# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1653 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1654 --- ## [Trouble to understand some simple query](https://discuss.elastic.co/t/trouble-to-understand-some-simple-query/217387)
**Author:** [@Guss4241](https://discuss.elastic.co/u/Guss4241)\ **Replies:** 3\ **Last updated:** [January 31, 2020, 3:49pm UTC](https://discuss.elastic.co/t/trouble-to-understand-some-simple-query/217387 "2020-01-31T15:49:54Z")
Hi, i'm working with elasticsearch since some weeks now and I'm on the final step for my company project, but I have have some trouble to understand a trouble with a simple query. in my index I have a nested field call… --- ## [Any beats are able to sending K8S/GKE event](https://discuss.elastic.co/t/any-beats-are-able-to-sending-k8s-gke-event/217320)
**Author:** [@Vincent\_Ngai](https://discuss.elastic.co/u/Vincent_Ngai)\ **Replies:** 1\ **Last updated:** [January 31, 2020, 3:16pm UTC](https://discuss.elastic.co/t/any-beats-are-able-to-sending-k8s-gke-event/217320 "2020-01-31T15:16:11Z")
HI there May i know any one try sending GKE event (kubectl get event) to elasticsearch cluster by using one of the beats ?? --- ## [Extract multiple field/value pairs from single value in JSON string](https://discuss.elastic.co/t/extract-multiple-field-value-pairs-from-single-value-in-json-string/217367)
**Author:** [@Adi\_Buta](https://discuss.elastic.co/u/Adi_Buta)\ **Replies:** 2\ **Last updated:** [January 31, 2020, 3:11pm UTC](https://discuss.elastic.co/t/extract-multiple-field-value-pairs-from-single-value-in-json-string/217367 "2020-01-31T15:11:22Z")
Hello, I'm trying to extract some field/value pairs from a single field in a json string. My sample message: { ... "comment":"Ticket number : INC:I16393898, status : Work In Progress, group : Ent.Support.SOC.", ... … --- ## [Data Node Error \[Timed out when collecting data error\]](https://discuss.elastic.co/t/data-node-error-timed-out-when-collecting-data-error/216879)
**Author:** [@B.M](https://discuss.elastic.co/u/B.M)\ **Replies:** 0\ **Last updated:** [January 28, 2020, 4:36pm UTC](https://discuss.elastic.co/t/data-node-error-timed-out-when-collecting-data-error/216879 "2020-01-28T16:36:23Z")
Hi, we have a 9 nodes cluster in production that has been running for 10 days without any issues until a couple days ago when we increased the shard number from 2 shards & 1 replica to 3 shards & 1 replica. Juste after… --- ## [Logstash maintain order of updates](https://discuss.elastic.co/t/logstash-maintain-order-of-updates/217309)
**Author:** [@noelzubinvictor](https://discuss.elastic.co/u/noelzubinvictor)\ **Replies:** 1\ **Last updated:** [January 31, 2020, 3:00pm UTC](https://discuss.elastic.co/t/logstash-maintain-order-of-updates/217309 "2020-01-31T15:00:25Z")
I have a logstash jdbc pipeline that syncs data from postgres to elastic search. If I set the number of logstash workers to say 16. Does the pipeline still use only 1 thread. If it does use more than 1 thread then does l… --- ## [Создание индекса в logstash](https://discuss.elastic.co/t/logstash/217344)
**Author:** [@es7x](https://discuss.elastic.co/u/es7x)\ **Replies:** 1\ **Last updated:** [January 31, 2020, 2:54pm UTC](https://discuss.elastic.co/t/logstash/217344 "2020-01-31T14:54:58Z")
Собственно вопрос, при отправке индекса из логстеша в ELK ELK version 7.5.2 При такой записи создается индекс logstash-2020.01.31-000001 index =\> "logstash-%{+YYYY.MM.dd}" а при такой journalbeat-7.5.2-2020.01.31 … --- ## [Elasticsearch 6.2 service failed to start](https://discuss.elastic.co/t/elasticsearch-6-2-service-failed-to-start/216898)
