# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=913 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 914 --- ## [Unable to lock JVM after failed Snapshot](https://discuss.elastic.co/t/unable-to-lock-jvm-after-failed-snapshot/276019)
**Author:** [@Junebee](https://discuss.elastic.co/u/Junebee)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 11:21pm UTC](https://discuss.elastic.co/t/unable-to-lock-jvm-after-failed-snapshot/276019 "2021-06-15T23:21:54Z")
I have a three data node and one ingest node cluster. I recently had a node fail during a snapshot and it brought down my entire stack which had been running well for almost 6 months. When I went to restart the failed n… --- ## [Elastic search not loading](https://discuss.elastic.co/t/elastic-search-not-loading/275997)
**Author:** [@dorcas](https://discuss.elastic.co/u/dorcas)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 10:45pm UTC](https://discuss.elastic.co/t/elastic-search-not-loading/275997 "2021-06-15T22:45:13Z")
Dear Team, I mistakenly deleted some indices folders inside data.nodes in elasticsearch. Now I have restarted the service but unable to access Kibana. Please find below the error logs. policy \[ilm-history-ilm-policy-7da… --- ## [Executing a command from Elasticsearch/kibana](https://discuss.elastic.co/t/executing-a-command-from-elasticsearch-kibana/275920)
**Author:** [@T1330](https://discuss.elastic.co/u/T1330)\ **Replies:** 10\ **Last updated:** [June 15, 2021, 10:08pm UTC](https://discuss.elastic.co/t/executing-a-command-from-elasticsearch-kibana/275920 "2021-06-15T22:08:16Z")
Could you please have any example that executing a command from Elasticsearch to another server etc. i.e. moving from file "C:/aaa/a111.txt" to "C:/bbb/a111.txt" or displaying a pop-up by command Elasticsearch-kibana … --- ## [CPU,RAM spec details for Elasticsearch Master & Data nodes](https://discuss.elastic.co/t/cpu-ram-spec-details-for-elasticsearch-master-data-nodes/276038)
**Author:** [@purushothamkdr143](https://discuss.elastic.co/u/purushothamkdr143)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 10:02pm UTC](https://discuss.elastic.co/t/cpu-ram-spec-details-for-elasticsearch-master-data-nodes/276038 "2021-06-15T22:02:16Z")
Hi All, I am setting up elasticsearch cluster on k8s using eck operator. From the document I understood that Heapsize should be no more than 50% of Allocated RAM so passed the details accordingly. Details: k8 cluster:… --- ## [Kibana timeseries with stacked bar graph](https://discuss.elastic.co/t/kibana-timeseries-with-stacked-bar-graph/275464)
**Author:** [@rmartinez.rv](https://discuss.elastic.co/u/rmartinez.rv)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 9:42pm UTC](https://discuss.elastic.co/t/kibana-timeseries-with-stacked-bar-graph/275464 "2021-06-15T21:42:30Z")
Hi. I'm looking for help with getting a "particular" graph from kibana. I have an index in my elastic server filling with this kind of information: { "\_index": "register", "\_type": "\_doc", "\_id": "6kRQ8XkBeDPVH1… --- ## [Is there a way to query/filter for just RFC Non-Compliant Traffic?](https://discuss.elastic.co/t/is-there-a-way-to-query-filter-for-just-rfc-non-compliant-traffic/275155)
**Author:** [@kanrab](https://discuss.elastic.co/u/kanrab)\ **Replies:** 3\ **Last updated:** [June 15, 2021, 8:14pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-query-filter-for-just-rfc-non-compliant-traffic/275155 "2021-06-15T20:14:41Z")
I was unable to come up with a come up with anything. Any ideas? --- ## [How does kibana regenerate the target file](https://discuss.elastic.co/t/how-does-kibana-regenerate-the-target-file/275237)
**Author:** [@541002492](https://discuss.elastic.co/u/541002492)\ **Replies:** 3\ **Last updated:** [June 15, 2021, 7:59pm UTC](https://discuss.elastic.co/t/how-does-kibana-regenerate-the-target-file/275237 "2021-06-15T19:59:46Z")
I want to modify one of kibana's index.js files, but running the modification does not take effect. Looking at the browser, I find that the browser is loading the target file. How to recompile the index.js file to genera… --- ## [Logstash does not parse all logs with file as input](https://discuss.elastic.co/t/logstash-does-not-parse-all-logs-with-file-as-input/276044)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 7:22pm UTC](https://discuss.elastic.co/t/logstash-does-not-parse-all-logs-with-file-as-input/276044 "2021-06-15T19:22:20Z")
