# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1636 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1637 --- ## [Uploading third-party JSON output](https://discuss.elastic.co/t/uploading-third-party-json-output/218640)
**Author:** [@carenas](https://discuss.elastic.co/u/carenas)\ **Replies:** 1\ **Last updated:** [February 10, 2020, 9:03pm UTC](https://discuss.elastic.co/t/uploading-third-party-json-output/218640 "2020-02-10T21:03:28Z")
We are looking to analyze client log data that is exported (as JSON) from third-party SIEM products. Can this exported data be ingested as-is by Elastic SIEM and properly parsed? Or would we have to manually convert it… --- ## [Tracebeat - root privileges](https://discuss.elastic.co/t/tracebeat-root-privileges/218667)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 1\ **Last updated:** [February 10, 2020, 8:42pm UTC](https://discuss.elastic.co/t/tracebeat-root-privileges/218667 "2020-02-10T20:42:31Z")
Hi, I have a question about tracebeat. Tracebeat available at the address: The problem is probably classic. Can I run tracebeat somehow without root privileges? Is there any possibility? --- ## [System indices and number of replicas](https://discuss.elastic.co/t/system-indices-and-number-of-replicas/218395)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 1\ **Last updated:** [February 10, 2020, 8:32pm UTC](https://discuss.elastic.co/t/system-indices-and-number-of-replicas/218395 "2020-02-10T20:32:50Z")
I have a question about the number of replicas for system indices (Elasticsearch 7.5.x). Standard number of shards = 1, number of replicas = 1. Is it possible to change the number of replicas for system indices? For e… --- ## [Match all children items in an array](https://discuss.elastic.co/t/match-all-children-items-in-an-array/217747)
**Author:** [@akshaymaniyar](https://discuss.elastic.co/u/akshaymaniyar)\ **Replies:** 5\ **Last updated:** [February 10, 2020, 8:16pm UTC](https://discuss.elastic.co/t/match-all-children-items-in-an-array/217747 "2020-02-10T20:16:31Z")
I have the below structure Doc1: { "key1": "value1", "key2": \[ { "subId": "id1", "subKey1": "PASS" }, … --- ## [Not able to connect to ElasticSearch Cluster in AWS from Kibana](https://discuss.elastic.co/t/not-able-to-connect-to-elasticsearch-cluster-in-aws-from-kibana/218071)
**Author:** [@chilakala](https://discuss.elastic.co/u/chilakala)\ **Replies:** 3\ **Last updated:** [February 10, 2020, 8:05pm UTC](https://discuss.elastic.co/t/not-able-to-connect-to-elasticsearch-cluster-in-aws-from-kibana/218071 "2020-02-10T20:05:49Z")
Hi All, I have setup a Elastic search cluster in AWS using the ec2 discovery plugin. I have 2 Nodes, one as master and another as data node. They are able to discover automatically and i see the 2 Nodes on the master … --- ## [Get Kibana Cookie with Custom Realm](https://discuss.elastic.co/t/get-kibana-cookie-with-custom-realm/216747)
**Author:** [@YanbangLiuUiPath](https://discuss.elastic.co/u/YanbangLiuUiPath)\ **Replies:** 6\ **Last updated:** [February 10, 2020, 7:59pm UTC](https://discuss.elastic.co/t/get-kibana-cookie-with-custom-realm/216747 "2020-02-10T19:59:08Z")
Is there a way to get Kibana session cookie with custom realm? Right now I'm using Bearer token generated by ES for API calls in Kibana, but ultimately I want the users to be able to automatically login to their own kib… --- ## [Elastic Search is receiving data from beat, but no documents appear](https://discuss.elastic.co/t/elastic-search-is-receiving-data-from-beat-but-no-documents-appear/218230)
