# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=832 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 833 --- ## [7.14.x Kibana query bar (search) user interface glitch in Firefox 91/92](https://discuss.elastic.co/t/7-14-x-kibana-query-bar-search-user-interface-glitch-in-firefox-91-92/283740)
**Author:** [@jsteenkamp](https://discuss.elastic.co/u/jsteenkamp)\ **Replies:** 1\ **Last updated:** [September 9, 2021, 7:10am UTC](https://discuss.elastic.co/t/7-14-x-kibana-query-bar-search-user-interface-glitch-in-firefox-91-92/283740 "2021-09-09T07:10:19Z")
Kibana query bar (search) user interface glitch. Firefox version 91 and 92 Kibana version 7.14.0 and 7.14.1 --- ## [Index.number\_of\_replicas setting is not applied during ES startup](https://discuss.elastic.co/t/index-number-of-replicas-setting-is-not-applied-during-es-startup/281946)
**Author:** [@Viktor\_H](https://discuss.elastic.co/u/Viktor_H)\ **Replies:** 3\ **Last updated:** [September 9, 2021, 6:43am UTC](https://discuss.elastic.co/t/index-number-of-replicas-setting-is-not-applied-during-es-startup/281946 "2021-09-09T06:43:20Z")
I have a question regarding index.number\_of\_replicas setting in elasticsearch.yml. I'm using elastisearch 2.4. Let me explain the situation. I mirror the ES index from single (PROD) node into 3 nodes, which together form… --- ## [Fail to match query](https://discuss.elastic.co/t/fail-to-match-query/283737)
**Author:** [@ekrx](https://discuss.elastic.co/u/ekrx)\ **Replies:** 1\ **Last updated:** [September 9, 2021, 6:41am UTC](https://discuss.elastic.co/t/fail-to-match-query/283737 "2021-09-09T06:41:55Z")
Hi Im using multimatch with cross fields and im failing to match a query where the query contains more information than the field in the index. for example in the index I have "countryName": "United states of America" … --- ## [\[Kibana 7.10\] how to match item in two index patten](https://discuss.elastic.co/t/kibana-7-10-how-to-match-item-in-two-index-patten/283730)
**Author:** [@cps598](https://discuss.elastic.co/u/cps598)\ **Replies:** 1\ **Last updated:** [September 9, 2021, 5:52am UTC](https://discuss.elastic.co/t/kibana-7-10-how-to-match-item-in-two-index-patten/283730 "2021-09-09T05:52:45Z")
I originally have two index patterns with one same item called user.id. Now I create one more index pattern which combines those two indexes. But I find that they just simply add one index after another, which includes t… --- ## [Setting up elastic cluster](https://discuss.elastic.co/t/setting-up-elastic-cluster/283673)
**Author:** [@elastic\_dev](https://discuss.elastic.co/u/elastic_dev)\ **Replies:** 2\ **Last updated:** [September 9, 2021, 5:25am UTC](https://discuss.elastic.co/t/setting-up-elastic-cluster/283673 "2021-09-09T05:25:28Z")
Hi, I am setting up the Elasticsearch with 2 nodes. whenever I start my node-2 it gives me error as below '\[2021-09-08T19:24:43,093\]\[ERROR\]\[o.e.i.g.DatabaseRegistry \] \[node-2\] failed to download database \[GeoLite2-ASN.m… --- ## [“Classroom Guide” or “Reference" Links not working](https://discuss.elastic.co/t/classroom-guide-or-reference-links-not-working/283024)
**Author:** [@sparmar2000](https://discuss.elastic.co/u/sparmar2000)\ **Replies:** 5\ **Last updated:** [September 9, 2021, 5:24am UTC](https://discuss.elastic.co/t/classroom-guide-or-reference-links-not-working/283024 "2021-09-09T05:24:07Z")
The links on Strigo does not seem to work - has been like this for some time now. I would be really grateful for help. The following are steps to recreate: I select the DNS I paste on the browser and get I… --- ## [I need to have multiple index based on the path of log file](https://discuss.elastic.co/t/i-need-to-have-multiple-index-based-on-the-path-of-log-file/283667)
