# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1671 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1672 --- ## [Replace string with multiple patterns on ingest node](https://discuss.elastic.co/t/replace-string-with-multiple-patterns-on-ingest-node/216039)
**Author:** [@AndresL](https://discuss.elastic.co/u/AndresL)\ **Replies:** 1\ **Last updated:** [January 22, 2020, 11:28am UTC](https://discuss.elastic.co/t/replace-string-with-multiple-patterns-on-ingest-node/216039 "2020-01-22T11:28:34Z")
Hi, i have certain numbers in format xxxx-xxxx or format xxxxxxxx that i want to replace on the ingest-node. i will also like to verify if the message contains some credit card info. It seems i cant use multiple gsubs --- ## [Multiple match in Grok filter logstash is not working](https://discuss.elastic.co/t/multiple-match-in-grok-filter-logstash-is-not-working/215874)
**Author:** [@Saravana37](https://discuss.elastic.co/u/Saravana37)\ **Replies:** 14\ **Last updated:** [January 22, 2020, 11:24am UTC](https://discuss.elastic.co/t/multiple-match-in-grok-filter-logstash-is-not-working/215874 "2020-01-22T11:24:09Z")
Hello , My Grok filter looks like below grok { match =\> \["message","%{WORD:ACT\_SV\_NAME}%{SPACE}%{WORD:ACT\_CC\_Alias}%{SPACE}%{WORD:ACT\_CG\_ALIAS}%{SPACE}%{WORD:ACT\_Running\_Status}%{SPACE}%{GREEDYDATA:ACT\_OM\_Session}","… --- ## [Error with Logstash CSV Filter plugin](https://discuss.elastic.co/t/error-with-logstash-csv-filter-plugin/215879)
**Author:** [@mhyager](https://discuss.elastic.co/u/mhyager)\ **Replies:** 2\ **Last updated:** [January 22, 2020, 10:45am UTC](https://discuss.elastic.co/t/error-with-logstash-csv-filter-plugin/215879 "2020-01-22T10:45:09Z")
I am having strange errors with a specific word used in Column headers. All automatic column header recognition works fine, except for when column headers are called FName. Is this a limitation of the CSV Filter plugin? … --- ## [Getting nested object with json filter](https://discuss.elastic.co/t/getting-nested-object-with-json-filter/215921)
**Author:** [@toms130](https://discuss.elastic.co/u/toms130)\ **Replies:** 9\ **Last updated:** [January 22, 2020, 10:49am UTC](https://discuss.elastic.co/t/getting-nested-object-with-json-filter/215921 "2020-01-22T10:49:16Z")
Hi all, I've got problem when trying to get some nested fields in a json object with json filter. My field look like this { "total\_count" : 3, "orders" : \[ { "marketplace\_order\_id" : "malikilledme3", "order\_line… --- ## [How can I add previous results in a line chart to new results](https://discuss.elastic.co/t/how-can-i-add-previous-results-in-a-line-chart-to-new-results/215762)
**Author:** [@111249](https://discuss.elastic.co/u/111249)\ **Replies:** 4\ **Last updated:** [January 22, 2020, 10:41am UTC](https://discuss.elastic.co/t/how-can-i-add-previous-results-in-a-line-chart-to-new-results/215762 "2020-01-22T10:41:42Z")
Hello. For example, I have a graph that shows the number of products added to the supermarket. I added 20 products in the first hour, 5 products in the second hour and 8 products in the third hour. I want to combine each… --- ## [Kibana Multitenancy](https://discuss.elastic.co/t/kibana-multitenancy/215982)
**Author:** [@jaydengre](https://discuss.elastic.co/u/jaydengre)\ **Replies:** 1\ **Last updated:** [January 22, 2020, 10:29am UTC](https://discuss.elastic.co/t/kibana-multitenancy/215982 "2020-01-22T10:29:49Z")
Hi, we have Kibana Standard distribution hosted locally with elasticsearch service hosted on elastic cloud. Also we are using Auth0 as Identity Provider with SAML. Now, we have created roles and role-mappings according … --- ## [TIBCO EMS plugin connection](https://discuss.elastic.co/t/tibco-ems-plugin-connection/216024)
