# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1368 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1369 --- ## [Ruby API: difference between indices.template.\* and indices.index\_template](https://discuss.elastic.co/t/ruby-api-difference-between-indices-template-and-indices-index-template/238558)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 0\ **Last updated:** [June 24, 2020, 8:20pm UTC](https://discuss.elastic.co/t/ruby-api-difference-between-indices-template-and-indices-index-template/238558 "2020-06-24T20:20:09Z")
I have been writing some code to manage indexing templates and became very confused over whether I should be using , say, indices.exists\_index\_template.rb or indices.exists\_template.rb. After a lot of trial and error I … --- ## [J2KImageReader not loaded](https://discuss.elastic.co/t/j2kimagereader-not-loaded/238334)
**Author:** [@SKellyRJC](https://discuss.elastic.co/u/SKellyRJC)\ **Replies:** 9\ **Last updated:** [June 24, 2020, 8:14pm UTC](https://discuss.elastic.co/t/j2kimagereader-not-loaded/238334 "2020-06-24T20:14:16Z")
Hi, I have placed the jai-imageio-core-1.3.0.jar and the jai-imageio-jpeg2000-1.3.0.jar into the LIB directory for FSCrawler, however it does not get rid of the warning saying J2KImageReader not loaded? Why would this … --- ## [Role based access control displays Management Section](https://discuss.elastic.co/t/role-based-access-control-displays-management-section/237539)
**Author:** [@bmbrit](https://discuss.elastic.co/u/bmbrit)\ **Replies:** 3\ **Last updated:** [June 24, 2020, 7:53pm UTC](https://discuss.elastic.co/t/role-based-access-control-displays-management-section/237539 "2020-06-24T19:53:39Z")
Hi, I am facing a bug on the Kibana/ElasticSeach. I created a user with a test role that can have access only with Dashboards and Discover Section access but unfortunately, it displays the "Management" Section along wi… --- ## [Save Log Stream settings in Kibana](https://discuss.elastic.co/t/save-log-stream-settings-in-kibana/238541)
**Author:** [@sjabiulla](https://discuss.elastic.co/u/sjabiulla)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 7:49pm UTC](https://discuss.elastic.co/t/save-log-stream-settings-in-kibana/238541 "2020-06-24T19:49:05Z")
When I open Log Stream in Kibana, it shows the logs , which is fine. Is it possible to save that view by saving settings and create multiple views with different settings ? --- ## [Heartbeat send other fields in alert message](https://discuss.elastic.co/t/heartbeat-send-other-fields-in-alert-message/237492)
**Author:** [@matthiasbaldi](https://discuss.elastic.co/u/matthiasbaldi)\ **Replies:** 3\ **Last updated:** [June 24, 2020, 7:27pm UTC](https://discuss.elastic.co/t/heartbeat-send-other-fields-in-alert-message/237492 "2020-06-24T19:27:23Z")
We created Alerts for Heartbeat Monitors on our Cloudinstance (7.7). Currently the alerts are working, but the content which is sent to the Slack channel is a bit weired. There are a lot of IDs like the following one:D… --- ## [Where can I find Elasticsearch,Logstash,Kibana images for 6.6.1 version for Rancher v1.6](https://discuss.elastic.co/t/where-can-i-find-elasticsearch-logstash-kibana-images-for-6-6-1-version-for-rancher-v1-6/238538)
**Author:** [@chinmoy\_padhi](https://discuss.elastic.co/u/chinmoy_padhi)\ **Replies:** 0\ **Last updated:** [June 24, 2020, 5:24pm UTC](https://discuss.elastic.co/t/where-can-i-find-elasticsearch-logstash-kibana-images-for-6-6-1-version-for-rancher-v1-6/238538 "2020-06-24T17:24:16Z")
Hi, Where can I get the Elasticsearch,Kibana,Logstash images for 6.6.1 version for Rancher 1.6 supported version Thanks --- ## [Logstash connection failure to elasticsearch (deduplication pipeline)](https://discuss.elastic.co/t/logstash-connection-failure-to-elasticsearch-deduplication-pipeline/237181)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 4\ **Last updated:** [June 24, 2020, 7:17pm UTC](https://discuss.elastic.co/t/logstash-connection-failure-to-elasticsearch-deduplication-pipeline/237181 "2020-06-24T19:17:12Z")
I have created a pipeline to deduplicate logs in an index. I am facing issues while having logstash connect to the elasticsearch node. IP hosting elasticsearch is 192.168.0.2 and has a self-signed certificate. Followin… --- ## [Message: file too big for single read](https://discuss.elastic.co/t/message-file-too-big-for-single-read/238348)
