# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1049 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1050 --- ## [Elastic search won't start after upgrade to 7.11](https://discuss.elastic.co/t/elastic-search-wont-start-after-upgrade-to-7-11/264170)
**Author:** [@glifhits](https://discuss.elastic.co/u/glifhits)\ **Replies:** 2\ **Last updated:** [February 14, 2021, 3:27am UTC](https://discuss.elastic.co/t/elastic-search-wont-start-after-upgrade-to-7-11/264170 "2021-02-14T03:27:16Z")
I'm getting the following error. I've looked thru it but nothing stands out. \` Starting Elasticsearch Server … --- ## [Kibana (wazuh) not working right](https://discuss.elastic.co/t/kibana-wazuh-not-working-right/264227)
**Author:** [@zitstif](https://discuss.elastic.co/u/zitstif)\ **Replies:** 1\ **Last updated:** [February 14, 2021, 1:23am UTC](https://discuss.elastic.co/t/kibana-wazuh-not-working-right/264227 "2021-02-14T01:23:16Z")
Greetings all. I've ran into a problem with my Wazuh/Kibana setup. I can't quite pin point to when the issue occurred but it wouldn't surprise me if it was some update that caused it. I run Kibana on a VM that is centos … --- ## [Filter context without bool](https://discuss.elastic.co/t/filter-context-without-bool/264218)
**Author:** [@AndreKR](https://discuss.elastic.co/u/AndreKR)\ **Replies:** 2\ **Last updated:** [February 13, 2021, 7:03pm UTC](https://discuss.elastic.co/t/filter-context-without-bool/264218 "2021-02-13T19:03:53Z")
It seems that the minimum code I need for a filter context match is: { "query": { "bool": { "filter": { ... } } } } That looks quite verbose and involves a bool query, even though no act… --- ## [\_grokparsefailure with kv](https://discuss.elastic.co/t/grokparsefailure-with-kv/264195)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 1\ **Last updated:** [February 13, 2021, 12:12am UTC](https://discuss.elastic.co/t/grokparsefailure-with-kv/264195 "2021-02-13T00:12:29Z")
Hi, I am using kv { } filter but output in Kibana have tag \_grokparsefailure, why? Output looks like is fine, without errors however still have this tag, when I even don't have grok (only input udp, filter kv and mutat… --- ## [Logstash condition to check if a field value starts with another field's value](https://discuss.elastic.co/t/logstash-condition-to-check-if-a-field-value-starts-with-another-fields-value/264168)
**Author:** [@mattinVS](https://discuss.elastic.co/u/mattinVS)\ **Replies:** 2\ **Last updated:** [February 12, 2021, 10:49pm UTC](https://discuss.elastic.co/t/logstash-condition-to-check-if-a-field-value-starts-with-another-fields-value/264168 "2021-02-12T22:49:28Z")
Hi, I'd like to know how I can check in an if-condition in Logstash, is a field's value (in the example below the field is named "complete") starts with the value of another field (in the example below the field is name… --- ## [Push Index to Cloud](https://discuss.elastic.co/t/push-index-to-cloud/264178)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 2\ **Last updated:** [February 12, 2021, 9:54pm UTC](https://discuss.elastic.co/t/push-index-to-cloud/264178 "2021-02-12T21:54:19Z")
I am doing a proof-of-concept using my first instance of cloud. I have signed up for the trial but am having difficulty figuring out the best way to move my test index from my local server to the cloud instance. I unde… --- ## [Aggregate filter, error when same task\_id in two separate aggregate filters](https://discuss.elastic.co/t/aggregate-filter-error-when-same-task-id-in-two-separate-aggregate-filters/264151)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 3\ **Last updated:** [February 12, 2021, 9:10pm UTC](https://discuss.elastic.co/t/aggregate-filter-error-when-same-task-id-in-two-separate-aggregate-filters/264151 "2021-02-12T21:10:06Z")
Hi, I'm running a Logstash 7.9.2 Docker container inside a Kubernetes cluster and I'm seeing the following error message in Logstash when I attempt to use the same task\_id in two separate aggregate filters: \[ERROR\] 20… --- ## [Getting documents from an index with more than 10,000 records](https://discuss.elastic.co/t/getting-documents-from-an-index-with-more-than-10-000-records/264069)
**Author:** [@vastevenson](https://discuss.elastic.co/u/vastevenson)\ **Replies:** 4\ **Last updated:** [February 12, 2021, 8:59pm UTC](https://discuss.elastic.co/t/getting-documents-from-an-index-with-more-than-10-000-records/264069 "2021-02-12T20:59:39Z")
I am trying to get a list of the ids of all document in my index. The index has about 50k documents in it, however I cannot use the from parameter to see any ids once "from" + "size" \> 10,000. I know there's the scroll a… --- ## [ECK - Elastic Agent - how to enroll?](https://discuss.elastic.co/t/eck-elastic-agent-how-to-enroll/264174)
