# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1935 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1936 --- ## [Does logstash map to geo\_point type when parsing geoip?](https://discuss.elastic.co/t/does-logstash-map-to-geo-point-type-when-parsing-geoip/240776)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 2\ **Last updated:** [July 13, 2020, 5:28am UTC](https://discuss.elastic.co/t/does-logstash-map-to-geo-point-type-when-parsing-geoip/240776 "2020-07-13T05:28:48Z")
input{ kafka{ codec =\> "json" decorate\_events =\> true ...... } } filter { geoip { source =\> "remote\_addr" target =\> "geoip" add\_field =\> \["\[geoip\]\[coordinates\]","%{\[geoip\]\[lo… --- ## [Role mappings of all matched users in Elasticsearch](https://discuss.elastic.co/t/role-mappings-of-all-matched-users-in-elasticsearch/240850)
**Author:** [@soumendra](https://discuss.elastic.co/u/soumendra)\ **Replies:** 3\ **Last updated:** [July 13, 2020, 5:11am UTC](https://discuss.elastic.co/t/role-mappings-of-all-matched-users-in-elasticsearch/240850 "2020-07-13T05:11:48Z")
How to fetch all the role mappings of a single user in Elasticsearch. I have role mapping like this: "sdbsd21tdsbjvbriuu": { "enabled": true, "roles": \[ "kibana\_dashboard\_only\_user", … --- ## [Snapshot and restore source only feature](https://discuss.elastic.co/t/snapshot-and-restore-source-only-feature/240881)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 15\ **Last updated:** [July 13, 2020, 4:38am UTC](https://discuss.elastic.co/t/snapshot-and-restore-source-only-feature/240881 "2020-07-13T04:38:55Z")
Hi all i recently trying the snapshot feature in elastic and i noticed the feature source only button there, according to what i have read the source only will only save the metadata and the field of the index and nothi… --- ## [CSV export issue single date present in two columns - v6.8.1](https://discuss.elastic.co/t/csv-export-issue-single-date-present-in-two-columns-v6-8-1/240877)
**Author:** [@z018782](https://discuss.elastic.co/u/z018782)\ **Replies:** 0\ **Last updated:** [July 13, 2020, 1:55am UTC](https://discuss.elastic.co/t/csv-export-issue-single-date-present-in-two-columns-v6-8-1/240877 "2020-07-13T01:55:31Z")
Export CSV will gives two rows instead of single row. Is there any settings to change this. because earlier version of excel (2012) is not able to import these type of CSV in an single row. what i am getting now! hell… --- ## [How to avoid sending duplicate events when Winlogbeat is processing duplicate events](https://discuss.elastic.co/t/how-to-avoid-sending-duplicate-events-when-winlogbeat-is-processing-duplicate-events/240883)
**Author:** [@aixic](https://discuss.elastic.co/u/aixic)\ **Replies:** 0\ **Last updated:** [July 13, 2020, 2:22am UTC](https://discuss.elastic.co/t/how-to-avoid-sending-duplicate-events-when-winlogbeat-is-processing-duplicate-events/240883 "2020-07-13T02:22:49Z")
我是一个新手开发者，我想了解Winlogbeat是如何避免出现发送重复的日志。我通过复现beats/winlogbeat/beater/eventlogger.go 中的 for \_, lr := range records { client.Publish(lr.ToEvent()) } 会出现同一日志一直刷新created进行输出 --- ## [Logstash\_jdbc\_last\_run file is not created](https://discuss.elastic.co/t/logstash-jdbc-last-run-file-is-not-created/240882)
**Author:** [@ohoroyoi](https://discuss.elastic.co/u/ohoroyoi)\ **Replies:** 0\ **Last updated:** [July 13, 2020, 2:11am UTC](https://discuss.elastic.co/t/logstash-jdbc-last-run-file-is-not-created/240882 "2020-07-13T02:11:50Z")
./logstash -V 6.8.8 The logstash\_jdbc\_last\_run file is not created. It was created at first, but I deleted it. Then, when I run it with a arbitrary file in another location, sql\_last\_value is not created. And the fil… --- ## [Terms filter not receiving a hit within a function score](https://discuss.elastic.co/t/terms-filter-not-receiving-a-hit-within-a-function-score/240747)
**Author:** [@Stephen\_Kneubuehl](https://discuss.elastic.co/u/Stephen_Kneubuehl)\ **Replies:** 4\ **Last updated:** [July 13, 2020, 2:22am UTC](https://discuss.elastic.co/t/terms-filter-not-receiving-a-hit-within-a-function-score/240747 "2020-07-13T02:22:29Z")
I am relatively new to Elasticsearch and am building a function score query to find vehicles that may be of interest to our users. We have a field called "make" which holds the brand of the car manufacturer such as "BMW"… --- ## [PayloadFactor needed in similarity(es7)](https://discuss.elastic.co/t/payloadfactor-needed-in-similarity-es7/240880)
