# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1894 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1895 --- ## [Logstash not load conf.d directory](https://discuss.elastic.co/t/logstash-not-load-conf-d-directory/199733)
**Author:** [@mcoa](https://discuss.elastic.co/u/mcoa)\ **Replies:** 0\ **Last updated:** [September 16, 2019, 10:00pm UTC](https://discuss.elastic.co/t/logstash-not-load-conf-d-directory/199733 "2019-09-16T22:00:53Z")
Hello, I'm use Logstash v7.3.2-1 on Centos 7. When started the service from systemctl run fine but not load the /etc/logstash/conf.d/ directory . My filter work fine with the "manual" command: /usr/share/logstash/bin… --- ## [Access dynamic array](https://discuss.elastic.co/t/access-dynamic-array/199728)
**Author:** [@Guy\_E\_Bouchard](https://discuss.elastic.co/u/Guy_E_Bouchard)\ **Replies:** 1\ **Last updated:** [September 16, 2019, 9:57pm UTC](https://discuss.elastic.co/t/access-dynamic-array/199728 "2019-09-16T21:57:12Z")
Hi, I can't figure that out, I'm pretty sure I missed something I want to access the last line of this array. "logs" =\> \[ \[0\] 23:33:39 Sep 15, 2019 - Delivered "19-09-15\_23-33-37.127558/file\_01\_01\_01.xml",… --- ## [Auto authenticating kibana iframe without logging in again from external web application](https://discuss.elastic.co/t/auto-authenticating-kibana-iframe-without-logging-in-again-from-external-web-application/199726)
**Author:** [@vishal\_M](https://discuss.elastic.co/u/vishal_M)\ **Replies:** 1\ **Last updated:** [September 16, 2019, 9:55pm UTC](https://discuss.elastic.co/t/auto-authenticating-kibana-iframe-without-logging-in-again-from-external-web-application/199726 "2019-09-16T21:55:32Z")
Hello Team, I have embedded a dashboard into my external web application and able to see the dashboard (1 user). But, Kibana is asking me to enter the credentials every-time manually. I shouldn't enter the Kibana creden… --- ## [Logstash picking up JSON over TCP has non-json 1st line](https://discuss.elastic.co/t/logstash-picking-up-json-over-tcp-has-non-json-1st-line/199338)
**Author:** [@yungnvn](https://discuss.elastic.co/u/yungnvn)\ **Replies:** 2\ **Last updated:** [September 16, 2019, 9:48pm UTC](https://discuss.elastic.co/t/logstash-picking-up-json-over-tcp-has-non-json-1st-line/199338 "2019-09-16T21:48:02Z")
Hi, We are trying to send some metric data over TCP for AIX machines and we are using njmon (a variation of nmon which can send JSON formatted metrics). The way its currently set up, njmon sends the following: B@?=4zG?… --- ## [If I have syslogs from multiple types of devices and multiple ILM policies, how should I structure these?](https://discuss.elastic.co/t/if-i-have-syslogs-from-multiple-types-of-devices-and-multiple-ilm-policies-how-should-i-structure-these/199727)
**Author:** [@wmassingham](https://discuss.elastic.co/u/wmassingham)\ **Replies:** 0\ **Last updated:** [September 16, 2019, 8:59pm UTC](https://discuss.elastic.co/t/if-i-have-syslogs-from-multiple-types-of-devices-and-multiple-ilm-policies-how-should-i-structure-these/199727 "2019-09-16T20:59:58Z")
I have syslogs from multiple types of network devices from multiple customers being processed by logstash. Our end goal is to sell different tiers of data retention. I'm thinking that if we can put a field in the syslog … --- ## [Max\_nodes: 1000](https://discuss.elastic.co/t/max-nodes-1000/199722)
