# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=717 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 718 --- ## [Finding bottleneck in pipeline](https://discuss.elastic.co/t/finding-bottleneck-in-pipeline/294308)
**Author:** [@YvorL](https://discuss.elastic.co/u/YvorL)\ **Replies:** 8\ **Last updated:** [February 1, 2022, 1:19am UTC](https://discuss.elastic.co/t/finding-bottleneck-in-pipeline/294308 "2022-02-01T01:19:51Z")
Hello, I'm looking for brave and clever people who can help out someone in a pinch. I've been struggling to find out why one of my (very busy) index is lagging behind. I've been reading different posts, suggestions, et… --- ## [Compatibility Kibana/Elasticsearch - Same major version but different minor versions](https://discuss.elastic.co/t/compatibility-kibana-elasticsearch-same-major-version-but-different-minor-versions/295689)
**Author:** [@Sylmarch](https://discuss.elastic.co/u/Sylmarch)\ **Replies:** 2\ **Last updated:** [February 1, 2022, 12:18am UTC](https://discuss.elastic.co/t/compatibility-kibana-elasticsearch-same-major-version-but-different-minor-versions/295689 "2022-02-01T00:18:01Z")
Hello Elastic team! We plan to install Wazuh HIDS. They indicates that it is possible to use Elastic stack solution instead of Open Distro for Elastic solution. So we plan to use our existing Elasticsearch v7.16 clust… --- ## [Gateway settings](https://discuss.elastic.co/t/gateway-settings/295848)
**Author:** [@njain213](https://discuss.elastic.co/u/njain213)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 12:06am UTC](https://discuss.elastic.co/t/gateway-settings/295848 "2022-02-01T00:06:05Z")
Hello Team, I am using ES version 7.9.3. I just want to confirm regarding gateway settings. I am having hot,warm and cold architecture. Master nodes : 3 Data nodes: 13 (hot nodes : 3, cold nodes: 6, warm nodes : 4) W… --- ## [Spike in response time during deleteByQuery](https://discuss.elastic.co/t/spike-in-response-time-during-deletebyquery/295766)
**Author:** [@bradptp](https://discuss.elastic.co/u/bradptp)\ **Replies:** 23\ **Last updated:** [February 1, 2022, 12:05am UTC](https://discuss.elastic.co/t/spike-in-response-time-during-deletebyquery/295766 "2022-02-01T00:05:57Z")
We're using a deletebyQuery to remove a large number of records from Elasticsearch using a query similar to this: let query = { "query": { "bool": { "must\_not": { … --- ## [Has anyone seen automatic heap sizing work?](https://discuss.elastic.co/t/has-anyone-seen-automatic-heap-sizing-work/295887)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 0\ **Last updated:** [January 31, 2022, 10:53pm UTC](https://discuss.elastic.co/t/has-anyone-seen-automatic-heap-sizing-work/295887 "2022-01-31T22:53:19Z")
All postings I've seen are complaints where it doesn't. If it works for you, can you explain how it works? Does it start with the default 1G heap and grow? Does it set a reasonable heap size \> 1G at startup? My test … --- ## [Mapping explosion vs. the filebeat template](https://discuss.elastic.co/t/mapping-explosion-vs-the-filebeat-template/295886)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 0\ **Last updated:** [January 31, 2022, 10:49pm UTC](https://discuss.elastic.co/t/mapping-explosion-vs-the-filebeat-template/295886 "2022-01-31T22:49:10Z")
I'm struggling trying to figure out how to convert from the way we used legacy templates to the new index and component templates. I used to add our own templates with higher priority on top of the supplied filebeat tem… --- ## [Http input plugin](https://discuss.elastic.co/t/http-input-plugin/295609)
