# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1805 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1806 --- ## [How to make shorter (closer) token match more relevant? (edge\_ngram)](https://discuss.elastic.co/t/how-to-make-shorter-closer-token-match-more-relevant-edge-ngram/248703)
**Author:** [@rebelfreq](https://discuss.elastic.co/u/rebelfreq)\ **Replies:** 0\ **Last updated:** [September 15, 2020, 3:21pm UTC](https://discuss.elastic.co/t/how-to-make-shorter-closer-token-match-more-relevant-edge-ngram/248703 "2020-09-15T15:21:39Z")
Hello, I'm getting very weird results with edge\_ngram tokenizer I'm using for autocomplete. I'm trying to figure out how to make my results more relevant. I copied the example from the elasticsearch documentation. I ha… --- ## [How to serach message including "keyword" and format message](https://discuss.elastic.co/t/how-to-serach-message-including-keyword-and-format-message/248701)
**Author:** [@NouhaB](https://discuss.elastic.co/u/NouhaB)\ **Replies:** 0\ **Last updated:** [September 15, 2020, 3:06pm UTC](https://discuss.elastic.co/t/how-to-serach-message-including-keyword-and-format-message/248701 "2020-09-15T15:06:26Z")
Hello, I need to filter logs in order to get only the message begining by "CALL\_END" This is an example of logs : here is my logstash config file : '' input { udp { port =\> 2514 type =\> "syslog" } } filter{ … --- ## [Store and query generic attributes/fields](https://discuss.elastic.co/t/store-and-query-generic-attributes-fields/248671)
**Author:** [@ggrune](https://discuss.elastic.co/u/ggrune)\ **Replies:** 3\ **Last updated:** [September 15, 2020, 2:58pm UTC](https://discuss.elastic.co/t/store-and-query-generic-attributes-fields/248671 "2020-09-15T14:58:41Z")
We have a software that allows custom attributes for products. Example: "products" : \[ { "id" : "222222", "sku" : "12345", "name" : "Fancy notebook", "category" : "computer", ... "a… --- ## [Where can I find the Elastic UI CSS? Can I use it without Javascript?](https://discuss.elastic.co/t/where-can-i-find-the-elastic-ui-css-can-i-use-it-without-javascript/248632)
**Author:** [@egray](https://discuss.elastic.co/u/egray)\ **Replies:** 1\ **Last updated:** [September 15, 2020, 2:57pm UTC](https://discuss.elastic.co/t/where-can-i-find-the-elastic-ui-css-can-i-use-it-without-javascript/248632 "2020-09-15T14:57:15Z")
I tagged this Kibana because I couldn't see a better category for it. I am entirely new to UI programming, but I'm creating a web app which displays Kibana 7.8 dashboards- yes, I have reasons for doing this instead of us… --- ## [Check Kibana max-old-space-size](https://discuss.elastic.co/t/check-kibana-max-old-space-size/245310)
**Author:** [@VeeT](https://discuss.elastic.co/u/VeeT)\ **Replies:** 9\ **Last updated:** [September 15, 2020, 2:45pm UTC](https://discuss.elastic.co/t/check-kibana-max-old-space-size/245310 "2020-09-15T14:45:13Z")
Hi, I tried adding --max-old-space-size=2048 into the bin/kibana file under NODE\_OPTIONS. How do I check that this came in effect? Thanks! --- ## [OOM Error](https://discuss.elastic.co/t/oom-error/248154)
**Author:** [@Shreesha\_Gundmi](https://discuss.elastic.co/u/Shreesha_Gundmi)\ **Replies:** 7\ **Last updated:** [September 15, 2020, 2:44pm UTC](https://discuss.elastic.co/t/oom-error/248154 "2020-09-15T14:44:03Z")
Hi Team, I am using Elasticsearch 7.6.2, sometimes when we request query I am getting OOM (Out Of Memory) may I know how to tackle this issue? Hardware environment as follows: Server capacity vCPUs: 8 RAM: 32GB Sto… --- ## [Conversion type pipeline](https://discuss.elastic.co/t/conversion-type-pipeline/248638)
