# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1849 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1850 --- ## [Logstash doesn't jump to the next line](https://discuss.elastic.co/t/logstash-doesnt-jump-to-the-next-line/203008)
**Author:** [@Alekz](https://discuss.elastic.co/u/Alekz)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 11:05am UTC](https://discuss.elastic.co/t/logstash-doesnt-jump-to-the-next-line/203008 "2019-10-10T11:05:19Z")
Hi everyone, i been a lurker for a while from this community and i've to say thanks for helping me time to time, now i've a problem that can't be solved, ive a jboss with java app running inside of it , the thing is the … --- ## [Elasticsearch cluster health is fluctuating between yellow and red](https://discuss.elastic.co/t/elasticsearch-cluster-health-is-fluctuating-between-yellow-and-red/202877)
**Author:** [@Vishal\_0611](https://discuss.elastic.co/u/Vishal_0611)\ **Replies:** 11\ **Last updated:** [October 10, 2019, 10:51am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-health-is-fluctuating-between-yellow-and-red/202877 "2019-10-10T10:51:08Z")
Hi folks, We are facing a weird problem in one of our ES database server. Cluster health is constantly fluctuating between RED and Yellow. Need help to identify/root cause the same. Is it corruption issue/ Misconfigurat… --- ## [Count total number of words from all documents from a specific field accordingly](https://discuss.elastic.co/t/count-total-number-of-words-from-all-documents-from-a-specific-field-accordingly/203003)
**Author:** [@Noctis17](https://discuss.elastic.co/u/Noctis17)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 10:46am UTC](https://discuss.elastic.co/t/count-total-number-of-words-from-all-documents-from-a-specific-field-accordingly/203003 "2019-10-10T10:46:45Z")
Hello and good day! Someone asked this question but no one seems answered or tried to suggest techniques: https://discuss.elastic.co/t/count-the-number-of-words-in-the-field-elastic-search-6-2/121373 Now, I'm trying to… --- ## [Migrate mysql nth level data to elasticsearch via logstash (config file)](https://discuss.elastic.co/t/migrate-mysql-nth-level-data-to-elasticsearch-via-logstash-config-file/202833)
**Author:** [@saifrehman](https://discuss.elastic.co/u/saifrehman)\ **Replies:** 1\ **Last updated:** [October 10, 2019, 10:35am UTC](https://discuss.elastic.co/t/migrate-mysql-nth-level-data-to-elasticsearch-via-logstash-config-file/202833 "2019-10-10T10:35:15Z")
I am migrating mysql data to elasticsearch via logstash. The database is too big and have lots of relations. I already imported the simple tables and table with nested data(single level parent/child) as well. Problem : … --- ## [Logstash not listening filebeat](https://discuss.elastic.co/t/logstash-not-listening-filebeat/202999)
**Author:** [@Ghali](https://discuss.elastic.co/u/Ghali)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 10:07am UTC](https://discuss.elastic.co/t/logstash-not-listening-filebeat/202999 "2019-10-10T10:07:46Z")
! 71903847\_575966983186355\_2757365151446335488\_n|666x500 ! 73018616\_2514748882139881\_1200478560783958016\_n|666x500 Logstash is not listening on port 5044 i tried without the host but i got the same result. this… --- ## [How to parse json inside text line](https://discuss.elastic.co/t/how-to-parse-json-inside-text-line/202800)
**Author:** [@Deny7](https://discuss.elastic.co/u/Deny7)\ **Replies:** 17\ **Last updated:** [October 10, 2019, 10:05am UTC](https://discuss.elastic.co/t/how-to-parse-json-inside-text-line/202800 "2019-10-10T10:05:24Z")
Hi, I have following log that looks like this: 1570519737247 I access {"date":"2019-10-08T09:28:57.247","rootTitle":"title1","rootModel":"model1","dcTitle":"\[1a\]"} 1570519737247 I access {"date":"2019-10-08T09:28:57.2… --- ## [Filter for a minus value in kibana](https://discuss.elastic.co/t/filter-for-a-minus-value-in-kibana/201652)
**Author:** [@smerzlyakov](https://discuss.elastic.co/u/smerzlyakov)\ **Replies:** 4\ **Last updated:** [October 10, 2019, 9:58am UTC](https://discuss.elastic.co/t/filter-for-a-minus-value-in-kibana/201652 "2019-10-10T09:58:59Z")
I try to filter for a "-" in winlog.event\_data.SidHistory field (logs from winlogbeat). I have 7.2 ELK Stack. Filtering with filters from graphical interface simply doesn't work I try to escape - with \\ and it seems,… --- ## [Logstash hangs (CLOSE\_WAIT)](https://discuss.elastic.co/t/logstash-hangs-close-wait/201545)
