# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1200 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1201 --- ## [Want to fetch last one day filebeat data as CSV format and to store into S3](https://discuss.elastic.co/t/want-to-fetch-last-one-day-filebeat-data-as-csv-format-and-to-store-into-s3/251675)
**Author:** [@Ayush\_Agrahari](https://discuss.elastic.co/u/Ayush_Agrahari)\ **Replies:** 0\ **Last updated:** [October 11, 2020, 10:38am UTC](https://discuss.elastic.co/t/want-to-fetch-last-one-day-filebeat-data-as-csv-format-and-to-store-into-s3/251675 "2020-10-11T10:38:59Z")
We have filebeat running (filebeat -\> logstash -\> Elasticsearch \<- kafka) in ELK Setup. We are looking for some mechanism which store last 1 day data of filebeat-\* index as CSV format into S3 as night cron job. Is there… --- ## [Schedule Understanding - Logstash](https://discuss.elastic.co/t/schedule-understanding-logstash/251666)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 0\ **Last updated:** [October 11, 2020, 6:22am UTC](https://discuss.elastic.co/t/schedule-understanding-logstash/251666 "2020-10-11T06:22:28Z")
Hello I understand , now in input plugin of logstash say for example jdbc one , has schedule option, so that we can schedule it in here itself. I did read documents but did not came across the explanation of condition … --- ## [Too many vCPUs for the underlying hardware?](https://discuss.elastic.co/t/too-many-vcpus-for-the-underlying-hardware/251620)
**Author:** [@djh47](https://discuss.elastic.co/u/djh47)\ **Replies:** 1\ **Last updated:** [October 11, 2020, 12:58am UTC](https://discuss.elastic.co/t/too-many-vcpus-for-the-underlying-hardware/251620 "2020-10-11T00:58:47Z")
I have a 64-core dedicated machine which in order to use, I must allocate a virtualized instance. I have the option to virtualize with anything from 1 to 240 vCPUs. Perhaps naively, I decide to allocate the maximum of 2… --- ## [How to specify proxy url for hearbeat cloud.id](https://discuss.elastic.co/t/how-to-specify-proxy-url-for-hearbeat-cloud-id/251652)
**Author:** [@Porton](https://discuss.elastic.co/u/Porton)\ **Replies:** 1\ **Last updated:** [October 10, 2020, 6:42pm UTC](https://discuss.elastic.co/t/how-to-specify-proxy-url-for-hearbeat-cloud-id/251652 "2020-10-10T18:42:30Z")
Hi, How can proxy url be set so heartbeat can resolve cloud.id ? Heartbeat is currently sitting behind corporate proxy, and unable to connect to elasticsearch cloud. 2020-10-11T02:14:06.182+0800 INFO pipeline/output.g… --- ## [How to update index template](https://discuss.elastic.co/t/how-to-update-index-template/251491)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 4\ **Last updated:** [October 10, 2020, 4:54pm UTC](https://discuss.elastic.co/t/how-to-update-index-template/251491 "2020-10-10T16:54:43Z")
Our cluster have about 170 index templates. I need to update all templates , include the settings: PUT \_template/testovaci { "settings": { "index.routing.allocation.include.data": "hot" } } but this syntax doe… --- ## [Logstash shut down immediately after starting](https://discuss.elastic.co/t/logstash-shut-down-immediately-after-starting/251642)
**Author:** [@emaravi](https://discuss.elastic.co/u/emaravi)\ **Replies:** 1\ **Last updated:** [October 10, 2020, 1:48pm UTC](https://discuss.elastic.co/t/logstash-shut-down-immediately-after-starting/251642 "2020-10-10T13:48:17Z")
\[2020-10-10T05:30:55,854\]\[WARN \]\[logstash.config.source.multilocal\] Ignoring the 'pipelines.yml' file because modules or command line options are specified \[2020-10-10T05:30:57,935\]\[INFO \]\[org.reflections.Reflections\] R… --- ## [Need help with aggregation query](https://discuss.elastic.co/t/need-help-with-aggregation-query/251640)
