# Latest **URL:** https://discuss.elastic.co/latest.md?page=849 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 850 --- ## [How to connect es cluster](https://discuss.elastic.co/t/how-to-connect-es-cluster/321712)
**Author:** [@duocoding](https://discuss.elastic.co/u/duocoding)\ **Replies:** 1\ **Last updated:** [December 21, 2022, 8:39am UTC](https://discuss.elastic.co/t/how-to-connect-es-cluster/321712 "2022-12-21T08:39:27Z")
// Create the low-level client RestClient restClient = RestClient.builder( new HttpHost("localhost", 9200)).build(); // Create the transport with a Jackson mapper ElasticsearchTransport transport = new RestClientTra… --- ## [Elastic Agent 8.5.3 Logging](https://discuss.elastic.co/t/elastic-agent-8-5-3-logging/321732)
**Author:** [@zirota](https://discuss.elastic.co/u/zirota)\ **Replies:** 0\ **Last updated:** [December 21, 2022, 8:24am UTC](https://discuss.elastic.co/t/elastic-agent-8-5-3-logging/321732 "2022-12-21T08:24:42Z")
Hello, I am facing some difficulties in configuring the agent log path when running in standalone mode. Agent Version: 8.5.3 Distribution: linux\_x86-64 Config: Startup command: ./elastic-agent -run -c \ **Author:** [@fim01](https://discuss.elastic.co/u/fim01)\ **Replies:** 3\ **Last updated:** [December 21, 2022, 8:14am UTC](https://discuss.elastic.co/t/kibana-transforms/321141 "2022-12-21T08:14:41Z") I use Pivot to group data within the Transforms section in Kibana. I'm wondering if its possible to group by a certain field within a defined time intervall? In my case I would like to group by a field only within a da… --- ## [Dec 21st, 2022: \[EN\] How to import an ML model with Eland, if you're not a Python developer](https://discuss.elastic.co/t/dec-21st-2022-en-how-to-import-an-ml-model-with-eland-if-youre-not-a-python-developer/318465)
**Author:** [@Irina\_Truong](https://discuss.elastic.co/u/Irina_Truong)\ **Replies:** 0\ **Last updated:** [December 21, 2022, 8:00am UTC](https://discuss.elastic.co/t/dec-21st-2022-en-how-to-import-an-ml-model-with-eland-if-youre-not-a-python-developer/318465 "2022-12-21T08:00:47Z")
Why do I need an ML model? An ML model in Elasticsearch could be used for enriching your data during indexing. Some examples of what an ML model can do: extract entities from text (NER) predicting classes (classific… --- ## [javax.security.auth.login.LoginException: Could not login: the client is being asked for a password, but the Kafka client code does not currently support obtaining a password from the user. not available to garner authentication information from the user](https://discuss.elastic.co/t/javax-security-auth-login-loginexception-could-not-login-the-client-is-being-asked-for-a-password-but-the-kafka-client-code-does-not-currently-support-obtaining-a-password-from-the-user-not-available-to-garner-authentication-information-from-the-user/321723)
**Author:** [@Balaganesh\_G](https://discuss.elastic.co/u/Balaganesh_G)\ **Replies:** 0\ **Last updated:** [December 21, 2022, 7:19am UTC](https://discuss.elastic.co/t/javax-security-auth-login-loginexception-could-not-login-the-client-is-being-asked-for-a-password-but-the-kafka-client-code-does-not-currently-support-obtaining-a-password-from-the-user-not-available-to-garner-authentication-information-from-the-user/321723 "2022-12-21T07:19:49Z")
Hi Team, I have using logstash 8.3.3 and migirated to new Logstash 8.5.3 facing below error. javax.security.auth.login.LoginException: Could not login: the client is being asked for a password, but the Kafka client cod… --- ## [Override logging.level in a Fleet managed Filebeat?](https://discuss.elastic.co/t/override-logging-level-in-a-fleet-managed-filebeat/321688)
