# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=743 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 744 --- ## [Logstash pipeline error](https://discuss.elastic.co/t/logstash-pipeline-error/293118)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 0\ **Last updated:** [December 29, 2021, 1:18pm UTC](https://discuss.elastic.co/t/logstash-pipeline-error/293118 "2021-12-29T13:18:54Z")
Hello team, I am getting following issuw on logstash side. can anyone help me. Error: \[2021-12-29T16:50:48,240\]\[ERROR\]\[logstash.agent \] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pip… --- ## [After installing a filter plugin with BouncyCastleFipsProvider, Logstash fails to start](https://discuss.elastic.co/t/after-installing-a-filter-plugin-with-bouncycastlefipsprovider-logstash-fails-to-start/293115)
**Author:** [@yon\_y](https://discuss.elastic.co/u/yon_y)\ **Replies:** 0\ **Last updated:** [December 29, 2021, 12:41pm UTC](https://discuss.elastic.co/t/after-installing-a-filter-plugin-with-bouncycastlefipsprovider-logstash-fails-to-start/293115 "2021-12-29T12:41:46Z")
I wrote a Java filter plugin, compiled it into a gem (after successfully unit-tests), installed it successfully to Logstash, but then Logstash fails to start. The problem is caused by a single line (when the line is remo… --- ## [Change long field format](https://discuss.elastic.co/t/change-long-field-format/293049)
**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\ **Replies:** 3\ **Last updated:** [December 29, 2021, 12:24pm UTC](https://discuss.elastic.co/t/change-long-field-format/293049 "2021-12-29T12:24:18Z")
I have field called # user\_id\_s: 14,960,923,573 long as above name, value and type I want it should look like 14960923573 I try to change its type to string by mutate convert but not worked. I tried creating new s… --- ## [Kibana Pie Chart Issue Version 7.16](https://discuss.elastic.co/t/kibana-pie-chart-issue-version-7-16/293013)
**Author:** [@tanvi.sehgal](https://discuss.elastic.co/u/tanvi.sehgal)\ **Replies:** 1\ **Last updated:** [December 29, 2021, 12:13pm UTC](https://discuss.elastic.co/t/kibana-pie-chart-issue-version-7-16/293013 "2021-12-29T12:13:35Z")
We have recently upgraded ELK from Version 7.5 to Version 7.16. After the version upgrade, facing some issue with the pie chart visualization. Earlier the pie chart's tooltip used to show the Custom Label defined for t… --- ## [How to process ResponseTimestamp-ClientIP-ReceivedTimestamp to show ReceivedTimestamp (23/Dec/2021:00:02:53 +0000) as @timestamp](https://discuss.elastic.co/t/how-to-process-responsetimestamp-clientip-receivedtimestamp-to-show-receivedtimestamp-23-dec-202102-53-0000-as-timestamp/293056)
**Author:** [@Melvin](https://discuss.elastic.co/u/Melvin)\ **Replies:** 4\ **Last updated:** [December 29, 2021, 10:36am UTC](https://discuss.elastic.co/t/how-to-process-responsetimestamp-clientip-receivedtimestamp-to-show-receivedtimestamp-23-dec-202102-53-0000-as-timestamp/293056 "2021-12-29T10:36:06Z")
Input example line in log: 2021-12-23T00:02:54.126Z 10.173.7.76 - - \[23/Dec/2021:00:02:53 +0000\] "POST /uri1/uri2?queryp=00-0A-12-34-56-78 HTTP/1.1" 403 2001 "-" "useragent" 0 \[500456\] Grok filter expression: filter {… --- ## [Elasticsearch 7.16.1 crashing randomly](https://discuss.elastic.co/t/elasticsearch-7-16-1-crashing-randomly/291827)
**Author:** [@ppuschmann](https://discuss.elastic.co/u/ppuschmann)\ **Replies:** 27\ **Last updated:** [December 29, 2021, 10:23am UTC](https://discuss.elastic.co/t/elasticsearch-7-16-1-crashing-randomly/291827 "2021-12-29T10:23:36Z")
Hi, after upgrading to Elasticsearch 7.16.1 (Debian-package from elastic.co), we're seeing some graver errors and crashes on some clusters: Instances are running with Debian Buster (10) \[2021-12-14T00:00:06,036\]\[ERRO… --- ## [Incorrect/increasing elasticsearch count query after re-indexing!](https://discuss.elastic.co/t/incorrect-increasing-elasticsearch-count-query-after-re-indexing/293096)