**Author:** [@prabhakar\_talari](https://discuss.elastic.co/u/prabhakar_talari)\ **Replies:** 0\ **Last updated:** [October 10, 2020, 10:22am UTC](https://discuss.elastic.co/t/need-help-with-aggregation-query/251640 "2020-10-10T10:22:30Z")
Hi All, I am trying to write a query to get host and max cpu usage from metric beat data but i was not able to write exact query to get max cpu along with host name. for example below is the data "hostname:"hos… --- ## [DIfference between grok and dissect?](https://discuss.elastic.co/t/difference-between-grok-and-dissect/251634)
**Author:** [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\ **Replies:** 0\ **Last updated:** [October 10, 2020, 9:15am UTC](https://discuss.elastic.co/t/difference-between-grok-and-dissect/251634 "2020-10-10T09:15:30Z")
i've .net core application with use of nlog i created logs. for parsing logs to logstash which is more useful and proper filter grok filter or dissect filter --- ## [Getting “master not discovered or elected yet” causing cluster not up in version 7.9.1](https://discuss.elastic.co/t/getting-master-not-discovered-or-elected-yet-causing-cluster-not-up-in-version-7-9-1/250269)
**Author:** [@Jinlian\_Chen](https://discuss.elastic.co/u/Jinlian_Chen)\ **Replies:** 20\ **Last updated:** [October 10, 2020, 8:43am UTC](https://discuss.elastic.co/t/getting-master-not-discovered-or-elected-yet-causing-cluster-not-up-in-version-7-9-1/250269 "2020-10-10T08:43:35Z")
Hi, I am building a 5 nodes cluster using k8s, 3 master nodes, and 2 data nodes. When restart 3 masters orderly, got error "master not discovered or elected yet", the cluster can't work. This situation last several hours… --- ## [Grok can't create optional fields](https://discuss.elastic.co/t/grok-cant-create-optional-fields/251631)
**Author:** [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\ **Replies:** 0\ **Last updated:** [October 10, 2020, 7:20am UTC](https://discuss.elastic.co/t/grok-cant-create-optional-fields/251631 "2020-10-10T07:20:41Z")
I'm trying to parse logs in logstash with use of grok. In error log there are two more optional fields like requestUrl and requestMethod. but when i use grok for parsing logs to logstash.these from the error log grok can… --- ## [How to change handeld=True in apm errors。](https://discuss.elastic.co/t/how-to-change-handeld-true-in-apm-errors/251544)
**Author:** [@111395](https://discuss.elastic.co/u/111395)\ **Replies:** 0\ **Last updated:** [October 9, 2020, 8:44am UTC](https://discuss.elastic.co/t/how-to-change-handeld-true-in-apm-errors/251544 "2020-10-09T08:44:33Z")
(topic withdrawn by author, will be automatically deleted in 24 hours unless flagged) --- ## [How can I download the search, visualization, dashboard object names](https://discuss.elastic.co/t/how-can-i-download-the-search-visualization-dashboard-object-names/251614)
**Author:** [@rajkumar.m](https://discuss.elastic.co/u/rajkumar.m)\ **Replies:** 2\ **Last updated:** [October 9, 2020, 10:51pm UTC](https://discuss.elastic.co/t/how-can-i-download-the-search-visualization-dashboard-object-names/251614 "2020-10-09T22:51:15Z")
Hi Team, I would like to download the search, visualization, dashboard object names from kibana by using API calls. I could not find any specific api for this requirement. someone please help on this. Thanks --- ## [How to use server side pagination in kibana's data table?](https://discuss.elastic.co/t/how-to-use-server-side-pagination-in-kibanas-data-table/251600)