**Author:** [@hilo21](https://discuss.elastic.co/u/hilo21)\ **Replies:** 2\ **Last updated:** [June 24, 2020, 6:55pm UTC](https://discuss.elastic.co/t/message-file-too-big-for-single-read/238348 "2020-06-24T18:55:28Z")
Hello, Logstash was working fine for me until this started happening. I can't start my logstash instance and I can't find some extra information on this error anywhere. \[2020-06-23T23:03:31,655\]\[INFO \]\[logstash.runner … --- ## [Join Style Queries in Kibana](https://discuss.elastic.co/t/join-style-queries-in-kibana/237117)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 12\ **Last updated:** [June 24, 2020, 6:50pm UTC](https://discuss.elastic.co/t/join-style-queries-in-kibana/237117 "2020-06-24T18:50:44Z")
Hi, Can someone explain to me how I can formulate a query that: Matches documents where the message field contains "string 1" or "string 2" Where the transaction\_id is the same for all documents Thx D --- ## [Logstash pipeline to pipeline losing events when queue is full](https://discuss.elastic.co/t/logstash-pipeline-to-pipeline-losing-events-when-queue-is-full/238545)
**Author:** [@wizardofc0dz](https://discuss.elastic.co/u/wizardofc0dz)\ **Replies:** 0\ **Last updated:** [June 24, 2020, 6:34pm UTC](https://discuss.elastic.co/t/logstash-pipeline-to-pipeline-losing-events-when-queue-is-full/238545 "2020-06-24T18:34:06Z")
Hello, I have configured pipeline-to-pipeline with output isolator configuration in Logstash version 7.4.1 to send logs to local and remote Elasticsearch. Both pipelines, local and remote output, have been configured w… --- ## [Logstash mixing up two configuration files?!](https://discuss.elastic.co/t/logstash-mixing-up-two-configuration-files/238540)
**Author:** [@RonGros](https://discuss.elastic.co/u/RonGros)\ **Replies:** 7\ **Last updated:** [June 24, 2020, 6:26pm UTC](https://discuss.elastic.co/t/logstash-mixing-up-two-configuration-files/238540 "2020-06-24T18:26:06Z")
Hi, I swear to god I don't believe myself when I am writng this. I have a logstash configuration. it takes a CSV file we have and throws it into logstash. I have some ugly patches there that take information from the fi… --- ## [Kibana on office screens and remote control](https://discuss.elastic.co/t/kibana-on-office-screens-and-remote-control/238251)
**Author:** [@Martin\_Fredriksson](https://discuss.elastic.co/u/Martin_Fredriksson)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 5:24pm UTC](https://discuss.elastic.co/t/kibana-on-office-screens-and-remote-control/238251 "2020-06-24T17:24:34Z")
This might very well fall outside of the scope of this forum but I hope someone might have a good idea. Currently we have 10 screens displaying Kibana dashboards across the office, all connected with separate Chromebit … --- ## [Tagging Signals with some metadata or tags](https://discuss.elastic.co/t/tagging-signals-with-some-metadata-or-tags/238350)
**Author:** [@forkhead](https://discuss.elastic.co/u/forkhead)\ **Replies:** 2\ **Last updated:** [June 24, 2020, 3:38pm UTC](https://discuss.elastic.co/t/tagging-signals-with-some-metadata-or-tags/238350 "2020-06-24T15:38:01Z")
Hi, I wanted to know is it possible to tag signals with some keywords like False Positive / True positive / True Positive - not malicious, etc or would it require actually updating the document. I would be interested in … --- ## [Why Is My Bucket Not In Descending Order?](https://discuss.elastic.co/t/why-is-my-bucket-not-in-descending-order/238199)
**Author:** [@Ethan777100](https://discuss.elastic.co/u/Ethan777100)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 4:40pm UTC](https://discuss.elastic.co/t/why-is-my-bucket-not-in-descending-order/238199 "2020-06-24T16:40:37Z")
I clearly sorted my bucket (in green bar) in descending order, why is the result not in descending order then? --- ## [How to use regex function on kibana for Ordered Search / match multiple keyword(sentence)?](https://discuss.elastic.co/t/how-to-use-regex-function-on-kibana-for-ordered-search-match-multiple-keyword-sentence/238174)
**Author:** [@nagmawan](https://discuss.elastic.co/u/nagmawan)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 4:34pm UTC](https://discuss.elastic.co/t/how-to-use-regex-function-on-kibana-for-ordered-search-match-multiple-keyword-sentence/238174 "2020-06-24T16:34:23Z")
Hi, Sorry i'm beginner in kibana. I will ask something about search, and will this work on kibana? I want to use the regex function with the goal to order search / matching 2 sentences or maybe more in just 1 field. I … --- ## [Kibana server is not starting](https://discuss.elastic.co/t/kibana-server-is-not-starting/238412)
