# Latest **URL:** https://discuss.elastic.co/latest.md?page=820 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 821 --- ## [Elasticsearch stuck in ApplyingChanges phase on Openshift](https://discuss.elastic.co/t/elasticsearch-stuck-in-applyingchanges-phase-on-openshift/323228)
**Author:** [@TimTim](https://discuss.elastic.co/u/TimTim)\ **Replies:** 1\ **Last updated:** [January 16, 2023, 3:07pm UTC](https://discuss.elastic.co/t/elasticsearch-stuck-in-applyingchanges-phase-on-openshift/323228 "2023-01-16T15:07:59Z")
Hi! We're running Openshift 4.11 and we've installed ECK 2.6.2. I start an Elasticsearch instance with this YAML code (copied from the quickstart doc): cat \<\ **Author:** [@karpediemnow](https://discuss.elastic.co/u/karpediemnow)\ **Replies:** 5\ **Last updated:** [January 16, 2023, 2:51pm UTC](https://discuss.elastic.co/t/net-core-nlog-correlation-not-showing-when-using-auto-instrumentation-profiler-or-zero-code-change-startup-hook/319089 "2023-01-16T14:51:41Z") HI, following the documentation about Log correlation ( Link ) I have added the Elastic.Apm.NLog.dll and the following entries into NLog.config file but the ElasticApmTraceId and ElasticApmTransactionId are not sho… --- ## [Kibana Kubernetes Dashboard - Metric issue](https://discuss.elastic.co/t/kibana-kubernetes-dashboard-metric-issue/323252)
**Author:** [@Swathi12](https://discuss.elastic.co/u/Swathi12)\ **Replies:** 5\ **Last updated:** [January 16, 2023, 2:31pm UTC](https://discuss.elastic.co/t/kibana-kubernetes-dashboard-metric-issue/323252 "2023-01-16T14:31:09Z")
Hi, i am currently working on kubernetes-metricbeat and in kibana dashboard the metrics in kibana are available only on weekdays. At the weekend the metrics are not anymore available and everything is crashed.... Does … --- ## [Kibana development server up and running, but not picking up changes](https://discuss.elastic.co/t/kibana-development-server-up-and-running-but-not-picking-up-changes/323253)
**Author:** [@mpjjonker](https://discuss.elastic.co/u/mpjjonker)\ **Replies:** 6\ **Last updated:** [January 16, 2023, 2:17pm UTC](https://discuss.elastic.co/t/kibana-development-server-up-and-running-but-not-picking-up-changes/323253 "2023-01-16T14:17:20Z")
Hi, I have followed the instructions to setup a development environment for plugin development. I also do see the first attempt (created by the create-plugin-script), but when I make a change to any of the files (publi… --- ## [Logstash horizontal autoscaling](https://discuss.elastic.co/t/logstash-horizontal-autoscaling/323256)
**Author:** [@yuvalweber](https://discuss.elastic.co/u/yuvalweber)\ **Replies:** 0\ **Last updated:** [January 16, 2023, 2:10pm UTC](https://discuss.elastic.co/t/logstash-horizontal-autoscaling/323256 "2023-01-16T14:10:50Z")
I want to create autoscaling for our logstash based on prometheus queries we have from the api of logstash. I am using Persistent Queue has a way for backing up our messages in case of disaster and I thought that based … --- ## [Coremigration error while importing dashboards from dev instance to prod instance](https://discuss.elastic.co/t/coremigration-error-while-importing-dashboards-from-dev-instance-to-prod-instance/323239)
**Author:** [@krishnaabylle](https://discuss.elastic.co/u/krishnaabylle)\ **Replies:** 2\ **Last updated:** [January 16, 2023, 2:08pm UTC](https://discuss.elastic.co/t/coremigration-error-while-importing-dashboards-from-dev-instance-to-prod-instance/323239 "2023-01-16T14:08:13Z")
Hi everyone Can anyone help me with this error.We have a dev and prod instance.i exported one dashboard in dev and While migrating dashboard from dev instance to prod instane getting the error as … --- ## [How to add new node to Elasticsearch cluster with Https](https://discuss.elastic.co/t/how-to-add-new-node-to-elasticsearch-cluster-with-https/322942)