**Author:** [@WhatsIsKibana](https://discuss.elastic.co/u/WhatsIsKibana)\ **Replies:** 1\ **Last updated:** [October 9, 2020, 10:05pm UTC](https://discuss.elastic.co/t/how-to-use-server-side-pagination-in-kibanas-data-table/251600 "2020-10-09T22:05:54Z")
Hello there, I'm using elasticsearch and kibana 6.8. I use native kibana plugin for visualizations which is called "Data Table". It works fine with small count of rows, but when I get 1000 or 2000 rows, it renders about… --- ## [Duplicated lines when parsing rabbitmq logs§](https://discuss.elastic.co/t/duplicated-lines-when-parsing-rabbitmq-logs/251613)
**Author:** [@Hamish1](https://discuss.elastic.co/u/Hamish1)\ **Replies:** 2\ **Last updated:** [October 9, 2020, 9:37pm UTC](https://discuss.elastic.co/t/duplicated-lines-when-parsing-rabbitmq-logs/251613 "2020-10-09T21:37:52Z")
Good day everyone! We're using RabbitMQ version 3.6.10 and it has a weird log format: closing AMQP connection \<0.28817.3524\> (HIDEN:50790 -\> HIDEN:5672, vhost: '/', user: 'HIDEN') =INFO REPORT==== 9-Oct-2020::22:41:24… --- ## [Logstash :: What Would a NULL Returned from an External Program Mean?](https://discuss.elastic.co/t/logstash-what-would-a-null-returned-from-an-external-program-mean/251170)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 1\ **Last updated:** [October 9, 2020, 8:58pm UTC](https://discuss.elastic.co/t/logstash-what-would-a-null-returned-from-an-external-program-mean/251170 "2020-10-09T20:58:31Z")
Hi Logstash Gurus, I am using my Logstash filter{} configuration to use Ruby to “bounce” all my LS records off an external C program via a TCP socket. The C program accepts every record, does some processing, and then … --- ## [Unable to create raw field in index template in elk6](https://discuss.elastic.co/t/unable-to-create-raw-field-in-index-template-in-elk6/250703)
**Author:** [@rajkumar.m](https://discuss.elastic.co/u/rajkumar.m)\ **Replies:** 2\ **Last updated:** [October 9, 2020, 8:50pm UTC](https://discuss.elastic.co/t/unable-to-create-raw-field-in-index-template-in-elk6/250703 "2020-10-09T20:50:31Z")
\# vi XXXX.json { "template" : "XXXXX\*", "settings" : { "index" : { "number\_of\_shards" : "2", "number\_of\_replicas" : "1", "refresh\_interval" : "5s" } }, "mappings": { … --- ## [In Kibana 7.8.0, my legacy plugin isn't working on Canvas page](https://discuss.elastic.co/t/in-kibana-7-8-0-my-legacy-plugin-isnt-working-on-canvas-page/250384)
**Author:** [@Rhonda\_Gregory](https://discuss.elastic.co/u/Rhonda_Gregory)\ **Replies:** 4\ **Last updated:** [October 9, 2020, 8:01pm UTC](https://discuss.elastic.co/t/in-kibana-7-8-0-my-legacy-plugin-isnt-working-on-canvas-page/250384 "2020-10-09T20:01:34Z")
I realize the legacy plugins are being deprecated and I should move to the new framework but due to time constraints I want to hold off on refactoring my plugins until I move beyond 7.8.0 I'm having one issue with my pl… --- ## [Reindexing Elasticsearch creates a mapping which cannot be searched](https://discuss.elastic.co/t/reindexing-elasticsearch-creates-a-mapping-which-cannot-be-searched/251559)
**Author:** [@Leon\_Roy](https://discuss.elastic.co/u/Leon_Roy)\ **Replies:** 3\ **Last updated:** [October 9, 2020, 7:14pm UTC](https://discuss.elastic.co/t/reindexing-elasticsearch-creates-a-mapping-which-cannot-be-searched/251559 "2020-10-09T19:14:00Z")
Bit of an odd one or I'm missing something. We reindexed an AWS Elasticsearch index from old\_index to new\_index but for some reason searches on the new index return no results. The steps we took are: Reindex curl -H … --- ## [Mongo Output document deletion](https://discuss.elastic.co/t/mongo-output-document-deletion/249693)
