# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1539 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1540 --- ## [Standard Deviations, Revisited](https://discuss.elastic.co/t/standard-deviations-revisited/225731)
**Author:** [@gardanni](https://discuss.elastic.co/u/gardanni)\ **Replies:** 4\ **Last updated:** [April 1, 2020, 4:45pm UTC](https://discuss.elastic.co/t/standard-deviations-revisited/225731 "2020-04-01T16:45:33Z")
I'm going down one rabbit hole after another. I wonder if someone would offer some input. I have hourly data that I want to aggregate by Date and Count. Based on this data, I want to establish another column showing how … --- ## [Aggregate return all data](https://discuss.elastic.co/t/aggregate-return-all-data/226053)
**Author:** [@hariskhalique](https://discuss.elastic.co/u/hariskhalique)\ **Replies:** 9\ **Last updated:** [April 1, 2020, 4:37pm UTC](https://discuss.elastic.co/t/aggregate-return-all-data/226053 "2020-04-01T16:37:27Z")
Hi, Following is my query GET product\_detail\_info/\_search { "query": { "multi\_match": { "query": "a", "fields": \["item\_name", "description","cat\_name","item\_details"\] } }, "aggs": { "search\_result": { "terms"… --- ## [Set multiple base\_dn values in elasticsearch.yml](https://discuss.elastic.co/t/set-multiple-base-dn-values-in-elasticsearch-yml/226090)
**Author:** [@Yuriy](https://discuss.elastic.co/u/Yuriy)\ **Replies:** 0\ **Last updated:** [April 1, 2020, 4:35pm UTC](https://discuss.elastic.co/t/set-multiple-base-dn-values-in-elasticsearch-yml/226090 "2020-04-01T16:35:59Z")
In my Active Directory users are contained in two different organisation units: OU=users,OU=unit-01,DC=example,DC=com OU=users,OU=unit-02,DC=example,DC=com How can I set both base\_dn values with condition "OR" to opti… --- ## [Multiline codec produces ParseException: No close tag for /Events](https://discuss.elastic.co/t/multiline-codec-produces-parseexception-no-close-tag-for-events/226010)
**Author:** [@Paul\_Offord](https://discuss.elastic.co/u/Paul_Offord)\ **Replies:** 3\ **Last updated:** [April 1, 2020, 4:20pm UTC](https://discuss.elastic.co/t/multiline-codec-produces-parseexception-no-close-tag-for-events/226010 "2020-04-01T16:20:22Z")
Hi, I am ingesting an XML file that looks like this: \ \ - about 630,000 of these events ... stuff \ \ The input section of … --- ## [Send logs from native mobile apps to Kibana](https://discuss.elastic.co/t/send-logs-from-native-mobile-apps-to-kibana/226086)
**Author:** [@magdamiu](https://discuss.elastic.co/u/magdamiu)\ **Replies:** 0\ **Last updated:** [April 1, 2020, 4:08pm UTC](https://discuss.elastic.co/t/send-logs-from-native-mobile-apps-to-kibana/226086 "2020-04-01T16:08:03Z")
Hello, How could I send the logs from a native mobile app (android, ios) to Kibana? What product provided by elastic should I use? Thank you, Magda --- ## [Remove message and replace timestamp fields](https://discuss.elastic.co/t/remove-message-and-replace-timestamp-fields/226025)
**Author:** [@manikandanb87](https://discuss.elastic.co/u/manikandanb87)\ **Replies:** 2\ **Last updated:** [April 1, 2020, 3:49pm UTC](https://discuss.elastic.co/t/remove-message-and-replace-timestamp-fields/226025 "2020-04-01T15:49:56Z")
Hi Experts, I am using log stash to read my logs and I notice that the field "message" is there by default and has the complete data in it. So, I would like to remove it from my feed. Also, I want to replace "@timesta… --- ## [Way to filtering search result by user/dept role?](https://discuss.elastic.co/t/way-to-filtering-search-result-by-user-dept-role/225842)
