# Latest **URL:** https://discuss.elastic.co/latest.md?page=1810 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1811 --- ## [Logstash parsing json](https://discuss.elastic.co/t/logstash-parsing-json/265163)
**Author:** [@ali\_ghorbani](https://discuss.elastic.co/u/ali_ghorbani)\ **Replies:** 8\ **Last updated:** [March 1, 2021, 10:23am UTC](https://discuss.elastic.co/t/logstash-parsing-json/265163 "2021-03-01T10:23:51Z")
I am trying to use log-stash to read input file 1.log in JSON format and write on elasticsearch. This is my log file: {"key":"value00"} {"key":"value01"} {"key1":\[{"key2":"value02"},{"key3":"value03"},{"key4":\[{"key5":"… --- ## [Will kibana ocuupy storage when index patterns saved searches are created](https://discuss.elastic.co/t/will-kibana-ocuupy-storage-when-index-patterns-saved-searches-are-created/265760)
**Author:** [@sagar\_rao](https://discuss.elastic.co/u/sagar_rao)\ **Replies:** 1\ **Last updated:** [March 1, 2021, 10:20am UTC](https://discuss.elastic.co/t/will-kibana-ocuupy-storage-when-index-patterns-saved-searches-are-created/265760 "2021-03-01T10:20:22Z")
I have data in my elastic search. when i create index patterns in kibana will those patterns occupy storage space again? --- ## [Metricbeat Kibana Dashboard Request Time-out when there is a Virtual IP in the VM being monitored](https://discuss.elastic.co/t/metricbeat-kibana-dashboard-request-time-out-when-there-is-a-virtual-ip-in-the-vm-being-monitored/265775)
**Author:** [@thesn](https://discuss.elastic.co/u/thesn)\ **Replies:** 0\ **Last updated:** [March 1, 2021, 10:19am UTC](https://discuss.elastic.co/t/metricbeat-kibana-dashboard-request-time-out-when-there-is-a-virtual-ip-in-the-vm-being-monitored/265775 "2021-03-01T10:19:27Z")
hi, I have ES 7.11.1 and Kibana 7.11.1 setup in docker container (10.6.226.80) using docker-compose in a Linux VM. Also, I have Metricbeat 7.11.1 setup in docker container (10.6.226.104) using docker-compose in a Linux… --- ## [Extract certain values from Url.Query field](https://discuss.elastic.co/t/extract-certain-values-from-url-query-field/265633)
**Author:** [@jamesm1](https://discuss.elastic.co/u/jamesm1)\ **Replies:** 1\ **Last updated:** [March 1, 2021, 9:49am UTC](https://discuss.elastic.co/t/extract-certain-values-from-url-query-field/265633 "2021-03-01T09:49:52Z")
I currently have a Fleet module set up to ingest IIS logs into Kibana. Within the logs they contain the filed URL.Query, which holds alot of information. What i would like to do is to turn all of the parameters inside … --- ## [Dev Tools Throwing Storage Quota Error](https://discuss.elastic.co/t/dev-tools-throwing-storage-quota-error/265693)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [March 1, 2021, 9:36am UTC](https://discuss.elastic.co/t/dev-tools-throwing-storage-quota-error/265693 "2021-03-01T09:36:41Z")
Hello, Got the following error while working in Dev Tools Kibana 7.10.2: Error: Failed to execute 'setItem' on 'Storage': Setting the value of 'sense:hist\_elem\_1614440073476' exceeded the quota. at Storage.set (htt… --- ## [Date range as metric](https://discuss.elastic.co/t/date-range-as-metric/265675)
**Author:** [@sramya](https://discuss.elastic.co/u/sramya)\ **Replies:** 1\ **Last updated:** [March 1, 2021, 9:30am UTC](https://discuss.elastic.co/t/date-range-as-metric/265675 "2021-03-01T09:30:52Z")
I am new to Kibana and want to know if this is possible. My app makes service calls and many times it gets zero transactions and a few times it receives transactions. I want to create a table that may look like this S… --- ## [Kibana Dev Tools Console Broken v7.11](https://discuss.elastic.co/t/kibana-dev-tools-console-broken-v7-11/265732)
