# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=809 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 810 --- ## [CEF plugin is not working as expected](https://discuss.elastic.co/t/cef-plugin-is-not-working-as-expected/286024)
**Author:** [@Sunflower](https://discuss.elastic.co/u/Sunflower)\ **Replies:** 12\ **Last updated:** [October 7, 2021, 1:11pm UTC](https://discuss.elastic.co/t/cef-plugin-is-not-working-as-expected/286024 "2021-10-07T13:11:35Z")
Hi, I'm trying to configure Logstash to work with SentinelOne logs, but it is not working as expected, it looks like it is not separating the fields correctly. I configured the input to be CEF and the output to be json… --- ## [Upgrade Ubuntu 18.04 to 20.04](https://discuss.elastic.co/t/upgrade-ubuntu-18-04-to-20-04/286134)
**Author:** [@franco\_peppino](https://discuss.elastic.co/u/franco_peppino)\ **Replies:** 0\ **Last updated:** [October 7, 2021, 1:00pm UTC](https://discuss.elastic.co/t/upgrade-ubuntu-18-04-to-20-04/286134 "2021-10-07T13:00:11Z")
Hello guys, I have one question. I have a 3 node Elasticsearch cluster running on Ubuntu Server 18.04, and I want to upgrade to Ubuntu 20.04. Should I take care of something related to elastic or a do-release-upgrade sh… --- ## [How can I find the query that is eating up my memory?](https://discuss.elastic.co/t/how-can-i-find-the-query-that-is-eating-up-my-memory/285930)
**Author:** [@spdoes](https://discuss.elastic.co/u/spdoes)\ **Replies:** 1\ **Last updated:** [October 7, 2021, 12:29pm UTC](https://discuss.elastic.co/t/how-can-i-find-the-query-that-is-eating-up-my-memory/285930 "2021-10-07T12:29:17Z")
Hello guys, I did set the slowlogs to minimum time but when I read it all and try to find pattern by timestamp, all queries seems lightweight and are taking less than 500ms. is there a way to know the effect of each qu… --- ## [Elasticsearch Match phrase prefix query remove parameter zero\_terms\_query](https://discuss.elastic.co/t/elasticsearch-match-phrase-prefix-query-remove-parameter-zero-terms-query/286127)
**Author:** [@ijaxahmed](https://discuss.elastic.co/u/ijaxahmed)\ **Replies:** 0\ **Last updated:** [October 7, 2021, 12:06pm UTC](https://discuss.elastic.co/t/elasticsearch-match-phrase-prefix-query-remove-parameter-zero-terms-query/286127 "2021-10-07T12:06:53Z")
I am using Elasticsearch 6.2.4 with JEST client. using following library "org.elasticsearch" % "elasticsearch" % "6.2.4" But now i updated the library to 7.15 as "org.elasticsearch" % "elasticsearch" % "7.15.0" u… --- ## [Integrate dynatrace with ELK to fetch real time data](https://discuss.elastic.co/t/integrate-dynatrace-with-elk-to-fetch-real-time-data/286122)
**Author:** [@Divya\_Bansal](https://discuss.elastic.co/u/Divya_Bansal)\ **Replies:** 0\ **Last updated:** [October 7, 2021, 11:40am UTC](https://discuss.elastic.co/t/integrate-dynatrace-with-elk-to-fetch-real-time-data/286122 "2021-10-07T11:40:34Z")
can anyone provide with the options to integrate dynatrace with ELK to fetch the real time data? All the metrics from dynatrace could be seen in elk in a particular index. --- ## [Analyzer and Fuzzy](https://discuss.elastic.co/t/analyzer-and-fuzzy/286115)
**Author:** [@RabBit\_BR](https://discuss.elastic.co/u/RabBit_BR)\ **Replies:** 0\ **Last updated:** [October 7, 2021, 10:33am UTC](https://discuss.elastic.co/t/analyzer-and-fuzzy/286115 "2021-10-07T10:33:38Z")
Hi. In need of a second opinion. I created an analyzer that generates the tokens by reducing the term to its radical. Ex (I'm using a Brazilian analyzer, my language is Portuguese): confeitaria -\> confeit conflito -\>… --- ## [Logstash date filter don't parse time](https://discuss.elastic.co/t/logstash-date-filter-dont-parse-time/286064)
**Author:** [@AlexG](https://discuss.elastic.co/u/AlexG)\ **Replies:** 2\ **Last updated:** [October 7, 2021, 10:17am UTC](https://discuss.elastic.co/t/logstash-date-filter-dont-parse-time/286064 "2021-10-07T10:17:19Z")
I have a log in msi installer format (time only, without date): MSI (c) (F0:8C) \[09:00:05:007\]: Client-side and UI is none or basic: Running entire install on the server. MSI (c) (F0:8C) \[09:00:05:007\]: Grabbed executio… --- ## [Number of indices while reworking general architecture](https://discuss.elastic.co/t/number-of-indices-while-reworking-general-architecture/285600)
