# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1230 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1231 --- ## [Best web cache](https://discuss.elastic.co/t/best-web-cache/249206)
**Author:** [@highlandspring](https://discuss.elastic.co/u/highlandspring)\ **Replies:** 4\ **Last updated:** [September 19, 2020, 9:06am UTC](https://discuss.elastic.co/t/best-web-cache/249206 "2020-09-19T09:06:09Z")
I am working on a Business Intelligence projects, it has a large number of records, 4.6 million companies and 80 million directors. Currently I am replacing the full text queries with Elastic Search ones. Once this is … --- ## [Can logstash add array field to elasticsearch?](https://discuss.elastic.co/t/can-logstash-add-array-field-to-elasticsearch/249202)
**Author:** [@recordable542](https://discuss.elastic.co/u/recordable542)\ **Replies:** 0\ **Last updated:** [September 19, 2020, 7:09am UTC](https://discuss.elastic.co/t/can-logstash-add-array-field-to-elasticsearch/249202 "2020-09-19T07:09:58Z")
My Environment mysql logstash (with jdbc plugin) 7.8.0 elasticsearch 7.6.2 pipeline.yaml ... statement =\> "SELECT id, name, location1, location2 FROM users;" ... I have location1 and location2 column in mysql users ta… --- ## [S3 input plugin is not reading AWS-KMS (CMK) encrypted bucket](https://discuss.elastic.co/t/s3-input-plugin-is-not-reading-aws-kms-cmk-encrypted-bucket/249199)
**Author:** [@deepanshumarwah](https://discuss.elastic.co/u/deepanshumarwah)\ **Replies:** 0\ **Last updated:** [September 19, 2020, 6:38am UTC](https://discuss.elastic.co/t/s3-input-plugin-is-not-reading-aws-kms-cmk-encrypted-bucket/249199 "2020-09-19T06:38:18Z")
Hi All I am running a logstash container with s3 pipeline as per below configuration: input { s3 { id =\> "pipeline\_s3\_example\_bucket\_input" bucket =\> "example-bucket" region =\> "ap-southeast-1" access… --- ## [What is better. Monthly Indices or 1 Index with more shards?](https://discuss.elastic.co/t/what-is-better-monthly-indices-or-1-index-with-more-shards/248982)
**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\ **Replies:** 4\ **Last updated:** [September 19, 2020, 6:09am UTC](https://discuss.elastic.co/t/what-is-better-monthly-indices-or-1-index-with-more-shards/248982 "2020-09-19T06:09:07Z")
Hi, we are currently planning a cluster which takes about 1TB/year worth of data. When using a standard shard size of 5 this would mean that the shards are 250GB. As far as I know shards should only be around 50-70GB at… --- ## [SIEM Hosts/All Hosts Tables Empty](https://discuss.elastic.co/t/siem-hosts-all-hosts-tables-empty/248965)
**Author:** [@Dan\_Sputnikk](https://discuss.elastic.co/u/Dan_Sputnikk)\ **Replies:** 2\ **Last updated:** [September 19, 2020, 4:07am UTC](https://discuss.elastic.co/t/siem-hosts-all-hosts-tables-empty/248965 "2020-09-19T04:07:00Z")
Hi all, Configured filebeat 7.9 against ES/Kibana 7.9 and the netflow + cisco modules successfully and without errors, including during template generation. http s://www.elastic.co/guide/en/beats/filebeat/7.9/filebeat-… --- ## [Index and query at the same time speed loss](https://discuss.elastic.co/t/index-and-query-at-the-same-time-speed-loss/249191)
**Author:** [@Sayon\_Bhattacharjee](https://discuss.elastic.co/u/Sayon_Bhattacharjee)\ **Replies:** 1\ **Last updated:** [September 19, 2020, 3:22am UTC](https://discuss.elastic.co/t/index-and-query-at-the-same-time-speed-loss/249191 "2020-09-19T03:22:15Z")
I currently have an Elasticsearch index which is receiving 1 document/second (possible that will increase but not over 10/second). However, this index may get queried hundreds of times a second. My question is whether c… --- ## [\_update\_by\_query throws null\_pointer\_exception](https://discuss.elastic.co/t/update-by-query-throws-null-pointer-exception/248574)
