# Latest **URL:** https://discuss.elastic.co/latest.md?page=1617 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1618 --- ## [Парсинг поля "message"](https://discuss.elastic.co/t/message/275279)
**Author:** [@tonik](https://discuss.elastic.co/u/tonik)\ **Replies:** 2\ **Last updated:** [June 17, 2021, 9:57am UTC](https://discuss.elastic.co/t/message/275279 "2021-06-17T09:57:41Z")
Добрый день. Вопрос таков, имеется поле "message" которое изменяется по количеству содержащихся данных и мне при этом нужно выделять поле, которое периодически встречается. Думал сначала через grok но потом понял, что н… --- ## [Json format returned in search how to parse into fields?](https://discuss.elastic.co/t/json-format-returned-in-search-how-to-parse-into-fields/276201)
**Author:** [@KS\_123](https://discuss.elastic.co/u/KS_123)\ **Replies:** 1\ **Last updated:** [June 17, 2021, 9:55am UTC](https://discuss.elastic.co/t/json-format-returned-in-search-how-to-parse-into-fields/276201 "2021-06-17T09:55:58Z")
excuse me if I don't havethe correct terms but, I have this format from a search I am doing in kibana: How do I turn the gateway, rssi,snr in metrics like the messageTime is in the same pic? Can this be done at thi… --- ## [Missing logs](https://discuss.elastic.co/t/missing-logs/276234)
**Author:** [@Shaked](https://discuss.elastic.co/u/Shaked)\ **Replies:** 6\ **Last updated:** [June 17, 2021, 9:50am UTC](https://discuss.elastic.co/t/missing-logs/276234 "2021-06-17T09:50:54Z")
Hi everyone, I would be happy to get your help with a critical issue we have. We run AWS ElasticSearch service (v7.10) with Logstash as a Docker container on ECS Fargate. All of our environments are running the servic… --- ## [Set custom password on Elasticsearch resource](https://discuss.elastic.co/t/set-custom-password-on-elasticsearch-resource/276147)
**Author:** [@pkaramol](https://discuss.elastic.co/u/pkaramol)\ **Replies:** 2\ **Last updated:** [June 17, 2021, 8:39am UTC](https://discuss.elastic.co/t/set-custom-password-on-elasticsearch-resource/276147 "2021-06-17T08:39:35Z")
When spinning up a new Elasticsearch resource, a new password is created than can be retrieved as follows: PASSWORD=$(k get secret clusterName-es-elastic-user -o json | jq -r .data.elastic | base64 -D Is there a way to… --- ## [Best practices for fine tuning performance when it comes to Elasticsearch, Logstash and Kibana?](https://discuss.elastic.co/t/best-practices-for-fine-tuning-performance-when-it-comes-to-elasticsearch-logstash-and-kibana/273913)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 21\ **Last updated:** [June 17, 2021, 8:22am UTC](https://discuss.elastic.co/t/best-practices-for-fine-tuning-performance-when-it-comes-to-elasticsearch-logstash-and-kibana/273913 "2021-06-17T08:22:01Z")
Hello We have a Elastic Stack setup. Our basic architecture is based on this: Beats/source/etc -\> Logstash -\> Elasticsearch. Meaning, all incoming data always passes thru Logstash first. We have created various Logst… --- ## [Configuration for master node in YAML](https://discuss.elastic.co/t/configuration-for-master-node-in-yaml/275975)
**Author:** [@krish0608](https://discuss.elastic.co/u/krish0608)\ **Replies:** 5\ **Last updated:** [June 17, 2021, 8:15am UTC](https://discuss.elastic.co/t/configuration-for-master-node-in-yaml/275975 "2021-06-17T08:15:45Z")
Hi Team, I have configured big cluster in my production env. just wanted to confirm do we need to allocate half of memory in master node also. Suppose i have 16G node and do i need to allocate 8G in jvm options file wha… --- ## [.async\_search Index Problem](https://discuss.elastic.co/t/async-search-index-problem/275628)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 1\ **Last updated:** [June 17, 2021, 8:15am UTC](https://discuss.elastic.co/t/async-search-index-problem/275628 "2021-06-17T08:15:23Z")
Hi, Today we had a big crash in our Netapp cabinet and our elastic cluster went down After starting up all our indices appeared to be ok with the exception of this internal's elasticsearch index .async-search which is … --- ## [Last\_run\_metadata\_path not updated with sql\_last\_value](https://discuss.elastic.co/t/last-run-metadata-path-not-updated-with-sql-last-value/276143)
