# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=942 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 943 --- ## [Grok and curly brackets](https://discuss.elastic.co/t/grok-and-curly-brackets/273491)
**Author:** [@vaclav1](https://discuss.elastic.co/u/vaclav1)\ **Replies:** 1\ **Last updated:** [May 20, 2021, 10:36am UTC](https://discuss.elastic.co/t/grok-and-curly-brackets/273491 "2021-05-20T10:36:25Z")
Dear team, I have a grok filter which needs to parse following part of line from the Haproxy logs: {\*/\*||en-US|10.12.132.200:30012||||1997-04-09-17.02.03.246664|pclient\_us} Now how do I remove the brackets from beginn… --- ## [Reindex version conflict](https://discuss.elastic.co/t/reindex-version-conflict/273352)
**Author:** [@alexs1](https://discuss.elastic.co/u/alexs1)\ **Replies:** 4\ **Last updated:** [May 20, 2021, 10:35am UTC](https://discuss.elastic.co/t/reindex-version-conflict/273352 "2021-05-20T10:35:19Z")
Hello, What is exactly a version conflict ? An example will be appreciated. Thank you --- ## [Export to csv/excel from kibana](https://discuss.elastic.co/t/export-to-csv-excel-from-kibana/39237)
**Author:** [@jsp08](https://discuss.elastic.co/u/jsp08)\ **Replies:** 15\ **Last updated:** [May 20, 2021, 9:58am UTC](https://discuss.elastic.co/t/export-to-csv-excel-from-kibana/39237 "2021-05-20T09:58:46Z")
I have the dashboard with the graphs working without any issue. One of the requirements for my project is the ability to download the file(csv/excel). In kibana the only option i saw for downloading the file is by click… --- ## [Range-Query not working l](https://discuss.elastic.co/t/range-query-not-working-l/273496)
**Author:** [@Rammi22](https://discuss.elastic.co/u/Rammi22)\ **Replies:** 3\ **Last updated:** [May 20, 2021, 9:49am UTC](https://discuss.elastic.co/t/range-query-not-working-l/273496 "2021-05-20T09:49:42Z")
Hello, I use: Elasticsearch-PHP ElasticsearchDSL Configurated search query: array(2) { \["index"\]=\> string(19) "my\_index\_\*" \["body"\]=\> array(4) { \["query"\]=\> array(1) { \["range"\]=\> array(… --- ## [Elasticsearch - added LDAP authentication, node won't start](https://discuss.elastic.co/t/elasticsearch-added-ldap-authentication-node-wont-start/273499)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 2\ **Last updated:** [May 20, 2021, 9:44am UTC](https://discuss.elastic.co/t/elasticsearch-added-ldap-authentication-node-wont-start/273499 "2021-05-20T09:44:13Z")
Dears, ELK 7.7.0 With bellow configuration my node won't start: cluster.name: elkcluster node.name: elkcluster01 path.data: /var/lib/elasticsearch path.logs: /var/log/elasticsearch network.host: 10.10.10.1 http.port: … --- ## [Uptime smtp connector?](https://discuss.elastic.co/t/uptime-smtp-connector/272897)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 2\ **Last updated:** [May 20, 2021, 9:26am UTC](https://discuss.elastic.co/t/uptime-smtp-connector/272897 "2021-05-20T09:26:29Z")
In Kibana Alerts and Actions there is a SMTP connector however for some reason you can't add a SMTP to Uptime? --- ## [GROK: help with pattern](https://discuss.elastic.co/t/grok-help-with-pattern/273396)
**Author:** [@Guillermo\_Valles\_Cas](https://discuss.elastic.co/u/Guillermo_Valles_Cas)\ **Replies:** 3\ **Last updated:** [May 20, 2021, 9:18am UTC](https://discuss.elastic.co/t/grok-help-with-pattern/273396 "2021-05-20T09:18:38Z")
Hello!! I'm trying to get the pattern of a file in Logstash with GROK, but I do not know how to make it. The line I want to GROK is: {"type":"log","@timestamp":"2021-05-19T08:45:42+02:00","tags":\["info","plugins","actio… --- ## [Logstash unparsed events exceptions](https://discuss.elastic.co/t/logstash-unparsed-events-exceptions/273495)
**Author:** [@ima](https://discuss.elastic.co/u/ima)\ **Replies:** 0\ **Last updated:** [May 20, 2021, 8:55am UTC](https://discuss.elastic.co/t/logstash-unparsed-events-exceptions/273495 "2021-05-20T08:55:10Z")
Hello, is there anybody who knows where I can find logstash events exceptions and what other healthchecks should I do for logstash --- ## ["Unknown" logs in observability overview](https://discuss.elastic.co/t/unknown-logs-in-observability-overview/273240)
