# Latest **URL:** https://discuss.elastic.co/latest.md?page=934 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 935 --- ## [Enrich processor time range](https://discuss.elastic.co/t/enrich-processor-time-range/316070)
**Author:** [@Marcin\_Frankiewicz](https://discuss.elastic.co/u/Marcin_Frankiewicz)\ **Replies:** 4\ **Last updated:** [October 12, 2022, 11:02am UTC](https://discuss.elastic.co/t/enrich-processor-time-range/316070 "2022-10-12T11:02:51Z")
Hi, i have a pipeline with enrich processor. When enriching is called.. what time range is used for enrich? All documents in index(defined in enrich policy) will be scanned? or maybe from last 15minutes? Elasticsearc… --- ## [What's the Lucene equivalent of KQL query: now/d](https://discuss.elastic.co/t/whats-the-lucene-equivalent-of-kql-query-now-d/316230)
**Author:** [@ykara84](https://discuss.elastic.co/u/ykara84)\ **Replies:** 3\ **Last updated:** [October 12, 2022, 10:58am UTC](https://discuss.elastic.co/t/whats-the-lucene-equivalent-of-kql-query-now-d/316230 "2022-10-12T10:58:21Z")
Hi I'm trying to filter my data based on a date field to show me everything for today, in Kibana I can use the KQL query using now/d but I need the equivalent for Lucene, any help? I wouldve thought it'd be the same but… --- ## [Debug slow search query](https://discuss.elastic.co/t/debug-slow-search-query/316265)
**Author:** [@Icy\_Goose](https://discuss.elastic.co/u/Icy_Goose)\ **Replies:** 1\ **Last updated:** [October 12, 2022, 10:45am UTC](https://discuss.elastic.co/t/debug-slow-search-query/316265 "2022-10-12T10:45:35Z")
Hi everyone, I'm trying to debug a slow search query in Elasticsearch. Per-shard activities seems healthy but total amount to complete the request is surprisingly high. As I understand, the profile API does not include t… --- ## [Missing Data Nodes on Cluster Monitoring of Kibana](https://discuss.elastic.co/t/missing-data-nodes-on-cluster-monitoring-of-kibana/314546)
**Author:** [@wonderland14](https://discuss.elastic.co/u/wonderland14)\ **Replies:** 10\ **Last updated:** [October 12, 2022, 10:11am UTC](https://discuss.elastic.co/t/missing-data-nodes-on-cluster-monitoring-of-kibana/314546 "2022-10-12T10:11:10Z")
A pleasant day everyone! I have this issue on my Kibana Cluster Monitoring, it happens that my data nodes are missing and only the monitoring nodes is there. I checked the config xpack.monitoring.collection.enabled : tr… --- ## [Elastic agent behind NAT](https://discuss.elastic.co/t/elastic-agent-behind-nat/316424)
**Author:** [@krzychohoho](https://discuss.elastic.co/u/krzychohoho)\ **Replies:** 1\ **Last updated:** [October 12, 2022, 10:05am UTC](https://discuss.elastic.co/t/elastic-agent-behind-nat/316424 "2022-10-12T10:05:45Z")
Hi, I came across some issues while trying to install elastic-agent. The case is I have a fleet server with elastic and kibana on local machine with local IP adres. The problem is that i need to deploy elastic agent on a… --- ## [MYSQL to Elasticsearch via Logstash Problem: incompatible encodings: CP850 and UTF-8](https://discuss.elastic.co/t/mysql-to-elasticsearch-via-logstash-problem-incompatible-encodings-cp850-and-utf-8/314122)
**Author:** [@engineer86](https://discuss.elastic.co/u/engineer86)\ **Replies:** 5\ **Last updated:** [October 12, 2022, 9:57am UTC](https://discuss.elastic.co/t/mysql-to-elasticsearch-via-logstash-problem-incompatible-encodings-cp850-and-utf-8/314122 "2022-10-12T09:57:45Z")
I am using an elk stack via docker-compose with ES version 8.4.0 My goal is to use Logstash to copy an entire table from my MYSQL DB to ES. The connection works and Logstash copies about 30 entries with no problems. But… --- ## [\[Filebeat\]\[xpack\]\[httpjson\] - OAuth2 use without client secret and with url params is not possible](https://discuss.elastic.co/t/filebeat-xpack-httpjson-oauth2-use-without-client-secret-and-with-url-params-is-not-possible/314691)
**Author:** [@p-leh](https://discuss.elastic.co/u/p-leh)\ **Replies:** 8\ **Last updated:** [October 12, 2022, 9:33am UTC](https://discuss.elastic.co/t/filebeat-xpack-httpjson-oauth2-use-without-client-secret-and-with-url-params-is-not-possible/314691 "2022-10-12T09:33:32Z")
The xpack input module httpjson for filebeat can handle the OAuth2 process. We want to use httpjson against a cloud foundry setup which is not possible. The problem comes up because on two hard coded contraints: the "… --- ## [Filebeat Input Azure Event Hub Private Endpoint](https://discuss.elastic.co/t/filebeat-input-azure-event-hub-private-endpoint/316422)
