# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1827 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1828 --- ## [Elastic watcher, log multiple fields](https://discuss.elastic.co/t/elastic-watcher-log-multiple-fields/247343)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 1\ **Last updated:** [September 3, 2020, 1:44pm UTC](https://discuss.elastic.co/t/elastic-watcher-log-multiple-fields/247343 "2020-09-03T13:44:59Z")
Hello everybody, I just began using elastic watcher to alert when I detect a port scanner (I wanna build my own one to understand how the watcher works that's why I didn't use the one in elastic Github ) so my watcher … --- ## [Syslog source ip](https://discuss.elastic.co/t/syslog-source-ip/247363)
**Author:** [@mutt13y](https://discuss.elastic.co/u/mutt13y)\ **Replies:** 3\ **Last updated:** [September 3, 2020, 1:26pm UTC](https://discuss.elastic.co/t/syslog-source-ip/247363 "2020-09-03T13:26:40Z")
Hi, The syslog input plugin is creating a field based on the source IP of the syslog message. However for some hosts this is put into \[host\] and for other hosts it is going into \[host\]\[ip\] I cant figure out why this is… --- ## [Logstash - Simple Log Ingest](https://discuss.elastic.co/t/logstash-simple-log-ingest/247383)
**Author:** [@slash665](https://discuss.elastic.co/u/slash665)\ **Replies:** 1\ **Last updated:** [September 3, 2020, 1:22pm UTC](https://discuss.elastic.co/t/logstash-simple-log-ingest/247383 "2020-09-03T13:22:12Z")
Hello there, I'm a total newb to ELK, so at this point I am just trying to ingest a log file from a specific path using a logstash configuration file in conf.d . it's just not working, however... This is what my conf f… --- ## [Journalbeat message format](https://discuss.elastic.co/t/journalbeat-message-format/247289)
**Author:** [@cartesian-theatrics](https://discuss.elastic.co/u/cartesian-theatrics)\ **Replies:** 3\ **Last updated:** [September 3, 2020, 1:15pm UTC](https://discuss.elastic.co/t/journalbeat-message-format/247289 "2020-09-03T13:15:43Z")
Hello, I'm looking for documentation on the journalbeat message format? I need to understand what I can about the format in order to understand the tradeoffs related to batching. Thanks, John --- ## [How to return multiline or long list of values in painless?](https://discuss.elastic.co/t/how-to-return-multiline-or-long-list-of-values-in-painless/247385)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 1:11pm UTC](https://discuss.elastic.co/t/how-to-return-multiline-or-long-list-of-values-in-painless/247385 "2020-09-03T13:11:40Z")
hi, I've quite a large set of key-value fields to return in the transform as below. But I wanted it to look clean and copy-paste friendly, but fails (if I put all into one line it works) "index\_alert": { "tra… --- ## [Index not rolloving over based on any param](https://discuss.elastic.co/t/index-not-rolloving-over-based-on-any-param/247384)
**Author:** [@Pardha\_Saradhi](https://discuss.elastic.co/u/Pardha_Saradhi)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 12:57pm UTC](https://discuss.elastic.co/t/index-not-rolloving-over-based-on-any-param/247384 "2020-09-03T12:57:03Z")
Hi, I am on es 7.9.0. I have created a policy to rollover But its been 29 minutes and the index is still in hot phase. The data has grown to 2.5 GB and docs count is also way above the mentioned limit. This the ou… --- ## [KV filter not splitting log](https://discuss.elastic.co/t/kv-filter-not-splitting-log/247380)
**Author:** [@varun1992](https://discuss.elastic.co/u/varun1992)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 12:36pm UTC](https://discuss.elastic.co/t/kv-filter-not-splitting-log/247380 "2020-09-03T12:36:47Z")
My config file as below. It's not splitting log read by grok input { file { path =\> "/log/ForwardTrafficLog.log" start\_position =\> "beginning" } } filter { grok { match =\> { "message" =\> \["%{GR… --- ## [Nodes disabled from Cluster when XPack SSL is enabled](https://discuss.elastic.co/t/nodes-disabled-from-cluster-when-xpack-ssl-is-enabled/247000)
