# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=649 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 650 --- ## [How to use the value from kubernetes metadata in S3 output](https://discuss.elastic.co/t/how-to-use-the-value-from-kubernetes-metadata-in-s3-output/302975)
**Author:** [@user2416](https://discuss.elastic.co/u/user2416)\ **Replies:** 1\ **Last updated:** [April 22, 2022, 4:38pm UTC](https://discuss.elastic.co/t/how-to-use-the-value-from-kubernetes-metadata-in-s3-output/302975 "2022-04-22T16:38:22Z")
Hi, I am trying to use the service name which will get from kubernetes metadata to use in S3 output to construct prefix, how can I use that field value in output? --- ## [Discoverにてコロン前後のキーワードを検索する場合の事象について](https://discuss.elastic.co/t/discover/302766)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 1\ **Last updated:** [April 22, 2022, 3:55pm UTC](https://discuss.elastic.co/t/discover/302766 "2022-04-22T15:55:02Z")
下記のようなインデックスを保持しております { "took" : 2, "timed\_out" : false, "\_shards" : { "total" : 5, "successful" : 5, "skipped" : 0, "failed" : 0 }, "hits" : { "total" : { "value" : 4, "relatio… --- ## [java.net.NetPermission "specifyStreamHandler" not allowed for custom plugin](https://discuss.elastic.co/t/java-net-netpermission-specifystreamhandler-not-allowed-for-custom-plugin/301392)
**Author:** [@poanse](https://discuss.elastic.co/u/poanse)\ **Replies:** 2\ **Last updated:** [April 22, 2022, 3:50pm UTC](https://discuss.elastic.co/t/java-net-netpermission-specifystreamhandler-not-allowed-for-custom-plugin/301392 "2022-04-22T15:50:22Z")
I presume this issue is analogous to java.io.FilePermission is no longer allowed for custom plug-in. · Issue #69464 · elastic/elasticsearch · GitHub, but dealing with java.net.NetPermission "specifyStreamHandler" permiss… --- ## [Date conversion with Logstash](https://discuss.elastic.co/t/date-conversion-with-logstash/302947)
**Author:** [@Lynow](https://discuss.elastic.co/u/Lynow)\ **Replies:** 4\ **Last updated:** [April 22, 2022, 2:04pm UTC](https://discuss.elastic.co/t/date-conversion-with-logstash/302947 "2022-04-22T14:04:33Z")
Hello, I currently have a problem for date conversion with Logstash. I receive logs including dates in epoche format (UNIX), so I added the following filters to modify them. Namely, I have multiple date fields, as you c… --- ## [How to implement this ES curl into Java](https://discuss.elastic.co/t/how-to-implement-this-es-curl-into-java/303008)
**Author:** [@aboli](https://discuss.elastic.co/u/aboli)\ **Replies:** 1\ **Last updated:** [April 22, 2022, 1:55pm UTC](https://discuss.elastic.co/t/how-to-implement-this-es-curl-into-java/303008 "2022-04-22T13:55:57Z")
Hi, I want to translate this curl into working java code in spring - curl -XGET 'localhost:9200/catalog/\_search?pretty' -H 'Content-Type: application/json' -d' { "size": 0, "aggs": { "types": { "terms": { "field":… --- ## [Failed to parse date field](https://discuss.elastic.co/t/failed-to-parse-date-field/302812)
**Author:** [@Krunal](https://discuss.elastic.co/u/Krunal)\ **Replies:** 4\ **Last updated:** [April 22, 2022, 1:48pm UTC](https://discuss.elastic.co/t/failed-to-parse-date-field/302812 "2022-04-22T13:48:22Z")
Blockquote I am having little problem regarding the date. What is the solution to change the date format, if i am having date format like wed 11:32 , fri 4:52, I cant able to do mapping in elasticsearch. So i got this … --- ## [Elastic - restoring index from snapshots does not work](https://discuss.elastic.co/t/elastic-restoring-index-from-snapshots-does-not-work/303001)
