# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1694 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1695 --- ## [Is there a way to batch your query when facing with too\_many\_buckets\_exception](https://discuss.elastic.co/t/is-there-a-way-to-batch-your-query-when-facing-with-too-many-buckets-exception/214293)
**Author:** [@Tomaz\_Bratanic1](https://discuss.elastic.co/u/Tomaz_Bratanic1)\ **Replies:** 4\ **Last updated:** [January 8, 2020, 7:43pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-batch-your-query-when-facing-with-too-many-buckets-exception/214293 "2020-01-08T19:43:12Z")
I use the following query: { "aggs": { "2": { "terms": { "field": "deviceID.keyword", "order": { "\_key": "desc" }, "size": 500000 }, "aggs": { "1… --- ## [Logstash file output](https://discuss.elastic.co/t/logstash-file-output/214288)
**Author:** [@rahul\_cheekoti](https://discuss.elastic.co/u/rahul_cheekoti)\ **Replies:** 1\ **Last updated:** [January 8, 2020, 7:38pm UTC](https://discuss.elastic.co/t/logstash-file-output/214288 "2020-01-08T19:38:46Z")
Hi all My Logstash file generates a output file every day . It will modified for every few minutes. But when I check the last modified date of file it is updating once the file is created and when new file is create… --- ## [Logstash-core-plugin-api gem compatibility to 7.x](https://discuss.elastic.co/t/logstash-core-plugin-api-gem-compatibility-to-7-x/214295)
**Author:** [@pawankt](https://discuss.elastic.co/u/pawankt)\ **Replies:** 0\ **Last updated:** [January 8, 2020, 7:38pm UTC](https://discuss.elastic.co/t/logstash-core-plugin-api-gem-compatibility-to-7-x/214295 "2020-01-08T19:38:42Z")
Hi, Issue noticed for api gem compatibility which still looking older logstash core. I was tried to place 5.6.4 gem in vendor/cache still having problem. If we can sort logstash-core-plugin-api to 7.x i can rebuild with … --- ## [Send Cisco ASA Logs to ElasticSearch](https://discuss.elastic.co/t/send-cisco-asa-logs-to-elasticsearch/213749)
**Author:** [@YogeshAggarwal](https://discuss.elastic.co/u/YogeshAggarwal)\ **Replies:** 3\ **Last updated:** [January 8, 2020, 7:06pm UTC](https://discuss.elastic.co/t/send-cisco-asa-logs-to-elasticsearch/213749 "2020-01-08T19:06:20Z")
Hi, I am new to Elastic and need some help as i could not find an answer even after extensive googling. I have installed Elasticsearch 7.5, kibana 7.5, Filebeat and Logstash. All of these things works fine when i forwa… --- ## [Cannot generate CSV on nested field](https://discuss.elastic.co/t/cannot-generate-csv-on-nested-field/214062)
**Author:** [@JeremyP](https://discuss.elastic.co/u/JeremyP)\ **Replies:** 2\ **Last updated:** [January 8, 2020, 7:02pm UTC](https://discuss.elastic.co/t/cannot-generate-csv-on-nested-field/214062 "2020-01-08T19:02:35Z")
Hello, I have a nested field (Vulnerability Advisories) and I cannot generate a CSV unless I flatten the field out by converting it to a string. The problem with converting it, is it is no longer indexed. I'd like to ma… --- ## [Single dashboard](https://discuss.elastic.co/t/single-dashboard/214161)
**Author:** [@volcano](https://discuss.elastic.co/u/volcano)\ **Replies:** 1\ **Last updated:** [January 8, 2020, 6:41pm UTC](https://discuss.elastic.co/t/single-dashboard/214161 "2020-01-08T18:41:08Z")
Goal: I want to display multiple search queries in a single dashboard. Currently, I have 2 saved search queries and I have created 2 dashboards from these individual saved search queries like below. These dashboards wo… --- ## [New on-prem installation](https://discuss.elastic.co/t/new-on-prem-installation/214135)