**Author:** [@makkaroni8](https://discuss.elastic.co/u/makkaroni8)\ **Replies:** 7\ **Last updated:** [January 16, 2023, 2:00pm UTC](https://discuss.elastic.co/t/how-to-add-new-node-to-elasticsearch-cluster-with-https/322942 "2023-01-16T14:00:19Z")
Hi, I'm using a single-node Elasticsearch instance. I want to add another node to my cluster by Enrolling the new node. But I have the same Issue: ERROR: Failed to determine the health of the cluster with elasticsearc… --- ## [Winlogbeat to Logstash over SSL](https://discuss.elastic.co/t/winlogbeat-to-logstash-over-ssl/322705)
**Author:** [@Mark\_Marais](https://discuss.elastic.co/u/Mark_Marais)\ **Replies:** 11\ **Last updated:** [January 16, 2023, 1:56pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-over-ssl/322705 "2023-01-16T13:56:11Z")
Good day, Can someone assist me with a secure connection from my beats to my logstash instances. Thanks. --- ## [Query dsl span\_or vs bool should](https://discuss.elastic.co/t/query-dsl-span-or-vs-bool-should/323254)
**Author:** [@IvanTushin](https://discuss.elastic.co/u/IvanTushin)\ **Replies:** 0\ **Last updated:** [January 16, 2023, 1:34pm UTC](https://discuss.elastic.co/t/query-dsl-span-or-vs-bool-should/323254 "2023-01-16T13:34:13Z")
Hi! I have two "span\_near" queries. What's the difference between bool-\>should and span\_or? Does it affect on "index.query.bool.max\_clause\_count" limit or query performance? { "span\_or": { "clauses": \[ … --- ## [Kibana REST API for integrations setup](https://discuss.elastic.co/t/kibana-rest-api-for-integrations-setup/322151)
**Author:** [@OlLap](https://discuss.elastic.co/u/OlLap)\ **Replies:** 16\ **Last updated:** [January 16, 2023, 12:49pm UTC](https://discuss.elastic.co/t/kibana-rest-api-for-integrations-setup/322151 "2023-01-16T12:49:24Z")
Hello, I have installed Elastic stack using ECK (Elasticsearch, Kibana, Beats, APM Server + agents), and trying to automate setup moving manual configuration steps to Kubernetes jobs that use Elasticsearch REST API. Bu… --- ## [Elasticearch and Power BI](https://discuss.elastic.co/t/elasticearch-and-power-bi/323250)
**Author:** [@palko.balazs](https://discuss.elastic.co/u/palko.balazs)\ **Replies:** 0\ **Last updated:** [January 16, 2023, 12:35pm UTC](https://discuss.elastic.co/t/elasticearch-and-power-bi/323250 "2023-01-16T12:35:02Z")
Hi, I'm trying to import our data stored in Elasticsearch into a BI Tool. I tried Power BI with ODBC using this guide and this guide for Tableau. I was able to get our data into both PowerBi and Tableau, however I'm st… --- ## [Need proper example and resource for xml filter plugin](https://discuss.elastic.co/t/need-proper-example-and-resource-for-xml-filter-plugin/323087)
**Author:** [@Nikhil27](https://discuss.elastic.co/u/Nikhil27)\ **Replies:** 3\ **Last updated:** [January 16, 2023, 12:25pm UTC](https://discuss.elastic.co/t/need-proper-example-and-resource-for-xml-filter-plugin/323087 "2023-01-16T12:25:38Z")
I want to parse unstructured xml log data.I am not getting any proper resource for reference.The xml filter plugin documentation is not that able to sort my problem. I am new to the ELK please help me out of this.... --- ## [Filebeat's add\_docker\_metadata stop working after container restart](https://discuss.elastic.co/t/filebeats-add-docker-metadata-stop-working-after-container-restart/322358)
