# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1639 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1640 --- ## [Indexing question related to pipeline outputs](https://discuss.elastic.co/t/indexing-question-related-to-pipeline-outputs/218417)
**Author:** [@\_finack](https://discuss.elastic.co/u/_finack)\ **Replies:** 0\ **Last updated:** [February 7, 2020, 9:35pm UTC](https://discuss.elastic.co/t/indexing-question-related-to-pipeline-outputs/218417 "2020-02-07T21:35:21Z")
Issue: I have a Logstash pipeline output testing if \[agent\]\[type\] == "metricbeat". I am expecting such documents to end up in indices matching the pattern metricbeat-\*; however, some are ending up in indices matching the… --- ## [Logs parsed from Ubuntu but not from server with same configurations](https://discuss.elastic.co/t/logs-parsed-from-ubuntu-but-not-from-server-with-same-configurations/218412)
**Author:** [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\ **Replies:** 0\ **Last updated:** [February 7, 2020, 8:55pm UTC](https://discuss.elastic.co/t/logs-parsed-from-ubuntu-but-not-from-server-with-same-configurations/218412 "2020-02-07T20:55:47Z")
Filebeat is sending and logstahs is applying grok filter perfectly from Ubuntu, but from windows server it only passed logs but logstash isnt applying filters. I have the same config file for filebeat and logstash on ser… --- ## [Elasticsearch / Logstash isnt indexing all lines of json file](https://discuss.elastic.co/t/elasticsearch-logstash-isnt-indexing-all-lines-of-json-file/218411)
**Author:** [@richk516](https://discuss.elastic.co/u/richk516)\ **Replies:** 0\ **Last updated:** [February 7, 2020, 8:55pm UTC](https://discuss.elastic.co/t/elasticsearch-logstash-isnt-indexing-all-lines-of-json-file/218411 "2020-02-07T20:55:11Z")
I am running a very simple config, which should index a json file. It works fine when the json is small (4 or 5 lines) but then when it gets any longer, I get an error and it only indexes the last few lines. To test. To… --- ## [Login page and dark theme](https://discuss.elastic.co/t/login-page-and-dark-theme/218396)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 1\ **Last updated:** [February 7, 2020, 8:44pm UTC](https://discuss.elastic.co/t/login-page-and-dark-theme/218396 "2020-02-07T20:44:19Z")
Hi, Is there a simple/automatic way to set a dark theme also for the Kiban login page? The settings in the panel refer to Space after login. Is this issue known? --- ## [Logstash thread model - workaround for multiple destinations](https://discuss.elastic.co/t/logstash-thread-model-workaround-for-multiple-destinations/218401)
**Author:** [@g.le](https://discuss.elastic.co/u/g.le)\ **Replies:** 0\ **Last updated:** [February 7, 2020, 8:23pm UTC](https://discuss.elastic.co/t/logstash-thread-model-workaround-for-multiple-destinations/218401 "2020-02-07T20:23:24Z")
A while ago, I had created a thread regarding cloned events and delivery to two distinct Elasticsearch clusters. As it turned out, the thread model of Logstash does not guarantee delivery of an event to its proper outpu… --- ## [Keyname in json is causing an error](https://discuss.elastic.co/t/keyname-in-json-is-causing-an-error/218372)
**Author:** [@rich516](https://discuss.elastic.co/u/rich516)\ **Replies:** 0\ **Last updated:** [February 7, 2020, 3:27pm UTC](https://discuss.elastic.co/t/keyname-in-json-is-causing-an-error/218372 "2020-02-07T15:27:55Z")
I have a strange error that I cant figure out. I am using logstash 7.3.2 and have a simple config. Input is a json log file I am creating manually (just testing right now) Output is to elsasticsearch. When my test fi… --- ## [Rename nested field name](https://discuss.elastic.co/t/rename-nested-field-name/218398)
