# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1326 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1327 --- ## [Do you need to keep the small version always in elk and kibana](https://discuss.elastic.co/t/do-you-need-to-keep-the-small-version-always-in-elk-and-kibana/241571)
**Author:** [@111351](https://discuss.elastic.co/u/111351)\ **Replies:** 1\ **Last updated:** [July 17, 2020, 3:28am UTC](https://discuss.elastic.co/t/do-you-need-to-keep-the-small-version-always-in-elk-and-kibana/241571 "2020-07-17T03:28:36Z")
Do you need to keep the small version always in elk and kibana if I use logstash5.6.16 and elasticsearch5.4 will there be a problem thanks for you --- ## [How to set default mapping to “keyword” for dynamically added properties in Elasticsearch](https://discuss.elastic.co/t/how-to-set-default-mapping-to-keyword-for-dynamically-added-properties-in-elasticsearch/241485)
**Author:** [@gitterhh](https://discuss.elastic.co/u/gitterhh)\ **Replies:** 1\ **Last updated:** [July 17, 2020, 3:26am UTC](https://discuss.elastic.co/t/how-to-set-default-mapping-to-keyword-for-dynamically-added-properties-in-elasticsearch/241485 "2020-07-17T03:26:13Z")
In our application we add new documents which can have new unknown properties. Is it possible to set default mapping to "keyword" for dynamically added new properties in Elasticsearch? --- ## [Aggregate filter gets different output even with same input](https://discuss.elastic.co/t/aggregate-filter-gets-different-output-even-with-same-input/241394)
**Author:** [@Aberry](https://discuss.elastic.co/u/Aberry)\ **Replies:** 4\ **Last updated:** [July 17, 2020, 2:33am UTC](https://discuss.elastic.co/t/aggregate-filter-gets-different-output-even-with-same-input/241394 "2020-07-17T02:33:42Z")
I encountered similar problem again while using a mass of test data. This time to set pipeline.workers=1 and pipeline.java\_execution = false in logstash.yml cannot help anymore. I have 2 input files like below - inboun… --- ## [Shards unbalanced distribution](https://discuss.elastic.co/t/shards-unbalanced-distribution/241569)
**Author:** [@LuckyNemo](https://discuss.elastic.co/u/LuckyNemo)\ **Replies:** 1\ **Last updated:** [July 17, 2020, 2:18am UTC](https://discuss.elastic.co/t/shards-unbalanced-distribution/241569 "2020-07-17T02:18:11Z")
ES version 6.0.0 8 nodes(5 datanode 3 ingests,all are 8c16g config) I have a index (5 primary 1 replica) mapping like this { "myindex": { "mappings": { "order": { "properties": { "addTime… --- ## [Convert winbeats back to Raw windows event](https://discuss.elastic.co/t/convert-winbeats-back-to-raw-windows-event/241567)
**Author:** [@bcl](https://discuss.elastic.co/u/bcl)\ **Replies:** 0\ **Last updated:** [July 17, 2020, 1:56am UTC](https://discuss.elastic.co/t/convert-winbeats-back-to-raw-windows-event/241567 "2020-07-17T01:56:16Z")
Hi All, We currently use ELK in the following way winbeats,filebeats,syslog -\> logstash ingest nodes -\> kafka cluster -\> logstash grok nodes -\> Elastic cluster We have a requirement to send winbeats logs to our securi… --- ## [ES 7.4 Field \[start\_time\] of type \[keyword\] does not support custom formats](https://discuss.elastic.co/t/es-7-4-field-start-time-of-type-keyword-does-not-support-custom-formats/241554)