**Author:** [@JimJ](https://discuss.elastic.co/u/JimJ)\ **Replies:** 1\ **Last updated:** [April 22, 2022, 1:46pm UTC](https://discuss.elastic.co/t/elastic-restoring-index-from-snapshots-does-not-work/303001 "2022-04-22T13:46:52Z")
running Elastic stack 7.12.0. I configured a repository to snapshot indices. The system takes a snapshot on a daily basis and keeps 7 days. All snapshots seem to be okay. States are all "Snapshot complete". I tried … --- ## [Failed to create query - maxClauseCount is set to 1024](https://discuss.elastic.co/t/failed-to-create-query-maxclausecount-is-set-to-1024/302898)
**Author:** [@Sowmiya](https://discuss.elastic.co/u/Sowmiya)\ **Replies:** 3\ **Last updated:** [April 22, 2022, 1:39pm UTC](https://discuss.elastic.co/t/failed-to-create-query-maxclausecount-is-set-to-1024/302898 "2022-04-22T13:39:39Z")
Hi Team, I am using Elasticsearch version 7.16.2. Have set up the search on the domain-specific data around 20k records. When I am searching for a particular query, I am getting the below error. RequestError(400, 'sear… --- ## [After restarting, all saved objects disappeared in Kibana](https://discuss.elastic.co/t/after-restarting-all-saved-objects-disappeared-in-kibana/300671)
**Author:** [@petschenek](https://discuss.elastic.co/u/petschenek)\ **Replies:** 4\ **Last updated:** [April 22, 2022, 1:18pm UTC](https://discuss.elastic.co/t/after-restarting-all-saved-objects-disappeared-in-kibana/300671 "2022-04-22T13:18:34Z")
Hi team, We are using Elasticsearch and Kibana (7.10.2) deployed on our Kubernetes cluster. After restarting the Kibana deployment, all of our saved objects were gone. They seem to be stored in Elasticsearch but somehow… --- ## [Aggregate similar Logs](https://discuss.elastic.co/t/aggregate-similar-logs/302630)
**Author:** [@Bo-Wyatt](https://discuss.elastic.co/u/Bo-Wyatt)\ **Replies:** 2\ **Last updated:** [April 22, 2022, 11:39am UTC](https://discuss.elastic.co/t/aggregate-similar-logs/302630 "2022-04-22T11:39:32Z")
Hello, I have SIEM-like logs (with a unique identifier field) in a log flow (two or more logs, in every update/log there's extra info or updaded info). I need to preserve the last log or aggregate all the logs into one w… --- ## [Ingest data to Elastic Security using third-party collectors configured to ship ECS-compliant data](https://discuss.elastic.co/t/ingest-data-to-elastic-security-using-third-party-collectors-configured-to-ship-ecs-compliant-data/303023)
**Author:** [@msilva](https://discuss.elastic.co/u/msilva)\ **Replies:** 0\ **Last updated:** [April 22, 2022, 11:25am UTC](https://discuss.elastic.co/t/ingest-data-to-elastic-security-using-third-party-collectors-configured-to-ship-ecs-compliant-data/303023 "2022-04-22T11:25:20Z")
Hi, In Ingest data to Elastic Security | Elastic Security Solution \[8.1\] | Elastic, it is mentioned that data can be ingested to Elastic Security using third-party collectors configured to ship ECS-compliant data. What… --- ## [Logstash to elasticsearch ssl connection issue](https://discuss.elastic.co/t/logstash-to-elasticsearch-ssl-connection-issue/302842)
**Author:** [@fabek.75](https://discuss.elastic.co/u/fabek.75)\ **Replies:** 1\ **Last updated:** [April 22, 2022, 8:56am UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch-ssl-connection-issue/302842 "2022-04-22T08:56:33Z")
Hi, I have setup an on-prem dev environment with Elasticsearch 8.x and from a client I'm trying to push some data through a Logstash pipeline (version is 8.1.2-1). It seems, however, Logstash wants absolutely that some … --- ## [Indicator matching Rules](https://discuss.elastic.co/t/indicator-matching-rules/302346)