**Author:** [@SirJune](https://discuss.elastic.co/u/SirJune)\ **Replies:** 1\ **Last updated:** [September 16, 2019, 8:32pm UTC](https://discuss.elastic.co/t/max-nodes-1000/199722 "2019-09-16T20:32:52Z")
So i started to add authentication in my POC instance. I ran this "elasticsearch-setup-passwords interactive" and followed the prompt, till it exited with: Unexpected response code \[400\] from calling PUT http://192.168… --- ## [Split email address from existing field into new field without changing original field](https://discuss.elastic.co/t/split-email-address-from-existing-field-into-new-field-without-changing-original-field/199477)
**Author:** [@hueyg](https://discuss.elastic.co/u/hueyg)\ **Replies:** 4\ **Last updated:** [September 16, 2019, 8:10pm UTC](https://discuss.elastic.co/t/split-email-address-from-existing-field-into-new-field-without-changing-original-field/199477 "2019-09-16T20:10:23Z")
I have a working grok filter for a log file just like I want it. Currently the full email is currently parsed into a single field I call "user". I do not want to split this in the original grok unless I have to. I wou… --- ## [Kibana grok debug custom pattern failure](https://discuss.elastic.co/t/kibana-grok-debug-custom-pattern-failure/199655)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 3\ **Last updated:** [September 16, 2019, 8:08pm UTC](https://discuss.elastic.co/t/kibana-grok-debug-custom-pattern-failure/199655 "2019-09-16T20:08:38Z")
Hello I have a grok pattern with multiline pattern. On version 6.x everything worked but since I have migrated to 7.3.0 is not working anymore. I have tried to see if it is still matching in kibana but I always get an er… --- ## [Response time](https://discuss.elastic.co/t/response-time/199698)
**Author:** [@Mohamad-Sobhie](https://discuss.elastic.co/u/Mohamad-Sobhie)\ **Replies:** 3\ **Last updated:** [September 16, 2019, 8:07pm UTC](https://discuss.elastic.co/t/response-time/199698 "2019-09-16T20:07:48Z")
Is there any monitoring tool in kibana to view the response time of queries? --- ## [Logstash custom pattern not working](https://discuss.elastic.co/t/logstash-custom-pattern-not-working/199685)
**Author:** [@user3](https://discuss.elastic.co/u/user3)\ **Replies:** 5\ **Last updated:** [September 16, 2019, 8:06pm UTC](https://discuss.elastic.co/t/logstash-custom-pattern-not-working/199685 "2019-09-16T20:06:22Z")
Hello everyone, New to logstash so please bare with me. My logstash config is not working as desired with a pattern file using regex to pull for very specific text from a log message. From the specific log message, he… --- ## [Type of aggregation?](https://discuss.elastic.co/t/type-of-aggregation/198478)
**Author:** [@SirJune](https://discuss.elastic.co/u/SirJune)\ **Replies:** 3\ **Last updated:** [September 16, 2019, 7:56pm UTC](https://discuss.elastic.co/t/type-of-aggregation/198478 "2019-09-16T19:56:18Z")
Hi, I have these documents in ElasticSearch (single indexname) |datetime|, |label|, |count| 2019-09-06 13:32:18,host1 service1,876 2019-09-06 13:32:18,host1 service1,353 2019-09-06 13:32:18,host2 ser… --- ## [Create Pie Chart in Kibana based on query DSL](https://discuss.elastic.co/t/create-pie-chart-in-kibana-based-on-query-dsl/193162)
**Author:** [@Vladpov](https://discuss.elastic.co/u/Vladpov)\ **Replies:** 13\ **Last updated:** [September 16, 2019, 7:43pm UTC](https://discuss.elastic.co/t/create-pie-chart-in-kibana-based-on-query-dsl/193162 "2019-09-16T19:43:35Z")
Hello everyone, I have this query which mi find all message numbers that have two suffix's GET /my\_index3/\_search { "size": 0, "aggs": { "num1": { "terms": { "field": "n… --- ## [Migrating to Elastic on Azure](https://discuss.elastic.co/t/migrating-to-elastic-on-azure/199719)
