# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1346 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1347 --- ## [SIEM detections](https://discuss.elastic.co/t/siem-detections/240121)
**Author:** [@amalchandran](https://discuss.elastic.co/u/amalchandran)\ **Replies:** 2\ **Last updated:** [July 7, 2020, 1:06pm UTC](https://discuss.elastic.co/t/siem-detections/240121 "2020-07-07T13:06:48Z")
Hi All I have been trying out SIEM functionalities in ELK 7.8.I have a use case I need to detect and alert 'No logs received for last 6 hours' from a particular host Is it possible using SIEM detection? --- ## [Divide Should query into two parts and combine them with and logic](https://discuss.elastic.co/t/divide-should-query-into-two-parts-and-combine-them-with-and-logic/240120)
**Author:** [@buka\_bidzina](https://discuss.elastic.co/u/buka_bidzina)\ **Replies:** 12\ **Last updated:** [July 7, 2020, 1:03pm UTC](https://discuss.elastic.co/t/divide-should-query-into-two-parts-and-combine-them-with-and-logic/240120 "2020-07-07T13:03:44Z")
GET INDEX/\_search { "query": { "bool": { "must": \[ { "nested": { "path": "categories", "query": { "terms": { "categories.id": \[ … --- ## [The correct use of logstash](https://discuss.elastic.co/t/the-correct-use-of-logstash/239823)
**Author:** [@Katia](https://discuss.elastic.co/u/Katia)\ **Replies:** 5\ **Last updated:** [July 7, 2020, 12:59pm UTC](https://discuss.elastic.co/t/the-correct-use-of-logstash/239823 "2020-07-07T12:59:03Z")
I have four types of log files. Every day I get the 4 types from several machines and, I have for each machine : t1-20200703, t2-20200703, t3-20200703 and t4-20200703. After a few days I will have hundreds of files and… --- ## [Query range problem](https://discuss.elastic.co/t/query-range-problem/240150)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 2\ **Last updated:** [July 7, 2020, 12:51pm UTC](https://discuss.elastic.co/t/query-range-problem/240150 "2020-07-07T12:51:39Z")
Dears, How to modify such query to add additional condition to first range "0nn"? I need to find only such documents which meet such conditions: ci.a": { "gte": 0,"lte": 99} and ci.b like "(??1?) or (??3?) or (??5?) o… --- ## [URL ingest processor](https://discuss.elastic.co/t/url-ingest-processor/239616)
**Author:** [@bernhard.fluehmann](https://discuss.elastic.co/u/bernhard.fluehmann)\ **Replies:** 2\ **Last updated:** [July 7, 2020, 12:25pm UTC](https://discuss.elastic.co/t/url-ingest-processor/239616 "2020-07-07T12:25:06Z")
It would be helpful to have an ingest pipeline processor which parses a url to the corresponding ecs fields. It can be done with GROK, but would be much more convenient and error save to have it as an official processor. … --- ## [How to make elastic search ignore delimiter](https://discuss.elastic.co/t/how-to-make-elastic-search-ignore-delimiter/240037)
**Author:** [@ermagherd](https://discuss.elastic.co/u/ermagherd)\ **Replies:** 1\ **Last updated:** [July 7, 2020, 12:19pm UTC](https://discuss.elastic.co/t/how-to-make-elastic-search-ignore-delimiter/240037 "2020-07-07T12:19:33Z")
Hi all, ES Noob posting his first question here. I've ingested some text documents into ES using FS Crawler. When I try to run a match query in elastic search for a piece of text like "aaa-bbb", I notice that elastic se… --- ## [Unable to connect to Elasticsearch server 6.2.2 from spring application](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-server-6-2-2-from-spring-application/240055)
