# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=674 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 675 --- ## [\[KIBANA\] Customize the result of a metric in a Data Table Aggregation](https://discuss.elastic.co/t/kibana-customize-the-result-of-a-metric-in-a-data-table-aggregation/298311)
**Author:** [@Sisiniya](https://discuss.elastic.co/u/Sisiniya)\ **Replies:** 1\ **Last updated:** [March 23, 2022, 7:39am UTC](https://discuss.elastic.co/t/kibana-customize-the-result-of-a-metric-in-a-data-table-aggregation/298311 "2022-03-23T07:39:59Z")
Hello, In my application, each action generates a series of logs. For example : First suite of logs for the same value of data1/data2/data3 : {data1: "val1", data2: "val2", data3: "val3", level: "INFO", level\_value: 2… --- ## [High disk read resulting in io wait on new Cluster 7.9](https://discuss.elastic.co/t/high-disk-read-resulting-in-io-wait-on-new-cluster-7-9/298884)
**Author:** [@borch-inc](https://discuss.elastic.co/u/borch-inc)\ **Replies:** 10\ **Last updated:** [March 23, 2022, 5:23am UTC](https://discuss.elastic.co/t/high-disk-read-resulting-in-io-wait-on-new-cluster-7-9/298884 "2022-03-23T05:23:34Z")
Hey hope for some help on where to optimize We have just moved our cluster into new and bigger servers. so we went from 8 to 5 data nodes since the hardware should have improved a lot. Once we started our application … --- ## [Elasticsearch Became case sensitive after add synonym analyzer](https://discuss.elastic.co/t/elasticsearch-became-case-sensitive-after-add-synonym-analyzer/300283)
**Author:** [@Muhammad\_Fhadli](https://discuss.elastic.co/u/Muhammad_Fhadli)\ **Replies:** 3\ **Last updated:** [March 23, 2022, 4:42am UTC](https://discuss.elastic.co/t/elasticsearch-became-case-sensitive-after-add-synonym-analyzer/300283 "2022-03-23T04:42:22Z")
After I added synonym analyzer to my\_index, the index became case-sensitive I have one property called nationality that has synonym analyzer. But it seems that this property become case sensitive because of the synonym … --- ## [Logstash SNMP input error](https://discuss.elastic.co/t/logstash-snmp-input-error/298106)
**Author:** [@varun1992](https://discuss.elastic.co/u/varun1992)\ **Replies:** 1\ **Last updated:** [March 23, 2022, 4:02am UTC](https://discuss.elastic.co/t/logstash-snmp-input-error/298106 "2022-03-23T04:02:11Z")
I am getting some error when running logstash config as below input { snmp { get =\> \[".1.3.6.1.2.1.5.1.0", ".1.3.6.1.2.1.5.2.0", ".1.3.6.1.2.1.5.3.0", ".1.3.6.1.2.1.5.4.0", ".1.3.6.1.2.1.5.5.0", ".1.3.6.1.… --- ## [Is there any introduction about the action in \_cat/tasks api](https://discuss.elastic.co/t/is-there-any-introduction-about-the-action-in-cat-tasks-api/300271)
**Author:** [@ericsoul](https://discuss.elastic.co/u/ericsoul)\ **Replies:** 4\ **Last updated:** [March 23, 2022, 12:42am UTC](https://discuss.elastic.co/t/is-there-any-introduction-about-the-action-in-cat-tasks-api/300271 "2022-03-23T00:42:56Z")
Is there any introduction about all list of the action of \_cat/tasks? --- ## [Filtering collection in aggregation based on document property value](https://discuss.elastic.co/t/filtering-collection-in-aggregation-based-on-document-property-value/299592)
**Author:** [@Mahendra\_Choudhary](https://discuss.elastic.co/u/Mahendra_Choudhary)\ **Replies:** 3\ **Last updated:** [March 22, 2022, 9:32pm UTC](https://discuss.elastic.co/t/filtering-collection-in-aggregation-based-on-document-property-value/299592 "2022-03-22T21:32:14Z")
Hello all, I am kind of stuck in a special case. My document looks like below. { "\_source" : { "name" : "SPIM", "spDetails" : { "isActive" : true }, "id" : "251561", "categories" : \[ "FM", "SP" \] } }, { … --- ## [Can the field type (e.g. "flattened") be specified at time of indexing?](https://discuss.elastic.co/t/can-the-field-type-e-g-flattened-be-specified-at-time-of-indexing/298671)
