# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=769 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 770 --- ## [Extracting a tag from an XML file using RSS input filter](https://discuss.elastic.co/t/extracting-a-tag-from-an-xml-file-using-rss-input-filter/289137)
**Author:** [@Franke2u](https://discuss.elastic.co/u/Franke2u)\ **Replies:** 6\ **Last updated:** [November 26, 2021, 1:30pm UTC](https://discuss.elastic.co/t/extracting-a-tag-from-an-xml-file-using-rss-input-filter/289137 "2021-11-26T13:30:56Z")
On Logstash the RSS input filter is not getting the 'enclosure' or 'subtitle' items below. How do I force those items to be logged? \ Day https://year/day Sat, 13 Nov 2021 Fo… --- ## [Kibana error for theme validation](https://discuss.elastic.co/t/kibana-error-for-theme-validation/289878)
**Author:** [@DPattee](https://discuss.elastic.co/u/DPattee)\ **Replies:** 1\ **Last updated:** [November 26, 2021, 11:19am UTC](https://discuss.elastic.co/t/kibana-error-for-theme-validation/289878 "2021-11-26T11:19:14Z")
I just noticed that my kibana log is full of 'failed validation' errors... like zillions of them: log \[11:21:26.836\] \[warning\]\[ui-settings-service\] Ignore invalid UiSettings value. Error: \[validation \[theme:version\]\]… --- ## [Unable to search for phrases between double quotes in Saved Objects Explorer](https://discuss.elastic.co/t/unable-to-search-for-phrases-between-double-quotes-in-saved-objects-explorer/288561)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [November 26, 2021, 11:12am UTC](https://discuss.elastic.co/t/unable-to-search-for-phrases-between-double-quotes-in-saved-objects-explorer/288561 "2021-11-26T11:12:13Z")
Hello, It seems it's no longer possible to search for objects in the Saved Objects Explorer with multiple words between double quotes. The result is that it's very hard to find some objects... For example searching for… --- ## [When writing to ES and get 400 status code, can you get the original log message?](https://discuss.elastic.co/t/when-writing-to-es-and-get-400-status-code-can-you-get-the-original-log-message/290239)
**Author:** [@zcola](https://discuss.elastic.co/u/zcola)\ **Replies:** 1\ **Last updated:** [November 26, 2021, 10:54am UTC](https://discuss.elastic.co/t/when-writing-to-es-and-get-400-status-code-can-you-get-the-original-log-message/290239 "2021-11-26T10:54:49Z")
{:status=\>400, :action=\>\["index", {:\_id=\>nil, :\_index=\>"monitor3\_api\_logtail\_write", :\_type=\>"logs", :routing=\>nil}, #\\], :response=\>{"index"=\>{"\_index"=\>"monitor3\_api\_logtail-2021.11.25-00068… --- ## [To change Label Position](https://discuss.elastic.co/t/to-change-label-position/290238)
**Author:** [@SwetaD](https://discuss.elastic.co/u/SwetaD)\ **Replies:** 4\ **Last updated:** [November 26, 2021, 10:36am UTC](https://discuss.elastic.co/t/to-change-label-position/290238 "2021-11-26T10:36:51Z")
Can someone please help on how to change the Label Position from bottom to top? ONU ALIAS to be on top instead of bottom. Using Kibana v7.10.0 --- ## [Logstash file input path options](https://discuss.elastic.co/t/logstash-file-input-path-options/290269)
**Author:** [@mangesh\_shinde](https://discuss.elastic.co/u/mangesh_shinde)\ **Replies:** 0\ **Last updated:** [November 26, 2021, 10:10am UTC](https://discuss.elastic.co/t/logstash-file-input-path-options/290269 "2021-11-26T10:10:07Z")
I have two subfolders under the parent folder naming like platform\* i want to specify path option like that in parent folder whichever subfolder start with platform should be the path for .csv file --- ## [How can I take dump of freeze index?](https://discuss.elastic.co/t/how-can-i-take-dump-of-freeze-index/290268)
**Author:** [@Sage](https://discuss.elastic.co/u/Sage)\ **Replies:** 0\ **Last updated:** [November 26, 2021, 10:05am UTC](https://discuss.elastic.co/t/how-can-i-take-dump-of-freeze-index/290268 "2021-11-26T10:05:50Z")
Hi, I am facing an issue with elasticdump. I want to take dump of all index in which some of freeze indices but getting issue with freeze index. Can anyone tell me is possible to take dump of freeze index? --- ## [400 bad request error](https://discuss.elastic.co/t/400-bad-request-error/290265)
