# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1547 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1548 --- ## [Enrich policy with integrated sort/search query](https://discuss.elastic.co/t/enrich-policy-with-integrated-sort-search-query/225349)
**Author:** [@winlamp](https://discuss.elastic.co/u/winlamp)\ **Replies:** 7\ **Last updated:** [March 28, 2020, 2:04pm UTC](https://discuss.elastic.co/t/enrich-policy-with-integrated-sort-search-query/225349 "2020-03-28T14:04:48Z")
Hi, I'm trying to integrate a search query into my enrich policy. This step is required since I only require the most recent data from my index. Therefore i would like to do a sort based on the index @timestamp. I alre… --- ## [Unforseen data loss in ES Cluster. Need help recovering it!](https://discuss.elastic.co/t/unforseen-data-loss-in-es-cluster-need-help-recovering-it/225266)
**Author:** [@Vinay\_Kumar3](https://discuss.elastic.co/u/Vinay_Kumar3)\ **Replies:** 6\ **Last updated:** [March 28, 2020, 11:39am UTC](https://discuss.elastic.co/t/unforseen-data-loss-in-es-cluster-need-help-recovering-it/225266 "2020-03-28T11:39:38Z")
Our scenario below. Self-Managed ES 3-node cluster on AWS EC2. How can we recover this data loss described below? Can your team of experts help? The loss of all user data was confirmed by looking at elasticsearch and … --- ## [Logstash Ruby Filter Not Removing Fields](https://discuss.elastic.co/t/logstash-ruby-filter-not-removing-fields/225297)
**Author:** [@Rahul\_Kumar4](https://discuss.elastic.co/u/Rahul_Kumar4)\ **Replies:** 3\ **Last updated:** [March 28, 2020, 11:06am UTC](https://discuss.elastic.co/t/logstash-ruby-filter-not-removing-fields/225297 "2020-03-28T11:06:33Z")
Hello, I have logs that look like this { "attachments" : \[ { "field1" : "rkredux", "inner\_value" : \[ "check" \] }, { "field1" … --- ## [Grok Matches but getting \_grokparsefailure in Kibana](https://discuss.elastic.co/t/grok-matches-but-getting-grokparsefailure-in-kibana/225476)
**Author:** [@Harsh\_Sharma](https://discuss.elastic.co/u/Harsh_Sharma)\ **Replies:** 0\ **Last updated:** [March 28, 2020, 8:58am UTC](https://discuss.elastic.co/t/grok-matches-but-getting-grokparsefailure-in-kibana/225476 "2020-03-28T08:58:26Z")
I don't know what's wrong here. Grok matches for access.log but when creating index pattern in KIBANA logs showing \_grokparsefailure I'm using ELK version of 6.5.4. Sample log - 157.50.50.50 - - \[28/Mar/2020:13:36:28 … --- ## [Dealing with IPs and the end of mapping types](https://discuss.elastic.co/t/dealing-with-ips-and-the-end-of-mapping-types/225460)
**Author:** [@joaociocca](https://discuss.elastic.co/u/joaociocca)\ **Replies:** 4\ **Last updated:** [March 28, 2020, 2:56am UTC](https://discuss.elastic.co/t/dealing-with-ips-and-the-end-of-mapping-types/225460 "2020-03-28T02:56:52Z")
So, I've been reading a lot about how the mapping types are "in extinction" and will be gone in 8.x, but I don't understand is how do we deal with searching related to IP types when it's gone. Maybe there's something ab… --- ## [Spell check Questions](https://discuss.elastic.co/t/spell-check-questions/225474)
**Author:** [@vijay2](https://discuss.elastic.co/u/vijay2)\ **Replies:** 0\ **Last updated:** [March 27, 2020, 11:55pm UTC](https://discuss.elastic.co/t/spell-check-questions/225474 "2020-03-27T23:55:07Z")
Hello, Which one is good for spell correction?? Term suggest or Phrase suggest?? I did a search Case 1: Input:- guci walet Phrase Suggester test:- Output:- 1st result : Gucci walet. 2nd result: guci wallet In t… --- ## [Query ideas for my usecase to find order status](https://discuss.elastic.co/t/query-ideas-for-my-usecase-to-find-order-status/225469)