**Author:** [@vinitp](https://discuss.elastic.co/u/vinitp)\ **Replies:** 0\ **Last updated:** [September 16, 2019, 7:40pm UTC](https://discuss.elastic.co/t/migrating-to-elastic-on-azure/199719 "2019-09-16T19:40:52Z")
Hi, We have been using ES 6.8 (running on VM on Azure) for some time. Since ES as a Service is available on Azure, we decided to try it out. We use Spring-ElasticSearch framework to connect to the ES instance. The Previ… --- ## [Logstash Filter || Json Message to Split Fields](https://discuss.elastic.co/t/logstash-filter-json-message-to-split-fields/199713)
**Author:** [@deeps](https://discuss.elastic.co/u/deeps)\ **Replies:** 2\ **Last updated:** [September 16, 2019, 7:28pm UTC](https://discuss.elastic.co/t/logstash-filter-json-message-to-split-fields/199713 "2019-09-16T19:28:58Z")
Could someone suggest the best and easy way to split the message into separate fields? I have incoming messages in json format: ex: message {"scenarioName":"x","id":"x","type":"x","source":"x","transaction":"x","appId… --- ## [How do I ensure an index is the first for a document?](https://discuss.elastic.co/t/how-do-i-ensure-an-index-is-the-first-for-a-document/199349)
**Author:** [@jcavalieri](https://discuss.elastic.co/u/jcavalieri)\ **Replies:** 4\ **Last updated:** [September 16, 2019, 7:25pm UTC](https://discuss.elastic.co/t/how-do-i-ensure-an-index-is-the-first-for-a-document/199349 "2019-09-16T19:25:56Z")
In a concurrent system, I believe I understand optimistic locking and passing the version query string parameter along. However, that is only if the document exists. I.e. you can't send ?version=0. What is the equivalent… --- ## [Elasticsearch conversion of string to keyword / text](https://discuss.elastic.co/t/elasticsearch-conversion-of-string-to-keyword-text/199714)
**Author:** [@Deb](https://discuss.elastic.co/u/Deb)\ **Replies:** 0\ **Last updated:** [September 16, 2019, 6:57pm UTC](https://discuss.elastic.co/t/elasticsearch-conversion-of-string-to-keyword-text/199714 "2019-09-16T18:57:05Z")
Can someone let me know what rules do elasticsearch follows to map a string field to text/keyword when an elasticsearch cluster running 2.3 is upgraded to 5.6.16? For example how will the below string properties map to … --- ## [ES Upgrade: v2.3 to v5.6 - why were my indexes renamed like this?](https://discuss.elastic.co/t/es-upgrade-v2-3-to-v5-6-why-were-my-indexes-renamed-like-this/199711)
**Author:** [@tryptych](https://discuss.elastic.co/u/tryptych)\ **Replies:** 1\ **Last updated:** [September 16, 2019, 6:43pm UTC](https://discuss.elastic.co/t/es-upgrade-v2-3-to-v5-6-why-were-my-indexes-renamed-like-this/199711 "2019-09-16T18:43:40Z")
I recently upgraded us from v2.3 to v5.6 (I'm extremely new to ES so go easy on me). Previously my indexes were each in their own directory like so: ls /mnt/store1/elasticsearch/data/graylog/nodes/0/indices/ graylog2\_… --- ## [Newbie in Logstash need suggestion on setting up Logstash on GCP](https://discuss.elastic.co/t/newbie-in-logstash-need-suggestion-on-setting-up-logstash-on-gcp/199710)
**Author:** [@Rahul\_Goyal](https://discuss.elastic.co/u/Rahul_Goyal)\ **Replies:** 0\ **Last updated:** [September 16, 2019, 6:26pm UTC](https://discuss.elastic.co/t/newbie-in-logstash-need-suggestion-on-setting-up-logstash-on-gcp/199710 "2019-09-16T18:26:33Z")
Hey, I have just started using Logstash, and need some guidelines and best practices of running a Logstash pipeline on production. I am familiar with the pipeline.yml and logstash.yml and also have written a basic conf… --- ## [Uptime: "no uptime monitors found" for heartbeat](https://discuss.elastic.co/t/uptime-no-uptime-monitors-found-for-heartbeat/193767)
