# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=721 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 722 --- ## [Split text field in array with multiple value](https://discuss.elastic.co/t/split-text-field-in-array-with-multiple-value/295492)
**Author:** [@meyer1](https://discuss.elastic.co/u/meyer1)\ **Replies:** 1\ **Last updated:** [January 26, 2022, 5:45pm UTC](https://discuss.elastic.co/t/split-text-field-in-array-with-multiple-value/295492 "2022-01-26T17:45:51Z")
Hello ! I am new to kibana and Elasticsearch. My need : my document : { "text": "The 2 QUICK Brown-Foxes jumped over the lazy dog's bone." } and i want to create scripted field and i want this result { "splitText… --- ## [Specifics around local store recovery and out-of-sync shards](https://discuss.elastic.co/t/specifics-around-local-store-recovery-and-out-of-sync-shards/295401)
**Author:** [@Bryan\_Warner](https://discuss.elastic.co/u/Bryan_Warner)\ **Replies:** 4\ **Last updated:** [January 26, 2022, 5:42pm UTC](https://discuss.elastic.co/t/specifics-around-local-store-recovery-and-out-of-sync-shards/295401 "2022-01-26T17:42:51Z")
Hello, I'm trying to understand better how local shard data is recovered after a node comes back online (e.g. after a crash). I believe this recovery is called a "local store recovery" as stated in Index recovery API | … --- ## [CentOS Yum Repo Issues](https://discuss.elastic.co/t/centos-yum-repo-issues/294619)
**Author:** [@dgoldsmith](https://discuss.elastic.co/u/dgoldsmith)\ **Replies:** 2\ **Last updated:** [January 26, 2022, 4:34pm UTC](https://discuss.elastic.co/t/centos-yum-repo-issues/294619 "2022-01-26T16:34:58Z")
If I simply point a server to the Elastic Yum repo at https://artifacts.elastic.co/packages/7.x/yum/ using a copy of the Yum repo config file provided from the elastic web site, it is able to reach out and retrieve the Y… --- ## [Creating a new pipeline in Logstash](https://discuss.elastic.co/t/creating-a-new-pipeline-in-logstash/295478)
**Author:** [@goncalobsantos](https://discuss.elastic.co/u/goncalobsantos)\ **Replies:** 1\ **Last updated:** [January 26, 2022, 4:16pm UTC](https://discuss.elastic.co/t/creating-a-new-pipeline-in-logstash/295478 "2022-01-26T16:16:58Z")
Step 1. I have edited the pipelines.yml file, adding a third pipeline to the two already existing. Step 2. The corresponding configuration file is placed in the /conf.d folder. Step 3. I stoped and started logstash, ex… --- ## [Logstash with many config files vs one config with many files](https://discuss.elastic.co/t/logstash-with-many-config-files-vs-one-config-with-many-files/295473)
**Author:** [@nikssssss](https://discuss.elastic.co/u/nikssssss)\ **Replies:** 2\ **Last updated:** [January 26, 2022, 3:44pm UTC](https://discuss.elastic.co/t/logstash-with-many-config-files-vs-one-config-with-many-files/295473 "2022-01-26T15:44:46Z")
hello everybody, i have not understand what is the best solution if you have many input files. Should you use one config file with the configuration of input files or create one config file per input file. (ex. 5-10 fil… --- ## [ElasticSearch Read/Write performance issue on Peak Load](https://discuss.elastic.co/t/elasticsearch-read-write-performance-issue-on-peak-load/295216)
**Author:** [@sahil441](https://discuss.elastic.co/u/sahil441)\ **Replies:** 3\ **Last updated:** [January 26, 2022, 3:26pm UTC](https://discuss.elastic.co/t/elasticsearch-read-write-performance-issue-on-peak-load/295216 "2022-01-26T15:26:21Z")
Context: We are running ES Cluster (ES Version - "7.9.1") with 3 Master-Nodes & 8 data-nodes (AWS-"r5.2xlarge") We are using the default ES thread pool configuration There are 2 indices having 5 shards each (used by th… --- ## [Pipe to pipe with multiline codec on the second pipe](https://discuss.elastic.co/t/pipe-to-pipe-with-multiline-codec-on-the-second-pipe/295456)
