# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=860 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 861 --- ## [Kibana 7.12.0 add Enrich pipeline](https://discuss.elastic.co/t/kibana-7-12-0-add-enrich-pipeline/280796)
**Author:** [@zhyp](https://discuss.elastic.co/u/zhyp)\ **Replies:** 6\ **Last updated:** [August 10, 2021, 11:32am UTC](https://discuss.elastic.co/t/kibana-7-12-0-add-enrich-pipeline/280796 "2021-08-10T11:32:00Z")
Hi, I want to calculate the value of a field in index A. Its data comes from two other index fields, index B and index C. Calculation formula: index A.count = index B.count - index C.count. Condition: index A… --- ## [Cluster cannot find nodes](https://discuss.elastic.co/t/cluster-cannot-find-nodes/280507)
**Author:** [@smam](https://discuss.elastic.co/u/smam)\ **Replies:** 2\ **Last updated:** [August 10, 2021, 9:56am UTC](https://discuss.elastic.co/t/cluster-cannot-find-nodes/280507 "2021-08-10T09:56:58Z")
Hello! I read a lot of Internet Guides on how to set-up an elasticsearch cluster. Yet I was not successful. I will paste one elasticsearch.yml file, so you can maybe tell me what is wrong with it. # ==================… --- ## [Extended bounds on auto-interval date histogram](https://discuss.elastic.co/t/extended-bounds-on-auto-interval-date-histogram/280904)
**Author:** [@rooch](https://discuss.elastic.co/u/rooch)\ **Replies:** 0\ **Last updated:** [August 10, 2021, 9:41am UTC](https://discuss.elastic.co/t/extended-bounds-on-auto-interval-date-histogram/280904 "2021-08-10T09:41:43Z")
I need to be able to run a query with a set of filters and an auto-interval date histogram aggregation to retrieve a set of bins. I then need to be able to rerun that query but with additional filters, and receive exact… --- ## [Logstash-codec-nmap undefined Method'\[\]'](https://discuss.elastic.co/t/logstash-codec-nmap-undefined-method/280517)
**Author:** [@111401](https://discuss.elastic.co/u/111401)\ **Replies:** 1\ **Last updated:** [August 10, 2021, 9:33am UTC](https://discuss.elastic.co/t/logstash-codec-nmap-undefined-method/280517 "2021-08-10T09:33:20Z")
Hi, I saved my nmap scan output as a xml file as well use a file input and logstash-codec-nmap to decode, also i use the filter and direct output into elasticsearch just like the following configuration logstash-codec-… --- ## [Elasticsearch "READ ONLY" Indices](https://discuss.elastic.co/t/elasticsearch-read-only-indices/280837)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 7\ **Last updated:** [August 10, 2021, 7:36am UTC](https://discuss.elastic.co/t/elasticsearch-read-only-indices/280837 "2021-08-10T07:36:06Z")
Hello Team: I am using Elasticsearch version 7.8.0.. I am using Index Settings : index.blocks.read\_only\_allow\_delete: true for my indices ... If i run a CURL command to update my index settings curl -X PUT "localh… --- ## [Plugin "metricsEntities" is disabled](https://discuss.elastic.co/t/plugin-metricsentities-is-disabled/280728)
**Author:** [@Naim\_Rihan](https://discuss.elastic.co/u/Naim_Rihan)\ **Replies:** 6\ **Last updated:** [August 10, 2021, 7:27am UTC](https://discuss.elastic.co/t/plugin-metricsentities-is-disabled/280728 "2021-08-10T07:27:09Z")
Hi, I install Kibana 7.14 and command with "my\_path".\\bin\\kibana.bat but I get the following error: Plugin "metricsEntities" is disabled How can I fix it? Thanks --- ## [How to setup multiple Logstash conf reading the same input](https://discuss.elastic.co/t/how-to-setup-multiple-logstash-conf-reading-the-same-input/280878)
