# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1480 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1481 --- ## [How to move a 4 node managed cluster to a new datacenter (basic license)](https://discuss.elastic.co/t/how-to-move-a-4-node-managed-cluster-to-a-new-datacenter-basic-license/229765)
**Author:** [@leij9857](https://discuss.elastic.co/u/leij9857)\ **Replies:** 6\ **Last updated:** [April 29, 2020, 5:52pm UTC](https://discuss.elastic.co/t/how-to-move-a-4-node-managed-cluster-to-a-new-datacenter-basic-license/229765 "2020-04-29T17:52:17Z")
I was hoping someone could advise me with the following problem. I have a four node Linux cluster with a basic licence in a managed datacenter. All nodes have the same hardware resources 1TB SSD. At this point in time t… --- ## [Automated queries to .kibana\_task\_manager cause CircuitBreakerException](https://discuss.elastic.co/t/automated-queries-to-kibana-task-manager-cause-circuitbreakerexception/230256)
**Author:** [@toneyalexander](https://discuss.elastic.co/u/toneyalexander)\ **Replies:** 8\ **Last updated:** [April 29, 2020, 5:51pm UTC](https://discuss.elastic.co/t/automated-queries-to-kibana-task-manager-cause-circuitbreakerexception/230256 "2020-04-29T17:51:34Z")
We have a 7.4.2 Elasticsearch cluster with Kibana. We keep getting the following messages in our log files. { "type": "server", "timestamp": "2020-04-14T00:00:10,274Z", "level": "DEBUG", "component": "o.e.a.s.Tr… --- ## [Script Field is a list of nested values](https://discuss.elastic.co/t/script-field-is-a-list-of-nested-values/230414)
**Author:** [@Orson\_Duque](https://discuss.elastic.co/u/Orson_Duque)\ **Replies:** 0\ **Last updated:** [April 29, 2020, 5:44pm UTC](https://discuss.elastic.co/t/script-field-is-a-list-of-nested-values/230414 "2020-04-29T17:44:23Z")
Hello, I am new to this ES world and I honestly find it very interesting. I have a problem with fields generated or calculated from others. Let's say I have a movie and each movie has a list of participants. And said pa… --- ## [If and problem](https://discuss.elastic.co/t/if-and-problem/230222)
**Author:** [@Youssef\_SBAI](https://discuss.elastic.co/u/Youssef_SBAI)\ **Replies:** 10\ **Last updated:** [April 29, 2020, 5:16pm UTC](https://discuss.elastic.co/t/if-and-problem/230222 "2020-04-29T17:16:50Z")
I have an erreur if use this condition in logstsh if \[job\] == "MNNATY0P02" and \[statut\] == "OK" { mutate { add\_field =\> { "statut\_globale" =\> "1" } } } --- ## [Elasticsearch NEST - Documents values are NULL](https://discuss.elastic.co/t/elasticsearch-nest-documents-values-are-null/230291)
**Author:** [@iluvcode](https://discuss.elastic.co/u/iluvcode)\ **Replies:** 2\ **Last updated:** [April 29, 2020, 4:28pm UTC](https://discuss.elastic.co/t/elasticsearch-nest-documents-values-are-null/230291 "2020-04-29T16:28:48Z")
I upgraded Elasticsearch from 6.8 to 7.6 and after the upgrade values returned in the documents are all NULL. I do see the values coming in Debug information and total count is also correct but not sure why documents ar… --- ## [Help getting started](https://discuss.elastic.co/t/help-getting-started/230404)
**Author:** [@thenewguy](https://discuss.elastic.co/u/thenewguy)\ **Replies:** 0\ **Last updated:** [April 29, 2020, 4:00pm UTC](https://discuss.elastic.co/t/help-getting-started/230404 "2020-04-29T16:00:36Z")
I am trying to make sense of how to use logstash but I am not getting anywhere. I am trying to deploy the logstash container to receive gelf messages from the docker logger. How do I use the environment variable config… --- ## [Concatenate analyzers](https://discuss.elastic.co/t/concatenate-analyzers/230390)
