# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1741 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1742 --- ## [Configuring Logstash to index nested xml data](https://discuss.elastic.co/t/configuring-logstash-to-index-nested-xml-data/252692)
**Author:** [@andrew.laraia](https://discuss.elastic.co/u/andrew.laraia)\ **Replies:** 1\ **Last updated:** [October 20, 2020, 1:55pm UTC](https://discuss.elastic.co/t/configuring-logstash-to-index-nested-xml-data/252692 "2020-10-20T13:55:36Z")
With Logstash, is there a way to index nested serialized XML using the XML plugin? Can you provide an example? We have some data that we migrate from an existing SQL database via Logstash. These records have a handful o… --- ## [Calculate filtered document's size](https://discuss.elastic.co/t/calculate-filtered-documents-size/251969)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 2\ **Last updated:** [October 20, 2020, 1:52pm UTC](https://discuss.elastic.co/t/calculate-filtered-documents-size/251969 "2020-10-20T13:52:11Z")
Hi all, Is there a way to calculate the amount of filtered documents size inside a specific index? I mean, in a daily log index I would like to know the index total size is divided. --- ## [How to remove duplicate search result in elasticsearch?](https://discuss.elastic.co/t/how-to-remove-duplicate-search-result-in-elasticsearch/252319)
**Author:** [@yen\_l\_ng\_th](https://discuss.elastic.co/u/yen_l_ng_th)\ **Replies:** 4\ **Last updated:** [October 20, 2020, 1:49pm UTC](https://discuss.elastic.co/t/how-to-remove-duplicate-search-result-in-elasticsearch/252319 "2020-10-20T13:49:37Z")
I use a paginated search by elasticseach. But the items are duplicated between pages. It is at the bottom of this page and at the top of the other page. I did like this but it still doesn't work $aggregations = \[ "uni… --- ## [Email alert per sourceip](https://discuss.elastic.co/t/email-alert-per-sourceip/251864)
**Author:** [@ianvera](https://discuss.elastic.co/u/ianvera)\ **Replies:** 5\ **Last updated:** [October 20, 2020, 1:42pm UTC](https://discuss.elastic.co/t/email-alert-per-sourceip/251864 "2020-10-20T13:42:40Z")
we created one watcher having multiple sourceip so that whenever the watcher matches the messages it will send email alert. Will it be possible that the watcher having multiple sourceip will send multiple email alerts b… --- ## [Logstash](https://discuss.elastic.co/t/logstash/252689)
**Author:** [@Syed.Ubaid](https://discuss.elastic.co/u/Syed.Ubaid)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 1:24pm UTC](https://discuss.elastic.co/t/logstash/252689 "2020-10-20T13:24:56Z")
After installing xpack logstash is giving error my configuration file is input { file { path =\> "D:/csv/countriesdata.csv" start\_position =\> "beginning" sincedb\_path =\> "NUL" } } filter { csv { separator =\> ",… --- ## [Parsing syslogs using Grok](https://discuss.elastic.co/t/parsing-syslogs-using-grok/252673)
**Author:** [@pacy1](https://discuss.elastic.co/u/pacy1)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 11:59am UTC](https://discuss.elastic.co/t/parsing-syslogs-using-grok/252673 "2020-10-20T11:59:57Z")
Hi All, Hope you are good!! I need your help on how syslog configuration with the following raw event that is unstructured, how to parsing using grok filter: 2020-10-05T00:00:00+02:00 x.x.x.x 3 0 1 1 229eb9 1020 20201… --- ## [IOPS and elasticsearch](https://discuss.elastic.co/t/iops-and-elasticsearch/251576)
**Author:** [@Juicy45](https://discuss.elastic.co/u/Juicy45)\ **Replies:** 4\ **Last updated:** [October 20, 2020, 1:09pm UTC](https://discuss.elastic.co/t/iops-and-elasticsearch/251576 "2020-10-20T13:09:35Z")
Hi, I have an Elasticsearch cluster that needs to ingest 2000 EPS. What is the minimum amount of IOPS do I need on a virtual machine ? Thank you for your answer. --- ## [Separated filesystems for data and logs?](https://discuss.elastic.co/t/separated-filesystems-for-data-and-logs/252686)
**Author:** [@ffknob](https://discuss.elastic.co/u/ffknob)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 12:56pm UTC](https://discuss.elastic.co/t/separated-filesystems-for-data-and-logs/252686 "2020-10-20T12:56:29Z")
Hi, I'd like to know your thoughts on the best/recommended approach to organize the filesystem of a VM that will run an Elasticsearch instance. How should I separate things in such a way for the service to have some de… --- ## [Need help with a 2XX HTTP code 400 Error](https://discuss.elastic.co/t/need-help-with-a-2xx-http-code-400-error/252682)