**Author:** [@sc75651](https://discuss.elastic.co/u/sc75651)\ **Replies:** 1\ **Last updated:** [February 12, 2021, 8:25pm UTC](https://discuss.elastic.co/t/eck-elastic-agent-how-to-enroll/264174 "2021-02-12T20:25:35Z")
Hi, Was able to start the agent using operator - https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-quickstart.html but, how to enroll them in Kibana? did not see where we can put the token --- ## [Logstash aggregate syslog entries](https://discuss.elastic.co/t/logstash-aggregate-syslog-entries/263783)
**Author:** [@Pablo\_Marques](https://discuss.elastic.co/u/Pablo_Marques)\ **Replies:** 12\ **Last updated:** [February 12, 2021, 8:08pm UTC](https://discuss.elastic.co/t/logstash-aggregate-syslog-entries/263783 "2021-02-12T20:08:25Z")
Hello I am getting syslogs from Clearpass servers and using logstash to ingest them into elasticsearch. Some of these messages are received on multiple syslog packets, but they are really the same (big) message. I am … --- ## [MalformedCSVError: Illegal quoting in line 1](https://discuss.elastic.co/t/malformedcsverror-illegal-quoting-in-line-1/264048)
**Author:** [@checknew](https://discuss.elastic.co/u/checknew)\ **Replies:** 5\ **Last updated:** [February 12, 2021, 8:07pm UTC](https://discuss.elastic.co/t/malformedcsverror-illegal-quoting-in-line-1/264048 "2021-02-12T20:07:27Z")
Hi all, I am seeing WARNING messages when csv is pushed to logstash, I want to eliminate the WARNING messages, any help appreciated: Sample csv: 20185656,2021-02-01 17:52:47,2021-02-01 18:23:15,"Hi Test2, this is ch… --- ## [Search not returning the intended results](https://discuss.elastic.co/t/search-not-returning-the-intended-results/264169)
**Author:** [@RicPeres](https://discuss.elastic.co/u/RicPeres)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 6:35pm UTC](https://discuss.elastic.co/t/search-not-returning-the-intended-results/264169 "2021-02-12T18:35:09Z")
Hello all, Wondering if anyone can help me, I'm having problems in a search performed on elastic, the search itself is very simple however for some specific words, although, they exist in the intended doc, the hit is no… --- ## [How do I find which event is generating this error](https://discuss.elastic.co/t/how-do-i-find-which-event-is-generating-this-error/264166)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 6:07pm UTC](https://discuss.elastic.co/t/how-do-i-find-which-event-is-generating-this-error/264166 "2021-02-12T18:07:29Z")
I have thousands of event coming from metricbeat to logstash. then I do some parsing. but every on/off I getting following errors. is there a easy way to find out which event is it? An exceptionCaught() event was fire… --- ## [Query string cross\_fields synonyms](https://discuss.elastic.co/t/query-string-cross-fields-synonyms/264059)
**Author:** [@wboult](https://discuss.elastic.co/u/wboult)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 10:24pm UTC](https://discuss.elastic.co/t/query-string-cross-fields-synonyms/264059 "2021-02-11T22:24:06Z")
I am using the query string cross\_fields query type to provide a simple search UI that queries many different fields as though they are one big field. I want to make it possible to have different analyzers for some of t… --- ## [Many Elasticsearch threads in WAITING parking state](https://discuss.elastic.co/t/many-elasticsearch-threads-in-waiting-parking-state/264154)
**Author:** [@shreedhan](https://discuss.elastic.co/u/shreedhan)\ **Replies:** 1\ **Last updated:** [February 12, 2021, 5:23pm UTC](https://discuss.elastic.co/t/many-elasticsearch-threads-in-waiting-parking-state/264154 "2021-02-12T17:23:48Z")
Hi, We are running a ES cluster on 6.8 and we are still using TCP client. I know it's deprecated and move to REST client but we have not got around to it yet. In addition, we have a service which uses Elastic4s library… --- ## [Probleme de synchronisation entre logstash et kibana](https://discuss.elastic.co/t/probleme-de-synchronisation-entre-logstash-et-kibana/264107)
