# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=814 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 815 --- ## [Automatic provisioning (index/pipelin/transform)](https://discuss.elastic.co/t/automatic-provisioning-index-pipelin-transform/285475)
**Author:** [@roll](https://discuss.elastic.co/u/roll)\ **Replies:** 6\ **Last updated:** [September 30, 2021, 3:44pm UTC](https://discuss.elastic.co/t/automatic-provisioning-index-pipelin-transform/285475 "2021-09-30T15:44:53Z")
Hi all, I'm fairly new to Elasticsearch and need help automanizing the deployment. I'm using kafka sink connector to feed the data to Elasticsearch and transform API to prepare data for the client for querying. Elasti… --- ## [Sort by term position, ignoring term freqs](https://discuss.elastic.co/t/sort-by-term-position-ignoring-term-freqs/285611)
**Author:** [@maurienvy](https://discuss.elastic.co/u/maurienvy)\ **Replies:** 0\ **Last updated:** [September 30, 2021, 3:36pm UTC](https://discuss.elastic.co/t/sort-by-term-position-ignoring-term-freqs/285611 "2021-09-30T15:36:16Z")
Hello everyone! I want to do a search that allows me to sort the results depending on wether the terms that I am looking for are closer to the beggining of the text field, and ignore term frequency altogether. So for ex… --- ## [How to modify a single value from timestamp](https://discuss.elastic.co/t/how-to-modify-a-single-value-from-timestamp/285567)
**Author:** [@Jose\_E](https://discuss.elastic.co/u/Jose_E)\ **Replies:** 3\ **Last updated:** [September 30, 2021, 3:08pm UTC](https://discuss.elastic.co/t/how-to-modify-a-single-value-from-timestamp/285567 "2021-09-30T15:08:13Z")
Hi all, I'm trying to find out a way to substitute a single value from @timestamp, from another one, for instance, the hour. So far I know you can get the timestamp separated values using %{+HH}, but I can't find a way… --- ## [Logstash misinterprets incoming data](https://discuss.elastic.co/t/logstash-misinterprets-incoming-data/285200)
**Author:** [@hellotty](https://discuss.elastic.co/u/hellotty)\ **Replies:** 4\ **Last updated:** [September 30, 2021, 2:45pm UTC](https://discuss.elastic.co/t/logstash-misinterprets-incoming-data/285200 "2021-09-30T14:45:55Z")
Hello. I am streaming mdaemon logs using filebeat and using multiline.pattern to concatenate lines into one event. Using logstash, I create fields "mail from", "mail to", "message id", etc. Is it possible to make grok … --- ## [TCP plugin tuning](https://discuss.elastic.co/t/tcp-plugin-tuning/285510)
**Author:** [@vaseemQA](https://discuss.elastic.co/u/vaseemQA)\ **Replies:** 5\ **Last updated:** [September 30, 2021, 2:40pm UTC](https://discuss.elastic.co/t/tcp-plugin-tuning/285510 "2021-09-30T14:40:16Z")
Hi Team, I'm Using TCP plugin inside input and opened port =\> 12345 and then I've started logstash which works a listener, on the other side I've generated a sample shell script which works as a client and opened a TCP … --- ## [Unexpected end of ZLIB input stream on parsing gzip files](https://discuss.elastic.co/t/unexpected-end-of-zlib-input-stream-on-parsing-gzip-files/285603)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 0\ **Last updated:** [September 30, 2021, 2:35pm UTC](https://discuss.elastic.co/t/unexpected-end-of-zlib-input-stream-on-parsing-gzip-files/285603 "2021-09-30T14:35:55Z")