**Author:** [@dsdameron](https://discuss.elastic.co/u/dsdameron)\ **Replies:** 14\ **Last updated:** [February 10, 2020, 7:44pm UTC](https://discuss.elastic.co/t/elastic-search-is-receiving-data-from-beat-but-no-documents-appear/218230 "2020-02-10T19:44:29Z")
We have a beat with the panw module enabled collecting data from Palo Alto Firewalls. The data is being received by Elasticsearch but there are no documents. We have confirmed with a tcpdump the data is arriving from t… --- ## [Drop part of a fieldname](https://discuss.elastic.co/t/drop-part-of-a-fieldname/218660)
**Author:** [@olatunde.tokun](https://discuss.elastic.co/u/olatunde.tokun)\ **Replies:** 2\ **Last updated:** [February 10, 2020, 7:43pm UTC](https://discuss.elastic.co/t/drop-part-of-a-fieldname/218660 "2020-02-10T19:43:53Z")
Looking for a more efficient way to drop the top part of Windows fields (winlog) for 50+ fields. The less efficient way would be to have unique mutate \> rename entries for each field. Any ideas on achieving this would b… --- ## [Email alert in elasticsearch](https://discuss.elastic.co/t/email-alert-in-elasticsearch/218105)
**Author:** [@vishnuvardhan](https://discuss.elastic.co/u/vishnuvardhan)\ **Replies:** 2\ **Last updated:** [February 10, 2020, 7:36pm UTC](https://discuss.elastic.co/t/email-alert-in-elasticsearch/218105 "2020-02-10T19:36:20Z")
Hi Team, I am working on the Email Alert functionality, where i came different scenario like Let's Suppose I have configured the metricbeat & filebeat in 10 servers which will send the data to the Elastics cluster. Amo… --- ## [Cert-validity isn't working](https://discuss.elastic.co/t/cert-validity-isnt-working/218631)
**Author:** [@deepak\_deore](https://discuss.elastic.co/u/deepak_deore)\ **Replies:** 1\ **Last updated:** [February 10, 2020, 7:34pm UTC](https://discuss.elastic.co/t/cert-validity-isnt-working/218631 "2020-02-10T19:34:07Z")
I asked this question on slack but no reply yet so asking here: is there anything wrong with these ssl options, it doesn’t seem to be working, it always show 1 year certificate while accessing 9200 port this is the ope… --- ## [Filebeat to logstash](https://discuss.elastic.co/t/filebeat-to-logstash/218663)
**Author:** [@sunisola0202](https://discuss.elastic.co/u/sunisola0202)\ **Replies:** 0\ **Last updated:** [February 10, 2020, 7:31pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash/218663 "2020-02-10T19:31:32Z")
I am connecting filebeat to logstash Getting below errors 2020-02-11T03:30:44.949+0800 ERROR logstash/async.go:256 Failed to publish events caused by: read tcp 192.168.211.31:48788-\>192.168.215.31:9999: i/o timeout 20… --- ## [Will an even number of master nodes cause split brain situation with 7.x version of ES?](https://discuss.elastic.co/t/will-an-even-number-of-master-nodes-cause-split-brain-situation-with-7-x-version-of-es/218654)
**Author:** [@ted.fed](https://discuss.elastic.co/u/ted.fed)\ **Replies:** 5\ **Last updated:** [February 10, 2020, 7:25pm UTC](https://discuss.elastic.co/t/will-an-even-number-of-master-nodes-cause-split-brain-situation-with-7-x-version-of-es/218654 "2020-02-10T19:25:19Z")
Due to some limitation with our provisioning system, it is difficult to provision an odd number of nodes. For some other technologies, we have provisioned zookeepers with an even number of nodes for 2-3 years now and th… --- ## [Merge or combine 2 different input fields as 1](https://discuss.elastic.co/t/merge-or-combine-2-different-input-fields-as-1/218420)
