# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1835 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1836 --- ## [Single key (field) with multiple values to multiple key (fields) with single fields convertion](https://discuss.elastic.co/t/single-key-field-with-multiple-values-to-multiple-key-fields-with-single-fields-convertion/204090)
**Author:** [@Andres\_Man](https://discuss.elastic.co/u/Andres_Man)\ **Replies:** 2\ **Last updated:** [October 17, 2019, 3:50pm UTC](https://discuss.elastic.co/t/single-key-field-with-multiple-values-to-multiple-key-fields-with-single-fields-convertion/204090 "2019-10-17T15:50:41Z")
I need to split a log into multiple fields however the log has the same field name for multiple values and when I use the fiedl\_split option of kv it will put all the the fields with the same key in the same field. How c… --- ## [Logstash adding date at the beginning of the each record](https://discuss.elastic.co/t/logstash-adding-date-at-the-beginning-of-the-each-record/203936)
**Author:** [@sekharvijju](https://discuss.elastic.co/u/sekharvijju)\ **Replies:** 1\ **Last updated:** [October 17, 2019, 3:44pm UTC](https://discuss.elastic.co/t/logstash-adding-date-at-the-beginning-of-the-each-record/203936 "2019-10-17T15:44:32Z")
Hi Logstash gurus, I m trying to setup a basic logstash client to push server logs into S3 bucket using Input plugin & s3 output plugin. input { file { path =\> "/logs/sys\*" exclude =\> "\*.tar" start\_position =\> "beg… --- ## [Logstash: installing plugin results in certificate verify failed error](https://discuss.elastic.co/t/logstash-installing-plugin-results-in-certificate-verify-failed-error/204076)
**Author:** [@an.schall](https://discuss.elastic.co/u/an.schall)\ **Replies:** 1\ **Last updated:** [October 17, 2019, 3:31pm UTC](https://discuss.elastic.co/t/logstash-installing-plugin-results-in-certificate-verify-failed-error/204076 "2019-10-17T15:31:51Z")
Hi, I am behind a corporate firewall with SSL interception. As many people here in this forum, I receive an SSL-related error when installing a logstash plugin: root@kali:/etc/ssl/certs# /usr/share/logstash/bin/logstash… --- ## [Writing grok filter which ignores some field and captures time and date](https://discuss.elastic.co/t/writing-grok-filter-which-ignores-some-field-and-captures-time-and-date/204028)
**Author:** [@Aayush\_Agrawal](https://discuss.elastic.co/u/Aayush_Agrawal)\ **Replies:** 1\ **Last updated:** [October 17, 2019, 3:12pm UTC](https://discuss.elastic.co/t/writing-grok-filter-which-ignores-some-field-and-captures-time-and-date/204028 "2019-10-17T15:12:37Z")
I am trying to capture start time and end time for this log, but every time i am having different errors. Kindly help. Offline batch Start Time -\>Oct 8, 2019 11:47:33 PM, End time -\>Oct 8, 2019 11:49:43 PM --- ## [Unstable after starting nodes](https://discuss.elastic.co/t/unstable-after-starting-nodes/200526)
**Author:** [@Tex](https://discuss.elastic.co/u/Tex)\ **Replies:** 14\ **Last updated:** [October 17, 2019, 3:11pm UTC](https://discuss.elastic.co/t/unstable-after-starting-nodes/200526 "2019-10-17T15:11:01Z")
Hi, ES: v7.3.2 I create a brand new cluster with 3 master nodes, no problem all running fine. but each time that i want to add a node ( no master ) after some time ( 1h ) the node disappear, monitoring show node was re… --- ## [Accessing the inverse index](https://discuss.elastic.co/t/accessing-the-inverse-index/204005)
**Author:** [@ftr](https://discuss.elastic.co/u/ftr)\ **Replies:** 5\ **Last updated:** [October 17, 2019, 3:09pm UTC](https://discuss.elastic.co/t/accessing-the-inverse-index/204005 "2019-10-17T15:09:19Z")
I am currently researching the contents of an index on an old 1.7.1 ES cluster, in relation to GDPR related issues. In other words, I need to know exactly what can be retrieved from the cluster. I have come up against a… --- ## [ECK install kubernetes on-premise k8s cluster with local NFS](https://discuss.elastic.co/t/eck-install-kubernetes-on-premise-k8s-cluster-with-local-nfs/204065)