**Author:** [@Akash\_Deep](https://discuss.elastic.co/u/Akash_Deep)\ **Replies:** 4\ **Last updated:** [December 21, 2022, 6:50am UTC](https://discuss.elastic.co/t/override-logging-level-in-a-fleet-managed-filebeat/321688 "2022-12-21T06:50:56Z")
I have a Fleet managed Elastic Agent running as a service which on systemctl start elastic-agent starts-up filebeat with some flags(as seen in the picture). HOW DO I OVERRIDE THE LOGGING.LEVEL IN A MANAGED SETUP? I'… --- ## [Storage upgrade | new disk added | how to extend storage for ELK](https://discuss.elastic.co/t/storage-upgrade-new-disk-added-how-to-extend-storage-for-elk/321715)
**Author:** [@theacodes](https://discuss.elastic.co/u/theacodes)\ **Replies:** 1\ **Last updated:** [December 21, 2022, 6:42am UTC](https://discuss.elastic.co/t/storage-upgrade-new-disk-added-how-to-extend-storage-for-elk/321715 "2022-12-21T06:42:55Z")
Hi! I've added a new disk for storage upgrade and I want to retain data for 45 day then move it to new disk but that data should still be searchable after 45 days. can someone brief me on how to get this done. I've al… --- ## [Upgrade from Transport Client to HLRC / JAVA API Client? Which to choose?](https://discuss.elastic.co/t/upgrade-from-transport-client-to-hlrc-java-api-client-which-to-choose/320869)
**Author:** [@Umang\_Pachaury](https://discuss.elastic.co/u/Umang_Pachaury)\ **Replies:** 6\ **Last updated:** [December 21, 2022, 6:30am UTC](https://discuss.elastic.co/t/upgrade-from-transport-client-to-hlrc-java-api-client-which-to-choose/320869 "2022-12-21T06:30:08Z")
Hello Team, I am fairly new to Elasticsearch and I have project in which we use Java Client provided by Elasticsearch to fetch logs from Elasticsearch and use those logs in our Application. The thing is that the project … --- ## [Using runtime field in another runtime field in Kibana index template](https://discuss.elastic.co/t/using-runtime-field-in-another-runtime-field-in-kibana-index-template/320734)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 2\ **Last updated:** [December 21, 2022, 6:13am UTC](https://discuss.elastic.co/t/using-runtime-field-in-another-runtime-field-in-kibana-index-template/320734 "2022-12-21T06:13:33Z")
I have a runtime field called "throughput\_in" with type long and the following script: throughput\_in: emit(doc\['volume\_uplink'\].value / doc\['duration'\].value) and a field called "throughput\_out" with type long: throug… --- ## [Logstash filter code that sends a query to related indices by wild card \[indexname-\*\]](https://discuss.elastic.co/t/logstash-filter-code-that-sends-a-query-to-related-indices-by-wild-card-indexname/321718)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 0\ **Last updated:** [December 21, 2022, 5:54am UTC](https://discuss.elastic.co/t/logstash-filter-code-that-sends-a-query-to-related-indices-by-wild-card-indexname/321718 "2022-12-21T05:54:50Z")
Hello All, Can someone please help me out how can I write custom filter in logstash to achieve the following: Making a custom logstash filter that sends a query to related indices by wild card (indexname-\*) for records… --- ## [Kibana 8.4: How do disable ML , APM, or entire observability app?](https://discuss.elastic.co/t/kibana-8-4-how-do-disable-ml-apm-or-entire-observability-app/316447)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 1\ **Last updated:** [October 26, 2022, 12:54pm UTC](https://discuss.elastic.co/t/kibana-8-4-how-do-disable-ml-apm-or-entire-observability-app/316447 "2022-10-26T12:54:42Z")
We run elastic 8.4.3, elasticsearch + kibana. We dont run any "ml", but kibana tries to call elasticsearch ML api: \[2022-10-12T01:19:52.716+00:00\]\[ERROR\]\[plugins.taskManager\] Task ML:saved-objects-sync "ML:saved-object… --- ## [\[Integration\] Facing error while adding transform in integration package](https://discuss.elastic.co/t/integration-facing-error-while-adding-transform-in-integration-package/320746)