**Author:** [@Cesidio\_DiBenedetto](https://discuss.elastic.co/u/Cesidio_DiBenedetto)\ **Replies:** 1\ **Last updated:** [March 1, 2021, 9:28am UTC](https://discuss.elastic.co/t/kibana-dev-tools-console-broken-v7-11/265732 "2021-03-01T09:28:13Z")
Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-xxxxxxx'), or a nonce ('nonce-.… --- ## [Wrapped Facet in vega](https://discuss.elastic.co/t/wrapped-facet-in-vega/265601)
**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\ **Replies:** 2\ **Last updated:** [March 1, 2021, 8:19am UTC](https://discuss.elastic.co/t/wrapped-facet-in-vega/265601 "2021-03-01T08:19:22Z")
Hello, I have used facet as well as layer in below code, I tried to limit no. of columns to 2 but it wasn't working. { "$schema": "https://vega.github.io/schema/vega-lite/v5.json", "name": "trellis\_barley", "desc… --- ## [Selecting "file" in logstash input does not send to elasticsearch](https://discuss.elastic.co/t/selecting-file-in-logstash-input-does-not-send-to-elasticsearch/265602)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 8\ **Last updated:** [March 1, 2021, 8:04am UTC](https://discuss.elastic.co/t/selecting-file-in-logstash-input-does-not-send-to-elasticsearch/265602 "2021-03-01T08:04:24Z")
I am trying to send log files from logstash to elasticsearch. I have completed the whole setup and the test to send the standard input to elasticsearch has passed. Now, I want to send the file to elasticsearch by speci… --- ## [Elastalert module error](https://discuss.elastic.co/t/elastalert-module-error/265723)
**Author:** [@Sarmad](https://discuss.elastic.co/u/Sarmad)\ **Replies:** 2\ **Last updated:** [March 1, 2021, 7:16am UTC](https://discuss.elastic.co/t/elastalert-module-error/265723 "2021-03-01T07:16:52Z")
Hi, I am trying to setup elastalert on Amazon Linux ami but getting this screenshot error when I run elastalert python3 -m elastalert.elastalert --verbose --rule example\_rules/example\_frequency.yaml I have tried wit… --- ## [Data loss in bulk update for field type date using painless script](https://discuss.elastic.co/t/data-loss-in-bulk-update-for-field-type-date-using-painless-script/265761)
**Author:** [@Manjunath\_Kadrolli](https://discuss.elastic.co/u/Manjunath_Kadrolli)\ **Replies:** 0\ **Last updated:** [March 1, 2021, 7:16am UTC](https://discuss.elastic.co/t/data-loss-in-bulk-update-for-field-type-date-using-painless-script/265761 "2021-03-01T07:16:01Z")
Following is a row from my bulk update http body When i run the same for small set of records (100) the same works fine but if i trigger the for the entire DB the the valueTimestamp field always null where other values … --- ## [How to configure ingest pipeline with filebeat to send filtered data to elastic search](https://discuss.elastic.co/t/how-to-configure-ingest-pipeline-with-filebeat-to-send-filtered-data-to-elastic-search/265755)
**Author:** [@chintu1411](https://discuss.elastic.co/u/chintu1411)\ **Replies:** 0\ **Last updated:** [March 1, 2021, 6:51am UTC](https://discuss.elastic.co/t/how-to-configure-ingest-pipeline-with-filebeat-to-send-filtered-data-to-elastic-search/265755 "2021-03-01T06:51:24Z")
Hi All, this is very first time we are using ELK with filebeat. we have been instructed to use ingest pipeline to use it with filebeat to filter the data. all over the internet and elastic.co only its given how to wri… --- ## [Kibana 7.11 problems with spaces and roles -](https://discuss.elastic.co/t/kibana-7-11-problems-with-spaces-and-roles/265679)
