# \#none

**URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1711

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1712

---

## [Faield to parse geo\_point](https://discuss.elastic.co/t/faield-to-parse-geo-point/212816)

<div class="topic-metadata">

**Author:** [@AsfK](https://discuss.elastic.co/u/AsfK)\
**Replies:** 5\
**Last updated:** [December 24, 2019, 9:25am UTC](https://discuss.elastic.co/t/faield-to-parse-geo-point/212816 "2019-12-24T09:25:54Z")

</div>

EDIT: ES version: 7.4.2 I have a mapping contains a coordinate of type geo\_point, like this: "coordinates": { "type": "geo\_point" } I'm sending a POST command (using Postman) with correct syntex: "coordinates": \[…

---

## [Can we merge two similar structure indices in elasticsearch?](https://discuss.elastic.co/t/can-we-merge-two-similar-structure-indices-in-elasticsearch/212920)

<div class="topic-metadata">

**Author:** [@Amit\_Chauhan](https://discuss.elastic.co/u/Amit_Chauhan)\
**Replies:** 1\
**Last updated:** [December 24, 2019, 8:36am UTC](https://discuss.elastic.co/t/can-we-merge-two-similar-structure-indices-in-elasticsearch/212920 "2019-12-24T08:36:22Z")

</div>

I want to merge similar structure indices in elasticsearch. For example I have 10 indices . 5 are same structure and another 5 are another structure indices. each indices have 100 rows . So I need only two indices with 5…

---

## [ElasticSearch Red Health - Red Indices](https://discuss.elastic.co/t/elasticsearch-red-health-red-indices/212927)

<div class="topic-metadata">

**Author:** [@antonopo](https://discuss.elastic.co/u/antonopo)\
**Replies:** 1\
**Last updated:** [December 24, 2019, 8:22am UTC](https://discuss.elastic.co/t/elasticsearch-red-health-red-indices/212927 "2019-12-24T08:22:10Z")

</div>

Hi, Day by day i am facing red status on the Elasticsearch due to some indices that are also red. On my ELK we have 7 nodes and 44 primary, 44 replica shards. I am keeping 7 indices for each beat (filebeat - winloagbe…

---

## [Logstash не отправляет логи в эластик](https://discuss.elastic.co/t/logstash/212490)

<div class="topic-metadata">

**Author:** [@alex.tregub](https://discuss.elastic.co/u/alex.tregub)\
**Replies:** 2\
**Last updated:** [December 24, 2019, 8:09am UTC](https://discuss.elastic.co/t/logstash/212490 "2019-12-24T08:09:51Z")

</div>

Здравствуйте! Уже писал вот сюда https://discuss.elastic.co/t/output-path/210727/8, но там сумбур какой-то получился, поэтому решил создать отдельный топик по этому вопросу. Итак, у меня есть пример лога: 2019-06-10T2…

---

## [Dec 24th, 2019 \[EN\]\[Kibana\] Canada open data in Kibana maps](https://discuss.elastic.co/t/dec-24th-2019-en-kibana-canada-open-data-in-kibana-maps/212361)

<div class="topic-metadata">

**Author:** [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)\
**Replies:** 0\
**Last updated:** [December 24, 2019, 8:00am UTC](https://discuss.elastic.co/t/dec-24th-2019-en-kibana-canada-open-data-in-kibana-maps/212361 "2019-12-24T08:00:04Z")

</div>

I love maps, I love geo-spatial open data. And last year, I plugged in Canada's population data into our region maps for the advent calendar. At that time our maps application was in development mode. But now its here an…

---

## [Want to redirect to Kibana dashboard as per user which is coming from aspx page](https://discuss.elastic.co/t/want-to-redirect-to-kibana-dashboard-as-per-user-which-is-coming-from-aspx-page/212924)

<div class="topic-metadata">

**Author:** [@Vishal\_Joshi1](https://discuss.elastic.co/u/Vishal_Joshi1)\
**Replies:** 0\
**Last updated:** [December 24, 2019, 6:59am UTC](https://discuss.elastic.co/t/want-to-redirect-to-kibana-dashboard-as-per-user-which-is-coming-from-aspx-page/212924 "2019-12-24T06:59:27Z")

