# Latest **URL:** https://discuss.elastic.co/latest.md?page=938 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 939 --- ## [Dead letter queue not working with logtash output mongo](https://discuss.elastic.co/t/dead-letter-queue-not-working-with-logtash-output-mongo/316030)
**Author:** [@van\_le1](https://discuss.elastic.co/u/van_le1)\ **Replies:** 2\ **Last updated:** [October 10, 2022, 1:04am UTC](https://discuss.elastic.co/t/dead-letter-queue-not-working-with-logtash-output-mongo/316030 "2022-10-10T01:04:20Z")
Hi everyone, I intend to use dead letter queue on log event failure from sending log into mongodb use logtash. My config includes: logtash.yml http.host: "0.0.0.0" pipeline.batch.delay: 10 pipeline.batch.size: 10… --- ## [Openshift problem with logstash in other server](https://discuss.elastic.co/t/openshift-problem-with-logstash-in-other-server/316157)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 4\ **Last updated:** [October 9, 2022, 10:21pm UTC](https://discuss.elastic.co/t/openshift-problem-with-logstash-in-other-server/316157 "2022-10-09T22:21:44Z")
2022-10-09T19:03:48,320\]\[WARN \]\[logstash.outputs.elasticsearch\]\[openshift1\] Attempted to resurrect connection to dead ES instance, but got an error {:url=\>"http://elastichttp2-n-turri-dev.apps.sandbox-m2.ll9k.p1.openshif… --- ## [File Mirroring via FileBeat or Logstash](https://discuss.elastic.co/t/file-mirroring-via-filebeat-or-logstash/315973)
**Author:** [@shocko](https://discuss.elastic.co/u/shocko)\ **Replies:** 8\ **Last updated:** [October 9, 2022, 9:45pm UTC](https://discuss.elastic.co/t/file-mirroring-via-filebeat-or-logstash/315973 "2022-10-09T21:45:48Z")
I have the following use case for several directories containing log files: Tail these files and write out to another location with the same filename For example, our app is creating files names myapp\_.log and we need… --- ## [Force index rollover with a new index name](https://discuss.elastic.co/t/force-index-rollover-with-a-new-index-name/315983)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 2\ **Last updated:** [October 9, 2022, 8:35pm UTC](https://discuss.elastic.co/t/force-index-rollover-with-a-new-index-name/315983 "2022-10-09T20:35:05Z")
Hello, I was configured filebeat agent to send data directly to elasticsearch from multiples agent. afterwards I added the index to a have a problem with the rollover I added the index to the retention policy test0. T… --- ## [Scripted Field Help](https://discuss.elastic.co/t/scripted-field-help/316156)
**Author:** [@snkhan](https://discuss.elastic.co/u/snkhan)\ **Replies:** 11\ **Last updated:** [October 9, 2022, 6:44pm UTC](https://discuss.elastic.co/t/scripted-field-help/316156 "2022-10-09T18:44:40Z")
Hello, I am trying to use a scripted field to compare the value of one field against another. A sample document extract is below: Field1 C2\_Host: \["check.example.workers.dev"\] Field2 HostHeader: "Host: check.example.w… --- ## [Upgrade from 7.x to 8.4.1](https://discuss.elastic.co/t/upgrade-from-7-x-to-8-4-1/316027)
**Author:** [@Ravi\_S1](https://discuss.elastic.co/u/Ravi_S1)\ **Replies:** 3\ **Last updated:** [October 9, 2022, 2:36pm UTC](https://discuss.elastic.co/t/upgrade-from-7-x-to-8-4-1/316027 "2022-10-09T14:36:47Z")
After upgrade from 7.7.1 to 8.4.1, Kibana 8.4.1 is showing down.. "{"statusCode":503,"error":"Service Unavailable","message":"\[No shard available for \[get \[.kibana\_8.4.1\]\[space:default\]: routing \[null\]\]: no\_shard\_availab… --- ## [Elasticsearch Highlight the result of script fields](https://discuss.elastic.co/t/elasticsearch-highlight-the-result-of-script-fields/316121)
