# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1877 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1878 --- ## [How can i change Elastic search 6.x shards to 1?](https://discuss.elastic.co/t/how-can-i-change-elastic-search-6-x-shards-to-1/200905)
**Author:** [@pamamolf](https://discuss.elastic.co/u/pamamolf)\ **Replies:** 4\ **Last updated:** [September 24, 2019, 7:23pm UTC](https://discuss.elastic.co/t/how-can-i-change-elastic-search-6-x-shards-to-1/200905 "2019-09-24T19:23:26Z")
Hello I would like to change from ssh the shards for latest Elastic search 6.x and my index name is "content". I was using something like: curl -XPUT http://localhost:9200/\_template/content -H 'Content-Type: applicati… --- ## [Load avro export from BigQuery](https://discuss.elastic.co/t/load-avro-export-from-bigquery/200918)
**Author:** [@MMH](https://discuss.elastic.co/u/MMH)\ **Replies:** 1\ **Last updated:** [September 24, 2019, 7:10pm UTC](https://discuss.elastic.co/t/load-avro-export-from-bigquery/200918 "2019-09-24T19:10:05Z")
I would like to load avro export from BigQuery. Ideally without making any changes to that file. File has the following content: Objavro.codecnullavro.schemaØ {"type":"record","name":"Root","fields":\[{"name":"id","type… --- ## [Zeek Filebeat Module to Logstash JSON](https://discuss.elastic.co/t/zeek-filebeat-module-to-logstash-json/200539)
**Author:** [@millap](https://discuss.elastic.co/u/millap)\ **Replies:** 1\ **Last updated:** [September 24, 2019, 6:43pm UTC](https://discuss.elastic.co/t/zeek-filebeat-module-to-logstash-json/200539 "2019-09-24T18:43:09Z")
Hi All, I wonder if anyone can offer any assistance. We've recently moved to using the Zeek Filebeat module on some remote sensors, as these integrate nicely with the SIEM feature of Kibana, however, the old function we… --- ## [No Compatible Fields: The "blabla" index pattern does not contain any of the following field types: geo\_point](https://discuss.elastic.co/t/no-compatible-fields-the-blabla-index-pattern-does-not-contain-any-of-the-following-field-types-geo-point/199855)
**Author:** [@Barushka](https://discuss.elastic.co/u/Barushka)\ **Replies:** 9\ **Last updated:** [September 24, 2019, 6:10pm UTC](https://discuss.elastic.co/t/no-compatible-fields-the-blabla-index-pattern-does-not-contain-any-of-the-following-field-types-geo-point/199855 "2019-09-24T18:10:26Z")
Hello everyone, I am new in ELK community. I have recently discovered ELK and currently going through a massive learning process. I encountered one issue that I cannot resolve. Please help! I am trying to visualize some… --- ## [Exclude null itens from aggregation](https://discuss.elastic.co/t/exclude-null-itens-from-aggregation/200916)
**Author:** [@fernando.vicente](https://discuss.elastic.co/u/fernando.vicente)\ **Replies:** 2\ **Last updated:** [September 24, 2019, 6:10pm UTC](https://discuss.elastic.co/t/exclude-null-itens-from-aggregation/200916 "2019-09-24T18:10:40Z")
Greetings, I'm trying to do an aggregation like that; map\['sub\_menu'\] ||= \[\] checkedFieldSubMenu = { 'sub\_menu\_id' =\> event.get('sub\_menu\_id'), 'cms\_menu\_name' =\>… --- ## [After upgrading Kibana from 7.1 to 7.3.2 it keeps restarting](https://discuss.elastic.co/t/after-upgrading-kibana-from-7-1-to-7-3-2-it-keeps-restarting/200742)
