# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=868 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 869 --- ## [Query on elasticsearch.keystore file present in ES config directory](https://discuss.elastic.co/t/query-on-elasticsearch-keystore-file-present-in-es-config-directory/278652)
**Author:** [@chaitra\_hegde](https://discuss.elastic.co/u/chaitra_hegde)\ **Replies:** 2\ **Last updated:** [August 2, 2021, 7:51am UTC](https://discuss.elastic.co/t/query-on-elasticsearch-keystore-file-present-in-es-config-directory/278652 "2021-08-02T07:51:26Z")
Hi, I am using Elasticsearch-oss 7.8.0 in k8s environment. I want to know what is elasticsearch.keystore file present in ES Config directory(/etc/elasticsearch) which comes by default when ES rpm is installed. I saw thi… --- ## [Whats difference org.elasticsearch.index.mapper.GeoPointFieldMapper and org.elasticsearch.xpack.ml.extractor.GeoPointField](https://discuss.elastic.co/t/whats-difference-org-elasticsearch-index-mapper-geopointfieldmapper-and-org-elasticsearch-xpack-ml-extractor-geopointfield/280042)
**Author:** [@drake-jin](https://discuss.elastic.co/u/drake-jin)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 7:50am UTC](https://discuss.elastic.co/t/whats-difference-org-elasticsearch-index-mapper-geopointfieldmapper-and-org-elasticsearch-xpack-ml-extractor-geopointfield/280042 "2021-08-02T07:50:36Z")
I wonder why same role classes are here in elasticsearch repository. What org.elasticsearch.xpack.ml.extractor.GeoPointField is for? What org.elasticsearch.index.mapper.GeoPointFieldMapper is for? Any documents? --- ## [Can I change the system index mapping and enrich it with new fields](https://discuss.elastic.co/t/can-i-change-the-system-index-mapping-and-enrich-it-with-new-fields/280057)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 7:28am UTC](https://discuss.elastic.co/t/can-i-change-the-system-index-mapping-and-enrich-it-with-new-fields/280057 "2021-08-02T07:28:45Z")
Hi, Can I change the mapping of the system index and enrich it with new fields. The current mapping of an index is "dynamic":"strict" and the index is hidden by default and its name starting with "." System index --- ## [Filebeat integration as file](https://discuss.elastic.co/t/filebeat-integration-as-file/279990)
**Author:** [@doragon](https://discuss.elastic.co/u/doragon)\ **Replies:** 2\ **Last updated:** [August 2, 2021, 7:25am UTC](https://discuss.elastic.co/t/filebeat-integration-as-file/279990 "2021-08-02T07:25:30Z")
Good afternoon. I tried to setup a disconnected architecture between production and monitoring, as I have non-connectivity between my production servers and my ELK stack (local network). I planed to work as follow: f… --- ## [Same index-pattern created with kibana UI and REST command](https://discuss.elastic.co/t/same-index-pattern-created-with-kibana-ui-and-rest-command/280079)
**Author:** [@prashant1](https://discuss.elastic.co/u/prashant1)\ **Replies:** 4\ **Last updated:** [August 2, 2021, 7:13am UTC](https://discuss.elastic.co/t/same-index-pattern-created-with-kibana-ui-and-rest-command/280079 "2021-08-02T07:13:18Z")
Hi We have deployed kibana 7.8.0. We notice one observation if we try to create one index pattern through Kibana UI and another through REST API in that case we are able to create the same index-pattern. But if we try t… --- ## [Red indices when restoring from snapshot which contains indices in cold phase](https://discuss.elastic.co/t/red-indices-when-restoring-from-snapshot-which-contains-indices-in-cold-phase/279329)
