# Latest **URL:** https://discuss.elastic.co/latest.md?page=830 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 831 --- ## [Logstash pkg update results log prasing stopped](https://discuss.elastic.co/t/logstash-pkg-update-results-log-prasing-stopped/322542)
**Author:** [@Dilipssn](https://discuss.elastic.co/u/Dilipssn)\ **Replies:** 7\ **Last updated:** [January 9, 2023, 1:57am UTC](https://discuss.elastic.co/t/logstash-pkg-update-results-log-prasing-stopped/322542 "2023-01-09T01:57:50Z")
Hello Team, We have logstash to push the logs from one server to other, where all the traps are collected. Through which we plot graphs in "Grafana". The port number in which logs parsing is "7546". until "logstash-7… --- ## [Date histogram aggregation seems incorrect with calendar\_interval and when offset \>= 30 days](https://discuss.elastic.co/t/date-histogram-aggregation-seems-incorrect-with-calendar-interval-and-when-offset-30-days/322492)
**Author:** [@xiaofei](https://discuss.elastic.co/u/xiaofei)\ **Replies:** 3\ **Last updated:** [January 9, 2023, 1:26am UTC](https://discuss.elastic.co/t/date-histogram-aggregation-seems-incorrect-with-calendar-interval-and-when-offset-30-days/322492 "2023-01-09T01:26:23Z")
Based on this doc, elasticsearch supports Calendar-aware interval on data histogram aggregation. Specially for a "quarter" interval: "One quarter is the interval between the start day of the month and time of day and t… --- ## [How to get average of items in an array of a nested field?](https://discuss.elastic.co/t/how-to-get-average-of-items-in-an-array-of-a-nested-field/322690)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 4\ **Last updated:** [January 9, 2023, 12:32am UTC](https://discuss.elastic.co/t/how-to-get-average-of-items-in-an-array-of-a-nested-field/322690 "2023-01-09T00:32:28Z")
I'm trying to get the average price of products that are in stock across my different physical warehouses. I made this index: PUT warehouse POST warehouse/\_mapping { "properties": { "inventory": { "prope… --- ## [PHP Client 8.5 Not Response Data](https://discuss.elastic.co/t/php-client-8-5-not-response-data/322670)
**Author:** [@vcamargo](https://discuss.elastic.co/u/vcamargo)\ **Replies:** 1\ **Last updated:** [January 9, 2023, 12:07am UTC](https://discuss.elastic.co/t/php-client-8-5-not-response-data/322670 "2023-01-09T00:07:05Z")
When try request do elastic using php client response it's returning always null, I've try using "search", "get" methodos and not working, when a try use postman request it's working, sample code below Request Status Co… --- ## [Cluster health status changed from \[YELLOW\] to \[RED\] (reason: \[auto-create\] after changing path.data and path.log](https://discuss.elastic.co/t/cluster-health-status-changed-from-yellow-to-red-reason-auto-create-after-changing-path-data-and-path-log/320864)
**Author:** [@amiraliw](https://discuss.elastic.co/u/amiraliw)\ **Replies:** 1\ **Last updated:** [December 11, 2022, 11:58pm UTC](https://discuss.elastic.co/t/cluster-health-status-changed-from-yellow-to-red-reason-auto-create-after-changing-path-data-and-path-log/320864 "2022-12-11T23:58:12Z")
I have installed elasticsearch-8.4.3-x86\_64 and changed the path.data and path.log before I started the service. Permissions to the new pathes are more than needed as following: drwxrwsrwx. 2 elasticsearch elasticsearc… --- ## [A kibana startup question](https://discuss.elastic.co/t/a-kibana-startup-question/320611)
**Author:** [@laughting](https://discuss.elastic.co/u/laughting)\ **Replies:** 4\ **Last updated:** [December 11, 2022, 8:52pm UTC](https://discuss.elastic.co/t/a-kibana-startup-question/320611 "2022-12-11T20:52:04Z")
Why need to configure elasticsearch.password and elasticsaerch.username to start Kibana? What is initialized? Why not login directly through the account and password from the browser？ --- ## [Add count threshold to ratio threshold alert](https://discuss.elastic.co/t/add-count-threshold-to-ratio-threshold-alert/320107)