**Author:** [@alexc1](https://discuss.elastic.co/u/alexc1)\ **Replies:** 1\ **Last updated:** [July 7, 2020, 12:07pm UTC](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-server-6-2-2-from-spring-application/240055 "2020-07-07T12:07:12Z")
Hello everyone, I am struggling to connect my webapp based on Spring Framework 4.3.13 (not a springboot app) to an Elasticsearch server 6.2.2. I've googling al lot but with no result unfortunally. Here the code I'm ex… --- ## [How to add the value count of 2 search results in Logstash](https://discuss.elastic.co/t/how-to-add-the-value-count-of-2-search-results-in-logstash/240153)
**Author:** [@Matish\_Bhuyan](https://discuss.elastic.co/u/Matish_Bhuyan)\ **Replies:** 1\ **Last updated:** [July 7, 2020, 11:51am UTC](https://discuss.elastic.co/t/how-to-add-the-value-count-of-2-search-results-in-logstash/240153 "2020-07-07T11:51:35Z")
Hi All, I have written a scripted filed to add the count of these 2 values Identity Accepted and Identity Rejected. These values are searched under result keyword this is my scripted field if (doc\['result'\].value ==… --- ## [Elastic search errors after OutOfMemoryError](https://discuss.elastic.co/t/elastic-search-errors-after-outofmemoryerror/240142)
**Author:** [@cm-vdp](https://discuss.elastic.co/u/cm-vdp)\ **Replies:** 3\ **Last updated:** [July 7, 2020, 11:48am UTC](https://discuss.elastic.co/t/elastic-search-errors-after-outofmemoryerror/240142 "2020-07-07T11:48:17Z")
I restarted the elasticsearch service after I saw OutOfMemoryError - errors. But in the logging I see these errors: \[2020-07-07T09:43:52,654\]\[ERROR\]\[o.e.x.m.c.i.IndexStatsCollector\] \[mPGPZUq\] collector \[index-stats\] fa… --- ## [JMS Input Plugin for Logstash - Tibco JMS Provider](https://discuss.elastic.co/t/jms-input-plugin-for-logstash-tibco-jms-provider/240151)
**Author:** [@rohitdgp](https://discuss.elastic.co/u/rohitdgp)\ **Replies:** 0\ **Last updated:** [July 7, 2020, 11:42am UTC](https://discuss.elastic.co/t/jms-input-plugin-for-logstash-tibco-jms-provider/240151 "2020-07-07T11:42:47Z")
I was reading through JMS as input plugin for Logstash. Post reading the documentation i was trying to setup a Logstash EMS listener for Tibco JMS provider with JNDI configuration. Although the official elastic-matrix … --- ## [How to create map with 0 length](https://discuss.elastic.co/t/how-to-create-map-with-0-length/240093)
**Author:** [@Deepak\_Dandotiya](https://discuss.elastic.co/u/Deepak_Dandotiya)\ **Replies:** 2\ **Last updated:** [July 7, 2020, 11:42am UTC](https://discuss.elastic.co/t/how-to-create-map-with-0-length/240093 "2020-07-07T11:42:29Z")
Hi All, I need one help. how to create map with 0 length if data is null for that map fields. I am giving one example where student\_key is PK and for a student creating SUBJECT as map so if all column data is null then… --- ## [Rsyslog + Beats together](https://discuss.elastic.co/t/rsyslog-beats-together/239994)
**Author:** [@akam](https://discuss.elastic.co/u/akam)\ **Replies:** 3\ **Last updated:** [July 7, 2020, 10:55am UTC](https://discuss.elastic.co/t/rsyslog-beats-together/239994 "2020-07-07T10:55:56Z")
Hello, I am trying to collect logs from rsyslog and filebeats. I have rsyslog configuration files: 01-json-template.conf template(name="json-template" type="list") { constant(value="{") constant(va… --- ## [Performance tuning for aggregators](https://discuss.elastic.co/t/performance-tuning-for-aggregators/240050)