**Author:** [@GitSpree23](https://discuss.elastic.co/u/GitSpree23)\ **Replies:** 3\ **Last updated:** [August 10, 2021, 6:50am UTC](https://discuss.elastic.co/t/how-to-setup-multiple-logstash-conf-reading-the-same-input/280878 "2021-08-10T06:50:34Z")
I want to push 2 different transformations of the same data to 2 different outputs. conf-v1: source/.txt -\> filter A -\> output 1 conf-v2: source/.txt -\> filter B -\> output 2 If I use 2 different pipelines, they will s… --- ## [Regex with "interval" flag enabled to filter private-ip-addresses](https://discuss.elastic.co/t/regex-with-interval-flag-enabled-to-filter-private-ip-addresses/280826)
**Author:** [@jnair](https://discuss.elastic.co/u/jnair)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 3:37pm UTC](https://discuss.elastic.co/t/regex-with-interval-flag-enabled-to-filter-private-ip-addresses/280826 "2021-08-09T15:37:21Z")
In the kibana visualization query interface, in the "Add filter -\> Edit as Query DSL" editor, I am using the below "REGEX" filter queries with the "INTERVAL" flag set, to filter the Private-IP addresses. I did check the … --- ## [Memory management for elasticsearch](https://discuss.elastic.co/t/memory-management-for-elasticsearch/280702)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 4\ **Last updated:** [August 10, 2021, 6:32am UTC](https://discuss.elastic.co/t/memory-management-for-elasticsearch/280702 "2021-08-10T06:32:50Z")
Hi Team, I am trying to calculate good balance of total memory in three node es cluster. If I have three node e.s cluster each with 32G memory, 8 vcpu. Which combination would be more suitable for balancing memory betw… --- ## [Group by, having sql ..How to Convert](https://discuss.elastic.co/t/group-by-having-sql-how-to-convert/280029)
**Author:** [@HYOJIN\_LEE](https://discuss.elastic.co/u/HYOJIN_LEE)\ **Replies:** 2\ **Last updated:** [August 10, 2021, 5:31am UTC](https://discuss.elastic.co/t/group-by-having-sql-how-to-convert/280029 "2021-08-10T05:31:26Z")
hello. I want to achieve some functionality which is available in SQL data stores. I have tried a lot but having a hard time achieving that functionality with elasticsearch. SQL SELECT CD\_HASH, COUNT(\*) FROM GRW\_MAIL… --- ## [Elasticsearch update by query using C#](https://discuss.elastic.co/t/elasticsearch-update-by-query-using-c/280874)
**Author:** [@HYOJIN\_LEE](https://discuss.elastic.co/u/HYOJIN_LEE)\ **Replies:** 0\ **Last updated:** [August 10, 2021, 5:26am UTC](https://discuss.elastic.co/t/elasticsearch-update-by-query-using-c/280874 "2021-08-10T05:26:17Z")
hi, I have a problem. I want to update only one data in sub\_info. example.. yn\_complete to "N" in cd\_emp = "2021019" But, Currently I get all the sub\_info sets, change only the part you want, and update the whole… --- ## [Dynamic index mappings and autogenerated searches](https://discuss.elastic.co/t/dynamic-index-mappings-and-autogenerated-searches/280767)
**Author:** [@MattG1](https://discuss.elastic.co/u/MattG1)\ **Replies:** 1\ **Last updated:** [August 10, 2021, 3:45am UTC](https://discuss.elastic.co/t/dynamic-index-mappings-and-autogenerated-searches/280767 "2021-08-10T03:45:15Z")
Hey, I hope this is the correct category (please point me in the correct direction if it is not). I want to give my users the ability to add custom data into an ES index and then search based on that custom data. I wil… --- ## [Logstash grok](https://discuss.elastic.co/t/logstash-grok/280779)
