# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=981 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 982 --- ## [ES data redundancy VS Kibana visualizations](https://discuss.elastic.co/t/es-data-redundancy-vs-kibana-visualizations/270022)
**Author:** [@MartinKolar](https://discuss.elastic.co/u/MartinKolar)\ **Replies:** 2\ **Last updated:** [April 14, 2021, 12:41am UTC](https://discuss.elastic.co/t/es-data-redundancy-vs-kibana-visualizations/270022 "2021-04-14T00:41:05Z")
Hi everyone, I would love to hear some tips on how to avoid data redundancy in ES and Kibana. We are using ES and Kibana to collect and visualize videogame analytics. The game client indexes an "event" - a document with… --- ## [Elasticsearch (Docker) - failed to set monitoring pipeline](https://discuss.elastic.co/t/elasticsearch-docker-failed-to-set-monitoring-pipeline/269904)
**Author:** [@chainhead](https://discuss.elastic.co/u/chainhead)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 12:25am UTC](https://discuss.elastic.co/t/elasticsearch-docker-failed-to-set-monitoring-pipeline/269904 "2021-04-14T00:25:16Z")
I am using Elasticsearch with Docker elasticsearch/elasticsearch:7.12.0 and this is what I see in the logs. It is probably for these blogs, Kibana never gets to connect to Elasticsearch rendering my EFK stack unusable. C… --- ## [Creating ingest node pipeline with if condition](https://discuss.elastic.co/t/creating-ingest-node-pipeline-with-if-condition/269991)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 3\ **Last updated:** [April 14, 2021, 12:20am UTC](https://discuss.elastic.co/t/creating-ingest-node-pipeline-with-if-condition/269991 "2021-04-14T00:20:27Z")
Hello, I need to create ingest node pipeline that will tag every document with a specific field based on IP. I need to make it for 4 different groups with over 200 IP addresses. So far I have tried something like this … --- ## [Tenant](https://discuss.elastic.co/t/tenant/269696)
**Author:** [@Skander\_Harrabi](https://discuss.elastic.co/u/Skander_Harrabi)\ **Replies:** 3\ **Last updated:** [April 14, 2021, 12:05am UTC](https://discuss.elastic.co/t/tenant/269696 "2021-04-14T00:05:06Z")
Hello guys, Can i change tenant from code ?? like is there any Api or something that allow me to change tenant from a function or anywhere Like i want do a button, and when i click on that button i want change to a spe… --- ## [Feature Request: Enforce consistent position\_increment\_gap in multi-fields for multi-values](https://discuss.elastic.co/t/feature-request-enforce-consistent-position-increment-gap-in-multi-fields-for-multi-values/270067)
**Author:** [@Michael\_Sander](https://discuss.elastic.co/u/Michael_Sander)\ **Replies:** 3\ **Last updated:** [April 13, 2021, 10:55pm UTC](https://discuss.elastic.co/t/feature-request-enforce-consistent-position-increment-gap-in-multi-fields-for-multi-values/270067 "2021-04-13T22:55:47Z")
Hi ES Community, I recently found some confusing behavior with a mapping and multi-fields, and it would be nice if Elasticsearch would prevent you from shooting yourself in the foot (like I did). The issue arises when … --- ## [Moving disk to another data node](https://discuss.elastic.co/t/moving-disk-to-another-data-node/270020)
**Author:** [@Feedy](https://discuss.elastic.co/u/Feedy)\ **Replies:** 2\ **Last updated:** [April 13, 2021, 10:46pm UTC](https://discuss.elastic.co/t/moving-disk-to-another-data-node/270020 "2021-04-13T22:46:13Z")
Running out of space with current 4 node cluster w/replica. I would like to install new larger disk drives but it may require moving disk drives from one data node to another. Does the master node have the ability to rec… --- ## [Time based indexing alternatives](https://discuss.elastic.co/t/time-based-indexing-alternatives/270064)
**Author:** [@abhishekc92](https://discuss.elastic.co/u/abhishekc92)\ **Replies:** 1\ **Last updated:** [April 13, 2021, 9:57pm UTC](https://discuss.elastic.co/t/time-based-indexing-alternatives/270064 "2021-04-13T21:57:36Z")
Hi, We are building a search system on top of document style data(ie. a document that has a few states over its lifecycle and gets updated over time). Most indexing strategies I see are some form of time-based indexing… --- ## [Kibana Add Data for Sophos XG](https://discuss.elastic.co/t/kibana-add-data-for-sophos-xg/270060)
