# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=917 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 918 --- ## [Logstash drop based on size](https://discuss.elastic.co/t/logstash-drop-based-on-size/275610)
**Author:** [@mcosta](https://discuss.elastic.co/u/mcosta)\ **Replies:** 2\ **Last updated:** [June 11, 2021, 9:11pm UTC](https://discuss.elastic.co/t/logstash-drop-based-on-size/275610 "2021-06-11T21:11:12Z")
Hi all, Is it possible to drop a message based on it's size (ex: above 1 MB)? I'm reading from tcp port and writing into Kafka topic. All messages bigger then 1 MB give errors similar to this and then logstash retry t… --- ## [Parsing csv file through Logstash](https://discuss.elastic.co/t/parsing-csv-file-through-logstash/274792)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 17\ **Last updated:** [June 11, 2021, 9:01pm UTC](https://discuss.elastic.co/t/parsing-csv-file-through-logstash/274792 "2021-06-11T21:01:28Z")
Hi All, I am running ELK stack 7.6.2. I need to parse a csv through Logstash. My logstash conf file looks like this: input { file { path =\> "/opt/gtal/ictal/elasticsearch/app/logstash/stage/STATS-01062021.txt" … --- ## [Aggregration Filter doesnt seem to work](https://discuss.elastic.co/t/aggregration-filter-doesnt-seem-to-work/275182)
**Author:** [@kapso](https://discuss.elastic.co/u/kapso)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 8:58pm UTC](https://discuss.elastic.co/t/aggregration-filter-doesnt-seem-to-work/275182 "2021-06-11T20:58:30Z")
I have document of type blog posts, here's what an example looks like Input: \[ { "id": 1, "post\_title": "Title 1", "published\_on": "2021-06-07", "tag\_ids": \[1, 2\], "authors": \[ { "id… --- ## [Bucket selector Kibana Data table visualization](https://discuss.elastic.co/t/bucket-selector-kibana-data-table-visualization/275573)
**Author:** [@theDor](https://discuss.elastic.co/u/theDor)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 8:53pm UTC](https://discuss.elastic.co/t/bucket-selector-kibana-data-table-visualization/275573 "2021-06-11T20:53:05Z")
Hello to every one, I have a simple data table visualization that using the sum metric on a field and displaying the results in a data table. Now my goal is to display only results that the sum is greater than X value.… --- ## [Possible bug in completion context suggester (6.8 and 7.10)](https://discuss.elastic.co/t/possible-bug-in-completion-context-suggester-6-8-and-7-10/275718)
**Author:** [@bklippel](https://discuss.elastic.co/u/bklippel)\ **Replies:** 0\ **Last updated:** [June 11, 2021, 8:10pm UTC](https://discuss.elastic.co/t/possible-bug-in-completion-context-suggester-6-8-and-7-10/275718 "2021-06-11T20:10:22Z")
Hi, I've come across some strange behavior using the completion suggest. In my scenario it seems that inputs over ~34 characters are ignored. I have steps to reproduce. Create this index, post this doc then try the qu… --- ## [Cannot start elastic search server](https://discuss.elastic.co/t/cannot-start-elastic-search-server/275700)
**Author:** [@elastic0](https://discuss.elastic.co/u/elastic0)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 8:08pm UTC](https://discuss.elastic.co/t/cannot-start-elastic-search-server/275700 "2021-06-11T20:08:02Z")
I downloaded elasticsearch-7.13.1-windows-x86\_64.zip, but when I run elasticsearch-service-x64.exe it immediately crashes briefly flashing a blank window. If I run elasticsearch.bat, it gets the following exception. un… --- ## [Kibana uses the kbn-version and kbn-name headers to prevent XSRF attacks](https://discuss.elastic.co/t/kibana-uses-the-kbn-version-and-kbn-name-headers-to-prevent-xsrf-attacks/275665)
**Author:** [@ravi\_yadav2](https://discuss.elastic.co/u/ravi_yadav2)\ **Replies:** 2\ **Last updated:** [June 11, 2021, 7:36pm UTC](https://discuss.elastic.co/t/kibana-uses-the-kbn-version-and-kbn-name-headers-to-prevent-xsrf-attacks/275665 "2021-06-11T19:36:58Z")
Could anyone please explain how Kibana uses the kbn-version and kbn-name headers to prevent XSRF attacks. --- ## [How do I read data from influxdb](https://discuss.elastic.co/t/how-do-i-read-data-from-influxdb/275711)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 7:22pm UTC](https://discuss.elastic.co/t/how-do-i-read-data-from-influxdb/275711 "2021-06-11T19:22:52Z")