**Author:** [@Keerthana\_Paga](https://discuss.elastic.co/u/Keerthana_Paga)\ **Replies:** 1\ **Last updated:** [November 26, 2021, 9:56am UTC](https://discuss.elastic.co/t/400-bad-request-error/290265 "2021-11-26T09:56:49Z")
root@:/etc/kibana# curl -IL localhost:5601 HTTP/1.1 302 Found location: /spaces/enter kbn-name: kbn-license-sig: cache-control: private, no-cache, no-store, must-revalidate content-length: 0 Date: Fri, 26 Nov 2021… --- ## [Return latency\_info.keyword in a Watcher for Kibana elasticsearch](https://discuss.elastic.co/t/return-latency-info-keyword-in-a-watcher-for-kibana-elasticsearch/290261)
**Author:** [@Aitor\_MtzAm](https://discuss.elastic.co/u/Aitor_MtzAm)\ **Replies:** 0\ **Last updated:** [November 26, 2021, 9:43am UTC](https://discuss.elastic.co/t/return-latency-info-keyword-in-a-watcher-for-kibana-elasticsearch/290261 "2021-11-26T09:43:40Z")
Hello! I am really a little newbie in Elasticsearch. I need help returning the latency\_info.keyword field. I am setting up a wathcer for an API and I need a webhook in teams to show me that field. I have this created: "… --- ## [Netflow input and output](https://discuss.elastic.co/t/netflow-input-and-output/289974)
**Author:** [@btjtaylor](https://discuss.elastic.co/u/btjtaylor)\ **Replies:** 2\ **Last updated:** [November 26, 2021, 9:29am UTC](https://discuss.elastic.co/t/netflow-input-and-output/289974 "2021-11-26T09:29:03Z")
Hi all I need to receive netflow data and output it to multiple destinations (just testing with single destination for now) Im running logstash 7.15.2 under windows I made the following logstash config file but it cra… --- ## [Missing documents after elastic restart](https://discuss.elastic.co/t/missing-documents-after-elastic-restart/290210)
**Author:** [@adminunix](https://discuss.elastic.co/u/adminunix)\ **Replies:** 5\ **Last updated:** [November 26, 2021, 9:28am UTC](https://discuss.elastic.co/t/missing-documents-after-elastic-restart/290210 "2021-11-26T09:28:16Z")
Hello, I have had a strange issue. An index has lost many documents and the elastic logs doesn´t show any message about it. These are monitoring visualizations about the index: I have noticed this issue after res… --- ## [Warning in Rules](https://discuss.elastic.co/t/warning-in-rules/290036)
**Author:** [@norgro2601](https://discuss.elastic.co/u/norgro2601)\ **Replies:** 3\ **Last updated:** [November 26, 2021, 8:21am UTC](https://discuss.elastic.co/t/warning-in-rules/290036 "2021-11-26T08:21:06Z")
Hi, I have an environment with several spaces to separate access to different indices, e.g. space a has only access to indices "filebeat-a-\*", space b to "filebeat-b-\*". In Security I've activated some of the provided … --- ## [How many logstash can connect to elasticsearch cluster?](https://discuss.elastic.co/t/how-many-logstash-can-connect-to-elasticsearch-cluster/290242)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 1\ **Last updated:** [November 26, 2021, 7:43am UTC](https://discuss.elastic.co/t/how-many-logstash-can-connect-to-elasticsearch-cluster/290242 "2021-11-26T07:43:01Z")
we have logstash with 4 pipeline and each pipeline.worker is set to 120 and Elasticsearch cluster has 6 data nodes.(c5.9xlarge) we are facing high cpu usage in Elasticsearch data nodes when we have more than 10 logstash… --- ## [How to ignore a field from search if the field is not part of mappings?](https://discuss.elastic.co/t/how-to-ignore-a-field-from-search-if-the-field-is-not-part-of-mappings/290228)
**Author:** [@Raghavan\_TV](https://discuss.elastic.co/u/Raghavan_TV)\ **Replies:** 0\ **Last updated:** [November 26, 2021, 4:28am UTC](https://discuss.elastic.co/t/how-to-ignore-a-field-from-search-if-the-field-is-not-part-of-mappings/290228 "2021-11-26T04:28:00Z")
The document in elastic has field mappings only for the fields catalog and @type . now if a user sends an non-existing field ( countryCode ) in the search, is there a way in elastic to instruct to ignore the field in the… --- ## [Need help to create logstash json.conf file](https://discuss.elastic.co/t/need-help-to-create-logstash-json-conf-file/290225)
**Author:** [@hagaluly](https://discuss.elastic.co/u/hagaluly)\ **Replies:** 3\ **Last updated:** [November 26, 2021, 4:10am UTC](https://discuss.elastic.co/t/need-help-to-create-logstash-json-conf-file/290225 "2021-11-26T04:10:42Z")
i have jenkins job that outputs a json file. i want to know how can i build the logstash conf file in order to export it to Elasticsearch i have tried different configs but always failing on parsing errors. json file … --- ## [How to implement deflate (best compression)?](https://discuss.elastic.co/t/how-to-implement-deflate-best-compression/289984)
