# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1235 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1236 --- ## [Disk partitioning for Elasticsearch](https://discuss.elastic.co/t/disk-partitioning-for-elasticsearch/284459)
**Author:** [@ithfdemir](https://discuss.elastic.co/u/ithfdemir)\ **Replies:** 1\ **Last updated:** [September 18, 2021, 7:29am UTC](https://discuss.elastic.co/t/disk-partitioning-for-elasticsearch/284459 "2021-09-18T07:29:08Z")
Hi, I have SAS and SSD disk coming from data center's pool. I want to setup my Elasticsearch cluster with those disks. I want to use SSDs only for recent 1 week and SAS for past. Is it possible? This setup will be ded… --- ## [Filebeat merge input duplicate logs](https://discuss.elastic.co/t/filebeat-merge-input-duplicate-logs/284506)
**Author:** [@dangge](https://discuss.elastic.co/u/dangge)\ **Replies:** 2\ **Last updated:** [September 18, 2021, 6:53am UTC](https://discuss.elastic.co/t/filebeat-merge-input-duplicate-logs/284506 "2021-09-18T06:53:36Z")
we had meet some linux filesystem error recently,a troublesome thing is that Linux will log a large number of the same logs at a certain point in time.like this: we use filebeat and logstash to record this error and … --- ## [How to apply filebeat to openshift and make use of multiline](https://discuss.elastic.co/t/how-to-apply-filebeat-to-openshift-and-make-use-of-multiline/284528)
**Author:** [@lsy1990](https://discuss.elastic.co/u/lsy1990)\ **Replies:** 0\ **Last updated:** [September 18, 2021, 6:18am UTC](https://discuss.elastic.co/t/how-to-apply-filebeat-to-openshift-and-make-use-of-multiline/284528 "2021-09-18T06:18:04Z")
I deploy filebeat to openshift 3.11 by daemonset .The log format is json like this below: {"log":"\\u0009at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.invokeJoinpoint(CglibAopProxy.java:746)\\n"… --- ## [Stopwords(Elasticsearch7.14+ fscrawler2.7)](https://discuss.elastic.co/t/stopwords-elasticsearch7-14-fscrawler2-7/284053)
**Author:** [@Tarik\_Bouhasse](https://discuss.elastic.co/u/Tarik_Bouhasse)\ **Replies:** 6\ **Last updated:** [September 18, 2021, 1:29am UTC](https://discuss.elastic.co/t/stopwords-elasticsearch7-14-fscrawler2-7/284053 "2021-09-18T01:29:49Z")
how to configure stopwords. I am in fscrawler2.7 and Elasticsearch7.14 --- ## [Match complete line after some regex pattern](https://discuss.elastic.co/t/match-complete-line-after-some-regex-pattern/284385)
**Author:** [@ansamHox](https://discuss.elastic.co/u/ansamHox)\ **Replies:** 9\ **Last updated:** [September 17, 2021, 9:57pm UTC](https://discuss.elastic.co/t/match-complete-line-after-some-regex-pattern/284385 "2021-09-17T21:57:55Z")
I have lines in document like this. \*\*\* Begin time: Sat Jun 26 21:11:14 AEST 2019 Want to assign new field begin\_time = Sat Jun 26 21:11:14 AEST 2019 This is what I tried: if x =~ /(\\bBegin time:\\s+(.\*))/ … --- ## [Failure: \[lang\_ident\_neural\_network\] model could not find non-null numerical array named \[embedding\_vector\]](https://discuss.elastic.co/t/failure-lang-ident-neural-network-model-could-not-find-non-null-numerical-array-named-embedding-vector/284507)
**Author:** [@ccat](https://discuss.elastic.co/u/ccat)\ **Replies:** 1\ **Last updated:** [September 17, 2021, 8:38pm UTC](https://discuss.elastic.co/t/failure-lang-ident-neural-network-model-could-not-find-non-null-numerical-array-named-embedding-vector/284507 "2021-09-17T20:38:21Z")
Hi, I am running an inference processor for language identification on a text field (model ID: lang\_ident\_model\_1). The processor works when I test it with sample data using the \_ingest REST endpoint with \_simulate. … --- ## [Pipeline.workers configuration and aggregation filter](https://discuss.elastic.co/t/pipeline-workers-configuration-and-aggregation-filter/284461)