**Author:** [@Alex\_R](https://discuss.elastic.co/u/Alex_R)\ **Replies:** 4\ **Last updated:** [December 21, 2022, 5:05am UTC](https://discuss.elastic.co/t/integration-facing-error-while-adding-transform-in-integration-package/320746 "2022-12-21T05:05:02Z")
I have referred elastic-package spec to ship transform along with integration package. However, I am not able to install integration package when added transform under /root/integrations/packages/my\_package/elasticsearch… --- ## [Delete by query error (version conflict)](https://discuss.elastic.co/t/delete-by-query-error-version-conflict/321365)
**Author:** [@theacodes](https://discuss.elastic.co/u/theacodes)\ **Replies:** 1\ **Last updated:** [December 21, 2022, 4:57am UTC](https://discuss.elastic.co/t/delete-by-query-error-version-conflict/321365 "2022-12-21T04:57:17Z")
I'm trying to delete some specific documents from an index with a query POST /.ds-logs-system.syslog-default-2022.10.30-000004/\_delete\_by\_query?pretty { "query": { "match": { "process.name": "install.sh" … --- ## [Application startup exception](https://discuss.elastic.co/t/application-startup-exception/321640)
**Author:** [@Vincent7326](https://discuss.elastic.co/u/Vincent7326)\ **Replies:** 2\ **Last updated:** [December 21, 2022, 3:27am UTC](https://discuss.elastic.co/t/application-startup-exception/321640 "2022-12-21T03:27:07Z")
I just upgrade elasticsearch, kibana and elasticagent(fleet and apm) from 8.4.3 to 8.5.3 Then I cannot receive any apm transactions ... After, I downgrade elastic agent to 8.4.3, and my application got problem ... The… --- ## [Keytool asking for password for keystore , none applied ever](https://discuss.elastic.co/t/keytool-asking-for-password-for-keystore-none-applied-ever/321713)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 0\ **Last updated:** [December 21, 2022, 3:57am UTC](https://discuss.elastic.co/t/keytool-asking-for-password-for-keystore-none-applied-ever/321713 "2022-12-21T03:57:27Z")
We are on ES version 7.17 and trying to setting up cross cluster ( remote ). I am trying to add cert from one node to remote in the elastic-certificates.p12 file using below command keytool -importcert -noprompt -keysto… --- ## [How to replace "and" operator inside "must\_not" to group clauses. Query migration to ES 7.6.1](https://discuss.elastic.co/t/how-to-replace-and-operator-inside-must-not-to-group-clauses-query-migration-to-es-7-6-1/321706)
**Author:** [@aanaya](https://discuss.elastic.co/u/aanaya)\ **Replies:** 2\ **Last updated:** [December 21, 2022, 12:51am UTC](https://discuss.elastic.co/t/how-to-replace-and-operator-inside-must-not-to-group-clauses-query-migration-to-es-7-6-1/321706 "2022-12-21T00:51:31Z")
Hi guys, I'm trying to migrate following query to ES 7.6.1, but not sure how to replace "and" functionality cause it looks like it's not longer supported in ES 7.6.1. ... "must\_not": \[ { "and": \[ { … --- ## [Error 403 Forbidden when trying to install a plugin](https://discuss.elastic.co/t/error-403-forbidden-when-trying-to-install-a-plugin/321707)
**Author:** [@vadd98](https://discuss.elastic.co/u/vadd98)\ **Replies:** 1\ **Last updated:** [December 21, 2022, 12:50am UTC](https://discuss.elastic.co/t/error-403-forbidden-when-trying-to-install-a-plugin/321707 "2022-12-21T00:50:48Z")
Hi, I'm running a Dockerized Elasticsearch cluster on multiple Italian servers, but one of those is always getting a 403 http response from Elasticsearch servers. This is the exception I'm getting: Exception in thread … --- ## [Unable to connect to kibana with a secure cluster](https://discuss.elastic.co/t/unable-to-connect-to-kibana-with-a-secure-cluster/316444)
