# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1957 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1958 --- ## [\_geoip\_lookup\_failure though all geoip fields are populated](https://discuss.elastic.co/t/geoip-lookup-failure-though-all-geoip-fields-are-populated/195267)
**Author:** [@nnet](https://discuss.elastic.co/u/nnet)\ **Replies:** 16\ **Last updated:** [August 15, 2019, 1:23pm UTC](https://discuss.elastic.co/t/geoip-lookup-failure-though-all-geoip-fields-are-populated/195267 "2019-08-15T13:23:05Z")
Hi folks, using ELK 5.6.16. I'm attempting to geoip iptables logs. I'm seeing geoip fields being populated, but tags field shows \_geoip\_lookup\_failure as well as the tags I apply in my grok. Input is provided by filebe… --- ## [Drop last bucket not working](https://discuss.elastic.co/t/drop-last-bucket-not-working/195373)
**Author:** [@cbmurphy87](https://discuss.elastic.co/u/cbmurphy87)\ **Replies:** 3\ **Last updated:** [August 15, 2019, 11:07pm UTC](https://discuss.elastic.co/t/drop-last-bucket-not-working/195373 "2019-08-15T23:07:26Z")
I am seeing a lot of zero values using metricbeat, causing readings to be wrong. I have "drop last bucket" selected on the visualization, but it doesn't seem to be working correctly. That feature is supposed to eliminate… --- ## [Is it normal for client nodes in a cluster to have high OS memory usage?](https://discuss.elastic.co/t/is-it-normal-for-client-nodes-in-a-cluster-to-have-high-os-memory-usage/195251)
**Author:** [@John\_Doe1](https://discuss.elastic.co/u/John_Doe1)\ **Replies:** 2\ **Last updated:** [August 15, 2019, 10:33pm UTC](https://discuss.elastic.co/t/is-it-normal-for-client-nodes-in-a-cluster-to-have-high-os-memory-usage/195251 "2019-08-15T22:33:04Z")
I have an elastic cluster with two client nodes. When I look at the /es/\_nodes/stats/os metric, I notice the used\_percent for each of them is around 95% even though elastic and java are the only thing running on the serv… --- ## [Dropping duplicate documents](https://discuss.elastic.co/t/dropping-duplicate-documents/195280)
**Author:** [@Karthik2411](https://discuss.elastic.co/u/Karthik2411)\ **Replies:** 3\ **Last updated:** [August 15, 2019, 10:32pm UTC](https://discuss.elastic.co/t/dropping-duplicate-documents/195280 "2019-08-15T22:32:22Z")
I am able to see that there are two documents from the same report in a span of 30 seconds.How can I get the latest or unique record at that particular time stamp?? --- ## [Compare two columns with fuzziness or slops](https://discuss.elastic.co/t/compare-two-columns-with-fuzziness-or-slops/195286)
**Author:** [@alltheway99](https://discuss.elastic.co/u/alltheway99)\ **Replies:** 2\ **Last updated:** [August 15, 2019, 10:24pm UTC](https://discuss.elastic.co/t/compare-two-columns-with-fuzziness-or-slops/195286 "2019-08-15T22:24:11Z")
Hi, I'm trying to compare two columns such as address1 and address2, but also want to apply fuzziness or slop values. I could get the exact match in the following in Kibana. GET /my\_index/\_search { "query": { "bool"… --- ## [I want to visualize the plots for thread level heap details](https://discuss.elastic.co/t/i-want-to-visualize-the-plots-for-thread-level-heap-details/195366)
