# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=331 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 332 --- ## [Need help dropping specific messages](https://discuss.elastic.co/t/need-help-dropping-specific-messages/339441)
**Author:** [@RJC](https://discuss.elastic.co/u/RJC)\ **Replies:** 4\ **Last updated:** [July 28, 2023, 12:31pm UTC](https://discuss.elastic.co/t/need-help-dropping-specific-messages/339441 "2023-07-28T12:31:15Z")
My logstash server generates the following messages every time it is restarted: {"syslog\_severity\_code":5,"syslog\_severity":"notice","syslog\_facility\_code":1,"message":"\\u0000\\u0016\\u0000\\u0014\\u0000\\u0017\\u0000\\u0018\\u… --- ## [Colors for line graph](https://discuss.elastic.co/t/colors-for-line-graph/339370)
**Author:** [@Rushi\_Bagul](https://discuss.elastic.co/u/Rushi_Bagul)\ **Replies:** 2\ **Last updated:** [July 28, 2023, 11:24am UTC](https://discuss.elastic.co/t/colors-for-line-graph/339370 "2023-07-28T11:24:36Z")
I want to create line chart or area with different background colors on specific areas as per following image. Can anyone tell me how it is possible? Suggest me to better approach --- ## [Ingest sharepoint on premises files to elk](https://discuss.elastic.co/t/ingest-sharepoint-on-premises-files-to-elk/339522)
**Author:** [@sunny2502](https://discuss.elastic.co/u/sunny2502)\ **Replies:** 1\ **Last updated:** [July 28, 2023, 9:54am UTC](https://discuss.elastic.co/t/ingest-sharepoint-on-premises-files-to-elk/339522 "2023-07-28T09:54:22Z")
Hi I want to ingest data from local sharepoint to elastic using python, can anyone please help me in same. --- ## [Logstash - GCP cloud storage Output plugin](https://discuss.elastic.co/t/logstash-gcp-cloud-storage-output-plugin/339524)
**Author:** [@Luko](https://discuss.elastic.co/u/Luko)\ **Replies:** 0\ **Last updated:** [July 28, 2023, 9:48am UTC](https://discuss.elastic.co/t/logstash-gcp-cloud-storage-output-plugin/339524 "2023-07-28T09:48:21Z")
Hello Does Losgatsh Output plugin - google\_cloud\_storage, support the action based on the content of the field. I want to do something like that: output { google\_cloud\_storage { bucket =\> "bucket\_name/%{… --- ## [No data Alert](https://discuss.elastic.co/t/no-data-alert/338315)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 18\ **Last updated:** [July 28, 2023, 9:27am UTC](https://discuss.elastic.co/t/no-data-alert/338315 "2023-07-28T09:27:40Z")
Hi Team, We want to create alert if no data is receiving is from last 15 minute. We have tried with the watcher it worked for us but we can't go as in watcher the alert status does not change like as in alert we have ac… --- ## [TSVB and interval issue](https://discuss.elastic.co/t/tsvb-and-interval-issue/339516)
**Author:** [@vincent2mots](https://discuss.elastic.co/u/vincent2mots)\ **Replies:** 0\ **Last updated:** [July 28, 2023, 9:14am UTC](https://discuss.elastic.co/t/tsvb-and-interval-issue/339516 "2023-07-28T09:14:20Z")
Hi there! I'm using a 7.12 version of Elasticsearch Stack and I'm struggling with TSVB. I'm using the following formula : (params.bytes \* 8) / (params.\_interval / 1000) as shown bellow : However, when I see my area… --- ## [Rolling vs. Cluster Upgrades](https://discuss.elastic.co/t/rolling-vs-cluster-upgrades/339424)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 1\ **Last updated:** [July 28, 2023, 8:06am UTC](https://discuss.elastic.co/t/rolling-vs-cluster-upgrades/339424 "2023-07-28T08:06:30Z")
