# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1736 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1737 --- ## [Iterating over certain field extracted from xml to do few operations like remove and replace](https://discuss.elastic.co/t/iterating-over-certain-field-extracted-from-xml-to-do-few-operations-like-remove-and-replace/211126)
**Author:** [@saif3r](https://discuss.elastic.co/u/saif3r)\ **Replies:** 0\ **Last updated:** [December 9, 2019, 1:35pm UTC](https://discuss.elastic.co/t/iterating-over-certain-field-extracted-from-xml-to-do-few-operations-like-remove-and-replace/211126 "2019-12-09T13:35:11Z")
Hi, I have an XML with multiple events. Each event can contain 0 - 6 entries. I would like to make sure that Logstash will extract all parameters, add it to corresponding param field and also enrich one of the fields … --- ## [How to reference http poller data](https://discuss.elastic.co/t/how-to-reference-http-poller-data/210915)
**Author:** [@raged](https://discuss.elastic.co/u/raged)\ **Replies:** 1\ **Last updated:** [December 9, 2019, 1:51pm UTC](https://discuss.elastic.co/t/how-to-reference-http-poller-data/210915 "2019-12-09T13:51:08Z")
I have logstash rigged up for two inputs, one for beats and the other for an http poller to further enrich beats data. How do I reference the data that comes from the http\_poller input? Here is my config for the inputs… --- ## [Can Elastic store data on multiple file systems?](https://discuss.elastic.co/t/can-elastic-store-data-on-multiple-file-systems/211002)
**Author:** [@yishain11](https://discuss.elastic.co/u/yishain11)\ **Replies:** 1\ **Last updated:** [December 9, 2019, 1:51pm UTC](https://discuss.elastic.co/t/can-elastic-store-data-on-multiple-file-systems/211002 "2019-12-09T13:51:04Z")
Hi everyone! I got a question from a client and I didn't found any clear answer for: Can elastic store data on multiple file systems? If I have a linux machine with multiple file systems, can I configure elastic you u… --- ## [Cluster issues](https://discuss.elastic.co/t/cluster-issues/211036)
**Author:** [@owen\_li](https://discuss.elastic.co/u/owen_li)\ **Replies:** 1\ **Last updated:** [December 9, 2019, 1:49pm UTC](https://discuss.elastic.co/t/cluster-issues/211036 "2019-12-09T13:49:19Z")
"stacktrace": \["org.elasticsearch.cluster.block.ClusterBlockException: blocked by: \[SERVICE\_UNAVAILABLE/1/state not recovered / initialized\]; "at org.elasticsearch.cluster.block.ClusterBlocks.globalBlockedException(Clus… --- ## [I want to enable the map which is present in SIEM app](https://discuss.elastic.co/t/i-want-to-enable-the-map-which-is-present-in-siem-app/211054)
**Author:** [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)\ **Replies:** 0\ **Last updated:** [December 9, 2019, 6:06am UTC](https://discuss.elastic.co/t/i-want-to-enable-the-map-which-is-present-in-siem-app/211054 "2019-12-09T06:06:19Z")
Hi , I am having Elasticsearch version 7.4, and in the SIEM app network section I want to enable the map present. I want to enable it through my own index , so i am doing ECS mapping of my index field but when i conve… --- ## [Id duplicated (and even more) but showing differents id for each entry](https://discuss.elastic.co/t/id-duplicated-and-even-more-but-showing-differents-id-for-each-entry/210932)