**Author:** [@Alesora](https://discuss.elastic.co/u/Alesora)\ **Replies:** 2\ **Last updated:** [June 17, 2021, 8:06am UTC](https://discuss.elastic.co/t/last-run-metadata-path-not-updated-with-sql-last-value/276143 "2021-06-17T08:06:14Z")
Hi, I m new to ELK and I'm having an issue with the jdbc sql\_last\_value. So I'm trying to update my Elastic database from a SQL database using the jdbc driver, I want to update records that are modified (dhm is the row t… --- ## [Filebeat](https://discuss.elastic.co/t/filebeat/276224)
**Author:** [@SLIM\_SLIM](https://discuss.elastic.co/u/SLIM_SLIM)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 7:26am UTC](https://discuss.elastic.co/t/filebeat/276224 "2021-06-17T07:26:37Z")
Hi, i want to regroup lines in log file (5 lines max), i want to regroup lines until (default task-XX) This is my filebeat config : fields\_under\_root: true multiline.type: pattern multiline.pattern: '\[0-9\]{4}-\[0-… --- ## [Optimizing shard placement for indexing](https://discuss.elastic.co/t/optimizing-shard-placement-for-indexing/276227)
**Author:** [@Timur\_Makarchuk](https://discuss.elastic.co/u/Timur_Makarchuk)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 7:49am UTC](https://discuss.elastic.co/t/optimizing-shard-placement-for-indexing/276227 "2021-06-17T07:49:20Z")
Good day, everyone! I'm currently working on a tool that would spread indices in our cluster to spread indexing load more optimally, as inspired by this article (Optimal Shard Placement in a Petabyte Scale Elasticsearch… --- ## [Is field type "wildcard" supported in elasticsearch-spark?](https://discuss.elastic.co/t/is-field-type-wildcard-supported-in-elasticsearch-spark/275983)
**Author:** [@jrxs](https://discuss.elastic.co/u/jrxs)\ **Replies:** 1\ **Last updated:** [June 17, 2021, 7:41am UTC](https://discuss.elastic.co/t/is-field-type-wildcard-supported-in-elasticsearch-spark/275983 "2021-06-17T07:41:09Z")
Hi, I am currently doing some tests to see if I can use Apache Spark and the elasticsearch-spark (elasticsearch-hadoop) to analyse data that I have in elasticsearch. I am testing using the following versions in a docke… --- ## [No cached mapping for important monitoring fields](https://discuss.elastic.co/t/no-cached-mapping-for-important-monitoring-fields/276225)
**Author:** [@kodka](https://discuss.elastic.co/u/kodka)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 7:28am UTC](https://discuss.elastic.co/t/no-cached-mapping-for-important-monitoring-fields/276225 "2021-06-17T07:28:33Z")
(I tried to refresh cached mapping in the index pattern page, it didn't help.) I have two clusters with very similar architecture, one of them have this problem, but the other one is fine, differences between them are t… --- ## [Logstash How to read only name of the file](https://discuss.elastic.co/t/logstash-how-to-read-only-name-of-the-file/276096)
**Author:** [@Betorov](https://discuss.elastic.co/u/Betorov)\ **Replies:** 2\ **Last updated:** [June 17, 2021, 6:27am UTC](https://discuss.elastic.co/t/logstash-how-to-read-only-name-of-the-file/276096 "2021-06-17T06:27:27Z")
Hi I'am new to elasticsearch. I wanted to know if there was a possible way to read only the names of the files and ignore the contents inside (I must ignore it to prevent error. I saw this posts but it didn't work for m… --- ## [Problem in connecting to Elasticsearch using Python script](https://discuss.elastic.co/t/problem-in-connecting-to-elasticsearch-using-python-script/276130)
**Author:** [@ravi-shanker](https://discuss.elastic.co/u/ravi-shanker)\ **Replies:** 4\ **Last updated:** [June 17, 2021, 6:17am UTC](https://discuss.elastic.co/t/problem-in-connecting-to-elasticsearch-using-python-script/276130 "2021-06-17T06:17:42Z")
Hello All, I have a 3 node elastic cluster setup on EC2. I am trying to connect to my cluster and index some sample data using python script. Below is my python script: - from elasticsearch import Elasticsearch es=Ela… --- ## [Jolokia module - tomcat](https://discuss.elastic.co/t/jolokia-module-tomcat/276220)
**Author:** [@venkatesh\_prasanth](https://discuss.elastic.co/u/venkatesh_prasanth)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 5:39am UTC](https://discuss.elastic.co/t/jolokia-module-tomcat/276220 "2021-06-17T05:39:37Z")
Hi, I have multiple tomcat running on same server in different ports. localhost:80 localhost:8081 now how i can use same metricbeat jolokia module to monitor the both. and i metricbeat tomcat dashboard i would like t… --- ## [Elasticsearch 7.13 2 nodes cluster](https://discuss.elastic.co/t/elasticsearch-7-13-2-nodes-cluster/276079)