**Author:** [@Itamar\_Carmel](https://discuss.elastic.co/u/Itamar_Carmel)\ **Replies:** 3\ **Last updated:** [January 8, 2023, 4:53pm UTC](https://discuss.elastic.co/t/add-count-threshold-to-ratio-threshold-alert/320107 "2023-01-08T16:53:13Z")
Hi, I've been trying to set up an alert which monitors the percentage of error logs (out of the total logs). I have been using the ratio threshold option but I get the alert triggered also for a single error log line (w… --- ## [Using NDJSON for Logstash HTTP Output Plugin](https://discuss.elastic.co/t/using-ndjson-for-logstash-http-output-plugin/322683)
**Author:** [@gs04](https://discuss.elastic.co/u/gs04)\ **Replies:** 0\ **Last updated:** [January 8, 2023, 3:29pm UTC](https://discuss.elastic.co/t/using-ndjson-for-logstash-http-output-plugin/322683 "2023-01-08T15:29:00Z")
I'm looking to use a Logstash http output plugin to send a batch of JSON events where all the events are stored in the HTTP message as new-line delimited JSON events. For example, we'd need the data of the HTTP transmis… --- ## [Kubernetes Logstash statefulset under a Service of type Load Balancer (Amazon EKS) uneven distribution of events between pods](https://discuss.elastic.co/t/kubernetes-logstash-statefulset-under-a-service-of-type-load-balancer-amazon-eks-uneven-distribution-of-events-between-pods/322578)
**Author:** [@vikasp](https://discuss.elastic.co/u/vikasp)\ **Replies:** 3\ **Last updated:** [January 8, 2023, 3:08pm UTC](https://discuss.elastic.co/t/kubernetes-logstash-statefulset-under-a-service-of-type-load-balancer-amazon-eks-uneven-distribution-of-events-between-pods/322578 "2023-01-08T15:08:20Z")
I am working with a self managed elasticsearch cluster hosted in Amazon EKS. The pipeline flow is: filebeat agent is deployed in all ec2 servers seding data to logstash. https://logstash.company.com:5046. Logstash is … --- ## [Json data from Filebeat to Logstash](https://discuss.elastic.co/t/json-data-from-filebeat-to-logstash/322672)
**Author:** [@Hamburglar](https://discuss.elastic.co/u/Hamburglar)\ **Replies:** 4\ **Last updated:** [January 8, 2023, 1:54pm UTC](https://discuss.elastic.co/t/json-data-from-filebeat-to-logstash/322672 "2023-01-08T13:54:35Z")
Json data to be ingested: /var/log/file.json {"event\_type":"temp","time":"2023-01-07 23:30:12","temp":64.0,"fan":2291} {"event\_type":"temp","time":"2023-01-07 23:30:22","temp":63.0,"fan":2308} {"event\_type":"temp","time… --- ## [Illegal\_argument\_exception](https://discuss.elastic.co/t/illegal-argument-exception/320962)
**Author:** [@Jinhyuck\_Cha](https://discuss.elastic.co/u/Jinhyuck_Cha)\ **Replies:** 1\ **Last updated:** [December 11, 2022, 4:38pm UTC](https://discuss.elastic.co/t/illegal-argument-exception/320962 "2022-12-11T16:38:55Z")
Hi i'm try to query to Elasticsearch in kibana But I got some error in there How can I solve it? this is my query POST dingo-dev-images-enriched-index-v1/\_search { "query": { "bool": { "filter": \[ … --- ## [Why elasticsearch search query (when you inspect)on date is different from kibana query on date?](https://discuss.elastic.co/t/why-elasticsearch-search-query-when-you-inspect-on-date-is-different-from-kibana-query-on-date/322676)
**Author:** [@alex\_petrov](https://discuss.elastic.co/u/alex_petrov)\ **Replies:** 4\ **Last updated:** [January 8, 2023, 11:23am UTC](https://discuss.elastic.co/t/why-elasticsearch-search-query-when-you-inspect-on-date-is-different-from-kibana-query-on-date/322676 "2023-01-08T11:23:27Z")
I used date as a field in kibana as shown below and date is between Oct 15, 2022 @ 00:00:00.000 - Oct 16, 2022 @ 00:00:00.000 why it is different from elasticsearch query when you inspect(as shown below)? --- ## [Jdbc mongo plugin](https://discuss.elastic.co/t/jdbc-mongo-plugin/322282)
