# Latest **URL:** https://discuss.elastic.co/latest.md?page=1966 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1967 --- ## [Filebeat for just forwarding Full text log](https://discuss.elastic.co/t/filebeat-for-just-forwarding-full-text-log/256697)
**Author:** [@seddikalaouiismaili](https://discuss.elastic.co/u/seddikalaouiismaili)\ **Replies:** 8\ **Last updated:** [December 1, 2020, 4:49pm UTC](https://discuss.elastic.co/t/filebeat-for-just-forwarding-full-text-log/256697 "2020-12-01T16:49:14Z")
Hello team, Is there any way using filebat (7.10), for just forwarding logs ? The main goals is : shipping log from differents sources (file log text) forward them to another (file log text), without do any changes i… --- ## [Field value factor based on matched term](https://discuss.elastic.co/t/field-value-factor-based-on-matched-term/257241)
**Author:** [@Tianyi\_Mao](https://discuss.elastic.co/u/Tianyi_Mao)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 4:44pm UTC](https://discuss.elastic.co/t/field-value-factor-based-on-matched-term/257241 "2020-12-01T16:44:18Z")
In https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-function-score-query.html#function-field-value-factor it is mentioned that one can use a numeric field in the document to influence scoring. C… --- ## [Inner hits in a double nested query fine in ES 7.7, but not working in 7.10](https://discuss.elastic.co/t/inner-hits-in-a-double-nested-query-fine-in-es-7-7-but-not-working-in-7-10/257239)
**Author:** [@timarkh](https://discuss.elastic.co/u/timarkh)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 4:25pm UTC](https://discuss.elastic.co/t/inner-hits-in-a-double-nested-query-fine-in-es-7-7-but-not-working-in-7-10/257239 "2020-12-01T16:25:46Z")
I have an index (sentences) where documents contain two kinds of nested objects, one (ana) inside the other (words). In my queries, I use two inner\_hits keys to highlight the matches. This worked fine in 5.6 and still wo… --- ## [Vega request @timestamp not mapped to timestamp field](https://discuss.elastic.co/t/vega-request-timestamp-not-mapped-to-timestamp-field/257200)
**Author:** [@ewolfman](https://discuss.elastic.co/u/ewolfman)\ **Replies:** 6\ **Last updated:** [December 1, 2020, 4:14pm UTC](https://discuss.elastic.co/t/vega-request-timestamp-not-mapped-to-timestamp-field/257200 "2020-12-01T16:14:52Z")
Hi, I am using Kibana and ES 7.10.0. I have a vega-lite widget that works and fetches from Elasticsearch the data. When trying using @timestamp in a vega-lite widget I get no results, and the warning: "Infinite extent … --- ## [Grok parse failures](https://discuss.elastic.co/t/grok-parse-failures/257230)
**Author:** [@naveenrt23](https://discuss.elastic.co/u/naveenrt23)\ **Replies:** 3\ **Last updated:** [December 1, 2020, 4:12pm UTC](https://discuss.elastic.co/t/grok-parse-failures/257230 "2020-12-01T16:12:21Z")
Hello I'm playing around with grok filters and i'm running into parse failures..Any idea whats wrong ? Filters: filter { if \[type\] == "app-data" { mutate { rename =\> \["env", "environment"\] } grok { … --- ## [How can I drop preflight http requst( OPTIONS request)in Logstash](https://discuss.elastic.co/t/how-can-i-drop-preflight-http-requst-options-request-in-logstash/257235)
**Author:** [@abdoegy83](https://discuss.elastic.co/u/abdoegy83)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 4:09pm UTC](https://discuss.elastic.co/t/how-can-i-drop-preflight-http-requst-options-request-in-logstash/257235 "2020-12-01T16:09:51Z")
how can I drop preflight HTTP request( OPTIONS request)in Logstash, how can I get access to the HTTP method (post,get,...) --- ## [Logstash Grok](https://discuss.elastic.co/t/logstash-grok/256682)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 3\ **Last updated:** [December 1, 2020, 3:51pm UTC](https://discuss.elastic.co/t/logstash-grok/256682 "2020-12-01T15:51:45Z")
