# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=876 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 877 --- ## [Logstash parsing XML failing on second and subsequent records](https://discuss.elastic.co/t/logstash-parsing-xml-failing-on-second-and-subsequent-records/308905)
**Author:** [@Gerrard](https://discuss.elastic.co/u/Gerrard)\ **Replies:** 2\ **Last updated:** [July 5, 2022, 2:54pm UTC](https://discuss.elastic.co/t/logstash-parsing-xml-failing-on-second-and-subsequent-records/308905 "2022-07-05T14:54:55Z")
Hi, I'm struggling to understand why logstash is unable to process any records beyond the first in my XML log file. The first record is parsed fine, but then any following ones get the "\_xmlparsefailure" tag. My log fil… --- ## [Spark write to es thrown 'FORBIDDEN/12/index read-only'](https://discuss.elastic.co/t/spark-write-to-es-thrown-forbidden-12-index-read-only/308923)
**Author:** [@jimi\_feng](https://discuss.elastic.co/u/jimi_feng)\ **Replies:** 2\ **Last updated:** [July 5, 2022, 2:22pm UTC](https://discuss.elastic.co/t/spark-write-to-es-thrown-forbidden-12-index-read-only/308923 "2022-07-05T14:22:41Z")
Hi team, i meet some problem, when i write data from spark streaming to elasticsearch, there throw \[FORBIDDEN/12/index read-only / allow delete (api)\], i though may caused by low disk space, so i chekced node stat: http… --- ## [Logstash 'file\_chunk\_size'](https://discuss.elastic.co/t/logstash-file-chunk-size/308659)
**Author:** [@ChinigamiHunter](https://discuss.elastic.co/u/ChinigamiHunter)\ **Replies:** 3\ **Last updated:** [July 5, 2022, 2:23pm UTC](https://discuss.elastic.co/t/logstash-file-chunk-size/308659 "2022-07-05T14:23:06Z")
hi all, i have some files in a folder and i want to index them in Elasticsearch using logstash. some of the files are indexed, but i get a lot of this error i don't know why : \[2022-06-30T16:15:24,966\]\[INFO \]\[filewatc… --- ## [Send only one field in pipeline to pipeline communication](https://discuss.elastic.co/t/send-only-one-field-in-pipeline-to-pipeline-communication/308002)
**Author:** [@Laetitia\_RICHARD](https://discuss.elastic.co/u/Laetitia_RICHARD)\ **Replies:** 9\ **Last updated:** [July 5, 2022, 2:17pm UTC](https://discuss.elastic.co/t/send-only-one-field-in-pipeline-to-pipeline-communication/308002 "2022-07-05T14:17:08Z")
Hello, I'd like my 1st pipeline to send the event to an Elasticsearch output and only a field's event to the input of a 2nd pipeline. Is it possible to send only one field in a pipeline and not a complete event? --- ## [Installing Mapper Size Plugin on Elastic Cloud](https://discuss.elastic.co/t/installing-mapper-size-plugin-on-elastic-cloud/308872)
**Author:** [@pablo\_diez](https://discuss.elastic.co/u/pablo_diez)\ **Replies:** 2\ **Last updated:** [July 5, 2022, 2:12pm UTC](https://discuss.elastic.co/t/installing-mapper-size-plugin-on-elastic-cloud/308872 "2022-07-05T14:12:27Z")
Good morning, I am trying to install the Mapper Size Plugin on ElasticSearch Cloud, but I dont know where or how to begin since the server is managed by Elastic directly. Is there any way to install it through Kibana o… --- ## [Regarding if else condition for grok filter](https://discuss.elastic.co/t/regarding-if-else-condition-for-grok-filter/308863)
