# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=980 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 981 --- ## [Logstash](https://discuss.elastic.co/t/logstash/270107)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 1:30pm UTC](https://discuss.elastic.co/t/logstash/270107 "2021-04-14T13:30:13Z")
can somebody help me when i excute the logstash this error appear Using bundled JDK: /usr/share/logstash/jdk OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be… --- ## [Canvas Time Filter When Adding Kibana Objects](https://discuss.elastic.co/t/canvas-time-filter-when-adding-kibana-objects/269971)
**Author:** [@azulgrana](https://discuss.elastic.co/u/azulgrana)\ **Replies:** 6\ **Last updated:** [April 14, 2021, 1:29pm UTC](https://discuss.elastic.co/t/canvas-time-filter-when-adding-kibana-objects/269971 "2021-04-14T13:29:03Z")
Hi there, I have a Canvas with a time filter and I'm looking into adding some existing Kibana objects into my new Canvas. I see that each of the Kibana objects I add into my Canvas has line similar to this ... savedVis… --- ## [Filter last result in Kibana table](https://discuss.elastic.co/t/filter-last-result-in-kibana-table/269995)
**Author:** [@artobstrel](https://discuss.elastic.co/u/artobstrel)\ **Replies:** 2\ **Last updated:** [April 14, 2021, 1:16pm UTC](https://discuss.elastic.co/t/filter-last-result-in-kibana-table/269995 "2021-04-14T13:16:06Z")
I have the following data: With "Top Hit" aggregations I can get the latest result of each event: How can I filter Data Table results to get events with the last result is "failed"? Samples under the spoilerThis i… --- ## [Issues trying to search with ngram tokenizer](https://discuss.elastic.co/t/issues-trying-to-search-with-ngram-tokenizer/269946)
**Author:** [@nealdan0](https://discuss.elastic.co/u/nealdan0)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 12:00pm UTC](https://discuss.elastic.co/t/issues-trying-to-search-with-ngram-tokenizer/269946 "2021-04-14T12:00:43Z")
Hi, Recently we upgraded our version of elastic search to 7.10. Since then I've had issues querying with an ngram tokenizer from the java api. Specifically, searching for a text value only returns results if using a… --- ## [Is there any way to redo the input of beats?](https://discuss.elastic.co/t/is-there-any-way-to-redo-the-input-of-beats/268863)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 2\ **Last updated:** [April 14, 2021, 10:50am UTC](https://discuss.elastic.co/t/is-there-any-way-to-redo-the-input-of-beats/268863 "2021-04-14T10:50:23Z")
I am sending logs from filebeat to logstash. However, when I added filebeat to a new server and restarted logstash, some kind of failure caused most of the logs to be thrown away. I would like to start logging again fr… --- ## [Ingestion doc to index template](https://discuss.elastic.co/t/ingestion-doc-to-index-template/270093)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 2\ **Last updated:** [April 14, 2021, 10:21am UTC](https://discuss.elastic.co/t/ingestion-doc-to-index-template/270093 "2021-04-14T10:21:50Z")
Hi, I've created a index template in Kibana: { "properties": { "date": { "type": "date" }, "formatDate": { "type": "text" }, "temp": { "type":… --- ## [Hot/Warm/Cold storage architecture 1 node](https://discuss.elastic.co/t/hot-warm-cold-storage-architecture-1-node/270102)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 3\ **Last updated:** [April 14, 2021, 10:21am UTC](https://discuss.elastic.co/t/hot-warm-cold-storage-architecture-1-node/270102 "2021-04-14T10:21:02Z")
I am pretty sure it is not possible but still would like to know this for sure. It's possible to use 3 types(Martix,SSD,HDD) of storage for one elasticserach node and configure which index should be stored on which stora… --- ## [Filter on array of object](https://discuss.elastic.co/t/filter-on-array-of-object/270004)
**Author:** [@My-project-repositor](https://discuss.elastic.co/u/My-project-repositor)\ **Replies:** 3\ **Last updated:** [April 14, 2021, 10:16am UTC](https://discuss.elastic.co/t/filter-on-array-of-object/270004 "2021-04-14T10:16:39Z")
I have a documents with many nested fields and array of objects inside them. So when I perform search, how can I get only the matching object inside the array of object, not the entire document? { "name": "Olivia", … --- ## [Create visualizations based on Kibana saved objects, including tags?](https://discuss.elastic.co/t/create-visualizations-based-on-kibana-saved-objects-including-tags/270073)