**Author:** [@mike.wright88](https://discuss.elastic.co/u/mike.wright88)\ **Replies:** 3\ **Last updated:** [January 8, 2020, 6:27pm UTC](https://discuss.elastic.co/t/new-on-prem-installation/214135 "2020-01-08T18:27:53Z")
Hello, new to this forum, and I am working on getting a 5-node installation setup. i setup two data nodes and they work enough to tell me that they can't find the master ... but I noticed that the data nodes installed to… --- ## [Cant access fields from log using query template for Elasticsearch filter in Logstash](https://discuss.elastic.co/t/cant-access-fields-from-log-using-query-template-for-elasticsearch-filter-in-logstash/214291)
**Author:** [@james.garside](https://discuss.elastic.co/u/james.garside)\ **Replies:** 0\ **Last updated:** [January 8, 2020, 6:20pm UTC](https://discuss.elastic.co/t/cant-access-fields-from-log-using-query-template-for-elasticsearch-filter-in-logstash/214291 "2020-01-08T18:20:42Z")
Cant access fields from log using query template I have an instance of logstash which I want to use to enrich a field on incomming logs by querying elasticsearch then add the result to the recieved log. I have configure… --- ## [Download Index ElasticCloud to Elasticsearch onPremise](https://discuss.elastic.co/t/download-index-elasticcloud-to-elasticsearch-onpremise/214104)
**Author:** [@rguerrero](https://discuss.elastic.co/u/rguerrero)\ **Replies:** 6\ **Last updated:** [January 8, 2020, 5:33pm UTC](https://discuss.elastic.co/t/download-index-elasticcloud-to-elasticsearch-onpremise/214104 "2020-01-08T17:33:08Z")
I want to download all the data that is in my index that is in ElasticCloud and put in an elasticsearch onpremise instance since I have to close the ElasticCloud instance. I'm thinking of pulling the information with Lo… --- ## [Watcher condition: when node is down](https://discuss.elastic.co/t/watcher-condition-when-node-is-down/214275)
**Author:** [@MMH](https://discuss.elastic.co/u/MMH)\ **Replies:** 1\ **Last updated:** [January 8, 2020, 5:23pm UTC](https://discuss.elastic.co/t/watcher-condition-when-node-is-down/214275 "2020-01-08T17:23:09Z")
I would like to set up a watcher that triggers an action (email for example) when one of the cluster nodes is down. From the documentation I know, that it's possible to monitor cluster status from /\_cluster/health. But … --- ## [DMARC XML FIle](https://discuss.elastic.co/t/dmarc-xml-file/214248)
**Author:** [@Wilks](https://discuss.elastic.co/u/Wilks)\ **Replies:** 2\ **Last updated:** [January 8, 2020, 5:09pm UTC](https://discuss.elastic.co/t/dmarc-xml-file/214248 "2020-01-08T17:09:33Z")
Hi All, I am trying to send dmarc logs to elasticsearch and running into some issues with the logstash config. Logstash only appears to process the first few lines of the xml log file as per below. It seems to be s… --- ## [How to forward logstash logs to Rapid7?](https://discuss.elastic.co/t/how-to-forward-logstash-logs-to-rapid7/214141)
**Author:** [@srbhklkrn](https://discuss.elastic.co/u/srbhklkrn)\ **Replies:** 6\ **Last updated:** [January 8, 2020, 4:15pm UTC](https://discuss.elastic.co/t/how-to-forward-logstash-logs-to-rapid7/214141 "2020-01-08T16:15:20Z")
I'm trying to forward logs using Logstash to Rapid7 SIEM tool with particular tags, below is the output plugin but it's not working, what am I doing wrong? output { if \[type\] == "syslog" { elasticsearch { h… --- ## [Kibana is very slow in discover and visualisations](https://discuss.elastic.co/t/kibana-is-very-slow-in-discover-and-visualisations/214066)
