# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=801 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 802 --- ## [O365.audit to message field](https://discuss.elastic.co/t/o365-audit-to-message-field/286396)
**Author:** [@geetika\_gopi](https://discuss.elastic.co/u/geetika_gopi)\ **Replies:** 2\ **Last updated:** [October 16, 2021, 2:43pm UTC](https://discuss.elastic.co/t/o365-audit-to-message-field/286396 "2021-10-16T14:43:34Z")
Hello, I have O365 logs coming in to my logstash via the O365 filebeat module. I am trying to create two outputs : Elasticsearch output S3 bucket output The S3 bucket output requires a "message" field to be present. … --- ## [Timed out while retrying \[indices:admin/exists\] after failure](https://discuss.elastic.co/t/timed-out-while-retrying-indices-admin-exists-after-failure/286870)
**Author:** [@akshay\_dindure1994](https://discuss.elastic.co/u/akshay_dindure1994)\ **Replies:** 0\ **Last updated:** [October 15, 2021, 7:22pm UTC](https://discuss.elastic.co/t/timed-out-while-retrying-indices-admin-exists-after-failure/286870 "2021-10-15T19:22:45Z")
Hello Team, I have single node setup in my environment. I am facing issue after an server reboot. Elastic is take 8 time more time then usual to start. And soon getting abnormal. Please find the the Error which I am g… --- ## [Elasticsearch configuration](https://discuss.elastic.co/t/elasticsearch-configuration/286480)
**Author:** [@niraj\_pandey](https://discuss.elastic.co/u/niraj_pandey)\ **Replies:** 29\ **Last updated:** [October 16, 2021, 4:31am UTC](https://discuss.elastic.co/t/elasticsearch-configuration/286480 "2021-10-16T04:31:14Z")
Hi , I am trying to configure Elasticsearch 7.0.0 with 2 master and 1 data nodes (will add more data nodes later). Below are the configuration details for each node. But when I ran the API (curl -X GET "rw-elkm2-vm:9200… --- ## [PARSE Logs having pip saperator](https://discuss.elastic.co/t/parse-logs-having-pip-saperator/286881)
**Author:** [@Nikparab](https://discuss.elastic.co/u/Nikparab)\ **Replies:** 7\ **Last updated:** [October 16, 2021, 3:33am UTC](https://discuss.elastic.co/t/parse-logs-having-pip-saperator/286881 "2021-10-16T03:33:50Z")
Hi I am having the log format as below. 2021-10-16 00:14:14|http-nio-2222-exec-1|DEBUG|c.v.a.ultimatevault.web.TraceFilter|01AD08F98FB24AB7A639383F44613AE4|Processing request:- id: 01AD08F98FB24AB7A639383F44613AE4 metho… --- ## [Fetch additional info for each Elasticsearch](https://discuss.elastic.co/t/fetch-additional-info-for-each-elasticsearch/286880)
**Author:** [@pedrorabbi](https://discuss.elastic.co/u/pedrorabbi)\ **Replies:** 2\ **Last updated:** [October 16, 2021, 3:31am UTC](https://discuss.elastic.co/t/fetch-additional-info-for-each-elasticsearch/286880 "2021-10-16T03:31:12Z")
So, I have 2 indexes in my Elasticsearch server. I need to gather the results from the first index, and for each result I need to gather info from the second index. How to do that? Tried the foreach processor, but no lu… --- ## [How to disable search button when no text is entered on search input field and enable when text is entered](https://discuss.elastic.co/t/how-to-disable-search-button-when-no-text-is-entered-on-search-input-field-and-enable-when-text-is-entered/286869)
**Author:** [@pradeepjanga](https://discuss.elastic.co/u/pradeepjanga)\ **Replies:** 2\ **Last updated:** [October 15, 2021, 9:02pm UTC](https://discuss.elastic.co/t/how-to-disable-search-button-when-no-text-is-entered-on-search-input-field-and-enable-when-text-is-entered/286869 "2021-10-15T21:02:51Z")
am using the below code. but unable to disable it when search term is having data. how to achieve this ? \ ( \<\> \
**Author:** [@Rakesh\_B](https://discuss.elastic.co/u/Rakesh_B)\ **Replies:** 3\ **Last updated:** [October 15, 2021, 8:26pm UTC](https://discuss.elastic.co/t/enable-keyword-fields-for-specific-fields-only/286866 "2021-10-15T20:26:16Z")
Hi, Elasticsearch Version: 7.15.0 Logstash Version: 7.15.0 We have a ton of fields for our index and we get new fields frequently so, we cannot disable dynamic mapping. Dynamic mapping creates .keyword fields for a ma… --- ## [How to get the value of an array using ctx.payload](https://discuss.elastic.co/t/how-to-get-the-value-of-an-array-using-ctx-payload/286864)
