# Latest **URL:** https://discuss.elastic.co/latest.md?page=1776 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1777 --- ## [BEATS input: org.logstash.FieldReference$IllegalSyntaxException: Invalid FieldReference: \`string\[\]\`](https://discuss.elastic.co/t/beats-input-org-logstash-fieldreference-illegalsyntaxexception-invalid-fieldreference-string/267781)
**Author:** [@zarak](https://discuss.elastic.co/u/zarak)\ **Replies:** 0\ **Last updated:** [March 19, 2021, 9:46am UTC](https://discuss.elastic.co/t/beats-input-org-logstash-fieldreference-illegalsyntaxexception-invalid-fieldreference-string/267781 "2021-03-19T09:46:57Z")
Hello, I've setup a basic filebeat to logstash infra, but I keep on getting this kind of error in logstash' logs: Mar 19 10:42:33 logstash\[5912\]: \[2021-03-19T10:42:33,892\]\[INFO \]\[org.logstash.beats.BeatsHandler\]\[http-i… --- ## [Removing unwanted data in Filebeats / Logstash](https://discuss.elastic.co/t/removing-unwanted-data-in-filebeats-logstash/267774)
**Author:** [@h\_q](https://discuss.elastic.co/u/h_q)\ **Replies:** 0\ **Last updated:** [March 19, 2021, 9:29am UTC](https://discuss.elastic.co/t/removing-unwanted-data-in-filebeats-logstash/267774 "2021-03-19T09:29:13Z")
I started ingesting Kubernetes logs into ElasticSearch, using the Filebeat Input Container: Filebeat -\> Logstash -\> ElasticSearch My filebeat.yml looks like this: - type: container paths: - /var/lib/docker/conta… --- ## [Is it possible to Return only one filed with Id](https://discuss.elastic.co/t/is-it-possible-to-return-only-one-filed-with-id/267664)
**Author:** [@mayank\_hardiya](https://discuss.elastic.co/u/mayank_hardiya)\ **Replies:** 2\ **Last updated:** [March 19, 2021, 9:03am UTC](https://discuss.elastic.co/t/is-it-possible-to-return-only-one-filed-with-id/267664 "2021-03-19T09:03:18Z")
\[ { "\_index": "onlive", "\_type": "\_doc", "\_id": "584", "\_score": 1, "\_source": { "description": "Free group Yoga session !!! for all levels Experience authentic Yoga from ancient scriptures", "name": "Free Yoga 1… --- ## [Is the below sizing fits for mentioned use case?](https://discuss.elastic.co/t/is-the-below-sizing-fits-for-mentioned-use-case/266855)
**Author:** [@Jax\_dev](https://discuss.elastic.co/u/Jax_dev)\ **Replies:** 12\ **Last updated:** [March 19, 2021, 9:01am UTC](https://discuss.elastic.co/t/is-the-below-sizing-fits-for-mentioned-use-case/266855 "2021-03-19T09:01:39Z")
I have been reading many documents to understand about sizing about elastic search... Data load: 9k transactions per second Each transaction contains around 1kb of data. Per second, 9k inserts and 50k search queries w… --- ## [Filebeat PostgreSQL module not parsing message](https://discuss.elastic.co/t/filebeat-postgresql-module-not-parsing-message/267464)
**Author:** [@martinfrancois](https://discuss.elastic.co/u/martinfrancois)\ **Replies:** 2\ **Last updated:** [March 19, 2021, 9:01am UTC](https://discuss.elastic.co/t/filebeat-postgresql-module-not-parsing-message/267464 "2021-03-19T09:01:37Z")
We are using filebeat 7.11.0 along with the postgresql module. However for some reason, the message attribute seems not to be touched, although some metadata seems to be added by the module. Our log messages look to be … --- ## [Got error "No processor type exists with name \[attachment\]](https://discuss.elastic.co/t/got-error-no-processor-type-exists-with-name-attachment/267741)
