# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1132 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1133 --- ## [How to use the result of two buckets count divison in alerts?](https://discuss.elastic.co/t/how-to-use-the-result-of-two-buckets-count-divison-in-alerts/257109)
**Author:** [@I\_Hathout](https://discuss.elastic.co/u/I_Hathout)\ **Replies:** 0\ **Last updated:** [November 30, 2020, 6:03pm UTC](https://discuss.elastic.co/t/how-to-use-the-result-of-two-buckets-count-divison-in-alerts/257109 "2020-11-30T18:03:18Z")
I 've a filter that contains data from two indices payment\_transfer and payment\_transfer\_failure. I want to set an alert of the number of transfer\_failure\_count in a month/ number of transfers whiten the same month is ab… --- ## [Change section type?](https://discuss.elastic.co/t/change-section-type/256570)
**Author:** [@Matias\_Gerstner](https://discuss.elastic.co/u/Matias_Gerstner)\ **Replies:** 5\ **Last updated:** [November 30, 2020, 7:37pm UTC](https://discuss.elastic.co/t/change-section-type/256570 "2020-11-30T19:37:45Z")
Hello, my English is not very good, but I want to ask you a question, to see if it is possible what I am trying to do or not. I need to change the NAME of the "type" section, in several indices already created and wit… --- ## [Filter individual json fields using json filters](https://discuss.elastic.co/t/filter-individual-json-fields-using-json-filters/257028)
**Author:** [@naveenrt23](https://discuss.elastic.co/u/naveenrt23)\ **Replies:** 16\ **Last updated:** [November 30, 2020, 7:34pm UTC](https://discuss.elastic.co/t/filter-individual-json-fields-using-json-filters/257028 "2020-11-30T19:34:20Z")
I'm trying to parse my message into json fields using Json filters but running into issues Error: Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::Configurati… --- ## [Can we override the way data gets stored in elasticsearch](https://discuss.elastic.co/t/can-we-override-the-way-data-gets-stored-in-elasticsearch/257106)
**Author:** [@Vivek\_Sagar](https://discuss.elastic.co/u/Vivek_Sagar)\ **Replies:** 4\ **Last updated:** [November 30, 2020, 7:27pm UTC](https://discuss.elastic.co/t/can-we-override-the-way-data-gets-stored-in-elasticsearch/257106 "2020-11-30T19:27:20Z")
Is there a way to override how the data is stored in elasticsearch? I want to encrypt the data just before elasticsearch writes it to file system and just before sending the search query to file-system send the encrypted… --- ## [Close Index Api warning in ES version 6.8](https://discuss.elastic.co/t/close-index-api-warning-in-es-version-6-8/256662)
**Author:** [@mrudrego](https://discuss.elastic.co/u/mrudrego)\ **Replies:** 5\ **Last updated:** [November 30, 2020, 7:24pm UTC](https://discuss.elastic.co/t/close-index-api-warning-in-es-version-6-8/256662 "2020-11-30T19:24:29Z")
Hi, There is a warning in Elasticsearch 6.8 version document about Close index api which states To reduce the risk of data loss, avoid keeping closed indices in your cluster for long periods of time. When a node leave… --- ## [Use existing elastic search persistence disk](https://discuss.elastic.co/t/use-existing-elastic-search-persistence-disk/257118)
**Author:** [@rajkumar\_25](https://discuss.elastic.co/u/rajkumar_25)\ **Replies:** 0\ **Last updated:** [November 30, 2020, 7:17pm UTC](https://discuss.elastic.co/t/use-existing-elastic-search-persistence-disk/257118 "2020-11-30T19:17:12Z")
I am facing "cluster\_uuid": "na", an issue in my GKE deployed elastic search. I haven’t taken any snapshots. But the persistence disk is still available. Is there is any way to retrieve the data from the existing persis… --- ## [Ensuring uniqueness of IDs across indices during insertion](https://discuss.elastic.co/t/ensuring-uniqueness-of-ids-across-indices-during-insertion/257113)
**Author:** [@jmaharjan](https://discuss.elastic.co/u/jmaharjan)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 6:44pm UTC](https://discuss.elastic.co/t/ensuring-uniqueness-of-ids-across-indices-during-insertion/257113 "2020-11-30T18:44:01Z")
From what I understand, if we assign explicit ids to documents we might end up with multiple documents with the same id in different indices. Is there a way to ensure, when using explicit document ids, that a document id… --- ## [Searching terms in Inverted index](https://discuss.elastic.co/t/searching-terms-in-inverted-index/257111)
