# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1399 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1400 --- ## [Wrong result for unique count operation](https://discuss.elastic.co/t/wrong-result-for-unique-count-operation/236320)
**Author:** [@inchirah](https://discuss.elastic.co/u/inchirah)\ **Replies:** 1\ **Last updated:** [June 9, 2020, 11:58am UTC](https://discuss.elastic.co/t/wrong-result-for-unique-count-operation/236320 "2020-06-09T11:58:09Z")
Hello, I use Kibana to visualize my data set. I apply "unique-count" operation on '\_id' field, but the result is "float". More precisely the number of rows is 5542 and the result given is 5.542. Could you please help… --- ## [Our elastic has set an index to read-only twice in the last two days](https://discuss.elastic.co/t/our-elastic-has-set-an-index-to-read-only-twice-in-the-last-two-days/236325)
**Author:** [@Veeresh\_Reddy](https://discuss.elastic.co/u/Veeresh_Reddy)\ **Replies:** 0\ **Last updated:** [June 9, 2020, 11:53am UTC](https://discuss.elastic.co/t/our-elastic-has-set-an-index-to-read-only-twice-in-the-last-two-days/236325 "2020-06-09T11:53:04Z")
Our elastic has set an index to read-only twice in the last two days. We should Get notified when an index is in read-only Delete old data instead of running out of space option: set retention to 2 days option: enable … --- ## [Importance of shard sizing for search performance](https://discuss.elastic.co/t/importance-of-shard-sizing-for-search-performance/236034)
**Author:** [@magnalite](https://discuss.elastic.co/u/magnalite)\ **Replies:** 2\ **Last updated:** [June 9, 2020, 11:44am UTC](https://discuss.elastic.co/t/importance-of-shard-sizing-for-search-performance/236034 "2020-06-09T11:44:16Z")
I'm currently in the process of designing/deploying a cluster which needs to handle \>2B docs/day and keep these docs for at least 3 months. This means an overall capacity of ~180B docs which can be searched at any moment… --- ## [Help writing a test for a custom plugin in ES](https://discuss.elastic.co/t/help-writing-a-test-for-a-custom-plugin-in-es/236316)
**Author:** [@rahulkarajgikar](https://discuss.elastic.co/u/rahulkarajgikar)\ **Replies:** 0\ **Last updated:** [June 9, 2020, 10:52am UTC](https://discuss.elastic.co/t/help-writing-a-test-for-a-custom-plugin-in-es/236316 "2020-06-09T10:52:45Z")
Hi everyone, I'm trying to create a test for a plugin that should be able to do these 3 things: Start a cluster(can have one node) with my plugin installed on each node. Customize the elasticsearch.yml for the nodes i… --- ## [Handling MQRFH2 header in Logstash](https://discuss.elastic.co/t/handling-mqrfh2-header-in-logstash/236318)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 0\ **Last updated:** [June 9, 2020, 11:11am UTC](https://discuss.elastic.co/t/handling-mqrfh2-header-in-logstash/236318 "2020-06-09T11:11:33Z")
Hi Guys, Can you please suggest , how to handle incoming MQRFH2 header in logstash, this is going to the dead letter queue, whenever there is an MQRFH2 header in request --- ## [Ingest Processor Conditional](https://discuss.elastic.co/t/ingest-processor-conditional/236311)
**Author:** [@Atul\_Gunjal](https://discuss.elastic.co/u/Atul_Gunjal)\ **Replies:** 1\ **Last updated:** [June 9, 2020, 10:53am UTC](https://discuss.elastic.co/t/ingest-processor-conditional/236311 "2020-06-09T10:53:25Z")
I want to process data in the message field from a source if fields.log\_type is combinedlogs...but it's not working. Can someone help me there? Thanks in Advance. Ingest Pipeline: PUT \_ingest/pipeline/pipeline\_combine… --- ## [How Set Setting.Builder in RestHighLevelClient Elastic 7.6 like in TransportClient and preBuildTransportClient](https://discuss.elastic.co/t/how-set-setting-builder-in-resthighlevelclient-elastic-7-6-like-in-transportclient-and-prebuildtransportclient/236315)