**Author:** [@manunc](https://discuss.elastic.co/u/manunc)\ **Replies:** 2\ **Last updated:** [October 10, 2019, 9:58am UTC](https://discuss.elastic.co/t/logstash-hangs-close-wait/201545 "2019-10-10T09:58:06Z")
Hello, Logstash version 7.3.2-1 on CentOS 7.6.1810 Since several days I noticed that Logstash is frozen every 24h. When I check the server I found a lot of CLOSE\_WAIT (131). Nothing in the logstash-plain.log relevant… --- ## [I have a problem inputing file on logstash](https://discuss.elastic.co/t/i-have-a-problem-inputing-file-on-logstash/202568)
**Author:** [@ByeonggeunSon](https://discuss.elastic.co/u/ByeonggeunSon)\ **Replies:** 2\ **Last updated:** [October 10, 2019, 9:43am UTC](https://discuss.elastic.co/t/i-have-a-problem-inputing-file-on-logstash/202568 "2019-10-10T09:43:40Z")
I'm trying to input the file which name is same for everytime It reads well but I'd like to output only the last line appended in that time my pipeline configuration is here input { file{ path =\> "/home/lisa/elastic… --- ## [Reading a specific file in S3 bucket](https://discuss.elastic.co/t/reading-a-specific-file-in-s3-bucket/202985)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 9:06am UTC](https://discuss.elastic.co/t/reading-a-specific-file-in-s3-bucket/202985 "2019-10-10T09:06:11Z")
I tried reading a single file from the S3 bucket using prefix field of S3 llogstash input plugin, but is not working. So would like to know if is possible to read a specific file from s3 bucket, --- ## [Beats setup fails with custom kibana\_index](https://discuss.elastic.co/t/beats-setup-fails-with-custom-kibana-index/202984)
**Author:** [@waraiotoko](https://discuss.elastic.co/u/waraiotoko)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 9:01am UTC](https://discuss.elastic.co/t/beats-setup-fails-with-custom-kibana-index/202984 "2019-10-10T09:01:31Z")
When setting up a new secure stack I noticed that beat setup fails when all of these are true: xpack.security.enabled: true using setup user as described in Grant users access to secured resources | Metricbeat Referenc… --- ## [How to get documents more than 10000 in elasticsearch for visualization?](https://discuss.elastic.co/t/how-to-get-documents-more-than-10000-in-elasticsearch-for-visualization/202845)
**Author:** [@Nirajan](https://discuss.elastic.co/u/Nirajan)\ **Replies:** 3\ **Last updated:** [October 10, 2019, 9:00am UTC](https://discuss.elastic.co/t/how-to-get-documents-more-than-10000-in-elasticsearch-for-visualization/202845 "2019-10-10T09:00:34Z")
Hello, I am looking for a solution to get all the records from the elasticsearch for visualization. It seems only 10000 documents can be visualized at a time. I went through elasticsearch documentation and found out t… --- ## [Thinning Of Timeseries Data](https://discuss.elastic.co/t/thinning-of-timeseries-data/202971)
**Author:** [@tomx1](https://discuss.elastic.co/u/tomx1)\ **Replies:** 3\ **Last updated:** [October 10, 2019, 8:43am UTC](https://discuss.elastic.co/t/thinning-of-timeseries-data/202971 "2019-10-10T08:43:01Z")
Hey, I wonder what is the best way to thin out timeseries data for example collected by metricbeat. We dont need to know the exact CPU usage in second X 30 days ago of a particular server. It is sufficient to have a one… --- ## [Hot, Warm Setup Storage Based](https://discuss.elastic.co/t/hot-warm-setup-storage-based/202974)
**Author:** [@tomx1](https://discuss.elastic.co/u/tomx1)\ **Replies:** 1\ **Last updated:** [October 10, 2019, 8:22am UTC](https://discuss.elastic.co/t/hot-warm-setup-storage-based/202974 "2019-10-10T08:22:25Z")
Hey, we are planning to setup a new cluster with 5 hardware servers. Each server will use a 2TB PCIe SSD and ~10TB of SAS Storage. We are collecting logs and timeseries. After a few days data should be moved to the SAS … --- ## [Cannot log in to Kibana in Azure](https://discuss.elastic.co/t/cannot-log-in-to-kibana-in-azure/202838)
**Author:** [@B\_Z](https://discuss.elastic.co/u/B_Z)\ **Replies:** 4\ **Last updated:** [October 10, 2019, 8:14am UTC](https://discuss.elastic.co/t/cannot-log-in-to-kibana-in-azure/202838 "2019-10-10T08:14:01Z")
I've created an ElasticStack from Azure but when I try to log in to Kibana through the IP Address (IPADDRESS:5601) then this error is generated: {"statusCode":403,"error":"Forbidden","message":"Forbidden"} Can you plea… --- ## [Add button(s) to export tabular data to external source](https://discuss.elastic.co/t/add-button-s-to-export-tabular-data-to-external-source/201394)