**Author:** [@Dilip\_Kumar](https://discuss.elastic.co/u/Dilip_Kumar)\ **Replies:** 6\ **Last updated:** [June 17, 2021, 5:29am UTC](https://discuss.elastic.co/t/elasticsearch-7-13-2-nodes-cluster/276079 "2021-06-17T05:29:37Z")
Hi I have two nodes(xnode1, xnode2) cluster on elasticsearch 7.13. I made cluster succesfully, it showing 2 nodes in cluster. For testing i stop xnode2, it showing 1 node cluster. but when stop xnode1 , then try curl w… --- ## [Wrong fields are comimg](https://discuss.elastic.co/t/wrong-fields-are-comimg/276136)
**Author:** [@stark](https://discuss.elastic.co/u/stark)\ **Replies:** 4\ **Last updated:** [June 17, 2021, 4:50am UTC](https://discuss.elastic.co/t/wrong-fields-are-comimg/276136 "2021-06-17T04:50:18Z")
boosting terms have higher precedence than keyword i search for eg if i search keyword 'index" top fields contain this word in description and lower fields contain keyword in title but i boost title field why this issue … --- ## [Kibana Vega : Right Aligned Five Digit Padding](https://discuss.elastic.co/t/kibana-vega-right-aligned-five-digit-padding/276148)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 2\ **Last updated:** [June 17, 2021, 4:48am UTC](https://discuss.elastic.co/t/kibana-vega-right-aligned-five-digit-padding/276148 "2021-06-17T04:48:47Z")
I am using Kibana vega visualization to show metrics. I would like to achieve the right align five-digit padding. What can be the property name to achieve the same? My vega code : marks: \[ { type: text … --- ## [Vega visualization issue](https://discuss.elastic.co/t/vega-visualization-issue/275929)
**Author:** [@Nisha2297](https://discuss.elastic.co/u/Nisha2297)\ **Replies:** 7\ **Last updated:** [June 17, 2021, 4:41am UTC](https://discuss.elastic.co/t/vega-visualization-issue/275929 "2021-06-17T04:41:25Z")
My Vega visual is throwing below errors. Can anyone help me on what these errors signify. --- ## [Search both parent and child , but not duplicate result of chil](https://discuss.elastic.co/t/search-both-parent-and-child-but-not-duplicate-result-of-chil/276214)
**Author:** [@DuyNguyen](https://discuss.elastic.co/u/DuyNguyen)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 4:11am UTC](https://discuss.elastic.co/t/search-both-parent-and-child-but-not-duplicate-result-of-chil/276214 "2021-06-17T04:11:05Z")
Hi everyone, I'm new with ELK and developing social app. I using ELK to query post and comment all of group social. Desired result: If match text of post just show post. If match text of comment show that comment an… --- ## [Can I use beat input in filebeat.yml and modules with different tag?](https://discuss.elastic.co/t/can-i-use-beat-input-in-filebeat-yml-and-modules-with-different-tag/276114)
**Author:** [@venkatesh\_prasanth](https://discuss.elastic.co/u/venkatesh_prasanth)\ **Replies:** 2\ **Last updated:** [June 17, 2021, 4:10am UTC](https://discuss.elastic.co/t/can-i-use-beat-input-in-filebeat-yml-and-modules-with-different-tag/276114 "2021-06-17T04:10:22Z")
Hi, I am using filebeat. i use apache module to collect log from apache. but want to collect the log from tomcat and index it in another index. can i use filebeat input in filebeat.yml and module in same time? but i wa… --- ## [Master not discovered yet, this node has not previously joined a bootstrapped (v7+) cluster version 7.13.2](https://discuss.elastic.co/t/master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster-version-7-13-2/276211)
**Author:** [@Senshuken\_GG](https://discuss.elastic.co/u/Senshuken_GG)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 3:00am UTC](https://discuss.elastic.co/t/master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster-version-7-13-2/276211 "2021-06-17T03:00:49Z")
Node 1 172.24.10.103 Node 1 172.24.10.101 Description: 1.Elasticsearch version 7.13 Elasticsearch cluster 2 Node issue is master\_not\_discovered\_exception Node 1 Config elasticsearch.yml cluster.name: POWER-CLUS… --- ## [Have to create multiple rollover\_alias for multiple inputs with ILM](https://discuss.elastic.co/t/have-to-create-multiple-rollover-alias-for-multiple-inputs-with-ilm/276212)