**Author:** [@steevhise](https://discuss.elastic.co/u/steevhise)\ **Replies:** 3\ **Last updated:** [January 31, 2022, 10:39pm UTC](https://discuss.elastic.co/t/http-input-plugin/295609 "2022-01-31T22:39:47Z")
I'm trying to debug communication with an endpoint set up in Logstash using the http input plugin. I'd like to be able to see in the logstash log the raw request payload that logstash receives but I can't figure out how … --- ## [Yellow index (primary shard seems fine)](https://discuss.elastic.co/t/yellow-index-primary-shard-seems-fine/295563)
**Author:** [@Michael\_Ubry](https://discuss.elastic.co/u/Michael_Ubry)\ **Replies:** 4\ **Last updated:** [January 31, 2022, 9:48pm UTC](https://discuss.elastic.co/t/yellow-index-primary-shard-seems-fine/295563 "2022-01-31T21:48:37Z")
Hi, most of my indices are yellow. I am curious about one particular index, which is important to me. Due to confidentiallity I have to rename it in Paint and in codes bellow. When I use this code I get result whats in… --- ## [Where is iptables dashboard?](https://discuss.elastic.co/t/where-is-iptables-dashboard/295850)
**Author:** [@mevan](https://discuss.elastic.co/u/mevan)\ **Replies:** 2\ **Last updated:** [January 31, 2022, 8:38pm UTC](https://discuss.elastic.co/t/where-is-iptables-dashboard/295850 "2022-01-31T20:38:41Z")
Documentation for iptables module speaks of 'dashboards for visualizing the log data' and 'module comes with sample dashboards' yet when I reference Dashboard in Kibana all I see is 'Create your first dashboard.' Nothing… --- ## [Merge data and metadata csv file in logstash](https://discuss.elastic.co/t/merge-data-and-metadata-csv-file-in-logstash/295815)
**Author:** [@danova](https://discuss.elastic.co/u/danova)\ **Replies:** 2\ **Last updated:** [January 31, 2022, 8:13pm UTC](https://discuss.elastic.co/t/merge-data-and-metadata-csv-file-in-logstash/295815 "2022-01-31T20:13:05Z")
Hi, I´m trying to import/combine two csv files as follows logstash\_metadata.csv: Sample,Treatment,Code S4444003,T\_7896\_D3,G10 S4444004,T\_4516\_D0t1h,G01 logstash\_file.csv: Sample,genus,value S4444003,Chloronema… --- ## [Get the most out of Elastic Security - Ubuntu and Windows Servers](https://discuss.elastic.co/t/get-the-most-out-of-elastic-security-ubuntu-and-windows-servers/294977)
**Author:** [@PSFletchTheTek](https://discuss.elastic.co/u/PSFletchTheTek)\ **Replies:** 7\ **Last updated:** [January 31, 2022, 7:11pm UTC](https://discuss.elastic.co/t/get-the-most-out-of-elastic-security-ubuntu-and-windows-servers/294977 "2022-01-31T19:11:19Z")
Hi All, I'm looking at Elasticsearch security and how much I can use it. I have windows and ubuntu servers, Can anyone recommend which beats and modules are best to work with the SIEM to make sure its being feed with a… --- ## [Visualization of errors aggregated by exception name and stack trace](https://discuss.elastic.co/t/visualization-of-errors-aggregated-by-exception-name-and-stack-trace/295709)
**Author:** [@xsw2-2wsx](https://discuss.elastic.co/u/xsw2-2wsx)\ **Replies:** 2\ **Last updated:** [January 31, 2022, 5:59pm UTC](https://discuss.elastic.co/t/visualization-of-errors-aggregated-by-exception-name-and-stack-trace/295709 "2022-01-31T17:59:00Z")
Hi, I am looking for a Kibana visualization that displays the count of errors that took place in a time range, grouped by an exception and a stack trace. the relevant mappings: { "index\_patterns": \[ ... \], "mappin… --- ## [Threshold rule : how to?](https://discuss.elastic.co/t/threshold-rule-how-to/295568)
