# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1510 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1511 --- ## [Logstash Memory Requirements and JVM Sizing](https://discuss.elastic.co/t/logstash-memory-requirements-and-jvm-sizing/227072)
**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Replies:** 8\ **Last updated:** [April 16, 2020, 5:02am UTC](https://discuss.elastic.co/t/logstash-memory-requirements-and-jvm-sizing/227072 "2020-04-16T05:02:01Z")
Hello I am getting approx 5000 events per second and a lot of Grok, KV, DNS filters are being used. My current memory is 16 GB, 8 Core thread per core is 2. I have set JVM size to 8GB. But My JVM is getting full and… --- ## [Thread Pool Configuration - Max thread\_pool.size?](https://discuss.elastic.co/t/thread-pool-configuration-max-thread-pool-size/228089)
**Author:** [@Vipul\_Sharma](https://discuss.elastic.co/u/Vipul_Sharma)\ **Replies:** 10\ **Last updated:** [April 16, 2020, 4:32am UTC](https://discuss.elastic.co/t/thread-pool-configuration-max-thread-pool-size/228089 "2020-04-16T04:32:52Z")
Hi All, Kindly help me with my query What could be the best possible configuration for a data-node running on a server having configuration lscpu output\> Architecture: x86\_64 CPU op-mode(s): 32-bit,… --- ## [Sizing Parameters for deploying SIEM](https://discuss.elastic.co/t/sizing-parameters-for-deploying-siem/228240)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 0\ **Last updated:** [April 16, 2020, 4:29am UTC](https://discuss.elastic.co/t/sizing-parameters-for-deploying-siem/228240 "2020-04-16T04:29:18Z")
Hi Guys, I am planning to test out SIEM app in production and I have around 70-80 servers \[60 of are those Windows/rest are all Linux/Unix\] then have PAN Firewall, 4-5 Cisco routers. So around 90 off devices that needs… --- ## [Benefit of increase number of data node in searching performance?](https://discuss.elastic.co/t/benefit-of-increase-number-of-data-node-in-searching-performance/227872)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 5\ **Last updated:** [April 16, 2020, 4:01am UTC](https://discuss.elastic.co/t/benefit-of-increase-number-of-data-node-in-searching-performance/227872 "2020-04-16T04:01:21Z")
Hi all Currently in my cluster, i have 3 data node in total, the query performance is fine but i really wanted it to be better, so other than doing all the thing that some blog say i should on the internet, i was just w… --- ## [Warning savedobjects-service Unable to connect to Elasticsearch Error Request Timeout after 30000ms](https://discuss.elastic.co/t/warning-savedobjects-service-unable-to-connect-to-elasticsearch-error-request-timeout-after-30000ms/228029)
**Author:** [@vivek898](https://discuss.elastic.co/u/vivek898)\ **Replies:** 4\ **Last updated:** [April 16, 2020, 3:59am UTC](https://discuss.elastic.co/t/warning-savedobjects-service-unable-to-connect-to-elasticsearch-error-request-timeout-after-30000ms/228029 "2020-04-16T03:59:40Z")
New to ELK and setting up in rhel 7.5 OS. Kibana is throwing error while setting up on master. Deleted below indices and tried again, but same error. red open .kibana\_task\_manager\_1 jmlrFCiCT-qOt\_hsevBM1g 1 1 red op… --- ## [Logstash and filebeat picking up the old files again and again](https://discuss.elastic.co/t/logstash-and-filebeat-picking-up-the-old-files-again-and-again/228163)
**Author:** [@Ananya\_Mohiley](https://discuss.elastic.co/u/Ananya_Mohiley)\ **Replies:** 2\ **Last updated:** [April 16, 2020, 3:51am UTC](https://discuss.elastic.co/t/logstash-and-filebeat-picking-up-the-old-files-again-and-again/228163 "2020-04-16T03:51:06Z")
i have configured logstash and filebeat on localhost however even when there is no updation of files in the folder the elasticsearch index is being populated by same files repetitively pl suggest remedial measures --- ## [Kibana displays wrong time](https://discuss.elastic.co/t/kibana-displays-wrong-time/228056)