**Author:** [@StephaneRodier](https://discuss.elastic.co/u/StephaneRodier)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 8:19pm UTC](https://discuss.elastic.co/t/how-to-get-the-value-of-an-array-using-ctx-payload/286864 "2021-10-15T20:19:27Z")
Hello, Let's say I have the results below in an array of 2: "hits": { "hits": \[ { "\_index": "blah-2021.10.01-000003", "\_type": "\_doc", "\_source": … --- ## [Logstash open file descriptors only increases](https://discuss.elastic.co/t/logstash-open-file-descriptors-only-increases/285571)
**Author:** [@N1k-3l](https://discuss.elastic.co/u/N1k-3l)\ **Replies:** 2\ **Last updated:** [October 15, 2021, 5:58pm UTC](https://discuss.elastic.co/t/logstash-open-file-descriptors-only-increases/285571 "2021-10-15T17:58:09Z")
Hello. I have a problem with logstash (logstash 7.12.1) file descriptors only increases. I set limits to 50000, but on another host, with the same config i have: may be somebody knows about this? :blush: --- ## [Certificate error on database update](https://discuss.elastic.co/t/certificate-error-on-database-update/286550)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 5\ **Last updated:** [October 15, 2021, 5:51pm UTC](https://discuss.elastic.co/t/certificate-error-on-database-update/286550 "2021-10-15T17:51:04Z")
After upgrading to logstash 7.14.1, I'm getting this error daily in the logstash-plain.log: \[ERROR\]\[logstash.filters.geoip.databasemanager\] certificate verify failed {:cause=\>#\ **Author:** [@Aliaksandr](https://discuss.elastic.co/u/Aliaksandr)\ **Replies:** 13\ **Last updated:** [October 15, 2021, 5:35pm UTC](https://discuss.elastic.co/t/topic/286603 "2021-10-15T17:35:22Z") Добрый день. Имеется около 120 млн объектов, которые нужно проиндексировать. Отправляю объекты на реиндекс предварительно отсортировав (по полю id типа guid), реиндекс занимает около 8 часов. Отправляю эти же объеты н… --- ## [Parse XML log with xml filter and grok fiter](https://discuss.elastic.co/t/parse-xml-log-with-xml-filter-and-grok-fiter/286712)
**Author:** [@Catalina\_Boteanu](https://discuss.elastic.co/u/Catalina_Boteanu)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 5:34pm UTC](https://discuss.elastic.co/t/parse-xml-log-with-xml-filter-and-grok-fiter/286712 "2021-10-15T17:34:46Z")
Hello. I am currently trying to apply some filters to different logs in Logstash. I have a log that has a string in the beginning and then it is in xml format. I was able to take out the xml from the log with a regex. No… --- ## [Logstash pipeline multiple if statements](https://discuss.elastic.co/t/logstash-pipeline-multiple-if-statements/286737)
**Author:** [@Robin020](https://discuss.elastic.co/u/Robin020)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 5:02pm UTC](https://discuss.elastic.co/t/logstash-pipeline-multiple-if-statements/286737 "2021-10-15T17:02:58Z")
Hello, I am trying create multiple if statements in the filter section in my pipeline config but I have no success with that. This works (with one if statement) filter { json { source =\> "message" } split … --- ## [Can you reference a dynamic variable in the grok filter?](https://discuss.elastic.co/t/can-you-reference-a-dynamic-variable-in-the-grok-filter/286838)
**Author:** [@Cibot](https://discuss.elastic.co/u/Cibot)\ **Replies:** 2\ **Last updated:** [October 15, 2021, 4:57pm UTC](https://discuss.elastic.co/t/can-you-reference-a-dynamic-variable-in-the-grok-filter/286838 "2021-10-15T16:57:52Z")
I have been trying to split up the input of a script from execbeat. So far everything has been going smooth. I have input of similar fashion. rpm-2109130090009900.x86-64 Thu 2019 ... and so on. So basically an inform… --- ## [Parsing nested json to flat structure](https://discuss.elastic.co/t/parsing-nested-json-to-flat-structure/286790)
**Author:** [@IsAa](https://discuss.elastic.co/u/IsAa)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 4:50pm UTC](https://discuss.elastic.co/t/parsing-nested-json-to-flat-structure/286790 "2021-10-15T16:50:36Z")
Hi Team, I was looking to parse my nested json structure using json filter. I have looked at some of the posts and tried their solution. My question, is it possible to make this structure completely flat, So if my log… --- ## [Кластер высокой доступности из 4 ElasticSearch, 4 Logstash, 1 Kibana и 1 Grafana](https://discuss.elastic.co/t/4-elasticsearch-4-logstash-1-kibana-1-grafana/286515)