**Author:** [@shinobu](https://discuss.elastic.co/u/shinobu)\ **Replies:** 2\ **Last updated:** [April 22, 2022, 8:46am UTC](https://discuss.elastic.co/t/indicator-matching-rules/302346 "2022-04-22T08:46:11Z")
Hello, I recently configured an Indicator Matching Rule that creates alarms if any indicator is found. The issue with this is that the indicator are matched partially. For instance if I have the indicator something.q77.… --- ## [Randomly xml tags are not showing in the elasticsearch 7.14](https://discuss.elastic.co/t/randomly-xml-tags-are-not-showing-in-the-elasticsearch-7-14/302994)
**Author:** [@Lakshani\_Gamage](https://discuss.elastic.co/u/Lakshani_Gamage)\ **Replies:** 0\ **Last updated:** [April 22, 2022, 8:06am UTC](https://discuss.elastic.co/t/randomly-xml-tags-are-not-showing-in-the-elasticsearch-7-14/302994 "2022-04-22T08:06:23Z")
I'm using Elasticsearch 7.14. When I check the JSON format of a message in the Elasticsearch, I can see below. "agent": { "ephemeral\_id": "2a4c1cb3-b7d6-4a1b-b244-0e669f1d7686", "type": "filebeat", "id": "3dfa6feb… --- ## [Read only searches for other users](https://discuss.elastic.co/t/read-only-searches-for-other-users/302928)
**Author:** [@afuente](https://discuss.elastic.co/u/afuente)\ **Replies:** 4\ **Last updated:** [April 22, 2022, 8:34am UTC](https://discuss.elastic.co/t/read-only-searches-for-other-users/302928 "2022-04-22T08:34:59Z")
Hello, everybody!! Does anybody know if it is possible to lock a saved search, a visualization, etc., for other users to be able to see the results but not change the filters and overwrite it? We are a lot of people us… --- ## [Winlogbeat message not parsed](https://discuss.elastic.co/t/winlogbeat-message-not-parsed/302979)
**Author:** [@Elie\_Sbat](https://discuss.elastic.co/u/Elie_Sbat)\ **Replies:** 7\ **Last updated:** [April 22, 2022, 8:25am UTC](https://discuss.elastic.co/t/winlogbeat-message-not-parsed/302979 "2022-04-22T08:25:03Z")
Hello, I am using elasticstack v8. The messages are sent from winlogbeat -\> kafka - \> logstash -\> elastic. The message is arrived unparsed. Logstash config: input { kafka{ bootstrap\_servers =\> … --- ## [Elasticsearch 7.16.2 failed to start when switching from Java 8 to Java 11](https://discuss.elastic.co/t/elasticsearch-7-16-2-failed-to-start-when-switching-from-java-8-to-java-11/301404)
**Author:** [@dzyubanv](https://discuss.elastic.co/u/dzyubanv)\ **Replies:** 9\ **Last updated:** [April 22, 2022, 8:16am UTC](https://discuss.elastic.co/t/elasticsearch-7-16-2-failed-to-start-when-switching-from-java-8-to-java-11/301404 "2022-04-22T08:16:03Z")
I'm testing Elasticsearch (ES) single node cluster with Java 8 and Java 11 Java 8 and Java 11 are installed on Linux server RHEL release 7.9 in directories: /usr/java/jdk1.8.0\_281-amd64 includes subdirectories bin, inc… --- ## [How can I use kerberos under python elasticsearch?](https://discuss.elastic.co/t/how-can-i-use-kerberos-under-python-elasticsearch/302981)
**Author:** [@papi1992](https://discuss.elastic.co/u/papi1992)\ **Replies:** 1\ **Last updated:** [April 22, 2022, 8:06am UTC](https://discuss.elastic.co/t/how-can-i-use-kerberos-under-python-elasticsearch/302981 "2022-04-22T08:06:35Z")
I checked the documentation of elasticsearch:7.x but still didn't find the way how I can force the python ES package to use my kerberos token. I can reach the ES through a browser, curl ( curl --negotiate -u ) and reque… --- ## [Compound score computation details](https://discuss.elastic.co/t/compound-score-computation-details/302940)