**Author:** [@Ratch54](https://discuss.elastic.co/u/Ratch54)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 12:46pm UTC](https://discuss.elastic.co/t/need-help-with-a-2xx-http-code-400-error/252682 "2020-10-20T12:46:31Z")
I am receiving the \[ERROR\]\[logstash.outputs.http\]\[HTTP Output Failure\] Encountered non-2XX HTTP code 400 {:response\_code=\>400, :url"https://some url:8086/write?db=db", :event=\>%{host} %{message}, will\_retry=\>false The c… --- ## [How to extract data from Json](https://discuss.elastic.co/t/how-to-extract-data-from-json/252595)
**Author:** [@rildo](https://discuss.elastic.co/u/rildo)\ **Replies:** 4\ **Last updated:** [October 20, 2020, 12:25pm UTC](https://discuss.elastic.co/t/how-to-extract-data-from-json/252595 "2020-10-20T12:25:36Z")
input { stdin { } } output { stdout { codec =\> rubydebug } } filter { json { source =\> "message" } mutate { gsub =\> \[ "message" , "\\n", "," \] } mutate { gsub =\> \[ "message" , "\[\\\]", "" \] gsub =\> \[ "other\_… --- ## [How to get all worlds which goes after "search word"](https://discuss.elastic.co/t/how-to-get-all-worlds-which-goes-after-search-word/252579)
**Author:** [@tfe2012](https://discuss.elastic.co/u/tfe2012)\ **Replies:** 4\ **Last updated:** [October 20, 2020, 12:16pm UTC](https://discuss.elastic.co/t/how-to-get-all-worlds-which-goes-after-search-word/252579 "2020-10-20T12:16:12Z")
Hi, for example, I have three documents like: { "description": "Small red fox" } { "description": "I see blue fox" } { "description": "I see small orange fox" } Is it possible to get all words which go after word… --- ## [Security Plugin](https://discuss.elastic.co/t/security-plugin/252671)
**Author:** [@Syed.Ubaid](https://discuss.elastic.co/u/Syed.Ubaid)\ **Replies:** 2\ **Last updated:** [October 20, 2020, 11:59am UTC](https://discuss.elastic.co/t/security-plugin/252671 "2020-10-20T11:59:49Z")
Hello. I am installing security plugin on windows using this link https://opendistro.github.io/for-elasticsearch-docs/docs/install/plugins/ i have installed the plugin on both elasticsearch and kibana on windows enviorm… --- ## [Field \_source added to mapping automatically is shown in Discovery as empty](https://discuss.elastic.co/t/field-source-added-to-mapping-automatically-is-shown-in-discovery-as-empty/252324)
**Author:** [@Rudolf\_Reddy\_Macejka](https://discuss.elastic.co/u/Rudolf_Reddy_Macejka)\ **Replies:** 3\ **Last updated:** [October 20, 2020, 11:56am UTC](https://discuss.elastic.co/t/field-source-added-to-mapping-automatically-is-shown-in-discovery-as-empty/252324 "2020-10-20T11:56:06Z")
Hello, I have a mapping which is "dynamic": false. By POST first message, there was automatically added few fields which i didn't defined. I understood that it is mandatory to have there: \_id | string \_index | stri… --- ## [JMX Input Plugin - Error in connecting to Weblogic JMX](https://discuss.elastic.co/t/jmx-input-plugin-error-in-connecting-to-weblogic-jmx/252670)
**Author:** [@abidub](https://discuss.elastic.co/u/abidub)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 11:30am UTC](https://discuss.elastic.co/t/jmx-input-plugin-error-in-connecting-to-weblogic-jmx/252670 "2020-10-20T11:30:20Z")
Hi there, I am using the JMX Input Plugin and trying to connect to a Weblogic JMX service URL and getting the following error: \[ERROR\]\[logstash.inputs.jmx\] "failed to retrieve RMIServe stub: javax.naming.NoInitialConte… --- ## [Can Logstash implement a data flow from Elastic to other database?](https://discuss.elastic.co/t/can-logstash-implement-a-data-flow-from-elastic-to-other-database/252672)
**Author:** [@Fernando1](https://discuss.elastic.co/u/Fernando1)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 11:45am UTC](https://discuss.elastic.co/t/can-logstash-implement-a-data-flow-from-elastic-to-other-database/252672 "2020-10-20T11:45:33Z")
Hello!! How are you? Can Logstash implement a reverse flow? Like instead of pulling data from, for example, PostgreSQL into Elasticsearch, do the contrary? Like pulling from Elasticsearch into PostgreSQL? Best Wishes, … --- ## [Bad cluster name - change on the fly possible?](https://discuss.elastic.co/t/bad-cluster-name-change-on-the-fly-possible/252475)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 2\ **Last updated:** [October 20, 2020, 11:45am UTC](https://discuss.elastic.co/t/bad-cluster-name-change-on-the-fly-possible/252475 "2020-10-20T11:45:09Z")
