# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=782 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 783 --- ## [Unexpected file read error while reading index](https://discuss.elastic.co/t/unexpected-file-read-error-while-reading-index/288795)
**Author:** [@tropically](https://discuss.elastic.co/u/tropically)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 7:23pm UTC](https://discuss.elastic.co/t/unexpected-file-read-error-while-reading-index/288795 "2021-11-09T19:23:58Z")
Hi We are running elastisearch on Openshift. Currently there are 3 nodes configured. We received the below error on one of the 3 nodes that we have : ElasticsearchException\[failed to load metadata\]; nested: CorruptI… --- ## [How elasticsearch index Geo-points?](https://discuss.elastic.co/t/how-elasticsearch-index-geo-points/288813)
**Author:** [@ehsan\_kabiri\_33](https://discuss.elastic.co/u/ehsan_kabiri_33)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 7:19pm UTC](https://discuss.elastic.co/t/how-elasticsearch-index-geo-points/288813 "2021-11-09T19:19:31Z")
I can't imagine how Elasteicsearch index Geo-points. Suppose I have 1 million records/documents in my table/index and each document has a geo point (Lat/Lon). In sql , if I want to find the 10 nearest docs, I need to … --- ## [Logstashpipelines, Internal API server error, path\_info=\>"/\_node/stats"](https://discuss.elastic.co/t/logstashpipelines-internal-api-server-error-path-info-node-stats/288735)
**Author:** [@Melany](https://discuss.elastic.co/u/Melany)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 6:03pm UTC](https://discuss.elastic.co/t/logstashpipelines-internal-api-server-error-path-info-node-stats/288735 "2021-11-09T18:03:42Z")
Hello, when I start my logstashpipelines service I am getting the following error: \[2021-11-09T10:05:16,268\]\[ERROR\]\[logstash.agent \] Internal API server error {:status=\>500, :request\_method=\>"GET", :path\_info=\>"/\_node/s… --- ## [How to replace all groups of number in a string using gsub](https://discuss.elastic.co/t/how-to-replace-all-groups-of-number-in-a-string-using-gsub/288761)
**Author:** [@gustavon](https://discuss.elastic.co/u/gustavon)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 5:49pm UTC](https://discuss.elastic.co/t/how-to-replace-all-groups-of-number-in-a-string-using-gsub/288761 "2021-11-09T17:49:00Z")
Hi, I have an uri on nginx log like this: /xyz/attachment/thumbnail/61355754/90/90 and others, so I need to use gsub to replace all number to something else, /xyz/attachment/thumbnail/{}/{}/{} for example, I tried to us… --- ## [Grok Named capture group as metadata](https://discuss.elastic.co/t/grok-named-capture-group-as-metadata/288731)
**Author:** [@sirReeall](https://discuss.elastic.co/u/sirReeall)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 5:47pm UTC](https://discuss.elastic.co/t/grok-named-capture-group-as-metadata/288731 "2021-11-09T17:47:57Z")
Hello, I was wondering if it is possible to set a named capture group as metadata rather then a field sent to Elastic? I'm parsing some data that has these permutations for the same field: 1m 125s 345ms 125s 345ms 345… --- ## [Generate Series of Days with ElasticSearch](https://discuss.elastic.co/t/generate-series-of-days-with-elasticsearch/288804)
**Author:** [@TomTom](https://discuss.elastic.co/u/TomTom)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 5:47pm UTC](https://discuss.elastic.co/t/generate-series-of-days-with-elasticsearch/288804 "2021-11-09T17:47:40Z")
With PostgreSQL I can use the generate\_series feature to generate a list of days between two dates, and with a little effort, even generate a list of sales made by day within that range, even if there are no sales for th… --- ## [Elastic search with Springboot connection error](https://discuss.elastic.co/t/elastic-search-with-springboot-connection-error/288789)
**Author:** [@adeybabs](https://discuss.elastic.co/u/adeybabs)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 5:03pm UTC](https://discuss.elastic.co/t/elastic-search-with-springboot-connection-error/288789 "2021-11-09T17:03:11Z")
I keep getting this error when I try to load my spring application connected to Elasticsearch --- ## [Applying settings /app/logs/settings via an API](https://discuss.elastic.co/t/applying-settings-app-logs-settings-via-an-api/288771)