**Author:** [@ghirsch](https://discuss.elastic.co/u/ghirsch)\ **Replies:** 5\ **Last updated:** [July 17, 2020, 1:55am UTC](https://discuss.elastic.co/t/es-7-4-field-start-time-of-type-keyword-does-not-support-custom-formats/241554 "2020-07-17T01:55:10Z")
Hi, I have an elasticsearch index with dynamic field mapping. I am inserting a log into the index with a field start\_time in the RFC3339 format (e.g. "2020-07-15T23:45:16Z") and until today this field was getting discove… --- ## [Elasticsearch 7.x with Puppet 3.x](https://discuss.elastic.co/t/elasticsearch-7-x-with-puppet-3-x/241529)
**Author:** [@maatthias](https://discuss.elastic.co/u/maatthias)\ **Replies:** 0\ **Last updated:** [July 16, 2020, 6:40pm UTC](https://discuss.elastic.co/t/elasticsearch-7-x-with-puppet-3-x/241529 "2020-07-16T18:40:10Z")
We are interested in using puppet to instrument our ELK stack. The ELK cluster is currently running 7.6.2. Puppet is older version 3.8.7. Is anyone aware of any successful puppet configurations in this arrangement?… --- ## [Datestamp to timestamp](https://discuss.elastic.co/t/datestamp-to-timestamp/241550)
**Author:** [@merlock](https://discuss.elastic.co/u/merlock)\ **Replies:** 2\ **Last updated:** [July 16, 2020, 11:12pm UTC](https://discuss.elastic.co/t/datestamp-to-timestamp/241550 "2020-07-16T23:12:35Z")
hello all, i have the next format of log 06/17/2020 00:00:00 - 1.6.250.107 o00044696e20022001200940005 my filter match =\> { "message" =\> ".%{DATESTAMP:LOGTIME}.-.\*%{IP}.\*w(?.{10})(?\.{5})(?.{3})(?\ **Author:** [@Yamini\_Shashank](https://discuss.elastic.co/u/Yamini_Shashank)\ **Replies:** 3\ **Last updated:** [July 16, 2020, 10:39pm UTC](https://discuss.elastic.co/t/elastic-cluster-on-azure-cloud-linux-one-server-fails-to-startup-while-the-other-is-successful/241021 "2020-07-16T22:39:58Z") Here is a configuration of a 2 node elastic cluster: node.max\_local\_storage\_nodes: 2 cluster.name: elasticsearch node.name: server2 path.data: /etc/elasticsearch/data path.logs: /etc/elasticsearch/logs discovery.se… --- ## [How apply a security of data and services into Elastcisearch](https://discuss.elastic.co/t/how-apply-a-security-of-data-and-services-into-elastcisearch/241428)
**Author:** [@vero](https://discuss.elastic.co/u/vero)\ **Replies:** 3\ **Last updated:** [July 16, 2020, 10:39pm UTC](https://discuss.elastic.co/t/how-apply-a-security-of-data-and-services-into-elastcisearch/241428 "2020-07-16T22:39:29Z")
Hi, Do you have please some ideas on how we securise our data into Elasticsearch ? As my information we don't have a DataLake. On the other hand, how we securise also the data shifting between services, could we apply… --- ## [Make logstash filter by name](https://discuss.elastic.co/t/make-logstash-filter-by-name/241526)
**Author:** [@elk6](https://discuss.elastic.co/u/elk6)\ **Replies:** 3\ **Last updated:** [July 16, 2020, 9:49pm UTC](https://discuss.elastic.co/t/make-logstash-filter-by-name/241526 "2020-07-16T21:49:59Z")
I have a log file called "/var/log/commands.log" that I'm trying to separate into fields with logstash & grok. I've got it working. Now, I'm trying to make logstash only do this to the file "/var/log/commands.log" and no… --- ## [Alias name duplication](https://discuss.elastic.co/t/alias-name-duplication/241364)
**Author:** [@Ugon](https://discuss.elastic.co/u/Ugon)\ **Replies:** 2\ **Last updated:** [July 16, 2020, 9:17pm UTC](https://discuss.elastic.co/t/alias-name-duplication/241364 "2020-07-16T21:17:12Z")
Hello :slight\_smile: After restart of one of my clusters, data nodes fail to start because of alias name duplication. On my other clusters I have similar situations (alias name pointing to multiple indices) and i can re… --- ## [Need help using a bucket\_script with single-value or filters filters](https://discuss.elastic.co/t/need-help-using-a-bucket-script-with-single-value-or-filters-filters/241544)
