# Latest **URL:** https://discuss.elastic.co/latest.md?page=885 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 886 --- ## [\[logstash.outputs.elasticsearch\] Attempted to resurrect connection to dead ES instance - AWS Govcloud](https://discuss.elastic.co/t/logstash-outputs-elasticsearch-attempted-to-resurrect-connection-to-dead-es-instance-aws-govcloud/319572)
**Author:** [@Vtech](https://discuss.elastic.co/u/Vtech)\ **Replies:** 1\ **Last updated:** [November 23, 2022, 7:01am UTC](https://discuss.elastic.co/t/logstash-outputs-elasticsearch-attempted-to-resurrect-connection-to-dead-es-instance-aws-govcloud/319572 "2022-11-23T07:01:27Z")
Getting the following error when attempting to send on-prem logstash to elasticsearch in the cloud The version running in the cloud is 8.2.2 Log file \[2022-11-22T08:24:43,581\]\[INFO \]\[logstash.runner \] Log4j … --- ## [Deleted docs could be still retrieved although refreshed](https://discuss.elastic.co/t/deleted-docs-could-be-still-retrieved-although-refreshed/319609)
**Author:** [@fanqiaoqing](https://discuss.elastic.co/u/fanqiaoqing)\ **Replies:** 14\ **Last updated:** [November 23, 2022, 6:44am UTC](https://discuss.elastic.co/t/deleted-docs-could-be-still-retrieved-although-refreshed/319609 "2022-11-23T06:44:52Z")
Hi Elasticsearch, I have an index with about 2.5 billion documents. The primary has a total of 10 shards, and each shard is about 10G. We have a problem like this: A query will find out the number of documents for som… --- ## [Logstash 7.3.1 with Elasticsearch 7.17.1](https://discuss.elastic.co/t/logstash-7-3-1-with-elasticsearch-7-17-1/319617)
**Author:** [@Wan\_Nur\_Athirah\_Wan](https://discuss.elastic.co/u/Wan_Nur_Athirah_Wan)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 6:30am UTC](https://discuss.elastic.co/t/logstash-7-3-1-with-elasticsearch-7-17-1/319617 "2022-11-23T06:30:02Z")
Hai. one quick question since i already upgrade my Elasticsearch version from 7.3.1 to 7.17.1. Is it compatible to use logstash 7.3.1 with Elasticsearch 7.17.1 and do i also must upgrade logstash? since there still no er… --- ## [Logstash loki standalone setup with input file form /var/log/ dir](https://discuss.elastic.co/t/logstash-loki-standalone-setup-with-input-file-form-var-log-dir/319614)
**Author:** [@jijesh\_vu](https://discuss.elastic.co/u/jijesh_vu)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 6:11am UTC](https://discuss.elastic.co/t/logstash-loki-standalone-setup-with-input-file-form-var-log-dir/319614 "2022-11-23T06:11:36Z")
Im using logstash client with input file plugin to read the kubernetes logs from /var/log/\*\* directory. I have also a log generator is running on a node, and grafana is unable to detect the log generator logs .Grafana is… --- ## [Automatically create shards](https://discuss.elastic.co/t/automatically-create-shards/319613)
**Author:** [@dms6978](https://discuss.elastic.co/u/dms6978)\ **Replies:** 2\ **Last updated:** [November 23, 2022, 5:54am UTC](https://discuss.elastic.co/t/automatically-create-shards/319613 "2022-11-23T05:54:09Z")
Is there a way to automatically create a shard in one index when the specified shard capacity is full like index rollover? --- ## [App Search Roles](https://discuss.elastic.co/t/app-search-roles/318704)
**Author:** [@moassafiri](https://discuss.elastic.co/u/moassafiri)\ **Replies:** 3\ **Last updated:** [November 23, 2022, 4:37am UTC](https://discuss.elastic.co/t/app-search-roles/318704 "2022-11-23T04:37:36Z")
Hi Team, Is it possible to create custom App Search roles? We're looking to give a user Read-Only access to all the elements that a Developer can see (Crawlers, Curations etc) - but not give them write access. Thanks, --- ## [Metricbeat unable to find keystore values with \`systemctl\`](https://discuss.elastic.co/t/metricbeat-unable-to-find-keystore-values-with-systemctl/319595)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 5\ **Last updated:** [November 23, 2022, 4:09am UTC](https://discuss.elastic.co/t/metricbeat-unable-to-find-keystore-values-with-systemctl/319595 "2022-11-23T04:09:42Z")