**Author:** [@reza\_sabz](https://discuss.elastic.co/u/reza_sabz)\ **Replies:** 2\ **Last updated:** [January 8, 2023, 8:58am UTC](https://discuss.elastic.co/t/jdbc-mongo-plugin/322282 "2023-01-08T08:58:46Z")
Hello every one I want to connect mongodb to elastic via logstash. I did a lot of research on this. I checked and tested many methods. Finally, I reached jdbc. I have a problem in configuring this plugin and somehow I i… --- ## [Kibana painless scripted fields](https://discuss.elastic.co/t/kibana-painless-scripted-fields/316762)
**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\ **Replies:** 3\ **Last updated:** [October 18, 2022, 7:58am UTC](https://discuss.elastic.co/t/kibana-painless-scripted-fields/316762 "2022-10-18T07:58:21Z")
Hi elastic Team, I want to calculate the number of adults and children in every room. Below is an example of my document: "rooms": \[ { "pensionId": 16, "LibelleChambre": "Twin GardenView ", "MontantRemise": 0, "N… --- ## [How to encrypt Elasticsearch data path](https://discuss.elastic.co/t/how-to-encrypt-elasticsearch-data-path/322562)
**Author:** [@Naga\_Prudhvi](https://discuss.elastic.co/u/Naga_Prudhvi)\ **Replies:** 3\ **Last updated:** [January 8, 2023, 6:21am UTC](https://discuss.elastic.co/t/how-to-encrypt-elasticsearch-data-path/322562 "2023-01-08T06:21:55Z")
I want to perform dm-crypt encryption at rest for all data path for Elasticsearch but it should be searchable if I try to access data from hadoop/spark/kibana. Any ideas on this would be very appreciated. --- ## [Visualize data by two fields](https://discuss.elastic.co/t/visualize-data-by-two-fields/316819)
**Author:** [@Kohlman](https://discuss.elastic.co/u/Kohlman)\ **Replies:** 1\ **Last updated:** [October 18, 2022, 6:54am UTC](https://discuss.elastic.co/t/visualize-data-by-two-fields/316819 "2022-10-18T06:54:56Z")
We have multiple clients. Each client has there own instance of our database. While there may be subtle differences in schema as we continue to make enhancements. For purposes of this question we can assume they are the … --- ## [Can ES single node use index lifecycle management(ILM)?](https://discuss.elastic.co/t/can-es-single-node-use-index-lifecycle-management-ilm/322664)
**Author:** [@jacksparrow414](https://discuss.elastic.co/u/jacksparrow414)\ **Replies:** 2\ **Last updated:** [January 8, 2023, 2:06am UTC](https://discuss.elastic.co/t/can-es-single-node-use-index-lifecycle-management-ilm/322664 "2023-01-08T02:06:56Z")
I checked the official documentation, which only mentioned clusters, I wonder if a single node supports ILM? According to my understanding, a single-node ES has all node roles and all data tiers, so it should support IL… --- ## [Security troubles - java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors (ca.crt matches on all nodes)](https://discuss.elastic.co/t/security-troubles-java-security-cert-certpathvalidatorexception-path-does-not-chain-with-any-of-the-trust-anchors-ca-crt-matches-on-all-nodes/322674)
**Author:** [@emoon](https://discuss.elastic.co/u/emoon)\ **Replies:** 1\ **Last updated:** [January 8, 2023, 1:23am UTC](https://discuss.elastic.co/t/security-troubles-java-security-cert-certpathvalidatorexception-path-does-not-chain-with-any-of-the-trust-anchors-ca-crt-matches-on-all-nodes/322674 "2023-01-08T01:23:01Z")
Note that this entire cluster was working fine up 'til I updated certificates. I'm on Elasticsearch 7.5. I updated my certificates using the certificate-util - created a server.yml with all my servers and the Kibana nod… --- ## [Status of hosts with ELK](https://discuss.elastic.co/t/status-of-hosts-with-elk/318738)