**Author:** [@satyam2593](https://discuss.elastic.co/u/satyam2593)\ **Replies:** 1\ **Last updated:** [August 15, 2019, 10:20pm UTC](https://discuss.elastic.co/t/i-want-to-visualize-the-plots-for-thread-level-heap-details/195366 "2019-08-15T22:20:40Z")
i have the documents which contains the thread name, thread-id, cpu & memory details.. I want to plot the graphs for each individual thread for cpu as well as memory... My document looks like as follows @timestamp Sep … --- ## [Newb rsyslogd vs logstash question](https://discuss.elastic.co/t/newb-rsyslogd-vs-logstash-question/195398)
**Author:** [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Replies:** 0\ **Last updated:** [August 15, 2019, 9:41pm UTC](https://discuss.elastic.co/t/newb-rsyslogd-vs-logstash-question/195398 "2019-08-15T21:41:23Z")
Please clear the topic of whether to use rsyslog or logstash itself as the syslog receiver. This thread (https://github.com/elastic/logstash/issues/2965) implies that using ryslog has a great benefit over logstash as a … --- ## [Splitting multiple arrays of objects from a single log](https://discuss.elastic.co/t/splitting-multiple-arrays-of-objects-from-a-single-log/195375)
**Author:** [@daniel\_a](https://discuss.elastic.co/u/daniel_a)\ **Replies:** 6\ **Last updated:** [August 15, 2019, 9:32pm UTC](https://discuss.elastic.co/t/splitting-multiple-arrays-of-objects-from-a-single-log/195375 "2019-08-15T21:32:54Z")
If I need to split multiple arrays of objects from a single log, let's say, I have 3 arrays in a log, let's say something like this: "arrays1" : \[{o1}, {o2}, {o3}, {o4}, {o5}, {o6}\] "arrays2" : \[{ob1}, {ob2}, {ob3}, … --- ## [Static Value as a metric](https://discuss.elastic.co/t/static-value-as-a-metric/195256)
**Author:** [@T\_MP](https://discuss.elastic.co/u/T_MP)\ **Replies:** 1\ **Last updated:** [August 15, 2019, 8:36pm UTC](https://discuss.elastic.co/t/static-value-as-a-metric/195256 "2019-08-15T20:36:35Z")
I have displayed the count of something using a metric visualization but when something is filtered on the page, this number changes to reflect the count after the filter is applied. I would like this number to remain a … --- ## [How to create a repository for ES snapshots](https://discuss.elastic.co/t/how-to-create-a-repository-for-es-snapshots/195383)
**Author:** [@nicks1993](https://discuss.elastic.co/u/nicks1993)\ **Replies:** 0\ **Last updated:** [August 15, 2019, 6:58pm UTC](https://discuss.elastic.co/t/how-to-create-a-repository-for-es-snapshots/195383 "2019-08-15T18:58:40Z")
I am looking to backup my elastic search logs from Kibana. How do I go about this? --- ## [XML ingestion splits object and reads one object as two separate objects creating errors](https://discuss.elastic.co/t/xml-ingestion-splits-object-and-reads-one-object-as-two-separate-objects-creating-errors/195382)
**Author:** [@edster](https://discuss.elastic.co/u/edster)\ **Replies:** 0\ **Last updated:** [August 15, 2019, 6:53pm UTC](https://discuss.elastic.co/t/xml-ingestion-splits-object-and-reads-one-object-as-two-separate-objects-creating-errors/195382 "2019-08-15T18:53:33Z")
Trying to ingest an xml with a format like; \ \\ \\ \ \\ \\ \\ \\ \\ \\ ......(same as above\>) \ **Author:** [@mhare](https://discuss.elastic.co/u/mhare)\ **Replies:** 2\ **Last updated:** [August 15, 2019, 6:44pm UTC](https://discuss.elastic.co/t/need-a-little-help-with-kibana-visualization/194872 "2019-08-15T18:44:44Z") I am using 7.3 of logstash, elasticsearch and kibana on a Windows PC I am ingesting csv from 5 files, which seems to be working. My Filter filter { csv { columns =\> \[ "timestamp","uptime","ramused","memused","memfr… --- ## [Null error with greater-than comparison on an integer field](https://discuss.elastic.co/t/null-error-with-greater-than-comparison-on-an-integer-field/194313)
