# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=847 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 848 --- ## [Elasticsearch6 on MAC - Bootstrap failed: 5: Input/output error](https://discuss.elastic.co/t/elasticsearch6-on-mac-bootstrap-failed-5-input-output-error/282263)
**Author:** [@Mike\_Fritzsche](https://discuss.elastic.co/u/Mike_Fritzsche)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 5:20pm UTC](https://discuss.elastic.co/t/elasticsearch6-on-mac-bootstrap-failed-5-input-output-error/282263 "2021-08-23T17:20:00Z")
Hi all, I can not get run Elasticsearch 6 on my MAC Big Sure. I installed with Brew and all the time when brew services start elasticsearch@6 I get the following error: Bootstrap failed: 5: Input/output error Error:… --- ## [Kibana List API Questions](https://discuss.elastic.co/t/kibana-list-api-questions/280530)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [August 23, 2021, 5:16pm UTC](https://discuss.elastic.co/t/kibana-list-api-questions/280530 "2021-08-23T17:16:01Z")
Hello all, We really like the Kibana List API. it enables us to make black and whitelists we can use in Elastic detection rules. For example a list of developers, compromised accounts, vpn users, etc. We also really lik… --- ## [Configure Kibana with default fields](https://discuss.elastic.co/t/configure-kibana-with-default-fields/282253)
**Author:** [@gba8912](https://discuss.elastic.co/u/gba8912)\ **Replies:** 3\ **Last updated:** [August 23, 2021, 5:14pm UTC](https://discuss.elastic.co/t/configure-kibana-with-default-fields/282253 "2021-08-23T17:14:30Z")
Hi all, I made a grok filter to for logstash that created fields in kinbana. This is great but in discover, I am having to add the fields manually every time i load in. Is there a way to make kibana load in the fields a… --- ## [Search\_as\_you\_type not working, help](https://discuss.elastic.co/t/search-as-you-type-not-working-help/282111)
**Author:** [@michel.st-louis](https://discuss.elastic.co/u/michel.st-louis)\ **Replies:** 3\ **Last updated:** [August 23, 2021, 5:06pm UTC](https://discuss.elastic.co/t/search-as-you-type-not-working-help/282111 "2021-08-23T17:06:02Z")
I was trying the new feature Search\_as\_you\_type but I don't know if if it my lack of knowledge but it is not working. I installed the verion 7.14. this is my kibana queries. this query yeld nothing no hits. DELETE test … --- ## [ERROR: this cluster currently has \[x\]/\[x\] maximum normal shards open](https://discuss.elastic.co/t/error-this-cluster-currently-has-x-x-maximum-normal-shards-open/282254)
**Author:** [@Stef\_Nestor](https://discuss.elastic.co/u/Stef_Nestor)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 4:01pm UTC](https://discuss.elastic.co/t/error-this-cluster-currently-has-x-x-maximum-normal-shards-open/282254 "2021-08-23T16:01:14Z")
This example error may return from Elasticsearch to any ingestor (e.g. Logstash, Bulk, API, Beats, etc): \[{TIMESTAMP}\]\[WARN\]\[logstash.outputs.elasticsearch\]\[x\]\[y\] Could not index event to Elasticsearch. { :status=\> 400… --- ## [Custom grok filter](https://discuss.elastic.co/t/custom-grok-filter/281105)
**Author:** [@gba8912](https://discuss.elastic.co/u/gba8912)\ **Replies:** 3\ **Last updated:** [August 23, 2021, 3:59pm UTC](https://discuss.elastic.co/t/custom-grok-filter/281105 "2021-08-23T15:59:51Z")
Hello, I'm new to all this so bear with me. My company has asked me to figure out elk stack and how to make it work for their logs. I have everything set up and working but I need to be able to parse the logs in kibana a… --- ## [Multiple concatenation in ruby file filter](https://discuss.elastic.co/t/multiple-concatenation-in-ruby-file-filter/282101)
