# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1781 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1782 --- ## [503 Error :Saved Object Service not available in kibana](https://discuss.elastic.co/t/503-error-saved-object-service-not-available-in-kibana/205785)
**Author:** [@das\_santosh](https://discuss.elastic.co/u/das_santosh)\ **Replies:** 5\ **Last updated:** [November 15, 2019, 5:31am UTC](https://discuss.elastic.co/t/503-error-saved-object-service-not-available-in-kibana/205785 "2019-11-15T05:31:53Z")
Hi Elasticteam, I have tried to delete my saved object but i am getting the attached error also while modifying the saved object pattern i am getting the error. Please find the attached screenshots , could you please a… --- ## [Setting the best config in logstash.yml for my Environment](https://discuss.elastic.co/t/setting-the-best-config-in-logstash-yml-for-my-environment/207780)
**Author:** [@Thiago\_Paiva](https://discuss.elastic.co/u/Thiago_Paiva)\ **Replies:** 2\ **Last updated:** [November 15, 2019, 4:33am UTC](https://discuss.elastic.co/t/setting-the-best-config-in-logstash-yml-for-my-environment/207780 "2019-11-15T04:33:15Z")
Hi community. Recently in my environment, I'm feeling that a input data that a pipeline is too slow. Before explain how is mine solution ELK. Following info’s about my machine: OS: Linux version 4.1.12-124.25.1 Red Hat … --- ## [ログ出力先に複数フォーマットのログが出力される場合](https://discuss.elastic.co/t/topic/207979)
**Author:** [@keikei12](https://discuss.elastic.co/u/keikei12)\ **Replies:** 1\ **Last updated:** [November 15, 2019, 3:06am UTC](https://discuss.elastic.co/t/topic/207979 "2019-11-15T03:06:20Z")
logstashの仕様でご存じでしたら教えて下さい。 現在下記のような設定を入れています。 input { beats { port =\> "5044" } } filter { grok { match =\> {"message" =\> '%{TIMESTAMP\_ISO8601}\\s\*%{DATESTAMP\_OTHER}%{LOGLEVEEL}:\\s\*%{GREE… --- ## [Nagioscheckbeat 'metric' data combined with 'check'?](https://discuss.elastic.co/t/nagioscheckbeat-metric-data-combined-with-check/205370)
**Author:** [@safehouse](https://discuss.elastic.co/u/safehouse)\ **Replies:** 2\ **Last updated:** [November 15, 2019, 2:47am UTC](https://discuss.elastic.co/t/nagioscheckbeat-metric-data-combined-with-check/205370 "2019-11-15T02:47:20Z")
@PhaedrusTheGreek In this post we discussed how to successfully send nagioscheckbeat 'check' data to the nagios host, while sending the 'metric' data to Elasticsearch. I am trying to figure out how to send Nagios 'perfd… --- ## [ログを4つのログに分割してElasticsearchに送る](https://discuss.elastic.co/t/4-elasticsearch/206889)
**Author:** [@keikei12](https://discuss.elastic.co/u/keikei12)\ **Replies:** 6\ **Last updated:** [November 15, 2019, 1:46am UTC](https://discuss.elastic.co/t/4-elasticsearch/206889 "2019-11-15T01:46:57Z")
下記のようなログをlogstashで整形してElasticSearchに送りたいのですが可能でしょうか？ ＜ログのフォーマット＞ 日付:ログ種別△ログ1△△ログ2△△ログ3△△ログ4 ※△はタブです。 ログ1、ログ2、ログ3、ログ4とそれぞれ別のログとして elasticsearchに送りたいです。 --- ## [Visualize bar chart Kibana](https://discuss.elastic.co/t/visualize-bar-chart-kibana/207971)
**Author:** [@Diego\_Ruggirello](https://discuss.elastic.co/u/Diego_Ruggirello)\ **Replies:** 0\ **Last updated:** [November 14, 2019, 11:05pm UTC](https://discuss.elastic.co/t/visualize-bar-chart-kibana/207971 "2019-11-14T23:05:08Z")
Good afternoon, nice to meet you I am new with the kibana tool and I am trying to make a visualization with bar graph. What I want to correct is that it shows me in the graph only two dates (in this case 2019-11-09 and … --- ## [Parse single line multi object json with logstash](https://discuss.elastic.co/t/parse-single-line-multi-object-json-with-logstash/207608)
