# Latest **URL:** https://discuss.elastic.co/latest.md?page=1968 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1969 --- ## [Parse KV:s beginning with a \key=value](https://discuss.elastic.co/t/parse-kv-s-beginning-with-a-xxx-key-value/257055)
**Author:** [@Elitlogik](https://discuss.elastic.co/u/Elitlogik)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 10:14pm UTC](https://discuss.elastic.co/t/parse-kv-s-beginning-with-a-xxx-key-value/257055 "2020-11-30T22:14:52Z")
Is there a way to easily remove the leading in a key-value sequence? \key1=value1 key2=value2 key3=value3 Filter looks like this now: filter { kv {} } Thank you for your support! --- ## [Filebeat: Ingest logs to Datastream](https://discuss.elastic.co/t/filebeat-ingest-logs-to-datastream/256164)
**Author:** [@vishakh](https://discuss.elastic.co/u/vishakh)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 10:06pm UTC](https://discuss.elastic.co/t/filebeat-ingest-logs-to-datastream/256164 "2020-11-30T22:06:56Z")
ELK-stack: 7.10 Currently, I'm using filebeat to ingest logs to elasticsearch directly to an index (example: useract-\*) Since 7.9.1, I see a new feature called data-stream. Question: How can we specify and make filebe… --- ## [ELK stack set up - Filebeat setup failing](https://discuss.elastic.co/t/elk-stack-set-up-filebeat-setup-failing/257122)
**Author:** [@Guy\_Goodrick](https://discuss.elastic.co/u/Guy_Goodrick)\ **Replies:** 5\ **Last updated:** [November 30, 2020, 9:54pm UTC](https://discuss.elastic.co/t/elk-stack-set-up-filebeat-setup-failing/257122 "2020-11-30T21:54:51Z")
Hello - I'm new to this, just getting started installing the ELK stack on Ubuntu 20.04. Everything is running on that one server for now (though eventually we will want to look at a production version with a cluster, but… --- ## [Filebeat httpjson with content type plus beat block](https://discuss.elastic.co/t/filebeat-httpjson-with-content-type-plus-beat-block/257131)
**Author:** [@jkaufmanlr](https://discuss.elastic.co/u/jkaufmanlr)\ **Replies:** 0\ **Last updated:** [November 30, 2020, 9:48pm UTC](https://discuss.elastic.co/t/filebeat-httpjson-with-content-type-plus-beat-block/257131 "2020-11-30T21:48:30Z")
okay I am at a loss, I have a POST api call that has a body and absolutely requires content-type: "application/json" without the content-type I can get the api to make the call but the json response isn't what I was exp… --- ## [No metricbeat data sent via Logstash is shown in Kibana "Metrics" section](https://discuss.elastic.co/t/no-metricbeat-data-sent-via-logstash-is-shown-in-kibana-metrics-section/257091)
**Author:** [@phlegx](https://discuss.elastic.co/u/phlegx)\ **Replies:** 3\ **Last updated:** [November 30, 2020, 7:23pm UTC](https://discuss.elastic.co/t/no-metricbeat-data-sent-via-logstash-is-shown-in-kibana-metrics-section/257091 "2020-11-30T19:23:00Z")
Hi there, I'm sending Metricbeat data via Logstash to Elasticsearch. Data is there and I can query the index just fine in Kibana "Discover". However, even if I add the index in "Observability -\> Metrics - \> Settings",… --- ## [\[ERROR\] Ruby exception occurred: undefined method \`time' for nil:NilClass](https://discuss.elastic.co/t/error-ruby-exception-occurred-undefined-method-time-for-nil-nilclass/256062)
**Author:** [@artem33region](https://discuss.elastic.co/u/artem33region)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 9:09pm UTC](https://discuss.elastic.co/t/error-ruby-exception-occurred-undefined-method-time-for-nil-nilclass/256062 "2020-11-30T21:09:11Z")
Всем привет, в logstash логе возникает ошибка, в моем конфиге есть только одно упоминание про Ruby, вот оно: ruby { code =\> " event.set('duration\_call', event.get('Duration\_temp').time.strftime('%H:%M:… --- ## [New installation - Unable to connect to kibana 7.9.2](https://discuss.elastic.co/t/new-installation-unable-to-connect-to-kibana-7-9-2/256579)
