# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1057 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1058 --- ## [If else condition with logstash filter](https://discuss.elastic.co/t/if-else-condition-with-logstash-filter/263517)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 3\ **Last updated:** [February 7, 2021, 3:24pm UTC](https://discuss.elastic.co/t/if-else-condition-with-logstash-filter/263517 "2021-02-07T15:24:13Z")
Hi Folks, I am trying to achive certain conditions with logstash and wondering \\if - if-else statement or validation is possible in Logstash filter? I have below messages in json and parsing DMARC logs with logstash. I… --- ## [Get subset of values that exist for a given search](https://discuss.elastic.co/t/get-subset-of-values-that-exist-for-a-given-search/263523)
**Author:** [@cozzbp](https://discuss.elastic.co/u/cozzbp)\ **Replies:** 0\ **Last updated:** [February 7, 2021, 2:25pm UTC](https://discuss.elastic.co/t/get-subset-of-values-that-exist-for-a-given-search/263523 "2021-02-07T14:25:20Z")
Is it possible to query for which values of a given set are represented/not represented in the data set? If I have documents that look like: { "category": "fiction", "tags": \["horror", "thriller"\] }… --- ## [Syslog filter for IP](https://discuss.elastic.co/t/syslog-filter-for-ip/263512)
**Author:** [@dandotwalker](https://discuss.elastic.co/u/dandotwalker)\ **Replies:** 3\ **Last updated:** [February 7, 2021, 9:57am UTC](https://discuss.elastic.co/t/syslog-filter-for-ip/263512 "2021-02-07T09:57:01Z")
Hi, I am learning Elastic so I have set it up in my home to prepare for when we start designing it at work. I have a simple set up where logstash is listening for syslog messages. It works great with most hosts but my … --- ## [Elasticsearch master node start failed. There is insufficient memory for the Java Runtime Environment to continue](https://discuss.elastic.co/t/elasticsearch-master-node-start-failed-there-is-insufficient-memory-for-the-java-runtime-environment-to-continue/263520)
**Author:** [@Jinlian\_Chen](https://discuss.elastic.co/u/Jinlian_Chen)\ **Replies:** 0\ **Last updated:** [February 7, 2021, 9:16am UTC](https://discuss.elastic.co/t/elasticsearch-master-node-start-failed-there-is-insufficient-memory-for-the-java-runtime-environment-to-continue/263520 "2021-02-07T09:16:51Z")
I have setup a elasticsearch cluster with 3 master node and 2 data node on k8s. While start master node , it failed. System config: ulimit -n 65535 ulimit -l unlimited sysctl -w vm.max\_map\_count=262144 sysctl -w vm.ove… --- ## [Logstash SPLIT plugin help](https://discuss.elastic.co/t/logstash-split-plugin-help/263462)
**Author:** [@Zdeno\_Liska](https://discuss.elastic.co/u/Zdeno_Liska)\ **Replies:** 5\ **Last updated:** [February 7, 2021, 12:51am UTC](https://discuss.elastic.co/t/logstash-split-plugin-help/263462 "2021-02-07T00:51:11Z")
Hi, I would like to ask thing about Split plugin. I have event like: {"name":"JASON", "phones":\[{ "mark":"Nokia", "model":"3310"},{"mark":"Apple","model":"12 Pro"}\]} I use clone, and want object like: {"name":"JAS… --- ## [Coordinating node](https://discuss.elastic.co/t/coordinating-node/263510)
**Author:** [@leemase004](https://discuss.elastic.co/u/leemase004)\ **Replies:** 2\ **Last updated:** [February 7, 2021, 12:39am UTC](https://discuss.elastic.co/t/coordinating-node/263510 "2021-02-07T00:39:31Z")
I know data nodes can act as coordinating nodes if one is not set; but, if I set up a designated coordinating-only node does that mean the data nodes will completely stop performing the coordinating function? Or will the… --- ## [Elasticsearch Nodes Crash After Attempt to Create Scripted Filed](https://discuss.elastic.co/t/elasticsearch-nodes-crash-after-attempt-to-create-scripted-filed/263179)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 3\ **Last updated:** [February 6, 2021, 11:33pm UTC](https://discuss.elastic.co/t/elasticsearch-nodes-crash-after-attempt-to-create-scripted-filed/263179 "2021-02-06T23:33:05Z")