Hi All. I am using file input plugin to read logs. My config looks like below: input { file { path =\> "/opt/gtal/iptal/elasticsearch/app/logstash/stage/CVMQA\_UAT\_STATS-\*.txt" codec =\> multiline { pattern =\> "… --- ## [Is there a way to get all doc ID's from an index for a specified time range?](https://discuss.elastic.co/t/is-there-a-way-to-get-all-doc-ids-from-an-index-for-a-specified-time-range/275885)
**Author:** [@aidenosi](https://discuss.elastic.co/u/aidenosi)\ **Replies:** 3\ **Last updated:** [June 15, 2021, 5:34pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-get-all-doc-ids-from-an-index-for-a-specified-time-range/275885 "2021-06-15T17:34:35Z")
Hello, We recently had an issue that caused one of our servers to report as "down" to heartbeat even though it was up. This caused us to have 3 days of "downtime" in our metrics. We want to fix this by going through and… --- ## [Elasticsearch Performance Issues Upgrading v6.2.3 to v7.13.1](https://discuss.elastic.co/t/elasticsearch-performance-issues-upgrading-v6-2-3-to-v7-13-1/275611)
**Author:** [@radleta](https://discuss.elastic.co/u/radleta)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 5:06pm UTC](https://discuss.elastic.co/t/elasticsearch-performance-issues-upgrading-v6-2-3-to-v7-13-1/275611 "2021-06-15T17:06:53Z")
We've been working on an upgrade from Elasticsearch cluster running v6.2.3 to v7.13.1 and running into a major performance roadblock. We are running the versions side-by-side and trying to cut-over to the new version bu… --- ## [Rename strings field to nested field](https://discuss.elastic.co/t/rename-strings-field-to-nested-field/275912)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 6\ **Last updated:** [June 15, 2021, 4:48pm UTC](https://discuss.elastic.co/t/rename-strings-field-to-nested-field/275912 "2021-06-15T16:48:00Z")
Hello every body, I want to parse the logs bellow Apr 20 01:10:04 hostname sshproxy\[150\]: \[SSH Session\] session\_id="56454646eaeazjajflen" client\_ip="X.X.X.X" target\_ip="X.X.X.X" user="X.X.X.X" device="X.X.X.X" service… --- ## [Elasticsearch cluster with 2 nodes](https://discuss.elastic.co/t/elasticsearch-cluster-with-2-nodes/275588)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 4\ **Last updated:** [June 15, 2021, 4:35pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-with-2-nodes/275588 "2021-06-15T16:35:16Z")
hi I hope this message finds you well I have situation where I have installed two instance of Elasticsearch setup in remote server 1 (node1) and remote server 2 (node2), and I want to connect both these node in one clu… --- ## [How do I divide two metrics calculated in bar-chart](https://discuss.elastic.co/t/how-do-i-divide-two-metrics-calculated-in-bar-chart/276024)
**Author:** [@Dhruv\_Makwana](https://discuss.elastic.co/u/Dhruv_Makwana)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 3:52pm UTC](https://discuss.elastic.co/t/how-do-i-divide-two-metrics-calculated-in-bar-chart/276024 "2021-06-15T15:52:34Z")
I want to divide two metrics which were calculated by sum and count at the y-axis in Bar-graphs. I went through some discussion, for the newer version there's supposed to calculation field in metrics aggregation. But… --- ## [Управление ILM из Logstash для Filebeat](https://discuss.elastic.co/t/ilm-logstash-filebeat/275200)
**Author:** [@Sergei\_Frolov](https://discuss.elastic.co/u/Sergei_Frolov)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 3:39pm UTC](https://discuss.elastic.co/t/ilm-logstash-filebeat/275200 "2021-06-15T15:39:11Z")
Добрый день. Хочу сделать централизованную отправку логов, собранных модулями Filebeat в кафку, и из кафки - в Elasticsearch. Делаю как написано в этой инструкции: Это работает, но получаю ошибки ILM при такой конст… --- ## [It is possible to use two filters within a query in NodeJs?](https://discuss.elastic.co/t/it-is-possible-to-use-two-filters-within-a-query-in-nodejs/276029)
**Author:** [@Sebastian\_Marroquin](https://discuss.elastic.co/u/Sebastian_Marroquin)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 3:39pm UTC](https://discuss.elastic.co/t/it-is-possible-to-use-two-filters-within-a-query-in-nodejs/276029 "2021-06-15T15:39:09Z")
Hello everybody. I was wondering if it is possible to have within a variable in NodeJs two types of filters, for example: query = { "bool": { … --- ## [Overwrite @timestamp with log timestamp](https://discuss.elastic.co/t/overwrite-timestamp-with-log-timestamp/275713)