**Author:** [@John\_Smith1](https://discuss.elastic.co/u/John_Smith1)\ **Replies:** 4\ **Last updated:** [January 26, 2022, 2:51pm UTC](https://discuss.elastic.co/t/pipe-to-pipe-with-multiline-codec-on-the-second-pipe/295456 "2022-01-26T14:51:33Z")
It's seems impossible, but just in case want to ask, is there some way to apply multiline code plugin in the second pipe, that receive logs from first pipe. first pipe pipe\_01.conf output: pipeline { send\_to =\>… --- ## [Documentation issue for elastic version 8 breaking changes](https://discuss.elastic.co/t/documentation-issue-for-elastic-version-8-breaking-changes/294416)
**Author:** [@raulk89](https://discuss.elastic.co/u/raulk89)\ **Replies:** 1\ **Last updated:** [January 26, 2022, 2:48pm UTC](https://discuss.elastic.co/t/documentation-issue-for-elastic-version-8-breaking-changes/294416 "2022-01-26T14:48:53Z")
Hi https://www.elastic.co/guide/en/elasticsearch/reference/8.0/migrating-8.0.html#breaking-changes-8.0 How one should understand this, seems like contrary sentences..? Regards Raul --- ## [Logstash LogStash::Error: Don’t know how to handle \`Java::JavaLang::IllegalArgumentException\` for \`PipelineAction::Create\\`](https://discuss.elastic.co/t/logstash-logstash-don-t-know-how-to-handle-java-illegalargumentexception-for-pipelineaction-create-main/295468)
**Author:** [@Faisal\_Malik](https://discuss.elastic.co/u/Faisal_Malik)\ **Replies:** 0\ **Last updated:** [January 26, 2022, 2:44pm UTC](https://discuss.elastic.co/t/logstash-logstash-don-t-know-how-to-handle-java-illegalargumentexception-for-pipelineaction-create-main/295468 "2022-01-26T14:44:43Z")
My logstash was working fine through the Helm chart in Kubernetes stateful set. I updated the logstash version from 7.9 to 7.16.2 but its don't work so I revert to the previous version 7.9 After reverting it also gives … --- ## [Broken Grok filter since V7.10.0](https://discuss.elastic.co/t/broken-grok-filter-since-v7-10-0/295379)
**Author:** [@Landong.Zuo](https://discuss.elastic.co/u/Landong.Zuo)\ **Replies:** 2\ **Last updated:** [January 26, 2022, 2:09pm UTC](https://discuss.elastic.co/t/broken-grok-filter-since-v7-10-0/295379 "2022-01-26T14:09:22Z")
Hi , I've recently upgraded logstash from V7.6.0 to V7.16.3. and have seen some odd behaviors of Grok filter since then. filter { grok { patterns\_dir =\> "C:\\software\\ELK\\config\\patterns" … --- ## [Extracting key pair Values using nested Json Paths](https://discuss.elastic.co/t/extracting-key-pair-values-using-nested-json-paths/295419)
**Author:** [@vaseemQA](https://discuss.elastic.co/u/vaseemQA)\ **Replies:** 4\ **Last updated:** [January 26, 2022, 1:35pm UTC](https://discuss.elastic.co/t/extracting-key-pair-values-using-nested-json-paths/295419 "2022-01-26T13:35:26Z")
Hi Guys, I'm Using Json plugin in filter and trying to fetch a value which resides in below json path. parsedJson.query.bool.filter\[0\].bool.must\[0\].bool.must\[2\].term\["list\_attributes.orderId.long"\].value and actually … --- ## [Systemd services' settings in deb packages](https://discuss.elastic.co/t/systemd-services-settings-in-deb-packages/295452)
**Author:** [@alexandrpaliy](https://discuss.elastic.co/u/alexandrpaliy)\ **Replies:** 0\ **Last updated:** [January 26, 2022, 12:52pm UTC](https://discuss.elastic.co/t/systemd-services-settings-in-deb-packages/295452 "2022-01-26T12:52:15Z")
Hi all. Just figured out that in deb packages, provided by your repo, systemd.service's 'Restart=' option is... inconsistent? $ systemctl cat elasticsearch | grep ^Restart \ $ systemctl cat logstash | grep ^Rest… --- ## [Engineer Lab + Instrutions](https://discuss.elastic.co/t/engineer-lab-instrutions/295154)