**Author:** [@Ilia](https://discuss.elastic.co/u/Ilia)\ **Replies:** 1\ **Last updated:** [December 29, 2021, 9:44am UTC](https://discuss.elastic.co/t/incorrect-increasing-elasticsearch-count-query-after-re-indexing/293096 "2021-12-29T09:44:06Z")
Some hours ago I've re-indexed one of my indices. The re-indexing process completed in about 2 hours and I've run the following query afterwards: GET myIndex/\_count { "query": { "bool": { "must": \[ {… --- ## [Self-managed Gold subscription infra required is 3-node with 64GB ram, 8 core cpu, 2TB ssd?](https://discuss.elastic.co/t/self-managed-gold-subscription-infra-required-is-3-node-with-64gb-ram-8-core-cpu-2tb-ssd/293090)
**Author:** [@Melvin](https://discuss.elastic.co/u/Melvin)\ **Replies:** 1\ **Last updated:** [December 29, 2021, 7:18am UTC](https://discuss.elastic.co/t/self-managed-gold-subscription-infra-required-is-3-node-with-64gb-ram-8-core-cpu-2tb-ssd/293090 "2021-12-29T07:18:22Z")
Hi, Wanted to check with the community if there was a mistake in my understanding. I was told that Gold subscription is provided to self-managed instances only if the infra we have confirms to the following specs: 3 n… --- ## [Sort After Aggregation](https://discuss.elastic.co/t/sort-after-aggregation/293081)
**Author:** [@aosrc](https://discuss.elastic.co/u/aosrc)\ **Replies:** 1\ **Last updated:** [December 29, 2021, 5:02am UTC](https://discuss.elastic.co/t/sort-after-aggregation/293081 "2021-12-29T05:02:09Z")
I need to aggregate by multi fields : \[srcMac, dstMac, srcIp, dstIp, srcPort, dstPort, protocol\], so I add a field "groupKey" and then aggregate by it. the mappings is: { "mappings": { "\_doc": { … --- ## [After deleting an index, a new one is created with invalid naming scheme](https://discuss.elastic.co/t/after-deleting-an-index-a-new-one-is-created-with-invalid-naming-scheme/292747)
**Author:** [@mdebord](https://discuss.elastic.co/u/mdebord)\ **Replies:** 6\ **Last updated:** [December 28, 2021, 9:21pm UTC](https://discuss.elastic.co/t/after-deleting-an-index-a-new-one-is-created-with-invalid-naming-scheme/292747 "2021-12-28T21:21:39Z")
Logstash 7.16.2 Elasticsearch 7.16.2 Summary In a scenario that beat processors are sending to logstash, and logstash has ilm configured, if the working index is deleted, a new one is created (as expected), but the n… --- ## [\[ERROR\] logstash.filters.ruby](https://discuss.elastic.co/t/error-logstash-filters-ruby/291841)
**Author:** [@kyk](https://discuss.elastic.co/u/kyk)\ **Replies:** 4\ **Last updated:** [December 29, 2021, 3:14am UTC](https://discuss.elastic.co/t/error-logstash-filters-ruby/291841 "2021-12-29T03:14:16Z")
I have the next ruby code ruby { code =\> ' m = event.get("ip\_port").scan(/(\\d+.\\d+.\\d+.\\d+):(\\d+)-\>(\\d+.\\d+.\\d+.\\d+):(\\d+)/) w = ; x = ; y = ; z = m.each { |a| w \<\< a\[0\].to\_fo x \<\< a\[1\].to\_fo y \<\< a\[2\].to\_fo z \<… --- ## [Upload documenet/image as data into Elasticsearch](https://discuss.elastic.co/t/upload-documenet-image-as-data-into-elasticsearch/293058)
**Author:** [@Amisha\_Thakkar](https://discuss.elastic.co/u/Amisha_Thakkar)\ **Replies:** 3\ **Last updated:** [December 28, 2021, 11:38pm UTC](https://discuss.elastic.co/t/upload-documenet-image-as-data-into-elasticsearch/293058 "2021-12-28T23:38:37Z")
Hi Team, We would like to know if we can upload document/image as a data into Elasticsearch. And will it index the text which is there in that document/image. So that we can search the text present on that document/imag… --- ## [Help with my first elasticsearch mapping](https://discuss.elastic.co/t/help-with-my-first-elasticsearch-mapping/292358)
