# Latest **URL:** https://discuss.elastic.co/latest.md?page=856 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 857 --- ## [Unable to use the replace filter on filebeat.yml](https://discuss.elastic.co/t/unable-to-use-the-replace-filter-on-filebeat-yml/321305)
**Author:** [@maviles](https://discuss.elastic.co/u/maviles)\ **Replies:** 4\ **Last updated:** [December 15, 2022, 5:44pm UTC](https://discuss.elastic.co/t/unable-to-use-the-replace-filter-on-filebeat-yml/321305 "2022-12-15T17:44:26Z")
I cannot replace the value of a field using the "replace" processor on filebeat.yml. The service is running but the field returns a null value. See the configuration below: replace: fields: - field: "decoded.cef.sev… --- ## [.net client application log not creating index in elasticsearch](https://discuss.elastic.co/t/net-client-application-log-not-creating-index-in-elasticsearch/321259)
**Author:** [@rajvel](https://discuss.elastic.co/u/rajvel)\ **Replies:** 4\ **Last updated:** [December 15, 2022, 4:41pm UTC](https://discuss.elastic.co/t/net-client-application-log-not-creating-index-in-elasticsearch/321259 "2022-12-15T16:41:38Z")
Hello Team, we have .net application we used .net client elasticsearch to share the log to new index. Recently we haven't received any new index created by .net application. there is no way to find the whether the inde… --- ## [Exclude file types/extensions with Agent Policy](https://discuss.elastic.co/t/exclude-file-types-extensions-with-agent-policy/321326)
**Author:** [@cmminear](https://discuss.elastic.co/u/cmminear)\ **Replies:** 0\ **Last updated:** [December 15, 2022, 3:56pm UTC](https://discuss.elastic.co/t/exclude-file-types-extensions-with-agent-policy/321326 "2022-12-15T15:56:31Z")
I am trying to recusively include a bunch of folders for logs but exclude a few extensions/file types and missing any documentation specific for the agents to do this. I want to get all logs in all folder from /cgilo… --- ## [Migrate from NEST 6.6 to ElasticSearch client 8](https://discuss.elastic.co/t/migrate-from-nest-6-6-to-elasticsearch-client-8/321288)
**Author:** [@apokryfos](https://discuss.elastic.co/u/apokryfos)\ **Replies:** 1\ **Last updated:** [December 15, 2022, 3:15pm UTC](https://discuss.elastic.co/t/migrate-from-nest-6-6-to-elasticsearch-client-8/321288 "2022-12-15T15:15:36Z")
I've recently upgraded my Elasticsearch server from 6.6 to 8.5 (quite a jump I know but it was long overdue). The main process to create/updated indexes is written in C# and was previously using NEST. I originally asked… --- ## [Heartbeat issue : Bad Gateway: couldn't connect to any of the configured Elasticsearch hosts](https://discuss.elastic.co/t/heartbeat-issue-bad-gateway-couldnt-connect-to-any-of-the-configured-elasticsearch-hosts/321270)
**Author:** [@aji.shinde7](https://discuss.elastic.co/u/aji.shinde7)\ **Replies:** 3\ **Last updated:** [December 15, 2022, 3:14pm UTC](https://discuss.elastic.co/t/heartbeat-issue-bad-gateway-couldnt-connect-to-any-of-the-configured-elasticsearch-hosts/321270 "2022-12-15T15:14:28Z")
Hello Experts, I am having issue to connect Heartbeat to Elasticsearch instance (Cloud). Background: I have a Linux server, Heartbeat Version 7.5.0 is running on it and sending Data to Elasticsearch instance (Cloud). … --- ## [APM agent to Server Communication via https](https://discuss.elastic.co/t/apm-agent-to-server-communication-via-https/321277)