**Author:** [@Yury\_Trafimovich](https://discuss.elastic.co/u/Yury_Trafimovich)\ **Replies:** 1\ **Last updated:** [April 29, 2020, 3:31pm UTC](https://discuss.elastic.co/t/concatenate-analyzers/230390 "2020-04-29T15:31:56Z")
Is it possible to reach the following? POST my\_index/\_analyze { "analyzer": "customer\_analyzer\_for\_search\_only", "text": \["ka bel"\] } tokens \["ka", "bel", "kabel"\] So during the search it always add 1 more token … --- ## [Field case sensitivity and detection rules not triggering 'clear-eventlog'](https://discuss.elastic.co/t/field-case-sensitivity-and-detection-rules-not-triggering-clear-eventlog/230167)
**Author:** [@jimmburton](https://discuss.elastic.co/u/jimmburton)\ **Replies:** 3\ **Last updated:** [April 29, 2020, 2:57pm UTC](https://discuss.elastic.co/t/field-case-sensitivity-and-detection-rules-not-triggering-clear-eventlog/230167 "2020-04-29T14:57:44Z")
I have an new on-prem deployment of ELK 7.6.2, and have been working the the SIEM tool and like in another post about not seeing a signal get triggered when clearing logs I had the same issue. I worked through the winlog… --- ## [Getting \_dateparsefailure tag](https://discuss.elastic.co/t/getting-dateparsefailure-tag/230375)
**Author:** [@Hari\_Krishna](https://discuss.elastic.co/u/Hari_Krishna)\ **Replies:** 4\ **Last updated:** [April 29, 2020, 2:54pm UTC](https://discuss.elastic.co/t/getting-dateparsefailure-tag/230375 "2020-04-29T14:54:56Z")
I have to replace the @timestamp in kibana with the timestamp in my log.But when i try to do that it doesn't replace, but it adds a \_dateparsefailure tag. Here is my filter filter { grok { break\_on\_match =\> false … --- ## [Http poller with integraion key](https://discuss.elastic.co/t/http-poller-with-integraion-key/230381)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 0\ **Last updated:** [April 29, 2020, 1:50pm UTC](https://discuss.elastic.co/t/http-poller-with-integraion-key/230381 "2020-04-29T13:50:16Z")
Hi All, We are trying to ingest using logstash from servicenow, generally we used to get restapi url and user credentials to configure the logstash config file. Now the scenario is like they have given us a restapi url… --- ## [Logstash - http input plugin](https://discuss.elastic.co/t/logstash-http-input-plugin/230284)
**Author:** [@nages](https://discuss.elastic.co/u/nages)\ **Replies:** 1\ **Last updated:** [April 29, 2020, 1:39pm UTC](https://discuss.elastic.co/t/logstash-http-input-plugin/230284 "2020-04-29T13:39:59Z")
As of now, http input plugin acts as "server" and listens for incoming connections .Is it possible to configure to connect is as "client" like tcp plugin does. tcp plugin had a mode attribute which will enable to act it … --- ## [Lostash std err and out file oversize](https://discuss.elastic.co/t/lostash-std-err-and-out-file-oversize/230297)
**Author:** [@kopilim96](https://discuss.elastic.co/u/kopilim96)\ **Replies:** 1\ **Last updated:** [April 29, 2020, 1:35pm UTC](https://discuss.elastic.co/t/lostash-std-err-and-out-file-oversize/230297 "2020-04-29T13:35:32Z")
Hi all, one of my colleagues called me yesterday and I was told that there are 2 logfile from Logstash are growing oversize, screenshot as below: So the scenario is I am running 2 logstash as background services 24/7 … --- ## [Logstash not running continously](https://discuss.elastic.co/t/logstash-not-running-continously/230312)