**Author:** [@drivera](https://discuss.elastic.co/u/drivera)\ **Replies:** 4\ **Last updated:** [November 30, 2020, 8:05pm UTC](https://discuss.elastic.co/t/new-installation-unable-to-connect-to-kibana-7-9-2/256579 "2020-11-30T20:05:27Z")
Unable to connect to my kibana server. When connecting through my browser I get the message "refused to connect". This is a new installation. No visible errors in the kibana.log file. Not sure where to go from here. I'm … --- ## [Best Possible way to implement two words search](https://discuss.elastic.co/t/best-possible-way-to-implement-two-words-search/256837)
**Author:** [@Vipul\_Sharma](https://discuss.elastic.co/u/Vipul_Sharma)\ **Replies:** 0\ **Last updated:** [November 27, 2020, 5:37am UTC](https://discuss.elastic.co/t/best-possible-way-to-implement-two-words-search/256837 "2020-11-27T05:37:39Z")
Hi, I was wondering what would be the best possible way to write a ES query to fetch the documents in a way that if the search query is like: 'elastic search' Then on the top it will show all the documents with 'elast… --- ## [Help with querying text fields that contain decimal values, ie 2000 = 2000.00](https://discuss.elastic.co/t/help-with-querying-text-fields-that-contain-decimal-values-ie-2000-2000-00/256547)
**Author:** [@DaveRowley](https://discuss.elastic.co/u/DaveRowley)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 7:40pm UTC](https://discuss.elastic.co/t/help-with-querying-text-fields-that-contain-decimal-values-ie-2000-2000-00/256547 "2020-11-30T19:40:38Z")
Hello, I'm having difficulty trying to find decimal values in a text field without specifying the decimal part. I'd like a query for '2000' to also include results from fields that contain '2000.00', and preferably ignor… --- ## [How to use the result of two buckets count divison in alerts?](https://discuss.elastic.co/t/how-to-use-the-result-of-two-buckets-count-divison-in-alerts/257109)
**Author:** [@I\_Hathout](https://discuss.elastic.co/u/I_Hathout)\ **Replies:** 0\ **Last updated:** [November 30, 2020, 6:03pm UTC](https://discuss.elastic.co/t/how-to-use-the-result-of-two-buckets-count-divison-in-alerts/257109 "2020-11-30T18:03:18Z")
I 've a filter that contains data from two indices payment\_transfer and payment\_transfer\_failure. I want to set an alert of the number of transfer\_failure\_count in a month/ number of transfers whiten the same month is ab… --- ## [Change section type?](https://discuss.elastic.co/t/change-section-type/256570)
**Author:** [@Matias\_Gerstner](https://discuss.elastic.co/u/Matias_Gerstner)\ **Replies:** 5\ **Last updated:** [November 30, 2020, 7:37pm UTC](https://discuss.elastic.co/t/change-section-type/256570 "2020-11-30T19:37:45Z")
Hello, my English is not very good, but I want to ask you a question, to see if it is possible what I am trying to do or not. I need to change the NAME of the "type" section, in several indices already created and wit… --- ## [Filter individual json fields using json filters](https://discuss.elastic.co/t/filter-individual-json-fields-using-json-filters/257028)