**Author:** [@az123](https://discuss.elastic.co/u/az123)\ **Replies:** 3\ **Last updated:** [September 24, 2019, 5:24pm UTC](https://discuss.elastic.co/t/after-upgrading-kibana-from-7-1-to-7-3-2-it-keeps-restarting/200742 "2019-09-24T17:24:18Z")
After upgrading the stack using yum on centos7, I see elastic search is running fine using systemctl cli. I notice that kibana service keeps restarting. From the log file I see this error: FATAL Error: Unknown uiExport… --- ## [JVM heap tuning for percolators](https://discuss.elastic.co/t/jvm-heap-tuning-for-percolators/200915)
**Author:** [@dwilches](https://discuss.elastic.co/u/dwilches)\ **Replies:** 0\ **Last updated:** [September 24, 2019, 5:23pm UTC](https://discuss.elastic.co/t/jvm-heap-tuning-for-percolators/200915 "2019-09-24T17:23:55Z")
I've read in the docs that one shouldn't set the JVM's heap size over 50% of the physical memory, as ES needs to leave enough memory for filesystem caches and other things. But, given percolators don't index data into f… --- ## [Config paths not being respected](https://discuss.elastic.co/t/config-paths-not-being-respected/200908)
**Author:** [@mdavis](https://discuss.elastic.co/u/mdavis)\ **Replies:** 0\ **Last updated:** [September 24, 2019, 4:59pm UTC](https://discuss.elastic.co/t/config-paths-not-being-respected/200908 "2019-09-24T16:59:31Z")
I have a one node server setup, it works fine when the files are in the default location. I update /etc/elasticsearch/elasticsearch.yml to the new path and restart after moving the entire directory. Then the service fail… --- ## [Bucket Sort over Composite aggregation degrading the performance of query - Any better way?](https://discuss.elastic.co/t/bucket-sort-over-composite-aggregation-degrading-the-performance-of-query-any-better-way/199782)
**Author:** [@Santosh\_Singh1](https://discuss.elastic.co/u/Santosh_Singh1)\ **Replies:** 10\ **Last updated:** [September 24, 2019, 4:42pm UTC](https://discuss.elastic.co/t/bucket-sort-over-composite-aggregation-degrading-the-performance-of-query-any-better-way/199782 "2019-09-24T16:42:01Z")
We have a use case where we need to get the top 20 items, which has max sum of revenues. Lets consider the mapping below: PUT /my-index/\_mapping { "properties": { "item": { "type": "keyword" … --- ## [Permission Denied Error starting Elasticsearch 7.3 from RPM installation RedHat 6.7 Linux](https://discuss.elastic.co/t/permission-denied-error-starting-elasticsearch-7-3-from-rpm-installation-redhat-6-7-linux/200897)
**Author:** [@npm](https://discuss.elastic.co/u/npm)\ **Replies:** 4\ **Last updated:** [September 24, 2019, 4:37pm UTC](https://discuss.elastic.co/t/permission-denied-error-starting-elasticsearch-7-3-from-rpm-installation-redhat-6-7-linux/200897 "2019-09-24T16:37:07Z")
Installed Elasticsearch 7.3 from RPM on RedHat 6.7 machine as root. sudo rpm --install elasticsearch-7.3.0-x86\_64.rpm Attempted to start using the service commands: root@seismic-an10:/usr/share/elasticsearch\> chkconfi… --- ## [Logstash: Замена индексов в массиве в JSON](https://discuss.elastic.co/t/logstash-json/200848)
**Author:** [@Igor\_Belyakov](https://discuss.elastic.co/u/Igor_Belyakov)\ **Replies:** 3\ **Last updated:** [September 24, 2019, 3:22pm UTC](https://discuss.elastic.co/t/logstash-json/200848 "2019-09-24T15:22:41Z")
Добрый день. Я зашел в тупик. Как заменить все вхождения ID вот в таком JSON: "\_source": { "rules": \[ { "ruleid": "001" "action": "count" } { "ruleid": "003" "action": "count" } \] } Замена значения одного к… --- ## [ES 6.8.2 Search slow when response payload \> 1 MB](https://discuss.elastic.co/t/es-6-8-2-search-slow-when-response-payload-1-mb/200899)
