# Latest **URL:** https://discuss.elastic.co/latest.md?page=1920 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1921 --- ## [Return node to cluster](https://discuss.elastic.co/t/return-node-to-cluster/259663)
**Author:** [@KA3AXCTAH](https://discuss.elastic.co/u/KA3AXCTAH)\ **Replies:** 1\ **Last updated:** [December 26, 2020, 7:48pm UTC](https://discuss.elastic.co/t/return-node-to-cluster/259663 "2020-12-26T19:48:22Z")
I have 3 node elasticsearch cluster 192.168.2.11 - node-01 192.168.2.12 - node-02 192.168.2.13 - node-03 and i deleted node-02 from cluster using this command curl -XPUT 192.168.2.12:9200/\_cluster/settings -H 'Content… --- ## [How to specify timezone on elasticsearch?](https://discuss.elastic.co/t/how-to-specify-timezone-on-elasticsearch/259614)
**Author:** [@gabriel.goncalves](https://discuss.elastic.co/u/gabriel.goncalves)\ **Replies:** 6\ **Last updated:** [December 26, 2020, 6:19pm UTC](https://discuss.elastic.co/t/how-to-specify-timezone-on-elasticsearch/259614 "2020-12-26T18:19:38Z")
It says: "Internally, dates are converted to UTC (if the time-zone is specified) and stored as a long number representing milliseconds-since-the-epoch." What are all possible ways to specify the timezone? --- ## [Suricata Rule](https://discuss.elastic.co/t/suricata-rule/259666)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 0\ **Last updated:** [December 26, 2020, 5:43pm UTC](https://discuss.elastic.co/t/suricata-rule/259666 "2020-12-26T17:43:19Z")
Is there some type of general Suricata rule for Elastic that will create a detection alert in Elastic SIEM everytime that the suricata rules goes off. --- ## [Pipeline with id \[\] does not exist](https://discuss.elastic.co/t/pipeline-with-id-does-not-exist/259476)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 12\ **Last updated:** [December 26, 2020, 12:53pm UTC](https://discuss.elastic.co/t/pipeline-with-id-does-not-exist/259476 "2020-12-26T12:53:05Z")
There are few references to this problem already here but none provide resolution, I am getting the below error on 7.6.2 and i do see the pipeline when i run the GET API call { "index" : "xxxxxxxxxx-2020.45-reind… --- ## [How to search multiple fields and aggregate scores?](https://discuss.elastic.co/t/how-to-search-multiple-fields-and-aggregate-scores/259659)
**Author:** [@Shuri](https://discuss.elastic.co/u/Shuri)\ **Replies:** 0\ **Last updated:** [December 26, 2020, 11:34am UTC](https://discuss.elastic.co/t/how-to-search-multiple-fields-and-aggregate-scores/259659 "2020-12-26T11:34:28Z")
Hi all, I'm trying to figure out a solution to how I should structure my queries for finding answers to people's questions. For example, based off the dataset I will paste at the end of this post, I would like to query "… --- ## [Fail to parse HTTP parameters: parse "response\\"}}\\nPOST /\_bulk": net/url: invalid control character in](https://discuss.elastic.co/t/fail-to-parse-http-parameters-parse-response-npost-bulk-net-url-invalid-control-character-in/259652)
**Author:** [@Alir3z4](https://discuss.elastic.co/u/Alir3z4)\ **Replies:** 0\ **Last updated:** [December 25, 2020, 11:18pm UTC](https://discuss.elastic.co/t/fail-to-parse-http-parameters-parse-response-npost-bulk-net-url-invalid-control-character-in/259652 "2020-12-25T23:18:40Z")
I'm running packetbeat version 7.10.1; Looking at its logs I see 2020-12-25T23:08:29.956Z WARN http/http.go:545 Fail to parse HTTP parameters: parse "response\\"}}\\nPOST /\_bulk": net/url: invalid contro… --- ## [Using aggregation in Elasticsearch to find duplicate data in the same index](https://discuss.elastic.co/t/using-aggregation-in-elasticsearch-to-find-duplicate-data-in-the-same-index/259637)