**Author:** [@kowy](https://discuss.elastic.co/u/kowy)\ **Replies:** 1\ **Last updated:** [January 16, 2023, 12:22pm UTC](https://discuss.elastic.co/t/filebeats-add-docker-metadata-stop-working-after-container-restart/322358 "2023-01-16T12:22:00Z")
We use filebeat from Graylog to collect logs from services run in docker-compose. Filebeat is not started as a linux service, but executed as this command: sudo /usr/share/filebeat/bin/filebeat --path.home /usr/share/f… --- ## [Watcher - send runtime field in a Slack message](https://discuss.elastic.co/t/watcher-send-runtime-field-in-a-slack-message/323235)
**Author:** [@Darko\_Krstevski](https://discuss.elastic.co/u/Darko_Krstevski)\ **Replies:** 0\ **Last updated:** [January 16, 2023, 10:36am UTC](https://discuss.elastic.co/t/watcher-send-runtime-field-in-a-slack-message/323235 "2023-01-16T10:36:12Z")
Hi All. I've created runtime mapping (field), transaction.duration.sec, which contains converted (in seconds) value of the "original" transaction duration (expressed in microseconds), with the following watcher configur… --- ## [Using wildcard and must\_not to search](https://discuss.elastic.co/t/using-wildcard-and-must-not-to-search/323236)
**Author:** [@geeky\_human](https://discuss.elastic.co/u/geeky_human)\ **Replies:** 1\ **Last updated:** [January 16, 2023, 11:12am UTC](https://discuss.elastic.co/t/using-wildcard-and-must-not-to-search/323236 "2023-01-16T11:12:27Z")
Hi, I’m new to ELK. For searching, I’m using dev tools in kibana. I want to find all the results that do not match a wildcard term. "must\_not": \[ {"wildcard": { "agent.keyword": {"value":"python\*"} }}\] I… --- ## [Elastic Logging Plugin for Docker: "error creating client config: A hosts flag is required"](https://discuss.elastic.co/t/elastic-logging-plugin-for-docker-error-creating-client-config-a-hosts-flag-is-required/323202)
**Author:** [@kthy](https://discuss.elastic.co/u/kthy)\ **Replies:** 1\ **Last updated:** [January 16, 2023, 11:12am UTC](https://discuss.elastic.co/t/elastic-logging-plugin-for-docker-error-creating-client-config-a-hosts-flag-is-required/323202 "2023-01-16T11:12:18Z")
This question is about the Elastic Logging Plugin for Docker , which doesn't have it's own category on the Elastic forums. Sad. I have tried creating a docker container with the Elastic logging plugin, but I get an erro… --- ## [Please keep the old expand document, the new "pop-out" makes everything slow](https://discuss.elastic.co/t/please-keep-the-old-expand-document-the-new-pop-out-makes-everything-slow/322941)
**Author:** [@blommis](https://discuss.elastic.co/u/blommis)\ **Replies:** 6\ **Last updated:** [January 16, 2023, 10:54am UTC](https://discuss.elastic.co/t/please-keep-the-old-expand-document-the-new-pop-out-makes-everything-slow/322941 "2023-01-16T10:54:30Z")
We just upgraded version and expanding a document in the table is now in a popup covering halv the screen. Before this change it was shown as more details below every row, making it possible to view details on multiple … --- ## [Elasticsearch DSL Query - Field is not null or not empty](https://discuss.elastic.co/t/elasticsearch-dsl-query-field-is-not-null-or-not-empty/323005)
**Author:** [@Java2avaj](https://discuss.elastic.co/u/Java2avaj)\ **Replies:** 8\ **Last updated:** [January 16, 2023, 10:49am UTC](https://discuss.elastic.co/t/elasticsearch-dsl-query-field-is-not-null-or-not-empty/323005 "2023-01-16T10:49:18Z")
I have an existing DSL query that needs to modify such that the id "12345" should be not null or not empty: { "bool":{ "must":\[ { "bool":{ "should":\[ { … --- ## [Cache tunning for cardinality](https://discuss.elastic.co/t/cache-tunning-for-cardinality/323015)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 5\ **Last updated:** [January 16, 2023, 10:41am UTC](https://discuss.elastic.co/t/cache-tunning-for-cardinality/323015 "2023-01-16T10:41:25Z")
