# Latest **URL:** https://discuss.elastic.co/latest.md?page=1550 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1551 --- ## [Problems with error "File was truncated. Begin reading file from offset 0"](https://discuss.elastic.co/t/problems-with-error-file-was-truncated-begin-reading-file-from-offset-0/279959)
**Author:** [@mark\_vr](https://discuss.elastic.co/u/mark_vr)\ **Replies:** 4\ **Last updated:** [July 29, 2021, 5:32pm UTC](https://discuss.elastic.co/t/problems-with-error-file-was-truncated-begin-reading-file-from-offset-0/279959 "2021-07-29T17:32:17Z")
We use Azure Kubernetes Service, and our HTTP logs are written by the loadbalancer (ingress) to shared Azure storage. I'd like to read these logs and import them to Elasticsearch. I realise reading from shared storage … --- ## [Add geo point in Elastic](https://discuss.elastic.co/t/add-geo-point-in-elastic/280005)
**Author:** [@klynxe](https://discuss.elastic.co/u/klynxe)\ **Replies:** 0\ **Last updated:** [July 29, 2021, 4:52pm UTC](https://discuss.elastic.co/t/add-geo-point-in-elastic/280005 "2021-07-29T16:52:17Z")
Hi everyone, I use ELK and filebeat. I send a lot of logs with different fields. logstash config: input { beats { port =\> 5044 include\_codec\_tag =\> false } } filter { if \[type\] == "json" { j… --- ## [Logstash file input - output to different indices](https://discuss.elastic.co/t/logstash-file-input-output-to-different-indices/279906)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 4\ **Last updated:** [July 29, 2021, 4:02pm UTC](https://discuss.elastic.co/t/logstash-file-input-output-to-different-indices/279906 "2021-07-29T16:02:46Z")
Hello All, I am running ELK 7.6.2 stack. In my current set up, a single file gets ingested in logstash and creates an index successfully as below (only relevant part shown): input { file { path =\> "/opt/gtal/ita… --- ## [Dynamically show or hide visualisation using control](https://discuss.elastic.co/t/dynamically-show-or-hide-visualisation-using-control/278883)
**Author:** [@antongb](https://discuss.elastic.co/u/antongb)\ **Replies:** 2\ **Last updated:** [July 29, 2021, 3:37pm UTC](https://discuss.elastic.co/t/dynamically-show-or-hide-visualisation-using-control/278883 "2021-07-29T15:37:48Z")
Hi, I'm using a pie chart to display the % of counts of items from different categories. However, I don't want to display the chart until a category is first chosen from an options control. E.g. there are 2 categories:… --- ## [Elasticsearch query to return all records](https://discuss.elastic.co/t/elasticsearch-query-to-return-all-records/279998)
**Author:** [@varsha\_dusa](https://discuss.elastic.co/u/varsha_dusa)\ **Replies:** 1\ **Last updated:** [July 29, 2021, 3:27pm UTC](https://discuss.elastic.co/t/elasticsearch-query-to-return-all-records/279998 "2021-07-29T15:27:21Z")
I have a small database in Elasticsearch and for testing purposes would like to pull all records back. I am attempting to use a URL of the form... http://localhost:9200/foo/\_search?pretty=true&q={'matchAll':{''}} Can s… --- ## [Combine 2 types of panels](https://discuss.elastic.co/t/combine-2-types-of-panels/279983)
**Author:** [@AlexM566](https://discuss.elastic.co/u/AlexM566)\ **Replies:** 2\ **Last updated:** [July 29, 2021, 3:23pm UTC](https://discuss.elastic.co/t/combine-2-types-of-panels/279983 "2021-07-29T15:23:12Z")
Hello guys, Is there possible to combine 2 visualization in 1 (like in the image below ). So I have vertical bar visualization of data and I want to add a line visualization over that. I have to mention that the data… --- ## [How to read local0.info and local4.info file content in UNIX server using filebeat configuration](https://discuss.elastic.co/t/how-to-read-local0-info-and-local4-info-file-content-in-unix-server-using-filebeat-configuration/280000)
