# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1825 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1826 --- ## [How to get sql\_last\_value from last\_run\_metadata\_path every time](https://discuss.elastic.co/t/how-to-get-sql-last-value-from-last-run-metadata-path-every-time/204582)
**Author:** [@Olivia5](https://discuss.elastic.co/u/Olivia5)\ **Replies:** 2\ **Last updated:** [October 23, 2019, 3:55am UTC](https://discuss.elastic.co/t/how-to-get-sql-last-value-from-last-run-metadata-path-every-time/204582 "2019-10-23T03:55:05Z")
just the pipeline starts up, sql\_last\_value will be reading from the file(last\_run\_metadata\_path). so logstash is running, cant get change value from the file. ( There is a shell timing script that initializes values… --- ## [Date histogram doesn't create buckets for dates later than the last record found, even with 'extended\_bounds' min value of 0. How do I fix this?](https://discuss.elastic.co/t/date-histogram-doesnt-create-buckets-for-dates-later-than-the-last-record-found-even-with-extended-bounds-min-value-of-0-how-do-i-fix-this/204570)
**Author:** [@ShawnCorrigan](https://discuss.elastic.co/u/ShawnCorrigan)\ **Replies:** 3\ **Last updated:** [October 23, 2019, 3:50am UTC](https://discuss.elastic.co/t/date-histogram-doesnt-create-buckets-for-dates-later-than-the-last-record-found-even-with-extended-bounds-min-value-of-0-how-do-i-fix-this/204570 "2019-10-23T03:50:38Z")
I am trying to create a chart with the sum of a value in records I have. The date buckets should be categorized by weeks, and they should include a sum of the 'time' value in each record. To test this I inserted 10 milli… --- ## [Parent circuit breaker calculation seems to be wrong with version 7.x](https://discuss.elastic.co/t/parent-circuit-breaker-calculation-seems-to-be-wrong-with-version-7-x/183530)
**Author:** [@e-orz](https://discuss.elastic.co/u/e-orz)\ **Replies:** 21\ **Last updated:** [October 22, 2019, 7:52pm UTC](https://discuss.elastic.co/t/parent-circuit-breaker-calculation-seems-to-be-wrong-with-version-7-x/183530 "2019-10-22T19:52:31Z")
Hi, After upgrading to ES we started to notice that sometimes search or bulk request fail with: \[parent\] Data too large, data for \[\\] would be \[3070458198/2.8gb\], which is larger than the limit of \[30… --- ## [Is this expected behaviour of split processor in a pipeline?](https://discuss.elastic.co/t/is-this-expected-behaviour-of-split-processor-in-a-pipeline/204754)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 0\ **Last updated:** [October 23, 2019, 4:29am UTC](https://discuss.elastic.co/t/is-this-expected-behaviour-of-split-processor-in-a-pipeline/204754 "2019-10-23T04:29:14Z")
I am on ES 7.2.0 I create a simple pipeline: PUT \_ingest/pipeline/test\_pipeline { "description": "test", "processors": \[ { "split": { "field": "message", "target\_field": "splitdata", … --- ## [Aggregate Query on a Large Number of Documents by filtering out fewer doc counts](https://discuss.elastic.co/t/aggregate-query-on-a-large-number-of-documents-by-filtering-out-fewer-doc-counts/204721)
**Author:** [@rvshchwl](https://discuss.elastic.co/u/rvshchwl)\ **Replies:** 1\ **Last updated:** [October 23, 2019, 3:18am UTC](https://discuss.elastic.co/t/aggregate-query-on-a-large-number-of-documents-by-filtering-out-fewer-doc-counts/204721 "2019-10-23T03:18:28Z")
I am trying to write an Aggregate Query for Elasticsearch, that can be performed on a large volume of data, but also filters out any buckets that have a small doc count. The data I am using is structured as follows (rel… --- ## [Extract year from date field and assign to new field](https://discuss.elastic.co/t/extract-year-from-date-field-and-assign-to-new-field/204691)