**Author:** [@pratikgcet](https://discuss.elastic.co/u/pratikgcet)\ **Replies:** 0\ **Last updated:** [July 6, 2020, 6:21pm UTC](https://discuss.elastic.co/t/performance-tuning-for-aggregators/240050 "2020-07-06T18:21:37Z")
Hello, I have a below query which is doing mulitple aggregations and then returning the data. I am doing a filter on date greater than 7am this morning. The elasticsearch has got millions of rows and I expected the belo… --- ## [Logstash studdown seconds after starting on its own](https://discuss.elastic.co/t/logstash-studdown-seconds-after-starting-on-its-own/240138)
**Author:** [@Jayesh\_Rathi](https://discuss.elastic.co/u/Jayesh_Rathi)\ **Replies:** 7\ **Last updated:** [July 7, 2020, 10:42am UTC](https://discuss.elastic.co/t/logstash-studdown-seconds-after-starting-on-its-own/240138 "2020-07-07T10:42:50Z")
hello, i was trying to start my logstash but it started and shutted down in a few seconds. Does anyone have any idea to resolve this issue? \[2020-07-07T15:17:11,564\]\[INFO \]\[logstash.runner \] Logstash shut down… --- ## [Logstash Events Stats API](https://discuss.elastic.co/t/logstash-events-stats-api/239212)
**Author:** [@Rahul\_Kumar4](https://discuss.elastic.co/u/Rahul_Kumar4)\ **Replies:** 4\ **Last updated:** [July 7, 2020, 9:57am UTC](https://discuss.elastic.co/t/logstash-events-stats-api/239212 "2020-07-07T09:57:07Z")
What do the fields duration\_in\_millis and queue\_push\_duration\_in\_millis in Logstash's Events Stats API response in the link below mean? https://www.elastic.co/guide/en/logstash/current/node-stats-api.html#event-stats --- ## [How to set RAM:Disk ratio for Elastic Search 7.6.2](https://discuss.elastic.co/t/how-to-set-ram-disk-ratio-for-elastic-search-7-6-2/240128)
**Author:** [@Avneet\_Singh1](https://discuss.elastic.co/u/Avneet_Singh1)\ **Replies:** 0\ **Last updated:** [July 7, 2020, 9:11am UTC](https://discuss.elastic.co/t/how-to-set-ram-disk-ratio-for-elastic-search-7-6-2/240128 "2020-07-07T09:11:10Z")
I'm trying to setup the RAM:Disk ratio in Elastic Search using the API Curl curl -X PUT http://COORDINATE\_HOST:PORT/api/v0.1/regions/ece-region/node\_types/elasticsearch/default -H 'Accept: \*/\* ' -H 'Content-Type: appl… --- ## [The difference between using script in pipeline and using normal script to update document](https://discuss.elastic.co/t/the-difference-between-using-script-in-pipeline-and-using-normal-script-to-update-document/239951)
**Author:** [@FFFro](https://discuss.elastic.co/u/FFFro)\ **Replies:** 2\ **Last updated:** [July 7, 2020, 9:30am UTC](https://discuss.elastic.co/t/the-difference-between-using-script-in-pipeline-and-using-normal-script-to-update-document/239951 "2020-07-07T09:30:46Z")
Now I'd like to update documents with parent-child relationships. When I use script to update, prompt me "field"\[\_ routing\] is a metadata field and cannot be added inside a document. Use the index API request parameters.… --- ## [Elasticsearch simple scripted similarity performance issues](https://discuss.elastic.co/t/elasticsearch-simple-scripted-similarity-performance-issues/240134)
**Author:** [@kamils468](https://discuss.elastic.co/u/kamils468)\ **Replies:** 0\ **Last updated:** [July 7, 2020, 9:30am UTC](https://discuss.elastic.co/t/elasticsearch-simple-scripted-similarity-performance-issues/240134 "2020-07-07T09:30:39Z")
I have created simple similarity which all it does is returning doc.freq . { "similarity": { "custom\_similarity\_score": { "type": "scripted", "script": { "source": "return doc.freq;" } … --- ## [Huge delay in logs to ES from Kafka/Logstash](https://discuss.elastic.co/t/huge-delay-in-logs-to-es-from-kafka-logstash/239948)
