# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1468 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1469 --- ## [S3 input plugin is failing when running logstash on kubernetes](https://discuss.elastic.co/t/s3-input-plugin-is-failing-when-running-logstash-on-kubernetes/231261)
**Author:** [@user2416](https://discuss.elastic.co/u/user2416)\ **Replies:** 0\ **Last updated:** [May 6, 2020, 5:31am UTC](https://discuss.elastic.co/t/s3-input-plugin-is-failing-when-running-logstash-on-kubernetes/231261 "2020-05-06T05:31:46Z")
hi, I am running logstash on kubernetes and using s3 input plugin to read logs from S3 and send it to elasticsearch. Pod is being crashloopback with the below error. Can someone help me with this issue? error: \[2020-0… --- ## [Suggestion Size](https://discuss.elastic.co/t/suggestion-size/231121)
**Author:** [@111329](https://discuss.elastic.co/u/111329)\ **Replies:** 1\ **Last updated:** [May 6, 2020, 4:54am UTC](https://discuss.elastic.co/t/suggestion-size/231121 "2020-05-06T04:54:35Z")
hello, I have some Issue with the number of suggestions to return field (size) the first query is size equal to 1 POST ja-search-data-prod/\_search { "suggest": { "promotion-suggest": { … --- ## [Date histogram ignores timezone](https://discuss.elastic.co/t/date-histogram-ignores-timezone/231247)
**Author:** [@Quang\_D\_Tr\_n](https://discuss.elastic.co/u/Quang_D_Tr_n)\ **Replies:** 0\ **Last updated:** [May 6, 2020, 4:15am UTC](https://discuss.elastic.co/t/date-histogram-ignores-timezone/231247 "2020-05-06T04:15:16Z")
I have date field "local\_time": "2020-04-10T23:00:52.000-0600" which stores the local time (various timezones). Now I want to use date\_histogram to group data by day but it auto converts the above time to UTC and it wil… --- ## [How can I setup file offset state with filebeat source code?](https://discuss.elastic.co/t/how-can-i-setup-file-offset-state-with-filebeat-source-code/231084)
**Author:** [@thangld](https://discuss.elastic.co/u/thangld)\ **Replies:** 1\ **Last updated:** [May 6, 2020, 2:22am UTC](https://discuss.elastic.co/t/how-can-i-setup-file-offset-state-with-filebeat-source-code/231084 "2020-05-06T02:22:00Z")
I'm trying to import filebeat source code to read text from file. I understand that filebeat saves offset to filesystem so when it restarts, it won't read text from beginning of the file. How can I implement this functio… --- ## [Aggregation : take only one instance of document based on field](https://discuss.elastic.co/t/aggregation-take-only-one-instance-of-document-based-on-field/231225)
**Author:** [@pkrawat1](https://discuss.elastic.co/u/pkrawat1)\ **Replies:** 1\ **Last updated:** [May 6, 2020, 1:57am UTC](https://discuss.elastic.co/t/aggregation-take-only-one-instance-of-document-based-on-field/231225 "2020-05-06T01:57:19Z")
I have a data that looks like this \[ { "created\_at": "2020-05-05", "candidate\_id" : 43, "state": "a" }, { "created\_at": "2020-05-06", "candidate\_id" : 43, "state": "b… --- ## [Logstash shutting down without noticable error](https://discuss.elastic.co/t/logstash-shutting-down-without-noticable-error/231236)
**Author:** [@Thaylin](https://discuss.elastic.co/u/Thaylin)\ **Replies:** 2\ **Last updated:** [May 6, 2020, 1:42am UTC](https://discuss.elastic.co/t/logstash-shutting-down-without-noticable-error/231236 "2020-05-06T01:42:05Z")
For some reason after logstash starts the API endpoint it shuts down. \[2020-05-05T20:22:54,694\]\[WARN \]\[logstash.config.source.multilocal\] Ignoring the 'pipelines.yml' file because modules or command line options are sp… --- ## [Index creation slows down over time](https://discuss.elastic.co/t/index-creation-slows-down-over-time/230775)
