# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=819 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 820 --- ## [What is the best way to classify data?](https://discuss.elastic.co/t/what-is-the-best-way-to-classify-data/285076)
**Author:** [@wifi](https://discuss.elastic.co/u/wifi)\ **Replies:** 0\ **Last updated:** [September 24, 2021, 11:44am UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-classify-data/285076 "2021-09-24T11:44:25Z")
I have data that originates from three sources and thus saved in a separate index each. metricbeat manual data: manually ingested data app data: data ingested by an app The documents in each index have different field… --- ## [Getting Error while installing checkstyle on IntelliJ](https://discuss.elastic.co/t/getting-error-while-installing-checkstyle-on-intellij/285074)
**Author:** [@Ankur\_Jain](https://discuss.elastic.co/u/Ankur_Jain)\ **Replies:** 0\ **Last updated:** [September 24, 2021, 11:16am UTC](https://discuss.elastic.co/t/getting-error-while-installing-checkstyle-on-intellij/285074 "2021-09-24T11:16:49Z")
Hi Team, I have cloned elasticsearch project on my local and getting below error while installing checkstyle. Could not determine the dependencies of task ':buildDependencyArtifacts'. Task with path ':plugins:reposit… --- ## [Logstash pipeline, разделение логов в различные индексы](https://discuss.elastic.co/t/logstash-pipeline/285004)
**Author:** [@Savai](https://discuss.elastic.co/u/Savai)\ **Replies:** 1\ **Last updated:** [September 24, 2021, 9:12am UTC](https://discuss.elastic.co/t/logstash-pipeline/285004 "2021-09-24T09:12:40Z")
Подскажите пожалуйста В сети есть компьютеры с установлеными winlogbeat(установлены на ОС Windows) и filebeat- они могут быть установлены как на ОС Linux так и на Windows, как в pipeline logstash правильно организовать… --- ## [How to create a segment/line chart visualization with well-defined time intervals in a dashboard?](https://discuss.elastic.co/t/how-to-create-a-segment-line-chart-visualization-with-well-defined-time-intervals-in-a-dashboard/283881)
**Author:** [@Mario\_Sabetta](https://discuss.elastic.co/u/Mario_Sabetta)\ **Replies:** 2\ **Last updated:** [September 24, 2021, 8:49am UTC](https://discuss.elastic.co/t/how-to-create-a-segment-line-chart-visualization-with-well-defined-time-intervals-in-a-dashboard/283881 "2021-09-24T08:49:10Z")
Hello everyone, I have to make a segment chart with the time intervals as shown in the figure (first picture below). I started doing something similar by doing a simple trapezoidal function with integers on the abscissa… --- ## [How to run elasticsearch when installed from source?](https://discuss.elastic.co/t/how-to-run-elasticsearch-when-installed-from-source/285047)
**Author:** [@Rahmat\_Agung\_W](https://discuss.elastic.co/u/Rahmat_Agung_W)\ **Replies:** 3\ **Last updated:** [September 24, 2021, 7:19am UTC](https://discuss.elastic.co/t/how-to-run-elasticsearch-when-installed-from-source/285047 "2021-09-24T07:19:04Z")
Hi, so I want to install Elasticsearch from archieve (Install Elasticsearch from archive on Linux or MacOS | Elasticsearch Guide \[7.15\] | Elastic). Why? Because I need to install them on custom path (by default Elasticse… --- ## [Unable to retrieve more 10k records from elastic search using rest api](https://discuss.elastic.co/t/unable-to-retrieve-more-10k-records-from-elastic-search-using-rest-api/285051)
