# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1670 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1671 --- ## [How to get data from large JDBC quires?](https://discuss.elastic.co/t/how-to-get-data-from-large-jdbc-quires/254647)
**Author:** [@I\_Hathout](https://discuss.elastic.co/u/I_Hathout)\ **Replies:** 12\ **Last updated:** [November 30, 2020, 6:04pm UTC](https://discuss.elastic.co/t/how-to-get-data-from-large-jdbc-quires/254647 "2020-11-30T18:04:05Z")
Hello, I am trying to get data from a postgres database using JDBC. I managed to get data to stdout by using only 3 fields, but it fails because of the large number of fields in the query. here is the output from runni… --- ## [Dealing with "tags" =\> \[ \[0\] "multiline" \] in xml filter for logstash](https://discuss.elastic.co/t/dealing-with-tags-0-multiline-in-xml-filter-for-logstash/257094)
**Author:** [@amol\_p81](https://discuss.elastic.co/u/amol_p81)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 5:19pm UTC](https://discuss.elastic.co/t/dealing-with-tags-0-multiline-in-xml-filter-for-logstash/257094 "2020-11-30T17:19:22Z")
Hi, I have setup xml filter for logstash (in config file) however how can i avoid below from getting displayed: "tags" =\> \[ \[0\] "multiline" \] Regards Amol --- ## [Logstash aggregate without unique id](https://discuss.elastic.co/t/logstash-aggregate-without-unique-id/257068)
**Author:** [@bbwolf](https://discuss.elastic.co/u/bbwolf)\ **Replies:** 5\ **Last updated:** [November 30, 2020, 5:06pm UTC](https://discuss.elastic.co/t/logstash-aggregate-without-unique-id/257068 "2020-11-30T17:06:17Z")
Hello, supposed il have current log INFO - 12345 - TASK\_START - start INFO - 12345 - SQL - sqlQuery1 - 12 INFO - 12345 - SQL - sqlQuery2 - 34 INFO - 12345 - TASK\_END - end INFO - 12345 - TASK\_START - start INFO - … --- ## [Locating rogue clients with authentication errors](https://discuss.elastic.co/t/locating-rogue-clients-with-authentication-errors/257102)
**Author:** [@franco-martin](https://discuss.elastic.co/u/franco-martin)\ **Replies:** 0\ **Last updated:** [November 30, 2020, 4:51pm UTC](https://discuss.elastic.co/t/locating-rogue-clients-with-authentication-errors/257102 "2020-11-30T16:51:07Z")
Im using filebeat to export elasticsearch logs to well... elasticsearch. I get the authentication errors but not where they come from. I tried changing the log level to TRACE for the rest package but no luck. Is there a… --- ## [Parse logstash - rfc5424](https://discuss.elastic.co/t/parse-logstash-rfc5424/256992)
**Author:** [@Paulogbr](https://discuss.elastic.co/u/Paulogbr)\ **Replies:** 3\ **Last updated:** [November 30, 2020, 4:35pm UTC](https://discuss.elastic.co/t/parse-logstash-rfc5424/256992 "2020-11-30T16:35:25Z")
Hello guys, I need help to parse the syslog RFC 5424 with logstash. \<190\> 1 2020-11-28T14:18:03-02:00 workstantion1030.teste.corp WSEE - - \[message@01-\] @cee:{"type":"1","timestamp":"4698753981054","host\_name":"","user\_… --- ## [How to get MappingMetadata per type using Rest High Level Client?](https://discuss.elastic.co/t/how-to-get-mappingmetadata-per-type-using-rest-high-level-client/257082)
**Author:** [@amishar](https://discuss.elastic.co/u/amishar)\ **Replies:** 3\ **Last updated:** [November 30, 2020, 3:31pm UTC](https://discuss.elastic.co/t/how-to-get-mappingmetadata-per-type-using-rest-high-level-client/257082 "2020-11-30T15:31:47Z")
We are migrating from Transport Client to High Level Rest Client. We have a piece of code that get indices, mappings and settings using GetIndex call. For transport client, we use this code to obtain the index informati… --- ## [Logstash log unable to complete log read and throws error](https://discuss.elastic.co/t/logstash-log-unable-to-complete-log-read-and-throws-error/256945)
**Author:** [@msk\_76](https://discuss.elastic.co/u/msk_76)\ **Replies:** 4\ **Last updated:** [November 30, 2020, 3:12pm UTC](https://discuss.elastic.co/t/logstash-log-unable-to-complete-log-read-and-throws-error/256945 "2020-11-30T15:12:41Z")
I have setup logstash to read log files generated by another application realtime. The input config is like this. it is throwing the below error in logstash log. I am unable to track if it has been able to read the finis… --- ## [ML Datafeed lookback retrieved no data](https://discuss.elastic.co/t/ml-datafeed-lookback-retrieved-no-data/256864)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 5\ **Last updated:** [November 30, 2020, 2:40pm UTC](https://discuss.elastic.co/t/ml-datafeed-lookback-retrieved-no-data/256864 "2020-11-30T14:40:15Z")