**Author:** [@Jamshid](https://discuss.elastic.co/u/Jamshid)\ **Replies:** 4\ **Last updated:** [March 22, 2022, 9:24pm UTC](https://discuss.elastic.co/t/can-the-field-type-e-g-flattened-be-specified-at-time-of-indexing/298671 "2022-03-22T21:24:50Z")
I know I can specify that a specific field has the type "flattened" (Flattened field type | Elasticsearch Guide \[8.0\] | Elastic) by specifying that in the index \_mapping but is there a way to do that when indexing? I wa… --- ## [Role 'reporting\_user' is deprecated. Please use Kibana feature privileges instead](https://discuss.elastic.co/t/role-reporting-user-is-deprecated-please-use-kibana-feature-privileges-instead/294593)
**Author:** [@jsteenkamp](https://discuss.elastic.co/u/jsteenkamp)\ **Replies:** 8\ **Last updated:** [March 22, 2022, 8:38pm UTC](https://discuss.elastic.co/t/role-reporting-user-is-deprecated-please-use-kibana-feature-privileges-instead/294593 "2022-03-22T20:38:19Z")
latest version 7.16.3 (forever free edition) management \> users How do I grant users reporting permissions without using the deprecated reporting\_user in the forever free edition that does not support sub-featu… --- ## [Ingest postfix (mail) logs to ELK](https://discuss.elastic.co/t/ingest-postfix-mail-logs-to-elk/299663)
**Author:** [@Guif](https://discuss.elastic.co/u/Guif)\ **Replies:** 6\ **Last updated:** [March 22, 2022, 6:57pm UTC](https://discuss.elastic.co/t/ingest-postfix-mail-logs-to-elk/299663 "2022-03-22T18:57:10Z")
Hi! I would like to ingest sendmail logs (/var/log/maillog) from different servers (about 5) into Elasticsearch at the same time. I did Google search and found different and confused tutorials about this. Anybody can … --- ## [Index size with elasticseach 8 increasing?](https://discuss.elastic.co/t/index-size-with-elasticseach-8-increasing/300351)
**Author:** [@rsommer](https://discuss.elastic.co/u/rsommer)\ **Replies:** 4\ **Last updated:** [March 22, 2022, 4:19pm UTC](https://discuss.elastic.co/t/index-size-with-elasticseach-8-increasing/300351 "2022-03-22T16:19:38Z")
Hi, before filing a bug report I would like to ask if someone else is encountering increase in index sizes after the update to Elasticsearch 8? I posted the sizes of our logstash daily indices from one cluster. Size and… --- ## [Filter with more than one possible match?](https://discuss.elastic.co/t/filter-with-more-than-one-possible-match/300292)
**Author:** [@andre22](https://discuss.elastic.co/u/andre22)\ **Replies:** 2\ **Last updated:** [March 22, 2022, 3:21pm UTC](https://discuss.elastic.co/t/filter-with-more-than-one-possible-match/300292 "2022-03-22T15:21:57Z")
Hi, I'm running the Elastic stack 8.1 I want to create a filter that has more than one condition and therefore avoid creating the same filter for all possibilities again and again. An example: I want the IF condition t… --- ## [APM-Server 8.1 via Elastic-Agent 8.1 unable to connect to ElasticSearch 8.1](https://discuss.elastic.co/t/apm-server-8-1-via-elastic-agent-8-1-unable-to-connect-to-elasticsearch-8-1/300362)