**Author:** [@graimato](https://discuss.elastic.co/u/graimato)\ **Replies:** 6\ **Last updated:** [September 15, 2020, 2:23pm UTC](https://discuss.elastic.co/t/conversion-type-pipeline/248638 "2020-09-15T14:23:11Z")
Hello, I'm trying to write a pipeline to parse following part of data ua="192.168.211.109:443" I implement it as ua=\\"%{IP:wkaddress}:%{NUMBER:port:integer}\\" but always I have wkaddress and port as Text field. Wh… --- ## [Changing kubernetes storage class for data nodes without data loss](https://discuss.elastic.co/t/changing-kubernetes-storage-class-for-data-nodes-without-data-loss/248693)
**Author:** [@danksim](https://discuss.elastic.co/u/danksim)\ **Replies:** 0\ **Last updated:** [September 15, 2020, 2:18pm UTC](https://discuss.elastic.co/t/changing-kubernetes-storage-class-for-data-nodes-without-data-loss/248693 "2020-09-15T14:18:28Z")
Elasticsearch version: 7.6.2 $ kubectl version Client Version: version.Info{Major:"1", Minor:"18", GitVersion:"v1.18.2", GitCommit:"52c56ce7a8272c798dbc29846288d7cd9fbae032", GitTreeState:"clean", BuildDate:"2020-04-16T… --- ## [Using a layer as a filter in a map](https://discuss.elastic.co/t/using-a-layer-as-a-filter-in-a-map/248588)
**Author:** [@Vester](https://discuss.elastic.co/u/Vester)\ **Replies:** 4\ **Last updated:** [September 15, 2020, 2:15pm UTC](https://discuss.elastic.co/t/using-a-layer-as-a-filter-in-a-map/248588 "2020-09-15T14:15:48Z")
Hi, Is it possible to use a layer imported from a GeoJSON file as a filter ? Example, in this picture I would like to use the red area layer as a filter, only points inside the area are shown ? How can I do it ? tha… --- ## [Watcher alert not working for multiple query with percentage calculation](https://discuss.elastic.co/t/watcher-alert-not-working-for-multiple-query-with-percentage-calculation/248335)
**Author:** [@suryanaj](https://discuss.elastic.co/u/suryanaj)\ **Replies:** 2\ **Last updated:** [September 15, 2020, 2:00pm UTC](https://discuss.elastic.co/t/watcher-alert-not-working-for-multiple-query-with-percentage-calculation/248335 "2020-09-15T14:00:25Z")
watcher alert not working for multiple query with percentage calculation code { "trigger": { "schedule": { "interval": "2m" } }, "input": { "chain": { "inputs": \[ { "first": { "search": { "request": { "sea… --- ## [Node class, Client interface and RestHighLevelClient](https://discuss.elastic.co/t/node-class-client-interface-and-resthighlevelclient/248665)
**Author:** [@Pete\_Watcharawit](https://discuss.elastic.co/u/Pete_Watcharawit)\ **Replies:** 3\ **Last updated:** [September 15, 2020, 1:25pm UTC](https://discuss.elastic.co/t/node-class-client-interface-and-resthighlevelclient/248665 "2020-09-15T13:25:38Z")
import org.elasticsearch.node.Node; import org.elasticsearch.client.Client; Settings settings = Settings.builder().loadFromPath(Paths.get("config/elasticsearch.yml").toAbsolutePath()).build(); Path path = Paths.get("con… --- ## [Reading Elasticsearch error in logs - ML](https://discuss.elastic.co/t/reading-elasticsearch-error-in-logs-ml/247790)
**Author:** [@Apollyon](https://discuss.elastic.co/u/Apollyon)\ **Replies:** 3\ **Last updated:** [September 15, 2020, 12:56pm UTC](https://discuss.elastic.co/t/reading-elasticsearch-error-in-logs-ml/247790 "2020-09-15T12:56:51Z")
Hello All, I am using ELK v 7.9.1. Have seen the below error. I have been itching my head with where this has come from or where I would look to help over come this issue. The below is the error message: \[instance-00… --- ## [Metricbeat - Windows Module - Perfmon Instances truncated with parenthesis](https://discuss.elastic.co/t/metricbeat-windows-module-perfmon-instances-truncated-with-parenthesis/248422)
