# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=907 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 908 --- ## [How do you search for many IP addresses and output only the source IP and destination IP in Dev Tools \[Kibana\]](https://discuss.elastic.co/t/how-do-you-search-for-many-ip-addresses-and-output-only-the-source-ip-and-destination-ip-in-dev-tools-kibana/276542)
**Author:** [@kanrab](https://discuss.elastic.co/u/kanrab)\ **Replies:** 1\ **Last updated:** [June 22, 2021, 11:29am UTC](https://discuss.elastic.co/t/how-do-you-search-for-many-ip-addresses-and-output-only-the-source-ip-and-destination-ip-in-dev-tools-kibana/276542 "2021-06-22T11:29:38Z")
So the query to search for a single IP is: GET \_search { "query": { "term": { "ip\_addr": "43.225.52.0/23" } } } But this is only able to search for one IP address My original query was: GET \_… --- ## [Follow-up from "Unable to avoid JSON parsing errors in logstash log-file"](https://discuss.elastic.co/t/follow-up-from-unable-to-avoid-json-parsing-errors-in-logstash-log-file/276641)
**Author:** [@es-gabriele](https://discuss.elastic.co/u/es-gabriele)\ **Replies:** 0\ **Last updated:** [June 22, 2021, 11:02am UTC](https://discuss.elastic.co/t/follow-up-from-unable-to-avoid-json-parsing-errors-in-logstash-log-file/276641 "2021-06-22T11:02:13Z")
Hi everyone, I am using ELK 7.2. I did read from a past answer here and I found it useful, as what I need to do is to make logstash correctly parse json data, and also an array of nested json objects. However, if I ne… --- ## [Aggregate Query Results](https://discuss.elastic.co/t/aggregate-query-results/276570)
**Author:** [@usman1](https://discuss.elastic.co/u/usman1)\ **Replies:** 5\ **Last updated:** [June 22, 2021, 10:39am UTC](https://discuss.elastic.co/t/aggregate-query-results/276570 "2021-06-22T10:39:15Z")
I am fetching timestamp and data against that timestamp with my search query to Elasticsearch node. The result being fetched contains multiple values against the same timeframe and I want Elasticsearch to return the aggr… --- ## [Access denied error on keystore when using ECK](https://discuss.elastic.co/t/access-denied-error-on-keystore-when-using-eck/276297)
**Author:** [@pkaramol](https://discuss.elastic.co/u/pkaramol)\ **Replies:** 2\ **Last updated:** [June 22, 2021, 10:03am UTC](https://discuss.elastic.co/t/access-denied-error-on-keystore-when-using-eck/276297 "2021-06-22T10:03:30Z")
We have orchestrated an elastic instance using ECK. The pods fail to start with this error Exception in thread "main" java.nio.file.AccessDeniedException: /usr/share/elasticsearch/config/elasticsearch.keystore at java… --- ## [Logstash 'compile\_imperative' error](https://discuss.elastic.co/t/logstash-compile-imperative-error/276625)
**Author:** [@Michael\_Dylan\_McAloo](https://discuss.elastic.co/u/Michael_Dylan_McAloo)\ **Replies:** 2\ **Last updated:** [June 22, 2021, 9:33am UTC](https://discuss.elastic.co/t/logstash-compile-imperative-error/276625 "2021-06-22T09:33:32Z")
Hi, I have Logstash to pick up Snort Alerts, but i have had this error and i don't know why. Error: logstash | \[2021-06-22T08:55:53,809\]\[ERROR\]\[logstash.agent \] Failed to execute action {:action=\>Log… --- ## [Are you aware of uncomptability between hibernate-enhance-maven-plugin and elasticsearch?](https://discuss.elastic.co/t/are-you-aware-of-uncomptability-between-hibernate-enhance-maven-plugin-and-elasticsearch/276574)
**Author:** [@guigui0824](https://discuss.elastic.co/u/guigui0824)\ **Replies:** 1\ **Last updated:** [June 22, 2021, 7:53am UTC](https://discuss.elastic.co/t/are-you-aware-of-uncomptability-between-hibernate-enhance-maven-plugin-and-elasticsearch/276574 "2021-06-22T07:53:34Z")
Hi, i work on a spring-boot project (version 2.3.8.RELEASE) with Hibernate (version 5.4.27.Final) and elasticsearch (spring-boot-starter-data-elasticsearch). I want to enable bytecode enhancement lazy loading to increas… --- ## [Removal of official Freenode IRC channels](https://discuss.elastic.co/t/removal-of-official-freenode-irc-channels/276603)
**Author:** [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Replies:** 0\ **Last updated:** [June 22, 2021, 4:44am UTC](https://discuss.elastic.co/t/removal-of-official-freenode-irc-channels/276603 "2021-06-22T04:44:26Z")
Folks, If you've been around the Elastic Stack for a few years, you likely would have come across our IRC channels that used to exist on Freenode. Unfortunately, the Freenode admins recently deleted all auth and channel… --- ## [How to restore index data if I remove all my master nodes accidentally!](https://discuss.elastic.co/t/how-to-restore-index-data-if-i-remove-all-my-master-nodes-accidentally/275109)