**Author:** [@Roberto\_B](https://discuss.elastic.co/u/Roberto_B)\ **Replies:** 8\ **Last updated:** [September 17, 2021, 8:04pm UTC](https://discuss.elastic.co/t/pipeline-workers-configuration-and-aggregation-filter/284461 "2021-09-17T20:04:38Z")
Hi all, I'm going to use a brand new server with 4 vCPU and 16GB RAM, I've some pipelines (+60) and I'll run multiple pipeline (for eg: 1 pipeline for 10 "easy pipelines" 8 for "medium pipelines" and so on). Some of th… --- ## [How to decrease the response time for the first time call of Elasticsearch query?](https://discuss.elastic.co/t/how-to-decrease-the-response-time-for-the-first-time-call-of-elasticsearch-query/284361)
**Author:** [@pavan\_kalyan](https://discuss.elastic.co/u/pavan_kalyan)\ **Replies:** 5\ **Last updated:** [September 17, 2021, 7:54pm UTC](https://discuss.elastic.co/t/how-to-decrease-the-response-time-for-the-first-time-call-of-elasticsearch-query/284361 "2021-09-17T19:54:32Z")
sample query here, could anyone please help me to solve this issue. query = { "size": 20, "\_source": { "includes": \[ "xyz", "abc", 'dgs'\], }, "query": { "bool": { "mus… --- ## [Native controller process has stopped](https://discuss.elastic.co/t/native-controller-process-has-stopped/284505)
**Author:** [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\ **Replies:** 1\ **Last updated:** [September 17, 2021, 6:09pm UTC](https://discuss.elastic.co/t/native-controller-process-has-stopped/284505 "2021-09-17T18:09:03Z")
I am not able to start the elasticsearch service, I am getting the following errors. I could find many discussions with the same error but didn't find solution in any of them. Below are the logs, can anyone please provi… --- ## [How to use ingest attachment processor in elastic cloud](https://discuss.elastic.co/t/how-to-use-ingest-attachment-processor-in-elastic-cloud/284455)
**Author:** [@zaidsalah](https://discuss.elastic.co/u/zaidsalah)\ **Replies:** 6\ **Last updated:** [September 17, 2021, 4:33pm UTC](https://discuss.elastic.co/t/how-to-use-ingest-attachment-processor-in-elastic-cloud/284455 "2021-09-17T16:33:12Z")
how to use ingest attachment processor in elastic cloud Elastic search is not in local i am using free trial cloud when i run this in dev tools PUT \_ingest/pipeline/attachment { "description" : "Extract attachment i… --- ## [Change in code source kibana 7.13](https://discuss.elastic.co/t/change-in-code-source-kibana-7-13/283139)
**Author:** [@hedia](https://discuss.elastic.co/u/hedia)\ **Replies:** 3\ **Last updated:** [September 17, 2021, 3:32pm UTC](https://discuss.elastic.co/t/change-in-code-source-kibana-7-13/283139 "2021-09-17T15:32:32Z")
Hello, I have upgrade from kibana 7.5 to kibana 7.13. and i want to change orientation of my dashboard kibana from right to left. In kibana 7.5 it's easy, i change direction in commons.style.css and the changes are h… --- ## [Parse Hostname from offline logs and then apply to all events](https://discuss.elastic.co/t/parse-hostname-from-offline-logs-and-then-apply-to-all-events/284467)
**Author:** [@sirReeall](https://discuss.elastic.co/u/sirReeall)\ **Replies:** 6\ **Last updated:** [September 17, 2021, 3:16pm UTC](https://discuss.elastic.co/t/parse-hostname-from-offline-logs-and-then-apply-to-all-events/284467 "2021-09-17T15:16:23Z")
Hi, I'm building an offline log parser using logstash, ES and Kibana. In this scenario the logs are provided in a zip from servers. They are placed in a volume mounted into the logstash container, then pushed into ES an… --- ## [Metricbeat setup --dashboards fails: error loading config file](https://discuss.elastic.co/t/metricbeat-setup-dashboards-fails-error-loading-config-file/284495)
