# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1103 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1104 --- ## [Duplicate log entries](https://discuss.elastic.co/t/duplicate-log-entries/259394)
**Author:** [@leandro.borges](https://discuss.elastic.co/u/leandro.borges)\ **Replies:** 17\ **Last updated:** [December 23, 2020, 3:52pm UTC](https://discuss.elastic.co/t/duplicate-log-entries/259394 "2020-12-23T15:52:32Z")
Hi, We are facing some issues with elasticsearch. We are having lots of duplicate log entries like below. Inside logstash.yml there is only a file in path.config that we use: path.config: "/etc/logstash/pipeline.global.… --- ## [How to generate a pie chart from geo\_points within a geo\_shape in ELK?](https://discuss.elastic.co/t/how-to-generate-a-pie-chart-from-geo-points-within-a-geo-shape-in-elk/258312)
**Author:** [@MichaelLevy](https://discuss.elastic.co/u/MichaelLevy)\ **Replies:** 7\ **Last updated:** [December 23, 2020, 3:33pm UTC](https://discuss.elastic.co/t/how-to-generate-a-pie-chart-from-geo-points-within-a-geo-shape-in-elk/258312 "2020-12-23T15:33:54Z")
Hello everyone! I have created a map by importing GEOJSON data in KIBANA. The data is indexed as geo\_shape and it contains the World's territorial waters area. It represents a layer in my map. I have then added another … --- ## [Issue unzipping Kibana 7.10 installation file (kibana-7.10.0-windows-x86\_64.zip)](https://discuss.elastic.co/t/issue-unzipping-kibana-7-10-installation-file-kibana-7-10-0-windows-x86-64-zip/257332)
**Author:** [@eugenevk](https://discuss.elastic.co/u/eugenevk)\ **Replies:** 1\ **Last updated:** [December 23, 2020, 3:28pm UTC](https://discuss.elastic.co/t/issue-unzipping-kibana-7-10-installation-file-kibana-7-10-0-windows-x86-64-zip/257332 "2020-12-23T15:28:09Z")
Hi, I get an error message when unzipping kibana-7.10.0-windows-x86\_64.zip. Towards the end of the extraction process I get the error message Skipping file: unable to create a sensible filename out of "C:\\Users\\...\\add\_… --- ## [Timestamp not mapping with event time](https://discuss.elastic.co/t/timestamp-not-mapping-with-event-time/258976)
**Author:** [@bharat1](https://discuss.elastic.co/u/bharat1)\ **Replies:** 6\ **Last updated:** [December 23, 2020, 3:00pm UTC](https://discuss.elastic.co/t/timestamp-not-mapping-with-event-time/258976 "2020-12-23T15:00:20Z")
My logs are exported in csv format and uploaded. The first column name called "Event Time" has following format event time followed by rest of the comma separated columns - "2020/11/10 00:00:00 CET" I am not able to ma… --- ## [Logstashのlogstash-input-s3利用時のログ欠損](https://discuss.elastic.co/t/logstash-logstash-input-s3/258695)
**Author:** [@Branzino](https://discuss.elastic.co/u/Branzino)\ **Replies:** 4\ **Last updated:** [December 23, 2020, 2:37pm UTC](https://discuss.elastic.co/t/logstash-logstash-input-s3/258695 "2020-12-23T14:37:55Z")
【環境構成】 複数サーバから同じフォーマットのログをFilebeat利用してLogstash経由（logstash-output-s3）でAWS上のS3バケットに集約して、さらにLogstash（logstash-input-s3）を利用してログをElasticsearchへ転送しています。 【問い合わせ内容】 上記構成において、S3バケットまでログは欠損せずに保管されますが、後続の処理においてログ欠損が発生しています。 収集対… --- ## [ECE security-cluster failed upgrade](https://discuss.elastic.co/t/ece-security-cluster-failed-upgrade/259495)
**Author:** [@bharat1](https://discuss.elastic.co/u/bharat1)\ **Replies:** 0\ **Last updated:** [December 23, 2020, 2:01pm UTC](https://discuss.elastic.co/t/ece-security-cluster-failed-upgrade/259495 "2020-12-23T14:01:32Z")
I recently upgraded ECE from 2.6.2 it was successful however the security-cluster failed to upgrade from v7.9.2 to 7.10.1 but admin-console-elasticsearch got automatically upgraded to 7.10.1 I tried to upgrade security-… --- ## [JavaScript](https://discuss.elastic.co/t/javascript/257561)