**Author:** [@mar-ro](https://discuss.elastic.co/u/mar-ro)\ **Replies:** 3\ **Last updated:** [May 20, 2021, 8:29am UTC](https://discuss.elastic.co/t/unknown-logs-in-observability-overview/273240 "2021-05-20T08:29:58Z")
Good morning. When I click on the menu called "Observability Overview" it shows me an image with "Logs per minute rate" but all the bars in this image appear as "Unknown". I was searching in this forum and I could find a… --- ## [Changing the score of the results based on a field's value \[Java\]](https://discuss.elastic.co/t/changing-the-score-of-the-results-based-on-a-fields-value-java/273490)
**Author:** [@oasis\_agano](https://discuss.elastic.co/u/oasis_agano)\ **Replies:** 0\ **Last updated:** [May 20, 2021, 8:11am UTC](https://discuss.elastic.co/t/changing-the-score-of-the-results-based-on-a-fields-value-java/273490 "2021-05-20T08:11:13Z")
I am trying to change the order of the results based on a keyword field. something similar to this but with the java client. { "query": { "function\_score": { "functions": \[ { … --- ## [Want to find all document in elastic search in Node JS using aggregation](https://discuss.elastic.co/t/want-to-find-all-document-in-elastic-search-in-node-js-using-aggregation/273281)
**Author:** [@Anjali\_Gupta](https://discuss.elastic.co/u/Anjali_Gupta)\ **Replies:** 5\ **Last updated:** [May 20, 2021, 7:53am UTC](https://discuss.elastic.co/t/want-to-find-all-document-in-elastic-search-in-node-js-using-aggregation/273281 "2021-05-20T07:53:37Z")
Here is my code, i have lakhs of document in transactions\_development index and in below code I am getting only 10 hits inside body but I want to fetch lakhs of hits const totalDebited = await esClient.search({ index: … --- ## [How to access term\_vectors (payloads) from painless script](https://discuss.elastic.co/t/how-to-access-term-vectors-payloads-from-painless-script/273481)
**Author:** [@JF2018](https://discuss.elastic.co/u/JF2018)\ **Replies:** 0\ **Last updated:** [May 20, 2021, 7:30am UTC](https://discuss.elastic.co/t/how-to-access-term-vectors-payloads-from-painless-script/273481 "2021-05-20T07:30:35Z")
Hi I am using elastic 7.5.2. I have seen multiple examples on how to access term\_vectors (payloads) via groovy scripts. I though only have painless scripting available, so any help on how to access term\_vectors (payload… --- ## [Cpu utilization 100 percent - Elasticsearch](https://discuss.elastic.co/t/cpu-utilization-100-percent-elasticsearch/273291)
**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Replies:** 4\ **Last updated:** [May 20, 2021, 7:23am UTC](https://discuss.elastic.co/t/cpu-utilization-100-percent-elasticsearch/273291 "2021-05-20T07:23:10Z")
My monitoring cluster is showing 99 percent Cpu usage during writes. Is it normal? If it's a 4 cpu node, does it mean that max is 400 percent? --- ## [Event based data pushing](https://discuss.elastic.co/t/event-based-data-pushing/273478)
**Author:** [@Abhishek\_Chauhan](https://discuss.elastic.co/u/Abhishek_Chauhan)\ **Replies:** 0\ **Last updated:** [May 20, 2021, 7:22am UTC](https://discuss.elastic.co/t/event-based-data-pushing/273478 "2021-05-20T07:22:14Z")
Hello guys, I have deployed logstash to push data from postgres to elasticsearch but as the quantity of data has increased, pushing thousands of rows(all data in that db) every 60 seconds just for a small change or addi… --- ## [Load more than 1 million row from SQL Server to ES with Logstash JDBC](https://discuss.elastic.co/t/load-more-than-1-million-row-from-sql-server-to-es-with-logstash-jdbc/273476)
**Author:** [@Dai\_Thai\_Hoa\_Vo](https://discuss.elastic.co/u/Dai_Thai_Hoa_Vo)\ **Replies:** 0\ **Last updated:** [May 20, 2021, 7:06am UTC](https://discuss.elastic.co/t/load-more-than-1-million-row-from-sql-server-to-es-with-logstash-jdbc/273476 "2021-05-20T07:06:36Z")
Hi every onne. I have a trouble when load the tables SalesTrans has more than 1 million rows. I used logstash to load them into ES. It works fine but very slow. Please any one support to me. Thank you. --- ## [Grok make log missing](https://discuss.elastic.co/t/grok-make-log-missing/273255)
**Author:** [@DawitCh](https://discuss.elastic.co/u/DawitCh)\ **Replies:** 4\ **Last updated:** [May 20, 2021, 6:53am UTC](https://discuss.elastic.co/t/grok-make-log-missing/273255 "2021-05-20T06:53:07Z")
Here is my example log \<134\>May 24 17:15:52 asdsgag.com 1,yyyy/mm/dd 17:15:52,001801056715,TRAFFIC,end,1,yyyy/mm/dd 17:15:52,xxx.xxx.xxx.xxx,xxx.xxx.xxx.xxx,0.0.0.0,0.0.0.0,TEST,,,incomplete,local1,wifi,office,cd5.32,rt… --- ## [Index Patterns containing frozen indices](https://discuss.elastic.co/t/index-patterns-containing-frozen-indices/273471)