**Author:** [@HJE](https://discuss.elastic.co/u/HJE)\ **Replies:** 3\ **Last updated:** [January 26, 2022, 12:03pm UTC](https://discuss.elastic.co/t/engineer-lab-instrutions/295154 "2022-01-26T12:03:27Z")
Hi I have started the Elasticsearch Engineer on-demand, but my strigo access for that caorse have expired (i guess i where to slow to get the course done) So i wanted to set up my own lab, but i cant find the download l… --- ## [Logstash-plugin.bat fails to find bundled Java in 7.16.1](https://discuss.elastic.co/t/logstash-plugin-bat-fails-to-find-bundled-java-in-7-16-1/295358)
**Author:** [@stevedearl](https://discuss.elastic.co/u/stevedearl)\ **Replies:** 3\ **Last updated:** [January 26, 2022, 9:54am UTC](https://discuss.elastic.co/t/logstash-plugin-bat-fails-to-find-bundled-java-in-7-16-1/295358 "2022-01-26T09:54:07Z")
Hi All, I upgraded to 7.16.1 a little while back and noticed today that when I try to list the installed plugins I get the following error: C:\\APPS\\ELASTIC\\logstash-7.16.1\\bin\>logstash-plugin.bat list "Using bundled JD… --- ## [New installation - unable to start Elastic search on our harden RHEL8 image](https://discuss.elastic.co/t/new-installation-unable-to-start-elastic-search-on-our-harden-rhel8-image/295440)
**Author:** [@jokem48](https://discuss.elastic.co/u/jokem48)\ **Replies:** 0\ **Last updated:** [January 26, 2022, 9:38am UTC](https://discuss.elastic.co/t/new-installation-unable-to-start-elastic-search-on-our-harden-rhel8-image/295440 "2022-01-26T09:38:53Z")
Fresh install in our newly created RHEL8 vm. When we download and try to start Elasticsearch for the first time, we encounter an error. systemctl status ● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/l… --- ## [Siem Rule Duplication - Query Not Changed Despite Rule Edit](https://discuss.elastic.co/t/siem-rule-duplication-query-not-changed-despite-rule-edit/295433)
**Author:** [@Ofir\_Edi](https://discuss.elastic.co/u/Ofir_Edi)\ **Replies:** 0\ **Last updated:** [January 26, 2022, 9:03am UTC](https://discuss.elastic.co/t/siem-rule-duplication-query-not-changed-despite-rule-edit/295433 "2022-01-26T09:03:21Z")
Hi, We are using SIEM in Kibana for threat detection. We have a rule which uses a saved query that we duplicated. On the new rule we changed chose custom query and inserted a different query in kql. What happens is tha… --- ## [Elastic driver](https://discuss.elastic.co/t/elastic-driver/295425)
**Author:** [@bertvervaele](https://discuss.elastic.co/u/bertvervaele)\ **Replies:** 0\ **Last updated:** [January 26, 2022, 7:13am UTC](https://discuss.elastic.co/t/elastic-driver/295425 "2022-01-26T07:13:26Z")
Hi everyone, I encountered a wierd issue with the http encoding of the Elastic driver. In some of my projects it translates the '/' to '%2f' as it should and in others it doesn't. Any ideas are welcome :slight\_smile: … --- ## [Can't login in Kibana with any of the built-in users](https://discuss.elastic.co/t/cant-login-in-kibana-with-any-of-the-built-in-users/295248)
**Author:** [@Penchev](https://discuss.elastic.co/u/Penchev)\ **Replies:** 2\ **Last updated:** [January 26, 2022, 7:07am UTC](https://discuss.elastic.co/t/cant-login-in-kibana-with-any-of-the-built-in-users/295248 "2022-01-26T07:07:50Z")
Hi folks, I've just recently updated from 6.8.22 to 7.14.2. I configured the username and password of Kibana in the kibana keystore. My Elasticsearch cluster is up and running I can send requests via curl. I try to a… --- ## [Use global field](https://discuss.elastic.co/t/use-global-field/295420)