**Author:** [@Angelos](https://discuss.elastic.co/u/Angelos)\ **Replies:** 1\ **Last updated:** [January 8, 2020, 4:39pm UTC](https://discuss.elastic.co/t/kibana-is-very-slow-in-discover-and-visualisations/214066 "2020-01-08T16:39:37Z")
Hello, An index pattern is very slow when it comes to discover and even more in visualisation. Specifically in visualisation, when I use this index, kibana crashes sometimes. This pattern has 2.5b documents and 51 fie… --- ## [Colorblindness prevention for graphs](https://discuss.elastic.co/t/colorblindness-prevention-for-graphs/214064)
**Author:** [@Xuan\_Nam\_Dang](https://discuss.elastic.co/u/Xuan_Nam_Dang)\ **Replies:** 1\ **Last updated:** [January 8, 2020, 4:36pm UTC](https://discuss.elastic.co/t/colorblindness-prevention-for-graphs/214064 "2020-01-08T16:36:28Z")
Our team has several members with color blindness. Is there an update for latest Kibana version, which offers preventing against blindness in a chart (i.e. different icons in a line chart or bar chart with different area… --- ## [Can we change the base URL of Kibna?(KİBANA :))](https://discuss.elastic.co/t/can-we-change-the-base-url-of-kibna-kibana/214175)
**Author:** [@mr\_searchng](https://discuss.elastic.co/u/mr_searchng)\ **Replies:** 2\ **Last updated:** [January 8, 2020, 4:22pm UTC](https://discuss.elastic.co/t/can-we-change-the-base-url-of-kibna-kibana/214175 "2020-01-08T16:22:53Z")
http://localhost:5601/lqx/app/kibana#/dashboard I change kibana ,instead "test" text http://localhost:5601/lqx/app/test#/dashboard --- ## [Can we change KİBANA BASE URL ? (Thousands of people are developing projects on kibana.)](https://discuss.elastic.co/t/can-we-change-kibana-base-url-thousands-of-people-are-developing-projects-on-kibana/214001)
**Author:** [@mr\_searchng](https://discuss.elastic.co/u/mr_searchng)\ **Replies:** 1\ **Last updated:** [January 8, 2020, 4:20pm UTC](https://discuss.elastic.co/t/can-we-change-kibana-base-url-thousands-of-people-are-developing-projects-on-kibana/214001 "2020-01-08T16:20:09Z")
thousands of people are developing projects on kibana. Someone sure knows how to change. There must be another way NOW: http://localhost:5601/lqx/app/kibana#/dashboard/ İNSTEAD: http://localhost:5601/lqx/app/test#/… --- ## [Unable to revive connection: http://localhost:9200/](https://discuss.elastic.co/t/unable-to-revive-connection-http-localhost-9200/213973)
**Author:** [@pyerunka](https://discuss.elastic.co/u/pyerunka)\ **Replies:** 1\ **Last updated:** [January 8, 2020, 4:13pm UTC](https://discuss.elastic.co/t/unable-to-revive-connection-http-localhost-9200/213973 "2020-01-08T16:13:35Z")
Hello, I have ES cluster of 3 nodes. And i am trying to start kibana on one of the node. But it is giving me below error: \[warning\]\[admin\]\[elasticsearch\] Unable to revive connection: http://localhost:9200/ \[warning\]\[a… --- ## [How to use gz files in s3 to kibana?](https://discuss.elastic.co/t/how-to-use-gz-files-in-s3-to-kibana/213962)
**Author:** [@jamesyone](https://discuss.elastic.co/u/jamesyone)\ **Replies:** 1\ **Last updated:** [January 8, 2020, 4:11pm UTC](https://discuss.elastic.co/t/how-to-use-gz-files-in-s3-to-kibana/213962 "2020-01-08T16:11:54Z")
Hi! I was able to successfully use kibana through .json files, but I was wondering if you are able to use .gz files on kibana as well? For some reason my .gz files dont work with kibana... Thanks! --- ## [Kibana 7.5 Load Balancing](https://discuss.elastic.co/t/kibana-7-5-load-balancing/213775)
