# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=781 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 782 --- ## ["bad\_certificate" error on elasticsearch input plugin](https://discuss.elastic.co/t/bad-certificate-error-on-elasticsearch-input-plugin/288812)
**Author:** [@plubbs](https://discuss.elastic.co/u/plubbs)\ **Replies:** 5\ **Last updated:** [November 10, 2021, 2:40pm UTC](https://discuss.elastic.co/t/bad-certificate-error-on-elasticsearch-input-plugin/288812 "2021-11-10T14:40:22Z")
Hello, TLDR - Our certificate we use with the output-Elasticsearch plugin does not work on the input-Elasticsearch plugin despite being a valid certificate We are currently attempting to connect to an existing index in… --- ## [Filtering on external syslog message.keyword for SRC=aaa.bbb.ccc.ddd IP address](https://discuss.elastic.co/t/filtering-on-external-syslog-message-keyword-for-src-aaa-bbb-ccc-ddd-ip-address/287216)
**Author:** [@Johnf](https://discuss.elastic.co/u/Johnf)\ **Replies:** 4\ **Last updated:** [November 10, 2021, 2:06pm UTC](https://discuss.elastic.co/t/filtering-on-external-syslog-message-keyword-for-src-aaa-bbb-ccc-ddd-ip-address/287216 "2021-11-10T14:06:07Z")
I am new to the list. Hopefully I am in the right thread location. I have a external remote syslog being ported to an internal Logstash syslog input and sent to Elasticsearch engine. Typically the message contains the d… --- ## [Split a specific csv column into multiple fields](https://discuss.elastic.co/t/split-a-specific-csv-column-into-multiple-fields/288875)
**Author:** [@Greninja\_San](https://discuss.elastic.co/u/Greninja_San)\ **Replies:** 2\ **Last updated:** [November 10, 2021, 2:03pm UTC](https://discuss.elastic.co/t/split-a-specific-csv-column-into-multiple-fields/288875 "2021-11-10T14:03:33Z")
I have a csv file, with data like this : field1;field2;field3,field4\_1::field4\_2::field4\_3;field5;field6 The 4th field is composed of 3 values that I want to divide into 3 different fields in Elasticsearch. Is there a… --- ## [Maximum number of records per second in time series bar chart](https://discuss.elastic.co/t/maximum-number-of-records-per-second-in-time-series-bar-chart/288743)
**Author:** [@Bert\_Vanpeteghem](https://discuss.elastic.co/u/Bert_Vanpeteghem)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 1:58pm UTC](https://discuss.elastic.co/t/maximum-number-of-records-per-second-in-time-series-bar-chart/288743 "2021-11-10T13:58:24Z")
Hi, how can i visualize the maximum number of records per second in a time series bar chart (that will choose interval automatically). So when the interval changes to eg hourly, I want to see the maximum number of recor… --- ## [How to read the data displayed inside \[ERROR\]\[org.logstash.Logstash\]?](https://discuss.elastic.co/t/how-to-read-the-data-displayed-inside-error-org-logstash-logstash/288893)
**Author:** [@Robert\_Neagu](https://discuss.elastic.co/u/Robert_Neagu)\ **Replies:** 0\ **Last updated:** [November 10, 2021, 1:45pm UTC](https://discuss.elastic.co/t/how-to-read-the-data-displayed-inside-error-org-logstash-logstash/288893 "2021-11-10T13:45:30Z")
I want to read the data that is displayed inside the \[ERROR\]\[org.logstash.Logstash\] section inside the email plugin. --- ## [Suggest query does not work when used with script query?](https://discuss.elastic.co/t/suggest-query-does-not-work-when-used-with-script-query/288888)