**Author:** [@sumitsinghtomar09](https://discuss.elastic.co/u/sumitsinghtomar09)\ **Replies:** 1\ **Last updated:** [January 22, 2020, 10:13am UTC](https://discuss.elastic.co/t/tibco-ems-plugin-connection/216024 "2020-01-22T10:13:34Z")
Hi All, I am trying to connect my local tibco ems server from logstanch, i am getting below error. Sending Logstash logs to C:/Users/vv19sn/Downloads/logstash-7.5.1/logstash-7.5.1/logs which is now configured via log4j… --- ## [ELK Red status](https://discuss.elastic.co/t/elk-red-status/216015)
**Author:** [@antonopo](https://discuss.elastic.co/u/antonopo)\ **Replies:** 1\ **Last updated:** [January 22, 2020, 10:06am UTC](https://discuss.elastic.co/t/elk-red-status/216015 "2020-01-22T10:06:00Z")
Hi, Every day i am facing an issue on my ELK cluster with red status. Some Indexes everyday are red so i am deleting them and they are recreating and after this the ELK Status is becoming green again. Here is the log o… --- ## [Configuration file. Path to data: path error](https://discuss.elastic.co/t/configuration-file-path-to-data-path-error/216010)
**Author:** [@VIGNESHkumar](https://discuss.elastic.co/u/VIGNESHkumar)\ **Replies:** 3\ **Last updated:** [January 22, 2020, 9:58am UTC](https://discuss.elastic.co/t/configuration-file-path-to-data-path-error/216010 "2020-01-22T09:58:55Z")
while configuring the latest version of elasticsearch.yml file. the path where we need to store the index cannot be accessed throws an error Masternode not discovered exception. But the same elasticsearch.yml file is wor… --- ## [Elasticsearch 1.7 logrotation crashes for clusters with low logging](https://discuss.elastic.co/t/elasticsearch-1-7-logrotation-crashes-for-clusters-with-low-logging/216017)
**Author:** [@workaround](https://discuss.elastic.co/u/workaround)\ **Replies:** 0\ **Last updated:** [January 22, 2020, 9:27am UTC](https://discuss.elastic.co/t/elasticsearch-1-7-logrotation-crashes-for-clusters-with-low-logging/216017 "2020-01-22T09:27:59Z")
Hello, We have specific active Elasticsearch clusters whose logrotation crushes frequently. We have more than 100 elasticsearch clusters and just some specific keep crushing their logrotation. After investigation, I h… --- ## [How to get the nested array and nested json from input message in logstash](https://discuss.elastic.co/t/how-to-get-the-nested-array-and-nested-json-from-input-message-in-logstash/215693)
**Author:** [@Amit\_Agarwal1](https://discuss.elastic.co/u/Amit_Agarwal1)\ **Replies:** 11\ **Last updated:** [January 22, 2020, 9:43am UTC](https://discuss.elastic.co/t/how-to-get-the-nested-array-and-nested-json-from-input-message-in-logstash/215693 "2020-01-22T09:43:00Z")
message : {"prdctId":"10066","id":"10066","owner":{"id":"E040547","name":"Shashi Raghunandan"},"regAvail":\["ap","lac","mea"\] ,"isActive":true} Applied Filter: kv { source =\> "message" trim\_key =\> """ trim\_value =\> … --- ## [Does ES store \_id field in Lucene as its docid?](https://discuss.elastic.co/t/does-es-store-id-field-in-lucene-as-its-docid/215977)
**Author:** [@DeeeFOX](https://discuss.elastic.co/u/DeeeFOX)\ **Replies:** 2\ **Last updated:** [January 22, 2020, 9:32am UTC](https://discuss.elastic.co/t/does-es-store-id-field-in-lucene-as-its-docid/215977 "2020-01-22T09:32:35Z")
As the title asked, Does ES store \_id field in Lucene as its docid? Or ES just store \_id field as an index-field and each time ES write a doc, lucene create an unique docid and return to ES? --- ## [Conditional function score boost based on used search term](https://discuss.elastic.co/t/conditional-function-score-boost-based-on-used-search-term/216016)