**Author:** [@Rui\_Goncalves](https://discuss.elastic.co/u/Rui_Goncalves)\ **Replies:** 2\ **Last updated:** [September 19, 2020, 12:52am UTC](https://discuss.elastic.co/t/update-by-query-throws-null-pointer-exception/248574 "2020-09-19T00:52:44Z")
I've created an index, and I'm trying to add one field. using this script: POST test\_kris\_assignment/\_update\_by\_query { "script": { "source": "ctx.\_source.field1.field2\_1 =10", "lang": "painless" }, "query": { "m… --- ## [Visualization Type Lens not present in Kibana 7.9 on windows](https://discuss.elastic.co/t/visualization-type-lens-not-present-in-kibana-7-9-on-windows/249187)
**Author:** [@Puttappaiahm](https://discuss.elastic.co/u/Puttappaiahm)\ **Replies:** 1\ **Last updated:** [September 18, 2020, 11:58pm UTC](https://discuss.elastic.co/t/visualization-type-lens-not-present-in-kibana-7-9-on-windows/249187 "2020-09-18T23:58:16Z")
I have installed ELK on windows. Under Kibana Visualizations I do not see the type 'Lens', I see all other types Area, Bar etc.. ANy suggestions on How to enable Lens? Thanks --- ## [I have problem with the logstash configuration](https://discuss.elastic.co/t/i-have-problem-with-the-logstash-configuration/249189)
**Author:** [@Pablo\_Rivadeneira](https://discuss.elastic.co/u/Pablo_Rivadeneira)\ **Replies:** 0\ **Last updated:** [September 18, 2020, 11:43pm UTC](https://discuss.elastic.co/t/i-have-problem-with-the-logstash-configuration/249189 "2020-09-18T23:43:46Z")
this is my configuration file input { file { path =\> \["C:/Users/user03/Documents/sistema\_TPG/88.-Elasticsearch/testlog.log"\] start\_position =\> "beginning" sincedb\_path =\> "C:/logstash/logstash/sincedb/logdbpath.txt" … --- ## [Processing data from logstash to elastic](https://discuss.elastic.co/t/processing-data-from-logstash-to-elastic/249183)
**Author:** [@gr0k](https://discuss.elastic.co/u/gr0k)\ **Replies:** 0\ **Last updated:** [September 18, 2020, 10:17pm UTC](https://discuss.elastic.co/t/processing-data-from-logstash-to-elastic/249183 "2020-09-18T22:17:52Z")
Worked through the RedELK install over the last week which is set to collect logs out of /root/cobaltstrike/logs. I made 1 edit to the teamserver filebeat config to collect logs from /opt/cobaltstrike/logs and it broke t… --- ## [Problem With Date Parse - Suddenly Started Last Night](https://discuss.elastic.co/t/problem-with-date-parse-suddenly-started-last-night/249172)
**Author:** [@dmb](https://discuss.elastic.co/u/dmb)\ **Replies:** 1\ **Last updated:** [September 18, 2020, 9:40pm UTC](https://discuss.elastic.co/t/problem-with-date-parse-suddenly-started-last-night/249172 "2020-09-18T21:40:28Z")
Hi All, Very new to the ELK stack and have set up a server to ingest all my syslogs and firewall logs. Up until last night at exactly 6:59 PM all my syslogs were being ingested and the date field was being parsed out, … --- ## [I can't cancel task API enrich \_execute](https://discuss.elastic.co/t/i-cant-cancel-task-api-enrich-execute/248681)
**Author:** [@Tornis](https://discuss.elastic.co/u/Tornis)\ **Replies:** 1\ **Last updated:** [September 18, 2020, 9:36pm UTC](https://discuss.elastic.co/t/i-cant-cancel-task-api-enrich-execute/248681 "2020-09-18T21:36:31Z")
Hello guys! I have a problem and I believe it could be a bug! I created an enrichment policy pointing to an alias with 3 indexes. I started the API "\_enrich / policy/checa-fone/\_execute" and the following error is pres… --- ## [Using the date plugin to replace the value of @timestamp](https://discuss.elastic.co/t/using-the-date-plugin-to-replace-the-value-of-timestamp/249094)