**Author:** [@Nerbelir](https://discuss.elastic.co/u/Nerbelir)\ **Replies:** 1\ **Last updated:** [September 15, 2020, 12:53pm UTC](https://discuss.elastic.co/t/metricbeat-windows-module-perfmon-instances-truncated-with-parenthesis/248422 "2020-09-15T12:53:11Z")
Using 7.9.0 and 7.9.1 (I can't confirm this for earlier versions) it seems there is something off with how it will read instance names to elasticsearch output. If the perfmon instance's name contains parenthesis such as … --- ## [Beats pipeline.json not received correctly in elastisearch/kibana](https://discuss.elastic.co/t/beats-pipeline-json-not-received-correctly-in-elastisearch-kibana/248624)
**Author:** [@schultz](https://discuss.elastic.co/u/schultz)\ **Replies:** 2\ **Last updated:** [September 15, 2020, 12:45pm UTC](https://discuss.elastic.co/t/beats-pipeline-json-not-received-correctly-in-elastisearch-kibana/248624 "2020-09-15T12:45:14Z")
Versions: Filebeat v7.9.1 Elastisearch v 7.9.1 Kibana v7.9.1 On windows. I have a pipeline.json file that describes the ingest part of my module { "description": "Pipeline for parsing aaa server logs.", "processors"… --- ## [Json + multiline codecs together, is it possible?](https://discuss.elastic.co/t/json-multiline-codecs-together-is-it-possible/248549)
**Author:** [@Hleb\_V](https://discuss.elastic.co/u/Hleb_V)\ **Replies:** 5\ **Last updated:** [September 15, 2020, 12:20pm UTC](https://discuss.elastic.co/t/json-multiline-codecs-together-is-it-possible/248549 "2020-09-15T12:20:01Z")
Hi. We are running Java applications inside docker containers. We use file input with json codec to parse their logs. Unfortunately Java is known to throw stack traces and docker creates a single json entry for every lo… --- ## [Using the xpack.encryptedSavedObjects.encryptionKey for Alerts and Actions in kibana 7.9](https://discuss.elastic.co/t/using-the-xpack-encryptedsavedobjects-encryptionkey-for-alerts-and-actions-in-kibana-7-9/248647)
**Author:** [@kennedy](https://discuss.elastic.co/u/kennedy)\ **Replies:** 2\ **Last updated:** [September 15, 2020, 12:04pm UTC](https://discuss.elastic.co/t/using-the-xpack-encryptedsavedobjects-encryptionkey-for-alerts-and-actions-in-kibana-7-9/248647 "2020-09-15T12:04:39Z")
Hi, I'm using a docker compose file for ELK setup and using the latest 7.9 version for kibana. Now i want to set the xpack.encryptedSavedObjects.encryptionKey parameter in the kibana.yml so that i can use the alert and… --- ## [Instantiate TransportClient in ES 7.8 help](https://discuss.elastic.co/t/instantiate-transportclient-in-es-7-8-help/248620)
**Author:** [@Pete\_Watcharawit](https://discuss.elastic.co/u/Pete_Watcharawit)\ **Replies:** 5\ **Last updated:** [September 15, 2020, 11:59am UTC](https://discuss.elastic.co/t/instantiate-transportclient-in-es-7-8-help/248620 "2020-09-15T11:59:01Z")
I would like to replace the way I instantiate TransportClient in 7.8 since our application is heavily dependent on TransportClient at the moment. TransportClient will be migrated to RestHighLevelClient. Settings setting… --- ## [Kibana data table](https://discuss.elastic.co/t/kibana-data-table/248631)
**Author:** [@vikram\_singh](https://discuss.elastic.co/u/vikram_singh)\ **Replies:** 2\ **Last updated:** [September 15, 2020, 11:58am UTC](https://discuss.elastic.co/t/kibana-data-table/248631 "2020-09-15T11:58:01Z")
Hi, I create a data table visualisation kibana. I add split table option on timestamp, but after it.It is creating problem on export option. When I export it, timestamp field not showing in correct format and one colum… --- ## [Elasticsearch.keystore location](https://discuss.elastic.co/t/elasticsearch-keystore-location/248575)