**Author:** [@Elaak](https://discuss.elastic.co/u/Elaak)\ **Replies:** 3\ **Last updated:** [October 10, 2019, 8:03am UTC](https://discuss.elastic.co/t/add-button-s-to-export-tabular-data-to-external-source/201394 "2019-10-10T08:03:47Z")
In Kibana I have a table representation of my data. I want to be able to filter this data and by pressing a button be able to export the resulting dataset to an external source. I will likely have multiple external sourc… --- ## [Field is not displaying proper field output - UDP](https://discuss.elastic.co/t/field-is-not-displaying-proper-field-output-udp/202966)
**Author:** [@akhilsharma.in](https://discuss.elastic.co/u/akhilsharma.in)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 7:47am UTC](https://discuss.elastic.co/t/field-is-not-displaying-proper-field-output-udp/202966 "2019-10-10T07:47:43Z")
Hi, I'm using input as UDP and storing the output in file. Events have a field "message" which is not having the complete value but it's truncated. Example: "message":" ...fkhfhftxt..." Sample: { "@version": "1", … --- ## [Ephemeral Jobs](https://discuss.elastic.co/t/ephemeral-jobs/202047)
**Author:** [@jasonmoo-we](https://discuss.elastic.co/u/jasonmoo-we)\ **Replies:** 10\ **Last updated:** [October 10, 2019, 7:13am UTC](https://discuss.elastic.co/t/ephemeral-jobs/202047 "2019-10-10T07:13:27Z")
Hi I'm just curious if the APM libraries can be used for short lived jobs (ie. a cron job that processes some entries in a queue and puts them in a database and exits). I haven't seen any special configuration for this.… --- ## [\[MAPS\]\[scripted field\]Heading and lat/lon not in same doc, any way to merge them?](https://discuss.elastic.co/t/maps-scripted-field-heading-and-lat-lon-not-in-same-doc-any-way-to-merge-them/202783)
**Author:** [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Replies:** 2\ **Last updated:** [October 10, 2019, 6:39am UTC](https://discuss.elastic.co/t/maps-scripted-field-heading-and-lat-lon-not-in-same-doc-any-way-to-merge-them/202783 "2019-10-10T06:39:27Z")
Hi, I am collecting lat/lon data for a moving object containing three fields. { "object": "name", "geo": "lat lon", "@timestamp": 12:00:00 } I am also receiving heading information from a different source. { … --- ## [Sort terms aggregation hits by topHits first hit](https://discuss.elastic.co/t/sort-terms-aggregation-hits-by-tophits-first-hit/202952)
**Author:** [@Hanan\_Aharonof](https://discuss.elastic.co/u/Hanan_Aharonof)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 6:23am UTC](https://discuss.elastic.co/t/sort-terms-aggregation-hits-by-tophits-first-hit/202952 "2019-10-10T06:23:52Z")
Hi, I'm running the following query: GET security/\_search { "size": 0, "query": { "match\_all": {} }, "aggs": { "aggBy": { "terms": { "field": "assetType", "size": 250, "order": { "\_count": "asc" } }, "ag… --- ## [Failed to decode ndjson new format with python](https://discuss.elastic.co/t/failed-to-decode-ndjson-new-format-with-python/202881)
**Author:** [@GitsBdr](https://discuss.elastic.co/u/GitsBdr)\ **Replies:** 2\ **Last updated:** [October 10, 2019, 6:00am UTC](https://discuss.elastic.co/t/failed-to-decode-ndjson-new-format-with-python/202881 "2019-10-10T06:00:51Z")
Hi here, Thanks in advance for your time and help I can find on the web couple of examples using python scripts to "decode" data from the Kibana API with json Such as : dashboard = requests.get('http://' + hostname +… --- ## [Can a Logstash pipeline wait to start until another pipeline completes?](https://discuss.elastic.co/t/can-a-logstash-pipeline-wait-to-start-until-another-pipeline-completes/202943)
**Author:** [@snowboardcto](https://discuss.elastic.co/u/snowboardcto)\ **Replies:** 1\ **Last updated:** [October 10, 2019, 5:27am UTC](https://discuss.elastic.co/t/can-a-logstash-pipeline-wait-to-start-until-another-pipeline-completes/202943 "2019-10-10T05:27:07Z")
Using Logstash multiple pipelines can I configure a pipeline to wait to start until another pipeline has completed? --- ## [Deduplication in beats while sending logs to Logstash or Elasticsearch](https://discuss.elastic.co/t/deduplication-in-beats-while-sending-logs-to-logstash-or-elasticsearch/202942)
**Author:** [@nindate](https://discuss.elastic.co/u/nindate)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 4:51am UTC](https://discuss.elastic.co/t/deduplication-in-beats-while-sending-logs-to-logstash-or-elasticsearch/202942 "2019-10-10T04:51:51Z")
Hi, I am sure this point would have been considered already, but since I could not find any reference to this, asking it here. When various beats send log data to Logstash/Elasticsearch data for most of the fields from… --- ## [Unable to search special character](https://discuss.elastic.co/t/unable-to-search-special-character/202938)
