# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1459 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1460 --- ## [Filter results based on aggregated field](https://discuss.elastic.co/t/filter-results-based-on-aggregated-field/230149)
**Author:** [@vissu](https://discuss.elastic.co/u/vissu)\ **Replies:** 2\ **Last updated:** [May 11, 2020, 4:35am UTC](https://discuss.elastic.co/t/filter-results-based-on-aggregated-field/230149 "2020-05-11T04:35:47Z")
Hi Team, How do we filter results on a aggregated field. For example: i have a built a visulation table which will show the average value of memory used over some interval. i want to add a condition on the table to sho… --- ## [Hot-Warm nodes - Indexes replicated across nodes](https://discuss.elastic.co/t/hot-warm-nodes-indexes-replicated-across-nodes/231240)
**Author:** [@Camilo\_Diaz](https://discuss.elastic.co/u/Camilo_Diaz)\ **Replies:** 4\ **Last updated:** [May 11, 2020, 4:01am UTC](https://discuss.elastic.co/t/hot-warm-nodes-indexes-replicated-across-nodes/231240 "2020-05-11T04:01:36Z")
Hi, I have 2 data nodes, one as master (hot) and other as data (warm) authmattix x.x.x. box\_type hot pukeko x.x.x.x box\_type warm I have set all the indexes to number\_of\_replicas= 0 on … --- ## [Failed to create Logstash keystore Only PrivateKey storage is supported](https://discuss.elastic.co/t/failed-to-create-logstash-keystore-only-privatekey-storage-is-supported/231914)
**Author:** [@bootham13](https://discuss.elastic.co/u/bootham13)\ **Replies:** 0\ **Last updated:** [May 11, 2020, 3:50am UTC](https://discuss.elastic.co/t/failed-to-create-logstash-keystore-only-privatekey-storage-is-supported/231914 "2020-05-11T03:50:31Z")
Hi, I am trying to create the logstash keystore to store the keys, whenever I try to create the store I get the below mentioned error. I am attaching the logs from the error. I am logged in as root when I try to install… --- ## [Single jmx configuration json file possible for multiple servers to connect to logstash](https://discuss.elastic.co/t/single-jmx-configuration-json-file-possible-for-multiple-servers-to-connect-to-logstash/231660)
**Author:** [@Bhanu\_Praveen](https://discuss.elastic.co/u/Bhanu_Praveen)\ **Replies:** 2\ **Last updated:** [May 11, 2020, 2:48am UTC](https://discuss.elastic.co/t/single-jmx-configuration-json-file-possible-for-multiple-servers-to-connect-to-logstash/231660 "2020-05-11T02:48:15Z")
Hello, Currently i have configured single jmx json file for a single server in logstash jmx input configuration as below. \[{ "host" : "localhost" , "port" : 9000, "alias" : "jmx.elasticsearch" , "queries" : \[ { … --- ## [Initializing variable in ruby logstash filter](https://discuss.elastic.co/t/initializing-variable-in-ruby-logstash-filter/231875)
**Author:** [@sajjad0927](https://discuss.elastic.co/u/sajjad0927)\ **Replies:** 2\ **Last updated:** [May 11, 2020, 2:20am UTC](https://discuss.elastic.co/t/initializing-variable-in-ruby-logstash-filter/231875 "2020-05-11T02:20:16Z")
Can I do multiple initialization in logstash ruby filter like below. For me it is giving error ruby { init =\> "@buffer = 377" init =\> "@buffer1 = 477" code =\> " --- ## [Ingesting .gz files in elastic](https://discuss.elastic.co/t/ingesting-gz-files-in-elastic/231910)