</div>

Hello All, I want to redirect to Kibana dashboard as per user which is coming from login.aspx page in Basic version. Please help me out. Getting very frustrated with this. Please help. Any suggestions are welcome and a…

---

## [Snow API not working with logstash](https://discuss.elastic.co/t/snow-api-not-working-with-logstash/212910)

<div class="topic-metadata">

**Author:** [@katara](https://discuss.elastic.co/u/katara)\
**Replies:** 0\
**Last updated:** [December 24, 2019, 4:00am UTC](https://discuss.elastic.co/t/snow-api-not-working-with-logstash/212910 "2019-12-24T04:00:23Z")

</div>

Hi, Im trying to query a snow API with the below configuration in Logstash 7.2.0, input { http\_poller { urls =\> { snowinc =\> { url =\> "https://l.service-now.com/api/now/table/incident?sysparm\_limit=10" …

---

## [Invalid NEST response built from a unsuccessful () low level call on PUT:](https://discuss.elastic.co/t/invalid-nest-response-built-from-a-unsuccessful-low-level-call-on-put/212202)

<div class="topic-metadata">

**Author:** [@Ilyoskhuja](https://discuss.elastic.co/u/Ilyoskhuja)\
**Replies:** 9\
**Last updated:** [December 24, 2019, 6:23am UTC](https://discuss.elastic.co/t/invalid-nest-response-built-from-a-unsuccessful-low-level-call-on-put/212202 "2019-12-24T06:23:35Z")

</div>

I have this error "Invalid NEST response built from a unsuccessful () low level call on PUT:/ nameOfIndex". I use Elasticsearch.Net/7.1.0 and ElasticSearch Cloud 7.5 BadRequest: Node: https://f3bf622c3-----------------a…

---

## [How to create tokens from the text data](https://discuss.elastic.co/t/how-to-create-tokens-from-the-text-data/212824)

<div class="topic-metadata">

**Author:** [@Pratik\_Hulji](https://discuss.elastic.co/u/Pratik_Hulji)\
**Replies:** 8\
**Last updated:** [December 24, 2019, 6:19am UTC](https://discuss.elastic.co/t/how-to-create-tokens-from-the-text-data/212824 "2019-12-24T06:19:11Z")

</div>

Hi guys, I have converted the pdf into base64 format and now i want to convert the text data into tokens. Can you please guide me.

---

## [Monitoring PFSense with ELK](https://discuss.elastic.co/t/monitoring-pfsense-with-elk/212912)

<div class="topic-metadata">

**Author:** [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\
**Replies:** 0\
**Last updated:** [December 24, 2019, 4:17am UTC](https://discuss.elastic.co/t/monitoring-pfsense-with-elk/212912 "2019-12-24T04:17:42Z")

</div>

Hello Team, We are using ELK6.4 and PFSense2.4, everything is working as expected but now we want to monitor the logs of PFSense using ELK. Can you please help me how we can monitor it? Is Elasticsaerch/Kibana have an…

---

## [Extract information from raw messages in KIBANA](https://discuss.elastic.co/t/extract-information-from-raw-messages-in-kibana/212820)

<div class="topic-metadata">

**Author:** [@tofmonaute](https://discuss.elastic.co/u/tofmonaute)\
**Replies:** 2\
**Last updated:** [December 24, 2019, 3:07am UTC](https://discuss.elastic.co/t/extract-information-from-raw-messages-in-kibana/212820 "2019-12-24T03:07:43Z")

</div>

Hi, I've been struggling for weeks to create a vizualization with dynamic labels : extracted from a a search request. ( we dont want to create a new field in logstash for some errors that occurs with a very l…

---

## [How to re-arrange or sort fields of \_source in kibana , by default kibana is sorting alphabetically?](https://discuss.elastic.co/t/how-to-re-arrange-or-sort-fields-of-source-in-kibana-by-default-kibana-is-sorting-alphabetically/212780)

<div class="topic-metadata">

**Author:** [@bunny\_rocker](https://discuss.elastic.co/u/bunny_rocker)\
**Replies:** 2\
**Last updated:** [December 24, 2019, 2:42am UTC](https://discuss.elastic.co/t/how-to-re-arrange-or-sort-fields-of-source-in-kibana-by-default-kibana-is-sorting-alphabetically/212780 "2019-12-24T02:42:43Z")