**Author:** [@Amraneze](https://discuss.elastic.co/u/Amraneze)\ **Replies:** 5\ **Last updated:** [December 25, 2020, 5:41pm UTC](https://discuss.elastic.co/t/using-aggregation-in-elasticsearch-to-find-duplicate-data-in-the-same-index/259637 "2020-12-25T17:41:47Z")
Hi everyone, I'm trying to find duplicates within the same index. I tried to use aggregation like this : { "aggs": { "duplicates": { "terms": { "script": { "source": "if (doc\['username.sort-field'\].size(… --- ## [Как настроить хранение индексов по размеру](https://discuss.elastic.co/t/topic/259551)
**Author:** [@Peter\_Homicevich](https://discuss.elastic.co/u/Peter_Homicevich)\ **Replies:** 1\ **Last updated:** [December 25, 2020, 5:11pm UTC](https://discuss.elastic.co/t/topic/259551 "2020-12-25T17:11:36Z")
Добрый день! Подскажите как настроить хранение индексов не более 90Гб. Ситуация следующая: Имеется ELK, из одной ноды. Сервисы пишут логи в logsatsh. Logsatsh создает индекс в elasticsearch - index =\> "logs-%{+YYYY.MM… --- ## [Не работает should только по определенным словам](https://discuss.elastic.co/t/should/259194)
**Author:** [@unavailabl3](https://discuss.elastic.co/u/unavailabl3)\ **Replies:** 1\ **Last updated:** [December 25, 2020, 4:44pm UTC](https://discuss.elastic.co/t/should/259194 "2020-12-25T16:44:32Z")
Недавно что-то странное начало происходить с Elasticsearch. Всё работало на разных серверах, а теперь и в локальной среде и нет should не учитывает некоторые слова. { "\_index" : "products", "\_type" : "\_doc", "\_id"… --- ## [Can I get only one data in logstash's output?](https://discuss.elastic.co/t/can-i-get-only-one-data-in-logstashs-output/259626)
**Author:** [@iooi](https://discuss.elastic.co/u/iooi)\ **Replies:** 1\ **Last updated:** [December 25, 2020, 4:09pm UTC](https://discuss.elastic.co/t/can-i-get-only-one-data-in-logstashs-output/259626 "2020-12-25T16:09:15Z")
Can I get only one data in logstash's output? If the data after filter like: "a" =\> 1, "b" =\> 2, "c" =\> 3, in the output, send it to elasticsearch. output { elasticsearch { protocol =\> http host =\>… --- ## [Logsource On-boarding](https://discuss.elastic.co/t/logsource-on-boarding/259590)
**Author:** [@ameermane](https://discuss.elastic.co/u/ameermane)\ **Replies:** 2\ **Last updated:** [December 25, 2020, 2:49pm UTC](https://discuss.elastic.co/t/logsource-on-boarding/259590 "2020-12-25T14:49:13Z")
Hello All, Hope you are doing good!!! ELK is new for me. I have deployed ELK in my lab and wondering how to onboard different logs source like paloalto , checkpoint , cisco firewalls. Please share any leadings that wi… --- ## [Journalbeat no connection event](https://discuss.elastic.co/t/journalbeat-no-connection-event/259633)
**Author:** [@Catherine](https://discuss.elastic.co/u/Catherine)\ **Replies:** 0\ **Last updated:** [December 25, 2020, 12:46pm UTC](https://discuss.elastic.co/t/journalbeat-no-connection-event/259633 "2020-12-25T12:46:17Z")
Hello I have a problem with no attempt to connect from journalbeat to logstash, even no errors (nothing at all). How to troubleshoot this problem? 2020-12-25T12:38:28.195Z INFO instance/beat.go:299 Setup … --- ## [How can I use elasticsearch java aip to agg from the Query Builders？](https://discuss.elastic.co/t/how-can-i-use-elasticsearch-java-aip-to-agg-from-the-query-builders/259624)
