# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1803 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1804 --- ## [ES HA and Load Balancing](https://discuss.elastic.co/t/es-ha-and-load-balancing/206294)
**Author:** [@SirJune](https://discuss.elastic.co/u/SirJune)\ **Replies:** 0\ **Last updated:** [November 3, 2019, 3:07pm UTC](https://discuss.elastic.co/t/es-ha-and-load-balancing/206294 "2019-11-03T15:07:55Z")
Hi, Here's my setup: 2 - coordinating nodes (esnode1,esnode2) 3 - master/data node (esnode3,esnode4,esnode5) 1 - data node (esnode6) should i configure logstash to hosts=\> esnode1, esnode2 only ? or should i s… --- ## [Question about the refresh parameter](https://discuss.elastic.co/t/question-about-the-refresh-parameter/206287)
**Author:** [@111231](https://discuss.elastic.co/u/111231)\ **Replies:** 2\ **Last updated:** [November 3, 2019, 3:02pm UTC](https://discuss.elastic.co/t/question-about-the-refresh-parameter/206287 "2019-11-03T15:02:04Z")
If I make 2 requests to es in sequence, which is firing the second request after the first request is returned. My question is that If I set the refresh parameter of the second request to TRUE. would the change of the f… --- ## [Query on Grok & Mutate plugins with Logstash](https://discuss.elastic.co/t/query-on-grok-mutate-plugins-with-logstash/206293)
**Author:** [@angryninja](https://discuss.elastic.co/u/angryninja)\ **Replies:** 0\ **Last updated:** [November 3, 2019, 2:43pm UTC](https://discuss.elastic.co/t/query-on-grok-mutate-plugins-with-logstash/206293 "2019-11-03T14:43:55Z")
Hello, I am trying to match a pattern ES document which is being ingested via Logstash. Pattern is duration defined in hours like PT(Hours)H. I am using following as part of the logstash conf but I don't see any field… --- ## [Parsing problem - one or more space](https://discuss.elastic.co/t/parsing-problem-one-or-more-space/206285)
**Author:** [@Jan\_Kaspar](https://discuss.elastic.co/u/Jan_Kaspar)\ **Replies:** 1\ **Last updated:** [November 3, 2019, 2:18pm UTC](https://discuss.elastic.co/t/parsing-problem-one-or-more-space/206285 "2019-11-03T14:18:25Z")
Hi All, I would have a question about parsing the logs from DNS server logs. Sample of DNS logs: message: 3. 11. 2019 12:33:14 0958 PACKET 000000C97B8371C0 UDP Snd 192.168.5.202 4cbf Q \[0000 NOERROR\] SOA … --- ## [Monitoring templates](https://discuss.elastic.co/t/monitoring-templates/206290)
**Author:** [@amitavmohanty01](https://discuss.elastic.co/u/amitavmohanty01)\ **Replies:** 0\ **Last updated:** [November 3, 2019, 1:51pm UTC](https://discuss.elastic.co/t/monitoring-templates/206290 "2019-11-03T13:51:37Z")
I have Logstash running version 7.4.0. It is connecting to an Elasticsearch cluster running 7.4.0. I am not sure why the following issue is showing up. \[2019-11-03T05:34:11,762\]\[WARN \]\[logstash.outputs.elasticsearch\] Yo… --- ## [How to improve the speed of Logstash output to Elasticsearch?](https://discuss.elastic.co/t/how-to-improve-the-speed-of-logstash-output-to-elasticsearch/206254)
**Author:** [@StruggleYang](https://discuss.elastic.co/u/StruggleYang)\ **Replies:** 7\ **Last updated:** [November 3, 2019, 10:10am UTC](https://discuss.elastic.co/t/how-to-improve-the-speed-of-logstash-output-to-elasticsearch/206254 "2019-11-03T10:10:46Z")
I have a lot of application logs to collect, and data conversion is like, filebeat =\> kafka =\> logstash =\> elasticsearch ,Everything is smooth, But sometimes the application log will suddenly increase, such as when the u… --- ## [Logs from hp-ux - logstash or 3rd party solution?](https://discuss.elastic.co/t/logs-from-hp-ux-logstash-or-3rd-party-solution/206279)