**Author:** [@Erylis](https://discuss.elastic.co/u/Erylis)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 9:18am UTC](https://discuss.elastic.co/t/filebeat-input-azure-event-hub-private-endpoint/316422 "2022-10-12T09:18:24Z")
Hello, I'm trying to connect filebeat with an azure eventhub using a private endpoint. The connection doesn't work properly because of a certificate issue : 2022-10-11T09:06:38.358+0200 ERROR \[azure-eventhub input… --- ## [Elastic-agent communication error](https://discuss.elastic.co/t/elastic-agent-communication-error/316418)
**Author:** [@Mohsin\_Ashraf](https://discuss.elastic.co/u/Mohsin_Ashraf)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 8:18am UTC](https://discuss.elastic.co/t/elastic-agent-communication-error/316418 "2022-10-12T08:18:54Z")
hi, When I tried to enrol elastic-agent, it was successfully enrolled but after a few time, it give me this error I tried to resolve this but was not able to resolve this error. if anyone has a solution to this please h… --- ## [Logstash http\_poller "read time out" on http 200 response](https://discuss.elastic.co/t/logstash-http-poller-read-time-out-on-http-200-response/316416)
**Author:** [@Marc\_Hoog](https://discuss.elastic.co/u/Marc_Hoog)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 8:11am UTC](https://discuss.elastic.co/t/logstash-http-poller-read-time-out-on-http-200-response/316416 "2022-10-12T08:11:33Z")
So I got this pipeline in logstash using http\_poller and it works when the client is responding with a 401, but It breaks when it responses with a 200 with a little bit of data. These request also do work with curl from… --- ## [Date histogram that doesn't look at the entire date bucket?](https://discuss.elastic.co/t/date-histogram-that-doesnt-look-at-the-entire-date-bucket/316415)
**Author:** [@netzer](https://discuss.elastic.co/u/netzer)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 8:06am UTC](https://discuss.elastic.co/t/date-histogram-that-doesnt-look-at-the-entire-date-bucket/316415 "2022-10-12T08:06:33Z")
I'm wondering if the following is possible. I have events with metrics sent every 10 minutes, so when I create a dashboard looking at the past 15 minutes I can see the "latest status". I can also do a "SUM" of a field o… --- ## [Enrolling fleet using FQDN certificates](https://discuss.elastic.co/t/enrolling-fleet-using-fqdn-certificates/316328)
**Author:** [@krzychohoho](https://discuss.elastic.co/u/krzychohoho)\ **Replies:** 2\ **Last updated:** [October 12, 2022, 7:35am UTC](https://discuss.elastic.co/t/enrolling-fleet-using-fqdn-certificates/316328 "2022-10-12T07:35:15Z")
Hi, I came across some issues during installation of fleet server. First of all i need the server to run on FQDn rather than on IP adress. So I started with generating certificates using dns instead of IP. The command … --- ## [Match and replace in logstash](https://discuss.elastic.co/t/match-and-replace-in-logstash/316406)
**Author:** [@tegerei](https://discuss.elastic.co/u/tegerei)\ **Replies:** 1\ **Last updated:** [October 12, 2022, 7:21am UTC](https://discuss.elastic.co/t/match-and-replace-in-logstash/316406 "2022-10-12T07:21:54Z")
Hello, I have a setup where I collect PfSense VPN logs and pass them through Logstash to extract some fields. My VPN logs have LDAP usernames such as doejo, which implies the full name of John Doe. Now I need the logs … --- ## [Fleet enroll error unknown resource](https://discuss.elastic.co/t/fleet-enroll-error-unknown-resource/316402)
**Author:** [@Alexej\_Gerstmaier](https://discuss.elastic.co/u/Alexej_Gerstmaier)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 6:59am UTC](https://discuss.elastic.co/t/fleet-enroll-error-unknown-resource/316402 "2022-10-12T06:59:51Z")
I have the same problem as this guy: Elastic-agent install: Unknown resource --- ## [Is any Java client V7 working with ES V8?](https://discuss.elastic.co/t/is-any-java-client-v7-working-with-es-v8/316325)
**Author:** [@Eduardo\_Montes](https://discuss.elastic.co/u/Eduardo_Montes)\ **Replies:** 3\ **Last updated:** [October 12, 2022, 6:56am UTC](https://discuss.elastic.co/t/is-any-java-client-v7-working-with-es-v8/316325 "2022-10-12T06:56:26Z")
Hello, I'm trying to make upgrade from ES V6 to V8. Unfortunately I have to use Java 8 only (on client side). I found out that compatible (it means supported) Java 8 client (TransportClient) for ES V8 is also V7.17.6. … --- ## [Policy is not getting applied to the particular index in elastic](https://discuss.elastic.co/t/policy-is-not-getting-applied-to-the-particular-index-in-elastic/316399)