**Author:** [@datawrangler](https://discuss.elastic.co/u/datawrangler)\ **Replies:** 4\ **Last updated:** [August 15, 2019, 6:21pm UTC](https://discuss.elastic.co/t/null-error-with-greater-than-comparison-on-an-integer-field/194313 "2019-08-15T18:21:06Z")
Hello All, I am getting an error which suggests that my if-statement is trying to do a \> (greater-than) expression comparison against a null value. When I comment out the if-statement everything works as expected. Here… --- ## [Default Sort Order in Constant Score Query](https://discuss.elastic.co/t/default-sort-order-in-constant-score-query/195112)
**Author:** [@Spock\_Tgai](https://discuss.elastic.co/u/Spock_Tgai)\ **Replies:** 4\ **Last updated:** [August 15, 2019, 6:03pm UTC](https://discuss.elastic.co/t/default-sort-order-in-constant-score-query/195112 "2019-08-15T18:03:23Z")
Hi, I wanted to know what is the default sort order for elasticsearch when using a constant score query. Also what is the mechanism for tie breaking. Thanks. --- ## [Logstash date filter for @timestamp and conversion](https://discuss.elastic.co/t/logstash-date-filter-for-timestamp-and-conversion/195368)
**Author:** [@griffer98](https://discuss.elastic.co/u/griffer98)\ **Replies:** 4\ **Last updated:** [August 15, 2019, 5:33pm UTC](https://discuss.elastic.co/t/logstash-date-filter-for-timestamp-and-conversion/195368 "2019-08-15T17:33:15Z")
I currently have a field called time which has a the time my file was created in this format: dd-MM-yyyy\_HHmmss. I would like to change the @timestamp to be the the time of file creation(time from my time field) instead … --- ## [Can't delete index template](https://discuss.elastic.co/t/cant-delete-index-template/194671)
**Author:** [@jwalls](https://discuss.elastic.co/u/jwalls)\ **Replies:** 3\ **Last updated:** [August 14, 2019, 8:45pm UTC](https://discuss.elastic.co/t/cant-delete-index-template/194671 "2019-08-14T20:45:12Z")
Hello, I am having issues with "final mapping would have more than one type" errors, so I checked to see if logstash has multiple templates left over. I have one, logstash-index-template that when trying curl -X DELETE … --- ## [Visualization with multiple gauges gradient issue](https://discuss.elastic.co/t/visualization-with-multiple-gauges-gradient-issue/193559)
**Author:** [@Johnathan\_Herndon](https://discuss.elastic.co/u/Johnathan_Herndon)\ **Replies:** 2\ **Last updated:** [August 15, 2019, 4:40pm UTC](https://discuss.elastic.co/t/visualization-with-multiple-gauges-gradient-issue/193559 "2019-08-15T16:40:51Z")
Hello. I have a visualization with 25+ gauges in it. Most of them are near 100%, they are in 6 rows of 4 and a row of 1. Where we would assume that all would be green, the color gradient of them goes from bright green o… --- ## [RedHat OpenShift fluentd to ECE connection configuration](https://discuss.elastic.co/t/redhat-openshift-fluentd-to-ece-connection-configuration/195230)
**Author:** [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\ **Replies:** 7\ **Last updated:** [August 15, 2019, 3:49pm UTC](https://discuss.elastic.co/t/redhat-openshift-fluentd-to-ece-connection-configuration/195230 "2019-08-15T15:49:38Z")
Does anyone have any experience with getting OpenShift thats using fluentd as an ingest pipeline processor to connect to ECE? Since fluentd is very similar to logstash I have a logstash config that is working, in that i… --- ## [Specify a grok pattern to specific files?](https://discuss.elastic.co/t/specify-a-grok-pattern-to-specific-files/195360)