**Author:** [@teebu](https://discuss.elastic.co/u/teebu)\ **Replies:** 0\ **Last updated:** [July 16, 2020, 8:56pm UTC](https://discuss.elastic.co/t/need-help-using-a-bucket-script-with-single-value-or-filters-filters/241544 "2020-07-16T20:56:41Z")
I'm trying to compute count of a nested field where active and inactive is not 0 for both values. But I can't get my aggs working inside the bucket\_script. Initially I tried using the active\_entities" : { "filter" but I … --- ## [Logstash Netflow Codec Issues](https://discuss.elastic.co/t/logstash-netflow-codec-issues/241500)
**Author:** [@csgeek](https://discuss.elastic.co/u/csgeek)\ **Replies:** 1\ **Last updated:** [July 16, 2020, 8:26pm UTC](https://discuss.elastic.co/t/logstash-netflow-codec-issues/241500 "2020-07-16T20:26:26Z")
I'm having issues handling netflow data through the logstash codec. I was wondering if anyone had any insight that could help. Logstash version: 7.6.2 (I'm happy to upgrade if need be not tied to a specific version) f… --- ## [How to access aggregations from within custom request handler](https://discuss.elastic.co/t/how-to-access-aggregations-from-within-custom-request-handler/226445)
**Author:** [@ssimmons](https://discuss.elastic.co/u/ssimmons)\ **Replies:** 4\ **Last updated:** [July 16, 2020, 8:23pm UTC](https://discuss.elastic.co/t/how-to-access-aggregations-from-within-custom-request-handler/226445 "2020-07-16T20:23:32Z")
Is it possible to access the aggregations from within a custom visualization request handler? I'm currently not seeing the aggs object contained within the object that is passed into the custom request handler. I'm tryin… --- ## [Tag \_grokparsefailure when parsing logs via logstash](https://discuss.elastic.co/t/tag-grokparsefailure-when-parsing-logs-via-logstash/241489)
**Author:** [@Rahul\_Aggarwal](https://discuss.elastic.co/u/Rahul_Aggarwal)\ **Replies:** 3\ **Last updated:** [July 16, 2020, 8:18pm UTC](https://discuss.elastic.co/t/tag-grokparsefailure-when-parsing-logs-via-logstash/241489 "2020-07-16T20:18:58Z")
Below are 2 logs of same cloudfront distribution, patterns of logs same but when processing with logstash same filter showing tag \_grokparsefailure for first line but no any failure for second line, Please help to remove… --- ## [Logstash Patterns - Firewalls - Best Place to Find it](https://discuss.elastic.co/t/logstash-patterns-firewalls-best-place-to-find-it/239107)
**Author:** [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Replies:** 4\ **Last updated:** [July 16, 2020, 8:15pm UTC](https://discuss.elastic.co/t/logstash-patterns-firewalls-best-place-to-find-it/239107 "2020-07-16T20:15:43Z")
My use case is Cisco ASA firewall logs but I think these questions apply more broadly. I am trying do the parsing of Cisco ASA logs in logstash, not using Filebeat. I'd like to not reinvent the wheel so where can I f… --- ## [Implications of using serial ids for documents](https://discuss.elastic.co/t/implications-of-using-serial-ids-for-documents/241355)