**Author:** [@sili.redwork](https://discuss.elastic.co/u/sili.redwork)\ **Replies:** 12\ **Last updated:** [November 14, 2019, 11:59pm UTC](https://discuss.elastic.co/t/parse-single-line-multi-object-json-with-logstash/207608 "2019-11-14T23:59:44Z")
Hello, We are sending collecting cloudwatch logs to central log account's S3 bucket using Cloudwatch --\> Log Destination --\> Kinesis --\> S3 S3 file has multiple json objects in single line, below is the sample format {… --- ## [Process to import periodic text file](https://discuss.elastic.co/t/process-to-import-periodic-text-file/207969)
**Author:** [@K29](https://discuss.elastic.co/u/K29)\ **Replies:** 0\ **Last updated:** [November 14, 2019, 10:56pm UTC](https://discuss.elastic.co/t/process-to-import-periodic-text-file/207969 "2019-11-14T22:56:48Z")
Hello, I'm using ES recently. After having read several posts, I don't see how to use the best method to import datas from a text file in an index. I need to import this file each month and update the index with the new… --- ## [Logstash UDP to InfluxDB](https://discuss.elastic.co/t/logstash-udp-to-influxdb/207966)
**Author:** [@nck8791](https://discuss.elastic.co/u/nck8791)\ **Replies:** 0\ **Last updated:** [November 14, 2019, 10:39pm UTC](https://discuss.elastic.co/t/logstash-udp-to-influxdb/207966 "2019-11-14T22:39:09Z")
I am trying to push data from a UDP to InfluxDB pipeline in Logstash. The logstash configuration is as follows Sample Logstash configuration for creating a simple UDP -\> Logstash -\> InfluxDB pipeline. input { udp { po… --- ## [Why search.max\_buckets soft limit is 10000 ? What are the cons of increasing this size limit?](https://discuss.elastic.co/t/why-search-max-buckets-soft-limit-is-10000-what-are-the-cons-of-increasing-this-size-limit/207190)
**Author:** [@Seetha93](https://discuss.elastic.co/u/Seetha93)\ **Replies:** 3\ **Last updated:** [November 14, 2019, 9:56pm UTC](https://discuss.elastic.co/t/why-search-max-buckets-soft-limit-is-10000-what-are-the-cons-of-increasing-this-size-limit/207190 "2019-11-14T21:56:10Z")
Also, why top\_hits window inside aggregation buckets is 100. Does that mean, increasing the window size to 10 times will have a significant toll on performance ? --- ## [Links in uptime do not work \[7.4\]](https://discuss.elastic.co/t/links-in-uptime-do-not-work-7-4/206983)
**Author:** [@robrotheram](https://discuss.elastic.co/u/robrotheram)\ **Replies:** 1\ **Last updated:** [November 12, 2019, 10:28pm UTC](https://discuss.elastic.co/t/links-in-uptime-do-not-work-7-4/206983 "2019-11-12T22:28:00Z")
I have upgraded to kibana 7.4 from 6.7 and the links in uptime to view in infra UI or Logui do not work. I running kibana through nginx and I have a basepath set to /kibana . I have set up a rewrite rule in nginx rewr… --- ## [C# NEST Client Elasticsearch 7.x DeleteIndex](https://discuss.elastic.co/t/c-nest-client-elasticsearch-7-x-deleteindex/207772)
**Author:** [@codyspeck](https://discuss.elastic.co/u/codyspeck)\ **Replies:** 2\ **Last updated:** [November 14, 2019, 8:06pm UTC](https://discuss.elastic.co/t/c-nest-client-elasticsearch-7-x-deleteindex/207772 "2019-11-14T20:06:54Z")
According to the NEST breaking change list in version 7.0.0, the DeleteIndex method is no longer available. Does anyone know if the same behavior (deleting an index or clearing all documents in an index) is able to be pe… --- ## [Is JVM heap size a function of GC algorithm?](https://discuss.elastic.co/t/is-jvm-heap-size-a-function-of-gc-algorithm/207954)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 0\ **Last updated:** [November 14, 2019, 7:36pm UTC](https://discuss.elastic.co/t/is-jvm-heap-size-a-function-of-gc-algorithm/207954 "2019-11-14T19:36:55Z")