I need to start a grok at \<190\> I dont care about anything before that . What is the way to do this ? \<13\>Nov 25 15:36:31 servername.abc.com LOGSTASH\[-\]: \<190\>Nov 25 07:36:31 --- ## [Ingest pipeline not working but working in the simulate API](https://discuss.elastic.co/t/ingest-pipeline-not-working-but-working-in-the-simulate-api/205322)
**Author:** [@themarcusaurelius](https://discuss.elastic.co/u/themarcusaurelius)\ **Replies:** 6\ **Last updated:** [December 1, 2020, 3:42pm UTC](https://discuss.elastic.co/t/ingest-pipeline-not-working-but-working-in-the-simulate-api/205322 "2020-12-01T15:42:41Z")
I have a pipeline that is filtering Palo Alto logs through Grok patterns and other processors. Testing with the simulate API shows that it works but when I try to ingest into elasticsearch none of the documents go throug… --- ## [How to solve AWS elasticsearch CircuitBreakingException error without elasticsearch.yml file?](https://discuss.elastic.co/t/how-to-solve-aws-elasticsearch-circuitbreakingexception-error-without-elasticsearch-yml-file/257226)
**Author:** [@I\_Hathout](https://discuss.elastic.co/u/I_Hathout)\ **Replies:** 1\ **Last updated:** [December 1, 2020, 3:31pm UTC](https://discuss.elastic.co/t/how-to-solve-aws-elasticsearch-circuitbreakingexception-error-without-elasticsearch-yml-file/257226 "2020-12-01T15:31:18Z")
I have the CircuitBreakingException issue and I found a solution in another topic, by setting the elasticsearch.yml real memory breaker variable to false, but in my case AWS Elasticsearch has no .yml file. so how to sol… --- ## [No geopoint for destination.ip but latitude and longitude field - 7.10](https://discuss.elastic.co/t/no-geopoint-for-destination-ip-but-latitude-and-longitude-field-7-10/256905)
**Author:** [@Camille](https://discuss.elastic.co/u/Camille)\ **Replies:** 3\ **Last updated:** [December 1, 2020, 3:23pm UTC](https://discuss.elastic.co/t/no-geopoint-for-destination-ip-but-latitude-and-longitude-field-7-10/256905 "2020-12-01T15:23:53Z")
Hi, i'm trying to use "geoip" module on a destination.ip. My logstash code is : if \[destination.ip\] { geoip { source =\> "destination.ip" target =\> "destination.geo" } … --- ## [Log rotation policy](https://discuss.elastic.co/t/log-rotation-policy/256683)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 3\ **Last updated:** [December 1, 2020, 3:17pm UTC](https://discuss.elastic.co/t/log-rotation-policy/256683 "2020-12-01T15:17:39Z")
I have deployed elasticsearch cluster in GCP with one master and data-ingest nodes. What is the default log rotation policy. How frequently logs are rotated? How much logs will be collected in pvc? --- ## [Logstash starts then stops after enabling tcp output config](https://discuss.elastic.co/t/logstash-starts-then-stops-after-enabling-tcp-output-config/257224)
**Author:** [@gprimm](https://discuss.elastic.co/u/gprimm)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 3:11pm UTC](https://discuss.elastic.co/t/logstash-starts-then-stops-after-enabling-tcp-output-config/257224 "2020-12-01T15:11:46Z")
I am trying to send logs to an address listening on a tcp port, but when I add the lines to an output config and restart the logstash service logstash will start for a minute and then fail. There are no errors anywhere a… --- ## [\[Pipeline to Pipeline communication\] - passing pipeline id dinamically to send\_to =\>](https://discuss.elastic.co/t/pipeline-to-pipeline-communication-passing-pipeline-id-dinamically-to-send-to/257222)