**Author:** [@Evan\_W](https://discuss.elastic.co/u/Evan_W)\ **Replies:** 5\ **Last updated:** [June 15, 2021, 3:28pm UTC](https://discuss.elastic.co/t/overwrite-timestamp-with-log-timestamp/275713 "2021-06-15T15:28:47Z")
As the title says, I'm looking to overwrite ingest timestamp to reflect the actual timestamp pulled from log data. I've already got a custom regex that can pull this timestamp out of my logs as its own unique field, but … --- ## [How would I parse further the syslog5424\_msg in a syslog event in logstash conf?](https://discuss.elastic.co/t/how-would-i-parse-further-the-syslog5424-msg-in-a-syslog-event-in-logstash-conf/275964)
**Author:** [@devashishsingh](https://discuss.elastic.co/u/devashishsingh)\ **Replies:** 4\ **Last updated:** [June 15, 2021, 2:47pm UTC](https://discuss.elastic.co/t/how-would-i-parse-further-the-syslog5424-msg-in-a-syslog-event-in-logstash-conf/275964 "2021-06-15T14:47:54Z")
Hello, I have parsed the XML log format coming from a syslog source as defined in logstash config file. What shall be done further to parse the syslog message field within the XML? Below is the config: input { tcp … --- ## [Request Body is Required](https://discuss.elastic.co/t/request-body-is-required/275691)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 3\ **Last updated:** [June 15, 2021, 2:41pm UTC](https://discuss.elastic.co/t/request-body-is-required/275691 "2021-06-15T14:41:50Z")
I am attempting to use the reindex API to combine indices for the month into one single index: POST \_reindex?pretty { "conflicts": "proceed", "source": { "index": "my-index-2021.04.\*" }, "dest": { "index… --- ## [Nested field size script](https://discuss.elastic.co/t/nested-field-size-script/276013)
**Author:** [@tfe2012](https://discuss.elastic.co/u/tfe2012)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 2:06pm UTC](https://discuss.elastic.co/t/nested-field-size-script/276013 "2021-06-15T14:06:35Z")
Hi, I try to get all documents which nested field size \> 1 my mapping: "selectStatsListNested" : { "type" : "nested", "properties" : { "isSampleSelect" : { "type" : "boolea… --- ## [I would like to concatenate date and time fields with logstash](https://discuss.elastic.co/t/i-would-like-to-concatenate-date-and-time-fields-with-logstash/275992)
**Author:** [@sudo-ranjith](https://discuss.elastic.co/u/sudo-ranjith)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 2:05pm UTC](https://discuss.elastic.co/t/i-would-like-to-concatenate-date-and-time-fields-with-logstash/275992 "2021-06-15T14:05:52Z")
Hi There, I have two fields date and time("10/26/20","09:30:53"). My Grok patterns are "%{DATA:date}","%{DATA:time}" I would like to concatenate these two fields as datetime, Could you please help me on the same. --- ## [Configure logstash to recieve logs from Openshift 4 and fluentdForward](https://discuss.elastic.co/t/configure-logstash-to-recieve-logs-from-openshift-4-and-fluentdforward/276012)
**Author:** [@sudden74](https://discuss.elastic.co/u/sudden74)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 2:00pm UTC](https://discuss.elastic.co/t/configure-logstash-to-recieve-logs-from-openshift-4-and-fluentdforward/276012 "2021-06-15T14:00:41Z")
We have configured the fluentdForward on Openshift 4.7 to send logs to an external ELK stack. Logs are arriving to logstash but we are not able to decode the messages correctly. It looks like the special characters are r… --- ## [Is it necessary to give only elasticsearch master nodes in kibana config](https://discuss.elastic.co/t/is-it-necessary-to-give-only-elasticsearch-master-nodes-in-kibana-config/275543)
**Author:** [@elk11](https://discuss.elastic.co/u/elk11)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 1:57pm UTC](https://discuss.elastic.co/t/is-it-necessary-to-give-only-elasticsearch-master-nodes-in-kibana-config/275543 "2021-06-15T13:57:55Z")
Elasticsearch and Kibana version: 7.3.1 I'm deploying Elasticsearch (3 nodes) and Kibana on docker. node1: elasticsearch master(data) and kibana node2: elasticsearch (data) node3: elasticsearch (data) our kibana con… --- ## [Performance Downgrade, after upgrading from 6.4 to 7.7](https://discuss.elastic.co/t/performance-downgrade-after-upgrading-from-6-4-to-7-7/274861)