**Author:** [@AmirMohammad\_Safari](https://discuss.elastic.co/u/AmirMohammad_Safari)\ **Replies:** 2\ **Last updated:** [October 9, 2022, 2:11pm UTC](https://discuss.elastic.co/t/elasticsearch-highlight-the-result-of-script-fields/316121 "2022-10-09T14:11:19Z")
I write out an analyzer to remove the HTML tags in my search results, After that I thought I could highlight the results with a common query, But in the highlighting field I got other html contents that you removed with … --- ## [Switching from platinum to basic](https://discuss.elastic.co/t/switching-from-platinum-to-basic/315856)
**Author:** [@heric](https://discuss.elastic.co/u/heric)\ **Replies:** 4\ **Last updated:** [October 9, 2022, 1:32pm UTC](https://discuss.elastic.co/t/switching-from-platinum-to-basic/315856 "2022-10-09T13:32:20Z")
Hi, Unfortunately our elastic license is going to expired and not going to be extended. Right now i am using some features that is using license such as anomaly detection, SAML authentication and centralized pipeline. … --- ## [Merging two indexes by a column](https://discuss.elastic.co/t/merging-two-indexes-by-a-column/315163)
**Author:** [@Juanfer](https://discuss.elastic.co/u/Juanfer)\ **Replies:** 2\ **Last updated:** [October 9, 2022, 10:38am UTC](https://discuss.elastic.co/t/merging-two-indexes-by-a-column/315163 "2022-10-09T10:38:41Z")
Hello there, I am a beginner in Elasticsearch and I have been reading about how to merge 2 indexes based on two different names columns with the same values. I understand the NoSQL performance of elastic but still havin… --- ## [JSON with comma separated string to multiple tags](https://discuss.elastic.co/t/json-with-comma-separated-string-to-multiple-tags/315111)
**Author:** [@Ranger\_Rick](https://discuss.elastic.co/u/Ranger_Rick)\ **Replies:** 2\ **Last updated:** [October 9, 2022, 1:38am UTC](https://discuss.elastic.co/t/json-with-comma-separated-string-to-multiple-tags/315111 "2022-10-09T01:38:22Z")
Good evening! I really think this should be easy and straightforward but I am having a heck of a time with it so decided to ask the community. My pipeline accepts daily json files and splits it out and further enriches … --- ## [Showing only non-cleared events in a visualization](https://discuss.elastic.co/t/showing-only-non-cleared-events-in-a-visualization/316138)
**Author:** [@DirtyRaven](https://discuss.elastic.co/u/DirtyRaven)\ **Replies:** 0\ **Last updated:** [October 8, 2022, 9:27pm UTC](https://discuss.elastic.co/t/showing-only-non-cleared-events-in-a-visualization/316138 "2022-10-08T21:27:53Z")
I would like to make a visualization that only displays memory, CPU, and file system events. The trick is, I would like the visualization to only display these events if they are still over the threshold, but hosts wher… --- ## [List of Query DSL keywords and additional instructions](https://discuss.elastic.co/t/list-of-query-dsl-keywords-and-additional-instructions/316132)
**Author:** [@Michael\_Gattinger](https://discuss.elastic.co/u/Michael_Gattinger)\ **Replies:** 4\ **Last updated:** [October 8, 2022, 5:49pm UTC](https://discuss.elastic.co/t/list-of-query-dsl-keywords-and-additional-instructions/316132 "2022-10-08T17:49:22Z")
Hello, as i understood Query DSL has in line 1 of the Query spezial keywords that are not part of the JSON. JSON starts at line 2 of the Query and is only one JSON-Object accept BULK-Requests, where multiple JSON Object… --- ## [Conditional IF and ELIF in set processor](https://discuss.elastic.co/t/conditional-if-and-elif-in-set-processor/316123)