**Author:** [@andre22](https://discuss.elastic.co/u/andre22)\ **Replies:** 4\ **Last updated:** [September 16, 2019, 3:23pm UTC](https://discuss.elastic.co/t/uptime-no-uptime-monitors-found-for-heartbeat/193767 "2019-09-16T15:23:26Z")
Hi, I am getting the output above when looking at the uptime: As you can see, heartbeat data ist being delivered to Elasticsearch. How can I fix this? EDIT: some more Info: everything is on 7.3.0 heartbeat is on t… --- ## [How many shards for a Single Node?](https://discuss.elastic.co/t/how-many-shards-for-a-single-node/199701)
**Author:** [@Michael\_Ramirez\_Pare](https://discuss.elastic.co/u/Michael_Ramirez_Pare)\ **Replies:** 2\ **Last updated:** [September 16, 2019, 6:12pm UTC](https://discuss.elastic.co/t/how-many-shards-for-a-single-node/199701 "2019-09-16T18:12:07Z")
In our current Env we are running a Single Node Elasticsearch so I set up One Shard and Cero Replica for all my indexes. But there are a suggestions to increment the number of the shards for using more the CPU usage. Mor… --- ## [Docker Updates Causing Issues with the ECE](https://discuss.elastic.co/t/docker-updates-causing-issues-with-the-ece/198131)
**Author:** [@daniel\_a](https://discuss.elastic.co/u/daniel_a)\ **Replies:** 5\ **Last updated:** [September 16, 2019, 5:43pm UTC](https://discuss.elastic.co/t/docker-updates-causing-issues-with-the-ece/198131 "2019-09-16T17:43:10Z")
I noticed connection issues with the ECE after Google updated docker to its latest version "Docker version 19.03.2, build", and right after that everything in the ECE has stopped working. I can still log into the UI, but… --- ## [Read logs using the ELK stack from the remote server](https://discuss.elastic.co/t/read-logs-using-the-elk-stack-from-the-remote-server/199142)
**Author:** [@Konstantin\_Doncov](https://discuss.elastic.co/u/Konstantin_Doncov)\ **Replies:** 11\ **Last updated:** [September 16, 2019, 5:14pm UTC](https://discuss.elastic.co/t/read-logs-using-the-elk-stack-from-the-remote-server/199142 "2019-09-16T17:14:42Z")
I have successfully installed the Elastic stack(Elasticsearch + Logstash + Kibana) and can use it with Logback logs on the local machine. But now I need to read the logs from the remote server. I think there is no need t… --- ## [How to get the original log from winlogbeat?](https://discuss.elastic.co/t/how-to-get-the-original-log-from-winlogbeat/199697)
**Author:** [@Daniel\_Ben\_Hayoun](https://discuss.elastic.co/u/Daniel_Ben_Hayoun)\ **Replies:** 0\ **Last updated:** [September 16, 2019, 4:01pm UTC](https://discuss.elastic.co/t/how-to-get-the-original-log-from-winlogbeat/199697 "2019-09-16T16:01:25Z")
Hi, I'm using winlogbeat to publish event logs to logstash. I mean that the output from winlogbeat is for another machine that runs logstash. The plugin is : input { # tcp { # port =\> 12345 # } beats { port=\> … --- ## [Show the specific field value in a time series spot line](https://discuss.elastic.co/t/show-the-specific-field-value-in-a-time-series-spot-line/197068)
**Author:** [@wl105500396](https://discuss.elastic.co/u/wl105500396)\ **Replies:** 9\ **Last updated:** [September 16, 2019, 3:46pm UTC](https://discuss.elastic.co/t/show-the-specific-field-value-in-a-time-series-spot-line/197068 "2019-09-16T15:46:22Z")
Hi there, I'm stuck for days creating a visulization which shows the specifc field value in a time series spot line. Lets say I have an index named costs, and its docs look like below {"@timestamp": "2019-08-27T09:59:… --- ## [Basic criteria for sorting](https://discuss.elastic.co/t/basic-criteria-for-sorting/199687)