**Author:** [@sai\_kiran1](https://discuss.elastic.co/u/sai_kiran1)\ **Replies:** 2\ **Last updated:** [February 7, 2020, 8:11pm UTC](https://discuss.elastic.co/t/rename-nested-field-name/218398 "2020-02-07T20:11:46Z")
Hello, Trying to rename the fields \[field\]\[subfield\] to \[subfield\] for all the dynamic subfields I receive under my field. "field" : { "subfield\_1" : "value1", "subfield\_2" : "value2", . . "subfield\_n" : "value3" … --- ## [7.5.2 unable to revive connection (custom routine to generate certs)](https://discuss.elastic.co/t/7-5-2-unable-to-revive-connection-custom-routine-to-generate-certs/218254)
**Author:** [@elemus](https://discuss.elastic.co/u/elemus)\ **Replies:** 5\ **Last updated:** [February 7, 2020, 7:56pm UTC](https://discuss.elastic.co/t/7-5-2-unable-to-revive-connection-custom-routine-to-generate-certs/218254 "2020-02-07T19:56:17Z")
Hi again, Exists a way to see detailed kibana logs? I have the famous "unable to revive connection" exception using a docker compose (se below) When I pass verification mode to 'none' TLS works in cluster and kibana. … --- ## [How to import Winlogbeat index template when using ILM and Logstash?](https://discuss.elastic.co/t/how-to-import-winlogbeat-index-template-when-using-ilm-and-logstash/218354)
**Author:** [@fdaa](https://discuss.elastic.co/u/fdaa)\ **Replies:** 0\ **Last updated:** [February 7, 2020, 1:42pm UTC](https://discuss.elastic.co/t/how-to-import-winlogbeat-index-template-when-using-ilm-and-logstash/218354 "2020-02-07T13:42:30Z")
How do I manually import the Winlogbeat index template when using ILM and Logstash with the following configuration? I have tried every possible setting I can think of in my temporary winlogbeat.yml but can't get it to w… --- ## [Multi Search with Count greater than 10000](https://discuss.elastic.co/t/multi-search-with-count-greater-than-10000/218257)
**Author:** [@xavierstein](https://discuss.elastic.co/u/xavierstein)\ **Replies:** 2\ **Last updated:** [February 7, 2020, 7:31pm UTC](https://discuss.elastic.co/t/multi-search-with-count-greater-than-10000/218257 "2020-02-07T19:31:47Z")
Hello, I have two elasticsearch queries that I would like to combine into one using the \_msearch endpoint. The first one is a normal query to filter by \_ids and the second is a \_count query. Now I know I am able to com… --- ## [Haproxy Passthrough Endpoints for ECE](https://discuss.elastic.co/t/haproxy-passthrough-endpoints-for-ece/216695)
**Author:** [@balogan](https://discuss.elastic.co/u/balogan)\ **Replies:** 10\ **Last updated:** [February 7, 2020, 7:10pm UTC](https://discuss.elastic.co/t/haproxy-passthrough-endpoints-for-ece/216695 "2020-02-07T19:10:13Z")
I'm attempting to setup haproxy to service all endpoints within an ECE deployment. First step with getting wildcard DNS setup is done. The problem is getting the endpoints passed through to the proxy servers. After go… --- ## [Logstash not finding files](https://discuss.elastic.co/t/logstash-not-finding-files/218393)
**Author:** [@kberry](https://discuss.elastic.co/u/kberry)\ **Replies:** 0\ **Last updated:** [February 7, 2020, 6:59pm UTC](https://discuss.elastic.co/t/logstash-not-finding-files/218393 "2020-02-07T18:59:37Z")
I am running a logstash instance looking at 10000 gz files between kbs to mb in size. The files are stored in a folder structure of /var/log/prd/\/\/\/\/GZFILES/the\_files.gz. my file opti… --- ## [Match when paragraph contains sentences from indexes](https://discuss.elastic.co/t/match-when-paragraph-contains-sentences-from-indexes/218263)