**Author:** [@arichiardi](https://discuss.elastic.co/u/arichiardi)\ **Replies:** 2\ **Last updated:** [October 9, 2020, 6:08pm UTC](https://discuss.elastic.co/t/mongo-output-document-deletion/249693 "2020-10-09T18:08:42Z")
Hi there, I am learning how to use the MongoDB output pluing and trying to understand how to delete a document in a collection. I was wondering if this is supported. The alternative I can think of is to have a tombsto… --- ## [Kibana v7.0.1 Infrastructure App Configurability](https://discuss.elastic.co/t/kibana-v7-0-1-infrastructure-app-configurability/251540)
**Author:** [@Porton](https://discuss.elastic.co/u/Porton)\ **Replies:** 1\ **Last updated:** [October 9, 2020, 6:05pm UTC](https://discuss.elastic.co/t/kibana-v7-0-1-infrastructure-app-configurability/251540 "2020-10-09T18:05:25Z")
Hi, How can one modify what gets displayed in Kibana v7.0.1 Infrastructure App ? Want to see used disk space pct metrics, which exist in the index. Currently can only see CPU, Load, Memory Usage, Network. From quick r… --- ## [Elasticsearch xpack security using basic license](https://discuss.elastic.co/t/elasticsearch-xpack-security-using-basic-license/251594)
**Author:** [@ksaha](https://discuss.elastic.co/u/ksaha)\ **Replies:** 6\ **Last updated:** [October 9, 2020, 5:27pm UTC](https://discuss.elastic.co/t/elasticsearch-xpack-security-using-basic-license/251594 "2020-10-09T17:27:04Z")
Hi Team, Can we use Elasticsearch xpack security for multinode Elasticsearch cluster using Basic License? Thanks --- ## [Cannot read Cloudtrail logs using s3-sns-sqs plugin. Uncompleted message at the end of poller loop](https://discuss.elastic.co/t/cannot-read-cloudtrail-logs-using-s3-sns-sqs-plugin-uncompleted-message-at-the-end-of-poller-loop/251603)
**Author:** [@wpitt13](https://discuss.elastic.co/u/wpitt13)\ **Replies:** 0\ **Last updated:** [October 9, 2020, 5:11pm UTC](https://discuss.elastic.co/t/cannot-read-cloudtrail-logs-using-s3-sns-sqs-plugin-uncompleted-message-at-the-end-of-poller-loop/251603 "2020-10-09T17:11:58Z")
When I try to ingest logs using the s3snssqs input, I see no events output but no errors either. If I enable DEBUG logs, I see an "Inside Preprocess" message followed by a "Payload in Preprocess" message and then the fol… --- ## [Parent child not working consistently](https://discuss.elastic.co/t/parent-child-not-working-consistently/251044)
**Author:** [@askids](https://discuss.elastic.co/u/askids)\ **Replies:** 1\ **Last updated:** [October 9, 2020, 7:03am UTC](https://discuss.elastic.co/t/parent-child-not-working-consistently/251044 "2020-10-09T07:03:42Z")
hi All, We have been using parent child structure since v5 and migrated to v7.2 earlier in Jan and now upgrading to 7.8.1. After moving to v7.2, we have been seeing inconsistency when using parent-child relationship. W… --- ## [Would a node failure take down the cluster?](https://discuss.elastic.co/t/would-a-node-failure-take-down-the-cluster/251513)
**Author:** [@Jtomage](https://discuss.elastic.co/u/Jtomage)\ **Replies:** 2\ **Last updated:** [October 9, 2020, 3:57pm UTC](https://discuss.elastic.co/t/would-a-node-failure-take-down-the-cluster/251513 "2020-10-09T15:57:33Z")
Trying to troubleshoot why a 3 Node Master-data cluster would go down. Mainly looking for direction on where to look for issues and any possible solutions Currently running version 7.0.1 Indices - 19 Max Memory - 38.8… --- ## [Percolator not matching queries it should, reindex the query fixes the problem](https://discuss.elastic.co/t/percolator-not-matching-queries-it-should-reindex-the-query-fixes-the-problem/251586)
