# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1975 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1976 --- ## [Logstash pipeline to pipeline losing events when queue is full](https://discuss.elastic.co/t/logstash-pipeline-to-pipeline-losing-events-when-queue-is-full/238545)
**Author:** [@wizardofc0dz](https://discuss.elastic.co/u/wizardofc0dz)\ **Replies:** 0\ **Last updated:** [June 24, 2020, 6:34pm UTC](https://discuss.elastic.co/t/logstash-pipeline-to-pipeline-losing-events-when-queue-is-full/238545 "2020-06-24T18:34:06Z")
Hello, I have configured pipeline-to-pipeline with output isolator configuration in Logstash version 7.4.1 to send logs to local and remote Elasticsearch. Both pipelines, local and remote output, have been configured w… --- ## [Logstash mixing up two configuration files?!](https://discuss.elastic.co/t/logstash-mixing-up-two-configuration-files/238540)
**Author:** [@RonGros](https://discuss.elastic.co/u/RonGros)\ **Replies:** 7\ **Last updated:** [June 24, 2020, 6:26pm UTC](https://discuss.elastic.co/t/logstash-mixing-up-two-configuration-files/238540 "2020-06-24T18:26:06Z")
Hi, I swear to god I don't believe myself when I am writng this. I have a logstash configuration. it takes a CSV file we have and throws it into logstash. I have some ugly patches there that take information from the fi… --- ## [Kibana on office screens and remote control](https://discuss.elastic.co/t/kibana-on-office-screens-and-remote-control/238251)
**Author:** [@Martin\_Fredriksson](https://discuss.elastic.co/u/Martin_Fredriksson)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 5:24pm UTC](https://discuss.elastic.co/t/kibana-on-office-screens-and-remote-control/238251 "2020-06-24T17:24:34Z")
This might very well fall outside of the scope of this forum but I hope someone might have a good idea. Currently we have 10 screens displaying Kibana dashboards across the office, all connected with separate Chromebit … --- ## [Why Is My Bucket Not In Descending Order?](https://discuss.elastic.co/t/why-is-my-bucket-not-in-descending-order/238199)
**Author:** [@Ethan777100](https://discuss.elastic.co/u/Ethan777100)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 4:40pm UTC](https://discuss.elastic.co/t/why-is-my-bucket-not-in-descending-order/238199 "2020-06-24T16:40:37Z")
I clearly sorted my bucket (in green bar) in descending order, why is the result not in descending order then? --- ## [How to use regex function on kibana for Ordered Search / match multiple keyword(sentence)?](https://discuss.elastic.co/t/how-to-use-regex-function-on-kibana-for-ordered-search-match-multiple-keyword-sentence/238174)
**Author:** [@nagmawan](https://discuss.elastic.co/u/nagmawan)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 4:34pm UTC](https://discuss.elastic.co/t/how-to-use-regex-function-on-kibana-for-ordered-search-match-multiple-keyword-sentence/238174 "2020-06-24T16:34:23Z")
Hi, Sorry i'm beginner in kibana. I will ask something about search, and will this work on kibana? I want to use the regex function with the goal to order search / matching 2 sentences or maybe more in just 1 field. I … --- ## [ES/Spark RDD Partitioning Strangeness](https://discuss.elastic.co/t/es-spark-rdd-partitioning-strangeness/238312)
**Author:** [@ikiril01](https://discuss.elastic.co/u/ikiril01)\ **Replies:** 3\ **Last updated:** [June 24, 2020, 4:33pm UTC](https://discuss.elastic.co/t/es-spark-rdd-partitioning-strangeness/238312 "2020-06-24T16:33:13Z")
We're using the es-hadoop connector to dump data from an ES index to spark (w/ pyspark, newAPIHadoopRDD). The issue we're seeing is that the RDD that is returned is skewed in terms of partitions - it always returns 9 par… --- ## [Kibana server is not starting](https://discuss.elastic.co/t/kibana-server-is-not-starting/238412)
**Author:** [@sid99](https://discuss.elastic.co/u/sid99)\ **Replies:** 4\ **Last updated:** [June 24, 2020, 4:32pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-starting/238412 "2020-06-24T16:32:49Z")
I am getting the above error logs. What should I do to start Kibana? --- ## [How speed index](https://discuss.elastic.co/t/how-speed-index/238484)
**Author:** [@livetech](https://discuss.elastic.co/u/livetech)\ **Replies:** 3\ **Last updated:** [June 24, 2020, 3:40pm UTC](https://discuss.elastic.co/t/how-speed-index/238484 "2020-06-24T15:40:46Z")
My server have 48gb ram and 500GB free space, digital ocean server very strong cpu how to configure yaml to speed index, please someone give me an example. --- ## [Lens — request for improvement](https://discuss.elastic.co/t/lens-request-for-improvement/238285)