**Author:** [@danieldou](https://discuss.elastic.co/u/danieldou)\ **Replies:** 0\ **Last updated:** [February 7, 2020, 1:07am UTC](https://discuss.elastic.co/t/match-when-paragraph-contains-sentences-from-indexes/218263 "2020-02-07T01:07:32Z")
I use elasticsearch to create a program allowing to find all the places in a text where the bible is quoted as well as the place where is the verse mentioned I indexed all the verses of the bible in elasticsearch, each v… --- ## [BulkProcessor best practice for heavy ingestion](https://discuss.elastic.co/t/bulkprocessor-best-practice-for-heavy-ingestion/217263)
**Author:** [@Faiz\_Ahmed\_Mushtak\_H](https://discuss.elastic.co/u/Faiz_Ahmed_Mushtak_H)\ **Replies:** 6\ **Last updated:** [February 7, 2020, 6:27pm UTC](https://discuss.elastic.co/t/bulkprocessor-best-practice-for-heavy-ingestion/217263 "2020-02-07T18:27:51Z")
We want to reindex documents into our new 7.2 ES cluster from our old 1.7 ES cluster (around 2TB of data) For indexing purpose, we are going to use the BulkProcessor API. We had three approaches in mind Have N (confi… --- ## [Setting total\_shards\_per\_node to zero](https://discuss.elastic.co/t/setting-total-shards-per-node-to-zero/218386)
**Author:** [@mikewillis](https://discuss.elastic.co/u/mikewillis)\ **Replies:** 1\ **Last updated:** [February 7, 2020, 6:25pm UTC](https://discuss.elastic.co/t/setting-total-shards-per-node-to-zero/218386 "2020-02-07T18:25:33Z")
How does Elasticsearch handleindex.routing.allocation.total\_shards\_per\_node getting set to 0 ? Setting it to 0 is obviously something that doesn't make sense to do, but Elasticsearch allows it to be done, so what if it … --- ## [Unable to use termsAggregation with includes\[\] on Long type fields](https://discuss.elastic.co/t/unable-to-use-termsaggregation-with-includes-on-long-type-fields/216895)
**Author:** [@jdcohen220](https://discuss.elastic.co/u/jdcohen220)\ **Replies:** 2\ **Last updated:** [February 7, 2020, 6:12pm UTC](https://discuss.elastic.co/t/unable-to-use-termsaggregation-with-includes-on-long-type-fields/216895 "2020-02-07T18:12:53Z")
I have a query with the following aggregation: "aggs": { "category": { "terms": { "field": "visits.categories", "include": \[ 887706088583989170 \] } This returns no results in the buckets section, however if I re… --- ## [Unique Count by using visual builder metric](https://discuss.elastic.co/t/unique-count-by-using-visual-builder-metric/218093)
**Author:** [@sajjithreddy](https://discuss.elastic.co/u/sajjithreddy)\ **Replies:** 4\ **Last updated:** [February 7, 2020, 6:12pm UTC](https://discuss.elastic.co/t/unique-count-by-using-visual-builder-metric/218093 "2020-02-07T18:12:28Z")
I have a question that, How we can get unique count of multiple events in visual builder or any visualization kibana? Let me explain my question clearly. In log stash events class name, git url and status is there. Thi… --- ## [Logstash Error to read SQL query for Firebird](https://discuss.elastic.co/t/logstash-error-to-read-sql-query-for-firebird/218388)
**Author:** [@eng.lucianamendes](https://discuss.elastic.co/u/eng.lucianamendes)\ **Replies:** 1\ **Last updated:** [February 7, 2020, 6:04pm UTC](https://discuss.elastic.co/t/logstash-error-to-read-sql-query-for-firebird/218388 "2020-02-07T18:04:56Z")
I´m using Logstash in Raspiberry Pi with OS Raspbian Jesse. It´s works with API, but it don't works with a Firebird. The error is : \[2020-02-07T14:43:11,666\]\[ERROR\]\[logstash.inputs.jdbc \] Java::JavaSql::SQLSyntaxE… --- ## [ELK with Xpack](https://discuss.elastic.co/t/elk-with-xpack/218343)