**Author:** [@med\_rgn](https://discuss.elastic.co/u/med_rgn)\ **Replies:** 0\ **Last updated:** [April 21, 2022, 3:48pm UTC](https://discuss.elastic.co/t/compound-score-computation-details/302940 "2022-04-21T15:48:25Z")
Hello context In my use case I rank documents regarding an input request relying on a compound score used for the ranking. This compound score is a weighted sum of 3 text similarity scores as follow: score = weight1 \*… --- ## [Grok Parsing for multiple patterns in single log file](https://discuss.elastic.co/t/grok-parsing-for-multiple-patterns-in-single-log-file/302948)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 2\ **Last updated:** [April 22, 2022, 5:18am UTC](https://discuss.elastic.co/t/grok-parsing-for-multiple-patterns-in-single-log-file/302948 "2022-04-22T05:18:15Z")
Hi Everyone, I am writing a grok pattern to parse a log file where i have two types of log lines. 2022-04-13 06:38:24.472 DBG Microsoft.AspNet.server --- Connection Id "Xxxxxxxx" accepted 2022-04-13 06:38:19.330 d… --- ## [S3 input: Unable to list objects. Access Denied](https://discuss.elastic.co/t/s3-input-unable-to-list-objects-access-denied/302380)
**Author:** [@elker](https://discuss.elastic.co/u/elker)\ **Replies:** 1\ **Last updated:** [April 22, 2022, 3:01am UTC](https://discuss.elastic.co/t/s3-input-unable-to-list-objects-access-denied/302380 "2022-04-22T03:01:00Z")
I am using the s3 input plugin to use assume a role using an aws\_access\_key/secret key and read from a bucket using a date based key. The Logstash role allows AssumeRole, and the bucket allows the role to ListBucket an… --- ## [Unexpected result from Synonym Filter if Char Filter is also used](https://discuss.elastic.co/t/unexpected-result-from-synonym-filter-if-char-filter-is-also-used/302896)
**Author:** [@Patrick\_N](https://discuss.elastic.co/u/Patrick_N)\ **Replies:** 0\ **Last updated:** [April 21, 2022, 10:29am UTC](https://discuss.elastic.co/t/unexpected-result-from-synonym-filter-if-char-filter-is-also-used/302896 "2022-04-21T10:29:18Z")
I have a field which uses both a char filter (it converts Chinese words to some separator text) and a synonym filter. PUT test { "mappings": { "properties": { "description": { "an… --- ## [Failed to install kibana 7.17.2 on Amazon Linux 2](https://discuss.elastic.co/t/failed-to-install-kibana-7-17-2-on-amazon-linux-2/302945)
**Author:** [@chrisbra](https://discuss.elastic.co/u/chrisbra)\ **Replies:** 2\ **Last updated:** [April 21, 2022, 7:21pm UTC](https://discuss.elastic.co/t/failed-to-install-kibana-7-17-2-on-amazon-linux-2/302945 "2022-04-21T19:21:09Z")
I I downloaded kibana 7.17.2 as rpm package. Unfortunately, when trying to run it, it fails with those errors: ~ $ sudo /usr/share/kibana/bin/kibana /usr/share/kibana/bin/../node/bin/node: /lib/libstdc++.so.6: version … --- ## [Bash Script – Remove Indices from x Days Ago](https://discuss.elastic.co/t/bash-script-remove-indices-from-x-days-ago/302925)
**Author:** [@Shanu\_Modi](https://discuss.elastic.co/u/Shanu_Modi)\ **Replies:** 3\ **Last updated:** [April 21, 2022, 5:57pm UTC](https://discuss.elastic.co/t/bash-script-remove-indices-from-x-days-ago/302925 "2022-04-21T17:57:42Z")
Hi please help or suggest any solution. My cluster is running over pod on eks --- ## [Value in Legend \[Pie Chart\]](https://discuss.elastic.co/t/value-in-legend-pie-chart/302934)