**Author:** [@Ejaz\_Ahmed](https://discuss.elastic.co/u/Ejaz_Ahmed)\ **Replies:** 0\ **Last updated:** [November 10, 2021, 1:02pm UTC](https://discuss.elastic.co/t/suggest-query-does-not-work-when-used-with-script-query/288888 "2021-11-10T13:02:50Z")
Suggest query does not return anything when used with script \_score query {"\_source": {"excludes": \["tag", "document\_vector"\]}, "size": 1000, "query": { "script\_score": { "q… --- ## [Trying to rename all elements inside array](https://discuss.elastic.co/t/trying-to-rename-all-elements-inside-array/288884)
**Author:** [@Ankitkumar\_Ravidas](https://discuss.elastic.co/u/Ankitkumar_Ravidas)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 12:36pm UTC](https://discuss.elastic.co/t/trying-to-rename-all-elements-inside-array/288884 "2021-11-10T12:36:23Z")
Hi team, i have tags array in my mongodb contacts collection, which contain mongodb ids, its store as "tags":\[{"$oid":"61822c908200c6b810bfee4d"},{"$oid":"61822c908200c6b810bfee4e"}\] i want to rename all element… --- ## [High cardinality aggregation questions](https://discuss.elastic.co/t/high-cardinality-aggregation-questions/287169)
**Author:** [@galambo](https://discuss.elastic.co/u/galambo)\ **Replies:** 5\ **Last updated:** [November 10, 2021, 12:15pm UTC](https://discuss.elastic.co/t/high-cardinality-aggregation-questions/287169 "2021-11-10T12:15:55Z")
Hello, I'm currently working on a use case with an extremely high cardinality (couple of million combinations) and I'm having trouble understanding how ES behaves with aggregations. Here are sample documents: { … --- ## [ElasticSearch when I index there is like a limit in which It stops indexing and increments the number of docs.deleted](https://discuss.elastic.co/t/elasticsearch-when-i-index-there-is-like-a-limit-in-which-it-stops-indexing-and-increments-the-number-of-docs-deleted/288797)
**Author:** [@Juliito19](https://discuss.elastic.co/u/Juliito19)\ **Replies:** 5\ **Last updated:** [November 10, 2021, 12:06pm UTC](https://discuss.elastic.co/t/elasticsearch-when-i-index-there-is-like-a-limit-in-which-it-stops-indexing-and-increments-the-number-of-docs-deleted/288797 "2021-11-10T12:06:27Z")
Hi, I have an Apliccation in which I have an Elasticsearch template and I Insert with the pattern of template+(yyyy-MM-dd), Well, So far, so good, I think, but for each Index I suppose that have like a Limit in which w… --- ## [Collapsing / Hiding stack traces in the log stream view?](https://discuss.elastic.co/t/collapsing-hiding-stack-traces-in-the-log-stream-view/288767)
**Author:** [@Matthias\_W](https://discuss.elastic.co/u/Matthias_W)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 11:29am UTC](https://discuss.elastic.co/t/collapsing-hiding-stack-traces-in-the-log-stream-view/288767 "2021-11-10T11:29:42Z")
Hi, is there any way to collapse / hide stack traces in the "Observability - Logs - Stream" view? Large stack traces make scrolling quite unpleasant and usability really suffers (even when using small text and having a… --- ## [Could not read repository data from index blob](https://discuss.elastic.co/t/could-not-read-repository-data-from-index-blob/288880)
**Author:** [@vaclav1](https://discuss.elastic.co/u/vaclav1)\ **Replies:** 0\ **Last updated:** [November 10, 2021, 11:14am UTC](https://discuss.elastic.co/t/could-not-read-repository-data-from-index-blob/288880 "2021-11-10T11:14:20Z")
When trying to read all snaphots from the repository in s3 we are getting the error: \[user@adapt103:~\]$ curl 'http://localhost:9200/\_cat/snapshots/adapt-prod\_202111?pretty' { "error" : { "root\_cause" : \[ { … --- ## [Index PDF with Ingest Attachement Plugin using NodeJS Client](https://discuss.elastic.co/t/index-pdf-with-ingest-attachement-plugin-using-nodejs-client/288870)
