# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=696 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 697 --- ## [Logstash won't start pipeline after moving to 7.6.13 from 6.5.x](https://discuss.elastic.co/t/logstash-wont-start-pipeline-after-moving-to-7-6-13-from-6-5-x/298035)
**Author:** [@fribse](https://discuss.elastic.co/u/fribse)\ **Replies:** 2\ **Last updated:** [February 24, 2022, 6:45am UTC](https://discuss.elastic.co/t/logstash-wont-start-pipeline-after-moving-to-7-6-13-from-6-5-x/298035 "2022-02-24T06:45:09Z")
Hi All, I've gotten a problem with my old logstash pipeline. My config looks like this (everything is commented out during debugging): \[root@ALPHA00035 pipeline\]# cat logstash.conf input { beats { … --- ## [How to fill area between 2 point with Kibana](https://discuss.elastic.co/t/how-to-fill-area-between-2-point-with-kibana/297883)
**Author:** [@alparslan](https://discuss.elastic.co/u/alparslan)\ **Replies:** 3\ **Last updated:** [February 24, 2022, 6:25am UTC](https://discuss.elastic.co/t/how-to-fill-area-between-2-point-with-kibana/297883 "2022-02-24T06:25:19Z")
Hi, I need to visualize "busy | available" graph for my data. Sample data and sketchy graph here is below. What is best approach to catch something like this graph? I tried something with also TSVB. But i just wonder… --- ## [Kibana Portal not loading when configured to a 3 node ES cluster](https://discuss.elastic.co/t/kibana-portal-not-loading-when-configured-to-a-3-node-es-cluster/297969)
**Author:** [@Aditya93](https://discuss.elastic.co/u/Aditya93)\ **Replies:** 4\ **Last updated:** [February 24, 2022, 4:13am UTC](https://discuss.elastic.co/t/kibana-portal-not-loading-when-configured-to-a-3-node-es-cluster/297969 "2022-02-24T04:13:21Z")
I've configured a 3 node ES cluster and installed kibana and made it point to the cluster. Both ES an Kibana services are up, but the kibana portal is still not loading. I dont see any errors in ES logs, on error log in… --- ## [Whole data from db not updated in elastic index](https://discuss.elastic.co/t/whole-data-from-db-not-updated-in-elastic-index/298030)
**Author:** [@Akhil\_Chandran](https://discuss.elastic.co/u/Akhil_Chandran)\ **Replies:** 3\ **Last updated:** [February 24, 2022, 3:53am UTC](https://discuss.elastic.co/t/whole-data-from-db-not-updated-in-elastic-index/298030 "2022-02-24T03:53:17Z")
input { jdbc { tags =\> "staff" jdbc\_connection\_string =\> "jdbc:postgresql://${DB\_HOST}:${DB\_PORT}/${DB\_NAME}" jdbc\_user =\> "${DB\_USER}" jdbc\_password =\> "${DB\_PASSWORD}" schedule =\> "\* \* \* \* \*" … --- ## [I want to rebuild the old runtime environment](https://discuss.elastic.co/t/i-want-to-rebuild-the-old-runtime-environment/297829)
**Author:** [@TANIGUCHIK](https://discuss.elastic.co/u/TANIGUCHIK)\ **Replies:** 5\ **Last updated:** [February 24, 2022, 1:49am UTC](https://discuss.elastic.co/t/i-want-to-rebuild-the-old-runtime-environment/297829 "2022-02-24T01:49:20Z")
I want to install an old plugin for 1.5.x to reproduce an old validation environment, but I could not install the plugin from the command line. Are there any pre-built plugin URLs left? Elasticsearch-cloud-aws 2.5.x E… --- ## [Large amounts of bulk data sent from Logstash to Elasticsearch after using pipelines](https://discuss.elastic.co/t/large-amounts-of-bulk-data-sent-from-logstash-to-elasticsearch-after-using-pipelines/298092)