**Author:** [@ravishka](https://discuss.elastic.co/u/ravishka)\ **Replies:** 11\ **Last updated:** [December 23, 2020, 1:53pm UTC](https://discuss.elastic.co/t/javascript/257561 "2020-12-23T13:53:48Z")
Can I put Javascript code or library on the kibana canvas? --- ## [The shutdown process appears to be stalled due to busy or blocked plugins](https://discuss.elastic.co/t/the-shutdown-process-appears-to-be-stalled-due-to-busy-or-blocked-plugins/259487)
**Author:** [@Suddhasil\_Sarkar](https://discuss.elastic.co/u/Suddhasil_Sarkar)\ **Replies:** 0\ **Last updated:** [December 23, 2020, 1:06pm UTC](https://discuss.elastic.co/t/the-shutdown-process-appears-to-be-stalled-due-to-busy-or-blocked-plugins/259487 "2020-12-23T13:06:05Z")
Hi Team, Need help- we have ELK cluster which was down for few months. we nor brought the cluster up . Now having issues in logstash log as below.. \[ERROR\]\[logstash.shutdownwatcher \] The shutdown process appears to be s… --- ## [Sorting with wildcards. occurrences of term. amount of “\*searchstring\*”](https://discuss.elastic.co/t/sorting-with-wildcards-occurrences-of-term-amount-of-searchstring/259481)
**Author:** [@flashpeter](https://discuss.elastic.co/u/flashpeter)\ **Replies:** 0\ **Last updated:** [December 23, 2020, 12:18pm UTC](https://discuss.elastic.co/t/sorting-with-wildcards-occurrences-of-term-amount-of-searchstring/259481 "2020-12-23T12:18:35Z")
hi all i have nasty problem with elastic result sorting combined with boolean type of query (a kind of wildcard). lets say we have blog post with field "content". each post contains some info about dragons. with all co… --- ## [Random file generated by elasticsearch](https://discuss.elastic.co/t/random-file-generated-by-elasticsearch/259453)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [December 23, 2020, 11:06am UTC](https://discuss.elastic.co/t/random-file-generated-by-elasticsearch/259453 "2020-12-23T11:06:38Z")
I am using elasticsearch cluster of 8 node (3Master+3data+2coordinate).In data node there is a file called java\_pid4907.hprof of 7.2 gb in elasticsearch data directory this file is present in all elasticsearch data node.… --- ## [Event attribute not resolved in elasticsearh output](https://discuss.elastic.co/t/event-attribute-not-resolved-in-elasticsearh-output/259472)
**Author:** [@KarlosA](https://discuss.elastic.co/u/KarlosA)\ **Replies:** 0\ **Last updated:** [December 23, 2020, 10:33am UTC](https://discuss.elastic.co/t/event-attribute-not-resolved-in-elasticsearh-output/259472 "2020-12-23T10:33:02Z")
Hello, I'm using helm chart with image: image: "docker.elastic.co/logstash/logstash-oss" imageTag: "7.10.0" I provide the following configuration in values.yml: logstashPipeline: logstash.conf: | input { … --- ## [Audit logging for applying Licence](https://discuss.elastic.co/t/audit-logging-for-applying-licence/259443)
**Author:** [@Vineeth\_varma](https://discuss.elastic.co/u/Vineeth_varma)\ **Replies:** 0\ **Last updated:** [December 23, 2020, 4:25am UTC](https://discuss.elastic.co/t/audit-logging-for-applying-licence/259443 "2020-12-23T04:25:42Z")
Hi Team, I am using trail licence for ECK, and I have enabled auditing feature but still I am getting only few parameters, as this is testing its okay but after that will go into production one so in order to buy licenc… --- ## [Dec 23rd, 2020: \[EN\] New additions to the keyword family: constant\_keyword and wildcard](https://discuss.elastic.co/t/dec-23rd-2020-en-new-additions-to-the-keyword-family-constant-keyword-and-wildcard/257213)