**Author:** [@jrodbor](https://discuss.elastic.co/u/jrodbor)\ **Replies:** 3\ **Last updated:** [February 10, 2020, 7:11pm UTC](https://discuss.elastic.co/t/merge-or-combine-2-different-input-fields-as-1/218420 "2020-02-10T19:11:19Z")
Hello, I the input CSV file I have the timestamp file separate by a TAB, one as "date" and another as "time", is it possible load is as the timestamp one ? What is the code to doing it ? input { file { path =\> "/Use… --- ## [What is the maximum indexes I can have in one ES cluster?](https://discuss.elastic.co/t/what-is-the-maximum-indexes-i-can-have-in-one-es-cluster/218492)
**Author:** [@yuecong](https://discuss.elastic.co/u/yuecong)\ **Replies:** 2\ **Last updated:** [February 10, 2020, 6:22pm UTC](https://discuss.elastic.co/t/what-is-the-maximum-indexes-i-can-have-in-one-es-cluster/218492 "2020-02-10T18:22:19Z")
I understand one ES shard is one Lucien index and it will consume some amount of CPU/ memory. Is there some limitation on how many ES indexes I can have for one ES cluster? e.g. if I have thousands of indexes, but most … --- ## [Elasticsearch date parsing issue with default format](https://discuss.elastic.co/t/elasticsearch-date-parsing-issue-with-default-format/216617)
**Author:** [@MrSeeker](https://discuss.elastic.co/u/MrSeeker)\ **Replies:** 3\ **Last updated:** [February 10, 2020, 6:13pm UTC](https://discuss.elastic.co/t/elasticsearch-date-parsing-issue-with-default-format/216617 "2020-02-10T18:13:15Z")
I am having a problem to parse some dates in elasticsearch. I have posted about the problem in stackoverflow. Please help me on this as i also could have some yyyy-mm-dd format dates along with epoch. Thank you, --- ## [Error in custom analyzer and mappings in ES v7](https://discuss.elastic.co/t/error-in-custom-analyzer-and-mappings-in-es-v7/218593)
**Author:** [@prasad98](https://discuss.elastic.co/u/prasad98)\ **Replies:** 3\ **Last updated:** [February 10, 2020, 6:12pm UTC](https://discuss.elastic.co/t/error-in-custom-analyzer-and-mappings-in-es-v7/218593 "2020-02-10T18:12:34Z")
Hi, I'm trying to migrate my ES setup from 2.3 to 7.5. However, I'm facing an error with my custom analyzer: elastic: Error 400 (Bad Request): analyzer \[keyword\_lowercase\_remove\_space\] not found for field \[identity\_exac… --- ## [Heartbeat list of host help](https://discuss.elastic.co/t/heartbeat-list-of-host-help/217415)
**Author:** [@delatucci](https://discuss.elastic.co/u/delatucci)\ **Replies:** 8\ **Last updated:** [February 10, 2020, 5:41pm UTC](https://discuss.elastic.co/t/heartbeat-list-of-host-help/217415 "2020-02-10T17:41:16Z")
Hi all, I am trying to configure an icmp.yml file to ping a list of hosts on my network. I got it to ping the host that part is working, how do I add name: to the list of host. type: icmp enabled: true schedule: '@… --- ## [Elasticsearch query with timezone conversion](https://discuss.elastic.co/t/elasticsearch-query-with-timezone-conversion/215220)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 10\ **Last updated:** [February 10, 2020, 5:21pm UTC](https://discuss.elastic.co/t/elasticsearch-query-with-timezone-conversion/215220 "2020-02-10T17:21:39Z")