Hi I'm troubleshooting some wired case related to maybe cache ... so when I'm using simple query by curl for the first shoot I got something like below {"detail":"3,000 milliseconds timeout on connection http-outgoing-… --- ## [This node is locked](https://discuss.elastic.co/t/this-node-is-locked/323040)
**Author:** [@Randomize](https://discuss.elastic.co/u/Randomize)\ **Replies:** 11\ **Last updated:** [January 16, 2023, 10:25am UTC](https://discuss.elastic.co/t/this-node-is-locked/323040 "2023-01-16T10:25:02Z")
Hello I updated elasticsearch to version 8.4.1 Now im trying to start elasticsearch using discovery.type: single-node in config file. But its does not starting. I can see status activating in systemctl status. In elast… --- ## [Gsub processor in ingest pipeline cannot substitute a pattern into newline](https://discuss.elastic.co/t/gsub-processor-in-ingest-pipeline-cannot-substitute-a-pattern-into-newline/323151)
**Author:** [@andreatera](https://discuss.elastic.co/u/andreatera)\ **Replies:** 4\ **Last updated:** [January 16, 2023, 9:39am UTC](https://discuss.elastic.co/t/gsub-processor-in-ingest-pipeline-cannot-substitute-a-pattern-into-newline/323151 "2023-01-16T09:39:17Z")
Hello there, since we are moving from logstash pipeline into ingest pipeline we had to rewrite our gsub pattern from logstash into ingest processors. Our use case is simple, replace the unicode \\u2028 into a newline ch… --- ## [\[apm\]The java-agent only provides the request information to the apm-service, and the dependency is empty](https://discuss.elastic.co/t/apm-the-java-agent-only-provides-the-request-information-to-the-apm-service-and-the-dependency-is-empty/322440)
**Author:** [@ntmxglrtayl03](https://discuss.elastic.co/u/ntmxglrtayl03)\ **Replies:** 11\ **Last updated:** [January 16, 2023, 9:29am UTC](https://discuss.elastic.co/t/apm-the-java-agent-only-provides-the-request-information-to-the-apm-service-and-the-dependency-is-empty/322440 "2023-01-16T09:29:48Z")
Kibana version: 7.17.8 Elasticsearch version: 7.17.8 APM Server version: 7.17.8 APM Agent language and version: java 1.35.0 What can I do to make them show? --- ## [Problems deploying ECK on k8 v1.23.10](https://discuss.elastic.co/t/problems-deploying-eck-on-k8-v1-23-10/323129)
**Author:** [@Dennis\_Christensen](https://discuss.elastic.co/u/Dennis_Christensen)\ **Replies:** 2\ **Last updated:** [January 16, 2023, 8:10am UTC](https://discuss.elastic.co/t/problems-deploying-eck-on-k8-v1-23-10/323129 "2023-01-16T08:10:04Z")
Hi. I am new to ECK, and would like to install it on our development cluster. But I have problems just installing the CRDs. From the quickstart I've tried to install the CRDs: kubectl apply -f https://download.elastic… --- ## [How to apply search on special characters when search is limited to specific fields?](https://discuss.elastic.co/t/how-to-apply-search-on-special-characters-when-search-is-limited-to-specific-fields/323220)
**Author:** [@Moazzam\_Saleem](https://discuss.elastic.co/u/Moazzam_Saleem)\ **Replies:** 0\ **Last updated:** [January 16, 2023, 6:58am UTC](https://discuss.elastic.co/t/how-to-apply-search-on-special-characters-when-search-is-limited-to-specific-fields/323220 "2023-01-16T06:58:49Z")
I'm new to elasticsearch, I'm trying to give global search but when I limited my search to apply of specific fields by giving fields param in query, search doesn't apply on special characters Here is my JSON query: { … --- ## [How to mask card number of xml message](https://discuss.elastic.co/t/how-to-mask-card-number-of-xml-message/322925)
