# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1734 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1735 --- ## [Parsing underscore](https://discuss.elastic.co/t/parsing-underscore/253104)
**Author:** [@rbeg](https://discuss.elastic.co/u/rbeg)\ **Replies:** 2\ **Last updated:** [October 23, 2020, 1:58pm UTC](https://discuss.elastic.co/t/parsing-underscore/253104 "2020-10-23T13:58:48Z")
Hello, Can you help me please? I need to parse this field in logstash filter : word1\_word2\_word3\_word4 And I want to put word3 into a new field named my\_field. How to do this please? I try with grok and regular exp… --- ## [JDBC\_static lookup timeout](https://discuss.elastic.co/t/jdbc-static-lookup-timeout/253134)
**Author:** [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\ **Replies:** 0\ **Last updated:** [October 23, 2020, 1:29pm UTC](https://discuss.elastic.co/t/jdbc-static-lookup-timeout/253134 "2020-10-23T13:29:13Z")
I'm running a static lookup to enhance my syslog data and I'm seeing this WARN in the log. Is there some configuration I can hit to help this timeout problem? \[2020-10-23T13:25:35,278\]\[WARN \]\[logstash.filters.jdbc.looku… --- ## [Filebeats live shipping of data?](https://discuss.elastic.co/t/filebeats-live-shipping-of-data/253103)
**Author:** [@juuuhuuu](https://discuss.elastic.co/u/juuuhuuu)\ **Replies:** 0\ **Last updated:** [October 23, 2020, 8:48am UTC](https://discuss.elastic.co/t/filebeats-live-shipping-of-data/253103 "2020-10-23T08:48:23Z")
Hi :slight\_smile: How can I create live shipping of data from filebeats to logstash ? Our Filebeats send data just after restart of docker container. A few minutes later well get this logs ,"filebeat":{"harvester":{"o… --- ## [Logstash Error after enabling xpack security](https://discuss.elastic.co/t/logstash-error-after-enabling-xpack-security/253123)
**Author:** [@Craig2188](https://discuss.elastic.co/u/Craig2188)\ **Replies:** 3\ **Last updated:** [October 23, 2020, 12:11pm UTC](https://discuss.elastic.co/t/logstash-error-after-enabling-xpack-security/253123 "2020-10-23T12:11:25Z")
Hi, I enabled xpack security on Elastic, then set the logstash account as per the below link: Add user information in Logstash | Elasticsearch Reference \[6.8\] | Elastic I used the keystore option. However I am getting… --- ## [Alerting if a beat is down](https://discuss.elastic.co/t/alerting-if-a-beat-is-down/252308)
**Author:** [@sfenman](https://discuss.elastic.co/u/sfenman)\ **Replies:** 3\ **Last updated:** [October 23, 2020, 6:26am UTC](https://discuss.elastic.co/t/alerting-if-a-beat-is-down/252308 "2020-10-23T06:26:04Z")
Hello, I have many beats running in different hosts. I need to monitor these agents so I' ve enabled the xpack.monitoring and now I can see event rate, fail rate, cpu util etc. in Kibana. Can I Somehow create alerts for… --- ## [Please help me to understand mapping templates](https://discuss.elastic.co/t/please-help-me-to-understand-mapping-templates/253027)
**Author:** [@Gosforth](https://discuss.elastic.co/u/Gosforth)\ **Replies:** 6\ **Last updated:** [October 23, 2020, 11:29am UTC](https://discuss.elastic.co/t/please-help-me-to-understand-mapping-templates/253027 "2020-10-23T11:29:43Z")
In documentation we have information that: "index templates are deprecated and will be replaced by the composable templates". But when we enter composable templates documentation we have statement: "You cannot dire… --- ## [Elasticsearch snapshots](https://discuss.elastic.co/t/elasticsearch-snapshots/253121)