**Author:** [@artobstrel](https://discuss.elastic.co/u/artobstrel)\ **Replies:** 3\ **Last updated:** [June 24, 2020, 4:01pm UTC](https://discuss.elastic.co/t/lens-request-for-improvement/238285 "2020-06-24T16:01:59Z")
Lens is beautiful, but so far it has a lot of flaws, for example: Colors cannot be changed X/Y-axis labels can't be renamed or removed (1-2) Legend cannot be hidden (3) Very disappointing :sleepy: --- ## [Collect the nested fields](https://discuss.elastic.co/t/collect-the-nested-fields/238528)
**Author:** [@aviman](https://discuss.elastic.co/u/aviman)\ **Replies:** 0\ **Last updated:** [June 24, 2020, 3:54pm UTC](https://discuss.elastic.co/t/collect-the-nested-fields/238528 "2020-06-24T15:54:38Z")
Hi, How can I collect the nested fields names only: "variable" : { "XX" : { "value" : "1" }, "YY" : { "value" : "2" } How can i extract the nested filed names "XX" & "YY" using painless script --- ## [Aggregating (count) by regex](https://discuss.elastic.co/t/aggregating-count-by-regex/238281)
**Author:** [@Luciano\_Borges](https://discuss.elastic.co/u/Luciano_Borges)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 3:51pm UTC](https://discuss.elastic.co/t/aggregating-count-by-regex/238281 "2020-06-24T15:51:10Z")
I have some data that I'd like to do a regex of a field and then an aggregation (count) of the results of that regex'd field. For instance: Data: GET system/path\_param/1234567/00?query\_param=xpto HTTP/1.1 GET system/p… --- ## [Index lifecycle error - '^.\*-\\d+$'](https://discuss.elastic.co/t/index-lifecycle-error-d/238515)
**Author:** [@Jasperdb5](https://discuss.elastic.co/u/Jasperdb5)\ **Replies:** 2\ **Last updated:** [June 24, 2020, 3:48pm UTC](https://discuss.elastic.co/t/index-lifecycle-error-d/238515 "2020-06-24T15:48:50Z")
Hi there, My Index-Lifecycle management functionality is not working as I would expect. The ILM is trying to roll-over the following indexes, but I'm getting the following error. illegal\_argument\_exception: index name… --- ## [Cannot connect to the elsaticserach cluster currently configured for kibana](https://discuss.elastic.co/t/cannot-connect-to-the-elsaticserach-cluster-currently-configured-for-kibana/238303)
**Author:** [@Dublin\_2020](https://discuss.elastic.co/u/Dublin_2020)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 3:46pm UTC](https://discuss.elastic.co/t/cannot-connect-to-the-elsaticserach-cluster-currently-configured-for-kibana/238303 "2020-06-24T15:46:55Z")
Hi Team , we have two kibana dashboards on two different load balancers ., currently i am getting the error 'Cannot connect to the ealsticsearch cluster currently configured for kibana . Can you please help on this --- ## [Could not index event to Elasticsearch.Rejecting mapping update to \[\] as the final mapping would have more than 1 type: \[\_doc,syslog\]](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-rejecting-mapping-update-to-as-the-final-mapping-would-have-more-than-1-type-doc-syslog/238326)
**Author:** [@cezar996](https://discuss.elastic.co/u/cezar996)\ **Replies:** 2\ **Last updated:** [June 24, 2020, 3:44pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-rejecting-mapping-update-to-as-the-final-mapping-would-have-more-than-1-type-doc-syslog/238326 "2020-06-24T15:44:52Z")
Hello everybody! I get the following error when I try to send syslog data to Elasticsearch Index: \[logstash.outputs.elasticsearch\] Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>nil, :… --- ## [Centralize Kafka input settings](https://discuss.elastic.co/t/centralize-kafka-input-settings/238496)
**Author:** [@YvorL](https://discuss.elastic.co/u/YvorL)\ **Replies:** 2\ **Last updated:** [June 24, 2020, 3:40pm UTC](https://discuss.elastic.co/t/centralize-kafka-input-settings/238496 "2020-06-24T15:40:43Z")
Hi, Is there a way to refer to one file in my Logstash configuration files where I put all Kafka input general settings and avoid flooding (20 rows that are the same) each pipeline? Thank you! --- ## [How to integrate ELK with ArcSight](https://discuss.elastic.co/t/how-to-integrate-elk-with-arcsight/236762)