**Author:** [@Bo-Wyatt](https://discuss.elastic.co/u/Bo-Wyatt)\ **Replies:** 1\ **Last updated:** [April 21, 2022, 5:01pm UTC](https://discuss.elastic.co/t/value-in-legend-pie-chart/302934 "2022-04-21T17:01:52Z")
Hello, I want to display the metric of each value in the legend. For example in the photo, show my metric on the right side the value, next to the three dots. --- ## [Logstash fail to rewrite json files](https://discuss.elastic.co/t/logstash-fail-to-rewrite-json-files/302942)
**Author:** [@Math](https://discuss.elastic.co/u/Math)\ **Replies:** 1\ **Last updated:** [April 21, 2022, 4:41pm UTC](https://discuss.elastic.co/t/logstash-fail-to-rewrite-json-files/302942 "2022-04-21T16:41:16Z")
Hi, I want to send json files with filebeat to logstash and then logstash rewrite these json files locally. Filebeat version: 8.1.2 Logstash version: 8.1.2 There is my filebeat conf: filebeat.inputs: - type: filest… --- ## [Logstash is not reading some files from filebeat](https://discuss.elastic.co/t/logstash-is-not-reading-some-files-from-filebeat/302570)
**Author:** [@Rohini\_Gadge28](https://discuss.elastic.co/u/Rohini_Gadge28)\ **Replies:** 5\ **Last updated:** [April 21, 2022, 4:38pm UTC](https://discuss.elastic.co/t/logstash-is-not-reading-some-files-from-filebeat/302570 "2022-04-21T16:38:35Z")
There is data in a folder which is read by filebeat and forwarded to Logstash . So we write to logs file everyday and based on date multiple files(eg. : 2022-03-29-1.log , 2022-03-30-1.log, etc) get created. But somehow… --- ## [Elasticsearch pods stuck in pending: nodes are available: 3 node(s) had volume node affinity conflict,](https://discuss.elastic.co/t/elasticsearch-pods-stuck-in-pending-nodes-are-available-3-node-s-had-volume-node-affinity-conflict/302935)
**Author:** [@x00m](https://discuss.elastic.co/u/x00m)\ **Replies:** 1\ **Last updated:** [April 21, 2022, 4:21pm UTC](https://discuss.elastic.co/t/elasticsearch-pods-stuck-in-pending-nodes-are-available-3-node-s-had-volume-node-affinity-conflict/302935 "2022-04-21T16:21:07Z")
I am using AKS. (Azure) I had an elasticsearch cluster provisioned via ECK 1.8.0 with 3 nodes accross 3 VMs in a nodepool. (AKS) I wanted to bump up the configuration, so i provisioned a new nodepool with 3 VMs and the… --- ## [Change topic from :Bad logic for allocation shard due to data tier arch -\> case with node roles syntax in elastic \>8.0.0](https://discuss.elastic.co/t/change-topic-from-bad-logic-for-allocation-shard-due-to-data-tier-arch-case-with-node-roles-syntax-in-elastic-8-0-0/300168)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 16\ **Last updated:** [April 21, 2022, 3:50pm UTC](https://discuss.elastic.co/t/change-topic-from-bad-logic-for-allocation-shard-due-to-data-tier-arch-case-with-node-roles-syntax-in-elastic-8-0-0/300168 "2022-04-21T15:50:23Z")
Hi Today I observed not expected logic for allocation shards. Under configuration I've data tier structure like coordinator nodes - are responsible for taking data traffic es\_data\_ssd\* nodes - are storing hot phase (… --- ## ["Unable to retrieve version information from Elasticsearch nodes. "](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes/302852)
**Author:** [@Bruceclegg](https://discuss.elastic.co/u/Bruceclegg)\ **Replies:** 5\ **Last updated:** [April 21, 2022, 3:49pm UTC](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes/302852 "2022-04-21T15:49:41Z")
Trying to set up a small barebones (for now) 3 node cluster in Centos 7. Cluster appears to be up, but I can't connect kibana to it. I have installed kibana on one of the Elasticsearch nodes. Elasticsearch is running … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=648) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=650)