hello , I have a few MBs of gzip files ,which logstash fails to parse for some reason . I have 3 configs set up in pipelines.yml and 1 succeeds first and the other 2 fail the same error . \[2021-09-30T14:29:47,055\]\[ERRO… --- ## [TLS Certificates dashboard is empty](https://discuss.elastic.co/t/tls-certificates-dashboard-is-empty/281984)
**Author:** [@norgro2601](https://discuss.elastic.co/u/norgro2601)\ **Replies:** 15\ **Last updated:** [September 30, 2021, 2:31pm UTC](https://discuss.elastic.co/t/tls-certificates-dashboard-is-empty/281984 "2021-09-30T14:31:03Z")
Hi, I have a problem with the TLS Certificates dashboard in Uptime 7.14.0. In the Monitors dashboard, I can see dates in the TLS Certificates column saying that the certificates will expire next year. Unfortunately, wh… --- ## [High CPU usage ElasticSearch Causing Search slow and timeout with Kibana](https://discuss.elastic.co/t/high-cpu-usage-elasticsearch-causing-search-slow-and-timeout-with-kibana/285221)
**Author:** [@mitesh.gangaramani](https://discuss.elastic.co/u/mitesh.gangaramani)\ **Replies:** 8\ **Last updated:** [September 30, 2021, 12:48pm UTC](https://discuss.elastic.co/t/high-cpu-usage-elasticsearch-causing-search-slow-and-timeout-with-kibana/285221 "2021-09-30T12:48:20Z")
Hello Guys, Hope you are all doing well! We are using Fluent-bit + Elastic + Kibana stack for logging our kubernetes containers. However, sometimes the CPU usage goes too high and search from kibana not working. Setup… --- ## [Logstash persistent queue max capacity](https://discuss.elastic.co/t/logstash-persistent-queue-max-capacity/285588)
**Author:** [@samia](https://discuss.elastic.co/u/samia)\ **Replies:** 0\ **Last updated:** [September 30, 2021, 12:19pm UTC](https://discuss.elastic.co/t/logstash-persistent-queue-max-capacity/285588 "2021-09-30T12:19:27Z")
Hello, I would like to know if there's a maximum for the queue size of Logstash persistent queue ? I read that its default value is 1GB and it must not exceed the local disk size. I wander if it can handle volumes of … --- ## [Data/write/bulk tasks appearing on master nodes](https://discuss.elastic.co/t/data-write-bulk-tasks-appearing-on-master-nodes/285375)
**Author:** [@skijash](https://discuss.elastic.co/u/skijash)\ **Replies:** 2\ **Last updated:** [September 30, 2021, 11:58am UTC](https://discuss.elastic.co/t/data-write-bulk-tasks-appearing-on-master-nodes/285375 "2021-09-30T11:58:27Z")
I'm seeing some strange usage patters on dedicated master nodes in a 5.6.16 Elasticsearch cluster. Master nodes seem to be having excessive heap pressure during some workloads, causing them to crash with OOM errors. Whe… --- ## [Strings shown as Multifields](https://discuss.elastic.co/t/strings-shown-as-multifields/285580)
**Author:** [@KarlosA](https://discuss.elastic.co/u/KarlosA)\ **Replies:** 0\ **Last updated:** [September 30, 2021, 11:14am UTC](https://discuss.elastic.co/t/strings-shown-as-multifields/285580 "2021-09-30T11:14:19Z")
Hello, Using Elasticsearch 7.8.1 the following mapping: "mappings": { "\_routing": { "required": true }, "properties": { "qualified\_host": { … --- ## [Extremely Large Documents: Querying and Dealing with](https://discuss.elastic.co/t/extremely-large-documents-querying-and-dealing-with/284393)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 16\ **Last updated:** [September 30, 2021, 11:19am UTC](https://discuss.elastic.co/t/extremely-large-documents-querying-and-dealing-with/284393 "2021-09-30T11:19:31Z")