**Author:** [@Vastzhang](https://discuss.elastic.co/u/Vastzhang)\ **Replies:** 2\ **Last updated:** [December 25, 2020, 10:18am UTC](https://discuss.elastic.co/t/how-can-i-use-elasticsearch-java-aip-to-agg-from-the-query-builders/259624 "2020-12-25T10:18:19Z")
Hi!I use elasticsearch java api like as follw: how can i convert json as follow to java api？ Thanks！！！ --- ## [Can logstash's JDBC input plugin do multiple sql tasks?](https://discuss.elastic.co/t/can-logstashs-jdbc-input-plugin-do-multiple-sql-tasks/259573)
**Author:** [@iooi](https://discuss.elastic.co/u/iooi)\ **Replies:** 6\ **Last updated:** [December 25, 2020, 9:17am UTC](https://discuss.elastic.co/t/can-logstashs-jdbc-input-plugin-do-multiple-sql-tasks/259573 "2020-12-25T09:17:12Z")
Now there is a JDBC task read from db as input { jdbc { jdbc\_connection\_string =\> "jdbc:mysql://${MYSQL\_MAIN\_HOST}/${MYSQL\_DATABASE}" jdbc\_driver\_class =\> "com.mysql.cj.jdbc.Driver" jdbc\_page\_size =\> 10000… --- ## [Elasticsearch query that returns latest document for each group of criteria in the query](https://discuss.elastic.co/t/elasticsearch-query-that-returns-latest-document-for-each-group-of-criteria-in-the-query/259625)
**Author:** [@n0rman](https://discuss.elastic.co/u/n0rman)\ **Replies:** 0\ **Last updated:** [December 25, 2020, 9:07am UTC](https://discuss.elastic.co/t/elasticsearch-query-that-returns-latest-document-for-each-group-of-criteria-in-the-query/259625 "2020-12-25T09:07:30Z")
Newbie here. Trying to figure out how to query to find grandparent processes of child processes by using parent process info in windows logs. I have a list of child processes with host info (hostname) and parent proces… --- ## [Indexer Mongodb dans ES en temps réel](https://discuss.elastic.co/t/indexer-mongodb-dans-es-en-temps-reel/259190)
**Author:** [@Jalil](https://discuss.elastic.co/u/Jalil)\ **Replies:** 23\ **Last updated:** [December 25, 2020, 9:03am UTC](https://discuss.elastic.co/t/indexer-mongodb-dans-es-en-temps-reel/259190 "2020-12-25T09:03:53Z")
Bonjour à tous, Mon besoin est d'indexer en temps réel une base mongodb (plusieurs collections) dans Elasticsearch (en leur appliquant qlq transformation au passage : formatage des geo\_point par exemple). J'ai essayé a… --- ## [Logstash doesnt update the data when mongodb data gets updated](https://discuss.elastic.co/t/logstash-doesnt-update-the-data-when-mongodb-data-gets-updated/259562)
**Author:** [@Siddhanta\_Das](https://discuss.elastic.co/u/Siddhanta_Das)\ **Replies:** 1\ **Last updated:** [December 25, 2020, 8:42am UTC](https://discuss.elastic.co/t/logstash-doesnt-update-the-data-when-mongodb-data-gets-updated/259562 "2020-12-25T08:42:18Z")
I am using this configuration input{ mongodb{ uri=\>"mongodb://localhost:27017/ebyat" placeholder\_db\_dir =\> "/opt/logstash-mongodb/" placeholder\_db\_name =\> "logstash\_sqlite.db" collection =\> "amenities" batch\_size =\>… --- ## [Grok pattern to match multiple results](https://discuss.elastic.co/t/grok-pattern-to-match-multiple-results/259605)
**Author:** [@Minor\_Vargas](https://discuss.elastic.co/u/Minor_Vargas)\ **Replies:** 1\ **Last updated:** [December 25, 2020, 8:29am UTC](https://discuss.elastic.co/t/grok-pattern-to-match-multiple-results/259605 "2020-12-25T08:29:14Z")
Hi guys, I need to match the first line of each log and maybe store it in an array and prepend some metadata at the beginning of each line.. I have a grok pattern that's matching only the first result and ignores the re… --- ## [Dec 25th, 2020 \[EN\] Santa’s Little Helper - Workplace Search](https://discuss.elastic.co/t/dec-25th-2020-en-santa-s-little-helper-workplace-search/256691)