**Author:** [@akhilkandari](https://discuss.elastic.co/u/akhilkandari)\ **Replies:** 2\ **Last updated:** [September 9, 2021, 4:52am UTC](https://discuss.elastic.co/t/i-need-to-have-multiple-index-based-on-the-path-of-log-file/283667 "2021-09-09T04:52:37Z")
we have 2 environment one dev & one prod storing logs in dev path & prod path so how can i have 2 separate index for both of these based on path input { stdin{ type =\> "stdin-type" } file{ type… --- ## [How to search all Domain](https://discuss.elastic.co/t/how-to-search-all-domain/282797)
**Author:** [@Mick1](https://discuss.elastic.co/u/Mick1)\ **Replies:** 3\ **Last updated:** [September 9, 2021, 4:07am UTC](https://discuss.elastic.co/t/how-to-search-all-domain/282797 "2021-09-09T04:07:20Z")
Why domain : \*.02222105.com include www.02222105.com and 02222105.com but not include www100.02222105.com How to Search all Domain (Lucene or KQL) Thanks you Master --- ## [Logstash support snmptrap v3?](https://discuss.elastic.co/t/logstash-support-snmptrap-v3/283722)
**Author:** [@T\_Mashimo](https://discuss.elastic.co/u/T_Mashimo)\ **Replies:** 1\ **Last updated:** [September 9, 2021, 3:00am UTC](https://discuss.elastic.co/t/logstash-support-snmptrap-v3/283722 "2021-09-09T03:00:57Z")
Hello. Does snmptrap input plugin for logstash support v3? The official documentation does not specify the supported versions. Someone is asking the same question here, but there is no answer. Thank you. --- ## [\[Kibana 7.10\] How to search from all Index Patten](https://discuss.elastic.co/t/kibana-7-10-how-to-search-from-all-index-patten/283721)
**Author:** [@cps598](https://discuss.elastic.co/u/cps598)\ **Replies:** 3\ **Last updated:** [September 9, 2021, 2:33am UTC](https://discuss.elastic.co/t/kibana-7-10-how-to-search-from-all-index-patten/283721 "2021-09-09T02:33:04Z")
I would like to search for the IP address from all Index Patten. All Index Patten got the same field call "s.ip". Can we search like Splunk "index:\* s.ip:192.168.1.1"? --- ## [SIEM open rules](https://discuss.elastic.co/t/siem-open-rules/283710)
**Author:** [@wallacepalace](https://discuss.elastic.co/u/wallacepalace)\ **Replies:** 2\ **Last updated:** [September 9, 2021, 1:54am UTC](https://discuss.elastic.co/t/siem-open-rules/283710 "2021-09-09T01:54:06Z")
Hey there, how are ur? I'm posting here some rules I made for detecting communications with botnets, command and control (C2), VNC scanners, SSH, MySQL, RDP, DNS, Telnet, HTTP, TFTP. Using honeypots, blacklists, IP rank… --- ## [elasticsearch.exceptions.RequestError: RequestError(400, 'parse\_exception', 'numeric value expected')](https://discuss.elastic.co/t/elasticsearch-exceptions-requesterror-requesterror-400-parse-exception-numeric-value-expected/283687)
**Author:** [@saltyMcSalt](https://discuss.elastic.co/u/saltyMcSalt)\ **Replies:** 1\ **Last updated:** [September 9, 2021, 12:19am UTC](https://discuss.elastic.co/t/elasticsearch-exceptions-requesterror-requesterror-400-parse-exception-numeric-value-expected/283687 "2021-09-09T00:19:49Z")
Hi all, I am trying to do a geo-polygon query, running into this exception: elasticsearch.exceptions.RequestError: RequestError(400, 'parse\_exception', 'numeric value expected') Elasticsearch Version 7.5.3 The quer… --- ## [Json parse with logstash](https://discuss.elastic.co/t/json-parse-with-logstash/283714)
