-handle-index-names/291336)
**Author:** [@mauog](https://discuss.elastic.co/u/mauog)\ **Replies:** 1\ **Last updated:** [December 21, 2021, 6:59pm UTC](https://discuss.elastic.co/t/reindex-how-elastic-handle-index-names/291336 "2021-12-21T18:59:15Z")
Hello, I read sometime that some operation are impossible on current index and so the strategy is to create a new one an the reindex there all the data stored. I'm a newbie here and this could be a stupid question but … --- ## [Logstash Ruby plugin code block not raising Exception](https://discuss.elastic.co/t/logstash-ruby-plugin-code-block-not-raising-exception/291376)
**Author:** [@Colin\_K](https://discuss.elastic.co/u/Colin_K)\ **Replies:** 4\ **Last updated:** [December 21, 2021, 6:57pm UTC](https://discuss.elastic.co/t/logstash-ruby-plugin-code-block-not-raising-exception/291376 "2021-12-21T18:57:35Z")
I have a ruby block. The "happy" path works where I see the expected map output. When I provide an invalid scheme for an Array with a log line and an element that does not contain an object with field, I do not throw the… --- ## [Certificate problems adding node to cluster](https://discuss.elastic.co/t/certificate-problems-adding-node-to-cluster/292511)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 2\ **Last updated:** [December 21, 2021, 6:38pm UTC](https://discuss.elastic.co/t/certificate-problems-adding-node-to-cluster/292511 "2021-12-21T18:38:57Z")
I am preparing to turn on "security" on my production cluster by setting up a test cluster first. I have a single node running fine with security enabled but when I try and bring up a second node with the same configura… --- ## [Sorting on ES does not work on # number field](https://discuss.elastic.co/t/sorting-on-es-does-not-work-on-number-field/292591)
**Author:** [@mclovin](https://discuss.elastic.co/u/mclovin)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 6:14pm UTC](https://discuss.elastic.co/t/sorting-on-es-does-not-work-on-number-field/292591 "2021-12-21T18:14:54Z")
Hi all, I read the multi sort feature document, I have no sorting on either of my two columns. ie. Time and VST. When I try sorting on the vst column it does not do anything. --- ## [Logstash stopped processing because of an error: (SystemExit) exit org.jruby.exceptions.SystemExit: (SystemExit) exit](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error-systemexit-exit-org-jruby-exceptions-systemexit-systemexit-exit/292432)
**Author:** [@tobias.greis](https://discuss.elastic.co/u/tobias.greis)\ **Replies:** 4\ **Last updated:** [December 21, 2021, 5:20pm UTC](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error-systemexit-exit-org-jruby-exceptions-systemexit-systemexit-exit/292432 "2021-12-21T17:20:08Z")
Hi, I have a problem with my Logstash Component. When starting I get the following failure and can't find helpful information online. I use a SLES 15 with Logstash 7.16.1 and OpenJDK11. \[2021-12-20T07:56:23,219\]\[INFO \]… --- ## [Does cluster.routing.allocation.cluster\_concurrent\_rebalance limit the number of reallocation due to a high watermark?](https://discuss.elastic.co/t/does-cluster-routing-allocation-cluster-concurrent-rebalance-limit-the-number-of-reallocation-due-to-a-high-watermark/292555)
**Author:** [@alsyia](https://discuss.elastic.co/u/alsyia)\ **Replies:** 1\ **Last updated:** [December 21, 2021, 5:15pm UTC](https://discuss.elastic.co/t/does-cluster-routing-allocation-cluster-concurrent-rebalance-limit-the-number-of-reallocation-due-to-a-high-watermark/292555 "2021-12-21T17:15:22Z")
Hello, We had an event this morning were a node reached its high watermark. Elasticsearch decided to move 21 of its shards. We didn't modify cluster.routing.allocation.cluster\_concurrent\_rebalance, so it should limit t… --- ## [Logstash update doc fields if exits](https://discuss.elastic.co/t/logstash-update-doc-fields-if-exits/292206)
**Author:** [@patilanna](https://discuss.elastic.co/u/patilanna)\ **Replies:** 3\ **Last updated:** [December 21, 2021, 5:13pm UTC](https://discuss.elastic.co/t/logstash-update-doc-fields-if-exits/292206 "2021-12-21T17:13:26Z")
Blockquote logstash to update doc fields if exits or insert new to ELK stack, sorry if any thing not as per forum I am sending kafka stream of events logs, there was two types of logs, open-event log and close-event l… --- ## [Logstash to logstash not indexing logs when is enabled](https://discuss.elastic.co/t/logstash-to-logstash-not-indexing-logs-when-is-enabled/292546)