Hello Community, I am trying to create a scripted field. I want to parse a string into a date format. I have created the following script DateTimeFormatter formatter = DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss… --- ## [Question in elastic search to get specific records with specific date and time range](https://discuss.elastic.co/t/question-in-elastic-search-to-get-specific-records-with-specific-date-and-time-range/261217)
**Author:** [@Kin\_Wan](https://discuss.elastic.co/u/Kin_Wan)\ **Replies:** 8\ **Last updated:** [February 6, 2021, 11:32pm UTC](https://discuss.elastic.co/t/question-in-elastic-search-to-get-specific-records-with-specific-date-and-time-range/261217 "2021-02-06T23:32:28Z")
Hello all, I would like to perform a query to get last weeks records on our log which the record are within Mon-Fri from (19:00-07:00) and Sat from (15:00-00:00) and full day on Sunday. How should I write the query? Than… --- ## [Error when build kibana 7.7 from source code](https://discuss.elastic.co/t/error-when-build-kibana-7-7-from-source-code/263502)
**Author:** [@Thien\_Hoang](https://discuss.elastic.co/u/Thien_Hoang)\ **Replies:** 2\ **Last updated:** [February 6, 2021, 11:13pm UTC](https://discuss.elastic.co/t/error-when-build-kibana-7-7-from-source-code/263502 "2021-02-06T23:13:51Z")
I get error about module 'static-extend' when build kibana from branch 7.7 version 7.7.2 run yarn kbn bootstrap F:\\Project\\kibana\>yarn kbn bootstrap yarn run v1.22.4 $ node scripts/kbn bootstrap F:\\Project\\kibana\\packa… --- ## [Question on what Elasticsearch considers data vs logs](https://discuss.elastic.co/t/question-on-what-elasticsearch-considers-data-vs-logs/263506)
**Author:** [@halfbakedprod](https://discuss.elastic.co/u/halfbakedprod)\ **Replies:** 1\ **Last updated:** [February 6, 2021, 6:10pm UTC](https://discuss.elastic.co/t/question-on-what-elasticsearch-considers-data-vs-logs/263506 "2021-02-06T18:10:12Z")
Hello all, I just setup Graylog + Elasticsearch for my first time. I'm trying to change the default location that ingested logs are saved. Currently, the default filepath is the OS drive, which will fill up in no time. … --- ## [Cluster with mix of cloud and self hosted](https://discuss.elastic.co/t/cluster-with-mix-of-cloud-and-self-hosted/263489)
**Author:** [@efftee](https://discuss.elastic.co/u/efftee)\ **Replies:** 2\ **Last updated:** [February 6, 2021, 5:35pm UTC](https://discuss.elastic.co/t/cluster-with-mix-of-cloud-and-self-hosted/263489 "2021-02-06T17:35:53Z")
Hi Are there any difficulties or limitations to have a cluster of instances mixing cloud-hosted Elasticsearch with self-hosted instances ? I have a main cloud instance, hosted by Elasticsearch. And I am wondering if it… --- ## [My elsticsearch cannot start](https://discuss.elastic.co/t/my-elsticsearch-cannot-start/263494)
**Author:** [@baber1223](https://discuss.elastic.co/u/baber1223)\ **Replies:** 3\ **Last updated:** [February 6, 2021, 2:39pm UTC](https://discuss.elastic.co/t/my-elsticsearch-cannot-start/263494 "2021-02-06T14:39:20Z")
I have installed elasticsearch-1.7.2-1.noarch now due start service show follow error : \[root@testopenbank ~\]# Exception in thread "main" java.lang.NoClassDefFoundError: Could not initialize class org.elasticsearch.Vers… --- ## [Base documentaire, stockage video, images, son, pdf](https://discuss.elastic.co/t/base-documentaire-stockage-video-images-son-pdf/263488)
