# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=964 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 965 --- ## [Extract multiple xml of multiline log](https://discuss.elastic.co/t/extract-multiple-xml-of-multiline-log/271560)
**Author:** [@E\_T\_N](https://discuss.elastic.co/u/E_T_N)\ **Replies:** 3\ **Last updated:** [April 29, 2021, 12:21am UTC](https://discuss.elastic.co/t/extract-multiple-xml-of-multiline-log/271560 "2021-04-29T00:21:36Z")
Hello. I have a log file with similar estructure: 05 Feb 2021 14:00:00,213 \[AAA-11\] INFO - Line A:\[0\] 05 Feb 2021 14:00:00,231 \[AAA-11\] INFO - Line2:\[0\] 05 Feb 2021 14:00:00,231 \[AAA-11\] INFO - Line3\[: 0\] 05 Feb 202… --- ## [What is maximum limit for new data records for index in data visualizer in kibana?](https://discuss.elastic.co/t/what-is-maximum-limit-for-new-data-records-for-index-in-data-visualizer-in-kibana/271406)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 2\ **Last updated:** [April 29, 2021, 12:20am UTC](https://discuss.elastic.co/t/what-is-maximum-limit-for-new-data-records-for-index-in-data-visualizer-in-kibana/271406 "2021-04-29T00:20:27Z")
Hi all, I just wanted to know maximum how many records or lines of data can be uploaded for a new index in Kibana Data visualizer? What is limit for no of records or lines? Regards --- ## [Configure the anomaly detector to find unusual logon](https://discuss.elastic.co/t/configure-the-anomaly-detector-to-find-unusual-logon/271553)
**Author:** [@Vannessa\_Kemeni](https://discuss.elastic.co/u/Vannessa_Kemeni)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 8:08pm UTC](https://discuss.elastic.co/t/configure-the-anomaly-detector-to-find-unusual-logon/271553 "2021-04-28T20:08:01Z")
Hello everyone, I have a document with IP address and the username. A user in a country can have an IP Address in a specific range for example from 192.168.0.0 up to 192.168.0.255. That means for example it logs on from… --- ## [Cluster stops responding when transferring data to relational index](https://discuss.elastic.co/t/cluster-stops-responding-when-transferring-data-to-relational-index/271332)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 11:52pm UTC](https://discuss.elastic.co/t/cluster-stops-responding-when-transferring-data-to-relational-index/271332 "2021-04-28T23:52:11Z")
Hi everyone. I have a cluster of 3 main 13 data nodes. I have a relational index of 40 shards in this set. '\[ERROR\] \[o.e.x.m.c.c.ClusterStatsCollector\] \[main-3\] collector \[cluster\_stats\] timed out while collecting data' … --- ## [Additional data path not used](https://discuss.elastic.co/t/additional-data-path-not-used/270937)
**Author:** [@karlmaresch](https://discuss.elastic.co/u/karlmaresch)\ **Replies:** 7\ **Last updated:** [April 28, 2021, 11:33pm UTC](https://discuss.elastic.co/t/additional-data-path-not-used/270937 "2021-04-28T23:33:28Z")
Hi, We currently have an elasticsearch cluster with two seperate equal servers as two data nodes - one master, one slave. The servers each have 1 TB of diskspace. However, master is now at 81% of disk usage and slave i… --- ## [PSI Exam Environment](https://discuss.elastic.co/t/psi-exam-environment/271563)
**Author:** [@gse](https://discuss.elastic.co/u/gse)\ **Replies:** 2\ **Last updated:** [April 28, 2021, 10:08pm UTC](https://discuss.elastic.co/t/psi-exam-environment/271563 "2021-04-28T22:08:56Z")
Has anyone done one of the Elastic exams, with the proctor, while using a Linux workstation? I get the impression they can only handle Windows and Mac. I've asked Elastic, they didn't know. I've emailed PSIonline support… --- ## [Logstash IPV4 bind issue](https://discuss.elastic.co/t/logstash-ipv4-bind-issue/271303)
**Author:** [@edvrfn](https://discuss.elastic.co/u/edvrfn)\ **Replies:** 6\ **Last updated:** [April 28, 2021, 9:09pm UTC](https://discuss.elastic.co/t/logstash-ipv4-bind-issue/271303 "2021-04-28T21:09:52Z")
I have stopped/disabled firewalld and restarted logstash/Elasticsearch services but netstat only shows them listening only on IPv6. Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address … --- ## [Unable to Parse Meraki Flow Syslog Message with GROK and KV Filters in Logstash](https://discuss.elastic.co/t/unable-to-parse-meraki-flow-syslog-message-with-grok-and-kv-filters-in-logstash/271446)