**Author:** [@astevenson](https://discuss.elastic.co/u/astevenson)\ **Replies:** 15\ **Last updated:** [May 5, 2020, 10:42pm UTC](https://discuss.elastic.co/t/index-creation-slows-down-over-time/230775 "2020-05-05T22:42:02Z")
We have a ruby test suite that creates and deletes our indices between tests. Under elasticsearch 5.6 this runs consistently very fast. Under 6.8 it degrades over time. And under 7.6 it is slow off the bat. I made a gene… --- ## [Kibana 4.1 metric visualization round decimal value](https://discuss.elastic.co/t/kibana-4-1-metric-visualization-round-decimal-value/24098)
**Author:** [@rajeshchinnam1985](https://discuss.elastic.co/u/rajeshchinnam1985)\ **Replies:** 22\ **Last updated:** [May 5, 2020, 10:23pm UTC](https://discuss.elastic.co/t/kibana-4-1-metric-visualization-round-decimal-value/24098 "2020-05-05T22:23:19Z")
Thanks in advance.. I am using kibana 4.1 and trying to create a metric visualization which returning me a value of 135.649 how can I round off this value 135.65 How can I do this --- ## [Classifying different events using logstash](https://discuss.elastic.co/t/classifying-different-events-using-logstash/231229)
**Author:** [@Ram\_Jeghan](https://discuss.elastic.co/u/Ram_Jeghan)\ **Replies:** 0\ **Last updated:** [May 5, 2020, 9:55pm UTC](https://discuss.elastic.co/t/classifying-different-events-using-logstash/231229 "2020-05-05T21:55:50Z")
Hi, We have log events from different sources: windows syslog firewall -database etc dumped into the same file from a legacy process. event1 could be windows, event2 could be oracle etc., What would be the best … --- ## [Cant send mail alert through watcher](https://discuss.elastic.co/t/cant-send-mail-alert-through-watcher/229011)
**Author:** [@rakeshraagu2](https://discuss.elastic.co/u/rakeshraagu2)\ **Replies:** 6\ **Last updated:** [May 5, 2020, 8:59pm UTC](https://discuss.elastic.co/t/cant-send-mail-alert-through-watcher/229011 "2020-05-05T20:59:35Z")
Hi, When I testing my mail alert using watcher it is showing an error that mail send failed. In my cluster log file I saw below given line. Can anyoone help. \]\[ERROR\]\[o.e.x.w.a.e.ExecutableEmailAction\] \[elk-master\] fa… --- ## [Upgrade from 6 to 7: This index has more than one mapping type, which is not supported in 7.0](https://discuss.elastic.co/t/upgrade-from-6-to-7-this-index-has-more-than-one-mapping-type-which-is-not-supported-in-7-0/231220)
**Author:** [@gdreyv](https://discuss.elastic.co/u/gdreyv)\ **Replies:** 0\ **Last updated:** [May 5, 2020, 8:58pm UTC](https://discuss.elastic.co/t/upgrade-from-6-to-7-this-index-has-more-than-one-mapping-type-which-is-not-supported-in-7-0/231220 "2020-05-05T20:58:10Z")
I faced the error "This index has more than one mapping type, which is not supported in 7.0. This index must be reindexed into one or more single-type indices." How can I do this? I'm ok to convert \_type into the propert… --- ## [Archive logs from elasticsearch to s3 in a readable format](https://discuss.elastic.co/t/archive-logs-from-elasticsearch-to-s3-in-a-readable-format/231219)
**Author:** [@Ilan\_Peretz](https://discuss.elastic.co/u/Ilan_Peretz)\ **Replies:** 0\ **Last updated:** [May 5, 2020, 8:44pm UTC](https://discuss.elastic.co/t/archive-logs-from-elasticsearch-to-s3-in-a-readable-format/231219 "2020-05-05T20:44:53Z")
hello, i need to archive data from elasticsearch to s3, like there is in logz.io. the thing is, in logz.io the data get to S3 in a readable format (json), and then i can manipulate it however i need. when i do a snaps… --- ## [When applying ingest pipeline it fails with "Parse execption, request body is required"](https://discuss.elastic.co/t/when-applying-ingest-pipeline-it-fails-with-parse-execption-request-body-is-required/230788)