**Author:** [@111307](https://discuss.elastic.co/u/111307)\ **Replies:** 1\ **Last updated:** [April 1, 2020, 3:47pm UTC](https://discuss.elastic.co/t/way-to-filtering-search-result-by-user-dept-role/225842 "2020-04-01T15:47:18Z")
Hi Experts, I'm configuring intranet search page. One of the requirements of this project is that users can get the search result only in their department's data. I have "user id" & "dept id" fields but dont know how t… --- ## [Support of AWS (S3, EC2, ELB, Billing, etc.) in Apache Open source elasticsearch](https://discuss.elastic.co/t/support-of-aws-s3-ec2-elb-billing-etc-in-apache-open-source-elasticsearch/225843)
**Author:** [@Stephy\_Jacob](https://discuss.elastic.co/u/Stephy_Jacob)\ **Replies:** 1\ **Last updated:** [April 1, 2020, 3:37pm UTC](https://discuss.elastic.co/t/support-of-aws-s3-ec2-elb-billing-etc-in-apache-open-source-elasticsearch/225843 "2020-04-01T15:37:37Z")
Hi Team, Could you please explain more on AWS (S3, EC2, ELB, Billing, etc.) as a data source not supported in Open source license version of elasticsearch mentioned in this page. https://www.elastic.co/subscriptions W… --- ## [Filebeat no create object property alias](https://discuss.elastic.co/t/filebeat-no-create-object-property-alias/225388)
**Author:** [@josgut](https://discuss.elastic.co/u/josgut)\ **Replies:** 1\ **Last updated:** [April 1, 2020, 3:31pm UTC](https://discuss.elastic.co/t/filebeat-no-create-object-property-alias/225388 "2020-04-01T15:31:29Z")
Hello, i'm trying to configure filebeat and use kibana iis sample dashboard, but i can't because filebeat setup doesn't create mapped alias of geoip object, for example, i see iis geoip object index template void, becaus… --- ## [Parse json with multiple lists to different events](https://discuss.elastic.co/t/parse-json-with-multiple-lists-to-different-events/225987)
**Author:** [@aleixsb](https://discuss.elastic.co/u/aleixsb)\ **Replies:** 1\ **Last updated:** [April 1, 2020, 3:18pm UTC](https://discuss.elastic.co/t/parse-json-with-multiple-lists-to-different-events/225987 "2020-04-01T15:18:24Z")
Hi all, I'm trying to parse a json I get from an API which contains several lists of objects, which I would like to parse each object of each list to a different event. { "Time":"XXXXX", "listA":\[ \], "listB":\[… --- ## [Multiple logs showing Kibana](https://discuss.elastic.co/t/multiple-logs-showing-kibana/225769)
**Author:** [@anmohamed](https://discuss.elastic.co/u/anmohamed)\ **Replies:** 1\ **Last updated:** [April 1, 2020, 3:14pm UTC](https://discuss.elastic.co/t/multiple-logs-showing-kibana/225769 "2020-04-01T15:14:38Z")
Current Config is filter { grok { patterns\_dir =\> \["./patterns"\] match =\> { "message" =\> "\[%{TIMESTAMP\_ISO8601:timestamp} #%{POSINT:pid}\] \*%{RUBY\_LOGLEVEL:loglevel} -- +%{DATA:progname}: %{GREEDYDATA:message}" } } … --- ## [Technical enquiry - setting "hosts" in the "output" pipeline section](https://discuss.elastic.co/t/technical-enquiry-setting-hosts-in-the-output-pipeline-section/226028)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 1\ **Last updated:** [April 1, 2020, 3:09pm UTC](https://discuss.elastic.co/t/technical-enquiry-setting-hosts-in-the-output-pipeline-section/226028 "2020-04-01T15:09:29Z")
Take for example the documentation for plugins-outputs-lumberjack: list of addresses lumberjack can send to This plugin can send data to hosts from an array called "hosts". This is simple. There is information in… --- ## [ES 7.1 repository type \[azure\] does not exist](https://discuss.elastic.co/t/es-7-1-repository-type-azure-does-not-exist/225468)