https://discuss.elastic.co/t/jvm-heap-size-too-large/207312 This topic described it all. I understand the reasoning to avoid long stop the world GC. So reducing the RAM will shorten such event. But it would make old … --- ## [Changed grok pattern for ingest pipeline and now grok pattern matching is timing out after 1000ms](https://discuss.elastic.co/t/changed-grok-pattern-for-ingest-pipeline-and-now-grok-pattern-matching-is-timing-out-after-1000ms/207775)
**Author:** [@thethomp](https://discuss.elastic.co/u/thethomp)\ **Replies:** 3\ **Last updated:** [November 14, 2019, 7:31pm UTC](https://discuss.elastic.co/t/changed-grok-pattern-for-ingest-pipeline-and-now-grok-pattern-matching-is-timing-out-after-1000ms/207775 "2019-11-14T19:31:41Z")
Hello, I'm using ingest pipelines to do some grokking and formatting before inserting documents into Elasticsearch, I've been using this grok pattern for months without any issue. Today the format of my logs changed a l… --- ## [Best beats for crontab in linux](https://discuss.elastic.co/t/best-beats-for-crontab-in-linux/206005)
**Author:** [@Bharatsid](https://discuss.elastic.co/u/Bharatsid)\ **Replies:** 1\ **Last updated:** [November 14, 2019, 6:53pm UTC](https://discuss.elastic.co/t/best-beats-for-crontab-in-linux/206005 "2019-11-14T18:53:08Z")
I want alert monitoring for crontab in my application. So which beats are best to monitor for crontabs? --- ## [Faceted search with aggregations](https://discuss.elastic.co/t/faceted-search-with-aggregations/205135)
**Author:** [@decodeit](https://discuss.elastic.co/u/decodeit)\ **Replies:** 20\ **Last updated:** [November 14, 2019, 6:42pm UTC](https://discuss.elastic.co/t/faceted-search-with-aggregations/205135 "2019-11-14T18:42:47Z")
I am trying to do faceted search with aggregation (which I think is the way to do, suggestions are welcome). so the query below is sending the search term with the aggs. POST events/event/\_search { "query": { "multi\_ma… --- ## [Extract string from a field in logstash](https://discuss.elastic.co/t/extract-string-from-a-field-in-logstash/207736)
**Author:** [@aasoft](https://discuss.elastic.co/u/aasoft)\ **Replies:** 7\ **Last updated:** [November 14, 2019, 6:24pm UTC](https://discuss.elastic.co/t/extract-string-from-a-field-in-logstash/207736 "2019-11-14T18:24:40Z")
I have a field in my index as: "url" : "http://myaddress:myport/mydoc-3.docx" I would like to create a new field ("newid") and put the extracted value mydoc to it. basically I want to capture the document name with ex… --- ## [ES 6.4.3 Highlight response has unexpected content for query\_string type of query](https://discuss.elastic.co/t/es-6-4-3-highlight-response-has-unexpected-content-for-query-string-type-of-query/207950)
**Author:** [@amitbyahoo](https://discuss.elastic.co/u/amitbyahoo)\ **Replies:** 0\ **Last updated:** [November 14, 2019, 6:07pm UTC](https://discuss.elastic.co/t/es-6-4-3-highlight-response-has-unexpected-content-for-query-string-type-of-query/207950 "2019-11-14T18:07:23Z")
Hi I was able to get highlighting to work correctly with some sample queries from documentation website. However, for my real queries I am facing a strange problem where the highlight tags are displayed many times over … --- ## [Split rabbitmq.connection.name field to visualize](https://discuss.elastic.co/t/split-rabbitmq-connection-name-field-to-visualize/207713)