**Author:** [@DerrickXp](https://discuss.elastic.co/u/DerrickXp)\ **Replies:** 0\ **Last updated:** [January 22, 2020, 9:23am UTC](https://discuss.elastic.co/t/conditional-function-score-boost-based-on-used-search-term/216016 "2020-01-22T09:23:46Z")
I have client that requested a feature to apply certain boosts only when a certain search term is used. My first thought is that this should not be necessary with the right configuration and doc content. But after a demo… --- ## [Logstash wait for Elasticsearch](https://discuss.elastic.co/t/logstash-wait-for-elasticsearch/216012)
**Author:** [@marcohald](https://discuss.elastic.co/u/marcohald)\ **Replies:** 0\ **Last updated:** [January 22, 2020, 8:58am UTC](https://discuss.elastic.co/t/logstash-wait-for-elasticsearch/216012 "2020-01-22T08:58:28Z")
Hi, is there a config variable which defines the retry count to elasticsearch on startup? In the moment it does a retry 10 times within 16 seconds. I already tried this as mentioned here https://stackoverflow.com/ques… --- ## [Example: predicting flight delays, but per carrier](https://discuss.elastic.co/t/example-predicting-flight-delays-but-per-carrier/216007)
**Author:** [@Sven\_Beauprez](https://discuss.elastic.co/u/Sven_Beauprez)\ **Replies:** 0\ **Last updated:** [January 22, 2020, 8:07am UTC](https://discuss.elastic.co/t/example-predicting-flight-delays-but-per-carrier/216007 "2020-01-22T08:07:55Z")
I am learning about the way ES uses regression analysis and looking at the example of flight carriers, I wonder if it is possible to group on a certain field such as carrier and have predictions per carrier. In the exam… --- ## [Named query within nested query](https://discuss.elastic.co/t/named-query-within-nested-query/215923)
**Author:** [@meirshal](https://discuss.elastic.co/u/meirshal)\ **Replies:** 1\ **Last updated:** [January 22, 2020, 8:17am UTC](https://discuss.elastic.co/t/named-query-within-nested-query/215923 "2020-01-22T08:17:24Z")
Hey folks! I’ve encountered something that looked to me like a bug, involving named queries inside nested queries. I’ve also found this issue on Github: https://github.com/elastic/elasticsearch/issues/46231 It looks ve… --- ## [Ansible role for kibana #2](https://discuss.elastic.co/t/ansible-role-for-kibana-2/215725)
**Author:** [@bernhard.fluehmann](https://discuss.elastic.co/u/bernhard.fluehmann)\ **Replies:** 2\ **Last updated:** [January 22, 2020, 8:14am UTC](https://discuss.elastic.co/t/ansible-role-for-kibana-2/215725 "2020-01-22T08:14:51Z")
Please provide a official Ansible role for Kibana. This was already discussed here: https://discuss.elastic.co/t/ansible-role-for-kibana/130537. Regards Bernhard --- ## [Débutante en Elastic search - Problème avec port 9200](https://discuss.elastic.co/t/debutante-en-elastic-search-probleme-avec-port-9200/215897)
**Author:** [@MLaure19](https://discuss.elastic.co/u/MLaure19)\ **Replies:** 5\ **Last updated:** [January 22, 2020, 7:42am UTC](https://discuss.elastic.co/t/debutante-en-elastic-search-probleme-avec-port-9200/215897 "2020-01-22T07:42:27Z")
Bonjour, Quand je rentre l'adresse suivante : http://127.0.0.1:9200 , J'obtiens les écrans d'erreur suivants et C'est comme si j'avais besoin d'un nom d'utilisateur et d'un mot de passe pour des raisons de sécurit… --- ## [Kibana CircuitBreakingException](https://discuss.elastic.co/t/kibana-circuitbreakingexception/215668)