**Author:** [@Hiren\_Loong](https://discuss.elastic.co/u/Hiren_Loong)\ **Replies:** 8\ **Last updated:** [June 22, 2021, 3:42am UTC](https://discuss.elastic.co/t/how-to-restore-index-data-if-i-remove-all-my-master-nodes-accidentally/275109 "2021-06-22T03:42:15Z")
There are 3 master nodes and 6 data nodes in my ES Cluster. ES version is 6.7.x. I delete virtual machines accidentally, so 3 master nodes are disappeared forever! But my 6 data nodes are still on. Is any possible to … --- ## [ETW Events](https://discuss.elastic.co/t/etw-events/276597)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 0\ **Last updated:** [June 22, 2021, 3:20am UTC](https://discuss.elastic.co/t/etw-events/276597 "2021-06-22T03:20:32Z")
Will Elastic Agent support ETW events in the future or am I better off using Filebeat with standard log files at the moment? See Microsoft ETW (Event Tracing for Windows) Listener. Look for a Beats to deal with Service … --- ## [Logstash input plugin bad uri](https://discuss.elastic.co/t/logstash-input-plugin-bad-uri/276592)
**Author:** [@IsAa](https://discuss.elastic.co/u/IsAa)\ **Replies:** 2\ **Last updated:** [June 22, 2021, 2:53am UTC](https://discuss.elastic.co/t/logstash-input-plugin-bad-uri/276592 "2021-06-22T02:53:03Z")
Hi, I am trying to install plugin for logstash. But whenever I execute .\\logstash-plugin list to see a list of available plugins. I keep getting bad uri error Using JAVA\_HOME defined java: C:\\Program Files\\Java\\jdk-14… --- ## [Elasticsearch Cluster Status red and Incides status red without error and reason](https://discuss.elastic.co/t/elasticsearch-cluster-status-red-and-incides-status-red-without-error-and-reason/276513)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 3\ **Last updated:** [June 22, 2021, 12:50am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-status-red-and-incides-status-red-without-error-and-reason/276513 "2021-06-22T00:50:55Z")
Hi everyone, My problem is some indices have red status without reason. ENV: Elasticsearch 7.9.0 Centos 7 Clustering 4 node (3 data-master Node + 1 Coordinator Node) Using logstash to parsing data and using elasticse… --- ## [Logstash -\> array field -\> subquery](https://discuss.elastic.co/t/logstash-array-field-subquery/276584)
**Author:** [@seboraid](https://discuss.elastic.co/u/seboraid)\ **Replies:** 1\ **Last updated:** [June 22, 2021, 12:06am UTC](https://discuss.elastic.co/t/logstash-array-field-subquery/276584 "2021-06-22T00:06:42Z")
Hi! Im looking to add data from a subquery (i dont jnow if this is possible) to an array field in a elastic index. I have the following tables in MySQL: transactions and applied\_rules where applied\_rules has the follo… --- ## [\nter\>nginx\tity Too Large\\d\>bana response: invalid character '\<' looking for beginning of value. Response: \](https://discuss.elastic.co/t/html-nter-nginx-center-tity-too-large-h1-center-d-bana-response-invalid-character-looking-for-beginning-of-value-response-html/276550)
**Author:** [@gavinmathias](https://discuss.elastic.co/u/gavinmathias)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 10:05pm UTC](https://discuss.elastic.co/t/html-nter-nginx-center-tity-too-large-h1-center-d-bana-response-invalid-character-looking-for-beginning-of-value-response-html/276550 "2021-06-21T22:05:34Z")
Seeing this error when running filebeat -e setup. Any hints on how to troubleshoot this? Index setup finished. Loading dashboards (Kibana must be running and reachable) 2021-06-21T13:19:14.860Z INFO kibana/client.go:119… --- ## [Whitelist processes in Uncommon Processes](https://discuss.elastic.co/t/whitelist-processes-in-uncommon-processes/276285)
**Author:** [@bmbrit](https://discuss.elastic.co/u/bmbrit)\ **Replies:** 4\ **Last updated:** [June 21, 2021, 9:12pm UTC](https://discuss.elastic.co/t/whitelist-processes-in-uncommon-processes/276285 "2021-06-21T21:12:07Z")
Hi, I don't want to see processes that are legitimate. Is it possible to whitelist processes so that they don't appear in the uncommon processes? Thanks in advance, Brit --- ## [Automatic setting of read\_only\_allow\_delete](https://discuss.elastic.co/t/automatic-setting-of-read-only-allow-delete/276525)