**Author:** [@saba\_safavi](https://discuss.elastic.co/u/saba_safavi)\ **Replies:** 0\ **Last updated:** [June 9, 2020, 10:50am UTC](https://discuss.elastic.co/t/how-set-setting-builder-in-resthighlevelclient-elastic-7-6-like-in-transportclient-and-prebuildtransportclient/236315 "2020-06-09T10:50:21Z")
I want to migrate from Elastic 5.6 to 7.6 we can set some settings in Settings.Builder setting = Settings.builder(); like node.name , cluster.name and some SSL setting but I can find neither in Java Rest Client api nor i… --- ## [How to check if then else whether nummeric between 2 signs of a string](https://discuss.elastic.co/t/how-to-check-if-then-else-whether-nummeric-between-2-signs-of-a-string/236310)
**Author:** [@Datakids](https://discuss.elastic.co/u/Datakids)\ **Replies:** 0\ **Last updated:** [June 9, 2020, 10:07am UTC](https://discuss.elastic.co/t/how-to-check-if-then-else-whether-nummeric-between-2-signs-of-a-string/236310 "2020-06-09T10:07:36Z")
Hi there, I have this in my logs: check code '' is relevant check code '589' is relevant What I want to do in logstash: if \[field\] !~ check code '/^\[0-9\]+$/' is relavant! { mutate { update =\> {"sta… --- ## [Mapper parser exception when creating an index with mapping](https://discuss.elastic.co/t/mapper-parser-exception-when-creating-an-index-with-mapping/235833)
**Author:** [@Sesha\_Sai\_Suhash\_Des](https://discuss.elastic.co/u/Sesha_Sai_Suhash_Des)\ **Replies:** 3\ **Last updated:** [June 9, 2020, 10:03am UTC](https://discuss.elastic.co/t/mapper-parser-exception-when-creating-an-index-with-mapping/235833 "2020-06-09T10:03:26Z")
I am getting error when running the following command. I am a noob please help me. command : PUT /companydatabase?pretty { "mappings": { "employees": { "properties": { "FirstName… --- ## [Logstash log error format](https://discuss.elastic.co/t/logstash-log-error-format/236300)
**Author:** [@MagnusSectra](https://discuss.elastic.co/u/MagnusSectra)\ **Replies:** 0\ **Last updated:** [June 9, 2020, 9:43am UTC](https://discuss.elastic.co/t/logstash-log-error-format/236300 "2020-06-09T09:43:47Z")
We have a lot of hosts adding data to our logstash. When errors appear it would be nice to somehow get "sender" information. Is that possible? Example: Say that suddenly a XML parsing error appears in the logstash-plai… --- ## [I have configured logstash to send logs to diffrent indexes](https://discuss.elastic.co/t/i-have-configured-logstash-to-send-logs-to-diffrent-indexes/236291)
**Author:** [@altaf123](https://discuss.elastic.co/u/altaf123)\ **Replies:** 0\ **Last updated:** [June 9, 2020, 9:01am UTC](https://discuss.elastic.co/t/i-have-configured-logstash-to-send-logs-to-diffrent-indexes/236291 "2020-06-09T09:01:38Z")
i tried something like below, it is creating saparate indexes but i want to redirect only one machine logs to one index, but here in my case logs are clubbing if \[host.hostname\] == "fth-qa" { elasticsearch { hosts … --- ## [Xml PARSING IN LOGSTASH & filebeat](https://discuss.elastic.co/t/xml-parsing-in-logstash-filebeat/233072)