We are in a situation where extremely large documents were indexed (to text fields) and our ElasticSearch instance has been going down/crazy recently with out of disk and out of memory. We've also run into HTTP response … --- ## [Metricbeat creates a Standalone Cluster](https://discuss.elastic.co/t/metricbeat-creates-a-standalone-cluster/285492)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 1\ **Last updated:** [September 30, 2021, 11:15am UTC](https://discuss.elastic.co/t/metricbeat-creates-a-standalone-cluster/285492 "2021-09-30T11:15:00Z")
Hi folks, I have running 3 nodes elastic cluster and 2 nodes of logstash and I use metricbeat to monitor them and filebeat to collect logs. Everything is in 7.13.2 version Currently I am experiencing following issue wh… --- ## [How to create a visualization for node cpu usage of kubernetes](https://discuss.elastic.co/t/how-to-create-a-visualization-for-node-cpu-usage-of-kubernetes/285356)
**Author:** [@Kaushik\_R](https://discuss.elastic.co/u/Kaushik_R)\ **Replies:** 5\ **Last updated:** [September 30, 2021, 8:59am UTC](https://discuss.elastic.co/t/how-to-create-a-visualization-for-node-cpu-usage-of-kubernetes/285356 "2021-09-30T08:59:49Z")
Hi All, I'm trying to create a visualization to capture the node cpu usage of a kubernetes node. i'm trying to use kubernetes.node.cpu.usage.nanocores , kubernetes.node.cpu.usage.nanocores but none is working the outco… --- ## [How to visualise objects fields in a tab like in DISPLAY 1 (see body message)](https://discuss.elastic.co/t/how-to-visualise-objects-fields-in-a-tab-like-in-display-1-see-body-message/285561)
**Author:** [@paulpatou](https://discuss.elastic.co/u/paulpatou)\ **Replies:** 0\ **Last updated:** [September 30, 2021, 8:59am UTC](https://discuss.elastic.co/t/how-to-visualise-objects-fields-in-a-tab-like-in-display-1-see-body-message/285561 "2021-09-30T08:59:18Z")
Hello, I am using logstash to send data into elastic. My goal is to get a visualization in kibana like : "DISPLAY 1" group\_num| name\_group |unique count of id\_document 10 |groupA |2 20 |groupB … --- ## [Kibana Visualization Top Hit Counts](https://discuss.elastic.co/t/kibana-visualization-top-hit-counts/285365)
**Author:** [@susmeeta](https://discuss.elastic.co/u/susmeeta)\ **Replies:** 2\ **Last updated:** [September 29, 2021, 12:54pm UTC](https://discuss.elastic.co/t/kibana-visualization-top-hit-counts/285365 "2021-09-29T12:54:21Z")
Hi , We have a scenario where each case is processed multiple times. I am trying to fetch the unique count of cases along with the latest status of each case. To get this i have used Top Hit aggregation to get the lates… --- ## [Query DSL: Aggregation of fields and also value of fields](https://discuss.elastic.co/t/query-dsl-aggregation-of-fields-and-also-value-of-fields/285083)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 2\ **Last updated:** [September 24, 2021, 3:11pm UTC](https://discuss.elastic.co/t/query-dsl-aggregation-of-fields-and-also-value-of-fields/285083 "2021-09-24T15:11:07Z")
My data structure is as follows username,department,salary bob,finance,2000 joe,HR,2200 chan,finance,3000 bobby,finance,2500 don,HR,1800 I was looking for a Splunk's equivalent command of ... | stats values(salary) b… --- ## [Query DSL: How to use WILDCARD queries on \_id](https://discuss.elastic.co/t/query-dsl-how-to-use-wildcard-queries-on-id/285547)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 0\ **Last updated:** [September 30, 2021, 7:29am UTC](https://discuss.elastic.co/t/query-dsl-how-to-use-wildcard-queries-on-id/285547 "2021-09-30T07:29:44Z")