**Author:** [@BE-CH](https://discuss.elastic.co/u/BE-CH)\ **Replies:** 3\ **Last updated:** [November 10, 2021, 11:04am UTC](https://discuss.elastic.co/t/index-pdf-with-ingest-attachement-plugin-using-nodejs-client/288870 "2021-11-10T11:04:34Z")
I am having a hard time understanding how I can index files such PDF and .RTF files using the Ingest Attachment Processor Plugin and make them searchable. My main problem seems to be that I can't search for the files af… --- ## [Failure authentication not displayed at "security-hosts-authentications"](https://discuss.elastic.co/t/failure-authentication-not-displayed-at-security-hosts-authentications/288096)
**Author:** [@sadux](https://discuss.elastic.co/u/sadux)\ **Replies:** 8\ **Last updated:** [November 10, 2021, 10:48am UTC](https://discuss.elastic.co/t/failure-authentication-not-displayed-at-security-hosts-authentications/288096 "2021-11-10T10:48:30Z")
Hello! Just upgrade Kibana and Elasticsearch from 7.8 to 7.15.1 and found, that Failure authentications not displayed at "security-hosts-authentications". With Success auth all good and they displayed at Authentications… --- ## [Results not displayed in kibana](https://discuss.elastic.co/t/results-not-displayed-in-kibana/288874)
**Author:** [@mostafaelsayed](https://discuss.elastic.co/u/mostafaelsayed)\ **Replies:** 0\ **Last updated:** [November 10, 2021, 10:34am UTC](https://discuss.elastic.co/t/results-not-displayed-in-kibana/288874 "2021-11-10T10:34:50Z")
Hello I have an Elasticsearch index that has one primary shard and one replica shard. This is a snapshot of the document count: document count on the primary shard is 677919 document count on the replica shard is 638… --- ## [Http\_poller plugin and parsing second level of json](https://discuss.elastic.co/t/http-poller-plugin-and-parsing-second-level-of-json/288872)
**Author:** [@111435](https://discuss.elastic.co/u/111435)\ **Replies:** 0\ **Last updated:** [November 10, 2021, 10:09am UTC](https://discuss.elastic.co/t/http-poller-plugin-and-parsing-second-level-of-json/288872 "2021-11-10T10:09:09Z")
Hello, I am using Http\_poller plugin for get api call. My conf.file: input { http\_poller { urls =\> { test2 =\> { method =\> get url =\> "https://somethin.somethin.kz/uapi/tickets?api\_token=fdf… --- ## [Problem getting text search hits](https://discuss.elastic.co/t/problem-getting-text-search-hits/288601)
**Author:** [@TS1997](https://discuss.elastic.co/u/TS1997)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 9:47am UTC](https://discuss.elastic.co/t/problem-getting-text-search-hits/288601 "2021-11-10T09:47:29Z")
Hello, I'm currently trying to implement my first search using Elasticsearch in Pimcore but am having issues getting hits on text strings. I'm currently using the Kibana dev tools to perform my search so Pimcore is only… --- ## [Limit of total fields has been exceeded -\> set for dynamic daily index](https://discuss.elastic.co/t/limit-of-total-fields-has-been-exceeded-set-for-dynamic-daily-index/288851)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 0\ **Last updated:** [November 10, 2021, 7:46am UTC](https://discuss.elastic.co/t/limit-of-total-fields-has-been-exceeded-set-for-dynamic-daily-index/288851 "2021-11-10T07:46:49Z")
Hi How can I set permanently for my all index index.mapping.total\_fields.limit I've daily indexes index =\> "logstash-test2000-%{+YYYY.MM.dd}" below input was set for only one index PUT logstash-\*/\_settings { "index… --- ## [Kibana not found elasticsearch host](https://discuss.elastic.co/t/kibana-not-found-elasticsearch-host/288839)
