# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=770 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 771 --- ## [User keyword and zero\_terms\_query in the same query](https://discuss.elastic.co/t/user-keyword-and-zero-terms-query-in-the-same-query/290177)
**Author:** [@fabry](https://discuss.elastic.co/u/fabry)\ **Replies:** 0\ **Last updated:** [November 25, 2021, 1:06pm UTC](https://discuss.elastic.co/t/user-keyword-and-zero-terms-query-in-the-same-query/290177 "2021-11-25T13:06:52Z")
Hi we would like to build a query like the following ... ... bool: { must: \[ match : { myfield.myfield2 : { query: "myvalue", zero\_terms\_query: "all" } } \] } ... .… --- ## [Synchronization of Elasticsearch and relational databases with Logstash and JDBC disconnected EC2](https://discuss.elastic.co/t/synchronization-of-elasticsearch-and-relational-databases-with-logstash-and-jdbc-disconnected-ec2/290140)
**Author:** [@Soongu\_Jeon](https://discuss.elastic.co/u/Soongu_Jeon)\ **Replies:** 2\ **Last updated:** [November 25, 2021, 11:43am UTC](https://discuss.elastic.co/t/synchronization-of-elasticsearch-and-relational-databases-with-logstash-and-jdbc-disconnected-ec2/290140 "2021-11-25T11:43:00Z")
hi. After reading the above site article, I set the schedule for jdbc and mysql every 5 minutes, but the next day I turned on the background and checked, and the server was disconnected. How can I solve this problem? --- ## [Nodes restarting with shards initializing](https://discuss.elastic.co/t/nodes-restarting-with-shards-initializing/289489)
**Author:** [@Ayca](https://discuss.elastic.co/u/Ayca)\ **Replies:** 3\ **Last updated:** [November 25, 2021, 10:06am UTC](https://discuss.elastic.co/t/nodes-restarting-with-shards-initializing/289489 "2021-11-25T10:06:01Z")
Our elastic cluster had some nodes restarted with a network outage and when they were back, we were monitoring the shard reallocations. The question is, even on unaffected nodes were there shards in the state of "INITI… --- ## [Error with Logstash: error=\>"cannot link Java class io.netty.handler.ssl.OpenSsl, probable missing dependency: io.netty.internal.tcnative.SSLContext.setCipherSuite](https://discuss.elastic.co/t/error-with-logstash-error-cannot-link-java-class-io-netty-handler-ssl-openssl-probable-missing-dependency-io-netty-internal-tcnative-sslcontext-setciphersuite/290155)
**Author:** [@sarath.sarepaka](https://discuss.elastic.co/u/sarath.sarepaka)\ **Replies:** 0\ **Last updated:** [November 25, 2021, 10:03am UTC](https://discuss.elastic.co/t/error-with-logstash-error-cannot-link-java-class-io-netty-handler-ssl-openssl-probable-missing-dependency-io-netty-internal-tcnative-sslcontext-setciphersuite/290155 "2021-11-25T10:03:03Z")
We've upgraded our ELK stack from 6.4 version to 6.8.20 version. Elasticsearch and Kibana were upgraded without any issues. But we observed that Logstash service is restarting continuously after the upgradation. Elastic… --- ## [Persistance Queue Logstash](https://discuss.elastic.co/t/persistance-queue-logstash/290146)
**Author:** [@ahmed\_charafouddine](https://discuss.elastic.co/u/ahmed_charafouddine)\ **Replies:** 0\ **Last updated:** [November 25, 2021, 9:07am UTC](https://discuss.elastic.co/t/persistance-queue-logstash/290146 "2021-11-25T09:07:51Z")
Hello, To better understand logstash queue persistence, we would like to know if there would be a ratio of how much (bytes) between theoretical volume (incoming volume) and practical volume (stored volume) in logstash q… --- ## [Connect to Elasticsearch remotely](https://discuss.elastic.co/t/connect-to-elasticsearch-remotely/289919)