**Author:** [@kasim123](https://discuss.elastic.co/u/kasim123)\ **Replies:** 7\ **Last updated:** [February 7, 2020, 5:01pm UTC](https://discuss.elastic.co/t/elk-with-xpack/218343 "2020-02-07T17:01:08Z")
Hi Team, I have configued elasticsearch statefulset object using official elasticsearch helm chart https://github.com/elastic/helm-charts. I enabeld xpack security feature and created a CA certificate on one of the ela… --- ## [Same field different types (primitive vs. complex)](https://discuss.elastic.co/t/same-field-different-types-primitive-vs-complex/218047)
**Author:** [@Bartlomiej\_Palmowski](https://discuss.elastic.co/u/Bartlomiej_Palmowski)\ **Replies:** 2\ **Last updated:** [February 7, 2020, 4:54pm UTC](https://discuss.elastic.co/t/same-field-different-types-primitive-vs-complex/218047 "2020-02-07T16:54:15Z")
Hi, please forgive me for this very basic question but I can't find an answer so far. I'm sending my logs to AWS CloudWatch and from there I'm using an AWS Lambda to push said logs to AWS hosted ElasticSearch. The prob… --- ## [Unable to connect to Elasticsearch. Error: \[mapper\_parsing\_exception\] No handler for type \[flattened\] declared on field \[state\]](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-error-mapper-parsing-exception-no-handler-for-type-flattened-declared-on-field-state/215378)
**Author:** [@o1o1o11o1](https://discuss.elastic.co/u/o1o1o11o1)\ **Replies:** 13\ **Last updated:** [February 7, 2020, 4:18pm UTC](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-error-mapper-parsing-exception-no-handler-for-type-flattened-declared-on-field-state/215378 "2020-02-07T16:18:53Z")
After upgrading Elasticsearch and Kibana from 7.1 to 7.5.1 Kibana is unable to start with the following error: Unable to connect to Elasticsearch. Error: \[mapper\_parsing\_exception\] No handler for type \[flattened\] declar… --- ## [Kibana Data Table to group by fields](https://discuss.elastic.co/t/kibana-data-table-to-group-by-fields/218232)
**Author:** [@Joseph\_Mak](https://discuss.elastic.co/u/Joseph_Mak)\ **Replies:** 2\ **Last updated:** [February 7, 2020, 4:15pm UTC](https://discuss.elastic.co/t/kibana-data-table-to-group-by-fields/218232 "2020-02-07T16:15:52Z")
If I have something super simple like this, a bunch of records with a few fields and a timestamp. Is there a way to build a Data Table (or some other visualization), grouping by each of the fields? For example, in the … --- ## [Issue with Time Range visualization](https://discuss.elastic.co/t/issue-with-time-range-visualization/218370)
**Author:** [@enordstrand](https://discuss.elastic.co/u/enordstrand)\ **Replies:** 2\ **Last updated:** [February 7, 2020, 4:02pm UTC](https://discuss.elastic.co/t/issue-with-time-range-visualization/218370 "2020-02-07T16:02:57Z")
Hello I have an issue with vizualisation in Kibana. See bellow picture. I want the Aggregation "Date Range" show bar graphs that are side by side, with a space between them and I want the time ranges to be listed under … --- ## [New field or update field after data insertion?](https://discuss.elastic.co/t/new-field-or-update-field-after-data-insertion/218378)
**Author:** [@ccfc1986](https://discuss.elastic.co/u/ccfc1986)\ **Replies:** 0\ **Last updated:** [February 7, 2020, 3:57pm UTC](https://discuss.elastic.co/t/new-field-or-update-field-after-data-insertion/218378 "2020-02-07T15:57:57Z")
Hello! I am working with a specific data set that i have ingested into elastic via filebeat from a JSON file. The data contains a large number of fields, and two of them are specific to my question. I have longitude and … --- ## [FailureReason: Unrecoverable/Unexpected BadResponse while attempting POST](https://discuss.elastic.co/t/failurereason-unrecoverable-unexpected-badresponse-while-attempting-post/218377)
