# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1928 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1929 --- ## [Replacing missing aggregation value](https://discuss.elastic.co/t/replacing-missing-aggregation-value/241223)
**Author:** [@111366](https://discuss.elastic.co/u/111366)\ **Replies:** 0\ **Last updated:** [July 15, 2020, 5:12am UTC](https://discuss.elastic.co/t/replacing-missing-aggregation-value/241223 "2020-07-15T05:12:22Z")
Hello, I am an engineer preparing to migrate from splunk to elasticsearch. I wanted to aggregate the highest value of count every minute, and I wanted to replace the empty part with zero. However, it didn't work out as… --- ## [Logstash pipeline execution order](https://discuss.elastic.co/t/logstash-pipeline-execution-order/240539)
**Author:** [@tbege](https://discuss.elastic.co/u/tbege)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 4:17am UTC](https://discuss.elastic.co/t/logstash-pipeline-execution-order/240539 "2020-07-15T04:17:38Z")
Hello, I am working on a sync mechanism between a DB2 database and Elasticsearch, I am transporting the data with the JDBC plugin. However, I am running into the issue of the pipeline order, meaning: I have 3 masterd… --- ## [Elasticsearch index/result aggregation with multiple datasources](https://discuss.elastic.co/t/elasticsearch-index-result-aggregation-with-multiple-datasources/237649)
**Author:** [@tbege](https://discuss.elastic.co/u/tbege)\ **Replies:** 13\ **Last updated:** [July 15, 2020, 4:16am UTC](https://discuss.elastic.co/t/elasticsearch-index-result-aggregation-with-multiple-datasources/237649 "2020-07-15T04:16:38Z")
Hello, I am currently researching the functionalities and features of the Elastic stack, more precisely Elasticsearch and Logstash and would need some advice regarding a scenario that I would need to implement. I have s… --- ## [Timelion - metric=median query?](https://discuss.elastic.co/t/timelion-metric-median-query/240727)
**Author:** [@isarib](https://discuss.elastic.co/u/isarib)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 4:05am UTC](https://discuss.elastic.co/t/timelion-metric-median-query/240727 "2020-07-15T04:05:05Z")
I am using timelion to do sum and averages, but is there an internal metric function to determine median? example: .es(offset=-24h,index=system\_stats\*,interval=5m, timefield='@timestamp', metric=avg:downnodes, q=island… --- ## [Elasticsearch restart issue](https://discuss.elastic.co/t/elasticsearch-restart-issue/241197)
**Author:** [@Splunk](https://discuss.elastic.co/u/Splunk)\ **Replies:** 3\ **Last updated:** [July 15, 2020, 3:58am UTC](https://discuss.elastic.co/t/elasticsearch-restart-issue/241197 "2020-07-15T03:58:15Z")
Hi Guys, I changed network host to 0.0.0.0 from localhost and I restarted the machine that's all its gone below is the message, any suggestion thanks. ubuntu@ip-1XX-XX-X-X:~/ELK$ sudo /etc/init.d/elasticsearch status ●… --- ## [Elastic Search Failure over EC2 AWS](https://discuss.elastic.co/t/elastic-search-failure-over-ec2-aws/241130)
**Author:** [@BabarKhan](https://discuss.elastic.co/u/BabarKhan)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 2:53am UTC](https://discuss.elastic.co/t/elastic-search-failure-over-ec2-aws/241130 "2020-07-15T02:53:49Z")
I was trying to install Magento over Amazon EC2 instance and it requires ElasticSearch as prerequisite. I followed available methods to install it through Archive and the other method. But none of them worked for me. Wh… --- ## [exception=\>#\ **Author:** [@srbhklkrn](https://discuss.elastic.co/u/srbhklkrn)\ **Replies:** 7\ **Last updated:** [July 15, 2020, 2:37am UTC](https://discuss.elastic.co/t/exception-logstash-unexpected-character-code-58-expected-a-valid-value-number-string-array-object-true-false-or-null/241198 "2020-07-15T02:37:37Z") I need to parse and have all the JSON object in one message but it is splitting into different messages as you can see in stdout below JSON: \[ { "SOURCE": "Source A", "Model": "Mo… --- ## [When \`.logstash\_jdbc\_last\_run\` is created?](https://discuss.elastic.co/t/when-logstash-jdbc-last-run-is-created/240902)
**Author:** [@ohoroyoi](https://discuss.elastic.co/u/ohoroyoi)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 2:18am UTC](https://discuss.elastic.co/t/when-logstash-jdbc-last-run-is-created/240902 "2020-07-15T02:18:48Z")
Even if I create a file arbitrarily, the text in the file is erased and sql\_last\_value is not created. I originally had this file, but I deleted it. So I can't get sql\_last\_value. How should I solve it? --- ## [Facing issue in Discover in kibana while accessing index](https://discuss.elastic.co/t/facing-issue-in-discover-in-kibana-while-accessing-index/241152)
