# Latest **URL:** https://discuss.elastic.co/latest.md?page=869 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 870 --- ## [How does logstash match?](https://discuss.elastic.co/t/how-does-logstash-match/320610)
**Author:** [@stefanocog](https://discuss.elastic.co/u/stefanocog)\ **Replies:** 4\ **Last updated:** [December 6, 2022, 4:57pm UTC](https://discuss.elastic.co/t/how-does-logstash-match/320610 "2022-12-06T16:57:45Z")
Hello, I need to match some logs that differ only in one fields (url), I match with grok, each grok rule matches a log, so I have different filters but with different grok rules, but now I realize that some logs after d… --- ## [DLQ Processing](https://discuss.elastic.co/t/dlq-processing/320603)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 1\ **Last updated:** [December 6, 2022, 4:34pm UTC](https://discuss.elastic.co/t/dlq-processing/320603 "2022-12-06T16:34:54Z")
Hi, I'm trying to process events written to a dlq due to mapping conflicts. I'm not trying to preprocess any of those messages (yet). Instead, am just reading them in and writing them to a new index name. However, I get… --- ## [Activemq module give Grok error on filebeat](https://discuss.elastic.co/t/activemq-module-give-grok-error-on-filebeat/320608)
**Author:** [@amir\_Bialek](https://discuss.elastic.co/u/amir_Bialek)\ **Replies:** 0\ **Last updated:** [December 6, 2022, 3:58pm UTC](https://discuss.elastic.co/t/activemq-module-give-grok-error-on-filebeat/320608 "2022-12-06T15:58:35Z")
Hello all, Running in k8s I have activemq and filebeat, elasticsearch, kibana. filebeat collect the logs from activemq like so: filebeat.autodiscover: providers: - type: kubernetes … --- ## [8.5.2 won't start](https://discuss.elastic.co/t/8-5-2-wont-start/320516)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [December 6, 2022, 3:16pm UTC](https://discuss.elastic.co/t/8-5-2-wont-start/320516 "2022-12-06T15:16:58Z")
I have try to upgrade one of the cluster to 8.5.2 and it won't start I found this which is exact error I am getting. this is not on docker though. running on centos8.x https://github.com/elastic/elasticsearch/pull/9170… --- ## [APM Server index template matching \[traces-apm.sampled\] not found](https://discuss.elastic.co/t/apm-server-index-template-matching-traces-apm-sampled-not-found/319677)
**Author:** [@DenishPatel](https://discuss.elastic.co/u/DenishPatel)\ **Replies:** 2\ **Last updated:** [December 6, 2022, 3:06pm UTC](https://discuss.elastic.co/t/apm-server-index-template-matching-traces-apm-sampled-not-found/319677 "2022-12-06T15:06:40Z")
Kibana version: 8.5.1 Elasticsearch version:8.5.1 APM Server version:8.5.1 APM Agent language and version: Not yet installed Browser version:Chrome 107.0.5304.63 Original install method (e.g. download page, yum, deb… --- ## [How to setup watcher condition ctx.payload.hits.total in percentage?](https://discuss.elastic.co/t/how-to-setup-watcher-condition-ctx-payload-hits-total-in-percentage/320593)
**Author:** [@dharini\_u](https://discuss.elastic.co/u/dharini_u)\ **Replies:** 0\ **Last updated:** [December 6, 2022, 2:22pm UTC](https://discuss.elastic.co/t/how-to-setup-watcher-condition-ctx-payload-hits-total-in-percentage/320593 "2022-12-06T14:22:51Z")
Hi Folks, Please help me in setting up a watcher with the below condition: percentage of ctx.payload.hits.total of variable1 in percentage of variable2 \> 10% currently the condition is ctx.payload.hits.total \> params.… --- ## [It is possible to limit amount of hits per token?](https://discuss.elastic.co/t/it-is-possible-to-limit-amount-of-hits-per-token/320561)
