# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1245 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1246 --- ## [Logstash start failed because of Could not load FFI Provider: (NotImplementedError) FFI not available](https://discuss.elastic.co/t/logstash-start-failed-because-of-could-not-load-ffi-provider-notimplementederror-ffi-not-available/247970)
**Author:** [@qiuwenhui1](https://discuss.elastic.co/u/qiuwenhui1)\ **Replies:** 0\ **Last updated:** [September 9, 2020, 7:47am UTC](https://discuss.elastic.co/t/logstash-start-failed-because-of-could-not-load-ffi-provider-notimplementederror-ffi-not-available/247970 "2020-09-09T07:47:31Z")
java.lang.IllegalStateException: Logstash stopped processing because of an error: (LoadError) Could not load FFI Provider: (NotImplementedError) FFI not available: java.lang.ClassCastException: java.nio.HeapByteBuffer ca… --- ## [Cluster Filtering is not showing any results](https://discuss.elastic.co/t/cluster-filtering-is-not-showing-any-results/247919)
**Author:** [@Shubhangi](https://discuss.elastic.co/u/Shubhangi)\ **Replies:** 2\ **Last updated:** [September 9, 2020, 7:47am UTC](https://discuss.elastic.co/t/cluster-filtering-is-not-showing-any-results/247919 "2020-09-09T07:47:25Z")
Hi, I'm using Elastic Stack 7.8. I wanted to decommission a node, in order to do that i used the following command: PUT \_cluster/settings { "transient" : { "cluster.routing.allocation.exclude.\_ip" : "1.2.3.4" }… --- ## [Failed to parse the query in Kibana](https://discuss.elastic.co/t/failed-to-parse-the-query-in-kibana/247354)
**Author:** [@ankitsingh](https://discuss.elastic.co/u/ankitsingh)\ **Replies:** 1\ **Last updated:** [September 9, 2020, 7:28am UTC](https://discuss.elastic.co/t/failed-to-parse-the-query-in-kibana/247354 "2020-09-09T07:28:31Z")
Hi , I have this kind of data: message: "message": "2020-09-02 08:11:55.000000000 +0000 state-handler: {"date":"2020-09-02T08:11:55.863Z","nfInstanceId":"0690e150-4c69-4d86-a49c-990bf056f333","instance":"ausf-nausf-aut… --- ## [How to choose between Logstash and Fluentd in Elastic stack?](https://discuss.elastic.co/t/how-to-choose-between-logstash-and-fluentd-in-elastic-stack/247963)
**Author:** [@Ashish1101](https://discuss.elastic.co/u/Ashish1101)\ **Replies:** 0\ **Last updated:** [September 9, 2020, 7:12am UTC](https://discuss.elastic.co/t/how-to-choose-between-logstash-and-fluentd-in-elastic-stack/247963 "2020-09-09T07:12:59Z")
How do I decide whether to Logstash or Fluentd in elastic stack? what are the criteria? any reference links will be helpful. --- ## [How to parse xml.log via logstash](https://discuss.elastic.co/t/how-to-parse-xml-log-via-logstash/247940)
**Author:** [@gavin-orange](https://discuss.elastic.co/u/gavin-orange)\ **Replies:** 3\ **Last updated:** [September 9, 2020, 6:10am UTC](https://discuss.elastic.co/t/how-to-parse-xml-log-via-logstash/247940 "2020-09-09T06:10:11Z")
Hello Guys , I am totally new into ES and now I want to use logstash to parse the xml.log , hope could get any help . Here is part of xml.log which I have : \ **Author:** [@Ubeta](https://discuss.elastic.co/u/Ubeta)\ **Replies:** 0\ **Last updated:** [September 9, 2020, 4:46am UTC](https://discuss.elastic.co/t/capitalization-of-words-in-nori-user-dictionary/247950 "2020-09-09T04:46:29Z") Hi! My custom nori analyzer uses a nori user dictionary that contains Korean, English, and a mix of Korean-English words. These words are very technical so there was a need to put them in my user dictionary. However, wi… --- ## [Mapping explosion, how to refactor?](https://discuss.elastic.co/t/mapping-explosion-how-to-refactor/247473)
**Author:** [@DumpCat](https://discuss.elastic.co/u/DumpCat)\ **Replies:** 5\ **Last updated:** [September 9, 2020, 4:27am UTC](https://discuss.elastic.co/t/mapping-explosion-how-to-refactor/247473 "2020-09-09T04:27:55Z")
We have hbase with thousands of colume and sync colume data to elasticsearch periodically, but it is causing mapping explosion. Every field in elasticsearch maybe be searched by user, how do I to refactor? Thanks in adva… --- ## [Synced flush failed problem](https://discuss.elastic.co/t/synced-flush-failed-problem/247937)