**Author:** [@AlexM566](https://discuss.elastic.co/u/AlexM566)\ **Replies:** 14\ **Last updated:** [November 24, 2021, 9:26am UTC](https://discuss.elastic.co/t/connect-to-elasticsearch-remotely/289919 "2021-11-24T09:26:37Z")
Hello community, I have a problem. I have installed on ubuntu 20.04 an ELK stack 7.15.2. My goal is to connect remotely to Elasticsearch to ingest data from a web form into Elasticsearch and my problem is that I cannot … --- ## [Long running uncancellable transport task](https://discuss.elastic.co/t/long-running-uncancellable-transport-task/290138)
**Author:** [@hunsw](https://discuss.elastic.co/u/hunsw)\ **Replies:** 0\ **Last updated:** [November 25, 2021, 8:10am UTC](https://discuss.elastic.co/t/long-running-uncancellable-transport-task/290138 "2021-11-25T08:10:23Z")
I have a transport task that cannot be cancelled, but has been running for 60+ days. I have 2 questions: Is there anything I can do to make this task disappear OTHER than restarting the node? (E.g. should I try to cl… --- ## [Logstash to handle multiline input from Filebeat](https://discuss.elastic.co/t/logstash-to-handle-multiline-input-from-filebeat/290116)
**Author:** [@grazia0912](https://discuss.elastic.co/u/grazia0912)\ **Replies:** 4\ **Last updated:** [November 25, 2021, 5:25am UTC](https://discuss.elastic.co/t/logstash-to-handle-multiline-input-from-filebeat/290116 "2021-11-25T05:25:28Z")
Hi, Would just like to ask how can Logstash handle multiline from input Filebeat. My filebeat already handles the multiline however the logstash still outputs only the first line. after the \\n all the rest are ignored … --- ## [Object mapping errors](https://discuss.elastic.co/t/object-mapping-errors/290032)
**Author:** [@Sconic](https://discuss.elastic.co/u/Sconic)\ **Replies:** 6\ **Last updated:** [November 25, 2021, 4:27am UTC](https://discuss.elastic.co/t/object-mapping-errors/290032 "2021-11-25T04:27:44Z")
Hi All, We've run into an issue with Logstash (or could be Filebeat) where it's not sending some log entries to ES. We're currently running version 7.15.2 of all the Elastic Components, although I haven't been able to … --- ## [Near Realtime Threat Intel enrichment using custom external sources stored on enrichment indexes](https://discuss.elastic.co/t/near-realtime-threat-intel-enrichment-using-custom-external-sources-stored-on-enrichment-indexes/289525)
**Author:** [@claudio.rifo](https://discuss.elastic.co/u/claudio.rifo)\ **Replies:** 1\ **Last updated:** [November 25, 2021, 3:05am UTC](https://discuss.elastic.co/t/near-realtime-threat-intel-enrichment-using-custom-external-sources-stored-on-enrichment-indexes/289525 "2021-11-25T03:05:13Z")
Hi There. First Ill try to explain my general idea (that I already have implemented and is working) then the problems I have and a few questions. The general idea is to have a Logstash ingest pipeline, lets call it Pip… --- ## [Unpack a list of hashes into new fields](https://discuss.elastic.co/t/unpack-a-list-of-hashes-into-new-fields/290107)
**Author:** [@antonisnyc94](https://discuss.elastic.co/u/antonisnyc94)\ **Replies:** 4\ **Last updated:** [November 25, 2021, 2:39am UTC](https://discuss.elastic.co/t/unpack-a-list-of-hashes-into-new-fields/290107 "2021-11-25T02:39:02Z")
Hello, I am having a field data.aws.httpRequest.headers , and it has a list of hashes as seen below. { "name": "host", "value": "testwebsite.com" }, { "name": "authorization", "value": "token hidden" }, { "na… --- ## [How to Create Login failed Rule](https://discuss.elastic.co/t/how-to-create-login-failed-rule/287862)