I am having trouble using the /usr/share/metricbeat/bin/metricbeat keystore command to store an api key. Everytime I do a systemctl restart metricbeat.service, I get this error: {"log.level":"error","@timestamp":"2022-… --- ## [Elastic search doesnot bootstrap with 8.5.0](https://discuss.elastic.co/t/elastic-search-doesnot-bootstrap-with-8-5-0/318993)
**Author:** [@smiley\_tamy](https://discuss.elastic.co/u/smiley_tamy)\ **Replies:** 6\ **Last updated:** [November 23, 2022, 3:07am UTC](https://discuss.elastic.co/t/elastic-search-doesnot-bootstrap-with-8-5-0/318993 "2022-11-23T03:07:08Z")
I have Elasticsearch service with version 8.5.0 When I try to invoke Elasticsearch.main from Java class, the following exception is thrown Can you please help me to resolve that Invoked call - Elasticsearch.main(args… --- ## [Access child aggregations from parent](https://discuss.elastic.co/t/access-child-aggregations-from-parent/319607)
**Author:** [@HasiAmarasena](https://discuss.elastic.co/u/HasiAmarasena)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 3:04am UTC](https://discuss.elastic.co/t/access-child-aggregations-from-parent/319607 "2022-11-23T03:04:01Z")
I have below search POST /MY\_ID/\_search?typed\_keys=true { "aggs": { "terms\_agg": { "terms": { "field": "\[RefNumber\]" }, "aggs": { "max\_agg\_startdate": { "max": { … --- ## [Logstash.inputs.jdbc connect to Azure SQL Server throw exception](https://discuss.elastic.co/t/logstash-inputs-jdbc-connect-to-azure-sql-server-throw-exception/319603)
**Author:** [@liuxiao617111](https://discuss.elastic.co/u/liuxiao617111)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 1:59am UTC](https://discuss.elastic.co/t/logstash-inputs-jdbc-connect-to-azure-sql-server-throw-exception/319603 "2022-11-23T01:59:15Z")
when I using "authentication=ActiveDirectoryPassword" to connect Azure SQL server. It throw an exception: "Failed to load MSAL4J Java library for performing ActiveDirectoryPassword authentication.". Logstash Version : … --- ## [Elasticsearch multi-match query using a fuzziness criteria behaves in a strange way](https://discuss.elastic.co/t/elasticsearch-multi-match-query-using-a-fuzziness-criteria-behaves-in-a-strange-way/319498)
**Author:** [@Ivo\_Tavares](https://discuss.elastic.co/u/Ivo_Tavares)\ **Replies:** 2\ **Last updated:** [November 23, 2022, 12:40am UTC](https://discuss.elastic.co/t/elasticsearch-multi-match-query-using-a-fuzziness-criteria-behaves-in-a-strange-way/319498 "2022-11-23T00:40:37Z")
I'm trying to search for some files using the function fetch\_document to fetch a document by its name in the data.name subfield. This function is being used in the following way: fetch\_document( client=server, … --- ## [Elasticsearch not returning larger results (not total result size/length, but size of individual hit](https://discuss.elastic.co/t/elasticsearch-not-returning-larger-results-not-total-result-size-length-but-size-of-individual-hit/319242)
**Author:** [@NickIsWorking](https://discuss.elastic.co/u/NickIsWorking)\ **Replies:** 5\ **Last updated:** [November 22, 2022, 10:59pm UTC](https://discuss.elastic.co/t/elasticsearch-not-returning-larger-results-not-total-result-size-length-but-size-of-individual-hit/319242 "2022-11-22T22:59:25Z")
Hello. I have an Elasticsearch instance, storing objects that contain really large strings. I am trying to make a request to retrieve those objects from elasticsearch, but for whatever reason, elasticsearch will not retu… --- ## [Rsyslog + Elasticsearch + Kibana](https://discuss.elastic.co/t/rsyslog-elasticsearch-kibana/319594)