**Author:** [@LuigiDelavega](https://discuss.elastic.co/u/LuigiDelavega)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 3:13pm UTC](https://discuss.elastic.co/t/multiple-concatenation-in-ruby-file-filter/282101 "2021-08-23T15:13:29Z")
Hello, I would like to concatenate 5 fields which can exist or not and i would like to do it in my ruby file filter because we already have others working filters in it. my fields looks like this, they can have a value… --- ## [Single index or multiple index](https://discuss.elastic.co/t/single-index-or-multiple-index/282139)
**Author:** [@selin](https://discuss.elastic.co/u/selin)\ **Replies:** 3\ **Last updated:** [August 23, 2021, 2:09pm UTC](https://discuss.elastic.co/t/single-index-or-multiple-index/282139 "2021-08-23T14:09:41Z")
My environment architecture is I have 15 server. The details as below Group 1 (Standalone) server 1 (2 app) server 2 3 app) server 3 (2 app) server 4 (3 app) Group 2 (master and slave) server 5 master (2 app) serve… --- ## [Elasticsearch after upgrade on 7.7.0 starts CircuitBreakingExceptions and nodes leaves/rejoin cluster](https://discuss.elastic.co/t/elasticsearch-after-upgrade-on-7-7-0-starts-circuitbreakingexceptions-and-nodes-leaves-rejoin-cluster/282071)
**Author:** [@Jiri\_Petak](https://discuss.elastic.co/u/Jiri_Petak)\ **Replies:** 8\ **Last updated:** [August 23, 2021, 1:45pm UTC](https://discuss.elastic.co/t/elasticsearch-after-upgrade-on-7-7-0-starts-circuitbreakingexceptions-and-nodes-leaves-rejoin-cluster/282071 "2021-08-23T13:45:41Z")
Hi, we have an issue when performing an upgrade on one of our clusters. We are upgrading elasticsearch from version 6.8.1 to 7.7.0 (we have other clusters on this version). The cluster has 3 master nodes, 5 data nodes a… --- ## [How to execute dynamic queries with visualisations](https://discuss.elastic.co/t/how-to-execute-dynamic-queries-with-visualisations/281640)
**Author:** [@akashk](https://discuss.elastic.co/u/akashk)\ **Replies:** 8\ **Last updated:** [August 23, 2021, 1:13pm UTC](https://discuss.elastic.co/t/how-to-execute-dynamic-queries-with-visualisations/281640 "2021-08-23T13:13:58Z")
Hi, I am new to ELK and I am facing one issue in creating visualisations. So we have two different sources(log files) from where we are reading the logs and storing triggeredTime and pickedTime of application event in … --- ## [Cant ship big log from filebeat or logstash to elastic](https://discuss.elastic.co/t/cant-ship-big-log-from-filebeat-or-logstash-to-elastic/282152)
**Author:** [@hagaluly](https://discuss.elastic.co/u/hagaluly)\ **Replies:** 3\ **Last updated:** [August 23, 2021, 1:01pm UTC](https://discuss.elastic.co/t/cant-ship-big-log-from-filebeat-or-logstash-to-elastic/282152 "2021-08-23T13:01:15Z")
i have a 3 nodes cluster with 1 master and 2 data nodes each is set for 1TB i have increased both -Xms24g -Xmx24g to half my ram (48GB total) i than successfully upload 140mb file from Kibana to elk from the GUI after i… --- ## [Tracking multiple records by unique value from json.rest](https://discuss.elastic.co/t/tracking-multiple-records-by-unique-value-from-json-rest/282225)
**Author:** [@Olga\_Drakonen](https://discuss.elastic.co/u/Olga_Drakonen)\ **Replies:** 0\ **Last updated:** [August 23, 2021, 12:57pm UTC](https://discuss.elastic.co/t/tracking-multiple-records-by-unique-value-from-json-rest/282225 "2021-08-23T12:57:55Z")
I have a huge array of records, each with a unique value in json.rest. Each entry with its own zson.rest key value is first displayed in one record from the first service, then in the next record from the second service.… --- ## [Can't edit Widget after rename Index Pattern](https://discuss.elastic.co/t/cant-edit-widget-after-rename-index-pattern/281514)