**Author:** [@prasad.deshpande](https://discuss.elastic.co/u/prasad.deshpande)\ **Replies:** 0\ **Last updated:** [November 30, 2020, 6:16pm UTC](https://discuss.elastic.co/t/searching-terms-in-inverted-index/257111 "2020-11-30T18:16:06Z")
Is there a way in Elasticsearch in which I can search all the terms in the inverted index? So say, if I want to find all the terms (Not the documents..) starting with au and ending with o. I know that there is a \_termve… --- ## [Strange behavior with date histogram aggregation in a field that is inside a nested object (Elasticsearch 7.10.0)](https://discuss.elastic.co/t/strange-behavior-with-date-histogram-aggregation-in-a-field-that-is-inside-a-nested-object-elasticsearch-7-10-0/256823)
**Author:** [@tberne](https://discuss.elastic.co/u/tberne)\ **Replies:** 7\ **Last updated:** [November 30, 2020, 6:11pm UTC](https://discuss.elastic.co/t/strange-behavior-with-date-histogram-aggregation-in-a-field-that-is-inside-a-nested-object-elasticsearch-7-10-0/256823 "2020-11-30T18:11:54Z")
Hi! I'm in the middle of an upgrade process to the 7.10.0 Elasticsearch (changing the client from TransportClient to JavaRestHighLevelClient also) and I've noticed a strange behavior of Date Histogram Aggregation when i… --- ## [How to get data from large JDBC quires?](https://discuss.elastic.co/t/how-to-get-data-from-large-jdbc-quires/254647)
**Author:** [@I\_Hathout](https://discuss.elastic.co/u/I_Hathout)\ **Replies:** 12\ **Last updated:** [November 30, 2020, 6:04pm UTC](https://discuss.elastic.co/t/how-to-get-data-from-large-jdbc-quires/254647 "2020-11-30T18:04:05Z")
Hello, I am trying to get data from a postgres database using JDBC. I managed to get data to stdout by using only 3 fields, but it fails because of the large number of fields in the query. here is the output from runni… --- ## [Public stock offering?](https://discuss.elastic.co/t/public-stock-offering/257100)
**Author:** [@PremiumLeo](https://discuss.elastic.co/u/PremiumLeo)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 5:42pm UTC](https://discuss.elastic.co/t/public-stock-offering/257100 "2020-11-30T17:42:50Z")
Anyone know if elastic has a publicly traded stock? Thanks --- ## [Dealing with "tags" =\> \[ \[0\] "multiline" \] in xml filter for logstash](https://discuss.elastic.co/t/dealing-with-tags-0-multiline-in-xml-filter-for-logstash/257094)
**Author:** [@amol\_p81](https://discuss.elastic.co/u/amol_p81)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 5:19pm UTC](https://discuss.elastic.co/t/dealing-with-tags-0-multiline-in-xml-filter-for-logstash/257094 "2020-11-30T17:19:22Z")
Hi, I have setup xml filter for logstash (in config file) however how can i avoid below from getting displayed: "tags" =\> \[ \[0\] "multiline" \] Regards Amol --- ## [Logstash aggregate without unique id](https://discuss.elastic.co/t/logstash-aggregate-without-unique-id/257068)
**Author:** [@bbwolf](https://discuss.elastic.co/u/bbwolf)\ **Replies:** 5\ **Last updated:** [November 30, 2020, 5:06pm UTC](https://discuss.elastic.co/t/logstash-aggregate-without-unique-id/257068 "2020-11-30T17:06:17Z")
Hello, supposed il have current log INFO - 12345 - TASK\_START - start INFO - 12345 - SQL - sqlQuery1 - 12 INFO - 12345 - SQL - sqlQuery2 - 34 INFO - 12345 - TASK\_END - end INFO - 12345 - TASK\_START - start INFO - … --- ## [Locating rogue clients with authentication errors](https://discuss.elastic.co/t/locating-rogue-clients-with-authentication-errors/257102)
**Author:** [@franco-martin](https://discuss.elastic.co/u/franco-martin)\ **Replies:** 0\ **Last updated:** [November 30, 2020, 4:51pm UTC](https://discuss.elastic.co/t/locating-rogue-clients-with-authentication-errors/257102 "2020-11-30T16:51:07Z")
Im using filebeat to export elasticsearch logs to well... elasticsearch. I get the authentication errors but not where they come from. I tried changing the log level to TRACE for the rest package but no luck. Is there a… --- ## [Parse logstash - rfc5424](https://discuss.elastic.co/t/parse-logstash-rfc5424/256992)