**Author:** [@Abderaouf\_Omari](https://discuss.elastic.co/u/Abderaouf_Omari)\ **Replies:** 0\ **Last updated:** [November 3, 2019, 10:10am UTC](https://discuss.elastic.co/t/logs-from-hp-ux-logstash-or-3rd-party-solution/206279 "2019-11-03T10:10:01Z")
Hi all, i hope that one of you could help me, my need is to centralize logs, so iam using elasticsearch and kibana ( 7.3.1 version ). and from clients side iam using filebeat to transfer the logs directly to Elasticsear… --- ## [Elasticsearch aggregation performance on long vs float/scaled\_float/double](https://discuss.elastic.co/t/elasticsearch-aggregation-performance-on-long-vs-float-scaled-float-double/206262)
**Author:** [@kevin\_Art](https://discuss.elastic.co/u/kevin_Art)\ **Replies:** 0\ **Last updated:** [November 3, 2019, 1:16am UTC](https://discuss.elastic.co/t/elasticsearch-aggregation-performance-on-long-vs-float-scaled-float-double/206262 "2019-11-03T01:16:58Z")
i'm just wondering if there's someone here who have tried to check if there's a performance difference between using long and float/scaled\_float in elasticsearch specially when using sum aggregation? for the long, the n… --- ## [Kibana HTTPS with Search Guard](https://discuss.elastic.co/t/kibana-https-with-search-guard/205301)
**Author:** [@revglen](https://discuss.elastic.co/u/revglen)\ **Replies:** 2\ **Last updated:** [November 2, 2019, 8:27pm UTC](https://discuss.elastic.co/t/kibana-https-with-search-guard/205301 "2019-11-02T20:27:14Z")
Hello Guys, I installed ElasticSearch and Search Guard which was successful. I am able to access ES using HTTPS ( https://localhost:9200). I have integrated Kibana with Search Guard however there are no settings for Kib… --- ## [Getting Doc Counts using a Rollup query](https://discuss.elastic.co/t/getting-doc-counts-using-a-rollup-query/206110)
**Author:** [@rvshchwl](https://discuss.elastic.co/u/rvshchwl)\ **Replies:** 1\ **Last updated:** [November 2, 2019, 6:53pm UTC](https://discuss.elastic.co/t/getting-doc-counts-using-a-rollup-query/206110 "2019-11-02T18:53:29Z")
I am currently using an Aggregation query to get Document Counts from a Date Histogram of 1 Minute samples. This is my current query: scroll\_query = { "query" : { "range": { "Timestamp": { "gte": "now-30d/d", … --- ## [ES cluster is down: indexing is not supported on a read-only engine](https://discuss.elastic.co/t/es-cluster-is-down-indexing-is-not-supported-on-a-read-only-engine/206229)
**Author:** [@MosheMallal](https://discuss.elastic.co/u/MosheMallal)\ **Replies:** 4\ **Last updated:** [November 2, 2019, 4:05pm UTC](https://discuss.elastic.co/t/es-cluster-is-down-indexing-is-not-supported-on-a-read-only-engine/206229 "2019-11-02T16:05:14Z")
Hi all, we have very sever issue for the past 24H. our ES is down no data is received from logstash into ES. Logstash logs shows unsupported\_operation\_exception: indexing is not supported on a read-only engine. There … --- ## [Output](https://discuss.elastic.co/t/output/206253)
**Author:** [@Jan\_Kaspar](https://discuss.elastic.co/u/Jan_Kaspar)\ **Replies:** 0\ **Last updated:** [November 2, 2019, 6:02pm UTC](https://discuss.elastic.co/t/output/206253 "2019-11-02T18:02:40Z")
Hi, I have a question to Output plugin. Curently I am using filebat to parse mulitple rsyslog files. Rsyslog files are divided by device. every device logs in to separate directory. What is necesary to split index fi… --- ## [Is it possible to use OSS docker images (without xpack)?](https://discuss.elastic.co/t/is-it-possible-to-use-oss-docker-images-without-xpack/184410)