**Author:** [@suresh\_u](https://discuss.elastic.co/u/suresh_u)\ **Replies:** 5\ **Last updated:** [July 5, 2022, 2:11pm UTC](https://discuss.elastic.co/t/regarding-if-else-condition-for-grok-filter/308863 "2022-07-05T14:11:39Z")
Hi @sudhagar\_ramesh @Badger I have 1 date field in my oracle db. If the date field value is empty then I am getting grokparsefailure error as I am doing grok on that value. I need to put 1 condition like if date is nil… --- ## [How to stop logstash using default address when using pipeline](https://discuss.elastic.co/t/how-to-stop-logstash-using-default-address-when-using-pipeline/308922)
**Author:** [@michael.rhys](https://discuss.elastic.co/u/michael.rhys)\ **Replies:** 0\ **Last updated:** [July 5, 2022, 2:00pm UTC](https://discuss.elastic.co/t/how-to-stop-logstash-using-default-address-when-using-pipeline/308922 "2022-07-05T14:00:06Z")
I am configuring logstash inside kubernetes using the pipeline and it is connecting to my central elk stack fine. However not only is it connecting to the ELK Host I specify it is repeatedly trying to contact http://ela… --- ## [How to iterate through multiple records and create notification for each record?](https://discuss.elastic.co/t/how-to-iterate-through-multiple-records-and-create-notification-for-each-record/308887)
**Author:** [@chsasm](https://discuss.elastic.co/u/chsasm)\ **Replies:** 0\ **Last updated:** [July 5, 2022, 9:44am UTC](https://discuss.elastic.co/t/how-to-iterate-through-multiple-records-and-create-notification-for-each-record/308887 "2022-07-05T09:44:12Z")
Hi All, I am trying to implement a Watcher alert for error scenarios. I have a use-case where the 1st search query will retrieve all the failure records from Kibana index. I would like to iterate through each retrieve… --- ## [Regular expression query](https://discuss.elastic.co/t/regular-expression-query/308865)
**Author:** [@Krishna\_Sai\_Nag\_G](https://discuss.elastic.co/u/Krishna_Sai_Nag_G)\ **Replies:** 1\ **Last updated:** [July 5, 2022, 1:17pm UTC](https://discuss.elastic.co/t/regular-expression-query/308865 "2022-07-05T13:17:05Z")
Hi, i have data as below in my elastic 'My ORDER NO. 013-2009-01 and the order date is March 11, 2009 and delivered date is 13-03-2009 and the product id is B-43.' I am using regular expression query to get the data fr… --- ## [Json input script for converting bytes to GB and percentage?](https://discuss.elastic.co/t/json-input-script-for-converting-bytes-to-gb-and-percentage/308862)
**Author:** [@jisha](https://discuss.elastic.co/u/jisha)\ **Replies:** 1\ **Last updated:** [July 5, 2022, 1:06pm UTC](https://discuss.elastic.co/t/json-input-script-for-converting-bytes-to-gb-and-percentage/308862 "2022-07-05T13:06:44Z")
Hi , I want to convert memory size and cpu usage into GB in dashboard , please help me with json input script for that --- ## [Kibana error](https://discuss.elastic.co/t/kibana-error/308861)
**Author:** [@tharunkumar](https://discuss.elastic.co/u/tharunkumar)\ **Replies:** 1\ **Last updated:** [July 5, 2022, 1:05pm UTC](https://discuss.elastic.co/t/kibana-error/308861 "2022-07-05T13:05:11Z")
Hi i am facing this error while starting the kibana service.can you provide me the solution \[fatal\]\[root\] Error: Unable to complete saved object migrations for the \[.kibana\_task\_manager\] index: Unable to complete the OU… --- ## [How to change memory, disk space into GB and %](https://discuss.elastic.co/t/how-to-change-memory-disk-space-into-gb-and/308855)
**Author:** [@jisha](https://discuss.elastic.co/u/jisha)\ **Replies:** 1\ **Last updated:** [July 5, 2022, 1:01pm UTC](https://discuss.elastic.co/t/how-to-change-memory-disk-space-into-gb-and/308855 "2022-07-05T13:01:37Z")
Hi, i have to change disk space in bytes into GB and % .i tried by changing the fields into bytes, pct, size etc but its showing up as bytes only. --- ## [Count API with track\_total\_hits](https://discuss.elastic.co/t/count-api-with-track-total-hits/308912)