**Author:** [@kfehrenbach](https://discuss.elastic.co/u/kfehrenbach)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 8:09pm UTC](https://discuss.elastic.co/t/automatic-setting-of-read-only-allow-delete/276525 "2021-06-21T20:09:06Z")
We're running elasticsearch version 6.8.8 and 7.7. In both clusters we observed the bahaviour, that the cluster is setting the parameter read\_only\_allow\_delete to true as soon as the fllod stage is reached for some of th… --- ## [Phrase Suggester doesn't work with short prefixes?](https://discuss.elastic.co/t/phrase-suggester-doesnt-work-with-short-prefixes/276569)
**Author:** [@sabetai](https://discuss.elastic.co/u/sabetai)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 5:56pm UTC](https://discuss.elastic.co/t/phrase-suggester-doesnt-work-with-short-prefixes/276569 "2021-06-21T17:56:49Z")
I'm trying to implement simple auto-complete where entering the prefix of a phrase will retrieve auto-complete suggestions (ie for phrase size of 3-5). However, the Phrase Suggester often doesn't yield results until the … --- ## [To much results](https://discuss.elastic.co/t/to-much-results/276572)
**Author:** [@Joni94](https://discuss.elastic.co/u/Joni94)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 6:34pm UTC](https://discuss.elastic.co/t/to-much-results/276572 "2021-06-21T18:34:59Z")
My problem first of all i try this query: GET /index/\_search { "query": { "simple\_query\_string": { "query": "(\\"cheaper+than,+therapy\\")", "analyzer": "standard", "flags": "OR|AND", … --- ## [Issue importing saved objects via API](https://discuss.elastic.co/t/issue-importing-saved-objects-via-api/276287)
**Author:** [@Kohlman](https://discuss.elastic.co/u/Kohlman)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 6:25pm UTC](https://discuss.elastic.co/t/issue-importing-saved-objects-via-api/276287 "2021-06-21T18:25:05Z")
We are using 7.11.2. From the documentation (Import objects API | Kibana Guide \[7.13\] | Elastic) it said "The request body must include the multipart/form-data type." So we created a python script to "export" and "impo… --- ## [How to multiply score of shouldClause and mustClause in booleanQuery?](https://discuss.elastic.co/t/how-to-multiply-score-of-shouldclause-and-mustclause-in-booleanquery/276566)
**Author:** [@lunablessing](https://discuss.elastic.co/u/lunablessing)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 5:12pm UTC](https://discuss.elastic.co/t/how-to-multiply-score-of-shouldclause-and-mustclause-in-booleanquery/276566 "2021-06-21T17:12:52Z")
I know booleanQuery will add score of should clauses and must clauses. I used to do log(scoreOfShould) + log(scoreOfMust) + log(\_score) for sorting as scoreOfShould \* scoreOfMust \* \_score. In my case, scoreOfShould is q… --- ## [Отоброжение кракозябр](https://discuss.elastic.co/t/topic/276478)
**Author:** [@ksfe21](https://discuss.elastic.co/u/ksfe21)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 3:28pm UTC](https://discuss.elastic.co/t/topic/276478 "2021-06-21T15:28:45Z")
Доброго времени суток! Подскажите как исправить данную ошибку в Wazuh? --- ## [Logstash-output-syslog incorrect time](https://discuss.elastic.co/t/logstash-output-syslog-incorrect-time/276554)
**Author:** [@bambam](https://discuss.elastic.co/u/bambam)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 2:57pm UTC](https://discuss.elastic.co/t/logstash-output-syslog-incorrect-time/276554 "2021-06-21T14:57:46Z")
I'm having an issue with using the logstash-output-syslog plugin. The syslog message header is showing a timestamp for UTC and not the timezone for where I'm located. Can someone provide some input on how to change the t… --- ## [Visualizing the latest Entries by a specific Field](https://discuss.elastic.co/t/visualizing-the-latest-entries-by-a-specific-field/276197)
**Author:** [@New\_ElasticFan](https://discuss.elastic.co/u/New_ElasticFan)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 2:29pm UTC](https://discuss.elastic.co/t/visualizing-the-latest-entries-by-a-specific-field/276197 "2021-06-21T14:29:17Z")
So, I am new to Elastic Stack. My index have different entries like the following. { "\_index": "events", "\_type": "\_doc", "\_id": "irkkDFHoBkM1o5v\_kC", "\_score": null, "fields": { "@timestamp": \[ "2021-02-18T15:46:47.000… --- ## [Elastic Observability Training Material - Possible Error](https://discuss.elastic.co/t/elastic-observability-training-material-possible-error/276484)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 2:21pm UTC](https://discuss.elastic.co/t/elastic-observability-training-material-possible-error/276484 "2021-06-21T14:21:39Z")