**Author:** [@Shalinicts](https://discuss.elastic.co/u/Shalinicts)\ **Replies:** 4\ **Last updated:** [December 15, 2022, 3:04pm UTC](https://discuss.elastic.co/t/apm-agent-to-server-communication-via-https/321277 "2022-12-15T15:04:31Z")
If you are asking about a problem you are experiencing, please use the following template, as it will help us help you. If you have a different problem, please delete all of this text :slight\_smile: TIP 1: select at lea… --- ## [High cpu usage after ES update to 7.17.7](https://discuss.elastic.co/t/high-cpu-usage-after-es-update-to-7-17-7/321143)
**Author:** [@anon90868141](https://discuss.elastic.co/u/anon90868141)\ **Replies:** 14\ **Last updated:** [December 15, 2022, 2:40pm UTC](https://discuss.elastic.co/t/high-cpu-usage-after-es-update-to-7-17-7/321143 "2022-12-15T14:40:59Z")
Hello, after an update from 7.16.2 to 7.17.7, we're experiencing about double the CPU usage without changing anything else. This happens during all time and the usage basically never dropped below the new baseline. When… --- ## [Learning to Rank not working for nested field type](https://discuss.elastic.co/t/learning-to-rank-not-working-for-nested-field-type/321182)
**Author:** [@varunbharti48](https://discuss.elastic.co/u/varunbharti48)\ **Replies:** 1\ **Last updated:** [December 15, 2022, 2:34pm UTC](https://discuss.elastic.co/t/learning-to-rank-not-working-for-nested-field-type/321182 "2022-12-15T14:34:29Z")
Hi, I am implementing learning to rank on a nested field type. It is working completely fine for object field type(non-nested). But in case of nested field we are using score\_mode : "sum" to cumulate the score of child … --- ## [2 aliases to 1 index with rollover](https://discuss.elastic.co/t/2-aliases-to-1-index-with-rollover/321313)
**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\ **Replies:** 3\ **Last updated:** [December 15, 2022, 2:30pm UTC](https://discuss.elastic.co/t/2-aliases-to-1-index-with-rollover/321313 "2022-12-15T14:30:23Z")
Hi, I want to define two aliases to index with rollover. I have set the following: PUT \_ilm/policy/policy1 { "policy": { "phases": { "hot": { "actions": { "rollover": { "max\_… --- ## [Cant parse logs with - in bytes field](https://discuss.elastic.co/t/cant-parse-logs-with-in-bytes-field/321281)
**Author:** [@bill210kouk](https://discuss.elastic.co/u/bill210kouk)\ **Replies:** 4\ **Last updated:** [December 15, 2022, 1:43pm UTC](https://discuss.elastic.co/t/cant-parse-logs-with-in-bytes-field/321281 "2022-12-15T13:43:30Z")
Hello! I facing an issue with my grok format pattern even though i managed to change the type of the bytes log field to numbers (this type will be used for better Kibana visualizations) some of logs have the bytes field… --- ## [ASP .NET 6.0 Agent seems to fail instantiation occasionally. No errors in logs](https://discuss.elastic.co/t/asp-net-6-0-agent-seems-to-fail-instantiation-occasionally-no-errors-in-logs/320890)
**Author:** [@Mellow](https://discuss.elastic.co/u/Mellow)\ **Replies:** 3\ **Last updated:** [December 15, 2022, 1:33pm UTC](https://discuss.elastic.co/t/asp-net-6-0-agent-seems-to-fail-instantiation-occasionally-no-errors-in-logs/320890 "2022-12-15T13:33:26Z")
APM Agent language and version: Elastic.Apm.NetCoreAll (1.16.0) and .NET 6.0 Original install method (e.g. download page, yum, deb, from source, etc.) and version: Nuget Fresh install or upgraded from other version? Fr… --- ## [Logstash convert existing timestamp format in message](https://discuss.elastic.co/t/logstash-convert-existing-timestamp-format-in-message/321309)