**Author:** [@dimitris\_sb](https://discuss.elastic.co/u/dimitris_sb)\ **Replies:** 8\ **Last updated:** [August 2, 2021, 6:37am UTC](https://discuss.elastic.co/t/red-indices-when-restoring-from-snapshot-which-contains-indices-in-cold-phase/279329 "2021-08-02T06:37:47Z")
Hi All, I got a snapshot in s3 from cluster A (7.11.x) and tried to restore it in cluster B (7.13.x) and noticed that indices in cold nodes e.g. index-data-2021.03 were restored as e.g. restored-shrink-index-data-2021.0… --- ## [How to embed HTML code into Kibana?](https://discuss.elastic.co/t/how-to-embed-html-code-into-kibana/280025)
**Author:** [@tan\_minkee](https://discuss.elastic.co/u/tan_minkee)\ **Replies:** 2\ **Last updated:** [August 2, 2021, 6:08am UTC](https://discuss.elastic.co/t/how-to-embed-html-code-into-kibana/280025 "2021-08-02T06:08:35Z")
Hi, Is there a way to embed HTML code into Kibana? I would like to embed a website by using iframe into Kibana. --- ## [Two-Node cluster, switch master node](https://discuss.elastic.co/t/two-node-cluster-switch-master-node/280117)
**Author:** [@TheWorkingDeveloper](https://discuss.elastic.co/u/TheWorkingDeveloper)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 5:49am UTC](https://discuss.elastic.co/t/two-node-cluster-switch-master-node/280117 "2021-08-02T05:49:24Z")
I have an old R710 that I've used as a server for a long time. It's pretty weak and performance is slow. Now I have a second new server that I added as purely a data-node which is appox 10x stronger. I'd like to switch t… --- ## [Fields are unknown in de discovery tab kibana and unable to make visualization of field](https://discuss.elastic.co/t/fields-are-unknown-in-de-discovery-tab-kibana-and-unable-to-make-visualization-of-field/279880)
**Author:** [@gregorysanders](https://discuss.elastic.co/u/gregorysanders)\ **Replies:** 3\ **Last updated:** [August 2, 2021, 5:37am UTC](https://discuss.elastic.co/t/fields-are-unknown-in-de-discovery-tab-kibana-and-unable-to-make-visualization-of-field/279880 "2021-08-02T05:37:10Z")
HI everyone, I am unable to make visualizations of certain fields in my index. In the discovery tab, some fields are unknown. I already tried to refresh the index pattern multiple times but this does not solve the prob… --- ## [Wrong hosts last event elastic siem](https://discuss.elastic.co/t/wrong-hosts-last-event-elastic-siem/280176)
**Author:** [@artsius](https://discuss.elastic.co/u/artsius)\ **Replies:** 0\ **Last updated:** [August 2, 2021, 3:32am UTC](https://discuss.elastic.co/t/wrong-hosts-last-event-elastic-siem/280176 "2021-08-02T03:32:48Z")
I've some problem with last event in my elastic siem environment. The date is incorrect and I don't know how to fix this. could anyone give the suggests on this? I'm still new on Elasticsearch. --- ## [How to implement pagination in composite aggregation after removing some buckets based on condition by BucketSelectorAggregation](https://discuss.elastic.co/t/how-to-implement-pagination-in-composite-aggregation-after-removing-some-buckets-based-on-condition-by-bucketselectoraggregation/280168)
**Author:** [@dipuoec](https://discuss.elastic.co/u/dipuoec)\ **Replies:** 0\ **Last updated:** [August 2, 2021, 1:27am UTC](https://discuss.elastic.co/t/how-to-implement-pagination-in-composite-aggregation-after-removing-some-buckets-based-on-condition-by-bucketselectoraggregation/280168 "2021-08-02T01:27:26Z")
I am trying to implement the inbuilt pagination feature available in Elasticsearch composite aggregation on aggregated data. This works perfectly fine until we are not removing certain buckets based on conditions of aggr… --- ## [How to set the index name to the value of tags set by filebeat](https://discuss.elastic.co/t/how-to-set-the-index-name-to-the-value-of-tags-set-by-filebeat/279820)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 6\ **Last updated:** [August 2, 2021, 1:22am UTC](https://discuss.elastic.co/t/how-to-set-the-index-name-to-the-value-of-tags-set-by-filebeat/279820 "2021-08-02T01:22:08Z")