**Author:** [@csrowell](https://discuss.elastic.co/u/csrowell)\ **Replies:** 2\ **Last updated:** [January 31, 2020, 2:40pm UTC](https://discuss.elastic.co/t/elasticsearch-6-2-service-failed-to-start/216898 "2020-01-31T14:40:27Z")
We did Windows updates this month and are now getting these errors: Windows Event Log: The Elasticsearch 6.2.4 (elasticsearch-service-x64) service terminated with the following service-specific error: Incorrect functi… --- ## [Unable to connect Kibana with Elasticsearch with docker-compose](https://discuss.elastic.co/t/unable-to-connect-kibana-with-elasticsearch-with-docker-compose/216894)
**Author:** [@Pablo95](https://discuss.elastic.co/u/Pablo95)\ **Replies:** 3\ **Last updated:** [January 31, 2020, 2:12pm UTC](https://discuss.elastic.co/t/unable-to-connect-kibana-with-elasticsearch-with-docker-compose/216894 "2020-01-31T14:12:05Z")
I can´t connect Kibana with my Elasticsearch. When I try to do it says: "Kibana server is not ready yet" How can I fix that? Thx --- ## [API Post role for kibana privileges - unexpected field \[kibana\]](https://discuss.elastic.co/t/api-post-role-for-kibana-privileges-unexpected-field-kibana/217123)
**Author:** [@Tennis](https://discuss.elastic.co/u/Tennis)\ **Replies:** 3\ **Last updated:** [January 31, 2020, 2:11pm UTC](https://discuss.elastic.co/t/api-post-role-for-kibana-privileges-unexpected-field-kibana/217123 "2020-01-31T14:11:03Z")
I want to create a role to control user access kibana feature (ref: Kibana privileges | Kibana Guide \[8.11\] | Elastic) My role in python code: my\_role = '{\\ "applications":\[\\ {\\ "application":"kiba… --- ## [Environment Variable in logstash export](https://discuss.elastic.co/t/environment-variable-in-logstash-export/217392)
**Author:** [@saravana\_hariharan](https://discuss.elastic.co/u/saravana_hariharan)\ **Replies:** 0\ **Last updated:** [January 31, 2020, 2:08pm UTC](https://discuss.elastic.co/t/environment-variable-in-logstash-export/217392 "2020-01-31T14:08:03Z")
How to set environment variable in logstash input { tcp { port =\> "${TCP\_PORT}" } } Now let’s set the value of TCP\_PORT: export TCP\_PORT=12345(i dont know, where to do this export please help) --- ## [Translate filter with +2.5 million dictionary entries](https://discuss.elastic.co/t/translate-filter-with-2-5-million-dictionary-entries/217390)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 0\ **Last updated:** [January 31, 2020, 2:01pm UTC](https://discuss.elastic.co/t/translate-filter-with-2-5-million-dictionary-entries/217390 "2020-01-31T14:01:52Z")
Hi, I have a case when I need to use a translate filter with a very large YAML dictionary (around 2.5 million of entries). I was reading this post where it recommends to use memcached in order to speed up the transla… --- ## [Date format parse error](https://discuss.elastic.co/t/date-format-parse-error/217234)
**Author:** [@F\_eq\_kx](https://discuss.elastic.co/u/F_eq_kx)\ **Replies:** 2\ **Last updated:** [January 31, 2020, 1:36pm UTC](https://discuss.elastic.co/t/date-format-parse-error/217234 "2020-01-31T13:36:32Z")
I'm getting Caused by: java.lang.IllegalArgumentException: failed to parse date field \[Thu Jan 30 15:31:42 +00:00 2020\] with format \[strict\_date\_optional\_time||epoch\_millis||E M dd HH:mm:ss Z yyyy\] when ingesting some da… --- ## [Part of (message) field to new field - how?](https://discuss.elastic.co/t/part-of-message-field-to-new-field-how/217212)
