# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=852 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 853 --- ## [Pipelines.yml failed to read with Pipeline to Pipeline model](https://discuss.elastic.co/t/pipelines-yml-failed-to-read-with-pipeline-to-pipeline-model/281659)
**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 2:32pm UTC](https://discuss.elastic.co/t/pipelines-yml-failed-to-read-with-pipeline-to-pipeline-model/281659 "2021-08-17T14:32:44Z")
I had previously multiple pipelines and i added Pipeline to Pipeline model in my pipelines.yml But since then i get this error: ERROR: Failed to read pipelines yaml file. Location: /usr/share/logstash/config/pipelines.… --- ## [Unable to remove "timestamp" field (not "@timestamp"!)](https://discuss.elastic.co/t/unable-to-remove-timestamp-field-not-timestamp/281654)
**Author:** [@jze1](https://discuss.elastic.co/u/jze1)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 2:25pm UTC](https://discuss.elastic.co/t/unable-to-remove-timestamp-field-not-timestamp/281654 "2021-08-17T14:25:18Z")
I am seeing the error below in logstash log. So I'm trying to parse the string further but after that mutate { remove\_field =\> \[ "timestamp" \] } does NOTHING. WTF? "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"… --- ## [Double Scripted Field gets fetched as string when filtering in a Dashboard](https://discuss.elastic.co/t/double-scripted-field-gets-fetched-as-string-when-filtering-in-a-dashboard/281357)
**Author:** [@DavidBrosIvent](https://discuss.elastic.co/u/DavidBrosIvent)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 2:24pm UTC](https://discuss.elastic.co/t/double-scripted-field-gets-fetched-as-string-when-filtering-in-a-dashboard/281357 "2021-08-17T14:24:13Z")
Hey guys, I have a scripted field which returns a percentage value based on 2 keys in my documents. The scripted field is set to return 0 when the keys return a NaN value due to one of them being missing. The script an… --- ## [How can I configure logstash in this way?](https://discuss.elastic.co/t/how-can-i-configure-logstash-in-this-way/281561)
**Author:** [@xemyleex](https://discuss.elastic.co/u/xemyleex)\ **Replies:** 5\ **Last updated:** [August 17, 2021, 1:53pm UTC](https://discuss.elastic.co/t/how-can-i-configure-logstash-in-this-way/281561 "2021-08-17T13:53:31Z")
I need a way to configure a logstash instance to work as load balancer for other 5 logstash instances. How can I do that? and what are the advantages and the disavantages to use multiple instances instead of only one? … --- ## [Need to get any help in parsing a complicated logs](https://discuss.elastic.co/t/need-to-get-any-help-in-parsing-a-complicated-logs/281671)
**Author:** [@MT2021](https://discuss.elastic.co/u/MT2021)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 1:49pm UTC](https://discuss.elastic.co/t/need-to-get-any-help-in-parsing-a-complicated-logs/281671 "2021-08-17T13:49:27Z")
Hi team, I am very new in Grok. I am struggling at this point. I cannot make a parser for below log file. The issue comes in \[17/Aug/2021:16:46:33 +0700\]. I cannot pass it. 192.168.40.100 - - \[17/Aug/2021:16:46:33 +0… --- ## [Sort not works on string field](https://discuss.elastic.co/t/sort-not-works-on-string-field/281685)
**Author:** [@rahmatzadeh\_mofid](https://discuss.elastic.co/u/rahmatzadeh_mofid)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 1:26pm UTC](https://discuss.elastic.co/t/sort-not-works-on-string-field/281685 "2021-08-17T13:26:45Z")
Sort() function not working on string fields of the document. this is my query: (I use the latest version of Nest client in c# dotnet 5) var res = await elasticClient.SearchAsync\(s =\> s.Index("customers"… --- ## [Need help to figure out what functionality is free](https://discuss.elastic.co/t/need-help-to-figure-out-what-functionality-is-free/281683)
**Author:** [@Maria\_Mikhalska](https://discuss.elastic.co/u/Maria_Mikhalska)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 1:01pm UTC](https://discuss.elastic.co/t/need-help-to-figure-out-what-functionality-is-free/281683 "2021-08-17T13:01:19Z")
Hi! I'm confused a lot that there are oss version &. non-oss version of elasticsearch (v. 7.10). I understand that one is open source version. But what does it change for me? For example, can it be situation that I use f… --- ## [High cpu usage (90-100%) on elastic search servers](https://discuss.elastic.co/t/high-cpu-usage-90-100-on-elastic-search-servers/12268)