**Author:** [@Renz\_Aguilar](https://discuss.elastic.co/u/Renz_Aguilar)\ **Replies:** 2\ **Last updated:** [November 25, 2021, 1:46am UTC](https://discuss.elastic.co/t/how-to-create-login-failed-rule/287862 "2021-11-25T01:46:22Z")
Hi Team can i ask how to create a login failed rule on kibana? i want to monitor the users who failed logging in into their computer. --- ## [How to turn off the color marking in the log?](https://discuss.elastic.co/t/how-to-turn-off-the-color-marking-in-the-log/288897)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 2\ **Last updated:** [November 25, 2021, 1:06am UTC](https://discuss.elastic.co/t/how-to-turn-off-the-color-marking-in-the-log/288897 "2021-11-25T01:06:29Z")
There are many color marks in the logs collected from filebeat, which greatly affects the structure of the log. Is there any way to close it? Can I only change the log level from INFO to WARN? --- ## [Mapping conflict!](https://discuss.elastic.co/t/mapping-conflict/290084)
**Author:** [@Skeldren](https://discuss.elastic.co/u/Skeldren)\ **Replies:** 1\ **Last updated:** [November 24, 2021, 11:30pm UTC](https://discuss.elastic.co/t/mapping-conflict/290084 "2021-11-24T23:30:04Z")
Hey Guys! I have a question regarding a problem of Mapping conflict! I had to change one field type from string to integer. Due to the Index pattern include include both old indexes and new indexes, there are now confl… --- ## [Filter is removed when visualisation is saved](https://discuss.elastic.co/t/filter-is-removed-when-visualisation-is-saved/289655)
**Author:** [@Matt.Wash](https://discuss.elastic.co/u/Matt.Wash)\ **Replies:** 2\ **Last updated:** [November 24, 2021, 9:39pm UTC](https://discuss.elastic.co/t/filter-is-removed-when-visualisation-is-saved/289655 "2021-11-24T21:39:04Z")
when trying to save a lens visualisation after adding a filter, the filter is instantly removed. See attached gif. Anyone know what might be the cause? --- ## [Sametimes logs are not parsed](https://discuss.elastic.co/t/sametimes-logs-are-not-parsed/289940)
**Author:** [@gabrielfsousa](https://discuss.elastic.co/u/gabrielfsousa)\ **Replies:** 1\ **Last updated:** [November 24, 2021, 9:04pm UTC](https://discuss.elastic.co/t/sametimes-logs-are-not-parsed/289940 "2021-11-24T21:04:18Z")
Using filebeat 7.10.2 and sending to ES 7.10.2 , same times are logs not parsed, with no errors, exemple of a log not parsed {"type":"log","@timestamp":"2021-10-26T14:04:32Z","tags":\["info","plugins","security","audit",… --- ## [Create index for kube-system and rest of the namespaces another index](https://discuss.elastic.co/t/create-index-for-kube-system-and-rest-of-the-namespaces-another-index/290058)
**Author:** [@Murali\_Thumalapalli](https://discuss.elastic.co/u/Murali_Thumalapalli)\ **Replies:** 0\ **Last updated:** [November 24, 2021, 12:13pm UTC](https://discuss.elastic.co/t/create-index-for-kube-system-and-rest-of-the-namespaces-another-index/290058 "2021-11-24T12:13:02Z")
Hi Team, we are trying to create a new index for Kube-system namespace related logs as one index and rest of the system as another index. as part of that we have below spec read and deployed but we are not seeing any in… --- ## [Logs contains different format of same field name while parsing in logstash](https://discuss.elastic.co/t/logs-contains-different-format-of-same-field-name-while-parsing-in-logstash/290103)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 1\ **Last updated:** [November 24, 2021, 7:00pm UTC](https://discuss.elastic.co/t/logs-contains-different-format-of-same-field-name-while-parsing-in-logstash/290103 "2021-11-24T19:00:16Z")
Hi, I am using logstash to parse logs from txt file.I am having field "mstrGateway" and "MstrGateway" in two different logs, how to parse this field in single "mstrGateway" field. If I make two different fields such as… --- ## [Getting illegal\_state\_exception error while pushing logs to elasticsearch](https://discuss.elastic.co/t/getting-illegal-state-exception-error-while-pushing-logs-to-elasticsearch/290029)