**Author:** [@leemase004](https://discuss.elastic.co/u/leemase004)\ **Replies:** 0\ **Last updated:** [May 20, 2021, 5:52am UTC](https://discuss.elastic.co/t/index-patterns-containing-frozen-indices/273471 "2021-05-20T05:52:58Z")
We have noticed on our system that our search\_throttled thread pool has an extremely high number of rejected request. Each node has about ~4k-6k. To my understanding, the search\_throttled thread pool is reserved specifi… --- ## [Why does Logstash's https communication work without OpenSSL?](https://discuss.elastic.co/t/why-does-logstashs-https-communication-work-without-openssl/273460)
**Author:** [@TakaSeki](https://discuss.elastic.co/u/TakaSeki)\ **Replies:** 2\ **Last updated:** [May 20, 2021, 5:25am UTC](https://discuss.elastic.co/t/why-does-logstashs-https-communication-work-without-openssl/273460 "2021-05-20T05:25:19Z")
I'm running logstash using docker on CentOS7. Openssl is not installed on CentOS 7 and docker containers. However, logstash input https communication is working. Why is this? Does logstash include openssl functionali… --- ## [Display piechart](https://discuss.elastic.co/t/display-piechart/273463)
**Author:** [@gregory7](https://discuss.elastic.co/u/gregory7)\ **Replies:** 2\ **Last updated:** [May 20, 2021, 4:21am UTC](https://discuss.elastic.co/t/display-piechart/273463 "2021-05-20T04:21:41Z")
Hi, I'm trying to display pie chart, but little guide for me, so I'm asking your help. I built up elasticsearch index as follows {id:1,group:fruit,item:apple,sold:Y,yymm:202105} {id:2,group:fruit,item:banana,sold:Y,y… --- ## [Help with http http\_poller input plugin](https://discuss.elastic.co/t/help-with-http-http-poller-input-plugin/273226)
**Author:** [@jeromeat](https://discuss.elastic.co/u/jeromeat)\ **Replies:** 2\ **Last updated:** [May 20, 2021, 3:28am UTC](https://discuss.elastic.co/t/help-with-http-http-poller-input-plugin/273226 "2021-05-20T03:28:11Z")
I can pull json data using the following curl command successfully: curl -H "Api-Token: xxxxxxxxxx" -H "Api-Secret: xxxxxxxxxxxxxxx" https://site.cyz10.local:443/api/v1/tags?page=1&page\_size=10&type=ip Below is the con… --- ## [Elasticsearch slow query log pattern too big](https://discuss.elastic.co/t/elasticsearch-slow-query-log-pattern-too-big/273462)
**Author:** [@Izek](https://discuss.elastic.co/u/Izek)\ **Replies:** 0\ **Last updated:** [May 20, 2021, 2:15am UTC](https://discuss.elastic.co/t/elasticsearch-slow-query-log-pattern-too-big/273462 "2021-05-20T02:15:55Z")
I try to debug on the slow query but found out that all the slow query logs pattern are corrupt and cannot be parse by filebeat. Is there any way to increase the pattern size Below is the example, I cut most of the det… --- ## [The problems of memory of ES7.12](https://discuss.elastic.co/t/the-problems-of-memory-of-es7-12/273461)
**Author:** [@lichuandev](https://discuss.elastic.co/u/lichuandev)\ **Replies:** 1\ **Last updated:** [May 20, 2021, 2:10am UTC](https://discuss.elastic.co/t/the-problems-of-memory-of-es7-12/273461 "2021-05-20T02:10:04Z")
I use ES to store files, and the size of each file is within 100kb. The following two problems encountered in the use process have not been solved: 1.We set the requests cache: false, and the memory will still slowly re… --- ## [Best practices/recommendations for structuring log indices for a lot of apps](https://discuss.elastic.co/t/best-practices-recommendations-for-structuring-log-indices-for-a-lot-of-apps/273254)
**Author:** [@lancer\_enkor](https://discuss.elastic.co/u/lancer_enkor)\ **Replies:** 1\ **Last updated:** [May 20, 2021, 1:52am UTC](https://discuss.elastic.co/t/best-practices-recommendations-for-structuring-log-indices-for-a-lot-of-apps/273254 "2021-05-20T01:52:32Z")
Hi, I'm building an ES cluster for application logs. The problem is that we have a lot of apps and a lot of environments. Every app and every env can have different retention times, so I can have let say over 100 apps t… --- ## [How to perform nested aggregation in child parent relationship](https://discuss.elastic.co/t/how-to-perform-nested-aggregation-in-child-parent-relationship/273372)
