# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1814 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1815 --- ## [Windows DNS parsing](https://discuss.elastic.co/t/windows-dns-parsing/205437)
**Author:** [@Jan\_Kaspar](https://discuss.elastic.co/u/Jan_Kaspar)\ **Replies:** 2\ **Last updated:** [October 28, 2019, 1:06pm UTC](https://discuss.elastic.co/t/windows-dns-parsing/205437 "2019-10-28T13:06:16Z")
Hi All, I would like to ask you for help. I am trying to parse Microsoft DNS debug logs but I stucked. My testing environment is running on ELK version 7.2. Beats are also running on 7.2 version. Problem is I am getti… --- ## [Searching multiple fields, types, and indexes within php](https://discuss.elastic.co/t/searching-multiple-fields-types-and-indexes-within-php/204935)
**Author:** [@prawsthorne](https://discuss.elastic.co/u/prawsthorne)\ **Replies:** 1\ **Last updated:** [October 28, 2019, 12:41pm UTC](https://discuss.elastic.co/t/searching-multiple-fields-types-and-indexes-within-php/204935 "2019-10-28T12:41:52Z")
I wanting to query one term across multiple indexes, types, and fields. I've been reading and experimenting with no working solution... yet. It's time to ask. It works until I un-comment the second match clause. Thinki… --- ## [Java-rest-high-search-template typed\_keys field](https://discuss.elastic.co/t/java-rest-high-search-template-typed-keys-field/205461)
**Author:** [@wojciechss](https://discuss.elastic.co/u/wojciechss)\ **Replies:** 0\ **Last updated:** [October 28, 2019, 12:39pm UTC](https://discuss.elastic.co/t/java-rest-high-search-template-typed-keys-field/205461 "2019-10-28T12:39:19Z")
Hi, is there any possibility to set typed\_keys param in SearchTemplateRequest class? In api specification: https://www.elastic.co/guide/en/elasticsearch/reference/master/search-template.html#search-template-api-query-… --- ## [Split header param and convert the value to a number](https://discuss.elastic.co/t/split-header-param-and-convert-the-value-to-a-number/205421)
**Author:** [@anuradhamudalige](https://discuss.elastic.co/u/anuradhamudalige)\ **Replies:** 1\ **Last updated:** [October 28, 2019, 12:30pm UTC](https://discuss.elastic.co/t/split-header-param-and-convert-the-value-to-a-number/205421 "2019-10-28T12:30:35Z")
grok { match =\> { "message" =\> "^%{TIMESTAMP\_ISO8601:timestamp} %{LOGLEVEL:loglevel}%{SPACE}%{NOTSPACE:class}%{SPACE}(%{DATA:thread})%{SPACE}%{DATA:linenumber}%{DATA:txnid}%{NUMBER:eventID}%{DATA:eventName}%{DATA:compo… --- ## [ILM query optimization](https://discuss.elastic.co/t/ilm-query-optimization/205458)
**Author:** [@coudenysj](https://discuss.elastic.co/u/coudenysj)\ **Replies:** 0\ **Last updated:** [October 28, 2019, 12:23pm UTC](https://discuss.elastic.co/t/ilm-query-optimization/205458 "2019-10-28T12:23:45Z")
Hi, We're using ILM to enable a hot/warm/cold architecture. We ingest quite a lot of data, and try to keep them for 90 days. Ingest is running smoothly, but I'm trying to speed up the querying. When I run a time based… --- ## [Upper case and lower case string giving different results for filter](https://discuss.elastic.co/t/upper-case-and-lower-case-string-giving-different-results-for-filter/205260)
**Author:** [@decodeit](https://discuss.elastic.co/u/decodeit)\ **Replies:** 2\ **Last updated:** [October 28, 2019, 11:58am UTC](https://discuss.elastic.co/t/upper-case-and-lower-case-string-giving-different-results-for-filter/205260 "2019-10-28T11:58:32Z")
So I have this query, { "query": { "bool": { "must": \[ { "match": { "title": "communication"}} \], "filter": \[ { "term": { "survey": "general" }} \] } } } Now, i… --- ## [Run pipeline based on condition in another pipeline](https://discuss.elastic.co/t/run-pipeline-based-on-condition-in-another-pipeline/204025)