**Author:** [@amit\_kumar3](https://discuss.elastic.co/u/amit_kumar3)\ **Replies:** 0\ **Last updated:** [February 7, 2020, 3:55pm UTC](https://discuss.elastic.co/t/failurereason-unrecoverable-unexpected-badresponse-while-attempting-post/218377 "2020-02-07T15:55:12Z")
System.IO.IOException: Received an unexpected EOF or 0 bytes from the transport stream. at System.Net.ConnectStream.Read(Byte buffer, Int32 offset, Int32 size) at System.IO.StreamReader.ReadBuffer(Char userBuffer, Int3… --- ## [Reason for creating a custom document\_id?](https://discuss.elastic.co/t/reason-for-creating-a-custom-document-id/218368)
**Author:** [@\_finack](https://discuss.elastic.co/u/_finack)\ **Replies:** 1\ **Last updated:** [February 7, 2020, 3:46pm UTC](https://discuss.elastic.co/t/reason-for-creating-a-custom-document-id/218368 "2020-02-07T15:46:41Z")
I've seen various Logstash filter plugins customizing the document\_id field in pipeline filters (e.g. the HELK project). I'm trying to make sense of the reason for doing this. Doesn't a unique document\_id get applied aut… --- ## [Numbers in Table and JSON are different](https://discuss.elastic.co/t/numbers-in-table-and-json-are-different/218362)
**Author:** [@ldevlnull](https://discuss.elastic.co/u/ldevlnull)\ **Replies:** 1\ **Last updated:** [February 7, 2020, 3:24pm UTC](https://discuss.elastic.co/t/numbers-in-table-and-json-are-different/218362 "2020-02-07T15:24:47Z")
I noticed strange thing in logs: the number-value of marker in table-view differs from the corresponding value of field in JSON. What is this? --- ## [Calculate time difference in scripted field](https://discuss.elastic.co/t/calculate-time-difference-in-scripted-field/216893)
**Author:** [@Anne\_Kim](https://discuss.elastic.co/u/Anne_Kim)\ **Replies:** 11\ **Last updated:** [February 7, 2020, 3:21pm UTC](https://discuss.elastic.co/t/calculate-time-difference-in-scripted-field/216893 "2020-02-07T15:21:12Z")
Hello, The question is how to get the difference rounded to a day between the dates in a document? For example, if date1 = 2019-12-27T23:00:00.999 and date2 = 2019-12-28T01:00:00.999, the answer is 1. I'm already usin… --- ## [Use BulkProcessor with RefreshPolicy.WAIT\_UNTIL](https://discuss.elastic.co/t/use-bulkprocessor-with-refreshpolicy-wait-until/217934)
**Author:** [@mmu](https://discuss.elastic.co/u/mmu)\ **Replies:** 6\ **Last updated:** [February 7, 2020, 3:10pm UTC](https://discuss.elastic.co/t/use-bulkprocessor-with-refreshpolicy-wait-until/217934 "2020-02-07T15:10:27Z")
The the current documentation \[1\] states how to wait for bulk requests to become visible for search: BulkRequest request = new BulkRequest(); // wait for bulk transaction results to become visible for search request.set… --- ## [How to generate last login report in kibana](https://discuss.elastic.co/t/how-to-generate-last-login-report-in-kibana/218136)
**Author:** [@mkanukur](https://discuss.elastic.co/u/mkanukur)\ **Replies:** 1\ **Last updated:** [February 7, 2020, 3:05pm UTC](https://discuss.elastic.co/t/how-to-generate-last-login-report-in-kibana/218136 "2020-02-07T15:05:25Z")
Hi All, I'm trying to generate a report for last logon activity for all users. Entire cluster is on 7.2.1(BLEK). Any suggestions ? Thanks in advance [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1638) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1640)