How to use WILDCARD queries on \_id While searching for specific type of Watcher runs (triggered\_watches), I was looking for a run of a specific type of watcher which contains a keyword in the \_id. But when I do a wildca… --- ## [Setting Fortigate OID with ELK](https://discuss.elastic.co/t/setting-fortigate-oid-with-elk/285057)
**Author:** [@Jim2](https://discuss.elastic.co/u/Jim2)\ **Replies:** 1\ **Last updated:** [September 30, 2021, 7:15am UTC](https://discuss.elastic.co/t/setting-fortigate-oid-with-elk/285057 "2021-09-30T07:15:49Z")
Hi Sir I want to setting Fortigate bandwidth chart in ELK. And refer the following img that is the chart in my Fortigate. Then I have collect OID in ELK : 1.3.6.1.2.1.2.2.1.10 1.3.6.1.2.1.2.2.1.16 And Setting th… --- ## [Sliced scroll with sort](https://discuss.elastic.co/t/sliced-scroll-with-sort/284874)
**Author:** [@Burak](https://discuss.elastic.co/u/Burak)\ **Replies:** 4\ **Last updated:** [September 30, 2021, 7:05am UTC](https://discuss.elastic.co/t/sliced-scroll-with-sort/284874 "2021-09-30T07:05:05Z")
Hello guys. How does actually Elasticsearch perform sorting under the hood for shard and for index? I can find it neither in documentation or books. I am going to use a sliced scroll with sort but in some cases, I have… --- ## [Coordinates precision](https://discuss.elastic.co/t/coordinates-precision/285434)
**Author:** [@dariusz](https://discuss.elastic.co/u/dariusz)\ **Replies:** 4\ **Last updated:** [September 30, 2021, 7:03am UTC](https://discuss.elastic.co/t/coordinates-precision/285434 "2021-09-30T07:03:46Z")
Hello, What is the precision of the floats for the coordinates in shapes, like Polygon? We tried to store a polygon without intersections with coordinates having 6 decimal digits but we got "Unable to Tessellate shape" … --- ## [Отказоустойчивый кластер из 3 нод](https://discuss.elastic.co/t/topic/285349)
**Author:** [@Uporaba](https://discuss.elastic.co/u/Uporaba)\ **Replies:** 6\ **Last updated:** [September 30, 2021, 6:39am UTC](https://discuss.elastic.co/t/topic/285349 "2021-09-30T06:39:44Z")
Добрый день. Сделал кластер из 3 нод (1 мастер, остальные дата ноды). С подключенным грейлогом (на 2 нодах, стоит грейлог), третья пустая. При падении одной ноды падает весь кластер. Подскажите, как это исправить? --- ## [Failed to execute action](https://discuss.elastic.co/t/failed-to-execute-action/285464)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 2\ **Last updated:** [September 30, 2021, 6:27am UTC](https://discuss.elastic.co/t/failed-to-execute-action/285464 "2021-09-30T06:27:44Z")
Hi firends i am getting an error like below but there is no error in the first line of my conf file. Does anyone have an idea ? Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exce… --- ## [키바나 대시보드에서 필터를 자동으로 지정할 수 있는 방법이 있을까요?](https://discuss.elastic.co/t/topic/284147)
**Author:** [@YJK](https://discuss.elastic.co/u/YJK)\ **Replies:** 2\ **Last updated:** [September 30, 2021, 4:52am UTC](https://discuss.elastic.co/t/topic/284147 "2021-09-30T04:52:12Z")
혹시 키바나 대시보드를 이용할 때 필터를 수동으로 지정하지 않고 자동으로 지정되도록 할 수 있는 방법이 있을까요? 예를 들면 metric data를 활용하여 visualize를 만들고 대시보드에서 그래프 형태로 볼 때, (어떤 방법을 통해 특정 id값을 전달해주면) 대시보드에서 특정 id값을 가진 데이터의 그래프가 자동으로 보이도록 하고 싶습니다. (특정 id값은 정해둘 수 없고 늘 … --- ## [Portable Kibana dashboard?](https://discuss.elastic.co/t/portable-kibana-dashboard/285531)
