# Latest **URL:** https://discuss.elastic.co/latest.md?page=855 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 856 --- ## [\_id is not unique. is repeated in indexes addressed by a single alias](https://discuss.elastic.co/t/id-is-not-unique-is-repeated-in-indexes-addressed-by-a-single-alias/321386)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 4\ **Last updated:** [December 16, 2022, 10:55am UTC](https://discuss.elastic.co/t/id-is-not-unique-is-repeated-in-indexes-addressed-by-a-single-alias/321386 "2022-12-16T10:55:12Z")
I experience the situation that index is having multiple same \_id within the same index I have version 7.17.0 the data are ingested by python requests lib via API this way the uniqueness is broken among multiple inde… --- ## [Order of documents when using a transform](https://discuss.elastic.co/t/order-of-documents-when-using-a-transform/321183)
**Author:** [@Hemabh\_Ravee\_Fox](https://discuss.elastic.co/u/Hemabh_Ravee_Fox)\ **Replies:** 4\ **Last updated:** [December 16, 2022, 10:51am UTC](https://discuss.elastic.co/t/order-of-documents-when-using-a-transform/321183 "2022-12-16T10:51:00Z")
I'm using elasticsearch to store the events data for web sessions. Each event is it's own document. Then I'm using transforms to aggregate this data grouping them by a sessionId key and also creating a field eventFlow wh… --- ## [ElasticSearch Low Level Client search using anonymous type](https://discuss.elastic.co/t/elasticsearch-low-level-client-search-using-anonymous-type/320668)
**Author:** [@gjahagir](https://discuss.elastic.co/u/gjahagir)\ **Replies:** 2\ **Last updated:** [December 16, 2022, 10:13am UTC](https://discuss.elastic.co/t/elasticsearch-low-level-client-search-using-anonymous-type/320668 "2022-12-16T10:13:38Z")
Hi, We are exploring Elastic search to see if it fits into our application requirements. We would want to search using anonymous type, here is what i found in the documentation - var searchResponse = lowlevelClient.Se… --- ## [Filter for specific folder activity](https://discuss.elastic.co/t/filter-for-specific-folder-activity/321395)
**Author:** [@BeyondRAM](https://discuss.elastic.co/u/BeyondRAM)\ **Replies:** 0\ **Last updated:** [December 16, 2022, 10:07am UTC](https://discuss.elastic.co/t/filter-for-specific-folder-activity/321395 "2022-12-16T10:07:18Z")
Hello I wanted to know if it's possible to add a filter in winlogbeat to only have the activity of a specific folder and all it's files inside it, and itself by the way if the folder is renamed, deleted or something else… --- ## [Complex filter query](https://discuss.elastic.co/t/complex-filter-query/321234)
**Author:** [@Henri\_L](https://discuss.elastic.co/u/Henri_L)\ **Replies:** 1\ **Last updated:** [December 15, 2022, 9:38pm UTC](https://discuss.elastic.co/t/complex-filter-query/321234 "2022-12-15T21:38:46Z")
Sorry if it might be obvious but I'm stuck with this query. Here are some example input: { "\_index" : "education", "\_type" : "logs", "\_id" : "educ\_0610426G", "\_score" : 10.917585, … --- ## [Filebeat Failed to connect to backoff(async(tcp:logstash:5044](https://discuss.elastic.co/t/filebeat-failed-to-connect-to-backoff-async-tcp5044/321390)
**Author:** [@Coder\_HK](https://discuss.elastic.co/u/Coder_HK)\ **Replies:** 0\ **Last updated:** [December 16, 2022, 9:27am UTC](https://discuss.elastic.co/t/filebeat-failed-to-connect-to-backoff-async-tcp5044/321390 "2022-12-16T09:27:25Z")
I have set two VMs, one Ubuntu where I've installed ELK and another CentOS where I've installed Filebeat. I want to forward CentOS logs to ELK via filebeat. I have configured all my files correctly (I think) but when I r… --- ## [Elasticsearch 7.17.8 mvnrepository artifact](https://discuss.elastic.co/t/elasticsearch-7-17-8-mvnrepository-artifact/320775)
