# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1538 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1539 --- ## [Use logstash Sync kafka data to elasticsearch](https://discuss.elastic.co/t/use-logstash-sync-kafka-data-to-elasticsearch/226022)
**Author:** [@George\_Lee](https://discuss.elastic.co/u/George_Lee)\ **Replies:** 3\ **Last updated:** [April 2, 2020, 3:50am UTC](https://discuss.elastic.co/t/use-logstash-sync-kafka-data-to-elasticsearch/226022 "2020-04-02T03:50:18Z")
use logstash (version 7.3) Sync kafka data to elasticsearch.this is logstash config file input { kafka { codec =\> "json" auto\_offset\_reset =\> "earliest" bootstrap\_servers =\> "kafka-ece.crcloud.com:9092" … --- ## [Using forked plugin in an Logstash image](https://discuss.elastic.co/t/using-forked-plugin-in-an-logstash-image/226150)
**Author:** [@Suryatej\_Mukkamalla](https://discuss.elastic.co/u/Suryatej_Mukkamalla)\ **Replies:** 0\ **Last updated:** [April 2, 2020, 3:25am UTC](https://discuss.elastic.co/t/using-forked-plugin-in-an-logstash-image/226150 "2020-04-02T03:25:21Z")
I would like to fork my own version of the official Logstash kafka-input plugin. Is there a way for me to instruct the official Logstash 7.2.0 Docker image to install and use this forked version? --- ## [Search on Long is faster than keyword](https://discuss.elastic.co/t/search-on-long-is-faster-than-keyword/226145)
**Author:** [@kiranprakash154](https://discuss.elastic.co/u/kiranprakash154)\ **Replies:** 0\ **Last updated:** [April 2, 2020, 12:26am UTC](https://discuss.elastic.co/t/search-on-long-is-faster-than-keyword/226145 "2020-04-02T00:26:45Z")
Hi, I came across this article from ES on indexing fields as keywords would result in faster in search performance than having them as numerics I went ahead and benchmarked this and found out that this was not the case… --- ## [If condition after parsing logs in logstash](https://discuss.elastic.co/t/if-condition-after-parsing-logs-in-logstash/226130)
**Author:** [@Sepideh\_Bayati](https://discuss.elastic.co/u/Sepideh_Bayati)\ **Replies:** 2\ **Last updated:** [April 2, 2020, 12:24am UTC](https://discuss.elastic.co/t/if-condition-after-parsing-logs-in-logstash/226130 "2020-04-02T00:24:26Z")
hello. i have a logstash configuration file and i can parse input logs correctly. my question is: can i have conditions in my parsed data ? is this even possible in logastash config file ? for example i want only odd se… --- ## [Can't escape single quote in json input in kibana visualization](https://discuss.elastic.co/t/cant-escape-single-quote-in-json-input-in-kibana-visualization/226007)
**Author:** [@WAFA\_Mardiney](https://discuss.elastic.co/u/WAFA_Mardiney)\ **Replies:** 7\ **Last updated:** [April 2, 2020, 12:07am UTC](https://discuss.elastic.co/t/cant-escape-single-quote-in-json-input-in-kibana-visualization/226007 "2020-04-02T00:07:54Z")
I'm using kibana data table visualization and i need to make an aggregation that counts all fields that contains a specific message THAT contains single-quote, the problem is that i'm using painless lang in json input fi… --- ## [Data in old index has grok working, but new data in old index doesnt](https://discuss.elastic.co/t/data-in-old-index-has-grok-working-but-new-data-in-old-index-doesnt/226135)