**Author:** [@hugoboubou](https://discuss.elastic.co/u/hugoboubou)\ **Replies:** 10\ **Last updated:** [February 12, 2021, 4:39pm UTC](https://discuss.elastic.co/t/probleme-de-synchronisation-entre-logstash-et-kibana/264107 "2021-02-12T16:39:07Z")
Bonjour à tous, Je souhaite analyser différents types de logs. Qui proviennent de plusieurs agents beats. Actuellement j'ai deux patterns grok pour les traiter. Les voici : match =\> { "message" =\> "(?\%{YEAR… --- ## [How to convert two inserted values in kibana in a single Geopoint](https://discuss.elastic.co/t/how-to-convert-two-inserted-values-in-kibana-in-a-single-geopoint/264153)
**Author:** [@Mheni](https://discuss.elastic.co/u/Mheni)\ **Replies:** 3\ **Last updated:** [February 12, 2021, 4:30pm UTC](https://discuss.elastic.co/t/how-to-convert-two-inserted-values-in-kibana-in-a-single-geopoint/264153 "2021-02-12T16:30:33Z")
I Insert 2 values(Lat and Long) in Kibana and I want to convert them in a single Geopoint . The Aim is to present them using a heatMap. --- ## [ElasticsearchDeprecationWarning: Need some clarification to make corrections](https://discuss.elastic.co/t/elasticsearchdeprecationwarning-need-some-clarification-to-make-corrections/264136)
**Author:** [@varshap](https://discuss.elastic.co/u/varshap)\ **Replies:** 3\ **Last updated:** [February 12, 2021, 4:11pm UTC](https://discuss.elastic.co/t/elasticsearchdeprecationwarning-need-some-clarification-to-make-corrections/264136 "2021-02-12T16:11:33Z")
Hi Guys, I am new to ES, I recently integrated ES in my Django project by following. https://django-elasticsearch-dsl.readthedocs.io/en/latest/quickstart.html Versions used: django-elasticsearch-dsl==7.1.4 django-el… --- ## [Kibana 7.4.0 all indices vanish at the end of each day](https://discuss.elastic.co/t/kibana-7-4-0-all-indices-vanish-at-the-end-of-each-day/264148)
**Author:** [@Josh\_Creek](https://discuss.elastic.co/u/Josh_Creek)\ **Replies:** 7\ **Last updated:** [February 12, 2021, 4:08pm UTC](https://discuss.elastic.co/t/kibana-7-4-0-all-indices-vanish-at-the-end-of-each-day/264148 "2021-02-12T16:08:14Z")
I have been using ELK in Docker for several years now, with zero issues. I am currently running a couple of entirely separate Dockerized ELK stacks, on entirely different servers running different environments, and am ex… --- ## [Logstash JDBC file permission errors, cannot send data to elastic](https://discuss.elastic.co/t/logstash-jdbc-file-permission-errors-cannot-send-data-to-elastic/263810)
**Author:** [@wlbsxnlp22](https://discuss.elastic.co/u/wlbsxnlp22)\ **Replies:** 5\ **Last updated:** [February 12, 2021, 3:43pm UTC](https://discuss.elastic.co/t/logstash-jdbc-file-permission-errors-cannot-send-data-to-elastic/263810 "2021-02-12T15:43:28Z")
Hi, I keep getting errors when running JDBC, it seems to complain about being unable to read to files on disc but I have checked the permissions and there is write access. The problem seems to become worse when having a… --- ## [XML load with Logstash into Elasticsearch](https://discuss.elastic.co/t/xml-load-with-logstash-into-elasticsearch/263767)
**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\ **Replies:** 4\ **Last updated:** [February 12, 2021, 3:28pm UTC](https://discuss.elastic.co/t/xml-load-with-logstash-into-elasticsearch/263767 "2021-02-12T15:28:06Z")
Hi , I have tried to create a load process with Logstash from an XML file to Elasticsearch. i use ELK 7.9.0 on windows. this is my config file : input { file { path =\> "C:/Talend/workspace/data/giata/geography/geog… --- ## [Persistent Queueing Performance](https://discuss.elastic.co/t/persistent-queueing-performance/264149)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 3:15pm UTC](https://discuss.elastic.co/t/persistent-queueing-performance/264149 "2021-02-12T15:15:39Z")
Hi, As I understand it, persistent queue operations are single threaded. And that tallies with what I've seen during performance tests. Can I ask, are there plans to make persistent queues multi-threaded? If so, how far… --- ## [Plugin configuration](https://discuss.elastic.co/t/plugin-configuration/264079)
**Author:** [@rwxr\_xr\_x](https://discuss.elastic.co/u/rwxr_xr_x)\ **Replies:** 2\ **Last updated:** [February 12, 2021, 3:14pm UTC](https://discuss.elastic.co/t/plugin-configuration/264079 "2021-02-12T15:14:05Z")
Hello, I'm converting a plugin built for ES 2.1.1 to ES 7.10. I'm running into a strange issue. I need to pass: plugin-name.enable: true If I add it to elasticsearch.yml file, the configuration is available in my plu… --- ## [Elasticsearch throwing some overhead warning in logs](https://discuss.elastic.co/t/elasticsearch-throwing-some-overhead-warning-in-logs/264137)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 3\ **Last updated:** [February 12, 2021, 3:01pm UTC](https://discuss.elastic.co/t/elasticsearch-throwing-some-overhead-warning-in-logs/264137 "2021-02-12T15:01:57Z")