**Author:** [@AnandRajalingam](https://discuss.elastic.co/u/AnandRajalingam)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 6:39am UTC](https://discuss.elastic.co/t/policy-is-not-getting-applied-to-the-particular-index-in-elastic/316399 "2022-10-12T06:39:08Z")
We have upgraded our elastic from 6.xxx to 7.17.15 version recently. Our elastic policy was working fine in the old instances but not working in the new server. Please find below steps which are performed while creating… --- ## [Logstash service discover\_files {:count=\>0}](https://discuss.elastic.co/t/logstash-service-discover-files-count-0/316376)
**Author:** [@fantastas](https://discuss.elastic.co/u/fantastas)\ **Replies:** 5\ **Last updated:** [October 12, 2022, 6:33am UTC](https://discuss.elastic.co/t/logstash-service-discover-files-count-0/316376 "2022-10-12T06:33:30Z")
hello, i have an issue i can't figure out. I am also not sure how logstash sincedb\_path works too so if someone could help me understand - I'd highly appreciate. I am running ELK on RedHat Linux virtual machine. If i … --- ## [Is Rolling restart documentation correct?](https://discuss.elastic.co/t/is-rolling-restart-documentation-correct/316338)
**Author:** [@landychev](https://discuss.elastic.co/u/landychev)\ **Replies:** 2\ **Last updated:** [October 12, 2022, 6:33am UTC](https://discuss.elastic.co/t/is-rolling-restart-documentation-correct/316338 "2022-10-12T06:33:05Z")
I have read the documentation for rolling restart at. and more about cluster.routing.allocation.enable What i am confused about is step 7, Re-enable shard allocation . Why would you set it to null when the default v… --- ## [Read data from postgres and calling external api in Logstash](https://discuss.elastic.co/t/read-data-from-postgres-and-calling-external-api-in-logstash/316398)
**Author:** [@mani7](https://discuss.elastic.co/u/mani7)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 6:28am UTC](https://discuss.elastic.co/t/read-data-from-postgres-and-calling-external-api-in-logstash/316398 "2022-10-12T06:28:19Z")
I am looking forward to read data from Postgres using Logstash, taking one value as a input to call one external api. and taking the output results of that. And storing into elastic. Can anyone tell what all can be the … --- ## [Full Text Search Force Find All Tokens](https://discuss.elastic.co/t/full-text-search-force-find-all-tokens/316215)
**Author:** [@Saeed\_Mozaffari](https://discuss.elastic.co/u/Saeed_Mozaffari)\ **Replies:** 4\ **Last updated:** [October 12, 2022, 6:24am UTC](https://discuss.elastic.co/t/full-text-search-force-find-all-tokens/316215 "2022-10-12T06:24:22Z")
I try to implement full text search. I have a question related to this subject. I want to at search time, when i search a text, for example "Hello Saeed", return result only when all tokens of that text exist in a mess… --- ## [Condition filter not working after upgrading to logstash8](https://discuss.elastic.co/t/condition-filter-not-working-after-upgrading-to-logstash8/316300)
**Author:** [@PIYUSH\_MISHRA1](https://discuss.elastic.co/u/PIYUSH_MISHRA1)\ **Replies:** 5\ **Last updated:** [October 12, 2022, 5:35am UTC](https://discuss.elastic.co/t/condition-filter-not-working-after-upgrading-to-logstash8/316300 "2022-10-12T05:35:52Z")
Hi Team, I have following configuration in my logstash.conf file. irresepective of the value in ${ENV}, always else block is getting executed. Same piece of code used to work with logstash older versions (2.X and 6.x)… --- ## [Filebeat modules via Logstash?](https://discuss.elastic.co/t/filebeat-modules-via-logstash/316307)
**Author:** [@dygland](https://discuss.elastic.co/u/dygland)\ **Replies:** 2\ **Last updated:** [October 12, 2022, 5:20am UTC](https://discuss.elastic.co/t/filebeat-modules-via-logstash/316307 "2022-10-12T05:20:55Z")
Hello! TLDR: How do we setup and update module dashboards and pipelines without connectivity between filebeat and Kibana/ES hosts directly? Long version: We're using Filebeat without direct access to ES nor Kibana, ev… --- ## [Aws ecs filebeat log collection stops when the application containers are restarted](https://discuss.elastic.co/t/aws-ecs-filebeat-log-collection-stops-when-the-application-containers-are-restarted/311832)