Hello, I am trying to run the job "windows\_rare\_user\_type10\_remote\_login" in my cluster and It process no data, and I am getting ML Datafeed lookback retrieved no data Knowing that I already installed winlogbeat in s… --- ## [Slowness in ES bulk inserts](https://discuss.elastic.co/t/slowness-in-es-bulk-inserts/256886)
**Author:** [@Chirag\_Patwa](https://discuss.elastic.co/u/Chirag_Patwa)\ **Replies:** 10\ **Last updated:** [November 30, 2020, 2:32pm UTC](https://discuss.elastic.co/t/slowness-in-es-bulk-inserts/256886 "2020-11-30T14:32:50Z")
We are running behind the schedule to achieve something and we need help. Please take a look and suggest something. Issue: Slowness on bulk Indexing. For 10000 records its taking 27560 ms For 500 records its taking ab… --- ## [Elasticsearch Shards problem](https://discuss.elastic.co/t/elasticsearch-shards-problem/256998)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 0\ **Last updated:** [November 29, 2020, 5:48pm UTC](https://discuss.elastic.co/t/elasticsearch-shards-problem/256998 "2020-11-29T17:48:55Z")
I have set-up elasticsearch 8 node cluster 3 master 3 data(500gb total 1.5 tb) +2 coordinate nodes each node have 16gb ram and 4 CPUs and it uses only 2 cpu. In client side we have packbeat and winlogbeat pointing to ka… --- ## [ElasticSearch - Sort by another field which is not mentioned in field section aggregation query](https://discuss.elastic.co/t/elasticsearch-sort-by-another-field-which-is-not-mentioned-in-field-section-aggregation-query/257080)
**Author:** [@Mamta\_Shettigar](https://discuss.elastic.co/u/Mamta_Shettigar)\ **Replies:** 0\ **Last updated:** [November 30, 2020, 2:27pm UTC](https://discuss.elastic.co/t/elasticsearch-sort-by-another-field-which-is-not-mentioned-in-field-section-aggregation-query/257080 "2020-11-30T14:27:12Z")
I want to perform aggregation on a certain results and then sort it. While aggregation query works fine. We want to sort the results based on another parameter and not the aggregated field. Say for example I want to aggr… --- ## [ILM policy to transform index](https://discuss.elastic.co/t/ilm-policy-to-transform-index/256974)
**Author:** [@fadjar340](https://discuss.elastic.co/u/fadjar340)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 2:10pm UTC](https://discuss.elastic.co/t/ilm-policy-to-transform-index/256974 "2020-11-30T14:10:39Z")
Is it possible to use ILM policy to the transform index result? I tried to the transform index and added alias into it, but the ILM not works as expected for transform indices. Is there any workaround to do this? Rega… --- ## [Categorizing similar values](https://discuss.elastic.co/t/categorizing-similar-values/257071)
**Author:** [@OmarDacca](https://discuss.elastic.co/u/OmarDacca)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 2:04pm UTC](https://discuss.elastic.co/t/categorizing-similar-values/257071 "2020-11-30T14:04:21Z")
Hi, Is there a way to categorize similar values of specific field, during the query time ? for example, suppose I have these documents: {..., message: "this is message no 1",...} {..., message: "this is message no 2"… --- ## [Http 400 query crashes elastic search cluster](https://discuss.elastic.co/t/http-400-query-crashes-elastic-search-cluster/256228)
**Author:** [@sebastienf](https://discuss.elastic.co/u/sebastienf)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 1:54pm UTC](https://discuss.elastic.co/t/http-400-query-crashes-elastic-search-cluster/256228 "2020-11-30T13:54:37Z")
on a 5.6 ES cluster that i don't administrate, i noticed, when a query gives an error HTTP 400 such as {"error":{"root\_cause":\[{"type":"action\_request\_validation\_exception","reason":"Validation Failed: 1: template is mi… --- ## [Help parse Snort IDS Alert](https://discuss.elastic.co/t/help-parse-snort-ids-alert/256991)
**Author:** [@coolkaveh](https://discuss.elastic.co/u/coolkaveh)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 1:30pm UTC](https://discuss.elastic.co/t/help-parse-snort-ids-alert/256991 "2020-11-30T13:30:27Z")
Please help me to correct my Logstash conf as below: Log: 11/28-06:50:39.263833 \[\*\*\] \[1:31978:5\] OS-OTHER Bash CGI environment variable injection attempt \[\*\*\] \[Classification: Attempted Administrator Privilege Gain\] \[… --- ## [Eliminate Failure that Later Converted in Success in Dashboard](https://discuss.elastic.co/t/eliminate-failure-that-later-converted-in-success-in-dashboard/257051)