Hi all, While I was reviewing the course's material in Extracting Data Types (page 181) it shows how to convert a token directly in the tokenizer .. The problem is that date is not a valid data type From the doc: … --- ## [How to "remove" cluster.routing.allocation.awareness.attributes](https://discuss.elastic.co/t/how-to-remove-cluster-routing-allocation-awareness-attributes/276537)
**Author:** [@Maxime\_Poirier-Journ](https://discuss.elastic.co/u/Maxime_Poirier-Journ)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 2:20pm UTC](https://discuss.elastic.co/t/how-to-remove-cluster-routing-allocation-awareness-attributes/276537 "2021-06-21T14:20:29Z")
Hi there, We're using Elastic in all our environments from dev, qa to prod. We're currently using cluster.routing.allocation.awareness.attributes on all our clusters based on the attribute "aws\_availability\_zone" meanin… --- ## [Log4j2.properties- Rolling File Issue](https://discuss.elastic.co/t/log4j2-properties-rolling-file-issue/276551)
**Author:** [@anguri\_sudhakar](https://discuss.elastic.co/u/anguri_sudhakar)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 2:14pm UTC](https://discuss.elastic.co/t/log4j2-properties-rolling-file-issue/276551 "2021-06-21T14:14:16Z")
Hi Team, we have 4-node cluster elasticsearch-7.5.2 installed and configure Centos 7 in Dev- Environment Like below : master-1 master-2 hotnode warmnode We are using default log4j2.properties file for roll the lo… --- ## [\[ANNOUNCEMENT\] - Elasticsearch Beyonder 7.13.1 released](https://discuss.elastic.co/t/announcement-elasticsearch-beyonder-7-13-1-released/276544)
**Author:** [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 1:37pm UTC](https://discuss.elastic.co/t/announcement-elasticsearch-beyonder-7-13-1-released/276544 "2021-06-21T13:37:40Z")
The Elasticsearch Beyonder team is pleased to announce the elasticsearch-beyonder-7.13.1 release! Elasticsearch Beyonder Elasticsearch beyonder provides automatic index, mapping, alias or template creation when an elas… --- ## [Elasticsearch Kibana Preference](https://discuss.elastic.co/t/elasticsearch-kibana-preference/276423)
**Author:** [@Sanchit\_Agrawal](https://discuss.elastic.co/u/Sanchit_Agrawal)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 11:26am UTC](https://discuss.elastic.co/t/elasticsearch-kibana-preference/276423 "2021-06-21T11:26:16Z")
GET /executives/\_search?request\_cache=true&preference=sa GET /executives/\_search?request\_cache=true When hitting from Kibana both with the same query doesn't make any difference. Is it true preferences are ignored in … --- ## [I get error with Logstash: IllegalStateException](https://discuss.elastic.co/t/i-get-error-with-logstash-illegalstateexception/276486)
**Author:** [@an\_dinh](https://discuss.elastic.co/u/an_dinh)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 12:09pm UTC](https://discuss.elastic.co/t/i-get-error-with-logstash-illegalstateexception/276486 "2021-06-21T12:09:02Z")
Here is my logstash.conf: input { mongodb{ uri =\> 'mongodb://localhost:27017/vnExpressCrawler?authSource=vnExpressCrawler' placeholder\_db\_dir =\> '/opt/logstash-mongodb/' placeholder\_db\_name =\> 'logstash\_s… --- ## [Append hostname in each index name](https://discuss.elastic.co/t/append-hostname-in-each-index-name/276519)
**Author:** [@connectgeeks](https://discuss.elastic.co/u/connectgeeks)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 12:00pm UTC](https://discuss.elastic.co/t/append-hostname-in-each-index-name/276519 "2021-06-21T12:00:49Z")
I would like to append hostname in each index name for classification of files based on the source hostname. output{ elasticsearch { hosts =\> \["127.0.0.1:9200"\] index =\> "sample-%{\[@metadata\]\[hostname\]}-%{\[@me… --- ## [Parsing a Concatenated Field to Extract Sub-Fields](https://discuss.elastic.co/t/parsing-a-concatenated-field-to-extract-sub-fields/276523)
**Author:** [@fmaginga](https://discuss.elastic.co/u/fmaginga)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 11:29am UTC](https://discuss.elastic.co/t/parsing-a-concatenated-field-to-extract-sub-fields/276523 "2021-06-21T11:29:23Z")
Hello, I am trying to write a logstash filter to extract individual sub-fields from on concatenated field. Example: I have a field CGI = 640070003110080 CGI = 640070003110080 I want to split the CGI field in to four… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=906) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=908)