**Author:** [@jacob.holmes](https://discuss.elastic.co/u/jacob.holmes)\ **Replies:** 0\ **Last updated:** [October 9, 2020, 3:18pm UTC](https://discuss.elastic.co/t/percolator-not-matching-queries-it-should-reindex-the-query-fixes-the-problem/251586 "2020-10-09T15:18:48Z")
Hello, My team recently launched an application that uses Percolate. We are running ES 6.4 in AWS and are seeing a very strange issue where percolate is not matching queries that it should match. Those queries exist in… --- ## [How to grant access for specefic data in elastic cluster](https://discuss.elastic.co/t/how-to-grant-access-for-specefic-data-in-elastic-cluster/251575)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 4\ **Last updated:** [October 9, 2020, 3:04pm UTC](https://discuss.elastic.co/t/how-to-grant-access-for-specefic-data-in-elastic-cluster/251575 "2020-10-09T15:04:57Z")
Hello everybody, let's suppose I have 2 machines where I run the same agent (packetbeat for example), how can I do to create 2 users where each user can only access data that has been created from one machine ? so user… --- ## [Elasticsearch synonym\_graph filter not giving all tokens](https://discuss.elastic.co/t/elasticsearch-synonym-graph-filter-not-giving-all-tokens/251583)
**Author:** [@Dhiru9895](https://discuss.elastic.co/u/Dhiru9895)\ **Replies:** 0\ **Last updated:** [October 9, 2020, 2:59pm UTC](https://discuss.elastic.co/t/elasticsearch-synonym-graph-filter-not-giving-all-tokens/251583 "2020-10-09T14:59:29Z")
I'm trying to use synonym\_graph filter in the analyzer but it is not generating the result we need. This is my curl command to analyze text: curl -X GET "localhost:9200/\_analyze?pretty" -H 'Content-Type: application/js… --- ## [Logstash consuming Kafka Topic but don't output document](https://discuss.elastic.co/t/logstash-consuming-kafka-topic-but-dont-output-document/251026)
**Author:** [@Coyz](https://discuss.elastic.co/u/Coyz)\ **Replies:** 3\ **Last updated:** [October 9, 2020, 2:32pm UTC](https://discuss.elastic.co/t/logstash-consuming-kafka-topic-but-dont-output-document/251026 "2020-10-09T14:32:53Z")
Hello, I'm trying to get the stack working with Filebeat =\> Kafka \<= Logstash =\> Elasticsearch Sometimes the configuration is working but sometimes logstash is consuming the kafka topic but not sending the document to… --- ## [Scientific Notation Auto Rounding](https://discuss.elastic.co/t/scientific-notation-auto-rounding/251496)
**Author:** [@Jim\_Thunder](https://discuss.elastic.co/u/Jim_Thunder)\ **Replies:** 4\ **Last updated:** [October 9, 2020, 2:04pm UTC](https://discuss.elastic.co/t/scientific-notation-auto-rounding/251496 "2020-10-09T14:04:21Z")
I am using ruby and BigDecmial to convert a scientific notation number to decimal, but it's automatically getting rouded to the nearest thousandth. How can I prevent this? I want the full number or at least n^-6 not n^-3… --- ## [Questions regardings ports and network flows](https://discuss.elastic.co/t/questions-regardings-ports-and-network-flows/251440)
**Author:** [@Juicy45](https://discuss.elastic.co/u/Juicy45)\ **Replies:** 2\ **Last updated:** [October 9, 2020, 1:58pm UTC](https://discuss.elastic.co/t/questions-regardings-ports-and-network-flows/251440 "2020-10-09T13:58:48Z")
Hi, I have some questions regardings the network flows and ports. I already know that elasticsearch is using 9200 and 9300 ports. 9200 for the requests 9300 for the communication between nodes Which port is using el… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1199) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1201)