**Author:** [@rajsolanki](https://discuss.elastic.co/u/rajsolanki)\ **Replies:** 0\ **Last updated:** [March 27, 2020, 10:30pm UTC](https://discuss.elastic.co/t/query-ideas-for-my-usecase-to-find-order-status/225469 "2020-03-27T22:30:38Z")
Firstly sorry if i m asking elementary questions and bit long question. So i have a need for some sort of join query ( i know Elasticsearch is not RDBMS ) so i m looking for ideas. So here are my few sample docs. { … --- ## [Enhance ELK data records with an external source?](https://discuss.elastic.co/t/enhance-elk-data-records-with-an-external-source/225291)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 2\ **Last updated:** [March 27, 2020, 8:45pm UTC](https://discuss.elastic.co/t/enhance-elk-data-records-with-an-external-source/225291 "2020-03-27T20:45:32Z")
Hello Logstash Gurus, I have built a server that receives network data from external sources. That data goes into Logstash, then Elasticsearch, then is displayed on Kibana. Everything works great. (I’m using ELK vers… --- ## [Metricbeat module docker vs memory dataset](https://discuss.elastic.co/t/metricbeat-module-docker-vs-memory-dataset/224802)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 15\ **Last updated:** [March 27, 2020, 8:04pm UTC](https://discuss.elastic.co/t/metricbeat-module-docker-vs-memory-dataset/224802 "2020-03-27T20:04:08Z")
When I try to run metricbeat 7.6.1 on a CentOS 7 box with docker-engine-17.05.0.ce-1.el7.centos.x86\_64, I see these warning logged every time docker attempts to ship the memory metricset: 2020-03-24T11:14:00.316+0100\ **Author:** [@Supermathie](https://discuss.elastic.co/u/Supermathie)\ **Replies:** 8\ **Last updated:** [March 27, 2020, 7:30pm UTC](https://discuss.elastic.co/t/syntax-to-specify-multiple-hosts-using-elasticsearch-hosts-env/221306 "2020-03-27T19:30:22Z") follow-up to: https://discuss.elastic.co/t/kibana-docker-list-multiple-es-hosts/189594?u=supermathie I have tried various values for this environment variable: http://elasticsearch-1:9200,http://elasticsearch-2:9200,ht… --- ## [Timestamp auto create](https://discuss.elastic.co/t/timestamp-auto-create/225433)
**Author:** [@edkash](https://discuss.elastic.co/u/edkash)\ **Replies:** 1\ **Last updated:** [March 27, 2020, 6:58pm UTC](https://discuss.elastic.co/t/timestamp-auto-create/225433 "2020-03-27T18:58:12Z")
Hello guys. I creating index on elasticsearch, inserting json files. So, how can i configure index to creating timestamp automatically? Because dont wanna inserting json date filed on all json post requests, if possib… --- ## [EUI BasicTable selection updates not reflecting](https://discuss.elastic.co/t/eui-basictable-selection-updates-not-reflecting/225310)
**Author:** [@tiburon\_security](https://discuss.elastic.co/u/tiburon_security)\ **Replies:** 2\ **Last updated:** [March 27, 2020, 6:30pm UTC](https://discuss.elastic.co/t/eui-basictable-selection-updates-not-reflecting/225310 "2020-03-27T18:30:19Z")
Hi all, I'm using an EUI BasicTable with the selection feature for performing actions against rows of data. However, when I programatically update the tables selection (for example in response to an action against a row)… --- ## [Two different aggregate blocks in one logstash filter](https://discuss.elastic.co/t/two-different-aggregate-blocks-in-one-logstash-filter/225205)
