# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=853 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 854 --- ## [Kibana Dashboard compare fields from filebeat and Heartbeat](https://discuss.elastic.co/t/kibana-dashboard-compare-fields-from-filebeat-and-heartbeat/281343)
**Author:** [@newbie5](https://discuss.elastic.co/u/newbie5)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 1:19am UTC](https://discuss.elastic.co/t/kibana-dashboard-compare-fields-from-filebeat-and-heartbeat/281343 "2021-08-17T01:19:42Z")
Hi, I have filed "name" in filebeat - type: log enabled: true paths: - C:\\Desktop\\ELK4\\aplikacja\\macro.log fields: log\_type: app name: BYD1 multiline.type: pattern multiline.pattern: '^\\\*' m… --- ## [Get the full date format in elasticsearch](https://discuss.elastic.co/t/get-the-full-date-format-in-elasticsearch/281310)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 1:18am UTC](https://discuss.elastic.co/t/get-the-full-date-format-in-elasticsearch/281310 "2021-08-17T01:18:09Z")
Hi all, In an old project, the date fields have been mapped and data is present. Now in Kibana, I can see human readable format of date When i Use GET API to get format of date in devtools, i get ony format of date fi… --- ## [Sorting the response JSON](https://discuss.elastic.co/t/sorting-the-response-json/281532)
**Author:** [@Anubhav\_Singh1](https://discuss.elastic.co/u/Anubhav_Singh1)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 1:07am UTC](https://discuss.elastic.co/t/sorting-the-response-json/281532 "2021-08-17T01:07:36Z")
I'm using the below synonyms in my elasticsearch index. Road Types avenue,ave,boulevard,blvd,circle,cir,court,ct,drive,dr,highway,hwy,lane,ln,loop,lp,parkway,pkwy,place,pl,road,rd,route,rte,street,st,terrace,ter,trail… --- ## [ELK: NGINX logs analyze](https://discuss.elastic.co/t/elk-nginx-logs-analyze/281545)
**Author:** [@Wilford](https://discuss.elastic.co/u/Wilford)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 1:03am UTC](https://discuss.elastic.co/t/elk-nginx-logs-analyze/281545 "2021-08-17T01:03:40Z")
Hello to everyone, i have an strange issue. I'm running 2 nginx balancing units and it export it logs via filebeat to logstash and to elasticsearch index as a final destination. In a same time im running nignx stats mo… --- ## [Design Decision on Elastic Search - Replace Searchable Entity on Primary DB](https://discuss.elastic.co/t/design-decision-on-elastic-search-replace-searchable-entity-on-primary-db/281551)
**Author:** [@CharlieUPB](https://discuss.elastic.co/u/CharlieUPB)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 1:00am UTC](https://discuss.elastic.co/t/design-decision-on-elastic-search-replace-searchable-entity-on-primary-db/281551 "2021-08-17T01:00:16Z")
Hi guys I cant seem to find an answer to this question, can you please clarify my question. I have a normal database such as mongo where I store my domain related data, customers, products, prices. Now I came with the … --- ## [Elastic Seach: master not discovered or elected yet, an election requires at least 2 nodes with ids from](https://discuss.elastic.co/t/elastic-seach-master-not-discovered-or-elected-yet-an-election-requires-at-least-2-nodes-with-ids-from/281564)
**Author:** [@michelefa1988](https://discuss.elastic.co/u/michelefa1988)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 12:57am UTC](https://discuss.elastic.co/t/elastic-seach-master-not-discovered-or-elected-yet-an-election-requires-at-least-2-nodes-with-ids-from/281564 "2021-08-17T00:57:44Z")
Hello, Elastic search was running 7.10.1 was running successfully (via helm chart, however recently I got the following error The configuration is pretty standard (3 nodes 3x masters I would like to know what the corr… --- ## [Condition Section after Grok section not working](https://discuss.elastic.co/t/condition-section-after-grok-section-not-working/281600)