**Author:** [@Arethusa](https://discuss.elastic.co/u/Arethusa)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 12:47pm UTC](https://discuss.elastic.co/t/cant-edit-widget-after-rename-index-pattern/281514 "2021-08-23T12:47:24Z")
Hello, I am on v 7.12.0. I observe a bug, maybe it was fix with new version but we never know. Some one have rename one Index Pattern, and after that, I can't edit my widget to update it, I have to create new widget. … --- ## [Could you delete my account?](https://discuss.elastic.co/t/could-you-delete-my-account/282193)
**Author:** [@anon89617342](https://discuss.elastic.co/u/anon89617342)\ **Replies:** 2\ **Last updated:** [August 23, 2021, 11:10am UTC](https://discuss.elastic.co/t/could-you-delete-my-account/282193 "2021-08-23T11:10:10Z")
I don't need this account anymore and I would like to delete it. --- ## [Having hard time to extract day of week in scripted field](https://discuss.elastic.co/t/having-hard-time-to-extract-day-of-week-in-scripted-field/281690)
**Author:** [@Mojahid\_Ahmad](https://discuss.elastic.co/u/Mojahid_Ahmad)\ **Replies:** 6\ **Last updated:** [August 23, 2021, 10:41am UTC](https://discuss.elastic.co/t/having-hard-time-to-extract-day-of-week-in-scripted-field/281690 "2021-08-23T10:41:00Z")
I am able to extract hour of day using the below script format. But facing the issue while extracting the day of week because of timezone. I used this script. \["","Mon","Tue","Wed","Thu","Fri","Sat","Sun"\]doc\['event\_ti… --- ## [Elasticsearch 7.13 unassigned shard problem](https://discuss.elastic.co/t/elasticsearch-7-13-unassigned-shard-problem/282204)
**Author:** [@mug3n451](https://discuss.elastic.co/u/mug3n451)\ **Replies:** 4\ **Last updated:** [August 23, 2021, 10:26am UTC](https://discuss.elastic.co/t/elasticsearch-7-13-unassigned-shard-problem/282204 "2021-08-23T10:26:07Z")
Hi, i have i weird problem on elasticsearc 7.13 deployed on kubernetes. Here my configuration: 3 master node 2 date node with heap 8gb and 100gb storage 2 shard and 1 replica index size: eventsched n° doc 3178640… --- ## [Kafka consumergroup metricset & TSVB interval](https://discuss.elastic.co/t/kafka-consumergroup-metricset-tsvb-interval/279964)
**Author:** [@Malec](https://discuss.elastic.co/u/Malec)\ **Replies:** 2\ **Last updated:** [August 23, 2021, 10:25am UTC](https://discuss.elastic.co/t/kafka-consumergroup-metricset-tsvb-interval/279964 "2021-08-23T10:25:08Z")
Hi, I'm trying to use the Kafka consumergroup metricset to report global lag per consumer group. For simplicity's sake let's say that 1 consumergroup == one topic. The problem is the lag is reported per partition so if… --- ## [ELK data/shard allocation is not happening properly](https://discuss.elastic.co/t/elk-data-shard-allocation-is-not-happening-properly/281784)
**Author:** [@karthik\_kiccha](https://discuss.elastic.co/u/karthik_kiccha)\ **Replies:** 8\ **Last updated:** [August 23, 2021, 10:09am UTC](https://discuss.elastic.co/t/elk-data-shard-allocation-is-not-happening-properly/281784 "2021-08-23T10:09:38Z")
Hello Team, We have 6 node ELK cluster and all of them are configured to act as master and data node. Out of 6 nodes two nodes are consuming more disk space which is at 93%, other nodes are at 70% to 80%. We have tried … --- ## [Elasticsearch index and clustering](https://discuss.elastic.co/t/elasticsearch-index-and-clustering/282025)