**Author:** [@Imma](https://discuss.elastic.co/u/Imma)\ **Replies:** 0\ **Last updated:** [December 23, 2020, 8:00am UTC](https://discuss.elastic.co/t/dec-23rd-2020-en-new-additions-to-the-keyword-family-constant-keyword-and-wildcard/257213 "2020-12-23T08:00:03Z")
Spanish version We’ve recently introduced two additional keyword types, wildcard and constant\_keyword. In this post, we’ll try to briefly introduce them. The wildcard field is optimized for matching any part of string … --- ## [Dec 23rd, 2020: \[ES\] Nuevas incorporaciones a la familia de tipos keyword: constant\_keyword y wildcard](https://discuss.elastic.co/t/dec-23rd-2020-es-nuevas-incorporaciones-a-la-familia-de-tipos-keyword-constant-keyword-y-wildcard/257209)
**Author:** [@Imma](https://discuss.elastic.co/u/Imma)\ **Replies:** 0\ **Last updated:** [December 23, 2020, 8:00am UTC](https://discuss.elastic.co/t/dec-23rd-2020-es-nuevas-incorporaciones-a-la-familia-de-tipos-keyword-constant-keyword-y-wildcard/257209 "2020-12-23T08:00:03Z")
Versión en inglés En este post hablaremos de las recientes incorporaciones a la familia de tipos keyword: wildcard y constant\_keyword. Los campos de tipo wildcard estan optimizados para búsquedas con caracteres comodín… --- ## [Complex SQL query calculated field generation in kibana](https://discuss.elastic.co/t/complex-sql-query-calculated-field-generation-in-kibana/259356)
**Author:** [@anjali28](https://discuss.elastic.co/u/anjali28)\ **Replies:** 7\ **Last updated:** [December 23, 2020, 7:19am UTC](https://discuss.elastic.co/t/complex-sql-query-calculated-field-generation-in-kibana/259356 "2020-12-23T07:19:56Z")
Hello, We want to created a visualization based on regular user in every month. Here is the requirement: "The visualization would display the number of regular users every month, regular users are those who have logg… --- ## [How can convert unstructured log string to json format using logstatsh](https://discuss.elastic.co/t/how-can-convert-unstructured-log-string-to-json-format-using-logstatsh/259202)
**Author:** [@abhi.coerian](https://discuss.elastic.co/u/abhi.coerian)\ **Replies:** 5\ **Last updated:** [December 23, 2020, 6:45am UTC](https://discuss.elastic.co/t/how-can-convert-unstructured-log-string-to-json-format-using-logstatsh/259202 "2020-12-23T06:45:43Z")
INFO handlers.DrivelRequestHandler: 2020-12-14 00:00:15.486 - JOB job\_1603918538928\_4026468 QUEUE queue\_test USER test AUTHORIZED\_SCHEMA message student {\\n optional int64 name;\\n optional double score;\\n required bin… --- ## [Not able to import GeoJson file using Kibana Maps](https://discuss.elastic.co/t/not-able-to-import-geojson-file-using-kibana-maps/258228)
**Author:** [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\ **Replies:** 8\ **Last updated:** [December 23, 2020, 6:35am UTC](https://discuss.elastic.co/t/not-able-to-import-geojson-file-using-kibana-maps/258228 "2020-12-23T06:35:33Z")
Hi Team, I have created the custom geojson file for India region, when i try to import the file in kibana maps, it doesn't show any errors in elasticsearch log nor in the kibana UI. But i can see below error in kibana … --- ## [Logs of an Elasticsearch](https://discuss.elastic.co/t/logs-of-an-elasticsearch/257156)
**Author:** [@Vineeth\_varma](https://discuss.elastic.co/u/Vineeth_varma)\ **Replies:** 5\ **Last updated:** [December 8, 2020, 9:48am UTC](https://discuss.elastic.co/t/logs-of-an-elasticsearch/257156 "2020-12-08T09:48:47Z")
Hi, I have deployed Elasticsearch 7.10.0 in kubernetes using Operator. I have path.logs: /usr/share/elasticsearch/logs , here I am getting only gc.log Apart from this I am not getting any elasticsearch logs. So here… --- ## [Filebeat-logstash issue](https://discuss.elastic.co/t/filebeat-logstash-issue/259272)