**Author:** [@manideep](https://discuss.elastic.co/u/manideep)\ **Replies:** 1\ **Last updated:** [October 23, 2019, 2:23am UTC](https://discuss.elastic.co/t/extract-year-from-date-field-and-assign-to-new-field/204691 "2019-10-23T02:23:19Z")
Hi All, is there a way to extract year from date field and assign to new field? I want to update existing mapping with new field or i can re-index with new new mapping as well. Please suggest. --- ## [Can Oracle Data Integrator (ODI) insert records into Elasticsearch](https://discuss.elastic.co/t/can-oracle-data-integrator-odi-insert-records-into-elasticsearch/204698)
**Author:** [@mmch](https://discuss.elastic.co/u/mmch)\ **Replies:** 1\ **Last updated:** [October 23, 2019, 1:20am UTC](https://discuss.elastic.co/t/can-oracle-data-integrator-odi-insert-records-into-elasticsearch/204698 "2019-10-23T01:20:00Z")
Can Oracle Data Integrator (ODI) insert records into Elasticsearch? I've used logstash, but that's not what I'm trying to do. I basically want to be able to read a delimited file from a directory, and write those recor… --- ## [Performance of keyword vs fielddata](https://discuss.elastic.co/t/performance-of-keyword-vs-fielddata/204742)
**Author:** [@yungnvn](https://discuss.elastic.co/u/yungnvn)\ **Replies:** 1\ **Last updated:** [October 23, 2019, 1:11am UTC](https://discuss.elastic.co/t/performance-of-keyword-vs-fielddata/204742 "2019-10-23T01:11:42Z")
Hi, I had a couple of questions regarding keywords vs fielddata. I understand if fielddata type for "text" fields are enabled, it is much more performance intensive since it has to store it in the JVM memory itself. … --- ## [Fuzzy query with simple query string](https://discuss.elastic.co/t/fuzzy-query-with-simple-query-string/204745)
**Author:** [@georgina](https://discuss.elastic.co/u/georgina)\ **Replies:** 0\ **Last updated:** [October 23, 2019, 1:09am UTC](https://discuss.elastic.co/t/fuzzy-query-with-simple-query-string/204745 "2019-10-23T01:09:08Z")
I'm trying to get fuzzy searching working using simple\_query\_string. An example query: "query":{ "simple\_query\_string": { "query" : "drover", "fields" : \[ "description^1.0", "title^1.0", "content^1.0" \], "flags… --- ## [OpenLdap log parsing pipeline issue](https://discuss.elastic.co/t/openldap-log-parsing-pipeline-issue/204743)
**Author:** [@iukea](https://discuss.elastic.co/u/iukea)\ **Replies:** 0\ **Last updated:** [October 23, 2019, 12:06am UTC](https://discuss.elastic.co/t/openldap-log-parsing-pipeline-issue/204743 "2019-10-23T00:06:51Z")
Hello, I am currently trying to parse some openldap logs and need some help from the ElasticSearch gods. attached is the error message \[2019-10-23T00:03:53,115\]\[ERROR\]\[logstash.javapipeline \] Pipeline aborted due to… --- ## [New SIEM infrastructure with Elasticsearch](https://discuss.elastic.co/t/new-siem-infrastructure-with-elasticsearch/204559)
**Author:** [@elk2](https://discuss.elastic.co/u/elk2)\ **Replies:** 3\ **Last updated:** [October 22, 2019, 11:51pm UTC](https://discuss.elastic.co/t/new-siem-infrastructure-with-elasticsearch/204559 "2019-10-22T23:51:57Z")
I want to implement a new SIEM infrastructure for threat detection and incident response. I would host the systems in our datacenter where all others servers are hosted. I want to use beat to send logs from servers to … --- ## [How to mix nested object with script in aggregation?](https://discuss.elastic.co/t/how-to-mix-nested-object-with-script-in-aggregation/204741)