**Author:** [@cdalexndr](https://discuss.elastic.co/u/cdalexndr)\ **Replies:** 1\ **Last updated:** [September 17, 2021, 3:15pm UTC](https://discuss.elastic.co/t/metricbeat-setup-dashboards-fails-error-loading-config-file/284495 "2021-09-17T15:15:30Z")
λ docker exec -it docker\_metricbeat\_1 sh sh-4.2# metricbeat setup --dashboards Exiting: error loading config file: config file ("metricbeat.yml") can only be writable by the owner but the permissions are "-rwxrwxrwx" (to… --- ## [Integrated Kibana Dev tools for IntelliJ Jetbrains IDE - Looking for ideas/possibilities of using Kibana core APIs](https://discuss.elastic.co/t/integrated-kibana-dev-tools-for-intellij-jetbrains-ide-looking-for-ideas-possibilities-of-using-kibana-core-apis/284494)
**Author:** [@dinbtechit](https://discuss.elastic.co/u/dinbtechit)\ **Replies:** 0\ **Last updated:** [September 17, 2021, 3:09pm UTC](https://discuss.elastic.co/t/integrated-kibana-dev-tools-for-intellij-jetbrains-ide-looking-for-ideas-possibilities-of-using-kibana-core-apis/284494 "2021-09-17T15:09:30Z")
I am planning to build a Integrated Kibana - Dev Tools for IntelliJ Jetbrains IDE. Rather than building everything from scratch, I am wondering if I can reuse some of Kibana's core API's (if there is any) to accomplish t… --- ## [How can I use "minimum\_should\_match" correctly?](https://discuss.elastic.co/t/how-can-i-use-minimum-should-match-correctly/284466)
**Author:** [@bigwang](https://discuss.elastic.co/u/bigwang)\ **Replies:** 6\ **Last updated:** [September 17, 2021, 2:44pm UTC](https://discuss.elastic.co/t/how-can-i-use-minimum-should-match-correctly/284466 "2021-09-17T14:44:19Z")
Are these two syntaxes not equivalent? first GET doc\_data/\_search { "query": { "match": { "title": { "query": "农村信用银行", "minimum\_should\_match": 2 } } } } second: GET doc\_data… --- ## [Split field into multiple fields](https://discuss.elastic.co/t/split-field-into-multiple-fields/284096)
**Author:** [@mavericknd](https://discuss.elastic.co/u/mavericknd)\ **Replies:** 3\ **Last updated:** [September 17, 2021, 2:14pm UTC](https://discuss.elastic.co/t/split-field-into-multiple-fields/284096 "2021-09-17T14:14:29Z")
Hi, i have the following log and want the key value pairs inside message (ipAddress=1.1.1.1 realmId=some\_realm) to be separate fields. I tried with grok, kv, mutate, nothing works, no change in kibana. If somebody can … --- ## [Elapsed Plugin 'expired' events create new index with incorrect field mapping](https://discuss.elastic.co/t/elapsed-plugin-expired-events-create-new-index-with-incorrect-field-mapping/284486)
**Author:** [@stevedearl](https://discuss.elastic.co/u/stevedearl)\ **Replies:** 0\ **Last updated:** [September 17, 2021, 1:29pm UTC](https://discuss.elastic.co/t/elapsed-plugin-expired-events-create-new-index-with-incorrect-field-mapping/284486 "2021-09-17T13:29:35Z")
Hi All, I had an issue a few months ago where a float field in my documents began to be displayed as a numeric (no decimal values). The field was 'elapsedtime' which is measured seconds/millis. I raised this here in an… --- ## [Send data from filebeat to kafka(with kerberos) failed](https://discuss.elastic.co/t/send-data-from-filebeat-to-kafka-with-kerberos-failed/284479)
**Author:** [@charlielin](https://discuss.elastic.co/u/charlielin)\ **Replies:** 0\ **Last updated:** [September 17, 2021, 11:47am UTC](https://discuss.elastic.co/t/send-data-from-filebeat-to-kafka-with-kerberos-failed/284479 "2021-09-17T11:47:37Z")
filebeat: filebeat-7.10.2-linux-x86\_64 kafka: kafka\_2.13-2.6.0/ here is my filebeat config: filebeat.inputs: - type: log # Change to true to enable this input configuration. enabled: true fields\_under\_root: tru… --- ## [Search first in one field and if not return result, search in all document](https://discuss.elastic.co/t/search-first-in-one-field-and-if-not-return-result-search-in-all-document/284047)