**Author:** [@Ramesh\_balasubramani](https://discuss.elastic.co/u/Ramesh_balasubramani)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 4:16am UTC](https://discuss.elastic.co/t/unable-to-search-special-character/202938 "2019-10-10T04:16:45Z")
GET logs\*/\_search { "query": { "match\_phrase": { "message": "2=2" } } } Result : "message": "2019-10-10 09:28:59.301644 xxx.xxx.xxx.xxx switchapp event=process\_started process\_name=kw… --- ## [Metric and Gauge Shows Zero Only In TSVB](https://discuss.elastic.co/t/metric-and-gauge-shows-zero-only-in-tsvb/202649)
**Author:** [@Ramya\_Tanikanti](https://discuss.elastic.co/u/Ramya_Tanikanti)\ **Replies:** 4\ **Last updated:** [October 10, 2019, 3:40am UTC](https://discuss.elastic.co/t/metric-and-gauge-shows-zero-only-in-tsvb/202649 "2019-10-10T03:40:35Z")
In TSVB, the time series graph changes when I add metrics and aggregations in the Data Tab, but the Metric and Gauge does not change and remains 'Zero' only. Kindly Help! --- ## [Logstash - aggregate filter - for each transaction/thread, only look for the first match message](https://discuss.elastic.co/t/logstash-aggregate-filter-for-each-transaction-thread-only-look-for-the-first-match-message/202936)
**Author:** [@Vincent\_Chen](https://discuss.elastic.co/u/Vincent_Chen)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 3:23am UTC](https://discuss.elastic.co/t/logstash-aggregate-filter-for-each-transaction-thread-only-look-for-the-first-match-message/202936 "2019-10-10T03:23:29Z")
Hi everyone, We have a log that do not provide a unique ID for each transaction. We want to use the thread-id and the message body to define the transaction boundary. Here is the mock-up log: ##transaction 1 \[2019-… --- ## [Logstash/ Synchronize Postgres to EL](https://discuss.elastic.co/t/logstash-synchronize-postgres-to-el/202927)
**Author:** [@sbyamauchi](https://discuss.elastic.co/u/sbyamauchi)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 1:11am UTC](https://discuss.elastic.co/t/logstash-synchronize-postgres-to-el/202927 "2019-10-10T01:11:12Z")
Hi,I try to synchronize postgres to elastic. But I receive the error below and not update index data. Is it necessary to make multiple pipelines or something? Logstash could not be started because there is already ano… --- ## [Logstash Service starts but it could not work without manually starting with --path.settings and -f parameters](https://discuss.elastic.co/t/logstash-service-starts-but-it-could-not-work-without-manually-starting-with-path-settings-and-f-parameters/200981)
**Author:** [@alperensoydan](https://discuss.elastic.co/u/alperensoydan)\ **Replies:** 1\ **Last updated:** [October 10, 2019, 2:15am UTC](https://discuss.elastic.co/t/logstash-service-starts-but-it-could-not-work-without-manually-starting-with-path-settings-and-f-parameters/200981 "2019-10-10T02:15:10Z")
Hello, I have a problem with Logstash, I want to start it on startup. It seems it works as a service but it can not work essentially. When I run /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d --path.settings /… --- ## [Running multiple logstash config](https://discuss.elastic.co/t/running-multiple-logstash-config/202745)
**Author:** [@ashokchinna](https://discuss.elastic.co/u/ashokchinna)\ **Replies:** 2\ **Last updated:** [October 9, 2019, 11:45pm UTC](https://discuss.elastic.co/t/running-multiple-logstash-config/202745 "2019-10-09T23:45:21Z")
I want to run multiple logstash conf file in the same instance or multiple instance of logstash. What is the best approach to follow? --- ## [Lotstash is not picking Apache Logs config](https://discuss.elastic.co/t/lotstash-is-not-picking-apache-logs-config/202747)
**Author:** [@sud0](https://discuss.elastic.co/u/sud0)\ **Replies:** 10\ **Last updated:** [October 9, 2019, 11:21pm UTC](https://discuss.elastic.co/t/lotstash-is-not-picking-apache-logs-config/202747 "2019-10-09T23:21:17Z")
I have two Apache webservers (1x uat and 1x prod). I am sending the logs to my ELK setup for both of them. For the UAT one, it is working fine. For the PROD one, the logs are now shown in Kibana. I need some help to d… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1848) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1850)