**Author:** [@va2dim](https://discuss.elastic.co/u/va2dim)\ **Replies:** 2\ **Last updated:** [December 6, 2022, 1:47pm UTC](https://discuss.elastic.co/t/it-is-possible-to-limit-amount-of-hits-per-token/320561 "2022-12-06T13:47:00Z")
I have indexed refBook of materials: doc/id name 1 polibutilen 5 polibutelenteraftalat 13 elastan, 23 elastodien, 25 elastodin query could contain many materials (using OR operator): elastan, polibutilen. (examp… --- ## [How to grok haproxy Log](https://discuss.elastic.co/t/how-to-grok-haproxy-log/320566)
**Author:** [@Roccof97](https://discuss.elastic.co/u/Roccof97)\ **Replies:** 3\ **Last updated:** [December 6, 2022, 1:59pm UTC](https://discuss.elastic.co/t/how-to-grok-haproxy-log/320566 "2022-12-06T13:59:13Z")
Hi, I'm parsing this log, but I get stuck in curly braces, I don't know what exception to add to export dns and ip. This is my log: Dec 6 10:31:43 eu01-test-test haproxy\[1311\]: eu01-test.test.lan x.x.x.x:xxxx \[06/Dec… --- ## [How to download only desired entry rows from Eland (Elasticsearch python+pandas client)?](https://discuss.elastic.co/t/how-to-download-only-desired-entry-rows-from-eland-elasticsearch-python-pandas-client/320591)
**Author:** [@Ivo\_Tavares](https://discuss.elastic.co/u/Ivo_Tavares)\ **Replies:** 0\ **Last updated:** [December 6, 2022, 1:58pm UTC](https://discuss.elastic.co/t/how-to-download-only-desired-entry-rows-from-eland-elasticsearch-python-pandas-client/320591 "2022-12-06T13:58:10Z")
Currently, if I want to create a dataframe with specific entries from an index, using Eland, I must first download a dataframe with all the entries, and then filter them out, locally... this is hardly desirable in terms … --- ## [Ingestion pipeline dynamically creates empty object upon nested JSON](https://discuss.elastic.co/t/ingestion-pipeline-dynamically-creates-empty-object-upon-nested-json/320480)
**Author:** [@Douglas\_Korgut](https://discuss.elastic.co/u/Douglas_Korgut)\ **Replies:** 2\ **Last updated:** [December 6, 2022, 1:37pm UTC](https://discuss.elastic.co/t/ingestion-pipeline-dynamically-creates-empty-object-upon-nested-json/320480 "2022-12-06T13:37:08Z")
Hello guys! I've been trying to ingest documents through the ingestion pipeline provided by elastic. The idea is quite simple, transform the original JSON into one that has well formatted field names that at some point … --- ## [Unable to retrieve version information from Elasticsearch nodes](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes/320128)
**Author:** [@ali\_haider](https://discuss.elastic.co/u/ali_haider)\ **Replies:** 4\ **Last updated:** [December 6, 2022, 1:21pm UTC](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes/320128 "2022-12-06T13:21:42Z")
I am using Elasticsearch and Kibana 7.17 free and basic version. I am trying to setting up the minimal security. I did all of the following steps mentioned in the following document : I saw multiple solutions in whic… --- ## [Cannot parse empty date](https://discuss.elastic.co/t/cannot-parse-empty-date/320575)
**Author:** [@stefanocog](https://discuss.elastic.co/u/stefanocog)\ **Replies:** 4\ **Last updated:** [December 6, 2022, 1:16pm UTC](https://discuss.elastic.co/t/cannot-parse-empty-date/320575 "2022-12-06T13:16:58Z")
Hi, I have a log that has a json field inside that can have empty fields, specifically I have a date field, the log can be like this "2022-11-28 09:24:46:705"|"+0100"|"transId: xxxxxx"|"resId: xxxxxx"|"1.1.1.1"|"https:… --- ## [Фильтр по nested объектам](https://discuss.elastic.co/t/nested/320579)