**Author:** [@Areopagit](https://discuss.elastic.co/u/Areopagit)\ **Replies:** 3\ **Last updated:** [October 15, 2021, 3:50pm UTC](https://discuss.elastic.co/t/4-elasticsearch-4-logstash-1-kibana-1-grafana/286515 "2021-10-15T15:50:19Z")
Добрый день. Собрал кластер (для сбора логов всех систем организации) из вышеперечисленного (четыре ноды Elasticsearch, четыре ноды Logstash, одна нода Kibana и одна нода Grafana) на одном высокопроизводительном физичес… --- ## [Assigning Multiple Roles to one Kibana Space](https://discuss.elastic.co/t/assigning-multiple-roles-to-one-kibana-space/285812)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 3:14pm UTC](https://discuss.elastic.co/t/assigning-multiple-roles-to-one-kibana-space/285812 "2021-10-15T15:14:18Z")
Hello, I want to assign multiple roles to one space, but I also want one role to be able to view specific dashboards or even if they have access to the dashboard to only see data that I give them access to. For example,… --- ## [Customize Lens's graphs](https://discuss.elastic.co/t/customize-lenss-graphs/286702)
**Author:** [@Kadhem](https://discuss.elastic.co/u/Kadhem)\ **Replies:** 9\ **Last updated:** [October 15, 2021, 2:36pm UTC](https://discuss.elastic.co/t/customize-lenss-graphs/286702 "2021-10-15T14:36:12Z")
Hi, i'm using Lens charts in Kibana. i want to display a graph where Y axis is the timestamp and X axis is the values of My field . But Lens enable me to use a simple Function "Value" is there any solution? I don't want… --- ## [Very slow aggregate query](https://discuss.elastic.co/t/very-slow-aggregate-query/286371)
**Author:** [@Giovanni\_Di\_Lembo](https://discuss.elastic.co/u/Giovanni_Di_Lembo)\ **Replies:** 15\ **Last updated:** [October 15, 2021, 2:13pm UTC](https://discuss.elastic.co/t/very-slow-aggregate-query/286371 "2021-10-15T14:13:15Z")
Hi all I have 200 Gb data in Elasticsearch and when I excecute an aggregate query it takes 8 seconds. My client goes in timeout. Actually my query is like that: { "aggs": { "filtered": { "filter": { … --- ## [StackOverflowError triggering cluster crash](https://discuss.elastic.co/t/stackoverflowerror-triggering-cluster-crash/285550)
**Author:** [@bhargava\_kovi](https://discuss.elastic.co/u/bhargava_kovi)\ **Replies:** 7\ **Last updated:** [October 15, 2021, 1:43pm UTC](https://discuss.elastic.co/t/stackoverflowerror-triggering-cluster-crash/285550 "2021-10-15T13:43:36Z")
The cluster was suddenly crashed mentioning the below stack trace. we are using version ES 7.10.1. I tried to look for a similar issue on StackOverflowError in Lucene but couldnt find much on it. Can anyone help to un… --- ## [Filebeat installed as Daemon Set in IBM Private Cloud Kubernetes Cluster don't send logs to Elastic Cloud instance](https://discuss.elastic.co/t/filebeat-installed-as-daemon-set-in-ibm-private-cloud-kubernetes-cluster-dont-send-logs-to-elastic-cloud-instance/184406)
**Author:** [@l.rava](https://discuss.elastic.co/u/l.rava)\ **Replies:** 4\ **Last updated:** [October 15, 2021, 1:31pm UTC](https://discuss.elastic.co/t/filebeat-installed-as-daemon-set-in-ibm-private-cloud-kubernetes-cluster-dont-send-logs-to-elastic-cloud-instance/184406 "2021-10-15T13:31:20Z")
Hi I installed as Daemon Set metricBeat and fileBeat into my infrastracture: IBM Private Cloud kubernetes cluster - 2 nodes - v.1.13 following this guide. MetricBeat send data without problem. Filebeat don't send da… --- ## [Aggregation after rescore](https://discuss.elastic.co/t/aggregation-after-rescore/286833)
**Author:** [@SantaDiver](https://discuss.elastic.co/u/SantaDiver)\ **Replies:** 0\ **Last updated:** [October 15, 2021, 12:47pm UTC](https://discuss.elastic.co/t/aggregation-after-rescore/286833 "2021-10-15T12:47:50Z")
Hello! I am trying to build ecommerce search engine with facets using Elasticsearch. I am using Elasticsearch-ltr plugin, which provides me possibility to rescore documents using machine learning formula. I want to cut … --- ## [Random node frequently removed from the cluster](https://discuss.elastic.co/t/random-node-frequently-removed-from-the-cluster/286296)