**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\ **Replies:** 4\ **Last updated:** [September 8, 2021, 11:49pm UTC](https://discuss.elastic.co/t/json-parse-with-logstash/283714 "2021-09-08T23:49:49Z")
Hi team, I want to laod data from sql server to elasticsearch via logstash 6.5 I have a table in sql server which has json objects as a value in one of the columns. My requirement is to read those objects as it is and … --- ## [What is the ideal configuration for a Elasticsearch cluster designed for High Availiability?](https://discuss.elastic.co/t/what-is-the-ideal-configuration-for-a-elasticsearch-cluster-designed-for-high-availiability/283654)
**Author:** [@xemyleex](https://discuss.elastic.co/u/xemyleex)\ **Replies:** 1\ **Last updated:** [September 8, 2021, 11:39pm UTC](https://discuss.elastic.co/t/what-is-the-ideal-configuration-for-a-elasticsearch-cluster-designed-for-high-availiability/283654 "2021-09-08T23:39:46Z")
Hello, I need to design a elasticsearch cluster for high availability. What is the ideal configuration ( nodes numbers, nodes roles, node configurations, etc ) for elasticsearch? What parameters ( workload, how much se… --- ## [Magento 2.4 to web hosting sites (NO ELASTICSEARCH)](https://discuss.elastic.co/t/magento-2-4-to-web-hosting-sites-no-elasticsearch/283701)
**Author:** [@larzu](https://discuss.elastic.co/u/larzu)\ **Replies:** 1\ **Last updated:** [September 8, 2021, 11:16pm UTC](https://discuss.elastic.co/t/magento-2-4-to-web-hosting-sites-no-elasticsearch/283701 "2021-09-08T23:16:13Z")
I suppose that you can give some help Shorty - Could you let me know how install Magento 2.4 to web hosting sites (like Siteground) where this elasticsearch is not supported? Is this a dead end for Magento or is there… --- ## [How to get only deltas in elasticsearch input](https://discuss.elastic.co/t/how-to-get-only-deltas-in-elasticsearch-input/283708)
**Author:** [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\ **Replies:** 1\ **Last updated:** [September 8, 2021, 8:41pm UTC](https://discuss.elastic.co/t/how-to-get-only-deltas-in-elasticsearch-input/283708 "2021-09-08T20:41:07Z")
I would like to know how I do something like jdbc-input, that the query is always the most recent, but this using elaticsearch\_input. if it is not possible, please help me to build a query that returns everything from t… --- ## [Getting error \`\[template\] unknown field \[index\_patterns\]\` while creating index template in 7.14.0](https://discuss.elastic.co/t/getting-error-template-unknown-field-index-patterns-while-creating-index-template-in-7-14-0/283700)
**Author:** [@prathamesh7](https://discuss.elastic.co/u/prathamesh7)\ **Replies:** 3\ **Last updated:** [September 8, 2021, 7:25pm UTC](https://discuss.elastic.co/t/getting-error-template-unknown-field-index-patterns-while-creating-index-template-in-7-14-0/283700 "2021-09-08T19:25:58Z")
Hi Team, I am creating index template (not legacy template) in kibana in version 7.14.0 but can see below error in 6th step of Review template in preview tab. { "statusCode": 400, "error": "Bad Request", "messag… --- ## [Filter on nested field](https://discuss.elastic.co/t/filter-on-nested-field/283697)
**Author:** [@dgastudio](https://discuss.elastic.co/u/dgastudio)\ **Replies:** 3\ **Last updated:** [September 8, 2021, 7:25pm UTC](https://discuss.elastic.co/t/filter-on-nested-field/283697 "2021-09-08T19:25:24Z")
Hello! I can't understand what i'm doing wrong when filtering on nested field. Mapping { "acc": { "type": "keyword" }, "birthday": { "type": "date", "format": "epoch\_second" }, … --- ## [Running as service, continuously giving "No source loaders matched! This shouldn't happen"](https://discuss.elastic.co/t/running-as-service-continuously-giving-no-source-loaders-matched-this-shouldnt-happen/283487)
