# Latest **URL:** https://discuss.elastic.co/latest.md?page=1336 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1337 --- ## [JVMs tab empty for most services](https://discuss.elastic.co/t/jvms-tab-empty-for-most-services/289955)
**Author:** [@coynef](https://discuss.elastic.co/u/coynef)\ **Replies:** 9\ **Last updated:** [December 21, 2021, 9:39am UTC](https://discuss.elastic.co/t/jvms-tab-empty-for-most-services/289955 "2021-12-21T09:39:28Z")
Kibana version: 7.10.1 Elasticsearch version: 7.10.1 APM Server version: 7.10.1 APM Agent language and version: 1.26 Description of the problem including expected versus actual behavior. Please include screenshots (i… --- ## [Logstash Rspec Test Library, how does it fundamentally work when creating pipelines?](https://discuss.elastic.co/t/logstash-rspec-test-library-how-does-it-fundamentally-work-when-creating-pipelines/292537)
**Author:** [@UXabre](https://discuss.elastic.co/u/UXabre)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 8:54am UTC](https://discuss.elastic.co/t/logstash-rspec-test-library-how-does-it-fundamentally-work-when-creating-pipelines/292537 "2021-12-21T08:54:33Z")
So, I've been using rspec for a while now while testing my "simple" pipeline configs. However, as of recent, I'd like to use "complex" filters like "aggregate" and "memcached" but it is hard, if not impossible to find t… --- ## [Logstash pipelines failing after JNDI lookup class removed from version 7.4.2](https://discuss.elastic.co/t/logstash-pipelines-failing-after-jndi-lookup-class-removed-from-version-7-4-2/292539)
**Author:** [@Rahul\_Dey](https://discuss.elastic.co/u/Rahul_Dey)\ **Replies:** 1\ **Last updated:** [December 21, 2021, 9:07am UTC](https://discuss.elastic.co/t/logstash-pipelines-failing-after-jndi-lookup-class-removed-from-version-7-4-2/292539 "2021-12-21T09:07:11Z")
For threat mitigation of log4j vulnerability in Logstash, I have removed that JNDI look up class from Logstash docker image by adding the below lines in Dockerfile as advised by Elastic team. RUN bin/ruby -rzip -e \\ '… --- ## [Addressing log4j vulnerability for 1.x and 2.x elasticsearch](https://discuss.elastic.co/t/addressing-log4j-vulnerability-for-1-x-and-2-x-elasticsearch/292531)
**Author:** [@stecino](https://discuss.elastic.co/u/stecino)\ **Replies:** 1\ **Last updated:** [December 21, 2021, 8:47am UTC](https://discuss.elastic.co/t/addressing-log4j-vulnerability-for-1-x-and-2-x-elasticsearch/292531 "2021-12-21T08:47:07Z")
I am sure there are still people out there who are using this. Anyone with 1.7 and/or 2.3 that have to deal with this? --- ## [URI Parts Processor decodes an encoded & in URL query](https://discuss.elastic.co/t/uri-parts-processor-decodes-an-encoded-in-url-query/292534)
**Author:** [@plailla](https://discuss.elastic.co/u/plailla)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 8:34am UTC](https://discuss.elastic.co/t/uri-parts-processor-decodes-an-encoded-in-url-query/292534 "2021-12-21T08:34:13Z")
Hello, I'm fairly new to the Elastic Stack. I've set up a cluster that receives Tomcat access logs from Filebeats. I'm using the default Ingest Pipeline created by the Apache module in Filebeat, which uses the processo… --- ## [Unexpected behaviour for auto\_create\_index](https://discuss.elastic.co/t/unexpected-behaviour-for-auto-create-index/292487)
**Author:** [@hapeka](https://discuss.elastic.co/u/hapeka)\ **Replies:** 4\ **Last updated:** [December 21, 2021, 8:15am UTC](https://discuss.elastic.co/t/unexpected-behaviour-for-auto-create-index/292487 "2021-12-21T08:15:53Z")
Hi, I have a question about the cluster setting "action.auto\_create\_index". I set it to "false" to avoid indices from being created automatically when a PUT is sent to index a document. It works without problem when I … --- ## [Unable to expand persistent volumes used by Elasticsearch on Oracle Cloud](https://discuss.elastic.co/t/unable-to-expand-persistent-volumes-used-by-elasticsearch-on-oracle-cloud/292114)
