# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1584 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1585 --- ## [Writing API update for setting number of replicas to 0](https://discuss.elastic.co/t/writing-api-update-for-setting-number-of-replicas-to-0/261595)
**Author:** [@txmrlevine](https://discuss.elastic.co/u/txmrlevine)\ **Replies:** 5\ **Last updated:** [January 27, 2021, 11:13pm UTC](https://discuss.elastic.co/t/writing-api-update-for-setting-number-of-replicas-to-0/261595 "2021-01-27T23:13:42Z")
We are trying to eliminate replicas in our non-prod environment to save space and we do not need the replicas. we know this is counter to the fault tolerance but it is something we must do. I found this on the document… --- ## [Nested Document Search Query (searching across filtered nested documents)](https://discuss.elastic.co/t/nested-document-search-query-searching-across-filtered-nested-documents/262420)
**Author:** [@suy1993](https://discuss.elastic.co/u/suy1993)\ **Replies:** 0\ **Last updated:** [January 27, 2021, 9:38pm UTC](https://discuss.elastic.co/t/nested-document-search-query-searching-across-filtered-nested-documents/262420 "2021-01-27T21:38:43Z")
I have nested document like {id:123, name:"abc", attendance\[{class: "physics", Joined: "2021-01- 21", "grade": "pass"} , {class: "chemistry", Joined: "2021-01- 13", "grade": "NA"}, {class: "maths", Joined: "2021-01- … --- ## [Roll up index](https://discuss.elastic.co/t/roll-up-index/262010)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 4\ **Last updated:** [January 27, 2021, 9:30pm UTC](https://discuss.elastic.co/t/roll-up-index/262010 "2021-01-27T21:30:55Z")
I have turn on roll up job for testing when I do GET /\_rollup/job/\_all I can see it is running. it says started but I don't see any rollup index. I don't see any index named metricbeat-rollup how do I confirm that it… --- ## [Python read all index pattern](https://discuss.elastic.co/t/python-read-all-index-pattern/262293)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 4\ **Last updated:** [January 27, 2021, 9:30pm UTC](https://discuss.elastic.co/t/python-read-all-index-pattern/262293 "2021-01-27T21:30:02Z")
is there a python call to read all index patterns I can read all indexes but I want to read patterns name for example I have index-1, index-2, index-3 and index pattern is index-\* and I use that for all visulization. … --- ## [Regular Expression on Env Var](https://discuss.elastic.co/t/regular-expression-on-env-var/262295)
**Author:** [@hQWeedEater](https://discuss.elastic.co/u/hQWeedEater)\ **Replies:** 1\ **Last updated:** [January 27, 2021, 5:08pm UTC](https://discuss.elastic.co/t/regular-expression-on-env-var/262295 "2021-01-27T17:08:17Z")
processors: - add\_fields: fields: custom\_value: "${COMPUTERNAME}" Is it possible to use regex on {COMPUTERNAME} to only return the first X characters or last X characters? I tried adding the above process… --- ## [How to distribute search requests by date](https://discuss.elastic.co/t/how-to-distribute-search-requests-by-date/262405)
**Author:** [@ozgun](https://discuss.elastic.co/u/ozgun)\ **Replies:** 2\ **Last updated:** [January 27, 2021, 8:54pm UTC](https://discuss.elastic.co/t/how-to-distribute-search-requests-by-date/262405 "2021-01-27T20:54:27Z")
Hello, I have daily indexes in the format of "payments-2021-01-27". When I search documents I send a time based query and I want to distribute search requests to the matched indexes by date. For example when I search l… --- ## [Exporting/Importing Saved Objects in Kibana 7.1](https://discuss.elastic.co/t/exporting-importing-saved-objects-in-kibana-7-1/262410)
**Author:** [@Colby\_Dozier](https://discuss.elastic.co/u/Colby_Dozier)\ **Replies:** 3\ **Last updated:** [January 27, 2021, 8:15pm UTC](https://discuss.elastic.co/t/exporting-importing-saved-objects-in-kibana-7-1/262410 "2021-01-27T20:15:59Z")
We are stuck with 7.1 being the newest version of Kibana we can use in our environment. I'm attempting to import multiple saved objects that was exported by hand in Kibana into a JSON file. This would be done during stan… --- ## [Composite aggs with an after key in a large index take forever](https://discuss.elastic.co/t/composite-aggs-with-an-after-key-in-a-large-index-take-forever/262412)
