# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1531 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1532 --- ## [Auto-creating indices even though configured not to](https://discuss.elastic.co/t/auto-creating-indices-even-though-configured-not-to/226027)
**Author:** [@simonauner-bookbeat](https://discuss.elastic.co/u/simonauner-bookbeat)\ **Replies:** 2\ **Last updated:** [April 6, 2020, 8:41am UTC](https://discuss.elastic.co/t/auto-creating-indices-even-though-configured-not-to/226027 "2020-04-06T08:41:05Z")
I want to have full control over what indices are created in my cluster, so I have configured PUT \_cluster/settings { "persistent": { "action.auto\_create\_index": "false" } } Still, when using NEST to s… --- ## [How to: display table with multiple aggregations?](https://discuss.elastic.co/t/how-to-display-table-with-multiple-aggregations/226033)
**Author:** [@KatherineMunro](https://discuss.elastic.co/u/KatherineMunro)\ **Replies:** 6\ **Last updated:** [April 6, 2020, 8:01am UTC](https://discuss.elastic.co/t/how-to-display-table-with-multiple-aggregations/226033 "2020-04-06T08:01:25Z")
Hi there. As a newbie here I don't quite know how to phrase my question and title and thus also haven't been able to find a solution. Kibana version 5.6.5. I have logs of the following format: The 'path' field repre… --- ## [How to get array size for each document](https://discuss.elastic.co/t/how-to-get-array-size-for-each-document/226599)
**Author:** [@ntsh999](https://discuss.elastic.co/u/ntsh999)\ **Replies:** 2\ **Last updated:** [April 6, 2020, 8:01am UTC](https://discuss.elastic.co/t/how-to-get-array-size-for-each-document/226599 "2020-04-06T08:01:25Z")
I want the size of an array of objects ('breaches' here) which is present in each document to be returned along with the fields present in the document once the query is executed. How can I do this? Below is my document … --- ## [Handling data between multiple indices](https://discuss.elastic.co/t/handling-data-between-multiple-indices/226556)
**Author:** [@Vignesh\_Theyagarajan](https://discuss.elastic.co/u/Vignesh_Theyagarajan)\ **Replies:** 3\ **Last updated:** [April 6, 2020, 7:33am UTC](https://discuss.elastic.co/t/handling-data-between-multiple-indices/226556 "2020-04-06T07:33:15Z")
I have 2 indices. These 2 indices are kind of related to one another. For example, lets say, the 1st index contains all information pertaining to an e-book. Information like author, published date, title etc. will be in… --- ## [Retrying failed action with response code: 503 unavailable\_shards\_exception, reason - logstash primary shard is not active](https://discuss.elastic.co/t/retrying-failed-action-with-response-code-503-unavailable-shards-exception-reason-logstash-primary-shard-is-not-active/226576)
**Author:** [@vignesh.s2](https://discuss.elastic.co/u/vignesh.s2)\ **Replies:** 5\ **Last updated:** [April 6, 2020, 7:27am UTC](https://discuss.elastic.co/t/retrying-failed-action-with-response-code-503-unavailable-shards-exception-reason-logstash-primary-shard-is-not-active/226576 "2020-04-06T07:27:49Z")
After upgrading to the latest version of the ELK 7.6.2 , I tried to restart the all the services. But elasticsearch has errors Below mentioned is the errors, Apr 03 21:56:46 CLMserver logstash\[3216\]: \[2020-04-03T21:56:… --- ## [How to use filter with more like query](https://discuss.elastic.co/t/how-to-use-filter-with-more-like-query/226635)