**Author:** [@Javier\_Luque](https://discuss.elastic.co/u/Javier_Luque)\ **Replies:** 2\ **Last updated:** [September 24, 2019, 3:12pm UTC](https://discuss.elastic.co/t/es-6-8-2-search-slow-when-response-payload-1-mb/200899 "2019-09-24T15:12:51Z")
Hi everyone, I was wondering if anyone has encountered this error. Upgraded from 6.5.2 to 6.8.2 and noticed our queries were running slow. Using insomnia to test Elasticsearch I was running some queries and noticed tha… --- ## [Logstash: How to replace field values in JSON based on ID](https://discuss.elastic.co/t/logstash-how-to-replace-field-values-in-json-based-on-id/200850)
**Author:** [@Igor\_Belyakov](https://discuss.elastic.co/u/Igor_Belyakov)\ **Replies:** 2\ **Last updated:** [September 24, 2019, 3:05pm UTC](https://discuss.elastic.co/t/logstash-how-to-replace-field-values-in-json-based-on-id/200850 "2019-09-24T15:05:32Z")
Hello How to replace all occurrences of ID in such JSON: "\_source": { "rules": \[ { "ruleID": "001" "action": "count" } { "ruleID": "003" "action": "count" } \] } Provided that all identifiers are known: 001… --- ## [Logstash to Master Node or Hot Node?](https://discuss.elastic.co/t/logstash-to-master-node-or-hot-node/200868)
**Author:** [@Wilks](https://discuss.elastic.co/u/Wilks)\ **Replies:** 3\ **Last updated:** [September 24, 2019, 2:56pm UTC](https://discuss.elastic.co/t/logstash-to-master-node-or-hot-node/200868 "2019-09-24T14:56:43Z")
Hi, I need some clarification in the Master, Hot Node, Warm Node design I have setup a working cluster with a dedicated master Node thats not set to ingest any data. In my design I have a Hot-Node1 and Hot-Node2 and a… --- ## [Is it possible to change variable names through mapping?](https://discuss.elastic.co/t/is-it-possible-to-change-variable-names-through-mapping/200896)
**Author:** [@planetracer](https://discuss.elastic.co/u/planetracer)\ **Replies:** 0\ **Last updated:** [September 24, 2019, 2:53pm UTC](https://discuss.elastic.co/t/is-it-possible-to-change-variable-names-through-mapping/200896 "2019-09-24T14:53:21Z")
If I have the following: "categories":\[{"category":"TB","totaldur":55},{"category":"CPB","totaldur":568},{"category":"PP","totaldur":23} is it possible to change it so it's like this "categories":\[{"category":"TB","tb… --- ## [AWS S3 bucket ingestion to ES](https://discuss.elastic.co/t/aws-s3-bucket-ingestion-to-es/200890)
**Author:** [@sk545](https://discuss.elastic.co/u/sk545)\ **Replies:** 0\ **Last updated:** [September 24, 2019, 2:39pm UTC](https://discuss.elastic.co/t/aws-s3-bucket-ingestion-to-es/200890 "2019-09-24T14:39:47Z")
I have 20 folders and subfolders in AWS S3 bucket , 1) if i mention that bucket name in logstash's S3 plug-in input settings , does that logstash monitor all folders,subfolders ? 2) How do eliminate unwanted folders/… --- ## [TSVB Descending Order not working as expected](https://discuss.elastic.co/t/tsvb-descending-order-not-working-as-expected/200862)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [September 24, 2019, 2:28pm UTC](https://discuss.elastic.co/t/tsvb-descending-order-not-working-as-expected/200862 "2019-09-24T14:28:04Z")
Hello, For some reason when I create 7.3.2 tsvb timeseries chart and select order by "Max of system.diksio.read.bytes", the legend is not sorted at all: Json export of the visualisation: {"attributes":{"descripti… --- ## [Single node troubleshooting help required](https://discuss.elastic.co/t/single-node-troubleshooting-help-required/200428)