**Author:** [@hsalim](https://discuss.elastic.co/u/hsalim)\ **Replies:** 6\ **Last updated:** [May 11, 2020, 1:33am UTC](https://discuss.elastic.co/t/ingesting-gz-files-in-elastic/231910 "2020-05-11T01:33:11Z")
Hello, I know this topic has been discussed in the past, but I am unable to find any new information. So asking again to see if anyone can offer an update. Is there a way to ingest .gz files in elastic without unzippin… --- ## [Rollup Jobs - allocation only on defined nodes?](https://discuss.elastic.co/t/rollup-jobs-allocation-only-on-defined-nodes/231897)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 1\ **Last updated:** [May 10, 2020, 11:38pm UTC](https://discuss.elastic.co/t/rollup-jobs-allocation-only-on-defined-nodes/231897 "2020-05-10T23:38:33Z")
Hi, Is it possible to define that data from the Rollups should always be allocated only on certain nodes? I'm thinking of an automatic setting. If I'm not mistaken, I can set the ILM to Rollup. Nevertheless, for the … --- ## [How to backup spaces and user,roles of elasticsearch](https://discuss.elastic.co/t/how-to-backup-spaces-and-user-roles-of-elasticsearch/231742)
**Author:** [@Dragon9](https://discuss.elastic.co/u/Dragon9)\ **Replies:** 1\ **Last updated:** [May 10, 2020, 11:21pm UTC](https://discuss.elastic.co/t/how-to-backup-spaces-and-user-roles-of-elasticsearch/231742 "2020-05-10T23:21:15Z")
when i bounce elasticsearch and launch new application every time i need to create user,roles,and spaces in elasticsearch . i follow saved objects like dashboards using export ndjson file it is very helpful . so like … --- ## [Exception in thread "main" java.lang.RuntimeException: starting java failed with \[1\] : Failed to start Elasticsearch](https://discuss.elastic.co/t/exception-in-thread-main-java-lang-runtimeexception-starting-java-failed-with-1-failed-to-start-elasticsearch/231857)
**Author:** [@proxx](https://discuss.elastic.co/u/proxx)\ **Replies:** 1\ **Last updated:** [May 10, 2020, 11:13pm UTC](https://discuss.elastic.co/t/exception-in-thread-main-java-lang-runtimeexception-starting-java-failed-with-1-failed-to-start-elasticsearch/231857 "2020-05-10T23:13:04Z")
Hi, I'm using Elasticsearch 7.6.1, after installing Elasticsearch 7.6.1 rpm. I'm unable to start elasticsearch service. Error \[@o\* ~\] sudo systemctl status elasticsearch ● elasticsearch.service - Elasticsearch Loade… --- ## [Find and delete duplicate documents in Elasticsearch](https://discuss.elastic.co/t/find-and-delete-duplicate-documents-in-elasticsearch/231533)
**Author:** [@Youssef\_SBAI](https://discuss.elastic.co/u/Youssef_SBAI)\ **Replies:** 4\ **Last updated:** [May 10, 2020, 11:03pm UTC](https://discuss.elastic.co/t/find-and-delete-duplicate-documents-in-elasticsearch/231533 "2020-05-10T23:03:11Z")
I use python for find and delete duplicate documents in Elasticsearch I use this script but i have an error #!/usr/local/bin/python3 import hashlib from elasticsearch import Elasticsearch es = Elasticsearch(\["localhost… --- ## [How to run Cloud Logstash Pipeline](https://discuss.elastic.co/t/how-to-run-cloud-logstash-pipeline/231906)
**Author:** [@Holguinmora](https://discuss.elastic.co/u/Holguinmora)\ **Replies:** 1\ **Last updated:** [May 10, 2020, 10:56pm UTC](https://discuss.elastic.co/t/how-to-run-cloud-logstash-pipeline/231906 "2020-05-10T22:56:55Z")
Hi I´m trying to run a cloud logstash pipeline that has the next code to start working with the mail filters but I have not been able to find code to try it inside the pipeline or how to run it outside of the pipeline … --- ## [Limit amount of dynamic fields to a 1000](https://discuss.elastic.co/t/limit-amount-of-dynamic-fields-to-a-1000/231908)