**Author:** [@benlin](https://discuss.elastic.co/u/benlin)\ **Replies:** 0\ **Last updated:** [January 27, 2021, 7:48pm UTC](https://discuss.elastic.co/t/composite-aggs-with-an-after-key-in-a-large-index-take-forever/262412 "2021-01-27T19:48:34Z")
I'm running into an issue where composite aggs with an after key seem to run forever on large indices (several 100m docs) when the same agg without an after key runs just fine. So this runs in seconds: { "size": 0, … --- ## [\_jsonparsefailure on reading json](https://discuss.elastic.co/t/jsonparsefailure-on-reading-json/262335)
**Author:** [@logstash123](https://discuss.elastic.co/u/logstash123)\ **Replies:** 2\ **Last updated:** [January 27, 2021, 7:03pm UTC](https://discuss.elastic.co/t/jsonparsefailure-on-reading-json/262335 "2021-01-27T19:03:45Z")
Dear community, I need to parse a JSON of the following format: { "commitId": "xxxxxxx", "author": { "name": "", "email": "", "date": "" }, "committer": { "name": "", "email": "", "date"… --- ## [How to configure ELK to receive logs from multiple servers](https://discuss.elastic.co/t/how-to-configure-elk-to-receive-logs-from-multiple-servers/262383)
**Author:** [@huzaifa224](https://discuss.elastic.co/u/huzaifa224)\ **Replies:** 3\ **Last updated:** [January 27, 2021, 7:01pm UTC](https://discuss.elastic.co/t/how-to-configure-elk-to-receive-logs-from-multiple-servers/262383 "2021-01-27T19:01:13Z")
I have multiple servers in which filebeat is installed and sending their logs to ELK. In kibana multiple server's logs are showing on single logs page which is every complicated to identify which log is coming from whic… --- ## [Throttle filter is not throttling correctly](https://discuss.elastic.co/t/throttle-filter-is-not-throttling-correctly/262402)
**Author:** [@holobolo0815](https://discuss.elastic.co/u/holobolo0815)\ **Replies:** 0\ **Last updated:** [January 27, 2021, 5:32pm UTC](https://discuss.elastic.co/t/throttle-filter-is-not-throttling-correctly/262402 "2021-01-27T17:32:07Z")
With reference to https://discuss.elastic.co/t/throttle-filter-notify-on-throttle/261861 When doing this: if \[srcip\] and \[dstip\] and \[dstport\] { throttle { # decorates event if OUTSIDE bounds key =\> "%{%filter\_ma… --- ## [Date Match is setting incorrect timestamp / not actually setting timestamp](https://discuss.elastic.co/t/date-match-is-setting-incorrect-timestamp-not-actually-setting-timestamp/262363)
**Author:** [@beirtipol](https://discuss.elastic.co/u/beirtipol)\ **Replies:** 5\ **Last updated:** [January 27, 2021, 5:57pm UTC](https://discuss.elastic.co/t/date-match-is-setting-incorrect-timestamp-not-actually-setting-timestamp/262363 "2021-01-27T17:57:24Z")
I have the following filter in my logstash pipeline: date { match =\> \[ "\[fields\]\[serverrequest\]\[starttime\]", "UNIX\_MS" \] tag\_on\_failure =\> \[ "serverrequest\_logstyle\_dateparsefailure" \] } However, th… --- ## [Issue with HTTP Poller : ConfigurationError: Invalid URL](https://discuss.elastic.co/t/issue-with-http-poller-configurationerror-invalid-url/262328)
**Author:** [@AmarKolhapuri](https://discuss.elastic.co/u/AmarKolhapuri)\ **Replies:** 2\ **Last updated:** [January 27, 2021, 5:51pm UTC](https://discuss.elastic.co/t/issue-with-http-poller-configurationerror-invalid-url/262328 "2021-01-27T17:51:52Z")
I am facing error with invalid URL for below http\_poller code. input { http\_poller{ urls =\> { test2 =\> { method =\> get user =\> "weblogic" password =\> "welcome1" urls =\> "http://weblogic:7001/management/wls/lates… --- ## [\[ Error parsing CSV \] : :exception=\>#\](https://discuss.elastic.co/t/error-parsing-csv-exception-csv-illegal-quoting-in-line-1/262370)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 2\ **Last updated:** [January 27, 2021, 4:55pm UTC](https://discuss.elastic.co/t/error-parsing-csv-exception-csv-illegal-quoting-in-line-1/262370 "2021-01-27T16:55:12Z")
Hello, I am trying to parse some csv logs using logstash and I am getting this error: \[WARN \] 2021-01-27 14:05:31.217 \[\[main\]\>worker2\] csv - Error parsing csv {:field=\>"message", :source=\>"\\"2020-12-24 00:01:23\\", \\"29… --- ## [Grok pattern to extract the fields from the log file](https://discuss.elastic.co/t/grok-pattern-to-extract-the-fields-from-the-log-file/262326)