**Author:** [@umim9](https://discuss.elastic.co/u/umim9)\ **Replies:** 1\ **Last updated:** [October 17, 2019, 3:01pm UTC](https://discuss.elastic.co/t/eck-install-kubernetes-on-premise-k8s-cluster-with-local-nfs/204065 "2019-10-17T15:01:43Z")
Hi, I want install one ECK cluster in local on-premise k8s HA cluster. I use local network NFS share persistent store for k8s HA cluster. I am a beginner enginer. Someone can send install yaml file for me? Thank you… --- ## [How to match multiple should clauses?](https://discuss.elastic.co/t/how-to-match-multiple-should-clauses/204066)
**Author:** [@randomuser](https://discuss.elastic.co/u/randomuser)\ **Replies:** 5\ **Last updated:** [October 17, 2019, 2:50pm UTC](https://discuss.elastic.co/t/how-to-match-multiple-should-clauses/204066 "2019-10-17T14:50:21Z")
Hello, I'm looking for a way of matching multiple should cases. To explain this better, lets use this example: "query": { "bool": { "must": \[ ... \] "should": \[ { "terms" … --- ## [\[Theoretical\] How does query filtering upon nested aggregation work?](https://discuss.elastic.co/t/theoretical-how-does-query-filtering-upon-nested-aggregation-work/204072)
**Author:** [@randomuser](https://discuss.elastic.co/u/randomuser)\ **Replies:** 0\ **Last updated:** [October 17, 2019, 2:06pm UTC](https://discuss.elastic.co/t/theoretical-how-does-query-filtering-upon-nested-aggregation-work/204072 "2019-10-17T14:06:07Z")
I've just used a really neat option - filtering upon nested aggregation values. I love it, it works the way it's supposed to, but I'm interested in how does it work and in which order are the filters/aggregations execute… --- ## [There is not data using visual builder](https://discuss.elastic.co/t/there-is-not-data-using-visual-builder/203929)
**Author:** [@AlfredoC](https://discuss.elastic.co/u/AlfredoC)\ **Replies:** 2\ **Last updated:** [October 17, 2019, 2:39pm UTC](https://discuss.elastic.co/t/there-is-not-data-using-visual-builder/203929 "2019-10-17T14:39:13Z")
Hello, I am traying to use the data with visual builder but Kibana does not display any information when I try Top N or table, the informatión is displayed only using times series, however the information is in the datab… --- ## [Import large PCAP with Packetbeat](https://discuss.elastic.co/t/import-large-pcap-with-packetbeat/203578)
**Author:** [@sutello](https://discuss.elastic.co/u/sutello)\ **Replies:** 3\ **Last updated:** [October 17, 2019, 1:52pm UTC](https://discuss.elastic.co/t/import-large-pcap-with-packetbeat/203578 "2019-10-17T13:52:51Z")
Hey, we sitting here in a Study-Project in Germany and want to work with packetbeat and ELK to find security issues in network-traffic. The live-capturing works fine. Now, we want to import our old PCAP-files from the … --- ## [RBAC for APM Metrics](https://discuss.elastic.co/t/rbac-for-apm-metrics/203672)
**Author:** [@rwcanand](https://discuss.elastic.co/u/rwcanand)\ **Replies:** 2\ **Last updated:** [October 17, 2019, 1:07pm UTC](https://discuss.elastic.co/t/rbac-for-apm-metrics/203672 "2019-10-17T13:07:27Z")
I currently have an ELK - APM setup in place where multiple teams have configured their agents to send data via APM server to Elasticsearch. They are able to look at the data in Kibana. Is it possible to configure Kiban… --- ## [Not able to filter by APM labels](https://discuss.elastic.co/t/not-able-to-filter-by-apm-labels/201720)