**Author:** [@Paulogbr](https://discuss.elastic.co/u/Paulogbr)\ **Replies:** 3\ **Last updated:** [November 30, 2020, 4:35pm UTC](https://discuss.elastic.co/t/parse-logstash-rfc5424/256992 "2020-11-30T16:35:25Z")
Hello guys, I need help to parse the syslog RFC 5424 with logstash. \<190\> 1 2020-11-28T14:18:03-02:00 workstantion1030.teste.corp WSEE - - \[message@01-\] @cee:{"type":"1","timestamp":"4698753981054","host\_name":"","user\_… --- ## [Just a question about a siem rule filter](https://discuss.elastic.co/t/just-a-question-about-a-siem-rule-filter/256397)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [November 30, 2020, 3:55pm UTC](https://discuss.elastic.co/t/just-a-question-about-a-siem-rule-filter/256397 "2020-11-30T15:55:27Z")
Hello, Just wondering what's the purpose of the extra info / metadata in the filter of for example: I can't find this info in the SIEM rule when I duplicate it: { "$state": { "store": "appState" },… --- ## [Logstash log unable to complete log read and throws error](https://discuss.elastic.co/t/logstash-log-unable-to-complete-log-read-and-throws-error/256945)
**Author:** [@msk\_76](https://discuss.elastic.co/u/msk_76)\ **Replies:** 4\ **Last updated:** [November 30, 2020, 3:12pm UTC](https://discuss.elastic.co/t/logstash-log-unable-to-complete-log-read-and-throws-error/256945 "2020-11-30T15:12:41Z")
I have setup logstash to read log files generated by another application realtime. The input config is like this. it is throwing the below error in logstash log. I am unable to track if it has been able to read the finis… --- ## [Malicious is reported in the zip file for windows platform](https://discuss.elastic.co/t/malicious-is-reported-in-the-zip-file-for-windows-platform/256707)
**Author:** [@dtln](https://discuss.elastic.co/u/dtln)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 2:56pm UTC](https://discuss.elastic.co/t/malicious-is-reported-in-the-zip-file-for-windows-platform/256707 "2020-11-30T14:56:11Z")
I scan the zip file for windows platform which downloaded from (https://www.elastic.co/guide/en/elasticsearch/reference/current/getting-started-install.html) using virustotal. But it report that it has Malicious in it. … --- ## [Провести поиск по пустому "" значению в массиве документа](https://discuss.elastic.co/t/topic/256646)
**Author:** [@Leleka](https://discuss.elastic.co/u/Leleka)\ **Replies:** 5\ **Last updated:** [November 30, 2020, 3:01pm UTC](https://discuss.elastic.co/t/topic/256646 "2020-11-30T15:01:23Z")
Добрий день У меня есть такая структура данных в базе еластик { "hits": \[ { "\_index": "database", "\_type": "\_doc", "\_id": "1", "\_score": 1.0, "\_source": { "Card\_H… --- ## [Failed to close Detection alert](https://discuss.elastic.co/t/failed-to-close-detection-alert/256407)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 2:53pm UTC](https://discuss.elastic.co/t/failed-to-close-detection-alert/256407 "2020-11-30T14:53:41Z")
Hello, Version 7.9.2 I was trying to clean up / close some old alerts and I get the following error: Known issue? In the Kibana logs I find a 409: Request referrer: https://kiburl:5601/app/security/detections?f… --- ## [Slowness in ES bulk inserts](https://discuss.elastic.co/t/slowness-in-es-bulk-inserts/256886)
**Author:** [@Chirag\_Patwa](https://discuss.elastic.co/u/Chirag_Patwa)\ **Replies:** 10\ **Last updated:** [November 30, 2020, 2:32pm UTC](https://discuss.elastic.co/t/slowness-in-es-bulk-inserts/256886 "2020-11-30T14:32:50Z")
We are running behind the schedule to achieve something and we need help. Please take a look and suggest something. Issue: Slowness on bulk Indexing. For 10000 records its taking 27560 ms For 500 records its taking ab… --- ## [Elasticsearch Shards problem](https://discuss.elastic.co/t/elasticsearch-shards-problem/256998)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 0\ **Last updated:** [November 29, 2020, 5:48pm UTC](https://discuss.elastic.co/t/elasticsearch-shards-problem/256998 "2020-11-29T17:48:55Z")
I have set-up elasticsearch 8 node cluster 3 master 3 data(500gb total 1.5 tb) +2 coordinate nodes each node have 16gb ram and 4 CPUs and it uses only 2 cpu. In client side we have packbeat and winlogbeat pointing to ka… --- ## [ElasticSearch - Sort by another field which is not mentioned in field section aggregation query](https://discuss.elastic.co/t/elasticsearch-sort-by-another-field-which-is-not-mentioned-in-field-section-aggregation-query/257080)