**Author:** [@jhaos](https://discuss.elastic.co/u/jhaos)\ **Replies:** 1\ **Last updated:** [December 21, 2021, 5:12pm UTC](https://discuss.elastic.co/t/logstash-to-logstash-not-indexing-logs-when-is-enabled/292546 "2021-12-21T17:12:27Z")
Hi, we are facing an issue using Logstash to Logstash configuration Logstash-to-Logstash Communication | Logstash Reference \[7.16\] | Elastic. Our architecture is the following using two different inputs in filebeat: Fil… --- ## [Journalbeat can't create an alias and fails to work](https://discuss.elastic.co/t/journalbeat-cant-create-an-alias-and-fails-to-work/201875)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 6\ **Last updated:** [December 21, 2021, 5:09pm UTC](https://discuss.elastic.co/t/journalbeat-cant-create-an-alias-and-fails-to-work/201875 "2021-12-21T17:09:29Z")
Journalbeat is having issues getting started. It seems like it fails to create an alias? journalctl -l --follow -u journalbeat eventually spits this out: Oct 01 15:33:43 hostname journalbeat\[30589\]: 2019-10-01T15:33:43… --- ## [Filebeat Azure plugin parsing error on azure.signinlogs.properties.authentication\_requirement\_policies field](https://discuss.elastic.co/t/filebeat-azure-plugin-parsing-error-on-azure-signinlogs-properties-authentication-requirement-policies-field/292586)
**Author:** [@vgarric](https://discuss.elastic.co/u/vgarric)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 5:08pm UTC](https://discuss.elastic.co/t/filebeat-azure-plugin-parsing-error-on-azure-signinlogs-properties-authentication-requirement-policies-field/292586 "2021-12-21T17:08:20Z")
hi, we get drops with some logs from Azure signinlogs linked to the azure.signinlogs.properties.authentication\_requirement\_policies field parsing. Here is the logs from filebeat with azure module : 2021-12-21T15:24:27… --- ## [Significant text aggregation on multiple fields](https://discuss.elastic.co/t/significant-text-aggregation-on-multiple-fields/292585)
**Author:** [@Manisekhar\_techo](https://discuss.elastic.co/u/Manisekhar_techo)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 5:02pm UTC](https://discuss.elastic.co/t/significant-text-aggregation-on-multiple-fields/292585 "2021-12-21T17:02:19Z")
Hi I'm using the multi\_match query for search with phrase keyword, in the aggregations, I'm using significant\_text aggregation, But I can only specify one field is there any way to perform that aggregation on multiple… --- ## [Elastic Stack Cloud Subscription](https://discuss.elastic.co/t/elastic-stack-cloud-subscription/292449)
**Author:** [@Thamini\_NellaiKumar](https://discuss.elastic.co/u/Thamini_NellaiKumar)\ **Replies:** 3\ **Last updated:** [December 21, 2021, 4:38pm UTC](https://discuss.elastic.co/t/elastic-stack-cloud-subscription/292449 "2021-12-21T16:38:24Z")
Hi, I would like to know the difference between getting elastic cloud subscription separately and hosting elastic from the existing Azure subscription --- ## [Version-specific beats index template for every update required?](https://discuss.elastic.co/t/version-specific-beats-index-template-for-every-update-required/292582)
**Author:** [@hafneren](https://discuss.elastic.co/u/hafneren)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 4:14pm UTC](https://discuss.elastic.co/t/version-specific-beats-index-template-for-every-update-required/292582 "2021-12-21T16:14:26Z")
Hi, I'm trying to improve the security of my Elastic Stack through a least privilege architecture consisting of winlogbeat, filebeat, auditbeat -\> logstash -\> Elasticsearch & Kibana. My goal is that the different beats … --- ## [Roadmap / release schedule (8.1.0 when?)](https://discuss.elastic.co/t/roadmap-release-schedule-8-1-0-when/292557)