**Author:** [@Tommie](https://discuss.elastic.co/u/Tommie)\ **Replies:** 2\ **Last updated:** [January 31, 2020, 1:32pm UTC](https://discuss.elastic.co/t/part-of-message-field-to-new-field-how/217212 "2020-01-31T13:32:33Z")
There's an index with (message) fields like: selection xyz finished. elapsed\_millis: 73, rows=4 selection shorter finished. elapsed\_millis: 165, rows=454 selection another finished. elapsed\_millis: 9999, rows=0 Is it… --- ## [Preferred method of setting JVM options for process memory](https://discuss.elastic.co/t/preferred-method-of-setting-jvm-options-for-process-memory/217378)
**Author:** [@TheVintik](https://discuss.elastic.co/u/TheVintik)\ **Replies:** 0\ **Last updated:** [January 31, 2020, 1:29pm UTC](https://discuss.elastic.co/t/preferred-method-of-setting-jvm-options-for-process-memory/217378 "2020-01-31T13:29:13Z")
Hello, I have a question about memory for ElasticSearch. I am using 7x version, and I was setup my OS (centos 7 / 32 GB RAM) with the following configs (ES\_JAVA\_OPTS="-Xms16g -Xmx16g"): When I restarted my ES service… --- ## [Duplicate records in elastic search during load of records with Logstash](https://discuss.elastic.co/t/duplicate-records-in-elastic-search-during-load-of-records-with-logstash/217372)
**Author:** [@ramypala](https://discuss.elastic.co/u/ramypala)\ **Replies:** 0\ **Last updated:** [January 31, 2020, 12:41pm UTC](https://discuss.elastic.co/t/duplicate-records-in-elastic-search-during-load-of-records-with-logstash/217372 "2020-01-31T12:41:09Z")
Hi Team, I am loading a ServiceNow table data into Elastic search using Logstash config with HTTP Poller Plugin.For example if the table has 40 records,after the load of 40 records in Elastic search, data load is not ge… --- ## [Find latest value of X for each term in Y - Splunk equivalent](https://discuss.elastic.co/t/find-latest-value-of-x-for-each-term-in-y-splunk-equivalent/217346)
**Author:** [@wiouser](https://discuss.elastic.co/u/wiouser)\ **Replies:** 5\ **Last updated:** [January 31, 2020, 12:17pm UTC](https://discuss.elastic.co/t/find-latest-value-of-x-for-each-term-in-y-splunk-equivalent/217346 "2020-01-31T12:17:39Z")
Hi, I have a time series data in an index. I am trying to find latest value of a field1 split by terms in field2. Then apply a filter example field1=SUCCESS and count the resulting terms. I just want to return only t… --- ## [How to drilldown to underlying data in Kibana from a visualization/chat?](https://discuss.elastic.co/t/how-to-drilldown-to-underlying-data-in-kibana-from-a-visualization-chat/217296)
**Author:** [@Praveen\_V](https://discuss.elastic.co/u/Praveen_V)\ **Replies:** 1\ **Last updated:** [January 31, 2020, 12:15pm UTC](https://discuss.elastic.co/t/how-to-drilldown-to-underlying-data-in-kibana-from-a-visualization-chat/217296 "2020-01-31T12:15:50Z")
Hi all - How to drilldown to underlying data in Kibana from a visualization/chat ? Kibana has built in dashboards which are great , but how to i see the data behind these stats .. i want to further drilldown to see the… --- ## [Failed to connect to backoff(async(tcp://localhost:5044)): dial tcp 127.0.0.1:5044: connect: connection refused](https://discuss.elastic.co/t/failed-to-connect-to-backoff-async-tcp-localhost-5044-dial-tcp-127-0-0-1-connect-connection-refused/213713)
**Author:** [@Robin020](https://discuss.elastic.co/u/Robin020)\ **Replies:** 5\ **Last updated:** [January 31, 2020, 12:11pm UTC](https://discuss.elastic.co/t/failed-to-connect-to-backoff-async-tcp-localhost-5044-dial-tcp-127-0-0-1-connect-connection-refused/213713 "2020-01-31T12:11:04Z")
My setup = filebeat --\> logstash --\> elasticsearch The first part (filebeat --\> logstash ) doens't work. I got this message in the filebeat log: INFO pipeline/output.go:95 Connecting to backoff(async(tcp://localh… --- ## [Elasticsearch7.4 multinode cluster - Bootstrap Service discovery on Openshift cluster](https://discuss.elastic.co/t/elasticsearch7-4-multinode-cluster-bootstrap-service-discovery-on-openshift-cluster/217356)