**Author:** [@ajay\_jangid](https://discuss.elastic.co/u/ajay_jangid)\ **Replies:** 0\ **Last updated:** [April 6, 2020, 7:18am UTC](https://discuss.elastic.co/t/how-to-use-filter-with-more-like-query/226635 "2020-04-06T07:18:10Z")
I am working on some recommendation problem as mine college project so task is to recommend a activity based on search term given by user and I am able to recommend similar result based on query. But I want to add filter… --- ## [Logstash - java.lang.OutOfMemoryError: Java heap space](https://discuss.elastic.co/t/logstash-java-lang-outofmemoryerror-java-heap-space/226632)
**Author:** [@Elango\_Sakthi](https://discuss.elastic.co/u/Elango_Sakthi)\ **Replies:** 0\ **Last updated:** [April 6, 2020, 7:03am UTC](https://discuss.elastic.co/t/logstash-java-lang-outofmemoryerror-java-heap-space/226632 "2020-04-06T07:03:57Z")
I am using Logstash latest version 7.6.1 and I am using 4GB Ram in my machine. When I trying to push data from Redshift to Elasticsearch using Logstash I am getting the Error: java.lang.OutOfMemoryError: Java heap spa… --- ## [Problem when importing a CSV file](https://discuss.elastic.co/t/problem-when-importing-a-csv-file/226627)
**Author:** [@GuyMuller](https://discuss.elastic.co/u/GuyMuller)\ **Replies:** 1\ **Last updated:** [April 6, 2020, 6:48am UTC](https://discuss.elastic.co/t/problem-when-importing-a-csv-file/226627 "2020-04-06T06:48:16Z")
Good morning, sir, When importing, the columns described in the Filter section were not taken into account. They are all in column 1!?! Blockquote filter { csv { separator =\> "," … --- ## [How to create filter to handle spaces & commas in street addresses & person names?](https://discuss.elastic.co/t/how-to-create-filter-to-handle-spaces-commas-in-street-addresses-person-names/226604)
**Author:** [@hc-jgregory](https://discuss.elastic.co/u/hc-jgregory)\ **Replies:** 1\ **Last updated:** [April 6, 2020, 6:33am UTC](https://discuss.elastic.co/t/how-to-create-filter-to-handle-spaces-commas-in-street-addresses-person-names/226604 "2020-04-06T06:33:46Z")
Sample text from log (comes in a segment without quotes enclosing field and values as expected if true JSON): {Field1=1111 NE 1ST AVE,Field2=ATLANTA, GA 30309-1111,Field3=JOHN ALLEN DOE} filter { gr… --- ## [Kibana unable to load index in Elasticsearch](https://discuss.elastic.co/t/kibana-unable-to-load-index-in-elasticsearch/226179)
**Author:** [@anirudhak](https://discuss.elastic.co/u/anirudhak)\ **Replies:** 8\ **Last updated:** [April 6, 2020, 6:21am UTC](https://discuss.elastic.co/t/kibana-unable-to-load-index-in-elasticsearch/226179 "2020-04-06T06:21:58Z")
I have just installed Kibana, Elastic and Filebeat on my Red Hat 7.7 servers using RPM. Details, Filebeat 7.6.1 Elastic 7.6.1 Kibana 7.6.1 Filebeat is installed on two nodes and Kibana and Elastic are installed on the… --- ## [Region map in Kibana](https://discuss.elastic.co/t/region-map-in-kibana/226565)
**Author:** [@legolas\_bilbao](https://discuss.elastic.co/u/legolas_bilbao)\ **Replies:** 2\ **Last updated:** [April 6, 2020, 6:03am UTC](https://discuss.elastic.co/t/region-map-in-kibana/226565 "2020-04-06T06:03:09Z")
hi everybody, where can i find the region map en Kibana 7. I dont find it regards --- ## [Error whilie csv download \[monitoring execution failed org.elasticsearch.xpack.monitoring.exporter.ExportException\]](https://discuss.elastic.co/t/error-whilie-csv-download-monitoring-execution-failed-org-elasticsearch-xpack-monitoring-exporter-exportexception/226622)