I have a need to read data from influxdb. anyone has done this before can you give me example of input plugin for that? --- ## [How to replace @timestamp field in logstash aggregate filter map](https://discuss.elastic.co/t/how-to-replace-timestamp-field-in-logstash-aggregate-filter-map/275708)
**Author:** [@jratliff](https://discuss.elastic.co/u/jratliff)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 7:13pm UTC](https://discuss.elastic.co/t/how-to-replace-timestamp-field-in-logstash-aggregate-filter-map/275708 "2021-06-11T19:13:49Z")
I'm using the logstash aggregate filter. When the map is pushed upon timeout, I want to set the @timestamp field to be a specific valu. I've tried using timeout\_code =\> event.set('@timestamp', "2021-06-10T19:00:00.000Z"… --- ## [Ingest Pipeline for routing data into 2 different indexes](https://discuss.elastic.co/t/ingest-pipeline-for-routing-data-into-2-different-indexes/228189)
**Author:** [@Mack\_rogers](https://discuss.elastic.co/u/Mack_rogers)\ **Replies:** 3\ **Last updated:** [June 11, 2021, 7:13pm UTC](https://discuss.elastic.co/t/ingest-pipeline-for-routing-data-into-2-different-indexes/228189 "2021-06-11T19:13:38Z")
How can you write into 2 different indexes using a ingest pipeline? Example. a single doc with fields a , b, c, and d ? index A will receive fields A & B index B will receive fields C & D How can I accomplish this wi… --- ## [Console use to find new accounts created](https://discuss.elastic.co/t/console-use-to-find-new-accounts-created/275709)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 0\ **Last updated:** [June 11, 2021, 6:29pm UTC](https://discuss.elastic.co/t/console-use-to-find-new-accounts-created/275709 "2021-06-11T18:29:36Z")
Good Afternoon. I have now been using and testing Elastic Stack for over a month and have been able to get pretty far in it. I am working with WinLogBeats, FileBeats and MetricBeats (All at version 7.12.1)now and one … --- ## [Shards](https://discuss.elastic.co/t/shards/275554)
**Author:** [@Abhishek\_Shinde](https://discuss.elastic.co/u/Abhishek_Shinde)\ **Replies:** 3\ **Last updated:** [June 11, 2021, 6:14pm UTC](https://discuss.elastic.co/t/shards/275554 "2021-06-11T18:14:23Z")
I was referring to following for sizing the shards, I referred the following sections in the article, #Aim for shard sizes between 10GB and 50GB #Aim for 20 shards or fewer per GB of heap memory I wanted to understa… --- ## [Kv filter has no support for this type of data {:type=\>Hash, :value=\>{"METHODNAME"=\>](https://discuss.elastic.co/t/kv-filter-has-no-support-for-this-type-of-data-type-hash-value-methodname/275659)
**Author:** [@Chandana](https://discuss.elastic.co/u/Chandana)\ **Replies:** 2\ **Last updated:** [June 11, 2021, 5:56pm UTC](https://discuss.elastic.co/t/kv-filter-has-no-support-for-this-type-of-data-type-hash-value-methodname/275659 "2021-06-11T17:56:38Z")
Can some please help me to parse the below log, I need the key-value pairs in DEBUGMESSAGE as my fields. Here is my sample logs snippet: {"thread":"default task-131","TimeStamp":"06/08/2021:00:58:02,848-08:00","level":… --- ## [Force logstash to recreate/ update the same index](https://discuss.elastic.co/t/force-logstash-to-recreate-update-the-same-index/275705)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 0\ **Last updated:** [June 11, 2021, 5:23pm UTC](https://discuss.elastic.co/t/force-logstash-to-recreate-update-the-same-index/275705 "2021-06-11T17:23:50Z")
Hello. I need to force logstash to recreate (re-read) the "same" index and update it. Is there an option for that? Please guide for ELK stack 7.6.2 Thanks --- ## [How to pass user credential to REST api?](https://discuss.elastic.co/t/how-to-pass-user-credential-to-rest-api/275562)
**Author:** [@Ashwin\_Srivastav](https://discuss.elastic.co/u/Ashwin_Srivastav)\ **Replies:** 5\ **Last updated:** [June 11, 2021, 4:44pm UTC](https://discuss.elastic.co/t/how-to-pass-user-credential-to-rest-api/275562 "2021-06-11T16:44:56Z")
I have coded a REST api which basically inserts, gets and updates the data from Elasticsearch. After implementing the basic security when I pass a curl command to the api providing credentials along with it (using -u), I… --- ## [Does ECK supports cert manger](https://discuss.elastic.co/t/does-eck-supports-cert-manger/275561)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 3\ **Last updated:** [June 11, 2021, 4:35pm UTC](https://discuss.elastic.co/t/does-eck-supports-cert-manger/275561 "2021-06-11T16:35:32Z")