**Author:** [@James\_Conkling](https://discuss.elastic.co/u/James_Conkling)\ **Replies:** 0\ **Last updated:** [July 5, 2022, 12:54pm UTC](https://discuss.elastic.co/t/count-api-with-track-total-hits/308912 "2022-07-05T12:54:07Z")
While the search API has the track\_total\_hits optimization to approximate search hit count, I noticed the count API does not. If I am only looking for the approximate hit count, is it more performant to use the search A… --- ## [Configuration ingest from file](https://discuss.elastic.co/t/configuration-ingest-from-file/308910)
**Author:** [@mololkin.kirill.mol](https://discuss.elastic.co/u/mololkin.kirill.mol)\ **Replies:** 1\ **Last updated:** [July 5, 2022, 12:53pm UTC](https://discuss.elastic.co/t/configuration-ingest-from-file/308910 "2022-07-05T12:53:06Z")
Hello is there an opportunity for configuration ingest pipelines with elasticsearch.yaml? --- ## [How to use filter on a column if it's from a nested field on Kibana Canvas?](https://discuss.elastic.co/t/how-to-use-filter-on-a-column-if-its-from-a-nested-field-on-kibana-canvas/308763)
**Author:** [@Gvinfinity](https://discuss.elastic.co/u/Gvinfinity)\ **Replies:** 1\ **Last updated:** [July 5, 2022, 12:46pm UTC](https://discuss.elastic.co/t/how-to-use-filter-on-a-column-if-its-from-a-nested-field-on-kibana-canvas/308763 "2022-07-05T12:46:09Z")
Whenever I use a filter, be it a dropdown or time filter on a column that is from a nested field no data, even data that match the filter, appears in data tables. Is there another way to do this that I'm not aware of? --- ## [Get list of current hot indexes in elasticSearch](https://discuss.elastic.co/t/get-list-of-current-hot-indexes-in-elasticsearch/308870)
**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\ **Replies:** 2\ **Last updated:** [July 5, 2022, 12:42pm UTC](https://discuss.elastic.co/t/get-list-of-current-hot-indexes-in-elasticsearch/308870 "2022-07-05T12:42:41Z")
Hi, Currently I am getting list of current hot indexes through Low Level Client: Request request = new Request("GET", "/\_cat/aliases/" + ALIAS\_NAME+ "?format=json&s=is\_write\_index:desc,"); Is there a way to get list… --- ## [Can we use wildcard in the field\_name or Can we apply condition in fields block inside query\_string](https://discuss.elastic.co/t/can-we-use-wildcard-in-the-field-name-or-can-we-apply-condition-in-fields-block-inside-query-string/308904)
**Author:** [@deepak\_prem](https://discuss.elastic.co/u/deepak_prem)\ **Replies:** 0\ **Last updated:** [July 5, 2022, 11:56am UTC](https://discuss.elastic.co/t/can-we-use-wildcard-in-the-field-name-or-can-we-apply-condition-in-fields-block-inside-query-string/308904 "2022-07-05T11:56:30Z")
Hi friends, I have the following questions related to the Elasticsearch:- I want to know Can we use the wildcard in the fields name in term block in the query, if not is there any alternate way to achieve this.like In … --- ## [Help me to parse a string to fields (grok)](https://discuss.elastic.co/t/help-me-to-parse-a-string-to-fields-grok/308903)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 0\ **Last updated:** [July 5, 2022, 11:53am UTC](https://discuss.elastic.co/t/help-me-to-parse-a-string-to-fields-grok/308903 "2022-07-05T11:53:05Z")
Hi folks, I have following key: key = "value1/value2/value3" or key = "value1/value2/value3/value4" I want to split this to following structure: key1: value1 key2: value2 key3: value3 This would be easy by using a… --- ## [Authentication of my Python Script Elasticsearch 8.3](https://discuss.elastic.co/t/authentication-of-my-python-script-elasticsearch-8-3/308901)