**Author:** [@jfs1](https://discuss.elastic.co/u/jfs1)\ **Replies:** 2\ **Last updated:** [January 31, 2022, 3:53pm UTC](https://discuss.elastic.co/t/threshold-rule-how-to/295568 "2022-01-31T15:53:12Z")
Maybe stupid newbie question here. I want to create a rule that triggers an alert when "count(distinct(source.ip))" is above a certain threshold. Hard time figuring out how the 'Group by" and "Count" fields must be ass… --- ## [Error restoring state from URL when Opening Dashboards](https://discuss.elastic.co/t/error-restoring-state-from-url-when-opening-dashboards/295471)
**Author:** [@chjimenez](https://discuss.elastic.co/u/chjimenez)\ **Replies:** 3\ **Last updated:** [January 31, 2022, 3:31pm UTC](https://discuss.elastic.co/t/error-restoring-state-from-url-when-opening-dashboards/295471 "2022-01-31T15:31:20Z")
Hello, Since I updated from 6.8.0 to 7.16,3 always get this error " Error restoring state from URL Unable to completely restore the URL, be sure to use the share functionality." when opening any Dashboard. BUT dashboard… --- ## [Only String and Array types are splittable. field:\[array\]\[method\] is of type = NilClass"](https://discuss.elastic.co/t/only-string-and-array-types-are-splittable-field-array-method-is-of-type-nilclass/295861)
**Author:** [@rutika\_kamble](https://discuss.elastic.co/u/rutika_kamble)\ **Replies:** 0\ **Last updated:** [January 31, 2022, 3:21pm UTC](https://discuss.elastic.co/t/only-string-and-array-types-are-splittable-field-array-method-is-of-type-nilclass/295861 "2022-01-31T15:21:39Z")
I am trying to input JSON data from logs through logstash to Elasticsearch but I am getting this error field:\[array\]\[method\] is of type = NilClass" Preformatted text Please find my logstash conf file- input { http { … --- ## [Bulk API - can't add more than one row](https://discuss.elastic.co/t/bulk-api-cant-add-more-than-one-row/295718)
**Author:** [@yamaga](https://discuss.elastic.co/u/yamaga)\ **Replies:** 3\ **Last updated:** [January 31, 2022, 12:34pm UTC](https://discuss.elastic.co/t/bulk-api-cant-add-more-than-one-row/295718 "2022-01-31T12:34:35Z")
Hi I am trying to add some data with Bulk API, but it takes only the last record of my JSON input data. Here an example with 3 record: input data: \[ { "ID\_PROD": "15136", "UNIT": "UN", "RATE": 1 }, … --- ## [Elasticsearch deployment issue in ECK cluster](https://discuss.elastic.co/t/elasticsearch-deployment-issue-in-eck-cluster/295835)
**Author:** [@rathu\_buwa](https://discuss.elastic.co/u/rathu_buwa)\ **Replies:** 0\ **Last updated:** [January 31, 2022, 12:05pm UTC](https://discuss.elastic.co/t/elasticsearch-deployment-issue-in-eck-cluster/295835 "2022-01-31T12:05:11Z")
I Already deployed ECK cluster on our on premise servers. And try to deployed 3node Elasticsearch cluster (3 master data nodes). already firewall was disabled in our VMs. we faced below issue in after Elasticsearch deplo… --- ## [Getting separate values from single variable value in logstash](https://discuss.elastic.co/t/getting-separate-values-from-single-variable-value-in-logstash/295806)
**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\ **Replies:** 4\ **Last updated:** [January 31, 2022, 11:50am UTC](https://discuss.elastic.co/t/getting-separate-values-from-single-variable-value-in-logstash/295806 "2022-01-31T11:50:16Z")
I have log line as follows file\_name,file\_id,size,file\_owner,folder\_id,folder\_name,path\_ids,folder\_owner,deleted,date\_modified,date\_uploaded,folder\_paths nash+animal models.docx,884054786846,20068,xyz@123.com,1499863948… --- ## [Store binary files in elastic search](https://discuss.elastic.co/t/store-binary-files-in-elastic-search/295805)
