# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1101 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1102 --- ## [Search for docs that are parents](https://discuss.elastic.co/t/search-for-docs-that-are-parents/259684)
**Author:** [@Luca\_Frost](https://discuss.elastic.co/u/Luca_Frost)\ **Replies:** 0\ **Last updated:** [December 27, 2020, 1:03pm UTC](https://discuss.elastic.co/t/search-for-docs-that-are-parents/259684 "2020-12-27T13:03:19Z")
Hi There, I'm looking for a way to search for documents where the join field specifies that they are a parent, that way I can still search for parents without children? Here's my very crude attempt which fails... POST… --- ## [Logstash kv field split problem](https://discuss.elastic.co/t/logstash-kv-field-split-problem/259552)
**Author:** [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)\ **Replies:** 7\ **Last updated:** [December 27, 2020, 10:00am UTC](https://discuss.elastic.co/t/logstash-kv-field-split-problem/259552 "2020-12-27T10:00:10Z")
Logs like this: topic = abc, partition = 2, offset = 4386, serialized key size = -1, serialized value size = 1139, key = null, value = {"Name":"pc-1","test":false,"message":"elk test - Your pc-1 better. Thank you.","Cou… --- ## [Time filtered aggregations with very high cardinality](https://discuss.elastic.co/t/time-filtered-aggregations-with-very-high-cardinality/259673)
**Author:** [@Metheny](https://discuss.elastic.co/u/Metheny)\ **Replies:** 0\ **Last updated:** [December 27, 2020, 6:49am UTC](https://discuss.elastic.co/t/time-filtered-aggregations-with-very-high-cardinality/259673 "2020-12-27T06:49:29Z")
We have an index with a large amount of user reports (millions / 10s of millions). Assuming most users have reports, we need to calculate some statistics per-user with an input time range. For example, how many users ha… --- ## [Elasticsearch 7.10.1 new test cluster - cannot bring up - state not recovered](https://discuss.elastic.co/t/elasticsearch-7-10-1-new-test-cluster-cannot-bring-up-state-not-recovered/259520)
**Author:** [@lakshmi-github](https://discuss.elastic.co/u/lakshmi-github)\ **Replies:** 1\ **Last updated:** [December 26, 2020, 11:36pm UTC](https://discuss.elastic.co/t/elasticsearch-7-10-1-new-test-cluster-cannot-bring-up-state-not-recovered/259520 "2020-12-26T23:36:53Z")
Hello, I am trying to bring up a new ES 7.10.1 cluster for testing as follows: node1 - master (node.roles: \[ 'master'\]) node2 - master (node.roles: \[ 'master'\]) node3 - master (node.roles: \[ 'master'\]) node4 - data (n… --- ## [Aggregate filter dilemma](https://discuss.elastic.co/t/aggregate-filter-dilemma/259657)
**Author:** [@tommys](https://discuss.elastic.co/u/tommys)\ **Replies:** 4\ **Last updated:** [December 26, 2020, 10:58pm UTC](https://discuss.elastic.co/t/aggregate-filter-dilemma/259657 "2020-12-26T22:58:43Z")
Hi all, hoping to get some feedback on this as it took me 3 days to resolve which I think is potentially a knowledge gap on my side or a BUG. In summary: Two logs, I want to aggregate using the aggregate filter. One… --- ## [How can i do a Month over Month change in my graph?](https://discuss.elastic.co/t/how-can-i-do-a-month-over-month-change-in-my-graph/259322)
**Author:** [@marcosvrrs](https://discuss.elastic.co/u/marcosvrrs)\ **Replies:** 2\ **Last updated:** [December 26, 2020, 10:03pm UTC](https://discuss.elastic.co/t/how-can-i-do-a-month-over-month-change-in-my-graph/259322 "2020-12-26T22:03:42Z")
I have this graph that is a sum of transactions per month. How can I draw a line with the percentage change each month in this graph? I can't do this in TSVB, and didn't try in Timelion cause I'am bit of a newbie. Thank… --- ## [Return node to cluster](https://discuss.elastic.co/t/return-node-to-cluster/259663)