**Author:** [@syost](https://discuss.elastic.co/u/syost)\ **Replies:** 3\ **Last updated:** [May 5, 2020, 8:34pm UTC](https://discuss.elastic.co/t/when-applying-ingest-pipeline-it-fails-with-parse-execption-request-body-is-required/230788 "2020-05-05T20:34:27Z")
I have filebeats going and I'm trying to play around with ingest pipelines. I have accessed the console and defined the following pipeline... PUT \_ingest/pipeline/upper { "description": "Testing lower to uppercase on … --- ## [Logstash jdbc using tns results in error "Unknown host specified"](https://discuss.elastic.co/t/logstash-jdbc-using-tns-results-in-error-unknown-host-specified/230498)
**Author:** [@philippeE](https://discuss.elastic.co/u/philippeE)\ **Replies:** 14\ **Last updated:** [May 5, 2020, 8:11pm UTC](https://discuss.elastic.co/t/logstash-jdbc-using-tns-results-in-error-unknown-host-specified/230498 "2020-05-05T20:11:47Z")
Hello, I try to use jdbc to connect to my oracle server using tns. logstash.conf: input { jdbc { jdbc\_driver\_library =\> "" jdbc\_driver\_class =\> "Java::oracle.jdbc.driver.OracleDriver" jdbc\_connection\_string =\> "j… --- ## [Snapshot to S3 from elasticsearch cloud](https://discuss.elastic.co/t/snapshot-to-s3-from-elasticsearch-cloud/231118)
**Author:** [@Ilan\_Peretz](https://discuss.elastic.co/u/Ilan_Peretz)\ **Replies:** 3\ **Last updated:** [May 5, 2020, 8:06pm UTC](https://discuss.elastic.co/t/snapshot-to-s3-from-elasticsearch-cloud/231118 "2020-05-05T20:06:34Z")
hello, we're using elastic.co cloud service, platinum license. we want to snapshot logs to S3 bucket. repository-s3 is installed on the server. when using the devtools with this command: PUT /\_snapshot/s3\_snapshot1… --- ## [Cant start elasticsearch after update from 6.6.2 to 7.6.2](https://discuss.elastic.co/t/cant-start-elasticsearch-after-update-from-6-6-2-to-7-6-2/231195)
**Author:** [@Deny7](https://discuss.elastic.co/u/Deny7)\ **Replies:** 5\ **Last updated:** [May 5, 2020, 7:26pm UTC](https://discuss.elastic.co/t/cant-start-elasticsearch-after-update-from-6-6-2-to-7-6-2/231195 "2020-05-05T19:26:29Z")
Hi, I want to do full elk stack upgrade from 6.6.2 to 7.6.2. Started with elasticsearch. I did snapshot backup. Followed this guide https://www.elastic.co/guide/en/elasticsearch/reference/7.6/restart-upgrade.html Downl… --- ## [Logstash 7.6.2 / Unable to produce output](https://discuss.elastic.co/t/logstash-7-6-2-unable-to-produce-output/231211)
**Author:** [@sc5283](https://discuss.elastic.co/u/sc5283)\ **Replies:** 0\ **Last updated:** [May 5, 2020, 7:08pm UTC](https://discuss.elastic.co/t/logstash-7-6-2-unable-to-produce-output/231211 "2020-05-05T19:08:02Z")
I am running rhel 7.8 / logstash 7.6.2 (as root) logstash is unable to produce any output (tested elastic, file, and stdout) executing: /usr/share/logstash/bin/logstash -f /etc/logstash/testdata/test\_file.conf --log.… --- ## [Logstash - JSON Filter to get inner json fields](https://discuss.elastic.co/t/logstash-json-filter-to-get-inner-json-fields/231022)
**Author:** [@Rekha\_Dhinagaran](https://discuss.elastic.co/u/Rekha_Dhinagaran)\ **Replies:** 1\ **Last updated:** [May 5, 2020, 7:14pm UTC](https://discuss.elastic.co/t/logstash-json-filter-to-get-inner-json-fields/231022 "2020-05-05T19:14:12Z")
Hi, This is my event log, {'\_index': 'logstash-2020.05.03', '\_type': '\_doc', '\_id': 'xXKW2XEB43wd9fLrXQnQ', '\_score': 1.0, '\_source': {'@version': '1', 'beat': {'version': '6.2.4', 'name': 'cb-rekha.local', 'hostname':… --- ## [Logstash JDBC analyzers](https://discuss.elastic.co/t/logstash-jdbc-analyzers/231210)