**Author:** [@naveenrt23](https://discuss.elastic.co/u/naveenrt23)\ **Replies:** 16\ **Last updated:** [November 30, 2020, 7:34pm UTC](https://discuss.elastic.co/t/filter-individual-json-fields-using-json-filters/257028 "2020-11-30T19:34:20Z")
I'm trying to parse my message into json fields using Json filters but running into issues Error: Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::Configurati… --- ## [How to use App Search in Wordpress?](https://discuss.elastic.co/t/how-to-use-app-search-in-wordpress/254931)
**Author:** [@Mohanish\_Sontakke](https://discuss.elastic.co/u/Mohanish_Sontakke)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 7:30pm UTC](https://discuss.elastic.co/t/how-to-use-app-search-in-wordpress/254931 "2020-11-30T19:30:17Z")
I want to integrate App Search within WordPress so can you please me the steps on how to do that? I tried it using npm start but I don't want to use the npm start. I just want to use the react package. Please provide fur… --- ## [Can we override the way data gets stored in elasticsearch](https://discuss.elastic.co/t/can-we-override-the-way-data-gets-stored-in-elasticsearch/257106)
**Author:** [@Vivek\_Sagar](https://discuss.elastic.co/u/Vivek_Sagar)\ **Replies:** 4\ **Last updated:** [November 30, 2020, 7:27pm UTC](https://discuss.elastic.co/t/can-we-override-the-way-data-gets-stored-in-elasticsearch/257106 "2020-11-30T19:27:20Z")
Is there a way to override how the data is stored in elasticsearch? I want to encrypt the data just before elasticsearch writes it to file system and just before sending the search query to file-system send the encrypted… --- ## [Close Index Api warning in ES version 6.8](https://discuss.elastic.co/t/close-index-api-warning-in-es-version-6-8/256662)
**Author:** [@mrudrego](https://discuss.elastic.co/u/mrudrego)\ **Replies:** 5\ **Last updated:** [November 30, 2020, 7:24pm UTC](https://discuss.elastic.co/t/close-index-api-warning-in-es-version-6-8/256662 "2020-11-30T19:24:29Z")
Hi, There is a warning in Elasticsearch 6.8 version document about Close index api which states To reduce the risk of data loss, avoid keeping closed indices in your cluster for long periods of time. When a node leave… --- ## [Use existing elastic search persistence disk](https://discuss.elastic.co/t/use-existing-elastic-search-persistence-disk/257118)
**Author:** [@rajkumar\_25](https://discuss.elastic.co/u/rajkumar_25)\ **Replies:** 0\ **Last updated:** [November 30, 2020, 7:17pm UTC](https://discuss.elastic.co/t/use-existing-elastic-search-persistence-disk/257118 "2020-11-30T19:17:12Z")
I am facing "cluster\_uuid": "na", an issue in my GKE deployed elastic search. I haven’t taken any snapshots. But the persistence disk is still available. Is there is any way to retrieve the data from the existing persis… --- ## [Is there a SIMILAR TO in Elasticsearch SQL?](https://discuss.elastic.co/t/is-there-a-similar-to-in-elasticsearch-sql/256595)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 7:10pm UTC](https://discuss.elastic.co/t/is-there-a-similar-to-in-elasticsearch-sql/256595 "2020-11-30T19:10:42Z")
Hi, I want to match several values in a Elasticsearch SQL query, is there something like "SIMILAR TO" to do this? WHERE items SIMILAR TO 'CPU Porcentual|CPU Utilization' --- ## [Ensuring uniqueness of IDs across indices during insertion](https://discuss.elastic.co/t/ensuring-uniqueness-of-ids-across-indices-during-insertion/257113)
**Author:** [@jmaharjan](https://discuss.elastic.co/u/jmaharjan)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 6:44pm UTC](https://discuss.elastic.co/t/ensuring-uniqueness-of-ids-across-indices-during-insertion/257113 "2020-11-30T18:44:01Z")
From what I understand, if we assign explicit ids to documents we might end up with multiple documents with the same id in different indices. Is there a way to ensure, when using explicit document ids, that a document id… --- ## [Searching terms in Inverted index](https://discuss.elastic.co/t/searching-terms-in-inverted-index/257111)