**Author:** [@Khughes0516](https://discuss.elastic.co/u/Khughes0516)\ **Replies:** 4\ **Last updated:** [April 28, 2021, 9:03pm UTC](https://discuss.elastic.co/t/unable-to-parse-meraki-flow-syslog-message-with-grok-and-kv-filters-in-logstash/271446 "2021-04-28T21:03:53Z")
Hello, I am having a lot of trouble with trying to parse a Cisco Meraki flow syslog message in Logstash. A sample message looks like this: Apr 25 13:12:41 gateway 1619356361.230223408 ip\_flow\_end src=10.1.130.45 dst=3… --- ## [Search over all fields](https://discuss.elastic.co/t/search-over-all-fields/271511)
**Author:** [@Sander\_Marx](https://discuss.elastic.co/u/Sander_Marx)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 8:33pm UTC](https://discuss.elastic.co/t/search-over-all-fields/271511 "2021-04-28T20:33:13Z")
Hi, i have a index with multiple documents with severeal fields. I want to be able to search over all the fields without using multi\_match and manualy writing each field. Is there a way to do this? Here is an example of… --- ## [NESTED ATTRIBUTE RENAME NOT WORKING](https://discuss.elastic.co/t/nested-attribute-rename-not-working/271545)
**Author:** [@kamalgunda](https://discuss.elastic.co/u/kamalgunda)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 8:30pm UTC](https://discuss.elastic.co/t/nested-attribute-rename-not-working/271545 "2021-04-28T20:30:27Z")
Hi All, I am not able to rename the nested attribute through logstash mutate/filter/ruby codes while loading the Elasticsearch index and input data is from database. Sample input data and logstash config file given bel… --- ## [Calculate the time difference between 2 xml log lines](https://discuss.elastic.co/t/calculate-the-time-difference-between-2-xml-log-lines/271458)
**Author:** [@roua.B](https://discuss.elastic.co/u/roua.B)\ **Replies:** 4\ **Last updated:** [April 28, 2021, 7:49pm UTC](https://discuss.elastic.co/t/calculate-the-time-difference-between-2-xml-log-lines/271458 "2021-04-28T19:49:02Z")
Hello everyone, I have an XML log file that looks like this: \ \ \ **Author:** [@Vannessa\_Kemeni](https://discuss.elastic.co/u/Vannessa_Kemeni)\ **Replies:** 2\ **Last updated:** [April 28, 2021, 7:42pm UTC](https://discuss.elastic.co/t/find-the-gelocation-from-ip-internal-network/270559 "2021-04-28T19:42:49Z") Hello, i have internal ip adress and the corresonding geolocation. How i can create a list with those ip adresses and the location and enrich my documents in elastic search. Thank you. --- ## [How to monitor the number of events in Dead letter queue](https://discuss.elastic.co/t/how-to-monitor-the-number-of-events-in-dead-letter-queue/271410)
**Author:** [@Animesh\_Agarwal](https://discuss.elastic.co/u/Animesh_Agarwal)\ **Replies:** 2\ **Last updated:** [April 28, 2021, 6:03pm UTC](https://discuss.elastic.co/t/how-to-monitor-the-number-of-events-in-dead-letter-queue/271410 "2021-04-28T18:03:45Z")
Hi Team, We have configured Dead Letter Queue(DLQ) in our Logstash layer. We want to be alerted when the number of events in DLQ increase beyond a certain limit. I tried going through the Logstash Monitoring docs, but… --- ## [Elasticsearch query to update one document using data from another document in the same es](https://discuss.elastic.co/t/elasticsearch-query-to-update-one-document-using-data-from-another-document-in-the-same-es/271540)
**Author:** [@chamiduz](https://discuss.elastic.co/u/chamiduz)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 5:06pm UTC](https://discuss.elastic.co/t/elasticsearch-query-to-update-one-document-using-data-from-another-document-in-the-same-es/271540 "2021-04-28T17:06:56Z")
Hi, I have static data stored in elasticsearch. for example country name and country id { "id" : 250, "name" : "Sri Lanka" } { "id" : 260, "name" : "India" } I am getting another set of attraction data from a web ser… --- ## [\_dateparsefailure mapping date and time to @timestamp field](https://discuss.elastic.co/t/dateparsefailure-mapping-date-and-time-to-timestamp-field/271509)
**Author:** [@Wilks](https://discuss.elastic.co/u/Wilks)\ **Replies:** 2\ **Last updated:** [April 28, 2021, 4:17pm UTC](https://discuss.elastic.co/t/dateparsefailure-mapping-date-and-time-to-timestamp-field/271509 "2021-04-28T16:17:52Z")
I am getting a \_dateparsefailure when I try to map the date and time the log arrived to the @timestamp field. Below is my filter, if I comment out the attempt to map to @timestamp I dont get a \_dateparsefailure so it so… --- ## [Logstash stop to output when one kafka node is down](https://discuss.elastic.co/t/logstash-stop-to-output-when-one-kafka-node-is-down/271412)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 11\ **Last updated:** [April 28, 2021, 4:08pm UTC](https://discuss.elastic.co/t/logstash-stop-to-output-when-one-kafka-node-is-down/271412 "2021-04-28T16:08:22Z")
