# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1009 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1010 --- ## [Way to get summary of content](https://discuss.elastic.co/t/way-to-get-summary-of-content/267739)
**Author:** [@jaru\_kim](https://discuss.elastic.co/u/jaru_kim)\ **Replies:** 0\ **Last updated:** [March 19, 2021, 2:29am UTC](https://discuss.elastic.co/t/way-to-get-summary-of-content/267739 "2021-03-19T02:29:55Z")
I am testing query for index that has documents. { "query": { "bool": { "should": \[ { "match": { "title": "test.docx" } }, … --- ## [Displaying custom data into the SIEM map](https://discuss.elastic.co/t/displaying-custom-data-into-the-siem-map/267735)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 0\ **Last updated:** [March 19, 2021, 1:32am UTC](https://discuss.elastic.co/t/displaying-custom-data-into-the-siem-map/267735 "2021-03-19T01:32:50Z")
Hi im trying to display data in the SIEM map, using ECS, Im getting the data from a database using logstash JDBC this is the template for the index PUT \_template/ecs { "mappings": { "properties": { "@times… --- ## [Is this going to be efficient elasticsearch output config in logstash?](https://discuss.elastic.co/t/is-this-going-to-be-efficient-elasticsearch-output-config-in-logstash/267734)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 2\ **Last updated:** [March 19, 2021, 1:32am UTC](https://discuss.elastic.co/t/is-this-going-to-be-efficient-elasticsearch-output-config-in-logstash/267734 "2021-03-19T01:32:04Z")
I am planning to use ILM in logstash. And there is a note saying : You cannot use dynamic variable substitution when ilm\_enabled is true and when using ilm\_rollover\_alias. At the same time this is also there: In order … --- ## [How to get store size for each filebeat module?](https://discuss.elastic.co/t/how-to-get-store-size-for-each-filebeat-module/267504)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 1\ **Last updated:** [March 19, 2021, 12:08am UTC](https://discuss.elastic.co/t/how-to-get-store-size-for-each-filebeat-module/267504 "2021-03-19T00:08:31Z")
Hi, The total store size of our filebeat-\* indices is 242GB. This indices is a combination of system, apache, and mssql modules. Is there any way how we can get store size of each module? Appreciate the reply … --- ## [Stop exporting logs after file reaches a certain size](https://discuss.elastic.co/t/stop-exporting-logs-after-file-reaches-a-certain-size/267712)
**Author:** [@agushchin](https://discuss.elastic.co/u/agushchin)\ **Replies:** 3\ **Last updated:** [March 18, 2021, 11:26pm UTC](https://discuss.elastic.co/t/stop-exporting-logs-after-file-reaches-a-certain-size/267712 "2021-03-18T23:26:28Z")
Hi, I have the following question/problem: is there a way to stop logstash sending logs to ES after the log file reaches a certain size limit (or some other limit is reached)? Asking because recently faced an issue caus… --- ## [Unable to load the xml document to elastic search](https://discuss.elastic.co/t/unable-to-load-the-xml-document-to-elastic-search/267403)
**Author:** [@sdeven](https://discuss.elastic.co/u/sdeven)\ **Replies:** 5\ **Last updated:** [March 18, 2021, 10:24pm UTC](https://discuss.elastic.co/t/unable-to-load-the-xml-document-to-elastic-search/267403 "2021-03-18T22:24:15Z")
Hi Team, I am trying to load the whole xml document to elastic search using logstash. I don't see any errors in the logstash console, and the document is not there in elastic search also. my config file below. input { … --- ## [Is this the correct approach of taking a snapshop of an indice which is in production?](https://discuss.elastic.co/t/is-this-the-correct-approach-of-taking-a-snapshop-of-an-indice-which-is-in-production/267526)