**Author:** [@kkhadka](https://discuss.elastic.co/u/kkhadka)\ **Replies:** 3\ **Last updated:** [September 3, 2020, 11:52am UTC](https://discuss.elastic.co/t/nodes-disabled-from-cluster-when-xpack-ssl-is-enabled/247000 "2020-09-03T11:52:45Z")
I am following the steps given in this Node-1 elasticsearch.yml file cluster.name: as-cluster node.name: as-node1 node.master: true node.data: true network.host: 10.71.34.27 http.port: 9200 discovery.seed\_hosts: \["10.7… --- ## [Data Stream](https://discuss.elastic.co/t/data-stream/247310)
**Author:** [@js7](https://discuss.elastic.co/u/js7)\ **Replies:** 2\ **Last updated:** [September 3, 2020, 11:28am UTC](https://discuss.elastic.co/t/data-stream/247310 "2020-09-03T11:28:45Z")
Hello, is it possible to visualize in Kibana the Data Streams? I couldn't find a way other than with indexes. Thank you. --- ## [Kibana error fetching fields for index pattern](https://discuss.elastic.co/t/kibana-error-fetching-fields-for-index-pattern/242725)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 18\ **Last updated:** [September 3, 2020, 11:27am UTC](https://discuss.elastic.co/t/kibana-error-fetching-fields-for-index-pattern/242725 "2020-09-03T11:27:13Z")
Hi, Have seen this question pass by several times, however yet I have found no solution. I have this ELK 7.7 stack. I try to index a log file and view the reults in Kibana. I have quite a default kibana installation a… --- ## [How to find quorum of the cluster in elasticsearch 7.x](https://discuss.elastic.co/t/how-to-find-quorum-of-the-cluster-in-elasticsearch-7-x/247335)
**Author:** [@bhavya](https://discuss.elastic.co/u/bhavya)\ **Replies:** 4\ **Last updated:** [September 3, 2020, 11:15am UTC](https://discuss.elastic.co/t/how-to-find-quorum-of-the-cluster-in-elasticsearch-7-x/247335 "2020-09-03T11:15:29Z")
I am using Elasticsearch 7.9 version. I want to find the quorum value of my cluster. Before 7.x version, discovery.zen.minimum\_master\_nodes controlled the minimum number of eligible master nodes that a node should “se… --- ## [Cannot connect to elasticsearch but i have connected to kibana](https://discuss.elastic.co/t/cannot-connect-to-elasticsearch-but-i-have-connected-to-kibana/247224)
**Author:** [@talaatkamal](https://discuss.elastic.co/u/talaatkamal)\ **Replies:** 10\ **Last updated:** [September 3, 2020, 10:51am UTC](https://discuss.elastic.co/t/cannot-connect-to-elasticsearch-but-i-have-connected-to-kibana/247224 "2020-09-03T10:51:54Z")
I cannot connect to elasticsearch , when I try to connect it through client winlogbeat , connection refused by server. --- ## [.ml-state too big](https://discuss.elastic.co/t/ml-state-too-big/247366)
**Author:** [@usrigp](https://discuss.elastic.co/u/usrigp)\ **Replies:** 1\ **Last updated:** [September 3, 2020, 10:50am UTC](https://discuss.elastic.co/t/ml-state-too-big/247366 "2020-09-03T10:50:00Z")
Hi We have the index .ml\_state with a size in disk almost 60Gb on disk. Is it possible to purge any data or apply an ILM policy to make rollover? As it is a system index we do not know if it is possible to apply ILM. E… --- ## [Logstash - grok - ruby and random numbers](https://discuss.elastic.co/t/logstash-grok-ruby-and-random-numbers/247367)
**Author:** [@BBQigniter](https://discuss.elastic.co/u/BBQigniter)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 10:36am UTC](https://discuss.elastic.co/t/logstash-grok-ruby-and-random-numbers/247367 "2020-09-03T10:36:02Z")
hello, maybe someone has an idea here. we use following setup for our log-filtering: source -- (dns-rr) --\> 3 x logstash -\> 3-node-rabbitmq-cluster -\> 3 x logstash -\> elasticsearch-cluster on the 3-node rabbitmq-clus… --- ## [\[Filebeat\] Range:%20990%0AX-SA-ID:%20778 to multiple fields](https://discuss.elastic.co/t/filebeat-range-20990-0ax-sa-id-20778-to-multiple-fields/247346)
**Author:** [@Kuo\_Hugo](https://discuss.elastic.co/u/Kuo_Hugo)\ **Replies:** 1\ **Last updated:** [September 3, 2020, 10:17am UTC](https://discuss.elastic.co/t/filebeat-range-20990-0ax-sa-id-20778-to-multiple-fields/247346 "2020-09-03T10:17:04Z")
Hi, May I know if there's a way to split the string into multiple fields? Range:%20990%0AX-SA-ID:%20778 This is encoded. The decoded string is Range: 990\\nX-SA-ID: 778 My goal is to split it into multiple field and … --- ## [Elasticsearch: JSON processor issue in Elastic V7.8.1](https://discuss.elastic.co/t/elasticsearch-json-processor-issue-in-elastic-v7-8-1/247360)