**Author:** [@userR](https://discuss.elastic.co/u/userR)\ **Replies:** 3\ **Last updated:** [February 24, 2022, 1:18am UTC](https://discuss.elastic.co/t/large-amounts-of-bulk-data-sent-from-logstash-to-elasticsearch-after-using-pipelines/298092 "2022-02-24T01:18:41Z")
I recently changed my configuration from one logstash.config file to pipelines to make it easier. My pipelines.yml (replaced actual names with letters, main re-routes data to correct pipeline based on tag): - pipeline.… --- ## [Design Question - Better to have a summary text field or index each field as keyword and text](https://discuss.elastic.co/t/design-question-better-to-have-a-summary-text-field-or-index-each-field-as-keyword-and-text/297815)
**Author:** [@johnrodey](https://discuss.elastic.co/u/johnrodey)\ **Replies:** 1\ **Last updated:** [February 24, 2022, 1:03am UTC](https://discuss.elastic.co/t/design-question-better-to-have-a-summary-text-field-or-index-each-field-as-keyword-and-text/297815 "2022-02-24T01:03:39Z")
So I have a general design question. I have long been indexing documents where all string fields generally are stored as keywords. However now we are wanting to add the capability to allow users to enter a string and t… --- ## [Data enrichment](https://discuss.elastic.co/t/data-enrichment/298099)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 2\ **Last updated:** [February 24, 2022, 12:35am UTC](https://discuss.elastic.co/t/data-enrichment/298099 "2022-02-24T00:35:51Z")
How is best way for data enrichment? I have events with IDs of employees in ES, and want change them on their surname. How do it best way? Should I do it in logstash? Most helpful would be to change static lookup but I … --- ## [Should Data Nodes still be the same size?](https://discuss.elastic.co/t/should-data-nodes-still-be-the-same-size/298059)
**Author:** [@bunste](https://discuss.elastic.co/u/bunste)\ **Replies:** 2\ **Last updated:** [February 23, 2022, 11:20pm UTC](https://discuss.elastic.co/t/should-data-nodes-still-be-the-same-size/298059 "2022-02-23T23:20:53Z")
Hello all, In our company we run a small Elasticsearch cluster with meanwhile 6 data nodes. These have been added over time and are therefore equipped quite differently - especially in terms of disk capacity. Now we ar… --- ## [Beatsで収集したログを日次指定してlogstashに送信するには](https://discuss.elastic.co/t/beats-logstash/297841)
**Author:** [@gou\_gemma](https://discuss.elastic.co/u/gou_gemma)\ **Replies:** 4\ **Last updated:** [February 23, 2022, 11:17pm UTC](https://discuss.elastic.co/t/beats-logstash/297841 "2022-02-23T23:17:15Z")
winlogbeat,filebeatで収集したログをリアルタイムもしくは日次指定してlogstashに送信する方法が知りたいです。 どのソフトのymlファイルで設定すれば宜しいのでしょうか？ 宜しくお願い致します。 --- ## [Systemctlで起動する際、pipelines.ymlを読み込み起動する方法](https://discuss.elastic.co/t/systemctl-pipelines-yml/298094)
**Author:** [@gou\_gemma](https://discuss.elastic.co/u/gou_gemma)\ **Replies:** 0\ **Last updated:** [February 23, 2022, 11:16pm UTC](https://discuss.elastic.co/t/systemctl-pipelines-yml/298094 "2022-02-23T23:16:02Z")
logstashをsystemctl start logstashで起動する際、デフォルトでpipelines.ymlを読み込み起動すると認識していますが、pipelines.ymlを読み込んで起動しません。 /etc/systemd/system/logstash.serviceの内容は以下 \[Unit\] Description=logstash \[Service\] Type=simple User=root Group=roo… --- ## [Winlogbeatで複数ファイルを振り分ける方法](https://discuss.elastic.co/t/winlogbeat/298093)
**Author:** [@gou\_gemma](https://discuss.elastic.co/u/gou_gemma)\ **Replies:** 0\ **Last updated:** [February 23, 2022, 11:01pm UTC](https://discuss.elastic.co/t/winlogbeat/298093 "2022-02-23T23:01:51Z")
複数ディレクトリに格納されたファイルをwinlogbeatからlogstashにファイルを送信した後で、ディレクトリ毎にファイルを格納したいです。 filebeatであれば、tagsで振り分けができたのですがwinlogbeatではfilebeatでいう、tagsのような振り分けに適したパラメータがあるのでしょうか？ ちなみにfilebeatでは以下のようにディレクトリ毎に振り分けをしています。 output { if "fi… --- ## [Kibana Controls shows only top 10 values](https://discuss.elastic.co/t/kibana-controls-shows-only-top-10-values/297949)
