# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1796 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1797 --- ## [Master not discovered, removed nodes have been totally destroyed](https://discuss.elastic.co/t/master-not-discovered-removed-nodes-have-been-totally-destroyed/206143)
**Author:** [@hackerwin7](https://discuss.elastic.co/u/hackerwin7)\ **Replies:** 7\ **Last updated:** [November 6, 2019, 11:49am UTC](https://discuss.elastic.co/t/master-not-discovered-removed-nodes-have-been-totally-destroyed/206143 "2019-11-06T11:49:58Z")
Hi, I have removed half of nodes of cluster, and the removed nodes and machines have been totally destroyed. the existing cluster log like: master not discovered or elected yet, an election requires at least nodes wit… --- ## [Wrong doc\_count on Children Aggregation](https://discuss.elastic.co/t/wrong-doc-count-on-children-aggregation/206903)
**Author:** [@DeeeFOX](https://discuss.elastic.co/u/DeeeFOX)\ **Replies:** 0\ **Last updated:** [November 7, 2019, 6:26am UTC](https://discuss.elastic.co/t/wrong-doc-count-on-children-aggregation/206903 "2019-11-07T06:26:47Z")
request: POST /test\_tsdb\_alias/\_search?routing=ms\_nginxgas3\_count&track\_total\_hits=true { "query": { "bool": { "filter": \[ { "has\_parent": { "parent\_type": "t", "que… --- ## [Watcherのemail actionでdashboard.pdfを添付したい](https://discuss.elastic.co/t/watcher-email-action-dashboard-pdf/205998)
**Author:** [@sshota](https://discuss.elastic.co/u/sshota)\ **Replies:** 4\ **Last updated:** [November 7, 2019, 6:37am UTC](https://discuss.elastic.co/t/watcher-email-action-dashboard-pdf/205998 "2019-11-07T06:37:21Z")
Watcherのemail actionで、送るメールにdashboardのpdfファイルを添付したいと考えています。 下記URLを参考に設定をしているのですが、上手くいきません。 https://www.elastic.co/guide/en/elasticsearch/reference/7.3/actions-email.html#configuring-email-attachments 設定した条件（trigger,in… --- ## [結合ログを分割してElasticSearchに取り込む](https://discuss.elastic.co/t/elasticsearch/206907)
**Author:** [@sat1100](https://discuss.elastic.co/u/sat1100)\ **Replies:** 0\ **Last updated:** [November 7, 2019, 6:34am UTC](https://discuss.elastic.co/t/elasticsearch/206907 "2019-11-07T06:34:49Z")
初心者の者です。 複数のログをタブで結合したファイルをFilebeatで取得し、logstashを経由して 分割した状態でログをElasticsearchに取り込ませたいと考えておりますが、実現可能でしょうか？ 環境は以下の通りです。 ・CentOS7.5 ・ElasticSearch：7.4.0 ・Kibana：7.4.0 ・Logstash：7.4.0 ・Filebeat：7.4.0 以上、よろしくお願いします。 --- ## [Cluster elasticsearch on basic license](https://discuss.elastic.co/t/cluster-elasticsearch-on-basic-license/206733)
**Author:** [@Mohammad\_Mousavi](https://discuss.elastic.co/u/Mohammad_Mousavi)\ **Replies:** 5\ **Last updated:** [November 7, 2019, 6:13am UTC](https://discuss.elastic.co/t/cluster-elasticsearch-on-basic-license/206733 "2019-11-07T06:13:26Z")
Hi, I have 1 elasticsearch node, I've installed another node in another DC. Now I wanna have a cluster between 2 node so data can be HA. Based on documentations I've added this config (on master): cluster.name: mycluste… --- ## [Sync mongodb data to elasticsearch(update if exists or insert) using logstash](https://discuss.elastic.co/t/sync-mongodb-data-to-elasticsearch-update-if-exists-or-insert-using-logstash/206897)
**Author:** [@hannu98](https://discuss.elastic.co/u/hannu98)\ **Replies:** 0\ **Last updated:** [November 7, 2019, 6:03am UTC](https://discuss.elastic.co/t/sync-mongodb-data-to-elasticsearch-update-if-exists-or-insert-using-logstash/206897 "2019-11-07T06:03:42Z")
I just want to sync the data from mongodb to elastic using logstash. Its working good, when any new record comes in mongodb, logstash pushes into elastic. But when I update any record in mongodb then it does not change i… --- ## [Does logstash-filter-cidr support mutiple address match like if condition](https://discuss.elastic.co/t/does-logstash-filter-cidr-support-mutiple-address-match-like-if-condition/206882)