**Author:** [@Hung\_M\_Le](https://discuss.elastic.co/u/Hung_M_Le)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 9:57am UTC](https://discuss.elastic.co/t/elasticsearch-json-processor-issue-in-elastic-v7-8-1/247360 "2020-09-03T09:57:49Z")
Hi I have followed the example outlined inside the document about the JSON processor: https://www.elastic.co/guide/en/elasticsearch/reference/6.8/json-processor.html Here is the code: { "json" : { "field" : "st… --- ## [Use wildcard data type ,The number of events does not match when querying](https://discuss.elastic.co/t/use-wildcard-data-type-the-number-of-events-does-not-match-when-querying/247318)
**Author:** [@woxiang-H](https://discuss.elastic.co/u/woxiang-H)\ **Replies:** 5\ **Last updated:** [September 3, 2020, 10:01am UTC](https://discuss.elastic.co/t/use-wildcard-data-type-the-number-of-events-does-not-match-when-querying/247318 "2020-09-03T10:01:03Z")
I use two field types: text and wildcard to store the same error log. When I query, I find the missing content GET test-wildcard/\_search { "query": { "match": { "json.thrown.stack": "\*invokeWithoutCircuitBre… --- ## [Logstash-input-wmi error in logs](https://discuss.elastic.co/t/logstash-input-wmi-error-in-logs/246796)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 3\ **Last updated:** [September 3, 2020, 9:53am UTC](https://discuss.elastic.co/t/logstash-input-wmi-error-in-logs/246796 "2020-09-03T09:53:50Z")
Hello, I installed logstash-wmi plugin into my logstash installation 7.8 using logstash executable and command install. I am not able to move forward with my configuration becouse of "(LoadError) load error: win32ole/w… --- ## [Logstash not detecting newly added records in elastic](https://discuss.elastic.co/t/logstash-not-detecting-newly-added-records-in-elastic/247358)
**Author:** [@B\_K\_V\_GOPI\_KRISHNA\_G](https://discuss.elastic.co/u/B_K_V_GOPI_KRISHNA_G)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 9:45am UTC](https://discuss.elastic.co/t/logstash-not-detecting-newly-added-records-in-elastic/247358 "2020-09-03T09:45:48Z")
I have a sql db and I have logstash running on it for every 1min with docupsert true , everything is fine . But when i add a record into elastic using my backend code , its being pushed into the elastic successfully bu… --- ## [Kibana Tile Map not showing geo points](https://discuss.elastic.co/t/kibana-tile-map-not-showing-geo-points/247325)
**Author:** [@galvin1234](https://discuss.elastic.co/u/galvin1234)\ **Replies:** 1\ **Last updated:** [September 3, 2020, 9:34am UTC](https://discuss.elastic.co/t/kibana-tile-map-not-showing-geo-points/247325 "2020-09-03T09:34:02Z")
I have set my mapping to accept geo data in geo\_shape field, geo\_shape field is able to draw shapes on kibana map. But when i try to store geo\_point shape in geo\_shape field then kibana map is not able to draw poiint sh… --- ## [.task index to large](https://discuss.elastic.co/t/task-index-to-large/247352)
**Author:** [@tjmartins](https://discuss.elastic.co/u/tjmartins)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 9:25am UTC](https://discuss.elastic.co/t/task-index-to-large/247352 "2020-09-03T09:25:16Z")
I'm using elasticsearch 5.6.1 and when I list my indexes I have a .task index with almost 80GB. Is there anything I can do to shrink or delete (if possible) this index? Any help please? Best regards, Tiago Martins --- ## [Logstash Configuration Error](https://discuss.elastic.co/t/logstash-configuration-error/247211)
**Author:** [@Chandana\_Koppal](https://discuss.elastic.co/u/Chandana_Koppal)\ **Replies:** 2\ **Last updated:** [September 3, 2020, 6:28am UTC](https://discuss.elastic.co/t/logstash-configuration-error/247211 "2020-09-03T06:28:32Z")
\[2020-09-02T16:11:38,526\]\[ERROR\]\[logstash.agent \] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of \[ \\… --- ## [Installer package vs elastic licence](https://discuss.elastic.co/t/installer-package-vs-elastic-licence/247337)
**Author:** [@Adam\_Grabek](https://discuss.elastic.co/u/Adam_Grabek)\ **Replies:** 1\ **Last updated:** [September 3, 2020, 8:42am UTC](https://discuss.elastic.co/t/installer-package-vs-elastic-licence/247337 "2020-09-03T08:42:17Z")
Hi, I would like to ask if what I want to do is not violating elastic licence. Client asked me to create bundled installer package that will utilize available windows installers for elasticsearch, kibana etc. The idea… --- ## [Cannot see restored indices in Kibana](https://discuss.elastic.co/t/cannot-see-restored-indices-in-kibana/247226)