**Author:** [@ismailbaskin](https://discuss.elastic.co/u/ismailbaskin)\ **Replies:** 3\ **Last updated:** [November 2, 2019, 5:37pm UTC](https://discuss.elastic.co/t/is-it-possible-to-use-oss-docker-images-without-xpack/184410 "2019-11-02T17:37:39Z")
Hi, I'm not sure but it seems ECK operator is strictly depends on xpack features. Is there any way to use it open source version of ElasticSearch with ECK operator? --- ## [Where is rest of the memory?](https://discuss.elastic.co/t/where-is-rest-of-the-memory/205537)
**Author:** [@amitavmohanty01](https://discuss.elastic.co/u/amitavmohanty01)\ **Replies:** 0\ **Last updated:** [October 28, 2019, 6:52pm UTC](https://discuss.elastic.co/t/where-is-rest-of-the-memory/205537 "2019-10-28T18:52:58Z")
I am trying to install Logstash 7.4.0 from the RPM. I have a 6.8.3 RPM already installed and the process is running. I am getting the following error: Downloading packages: Delta RPMs disabled because /usr/bin/applydelt… --- ## [Is there a way to count nested documents in in a doc](https://discuss.elastic.co/t/is-there-a-way-to-count-nested-documents-in-in-a-doc/206236)
**Author:** [@RITZ\_VERMA](https://discuss.elastic.co/u/RITZ_VERMA)\ **Replies:** 0\ **Last updated:** [November 2, 2019, 1:14pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-count-nested-documents-in-in-a-doc/206236 "2019-11-02T13:14:07Z")
I have a document which contains nested documents.i want to get the count of nested documents associated with a field. --- ## [S3 input \[ERROR\]\[logstash.pipeline \] A plugin had an unrecoverable error. Will restart this plugin](https://discuss.elastic.co/t/s3-input-error-logstash-pipeline-a-plugin-had-an-unrecoverable-error-will-restart-this-plugin/206234)
**Author:** [@prabhakar\_talari](https://discuss.elastic.co/u/prabhakar_talari)\ **Replies:** 0\ **Last updated:** [November 2, 2019, 10:33am UTC](https://discuss.elastic.co/t/s3-input-error-logstash-pipeline-a-plugin-had-an-unrecoverable-error-will-restart-this-plugin/206234 "2019-11-02T10:33:36Z")
All, we are getting below frequent errors in logstash log file Error: couldn't parse document: Premature end of file. Exception: RuntimeError Stack: nokogiri/XmlSaxParserContext.java:258:in parse\_with' /usr/share/log… --- ## [I take index.lifecycle.name bat had a error](https://discuss.elastic.co/t/i-take-index-lifecycle-name-bat-had-a-error/206231)
**Author:** [@Jacky\_zm](https://discuss.elastic.co/u/Jacky_zm)\ **Replies:** 1\ **Last updated:** [November 2, 2019, 8:09am UTC](https://discuss.elastic.co/t/i-take-index-lifecycle-name-bat-had-a-error/206231 "2019-11-02T08:09:16Z")
{ "index": { "lifecycle": { "index.lifecycle.name": "debug-fluentd", "index.lifecycle.rollover\_alias": "debug\_fluentd\_rollover\_alias" } } had a error \[illegal\_argument\_exception\] unknown setting \[index.lifecycle.… --- ## [Missing doc in kibana](https://discuss.elastic.co/t/missing-doc-in-kibana/206147)
**Author:** [@Gordon\_Ooi](https://discuss.elastic.co/u/Gordon_Ooi)\ **Replies:** 2\ **Last updated:** [November 2, 2019, 3:55am UTC](https://discuss.elastic.co/t/missing-doc-in-kibana/206147 "2019-11-02T03:55:42Z")
Hi, I've observed my kibana having some of the doc missing as compared to the elasticsearch query. I did a query on the \_id in elasticsearch and return 1 hits But I did the same query in Kibana Discover, it did not … --- ## [Unable to create index patterns in kibana](https://discuss.elastic.co/t/unable-to-create-index-patterns-in-kibana/206180)