**Author:** [@mist](https://discuss.elastic.co/u/mist)\ **Replies:** 0\ **Last updated:** [April 6, 2020, 6:02am UTC](https://discuss.elastic.co/t/error-whilie-csv-download-monitoring-execution-failed-org-elasticsearch-xpack-monitoring-exporter-exportexception/226622 "2020-04-06T06:02:08Z")
Hello All I am using ES 7.4.0 on AWS. I tried to download csv from kibana, but the error occurred and I checked the log and found the following log. elastic\_search log : \[instance-0000000008\] monitoring execution fai… --- ## [Change Indices Name after Snapshot](https://discuss.elastic.co/t/change-indices-name-after-snapshot/226603)
**Author:** [@jamesyone](https://discuss.elastic.co/u/jamesyone)\ **Replies:** 3\ **Last updated:** [April 6, 2020, 5:39am UTC](https://discuss.elastic.co/t/change-indices-name-after-snapshot/226603 "2020-04-06T05:39:12Z")
Hi, I was able to take a manual screenshot of a index and transfer it to another domain. Is there a way to change that index name to a new index name when I restore the screenshot to the other domain? Thanks --- ## [Kibana canvas の Expression editor](https://discuss.elastic.co/t/kibana-canvas-expression-editor/226616)
**Author:** [@sshota](https://discuss.elastic.co/u/sshota)\ **Replies:** 0\ **Last updated:** [April 6, 2020, 5:22am UTC](https://discuss.elastic.co/t/kibana-canvas-expression-editor/226616 "2020-04-06T05:22:01Z")
お世話になります。 Kibana canvas の Markdownなどにおいて、 Expression editorを使って、値に応じて背景色を変えたり文字色を変えるなどを実現したいです。 下記discussの投稿や、function-referenceなどを参考にして、 とってきた数値データに応じて、とりあえず色を変えることなどは実現できました。 ただ、正式な文法や、何をどこに記載すればいいのかが全くわかっておらず、 … --- ## [Get value from json object](https://discuss.elastic.co/t/get-value-from-json-object/224347)
**Author:** [@Avend544](https://discuss.elastic.co/u/Avend544)\ **Replies:** 10\ **Last updated:** [April 6, 2020, 4:56am UTC](https://discuss.elastic.co/t/get-value-from-json-object/224347 "2020-04-06T04:56:36Z")
Hi! I have Kibana 7.3.2. I want to use own scripted field. I spent 5 hours for looking for the good try to get value from json object for a my scripted field. I have a next field with json object: { "timestamp": "20… --- ## [Keyword Insensitive Match](https://discuss.elastic.co/t/keyword-insensitive-match/226549)
**Author:** [@Jose\_Salgodo](https://discuss.elastic.co/u/Jose_Salgodo)\ **Replies:** 5\ **Last updated:** [April 6, 2020, 1:57am UTC](https://discuss.elastic.co/t/keyword-insensitive-match/226549 "2020-04-06T01:57:12Z")
any way to make a keyword type case insensitive ? an example would be me using match query and the input would be "input" and the output "InPuT" --- ## [Elasticsearch mTLS connection to S3 (minio) to store snapshots](https://discuss.elastic.co/t/elasticsearch-mtls-connection-to-s3-minio-to-store-snapshots/223997)
**Author:** [@bikkina\_mahesh](https://discuss.elastic.co/u/bikkina_mahesh)\ **Replies:** 2\ **Last updated:** [April 6, 2020, 1:12am UTC](https://discuss.elastic.co/t/elasticsearch-mtls-connection-to-s3-minio-to-store-snapshots/223997 "2020-04-06T01:12:47Z")
Hi All, I want to store snapshots in s3 storage where it requires mutual auth (mTLS) ( Note : S3 is minio based) I have client.crt, client.key, root.crt at client side. I tried these steps, 1. openssl pkcs12 -export … --- ## [Splitting syslog/beat entries by host?](https://discuss.elastic.co/t/splitting-syslog-beat-entries-by-host/226596)
**Author:** [@almathden](https://discuss.elastic.co/u/almathden)\ **Replies:** 2\ **Last updated:** [April 5, 2020, 11:15pm UTC](https://discuss.elastic.co/t/splitting-syslog-beat-entries-by-host/226596 "2020-04-05T23:15:11Z")
Hey Team! Due to the wildly different syslog formats (And my not understanding how to grok/mutate/etc properly yet) I'm trying to split my syslog inputs by IP address so there's a different index for each. It seems to m… --- ## [Creating Multiple Logstash indexes from Filebeat logs of different machines](https://discuss.elastic.co/t/creating-multiple-logstash-indexes-from-filebeat-logs-of-different-machines/226588)