**Author:** [@KA3AXCTAH](https://discuss.elastic.co/u/KA3AXCTAH)\ **Replies:** 1\ **Last updated:** [October 23, 2020, 11:24am UTC](https://discuss.elastic.co/t/elasticsearch-snapshots/253121 "2020-10-23T11:24:50Z")
I have many (10+) Elasticsearch clusters, and this clusters is use for different purposes (storing logs, storing some business and analytical data) So for example i have a 3-node elasticsearch cluster used for some busin… --- ## [Similarity scoring based on array length and matching terms](https://discuss.elastic.co/t/similarity-scoring-based-on-array-length-and-matching-terms/253116)
**Author:** [@KoPee](https://discuss.elastic.co/u/KoPee)\ **Replies:** 0\ **Last updated:** [October 23, 2020, 10:29am UTC](https://discuss.elastic.co/t/similarity-scoring-based-on-array-length-and-matching-terms/253116 "2020-10-23T10:29:52Z")
I need to end up with a score where doc 1 and doc 2 both score 100% while document 3 scores 50%. I'd like to score based on "Matching keywords" divided by length of keywords array. BM25 with a k1 and b of 0 comes clo… --- ## [Logstash results coming from behind](https://discuss.elastic.co/t/logstash-results-coming-from-behind/253115)
**Author:** [@bnmtl](https://discuss.elastic.co/u/bnmtl)\ **Replies:** 0\ **Last updated:** [October 23, 2020, 10:14am UTC](https://discuss.elastic.co/t/logstash-results-coming-from-behind/253115 "2020-10-23T10:14:19Z")
Hello, I have incremental json input in my logstash configuration, and using aggregation and some mutation in my filter and output is rabbit I see that logstash outputs are coming from behind about 2-3 hour. I mean tha… --- ## [Question about filtering in a visualisation in Kibana](https://discuss.elastic.co/t/question-about-filtering-in-a-visualisation-in-kibana/252652)
**Author:** [@blansdown](https://discuss.elastic.co/u/blansdown)\ **Replies:** 2\ **Last updated:** [October 23, 2020, 9:49am UTC](https://discuss.elastic.co/t/question-about-filtering-in-a-visualisation-in-kibana/252652 "2020-10-23T09:49:55Z")
Hi, New to Elastic/Kibana and have got a simple question about filtering in a visualisation in Kibana. I have some data stored in a rollup index, and when I visualise it, the y-axis displays 'count', and the buckets are… --- ## [Error on sudo systemctl enable --now elasticsearch](https://discuss.elastic.co/t/error-on-sudo-systemctl-enable-now-elasticsearch/252199)
**Author:** [@robin76](https://discuss.elastic.co/u/robin76)\ **Replies:** 3\ **Last updated:** [October 23, 2020, 9:30am UTC](https://discuss.elastic.co/t/error-on-sudo-systemctl-enable-now-elasticsearch/252199 "2020-10-23T09:30:02Z")
Hi, I am new here. I am trying to install elasticsearch on my Centos 7.8 to support Magento 2.4\] I followed all instruction but on enabling it with command sudo systemctl enable --now elasticsearch I have this error … --- ## [Filebeat netflow module inverting source and destination on host behind nat?](https://discuss.elastic.co/t/filebeat-netflow-module-inverting-source-and-destination-on-host-behind-nat/253023)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 1\ **Last updated:** [October 22, 2020, 9:11pm UTC](https://discuss.elastic.co/t/filebeat-netflow-module-inverting-source-and-destination-on-host-behind-nat/253023 "2020-10-22T21:11:26Z")
Hello, recently when I was working on a network problem I discovered the strange behavior of Kibana parsing the NetFlow docs. I was looking for a top communication on the network and I noticed communication between hos… --- ## [Winlogbeat missing mapping fields](https://discuss.elastic.co/t/winlogbeat-missing-mapping-fields/252846)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 18\ **Last updated:** [October 23, 2020, 9:03am UTC](https://discuss.elastic.co/t/winlogbeat-missing-mapping-fields/252846 "2020-10-23T09:03:44Z")