**Author:** [@BrunoSdeMenezes](https://discuss.elastic.co/u/BrunoSdeMenezes)\ **Replies:** 2\ **Last updated:** [December 9, 2019, 1:36pm UTC](https://discuss.elastic.co/t/id-duplicated-and-even-more-but-showing-differents-id-for-each-entry/210932 "2019-12-09T13:36:55Z")
Hello all, Kibana is showing duplicated entries on discover with differents ids. I do the right treatment to not duplicate the id during the ingestion. Using the Kibana 7.5.0 Can someone help me? --- ## [Path.config and config.string mixed](https://discuss.elastic.co/t/path-config-and-config-string-mixed/211120)
**Author:** [@devopstt](https://discuss.elastic.co/u/devopstt)\ **Replies:** 0\ **Last updated:** [December 9, 2019, 1:26pm UTC](https://discuss.elastic.co/t/path-config-and-config-string-mixed/211120 "2019-12-09T13:26:40Z")
Hi, we want to seperate some information in our logstash configurations, to let teams configure the filter and index setting, but not the input ports or ES output settings, like ES hosts, or users. So we created a conf… --- ## [CCR and deleted indices](https://discuss.elastic.co/t/ccr-and-deleted-indices/211116)
**Author:** [@matt\_db](https://discuss.elastic.co/u/matt_db)\ **Replies:** 0\ **Last updated:** [December 9, 2019, 1:20pm UTC](https://discuss.elastic.co/t/ccr-and-deleted-indices/211116 "2019-12-09T13:20:56Z")
I am testing CCR and would like to know if it is possible to delete a follower index if the source index is deleted. For example we create a new index in the remote cluster and our CCR auto follow pattern replicates it.… --- ## [Elasticsearch 7.2.1 doesn't work scroll in program](https://discuss.elastic.co/t/elasticsearch-7-2-1-doesnt-work-scroll-in-program/211112)
**Author:** [@datatek](https://discuss.elastic.co/u/datatek)\ **Replies:** 0\ **Last updated:** [December 9, 2019, 1:01pm UTC](https://discuss.elastic.co/t/elasticsearch-7-2-1-doesnt-work-scroll-in-program/211112 "2019-12-09T13:01:20Z")
Hello, I am using Elasticphp for elasticsearch 7.2.1. Scroll coding doesn't work at all. I need some many samples. Many thanks --- ## [Elasticsearch snapshot cannot on mounted DFS drive](https://discuss.elastic.co/t/elasticsearch-snapshot-cannot-on-mounted-dfs-drive/210715)
**Author:** [@Jiri\_Safar](https://discuss.elastic.co/u/Jiri_Safar)\ **Replies:** 1\ **Last updated:** [December 9, 2019, 12:49pm UTC](https://discuss.elastic.co/t/elasticsearch-snapshot-cannot-on-mounted-dfs-drive/210715 "2019-12-09T12:49:22Z")
Hi guys, I need to backup some index in my Elasticsearch and I would like to use options in Kibana to save/restore snapshots. I have already mount DFS share in to /mn/elk on all nodes (data and also masters nodes) and p… --- ## [How to use Type string in a multiple input Http\_Poller for different Grok pattern](https://discuss.elastic.co/t/how-to-use-type-string-in-a-multiple-input-http-poller-for-different-grok-pattern/210759)
**Author:** [@kamalesh](https://discuss.elastic.co/u/kamalesh)\ **Replies:** 1\ **Last updated:** [December 9, 2019, 12:25pm UTC](https://discuss.elastic.co/t/how-to-use-type-string-in-a-multiple-input-http-poller-for-different-grok-pattern/210759 "2019-12-09T12:25:25Z")
Hi All, I am trying to using multiple Url's for the http\_poller and need to use a different Grok patterns for each of the Url's I am aware that i can make use of type string in the Input plugins and make Grok patterns… --- ## [Elasticsearch behavior when stop indexing the biggest part of your messages](https://discuss.elastic.co/t/elasticsearch-behavior-when-stop-indexing-the-biggest-part-of-your-messages/211105)