**Author:** [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\ **Replies:** 0\ **Last updated:** [November 22, 2022, 10:41pm UTC](https://discuss.elastic.co/t/rsyslog-elasticsearch-kibana/319594 "2022-11-22T22:41:56Z")
Hello! Could you give link to rsyslog configuration to work with Elasticsearch and Kibana? Thank you, Vassiliy --- ## [How to Reference field value(s) in Logstash](https://discuss.elastic.co/t/how-to-reference-field-value-s-in-logstash/319593)
**Author:** [@RCooper56](https://discuss.elastic.co/u/RCooper56)\ **Replies:** 2\ **Last updated:** [November 22, 2022, 10:41pm UTC](https://discuss.elastic.co/t/how-to-reference-field-value-s-in-logstash/319593 "2022-11-22T22:41:06Z")
Hey Elastic Team, First time post here so please let me know if you need more detail, I'll try to provide as much context as possible. I am trying to create a visualisation based on snmp data coming from our firewall. … --- ## [Email - Something happen while delivering an email {:exception=\>#\}](https://discuss.elastic.co/t/email-something-happen-while-delivering-an-email-exception-net-execution-expired/319590)
**Author:** [@David\_Graciano](https://discuss.elastic.co/u/David_Graciano)\ **Replies:** 0\ **Last updated:** [November 22, 2022, 9:49pm UTC](https://discuss.elastic.co/t/email-something-happen-while-delivering-an-email-exception-net-execution-expired/319590 "2022-11-22T21:49:03Z")
Attempting to send an email from the logstash output produces the following error in the output. email - Something happen while delivering an email {:exception=\>#\} this is my curren… --- ## [MaxTimeoutReached occurring after failing to connect via sniffing connection pool](https://discuss.elastic.co/t/maxtimeoutreached-occurring-after-failing-to-connect-via-sniffing-connection-pool/318973)
**Author:** [@Hoppities](https://discuss.elastic.co/u/Hoppities)\ **Replies:** 1\ **Last updated:** [November 22, 2022, 7:53pm UTC](https://discuss.elastic.co/t/maxtimeoutreached-occurring-after-failing-to-connect-via-sniffing-connection-pool/318973 "2022-11-22T19:53:45Z")
Whenever we run into this scenario where a sniff happened and elastic was unable to connect, we then see this timeout with a massive negative number. I'm not even sure where to start with this. Any help would be appreci… --- ## [Filebeat.yml and logstash.conf are not getting loaded automatically](https://discuss.elastic.co/t/filebeat-yml-and-logstash-conf-are-not-getting-loaded-automatically/319573)
**Author:** [@Manjiri](https://discuss.elastic.co/u/Manjiri)\ **Replies:** 1\ **Last updated:** [November 22, 2022, 6:53pm UTC](https://discuss.elastic.co/t/filebeat-yml-and-logstash-conf-are-not-getting-loaded-automatically/319573 "2022-11-22T18:53:18Z")
When we starting the filebeat and logstash services through services.msc , filebeat.yml and logstash.conf is not getting loaded automatically. Everytime we need to load 2 files manually through command prompt using below… --- ## [Defender for Endpoint to Azure Event Hub to Elasticsearch?](https://discuss.elastic.co/t/defender-for-endpoint-to-azure-event-hub-to-elasticsearch/319578)
**Author:** [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Replies:** 0\ **Last updated:** [November 22, 2022, 5:53pm UTC](https://discuss.elastic.co/t/defender-for-endpoint-to-azure-event-hub-to-elasticsearch/319578 "2022-11-22T17:53:31Z")
Our Defender for Endpoint Device tables are around 1TB a day, I'll never get the money to use Sentinel so I'm looking for an alternative. Is there no way to use Azure Event Hubs with Elasticsearch? Stream the events fr… --- ## [I want to have a button kind of visualization in the KIBANA dashboard, Can anyone please provide any information on this?](https://discuss.elastic.co/t/i-want-to-have-a-button-kind-of-visualization-in-the-kibana-dashboard-can-anyone-please-provide-any-information-on-this/316733)
