# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=695 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 696 --- ## [High disk READ](https://discuss.elastic.co/t/high-disk-read/298221)
**Author:** [@bknv](https://discuss.elastic.co/u/bknv)\ **Replies:** 0\ **Last updated:** [February 24, 2022, 9:33pm UTC](https://discuss.elastic.co/t/high-disk-read/298221 "2022-02-24T21:33:26Z")
Hello everybody. I have a problem with high activity (read) on the disk. Disk SSD load on 90%. "iostat" show me, what reading from disk 400-500+ M/s . in "iotop" i see process "java -Xshare:auto -Des.networkaddres… --- ## [Problem CPU Usage Gauge](https://discuss.elastic.co/t/problem-cpu-usage-gauge/297936)
**Author:** [@jorge\_Flores\_Machuca](https://discuss.elastic.co/u/jorge_Flores_Machuca)\ **Replies:** 4\ **Last updated:** [February 24, 2022, 8:57pm UTC](https://discuss.elastic.co/t/problem-cpu-usage-gauge/297936 "2022-02-24T20:57:03Z")
Hello, I have configured metricbeats from windows and for the part of memory use or CPU use, sometimes when it refreshes it shows me all the GAUGE in green without a usage metric some samaritan who can guide me, so th… --- ## [JSON parse error, original data now in message field](https://discuss.elastic.co/t/json-parse-error-original-data-now-in-message-field/298065)
**Author:** [@d6036de2b54af16665f4](https://discuss.elastic.co/u/d6036de2b54af16665f4)\ **Replies:** 2\ **Last updated:** [February 24, 2022, 8:54pm UTC](https://discuss.elastic.co/t/json-parse-error-original-data-now-in-message-field/298065 "2022-02-24T20:54:13Z")
HI, Error I am receiving in logstash logs is : \[2022-02-22T15:19:27,369\]\[ERROR\]\[logstash.codecs.json \] JSON parse error, original data now in message field {:error=\>#\ **Author:** [@martiros\_martiros](https://discuss.elastic.co/u/martiros_martiros)\ **Replies:** 1\ **Last updated:** [February 24, 2022, 8:49pm UTC](https://discuss.elastic.co/t/cant-send-logs-to-data-view/298176 "2022-02-24T20:49:47Z") I got this in my spring boot this is my conf. file input { file { type =\> "java" path =\> "/UUUU\*\*\*\*\*\*\*\*/IdeaProjects/elk-stack-logging-example/elk-example.log" codec =\> multiline { … --- ## [Log stream with logstash](https://discuss.elastic.co/t/log-stream-with-logstash/298195)
**Author:** [@laolao](https://discuss.elastic.co/u/laolao)\ **Replies:** 1\ **Last updated:** [February 24, 2022, 8:45pm UTC](https://discuss.elastic.co/t/log-stream-with-logstash/298195 "2022-02-24T20:45:11Z")
I have a basic configuration of logstash sending syslogs to Elasticsearch. I created my index pattern and can make visualizations, etc. However, I want to view the logs in real time on my dashboard. My dashboard has 4 d… --- ## [Creating a visualization: aggregate data over time](https://discuss.elastic.co/t/creating-a-visualization-aggregate-data-over-time/298075)
**Author:** [@4art4](https://discuss.elastic.co/u/4art4)\ **Replies:** 3\ **Last updated:** [February 24, 2022, 8:20pm UTC](https://discuss.elastic.co/t/creating-a-visualization-aggregate-data-over-time/298075 "2022-02-24T20:20:46Z")
I am likely using the wrong terms... or I would have found this in my searching... I am getting documents every day that list activity for objects. Eg: Day 1: { objectOne: { countOfFirstAction: 3, … --- ## [Update values based on previous documents](https://discuss.elastic.co/t/update-values-based-on-previous-documents/296406)
**Author:** [@SKraine](https://discuss.elastic.co/u/SKraine)\ **Replies:** 2\ **Last updated:** [February 24, 2022, 4:34pm UTC](https://discuss.elastic.co/t/update-values-based-on-previous-documents/296406 "2022-02-24T16:34:48Z")
Hey Everyone! So I am very new to the elastic stack and am currently working on my first application using it. I have data that comes from different files via filebeat. They then go through logstash to parse out the fie… --- ## [How to perform sum aggregation and term aggregation in single query?](https://discuss.elastic.co/t/how-to-perform-sum-aggregation-and-term-aggregation-in-single-query/298151)