**Author:** [@tvdruenen](https://discuss.elastic.co/u/tvdruenen)\ **Replies:** 0\ **Last updated:** [December 9, 2019, 11:56am UTC](https://discuss.elastic.co/t/elasticsearch-behavior-when-stop-indexing-the-biggest-part-of-your-messages/211105 "2019-12-09T11:56:30Z")
Hi Elastic fanatics, Last couple of years I was able to find everything I wanted to know in either the official documentation or in this forum. For the first time I stumbled upon something I'm not sure about but also ca… --- ## [Logstash queue is not draining](https://discuss.elastic.co/t/logstash-queue-is-not-draining/211098)
**Author:** [@74db36a597f21b891b3f](https://discuss.elastic.co/u/74db36a597f21b891b3f)\ **Replies:** 0\ **Last updated:** [December 9, 2019, 11:31am UTC](https://discuss.elastic.co/t/logstash-queue-is-not-draining/211098 "2019-12-09T11:31:48Z")
Hello. Right after the issue described here (https://discuss.elastic.co/t/problem-in-output-pipeline-affected-monitoring-pipeline/209321) i changed logstash pipeline configs and restarted it. But one of servers did not… --- ## [Elasticsearch 7.4 snapshot retention not working](https://discuss.elastic.co/t/elasticsearch-7-4-snapshot-retention-not-working/211097)
**Author:** [@jaiganesh06](https://discuss.elastic.co/u/jaiganesh06)\ **Replies:** 0\ **Last updated:** [December 9, 2019, 11:28am UTC](https://discuss.elastic.co/t/elasticsearch-7-4-snapshot-retention-not-working/211097 "2019-12-09T11:28:38Z")
Hi All, I have configured daily snapshot policy without retention and it is working fine. { "daily-snapshots" : { "version" : 1, "modified\_date\_millis" : 1575888007858, "policy" : { "name" : "\"… --- ## [Subtraction between 2 different fields(with scripted fields)](https://discuss.elastic.co/t/subtraction-between-2-different-fields-with-scripted-fields/210558)
**Author:** [@Angelos](https://discuss.elastic.co/u/Angelos)\ **Replies:** 7\ **Last updated:** [December 9, 2019, 11:05am UTC](https://discuss.elastic.co/t/subtraction-between-2-different-fields-with-scripted-fields/210558 "2019-12-09T11:05:40Z")
Hello! I converted a string into int using scripted fields. Now I am trying to subtract this field with another field inside the the index pattern. My document looks something like this: { "\_source": { "type": "ex… --- ## [Create\_weight takes too long](https://discuss.elastic.co/t/create-weight-takes-too-long/211093)
**Author:** [@chenyiping111](https://discuss.elastic.co/u/chenyiping111)\ **Replies:** 0\ **Last updated:** [December 9, 2019, 10:48am UTC](https://discuss.elastic.co/t/create-weight-takes-too-long/211093 "2019-12-09T10:48:29Z")
when i use query to search, the profile API show me the each TermQuery search time, the time of create\_weight takes 90%. I use shingle (2 words, 3 words), is that makes term dictionary too large? Any suggest can help? m… --- ## [Indexing large text fields](https://discuss.elastic.co/t/indexing-large-text-fields/210694)
**Author:** [@Maxim\_Golman](https://discuss.elastic.co/u/Maxim_Golman)\ **Replies:** 2\ **Last updated:** [December 9, 2019, 10:22am UTC](https://discuss.elastic.co/t/indexing-large-text-fields/210694 "2019-12-09T10:22:56Z")
Hello, I'm trying to index news and other articles that my clients upload and allow free text search on them. Is elasticsearch the right choice since there's a limit to text field size which get indexed. --- ## [Kibana Import & Export for Saved Objects via Rest API](https://discuss.elastic.co/t/kibana-import-export-for-saved-objects-via-rest-api/210852)