**Author:** [@Magesh\_02](https://discuss.elastic.co/u/Magesh_02)\ **Replies:** 3\ **Last updated:** [September 24, 2021, 7:11am UTC](https://discuss.elastic.co/t/unable-to-retrieve-more-10k-records-from-elastic-search-using-rest-api/285051 "2021-09-24T07:11:50Z")
I'm trying to get more than 10k records from an Elasticsearch using the Rest api (http://localhost:9200/json-metrics/\_search), but all I have is the rest api link, which is the input to my BI tool. I need those records i… --- ## [Unable to parse multiline json data into logstash](https://discuss.elastic.co/t/unable-to-parse-multiline-json-data-into-logstash/284114)
**Author:** [@Magesh\_02](https://discuss.elastic.co/u/Magesh_02)\ **Replies:** 11\ **Last updated:** [September 24, 2021, 6:17am UTC](https://discuss.elastic.co/t/unable-to-parse-multiline-json-data-into-logstash/284114 "2021-09-24T06:17:09Z")
I have tried to parse my json data into logstash data with separate fields. But unable to parse my data, logstash console struck on pipeline starts line input : { "id": 1, "first\_name": "Frank", "las… --- ## [Slow response times query first couple of times](https://discuss.elastic.co/t/slow-response-times-query-first-couple-of-times/285018)
**Author:** [@Mark\_Schenk](https://discuss.elastic.co/u/Mark_Schenk)\ **Replies:** 2\ **Last updated:** [September 24, 2021, 4:37am UTC](https://discuss.elastic.co/t/slow-response-times-query-first-couple-of-times/285018 "2021-09-24T04:37:59Z")
We have a service which is using ES sporadically, (once every few hours). We noted that the first couple of times we query ES takes a lot longer than subsequent calls. For example if we perform the following query: { … --- ## [No processor type exists with name \[attachment\]](https://discuss.elastic.co/t/no-processor-type-exists-with-name-attachment/285013)
**Author:** [@Jihad\_Abdulrazaq](https://discuss.elastic.co/u/Jihad_Abdulrazaq)\ **Replies:** 9\ **Last updated:** [September 24, 2021, 1:45am UTC](https://discuss.elastic.co/t/no-processor-type-exists-with-name-attachment/285013 "2021-09-24T01:45:31Z")
Hello Dears, I am getting below error, while trying to ingest pdf file: “No processor type exists with name \[attachment\]" $params = \[ 'id' =\> 'attachment', 'body' =\> \[ … --- ## [Completion suggester index - What's loaded in heap?](https://discuss.elastic.co/t/completion-suggester-index-whats-loaded-in-heap/285041)
**Author:** [@mattkallo](https://discuss.elastic.co/u/mattkallo)\ **Replies:** 0\ **Last updated:** [September 24, 2021, 12:52am UTC](https://discuss.elastic.co/t/completion-suggester-index-whats-loaded-in-heap/285041 "2021-09-24T00:52:39Z")
I have an index with 20+ fields and the same index has one suggester/completion field. As I understand, completion suggester is loaded into heap for faster response times. My question is - does all the fields in the in… --- ## [False Positives in the 1000's](https://discuss.elastic.co/t/false-positives-in-the-1000s/285019)
**Author:** [@tanner8302](https://discuss.elastic.co/u/tanner8302)\ **Replies:** 1\ **Last updated:** [September 23, 2021, 11:31pm UTC](https://discuss.elastic.co/t/false-positives-in-the-1000s/285019 "2021-09-23T23:31:55Z")
Has anyone noticed a "HUGE" amount of false positives that occur when enabling the Detection Rule \[Threat Intel Filebeat Module Indicator Match\]. This rule is tagged as follows Continuous Monitoring Elastic Elastic E… --- ## [What does this exception mean?](https://discuss.elastic.co/t/what-does-this-exception-mean/285024)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 1\ **Last updated:** [September 23, 2021, 9:16pm UTC](https://discuss.elastic.co/t/what-does-this-exception-mean/285024 "2021-09-23T21:16:35Z")