I have put a record in elk input message =\> '{"submitted\_date": "2020-01-14 10:05:11.11"}' it got saved as UTC, 8 hour earlier (Singapore timezone) { "submitted\_date" =\> 2020-01-14T02:05:11.110Z } in kibana dev … --- ## [Cant view indices in kibana discovery after deleting them and indexing them again](https://discuss.elastic.co/t/cant-view-indices-in-kibana-discovery-after-deleting-them-and-indexing-them-again/218607)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 2\ **Last updated:** [February 10, 2020, 5:21pm UTC](https://discuss.elastic.co/t/cant-view-indices-in-kibana-discovery-after-deleting-them-and-indexing-them-again/218607 "2020-02-10T17:21:33Z")
Hi I have deleted some indices, from elastic using kibana, after some changes in the configuration of logstash I have restarted logstash, create kibana indexes again, but nothing is showing in discovery; I have check th… --- ## [How can I migrate my v6 dashboards to v7](https://discuss.elastic.co/t/how-can-i-migrate-my-v6-dashboards-to-v7/218587)
**Author:** [@stephen.palfreyman](https://discuss.elastic.co/u/stephen.palfreyman)\ **Replies:** 4\ **Last updated:** [February 10, 2020, 5:15pm UTC](https://discuss.elastic.co/t/how-can-i-migrate-my-v6-dashboards-to-v7/218587 "2020-02-10T17:15:01Z")
In kibana 6.8.0 saved visualizations have an element called uiStateJSON, which has been deprecated in kibana 7 (in https://github.com/elastic/kibana/issues/15204 & https://github.com/elastic/kibana/pull/14949). However,… --- ## [Accent-insensitive search](https://discuss.elastic.co/t/accent-insensitive-search/218404)
**Author:** [@danielchodusov](https://discuss.elastic.co/u/danielchodusov)\ **Replies:** 1\ **Last updated:** [February 10, 2020, 5:12pm UTC](https://discuss.elastic.co/t/accent-insensitive-search/218404 "2020-02-10T17:12:02Z")
Hi, after spending hours trying to figure out I need a help with: How to search accent-insensitive + case insensitive? I have created an index: curl -X PUT "localhost:9200/my\_index?pretty" -H 'Content-Type: applicatio… --- ## [How to reindex using last weeks](https://discuss.elastic.co/t/how-to-reindex-using-last-weeks/218618)
**Author:** [@Mouloud\_CHIKHOUNE](https://discuss.elastic.co/u/Mouloud_CHIKHOUNE)\ **Replies:** 1\ **Last updated:** [February 10, 2020, 5:01pm UTC](https://discuss.elastic.co/t/how-to-reindex-using-last-weeks/218618 "2020-02-10T17:01:48Z")
Hello, I have a metricbeat index. "metricbeat" index contains documents from 2019 and 2020. I want to re-index the documents from last weekend (w-1) and (w-2) (w-n). example: POST \_reindex { "source": { "index"… --- ## [Elasticsearch IO characteristics on SSD Vs HDD](https://discuss.elastic.co/t/elasticsearch-io-characteristics-on-ssd-vs-hdd/218629)
**Author:** [@dbakti7](https://discuss.elastic.co/u/dbakti7)\ **Replies:** 1\ **Last updated:** [February 10, 2020, 5:01pm UTC](https://discuss.elastic.co/t/elasticsearch-io-characteristics-on-ssd-vs-hdd/218629 "2020-02-10T17:01:43Z")
Hi! We are trying to compare between SSD and HDD for our Elasticsearch use case. In one of the scenarios, we want to see how fast we can Open an index. Index size is around 4.5 - 5GB. For SSD, we observe that there s… --- ## [Beat ILM Problems](https://discuss.elastic.co/t/beat-ilm-problems/218636)
**Author:** [@Ali\_Szoenyi](https://discuss.elastic.co/u/Ali_Szoenyi)\ **Replies:** 0\ **Last updated:** [February 10, 2020, 4:32pm UTC](https://discuss.elastic.co/t/beat-ilm-problems/218636 "2020-02-10T16:32:04Z")
Dear All. I have following configuration. Elasticsearch Version 7.4.0 We have several beats in use. filebeat, metricbeat, packetbeat, auditbeat and heartbeat We have following to communication streams from the beats… --- ## [Проблемы со скорингом](https://discuss.elastic.co/t/topic/218317)