**Author:** [@Corben\_Dallas](https://discuss.elastic.co/u/Corben_Dallas)\ **Replies:** 1\ **Last updated:** [February 6, 2021, 9:08am UTC](https://discuss.elastic.co/t/base-documentaire-stockage-video-images-son-pdf/263488 "2021-02-06T09:08:23Z")
Bonjour, Petite question, y a t'il moyen de stocker un champ dans un document de type "blob" pour contenir des image, video,son, pdf, etc.., indexer par des mot clé de recherche, pour faire une base documentaire. pour t… --- ## [From Coveo to Elasticsearch](https://discuss.elastic.co/t/from-coveo-to-elasticsearch/263457)
**Author:** [@manideep](https://discuss.elastic.co/u/manideep)\ **Replies:** 3\ **Last updated:** [February 6, 2021, 5:03am UTC](https://discuss.elastic.co/t/from-coveo-to-elasticsearch/263457 "2021-02-06T05:03:04Z")
Dear Community, I have a web application built for enterprise search using Coveo. It has lot of sources (CSVs, Excel, Sharepoint, S3, APIs, etc.) indexed using default Coveo Connectors and few custom Connector written … --- ## [Best way to resolve this out of memory error in my ES Data Nodes](https://discuss.elastic.co/t/best-way-to-resolve-this-out-of-memory-error-in-my-es-data-nodes/263478)
**Author:** [@cis4life](https://discuss.elastic.co/u/cis4life)\ **Replies:** 2\ **Last updated:** [February 6, 2021, 4:04am UTC](https://discuss.elastic.co/t/best-way-to-resolve-this-out-of-memory-error-in-my-es-data-nodes/263478 "2021-02-06T04:04:57Z")
I have a cluster and now my data nodes are crashing. Looking over the logs i see this error. Its an out of memory error. Is there something i should set in the Elastic yml file to help lock memory? Add more data nodes… --- ## [Difference on dotted notation vs dictionary](https://discuss.elastic.co/t/difference-on-dotted-notation-vs-dictionary/263450)
**Author:** [@oskrdt](https://discuss.elastic.co/u/oskrdt)\ **Replies:** 2\ **Last updated:** [February 6, 2021, 3:00am UTC](https://discuss.elastic.co/t/difference-on-dotted-notation-vs-dictionary/263450 "2021-02-06T03:00:38Z")
I'm using a python script to populate data to elasticsearch using pandas to transform the data before the population. I was creating columns on pandas using dotted notation expecting that the elasticsearch index process… --- ## [Custom coloring in Kibana Visualize? e.g. the "failed" tag is red, "success" is green](https://discuss.elastic.co/t/custom-coloring-in-kibana-visualize-e-g-the-failed-tag-is-red-success-is-green/263346)
**Author:** [@fzyzcjy](https://discuss.elastic.co/u/fzyzcjy)\ **Replies:** 2\ **Last updated:** [February 6, 2021, 1:04am UTC](https://discuss.elastic.co/t/custom-coloring-in-kibana-visualize-e-g-the-failed-tag-is-red-success-is-green/263346 "2021-02-06T01:04:23Z")
Hi thanks for the lib! I wonder how can I custom the coloringin Kibana Visualize? e.g. the "failed" tag is red, "success" is green. Currently I cannot control it. See the following figure: where the "failed" and "suc… --- ## [Time of Day filter](https://discuss.elastic.co/t/time-of-day-filter/263277)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 4\ **Last updated:** [February 5, 2021, 11:20pm UTC](https://discuss.elastic.co/t/time-of-day-filter/263277 "2021-02-05T23:20:15Z")
I am trying to produce a dashboard that has some visualizations but also some data tables. In order to produce the results I need in the data tables, there are times that I must filter based on the time of day. For exa… --- ## [Sum with negative fields (double type) strange result](https://discuss.elastic.co/t/sum-with-negative-fields-double-type-strange-result/263438)