I am using filebeat to collect some logs. I have set the value of tags for each log, and I want to use that value as the name of the index. Is that possible? vi /etc/filebeat/filebeat.yml ... snip ... filebeat.inputs:… --- ## [Create fields when a word followed by ':'](https://discuss.elastic.co/t/create-fields-when-a-word-followed-by/280164)
**Author:** [@Arkapravo\_Das](https://discuss.elastic.co/u/Arkapravo_Das)\ **Replies:** 3\ **Last updated:** [August 1, 2021, 11:15pm UTC](https://discuss.elastic.co/t/create-fields-when-a-word-followed-by/280164 "2021-08-01T23:15:11Z")
Hi, What I am trying to do is , if the unformatted text is like updating demand record with key:202107231924440412212356|current demand quantity:1|quantity getting reduced:1|shipmentno:170801380 then I want to create… --- ## [How to Setup Tenant IDs](https://discuss.elastic.co/t/how-to-setup-tenant-ids/280086)
**Author:** [@Verax](https://discuss.elastic.co/u/Verax)\ **Replies:** 1\ **Last updated:** [August 1, 2021, 10:15pm UTC](https://discuss.elastic.co/t/how-to-setup-tenant-ids/280086 "2021-08-01T22:15:45Z")
Hello, I am looking to create a MSSP and wanted to know the best process for determining whos data is whos and how to see the volume of data ingested by each tenant. Could someone please assist? Many Thanks --- ## [Need help - Cisco syslog events matching in GROK debugger but not showing up in](https://discuss.elastic.co/t/need-help-cisco-syslog-events-matching-in-grok-debugger-but-not-showing-up-in/280116)
**Author:** [@Cdnvballer](https://discuss.elastic.co/u/Cdnvballer)\ **Replies:** 7\ **Last updated:** [August 1, 2021, 7:59pm UTC](https://discuss.elastic.co/t/need-help-cisco-syslog-events-matching-in-grok-debugger-but-not-showing-up-in/280116 "2021-08-01T19:59:20Z")
the actual grok pattern(s) used to match Cisco syslog event messages is no longer working despite the match is successful in the grok debugger UI . other pattern is working fine for Juniper routers though... not sure wh… --- ## [Finding missing logs against specific index](https://discuss.elastic.co/t/finding-missing-logs-against-specific-index/280153)
**Author:** [@Bilal\_Malik](https://discuss.elastic.co/u/Bilal_Malik)\ **Replies:** 2\ **Last updated:** [August 1, 2021, 6:57pm UTC](https://discuss.elastic.co/t/finding-missing-logs-against-specific-index/280153 "2021-08-01T18:57:57Z")
Hi All, i have different services, sending logs to elastic search and showing in Kibana. Is there any way to find which service is not sending logs to elastic search? from the existing logs, how i can put filter it show… --- ## [After lot of effort my geo\_ip is still not working](https://discuss.elastic.co/t/after-lot-of-effort-my-geo-ip-is-still-not-working/280031)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 2\ **Last updated:** [August 1, 2021, 8:16am UTC](https://discuss.elastic.co/t/after-lot-of-effort-my-geo-ip-is-still-not-working/280031 "2021-08-01T08:16:57Z")
Hi Team, Below is my config and after lot of tries my geo\_ip is still not reflecting in my indices. Am I doing anything wrong here? input { stdin { type =\> "json" codec =\> "json… --- ## [Unable to start Kibana:](https://discuss.elastic.co/t/unable-to-start-kibana/280114)