</div>

Hi Team, I am using kibana to display log records, my data seems to reside in \_source field, and being sorted alphabetically. Is there any way to list only certain prt of \_source field or to sort fields in non-alphabeti…

---

## [Top Hit Aggregation in Data Table showing Undefined for all bools](https://discuss.elastic.co/t/top-hit-aggregation-in-data-table-showing-undefined-for-all-bools/212866)

<div class="topic-metadata">

**Author:** [@Zebra](https://discuss.elastic.co/u/Zebra)\
**Replies:** 2\
**Last updated:** [December 24, 2019, 2:31am UTC](https://discuss.elastic.co/t/top-hit-aggregation-in-data-table-showing-undefined-for-all-bools/212866 "2019-12-24T02:31:21Z")

</div>

I'm trying to get the most recent value of a boolean field in a data table. To do this I'm using the Top Hit aggregation with my field, aggregating with concatenate, a size of 1 and sorted on a timestamp. When I do this …

---

## [Timezone issue DHT11 sensor](https://discuss.elastic.co/t/timezone-issue-dht11-sensor/212906)

<div class="topic-metadata">

**Author:** [@f1wing](https://discuss.elastic.co/u/f1wing)\
**Replies:** 0\
**Last updated:** [December 24, 2019, 2:24am UTC](https://discuss.elastic.co/t/timezone-issue-dht11-sensor/212906 "2019-12-24T02:24:52Z")

</div>

Hi everyone, I am a network specialist and my work consist of configuring switches and firewalls to allows communication between two endpoints. Now, I am playing with Elastic stack and I like it as it may help me to an…

---

## [Incremental value in document IDs](https://discuss.elastic.co/t/incremental-value-in-document-ids/212810)

<div class="topic-metadata">

**Author:** [@psteh](https://discuss.elastic.co/u/psteh)\
**Replies:** 2\
**Last updated:** [December 24, 2019, 2:24am UTC](https://discuss.elastic.co/t/incremental-value-in-document-ids/212810 "2019-12-24T02:24:07Z")

</div>

Greetings, How do I have an incrementing field (counter) on document\_id if I am using JDBC input? The reason is that my statement is using left join on multiple tables and have duplicate of IDs. Using IDs for document\_…

---

## [Add columns to aggregated Table visualization](https://discuss.elastic.co/t/add-columns-to-aggregated-table-visualization/212690)

<div class="topic-metadata">

**Author:** [@ecc256](https://discuss.elastic.co/u/ecc256)\
**Replies:** 1\
**Last updated:** [December 24, 2019, 1:34am UTC](https://discuss.elastic.co/t/add-columns-to-aggregated-table-visualization/212690 "2019-12-24T01:34:32Z")

</div>

Need a little help with Table visualization. Basically, I have web log with GeoIP column. I want to show 10 most frequent IPs for a time period (which is super easy with Table visualization). I want to add few GeoIP c…

---

## [Keep getting "Index Lifecycle error"](https://discuss.elastic.co/t/keep-getting-index-lifecycle-error/212868)

<div class="topic-metadata">

**Author:** [@Apollyon](https://discuss.elastic.co/u/Apollyon)\
**Replies:** 2\
**Last updated:** [December 23, 2019, 11:46pm UTC](https://discuss.elastic.co/t/keep-getting-index-lifecycle-error/212868 "2019-12-23T23:46:20Z")

</div>

Hello, I am using ELK 7.5.1. I keep seeing this error when going on the Index Management page. illegal\_argument\_exception: source alias \[rollover-index\] does not point to a write index The Lifecycle Policy is pointin…

---

## [Parsing firewall logs in logstash](https://discuss.elastic.co/t/parsing-firewall-logs-in-logstash/212786)

<div class="topic-metadata">

**Author:** [@heinrich](https://discuss.elastic.co/u/heinrich)\
**Replies:** 6\
**Last updated:** [December 23, 2019, 9:45pm UTC](https://discuss.elastic.co/t/parsing-firewall-logs-in-logstash/212786 "2019-12-23T21:45:44Z")