at java.lang.Thread.run(Thread.java:835) ~\[?:?\] at org.elasticsearch.transport.InboundHandler$1.doRun(InboundHandler.java:224) ~\[elasticsearch-7.3.1.jar:7.3.1\] at org.elasticsearch.common.util.concurrent… --- ## [Substring with grokPattern](https://discuss.elastic.co/t/substring-with-grokpattern/285026)
**Author:** [@mvasqueznr](https://discuss.elastic.co/u/mvasqueznr)\ **Replies:** 1\ **Last updated:** [September 23, 2021, 8:48pm UTC](https://discuss.elastic.co/t/substring-with-grokpattern/285026 "2021-09-23T20:48:31Z")
Hi. With this example data GigabitEthernet102/0/0/28 = TLU-46356\_CAR\_ONE\_RIVERO\_AUTO\_CENTER\_PRINCIPAL Traffic (SNMP Traffic) Down (The interface is disconnected: ifOperStatus=down (2) (code: PE058)) Im try to get a s… --- ## [Kibana Lens Table Date Format](https://discuss.elastic.co/t/kibana-lens-table-date-format/284746)
**Author:** [@fefontana](https://discuss.elastic.co/u/fefontana)\ **Replies:** 6\ **Last updated:** [September 23, 2021, 8:52pm UTC](https://discuss.elastic.co/t/kibana-lens-table-date-format/284746 "2021-09-23T20:52:26Z")
Hi, using a table in Kibana Lens I can't get a formatted date at the "Log Date" column. The date format changes according to the time period. Below is the JSON I've been using and the screenshots with the issue { "too… --- ## [ES 7.8 often giving errors "Data too large for http\_request", but some evidence makes no sense](https://discuss.elastic.co/t/es-7-8-often-giving-errors-data-too-large-for-http-request-but-some-evidence-makes-no-sense/285016)
**Author:** [@spdoes](https://discuss.elastic.co/u/spdoes)\ **Replies:** 8\ **Last updated:** [September 23, 2021, 8:51pm UTC](https://discuss.elastic.co/t/es-7-8-often-giving-errors-data-too-large-for-http-request-but-some-evidence-makes-no-sense/285016 "2021-09-23T20:51:53Z")
summary of error message: \[parent\] Data too large, data for \[\\] would be \[31095660714/28.9gb\], which is larger than the limit of \[30601641984/28.5gb\], real usage: \[31095659536/28.9gb\], new bytes reserved: … --- ## [Sharing index templates](https://discuss.elastic.co/t/sharing-index-templates/285023)
**Author:** [@Elitlogik](https://discuss.elastic.co/u/Elitlogik)\ **Replies:** 2\ **Last updated:** [September 23, 2021, 8:49pm UTC](https://discuss.elastic.co/t/sharing-index-templates/285023 "2021-09-23T20:49:59Z")
I have set up Index Templates and Kibana objects that I think many people out there would like to copy. Sharing Saved Objects as exported ndjson files is easy. How can I share Index Templates configuration for other to… --- ## [ECK - Fleet Server agent startup failure](https://discuss.elastic.co/t/eck-fleet-server-agent-startup-failure/280573)
**Author:** [@sc75651](https://discuss.elastic.co/u/sc75651)\ **Replies:** 11\ **Last updated:** [September 23, 2021, 6:53pm UTC](https://discuss.elastic.co/t/eck-fleet-server-agent-startup-failure/280573 "2021-09-23T18:53:16Z")
Followed these steps - but I am getting below error during startup Note\* - I am using custom TLS certificates generated using cert-manager - k logs -f fleet-server-agent-6f976f656c-l5vtd cp: cannot stat '/mnt/elastic-i… --- ## [How to round to 2 digits after comma scripted field parameter value](https://discuss.elastic.co/t/how-to-round-to-2-digits-after-comma-scripted-field-parameter-value/282032)
**Author:** [@arisxf](https://discuss.elastic.co/u/arisxf)\ **Replies:** 9\ **Last updated:** [September 23, 2021, 6:32pm UTC](https://discuss.elastic.co/t/how-to-round-to-2-digits-after-comma-scripted-field-parameter-value/282032 "2021-09-23T18:32:00Z")
Management/Index Patterns/{indexing}/scripted field Visualize Visualize please all help --- ## [Multiple query and aggregation filter](https://discuss.elastic.co/t/multiple-query-and-aggregation-filter/285020)
