# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1339 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1340 --- ## [Logstash when started using nohup, it is logging too much resulting in huge size](https://discuss.elastic.co/t/logstash-when-started-using-nohup-it-is-logging-too-much-resulting-in-huge-size/276560)
**Author:** [@mastersmit](https://discuss.elastic.co/u/mastersmit)\ **Replies:** 8\ **Last updated:** [July 2, 2021, 4:50am UTC](https://discuss.elastic.co/t/logstash-when-started-using-nohup-it-is-logging-too-much-resulting-in-huge-size/276560 "2021-07-02T04:50:02Z")
we are running logstash and its output has file and elasticsearch for every opening and closing the file plugin is logging in... resulting the nohup.out file being very huge... How do i avoid so much of logging, or is t… --- ## [Count specific entries in some field](https://discuss.elastic.co/t/count-specific-entries-in-some-field/277610)
**Author:** [@denisnovac](https://discuss.elastic.co/u/denisnovac)\ **Replies:** 0\ **Last updated:** [July 2, 2021, 4:04am UTC](https://discuss.elastic.co/t/count-specific-entries-in-some-field/277610 "2021-07-02T04:04:18Z")
Hi everyone. I have this aggregation to count the inputs in some field: "aggs": { "prodt": { "filter": { "bool": {} }, "aggs": { "prodt": { … --- ## [LogStash, GeoJSON and Kibana](https://discuss.elastic.co/t/logstash-geojson-and-kibana/277450)
**Author:** [@f4d0](https://discuss.elastic.co/u/f4d0)\ **Replies:** 4\ **Last updated:** [July 2, 2021, 2:24am UTC](https://discuss.elastic.co/t/logstash-geojson-and-kibana/277450 "2021-07-02T02:24:43Z")
I have successfully (I think) ingested logs using Logstash. Used the geoip filter and all the data looks good and well strucutred. When I index it in Kibana, the coordinates are set as float. This is what I can observe i… --- ## [Auditbeat not updating record/docs in index](https://discuss.elastic.co/t/auditbeat-not-updating-record-docs-in-index/277605)
**Author:** [@Stud21](https://discuss.elastic.co/u/Stud21)\ **Replies:** 0\ **Last updated:** [July 2, 2021, 1:17am UTC](https://discuss.elastic.co/t/auditbeat-not-updating-record-docs-in-index/277605 "2021-07-02T01:17:20Z")
I have installed Auditbeat and configured it on a RHEL machine. Auditbeat status shows that it is running. However, index for Auditbeat shows zero docs count. Auditd service is disabled. I have deleted and recreated the… --- ## [Is greates store logs into one indice or store in N small indices?](https://discuss.elastic.co/t/is-greates-store-logs-into-one-indice-or-store-in-n-small-indices/277588)
**Author:** [@guimap](https://discuss.elastic.co/u/guimap)\ **Replies:** 4\ **Last updated:** [July 1, 2021, 10:14pm UTC](https://discuss.elastic.co/t/is-greates-store-logs-into-one-indice-or-store-in-n-small-indices/277588 "2021-07-01T22:14:05Z")
Hi I was wondering which is greatest way to store logs data, store into only one indice ( maybe use ILM to manager this indice ) or split in small indices (like: logs-2021.07.01, logs-2021.07.02 etc) What the greatest … --- ## [Implementing a parent-child relationship and changing parent of a child document](https://discuss.elastic.co/t/implementing-a-parent-child-relationship-and-changing-parent-of-a-child-document/277498)
**Author:** [@ViniciusSPaiva](https://discuss.elastic.co/u/ViniciusSPaiva)\ **Replies:** 2\ **Last updated:** [July 1, 2021, 9:56pm UTC](https://discuss.elastic.co/t/implementing-a-parent-child-relationship-and-changing-parent-of-a-child-document/277498 "2021-07-01T21:56:39Z")
Hello, We need to create a solution able to search for two entities: record and file. Each one has its properties and records can have zero or more files. Appears to be very simple, but I am finding very difficult to f… --- ## [Numbers - ignore scientific notation](https://discuss.elastic.co/t/numbers-ignore-scientific-notation/277600)
**Author:** [@myronuecker](https://discuss.elastic.co/u/myronuecker)\ **Replies:** 0\ **Last updated:** [July 1, 2021, 9:42pm UTC](https://discuss.elastic.co/t/numbers-ignore-scientific-notation/277600 "2021-07-01T21:42:01Z")
We have fields that are defined like this: "type": "text", "store": true, "fields": { "date": { "type": "date", "ignore\_malformed": true, "format": "yyyy-MM-dd HH:mm:ss||yyyy-MM-dd" }, "number": { "… --- ## [Elasticsearch mapper-size plugin disadvantages/cost?](https://discuss.elastic.co/t/elasticsearch-mapper-size-plugin-disadvantages-cost/277585)
