# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1053 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1054 --- ## [Logs are not getting logged continuously](https://discuss.elastic.co/t/logs-are-not-getting-logged-continuously/263081)
**Author:** [@Bilal\_Malik](https://discuss.elastic.co/u/Bilal_Malik)\ **Replies:** 1\ **Last updated:** [February 10, 2021, 10:31am UTC](https://discuss.elastic.co/t/logs-are-not-getting-logged-continuously/263081 "2021-02-10T10:31:46Z")
Hi, Elastic search is showing very strange behavior from yesterday, it was working perfectly, but now it is missing logs after every ten minutes. It just logs for 5 minutes then shows a gap for the next 10 minutes. Plea… --- ## [ES 7.8.0 plugin development - onIndexModule questions](https://discuss.elastic.co/t/es-7-8-0-plugin-development-onindexmodule-questions/263848)
**Author:** [@Tom\_Elias](https://discuss.elastic.co/u/Tom_Elias)\ **Replies:** 0\ **Last updated:** [February 10, 2021, 10:16am UTC](https://discuss.elastic.co/t/es-7-8-0-plugin-development-onindexmodule-questions/263848 "2021-02-10T10:16:15Z")
Hello, I am currently developing a plugin for Elasticsearch and trying out the new dense\_vector data type. what i'm currently trying to do is register a PostIndexOperationListener and IndexOperationEventListener object… --- ## [Nested query max value](https://discuss.elastic.co/t/nested-query-max-value/263569)
**Author:** [@sivanzakay](https://discuss.elastic.co/u/sivanzakay)\ **Replies:** 1\ **Last updated:** [February 10, 2021, 10:04am UTC](https://discuss.elastic.co/t/nested-query-max-value/263569 "2021-02-10T10:04:15Z")
For a set of documents like this: { "took" : 1, "timed\_out" : false, "\_shards" : { "total" : 1, "successful" : 1, "skipped" : 0, "failed" : 0 }, "hits" : { "total" : { "value" : 3, "relation" : "eq" }, "ma… --- ## [How to do static field in visualization](https://discuss.elastic.co/t/how-to-do-static-field-in-visualization/263834)
**Author:** [@Nazakat](https://discuss.elastic.co/u/Nazakat)\ **Replies:** 6\ **Last updated:** [February 10, 2021, 9:28am UTC](https://discuss.elastic.co/t/how-to-do-static-field-in-visualization/263834 "2021-02-10T09:28:18Z")
In kibana visualization , for example in last 15 minute the kibana visulization shows that user x has count 10 then after 15 minutes if a user is not using computer then it should show count 0 and yes it should also show… --- ## [Parsing json logs issue](https://discuss.elastic.co/t/parsing-json-logs-issue/263638)
**Author:** [@doogle](https://discuss.elastic.co/u/doogle)\ **Replies:** 2\ **Last updated:** [February 10, 2021, 9:26am UTC](https://discuss.elastic.co/t/parsing-json-logs-issue/263638 "2021-02-10T09:26:52Z")
Hi All, I am rather new to all of this and I have been tasked to get logging working in our environment. We have a smoothwall firewall that we use for webfiltering. I have manged to get most of the logs parsed, however … --- ## [Running tasks get terminated when cluster is upgraded from 6.6.2 to 7.10.2 using full cluster restart upgrade approach](https://discuss.elastic.co/t/running-tasks-get-terminated-when-cluster-is-upgraded-from-6-6-2-to-7-10-2-using-full-cluster-restart-upgrade-approach/263668)
**Author:** [@yabhishek](https://discuss.elastic.co/u/yabhishek)\ **Replies:** 7\ **Last updated:** [February 10, 2021, 9:26am UTC](https://discuss.elastic.co/t/running-tasks-get-terminated-when-cluster-is-upgraded-from-6-6-2-to-7-10-2-using-full-cluster-restart-upgrade-approach/263668 "2021-02-10T09:26:39Z")
Hi I tried to upgrade my elasticsearch cluster running version 6.6.2 to version 7.10.2 using full cluster restart upgrade approach. Before performing upgrade, I had some tasks running as can be seen in the following ou… --- ## [Search Error - All Shards failed](https://discuss.elastic.co/t/search-error-all-shards-failed/263817)