**Author:** [@lxia](https://discuss.elastic.co/u/lxia)\ **Replies:** 4\ **Last updated:** [March 19, 2021, 8:57am UTC](https://discuss.elastic.co/t/got-error-no-processor-type-exists-with-name-attachment/267741 "2021-03-19T08:57:20Z")
have installed ingest-attachment on the host, and also restart the service "sudo systemctl restart elasticsearch.service". and get the message on the host: elasticsearch@CNSHZ-Amarisoft-OptiPlex-7050:/usr/local/elastic… --- ## [ClusterBlockException : All shards failed](https://discuss.elastic.co/t/clusterblockexception-all-shards-failed/267755)
**Author:** [@onkark](https://discuss.elastic.co/u/onkark)\ **Replies:** 4\ **Last updated:** [March 19, 2021, 8:34am UTC](https://discuss.elastic.co/t/clusterblockexception-all-shards-failed/267755 "2021-03-19T08:34:09Z")
Hi, I am getting the error like org.elasticsearch.cluster.block.ClusterBlockException : blocked by : \[SERVICE\_UNAVAILABLE/1/state not recovered/initialized\] where the cluster health status is YELLOW and primary shards … --- ## [Synonyms and/or synonym graph for mapping product names to other names](https://discuss.elastic.co/t/synonyms-and-or-synonym-graph-for-mapping-product-names-to-other-names/267678)
**Author:** [@Robert\_SL](https://discuss.elastic.co/u/Robert_SL)\ **Replies:** 0\ **Last updated:** [March 18, 2021, 2:05pm UTC](https://discuss.elastic.co/t/synonyms-and-or-synonym-graph-for-mapping-product-names-to-other-names/267678 "2021-03-18T14:05:56Z")
(Elastic Cloud 6.8) I have a requirement when searching for a product name to also return a different product that will replace it in the future. For example, when the user searches for "Product ABC", I also want to re… --- ## [How to implement join-fields with Spring Data Elasticsearch 4.0.0](https://discuss.elastic.co/t/how-to-implement-join-fields-with-spring-data-elasticsearch-4-0-0/267661)
**Author:** [@matt4](https://discuss.elastic.co/u/matt4)\ **Replies:** 2\ **Last updated:** [March 19, 2021, 7:50am UTC](https://discuss.elastic.co/t/how-to-implement-join-fields-with-spring-data-elasticsearch-4-0-0/267661 "2021-03-19T07:50:49Z")
Hi, I am using Spring Data Elasticsearch 4.0.0 and I would like to establish a parent-child-relationship between my entities. I found out that @JoinTypeRelation comes with version 4.1.X, but unfortunately, I am stuck wi… --- ## [Help please: logstash start error](https://discuss.elastic.co/t/help-please-logstash-start-error/267630)
**Author:** [@toufiq\_khan](https://discuss.elastic.co/u/toufiq_khan)\ **Replies:** 2\ **Last updated:** [March 19, 2021, 8:08am UTC](https://discuss.elastic.co/t/help-please-logstash-start-error/267630 "2021-03-19T08:08:15Z")
logstash showing this error Using bundled JDK: /usr/share/logstash/jdk OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release. WARNING:… --- ## [No results found in kabana discover page](https://discuss.elastic.co/t/no-results-found-in-kabana-discover-page/267242)
**Author:** [@Ravikumar.P](https://discuss.elastic.co/u/Ravikumar.P)\ **Replies:** 2\ **Last updated:** [March 19, 2021, 8:05am UTC](https://discuss.elastic.co/t/no-results-found-in-kabana-discover-page/267242 "2021-03-19T08:05:05Z")
Hi I am new to elastic search and kibana I am facing the below issues. When I select 30days time range only I could see the data until February 19th 2021, 14:01:51. How to get the latest data --- ## [Bytes can be at most 32766 in length got 36716](https://discuss.elastic.co/t/bytes-can-be-at-most-32766-in-length-got-36716/267463)