**Author:** [@cjb312](https://discuss.elastic.co/u/cjb312)\ **Replies:** 4\ **Last updated:** [August 15, 2019, 3:06pm UTC](https://discuss.elastic.co/t/specify-a-grok-pattern-to-specific-files/195360 "2019-08-15T15:06:32Z")
Is there a way to specify a pattern to a specific file? For example I have a filter working for all byte\_count files. I want to add more filters for other files. How would I do this to match the file and pattern combin… --- ## [I am not getting network inbound & outbound traffic details in Kibana dashboard](https://discuss.elastic.co/t/i-am-not-getting-network-inbound-outbound-traffic-details-in-kibana-dashboard/195142)
**Author:** [@vishnuvardhan](https://discuss.elastic.co/u/vishnuvardhan)\ **Replies:** 2\ **Last updated:** [August 15, 2019, 3:05pm UTC](https://discuss.elastic.co/t/i-am-not-getting-network-inbound-outbound-traffic-details-in-kibana-dashboard/195142 "2019-08-15T15:05:33Z")
Actually i created metricbeat pipeline from logstash to elasticsearch. i am getting all metric details in graph except network inbound & outbound traffic details graph.please suggest which metrics and settings i need to … --- ## [Indicators using Data Table VS Visual Builder](https://discuss.elastic.co/t/indicators-using-data-table-vs-visual-builder/195257)
**Author:** [@eStrux-MAB](https://discuss.elastic.co/u/eStrux-MAB)\ **Replies:** 4\ **Last updated:** [August 15, 2019, 2:51pm UTC](https://discuss.elastic.co/t/indicators-using-data-table-vs-visual-builder/195257 "2019-08-15T14:51:12Z")
Hello! I have a set of devices that I monitor, and for which the data lands into Elastic. For context: each of these devices draw electrical power from two sources, and I want to be aware, using a Kibana visualization,… --- ## [Starting Filebeat with Logstash breaks Metricbeat](https://discuss.elastic.co/t/starting-filebeat-with-logstash-breaks-metricbeat/195364)
**Author:** [@carson](https://discuss.elastic.co/u/carson)\ **Replies:** 0\ **Last updated:** [August 15, 2019, 2:49pm UTC](https://discuss.elastic.co/t/starting-filebeat-with-logstash-breaks-metricbeat/195364 "2019-08-15T14:49:57Z")
I'm using a standard configuration for logstash to input from beats and output to elasticsearch. I'm also using a standard Filebeat configuration. Metricbeat works fine, but once I start an instance of Filebeat, the met… --- ## [Load Json to Elasticsearch](https://discuss.elastic.co/t/load-json-to-elasticsearch/195235)
**Author:** [@mkajdos](https://discuss.elastic.co/u/mkajdos)\ **Replies:** 4\ **Last updated:** [August 15, 2019, 2:34pm UTC](https://discuss.elastic.co/t/load-json-to-elasticsearch/195235 "2019-08-15T14:34:45Z")
I am new to Elasticseach and I am on the 7.3.0 release. On the documentation page: https://www.elastic.co/guide/en/elasticsearch/reference/current/getting-started-explore-data.html there is command to load the "account… --- ## [Fetching large data from Elasticsearch in Node.js](https://discuss.elastic.co/t/fetching-large-data-from-elasticsearch-in-node-js/195352)
**Author:** [@purple](https://discuss.elastic.co/u/purple)\ **Replies:** 0\ **Last updated:** [August 15, 2019, 2:09pm UTC](https://discuss.elastic.co/t/fetching-large-data-from-elasticsearch-in-node-js/195352 "2019-08-15T14:09:49Z")
I am fetching about 60,000 documents from an index ABC in Elasticsearch (v7) through their Node.js client. I tried using their recommended Scroll API but it took almost 20s to do so. Next, I increased the max\_wind… --- ## [How to retrieve a string that starts with another string using grok?](https://discuss.elastic.co/t/how-to-retrieve-a-string-that-starts-with-another-string-using-grok/195053)