**Author:** [@lhartzman](https://discuss.elastic.co/u/lhartzman)\ **Replies:** 0\ **Last updated:** [October 22, 2019, 11:50pm UTC](https://discuss.elastic.co/t/how-to-mix-nested-object-with-script-in-aggregation/204741 "2019-10-22T23:50:19Z")
I want to concatenate 2 document fields, one of which is a nested object. If it were not nested, it wouldn't be a problem, but with script you can't mix nested. A sample mapping is: { "\_doc": { "properties… --- ## [Security](https://discuss.elastic.co/t/security/204731)
**Author:** [@gregorys](https://discuss.elastic.co/u/gregorys)\ **Replies:** 6\ **Last updated:** [October 22, 2019, 10:42pm UTC](https://discuss.elastic.co/t/security/204731 "2019-10-22T22:42:49Z")
Hi, I have enabled security in elasticsearch and kibana. I have created a user with only the built-in kibana\_user role assigned to it. It seems this user can create other users and assign whatever role he wants to the… --- ## [Visualizing related data automatically](https://discuss.elastic.co/t/visualizing-related-data-automatically/204243)
**Author:** [@planetracer](https://discuss.elastic.co/u/planetracer)\ **Replies:** 1\ **Last updated:** [October 22, 2019, 10:18pm UTC](https://discuss.elastic.co/t/visualizing-related-data-automatically/204243 "2019-10-22T22:18:12Z")
if I send something like this in (except with almost 300 fields): "durations": \[ { "Patching": 4 }, { "Extracting": 0 }, { "Building": 5 }, { "Configuring": 6 }, { "Installing to host directory": 1 }, } … --- ## [How to move an Index from Server A to B](https://discuss.elastic.co/t/how-to-move-an-index-from-server-a-to-b/204552)
**Author:** [@baselai](https://discuss.elastic.co/u/baselai)\ **Replies:** 3\ **Last updated:** [October 22, 2019, 10:05pm UTC](https://discuss.elastic.co/t/how-to-move-an-index-from-server-a-to-b/204552 "2019-10-22T22:05:18Z")
I'm looking for a way to move a 2.3 GB index from Server A to Server B, that is completely lives on a different domain/host. I tried logstash code, but it fails at some point and keeps pushing the data infinetly! input… --- ## [How to introduce a new api for kibana plugin?](https://discuss.elastic.co/t/how-to-introduce-a-new-api-for-kibana-plugin/204463)
**Author:** [@vvvprabhakar](https://discuss.elastic.co/u/vvvprabhakar)\ **Replies:** 4\ **Last updated:** [October 22, 2019, 9:59pm UTC](https://discuss.elastic.co/t/how-to-introduce-a-new-api-for-kibana-plugin/204463 "2019-10-22T21:59:24Z")
File name : create\_index\_pattern\_wizards.js to fetch all the indices return es.search(params) Now, I want to fetch aliases so i wrote es.cat.aliases it did not work out so i am trying to write an api Code as follo… --- ## [Index / document design for API logs, plus some extra data](https://discuss.elastic.co/t/index-document-design-for-api-logs-plus-some-extra-data/204733)
**Author:** [@D-Sect](https://discuss.elastic.co/u/D-Sect)\ **Replies:** 0\ **Last updated:** [October 22, 2019, 9:32pm UTC](https://discuss.elastic.co/t/index-document-design-for-api-logs-plus-some-extra-data/204733 "2019-10-22T21:32:06Z")
Hello, I am struggling a bit with a business use case, and I am trying to see if Elastic is the right fit. The use case is to be able query our systems' API logs (calls to our APIs from the outside) to answer questions… --- ## [Kibana - Add Request Payload in log](https://discuss.elastic.co/t/kibana-add-request-payload-in-log/204674)