**Author:** [@ashokp](https://discuss.elastic.co/u/ashokp)\ **Replies:** 2\ **Last updated:** [December 9, 2019, 10:11am UTC](https://discuss.elastic.co/t/kibana-import-export-for-saved-objects-via-rest-api/210852 "2019-12-09T10:11:15Z")
Is there any Rest API exposed by kibana for import and export the saved objects in json format. So that we can automate the deployment of saved objects to kibana. --- ## [Dec 9th, 2019 \[EN\]\[Kibana\] Smart query cancellation in Kibana](https://discuss.elastic.co/t/dec-9th-2019-en-kibana-smart-query-cancellation-in-kibana/211047)
**Author:** [@lukas](https://discuss.elastic.co/u/lukas)\ **Replies:** 0\ **Last updated:** [December 9, 2019, 8:00am UTC](https://discuss.elastic.co/t/dec-9th-2019-en-kibana-smart-query-cancellation-in-kibana/211047 "2019-12-09T08:00:08Z")
Since the beginning, Kibana has always been about taking huge volumes of data in Elasticsearch and making sense of it visually. Over time, Kibana has stretched the limits of Elasticsearch, and we’ve needed to make change… --- ## [Error receiving audit reply: no buffer space available](https://discuss.elastic.co/t/error-receiving-audit-reply-no-buffer-space-available/210382)
**Author:** [@vaclav](https://discuss.elastic.co/u/vaclav)\ **Replies:** 1\ **Last updated:** [December 9, 2019, 9:28am UTC](https://discuss.elastic.co/t/error-receiving-audit-reply-no-buffer-space-available/210382 "2019-12-09T09:28:48Z")
Hello, I am having issue with auditbeat service running, but there is no output and some commands are not working. Found this error in syslog: auditbeat\[23346\]: 2019-12-03T11:48:38.116Z#011ERROR#011\[auditd\]#011auditd/a… --- ## [Failing to create pipeline using RabbitMQ ouput - Fresh install](https://discuss.elastic.co/t/failing-to-create-pipeline-using-rabbitmq-ouput-fresh-install/211029)
**Author:** [@KevSex](https://discuss.elastic.co/u/KevSex)\ **Replies:** 1\ **Last updated:** [December 9, 2019, 9:23am UTC](https://discuss.elastic.co/t/failing-to-create-pipeline-using-rabbitmq-ouput-fresh-install/211029 "2019-12-09T09:23:51Z")
I've installed that latest version of Logstash (at the time of writing 7.5.0), and attempting to use the RabbitMQ output within the pipeline. When I start logstash, it connects to RabbitMQ as seen in the logs but receive… --- ## [How to aggregate when two fields equal each other](https://discuss.elastic.co/t/how-to-aggregate-when-two-fields-equal-each-other/211041)
**Author:** [@Ronin](https://discuss.elastic.co/u/Ronin)\ **Replies:** 1\ **Last updated:** [December 9, 2019, 9:22am UTC](https://discuss.elastic.co/t/how-to-aggregate-when-two-fields-equal-each-other/211041 "2019-12-09T09:22:36Z")
I may be going about this all wrong, but I have the following document structure: { "@timestamp: "the time", "source.ip": "100.100.1.1", "destination.ip": "10.10.1.1", "bytes\_transferred": 5000 } And I am tryin… --- ## [Working matrix of APM](https://discuss.elastic.co/t/working-matrix-of-apm/211078)
**Author:** [@srinarayanant](https://discuss.elastic.co/u/srinarayanant)\ **Replies:** 0\ **Last updated:** [December 9, 2019, 9:21am UTC](https://discuss.elastic.co/t/working-matrix-of-apm/211078 "2019-12-09T09:21:20Z")
\ \io.opentracing.contrib\ \opentracing-spring-cloud-starter\ \0.2.3\ \ \ \co.elastic.apm\ \ **Author:** [@akhilsharma.in](https://discuss.elastic.co/u/akhilsharma.in)\ **Replies:** 0\ **Last updated:** [December 9, 2019, 9:19am UTC](https://discuss.elastic.co/t/rest-api-using-http-poller-and-http-filter/211076 "2019-12-09T09:19:29Z") Hi, I'm using http\_poller in the input block and http in the filter block to do REST API calls, they are working fine. But recently we have observed variations in the output. I'm running the calls every 5 minutes. I ha… --- ## [How to know the unique count using an aggregated filter?](https://discuss.elastic.co/t/how-to-know-the-unique-count-using-an-aggregated-filter/210719)