Instead of operator generator certificates, Can we use cert manager to take care of certificates. I was following the below documentation Custom HTTP certificate | Elastic Cloud on Kubernetes \[1.6\] | Elastic. I have t… --- ## [After kubernetes node restart, data pods couldn't join the cluster again](https://discuss.elastic.co/t/after-kubernetes-node-restart-data-pods-couldnt-join-the-cluster-again/242959)
**Author:** [@igoragueme](https://discuss.elastic.co/u/igoragueme)\ **Replies:** 1\ **Last updated:** [July 29, 2020, 8:52am UTC](https://discuss.elastic.co/t/after-kubernetes-node-restart-data-pods-couldnt-join-the-cluster-again/242959 "2020-07-29T08:52:08Z")
Hello, I'm facing an issue with my elasticsearch cluster. I have 9 pods running in 3 nodes on my kubernetes cluster. 3 elasticsearch-client pod, 3 elasticsearch-data pod, 3 elasticsearch-master pod. Here my YAML's … --- ## [Logstash Key store](https://discuss.elastic.co/t/logstash-key-store/275633)
**Author:** [@farciarz121](https://discuss.elastic.co/u/farciarz121)\ **Replies:** 7\ **Last updated:** [June 11, 2021, 12:42pm UTC](https://discuss.elastic.co/t/logstash-key-store/275633 "2021-06-11T12:42:24Z")
I am trying to improve my ELK security with logstash keystore. I am following instruction from this article: https://www.elastic.co/guide/en/logstash/current/keystore.html All instructions seems to be straight forward… --- ## [FTP repository](https://discuss.elastic.co/t/ftp-repository/274508)
**Author:** [@Chinedum\_Nwuzor](https://discuss.elastic.co/u/Chinedum_Nwuzor)\ **Replies:** 4\ **Last updated:** [June 11, 2021, 11:53am UTC](https://discuss.elastic.co/t/ftp-repository/274508 "2021-06-11T11:53:36Z")
Hello, I am trying to setup an FTP repository for my snapshots. However, it fails with an access denied error message. Please the ftp url I used ftp://username:password@host/ Kindly assist. --- ## [Сортировка результатов по максимальному числу совпадащих фильтров](https://discuss.elastic.co/t/topic/275406)
**Author:** [@itmariacchi](https://discuss.elastic.co/u/itmariacchi)\ **Replies:** 4\ **Last updated:** [June 11, 2021, 11:17am UTC](https://discuss.elastic.co/t/topic/275406 "2021-06-11T11:17:22Z")
Здравствуйте! Есть индекс специалистов, у специалистов есть, например, ключевые навыки (множественное поле). Пользователь в фильтре выбирает ключевые навыки - например, PHP, JS, Java. Так вот специалисты, у которых напр… --- ## [Elastic pipeline](https://discuss.elastic.co/t/elastic-pipeline/275679)
**Author:** [@stefanskv](https://discuss.elastic.co/u/stefanskv)\ **Replies:** 2\ **Last updated:** [June 11, 2021, 11:11am UTC](https://discuss.elastic.co/t/elastic-pipeline/275679 "2021-06-11T11:11:19Z")
Why after upgrade to 7.13 version, Elastic started using new Ingest Node Pipelines (for example filebeat-7.13.1-cisco-asa-asa-ftd-pipeline ). The thing is i have problem with parsing source ip field. Can I configure tha… --- ## [Is there a way of preventing all primary shards of an idex to be placed on the same ES node](https://discuss.elastic.co/t/is-there-a-way-of-preventing-all-primary-shards-of-an-idex-to-be-placed-on-the-same-es-node/275555)
**Author:** [@A\_B](https://discuss.elastic.co/u/A_B)\ **Replies:** 2\ **Last updated:** [June 11, 2021, 10:52am UTC](https://discuss.elastic.co/t/is-there-a-way-of-preventing-all-primary-shards-of-an-idex-to-be-placed-on-the-same-es-node/275555 "2021-06-11T10:52:06Z")
Hello, I have a 49 node ES cluster with roughly the same size storage on each node (900GB). Most indices have 3-5 primary shards. Indices and shards can be of very variable size. Every so often, all primary shards of o… --- ## [Getting \_split\_type\_failure and \_jsonparsefailure in my logstash pipeline using only 1 filter (elasticsearch)](https://discuss.elastic.co/t/getting-split-type-failure-and-jsonparsefailure-in-my-logstash-pipeline-using-only-1-filter-elasticsearch/275671)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 10:35am UTC](https://discuss.elastic.co/t/getting-split-type-failure-and-jsonparsefailure-in-my-logstash-pipeline-using-only-1-filter-elasticsearch/275671 "2021-06-11T10:35:59Z")