**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\ **Replies:** 2\ **Last updated:** [April 14, 2021, 10:14am UTC](https://discuss.elastic.co/t/create-visualizations-based-on-kibana-saved-objects-including-tags/270073 "2021-04-14T10:14:13Z")
I'm creating dashboards in Kibana 7.11.2 for multiple types of event from a single application. In the data I'm working with, the event types are characterized by different values of a field named tableName. While there … --- ## [Kibana-comments-app-plugin](https://discuss.elastic.co/t/kibana-comments-app-plugin/269049)
**Author:** [@uusername](https://discuss.elastic.co/u/uusername)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 10:06am UTC](https://discuss.elastic.co/t/kibana-comments-app-plugin/269049 "2021-04-14T10:06:49Z")
@gwintzer hello, Very thanks for developed the plugin. I wondering whether I able to install this plugin in Kibana, kibana-7.11.2-windows-x86\_64? I keep getting the installation failure (when install locally ) with th… --- ## [Issue with loading 4-5 kibana dashboards on the page using Iframe](https://discuss.elastic.co/t/issue-with-loading-4-5-kibana-dashboards-on-the-page-using-iframe/269685)
**Author:** [@Srikanth\_V](https://discuss.elastic.co/u/Srikanth_V)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 9:56am UTC](https://discuss.elastic.co/t/issue-with-loading-4-5-kibana-dashboards-on-the-page-using-iframe/269685 "2021-04-14T09:56:26Z")
Hi There. I am having an issue with the loading of kibana dashboards using an iframe on my application. I have 5 dashboards and it seems to be making multiple requests and multiple plugins for each dashboard to be shown… --- ## [Flood storage Disk Watermark exceeded error](https://discuss.elastic.co/t/flood-storage-disk-watermark-exceeded-error/269411)
**Author:** [@Daud\_Ahmed1](https://discuss.elastic.co/u/Daud_Ahmed1)\ **Replies:** 6\ **Last updated:** [April 14, 2021, 9:50am UTC](https://discuss.elastic.co/t/flood-storage-disk-watermark-exceeded-error/269411 "2021-04-14T09:50:54Z")
I am getting the following error Elasticsearch error: cluster\_block\_exception \[FORBIDDEN/12/index read-only / allow delete (api)\], flood stage disk watermark exceeded Even though I have three data nodes each with 1TB s… --- ## [Multiple Pipelines - filebeat fails](https://discuss.elastic.co/t/multiple-pipelines-filebeat-fails/270094)
**Author:** [@Peque](https://discuss.elastic.co/u/Peque)\ **Replies:** 0\ **Last updated:** [April 14, 2021, 9:37am UTC](https://discuss.elastic.co/t/multiple-pipelines-filebeat-fails/270094 "2021-04-14T09:37:31Z")
Hi Forum. Been struggling with my ELK setup, but cannot make it work as I intend - and not sure where I'm going wrong. Using Elasticsearch,Kibana, Logstash and filebeat --\> from this guide: How To Install Elasticsearch… --- ## [How to increase heap size of elasticsearch pod](https://discuss.elastic.co/t/how-to-increase-heap-size-of-elasticsearch-pod/270044)
**Author:** [@Kaustubh20](https://discuss.elastic.co/u/Kaustubh20)\ **Replies:** 5\ **Last updated:** [April 14, 2021, 9:28am UTC](https://discuss.elastic.co/t/how-to-increase-heap-size-of-elasticsearch-pod/270044 "2021-04-14T09:28:41Z")
Hi, I got issue with heap size on elasticsearch pod on production environment, please guide us how to manage or clean heap size of elasticsearch pod. --- ## [Memory problems / Circuit breaking exception with small data](https://discuss.elastic.co/t/memory-problems-circuit-breaking-exception-with-small-data/270091)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 9\ **Last updated:** [April 14, 2021, 8:57am UTC](https://discuss.elastic.co/t/memory-problems-circuit-breaking-exception-with-small-data/270091 "2021-04-14T08:57:04Z")
I am experiencing an odd situation. I have 3 node cluster (two data nodes, one master node) with the following resources node1 24GB RAM, 12CPU node2 16GB RAM, 8CPU master 8GB RAM, 4CPU I am ingesting firewall logs wit… --- ## [ECK operator platforms](https://discuss.elastic.co/t/eck-operator-platforms/269981)