**Author:** [@KA3AXCTAH](https://discuss.elastic.co/u/KA3AXCTAH)\ **Replies:** 1\ **Last updated:** [December 26, 2020, 7:48pm UTC](https://discuss.elastic.co/t/return-node-to-cluster/259663 "2020-12-26T19:48:22Z")
I have 3 node elasticsearch cluster 192.168.2.11 - node-01 192.168.2.12 - node-02 192.168.2.13 - node-03 and i deleted node-02 from cluster using this command curl -XPUT 192.168.2.12:9200/\_cluster/settings -H 'Content… --- ## [How to specify timezone on elasticsearch?](https://discuss.elastic.co/t/how-to-specify-timezone-on-elasticsearch/259614)
**Author:** [@gabriel.goncalves](https://discuss.elastic.co/u/gabriel.goncalves)\ **Replies:** 6\ **Last updated:** [December 26, 2020, 6:19pm UTC](https://discuss.elastic.co/t/how-to-specify-timezone-on-elasticsearch/259614 "2020-12-26T18:19:38Z")
It says: "Internally, dates are converted to UTC (if the time-zone is specified) and stored as a long number representing milliseconds-since-the-epoch." What are all possible ways to specify the timezone? --- ## [Suricata Rule](https://discuss.elastic.co/t/suricata-rule/259666)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 0\ **Last updated:** [December 26, 2020, 5:43pm UTC](https://discuss.elastic.co/t/suricata-rule/259666 "2020-12-26T17:43:19Z")
Is there some type of general Suricata rule for Elastic that will create a detection alert in Elastic SIEM everytime that the suricata rules goes off. --- ## [Pipeline with id \[\] does not exist](https://discuss.elastic.co/t/pipeline-with-id-does-not-exist/259476)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 12\ **Last updated:** [December 26, 2020, 12:53pm UTC](https://discuss.elastic.co/t/pipeline-with-id-does-not-exist/259476 "2020-12-26T12:53:05Z")
There are few references to this problem already here but none provide resolution, I am getting the below error on 7.6.2 and i do see the pipeline when i run the GET API call { "index" : "xxxxxxxxxx-2020.45-reind… --- ## [How to search multiple fields and aggregate scores?](https://discuss.elastic.co/t/how-to-search-multiple-fields-and-aggregate-scores/259659)
**Author:** [@Shuri](https://discuss.elastic.co/u/Shuri)\ **Replies:** 0\ **Last updated:** [December 26, 2020, 11:34am UTC](https://discuss.elastic.co/t/how-to-search-multiple-fields-and-aggregate-scores/259659 "2020-12-26T11:34:28Z")
Hi all, I'm trying to figure out a solution to how I should structure my queries for finding answers to people's questions. For example, based off the dataset I will paste at the end of this post, I would like to query "… --- ## [Как настроить хранение индексов по размеру](https://discuss.elastic.co/t/topic/259551)
**Author:** [@Peter\_Homicevich](https://discuss.elastic.co/u/Peter_Homicevich)\ **Replies:** 1\ **Last updated:** [December 25, 2020, 5:11pm UTC](https://discuss.elastic.co/t/topic/259551 "2020-12-25T17:11:36Z")
Добрый день! Подскажите как настроить хранение индексов не более 90Гб. Ситуация следующая: Имеется ELK, из одной ноды. Сервисы пишут логи в logsatsh. Logsatsh создает индекс в elasticsearch - index =\> "logs-%{+YYYY.MM… --- ## [Не работает should только по определенным словам](https://discuss.elastic.co/t/should/259194)