**Author:** [@vikramaddagulla](https://discuss.elastic.co/u/vikramaddagulla)\ **Replies:** 3\ **Last updated:** [April 16, 2020, 3:04am UTC](https://discuss.elastic.co/t/kibana-displays-wrong-time/228056 "2020-04-16T03:04:43Z")
Hello, I have a log file and I am sending that from beats --\> logstash --\> elastic --\> kibana. Below are two lines in the log file : 172.27.88.123 2020-04-15T02:54:15.054Z GET /em 302 311 0.00… --- ## [Cluster RED unassigned shards CLUSTER\_RECOVERED](https://discuss.elastic.co/t/cluster-red-unassigned-shards-cluster-recovered/228229)
**Author:** [@Harikrishna\_Sarvaiya](https://discuss.elastic.co/u/Harikrishna_Sarvaiya)\ **Replies:** 0\ **Last updated:** [April 16, 2020, 1:44am UTC](https://discuss.elastic.co/t/cluster-red-unassigned-shards-cluster-recovered/228229 "2020-04-16T01:44:01Z")
Hi, My cluster status is showing in RED status. Many of my indices shown in RED status. I quried explain api and it results as below: { "index" : "abc-2019.04.24", "shard" : 2, "primary" : true, "current\_state" … --- ## [Block-max WAND for FunctionScoreQuery & CollapseTopDocsCollector](https://discuss.elastic.co/t/block-max-wand-for-functionscorequery-collapsetopdocscollector/228232)
**Author:** [@unix1986](https://discuss.elastic.co/u/unix1986)\ **Replies:** 0\ **Last updated:** [April 16, 2020, 2:22am UTC](https://discuss.elastic.co/t/block-max-wand-for-functionscorequery-collapsetopdocscollector/228232 "2020-04-16T02:22:09Z")
The block-max WAND algorithm in lucene，can it be applied to FunctionScoreQuery and CollapseTopDocsCollector？I think it can't，but i am not sure. I have not found the relevant implement in elasticsearch. --- ## [How to get the total number of records that do not match a regex?](https://discuss.elastic.co/t/how-to-get-the-total-number-of-records-that-do-not-match-a-regex/228230)
**Author:** [@Guerreiro\_Sousa](https://discuss.elastic.co/u/Guerreiro_Sousa)\ **Replies:** 0\ **Last updated:** [April 16, 2020, 2:17am UTC](https://discuss.elastic.co/t/how-to-get-the-total-number-of-records-that-do-not-match-a-regex/228230 "2020-04-16T02:17:53Z")
How to get the total number of records that do not match a regex? I'm doing this search: { "query": { "bool": { "must\_not": \[ { "regexp": { "clientip": { "value": "((25\[0-5\]|2\[0-4\]\[0-9\]|\[01\]?… --- ## [.NET Client max\_children in nested sorting](https://discuss.elastic.co/t/net-client-max-children-in-nested-sorting/228126)
**Author:** [@Kurmann](https://discuss.elastic.co/u/Kurmann)\ **Replies:** 1\ **Last updated:** [April 16, 2020, 12:50am UTC](https://discuss.elastic.co/t/net-client-max-children-in-nested-sorting/228126 "2020-04-16T00:50:06Z")
Hi. I need to set the property max\_children in a nested sort im .NET client. This question was already answered for version 6.x here: Closed Discussion and here: Stack Overflow, but I didn't found it for Version 7.x T… --- ## [Date filter can't read from fieldnames which contain dots (created by the JSON filter)](https://discuss.elastic.co/t/date-filter-cant-read-from-fieldnames-which-contain-dots-created-by-the-json-filter/228200)
**Author:** [@dreamspy](https://discuss.elastic.co/u/dreamspy)\ **Replies:** 2\ **Last updated:** [April 16, 2020, 12:25am UTC](https://discuss.elastic.co/t/date-filter-cant-read-from-fieldnames-which-contain-dots-created-by-the-json-filter/228200 "2020-04-16T00:25:46Z")
Hi I'm having some problems reading timestamps from nested JSON fields. Let's say I have this JSON document: {"time" : "2020-04-15T19:17:03.195641"} and I read it with logstash using this filter: filter { json { … --- ## [Cannot send logs from logstash to elasticsearch using systemctl](https://discuss.elastic.co/t/cannot-send-logs-from-logstash-to-elasticsearch-using-systemctl/228209)