**Author:** [@avili](https://discuss.elastic.co/u/avili)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 8:37am UTC](https://discuss.elastic.co/t/eck-operator-platforms/269981 "2021-04-14T08:37:57Z")
Hi, I am trying to deploy the ECK using eck-operator on IBM PowerPC platform, and it seem that it does not have image for this platform. my question is, is there a way to create such image ? i don't mine to build this… --- ## [Assign Master and ML both roles to same node?](https://discuss.elastic.co/t/assign-master-and-ml-both-roles-to-same-node/270041)
**Author:** [@bharat1](https://discuss.elastic.co/u/bharat1)\ **Replies:** 6\ **Last updated:** [April 14, 2021, 8:36am UTC](https://discuss.elastic.co/t/assign-master-and-ml-both-roles-to-same-node/270041 "2021-04-14T08:36:40Z")
Hi Team, We plan to use Platinum license Can I assign ML and Master both roles on single/same node? From license count perspective, if I use 3 master and 3 ML both roles assigned to those 3 master nodes, will that be … --- ## [Understand "enable: false" mapping setting](https://discuss.elastic.co/t/understand-enable-false-mapping-setting/270084)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 6\ **Last updated:** [April 14, 2021, 8:34am UTC](https://discuss.elastic.co/t/understand-enable-false-mapping-setting/270084 "2021-04-14T08:34:55Z")
Hello all ! I'm trying to understand "enable: false" mapping setting I don't want to index a specific field : syslog\_timestamp To achieve this, I mapped this field with "enabled: false" like this (extract of Index man… --- ## [RegEx in Painless illegal expression](https://discuss.elastic.co/t/regex-in-painless-illegal-expression/270040)
**Author:** [@jamesm1](https://discuss.elastic.co/u/jamesm1)\ **Replies:** 5\ **Last updated:** [April 14, 2021, 8:34am UTC](https://discuss.elastic.co/t/regex-in-painless-illegal-expression/270040 "2021-04-14T08:34:41Z")
Hello - I am using the Dev Tool for painless and i am trying to get a RegEx statement to work. The statement is : def path = "/v3/api/users/stuff./games"; if (path =~ /^\\/v3\\/api\\/users\\/(\[^\\/\]+)$/) { path = "bob"; … --- ## [Check if Elasticsearch index is SEARCHABLE](https://discuss.elastic.co/t/check-if-elasticsearch-index-is-searchable/270000)
**Author:** [@Daniel\_Jankech](https://discuss.elastic.co/u/Daniel_Jankech)\ **Replies:** 4\ **Last updated:** [April 14, 2021, 8:21am UTC](https://discuss.elastic.co/t/check-if-elasticsearch-index-is-searchable/270000 "2021-04-14T08:21:41Z")
Hello everyone, once again I ran into a wall with ELK stack that I'm unable to overcome by myself so I came here to ask for your help. In my project , I'm creating new index , putting data into it via logstash and then … --- ## [Parsing multiple time series into Elasticsearch](https://discuss.elastic.co/t/parsing-multiple-time-series-into-elasticsearch/270082)
**Author:** [@tkkchan](https://discuss.elastic.co/u/tkkchan)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 8:18am UTC](https://discuss.elastic.co/t/parsing-multiple-time-series-into-elasticsearch/270082 "2021-04-14T08:18:01Z")
Dear all, I am not sure if this belongs to logstash... please correct me if not. I have some data that contains a field which is a time series, of interval 60sec. Should I map it into a single ES document, or should I … --- ## [Sorting a terms aggregation by keys case insensitive but display the original value](https://discuss.elastic.co/t/sorting-a-terms-aggregation-by-keys-case-insensitive-but-display-the-original-value/270087)
**Author:** [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Replies:** 0\ **Last updated:** [April 14, 2021, 8:05am UTC](https://discuss.elastic.co/t/sorting-a-terms-aggregation-by-keys-case-insensitive-but-display-the-original-value/270087 "2021-04-14T08:05:31Z")
When you normalize a keyword field with a lowercase normalizer it becomes case insensitive but what if you want to display the "original" text? Here is a way to do that by using a top\_hits aggregation to fetch the text … --- ## [Vega tree layout error](https://discuss.elastic.co/t/vega-tree-layout-error/270077)
**Author:** [@Ashvin\_Bhutekar](https://discuss.elastic.co/u/Ashvin_Bhutekar)\ **Replies:** 2\ **Last updated:** [April 14, 2021, 7:53am UTC](https://discuss.elastic.co/t/vega-tree-layout-error/270077 "2021-04-14T07:53:12Z")
what is the reason behind this error "Infinite extent for field "depth": \[Infinity, -Infinity\]" in vega tree layout? --- ## [Elastic search](https://discuss.elastic.co/t/elastic-search/270081)