**Author:** [@gurdipe](https://discuss.elastic.co/u/gurdipe)\ **Replies:** 1\ **Last updated:** [January 8, 2020, 4:06pm UTC](https://discuss.elastic.co/t/kibana-7-5-load-balancing/213775 "2020-01-08T16:06:49Z")
Hi, For Elasticsearch 7.5 does Kibana come with built in load balancing using the Kibana config YML file when you have multiple Kibana servers running? Its a feature that has been requested for a while but I do not kno… --- ## [On premise pricing requirement for ELK](https://discuss.elastic.co/t/on-premise-pricing-requirement-for-elk/214267)
**Author:** [@Seetharaman\_K](https://discuss.elastic.co/u/Seetharaman_K)\ **Replies:** 1\ **Last updated:** [January 8, 2020, 3:53pm UTC](https://discuss.elastic.co/t/on-premise-pricing-requirement-for-elk/214267 "2020-01-08T15:53:40Z")
Hi All, i tried to use the https://www.elastic.co/subscriptions#contact-us link to contact the team and used the form , so far there is no response. i want to understand what is the price of the Gold subsription , and … --- ## [Elastic master not discovered yet, this node has not previously joined a bootstrapped (v7+) cluster, and this node must discover master-eligible nodes](https://discuss.elastic.co/t/elastic-master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster-and-this-node-must-discover-master-eligible-nodes/214118)
**Author:** [@Sreekanth3](https://discuss.elastic.co/u/Sreekanth3)\ **Replies:** 10\ **Last updated:** [January 8, 2020, 3:52pm UTC](https://discuss.elastic.co/t/elastic-master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster-and-this-node-must-discover-master-eligible-nodes/214118 "2020-01-08T15:52:49Z")
Hi , I have upgraded my elasticsearch cluster of 3 nodes from 7.4.0 to 7.5.1 and after completing the upgradation of the ES . I'm getting this error master not discovered yet, this node has not previously joined a boot… --- ## [Api/saved\_objects/search?overwrite=true getting 400 bad request](https://discuss.elastic.co/t/api-saved-objects-search-overwrite-true-getting-400-bad-request/214020)
**Author:** [@santhosh\_kumar2](https://discuss.elastic.co/u/santhosh_kumar2)\ **Replies:** 3\ **Last updated:** [January 8, 2020, 3:29pm UTC](https://discuss.elastic.co/t/api-saved-objects-search-overwrite-true-getting-400-bad-request/214020 "2020-01-08T15:29:43Z")
When i try to hip below url i am getting 400 bad request. KIBANASERVER:/kibana/api/saved\_objects/search?overwrite=true { "attributes": { "title": "test", "description": "", "hits": 0, "columns": \[ "adultCount" \], … --- ## [Show different Index for different fields](https://discuss.elastic.co/t/show-different-index-for-different-fields/214116)
**Author:** [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\ **Replies:** 5\ **Last updated:** [January 8, 2020, 3:26pm UTC](https://discuss.elastic.co/t/show-different-index-for-different-fields/214116 "2020-01-08T15:26:35Z")
I have a field called fields.log\_type which has three values- access, errors, dispatch. I want each value to be its own index on discover tab. Is it possible? Time mess… --- ## [Kibana cannot list saved\_objects. Fielddata is disabled on text fields by default](https://discuss.elastic.co/t/kibana-cannot-list-saved-objects-fielddata-is-disabled-on-text-fields-by-default/214052)
**Author:** [@KapitanPlaneta](https://discuss.elastic.co/u/KapitanPlaneta)\ **Replies:** 3\ **Last updated:** [January 8, 2020, 3:26pm UTC](https://discuss.elastic.co/t/kibana-cannot-list-saved-objects-fielddata-is-disabled-on-text-fields-by-default/214052 "2020-01-08T15:26:04Z")
Create an index pattern. Then go to saved objects - 'Unable find saved objects Error: Bad Request' popup shows up. This request: /api/kibana/management/saved\_objects/\_find?perPage=20&page=1&fields=id&type=config&type=ma… --- ## [Regex pattern\_replace](https://discuss.elastic.co/t/regex-pattern-replace/214047)