**Author:** [@Pranay\_Reddy](https://discuss.elastic.co/u/Pranay_Reddy)\ **Replies:** 2\ **Last updated:** [December 21, 2021, 8:03am UTC](https://discuss.elastic.co/t/unable-to-expand-persistent-volumes-used-by-elasticsearch-on-oracle-cloud/292114 "2021-12-21T08:03:17Z")
I am using block volumes on oracle cloud infrastructure for persistent storage of Elasticsearch(ECK). I wanted to increase the amount of storage of persistent volume. So, I increased the storage value in volume claim te… --- ## [Dec 21st, 2021: \[en\] Top 3 recommendations to keep your Elasticsearch cluster healthy](https://discuss.elastic.co/t/dec-21st-2021-en-top-3-recommendations-to-keep-your-elasticsearch-cluster-healthy/289326)
**Author:** [@Imma](https://discuss.elastic.co/u/Imma)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 8:00am UTC](https://discuss.elastic.co/t/dec-21st-2021-en-top-3-recommendations-to-keep-your-elasticsearch-cluster-healthy/289326 "2021-12-21T08:00:53Z")
This article is also available in Spanish. Working as an Elastic support engineer, we see a few tools that are very useful to have already in place when we need to help our customers troubleshoot their Elasticsearch c… --- ## [Dec 21st, 2021: \[es\] Tres recomendaciones para tener un clúster Elasticsearch saludable](https://discuss.elastic.co/t/dec-21st-2021-es-tres-recomendaciones-para-tener-un-cluster-elasticsearch-saludable/289328)
**Author:** [@Imma](https://discuss.elastic.co/u/Imma)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 8:00am UTC](https://discuss.elastic.co/t/dec-21st-2021-es-tres-recomendaciones-para-tener-un-cluster-elasticsearch-saludable/289328 "2021-12-21T08:00:53Z")
This article is also available in English: En nuestro día a día de soporte en Elastic vemos algunas herramientas que son muy útiles cuando necesitamos ayudar a nuestros clientes a solucionar problemas en sus clústeres… --- ## [Receiving "timed out waiting for all nodes to process published state"](https://discuss.elastic.co/t/receiving-timed-out-waiting-for-all-nodes-to-process-published-state/291670)
**Author:** [@pratiksha](https://discuss.elastic.co/u/pratiksha)\ **Replies:** 13\ **Last updated:** [December 21, 2021, 7:44am UTC](https://discuss.elastic.co/t/receiving-timed-out-waiting-for-all-nodes-to-process-published-state/291670 "2021-12-21T07:44:44Z")
I am using Elasticsearch v6.6.1. There are total 16 nodes (10 data, 3 master, 3 client). I see a frequent message in elected master logs: {"type":"log","host":"Elasticsearch-master-55ff74b94d-ckhfw","level":"WARN", "ti… --- ## [Unique Count and Currency Format in Elasticsearch](https://discuss.elastic.co/t/unique-count-and-currency-format-in-elasticsearch/292444)
**Author:** [@arungoel142](https://discuss.elastic.co/u/arungoel142)\ **Replies:** 3\ **Last updated:** [December 21, 2021, 7:14am UTC](https://discuss.elastic.co/t/unique-count-and-currency-format-in-elasticsearch/292444 "2021-12-21T07:14:36Z")
I am facing unique count accuracy issue in Elasticsearch and currency format indian change. Please help. --- ## [Native controller process has stopped - no new native processes can be started and then elasticsearch node stoped](https://discuss.elastic.co/t/native-controller-process-has-stopped-no-new-native-processes-can-be-started-and-then-elasticsearch-node-stoped/292527)
**Author:** [@qinkkai](https://discuss.elastic.co/u/qinkkai)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 6:43am UTC](https://discuss.elastic.co/t/native-controller-process-has-stopped-no-new-native-processes-can-be-started-and-then-elasticsearch-node-stoped/292527 "2021-12-21T06:43:50Z")
I have two nodes in my Elasticsearch cluster and have same configurations and environment. cat /etc/centos-release CentOS Linux release 7.8.2003 (Core) uname -r 3.10.0-1127.8.2.el7.x86\_64 sysctl vm.max\_map\_count vm… --- ## [CVE-2021-44228 - Logstahs - ERROR StatusLogger Log4j2 could not find a logging implementation. Please add log4j-core to the classpath](https://discuss.elastic.co/t/cve-2021-44228-logstahs-error-statuslogger-log4j2-could-not-find-a-logging-implementation-please-add-log4j-core-to-the-classpath/291798)