**Author:** [@ratseba](https://discuss.elastic.co/u/ratseba)\ **Replies:** 0\ **Last updated:** [January 26, 2022, 6:40am UTC](https://discuss.elastic.co/t/use-global-field/295420 "2022-01-26T06:40:07Z")
Hi, I have several environments with beats and logstash who write to one Elasticsearch. Each of them have properties like: customer, environmnet type ( production, test) and type (depending on what they are for). In ea… --- ## [How to increase query speed on search engine?](https://discuss.elastic.co/t/how-to-increase-query-speed-on-search-engine/295361)
**Author:** [@can.ozdemir](https://discuss.elastic.co/u/can.ozdemir)\ **Replies:** 3\ **Last updated:** [January 26, 2022, 5:36am UTC](https://discuss.elastic.co/t/how-to-increase-query-speed-on-search-engine/295361 "2022-01-26T05:36:35Z")
Hello there, We would like to improve the query response time of a search query on the cluster, you may ask what kind of query but I cannot share that information. The query does some full-text searches, then function\_… --- ## [Calculate time difference between two different time values excluding weekends](https://discuss.elastic.co/t/calculate-time-difference-between-two-different-time-values-excluding-weekends/295413)
**Author:** [@ryann](https://discuss.elastic.co/u/ryann)\ **Replies:** 2\ **Last updated:** [January 26, 2022, 5:10am UTC](https://discuss.elastic.co/t/calculate-time-difference-between-two-different-time-values-excluding-weekends/295413 "2022-01-26T05:10:53Z")
Currently have a logstash conf file that is gathering events with two time fields, createdDate and closedDate. Have a ruby code that calculates the time difference which is working as intended but looking for a way to ex… --- ## [Logstash error info : A plugin had an unrecoverable error. Will restart this plugin](https://discuss.elastic.co/t/logstash-error-info-a-plugin-had-an-unrecoverable-error-will-restart-this-plugin/295414)
**Author:** [@seth\_qiang](https://discuss.elastic.co/u/seth_qiang)\ **Replies:** 0\ **Last updated:** [January 26, 2022, 2:52am UTC](https://discuss.elastic.co/t/logstash-error-info-a-plugin-had-an-unrecoverable-error-will-restart-this-plugin/295414 "2022-01-26T02:52:40Z")
hi, everyone my logstash have some errors in my logstash. as follows keywords A plugin had an unrecoverable error. Will restart this plugin. Pipeline\_id:main Error: event executor terminated Exception: Java::JavaUt… --- ## [Date histogram error](https://discuss.elastic.co/t/date-histogram-error/295155)
**Author:** [@EnJay](https://discuss.elastic.co/u/EnJay)\ **Replies:** 11\ **Last updated:** [January 26, 2022, 1:11am UTC](https://discuss.elastic.co/t/date-histogram-error/295155 "2022-01-26T01:11:54Z")
Hello, dear community. Have an error with date histogram. I have a cryptocurrency price base with a 5 minute interval (4 million records). Fields: { "\_source": { "time":… --- ## [Fail to start Kibana 7.16.2](https://discuss.elastic.co/t/fail-to-start-kibana-7-16-2/293698)
**Author:** [@chilo](https://discuss.elastic.co/u/chilo)\ **Replies:** 10\ **Last updated:** [January 26, 2022, 12:08am UTC](https://discuss.elastic.co/t/fail-to-start-kibana-7-16-2/293698 "2022-01-26T00:08:28Z")
I have Elasticsearch and kibana running on version 7.9.2 for a very long time without issues. Lately, when I started to deploy Elasticsearch and kibana 7.16.2, I see the 403 error below: {"type":"log","@timestamp":"20… --- ## [Logstash TCP Zero Window - Palo Alto logs](https://discuss.elastic.co/t/logstash-tcp-zero-window-palo-alto-logs/295396)