**Author:** [@Arpita11](https://discuss.elastic.co/u/Arpita11)\ **Replies:** 8\ **Last updated:** [January 31, 2022, 11:36am UTC](https://discuss.elastic.co/t/store-binary-files-in-elastic-search/295805 "2022-01-31T11:36:19Z")
For my project, we are storing the data in Elasticsearch. I have new requirement regarding documents (i.e. the actual binaries): Store documents and be able to search the text within the document binary. Allow the use… --- ## [How do I use match query inside a nested aggregation?](https://discuss.elastic.co/t/how-do-i-use-match-query-inside-a-nested-aggregation/295811)
**Author:** [@dotel](https://discuss.elastic.co/u/dotel)\ **Replies:** 2\ **Last updated:** [January 31, 2022, 11:17am UTC](https://discuss.elastic.co/t/how-do-i-use-match-query-inside-a-nested-aggregation/295811 "2022-01-31T11:17:06Z")
Is there a way to do a match query inside nested aggregation? The query below works fine for my use case but it uses a term filter instead of a match. So searching for "nursery" will result in 0 buckets. GET sushant-ten… --- ## [Index Health often red](https://discuss.elastic.co/t/index-health-often-red/294367)
**Author:** [@it-dept](https://discuss.elastic.co/u/it-dept)\ **Replies:** 10\ **Last updated:** [January 31, 2022, 10:24am UTC](https://discuss.elastic.co/t/index-health-often-red/294367 "2022-01-31T10:24:17Z")
Good day. We have Elasticsearch version 7.13.3 on separated server, not a cluster. And often one of the indexes turns red. We are deleting it. But after a while it turns red again. May be there is a solution to how to … --- ## [How to convert String into JSon format?](https://discuss.elastic.co/t/how-to-convert-string-into-json-format/295703)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 3\ **Last updated:** [January 31, 2022, 10:17am UTC](https://discuss.elastic.co/t/how-to-convert-string-into-json-format/295703 "2022-01-31T10:17:20Z")
Hello Friends, Need your help to parse string into Json format in logstash. { "id":"xxx", "MessageCreateDate":"2022-01-20", "Response":"{'Cardholder':{'cards':\[{'isPrimaryCard':'N','cardNumber':'xxxxxxxxxx','r… --- ## [How to make \_id available for aggs?](https://discuss.elastic.co/t/how-to-make-id-available-for-aggs/295814)
**Author:** [@Emporea](https://discuss.elastic.co/u/Emporea)\ **Replies:** 0\ **Last updated:** [January 31, 2022, 10:03am UTC](https://discuss.elastic.co/t/how-to-make-id-available-for-aggs/295814 "2022-01-31T10:03:42Z")
Upon indexing I overwrote \_id with my own unique \_id field filled with integers. How can I aggregate something like max on my \_id field? max\_id: { max: { field: "\_id" } } This only throws an error. Currently I am usi… --- ## [Copy complete event to a field of a new event](https://discuss.elastic.co/t/copy-complete-event-to-a-field-of-a-new-event/295583)
**Author:** [@HansPeterSloot](https://discuss.elastic.co/u/HansPeterSloot)\ **Replies:** 7\ **Last updated:** [January 31, 2022, 9:26am UTC](https://discuss.elastic.co/t/copy-complete-event-to-a-field-of-a-new-event/295583 "2022-01-31T09:26:52Z")
Hi, I want to copy all fields of an event to a field of a new event in a logstash filter This { " agent ": " Mozilla / 5.0(compatible; MSIE 9.0)", " ip ": " 192.168.24.44 ", " request ": " / in… --- ## [Logstash cloud.id and proxies/LB](https://discuss.elastic.co/t/logstash-cloud-id-and-proxies-lb/294223)