**Author:** [@Hyun\_Choi](https://discuss.elastic.co/u/Hyun_Choi)\ **Replies:** 1\ **Last updated:** [February 10, 2021, 8:28am UTC](https://discuss.elastic.co/t/search-error-all-shards-failed/263817 "2021-02-10T08:28:22Z")
After parsing JSON log with the filter I used below filter { if \[type\] == "vizql\_cpp" or \[type\] == "vizql\_tabprotosrv" { json { source =\> "message" } mutate { rename =\>… --- ## [Start from zero with a new cluster](https://discuss.elastic.co/t/start-from-zero-with-a-new-cluster/263843)
**Author:** [@grillo](https://discuss.elastic.co/u/grillo)\ **Replies:** 0\ **Last updated:** [February 10, 2021, 8:12am UTC](https://discuss.elastic.co/t/start-from-zero-with-a-new-cluster/263843 "2021-02-10T08:12:14Z")
Hi all, I've been working with this ELK solution for a few years and I can't restart all the nodes in a cluster to ... start from zero with a new cluster 1st - Delete all stored data I can delete indexes ... (from com… --- ## [Common properties on docs](https://discuss.elastic.co/t/common-properties-on-docs/263412)
**Author:** [@Faycal](https://discuss.elastic.co/u/Faycal)\ **Replies:** 4\ **Last updated:** [February 10, 2021, 8:09am UTC](https://discuss.elastic.co/t/common-properties-on-docs/263412 "2021-02-10T08:09:44Z")
Hello all, i'm new on this community. I have an index of "hits" and for each document we have two parameters: user genre example: doc1 user:john genre:rock doc2 user:john genre:rap doc3 user:bruce genre:ro… --- ## [\[error\]\[data\]\[elasticsearch\] \[TimeoutError\]: Request timed out](https://discuss.elastic.co/t/error-data-elasticsearch-timeouterror-request-timed-out/263830)
**Author:** [@tushar1092](https://discuss.elastic.co/u/tushar1092)\ **Replies:** 1\ **Last updated:** [February 10, 2021, 8:01am UTC](https://discuss.elastic.co/t/error-data-elasticsearch-timeouterror-request-timed-out/263830 "2021-02-10T08:01:01Z")
I am trying to install Kibana on my windows machine, it keeps giving me error. I have also tried to delete all Kibana task - curl -XDELETE http://localhost:9200/.kibana\* But still getting this error. Below are the logs.… --- ## [State tracker file update - JDBC input plugin](https://discuss.elastic.co/t/state-tracker-file-update-jdbc-input-plugin/263268)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 2\ **Last updated:** [February 10, 2021, 7:28am UTC](https://discuss.elastic.co/t/state-tracker-file-update-jdbc-input-plugin/263268 "2021-02-10T07:28:27Z")
Would like to know when the state tracker file get's updated. We are using the jdbc input plugin and modified date from the table has been used as the state tracker field. Would like to know when the state tracker files… --- ## [Logstash is creating data streams instead of indices in ES](https://discuss.elastic.co/t/logstash-is-creating-data-streams-instead-of-indices-in-es/263824)
**Author:** [@naveenj](https://discuss.elastic.co/u/naveenj)\ **Replies:** 0\ **Last updated:** [February 10, 2021, 4:41am UTC](https://discuss.elastic.co/t/logstash-is-creating-data-streams-instead-of-indices-in-es/263824 "2021-02-10T04:41:31Z")
elasticsearch { host =\> "localhost" index\_type =\> "logs-%{\[kubernetes\]\[labels\]\[app\]}" } I am using above configuration in logstash Helm chat values.yml file for OKD setup. filebeat -\>logstash -\>ES Some logs … --- ## [Filebeat - apport.log: permission denied](https://discuss.elastic.co/t/filebeat-apport-log-permission-denied/263048)
**Author:** [@Stud21](https://discuss.elastic.co/u/Stud21)\ **Replies:** 1\ **Last updated:** [February 10, 2021, 4:28am UTC](https://discuss.elastic.co/t/filebeat-apport-log-permission-denied/263048 "2021-02-10T04:28:04Z")
Hi, I'm trying to configure and run Filebeat for one of the training topics related to Lab 4.2: Extracting Events and am getting the below error: 2021-02-02T21:46:53.121Z ERROR log/input.go:519 Harveste… --- ## [File storage](https://discuss.elastic.co/t/file-storage/263813)