**Author:** [@ansamHox](https://discuss.elastic.co/u/ansamHox)\ **Replies:** 3\ **Last updated:** [October 28, 2019, 12:11pm UTC](https://discuss.elastic.co/t/run-pipeline-based-on-condition-in-another-pipeline/204025 "2019-10-28T12:11:49Z")
Need to import new data from Oracle (as soon as they start batch processing) couple of times a day. E.g., my dba team are doing some batch processes 5 times a day (random time period and number of rows (up to 1 million)… --- ## [Cause of use\_field\_mapping warning?](https://discuss.elastic.co/t/cause-of-use-field-mapping-warning/204828)
**Author:** [@tomhe](https://discuss.elastic.co/u/tomhe)\ **Replies:** 2\ **Last updated:** [October 28, 2019, 11:49am UTC](https://discuss.elastic.co/t/cause-of-use-field-mapping-warning/204828 "2019-10-28T11:49:19Z")
Regarding the question about use\_field\_mapping warnings in the linked post above: "\[use\_field\_mapping\] is a special format that was only used to ease the transition to 7.x. It has become the default and shouldn't be s… --- ## [How to change app/kibana in kibana 6.8 URL to different name like app/devCustom](https://discuss.elastic.co/t/how-to-change-app-kibana-in-kibana-6-8-url-to-different-name-like-app-devcustom/200870)
**Author:** [@devesh37](https://discuss.elastic.co/u/devesh37)\ **Replies:** 5\ **Last updated:** [October 28, 2019, 11:21am UTC](https://discuss.elastic.co/t/how-to-change-app-kibana-in-kibana-6-8-url-to-different-name-like-app-devcustom/200870 "2019-10-28T11:21:50Z")
I want to change the name of app/kibana in kibana app. I have tried to cahnge the title and id in kibana plugin of src/legacy/core\_plugin/kibana folder. but nothing got changed. Please help me with steps or idea of ch… --- ## [Total function doesn't work in kibana](https://discuss.elastic.co/t/total-function-doesnt-work-in-kibana/205339)
**Author:** [@Mohammad\_Mousavi](https://discuss.elastic.co/u/Mohammad_Mousavi)\ **Replies:** 1\ **Last updated:** [October 28, 2019, 11:02am UTC](https://discuss.elastic.co/t/total-function-doesnt-work-in-kibana/205339 "2019-10-28T11:02:30Z")
Hi, I have a table like this. I wanna have avg of streamed time of all clients, so I add another row with "Group other values in seperate bucket" I checked the avg but it doesn't create another column, What I'm doing … --- ## [\[metrics:max\_buckets\] vs \[search.max\_buckets\]](https://discuss.elastic.co/t/metrics-max-buckets-vs-search-max-buckets/202489)
**Author:** [@peropero](https://discuss.elastic.co/u/peropero)\ **Replies:** 1\ **Last updated:** [October 28, 2019, 10:40am UTC](https://discuss.elastic.co/t/metrics-max-buckets-vs-search-max-buckets/202489 "2019-10-28T10:40:37Z")
● Question Is the upper limit for \[metrics: max\_buckets\] 1000? What is the difference between \[metrics: max\_buckets\] and \[search.max\_buckets\]? ● Background I am using kibana 7.2.0. The following error was displayed. … --- ## [NEST syntax for Multi Search queries](https://discuss.elastic.co/t/nest-syntax-for-multi-search-queries/205312)
**Author:** [@han1](https://discuss.elastic.co/u/han1)\ **Replies:** 4\ **Last updated:** [October 28, 2019, 10:29am UTC](https://discuss.elastic.co/t/nest-syntax-for-multi-search-queries/205312 "2019-10-28T10:29:57Z")
Can anyone assist us with the syntax of how a Multi Search Query is created in NEST 7. (This is getting a pain having to ask for NEST syntax everytime!) Many thanks --- ## [Centralized Logging using ELK and Filebeat](https://discuss.elastic.co/t/centralized-logging-using-elk-and-filebeat/205436)