**Author:** [@goncalobsantos](https://discuss.elastic.co/u/goncalobsantos)\ **Replies:** 1\ **Last updated:** [September 18, 2020, 7:36pm UTC](https://discuss.elastic.co/t/using-the-date-plugin-to-replace-the-value-of-timestamp/249094 "2020-09-18T19:36:04Z")
I am trying to write a .conf file to automatically build monthly indexes. I've read that Logstash uses @timestamp to identify the month of a document and that this field is in UTC by default. I'm in a timezone differe… --- ## [Hide some of "available fields" in Kibana Discover](https://discuss.elastic.co/t/hide-some-of-available-fields-in-kibana-discover/249088)
**Author:** [@a1tus](https://discuss.elastic.co/u/a1tus)\ **Replies:** 4\ **Last updated:** [September 18, 2020, 7:35pm UTC](https://discuss.elastic.co/t/hide-some-of-available-fields-in-kibana-discover/249088 "2020-09-18T19:35:21Z")
Hello. We've structured our logs so that we have only a few indexed and searchable fields and all the rest goes into "extra" field that is not indexed and can't be searched (so we put there arbitrary keys and values tha… --- ## [Issue Vega to plot timeseries data in longer time range](https://discuss.elastic.co/t/issue-vega-to-plot-timeseries-data-in-longer-time-range/249067)
**Author:** [@f2020](https://discuss.elastic.co/u/f2020)\ **Replies:** 1\ **Last updated:** [September 18, 2020, 5:23pm UTC](https://discuss.elastic.co/t/issue-vega-to-plot-timeseries-data-in-longer-time-range/249067 "2020-09-18T17:23:49Z")
Hi, Currently we are facing an issue when plot the Vega chart in longer time range (1 year) , the recent data not shown. For example: if the time range set to 1 year such as from 9/18/2019 to 9/18/2020. The chart only … --- ## [Run http\_poller only once and terminate logstash](https://discuss.elastic.co/t/run-http-poller-only-once-and-terminate-logstash/249029)
**Author:** [@hamsinihboomi](https://discuss.elastic.co/u/hamsinihboomi)\ **Replies:** 4\ **Last updated:** [September 18, 2020, 5:22pm UTC](https://discuss.elastic.co/t/run-http-poller-only-once-and-terminate-logstash/249029 "2020-09-18T17:22:05Z")
I have an API call to JIRA which should run only once every 4 weeks. I'm using logstash http\_poller to fetch the data from JIRA. The schedule with http\_poller does not allow a complex cron schedule so I was planning on … --- ## [Why query\_string doesn't honor the usual precedence rules?](https://discuss.elastic.co/t/why-query-string-doesnt-honor-the-usual-precedence-rules/248779)
**Author:** [@android.kc](https://discuss.elastic.co/u/android.kc)\ **Replies:** 3\ **Last updated:** [September 18, 2020, 4:36pm UTC](https://discuss.elastic.co/t/why-query-string-doesnt-honor-the-usual-precedence-rules/248779 "2020-09-18T16:36:25Z")
Can anyone please explain why I got all different results in the following query\_string queries (all are the same except the parentheses) A OR B AND C (A OR B) AND C A OR (B AND C) The index only has the thre… --- ## [Must\_exist](https://discuss.elastic.co/t/must-exist/249009)
**Author:** [@rihad](https://discuss.elastic.co/u/rihad)\ **Replies:** 5\ **Last updated:** [September 18, 2020, 4:26pm UTC](https://discuss.elastic.co/t/must-exist/249009 "2020-09-18T16:26:05Z")
Hi there! How do I use the must\_exist alias attribute that appeared in version 7.9? This is what I try: curl -sS -X POST http://localhost:9200/\_aliases?timeout=15m&master\_timeout=15m -H Content-Type: application/js… --- ## [Не отображаются dns-логи в Kibana](https://discuss.elastic.co/t/dns-kibana/248941)