**Author:** [@angelom888](https://discuss.elastic.co/u/angelom888)\ **Replies:** 3\ **Last updated:** [November 9, 2021, 4:52pm UTC](https://discuss.elastic.co/t/applying-settings-app-logs-settings-via-an-api/288771 "2021-11-09T16:52:25Z")
I am able to manually configure the setting for logs streams from https:/kibanahost:5601/app/logs/settings I want to do this programmatically but cannot seem to find the API to do this. Can anyone help point me in the… --- ## [Index data as nested and flattened to improve aggregation performance?](https://discuss.elastic.co/t/index-data-as-nested-and-flattened-to-improve-aggregation-performance/288799)
**Author:** [@caseydm](https://discuss.elastic.co/u/caseydm)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 4:51pm UTC](https://discuss.elastic.co/t/index-data-as-nested-and-flattened-to-improve-aggregation-performance/288799 "2021-11-09T16:51:39Z")
I am indexing academic papers that have a list of authors. Right now, I index the authors as a nested field type, because we want to query within the list, such as author\_sequence\_number: 1 and author\_display\_name: torre… --- ## [Alternatives to Multiline Codec for logging Java traces with TCP input?](https://discuss.elastic.co/t/alternatives-to-multiline-codec-for-logging-java-traces-with-tcp-input/288784)
**Author:** [@bennetth](https://discuss.elastic.co/u/bennetth)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 3:43pm UTC](https://discuss.elastic.co/t/alternatives-to-multiline-codec-for-logging-java-traces-with-tcp-input/288784 "2021-11-09T15:43:08Z")
Hello all, I have an issue where I am trying to log Java traces for a TCP input. However, it appears that Logstash truncates the trace to just the first line of the trace. I have attempted to use the multiline codec for… --- ## [%{message} is always empty](https://discuss.elastic.co/t/message-is-always-empty/288765)
**Author:** [@Robert\_Neagu](https://discuss.elastic.co/u/Robert_Neagu)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 2:32pm UTC](https://discuss.elastic.co/t/message-is-always-empty/288765 "2021-11-09T14:32:56Z")
I want to send an email notification if there are any errors inside the Logstash import process. For this I'm using the email plugin inside the output section output { email { to =\> "mail@gmail.com" from =\> "server@… --- ## [ECK with elastic helm-charts](https://discuss.elastic.co/t/eck-with-elastic-helm-charts/288502)
**Author:** [@TobiaszG24](https://discuss.elastic.co/u/TobiaszG24)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 1:27pm UTC](https://discuss.elastic.co/t/eck-with-elastic-helm-charts/288502 "2021-11-09T13:27:21Z")
How to deploy ELK using helm charts, but set ECK as cluster manager? From what I understand, ECK requires to set "Kind" in yaml manifest to "Elasticsearch" (specific custom resource) instead of "StatefulSet". --- ## [Adding ECK Operator Liveness Probe](https://discuss.elastic.co/t/adding-eck-operator-liveness-probe/288235)
**Author:** [@MattThomson](https://discuss.elastic.co/u/MattThomson)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 12:44pm UTC](https://discuss.elastic.co/t/adding-eck-operator-liveness-probe/288235 "2021-11-09T12:44:52Z")
I've attempted to add liveness and readiness probes to the ECK operator itself (not the Elasticsearch,kibana,etc pods), but I can't find any documentation on exposed endpoints for health checks. So far I'm doing this wit… --- ## [How can I retrieve all user sessions connected to my Kibana, using API](https://discuss.elastic.co/t/how-can-i-retrieve-all-user-sessions-connected-to-my-kibana-using-api/288329)
**Author:** [@dicto](https://discuss.elastic.co/u/dicto)\ **Replies:** 3\ **Last updated:** [November 8, 2021, 10:21am UTC](https://discuss.elastic.co/t/how-can-i-retrieve-all-user-sessions-connected-to-my-kibana-using-api/288329 "2021-11-08T10:21:58Z")
Hi! How can I retrieve all user sessions connected to my Kibana, using API ? I will do a montoring sessions to delete duplicate access to my dashboard in Kibana. I saw that its is possible to DELETE sessions using the… --- ## [Alternative to ingest-convert.sh for YML](https://discuss.elastic.co/t/alternative-to-ingest-convert-sh-for-yml/288597)
**Author:** [@IsaacKr](https://discuss.elastic.co/u/IsaacKr)\ **Replies:** 4\ **Last updated:** [November 9, 2021, 11:42am UTC](https://discuss.elastic.co/t/alternative-to-ingest-convert-sh-for-yml/288597 "2021-11-09T11:42:27Z")
We are using Logstash to ship logs to a cloud based SIEM. We'd like to utilize Filebeat to assist in the parsing, however it seems that Filebeat only provides the ingest pipelines for Elasticsearch. The ingest-convert.sh… --- ## [Create a count of the total of desired metric](https://discuss.elastic.co/t/create-a-count-of-the-total-of-desired-metric/288594)