**Author:** [@Ian\_Miller](https://discuss.elastic.co/u/Ian_Miller)\ **Replies:** 2\ **Last updated:** [September 24, 2019, 2:33pm UTC](https://discuss.elastic.co/t/single-node-troubleshooting-help-required/200428 "2019-09-24T14:33:13Z")
Hi, We've had a single node running logstash, elasticsearch and kibana for about six months. Although it wasn't intended to be a production system, it's become essential for troubleshooting - we use it to capture firewa… --- ## [SOAP call in HTTP\_POLLER with body](https://discuss.elastic.co/t/soap-call-in-http-poller-with-body/200885)
**Author:** [@fernrguez](https://discuss.elastic.co/u/fernrguez)\ **Replies:** 2\ **Last updated:** [September 24, 2019, 2:19pm UTC](https://discuss.elastic.co/t/soap-call-in-http-poller-with-body/200885 "2019-09-24T14:19:04Z")
Hello, I'm trying to retrieve logs from a SOAP WS, I tried several options but no luck so far. The main issue is related with the namespaces that requires quotations. I tested several options: Escaping quotes with \\… --- ## [Logstash pipeline with Elasticsearch on Openshift](https://discuss.elastic.co/t/logstash-pipeline-with-elasticsearch-on-openshift/200842)
**Author:** [@ShahafSW](https://discuss.elastic.co/u/ShahafSW)\ **Replies:** 1\ **Last updated:** [September 24, 2019, 2:07pm UTC](https://discuss.elastic.co/t/logstash-pipeline-with-elasticsearch-on-openshift/200842 "2019-09-24T14:07:19Z")
Hey everyone, Usually, I am using curl command to elasticsearch with the following flags: curl --key /PATH/admin-key --cert /PATH/admin-cert --cacert /PATH/admin-ca -XGET "https://ROUTE:PORT" This curl command w… --- ## [Slowness in percolator 7.2](https://discuss.elastic.co/t/slowness-in-percolator-7-2/200256)
**Author:** [@Faiz\_Ahmed\_Mushtak\_H](https://discuss.elastic.co/u/Faiz_Ahmed_Mushtak_H)\ **Replies:** 5\ **Last updated:** [September 24, 2019, 2:01pm UTC](https://discuss.elastic.co/t/slowness-in-percolator-7-2/200256 "2019-09-24T14:01:41Z")
We are migrating from 1.7 to 7.2 ES Our use case of percolator is pretty simple. We have around 120K percolators spread on a 5 node cluster. Percolator docs have meta fields that lets us filter out unnecessary queries t… --- ## [RPM install](https://discuss.elastic.co/t/rpm-install/200886)
**Author:** [@Brendan1](https://discuss.elastic.co/u/Brendan1)\ **Replies:** 0\ **Last updated:** [September 24, 2019, 2:00pm UTC](https://discuss.elastic.co/t/rpm-install/200886 "2019-09-24T14:00:21Z")
We are trying to install a prod cluster using the RPM as root. We want it to run under a specific service account we have created. As per https://github.com/elastic/elasticsearch/issues/8419 . the home directory is ins… --- ## [\_dataparsefailure in tags](https://discuss.elastic.co/t/dataparsefailure-in-tags/200824)
**Author:** [@zebu14](https://discuss.elastic.co/u/zebu14)\ **Replies:** 8\ **Last updated:** [September 24, 2019, 2:00pm UTC](https://discuss.elastic.co/t/dataparsefailure-in-tags/200824 "2019-09-24T14:00:10Z")
Hello, I think this issue is very common but I am still searching for a solution. I have this log line : Mar 9 02:20:42 dvgospxi1 (squid-1): 09/Mar/2017:02:20:42 +0100 - TCP\_DENIED 403 10.117.56.12:47151 3529 GET htt… --- ## [Understanding fielddata size](https://discuss.elastic.co/t/understanding-fielddata-size/199963)