**Author:** [@prajyodh](https://discuss.elastic.co/u/prajyodh)\ **Replies:** 3\ **Last updated:** [December 21, 2021, 6:41am UTC](https://discuss.elastic.co/t/cve-2021-44228-logstahs-error-statuslogger-log4j2-could-not-find-a-logging-implementation-please-add-log4j-core-to-the-classpath/291798 "2021-12-21T06:41:37Z")
Hi I was checking on impact of CVE-2021-44228 on ELK stack and came across the link When i tried the solution mentioned for logstash to remove the JNDI Class zip -q -d \/logstash-core/lib/jars/log4j-c… --- ## [Elasticsearch MUST query with nestedQuery() ScoreMode.NONE vs FILTER with nested Query SCOREMODE.NONE performance](https://discuss.elastic.co/t/elasticsearch-must-query-with-nestedquery-scoremode-none-vs-filter-with-nested-query-scoremode-none-performance/292524)
**Author:** [@Akshayyha\_Krishnamur](https://discuss.elastic.co/u/Akshayyha_Krishnamur)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 5:56am UTC](https://discuss.elastic.co/t/elasticsearch-must-query-with-nestedquery-scoremode-none-vs-filter-with-nested-query-scoremode-none-performance/292524 "2021-12-21T05:56:56Z")
I am developing an Elasticsearch logic for searching certain fields and we are not concerned about relevance scoring. I already implemented the logic with MUST queries having nestedQuery ScoreMode.NONE. However, I came a… --- ## [Elasticsearch Re-indexing Issue](https://discuss.elastic.co/t/elasticsearch-re-indexing-issue/289529)
**Author:** [@Akshayyha\_Krishnamur](https://discuss.elastic.co/u/Akshayyha_Krishnamur)\ **Replies:** 7\ **Last updated:** [December 21, 2021, 5:42am UTC](https://discuss.elastic.co/t/elasticsearch-re-indexing-issue/289529 "2021-12-21T05:42:27Z")
We use a single node environment since we have adopted Elasticsearch recently. We are facing Elasticsearch indexing issues when 4 subsequent indexing requests were made at approximately 50 - 100ms interval each. Elastics… --- ## [How to calculate elapsed time between two events in different documents](https://discuss.elastic.co/t/how-to-calculate-elapsed-time-between-two-events-in-different-documents/292522)
**Author:** [@syunusic](https://discuss.elastic.co/u/syunusic)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 5:42am UTC](https://discuss.elastic.co/t/how-to-calculate-elapsed-time-between-two-events-in-different-documents/292522 "2021-12-21T05:42:08Z")
Hi all, If I have a log with: @timestamp EVENTNO (Event number) and DEVICEID (Device ID) and this happen: always when a specific event occurs, it does have a start (EVENTNO="300095") and an end (EVENTNO="300096"). I … --- ## [Caught exception while handling client http traffic, closing connection Netty4HttpChannel{localAddress=/](https://discuss.elastic.co/t/caught-exception-while-handling-client-http-traffic-closing-connection-netty4httpchannel-localaddress/292521)
**Author:** [@haipeng.zhao](https://discuss.elastic.co/u/haipeng.zhao)\ **Replies:** 1\ **Last updated:** [December 21, 2021, 5:35am UTC](https://discuss.elastic.co/t/caught-exception-while-handling-client-http-traffic-closing-connection-netty4httpchannel-localaddress/292521 "2021-12-21T05:35:53Z")
{"type": "server", "timestamp": "2021-12-17T19:45:21,865Z", "level": "WARN", "component": "o.e.h.AbstractHttpServerTransport", "cluster.name": "dev", "node.name": "dev-es-data-node-hot-0", "message": "caught exception wh… --- ## [Caught exception while handling client http traffic, closing connection Netty4HttpChannel{localAddress=/](https://discuss.elastic.co/t/caught-exception-while-handling-client-http-traffic-closing-connection-netty4httpchannel-localaddress/292440)