**Author:** [@terell](https://discuss.elastic.co/u/terell)\ **Replies:** 3\ **Last updated:** [July 16, 2020, 7:27pm UTC](https://discuss.elastic.co/t/implications-of-using-serial-ids-for-documents/241355 "2020-07-16T19:27:02Z")
I'm planning on linking documents I write to ES to records in my relational database by simply taking the record id and writing it to the document id. This means the IDs for my documents will be serial (ie. 1,2,3,4,5) in… --- ## [Logstash sFlow Codec Input Syntax :: Implement "optional\_removed\_field"?](https://discuss.elastic.co/t/logstash-sflow-codec-input-syntax-implement-optional-removed-field/241527)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 2\ **Last updated:** [July 16, 2020, 7:25pm UTC](https://discuss.elastic.co/t/logstash-sflow-codec-input-syntax-implement-optional-removed-field/241527 "2020-07-16T19:25:41Z")
Hi Logstash Megaminds, I'm using my Logstash instance as an sFlow collector, and it works great. When I read the documentation on the sFlow Codec, I see this: By default \[some sFlow\] fields are removed from \[every\] e… --- ## [Logstash date filter match timestamp issue](https://discuss.elastic.co/t/logstash-date-filter-match-timestamp-issue/241506)
**Author:** [@rahulnama](https://discuss.elastic.co/u/rahulnama)\ **Replies:** 5\ **Last updated:** [July 16, 2020, 7:24pm UTC](https://discuss.elastic.co/t/logstash-date-filter-match-timestamp-issue/241506 "2020-07-16T19:24:08Z")
Hi Team I want to match the timestamp with date from logs. But in kibana I see different time for timestamp and logdate. why is this happening and how to resolve this ? Kibana data Logstash.conf Any suggestions w… --- ## [Logstash pipeline workers and imap input plugin](https://discuss.elastic.co/t/logstash-pipeline-workers-and-imap-input-plugin/241534)
**Author:** [@Diptee](https://discuss.elastic.co/u/Diptee)\ **Replies:** 1\ **Last updated:** [July 16, 2020, 7:20pm UTC](https://discuss.elastic.co/t/logstash-pipeline-workers-and-imap-input-plugin/241534 "2020-07-16T19:20:34Z")
Hi, We have configured logstash(using default pipeline configuration). We have just one pipeline running. When I start logstash I see it has 4 pipeline workers and batch size of 125. I am using IMAP input plugin to pro… --- ## [Few worker threads keep running even after logstash is shutdown](https://discuss.elastic.co/t/few-worker-threads-keep-running-even-after-logstash-is-shutdown/241535)
**Author:** [@Diptee](https://discuss.elastic.co/u/Diptee)\ **Replies:** 0\ **Last updated:** [July 16, 2020, 7:14pm UTC](https://discuss.elastic.co/t/few-worker-threads-keep-running-even-after-logstash-is-shutdown/241535 "2020-07-16T19:14:34Z")
Hi, We have configured logstash(using default pipeline configuration). We have just one pipeline running. When I start logstash I see it has 4 pipeline workers and batch size of 125. I am using IMAP input plugin to pro… --- ## [Logstash multiple inputs parallel](https://discuss.elastic.co/t/logstash-multiple-inputs-parallel/241523)
**Author:** [@dbargo](https://discuss.elastic.co/u/dbargo)\ **Replies:** 1\ **Last updated:** [July 16, 2020, 6:10pm UTC](https://discuss.elastic.co/t/logstash-multiple-inputs-parallel/241523 "2020-07-16T18:10:51Z")
If I have multiple inputs in my logstash and one output does it collects the logs from the inputs in serial way ( one by one ) or in parallel way ( all of them in the same time) ? Couldn't find an answer to it --- ## [GeoIP lookup failed](https://discuss.elastic.co/t/geoip-lookup-failed/241414)
**Author:** [@Alex\_Liu](https://discuss.elastic.co/u/Alex_Liu)\ **Replies:** 3\ **Last updated:** [July 16, 2020, 5:51pm UTC](https://discuss.elastic.co/t/geoip-lookup-failed/241414 "2020-07-16T17:51:01Z")
Hi, how to debug GeoIP lookup failure? For below attached screenshot, why the first clientIP: 123.58.60.5 lookup failed, but the second one 112.85.231.147 succeed? the configuration is simple, and the GeoLIte2-city.m… --- ## [Logstash on k8s - high memory usage](https://discuss.elastic.co/t/logstash-on-k8s-high-memory-usage/241299)