**Author:** [@sid99](https://discuss.elastic.co/u/sid99)\ **Replies:** 4\ **Last updated:** [June 24, 2020, 4:32pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-starting/238412 "2020-06-24T16:32:49Z")
I am getting the above error logs. What should I do to start Kibana? --- ## [How speed index](https://discuss.elastic.co/t/how-speed-index/238484)
**Author:** [@livetech](https://discuss.elastic.co/u/livetech)\ **Replies:** 3\ **Last updated:** [June 24, 2020, 3:40pm UTC](https://discuss.elastic.co/t/how-speed-index/238484 "2020-06-24T15:40:46Z")
My server have 48gb ram and 500GB free space, digital ocean server very strong cpu how to configure yaml to speed index, please someone give me an example. --- ## [Collect the nested fields](https://discuss.elastic.co/t/collect-the-nested-fields/238528)
**Author:** [@aviman](https://discuss.elastic.co/u/aviman)\ **Replies:** 0\ **Last updated:** [June 24, 2020, 3:54pm UTC](https://discuss.elastic.co/t/collect-the-nested-fields/238528 "2020-06-24T15:54:38Z")
Hi, How can I collect the nested fields names only: "variable" : { "XX" : { "value" : "1" }, "YY" : { "value" : "2" } How can i extract the nested filed names "XX" & "YY" using painless script --- ## [Aggregating (count) by regex](https://discuss.elastic.co/t/aggregating-count-by-regex/238281)
**Author:** [@Luciano\_Borges](https://discuss.elastic.co/u/Luciano_Borges)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 3:51pm UTC](https://discuss.elastic.co/t/aggregating-count-by-regex/238281 "2020-06-24T15:51:10Z")
I have some data that I'd like to do a regex of a field and then an aggregation (count) of the results of that regex'd field. For instance: Data: GET system/path\_param/1234567/00?query\_param=xpto HTTP/1.1 GET system/p… --- ## [Cannot connect to the elsaticserach cluster currently configured for kibana](https://discuss.elastic.co/t/cannot-connect-to-the-elsaticserach-cluster-currently-configured-for-kibana/238303)
**Author:** [@Dublin\_2020](https://discuss.elastic.co/u/Dublin_2020)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 3:46pm UTC](https://discuss.elastic.co/t/cannot-connect-to-the-elsaticserach-cluster-currently-configured-for-kibana/238303 "2020-06-24T15:46:55Z")
Hi Team , we have two kibana dashboards on two different load balancers ., currently i am getting the error 'Cannot connect to the ealsticsearch cluster currently configured for kibana . Can you please help on this --- ## [Could not index event to Elasticsearch.Rejecting mapping update to \[\] as the final mapping would have more than 1 type: \[\_doc,syslog\]](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-rejecting-mapping-update-to-as-the-final-mapping-would-have-more-than-1-type-doc-syslog/238326)
**Author:** [@cezar996](https://discuss.elastic.co/u/cezar996)\ **Replies:** 2\ **Last updated:** [June 24, 2020, 3:44pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-rejecting-mapping-update-to-as-the-final-mapping-would-have-more-than-1-type-doc-syslog/238326 "2020-06-24T15:44:52Z")
Hello everybody! I get the following error when I try to send syslog data to Elasticsearch Index: \[logstash.outputs.elasticsearch\] Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>nil, :… --- ## [Centralize Kafka input settings](https://discuss.elastic.co/t/centralize-kafka-input-settings/238496)
**Author:** [@YvorL](https://discuss.elastic.co/u/YvorL)\ **Replies:** 2\ **Last updated:** [June 24, 2020, 3:40pm UTC](https://discuss.elastic.co/t/centralize-kafka-input-settings/238496 "2020-06-24T15:40:43Z")
Hi, Is there a way to refer to one file in my Logstash configuration files where I put all Kafka input general settings and avoid flooding (20 rows that are the same) each pipeline? Thank you! --- ## [How to integrate ELK with ArcSight](https://discuss.elastic.co/t/how-to-integrate-elk-with-arcsight/236762)
**Author:** [@cezar996](https://discuss.elastic.co/u/cezar996)\ **Replies:** 4\ **Last updated:** [June 24, 2020, 3:36pm UTC](https://discuss.elastic.co/t/how-to-integrate-elk-with-arcsight/236762 "2020-06-24T15:36:32Z")
Hello everybody! I have installed ELK 7.6.2 and I want to get logs from ArcSight SIEM. In order to do this I configured a forward connector which sends all events in Syslog CEF format on port 5000 TCP, as described here… --- ## [How to use Logstash and ElasticSearch to Index 'transactionID' from 'message' while keeping original 'message' intact](https://discuss.elastic.co/t/how-to-use-logstash-and-elasticsearch-to-index-transactionid-from-message-while-keeping-original-message-intact/237503)