**Author:** [@dsv](https://discuss.elastic.co/u/dsv)\ **Replies:** 3\ **Last updated:** [March 27, 2020, 5:47pm UTC](https://discuss.elastic.co/t/two-different-aggregate-blocks-in-one-logstash-filter/225205 "2020-03-27T17:47:26Z")
Need to aggregate two different sets of Cisco ASA logs. One - for a cert verification, other - for a firewall. ### TOKEN PRESENSE CHECK (717022 - cert validated THAN 722051 - IP assigned, # To match task\_id user.nam… --- ## [Elasticsearch bulk slows down after a certain amount of documents](https://discuss.elastic.co/t/elasticsearch-bulk-slows-down-after-a-certain-amount-of-documents/225434)
**Author:** [@Ivan\_Janev](https://discuss.elastic.co/u/Ivan_Janev)\ **Replies:** 3\ **Last updated:** [March 27, 2020, 5:41pm UTC](https://discuss.elastic.co/t/elasticsearch-bulk-slows-down-after-a-certain-amount-of-documents/225434 "2020-03-27T17:41:03Z")
Hello, I'm experiencing problems when using the bulk feature of Elastic but I'm still very novice in ES so I don't know how to even debug it properly. The problem: I'm trying to index 2 million documents using the bul… --- ## [Logstash only receiving DNS log while ignoring DHCP using filebeat](https://discuss.elastic.co/t/logstash-only-receiving-dns-log-while-ignoring-dhcp-using-filebeat/225422)
**Author:** [@data101](https://discuss.elastic.co/u/data101)\ **Replies:** 6\ **Last updated:** [March 27, 2020, 5:30pm UTC](https://discuss.elastic.co/t/logstash-only-receiving-dns-log-while-ignoring-dhcp-using-filebeat/225422 "2020-03-27T17:30:42Z")
Hello, I am trying to ship windows server DNS and DHCP logs to my testing ELK environment (Ubuntu). I can see Filebeat is sending the logs but for some reason logstash is only receiving dns logs, not dhcp. I am using la… --- ## [Can I delete the kibana\_task\_manager indices](https://discuss.elastic.co/t/can-i-delete-the-kibana-task-manager-indices/225445)
**Author:** [@dao](https://discuss.elastic.co/u/dao)\ **Replies:** 1\ **Last updated:** [March 27, 2020, 5:04pm UTC](https://discuss.elastic.co/t/can-i-delete-the-kibana-task-manager-indices/225445 "2020-03-27T17:04:11Z")
It is not clear on what those index are storing (can see some maps and lens related documents) Is it possible to delete them to limit my shards? what would be the consequences? --- ## [Generic search between docs added with Logstash or Filebeat](https://discuss.elastic.co/t/generic-search-between-docs-added-with-logstash-or-filebeat/225080)
**Author:** [@jason26](https://discuss.elastic.co/u/jason26)\ **Replies:** 2\ **Last updated:** [March 27, 2020, 4:53pm UTC](https://discuss.elastic.co/t/generic-search-between-docs-added-with-logstash-or-filebeat/225080 "2020-03-27T16:53:49Z")
I don't have control over how the JSON logs I'm trying to search get added to ElasticSearch, but its always Filebeat or Logstash. Something I've noticed, is for a specific field Filebeat has the mapping: "si… --- ## [Rollover logs indexed daily](https://discuss.elastic.co/t/rollover-logs-indexed-daily/225421)
**Author:** [@hongphuc95](https://discuss.elastic.co/u/hongphuc95)\ **Replies:** 6\ **Last updated:** [March 27, 2020, 4:47pm UTC](https://discuss.elastic.co/t/rollover-logs-indexed-daily/225421 "2020-03-27T16:47:14Z")
Hello every, I hope you all doing well during this time of confinement So basically what I have is a series of logs indexed daily into Elasticsearch, my logs index pattern is logs-YYYY.MM.DD I'm trying to set up a rol… --- ## [Fielddata is disabled, but I have added a keyword field](https://discuss.elastic.co/t/fielddata-is-disabled-but-i-have-added-a-keyword-field/222353)