**Author:** [@Jax\_dev](https://discuss.elastic.co/u/Jax_dev)\ **Replies:** 10\ **Last updated:** [March 18, 2021, 10:06pm UTC](https://discuss.elastic.co/t/is-this-the-correct-approach-of-taking-a-snapshop-of-an-indice-which-is-in-production/267526 "2021-03-18T22:06:18Z")
I have 4 different elastic nodes in a cluster. Want to take a snapshot from one of the server which is having primary shard. Step 1: sudo systemctl stop elasticsearch Step 2: add path.repo: \["/data/elasticbackup"\] in… --- ## [Limint the threads by Shards and CPU](https://discuss.elastic.co/t/limint-the-threads-by-shards-and-cpu/267030)
**Author:** [@ecarmona](https://discuss.elastic.co/u/ecarmona)\ **Replies:** 2\ **Last updated:** [March 18, 2021, 8:57pm UTC](https://discuss.elastic.co/t/limint-the-threads-by-shards-and-cpu/267030 "2021-03-18T20:57:24Z")
Hi Team, I am working in a small environment with just 4 core server for each node. Is there a way I can configure Kibana to serialize the requests between Kibana and elasticsearch? I have noticed that if my dashboards … --- ## [ElasticSearch V0.90 Faster Than V7.10.1](https://discuss.elastic.co/t/elasticsearch-v0-90-faster-than-v7-10-1/267495)
**Author:** [@ercinakcay](https://discuss.elastic.co/u/ercinakcay)\ **Replies:** 6\ **Last updated:** [March 18, 2021, 8:10pm UTC](https://discuss.elastic.co/t/elasticsearch-v0-90-faster-than-v7-10-1/267495 "2021-03-18T20:10:25Z")
Hi everyone, We are doing migration for ElasticSearch version 0.90 to version 7.10.1. I know this is really big upgrade for a component. While this migration we realized, V7 queries are slower than V0 ones. This slow … --- ## [Kibana \\ Elasticsearch - Search\_phase\_execution\_exception, all shards failed](https://discuss.elastic.co/t/kibana-elasticsearch-search-phase-execution-exception-all-shards-failed/267704)
**Author:** [@21908](https://discuss.elastic.co/u/21908)\ **Replies:** 1\ **Last updated:** [March 18, 2021, 7:48pm UTC](https://discuss.elastic.co/t/kibana-elasticsearch-search-phase-execution-exception-all-shards-failed/267704 "2021-03-18T19:48:10Z")
I'm using Kibana for querying a 3 node Elasticsearch cluster, both version 7.9.2. My Elasticsearch cluster and all of its indexes are healthy and in a green state as reported by \_cat/health and \_cat/indices?v. I query … --- ## [Pipelines stop with Java::OrgJrubyExceptions::SystemCallError](https://discuss.elastic.co/t/pipelines-stop-with-java-systemcallerror/267716)
**Author:** [@manuel.ferreira](https://discuss.elastic.co/u/manuel.ferreira)\ **Replies:** 0\ **Last updated:** [March 18, 2021, 7:40pm UTC](https://discuss.elastic.co/t/pipelines-stop-with-java-systemcallerror/267716 "2021-03-18T19:40:39Z")
Hi. Some light on this issue would be very much appreciated. The scenario is the following. Logstash pipelines fail after docker restart. Logstash : 7.9.3 When logstash exits with an error, the docker configuration … --- ## [Symantec Message Gateway Multiline Logs Parsing](https://discuss.elastic.co/t/symantec-message-gateway-multiline-logs-parsing/267455)
**Author:** [@msszafar](https://discuss.elastic.co/u/msszafar)\ **Replies:** 3\ **Last updated:** [March 18, 2021, 7:02pm UTC](https://discuss.elastic.co/t/symantec-message-gateway-multiline-logs-parsing/267455 "2021-03-18T19:02:43Z")
Hi Community, I've multiline logs of Symantec message gateway (email server). {"port":49542,"host":"10.10.x.x","type":"smg","message":"\<158\>Mar 2 16:21:59 smtp01 bmserver: 1614684119|0a0a5199-534c370000006c49-29-603e… --- ## [Question on logstash removing field from json string and saving back to same field](https://discuss.elastic.co/t/question-on-logstash-removing-field-from-json-string-and-saving-back-to-same-field/267677)