**Author:** [@Linuxuser](https://discuss.elastic.co/u/Linuxuser)\ **Replies:** 23\ **Last updated:** [November 25, 2021, 11:00pm UTC](https://discuss.elastic.co/t/how-to-implement-deflate-best-compression/289984 "2021-11-25T23:00:24Z")
Hello, kindly help me out. My elastic version is 6.3 how can i implement best compression for the log stored by elastic. Thanks --- ## [How to make WebStorm / TypeScript completion work?](https://discuss.elastic.co/t/how-to-make-webstorm-typescript-completion-work/290222)
**Author:** [@davestewart](https://discuss.elastic.co/u/davestewart)\ **Replies:** 0\ **Last updated:** [November 25, 2021, 10:09pm UTC](https://discuss.elastic.co/t/how-to-make-webstorm-typescript-completion-work/290222 "2021-11-25T22:09:09Z")
Hi there, I'm pretty new to Elastic, been using it on and off for about a year, using the JavaScript client. I finally seem to be at the stage where I understand how to build complex queries, bool, match\_phrase\_prefix,… --- ## [Logstash-codec-plain is broken dependency in Logstash version 7.15.2](https://discuss.elastic.co/t/logstash-codec-plain-is-broken-dependency-in-logstash-version-7-15-2/290212)
**Author:** [@Saida\_Meftah](https://discuss.elastic.co/u/Saida_Meftah)\ **Replies:** 1\ **Last updated:** [November 25, 2021, 8:23pm UTC](https://discuss.elastic.co/t/logstash-codec-plain-is-broken-dependency-in-logstash-version-7-15-2/290212 "2021-11-25T20:23:08Z")
I am trying to install Logstash-output-loki plugin, the logstash-codec-plain causes a dependency conflict, looks like this plugin is a broken dependency. My Logstash version is 7.15.2, this problem is not happening in L… --- ## [Stats aggregation returning inconsistent results](https://discuss.elastic.co/t/stats-aggregation-returning-inconsistent-results/289377)
**Author:** [@Doug\_Coburn](https://discuss.elastic.co/u/Doug_Coburn)\ **Replies:** 1\ **Last updated:** [November 25, 2021, 7:27pm UTC](https://discuss.elastic.co/t/stats-aggregation-returning-inconsistent-results/289377 "2021-11-25T19:27:00Z")
Using version 7.9.2 curl -X POST 172.31.26.133:9200/5cab6838-5c3a-455d-9486-a708f6cb20a7/\_search --data-raw '{"aggs":{"Stats":{"stats":{"field":"Date & Time"}}},"size":0}' -H 'content-type: application/json' { "too… --- ## [How to configure ELK for geoip](https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590)
**Author:** [@root\_linux](https://discuss.elastic.co/u/root_linux)\ **Replies:** 21\ **Last updated:** [November 25, 2021, 6:50pm UTC](https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590 "2021-11-25T18:50:21Z")
Hi, I want to configure ELK stack. Elasticsearch, Kibana and Logstash will configure at one server and there will be multiple filebeat client. How can I configure for geoip? What need to configure in Elasticsearch, Kiba… --- ## [Group data and create a new index whit it](https://discuss.elastic.co/t/group-data-and-create-a-new-index-whit-it/290208)
**Author:** [@lino\_alejandro](https://discuss.elastic.co/u/lino_alejandro)\ **Replies:** 0\ **Last updated:** [November 25, 2021, 6:19pm UTC](https://discuss.elastic.co/t/group-data-and-create-a-new-index-whit-it/290208 "2021-11-25T18:19:54Z")
I have this data in my index { "filekey": "book1", "word": "carlos", "page": 1 }, { "filekey": "book1", "word": "license", "page": 1 }, { "filekey": "book1", "word": "carlos", … --- ## [Csv filter : how to deal with missing field?](https://discuss.elastic.co/t/csv-filter-how-to-deal-with-missing-field/290147)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 2\ **Last updated:** [November 25, 2021, 4:09pm UTC](https://discuss.elastic.co/t/csv-filter-how-to-deal-with-missing-field/290147 "2021-11-25T16:09:17Z")
Hello ! I have the following data : \<188\>Nov 25 07:38:31 172.28.192.111 ts-swsan-p11 raslogd: 2021/11/25-07:38:31, \[MAPS-1003\], 28921, WWN 10:00:88:94:71:c4:c0:e0 | FID 128, WARNING, ts-swsan-p11, SW11\_TS\_VPLEX\_P01\_E1… --- ## [Problems enabling security features](https://discuss.elastic.co/t/problems-enabling-security-features/290164)