**Author:** [@JohnPhilip](https://discuss.elastic.co/u/JohnPhilip)\ **Replies:** 11\ **Last updated:** [October 11, 2021, 9:58am UTC](https://discuss.elastic.co/t/random-node-frequently-removed-from-the-cluster/286296 "2021-10-11T09:58:32Z")
I found different node removed from cluster in last month, sometimes it happens 10 times a day. ES version is 7.6.2, and there are 5000+ shards, 6 data nodes with 30gb heap size, and another 3 master node in the cluster… --- ## [Elasticsearch huge CPU utilisation](https://discuss.elastic.co/t/elasticsearch-huge-cpu-utilisation/286707)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 6\ **Last updated:** [October 15, 2021, 11:10am UTC](https://discuss.elastic.co/t/elasticsearch-huge-cpu-utilisation/286707 "2021-10-15T11:10:02Z")
Hello, We have ELK Stack in our Company. Last time I had stability issues with Elasticsearch - meaning Elasticsearch was running after restart and after 3 hours was hung. Right now I see java process in Elasticsearch … --- ## [Optional field for boosting results score](https://discuss.elastic.co/t/optional-field-for-boosting-results-score/286805)
**Author:** [@Sodium](https://discuss.elastic.co/u/Sodium)\ **Replies:** 2\ **Last updated:** [October 15, 2021, 11:01am UTC](https://discuss.elastic.co/t/optional-field-for-boosting-results-score/286805 "2021-10-15T11:01:18Z")
Hello, I currently have this request: 'query' =\> 'multi\_match' =\> \[ 'query' =\> $queryString, 'type' =\> 'bool\_prefix', 'fields' =\> \[ 'label^3', 'categories\_lis… --- ## [Threat Intel filebeat module](https://discuss.elastic.co/t/threat-intel-filebeat-module/283979)
**Author:** [@SiRVaNdO](https://discuss.elastic.co/u/SiRVaNdO)\ **Replies:** 9\ **Last updated:** [October 15, 2021, 10:50am UTC](https://discuss.elastic.co/t/threat-intel-filebeat-module/283979 "2021-10-15T10:50:08Z")
Hello everyone, I installed a filebeat with the threat intel module and it's importing threat intel data to the Elasticsearch. When I visit the feeds dashboards all is working properly. The problem comes when I tried t… --- ## [.startsWith Implementation](https://discuss.elastic.co/t/startswith-implementation/286489)
**Author:** [@varunbsgaur](https://discuss.elastic.co/u/varunbsgaur)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 9:33am UTC](https://discuss.elastic.co/t/startswith-implementation/286489 "2021-10-15T09:33:47Z")
Need to know proper implementation of startsWith for the url for the script to run in all the 4 cases of document. Error comes for startsWith when runnned. SCRIPT:- POST \_ingest/pipeline/\_simulate { "pipeline": { … --- ## [onQueryPhase listener org.elasticsearch.index.SearchSlowLog fails with NullpointerException](https://discuss.elastic.co/t/onqueryphase-listener-org-elasticsearch-index-searchslowlog-fails-with-nullpointerexception/286726)
**Author:** [@Harald\_Bittermann](https://discuss.elastic.co/u/Harald_Bittermann)\ **Replies:** 3\ **Last updated:** [October 15, 2021, 8:13am UTC](https://discuss.elastic.co/t/onqueryphase-listener-org-elasticsearch-index-searchslowlog-fails-with-nullpointerexception/286726 "2021-10-15T08:13:34Z")
Within the last month we are seeing the following exceptions like the one below more and more often on one of our clusters. \[2021-10-12T12:38:45,944 UTC\]\[WARN \]\[o.e.i.s.IndexShard \] \[10.180.253.11\] \[visit-global-l… --- ## [What happens if 2 of 5 data nodes are down?](https://discuss.elastic.co/t/what-happens-if-2-of-5-data-nodes-are-down/286019)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 2\ **Last updated:** [October 15, 2021, 7:04am UTC](https://discuss.elastic.co/t/what-happens-if-2-of-5-data-nodes-are-down/286019 "2021-10-15T07:04:32Z")
Dear community, what does happen if in an Elasticsearch cluster 2 of 5 data nodes are down, data is still incoming via logstash and daily indices are used (cluster version 7.8.1)? For example the nodes are down for max … --- ## [Elsticsearch, do POST, GET Requests between custom plugins with the nodeClient](https://discuss.elastic.co/t/elsticsearch-do-post-get-requests-between-custom-plugins-with-the-nodeclient/286795)
**Author:** [@aza-zil](https://discuss.elastic.co/u/aza-zil)\ **Replies:** 0\ **Last updated:** [October 15, 2021, 6:30am UTC](https://discuss.elastic.co/t/elsticsearch-do-post-get-requests-between-custom-plugins-with-the-nodeclient/286795 "2021-10-15T06:30:05Z")
I have two plugins in ES, and I want one of them to send GET/POST requests to the other using the nodeCLient, how can I do that? [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=800) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=802)