**Author:** [@Jcroy](https://discuss.elastic.co/u/Jcroy)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 10:09pm UTC](https://discuss.elastic.co/t/file-storage/263813 "2021-02-09T22:09:46Z")
Hey everyone, I’m trying figure out the best way to configure a backup solution for 8 nodes. I want to have anything older than 30 days be sent to local file storage. Is the best way to do this to use snapshots? --- ## [Getting bucket size from response](https://discuss.elastic.co/t/getting-bucket-size-from-response/263188)
**Author:** [@araujonelson](https://discuss.elastic.co/u/araujonelson)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 9:46pm UTC](https://discuss.elastic.co/t/getting-bucket-size-from-response/263188 "2021-02-09T21:46:45Z")
Hello there. Is there any way to get the bucket size (number of buckets) generated from a terms aggregation? I'm using the Java High Level client but couldn't find anything. P.S: What I'm trying to get is the number 3 … --- ## [Logstash Aggregation and IF/Else](https://discuss.elastic.co/t/logstash-aggregation-and-if-else/263777)
**Author:** [@govind94](https://discuss.elastic.co/u/govind94)\ **Replies:** 0\ **Last updated:** [February 9, 2021, 4:57pm UTC](https://discuss.elastic.co/t/logstash-aggregation-and-if-else/263777 "2021-02-09T16:57:00Z")
I have SOP named GIS which have 3 jobs and getting 3 events {"jobName":"BIS43683","JobStatus":"COMPLETE","@timestamp":"2020-02-08T23:00:47.958Z","JobSystemStatus":"COMPLETE"} {"jobName":"BIS43595","JobStatus":"COMPLETE… --- ## [Logstash Filter - regez](https://discuss.elastic.co/t/logstash-filter-regez/263806)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 3\ **Last updated:** [February 9, 2021, 9:33pm UTC](https://discuss.elastic.co/t/logstash-filter-regez/263806 "2021-02-09T21:33:06Z")
Hi, Please help me with the if condition filter in logstash for same KQL querymentioned below. message: \*.url.\* and not \*failover\* Below logstash filter is not working filter{ if (\[message\] != ‘.\\.url\\..’ and \[messa… --- ## [Issue with deserializing MultilineStringGeoShape](https://discuss.elastic.co/t/issue-with-deserializing-multilinestringgeoshape/263670)
**Author:** [@rckreddy](https://discuss.elastic.co/u/rckreddy)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 9:10pm UTC](https://discuss.elastic.co/t/issue-with-deserializing-multilinestringgeoshape/263670 "2021-02-09T21:10:34Z")
Please see the code below. Results when calling ElasticSearch. "\_source": { "TEST1": 450304485, "TEST2": 1612465007053, "GEOMETRY": { "TYPE": "MultiLineString", "COORDINATES": \[ \[ \[ -83.01273, 39.94391 \], \[ … --- ## [404 Not found only for filebeat](https://discuss.elastic.co/t/404-not-found-only-for-filebeat/258876)
**Author:** [@pup\_seba](https://discuss.elastic.co/u/pup_seba)\ **Replies:** 7\ **Last updated:** [February 9, 2021, 8:05pm UTC](https://discuss.elastic.co/t/404-not-found-only-for-filebeat/258876 "2021-02-09T20:05:09Z")
Hi, We are trying to send our filebeat logs to an elasticsearch cluster but we get this error: 2020-12-16T15:32:37.816+0100 ERROR \[esclientleg\] eslegclient/connection.go:261 error connecting to Elasticsearch a… --- ## [Which is more efficient? KV, Dissect, Split, Grok](https://discuss.elastic.co/t/which-is-more-efficient-kv-dissect-split-grok/263789)
**Author:** [@kavierkoo](https://discuss.elastic.co/u/kavierkoo)\ **Replies:** 2\ **Last updated:** [February 9, 2021, 6:55pm UTC](https://discuss.elastic.co/t/which-is-more-efficient-kv-dissect-split-grok/263789 "2021-02-09T18:55:38Z")
Hi all, As there are many ways to achive similar goal using logstash filters, would like to discuss and compare between KV, Dissect, Split, and Grok, which is a better way of handling data? Scenario 1: Mapping & Parsi… --- ## [Received an event that has a different character encoding than you configured](https://discuss.elastic.co/t/received-an-event-that-has-a-different-character-encoding-than-you-configured/263792)