**Author:** [@ELK\_sanjay](https://discuss.elastic.co/u/ELK_sanjay)\ **Replies:** 1\ **Last updated:** [June 17, 2021, 3:33am UTC](https://discuss.elastic.co/t/have-to-create-multiple-rollover-alias-for-multiple-inputs-with-ilm/276212 "2021-06-17T03:33:18Z")
I have an issue creating multiple rollover\_alias for multiple inputs with ILM. But not getting an exact answer. Thanks in Advance..!! --- ## [Elasticsearch ILM Deleting an index is just a logical drop, but the index can still be used. Will it eventually be physically deleted](https://discuss.elastic.co/t/elasticsearch-ilm-deleting-an-index-is-just-a-logical-drop-but-the-index-can-still-be-used-will-it-eventually-be-physically-deleted/276071)
**Author:** [@liuliugang](https://discuss.elastic.co/u/liuliugang)\ **Replies:** 16\ **Last updated:** [June 17, 2021, 3:16am UTC](https://discuss.elastic.co/t/elasticsearch-ilm-deleting-an-index-is-just-a-logical-drop-but-the-index-can-still-be-used-will-it-eventually-be-physically-deleted/276071 "2021-06-17T03:16:23Z")
View index lifecycle management in Kibana The current phase is Delete and the current action is Complete thanks --- ## [High CPU usage because lucene merge thread](https://discuss.elastic.co/t/high-cpu-usage-because-lucene-merge-thread/276209)
**Author:** [@yeziblo](https://discuss.elastic.co/u/yeziblo)\ **Replies:** 5\ **Last updated:** [June 17, 2021, 3:01am UTC](https://discuss.elastic.co/t/high-cpu-usage-because-lucene-merge-thread/276209 "2021-06-17T03:01:36Z")
My operation process is as follows: At 3 am everyday, program try to index data to ES, that usually takes 3 hours. During the indexing process, I will set the number\_of\_replicas parameter to 0, and when data indexing is… --- ## [Filebeat - Unable to change indice name & disable ILM](https://discuss.elastic.co/t/filebeat-unable-to-change-indice-name-disable-ilm/276107)
**Author:** [@shlomia](https://discuss.elastic.co/u/shlomia)\ **Replies:** 2\ **Last updated:** [June 17, 2021, 2:09am UTC](https://discuss.elastic.co/t/filebeat-unable-to-change-indice-name-disable-ilm/276107 "2021-06-17T02:09:09Z")
Hi, I recently started to use ELK with Filebeat version 7.13.0. I'm trying to change the default indice name that Filebeat is creating: "filebeat-%{\[agent.version\]}-%{+yyyy.MM.dd}" and also disabling the ILM policy … --- ## [Can Elastic send the api to jp1 customer the alert and recovery like servicenow?](https://discuss.elastic.co/t/can-elastic-send-the-api-to-jp1-customer-the-alert-and-recovery-like-servicenow/276102)
**Author:** [@T1330](https://discuss.elastic.co/u/T1330)\ **Replies:** 3\ **Last updated:** [June 17, 2021, 2:02am UTC](https://discuss.elastic.co/t/can-elastic-send-the-api-to-jp1-customer-the-alert-and-recovery-like-servicenow/276102 "2021-06-17T02:02:38Z")
Elastic obtain the alert and updated alert by ServiceNow api. Is it also available to have jp1 customer updated alert like ServiceNow in elastic. Please let's us know if you have any customer jp1 using elastic. I ap… --- ## [Split field in elastic](https://discuss.elastic.co/t/split-field-in-elastic/276069)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 6\ **Last updated:** [June 17, 2021, 1:46am UTC](https://discuss.elastic.co/t/split-field-in-elastic/276069 "2021-06-17T01:46:50Z")
Hi all, I have a little problems that needed solving. I have a field dns domain dns.question.name has value like this: a.b.c.d Now i want to split this domain into many other domain like tld, sld ..... dynamically wit… --- ## [Enabling http & https connections to elastic](https://discuss.elastic.co/t/enabling-http-https-connections-to-elastic/276141)
**Author:** [@jdswifty](https://discuss.elastic.co/u/jdswifty)\ **Replies:** 2\ **Last updated:** [June 17, 2021, 1:17am UTC](https://discuss.elastic.co/t/enabling-http-https-connections-to-elastic/276141 "2021-06-17T01:17:36Z")
Running Elasticsearch 7.11 & getting towards the end of a piece of work to enable TLS across the platform I'm now at the point i need to enable tls on the http connections for the ingest nodes but I need to be able to s… --- ## [Confused about filebeat privileges / ILM](https://discuss.elastic.co/t/confused-about-filebeat-privileges-ilm/276112)
**Author:** [@Balu](https://discuss.elastic.co/u/Balu)\ **Replies:** 0\ **Last updated:** [June 16, 2021, 9:47am UTC](https://discuss.elastic.co/t/confused-about-filebeat-privileges-ilm/276112 "2021-06-16T09:47:07Z")
Hey folks, I am just starting to work with the ELK stack and I am quite often confused by the documentation. For example while setting up filebeat, Grant privileges and roles needed for publishing tells me When using… [Previous page](https://discuss.elastic.co/latest.md?page=1616) [Next page](https://discuss.elastic.co/latest.md?page=1618)