Hello everybody, I have a 3 kafka nodes cluster Logstash has a kafka input and output to elasticsearch and syslog (I'm using logstash output isolator pattern). When one kafka node is down (kafka3 in this case), logstas… --- ## [Configuring and better understanding index.refresh\_interval for an index updated twice a day](https://discuss.elastic.co/t/configuring-and-better-understanding-index-refresh-interval-for-an-index-updated-twice-a-day/271535)
**Author:** [@Catalin](https://discuss.elastic.co/u/Catalin)\ **Replies:** 1\ **Last updated:** [April 28, 2021, 3:33pm UTC](https://discuss.elastic.co/t/configuring-and-better-understanding-index-refresh-interval-for-an-index-updated-twice-a-day/271535 "2021-04-28T15:33:27Z")
How exactly does index.refresh\_interval affect search performance ? I have an index that is updated for 10 mins twice a day. Is it sufficient to refresh it 1 time, once the updating process finishes and disable index.re… --- ## [Http curl queries. is possible?](https://discuss.elastic.co/t/http-curl-queries-is-possible/271422)
**Author:** [@sylvani](https://discuss.elastic.co/u/sylvani)\ **Replies:** 4\ **Last updated:** [April 28, 2021, 3:28pm UTC](https://discuss.elastic.co/t/http-curl-queries-is-possible/271422 "2021-04-28T15:28:37Z")
Hello, I need to ask a question, maybe a little stupid ... Is it possible to query the kibana web console by http and curl? Is there a way for this to return the data from the query? Thanks --- ## [Kibana Metrics Logs Timeouts in some spaces](https://discuss.elastic.co/t/kibana-metrics-logs-timeouts-in-some-spaces/271501)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 3:18pm UTC](https://discuss.elastic.co/t/kibana-metrics-logs-timeouts-in-some-spaces/271501 "2021-04-28T15:18:11Z")
Hi folks, I experience strange behavior in my kibana 7.6.2. I have multiple different spaces, where I have not changed the default settings for metrics or logs dashboards. In some spaces when I press on Metrics after … --- ## [Input on UDP converting to default UTF-8 but want Hex Strings](https://discuss.elastic.co/t/input-on-udp-converting-to-default-utf-8-but-want-hex-strings/271513)
**Author:** [@Yasho](https://discuss.elastic.co/u/Yasho)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 12:52pm UTC](https://discuss.elastic.co/t/input-on-udp-converting-to-default-utf-8-but-want-hex-strings/271513 "2021-04-28T12:52:43Z")
Why is logstash converting input stream by default to UTF-8, ASCII, Unsigned Char, I want the data either converted full or do not touch it.. There is no codec to format the received data on UDP port. Example: This i… --- ## [Kibana table question](https://discuss.elastic.co/t/kibana-table-question/271514)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 1\ **Last updated:** [April 28, 2021, 3:00pm UTC](https://discuss.elastic.co/t/kibana-table-question/271514 "2021-04-28T15:00:35Z")
Hi there. I have a dashboard with some tables like this. My idea is to set an URL on each of these entries that redirects to the "Discover" tab with the filter applied, for example, click on "ET POLICY TEAMVIEWER DYN… --- ## [Maps delayed loading of cluster circle icon](https://discuss.elastic.co/t/maps-delayed-loading-of-cluster-circle-icon/271444)
**Author:** [@DMinovski](https://discuss.elastic.co/u/DMinovski)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 2:41pm UTC](https://discuss.elastic.co/t/maps-delayed-loading-of-cluster-circle-icon/271444 "2021-04-28T14:41:53Z")
I'm using Maps in Kibana 7.11.1. The maps have a field filter in the cluster settings menu, and the dashboard has one or two global filters in the top menu. Sometimes, there is a delay of the cluster circle icon if it's … --- ## [Logstash Ouptut to Elasticsearch when one node is down](https://discuss.elastic.co/t/logstash-ouptut-to-elasticsearch-when-one-node-is-down/270876)
**Author:** [@linfordwoode](https://discuss.elastic.co/u/linfordwoode)\ **Replies:** 6\ **Last updated:** [April 28, 2021, 1:52pm UTC](https://discuss.elastic.co/t/logstash-ouptut-to-elasticsearch-when-one-node-is-down/270876 "2021-04-28T13:52:52Z")
Logstash sending output to three ES nodes. When one ES node is down, Logstash doesn't forward specific outputs to other nodes, probably because the dead node was receiving the output. For example, in the Logstash conf be… --- ## [Kibana filter issues on embedded dashboards](https://discuss.elastic.co/t/kibana-filter-issues-on-embedded-dashboards/268898)