**Author:** [@Kevin\_Juliano](https://discuss.elastic.co/u/Kevin_Juliano)\ **Replies:** 0\ **Last updated:** [May 5, 2020, 7:07pm UTC](https://discuss.elastic.co/t/logstash-jdbc-analyzers/231210 "2020-05-05T19:07:06Z")
Hi Everyone, I'm still new to Elastic. I am trying to use the snowball or porter\_strem analyzer but I have no Idea how to do it with JDBC Logstash and PostgreSQL, as far as I search and looked for solution,to use this fe… --- ## [Logstash server running Salesforce-plugin](https://discuss.elastic.co/t/logstash-server-running-salesforce-plugin/229360)
**Author:** [@eemtzc](https://discuss.elastic.co/u/eemtzc)\ **Replies:** 4\ **Last updated:** [May 5, 2020, 6:20pm UTC](https://discuss.elastic.co/t/logstash-server-running-salesforce-plugin/229360 "2020-05-05T18:20:37Z")
Hello, I have a logstash server specifically to run salesforce-plugin to update a pipeline. Everything "works" good except for the fact that recently found out that the logstash service on this server restarts every 12-… --- ## [Unable to enable security on elk instance using puppet](https://discuss.elastic.co/t/unable-to-enable-security-on-elk-instance-using-puppet/231179)
**Author:** [@Thaylin](https://discuss.elastic.co/u/Thaylin)\ **Replies:** 4\ **Last updated:** [May 5, 2020, 6:05pm UTC](https://discuss.elastic.co/t/unable-to-enable-security-on-elk-instance-using-puppet/231179 "2020-05-05T18:05:36Z")
I currently have a puppet configuration of the elasticsearch and kibana, however I cannot get security to enable so I can setup users and then enable the logstash. When I enable the securty it still allows me into the UI… --- ## [Nested Date fields not showing up in date histogram/date range](https://discuss.elastic.co/t/nested-date-fields-not-showing-up-in-date-histogram-date-range/231202)
**Author:** [@sana\_es](https://discuss.elastic.co/u/sana_es)\ **Replies:** 1\ **Last updated:** [May 5, 2020, 6:04pm UTC](https://discuss.elastic.co/t/nested-date-fields-not-showing-up-in-date-histogram-date-range/231202 "2020-05-05T18:04:45Z")
I am working with a Nested field with date data type for as starting and ending duration. I would like to use use those fields for date histograms in data table and also to create drop down with control. I am not able t… --- ## [In a cluster, changes in elasticsearch.yml must be replicated in all nodes?](https://discuss.elastic.co/t/in-a-cluster-changes-in-elasticsearch-yml-must-be-replicated-in-all-nodes/231181)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 3\ **Last updated:** [May 5, 2020, 5:33pm UTC](https://discuss.elastic.co/t/in-a-cluster-changes-in-elasticsearch-yml-must-be-replicated-in-all-nodes/231181 "2020-05-05T17:33:04Z")
Hi, previously I have made changes to elasticsearch.yml and replicated those changes in all nodes, no Im about to configure xpack.notification.email and I was wandering if it necessary to add this lines in all nodes in m… --- ## [Pagination for REST API Through Logstash](https://discuss.elastic.co/t/pagination-for-rest-api-through-logstash/231060)
**Author:** [@Mahmmoud\_Rashed](https://discuss.elastic.co/u/Mahmmoud_Rashed)\ **Replies:** 2\ **Last updated:** [May 5, 2020, 5:29pm UTC](https://discuss.elastic.co/t/pagination-for-rest-api-through-logstash/231060 "2020-05-05T17:29:26Z")
How can I import from a REST API to Elasticsearch via Logstash using Pagination? I was able to import using http\_poller but unfortunately, it doesn't support pagination, so how can I write force a custom script or "for … --- ## [Logstash-codec-json stopped working](https://discuss.elastic.co/t/logstash-codec-json-stopped-working/231196)