**Author:** [@mehmood1](https://discuss.elastic.co/u/mehmood1)\ **Replies:** 14\ **Last updated:** [November 10, 2021, 5:15am UTC](https://discuss.elastic.co/t/kibana-not-found-elasticsearch-host/288839 "2021-11-10T05:15:02Z")
when i run kibana.bat on windows os it is showing error. Both are running in same machine. FATAL Error: \[config validation of \[server\].host\]: types that failed validation: \[config validation of \[server\].host.0\]: val… --- ## [Logstash showing Document count as 1. only last line of the syslog is displaying in kibana](https://discuss.elastic.co/t/logstash-showing-document-count-as-1-only-last-line-of-the-syslog-is-displaying-in-kibana/288787)
**Author:** [@kalyan\_M](https://discuss.elastic.co/u/kalyan_M)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 4:02pm UTC](https://discuss.elastic.co/t/logstash-showing-document-count-as-1-only-last-line-of-the-syslog-is-displaying-in-kibana/288787 "2021-11-09T16:02:12Z")
Hi, I am new to ELK configurations. I configured the ubuntu VM logs to ELK VM. I am getting logs from the ubuntu VM to log stash. but it was showing document count as only 1. please help with the issue. --- ## [Kibana Development 7.15 Yarn Bootstrap Fails no native build was found for platform=linux](https://discuss.elastic.co/t/kibana-development-7-15-yarn-bootstrap-fails-no-native-build-was-found-for-platform-linux/288282)
**Author:** [@Jsof](https://discuss.elastic.co/u/Jsof)\ **Replies:** 4\ **Last updated:** [November 10, 2021, 1:47am UTC](https://discuss.elastic.co/t/kibana-development-7-15-yarn-bootstrap-fails-no-native-build-was-found-for-platform-linux/288282 "2021-11-10T01:47:28Z")
Hi, i am trying to get kibana development environment for kibana 7.15 running but i keep getting the error below when running "yarn kbn boostrap". I am running the dev environment on CentOS Linux release 7.8.2003 \[vsco… --- ## [CPU at 100% with XPACK security Enabled - ES 7.9.0](https://discuss.elastic.co/t/cpu-at-100-with-xpack-security-enabled-es-7-9-0/288820)
**Author:** [@ilavajuthy](https://discuss.elastic.co/u/ilavajuthy)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 11:29pm UTC](https://discuss.elastic.co/t/cpu-at-100-with-xpack-security-enabled-es-7-9-0/288820 "2021-11-09T23:29:11Z")
Hi, We are noticing high CPU after upgrading to 7.9.0 with XPACK security. Earlier we had 6.8.7 version without XPACK auth. We are using ECK deployment. I see few posts on this issue, but none of the topic has resoluti… --- ## [Elasticsearch return empty list of objects to spark](https://discuss.elastic.co/t/elasticsearch-return-empty-list-of-objects-to-spark/288052)
**Author:** [@mohsen\_mortezapour](https://discuss.elastic.co/u/mohsen_mortezapour)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 10:58pm UTC](https://discuss.elastic.co/t/elasticsearch-return-empty-list-of-objects-to-spark/288052 "2021-11-09T22:58:29Z")
I have a problem with Elasticsearch . I want to read data from Elasticsearch index with Pyspark . my data look like as below: user\_id: 123, features: { hashtags: \[ { text: "hello", c… --- ## [Elasticsearch Storage Distribution](https://discuss.elastic.co/t/elasticsearch-storage-distribution/288774)
**Author:** [@gutierrezfj](https://discuss.elastic.co/u/gutierrezfj)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 9:34pm UTC](https://discuss.elastic.co/t/elasticsearch-storage-distribution/288774 "2021-11-09T21:34:01Z")
Hi dear community, a doubt: for a small cluster: is it better to centralize the data of all nodes in a single storage unit or file system? Or is it better for each node on a dedicated host to store its own data? Tha… --- ## [How to handle this error](https://discuss.elastic.co/t/how-to-handle-this-error/288726)