**Author:** [@badpenguin](https://discuss.elastic.co/u/badpenguin)\ **Replies:** 6\ **Last updated:** [December 9, 2019, 9:17am UTC](https://discuss.elastic.co/t/how-to-know-the-unique-count-using-an-aggregated-filter/210719 "2019-12-09T09:17:55Z")
I've data organized as rows with: user\_id, product\_id, etc. How can i have a unique count of how many users purchased both product\_id=123 and product\_id=234 ? I'was unable to figure out how to perform this kind of aggr… --- ## [Problem in output pipeline affected monitoring pipeline](https://discuss.elastic.co/t/problem-in-output-pipeline-affected-monitoring-pipeline/209321)
**Author:** [@74db36a597f21b891b3f](https://discuss.elastic.co/u/74db36a597f21b891b3f)\ **Replies:** 1\ **Last updated:** [December 9, 2019, 9:12am UTC](https://discuss.elastic.co/t/problem-in-output-pipeline-affected-monitoring-pipeline/209321 "2019-12-09T09:12:49Z")
Hi. I'd like to talk about one case, that had been today and maybe get and advice in pipeline handling. Today I added new ES output to my logstash config. I define outputs in separate pipelines to avoid problem when one… --- ## [\_meta for Fs-Crawler Mapping](https://discuss.elastic.co/t/meta-for-fs-crawler-mapping/210889)
**Author:** [@alipfi](https://discuss.elastic.co/u/alipfi)\ **Replies:** 6\ **Last updated:** [December 9, 2019, 9:02am UTC](https://discuss.elastic.co/t/meta-for-fs-crawler-mapping/210889 "2019-12-09T09:02:10Z")
I would like my Elasticsearch to also read custom-metadata. I read about the \_meta field and I am not sure how to implement it in my FS-Crawler Mappings. Does anyone have some experience with this field an can help? So … --- ## [General filter to agree with option filter](https://discuss.elastic.co/t/general-filter-to-agree-with-option-filter/211067)
**Author:** [@Voula\_Mikr](https://discuss.elastic.co/u/Voula_Mikr)\ **Replies:** 0\ **Last updated:** [December 9, 2019, 8:18am UTC](https://discuss.elastic.co/t/general-filter-to-agree-with-option-filter/211067 "2019-12-09T08:18:47Z")
Hi, I made a dashboard with a control in it, which includes filter for field\_A and filter for field\_B. When I filter from control with field\_A (for example), also a "general" filter is shown on the dashboard. But when … --- ## [Elasticsearch SQLの判定がおかしい](https://discuss.elastic.co/t/elasticsearch-sql/211049)
**Author:** [@sshota](https://discuss.elastic.co/u/sshota)\ **Replies:** 3\ **Last updated:** [December 9, 2019, 7:01am UTC](https://discuss.elastic.co/t/elasticsearch-sql/211049 "2019-12-09T07:01:19Z")
お世話になります。 CanvasのImage revealエレメントで、data source に Elaticsearch SQLを指定しています。 SQLの中で、値がXX以上なら～のような構文を書いているのですが、想定どおり動作しない箇所があります。 SELECT CASE WHEN round(0,3) \< 0 THEN 0 ELSE 1 END AS "test" 結果：test=0 この場合、想定する動きとして r… --- ## [Replace @timestamp or add new field with time from log file](https://discuss.elastic.co/t/replace-timestamp-or-add-new-field-with-time-from-log-file/211007)
**Author:** [@pashang](https://discuss.elastic.co/u/pashang)\ **Replies:** 3\ **Last updated:** [December 9, 2019, 6:27am UTC](https://discuss.elastic.co/t/replace-timestamp-or-add-new-field-with-time-from-log-file/211007 "2019-12-09T06:27:33Z")
I have below sample log and I need to replace @timestamp or add new field from 15:38:43.335 segment. -15:38:43.335 U888 ExecuteThread: '3' for queue ... I used below filter but not worked. filter { date { … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1735) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1737)