**Author:** [@Anil0110](https://discuss.elastic.co/u/Anil0110)\ **Replies:** 5\ **Last updated:** [January 16, 2023, 7:19am UTC](https://discuss.elastic.co/t/how-to-mask-card-number-of-xml-message/322925 "2023-01-16T07:19:27Z")
Hello the requirement is we need to mask the cardnumber of xml message our input message looks like : message : output message expected --- ## [How to Get Control Filter in my custom plugin](https://discuss.elastic.co/t/how-to-get-control-filter-in-my-custom-plugin/323221)
**Author:** [@monusharma](https://discuss.elastic.co/u/monusharma)\ **Replies:** 0\ **Last updated:** [January 16, 2023, 6:59am UTC](https://discuss.elastic.co/t/how-to-get-control-filter-in-my-custom-plugin/323221 "2023-01-16T06:59:28Z")
In this regards, I have searched on internet and found deprecated below mentioned code: import FilterBarQueryFilterProvider from 'ui/filter\_bar/query\_filter'; // Somewhere in your directive, service, or controller con… --- ## [Cluter removed timeout Coordinating node](https://discuss.elastic.co/t/cluter-removed-timeout-coordinating-node/323208)
**Author:** [@chengdihua](https://discuss.elastic.co/u/chengdihua)\ **Replies:** 1\ **Last updated:** [January 16, 2023, 6:45am UTC](https://discuss.elastic.co/t/cluter-removed-timeout-coordinating-node/323208 "2023-01-16T06:45:25Z")
Hello, everyone! We have 15 nodes in our ES cluster, including 3 master nodes, 9 data nodes, and 3 coordinate/client nodes. There are 3 physical hosts in the cluster, and 5 ES nodes are deployed on each host. (1 master… --- ## [Regarding daily active users count formula](https://discuss.elastic.co/t/regarding-daily-active-users-count-formula/323188)
**Author:** [@bhavin.shah](https://discuss.elastic.co/u/bhavin.shah)\ **Replies:** 3\ **Last updated:** [January 16, 2023, 5:52am UTC](https://discuss.elastic.co/t/regarding-daily-active-users-count-formula/323188 "2023-01-16T05:52:57Z")
Hello team, I am trying to calculate one number output as , how many customers have placed daily atleast one order in last one day. My index formation is like following Ord\_order\_no - unique record / document ID Clien… --- ## [Unable to reset default password](https://discuss.elastic.co/t/unable-to-reset-default-password/323210)
**Author:** [@yuvrajbset](https://discuss.elastic.co/u/yuvrajbset)\ **Replies:** 1\ **Last updated:** [January 16, 2023, 3:58am UTC](https://discuss.elastic.co/t/unable-to-reset-default-password/323210 "2023-01-16T03:58:15Z")
Hello ES Team, I am unable to reset my Elasticsearch password. Please find the screenshot below. Please help me out with this. --- ## [Path does not chain with any of the trust anchors](https://discuss.elastic.co/t/path-does-not-chain-with-any-of-the-trust-anchors/322688)
**Author:** [@chris3](https://discuss.elastic.co/u/chris3)\ **Replies:** 3\ **Last updated:** [January 15, 2023, 11:37pm UTC](https://discuss.elastic.co/t/path-does-not-chain-with-any-of-the-trust-anchors/322688 "2023-01-15T23:37:00Z")
Hi All, Appreciate if you could help. I have tried to follow the elastic documentation here to setup internode communication using certificates: https://www.elastic.co/guide/en/elasticsearch/reference/current/security-… [Previous page](https://discuss.elastic.co/latest.md?page=819) [Next page](https://discuss.elastic.co/latest.md?page=821)