**Author:** [@Han\_2](https://discuss.elastic.co/u/Han_2)\ **Replies:** 21\ **Last updated:** [August 17, 2021, 12:36pm UTC](https://discuss.elastic.co/t/high-cpu-usage-90-100-on-elastic-search-servers/12268 "2021-08-17T12:36:25Z")
we are going live with elasticsearch and as soon as we put production load cpu spikes to 90-100%.. wondering whats causing the issue. here is cluster info: es version: 0.90.0 5 nodes each with following config: … --- ## [When i am running this query without filter then it is running fine but when i am putting the filter context with time range of 10 minute i am not getting any value in hits. I have to filter and get the events of last 10 minutes](https://discuss.elastic.co/t/when-i-am-running-this-query-without-filter-then-it-is-running-fine-but-when-i-am-putting-the-filter-context-with-time-range-of-10-minute-i-am-not-getting-any-value-in-hits-i-have-to-filter-and-get-the-events-of-last-10-minutes/281679)
**Author:** [@ashurajchandra](https://discuss.elastic.co/u/ashurajchandra)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 12:08pm UTC](https://discuss.elastic.co/t/when-i-am-running-this-query-without-filter-then-it-is-running-fine-but-when-i-am-putting-the-filter-context-with-time-range-of-10-minute-i-am-not-getting-any-value-in-hits-i-have-to-filter-and-get-the-events-of-last-10-minutes/281679 "2021-08-17T12:08:03Z")
{ "sort": \[{ "date": { "order": "desc" } }\], "from": 0, "size": 3, "track\_total\_hits": true, "query": { "bool": { "must": \[ … --- ## [Creating index name as per log file name](https://discuss.elastic.co/t/creating-index-name-as-per-log-file-name/281677)
**Author:** [@mangesh\_shinde](https://discuss.elastic.co/u/mangesh_shinde)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 11:52am UTC](https://discuss.elastic.co/t/creating-index-name-as-per-log-file-name/281677 "2021-08-17T11:52:04Z")
Hi, I have use beat to get log files and location specified .log files are there. I am sending this log through logstash to elastic search. in conf file what to do to have index name as file name --- ## [CITRIX NETSCALER](https://discuss.elastic.co/t/citrix-netscaler/281663)
**Author:** [@Hoffmann\_Patrick](https://discuss.elastic.co/u/Hoffmann_Patrick)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 10:14am UTC](https://discuss.elastic.co/t/citrix-netscaler/281663 "2021-08-17T10:14:08Z")
Bonjour, J'ai un soucis pour parser les logs (file depuis un syslog server) d'un netscaler Citrix (Citrix VDA et loadbalancer https/smtp via logstash et grok, personne n'aurait une petite idée ou piste. J'ai … --- ## [Attempted to resurrect connection to dead ES instance, but got an error](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance-but-got-an-error/281657)
**Author:** [@naaviin](https://discuss.elastic.co/u/naaviin)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 9:45am UTC](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance-but-got-an-error/281657 "2021-08-17T09:45:30Z")
Hi friends, i configured accordingly. However i am getting error logstash.yml http.host: '0.0.0.0' xpack.monitoring.elasticsearch.hosts: \["https://es1:9200","https://es2:9200","https://es3:9200"\] xpack.monitoring.elast… --- ## [Update given indices by index template](https://discuss.elastic.co/t/update-given-indices-by-index-template/281645)
**Author:** [@Rammi22](https://discuss.elastic.co/u/Rammi22)\ **Replies:** 3\ **Last updated:** [August 17, 2021, 8:57am UTC](https://discuss.elastic.co/t/update-given-indices-by-index-template/281645 "2021-08-17T08:57:05Z")
Hi, i've created a index\_template. There exist a lot of indices with more than 40 million documents. Is it possible update existing index by the template instaed to reindex all? The \_update\_by\_query doesn't do the jo… --- ## [Nest always maps values in Dictionary to string](https://discuss.elastic.co/t/nest-always-maps-values-in-dictionary-to-string/281652)
**Author:** [@AaronAlluyn](https://discuss.elastic.co/u/AaronAlluyn)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 8:56am UTC](https://discuss.elastic.co/t/nest-always-maps-values-in-dictionary-to-string/281652 "2021-08-17T08:56:16Z")
I've been trying to figure out how the dynamic mapping and templates work but not having much luck. I have a simple app that loads in data file and maps it to a Dictionary\ the values are all technically… --- ## [Endpoint Security DEGRADED, Malware failed to enable due to potential system deadlock](https://discuss.elastic.co/t/endpoint-security-degraded-malware-failed-to-enable-due-to-potential-system-deadlock/281337)