**Author:** [@Groove](https://discuss.elastic.co/u/Groove)\ **Replies:** 0\ **Last updated:** [December 15, 2022, 1:10pm UTC](https://discuss.elastic.co/t/logstash-convert-existing-timestamp-format-in-message/321309 "2022-12-15T13:10:09Z")
Hello, I have 2 different application logs. OUTPUT: \<135\>1 2022-12-12T16:28:02Z HOSTNAME EvntSLog - - - Le service Service de licences de client (ClipSVC) est entré dans l’état : arrêté. \<134\>Dec 12 16:28:02 HOSTNAME… --- ## [Best strategy for re-indexing?](https://discuss.elastic.co/t/best-strategy-for-re-indexing/320567)
**Author:** [@Michal\_Stefaniuk](https://discuss.elastic.co/u/Michal_Stefaniuk)\ **Replies:** 5\ **Last updated:** [December 15, 2022, 11:56am UTC](https://discuss.elastic.co/t/best-strategy-for-re-indexing/320567 "2022-12-15T11:56:15Z")
Hey guys! I have an index in my ES and apparently I've added a new fields in the mapping (on the spring boot application side). Now the application will be released to the client and on the client side we will have to c… --- ## [Upgrade ES version managed by ECK on terraform - all pods terminated](https://discuss.elastic.co/t/upgrade-es-version-managed-by-eck-on-terraform-all-pods-terminated/320897)
**Author:** [@Roberto\_D\_Arco](https://discuss.elastic.co/u/Roberto_D_Arco)\ **Replies:** 6\ **Last updated:** [December 15, 2022, 11:19am UTC](https://discuss.elastic.co/t/upgrade-es-version-managed-by-eck-on-terraform-all-pods-terminated/320897 "2022-12-15T11:19:36Z")
Hello everyone, Our current Production Elasticsearch cluster for logs collection is manually managed and runs on AWS. I'm creating the same cluster using ECK deployed with Helm under Terraform. I was able to get all t… --- ## [Bug in eck operator? Cluster upgrade fails (under terraform)](https://discuss.elastic.co/t/bug-in-eck-operator-cluster-upgrade-fails-under-terraform/321149)
**Author:** [@Roberto\_D\_Arco](https://discuss.elastic.co/u/Roberto_D_Arco)\ **Replies:** 1\ **Last updated:** [December 15, 2022, 11:13am UTC](https://discuss.elastic.co/t/bug-in-eck-operator-cluster-upgrade-fails-under-terraform/321149 "2022-12-15T11:13:30Z")
Hello everyone, Our current Production Elasticsearch cluster for logs collection is manually managed and runs on AWS. I'm creating the same cluster using ECK deployed with Helm under Terraform. I was able to get all t… --- ## [Different Query format for wildcard query and term query](https://discuss.elastic.co/t/different-query-format-for-wildcard-query-and-term-query/321250)
**Author:** [@adholpuria](https://discuss.elastic.co/u/adholpuria)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 10:50am UTC](https://discuss.elastic.co/t/different-query-format-for-wildcard-query-and-term-query/321250 "2022-12-15T10:50:59Z")
Hey community, I am currently using below mentioned query format for term query { "query": { "term": { "core.externalId": "Kimchy" } } Below is the query format described in Elasticsearch Document Ter… --- ## [Transforms combining pivot & latest](https://discuss.elastic.co/t/transforms-combining-pivot-latest/321193)
**Author:** [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Replies:** 5\ **Last updated:** [December 15, 2022, 10:35am UTC](https://discuss.elastic.co/t/transforms-combining-pivot-latest/321193 "2022-12-15T10:35:17Z")
Hello, I have a case where i pivot data based on : @timestamp (interval of 1 day) Entity (let say customer\_account) A customer\_account can order items any time, so raw data are like : order\_id @timestamp product\_i… --- ## [Sort bucket and metrics columns in Data table](https://discuss.elastic.co/t/sort-bucket-and-metrics-columns-in-data-table/319130)
