# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1680 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1681 --- ## [Multiple Grok pattern filters arent filtering multiple logs in one logstash file](https://discuss.elastic.co/t/multiple-grok-pattern-filters-arent-filtering-multiple-logs-in-one-logstash-file/214654)
**Author:** [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\ **Replies:** 7\ **Last updated:** [January 16, 2020, 11:33pm UTC](https://discuss.elastic.co/t/multiple-grok-pattern-filters-arent-filtering-multiple-logs-in-one-logstash-file/214654 "2020-01-16T23:33:57Z")
Below is my pipeline.conf where I want the filter block to apply three separate grok patterns on three different log files. But currently, it isnt working. Should I add multiple pipelines to it? or create three different… --- ## [Error 400 during parsing logs from logstash](https://discuss.elastic.co/t/error-400-during-parsing-logs-from-logstash/214352)
**Author:** [@akshay\_singh2](https://discuss.elastic.co/u/akshay_singh2)\ **Replies:** 7\ **Last updated:** [January 16, 2020, 11:06pm UTC](https://discuss.elastic.co/t/error-400-during-parsing-logs-from-logstash/214352 "2020-01-16T23:06:24Z")
Hello Team, I have recently moved ES from 6.x to 7.x and faced a issue in one of pipeline which was working fine in ES 6.x version, but in ES 7.x I'm getting 400 error in logstash. Logstash is flooded with this error: … --- ## [Term query Kibana](https://discuss.elastic.co/t/term-query-kibana/214592)
**Author:** [@rvanegmond](https://discuss.elastic.co/u/rvanegmond)\ **Replies:** 3\ **Last updated:** [January 16, 2020, 9:14pm UTC](https://discuss.elastic.co/t/term-query-kibana/214592 "2020-01-16T21:14:54Z")
I'm looking into a way to perform a term query straight from the search bar in Kibana. Found some stuff on this but last post is about a year old. I know I can then do this by editing the filter using the query DSL. When… --- ## [Urgent Help needed: Filter for Value in a Datatable on a Dashboard not responding](https://discuss.elastic.co/t/urgent-help-needed-filter-for-value-in-a-datatable-on-a-dashboard-not-responding/214951)
**Author:** [@Datakids](https://discuss.elastic.co/u/Datakids)\ **Replies:** 4\ **Last updated:** [January 16, 2020, 9:00pm UTC](https://discuss.elastic.co/t/urgent-help-needed-filter-for-value-in-a-datatable-on-a-dashboard-not-responding/214951 "2020-01-16T21:00:56Z")
Hi Folks, ELK v7.5.1 Windows Server 16 Chrome, FF (same behaviour) I got a major issue here for unknown reason. I have 3 Indicies I Build for each a Datatable I create a Dashboard and bring them on But just one o… --- ## [Is there any way to enable versioning or concurrency control of documents based on a particular field? (Timestamp field)](https://discuss.elastic.co/t/is-there-any-way-to-enable-versioning-or-concurrency-control-of-documents-based-on-a-particular-field-timestamp-field/215388)
**Author:** [@perahimi](https://discuss.elastic.co/u/perahimi)\ **Replies:** 0\ **Last updated:** [January 16, 2020, 8:33pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-enable-versioning-or-concurrency-control-of-documents-based-on-a-particular-field-timestamp-field/215388 "2020-01-16T20:33:40Z")
Hello, I am currently working with catalog data that is coming in hourly in our pipeline. This is an example of how the written source document might look like. { "name": "Hoodie", "sku": "123", "timeStamp"… --- ## [Upgrade to kibana 7.5 failed (partially)](https://discuss.elastic.co/t/upgrade-to-kibana-7-5-failed-partially/215217)