**Author:** [@Eduard\_Abril](https://discuss.elastic.co/u/Eduard_Abril)\ **Replies:** 4\ **Last updated:** [February 23, 2022, 10:14pm UTC](https://discuss.elastic.co/t/kibana-controls-shows-only-top-10-values/297949 "2022-02-23T22:14:15Z")
Hi guys, I'm building some kibana dashbaords using control panel and I have a problem because control panel is showing only the first 10 values or at least it seems so. I understand that control panel does a terms aggr… --- ## [Logstash 7.x support on Debian 10 or 11](https://discuss.elastic.co/t/logstash-7-x-support-on-debian-10-or-11/298087)
**Author:** [@jeroen.antsec](https://discuss.elastic.co/u/jeroen.antsec)\ **Replies:** 0\ **Last updated:** [February 23, 2022, 9:48pm UTC](https://discuss.elastic.co/t/logstash-7-x-support-on-debian-10-or-11/298087 "2022-02-23T21:48:06Z")
Hi all. Do any of you know the reason why Logstash 7.x (all versions up to 7.17) are not officially supported on Debian 10 or 11? Elastic and Kibana are, but Logstash not. Only version 8.0 is supported on Debian 10. Wil… --- ## [Logstash parshing unicode characters](https://discuss.elastic.co/t/logstash-parshing-unicode-characters/296890)
**Author:** [@vee](https://discuss.elastic.co/u/vee)\ **Replies:** 16\ **Last updated:** [February 23, 2022, 8:46pm UTC](https://discuss.elastic.co/t/logstash-parshing-unicode-characters/296890 "2022-02-23T20:46:48Z")
hi, we are running into parsing errors when sending data through logstash pipelines. After digging a little, found that the source system has been sending a lot of unicode special characters - something like below: \\u00… --- ## [Can not connect to localhost:9600 for logstash](https://discuss.elastic.co/t/can-not-connect-to-localhost-9600-for-logstash/297687)
**Author:** [@TomYang1993](https://discuss.elastic.co/u/TomYang1993)\ **Replies:** 13\ **Last updated:** [February 23, 2022, 7:23pm UTC](https://discuss.elastic.co/t/can-not-connect-to-localhost-9600-for-logstash/297687 "2022-02-23T19:23:22Z")
logstash 7.17.0 Elasticsearch 7.17.0 logstash with all default settings, fresh install use sudo systemctl start logstash to start, sudo status shows logstash actively running However, curl -XGET 'localhost:9600/?pret… --- ## [Geoip stopped consolidating coordinates after logstash upgrade to 8.0](https://discuss.elastic.co/t/geoip-stopped-consolidating-coordinates-after-logstash-upgrade-to-8-0/298067)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 2\ **Last updated:** [February 23, 2022, 6:46pm UTC](https://discuss.elastic.co/t/geoip-stopped-consolidating-coordinates-after-logstash-upgrade-to-8-0/298067 "2022-02-23T18:46:22Z")
My logstash for geo tagging IPs are failing after logstash upgrade 8.0. Here's a snippet , i get the lat and lon values , but cant seem to get into the "destlocation" field "Dest\_IP" =\> { "geo" =\> { … --- ## [Database Management](https://discuss.elastic.co/t/database-management/298060)
**Author:** [@John\_Dever\_Rusiana](https://discuss.elastic.co/u/John_Dever_Rusiana)\ **Replies:** 1\ **Last updated:** [February 23, 2022, 4:49pm UTC](https://discuss.elastic.co/t/database-management/298060 "2022-02-23T16:49:57Z")
Hi All, good day! I just want to ask from someone who have experienced in Database Management. As a database designer or manager, which would you prefer doing, normalization or denormalization of database? Why? Any ide… --- ## [Kibana Short URL Intended Use](https://discuss.elastic.co/t/kibana-short-url-intended-use/297619)