**Author:** [@mustafa.husny](https://discuss.elastic.co/u/mustafa.husny)\ **Replies:** 3\ **Last updated:** [December 23, 2020, 3:16am UTC](https://discuss.elastic.co/t/filebeat-logstash-issue/259272 "2020-12-23T03:16:37Z")
I am using ELK 7.6.2 I have three piplines first for the heartbeat second for the tcp to forward logs from QRadar Third is for filebeat I am receiving logs from heartbeat and qradar, but when I installed filebeat on… --- ## [Elastic search query using a list](https://discuss.elastic.co/t/elastic-search-query-using-a-list/259439)
**Author:** [@shantanuo](https://discuss.elastic.co/u/shantanuo)\ **Replies:** 0\ **Last updated:** [December 23, 2020, 3:15am UTC](https://discuss.elastic.co/t/elastic-search-query-using-a-list/259439 "2020-12-23T03:15:56Z")
How do I pass a list as query string to match\_phrase query? This works: \`{"match\_phrase": {"requestParameters.bucketName": {"query": "auditloggingnew2232"}}},\` This does not: { "match\_phrase": { … --- ## [How to store big int value in elastic](https://discuss.elastic.co/t/how-to-store-big-int-value-in-elastic/259391)
**Author:** [@AKASH\_DUBEY1](https://discuss.elastic.co/u/AKASH_DUBEY1)\ **Replies:** 4\ **Last updated:** [December 23, 2020, 2:45am UTC](https://discuss.elastic.co/t/how-to-store-big-int-value-in-elastic/259391 "2020-12-23T02:45:24Z")
what data type should be used for storing the given value =281471798906391 .as it is out of long-range in java. and I have to use the range query on it. I tried using the keyword, double,it works but the range query does… --- ## [Fail to pass data from logstash to ES](https://discuss.elastic.co/t/fail-to-pass-data-from-logstash-to-es/259424)
**Author:** [@azteker](https://discuss.elastic.co/u/azteker)\ **Replies:** 1\ **Last updated:** [December 22, 2020, 11:59pm UTC](https://discuss.elastic.co/t/fail-to-pass-data-from-logstash-to-es/259424 "2020-12-22T23:59:29Z")
The output conf in the logstash conf file is output { elasticsearch { hosts =\> \["10.28.1.17:9200"\] index =\> "event-%{+YYYY.MM.dd}" } } I run the logstash in CLI with output as stdout {codec =\> rubyd… --- ## [Help creating a bar chart using split series percentages](https://discuss.elastic.co/t/help-creating-a-bar-chart-using-split-series-percentages/259400)
**Author:** [@brookeharrislowing](https://discuss.elastic.co/u/brookeharrislowing)\ **Replies:** 2\ **Last updated:** [December 22, 2020, 11:29pm UTC](https://discuss.elastic.co/t/help-creating-a-bar-chart-using-split-series-percentages/259400 "2020-12-22T23:29:44Z")
Hi there, I am trying to make a bar graph that is split by region, showing the relevant percentage for each region. However, all of my bars come out at 100% with a legend detailing their actual percentages. I would like… --- ## [Ignore\_malformed fires mapper\_parsing\_exception for keyword type on 7.10.1 (it worked on 7.1.0)](https://discuss.elastic.co/t/ignore-malformed-fires-mapper-parsing-exception-for-keyword-type-on-7-10-1-it-worked-on-7-1-0/259142)
**Author:** [@DevFullStack](https://discuss.elastic.co/u/DevFullStack)\ **Replies:** 9\ **Last updated:** [December 22, 2020, 11:13pm UTC](https://discuss.elastic.co/t/ignore-malformed-fires-mapper-parsing-exception-for-keyword-type-on-7-10-1-it-worked-on-7-1-0/259142 "2020-12-22T23:13:04Z")
This may be a breaking change in v.7.4+ that apparently was not documented. Any thoughts on how to solve this issue with an upgrade on a logs analysis use case? The docs about the ignore\_malformed mapping parameter hav… --- ## [How can I remove the color bar from Top N?](https://discuss.elastic.co/t/how-can-i-remove-the-color-bar-from-top-n/259308)