**Author:** [@Roberto\_B](https://discuss.elastic.co/u/Roberto_B)\ **Replies:** 0\ **Last updated:** [September 23, 2021, 5:42pm UTC](https://discuss.elastic.co/t/multiple-query-and-aggregation-filter/285020 "2021-09-23T17:42:07Z")
Let's assume that i have in input 3 different query that fetch data from 3 different tables. from the first i take for example 4 fields one of them is "id\_test" and it is common and present in the other 2 input query r… --- ## [Logstash tags entries as\_grokparsefailures but multiple online debuggers says otherwise](https://discuss.elastic.co/t/logstash-tags-entries-as-grokparsefailures-but-multiple-online-debuggers-says-otherwise/283753)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 11\ **Last updated:** [September 23, 2021, 2:56pm UTC](https://discuss.elastic.co/t/logstash-tags-entries-as-grokparsefailures-but-multiple-online-debuggers-says-otherwise/283753 "2021-09-23T14:56:19Z")
Hi All, I've a very strange question that I hope to explain eloquently. I'm dealing with FW logs. Already wrote a grok parser that works like a charm (prefer not to provided it here, let me know if it's going to be need… --- ## [How can I parse nested JSON object with arrays and dict into Elasticsearch using Logstash](https://discuss.elastic.co/t/how-can-i-parse-nested-json-object-with-arrays-and-dict-into-elasticsearch-using-logstash/284971)
**Author:** [@shaikadil95](https://discuss.elastic.co/u/shaikadil95)\ **Replies:** 1\ **Last updated:** [September 23, 2021, 2:43pm UTC](https://discuss.elastic.co/t/how-can-i-parse-nested-json-object-with-arrays-and-dict-into-elasticsearch-using-logstash/284971 "2021-09-23T14:43:14Z")
I have a nested JSON object below. { "data": { "testChannels": \[ { "name": "TC1", "Time": "2021-08-31 12:02:51.103188", "info": { "user": "johan", "epic": "Epic" … --- ## [Response Time Report](https://discuss.elastic.co/t/response-time-report/284806)
**Author:** [@chivas](https://discuss.elastic.co/u/chivas)\ **Replies:** 3\ **Last updated:** [September 23, 2021, 2:38pm UTC](https://discuss.elastic.co/t/response-time-report/284806 "2021-09-23T14:38:42Z")
Hello, I need to generate a Visual/Report which shows the response time taken by an API/function call to my webserver from the client. Below is my data in Elasticsearch. So my question is what is the best way to gen… --- ## [Time based count in Kibana Visualization](https://discuss.elastic.co/t/time-based-count-in-kibana-visualization/284835)
**Author:** [@Anchit\_Banerjee](https://discuss.elastic.co/u/Anchit_Banerjee)\ **Replies:** 2\ **Last updated:** [September 23, 2021, 2:33pm UTC](https://discuss.elastic.co/t/time-based-count-in-kibana-visualization/284835 "2021-09-23T14:33:02Z")
Hello All, I am trying to create a pie-chart of a particular event with count in Kibana. I am fetching the data from Oracle DB through logstash JDBC input pipeline. Eg: Name Count event1 10 event2 20 I… --- ## [Wrong events order if time difference is less than 1ms](https://discuss.elastic.co/t/wrong-events-order-if-time-difference-is-less-than-1ms/284983)