**Author:** [@matt.snyder](https://discuss.elastic.co/u/matt.snyder)\ **Replies:** 1\ **Last updated:** [September 8, 2021, 5:57pm UTC](https://discuss.elastic.co/t/running-as-service-continuously-giving-no-source-loaders-matched-this-shouldnt-happen/283487 "2021-09-08T17:57:26Z")
I am running logstash as a service, and it seems that an erroneous job is stuck in a queue somewhere, though I cannot find it. The error in the subject appears over and over in logstash-plain.log, no matter what files I… --- ## [How does Elasticsearch automatically configure heap size based on available memory?](https://discuss.elastic.co/t/how-does-elasticsearch-automatically-configure-heap-size-based-on-available-memory/283670)
**Author:** [@anto\_gian](https://discuss.elastic.co/u/anto_gian)\ **Replies:** 1\ **Last updated:** [September 8, 2021, 5:49pm UTC](https://discuss.elastic.co/t/how-does-elasticsearch-automatically-configure-heap-size-based-on-available-memory/283670 "2021-09-08T17:49:41Z")
Hi I just setup an Elasticsearch 7.14 cluster with 2 nodes. I was about to configure JVM Heap size and saw this message The heap size is automatically configured by Elasticsearch ## based on the available memory in you… --- ## [Packetbeat 7.14.1 process.env not added to the document](https://discuss.elastic.co/t/packetbeat-7-14-1-process-env-not-added-to-the-document/283698)
**Author:** [@Rodrigo\_Bernardo](https://discuss.elastic.co/u/Rodrigo_Bernardo)\ **Replies:** 0\ **Last updated:** [September 8, 2021, 5:09pm UTC](https://discuss.elastic.co/t/packetbeat-7-14-1-process-env-not-added-to-the-document/283698 "2021-09-08T17:09:24Z")
Hello there, I tried to follow the documentation but with no success. Am I doing something wrong or packetbeat has issues sending the process environment into the document. I am using the latest version of packetbeat 7.… --- ## [Indices replicas are set to 0 during night? \[7.11.2\]](https://discuss.elastic.co/t/indices-replicas-are-set-to-0-during-night-7-11-2/283627)
**Author:** [@mbooh](https://discuss.elastic.co/u/mbooh)\ **Replies:** 3\ **Last updated:** [September 8, 2021, 4:34pm UTC](https://discuss.elastic.co/t/indices-replicas-are-set-to-0-during-night-7-11-2/283627 "2021-09-08T16:34:49Z")
Hi! I have a strange behavior. During night one of my indices lost a replica setting? Yesterday everything worked fine, they both had 1 replica but this morning it is 0 on one of them meaning when I close one node down … --- ## [Ruby time.strftime Stripping hours from the time](https://discuss.elastic.co/t/ruby-time-strftime-stripping-hours-from-the-time/283655)
**Author:** [@Bryan\_Hamilton](https://discuss.elastic.co/u/Bryan_Hamilton)\ **Replies:** 3\ **Last updated:** [September 8, 2021, 3:46pm UTC](https://discuss.elastic.co/t/ruby-time-strftime-stripping-hours-from-the-time/283655 "2021-09-08T15:46:17Z")
Hi all, I am using the following filter to extract only the time from the @timestamp field. ruby { code =\> "event.set('\[datetime\]\[time\]',event.get('@timestamp').time.strftime('%H:%M:%S'))" } Which works exept … --- ## [Rarely, the "found" key is missing from the multi-get response](https://discuss.elastic.co/t/rarely-the-found-key-is-missing-from-the-multi-get-response/283584)
**Author:** [@jesseb](https://discuss.elastic.co/u/jesseb)\ **Replies:** 2\ **Last updated:** [September 8, 2021, 3:23pm UTC](https://discuss.elastic.co/t/rarely-the-found-key-is-missing-from-the-multi-get-response/283584 "2021-09-08T15:23:55Z")
We are using Elasticsearch 6.8. Our logs show that very very rarely, we get a responses from multi-get where the "found" field is missing, but the expected documents are otherwise intact. Is this ever expected to happen… --- ## [Logstash - not update a document even if document\_id is specified](https://discuss.elastic.co/t/logstash-not-update-a-document-even-if-document-id-is-specified/283660)