**Author:** [@Maurip00](https://discuss.elastic.co/u/Maurip00)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 4:43pm UTC](https://discuss.elastic.co/t/sum-with-negative-fields-double-type-strange-result/263438 "2021-02-05T16:43:00Z")
There is someone that could me explain why by this simple aggregation: \> GET cfo1/\_search \> { \> "size": 0, \> "aggs": { \> "NAME": { \> "filter": {...}, \> "aggs": { \> … --- ## [ElasticSearch: L2 norm script\_score returns false distances](https://discuss.elastic.co/t/elasticsearch-l2-norm-script-score-returns-false-distances/257384)
**Author:** [@christiana](https://discuss.elastic.co/u/christiana)\ **Replies:** 1\ **Last updated:** [February 5, 2021, 9:57pm UTC](https://discuss.elastic.co/t/elasticsearch-l2-norm-script-score-returns-false-distances/257384 "2021-02-05T21:57:44Z")
i'm trying to calculate the L2-Norm between the fields of my database. To validate the correctness I setup a testing database with two documents, which are having equal vectors. My db look like this: Documents \_index:… --- ## [Intermittent exception using high-level-rest-client. Unable to load a DateTransformer](https://discuss.elastic.co/t/intermittent-exception-using-high-level-rest-client-unable-to-load-a-datetransformer/262375)
**Author:** [@Srikar\_Yekollu](https://discuss.elastic.co/u/Srikar_Yekollu)\ **Replies:** 10\ **Last updated:** [February 5, 2021, 9:29pm UTC](https://discuss.elastic.co/t/intermittent-exception-using-high-level-rest-client-unable-to-load-a-datetransformer/262375 "2021-02-05T21:29:42Z")
Elastic Search Version: 7.9.2 Client: Java: elasticsearch-rest-high-level-client We use elastic search on Kubernetes in AWS. We are noticing these errors sporadically in our server logs. When this happens, all searche… --- ## [Build constant score as sum of fields matching](https://discuss.elastic.co/t/build-constant-score-as-sum-of-fields-matching/263423)
**Author:** [@Maor\_Nissan](https://discuss.elastic.co/u/Maor_Nissan)\ **Replies:** 1\ **Last updated:** [February 5, 2021, 8:29pm UTC](https://discuss.elastic.co/t/build-constant-score-as-sum-of-fields-matching/263423 "2021-02-05T20:29:29Z")
hi, i have documents that have the following fields: title, gender,brand, category i want to run an exact query and score each hit with a constant score, lets say: title = 100, gender = 50, color = 200, category =… --- ## [Outils import export collection en python pour elasticsearch 2.3.x](https://discuss.elastic.co/t/outils-import-export-collection-en-python-pour-elasticsearch-2-3-x/263359)
**Author:** [@Corben\_Dallas](https://discuss.elastic.co/u/Corben_Dallas)\ **Replies:** 5\ **Last updated:** [February 5, 2021, 8:14pm UTC](https://discuss.elastic.co/t/outils-import-export-collection-en-python-pour-elasticsearch-2-3-x/263359 "2021-02-05T20:14:45Z")
Bonjour, Je cherche un outil en python pour faire un export import de collection sur un elastic 2.3.1, pour faire un backup, pas du npm, j'ai du python installé partout, c'est pas le cas du npm Est ce quelqu'un en co… --- ## [Nodes being dropped from cluster](https://discuss.elastic.co/t/nodes-being-dropped-from-cluster/263161)
**Author:** [@khuang](https://discuss.elastic.co/u/khuang)\ **Replies:** 7\ **Last updated:** [February 5, 2021, 7:20pm UTC](https://discuss.elastic.co/t/nodes-being-dropped-from-cluster/263161 "2021-02-05T19:20:04Z")
I am currently trying to set up a 17 node cluster. 3 master nodes - 4 vCPU, 12 GB RAM, 7 GB Heap 10 data nodes - 15 vCPU, 116 GB RAM, 32 GB Heap 3 ingest nodes - 7 vCPU, 8 GB RAM, 2 GB Heap (Is this enough?) 1 coordi… --- ## [Logstash HTTP input plugin](https://discuss.elastic.co/t/logstash-http-input-plugin/263456)