**Author:** [@Mamta\_Shettigar](https://discuss.elastic.co/u/Mamta_Shettigar)\ **Replies:** 0\ **Last updated:** [November 30, 2020, 2:27pm UTC](https://discuss.elastic.co/t/elasticsearch-sort-by-another-field-which-is-not-mentioned-in-field-section-aggregation-query/257080 "2020-11-30T14:27:12Z")
I want to perform aggregation on a certain results and then sort it. While aggregation query works fine. We want to sort the results based on another parameter and not the aggregated field. Say for example I want to aggr… --- ## [Categorizing similar values](https://discuss.elastic.co/t/categorizing-similar-values/257071)
**Author:** [@OmarDacca](https://discuss.elastic.co/u/OmarDacca)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 2:04pm UTC](https://discuss.elastic.co/t/categorizing-similar-values/257071 "2020-11-30T14:04:21Z")
Hi, Is there a way to categorize similar values of specific field, during the query time ? for example, suppose I have these documents: {..., message: "this is message no 1",...} {..., message: "this is message no 2"… --- ## [Http 400 query crashes elastic search cluster](https://discuss.elastic.co/t/http-400-query-crashes-elastic-search-cluster/256228)
**Author:** [@sebastienf](https://discuss.elastic.co/u/sebastienf)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 1:54pm UTC](https://discuss.elastic.co/t/http-400-query-crashes-elastic-search-cluster/256228 "2020-11-30T13:54:37Z")
on a 5.6 ES cluster that i don't administrate, i noticed, when a query gives an error HTTP 400 such as {"error":{"root\_cause":\[{"type":"action\_request\_validation\_exception","reason":"Validation Failed: 1: template is mi… --- ## [Help parse Snort IDS Alert](https://discuss.elastic.co/t/help-parse-snort-ids-alert/256991)
**Author:** [@coolkaveh](https://discuss.elastic.co/u/coolkaveh)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 1:30pm UTC](https://discuss.elastic.co/t/help-parse-snort-ids-alert/256991 "2020-11-30T13:30:27Z")
Please help me to correct my Logstash conf as below: Log: 11/28-06:50:39.263833 \[\*\*\] \[1:31978:5\] OS-OTHER Bash CGI environment variable injection attempt \[\*\*\] \[Classification: Attempted Administrator Privilege Gain\] \[… --- ## [Eliminate Failure that Later Converted in Success in Dashboard](https://discuss.elastic.co/t/eliminate-failure-that-later-converted-in-success-in-dashboard/257051)
**Author:** [@Vaishali19](https://discuss.elastic.co/u/Vaishali19)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 1:24pm UTC](https://discuss.elastic.co/t/eliminate-failure-that-later-converted-in-success-in-dashboard/257051 "2020-11-30T13:24:55Z")
Hi All, I have a requirement to create a dashboard in kibana for SuccessVsFailure for institutions. The single user is identified by token and I want to eliminate failures which later converted into Success on retry. Ho… --- ## [Elasticsearch single node "cluster" fails with "incoming term X does not match current term Y"](https://discuss.elastic.co/t/elasticsearch-single-node-cluster-fails-with-incoming-term-x-does-not-match-current-term-y/256857)
**Author:** [@tobal](https://discuss.elastic.co/u/tobal)\ **Replies:** 6\ **Last updated:** [November 30, 2020, 1:22pm UTC](https://discuss.elastic.co/t/elasticsearch-single-node-cluster-fails-with-incoming-term-x-does-not-match-current-term-y/256857 "2020-11-30T13:22:58Z")
Hi there, We have a recurring error in our test environment, where elasticsearch fails to boot up. We have logs from two occurrence, but sadly we can't reproduce the error consistently to help determine what the problem… --- ## [Elasticesearch 7.6.2 translog overflow issue](https://discuss.elastic.co/t/elasticesearch-7-6-2-translog-overflow-issue/256776)
**Author:** [@rambling](https://discuss.elastic.co/u/rambling)\ **Replies:** 9\ **Last updated:** [November 30, 2020, 1:08pm UTC](https://discuss.elastic.co/t/elasticesearch-7-6-2-translog-overflow-issue/256776 "2020-11-30T13:08:58Z")
Hi, recently I caught very strange behavior of translog in my cluster: I noticed that one node was executing task for 3 days like: "node" : "PAHpy641TPqLYhPOKPnAvQ", "id" : 1336600606, "type" : "trans… --- ## [Kibana Maintainance notification](https://discuss.elastic.co/t/kibana-maintainance-notification/256988)
**Author:** [@PraveenKT](https://discuss.elastic.co/u/PraveenKT)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 12:52pm UTC](https://discuss.elastic.co/t/kibana-maintainance-notification/256988 "2020-11-30T12:52:30Z")
How do I get Maintainance notification on kibana GUI ? [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1131) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1133)