**Author:** [@vincentduan](https://discuss.elastic.co/u/vincentduan)\ **Replies:** 1\ **Last updated:** [September 9, 2020, 4:00am UTC](https://discuss.elastic.co/t/synced-flush-failed-problem/247937 "2020-09-09T04:00:27Z")
Elasticsearch 6.2.3 The index has five primary shards and replicas is set to 1. Each shard is about 30GB. The cluster health is Green. And no data is being wrtten to the index. When I execute POST myindex/\_flush/synced,… --- ## [Uptime tags missing when monitor is ICMP](https://discuss.elastic.co/t/uptime-tags-missing-when-monitor-is-icmp/245289)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 10\ **Last updated:** [September 9, 2020, 3:46am UTC](https://discuss.elastic.co/t/uptime-tags-missing-when-monitor-is-icmp/245289 "2020-09-09T03:46:44Z")
Uptime 7.8 and as far as I know back to 7.6. When adding tags to ICMP monitors they do not show up as drop down fields on the top right. This can be duplicated by uncommenting the tags in the ICMP example and change the… --- ## [Azureでのクラスタ構成でスナップショットが作れない](https://discuss.elastic.co/t/azure/247833)
**Author:** [@rykon13](https://discuss.elastic.co/u/rykon13)\ **Replies:** 1\ **Last updated:** [September 9, 2020, 3:26am UTC](https://discuss.elastic.co/t/azure/247833 "2020-09-09T03:26:03Z")
Azure MarketplaceでElastic社が提供しているクラスタ構成でAzure上にデプロイしています。 (Masterノード3台、dateノード3台、Clientノード2台＋kibana) デプロイ完了後、バックアップ用にレポジトリを作成しようと思い、 全てのnodeにAzureとAWS S3用のプラグインを追加し、kibanaからレポジトリを作成しようとしたところ、エラーとなりました。 原因と対処、回避策などありま… --- ## [Blockchain and time series data](https://discuss.elastic.co/t/blockchain-and-time-series-data/247839)
**Author:** [@hejmaniok](https://discuss.elastic.co/u/hejmaniok)\ **Replies:** 1\ **Last updated:** [September 9, 2020, 1:42am UTC](https://discuss.elastic.co/t/blockchain-and-time-series-data/247839 "2020-09-09T01:42:20Z")
Hi everyone, We are considering using ES to index blockchain data, but before we make a move I would like to find out if with time series data it is possible to have let's say an hourly bucket and get the average of all… --- ## [Kafka String Deserializer with Logstash](https://discuss.elastic.co/t/kafka-string-deserializer-with-logstash/247693)
**Author:** [@phucsnguyenv](https://discuss.elastic.co/u/phucsnguyenv)\ **Replies:** 1\ **Last updated:** [September 9, 2020, 1:35am UTC](https://discuss.elastic.co/t/kafka-string-deserializer-with-logstash/247693 "2020-09-09T01:35:40Z")
Hi everyone I am getting a problem on pushing data from Kafka to Logstash and getting following problem. first, my data type is JSON file, original data {"key":"value"} I configured Kafka filesystem source connect to… --- ## [Threat Hunting Report for Elasticsearch](https://discuss.elastic.co/t/threat-hunting-report-for-elasticsearch/246540)
**Author:** [@syafeera](https://discuss.elastic.co/u/syafeera)\ **Replies:** 10\ **Last updated:** [September 9, 2020, 1:25am UTC](https://discuss.elastic.co/t/threat-hunting-report-for-elasticsearch/246540 "2020-09-09T01:25:13Z")
Hi there, Did anyone here know how to do Threat Hunting report using SIEM in Kibana? --- ## [Kibana : Unable to connect to Elasticsearch](https://discuss.elastic.co/t/kibana-unable-to-connect-to-elasticsearch/247687)
**Author:** [@infected](https://discuss.elastic.co/u/infected)\ **Replies:** 8\ **Last updated:** [September 9, 2020, 12:43am UTC](https://discuss.elastic.co/t/kibana-unable-to-connect-to-elasticsearch/247687 "2020-09-09T00:43:38Z")
Kibana cant connect Elasticsearch Kibana's error log log \[23:55:34.484\] \[info\]\[plugins-service\] Plugin "case" is disabled. log \[23:55:46.109\] \[info\]\[plugins-system\] Setting up \[37\] plugins: \[siem,taskManager,li… --- ## [How to keep only one version of an index / rebuild index each jdbc input](https://discuss.elastic.co/t/how-to-keep-only-one-version-of-an-index-rebuild-index-each-jdbc-input/247857)