**Author:** [@diegz](https://discuss.elastic.co/u/diegz)\ **Replies:** 19\ **Last updated:** [October 26, 2022, 12:15pm UTC](https://discuss.elastic.co/t/unable-to-connect-to-kibana-with-a-secure-cluster/316444 "2022-10-26T12:15:22Z")
Hello everyone, I have configured a cluster of 5 secure nodes with this configuration (adapted on each node :slight\_smile: xpack.security.http.ssl: enabled: true keystore.path: /etc/elasticsearch/new/http.p12 tru… --- ## [Internal monitoring indices shards in UNASSIGNED state](https://discuss.elastic.co/t/internal-monitoring-indices-shards-in-unassigned-state/321247)
**Author:** [@ppine7](https://discuss.elastic.co/u/ppine7)\ **Replies:** 8\ **Last updated:** [December 20, 2022, 11:14pm UTC](https://discuss.elastic.co/t/internal-monitoring-indices-shards-in-unassigned-state/321247 "2022-12-20T23:14:52Z")
Hi, We have an 8.x ES cluster running on Elastic cloud, All seems to be working ok except that a few internal monitoring indices have one shard marked as UNASSIGNED and this causes the cluster state to be YELLOW, all th… --- ## [Fleet server and agents unable to write data to Elasticsearch - Bad Certificate](https://discuss.elastic.co/t/fleet-server-and-agents-unable-to-write-data-to-elasticsearch-bad-certificate/321675)
**Author:** [@rude](https://discuss.elastic.co/u/rude)\ **Replies:** 1\ **Last updated:** [December 20, 2022, 10:59pm UTC](https://discuss.elastic.co/t/fleet-server-and-agents-unable-to-write-data-to-elasticsearch-bad-certificate/321675 "2022-12-20T22:59:30Z")
I'm getting an error when Fleet agents are sending data to Elastic. On Kibana, at the fleet tab I can see Server and Agent are reporting correctly. If I change any of the policies they get redeployed. However, no data is… --- ## [Change field format in response](https://discuss.elastic.co/t/change-field-format-in-response/321702)
**Author:** [@rybak.yuriy.m](https://discuss.elastic.co/u/rybak.yuriy.m)\ **Replies:** 0\ **Last updated:** [December 20, 2022, 10:54pm UTC](https://discuss.elastic.co/t/change-field-format-in-response/321702 "2022-12-20T22:54:40Z")
I do some aggregattion with search api and in my response sum field looks like: "value": 9.34467409269E11" How do I can to change format to long without exponential format? --- ## [Index-append into data-stream](https://discuss.elastic.co/t/index-append-into-data-stream/320930)
**Author:** [@Safty](https://discuss.elastic.co/u/Safty)\ **Replies:** 5\ **Last updated:** [December 20, 2022, 4:39pm UTC](https://discuss.elastic.co/t/index-append-into-data-stream/320930 "2022-12-20T16:39:37Z")
Hello, Does Rally 2.7.0 support index-append (bulk) into a data-stream? I am able to generate a data-stream using component templates and a composable index template without issue, but the index-append is not writing d… --- ## [How to set timerange query to -15min from now?](https://discuss.elastic.co/t/how-to-set-timerange-query-to-15min-from-now/321662)
**Author:** [@ElasticUser11](https://discuss.elastic.co/u/ElasticUser11)\ **Replies:** 0\ **Last updated:** [December 20, 2022, 2:33pm UTC](https://discuss.elastic.co/t/how-to-set-timerange-query-to-15min-from-now/321662 "2022-12-20T14:33:55Z")
I need to check to see if two distinct logs are being generated every 15 min and every hour, so I'm trying to create two timeranges for two different indices -- one that checks for logs in the past 15 min and returns the… --- ## [Azure App Service Logs to Elastic Cloud (without Filebeat)](https://discuss.elastic.co/t/azure-app-service-logs-to-elastic-cloud-without-filebeat/321661)
**Author:** [@CrystalDesignDR](https://discuss.elastic.co/u/CrystalDesignDR)\ **Replies:** 0\ **Last updated:** [December 20, 2022, 2:30pm UTC](https://discuss.elastic.co/t/azure-app-service-logs-to-elastic-cloud-without-filebeat/321661 "2022-12-20T14:30:41Z")
Hi, we send various types of data into our Elastic Cloud deployments, whether it be custom indexes or APM (RUM, node.js, ASP.NET, .NET Core ecc.) data, which is all very straight forward. But when it comes to applicati… --- ## [Regex Pattern to fetch field from message](https://discuss.elastic.co/t/regex-pattern-to-fetch-field-from-message/320563)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 1\ **Last updated:** [December 20, 2022, 9:14pm UTC](https://discuss.elastic.co/t/regex-pattern-to-fetch-field-from-message/320563 "2022-12-20T21:14:55Z")