**Author:** [@tacyeh](https://discuss.elastic.co/u/tacyeh)\ **Replies:** 0\ **Last updated:** [November 7, 2019, 4:20am UTC](https://discuss.elastic.co/t/does-logstash-filter-cidr-support-mutiple-address-match-like-if-condition/206882 "2019-11-07T04:20:57Z")
I want add a field {"key" =\> "value1"} when address match "192.168.1.1/24", add a field {"key" =\> "value2"} when address match "192.168.2.1/24"..., but accord the reference, I wrote configs like this: filter { c… --- ## [Data Update from MYSQL not appear](https://discuss.elastic.co/t/data-update-from-mysql-not-appear/206512)
**Author:** [@dean92](https://discuss.elastic.co/u/dean92)\ **Replies:** 4\ **Last updated:** [November 7, 2019, 3:07am UTC](https://discuss.elastic.co/t/data-update-from-mysql-not-appear/206512 "2019-11-07T03:07:53Z")
hi all, I have one problem on my data. I export one table and a few column on my MYSQL to ES using logstash. there are one column(status\_ticket) in table is frequently change e.g: from status new to open/closed and it e… --- ## [How To Add a New Field, Then Populate It Based On Another Field's Value?](https://discuss.elastic.co/t/how-to-add-a-new-field-then-populate-it-based-on-another-fields-value/206190)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 2\ **Last updated:** [November 7, 2019, 12:43am UTC](https://discuss.elastic.co/t/how-to-add-a-new-field-then-populate-it-based-on-another-fields-value/206190 "2019-11-07T00:43:11Z")
Hello Elasticsearch Sorcerers, I am running Logstash v7.4.0 and Elasticsearch v7.4.0 in a nicely-working pipeline. My chain of fruit stores are sending my sales information to Logstash; Logstash then pushes that data t… --- ## [LogStash:: How To Add a New Field, Then Populate It Based On Another Field's Value?](https://discuss.elastic.co/t/logstash-how-to-add-a-new-field-then-populate-it-based-on-another-fields-value/206193)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 14\ **Last updated:** [November 7, 2019, 12:41am UTC](https://discuss.elastic.co/t/logstash-how-to-add-a-new-field-then-populate-it-based-on-another-fields-value/206193 "2019-11-07T00:41:10Z")
Hello Logstash Sorcerers, I am running Logstash v7.4.0 and Elasticsearch v7.4.0 in a nicely-working pipeline. My chain of fruit stores are sending my sales information to Logstash; Logstash then pushes that data to Ela… --- ## [NEST SortScriptDescriptor class](https://discuss.elastic.co/t/nest-sortscriptdescriptor-class/206724)
**Author:** [@Paulo\_Henrique\_PH](https://discuss.elastic.co/u/Paulo_Henrique_PH)\ **Replies:** 1\ **Last updated:** [November 7, 2019, 12:16am UTC](https://discuss.elastic.co/t/nest-sortscriptdescriptor-class/206724 "2019-11-07T00:16:05Z")
Hi guys, I was using the "SortScriptDescriptor" class in this part of a c# app: SortScriptDescriptor\ sortScriptDescriptor = new SortScriptDescriptor\(); if (sort… --- ## [ECE 2.4 released](https://discuss.elastic.co/t/ece-2-4-released/206875)
**Author:** [@elyssaemrich](https://discuss.elastic.co/u/elyssaemrich)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 11:31pm UTC](https://discuss.elastic.co/t/ece-2-4-released/206875 "2019-11-06T23:31:03Z")
ECE 2.4 released Introducing Elastic Cloud Enterprise (ECE) 2.4 with Elastic App Search (beta) for building modern, streamlined search experiences. Plus a new command line tool, new allocation methods, and improved stab… --- ## [Question on missing documents, timeouts, shard failures, and partial search results](https://discuss.elastic.co/t/question-on-missing-documents-timeouts-shard-failures-and-partial-search-results/206869)