**Author:** [@larrya](https://discuss.elastic.co/u/larrya)\ **Replies:** 3\ **Last updated:** [December 22, 2020, 11:11pm UTC](https://discuss.elastic.co/t/how-can-i-remove-the-color-bar-from-top-n/259308 "2020-12-22T23:11:30Z")
I am using TSVB on Kibana 7.4.2 to show a list of tests and their pass rate using Filter Ratio. Using Top N this list displays the test name, color bar, and pass rate, sorted by pass rate. The names of the tests are trun… --- ## [Logstash doesn't remove proceed gz files](https://discuss.elastic.co/t/logstash-doesnt-remove-proceed-gz-files/259347)
**Author:** [@snowline](https://discuss.elastic.co/u/snowline)\ **Replies:** 4\ **Last updated:** [December 22, 2020, 9:46pm UTC](https://discuss.elastic.co/t/logstash-doesnt-remove-proceed-gz-files/259347 "2020-12-22T21:46:11Z")
I've setup logstash as file reader for \*.gz log files in "read" mode. These files are copied from remote server to local folders every 15 minutes under user logstash. Files and folders have owner "logstash" and mode - … --- ## [Dec 20th, 2020: \[RU\] Разведочный анализ данных с Kibana](https://discuss.elastic.co/t/dec-20th-2020-ru-kibana/258244)
**Author:** [@raya](https://discuss.elastic.co/u/raya)\ **Replies:** 0\ **Last updated:** [December 20, 2020, 8:00am UTC](https://discuss.elastic.co/t/dec-20th-2020-ru-kibana/258244 "2020-12-20T08:00:19Z")
English version Специалисты в области визуализации данных часто говорят о двух типах визуализаций: разведочных и объяснительных. В Википедии разведочные визуализации описаны как “анализ основных свойств данных, нахожден… --- ## [\[Ingest Node\] pipeline with id \[x\] does not exist (solved)](https://discuss.elastic.co/t/ingest-node-pipeline-with-id-x-does-not-exist-solved/54436)
**Author:** [@PatrickKik](https://discuss.elastic.co/u/PatrickKik)\ **Replies:** 13\ **Last updated:** [December 22, 2020, 8:10pm UTC](https://discuss.elastic.co/t/ingest-node-pipeline-with-id-x-does-not-exist-solved/54436 "2020-12-22T20:10:32Z")
SOLVED Just minutes before the release of 5.0.0-alpha4 I found this bug. I tried it in \`5.0.0-alpha4' and it works fine. That's nice. But it still feels like I have lost some time... :weary: I'm using elasticsearch-5.… --- ## [When a JDBC input start, drops the previous if not completed?](https://discuss.elastic.co/t/when-a-jdbc-input-start-drops-the-previous-if-not-completed/259416)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 3\ **Last updated:** [December 22, 2020, 8:01pm UTC](https://discuss.elastic.co/t/when-a-jdbc-input-start-drops-the-previous-if-not-completed/259416 "2020-12-22T20:01:31Z")
Lets say I got to index data from a week ago, and I use a schedule of 5 minutes in JDB input, and the data of a week cant be indexed in those 5 minutes, the data ingestion will be stopped at five minutes, and start agai… --- ## [Installing all of the Rules from GitHub](https://discuss.elastic.co/t/installing-all-of-the-rules-from-github/259304)
**Author:** [@AirJordan](https://discuss.elastic.co/u/AirJordan)\ **Replies:** 2\ **Last updated:** [December 22, 2020, 7:25pm UTC](https://discuss.elastic.co/t/installing-all-of-the-rules-from-github/259304 "2020-12-22T19:25:41Z")
I see there is a https://github.com/elastic/detection-rules. It seems like when I installed Endpoint Security and did generate rules it created a lot of the rules. Yeah some are still missing. Is there a way to get the l… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1102) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1104)