# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1926 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1927 --- ## [Pipeline config error](https://discuss.elastic.co/t/pipeline-config-error/197525)
**Author:** [@Philip\_Thomson1](https://discuss.elastic.co/u/Philip_Thomson1)\ **Replies:** 8\ **Last updated:** [August 30, 2019, 5:48pm UTC](https://discuss.elastic.co/t/pipeline-config-error/197525 "2019-08-30T17:48:28Z")
Maybe I have been staring at this too long and need another set of eyes to point out something silly.. Using logstash 7.3.1 started using pipelines, I have one running, but two defined, I get an error in the debug logs… --- ## [Runaway Resource Usage](https://discuss.elastic.co/t/runaway-resource-usage/197560)
**Author:** [@j-rewerts](https://discuss.elastic.co/u/j-rewerts)\ **Replies:** 2\ **Last updated:** [August 30, 2019, 5:36pm UTC](https://discuss.elastic.co/t/runaway-resource-usage/197560 "2019-08-30T17:36:33Z")
Hi! I've deployed a cluster following this guide to Kubernetes in GKE. One of my ES nodes was evicted for using too much memory. I wasn't running anything overnight on the cluster. How can I ensure Elasticsearch do… --- ## [Remove weekends from Timelion or Timeseries](https://discuss.elastic.co/t/remove-weekends-from-timelion-or-timeseries/197542)
**Author:** [@calvinAtSelerity](https://discuss.elastic.co/u/calvinAtSelerity)\ **Replies:** 1\ **Last updated:** [August 30, 2019, 5:34pm UTC](https://discuss.elastic.co/t/remove-weekends-from-timelion-or-timeseries/197542 "2019-08-30T17:34:12Z")
New to Kibana and Elasticsearch, and need some help. We have documents that are mainly created during the week, and very small number of documents on the weekend. When document is created we mark each document with day… --- ## [Attempting to perform aggregation script on ES buckets](https://discuss.elastic.co/t/attempting-to-perform-aggregation-script-on-es-buckets/197155)
**Author:** [@Arty\_Sidorenko](https://discuss.elastic.co/u/Arty_Sidorenko)\ **Replies:** 1\ **Last updated:** [August 30, 2019, 5:29pm UTC](https://discuss.elastic.co/t/attempting-to-perform-aggregation-script-on-es-buckets/197155 "2019-08-30T17:29:54Z")
Hi, I'm trying to use a bucket script to calculate the proportion of total of one of my buckets (query snippet below). I was getting an error of type "Only sibling pipeline aggregations are allowed at the top level" so… --- ## [Index.blocks.read\_only vs Frozen indices](https://discuss.elastic.co/t/index-blocks-read-only-vs-frozen-indices/196994)
**Author:** [@Karthik\_Ramachandran](https://discuss.elastic.co/u/Karthik_Ramachandran)\ **Replies:** 1\ **Last updated:** [August 30, 2019, 5:14pm UTC](https://discuss.elastic.co/t/index-blocks-read-only-vs-frozen-indices/196994 "2019-08-30T17:14:24Z")
Trying to clarify between read-only and frozen indices. We have a indice setting index.blocks.read\_only, and also have Freezing option. Freezing helps with heap, but trying to understand not freezing and setting only th… --- ## [Nearly 50% shards marked as 'unassigned' after cluster restart](https://discuss.elastic.co/t/nearly-50-shards-marked-as-unassigned-after-cluster-restart/197012)
**Author:** [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\ **Replies:** 2\ **Last updated:** [August 30, 2019, 5:06pm UTC](https://discuss.elastic.co/t/nearly-50-shards-marked-as-unassigned-after-cluster-restart/197012 "2019-08-30T17:06:53Z")
Working cluster running in Kubernetes. This morning I updated k8 + docker and this meant restarting the master node(s) which meant restarting everything. (thread) This is a familiar process - we've done it pretty regular… --- ## [Problem with ELK Cluster, Unassigned Shards](https://discuss.elastic.co/t/problem-with-elk-cluster-unassigned-shards/197470)