**Author:** [@byteandbit](https://discuss.elastic.co/u/byteandbit)\ **Replies:** 13\ **Last updated:** [March 1, 2021, 6:48am UTC](https://discuss.elastic.co/t/kibana-7-11-problems-with-spaces-and-roles/265679 "2021-03-01T06:48:19Z")
Hello, We have created a new space just for read only user to access - Visibility in Analytics-\>Dashboard, Discover and Visualise. Then we created a new role within new space only, with read only privileges again fo… --- ## [Controls visualization filter uses the default index pattern](https://discuss.elastic.co/t/controls-visualization-filter-uses-the-default-index-pattern/265553)
**Author:** [@yash\_gupta](https://discuss.elastic.co/u/yash_gupta)\ **Replies:** 2\ **Last updated:** [March 1, 2021, 6:30am UTC](https://discuss.elastic.co/t/controls-visualization-filter-uses-the-default-index-pattern/265553 "2021-03-01T06:30:45Z")
Hi, I did end up in this situation where the filter uses default index and no option to change it. I also know that this is an known defect and just wanted to check if we have any resolution or work around for this ? de… --- ## [Elasticsearch IOPS](https://discuss.elastic.co/t/elasticsearch-iops/265680)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 10\ **Last updated:** [March 1, 2021, 6:10am UTC](https://discuss.elastic.co/t/elasticsearch-iops/265680 "2021-03-01T06:10:15Z")
Hello Team I am having Elasticsearch version 5.6.3 running on RHEL 7.4. This Cluster is of 10 nodes. Hardware : 8 CPU and 32 GB RAM. Hard Disk : HDD { CEPH Storage } Elastic Data Paths : Multiple { 7 Different mount … --- ## [CPU running high only on one node at time in the ES cluster](https://discuss.elastic.co/t/cpu-running-high-only-on-one-node-at-time-in-the-es-cluster/265708)
**Author:** [@sbk-elk](https://discuss.elastic.co/u/sbk-elk)\ **Replies:** 5\ **Last updated:** [March 1, 2021, 5:03am UTC](https://discuss.elastic.co/t/cpu-running-high-only-on-one-node-at-time-in-the-es-cluster/265708 "2021-03-01T05:03:53Z")
Not sure why only one node in the cluster has such high CPU when there is nothing happening in the cluster. top - 00:34:43 up 137 days, 17:43, 1 user, load average: 1.24, 2.14, 3.15 Tasks: 198 total, 1 running, 197 … --- ## [How to stop logstash to not creating multiple conf.save file](https://discuss.elastic.co/t/how-to-stop-logstash-to-not-creating-multiple-conf-save-file/265747)
**Author:** [@asan](https://discuss.elastic.co/u/asan)\ **Replies:** 1\ **Last updated:** [March 1, 2021, 4:55am UTC](https://discuss.elastic.co/t/how-to-stop-logstash-to-not-creating-multiple-conf-save-file/265747 "2021-03-01T04:55:13Z")
Hi Recently i configured logstsh for parsing my mikrotik and fortigate log and they are working correctly but in conf.d logstsh started to create multiple conf.save like : mikrotik.conf.save.1, mikrotik.conf.save.2, m… --- ## [Add site to crawler via api](https://discuss.elastic.co/t/add-site-to-crawler-via-api/264257)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 5\ **Last updated:** [March 1, 2021, 1:18am UTC](https://discuss.elastic.co/t/add-site-to-crawler-via-api/264257 "2021-03-01T01:18:21Z")
I'd like to add sites to search via the API which akaict isn't currently possible officially - is there : a way to do this unofficially? plans to do this eventually? --- ## [Elastic Stack alerting now generally available](https://discuss.elastic.co/t/elastic-stack-alerting-now-generally-available/265714)