**Author:** [@sivachandran](https://discuss.elastic.co/u/sivachandran)\ **Replies:** 1\ **Last updated:** [October 17, 2019, 12:43pm UTC](https://discuss.elastic.co/t/not-able-to-filter-by-apm-labels/201720 "2019-10-17T12:43:40Z")
My application is sending custom metric as APM label fields. I can see these fields as labels.{field-name} in Discover page. But I couldn't neither filter by these fields nor create visualisation on this. How can I use t… --- ## [Another Kibana instance appears to be migrating the index. Waiting for that migration to complete. If no other Kibana instance is attempting migrations, you can get past this message by deleting index .kibana\_1 and restarting Kibana](https://discuss.elastic.co/t/another-kibana-instance-appears-to-be-migrating-the-index-waiting-for-that-migration-to-complete-if-no-other-kibana-instance-is-attempting-migrations-you-can-get-past-this-message-by-deleting-index-kibana-1-and-restarting-kibana/204051)
**Author:** [@subha1](https://discuss.elastic.co/u/subha1)\ **Replies:** 0\ **Last updated:** [October 17, 2019, 12:35pm UTC](https://discuss.elastic.co/t/another-kibana-instance-appears-to-be-migrating-the-index-waiting-for-that-migration-to-complete-if-no-other-kibana-instance-is-attempting-migrations-you-can-get-past-this-message-by-deleting-index-kibana-1-and-restarting-kibana/204051 "2019-10-17T12:35:09Z")
I have deployed ELK-7 , All the pods have come up successfully , But kibana pod shows this error . Another Kibana instance appears to be migrating the index. Waiting for that migration to complete. If no other Kibana in… --- ## [Logstash elasticsearch input with \_source disabled](https://discuss.elastic.co/t/logstash-elasticsearch-input-with-source-disabled/204034)
**Author:** [@raviep](https://discuss.elastic.co/u/raviep)\ **Replies:** 2\ **Last updated:** [October 17, 2019, 12:24pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-input-with-source-disabled/204034 "2019-10-17T12:24:49Z")
Hi, I'm using logstash elastic search input plugin to export elastic search indexes into csv file. Please note that \_source is disabled for indices. The issue here is export works only when \_source is enabled otherwise … --- ## [Safely upgrade from Elasticsearch 1.7.3 to 7.x](https://discuss.elastic.co/t/safely-upgrade-from-elasticsearch-1-7-3-to-7-x/203973)
**Author:** [@deltafarce](https://discuss.elastic.co/u/deltafarce)\ **Replies:** 3\ **Last updated:** [October 17, 2019, 12:21pm UTC](https://discuss.elastic.co/t/safely-upgrade-from-elasticsearch-1-7-3-to-7-x/203973 "2019-10-17T12:21:21Z")
Hello, this might be too basic a question for the forums, but I'm in the process of upgrading our infrastructure and we run the really outdated version of Elasticsearch 1.7.3. It badly needs an upgrade to a service suppo… --- ## [What is the difference in specifying the index in the URL with specifying the index in the query body?](https://discuss.elastic.co/t/what-is-the-difference-in-specifying-the-index-in-the-url-with-specifying-the-index-in-the-query-body/203910)
**Author:** [@Henrique\_Brasileiro](https://discuss.elastic.co/u/Henrique_Brasileiro)\ **Replies:** 3\ **Last updated:** [October 17, 2019, 12:19pm UTC](https://discuss.elastic.co/t/what-is-the-difference-in-specifying-the-index-in-the-url-with-specifying-the-index-in-the-query-body/203910 "2019-10-17T12:19:17Z")
I want to undenstand the performance diference between: GET /\_search { "query": { "terms": { "\_index": \["index\_1", "index\_2"\] } } } and: GET index\_1,index\_2/\_search --- ## [Unable to allocate index](https://discuss.elastic.co/t/unable-to-allocate-index/203653)
**Author:** [@Merlin\_Nunez](https://discuss.elastic.co/u/Merlin_Nunez)\ **Replies:** 7\ **Last updated:** [October 17, 2019, 12:02pm UTC](https://discuss.elastic.co/t/unable-to-allocate-index/203653 "2019-10-17T12:02:15Z")
Hi All, I´veen facing issue with an elasticsearch cluster, that first out of the blue, and later after a restart failed to allocate an index. The cluser has a single node atm and replication is disabled. When I check … --- ## [ParserError with Code 111](https://discuss.elastic.co/t/parsererror-with-code-111/204044)