I'm wanting to better understand when to perform a full-cluster restart upgrade vs. a rolling upgrade of ES. I understand that a rolling upgrade has the benefit of minimizing impact to services during the upgrade (with t… --- ## [Memory consumption in io.netty.buffer.PoolThreadCache](https://discuss.elastic.co/t/memory-consumption-in-io-netty-buffer-poolthreadcache/339412)
**Author:** [@liguifa](https://discuss.elastic.co/u/liguifa)\ **Replies:** 10\ **Last updated:** [July 28, 2023, 8:02am UTC](https://discuss.elastic.co/t/memory-consumption-in-io-netty-buffer-poolthreadcache/339412 "2023-07-28T08:02:13Z")
Hi guys, I'm facing a large memory consumption in io.netty.buffer.PoolThreadCache. This portion of memory can reach up to 5GB. I think this is abnormal /usr/share/elasticsearch/jdk/bin/java -Xshare:auto -Des.networ… --- ## ["stacktrace": \["org.apache.lucene.index.CorruptIndexException: compound sub-files must have a valid codec header and footer: file is too small (0 bytes) (resource=BufferedChecksumIndexInput)](https://discuss.elastic.co/t/stacktrace-org-apache-lucene-index-corruptindexexception-compound-sub-files-must-have-a-valid-codec-header-and-footer-file-is-too-small-0-bytes-resource-bufferedchecksumindexinput/338323)
**Author:** [@Aravindh\_M](https://discuss.elastic.co/u/Aravindh_M)\ **Replies:** 21\ **Last updated:** [July 28, 2023, 8:00am UTC](https://discuss.elastic.co/t/stacktrace-org-apache-lucene-index-corruptindexexception-compound-sub-files-must-have-a-valid-codec-header-and-footer-file-is-too-small-0-bytes-resource-bufferedchecksumindexinput/338323 "2023-07-28T08:00:43Z")
Recently, we have been encountering the "CorruptIndexException" frequently, accompanied by the following stacktrace: "org.apache.lucene.index.CorruptIndexException: compound sub-files must have a valid codec header and f… --- ## [Total count of a field](https://discuss.elastic.co/t/total-count-of-a-field/339289)
**Author:** [@Dana\_Pavaday](https://discuss.elastic.co/u/Dana_Pavaday)\ **Replies:** 6\ **Last updated:** [July 28, 2023, 7:04am UTC](https://discuss.elastic.co/t/total-count-of-a-field/339289 "2023-07-28T07:04:43Z")
Hello everyone, I need to get the total count of a field in Elasticsearch (in my case, the number of clients in client field). How do I write the query in Dev tools? --- ## [Metrics don't send after some time to Elasticsearch - Temp. bulk send fail](https://discuss.elastic.co/t/metrics-dont-send-after-some-time-to-elasticsearch-temp-bulk-send-fail/339500)
**Author:** [@Swathi12](https://discuss.elastic.co/u/Swathi12)\ **Replies:** 0\ **Last updated:** [July 28, 2023, 6:41am UTC](https://discuss.elastic.co/t/metrics-dont-send-after-some-time-to-elasticsearch-temp-bulk-send-fail/339500 "2023-07-28T06:41:58Z")
Hi, Few months ago I installed metricbeat in K8S cluster and everything was working fine. All of a sudden after 1-2 months I get error: Temporary bulk send failure - Drop batch INFO \[publisher\] pipeline/retry.go:223 … --- ## [I would like to know about the limit on the maximum number of documents per index](https://discuss.elastic.co/t/i-would-like-to-know-about-the-limit-on-the-maximum-number-of-documents-per-index/339497)
**Author:** [@bbasosuho](https://discuss.elastic.co/u/bbasosuho)\ **Replies:** 3\ **Last updated:** [July 28, 2023, 6:50am UTC](https://discuss.elastic.co/t/i-would-like-to-know-about-the-limit-on-the-maximum-number-of-documents-per-index/339497 "2023-07-28T06:50:17Z")
Hi We are going to use elasticsearch 8.7. I would like to know if there is a limit on the number of documents to be stored in one index. Is there a limit on the number of documents per index? Or is there a limit on th… --- ## [Can't see metricbeat logs](https://discuss.elastic.co/t/cant-see-metricbeat-logs/339407)