**Author:** [@bikramsingh](https://discuss.elastic.co/u/bikramsingh)\ **Replies:** 2\ **Last updated:** [April 15, 2020, 11:19pm UTC](https://discuss.elastic.co/t/cannot-send-logs-from-logstash-to-elasticsearch-using-systemctl/228209 "2020-04-15T23:19:29Z")
Hi when i send using "bin/logstash -f /etc/logstash/conf.d/logstash.conf" I am able to send logs to elasticsearch and see the index in kibana. But I am not able to send logs from logstash to elasticsearch when I am star… --- ## [How to do a conditional regex on or?](https://discuss.elastic.co/t/how-to-do-a-conditional-regex-on-or/228172)
**Author:** [@Amine\_Maalfi](https://discuss.elastic.co/u/Amine_Maalfi)\ **Replies:** 4\ **Last updated:** [April 15, 2020, 9:57pm UTC](https://discuss.elastic.co/t/how-to-do-a-conditional-regex-on-or/228172 "2020-04-15T21:57:48Z")
i have three files named: - foo.log.2020-02-17.log - bar.log - foo.log.17-02-2020 i need to extract the whole file name and the date aswell i tried this expression but it's not working for me: (?\< app\_name \>.\*(?\< lo… --- ## [Limited access user : role 'kibana\_user' can still manage spaces](https://discuss.elastic.co/t/limited-access-user-role-kibana-user-can-still-manage-spaces/227616)
**Author:** [@laurentml](https://discuss.elastic.co/u/laurentml)\ **Replies:** 7\ **Last updated:** [April 15, 2020, 9:51pm UTC](https://discuss.elastic.co/t/limited-access-user-role-kibana-user-can-still-manage-spaces/227616 "2020-04-15T21:51:41Z")
Hi all, and thx a lot for those wonderful ELK tools. I'm trying to configure a limited-access user, able to only create visualizations for a given space, limited to a specific index, with ELK 7.6.0. User shall not be ab… --- ## [Config field as date](https://discuss.elastic.co/t/config-field-as-date/228112)
**Author:** [@peretz\_shlomi](https://discuss.elastic.co/u/peretz_shlomi)\ **Replies:** 2\ **Last updated:** [April 15, 2020, 9:16pm UTC](https://discuss.elastic.co/t/config-field-as-date/228112 "2020-04-15T21:16:33Z")
hi Hi I'm trying to import a file csv that in one of the fields has a field of time according to the above format 20200402 133001 Also attached is the definition in the file filter { csv { separator =\> "," column… --- ## [Filter a CSV with a CSV](https://discuss.elastic.co/t/filter-a-csv-with-a-csv/228091)
**Author:** [@bazza](https://discuss.elastic.co/u/bazza)\ **Replies:** 3\ **Last updated:** [April 15, 2020, 9:14pm UTC](https://discuss.elastic.co/t/filter-a-csv-with-a-csv/228091 "2020-04-15T21:14:33Z")
Hi, I have a log entry from mysql\_audit.so that creates a CSV based log file. I have been able to filter this in to ELK no problems, but I have one type of log entry that contains comma delimited entries within the col… --- ## [Circuit breaker with permanent durability](https://discuss.elastic.co/t/circuit-breaker-with-permanent-durability/228193)
**Author:** [@Jonathan\_Mendenhall](https://discuss.elastic.co/u/Jonathan_Mendenhall)\ **Replies:** 2\ **Last updated:** [April 15, 2020, 9:06pm UTC](https://discuss.elastic.co/t/circuit-breaker-with-permanent-durability/228193 "2020-04-15T21:06:40Z")
In our Es 7.5 cluster, a large query I ran tripped some circuit breakers on the data nodes. { "took": 8097, "responses": \[{ "error": { "root\_cause": \[{ "type": "array\_in… --- ## [Configuring GeoIP information in Logstash for Kibana SIEM Network Map](https://discuss.elastic.co/t/configuring-geoip-information-in-logstash-for-kibana-siem-network-map/228203)