**Author:** [@Alexkab](https://discuss.elastic.co/u/Alexkab)\ **Replies:** 0\ **Last updated:** [December 6, 2022, 12:46pm UTC](https://discuss.elastic.co/t/nested/320579 "2022-12-06T12:46:23Z")
Добрый день! Подскажите, пожалуйста, как вывести только нужные nested объекты PUT test { "mappings": { "properties": { "title": { "type": "text" }, "author": { "type": "object", … --- ## [Ingesting IBM BigFix Client Logs](https://discuss.elastic.co/t/ingesting-ibm-bigfix-client-logs/318437)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 2\ **Last updated:** [December 6, 2022, 12:47pm UTC](https://discuss.elastic.co/t/ingesting-ibm-bigfix-client-logs/318437 "2022-12-06T12:47:05Z")
I am needing to ingest the IBM BigFix client logs located at C:\\Program Files (x86)\\BigFix Enterprise\\BES Client\\\_BESData\\\_Global\\Logs. Is there either a Beat module or Logstash plugin which would handle parsing these lo… --- ## [ElasticSearch phrase search not working for wildcard search](https://discuss.elastic.co/t/elasticsearch-phrase-search-not-working-for-wildcard-search/320543)
**Author:** [@golofetuk](https://discuss.elastic.co/u/golofetuk)\ **Replies:** 6\ **Last updated:** [December 6, 2022, 12:18pm UTC](https://discuss.elastic.co/t/elasticsearch-phrase-search-not-working-for-wildcard-search/320543 "2022-12-06T12:18:55Z")
I have a word index and I can't search phrases on elasticsearch. there is no result. I check tons of solutions but I can't implement them to my query. My mapping looks like this; PUT /words/\_mapping { "properties": {… --- ## [Datafeed has missed 152 documents due to ingest latency](https://discuss.elastic.co/t/datafeed-has-missed-152-documents-due-to-ingest-latency/316267)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 4\ **Last updated:** [October 11, 2022, 4:19pm UTC](https://discuss.elastic.co/t/datafeed-has-missed-152-documents-due-to-ingest-latency/316267 "2022-10-11T16:19:52Z")
Running ELK 7.16.3 version Platinum Subscription. I am getting error message Datafeed has missed 152 documents due to ingest latency, latest bucket with missing data is \[2022-10-10T17:00:00.000Z\]. Consider increasing qu… --- ## [Indicator match](https://discuss.elastic.co/t/indicator-match/320569)
**Author:** [@ramiwashere](https://discuss.elastic.co/u/ramiwashere)\ **Replies:** 0\ **Last updated:** [December 6, 2022, 11:17am UTC](https://discuss.elastic.co/t/indicator-match/320569 "2022-12-06T11:17:22Z")
Hello, I'm sorry if this information had already been asked but I didn't find my answer on old topic. I'm stuck on a indicator match rule and idk if I misunderstand this type of rule: I have 2 index, lets call them in… --- ## [When adding a filter in kibana all string fields have a entry and .keyword entry](https://discuss.elastic.co/t/when-adding-a-filter-in-kibana-all-string-fields-have-a-entry-and-keyword-entry/320552)
**Author:** [@Rajesh\_R](https://discuss.elastic.co/u/Rajesh_R)\ **Replies:** 2\ **Last updated:** [December 6, 2022, 11:13am UTC](https://discuss.elastic.co/t/when-adding-a-filter-in-kibana-all-string-fields-have-a-entry-and-keyword-entry/320552 "2022-12-06T11:13:35Z")
When adding a filter in kibana all string fields have an entry and .keyword entry. please assist how to remove the keyword --- ## [Coordinating-only nodes are a \_significant\_ bottleneck for our cluster](https://discuss.elastic.co/t/coordinating-only-nodes-are-a-significant-bottleneck-for-our-cluster/319813)