</div>

Hi all, I'm struggling parsing sophos utm firewall logs to extract data from the message field from filebeat. I'm new to grok and kv filters and require some help please. After some digging i have come across suggestion…

---

## [EPS by single tcp session](https://discuss.elastic.co/t/eps-by-single-tcp-session/212754)

<div class="topic-metadata">

**Author:** [@artem.n](https://discuss.elastic.co/u/artem.n)\
**Replies:** 1\
**Last updated:** [December 23, 2019, 9:24pm UTC](https://discuss.elastic.co/t/eps-by-single-tcp-session/212754 "2019-12-23T21:24:37Z")

</div>

I send logs to logstash using input syslog tcp. I can not overcome the EPS limit for one TCP session (2500 eps). Each TCP session provides a linear increase in EPS. The load on the processor is minimal, the sysctl setti…

---

## [Compress request with php client](https://discuss.elastic.co/t/compress-request-with-php-client/212892)

<div class="topic-metadata">

**Author:** [@simplesmente](https://discuss.elastic.co/u/simplesmente)\
**Replies:** 0\
**Last updated:** [December 23, 2019, 7:55pm UTC](https://discuss.elastic.co/t/compress-request-with-php-client/212892 "2019-12-23T19:55:23Z")

</div>

Hello, all. Have any of you tried to compress http request using oficial php client? I’ve been trying to debug the client but couldn’t find any way to do it. Can anybody help me with this matter? Thanks in advance. C…

---

## [Test network data to test beats inputs](https://discuss.elastic.co/t/test-network-data-to-test-beats-inputs/212890)

<div class="topic-metadata">

**Author:** [@bitsutah](https://discuss.elastic.co/u/bitsutah)\
**Replies:** 0\
**Last updated:** [December 23, 2019, 7:37pm UTC](https://discuss.elastic.co/t/test-network-data-to-test-beats-inputs/212890 "2019-12-23T19:37:58Z")

</div>

Is there a standard way to test a Beats input (like say, Graylog or Logstash) to make sure that an installation or configuration is working as expected? I would think that tcpreplay with a known-good pcap of Filebeat or…

---

## [\[Errno 111\] Connection refused): ConnectionError elasticsearch](https://discuss.elastic.co/t/errno-111-connection-refused-connectionerror-elasticsearch/212873)

<div class="topic-metadata">

**Author:** [@urketadic](https://discuss.elastic.co/u/urketadic)\
**Replies:** 1\
**Last updated:** [December 23, 2019, 5:42pm UTC](https://discuss.elastic.co/t/errno-111-connection-refused-connectionerror-elasticsearch/212873 "2019-12-23T17:42:42Z")

</div>

I was following this tutorial: It all works fine but the part where lambda pushes data from S3 to Elasticsearch fails. This is the error and some warnings: On top of this it used to also say Error loading data in…

---

## [Live data still persists after rollup](https://discuss.elastic.co/t/live-data-still-persists-after-rollup/212051)

<div class="topic-metadata">

**Author:** [@mcguacon](https://discuss.elastic.co/u/mcguacon)\
**Replies:** 2\
**Last updated:** [December 23, 2019, 7:27pm UTC](https://discuss.elastic.co/t/live-data-still-persists-after-rollup/212051 "2019-12-23T19:27:57Z")

</div>

I am rolling creating a rollup index with a 7d delay. The live index I am rolling up from has been around for months. The job has been running fine, but as the rolledup index is written to, I am expecting data that is …

---

## [Logstash version for multiple pipelines](https://discuss.elastic.co/t/logstash-version-for-multiple-pipelines/212875)

<div class="topic-metadata">

**Author:** [@mtudisco](https://discuss.elastic.co/u/mtudisco)\
**Replies:** 1\
**Last updated:** [December 23, 2019, 6:41pm UTC](https://discuss.elastic.co/t/logstash-version-for-multiple-pipelines/212875 "2019-12-23T18:41:52Z")

</div>

Hi, I'd like to know if the option to have multiple pipelines has always existed or in what logstash version it started. I have a logstash 2.2.4 in a production machine and i'd like to know if i can configure multiple …

---

## [Can't find in query but can find in filter](https://discuss.elastic.co/t/cant-find-in-query-but-can-find-in-filter/212882)