**Author:** [@ajaythakor](https://discuss.elastic.co/u/ajaythakor)\ **Replies:** 3\ **Last updated:** [March 19, 2021, 7:56am UTC](https://discuss.elastic.co/t/bytes-can-be-at-most-32766-in-length-got-36716/267463 "2021-03-19T07:56:36Z")
I have created new index named tbxmlcs Then I have added mapping: { "properties": { "34084-4": { "type": "keyword", "fields": { "keyword":{ "type":"keyword", "igno… --- ## [Include/Exclude for cardinality aggregation](https://discuss.elastic.co/t/include-exclude-for-cardinality-aggregation/267759)
**Author:** [@robmartin11](https://discuss.elastic.co/u/robmartin11)\ **Replies:** 0\ **Last updated:** [March 19, 2021, 7:50am UTC](https://discuss.elastic.co/t/include-exclude-for-cardinality-aggregation/267759 "2021-03-19T07:50:01Z")
I have a terms aggregation with an IncludeExclude filter: { "size": 0, "query": { ... }, "aggregations": { "facets": { "terms": { "field": "type\_id", "size": 20, "order": \[ … --- ## [inputで取得したjsonの特定の要素をElasticsearchに登録したい](https://discuss.elastic.co/t/input-json-elasticsearch/267733)
**Author:** [@Ryosuke.mm](https://discuss.elastic.co/u/Ryosuke.mm)\ **Replies:** 2\ **Last updated:** [March 19, 2021, 7:36am UTC](https://discuss.elastic.co/t/input-json-elasticsearch/267733 "2021-03-19T07:36:59Z")
logstashに関して、inputで取得したjsonが以下のような形式の場合に、issuesの1要素を Elasticsearchの1ドキュメントとして登録したいと考えております。 Blockquote { "issues": \[ { "id": 1, "FieldA": "1" }, { "id": 2, "FieldA": "2" }, \], "total\_count": "2", "timesta… --- ## [Upgrading Elasticsearch in Kubernetes using Helm](https://discuss.elastic.co/t/upgrading-elasticsearch-in-kubernetes-using-helm/267752)
**Author:** [@am\_Pg](https://discuss.elastic.co/u/am_Pg)\ **Replies:** 0\ **Last updated:** [March 19, 2021, 5:52am UTC](https://discuss.elastic.co/t/upgrading-elasticsearch-in-kubernetes-using-helm/267752 "2021-03-19T05:52:53Z")
Hello! Is it possible to upgrade Elasticsearch in Kubernetes using Helm from version 5.4.2 to 6.8? I saw this guide from Elastic https://www.elastic.co/guide/en/elasticsearch/reference/6.8/rolling-upgrades.html. I was w… --- ## [Cloud aws module IAM permissions for filebeat](https://discuss.elastic.co/t/cloud-aws-module-iam-permissions-for-filebeat/267617)
**Author:** [@AJ18](https://discuss.elastic.co/u/AJ18)\ **Replies:** 3\ **Last updated:** [March 19, 2021, 5:21am UTC](https://discuss.elastic.co/t/cloud-aws-module-iam-permissions-for-filebeat/267617 "2021-03-19T05:21:44Z")
What are the minimum set of permissions the cloud-aws plugin requires to work with filebeat? --- ## [Document level security for watchers](https://discuss.elastic.co/t/document-level-security-for-watchers/267749)
**Author:** [@sireesha\_m](https://discuss.elastic.co/u/sireesha_m)\ **Replies:** 0\ **Last updated:** [March 19, 2021, 5:16am UTC](https://discuss.elastic.co/t/document-level-security-for-watchers/267749 "2021-03-19T05:16:22Z")
Hi all, I would like to have document level security for watches. I saw that unless I give "manage\_watcher" role, I was not able to create watches. Is it possible to give a query on metadata of watch for example? I tri… --- ## [Kibana でのリバースプロキシ設定](https://discuss.elastic.co/t/kibana/267627)