**Author:** [@RiyazM](https://discuss.elastic.co/u/RiyazM)\ **Replies:** 2\ **Last updated:** [November 2, 2019, 2:16am UTC](https://discuss.elastic.co/t/unable-to-create-index-patterns-in-kibana/206180 "2019-11-02T02:16:24Z")
hello , we have installed EFK stack in kubernetes using the helm chart efk-stack.But there is a issue that sometimes its not possible to create a index pattern in kibana. Even if it succeeds the Index pattern gets dele… --- ## [Indices Keep Returning](https://discuss.elastic.co/t/indices-keep-returning/206157)
**Author:** [@StrifeX](https://discuss.elastic.co/u/StrifeX)\ **Replies:** 10\ **Last updated:** [November 2, 2019, 12:06am UTC](https://discuss.elastic.co/t/indices-keep-returning/206157 "2019-11-02T00:06:43Z")
Hello. I'm extremely new to managing an elastic stack, so it is not something I am familiar with. The implementation we have right now is encountering issues, and after trouble shooting for some time I believe it is due … --- ## [Shard allocation for master nodes during rolling upgrades](https://discuss.elastic.co/t/shard-allocation-for-master-nodes-during-rolling-upgrades/206188)
**Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Replies:** 4\ **Last updated:** [November 1, 2019, 9:24pm UTC](https://discuss.elastic.co/t/shard-allocation-for-master-nodes-during-rolling-upgrades/206188 "2019-11-01T21:24:52Z")
I'm aware that shard allocation needs to be disabled and then re-enabled back during rolling upgrades. My question is: Does this need to be done for master nodes? I reckon this is only needed for data nodes and NOT nee… --- ## [Configuring Logstash for Elasticsearch Services in the Cloud](https://discuss.elastic.co/t/configuring-logstash-for-elasticsearch-services-in-the-cloud/206215)
**Author:** [@sarahvo](https://discuss.elastic.co/u/sarahvo)\ **Replies:** 0\ **Last updated:** [November 1, 2019, 8:43pm UTC](https://discuss.elastic.co/t/configuring-logstash-for-elasticsearch-services-in-the-cloud/206215 "2019-11-01T20:43:03Z")
Hi, I'm using Elasticsearch Services on Azure and I'm trying to configure logstash to point to my elasticsearch instance in the cloud. I was reading the documentation given here: https://www.elastic.co/guide/en/logstash/… --- ## [Autonomous System Number (ASN) not displaying](https://discuss.elastic.co/t/autonomous-system-number-asn-not-displaying/206195)
**Author:** [@Justin\_Doles](https://discuss.elastic.co/u/Justin_Doles)\ **Replies:** 3\ **Last updated:** [November 1, 2019, 7:58pm UTC](https://discuss.elastic.co/t/autonomous-system-number-asn-not-displaying/206195 "2019-11-01T19:58:09Z")
I have an index that I've created that follows the ECS standard. Within the index I have the source.as.\* and destination.as.\* fields that are populated using the GeoLite2ASN database. The fields are being populated in … --- ## [Sorting in Discover not working](https://discuss.elastic.co/t/sorting-in-discover-not-working/204626)
**Author:** [@Ssingh12](https://discuss.elastic.co/u/Ssingh12)\ **Replies:** 12\ **Last updated:** [November 1, 2019, 7:26pm UTC](https://discuss.elastic.co/t/sorting-in-discover-not-working/204626 "2019-11-01T19:26:23Z")
Hi, I am struggling to a seeming humble issue. I am not able to get the sorting by fields work on the 'Discover'. So, in Discover, I 'added' a few fields to view and tried clicking on sort up/down arrows. The sorting i… --- ## [Rollup sum of terms?](https://discuss.elastic.co/t/rollup-sum-of-terms/205265)