**Author:** [@vaseem\_tt](https://discuss.elastic.co/u/vaseem_tt)\ **Replies:** 6\ **Last updated:** [October 12, 2022, 5:07am UTC](https://discuss.elastic.co/t/aws-ecs-filebeat-log-collection-stops-when-the-application-containers-are-restarted/311832 "2022-10-12T05:07:45Z")
We collect the logs of the container of our java application on ecs with the container of Filebeat. When any one or multiple container in the AWS ECS intance restart continously, filebeat container stops pushing logs to… --- ## [Documentation for Monitoring Elasticsearch with Metricbeat is outdated](https://discuss.elastic.co/t/documentation-for-monitoring-elasticsearch-with-metricbeat-is-outdated/315804)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 1\ **Last updated:** [October 12, 2022, 2:54am UTC](https://discuss.elastic.co/t/documentation-for-monitoring-elasticsearch-with-metricbeat-is-outdated/315804 "2022-10-12T02:54:20Z")
Hello, I've created a new production cluster on 8.4 and a new monitoring cluster as well, following the documentation to configure monitoring using metricbeat there is this step: Set xpack.monitoring.collection.enable… --- ## [Monitoring indexes size is increasing](https://discuss.elastic.co/t/monitoring-indexes-size-is-increasing/315935)
**Author:** [@harijld](https://discuss.elastic.co/u/harijld)\ **Replies:** 1\ **Last updated:** [October 12, 2022, 2:52am UTC](https://discuss.elastic.co/t/monitoring-indexes-size-is-increasing/315935 "2022-10-12T02:52:19Z")
HI Team, I am facing disk slowness issue in our non prod environment when we process some huge data. when i verified indexes. .monitoring index is also increasing continuously whenever we insert data into actual index. … --- ## [Must\_not with exists query on nested object returns excluded field](https://discuss.elastic.co/t/must-not-with-exists-query-on-nested-object-returns-excluded-field/316289)
**Author:** [@myx](https://discuss.elastic.co/u/myx)\ **Replies:** 1\ **Last updated:** [October 12, 2022, 2:45am UTC](https://discuss.elastic.co/t/must-not-with-exists-query-on-nested-object-returns-excluded-field/316289 "2022-10-12T02:45:36Z")
Hi all, I am querying using search API and tried a query using must\_not exists to get documents where there is no list of emails in a group within a class. However, it still returns documents with email\_list inside the g… --- ## [Aggregation is not working occasionally](https://discuss.elastic.co/t/aggregation-is-not-working-occasionally/316392)
**Author:** [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 2:01am UTC](https://discuss.elastic.co/t/aggregation-is-not-working-occasionally/316392 "2022-10-12T02:01:15Z")
Hi, I'm using Elasticsearch 7.16.2 and posting query by Dev Tools of Kibana 7.16.2. I got strange results from an aggregation query. When I repeat completely the same query: GET ss-mix2\_omp-01\_active/\_search { "siz… --- ## [Filebeat module enable](https://discuss.elastic.co/t/filebeat-module-enable/316389)
**Author:** [@gunlomboy](https://discuss.elastic.co/u/gunlomboy)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 12:19am UTC](https://discuss.elastic.co/t/filebeat-module-enable/316389 "2022-10-12T00:19:05Z")
Hi, Does anyone know if the "filebeat module enable" command does anything other than remove the .disabled from the file name? I am deploying via Ansible, so would like to just rename/overwrite the file without running… --- ## [Logstash with the cloud version / "Could not connect to a compatible version of Elasticsearch\>, "](https://discuss.elastic.co/t/logstash-with-the-cloud-version-could-not-connect-to-a-compatible-version-of-elasticsearch/316363)
**Author:** [@LeoCP](https://discuss.elastic.co/u/LeoCP)\ **Replies:** 2\ **Last updated:** [October 11, 2022, 9:18pm UTC](https://discuss.elastic.co/t/logstash-with-the-cloud-version-could-not-connect-to-a-compatible-version-of-elasticsearch/316363 "2022-10-11T21:18:19Z")
Greeting, I am evaluating the cloud version of Elasticsearch, and I want to mount some test data, using logstash (version 8.4.3), but I get an error telling me the following: "Could not connect to a compatible version… --- ## [Elasticsearch, Kibana, Apache-Nifi](https://discuss.elastic.co/t/elasticsearch-kibana-apache-nifi/316382)
**Author:** [@sytherin](https://discuss.elastic.co/u/sytherin)\ **Replies:** 0\ **Last updated:** [October 11, 2022, 8:49pm UTC](https://discuss.elastic.co/t/elasticsearch-kibana-apache-nifi/316382 "2022-10-11T20:49:35Z")
Hi! so I am trying to build a log with Apache Nifi and send it to Elasticsearch, and Kibana on ubuntu. After downloading the Apache Nifi, i ran the \ to verify he integrity of the files, i got \