**Author:** [@arp220](https://discuss.elastic.co/u/arp220)\ **Replies:** 1\ **Last updated:** [February 28, 2021, 4:33pm UTC](https://discuss.elastic.co/t/elastic-stack-alerting-now-generally-available/265714 "2021-02-28T16:33:09Z")
Hello. I use elasticsearch and kibana 7.11.1 but alerting slack and webhook and etc, They are not activatedfor me. . I have to do something special? thanks. --- ## [ILM how to delete index after days](https://discuss.elastic.co/t/ilm-how-to-delete-index-after-days/265490)
**Author:** [@thewasta](https://discuss.elastic.co/u/thewasta)\ **Replies:** 3\ **Last updated:** [March 1, 2021, 12:09am UTC](https://discuss.elastic.co/t/ilm-how-to-delete-index-after-days/265490 "2021-03-01T00:09:39Z")
My Enviroment { "name" : "5D776AA", "cluster\_name" : "rust-cluster", "cluster\_uuid" : "unlQZ9RcTTy34WDJkHZ1wA", "version" : { "number" : "7.10.2", "build\_flavor" : "default", "build\_type" : "deb", … --- ## [Aggregation to find largest range (diff of min max)](https://discuss.elastic.co/t/aggregation-to-find-largest-range-diff-of-min-max/265710)
**Author:** [@smlbiobot](https://discuss.elastic.co/u/smlbiobot)\ **Replies:** 2\ **Last updated:** [March 1, 2021, 12:03am UTC](https://discuss.elastic.co/t/aggregation-to-find-largest-range-diff-of-min-max/265710 "2021-03-01T00:03:16Z")
Is there a way to quickly find the largest range of values (i.e. the difference of min and max within a timeframe)? What I want to do: in a time series with an example doc structured as something like below, find the pr… --- ## [Calculating size of record in queue](https://discuss.elastic.co/t/calculating-size-of-record-in-queue/265727)
**Author:** [@pikomen](https://discuss.elastic.co/u/pikomen)\ **Replies:** 1\ **Last updated:** [February 28, 2021, 11:35pm UTC](https://discuss.elastic.co/t/calculating-size-of-record-in-queue/265727 "2021-02-28T23:35:30Z")
hi, any way to calculate record size in write.queue\_size? from 7.9 the write.queue\_size was updated from 200 to 10000 and I wonder if the heap size of 16 Gb can hold all the 10000 requests (most of them bulk requests) i… --- ## [Multi \_update\_by\_query API like MultiSearch \_msearch - how to? possible?](https://discuss.elastic.co/t/multi-update-by-query-api-like-multisearch-msearch-how-to-possible/261673)
**Author:** [@Datakids](https://discuss.elastic.co/u/Datakids)\ **Replies:** 3\ **Last updated:** [February 28, 2021, 11:15pm UTC](https://discuss.elastic.co/t/multi-update-by-query-api-like-multisearch-msearch-how-to-possible/261673 "2021-02-28T23:15:28Z")
Hi all, I have following question regarding the multiple search api \_msearch Is there a way to do the same by using the \_update\_by\_query api ? UseCase: change entries of fields based on mutliple bool query like: POST… --- ## [Uknown fields](https://discuss.elastic.co/t/uknown-fields/265254)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 4\ **Last updated:** [February 28, 2021, 10:51pm UTC](https://discuss.elastic.co/t/uknown-fields/265254 "2021-02-28T22:51:30Z")
In newest ELK stack, how I should deal with unknown fields? Before this version it was just about refresh index pattern. What should I do now? Removing and adding pattern will lead to lost my edits made in this pattern l… --- ## [Reindexing error](https://discuss.elastic.co/t/reindexing-error/265736)