**Author:** [@shiv97](https://discuss.elastic.co/u/shiv97)\ **Replies:** 1\ **Last updated:** [January 27, 2021, 4:54pm UTC](https://discuss.elastic.co/t/grok-pattern-to-extract-the-fields-from-the-log-file/262326 "2021-01-27T16:54:43Z")
Hi Everyone, I am having one log file and I need to parse the message field into multiple subfields for that I need grok parser please look at the log file below:- message:{"level":"info","ts":1611311978.7658348,"calle… --- ## [Array values into single field](https://discuss.elastic.co/t/array-values-into-single-field/262348)
**Author:** [@Stevek](https://discuss.elastic.co/u/Stevek)\ **Replies:** 1\ **Last updated:** [January 27, 2021, 4:50pm UTC](https://discuss.elastic.co/t/array-values-into-single-field/262348 "2021-01-27T16:50:36Z")
Hello, I struggle to extract IPs from JSON, I need to extract all IPs from array/s(regardless of count) into one field. Below the part of JSON I want to extract data from: "source": { "explicit": { … --- ## [Logstash writer permissions](https://discuss.elastic.co/t/logstash-writer-permissions/262397)
**Author:** [@iccMe](https://discuss.elastic.co/u/iccMe)\ **Replies:** 0\ **Last updated:** [January 27, 2021, 4:49pm UTC](https://discuss.elastic.co/t/logstash-writer-permissions/262397 "2021-01-27T16:49:23Z")
Hi, Looking for advice. I have created a new logstash writer user and created the appropriate role with permissions as per: https://www.elastic.co/guide/en/logstash/7.3/ls-security.html for a managed ILM index. The onl… --- ## [@timestamp not match with the log date](https://discuss.elastic.co/t/timestamp-not-match-with-the-log-date/262272)
**Author:** [@Riyanka](https://discuss.elastic.co/u/Riyanka)\ **Replies:** 3\ **Last updated:** [January 27, 2021, 4:46pm UTC](https://discuss.elastic.co/t/timestamp-not-match-with-the-log-date/262272 "2021-01-27T16:46:34Z")
The timestamp does not match with the actual log time in kibana @timestamp January 26th 2021, 23:38:10.426 message \[2021-01-22 09:53:09\] php.CRITICAL: Uncaught Error: Call to a member function getName() on null… --- ## [Convert string to number with decimal](https://discuss.elastic.co/t/convert-string-to-number-with-decimal/262163)
**Author:** [@jayv](https://discuss.elastic.co/u/jayv)\ **Replies:** 2\ **Last updated:** [January 27, 2021, 4:42pm UTC](https://discuss.elastic.co/t/convert-string-to-number-with-decimal/262163 "2021-01-27T16:42:26Z")
Hi there, can anyone help me mutate a string into a decimal-formatted number for geo-points? For example, I have a CSV with fields containing: -115168598 ....which needs to be: -115.168598 My first attempt just gave m… --- ## [Oracle to Elastic search date conversion #logstash](https://discuss.elastic.co/t/oracle-to-elastic-search-date-conversion-logstash/262368)
**Author:** [@onkarborade](https://discuss.elastic.co/u/onkarborade)\ **Replies:** 1\ **Last updated:** [January 27, 2021, 4:29pm UTC](https://discuss.elastic.co/t/oracle-to-elastic-search-date-conversion-logstash/262368 "2021-01-27T16:29:28Z")
Hi, Trying to insert records from Oracle db to Elastic search using logstash I am getting default date format of field from oracle database is 2021-01-27T12:39:01.867Z and I want to save a field in elastic search in … --- ## [Logstash randomly skipping files](https://discuss.elastic.co/t/logstash-randomly-skipping-files/262228)
**Author:** [@Rutger2000](https://discuss.elastic.co/u/Rutger2000)\ **Replies:** 3\ **Last updated:** [January 27, 2021, 4:25pm UTC](https://discuss.elastic.co/t/logstash-randomly-skipping-files/262228 "2021-01-27T16:25:38Z")
I'm using logstash to ingest data into Elasticsearch and view it in Kibana. Every hour I receive multiple files in a folder which then are processed by logstash. We notice that logstash sometimes skips a file, as far as … --- ## [Logstash JOSN parsing faile](https://discuss.elastic.co/t/logstash-josn-parsing-faile/262395)
**Author:** [@motyha](https://discuss.elastic.co/u/motyha)\ **Replies:** 0\ **Last updated:** [January 27, 2021, 4:15pm UTC](https://discuss.elastic.co/t/logstash-josn-parsing-faile/262395 "2021-01-27T16:15:24Z")
Hi i have some issue with JSON parsing that i create by Python the JSON file and CONF file uploaded the problem that the json file split the raws in the message {...} how do i make logstash parse the JSON that eve… --- ## [Upper limits on Filebeat harvesting](https://discuss.elastic.co/t/upper-limits-on-filebeat-harvesting/262389)