**Author:** [@Charis\_Yfantis](https://discuss.elastic.co/u/Charis_Yfantis)\ **Replies:** 4\ **Last updated:** [December 16, 2022, 8:27am UTC](https://discuss.elastic.co/t/elasticsearch-7-17-8-mvnrepository-artifact/320775 "2022-12-16T08:27:59Z")
Hello everyone, I just upgraded elasticsearch to 7.17.8 and i need to build a plugin for that version, but it seems https://mvnrepository.com/artifact/org.elasticsearch/elasticsearch does not have the artifact for 7.17… --- ## [Dec 16th, 2022: \[EN\] Cleaner dashboards with the new metric chart](https://discuss.elastic.co/t/dec-16th-2022-en-cleaner-dashboards-with-the-new-metric-chart/321104)
**Author:** [@Giovanni\_Magni](https://discuss.elastic.co/u/Giovanni_Magni)\ **Replies:** 0\ **Last updated:** [December 16, 2022, 8:00am UTC](https://discuss.elastic.co/t/dec-16th-2022-en-cleaner-dashboards-with-the-new-metric-chart/321104 "2022-12-16T08:00:34Z")
Over the past months, the Elastic team has been involved in a series of initiatives created to improve the readability and aesthetic of dashboards, the ongoing work on existing charts and components is one of these. I… --- ## [One line per year with monthly buckets in line chart](https://discuss.elastic.co/t/one-line-per-year-with-monthly-buckets-in-line-chart/321294)
**Author:** [@Jonas\_S](https://discuss.elastic.co/u/Jonas_S)\ **Replies:** 13\ **Last updated:** [December 15, 2022, 5:41pm UTC](https://discuss.elastic.co/t/one-line-per-year-with-monthly-buckets-in-line-chart/321294 "2022-12-15T17:41:47Z")
Hello, i have a line chart with a date histogram with monthly buckets on the horizontal axis. And a proportion of two cumulative sums on the vertical axis. Is there a way to overlay all years to have only a single y… --- ## [If statement not working as expected](https://discuss.elastic.co/t/if-statement-not-working-as-expected/321054)
**Author:** [@Mistral](https://discuss.elastic.co/u/Mistral)\ **Replies:** 3\ **Last updated:** [December 16, 2022, 7:49am UTC](https://discuss.elastic.co/t/if-statement-not-working-as-expected/321054 "2022-12-16T07:49:45Z")
Hi guys, I know this topic has been posted a few times, but I'm unable to find any tracks to help me since a few days. I'm trying to adapt the logstash 5.8 configuration provided by stormshield to a higher (latest) vers… --- ## [How to use custom ID for inserting document using java sdk](https://discuss.elastic.co/t/how-to-use-custom-id-for-inserting-document-using-java-sdk/321380)
**Author:** [@suresh\_chaudhari](https://discuss.elastic.co/u/suresh_chaudhari)\ **Replies:** 1\ **Last updated:** [December 16, 2022, 7:44am UTC](https://discuss.elastic.co/t/how-to-use-custom-id-for-inserting-document-using-java-sdk/321380 "2022-12-16T07:44:32Z")
Hi I want to use java sdk to insert document using ID .I will have custom my own IDs to insert docs. Thanks Suresh --- ## [Elastic Agent System integration not collecting Windows Event Log](https://discuss.elastic.co/t/elastic-agent-system-integration-not-collecting-windows-event-log/320344)