**Author:** [@jperezvt](https://discuss.elastic.co/u/jperezvt)\ **Replies:** 5\ **Last updated:** [April 1, 2020, 3:09pm UTC](https://discuss.elastic.co/t/es-7-1-repository-type-azure-does-not-exist/225468 "2020-04-01T15:09:23Z")
I'm running ES 7.1 in Azure govcloud, its working fine and now wish to setting snapshots. Here is what I've done Install plugin PLUGIN\_BIN=/usr/share/elasticsearch/bin/elasticsearch-plugin echo "y" | $PLUGIN\_BIN instal… --- ## [Dateparse failure jdbc](https://discuss.elastic.co/t/dateparse-failure-jdbc/226055)
**Author:** [@karlm](https://discuss.elastic.co/u/karlm)\ **Replies:** 1\ **Last updated:** [April 1, 2020, 3:02pm UTC](https://discuss.elastic.co/t/dateparse-failure-jdbc/226055 "2020-04-01T15:02:21Z")
i have an datetime column from sql and trying to map it to the @timetsamp field but receiving date parse error sql column date 2020-03-24 11:44:03.000 filter filter{ date { match =\> \[ "date", "yyyy-MM-dd HH:m… --- ## [Is it a bad practice to stop ELK daily](https://discuss.elastic.co/t/is-it-a-bad-practice-to-stop-elk-daily/222458)
**Author:** [@nahiko2000](https://discuss.elastic.co/u/nahiko2000)\ **Replies:** 7\ **Last updated:** [April 1, 2020, 2:49pm UTC](https://discuss.elastic.co/t/is-it-a-bad-practice-to-stop-elk-daily/222458 "2020-04-01T14:49:44Z")
Hi! I guess it is a bad practice to stop Elastic/Logstash/Kibana in the evening and start it in the morning, but it is not going to be used (we use it for logs, some logs would be ingested, but they can be ingested in t… --- ## [Updating existing documents with a new field](https://discuss.elastic.co/t/updating-existing-documents-with-a-new-field/225701)
**Author:** [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\ **Replies:** 2\ **Last updated:** [April 1, 2020, 2:35pm UTC](https://discuss.elastic.co/t/updating-existing-documents-with-a-new-field/225701 "2020-04-01T14:35:15Z")
Hello all, we're ingesting Windows event logs via Logstash and to get specific field data from an application log I've got the following filter in Logstash: if \[log\_name\] == "CISAccess" { grok { match =\> { "mes… --- ## [ELK v7.6 Kibana page hang (or crash) with sum bucket, aggregate --\> terms](https://discuss.elastic.co/t/elk-v7-6-kibana-page-hang-or-crash-with-sum-bucket-aggregate-terms/225924)
**Author:** [@subok](https://discuss.elastic.co/u/subok)\ **Replies:** 4\ **Last updated:** [April 1, 2020, 2:26pm UTC](https://discuss.elastic.co/t/elk-v7-6-kibana-page-hang-or-crash-with-sum-bucket-aggregate-terms/225924 "2020-04-01T14:26:57Z")
After upgrading from v7.1 to v7.6.1 i've noticed that when you create a visualization ("Table") in Kibana using Metric --\> Sum Bucket -- then --\> Bucket Aggregate = Terms.. then Kibana page STOPS until the browser indica… --- ## [I received the error ORA-01008: not all variables bound when i execute the logstash config file.can u pls tell about this error.Thanks in advance](https://discuss.elastic.co/t/i-received-the-error-ora-01008-not-all-variables-bound-when-i-execute-the-logstash-config-file-can-u-pls-tell-about-this-error-thanks-in-advance/226062)