**Author:** [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\ **Replies:** 1\ **Last updated:** [April 1, 2020, 11:59pm UTC](https://discuss.elastic.co/t/data-in-old-index-has-grok-working-but-new-data-in-old-index-doesnt/226135 "2020-04-01T23:59:39Z")
I created an index 2 days ago, and that has some data in it. The groks were being applied on it and fields created. But now I ran my logstash, filebeat, kibana again with same index named and new data does not have grok … --- ## [Visualizations: changing aggregation text on a median?](https://discuss.elastic.co/t/visualizations-changing-aggregation-text-on-a-median/226138)
**Author:** [@tedder](https://discuss.elastic.co/u/tedder)\ **Replies:** 2\ **Last updated:** [April 1, 2020, 11:56pm UTC](https://discuss.elastic.co/t/visualizations-changing-aggregation-text-on-a-median/226138 "2020-04-01T23:56:02Z")
When creating a line chart, I'm seeing "50th Percentile of \[Fieldname\]" for labels, like this: If I set a custom label, it only changes the ".. of \[Fieldname\]" part- in other words, it doesn't seem to be possible to g… --- ## [Forcemerge on daily or on monthly](https://discuss.elastic.co/t/forcemerge-on-daily-or-on-monthly/226059)
**Author:** [@Norman\_Khine](https://discuss.elastic.co/u/Norman_Khine)\ **Replies:** 2\ **Last updated:** [April 1, 2020, 11:45pm UTC](https://discuss.elastic.co/t/forcemerge-on-daily-or-on-monthly/226059 "2020-04-01T23:45:49Z")
Hello, We are implementing an Index Lifecycle Policy each month to reindex our daily indexes into a monthly index using the \_reindex api From https://www.elastic.co/blog/managing-time-based-indices-efficiently has good… --- ## [\[Kibana 7.5.2 - Table\] Scrollbars of Table visualisation are always visible in a dashboard](https://discuss.elastic.co/t/kibana-7-5-2-table-scrollbars-of-table-visualisation-are-always-visible-in-a-dashboard/226133)
**Author:** [@thanhvu](https://discuss.elastic.co/u/thanhvu)\ **Replies:** 5\ **Last updated:** [April 1, 2020, 11:30pm UTC](https://discuss.elastic.co/t/kibana-7-5-2-table-scrollbars-of-table-visualisation-are-always-visible-in-a-dashboard/226133 "2020-04-01T23:30:21Z")
Thanks so much for the great tool. But please can you help as the Scrollbars of table visualisation are always visible in a dashboard making it looks so bad? What should I do to fix it? --- ## [Unable to restart LS with: Logstash failed to create queue](https://discuss.elastic.co/t/unable-to-restart-ls-with-logstash-failed-to-create-queue/226134)
**Author:** [@mtudisco](https://discuss.elastic.co/u/mtudisco)\ **Replies:** 0\ **Last updated:** [April 1, 2020, 11:26pm UTC](https://discuss.elastic.co/t/unable-to-restart-ls-with-logstash-failed-to-create-queue/226134 "2020-04-01T23:26:36Z")
Hi, We have Logstash 7.5.1 configure with pipelines, our pipelines configuration is: - pipeline.id: main path.config: "/etc/logstash/config/main/\*.conf" queue.type: persisted queue.checkpoint.writes: 1 pipeline… --- ## [Check if items need updating](https://discuss.elastic.co/t/check-if-items-need-updating/226114)
**Author:** [@permagne](https://discuss.elastic.co/u/permagne)\ **Replies:** 1\ **Last updated:** [April 1, 2020, 10:39pm UTC](https://discuss.elastic.co/t/check-if-items-need-updating/226114 "2020-04-01T22:39:12Z")
Hi, Currently working on a scheduled batch import. The items that are being saved may or may not contain updated values. My question is if I should first get the documents by IDs and check if the items need updating, … --- ## [Logstash grok \_grokparsefailure tag](https://discuss.elastic.co/t/logstash-grok-grokparsefailure-tag/226123)
**Author:** [@Sepideh\_Bayati](https://discuss.elastic.co/u/Sepideh_Bayati)\ **Replies:** 2\ **Last updated:** [April 1, 2020, 9:20pm UTC](https://discuss.elastic.co/t/logstash-grok-grokparsefailure-tag/226123 "2020-04-01T21:20:40Z")
hi. im using syslog-ng and loggen to generate my logs and this is the one for example: \<38\>2020-04-01T23:30:02 localhost prg00000\[1234\]: seq: 0000000096, thread: 0000, runid: 1585767601, stamp: 2020-04-01T23:30:02 PADDP… --- ## [Input JDBC with mongo](https://discuss.elastic.co/t/input-jdbc-with-mongo/226125)