**Author:** [@vavan](https://discuss.elastic.co/u/vavan)\ **Replies:** 1\ **Last updated:** [March 19, 2021, 4:11am UTC](https://discuss.elastic.co/t/kibana/267627 "2021-03-19T04:11:12Z")
現在、 kibanaへのアクセスを 80ポートで行うためにリバースプロキシ設定をしようとしています。 kibanaは 7.8.１＋apache 2.4を利用しています。 ちょうど下記サイトがビンゴな内容だったので、この通りの設定にしているのですが、 ここで http://hostname/kibana にアクセスすると、Login画面にリダイレクトするのですが、 --- ## [Create a Automation Between List API and Github Repo](https://discuss.elastic.co/t/create-a-automation-between-list-api-and-github-repo/267434)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 6\ **Last updated:** [March 19, 2021, 4:10am UTC](https://discuss.elastic.co/t/create-a-automation-between-list-api-and-github-repo/267434 "2021-03-19T04:10:29Z")
I want to create a automation using the List API like the image below and a github repo so whenever I update the github repo that it will automatically update the corresponding lists in Elastic. How would I got about t… --- ## [Delete by query not working](https://discuss.elastic.co/t/delete-by-query-not-working/267652)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 4\ **Last updated:** [March 19, 2021, 3:10am UTC](https://discuss.elastic.co/t/delete-by-query-not-working/267652 "2021-03-19T03:10:24Z")
Hi all, I have an index with documents of username : 220987,220388,1218383. I want to delete all documents with username starting with 22. So i used below code: POST /snmp-ser-my-thyalytics-com/\_delete\_by\_query { … --- ## [X-ndjson build request from .NET error](https://discuss.elastic.co/t/x-ndjson-build-request-from-net-error/267681)
**Author:** [@roman.pavliuk](https://discuss.elastic.co/u/roman.pavliuk)\ **Replies:** 1\ **Last updated:** [March 19, 2021, 3:06am UTC](https://discuss.elastic.co/t/x-ndjson-build-request-from-net-error/267681 "2021-03-19T03:06:58Z")
I am sending content-Type/x-ndjson from my .net core app, but I have got error with incorrect header, or 400(bad request) or error below! { "error": { "root\_cause": \[ { "type": "illegal\_argument\_exception", "reason… --- ## [Way to get summary of content](https://discuss.elastic.co/t/way-to-get-summary-of-content/267739)
**Author:** [@jaru\_kim](https://discuss.elastic.co/u/jaru_kim)\ **Replies:** 0\ **Last updated:** [March 19, 2021, 2:29am UTC](https://discuss.elastic.co/t/way-to-get-summary-of-content/267739 "2021-03-19T02:29:55Z")
I am testing query for index that has documents. { "query": { "bool": { "should": \[ { "match": { "title": "test.docx" } }, … --- ## [Winlogbeats add public IP info](https://discuss.elastic.co/t/winlogbeats-add-public-ip-info/267542)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 3\ **Last updated:** [March 19, 2021, 1:58am UTC](https://discuss.elastic.co/t/winlogbeats-add-public-ip-info/267542 "2021-03-19T01:58:52Z")
Is there anyway with winlogbeats to get the devices current public IP and add that to the event data? --- ## [Displaying custom data into the SIEM map](https://discuss.elastic.co/t/displaying-custom-data-into-the-siem-map/267735)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 0\ **Last updated:** [March 19, 2021, 1:32am UTC](https://discuss.elastic.co/t/displaying-custom-data-into-the-siem-map/267735 "2021-03-19T01:32:50Z")
Hi im trying to display data in the SIEM map, using ECS, Im getting the data from a database using logstash JDBC this is the template for the index PUT \_template/ecs { "mappings": { "properties": { "@times… --- ## [Is this going to be efficient elasticsearch output config in logstash?](https://discuss.elastic.co/t/is-this-going-to-be-efficient-elasticsearch-output-config-in-logstash/267734)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 2\ **Last updated:** [March 19, 2021, 1:32am UTC](https://discuss.elastic.co/t/is-this-going-to-be-efficient-elasticsearch-output-config-in-logstash/267734 "2021-03-19T01:32:04Z")