**Author:** [@Boris\_Voytik](https://discuss.elastic.co/u/Boris_Voytik)\ **Replies:** 13\ **Last updated:** [September 18, 2020, 4:08pm UTC](https://discuss.elastic.co/t/dns-kibana/248941 "2020-09-18T16:08:32Z")
В rsyslog elk-сервера с двух ns-серверов с named (как я понял - bind4) пересылаются логи запросов. Пример логов: Sep 17 11:05:33 central.ns.1 named\[13705\]: 17-Sep-2020 11:05:33.399 client 10.127.0.9#50507 (19.img.avi… --- ## [Creating an index from another index with only certain fields and a different ID than the original index](https://discuss.elastic.co/t/creating-an-index-from-another-index-with-only-certain-fields-and-a-different-id-than-the-original-index/247576)
**Author:** [@edster](https://discuss.elastic.co/u/edster)\ **Replies:** 3\ **Last updated:** [September 18, 2020, 4:02pm UTC](https://discuss.elastic.co/t/creating-an-index-from-another-index-with-only-certain-fields-and-a-different-id-than-the-original-index/247576 "2020-09-18T16:02:25Z")
Is there anyway to create an index from another index but only taking certain fields, not all? The new index would have a new ID as well and include a new alias. I was looking at the reindex API and the clone API as mayb… --- ## [How to create fields dynamically?](https://discuss.elastic.co/t/how-to-create-fields-dynamically/249115)
**Author:** [@11191](https://discuss.elastic.co/u/11191)\ **Replies:** 1\ **Last updated:** [September 18, 2020, 3:14pm UTC](https://discuss.elastic.co/t/how-to-create-fields-dynamically/249115 "2020-09-18T15:14:17Z")
I have a log looking like: \[2020-09-18 12:34 smth1=38 smth2=125 ... \] and I want "smth1" to be a field name and "38" its value, what would be best way to do it considering that "smth1" might be different ea… --- ## [Best practice to search fields not available to most documents](https://discuss.elastic.co/t/best-practice-to-search-fields-not-available-to-most-documents/249040)
**Author:** [@andrew.laraia](https://discuss.elastic.co/u/andrew.laraia)\ **Replies:** 2\ **Last updated:** [September 18, 2020, 3:12pm UTC](https://discuss.elastic.co/t/best-practice-to-search-fields-not-available-to-most-documents/249040 "2020-09-18T15:12:46Z")
I'm new to the ELK stack. So far, so good. I am making progress, We're looking to use on an existing system get some real-time (or at least recent history) of client/user activity to aid in offering the most relevant ser… --- ## [How to implement task life cycle scenario](https://discuss.elastic.co/t/how-to-implement-task-life-cycle-scenario/248128)
**Author:** [@ram546](https://discuss.elastic.co/u/ram546)\ **Replies:** 9\ **Last updated:** [September 18, 2020, 3:09pm UTC](https://discuss.elastic.co/t/how-to-implement-task-life-cycle-scenario/248128 "2020-09-18T15:09:35Z")
hello, I am new to ELK stack and I want to create one scenario where I can track elapsed time. e.g I have a platform where user can CREATE ticket. and that ticket will be assigned to some department/person. then it will … --- ## [\[ERROR\]\[logstash.agent \] Failed to execute action {:id=\>:main, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Could not execute action: PipelineAction::Create\, action\_result: false", :backtrace=\>nil}](https://discuss.elastic.co/t/error-logstash-agent-failed-to-execute-action-id-main-action-type-logstash-failedaction-message-could-not-execute-action-pipelineaction-create-main-action-result-false-backtrace-nil/249057)
**Author:** [@Sayontani\_Bose](https://discuss.elastic.co/u/Sayontani_Bose)\ **Replies:** 1\ **Last updated:** [September 18, 2020, 3:01pm UTC](https://discuss.elastic.co/t/error-logstash-agent-failed-to-execute-action-id-main-action-type-logstash-failedaction-message-could-not-execute-action-pipelineaction-create-main-action-result-false-backtrace-nil/249057 "2020-09-18T15:01:23Z")
Hi I have Installed Logstash and whenever i m trying to run by "bin/logstash --path.settings /etc/logstash -f /etc/logstash/conf.d/01-wazuh.conf --config.reload.automatic I am getting this error - \[ERROR\]\[logstash.age… --- ## [Architecture validation](https://discuss.elastic.co/t/architecture-validation/248940)