**Author:** [@7cinquante](https://discuss.elastic.co/u/7cinquante)\ **Replies:** 0\ **Last updated:** [April 1, 2020, 9:13pm UTC](https://discuss.elastic.co/t/input-jdbc-with-mongo/226125 "2020-04-01T21:13:18Z")
Hello, I have a config to get data from mongo , logstash get doc , but only one doc is in ES logstash conf input { jdbc { jdbc\_driver\_library =\> "/usr/share/logstash/logstash-core/lib/jars/mongojdbc1.8.jar" … --- ## [Should I connect to master or data nodes to index new documents?](https://discuss.elastic.co/t/should-i-connect-to-master-or-data-nodes-to-index-new-documents/226124)
**Author:** [@alecrooney](https://discuss.elastic.co/u/alecrooney)\ **Replies:** 1\ **Last updated:** [April 1, 2020, 9:06pm UTC](https://discuss.elastic.co/t/should-i-connect-to-master-or-data-nodes-to-index-new-documents/226124 "2020-04-01T21:06:41Z")
Seems like you can connect to any node and index and query data. If I have a cluster with 3 master nodes and 3+ data nodes, should I connect to the data nodes or master nodes to index or query documents? Should I round… --- ## [Logstash fails with error on logstash-core-plugin-api.gemspec](https://discuss.elastic.co/t/logstash-fails-with-error-on-logstash-core-plugin-api-gemspec/226054)
**Author:** [@fionamacd1](https://discuss.elastic.co/u/fionamacd1)\ **Replies:** 1\ **Last updated:** [April 1, 2020, 8:58pm UTC](https://discuss.elastic.co/t/logstash-fails-with-error-on-logstash-core-plugin-api-gemspec/226054 "2020-04-01T20:58:37Z")
Hi, I updated our logstash to use OpenJDK11 and it was working fine for a few days. Then logs files grew too big and disk space got eaten. I removed the extra log files, turned down the log level and still getting this … --- ## [ML can't assign in spaces \[Roles\]](https://discuss.elastic.co/t/ml-cant-assign-in-spaces-roles/226004)
**Author:** [@zeghitsama](https://discuss.elastic.co/u/zeghitsama)\ **Replies:** 2\ **Last updated:** [April 1, 2020, 8:17pm UTC](https://discuss.elastic.co/t/ml-cant-assign-in-spaces-roles/226004 "2020-04-01T20:17:24Z")
Hi guys, I've an issue about to assign space on role. I want to assign stack monitoring and machine learning on specific user. Anyone have solution for this? Thanks.! Screenshot 2020-04-01 at 4.24.25 PM|384x499 --- ## [Test for field name containing special characters](https://discuss.elastic.co/t/test-for-field-name-containing-special-characters/226117)
**Author:** [@sampas](https://discuss.elastic.co/u/sampas)\ **Replies:** 4\ **Last updated:** [April 1, 2020, 8:10pm UTC](https://discuss.elastic.co/t/test-for-field-name-containing-special-characters/226117 "2020-04-01T20:10:35Z")
I want to test a field name to see if it contains a "%" character and drop it if it does. I do a KV on web logs, and we regularly see threat actors trying to escape application logic with long strings in the URI, e.g. b… --- ## [Word\_delimiter\_graph + preserve\_original = token position matters for "match" query](https://discuss.elastic.co/t/word-delimiter-graph-preserve-original-token-position-matters-for-match-query/225944)
**Author:** [@jetnet](https://discuss.elastic.co/u/jetnet)\ **Replies:** 1\ **Last updated:** [April 1, 2020, 7:29pm UTC](https://discuss.elastic.co/t/word-delimiter-graph-preserve-original-token-position-matters-for-match-query/225944 "2020-04-01T19:29:19Z")
following issue: DELETE test PUT test { "settings": { "number\_of\_shards": "1", "number\_of\_replicas": "0", "analysis": { "filter": { "word\_delimiter\_filter": { "type": "word\_delimit… --- ## [Convert Field Data to UTF8 or ISO-8859-1](https://discuss.elastic.co/t/convert-field-data-to-utf8-or-iso-8859-1/226112)
