# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1980 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1981 --- ## [Downgrade from 6.8 to 5.6](https://discuss.elastic.co/t/downgrade-from-6-8-to-5-6/193808)
**Author:** [@tomsk](https://discuss.elastic.co/u/tomsk)\ **Replies:** 2\ **Last updated:** [August 5, 2019, 2:07pm UTC](https://discuss.elastic.co/t/downgrade-from-6-8-to-5-6/193808 "2019-08-05T14:07:47Z")
Hello, Elastic 6.8 works great, but because of 3rd party software we have to downgrade to version 5.6, so l wonder how can l downgrade to 5.6 version. Thank you very much --- ## [Trying to import JSON fails](https://discuss.elastic.co/t/trying-to-import-json-fails/193200)
**Author:** [@elasticHT](https://discuss.elastic.co/u/elasticHT)\ **Replies:** 3\ **Last updated:** [August 5, 2019, 1:50pm UTC](https://discuss.elastic.co/t/trying-to-import-json-fails/193200 "2019-08-05T13:50:36Z")
I'm simply trying to get some data into ES to experiment with. My JSON looks like this (randomly generated names): { "RECORDS":\[ { "fname":"Hyon", "last":"Washko", "addr":"18 Ratliff", "City":"Cabot", "State":"MN" }, {… --- ## [How to put the value of {{ctx.payload.aggregations.bucketAgg.buckets.key}} into Watcher body](https://discuss.elastic.co/t/how-to-put-the-value-of-ctx-payload-aggregations-bucketagg-buckets-key-into-watcher-body/193694)
**Author:** [@isabel](https://discuss.elastic.co/u/isabel)\ **Replies:** 5\ **Last updated:** [August 5, 2019, 1:44pm UTC](https://discuss.elastic.co/t/how-to-put-the-value-of-ctx-payload-aggregations-bucketagg-buckets-key-into-watcher-body/193694 "2019-08-05T13:44:25Z")
Hello :slight\_smile: What i am trying to do is to hand over the value of "{{ctx.payload.aggregations.bucketAgg.buckets.key}}" to the body of my Watcher. However, the value is always empty. But in truth it is not! H… --- ## [Node not connected at org.elasticsearch.transport.TcpTransport.get](https://discuss.elastic.co/t/node-not-connected-at-org-elasticsearch-transport-tcptransport-get/193804)
**Author:** [@MichalF1](https://discuss.elastic.co/u/MichalF1)\ **Replies:** 0\ **Last updated:** [August 5, 2019, 1:26pm UTC](https://discuss.elastic.co/t/node-not-connected-at-org-elasticsearch-transport-tcptransport-get/193804 "2019-08-05T13:26:52Z")
Hello, i have a problem with nodes connections. When i start them everything seems OK and then i try to send to master some data and getting this error. I think problem is at master node but do not know exactly where. I… --- ## [Development cluster bootstrap error](https://discuss.elastic.co/t/development-cluster-bootstrap-error/193533)
**Author:** [@Imrankhan\_Patan](https://discuss.elastic.co/u/Imrankhan_Patan)\ **Replies:** 6\ **Last updated:** [August 5, 2019, 1:19pm UTC](https://discuss.elastic.co/t/development-cluster-bootstrap-error/193533 "2019-08-05T13:19:29Z")
I am trying to start elasticsearch 7.2 in development server after installation. when I started first I saw error related to "master not discovered or elected yet, an election requires two nodes ..", then I have tried t… --- ## [Searching tokenized field containing "." returns unexpected results](https://discuss.elastic.co/t/searching-tokenized-field-containing-returns-unexpected-results/192425)
**Author:** [@nverrill](https://discuss.elastic.co/u/nverrill)\ **Replies:** 2\ **Last updated:** [August 5, 2019, 1:13pm UTC](https://discuss.elastic.co/t/searching-tokenized-field-containing-returns-unexpected-results/192425 "2019-08-05T13:13:10Z")
I have a newly tokenized field of type text for domains. It is a reverse path hierarchy tokenizer on the "." So a field like "adservice.google.com" becomes the following 3 tokens: com google.com adservice.google.com … --- ## [How to allow read only user to report from Kibana](https://discuss.elastic.co/t/how-to-allow-read-only-user-to-report-from-kibana/189807)