**Author:** [@a.deharo](https://discuss.elastic.co/u/a.deharo)\ **Replies:** 7\ **Last updated:** [April 28, 2021, 1:16pm UTC](https://discuss.elastic.co/t/kibana-filter-issues-on-embedded-dashboards/268898 "2021-04-28T13:16:35Z")
Hi everyone, I recently upgraded my Elastic stack version from v7.11.2 to v7.12.0, and I'm starting to see some weird behavior on both filters and controls visualizations on embedded dashboards from Kibana. I guess the … --- ## [Try to add a new field with timestamp in logstash](https://discuss.elastic.co/t/try-to-add-a-new-field-with-timestamp-in-logstash/271512)
**Author:** [@David\_Barat](https://discuss.elastic.co/u/David_Barat)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 12:52pm UTC](https://discuss.elastic.co/t/try-to-add-a-new-field-with-timestamp-in-logstash/271512 "2021-04-28T12:52:39Z")
Hi everyone, I am pretty new in ELK world and I would like to parse csv file with logstash. I have tried to add a time field with timestamp (YYYY MM DD format), but I think there is an issue in the format I have made … --- ## [\[Bug\] Visualizations: Data table with image](https://discuss.elastic.co/t/bug-visualizations-data-table-with-image/271427)
**Author:** [@cceyda](https://discuss.elastic.co/u/cceyda)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 12:48pm UTC](https://discuss.elastic.co/t/bug-visualizations-data-table-with-image/271427 "2021-04-28T12:48:51Z")
I opened an issue : \[Bug\] Visualizations: Data table image weirdness · Issue #98257 · elastic/kibana · GitHub but no one replied so posting here too Kibana version: 7.12.0 Elasticsearch version: 7.12.0 Server OS vers… --- ## [Received plaintext http traffic on an https channel, closing connection](https://discuss.elastic.co/t/received-plaintext-http-traffic-on-an-https-channel-closing-connection/271380)
**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\ **Replies:** 1\ **Last updated:** [April 28, 2021, 12:32pm UTC](https://discuss.elastic.co/t/received-plaintext-http-traffic-on-an-https-channel-closing-connection/271380 "2021-04-28T12:32:58Z")
I have deployed ECK (using helm) on my k8s cluster and i am attempting to install elasticsearch following the docs. Deploy an Elasticsearch cluster | Elastic Cloud on Kubernetes \[2.10\] | Elastic I have externally expose… --- ## [Query for anomaly explorer visualization](https://discuss.elastic.co/t/query-for-anomaly-explorer-visualization/270784)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [April 28, 2021, 11:42am UTC](https://discuss.elastic.co/t/query-for-anomaly-explorer-visualization/270784 "2021-04-28T11:42:17Z")
Hi Im trying to emulate the anomaly explorer in a vega visualization, at first I think that a top hit agreggation will get me similar results, like this query: POST /.ml-anomalies-\*/\_search { "size": 0, "aggs": { … --- ## [UI\_actions\_explorer as a Plugin](https://discuss.elastic.co/t/ui-actions-explorer-as-a-plugin/271258)
**Author:** [@Noobmaster](https://discuss.elastic.co/u/Noobmaster)\ **Replies:** 1\ **Last updated:** [April 28, 2021, 11:39am UTC](https://discuss.elastic.co/t/ui-actions-explorer-as-a-plugin/271258 "2021-04-28T11:39:35Z")
Hi. I am new to ELK. Can anyone tell me how can I use certain part of the actions in UI\_actions\_explorer examples as a plugin. Example: I want to create a datagrid of 3\*3 data . And I want to have edit option as sho… --- ## [ES index goes read-only without the node reaching the disk watermark](https://discuss.elastic.co/t/es-index-goes-read-only-without-the-node-reaching-the-disk-watermark/271502)
**Author:** [@Bence\_Ver](https://discuss.elastic.co/u/Bence_Ver)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 11:24am UTC](https://discuss.elastic.co/t/es-index-goes-read-only-without-the-node-reaching-the-disk-watermark/271502 "2021-04-28T11:24:30Z")
We are running an ELK cluster (v7.11.2) in kubernetes, and we noticed that the cluster went read-only without the underlying node reaching the disk watermark. We don't see any trace of error in the ES logs, and neither a… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=963) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=965)