HI Team, I'm trying to fetch some key field from my message and i need pattern to match exact keyword. i need UserID and User agent matching pattern \[INFO \] 2022-12-05 17:20:45:409 Logger - 365 Service Request: \U… --- ## [Kibana 8.4.x and 8.5.x Elasticsearch compatibility](https://discuss.elastic.co/t/kibana-8-4-x-and-8-5-x-elasticsearch-compatibility/321687)
**Author:** [@Thornfalt](https://discuss.elastic.co/u/Thornfalt)\ **Replies:** 2\ **Last updated:** [December 20, 2022, 9:06pm UTC](https://discuss.elastic.co/t/kibana-8-4-x-and-8-5-x-elasticsearch-compatibility/321687 "2022-12-20T21:06:06Z")
I was browsing the support matrix at Support Matrix | Elastic When looking at the Elasticsearch compatibility, the Kibana versions 8.4.x and 8.5.x is not supported with Elasticsearch 8.4.x and 8.5.x. Does this mean it'… --- ## [Packetbeat unable to monitor mysql traffic](https://discuss.elastic.co/t/packetbeat-unable-to-monitor-mysql-traffic/321690)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 0\ **Last updated:** [December 20, 2022, 8:40pm UTC](https://discuss.elastic.co/t/packetbeat-unable-to-monitor-mysql-traffic/321690 "2022-12-20T20:40:13Z")
I'm trying out packetbeat to monitor events for the mysql protocol. Packetbeat seems to be able to detect packets on destination.port: 3306 which is the default mysql port as shown in this screenshot here: But packet… --- ## [HELP! Unable to open Kibana What should I do?](https://discuss.elastic.co/t/help-unable-to-open-kibana-what-should-i-do/321677)
**Author:** [@Pei\_Z](https://discuss.elastic.co/u/Pei_Z)\ **Replies:** 1\ **Last updated:** [December 20, 2022, 8:16pm UTC](https://discuss.elastic.co/t/help-unable-to-open-kibana-what-should-i-do/321677 "2022-12-20T20:16:36Z")
I am unable to open Kibana because of this error. \[2022-12-21T01:57:34.111+08:00\]\[ERROR\]\[elasticsearch-service\] Unable to retrieve version information from Elasticsearch nodes. security\_exception: \[security\_exception\] R… --- ## [\[filebeat 8.5.3\] extracting log\_level from message with dissect processor, ignoring right padding modifier](https://discuss.elastic.co/t/filebeat-8-5-3-extracting-log-level-from-message-with-dissect-processor-ignoring-right-padding-modifier/321683)
**Author:** [@vincen](https://discuss.elastic.co/u/vincen)\ **Replies:** 1\ **Last updated:** [December 20, 2022, 7:40pm UTC](https://discuss.elastic.co/t/filebeat-8-5-3-extracting-log-level-from-message-with-dissect-processor-ignoring-right-padding-modifier/321683 "2022-12-20T19:40:40Z")
I am trying to run filebeats on log files for a web application, and the messages have padding after the log level. I:DEBUG \[http-nio-8443-exec-45\] RequestCasTicketValidator 20 Dec 2022 11:00:17.221: Loading custom par… --- ## [Is it possible to trigger an alert when a new index is created](https://discuss.elastic.co/t/is-it-possible-to-trigger-an-alert-when-a-new-index-is-created/321605)
**Author:** [@Krishna\_Teja](https://discuss.elastic.co/u/Krishna_Teja)\ **Replies:** 3\ **Last updated:** [December 20, 2022, 7:43pm UTC](https://discuss.elastic.co/t/is-it-possible-to-trigger-an-alert-when-a-new-index-is-created/321605 "2022-12-20T19:43:55Z")
I have an ILM which creates indices every 10 days for a datastream. I need to update the mapping for the newly created index on creation. Is it possible to get an alert or trigger a webhook once a new index is created? [Previous page](https://discuss.elastic.co/latest.md?page=848) [Next page](https://discuss.elastic.co/latest.md?page=850)