HI Team, we are getting below response in elasticsearch log , anyone can help me on this why im getting this kind of error on it, \[2021-02-12T07:29:17,371\]\[WARN \]\[o.e.m.j.JvmGcMonitorService\] \[datanode1\] \[gc\]\[242917\] … --- ## [How to give access to Security Cases of one Kibana Space to the users in another Kibana Space?](https://discuss.elastic.co/t/how-to-give-access-to-security-cases-of-one-kibana-space-to-the-users-in-another-kibana-space/264032)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [February 12, 2021, 2:38pm UTC](https://discuss.elastic.co/t/how-to-give-access-to-security-cases-of-one-kibana-space-to-the-users-in-another-kibana-space/264032 "2021-02-12T14:38:07Z")
Hello, Is it possible to give access to Security Cases of one Kibana Space to the users in another Kibana Space? For example we have an engineer team Kibana where the detections are running, but our security officers a… --- ## [How to use date\_histogram to aggregate documents that span multiple period based on two date fields](https://discuss.elastic.co/t/how-to-use-date-histogram-to-aggregate-documents-that-span-multiple-period-based-on-two-date-fields/264135)
**Author:** [@Lekishor](https://discuss.elastic.co/u/Lekishor)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 1:42pm UTC](https://discuss.elastic.co/t/how-to-use-date-histogram-to-aggregate-documents-that-span-multiple-period-based-on-two-date-fields/264135 "2021-02-12T13:42:39Z")
Hi, So I have documents defined based on the following mapping: documents: "ID": { "type": "integer" }, "Start": { "type": "date", "format": "strict\_date\_optional\_t… --- ## [Unable to run logstash 7.10 on custom java path](https://discuss.elastic.co/t/unable-to-run-logstash-7-10-on-custom-java-path/264130)
**Author:** [@Suddhasil\_Sarkar](https://discuss.elastic.co/u/Suddhasil_Sarkar)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 12:59pm UTC](https://discuss.elastic.co/t/unable-to-run-logstash-7-10-on-custom-java-path/264130 "2021-02-12T12:59:46Z")
Hi ELK Gurus, Need help- I was trying to run my logstash with customized JVM which is not happening. I set JAVA\_HOME pointing to my custom path "/app/platform/java/" but logstash is running with default java 11 - "/usr/… --- ## ["\_shard\_stores" returns empty](https://discuss.elastic.co/t/shard-stores-returns-empty/263966)
**Author:** [@gruselglatz](https://discuss.elastic.co/u/gruselglatz)\ **Replies:** 3\ **Last updated:** [February 12, 2021, 12:25pm UTC](https://discuss.elastic.co/t/shard-stores-returns-empty/263966 "2021-02-12T12:25:36Z")
Hey, when I try to GET /\_shard\_stores i always get an empty response. I tried it with the elastic user or every other user. My cluster is Green and i have some 1000 shards allocated. I wanted to know where a shard live… --- ## [After two nodes fail, Master cannot be assigned to the third one](https://discuss.elastic.co/t/after-two-nodes-fail-master-cannot-be-assigned-to-the-third-one/264030)
**Author:** [@Mateusz\_Koper](https://discuss.elastic.co/u/Mateusz_Koper)\ **Replies:** 3\ **Last updated:** [February 12, 2021, 12:20pm UTC](https://discuss.elastic.co/t/after-two-nodes-fail-master-cannot-be-assigned-to-the-third-one/264030 "2021-02-12T12:20:16Z")
Hi, In our organization, we've set up 3 nodes, two of them are storing the data, and the last one is a kind of 'Tiebreaker'. When one of the node fails, Master is easily switched to the other machine, and everything se… --- ## [Elasticsearch script breaking change query Accessing missing document value](https://discuss.elastic.co/t/elasticsearch-script-breaking-change-query-accessing-missing-document-value/264096)
**Author:** [@sardar\_nale](https://discuss.elastic.co/u/sardar_nale)\ **Replies:** 1\ **Last updated:** [February 12, 2021, 11:43am UTC](https://discuss.elastic.co/t/elasticsearch-script-breaking-change-query-accessing-missing-document-value/264096 "2021-02-12T11:43:34Z")
Hi all, We are using elastic version 7.10.2 and it is migrated from 6.8.6. I want to compare two fields from a same document using Scripting .Below query was working in elastic version 6.8.6 now after upgrade to 7.10 i… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1048) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1050)