**Author:** [@Flavio1](https://discuss.elastic.co/u/Flavio1)\ **Replies:** 1\ **Last updated:** [December 1, 2020, 3:08pm UTC](https://discuss.elastic.co/t/pipeline-to-pipeline-communication-passing-pipeline-id-dinamically-to-send-to/257222 "2020-12-01T15:08:30Z")
Hi everybody, does exist a method to pass the value of pipeline id dinamically in send\_to. in my environment every log has a field with a value corresponding to a pipeline id present in my pipelines.yml. A hoped that wit… --- ## [Logstash not restarting/stoping](https://discuss.elastic.co/t/logstash-not-restarting-stoping/257153)
**Author:** [@PraveenKT](https://discuss.elastic.co/u/PraveenKT)\ **Replies:** 1\ **Last updated:** [December 1, 2020, 2:55pm UTC](https://discuss.elastic.co/t/logstash-not-restarting-stoping/257153 "2020-12-01T14:55:12Z")
Logstash is not restarting/stoping? How do we stop/restart? OS is CentOS 8 Logstash version using : 7.10 ( on previous versions also it is not stoping). \[root@INHY-PAPP-ELK01 conf.d\]# \[root@INHY-PAPP-ELK01 conf.d\]# … --- ## [Truncate filter adds tag even if no fileds were truncated](https://discuss.elastic.co/t/truncate-filter-adds-tag-even-if-no-fileds-were-truncated/257179)
**Author:** [@sarabande](https://discuss.elastic.co/u/sarabande)\ **Replies:** 1\ **Last updated:** [December 1, 2020, 2:34pm UTC](https://discuss.elastic.co/t/truncate-filter-adds-tag-even-if-no-fileds-were-truncated/257179 "2020-12-01T14:34:40Z")
Hi, I'm using truncate filter to truncate messages longer than 32766 bytes. In that case I'd like the tag 'truncated\_message' to be added to the message. This is how I use truncate filter in my logstash configuration: … --- ## [Logstash parse csv file with a column that contains multiple comma separated data points?](https://discuss.elastic.co/t/logstash-parse-csv-file-with-a-column-that-contains-multiple-comma-separated-data-points/256874)
**Author:** [@reillye](https://discuss.elastic.co/u/reillye)\ **Replies:** 7\ **Last updated:** [December 1, 2020, 2:33pm UTC](https://discuss.elastic.co/t/logstash-parse-csv-file-with-a-column-that-contains-multiple-comma-separated-data-points/256874 "2020-12-01T14:33:10Z")
I have a CSV file with multiple entries in the following format (the headers are not included in the actual data): Time, FT Data (2048 entries), SNR, Frequency 430201865, 1000, 2000, 8500,... 4.50, 1266.255 2… --- ## [Pushing data from one elastic search to another elastic search](https://discuss.elastic.co/t/pushing-data-from-one-elastic-search-to-another-elastic-search/257214)
**Author:** [@Nkrb](https://discuss.elastic.co/u/Nkrb)\ **Replies:** 1\ **Last updated:** [December 1, 2020, 2:20pm UTC](https://discuss.elastic.co/t/pushing-data-from-one-elastic-search-to-another-elastic-search/257214 "2020-12-01T14:20:05Z")
Hi, We have a need to pull Elasticsearch data from our environment and push the same to another Elasticsearch database, which is on another environment. Our indices are of time-based pattern, hence data push should be i… --- ## [Elasticsearch stores plain text](https://discuss.elastic.co/t/elasticsearch-stores-plain-text/257212)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 1\ **Last updated:** [December 1, 2020, 2:18pm UTC](https://discuss.elastic.co/t/elasticsearch-stores-plain-text/257212 "2020-12-01T14:18:39Z")
Did elasticsearch allows only to store data in json format? or is to possible to pass plain text to store in elasticsearch? --- ## [Why alias field name does not show in discover mode, and index pattern has created](https://discuss.elastic.co/t/why-alias-field-name-does-not-show-in-discover-mode-and-index-pattern-has-created/257087)