**Author:** [@Evesy](https://discuss.elastic.co/u/Evesy)\ **Replies:** 5\ **Last updated:** [February 23, 2022, 4:26pm UTC](https://discuss.elastic.co/t/kibana-short-url-intended-use/297619 "2022-02-23T16:26:21Z")
Hi, We've historically used Kibana's short URL feature to provide users with reliable links to predefined Kibana discover queries. This has been needed as we have Kibana behind a single sign-on flow which causes URL fr… --- ## [Shard Siem cause cluster red V2](https://discuss.elastic.co/t/shard-siem-cause-cluster-red-v2/296575)
**Author:** [@labate](https://discuss.elastic.co/u/labate)\ **Replies:** 1\ **Last updated:** [February 23, 2022, 4:14pm UTC](https://discuss.elastic.co/t/shard-siem-cause-cluster-red-v2/296575 "2022-02-23T16:14:43Z")
Hello everyone, I have a problem with my .siem-signals-default index. The shard goes to red status and I can't reallocate the shard to another node. Because the shard seems to not be in my cluster and I can't get it bac… --- ## [Logstash array how to and filter](https://discuss.elastic.co/t/logstash-array-how-to-and-filter/298054)
**Author:** [@melorium](https://discuss.elastic.co/u/melorium)\ **Replies:** 4\ **Last updated:** [February 23, 2022, 4:11pm UTC](https://discuss.elastic.co/t/logstash-array-how-to-and-filter/298054 "2022-02-23T16:11:26Z")
Hi. I have a list of user name's with user ID 1-100 each user id case a name that contains to it. Exmaple 01 "user 1" 02 "user2" etc. I my log events I have user id known but not user name. How can I match user id … --- ## [Cannot convert date to string by mutate](https://discuss.elastic.co/t/cannot-convert-date-to-string-by-mutate/298022)
**Author:** [@ivanhoe-dev](https://discuss.elastic.co/u/ivanhoe-dev)\ **Replies:** 4\ **Last updated:** [February 23, 2022, 3:25pm UTC](https://discuss.elastic.co/t/cannot-convert-date-to-string-by-mutate/298022 "2022-02-23T15:25:15Z")
I want to force my search\_varchar\_1 data type as string, but it always auto detect my data and parse as date type. Is there something I missed? My config filter { split {} csv { separator =\> "," skip\_header =\> "t… --- ## [What's the disk watermark actually applied while specified in both node configuration file and cluster settings?](https://discuss.elastic.co/t/whats-the-disk-watermark-actually-applied-while-specified-in-both-node-configuration-file-and-cluster-settings/297966)
**Author:** [@Hao\_Yellow](https://discuss.elastic.co/u/Hao_Yellow)\ **Replies:** 13\ **Last updated:** [February 23, 2022, 3:21pm UTC](https://discuss.elastic.co/t/whats-the-disk-watermark-actually-applied-while-specified-in-both-node-configuration-file-and-cluster-settings/297966 "2022-02-23T15:21:44Z")
Hello, I have a cluster of several nodes, where each node has the following configuration about the disk watermark: cluster.routing.allocation.disk.watermark.low=60gb cluster.routing.allocation.disk.watermark.high=50gb … --- ## [Parse json data with logstash](https://discuss.elastic.co/t/parse-json-data-with-logstash/297792)
**Author:** [@sylar11](https://discuss.elastic.co/u/sylar11)\ **Replies:** 7\ **Last updated:** [February 23, 2022, 2:54pm UTC](https://discuss.elastic.co/t/parse-json-data-with-logstash/297792 "2022-02-23T14:54:12Z")
Hi all, I'm a newbie to logstash and I'm trying to parse a JSON data file like the following { "A001": { "X": 503744.7, "Y": 4726339.0, "Z": 458.84, "LON": -2.954286956913572, … --- ## [Exists query problem](https://discuss.elastic.co/t/exists-query-problem/298037)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 1\ **Last updated:** [February 23, 2022, 2:45pm UTC](https://discuss.elastic.co/t/exists-query-problem/298037 "2022-02-23T14:45:37Z")