**Author:** [@DG13](https://discuss.elastic.co/u/DG13)\ **Replies:** 1\ **Last updated:** [January 22, 2020, 3:52am UTC](https://discuss.elastic.co/t/kibana-circuitbreakingexception/215668 "2020-01-22T03:52:42Z")
Hi , Version - ELK 7.1.0 cluster - Single node ELK cluster installed in AWS VM Have added the date filter in Kibana dashboard , If select more than 2 dates of data getting below error All shards failed for phase: \[qu… --- ## [ES 7.5 translog recovery is extremely slow](https://discuss.elastic.co/t/es-7-5-translog-recovery-is-extremely-slow/215505)
**Author:** [@Jonathan\_Mendenhall](https://discuss.elastic.co/u/Jonathan_Mendenhall)\ **Replies:** 14\ **Last updated:** [January 22, 2020, 2:45am UTC](https://discuss.elastic.co/t/es-7-5-translog-recovery-is-extremely-slow/215505 "2020-01-22T02:45:24Z")
A sample of the response from the recovery API: "translog" : { "recovered" : 17201, "total" : 4686825, "percent" : "0.4%", "total\_on\_start" : -1, "total\_time\_in\_millis" : 1790702 } This is on an index that is no … --- ## [Compare 2 indexes with many fields and same structure and set alert watcher on threshold](https://discuss.elastic.co/t/compare-2-indexes-with-many-fields-and-same-structure-and-set-alert-watcher-on-threshold/215965)
**Author:** [@adifucan](https://discuss.elastic.co/u/adifucan)\ **Replies:** 0\ **Last updated:** [January 21, 2020, 11:45pm UTC](https://discuss.elastic.co/t/compare-2-indexes-with-many-fields-and-same-structure-and-set-alert-watcher-on-threshold/215965 "2020-01-21T23:45:32Z")
Hi guys! I'm looking for an advice. I have 2 indexes with many identical fields. I just want to compare values of these fields and send an email notification if these values are beyond some threshold. So is it possible… --- ## [Logstash RESTFUL API Input](https://discuss.elastic.co/t/logstash-restful-api-input/215963)
**Author:** [@BDokas](https://discuss.elastic.co/u/BDokas)\ **Replies:** 0\ **Last updated:** [January 21, 2020, 11:26pm UTC](https://discuss.elastic.co/t/logstash-restful-api-input/215963 "2020-01-21T23:26:16Z")
Has anyone had success exposing an endpoint on an AWS EC2 instance running the ELK stack using the Logstash http input plugin? I cannot for the life of me figure out how to hit the specified input. --- ## [Logstash jdbc\_static filter plugin performing very poorly (nearly not at all)](https://discuss.elastic.co/t/logstash-jdbc-static-filter-plugin-performing-very-poorly-nearly-not-at-all/214292)
**Author:** [@tomj](https://discuss.elastic.co/u/tomj)\ **Replies:** 26\ **Last updated:** [January 21, 2020, 10:35pm UTC](https://discuss.elastic.co/t/logstash-jdbc-static-filter-plugin-performing-very-poorly-nearly-not-at-all/214292 "2020-01-21T22:35:20Z")
Running Logstash 7.1.1 on Amazon Linux 2; jdbc\_static plugin version 1.0.6 (stock installation for this version of Logstash) Sending data to Elasticsearch 7.1.1 (hosted on AWS Elasticsearch service) Logstash is running… --- ## [Logstash.inputs.mongodb, fail \](https://discuss.elastic.co/t/logstash-inputs-mongodb-fail-bson-1-is-an-invalid-objectid/215570)