**Author:** [@alonsnir](https://discuss.elastic.co/u/alonsnir)\ **Replies:** 9\ **Last updated:** [August 5, 2019, 1:04pm UTC](https://discuss.elastic.co/t/how-to-allow-read-only-user-to-report-from-kibana/189807 "2019-08-05T13:04:03Z")
Hi, I need some of my dashboard read only users to be able to export data. X-Pack documentation says " To access Kibana and generate reports, you need the kibana\_user and reporting\_user roles". The problem is that us… --- ## [SIEM Hosts/All Hosts Tables Empty](https://discuss.elastic.co/t/siem-hosts-all-hosts-tables-empty/189832)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 11\ **Last updated:** [August 5, 2019, 1:03pm UTC](https://discuss.elastic.co/t/siem-hosts-all-hosts-tables-empty/189832 "2019-08-05T13:03:12Z")
Started playing with SIEM after upgrading our Stack and some agents to 7.2. I currently have winlogbeat and auditbeat sending data to our stack. Auditbeat has the host and process modules enabled, winlogbeat is sending… --- ## [Seraching value of variable](https://discuss.elastic.co/t/seraching-value-of-variable/193768)
**Author:** [@RickT](https://discuss.elastic.co/u/RickT)\ **Replies:** 2\ **Last updated:** [August 5, 2019, 12:59pm UTC](https://discuss.elastic.co/t/seraching-value-of-variable/193768 "2019-08-05T12:59:18Z")
hi, i'm searching to compare the value of a variable in a field (from "message" or from a specific field). I'm trying this, but without result : ... filter { mutate { add\_field =\> { "mails" =\> "joe, mary, pierre" } … --- ## [How custom mapping at elasticsearch?](https://discuss.elastic.co/t/how-custom-mapping-at-elasticsearch/193765)
**Author:** [@psanggabuana](https://discuss.elastic.co/u/psanggabuana)\ **Replies:** 5\ **Last updated:** [August 5, 2019, 12:59pm UTC](https://discuss.elastic.co/t/how-custom-mapping-at-elasticsearch/193765 "2019-08-05T12:59:11Z")
I have a problem to showing string variable on grafana graph. I have a error like this: "Fielddata is disabled on text fields by default. Set fielddata=true on \[....\] in order to load fielddata in memory by uninverting… --- ## [Logstash runs out of memory](https://discuss.elastic.co/t/logstash-runs-out-of-memory/193749)
**Author:** [@luc1](https://discuss.elastic.co/u/luc1)\ **Replies:** 0\ **Last updated:** [August 5, 2019, 8:19am UTC](https://discuss.elastic.co/t/logstash-runs-out-of-memory/193749 "2019-08-05T08:19:48Z")
Hello, Here is the issue: My logstash conf file is not sending files to Elasticsearch when it's full: filter{ json { source =\> "message" remove\_field =\>\[ "message" \] } … --- ## [Gork failures](https://discuss.elastic.co/t/gork-failures/193775)
**Author:** [@sharath\_1245](https://discuss.elastic.co/u/sharath_1245)\ **Replies:** 2\ **Last updated:** [August 5, 2019, 12:24pm UTC](https://discuss.elastic.co/t/gork-failures/193775 "2019-08-05T12:24:45Z")
Hi Team, We are getting multiple gork\_failures. Kindly provide how to reduce gork\_failure. --- ## [Data too large, data for \[\\] would be \[10554893106/9.8gb\], which is larger than the limit of \[10092838912/9.3gb\], real usage: \[10523239224/9.8gb\], new bytes reserved: \[31653882/30.1mb\]\]\]\]](https://discuss.elastic.co/t/data-too-large-data-for-transport-request-would-be-10554893106-9-8gb-which-is-larger-than-the-limit-of-10092838912-9-3gb-real-usage-10523239224-9-8gb-new-bytes-reserved-31653882-30-1mb/192215)