**Author:** [@prasad.deshpande](https://discuss.elastic.co/u/prasad.deshpande)\ **Replies:** 0\ **Last updated:** [November 30, 2020, 6:16pm UTC](https://discuss.elastic.co/t/searching-terms-in-inverted-index/257111 "2020-11-30T18:16:06Z")
Is there a way in Elasticsearch in which I can search all the terms in the inverted index? So say, if I want to find all the terms (Not the documents..) starting with au and ending with o. I know that there is a \_termve… --- ## [Strange behavior with date histogram aggregation in a field that is inside a nested object (Elasticsearch 7.10.0)](https://discuss.elastic.co/t/strange-behavior-with-date-histogram-aggregation-in-a-field-that-is-inside-a-nested-object-elasticsearch-7-10-0/256823)
**Author:** [@tberne](https://discuss.elastic.co/u/tberne)\ **Replies:** 7\ **Last updated:** [November 30, 2020, 6:11pm UTC](https://discuss.elastic.co/t/strange-behavior-with-date-histogram-aggregation-in-a-field-that-is-inside-a-nested-object-elasticsearch-7-10-0/256823 "2020-11-30T18:11:54Z")
Hi! I'm in the middle of an upgrade process to the 7.10.0 Elasticsearch (changing the client from TransportClient to JavaRestHighLevelClient also) and I've noticed a strange behavior of Date Histogram Aggregation when i… --- ## [How to get data from large JDBC quires?](https://discuss.elastic.co/t/how-to-get-data-from-large-jdbc-quires/254647)
**Author:** [@I\_Hathout](https://discuss.elastic.co/u/I_Hathout)\ **Replies:** 12\ **Last updated:** [November 30, 2020, 6:04pm UTC](https://discuss.elastic.co/t/how-to-get-data-from-large-jdbc-quires/254647 "2020-11-30T18:04:05Z")
Hello, I am trying to get data from a postgres database using JDBC. I managed to get data to stdout by using only 3 fields, but it fails because of the large number of fields in the query. here is the output from runni… --- ## [Public stock offering?](https://discuss.elastic.co/t/public-stock-offering/257100)
**Author:** [@PremiumLeo](https://discuss.elastic.co/u/PremiumLeo)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 5:42pm UTC](https://discuss.elastic.co/t/public-stock-offering/257100 "2020-11-30T17:42:50Z")
Anyone know if elastic has a publicly traded stock? Thanks --- ## [Dealing with "tags" =\> \[ \[0\] "multiline" \] in xml filter for logstash](https://discuss.elastic.co/t/dealing-with-tags-0-multiline-in-xml-filter-for-logstash/257094)
**Author:** [@amol\_p81](https://discuss.elastic.co/u/amol_p81)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 5:19pm UTC](https://discuss.elastic.co/t/dealing-with-tags-0-multiline-in-xml-filter-for-logstash/257094 "2020-11-30T17:19:22Z")
Hi, I have setup xml filter for logstash (in config file) however how can i avoid below from getting displayed: "tags" =\> \[ \[0\] "multiline" \] Regards Amol --- ## [Logstash aggregate without unique id](https://discuss.elastic.co/t/logstash-aggregate-without-unique-id/257068)
**Author:** [@bbwolf](https://discuss.elastic.co/u/bbwolf)\ **Replies:** 5\ **Last updated:** [November 30, 2020, 5:06pm UTC](https://discuss.elastic.co/t/logstash-aggregate-without-unique-id/257068 "2020-11-30T17:06:17Z")
Hello, supposed il have current log INFO - 12345 - TASK\_START - start INFO - 12345 - SQL - sqlQuery1 - 12 INFO - 12345 - SQL - sqlQuery2 - 34 INFO - 12345 - TASK\_END - end INFO - 12345 - TASK\_START - start INFO - … --- ## [Locating rogue clients with authentication errors](https://discuss.elastic.co/t/locating-rogue-clients-with-authentication-errors/257102)