**Author:** [@daniele.saccon](https://discuss.elastic.co/u/daniele.saccon)\ **Replies:** 1\ **Last updated:** [October 22, 2019, 9:01pm UTC](https://discuss.elastic.co/t/kibana-add-request-payload-in-log/204674 "2019-10-22T21:01:03Z")
Hello, I'm using kibana 5.4, can I add the info "Request Payload" to the log? Thanks Daniele --- ## [Exception Details (Stack Trace) not displaying in KIBANA](https://discuss.elastic.co/t/exception-details-stack-trace-not-displaying-in-kibana/204693)
**Author:** [@Subramanyam](https://discuss.elastic.co/u/Subramanyam)\ **Replies:** 1\ **Last updated:** [October 22, 2019, 8:57pm UTC](https://discuss.elastic.co/t/exception-details-stack-trace-not-displaying-in-kibana/204693 "2019-10-22T20:57:55Z")
Hi , We are using KIBANA for logging purpose. When ever there is any exception , in Kibana we are not seeing the Exception/Stack Trace details fully. e.g. try { int j = i/0; } catch(Exception ex) { logger.erro… --- ## [Kibana 7.4 Plugin document Ready Event](https://discuss.elastic.co/t/kibana-7-4-plugin-document-ready-event/204725)
**Author:** [@Sincore](https://discuss.elastic.co/u/Sincore)\ **Replies:** 1\ **Last updated:** [October 22, 2019, 8:11pm UTC](https://discuss.elastic.co/t/kibana-7-4-plugin-document-ready-event/204725 "2019-10-22T20:11:00Z")
Hi All, I am currently in the process of developing a simple plugin that removes some elements from certain pages I want to be able to run some Simply Jquery after the document fully loads. I have tried doing this with … --- ## [Bookmarking Kibana dashboard](https://discuss.elastic.co/t/bookmarking-kibana-dashboard/204695)
**Author:** [@savage](https://discuss.elastic.co/u/savage)\ **Replies:** 1\ **Last updated:** [October 22, 2019, 8:10pm UTC](https://discuss.elastic.co/t/bookmarking-kibana-dashboard/204695 "2019-10-22T20:10:14Z")
(Using Kibana 6.7) We have customers who bookmark Kibana dashboards. The bookmark refers to a URL that obviously has volatile portions, (e.g. \_\_\_h@44136fa&\_a=h@32698d5). When those users open the bookmark to reload a das… --- ## [How many shards per node](https://discuss.elastic.co/t/how-many-shards-per-node/204641)
**Author:** [@elk2](https://discuss.elastic.co/u/elk2)\ **Replies:** 3\ **Last updated:** [October 22, 2019, 8:06pm UTC](https://discuss.elastic.co/t/how-many-shards-per-node/204641 "2019-10-22T20:06:40Z")
From blog : A good rule is to ensure to keep the number of shards per node below 20 per GB heap. How many shards per node is better to have a low overhead in case of fault ? --- ## [Adding multiple nested json fields to an array field](https://discuss.elastic.co/t/adding-multiple-nested-json-fields-to-an-array-field/204279)
**Author:** [@kylemain](https://discuss.elastic.co/u/kylemain)\ **Replies:** 2\ **Last updated:** [October 22, 2019, 7:29pm UTC](https://discuss.elastic.co/t/adding-multiple-nested-json-fields-to-an-array-field/204279 "2019-10-22T19:29:17Z")
Hello, I have a nested json field in my logs called "instanceId" : "responseElements": { "instancesSet": { "items": \[ { "instanceId": "i-02669ced00e8a3701", "currentState":{ "code": 32, "name": "shutting-down" }, "prev… --- ## [Extract Hour and Day from @timestamp](https://discuss.elastic.co/t/extract-hour-and-day-from-timestamp/204542)
**Author:** [@Jim\_Thunder](https://discuss.elastic.co/u/Jim_Thunder)\ **Replies:** 7\ **Last updated:** [October 22, 2019, 7:04pm UTC](https://discuss.elastic.co/t/extract-hour-and-day-from-timestamp/204542 "2019-10-22T19:04:13Z")
Hello! I am trying to copy the day and hour from the timestamp field and add each to their own fields. Here is my code: if \[source\] =~ "tableBASEtest" { mutate{ add\_field =\> { "\[@metadata\]\[timestam… --- ## [Can't start Elasticsearch on Ubuntu 19.10](https://discuss.elastic.co/t/cant-start-elasticsearch-on-ubuntu-19-10/204353)