**Author:** [@KaPBaJIOJI](https://discuss.elastic.co/u/KaPBaJIOJI)\ **Replies:** 4\ **Last updated:** [August 10, 2021, 3:28am UTC](https://discuss.elastic.co/t/logstash-grok/280779 "2021-08-10T03:28:49Z")
Good afternoon to everyone, my question is quite simple, but I'm still quite new to the elk stack. it is necessary to digest the expression through the grok filter Mon Aug 9 15:18:25 +07 2021 mail 0 the date passes no… --- ## [Pulling more than 2000 records from ServiceNow api using http\_poller](https://discuss.elastic.co/t/pulling-more-than-2000-records-from-servicenow-api-using-http-poller/280840)
**Author:** [@Purushottam22](https://discuss.elastic.co/u/Purushottam22)\ **Replies:** 2\ **Last updated:** [August 10, 2021, 3:08am UTC](https://discuss.elastic.co/t/pulling-more-than-2000-records-from-servicenow-api-using-http-poller/280840 "2021-08-10T03:08:46Z")
I have created the pipeline using http\_poller to pull the serviceNow CI records. To pull more than 2000 records, i am hitting the ServiceNow api multiple time with setting up start and count values using http\_poller in… --- ## [Is Logstash JDBC tracking\_column meant to work with BIGINT?](https://discuss.elastic.co/t/is-logstash-jdbc-tracking-column-meant-to-work-with-bigint/280856)
**Author:** [@catmanjan](https://discuss.elastic.co/u/catmanjan)\ **Replies:** 1\ **Last updated:** [August 10, 2021, 1:50am UTC](https://discuss.elastic.co/t/is-logstash-jdbc-tracking-column-meant-to-work-with-bigint/280856 "2021-08-10T01:50:14Z")
I have a Logstash JDBC configuration with tracking\_column set to a BIGINT of the format YYYYMMDDhhmmsss This is obviously a very big number and the value set in last\_run\_metadata\_path is always set to zero. If I use a … --- ## [Logstash Http Poller Method Head](https://discuss.elastic.co/t/logstash-http-poller-method-head/280855)
**Author:** [@gutierrezfj](https://discuss.elastic.co/u/gutierrezfj)\ **Replies:** 1\ **Last updated:** [August 10, 2021, 1:18am UTC](https://discuss.elastic.co/t/logstash-http-poller-method-head/280855 "2021-08-10T01:18:59Z")
I'm trying to retrieve data from an CUSTOM API which only allows HEAD requests, consequently the result is an empty body. where could the header response data be? is it possible to capture the data from a response head… --- ## [Logstash secuirty](https://discuss.elastic.co/t/logstash-secuirty/280854)
**Author:** [@Rickenson\_Robert](https://discuss.elastic.co/u/Rickenson_Robert)\ **Replies:** 1\ **Last updated:** [August 9, 2021, 11:42pm UTC](https://discuss.elastic.co/t/logstash-secuirty/280854 "2021-08-09T23:42:17Z")
After enabling xpack in the elasticsearch yml and setting passwords for elasticsearch I get the following error when trying to index into my elasticsearch cluster using logstash: BadResponseCodeError, :message=\>"Got res… --- ## [Load balancer for elasticsearch cluster](https://discuss.elastic.co/t/load-balancer-for-elasticsearch-cluster/280589)
**Author:** [@markrity](https://discuss.elastic.co/u/markrity)\ **Replies:** 3\ **Last updated:** [August 9, 2021, 10:11pm UTC](https://discuss.elastic.co/t/load-balancer-for-elasticsearch-cluster/280589 "2021-08-09T22:11:02Z")
Elasticsearch version - 5.1.2 16GB of max heap configured Installed and used enterprise modules, if any - No JVM version and operating system version - openjdk version "1.8.0\_292" , CentOS Other installed Elasticsearch … --- ## [Upgrade Elastic 7.9 from helm 2 to helm 3 in 1.16](https://discuss.elastic.co/t/upgrade-elastic-7-9-from-helm-2-to-helm-3-in-1-16/280851)