**Author:** [@Chitrank\_Tyagi](https://discuss.elastic.co/u/Chitrank_Tyagi)\ **Replies:** 1\ **Last updated:** [November 24, 2021, 6:38pm UTC](https://discuss.elastic.co/t/getting-illegal-state-exception-error-while-pushing-logs-to-elasticsearch/290029 "2021-11-24T18:38:10Z")
I'm getting illegal\_state\_exception error, Can someone please help me this? mapping\_template.json : error: "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse field \[message\] of type \[text\] in do… --- ## [Get the @timestamp of the document that has the max of a value](https://discuss.elastic.co/t/get-the-timestamp-of-the-document-that-has-the-max-of-a-value/290093)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 3\ **Last updated:** [November 24, 2021, 6:31pm UTC](https://discuss.elastic.co/t/get-the-timestamp-of-the-document-that-has-the-max-of-a-value/290093 "2021-11-24T18:31:00Z")
Hi I need to get the max of memory usage per host in a time range, I think I can do this with the query below, but I also need the @timestamp of the document when the max memory usage happens. how can I do this? GET me… --- ## [Logstash concatinates topics](https://discuss.elastic.co/t/logstash-concatinates-topics/290033)
**Author:** [@Mamol27](https://discuss.elastic.co/u/Mamol27)\ **Replies:** 1\ **Last updated:** [November 24, 2021, 5:38pm UTC](https://discuss.elastic.co/t/logstash-concatinates-topics/290033 "2021-11-24T17:38:09Z")
Hi! I have pipeline kafka→logstash→Elasticsearch I created two topics in kafka: test-1 and test-2 Write manually to these topics messages: 67 into test-1 and 67 into test-2. I wrote two logstash workers test1.conf i… --- ## [Pagination, slice vs search\_after](https://discuss.elastic.co/t/pagination-slice-vs-search-after/290098)
**Author:** [@tamis-laan](https://discuss.elastic.co/u/tamis-laan)\ **Replies:** 0\ **Last updated:** [November 24, 2021, 5:37pm UTC](https://discuss.elastic.co/t/pagination-slice-vs-search-after/290098 "2021-11-24T17:37:49Z")
When looking at the documentation two methods are used for skipping pages namely search\_after and slice: What are the pro's and con's? Are they both equally efficient? Slice looks easier to use but is never mentioned… --- ## [Send user input to elasticsearch](https://discuss.elastic.co/t/send-user-input-to-elasticsearch/290065)
**Author:** [@AlexM566](https://discuss.elastic.co/u/AlexM566)\ **Replies:** 1\ **Last updated:** [November 24, 2021, 5:30pm UTC](https://discuss.elastic.co/t/send-user-input-to-elasticsearch/290065 "2021-11-24T17:30:30Z")
Hello everyone, I have a web form and I want user input to be stored in Elasticsearch into an index. I do no know how to do that, I have a method written in php but is not working :frowning: . The elk stack version is … --- ## [Bootstrap checks failed,](https://discuss.elastic.co/t/bootstrap-checks-failed/287674)
**Author:** [@manu\_john](https://discuss.elastic.co/u/manu_john)\ **Replies:** 4\ **Last updated:** [November 24, 2021, 4:59pm UTC](https://discuss.elastic.co/t/bootstrap-checks-failed/287674 "2021-11-24T16:59:17Z")
Using this repository Getting below error, as per the error checked the configuration and its all same as expected ERROR: \[1\] bootstrap checks failed. You must address the points described in the following \[1\] lines b… --- ## [Plotting the result of nested aggregations in kibana](https://discuss.elastic.co/t/plotting-the-result-of-nested-aggregations-in-kibana/290074)