**Author:** [@Ismail\_Zam\_Zam](https://discuss.elastic.co/u/Ismail_Zam_Zam)\ **Replies:** 0\ **Last updated:** [October 28, 2019, 9:41am UTC](https://discuss.elastic.co/t/centralized-logging-using-elk-and-filebeat/205436 "2019-10-28T09:41:19Z")
Hi, I'm making centralized server-client logging on GCP vm-instances. I followed the below link: its seem that the logs are not transferring from the filebeat, which is installed on the client machine. The server lo… --- ## [Formatting fields... html, markdown](https://discuss.elastic.co/t/formatting-fields-html-markdown/204514)
**Author:** [@elvarb](https://discuss.elastic.co/u/elvarb)\ **Replies:** 3\ **Last updated:** [October 28, 2019, 9:32am UTC](https://discuss.elastic.co/t/formatting-fields-html-markdown/204514 "2019-10-28T09:32:08Z")
I have data in Elasticsearch where some fields are currently formatted as HTML. It contains simple things like P, A, B and I tags. These are fields that are never aggregated on but are sometimes displayed. Is there so… --- ## [HTTP filter - failover host](https://discuss.elastic.co/t/http-filter-failover-host/205433)
**Author:** [@MMH](https://discuss.elastic.co/u/MMH)\ **Replies:** 0\ **Last updated:** [October 28, 2019, 9:18am UTC](https://discuss.elastic.co/t/http-filter-failover-host/205433 "2019-10-28T09:18:27Z")
In my Logstash pipeline, I am using HTTP filter. The desired solution should be robust to HTTP host failure and if HTTP request fail try to send this request to another host (can be listed in code or as a parameter). I… --- ## [Logstash Issue sending data to elasticseach cluster](https://discuss.elastic.co/t/logstash-issue-sending-data-to-elasticseach-cluster/205205)
**Author:** [@pdkgamage](https://discuss.elastic.co/u/pdkgamage)\ **Replies:** 2\ **Last updated:** [October 28, 2019, 8:29am UTC](https://discuss.elastic.co/t/logstash-issue-sending-data-to-elasticseach-cluster/205205 "2019-10-28T08:29:20Z")
I have upgraded ELK stack into 7.4 version ( filebeat, logstash, elasticalert, kibana). I am using elasticsearch cloud. Once after the upgrade, following error shows in logstash log file. but few of records can see in k… --- ## [Kibana User/Client specific Dashboard](https://discuss.elastic.co/t/kibana-user-client-specific-dashboard/205357)
**Author:** [@wizard](https://discuss.elastic.co/u/wizard)\ **Replies:** 3\ **Last updated:** [October 28, 2019, 8:15am UTC](https://discuss.elastic.co/t/kibana-user-client-specific-dashboard/205357 "2019-10-28T08:15:51Z")
How can I create an user specific dashboard, I have created 2 different dashboard and users: Dashboard:- "Dashboard no.1" & Dashboard no.2 User:- "User A" & "User B" "user A" can see dashboard no.1 but not no.2 and "… --- ## [How calculate trend in data table visualization](https://discuss.elastic.co/t/how-calculate-trend-in-data-table-visualization/203007)
**Author:** [@Oleg\_Lowen](https://discuss.elastic.co/u/Oleg_Lowen)\ **Replies:** 2\ **Last updated:** [October 28, 2019, 8:15am UTC](https://discuss.elastic.co/t/how-calculate-trend-in-data-table-visualization/203007 "2019-10-28T08:15:27Z")
Hello, I'm executing thousands of tests on hourly basis in a CICD pipeline. Each Elasticsearch document is describing a test with fields (name, success, duration, etc). I'm trying to figure out, how to calculate a tren… --- ## [Grok filter when logs format is not fixed](https://discuss.elastic.co/t/grok-filter-when-logs-format-is-not-fixed/205408)