**Author:** [@GCosta](https://discuss.elastic.co/u/GCosta)\ **Replies:** 3\ **Last updated:** [October 7, 2021, 9:58am UTC](https://discuss.elastic.co/t/number-of-indices-while-reworking-general-architecture/285600 "2021-10-07T09:58:37Z")
Hello everyone, In our ES 6.8, we're planning to rethink our current indices partition as we acknowledged, month after month, that the starting decisions about indices was not properly planned. We now got 3 TB of data … --- ## [Añadirr campo en un dashboard](https://discuss.elastic.co/t/anadirr-campo-en-un-dashboard/286094)
**Author:** [@Angel\_G](https://discuss.elastic.co/u/Angel_G)\ **Replies:** 1\ **Last updated:** [October 7, 2021, 8:26am UTC](https://discuss.elastic.co/t/anadirr-campo-en-un-dashboard/286094 "2021-10-07T08:26:11Z")
Buenas tengo un log con un campo message que quiero seleccionar los campos separandolos por expresiones regulares y que crear campos en un dashboard para que pueda seleccionar desde un campo hasta otro y muestre l… --- ## [Table and sub-aggregation buckets result](https://discuss.elastic.co/t/table-and-sub-aggregation-buckets-result/286104)
**Author:** [@Vladimir\_Pavlovsky](https://discuss.elastic.co/u/Vladimir_Pavlovsky)\ **Replies:** 0\ **Last updated:** [October 7, 2021, 7:56am UTC](https://discuss.elastic.co/t/table-and-sub-aggregation-buckets-result/286104 "2021-10-07T07:56:42Z")
Hello! I have documents with ip and login. Every user can connecting with different ip address. Anyway i have this query: Result: I need to get all ip addresses to each login like this response: | LOGIN | IP1,… --- ## [Which structure of nested field is more efficient?](https://discuss.elastic.co/t/which-structure-of-nested-field-is-more-efficient/286096)
**Author:** [@taichi](https://discuss.elastic.co/u/taichi)\ **Replies:** 0\ **Last updated:** [October 7, 2021, 6:58am UTC](https://discuss.elastic.co/t/which-structure-of-nested-field-is-more-efficient/286096 "2021-10-07T06:58:39Z")
I'm using Elasticsearch 7.10 and I have an ES index which includes about 3M documents. I am going to add nested field (I call it items) which has fields as below: store\_id (long) big\_category\_id (integer / there are o… --- ## [Query\_string query length limit](https://discuss.elastic.co/t/query-string-query-length-limit/286095)
**Author:** [@lc\_l](https://discuss.elastic.co/u/lc_l)\ **Replies:** 0\ **Last updated:** [October 7, 2021, 6:55am UTC](https://discuss.elastic.co/t/query-string-query-length-limit/286095 "2021-10-07T06:55:35Z")
Hi , I've seen an old post of similar question Query string length limit and the answer "max\_clause\_count" seems to belong to DSL ? But what I concern is the exact character count in query.query\_string.query { "quer… --- ## [Can't get \_reload\_search\_analyzers to reload search analyzers](https://discuss.elastic.co/t/cant-get-reload-search-analyzers-to-reload-search-analyzers/286074)
**Author:** [@nahh](https://discuss.elastic.co/u/nahh)\ **Replies:** 0\ **Last updated:** [October 6, 2021, 9:39pm UTC](https://discuss.elastic.co/t/cant-get-reload-search-analyzers-to-reload-search-analyzers/286074 "2021-10-06T21:39:09Z")
I'm trying to update my synonyms file and I'm using the \_reload\_search\_analyzers API as documented here: However, it doesn't seem to be reloading my search analyzer. I see a reload log entry but nothing that reference… --- ## [HyperThreading vs performance](https://discuss.elastic.co/t/hyperthreading-vs-performance/286072)
**Author:** [@Vadym](https://discuss.elastic.co/u/Vadym)\ **Replies:** 0\ **Last updated:** [October 6, 2021, 8:54pm UTC](https://discuss.elastic.co/t/hyperthreading-vs-performance/286072 "2021-10-06T20:54:49Z")
Hi guys, We have 15x ES servers with 20 physical cores and 500Gb ram each. Will we benefit from leaving HT on on ES Data nodes in all cases or can it affect performance negatively in some cases? Can it affect query res… --- ## [Filter out dot prefix indices from kibana?](https://discuss.elastic.co/t/filter-out-dot-prefix-indices-from-kibana/286066)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 2\ **Last updated:** [October 6, 2021, 8:20pm UTC](https://discuss.elastic.co/t/filter-out-dot-prefix-indices-from-kibana/286066 "2021-10-06T20:20:19Z")
Is there an easy way to show all indices except those dot prefix internal ones? I often use GET \_cat/indices?v to list all my indices. It's kind of annoying to include those system ones I don't care for my use case. --- ## [File structure cannot be determined](https://discuss.elastic.co/t/file-structure-cannot-be-determined/286065)