**Author:** [@Athul\_Devkar](https://discuss.elastic.co/u/Athul_Devkar)\ **Replies:** 4\ **Last updated:** [August 16, 2021, 9:28pm UTC](https://discuss.elastic.co/t/condition-section-after-grok-section-not-working/281600 "2021-08-16T21:28:48Z")
Hello Everyone! I am trying to modify my pipeline to allow me to create few additional fields based on certain conditions. However, that section alone is not working and I don't see any errors in my log. I had used simi… --- ## [How does everyone feel about Amazon's prerolled ES service and how they have forked Elasticsearch?](https://discuss.elastic.co/t/how-does-everyone-feel-about-amazons-prerolled-es-service-and-how-they-have-forked-elasticsearch/281417)
**Author:** [@Jason\_Baumgartner](https://discuss.elastic.co/u/Jason_Baumgartner)\ **Replies:** 2\ **Last updated:** [August 16, 2021, 9:02pm UTC](https://discuss.elastic.co/t/how-does-everyone-feel-about-amazons-prerolled-es-service-and-how-they-have-forked-elasticsearch/281417 "2021-08-16T21:02:49Z")
First, I wanted to get other's opinions on Amazon's Elasticsearch service. While they do provide some nice features like nightly snapshots, etc. -- I'm discovering each day more annoying issues with their service. There… --- ## [Update a field if it does not contain any value](https://discuss.elastic.co/t/update-a-field-if-it-does-not-contain-any-value/281565)
**Author:** [@Derya\_Sayar](https://discuss.elastic.co/u/Derya_Sayar)\ **Replies:** 5\ **Last updated:** [August 16, 2021, 7:34pm UTC](https://discuss.elastic.co/t/update-a-field-if-it-does-not-contain-any-value/281565 "2021-08-16T19:34:02Z")
I have log files generated from some applications. Some of applications produces messages in following format. So there is "logContent" in message field. {"instant":{"epochSecond":1628692763,"nanoOfSecond":792000000},"t… --- ## [Master not discovered in the bootstrap cluster](https://discuss.elastic.co/t/master-not-discovered-in-the-bootstrap-cluster/281586)
**Author:** [@kadiveti](https://discuss.elastic.co/u/kadiveti)\ **Replies:** 2\ **Last updated:** [August 16, 2021, 7:24pm UTC](https://discuss.elastic.co/t/master-not-discovered-in-the-bootstrap-cluster/281586 "2021-08-16T19:24:40Z")
Hello All, I tried to set up a simple 3 node elastic cluster. I tried almost the same setup 10 times. Every I see a new issue will come up when setting this. Every time I create this setup from Azure and delete the set… --- ## [Failed to execute watch - Timeout waiting for task](https://discuss.elastic.co/t/failed-to-execute-watch-timeout-waiting-for-task/280256)
**Author:** [@Brandon\_Sollins](https://discuss.elastic.co/u/Brandon_Sollins)\ **Replies:** 1\ **Last updated:** [August 16, 2021, 6:22pm UTC](https://discuss.elastic.co/t/failed-to-execute-watch-timeout-waiting-for-task/280256 "2021-08-16T18:22:37Z")
I am noticing random watch timeouts on my cluster that is returning the following traceback: \[2021-07-31T05:08:11,951\]\[DEBUG\]\[o.e.x.w.e.ExecutionService\] failed to execute watch \[\\] org.elasti… --- ## [Elastic Cloud Enterprise: Run deployments on specific drives](https://discuss.elastic.co/t/elastic-cloud-enterprise-run-deployments-on-specific-drives/281579)