**Author:** [@rgreen](https://discuss.elastic.co/u/rgreen)\ **Replies:** 2\ **Last updated:** [March 18, 2021, 6:57pm UTC](https://discuss.elastic.co/t/question-on-logstash-removing-field-from-json-string-and-saving-back-to-same-field/267677 "2021-03-18T18:57:39Z")
Is it possible to read a json string, remove specified fields then have that json string saved back into a single field with-ought parsing the json data into separate fields. So i would be reading a field from a databas… --- ## [Canvas SQL and other examples wanted](https://discuss.elastic.co/t/canvas-sql-and-other-examples-wanted/121913)
**Author:** [@dorj1234](https://discuss.elastic.co/u/dorj1234)\ **Replies:** 3\ **Last updated:** [March 18, 2021, 6:26pm UTC](https://discuss.elastic.co/t/canvas-sql-and-other-examples-wanted/121913 "2021-03-18T18:26:03Z")
Hello, I am looking online and failing to find more than a very small set of examples for Canvas SQL queries. Probably my lacking search skills, but I would appreciate a few links and SQL examples that will show me wha… --- ## [Logstash and Split](https://discuss.elastic.co/t/logstash-and-split/267358)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 4\ **Last updated:** [March 18, 2021, 5:56pm UTC](https://discuss.elastic.co/t/logstash-and-split/267358 "2021-03-18T17:56:11Z")
Hello I have the following fields (data is example): ForwardedIpAddress 1.2.3.4,4.3.2.1 IpAddress 1.2.3.4,4.3.2.1 Would I would like to end up with is: ForwardedIpAddress1 1.2.3.4 ForwardedIpAddress2 4.3.2.1 IpAdd… --- ## [Status code 403 unauthorized for user \[\_anonymous\] is returned for anonymous user with a custom role which is Stack Management plugin not displayed](https://discuss.elastic.co/t/status-code-403-unauthorized-for-user-anonymous-is-returned-for-anonymous-user-with-a-custom-role-which-is-stack-management-plugin-not-displayed/267586)
**Author:** [@thiton](https://discuss.elastic.co/u/thiton)\ **Replies:** 2\ **Last updated:** [March 18, 2021, 5:51pm UTC](https://discuss.elastic.co/t/status-code-403-unauthorized-for-user-anonymous-is-returned-for-anonymous-user-with-a-custom-role-which-is-stack-management-plugin-not-displayed/267586 "2021-03-18T17:51:53Z")
Is that possible to configure Elasticsearch and Kibana for anonymous user with a custom role which is Stack Management plugin in NOT displayed when security is turned off? Many thanks in advance. Below are my steps: … --- ## [How to read Excel File with multiple Worksheet in logstash?](https://discuss.elastic.co/t/how-to-read-excel-file-with-multiple-worksheet-in-logstash/267636)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 1\ **Last updated:** [March 18, 2021, 4:58pm UTC](https://discuss.elastic.co/t/how-to-read-excel-file-with-multiple-worksheet-in-logstash/267636 "2021-03-18T16:58:58Z")
I have a dataset Excel file that have 10 worksheet so I want to access particular worksheet? How I can read worksheet? --- ## [Worker loop initialization error](https://discuss.elastic.co/t/worker-loop-initialization-error/267609)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [March 18, 2021, 4:56pm UTC](https://discuss.elastic.co/t/worker-loop-initialization-error/267609 "2021-03-18T16:56:22Z")