**Author:** [@zachshani](https://discuss.elastic.co/u/zachshani)\ **Replies:** 4\ **Last updated:** [July 16, 2020, 5:45pm UTC](https://discuss.elastic.co/t/logstash-on-k8s-high-memory-usage/241299 "2020-07-16T17:45:24Z")
Hi, I'm implementing logstash as a deployment (pod) on k8s. I've noticed that it consumes high memory - even when no data is being send to it. I've tried setting jvm.options (Xms4g & Xmx4g), but I got same results - h… --- ## [\[parent\] Data too large (for agg or reused\_arrays)](https://discuss.elastic.co/t/parent-data-too-large-for-agg-or-reused-arrays/241517)
**Author:** [@duttad](https://discuss.elastic.co/u/duttad)\ **Replies:** 0\ **Last updated:** [July 16, 2020, 5:44pm UTC](https://discuss.elastic.co/t/parent-data-too-large-for-agg-or-reused-arrays/241517 "2020-07-16T17:44:14Z")
I am doing nested aggregation over fields with large cardinality - so, probably the large number of buckets is tripping the circuit breakers. Trying to understand the following circuit breaker exception thoroughly. shar… --- ## [How logstash read multiline data line by line](https://discuss.elastic.co/t/how-logstash-read-multiline-data-line-by-line/241498)
**Author:** [@ashish2](https://discuss.elastic.co/u/ashish2)\ **Replies:** 0\ **Last updated:** [July 16, 2020, 3:58pm UTC](https://discuss.elastic.co/t/how-logstash-read-multiline-data-line-by-line/241498 "2020-07-16T15:58:53Z")
i am new to elk .am phasing some problem about logstash ,tell me that i can solve this problem with logstash or not? i have a csv file like this. a: rajat b: 123,321a,543, 123a....... a: ashish b: 878, 543, 321, 123… --- ## [Logstash multiple pipelines in k8s](https://discuss.elastic.co/t/logstash-multiple-pipelines-in-k8s/241497)
**Author:** [@digma89](https://discuss.elastic.co/u/digma89)\ **Replies:** 0\ **Last updated:** [July 16, 2020, 3:57pm UTC](https://discuss.elastic.co/t/logstash-multiple-pipelines-in-k8s/241497 "2020-07-16T15:57:32Z")
I'm trying to run multiple pipelines on my custom docker image in k8s, but doesn't seems to be working. On the config map in k8s I have: apiVersion: v1 kind: ConfigMap metadata: name: logstashffs-${trigger.resolvedEx… --- ## [Filter on custom plugin](https://discuss.elastic.co/t/filter-on-custom-plugin/237771)
**Author:** [@bard0x](https://discuss.elastic.co/u/bard0x)\ **Replies:** 1\ **Last updated:** [July 16, 2020, 3:41pm UTC](https://discuss.elastic.co/t/filter-on-custom-plugin/237771 "2020-07-16T15:41:22Z")
Hi, I wrote an angularJS plugin with a clickable image. How can I apply a filter on image click? Which module I have to import to do this feature? Thank's in advance --- ## [Boosting specific documents to be at the top of the results](https://discuss.elastic.co/t/boosting-specific-documents-to-be-at-the-top-of-the-results/240970)
**Author:** [@droplet](https://discuss.elastic.co/u/droplet)\ **Replies:** 6\ **Last updated:** [July 16, 2020, 3:24pm UTC](https://discuss.elastic.co/t/boosting-specific-documents-to-be-at-the-top-of-the-results/240970 "2020-07-16T15:24:50Z")
Hi there, I don't know how to best describe the topic, excuse the vague title. I'm having some issue with the search results coming from an index. The index contains about 1M+ documents (various products), but doing a… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1325) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1327)