**Author:** [@Puneeth\_S\_B\_Gowda1](https://discuss.elastic.co/u/Puneeth_S_B_Gowda1)\ **Replies:** 1\ **Last updated:** [June 9, 2020, 9:00am UTC](https://discuss.elastic.co/t/xml-parsing-in-logstash-filebeat/233072 "2020-06-09T09:00:23Z")
Hi I got new task in ELK and i never worked on ELK My task is take xml data from mysql and store it in notepad and forward it through filebeat and pars it from logstash my xml i need BedType as saparate value in the c… --- ## [\[2020-06-03T17:14:02,261\]\[WARN \]\[org.logstash.instrument.metrics.gauge.LazyDelegatingGauge\]\[main\] A gauge metric of an unknown type (org.jruby.specialized.RubyArrayOneObject) has been created for key: cluster\_uuids. This may result in invalid seri](https://discuss.elastic.co/t/2020-06-03t1702-261-warn-org-logstash-instrument-metrics-gauge-lazydelegatinggauge-main-a-gauge-metric-of-an-unknown-type-org-jruby-specialized-rubyarrayoneobject-has-been-created-for-key-cluster-uuids-this-may-result-in-invalid-seri/235540)
**Author:** [@Puneeth\_S\_B\_Gowda1](https://discuss.elastic.co/u/Puneeth_S_B_Gowda1)\ **Replies:** 3\ **Last updated:** [June 9, 2020, 8:55am UTC](https://discuss.elastic.co/t/2020-06-03t1702-261-warn-org-logstash-instrument-metrics-gauge-lazydelegatinggauge-main-a-gauge-metric-of-an-unknown-type-org-jruby-specialized-rubyarrayoneobject-has-been-created-for-key-cluster-uuids-this-may-result-in-invalid-seri/235540 "2020-06-09T08:55:57Z")
\[2020-06-03T17:14:02,261\]\[WARN \]\[org.logstash.instrument.metrics.gauge.LazyDelegatingGauge\]\[main\] A gauge metric of an unknown type (org.jruby.specialized.RubyArrayOneObject) has been created for key: cluster\_uuids. This… --- ## [How to make Ruby selectively remove the top level field from a specific nested field pattern](https://discuss.elastic.co/t/how-to-make-ruby-selectively-remove-the-top-level-field-from-a-specific-nested-field-pattern/232733)
**Author:** [@kevin\_branch](https://discuss.elastic.co/u/kevin_branch)\ **Replies:** 4\ **Last updated:** [June 9, 2020, 8:53am UTC](https://discuss.elastic.co/t/how-to-make-ruby-selectively-remove-the-top-level-field-from-a-specific-nested-field-pattern/232733 "2020-06-09T08:53:10Z")
My Logstash instance will be receiving JSON records containing a wide variety of nested fields whose names start with \[data\]\[ecs\].... and I need to trim the \[data\] prefix off of all of those field names before indexing. … --- ## [Timeout when creating S3 repository (but success)](https://discuss.elastic.co/t/timeout-when-creating-s3-repository-but-success/235905)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 1\ **Last updated:** [June 8, 2020, 8:26am UTC](https://discuss.elastic.co/t/timeout-when-creating-s3-repository-but-success/235905 "2020-06-08T08:26:54Z")
Using elasticsearch (with basic licence) v7.7.0, on kubernetes (3 master / 2 data nodes). Other side, we have a minio server (S3 like). When creating a snapshot repository: PUT \_snapshot/unsecure\_minio { "type": "s3… --- ## [Filebeat Cisco Module not parssing the logfile from the path](https://discuss.elastic.co/t/filebeat-cisco-module-not-parssing-the-logfile-from-the-path/236281)
**Author:** [@Omar\_Samra](https://discuss.elastic.co/u/Omar_Samra)\ **Replies:** 0\ **Last updated:** [June 9, 2020, 8:01am UTC](https://discuss.elastic.co/t/filebeat-cisco-module-not-parssing-the-logfile-from-the-path/236281 "2020-06-09T08:01:59Z")
Iam a newbie using ELK stack , with this order Filebeat -\> elasticsearch -\> Kibana and using Cisco Module to parse a cisco asa firewall logs priblem is that the index of filebeat is created elasitcsearch but withou… --- ## [Indexing word, pdf documents?](https://discuss.elastic.co/t/indexing-word-pdf-documents/235758)
**Author:** [@vikramaddagulla](https://discuss.elastic.co/u/vikramaddagulla)\ **Replies:** 11\ **Last updated:** [June 9, 2020, 7:56am UTC](https://discuss.elastic.co/t/indexing-word-pdf-documents/235758 "2020-06-09T07:56:20Z")
Can someone please guide me to a step-by-step documentation to index a word or pdf document in elasticsearch ?? I have gone through couple of posts on this and came across FS crawler etc. I would like to know if there … --- ## [Geoip to geopoint](https://discuss.elastic.co/t/geoip-to-geopoint/236218)