**Author:** [@bruce\_clegg](https://discuss.elastic.co/u/bruce_clegg)\ **Replies:** 3\ **Last updated:** [January 16, 2020, 8:10pm UTC](https://discuss.elastic.co/t/upgrade-to-kibana-7-5-failed-partially/215217 "2020-01-16T20:10:11Z")
I upgraded my kibana instance from 4.4 to 7.5 today on my CentOS7 server. I used the rpm method to install initially - so this is what I used to update. The upgrade appeared successful - but it was a bit of a mess. I … --- ## [Ingesting AppDynamics metric information into Elasticsearch](https://discuss.elastic.co/t/ingesting-appdynamics-metric-information-into-elasticsearch/215381)
**Author:** [@byoungman](https://discuss.elastic.co/u/byoungman)\ **Replies:** 0\ **Last updated:** [January 16, 2020, 7:46pm UTC](https://discuss.elastic.co/t/ingesting-appdynamics-metric-information-into-elasticsearch/215381 "2020-01-16T19:46:12Z")
We are using AppDynamics APM for our system monitoring and alerting and I need to get that information into Elasticsearch before AppDynamics starts rolling up it's data and we start losing information granularity. The i… --- ## [New indices remain yellow when there are relocations in the cluster](https://discuss.elastic.co/t/new-indices-remain-yellow-when-there-are-relocations-in-the-cluster/215345)
**Author:** [@itiyamas](https://discuss.elastic.co/u/itiyamas)\ **Replies:** 3\ **Last updated:** [January 16, 2020, 6:54pm UTC](https://discuss.elastic.co/t/new-indices-remain-yellow-when-there-are-relocations-in-the-cluster/215345 "2020-01-16T18:54:18Z")
Hi, When we reduce the number of nodes in our cluster to half, a lot of recoveries start in the cluster as a result of excluding the old ips. We are running a 120 node cluster with a total of 4M docs/second. There are 6… --- ## [Incorrect values order on the X-axis](https://discuss.elastic.co/t/incorrect-values-order-on-the-x-axis/215003)
**Author:** [@Anne\_Kim](https://discuss.elastic.co/u/Anne_Kim)\ **Replies:** 5\ **Last updated:** [January 16, 2020, 6:21pm UTC](https://discuss.elastic.co/t/incorrect-values-order-on-the-x-axis/215003 "2020-01-16T18:21:26Z")
Hello, The X-axis values are ordered Alphabetically (Ascending), but the visualization is incorrect (see image attached): Here is the visState: { "title": "Characters damages per a day after registration", "typ… --- ## [Blocked by: \[SERVICE\_UNAVAILABLE/1/state not recovered / initialized\];"}\]](https://discuss.elastic.co/t/blocked-by-service-unavailable-1-state-not-recovered-initialized/215372)
**Author:** [@symsymmas](https://discuss.elastic.co/u/symsymmas)\ **Replies:** 0\ **Last updated:** [January 16, 2020, 6:19pm UTC](https://discuss.elastic.co/t/blocked-by-service-unavailable-1-state-not-recovered-initialized/215372 "2020-01-16T18:19:16Z")
I have a cluster with 4 nodes. When the 3 slaves are stoped and I start the master, I’ve got this error. Could you help me please. {"error":{"root\_cause":\[{"type":"cluster\_block\_exception","reason":"blocked by: \[SERVICE… --- ## [Blog post update required](https://discuss.elastic.co/t/blog-post-update-required/215077)
**Author:** [@Rob\_wylde](https://discuss.elastic.co/u/Rob_wylde)\ **Replies:** 1\ **Last updated:** [January 16, 2020, 6:09pm UTC](https://discuss.elastic.co/t/blog-post-update-required/215077 "2020-01-16T18:09:31Z")
Blog Post on Custom Base Maps makes use of tilemap.url tilemap.options.attribution etc. but the these variables names have changed since this blog was posted, but i'm sure many are still looking to it as a guide. The ne… --- ## [Synonyms not getting applied](https://discuss.elastic.co/t/synonyms-not-getting-applied/215366)
**Author:** [@adityaPsl](https://discuss.elastic.co/u/adityaPsl)\ **Replies:** 1\ **Last updated:** [January 16, 2020, 6:03pm UTC](https://discuss.elastic.co/t/synonyms-not-getting-applied/215366 "2020-01-16T18:03:27Z")
Hello Team, I have below document in the index { "name" :"test", "products": \[ { "pname" : "p1", "qty" : "10 pcs" }, { "pname" : " p3 ", "qty" : "10 PCS" … --- ## [Cluster outage with old-gen size increasing](https://discuss.elastic.co/t/cluster-outage-with-old-gen-size-increasing/215229)