**Author:** [@cezar996](https://discuss.elastic.co/u/cezar996)\ **Replies:** 4\ **Last updated:** [June 24, 2020, 3:36pm UTC](https://discuss.elastic.co/t/how-to-integrate-elk-with-arcsight/236762 "2020-06-24T15:36:32Z")
Hello everybody! I have installed ELK 7.6.2 and I want to get logs from ArcSight SIEM. In order to do this I configured a forward connector which sends all events in Syslog CEF format on port 5000 TCP, as described here… --- ## [How to use Logstash and ElasticSearch to Index 'transactionID' from 'message' while keeping original 'message' intact](https://discuss.elastic.co/t/how-to-use-logstash-and-elasticsearch-to-index-transactionid-from-message-while-keeping-original-message-intact/237503)
**Author:** [@jibitgeorge](https://discuss.elastic.co/u/jibitgeorge)\ **Replies:** 3\ **Last updated:** [June 24, 2020, 3:27pm UTC](https://discuss.elastic.co/t/how-to-use-logstash-and-elasticsearch-to-index-transactionid-from-message-while-keeping-original-message-intact/237503 "2020-06-24T15:27:00Z")
I already have ELK setup for my Java application and I'm able to see the logs in Kibana. I have a field called 'message' in which I have a string called transactionID and a value assoicated with it (eg: transactionID:73… --- ## [Using The Advanced JSON Input For Filtering Data and Then Using The Intermediate Result As Part Of Calculations](https://discuss.elastic.co/t/using-the-advanced-json-input-for-filtering-data-and-then-using-the-intermediate-result-as-part-of-calculations/237556)
**Author:** [@Ethan777100](https://discuss.elastic.co/u/Ethan777100)\ **Replies:** 7\ **Last updated:** [June 24, 2020, 3:26pm UTC](https://discuss.elastic.co/t/using-the-advanced-json-input-for-filtering-data-and-then-using-the-intermediate-result-as-part-of-calculations/237556 "2020-06-24T15:26:22Z")
Hi, I made an earlier post on filtering the data within +/-300. I want to Do an on-the-spot filtering of values that are within +/-300mm per data bucket. Log this as a count per data bucket. Do a percentage calcula… --- ## [On average, what should we expect in query performance for nodes and core variations?](https://discuss.elastic.co/t/on-average-what-should-we-expect-in-query-performance-for-nodes-and-core-variations/237512)
**Author:** [@spdoes](https://discuss.elastic.co/u/spdoes)\ **Replies:** 4\ **Last updated:** [June 24, 2020, 3:21pm UTC](https://discuss.elastic.co/t/on-average-what-should-we-expect-in-query-performance-for-nodes-and-core-variations/237512 "2020-06-24T15:21:13Z")
Doubling the number of cores in rough average means reducing in half the query time ? (from 6 to 12 in my case) Doubling the number of nodes in rough average means reducing in half the query time ? (from 1 to 2 and … --- ## [Getting spans documents from filtered transactions](https://discuss.elastic.co/t/getting-spans-documents-from-filtered-transactions/236392)
**Author:** [@sannti](https://discuss.elastic.co/u/sannti)\ **Replies:** 3\ **Last updated:** [June 24, 2020, 3:18pm UTC](https://discuss.elastic.co/t/getting-spans-documents-from-filtered-transactions/236392 "2020-06-24T15:18:29Z")
Hi guys! I'm working with Kibana Dashboard, and i want to create a visualization or saved search with all spans parent from the transactions that i'm filtering. Is this posible? For example, let's supose that i filter … --- ## [Number Format and Rupee](https://discuss.elastic.co/t/number-format-and-rupee/236671)
**Author:** [@balaji\_18](https://discuss.elastic.co/u/balaji_18)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 2:55pm UTC](https://discuss.elastic.co/t/number-format-and-rupee/236671 "2020-06-24T14:55:08Z")
Is there any way to change the $ format into ₹ format ... Thank you! Please help me out --- ## [Logstash can't handle large messages](https://discuss.elastic.co/t/logstash-cant-handle-large-messages/238499)
**Author:** [@rzwarts](https://discuss.elastic.co/u/rzwarts)\ **Replies:** 3\ **Last updated:** [June 24, 2020, 2:52pm UTC](https://discuss.elastic.co/t/logstash-cant-handle-large-messages/238499 "2020-06-24T14:52:22Z")
Hi all, I'm having an issue with logstash and large syslog messages. I am using logstash 7.8 and a json template to get the files sent from rsyslog to logstash. But some messages are too long and completely crash the se… --- ## [How to use ES API to implement prometheus increase function](https://discuss.elastic.co/t/how-to-use-es-api-to-implement-prometheus-increase-function/238507)