**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Replies:** 1\ **Last updated:** [July 1, 2021, 9:25pm UTC](https://discuss.elastic.co/t/elasticsearch-mapper-size-plugin-disadvantages-cost/277585 "2021-07-01T21:25:02Z")
Is there any disadvantage or significant cost to the elasticsearch cluster if I use mapper-size plugin on all indices ? Suppose our daily ingestion in 1.5 TB. --- ## [Testing ruby filter for logstash](https://discuss.elastic.co/t/testing-ruby-filter-for-logstash/277599)
**Author:** [@blackberrySherbet](https://discuss.elastic.co/u/blackberrySherbet)\ **Replies:** 0\ **Last updated:** [July 1, 2021, 9:08pm UTC](https://discuss.elastic.co/t/testing-ruby-filter-for-logstash/277599 "2021-07-01T21:08:50Z")
How would you write a test to check if the code described in Indent any json file nested fields and make it flat (@Badger ) is working? I am having a hard time using the inline testing framework described in Ruby filter… --- ## [ILM policy for filebeats through config file](https://discuss.elastic.co/t/ilm-policy-for-filebeats-through-config-file/277597)
**Author:** [@rp346](https://discuss.elastic.co/u/rp346)\ **Replies:** 0\ **Last updated:** [July 1, 2021, 8:54pm UTC](https://discuss.elastic.co/t/ilm-policy-for-filebeats-through-config-file/277597 "2021-07-01T20:54:37Z")
I want to setup ILM through filebeat.yml I have following config # ====================== Index Lifecycle Management (ILM) ====================== # Configure index lifecycle management (ILM). These settings cr… --- ## [Runtime scripts](https://discuss.elastic.co/t/runtime-scripts/277596)
**Author:** [@andremarzo](https://discuss.elastic.co/u/andremarzo)\ **Replies:** 0\ **Last updated:** [July 1, 2021, 8:53pm UTC](https://discuss.elastic.co/t/runtime-scripts/277596 "2021-07-01T20:53:09Z")
I ran a runtime script but i want delete it. How can i do it? --- ## [Using Field Data in Output Hosts?](https://discuss.elastic.co/t/using-field-data-in-output-hosts/277594)
**Author:** [@Dan\_L](https://discuss.elastic.co/u/Dan_L)\ **Replies:** 1\ **Last updated:** [July 1, 2021, 8:09pm UTC](https://discuss.elastic.co/t/using-field-data-in-output-hosts/277594 "2021-07-01T20:09:57Z")
Hello, I am trying to use the value of a field when I am defining hosts in logstash output. I've been able to do this in other logstash outputs like index. Is this possible? For example: output { elasticsearch { hosts … --- ## [Aggregations to show all values with filter](https://discuss.elastic.co/t/aggregations-to-show-all-values-with-filter/277591)
**Author:** [@saiteja](https://discuss.elastic.co/u/saiteja)\ **Replies:** 0\ **Last updated:** [July 1, 2021, 7:48pm UTC](https://discuss.elastic.co/t/aggregations-to-show-all-values-with-filter/277591 "2021-07-01T19:48:37Z")
Hello, I am trying to get all aggregations on specific field with filter same as exclude facet in solr If I run below query GET /measurement/\_search { "query": { "query\_string": { "query": "\*" } }, … --- ## [Elastic has a large number os rejections search](https://discuss.elastic.co/t/elastic-has-a-large-number-os-rejections-search/277097)
**Author:** [@guimap](https://discuss.elastic.co/u/guimap)\ **Replies:** 8\ **Last updated:** [July 1, 2021, 6:31pm UTC](https://discuss.elastic.co/t/elastic-has-a-large-number-os-rejections-search/277097 "2021-07-01T18:31:10Z")
Hi guys Recently my elasticsearch are returning 429 HTTP code for all \_search requests, after few search, i noticed that has a large number of rejected search in my threads node\_name name active rejected … --- ## [Filebeat Error on Widows Machine](https://discuss.elastic.co/t/filebeat-error-on-widows-machine/277562)
**Author:** [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\ **Replies:** 1\ **Last updated:** [July 1, 2021, 5:49pm UTC](https://discuss.elastic.co/t/filebeat-error-on-widows-machine/277562 "2021-07-01T17:49:51Z")
How do I troubleshoot the following error? PS C:\\Program Files\\Filebeat\> .\\filebeat.exe -e 2021-07-01T12:20:50.286+0100 ERROR \[syslog\] syslog/input.go:155 Error starting the servererrorlisten tcp 127.0.… --- ## [Creating Index for different Systems is problematic](https://discuss.elastic.co/t/creating-index-for-different-systems-is-problematic/277516)