**Author:** [@bishtj](https://discuss.elastic.co/u/bishtj)\ **Replies:** 2\ **Last updated:** [January 31, 2020, 11:52am UTC](https://discuss.elastic.co/t/elasticsearch7-4-multinode-cluster-bootstrap-service-discovery-on-openshift-cluster/217356 "2020-01-31T11:52:06Z")
Hi, I am working on upgrading 3 node cluster elasticsearch5.5 hosted on openshift to elasticsearch7.4. Everything works on dev/qa ( single node cluster). My solution is to create brand new cluster and then migrate his… --- ## [Logstash jdbc plugin how to ingest data from mysql table](https://discuss.elastic.co/t/logstash-jdbc-plugin-how-to-ingest-data-from-mysql-table/217335)
**Author:** [@Vladpov](https://discuss.elastic.co/u/Vladpov)\ **Replies:** 3\ **Last updated:** [January 31, 2020, 11:49am UTC](https://discuss.elastic.co/t/logstash-jdbc-plugin-how-to-ingest-data-from-mysql-table/217335 "2020-01-31T11:49:19Z")
Hi everyone! I'm trying to transport data from MySQL table INFORMATION\_SCHEMA.PROCESSLIST via Logstash jdbc plugin. I never worked with jdbc before so I installed jdbc with sudo apt-get install libmysql-java command an… --- ## [Extract data from SQL Server](https://discuss.elastic.co/t/extract-data-from-sql-server/217360)
**Author:** [@Mbt\_Mbt](https://discuss.elastic.co/u/Mbt_Mbt)\ **Replies:** 0\ **Last updated:** [January 31, 2020, 11:35am UTC](https://discuss.elastic.co/t/extract-data-from-sql-server/217360 "2020-01-31T11:35:34Z")
Good Morning, I am having trouble accessing the data in the SQLExpress database.I don't receive answers in elasticsearch Downloaded de JDBC driver and put it in te route: C:\\Users\\admin\\Desktop\\sqljdbc\_4.2\\esn\\jre8\\sql… --- ## [Show Current Date and Time in Kibana Dashboard](https://discuss.elastic.co/t/show-current-date-and-time-in-kibana-dashboard/217312)
**Author:** [@Aadesh\_Sharma](https://discuss.elastic.co/u/Aadesh_Sharma)\ **Replies:** 4\ **Last updated:** [January 31, 2020, 11:35am UTC](https://discuss.elastic.co/t/show-current-date-and-time-in-kibana-dashboard/217312 "2020-01-31T11:35:45Z")
Hi, Is there any way to show current date and time in kibana dashboard. I have tried so many ways but nothing worked --- ## [Is there a way to implement a keep last N docs per id in a specific index?](https://discuss.elastic.co/t/is-there-a-way-to-implement-a-keep-last-n-docs-per-id-in-a-specific-index/217249)
**Author:** [@kostistsaprailis](https://discuss.elastic.co/u/kostistsaprailis)\ **Replies:** 3\ **Last updated:** [January 31, 2020, 11:34am UTC](https://discuss.elastic.co/t/is-there-a-way-to-implement-a-keep-last-n-docs-per-id-in-a-specific-index/217249 "2020-01-31T11:34:33Z")
Hello all, I have a weird question, I would like to know if there's some way to implement a grouping filter on a index. E.g. Say for example that we have an index where each doc is one customer purchase, and we keep al… --- ## [Logs with day entry or separate files per day](https://discuss.elastic.co/t/logs-with-day-entry-or-separate-files-per-day/217201)
**Author:** [@Elaak](https://discuss.elastic.co/u/Elaak)\ **Replies:** 3\ **Last updated:** [January 31, 2020, 11:08am UTC](https://discuss.elastic.co/t/logs-with-day-entry-or-separate-files-per-day/217201 "2020-01-31T11:08:53Z")
My Kibana server is running over several days, and after I found out an error in one of my plugins, I was setting out to backtrack all the times it failed. Only then I realized that the logs do not contain any dates. I h… --- ## [Difference between should clause with minimum\_should\_match and should clause inside a must clause](https://discuss.elastic.co/t/difference-between-should-clause-with-minimum-should-match-and-should-clause-inside-a-must-clause/217183)