**Author:** [@username11](https://discuss.elastic.co/u/username11)\ **Replies:** 1\ **Last updated:** [December 16, 2022, 7:32am UTC](https://discuss.elastic.co/t/elastic-agent-system-integration-not-collecting-windows-event-log/320344 "2022-12-16T07:32:08Z")
Hi. I am testing Elastic Agent (v8.0.1) + Fleet (v.8.5.2), and I'm currently having a problem with collecting Windows Event Log on a test machine. I have set up the agent and it does connect to Fleet and Elasticsearch, a… --- ## [Log requests](https://discuss.elastic.co/t/log-requests/321216)
**Author:** [@lubosvr](https://discuss.elastic.co/u/lubosvr)\ **Replies:** 2\ **Last updated:** [December 16, 2022, 7:29am UTC](https://discuss.elastic.co/t/log-requests/321216 "2022-12-16T07:29:00Z")
Hi, I'm migrating from the High Level Rest Client to Java Client and have problem to log the requests that are sent to ES. I'm not using direct query, but somethink like this: final var countRequest = new CountRequest… --- ## [Does elastic support transfer old data to ecs format?](https://discuss.elastic.co/t/does-elastic-support-transfer-old-data-to-ecs-format/321378)
**Author:** [@alex\_su](https://discuss.elastic.co/u/alex_su)\ **Replies:** 0\ **Last updated:** [December 16, 2022, 7:06am UTC](https://discuss.elastic.co/t/does-elastic-support-transfer-old-data-to-ecs-format/321378 "2022-12-16T07:06:30Z")
Hi, I want to know if i have old data (ex: windows event log) as below , does elasitc has package support transfer this format to ecs ? thanks. "{ ""configSource"": ""XXX"", ""\_User"": """", ""@version"": ""1"", … --- ## [Container logs not ingesting properly to elastic fleet agents](https://discuss.elastic.co/t/container-logs-not-ingesting-properly-to-elastic-fleet-agents/321377)
**Author:** [@krishnaabylle](https://discuss.elastic.co/u/krishnaabylle)\ **Replies:** 0\ **Last updated:** [December 16, 2022, 6:54am UTC](https://discuss.elastic.co/t/container-logs-not-ingesting-properly-to-elastic-fleet-agents/321377 "2022-12-16T06:54:40Z")
Hi, As we rolled out our elastic agents in new clusters through fleets, all logs are coming to Metrics-\* and Logs-\* from Kubernetes containers. As per documentation all the logs should come to Logs-\* and Metrics-\*. We … --- ## [Update Fields Based On The Same Value Of The Other Field (Same Index)](https://discuss.elastic.co/t/update-fields-based-on-the-same-value-of-the-other-field-same-index/321376)
**Author:** [@baoletrg](https://discuss.elastic.co/u/baoletrg)\ **Replies:** 0\ **Last updated:** [December 16, 2022, 6:52am UTC](https://discuss.elastic.co/t/update-fields-based-on-the-same-value-of-the-other-field-same-index/321376 "2022-12-16T06:52:29Z")
Hi guys, Im new to ELK and have googled for a solution for this case. For example, in my index, one transaction has 3 records logged, they all has the same ofsID field. Then I want to update a field named durationTime in… --- ## [Logs in discover tab are in ascending order](https://discuss.elastic.co/t/logs-in-discover-tab-are-in-ascending-order/321252)
**Author:** [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\ **Replies:** 2\ **Last updated:** [December 16, 2022, 6:13am UTC](https://discuss.elastic.co/t/logs-in-discover-tab-are-in-ascending-order/321252 "2022-12-16T06:13:28Z")
Hi, As u can see in the image the logs are showing the timestamp of Dec 12 first. The latest one's are of Dec 15. elasticsearch\_syslog is the data view created for indices elasticsearch\_syslog%timestamp. What can i d… --- ## [Confused issue when I search indices using wildcard pattern](https://discuss.elastic.co/t/confused-issue-when-i-search-indices-using-wildcard-pattern/321369)