**Author:** [@Surya\_Raviraj](https://discuss.elastic.co/u/Surya_Raviraj)\ **Replies:** 1\ **Last updated:** [October 6, 2021, 7:45pm UTC](https://discuss.elastic.co/t/file-structure-cannot-be-determined/286065 "2021-10-06T19:45:55Z")
I am trying to upload a very basic csv file, however elastic keeps throwing me the "File structure cannot be determined" error. I'm attaching a picture of my csv file here. I've made sure all the time formats are the sam… --- ## [Problema with italian analyzer](https://discuss.elastic.co/t/problema-with-italian-analyzer/286052)
**Author:** [@Giovanni\_Montobbio](https://discuss.elastic.co/u/Giovanni_Montobbio)\ **Replies:** 0\ **Last updated:** [October 6, 2021, 4:16pm UTC](https://discuss.elastic.co/t/problema-with-italian-analyzer/286052 "2021-10-06T16:16:30Z")
Hi guys, I noticed that the default Elasticsearch italian analyzer does not stem words long less than 6 characters and this obviously creates a problem for my work. Do you know how can I solve this problem? Thanks in adv… --- ## [Export has limited columns](https://discuss.elastic.co/t/export-has-limited-columns/285584)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 11\ **Last updated:** [October 6, 2021, 4:08pm UTC](https://discuss.elastic.co/t/export-has-limited-columns/285584 "2021-10-06T16:08:21Z")
Hello, I hope this message finds the community members safe and healthy. I'm having incomplete data when exporting via Kibana & the output is erratic. I am carrying out the searches on the same index Total documents… --- ## [Remove from json](https://discuss.elastic.co/t/remove-from-json/286047)
**Author:** [@ANISH\_VERMA](https://discuss.elastic.co/u/ANISH_VERMA)\ **Replies:** 4\ **Last updated:** [October 6, 2021, 4:04pm UTC](https://discuss.elastic.co/t/remove-from-json/286047 "2021-10-06T16:04:25Z")
Hi I am using logstash so when I am doing the multi-line thing I am getting \\n \\t \\r like character in json is there away to remove these in Json message without compromising with the message layout . And even if it is h… --- ## [Ruby Filter for Compressed Binary OID Table](https://discuss.elastic.co/t/ruby-filter-for-compressed-binary-oid-table/285691)
**Author:** [@bennrtc](https://discuss.elastic.co/u/bennrtc)\ **Replies:** 1\ **Last updated:** [October 6, 2021, 3:40pm UTC](https://discuss.elastic.co/t/ruby-filter-for-compressed-binary-oid-table/285691 "2021-10-06T15:40:16Z")
Hello all, I'm working within an OID that returns values in compressed binary. I've been able to successfully come up with a config (below) that polls a single SNMP OID with compressed binary value using 'get' and then… --- ## [Config files](https://discuss.elastic.co/t/config-files/286045)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 2\ **Last updated:** [October 6, 2021, 3:34pm UTC](https://discuss.elastic.co/t/config-files/286045 "2021-10-06T15:34:44Z")
I am trying to understand how to set up logstash .conf files to see what is required. I am considering a separate .conf files for each index/type of metric being captured. On the web it suggests that even if they are s… --- ## [Logstash JDBC\_last \_ not updating](https://discuss.elastic.co/t/logstash-jdbc-last-not-updating/285993)
**Author:** [@Akshaya](https://discuss.elastic.co/u/Akshaya)\ **Replies:** 2\ **Last updated:** [October 6, 2021, 3:11pm UTC](https://discuss.elastic.co/t/logstash-jdbc-last-not-updating/285993 "2021-10-06T15:11:01Z")
Hi , I'm new to Elasticsearch and Logstash, trying to implement JDBC plugin. I'm not sure why .logstash\_last\_run file is not getting updated. The values inside the file remains the same even after several runs. value … --- ## [Persistent Queues with multiple logstash processes in 2021](https://discuss.elastic.co/t/persistent-queues-with-multiple-logstash-processes-in-2021/286044)
**Author:** [@ab017i0](https://discuss.elastic.co/u/ab017i0)\ **Replies:** 0\ **Last updated:** [October 6, 2021, 2:45pm UTC](https://discuss.elastic.co/t/persistent-queues-with-multiple-logstash-processes-in-2021/286044 "2021-10-06T14:45:14Z")
Hello, our team is solving same problem. Persistent Queues with multiple logstash processes The output is "Logstash persistent queues are not shared. Nd configured per instance." as for 2019. Is the answer is still va… --- ## [High I/O usage on large Elasticsearch Instance](https://discuss.elastic.co/t/high-i-o-usage-on-large-elasticsearch-instance/283813)