**Author:** [@Saumyadipta\_Sarkar](https://discuss.elastic.co/u/Saumyadipta_Sarkar)\ **Replies:** 9\ **Last updated:** [July 1, 2021, 5:19pm UTC](https://discuss.elastic.co/t/creating-index-for-different-systems-is-problematic/277516 "2021-07-01T17:19:09Z")
When I create an Index in Kibana and Search specific logs using query its giving me correct response. But Then if I want to open the URL composed with queries from any other system then its asking me to create an Index a… --- ## [How to interact with .NET NEST object methods from powershell?](https://discuss.elastic.co/t/how-to-interact-with-net-nest-object-methods-from-powershell/276568)
**Author:** [@dreic](https://discuss.elastic.co/u/dreic)\ **Replies:** 7\ **Last updated:** [July 1, 2021, 4:53pm UTC](https://discuss.elastic.co/t/how-to-interact-with-net-nest-object-methods-from-powershell/276568 "2021-07-01T16:53:05Z")
How to call method of .NET object in powershell (Elasticsearch NEST .NET client). This is basic example of .NET code for NEST client and I am trying to write PS equivalent but I am failing in setting object value. Is thi… --- ## [Inrepolation logstash 7.11.1](https://discuss.elastic.co/t/inrepolation-logstash-7-11-1/277571)
**Author:** [@zakabluk](https://discuss.elastic.co/u/zakabluk)\ **Replies:** 1\ **Last updated:** [July 1, 2021, 4:28pm UTC](https://discuss.elastic.co/t/inrepolation-logstash-7-11-1/277571 "2021-07-01T16:28:09Z")
I haw been logstash version 6.X and my logstash output S3 worked. I use prefix at output: prefix =\> “dillinger-stat-message/%{+YYYY.MM.dd}/%{host\[name\]}/%{source}” when I migrate to logstash version 7.11.1(docker, file… --- ## [Filebeat make update fails for new custom module](https://discuss.elastic.co/t/filebeat-make-update-fails-for-new-custom-module/277578)
**Author:** [@Jerry\_Tian](https://discuss.elastic.co/u/Jerry_Tian)\ **Replies:** 0\ **Last updated:** [July 1, 2021, 4:20pm UTC](https://discuss.elastic.co/t/filebeat-make-update-fails-for-new-custom-module/277578 "2021-07-01T16:20:21Z")
I followed the instructions from here: Creating a New Filebeat Module | Beats Developer Guide \[master\] | Elastic. make create-module MODULE={module} make create-fileset MODULE={module} FILESET={fileset} make create-fiel… --- ## [Unable to push documents and index patterns in indexes in kibana plugin using core api](https://discuss.elastic.co/t/unable-to-push-documents-and-index-patterns-in-indexes-in-kibana-plugin-using-core-api/277508)
**Author:** [@kibanaPluginDev](https://discuss.elastic.co/u/kibanaPluginDev)\ **Replies:** 3\ **Last updated:** [July 1, 2021, 3:38pm UTC](https://discuss.elastic.co/t/unable-to-push-documents-and-index-patterns-in-indexes-in-kibana-plugin-using-core-api/277508 "2021-07-01T15:38:52Z")
I am unable to push the documents in the newly created index and add new fields to it using the kibana core API . Although I was able to do it with the dev tool. i want to implement this feature in my plugin to add docum… --- ## [Dynamic custom fields with numeric and date range queries](https://discuss.elastic.co/t/dynamic-custom-fields-with-numeric-and-date-range-queries/277574)
**Author:** [@nbiondic](https://discuss.elastic.co/u/nbiondic)\ **Replies:** 0\ **Last updated:** [July 1, 2021, 3:14pm UTC](https://discuss.elastic.co/t/dynamic-custom-fields-with-numeric-and-date-range-queries/277574 "2021-07-01T15:14:51Z")
We have a requirement to support custom search fields for our users. Each user should have an ability to create their own fields which can than be searched through by using our built-in filtering mechanism Our initial i… --- ## [How to create a user defined data table visualization](https://discuss.elastic.co/t/how-to-create-a-user-defined-data-table-visualization/277540)
**Author:** [@abhinav3](https://discuss.elastic.co/u/abhinav3)\ **Replies:** 3\ **Last updated:** [July 1, 2021, 3:06pm UTC](https://discuss.elastic.co/t/how-to-create-a-user-defined-data-table-visualization/277540 "2021-07-01T15:06:26Z")
Hi I have been using Kibana dashboard to monitor my Raspberry Pi devices health. Each raspberry pi sends its health log to elasticsearch and from their I have dashboard which then have multiple visualization to monitor … --- ## [How to create a master list of devices and compare with the input logs to show in Kibana](https://discuss.elastic.co/t/how-to-create-a-master-list-of-devices-and-compare-with-the-input-logs-to-show-in-kibana/277569)