**Author:** [@adkalavadia](https://discuss.elastic.co/u/adkalavadia)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 1:49am UTC](https://discuss.elastic.co/t/facing-issue-in-discover-in-kibana-while-accessing-index/241152 "2020-07-15T01:49:50Z")
Getting below error in discover window while accessing index. \[illegal\_argument\_exception\] Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operat… --- ## [Missing events when shipping Cloudtrail logs with Filebeat and the AWS module](https://discuss.elastic.co/t/missing-events-when-shipping-cloudtrail-logs-with-filebeat-and-the-aws-module/239838)
**Author:** [@m1kel](https://discuss.elastic.co/u/m1kel)\ **Replies:** 8\ **Last updated:** [July 15, 2020, 1:40am UTC](https://discuss.elastic.co/t/missing-events-when-shipping-cloudtrail-logs-with-filebeat-and-the-aws-module/239838 "2020-07-15T01:40:45Z")
I've configured a POC of Filebeat ingestion of Cloudtrail logs into our Elastic Cloud. I see the events and can see that the SQS queue is being processed. However, when looking closely, I can spot that not all of the ev… --- ## [Date parsing error in Elasticsearch 7.1](https://discuss.elastic.co/t/date-parsing-error-in-elasticsearch-7-1/240607)
**Author:** [@sharadha\_s](https://discuss.elastic.co/u/sharadha_s)\ **Replies:** 10\ **Last updated:** [July 15, 2020, 1:02am UTC](https://discuss.elastic.co/t/date-parsing-error-in-elasticsearch-7-1/240607 "2020-07-15T01:02:12Z")
We are using the AWS Elasticsearch 7.1 and we see some date formats are not being supported. It used to work in 5.5 and its a issue with only 7.1. Mapping : "dynamic": "strict", "dynamic\_templates… --- ## [Performance of painless scripts: inline vs stored](https://discuss.elastic.co/t/performance-of-painless-scripts-inline-vs-stored/241212)
**Author:** [@Dennis\_Andersen](https://discuss.elastic.co/u/Dennis_Andersen)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 12:53am UTC](https://discuss.elastic.co/t/performance-of-painless-scripts-inline-vs-stored/241212 "2020-07-15T00:53:08Z")
Is it more efficient to create stored painless scripts than put them inline? Specifically I am interested in this for aggregations. Thanks, Dennis --- ## [Delete Replica after N days ILM](https://discuss.elastic.co/t/delete-replica-after-n-days-ilm/241208)
**Author:** [@contregm](https://discuss.elastic.co/u/contregm)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 12:28am UTC](https://discuss.elastic.co/t/delete-replica-after-n-days-ilm/241208 "2020-07-15T00:28:11Z")
Looking at the documentation it seems to say that if you only have hot nodes you can't set a lifecycle policy to remove replicas after a certain time period. You would have to migrate to a warm/cold node to be able to do… --- ## [Rest client for Elastic 6.2.x and 7.2.x](https://discuss.elastic.co/t/rest-client-for-elastic-6-2-x-and-7-2-x/241183)
**Author:** [@ashu.vedi](https://discuss.elastic.co/u/ashu.vedi)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 7:04pm UTC](https://discuss.elastic.co/t/rest-client-for-elastic-6-2-x-and-7-2-x/241183 "2020-07-14T19:04:24Z")
Hi , We have a sbt project which need to query both elasticsearch 6.2 cluster using sksamuel/elastic4s as well as Elasticsearch 7.2.0 using the bight level rest client for elasticsearch. I am getting errors as there is a… --- ## [Logstash Cache](https://discuss.elastic.co/t/logstash-cache/241202)
**Author:** [@csgeek](https://discuss.elastic.co/u/csgeek)\ **Replies:** 4\ **Last updated:** [July 14, 2020, 10:34pm UTC](https://discuss.elastic.co/t/logstash-cache/241202 "2020-07-14T22:34:58Z")
I'm working on an event filter written in ruby that needs to do a lookup. I have the data stored in a JSON file that i'm loading locally and I'd like to know if there is any concept of a shared cache that I can leverage… --- ## [JVM Heap Size settings defined are not the same as I can see now](https://discuss.elastic.co/t/jvm-heap-size-settings-defined-are-not-the-same-as-i-can-see-now/241160)