**Author:** [@Harish\_fragger](https://discuss.elastic.co/u/Harish_fragger)\ **Replies:** 1\ **Last updated:** [February 24, 2022, 3:52pm UTC](https://discuss.elastic.co/t/how-to-perform-sum-aggregation-and-term-aggregation-in-single-query/298151 "2022-02-24T15:52:44Z")
I want to know if there is a method to write a query that can get the sum of a field value and such type of fields top 10 occurrences. For example, if I have 20 IP address in 100 documents and each document also tells me… --- ## [Multisearch requests in new Java API do not support "sort" or "\_source" properties](https://discuss.elastic.co/t/multisearch-requests-in-new-java-api-do-not-support-sort-or-source-properties/297489)
**Author:** [@babayotakun](https://discuss.elastic.co/u/babayotakun)\ **Replies:** 4\ **Last updated:** [February 24, 2022, 3:28pm UTC](https://discuss.elastic.co/t/multisearch-requests-in-new-java-api-do-not-support-sort-or-source-properties/297489 "2022-02-24T15:28:13Z")
With brand new Elasticsearch Java API I cannot write multisearch requests like: curl -H 'Content-type: application/x-ndjson' -XGET 'http://localhost:9200/myindex/\_msearch' -d '{} { "sort": \[ { "text": { … --- ## [Can Packetbeat check connectivity between two servers?](https://discuss.elastic.co/t/can-packetbeat-check-connectivity-between-two-servers/298114)
**Author:** [@hamdyahmed1984](https://discuss.elastic.co/u/hamdyahmed1984)\ **Replies:** 2\ **Last updated:** [February 24, 2022, 2:42pm UTC](https://discuss.elastic.co/t/can-packetbeat-check-connectivity-between-two-servers/298114 "2022-02-24T14:42:54Z")
Can I use packet beat to check connectivity between servers or components? for example, I want to be alerted if the connectivity between 2 components is failed. If this is possible, how to achieve it? --- ## [Master node Rejecting the data node request](https://discuss.elastic.co/t/master-node-rejecting-the-data-node-request/298168)
**Author:** [@Arunkumar\_Chandran](https://discuss.elastic.co/u/Arunkumar_Chandran)\ **Replies:** 1\ **Last updated:** [February 24, 2022, 1:33pm UTC](https://discuss.elastic.co/t/master-node-rejecting-the-data-node-request/298168 "2022-02-24T13:33:39Z")
We are using Elasticsearch version 7.0 can someone pleasse help us to resolve this issue. Error: "error":{"root\_cause":\[{"type":"master\_not\_discovered\_exception","reason":null}\],"type":"master\_not\_discovered\_exception"… --- ## [How to add index pattern for a space in Kibana](https://discuss.elastic.co/t/how-to-add-index-pattern-for-a-space-in-kibana/298136)
**Author:** [@borisr84](https://discuss.elastic.co/u/borisr84)\ **Replies:** 1\ **Last updated:** [February 24, 2022, 12:06pm UTC](https://discuss.elastic.co/t/how-to-add-index-pattern-for-a-space-in-kibana/298136 "2022-02-24T12:06:19Z")
Hi, I'm trying to add an index pattern for a particular space. I tried using the provided API, described here: POST \:\/s/\/api/index\_patterns/index\_pattern But, I keep getting 404 response. … --- ## [Search performance issue on Elasticsearch cluster](https://discuss.elastic.co/t/search-performance-issue-on-elasticsearch-cluster/298156)
**Author:** [@alpernka](https://discuss.elastic.co/u/alpernka)\ **Replies:** 1\ **Last updated:** [February 24, 2022, 11:57am UTC](https://discuss.elastic.co/t/search-performance-issue-on-elasticsearch-cluster/298156 "2022-02-24T11:57:03Z")
In an 14 node, RAID 5 based Elasticsearch cluster, the search performance does not improve no matter how simple the full-text query is. There are two indices: one is 30 shard, 1 replica, 1.1tb and 110M document size. Th… --- ## [Pipeline throught other pipelines](https://discuss.elastic.co/t/pipeline-throught-other-pipelines/295747)
**Author:** [@Clemv95](https://discuss.elastic.co/u/Clemv95)\ **Replies:** 0\ **Last updated:** [January 29, 2022, 10:45am UTC](https://discuss.elastic.co/t/pipeline-throught-other-pipelines/295747 "2022-01-29T10:45:06Z")
Hello. I explain my situation: I have one syslog server and he sends multiples logs to the same port of my ELK server. I'm trying to find a solution to send this logs to their respectives pipelines with their syslog h… --- ## [Event risk score (Filebeat Checkpoint)](https://discuss.elastic.co/t/event-risk-score-filebeat-checkpoint/296576)
**Author:** [@elasticfran](https://discuss.elastic.co/u/elasticfran)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 10:40am UTC](https://discuss.elastic.co/t/event-risk-score-filebeat-checkpoint/296576 "2022-02-08T10:40:51Z")
Hey there, I am wondering how the risk score works in the filebeat checkpoint index. I see a risk score spanning from 0 to 5, does anyone know how this index was designed ? I guess 5 is critical and 0 is kind of "beni… --- ## [Unassigned Shards after Master node restart](https://discuss.elastic.co/t/unassigned-shards-after-master-node-restart/297929)