**Author:** [@qub123](https://discuss.elastic.co/u/qub123)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 4:21pm UTC](https://discuss.elastic.co/t/why-alias-field-name-does-not-show-in-discover-mode-and-index-pattern-has-created/257087 "2020-11-30T16:21:01Z")
I have 24 actual fields in each document, and also with alias on each actual field name, so in total 24 aliases with string , number and date type. I also have created index pattern for that, but I am not sure why I am… --- ## [React Search UI is remounting its children on state or prop update](https://discuss.elastic.co/t/react-search-ui-is-remounting-its-children-on-state-or-prop-update/254501)
**Author:** [@ranjeet.tiwari](https://discuss.elastic.co/u/ranjeet.tiwari)\ **Replies:** 3\ **Last updated:** [December 1, 2020, 2:06pm UTC](https://discuss.elastic.co/t/react-search-ui-is-remounting-its-children-on-state-or-prop-update/254501 "2020-12-01T14:06:38Z")
We are experiencing an issue with the search UI, whenever we perform any action on search ui, it unmount and remount its children. Basically it is remounting its children again n again on any state changes. Sample code… --- ## [Message Parsing](https://discuss.elastic.co/t/message-parsing/256572)
**Author:** [@droidus](https://discuss.elastic.co/u/droidus)\ **Replies:** 5\ **Last updated:** [December 1, 2020, 1:32pm UTC](https://discuss.elastic.co/t/message-parsing/256572 "2020-12-01T13:32:25Z")
Here is what my logstash output looks like: output { elasticsearch { index =\> "%{\[@metadata\]\[beat\]}" hosts =\> "192.168.0.103" } } Logstash errors are as follows: \[2020-11-18T13:08:12,824\]\[WARN \]\[logstash.c… --- ## [Wildcard queries return responses in ES 6.8.0, but not in ES 7.9.3,](https://discuss.elastic.co/t/wildcard-queries-return-responses-in-es-6-8-0-but-not-in-es-7-9-3/257207)
**Author:** [@Tamil\_Selvan](https://discuss.elastic.co/u/Tamil_Selvan)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 1:26pm UTC](https://discuss.elastic.co/t/wildcard-queries-return-responses-in-es-6-8-0-but-not-in-es-7-9-3/257207 "2020-12-01T13:26:21Z")
{ "\_source": \[ "\_id" \], "query": { "bool": { "filter": { "bool": { "must": \[ { "query\_string": { "\_name": "0", "d… --- ## [Problems creating Alerts based on Logs Fields content](https://discuss.elastic.co/t/problems-creating-alerts-based-on-logs-fields-content/257191)
**Author:** [@Ayodele\_Ajayi](https://discuss.elastic.co/u/Ayodele_Ajayi)\ **Replies:** 1\ **Last updated:** [December 1, 2020, 1:23pm UTC](https://discuss.elastic.co/t/problems-creating-alerts-based-on-logs-fields-content/257191 "2020-12-01T13:23:30Z")
I am facing Problems creating Alerts for my Docker Application events based on Logs Fields content like error or warning or any other string in Kibana Discover, any guides or documentation that could help? --- ## [Workplace Search - Text extraction from big pdf files](https://discuss.elastic.co/t/workplace-search-text-extraction-from-big-pdf-files/257043)
**Author:** [@sam1325](https://discuss.elastic.co/u/sam1325)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 12:25pm UTC](https://discuss.elastic.co/t/workplace-search-text-extraction-from-big-pdf-files/257043 "2020-12-01T12:25:58Z")
I added Dropbox as a content source to my Enterprise-search cloud instance. All files got indexed as expected and I can search across multiple sources. But I noticed that for big pdf files (30+ pages), only the first ~10… --- ## [\_split\_type\_failure](https://discuss.elastic.co/t/split-type-failure/256959)