**Author:** [@bryonadams](https://discuss.elastic.co/u/bryonadams)\ **Replies:** 2\ **Last updated:** [April 13, 2021, 9:07pm UTC](https://discuss.elastic.co/t/kibana-add-data-for-sophos-xg/270060 "2021-04-13T21:07:01Z")
Trying to understand how I get logging out of XG and into Kibana. I watched some of the videos and got Elasticsearch and Kibana running on a VM. The document for Beats seems to say I'd push syslog from my firewall or oth… --- ## [Duplicated Log](https://discuss.elastic.co/t/duplicated-log/269931)
**Author:** [@Paulogbr](https://discuss.elastic.co/u/Paulogbr)\ **Replies:** 9\ **Last updated:** [April 13, 2021, 6:19pm UTC](https://discuss.elastic.co/t/duplicated-log/269931 "2021-04-13T18:19:41Z")
Hello Guys, My firewall device is sending duplicated log. I tried filter with logstash. I need write the output in file. I test with logger but don´t work, I tried use fingerprint. Can you have any ideia ? inpu… --- ## [Как отображать в выдаче только дубликаты - аггрегация, поиск дубликатов](https://discuss.elastic.co/t/topic/269874)
**Author:** [@Sergei\_Frolov](https://discuss.elastic.co/u/Sergei_Frolov)\ **Replies:** 9\ **Last updated:** [April 13, 2021, 6:12pm UTC](https://discuss.elastic.co/t/topic/269874 "2021-04-13T18:12:51Z")
Добрый день! Выполняю аггрегацию для поиска дублей: GET app\_log-\*/\_search { "size": 0, "aggs": { "duplicateCount": { "terms": { "field": "context.id", "min\_doc\_count": 2 }, "ag… --- ## [Logstash doesn't automatically collect all Zeek fields without grok pattern](https://discuss.elastic.co/t/logstash-doesnt-automatically-collect-all-zeek-fields-without-grok-pattern/269613)
**Author:** [@Automation\_Scripts](https://discuss.elastic.co/u/Automation_Scripts)\ **Replies:** 3\ **Last updated:** [April 13, 2021, 6:01pm UTC](https://discuss.elastic.co/t/logstash-doesnt-automatically-collect-all-zeek-fields-without-grok-pattern/269613 "2021-04-13T18:01:49Z")
Hi, Is there a setting I need to provide in order to enable the automatically collection of all the Zeek's log fields? I can collect the fields message only through a grok filter. My assumption is that logstash is smar… --- ## [Issues with Elastic Agent and Defender?](https://discuss.elastic.co/t/issues-with-elastic-agent-and-defender/269818)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 6\ **Last updated:** [April 13, 2021, 5:27pm UTC](https://discuss.elastic.co/t/issues-with-elastic-agent-and-defender/269818 "2021-04-13T17:27:09Z")
After an upgrade to 7.12, a few machines experience high CPU load from Elastic endpoint security. The load seems to be periodic: The three processes/services that seem to cause this load are Elastic Endpoint, MS D… --- ## [Сравнение документов внутри индекса](https://discuss.elastic.co/t/topic/268688)
**Author:** [@frostwar](https://discuss.elastic.co/u/frostwar)\ **Replies:** 11\ **Last updated:** [April 13, 2021, 5:16pm UTC](https://discuss.elastic.co/t/topic/268688 "2021-04-13T17:16:23Z")
Всем привет. В индексе есть несколько типов документов. Одни документы - Input, другие - Output. В каждом документе есть поле session\_ID, которое отвечает за уникальность передачи сесии. Вопросы: Как связать/сопост… --- ## [Index is not showing to create index pattern](https://discuss.elastic.co/t/index-is-not-showing-to-create-index-pattern/269973)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 1\ **Last updated:** [April 13, 2021, 4:41pm UTC](https://discuss.elastic.co/t/index-is-not-showing-to-create-index-pattern/269973 "2021-04-13T16:41:23Z")
I have created index in kibana Dev Tools but it is not visible in stack Management to create its index pattern for analysis. --- ## [Getting master\_not\_discovered\_exception from node](https://discuss.elastic.co/t/getting-master-not-discovered-exception-from-node/269840)
**Author:** [@arielman2304](https://discuss.elastic.co/u/arielman2304)\ **Replies:** 6\ **Last updated:** [April 13, 2021, 3:20pm UTC](https://discuss.elastic.co/t/getting-master-not-discovered-exception-from-node/269840 "2021-04-13T15:20:19Z")
Hi I created 3 EC2 clusters in AWS, and I'm trying to set 2 of them as nodes. I followed this guideline: However, nothing helps and I'm still getting this exception from the nodes. all ES are up and return response t… --- ## [Missing certain log entries (json from k8s using filebeat)](https://discuss.elastic.co/t/missing-certain-log-entries-json-from-k8s-using-filebeat/269948)