**Author:** [@unavailabl3](https://discuss.elastic.co/u/unavailabl3)\ **Replies:** 1\ **Last updated:** [December 25, 2020, 4:44pm UTC](https://discuss.elastic.co/t/should/259194 "2020-12-25T16:44:32Z")
Недавно что-то странное начало происходить с Elasticsearch. Всё работало на разных серверах, а теперь и в локальной среде и нет should не учитывает некоторые слова. { "\_index" : "products", "\_type" : "\_doc", "\_id"… --- ## [Can I get only one data in logstash's output?](https://discuss.elastic.co/t/can-i-get-only-one-data-in-logstashs-output/259626)
**Author:** [@iooi](https://discuss.elastic.co/u/iooi)\ **Replies:** 1\ **Last updated:** [December 25, 2020, 4:09pm UTC](https://discuss.elastic.co/t/can-i-get-only-one-data-in-logstashs-output/259626 "2020-12-25T16:09:15Z")
Can I get only one data in logstash's output? If the data after filter like: "a" =\> 1, "b" =\> 2, "c" =\> 3, in the output, send it to elasticsearch. output { elasticsearch { protocol =\> http host =\>… --- ## [Logsource On-boarding](https://discuss.elastic.co/t/logsource-on-boarding/259590)
**Author:** [@ameermane](https://discuss.elastic.co/u/ameermane)\ **Replies:** 2\ **Last updated:** [December 25, 2020, 2:49pm UTC](https://discuss.elastic.co/t/logsource-on-boarding/259590 "2020-12-25T14:49:13Z")
Hello All, Hope you are doing good!!! ELK is new for me. I have deployed ELK in my lab and wondering how to onboard different logs source like paloalto , checkpoint , cisco firewalls. Please share any leadings that wi… --- ## [How can I use elasticsearch java aip to agg from the Query Builders？](https://discuss.elastic.co/t/how-can-i-use-elasticsearch-java-aip-to-agg-from-the-query-builders/259624)
**Author:** [@Vastzhang](https://discuss.elastic.co/u/Vastzhang)\ **Replies:** 2\ **Last updated:** [December 25, 2020, 10:18am UTC](https://discuss.elastic.co/t/how-can-i-use-elasticsearch-java-aip-to-agg-from-the-query-builders/259624 "2020-12-25T10:18:19Z")
Hi!I use elasticsearch java api like as follw: how can i convert json as follow to java api？ Thanks！！！ --- ## [Can logstash's JDBC input plugin do multiple sql tasks?](https://discuss.elastic.co/t/can-logstashs-jdbc-input-plugin-do-multiple-sql-tasks/259573)
**Author:** [@iooi](https://discuss.elastic.co/u/iooi)\ **Replies:** 6\ **Last updated:** [December 25, 2020, 9:17am UTC](https://discuss.elastic.co/t/can-logstashs-jdbc-input-plugin-do-multiple-sql-tasks/259573 "2020-12-25T09:17:12Z")
Now there is a JDBC task read from db as input { jdbc { jdbc\_connection\_string =\> "jdbc:mysql://${MYSQL\_MAIN\_HOST}/${MYSQL\_DATABASE}" jdbc\_driver\_class =\> "com.mysql.cj.jdbc.Driver" jdbc\_page\_size =\> 10000… --- ## [Elasticsearch query that returns latest document for each group of criteria in the query](https://discuss.elastic.co/t/elasticsearch-query-that-returns-latest-document-for-each-group-of-criteria-in-the-query/259625)
**Author:** [@n0rman](https://discuss.elastic.co/u/n0rman)\ **Replies:** 0\ **Last updated:** [December 25, 2020, 9:07am UTC](https://discuss.elastic.co/t/elasticsearch-query-that-returns-latest-document-for-each-group-of-criteria-in-the-query/259625 "2020-12-25T09:07:30Z")
Newbie here. Trying to figure out how to query to find grandparent processes of child processes by using parent process info in windows logs. I have a list of child processes with host info (hostname) and parent proces… --- ## [Indexer Mongodb dans ES en temps réel](https://discuss.elastic.co/t/indexer-mongodb-dans-es-en-temps-reel/259190)