**Author:** [@varunjithtk](https://discuss.elastic.co/u/varunjithtk)\ **Replies:** 1\ **Last updated:** [October 28, 2019, 7:57am UTC](https://discuss.elastic.co/t/grok-filter-when-logs-format-is-not-fixed/205408 "2019-10-28T07:57:44Z")
Am trying to parse the rest api request and response in my node logs. Below are two example logs {"level":"debug","message":"HTTP GET /1stexample/alerts/subs?userId=111","meta":{"res":{"statusCode":200},"req":{"headers"… --- ## [Create percentage graph from a string](https://discuss.elastic.co/t/create-percentage-graph-from-a-string/205252)
**Author:** [@David\_Crespillo](https://discuss.elastic.co/u/David_Crespillo)\ **Replies:** 2\ **Last updated:** [October 28, 2019, 7:45am UTC](https://discuss.elastic.co/t/create-percentage-graph-from-a-string/205252 "2019-10-28T07:45:37Z")
Hi, I need to create a graph with porcentage from a search fields; these fields are string. I mean, I have a "Total Data" field and I make a search from "Total Data" that show me wich of these are "NOK". I need new gra… --- ## [Disabling fielddata on the cluster/index level](https://discuss.elastic.co/t/disabling-fielddata-on-the-cluster-index-level/205411)
**Author:** [@doron](https://discuss.elastic.co/u/doron)\ **Replies:** 1\ **Last updated:** [October 28, 2019, 7:38am UTC](https://discuss.elastic.co/t/disabling-fielddata-on-the-cluster-index-level/205411 "2019-10-28T07:38:53Z")
I've suddenly noticed that fielddata cache for the \_id field is taking 14GB of RAM on my cluster, and I'm not sure where that came from (probably some query I'm not aware of). I've cleared it manually, but I'm worried it… --- ## [Kibana shows watcher config error if you dont enter an index](https://discuss.elastic.co/t/kibana-shows-watcher-config-error-if-you-dont-enter-an-index/205038)
**Author:** [@Messias\_2](https://discuss.elastic.co/u/Messias_2)\ **Replies:** 4\ **Last updated:** [October 28, 2019, 6:41am UTC](https://discuss.elastic.co/t/kibana-shows-watcher-config-error-if-you-dont-enter-an-index/205038 "2019-10-28T06:41:13Z")
Hi, I get an config error in kibana when I edit a watcher config where no index is entered , even if you use \_doc fields in transform / payload. kibana error: " Please address the errors in your form. Index name is … --- ## [Enrich Win event logs with LDAP](https://discuss.elastic.co/t/enrich-win-event-logs-with-ldap/205409)
**Author:** [@AlexH](https://discuss.elastic.co/u/AlexH)\ **Replies:** 0\ **Last updated:** [October 28, 2019, 6:32am UTC](https://discuss.elastic.co/t/enrich-win-event-logs-with-ldap/205409 "2019-10-28T06:32:02Z")
I would like to enrich win event logs with LDAP info - user group, user OU, user start date, etc. What is the best way to accomplish this, given a domain and username? --- ## [Map timestamp using first time value in incoming JSON Lines?](https://discuss.elastic.co/t/map-timestamp-using-first-time-value-in-incoming-json-lines/204748)
**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\ **Replies:** 4\ **Last updated:** [October 28, 2019, 6:20am UTC](https://discuss.elastic.co/t/map-timestamp-using-first-time-value-in-incoming-json-lines/204748 "2019-10-28T06:20:54Z")
I am using Logstash 7.4 to ingest JSON Lines. In this particular JSON Lines data, which is from a proprietary source, the event timestamp is the first time value in each incoming line. By first, I am referring to the s… --- ## [Maximum number of data disk exceeded](https://discuss.elastic.co/t/maximum-number-of-data-disk-exceeded/204883)