**Author:** [@hzdb5betrieb](https://discuss.elastic.co/u/hzdb5betrieb)\ **Replies:** 0\ **Last updated:** [September 8, 2020, 9:34am UTC](https://discuss.elastic.co/t/how-to-keep-only-one-version-of-an-index-rebuild-index-each-jdbc-input/247857 "2020-09-08T09:34:45Z")
hello, we want to sync a table from an oracle database into an elasticsearch index with logstash jdbc input. the data is not timeseries data, we want to keep only one index with the current table entries (the ones from… --- ## [Debug Logstash pipeline Elastic Cloud](https://discuss.elastic.co/t/debug-logstash-pipeline-elastic-cloud/247858)
**Author:** [@captainfirebeard](https://discuss.elastic.co/u/captainfirebeard)\ **Replies:** 1\ **Last updated:** [September 9, 2020, 12:22am UTC](https://discuss.elastic.co/t/debug-logstash-pipeline-elastic-cloud/247858 "2020-09-09T00:22:01Z")
We have an Elastic Cloud subscription with one deployment (7.8). I've created a logstash pipeline on that deployment. And now i was wondering how to debug that pipeline. Since Logstash is running in the cloud I don't … --- ## [Changed JVM heap usage pattern on 7.8.1](https://discuss.elastic.co/t/changed-jvm-heap-usage-pattern-on-7-8-1/247877)
**Author:** [@Kim-Kruse-Hansen](https://discuss.elastic.co/u/Kim-Kruse-Hansen)\ **Replies:** 1\ **Last updated:** [September 9, 2020, 12:08am UTC](https://discuss.elastic.co/t/changed-jvm-heap-usage-pattern-on-7-8-1/247877 "2020-09-09T00:08:56Z")
Hi Having recently upgraded to 7.8.1 on all our clusters , we are seeing changed JVM heap usage. Our max heap usage seems to never go above around 19 GB , no matter what happens in the cluster. Same pattern on all no… --- ## [Dateparsefailure on time field](https://discuss.elastic.co/t/dateparsefailure-on-time-field/247927)
**Author:** [@ankitachow](https://discuss.elastic.co/u/ankitachow)\ **Replies:** 3\ **Last updated:** [September 8, 2020, 11:03pm UTC](https://discuss.elastic.co/t/dateparsefailure-on-time-field/247927 "2020-09-08T23:03:23Z")
I have date and time as separate fields in my input file. Date as 2019-08-28 ("yyyy-MM-dd"). Time as 09:33:05.579476547 (HH:mm:ss.SSSSSSSSZ). I want to merge the date and time for every record and create a timestamp fiel… --- ## [CPU high on Elastic cloud, instance almost stuck](https://discuss.elastic.co/t/cpu-high-on-elastic-cloud-instance-almost-stuck/247188)
**Author:** [@Daniele\_Renda](https://discuss.elastic.co/u/Daniele_Renda)\ **Replies:** 7\ **Last updated:** [September 8, 2020, 9:23pm UTC](https://discuss.elastic.co/t/cpu-high-on-elastic-cloud-instance-almost-stuck/247188 "2020-09-08T21:23:38Z")
Hi guys, I'm looking for some hint. Starting from this morning my ES instance (aws.data.highio.i3 2GB ram on Elastic cloud) is almost stuck with high load on cpu as you can see from screenshots. It seems there is no loa… --- ## [Renaming properties during reindex](https://discuss.elastic.co/t/renaming-properties-during-reindex/247926)
**Author:** [@dpr](https://discuss.elastic.co/u/dpr)\ **Replies:** 0\ **Last updated:** [September 8, 2020, 8:26pm UTC](https://discuss.elastic.co/t/renaming-properties-during-reindex/247926 "2020-09-08T20:26:30Z")
Hi! I've been successful at renaming fields during a reindex using a painless script, but I cannot figure out how to rename a (nested) property. I am trying to rename myObject.oldProperty to myObject.newProperty Here'… --- ## [Ideal Uses cases for elasticsearch Join](https://discuss.elastic.co/t/ideal-uses-cases-for-elasticsearch-join/247568)
**Author:** [@MickeyT](https://discuss.elastic.co/u/MickeyT)\ **Replies:** 6\ **Last updated:** [September 8, 2020, 7:53pm UTC](https://discuss.elastic.co/t/ideal-uses-cases-for-elasticsearch-join/247568 "2020-09-08T19:53:05Z")
If you are building a system say twitter where you anticipate replies to user tweets will be quite a lot. In addition the system will have huge user base. Is using the Join in elasticsearch ideal since you have to ensur… --- ## [How to change TSVB from an areal chart to a line chart](https://discuss.elastic.co/t/how-to-change-tsvb-from-an-areal-chart-to-a-line-chart/247893)