Hi, I have just installed Winlogbeat on one of my Windows 2019 terminal servers. After configurion the .yml file I have entered setup commands: winlogbeat.exe setup --index-management winlogbeat.exe setup --dahsboar… --- ## [Logstash can't reach elasticsearch](https://discuss.elastic.co/t/logstash-cant-reach-elasticsearch/253101)
**Author:** [@mw\_two](https://discuss.elastic.co/u/mw_two)\ **Replies:** 0\ **Last updated:** [October 23, 2020, 8:46am UTC](https://discuss.elastic.co/t/logstash-cant-reach-elasticsearch/253101 "2020-10-23T08:46:25Z")
Hello, we've following setup: 3x elasticsearch 2x logstash 2x kibana Since two weeks the second logstash-server cannot reach the elasticsearch servers. Following errors can be found in logs: \[2020-10-22T13:17:28,84… --- ## [Issue with highlighting a sentence in ElasticSearch cut off](https://discuss.elastic.co/t/issue-with-highlighting-a-sentence-in-elasticsearch-cut-off/253099)
**Author:** [@Deepukeloth](https://discuss.elastic.co/u/Deepukeloth)\ **Replies:** 0\ **Last updated:** [October 23, 2020, 8:31am UTC](https://discuss.elastic.co/t/issue-with-highlighting-a-sentence-in-elasticsearch-cut-off/253099 "2020-10-23T08:31:56Z")
Hi, I am facing an issue with highlighting of multi-synonym word in search response. Our ES version is 5.x .The issue is that if a synonym word is present at the beginning or at the end of the sentence, then part of th… --- ## [Change date format with in uptime graphs](https://discuss.elastic.co/t/change-date-format-with-in-uptime-graphs/252761)
**Author:** [@Aiders](https://discuss.elastic.co/u/Aiders)\ **Replies:** 6\ **Last updated:** [October 23, 2020, 8:02am UTC](https://discuss.elastic.co/t/change-date-format-with-in-uptime-graphs/252761 "2020-10-23T08:02:19Z")
Hi all, Question about uptime screen graphs within Elastic/Kibana 7.8.1 interface. The dates shown on the graphs are in MM-DD standard, is there a way to change to DD-MM? I have tried the usual setting timezone and tr… --- ## [What is excluded column in kibana index pattern?](https://discuss.elastic.co/t/what-is-excluded-column-in-kibana-index-pattern/252667)
**Author:** [@Matthew\_Field](https://discuss.elastic.co/u/Matthew_Field)\ **Replies:** 16\ **Last updated:** [October 23, 2020, 7:52am UTC](https://discuss.elastic.co/t/what-is-excluded-column-in-kibana-index-pattern/252667 "2020-10-23T07:52:45Z")
I am trying to create an index pattern in kibana and setting the time field to be @timestamp. The index pattern apparently creates OK with @timestamp as the time filter, but when i refresh the fields, the time filter ge… --- ## [Filebeat cannot parse a custom @timestamp string](https://discuss.elastic.co/t/filebeat-cannot-parse-a-custom-timestamp-string/252972)
**Author:** [@mattia\_galati](https://discuss.elastic.co/u/mattia_galati)\ **Replies:** 1\ **Last updated:** [October 23, 2020, 7:31am UTC](https://discuss.elastic.co/t/filebeat-cannot-parse-a-custom-timestamp-string/252972 "2020-10-23T07:31:03Z")
Hello everyone, I tryed to search in several topics but cannot manage to find a solution. I have a Python application that is writing logs and a Logstash process which is picking up that logs to send them to an Elastic… --- ## [Filebeat not reading .csv and .bad files from a particular location](https://discuss.elastic.co/t/filebeat-not-reading-csv-and-bad-files-from-a-particular-location/253091)