**Author:** [@muralikrishna](https://discuss.elastic.co/u/muralikrishna)\ **Replies:** 1\ **Last updated:** [July 29, 2021, 3:18pm UTC](https://discuss.elastic.co/t/how-to-read-local0-info-and-local4-info-file-content-in-unix-server-using-filebeat-configuration/280000 "2021-07-29T15:18:07Z")
Hello Everyone, I have some applications writing the logs to local0.info & local4.info file in UNIX servers. I have to read the log content from above files using filebeat.yml and send the same to Logstash. Could you … --- ## [How to use string interpolation for query string - Elasticsearch](https://discuss.elastic.co/t/how-to-use-string-interpolation-for-query-string-elasticsearch/280001)
**Author:** [@MarkCo](https://discuss.elastic.co/u/MarkCo)\ **Replies:** 0\ **Last updated:** [July 29, 2021, 2:58pm UTC](https://discuss.elastic.co/t/how-to-use-string-interpolation-for-query-string-elasticsearch/280001 "2021-07-29T14:58:45Z")
I am trying to perform string interpolation to my variable that contains of a string of JSON Objects. Below is my original query: var query = "{\\"size\\": 1000,\\"query\\": {\\"bool\\": {\\"should\\":\[ {\\"match\\": { \\"level\\"… --- ## [XML Filter: How import data from XML file](https://discuss.elastic.co/t/xml-filter-how-import-data-from-xml-file/279969)
**Author:** [@Fabio1](https://discuss.elastic.co/u/Fabio1)\ **Replies:** 1\ **Last updated:** [July 29, 2021, 2:42pm UTC](https://discuss.elastic.co/t/xml-filter-how-import-data-from-xml-file/279969 "2021-07-29T14:42:27Z")
Hello everyone, I'm trying to upload my xml file to logstash/elasticsearch to improve my research capabilites. I already tried a lot of ways but I just can import all the file with the xml tags (very confusing). I woul… --- ## [Snapshot restoration failures - FileAlreadyExistsException](https://discuss.elastic.co/t/snapshot-restoration-failures-filealreadyexistsexception/279976)
**Author:** [@Vamsi\_Htc](https://discuss.elastic.co/u/Vamsi_Htc)\ **Replies:** 3\ **Last updated:** [July 29, 2021, 2:33pm UTC](https://discuss.elastic.co/t/snapshot-restoration-failures-filealreadyexistsexception/279976 "2021-07-29T14:33:18Z")
We are facing issues with restoring a snapshot from s3 bucket and the we are seeing below error. ES version 5.6.3 Two of our nodes went down which got both primary and replicas which resulted in cluster turning into re… --- ## [Add a field to logs between 2 specific logs](https://discuss.elastic.co/t/add-a-field-to-logs-between-2-specific-logs/279743)
**Author:** [@Loulou](https://discuss.elastic.co/u/Loulou)\ **Replies:** 11\ **Last updated:** [July 29, 2021, 2:10pm UTC](https://discuss.elastic.co/t/add-a-field-to-logs-between-2-specific-logs/279743 "2021-07-29T14:10:12Z")
Hi, What I am trying to do is, when I encounter a specific log (with a message including "blockOpened"), I save somewhere the fact that I encountered it, and then for all the following logs I add to them a field or tag.… --- ## [SQL Server data to Elasticsearch using LogStash](https://discuss.elastic.co/t/sql-server-data-to-elasticsearch-using-logstash/279996)