**Author:** [@kguruprasadh](https://discuss.elastic.co/u/kguruprasadh)\ **Replies:** 1\ **Last updated:** [September 16, 2019, 3:37pm UTC](https://discuss.elastic.co/t/basic-criteria-for-sorting/199687 "2019-09-16T15:37:46Z")
I am creating a simple index and trying to sort as follows: { "mappings": { "type\_mapping": { "properties": { "checksort": { "type": "text" } } } } } And I try to sor… --- ## [How to get data or request query from Kibana Dashboard card](https://discuss.elastic.co/t/how-to-get-data-or-request-query-from-kibana-dashboard-card/199538)
**Author:** [@111208](https://discuss.elastic.co/u/111208)\ **Replies:** 1\ **Last updated:** [September 16, 2019, 3:31pm UTC](https://discuss.elastic.co/t/how-to-get-data-or-request-query-from-kibana-dashboard-card/199538 "2019-09-16T15:31:01Z")
I search Kibana REST API. In saved\_objects API, there is no data or query information just VIZ params. I'm testing with "kibana\_sample\_data\_flights" sample data. In Kibana Dashboard, I can get Request Parameters throu… --- ## [ElasticSearch 7.3 ClusterFormationFailureHelper master not discovered yet, this n ode has not previously joined a bootstrapped (v7+) cluster, and this node must discover master-eligible nodes](https://discuss.elastic.co/t/elasticsearch-7-3-clusterformationfailurehelper-master-not-discovered-yet-this-n-ode-has-not-previously-joined-a-bootstrapped-v7-cluster-and-this-node-must-discover-master-eligible-nodes/199680)
**Author:** [@alxdaly](https://discuss.elastic.co/u/alxdaly)\ **Replies:** 1\ **Last updated:** [September 16, 2019, 3:11pm UTC](https://discuss.elastic.co/t/elasticsearch-7-3-clusterformationfailurehelper-master-not-discovered-yet-this-n-ode-has-not-previously-joined-a-bootstrapped-v7-cluster-and-this-node-must-discover-master-eligible-nodes/199680 "2019-09-16T15:11:10Z")
I'm trying to setup 2 nodes using the same instance on a single server. I've been trying to base this on how our ElasticSearch 5.x server was configured but for the most recent version. When trying to start up each insta… --- ## [Logstash pattern does not work after being upgraded to 7.3.0](https://discuss.elastic.co/t/logstash-pattern-does-not-work-after-being-upgraded-to-7-3-0/199681)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 0\ **Last updated:** [September 16, 2019, 2:45pm UTC](https://discuss.elastic.co/t/logstash-pattern-does-not-work-after-being-upgraded-to-7-3-0/199681 "2019-09-16T14:45:41Z")
Hello, I am trying to separate java pattern into fields. I have the following pattern set up with custom pattern setup in order to be able to process multiline fields. However since I have upgraded logstash to 7.3.0 th… --- ## [Indexing PDFs directly](https://discuss.elastic.co/t/indexing-pdfs-directly/199124)
**Author:** [@jtgajda](https://discuss.elastic.co/u/jtgajda)\ **Replies:** 3\ **Last updated:** [September 16, 2019, 2:44pm UTC](https://discuss.elastic.co/t/indexing-pdfs-directly/199124 "2019-09-16T14:44:40Z")
I was able to upload 1650 PDF documents into Elasticsearch using the ingestor plugin. However, it looks like I am locked into the schema that was generated and am also not happy with search performance. As such, I am t… --- ## [The same query is really slow 20% of the time](https://discuss.elastic.co/t/the-same-query-is-really-slow-20-of-the-time/198483)
**Author:** [@rickbenchsci](https://discuss.elastic.co/u/rickbenchsci)\ **Replies:** 10\ **Last updated:** [September 16, 2019, 2:26pm UTC](https://discuss.elastic.co/t/the-same-query-is-really-slow-20-of-the-time/198483 "2019-09-16T14:26:10Z")
When running some of our msearch queries, the response time is usually around 500ms. However about 20% of the time the response time skyrockets to anywhere between 2000ms to 13000ms. The index has about 120GB data, 20 s… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1893) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1895)