I want to use multiple pipelines for logstash for example for input section i want to have pipeline.id: source\_input and for output and filter section i want to have pipeline.id: destination\_output But i am facing this… --- ## [Part of the indices are created with this name "%{\[kubernetes\]\[namespace\]}"](https://discuss.elastic.co/t/part-of-the-indices-are-created-with-this-name-kubernetes-namespace/267426)
**Author:** [@doronshai](https://discuss.elastic.co/u/doronshai)\ **Replies:** 3\ **Last updated:** [March 18, 2021, 4:52pm UTC](https://discuss.elastic.co/t/part-of-the-indices-are-created-with-this-name-kubernetes-namespace/267426 "2021-03-18T16:52:29Z")
Hi Team, I am using this configuration for logstash: input { beats {port =\> 6600 type =\> "K4" codec =\> "json" } } filter { if \[type\] == "K4" { json {source =\> "message"} } } output { if \[type\] =… --- ## [How to show filesystem metrics](https://discuss.elastic.co/t/how-to-show-filesystem-metrics/267515)
**Author:** [@CJ\_Chang](https://discuss.elastic.co/u/CJ_Chang)\ **Replies:** 1\ **Last updated:** [March 18, 2021, 4:09pm UTC](https://discuss.elastic.co/t/how-to-show-filesystem-metrics/267515 "2021-03-18T16:09:47Z")
Hi, I am using metricbeat 7.6. The following is my system.yaml - module: system period: 10s metricsets: - cpu - load - memory - network - process - process\_summary - socket\_summary pr… --- ## [Odd behaviour with search\_as\_you\_type](https://discuss.elastic.co/t/odd-behaviour-with-search-as-you-type/267695)
**Author:** [@mgvarley](https://discuss.elastic.co/u/mgvarley)\ **Replies:** 0\ **Last updated:** [March 18, 2021, 4:00pm UTC](https://discuss.elastic.co/t/odd-behaviour-with-search-as-you-type/267695 "2021-03-18T16:00:01Z")
I am using the search\_as\_you\_type field to provide suggestions to users for addresses from a large index of around 30m addresses. I am using this with the default settings for the most part and it generally works great … --- ## [Cookie issue with Kibana behind a load balancer](https://discuss.elastic.co/t/cookie-issue-with-kibana-behind-a-load-balancer/267639)
**Author:** [@jsu](https://discuss.elastic.co/u/jsu)\ **Replies:** 2\ **Last updated:** [March 18, 2021, 3:41pm UTC](https://discuss.elastic.co/t/cookie-issue-with-kibana-behind-a-load-balancer/267639 "2021-03-18T15:41:30Z")
Hey folks, As stated in the title, I was having issues with cookies of kibana instances behind a load balancer and even after taking into consideration what's written on the page concerning Kibana in production, it didn… --- ## [Collapse Search](https://discuss.elastic.co/t/collapse-search/267688)
**Author:** [@ToonB](https://discuss.elastic.co/u/ToonB)\ **Replies:** 0\ **Last updated:** [March 18, 2021, 3:19pm UTC](https://discuss.elastic.co/t/collapse-search/267688 "2021-03-18T15:19:01Z")
Hi. I am using Collapse Search to retrieve my search results collapsed to a certain field, in addition I use the inner\_hits option to return the top hits for each collapse key. Because of the way Collapse Search works, i… --- ## [Kibana visualisation from remote clusters](https://discuss.elastic.co/t/kibana-visualisation-from-remote-clusters/267621)
**Author:** [@Garry](https://discuss.elastic.co/u/Garry)\ **Replies:** 1\ **Last updated:** [March 18, 2021, 3:20pm UTC](https://discuss.elastic.co/t/kibana-visualisation-from-remote-clusters/267621 "2021-03-18T15:20:27Z")
Is it possible to setup Kibana to display data from remote Elasticsearch clusters? --- ## [No Data from Vega Percentiles Histogram](https://discuss.elastic.co/t/no-data-from-vega-percentiles-histogram/267670)