**Author:** [@Claire08](https://discuss.elastic.co/u/Claire08)\ **Replies:** 2\ **Last updated:** [April 5, 2020, 10:48pm UTC](https://discuss.elastic.co/t/creating-multiple-logstash-indexes-from-filebeat-logs-of-different-machines/226588 "2020-04-05T22:48:06Z")
I am fairly new to ES and I have been testing filebeat/logstash configurations. I am trying to get Logstash to output to multiple indexes based on the logs collected from another remote machine. For example, I wanted to … --- ## [Logstash geo\_point support](https://discuss.elastic.co/t/logstash-geo-point-support/226595)
**Author:** [@jimmymacGA](https://discuss.elastic.co/u/jimmymacGA)\ **Replies:** 1\ **Last updated:** [April 5, 2020, 10:38pm UTC](https://discuss.elastic.co/t/logstash-geo-point-support/226595 "2020-04-05T22:38:40Z")
Why is there no support on this forum for logstash and geo\_point? Every thread goes ignored and support for geojson in logstash is non-existant ? --- ## [Parse SNMP table data](https://discuss.elastic.co/t/parse-snmp-table-data/226552)
**Author:** [@Sketchy](https://discuss.elastic.co/u/Sketchy)\ **Replies:** 4\ **Last updated:** [April 5, 2020, 10:36pm UTC](https://discuss.elastic.co/t/parse-snmp-table-data/226552 "2020-04-05T22:36:24Z")
I am experimenting moving some snmp monitoring from telegraf to logstash snmp imput but having some problems with the layout of the output and cant figure out how to efficiently parse this into a useful format. Currentl… --- ## [Join Statements](https://discuss.elastic.co/t/join-statements/226550)
**Author:** [@Vijayakumar\_Kannan](https://discuss.elastic.co/u/Vijayakumar_Kannan)\ **Replies:** 1\ **Last updated:** [April 5, 2020, 8:05pm UTC](https://discuss.elastic.co/t/join-statements/226550 "2020-04-05T20:05:58Z")
i have a log file . in which first line shows client login activity second line show file transfer activity. Common for both lines are pid. How to join based on pid field? --- ## [Custom Date range selectors](https://discuss.elastic.co/t/custom-date-range-selectors/226567)
**Author:** [@edwardj3](https://discuss.elastic.co/u/edwardj3)\ **Replies:** 2\ **Last updated:** [April 5, 2020, 7:39pm UTC](https://discuss.elastic.co/t/custom-date-range-selectors/226567 "2020-04-05T19:39:24Z")
Hi community, Had Data Analyst training this week and I asked if there were options to add the following to date picker section:- Yesterday Last Week Last Month This Week This Month I was advised that this could not … --- ## [Problem converting multi-delimited kv string](https://discuss.elastic.co/t/problem-converting-multi-delimited-kv-string/226527)
**Author:** [@adude946](https://discuss.elastic.co/u/adude946)\ **Replies:** 6\ **Last updated:** [April 5, 2020, 7:19pm UTC](https://discuss.elastic.co/t/problem-converting-multi-delimited-kv-string/226527 "2020-04-05T19:19:36Z")
I'm lost with converting 1 mysql column to ES via logstash. I can convert a single kv to the expected format but not multiple. Data is in 1 mysql column called "profile". It is going to ES under same field name, mappin… --- ## [Newly created index template does not apply on old indices?](https://discuss.elastic.co/t/newly-created-index-template-does-not-apply-on-old-indices/226583)
