# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=956 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 957 --- ## [Variable content from file](https://discuss.elastic.co/t/variable-content-from-file/272296)
**Author:** [@emilsvil](https://discuss.elastic.co/u/emilsvil)\ **Replies:** 0\ **Last updated:** [May 6, 2021, 12:50pm UTC](https://discuss.elastic.co/t/variable-content-from-file/272296 "2021-05-06T12:50:46Z")
Hi. Im using cidr filter to check if an IP si public or private. The list of cidrs to check is now hardcoded in the filter but I need to read it from a file or using a meta-variable loaded at runtime. cidr { … --- ## [Getting single line from multiline](https://discuss.elastic.co/t/getting-single-line-from-multiline/272292)
**Author:** [@Learn\_Mulesoft\_With](https://discuss.elastic.co/u/Learn_Mulesoft_With)\ **Replies:** 0\ **Last updated:** [May 6, 2021, 12:35pm UTC](https://discuss.elastic.co/t/getting-single-line-from-multiline/272292 "2021-05-06T12:35:32Z")
hi , my message is like below Error type : VALIDATION:INVALID\_NUMBER FlowStack : at db-error-logFlow(db-error-logFlow/processors/0 @ db-error-log:db-error-log.xml:18 i want just single line " E… --- ## [Last record for each unique value](https://discuss.elastic.co/t/last-record-for-each-unique-value/271077)
**Author:** [@JeremyLoyd](https://discuss.elastic.co/u/JeremyLoyd)\ **Replies:** 2\ **Last updated:** [May 6, 2021, 11:11am UTC](https://discuss.elastic.co/t/last-record-for-each-unique-value/271077 "2021-05-06T11:11:15Z")
Hello, Our company changed to Elastic few months ago. before then we used to log a lot of things to one simple SQL table. in SQL i was able to find for each unique identifier last value that was recorded with simple Que… --- ## [Java plugin - Irrelevant JARs are loaded and cause conflicts](https://discuss.elastic.co/t/java-plugin-irrelevant-jars-are-loaded-and-cause-conflicts/272276)
**Author:** [@MosheElisha](https://discuss.elastic.co/u/MosheElisha)\ **Replies:** 0\ **Last updated:** [May 6, 2021, 10:20am UTC](https://discuss.elastic.co/t/java-plugin-irrelevant-jars-are-loaded-and-cause-conflicts/272276 "2021-05-06T10:20:55Z")
Hi, I am creating a Java input plugin that uses 'software.amazon.awssdk:s3:2.16.26' and libraries from manticore-0.7.0-java are loaded into my plugin and cause conflicts. After successful installation, when I try to us… --- ## [No alive nodes found in your cluster](https://discuss.elastic.co/t/no-alive-nodes-found-in-your-cluster/272216)
**Author:** [@chrisan](https://discuss.elastic.co/u/chrisan)\ **Replies:** 2\ **Last updated:** [May 6, 2021, 10:49am UTC](https://discuss.elastic.co/t/no-alive-nodes-found-in-your-cluster/272216 "2021-05-06T10:49:32Z")
I'm on Ubuntu 20.04 with Elasticsearch 7.10.2 (though this has happened in previous minor versions too) We have a PHP script that runs every night using 7.12.0 of the PHP SDK where it re-indexes live documents and delet… --- ## [Are nested docs efficiently skipped?](https://discuss.elastic.co/t/are-nested-docs-efficiently-skipped/271847)
**Author:** [@egalpin](https://discuss.elastic.co/u/egalpin)\ **Replies:** 4\ **Last updated:** [May 6, 2021, 10:44am UTC](https://discuss.elastic.co/t/are-nested-docs-efficiently-skipped/271847 "2021-05-06T10:44:35Z")
Hi all, I’m curious if anyone is able to comment on the handling of nested documents at query time. Are nested documents skipped over in the advance or nextDoc step, or must they also be considered if, for example, nest… --- ## [Control visualization](https://discuss.elastic.co/t/control-visualization/272158)
**Author:** [@graimato](https://discuss.elastic.co/u/graimato)\ **Replies:** 9\ **Last updated:** [May 6, 2021, 10:37am UTC](https://discuss.elastic.co/t/control-visualization/272158 "2021-05-06T10:37:59Z")
Dear all, it is possible to use Control visualization to filter on group of parameters? Suppose that there are: Test ServerTest-1 ServerTest-2 Prod ServerProd-1 ServerProd-2 It is possible to have Control … --- ## [Try to convert UTC timestamp to IST in logstash](https://discuss.elastic.co/t/try-to-convert-utc-timestamp-to-ist-in-logstash/272268)