Hi, i have 2 pipelines Pipeline 1: input { elasticsearch {}} filter { split {} json {} } output { pipeline {} } Pipeline 2: input { pipeline {}} filter { elasticsearch {} } output { stdout {} } Pipelin 1 where … --- ## [Watchguard Firebox to Logstash](https://discuss.elastic.co/t/watchguard-firebox-to-logstash/275672)
**Author:** [@gygrill](https://discuss.elastic.co/u/gygrill)\ **Replies:** 0\ **Last updated:** [June 11, 2021, 10:24am UTC](https://discuss.elastic.co/t/watchguard-firebox-to-logstash/275672 "2021-06-11T10:24:08Z")
Hi, total newbie here. How do I send Firebox logs to logstash? Do a specific beat exists or is it another method required? thanks for any help --- ## [Rook ceph for Elastic Search](https://discuss.elastic.co/t/rook-ceph-for-elastic-search/275647)
**Author:** [@Sangamesh\_Patil](https://discuss.elastic.co/u/Sangamesh_Patil)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 9:50am UTC](https://discuss.elastic.co/t/rook-ceph-for-elastic-search/275647 "2021-06-11T09:50:19Z")
Hello, We are deploying elastic search on kubernetes farm and we have rook ceph as our distributed storage. I was going through earlier topic and there was enough reason than with ES being heavy used for File system. Bu… --- ## [Top-hits on aggregations](https://discuss.elastic.co/t/top-hits-on-aggregations/274959)
**Author:** [@romathonat](https://discuss.elastic.co/u/romathonat)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 7:25am UTC](https://discuss.elastic.co/t/top-hits-on-aggregations/274959 "2021-06-11T07:25:19Z")
Hello, I need to get the top-hits over an aggregation. In my use case I store SQL queries as documents (with different statistics like the time it tooks). Each querie is hashed, so that I can make an aggregation term o… --- ## [Facing issue on kibana](https://discuss.elastic.co/t/facing-issue-on-kibana/275652)
**Author:** [@SHRIANSH\_RASEKAR](https://discuss.elastic.co/u/SHRIANSH_RASEKAR)\ **Replies:** 0\ **Last updated:** [June 11, 2021, 7:02am UTC](https://discuss.elastic.co/t/facing-issue-on-kibana/275652 "2021-06-11T07:02:32Z")
HI, I am facing issue on kibana dashboard, charts are blank , also from 1 week data is not coming, can anyone help to get cause. Error: Too Many Requests at Fetch.\_callee3$ (http://1\*\*.\*\*\*.\*\*.\*\*:5601/31997/bundles/commo… --- ## [How to parse message use ELK+Kafka](https://discuss.elastic.co/t/how-to-parse-message-use-elk-kafka/275642)
**Author:** [@tod-yangyd](https://discuss.elastic.co/u/tod-yangyd)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 5:52am UTC](https://discuss.elastic.co/t/how-to-parse-message-use-elk-kafka/275642 "2021-06-11T05:52:25Z")
Recently I tried to analyzed the log with the stream：filebeat -\> kafka -\>logstash -\> ES The data stored in ES becomes the structure shown below： { “\_source”:{ “@timestamp” : "YYYY-MM-DDTHH:mm:ss.sss" … --- ## [How to do lookup based on Ip ranges](https://discuss.elastic.co/t/how-to-do-lookup-based-on-ip-ranges/275397)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 5:38am UTC](https://discuss.elastic.co/t/how-to-do-lookup-based-on-ip-ranges/275397 "2021-06-11T05:38:00Z")
Hi Team, I have requirement where I have to do lookup on ranges like, If Ip 10.10.x.xx to 10.10x.xxx matches then add fileds Firewall 10.12.xx.xx to 10.12.x.xxx matches then add fileds Application. Below is my logst… --- ## [NPX is giving npm ERR! cb.apply is not a function when making gz and br files](https://discuss.elastic.co/t/npx-is-giving-npm-err-cb-apply-is-not-a-function-when-making-gz-and-br-files/275285)
**Author:** [@mohammadawaisjavaid](https://discuss.elastic.co/u/mohammadawaisjavaid)\ **Replies:** 3\ **Last updated:** [June 11, 2021, 5:18am UTC](https://discuss.elastic.co/t/npx-is-giving-npm-err-cb-apply-is-not-a-function-when-making-gz-and-br-files/275285 "2021-06-11T05:18:43Z")
Whenever I try to run the following command to customize ELK 7.10.0 npx gzip-cli /usr/share/kibana/x-pack/plugins/security/target/public/security.chunk.4.js -e=gz -e=b I got the following error. npm ERR! cb.apply is n… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=916) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=918)