**Author:** [@Volodymyr\_Zarytskyy](https://discuss.elastic.co/u/Volodymyr_Zarytskyy)\ **Replies:** 1\ **Last updated:** [August 30, 2019, 4:55pm UTC](https://discuss.elastic.co/t/problem-with-elk-cluster-unassigned-shards/197470 "2019-08-30T16:55:08Z")
Hi, I need help with an ELK cluster. I'm new at this. I have a cluster formed by 3 Logstash nodes, 3 Elasticsearch nodes and 1 Kibana node. A week ago the Elasticsearch nodes had no space and didn't let you authenticat… --- ## [Search template into painless script](https://discuss.elastic.co/t/search-template-into-painless-script/196553)
**Author:** [@mattia\_conversano](https://discuss.elastic.co/u/mattia_conversano)\ **Replies:** 1\ **Last updated:** [August 30, 2019, 4:52pm UTC](https://discuss.elastic.co/t/search-template-into-painless-script/196553 "2019-08-30T16:52:58Z")
Hi Team, I'm new with Elasticsearch, I'll explain my problem; I currently have two types of documents in the "modsec" index the first has (in its fields) an array of strings like this: "m\_data": \[ "test@test.it' a… --- ## [Does using a script in elastic output plugin for Logstash impact's performance](https://discuss.elastic.co/t/does-using-a-script-in-elastic-output-plugin-for-logstash-impacts-performance/197547)
**Author:** [@Rahul\_Goyal](https://discuss.elastic.co/u/Rahul_Goyal)\ **Replies:** 1\ **Last updated:** [August 30, 2019, 4:43pm UTC](https://discuss.elastic.co/t/does-using-a-script-in-elastic-output-plugin-for-logstash-impacts-performance/197547 "2019-08-30T16:43:51Z")
Hi, I am trying to insert data from multiple Kafka topics to ES. However, there are scenarios where I need to append message in an existing array or update message in multiple JSON documents, for which I am using the "s… --- ## [Histogram aggregation on collapse result](https://discuss.elastic.co/t/histogram-aggregation-on-collapse-result/197440)
**Author:** [@mybluedog24](https://discuss.elastic.co/u/mybluedog24)\ **Replies:** 3\ **Last updated:** [August 30, 2019, 4:37pm UTC](https://discuss.elastic.co/t/histogram-aggregation-on-collapse-result/197440 "2019-08-30T16:37:54Z")
Hi, My question is that I need to find the first time login of each user, and then apply date\_histogram aggregation. I tried top\_hits aggregation, min aggregation and collapse. They all get the first time login of each … --- ## [Can we use SQL Join in elastic query?](https://discuss.elastic.co/t/can-we-use-sql-join-in-elastic-query/196378)
**Author:** [@Sajal](https://discuss.elastic.co/u/Sajal)\ **Replies:** 28\ **Last updated:** [August 30, 2019, 4:14pm UTC](https://discuss.elastic.co/t/can-we-use-sql-join-in-elastic-query/196378 "2019-08-30T16:14:40Z")
Hi Can we use join function in elastic query ? I want to join two indexes with one common field . How to do that ? BR// Sajal --- ## [Simulate recovery from snapshot](https://discuss.elastic.co/t/simulate-recovery-from-snapshot/197549)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 1\ **Last updated:** [August 30, 2019, 4:08pm UTC](https://discuss.elastic.co/t/simulate-recovery-from-snapshot/197549 "2019-08-30T16:08:25Z")
hi, I would like to know if you have any suggestion regarding the possibility to simulate a disaster event after which I should use snapshot recovery. I mean, is there a way to simulate the last part (restore operation… --- ## [Configuring Synonyms.txt in AWS hosted elastic search](https://discuss.elastic.co/t/configuring-synonyms-txt-in-aws-hosted-elastic-search/196947)