**Author:** [@Thomas\_Vaudry-Read](https://discuss.elastic.co/u/Thomas_Vaudry-Read)\ **Replies:** 1\ **Last updated:** [August 16, 2021, 5:33pm UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-run-deployments-on-specific-drives/281579 "2021-08-16T17:33:56Z")
I am working on setting up Elastic Cloud Enterprise in various different configurations, and my newest question is about how to specify which drive to store data in depending on the tier of the data. I have a machine wi… --- ## [Export to CSV shows blank fields](https://discuss.elastic.co/t/export-to-csv-shows-blank-fields/280357)
**Author:** [@jasieltego](https://discuss.elastic.co/u/jasieltego)\ **Replies:** 3\ **Last updated:** [August 16, 2021, 4:25pm UTC](https://discuss.elastic.co/t/export-to-csv-shows-blank-fields/280357 "2021-08-16T16:25:36Z")
Hi , I have a saved object in Kibana. When I run this object I get the results I want, it shows all the information for the columns proposed. However when I export it to CSV alot of the columns are blank? I have opened… --- ## [Поиск по нескольким полям с вхождением части строки или полной строки в разных полях](https://discuss.elastic.co/t/topic/281513)
**Author:** [@vitaliy\_sheverov](https://discuss.elastic.co/u/vitaliy_sheverov)\ **Replies:** 2\ **Last updated:** [August 16, 2021, 3:37pm UTC](https://discuss.elastic.co/t/topic/281513 "2021-08-16T15:37:41Z")
Добрый день, помогите пожалуйста составить запрос Мне нужно чтобы, поиск сначала находил хотя бы по одному слову в каждом поле, если найдет все слова в одном поле, тоже подходит. В данном случае меня интересует только Т… --- ## [Create new field "Year" from a complete date](https://discuss.elastic.co/t/create-new-field-year-from-a-complete-date/281332)
**Author:** [@Raptoresse](https://discuss.elastic.co/u/Raptoresse)\ **Replies:** 3\ **Last updated:** [August 16, 2021, 3:13pm UTC](https://discuss.elastic.co/t/create-new-field-year-from-a-complete-date/281332 "2021-08-16T15:13:29Z")
Hi everybody ! I have a probleme : I have a field "date". I want to select juste the year, and create a vizualisation "controls" type (Add dropdown menus and range sliders to your dashboard) with the new field. For thi… --- ## [Logstash ip protocol enriching](https://discuss.elastic.co/t/logstash-ip-protocol-enriching/281496)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 2\ **Last updated:** [August 16, 2021, 3:07pm UTC](https://discuss.elastic.co/t/logstash-ip-protocol-enriching/281496 "2021-08-16T15:07:42Z")
Hello community. I was busy with the task of collecting netflow using logstash. So I noticed that the netflow data after the "netflow" codec contains the "protocol" field, which is actually the protocol number. But there… --- ## [Simple Central log monitoring with ELK](https://discuss.elastic.co/t/simple-central-log-monitoring-with-elk/280488)
**Author:** [@Prabhath\_samarasingh](https://discuss.elastic.co/u/Prabhath_samarasingh)\ **Replies:** 20\ **Last updated:** [August 16, 2021, 2:32pm UTC](https://discuss.elastic.co/t/simple-central-log-monitoring-with-elk/280488 "2021-08-16T14:32:49Z")
Need to ship my servers logs (Linux system logs " /var/logs/\*" and windows server logs) to logstash to ELK and display in KIbana dash board. Please guide to perform this task. --- ## [Logstash extract additional fields from message field of Json](https://discuss.elastic.co/t/logstash-extract-additional-fields-from-message-field-of-json/281373)
**Author:** [@Derya\_Sayar](https://discuss.elastic.co/u/Derya_Sayar)\ **Replies:** 2\ **Last updated:** [August 16, 2021, 2:18pm UTC](https://discuss.elastic.co/t/logstash-extract-additional-fields-from-message-field-of-json/281373 "2021-08-16T14:18:15Z")
I have logs files with json format.Here you can find single line of log. {"instant":{"epochSecond":1628692763,"nanoOfSecond":792000000},"thread":"AWT-EventQueue-0","level":"INFO","loggerName":"com.client.logon… --- ## [Parse Logstash message field into multiple field](https://discuss.elastic.co/t/parse-logstash-message-field-into-multiple-field/281425)