**Author:** [@kurdit](https://discuss.elastic.co/u/kurdit)\ **Replies:** 3\ **Last updated:** [November 13, 2022, 11:08am UTC](https://discuss.elastic.co/t/status-of-hosts-with-elk/318738 "2022-11-13T11:08:03Z")
hello friends! I have the following task: it is necessary to monitor hundreds of hosts (virtual machines). now they are monitored using Nagios, but I want to get a clear visualization of the availability of hosts. ther… --- ## [S3 output: Is there a way to have every event in its own file?](https://discuss.elastic.co/t/s3-output-is-there-a-way-to-have-every-event-in-its-own-file/322663)
**Author:** [@rickfish](https://discuss.elastic.co/u/rickfish)\ **Replies:** 4\ **Last updated:** [January 7, 2023, 6:57pm UTC](https://discuss.elastic.co/t/s3-output-is-there-a-way-to-have-every-event-in-its-own-file/322663 "2023-01-07T18:57:43Z")
I have an unusual requirement to put every event in a separate file in an s3 bucket. I have tried to use this: rotation\_strategy =\> "size" size\_file =\> 1 but that is just an estimate and it still puts multiple events i… --- ## [After 6.8 -\> 7.17 upgrade, logstash not sending data to logstash-\* indexes](https://discuss.elastic.co/t/after-6-8-7-17-upgrade-logstash-not-sending-data-to-logstash-indexes/322479)
**Author:** [@willdennis](https://discuss.elastic.co/u/willdennis)\ **Replies:** 7\ **Last updated:** [January 7, 2023, 4:45pm UTC](https://discuss.elastic.co/t/after-6-8-7-17-upgrade-logstash-not-sending-data-to-logstash-indexes/322479 "2023-01-07T16:45:48Z")
Hi all, Did an upgrade to my single-node cluster yesterday evening, now up on 7.17.8 and everything's basically working, except that it seems that Logstash is no longer creating logstash-\ indexes... I see th… --- ## [Kibana time filter change dynamically API](https://discuss.elastic.co/t/kibana-time-filter-change-dynamically-api/316732)
**Author:** [@PabloCuestaGarcia](https://discuss.elastic.co/u/PabloCuestaGarcia)\ **Replies:** 1\ **Last updated:** [October 17, 2022, 11:48pm UTC](https://discuss.elastic.co/t/kibana-time-filter-change-dynamically-api/316732 "2022-10-17T23:48:21Z")
Hi all. I would like to know if it is possible to dynamically change the time range in Kibana according to the last load data. I mean, I have an ETL loading data every day, but some days the data comes empty, the proce… --- ## [Kibana error when enabling xpack security](https://discuss.elastic.co/t/kibana-error-when-enabling-xpack-security/322666)
**Author:** [@francis009](https://discuss.elastic.co/u/francis009)\ **Replies:** 7\ **Last updated:** [January 7, 2023, 4:23pm UTC](https://discuss.elastic.co/t/kibana-error-when-enabling-xpack-security/322666 "2023-01-07T16:23:49Z")
Hi, i've look through the forums and found many people having errors when enabling xpack, but not exactly my error, if i enable xpack on elasticsearch it pops up the log in when i access the website, but when i enable it… --- ## [Query on Elastic Observability Engineer Exam](https://discuss.elastic.co/t/query-on-elastic-observability-engineer-exam/322489)
**Author:** [@chris3](https://discuss.elastic.co/u/chris3)\ **Replies:** 3\ **Last updated:** [January 7, 2023, 4:05pm UTC](https://discuss.elastic.co/t/query-on-elastic-observability-engineer-exam/322489 "2023-01-07T16:05:15Z")
Hi, I think I have the correct forum to post this in. I can setup an Elastic cluster no problem, the main query I have is surrounding APM server and the agents. I recently took the virtual instructor course for Elastic… --- ## [Pagination on composite aggregation](https://discuss.elastic.co/t/pagination-on-composite-aggregation/322667)