Hello friends, I need your help on a subject. There is a field with a nested type in an index and another field with a string type in this field. Any record has this field, but I would be very happy if you could help me … --- ## [Filebeat logging certificate error even when connection can be established](https://discuss.elastic.co/t/filebeat-logging-certificate-error-even-when-connection-can-be-established/297920)
**Author:** [@widhalmt](https://discuss.elastic.co/u/widhalmt)\ **Replies:** 1\ **Last updated:** [February 23, 2022, 1:13pm UTC](https://discuss.elastic.co/t/filebeat-logging-certificate-error-even-when-connection-can-be-established/297920 "2022-02-23T13:13:05Z")
Hi, I searched the board and other sources but all I found didn't match my case or did not receive a reply. So sorry if I missed something but at least I tried. :slight\_smile: I have beats that connect to two Logstash … --- ## [Uploading Images in kibana Dashboard](https://discuss.elastic.co/t/uploading-images-in-kibana-dashboard/27999)
**Author:** [@Suganthi\_Thangavel](https://discuss.elastic.co/u/Suganthi_Thangavel)\ **Replies:** 10\ **Last updated:** [February 23, 2022, 12:54pm UTC](https://discuss.elastic.co/t/uploading-images-in-kibana-dashboard/27999 "2022-02-23T12:54:53Z")
Hi, I have requirement to add some images to the Kibana Dashboard. Is there any plugin for kibana so that i can browse the image and upload to the panel. we are using kibana 3 Thanks Suganthi --- ## [Logstash plugin for Azure storage](https://discuss.elastic.co/t/logstash-plugin-for-azure-storage/297733)
**Author:** [@akpratiek](https://discuss.elastic.co/u/akpratiek)\ **Replies:** 10\ **Last updated:** [February 23, 2022, 12:17pm UTC](https://discuss.elastic.co/t/logstash-plugin-for-azure-storage/297733 "2022-02-23T12:17:12Z")
Hi Team , I am trying to access and retrieve files from Azure storage. I am getting the following error when I run the config file. Any help is appreciated. \< \[2022-02-21T12:07:37,177\]\[ERROR\]\[logstash.inputs.azureblobst… --- ## [Assigning Shards in ElasticSearch Cluster](https://discuss.elastic.co/t/assigning-shards-in-elasticsearch-cluster/298021)
**Author:** [@subham](https://discuss.elastic.co/u/subham)\ **Replies:** 1\ **Last updated:** [February 23, 2022, 11:59am UTC](https://discuss.elastic.co/t/assigning-shards-in-elasticsearch-cluster/298021 "2022-02-23T11:59:49Z")
Hi All, I have 8 nodes in my ES cluster. I want to de-provision 2 of the servers. When i stop the Elasticsearch process in 2 of my nodes, the 430 shards which are assigned to these 2 nodes gets unassigned. Is there any … --- ## [Aggregations on Unique Documents by field per day](https://discuss.elastic.co/t/aggregations-on-unique-documents-by-field-per-day/297999)
**Author:** [@baahubali](https://discuss.elastic.co/u/baahubali)\ **Replies:** 3\ **Last updated:** [February 23, 2022, 11:38am UTC](https://discuss.elastic.co/t/aggregations-on-unique-documents-by-field-per-day/297999 "2022-02-23T11:38:29Z")
We can find the Average of fields of all of the docs by using simple Metric. Great! We can find the Average of Averages per day using Average Bucket. Great! But how do we find Average of fields in single unique documen… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=695) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=697)