**Author:** [@salma\_widiarti](https://discuss.elastic.co/u/salma_widiarti)\ **Replies:** 6\ **Last updated:** [December 1, 2020, 4:03am UTC](https://discuss.elastic.co/t/split-type-failure/256959 "2020-12-01T04:03:44Z")
Hi all, i have config logstash like this input { http\_poller { urls =\> { users =\> { method =\> GET user =\> "user@gmail.com" password =\> "password" … --- ## [Unable to import Docker dashboard into kibana](https://discuss.elastic.co/t/unable-to-import-docker-dashboard-into-kibana/257195)
**Author:** [@Jose\_Angel\_Morena\_Si](https://discuss.elastic.co/u/Jose_Angel_Morena_Si)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 11:14am UTC](https://discuss.elastic.co/t/unable-to-import-docker-dashboard-into-kibana/257195 "2020-12-01T11:14:16Z")
Hello, I cannot import Docker metrics dashboard into Kibana. Kibana version 7.9.1 Metricbeat version 7.9.1 Whenever I run the following command from machine where Metricbeat is running, Kibana API returns 400 err… --- ## [Single Line Logs - No newline character](https://discuss.elastic.co/t/single-line-logs-no-newline-character/254941)
**Author:** [@CWelsh](https://discuss.elastic.co/u/CWelsh)\ **Replies:** 1\ **Last updated:** [December 1, 2020, 11:26am UTC](https://discuss.elastic.co/t/single-line-logs-no-newline-character/254941 "2020-12-01T11:26:07Z")
Filebeat documentation is very clear that logs not ending in a newline character will not be processed by filebeat: Documentation I do however have a number of logs which are written as single JSON objects, in a single … --- ## [Auto balancer not working in the midst of disk space crisis](https://discuss.elastic.co/t/auto-balancer-not-working-in-the-midst-of-disk-space-crisis/257173)
**Author:** [@test\_tester](https://discuss.elastic.co/u/test_tester)\ **Replies:** 8\ **Last updated:** [December 1, 2020, 11:07am UTC](https://discuss.elastic.co/t/auto-balancer-not-working-in-the-midst-of-disk-space-crisis/257173 "2020-12-01T11:07:08Z")
Hello everyone, So in my cluster, i have 3 nodes, with 70%, 88% and 65% disk space usage. As you might expect, my autobalancer is not working despite my configuration being set as 'enabled:all'. Afraid that my 2nd nod… --- ## [Filebeat to Logatsh, csv header d'ont send in first](https://discuss.elastic.co/t/filebeat-to-logatsh-csv-header-dont-send-in-first/257075)
**Author:** [@Alexis\_Devleeschauwe](https://discuss.elastic.co/u/Alexis_Devleeschauwe)\ **Replies:** 4\ **Last updated:** [December 1, 2020, 11:04am UTC](https://discuss.elastic.co/t/filebeat-to-logatsh-csv-header-dont-send-in-first/257075 "2020-12-01T11:04:34Z")
Hi. Description I need import csv file logs to elasticsearch, for this, have 3 stack Filebeats \> logstash \> elasticsearch. Filebeat read csv , datas is filter by logstash and elasticsearch is stores datas Problem Th… --- ## [Calculations between 2 Kibana hits on the @timestamp parameter](https://discuss.elastic.co/t/calculations-between-2-kibana-hits-on-the-timestamp-parameter/255958)
**Author:** [@Baptiste\_Orsoni](https://discuss.elastic.co/u/Baptiste_Orsoni)\ **Replies:** 11\ **Last updated:** [December 1, 2020, 10:43am UTC](https://discuss.elastic.co/t/calculations-between-2-kibana-hits-on-the-timestamp-parameter/255958 "2020-12-01T10:43:40Z")
Hello everyone, Here is the context : In Kibana, I have 2 hits, let's say A and B. The hit B is an "answer" of the hit A and will then be received after the creation of hit A (after a few seconds up to a few days). Hit… [Previous page](https://discuss.elastic.co/latest.md?page=1965) [Next page](https://discuss.elastic.co/latest.md?page=1967)