**Author:** [@chrome\_test](https://discuss.elastic.co/u/chrome_test)\ **Replies:** 0\ **Last updated:** [May 5, 2020, 4:32pm UTC](https://discuss.elastic.co/t/logstash-codec-json-stopped-working/231196 "2020-05-05T16:32:03Z")
I used logstash-codec-json plugin for a POC deployment on AWS, the related configuration is as below. input { udp { port =\> "9999" type =\> "mylog" codec =\> json buffer\_size =\> 65536 … --- ## [LogStash Config File - Grok Regex](https://discuss.elastic.co/t/logstash-config-file-grok-regex/231016)
**Author:** [@Karanbir\_Mann](https://discuss.elastic.co/u/Karanbir_Mann)\ **Replies:** 2\ **Last updated:** [May 5, 2020, 5:20pm UTC](https://discuss.elastic.co/t/logstash-config-file-grok-regex/231016 "2020-05-05T17:20:26Z")
Hello Community, I'm very new to LogStash and I have a question. I am trying to use grok to get a substring from my message and put it in a new field. I've used grokdebugger in kibana and it seems to highlight the right… --- ## [Changing default similarity of an index](https://discuss.elastic.co/t/changing-default-similarity-of-an-index/231193)
**Author:** [@mich123prem](https://discuss.elastic.co/u/mich123prem)\ **Replies:** 0\ **Last updated:** [May 5, 2020, 4:27pm UTC](https://discuss.elastic.co/t/changing-default-similarity-of-an-index/231193 "2020-05-05T16:27:43Z")
Hello! I am using elasticsearch in a university course on IR, and it is therefore interesting to change the default similarity of an index to show differences in performance related to the different similarities. In vers… --- ## [Elasticsearch 7 has 4x higher AZ transfer costs in AWS compared to 2.4](https://discuss.elastic.co/t/elasticsearch-7-has-4x-higher-az-transfer-costs-in-aws-compared-to-2-4/225745)
**Author:** [@Doc\_Kaos](https://discuss.elastic.co/u/Doc_Kaos)\ **Replies:** 13\ **Last updated:** [May 5, 2020, 4:21pm UTC](https://discuss.elastic.co/t/elasticsearch-7-has-4x-higher-az-transfer-costs-in-aws-compared-to-2-4/225745 "2020-05-05T16:21:16Z")
Since upgrading to Elasticsearch 7.4.1 from 2.4. (I know :stuck\_out\_tongue: ) we are seeing our AWS availability zone transfer charges skyrocket. Both the old and new clusters used the cluster.cloud.allocation.awareness.… --- ## [Elastic APM startup](https://discuss.elastic.co/t/elastic-apm-startup/231189)
**Author:** [@giorgiogale](https://discuss.elastic.co/u/giorgiogale)\ **Replies:** 0\ **Last updated:** [May 5, 2020, 4:16pm UTC](https://discuss.elastic.co/t/elastic-apm-startup/231189 "2020-05-05T16:16:45Z")
Hi, I'm starting to work with APM and I'd like to start monitoring some ws exposed on the glassfish server. can anyone give me any indication or guideline to get started? thanks. As a type of client I would like to use r… --- ## [Elasticsearch query with different fields](https://discuss.elastic.co/t/elasticsearch-query-with-different-fields/231166)
**Author:** [@Guillaume\_RENARD](https://discuss.elastic.co/u/Guillaume_RENARD)\ **Replies:** 7\ **Last updated:** [May 5, 2020, 3:53pm UTC](https://discuss.elastic.co/t/elasticsearch-query-with-different-fields/231166 "2020-05-05T15:53:07Z")
Hi here an exemple of my documents { "@timestamp": "2020-04-24T19:36:52.484Z", "token": "123", "application": "sso\_api\_v3", "ssoapiv3\_method": "GET", "ssoapiv3\_error\_description": "Your access token … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1467) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1469)