**Author:** [@akihu](https://discuss.elastic.co/u/akihu)\ **Replies:** 0\ **Last updated:** [October 17, 2019, 12:00pm UTC](https://discuss.elastic.co/t/parsererror-with-code-111/204044 "2019-10-17T12:00:54Z")
Dear Community, I've got server sending following json data via filebeat to logstash. Logstash version is 6.2.4. For some unknown reason to me, logstash returns following error during json filtering: Error parsing js… --- ## [Bucket Sort on non-numeric (keyword) field](https://discuss.elastic.co/t/bucket-sort-on-non-numeric-keyword-field/204041)
**Author:** [@mateuszjarzyna](https://discuss.elastic.co/u/mateuszjarzyna)\ **Replies:** 0\ **Last updated:** [October 17, 2019, 11:44am UTC](https://discuss.elastic.co/t/bucket-sort-on-non-numeric-keyword-field/204041 "2019-10-17T11:44:11Z")
I have index with products, each product has category and category\_owner. I'd like to show on my GUI table with all categories sorted by category\_owner, but table must be pageable. I know there is a way to sort (and pag… --- ## [Attempted to send a bulk request to elasticsearch' but Elasticsearch appears to be unreachable](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch-but-elasticsearch-appears-to-be-unreachable/204029)
**Author:** [@wangzf](https://discuss.elastic.co/u/wangzf)\ **Replies:** 0\ **Last updated:** [October 17, 2019, 10:47am UTC](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch-but-elasticsearch-appears-to-be-unreachable/204029 "2019-10-17T10:47:00Z")
hi,i hava a question ,my cluster is green ,but my logstasht hava this error Oct 15 09:17:16 logstashmysql logstash\[14839\]: \[2019-10-15T09:17:16,974\]\[WARN \]\[logstash.outputs.elasticsearch\] Marking url as dead. Last error… --- ## [Cannot add new field from event type](https://discuss.elastic.co/t/cannot-add-new-field-from-event-type/203875)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 2\ **Last updated:** [October 17, 2019, 10:37am UTC](https://discuss.elastic.co/t/cannot-add-new-field-from-event-type/203875 "2019-10-17T10:37:42Z")
Hello guys, I´m new to ELK stack and trying to add custom field to kibana using the filter in logstash. Can someone point me to right direction?? I want to add the field "Logon Activity" like "message" showing in the p… --- ## [Question shard allocation awareness?](https://discuss.elastic.co/t/question-shard-allocation-awareness/201565)
**Author:** [@CJ1](https://discuss.elastic.co/u/CJ1)\ **Replies:** 15\ **Last updated:** [October 17, 2019, 10:26am UTC](https://discuss.elastic.co/t/question-shard-allocation-awareness/201565 "2019-10-17T10:26:07Z")
Enabled shard allocation awareness/forced-awareness in the cluster, right now enabled for two zones "cluster.routing.allocation.awareness.attributes" : "rack\_id" "cluster.routing.allocation.awareness.force.rack\_id.value… --- ## [ES 7.4.0: Getting Exception when reading remote cluster stats](https://discuss.elastic.co/t/es-7-4-0-getting-exception-when-reading-remote-cluster-stats/203884)
**Author:** [@dextermorgan](https://discuss.elastic.co/u/dextermorgan)\ **Replies:** 1\ **Last updated:** [October 17, 2019, 10:17am UTC](https://discuss.elastic.co/t/es-7-4-0-getting-exception-when-reading-remote-cluster-stats/203884 "2019-10-17T10:17:51Z")
I just did a fresh install of 7.4 on a 2 node setup and getting following exception on node\_1 when I run command \`\`curl -XGET "localhost:9200/\_cat/allocation"\` on node\_1. \[2019-10-16T16:26:45,007\]\[DEBUG\]\[o.e.a.a.c.n.s.T… --- ## [ElasticSearch error Kibana not loading data](https://discuss.elastic.co/t/elasticsearch-error-kibana-not-loading-data/204012)