**Author:** [@angelma83](https://discuss.elastic.co/u/angelma83)\ **Replies:** 1\ **Last updated:** [January 21, 2020, 10:33pm UTC](https://discuss.elastic.co/t/logstash-inputs-mongodb-fail-bson-1-is-an-invalid-objectid/215570 "2020-01-21T22:33:56Z")
HI everybody, i am using logstash-input-mongodb, and i have the following mistake, \[logstash.inputs.mongodb \] MongoDB Input threw an exception, restarting {:exception=\>#\ **Author:** [@Bjen\_Shah](https://discuss.elastic.co/u/Bjen_Shah)\ **Replies:** 0\ **Last updated:** [January 21, 2020, 10:27pm UTC](https://discuss.elastic.co/t/could-not-load-template-couldnt-load-template-couldnt-load-json-error-400-bad-request/215961 "2020-01-21T22:27:41Z") 2020-01-17T09:49:26-06:00 INFO Connected to Elasticsearch version 7.5.0 2020-01-17T09:49:26-06:00 INFO Trying to load template for client: http://0.0.0.0:9200 2020-01-17T09:49:26-06:00 ERR Connecting error publishing eve… --- ## [What Ver of Elastic is able to be run in ECK?](https://discuss.elastic.co/t/what-ver-of-elastic-is-able-to-be-run-in-eck/215917)
**Author:** [@bigdamhero](https://discuss.elastic.co/u/bigdamhero)\ **Replies:** 6\ **Last updated:** [January 21, 2020, 8:38pm UTC](https://discuss.elastic.co/t/what-ver-of-elastic-is-able-to-be-run-in-eck/215917 "2020-01-21T20:38:55Z")
We are trying to upgrade our docker container based clusters into the newly released ECK. I am not seeing what newest version of ECK and support running. We want to try to migrate as much as we can and I am just wonder… --- ## [Logstash stopped accepting events from winlogbeat since the new year](https://discuss.elastic.co/t/logstash-stopped-accepting-events-from-winlogbeat-since-the-new-year/215941)
**Author:** [@albbapm](https://discuss.elastic.co/u/albbapm)\ **Replies:** 2\ **Last updated:** [January 21, 2020, 8:37pm UTC](https://discuss.elastic.co/t/logstash-stopped-accepting-events-from-winlogbeat-since-the-new-year/215941 "2020-01-21T20:37:45Z")
Posting this here as I think this is a logstash problem although I'm not really sure. ELK version 6.7.2 Winlogbeat version is a mix of 6.7.2 and 6.3.2 At midnight on January 1st, all winlogbeat events stopped going in… --- ## [Date filter not working - Logstash](https://discuss.elastic.co/t/date-filter-not-working-logstash/215880)
**Author:** [@Shahid\_Mustafa](https://discuss.elastic.co/u/Shahid_Mustafa)\ **Replies:** 6\ **Last updated:** [January 21, 2020, 8:33pm UTC](https://discuss.elastic.co/t/date-filter-not-working-logstash/215880 "2020-01-21T20:33:55Z")
I am trying to use following date filter to convert string to date but it doesn't seem to be working. Sample input data(string) - Jan 20 09:20:35 GMT 2020 I am first using a mutate gsub to remove GMT which renders foll… --- ## [Elasticsearch settings do not seem to be applied via Docker env variables?](https://discuss.elastic.co/t/elasticsearch-settings-do-not-seem-to-be-applied-via-docker-env-variables/213384)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 2\ **Last updated:** [January 21, 2020, 8:28pm UTC](https://discuss.elastic.co/t/elasticsearch-settings-do-not-seem-to-be-applied-via-docker-env-variables/213384 "2020-01-21T20:28:06Z")
I'm running a small test cluster via docker-compose on a desktop in my office, I've configured each node via environment variables. Not by using elasticsearch.yml. My main node looks like: version: '3.3' services: es… --- ## [Tool for ingesting SaaS audit logs into Elasticsearch](https://discuss.elastic.co/t/tool-for-ingesting-saas-audit-logs-into-elasticsearch/215948)
**Author:** [@arkadiy](https://discuss.elastic.co/u/arkadiy)\ **Replies:** 0\ **Last updated:** [January 21, 2020, 8:27pm UTC](https://discuss.elastic.co/t/tool-for-ingesting-saas-audit-logs-into-elasticsearch/215948 "2020-01-21T20:27:56Z")
Hi all, I've been building a product to ingest audit logs from all your SaaS tools (think G Suite, Okta, Github, Dropbox, Zendesk, Salesforce, etc) and push them into Elasticsearch. The product is in a beta state and I… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1670) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1672)