**Author:** [@Alwandy](https://discuss.elastic.co/u/Alwandy)\ **Replies:** 1\ **Last updated:** [October 28, 2019, 6:15am UTC](https://discuss.elastic.co/t/maximum-number-of-data-disk-exceeded/204883 "2019-10-28T06:15:57Z")
Hey guys, For my initial creation of K8s, I have already assigned 4 data disks (this is our QA env) during the creation process. When running the template to create the master node to act as ingress and data. I hit on … --- ## [Logstash TCP json\_lines to elasticsearch won't stop printing output to stdout](https://discuss.elastic.co/t/logstash-tcp-json-lines-to-elasticsearch-wont-stop-printing-output-to-stdout/205407)
**Author:** [@Blake\_Loring](https://discuss.elastic.co/u/Blake_Loring)\ **Replies:** 0\ **Last updated:** [October 28, 2019, 5:59am UTC](https://discuss.elastic.co/t/logstash-tcp-json-lines-to-elasticsearch-wont-stop-printing-output-to-stdout/205407 "2019-10-28T05:59:28Z")
Hello, I am using the logstash docker image and a pipeline from tcp to elastic search. Whenever a message is processed by logstash it is also output to stdout, even though I have logging turned to warn or above. There a… --- ## [Automating ES installation with ECK via Helm](https://discuss.elastic.co/t/automating-es-installation-with-eck-via-helm/205335)
**Author:** [@Aravind](https://discuss.elastic.co/u/Aravind)\ **Replies:** 1\ **Last updated:** [October 28, 2019, 5:51am UTC](https://discuss.elastic.co/t/automating-es-installation-with-eck-via-helm/205335 "2019-10-28T05:51:55Z")
I would like to automate the installation of Elasticsearch via ECK on a cloud provider via helm. I don't want to prematurely go and install the custom kubernetes resource of kind: Elasticsearch before the operator is fu… --- ## [Change index name and policy name to use](https://discuss.elastic.co/t/change-index-name-and-policy-name-to-use/205406)
**Author:** [@elasticnubie](https://discuss.elastic.co/u/elasticnubie)\ **Replies:** 0\ **Last updated:** [October 28, 2019, 5:47am UTC](https://discuss.elastic.co/t/change-index-name-and-policy-name-to-use/205406 "2019-10-28T05:47:57Z")
I wanna change the index name and the lifecycle policy name to use of packetbeat to my own. index name: packetbeat-7.4.1-2019.10.28 to dns-2019.10.28 ILM Policy: packetbeat-7.4.1 to ilm-dns (I created) I first creat… --- ## [Installing ES with Custom image from private repository fails](https://discuss.elastic.co/t/installing-es-with-custom-image-from-private-repository-fails/205331)
**Author:** [@Aravind](https://discuss.elastic.co/u/Aravind)\ **Replies:** 3\ **Last updated:** [October 28, 2019, 5:44am UTC](https://discuss.elastic.co/t/installing-es-with-custom-image-from-private-repository-fails/205331 "2019-10-28T05:44:46Z")
Here is my file - apiVersion: elasticsearch.k8s.elastic.co/v1alpha1 kind: Elasticsearch metadata: name: jaeger-elasticsearch namespace: test spec: image: phx.ocir.io/\<\>/elasticsearch/elasticsearch:7.3.2 version:… --- ## [Change version and custom images in ECK](https://discuss.elastic.co/t/change-version-and-custom-images-in-eck/205306)
**Author:** [@LoadingZhang](https://discuss.elastic.co/u/LoadingZhang)\ **Replies:** 1\ **Last updated:** [October 28, 2019, 5:41am UTC](https://discuss.elastic.co/t/change-version-and-custom-images-in-eck/205306 "2019-10-28T05:41:32Z")
Now I set configuration as below: spec: version: 7.4.0 image: my\_custom\_image:7.4.0 What would happen if I change version to 7.4.1 but image not? And what would happen if change image tag to 7.4.1 but version not? … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1813) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1815)