**Author:** [@Young\_Edmond](https://discuss.elastic.co/u/Young_Edmond)\ **Replies:** 0\ **Last updated:** [December 16, 2022, 6:01am UTC](https://discuss.elastic.co/t/confused-issue-when-i-search-indices-using-wildcard-pattern/321369 "2022-12-16T06:01:14Z")
Hi. I meet such interesting issue, I have created 3 indices named as below es-os-complex-neo-000001 es-os-complex-neo-000002 es-os-complex-neo-yudyang, when I try to get index using the specific name in dev tools, … --- ## [Can I add normalizer in runtime?](https://discuss.elastic.co/t/can-i-add-normalizer-in-runtime/321323)
**Author:** [@Michal\_Stefaniuk](https://discuss.elastic.co/u/Michal_Stefaniuk)\ **Replies:** 1\ **Last updated:** [December 16, 2022, 5:18am UTC](https://discuss.elastic.co/t/can-i-add-normalizer-in-runtime/321323 "2022-12-16T05:18:28Z")
Hey guys! I want to add a new field into my existing mapping (using dynamic templates as well). As far as I understand the best way to do it is to use update mapping API (Update mapping API | Elasticsearch Guide \[8.5\] |… --- ## [RuleDataWriteDisabledError ELK v8.5](https://discuss.elastic.co/t/ruledatawritedisablederror-elk-v8-5/320031)
**Author:** [@theacodes](https://discuss.elastic.co/u/theacodes)\ **Replies:** 5\ **Last updated:** [December 16, 2022, 5:05am UTC](https://discuss.elastic.co/t/ruledatawritedisablederror-elk-v8-5/320031 "2022-12-16T05:05:54Z")
getting this error Bulk Indexing of signals failed: RuleDataWriteDisabledError: Rule registry writing is disabled due to an error during Rule Data Client initialization. After I updated ELK from 8.4 to 8.5 --- ## [Can I use update statement in jdbc output plugin logstash](https://discuss.elastic.co/t/can-i-use-update-statement-in-jdbc-output-plugin-logstash/321358)
**Author:** [@Big\_Man](https://discuss.elastic.co/u/Big_Man)\ **Replies:** 1\ **Last updated:** [December 16, 2022, 4:21am UTC](https://discuss.elastic.co/t/can-i-use-update-statement-in-jdbc-output-plugin-logstash/321358 "2022-12-16T04:21:51Z")
I need to update specific row in my database. Can i use update statement? If yes how do that Or any other solution to achieve that. --- ## [Filebeat reading logs repeatedly](https://discuss.elastic.co/t/filebeat-reading-logs-repeatedly/321364)
**Author:** [@GodSlayer\_Inferno](https://discuss.elastic.co/u/GodSlayer_Inferno)\ **Replies:** 0\ **Last updated:** [December 16, 2022, 4:01am UTC](https://discuss.elastic.co/t/filebeat-reading-logs-repeatedly/321364 "2022-12-16T04:01:37Z")
I am deploying filebeat on a Linux server to manage logs on a webdrive mounted. Filebeat read the logs and send the content to logstash repeatedly, generating duplicated content. The frequency of each line appearing is a… --- ## [Elasticsearch-js ConnectionError: socket hang up](https://discuss.elastic.co/t/elasticsearch-js-connectionerror-socket-hang-up/321359)
**Author:** [@Jinhyuck\_Cha](https://discuss.elastic.co/u/Jinhyuck_Cha)\ **Replies:** 0\ **Last updated:** [December 16, 2022, 2:31am UTC](https://discuss.elastic.co/t/elasticsearch-js-connectionerror-socket-hang-up/321359 "2022-12-16T02:31:50Z")
hi I'm try to make github ci test flow in my project But there are a issue about ConnectionError: socket hang up I don't know what it is happen. Because this docker-file is well work in my local dev environment. How … --- ## [Packet Beats for DNS logs](https://discuss.elastic.co/t/packet-beats-for-dns-logs/321236)