**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\ **Replies:** 6\ **Last updated:** [January 31, 2022, 8:44am UTC](https://discuss.elastic.co/t/logstash-cloud-id-and-proxies-lb/294223 "2022-01-31T08:44:22Z")
Hello, I'm trying to understand the use of cloud.id in Logstash. Based on this typical diagram if I configure Logstash to use the cloud.id will hit the LB layer , the prox… --- ## [Give User access to execute particular query](https://discuss.elastic.co/t/give-user-access-to-execute-particular-query/295742)
**Author:** [@Adityadgr8](https://discuss.elastic.co/u/Adityadgr8)\ **Replies:** 2\ **Last updated:** [January 31, 2022, 8:35am UTC](https://discuss.elastic.co/t/give-user-access-to-execute-particular-query/295742 "2022-01-31T08:35:30Z")
Index Name : sampleindex@timestamp Everyday new index is being created with current date I made one user in kibana and assigned a particular role to the user: I already added sampleindex\* with privilages: monitor, … --- ## [Change default Page size of 50 in dashboard form saved search](https://discuss.elastic.co/t/change-default-page-size-of-50-in-dashboard-form-saved-search/294555)
**Author:** [@Moni](https://discuss.elastic.co/u/Moni)\ **Replies:** 3\ **Last updated:** [January 31, 2022, 8:27am UTC](https://discuss.elastic.co/t/change-default-page-size-of-50-in-dashboard-form-saved-search/294555 "2022-01-31T08:27:40Z")
When I try to create a dashboard from an existing saved search result (from discover) the default page size is 50 and there is no option to change this in the dashboard/panel. Atleast I could not locate. Do let me know i… --- ## [How to use Grok for JSON parsing](https://discuss.elastic.co/t/how-to-use-grok-for-json-parsing/295794)
**Author:** [@Adabi\_Raihan](https://discuss.elastic.co/u/Adabi_Raihan)\ **Replies:** 2\ **Last updated:** [January 31, 2022, 4:58am UTC](https://discuss.elastic.co/t/how-to-use-grok-for-json-parsing/295794 "2022-01-31T04:58:59Z")
Hi, I want to parse this JSON object to ELK { "Format": "IDEA0", "ID": "2b03eb1f-fc4c-4f67-94e5-31c9fb32dccc", "DetectTime": "2022-01-31T08:16:12.600470+07:00", "EventTime": "2022-01-31T01:23:01.637438+00:00", "Categor… --- ## [Cef message split](https://discuss.elastic.co/t/cef-message-split/295797)
**Author:** [@Rohit\_Mangotra](https://discuss.elastic.co/u/Rohit_Mangotra)\ **Replies:** 5\ **Last updated:** [January 31, 2022, 4:08am UTC](https://discuss.elastic.co/t/cef-message-split/295797 "2022-01-31T04:08:46Z")
Hi, I am new to ELK and learning it now as part of my job. I am getting .cef logs from imperva waf that needs to be split in to fields so that it can be uploaded to the Elastic. Please let me know how I can achieve thi… --- ## [Return documents that matches : Filter nested record with Max Start date and match a keyword : Search for candidate having last job with a keyword](https://discuss.elastic.co/t/return-documents-that-matches-filter-nested-record-with-max-start-date-and-match-a-keyword-search-for-candidate-having-last-job-with-a-keyword/295786)
**Author:** [@aloksharma](https://discuss.elastic.co/u/aloksharma)\ **Replies:** 0\ **Last updated:** [January 30, 2022, 7:51pm UTC](https://discuss.elastic.co/t/return-documents-that-matches-filter-nested-record-with-max-start-date-and-match-a-keyword-search-for-candidate-having-last-job-with-a-keyword/295786 "2022-01-30T19:51:50Z")
Hi, After all tries I am here to seek help. I have following structure of the document: { "candidate\_id" : 1234, "location" : { "city" : "NY", "country" : "US" }, "age" : 32, "highest\_education" : "Graduate", "job\_his… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=716) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=718)