**Author:** [@drs](https://discuss.elastic.co/u/drs)\ **Replies:** 9\ **Last updated:** [December 6, 2022, 10:50am UTC](https://discuss.elastic.co/t/coordinating-only-nodes-are-a-significant-bottleneck-for-our-cluster/319813 "2022-12-06T10:50:34Z")
We have a very large Elasticsearch cluster with the following node layout: masters: 5 ingest-only: 4 data-only: 98 coordinating-only: 3 Coordinating-only nodes have 32 cores and 64 GB of memory, data nodes typically… --- ## [Cannot change timestamp field in an existing data view in kibana](https://discuss.elastic.co/t/cannot-change-timestamp-field-in-an-existing-data-view-in-kibana/320532)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 4\ **Last updated:** [December 6, 2022, 8:45am UTC](https://discuss.elastic.co/t/cannot-change-timestamp-field-in-an-existing-data-view-in-kibana/320532 "2022-12-06T08:45:45Z")
Hello, I have created a dataview that uses @timetamp field which is generated from logstash. I wanted to change (edit) the default timestamp field to another field (timestamp\_seconds) in the dataview, but it is greyed o… --- ## [Dec 6th, 2022: \[EN\] A completion suggester for Santa's little helpers](https://discuss.elastic.co/t/dec-6th-2022-en-a-completion-suggester-for-santas-little-helpers/319231)
**Author:** [@Alexis\_Roberson](https://discuss.elastic.co/u/Alexis_Roberson)\ **Replies:** 0\ **Last updated:** [December 6, 2022, 8:00am UTC](https://discuss.elastic.co/t/dec-6th-2022-en-a-completion-suggester-for-santas-little-helpers/319231 "2022-12-06T08:00:07Z")
A completion suggester for Santa’s little helpers Introduction What is a completion suggester? Major components of a completion suggester Walkthrough / Demo Drawbacks Conclusion Introduction The elves have spun up … --- ## [Logstash input elasticsearch argument error](https://discuss.elastic.co/t/logstash-input-elasticsearch-argument-error/320538)
**Author:** [@CherryGoose](https://discuss.elastic.co/u/CherryGoose)\ **Replies:** 0\ **Last updated:** [December 6, 2022, 7:59am UTC](https://discuss.elastic.co/t/logstash-input-elasticsearch-argument-error/320538 "2022-12-06T07:59:32Z")
Hello. Im trying to setup my logstash to take docs from elastic and output them to console and im getting the following error \[ERROR\]\[logstash.agent \] Failed to execute action {:action=\>LogStash::PipelineActio… --- ## [DataNode disk full, despite on flood\_stage configuration](https://discuss.elastic.co/t/datanode-disk-full-despite-on-flood-stage-configuration/320468)
**Author:** [@gidonshn](https://discuss.elastic.co/u/gidonshn)\ **Replies:** 4\ **Last updated:** [December 6, 2022, 7:40am UTC](https://discuss.elastic.co/t/datanode-disk-full-despite-on-flood-stage-configuration/320468 "2022-12-06T07:40:22Z")
Hi All. I have a cluster (7.16.2) running on k8s, with multiple DataNodes, dedicated ClientNodes, and Dedicated MasterNodes. Some of the DataNodes are "hot" data nodes, and some of them are "warm". I have daily indice… --- ## [Access Secure Elastisearch Cluster from Ruby on Rails](https://discuss.elastic.co/t/access-secure-elastisearch-cluster-from-ruby-on-rails/320461)
**Author:** [@mbm1607](https://discuss.elastic.co/u/mbm1607)\ **Replies:** 4\ **Last updated:** [December 6, 2022, 7:31am UTC](https://discuss.elastic.co/t/access-secure-elastisearch-cluster-from-ruby-on-rails/320461 "2022-12-06T07:31:32Z")
I have setup a secure Elastisearch cluster with three nodes using the official installation with Docker Compose guide. It is being accessed from Kibana without issue. However now I need to access it from my custom ROR a… --- ## [How to write a painless script that get all the error from the EKS cluster as I want to create an error dashboad in kibana](https://discuss.elastic.co/t/how-to-write-a-painless-script-that-get-all-the-error-from-the-eks-cluster-as-i-want-to-create-an-error-dashboad-in-kibana/320533)