**Author:** [@abhinav3](https://discuss.elastic.co/u/abhinav3)\ **Replies:** 0\ **Last updated:** [July 1, 2021, 2:59pm UTC](https://discuss.elastic.co/t/how-to-create-a-master-list-of-devices-and-compare-with-the-input-logs-to-show-in-kibana/277569 "2021-07-01T14:59:43Z")
Hi I have 20 Raspberry Pi devices installed. They all are uploading data to elasticsearch and I can see the online devices in kibana dashboard. But along with online, I also want to see the list of device name which are… --- ## [Индексы](https://discuss.elastic.co/t/topic/277567)
**Author:** [@\_LA](https://discuss.elastic.co/u/_LA)\ **Replies:** 0\ **Last updated:** [July 1, 2021, 2:58pm UTC](https://discuss.elastic.co/t/topic/277567 "2021-07-01T14:58:26Z")
Подскажите пожалуйста, как и где в эластике посмотреть уже имеющуюся взаимосвязь индексов со всеми полями? --- ## [Creating custom module for filebeat](https://discuss.elastic.co/t/creating-custom-module-for-filebeat/277566)
**Author:** [@Jerry\_Tian](https://discuss.elastic.co/u/Jerry_Tian)\ **Replies:** 0\ **Last updated:** [July 1, 2021, 2:53pm UTC](https://discuss.elastic.co/t/creating-custom-module-for-filebeat/277566 "2021-07-01T14:53:05Z")
I was watching this webinar Build Your Own Filebeat Module | Elastic to learn how to create my own module. I wanted to test the pipeline.json file that I wrote for a custom log file but I'm not sure how to do it. In the … --- ## [Slow Performance of Elastic Search with Spark](https://discuss.elastic.co/t/slow-performance-of-elastic-search-with-spark/277101)
**Author:** [@Hardik\_Aggarwal](https://discuss.elastic.co/u/Hardik_Aggarwal)\ **Replies:** 3\ **Last updated:** [July 1, 2021, 2:48pm UTC](https://discuss.elastic.co/t/slow-performance-of-elastic-search-with-spark/277101 "2021-07-01T14:48:46Z")
I am trying to read the data from Elastic Search into a dataframe using Java ES-Spark-connector.. Now when I try to execute a query for example count() on the dataframe, the performance is dismal. For a 3Gb data it takes… --- ## [How to ignore URL when searching using ElasticSearch？](https://discuss.elastic.co/t/how-to-ignore-url-when-searching-using-elasticsearch/277443)
**Author:** [@bobfang1992](https://discuss.elastic.co/u/bobfang1992)\ **Replies:** 1\ **Last updated:** [July 1, 2021, 2:27pm UTC](https://discuss.elastic.co/t/how-to-ignore-url-when-searching-using-elasticsearch/277443 "2021-07-01T14:27:54Z")
Hi，I have a set of documents which may contains some texts, but may have URLs inside them: Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nullam tincidunt metus a convallis imperdiet. Praesent interdum magna u… --- ## [Need a script field tag to calculate time difference](https://discuss.elastic.co/t/need-a-script-field-tag-to-calculate-time-difference/277438)
**Author:** [@vikram.sablok](https://discuss.elastic.co/u/vikram.sablok)\ **Replies:** 1\ **Last updated:** [July 1, 2021, 2:27pm UTC](https://discuss.elastic.co/t/need-a-script-field-tag-to-calculate-time-difference/277438 "2021-07-01T14:27:05Z")
\-(minus) this will give me overall time taken for a request. I can use this field to show average time over a period of time. --- ## [Data Table - Display count as a metric and split it by filters](https://discuss.elastic.co/t/data-table-display-count-as-a-metric-and-split-it-by-filters/277259)
**Author:** [@prashu421](https://discuss.elastic.co/u/prashu421)\ **Replies:** 4\ **Last updated:** [July 1, 2021, 2:25pm UTC](https://discuss.elastic.co/t/data-table-display-count-as-a-metric-and-split-it-by-filters/277259 "2021-07-01T14:25:10Z")
Hello, I am working with Kibana through Elasticsearch version 7.4 (AWS Elasticsearch Service), and hoping to build a data table that looks similar to this - Before splitting the count by pipeline id, I am trying to c… --- ## [Difference range query between numeric type and range type](https://discuss.elastic.co/t/difference-range-query-between-numeric-type-and-range-type/277527)
**Author:** [@kr\_junhodo](https://discuss.elastic.co/u/kr_junhodo)\ **Replies:** 1\ **Last updated:** [July 1, 2021, 2:21pm UTC](https://discuss.elastic.co/t/difference-range-query-between-numeric-type-and-range-type/277527 "2021-07-01T14:21:17Z")
i Think this article says that range type is better way for range query. example 1) doc mapping : start\_date(date) and end\_date(date) query description : start\_date \< criteria && criteria \< end\_date via range query … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1338) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1340)