**Author:** [@galbash](https://discuss.elastic.co/u/galbash)\ **Replies:** 0\ **Last updated:** [May 10, 2020, 8:48pm UTC](https://discuss.elastic.co/t/limit-amount-of-dynamic-fields-to-a-1000/231908 "2020-05-10T20:48:43Z")
Hi all, My use case is that I am indexing documents over which I have little control, and would like to use dynamic mappings. However, I would like to limit the number of fields in each index to a 1,000 (the default val… --- ## [Ruby exception occurred: undefined method '\[\]' for nil:NilClass when filtering csv](https://discuss.elastic.co/t/ruby-exception-occurred-undefined-method-for-nil-nilclass-when-filtering-csv/231893)
**Author:** [@eeijlar](https://discuss.elastic.co/u/eeijlar)\ **Replies:** 2\ **Last updated:** [May 10, 2020, 7:43pm UTC](https://discuss.elastic.co/t/ruby-exception-occurred-undefined-method-for-nil-nilclass-when-filtering-csv/231893 "2020-05-10T19:43:28Z")
I can't figure out why this filter is throwing this error: Ruby exception occurred: undefined method \[\] for nil:NilClass I have added a check anytime ruby could have thrown an exception: filter { ruby { code … --- ## [Ways to speed up a date range query with an aggregation of a parent child field](https://discuss.elastic.co/t/ways-to-speed-up-a-date-range-query-with-an-aggregation-of-a-parent-child-field/231899)
**Author:** [@shocking\_black](https://discuss.elastic.co/u/shocking_black)\ **Replies:** 0\ **Last updated:** [May 10, 2020, 6:00pm UTC](https://discuss.elastic.co/t/ways-to-speed-up-a-date-range-query-with-an-aggregation-of-a-parent-child-field/231899 "2020-05-10T18:00:36Z")
Am trying to implement a "trending" feature for our video site based on date-tagged user favorites of videos. Our schema consists of Video documents with Favorites implemented as a child document of Videos, and each Fav… --- ## [JDBC Input Multiple sql statements as sub-query](https://discuss.elastic.co/t/jdbc-input-multiple-sql-statements-as-sub-query/231787)
**Author:** [@myersman](https://discuss.elastic.co/u/myersman)\ **Replies:** 2\ **Last updated:** [May 10, 2020, 11:07am UTC](https://discuss.elastic.co/t/jdbc-input-multiple-sql-statements-as-sub-query/231787 "2020-05-10T11:07:01Z")
I want to know if the jdbc input plugin allows me to query multiple tables where the second table runs only for a key value from the first. I presume the config would look something like... input { jdbc { jdbc\_dr… --- ## [Login page for Kibana 7.6 Basic license](https://discuss.elastic.co/t/login-page-for-kibana-7-6-basic-license/231537)
**Author:** [@nityaraj06](https://discuss.elastic.co/u/nityaraj06)\ **Replies:** 9\ **Last updated:** [May 10, 2020, 4:25pm UTC](https://discuss.elastic.co/t/login-page-for-kibana-7-6-basic-license/231537 "2020-05-10T16:25:13Z")
Hi, I have been looking at options to add a login page in the Kibana 7.6 basic license. I have tried it using x-pack but it seems like it is not possible with basic license. Followed these links - https://www.elastic.… --- ## [One node have less shards then the others](https://discuss.elastic.co/t/one-node-have-less-shards-then-the-others/231001)
**Author:** [@Burga](https://discuss.elastic.co/u/Burga)\ **Replies:** 2\ **Last updated:** [May 10, 2020, 2:32pm UTC](https://discuss.elastic.co/t/one-node-have-less-shards-then-the-others/231001 "2020-05-10T14:32:42Z")
Hi , we have a 9 node cluster where one node has almost half shards then the others but using more capacity then others. what could be the reason of this behavour ? and how can it be solved , rebalance ? by the way… --- ## [After logstash upgrade split array not working](https://discuss.elastic.co/t/after-logstash-upgrade-split-array-not-working/231866)