**Author:** [@Sean\_Story](https://discuss.elastic.co/u/Sean_Story)\ **Replies:** 0\ **Last updated:** [December 25, 2020, 8:00am UTC](https://discuss.elastic.co/t/dec-25th-2020-en-santa-s-little-helper-workplace-search/256691 "2020-12-25T08:00:13Z")
Santa’s Little Helper - Workplace Search You might have picked up on this from movies: Santa’s operation is pretty high tech. It’s a big job, coordinating a massive workforce of Elves to ensure the timely delivery of… --- ## [Line chart canvas visualization](https://discuss.elastic.co/t/line-chart-canvas-visualization/259466)
**Author:** [@salma\_widiarti](https://discuss.elastic.co/u/salma_widiarti)\ **Replies:** 2\ **Last updated:** [December 25, 2020, 5:54am UTC](https://discuss.elastic.co/t/line-chart-canvas-visualization/259466 "2020-12-25T05:54:24Z")
Hi all, I have data like this And this is my query SELECT substring(labels.tanggal,1,4) as date1, SUM(labels.money::int) as a FROM "apm-\*" WHERE labels.status = 'PAID' GROUP BY date1 But why when I make a visualiza… --- ## [Grok pattern to add some metadata to every log](https://discuss.elastic.co/t/grok-pattern-to-add-some-metadata-to-every-log/259432)
**Author:** [@Minor\_Vargas](https://discuss.elastic.co/u/Minor_Vargas)\ **Replies:** 1\ **Last updated:** [December 23, 2020, 6:48am UTC](https://discuss.elastic.co/t/grok-pattern-to-add-some-metadata-to-every-log/259432 "2020-12-23T06:48:39Z")
Hello all, I wrote a grok pattern that matches the beginning of each log line (Writing table data). I need to take the timestamp that I already matched and append it at the beginning of each log line. I'm facing 2 issue… --- ## [Index Management Tab is not visible after updating to 7.9.1](https://discuss.elastic.co/t/index-management-tab-is-not-visible-after-updating-to-7-9-1/259418)
**Author:** [@oskrdt](https://discuss.elastic.co/u/oskrdt)\ **Replies:** 6\ **Last updated:** [December 24, 2020, 6:01pm UTC](https://discuss.elastic.co/t/index-management-tab-is-not-visible-after-updating-to-7-9-1/259418 "2020-12-24T18:01:51Z")
Hi, I'm working with Elasticsearch and Kibana on Power PC docker containers. I'm using the Dockerfiles from ppc64le/build-scripts repository to create the container images, which use the source code on GitHub from the e… --- ## [How Resubscribe watcher email](https://discuss.elastic.co/t/how-resubscribe-watcher-email/259598)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 4\ **Last updated:** [December 24, 2020, 5:49pm UTC](https://discuss.elastic.co/t/how-resubscribe-watcher-email/259598 "2020-12-24T17:49:41Z")
how can i re-subscribe my mail to the watcher alerts, it no longer notifies me when an event happens in a watcher, i accidentally gave it in unsubscribed, but now i don't know how to re-subscribe my mail to get the alert… --- ## [Snapshot Policy Based on Data Phase](https://discuss.elastic.co/t/snapshot-policy-based-on-data-phase/259595)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 5\ **Last updated:** [December 24, 2020, 5:46pm UTC](https://discuss.elastic.co/t/snapshot-policy-based-on-data-phase/259595 "2020-12-24T17:46:17Z")
Hi All, I was wondering if it's possible to create snapshot policies that include/exclude indices based on their phase? I wasn't able to find any documentation on this and didn't see any posts about it. The use case I … --- ## [ERR\_TOO\_MANY\_REDIRECTS 302 with ELK Operator 7.10.0](https://discuss.elastic.co/t/err-too-many-redirects-302-with-elk-operator-7-10-0/259504)