**Author:** [@Rushabh\_Doshi](https://discuss.elastic.co/u/Rushabh_Doshi)\ **Replies:** 2\ **Last updated:** [June 9, 2020, 7:51am UTC](https://discuss.elastic.co/t/geoip-to-geopoint/236218 "2020-06-09T07:51:51Z")
geoip{ source =\> "IP" } how can i covert geo ip to geo point, as map is not accepting geoip what i need to add in logstash or fields.yml, i am using elk stack 7.X Need help --- ## [CreateSnapshotRequest in High Level Rest Client has a problem](https://discuss.elastic.co/t/createsnapshotrequest-in-high-level-rest-client-has-a-problem/236273)
**Author:** [@TheDevLuffy](https://discuss.elastic.co/u/TheDevLuffy)\ **Replies:** 1\ **Last updated:** [June 9, 2020, 7:22am UTC](https://discuss.elastic.co/t/createsnapshotrequest-in-high-level-rest-client-has-a-problem/236273 "2020-06-09T07:22:58Z")
Hello, Now, I'm using Amazon Elasticsearch Service with High Level Rest Client. Firstable, I tried to create snapshot with CreateSnapshotRequest. This trial has request body (following code block) according to http lo… --- ## [VisualizationのRange SliderRange Sliderのスライド幅が極端に小さくなってしまう](https://discuss.elastic.co/t/visualization-range-sliderrange-slider/236275)
**Author:** [@kuehara](https://discuss.elastic.co/u/kuehara)\ **Replies:** 0\ **Last updated:** [June 9, 2020, 6:46am UTC](https://discuss.elastic.co/t/visualization-range-sliderrange-slider/236275 "2020-06-09T06:46:00Z")
添付の画像のように極端に狭いスライダーができてしまうのですが、 この間隔を広くすることはできないものでしょうか。 Elastic Cloud V7.6.2の環境で発生してしまいます。 対処方法をご存知の方がおられましたらご教授いただきたいです。 --- ## [Csv output: add new line](https://discuss.elastic.co/t/csv-output-add-new-line/236265)
**Author:** [@cdra](https://discuss.elastic.co/u/cdra)\ **Replies:** 0\ **Last updated:** [June 9, 2020, 5:31am UTC](https://discuss.elastic.co/t/csv-output-add-new-line/236265 "2020-06-09T05:31:17Z")
My config file is: if \[type\] == "syslog" { csv { fields =\> \["Dia","Hora","Evento","Usuario","Politica","SesionID","Web","Enviado\_Bytes","Recibido\_Bytes","Origen","Destino"\] path =\> "D:\\NavegacionUsuarios\\Navegacion-… --- ## [Mongodb input plugin for logstash](https://discuss.elastic.co/t/mongodb-input-plugin-for-logstash/57254)
**Author:** [@sivapuvvada](https://discuss.elastic.co/u/sivapuvvada)\ **Replies:** 8\ **Last updated:** [June 9, 2020, 6:02am UTC](https://discuss.elastic.co/t/mongodb-input-plugin-for-logstash/57254 "2020-06-09T06:02:00Z")
Anyone could you please provide me the link to download mongoDB input plugin for logstash --- ## [JAVA\_HOME error at ES start, Ubuntu](https://discuss.elastic.co/t/java-home-error-at-es-start-ubuntu/236266)
**Author:** [@bajg](https://discuss.elastic.co/u/bajg)\ **Replies:** 0\ **Last updated:** [June 9, 2020, 5:31am UTC](https://discuss.elastic.co/t/java-home-error-at-es-start-ubuntu/236266 "2020-06-09T05:31:53Z")
I know that there is some topic about it already, but still can't fix it. I used this tutorial to install ES6 I got "JAVA\_HOME" error so before exported JAVA\_HOME . bitnami@bitnami-magento-b4b5:/$ export JAVA\_HOM… --- ## [Watcher alert for cluster nodes memory and disk](https://discuss.elastic.co/t/watcher-alert-for-cluster-nodes-memory-and-disk/236153)
**Author:** [@JG.91](https://discuss.elastic.co/u/JG.91)\ **Replies:** 1\ **Last updated:** [June 9, 2020, 5:20am UTC](https://discuss.elastic.co/t/watcher-alert-for-cluster-nodes-memory-and-disk/236153 "2020-06-09T05:20:45Z")
Hello friends, I want to know how I Can configure a watcher to alert when Elasticsearch nodes free memory or free disk space goes below a threshold? I mean what input search I should use in watcher JSON? Can you give … --- ## [Not finding a way to change Kibana Logo](https://discuss.elastic.co/t/not-finding-a-way-to-change-kibana-logo/236226)