**Author:** [@jelocabral](https://discuss.elastic.co/u/jelocabral)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 3:52pm UTC](https://discuss.elastic.co/t/jvm-heap-size-settings-defined-are-not-the-same-as-i-can-see-now/241160 "2020-07-14T15:52:37Z")
Dear people, I have an ELK 7.8.0 server with 60GB RAM. It is a Debian 10 server and the ELK packages were installed by apt (DEB packages). I've setup the JVM heap size in: /etc/elasticsearch/jvm.options: -Xms30g -Xmx… --- ## [Rename Pipeline.yml](https://discuss.elastic.co/t/rename-pipeline-yml/241192)
**Author:** [@Thiago\_Paiva](https://discuss.elastic.co/u/Thiago_Paiva)\ **Replies:** 2\ **Last updated:** [July 14, 2020, 9:36pm UTC](https://discuss.elastic.co/t/rename-pipeline-yml/241192 "2020-07-14T21:36:07Z")
Hello folks, I currently need to upload my pipeline.yml to git, But my logstash exists in 5 (Five) servers. And Three(3) servers use the same pipeline.yml and Two use other pipeline.yml. So I want to rename one like Pip… --- ## [Accessing file system from within Elasticsearch custom realm?](https://discuss.elastic.co/t/accessing-file-system-from-within-elasticsearch-custom-realm/241193)
**Author:** [@TimothyMDean](https://discuss.elastic.co/u/TimothyMDean)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 8:39pm UTC](https://discuss.elastic.co/t/accessing-file-system-from-within-elasticsearch-custom-realm/241193 "2020-07-14T20:39:44Z")
I am working on a custom authentication realm for Elasticsearch. In its current form I would like it to be able to read a secret key from a locally-readable Java keystone in JCEKS format. I have set up my ES plugin with … --- ## [Cisco syslogs showing up as grokparsefailure when sent to Logstash](https://discuss.elastic.co/t/cisco-syslogs-showing-up-as-grokparsefailure-when-sent-to-logstash/240587)
**Author:** [@jabberwalker](https://discuss.elastic.co/u/jabberwalker)\ **Replies:** 4\ **Last updated:** [July 14, 2020, 8:39pm UTC](https://discuss.elastic.co/t/cisco-syslogs-showing-up-as-grokparsefailure-when-sent-to-logstash/240587 "2020-07-14T20:39:31Z")
I am working through a Udemy course to familiarize myself with Elasticsearch but I've ran into a wall when applying it to our current environment when it comes to Logstash. I am trying to send data from Cisco syslog but… --- ## [Logstash unable to reach Elasticsearch: port issues](https://discuss.elastic.co/t/logstash-unable-to-reach-elasticsearch-port-issues/241187)
**Author:** [@rahulnama](https://discuss.elastic.co/u/rahulnama)\ **Replies:** 5\ **Last updated:** [July 14, 2020, 8:38pm UTC](https://discuss.elastic.co/t/logstash-unable-to-reach-elasticsearch-port-issues/241187 "2020-07-14T20:38:04Z")
Hello Team I deployed Elasticsearch on Kubernetes and it's working fine. Also, I created an ingress so it's redirecting from 80 =\> 9200. But logstash is looking for 9200 so connection is failing. However, if I try h… --- ## [Running logstash using systemd with specific settings](https://discuss.elastic.co/t/running-logstash-using-systemd-with-specific-settings/241184)
**Author:** [@kaplan.dani](https://discuss.elastic.co/u/kaplan.dani)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 7:29pm UTC](https://discuss.elastic.co/t/running-logstash-using-systemd-with-specific-settings/241184 "2020-07-14T19:29:14Z")
I run logstash with this command line and it works correctly: bin/logstash -f my\_pipeline.conf --config.reload.automatic --path.settings /etc/logstash when I run it using systemctl (on debian) it will not work, I guess… --- ## [Custom Label field not available for MaxBucket aggregation](https://discuss.elastic.co/t/custom-label-field-not-available-for-maxbucket-aggregation/235045)
**Author:** [@vijay3](https://discuss.elastic.co/u/vijay3)\ **Replies:** 5\ **Last updated:** [July 14, 2020, 7:20pm UTC](https://discuss.elastic.co/t/custom-label-field-not-available-for-maxbucket-aggregation/235045 "2020-07-14T19:20:42Z")
Whenever i am using "Max Bucket" sibling aggregation in "Metrics" section, i am not able to get custom field. The title is always something like " Overall Max of Count". Using Kibana 7.7 . Please guide me how to get cus… --- ## [Searching multiple values in multiple fields](https://discuss.elastic.co/t/searching-multiple-values-in-multiple-fields/241177)