**Author:** [@4art4](https://discuss.elastic.co/u/4art4)\ **Replies:** 3\ **Last updated:** [December 28, 2021, 9:16pm UTC](https://discuss.elastic.co/t/help-with-my-first-elasticsearch-mapping/292358 "2021-12-28T21:16:25Z")
What I have is elasticserach ingesting something like: { "policy": { "name": "account-cloudtrail-enabled", "resource": "account" }, "metrics": \[{ "MetricName": "ResourceCount", "Timestamp": "2021-12-06T11:29:… --- ## [Read \*.json.gz from AWS S3 bucket](https://discuss.elastic.co/t/read-json-gz-from-aws-s3-bucket/292822)
**Author:** [@Vidya\_Sagar](https://discuss.elastic.co/u/Vidya_Sagar)\ **Replies:** 2\ **Last updated:** [December 28, 2021, 7:24pm UTC](https://discuss.elastic.co/t/read-json-gz-from-aws-s3-bucket/292822 "2021-12-28T19:24:45Z")
Hi All, I am new to ELK Stack and trying to read data from S3 buckets. The json data is in compressed format and the folder structure in the S3 bucket is like YYYY-MM-DD/.json.gz 2021-12-01/A.json.gz 2021-12-02/B.jso… --- ## [Logstash does not use the correct index with Elasticsearch output](https://discuss.elastic.co/t/logstash-does-not-use-the-correct-index-with-elasticsearch-output/293052)
**Author:** [@dat\_tang](https://discuss.elastic.co/u/dat_tang)\ **Replies:** 6\ **Last updated:** [December 28, 2021, 6:39pm UTC](https://discuss.elastic.co/t/logstash-does-not-use-the-correct-index-with-elasticsearch-output/293052 "2021-12-28T18:39:28Z")
Hi, I have an ELK stack which I updated 2 weeks ago from 7.2.0 to 7.16.1. The configuration did not change and is as follow: # all input will come from filebeat, no local logs input { beats { port =\> 5044 } } f… --- ## [Logstash JDBC driver](https://discuss.elastic.co/t/logstash-jdbc-driver/293041)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 1\ **Last updated:** [December 28, 2021, 6:16pm UTC](https://discuss.elastic.co/t/logstash-jdbc-driver/293041 "2021-12-28T18:16:09Z")
Hi dears I have upgraded my cluster form 7.6.2 to 7.16.2 There is only one problem I faced with. My Logstash has some pipelines that need to connect to a sql db and according to a statement, get a SP result from sql d… --- ## [How to calculate the cost of elasticsearch in AWS?](https://discuss.elastic.co/t/how-to-calculate-the-cost-of-elasticsearch-in-aws/292995)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 3\ **Last updated:** [December 28, 2021, 2:46pm UTC](https://discuss.elastic.co/t/how-to-calculate-the-cost-of-elasticsearch-in-aws/292995 "2021-12-28T14:46:13Z")
Hi, we are considering moving , one of our cluster, from on premise to AWS, is there a calculator to get how much it will cost? or a blog page, your personal experiences... the cluster has 3 nodes and 3 teras of data. --- ## [Kibana update from 7.10.2 to 7.16.2](https://discuss.elastic.co/t/kibana-update-from-7-10-2-to-7-16-2/293034)
**Author:** [@rahul.cheekoti](https://discuss.elastic.co/u/rahul.cheekoti)\ **Replies:** 1\ **Last updated:** [December 28, 2021, 11:38am UTC](https://discuss.elastic.co/t/kibana-update-from-7-10-2-to-7-16-2/293034 "2021-12-28T11:38:45Z")
I am trying to upgrade Elasticsearch and kibana from 7.10.2 to 7.16.2 , I have successful updated the Elasticsearch , but while I am updating the kibana I am getting below error : FATAL Error: Unable to complete saved … --- ## [Cannot import name 'Elasticsearch' from 'elasticsearch' (unknown location)](https://discuss.elastic.co/t/cannot-import-name-elasticsearch-from-elasticsearch-unknown-location/292991)