Hi there, I have a cluster name defined in the elasticsearch.ym defined as follows cluster.name: CLUSTERNAME" resulting e.g. in: 'CLUSTERNAME".log' So, I want to correct this. The cluster is made of 3 production nod… --- ## [500 Internal Server Error: no such index \[Default\]](https://discuss.elastic.co/t/500-internal-server-error-no-such-index-default/252217)
**Author:** [@OrangeDog](https://discuss.elastic.co/u/OrangeDog)\ **Replies:** 2\ **Last updated:** [October 20, 2020, 11:26am UTC](https://discuss.elastic.co/t/500-internal-server-error-no-such-index-default/252217 "2020-10-20T11:26:18Z")
Autocomplete suggestions for filters have started causing 500 Internal Server Errors Request: POST https://example.com/kibana/api/kibana/suggestions/values/Default {"query":"","field":"hostname.keyword","boolFilter":\[… --- ## [Is it necessary to have elasticsearch ingest node?](https://discuss.elastic.co/t/is-it-necessary-to-have-elasticsearch-ingest-node/252661)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [October 20, 2020, 11:25am UTC](https://discuss.elastic.co/t/is-it-necessary-to-have-elasticsearch-ingest-node/252661 "2020-10-20T11:25:59Z")
I am using elk stack and i want to ask that if i have logstash do i need another elasticsearch as ingest node ? becuase logstash can also preprocess the data --- ## [Filebeat Autodiscover appenders - configuration not applied](https://discuss.elastic.co/t/filebeat-autodiscover-appenders-configuration-not-applied/252588)
**Author:** [@solarwinds](https://discuss.elastic.co/u/solarwinds)\ **Replies:** 4\ **Last updated:** [October 20, 2020, 10:53am UTC](https://discuss.elastic.co/t/filebeat-autodiscover-appenders-configuration-not-applied/252588 "2020-10-20T10:53:33Z")
Hi everyone, before opening an issue on Github, I will try here. As subject states, Filebeat Autodiscover appenders are not working as expected - configuration is not being applied. If I configure add\_docker\_metadata as … --- ## [Syslog plugin multiple grok](https://discuss.elastic.co/t/syslog-plugin-multiple-grok/252665)
**Author:** [@mutt13y](https://discuss.elastic.co/u/mutt13y)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 10:27am UTC](https://discuss.elastic.co/t/syslog-plugin-multiple-grok/252665 "2020-10-20T10:27:13Z")
Hi, The syslog plugin parameter grok\_pattern only accepts a string. Is there a reason it cant be changed to accept a list ? Currently we have to trap for parse failure and parse alternate patterns manually. --- ## [\[Watcher\] - Alerting on metricbeat monitored processes](https://discuss.elastic.co/t/watcher-alerting-on-metricbeat-monitored-processes/252660)
**Author:** [@bevano](https://discuss.elastic.co/u/bevano)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 10:11am UTC](https://discuss.elastic.co/t/watcher-alerting-on-metricbeat-monitored-processes/252660 "2020-10-20T10:11:43Z")
Hi All, I need some advice on how to implement watcher alerting. For example, we have 10 application servers, that have 5 programs running as processes. I have already installed metricbeat on these servers, and can see … --- ## [Getting items with Qty equal to 0](https://discuss.elastic.co/t/getting-items-with-qty-equal-to-0/252657)
**Author:** [@Padam\_Sethia](https://discuss.elastic.co/u/Padam_Sethia)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 9:55am UTC](https://discuss.elastic.co/t/getting-items-with-qty-equal-to-0/252657 "2020-10-20T09:55:52Z")
Hello , I am quite a beginner in elasticsearch . I really can't figure out how to get back items with qty as 0 , the problem is my index document is structured like this : { "children": \[\], "created": "2020-10-15T16:… --- ## [Query with function\_score and aggregation is too slow](https://discuss.elastic.co/t/query-with-function-score-and-aggregation-is-too-slow/252654)
**Author:** [@badreedine](https://discuss.elastic.co/u/badreedine)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 9:43am UTC](https://discuss.elastic.co/t/query-with-function-score-and-aggregation-is-too-slow/252654 "2020-10-20T09:43:41Z")
I have an index of about 15M items, I am using version 6.7.0 installed in AWS. We adopted denormalisation approach in our design, each project has many items. A project has a title, description, tags, popularity, project… --- ## [LogStash::Json::ParserError](https://discuss.elastic.co/t/logstash-parsererror/250809)