**Author:** [@Rakesh4](https://discuss.elastic.co/u/Rakesh4)\ **Replies:** 16\ **Last updated:** [August 5, 2019, 11:54am UTC](https://discuss.elastic.co/t/data-too-large-data-for-transport-request-would-be-10554893106-9-8gb-which-is-larger-than-the-limit-of-10092838912-9-3gb-real-usage-10523239224-9-8gb-new-bytes-reserved-31653882-30-1mb/192215 "2019-08-05T11:54:37Z")
Hi, We have elastic search configuration : version : 7.1.1 3 master node 3 data node 2 coordinating node memory configuration Data node : 64 machine java heap allocation : 10 gb coord : 32 gb java heap aloc … --- ## [How to have \_all mapping in es6 without indexing the source field](https://discuss.elastic.co/t/how-to-have-all-mapping-in-es6-without-indexing-the-source-field/193130)
**Author:** [@Adam\_Hawkins](https://discuss.elastic.co/u/Adam_Hawkins)\ **Replies:** 3\ **Last updated:** [August 5, 2019, 11:43am UTC](https://discuss.elastic.co/t/how-to-have-all-mapping-in-es6-without-indexing-the-source-field/193130 "2019-08-05T11:43:28Z")
I'm trying to index a document that has 1000s of fields, i'm only interested if the search text exists in the document. not searching on the specific field. I understand that v5 had an \_all field which indexed the aggre… --- ## [Logstash grok pattern failed check config](https://discuss.elastic.co/t/logstash-grok-pattern-failed-check-config/189939)
**Author:** [@Dave\_Hafid](https://discuss.elastic.co/u/Dave_Hafid)\ **Replies:** 22\ **Last updated:** [August 5, 2019, 11:29am UTC](https://discuss.elastic.co/t/logstash-grok-pattern-failed-check-config/189939 "2019-08-05T11:29:14Z")
Dear ALL, i try to create ssh grok pattern this is my pattern input { beats { port =\> 5044 host =\> "192.168.11.13" } } # Capture\_all\_MSG filter { if \[fileset\]\[name\] == "auth" { grok { match =\> { "message" =\>… --- ## [How to better design a system where a document language can be changed?](https://discuss.elastic.co/t/how-to-better-design-a-system-where-a-document-language-can-be-changed/193275)
**Author:** [@amitmbm](https://discuss.elastic.co/u/amitmbm)\ **Replies:** 2\ **Last updated:** [August 5, 2019, 11:27am UTC](https://discuss.elastic.co/t/how-to-better-design-a-system-where-a-document-language-can-be-changed/193275 "2019-08-05T11:27:00Z")
I have a legacy system , which stores documents of a specific language in its own index, for example, English based index will store all the documents which have language English, the german-based index will store all t… --- ## [Elasticsearch alarm payload not working](https://discuss.elastic.co/t/elasticsearch-alarm-payload-not-working/193670)
**Author:** [@Piyush\_Safaya](https://discuss.elastic.co/u/Piyush_Safaya)\ **Replies:** 3\ **Last updated:** [August 5, 2019, 11:26am UTC](https://discuss.elastic.co/t/elasticsearch-alarm-payload-not-working/193670 "2019-08-05T11:26:50Z")
I am facing issues when I try to use the Elastic alarm option. I basically want to monitor 1 specific event and once it happens I want contents of the event to be inserted into the new index . Email works fine for me. C… --- ## [How to search exact string in array of string values](https://discuss.elastic.co/t/how-to-search-exact-string-in-array-of-string-values/193564)