**Author:** [@tomx1](https://discuss.elastic.co/u/tomx1)\ **Replies:** 2\ **Last updated:** [October 8, 2022, 5:34pm UTC](https://discuss.elastic.co/t/conditional-if-and-elif-in-set-processor/316123 "2022-10-08T17:34:01Z")
I'm setting the value of a field named "customer" depending on the value of field "destination.ip" via ingest pipeline. Currently I'm using two independent Set processors via ingest pipeline for IPv4 and IPv6. But it wou… --- ## [Unable to Parse AVRO using Kafka Input and Avro Codec](https://discuss.elastic.co/t/unable-to-parse-avro-using-kafka-input-and-avro-codec/316133)
**Author:** [@mastersmit](https://discuss.elastic.co/u/mastersmit)\ **Replies:** 0\ **Last updated:** [October 8, 2022, 4:23pm UTC](https://discuss.elastic.co/t/unable-to-parse-avro-using-kafka-input-and-avro-codec/316133 "2022-10-08T16:23:09Z")
Hi, I am trying to use Kafka Input and Codec Avro, to read the messages but unable to do so. In Kafka, { "id": 5839355690199358000, "name": "VOH\*a|\[RF6y?" } In Logstash Output: "@timestamp" =\> 2022-10-08T14:… --- ## [Is Elastic Java Client actually communicating with Query DSL?](https://discuss.elastic.co/t/is-elastic-java-client-actually-communicating-with-query-dsl/316128)
**Author:** [@Michael\_Gattinger](https://discuss.elastic.co/u/Michael_Gattinger)\ **Replies:** 2\ **Last updated:** [October 8, 2022, 3:31pm UTC](https://discuss.elastic.co/t/is-elastic-java-client-actually-communicating-with-query-dsl/316128 "2022-10-08T15:31:55Z")
Hello, writing my master thesis. So a) if we are in Kibana we can open the dev console and type Query DSL (formatted in JSON) to send it to Elasticsearch. b) additionally we can send Query DSL (formatted in JSON) fro… --- ## [Elk on openshift server have limit?](https://discuss.elastic.co/t/elk-on-openshift-server-have-limit/316124)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 6\ **Last updated:** [October 8, 2022, 3:00pm UTC](https://discuss.elastic.co/t/elk-on-openshift-server-have-limit/316124 "2022-10-08T15:00:09Z")
hello i' ve mounted elk vers 7.16.2 but in console i see this logs \[2022-10-08T11:59:14,859\]\[ERROR\]\[logstash.licensechecker.licensereader\] Unable to retrieve license information from license server {:message=\>"No Avail… --- ## [Remove / using logstash filter](https://discuss.elastic.co/t/remove-using-logstash-filter/316106)
**Author:** [@Giridharan\_C](https://discuss.elastic.co/u/Giridharan_C)\ **Replies:** 3\ **Last updated:** [October 8, 2022, 1:52pm UTC](https://discuss.elastic.co/t/remove-using-logstash-filter/316106 "2022-10-08T13:52:32Z")
I used multiple mutate filters to remove the / in the message field, which is not working. Also, I want to parse these message fields into valid JSON. Please suggest and help. { "host" =\> "mylocalhost.mydomain.com", … --- ## [Store multiple values using ruby in multivalue field](https://discuss.elastic.co/t/store-multiple-values-using-ruby-in-multivalue-field/316059)
**Author:** [@bertr](https://discuss.elastic.co/u/bertr)\ **Replies:** 2\ **Last updated:** [October 8, 2022, 1:40pm UTC](https://discuss.elastic.co/t/store-multiple-values-using-ruby-in-multivalue-field/316059 "2022-10-08T13:40:57Z")
By nature all fields in elasticsearch are multivalue-enabled, i.e. they can have multiple values in one document. Using mutate filter it is easy to add multiple values, but I need to use ruby. I am trying to add multiple… --- ## [Handling changes between Kibana instances](https://discuss.elastic.co/t/handling-changes-between-kibana-instances/315640)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 2\ **Last updated:** [October 8, 2022, 11:25am UTC](https://discuss.elastic.co/t/handling-changes-between-kibana-instances/315640 "2022-10-08T11:25:14Z")
I have a dozen or so Kibans with the same basic configuration, but they differ slightly from one another (e.g. the selected queries are slightly altered). Is there a good option for handling this? What I have in mind, fo… --- ## [Elastic Search and Python pushing error](https://discuss.elastic.co/t/elastic-search-and-python-pushing-error/316105)