**Author:** [@abhinay\_nalla](https://discuss.elastic.co/u/abhinay_nalla)\ **Replies:** 6\ **Last updated:** [October 26, 2022, 6:56am UTC](https://discuss.elastic.co/t/i-want-to-have-a-button-kind-of-visualization-in-the-kibana-dashboard-can-anyone-please-provide-any-information-on-this/316733 "2022-10-26T06:56:13Z")
I want to create one button which shows this kind of information in it. If anyone has this kind of solution or information please do help me. Thank you Regards Abhi --- ## [Output isolator pattern, not working as expected when one pipeline is down](https://discuss.elastic.co/t/output-isolator-pattern-not-working-as-expected-when-one-pipeline-is-down/319329)
**Author:** [@rravitech](https://discuss.elastic.co/u/rravitech)\ **Replies:** 9\ **Last updated:** [November 22, 2022, 5:28pm UTC](https://discuss.elastic.co/t/output-isolator-pattern-not-working-as-expected-when-one-pipeline-is-down/319329 "2022-11-22T17:28:16Z")
All the outputs stop when one goes down here, i am trying to implement the output isolator pattern. In the below configuration when hosts =\> \["ext-se:9200"\] goes down the other host "es-host1" { hosts =\> \["eric-data-se… --- ## [Discover gives error from Kibana](https://discuss.elastic.co/t/discover-gives-error-from-kibana/319371)
**Author:** [@mpniel](https://discuss.elastic.co/u/mpniel)\ **Replies:** 4\ **Last updated:** [November 22, 2022, 5:25pm UTC](https://discuss.elastic.co/t/discover-gives-error-from-kibana/319371 "2022-11-22T17:25:36Z")
Hi, Click on discover icon from kibana gives the following error: Error: Request to Elasticsearch failed: ("error": {"root\_cause": \[{"reason': 'forbidden' due to \["OPERATION NOT ALLOWED"\]}\], "reason": "forbidden", "du… --- ## [Can I edit the query or inspector of a metricbeat lens?](https://discuss.elastic.co/t/can-i-edit-the-query-or-inspector-of-a-metricbeat-lens/319567)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 1\ **Last updated:** [November 22, 2022, 5:00pm UTC](https://discuss.elastic.co/t/can-i-edit-the-query-or-inspector-of-a-metricbeat-lens/319567 "2022-11-22T17:00:03Z")
I am learning to use MetricBeat and dashboards. I'm really enjoying it so far but I want to be able to edit one of the lens. This image below shows two lens that I really like, but I want to modify: So what I did w… --- ## [mTLS only setup for Elasticsearch](https://discuss.elastic.co/t/mtls-only-setup-for-elasticsearch/319576)
**Author:** [@Rohit\_Shrivastava](https://discuss.elastic.co/u/Rohit_Shrivastava)\ **Replies:** 0\ **Last updated:** [November 22, 2022, 4:59pm UTC](https://discuss.elastic.co/t/mtls-only-setup-for-elasticsearch/319576 "2022-11-22T16:59:20Z")
Is it possible to only use mTLS i.e. only authentication via PKI realm. I almost have the cluster working (using open source helm charts and 7.1.7 images). One issue I have is the pod readiness doesn't succeed as the \_c… --- ## [Drill down to different Dashboards in Maps for Elasticsearch 8.3.3](https://discuss.elastic.co/t/drill-down-to-different-dashboards-in-maps-for-elasticsearch-8-3-3/319450)
**Author:** [@Abj\_Ins](https://discuss.elastic.co/u/Abj_Ins)\ **Replies:** 3\ **Last updated:** [November 22, 2022, 3:39pm UTC](https://discuss.elastic.co/t/drill-down-to-different-dashboards-in-maps-for-elasticsearch-8-3-3/319450 "2022-11-22T15:39:50Z")
Hi Everyone, It would be really helpful if anyone can provide some solution. so, we are aware of drilldown options in Maps in Kibana and was trying to use it in our requirement where using filter option from the "… --- ## [Unable to output container password details when using ansible with podman](https://discuss.elastic.co/t/unable-to-output-container-password-details-when-using-ansible-with-podman/319563)