**Author:** [@rgeisman](https://discuss.elastic.co/u/rgeisman)\ **Replies:** 0\ **Last updated:** [April 15, 2020, 8:55pm UTC](https://discuss.elastic.co/t/configuring-geoip-information-in-logstash-for-kibana-siem-network-map/228203 "2020-04-15T20:55:25Z")
Hello All, I am working with a previous ELK stack that was setup to just use beats to go to Elasticsearch. I have upgraded he cluster and now using Logstash. Previously the SIEM Network Map worked because a "geoip-inf… --- ## [Marking url as dead. Last error: HostUnreachableError](https://discuss.elastic.co/t/marking-url-as-dead-last-error-hostunreachableerror/228202)
**Author:** [@Chris\_Wilmott](https://discuss.elastic.co/u/Chris_Wilmott)\ **Replies:** 0\ **Last updated:** [April 15, 2020, 8:37pm UTC](https://discuss.elastic.co/t/marking-url-as-dead-last-error-hostunreachableerror/228202 "2020-04-15T20:37:37Z")
Hi, I have updated my ElasticSearch cluster from 6.6 to 7.6.2, as part of this upgrade the \_all field and the \_default\_ fields were removed. I updated the cluster, checked the logs, and sure enough, one of my templates… --- ## [Ruby code to push whole map to event upon aggregate end\_of\_task](https://discuss.elastic.co/t/ruby-code-to-push-whole-map-to-event-upon-aggregate-end-of-task/228174)
**Author:** [@kevin\_branch](https://discuss.elastic.co/u/kevin_branch)\ **Replies:** 2\ **Last updated:** [April 15, 2020, 8:17pm UTC](https://discuss.elastic.co/t/ruby-code-to-push-whole-map-to-event-upon-aggregate-end-of-task/228174 "2020-04-15T20:17:00Z")
I understand with aggregate that push\_map\_as\_event\_on\_timeout can be used to push the whole aggregated map to the event when there is a timeout, but that there is nothing like a push\_map\_as\_event\_on\_end\_of\_task. What wo… --- ## [Translate with array fields](https://discuss.elastic.co/t/translate-with-array-fields/228196)
**Author:** [@mtudisco](https://discuss.elastic.co/u/mtudisco)\ **Replies:** 0\ **Last updated:** [April 15, 2020, 7:22pm UTC](https://discuss.elastic.co/t/translate-with-array-fields/228196 "2020-04-15T19:22:20Z")
Hi, Im using winlogbeat to send information to logstash and then all the information goes to a log in filesystem and some information goes to elasticsearch. To identify which information to store in ES, I identify cert… --- ## [Could not index event to Elasticsearch. Root mapping definition has unsupported parameters](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-root-mapping-definition-has-unsupported-parameters/228176)
**Author:** [@Chris\_Wilmott](https://discuss.elastic.co/u/Chris_Wilmott)\ **Replies:** 4\ **Last updated:** [April 15, 2020, 6:32pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-root-mapping-definition-has-unsupported-parameters/228176 "2020-04-15T18:32:51Z")
Hi, I have recently upgraded from 6.6 to 7.6.2 and it all went smoothly enough. However I checked my logs this morning and have found the following: \[2020-04-15T15:50:50,851\]\[WARN \]\[logstash.outputs.elasticsearch\] Coul… --- ## [Year over Year Calculations](https://discuss.elastic.co/t/year-over-year-calculations/227559)
**Author:** [@dmankaruse](https://discuss.elastic.co/u/dmankaruse)\ **Replies:** 4\ **Last updated:** [April 15, 2020, 5:58pm UTC](https://discuss.elastic.co/t/year-over-year-calculations/227559 "2020-04-15T17:58:27Z")
I am trying to create a report with year over year calculations, I want to show to sum of activity in Jan 2020, and compare that with the sum of Jan 2019, I wish to display this is a numeric value of the difference, and … --- ## [Nginx LoadBalancing to Logstash](https://discuss.elastic.co/t/nginx-loadbalancing-to-logstash/228177)