**Author:** [@gperdacher](https://discuss.elastic.co/u/gperdacher)\ **Replies:** 0\ **Last updated:** [March 22, 2022, 3:15pm UTC](https://discuss.elastic.co/t/apm-server-8-1-via-elastic-agent-8-1-unable-to-connect-to-elasticsearch-8-1/300362 "2022-03-22T15:15:22Z")
Hello, I installed Elasticsearch 8.1 Kibana 8.1 Fleet-Server 8.1 on a debian 11 system with default settings. Via Fleet-Server i installed/enrolled an elastic-agent with a policy and Elastic APM Integration 8.1. Af… --- ## [Index filled EC2 completely, manually deleted nodes, no longer able to start Elasticsearch](https://discuss.elastic.co/t/index-filled-ec2-completely-manually-deleted-nodes-no-longer-able-to-start-elasticsearch/300221)
**Author:** [@pritster5](https://discuss.elastic.co/u/pritster5)\ **Replies:** 7\ **Last updated:** [March 22, 2022, 2:18pm UTC](https://discuss.elastic.co/t/index-filled-ec2-completely-manually-deleted-nodes-no-longer-able-to-start-elasticsearch/300221 "2022-03-22T14:18:02Z")
I recently had an issue where I was ingesting data from S3 via Logstash and the S3 Input Plugin (aka the pipeline feature) into my AWS EC2 instance running ELK 7.5.2. Overnight, the index filled up my entire EC2 storage… --- ## [検索結果のvisualize表示について](https://discuss.elastic.co/t/visualize/300279)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 2:11pm UTC](https://discuss.elastic.co/t/visualize/300279 "2022-03-22T14:11:52Z")
下記URLを参照し、Discoverの結果のとあるフィールドの集約結果をvisualizeにて表示しようとしております。 型がip型や数値型のフィールドについてはviualize表示できたのですが、テキスト型のフィールドについて、Available fieldsのフィールド名をクリックしても「visualize」ボタンが表示されず、visualize表示できません。原因及び対処法をご教示頂けないでしょうか。 --- ## [Cummulative date sum in Kibana Console](https://discuss.elastic.co/t/cummulative-date-sum-in-kibana-console/300315)
**Author:** [@The-morpho](https://discuss.elastic.co/u/The-morpho)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 2:04pm UTC](https://discuss.elastic.co/t/cummulative-date-sum-in-kibana-console/300315 "2022-03-22T14:04:49Z")
I'm working with a log file,I have a field for timestamp ==\> "timestamp":"2021-12-15T16:06:27.269303Z". I want to perform a cummulative sum on this field in all the document. I have done this aggregation, but the resul… --- ## [Plugin unable to find classes in ES 7.12 and newer](https://discuss.elastic.co/t/plugin-unable-to-find-classes-in-es-7-12-and-newer/299890)
**Author:** [@brian8371](https://discuss.elastic.co/u/brian8371)\ **Replies:** 2\ **Last updated:** [March 22, 2022, 1:41pm UTC](https://discuss.elastic.co/t/plugin-unable-to-find-classes-in-es-7-12-and-newer/299890 "2022-03-22T13:41:31Z")
I'm new to ES plugin development and I'm trying to change an ES plugin that worked with ES v7.3.0 to work with ES v7.13.4 or newer, but it seems like both index.query.QueryShardContext and index.search.MatchQuery were re… --- ## [Send GeoPoint data to elastic Search using client.index method](https://discuss.elastic.co/t/send-geopoint-data-to-elastic-search-using-client-index-method/300345)
**Author:** [@Vishnu\_Agarwal](https://discuss.elastic.co/u/Vishnu_Agarwal)\ **Replies:** 0\ **Last updated:** [March 22, 2022, 1:25pm UTC](https://discuss.elastic.co/t/send-geopoint-data-to-elastic-search-using-client-index-method/300345 "2022-03-22T13:25:56Z")
I am trying to send geolocation as location:{"lat": 19.07, "lon": 72.87} , and i have mapped location as geo\_point in index. I am getting following error. reason: "can't merge a non object mapping \[myloc\] with an objec… --- ## [Config pipeline logstash with module cisco](https://discuss.elastic.co/t/config-pipeline-logstash-with-module-cisco/300044)