**Author:** [@millerthegorilla](https://discuss.elastic.co/u/millerthegorilla)\ **Replies:** 0\ **Last updated:** [November 22, 2022, 3:21pm UTC](https://discuss.elastic.co/t/unable-to-output-container-password-details-when-using-ansible-with-podman/319563 "2022-11-22T15:21:28Z")
Hi, when using ansible-podman, I am unable to output the std-out of the container run command as I might do when using the command line. This means that I don't get to see the automatically generated password and keysto… --- ## [Dropdown filter kibana canvas](https://discuss.elastic.co/t/dropdown-filter-kibana-canvas/319315)
**Author:** [@Gianluca\_De\_Pasquale](https://discuss.elastic.co/u/Gianluca_De_Pasquale)\ **Replies:** 5\ **Last updated:** [November 22, 2022, 2:36pm UTC](https://discuss.elastic.co/t/dropdown-filter-kibana-canvas/319315 "2022-11-22T14:36:08Z")
Hi all, following the topic Dropdown filter kibana canvas - Elastic Stack / Kibana - Discuss the Elastic Stack I tried to filter data on a table by using dropdown list element, but I did not succeed. I attach the code u… --- ## [Weekly Index Delete Automatically from Elasticsearch Cluster](https://discuss.elastic.co/t/weekly-index-delete-automatically-from-elasticsearch-cluster/319552)
**Author:** [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\ **Replies:** 5\ **Last updated:** [November 22, 2022, 2:36pm UTC](https://discuss.elastic.co/t/weekly-index-delete-automatically-from-elasticsearch-cluster/319552 "2022-11-22T14:36:02Z")
Hello Guys I am using Elasticsearch 7.10.2 I have 6 Data node Cluster in this Cluster I am Facing Space Issue so I set Index Policy for Daily Index but I am having Monthly and Weekly Index I want setup Automatically De… --- ## [Logstash connection with Oracle wallet](https://discuss.elastic.co/t/logstash-connection-with-oracle-wallet/319300)
**Author:** [@Num](https://discuss.elastic.co/u/Num)\ **Replies:** 3\ **Last updated:** [November 22, 2022, 2:31pm UTC](https://discuss.elastic.co/t/logstash-connection-with-oracle-wallet/319300 "2022-11-22T14:31:17Z")
Hello, I'm having issues connecting Logstash using Oracle wallet. I am getting an invalid login/password even though I am trying to connect through the wallet, without using said login/password. \[ERROR\]\[logstash.input… --- ## [Elasticsearch PHP Client implementation for a webshop](https://discuss.elastic.co/t/elasticsearch-php-client-implementation-for-a-webshop/319557)
**Author:** [@Thymen](https://discuss.elastic.co/u/Thymen)\ **Replies:** 0\ **Last updated:** [November 22, 2022, 2:26pm UTC](https://discuss.elastic.co/t/elasticsearch-php-client-implementation-for-a-webshop/319557 "2022-11-22T14:26:03Z")
Hello there, I am using the Elasticsearch PHP client (8.3), as can be found on: github I've used several types of queries to find and filter through results on several indices to find relevant/popular. Some more comple… --- ## [Elasticsearch-certutil parameters](https://discuss.elastic.co/t/elasticsearch-certutil-parameters/319529)
**Author:** [@adrien\_moreau](https://discuss.elastic.co/u/adrien_moreau)\ **Replies:** 1\ **Last updated:** [November 22, 2022, 1:47pm UTC](https://discuss.elastic.co/t/elasticsearch-certutil-parameters/319529 "2022-11-22T13:47:45Z")
Hello, I am using Elasticsearch on a self managed cluster and I had to use the "elasticsearch-certutil" tool to manage my cluster certificates. The help menu from the tool only lists the following options Simplifies c… [Previous page](https://discuss.elastic.co/latest.md?page=884) [Next page](https://discuss.elastic.co/latest.md?page=886)