**Author:** [@Terran](https://discuss.elastic.co/u/Terran)\ **Replies:** 30\ **Last updated:** [March 27, 2020, 4:46pm UTC](https://discuss.elastic.co/t/fielddata-is-disabled-but-i-have-added-a-keyword-field/222353 "2020-03-27T16:46:25Z")
I seem to be having an issue with mapping in my template. I have a field with data type "text", when I look into the Kibana SIEM console I receive the following error for several of my fields: \[illegal\_argument\_excepti… --- ## [Filtering on nested json fields of varying length](https://discuss.elastic.co/t/filtering-on-nested-json-fields-of-varying-length/225373)
**Author:** [@cyoez](https://discuss.elastic.co/u/cyoez)\ **Replies:** 3\ **Last updated:** [March 27, 2020, 4:44pm UTC](https://discuss.elastic.co/t/filtering-on-nested-json-fields-of-varying-length/225373 "2020-03-27T16:44:05Z")
Hello everyone, First of all, I am new to Logstash, so I would not be surprised if what I am asking is not within the scope of what Logstash can do. So, I am working on a project where I need to do multiple GeoIP looku… --- ## [Kibana connected to WebSockets](https://discuss.elastic.co/t/kibana-connected-to-websockets/225312)
**Author:** [@jondorozco](https://discuss.elastic.co/u/jondorozco)\ **Replies:** 2\ **Last updated:** [March 27, 2020, 4:18pm UTC](https://discuss.elastic.co/t/kibana-connected-to-websockets/225312 "2020-03-27T16:18:51Z")
Hi all, I am looking to use Kibana as the visualization/monitoring tool. I have several questions regarding Kibana and Elasticsearch as a whole. Does Kibana require Elasticsearch to perform its function of creating vi… --- ## [\[Gsoc\]New Component Idea](https://discuss.elastic.co/t/gsoc-new-component-idea/225332)
**Author:** [@Lokesh\_Rana](https://discuss.elastic.co/u/Lokesh_Rana)\ **Replies:** 1\ **Last updated:** [March 27, 2020, 4:09pm UTC](https://discuss.elastic.co/t/gsoc-new-component-idea/225332 "2020-03-27T16:09:33Z")
I have been going through eui components, there aren't any which can implement the functionality of Infinite scroll and carousel. Thinking of including them along with live documentation proposal. Any ideas? --- ## [Kibana 7.4.2 Plugin Development. Using external project with shared code](https://discuss.elastic.co/t/kibana-7-4-2-plugin-development-using-external-project-with-shared-code/225141)
**Author:** [@Javek](https://discuss.elastic.co/u/Javek)\ **Replies:** 2\ **Last updated:** [March 27, 2020, 3:58pm UTC](https://discuss.elastic.co/t/kibana-7-4-2-plugin-development-using-external-project-with-shared-code/225141 "2020-03-27T15:58:57Z")
Hi. I am developing a plugin for kibana with react and typescript. I also have a separate node js backend that the plugin's backend communicates with. These plugins and the backend have a common code, which I put in a s… --- ## [Unable to find usable node.js executable on ppc64le](https://discuss.elastic.co/t/unable-to-find-usable-node-js-executable-on-ppc64le/225384)
**Author:** [@aishwaryabk](https://discuss.elastic.co/u/aishwaryabk)\ **Replies:** 4\ **Last updated:** [March 27, 2020, 3:31pm UTC](https://discuss.elastic.co/t/unable-to-find-usable-node-js-executable-on-ppc64le/225384 "2020-03-27T15:31:05Z")
Hi, When i try to run kibana on ppc64le it gives me this \[root@p006vm32 kibana\]# docker run -it kibana:7.6.0 unable to find usable node.js executable. I have built kibana:7.6.0 image using centos:7 as the base image F… --- ## [Kibana iframe working due to cookies attribute "SameSite"](https://discuss.elastic.co/t/kibana-iframe-working-due-to-cookies-attribute-samesite/225326)