**Author:** [@Waseem\_Farooqui](https://discuss.elastic.co/u/Waseem_Farooqui)\ **Replies:** 0\ **Last updated:** [May 19, 2021, 8:02am UTC](https://discuss.elastic.co/t/how-to-perform-nested-aggregation-in-child-parent-relationship/273372 "2021-05-19T08:02:52Z")
Hi, I am using elasticsearch 7.11 and have implemented parent child relation on of the base reason was my updates were very frequent and time a new child could be added under 1 parent, My project is something managing … --- ## [Format mail send from siem detection threshold rule](https://discuss.elastic.co/t/format-mail-send-from-siem-detection-threshold-rule/273375)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 2\ **Last updated:** [May 20, 2021, 1:37am UTC](https://discuss.elastic.co/t/format-mail-send-from-siem-detection-threshold-rule/273375 "2021-05-20T01:37:34Z")
Hi all I have successfully config for siem to send alert mail and now when i tried it with the theashold rule it failed. So i want to ask how to format theashold rule mail to send infomation. The format that i tried i… --- ## [Getting error while setting up alters system in kibana](https://discuss.elastic.co/t/getting-error-while-setting-up-alters-system-in-kibana/273449)
**Author:** [@Umesh\_Kumar\_Sah](https://discuss.elastic.co/u/Umesh_Kumar_Sah)\ **Replies:** 1\ **Last updated:** [May 19, 2021, 11:08pm UTC](https://discuss.elastic.co/t/getting-error-while-setting-up-alters-system-in-kibana/273449 "2021-05-19T23:08:47Z")
Can anyone plz help me out this issue? May 20 02:41:18 devopsengineering systemd\[1\]: kibana.service: Scheduled restart job, restart counter is at 1. May 20 02:41:18 devopsengineering systemd\[1\]: Stopped Kibana. May 20… --- ## [SSL certificate in email output plugin logstash](https://discuss.elastic.co/t/ssl-certificate-in-email-output-plugin-logstash/273450)
**Author:** [@jrojasp95](https://discuss.elastic.co/u/jrojasp95)\ **Replies:** 4\ **Last updated:** [May 19, 2021, 10:20pm UTC](https://discuss.elastic.co/t/ssl-certificate-in-email-output-plugin-logstash/273450 "2021-05-19T22:20:38Z")
Hi I am trying to use the email output plugin in logstash but I can't get it to work on the server with docker, on localhost it works with port 587 but on the server I get an OpenSSL hostname not match with ssl certifica… --- ## [Sort by a field containing array of strings with sort mode min](https://discuss.elastic.co/t/sort-by-a-field-containing-array-of-strings-with-sort-mode-min/273215)
**Author:** [@curlyheads](https://discuss.elastic.co/u/curlyheads)\ **Replies:** 1\ **Last updated:** [May 19, 2021, 9:57pm UTC](https://discuss.elastic.co/t/sort-by-a-field-containing-array-of-strings-with-sort-mode-min/273215 "2021-05-19T21:57:54Z")
Hi everybody, I want to sort the following example documents by the first array value of the field "name": curl -X PUT "localhost:9200/my-index-000001/\_doc/1?refresh&pretty" -H 'Content-Type: application/json' -d' { … --- ## [\_grokparsefailure](https://discuss.elastic.co/t/grokparsefailure/273447)
**Author:** [@legolas\_bilbao](https://discuss.elastic.co/u/legolas_bilbao)\ **Replies:** 0\ **Last updated:** [May 19, 2021, 9:11pm UTC](https://discuss.elastic.co/t/grokparsefailure/273447 "2021-05-19T21:11:47Z")
Good night, I've use the dev tools for deploy the grook rule for squid logs The config file is the following input { file { path =\> "/var/elastik/access.log" start\_position =\> "beginning" } } filter { grok { … --- ## [This interval creates too many buckets to show in the selected time rage](https://discuss.elastic.co/t/this-interval-creates-too-many-buckets-to-show-in-the-selected-time-rage/273001)
**Author:** [@Hamza\_El\_Aouane](https://discuss.elastic.co/u/Hamza_El_Aouane)\ **Replies:** 27\ **Last updated:** [May 19, 2021, 8:29pm UTC](https://discuss.elastic.co/t/this-interval-creates-too-many-buckets-to-show-in-the-selected-time-rage/273001 "2021-05-19T20:29:17Z")
Hello guys. I have set a elastic search and kibana to receive some syslogs from our OnPrem server. When I go to the discover section and set the time range to refresh every second. I got the warning This interval crea… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=941) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=943)