**Author:** [@AstroSlazak](https://discuss.elastic.co/u/AstroSlazak)\ **Replies:** 1\ **Last updated:** [November 14, 2019, 5:58pm UTC](https://discuss.elastic.co/t/split-rabbitmq-connection-name-field-to-visualize/207713 "2019-11-14T17:58:57Z")
Hi I want to create a Sankey visualization in Kiban using rabbitmq.connection.name from metricbeat . I get the data like this: 10.149.100.111:42708 -\> 192.168.112.19:5672 but i need it to be like this: 10.149.100… --- ## [Split visualization based on partial string in field](https://discuss.elastic.co/t/split-visualization-based-on-partial-string-in-field/207599)
**Author:** [@dthor823](https://discuss.elastic.co/u/dthor823)\ **Replies:** 1\ **Last updated:** [November 14, 2019, 5:56pm UTC](https://discuss.elastic.co/t/split-visualization-based-on-partial-string-in-field/207599 "2019-11-14T17:56:57Z")
I have a large index of documents. Each document number either starts with "XXX-", "YYY-", or "ZZZ-" and I would like to, in a horizontal bar chart, have one bar be for "XXX-" documents, the other be for "YYY-" documents… --- ## [Need to implement a Lifecycle, but I have daily named indicies](https://discuss.elastic.co/t/need-to-implement-a-lifecycle-but-i-have-daily-named-indicies/207945)
**Author:** [@mhare](https://discuss.elastic.co/u/mhare)\ **Replies:** 1\ **Last updated:** [November 14, 2019, 5:55pm UTC](https://discuss.elastic.co/t/need-to-implement-a-lifecycle-but-i-have-daily-named-indicies/207945 "2019-11-14T17:55:00Z")
I hope I'm just not seeing something. I have version 7.4 of the Elastic Stack Logstash creates indices as: output { elasticsearch { action =\> "index" hosts =\> \[ "localhost:9200" \] index =\> "memleak-%{+YYYY.MM.dd}" … --- ## [SIEM not ingesting Forwarded Windows logs](https://discuss.elastic.co/t/siem-not-ingesting-forwarded-windows-logs/207311)
**Author:** [@mustdiee](https://discuss.elastic.co/u/mustdiee)\ **Replies:** 5\ **Last updated:** [November 14, 2019, 5:54pm UTC](https://discuss.elastic.co/t/siem-not-ingesting-forwarded-windows-logs/207311 "2019-11-14T17:54:34Z")
Hello! I'am collecting logs from all Windows PCs in my infrastructure with EventForwarding. Only one server has a winlogbeat installed, which is configured on other workstations as a subscription server (this is the eas… --- ## [Ingest only Node and Cold Nodes machine Spec](https://discuss.elastic.co/t/ingest-only-node-and-cold-nodes-machine-spec/207741)
**Author:** [@vsubrama](https://discuss.elastic.co/u/vsubrama)\ **Replies:** 1\ **Last updated:** [November 14, 2019, 5:51pm UTC](https://discuss.elastic.co/t/ingest-only-node-and-cold-nodes-machine-spec/207741 "2019-11-14T17:51:49Z")
We have an Elastic stack cluster now upgraded to 7.4.2 ingesting about 600 GB of data per day running in Hot Warm architecture in our AWS account. We keep data for 90 days. Our Hot nodes are AWS i3en.2x large (8 VCPU, 6… --- ## [No "blogs" data for Elasticsearch Engineer II](https://discuss.elastic.co/t/no-blogs-data-for-elasticsearch-engineer-ii/207837)
**Author:** [@Andrew\_Pouckatch](https://discuss.elastic.co/u/Andrew_Pouckatch)\ **Replies:** 4\ **Last updated:** [November 14, 2019, 5:45pm UTC](https://discuss.elastic.co/t/no-blogs-data-for-elasticsearch-engineer-ii/207837 "2019-11-14T17:45:19Z")
Hi I've started Elasticsearch Engineer II (on-demand). There is neither blogs.csv on Strigo's server1 nor pre-loaded index in cluster: get \_cat/indices?v health status index uuid … --- ## [Heat Maps](https://discuss.elastic.co/t/heat-maps/207939)