**Author:** [@jojodd](https://discuss.elastic.co/u/jojodd)\ **Replies:** 6\ **Last updated:** [March 22, 2022, 1:08pm UTC](https://discuss.elastic.co/t/config-pipeline-logstash-with-module-cisco/300044 "2022-03-22T13:08:53Z")
Hello, I would like to know if it is possible to use at the same time cisco-asa and cisco-ios in a single pipeline? Is there a method to create several indexes with one for cisco-ios and the other for cisco-asa? --- ## [Environment variable from secrets empty in pipeline](https://discuss.elastic.co/t/environment-variable-from-secrets-empty-in-pipeline/300340)
**Author:** [@pfennema](https://discuss.elastic.co/u/pfennema)\ **Replies:** 0\ **Last updated:** [March 22, 2022, 1:07pm UTC](https://discuss.elastic.co/t/environment-variable-from-secrets-empty-in-pipeline/300340 "2022-03-22T13:07:05Z")
Hi All, I'm trying to use an environment variable in one of my pipeline configs which is defined in a secrets file in kubernetes. When I login into the container and do an 'env' commend, the environment variable is def… --- ## [Unable to see ESquery while creating Rules and Connectors](https://discuss.elastic.co/t/unable-to-see-esquery-while-creating-rules-and-connectors/300195)
**Author:** [@Ankur\_Jain1](https://discuss.elastic.co/u/Ankur_Jain1)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 12:54pm UTC](https://discuss.elastic.co/t/unable-to-see-esquery-while-creating-rules-and-connectors/300195 "2022-03-22T12:54:30Z")
Hello, I have created a user in Kibana with some limited permissions. When I am trying to create Rules using that user I cannot see ESquery option. This option is available for superuser account. The user role have fol… --- ## [Query a specific IP address in Elastic](https://discuss.elastic.co/t/query-a-specific-ip-address-in-elastic/300318)
**Author:** [@ianrobo](https://discuss.elastic.co/u/ianrobo)\ **Replies:** 2\ **Last updated:** [March 22, 2022, 12:34pm UTC](https://discuss.elastic.co/t/query-a-specific-ip-address-in-elastic/300318 "2022-03-22T12:34:26Z")
Hi there, I am relatively new to elastic and expanding our ES daily. We are ingesting logs from various network devices but come across a problem in Cisco. They do not send the hostname in their syslog and therefore al… --- ## [Elasticsearch 7.16 installing error](https://discuss.elastic.co/t/elasticsearch-7-16-installing-error/300209)
**Author:** [@Kailas](https://discuss.elastic.co/u/Kailas)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 12:26pm UTC](https://discuss.elastic.co/t/elasticsearch-7-16-installing-error/300209 "2022-03-22T12:26:31Z")
Hi, I am trying to install Elasticsarch 7.16.1 on 3 nodes by following Install Elasticsearch from archive on Linux or MacOS | Elasticsearch Guide \[7.16\] | Elastic . The ES installation needs to be done on Linux. Howeve… --- ## [Elastic Security Rule exception](https://discuss.elastic.co/t/elastic-security-rule-exception/300273)
**Author:** [@Billz1026](https://discuss.elastic.co/u/Billz1026)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 12:20pm UTC](https://discuss.elastic.co/t/elastic-security-rule-exception/300273 "2022-03-22T12:20:25Z")
Hi, I have been using elastic security as a SIEM for my organization for some time. Due to insufficient space, I had deleted one index. Thereafter I saw failures of the detection rules which was not the case before. Be… --- ## [Rename fields names with logstash](https://discuss.elastic.co/t/rename-fields-names-with-logstash/300321)
**Author:** [@Paf](https://discuss.elastic.co/u/Paf)\ **Replies:** 2\ **Last updated:** [March 22, 2022, 11:53am UTC](https://discuss.elastic.co/t/rename-fields-names-with-logstash/300321 "2022-03-22T11:53:54Z")
Hello, I want to rename the field name "identity.claims.http://schemas.microsoft.com/claims/authnclassreference" to "identity\_claims\_authnclassreference". For this, i use mutate filter with rename as follwing: filter… --- ## [Can't use exception lists](https://discuss.elastic.co/t/cant-use-exception-lists/299635)