**Author:** [@Jalil](https://discuss.elastic.co/u/Jalil)\ **Replies:** 23\ **Last updated:** [December 25, 2020, 9:03am UTC](https://discuss.elastic.co/t/indexer-mongodb-dans-es-en-temps-reel/259190 "2020-12-25T09:03:53Z")
Bonjour à tous, Mon besoin est d'indexer en temps réel une base mongodb (plusieurs collections) dans Elasticsearch (en leur appliquant qlq transformation au passage : formatage des geo\_point par exemple). J'ai essayé a… --- ## [Logstash doesnt update the data when mongodb data gets updated](https://discuss.elastic.co/t/logstash-doesnt-update-the-data-when-mongodb-data-gets-updated/259562)
**Author:** [@Siddhanta\_Das](https://discuss.elastic.co/u/Siddhanta_Das)\ **Replies:** 1\ **Last updated:** [December 25, 2020, 8:42am UTC](https://discuss.elastic.co/t/logstash-doesnt-update-the-data-when-mongodb-data-gets-updated/259562 "2020-12-25T08:42:18Z")
I am using this configuration input{ mongodb{ uri=\>"mongodb://localhost:27017/ebyat" placeholder\_db\_dir =\> "/opt/logstash-mongodb/" placeholder\_db\_name =\> "logstash\_sqlite.db" collection =\> "amenities" batch\_size =\>… --- ## [Grok pattern to match multiple results](https://discuss.elastic.co/t/grok-pattern-to-match-multiple-results/259605)
**Author:** [@Minor\_Vargas](https://discuss.elastic.co/u/Minor_Vargas)\ **Replies:** 1\ **Last updated:** [December 25, 2020, 8:29am UTC](https://discuss.elastic.co/t/grok-pattern-to-match-multiple-results/259605 "2020-12-25T08:29:14Z")
Hi guys, I need to match the first line of each log and maybe store it in an array and prepend some metadata at the beginning of each line.. I have a grok pattern that's matching only the first result and ignores the re… --- ## [Dec 25th, 2020 \[EN\] Santa’s Little Helper - Workplace Search](https://discuss.elastic.co/t/dec-25th-2020-en-santa-s-little-helper-workplace-search/256691)
**Author:** [@Sean\_Story](https://discuss.elastic.co/u/Sean_Story)\ **Replies:** 0\ **Last updated:** [December 25, 2020, 8:00am UTC](https://discuss.elastic.co/t/dec-25th-2020-en-santa-s-little-helper-workplace-search/256691 "2020-12-25T08:00:13Z")
Santa’s Little Helper - Workplace Search You might have picked up on this from movies: Santa’s operation is pretty high tech. It’s a big job, coordinating a massive workforce of Elves to ensure the timely delivery of… --- ## [Line chart canvas visualization](https://discuss.elastic.co/t/line-chart-canvas-visualization/259466)
**Author:** [@salma\_widiarti](https://discuss.elastic.co/u/salma_widiarti)\ **Replies:** 2\ **Last updated:** [December 25, 2020, 5:54am UTC](https://discuss.elastic.co/t/line-chart-canvas-visualization/259466 "2020-12-25T05:54:24Z")
Hi all, I have data like this And this is my query SELECT substring(labels.tanggal,1,4) as date1, SUM(labels.money::int) as a FROM "apm-\*" WHERE labels.status = 'PAID' GROUP BY date1 But why when I make a visualiza… --- ## [Grok pattern to add some metadata to every log](https://discuss.elastic.co/t/grok-pattern-to-add-some-metadata-to-every-log/259432)
**Author:** [@Minor\_Vargas](https://discuss.elastic.co/u/Minor_Vargas)\ **Replies:** 1\ **Last updated:** [December 23, 2020, 6:48am UTC](https://discuss.elastic.co/t/grok-pattern-to-add-some-metadata-to-every-log/259432 "2020-12-23T06:48:39Z")
Hello all, I wrote a grok pattern that matches the beginning of each log line (Writing table data). I need to take the timestamp that I already matched and append it at the beginning of each log line. I'm facing 2 issue… --- ## [Index Management Tab is not visible after updating to 7.9.1](https://discuss.elastic.co/t/index-management-tab-is-not-visible-after-updating-to-7-9-1/259418)