**Author:** [@reed](https://discuss.elastic.co/u/reed)\ **Replies:** 3\ **Last updated:** [September 8, 2021, 2:23pm UTC](https://discuss.elastic.co/t/logstash-not-update-a-document-even-if-document-id-is-specified/283660 "2021-09-08T14:23:15Z")
Hi all, I'm new with elastic technology and I wold ask this: I have my pipeline with output { elasticsearch { hosts =\> "localhost:9200" index =\> "crsi-index-template-%{+yyyy.MM.dd}" document\_id … --- ## [How can I migrate from elasticsearch to postgresql?](https://discuss.elastic.co/t/how-can-i-migrate-from-elasticsearch-to-postgresql/283041)
**Author:** [@xemyleex](https://discuss.elastic.co/u/xemyleex)\ **Replies:** 2\ **Last updated:** [September 8, 2021, 2:15pm UTC](https://discuss.elastic.co/t/how-can-i-migrate-from-elasticsearch-to-postgresql/283041 "2021-09-08T14:15:01Z")
I have to migrate from elasticsearch to postgresql. What is the best way to do that? I found this plugin: Elasticsearch output plugin | Logstash Reference \[7.14\] | Elastic Is it useful for my purpose? Thanks … --- ## [Updating status code data with predefined Labels in Dashboard](https://discuss.elastic.co/t/updating-status-code-data-with-predefined-labels-in-dashboard/283668)
**Author:** [@keyu](https://discuss.elastic.co/u/keyu)\ **Replies:** 1\ **Last updated:** [September 8, 2021, 1:45pm UTC](https://discuss.elastic.co/t/updating-status-code-data-with-predefined-labels-in-dashboard/283668 "2021-09-08T13:45:40Z")
Hi, I am working on processing my transaction data for visualization. But I want to update the status codes with corresponding values. In Discover, I am able to see the data as 00, 01, 02 .. etc., But it should visual… --- ## [Unable to see dashboard drilldown option in kibana dashboards](https://discuss.elastic.co/t/unable-to-see-dashboard-drilldown-option-in-kibana-dashboards/283609)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [September 8, 2021, 1:40pm UTC](https://discuss.elastic.co/t/unable-to-see-dashboard-drilldown-option-in-kibana-dashboards/283609 "2021-09-08T13:40:19Z")
Hi all, I'm unable to see dashboard drilldown option in kibana dashboards when I click on visualization intended. I'm using Kibana 7.10.2 version. Is it related to Kibana OSS build vs Non OSS build? Should i reinst… --- ## [Logstash processing only number of events 2 times to pipeline.max\_inflight](https://discuss.elastic.co/t/logstash-processing-only-number-of-events-2-times-to-pipeline-max-inflight/283664)
**Author:** [@amar.molaka](https://discuss.elastic.co/u/amar.molaka)\ **Replies:** 0\ **Last updated:** [September 8, 2021, 1:21pm UTC](https://discuss.elastic.co/t/logstash-processing-only-number-of-events-2-times-to-pipeline-max-inflight/283664 "2021-09-08T13:21:17Z")
My pipeline configuration as below - pipeline.id: staticmetrics queue.type: persisted pipeline.workers: 10 pipeline.batch.size: 2 pipeline.batch.delay: 1000 path.config: "/Users/James/Desktop/metrics.con… --- ## [Find exceptions in indices](https://discuss.elastic.co/t/find-exceptions-in-indices/283656)
**Author:** [@bil\_15](https://discuss.elastic.co/u/bil_15)\ **Replies:** 0\ **Last updated:** [September 8, 2021, 12:49pm UTC](https://discuss.elastic.co/t/find-exceptions-in-indices/283656 "2021-09-08T12:49:50Z")
Hello! I've created exception on the rule and interested in the way it works. For ex, in Splunk we're receiving suppressed events anyway, so they are still stored in appropriate index, but they are don't visible in SIE… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=831) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=833)