**Author:** [@alexandrpaliy](https://discuss.elastic.co/u/alexandrpaliy)\ **Replies:** 1\ **Last updated:** [September 23, 2021, 2:10pm UTC](https://discuss.elastic.co/t/wrong-events-order-if-time-difference-is-less-than-1ms/284983 "2021-09-23T14:10:47Z")
Hi. I use version 7.13.4 of all stack (ELK + filebeats). Filebeat grabs events (auth.log entries in this case) on remote host, then passes them to logstash to filter/modify data, then events go to Elasticsearch. Talkin… --- ## [Logstash for z/OS](https://discuss.elastic.co/t/logstash-for-z-os/284916)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 2\ **Last updated:** [September 23, 2021, 1:57pm UTC](https://discuss.elastic.co/t/logstash-for-z-os/284916 "2021-09-23T13:57:44Z")
Hello there, Hope you are doing well! I have a few questions regarding Log monitoring on Mainframe through Logstash. My understanding here is extract and transform logs into JSON through JCL workbench and send it to th… --- ## [Search docs using month and day in birthday filed using elasticsearch SQL](https://discuss.elastic.co/t/search-docs-using-month-and-day-in-birthday-filed-using-elasticsearch-sql/284844)
**Author:** [@RAHUL\_PATEL](https://discuss.elastic.co/u/RAHUL_PATEL)\ **Replies:** 1\ **Last updated:** [September 23, 2021, 1:56pm UTC](https://discuss.elastic.co/t/search-docs-using-month-and-day-in-birthday-filed-using-elasticsearch-sql/284844 "2021-09-23T13:56:47Z")
i have a filed name birthday. which has date of birth in Date format. now using Elasticsearch SQL query, I want get "list all people who have birthdays in January" how to get all people using whose birthday is in Janu… --- ## [Elastic Cloud Enterprise 2.12.0 Released](https://discuss.elastic.co/t/elastic-cloud-enterprise-2-12-0-released/285005)
**Author:** [@Olivier\_Bierlaire](https://discuss.elastic.co/u/Olivier_Bierlaire)\ **Replies:** 0\ **Last updated:** [September 23, 2021, 12:59pm UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-2-12-0-released/285005 "2021-09-23T12:59:16Z")
We are pleased to announce that ECE 2.12.0 has been released today. Release notes: https://www.elastic.co/guide/en/cloud-enterprise/current/ece-release-notes-2.12.0.html --- ## [Shard Awareness Question](https://discuss.elastic.co/t/shard-awareness-question/284941)
**Author:** [@Dauni](https://discuss.elastic.co/u/Dauni)\ **Replies:** 3\ **Last updated:** [September 23, 2021, 12:11pm UTC](https://discuss.elastic.co/t/shard-awareness-question/284941 "2021-09-23T12:11:49Z")
Hello, We are running an ES 5.16 cluster in 3 DC's (total of 15 hosts, each host is 8 cpu / 32 GB ram and we have heap set to 16GB). DC1 = zone1 (1 master node, 6 data nodes) DC2 = zone2 (1 master node, 6 data nodes) … --- ## [Multiple Terms filters not working](https://discuss.elastic.co/t/multiple-terms-filters-not-working/284077)
**Author:** [@Jay2](https://discuss.elastic.co/u/Jay2)\ **Replies:** 9\ **Last updated:** [September 23, 2021, 11:48am UTC](https://discuss.elastic.co/t/multiple-terms-filters-not-working/284077 "2021-09-23T11:48:53Z")
Hi, I am new to the DSL and im using the below DSL query: {"from":0,"min\_score":0.5,"query":{"bool":{"filter":\[{"terms":{"extension":\["bmp","jpg","tif","img","png","gif","jpeg"\]}},{"terms":{"userContentType":\["webpage"\]… --- ## [Unable to use scripted field in TSVB sum aggregation..Please help](https://discuss.elastic.co/t/unable-to-use-scripted-field-in-tsvb-sum-aggregation-please-help/244026)
**Author:** [@Ashima\_Sachdeva](https://discuss.elastic.co/u/Ashima_Sachdeva)\ **Replies:** 2\ **Last updated:** [September 23, 2021, 11:32am UTC](https://discuss.elastic.co/t/unable-to-use-scripted-field-in-tsvb-sum-aggregation-please-help/244026 "2021-09-23T11:32:14Z")
unable to use scripted field in TSVB sum aggregation...only index pattern fields are coming in drop down. [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=818) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=820)