**Author:** [@john.wambua](https://discuss.elastic.co/u/john.wambua)\ **Replies:** 1\ **Last updated:** [April 29, 2020, 1:27pm UTC](https://discuss.elastic.co/t/logstash-not-running-continously/230312 "2020-04-29T13:27:24Z")
Hi, Am having trouble to keep my logstash running continously.It runs the after a day or 2 it stops running so i have to manually restart it.What could be causing this someone help --- ## [Best practice for adding tag in an inexpensive way?](https://discuss.elastic.co/t/best-practice-for-adding-tag-in-an-inexpensive-way/230321)
**Author:** [@omersiar](https://discuss.elastic.co/u/omersiar)\ **Replies:** 1\ **Last updated:** [April 29, 2020, 1:26pm UTC](https://discuss.elastic.co/t/best-practice-for-adding-tag-in-an-inexpensive-way/230321 "2020-04-29T13:26:24Z")
Hello All, Trying to understand structure of Logstash pipeline configuration, it seems almost every plugin (that are shipped by default) has some common functions like adding fields, removing tags, etc. My question is … --- ## [JSON Parse Failure using logstash](https://discuss.elastic.co/t/json-parse-failure-using-logstash/230013)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 4\ **Last updated:** [April 29, 2020, 1:25pm UTC](https://discuss.elastic.co/t/json-parse-failure-using-logstash/230013 "2020-04-29T13:25:18Z")
Hi All, I'm trying to ingest a json file using logstash adn i'm getting json parse failure message, can someone guide me where i'm doing the mistake My json FIle \[ { "Org": "ogr1", "date\_last": "2020-01-14 0… --- ## [Multiple bulk actions on the same document](https://discuss.elastic.co/t/multiple-bulk-actions-on-the-same-document/230233)
**Author:** [@Faiz\_Ahmed\_Mushtak\_H](https://discuss.elastic.co/u/Faiz_Ahmed_Mushtak_H)\ **Replies:** 2\ **Last updated:** [April 29, 2020, 1:22pm UTC](https://discuss.elastic.co/t/multiple-bulk-actions-on-the-same-document/230233 "2020-04-29T13:22:47Z")
Is it possible for multiple update actions in one bulk request on the same document to cause version conflict? that is to say, bulk actions are executed in parallel, so it is possible to face version conflict in that cas… --- ## [Logstash not able to ingest csvv](https://discuss.elastic.co/t/logstash-not-able-to-ingest-csvv/230326)
**Author:** [@richylyq](https://discuss.elastic.co/u/richylyq)\ **Replies:** 1\ **Last updated:** [April 29, 2020, 1:19pm UTC](https://discuss.elastic.co/t/logstash-not-able-to-ingest-csvv/230326 "2020-04-29T13:19:31Z")
Hi all, I just started working with logstash yesterday and could ingest my file successfully, but since this morning, I could not ingest using the same config file that was used yesterday and also a new config file tha… --- ## [Help Needed in creating multiple Area charts with multiple filter in single visualization](https://discuss.elastic.co/t/help-needed-in-creating-multiple-area-charts-with-multiple-filter-in-single-visualization/230298)
**Author:** [@Bhanu\_Praveen](https://discuss.elastic.co/u/Bhanu_Praveen)\ **Replies:** 2\ **Last updated:** [April 29, 2020, 1:15pm UTC](https://discuss.elastic.co/t/help-needed-in-creating-multiple-area-charts-with-multiple-filter-in-single-visualization/230298 "2020-04-29T13:15:20Z")
Hello, I have Purchase orders in system. I want to create single area chart which shows how many POs are coming and how many are closed in a single visualization. Single area chart i tried as below: Y-Axis Sum of Tot… --- ## [How can I parse nested json in message?](https://discuss.elastic.co/t/how-can-i-parse-nested-json-in-message/230348)