**Author:** [@dandago](https://discuss.elastic.co/u/dandago)\ **Replies:** 5\ **Last updated:** [October 22, 2019, 6:35pm UTC](https://discuss.elastic.co/t/cant-start-elasticsearch-on-ubuntu-19-10/204353 "2019-10-22T18:35:42Z")
I am trying to run Elasticsearch on Ubuntu 19.10, which was released just three days ago. I downloaded the Elasticsearch 7.4.0 .tar.gz file from https://www.elastic.co/downloads/elasticsearch I extracted the .tar.gz I… --- ## [Cluster constantly crashing after upgrade to 7.4](https://discuss.elastic.co/t/cluster-constantly-crashing-after-upgrade-to-7-4/202580)
**Author:** [@frederikwerner](https://discuss.elastic.co/u/frederikwerner)\ **Replies:** 4\ **Last updated:** [October 22, 2019, 6:23pm UTC](https://discuss.elastic.co/t/cluster-constantly-crashing-after-upgrade-to-7-4/202580 "2019-10-22T18:23:53Z")
Hey guys, I recently upgraded my 3 node ES cluster to version 7.4. This cluster, which has been running forever (literally years) without any real problems, just started falling apart since then. Nothing besides the ES … --- ## [Remove whole documents with certain value in field](https://discuss.elastic.co/t/remove-whole-documents-with-certain-value-in-field/204475)
**Author:** [@Marta\_Zagrajek](https://discuss.elastic.co/u/Marta_Zagrajek)\ **Replies:** 5\ **Last updated:** [October 22, 2019, 6:19pm UTC](https://discuss.elastic.co/t/remove-whole-documents-with-certain-value-in-field/204475 "2019-10-22T18:19:14Z")
Hello there I have apache logs in which are documents that I want to remove completely. Whole documents not fields so I do not want to use remove\_field in mutate. I have tried drop: filter { if "field\_name" == … --- ## [OpenLdap Log parsing? (strange errors)](https://discuss.elastic.co/t/openldap-log-parsing-strange-errors/204701)
**Author:** [@iukea](https://discuss.elastic.co/u/iukea)\ **Replies:** 1\ **Last updated:** [October 22, 2019, 6:05pm UTC](https://discuss.elastic.co/t/openldap-log-parsing-strange-errors/204701 "2019-10-22T18:05:16Z")
I am having a crazy hard time trying to parse logs coming from my LDAP servers. Sending data Vida filebeat to logstash. And found a nice example openldap.conf file someone was working on (it works okay but i have made… --- ## [Scripted field doc\['@timestamp'\].date.hourOfDay returs nothing](https://discuss.elastic.co/t/scripted-field-doc-timestamp-date-hourofday-returs-nothing/204685)
**Author:** [@Andrew22](https://discuss.elastic.co/u/Andrew22)\ **Replies:** 5\ **Last updated:** [October 22, 2019, 6:02pm UTC](https://discuss.elastic.co/t/scripted-field-doc-timestamp-date-hourofday-returs-nothing/204685 "2019-10-22T18:02:58Z")
Hello all, I'm trying to get the hours of the day that the message was sent at so I can filter for during work hours in kibana but the doc\['@timestamp'\].date.hourOfDay that is suggested to use in the painless scripting… --- ## [Elasticsearch Service now available on Google Cloud Marketplace](https://discuss.elastic.co/t/elasticsearch-service-now-available-on-google-cloud-marketplace/204706)
**Author:** [@elyssaemrich](https://discuss.elastic.co/u/elyssaemrich)\ **Replies:** 0\ **Last updated:** [October 22, 2019, 5:59pm UTC](https://discuss.elastic.co/t/elasticsearch-service-now-available-on-google-cloud-marketplace/204706 "2019-10-22T17:59:57Z")
Elasticsearch Service now available on Google Cloud Marketplace We’re pleased to announce that the Elasticsearch Service on Elastic Cloud is now available in the GCP Marketplace. Usage charges are now consolidated into … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1824) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1826)