**Author:** [@pilo](https://discuss.elastic.co/u/pilo)\ **Replies:** 1\ **Last updated:** [January 31, 2020, 11:00am UTC](https://discuss.elastic.co/t/difference-between-should-clause-with-minimum-should-match-and-should-clause-inside-a-must-clause/217183 "2020-01-31T11:00:39Z")
Hello everyone, I'm doing a request using should and filter clauses like this GET case/\_search { "\_source": false, "query": { "bool": { "should": \[ { "multi\_match": { "query"… --- ## [Dissect with a backslash at the end of the log line](https://discuss.elastic.co/t/dissect-with-a-backslash-at-the-end-of-the-log-line/216630)
**Author:** [@Vincent\_Maury](https://discuss.elastic.co/u/Vincent_Maury)\ **Replies:** 4\ **Last updated:** [January 31, 2020, 10:47am UTC](https://discuss.elastic.co/t/dissect-with-a-backslash-at-the-end-of-the-log-line/216630 "2020-01-31T10:47:55Z")
Hi, I'm having a log (from EMC Celerra) that ends with a backslash like this: \:\:\ daemon \\ I'm trying this dissect: dissect { mapping =\> { "message" =\> "%{event\_source}:%{severity}:%{id} d… --- ## [Unable to read flattened type field using pyspark connector](https://discuss.elastic.co/t/unable-to-read-flattened-type-field-using-pyspark-connector/217349)
**Author:** [@amendhe](https://discuss.elastic.co/u/amendhe)\ **Replies:** 0\ **Last updated:** [January 31, 2020, 10:22am UTC](https://discuss.elastic.co/t/unable-to-read-flattened-type-field-using-pyspark-connector/217349 "2020-01-31T10:22:05Z")
After reading index from elasticsearch using pyspark in databricks - All fields appeared but only one field which is a type of 'flattened' type not appeared in dataframe schema. Is there any option that i need to include… --- ## [How to introduce variable in script field](https://discuss.elastic.co/t/how-to-introduce-variable-in-script-field/214375)
**Author:** [@Ravin\_Nadar](https://discuss.elastic.co/u/Ravin_Nadar)\ **Replies:** 4\ **Last updated:** [January 31, 2020, 10:08am UTC](https://discuss.elastic.co/t/how-to-introduce-variable-in-script-field/214375 "2020-01-31T10:08:27Z")
i want to add filter in the visualization for expected result let say: int variable !=270 i want to store this much in my query. what should i do. Thanks in advance --- ## [Have I found a documentation error about auto\_generate\_phrase\_queries in query stings?](https://discuss.elastic.co/t/have-i-found-a-documentation-error-about-auto-generate-phrase-queries-in-query-stings/217339)
**Author:** [@ErikWarming](https://discuss.elastic.co/u/ErikWarming)\ **Replies:** 1\ **Last updated:** [January 31, 2020, 10:03am UTC](https://discuss.elastic.co/t/have-i-found-a-documentation-error-about-auto-generate-phrase-queries-in-query-stings/217339 "2020-01-31T10:03:02Z")
When following the documentation about query\_sting and auto\_generate\_phrase\_queries, Query string query | Elasticsearch Guide \[8.11\] | Elastic, is suggest that elastic 7.5 does indeed support auto\_generate\_phrase\_querie… --- ## [Composite aggregation - When to page](https://discuss.elastic.co/t/composite-aggregation-when-to-page/217342)
**Author:** [@wiouser](https://discuss.elastic.co/u/wiouser)\ **Replies:** 0\ **Last updated:** [January 31, 2020, 10:01am UTC](https://discuss.elastic.co/t/composite-aggregation-when-to-page/217342 "2020-01-31T10:01:57Z")
Hi, I tried using composite aggregation and using terms value source. For me it looks like all the responses contain the after\_key How to identify from the response to decide when to send the request for next page? I… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1652) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1654)