**Author:** [@Ravi2](https://discuss.elastic.co/u/Ravi2)\ **Replies:** 1\ **Last updated:** [June 9, 2020, 4:23am UTC](https://discuss.elastic.co/t/not-finding-a-way-to-change-kibana-logo/236226 "2020-06-09T04:23:12Z")
Hello There, I have seen many topics that explain how to change Kibana logo once you log into it. However, if you are using ELK on the cloud ( SaaS) version, I do not see any way we can change the Kibana logo sine you c… --- ## [Best way to do log retention](https://discuss.elastic.co/t/best-way-to-do-log-retention/236190)
**Author:** [@arixmf](https://discuss.elastic.co/u/arixmf)\ **Replies:** 3\ **Last updated:** [June 9, 2020, 4:01am UTC](https://discuss.elastic.co/t/best-way-to-do-log-retention/236190 "2020-06-09T04:01:45Z")
What would be the best way to do log retention in Open Source Elasticsearch? I'm using Elasticsearch 7.6 and I was reading about lifecycle management, but as far as I understand, it's part of X-Pack. What is the best w… --- ## [How to merge all the values of a keyword to a single value and use it in controls visualization in logstash and elasticsearch](https://discuss.elastic.co/t/how-to-merge-all-the-values-of-a-keyword-to-a-single-value-and-use-it-in-controls-visualization-in-logstash-and-elasticsearch/236230)
**Author:** [@Matish\_Bhuyan](https://discuss.elastic.co/u/Matish_Bhuyan)\ **Replies:** 2\ **Last updated:** [June 9, 2020, 3:54am UTC](https://discuss.elastic.co/t/how-to-merge-all-the-values-of-a-keyword-to-a-single-value-and-use-it-in-controls-visualization-in-logstash-and-elasticsearch/236230 "2020-06-09T03:54:43Z")
Hi all I have one requirement for which i need one help from you all In my elastic search i have a keyword as owner.keyword which is to be used as dynamic filter Which i have completed using the controls visualization… --- ## [No result found in dashbaord](https://discuss.elastic.co/t/no-result-found-in-dashbaord/236258)
**Author:** [@chairxiao](https://discuss.elastic.co/u/chairxiao)\ **Replies:** 0\ **Last updated:** [June 9, 2020, 3:42am UTC](https://discuss.elastic.co/t/no-result-found-in-dashbaord/236258 "2020-06-09T03:42:51Z")
Hello, I use filebeat to collect IIS logs and import them into elk. Error logs have been displayed in discover over the past two hours, but no data is displayed in the dashboard charts. --- ## [Json filter message filed](https://discuss.elastic.co/t/json-filter-message-filed/236232)
**Author:** [@iramki90](https://discuss.elastic.co/u/iramki90)\ **Replies:** 3\ **Last updated:** [June 9, 2020, 3:41am UTC](https://discuss.elastic.co/t/json-filter-message-filed/236232 "2020-06-09T03:41:53Z")
I currently have 2 different type of log formats coming in Json format. message{ id:scenario1 ip:0.0.0. } message { id:scenario2 message: "This is a message field coming from application" } json { source =\> "message" … --- ## [How can my plugin access the current users role?](https://discuss.elastic.co/t/how-can-my-plugin-access-the-current-users-role/235837)
**Author:** [@Paul\_Gege](https://discuss.elastic.co/u/Paul_Gege)\ **Replies:** 1\ **Last updated:** [June 9, 2020, 3:27am UTC](https://discuss.elastic.co/t/how-can-my-plugin-access-the-current-users-role/235837 "2020-06-09T03:27:19Z")
Hi all, I'd like to be able to hide my plugin from being seen on the side-nav when a user does not have a certain role configured. How can I access the current user's role through my plugin? [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1398) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1400)