**Author:** [@karlanakamura](https://discuss.elastic.co/u/karlanakamura)\ **Replies:** 1\ **Last updated:** [December 15, 2022, 10:22am UTC](https://discuss.elastic.co/t/sort-bucket-and-metrics-columns-in-data-table/319130 "2022-12-15T10:22:23Z")
Hello, I'm using version 8.4.3 of elastic cloud. I have a data table with 5 butckets (split row) and 4 metrics. From what I understand, the buckets columns are always before and the metrics columns are after. I would l… --- ## [Forward logs from Kafka to Elastic](https://discuss.elastic.co/t/forward-logs-from-kafka-to-elastic/320075)
**Author:** [@Deepika1](https://discuss.elastic.co/u/Deepika1)\ **Replies:** 3\ **Last updated:** [December 15, 2022, 10:10am UTC](https://discuss.elastic.co/t/forward-logs-from-kafka-to-elastic/320075 "2022-12-15T10:10:44Z")
Hello, I'm trying to forward logs from Kafka machine to Elasticsearch machine using kafka elastic connect referring below document configurations are: name=elasticsearch-sink connector.class=io.confluent.connect.ela… --- ## [Can't get started with the ElasticSearch Java API classes](https://discuss.elastic.co/t/cant-get-started-with-the-elasticsearch-java-api-classes/320951)
**Author:** [@Alain\_Desilets](https://discuss.elastic.co/u/Alain_Desilets)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 10:10am UTC](https://discuss.elastic.co/t/cant-get-started-with-the-elasticsearch-java-api-classes/320951 "2022-12-15T10:10:02Z")
I am am having a hell of a time trying to get started with the ES Java API using the instructions on the official doc I install it as instructed here, i.e., I put this in my pom.xml file: \ \ **Author:** [@swethanannam1325](https://discuss.elastic.co/u/swethanannam1325)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 10:09am UTC](https://discuss.elastic.co/t/how-to-enable-https-and-security-for-my-dev-elk-stack-cluster/321222 "2022-12-15T10:09:35Z") Hi, I'm new to Elastic Stack and I've setup Dev environment in my local machine. Can someone guide me on how to enable security for my Elasticsearch and Kibana. Also, do share me any documentation if available. --- ## [Kibana 8.2.3 "Donut chart can't render with negative values"](https://discuss.elastic.co/t/kibana-8-2-3-donut-chart-cant-render-with-negative-values/314508)
**Author:** [@nesretep](https://discuss.elastic.co/u/nesretep)\ **Replies:** 20\ **Last updated:** [October 20, 2022, 4:08pm UTC](https://discuss.elastic.co/t/kibana-8-2-3-donut-chart-cant-render-with-negative-values/314508 "2022-10-20T16:08:21Z")
Previously donuts and pies just rendered. Now this message is shown when negative values exist on buckets. How can this message be turned off, and thereby achieve the rendering of all buckets which are in fact positive. … --- ## [Agent Status in ELK](https://discuss.elastic.co/t/agent-status-in-elk/320451)
**Author:** [@Namita\_Jaokar](https://discuss.elastic.co/u/Namita_Jaokar)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 5:36am UTC](https://discuss.elastic.co/t/agent-status-in-elk/320451 "2022-12-15T05:36:35Z")
Hi Team, I am using ELK APM with Java agent. In Elasticsearch , We are able to view the current running services that have been configured in kibana dashboard. I wanted to understand how does ELK get the status of these… --- ## [\[7.5\] How to grant a user permission to create an index pattern?](https://discuss.elastic.co/t/7-5-how-to-grant-a-user-permission-to-create-an-index-pattern/319588)