**Author:** [@elink12](https://discuss.elastic.co/u/elink12)\ **Replies:** 4\ **Last updated:** [January 8, 2020, 3:18pm UTC](https://discuss.elastic.co/t/regex-pattern-replace/214047 "2020-01-08T15:18:56Z")
Hi friend, I have a problem. I don’t understand why it works like this? #My filter pattern 'my\_pattern\_replace' =\> \[ "type" =\> "pattern\_replace", "pattern" =\> "(\[0-9.,-\]+)\\s?(car\\b|cars\\b|cars\\w+)", "replacement" =\> … --- ## [Logtash ignores some lines randomly](https://discuss.elastic.co/t/logtash-ignores-some-lines-randomly/214259)
**Author:** [@JustDevZero](https://discuss.elastic.co/u/JustDevZero)\ **Replies:** 1\ **Last updated:** [January 8, 2020, 3:18pm UTC](https://discuss.elastic.co/t/logtash-ignores-some-lines-randomly/214259 "2020-01-08T15:18:41Z")
Logtash apparently ignores some of my log lines done by nginx. I'm trying to parse my customized nginx logs with logstash, I'm adding the response time by upstream, etc... and a few more fields that aren't normally on t… --- ## [Elasticsearch github](https://discuss.elastic.co/t/elasticsearch-github/214256)
**Author:** [@aioanei\_adrian](https://discuss.elastic.co/u/aioanei_adrian)\ **Replies:** 2\ **Last updated:** [January 8, 2020, 3:06pm UTC](https://discuss.elastic.co/t/elasticsearch-github/214256 "2020-01-08T15:06:56Z")
Hello, I want to start helping elasticsearch development but I can't find anywhere the way you are working. I have forked your repo but I cloud not be able to found your coding rules or any other details that a beginner… --- ## [Logstash issue with dropping rows with a condition check on empty elements](https://discuss.elastic.co/t/logstash-issue-with-dropping-rows-with-a-condition-check-on-empty-elements/214132)
**Author:** [@Nick11](https://discuss.elastic.co/u/Nick11)\ **Replies:** 7\ **Last updated:** [January 8, 2020, 2:51pm UTC](https://discuss.elastic.co/t/logstash-issue-with-dropping-rows-with-a-condition-check-on-empty-elements/214132 "2020-01-08T14:51:51Z")
I have a CSV file with the following 2 rows (sample) reservation date, reservationID Jan 6th, res:id:adbcj-oksok-gjkk Jan 10th, Mar 10th, res:id:kkbcj-oksok-gjkk My ask is to drop empty rows and apply a grok filter on … --- ## [/usr/share/logstash/bin/system-install: line 88: #: command not found](https://discuss.elastic.co/t/usr-share-logstash-bin-system-install-line-88-command-not-found/214242)
**Author:** [@leprovokateur](https://discuss.elastic.co/u/leprovokateur)\ **Replies:** 1\ **Last updated:** [January 8, 2020, 2:48pm UTC](https://discuss.elastic.co/t/usr-share-logstash-bin-system-install-line-88-command-not-found/214242 "2020-01-08T14:48:05Z")
Hi, On upgrading from 7.5.0 to 7.5.1 I receive the error: Using provided startup.options file: /etc/logstash/startup.options OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 an… --- ## [Syslog input configuration for Logstash](https://discuss.elastic.co/t/syslog-input-configuration-for-logstash/211510)
**Author:** [@Marcell0e](https://discuss.elastic.co/u/Marcell0e)\ **Replies:** 10\ **Last updated:** [January 8, 2020, 2:46pm UTC](https://discuss.elastic.co/t/syslog-input-configuration-for-logstash/211510 "2020-01-08T14:46:23Z")
I want to send syslog files to my logstash, but not sure how to incorporate it with my beats input. When I have tried adding my beats stop working. Below is my logstash file. input { beats { port =\> 5044 } } … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1693) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1695)