**Author:** [@musfiqur](https://discuss.elastic.co/u/musfiqur)\ **Replies:** 0\ **Last updated:** [January 16, 2020, 12:28am UTC](https://discuss.elastic.co/t/cluster-outage-with-old-gen-size-increasing/215229 "2020-01-16T00:28:35Z")
Hi, We are seeing logs like this in our ElasticSearch 6.7: \[gc\]\[young\]\[678215\]\[290288\] duration \[718ms\], collections \[1\]/\[1s\], total \[718ms\]/\[4.5h\], memory \[9.6gb\]-\>\[10.3gb\]/\[30.1gb\], all\_pools {\[young\] \[108.4mb\]-\>\[332… --- ## [JSON in API to Change Platform Endpoint](https://discuss.elastic.co/t/json-in-api-to-change-platform-endpoint/215326)
**Author:** [@balogan](https://discuss.elastic.co/u/balogan)\ **Replies:** 2\ **Last updated:** [January 16, 2020, 5:36pm UTC](https://discuss.elastic.co/t/json-in-api-to-change-platform-endpoint/215326 "2020-01-16T17:36:45Z")
I'm using the configuration store API to change the platform endpoint and having trouble getting the JSON formatting right. This is the JSON example from the docs. { "value" : "string" } When I use the API to list t… --- ## [Why NFS is to be avoided for data directories](https://discuss.elastic.co/t/why-nfs-is-to-be-avoided-for-data-directories/215240)
**Author:** [@malshan](https://discuss.elastic.co/u/malshan)\ **Replies:** 7\ **Last updated:** [January 16, 2020, 5:30pm UTC](https://discuss.elastic.co/t/why-nfs-is-to-be-avoided-for-data-directories/215240 "2020-01-16T17:30:35Z")
ES: 7.5 I have seen the recommendations in official documentation to 'avoid NFS' when using them as data directories for elasticsearch. I have also seen almost everywhere in the forums to 'avoid NFS' but couldn't find a… --- ## [Detecting and Alerting on Log Loss from Logstash or beats](https://discuss.elastic.co/t/detecting-and-alerting-on-log-loss-from-logstash-or-beats/214482)
**Author:** [@ciphee](https://discuss.elastic.co/u/ciphee)\ **Replies:** 3\ **Last updated:** [January 16, 2020, 5:04pm UTC](https://discuss.elastic.co/t/detecting-and-alerting-on-log-loss-from-logstash-or-beats/214482 "2020-01-16T17:04:22Z")
Hello, I was trying to be able to detect/alert when either logstash or a beats product stops sendings logs. The problem in the past we have had is when a specific logstash server goes down, or is up but not sending any… --- ## [Launch Elasticsearch - really an error?](https://discuss.elastic.co/t/launch-elasticsearch-really-an-error/215336)
**Author:** [@newKibanaUser](https://discuss.elastic.co/u/newKibanaUser)\ **Replies:** 3\ **Last updated:** [January 16, 2020, 4:37pm UTC](https://discuss.elastic.co/t/launch-elasticsearch-really-an-error/215336 "2020-01-16T16:37:51Z")
Hello - I am getting 401 error while launching elasticsearch as below from my ECE deployment. I am able to add/view indices onto this elasticsearch from my local instance using curl. Is this really an error or what shou… --- ## [General OpenSslEngine problem](https://discuss.elastic.co/t/general-opensslengine-problem/215358)
**Author:** [@lsambolino](https://discuss.elastic.co/u/lsambolino)\ **Replies:** 0\ **Last updated:** [January 16, 2020, 4:36pm UTC](https://discuss.elastic.co/t/general-opensslengine-problem/215358 "2020-01-16T16:36:02Z")
Hi, In our infrastructure we have deployed logstash on Debian nodes. At the moment, it appears logstash is not producing logs anymore. Log timestamp is stucked at 10 hours before the moment of writing. After checking /… --- ## [Sort by nested values "across" all documents (duplicate parent documents)](https://discuss.elastic.co/t/sort-by-nested-values-across-all-documents-duplicate-parent-documents/213257)