**Author:** [@ben-charles](https://discuss.elastic.co/u/ben-charles)\ **Replies:** 1\ **Last updated:** [September 15, 2020, 11:47am UTC](https://discuss.elastic.co/t/elasticsearch-keystore-location/248575 "2020-09-15T11:47:49Z")
Is it possible to configure where elasticsearch.keystore is created? We would like to have it in a separate directory from the config/ directory. --- ## [Error Messages in Logstash Logfile io.netty.channel](https://discuss.elastic.co/t/error-messages-in-logstash-logfile-io-netty-channel/248660)
**Author:** [@bateskevin](https://discuss.elastic.co/u/bateskevin)\ **Replies:** 2\ **Last updated:** [September 15, 2020, 11:41am UTC](https://discuss.elastic.co/t/error-messages-in-logstash-logfile-io-netty-channel/248660 "2020-09-15T11:41:23Z")
Hi, I am recieving the following errors in my logstash log file on the instance on a regular basis: \[2020-09-15T02:00:17,587\]\[WARN \]\[io.netty.channel.DefaultChannelPipeline\]\[main\]\[localinstance\] An exceptionCaught() ev… --- ## [Journalbeat does not support globbing?](https://discuss.elastic.co/t/journalbeat-does-not-support-globbing/248666)
**Author:** [@kbaf](https://discuss.elastic.co/u/kbaf)\ **Replies:** 0\ **Last updated:** [September 15, 2020, 11:28am UTC](https://discuss.elastic.co/t/journalbeat-does-not-support-globbing/248666 "2020-09-15T11:28:29Z")
I have several directories with different journals I'd like to collect with globbing: - paths: - "/var/log/journal" - "/openstack/log/\*/journal/\*/system.journal" This is documented behaviour for filebea… --- ## [Auditbeat consuming lot of CPU](https://discuss.elastic.co/t/auditbeat-consuming-lot-of-cpu/248629)
**Author:** [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\ **Replies:** 1\ **Last updated:** [September 15, 2020, 11:28am UTC](https://discuss.elastic.co/t/auditbeat-consuming-lot-of-cpu/248629 "2020-09-15T11:28:09Z")
Hello Team, We are using ELK with architecture Beat-\>Logstsh-\>Elasticsaerch-\>Kibana version 6.4. Elasticsaerch, Kibana, Logstash and all beats version is 6.4. Yesterday we installed auditbeat version 6.4 on our one ser… --- ## [Image from local host to kibana](https://discuss.elastic.co/t/image-from-local-host-to-kibana/248521)
**Author:** [@sai92](https://discuss.elastic.co/u/sai92)\ **Replies:** 4\ **Last updated:** [September 15, 2020, 11:12am UTC](https://discuss.elastic.co/t/image-from-local-host-to-kibana/248521 "2020-09-15T11:12:23Z")
Hi I am using kibana (7.8.0) and elasticsearch (7.8.0) is there any way to have markdown using image from local host in kibana --- ## [Error while xpack.security.enabled:true on ES 6.8](https://discuss.elastic.co/t/error-while-xpack-security-enabled-true-on-es-6-8/248296)
**Author:** [@analysteng](https://discuss.elastic.co/u/analysteng)\ **Replies:** 8\ **Last updated:** [September 15, 2020, 11:03am UTC](https://discuss.elastic.co/t/error-while-xpack-security-enabled-true-on-es-6-8/248296 "2020-09-15T11:03:43Z")
Hello, When I modify the file 'elasticsearch.yml' by adding the line 'xpack.security.enabled: true', then Kibana does not work. I have already read all the doc on the web but still did not get to solve it. Please, cou… --- ## [No handler for type \[string\] declared on field \[name\]](https://discuss.elastic.co/t/no-handler-for-type-string-declared-on-field-name/248661)