**Author:** [@vijay\_kaali](https://discuss.elastic.co/u/vijay_kaali)\ **Replies:** 2\ **Last updated:** [May 10, 2020, 1:49pm UTC](https://discuss.elastic.co/t/after-logstash-upgrade-split-array-not-working/231866 "2020-05-10T13:49:00Z")
I have upgraded logstash from 6.2 \> 6.8 and currently in 7.6.2-1 mutate { add\_field =\> { "shorthost2" =\> "%{\[pythonbeat\]\[Hostname\]}" } } mutate { split =\> \[ "shorthost2", "." \] add\_field =\> { "shorthost" =\> "%{sh… --- ## [Redirection to log message from graphs/charts](https://discuss.elastic.co/t/redirection-to-log-message-from-graphs-charts/231867)
**Author:** [@nikhilesh](https://discuss.elastic.co/u/nikhilesh)\ **Replies:** 1\ **Last updated:** [May 10, 2020, 10:40am UTC](https://discuss.elastic.co/t/redirection-to-log-message-from-graphs-charts/231867 "2020-05-10T10:40:30Z")
Hi All, Can any one please help on the below points ? When we click on the graphical charts( line, bar, pie) it should re-direct to log file of the error. is it possible? Already i have applied grok filter for my … --- ## [Transform index is not updating the records in destination index in batch process](https://discuss.elastic.co/t/transform-index-is-not-updating-the-records-in-destination-index-in-batch-process/230626)
**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\ **Replies:** 11\ **Last updated:** [May 10, 2020, 9:53am UTC](https://discuss.elastic.co/t/transform-index-is-not-updating-the-records-in-destination-index-in-batch-process/230626 "2020-05-10T09:53:53Z")
I have created transorm index in kibana with aggregations. The records are updated to destination index. I have updated the frequesncy as 10m and started the transform as below. POST \_transform/test-transform/\_update … --- ## [Shards initializing randomly](https://discuss.elastic.co/t/shards-initializing-randomly/229395)
**Author:** [@Lior\_Yakobov](https://discuss.elastic.co/u/Lior_Yakobov)\ **Replies:** 2\ **Last updated:** [May 10, 2020, 8:06am UTC](https://discuss.elastic.co/t/shards-initializing-randomly/229395 "2020-05-10T08:06:15Z")
Hello, I have upgraded my cluster to 7.5.2 around 2 weeks ago, and I'm seeing strange behavior related to shards ever since. (cluster running on EC2 Centos 7, RPM based Elasticsearch 7.5.2). For some reason, without a… --- ## [Separate process setup and write winlogbeat](https://discuss.elastic.co/t/separate-process-setup-and-write-winlogbeat/231733)
**Author:** [@orsa](https://discuss.elastic.co/u/orsa)\ **Replies:** 1\ **Last updated:** [May 9, 2020, 9:57pm UTC](https://discuss.elastic.co/t/separate-process-setup-and-write-winlogbeat/231733 "2020-05-09T21:57:09Z")
Hi I probably do not understand correctly what parameters should be in the configuration files when separating the installation process and writing data. Please help me understand how it works correctly my setup YML f… --- ## [Search\_as\_you\_type usage](https://discuss.elastic.co/t/search-as-you-type-usage/231506)
**Author:** [@CSharpBender](https://discuss.elastic.co/u/CSharpBender)\ **Replies:** 3\ **Last updated:** [May 9, 2020, 11:40am UTC](https://discuss.elastic.co/t/search-as-you-type-usage/231506 "2020-05-09T11:40:36Z")
Hello, I'm trying to make a search that orders the results by: -exact match -starts with -phrase match -exact words -fuzzy I'm using Elasticsearch 7.6.1 and after trying to make my own query I noticed that there i… --- ## [CISCO Grok Fail](https://discuss.elastic.co/t/cisco-grok-fail/231802)
**Author:** [@clockard](https://discuss.elastic.co/u/clockard)\ **Replies:** 2\ **Last updated:** [May 9, 2020, 6:40pm UTC](https://discuss.elastic.co/t/cisco-grok-fail/231802 "2020-05-09T18:40:52Z")
Let me say I am a network guy so take that for what it is worth. I have spent weeks googling, testing, and debugging I tried not to hassle anyone. I am trying to Grok the following data. \<134\>May 08 2020 10:50:53: %ASA… --- ## [How to change log directory for Kibana?](https://discuss.elastic.co/t/how-to-change-log-directory-for-kibana/231762)