**Author:** [@awagner](https://discuss.elastic.co/u/awagner)\ **Replies:** 2\ **Last updated:** [January 16, 2020, 4:06pm UTC](https://discuss.elastic.co/t/sort-by-nested-values-across-all-documents-duplicate-parent-documents/213257 "2020-01-16T16:06:28Z")
Hi all, First question, please forgive me if I'm ignorant of some essentials. Here is the issue: Among other options, I want to offer an ordering of query results based on the values of nested fields. That is, if a doc… --- ## [Aggregate logs if value of field is same](https://discuss.elastic.co/t/aggregate-logs-if-value-of-field-is-same/215348)
**Author:** [@mouloudjean](https://discuss.elastic.co/u/mouloudjean)\ **Replies:** 0\ **Last updated:** [January 16, 2020, 3:54pm UTC](https://discuss.elastic.co/t/aggregate-logs-if-value-of-field-is-same/215348 "2020-01-16T15:54:45Z")
Hello, I'm working on a project in my company, The goal is to implement the ELK stack to have an tracability of our data, and be able to aggregate some logs that containt the same value of a field. I'm trying to aggreg… --- ## [FORBIDDEN/12/index read-only](https://discuss.elastic.co/t/forbidden-12-index-read-only/215301)
**Author:** [@johnkary](https://discuss.elastic.co/u/johnkary)\ **Replies:** 6\ **Last updated:** [January 16, 2020, 3:51pm UTC](https://discuss.elastic.co/t/forbidden-12-index-read-only/215301 "2020-01-16T15:51:29Z")
Hi team! I often encounter the following error when i insert documents to my index. elasticsearch.exceptions.AuthorizationException: AuthorizationException(403, 'cluster\_block\_exception', 'blocked by: \[FORBIDDEN/12/ind… --- ## [Websphere Application Server support](https://discuss.elastic.co/t/websphere-application-server-support/215048)
**Author:** [@ledgpat](https://discuss.elastic.co/u/ledgpat)\ **Replies:** 4\ **Last updated:** [January 16, 2020, 3:50pm UTC](https://discuss.elastic.co/t/websphere-application-server-support/215048 "2020-01-16T15:50:32Z")
Hello, I know that the Supported technologies page only lists Websphere Liberty as being officially supported, but I have also seen references to future Websphere classic/full support being on the radar. It's been a whi… --- ## [How to take only last 20 records of the document in Visualization?](https://discuss.elastic.co/t/how-to-take-only-last-20-records-of-the-document-in-visualization/215117)
**Author:** [@Utshab\_Saha](https://discuss.elastic.co/u/Utshab_Saha)\ **Replies:** 1\ **Last updated:** [January 16, 2020, 3:37pm UTC](https://discuss.elastic.co/t/how-to-take-only-last-20-records-of-the-document-in-visualization/215117 "2020-01-16T15:37:15Z")
I want to count of hits w.r.t the datetime in visualization but while I use visualization tool to build the chart It applies on the whole document. So when I plot the data with 10 objects (size of the bucket) in Asc ord… --- ## [Install aggregate plugin (Offline) Logstash](https://discuss.elastic.co/t/install-aggregate-plugin-offline-logstash/215299)
**Author:** [@Khalil\_Diouri](https://discuss.elastic.co/u/Khalil_Diouri)\ **Replies:** 1\ **Last updated:** [January 16, 2020, 3:36pm UTC](https://discuss.elastic.co/t/install-aggregate-plugin-offline-logstash/215299 "2020-01-16T15:36:32Z")
Hello, Generally I need to install a plugin aggregate for logstash in a remote server to use it in my file .config to inject data in elasticsearch. the problem is that I can't download directly the aggregate plugin usi… --- ## [Logstash 7.5.1 flood syslog with messages](https://discuss.elastic.co/t/logstash-7-5-1-flood-syslog-with-messages/214366)