**Author:** [@selvarap1](https://discuss.elastic.co/u/selvarap1)\ **Replies:** 1\ **Last updated:** [August 30, 2019, 4:05pm UTC](https://discuss.elastic.co/t/configuring-synonyms-txt-in-aws-hosted-elastic-search/196947 "2019-08-30T16:05:28Z")
I am trying to upload sysnonyms.txt in AWS hosted elastic search, but I couldn't find any feasible way to do that. All I have tried is the following. I am not supposed to use inline sysnonym, since i have a huge list of… --- ## [Kibana Create Index pattern is in hanging state- Version 6.4.2](https://discuss.elastic.co/t/kibana-create-index-pattern-is-in-hanging-state-version-6-4-2/197104)
**Author:** [@Manya\_Goyal](https://discuss.elastic.co/u/Manya_Goyal)\ **Replies:** 3\ **Last updated:** [August 30, 2019, 3:49pm UTC](https://discuss.elastic.co/t/kibana-create-index-pattern-is-in-hanging-state-version-6-4-2/197104 "2019-08-30T15:49:43Z")
Hi Team, I am facing issue while creating index pattern, i already have few index patterns created but not able to create now. My developer console logs have error- Please help me , thanks in advance --- ## [How to get current open shards?](https://discuss.elastic.co/t/how-to-get-current-open-shards/197528)
**Author:** [@Dmitry1](https://discuss.elastic.co/u/Dmitry1)\ **Replies:** 3\ **Last updated:** [August 30, 2019, 2:55pm UTC](https://discuss.elastic.co/t/how-to-get-current-open-shards/197528 "2019-08-30T14:55:58Z")
Hello, can't find where I can to see current open shards ? I want to make monitoring to avoid cases like this: this cluster currently has \[999\]/\[1000\] maximum shards open I can get maximum limit - max\_shards\_per\_node … --- ## [Mapping ip address to geolocation](https://discuss.elastic.co/t/mapping-ip-address-to-geolocation/197136)
**Author:** [@gr1sha](https://discuss.elastic.co/u/gr1sha)\ **Replies:** 11\ **Last updated:** [August 30, 2019, 3:34pm UTC](https://discuss.elastic.co/t/mapping-ip-address-to-geolocation/197136 "2019-08-30T15:34:10Z")
Hi there. I am trying to create a region map so that I can see the activity of users from different countries. I have an ip address field in my index and what I am trying to do is map it to geoip location to get fields l… --- ## [Unexpected character ('\<' (code 60)) - different behavior - ES cloud](https://discuss.elastic.co/t/unexpected-character-code-60-different-behavior-es-cloud/197535)
**Author:** [@hborda](https://discuss.elastic.co/u/hborda)\ **Replies:** 2\ **Last updated:** [August 30, 2019, 3:24pm UTC](https://discuss.elastic.co/t/unexpected-character-code-60-different-behavior-es-cloud/197535 "2019-08-30T15:24:03Z")
We read most of what have been written about the topic, we tried many permutations and we can't successfully make logstash to work: Here is the console output start ----------------- C:\\Deleteme\\es\_logstash\>C:\\Softwar… --- ## [Identifying which node serviced a request via load balancer](https://discuss.elastic.co/t/identifying-which-node-serviced-a-request-via-load-balancer/197544)
**Author:** [@jmb](https://discuss.elastic.co/u/jmb)\ **Replies:** 0\ **Last updated:** [August 30, 2019, 3:15pm UTC](https://discuss.elastic.co/t/identifying-which-node-serviced-a-request-via-load-balancer/197544 "2019-08-30T15:15:33Z")
We have our cluster behind a generic HTTP load balancer, so can't readily determine which node a request is hitting initially. Is there any straightforward way to identify from an API response, which node actually servic… --- ## [Unable to use the app generated timestamp in logstash](https://discuss.elastic.co/t/unable-to-use-the-app-generated-timestamp-in-logstash/197531)