**Author:** [@castano\_guill](https://discuss.elastic.co/u/castano_guill)\ **Replies:** 9\ **Last updated:** [September 17, 2021, 10:54am UTC](https://discuss.elastic.co/t/search-first-in-one-field-and-if-not-return-result-search-in-all-document/284047 "2021-09-17T10:54:35Z")
Hello, I´m new in the community. Currently I ingest PDF documents to an index in elastic, in those documents I add custom fields of various information (state, short way of referring to it, etc, ..) I want to change m… --- ## [Elastic Search query to get the list of documents with some minimum occurrence of a property](https://discuss.elastic.co/t/elastic-search-query-to-get-the-list-of-documents-with-some-minimum-occurrence-of-a-property/284476)
**Author:** [@pranay\_jain](https://discuss.elastic.co/u/pranay_jain)\ **Replies:** 0\ **Last updated:** [September 17, 2021, 10:50am UTC](https://discuss.elastic.co/t/elastic-search-query-to-get-the-list-of-documents-with-some-minimum-occurrence-of-a-property/284476 "2021-09-17T10:50:27Z")
I have a index with documents like this \[ { "customer\_id" : "123", "country": "USA", "department": "IT", "creation\_date" : "2021-06-23" ... }, { "customer\_id" : "123", "country": "USA", "depar… --- ## [Index Lifecycle Policies](https://discuss.elastic.co/t/index-lifecycle-policies/284351)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 8\ **Last updated:** [September 17, 2021, 10:33am UTC](https://discuss.elastic.co/t/index-lifecycle-policies/284351 "2021-09-17T10:33:39Z")
how to make logs deleted every 2 weeks? --- ## [Empty row in the patter when creating an index and undefined value out field name](https://discuss.elastic.co/t/empty-row-in-the-patter-when-creating-an-index-and-undefined-value-out-field-name/284082)
**Author:** [@Jaime\_Teixido](https://discuss.elastic.co/u/Jaime_Teixido)\ **Replies:** 9\ **Last updated:** [September 17, 2021, 10:07am UTC](https://discuss.elastic.co/t/empty-row-in-the-patter-when-creating-an-index-and-undefined-value-out-field-name/284082 "2021-09-17T10:07:42Z")
Hello, when creating a new index as follows: PUT index-name The index is generated correctly but when generating the pattern, I see an empty row. I'm not sure if this is what is causing the documents to have an emp… --- ## [Less than or equal not working logstash filter and crashing](https://discuss.elastic.co/t/less-than-or-equal-not-working-logstash-filter-and-crashing/283729)
**Author:** [@Shaiju\_Sam](https://discuss.elastic.co/u/Shaiju_Sam)\ **Replies:** 21\ **Last updated:** [September 17, 2021, 10:02am UTC](https://discuss.elastic.co/t/less-than-or-equal-not-working-logstash-filter-and-crashing/283729 "2021-09-17T10:02:19Z")
Hi Team, I'm shipping logs from windows servers using filebeat. I have created a field which shows the reponse time in milliseconds. I have created a field "Create\_Indexing\_response\_time\_ms" using grok and it works per… --- ## [Unable to connect with GCP pubsub through logstash](https://discuss.elastic.co/t/unable-to-connect-with-gcp-pubsub-through-logstash/284470)
**Author:** [@anandsaini014](https://discuss.elastic.co/u/anandsaini014)\ **Replies:** 0\ **Last updated:** [September 17, 2021, 9:50am UTC](https://discuss.elastic.co/t/unable-to-connect-with-gcp-pubsub-through-logstash/284470 "2021-09-17T09:50:22Z")
Hi Team, I am trying to use Google pubsub input plugin through logstash. Followed this link: I am getting the following error: com.google.cloud.pubsub.v1.StreamingSubscriberConnection$1 onFailure SEVERE: terminate… --- ## [Spark Elasticsearch: Append new elements to nested array of objects](https://discuss.elastic.co/t/spark-elasticsearch-append-new-elements-to-nested-array-of-objects/284457)