**Author:** [@nstrel](https://discuss.elastic.co/u/nstrel)\ **Replies:** 2\ **Last updated:** [February 10, 2020, 4:23pm UTC](https://discuss.elastic.co/t/topic/218317 "2020-02-10T16:23:36Z")
Выполняю поиски по десяти различным массивам. Массивы состоят из слов, словосочетаний (преимущественно русский и английский), а также из придуманных обозначений, например "}{отта6Ь1ч". Результаты поиска по нескольким ин… --- ## [Csv filter plugin mapping problem](https://discuss.elastic.co/t/csv-filter-plugin-mapping-problem/216887)
**Author:** [@mhyager](https://discuss.elastic.co/u/mhyager)\ **Replies:** 6\ **Last updated:** [February 10, 2020, 4:21pm UTC](https://discuss.elastic.co/t/csv-filter-plugin-mapping-problem/216887 "2020-02-10T16:21:28Z")
Can somebody help me understand this error? \[2020-01-28T17:29:58,361\]\[DEBUG\]\[o.e.a.b.TransportShardBulkAction\] \[AMIENS\] \[llmlogs-2020.01-000001\]\[0\] failed to execute bulk item (index) index {\[llmlogs-2020.01-000001\]\[\_do… --- ## [Nodes crashing with unable to create native thread error](https://discuss.elastic.co/t/nodes-crashing-with-unable-to-create-native-thread-error/216701)
**Author:** [@SpeedDaemon](https://discuss.elastic.co/u/SpeedDaemon)\ **Replies:** 1\ **Last updated:** [February 10, 2020, 4:19pm UTC](https://discuss.elastic.co/t/nodes-crashing-with-unable-to-create-native-thread-error/216701 "2020-02-10T16:19:45Z")
I have an elastic cluster that had some nodes crash due to the "java.lang.OutOfMemoryError: unable to create native thread" error. Found some other posts here with the same error, but no useful information yet. The clus… --- ## [Make logstash upload then exit](https://discuss.elastic.co/t/make-logstash-upload-then-exit/218421)
**Author:** [@Goishin](https://discuss.elastic.co/u/Goishin)\ **Replies:** 2\ **Last updated:** [February 10, 2020, 3:59pm UTC](https://discuss.elastic.co/t/make-logstash-upload-then-exit/218421 "2020-02-10T15:59:02Z")
I've got what appears to be a unique situation. I am using Kibana to dashboard test pass data after a dev commits code. Because of that, my log data isn't received in real time. I basically have a file with all my loggin… --- ## [Access Kibana Dashboard without login](https://discuss.elastic.co/t/access-kibana-dashboard-without-login/218626)
**Author:** [@BjoernB](https://discuss.elastic.co/u/BjoernB)\ **Replies:** 1\ **Last updated:** [February 10, 2020, 3:51pm UTC](https://discuss.elastic.co/t/access-kibana-dashboard-without-login/218626 "2020-02-10T15:51:17Z")
Seems to be a well discussed topic, but I might run into some difficulties. I'm using elastic-stack in Version: 6.2.4, x-pack installed. I already do the "anonymous"-user in elasticstack.yml - Where I can change the ac… --- ## [Grok pattern doesn't match path](https://discuss.elastic.co/t/grok-pattern-doesnt-match-path/218592)
**Author:** [@hrmzaqa](https://discuss.elastic.co/u/hrmzaqa)\ **Replies:** 5\ **Last updated:** [February 10, 2020, 3:27pm UTC](https://discuss.elastic.co/t/grok-pattern-doesnt-match-path/218592 "2020-02-10T15:27:59Z")
Hi, I have a problem that I cannot solve for too long so I'm using this forum to get a help :slight\_smile: i need to to get name of application server parsed from path. I have this simple pattern but i'm getting "\_gro… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1635) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1637)