**Author:** [@krishnav1](https://discuss.elastic.co/u/krishnav1)\ **Replies:** 3\ **Last updated:** [February 24, 2022, 11:37am UTC](https://discuss.elastic.co/t/unassigned-shards-after-master-node-restart/297929 "2022-02-24T11:37:35Z")
Hello, I am new to elastic cluster, sorry for the long post and I am looking for help to revive some unassigned shards which are a result of me abruptly shutting the master node. This has an impact on Kibana as it has pr… --- ## [Index disk size issue](https://discuss.elastic.co/t/index-disk-size-issue/297805)
**Author:** [@Nisarg\_Pandya](https://discuss.elastic.co/u/Nisarg_Pandya)\ **Replies:** 3\ **Last updated:** [February 24, 2022, 11:10am UTC](https://discuss.elastic.co/t/index-disk-size-issue/297805 "2022-02-24T11:10:55Z")
Hi, We are using the Elasticsearch version 7.9.3 We have two Elasticsearch cluster with the same configuration. Which is storing some data. We are periodically updating the data in both clusters. e.g. adding newdata, r… --- ## [Logstash 7.17 on Windows - Pipeline running but logs are not present in Elasticsearch](https://discuss.elastic.co/t/logstash-7-17-on-windows-pipeline-running-but-logs-are-not-present-in-elasticsearch/297519)
**Author:** [@bianca6](https://discuss.elastic.co/u/bianca6)\ **Replies:** 5\ **Last updated:** [February 24, 2022, 10:56am UTC](https://discuss.elastic.co/t/logstash-7-17-on-windows-pipeline-running-but-logs-are-not-present-in-elasticsearch/297519 "2022-02-24T10:56:03Z")
Hi, I'm on Windows 10. I'm building a pipeline with Filebeat / Logstash / Elasticsearch / Kibana. Each one of them is at the latest version (downloaded thie previous week). I'm trying to ship a simple log file (ndjson… --- ## [Synthetics from gitlab repository or bucket it is possible?](https://discuss.elastic.co/t/synthetics-from-gitlab-repository-or-bucket-it-is-possible/298148)
**Author:** [@David\_Oceans](https://discuss.elastic.co/u/David_Oceans)\ **Replies:** 0\ **Last updated:** [February 24, 2022, 10:52am UTC](https://discuss.elastic.co/t/synthetics-from-gitlab-repository-or-bucket-it-is-possible/298148 "2022-02-24T10:52:33Z")
Hi! if i have a private repository in gitlab can i use the "zip url" option for the synthetic? If so, how I can setup the autentication? Could I use a bucket in gcp? Thank you very much --- ## [KQL and Lucene range query issue](https://discuss.elastic.co/t/kql-and-lucene-range-query-issue/298140)
**Author:** [@Sivarama](https://discuss.elastic.co/u/Sivarama)\ **Replies:** 2\ **Last updated:** [February 24, 2022, 10:31am UTC](https://discuss.elastic.co/t/kql-and-lucene-range-query-issue/298140 "2022-02-24T10:31:27Z")
I have tried to search for a request delay greater than 6000 using KQL as well as lucene queries , but in result i'm getting the greater value along with the smaller one . How to filter out the values less than 6000 . Ki… --- ## [Pipeline number of arguments error](https://discuss.elastic.co/t/pipeline-number-of-arguments-error/297367)
**Author:** [@Michael\_Bailey](https://discuss.elastic.co/u/Michael_Bailey)\ **Replies:** 4\ **Last updated:** [February 24, 2022, 10:13am UTC](https://discuss.elastic.co/t/pipeline-number-of-arguments-error/297367 "2022-02-24T10:13:14Z")
Hi, For some reason I have started to get the following fatal error with logstash 8.0.0. \[LogStash::Runner\] runner - An unexpected error occurred! {:error=\>#\ **Author:** [@vmassol](https://discuss.elastic.co/u/vmassol)\ **Replies:** 9\ **Last updated:** [February 24, 2022, 10:11am UTC](https://discuss.elastic.co/t/using-the-java-client-api-to-perform-a-query-using-json/297872 "2022-02-24T10:11:36Z") Hi guys, I'm slowly learning the new Java Client API and I got good results. I'm now implementing some code where the use of the API is passing the JSON for the search request. So far I cannot figure out how to pass th… --- ## [Where is the index saved on disk?](https://discuss.elastic.co/t/where-is-the-index-saved-on-disk/297968)
**Author:** [@jordane95](https://discuss.elastic.co/u/jordane95)\ **Replies:** 5\ **Last updated:** [February 24, 2022, 9:26am UTC](https://discuss.elastic.co/t/where-is-the-index-saved-on-disk/297968 "2022-02-24T09:26:08Z")
Hello, I recently used the python toolkit elasticsearch to build a IR system on my server. May I know the path where the index is saved on my disk? Thank you! --- ## [Trying to search for '$'](https://discuss.elastic.co/t/trying-to-search-for/298064)