**Author:** [@brsntus](https://discuss.elastic.co/u/brsntus)\ **Replies:** 2\ **Last updated:** [July 14, 2020, 7:15pm UTC](https://discuss.elastic.co/t/searching-multiple-values-in-multiple-fields/241177 "2020-07-14T19:15:30Z")
Hi folks. I have an index with documents that have a product\_id (long) and product\_subtype (text). I'm trying to search for documents using multiple product\_ids and product\_subtypes. The data that I have is this: \[ … --- ## [Where are the configurations for "scripted fields/dashboards/visualisations" stored?](https://discuss.elastic.co/t/where-are-the-configurations-for-scripted-fields-dashboards-visualisations-stored/240712)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 3\ **Last updated:** [July 14, 2020, 7:13pm UTC](https://discuss.elastic.co/t/where-are-the-configurations-for-scripted-fields-dashboards-visualisations-stored/240712 "2020-07-14T19:13:29Z")
We wanted to centralise the configuration into version control and wanted to move away from updating Kibana directly in PROD environment. As part of it, we needed to have configurations (like scripted fields/dashboards/v… --- ## [Sorting TSVB by column in a dashboard](https://discuss.elastic.co/t/sorting-tsvb-by-column-in-a-dashboard/240802)
**Author:** [@haythem](https://discuss.elastic.co/u/haythem)\ **Replies:** 1\ **Last updated:** [July 14, 2020, 7:08pm UTC](https://discuss.elastic.co/t/sorting-tsvb-by-column-in-a-dashboard/240802 "2020-07-14T19:08:26Z")
Hi guys lately i've been working on a tsvb table but i'm facing a problem , when i try sorting a by column in a dashboard it says No data to display for the selected metrics and when i try to show 100 lines in a ts… --- ## [Metricbeat extra fields](https://discuss.elastic.co/t/metricbeat-extra-fields/241168)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [July 14, 2020, 7:07pm UTC](https://discuss.elastic.co/t/metricbeat-extra-fields/241168 "2020-07-14T19:07:42Z")
I have just enable metricbeat. using very simple config. metricbeat.config.modules: path: ${path.config}/modules.d/\*.yml reload.enabled: false setup.template.settings: index.number\_of\_shards: 1 index.codec: be… --- ## [Can I match network ranges in painless?](https://discuss.elastic.co/t/can-i-match-network-ranges-in-painless/241182)
**Author:** [@tterranigma](https://discuss.elastic.co/u/tterranigma)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 7:01pm UTC](https://discuss.elastic.co/t/can-i-match-network-ranges-in-painless/241182 "2020-07-14T19:01:49Z")
I would like to port some packetbeat processors over to ingest node. One of the processors I would like to port is the network processor that matches a subnet range. Is there a way to port this over to ingest node? I cou… --- ## [Your socket connection to the server was not read from or written to within the timeout period](https://discuss.elastic.co/t/your-socket-connection-to-the-server-was-not-read-from-or-written-to-within-the-timeout-period/237638)
**Author:** [@Annette1](https://discuss.elastic.co/u/Annette1)\ **Replies:** 12\ **Last updated:** [July 14, 2020, 6:58pm UTC](https://discuss.elastic.co/t/your-socket-connection-to-the-server-was-not-read-from-or-written-to-within-the-timeout-period/237638 "2020-07-14T18:58:08Z")
when using logstash to s3 output. have tried many strategies of file\_size, file\_time, an rotation strategy to fix with no joy. --- ## [Geospatial query with aggregations does not return any results ES7.6](https://discuss.elastic.co/t/geospatial-query-with-aggregations-does-not-return-any-results-es7-6/240762)
**Author:** [@vmanohar1](https://discuss.elastic.co/u/vmanohar1)\ **Replies:** 4\ **Last updated:** [July 14, 2020, 6:27pm UTC](https://discuss.elastic.co/t/geospatial-query-with-aggregations-does-not-return-any-results-es7-6/240762 "2020-07-14T18:27:49Z")
1) MY template for indices of type myindex-YYYY-MM-DD is - PUT \_template/myindex\_template { "index\_patterns" : \["myindex-\*"\], "aliases" : { "myindex\_alias" : {} }, "settings": { "number\_of\_repl… --- ## [Grok working online but not in Kibana debugger or Logstash](https://discuss.elastic.co/t/grok-working-online-but-not-in-kibana-debugger-or-logstash/241176)
**Author:** [@HassaanSalik](https://discuss.elastic.co/u/HassaanSalik)\ **Replies:** 1\ **Last updated:** [July 14, 2020, 6:07pm UTC](https://discuss.elastic.co/t/grok-working-online-but-not-in-kibana-debugger-or-logstash/241176 "2020-07-14T18:07:48Z")
Hi, I am trying to parse gc-log file through grok as shown in this tutorial. The following grok is working fine in both Grok Constructor and Grok Debugger. %{TIMESTAMP\_ISO8601:timestamp}: %{NUMBER:jvm\_time}: \\\[%{DATA:… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1927) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1929)