**Author:** [@V\_o](https://discuss.elastic.co/u/V_o)\ **Replies:** 0\ **Last updated:** [July 5, 2022, 11:40am UTC](https://discuss.elastic.co/t/authentication-of-my-python-script-elasticsearch-8-3/308901 "2022-07-05T11:40:46Z")
Hello, since Elasticsearch version 8... my Python scrips, which are sending Data to Elasticsearch are no longer working. I tried solving this Problem by using this code. client = Elasticsearch( "https://localhost:… --- ## [Http Request from painless script not working](https://discuss.elastic.co/t/http-request-from-painless-script-not-working/308876)
**Author:** [@mukesh\_154](https://discuss.elastic.co/u/mukesh_154)\ **Replies:** 0\ **Last updated:** [July 5, 2022, 9:05am UTC](https://discuss.elastic.co/t/http-request-from-painless-script-not-working/308876 "2022-07-05T09:05:20Z")
I want to create a runtime field based on some conditions. And i have a query which is working fine on kibana console. I implemented the same query on java code but is not working. There is a method in SearchRequest run… --- ## [Very uncommon things happening with 7.17.0 ELK Cluster](https://discuss.elastic.co/t/very-uncommon-things-happening-with-7-17-0-elk-cluster/308664)
**Author:** [@Ravi\_S1](https://discuss.elastic.co/u/Ravi_S1)\ **Replies:** 6\ **Last updated:** [July 5, 2022, 11:05am UTC](https://discuss.elastic.co/t/very-uncommon-things-happening-with-7-17-0-elk-cluster/308664 "2022-07-05T11:05:07Z")
I have been observing that ELK 7.17.0 version is playing with my time & efforts. As i can observe, after changes happen in heap memory of ELK pods, have been observed that all thread pools are automatically consuming hi… --- ## [HTTP request from Painless script?](https://discuss.elastic.co/t/http-request-from-painless-script/308884)
**Author:** [@kennyprisjakt](https://discuss.elastic.co/u/kennyprisjakt)\ **Replies:** 2\ **Last updated:** [July 5, 2022, 10:19am UTC](https://discuss.elastic.co/t/http-request-from-painless-script/308884 "2022-07-05T10:19:59Z")
Hey, I'm currently looking for a way to do HTTP requests from a Painless script. Is that possible? Because i have not seen any examples of it when searching for it. Use case: Basically what i'm trying to do is runtim… --- ## [How to translate my sql query into es-sql?](https://discuss.elastic.co/t/how-to-translate-my-sql-query-into-es-sql/308890)
**Author:** [@josephLiu](https://discuss.elastic.co/u/josephLiu)\ **Replies:** 0\ **Last updated:** [July 5, 2022, 9:57am UTC](https://discuss.elastic.co/t/how-to-translate-my-sql-query-into-es-sql/308890 "2022-07-05T09:57:35Z")
I want to query the data I need In SQL Server I can query like this select UniqueAuditRecord from dbo.kibanaLog group by UniqueAuditRecord having count(\*) =1 and MAX(timestamp) \<(select max(timestamp) from dbo.kibana… --- ## [Partial update in a rolled-over index](https://discuss.elastic.co/t/partial-update-in-a-rolled-over-index/308885)
**Author:** [@Robina\_Dhingra1](https://discuss.elastic.co/u/Robina_Dhingra1)\ **Replies:** 0\ **Last updated:** [July 5, 2022, 9:39am UTC](https://discuss.elastic.co/t/partial-update-in-a-rolled-over-index/308885 "2022-07-05T09:39:09Z")
We're using datetime based index with an alias that is rolled over to a new index daily. We managed to achieve this by creating an ingest pipeline that figures out the physical index behind an alias and updates(read repl… --- ## [Sending data to Logstash TCP](https://discuss.elastic.co/t/sending-data-to-logstash-tcp/308879)