**Author:** [@oskrdt](https://discuss.elastic.co/u/oskrdt)\ **Replies:** 6\ **Last updated:** [December 24, 2020, 6:01pm UTC](https://discuss.elastic.co/t/index-management-tab-is-not-visible-after-updating-to-7-9-1/259418 "2020-12-24T18:01:51Z")
Hi, I'm working with Elasticsearch and Kibana on Power PC docker containers. I'm using the Dockerfiles from ppc64le/build-scripts repository to create the container images, which use the source code on GitHub from the e… --- ## [ERR\_TOO\_MANY\_REDIRECTS 302 with ELK Operator 7.10.0](https://discuss.elastic.co/t/err-too-many-redirects-302-with-elk-operator-7-10-0/259504)
**Author:** [@inforedaster](https://discuss.elastic.co/u/inforedaster)\ **Replies:** 6\ **Last updated:** [December 24, 2020, 5:11pm UTC](https://discuss.elastic.co/t/err-too-many-redirects-302-with-elk-operator-7-10-0/259504 "2020-12-24T17:11:15Z")
hello, i have an Elastick stack elasticsearch and kibana 7.10.0 using elk operator in kubernetes Whene i make the link https://monitoring.cloudapp.azure.com/kibana i have this redirection : https://monitoring.cloudap… --- ## [Bucket Terms aggregation, top 20 values](https://discuss.elastic.co/t/bucket-terms-aggregation-top-20-values/259031)
**Author:** [@grra](https://discuss.elastic.co/u/grra)\ **Replies:** 7\ **Last updated:** [December 24, 2020, 11:09am UTC](https://discuss.elastic.co/t/bucket-terms-aggregation-top-20-values/259031 "2020-12-24T11:09:47Z")
Hi, on my Buckets I have the Terms aggregation, with a field of the type number. I need the 20 biggest values of that field - in ascending order. Is it possible to order the Terms ascending and then take the last 20 … --- ## [Logstash filter plugin needs certificate with dns name](https://discuss.elastic.co/t/logstash-filter-plugin-needs-certificate-with-dns-name/259281)
**Author:** [@Moni\_Kherajani](https://discuss.elastic.co/u/Moni_Kherajani)\ **Replies:** 13\ **Last updated:** [December 24, 2020, 10:48am UTC](https://discuss.elastic.co/t/logstash-filter-plugin-needs-certificate-with-dns-name/259281 "2020-12-24T10:48:05Z")
Hi i tried to configure security in elkstack and wanted a common certificate in all nodes environments but logstash fillter plugin needs dns name to speicified else wont work, any other solution? --- ## [Strange memory leak ElasticSearch](https://discuss.elastic.co/t/strange-memory-leak-elasticsearch/258814)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 20\ **Last updated:** [December 24, 2020, 10:33am UTC](https://discuss.elastic.co/t/strange-memory-leak-elasticsearch/258814 "2020-12-24T10:33:32Z")
Hi, we have a cluster of ES. Our Heap is 31 Gb on each node. Total RAM 128 Gb on each node. And our RAM fills up over time and starts to run out, it that time we get faults of cluster. We see that "cached" constantly … --- ## [Intermittent search querying issues](https://discuss.elastic.co/t/intermittent-search-querying-issues/259471)
**Author:** [@Sajjan\_Kumar\_Jain](https://discuss.elastic.co/u/Sajjan_Kumar_Jain)\ **Replies:** 8\ **Last updated:** [December 24, 2020, 9:25am UTC](https://discuss.elastic.co/t/intermittent-search-querying-issues/259471 "2020-12-24T09:25:06Z")
Hi, We are using elastic search in our backend hosted on AWS. And our backend is in Java. We have seen a pattern where queries start failing for a brief period of time with the following error: cannot write time value … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1100) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1102)