**Author:** [@nickr](https://discuss.elastic.co/u/nickr)\ **Replies:** 1\ **Last updated:** [March 18, 2021, 2:56pm UTC](https://discuss.elastic.co/t/no-data-from-vega-percentiles-histogram/267670 "2021-03-18T14:56:50Z")
1st Post from a newbie, I'm trying to replicate something like the below graph using Vega. All I currently get is a labelled frame with no data. The data is returned by Elasticsearch "aggregations" : { … --- ## [Kibana ingress not working after upgrading to eck 1.1.0](https://discuss.elastic.co/t/kibana-ingress-not-working-after-upgrading-to-eck-1-1-0/232316)
**Author:** [@aman26ps](https://discuss.elastic.co/u/aman26ps)\ **Replies:** 5\ **Last updated:** [March 18, 2021, 2:06pm UTC](https://discuss.elastic.co/t/kibana-ingress-not-working-after-upgrading-to-eck-1-1-0/232316 "2021-03-18T14:06:30Z")
Hi Team, My kibana ingress is not working after i upgraded to eck 1.1.0 from eck 1.0.1, below are the files for reference kibana\_cr.yaml apiVersion: kibana.k8s.elastic.co/v1 kind: Kibana metadata: name: kibana-confi… --- ## [Join various WinLogBeat Windows Event Log events into one?](https://discuss.elastic.co/t/join-various-winlogbeat-windows-event-log-events-into-one/267095)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 3\ **Last updated:** [March 18, 2021, 2:41pm UTC](https://discuss.elastic.co/t/join-various-winlogbeat-windows-event-log-events-into-one/267095 "2021-03-18T14:41:52Z")
Hello Using WinLogBeat, Im collecting logs from Windows Event Logs and sending it to Logstash which then sends it to Elasticsearch. For all, working. Issue is that I want to do something a bit more complex... Lets say… --- ## [Oracle DB - JDBC Plugin high load](https://discuss.elastic.co/t/oracle-db-jdbc-plugin-high-load/267680)
**Author:** [@FALEN](https://discuss.elastic.co/u/FALEN)\ **Replies:** 0\ **Last updated:** [March 18, 2021, 2:08pm UTC](https://discuss.elastic.co/t/oracle-db-jdbc-plugin-high-load/267680 "2021-03-18T14:08:06Z")
Hi everyone, I am looking for a way to transfer logs written to the Oracle table to ELK. The plugin seems appropriate, but in the environment I will use, 1tb data per day is written to this Oracle table. In other words,… --- ## [Logstash - Validate the value of a field from the last ingest against the previous one](https://discuss.elastic.co/t/logstash-validate-the-value-of-a-field-from-the-last-ingest-against-the-previous-one/267679)
**Author:** [@Oscar\_Lopez](https://discuss.elastic.co/u/Oscar_Lopez)\ **Replies:** 0\ **Last updated:** [March 18, 2021, 2:06pm UTC](https://discuss.elastic.co/t/logstash-validate-the-value-of-a-field-from-the-last-ingest-against-the-previous-one/267679 "2021-03-18T14:06:55Z")
Good day At the moment in elastic search I am ingesting data from several weblogic servers, and for the data sources I want to make a graph where I can identify when an application changes version. At the moment in a fi… --- ## [Need help with aggregation query in ES 6.8](https://discuss.elastic.co/t/need-help-with-aggregation-query-in-es-6-8/267648)
**Author:** [@trak](https://discuss.elastic.co/u/trak)\ **Replies:** 0\ **Last updated:** [March 18, 2021, 11:53am UTC](https://discuss.elastic.co/t/need-help-with-aggregation-query-in-es-6-8/267648 "2021-03-18T11:53:30Z")
I try to make aggregation query with ElasticSearch 6.8: I want to find last documents for specific date, and last documents before specific date, group by documents fields. curl -X PUT "http://localhost:9200/test/x… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1008) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1010)