**Author:** [@biswajit\_list](https://discuss.elastic.co/u/biswajit_list)\ **Replies:** 4\ **Last updated:** [July 7, 2020, 9:26am UTC](https://discuss.elastic.co/t/huge-delay-in-logs-to-es-from-kafka-logstash/239948 "2020-07-07T09:26:12Z")
New for ELK Have 2 Kafka , 2 Logstash , 3 master ES and 2 Data nodes my logstash config is input { kafka { bootstrap\_servers =\> "kafka01:9092, kafka02:9092" topics =\> \["filebeat"\] codec =\> json heartbeat\_interval… --- ## [Logstash, Could not index event to Elasticsearch](https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch/240123)
**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\ **Replies:** 3\ **Last updated:** [July 7, 2020, 9:23am UTC](https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch/240123 "2020-07-07T09:23:05Z")
Hi, I am trying to index some data with logstash. My config: input { redis{ host =\> "localhost" data\_type =\> "list" key =\> "timeset1" threads =\> 4 } } filter { date { match =\> \[ "timestamp" , "yyyy-MM-… --- ## [Cross field search with different analyzers](https://discuss.elastic.co/t/cross-field-search-with-different-analyzers/239765)
**Author:** [@rathcke](https://discuss.elastic.co/u/rathcke)\ **Replies:** 1\ **Last updated:** [July 7, 2020, 9:04am UTC](https://discuss.elastic.co/t/cross-field-search-with-different-analyzers/239765 "2020-07-07T09:04:12Z")
I have the following (simplified) mapping: { "settings": { "index": { "number\_of\_shards": "2", "number\_of\_replicas": "1" }, "analysis": { "analyzer": { "rebuilt\_whitespace… --- ## [Nodes don't connect until keyboard interrupt is sent](https://discuss.elastic.co/t/nodes-dont-connect-until-keyboard-interrupt-is-sent/240125)
**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\ **Replies:** 0\ **Last updated:** [July 7, 2020, 9:02am UTC](https://discuss.elastic.co/t/nodes-dont-connect-until-keyboard-interrupt-is-sent/240125 "2020-07-07T09:02:21Z")
Hi, I have a cluster of 3 nodes. I had the problem that I turned off one node and when I turned in back on it didn't connect until I sent a keyboard interrupt (CTRL+C) in the terminal on a second node. After that they s… --- ## [How to return highlight as an html instead of string?](https://discuss.elastic.co/t/how-to-return-highlight-as-an-html-instead-of-string/239892)
**Author:** [@NikolaP93](https://discuss.elastic.co/u/NikolaP93)\ **Replies:** 1\ **Last updated:** [July 7, 2020, 8:32am UTC](https://discuss.elastic.co/t/how-to-return-highlight-as-an-html-instead-of-string/239892 "2020-07-07T08:32:14Z")
So I have a problem , I created a custom highlight like so: customHighlight={() =\> ({ highlight: { pre\_tags: \['\'\], … --- ## [Get saved object id through Search API of Kibana](https://discuss.elastic.co/t/get-saved-object-id-through-search-api-of-kibana/239424)
**Author:** [@Voula\_Mikr](https://discuss.elastic.co/u/Voula_Mikr)\ **Replies:** 1\ **Last updated:** [July 7, 2020, 8:17am UTC](https://discuss.elastic.co/t/get-saved-object-id-through-search-api-of-kibana/239424 "2020-07-07T08:17:44Z")
Hi! Is there any query I can make in console of Kibana that I can get the id of a specific Dashboard, visualization, index-pattern and search? For example with : GET .kibana/\_search { "\_source": \["dashboard.title"\], … --- ## [Elastic Node - Failed to execute watch](https://discuss.elastic.co/t/elastic-node-failed-to-execute-watch/239520)