**Author:** [@loren](https://discuss.elastic.co/u/loren)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 10:42pm UTC](https://discuss.elastic.co/t/question-on-missing-documents-timeouts-shard-failures-and-partial-search-results/206869 "2019-11-06T22:42:45Z")
ES7.4. I have queries that perform ID searches on documents I know exist in the index (which has 1 replica). As a sanity check, I raise an error if I get back less than 100%. This is rare but it happens. The cluster is u… --- ## [LOGSTASH, simple code unable to get output in elasticsearch and kibana](https://discuss.elastic.co/t/logstash-simple-code-unable-to-get-output-in-elasticsearch-and-kibana/206848)
**Author:** [@santhosh\_l](https://discuss.elastic.co/u/santhosh_l)\ **Replies:** 4\ **Last updated:** [November 6, 2019, 9:40pm UTC](https://discuss.elastic.co/t/logstash-simple-code-unable-to-get-output-in-elasticsearch-and-kibana/206848 "2019-11-06T21:40:59Z")
Hello all, I am a beginner in elk, i am trying to execute logstash ( through power shell). when ever i execute the fallowing command :- C:\\siem\> .\\logstash-7.4.1\\bin\\logstash.bat -f .\\myfirst.conf the output on the p… --- ## [Rollover request failed but the index is created](https://discuss.elastic.co/t/rollover-request-failed-but-the-index-is-created/206091)
**Author:** [@Alex\_Huo](https://discuss.elastic.co/u/Alex_Huo)\ **Replies:** 6\ **Last updated:** [November 6, 2019, 9:23pm UTC](https://discuss.elastic.co/t/rollover-request-failed-but-the-index-is-created/206091 "2019-11-06T21:23:29Z")
Hey there, I got a 503 response when using \_rollover API. Here is the response. { "error": { "root\_cause": \[ { "type": "process\_cluster\_event\_timeout\_exception", … --- ## [ERROR logstash/async.go:256 Failed to publish events caused by: lumberjack protocol error & client is not connected](https://discuss.elastic.co/t/error-logstash-async-go-256-failed-to-publish-events-caused-by-lumberjack-protocol-error-client-is-not-connected/206860)
**Author:** [@Sreekanth3](https://discuss.elastic.co/u/Sreekanth3)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 8:30pm UTC](https://discuss.elastic.co/t/error-logstash-async-go-256-failed-to-publish-events-caused-by-lumberjack-protocol-error-client-is-not-connected/206860 "2019-11-06T20:30:29Z")
I have enabled SSL on the logstash and I want to try validate logstash to elastic over ssl and filebeat to logstash with non-ssl . \`Connection to backoff(async(tcp://XXX.XXX.X.XXX:5045)) established\` \`Failed to … --- ## [Find top 10 documents when 1 document matches criteria](https://discuss.elastic.co/t/find-top-10-documents-when-1-document-matches-criteria/206696)
**Author:** [@kidrik](https://discuss.elastic.co/u/kidrik)\ **Replies:** 2\ **Last updated:** [November 6, 2019, 8:20pm UTC](https://discuss.elastic.co/t/find-top-10-documents-when-1-document-matches-criteria/206696 "2019-11-06T20:20:13Z")
I have an index with over 30M documents. Every document has a parentId field and a createdOn field. Modified documents have a modifiedOn field. Dates are stored as epoch\_millis. I need to find the top 10 most-recent … --- ## [Loading Kibana dashboard for filebeat](https://discuss.elastic.co/t/loading-kibana-dashboard-for-filebeat/206480)