**Author:** [@Joel\_Hansell](https://discuss.elastic.co/u/Joel_Hansell)\ **Replies:** 2\ **Last updated:** [December 21, 2021, 3:32pm UTC](https://discuss.elastic.co/t/roadmap-release-schedule-8-1-0-when/292557 "2021-12-21T15:32:11Z")
Hi, I tried searching for this on the elastic.co website, here on the Discuss server, and also using Google search, but found nothing current. Is there a planned release date for ELK 8, and specifically 8.1? I am inte… --- ## [Monitor Filebeat's Uptime](https://discuss.elastic.co/t/monitor-filebeats-uptime/292480)
**Author:** [@6igwig](https://discuss.elastic.co/u/6igwig)\ **Replies:** 1\ **Last updated:** [December 21, 2021, 3:26pm UTC](https://discuss.elastic.co/t/monitor-filebeats-uptime/292480 "2021-12-21T15:26:38Z")
Can Heartbeat be configured to monitor a filebeat instance and alert when that beat goes down? Is there another way to determine when a beat is not running when it should be? During version upgrades sometime a beat wil… --- ## [Timestamp entries in cet without time zone are displayed in Kibana as cet +1](https://discuss.elastic.co/t/timestamp-entries-in-cet-without-time-zone-are-displayed-in-kibana-as-cet-1/292571)
**Author:** [@jstricker](https://discuss.elastic.co/u/jstricker)\ **Replies:** 1\ **Last updated:** [December 21, 2021, 2:54pm UTC](https://discuss.elastic.co/t/timestamp-entries-in-cet-without-time-zone-are-displayed-in-kibana-as-cet-1/292571 "2021-12-21T14:54:24Z")
I have several log files with different timestamp formats. A log file like this: In the other file like this: The timestampe entrys with and with out timezone specification. With the following component template … --- ## [ILM shrink and warm node](https://discuss.elastic.co/t/ilm-shrink-and-warm-node/292357)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 8\ **Last updated:** [December 21, 2021, 2:42pm UTC](https://discuss.elastic.co/t/ilm-shrink-and-warm-node/292357 "2021-12-21T14:42:16Z")
I have setup ILM policy with shrink but not working. what am I missing PUT \_ilm/policy/metricbeat { "policy": { "phases": { "hot": { "min\_age": "0ms", "actions": { "rollover": { … --- ## [Field exist query to check nested type field exists for a doc](https://discuss.elastic.co/t/field-exist-query-to-check-nested-type-field-exists-for-a-doc/292152)
**Author:** [@sudheesh](https://discuss.elastic.co/u/sudheesh)\ **Replies:** 0\ **Last updated:** [December 16, 2021, 12:40pm UTC](https://discuss.elastic.co/t/field-exist-query-to-check-nested-type-field-exists-for-a-doc/292152 "2021-12-16T12:40:23Z")
This is the template for my index PUT employee\_index { "mappings":{ "properties": { "role": { "type": "text" }, "Employee": { "type": "nested", "properties": { … --- ## [Filebeat harvesting](https://discuss.elastic.co/t/filebeat-harvesting/292376)
**Author:** [@Milad\_Akhlaghi](https://discuss.elastic.co/u/Milad_Akhlaghi)\ **Replies:** 2\ **Last updated:** [December 21, 2021, 12:44pm UTC](https://discuss.elastic.co/t/filebeat-harvesting/292376 "2021-12-21T12:44:35Z")
Hi everybody , i need some help on filebeat harvesting a log file . i have a problem and i need to know which logfile that already exist is harvesting by filebeat and how can i know that harvest is finished and how i ca… --- ## [How to resolve "Failed to poll for work. Work has timed out" error](https://discuss.elastic.co/t/how-to-resolve-failed-to-poll-for-work-work-has-timed-out-error/291538)
**Author:** [@mertkaant](https://discuss.elastic.co/u/mertkaant)\ **Replies:** 3\ **Last updated:** [December 21, 2021, 12:02pm UTC](https://discuss.elastic.co/t/how-to-resolve-failed-to-poll-for-work-work-has-timed-out-error/291538 "2021-12-21T12:02:27Z")
Hello, dear elastic community, We recently upgraded our ELK stack to 7.15.2 from 7.7.0. All my nodes are on the same version (7.15.2) After the upgrade, our Kibana's status goes yellow repeatedly. When it goes yellow … --- ## [No signature of method: java.util.ArrayList.get() is applicable for argument types: (org.codehaus.groovy.runtime.GStringImpl)](https://discuss.elastic.co/t/no-signature-of-method-java-util-arraylist-get-is-applicable-for-argument-types-org-codehaus-groovy-runtime-gstringimpl/292554)
**Author:** [@dishant](https://discuss.elastic.co/u/dishant)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 11:51am UTC](https://discuss.elastic.co/t/no-signature-of-method-java-util-arraylist-get-is-applicable-for-argument-types-org-codehaus-groovy-runtime-gstringimpl/292554 "2021-12-21T11:51:53Z")
I am trying to make an Elasticsearch plugin for Elasticsearch version 5.6.16 and using the gradle version 4.7. I am using oracle jdk9. Whenever, I'm trying to create the project build, it is giving me an error. I have su… --- ## [Esrally warmup explaination](https://discuss.elastic.co/t/esrally-warmup-explaination/291307)