**Author:** [@chembohuang](https://discuss.elastic.co/u/chembohuang)\ **Replies:** 0\ **Last updated:** [July 13, 2020, 2:10am UTC](https://discuss.elastic.co/t/payloadfactor-needed-in-similarity-es7/240880 "2020-07-13T02:10:43Z")
https://issues.apache.org/jira/browse/LUCENE-8014 As we can see from the link above, SimScorer.computeSlopFactor and SimScorer.computePayloadFactor were removed in 7x. What if i need payloadfactor? How can i get this … --- ## [Reindexing docs that don’t yet exist in new index only (by doc id)](https://discuss.elastic.co/t/reindexing-docs-that-don-t-yet-exist-in-new-index-only-by-doc-id/240761)
**Author:** [@smlbiobot](https://discuss.elastic.co/u/smlbiobot)\ **Replies:** 1\ **Last updated:** [July 13, 2020, 1:15am UTC](https://discuss.elastic.co/t/reindexing-docs-that-don-t-yet-exist-in-new-index-only-by-doc-id/240761 "2020-07-13T01:15:30Z")
I need to reindex some indices so that it will change some object mapping to nested. I plan on setting the doc IDs to be the same in the source index and destination index. The challenge is that the source indices will c… --- ## [I am curious about SoketTimeoutException thrown by RestHighLevelCilent](https://discuss.elastic.co/t/i-am-curious-about-sokettimeoutexception-thrown-by-resthighlevelcilent/240632)
**Author:** [@111349](https://discuss.elastic.co/u/111349)\ **Replies:** 2\ **Last updated:** [July 13, 2020, 1:02am UTC](https://discuss.elastic.co/t/i-am-curious-about-sokettimeoutexception-thrown-by-resthighlevelcilent/240632 "2020-07-13T01:02:25Z")
My work environment contains 7 days of data, and when looking at elasticsearch, it contains 172 indices (1720shards, 500 million docs). Then, using reathighlevelcilent, we issue a query to get 7 days of data sorted by ti… --- ## [How to rollover to same index](https://discuss.elastic.co/t/how-to-rollover-to-same-index/239940)
**Author:** [@Prash7](https://discuss.elastic.co/u/Prash7)\ **Replies:** 4\ **Last updated:** [July 13, 2020, 12:35am UTC](https://discuss.elastic.co/t/how-to-rollover-to-same-index/239940 "2020-07-13T00:35:34Z")
Hello Team, I am trying to configure an ILM for a time series logs. Since they are logs, i am trying to impose a hot phase of 2d, and then essentially move them into the warm phase, where (i can proceed to mark them as … --- ## [Boostrapping: master not discovered yet, this node has not previously joined a bootstrapped (v7+) cluster](https://discuss.elastic.co/t/boostrapping-master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster/238758)
**Author:** [@code\_share](https://discuss.elastic.co/u/code_share)\ **Replies:** 1\ **Last updated:** [July 13, 2020, 12:32am UTC](https://discuss.elastic.co/t/boostrapping-master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster/238758 "2020-07-13T00:32:41Z")
I am trying to bootstrap a 3 node cluster based on this guide: https://www.elastic.co/guide/en/elasticsearch/reference/master/modules-discovery-bootstrap-cluster.html node1 (master) node.name: node01 discovery.zen.pin… --- ## [RSS Documentation Update](https://discuss.elastic.co/t/rss-documentation-update/240868)
**Author:** [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\ **Replies:** 3\ **Last updated:** [July 13, 2020, 12:14am UTC](https://discuss.elastic.co/t/rss-documentation-update/240868 "2020-07-13T00:14:18Z")
The description is for "exec" plugin and not RSS. --- ## [Error index.lifecycle.rollover\_alias](https://discuss.elastic.co/t/error-index-lifecycle-rollover-alias/240534)
**Author:** [@impkos](https://discuss.elastic.co/u/impkos)\ **Replies:** 1\ **Last updated:** [July 12, 2020, 11:45pm UTC](https://discuss.elastic.co/t/error-index-lifecycle-rollover-alias/240534 "2020-07-12T23:45:42Z")
I configured ILM to automatically delete old indexes Shows errors: illegal\_argument\_exception: index.lifecycle.rollover\_alias \[ms001-backup03\] does not point to index What is index.lifecycle.rollover\_alias? And why i… --- ## [Additional field for syslog message](https://discuss.elastic.co/t/additional-field-for-syslog-message/237678)