**Author:** [@Roy\_Zhang](https://discuss.elastic.co/u/Roy_Zhang)\ **Replies:** 0\ **Last updated:** [June 24, 2020, 2:51pm UTC](https://discuss.elastic.co/t/how-to-use-es-api-to-implement-prometheus-increase-function/238507 "2020-06-24T14:51:49Z")
Dear Elastic search experts, I am using metricBeat to streaming data from prometheus to ES. I have a requirement to implement prometheus increase function. The definition of increase function in prometheus: The follow… --- ## [QUESTION : Disable access to Kibana Console when using ELK inside a webapp](https://discuss.elastic.co/t/question-disable-access-to-kibana-console-when-using-elk-inside-a-webapp/236938)
**Author:** [@tenet\_testuser1](https://discuss.elastic.co/u/tenet_testuser1)\ **Replies:** 8\ **Last updated:** [June 24, 2020, 2:49pm UTC](https://discuss.elastic.co/t/question-disable-access-to-kibana-console-when-using-elk-inside-a-webapp/236938 "2020-06-24T14:49:54Z")
Need some proper guidance on setting up security in ELK. Problem Definition: I have a webapp that will display Kibana reports and dashbaords. The ""iframe" url is embedded to various menu/submenu in my app that will di… --- ## [Logstash ssl-tcp configuration syslog output](https://discuss.elastic.co/t/logstash-ssl-tcp-configuration-syslog-output/238349)
**Author:** [@bambam](https://discuss.elastic.co/u/bambam)\ **Replies:** 6\ **Last updated:** [June 24, 2020, 2:44pm UTC](https://discuss.elastic.co/t/logstash-ssl-tcp-configuration-syslog-output/238349 "2020-06-24T14:44:56Z")
Hello, I'm trying to forward messages from Logstash to an external syslog server (Qradar). I need to use ssl-tcp, for the external connection only not the connection to Elasticsearch. I can't find any documentation on h… --- ## [Facet operator doesn't work in Kibana Vega](https://discuss.elastic.co/t/facet-operator-doesnt-work-in-kibana-vega/237753)
**Author:** [@marrel](https://discuss.elastic.co/u/marrel)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 2:44pm UTC](https://discuss.elastic.co/t/facet-operator-doesnt-work-in-kibana-vega/237753 "2020-06-24T14:44:26Z")
Hello!! :wave: I have found that not all Multi-View Displays, such as Faceting (Trellis Plot / Small Multiples), work properly in Kibana Vega. To be more specific, for example I am running the following code in vega vi… --- ## [Relevancy - how this is calculated](https://discuss.elastic.co/t/relevancy-how-this-is-calculated/238504)
**Author:** [@nages](https://discuss.elastic.co/u/nages)\ **Replies:** 0\ **Last updated:** [June 24, 2020, 2:42pm UTC](https://discuss.elastic.co/t/relevancy-how-this-is-calculated/238504 "2020-06-24T14:42:06Z")
I had the following documents indexed PUT ecommercesite/product/2 { "product\_name": "Men Water Resistant Jacket", "description": "Provides comfort during biking and hiking", } when I tried to get the scoring fo… --- ## [TSVB: Create time series graph which based on latest document in each bucket](https://discuss.elastic.co/t/tsvb-create-time-series-graph-which-based-on-latest-document-in-each-bucket/235640)
**Author:** [@ofirsa](https://discuss.elastic.co/u/ofirsa)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 2:41pm UTC](https://discuss.elastic.co/t/tsvb-create-time-series-graph-which-based-on-latest-document-in-each-bucket/235640 "2020-06-24T14:41:56Z")
Hi All. I need your help, I just started working with Elasticsearch and Kibana. I have an Index with the following mapping: { "mapping": { "\_doc": { "properties": { "pending\_tasks": { "ty… --- ## [Get first two octets of IP address](https://discuss.elastic.co/t/get-first-two-octets-of-ip-address/238361)
**Author:** [@Leo\_Kwok](https://discuss.elastic.co/u/Leo_Kwok)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 2:15pm UTC](https://discuss.elastic.co/t/get-first-two-octets-of-ip-address/238361 "2020-06-24T14:15:20Z")
Hi, I only need the first two octet of IP address, for example, only 91.255 for IP 91.225.201.1. Please advise how to get this in logstash filter. Thanks, Leo --- ## [DLQ - Managing Dead Letter Queue Size- To /dev/null?](https://discuss.elastic.co/t/dlq-managing-dead-letter-queue-size-to-dev-null/238162)
**Author:** [@scott\_stash](https://discuss.elastic.co/u/scott_stash)\ **Replies:** 3\ **Last updated:** [June 24, 2020, 2:06pm UTC](https://discuss.elastic.co/t/dlq-managing-dead-letter-queue-size-to-dev-null/238162 "2020-06-24T14:06:39Z")
Looking through the DLQ docs https://www.elastic.co/guide/en/logstash/current/dead-letter-queues.html it looks like I can set a maximum size for each DLQ file, but it sounds like the rollover will just create a new file. … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1974) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1976)