**Author:** [@groth](https://discuss.elastic.co/u/groth)\ **Replies:** 3\ **Last updated:** [January 25, 2022, 10:36pm UTC](https://discuss.elastic.co/t/logstash-tcp-zero-window-palo-alto-logs/295396 "2022-01-25T22:36:06Z")
New to troubleshooting Logstash performance issues. I have a cluster of 3 load balanced virtual servers running Logstash that forward on to Elasticsearch in the cloud. We've noticed that we're not getting all of our logs… --- ## [Kibana service will not start Exit 126](https://discuss.elastic.co/t/kibana-service-will-not-start-exit-126/295286)
**Author:** [@craigothy](https://discuss.elastic.co/u/craigothy)\ **Replies:** 6\ **Last updated:** [January 25, 2022, 10:11pm UTC](https://discuss.elastic.co/t/kibana-service-will-not-start-exit-126/295286 "2022-01-25T22:11:12Z")
Upon trying to start kibana 7.16.3 after a fresh successful install on rhel 8, I am getting the following errors. Any ideas on what the cause could be. Thank you so much for any help. \> \[root@attack-range-elastic-server… --- ## [Differences in PUT requests in ES versions](https://discuss.elastic.co/t/differences-in-put-requests-in-es-versions/295171)
**Author:** [@EnJay](https://discuss.elastic.co/u/EnJay)\ **Replies:** 10\ **Last updated:** [January 25, 2022, 9:53pm UTC](https://discuss.elastic.co/t/differences-in-put-requests-in-es-versions/295171 "2022-01-25T21:53:50Z")
Hello everyone :hatched\_chick: I actively study Elasticsearch. I had to update my version ES to the latest from 5. But here I ran into a problem, the answer to which I could not find in the documentation. I used ES 5 … --- ## [Sorting a field on the view mode](https://discuss.elastic.co/t/sorting-a-field-on-the-view-mode/295251)
**Author:** [@dash5000](https://discuss.elastic.co/u/dash5000)\ **Replies:** 5\ **Last updated:** [January 25, 2022, 9:15pm UTC](https://discuss.elastic.co/t/sorting-a-field-on-the-view-mode/295251 "2022-01-25T21:15:11Z")
Hello Everyone, I was checking the sorting on the table visualization using the lens. I can sort the fields on the table in the edit mode, but i don't see the same option in the view mode. This is the drop down i see i… --- ## [Search templates {{#toJson}} with arrays: unexpected character](https://discuss.elastic.co/t/search-templates-tojson-with-arrays-unexpected-character/295398)
**Author:** [@Tristan2](https://discuss.elastic.co/u/Tristan2)\ **Replies:** 0\ **Last updated:** [January 25, 2022, 8:58pm UTC](https://discuss.elastic.co/t/search-templates-tojson-with-arrays-unexpected-character/295398 "2022-01-25T20:58:29Z")
I'm trying to parameterize \_source in a search template but I'm encountering an error. This is my template: PUT \_scripts/stored-script { "script": { "lang": "mustache", "source": { "\_source": "{{#toJson… --- ## [CPU usage metric via CAT API misbehaving after upgrading to 7.16.3 (running in LXD)](https://discuss.elastic.co/t/cpu-usage-metric-via-cat-api-misbehaving-after-upgrading-to-7-16-3-running-in-lxd/294620)
**Author:** [@juan.domenech](https://discuss.elastic.co/u/juan.domenech)\ **Replies:** 9\ **Last updated:** [January 25, 2022, 8:43pm UTC](https://discuss.elastic.co/t/cpu-usage-metric-via-cat-api-misbehaving-after-upgrading-to-7-16-3-running-in-lxd/294620 "2022-01-25T20:43:01Z")
Problem: In a 10 core CPU, 64GB RAM system, Centos 7.9 under LXD container virtualisation Elasticsearch reports wrong CPU usage after upgrading to 7.16.3 This issue wasn't present on 7.15.1 We use this metric to track … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=720) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=722)