**Author:** [@shwesinhan](https://discuss.elastic.co/u/shwesinhan)\ **Replies:** 0\ **Last updated:** [September 15, 2020, 11:01am UTC](https://discuss.elastic.co/t/no-handler-for-type-string-declared-on-field-name/248661 "2020-09-15T11:01:19Z")
Hi community. We have one issue after rolling upgrade from version 5.x to version 6.x. The issue is happening when reindex. Please check this out below: { "took": 22, "timed\_out": false, "tot… --- ## [The client is not connected when Filebeat connects to Logstash](https://discuss.elastic.co/t/the-client-is-not-connected-when-filebeat-connects-to-logstash/248654)
**Author:** [@XiaoyuZhann](https://discuss.elastic.co/u/XiaoyuZhann)\ **Replies:** 1\ **Last updated:** [September 15, 2020, 10:32am UTC](https://discuss.elastic.co/t/the-client-is-not-connected-when-filebeat-connects-to-logstash/248654 "2020-09-15T10:32:27Z")
I use the container created by the Docker images docker.io/sebp/elk. When Filebeat connects to Elasticsearch, the information is displayed perfectly in Kibana.But after Filebeat connected to Logstash, Filebeat logs repor… --- ## [GPO to start Beats not working](https://discuss.elastic.co/t/gpo-to-start-beats-not-working/248626)
**Author:** [@Thelmo\_Henrique\_Sant](https://discuss.elastic.co/u/Thelmo_Henrique_Sant)\ **Replies:** 5\ **Last updated:** [September 15, 2020, 10:18am UTC](https://discuss.elastic.co/t/gpo-to-start-beats-not-working/248626 "2020-09-15T10:18:58Z")
Hi buddies, I am trying to start beat services (filebeat, metricbeat, heartbeat, winlogbeat, auditbeat) using a GPO but I don't know why,it's not working. In Group Policy Management, under "Computer Configuration" I di… --- ## [Filebeat Modules and Parsing, with Logstash - Cisco Related](https://discuss.elastic.co/t/filebeat-modules-and-parsing-with-logstash-cisco-related/246027)
**Author:** [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Replies:** 5\ **Last updated:** [September 15, 2020, 10:12am UTC](https://discuss.elastic.co/t/filebeat-modules-and-parsing-with-logstash-cisco-related/246027 "2020-09-15T10:12:13Z")
From what I can glean from https://www.elastic.co/guide/en/logstash/current/use-ingest-pipelines.html and Problems parsing Cisco ASA logs using filebeat, using the filebeat cisco module with logstash successfully looks l… --- ## [Unable to connect to Elasticsearch. Error: Request Timeout after 30000ms](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-error-request-timeout-after-30000ms/248636)
**Author:** [@Shriram\_Wasule](https://discuss.elastic.co/u/Shriram_Wasule)\ **Replies:** 4\ **Last updated:** [September 15, 2020, 9:49am UTC](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-error-request-timeout-after-30000ms/248636 "2020-09-15T09:49:04Z")
i have elasticsearch on the same machine. elasticsearch.yml # ======================== Elasticsearch Configuration ========================= # # NOTE: Elasticsearch comes with reasonable defaults for most settings.… --- ## [Exiting: error connecting to Kibana: fail to get the Kibana version](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version/248526)
**Author:** [@Shriram\_Wasule](https://discuss.elastic.co/u/Shriram_Wasule)\ **Replies:** 4\ **Last updated:** [September 15, 2020, 9:27am UTC](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version/248526 "2020-09-15T09:27:07Z")
Hello, I am new to ELK,I am not able to load the dashboard into my kibana server, when i tried to load dashboard i am getting this error. please help me with this. my Metribeat.yml # This file is an example configura… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1804) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1806)