**Author:** [@sudheendra](https://discuss.elastic.co/u/sudheendra)\ **Replies:** 0\ **Last updated:** [May 6, 2021, 9:36am UTC](https://discuss.elastic.co/t/try-to-convert-utc-timestamp-to-ist-in-logstash/272268 "2021-05-06T09:36:21Z")
Hi , I need to convert the log UTC to my local time in IST . Used ruby Filter to convert to local time . My filter in logstash.yaml file filter { ruby { code =\> "event.set('new\_date', event.get('\[@timestamp\]').time… --- ## [Can't parse after optionnal field has been set](https://discuss.elastic.co/t/cant-parse-after-optionnal-field-has-been-set/272253)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 2\ **Last updated:** [May 6, 2021, 8:40am UTC](https://discuss.elastic.co/t/cant-parse-after-optionnal-field-has-been-set/272253 "2021-05-06T08:40:42Z")
Hello ! I'm working on Cisco WSA logs. Some fields are optionnal. In particular, the filed which contains username infomation: sometimes we have "DOMAIN\\smith@AD" and sometimes we have just - When username is present, … --- ## [Log Segregation](https://discuss.elastic.co/t/log-segregation/272254)
**Author:** [@Mukund\_Anand](https://discuss.elastic.co/u/Mukund_Anand)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 8:34am UTC](https://discuss.elastic.co/t/log-segregation/272254 "2021-05-06T08:34:51Z")
Hi, I have requirement to segregate the logs what different users can see. I have a log file as a source with all the logs. But, half of those logs has to be seen by one user and other half has to be seen by the other u… --- ## [Events are lost when elasticsearch output is temporary unavailable](https://discuss.elastic.co/t/events-are-lost-when-elasticsearch-output-is-temporary-unavailable/272176)
**Author:** [@mabato](https://discuss.elastic.co/u/mabato)\ **Replies:** 3\ **Last updated:** [May 6, 2021, 8:23am UTC](https://discuss.elastic.co/t/events-are-lost-when-elasticsearch-output-is-temporary-unavailable/272176 "2021-05-06T08:23:44Z")
Hi all, Newbie here. I have kubernetes cluster in a location with patchy internet connection. I have metric beats on the cluster and I want to send metrics to ES which runs in cloud. I thought that when I put logstash … --- ## [Logstash/kibana timezone issue](https://discuss.elastic.co/t/logstash-kibana-timezone-issue/272139)
**Author:** [@edvrfn](https://discuss.elastic.co/u/edvrfn)\ **Replies:** 3\ **Last updated:** [May 6, 2021, 8:07am UTC](https://discuss.elastic.co/t/logstash-kibana-timezone-issue/272139 "2021-05-06T08:07:52Z")
Below is the sample log message \<12\>May 5 00:10:28 UDM,50c9676c6d24,udm-1.9.3.3438 kernel: \[522844.682013\] IN=br30 OUT=eth4 MAC=76:ac:b9:1e:f2:fc:dc:a6:32:eb:22:ac:08:00 SRC=192.168.3.53 DST=132.145.110.200 LEN=61 TOS=… --- ## [Multiple index search. One with routing](https://discuss.elastic.co/t/multiple-index-search-one-with-routing/272204)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 5\ **Last updated:** [May 6, 2021, 7:20am UTC](https://discuss.elastic.co/t/multiple-index-search-one-with-routing/272204 "2021-05-06T07:20:06Z")
Hello, Is it possible to query multiple indices at the same time, where one of them requires routing? For example if index1 requires routing but index 2 doesn't. Get index1,index2/\_search?routing=..? Thanks --- ## [Metricbeat on elasticserach 7.10](https://discuss.elastic.co/t/metricbeat-on-elasticserach-7-10/272147)
**Author:** [@SafiaSo](https://discuss.elastic.co/u/SafiaSo)\ **Replies:** 4\ **Last updated:** [May 6, 2021, 7:27am UTC](https://discuss.elastic.co/t/metricbeat-on-elasticserach-7-10/272147 "2021-05-06T07:27:19Z")
Hi Should we install metricbeat on elasticsearch 7.10 ? --- ## [I want to further split messages into json and message after splitting them with grok](https://discuss.elastic.co/t/i-want-to-further-split-messages-into-json-and-message-after-splitting-them-with-grok/272243)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 4\ **Last updated:** [May 6, 2021, 7:23am UTC](https://discuss.elastic.co/t/i-want-to-further-split-messages-into-json-and-message-after-splitting-them-with-grok/272243 "2021-05-06T07:23:10Z")
I want to further split messages into json and message after splitting them with grok. I am using grok to split messages. I'm getting a log in json format in a field, and I found a case where the field contains both js… --- ## [Slow search process in kibana Discover](https://discuss.elastic.co/t/slow-search-process-in-kibana-discover/272188)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 4\ **Last updated:** [May 6, 2021, 6:23am UTC](https://discuss.elastic.co/t/slow-search-process-in-kibana-discover/272188 "2021-05-06T06:23:54Z")