**Author:** [@Pavitra\_Poojary](https://discuss.elastic.co/u/Pavitra_Poojary)\ **Replies:** 0\ **Last updated:** [October 23, 2020, 7:19am UTC](https://discuss.elastic.co/t/filebeat-not-reading-csv-and-bad-files-from-a-particular-location/253091 "2020-10-23T07:19:11Z")
Hi , I am trying to read files from the below 2log paths. #=========================== Filebeat inputs ============================= filebeat.inputs: # Each - is an input. Most options can be set at the input level, … --- ## [How to optimize memory and heap usage for Single node Elastic Search](https://discuss.elastic.co/t/how-to-optimize-memory-and-heap-usage-for-single-node-elastic-search/252492)
**Author:** [@avadhut](https://discuss.elastic.co/u/avadhut)\ **Replies:** 6\ **Last updated:** [October 23, 2020, 6:32am UTC](https://discuss.elastic.co/t/how-to-optimize-memory-and-heap-usage-for-single-node-elastic-search/252492 "2020-10-23T06:32:07Z")
Hi everyone, I have set up a single node latest version elasticsearch cluster with Xpack and Kibana UI on the same VM. The VM has 23 GB RAM. I have provided 12 GB of JAVA heap space. But still, elastic search uses all o… --- ## [Heartbeat Crashed on using a third-party module across the month](https://discuss.elastic.co/t/heartbeat-crashed-on-using-a-third-party-module-across-the-month/252918)
**Author:** [@lowry](https://discuss.elastic.co/u/lowry)\ **Replies:** 2\ **Last updated:** [October 23, 2020, 6:07am UTC](https://discuss.elastic.co/t/heartbeat-crashed-on-using-a-third-party-module-across-the-month/252918 "2020-10-23T06:07:39Z")
Hello, Beats friends, We encountered an issue when we using Heartbeat in our environment. After some further digging, we believe it cased by using a third-party module -- https://github.com/gorhill/cronexpr without con… --- ## [Which class and functions in Java code to use for Aggregation queries using Low Level Rest Client for elastic](https://discuss.elastic.co/t/which-class-and-functions-in-java-code-to-use-for-aggregation-queries-using-low-level-rest-client-for-elastic/253037)
**Author:** [@daviddavid](https://discuss.elastic.co/u/daviddavid)\ **Replies:** 3\ **Last updated:** [October 23, 2020, 5:28am UTC](https://discuss.elastic.co/t/which-class-and-functions-in-java-code-to-use-for-aggregation-queries-using-low-level-rest-client-for-elastic/253037 "2020-10-23T05:28:08Z")
Which class and functions in Java code to use for Aggregation queries using Low Level Rest Client for elastic. Which Class to be used. AggregationBuilder class seems to be not present in older version like in High Level … --- ## [\[feature request\] Add URL Parse processors](https://discuss.elastic.co/t/feature-request-add-url-parse-processors/253084)
**Author:** [@OhBonsai](https://discuss.elastic.co/u/OhBonsai)\ **Replies:** 0\ **Last updated:** [October 23, 2020, 5:21am UTC](https://discuss.elastic.co/t/feature-request-add-url-parse-processors/253084 "2020-10-23T05:21:04Z")
Hi All: It's very common url format field in log. urldecode processor have been implements in libbeat. Add a net/url.Parse processor will be helpful :slight\_smile: I have already done this feature? May I open a Pull… --- ## [Does elasticsearch recommend to use any special character in user password for user](https://discuss.elastic.co/t/does-elasticsearch-recommend-to-use-any-special-character-in-user-password-for-user/252974)
**Author:** [@sreerama.naga](https://discuss.elastic.co/u/sreerama.naga)\ **Replies:** 3\ **Last updated:** [October 23, 2020, 4:23am UTC](https://discuss.elastic.co/t/does-elasticsearch-recommend-to-use-any-special-character-in-user-password-for-user/252974 "2020-10-23T04:23:59Z")
Hi, Here I am trying to get the details, does elasticsearch recommend to use any special character for user password? I tried doing some search in those lines but didn't succeed in getting any proper pages with recommen… --- ## [Searching with special characters](https://discuss.elastic.co/t/searching-with-special-characters/253083)