**Author:** [@Dhanushka1282](https://discuss.elastic.co/u/Dhanushka1282)\ **Replies:** 0\ **Last updated:** [October 17, 2019, 9:31am UTC](https://discuss.elastic.co/t/elasticsearch-error-kibana-not-loading-data/204012 "2019-10-17T09:31:54Z")
Hi guys im getting below error when starting elasticsearch . Can you guys please help me to fix the this issue \[2019-10-17T14:53:43,856\]\[INFO \]\[o.e.c.m.MetaDataIndexTemplateService\] \[node-1\] adding template \[.manageme… --- ## [Audit logs not updating properly](https://discuss.elastic.co/t/audit-logs-not-updating-properly/204013)
**Author:** [@arun.kumar92](https://discuss.elastic.co/u/arun.kumar92)\ **Replies:** 0\ **Last updated:** [October 17, 2019, 9:33am UTC](https://discuss.elastic.co/t/audit-logs-not-updating-properly/204013 "2019-10-17T09:33:19Z")
Hi Folks I'm facing an issue in elasticsearch audit logs part. Audit logs not updating after somtime during restart. Configuration details Kindly go through the below log4j2.properties file \`status = error appender.c… --- ## [Creating a table "tagging" computers in Kibana](https://discuss.elastic.co/t/creating-a-table-tagging-computers-in-kibana/203861)
**Author:** [@EdH](https://discuss.elastic.co/u/EdH)\ **Replies:** 2\ **Last updated:** [October 17, 2019, 9:18am UTC](https://discuss.elastic.co/t/creating-a-table-tagging-computers-in-kibana/203861 "2019-10-17T09:18:58Z")
Hi, I was wondering whether it would be possible to create a table "tagging" computers on Kibana? We currently have a large number of PCs used worldwide and I'd like to keep track of where they are being used, how hard t… --- ## [Alias with high number of indices](https://discuss.elastic.co/t/alias-with-high-number-of-indices/204008)
**Author:** [@ctombaugh](https://discuss.elastic.co/u/ctombaugh)\ **Replies:** 0\ **Last updated:** [October 17, 2019, 8:57am UTC](https://discuss.elastic.co/t/alias-with-high-number-of-indices/204008 "2019-10-17T08:57:07Z")
I have a collection of around 100,000,000 documents, which consists of a few thousand subsets (each tens to millions of documents). Most of these subsets are regularly updated (wipe and replace, a few times per month). U… --- ## [Could not find the java in JAVA\_HOME or bundled at C:\\Software\\elasticsearch-7.4.0-windows-x86\_64\\elasticsearch-7.4.0\\jdk](https://discuss.elastic.co/t/could-not-find-the-java-in-java-home-or-bundled-at-c-software-elasticsearch-7-4-0-windows-x86-64-elasticsearch-7-4-0-jdk/204000)
**Author:** [@pratapkuraganti](https://discuss.elastic.co/u/pratapkuraganti)\ **Replies:** 0\ **Last updated:** [October 17, 2019, 8:28am UTC](https://discuss.elastic.co/t/could-not-find-the-java-in-java-home-or-bundled-at-c-software-elasticsearch-7-4-0-windows-x86-64-elasticsearch-7-4-0-jdk/204000 "2019-10-17T08:28:10Z")
Hi all, We are facing an issue while installing the Elasticsearch software in window 2016 server. " Could not find the java in JAVA\_HOME or bundled at C:\\Software\\elasticsearch-7.4.0-windows-x86\_64\\elasticsearch-7.4.0\\… --- ## [Simple example of new configuration of three node cluster, since v7.x update uses new settings](https://discuss.elastic.co/t/simple-example-of-new-configuration-of-three-node-cluster-since-v7-x-update-uses-new-settings/203922)
**Author:** [@AnitaL](https://discuss.elastic.co/u/AnitaL)\ **Replies:** 6\ **Last updated:** [October 17, 2019, 8:00am UTC](https://discuss.elastic.co/t/simple-example-of-new-configuration-of-three-node-cluster-since-v7-x-update-uses-new-settings/203922 "2019-10-17T08:00:27Z")
Hi, I took the Elasticsearch Engineer 1 training this summer (ES 6.x), then completed the Engineer 2 training (ES 7.x) Since I learned this the config settings no longer use : discovery.zen.ping.unicast.hosts: \["server… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1834) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1836)