**Author:** [@Mahrukh\_Malik](https://discuss.elastic.co/u/Mahrukh_Malik)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 9:08pm UTC](https://discuss.elastic.co/t/how-to-handle-this-error/288726 "2021-11-09T21:08:01Z")
elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since Tue 2021-11-09 13:38:12 PKT; 11s ago … --- ## [Parse Vsftp log (Filebeat + Logstash)](https://discuss.elastic.co/t/parse-vsftp-log-filebeat-logstash/288040)
**Author:** [@Hecha](https://discuss.elastic.co/u/Hecha)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 8:21pm UTC](https://discuss.elastic.co/t/parse-vsftp-log-filebeat-logstash/288040 "2021-11-09T20:21:12Z")
Hello guys! I am trying to parse the logs of my FTP server (Vsftpd) with logstash but I am having trouble. The logs follow the following format Fri Oct 29 17:16:17 2021 \[pid 22947\] CONNECT: Client "::ffff:10.0.1.6" Fri… --- ## [Where would my syslogs be?](https://discuss.elastic.co/t/where-would-my-syslogs-be/288819)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 8:19pm UTC](https://discuss.elastic.co/t/where-would-my-syslogs-be/288819 "2021-11-09T20:19:28Z")
Good Afternoon Elastic team. I have proof via packetbeat that my syslogs are flowing to my Logstash server. I can also netstat and confirm the ports are open and listening on the configured port. I have the following … --- ## ["Too small maximum heap"](https://discuss.elastic.co/t/too-small-maximum-heap/288816)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 7:53pm UTC](https://discuss.elastic.co/t/too-small-maximum-heap/288816 "2021-11-09T19:53:42Z")
I have installed 7.14 on a new machine running ubuntu 18.04. This machine has 48 GB of memory and is identical to another machine that I am currently running ES 7.14 on. The Elasticsearch.yml is identical and jvm.opti… --- ## [ParNew and ConcurrentMarkSweep seen in logs](https://discuss.elastic.co/t/parnew-and-concurrentmarksweep-seen-in-logs/288806)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 4\ **Last updated:** [November 9, 2021, 7:37pm UTC](https://discuss.elastic.co/t/parnew-and-concurrentmarksweep-seen-in-logs/288806 "2021-11-09T19:37:22Z")
Good Afternoon everyone; I am seeing the following lines when I place my Logstash in Debug mode to collect logs. I have a feeling that it is what is stopping me from seeing any syslog that has been forwarded to the logs… --- ## [Error install kibana last version](https://discuss.elastic.co/t/error-install-kibana-last-version/288684)
**Author:** [@samuel\_desseaux](https://discuss.elastic.co/u/samuel_desseaux)\ **Replies:** 7\ **Last updated:** [November 9, 2021, 7:29pm UTC](https://discuss.elastic.co/t/error-install-kibana-last-version/288684 "2021-11-09T19:29:57Z")
Hello I've installed elastcisearch without any problems in the last version,things are OK but when i installl kibana, it says "kibana server is not ready yet". In my configuration file, i've just filled the port,url of… --- ## [Get the first line of \[message\] field coming from winlogbeat](https://discuss.elastic.co/t/get-the-first-line-of-message-field-coming-from-winlogbeat/288768)
**Author:** [@yquirion](https://discuss.elastic.co/u/yquirion)\ **Replies:** 6\ **Last updated:** [November 9, 2021, 7:24pm UTC](https://discuss.elastic.co/t/get-the-first-line-of-message-field-coming-from-winlogbeat/288768 "2021-11-09T19:24:30Z")
Hello, I'm trying to get the first line of the message field because this is an important information to keep. The \[message\] line, when I set the output to file using rudydebug option looks like this: "message" =\> "A… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=780) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=782)