**Author:** [@johnny1891](https://discuss.elastic.co/u/johnny1891)\ **Replies:** 2\ **Last updated:** [November 25, 2021, 4:04pm UTC](https://discuss.elastic.co/t/problems-enabling-security-features/290164 "2021-11-25T16:04:05Z")
Hi, I am trying to enable password so that I can create a super user to access some pages after enabling the EDR trial for 30 days in the license management page after setting up ELK stack. The reason is I got this err… --- ## [Is it possible to mask field name in mappings?](https://discuss.elastic.co/t/is-it-possible-to-mask-field-name-in-mappings/290193)
**Author:** [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Replies:** 1\ **Last updated:** [November 25, 2021, 3:21pm UTC](https://discuss.elastic.co/t/is-it-possible-to-mask-field-name-in-mappings/290193 "2021-11-25T15:21:58Z")
Hello! I'd like to set all fields type as keyword except some custom fields. "properties": { "field1": { "type" : "text" }, "\*": { "type" : "keyword" } } doesn't work ant the fields mapping dynamically. Is there… --- ## [Heartbeat monitoring for a particular URL fails](https://discuss.elastic.co/t/heartbeat-monitoring-for-a-particular-url-fails/289219)
**Author:** [@maheshe](https://discuss.elastic.co/u/maheshe)\ **Replies:** 1\ **Last updated:** [November 25, 2021, 2:58pm UTC](https://discuss.elastic.co/t/heartbeat-monitoring-for-a-particular-url-fails/289219 "2021-11-25T14:58:35Z")
Hi, We are using heartbeat 7.9 client to dump the monitoring logs to Elasticsearch/Kibana 7.11 version. One particular url is returning monitor.status down even though the site is up and is returning 200. This is the s… --- ## [Pagination with PIT query required on each request?](https://discuss.elastic.co/t/pagination-with-pit-query-required-on-each-request/290144)
**Author:** [@tamis-laan](https://discuss.elastic.co/u/tamis-laan)\ **Replies:** 1\ **Last updated:** [November 25, 2021, 2:49pm UTC](https://discuss.elastic.co/t/pagination-with-pit-query-required-on-each-request/290144 "2021-11-25T14:49:44Z")
When you start a query and request a PIT ID do you need to send the query along in subsequent requests? Is the search index and query not cached and referenced by the PIT id? And if the query is required, what happens … --- ## [Concatenating array objects in elasticsearch transform aggregations](https://discuss.elastic.co/t/concatenating-array-objects-in-elasticsearch-transform-aggregations/289980)
**Author:** [@kbirk](https://discuss.elastic.co/u/kbirk)\ **Replies:** 2\ **Last updated:** [November 25, 2021, 2:42pm UTC](https://discuss.elastic.co/t/concatenating-array-objects-in-elasticsearch-transform-aggregations/289980 "2021-11-25T14:42:12Z")
I'm currently using an Elasticsearch transform in order to "merge" similar documents. It works very well, however I've run into an issue attempting to concatenate fields that contain an array of objects. For example, I… --- ## [Process in stall state while shutdown](https://discuss.elastic.co/t/process-in-stall-state-while-shutdown/290014)
**Author:** [@Vinutha\_A\_H](https://discuss.elastic.co/u/Vinutha_A_H)\ **Replies:** 3\ **Last updated:** [November 25, 2021, 2:03pm UTC](https://discuss.elastic.co/t/process-in-stall-state-while-shutdown/290014 "2021-11-25T14:03:44Z")
We have a script to stop the logstash, which inturn runs 'kill -15 '. This script is being called as part of system init file which in turn stops as part of server reboot. However, recently we see issues in prod while s… --- ## [Elasticsearch cluster load balancing](https://discuss.elastic.co/t/elasticsearch-cluster-load-balancing/290187)
**Author:** [@dooger21](https://discuss.elastic.co/u/dooger21)\ **Replies:** 0\ **Last updated:** [November 25, 2021, 1:56pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-load-balancing/290187 "2021-11-25T13:56:41Z")
Hi everyone, Please I need your help with the following: I have an Elasticsearch cluster (3 nodes) in version 7.14 configured and working, as it is in a productive environment, the following safeguards were implemented … --- ## [Replacing \_id field](https://discuss.elastic.co/t/replacing-id-field/290167)
**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\ **Replies:** 2\ **Last updated:** [November 25, 2021, 1:10pm UTC](https://discuss.elastic.co/t/replacing-id-field/290167 "2021-11-25T13:10:39Z")
there is \_id field auto generated by Elasticsearch which differ the each doc So I have an unique field to set as \_id field I want to that field as \_id for doc in Logstash conf How do to that [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=768) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=770)