**Author:** [@Johnnyboi](https://discuss.elastic.co/u/Johnnyboi)\ **Replies:** 0\ **Last updated:** [July 5, 2022, 9:15am UTC](https://discuss.elastic.co/t/sending-data-to-logstash-tcp/308879 "2022-07-05T09:15:51Z")
So I have logstash configured like this: input: tcp { port =\> 5401 } output: stdout { codec =\> rubydebug } When I try to connect to the port via browser, I can see the connection incoming in logstash lo… --- ## [Index not appearing in kibana via logstash](https://discuss.elastic.co/t/index-not-appearing-in-kibana-via-logstash/308178)
**Author:** [@bhatiac](https://discuss.elastic.co/u/bhatiac)\ **Replies:** 7\ **Last updated:** [July 5, 2022, 6:27am UTC](https://discuss.elastic.co/t/index-not-appearing-in-kibana-via-logstash/308178 "2022-07-05T06:27:31Z")
Hello, I am new to ELK, trying to read my application logs and wishing to show it on kibana dashboard for analysis purposes. Elasticsearch, kibana and logstash instances are up and running. While trying to see the newly… --- ## [To set a daily time range in kibana](https://discuss.elastic.co/t/to-set-a-daily-time-range-in-kibana/308738)
**Author:** [@hadi\_farzipour](https://discuss.elastic.co/u/hadi_farzipour)\ **Replies:** 1\ **Last updated:** [July 5, 2022, 9:03am UTC](https://discuss.elastic.co/t/to-set-a-daily-time-range-in-kibana/308738 "2022-07-05T09:03:35Z")
I am using ELK stack 7.6.1 to store and retrieve daily logs. I want to created a visualize(table) to show all daily logs between 00:00am to 10:00am automatically. while in the time span there is no option to select daily… --- ## [Elasticsearch Apply filters with results from aggregations](https://discuss.elastic.co/t/elasticsearch-apply-filters-with-results-from-aggregations/308744)
**Author:** [@Eddie\_Vuong](https://discuss.elastic.co/u/Eddie_Vuong)\ **Replies:** 7\ **Last updated:** [July 5, 2022, 8:53am UTC](https://discuss.elastic.co/t/elasticsearch-apply-filters-with-results-from-aggregations/308744 "2022-07-05T08:53:37Z")
Is there anyway I can using the results obtained from aggregations to filter out the final hits in the query? I want to obtain a list of users who have more than 2 devices and the list of their devices in the database. … --- ## [Remove Special character from message before sending to json filter](https://discuss.elastic.co/t/remove-special-character-from-message-before-sending-to-json-filter/308434)
**Author:** [@Basel](https://discuss.elastic.co/u/Basel)\ **Replies:** 4\ **Last updated:** [July 5, 2022, 8:10am UTC](https://discuss.elastic.co/t/remove-special-character-from-message-before-sending-to-json-filter/308434 "2022-07-05T08:10:46Z")
Hi, we are using ELK with Apigee to send the transaction logs, the logstash configuration is as recommended by the community as below: input { tcp { port =\> 8080 type =\> syslog } } filter { m… --- ## [Sort ctx.payload using Transformed field](https://discuss.elastic.co/t/sort-ctx-payload-using-transformed-field/308869)
**Author:** [@M.Naim](https://discuss.elastic.co/u/M.Naim)\ **Replies:** 0\ **Last updated:** [July 5, 2022, 7:59am UTC](https://discuss.elastic.co/t/sort-ctx-payload-using-transformed-field/308869 "2022-07-05T07:59:03Z")
I want to sort the email content of watcher based on transformed field,consider "HoursDelayed": from example below Any Idea ? "send\_email": { "transform": { "script": { "source": """ … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=875) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=877)