**Author:** [@Raiderume](https://discuss.elastic.co/u/Raiderume)\ **Replies:** 9\ **Last updated:** [October 20, 2020, 9:08am UTC](https://discuss.elastic.co/t/logstash-parsererror/250809 "2020-10-20T09:08:59Z")
Hello, I have problems with parsing json logs to logstash, there are tons of errors at log: Error parsing json {:source=\>"message", :raw=\>"\*\*\*\*", :exception=\>#\ **Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 3\ **Last updated:** [October 20, 2020, 9:07am UTC](https://discuss.elastic.co/t/deletion-of-indexed-documents-while-doing-the-indexing-with-action-set-to-index/251846 "2020-10-20T09:07:30Z") I have seen a peculiar behavior while using the logstash JDBC input plugin and Elasticsearch output plugin. Initial indexing has been completed and was trying to do the partial update for few columns. When I have sent … --- ## [Initializing\_shards got struck](https://discuss.elastic.co/t/initializing-shards-got-struck/252511)
**Author:** [@muthug](https://discuss.elastic.co/u/muthug)\ **Replies:** 30\ **Last updated:** [October 20, 2020, 8:55am UTC](https://discuss.elastic.co/t/initializing-shards-got-struck/252511 "2020-10-20T08:55:34Z")
Hi Team, initializing\_shards got struck, if i delete those shards wat will happen? it will become Green and will work smoothly? Kibana link is working for some time and its showing error timeout 30000ms some time. { … --- ## [Multilple field names are not getting renamed using logstash](https://discuss.elastic.co/t/multilple-field-names-are-not-getting-renamed-using-logstash/252646)
**Author:** [@abhay\_deshmukh](https://discuss.elastic.co/u/abhay_deshmukh)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 8:04am UTC](https://discuss.elastic.co/t/multilple-field-names-are-not-getting-renamed-using-logstash/252646 "2020-10-20T08:04:10Z")
mutate { rename =\> { "10" =\> "CheckSum" "103" =\> "OrdRejReason" "107" =\> "SecurityDesc" "108" =\> "HeartBtInt" "109" =\> "ClientID" "11" =\> "ClOrdID" "112" =\> "TestReqID" } I'm trying to rename these fields i tri… --- ## [\[ERROR\]\[logstash.outputs.elasticsearch\] Failed to install template. {:message=\>"Got response code '400' contacting Elasticsearch at URL 'http://localhost:9200/\_template/jose\_prueba\_v14'"](https://discuss.elastic.co/t/error-logstash-outputs-elasticsearch-failed-to-install-template-message-got-response-code-400-contacting-elasticsearch-at-url-http-localhost-9200-template-jose-prueba-v14/252582)
**Author:** [@joseantonio.sanchez](https://discuss.elastic.co/u/joseantonio.sanchez)\ **Replies:** 3\ **Last updated:** [October 20, 2020, 7:54am UTC](https://discuss.elastic.co/t/error-logstash-outputs-elasticsearch-failed-to-install-template-message-got-response-code-400-contacting-elasticsearch-at-url-http-localhost-9200-template-jose-prueba-v14/252582 "2020-10-20T07:54:26Z")
Good afternoon, I'm having problems with logstash when putting a template file to perform a mapping. in my logstash .conf file, I put "output { elasticsearch { hosts =\> \['localhost: 9200'\] index =\> 'jose\_test\_v14' … --- ## [Extract first 50 characters from message "body" into new field](https://discuss.elastic.co/t/extract-first-50-characters-from-message-body-into-new-field/252574)
**Author:** [@SecretSquizza](https://discuss.elastic.co/u/SecretSquizza)\ **Replies:** 4\ **Last updated:** [October 20, 2020, 7:44am UTC](https://discuss.elastic.co/t/extract-first-50-characters-from-message-body-into-new-field/252574 "2020-10-20T07:44:15Z")
Hello everyone, Firstly, apologies for any formatting mistakes in this post - its my first one... i'm relatively new to the Elastic stack and need to get a shortened version of the message body into another field so it… --- ## [Unable to delete the index (%{indexname}-%{type}-2020.09.19)](https://discuss.elastic.co/t/unable-to-delete-the-index-indexname-type-2020-09-19/252634)
**Author:** [@nikhilesh](https://discuss.elastic.co/u/nikhilesh)\ **Replies:** 2\ **Last updated:** [October 20, 2020, 7:16am UTC](https://discuss.elastic.co/t/unable-to-delete-the-index-indexname-type-2020-09-19/252634 "2020-10-20T07:16:51Z")
Hi All, I am using ES version 7.7 having a index with name "%{indexname}-%{type}-2020.09.19". trying to delete the index with the below command, but not working. can any please help on this. delete %{indexname}-%{type}… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1740) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1742)