**Author:** [@chelseia](https://discuss.elastic.co/u/chelseia)\ **Replies:** 0\ **Last updated:** [April 1, 2020, 2:18pm UTC](https://discuss.elastic.co/t/i-received-the-error-ora-01008-not-all-variables-bound-when-i-execute-the-logstash-config-file-can-u-pls-tell-about-this-error-thanks-in-advance/226062 "2020-04-01T14:18:20Z")
input{ jdbc{ clean\_run =\> true jdbc\_driver\_library =\> "C:/Program Files/SQL Developer 4/jdbc/lib/ojdbc8.jar" jdbc\_driver\_class =\> "Java::oracle.jdbc.driver.OracleDriver" jdbc\_connection\_string =\> "" jdbc\_user =\> "u… --- ## [Retrieve the last value of each "should" in a bool query](https://discuss.elastic.co/t/retrieve-the-last-value-of-each-should-in-a-bool-query/225634)
**Author:** [@LeopoldBriand](https://discuss.elastic.co/u/LeopoldBriand)\ **Replies:** 1\ **Last updated:** [April 1, 2020, 2:02pm UTC](https://discuss.elastic.co/t/retrieve-the-last-value-of-each-should-in-a-bool-query/225634 "2020-04-01T14:02:08Z")
Hi, I'm new to using Elastisearch and I'm completely stuck on a query. I've actually written this query that returns different values for all the ingredients. { "query": { "bool": { "must": … --- ## [Mount Shared Drive](https://discuss.elastic.co/t/mount-shared-drive/226035)
**Author:** [@cpb14pk](https://discuss.elastic.co/u/cpb14pk)\ **Replies:** 1\ **Last updated:** [April 1, 2020, 1:09pm UTC](https://discuss.elastic.co/t/mount-shared-drive/226035 "2020-04-01T13:09:58Z")
Hi, I am trying to mount a shared drive across three elasticsearch nodes with the aim of snapshotting an elasticsearch repository. I have three different nodes across three different centos servers, e.g. 10.212.145.10, … --- ## [Need help in capturing a pattern](https://discuss.elastic.co/t/need-help-in-capturing-a-pattern/225853)
**Author:** [@manikandanb87](https://discuss.elastic.co/u/manikandanb87)\ **Replies:** 4\ **Last updated:** [April 1, 2020, 12:41pm UTC](https://discuss.elastic.co/t/need-help-in-capturing-a-pattern/225853 "2020-04-01T12:41:41Z")
Hi Experts, Iam using filebeat to feed my logs to Logstash. Now, I need your help in capturing the occurences of "Sign on Code failed for user" in my logs. Kindly help me with the grok pattern code for it. My sample l… --- ## [Shodan Integration](https://discuss.elastic.co/t/shodan-integration/223425)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 4\ **Last updated:** [April 1, 2020, 12:41pm UTC](https://discuss.elastic.co/t/shodan-integration/223425 "2020-04-01T12:41:18Z")
Has anyone managed to get Shodan.io alerts into Elastic SIEM? I'm trying to use kubi-ecs-logger logging library and the shodan python api to send ECS alerts and wondered if anyone is interested in collaborating? H --- ## [Help with bundling search results](https://discuss.elastic.co/t/help-with-bundling-search-results/226041)
**Author:** [@MartinKip](https://discuss.elastic.co/u/MartinKip)\ **Replies:** 0\ **Last updated:** [April 1, 2020, 12:11pm UTC](https://discuss.elastic.co/t/help-with-bundling-search-results/226041 "2020-04-01T12:11:01Z")
Hello, I am having trouble finding out if and how the following use case can be done with ElasticSearch. I have an elastic cluster index with Real Estate properties. Some of these properties are the same property, but … --- ## [Xpath throws ClassCastException for one particular XML node](https://discuss.elastic.co/t/xpath-throws-classcastexception-for-one-particular-xml-node/226038)