I am using elk 7.11..i am searching an index size of 100gb but it taking long time more than 5 minutes or i can say it is not showing me the data it can show me only 7 days data although it contain last 30 days data but… --- ## [Add custom field and its value needs to be derived from one of the source field](https://discuss.elastic.co/t/add-custom-field-and-its-value-needs-to-be-derived-from-one-of-the-source-field/272229)
**Author:** [@AnamikaN](https://discuss.elastic.co/u/AnamikaN)\ **Replies:** 2\ **Last updated:** [May 6, 2021, 4:47am UTC](https://discuss.elastic.co/t/add-custom-field-and-its-value-needs-to-be-derived-from-one-of-the-source-field/272229 "2021-05-06T04:47:15Z")
I need to add one custom field 'log.level' into filebeat.yml. ITs value needs to be derived from one of source field 'message'. I need to extract log level (INFO or DEBUG or ERROR etc.) from message. Message field looks … --- ## [Add custom field and its value needs to be derived from one of the source field](https://discuss.elastic.co/t/add-custom-field-and-its-value-needs-to-be-derived-from-one-of-the-source-field/272119)
**Author:** [@AnamikaN](https://discuss.elastic.co/u/AnamikaN)\ **Replies:** 5\ **Last updated:** [May 6, 2021, 4:48am UTC](https://discuss.elastic.co/t/add-custom-field-and-its-value-needs-to-be-derived-from-one-of-the-source-field/272119 "2021-05-06T04:48:03Z")
I need to add one custom field 'log.level' into filebeat.yml. ITs value needs to be derived from one of source field 'message'. I need to extract log level (INFO or DEBUG or ERROR etc.) from message. Message field looks … --- ## [Moustache script syntax for aggregated buckets](https://discuss.elastic.co/t/moustache-script-syntax-for-aggregated-buckets/272145)
**Author:** [@michaelv](https://discuss.elastic.co/u/michaelv)\ **Replies:** 2\ **Last updated:** [May 6, 2021, 4:32am UTC](https://discuss.elastic.co/t/moustache-script-syntax-for-aggregated-buckets/272145 "2021-05-06T04:32:16Z")
Hi All, I'm sure this is a no brainer question. I have a search followed by this aggregation: "aggs": { "destination\_ip": { "significant\_terms": { … --- ## [Find Cases API endpoint](https://discuss.elastic.co/t/find-cases-api-endpoint/271904)
**Author:** [@rpiccio](https://discuss.elastic.co/u/rpiccio)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 2:05am UTC](https://discuss.elastic.co/t/find-cases-api-endpoint/271904 "2021-05-06T02:05:56Z")
Hi! I've been playing a bit with the Find Cases API endpoint but I'm unable to filter cases by any field other than status, reporters and tags. I've tried the Saved Objects filter parameter with lots of expresions to t… --- ## [How to run multiple logstash config in parallel](https://discuss.elastic.co/t/how-to-run-multiple-logstash-config-in-parallel/272198)
**Author:** [@ullasrao](https://discuss.elastic.co/u/ullasrao)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 12:20am UTC](https://discuss.elastic.co/t/how-to-run-multiple-logstash-config-in-parallel/272198 "2021-05-06T00:20:05Z")
hi , i am new to ELK and I am setting up the pipelines for the data. i have a requirement where i have to read data from 2 different kafka topics and load them to 2 different elastic search tables respectively. I hav… --- ## [Optimisation d'une requete](https://discuss.elastic.co/t/optimisation-dune-requete/271489)
**Author:** [@fredo33](https://discuss.elastic.co/u/fredo33)\ **Replies:** 6\ **Last updated:** [May 5, 2021, 5:38pm UTC](https://discuss.elastic.co/t/optimisation-dune-requete/271489 "2021-05-05T17:38:20Z")
Bonjour , je cherche à optimiser cette requête avez vous une idée , je cherche à afficher toutes les adresses qui contiennent le libelle 61 rue du paradis avec comme option de recherche : AND et OR { "from": 0, "size"… --- ## [Converting data type from string to int or from string to date](https://discuss.elastic.co/t/converting-data-type-from-string-to-int-or-from-string-to-date/271879)