**Author:** [@c1jt](https://discuss.elastic.co/u/c1jt)\ **Replies:** 7\ **Last updated:** [August 17, 2021, 8:35am UTC](https://discuss.elastic.co/t/endpoint-security-degraded-malware-failed-to-enable-due-to-potential-system-deadlock/281337 "2021-08-17T08:35:50Z")
Hi I have a node with endpoint-security policy applied, but is set to "DEGRADED" and "Unhealthy" after policy is applied/updated. Apparantly due to "potential system deadlock" Security Endpoints says: \> Malware \>\> Con… --- ## [Filebeat not connecting to elasticsearch cluster running with ECK](https://discuss.elastic.co/t/filebeat-not-connecting-to-elasticsearch-cluster-running-with-eck/278183)
**Author:** [@aksh\_18](https://discuss.elastic.co/u/aksh_18)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 8:22am UTC](https://discuss.elastic.co/t/filebeat-not-connecting-to-elasticsearch-cluster-running-with-eck/278183 "2021-08-17T08:22:13Z")
Hi All, I have deployed ES cluster and kibana with the help of ECK. I am using filebeat-kubernetes.yaml to deploy filebeat. I deployed metricbeat with metricbeat-kubernetes.yaml and its running fine. But even after appl… --- ## [Unassigned shards Inquiry](https://discuss.elastic.co/t/unassigned-shards-inquiry/281477)
**Author:** [@nadler](https://discuss.elastic.co/u/nadler)\ **Replies:** 6\ **Last updated:** [August 17, 2021, 8:16am UTC](https://discuss.elastic.co/t/unassigned-shards-inquiry/281477 "2021-08-17T08:16:46Z")
Hi, One of our teams in the company has complained that every week or so they get an alert for unassigned shards on their cluster. They asked me to look for the cause of the issue. My question is: Is there a way to se… --- ## [NetworkError when attempting to fetch resource](https://discuss.elastic.co/t/networkerror-when-attempting-to-fetch-resource/277150)
**Author:** [@iliya](https://discuss.elastic.co/u/iliya)\ **Replies:** 8\ **Last updated:** [August 17, 2021, 7:47am UTC](https://discuss.elastic.co/t/networkerror-when-attempting-to-fetch-resource/277150 "2021-08-17T07:47:26Z")
Hi Kibana version : 7.10.2 Elasticsearch version : 7.10.2 Browser version :Firefox 89.0.2 \*\*Original install method: from manjaro repository When I put in "http://localhost:5601/app/kibana/" in firefox, occur below … --- ## [How to analyze JVM heap memory ？](https://discuss.elastic.co/t/how-to-analyze-jvm-heap-memory/281631)
**Author:** [@casterQ](https://discuss.elastic.co/u/casterQ)\ **Replies:** 4\ **Last updated:** [August 17, 2021, 7:24am UTC](https://discuss.elastic.co/t/how-to-analyze-jvm-heap-memory/281631 "2021-08-17T07:24:29Z")
I want to know where memory used in es, as shown in the following figure：21.3gb memory used now in this node.i know some of them, such as: indices.queries.cache.size indices.fielddata.cache.size index.requests.cache.si… --- ## [How to extract a substring](https://discuss.elastic.co/t/how-to-extract-a-substring/281578)
**Author:** [@dvrla](https://discuss.elastic.co/u/dvrla)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 7:10am UTC](https://discuss.elastic.co/t/how-to-extract-a-substring/281578 "2021-08-17T07:10:56Z")
Hi, I would like to extract the value of a cookie from an HTTP request but up until now I can´t make it work. I´m trying to get from a request field like this GET /trading/css/main.css?version=4.4.0 HTTP/1.1, Host: ex… --- ## [Kibana canvas filter](https://discuss.elastic.co/t/kibana-canvas-filter/277043)
**Author:** [@xquest](https://discuss.elastic.co/u/xquest)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 7:01am UTC](https://discuss.elastic.co/t/kibana-canvas-filter/277043 "2021-08-17T07:01:35Z")
What is alternative for "level, rownum" in Kibana sql?? I need to build my filter like: select (case LEVEL when 1 then 'xyz' when 2 then 'xzt' ... end) as D, select (case LEVEL when 1 then '1' when 2 then '2'… --- ## [Kibana essql - select from select](https://discuss.elastic.co/t/kibana-essql-select-from-select/277044)
**Author:** [@xquest](https://discuss.elastic.co/u/xquest)\ **Replies:** 3\ **Last updated:** [August 17, 2021, 7:00am UTC](https://discuss.elastic.co/t/kibana-essql-select-from-select/277044 "2021-08-17T07:00:47Z")
I know that it is limitation in regular SQL in Kibana, but ESSQL is more like script than single query, so: Is it possible in ESSQL to use select from select?. For example, saving result from first select as table int… --- ## [Kibana fails to start](https://discuss.elastic.co/t/kibana-fails-to-start/281562)