**Author:** [@Alex\_Pravdin](https://discuss.elastic.co/u/Alex_Pravdin)\ **Replies:** 0\ **Last updated:** [October 23, 2020, 4:08am UTC](https://discuss.elastic.co/t/searching-with-special-characters/253083 "2020-10-23T04:08:53Z")
I'm trying to make an autocomplete search that will account for special characters and add weights to the results which match a query with these characters. Index: { "institution\_test":{ "settings":{ … --- ## [Can not add mapping](https://discuss.elastic.co/t/can-not-add-mapping/252979)
**Author:** [@Alex\_Pravdin](https://discuss.elastic.co/u/Alex_Pravdin)\ **Replies:** 1\ **Last updated:** [October 23, 2020, 2:46am UTC](https://discuss.elastic.co/t/can-not-add-mapping/252979 "2020-10-23T02:46:46Z")
I'm using Elasticsearch 5.6 (I know it's outdated but I can not switch it right now). I'm doing the following request: { "settings":{ "index":{ "analysis":{ "filter":{ … --- ## [Difference between PluginCLI and PluginManager used in Plugin.bat](https://discuss.elastic.co/t/difference-between-plugincli-and-pluginmanager-used-in-plugin-bat/253080)
**Author:** [@Varsha\_Muzumdar](https://discuss.elastic.co/u/Varsha_Muzumdar)\ **Replies:** 0\ **Last updated:** [October 23, 2020, 2:16am UTC](https://discuss.elastic.co/t/difference-between-plugincli-and-pluginmanager-used-in-plugin-bat/253080 "2020-10-23T02:16:57Z")
I am new to ES community and I have been using ES on Windows. I see that some distributions of ElasticSearch plugin.bat reference org.elasticsearch.plugins.PluginManager whereas some others reference org.elasticsearch.pl… --- ## [Filebeat collect log and output to es but occur time parse error](https://discuss.elastic.co/t/filebeat-collect-log-and-output-to-es-but-occur-time-parse-error/252820)
**Author:** [@lucasyu](https://discuss.elastic.co/u/lucasyu)\ **Replies:** 6\ **Last updated:** [October 23, 2020, 1:38am UTC](https://discuss.elastic.co/t/filebeat-collect-log-and-output-to-es-but-occur-time-parse-error/252820 "2020-10-23T01:38:14Z")
Dear all I use filebeat to collect log and parse to json output to es but the "timestamp" field can not parse the value of timestamp is "2020-10-21 17:10:51.963" error description is "failed to parse date field \[202… --- ## [Memory -Xmx and -Xms "should" be the same... how severely "should" we heed this recommendation?](https://discuss.elastic.co/t/memory-xmx-and-xms-should-be-the-same-how-severely-should-we-heed-this-recommendation/252737)
**Author:** [@cjcjameson](https://discuss.elastic.co/u/cjcjameson)\ **Replies:** 2\ **Last updated:** [October 23, 2020, 12:33am UTC](https://discuss.elastic.co/t/memory-xmx-and-xms-should-be-the-same-how-severely-should-we-heed-this-recommendation/252737 "2020-10-23T00:33:35Z")
https://github.com/elastic/elasticsearch/blob/master/docs/reference/setup/important-settings/heap-size.asciidoc#heap-size-settings mentions: Elasticsearch will assign the entire heap specified in jvm.options via the Xms… --- ## [Logstash generating two indices with the same content](https://discuss.elastic.co/t/logstash-generating-two-indices-with-the-same-content/253072)
**Author:** [@CezarOliveira](https://discuss.elastic.co/u/CezarOliveira)\ **Replies:** 0\ **Last updated:** [October 22, 2020, 11:40pm UTC](https://discuss.elastic.co/t/logstash-generating-two-indices-with-the-same-content/253072 "2020-10-22T23:40:30Z")
I have Elasticsearch, Logstash and Kibana running on Docker. First I run Elasticsearch and Kibana and confirm that no exists index. docker-compose-elastic-kibana.ymlversion: '3' services: elasticsearch: i… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1733) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1735)