**Author:** [@Siri\_sour](https://discuss.elastic.co/u/Siri_sour)\ **Replies:** 2\ **Last updated:** [August 15, 2019, 2:00pm UTC](https://discuss.elastic.co/t/how-to-retrieve-a-string-that-starts-with-another-string-using-grok/195053 "2019-08-15T14:00:38Z")
Hi everyone, I just starting working with es and kibana, right now I'm trying to structure this log : 2019-08-13 03:37:49,738 \[default task-28\] ERROR \[org.jboss.jca.core.connectionmanager.listener.TxConnectionListener\]… --- ## [Dedicated data and ingest node](https://discuss.elastic.co/t/dedicated-data-and-ingest-node/195347)
**Author:** [@newbie1](https://discuss.elastic.co/u/newbie1)\ **Replies:** 2\ **Last updated:** [August 15, 2019, 1:33pm UTC](https://discuss.elastic.co/t/dedicated-data-and-ingest-node/195347 "2019-08-15T13:33:01Z")
I have to defined a dedicated data and ingest node, I set node.master to false, do I have to set node.data and node.ingest to true since this is the default ? Note : I looked quickly on the forum and did not see an answ… --- ## [Kibana retention rate metric](https://discuss.elastic.co/t/kibana-retention-rate-metric/194871)
**Author:** [@Richard\_Bao](https://discuss.elastic.co/u/Richard_Bao)\ **Replies:** 4\ **Last updated:** [August 15, 2019, 1:18pm UTC](https://discuss.elastic.co/t/kibana-retention-rate-metric/194871 "2019-08-15T13:18:12Z")
My case is show user use an app retention rate in last 30 day. value = app opened count / total installed app count How to do this by using Kibana? The user schema is as follow, me… --- ## [Nested Json parse failure in logstash?](https://discuss.elastic.co/t/nested-json-parse-failure-in-logstash/195054)
**Author:** [@Abdul\_Gaffar\_Shaikh](https://discuss.elastic.co/u/Abdul_Gaffar_Shaikh)\ **Replies:** 8\ **Last updated:** [August 15, 2019, 7:11am UTC](https://discuss.elastic.co/t/nested-json-parse-failure-in-logstash/195054 "2019-08-15T07:11:00Z")
hi Guys, I am trying to parse my json into logstash and finally into ES, but giving all try i am failing . Could you please help with it input { file{ path =\> "${JSON\_HOME}/\*.json" #path =\> "C:/Users/ashaik13/Dev/sof… --- ## [Remove or disable default fields](https://discuss.elastic.co/t/remove-or-disable-default-fields/195336)
**Author:** [@zbawio](https://discuss.elastic.co/u/zbawio)\ **Replies:** 2\ **Last updated:** [August 15, 2019, 12:30pm UTC](https://discuss.elastic.co/t/remove-or-disable-default-fields/195336 "2019-08-15T12:30:50Z")
Hi i want to know that if we can remove default fields or not in elasticsearch i mean : "\_index" : "iislogs", "\_type" : "\_doc", "\_id" : "G2\_plGwB4leTdzHx29fX",\*\* "\_score" : 1.0, "\_source" :{ "S-Port" : "624… --- ## [Cannot migrate](https://discuss.elastic.co/t/cannot-migrate/195337)
**Author:** [@Aymen\_Ben\_Moussa](https://discuss.elastic.co/u/Aymen_Ben_Moussa)\ **Replies:** 1\ **Last updated:** [August 15, 2019, 12:23pm UTC](https://discuss.elastic.co/t/cannot-migrate/195337 "2019-08-15T12:23:56Z")
I have a Elasticsearch instance running on AWS under EU paris, i'm trying to migrate my instance to elastic cloud but i found out there is not EU paris region in the elastic cloud and therefore i can not migrate ? is the… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1956) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1958)