**Author:** [@jhettich](https://discuss.elastic.co/u/jhettich)\ **Replies:** 1\ **Last updated:** [September 30, 2021, 12:55am UTC](https://discuss.elastic.co/t/portable-kibana-dashboard/285531 "2021-09-30T00:55:00Z")
As a software vendor, I want to define a dashboard that can be used by multiple clients in their respective Elasticsearch/Kibana deployments. If I create a dashboard manually for one client, and export it as an NDJSON fi… --- ## [ElasticSearch Output Plugin partial update results in entire document substitution](https://discuss.elastic.co/t/elasticsearch-output-plugin-partial-update-results-in-entire-document-substitution/285512)
**Author:** [@samir\_varandas](https://discuss.elastic.co/u/samir_varandas)\ **Replies:** 3\ **Last updated:** [September 29, 2021, 11:19pm UTC](https://discuss.elastic.co/t/elasticsearch-output-plugin-partial-update-results-in-entire-document-substitution/285512 "2021-09-29T23:19:32Z")
Hi friends, I am having some trouble with the Elasticsearch Output Plugin, I am trying to perform a partial update on a document inside my Elastic index, I want to update certain fields only (the ones mapped in my event)… --- ## [Parse contents of a specific field and store in new fields](https://discuss.elastic.co/t/parse-contents-of-a-specific-field-and-store-in-new-fields/285527)
**Author:** [@rickyhicky](https://discuss.elastic.co/u/rickyhicky)\ **Replies:** 0\ **Last updated:** [September 29, 2021, 10:41pm UTC](https://discuss.elastic.co/t/parse-contents-of-a-specific-field-and-store-in-new-fields/285527 "2021-09-29T22:41:33Z")
Hello all, I have few log entries like below, which I am parsing using grok/regex. How can I again parse contents of a field and store it to new fields within the same index? Log example: \`2021-09-24T17:05:52,777 INFO… --- ## [How to run down source of mutate error?](https://discuss.elastic.co/t/how-to-run-down-source-of-mutate-error/285500)
**Author:** [@mistrhanky](https://discuss.elastic.co/u/mistrhanky)\ **Replies:** 5\ **Last updated:** [September 29, 2021, 9:55pm UTC](https://discuss.elastic.co/t/how-to-run-down-source-of-mutate-error/285500 "2021-09-29T21:55:26Z")
I have an error like the one below. In fact I get a fair number of them, lets say a few hundred each day on a production system(7.12) that logs fairly heavy, 800 million or so records a day. So the amount of these errors… --- ## [Single-node, manage data with more than one path](https://discuss.elastic.co/t/single-node-manage-data-with-more-than-one-path/285485)
**Author:** [@glitz](https://discuss.elastic.co/u/glitz)\ **Replies:** 1\ **Last updated:** [September 29, 2021, 9:36pm UTC](https://discuss.elastic.co/t/single-node-manage-data-with-more-than-one-path/285485 "2021-09-29T21:36:13Z")
Hello, I have a little yet productive (then important) single-node ELK stack version 7.9.3. In my unexperience I didn't properly took care of disk space...so I have a 200GB data partition at around at 90% disk usage, w… --- ## [Kibana stopped working after update](https://discuss.elastic.co/t/kibana-stopped-working-after-update/285444)
**Author:** [@Artemis\_Fowl](https://discuss.elastic.co/u/Artemis_Fowl)\ **Replies:** 6\ **Last updated:** [September 29, 2021, 9:32pm UTC](https://discuss.elastic.co/t/kibana-stopped-working-after-update/285444 "2021-09-29T21:32:33Z")
After the update kibana is not working. http://localhost:5601/ response - "Kibana server is not ready yet" $ journalctl -u kibana.service Sep 29 12:03:21 Notebook systemd\[1\]: Stopping Kibana... Sep 29 12:03:55 Noteboo… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=813) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=815)