**Author:** [@Swathi12](https://discuss.elastic.co/u/Swathi12)\ **Replies:** 2\ **Last updated:** [July 28, 2023, 6:35am UTC](https://discuss.elastic.co/t/cant-see-metricbeat-logs/339407 "2023-07-28T06:35:02Z")
Hi together Do you know why i can't see since creating of metricbeat any logfiles here ? --- ## [Logstash- How to parse formatted JSON arrays in log files](https://discuss.elastic.co/t/logstash-how-to-parse-formatted-json-arrays-in-log-files/339498)
**Author:** [@fisher\_he](https://discuss.elastic.co/u/fisher_he)\ **Replies:** 0\ **Last updated:** [July 28, 2023, 6:15am UTC](https://discuss.elastic.co/t/logstash-how-to-parse-formatted-json-arrays-in-log-files/339498 "2023-07-28T06:15:33Z")
Logstash version: 7.17.10 Elasticsearch version:7.17.10 The logs are located in /var/logs directory and the format is as below: xxx.log \[ { "t": "SYS", "dt": "2023-04-17 19:46:40.147 GMT-04:00", "c": "M… --- ## [Performance impact of upsert vs index with custom id](https://discuss.elastic.co/t/performance-impact-of-upsert-vs-index-with-custom-id/339492)
**Author:** [@sriapr98](https://discuss.elastic.co/u/sriapr98)\ **Replies:** 0\ **Last updated:** [July 28, 2023, 4:49am UTC](https://discuss.elastic.co/t/performance-impact-of-upsert-vs-index-with-custom-id/339492 "2023-07-28T04:49:47Z")
We have a huge traffic coming out of kafka which we are continuously ingesting to es using Index api(with custom doc id). Due to some edge cases we are thinking of moving to update api(upsert with doc\_as\_upsert with upd… --- ## [Failed to flush the buffer ||Data too large, data for|| could not push logs to Elasticsearch cluster](https://discuss.elastic.co/t/failed-to-flush-the-buffer-data-too-large-data-for-could-not-push-logs-to-elasticsearch-cluster/339489)
**Author:** [@Vikas1633](https://discuss.elastic.co/u/Vikas1633)\ **Replies:** 0\ **Last updated:** [July 28, 2023, 4:08am UTC](https://discuss.elastic.co/t/failed-to-flush-the-buffer-data-too-large-data-for-could-not-push-logs-to-elasticsearch-cluster/339489 "2023-07-28T04:08:46Z")
Hi all i am facing this issue since long and not able to control the buffer file whenever large amount of data is ingested its get chocked any help would be apprecitated. 2023-05-24 17:34:11 +0300 \[warn\]: #0 failed to f… --- ## [Get logs from remote devices](https://discuss.elastic.co/t/get-logs-from-remote-devices/339292)
**Author:** [@Siddharth\_Jain1](https://discuss.elastic.co/u/Siddharth_Jain1)\ **Replies:** 3\ **Last updated:** [July 28, 2023, 12:54am UTC](https://discuss.elastic.co/t/get-logs-from-remote-devices/339292 "2023-07-28T00:54:10Z")
We have 1500+ remote hosts( MAC, ubuntu, Windows) laptops, which are not in our network 24x7. I want to fetch logs from these devices even if they are not connected to our VPN. Is there any way through which we can achie… --- ## [Logstash HTTP client](https://discuss.elastic.co/t/logstash-http-client/339483)
**Author:** [@Arjun\_Nambiar](https://discuss.elastic.co/u/Arjun_Nambiar)\ **Replies:** 1\ **Last updated:** [July 27, 2023, 11:55pm UTC](https://discuss.elastic.co/t/logstash-http-client/339483 "2023-07-27T23:55:08Z")
I have an Elasticsearch cluster running on AWS which has an Elastic Load balancer(ELB) in front of it. I am scanning the ELB log file to find the clients writing to the Elasticsearch cluster. Logstash is also one of the … --- ## [Help with logstash output](https://discuss.elastic.co/t/help-with-logstash-output/339469)