**Author:** [@sarahvo](https://discuss.elastic.co/u/sarahvo)\ **Replies:** 1\ **Last updated:** [November 6, 2019, 8:11pm UTC](https://discuss.elastic.co/t/loading-kibana-dashboard-for-filebeat/206480 "2019-11-06T20:11:04Z")
Hi, I'm using Elasticsearch and Kibana services in Azure and I have logstash on-prem. I want to have filebeat push logs to logstash. I'm trying to load the Kibana dashboard for filebeat using the endpoint URLs for Elasti… --- ## [Per/Node Ip FIlters in Cluster Settings](https://discuss.elastic.co/t/per-node-ip-filters-in-cluster-settings/199384)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [November 6, 2019, 7:35pm UTC](https://discuss.elastic.co/t/per-node-ip-filters-in-cluster-settings/199384 "2019-11-06T19:35:23Z")
Hello, Currently we are setting the xpack.security.http.filter.allow directive in elasticsearch.yml on all our nodes (12). The configuration is different for master / data nodes and ingest/coordination nodes. This mean… --- ## [CSV/Time Bug](https://discuss.elastic.co/t/csv-time-bug/206845)
**Author:** [@Jim\_Thunder](https://discuss.elastic.co/u/Jim_Thunder)\ **Replies:** 2\ **Last updated:** [November 6, 2019, 7:25pm UTC](https://discuss.elastic.co/t/csv-time-bug/206845 "2019-11-06T19:25:31Z")
Hello! I have files being sent in CSV format. My logstash config ONLY parses them into different fields. It does nothing else. For some reason, whenever there is a date in the CSV file, the field that should contain th… --- ## [Logstash pipeline for csv file using filebeat](https://discuss.elastic.co/t/logstash-pipeline-for-csv-file-using-filebeat/206689)
**Author:** [@newbieELK](https://discuss.elastic.co/u/newbieELK)\ **Replies:** 2\ **Last updated:** [November 6, 2019, 6:52pm UTC](https://discuss.elastic.co/t/logstash-pipeline-for-csv-file-using-filebeat/206689 "2019-11-06T18:52:10Z")
Hi, Spent too much time on this, would really appreciate any help. My csv file loading in one record. My data is csv: Number,Category,Assignment group,Technology,Assigned to,Opened,O\_Month,Opened Day,Opened Date,Opened… --- ## [Console XML works, but not file XML](https://discuss.elastic.co/t/console-xml-works-but-not-file-xml/206645)
**Author:** [@kcb](https://discuss.elastic.co/u/kcb)\ **Replies:** 8\ **Last updated:** [November 6, 2019, 6:24pm UTC](https://discuss.elastic.co/t/console-xml-works-but-not-file-xml/206645 "2019-11-06T18:24:18Z")
We have written a logstash script to process an XMLfile and export contents to stdout{}. We have verified the script works when the input is specified as stdin{} However, when we specify a file as the input, the XML doe… --- ## [Help Me Logstash Not Found 5044](https://discuss.elastic.co/t/help-me-logstash-not-found-5044/206846)
**Author:** [@Paulo\_Lima](https://discuss.elastic.co/u/Paulo_Lima)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 6:06pm UTC](https://discuss.elastic.co/t/help-me-logstash-not-found-5044/206846 "2019-11-06T18:06:08Z")
I have ELK 7.4.2 and all services running, but winlogbeat cannot send logs to Logstash, it seems that port (5044) is not listening. Do you know how I can solve this? Already released in Firewall, check the configuratio… --- ## [How to match multiple fields to single value with IF](https://discuss.elastic.co/t/how-to-match-multiple-fields-to-single-value-with-if/206844)
**Author:** [@Andrew22](https://discuss.elastic.co/u/Andrew22)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 5:49pm UTC](https://discuss.elastic.co/t/how-to-match-multiple-fields-to-single-value-with-if/206844 "2019-11-06T17:49:58Z")
I am trying to match multiple fields to a single value then mutate the field if necessary in a single if statement instead of having multiple different If statements For example: if \[1\] or \[2\] or \[3\] = null { mutate … --- ## [Filtering By Field Inequality](https://discuss.elastic.co/t/filtering-by-field-inequality/206481)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 4\ **Last updated:** [November 6, 2019, 5:15pm UTC](https://discuss.elastic.co/t/filtering-by-field-inequality/206481 "2019-11-06T17:15:56Z")