<div class="topic-metadata">

**Author:** [@Dmitry1](https://discuss.elastic.co/u/Dmitry1)\
**Replies:** 0\
**Last updated:** [December 23, 2019, 6:34pm UTC](https://discuss.elastic.co/t/cant-find-in-query-but-can-find-in-filter/212882 "2019-12-23T18:34:48Z")

</div>

Hello, I have 7.5.0 ELK stack. And see very strange situation. I have index with "message" field and for example this line in it: \[comgId:1773182151883136235;expired:false;delivered:true;secured:false;querySecured:true\]…

---

## [MetricBeat HTTP Module giving "invalid character '\<' looking for beginning of value"](https://discuss.elastic.co/t/metricbeat-http-module-giving-invalid-character-looking-for-beginning-of-value/212840)

<div class="topic-metadata">

**Author:** [@Rahul12](https://discuss.elastic.co/u/Rahul12)\
**Replies:** 1\
**Last updated:** [December 23, 2019, 5:25pm UTC](https://discuss.elastic.co/t/metricbeat-http-module-giving-invalid-character-looking-for-beginning-of-value/212840 "2019-12-23T17:25:17Z")

</div>

Hi, I am using Metricbeat HTTP module to check the availability of Urls. HTTP module working fine when I tested it with localhost:9200 url. But when I am using any custom URL it is giving me error. "invalid character …

---

## [How to produce beats that will ingest ecs stats into elastic](https://discuss.elastic.co/t/how-to-produce-beats-that-will-ingest-ecs-stats-into-elastic/212819)

<div class="topic-metadata">

**Author:** [@vanshika\_agrawal](https://discuss.elastic.co/u/vanshika_agrawal)\
**Replies:** 1\
**Last updated:** [December 23, 2019, 5:01pm UTC](https://discuss.elastic.co/t/how-to-produce-beats-that-will-ingest-ecs-stats-into-elastic/212819 "2019-12-23T17:01:23Z")

</div>

need help on how to produce beats that will ingest tor ecs stats into elastic so I can monitor them.

---

## [Comprae values between to strings](https://discuss.elastic.co/t/comprae-values-between-to-strings/212750)

<div class="topic-metadata">

**Author:** [@Yoav\_Ben\_Moha](https://discuss.elastic.co/u/Yoav_Ben_Moha)\
**Replies:** 1\
**Last updated:** [December 23, 2019, 4:51pm UTC](https://discuss.elastic.co/t/comprae-values-between-to-strings/212750 "2019-12-23T16:51:22Z")

</div>

Hi, Please consider the following case. I have an index named : FRAUD I would like to display all the documents that field A is equal to field B fields A and B are of string data type. in sqlplus its looks like that …

---

## [Kibana plugin access an outside elasticsearch](https://discuss.elastic.co/t/kibana-plugin-access-an-outside-elasticsearch/212832)

<div class="topic-metadata">

**Author:** [@jaytran](https://discuss.elastic.co/u/jaytran)\
**Replies:** 1\
**Last updated:** [December 23, 2019, 4:43pm UTC](https://discuss.elastic.co/t/kibana-plugin-access-an-outside-elasticsearch/212832 "2019-12-23T16:43:33Z")

</div>

Hi all, My system includes (elasticsearch 7.2, kibana 7.2 and IBM cloud elasticsearch 6.7.2), I want to build a plugin that can access indexes on elasticsearch 6.7.2. is it possible? Thank you for any response.

---

## [Order Kibana bar graph by date](https://discuss.elastic.co/t/order-kibana-bar-graph-by-date/212533)

<div class="topic-metadata">

**Author:** [@Sergioc](https://discuss.elastic.co/u/Sergioc)\
**Replies:** 3\
**Last updated:** [December 23, 2019, 4:26pm UTC](https://discuss.elastic.co/t/order-kibana-bar-graph-by-date/212533 "2019-12-23T16:26:50Z")

</div>

Hello guys, I'm pretty new with Kibana and I have been trying to do a bar graph. I'm trying to order the bar based on dates. the graph shows the percentage or items by month. and this is the x-axis setting as yo…

[Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1710)

[Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1712)