**Author:** [@nach\_usal](https://discuss.elastic.co/u/nach_usal)\ **Replies:** 5\ **Last updated:** [July 27, 2023, 9:45pm UTC](https://discuss.elastic.co/t/help-with-logstash-output/339469 "2023-07-27T21:45:28Z")
Hi guys, I am trying to capture login and logout events in programs such as TeamViewer and AnyDesk, installed in a Windows virtual machine. Then I send them to my Logstash server via the same Filebeat node, here is the … --- ## [Q: is it possible to send from filebeats/metricbeats via elasticagent to logstash or elastic?](https://discuss.elastic.co/t/q-is-it-possible-to-send-from-filebeats-metricbeats-via-elasticagent-to-logstash-or-elastic/339434)
**Author:** [@DrG](https://discuss.elastic.co/u/DrG)\ **Replies:** 2\ **Last updated:** [July 27, 2023, 7:29pm UTC](https://discuss.elastic.co/t/q-is-it-possible-to-send-from-filebeats-metricbeats-via-elasticagent-to-logstash-or-elastic/339434 "2023-07-27T19:29:42Z")
Hello everybody, Background: We have a setup of a set of computers, where "just one" of that is connected to the Companies Network - with a dedicated unique IP Adress etc. The other two systems (lets call them sysb, sy… --- ## [Controls showing incorrect document count](https://discuss.elastic.co/t/controls-showing-incorrect-document-count/339477)
**Author:** [@Matthew\_Salah](https://discuss.elastic.co/u/Matthew_Salah)\ **Replies:** 1\ **Last updated:** [July 27, 2023, 7:11pm UTC](https://discuss.elastic.co/t/controls-showing-incorrect-document-count/339477 "2023-07-27T19:11:59Z")
I have a map on a Kibana dashboard and a series of controls. The controls have a count of documents associated with the filter value. However, the counts there don't line up with my global count of documents (see upper … --- ## [If index does not exists does not show error, return empty](https://discuss.elastic.co/t/if-index-does-not-exists-does-not-show-error-return-empty/339343)
**Author:** [@Murilo\_Livorato](https://discuss.elastic.co/u/Murilo_Livorato)\ **Replies:** 2\ **Last updated:** [July 27, 2023, 6:54pm UTC](https://discuss.elastic.co/t/if-index-does-not-exists-does-not-show-error-return-empty/339343 "2023-07-27T18:54:22Z")
hello , I have a search with many indexes here - GET index-0001, index-0002, index-0003/\_search { "size": 30, "query": { "match\_all": {} } } index-0001 exists index-0002 , does not exists . index-0003 exist… --- ## [Split filter and add\_field encoding object to a JSON string](https://discuss.elastic.co/t/split-filter-and-add-field-encoding-object-to-a-json-string/337590)
**Author:** [@MrOg](https://discuss.elastic.co/u/MrOg)\ **Replies:** 7\ **Last updated:** [July 27, 2023, 4:46pm UTC](https://discuss.elastic.co/t/split-filter-and-add-field-encoding-object-to-a-json-string/337590 "2023-07-27T16:46:34Z")
Hi, I have such a set of filters filter { json { source =\> "\[sql\_data\]\[response\]" } split { field =\> "docs" add\_field =\> { "id" =\> "%{\[docs\]\[id\]}" "names" =\> … --- ## [How to use pagination with new Java Client](https://discuss.elastic.co/t/how-to-use-pagination-with-new-java-client/339460)
**Author:** [@Andre\_Schmer](https://discuss.elastic.co/u/Andre_Schmer)\ **Replies:** 0\ **Last updated:** [July 27, 2023, 4:42pm UTC](https://discuss.elastic.co/t/how-to-use-pagination-with-new-java-client/339460 "2023-07-27T16:42:24Z")
Trying to use a search\_after with the new Java API. That s what i did so far: SearchResponse\ sr = newClient.search(searchRequest, PeriodInventory.class); List\\> searchHits = sr.h… --- ## [How to Create a list of Buttons (with link) when specific selected button is clicked there is a new set of sub buttons (links) that user can click in Mardown Visualisation?](https://discuss.elastic.co/t/how-to-create-a-list-of-buttons-with-link-when-specific-selected-button-is-clicked-there-is-a-new-set-of-sub-buttons-links-that-user-can-click-in-mardown-visualisation/339275)