**Author:** [@Sugand](https://discuss.elastic.co/u/Sugand)\ **Replies:** 3\ **Last updated:** [November 9, 2021, 11:38am UTC](https://discuss.elastic.co/t/create-a-count-of-the-total-of-desired-metric/288594 "2021-11-09T11:38:15Z")
Hi, I have certain visualizations in dashboard based off condition's. Example: 1\> A metric of company numbers starting with number 1 and 2\> A metric of emails staring with alphabet "a". I want to create another visu… --- ## [Data are processing slowly from the Logstash persistent queue to ES](https://discuss.elastic.co/t/data-are-processing-slowly-from-the-logstash-persistent-queue-to-es/288741)
**Author:** [@jenifer\_raja](https://discuss.elastic.co/u/jenifer_raja)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 10:14am UTC](https://discuss.elastic.co/t/data-are-processing-slowly-from-the-logstash-persistent-queue-to-es/288741 "2021-11-09T10:14:22Z")
We are facing an issue with Logstash parsing, Initially parsing speed is very high and then it decreases gradually, because of this we have around 10 gb of data in queue. We tried increasing swap size, increasing workers… --- ## [Heartbeat input plugin](https://discuss.elastic.co/t/heartbeat-input-plugin/288621)
**Author:** [@BeMoore](https://discuss.elastic.co/u/BeMoore)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 9:50am UTC](https://discuss.elastic.co/t/heartbeat-input-plugin/288621 "2021-11-09T09:50:40Z")
Hiya all, if i want to change the input plugins listen port for heartbeat how can i do this? the guide doesn't list it as an option input { heartbeat { port =\> 2600 } } generates this error \[ERROR\]\[logstash.… --- ## [Restore KQL time filter on Kibana Dashboard](https://discuss.elastic.co/t/restore-kql-time-filter-on-kibana-dashboard/287975)
**Author:** [@pranay\_jain](https://discuss.elastic.co/u/pranay_jain)\ **Replies:** 4\ **Last updated:** [November 9, 2021, 9:42am UTC](https://discuss.elastic.co/t/restore-kql-time-filter-on-kibana-dashboard/287975 "2021-11-09T09:42:27Z")
Is there a way to restore time filter selection on Kibana dashboard. Use case : We have menu button on our web page from where we open Kibana dashboard by using tokens with the endpoint /internal/security/login for log… --- ## [Coordinate converting issue!](https://discuss.elastic.co/t/coordinate-converting-issue/288733)
**Author:** [@FURKAN\_KURT](https://discuss.elastic.co/u/FURKAN_KURT)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 9:26am UTC](https://discuss.elastic.co/t/coordinate-converting-issue/288733 "2021-11-09T09:26:56Z")
Hello. I am stuck in this issue for days. I send the bounding box and get this response: { "took": 2, "timed\_out": false, "\_shards": { "total": 5, "successful": 5, "skipped": 0, "failed": 0 }, … --- ## [Feedback for 100Gbit/s Elastic SIEM design (which includes Suricata)](https://discuss.elastic.co/t/feedback-for-100gbit-s-elastic-siem-design-which-includes-suricata/288724)
**Author:** [@UPPERCASE](https://discuss.elastic.co/u/UPPERCASE)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 8:43am UTC](https://discuss.elastic.co/t/feedback-for-100gbit-s-elastic-siem-design-which-includes-suricata/288724 "2021-11-09T08:43:01Z")
Is cross-posting allowed here? If so, then I would like to hear some feedback on the topic below. You may reply on this Discourse instance, or the Suricata one of course. --- ## [Elasticsearch filter in logstash = random results](https://discuss.elastic.co/t/elasticsearch-filter-in-logstash-random-results/288718)
**Author:** [@Rnx](https://discuss.elastic.co/u/Rnx)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 7:52am UTC](https://discuss.elastic.co/t/elasticsearch-filter-in-logstash-random-results/288718 "2021-11-09T07:52:23Z")
Hi, I'm using Elasticsearch filter plugin in logstash to enrich records and calculate time difference between two events from different logs. It works, but randomly - it returns search results for some records, but not … --- ## [Space saving for index=false](https://discuss.elastic.co/t/space-saving-for-index-false/288184)