**Author:** [@chintushah46](https://discuss.elastic.co/u/chintushah46)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 12:30pm UTC](https://discuss.elastic.co/t/performance-downgrade-after-upgrading-from-6-4-to-7-7/274861 "2021-06-15T12:30:41Z")
I am seeing a huge performance downgrade after upgrading Elasticsearch from version 6.4 to 7.7. Query Sample: {"size": 1000000,"from": 0,"track\_total\_hits": true,"query": {"bool": {"filter": {"bool": {"should": \[{"boo… --- ## [Filter messages in logstash with different index](https://discuss.elastic.co/t/filter-messages-in-logstash-with-different-index/275990)
**Author:** [@learner21](https://discuss.elastic.co/u/learner21)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 11:45am UTC](https://discuss.elastic.co/t/filter-messages-in-logstash-with-different-index/275990 "2021-06-15T11:45:11Z")
I am getting 3 types of messages in logstash, based on that i need to parse and save in elasticSearch with 3 different index Message 1 =\> "2021-05-26T09:55:36.091040+00:00 10.13.14.11 \[S=294230650\] \[ID=fbf282:30:1115898… --- ## [Display Top 20 Results by Event Count](https://discuss.elastic.co/t/display-top-20-results-by-event-count/275492)
**Author:** [@nazevedo3](https://discuss.elastic.co/u/nazevedo3)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 11:32am UTC](https://discuss.elastic.co/t/display-top-20-results-by-event-count/275492 "2021-06-15T11:32:31Z")
Hi All, I have a dataset that returns data that includes a networks ASN. I'd like to be able to visualize a set of specific ASNs AND the top 20 of all other ASNs in my dataset based on event count. Any suggestions on … --- ## [Logstash multiple pipelines](https://discuss.elastic.co/t/logstash-multiple-pipelines/275984)
**Author:** [@sreedhar1](https://discuss.elastic.co/u/sreedhar1)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 11:25am UTC](https://discuss.elastic.co/t/logstash-multiple-pipelines/275984 "2021-06-15T11:25:30Z")
Hi All, I am using Logstash to populate data from sql server to Elasticsearch. I have created multiple .conf files to populate data in ES. Created pipeline to run all these .conf files. Question: do we need to create m… --- ## [Is it possible to leave the dashboard always fullscreen or hide the query part?](https://discuss.elastic.co/t/is-it-possible-to-leave-the-dashboard-always-fullscreen-or-hide-the-query-part/275702)
**Author:** [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 11:11am UTC](https://discuss.elastic.co/t/is-it-possible-to-leave-the-dashboard-always-fullscreen-or-hide-the-query-part/275702 "2021-06-15T11:11:02Z")
Is it possible to leave the dashboard always fullscreen or hide the query part? as follows in the image. --- ## [Kibana Report Error: Failed to decrypt report job data](https://discuss.elastic.co/t/kibana-report-error-failed-to-decrypt-report-job-data/275657)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 10:56am UTC](https://discuss.elastic.co/t/kibana-report-error-failed-to-decrypt-report-job-data/275657 "2021-06-15T10:56:05Z")
Hi there, I am facing following error each time I want to generate a CSV Report from Kibana Discover Module. Either immediately or after some time (like 30 seconds or so) I see following Error: Error: Failed to decryp… --- ## [Pods not finding PVC when using storage class with Retain reclaim policy](https://discuss.elastic.co/t/pods-not-finding-pvc-when-using-storage-class-with-retain-reclaim-policy/275835)
**Author:** [@pkaramol](https://discuss.elastic.co/u/pkaramol)\ **Replies:** 4\ **Last updated:** [June 15, 2021, 10:51am UTC](https://discuss.elastic.co/t/pods-not-finding-pvc-when-using-storage-class-with-retain-reclaim-policy/275835 "2021-06-15T10:51:02Z")
I am using in an Elasticsearch instance, a StorageClass that has Retain (instead of Delete) as its reclaim policy. Here are my PVCs before deleting the Elasticsearch instance ▶ k get pvc NAME … --- ## [Have not access to labs of Engineer 1](https://discuss.elastic.co/t/have-not-access-to-labs-of-engineer-1/275780)
**Author:** [@Donyez.Abdennadher](https://discuss.elastic.co/u/Donyez.Abdennadher)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 10:39am UTC](https://discuss.elastic.co/t/have-not-access-to-labs-of-engineer-1/275780 "2021-06-15T10:39:48Z")
Hi, I have done Engineer 1 (on demand) courses, and now I'm learning engineer 2 (on-demand) courses. I tried to access to labs of Engineer 1 but I have not access. I need to have the instructions lab and the correct… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=912) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=914)