**Author:** [@dghosh](https://discuss.elastic.co/u/dghosh)\ **Replies:** 1\ **Last updated:** [July 12, 2020, 11:38pm UTC](https://discuss.elastic.co/t/additional-field-for-syslog-message/237678 "2020-07-12T23:38:25Z")
can some one help me to create field for below syslog logs urgent. logs below :--- "Thu Jun 18 10:54:37 2020","pro pull / Jurong Singapore","HTTP","go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409","Allowed","General … --- ## [Beats, APM & Logstash auth with aouth or oidc](https://discuss.elastic.co/t/beats-apm-logstash-auth-with-aouth-or-oidc/236588)
**Author:** [@SomeHowChris](https://discuss.elastic.co/u/SomeHowChris)\ **Replies:** 0\ **Last updated:** [June 10, 2020, 10:18pm UTC](https://discuss.elastic.co/t/beats-apm-logstash-auth-with-aouth-or-oidc/236588 "2020-06-10T22:18:47Z")
Greetings all, We are moving towards OAuth on all our applications and so we would like to do the same with logstash, the beats, and apm. Not only to secure compute but also to gain metadata at the service consuming the… --- ## [Setting up a "lab-as-prod": Beats roles, permissions and tutorial!](https://discuss.elastic.co/t/setting-up-a-lab-as-prod-beats-roles-permissions-and-tutorial/236624)
**Author:** [@joaociocca](https://discuss.elastic.co/u/joaociocca)\ **Replies:** 0\ **Last updated:** [June 11, 2020, 6:29am UTC](https://discuss.elastic.co/t/setting-up-a-lab-as-prod-beats-roles-permissions-and-tutorial/236624 "2020-06-11T06:29:39Z")
(backtracking after all is done, I'd like to start apologizing for the sheer size of this post, and ask that you bear with me) So, not only I'm trying to build it, but I'm trying to document step-by-step how to do it. … --- ## [Filebeat decode json processor](https://discuss.elastic.co/t/filebeat-decode-json-processor/236770)
**Author:** [@venkat9731](https://discuss.elastic.co/u/venkat9731)\ **Replies:** 0\ **Last updated:** [June 11, 2020, 6:20pm UTC](https://discuss.elastic.co/t/filebeat-decode-json-processor/236770 "2020-06-11T18:20:34Z")
I am having an issue with my filebeat config Exiting: Error while initializing input: When using the JSON decoder and multiline together, you need to specify a message\_key value accessing filebeat.yml file filebeat.in… --- ## [Remove JSON formatting?](https://discuss.elastic.co/t/remove-json-formatting/236869)
**Author:** [@cogz0qj](https://discuss.elastic.co/u/cogz0qj)\ **Replies:** 0\ **Last updated:** [June 12, 2020, 10:27am UTC](https://discuss.elastic.co/t/remove-json-formatting/236869 "2020-06-12T10:27:28Z")
FileBeat reads JSON logfile and sends logs to Elasticsearch, but in Kibana discover (selected field full\_log) events are visually unreadable, because of JSON formatting. Is there any idea please, how to remove JSON form… --- ## [Heartbeat Monitoring on individual host](https://discuss.elastic.co/t/heartbeat-monitoring-on-individual-host/236894)
**Author:** [@quixter](https://discuss.elastic.co/u/quixter)\ **Replies:** 0\ **Last updated:** [June 12, 2020, 12:48pm UTC](https://discuss.elastic.co/t/heartbeat-monitoring-on-individual-host/236894 "2020-06-12T12:48:28Z")
WE currently use heartbeat from a single source that verifies a UL is up. It worksgreat but we want to know also if there is an issue with a single web server in a webfarm has an issue connecting to that url. I was think… --- ## [Ensuring GDPR compliance](https://discuss.elastic.co/t/ensuring-gdpr-compliance/236912)
**Author:** [@magnalite](https://discuss.elastic.co/u/magnalite)\ **Replies:** 0\ **Last updated:** [June 12, 2020, 2:18pm UTC](https://discuss.elastic.co/t/ensuring-gdpr-compliance/236912 "2020-06-12T14:18:13Z")
We are looking to how to ensure we are GDPR compliant with the handling of our data however this is posing a real issue for us. We collect data of users from another (third party) service and can identify them via their … --- ## [Duplicate everything to syslog](https://discuss.elastic.co/t/duplicate-everything-to-syslog/236926)
**Author:** [@PangolinCyber](https://discuss.elastic.co/u/PangolinCyber)\ **Replies:** 0\ **Last updated:** [June 12, 2020, 5:13pm UTC](https://discuss.elastic.co/t/duplicate-everything-to-syslog/236926 "2020-06-12T17:13:37Z")
I'm trying to put together a system which is intended to tee everything arriving at an ELK system from all input types to an evidence store syslog platform. i.e everything processed by ELK also goes to a syslog in the ra… --- ## [ELK Sizing recommendations for Log monitoring?](https://discuss.elastic.co/t/elk-sizing-recommendations-for-log-monitoring/237020)