**Author:** [@Lokesh\_Loks](https://discuss.elastic.co/u/Lokesh_Loks)\ **Replies:** 0\ **Last updated:** [September 17, 2021, 8:05am UTC](https://discuss.elastic.co/t/spark-elasticsearch-append-new-elements-to-nested-array-of-objects/284457 "2021-09-17T08:05:36Z")
I have elasticsearch query to add new elements to a nested array of objects below POST /transactions/\_doc/1/\_update { "script": { "source": "ctx.\_source.transactions.addAll(params.transactions)", "pa… --- ## [Failed to authenticate user \[elastic\] AND received plaintext http traffic on an https channel, closing connection](https://discuss.elastic.co/t/failed-to-authenticate-user-elastic-and-received-plaintext-http-traffic-on-an-https-channel-closing-connection/284062)
**Author:** [@smam](https://discuss.elastic.co/u/smam)\ **Replies:** 2\ **Last updated:** [September 17, 2021, 8:01am UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-elastic-and-received-plaintext-http-traffic-on-an-https-channel-closing-connection/284062 "2021-09-17T08:01:29Z")
Hello everyone, while setting up the highest security possible I am encountering multiple Problems. The first one is: \[2021-09-13T13:01:54,594\]\[INFO \]\[o.e.x.s.a.AuthenticationService\] \[elasticsearch\] Authentication of… --- ## [How to calculate the percentage in data table in kibana](https://discuss.elastic.co/t/how-to-calculate-the-percentage-in-data-table-in-kibana/284380)
**Author:** [@Nijanthan](https://discuss.elastic.co/u/Nijanthan)\ **Replies:** 6\ **Last updated:** [September 17, 2021, 7:23am UTC](https://discuss.elastic.co/t/how-to-calculate-the-percentage-in-data-table-in-kibana/284380 "2021-09-17T07:23:29Z")
How do I calculate the failure percentage in data table in kibana ? I have 3 columns like total ,success , failure nd I need to calculate the failure percentage which is ( failure / total ) ×100 . Is there any possible … --- ## [Metricbeat module system pass with special symbol](https://discuss.elastic.co/t/metricbeat-module-system-pass-with-special-symbol/284451)
**Author:** [@NoobUser404](https://discuss.elastic.co/u/NoobUser404)\ **Replies:** 0\ **Last updated:** [September 17, 2021, 6:55am UTC](https://discuss.elastic.co/t/metricbeat-module-system-pass-with-special-symbol/284451 "2021-09-17T06:55:13Z")
It is possible to put a any special symbol in the pass to sql? For example: hosts: \["sqlserver://sa:passwith$\ **Author:** [@vikramdayma](https://discuss.elastic.co/u/vikramdayma)\ **Replies:** 3\ **Last updated:** [September 17, 2021, 6:50am UTC](https://discuss.elastic.co/t/apply-filter-for-individual-visualization-in-dashboard/284275 "2021-09-17T06:50:40Z") Hi, I want to apply a filter for only a single visualization into a dashboard. Problem is when I apply a filter, all other visualization in dashboard also apply filter. Have any logic to implement filter only for indi… --- ## [Ingest fixed length data from internet](https://discuss.elastic.co/t/ingest-fixed-length-data-from-internet/284142)
**Author:** [@sparmar2000](https://discuss.elastic.co/u/sparmar2000)\ **Replies:** 2\ **Last updated:** [September 17, 2021, 6:30am UTC](https://discuss.elastic.co/t/ingest-fixed-length-data-from-internet/284142 "2021-09-17T06:30:20Z")
I have internet based web site, fixed length data, that I need to ingest. Question: Can beats be used - assuming have to use Logtash The input has about 100 fixed length. Is there a 'easy' way to define the fields - r… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1234) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1236)