**Author:** [@Daud\_Ahmed1](https://discuss.elastic.co/u/Daud_Ahmed1)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 7:19am UTC](https://discuss.elastic.co/t/elastic-search/270081 "2021-04-14T07:19:55Z")
I am not really able to find anything about this topic. Can anyone help with me will be really appreciated. --- ## [Elasticsearch doesn't display data in the graphs after a certain date](https://discuss.elastic.co/t/elasticsearch-doesnt-display-data-in-the-graphs-after-a-certain-date/270006)
**Author:** [@Borchart](https://discuss.elastic.co/u/Borchart)\ **Replies:** 2\ **Last updated:** [April 14, 2021, 7:11am UTC](https://discuss.elastic.co/t/elasticsearch-doesnt-display-data-in-the-graphs-after-a-certain-date/270006 "2021-04-14T07:11:57Z")
Hello everyone, I am new to using Elasticsearch. I have a server with Wazuh, Elasticsearch and Kibana installed, so I only have one node. When I look at the graphs for Wazuh I don't see the data until I put the data of … --- ## [Elasticsearch Multiple terms count filters](https://discuss.elastic.co/t/elasticsearch-multiple-terms-count-filters/270080)
**Author:** [@vkothari](https://discuss.elastic.co/u/vkothari)\ **Replies:** 0\ **Last updated:** [April 14, 2021, 6:32am UTC](https://discuss.elastic.co/t/elasticsearch-multiple-terms-count-filters/270080 "2021-04-14T06:32:03Z")
We are using Elasticsearch to search multiple terms and filter the records based on different filter terms. We are using multiple Keywords to search and filter the records, so I need some other details along with the re… --- ## [Updates on time based indexes](https://discuss.elastic.co/t/updates-on-time-based-indexes/270051)
**Author:** [@abhishekc92](https://discuss.elastic.co/u/abhishekc92)\ **Replies:** 2\ **Last updated:** [April 14, 2021, 6:42am UTC](https://discuss.elastic.co/t/updates-on-time-based-indexes/270051 "2021-04-14T06:42:28Z")
I am thinking of a time based index where we manage the lifecycle of a certain type of documents. The rollover API is one of the options vs spawning a new index at a cadence(say monthly). The nature of our documents are … --- ## [Logstash not parsing dynamic updates happening on the files present under the configured input path](https://discuss.elastic.co/t/logstash-not-parsing-dynamic-updates-happening-on-the-files-present-under-the-configured-input-path/269852)
**Author:** [@harish\_92](https://discuss.elastic.co/u/harish_92)\ **Replies:** 4\ **Last updated:** [April 14, 2021, 5:51am UTC](https://discuss.elastic.co/t/logstash-not-parsing-dynamic-updates-happening-on-the-files-present-under-the-configured-input-path/269852 "2021-04-14T05:51:21Z")
Hi Guys, I have configured a folder containing files which will be dynamically updated with some data which needs to be parsed by logstash and pushed into ES. Here, whenever new data is written into any one of the inpu… --- ## [“No processor type exists with name \[attachment\]”](https://discuss.elastic.co/t/no-processor-type-exists-with-name-attachment/270076)
**Author:** [@judy369](https://discuss.elastic.co/u/judy369)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 3:43am UTC](https://discuss.elastic.co/t/no-processor-type-exists-with-name-attachment/270076 "2021-04-14T03:43:02Z")
when i create pipline, curl --user elastic:ny123456 -H 'Content-Type: application/json' -XPUT 'http://192.168.250.49:9200/\_ingest/pipeline/attachment' -d' { "description" : "Extract attachment information", "… --- ## [Is there any way to reduce the size of data before indexing into elasticserch](https://discuss.elastic.co/t/is-there-any-way-to-reduce-the-size-of-data-before-indexing-into-elasticserch/270072)
**Author:** [@iammanmale](https://discuss.elastic.co/u/iammanmale)\ **Replies:** 4\ **Last updated:** [April 14, 2021, 1:49am UTC](https://discuss.elastic.co/t/is-there-any-way-to-reduce-the-size-of-data-before-indexing-into-elasticserch/270072 "2021-04-14T01:49:34Z")
As our data size is quite big, we wish to reduce the size of the record. Is it possible to do some kind of aggregation before indexing into ES in logstash? For example, it is possible to put only the record of the max va… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=979) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=981)