**Author:** [@inforedaster](https://discuss.elastic.co/u/inforedaster)\ **Replies:** 6\ **Last updated:** [December 24, 2020, 5:11pm UTC](https://discuss.elastic.co/t/err-too-many-redirects-302-with-elk-operator-7-10-0/259504 "2020-12-24T17:11:15Z")
hello, i have an Elastick stack elasticsearch and kibana 7.10.0 using elk operator in kubernetes Whene i make the link https://monitoring.cloudapp.azure.com/kibana i have this redirection : https://monitoring.cloudap… --- ## [How to add Len dashboards to canvas](https://discuss.elastic.co/t/how-to-add-len-dashboards-to-canvas/259494)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 8\ **Last updated:** [December 23, 2020, 4:59pm UTC](https://discuss.elastic.co/t/how-to-add-len-dashboards-to-canvas/259494 "2020-12-23T16:59:15Z")
Hello, I have created a dashboards using Len to display the new users created in my different AD, and the name of the machine where they have been created, I added some filters and the final result look like that: Th… --- ## [Filebeat-logstash issue](https://discuss.elastic.co/t/filebeat-logstash-issue/259576)
**Author:** [@mustafa.husny](https://discuss.elastic.co/u/mustafa.husny)\ **Replies:** 2\ **Last updated:** [December 24, 2020, 12:55pm UTC](https://discuss.elastic.co/t/filebeat-logstash-issue/259576 "2020-12-24T12:55:57Z")
I am using ELK 7.6.2 I have three piplines first for the heartbeat second for the tcp to forward logs from QRadar Third is for filebeat I am receiving logs from heartbeat and qradar, but when I installed filebeat on… --- ## [Is there any way to configure HTTPS without X-Pack](https://discuss.elastic.co/t/is-there-any-way-to-configure-https-without-x-pack/259588)
**Author:** [@Shubham](https://discuss.elastic.co/u/Shubham)\ **Replies:** 1\ **Last updated:** [December 24, 2020, 12:38pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-configure-https-without-x-pack/259588 "2020-12-24T12:38:40Z")
Is there any way to configure HTTPS in ES cluster without using x-pack ? I'm using 5.4 version. I know it is doable freely in 6.8+ but any lead with 5.4 version ? --- ## [Filter logstash with grok not work](https://discuss.elastic.co/t/filter-logstash-with-grok-not-work/259324)
**Author:** [@eebor](https://discuss.elastic.co/u/eebor)\ **Replies:** 5\ **Last updated:** [December 24, 2020, 12:31pm UTC](https://discuss.elastic.co/t/filter-logstash-with-grok-not-work/259324 "2020-12-24T12:31:10Z")
anyone can help, i want to filter my log this is my log {Level:info Time:2020-12-03 12:14:28.203517503 +0700 WIB m=+18300.336235694 LoggerName: somefield Message://app/snmaterialdetail/4550554942/V222FAK-BA341T Caller:… --- ## [Bucket Terms aggregation, top 20 values](https://discuss.elastic.co/t/bucket-terms-aggregation-top-20-values/259031)
**Author:** [@grra](https://discuss.elastic.co/u/grra)\ **Replies:** 7\ **Last updated:** [December 24, 2020, 11:09am UTC](https://discuss.elastic.co/t/bucket-terms-aggregation-top-20-values/259031 "2020-12-24T11:09:47Z")
Hi, on my Buckets I have the Terms aggregation, with a field of the type number. I need the 20 biggest values of that field - in ascending order. Is it possible to order the Terms ascending and then take the last 20 … [Previous page](https://discuss.elastic.co/latest.md?page=1919) [Next page](https://discuss.elastic.co/latest.md?page=1921)