**Author:** [@bolemebrige](https://discuss.elastic.co/u/bolemebrige)\ **Replies:** 4\ **Last updated:** [March 22, 2022, 10:13am UTC](https://discuss.elastic.co/t/cant-use-exception-lists/299635 "2022-03-22T10:13:54Z")
After adding value lists through API or kibana interface they are not shown in Kibana and can't be added as exception to rules. If I update rule with exception list using API, it is shown in rule exceptions (but doesn't… --- ## [Logstash working from cli, but not whilst running as a service](https://discuss.elastic.co/t/logstash-working-from-cli-but-not-whilst-running-as-a-service/300309)
**Author:** [@conor\_c](https://discuss.elastic.co/u/conor_c)\ **Replies:** 0\ **Last updated:** [March 22, 2022, 10:02am UTC](https://discuss.elastic.co/t/logstash-working-from-cli-but-not-whilst-running-as-a-service/300309 "2022-03-22T10:02:45Z")
Hi, I'm running Logstash and Filebeat with what I believe to be simple configurations. I have two syslog listeners, one on UDP 9001 and one on UDP 9002. When running Logstash as a service and when sending logs to 9001,… --- ## [Huge indexing (refresh) performance drop when upgrading from ES 2.4 to ES 7.16](https://discuss.elastic.co/t/huge-indexing-refresh-performance-drop-when-upgrading-from-es-2-4-to-es-7-16/299479)
**Author:** [@daniel-kr](https://discuss.elastic.co/u/daniel-kr)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 9:31am UTC](https://discuss.elastic.co/t/huge-indexing-refresh-performance-drop-when-upgrading-from-es-2-4-to-es-7-16/299479 "2022-03-22T09:31:25Z")
Hello, we updated our system from ES 2.4 to ES 7.16 some time ago. Now we recognized that there is a huge indexing performance drop when it comes to a very special use case that we have. The use case is as follows: We … --- ## [Discoverにおけるハイフンを含む文字列の検索について](https://discuss.elastic.co/t/discover/299817)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 9:13am UTC](https://discuss.elastic.co/t/discover/299817 "2022-03-22T09:13:23Z")
ドキュメント内のあるフィールドに、ハイフンを含む文字列があります。 フィールド名：fieldA 値：su su-l su-a Discover画面にて前方一致で「su-」から始まるものを検索したいのですが、想定通りの検索が出来ませんでした。 下記、Discoverでの指定条件と結果になります。 fieldA:"su-l" →su-lのフィールドのみマッチ fieldA:"su\*" →su、su-l、su-aがマッチ f… --- ## [Logstash to process multiple files of large size?](https://discuss.elastic.co/t/logstash-to-process-multiple-files-of-large-size/300299)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 0\ **Last updated:** [March 22, 2022, 8:43am UTC](https://discuss.elastic.co/t/logstash-to-process-multiple-files-of-large-size/300299 "2022-03-22T08:43:14Z")
Hello, To give a little bit of context, i have 3 VMs , each of 16 CPU cores out of which 2 are of 16GB RAM (they host Elasticsearch and kibana + a flask app, that provides a front end for the user to input the machineip… --- ## [Send logs from remote server on the same network](https://discuss.elastic.co/t/send-logs-from-remote-server-on-the-same-network/300052)
**Author:** [@Arraso26](https://discuss.elastic.co/u/Arraso26)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 8:35am UTC](https://discuss.elastic.co/t/send-logs-from-remote-server-on-the-same-network/300052 "2022-03-22T08:35:22Z")
Good, I want to send the logs from a server to this one but the logs don't arrive, I show you the files to see if you can help me. sudo cat /etc/logstash/conf.d/30-Elasticsearch-output.conf \> output { \> elasticsearch… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=673) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=675)