**Author:** [@shharukh](https://discuss.elastic.co/u/shharukh)\ **Replies:** 0\ **Last updated:** [July 29, 2021, 1:50pm UTC](https://discuss.elastic.co/t/sql-server-data-to-elasticsearch-using-logstash/279996 "2021-07-29T13:50:55Z")
hey ELK fam, Im trying to connect SQL sever with logstash, but unable to connect with SQLsever here are log can anyone please help me out. regards shahrukh \*\*\[2021-07-29T18:21:41,590\]\[ERROR\]\[logstash.inputs.jdbc … --- ## [Esrally ingesting to two indices parallelly](https://discuss.elastic.co/t/esrally-ingesting-to-two-indices-parallelly/279933)
**Author:** [@Sameera\_De\_Silva](https://discuss.elastic.co/u/Sameera_De_Silva)\ **Replies:** 5\ **Last updated:** [July 29, 2021, 1:44pm UTC](https://discuss.elastic.co/t/esrally-ingesting-to-two-indices-parallelly/279933 "2021-07-29T13:44:57Z")
I want to add documents to two indices simultaneously. For that, I tried with parallel option . But it stills run sequentially and add data to firstly mentioned index and later to the second one . Is this supported is … --- ## [Journalbeat - getting kubernetes metadata](https://discuss.elastic.co/t/journalbeat-getting-kubernetes-metadata/279456)
**Author:** [@DetlefG](https://discuss.elastic.co/u/DetlefG)\ **Replies:** 1\ **Last updated:** [July 29, 2021, 1:35pm UTC](https://discuss.elastic.co/t/journalbeat-getting-kubernetes-metadata/279456 "2021-07-29T13:35:45Z")
Hi, I'm trying to run Journalbeat with processor 'add\_kubernetes\_metadata' to get the metadata of the kubernetes cluster. Journalbeat is running on the kubernetes nodes started by a daemonset with the following configu… --- ## [Query on kibana space.id](https://discuss.elastic.co/t/query-on-kibana-space-id/279255)
**Author:** [@hsdevaraja](https://discuss.elastic.co/u/hsdevaraja)\ **Replies:** 2\ **Last updated:** [July 29, 2021, 1:33pm UTC](https://discuss.elastic.co/t/query-on-kibana-space-id/279255 "2021-07-29T13:33:42Z")
Hi, I was rereferring below link for setting up of Kibana spaces for logs isolation based on environment domain. We have single instance of Elastic search & Kibana(7.10.2) & Our requirement is create different Kibana … --- ## [Synonym filter and preserve originals](https://discuss.elastic.co/t/synonym-filter-and-preserve-originals/279989)
**Author:** [@JoeSouthpaw](https://discuss.elastic.co/u/JoeSouthpaw)\ **Replies:** 0\ **Last updated:** [July 29, 2021, 1:32pm UTC](https://discuss.elastic.co/t/synonym-filter-and-preserve-originals/279989 "2021-07-29T13:32:42Z")
Hi there! I'm using elasticsearch for full-text front end search and have set up a custom search analyser with a large solr-format synonym filter attached. Unfortunately, some of these synonyms address business cases wh… --- ## [Escaping field names in queries](https://discuss.elastic.co/t/escaping-field-names-in-queries/279861)
**Author:** [@stexxen](https://discuss.elastic.co/u/stexxen)\ **Replies:** 7\ **Last updated:** [July 29, 2021, 1:29pm UTC](https://discuss.elastic.co/t/escaping-field-names-in-queries/279861 "2021-07-29T13:29:11Z")
We have discovered that some documents in our index contain a source that resembles the following { "a": { "b" : \["test1"\] }, "a.b" : \["test2"\] } I'm aware of how to perform queries with "exists", but how do… --- ## [CentOS 7 unable to start elastic search searcive](https://discuss.elastic.co/t/centos-7-unable-to-start-elastic-search-searcive/278770)
**Author:** [@rdewan](https://discuss.elastic.co/u/rdewan)\ **Replies:** 2\ **Last updated:** [July 29, 2021, 1:25pm UTC](https://discuss.elastic.co/t/centos-7-unable-to-start-elastic-search-searcive/278770 "2021-07-29T13:25:39Z")
● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since Thu 2021-07-15 10:57:58 UTC; 13min a… --- ## [Text color of values on chart (bar-chart)](https://discuss.elastic.co/t/text-color-of-values-on-chart-bar-chart/274319)