**Author:** [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\ **Replies:** 4\ **Last updated:** [July 7, 2020, 7:58am UTC](https://discuss.elastic.co/t/elastic-node-failed-to-execute-watch/239520 "2020-07-07T07:58:16Z")
Hello, I am hoping that someone in the ElasticSearch Forum would kindly help me with an issue I am facing. I am seeing this in my elasticsearch log: Had a read through and doing some research, can't seem to get the r… --- ## [Snapshot failure missing file](https://discuss.elastic.co/t/snapshot-failure-missing-file/240097)
**Author:** [@michaelv](https://discuss.elastic.co/u/michaelv)\ **Replies:** 2\ **Last updated:** [July 7, 2020, 7:57am UTC](https://discuss.elastic.co/t/snapshot-failure-missing-file/240097 "2020-07-07T07:57:32Z")
Hi All, This is running ELK 7.7.8 on Ubuntu 18.04.4 LTS I had created a NFS mount on my 3 old node cluster and new 3 node cluster I did manage to make a snapshot from old and restore to new cluster. However, I decide… --- ## [Elasticsearch v2.2 Java version](https://discuss.elastic.co/t/elasticsearch-v2-2-java-version/239990)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 5\ **Last updated:** [July 7, 2020, 7:51am UTC](https://discuss.elastic.co/t/elasticsearch-v2-2-java-version/239990 "2020-07-07T07:51:22Z")
Hi everybody, I know that Elasticsearch v.2.2 is out of support, it is dead and so on but I was using for a small project. I have a plan to create it from scratch with a new version while for the moment I would like to … --- ## [Does elastic search allow aggregations within a document? Or is there another way to do same](https://discuss.elastic.co/t/does-elastic-search-allow-aggregations-within-a-document-or-is-there-another-way-to-do-same/239637)
**Author:** [@charvi23](https://discuss.elastic.co/u/charvi23)\ **Replies:** 6\ **Last updated:** [July 7, 2020, 7:46am UTC](https://discuss.elastic.co/t/does-elastic-search-allow-aggregations-within-a-document-or-is-there-another-way-to-do-same/239637 "2020-07-07T07:46:58Z")
I am new to elastic search, I have a elastic search index example as follows: Category is my index and insight is field having array of elements. "category": { "insight": { \[ { "topic":"xyz", "id":"10" } , { "… --- ## [How to migrate from multi node cluster to singe node cluster](https://discuss.elastic.co/t/how-to-migrate-from-multi-node-cluster-to-singe-node-cluster/240104)
**Author:** [@klokkie](https://discuss.elastic.co/u/klokkie)\ **Replies:** 4\ **Last updated:** [July 7, 2020, 7:43am UTC](https://discuss.elastic.co/t/how-to-migrate-from-multi-node-cluster-to-singe-node-cluster/240104 "2020-07-07T07:43:16Z")
Hi Is there some sort of work instruction how to migrate from a 5 node cluster (all data nodes) with 3 eligable masters to a single node cluster? Regards, Tim --- ## [I am curious when sending data from logstash to elasticsearch](https://discuss.elastic.co/t/i-am-curious-when-sending-data-from-logstash-to-elasticsearch/240073)
**Author:** [@111349](https://discuss.elastic.co/u/111349)\ **Replies:** 7\ **Last updated:** [July 7, 2020, 7:40am UTC](https://discuss.elastic.co/t/i-am-curious-when-sending-data-from-logstash-to-elasticsearch/240073 "2020-07-07T07:40:07Z")
I pass custom logs to elastocsearch using logstash For example, the string "A+B=AB" contains the field name in "fields1". If I search for "A+B=AB" literally, other fields containing A,B,AB are partially searched. This … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1345) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1347)