**Author:** [@Vaishali19](https://discuss.elastic.co/u/Vaishali19)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 1:24pm UTC](https://discuss.elastic.co/t/eliminate-failure-that-later-converted-in-success-in-dashboard/257051 "2020-11-30T13:24:55Z")
Hi All, I have a requirement to create a dashboard in kibana for SuccessVsFailure for institutions. The single user is identified by token and I want to eliminate failures which later converted into Success on retry. Ho… --- ## [Elasticsearch single node "cluster" fails with "incoming term X does not match current term Y"](https://discuss.elastic.co/t/elasticsearch-single-node-cluster-fails-with-incoming-term-x-does-not-match-current-term-y/256857)
**Author:** [@tobal](https://discuss.elastic.co/u/tobal)\ **Replies:** 6\ **Last updated:** [November 30, 2020, 1:22pm UTC](https://discuss.elastic.co/t/elasticsearch-single-node-cluster-fails-with-incoming-term-x-does-not-match-current-term-y/256857 "2020-11-30T13:22:58Z")
Hi there, We have a recurring error in our test environment, where elasticsearch fails to boot up. We have logs from two occurrence, but sadly we can't reproduce the error consistently to help determine what the problem… --- ## [Elasticesearch 7.6.2 translog overflow issue](https://discuss.elastic.co/t/elasticesearch-7-6-2-translog-overflow-issue/256776)
**Author:** [@rambling](https://discuss.elastic.co/u/rambling)\ **Replies:** 9\ **Last updated:** [November 30, 2020, 1:08pm UTC](https://discuss.elastic.co/t/elasticesearch-7-6-2-translog-overflow-issue/256776 "2020-11-30T13:08:58Z")
Hi, recently I caught very strange behavior of translog in my cluster: I noticed that one node was executing task for 3 days like: "node" : "PAHpy641TPqLYhPOKPnAvQ", "id" : 1336600606, "type" : "trans… --- ## [Taking several snapshots in parallell](https://discuss.elastic.co/t/taking-several-snapshots-in-parallell/257054)
**Author:** [@johanhaugland](https://discuss.elastic.co/u/johanhaugland)\ **Replies:** 3\ **Last updated:** [November 30, 2020, 1:07pm UTC](https://discuss.elastic.co/t/taking-several-snapshots-in-parallell/257054 "2020-11-30T13:07:51Z")
As discussed in https://github.com/elastic/elasticsearch/issues/27353 it is desirable to either queue snapshots, or even better, take several snapshots in parallell. I have not been able to find documentation on how thi… --- ## [Clearing selection for dropdowncontrol in Canvas](https://discuss.elastic.co/t/clearing-selection-for-dropdowncontrol-in-canvas/256405)
**Author:** [@shaigbdb](https://discuss.elastic.co/u/shaigbdb)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 12:57pm UTC](https://discuss.elastic.co/t/clearing-selection-for-dropdowncontrol-in-canvas/256405 "2020-11-30T12:57:36Z")
I have a dropdowncontrol A, and then a dropdowncontrol B. A filters B, which works fine. But once I make a choice in B, changing the choice in A doesn't remove the choice in B: it just adds up to it, causing B to show n… --- ## [Kibana Maintainance notification](https://discuss.elastic.co/t/kibana-maintainance-notification/256988)
**Author:** [@PraveenKT](https://discuss.elastic.co/u/PraveenKT)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 12:52pm UTC](https://discuss.elastic.co/t/kibana-maintainance-notification/256988 "2020-11-30T12:52:30Z")
How do I get Maintainance notification on kibana GUI ? --- ## [Having an issue enabling proper multiline options for container logs](https://discuss.elastic.co/t/having-an-issue-enabling-proper-multiline-options-for-container-logs/256916)
**Author:** [@sloney](https://discuss.elastic.co/u/sloney)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 12:36pm UTC](https://discuss.elastic.co/t/having-an-issue-enabling-proper-multiline-options-for-container-logs/256916 "2020-11-30T12:36:06Z")
Currently have these settings enabled, hoping to make all logs that start with a date like: 2020-11-27 to be in their own entry, including java stack traces. multiline.type: pattern multiline.pattern: '^\[0-9\]{4}-\[0-9\]{… --- ## [Error trying to setup filebeat](https://discuss.elastic.co/t/error-trying-to-setup-filebeat/257011)
**Author:** [@ffknob](https://discuss.elastic.co/u/ffknob)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 12:26pm UTC](https://discuss.elastic.co/t/error-trying-to-setup-filebeat/257011 "2020-11-30T12:26:26Z")
i'm geting this error trying to setup Filebeat 7.10 on a 7.10 Elasticsearch cluster: ➜ filebeat ./filebeat setup Overwriting ILM policy is disabled. Set \`setup.ilm.overwrite: true… --- ## [Watcher Alerting on multi-bucket anomaly?](https://discuss.elastic.co/t/watcher-alerting-on-multi-bucket-anomaly/256911)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 12:11pm UTC](https://discuss.elastic.co/t/watcher-alerting-on-multi-bucket-anomaly/256911 "2020-11-30T12:11:52Z")