**Author:** [@Rachitha](https://discuss.elastic.co/u/Rachitha)\ **Replies:** 2\ **Last updated:** [June 2, 2021, 8:39am UTC](https://discuss.elastic.co/t/text-color-of-values-on-chart-bar-chart/274319 "2021-06-02T08:39:50Z")
Can we change the text color of values displayed on charts like bar graph? Can I remove the shadow displayed around the text? I am using the kibana version(7.12.1). --- ## [Keeping same search rate on one index spikes CPU in data nodes vs distributing the same load in two indices](https://discuss.elastic.co/t/keeping-same-search-rate-on-one-index-spikes-cpu-in-data-nodes-vs-distributing-the-same-load-in-two-indices/279985)
**Author:** [@Anurag\_Prajapat](https://discuss.elastic.co/u/Anurag_Prajapat)\ **Replies:** 0\ **Last updated:** [July 29, 2021, 12:56pm UTC](https://discuss.elastic.co/t/keeping-same-search-rate-on-one-index-spikes-cpu-in-data-nodes-vs-distributing-the-same-load-in-two-indices/279985 "2021-07-29T12:56:35Z")
We tested out two scenarios: 100 TPS search traffic was pointed to one index 20% CPU usage in data nodes and Threadpool search queue spikes observed. Application side there was increase in TP90 by 3x 80-20 TPS sea… --- ## [\_refresh is throwing error \[post /indexname/\_refresh\] does not support having a body](https://discuss.elastic.co/t/refresh-is-throwing-error-post-indexname-refresh-does-not-support-having-a-body/279940)
**Author:** [@Sumit\_Gaud](https://discuss.elastic.co/u/Sumit_Gaud)\ **Replies:** 6\ **Last updated:** [July 29, 2021, 12:50pm UTC](https://discuss.elastic.co/t/refresh-is-throwing-error-post-indexname-refresh-does-not-support-having-a-body/279940 "2021-07-29T12:50:05Z")
Hi, I deployed a elasticsearch on Azure using Elasticsearch (Self-Managed) I am using NEST nuget package to communicate to elasticsearch api in a .net application. This my application works fine with elastic search ho… --- ## [Plot TP90 percentile](https://discuss.elastic.co/t/plot-tp90-percentile/279975)
**Author:** [@User8](https://discuss.elastic.co/u/User8)\ **Replies:** 1\ **Last updated:** [July 29, 2021, 12:48pm UTC](https://discuss.elastic.co/t/plot-tp90-percentile/279975 "2021-07-29T12:48:10Z")
Hello everyone! I have data that have fields like API endpoints and response times. I want to show TP90 for these different endpoints, how can I do so in Kibana? --- ## [Search UI apply to elastic workplace search?](https://discuss.elastic.co/t/search-ui-apply-to-elastic-workplace-search/279659)
**Author:** [@James\_Huang1](https://discuss.elastic.co/u/James_Huang1)\ **Replies:** 1\ **Last updated:** [July 29, 2021, 12:05pm UTC](https://discuss.elastic.co/t/search-ui-apply-to-elastic-workplace-search/279659 "2021-07-29T12:05:07Z")
Hi, I found a search-UI here (GitHub - elastic/search-ui: Search UI. Libraries for the fast development of modern, engaging search experiences.), base on this page, it is basically focus on the Elastic App search, could … --- ## [Logstash cycle in ruby filter](https://discuss.elastic.co/t/logstash-cycle-in-ruby-filter/279974)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 0\ **Last updated:** [July 29, 2021, 11:34am UTC](https://discuss.elastic.co/t/logstash-cycle-in-ruby-filter/279974 "2021-07-29T11:34:55Z")
Hi, community. I have message in CEF format, that may have cs1...csn and cs1Label...csnLabel fields. I can't use CEF codec, because I want to keep my original message too. So I decided to use "for" loop in ruby filter an… --- ## [Grok match regex](https://discuss.elastic.co/t/grok-match-regex/279957)