**Author:** [@Win32Sector](https://discuss.elastic.co/u/Win32Sector)\ **Replies:** 1\ **Last updated:** [April 29, 2020, 1:10pm UTC](https://discuss.elastic.co/t/how-can-i-parse-nested-json-in-message/230348 "2020-04-29T13:10:35Z")
Hi All! Can u help me with parsing log messages, for example: \`{"log":"{"timestamp":"2020-04-20T10:07:17.483Z","version":"1","message":"request","logger\_name":"WebClientLoggingHandler","thread\_name":"reactor-http-epoll… --- ## [Stacked column chart, get rid of "All Docs"](https://discuss.elastic.co/t/stacked-column-chart-get-rid-of-all-docs/227620)
**Author:** [@perfecto25](https://discuss.elastic.co/u/perfecto25)\ **Replies:** 2\ **Last updated:** [April 29, 2020, 1:09pm UTC](https://discuss.elastic.co/t/stacked-column-chart-get-rid-of-all-docs/227620 "2020-04-29T13:09:29Z")
Hello, Im trying to create a stacked column chart showing CPU % usage per CPU core Im getting data from metric beat, "system.core.id" The chart looks ok but I cant figure out how to remove the "All Docs" labels on X a… --- ## [Alias search using RestHighLevel Client](https://discuss.elastic.co/t/alias-search-using-resthighlevel-client/230147)
**Author:** [@PraveenJala](https://discuss.elastic.co/u/PraveenJala)\ **Replies:** 5\ **Last updated:** [April 29, 2020, 12:57pm UTC](https://discuss.elastic.co/t/alias-search-using-resthighlevel-client/230147 "2020-04-29T12:57:33Z")
Hi, I am using Elastic Search Rest Client 6.2.4. Can you help me with some example how to check if an alias exists using Rest Client and how to create alias using HighLevelRestClient. I have searched, but i couldn't f… --- ## [How to use aggregate function in logstash to calculate difference between 'elapsed' time fields?](https://discuss.elastic.co/t/how-to-use-aggregate-function-in-logstash-to-calculate-difference-between-elapsed-time-fields/230004)
**Author:** [@Nani\_20](https://discuss.elastic.co/u/Nani_20)\ **Replies:** 4\ **Last updated:** [April 28, 2020, 7:16pm UTC](https://discuss.elastic.co/t/how-to-use-aggregate-function-in-logstash-to-calculate-difference-between-elapsed-time-fields/230004 "2020-04-28T19:16:03Z")
I am using the latest version of logstash(7.6.2). I am trying to calculate the total time spent in system excluding time spent between Out2 and In2 i.e. \[(Out3-In1) - (Out2-In2)\] for a given ID. Find below my sample da… --- ## [Elastic search memory](https://discuss.elastic.co/t/elastic-search-memory/230355)
**Author:** [@Lynd](https://discuss.elastic.co/u/Lynd)\ **Replies:** 1\ **Last updated:** [April 29, 2020, 12:45pm UTC](https://discuss.elastic.co/t/elastic-search-memory/230355 "2020-04-29T12:45:03Z")
I tried to set the heap size of elastic search .so I have set it as -Xmx64m and -Xms64m.but when I restarted the es and check for the memory its still showing 2g.then I commented out those two setting written as follows… --- ## [Syntax error with "if" on multiple lines](https://discuss.elastic.co/t/syntax-error-with-if-on-multiple-lines/230360)
**Author:** [@Youssef\_SBAI](https://discuss.elastic.co/u/Youssef_SBAI)\ **Replies:** 1\ **Last updated:** [April 29, 2020, 12:07pm UTC](https://discuss.elastic.co/t/syntax-error-with-if-on-multiple-lines/230360 "2020-04-29T12:07:56Z")
i use this condition but the colonne statut\_globale not created in elastic if \[job\] == "MNNATY0P02" and \[job\] == "MNNATY0P00" and \[job\]== "MNNATY0P00" and \[job\]== "MNNATY0P99" and \[job\]== "MNNATY0P14" and \[job\]== "MNNA… --- ## [AWS Elasticsearch : mapper\_parsing\_exception for type date from Kinesis Firehose using index\_template](https://discuss.elastic.co/t/aws-elasticsearch-mapper-parsing-exception-for-type-date-from-kinesis-firehose-using-index-template/230262)