**Author:** [@vero](https://discuss.elastic.co/u/vero)\ **Replies:** 3\ **Last updated:** [September 18, 2020, 2:51pm UTC](https://discuss.elastic.co/t/architecture-validation/248940 "2020-09-18T14:51:47Z")
Hi, I'm writing to you, because I need to your help / points of view about the architecture that I choose. In fact, I just started a new project, I'm in preparation architecture stage. Normally, I have, 4 stages: Coll… --- ## [Kibana отображение](https://discuss.elastic.co/t/kibana/248977)
**Author:** [@Ivan\_Bykov](https://discuss.elastic.co/u/Ivan_Bykov)\ **Replies:** 1\ **Last updated:** [September 17, 2020, 3:06pm UTC](https://discuss.elastic.co/t/kibana/248977 "2020-09-17T15:06:56Z")
Как бы избавить от информации в поиске, которая мне не нужна, а именно все что идет после agent:hostname? Это меня пока не интересует и врядли понадобится --- ## [Events Received Rate is climbing high after logstash restart](https://discuss.elastic.co/t/events-received-rate-is-climbing-high-after-logstash-restart/249063)
**Author:** [@Burga](https://discuss.elastic.co/u/Burga)\ **Replies:** 1\ **Last updated:** [September 18, 2020, 10:09am UTC](https://discuss.elastic.co/t/events-received-rate-is-climbing-high-after-logstash-restart/249063 "2020-09-18T10:09:37Z")
Hi , I'm handling with strange behavior , after bouncing logstash Events Received Rate droped to 200 e/s after bounce again it climbed to 1000 e/s what can be the cause ? --- ## [Logstash, how to avoid output block when one elasticsearch node go down](https://discuss.elastic.co/t/logstash-how-to-avoid-output-block-when-one-elasticsearch-node-go-down/247419)
**Author:** [@daniele.lopez](https://discuss.elastic.co/u/daniele.lopez)\ **Replies:** 6\ **Last updated:** [September 18, 2020, 9:54am UTC](https://discuss.elastic.co/t/logstash-how-to-avoid-output-block-when-one-elasticsearch-node-go-down/247419 "2020-09-18T09:54:25Z")
Hi all, I have an elasticsearch cluster with 3 nodes. is a really basic cluster. On each node i have one logstash pointing to cluster nodes. If a node go down all logstash output fail, even if i have the master node u… --- ## [2-node cluster debian](https://discuss.elastic.co/t/2-node-cluster-debian/248834)
**Author:** [@zen.xen](https://discuss.elastic.co/u/zen.xen)\ **Replies:** 4\ **Last updated:** [September 18, 2020, 9:13am UTC](https://discuss.elastic.co/t/2-node-cluster-debian/248834 "2020-09-18T09:13:00Z")
Hello, I try to build 2-node cluster but it doesn't work. I have installed bitnami-elk-7.9.1-0-linux-debian-10-x86\_64-nami.ova , I made two nodes: debian-01: 192.168.11.96, and debian-02: 192.168.11.97 configuration f… --- ## [How does logstash read multiple gunzipped files](https://discuss.elastic.co/t/how-does-logstash-read-multiple-gunzipped-files/249074)
**Author:** [@Praneet\_Khandelwal](https://discuss.elastic.co/u/Praneet_Khandelwal)\ **Replies:** 0\ **Last updated:** [September 18, 2020, 9:07am UTC](https://discuss.elastic.co/t/how-does-logstash-read-multiple-gunzipped-files/249074 "2020-09-18T09:07:48Z")
I have set up a simple logstash pipeline with a single file input (mode= 'read'). I have given a regex pattern in the path attribute. I am trying to read a number of gunzipped files matching the regex in the path. The th… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1229) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1231)