**Author:** [@JohanRask](https://discuss.elastic.co/u/JohanRask)\ **Replies:** 1\ **Last updated:** [November 1, 2019, 6:58pm UTC](https://discuss.elastic.co/t/rollup-sum-of-terms/205265 "2019-11-01T18:58:56Z")
Hi, Is it possible to roll up sum of term occurrences, so I can aggregate i.e status\_codes from access logs? I.e, I would like to rollup sum group-by-term "status\_code" over a time period , is this possible? I tried i… --- ## [How to Limit Elasticsearch Log Space](https://discuss.elastic.co/t/how-to-limit-elasticsearch-log-space/206208)
**Author:** [@martinetwork](https://discuss.elastic.co/u/martinetwork)\ **Replies:** 0\ **Last updated:** [November 1, 2019, 6:42pm UTC](https://discuss.elastic.co/t/how-to-limit-elasticsearch-log-space/206208 "2019-11-01T18:42:01Z")
I would like to know how to limit the amount of space elasticsearch logs can take up on my Graylog server. Twice now an overload of elasticsearch logs has used up all the space and caused Graylog to stop working. I fixed… --- ## [Fresh install of 7.4 Kibana - Kibana does not start listening on expected interface](https://discuss.elastic.co/t/fresh-install-of-7-4-kibana-kibana-does-not-start-listening-on-expected-interface/206055)
**Author:** [@David.CIS](https://discuss.elastic.co/u/David.CIS)\ **Replies:** 3\ **Last updated:** [November 1, 2019, 6:40pm UTC](https://discuss.elastic.co/t/fresh-install-of-7-4-kibana-kibana-does-not-start-listening-on-expected-interface/206055 "2019-11-01T18:40:57Z")
Hello, I installed Elasticsearch and Kibana 7.4 on a VM running Ubuntu 18.04. Following the instructions in the guide for that version. After finishing I set this single option in kibana.yml server.host:0.0.0.0 From… --- ## [Kibana filter for subfield value](https://discuss.elastic.co/t/kibana-filter-for-subfield-value/205975)
**Author:** [@mjunaidmuzammil](https://discuss.elastic.co/u/mjunaidmuzammil)\ **Replies:** 1\ **Last updated:** [November 1, 2019, 6:22pm UTC](https://discuss.elastic.co/t/kibana-filter-for-subfield-value/205975 "2019-11-01T18:22:51Z")
HI, We have below mentioned Elasticsearch templates for a number of different string fields. "mapping" : { "doc\_values" : false, "fields" : { "keyword" : { … --- ## [Static mapping concatenating multiple locations if arrays](https://discuss.elastic.co/t/static-mapping-concatenating-multiple-locations-if-arrays/206204)
**Author:** [@dancerjohn](https://discuss.elastic.co/u/dancerjohn)\ **Replies:** 0\ **Last updated:** [November 1, 2019, 6:14pm UTC](https://discuss.elastic.co/t/static-mapping-concatenating-multiple-locations-if-arrays/206204 "2019-11-01T18:14:21Z")
I am having an issue with explicit index mapping with a property / field is pulling data from two locations in the \_source object, but only if both locations are arrays. I have posted the question on stackoverflow (befor… --- ## [How to show multi field value in discover table](https://discuss.elastic.co/t/how-to-show-multi-field-value-in-discover-table/205863)
**Author:** [@prakhara](https://discuss.elastic.co/u/prakhara)\ **Replies:** 2\ **Last updated:** [November 1, 2019, 5:55pm UTC](https://discuss.elastic.co/t/how-to-show-multi-field-value-in-discover-table/205863 "2019-11-01T17:55:35Z")
I have created a field as multi field in elastic mapping, originalfield as text and originalfield.keyword as keyword for aggregation but while showing the data in discover table only I get the value in originalfield and … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1802) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1804)