**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\ **Replies:** 1\ **Last updated:** [September 8, 2020, 7:52pm UTC](https://discuss.elastic.co/t/how-to-change-tsvb-from-an-areal-chart-to-a-line-chart/247893 "2020-09-08T19:52:02Z")
Hi, I want to use TSVB for line charts with multiple scales. I got the multiple scales working but it lookes like it is only an areal chart. On the internet I found a picture showing a TSVB line chart: Mine looks li… --- ## [Log file parsing and ingesting into ES](https://discuss.elastic.co/t/log-file-parsing-and-ingesting-into-es/247806)
**Author:** [@ankitachow](https://discuss.elastic.co/u/ankitachow)\ **Replies:** 14\ **Last updated:** [September 8, 2020, 6:58pm UTC](https://discuss.elastic.co/t/log-file-parsing-and-ingesting-into-es/247806 "2020-09-08T18:58:36Z")
I have a log file with 1 root of xml as below. I have created a logstash parser and tested it out in manual mode and it seems to work fine. But while ingesting into ES and get the error. Input file: \ **Author:** [@AditiKhalatkar](https://discuss.elastic.co/u/AditiKhalatkar)\ **Replies:** 4\ **Last updated:** [September 8, 2020, 6:02pm UTC](https://discuss.elastic.co/t/elasticsearch-querying-time/247589 "2020-09-08T18:02:26Z") Hi all, There is a use case, where I need some help from you guys. I wonder how should I do aggregation and which method would be the best. Let's take an example. May be a school register. Having 3 fields, student\_na… --- ## [How to run added tests for new kibana custom plugins](https://discuss.elastic.co/t/how-to-run-added-tests-for-new-kibana-custom-plugins/247805)
**Author:** [@larryzhu](https://discuss.elastic.co/u/larryzhu)\ **Replies:** 2\ **Last updated:** [September 8, 2020, 5:21pm UTC](https://discuss.elastic.co/t/how-to-run-added-tests-for-new-kibana-custom-plugins/247805 "2020-09-08T17:21:55Z")
I added a test in JS in kibana, how do I run it? lazhu@lazhu-mac kibana % git status On branch 7.8 Your branch is ahead of 'origin/7.8' by 1 commit. (use "git push" to publish your local commits)Changes not staged fo… --- ## [ELASTICSEARCH - Sort agg values only in most recent document](https://discuss.elastic.co/t/elasticsearch-sort-agg-values-only-in-most-recent-document/247398)
**Author:** [@Miguel\_BA](https://discuss.elastic.co/u/Miguel_BA)\ **Replies:** 2\ **Last updated:** [September 8, 2020, 5:20pm UTC](https://discuss.elastic.co/t/elasticsearch-sort-agg-values-only-in-most-recent-document/247398 "2020-09-08T17:20:09Z")
I want to return the most recent document of all results of the aggregations, but it is returning all the documents How can I solve that? { "aggs": { "nested": { "nested": { "path": "data.add" … --- ## [Detection Rules, Signals and CCS](https://discuss.elastic.co/t/detection-rules-signals-and-ccs/247818)
**Author:** [@Rob3](https://discuss.elastic.co/u/Rob3)\ **Replies:** 2\ **Last updated:** [September 8, 2020, 3:50pm UTC](https://discuss.elastic.co/t/detection-rules-signals-and-ccs/247818 "2020-09-08T15:50:44Z")
As far as I can tell, the SIEM app, in particular the builtin detection rules do not support cross cluster search? Is there any way to configure a CCS cluster/kibana instance such that the CCS kibana instance runs the d… --- ## [Kibana Logstash Pipeline Limit?](https://discuss.elastic.co/t/kibana-logstash-pipeline-limit/247395)
**Author:** [@rmoat](https://discuss.elastic.co/u/rmoat)\ **Replies:** 2\ **Last updated:** [September 8, 2020, 3:32pm UTC](https://discuss.elastic.co/t/kibana-logstash-pipeline-limit/247395 "2020-09-08T15:32:09Z")
Hello, I'm trying to figure out if there is a limit to what is in the Logstash Pipelines within Kibana. I have a lengthy pipeline for Winlog beat, and most of all of it is working. However, I added to new filters to fi… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1244) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1246)