**Author:** [@M.KRISHNAKANT\_ACHARY](https://discuss.elastic.co/u/M.KRISHNAKANT_ACHARY)\ **Replies:** 1\ **Last updated:** [November 24, 2021, 3:11pm UTC](https://discuss.elastic.co/t/plotting-the-result-of-nested-aggregations-in-kibana/290074 "2021-11-24T15:11:15Z")
I have an index which has nested data types. when I am running this query { "size":0, "aggs": { "tenant": { "nested": { "path": "custom\_details.tenantname" }, "aggs": { "count1… --- ## [Facing issue while reindexing document using elasticsearch-7.9.0.jar to Elasticsearch](https://discuss.elastic.co/t/facing-issue-while-reindexing-document-using-elasticsearch-7-9-0-jar-to-elasticsearch/290085)
**Author:** [@bikas](https://discuss.elastic.co/u/bikas)\ **Replies:** 0\ **Last updated:** [November 24, 2021, 2:50pm UTC](https://discuss.elastic.co/t/facing-issue-while-reindexing-document-using-elasticsearch-7-9-0-jar-to-elasticsearch/290085 "2021-11-24T14:50:09Z")
Hi Team, We are using Elasticsearch 7.9.0 having single node cluster. We have developed a plugin which is sitting inside plugins folder of Elasticsearch. We are using Elasticsearch SDK (org.Elasticsearch:Elasticsearch:… --- ## [Enhance the User Experience page with a search/filter bar similar to the one in APM](https://discuss.elastic.co/t/enhance-the-user-experience-page-with-a-search-filter-bar-similar-to-the-one-in-apm/289501)
**Author:** [@Kohlman](https://discuss.elastic.co/u/Kohlman)\ **Replies:** 5\ **Last updated:** [November 24, 2021, 1:47pm UTC](https://discuss.elastic.co/t/enhance-the-user-experience-page-with-a-search-filter-bar-similar-to-the-one-in-apm/289501 "2021-11-24T13:47:18Z")
We really like the User Experience page you have created. However, there are times where we wish we could filter the data. For example, by user.name or labels.some\_field. If we had a similar search bar to what's in APM i… --- ## [Extend cluster, new data nodes, identical disk space?](https://discuss.elastic.co/t/extend-cluster-new-data-nodes-identical-disk-space/289931)
**Author:** [@benoitp](https://discuss.elastic.co/u/benoitp)\ **Replies:** 7\ **Last updated:** [November 24, 2021, 1:07pm UTC](https://discuss.elastic.co/t/extend-cluster-new-data-nodes-identical-disk-space/289931 "2021-11-24T13:07:14Z")
Hello, I have a cluster with 4 data nodes, each with a storage of 4 To dedicated to the ES datas. Can i add 2 more data nodes, but only with 2 To of disk dedicated to the ES datas ? I don’t know if ES will handle this… --- ## [Negative axis does not work in TVSB](https://discuss.elastic.co/t/negative-axis-does-not-work-in-tvsb/290010)
**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\ **Replies:** 2\ **Last updated:** [November 24, 2021, 9:23am UTC](https://discuss.elastic.co/t/negative-axis-does-not-work-in-tvsb/290010 "2021-11-24T09:23:03Z")
I am trying to plot a graph on kibana using TSVB where inbound traffic is on top and outbound traffic is on the bottom. I am not able to get it in negative y axis I tried to follow this demo but does not work in my kiban… --- ## [Is there a way to stop visualizations from refreshing when editing a Lens?](https://discuss.elastic.co/t/is-there-a-way-to-stop-visualizations-from-refreshing-when-editing-a-lens/290020)
**Author:** [@aqiank](https://discuss.elastic.co/u/aqiank)\ **Replies:** 2\ **Last updated:** [November 24, 2021, 9:41am UTC](https://discuss.elastic.co/t/is-there-a-way-to-stop-visualizations-from-refreshing-when-editing-a-lens/290020 "2021-11-24T09:41:34Z")
Hi, I'm using Kibana 7.15. is it possible to tell Kibana to stop refresh visualizations when editing a Lens? It's really slow and seems to affect the UI as I can't edit anything while visualization is refreshing. There s… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=769) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=771)