**Author:** [@jibitgeorge](https://discuss.elastic.co/u/jibitgeorge)\ **Replies:** 3\ **Last updated:** [June 24, 2020, 3:27pm UTC](https://discuss.elastic.co/t/how-to-use-logstash-and-elasticsearch-to-index-transactionid-from-message-while-keeping-original-message-intact/237503 "2020-06-24T15:27:00Z")
I already have ELK setup for my Java application and I'm able to see the logs in Kibana. I have a field called 'message' in which I have a string called transactionID and a value assoicated with it (eg: transactionID:73… --- ## [Using The Advanced JSON Input For Filtering Data and Then Using The Intermediate Result As Part Of Calculations](https://discuss.elastic.co/t/using-the-advanced-json-input-for-filtering-data-and-then-using-the-intermediate-result-as-part-of-calculations/237556)
**Author:** [@Ethan777100](https://discuss.elastic.co/u/Ethan777100)\ **Replies:** 7\ **Last updated:** [June 24, 2020, 3:26pm UTC](https://discuss.elastic.co/t/using-the-advanced-json-input-for-filtering-data-and-then-using-the-intermediate-result-as-part-of-calculations/237556 "2020-06-24T15:26:22Z")
Hi, I made an earlier post on filtering the data within +/-300. I want to Do an on-the-spot filtering of values that are within +/-300mm per data bucket. Log this as a count per data bucket. Do a percentage calcula… --- ## [On average, what should we expect in query performance for nodes and core variations?](https://discuss.elastic.co/t/on-average-what-should-we-expect-in-query-performance-for-nodes-and-core-variations/237512)
**Author:** [@spdoes](https://discuss.elastic.co/u/spdoes)\ **Replies:** 4\ **Last updated:** [June 24, 2020, 3:21pm UTC](https://discuss.elastic.co/t/on-average-what-should-we-expect-in-query-performance-for-nodes-and-core-variations/237512 "2020-06-24T15:21:13Z")
Doubling the number of cores in rough average means reducing in half the query time ? (from 6 to 12 in my case) Doubling the number of nodes in rough average means reducing in half the query time ? (from 1 to 2 and … --- ## [Getting spans documents from filtered transactions](https://discuss.elastic.co/t/getting-spans-documents-from-filtered-transactions/236392)
**Author:** [@sannti](https://discuss.elastic.co/u/sannti)\ **Replies:** 3\ **Last updated:** [June 24, 2020, 3:18pm UTC](https://discuss.elastic.co/t/getting-spans-documents-from-filtered-transactions/236392 "2020-06-24T15:18:29Z")
Hi guys! I'm working with Kibana Dashboard, and i want to create a visualization or saved search with all spans parent from the transactions that i'm filtering. Is this posible? For example, let's supose that i filter … --- ## [Number Format and Rupee](https://discuss.elastic.co/t/number-format-and-rupee/236671)
**Author:** [@balaji\_18](https://discuss.elastic.co/u/balaji_18)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 2:55pm UTC](https://discuss.elastic.co/t/number-format-and-rupee/236671 "2020-06-24T14:55:08Z")
Is there any way to change the $ format into ₹ format ... Thank you! Please help me out --- ## [Logstash can't handle large messages](https://discuss.elastic.co/t/logstash-cant-handle-large-messages/238499)
**Author:** [@rzwarts](https://discuss.elastic.co/u/rzwarts)\ **Replies:** 3\ **Last updated:** [June 24, 2020, 2:52pm UTC](https://discuss.elastic.co/t/logstash-cant-handle-large-messages/238499 "2020-06-24T14:52:22Z")
Hi all, I'm having an issue with logstash and large syslog messages. I am using logstash 7.8 and a json template to get the files sent from rsyslog to logstash. But some messages are too long and completely crash the se… --- ## [How to use ES API to implement prometheus increase function](https://discuss.elastic.co/t/how-to-use-es-api-to-implement-prometheus-increase-function/238507)
**Author:** [@Roy\_Zhang](https://discuss.elastic.co/u/Roy_Zhang)\ **Replies:** 0\ **Last updated:** [June 24, 2020, 2:51pm UTC](https://discuss.elastic.co/t/how-to-use-es-api-to-implement-prometheus-increase-function/238507 "2020-06-24T14:51:49Z")
Dear Elastic search experts, I am using metricBeat to streaming data from prometheus to ES. I have a requirement to implement prometheus increase function. The definition of increase function in prometheus: The follow… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1367) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1369)