**Author:** [@maheshe](https://discuss.elastic.co/u/maheshe)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 9:06pm UTC](https://discuss.elastic.co/t/upgrade-elastic-7-9-from-helm-2-to-helm-3-in-1-16/280851 "2021-08-09T21:06:18Z")
Is there a recommended way to migrate from helm2 to helm3 for Elastic helm charts. Since helm2 and helm3 are quite different how to retain the Elasticsearch/Kibana indexes etc.. when I upgrade to an entirely new chart --- ## [Custom analyzer doesn't work in mapping but is fine through index/\_analyze endpoint, ES v6.8.10](https://discuss.elastic.co/t/custom-analyzer-doesnt-work-in-mapping-but-is-fine-through-index-analyze-endpoint-es-v6-8-10/280665)
**Author:** [@tehowe](https://discuss.elastic.co/u/tehowe)\ **Replies:** 1\ **Last updated:** [August 9, 2021, 8:49pm UTC](https://discuss.elastic.co/t/custom-analyzer-doesnt-work-in-mapping-but-is-fine-through-index-analyze-endpoint-es-v6-8-10/280665 "2021-08-09T20:49:26Z")
Why, if I've written an analyzer for Elasticsearch which works when I use the analysis API endpoint, does it not get picked up and used when I set the mapping for a field to that analyzer? This works: GET cobalt\_strike… --- ## [Mapping elastic rule to o365 logs](https://discuss.elastic.co/t/mapping-elastic-rule-to-o365-logs/280849)
**Author:** [@Jorge\_Dieguez\_Perez](https://discuss.elastic.co/u/Jorge_Dieguez_Perez)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 8:13pm UTC](https://discuss.elastic.co/t/mapping-elastic-rule-to-o365-logs/280849 "2021-08-09T20:13:49Z")
Hi guys, can someone tell me what is the field in o365 logs related to event.category? --- ## [Logstash - grokfilter is successful using grokdebug, but fails in live](https://discuss.elastic.co/t/logstash-grokfilter-is-successful-using-grokdebug-but-fails-in-live/280829)
**Author:** [@One\_Punch](https://discuss.elastic.co/u/One_Punch)\ **Replies:** 13\ **Last updated:** [August 9, 2021, 7:50pm UTC](https://discuss.elastic.co/t/logstash-grokfilter-is-successful-using-grokdebug-but-fails-in-live/280829 "2021-08-09T19:50:05Z")
Hello, im integratin filebeats and logstash, sample grok pattern works in grokdebug but throwing grokfailure in logstash Message: \[2m2021-08-09 15:50:07.850 \[0;39m \[32m INFO \[0;39m \[35m1 \[0;39m \[2m--- \[0;39m \[2m\[ni… --- ## [ECK workspace search?](https://discuss.elastic.co/t/eck-workspace-search/261159)
**Author:** [@sc75651](https://discuss.elastic.co/u/sc75651)\ **Replies:** 3\ **Last updated:** [August 9, 2021, 6:06pm UTC](https://discuss.elastic.co/t/eck-workspace-search/261159 "2021-08-09T18:06:23Z")
Can we install the free version of workplace search using ECK? --- ## [Elasticsearch help understanding Update by query version conflicts](https://discuss.elastic.co/t/elasticsearch-help-understanding-update-by-query-version-conflicts/280838)
**Author:** [@mgargi01](https://discuss.elastic.co/u/mgargi01)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 4:25pm UTC](https://discuss.elastic.co/t/elasticsearch-help-understanding-update-by-query-version-conflicts/280838 "2021-08-09T16:25:13Z")
Hi - ELastic 7.6.1: I am adding some new field mappings to my index. the index is set to "dynamic" : "strict", so after the mappings are added, I run: POST index.test/\_update\_by\_query?refresh&conflicts=proceed to u… --- ## [Logstash pipeline error at line 1 column 1](https://discuss.elastic.co/t/logstash-pipeline-error-at-line-1-column-1/280746)