**Author:** [@buulq90](https://discuss.elastic.co/u/buulq90)\ **Replies:** 8\ **Last updated:** [August 16, 2021, 2:13pm UTC](https://discuss.elastic.co/t/parse-logstash-message-field-into-multiple-field/281425 "2021-08-16T14:13:24Z")
Hello all, I'm firstly using log stash and got some issue when parsing the JSON log on the message field into multiple field for visualizing in the Kibana dashboard. Below is my message log appear in Elasticsearch me… --- ## [IPFIX processing Setup plan & queries](https://discuss.elastic.co/t/ipfix-processing-setup-plan-queries/281558)
**Author:** [@Saravana\_Maadavan](https://discuss.elastic.co/u/Saravana_Maadavan)\ **Replies:** 0\ **Last updated:** [August 16, 2021, 2:02pm UTC](https://discuss.elastic.co/t/ipfix-processing-setup-plan-queries/281558 "2021-08-16T14:02:11Z")
Hi Everyone, I have few questions reg. processing of IPFIX logs originating from "Thunder CFW | A10 network" exporter. Would not be able to change different network exporter product or any installation in source side si… --- ## [Heap Size setting in k8s](https://discuss.elastic.co/t/heap-size-setting-in-k8s/281522)
**Author:** [@purushothamkdr143](https://discuss.elastic.co/u/purushothamkdr143)\ **Replies:** 3\ **Last updated:** [August 16, 2021, 12:32pm UTC](https://discuss.elastic.co/t/heap-size-setting-in-k8s/281522 "2021-08-16T12:32:42Z")
Hi All, I am trying to setup up elasticsearch(version 6.8.14) on k8s using eck operator. As per the documentation HEAP SIZE should be 50% of RAM. so If set ( requests, limits as 16GB) then ES\_JAVA\_OPTS should be 8 i.… --- ## [Exclude Unicode symbol in Grok pattern](https://discuss.elastic.co/t/exclude-unicode-symbol-in-grok-pattern/280540)
**Author:** [@Avesalon\_Novinsky](https://discuss.elastic.co/u/Avesalon_Novinsky)\ **Replies:** 1\ **Last updated:** [August 16, 2021, 11:59am UTC](https://discuss.elastic.co/t/exclude-unicode-symbol-in-grok-pattern/280540 "2021-08-16T11:59:55Z")
Hi, Is there any option to exclude Unicode symbol from line directly in grok pattern. I'm trying to read json data line by line thought AWS Glue "getSourceWithFormat" method which use grok pattern for string parsing. l… --- ## [Logstash :Config file to parse nested json](https://discuss.elastic.co/t/logstash-config-file-to-parse-nested-json/281528)
**Author:** [@ippo](https://discuss.elastic.co/u/ippo)\ **Replies:** 1\ **Last updated:** [August 16, 2021, 11:26am UTC](https://discuss.elastic.co/t/logstash-config-file-to-parse-nested-json/281528 "2021-08-16T11:26:13Z")
hello i 'm new to elk and i seeking help for my mission. i want to export the data from the log of json file below so that i have visualizations related to the number of successful builds . im trying to remove the fields… --- ## [How to run Elasticsearch 7.10.2 as root user](https://discuss.elastic.co/t/how-to-run-elasticsearch-7-10-2-as-root-user/281354)
**Author:** [@mba](https://discuss.elastic.co/u/mba)\ **Replies:** 7\ **Last updated:** [August 16, 2021, 11:21am UTC](https://discuss.elastic.co/t/how-to-run-elasticsearch-7-10-2-as-root-user/281354 "2021-08-16T11:21:14Z")
I know we can not run elastic search as root user but still my requirement is to run Elasticsearch 7.10.2 as root user then how to run it ?? --- ## [Match on Ngram field where the words are in order without scripting](https://discuss.elastic.co/t/match-on-ngram-field-where-the-words-are-in-order-without-scripting/281518)