**Author:** [@Divyank\_Garg](https://discuss.elastic.co/u/Divyank_Garg)\ **Replies:** 1\ **Last updated:** [December 28, 2021, 11:20am UTC](https://discuss.elastic.co/t/cannot-import-name-elasticsearch-from-elasticsearch-unknown-location/292991 "2021-12-28T11:20:27Z")
I have installed Elasticsearch library and trying to import Elasticsearch from Elasticsearch library but getting issue: cannot import name 'Elasticsearch' from 'Elasticsearch' (unknown location) --- ## [Why is search\_after preferred over Scroll API?](https://discuss.elastic.co/t/why-is-search-after-preferred-over-scroll-api/292989)
**Author:** [@dandago](https://discuss.elastic.co/u/dandago)\ **Replies:** 1\ **Last updated:** [December 28, 2021, 11:13am UTC](https://discuss.elastic.co/t/why-is-search-after-preferred-over-scroll-api/292989 "2021-12-28T11:13:26Z")
I've read that "We no longer recommend using the scroll API for deep pagination. If you need to preserve the index state while paging through more than 10,000 hits, use the search\_after parameter with a point in time (… --- ## [Internal Server Error : SavedObjectReferenceResolutionError: Failed to resolve Inventory default view "inventory-saved-view-0" (after 7.14.0 -\> 7.16.1 migration)](https://discuss.elastic.co/t/internal-server-error-savedobjectreferenceresolutionerror-failed-to-resolve-inventory-default-view-inventory-saved-view-0-after-7-14-0-7-16-1-migration/292204)
**Author:** [@AmauryB](https://discuss.elastic.co/u/AmauryB)\ **Replies:** 3\ **Last updated:** [December 28, 2021, 9:07am UTC](https://discuss.elastic.co/t/internal-server-error-savedobjectreferenceresolutionerror-failed-to-resolve-inventory-default-view-inventory-saved-view-0-after-7-14-0-7-16-1-migration/292204 "2021-12-28T09:07:27Z")
Before migrating from ELK 7.14.0 to ELK 7.16.1I had configured a specific Default Inventory view in the Observability Metrics App. After migration I get the following error \[2021-12-16T18:31:48.765+01:00\]\[ERROR\]\[http\] … --- ## [折れ線グラフにおいて、日付単位で集計0件の場合にcountを0で集計させたい](https://discuss.elastic.co/t/0-count-0/292079)
**Author:** [@na\_taka](https://discuss.elastic.co/u/na_taka)\ **Replies:** 13\ **Last updated:** [December 28, 2021, 7:29am UTC](https://discuss.elastic.co/t/0-count-0/292079 "2021-12-28T07:29:18Z")
お世話になっております。 折れ線グラフにおいて、質問させていただきます。 サンプルログ date dstaddr\_i レコード数 11/19 10.1.2.1 1 11/19 10.2.1.1 1 11/19 172.16.2.1 2 11/19 192.168.2.1 2 11/19 11.1.2.1 2 グラフ表示対象 11/19 173.16.2.1 2 … --- ## [While compile my application using gradle, it gives error 'package org.elasticsearch.common.io.stream does not exist'](https://discuss.elastic.co/t/while-compile-my-application-using-gradle-it-gives-error-package-org-elasticsearch-common-io-stream-does-not-exist/293020)
**Author:** [@Arqam](https://discuss.elastic.co/u/Arqam)\ **Replies:** 0\ **Last updated:** [December 28, 2021, 7:19am UTC](https://discuss.elastic.co/t/while-compile-my-application-using-gradle-it-gives-error-package-org-elasticsearch-common-io-stream-does-not-exist/293020 "2021-12-28T07:19:36Z")
Hi all, I'm new to java/gradle/Elasticsearch/application(crate-db). I am trying to create a development setup of CRATE-DB application. But when I am compiling the application by ./gradlew compilejava command it is return… --- ## [Elasticsearch filter plugin doesn't work when using elasticsearch on cloud](https://discuss.elastic.co/t/elasticsearch-filter-plugin-doesnt-work-when-using-elasticsearch-on-cloud/293008)
**Author:** [@CasMeiron](https://discuss.elastic.co/u/CasMeiron)\ **Replies:** 1\ **Last updated:** [December 28, 2021, 12:39am UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-doesnt-work-when-using-elasticsearch-on-cloud/293008 "2021-12-28T00:39:46Z")
Hi, I've noticed that Elasticsearch filter plugin wont work if you try to connect to a Elasticsearch cloud instance. It seems it tries to append https:// twice (one already exists on cloud host resolution). Seems like … --- ## [Logstash Ruby How to get fields of json array](https://discuss.elastic.co/t/logstash-ruby-how-to-get-fields-of-json-array/292867)