**Author:** [@Arkapravo\_Das](https://discuss.elastic.co/u/Arkapravo_Das)\ **Replies:** 1\ **Last updated:** [August 1, 2021, 3:30am UTC](https://discuss.elastic.co/t/unable-to-start-kibana/280114 "2021-08-01T03:30:23Z")
I simply downloaded and now trying to start elastic search and Kibana. Kibana getting one error like below: log \[02:42:07.019\] \[info\]\[plugins-service\] Plugin "timelines" is disabled. log \[02:42:07.117\] \[warning\]… --- ## [Best strategy to deal with one event that contain multiple events, and graph it on kibana](https://discuss.elastic.co/t/best-strategy-to-deal-with-one-event-that-contain-multiple-events-and-graph-it-on-kibana/280137)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 0\ **Last updated:** [July 31, 2021, 7:42pm UTC](https://discuss.elastic.co/t/best-strategy-to-deal-with-one-event-that-contain-multiple-events-and-graph-it-on-kibana/280137 "2021-07-31T19:42:38Z")
Hi, after parsing a string field . it, I got several fields with different names, this names will change constantly and probably will appear new ones { "mfemve"=\>"0,39 ", "vmtoolsd"=\>"0,39 ", "zabbix\_agentd"=\>"0,32 ", … --- ## [Multiple logs parsing to elastic search directly through filebeat](https://discuss.elastic.co/t/multiple-logs-parsing-to-elastic-search-directly-through-filebeat/280134)
**Author:** [@maduranga\_nessus](https://discuss.elastic.co/u/maduranga_nessus)\ **Replies:** 0\ **Last updated:** [July 31, 2021, 5:24pm UTC](https://discuss.elastic.co/t/multiple-logs-parsing-to-elastic-search-directly-through-filebeat/280134 "2021-07-31T17:24:23Z")
I need to parse multiple log files to an elastic search through a file beat. File beat already installed in this pc and through that file beat nginx already parsing directly to elastic search. I need to parse apache logs… --- ## [Reindex by grouping documents by Unique ID](https://discuss.elastic.co/t/reindex-by-grouping-documents-by-unique-id/280129)
**Author:** [@mrunalini](https://discuss.elastic.co/u/mrunalini)\ **Replies:** 0\ **Last updated:** [July 31, 2021, 3:15pm UTC](https://discuss.elastic.co/t/reindex-by-grouping-documents-by-unique-id/280129 "2021-07-31T15:15:35Z")
Hi Everyone, I want to reindex my Index which has different documents with unique id . I want to reindex all the data into single documents against unique id. is it possible to do that. --- ## [MySQL 8: Could not create connection to database server](https://discuss.elastic.co/t/mysql-8-could-not-create-connection-to-database-server/280064)
**Author:** [@Justin\_Morgan](https://discuss.elastic.co/u/Justin_Morgan)\ **Replies:** 1\ **Last updated:** [July 30, 2021, 11:57am UTC](https://discuss.elastic.co/t/mysql-8-could-not-create-connection-to-database-server/280064 "2021-07-30T11:57:29Z")
After upgrading to MySQL 8 I get the following error from my logstash pod: Loading class \`com.mysql.jdbc.Driver'. This is deprecated. The new driver class is \`com.mysql.cj.jdbc.Driver'. The driver is automatically regis… --- ## [Fluentd performance is degraded](https://discuss.elastic.co/t/fluentd-performance-is-degraded/280060)
**Author:** [@Voula\_Mikr](https://discuss.elastic.co/u/Voula_Mikr)\ **Replies:** 3\ **Last updated:** [July 31, 2021, 6:05am UTC](https://discuss.elastic.co/t/fluentd-performance-is-degraded/280060 "2021-07-31T06:05:31Z")
In a deployment with elasticsearch 8.x, fluentd pod performance has been degraded and following log is printed whenever a new message is received and it is about to be delivered in elastic. warning: 299 Elasticsearch-7.… --- ## [Ruby hash to fields of an event](https://discuss.elastic.co/t/ruby-hash-to-fields-of-an-event/280102)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [July 30, 2021, 10:03pm UTC](https://discuss.elastic.co/t/ruby-hash-to-fields-of-an-event/280102 "2021-07-30T22:03:53Z")