**Author:** [@Nisar\_Adappadathil1](https://discuss.elastic.co/u/Nisar_Adappadathil1)\ **Replies:** 8\ **Last updated:** [October 6, 2021, 2:42pm UTC](https://discuss.elastic.co/t/high-i-o-usage-on-large-elasticsearch-instance/283813 "2021-10-06T14:42:24Z")
Hi We have a elasticsearch-6.4 cluster with 100 nodes we were using AWS instances of type (8 core CPU & 15 GB memory), now we are migrating to (48 core 384 GB memory) The issue here is that now we have half number of… --- ## [Engineer Training - Lab 6.1 Testing index template returns nothing](https://discuss.elastic.co/t/engineer-training-lab-6-1-testing-index-template-returns-nothing/286031)
**Author:** [@eRDe2021](https://discuss.elastic.co/u/eRDe2021)\ **Replies:** 2\ **Last updated:** [October 6, 2021, 2:24pm UTC](https://discuss.elastic.co/t/engineer-training-lab-6-1-testing-index-template-returns-nothing/286031 "2021-10-06T14:24:54Z")
Hello, Testing index template: POST \_index\_template/\_simulate\_index/my-metrics-test returns nothing returns nothing, just {} and 200 - OK. What I missed? RD --- ## [How can I make my Grok filter match a file extension or blank (if no extension)?](https://discuss.elastic.co/t/how-can-i-make-my-grok-filter-match-a-file-extension-or-blank-if-no-extension/286011)
**Author:** [@nsouth](https://discuss.elastic.co/u/nsouth)\ **Replies:** 2\ **Last updated:** [October 6, 2021, 1:30pm UTC](https://discuss.elastic.co/t/how-can-i-make-my-grok-filter-match-a-file-extension-or-blank-if-no-extension/286011 "2021-10-06T13:30:01Z")
I have the following grok filter which extracts the file\_extension from a field. It works except fine for files which have no extension, which generate a \_grokparsefailure tag. For files with no extension, I would like t… --- ## [Updating config file](https://discuss.elastic.co/t/updating-config-file/286021)
**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\ **Replies:** 5\ **Last updated:** [October 6, 2021, 1:23pm UTC](https://discuss.elastic.co/t/updating-config-file/286021 "2021-10-06T13:23:33Z")
I have been trial and error technique to solve problems with the logstash I have been updating the config file input filter and output settings time to time. so I want to index already present files but at first time i… --- ## ["fields" ignored on MLT query with artificial document](https://discuss.elastic.co/t/fields-ignored-on-mlt-query-with-artificial-document/285933)
**Author:** [@mirco\_romagnoli](https://discuss.elastic.co/u/mirco_romagnoli)\ **Replies:** 0\ **Last updated:** [October 5, 2021, 2:05pm UTC](https://discuss.elastic.co/t/fields-ignored-on-mlt-query-with-artificial-document/285933 "2021-10-05T14:05:42Z")
Hi everyone! When I execute an MLT query with an artificial document the "fields" field is ignored and all the fields from the artificial document are used for scoring. For instance I built an index with these settings… --- ## [Logstash input JDBC - Oracle wallet support](https://discuss.elastic.co/t/logstash-input-jdbc-oracle-wallet-support/286023)
**Author:** [@Prashant\_Achari](https://discuss.elastic.co/u/Prashant_Achari)\ **Replies:** 0\ **Last updated:** [October 6, 2021, 12:20pm UTC](https://discuss.elastic.co/t/logstash-input-jdbc-oracle-wallet-support/286023 "2021-10-06T12:20:10Z")
I am trying to setup Logstah to work with Oracle wallet. I am unable get any configuration that supports wallet. I cannot keep open passwords in config files that is against the security policy. I am getting below error … --- ## [Detect when a Logstash pipeline is ready for input?](https://discuss.elastic.co/t/detect-when-a-logstash-pipeline-is-ready-for-input/285813)
**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\ **Replies:** 5\ **Last updated:** [October 6, 2021, 11:57am UTC](https://discuss.elastic.co/t/detect-when-a-logstash-pipeline-is-ready-for-input/285813 "2021-10-06T11:57:52Z")
Until recently, using Elastic 7.11.2, I've been using the following curl command line, in a Linux shell script, to detect whether Logstash is ready to ingest data: curl localhost:9600 2\> /dev/null (In a previous edit o… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=808) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=810)