**Author:** [@joneswac](https://discuss.elastic.co/u/joneswac)\ **Replies:** 1\ **Last updated:** [February 24, 2022, 9:25am UTC](https://discuss.elastic.co/t/trying-to-search-for/298064 "2022-02-24T09:25:12Z")
I'm attempting to search for a '$' in a string field. I've tried all of the types of queries listed in the documentation, as well as the analyzers too. I can get a regex match for things like this: { "query": { "q… --- ## [Sorting events with identical millis timestamps by order events were recorded](https://discuss.elastic.co/t/sorting-events-with-identical-millis-timestamps-by-order-events-were-recorded/297758)
**Author:** [@bublik-hpt](https://discuss.elastic.co/u/bublik-hpt)\ **Replies:** 1\ **Last updated:** [February 24, 2022, 9:19am UTC](https://discuss.elastic.co/t/sorting-events-with-identical-millis-timestamps-by-order-events-were-recorded/297758 "2022-02-24T09:19:00Z")
Hi i have logs where multiple lines have the same timestamp. In Kibana discover they are in opposite order (if i follow the timestamp) then in the logfile, but when I check surrounding documents they are in correct order… --- ## [Structure for query with multiple sub queries with the same structure but different parameters](https://discuss.elastic.co/t/structure-for-query-with-multiple-sub-queries-with-the-same-structure-but-different-parameters/297939)
**Author:** [@GavinBeattie](https://discuss.elastic.co/u/GavinBeattie)\ **Replies:** 3\ **Last updated:** [February 24, 2022, 8:50am UTC](https://discuss.elastic.co/t/structure-for-query-with-multiple-sub-queries-with-the-same-structure-but-different-parameters/297939 "2022-02-24T08:50:13Z")
I am trying to analyse speed exceedances along a route, and what I would like is a query that returns all results together (all speed exceedances), which is the result of individual section by section queries (because ea… --- ## [Logstash error : rejected excution exeption](https://discuss.elastic.co/t/logstash-error-rejected-excution-exeption/298117)
**Author:** [@priyanka\_mundhe](https://discuss.elastic.co/u/priyanka_mundhe)\ **Replies:** 1\ **Last updated:** [February 24, 2022, 8:24am UTC](https://discuss.elastic.co/t/logstash-error-rejected-excution-exeption/298117 "2022-02-24T08:24:39Z")
cluster is going into red state continously. Please help --- ## [Index and search node(s) (multinode cluster)](https://discuss.elastic.co/t/index-and-search-node-s-multinode-cluster/298032)
**Author:** [@dev\_test](https://discuss.elastic.co/u/dev_test)\ **Replies:** 4\ **Last updated:** [February 24, 2022, 8:22am UTC](https://discuss.elastic.co/t/index-and-search-node-s-multinode-cluster/298032 "2022-02-24T08:22:32Z")
Hi, I'm creating a cluster for Elasticsearch having 3 nodes (one acting as master) I was to ask that while indexing or searching (considering we have a single index) will i be providing the IP-Address of same node for … --- ## [Add fields with same format but different value problem with grok logstash](https://discuss.elastic.co/t/add-fields-with-same-format-but-different-value-problem-with-grok-logstash/298043)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 1\ **Last updated:** [February 23, 2022, 7:51pm UTC](https://discuss.elastic.co/t/add-fields-with-same-format-but-different-value-problem-with-grok-logstash/298043 "2022-02-23T19:51:31Z")
Hi, log file example: 2021-01-01 11:15:02 - it is a f.... 2021-01-01 11:15:04 - format is =\> 000000: 00 11 22 a5 12 12 23 2a 55 12 00 22 33 44 | ?1451202000 . . . 00114: 00 11 55 77 9a 11 0 2021-12-23 10:14:22 … --- ## [Upgrading/Updating SIEM rules](https://discuss.elastic.co/t/upgrading-updating-siem-rules/298014)
**Author:** [@alaine](https://discuss.elastic.co/u/alaine)\ **Replies:** 2\ **Last updated:** [February 24, 2022, 7:13am UTC](https://discuss.elastic.co/t/upgrading-updating-siem-rules/298014 "2022-02-24T07:13:16Z")
Good Morning, I am in the process of migrating a SOC from Splunk to Elastic and am going through some of the growing pains at the moment. This question is in regards to upgrading/updating SIEM rules as we upgrade our el… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=694) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=696)