Hi I got the following ruby hash after parsing a long string with ruby code, { "mfemve"=\>"0,39 ", "vmtoolsd"=\>"0,39 ", "zabbix\_agentd"=\>"0,39 ", "powershell"=\>"0,39 ", "ir\_agent"=\>"0,00 ", "wmiprvse"=\>"0,00 ", "unsecap… --- ## [How to compare exported objects in .ndjson format from two envirornments](https://discuss.elastic.co/t/how-to-compare-exported-objects-in-ndjson-format-from-two-envirornments/279846)
**Author:** [@Kunal\_Sharma](https://discuss.elastic.co/u/Kunal_Sharma)\ **Replies:** 2\ **Last updated:** [July 30, 2021, 8:19pm UTC](https://discuss.elastic.co/t/how-to-compare-exported-objects-in-ndjson-format-from-two-envirornments/279846 "2021-07-30T20:19:11Z")
Dear Team, We have multiple Kibana stacks (dev, test, prod) which are manually managed and have some differences. We are looking for some quick help on comparing the Kibana objects from two environments and finding the… --- ## [Output to json saving only specific fields](https://discuss.elastic.co/t/output-to-json-saving-only-specific-fields/280098)
**Author:** [@Hamza\_El\_Aouane](https://discuss.elastic.co/u/Hamza_El_Aouane)\ **Replies:** 3\ **Last updated:** [July 30, 2021, 7:57pm UTC](https://discuss.elastic.co/t/output-to-json-saving-only-specific-fields/280098 "2021-07-30T19:57:42Z")
Hello everyone I am new logstash and I am sorry if the question is so basic. I have been saving my syslog into a csv file, as follow: csv { path =\> "C:\\path\\Desktop\\Adib\\adib-syslogs-%{+yyyy.MM.dd}.csv" csv\_o… --- ## [Logstash mutate field](https://discuss.elastic.co/t/logstash-mutate-field/280097)
**Author:** [@Hamza\_El\_Aouane](https://discuss.elastic.co/u/Hamza_El_Aouane)\ **Replies:** 1\ **Last updated:** [July 30, 2021, 7:56pm UTC](https://discuss.elastic.co/t/logstash-mutate-field/280097 "2021-07-30T19:56:27Z")
Hi everyone, I hope somebody can help me with this issue I am facing with logstash. I am receiving some syslog, and trying to put in place some filtering and merging together 2 fields. the simple structure that I want… --- ## [Elasticsearch not doing local primary indices recovery after node restart](https://discuss.elastic.co/t/elasticsearch-not-doing-local-primary-indices-recovery-after-node-restart/280101)
**Author:** [@pranav\_sah](https://discuss.elastic.co/u/pranav_sah)\ **Replies:** 0\ **Last updated:** [July 30, 2021, 7:45pm UTC](https://discuss.elastic.co/t/elasticsearch-not-doing-local-primary-indices-recovery-after-node-restart/280101 "2021-07-30T19:45:41Z")
We have a cluster of 6 nodes of which one node was restarted due to some patch activity. Before the node was brought down we had set "cluster.routing.allocation.enable" : "primaries" on persistent level so as to have f… --- ## [How to prevent clobbering in translate filter](https://discuss.elastic.co/t/how-to-prevent-clobbering-in-translate-filter/280008)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 4\ **Last updated:** [July 30, 2021, 4:50pm UTC](https://discuss.elastic.co/t/how-to-prevent-clobbering-in-translate-filter/280008 "2021-07-30T16:50:51Z")
Hello , I'm using translate filter with a set of mappings in dictionary . { "@timestamp" =\> 2021-07-23T11:52:08.000Z, "Flag" =\> "16464", "Flag\_Definition" =\> "liveness test timed out… --- ## [Kibana discover tab is lagging](https://discuss.elastic.co/t/kibana-discover-tab-is-lagging/277902)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 17\ **Last updated:** [July 30, 2021, 3:51pm UTC](https://discuss.elastic.co/t/kibana-discover-tab-is-lagging/277902 "2021-07-30T15:51:53Z")
Running elk stack 7.11 Issue is while searching 2 months data in kibana's discover it is taking more than 5 minutes to show the result the index size is 100gb we did top command and we didn't see any serious thing cpu i… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=867) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=869)