**Author:** [@ghost\_recon](https://discuss.elastic.co/u/ghost_recon)\ **Replies:** 2\ **Last updated:** [April 5, 2020, 7:01pm UTC](https://discuss.elastic.co/t/newly-created-index-template-does-not-apply-on-old-indices/226583 "2020-04-05T19:01:29Z")
I newly created an index templates that has the following index-pattern log-\*, And i already have an old index under the name log-server which has a timestamp field that contains a different format than the default form… --- ## [How do I test my condition statement that is not working?](https://discuss.elastic.co/t/how-do-i-test-my-condition-statement-that-is-not-working/226504)
**Author:** [@newmember](https://discuss.elastic.co/u/newmember)\ **Replies:** 5\ **Last updated:** [April 5, 2020, 1:25pm UTC](https://discuss.elastic.co/t/how-do-i-test-my-condition-statement-that-is-not-working/226504 "2020-04-05T13:25:34Z")
This is my preferred filter to capture "error" from the tag that is added in the 'input' as part of filebeat. This filter fails. filter { if "error" in \[tags\] { grok { match =\> \[ 'message', '^.\*=%{INT… --- ## [Retrying failed action with response code: 503 unavailable\_shards\_exception, reason =\> logstash primary shard is not active](https://discuss.elastic.co/t/retrying-failed-action-with-response-code-503-unavailable-shards-exception-reason-logstash-primary-shard-is-not-active/226437)
**Author:** [@vignesh.s2](https://discuss.elastic.co/u/vignesh.s2)\ **Replies:** 3\ **Last updated:** [April 5, 2020, 1:19pm UTC](https://discuss.elastic.co/t/retrying-failed-action-with-response-code-503-unavailable-shards-exception-reason-logstash-primary-shard-is-not-active/226437 "2020-04-05T13:19:51Z")
After upgrading to the latest version of the ELK 7.6.2 , I tried to restart the all the services. Only elasticsearch service is up and running. Logstash and kibana failed. Below mentioned is the error Apr 03 21:56:46 C… --- ## [Restore snapshot](https://discuss.elastic.co/t/restore-snapshot/224188)
**Author:** [@debasisc](https://discuss.elastic.co/u/debasisc)\ **Replies:** 8\ **Last updated:** [April 5, 2020, 11:55am UTC](https://discuss.elastic.co/t/restore-snapshot/224188 "2020-04-05T11:55:51Z")
I see this command in help site https://www.elastic.co/guide/en/elasticsearch/reference/current/snapshots-restore-snapshot.html POST /\_snapshot/my\_backup/snapshot\_1/\_restore But I am missing the prerequisite steps. H… --- ## [2 index same data](https://discuss.elastic.co/t/2-index-same-data/226551)
**Author:** [@legolas\_bilbao](https://discuss.elastic.co/u/legolas_bilbao)\ **Replies:** 7\ **Last updated:** [April 5, 2020, 10:51am UTC](https://discuss.elastic.co/t/2-index-same-data/226551 "2020-04-05T10:51:07Z")
Hi everybody , I've two index defined in the same logstash and the origin of the data are two different tables of a database. When i read the data with logstash and paint them into kibana, the data is mixed , why does … --- ## [CSV Date column replace to timestamp](https://discuss.elastic.co/t/csv-date-column-replace-to-timestamp/226560)
**Author:** [@lohit18](https://discuss.elastic.co/u/lohit18)\ **Replies:** 1\ **Last updated:** [April 5, 2020, 10:05am UTC](https://discuss.elastic.co/t/csv-date-column-replace-to-timestamp/226560 "2020-04-05T10:05:14Z")
Dear Team, Kindly help me out how to repalce with CSV date format(3/27/2020 18:01 PM) with logstash timestamp . I am passing .conf like this below input { file { path=\>"C:Downloads/low\_data.csv" start\_position=\>"… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1530) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1532)