**Author:** [@ANIKET\_YADAV](https://discuss.elastic.co/u/ANIKET_YADAV)\ **Replies:** 0\ **Last updated:** [December 6, 2022, 7:31am UTC](https://discuss.elastic.co/t/how-to-write-a-painless-script-that-get-all-the-error-from-the-eks-cluster-as-i-want-to-create-an-error-dashboad-in-kibana/320533 "2022-12-06T07:31:28Z")
I want to create an error field in filebeat index pattern as I need to create an error dashboard that fetch me the error of my pods running in EKS cluster but for that it is required to write a script to add a field... P… --- ## [Filbeat with netflow as input and elastic output for oss elastic 7.6.1](https://discuss.elastic.co/t/filbeat-with-netflow-as-input-and-elastic-output-for-oss-elastic-7-6-1/320421)
**Author:** [@shaikmuzakkir](https://discuss.elastic.co/u/shaikmuzakkir)\ **Replies:** 4\ **Last updated:** [December 6, 2022, 7:09am UTC](https://discuss.elastic.co/t/filbeat-with-netflow-as-input-and-elastic-output-for-oss-elastic-7-6-1/320421 "2022-12-06T07:09:25Z")
Elastic cluster we have is of open source 7.6.1 version. We need filebeat to have netflow as input and elastic as output to write to our cluster. With filebeat open source, netflow is not enabled as input ERROR inst… --- ## [Logstash drop filter plugin](https://discuss.elastic.co/t/logstash-drop-filter-plugin/320526)
**Author:** [@bex](https://discuss.elastic.co/u/bex)\ **Replies:** 1\ **Last updated:** [December 6, 2022, 7:19am UTC](https://discuss.elastic.co/t/logstash-drop-filter-plugin/320526 "2022-12-06T07:19:31Z")
As we know, we can drop like that: if \[log\]\[file\]\[path\] == "/var/log/messages" { drop {} } But I have case when I am getting logs in format "/var/log/messages-20221212" or "/var/log/messages-date" But logstash drop … --- ## [Unable to restart a node - index.mapper.dynamic was removed after version 6.0.0](https://discuss.elastic.co/t/unable-to-restart-a-node-index-mapper-dynamic-was-removed-after-version-6-0-0/320506)
**Author:** [@newkidtopc](https://discuss.elastic.co/u/newkidtopc)\ **Replies:** 2\ **Last updated:** [December 6, 2022, 6:32am UTC](https://discuss.elastic.co/t/unable-to-restart-a-node-index-mapper-dynamic-was-removed-after-version-6-0-0/320506 "2022-12-06T06:32:08Z")
We have been running our ES cluster (ES Version 7.16.3) for a few months now. This cluster was built using the data from earlier ES version (ES 6.8) and the cluster has been running smoothly after the upgrade. We run on… --- ## [Boost results by yeke weights](https://discuss.elastic.co/t/boost-results-by-yeke-weights/320338)
**Author:** [@Ostr1969](https://discuss.elastic.co/u/Ostr1969)\ **Replies:** 4\ **Last updated:** [December 6, 2022, 6:27am UTC](https://discuss.elastic.co/t/boost-results-by-yeke-weights/320338 "2022-12-06T06:27:29Z")
This is a question for a possible strategic. I use yeke to get meaningful words from text. I want to ingest those words with the weights so that Elasticsearch could boost the doc using those weights. for example: doc… --- ## [Can we ingest csv directly into elastric search from python?](https://discuss.elastic.co/t/can-we-ingest-csv-directly-into-elastric-search-from-python/320404)
**Author:** [@Shashank02](https://discuss.elastic.co/u/Shashank02)\ **Replies:** 14\ **Last updated:** [December 6, 2022, 6:07am UTC](https://discuss.elastic.co/t/can-we-ingest-csv-directly-into-elastric-search-from-python/320404 "2022-12-06T06:07:24Z")
Actually, I've tried pushing the data but to no use. I'm using Elastic Search version '8.4.1'. I want to push the CSV directly into the Elasticsearch without uploading it manually using the File Data Visualizer option in… [Previous page](https://discuss.elastic.co/latest.md?page=868) [Next page](https://discuss.elastic.co/latest.md?page=870)