**Author:** [@franco-martin](https://discuss.elastic.co/u/franco-martin)\ **Replies:** 0\ **Last updated:** [November 30, 2020, 4:51pm UTC](https://discuss.elastic.co/t/locating-rogue-clients-with-authentication-errors/257102 "2020-11-30T16:51:07Z")
Im using filebeat to export elasticsearch logs to well... elasticsearch. I get the authentication errors but not where they come from. I tried changing the log level to TRACE for the rest package but no luck. Is there a… --- ## [Parse logstash - rfc5424](https://discuss.elastic.co/t/parse-logstash-rfc5424/256992)
**Author:** [@Paulogbr](https://discuss.elastic.co/u/Paulogbr)\ **Replies:** 3\ **Last updated:** [November 30, 2020, 4:35pm UTC](https://discuss.elastic.co/t/parse-logstash-rfc5424/256992 "2020-11-30T16:35:25Z")
Hello guys, I need help to parse the syslog RFC 5424 with logstash. \<190\> 1 2020-11-28T14:18:03-02:00 workstantion1030.teste.corp WSEE - - \[message@01-\] @cee:{"type":"1","timestamp":"4698753981054","host\_name":"","user\_… --- ## [Ignore Spring Boot MVC endpoint and switch to @CaptureTransaction](https://discuss.elastic.co/t/ignore-spring-boot-mvc-endpoint-and-switch-to-capturetransaction/254948)
**Author:** [@ecostanzi](https://discuss.elastic.co/u/ecostanzi)\ **Replies:** 3\ **Last updated:** [November 30, 2020, 4:27pm UTC](https://discuss.elastic.co/t/ignore-spring-boot-mvc-endpoint-and-switch-to-capturetransaction/254948 "2020-11-30T16:27:03Z")
Kibana version: 7.4 Elasticsearch version: APM Server version: 7.4 APM Agent language and version: 1.18.1 Original install method (e.g. download page, yum, deb, from source, etc.) and version: deb Fresh install … --- ## [Just a question about a siem rule filter](https://discuss.elastic.co/t/just-a-question-about-a-siem-rule-filter/256397)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [November 30, 2020, 3:55pm UTC](https://discuss.elastic.co/t/just-a-question-about-a-siem-rule-filter/256397 "2020-11-30T15:55:27Z")
Hello, Just wondering what's the purpose of the extra info / metadata in the filter of for example: I can't find this info in the SIEM rule when I duplicate it: { "$state": { "store": "appState" },… --- ## [How to get MappingMetadata per type using Rest High Level Client?](https://discuss.elastic.co/t/how-to-get-mappingmetadata-per-type-using-rest-high-level-client/257082)
**Author:** [@amishar](https://discuss.elastic.co/u/amishar)\ **Replies:** 3\ **Last updated:** [November 30, 2020, 3:31pm UTC](https://discuss.elastic.co/t/how-to-get-mappingmetadata-per-type-using-rest-high-level-client/257082 "2020-11-30T15:31:47Z")
We are migrating from Transport Client to High Level Rest Client. We have a piece of code that get indices, mappings and settings using GetIndex call. For transport client, we use this code to obtain the index informati… --- ## [Logstash log unable to complete log read and throws error](https://discuss.elastic.co/t/logstash-log-unable-to-complete-log-read-and-throws-error/256945)
**Author:** [@msk\_76](https://discuss.elastic.co/u/msk_76)\ **Replies:** 4\ **Last updated:** [November 30, 2020, 3:12pm UTC](https://discuss.elastic.co/t/logstash-log-unable-to-complete-log-read-and-throws-error/256945 "2020-11-30T15:12:41Z")
I have setup logstash to read log files generated by another application realtime. The input config is like this. it is throwing the below error in logstash log. I am unable to track if it has been able to read the finis… [Previous page](https://discuss.elastic.co/latest.md?page=1967) [Next page](https://discuss.elastic.co/latest.md?page=1969)