**Author:** [@chimbu3306](https://discuss.elastic.co/u/chimbu3306)\ **Replies:** 3\ **Last updated:** [August 30, 2019, 3:11pm UTC](https://discuss.elastic.co/t/unable-to-use-the-app-generated-timestamp-in-logstash/197531 "2019-08-30T15:11:55Z")
I have the below log file created by the application and the timestamp value is recorded in "@timestamp" but logstash is unable to use that timestamp and failing to push this value to elasticsearch { "@timestamp": "2019… --- ## [Execute scripted field on latest document instead of oldest?](https://discuss.elastic.co/t/execute-scripted-field-on-latest-document-instead-of-oldest/197245)
**Author:** [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Replies:** 1\ **Last updated:** [August 30, 2019, 3:07pm UTC](https://discuss.elastic.co/t/execute-scripted-field-on-latest-document-instead-of-oldest/197245 "2019-08-30T15:07:35Z")
Hi, I have this scripted field that calculates the delay of incoming data. I'm made a table viz with unique count on the name field, the split it with a terms bucket for the name and a term for the delay below that. The… --- ## [Environment variables in if..then logic](https://discuss.elastic.co/t/environment-variables-in-if-then-logic/197099)
**Author:** [@pgf](https://discuss.elastic.co/u/pgf)\ **Replies:** 4\ **Last updated:** [August 30, 2019, 2:53pm UTC](https://discuss.elastic.co/t/environment-variables-in-if-then-logic/197099 "2019-08-30T14:53:06Z")
I am using a number of environment variables in my logstash config which all work well, except for one. In my output section I am trying to use a variable in an if.. then statement and it does not appear to be working. P… --- ## [How to create an histogram of string occurences over all log entries?](https://discuss.elastic.co/t/how-to-create-an-histogram-of-string-occurences-over-all-log-entries/196962)
**Author:** [@s7ygian](https://discuss.elastic.co/u/s7ygian)\ **Replies:** 3\ **Last updated:** [August 30, 2019, 2:53pm UTC](https://discuss.elastic.co/t/how-to-create-an-histogram-of-string-occurences-over-all-log-entries/196962 "2019-08-30T14:53:05Z")
Hi everyone, I have the following 3 exemplary and very simple log entries: textA textB textC; textA textB textC textA textB; textA textB textA; textA Now I want to create a histogram in Kibana with the following exe… --- ## [Kibana not loading properly. Check the server output for more information](https://discuss.elastic.co/t/kibana-not-loading-properly-check-the-server-output-for-more-information/194011)
**Author:** [@Peter\_Holm](https://discuss.elastic.co/u/Peter_Holm)\ **Replies:** 4\ **Last updated:** [August 30, 2019, 2:45pm UTC](https://discuss.elastic.co/t/kibana-not-loading-properly-check-the-server-output-for-more-information/194011 "2019-08-30T14:45:32Z")
I have Elasticsearch 7.2 and Kibana 7.2 on a RedHat 7.4 zLinux. I can access the Kibana from any host on the same VLAN, either with port 5601 or nginx port 9000, but when I try to access from outside the VLAN it fails wi… --- ## [Having trouble ingesting a ModSsecurity log VIA TCP..sort of](https://discuss.elastic.co/t/having-trouble-ingesting-a-modssecurity-log-via-tcp-sort-of/197527)
**Author:** [@SigmazGFX](https://discuss.elastic.co/u/SigmazGFX)\ **Replies:** 2\ **Last updated:** [August 30, 2019, 2:22pm UTC](https://discuss.elastic.co/t/having-trouble-ingesting-a-modssecurity-log-via-tcp-sort-of/197527 "2019-08-30T14:22:20Z")
Hey guys.. I'm really hoping that someone here can help me out. I'm working with a Sophos XG firewall that uses Modsecurity as the reverse proxy WAF engine. Because of support contract restrictions and also the locked … --- ## [How to remove \\n and \\t chars when using FS Crawler?](https://discuss.elastic.co/t/how-to-remove-n-and-t-chars-when-using-fs-crawler/197194)