**Author:** [@selin](https://discuss.elastic.co/u/selin)\ **Replies:** 9\ **Last updated:** [August 23, 2021, 9:43am UTC](https://discuss.elastic.co/t/elasticsearch-index-and-clustering/282025 "2021-08-23T09:43:40Z")
Hi friends, Can i know is it good to have a single index per environment or 1 environment to have 5 index based on team. based on each team they have multiple logs. Besides that i have 3 Elasticsearch cluster, will the … --- ## [Logstash aggregate filter sum incorrect](https://discuss.elastic.co/t/logstash-aggregate-filter-sum-incorrect/282199)
**Author:** [@zhyp](https://discuss.elastic.co/u/zhyp)\ **Replies:** 0\ **Last updated:** [August 23, 2021, 8:40am UTC](https://discuss.elastic.co/t/logstash-aggregate-filter-sum-incorrect/282199 "2021-08-23T08:40:29Z")
Hi, :slightly\_smiling\_face: Here is my es data.I can query them correctly. {"count":1,"time":"2021-08-10T00:15:00.000+08:00"} {"count":2,"time":"2021-08-10T00:30:00.000+08:00"} I want to sum the count by day. Here … --- ## [Unstructured Tomcat Logs](https://discuss.elastic.co/t/unstructured-tomcat-logs/282190)
**Author:** [@dipinsugathan](https://discuss.elastic.co/u/dipinsugathan)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 8:28am UTC](https://discuss.elastic.co/t/unstructured-tomcat-logs/282190 "2021-08-23T08:28:18Z")
Hi All, Need help in ingesting tomcat unstructured logs to ELK. While ingesting via filebeat -\>logstash-\>elasticsearch -\> kibana everything is coming in one message field. I was trying to split it with mutate filter pl… --- ## [Logstash GeoIP filter with words](https://discuss.elastic.co/t/logstash-geoip-filter-with-words/281638)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 3\ **Last updated:** [August 23, 2021, 7:01am UTC](https://discuss.elastic.co/t/logstash-geoip-filter-with-words/281638 "2021-08-23T07:01:21Z")
hello! I have a log with countries but it does not have an IP field and I would like to make a map in kibana giving a latitude and longitude to that field. If I had an IP I would know how to do it with geoip. Can this… --- ## [Indexes are keep increasing after traffic towards elastic has stoped](https://discuss.elastic.co/t/indexes-are-keep-increasing-after-traffic-towards-elastic-has-stoped/281183)
**Author:** [@John\_Xanthopoulos](https://discuss.elastic.co/u/John_Xanthopoulos)\ **Replies:** 19\ **Last updated:** [August 23, 2021, 6:40am UTC](https://discuss.elastic.co/t/indexes-are-keep-increasing-after-traffic-towards-elastic-has-stoped/281183 "2021-08-23T06:40:31Z")
After having performed a test with indexing rate of ~30000/sec for couple of hours we noticed the following behavior. After Fluentd has stopped sending data to elasticsearch, four some time there is an ammount of documen… --- ## [I think in elasticsearch it shows the size of 10 by default but instead of 10 i want to set the size to total hits value that i am getting after running the query. I am attaching my query Please help me out](https://discuss.elastic.co/t/i-think-in-elasticsearch-it-shows-the-size-of-10-by-default-but-instead-of-10-i-want-to-set-the-size-to-total-hits-value-that-i-am-getting-after-running-the-query-i-am-attaching-my-query-please-help-me-out/282157)
**Author:** [@ashurajchandra](https://discuss.elastic.co/u/ashurajchandra)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 1:39am UTC](https://discuss.elastic.co/t/i-think-in-elasticsearch-it-shows-the-size-of-10-by-default-but-instead-of-10-i-want-to-set-the-size-to-total-hits-value-that-i-am-getting-after-running-the-query-i-am-attaching-my-query-please-help-me-out/282157 "2021-08-23T01:39:40Z")
GET /\_search { "sort": \[{ "date": { "order": "desc" } }\], "track\_total\_hits": true, "query": { "bool": { "must": \[ { … --- ## [TOO\_MANY\_REQUESTS/12/disk usage exceeded](https://discuss.elastic.co/t/too-many-requests-12-disk-usage-exceeded/280753)