**Author:** [@rebirther](https://discuss.elastic.co/u/rebirther)\ **Replies:** 3\ **Last updated:** [March 27, 2020, 3:15pm UTC](https://discuss.elastic.co/t/kibana-iframe-working-due-to-cookies-attribute-samesite/225326 "2020-03-27T15:15:33Z")
At moment, Kibana refuses to work in newer versions of browsers for iframe (for example for Chrome 80.0.3987.149). Is there any way on the Kibana side to set cookies attributes - "SameSite=None" and "Secure"? --- ## [How to measure megabytes transferred between Beats and Logstash over 5044 port](https://discuss.elastic.co/t/how-to-measure-megabytes-transferred-between-beats-and-logstash-over-5044-port/225431)
**Author:** [@saif3r](https://discuss.elastic.co/u/saif3r)\ **Replies:** 0\ **Last updated:** [March 27, 2020, 3:15pm UTC](https://discuss.elastic.co/t/how-to-measure-megabytes-transferred-between-beats-and-logstash-over-5044-port/225431 "2020-03-27T15:15:06Z")
Hello, I was asked to measure how much data we send from Beats to Logstash over 24h period. Are such statistics available somewhere in Beats or Logstash? I can't install anything on a computer where Beats is installed s… --- ## [RDS -\> (Logstash) -\> Elasticsearch の取り込みができない](https://discuss.elastic.co/t/rds-logstash-elasticsearch/225406)
**Author:** [@sogaoh](https://discuss.elastic.co/u/sogaoh)\ **Replies:** 1\ **Last updated:** [March 27, 2020, 3:11pm UTC](https://discuss.elastic.co/t/rds-logstash-elasticsearch/225406 "2020-03-27T15:11:49Z")
バージョン： logstash:7.6.1 ( https://hub.docker.com/\_/logstash?tab=tags ) Logstash Pipeline を利用した AWS RDS (MySQL 5.7.12) からの AWS Elasticsearch(7.1) へのデータ流し込みでつまづいてしまっています。 おそらく該当のテーブルに geometry型のカラムがあるためではないかと思い、以下２点を試したので… --- ## [Elastic Cloud APM Server - Queue is full](https://discuss.elastic.co/t/elastic-cloud-apm-server-queue-is-full/225282)
**Author:** [@Edgar\_Peixoto](https://discuss.elastic.co/u/Edgar_Peixoto)\ **Replies:** 2\ **Last updated:** [March 27, 2020, 2:53pm UTC](https://discuss.elastic.co/t/elastic-cloud-apm-server-queue-is-full/225282 "2020-03-27T14:53:43Z")
I have many Java microservices running in a Kubernetes Cluster. All of them are APM agents sending data to an APM server in our Elastic Cloud Cluster. Everything was working fine but suddenly every microservice received… --- ## [Managing a large number of Dashboards/visualizations](https://discuss.elastic.co/t/managing-a-large-number-of-dashboards-visualizations/225067)
**Author:** [@akrzos](https://discuss.elastic.co/u/akrzos)\ **Replies:** 1\ **Last updated:** [March 27, 2020, 2:45pm UTC](https://discuss.elastic.co/t/managing-a-large-number-of-dashboards-visualizations/225067 "2020-03-27T14:45:17Z")
I have created several dashboards with many visualizations, it is pretty easy to export/import these into separate elastic clusters however making a small change that would affect all of the visualizations (TSVB) seems t… --- ## [Shared Cluster - Nested Object Not Showing Child Objects](https://discuss.elastic.co/t/shared-cluster-nested-object-not-showing-child-objects/225038)
**Author:** [@uklipse](https://discuss.elastic.co/u/uklipse)\ **Replies:** 2\ **Last updated:** [March 27, 2020, 2:39pm UTC](https://discuss.elastic.co/t/shared-cluster-nested-object-not-showing-child-objects/225038 "2020-03-27T14:39:26Z")
I have a shared cluster that ties into multiple client clusters and I'm trying to create a dashboard to show geo information from them all but in the table view the child fields under geoip such as geoip.country\_name are… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1546) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1548)