**Author:** [@anon17386273](https://discuss.elastic.co/u/anon17386273)\ **Replies:** 5\ **Last updated:** [November 9, 2021, 6:14am UTC](https://discuss.elastic.co/t/space-saving-for-index-false/288184 "2021-11-09T06:14:40Z")
Hi I have an index that is 300gb in size with all 30 fields index=true. I tried setting 15 of the fields with index=false on another index and did a reindexing to compare the size. The end result is that there seems to… --- ## [Running cold tier on NFS storage](https://discuss.elastic.co/t/running-cold-tier-on-nfs-storage/288707)
**Author:** [@anon17386273](https://discuss.elastic.co/u/anon17386273)\ **Replies:** 3\ **Last updated:** [November 9, 2021, 4:51am UTC](https://discuss.elastic.co/t/running-cold-tier-on-nfs-storage/288707 "2021-11-09T04:51:48Z")
Hi, I understand that NFS storage should be avoided. However, my task was to write fresh data into HOT SSD and potential spill to WARM spin disk. The NFS storage will be used as COLD tier with very minimal write. Does … --- ## [How to manage large messages with a few memory?](https://discuss.elastic.co/t/how-to-manage-large-messages-with-a-few-memory/288677)
**Author:** [@Jesus\_Alberto\_Carril](https://discuss.elastic.co/u/Jesus_Alberto_Carril)\ **Replies:** 4\ **Last updated:** [November 9, 2021, 3:55am UTC](https://discuss.elastic.co/t/how-to-manage-large-messages-with-a-few-memory/288677 "2021-11-09T03:55:17Z")
I have a problem. My JVM logstash only has 512M in it configurations: -Xms256m -Xmx512m Logstash read messages from mylog.json and send them to my broker. BUT when a super large message is written in my mylog.json the… --- ## [IIS logs showing as a string](https://discuss.elastic.co/t/iis-logs-showing-as-a-string/288470)
**Author:** [@Venu1](https://discuss.elastic.co/u/Venu1)\ **Replies:** 3\ **Last updated:** [November 9, 2021, 3:21am UTC](https://discuss.elastic.co/t/iis-logs-showing-as-a-string/288470 "2021-11-09T03:21:24Z")
Hello all, I'm a newbie to ELK, I'm able to send the IIS logs and other application logs to the Elastic Kibana from the servers directly without logstash, IIS logs are showing up one string in the Elastic Kibana, I woul… --- ## [JVM setting](https://discuss.elastic.co/t/jvm-setting/287954)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 5\ **Last updated:** [November 9, 2021, 1:49am UTC](https://discuss.elastic.co/t/jvm-setting/287954 "2021-11-09T01:49:56Z")
What should be prefer jvm option for cluster? using elasicsearch java three node x 100gig ram each, 20core each host -Xms24g -Xmx24g -XX:+UseG1GC -XX:G1ReservePercent=25 -XX:InitiatingHeapOccupancyPercent=30 or follo… --- ## [Catenate\_numbers - way to avoid joining on space and comma?](https://discuss.elastic.co/t/catenate-numbers-way-to-avoid-joining-on-space-and-comma/288690)
**Author:** [@fcntl](https://discuss.elastic.co/u/fcntl)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 1:19am UTC](https://discuss.elastic.co/t/catenate-numbers-way-to-avoid-joining-on-space-and-comma/288690 "2021-11-09T01:19:24Z")
catenate\_numbers is useful for joining numbers separated by hyphen, as it allows a non-segmented search term to match against segmented numbers in the document, e.g. Document: 02 6287-1455 Search term: 0262871455 (wil… --- ## [How to load dashboard when Kibana starts](https://discuss.elastic.co/t/how-to-load-dashboard-when-kibana-starts/288596)
**Author:** [@gokulnath112](https://discuss.elastic.co/u/gokulnath112)\ **Replies:** 2\ **Last updated:** [November 8, 2021, 11:31pm UTC](https://discuss.elastic.co/t/how-to-load-dashboard-when-kibana-starts/288596 "2021-11-08T23:31:43Z")
Hi team, Please help me on this. I want to load some dashboard when Kibana starts. I have created a dashboard, but I want to provide the dashboard along with build. I'm not supposed to touch the Kibana. Elastic mappin… --- ## [Daylight saving time impacting only part of the environment](https://discuss.elastic.co/t/daylight-saving-time-impacting-only-part-of-the-environment/288622)
**Author:** [@phdsantos](https://discuss.elastic.co/u/phdsantos)\ **Replies:** 5\ **Last updated:** [November 8, 2021, 9:03pm UTC](https://discuss.elastic.co/t/daylight-saving-time-impacting-only-part-of-the-environment/288622 "2021-11-08T21:03:14Z")
Hello everyone, we are facing a strange behavior in ELK environment related to daylight saving time; the details are below: Platform: kibana 6.7.2 Logstash 5.3.0 Elasticsearch 6.7.2 Scenario: We have Weblogic domai… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=781) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=783)