**Author:** [@haipeng.zhao](https://discuss.elastic.co/u/haipeng.zhao)\ **Replies:** 2\ **Last updated:** [December 21, 2021, 5:34am UTC](https://discuss.elastic.co/t/caught-exception-while-handling-client-http-traffic-closing-connection-netty4httpchannel-localaddress/292440 "2021-12-21T05:34:38Z")
My hot node is already outputting this log. What is the problem? {"type": "server", "timestamp": "2021-12-17T19:45:21,865Z", "level": "WARN", "component": "o.e.h.AbstractHttpServerTransport", "cluster.name": "dev", "nod… --- ## [FATAL Error: Unable to complete saved object migrations for the \[.kibana\] index: Unable to complete the OUTDATED\_DOCUMENTS\_SEARCH\_OPEN\_PIT step after 15 attempts, terminating](https://discuss.elastic.co/t/fatal-error-unable-to-complete-saved-object-migrations-for-the-kibana-index-unable-to-complete-the-outdated-documents-search-open-pit-step-after-15-attempts-terminating/292210)
**Author:** [@user23](https://discuss.elastic.co/u/user23)\ **Replies:** 4\ **Last updated:** [December 21, 2021, 5:17am UTC](https://discuss.elastic.co/t/fatal-error-unable-to-complete-saved-object-migrations-for-the-kibana-index-unable-to-complete-the-outdated-documents-search-open-pit-step-after-15-attempts-terminating/292210 "2021-12-21T05:17:39Z")
HI!HOW CAN I SOLVE THIS PROBLEM? WHEN I OPEN KIBANA 7.15 VERSION FATAL Error: Unable to complete saved object migrations for the \[.kibana\] index: Unable to complete the OUTDATED\_DOCUMENTS\_SEARCH\_OPEN\_PIT step after 15 … --- ## [Watcher for Heartbeat : challenging questions](https://discuss.elastic.co/t/watcher-for-heartbeat-challenging-questions/292454)
**Author:** [@appleyin1](https://discuss.elastic.co/u/appleyin1)\ **Replies:** 0\ **Last updated:** [December 20, 2021, 11:34am UTC](https://discuss.elastic.co/t/watcher-for-heartbeat-challenging-questions/292454 "2021-12-20T11:34:10Z")
Hi there: Need your advice in the following, “A cluster has configured with the heartbeat check for 10 URL. If 1 out of 10 heartbeat of the URL is down I would like the Watcher to be able send an email with monitor ID … --- ## [Elastic Cluster State Restore never really works for .kibana-x.x.x index (workarounds need to be applied)](https://discuss.elastic.co/t/elastic-cluster-state-restore-never-really-works-for-kibana-x-x-x-index-workarounds-need-to-be-applied/292491)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 0\ **Last updated:** [December 20, 2021, 4:37pm UTC](https://discuss.elastic.co/t/elastic-cluster-state-restore-never-really-works-for-kibana-x-x-x-index-workarounds-need-to-be-applied/292491 "2021-12-20T16:37:04Z")
Hi, when I try to restore cluster state of a cluster with different version (for example right now I want to restore 7.13.2 to 7.16.2) from a snapshot the .kibana instance always crashes with the error: "type":"log","@… --- ## [Search Template : Watcher](https://discuss.elastic.co/t/search-template-watcher/292515)
**Author:** [@appleyin1](https://discuss.elastic.co/u/appleyin1)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 3:36am UTC](https://discuss.elastic.co/t/search-template-watcher/292515 "2021-12-21T03:36:15Z")
Is that possible to create watcher with conditions and send an email if the conditions meet in a search template? Thanks --- ## [Wireshark json file cannot display in separate fields in Elasticsearch](https://discuss.elastic.co/t/wireshark-json-file-cannot-display-in-separate-fields-in-elasticsearch/291381)
**Author:** [@lauyatkin](https://discuss.elastic.co/u/lauyatkin)\ **Replies:** 30\ **Last updated:** [December 21, 2021, 2:38am UTC](https://discuss.elastic.co/t/wireshark-json-file-cannot-display-in-separate-fields-in-elasticsearch/291381 "2021-12-21T02:38:42Z")
I have investigated for a month and still cannot find a solution to structure the json data captured by Wireshark. I am using FileBeat in Elastic to import json data. However, all the json data are packed to the "message… --- ## [What is "score" in elasticsearch](https://discuss.elastic.co/t/what-is-score-in-elasticsearch/292498)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [December 21, 2021, 1:32am UTC](https://discuss.elastic.co/t/what-is-score-in-elasticsearch/292498 "2021-12-21T01:32:55Z")