**Author:** [@vikas\_mahajan](https://discuss.elastic.co/u/vikas_mahajan)\ **Replies:** 0\ **Last updated:** [June 14, 2020, 11:32am UTC](https://discuss.elastic.co/t/elk-sizing-recommendations-for-log-monitoring/237020 "2020-06-14T11:32:19Z")
Calling out ELK experts to review my design. Do you recommend doubling the no. of shards from 4 to 8 for each index ? One dedicated master node (having 2TB, 256 GB and 16 CPU) will suffice the purpose for managing … --- ## [Best budget minipc for ELK lab](https://discuss.elastic.co/t/best-budget-minipc-for-elk-lab/237636)
**Author:** [@Marat](https://discuss.elastic.co/u/Marat)\ **Replies:** 0\ **Last updated:** [June 18, 2020, 12:46pm UTC](https://discuss.elastic.co/t/best-budget-minipc-for-elk-lab/237636 "2020-06-18T12:46:39Z")
I want to purchase two minipcs like odyssey x86 for setting up Elastic Stack Cluster, would you recommend these machines or there is a better options? Thank you in advance! --- ## [NetMon Freemium et elasticstack](https://discuss.elastic.co/t/netmon-freemium-et-elasticstack/237672)
**Author:** [@oumy](https://discuss.elastic.co/u/oumy)\ **Replies:** 0\ **Last updated:** [June 18, 2020, 4:00pm UTC](https://discuss.elastic.co/t/netmon-freemium-et-elasticstack/237672 "2020-06-18T16:00:37Z")
Hello i was wondering if there is a way to send netmon data to elasticsearch? and how so? thank you --- ## [Elasticsearch connectors](https://discuss.elastic.co/t/elasticsearch-connectors/238727)
**Author:** [@Saber\_Ben\_Njima](https://discuss.elastic.co/u/Saber_Ben_Njima)\ **Replies:** 0\ **Last updated:** [June 25, 2020, 4:50pm UTC](https://discuss.elastic.co/t/elasticsearch-connectors/238727 "2020-06-25T16:50:03Z")
how can i send data from talend to elasticsearch to visualise it in kibana --- ## [GROK pattern not work with OPTIONS Request Method](https://discuss.elastic.co/t/grok-pattern-not-work-with-options-request-method/238867)
**Author:** [@muthucse](https://discuss.elastic.co/u/muthucse)\ **Replies:** 0\ **Last updated:** [June 26, 2020, 1:41pm UTC](https://discuss.elastic.co/t/grok-pattern-not-work-with-options-request-method/238867 "2020-06-26T13:41:49Z")
Grok pattern for OPTIONS http method is not working. Pattern: %{TIMESTAMP\_ISO8601:iis.access.time} %{WORD:iis.access.site\_name} %{WORD:http.request.method} %{URIPATH:url.path} Sample Log: 2020-06-16 14:03:12 API OPTI… --- ## [Using Elasticsearch graph for Data lineage Analysis](https://discuss.elastic.co/t/using-elasticsearch-graph-for-data-lineage-analysis/239121)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 0\ **Last updated:** [June 29, 2020, 2:08pm UTC](https://discuss.elastic.co/t/using-elasticsearch-graph-for-data-lineage-analysis/239121 "2020-06-29T14:08:53Z")
I would like to know if the Elasticsearch graph can be used for Data Lineage analysis. Please provide some details around the same. --- ## [ELK stack - @timestamp issue](https://discuss.elastic.co/t/elk-stack-timestamp-issue/240620)
**Author:** [@jang](https://discuss.elastic.co/u/jang)\ **Replies:** 1\ **Last updated:** [July 12, 2020, 11:00pm UTC](https://discuss.elastic.co/t/elk-stack-timestamp-issue/240620 "2020-07-12T23:00:59Z")
hello, I am using Filebeat, Logstash, Elasticsearch, and Kibana. I found a problem while checking the data through Kibana. @timestamp data is 9hours slower than local time. Of course, I know that i can change the t… --- ## [SELECT IN (SELECT, SELECT)](https://discuss.elastic.co/t/select-in-select-select/240495)
**Author:** [@MatDemb](https://discuss.elastic.co/u/MatDemb)\ **Replies:** 0\ **Last updated:** [July 9, 2020, 8:43am UTC](https://discuss.elastic.co/t/select-in-select-select/240495 "2020-07-09T08:43:09Z")
Hello, I try to extract some datas with SQL request in canvas but I don't find the way to do it with sql restriction essql has (and my poor experience on it). Here an example of data I have (each row is a document): c… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1934) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1936)