**Author:** [@Ron\_lusha](https://discuss.elastic.co/u/Ron_lusha)\ **Replies:** 0\ **Last updated:** [August 16, 2021, 8:37am UTC](https://discuss.elastic.co/t/match-on-ngram-field-where-the-words-are-in-order-without-scripting/281518 "2021-08-16T08:37:37Z")
Hello, I have a question regarding auto-complete using Ngram search, Im using elasticsearch 7.3, so the new "wildcard" field type is not relevant for me This is my index: PUT ngram\_test { "mappings": { "propertie… --- ## [Nested JSON flattened in Logstash Filter](https://discuss.elastic.co/t/nested-json-flattened-in-logstash-filter/281502)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 1\ **Last updated:** [August 16, 2021, 8:11am UTC](https://discuss.elastic.co/t/nested-json-flattened-in-logstash-filter/281502 "2021-08-16T08:11:47Z")
Hi, I am able to flatten at fields present in nested JSON excluding 3 fields that are present in double nested JSON. I need to flatten these fields so that I can create viz based on that such as Fields-"quantity", "rate… --- ## [Scripted fields - doc\[message.keyword\].value reading as empty - field is not empty](https://discuss.elastic.co/t/scripted-fields-doc-message-keyword-value-reading-as-empty-field-is-not-empty/280953)
**Author:** [@acastravet](https://discuss.elastic.co/u/acastravet)\ **Replies:** 15\ **Last updated:** [August 16, 2021, 7:05am UTC](https://discuss.elastic.co/t/scripted-fields-doc-message-keyword-value-reading-as-empty-field-is-not-empty/280953 "2021-08-16T07:05:48Z")
Hello everyone, I have a field that holds all the log information (multiple fields inside it). Field looks like this: logging.level="some info", @timestamp="some info", message="some info", trace\_id="some info" I am t… --- ## [How to Provide mapping to the API before injesting data to the elasticsearch using logstash conf file](https://discuss.elastic.co/t/how-to-provide-mapping-to-the-api-before-injesting-data-to-the-elasticsearch-using-logstash-conf-file/281061)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 1\ **Last updated:** [August 16, 2021, 6:58am UTC](https://discuss.elastic.co/t/how-to-provide-mapping-to-the-api-before-injesting-data-to-the-elasticsearch-using-logstash-conf-file/281061 "2021-08-16T06:58:45Z")
Hi, I am using Twilio API for ingesting data to elasticsearch. It is providing Output in the form of JSON. curl -G https://api.twilio.com/2010-04-01/Accounts/ACXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX/Usage/Records/LastMonth.… --- ## [How configuration logstash 7.6.2 email in output](https://discuss.elastic.co/t/how-configuration-logstash-7-6-2-email-in-output/281148)
**Author:** [@arisxf](https://discuss.elastic.co/u/arisxf)\ **Replies:** 5\ **Last updated:** [August 16, 2021, 6:47am UTC](https://discuss.elastic.co/t/how-configuration-logstash-7-6-2-email-in-output/281148 "2021-08-16T06:47:28Z")
how to use logstash 7.6.2 email in output ? is this email plugin available by default? --- ## [Не правильная работа terminate\_after](https://discuss.elastic.co/t/terminate-after/281344)
**Author:** [@romanenkoss](https://discuss.elastic.co/u/romanenkoss)\ **Replies:** 2\ **Last updated:** [August 16, 2021, 6:25am UTC](https://discuss.elastic.co/t/terminate-after/281344 "2021-08-16T06:25:26Z")
Добрый день. Столкнулся с проблемой в использовании terminate\_after. Мы работаем с индексом в 4 миллиарда документов, состоит из 200 шардов, судя по документации эластика terminate\_after применяется к каждому шарду, у… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=852) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=854)