**Author:** [@rviega](https://discuss.elastic.co/u/rviega)\ **Replies:** 0\ **Last updated:** [April 1, 2020, 6:24pm UTC](https://discuss.elastic.co/t/convert-field-data-to-utf8-or-iso-8859-1/226112 "2020-04-01T18:24:00Z")
Hi Everyone, I would like to convert a field called "subject" to UTF-8 but I wasn't able to do it. I have configured logstash using charset ISO-8859-1and UTF-8 but Is not working. Here is an example of the data from th… --- ## [Replacing special characters with gsub](https://discuss.elastic.co/t/replacing-special-characters-with-gsub/226098)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 2\ **Last updated:** [April 1, 2020, 6:17pm UTC](https://discuss.elastic.co/t/replacing-special-characters-with-gsub/226098 "2020-04-01T18:17:32Z")
I'm using gsub and regex to structure a field into json. Unfortunately, I'm having problems with double-quotes being escaped in the output. For example: Field: event Value: 'success': True "event", "'", "\\"", Expec… --- ## [Correlation Coefficient in Kibana](https://discuss.elastic.co/t/correlation-coefficient-in-kibana/225947)
**Author:** [@tshayan](https://discuss.elastic.co/u/tshayan)\ **Replies:** 3\ **Last updated:** [April 1, 2020, 6:09pm UTC](https://discuss.elastic.co/t/correlation-coefficient-in-kibana/225947 "2020-04-01T18:09:56Z")
Hello, I am wondering if there is a visualization in Kibana that supports the "matrix\_stats" aggregation. Specifically I am looking for a way to visualize a matrix/table that shows the correlation coefficient between mu… --- ## [How to warm up shard request cache?](https://discuss.elastic.co/t/how-to-warm-up-shard-request-cache/226109)
**Author:** [@hhsuey](https://discuss.elastic.co/u/hhsuey)\ **Replies:** 0\ **Last updated:** [April 1, 2020, 6:00pm UTC](https://discuss.elastic.co/t/how-to-warm-up-shard-request-cache/226109 "2020-04-01T18:00:39Z")
We have an elasticsearch cluster with 1 small index and high read to write volumes. It has 1 primary and several replicas to handle the read loads. We turned on shard request cache for searches (with size\>0 hits). As exp… --- ## [Logstash install plugin : how to get debug info](https://discuss.elastic.co/t/logstash-install-plugin-how-to-get-debug-info/226101)
**Author:** [@deslauriersp](https://discuss.elastic.co/u/deslauriersp)\ **Replies:** 0\ **Last updated:** [April 1, 2020, 5:39pm UTC](https://discuss.elastic.co/t/logstash-install-plugin-how-to-get-debug-info/226101 "2020-04-01T17:39:46Z")
I am using the base docker image from Logstash 7.6.0. It is a cenOS image. I am trying to install a custom java filter plugin. I used the example "java filter" in the Logstash to build from there. I built my gem on th… --- ## [Search character ( wild card )](https://discuss.elastic.co/t/search-character-wild-card/226091)
**Author:** [@hariskhalique](https://discuss.elastic.co/u/hariskhalique)\ **Replies:** 7\ **Last updated:** [April 1, 2020, 5:34pm UTC](https://discuss.elastic.co/t/search-character-wild-card/226091 "2020-04-01T17:34:56Z")
How we use wild card to search in elasticsearch. I try with following queries "query": { "wildcard": { "item\_name": { "value": "\*Iko\*", "boost": 1.0, "rewrite": "constant\_score" } } a… --- ## [How to construct geo\_point field from separate fields of latitude and longitude for Kibana 7.6?](https://discuss.elastic.co/t/how-to-construct-geo-point-field-from-separate-fields-of-latitude-and-longitude-for-kibana-7-6/225847)