**Author:** [@chandima\_jayamina](https://discuss.elastic.co/u/chandima_jayamina)\ **Replies:** 1\ **Last updated:** [December 27, 2021, 11:07pm UTC](https://discuss.elastic.co/t/logstash-ruby-how-to-get-fields-of-json-array/292867 "2021-12-27T23:07:19Z")
Hi I have an array "testItem":\["test1":"N", "test2":"", "test3":"xyz", "items":{"itemId":"123"},"test4","null"\] In here I want to extract the itemId from Json input through logstash how can i do it. I am new to logstas… --- ## [Logstash CPU gets pegged, all processing stops with Apache logs](https://discuss.elastic.co/t/logstash-cpu-gets-pegged-all-processing-stops-with-apache-logs/292985)
**Author:** [@erihar](https://discuss.elastic.co/u/erihar)\ **Replies:** 10\ **Last updated:** [December 27, 2021, 7:27pm UTC](https://discuss.elastic.co/t/logstash-cpu-gets-pegged-all-processing-stops-with-apache-logs/292985 "2021-12-27T19:27:40Z")
We are doing Apache accesslog ingestion into Logstash, from publicly-facing web servers. These work correctly, however after a day or two, some "crafty" requests come in, either from a security scan or hack attempt, and… --- ## [No data after CSV Export - Kibana](https://discuss.elastic.co/t/no-data-after-csv-export-kibana/290547)
**Author:** [@njain213](https://discuss.elastic.co/u/njain213)\ **Replies:** 10\ **Last updated:** [December 27, 2021, 6:27pm UTC](https://discuss.elastic.co/t/no-data-after-csv-export-kibana/290547 "2021-12-27T18:27:26Z")
Hi Team, On follow up on below issue can anyone help me out? --- ## [Beginner - hoping to show only unique results in Discover search](https://discuss.elastic.co/t/beginner-hoping-to-show-only-unique-results-in-discover-search/292837)
**Author:** [@jeffkbiz](https://discuss.elastic.co/u/jeffkbiz)\ **Replies:** 4\ **Last updated:** [December 27, 2021, 4:31pm UTC](https://discuss.elastic.co/t/beginner-hoping-to-show-only-unique-results-in-discover-search/292837 "2021-12-27T16:31:12Z")
I'm doing a logstash firewall search with fields for source.ip, destination.ip, rule.name, hostname, action and need to go back one month. The number of hits is huge but so many are identical. Is there a way for me to … --- ## [Failing shard with illegal\_argument\_exception](https://discuss.elastic.co/t/failing-shard-with-illegal-argument-exception/292977)
**Author:** [@obol89](https://discuss.elastic.co/u/obol89)\ **Replies:** 1\ **Last updated:** [December 27, 2021, 2:53pm UTC](https://discuss.elastic.co/t/failing-shard-with-illegal-argument-exception/292977 "2021-12-27T14:53:59Z")
Hi Everyone, When I'm trying to filter some data in Kibana I'm getting this message "1 of 716 shards failed" with this explanation: illegal\_argument\_exception at shard 0 index metricbeat-7.15.0-2021.12.27 node bfnMWOK… --- ## [Scripted fields on large number of data](https://discuss.elastic.co/t/scripted-fields-on-large-number-of-data/292983)
**Author:** [@bazingaa](https://discuss.elastic.co/u/bazingaa)\ **Replies:** 0\ **Last updated:** [December 27, 2021, 2:31pm UTC](https://discuss.elastic.co/t/scripted-fields-on-large-number-of-data/292983 "2021-12-27T14:31:34Z")
I have a ES index with millions of records. Currently records are fetched using scroll api and are paginated. Also all fields are sortable. I have request for new additional fields (dependent on already existing fields)… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=742) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=744)