**Author:** [@Shashank02](https://discuss.elastic.co/u/Shashank02)\ **Replies:** 1\ **Last updated:** [October 8, 2022, 9:07am UTC](https://discuss.elastic.co/t/elastic-search-and-python-pushing-error/316105 "2022-10-08T09:07:33Z")
elasticsearch.BadRequestError: BadRequestError(400, 'illegal\_argument\_exception', 'Action/metadata line \[1\] contains an unknown parameter \[\_type\]') How do you resolve this error? I'm trying to push the data through my p… --- ## [Unable to Tessellate shape. Possible malformed shape detected](https://discuss.elastic.co/t/unable-to-tessellate-shape-possible-malformed-shape-detected/316122)
**Author:** [@baiwenbo1997](https://discuss.elastic.co/u/baiwenbo1997)\ **Replies:** 0\ **Last updated:** [October 8, 2022, 8:58am UTC](https://discuss.elastic.co/t/unable-to-tessellate-shape-possible-malformed-shape-detected/316122 "2022-10-08T08:58:21Z")
Why is this polygon judged to be a self-intersecting figure? If it is the accuracy problem that causes the judgment to be self-intersecting, how can I make the judgment during storage, or please tell me what is the accu… --- ## [Machine learning java api](https://discuss.elastic.co/t/machine-learning-java-api/316119)
**Author:** [@ericdwz](https://discuss.elastic.co/u/ericdwz)\ **Replies:** 0\ **Last updated:** [October 8, 2022, 8:05am UTC](https://discuss.elastic.co/t/machine-learning-java-api/316119 "2022-10-08T08:05:21Z")
Hi there, Is there any document or instruction on how to use the machine learning api in java? For example, how can I convert the following DSL into java POST /\_ml/trained\_models/bert-base-chinese/\_infer { "docs": {… --- ## [Action \[cluster:monitor/nodes/stats\[n\]\] timed out](https://discuss.elastic.co/t/action-cluster-monitor-nodes-stats-n-timed-out/312818)
**Author:** [@dukewrz](https://discuss.elastic.co/u/dukewrz)\ **Replies:** 8\ **Last updated:** [October 8, 2022, 6:56am UTC](https://discuss.elastic.co/t/action-cluster-monitor-nodes-stats-n-timed-out/312818 "2022-10-08T06:56:41Z")
I can't take the log file out. Logs says: Received response for a request that as timed out, sent \[xxx/xxx\] ago..... tells that a timeout occurred when the master tries to collecting node stats info from one particu… --- ## [Why I have log duplication when filebeat read rotating log files and stop filebeat for specific time manually and default close inactive reached](https://discuss.elastic.co/t/why-i-have-log-duplication-when-filebeat-read-rotating-log-files-and-stop-filebeat-for-specific-time-manually-and-default-close-inactive-reached/314663)
**Author:** [@alex\_petrov](https://discuss.elastic.co/u/alex_petrov)\ **Replies:** 6\ **Last updated:** [October 8, 2022, 4:58am UTC](https://discuss.elastic.co/t/why-i-have-log-duplication-when-filebeat-read-rotating-log-files-and-stop-filebeat-for-specific-time-manually-and-default-close-inactive-reached/314663 "2022-10-08T04:58:17Z")
I set filebeat to read logs from rotating logs (rotated when 5 mg is reached) and below is my config : - type: log fields: source: 'filebeat2' logID: logbackup fields\_under\_root: true enabled: true paths: - /… --- ## [Log Pipeline](https://discuss.elastic.co/t/log-pipeline/315714)
**Author:** [@marchias](https://discuss.elastic.co/u/marchias)\ **Replies:** 1\ **Last updated:** [October 7, 2022, 10:32pm UTC](https://discuss.elastic.co/t/log-pipeline/315714 "2022-10-07T22:32:04Z")
I've got a non-standard log on my hands that I'm trying to create a custom ingest pipeline for. I can get the first section up to the "Action" key using Grok like below. %{CISCOTAG:date}\\s\*%{HOUR:hour}:%{MINUTE:minute}:… --- ## [Upgrading from ES 6.8 to 7.17 and got MasterNotDiscoveredException](https://discuss.elastic.co/t/upgrading-from-es-6-8-to-7-17-and-got-masternotdiscoveredexception/316108)