I am planning to use ILM in logstash. And there is a note saying : You cannot use dynamic variable substitution when ilm\_enabled is true and when using ilm\_rollover\_alias. At the same time this is also there: In order … --- ## [Custom name for http certificate in elastic cluster](https://discuss.elastic.co/t/custom-name-for-http-certificate-in-elastic-cluster/267009)
**Author:** [@dzyubanv](https://discuss.elastic.co/u/dzyubanv)\ **Replies:** 9\ **Last updated:** [March 19, 2021, 12:31am UTC](https://discuss.elastic.co/t/custom-name-for-http-certificate-in-elastic-cluster/267009 "2021-03-19T00:31:19Z")
Hi elastic engineers, I have a few questions in regards to the certificate generation process \[1\] Is it allowed to use custom name for http certificate instead of default http.p12 ? The elasticsearch-certutil does all… --- ## [How to get store size for each filebeat module?](https://discuss.elastic.co/t/how-to-get-store-size-for-each-filebeat-module/267504)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 1\ **Last updated:** [March 19, 2021, 12:08am UTC](https://discuss.elastic.co/t/how-to-get-store-size-for-each-filebeat-module/267504 "2021-03-19T00:08:31Z")
Hi, The total store size of our filebeat-\* indices is 242GB. This indices is a combination of system, apache, and mssql modules. Is there any way how we can get store size of each module? Appreciate the reply … --- ## [Stop exporting logs after file reaches a certain size](https://discuss.elastic.co/t/stop-exporting-logs-after-file-reaches-a-certain-size/267712)
**Author:** [@agushchin](https://discuss.elastic.co/u/agushchin)\ **Replies:** 3\ **Last updated:** [March 18, 2021, 11:26pm UTC](https://discuss.elastic.co/t/stop-exporting-logs-after-file-reaches-a-certain-size/267712 "2021-03-18T23:26:28Z")
Hi, I have the following question/problem: is there a way to stop logstash sending logs to ES after the log file reaches a certain size limit (or some other limit is reached)? Asking because recently faced an issue caus… --- ## [Unable to load the xml document to elastic search](https://discuss.elastic.co/t/unable-to-load-the-xml-document-to-elastic-search/267403)
**Author:** [@sdeven](https://discuss.elastic.co/u/sdeven)\ **Replies:** 5\ **Last updated:** [March 18, 2021, 10:24pm UTC](https://discuss.elastic.co/t/unable-to-load-the-xml-document-to-elastic-search/267403 "2021-03-18T22:24:15Z")
Hi Team, I am trying to load the whole xml document to elastic search using logstash. I don't see any errors in the logstash console, and the document is not there in elastic search also. my config file below. input { … --- ## [Is this the correct approach of taking a snapshop of an indice which is in production?](https://discuss.elastic.co/t/is-this-the-correct-approach-of-taking-a-snapshop-of-an-indice-which-is-in-production/267526)
**Author:** [@Jax\_dev](https://discuss.elastic.co/u/Jax_dev)\ **Replies:** 10\ **Last updated:** [March 18, 2021, 10:06pm UTC](https://discuss.elastic.co/t/is-this-the-correct-approach-of-taking-a-snapshop-of-an-indice-which-is-in-production/267526 "2021-03-18T22:06:18Z")
I have 4 different elastic nodes in a cluster. Want to take a snapshot from one of the server which is having primary shard. Step 1: sudo systemctl stop elasticsearch Step 2: add path.repo: \["/data/elasticbackup"\] in… [Previous page](https://discuss.elastic.co/latest.md?page=1775) [Next page](https://discuss.elastic.co/latest.md?page=1777)