**Author:** [@Ankit\_Sus](https://discuss.elastic.co/u/Ankit_Sus)\ **Replies:** 1\ **Last updated:** [May 9, 2020, 6:36pm UTC](https://discuss.elastic.co/t/how-to-change-log-directory-for-kibana/231762 "2020-05-09T18:36:20Z")
I have used logging.dest in my kibana.yml but I don't see logs being generated in this location. I have also created a file "kibana.log" expecting it would write to it but no luck. The file has all the permissions. logg… --- ## [Override discovery.type=single-node in docker-compose.yml](https://discuss.elastic.co/t/override-discovery-type-single-node-in-docker-compose-yml/231622)
**Author:** [@braddre](https://discuss.elastic.co/u/braddre)\ **Replies:** 2\ **Last updated:** [May 9, 2020, 5:47pm UTC](https://discuss.elastic.co/t/override-discovery-type-single-node-in-docker-compose-yml/231622 "2020-05-09T17:47:20Z")
I'm using two -c yaml files on the docker-compose command line to provide override of Elasticsearch settings. I have the base settings in docker-compose.yml in the services.elasticsearch.environment, and the override in… --- ## [Possibilities of increasing data security in elasticsearch - power failures \[?\]](https://discuss.elastic.co/t/possibilities-of-increasing-data-security-in-elasticsearch-power-failures/231839)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 5\ **Last updated:** [May 9, 2020, 5:36pm UTC](https://discuss.elastic.co/t/possibilities-of-increasing-data-security-in-elasticsearch-power-failures/231839 "2020-05-09T17:36:53Z")
Hi, Relatively simple question about the configuration of elasticsearch with respect to specific data security. Are there any possibilities to configure an elasticsearch cluster so that in case of a power failure there… --- ## [Logstash Service is ignoring pipelines.yml](https://discuss.elastic.co/t/logstash-service-is-ignoring-pipelines-yml/231844)
**Author:** [@mukeshkundergep](https://discuss.elastic.co/u/mukeshkundergep)\ **Replies:** 1\ **Last updated:** [May 9, 2020, 3:41pm UTC](https://discuss.elastic.co/t/logstash-service-is-ignoring-pipelines-yml/231844 "2020-05-09T15:41:26Z")
Logstash Service is ignoring pipeline.yml instead of providing following information pipeline.id: pipeline1 path.config: "/etc/logstash/conf.d/test1.conf" queue.type: persisted pipeline.id: pipeline2 path.config: "/… --- ## [Elasticsearch Watcher Rate function query](https://discuss.elastic.co/t/elasticsearch-watcher-rate-function-query/231570)
**Author:** [@rj23495](https://discuss.elastic.co/u/rj23495)\ **Replies:** 3\ **Last updated:** [May 9, 2020, 3:30pm UTC](https://discuss.elastic.co/t/elasticsearch-watcher-rate-function-query/231570 "2020-05-09T15:30:53Z")
Hi All, I wish to create a watch in elasticsearch based on rate function of logstash emitted events as seen in monitoring overview of logstash. How should i go about in creating a watch for the purpose as in if rate of… --- ## [Shards failure - recovery possible?](https://discuss.elastic.co/t/shards-failure-recovery-possible/231834)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 6\ **Last updated:** [May 9, 2020, 3:10pm UTC](https://discuss.elastic.co/t/shards-failure-recovery-possible/231834 "2020-05-09T15:10:19Z")
Hi, Unfortunately, there was a problem on my cluster when the power was switched off. Cluster has RED status - a few shards do not want to get up. I've tried using reroute: POST /\_cluster/reroute?retry\_failed=true b… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1458) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1460)