**Author:** [@Danilo\_Felix](https://discuss.elastic.co/u/Danilo_Felix)\ **Replies:** 2\ **Last updated:** [August 30, 2019, 1:56pm UTC](https://discuss.elastic.co/t/how-to-remove-n-and-t-chars-when-using-fs-crawler/197194 "2019-08-30T13:56:30Z")
Hello all, I'm new with FS Crawler, so please be patient with me. Using version 2.6, I'm crawling many files from a big Windows's folders tree. There are PDF, XLS, DOC, etc. It's working, but the content attribute goe… --- ## [Java home](https://discuss.elastic.co/t/java-home/196509)
**Author:** [@mylyo](https://discuss.elastic.co/u/mylyo)\ **Replies:** 1\ **Last updated:** [August 30, 2019, 1:54pm UTC](https://discuss.elastic.co/t/java-home/196509 "2019-08-30T13:54:54Z")
Hello, i'm working on elastic 7.2 install on redhat 7.6. My problem is that my service couldn't start due to error about java home. when i launch my service it return : could not find java in JAVA\_HOME or bundeled at /e… --- ## [Elasticsearch query result order based on matching position](https://discuss.elastic.co/t/elasticsearch-query-result-order-based-on-matching-position/196450)
**Author:** [@PrasathRajan](https://discuss.elastic.co/u/PrasathRajan)\ **Replies:** 1\ **Last updated:** [August 30, 2019, 1:44pm UTC](https://discuss.elastic.co/t/elasticsearch-query-result-order-based-on-matching-position/196450 "2019-08-30T13:44:05Z")
I have two sentences. Model text Jug Model if I query for 'model' or 'del' result is coming in below order Jug Model Model Text Is there any way I can get "Model Text" first, since its the best match. I know about … --- ## [LogStash::ConfigurationError", :message=\>"Expected one of #, input, filter, output at line 1, column 1 (byte 1)](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-input-filter-output-at-line-1-column-1-byte-1/197447)
**Author:** [@shan\_usa](https://discuss.elastic.co/u/shan_usa)\ **Replies:** 1\ **Last updated:** [August 30, 2019, 1:22pm UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-input-filter-output-at-line-1-column-1-byte-1/197447 "2019-08-30T13:22:25Z")
Hi , I am trying pull data from oracle table to elastic search but i am getting below error, Any one please tell me how to fix this issue. conf file : input { jdbc { jdbc\_driver\_library =\> "C:\\Product\\SabaWeb\\lib\\o… --- ## [Duplicate entries while using mutate](https://discuss.elastic.co/t/duplicate-entries-while-using-mutate/197413)
**Author:** [@humartinez](https://discuss.elastic.co/u/humartinez)\ **Replies:** 4\ **Last updated:** [August 30, 2019, 1:08pm UTC](https://discuss.elastic.co/t/duplicate-entries-while-using-mutate/197413 "2019-08-30T13:08:37Z")
Hi there! Im having a issue (random I think) when using mutate and split. This is my logstash config input { kafka { bootstrap\_servers =\> "localhost:9092" topics =\> \["topic"\] } } filter { mutate { … --- ## [How to select specific field value](https://discuss.elastic.co/t/how-to-select-specific-field-value/197473)
**Author:** [@Skiloop\_Shi](https://discuss.elastic.co/u/Skiloop_Shi)\ **Replies:** 2\ **Last updated:** [August 30, 2019, 12:49pm UTC](https://discuss.elastic.co/t/how-to-select-specific-field-value/197473 "2019-08-30T12:49:52Z")
For example: How to turn {"name":"James","location":{"city":"A City","address":""}} into {"city":"A City","address":""} [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1925) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1927)