**Author:** [@jrpayne30506](https://discuss.elastic.co/u/jrpayne30506)\ **Replies:** 5\ **Last updated:** [December 16, 2022, 12:32am UTC](https://discuss.elastic.co/t/packet-beats-for-dns-logs/321236 "2022-12-16T00:32:22Z")
I have set up a Graylog server in order to send my DNS logs to and installed Packetbeat on the Windows DNS server. In the instructions I found for configuring the yml file, it said to use either the username and password… --- ## [Index sizes increasing after upgrade from 7.10.2 -\> 7.17.0](https://discuss.elastic.co/t/index-sizes-increasing-after-upgrade-from-7-10-2-7-17-0/321352)
**Author:** [@zfisher](https://discuss.elastic.co/u/zfisher)\ **Replies:** 0\ **Last updated:** [December 15, 2022, 10:24pm UTC](https://discuss.elastic.co/t/index-sizes-increasing-after-upgrade-from-7-10-2-7-17-0/321352 "2022-12-15T22:24:29Z")
We recently upgraded our cluster from version 7.10.2 to version 7.17 and have noticed that, starting on the day of the upgrade, the total storage size for our indices has grown while our event count has stayed relatively… --- ## [Filebeat index ILM error](https://discuss.elastic.co/t/filebeat-index-ilm-error/321320)
**Author:** [@Shalinicts](https://discuss.elastic.co/u/Shalinicts)\ **Replies:** 0\ **Last updated:** [December 15, 2022, 3:01pm UTC](https://discuss.elastic.co/t/filebeat-index-ilm-error/321320 "2022-12-15T15:01:12Z")
Blockquote Hi Team , We are getting below error in elasticsearch ILM error : Blockquote illegal\_argument\_exception: index.lifecycle.rollover\_alias \[filebeat-7.17.1\] does not point to index \[filebeat-7.17.1-o365-… --- ## [Elastcisearch](https://discuss.elastic.co/t/elastcisearch/321319)
**Author:** [@Sarthak\_Agarwal](https://discuss.elastic.co/u/Sarthak_Agarwal)\ **Replies:** 0\ **Last updated:** [December 15, 2022, 2:46pm UTC](https://discuss.elastic.co/t/elastcisearch/321319 "2022-12-15T14:46:51Z")
I am using the last Java Client API for Elasticsearch 7.17.5. I have a boolean query builder and I want to add conditions before checking if a must clause is already there or not. But the issue is that I can build the q… --- ## [TCP-input Receiving an encoding error](https://discuss.elastic.co/t/tcp-input-receiving-an-encoding-error/321344)
**Author:** [@elrozario](https://discuss.elastic.co/u/elrozario)\ **Replies:** 1\ **Last updated:** [December 15, 2022, 8:49pm UTC](https://discuss.elastic.co/t/tcp-input-receiving-an-encoding-error/321344 "2022-12-15T20:49:24Z")
Hello, I have a TCP input and getting data with some special characters. How do I resolve this issue? Here is my config input { tcp { host =\> "0.0.0.0" port =\> "0000" mode =\> "server" … --- ## [Mapping conflict between object, text, & keyword](https://discuss.elastic.co/t/mapping-conflict-between-object-text-keyword/321343)
**Author:** [@datdoo](https://discuss.elastic.co/u/datdoo)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 8:39pm UTC](https://discuss.elastic.co/t/mapping-conflict-between-object-text-keyword/321343 "2022-12-15T20:39:59Z")
I have this mapping currently "response": { "properties": { "body": { "properties": { "id": { "type": "long" }, "json… --- ## [Not getting output with CEF codec](https://discuss.elastic.co/t/not-getting-output-with-cef-codec/321341)
**Author:** [@j00bar](https://discuss.elastic.co/u/j00bar)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 8:18pm UTC](https://discuss.elastic.co/t/not-getting-output-with-cef-codec/321341 "2022-12-15T20:18:56Z")
I've got a working pipeline in Logstash where non-ECS JSON (I have ecs\_compatibility disabled in my pipeline) is coming in from SQS, getting transformed using mutate filters, and then output using stdout and the rubydebu… [Previous page](https://discuss.elastic.co/latest.md?page=854) [Next page](https://discuss.elastic.co/latest.md?page=856)