**Author:** [@mpniel](https://discuss.elastic.co/u/mpniel)\ **Replies:** 9\ **Last updated:** [December 15, 2022, 9:15am UTC](https://discuss.elastic.co/t/7-5-how-to-grant-a-user-permission-to-create-an-index-pattern/319588 "2022-12-15T09:15:37Z")
Hi \[7.5\] How to grant a user permission to create an index pattern? --- ## [Make the search crawler ignore sitemap](https://discuss.elastic.co/t/make-the-search-crawler-ignore-sitemap/321212)
**Author:** [@GTHvidsten](https://discuss.elastic.co/u/GTHvidsten)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 9:08am UTC](https://discuss.elastic.co/t/make-the-search-crawler-ignore-sitemap/321212 "2022-12-15T09:08:50Z")
The app search is connected to a crawler. Is there a way to make this crawler ignore the sitemap defined in robots.txt? --- ## [Unrecognized function: kibanaRemoveFilter](https://discuss.elastic.co/t/unrecognized-function-kibanaremovefilter/321274)
**Author:** [@Jaro](https://discuss.elastic.co/u/Jaro)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 8:56am UTC](https://discuss.elastic.co/t/unrecognized-function-kibanaremovefilter/321274 "2022-12-15T08:56:01Z")
Hello, I get a visualisation error in Kibana: Unrecognized function: kibanaRemoveFilter The Vega code for the visualisation is below. It worked before we upgraded Kibana to OpenSearch 2.2.1 Would anyone know why is … --- ## [Grok Pattern](https://discuss.elastic.co/t/grok-pattern/321273)
**Author:** [@imdroid](https://discuss.elastic.co/u/imdroid)\ **Replies:** 0\ **Last updated:** [December 15, 2022, 8:33am UTC](https://discuss.elastic.co/t/grok-pattern/321273 "2022-12-15T08:33:10Z")
Hello, I'm trying to configure an ingest pipeline for my apache tomcat logs, need some help in generating a grok pattern for the below stack trace. \< 2022-12-15 06:24:37,468 \[DiscoveryClient-2\] ERROR \[/\] com.netflix.d… --- ## [Socket timeout using the v8 driver](https://discuss.elastic.co/t/socket-timeout-using-the-v8-driver/321197)
**Author:** [@Mhanna\_Abu\_Tareef](https://discuss.elastic.co/u/Mhanna_Abu_Tareef)\ **Replies:** 1\ **Last updated:** [December 15, 2022, 8:14am UTC](https://discuss.elastic.co/t/socket-timeout-using-the-v8-driver/321197 "2022-12-15T08:14:15Z")
Just moved to the new elastic client v8, but not able to overcome this annoying issue. a single request - create index - fails by timeout in the server log i can see the index got created the delete index right after … --- ## [Problem configure output Email in logstash.conf?](https://discuss.elastic.co/t/problem-configure-output-email-in-logstash-conf/321269)
**Author:** [@tpot\_IT](https://discuss.elastic.co/u/tpot_IT)\ **Replies:** 0\ **Last updated:** [December 15, 2022, 8:07am UTC](https://discuss.elastic.co/t/problem-configure-output-email-in-logstash-conf/321269 "2022-12-15T08:07:10Z")
Hello, My goal is to get email alerts from the Tpot . Do I need to install alerta before configure the logstash.conf to send emails ? I'm trying to follow those instructions: (gitHub) and insert the Email output to… --- ## [Shard size increase right after rollover](https://discuss.elastic.co/t/shard-size-increase-right-after-rollover/321261)
**Author:** [@nairobi](https://discuss.elastic.co/u/nairobi)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 7:48am UTC](https://discuss.elastic.co/t/shard-size-increase-right-after-rollover/321261 "2022-12-15T07:48:01Z")
I have index that primaries 3 replicas 1 ilm: roll over when any primary shard reaches 50gb (hot to warm) So when it reached to 300gb, it roll over to warm phase. But after it roll over, size of shard increase to abo… [Previous page](https://discuss.elastic.co/latest.md?page=855) [Next page](https://discuss.elastic.co/latest.md?page=857)