**Author:** [@jze](https://discuss.elastic.co/u/jze)\ **Replies:** 2\ **Last updated:** [September 3, 2020, 8:39am UTC](https://discuss.elastic.co/t/cannot-see-restored-indices-in-kibana/247226 "2020-09-03T08:39:11Z")
Hello, I installed new ELK stack using the same template/process as with existing ones and restored an old snapshot from another ELK stack via POST /\_snapshot/\/date:20200715/\_restore Now I can see via curl -s … --- ## [\[Solved\] Rolling upgrade 7.6.1 -\> 7.9.0 suddenly failed on node: Java error?](https://discuss.elastic.co/t/solved-rolling-upgrade-7-6-1-7-9-0-suddenly-failed-on-node-java-error/247217)
**Author:** [@alexolivan](https://discuss.elastic.co/u/alexolivan)\ **Replies:** 4\ **Last updated:** [September 3, 2020, 8:33am UTC](https://discuss.elastic.co/t/solved-rolling-upgrade-7-6-1-7-9-0-suddenly-failed-on-node-java-error/247217 "2020-09-03T08:33:41Z")
Hi... I'm doing a rolling upgrade... overall, never had an issue with this.. The cluster is 7.6.1 and I'm going to latest 7.9.0 All nodes are identical machines: Debian stable machines... so far so good. I tried upgra… --- ## [Set score lower bound](https://discuss.elastic.co/t/set-score-lower-bound/247342)
**Author:** [@Alex\_D](https://discuss.elastic.co/u/Alex_D)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 8:33am UTC](https://discuss.elastic.co/t/set-score-lower-bound/247342 "2020-09-03T08:33:02Z")
Hi all ! I am trying to set score lower bound for query. If I use simple query construction, "min\_score" works properly GET my-index/\_search { "query": { "match": { "textField": "something" } }, "… --- ## [Could not index event to Elasticsearch, mapper \[geoip.location\] of different type](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-mapper-geoip-location-of-different-type/247254)
**Author:** [@real\_user](https://discuss.elastic.co/u/real_user)\ **Replies:** 4\ **Last updated:** [September 3, 2020, 8:27am UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-mapper-geoip-location-of-different-type/247254 "2020-09-03T08:27:00Z")
Hi All I have configured logstash and elasticsearch v7.8. This is the logstash part geoip { source =\> "\[iis\]\[access\]\[client\_ip\]" } Index template: GET /\_template/iis { "iis" : { "order" : 0, … --- ## [Cron Job Expression to take snapshot in Each 15 Mins](https://discuss.elastic.co/t/cron-job-expression-to-take-snapshot-in-each-15-mins/247334)
**Author:** [@Ayush\_Agrahari](https://discuss.elastic.co/u/Ayush_Agrahari)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 7:35am UTC](https://discuss.elastic.co/t/cron-job-expression-to-take-snapshot-in-each-15-mins/247334 "2020-09-03T07:35:27Z")
Hello, Could you please help me to create Cron Job expression to take snapshot in Each 15 mins in SLM Policy. Currently I am using below format. 'curl -X PUT "localhost:9200/\_slm/policy/policy-name?pretty" -H 'Conten… --- ## [Java version in Elasticsearch 7.8.0](https://discuss.elastic.co/t/java-version-in-elasticsearch-7-8-0/247329)
**Author:** [@pratiksha](https://discuss.elastic.co/u/pratiksha)\ **Replies:** 1\ **Last updated:** [September 3, 2020, 7:04am UTC](https://discuss.elastic.co/t/java-version-in-elasticsearch-7-8-0/247329 "2020-09-03T07:04:21Z")
Elasticsearch 7.8.0 comes with Java 14 and it is build using it. As per the elastic document, we can use our own version of Java and it is recommended to use a supported LTS version of Java. So, we are installing and u… --- ## [Set number of shards of index created by dateindexname processor](https://discuss.elastic.co/t/set-number-of-shards-of-index-created-by-dateindexname-processor/247263)
**Author:** [@matteocalisti](https://discuss.elastic.co/u/matteocalisti)\ **Replies:** 2\ **Last updated:** [September 3, 2020, 6:56am UTC](https://discuss.elastic.co/t/set-number-of-shards-of-index-created-by-dateindexname-processor/247263 "2020-09-03T06:56:25Z")
Hello! I'd like to know if it is possible to set the number of shards of an index created by a dateindexname processor. Right now, my pipeline creates a new index based on a date field, but creates only one primary sha… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1826) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1828)