**Author:** [@mbrown007](https://discuss.elastic.co/u/mbrown007)\ **Replies:** 2\ **Last updated:** [November 14, 2019, 5:32pm UTC](https://discuss.elastic.co/t/heat-maps/207939 "2019-11-14T17:32:57Z")
Have I seen it correct that the only way to do heat maps is via having latitude and longitude or can I do it via addresses? Thanks --- ## [Help with Failed to authenticate user error for elastic](https://discuss.elastic.co/t/help-with-failed-to-authenticate-user-error-for-elastic/207778)
**Author:** [@reswob](https://discuss.elastic.co/u/reswob)\ **Replies:** 1\ **Last updated:** [November 14, 2019, 5:31pm UTC](https://discuss.elastic.co/t/help-with-failed-to-authenticate-user-error-for-elastic/207778 "2019-11-14T17:31:02Z")
So I've been googling this issue and trying multiple solutions but so far nothing has worked. I'm posting this here in the hopes that I've missed something else. I have a single ES cluster running on server with Kibana… --- ## [List variable reference - is it possible?](https://discuss.elastic.co/t/list-variable-reference-is-it-possible/207940)
**Author:** [@sdndude](https://discuss.elastic.co/u/sdndude)\ **Replies:** 0\ **Last updated:** [November 14, 2019, 5:08pm UTC](https://discuss.elastic.co/t/list-variable-reference-is-it-possible/207940 "2019-11-14T17:08:56Z")
I have a scenario where I could have firewalls (all the same vendor) that are of differing OS versions sending data to logstash. The only difference in the messages is the number of fields it sends. It's all comma del… --- ## [Different order gives different results](https://discuss.elastic.co/t/different-order-gives-different-results/207938)
**Author:** [@Swetha\_Mallika\_Guntu](https://discuss.elastic.co/u/Swetha_Mallika_Guntu)\ **Replies:** 0\ **Last updated:** [November 14, 2019, 4:46pm UTC](https://discuss.elastic.co/t/different-order-gives-different-results/207938 "2019-11-14T16:46:53Z")
I have created a customised analyzer which looks like this { 'type': 'custom', 'tokenizer': 'standard', 'filter': \[ 'standard', 'lowercase', 'unique' \] }\\ I am using this analyzer for different fields in my dat… --- ## [Analytics for elasticsearch](https://discuss.elastic.co/t/analytics-for-elasticsearch/207936)
**Author:** [@imranazad](https://discuss.elastic.co/u/imranazad)\ **Replies:** 0\ **Last updated:** [November 14, 2019, 4:35pm UTC](https://discuss.elastic.co/t/analytics-for-elasticsearch/207936 "2019-11-14T16:35:43Z")
This post is to get some ideas and advice on what analytics can be done on elasticsearch. We want to measure our search performance. In particular we are interested in getting data around Number of results returned for… --- ## [Aggregation Per document](https://discuss.elastic.co/t/aggregation-per-document/207934)
**Author:** [@Calvin-J-Scott](https://discuss.elastic.co/u/Calvin-J-Scott)\ **Replies:** 0\ **Last updated:** [November 14, 2019, 4:34pm UTC](https://discuss.elastic.co/t/aggregation-per-document/207934 "2019-11-14T16:34:40Z")
Hi am trying to create a query that will return aggregations for each hit returned from a query rather that aggregation for the full search response. for example if i had two documents { "Name":"Jon", "Cars":\[ … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1780) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1782)