**Author:** [@Paul\_Offord](https://discuss.elastic.co/u/Paul_Offord)\ **Replies:** 1\ **Last updated:** [April 1, 2020, 12:02pm UTC](https://discuss.elastic.co/t/xpath-throws-classcastexception-for-one-particular-xml-node/226038 "2020-04-01T12:02:42Z")
Hi, I am using the XML filter to ingest a file that looks like this: \ ... other events \ \ \ **Author:** [@deepak\_deore](https://discuss.elastic.co/u/deepak_deore)\ **Replies:** 6\ **Last updated:** [April 1, 2020, 11:42am UTC](https://discuss.elastic.co/t/horizontal-scaling-doesnt-improve-logshash-performance-with-kinesis-input-plugin/225674 "2020-04-01T11:42:31Z") as per prometheus metrics, only 1 logstash pod is processing the kinesis input, we need to vertically scale the pods in this case. can multiple logstash not work in parallel with kinesis input? --- ## [Logtrail performance](https://discuss.elastic.co/t/logtrail-performance/225989)
**Author:** [@Dawood](https://discuss.elastic.co/u/Dawood)\ **Replies:** 2\ **Last updated:** [April 1, 2020, 11:35am UTC](https://discuss.elastic.co/t/logtrail-performance/225989 "2020-04-01T11:35:53Z")
I have a question regarding Logtrail plugin in kibana. I am sending structured data from python using AsynchronousLogstashHandler: handler = AsynchronousLogstashHandler(host=self.logstash\_host, port=5045, database\_path=… --- ## [Some kind of logrotation implemented?](https://discuss.elastic.co/t/some-kind-of-logrotation-implemented/225864)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 2\ **Last updated:** [April 1, 2020, 10:31am UTC](https://discuss.elastic.co/t/some-kind-of-logrotation-implemented/225864 "2020-04-01T10:31:32Z")
Hi, is there any kind of log rotation implemented for kibana? Looks to me that kibana is the only compontent of elastic stack which cannot handle it - or did I miss sth? Thanks, Andreas --- ## [Why Filebeat is treating the the whole content of the file as a single message?](https://discuss.elastic.co/t/why-filebeat-is-treating-the-the-whole-content-of-the-file-as-a-single-message/225919)
**Author:** [@muntazirabbas](https://discuss.elastic.co/u/muntazirabbas)\ **Replies:** 0\ **Last updated:** [March 31, 2020, 4:53pm UTC](https://discuss.elastic.co/t/why-filebeat-is-treating-the-the-whole-content-of-the-file-as-a-single-message/225919 "2020-03-31T16:53:18Z")
Hi, I am trying to send some custome logs to elasticsearch but it seems filebeat is treating the content of the file as a single message while the file has many log entries. The file name syntax is as follows: F:\\inetp… --- ## [Stop Graphs Auto-Filling Blank Space in Dashboard](https://discuss.elastic.co/t/stop-graphs-auto-filling-blank-space-in-dashboard/225867)
**Author:** [@KatherineMunro](https://discuss.elastic.co/u/KatherineMunro)\ **Replies:** 2\ **Last updated:** [April 1, 2020, 9:46am UTC](https://discuss.elastic.co/t/stop-graphs-auto-filling-blank-space-in-dashboard/225867 "2020-04-01T09:46:04Z")
Hi, maybe I'm not phrasing this right but surprisingly can't find an online solution. I'm building a dashboard with multiple rows of graphs: each row should have three graphs except the top row which should have only tw… --- ## [Error when Registering new Snapshot Repository](https://discuss.elastic.co/t/error-when-registering-new-snapshot-repository/225828)
**Author:** [@cpb14pk](https://discuss.elastic.co/u/cpb14pk)\ **Replies:** 5\ **Last updated:** [April 1, 2020, 9:35am UTC](https://discuss.elastic.co/t/error-when-registering-new-snapshot-repository/225828 "2020-04-01T09:35:21Z")
Hi, I am trying to snapshot an elasticsearch repository. I have three different nodes across three different servers, e.g. 10.212.145.10, 10.212.145.20, 10.212.145.30. I have added the path.repo field in my elasticsear… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1538) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1540)