**Author:** [@beirtipol](https://discuss.elastic.co/u/beirtipol)\ **Replies:** 0\ **Last updated:** [January 27, 2021, 3:38pm UTC](https://discuss.elastic.co/t/upper-limits-on-filebeat-harvesting/262389 "2021-01-27T15:38:31Z")
I have a system which produces separate log files of all RMI calls and SQL executions. This is very useful for tracing of client requests. The loggers are set to roll the file every 10mb, which equals 36,000 lines on ave… --- ## [Filebeat ships only the first path mentioned from filebeat.yml](https://discuss.elastic.co/t/filebeat-ships-only-the-first-path-mentioned-from-filebeat-yml/262388)
**Author:** [@ranjini](https://discuss.elastic.co/u/ranjini)\ **Replies:** 0\ **Last updated:** [January 27, 2021, 3:35pm UTC](https://discuss.elastic.co/t/filebeat-ships-only-the-first-path-mentioned-from-filebeat-yml/262388 "2021-01-27T15:35:48Z")
Please find my filebeat conf. ################### Filebeat Configuration Example ################### # filebeat config for dco project # ############################# Filebeat ########… --- ## [ElasticSearch 6.8 Slow on Apple Silicon](https://discuss.elastic.co/t/elasticsearch-6-8-slow-on-apple-silicon/262379)
**Author:** [@gjaldon](https://discuss.elastic.co/u/gjaldon)\ **Replies:** 0\ **Last updated:** [January 27, 2021, 2:42pm UTC](https://discuss.elastic.co/t/elasticsearch-6-8-slow-on-apple-silicon/262379 "2021-01-27T14:42:49Z")
Hi everyone! I'm running ElasticSearch 6.8 on my Mac Air M1 which I downloaded from https://www.elastic.co/guide/en/elasticsearch/reference/6.8/zip-targz.html. I noticed that our test suite runs much slower on Elasticsea… --- ## [Fscrawler](https://discuss.elastic.co/t/fscrawler/260467)
**Author:** [@vikram\_singh](https://discuss.elastic.co/u/vikram_singh)\ **Replies:** 14\ **Last updated:** [January 27, 2021, 2:25pm UTC](https://discuss.elastic.co/t/fscrawler/260467 "2021-01-27T14:25:25Z")
Hi I am running elasticsearch cluster in docker. Setup fscrawler, but when I am running it is giving error We can not start Elasticsearch Client. Exiting. Here are complete error Recreating fscrawler ... done Attachin… --- ## [Boost throughput of Kafka input](https://discuss.elastic.co/t/boost-throughput-of-kafka-input/261958)
**Author:** [@YvorL](https://discuss.elastic.co/u/YvorL)\ **Replies:** 5\ **Last updated:** [January 27, 2021, 2:19pm UTC](https://discuss.elastic.co/t/boost-throughput-of-kafka-input/261958 "2021-01-27T14:19:38Z")
Hi, I've tried to look up every available documentation, example, blog post that's available on the net but I couldn't find anything useful on how to speed up ingesting from Kafka. Logstash barely uses any resources (10… --- ## [Logstash and Mysql logs](https://discuss.elastic.co/t/logstash-and-mysql-logs/262374)
**Author:** [@cwt](https://discuss.elastic.co/u/cwt)\ **Replies:** 0\ **Last updated:** [January 27, 2021, 2:04pm UTC](https://discuss.elastic.co/t/logstash-and-mysql-logs/262374 "2021-01-27T14:04:41Z")
Hi. I have a problem with a JSON logs from mysql servers. I send such logs to logstash but they don't get into elastic and give no error. If I change single quotes for 'alerts test' to double quotes "alerts test" everyth… --- ## [Deleting data deleted from the source in Elasticsearch](https://discuss.elastic.co/t/deleting-data-deleted-from-the-source-in-elasticsearch/262366)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 1\ **Last updated:** [January 27, 2021, 1:48pm UTC](https://discuss.elastic.co/t/deleting-data-deleted-from-the-source-in-elasticsearch/262366 "2021-01-27T13:48:32Z")
Hi guys, I transfer data between MSSQL and Elasticsearch using LogStash. I want the data deleted on the MSSQL side to be deleted in Elasticsearch. Is it possible? Please say if more details are required. --- ## [Logstash monitoring with metricbeat, where is Kibana viz?](https://discuss.elastic.co/t/logstash-monitoring-with-metricbeat-where-is-kibana-viz/262227)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 1\ **Last updated:** [January 27, 2021, 1:41pm UTC](https://discuss.elastic.co/t/logstash-monitoring-with-metricbeat-where-is-kibana-viz/262227 "2021-01-27T13:41:57Z")
I have setup metricbeat to monitor logstash and output data to elasticsearch. I can see the index: "monitoring-logstash-7-mb-2021.01.26" with data. On Kibana, when I click on "Stack monitoring", Kibana asks me to setup… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1583) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1585)