**Author:** [@yoyomonkey](https://discuss.elastic.co/u/yoyomonkey)\ **Replies:** 13\ **Last updated:** [April 29, 2020, 11:42am UTC](https://discuss.elastic.co/t/aws-elasticsearch-mapper-parsing-exception-for-type-date-from-kinesis-firehose-using-index-template/230262 "2020-04-29T11:42:05Z")
Hi all, I hope someone can help me. I am really new to Elasticsearch so any guidance would be really appreciated. I have been battling with AWS Elasticsearch and Kinesis FIrehose Agent (this reads in a application log … --- ## [Explain API - All these statistics are per shard not per index](https://discuss.elastic.co/t/explain-api-all-these-statistics-are-per-shard-not-per-index/230187)
**Author:** [@nages](https://discuss.elastic.co/u/nages)\ **Replies:** 10\ **Last updated:** [April 29, 2020, 11:23am UTC](https://discuss.elastic.co/t/explain-api-all-these-statistics-are-per-shard-not-per-index/230187 "2020-04-29T11:23:34Z")
I am going through this thread Somewhere it is said All these statistics are per shard not per index I hope this statement is still valid , and i confirmed this behavior too .. What was the reasoning behind this … --- ## [How to write a scripted field for nested fileds in index pattern](https://discuss.elastic.co/t/how-to-write-a-scripted-field-for-nested-fileds-in-index-pattern/230252)
**Author:** [@sami88rosh](https://discuss.elastic.co/u/sami88rosh)\ **Replies:** 1\ **Last updated:** [April 29, 2020, 11:11am UTC](https://discuss.elastic.co/t/how-to-write-a-scripted-field-for-nested-fileds-in-index-pattern/230252 "2020-04-29T11:11:27Z")
Hello guys, I want to write a scripted filed to get nested filed value. I want to get the pressure value for each doc(record). Is it possible to do in Kibana? My index is like this. Thanks in advance!! { "\_index": … --- ## [\[7.5.0\] Problem with reporting feature (dependencies most likely)](https://discuss.elastic.co/t/7-5-0-problem-with-reporting-feature-dependencies-most-likely/213686)
**Author:** [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\ **Replies:** 7\ **Last updated:** [April 29, 2020, 10:58am UTC](https://discuss.elastic.co/t/7-5-0-problem-with-reporting-feature-dependencies-most-likely/213686 "2020-04-29T10:58:07Z")
Hi there! I think the title is self-explanatory but I'll add here some further info. I'm trying to make some reports on a Kibana instance installed on a RHEL 6.3 (Santiago) machine. Now, it fails with main error Erro… --- ## [Run RabbitMQ in Master/Slave mode](https://discuss.elastic.co/t/run-rabbitmq-in-master-slave-mode/230347)
**Author:** [@MdRashid](https://discuss.elastic.co/u/MdRashid)\ **Replies:** 2\ **Last updated:** [April 29, 2020, 10:26am UTC](https://discuss.elastic.co/t/run-rabbitmq-in-master-slave-mode/230347 "2020-04-29T10:26:38Z")
Need help How to Run RabbitMQ in Master/Slave mode in my ubuntu 20.04 or in docker i want to setup in both ubuntu and in docker let me know how to setup it --- ## [Eleasticsearch Logs Pull](https://discuss.elastic.co/t/eleasticsearch-logs-pull/230346)
**Author:** [@MdRashid](https://discuss.elastic.co/u/MdRashid)\ **Replies:** 2\ **Last updated:** [April 29, 2020, 10:26am UTC](https://discuss.elastic.co/t/eleasticsearch-logs-pull/230346 "2020-04-29T10:26:13Z")
Let ES directly pull log data from RabbitMQ queue https://www.elastic.co/guide/en/logstash/current/plugins-inputs-rabbitmq.html I need help to how to setup it and in details let me know My Specif is Ubuntu 20.04 and i… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1479) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1481)