**Author:** [@luiz.miguelsl](https://discuss.elastic.co/u/luiz.miguelsl)\ **Replies:** 1\ **Last updated:** [April 15, 2020, 5:54pm UTC](https://discuss.elastic.co/t/nginx-loadbalancing-to-logstash/228177 "2020-04-15T17:54:38Z")
Hi there guys, I hope you're all safe. I have two Logstash instances behind an Nginx as the load balancer. The problem is that load balancing isn't happening properly. Always, one server is receiving more traffic than t… --- ## [Getting HeadlessError: ECONNREFUSED when trying to generate PDF report from Kibana](https://discuss.elastic.co/t/getting-headlesserror-econnrefused-when-trying-to-generate-pdf-report-from-kibana/222773)
**Author:** [@preetish\_P](https://discuss.elastic.co/u/preetish_P)\ **Replies:** 5\ **Last updated:** [April 15, 2020, 5:32pm UTC](https://discuss.elastic.co/t/getting-headlesserror-econnrefused-when-trying-to-generate-pdf-report-from-kibana/222773 "2020-04-15T17:32:26Z")
Hi Team, I am trying to generate PDF reports on Kibana and while doing so I am getting the below error: HeadlessError: Request() error evaluating createPage() call: Error: connect ECONNREFUSED 127.0.0.1:33395 We are r… --- ## [How do ECE Cloud UI Hot-Warm and Index Management Hot-Warm join up](https://discuss.elastic.co/t/how-do-ece-cloud-ui-hot-warm-and-index-management-hot-warm-join-up/227956)
**Author:** [@david.preston](https://discuss.elastic.co/u/david.preston)\ **Replies:** 8\ **Last updated:** [April 15, 2020, 5:13pm UTC](https://discuss.elastic.co/t/how-do-ece-cloud-ui-hot-warm-and-index-management-hot-warm-join-up/227956 "2020-04-15T17:13:39Z")
I've been working through the Elastic documentation, starting here: https://www.elastic.co/guide/en/cloud-enterprise/current/ece-configuring-ece-tag-allocators.html The guide walks through the setting up of Hot-Warm all… --- ## [Accessing Metafield \_index in Logstash](https://discuss.elastic.co/t/accessing-metafield-index-in-logstash/228113)
**Author:** [@InfiniteLoops](https://discuss.elastic.co/u/InfiniteLoops)\ **Replies:** 3\ **Last updated:** [April 15, 2020, 5:12pm UTC](https://discuss.elastic.co/t/accessing-metafield-index-in-logstash/228113 "2020-04-15T17:12:10Z")
I am using this output for Elasticsearch index =\> "%{\[headers\]\[key\]}-data-%{+YYYY.MM}" So it creates a index name with the date added. I am trying to reindex this data through a logstash filter. So I am using the previ… --- ## [Split json data based on timestamp](https://discuss.elastic.co/t/split-json-data-based-on-timestamp/228175)
**Author:** [@giridharan78](https://discuss.elastic.co/u/giridharan78)\ **Replies:** 0\ **Last updated:** [April 15, 2020, 5:11pm UTC](https://discuss.elastic.co/t/split-json-data-based-on-timestamp/228175 "2020-04-15T17:11:16Z")
Below is my json data which need to be split based on the time. Please guide me on creating a filter for below data so that date is picked from the response rather than @timestamp. { "2020-04-15T14:37:23.689Z": { … --- ## [Display Minimum Count of Unique Count Field](https://discuss.elastic.co/t/display-minimum-count-of-unique-count-field/225753)
**Author:** [@uklipse](https://discuss.elastic.co/u/uklipse)\ **Replies:** 4\ **Last updated:** [April 15, 2020, 5:07pm UTC](https://discuss.elastic.co/t/display-minimum-count-of-unique-count-field/225753 "2020-04-15T17:07:18Z")
I've calculated unique counts for a dataset but I'd like to only display when those counts are above a certain number. On regular fields I would use {"min\_doc\_count": 13} under the Json input but on unique counts I get a… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1509) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1511)