**Author:** [@yassine\_belhajali](https://discuss.elastic.co/u/yassine_belhajali)\ **Replies:** 2\ **Last updated:** [April 1, 2020, 5:23pm UTC](https://discuss.elastic.co/t/how-to-construct-geo-point-field-from-separate-fields-of-latitude-and-longitude-for-kibana-7-6/225847 "2020-04-01T17:23:44Z")
From input csv data I have 2 fields of location - lat and long. How can I construct a geo\_point location field to create map visualization in logstash config (version 7.6)? Thank you. ' ' ' ' filter { csv{ separator… --- ## [Logstash events out of order](https://discuss.elastic.co/t/logstash-events-out-of-order/226082)
**Author:** [@sfischer](https://discuss.elastic.co/u/sfischer)\ **Replies:** 2\ **Last updated:** [April 1, 2020, 5:20pm UTC](https://discuss.elastic.co/t/logstash-events-out-of-order/226082 "2020-04-01T17:20:08Z")
Hello, I am monitoring a Java application with the elastic agent and create some custom transactions using the Java apm client. I configured the apm server to write all data into a file, so it can be collected later. … --- ## [\*Really\* Delete All Scrolls?](https://discuss.elastic.co/t/really-delete-all-scrolls/226097)
**Author:** [@vp\_tech](https://discuss.elastic.co/u/vp_tech)\ **Replies:** 0\ **Last updated:** [April 1, 2020, 5:18pm UTC](https://discuss.elastic.co/t/really-delete-all-scrolls/226097 "2020-04-01T17:18:08Z")
I'm familiar with DELETE /\_search/scroll/\_all But when I use it only a small handful of scrolls are actually closed (10-40) when I currently have 100s open. Is there a way to really clear all the open search contexts… --- ## [Using FROM option with delete by query](https://discuss.elastic.co/t/using-from-option-with-delete-by-query/225925)
**Author:** [@ninze](https://discuss.elastic.co/u/ninze)\ **Replies:** 3\ **Last updated:** [April 1, 2020, 5:13pm UTC](https://discuss.elastic.co/t/using-from-option-with-delete-by-query/225925 "2020-04-01T17:13:06Z")
Hi, I want to keep a max of 1000 latest documents (notifications) for each user. In case the search finds much more than that, I am trying to use "delete by query" to delete excess documents for the user. The docs for … --- ## [ILM Policy and Filebeat versions](https://discuss.elastic.co/t/ilm-policy-and-filebeat-versions/226095)
**Author:** [@t3fsx](https://discuss.elastic.co/u/t3fsx)\ **Replies:** 0\ **Last updated:** [April 1, 2020, 5:07pm UTC](https://discuss.elastic.co/t/ilm-policy-and-filebeat-versions/226095 "2020-04-01T17:07:08Z")
My setup is fairly simple. I use Filebeat, with all the default options to send to Elastic Cloud. My cluster is sized with 200GB. I see that each update of Filebeat is creating it's own ILM policy, and there's also an u… --- ## [SSL cert configuration for proxy and encryption for Elastic cluster nodes](https://discuss.elastic.co/t/ssl-cert-configuration-for-proxy-and-encryption-for-elastic-cluster-nodes/226093)
**Author:** [@chitraj8](https://discuss.elastic.co/u/chitraj8)\ **Replies:** 0\ **Last updated:** [April 1, 2020, 4:54pm UTC](https://discuss.elastic.co/t/ssl-cert-configuration-for-proxy-and-encryption-for-elastic-cluster-nodes/226093 "2020-04-01T16:54:27Z")
We have below setup for Elasticsearch consisting of stack components in front of haproxy server. cname and cert for below exists: data-eng.stats.com and urls below for elastic stack redirection from proxy data-eng.st… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1537) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1539)