I want to understand the concept of score in Elasticsearch with an example and how it is work search engine. --- ## [Restoring deleted indexes from a data stream](https://discuss.elastic.co/t/restoring-deleted-indexes-from-a-data-stream/292512)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 0\ **Last updated:** [December 20, 2021, 11:29pm UTC](https://discuss.elastic.co/t/restoring-deleted-indexes-from-a-data-stream/292512 "2021-12-20T23:29:52Z")
I bungled setting up the retention policy for a data stream with the result that a bunch of indexes have been deleted when they should not have been. I have snapshots of most of the indexes scattered across several snap… --- ## [Default language for language detection](https://discuss.elastic.co/t/default-language-for-language-detection/292470)
**Author:** [@uu99ix](https://discuss.elastic.co/u/uu99ix)\ **Replies:** 2\ **Last updated:** [December 21, 2021, 1:01am UTC](https://discuss.elastic.co/t/default-language-for-language-detection/292470 "2021-12-21T01:01:37Z")
I don't know if this is the right category to post under, sorry if it's not. I followed this guide: Language identification | Machine Learning in the Elastic Stack \[7.16\] | Elastic and it seems to return Japanese ("ja")… --- ## [Invalid snapshot name, snapshot with the same name already exists](https://discuss.elastic.co/t/invalid-snapshot-name-snapshot-with-the-same-name-already-exists/292497)
**Author:** [@Ludovic9](https://discuss.elastic.co/u/Ludovic9)\ **Replies:** 3\ **Last updated:** [December 20, 2021, 11:29pm UTC](https://discuss.elastic.co/t/invalid-snapshot-name-snapshot-with-the-same-name-already-exists/292497 "2021-12-20T23:29:26Z")
Hello I have an index in my cluster with datas. The datas are shipped from logstatsh with this configuration index =\> "%{\[@metadata\]\[beat\]}-%{\[@metadata\]\[version\]}-%{+YYYY.MM}" So the index is named with the year and … --- ## [Osquery results don't come in: "matching app is not found for action input: osquery"](https://discuss.elastic.co/t/osquery-results-dont-come-in-matching-app-is-not-found-for-action-input-osquery/292381)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 6\ **Last updated:** [December 20, 2021, 11:14pm UTC](https://discuss.elastic.co/t/osquery-results-dont-come-in-matching-app-is-not-found-for-action-input-osquery/292381 "2021-12-20T23:14:45Z")
Hey, unfortunately, I managed to break my OSQuery integrations again. A simple query like SELECT \* FROM os\_version; yields the error message matching app is not found for action input: osquery for most of my hosts. Ed… --- ## [Kibana Report Generation Timeout](https://discuss.elastic.co/t/kibana-report-generation-timeout/292238)
**Author:** [@TASI](https://discuss.elastic.co/u/TASI)\ **Replies:** 3\ **Last updated:** [December 20, 2021, 10:58pm UTC](https://discuss.elastic.co/t/kibana-report-generation-timeout/292238 "2021-12-20T22:58:51Z")
We currently have Elasticsearch, Logstash and Kibana installed (version 7.16.1).. We use scripts to generate and download data from Kibana/Elasticsearch using curl and a POST URL. One intermittent issue we have been fac… --- ## [Elasticsearch OSS](https://discuss.elastic.co/t/elasticsearch-oss/292501)
**Author:** [@kfull6\_nike](https://discuss.elastic.co/u/kfull6_nike)\ **Replies:** 4\ **Last updated:** [December 20, 2021, 10:03pm UTC](https://discuss.elastic.co/t/elasticsearch-oss/292501 "2021-12-20T22:03:42Z")
I noticed that for the latest log4j2 vulnerabilities ES was updated. Any idea if and when Elasticsearch-oss will be updated? [Previous page](https://discuss.elastic.co/latest.md?page=1335) [Next page](https://discuss.elastic.co/latest.md?page=1337)