**Author:** [@SHAIK\_ASMA\_ZABI\_18BB](https://discuss.elastic.co/u/SHAIK_ASMA_ZABI_18BB)\ **Replies:** 1\ **Last updated:** [July 27, 2023, 3:58pm UTC](https://discuss.elastic.co/t/how-to-create-a-list-of-buttons-with-link-when-specific-selected-button-is-clicked-there-is-a-new-set-of-sub-buttons-links-that-user-can-click-in-mardown-visualisation/339275 "2023-07-27T15:58:51Z")
I am using Markdown Visualization in which there are 5 buttons which have individual dashboard loading links. From those dashboard links there are sub buttons coming up which have their own dashboard loading links. How d… --- ## [Threshold Alerts with Delayed Logs - Verification](https://discuss.elastic.co/t/threshold-alerts-with-delayed-logs-verification/338362)
**Author:** [@kbratt](https://discuss.elastic.co/u/kbratt)\ **Replies:** 2\ **Last updated:** [July 27, 2023, 3:53pm UTC](https://discuss.elastic.co/t/threshold-alerts-with-delayed-logs-verification/338362 "2023-07-27T15:53:18Z")
I have set up Threshold Security Alerts that are running every 5 minutes and looking back an additional 1 minute.. We are working on fixing a performance issue where our Logs are delayed by up to 20 minutes at times. S… --- ## [Upgrading from 7.11.1 to 7.17 with only one node in the Cluster](https://discuss.elastic.co/t/upgrading-from-7-11-1-to-7-17-with-only-one-node-in-the-cluster/339455)
**Author:** [@getmoin](https://discuss.elastic.co/u/getmoin)\ **Replies:** 0\ **Last updated:** [July 27, 2023, 2:51pm UTC](https://discuss.elastic.co/t/upgrading-from-7-11-1-to-7-17-with-only-one-node-in-the-cluster/339455 "2023-07-27T14:51:55Z")
Hi everyone, I have an Elastic search in prod, hosting on GCP. The present version of the Elastic search is 7.11.1 and its in yellow (EOL) in the dashboard.I want to upgrade it to the 7.17.12. And then to the 8.x I hav… --- ## [Elastic memmory size](https://discuss.elastic.co/t/elastic-memmory-size/339450)
**Author:** [@hlcxpl](https://discuss.elastic.co/u/hlcxpl)\ **Replies:** 2\ **Last updated:** [July 27, 2023, 2:45pm UTC](https://discuss.elastic.co/t/elastic-memmory-size/339450 "2023-07-27T14:45:40Z")
Hi i have this error when i ingest my nodes with logstsh data the thing is that the nodes were block because the memory what to small for the size of data but i change the path data to another that has 5 Teras o f memor… --- ## [ES SQL against index pattern](https://discuss.elastic.co/t/es-sql-against-index-pattern/339447)
**Author:** [@tangkalo](https://discuss.elastic.co/u/tangkalo)\ **Replies:** 1\ **Last updated:** [July 27, 2023, 2:45pm UTC](https://discuss.elastic.co/t/es-sql-against-index-pattern/339447 "2023-07-27T14:45:27Z")
Hi, one of my ES SQL in a Canvas workpad runs against an index pattern(i.e. some-index-name\* ) which cannot be found in the dropdown list of Kibana Discover's dropdown list. Could this be a permission issue in Kibana? I… --- ## [Customize security exception error message](https://discuss.elastic.co/t/customize-security-exception-error-message/339191)
**Author:** [@Juan\_Heredia\_Heredia](https://discuss.elastic.co/u/Juan_Heredia_Heredia)\ **Replies:** 0\ **Last updated:** [July 25, 2023, 12:15pm UTC](https://discuss.elastic.co/t/customize-security-exception-error-message/339191 "2023-07-25T12:15:27Z")
Hello everyone! I am novice in Kibana and this is my first topic in the group. Thanks in advance. It is possible to customize the error messages in Dev Tools Console? I need not shows the user and backend\_roles sec… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=330) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=332)