**Author:** [@fentom](https://discuss.elastic.co/u/fentom)\ **Replies:** 2\ **Last updated:** [December 21, 2021, 11:13am UTC](https://discuss.elastic.co/t/esrally-warmup-explaination/291307 "2021-12-21T11:13:54Z")
Hi, I'm new to Elasticsearch and ESRally. I want to run some benchmarks but I don't understand how the warmup-iterations parameter for tracks works. Documentation says "Number of iterations that each client should execu… --- ## [Run Winlogbeat service under a custom account](https://discuss.elastic.co/t/run-winlogbeat-service-under-a-custom-account/292465)
**Author:** [@a.gavric](https://discuss.elastic.co/u/a.gavric)\ **Replies:** 1\ **Last updated:** [December 21, 2021, 11:11am UTC](https://discuss.elastic.co/t/run-winlogbeat-service-under-a-custom-account/292465 "2021-12-21T11:11:17Z")
Hi, I've been having some difficulties setting up winglobeat to run as a service under a custom domain account with logon as a service rights on a windows 2016 server. The reason we are doing that is to be compliant with… --- ## [Problem with Refresh button for visualizations in Kibana 7.16.1](https://discuss.elastic.co/t/problem-with-refresh-button-for-visualizations-in-kibana-7-16-1/292469)
**Author:** [@Fer\_dominguez](https://discuss.elastic.co/u/Fer_dominguez)\ **Replies:** 3\ **Last updated:** [December 21, 2021, 10:47am UTC](https://discuss.elastic.co/t/problem-with-refresh-button-for-visualizations-in-kibana-7-16-1/292469 "2021-12-21T10:47:16Z")
Hi, In Kibana v7.16.1 inside a vertical bar visualization (didn't test on other types), when I click the Refresh button, the graph is not updated, and I know the data is being updated. I can see that the data is actuall… --- ## [Manage Thread Pool in Elasticsearch](https://discuss.elastic.co/t/manage-thread-pool-in-elasticsearch/292493)
**Author:** [@yash\_196](https://discuss.elastic.co/u/yash_196)\ **Replies:** 6\ **Last updated:** [December 21, 2021, 10:22am UTC](https://discuss.elastic.co/t/manage-thread-pool-in-elasticsearch/292493 "2021-12-21T10:22:48Z")
Hi Team, Is there any way to increase the queue size for write and search using JAVA API's / High Level Rest Client? --- ## [Save a field into another index](https://discuss.elastic.co/t/save-a-field-into-another-index/292455)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 2\ **Last updated:** [December 21, 2021, 10:18am UTC](https://discuss.elastic.co/t/save-a-field-into-another-index/292455 "2021-12-21T10:18:55Z")
Hi folks, I am using the mapper size plugin to save the size of the document to be able to create dashboards, so a developer can see how much log data he produces within his containers in kubernetes/openshift. I am usin… --- ## [Elasticsearch 7.3.2 log4j2 properties changes](https://discuss.elastic.co/t/elasticsearch-7-3-2-log4j2-properties-changes/292242)
**Author:** [@Siva\_Karan](https://discuss.elastic.co/u/Siva_Karan)\ **Replies:** 2\ **Last updated:** [December 21, 2021, 10:18am UTC](https://discuss.elastic.co/t/elasticsearch-7-3-2-log4j2-properties-changes/292242 "2021-12-21T10:18:24Z")
Hi , we are using the Elasticsearch 7.3.2 it runs on jdk8, for log4j2 properties changes what are the things need to do in JVM file. --- ## [Use processor like translate plugin in logstash for filebeat](https://discuss.elastic.co/t/use-processor-like-translate-plugin-in-logstash-for-filebeat/291987)
**Author:** [@Paf](https://discuss.elastic.co/u/Paf)\ **Replies:** 2\ **Last updated:** [December 21, 2021, 9:40am UTC](https://discuss.elastic.co/t/use-processor-like-translate-plugin-in-logstash-for-filebeat/291987 "2021-12-21T09:40:29Z")
Hi, I want to use processor like translate plugin in Logstash for Filebeat, to compare a field value with a list from file and add another field if matched. I search processor in Filbeat documentation, but I did not fi… [Previous page](https://discuss.elastic.co/latest.md?page=1334) [Next page](https://discuss.elastic.co/latest.md?page=1336)