**Author:** [@wga](https://discuss.elastic.co/u/wga)\ **Replies:** 2\ **Last updated:** [January 16, 2020, 3:23pm UTC](https://discuss.elastic.co/t/logstash-7-5-1-flood-syslog-with-messages/214366 "2020-01-16T15:23:18Z")
After upgrade from 7.5 to 7.5.1 except that all messages which receive from filebeat nodes going to elastic, for some reason start bombing /var/log/syslog with the same information without even to have any of output-sysl… --- ## [Suggester doesn't suggest as expected, based on beginning of word](https://discuss.elastic.co/t/suggester-doesnt-suggest-as-expected-based-on-beginning-of-word/214715)
**Author:** [@Casper\_Thrane](https://discuss.elastic.co/u/Casper_Thrane)\ **Replies:** 4\ **Last updated:** [January 16, 2020, 3:06pm UTC](https://discuss.elastic.co/t/suggester-doesnt-suggest-as-expected-based-on-beginning-of-word/214715 "2020-01-16T15:06:05Z")
I want ElasticSearch to suggest more words, based on the beginning of a word. My example is the following. I have these titles: affaldsregister affaldsdatasystem - Import af indberetninger anmod om ændring af affaldso… --- ## [org.apache.lucene.store.AlreadyClosedException: Underlying file changed by an external force](https://discuss.elastic.co/t/org-apache-lucene-store-alreadyclosedexception-underlying-file-changed-by-an-external-force/215311)
**Author:** [@rdl](https://discuss.elastic.co/u/rdl)\ **Replies:** 3\ **Last updated:** [January 16, 2020, 2:52pm UTC](https://discuss.elastic.co/t/org-apache-lucene-store-alreadyclosedexception-underlying-file-changed-by-an-external-force/215311 "2020-01-16T14:52:24Z")
Environment: GlusterFS 6.0 OpenShift 3.11 ES 6 Hi, while deploying sonarqube which in turn uses ES6 in a POD I encounter the following error: 2020.01.16 12:16:19 WARN es\[o.e.c.r.a.AllocationService\] failing shard \[… --- ## [Elasticsearch cluster architecture](https://discuss.elastic.co/t/elasticsearch-cluster-architecture/215320)
**Author:** [@Ged](https://discuss.elastic.co/u/Ged)\ **Replies:** 0\ **Last updated:** [January 16, 2020, 1:47pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-architecture/215320 "2020-01-16T13:47:25Z")
Hi guys, As per attached diagram I've 8 application servers in 2 data centers (4 per each DC) and 4 monitoring servers przezn for ELK Stack (2 per DC). 4 app servers (1-4) push their log data to Logstash placed on Moni… --- ## [При добавлении в конфиг Logstash elasticsearch filter plugun появилась ошибка filebeat: Failed to connect to backoff(async(tcp://xxx.xxx.xxx.xxx:5044)): dial tcp xxx.xxx.xxx.xxx:5044: connect: connection refused](https://discuss.elastic.co/t/logstash-elasticsearch-filter-plugun-filebeat-failed-to-connect-to-backoff-async-tcp-xxx-xxx-xxx-xxx-5044-dial-tcp-xxx-xxx-xxx-xxx-connect-connection-refused/215132)
**Author:** [@111249](https://discuss.elastic.co/u/111249)\ **Replies:** 4\ **Last updated:** [January 16, 2020, 1:53pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-plugun-filebeat-failed-to-connect-to-backoff-async-tcp-xxx-xxx-xxx-xxx-5044-dial-tcp-xxx-xxx-xxx-xxx-connect-connection-refused/215132 "2020-01-16T13:53:22Z")
В фильтре logstash я пытаюсь обратиться к elasticsearch, чтобы получить необходимые данные. Без elasticsearch plugin все работает хорошо (если код закоментирован). /etc/logstash/conf.d/mysql-beats.conf input { beats … --- ## [Could not find jruby in C:\\logstash-7.5.1\\vendor\\jruby](https://discuss.elastic.co/t/could-not-find-jruby-in-c-logstash-7-5-1-vendor-jruby/215319)
**Author:** [@martinm1](https://discuss.elastic.co/u/martinm1)\ **Replies:** 0\ **Last updated:** [January 16, 2020, 1:47pm UTC](https://discuss.elastic.co/t/could-not-find-jruby-in-c-logstash-7-5-1-vendor-jruby/215319 "2020-01-16T13:47:01Z")
logstash-7.5.1 Win10/64 jdk1.8.0\_241 I'm following the windows installation instructions and have setup the Java paths. I also installed JRuby in case it was needed but when I still get PS C:\\logstash-7.5.1\> ./bin/lo… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1679) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1681)