**Author:** [@jayp-glb](https://discuss.elastic.co/u/jayp-glb)\ **Replies:** 0\ **Last updated:** [October 7, 2022, 10:07pm UTC](https://discuss.elastic.co/t/upgrading-from-es-6-8-to-7-17-and-got-masternotdiscoveredexception/316108 "2022-10-07T22:07:02Z")
Hello community, In my Elasticsearch upgrade crazyness, I was finally able to reindex my old ES 5.0 cluster into 6.8, though with lots of adjustments because of the only one mapping per index rule, but I digress. I hav… --- ## [Certificate issue while installing Elastic cluster using Helm Kubernetes](https://discuss.elastic.co/t/certificate-issue-while-installing-elastic-cluster-using-helm-kubernetes/315335)
**Author:** [@RoshRagh](https://discuss.elastic.co/u/RoshRagh)\ **Replies:** 0\ **Last updated:** [September 28, 2022, 8:35am UTC](https://discuss.elastic.co/t/certificate-issue-while-installing-elastic-cluster-using-helm-kubernetes/315335 "2022-09-28T08:35:06Z")
Hi, I am doing a helm-Kubernetes deployment of Elastic cluster and I am using company signed CA certificates. Elasticsearch is coming up with the certificate, however Kibana gives this error. Looking for help on underst… --- ## [Is it possible for Elasticsearch to integration with sophos and watchguard firewall?](https://discuss.elastic.co/t/is-it-possible-for-elasticsearch-to-integration-with-sophos-and-watchguard-firewall/315518)
**Author:** [@vyom](https://discuss.elastic.co/u/vyom)\ **Replies:** 0\ **Last updated:** [September 30, 2022, 6:00am UTC](https://discuss.elastic.co/t/is-it-possible-for-elasticsearch-to-integration-with-sophos-and-watchguard-firewall/315518 "2022-09-30T06:00:06Z")
Hello everyone, I am working on a project "Elastic integration with sophis and watchguard firewall". And i am very confuse about how the logs will come to the elastic. Can someone guide me to this??? --- ## [Unable to retrieve version information from Elasticsearch nodes. unable to get issuer certificate Unable to retrieve version information from Elasticsearch nodes. unable to get issuer certificate](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes-unable-to-get-issuer-certificate-unable-to-retrieve-version-information-from-elasticsearch-nodes-unable-to-get-issuer-certificate/316000)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 8\ **Last updated:** [October 7, 2022, 8:41pm UTC](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes-unable-to-get-issuer-certificate-unable-to-retrieve-version-information-from-elasticsearch-nodes-unable-to-get-issuer-certificate/316000 "2022-10-07T20:41:43Z")
I'm trying to use ssl certificates created by Let's Encrypt for elasticsearch and kibana version 8.4. Kibana fails at start up with this error message: Unable to retrieve version information from Elasticsearch nodes. u… --- ## [Unable to download Kibana Discover logs into csv/excel in Kibana 8.2.2](https://discuss.elastic.co/t/unable-to-download-kibana-discover-logs-into-csv-excel-in-kibana-8-2-2/315966)
**Author:** [@lakshmiD](https://discuss.elastic.co/u/lakshmiD)\ **Replies:** 1\ **Last updated:** [October 7, 2022, 7:44pm UTC](https://discuss.elastic.co/t/unable-to-download-kibana-discover-logs-into-csv-excel-in-kibana-8-2-2/315966 "2022-10-07T19:44:18Z")
Hi Team, How to download kibana discover tab logs into csv/excel when I tired to generate from share--\>csv reports--\>Generate CSV ,getting request timed out error Is there any extensions available in chrome to downloa… [Previous page](https://discuss.elastic.co/latest.md?page=937) [Next page](https://discuss.elastic.co/latest.md?page=939)