**Author:** [@leemase004](https://discuss.elastic.co/u/leemase004)\ **Replies:** 1\ **Last updated:** [February 28, 2021, 10:48pm UTC](https://discuss.elastic.co/t/reindexing-error/265736 "2021-02-28T22:48:13Z")
We are attempting to update the mappings for an index. The new mapping includes multiple aliases (around 36) When we attempt to reindex the old indices to the new mappings we keep receiving this error: Reindex can not… --- ## [Manage connection between source and target clusters for remote index](https://discuss.elastic.co/t/manage-connection-between-source-and-target-clusters-for-remote-index/265701)
**Author:** [@jthoni](https://discuss.elastic.co/u/jthoni)\ **Replies:** 2\ **Last updated:** [February 28, 2021, 10:15pm UTC](https://discuss.elastic.co/t/manage-connection-between-source-and-target-clusters-for-remote-index/265701 "2021-02-28T22:15:17Z")
We are migrating our ES cluster to a new environment (from stand-alone Azure VMs to Service Fabric hosted, updating the OS image, upgrading ES version, adding security etc.). I have my new cluster ready for data and am w… --- ## [Newly inserted document not visible in searches](https://discuss.elastic.co/t/newly-inserted-document-not-visible-in-searches/265734)
**Author:** [@Cesidio\_DiBenedetto](https://discuss.elastic.co/u/Cesidio_DiBenedetto)\ **Replies:** 2\ **Last updated:** [February 28, 2021, 7:23pm UTC](https://discuss.elastic.co/t/newly-inserted-document-not-visible-in-searches/265734 "2021-02-28T19:23:20Z")
PUT https://elasticsearch-url/index-name/\_doc/customID?refresh { my data object } This is the response I get: { "\_index": "index-name", "\_type": "\_doc", "\_id": "customID", "\_version": 1, "result": "created",… --- ## [Parse "message" field on Syslog](https://discuss.elastic.co/t/parse-message-field-on-syslog/265729)
**Author:** [@Santiago\_Fernandez](https://discuss.elastic.co/u/Santiago_Fernandez)\ **Replies:** 3\ **Last updated:** [February 28, 2021, 6:53pm UTC](https://discuss.elastic.co/t/parse-message-field-on-syslog/265729 "2021-02-28T18:53:17Z")
Hi Guys! I m new in ELK. have managed to get the Stack up and send my syslogs from my API Manager. I would like to be able to transform a Syslog field into JSON. The "message" field. This is my logstash.conf input { … --- ## ['Cannot read ENT\_SEARCH\_CONFIG\_PATH file' error in Enterprise Search](https://discuss.elastic.co/t/cannot-read-ent-search-config-path-file-error-in-enterprise-search/265588)
**Author:** [@basan4ik](https://discuss.elastic.co/u/basan4ik)\ **Replies:** 4\ **Last updated:** [February 28, 2021, 5:57pm UTC](https://discuss.elastic.co/t/cannot-read-ent-search-config-path-file-error-in-enterprise-search/265588 "2021-02-28T17:57:39Z")
I'm trying to log in Elastic Enterpirse Search: ENT\_SEARCH\_DEFAULT\_PASSWORD=somepassword bin/enterprise-search but get this Error: Found java executable in PATH Java version detected: 11.0.10 (major version: 11) Canno… --- ## [503 license not available--security](https://discuss.elastic.co/t/503-license-not-available-security/264966)
**Author:** [@John\_McDonnell](https://discuss.elastic.co/u/John_McDonnell)\ **Replies:** 3\ **Last updated:** [February 28, 2021, 5:33pm UTC](https://discuss.elastic.co/t/503-license-not-available-security/264966 "2021-02-28T17:33:42Z")
Okay, I'm confused. Numerous elastic blogs now suggest that security features are available with the basic license, so I thought this would be a great opportunity to check out the features in my home lab. But, when I f… [Previous page](https://discuss.elastic.co/latest.md?page=1809) [Next page](https://discuss.elastic.co/latest.md?page=1811)