**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\ **Replies:** 4\ **Last updated:** [August 9, 2021, 4:05pm UTC](https://discuss.elastic.co/t/logstash-pipeline-error-at-line-1-column-1/280746 "2021-08-09T16:05:57Z")
I get this error: \[2021-08-08T20:15:12,553\]\[INFO \]\[logstash.agent \] Successfully started Logstash API endpoint {:port=\>9600} \[2021-08-08T20:15:13,441\]\[ERROR\]\[logstash.agent \] Failed to execute action… --- ## [How does elasticsearch return buckets when aggs by sum is used?](https://discuss.elastic.co/t/how-does-elasticsearch-return-buckets-when-aggs-by-sum-is-used/280740)
**Author:** [@chrisan](https://discuss.elastic.co/u/chrisan)\ **Replies:** 2\ **Last updated:** [August 9, 2021, 4:00pm UTC](https://discuss.elastic.co/t/how-does-elasticsearch-return-buckets-when-aggs-by-sum-is-used/280740 "2021-08-09T16:00:23Z")
By default, the terms aggregation will return the buckets for the top ten terms ordered by the doc\_count . One can change this default behaviour by setting the size parameter. If I am doing a search like below, how … --- ## [ECK Fail to update status field of elasticsearch cluster on EKS 1.19](https://discuss.elastic.co/t/eck-fail-to-update-status-field-of-elasticsearch-cluster-on-eks-1-19/279246)
**Author:** [@Francesco\_Ciocchetti](https://discuss.elastic.co/u/Francesco_Ciocchetti)\ **Replies:** 3\ **Last updated:** [August 9, 2021, 3:51pm UTC](https://discuss.elastic.co/t/eck-fail-to-update-status-field-of-elasticsearch-cluster-on-eks-1-19/279246 "2021-08-09T15:51:40Z")
Hi, i am trying to get a cluster running on EKS 1.19 to sucessfully create an elasticsearchcluster using the ECK operator 1.6 the cluster gets created just fine when i create the elasticsearch resource and i can see the… --- ## [From single-node cluster to multi-nodes cluster](https://discuss.elastic.co/t/from-single-node-cluster-to-multi-nodes-cluster/280777)
**Author:** [@Rosanna\_Staiano](https://discuss.elastic.co/u/Rosanna_Staiano)\ **Replies:** 2\ **Last updated:** [August 9, 2021, 3:18pm UTC](https://discuss.elastic.co/t/from-single-node-cluster-to-multi-nodes-cluster/280777 "2021-08-09T15:18:53Z")
Hello! I have a single-node cluster with the "discovery.type: single node" setup, and I want to turn it into a multi-node cluster. Could you give me some advice to make this conversion in the best way? I'm using Elast… --- ## [Link in Markdown panel to dashboard with specific time and refresh interval?](https://discuss.elastic.co/t/link-in-markdown-panel-to-dashboard-with-specific-time-and-refresh-interval/274985)
**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\ **Replies:** 5\ **Last updated:** [August 9, 2021, 2:55pm UTC](https://discuss.elastic.co/t/link-in-markdown-panel-to-dashboard-with-specific-time-and-refresh-interval/274985 "2021-08-09T14:55:05Z")
I'm using TSVB Markdown panels to present links to dashboards, like this: \[Dashboard title\](#/dashboard/88da11e0-9c58-11eb-b38d-7b8e5ab9c930) Such links are independent of the current space, which is how I like them. T… --- ## [Size of an index is very less than the raw document size when ingested via logstash](https://discuss.elastic.co/t/size-of-an-index-is-very-less-than-the-raw-document-size-when-ingested-via-logstash/280812)
**Author:** [@madhanbaskar](https://discuss.elastic.co/u/madhanbaskar)\ **Replies:** 3\ **Last updated:** [August 9, 2021, 2:23pm UTC](https://discuss.elastic.co/t/size-of-an-index-is-very-less-than-the-raw-document-size-when-ingested-via-logstash/280812 "2021-08-09T14:23:23Z")
I have a JSON file which has 93k records in it. The size of the JSON file is 413MB. When Indexed via logstash it is just 88MB in the index. I could see all the records ingested. Index setting : I have 50 fields for ind… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=859) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=861)