**Author:** [@geoaxis](https://discuss.elastic.co/u/geoaxis)\ **Replies:** 2\ **Last updated:** [April 13, 2021, 3:18pm UTC](https://discuss.elastic.co/t/missing-certain-log-entries-json-from-k8s-using-filebeat/269948 "2021-04-13T15:18:42Z")
I am a consumer of an elastic stack (filebeat, es, kibana) that gets structured json logs from a kubernetes cluster (writing to stdout). The stack is slef hosted by a group at my workplace and unfortunately it does not … --- ## [Xml with optionnal fields not added in the result array by logstash](https://discuss.elastic.co/t/xml-with-optionnal-fields-not-added-in-the-result-array-by-logstash/269891)
**Author:** [@meepmeep](https://discuss.elastic.co/u/meepmeep)\ **Replies:** 7\ **Last updated:** [April 13, 2021, 3:17pm UTC](https://discuss.elastic.co/t/xml-with-optionnal-fields-not-added-in-the-result-array-by-logstash/269891 "2021-04-13T15:17:09Z")
Hi :slight\_smile: I'm moving slowly in this new wold of elastic stack. I'm currently stuck on a parsing issue with my xml file (ip and nickname removed) : \ \ \ \User1\ … --- ## [Can I get a specific part of the referrer in the nginx log when parsing it via logstash](https://discuss.elastic.co/t/can-i-get-a-specific-part-of-the-referrer-in-the-nginx-log-when-parsing-it-via-logstash/269865)
**Author:** [@pradeep\_gadkari](https://discuss.elastic.co/u/pradeep_gadkari)\ **Replies:** 3\ **Last updated:** [April 13, 2021, 3:13pm UTC](https://discuss.elastic.co/t/can-i-get-a-specific-part-of-the-referrer-in-the-nginx-log-when-parsing-it-via-logstash/269865 "2021-04-13T15:13:04Z")
My grok pattern is as below: grok{ match =\> { "message" =\> \["%{IPV4:IP\_address} (?:-|(%{WORD}.%{WORD})) %{USER:ident} \\\[%{HTTPDATE:message\_timestamp}\\\] \\"(?:%{WORD:message\_type} %{NOTSPACE:request}(?: HTTP/%{NUMB… --- ## [An error occurred during rule execution](https://discuss.elastic.co/t/an-error-occurred-during-rule-execution/269536)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 1\ **Last updated:** [April 13, 2021, 2:06pm UTC](https://discuss.elastic.co/t/an-error-occurred-during-rule-execution/269536 "2021-04-13T14:06:31Z")
I've been getting this error on all of my Machine Learning Rules. --- ## [Invalid value for MonthOfYear and nested JSON mapping](https://discuss.elastic.co/t/invalid-value-for-monthofyear-and-nested-json-mapping/270019)
**Author:** [@tommycahir](https://discuss.elastic.co/u/tommycahir)\ **Replies:** 0\ **Last updated:** [April 13, 2021, 2:02pm UTC](https://discuss.elastic.co/t/invalid-value-for-monthofyear-and-nested-json-mapping/270019 "2021-04-13T14:02:41Z")
Hi Folks, I am very new to Elastic Stack and am trying to insert a JSON list of JSON API responses to an index from a python script and am getting the error: elasticsearch.exceptions.RequestError: RequestError(400, 'ma… --- ## [Generate report in Kibana results in 404](https://discuss.elastic.co/t/generate-report-in-kibana-results-in-404/269050)
**Author:** [@eeijlar](https://discuss.elastic.co/u/eeijlar)\ **Replies:** 8\ **Last updated:** [April 13, 2021, 2:00pm UTC](https://discuss.elastic.co/t/generate-report-in-kibana-results-in-404/269050 "2021-04-13T14:00:22Z")
If I generate a pdf report from Kibana web UI, using Share \> PDF Reports \> Generate PDF. Then I got to : Stack Management \> Reporting \> Download report The resulting report just has: ELK Stack version 7.11.2 The sa… --- ## [Reindex nested to non-nested](https://discuss.elastic.co/t/reindex-nested-to-non-nested/269961)
**Author:** [@ajitha](https://discuss.elastic.co/u/ajitha)\ **Replies:** 0\ **Last updated:** [April 13, 2021, 2:07am UTC](https://discuss.elastic.co/t/reindex-nested-to-non-nested/269961 "2021-04-13T02:07:55Z")
Does the script in the "reindex API" support mapping of nested fields to non nested fields? If i do use the script I keep getting cannot create source field in dest index, even though I have "remove". What is the issu… --- ## [Kibana: Scripted Field: Dynamic date (now - 15d / now - 30d) not working](https://discuss.elastic.co/t/kibana-scripted-field-dynamic-date-now-15d-now-30d-not-working/269781)