**Author:** [@111189](https://discuss.elastic.co/u/111189)\ **Replies:** 1\ **Last updated:** [August 5, 2019, 11:25am UTC](https://discuss.elastic.co/t/how-to-search-exact-string-in-array-of-string-values/193564 "2019-08-05T11:25:30Z")
This is my index { "mappings": { "page": { "properties": { "company-product-skus": { "type": "text", "include\_in\_all": false, "analyzer": "keyword", "index":… --- ## [NoSuchMethodError: org.elasticsearch.common.xcontent.XContentBuilder.string()Ljava/lang/String](https://discuss.elastic.co/t/nosuchmethoderror-org-elasticsearch-common-xcontent-xcontentbuilder-string-ljava-lang-string/193734)
**Author:** [@Vladimir\_Routine](https://discuss.elastic.co/u/Vladimir_Routine)\ **Replies:** 7\ **Last updated:** [August 5, 2019, 11:20am UTC](https://discuss.elastic.co/t/nosuchmethoderror-org-elasticsearch-common-xcontent-xcontentbuilder-string-ljava-lang-string/193734 "2019-08-05T11:20:59Z")
I am using elasticsearch 6.1.1 alongside spring and I am getting the following error NoSuchMethodError: org.elasticsearch.common.xcontent.XContentBuilder.string()Ljava/lang/String what might be the reason? --- ## [Unable to access kibana from my machine](https://discuss.elastic.co/t/unable-to-access-kibana-from-my-machine/193772)
**Author:** [@Ayush\_Verma](https://discuss.elastic.co/u/Ayush_Verma)\ **Replies:** 0\ **Last updated:** [August 5, 2019, 10:41am UTC](https://discuss.elastic.co/t/unable-to-access-kibana-from-my-machine/193772 "2019-08-05T10:41:09Z")
I installed kibana in google vm instance and now I am trying to use kibana from my machine browser : http://35.209.46.170:5601/ This site can't be reached this is the message i am getting. kibana .yml file: # Kibana … --- ## [Using a different Index other than Heartbeat-7.0.0](https://discuss.elastic.co/t/using-a-different-index-other-than-heartbeat-7-0-0/193134)
**Author:** [@PeterPain](https://discuss.elastic.co/u/PeterPain)\ **Replies:** 4\ **Last updated:** [August 5, 2019, 10:30am UTC](https://discuss.elastic.co/t/using-a-different-index-other-than-heartbeat-7-0-0/193134 "2019-08-05T10:30:12Z")
Hey dear Elastic-Team, The documentation gives following specification about how the index should be named for uptime App. Kibana 7.0 requires an index of heartbeat-7\* (containing documents from Heartbeat 7.0). An… --- ## [Path\_match object name Dynamic templates](https://discuss.elastic.co/t/path-match-object-name-dynamic-templates/193715)
**Author:** [@golmartvietnam](https://discuss.elastic.co/u/golmartvietnam)\ **Replies:** 1\ **Last updated:** [August 5, 2019, 9:52am UTC](https://discuss.elastic.co/t/path-match-object-name-dynamic-templates/193715 "2019-08-05T09:52:37Z")
Hello, I created the following dynamic template to apply a custom mapping on the "kubernetes" object and it's subobjects and fields: It should match these: kubernetes.container.name kubernetes.pod.name kubernetes.po… --- ## [How to compare data for 1 hr to the data for the same 1 hour 7 days ago](https://discuss.elastic.co/t/how-to-compare-data-for-1-hr-to-the-data-for-the-same-1-hour-7-days-ago/193313)
**Author:** [@kalyani](https://discuss.elastic.co/u/kalyani)\ **Replies:** 3\ **Last updated:** [August 5, 2019, 9:40am UTC](https://discuss.elastic.co/t/how-to-compare-data-for-1-hr-to-the-data-for-the-same-1-hour-7-days-ago/193313 "2019-08-05T09:40:45Z")
Hello, I have a set of data from an elastic search index for a period of 1 hour today. I want to compare that count with the data for the same 1 hrs but 7days ago. And then calculate the percentage change. Please s… --- ## [NEST result loses aggregates](https://discuss.elastic.co/t/nest-result-loses-aggregates/193589)