**Author:** [@Soren\_vdc](https://discuss.elastic.co/u/Soren_vdc)\ **Replies:** 2\ **Last updated:** [July 29, 2021, 11:11am UTC](https://discuss.elastic.co/t/grok-match-regex/279957 "2021-07-29T11:11:18Z")
Hi, I want to create grok match and have the 2 first words and the last part of the message. For example: ERROR;AuthenticationController ;processMessage ;THR=11107194 R=760a52d97983874 T=6031a0711ec3 U=Unauthenticated… --- ## ["Cannot invoke "java.util.List.get(int)" because "nestedParsedSource" is null" when using nested properties + has\_parent + inner\_hits](https://discuss.elastic.co/t/cannot-invoke-java-util-list-get-int-because-nestedparsedsource-is-null-when-using-nested-properties-has-parent-inner-hits/279967)
**Author:** [@pavelfry](https://discuss.elastic.co/u/pavelfry)\ **Replies:** 0\ **Last updated:** [July 29, 2021, 10:38am UTC](https://discuss.elastic.co/t/cannot-invoke-java-util-list-get-int-because-nestedparsedsource-is-null-when-using-nested-properties-has-parent-inner-hits/279967 "2021-07-29T10:38:19Z")
Hello everyone, I've been banging my head against this for a while and it seems I've reached a dead end. I've tried to simplify the code as much as possible. Problem: I'm using the child/parent relationships and neste… --- ## [Is it possible change the log level of ECK - Operator?](https://discuss.elastic.co/t/is-it-possible-change-the-log-level-of-eck-operator/279909)
**Author:** [@weydersantos](https://discuss.elastic.co/u/weydersantos)\ **Replies:** 1\ **Last updated:** [July 29, 2021, 10:13am UTC](https://discuss.elastic.co/t/is-it-possible-change-the-log-level-of-eck-operator/279909 "2021-07-29T10:13:08Z")
Hey guys! Simple and fast, is it possible change? Because when you follow the quickstart deployment (of course adjusting to your scenario) the pod of elastic-operador output a lot of logs of the type info... --- ## [Global Search Query](https://discuss.elastic.co/t/global-search-query/279835)
**Author:** [@Ravi\_Chhatwani](https://discuss.elastic.co/u/Ravi_Chhatwani)\ **Replies:** 2\ **Last updated:** [July 29, 2021, 10:12am UTC](https://discuss.elastic.co/t/global-search-query/279835 "2021-07-29T10:12:52Z")
I am working on the Global Search functionality which include mathematical comparision operation like (=,\>,\<) , I am looking for the solution how to infer the field and then search the text or value meaning I can give us… --- ## [Winlogbeat Dashboard](https://discuss.elastic.co/t/winlogbeat-dashboard/279814)
**Author:** [@insurin](https://discuss.elastic.co/u/insurin)\ **Replies:** 1\ **Last updated:** [July 29, 2021, 10:08am UTC](https://discuss.elastic.co/t/winlogbeat-dashboard/279814 "2021-07-29T10:08:32Z")
Can anyone help me get my dashboard working again. I deleted an index ( winlog 7.1.12.0) and a new one got made (winlog 7.1.12.1) but now I get loads of errors when using the built-in dashboard I'm not sure where to sta… --- ## [Filter on script hit result](https://discuss.elastic.co/t/filter-on-script-hit-result/279960)
**Author:** [@Giovanni\_Di\_Lembo](https://discuss.elastic.co/u/Giovanni_Di_Lembo)\ **Replies:** 0\ **Last updated:** [July 29, 2021, 9:59am UTC](https://discuss.elastic.co/t/filter-on-script-hit-result/279960 "2021-07-29T09:59:55Z")
Hi all and sorry for my poor english. I'm filtering my index cpes using script (painless). As a a result , I have hits with null values and I need to exclude those hits. I've done this query, but I cannot find a way t… [Previous page](https://discuss.elastic.co/latest.md?page=1549) [Next page](https://discuss.elastic.co/latest.md?page=1551)