**Author:** [@nshari.24](https://discuss.elastic.co/u/nshari.24)\ **Replies:** 4\ **Last updated:** [April 13, 2021, 11:11am UTC](https://discuss.elastic.co/t/kibana-scripted-field-dynamic-date-now-15d-now-30d-not-working/269781 "2021-04-13T11:11:47Z")
I have a scripted field of the format "Date". When I try using this field in Kibana visualization and apply a filter like "date \> now-30d", I am getting an error: caused\_by": { "type": "date\_time\_pa… --- ## [Watchers and Elastic Security](https://discuss.elastic.co/t/watchers-and-elastic-security/268360)
**Author:** [@Anna\_Foxx](https://discuss.elastic.co/u/Anna_Foxx)\ **Replies:** 1\ **Last updated:** [April 13, 2021, 11:01am UTC](https://discuss.elastic.co/t/watchers-and-elastic-security/268360 "2021-04-13T11:01:28Z")
Hi! I have a lot of detections on my watchers. Is it possible to have the alert generated by watchers in the Detection section of Elastic Security SIEM? --- ## [Restart Elastic Lab Training](https://discuss.elastic.co/t/restart-elastic-lab-training/269985)
**Author:** [@artsius](https://discuss.elastic.co/u/artsius)\ **Replies:** 0\ **Last updated:** [April 13, 2021, 9:36am UTC](https://discuss.elastic.co/t/restart-elastic-lab-training/269985 "2021-04-13T09:36:45Z")
May I know how to restart lab training on strigo.io? I have already do restart machine 3 times and nothing is changed. I want to do the lab from start again. Thanks --- ## [Corrélation log](https://discuss.elastic.co/t/correlation-log/269495)
**Author:** [@david\_oliver](https://discuss.elastic.co/u/david_oliver)\ **Replies:** 2\ **Last updated:** [April 13, 2021, 9:35am UTC](https://discuss.elastic.co/t/correlation-log/269495 "2021-04-13T09:35:49Z")
Bonjour, Je cherche des piste sur comment faire matcher des valeur de diffèrent index. le cas d'usage : un index avec des logs apache par exemple un index avec une liste ip si une ip est dans les log apache le faire… --- ## [How can we configure ELK Stack and Filebeat for production environment?](https://discuss.elastic.co/t/how-can-we-configure-elk-stack-and-filebeat-for-production-environment/269968)
**Author:** [@Husnain](https://discuss.elastic.co/u/Husnain)\ **Replies:** 3\ **Last updated:** [April 13, 2021, 8:45am UTC](https://discuss.elastic.co/t/how-can-we-configure-elk-stack-and-filebeat-for-production-environment/269968 "2021-04-13T08:45:00Z")
Hello.Currently I am running ELK Stack and Filebeat for development and testing purpose.After some time I want to run ELK Stack and Filebeat in production environment.How can I do this?What are the configurations to run … --- ## [Time series kibana](https://discuss.elastic.co/t/time-series-kibana/268805)
**Author:** [@Jose\_Manuel\_Tirado](https://discuss.elastic.co/u/Jose_Manuel_Tirado)\ **Replies:** 5\ **Last updated:** [April 13, 2021, 8:24am UTC](https://discuss.elastic.co/t/time-series-kibana/268805 "2021-04-13T08:24:46Z")
Hi!!: I want to compare a data set from the last 15 min with the total mean accumulated over time. How could i do this in kibana? I have tried as TSVB and Timelion and cannot get the desired result. Can anybody help … --- ## [Logstash Runs And Does Nothing](https://discuss.elastic.co/t/logstash-runs-and-does-nothing/269932)
**Author:** [@baklavadeseni](https://discuss.elastic.co/u/baklavadeseni)\ **Replies:** 2\ **Last updated:** [April 13, 2021, 8:16am UTC](https://discuss.elastic.co/t/logstash-runs-and-does-nothing/269932 "2021-04-13T08:16:39Z")
Hi there, I have simple file input/output logstash pipeline. Logstash runs but does nothing. There is no output. In logstash log file only suspicious thing is this "One or more required cgroup files or directories not f… --- ## [Event Correlation detection - tiebreaker field](https://discuss.elastic.co/t/event-correlation-detection-tiebreaker-field/269974)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 0\ **Last updated:** [April 13, 2021, 8:12am UTC](https://discuss.elastic.co/t/event-correlation-detection-tiebreaker-field/269974 "2021-04-13T08:12:10Z")
Hi, I need to use a tiebreaker field within an Event Correlation detection rule, I cannot find in the docs other than for a query, hoping its possible somehow Thanks [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=980) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=982)