Its posible to alert only on multi-bucket anomalies? can you direct me to some examples please? thanks --- ## [Elastic 7.9.2 / kibana 7.9.2 pie chart, json filter pb refresh display](https://discuss.elastic.co/t/elastic-7-9-2-kibana-7-9-2-pie-chart-json-filter-pb-refresh-display/256865)
**Author:** [@Corben\_Dallas](https://discuss.elastic.co/u/Corben_Dallas)\ **Replies:** 4\ **Last updated:** [November 30, 2020, 11:19am UTC](https://discuss.elastic.co/t/elastic-7-9-2-kibana-7-9-2-pie-chart-json-filter-pb-refresh-display/256865 "2020-11-30T11:19:43Z")
Hello, i work on migration dashboard, vizualisation, queries, kibana 4.5.2 to 7.9.2 I created simple pie chart 7.9.2, with filter with kql, working fine, result is ok. i create new pie chart 7.9.2, same approach at … --- ## [After applied the tutorial "Getting start with Elasticsearch security" Logstash receive Syslog data but Kibana can’t show it](https://discuss.elastic.co/t/after-applied-the-tutorial-getting-start-with-elasticsearch-security-logstash-receive-syslog-data-but-kibana-can-t-show-it/256666)
**Author:** [@Thelmo\_Henrique\_Sant](https://discuss.elastic.co/u/Thelmo_Henrique_Sant)\ **Replies:** 3\ **Last updated:** [November 30, 2020, 11:42am UTC](https://discuss.elastic.co/t/after-applied-the-tutorial-getting-start-with-elasticsearch-security-logstash-receive-syslog-data-but-kibana-can-t-show-it/256666 "2020-11-30T11:42:09Z")
Hi buddies! I getting a problem after applying "Getting start with Elasticsearch security" to my environment. I followed this entire procedure: And everything works fine. Elasticsearch protected with user and passwo… --- ## [Elasticsearch perform slow process intermittently](https://discuss.elastic.co/t/elasticsearch-perform-slow-process-intermittently/255510)
**Author:** [@fardhana](https://discuss.elastic.co/u/fardhana)\ **Replies:** 12\ **Last updated:** [November 30, 2020, 10:59am UTC](https://discuss.elastic.co/t/elasticsearch-perform-slow-process-intermittently/255510 "2020-11-30T10:59:48Z")
Hi, i have nodejs consumer using rabbitmq that doing one of this two thing. simple Indexing into elasticsearch using predifined \_id (using INDEX API) search using specific id then if the doc exists it will running upda… --- ## [Kibana scripted field error tells me I dont have any values in field while they do show up in discovery](https://discuss.elastic.co/t/kibana-scripted-field-error-tells-me-i-dont-have-any-values-in-field-while-they-do-show-up-in-discovery/256851)
**Author:** [@skibana](https://discuss.elastic.co/u/skibana)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 10:40am UTC](https://discuss.elastic.co/t/kibana-scripted-field-error-tells-me-i-dont-have-any-values-in-field-while-they-do-show-up-in-discovery/256851 "2020-11-30T10:40:29Z")
I've been trying to create a scripted field in which i want to make a URL which directs me to a specific APM timeline page. The values I want to add to this URL are filters which are needed to select te specific transact… --- ## [Unable to login to kibana](https://discuss.elastic.co/t/unable-to-login-to-kibana/256758)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 3\ **Last updated:** [November 30, 2020, 10:35am UTC](https://discuss.elastic.co/t/unable-to-login-to-kibana/256758 "2020-11-30T10:35:11Z")
Hi Team, I am unable to login to kibana dashboard. We have kibana url as \`\`. It's only accessible from intranet. We have haproxy where request first goes and from there it goes to kibana server on 8601. # Ansible man… --- ## [Kibana defualt indexes usage](https://discuss.elastic.co/t/kibana-defualt-indexes-usage/256985)
**Author:** [@azxqw](https://discuss.elastic.co/u/azxqw)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 10:26am UTC](https://discuss.elastic.co/t/kibana-defualt-indexes-usage/256985 "2020-11-30T10:26:48Z")
Hi, How do I determine which of my .Kibana indexes are being used by the stack? i have quite a few of those indexes, some of which are probably not benig used and are interfering with my logstash and elasticsearch upda… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1669) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1671)