**Author:** [@TrentB2000](https://discuss.elastic.co/u/TrentB2000)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 6:57pm UTC](https://discuss.elastic.co/t/logstash-http-input-plugin/263456 "2021-02-05T18:57:01Z")
I am attempting to use the logstash HTTP input plugin with my Docker container that I am running Elk in. I am currently using Docker Compose to run my stack and in trying to follow this page (below) I have been unsuc… --- ## [Kibana specific dashboard show for users](https://discuss.elastic.co/t/kibana-specific-dashboard-show-for-users/263449)
**Author:** [@Shayan\_Delavarkhan](https://discuss.elastic.co/u/Shayan_Delavarkhan)\ **Replies:** 1\ **Last updated:** [February 5, 2021, 6:46pm UTC](https://discuss.elastic.co/t/kibana-specific-dashboard-show-for-users/263449 "2021-02-05T18:46:22Z")
Dear guys, I wanna set a permission for a user which can see only single specific dashboard instead of list of all dashboards. My question is that how can I achieve this view? thanks in advanced --- ## [GSUB & Regular Expression](https://discuss.elastic.co/t/gsub-regular-expression/263442)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 1\ **Last updated:** [February 5, 2021, 6:12pm UTC](https://discuss.elastic.co/t/gsub-regular-expression/263442 "2021-02-05T18:12:39Z")
I have a text field being ingested that I want to remove an email disclaimer from, unfortunately, I can't figure out the correct syntax to remove it. I've got the mutate filter setup in the following way: mutate { gs… --- ## [Elastic SIEM - Detection Rules - Combination of Time-based, Threshold, Aggregation and Sequence Events](https://discuss.elastic.co/t/elastic-siem-detection-rules-combination-of-time-based-threshold-aggregation-and-sequence-events/263175)
**Author:** [@tushar.bansal](https://discuss.elastic.co/u/tushar.bansal)\ **Replies:** 6\ **Last updated:** [February 5, 2021, 6:11pm UTC](https://discuss.elastic.co/t/elastic-siem-detection-rules-combination-of-time-based-threshold-aggregation-and-sequence-events/263175 "2021-02-05T18:11:20Z")
How to create rule to detect: "Successful Brute Force Attack" (When more than 10 Windows logout events (ID 4625) occur AND followed by a Windows login event (ID 4624) on a same host) in 5 minutes timespan Thresholds: N… --- ## [Elastic SIEM - Detection Rules - Multiple Thresholds in a Rule](https://discuss.elastic.co/t/elastic-siem-detection-rules-multiple-thresholds-in-a-rule/263411)
**Author:** [@tushar.bansal](https://discuss.elastic.co/u/tushar.bansal)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 3:11pm UTC](https://discuss.elastic.co/t/elastic-siem-detection-rules-multiple-thresholds-in-a-rule/263411 "2021-02-05T15:11:01Z")
Is there a way to apply multiple Thresholds in a single rule? example: More than 10 Identical event.actions on more than 10 destination.hostnames in a span of 10 minutes Threshold 1: Results aggregated by event.action… --- ## [Removal of mapping types in 7.x: why not include index aliases in results?](https://discuss.elastic.co/t/removal-of-mapping-types-in-7-x-why-not-include-index-aliases-in-results/263293)
**Author:** [@Thomas\_Doman](https://discuss.elastic.co/u/Thomas_Doman)\ **Replies:** 0\ **Last updated:** [February 4, 2021, 7:10pm UTC](https://discuss.elastic.co/t/removal-of-mapping-types-in-7-x-why-not-include-index-aliases-in-results/263293 "2021-02-04T19:10:56Z")
ES: 6.8.13 NEST: 6.8.6 We're preparing to upgrade to ES 7.x and are considering the type removal. We've reviewed the suggestions in Removal of mapping types. Since the 1.x days, we haven't had multiple types in any o… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1056) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1058)