I have two fields with the same value, 99% of the time. I'd like to filter down to just the entries where the two fields are NOT the same, is it possible to do something like \[field1\] != \[field2\]? --- ## [Invalid index name \[\_watcher\], must not start with '\_', '-', or '+'"](https://discuss.elastic.co/t/invalid-index-name-watcher-must-not-start-with-or/203930)
**Author:** [@mv007](https://discuss.elastic.co/u/mv007)\ **Replies:** 4\ **Last updated:** [November 6, 2019, 4:54pm UTC](https://discuss.elastic.co/t/invalid-index-name-watcher-must-not-start-with-or/203930 "2019-11-06T16:54:11Z")
Hello All, I am a newbie in ELK and still learning it. I am planning to setup a watcher functionality. Below is the watcher definition that i have written, I have just followed the online document. However, I am not… --- ## [Custom plugin offline installation](https://discuss.elastic.co/t/custom-plugin-offline-installation/206840)
**Author:** [@ildefonso.gonzalez](https://discuss.elastic.co/u/ildefonso.gonzalez)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 4:52pm UTC](https://discuss.elastic.co/t/custom-plugin-offline-installation/206840 "2019-11-06T16:52:30Z")
Dear, After develop and install a custom plugin of logstash using version 7.3.0 (Java), we found the follow error on stratup server time when we invoke the method class on conf file: \[ERROR\] 2019-11-06 17:37:22.408 \[… --- ## [Terms lookup in a filtered alias](https://discuss.elastic.co/t/terms-lookup-in-a-filtered-alias/206838)
**Author:** [@jmccaskill](https://discuss.elastic.co/u/jmccaskill)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 4:46pm UTC](https://discuss.elastic.co/t/terms-lookup-in-a-filtered-alias/206838 "2019-11-06T16:46:51Z")
Hello, is a terms lookup query in a filtered alias supposed to be supported? In 6.7.1 and 7.4.2 I am able to execute a terms lookup query directly against an index, but if I try to define a filtered alias on that index … --- ## [Logstash: import tables depending on colum name value](https://discuss.elastic.co/t/logstash-import-tables-depending-on-colum-name-value/206826)
**Author:** [@Asma\_Sassi](https://discuss.elastic.co/u/Asma_Sassi)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 3:48pm UTC](https://discuss.elastic.co/t/logstash-import-tables-depending-on-colum-name-value/206826 "2019-11-06T15:48:45Z")
I'm actually working on migrating mysql data to elasticsearch and had successfully imported tables to ES. And now I have another task which is more complicated, I have table A structure and its data like schema below: … --- ## [Change the type of an index field during ingestion](https://discuss.elastic.co/t/change-the-type-of-an-index-field-during-ingestion/206831)
**Author:** [@kailash](https://discuss.elastic.co/u/kailash)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 4:10pm UTC](https://discuss.elastic.co/t/change-the-type-of-an-index-field-during-ingestion/206831 "2019-11-06T16:10:29Z")
I am using Fix Protocol plugin (open source by Connamara). One field NoMDEntries is created as Structure/Object. However, we want it to be of type nested. Changing it using PUT results in error reason": "object mapping \[… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1795) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1797)