**Author:** [@LombardoAndrea195](https://discuss.elastic.co/u/LombardoAndrea195)\ **Replies:** 6\ **Last updated:** [May 5, 2021, 5:35pm UTC](https://discuss.elastic.co/t/converting-data-type-from-string-to-int-or-from-string-to-date/271879 "2021-05-05T17:35:16Z")
Hi all I've doing this call but how can you see data is string but I would like to convert data like ANGLE from text to a double or DATE like data fields, what's the call in order to do that? When data is flushed again … --- ## [Unknown field \[has\_parent\] while parsing valid query using XContentParser](https://discuss.elastic.co/t/unknown-field-has-parent-while-parsing-valid-query-using-xcontentparser/272210)
**Author:** [@avj](https://discuss.elastic.co/u/avj)\ **Replies:** 1\ **Last updated:** [May 5, 2021, 5:34pm UTC](https://discuss.elastic.co/t/unknown-field-has-parent-while-parsing-valid-query-using-xcontentparser/272210 "2021-05-05T17:34:55Z")
ES 7.7.0, Getting the following exception, although "has\_parent" query is valid and works in ES index, getting an exception when trying to parse using ES parser API Output : ssb = {"query":{"term":{"\_tenant\_id":{"value… --- ## [How to create rolling index with date as the index name?](https://discuss.elastic.co/t/how-to-create-rolling-index-with-date-as-the-index-name/272156)
**Author:** [@Sumeet\_Singh](https://discuss.elastic.co/u/Sumeet_Singh)\ **Replies:** 5\ **Last updated:** [May 5, 2021, 4:58pm UTC](https://discuss.elastic.co/t/how-to-create-rolling-index-with-date-as-the-index-name/272156 "2021-05-05T16:58:48Z")
Hi, my elastic search index will ingest thousands of documents per second. The service which puts documents in the index doesn't creates a new index, instead it just gets current data in nodejs and indexes docs in "log-Y… --- ## [Restore data from 7.12 to 7.10.2](https://discuss.elastic.co/t/restore-data-from-7-12-to-7-10-2/272201)
**Author:** [@mahomedsh](https://discuss.elastic.co/u/mahomedsh)\ **Replies:** 1\ **Last updated:** [May 5, 2021, 2:41pm UTC](https://discuss.elastic.co/t/restore-data-from-7-12-to-7-10-2/272201 "2021-05-05T14:41:40Z")
Hi I am using Graylog with Elasticsearch installed on the same server. Unfortunately I ran an apt upgrade which updated Elasticsearch to 7.12 before I realised that Graylog is currently not compatible with this version.… --- ## [Date Plugin doc not visible](https://discuss.elastic.co/t/date-plugin-doc-not-visible/272202)
**Author:** [@Soren\_vdc](https://discuss.elastic.co/u/Soren_vdc)\ **Replies:** 0\ **Last updated:** [May 5, 2021, 2:03pm UTC](https://discuss.elastic.co/t/date-plugin-doc-not-visible/272202 "2021-05-05T14:03:45Z")
Hi, I have this time format in logfile: time\_stamp=\[30/Apr/2021:15:23:46+0200\] When I use the date plugin: kv { source =\> "message" field\_split =\> "|" } date { match =\> \[ "time\_stamp", ,… --- ## [Trouble with Kibana Regex querys](https://discuss.elastic.co/t/trouble-with-kibana-regex-querys/272002)
**Author:** [@lpnewell](https://discuss.elastic.co/u/lpnewell)\ **Replies:** 3\ **Last updated:** [May 5, 2021, 1:31pm UTC](https://discuss.elastic.co/t/trouble-with-kibana-regex-querys/272002 "2021-05-05T13:31:14Z")
I'm trying to write a regex query to pick up on basic ssn and sin data in a query but any time i add a tiny bit of complexity the query can't pick up any data. I've wrote this query in things like devo and syslog(and onl… --- ## [Update index patterns automatically - programatically?](https://discuss.elastic.co/t/update-index-patterns-automatically-programatically/271643)
**Author:** [@Paul\_Cardy](https://discuss.elastic.co/u/Paul_Cardy)\ **Replies:** 6\ **Last updated:** [May 5, 2021, 12:43pm UTC](https://discuss.elastic.co/t/update-index-patterns-automatically-programatically/271643 "2021-05-05T12:43:44Z")
A few years ago, this question was asked and at the time it was suggested an API might be forthcoming. Has that happened? If not, what is the normal flow for a pipeline that does not have a fixed set of fields? Paul --- ## [How to handle lots of small indices](https://discuss.elastic.co/t/how-to-handle-lots-of-small-indices/272063)
**Author:** [@fillg1](https://discuss.elastic.co/u/fillg1)\ **Replies:** 8\ **Last updated:** [May 5, 2021, 12:13pm UTC](https://discuss.elastic.co/t/how-to-handle-lots-of-small-indices/272063 "2021-05-05T12:13:31Z")
Hi folks We are using Elasticsearch as a kind of backend for our application. Due to security and privacy reasons, we create a per user index which is opened/ closed by the application. This size of the index is small… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=955) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=957)