**Author:** [@cwinkler](https://discuss.elastic.co/u/cwinkler)\ **Replies:** 1\ **Last updated:** [September 24, 2019, 1:59pm UTC](https://discuss.elastic.co/t/understanding-fielddata-size/199963 "2019-09-24T13:59:34Z")
We are having a field containing path information like: a\>b\>c\>d The paths usually have a length of 4 segments. The field is defined both as a keyword field and analyzed text using the path-tokenizer. Fielddata is enab… --- ## [Compare two values in a single field of same index](https://discuss.elastic.co/t/compare-two-values-in-a-single-field-of-same-index/200563)
**Author:** [@sampy12345](https://discuss.elastic.co/u/sampy12345)\ **Replies:** 1\ **Last updated:** [September 24, 2019, 1:36pm UTC](https://discuss.elastic.co/t/compare-two-values-in-a-single-field-of-same-index/200563 "2019-09-24T13:36:25Z")
Hi All, I am new to Kibana and wanted to check last 4 hours difference between two values which are in in a single field of same index. Below is a small example My Index have 5 fields ( datetime, state, errorcode, fil… --- ## [Clamp Without Max Value](https://discuss.elastic.co/t/clamp-without-max-value/200667)
**Author:** [@christeven94](https://discuss.elastic.co/u/christeven94)\ **Replies:** 1\ **Last updated:** [September 24, 2019, 1:29pm UTC](https://discuss.elastic.co/t/clamp-without-max-value/200667 "2019-09-24T13:29:46Z")
Hi, Is it possible to CLAMP a value without maximum value? If we could, should I use clamp function or not any other function? Thanks --- ## [Rollover index - not getting progress](https://discuss.elastic.co/t/rollover-index-not-getting-progress/200578)
**Author:** [@Yoav\_Ben\_Moha](https://discuss.elastic.co/u/Yoav_Ben_Moha)\ **Replies:** 0\ **Last updated:** [September 22, 2019, 11:45am UTC](https://discuss.elastic.co/t/rollover-index-not-getting-progress/200578 "2019-09-22T11:45:00Z")
H, I have followed : https://www.elastic.co/guide/en/elasticsearch/reference/master/indices-rollover-index.html#indices-rollover-index I have created an empty index : PUT /%3Ccdr-%7Bnow%2Fd%7D-1%3E { "aliases": { … --- ## [Excel export problem](https://discuss.elastic.co/t/excel-export-problem/200739)
**Author:** [@mr\_searchng](https://discuss.elastic.co/u/mr_searchng)\ **Replies:** 1\ **Last updated:** [September 24, 2019, 1:24pm UTC](https://discuss.elastic.co/t/excel-export-problem/200739 "2019-09-24T13:24:46Z")
In the export part of the graphics in the same column kibana doing. both raw and formatted var. both give the same output. what is the difference --- ## [React app + get no results / Network error](https://discuss.elastic.co/t/react-app-get-no-results-network-error/200871)
**Author:** [@K29](https://discuss.elastic.co/u/K29)\ **Replies:** 0\ **Last updated:** [September 24, 2019, 1:05pm UTC](https://discuss.elastic.co/t/react-app-get-no-results-network-error/200871 "2019-09-24T13:05:31Z")
Hello, I begin to use ElasticSearch, and I need to build a React App to get datas from an index. For this, I use a basic request to call my index : axios.get(url, { auth: { username: 'elastic', … --- ## [Kibana Watcher Requirement for 5.5.2 Version](https://discuss.elastic.co/t/kibana-watcher-requirement-for-5-5-2-version/200631)
**Author:** [@Shubham\_Dhoot](https://discuss.elastic.co/u/Shubham_Dhoot)\ **Replies:** 1\ **Last updated:** [September 24, 2019, 1:02pm UTC](https://discuss.elastic.co/t/kibana-watcher-requirement-for-5-5-2-version/200631 "2019-09-24T13:02:59Z")
Hi, I want to setup Kibana watcher on 5.5.2 version. So to implement it, we just require Platinum License or any other requirements to implement it. Please let me know what all required to implement Kibana Watcher. Th… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1876) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1878)