**Author:** [@hmkhitaryan](https://discuss.elastic.co/u/hmkhitaryan)\ **Replies:** 0\ **Last updated:** [January 7, 2023, 3:25pm UTC](https://discuss.elastic.co/t/pagination-on-composite-aggregation/322667 "2023-01-07T15:25:38Z")
Hi. I'm having such kind of problem on defining composite aggregation for paginating the results. CompositeAggregationBuilder aggregationBuilder = AggregationBuilders .composite(aggrField, List.of(ne… --- ## [Kibana Index not working after update](https://discuss.elastic.co/t/kibana-index-not-working-after-update/316796)
**Author:** [@Rommy](https://discuss.elastic.co/u/Rommy)\ **Replies:** 1\ **Last updated:** [October 17, 2022, 2:08pm UTC](https://discuss.elastic.co/t/kibana-index-not-working-after-update/316796 "2022-10-17T14:08:28Z")
Hello, A version update was made for the stack. After the update, there is a problem with the Kibana index. Before the update there was a Kibana version 7.10.2 (OpenDistro 1.13). Has been updated to version 7.13.4. {"t… --- ## [Elasticsearch not starting, with no errors in the logs](https://discuss.elastic.co/t/elasticsearch-not-starting-with-no-errors-in-the-logs/322660)
**Author:** [@sphawk](https://discuss.elastic.co/u/sphawk)\ **Replies:** 3\ **Last updated:** [January 7, 2023, 11:29am UTC](https://discuss.elastic.co/t/elasticsearch-not-starting-with-no-errors-in-the-logs/322660 "2023-01-07T11:29:34Z")
I've updated debian to buster version without no problem and today I've tried to update ES to 8.5 version. Bad idea (some Java problem) so I've reinstalled previous version (6.x) but ES still not starting. service elas… --- ## [Upgraded first node from 7.17.5 to 8.4. Won't start, claiming there is a 6.4.5 index, but I can't find it](https://discuss.elastic.co/t/upgraded-first-node-from-7-17-5-to-8-4-wont-start-claiming-there-is-a-6-4-5-index-but-i-cant-find-it/317811)
**Author:** [@Brett\_C](https://discuss.elastic.co/u/Brett_C)\ **Replies:** 11\ **Last updated:** [January 7, 2023, 10:57am UTC](https://discuss.elastic.co/t/upgraded-first-node-from-7-17-5-to-8-4-wont-start-claiming-there-is-a-6-4-5-index-but-i-cant-find-it/317811 "2023-01-07T10:57:10Z")
Hi Everyone, I have just started upgrading my cluster from 7.17.5 to 8.4. I completed the first node, but when I went to start the service, it complained that: \[2022-10-31T17:08:08,683\]\[ERROR\]\[o.e.b.Elasticsearch \]… --- ## [Divide Number in Y axis by 10 in TSVB Vizualization](https://discuss.elastic.co/t/divide-number-in-y-axis-by-10-in-tsvb-vizualization/320584)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 2\ **Last updated:** [December 10, 2022, 9:38am UTC](https://discuss.elastic.co/t/divide-number-in-y-axis-by-10-in-tsvb-vizualization/320584 "2022-12-10T09:38:24Z")
Hi, I am trying to Build Viz in Kibana Version 7.6. I want to divide number present in Y axis by 10. I tried filtering options but it did not worked out, may be I am missing something. Current viz Snap: Pls let me… --- ## [Filebeat: active (running) then code=exited, status=2 or code=exited, status=1](https://discuss.elastic.co/t/filebeat-active-running-then-code-exited-status-2-or-code-exited-status-1/322233)
**Author:** [@Anthony\_Allen](https://discuss.elastic.co/u/Anthony_Allen)\ **Replies:** 11\ **Last updated:** [January 7, 2023, 1:49am UTC](https://discuss.elastic.co/t/filebeat-active-running-then-code-exited-status-2-or-code-exited-status-1/322233 "2023-01-07T01:49:49Z")
I am running Elasticsearch/Kibana 7.14. on Ubuntu 22.04 on the backend of an Apache reverse proxy. Filebeat is on another Ubuntu 22.04 on the backend of the same reverse proxy. Other beats are on the Filebeat's machine. … [Previous page](https://discuss.elastic.co/latest.md?page=829) [Next page](https://discuss.elastic.co/latest.md?page=831)