**Author:** [@Avnish\_Singh](https://discuss.elastic.co/u/Avnish_Singh)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 5:32am UTC](https://discuss.elastic.co/t/kibana-fails-to-start/281562 "2021-08-17T05:32:46Z")
Failed to start kibana on centos 8 ElasticSearch version: 7.14 Kibana Version: 7.14 the log file looks like: \[root@localhost kibana\]# tail -10f kibana.log {"type":"log","@timestamp":"2021-08-16T19:51:10+05:30","tags"… --- ## [How to set log's remain time in eck?](https://discuss.elastic.co/t/how-to-set-logs-remain-time-in-eck/281623)
**Author:** [@111501](https://discuss.elastic.co/u/111501)\ **Replies:** 5\ **Last updated:** [August 17, 2021, 3:36am UTC](https://discuss.elastic.co/t/how-to-set-logs-remain-time-in-eck/281623 "2021-08-17T03:36:19Z")
I can't find this parameter in eck official document. --- ## [How can I log 400 Bad Request when creating documents](https://discuss.elastic.co/t/how-can-i-log-400-bad-request-when-creating-documents/281238)
**Author:** [@kiancross](https://discuss.elastic.co/u/kiancross)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 2:20am UTC](https://discuss.elastic.co/t/how-can-i-log-400-bad-request-when-creating-documents/281238 "2021-08-17T02:20:02Z")
When creating documents, I want 400 Bad Requests to be added to the log so I can see clients that are getting errors. Is this possible? --- ## [Unable to revive connection](https://discuss.elastic.co/t/unable-to-revive-connection/281245)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 1:31am UTC](https://discuss.elastic.co/t/unable-to-revive-connection/281245 "2021-08-17T01:31:01Z")
I'm working on a new proof-of-concept deployment with a self-managed, single-node cluster. After encrypting traffic between Kibana and Elasticsearch (using this documentation), I'm now unable to access Kibana. When att… --- ## [All shards being reassigned from one of our Warm nodes](https://discuss.elastic.co/t/all-shards-being-reassigned-from-one-of-our-warm-nodes/281203)
**Author:** [@TheEvilDonut](https://discuss.elastic.co/u/TheEvilDonut)\ **Replies:** 3\ **Last updated:** [August 17, 2021, 1:29am UTC](https://discuss.elastic.co/t/all-shards-being-reassigned-from-one-of-our-warm-nodes/281203 "2021-08-17T01:29:59Z")
Good day all. We have noticed a few days ago that all shards from one of our warm data nodes are being rebalanced and reassigned to the other warm nodes. We are currently at a loss at finding the reason. The node itsel… --- ## [Unable to take snapshot - Version 5.6.12](https://discuss.elastic.co/t/unable-to-take-snapshot-version-5-6-12/281262)
**Author:** [@sridharparepalli](https://discuss.elastic.co/u/sridharparepalli)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 1:24am UTC](https://discuss.elastic.co/t/unable-to-take-snapshot-version-5-6-12/281262 "2021-08-17T01:24:24Z")
Hello, I was able to register the snapshot successfully. However, when I try to take a backup I'm getting this error message. "No matches found..." Any help is greatly appreciated. Register Snapshot (works fine): sudo … --- ## [Aggregation with different timezones](https://discuss.elastic.co/t/aggregation-with-different-timezones/281305)
**Author:** [@scorona85](https://discuss.elastic.co/u/scorona85)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 1:22am UTC](https://discuss.elastic.co/t/aggregation-with-different-timezones/281305 "2021-08-17T01:22:03Z")
How can I create an aggregation of datas aquired from different part of Timezones (example New York -6.00 and Rome +2.00). In the document I have a field 'timestamp' defined as "data". I have to create a "date\_histogram"… --- ## [Unrecognized VM option 'UseConcMarkSweepGC' while trying to install ES 7.13.0](https://discuss.elastic.co/t/unrecognized-vm-option-useconcmarksweepgc-while-trying-to-install-es-7-13-0/281307)
**Author:** [@babai7](https://discuss.elastic.co/u/babai7)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 1:20am UTC](https://discuss.elastic.co/t/unrecognized-vm-option-useconcmarksweepgc-while-trying-to-install-es-7-13-0/281307 "2021-08-17T01:20:55Z")
Aug 13 09:16:10 \*\*\*\*\*\*\*\*\* elasticsearch\[1120000\]: error: Aug 13 09:16:10 \*\*\*\*\*\*\*\*\* elasticsearch\[1120000\]: Unrecognized VM option 'UseConcMarkSweepGC' Aug 13 09:16:10 \*\*\*\*\*\*\*\*\* elasticsearch\[1120000\]: Error: Could not … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=851) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=853)