**Author:** [@mfisher](https://discuss.elastic.co/u/mfisher)\ **Replies:** 3\ **Last updated:** [August 23, 2021, 1:29am UTC](https://discuss.elastic.co/t/too-many-requests-12-disk-usage-exceeded/280753 "2021-08-23T01:29:42Z")
Recently credentials are failing in the Kibana web interface. Checking the logs there is an error indicating disk usage is exceeded. {"type":"log","@timestamp":"2021-08-08T20:41:52-05:00","tags":\["error","plugins","apm… --- ## [Having 0 shard for cluster elastisearch](https://discuss.elastic.co/t/having-0-shard-for-cluster-elastisearch/282150)
**Author:** [@selin](https://discuss.elastic.co/u/selin)\ **Replies:** 3\ **Last updated:** [August 23, 2021, 1:24am UTC](https://discuss.elastic.co/t/having-0-shard-for-cluster-elastisearch/282150 "2021-08-23T01:24:25Z")
Hi friend, i have 3 container elasticsearch. I am assuming it should crete 5 shard for each container as 1 index in each container and each container have multiple shard/ When I fired shards api, i getting 0. Please advi… --- ## [How to change type of field in logstash for xml plugin](https://discuss.elastic.co/t/how-to-change-type-of-field-in-logstash-for-xml-plugin/282160)
**Author:** [@Ankit-github-26](https://discuss.elastic.co/u/Ankit-github-26)\ **Replies:** 1\ **Last updated:** [August 22, 2021, 1:00pm UTC](https://discuss.elastic.co/t/how-to-change-type-of-field-in-logstash-for-xml-plugin/282160 "2021-08-22T13:00:20Z")
I want to change some field types from text(by default) to float for aggregation purpose from xml parsed data. kindly find my logstash configuration below xml { source =\> "\[data\]\[cdr\]" target =\> "cdr" } mutate { re… --- ## [Jointure entre deux CSV](https://discuss.elastic.co/t/jointure-entre-deux-csv/282147)
**Author:** [@Hind](https://discuss.elastic.co/u/Hind)\ **Replies:** 2\ **Last updated:** [August 22, 2021, 10:31am UTC](https://discuss.elastic.co/t/jointure-entre-deux-csv/282147 "2021-08-22T10:31:38Z")
Bonsoir, j'ai une question ! J'ai deux fichiers CSV ,qui contiennent des données complémentaires, que je veux injecter dans ElasticSearch, et je voulais savoir est ce qu'il vaut mieux de les joindre dans un même CSV av… --- ## [Elasticsearch Increasing Write rejections](https://discuss.elastic.co/t/elasticsearch-increasing-write-rejections/281882)
**Author:** [@Tombal](https://discuss.elastic.co/u/Tombal)\ **Replies:** 10\ **Last updated:** [August 22, 2021, 2:18am UTC](https://discuss.elastic.co/t/elasticsearch-increasing-write-rejections/281882 "2021-08-22T02:18:51Z")
Hello, I have 20 node platinum licenced ELK cluster. (Version 7.6.1) Setup is stated as below. 16 data nodes --\> each 64GB memory // 32gb allocated as Xms-Xmx jvm . --\> 8TB disk each 3 master nodes --\> 32gb memory ea… --- ## [Questions On Logstash Conf File](https://discuss.elastic.co/t/questions-on-logstash-conf-file/282149)
**Author:** [@Jared9922](https://discuss.elastic.co/u/Jared9922)\ **Replies:** 1\ **Last updated:** [August 22, 2021, 1:05am UTC](https://discuss.elastic.co/t/questions-on-logstash-conf-file/282149 "2021-08-22T01:05:43Z")
Hello I was just wondering if somebody could help clear up some confusion I am having when it comes to logstash. So in my current .conf file I have the output set to elasticsearch. This is where my questions start to po… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=846) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=848)