**Author:** [@rwb](https://discuss.elastic.co/u/rwb)\ **Replies:** 2\ **Last updated:** [August 5, 2019, 9:15am UTC](https://discuss.elastic.co/t/nest-result-loses-aggregates/193589 "2019-08-05T09:15:52Z")
This is my query { "query":{ "match\_all":{ } }, "size":20, "aggs":{ "CompanyName.raw":{ "terms":{ "field":"CompanyName.raw", "size":20, "order"… --- ## [Logstash ssl error es input --\> output csv](https://discuss.elastic.co/t/logstash-ssl-error-es-input-output-csv/193759)
**Author:** [@subok](https://discuss.elastic.co/u/subok)\ **Replies:** 0\ **Last updated:** [August 5, 2019, 9:12am UTC](https://discuss.elastic.co/t/logstash-ssl-error-es-input-output-csv/193759 "2019-08-05T09:12:43Z")
I'm getting the following error when running a logstash: tric=\>true, charset=\>"UTF-8"\>, size=\>1000, scroll=\>"1m", docinfo=\>false, docinfo\_target=\>"@metadata", docinfo\_fields=\>\["\_index", "\_type", "\_id"\], ssl=\>false\> Err… --- ## [Time builder help](https://discuss.elastic.co/t/time-builder-help/193509)
**Author:** [@Ayden](https://discuss.elastic.co/u/Ayden)\ **Replies:** 2\ **Last updated:** [August 5, 2019, 8:52am UTC](https://discuss.elastic.co/t/time-builder-help/193509 "2019-08-05T08:52:58Z")
Hello I have a doubt about time builder. The data in my index has 1 month and I used 2 intervals 31day and 365day. My question is why the 365day shows me 0% while the 31day shows me correct values. Shouldn't the 365da… --- ## [Count duplicated field value by doc](https://discuss.elastic.co/t/count-duplicated-field-value-by-doc/193567)
**Author:** [@chaymaa](https://discuss.elastic.co/u/chaymaa)\ **Replies:** 2\ **Last updated:** [August 5, 2019, 8:36am UTC](https://discuss.elastic.co/t/count-duplicated-field-value-by-doc/193567 "2019-08-05T08:36:53Z")
Hi All, I have already aggregate and filter my message into elastic search, and i have now a problem to display the results on a kibana bar chart, This is the final filtered message: { "features" =\> \[ \[0\] { "action… --- ## [Urdu language support for ELK](https://discuss.elastic.co/t/urdu-language-support-for-elk/193751)
**Author:** [@asad\_ali](https://discuss.elastic.co/u/asad_ali)\ **Replies:** 0\ **Last updated:** [August 5, 2019, 8:31am UTC](https://discuss.elastic.co/t/urdu-language-support-for-elk/193751 "2019-08-05T08:31:12Z")
Dear Community, I want to know how can I decode content coming from URDU language, I don't see the support of URDU language over the link The closest is arabic but its encoded as "???". Do i need to write custom… --- ## [Info about recovery from snapshots](https://discuss.elastic.co/t/info-about-recovery-from-snapshots/193750)
**Author:** [@anowak](https://discuss.elastic.co/u/anowak)\ **Replies:** 0\ **Last updated:** [August 5, 2019, 8:22am UTC](https://discuss.elastic.co/t/info-about-recovery-from-snapshots/193750 "2019-08-05T08:22:05Z")
Hello Is there any way to get information about all previous status of recovery from snapshot. I tried to use GET /\_recovery?human and GET \_cat/recovery?v but this show me only few latests internal restore process (type… --- ## [Unable to create Custom Kibana Visualisation](https://discuss.elastic.co/t/unable-to-create-custom-kibana-visualisation/193045)
**Author:** [@adityaPsl](https://discuss.elastic.co/u/adityaPsl)\ **Replies:** 4\ **Last updated:** [August 5, 2019, 8:18am UTC](https://discuss.elastic.co/t/unable-to-create-custom-kibana-visualisation/193045 "2019-08-05T08:18:37Z")
Hello Team, I am trying to build Kibana custom visualisation. I am trying to reuse the markdown\_vis from SRC/legacy/core\_plugins , and copied the folder in plugins directory and changed the name from markdown\_vis to cu… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1979) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1981)