**Author:** [@MakoWish](https://discuss.elastic.co/u/MakoWish)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 6:32pm UTC](https://discuss.elastic.co/t/received-an-event-that-has-a-different-character-encoding-than-you-configured/263792 "2021-02-09T18:32:01Z")
I have seen several threads related to the same error, but none of them seem to address the issue as we are experiencing it. The messages I get this error for are from ADAudit+ reading logs from an Isilon storage applian… --- ## [Same logstash config file give different result for the same input on different machines](https://discuss.elastic.co/t/same-logstash-config-file-give-different-result-for-the-same-input-on-different-machines/263774)
**Author:** [@Aryaman\_Gupta](https://discuss.elastic.co/u/Aryaman_Gupta)\ **Replies:** 4\ **Last updated:** [February 9, 2021, 6:13pm UTC](https://discuss.elastic.co/t/same-logstash-config-file-give-different-result-for-the-same-input-on-different-machines/263774 "2021-02-09T18:13:57Z")
Hi I have created one logstash conf file but I am running the same config file on two machine, one is mac and other is ubbuntu. For the same input data on my mac I am getting the correct output where as in ubuntu I am g… --- ## [Do not update sql\_last\_value when an Elastic error is encountered](https://discuss.elastic.co/t/do-not-update-sql-last-value-when-an-elastic-error-is-encountered/263788)
**Author:** [@KSmith](https://discuss.elastic.co/u/KSmith)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 5:46pm UTC](https://discuss.elastic.co/t/do-not-update-sql-last-value-when-an-elastic-error-is-encountered/263788 "2021-02-09T17:46:26Z")
input { jdbc { jdbc\_driver\_library =\> "/usr/share/logstash/drivers/jdbc/${PG\_DRIVER}" jdbc\_driver\_class =\> "org.postgresql.Driver" jdbc\_connection\_string =\> "jdbc:postgresql://${DATABASE\_HOST}… --- ## [Logstash/Filebeat is periodically hanging (unresponsive)](https://discuss.elastic.co/t/logstash-filebeat-is-periodically-hanging-unresponsive/263199)
**Author:** [@user2416](https://discuss.elastic.co/u/user2416)\ **Replies:** 3\ **Last updated:** [February 9, 2021, 5:39pm UTC](https://discuss.elastic.co/t/logstash-filebeat-is-periodically-hanging-unresponsive/263199 "2021-02-09T17:39:17Z")
Hi, We are using filebeat as a deamonset on kubernetes nodes to collect all application logs and sending them to logstash and then to elasticsearch. we observe that logs stops working/hangs periodically from some speci… --- ## [TSVB Metric color based on text field and numeric value](https://discuss.elastic.co/t/tsvb-metric-color-based-on-text-field-and-numeric-value/263570)
**Author:** [@Chenlrv](https://discuss.elastic.co/u/Chenlrv)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 5:18pm UTC](https://discuss.elastic.co/t/tsvb-metric-color-based-on-text-field-and-numeric-value/263570 "2021-02-09T17:18:36Z")
Hi, I created a TSVB Metric widget that it's purpose is to function as a traffic light - should be red when there's an error in the system, yellow if there's a warning, and green if all is ok. The problem is, I can't… --- ## [Kibana service not running](https://discuss.elastic.co/t/kibana-service-not-running/263470)
**Author:** [@srcarter](https://discuss.elastic.co/u/srcarter)\ **Replies:** 2\ **Last updated:** [February 9, 2021, 5:18pm UTC](https://discuss.elastic.co/t/kibana-service-not-running/263470 "2021-02-09T17:18:19Z")
Hi there, I recently had our IT build me a new computer that I am dedicating for a simple elasticsearch/kibana machine. I had previously built my own machine for the same purpose and was successful, that machine was ru… --- ## [Kibana console code 44 trying to get \_souce timestamp](https://discuss.elastic.co/t/kibana-console-code-44-trying-to-get-souce-timestamp/263649)
**Author:** [@Chris6](https://discuss.elastic.co/u/Chris6)\ **Replies:** 0\ **Last updated:** [February 8, 2021, 7:10pm UTC](https://discuss.elastic.co/t/kibana-console-code-44-trying-to-get-souce-timestamp/263649 "2021-02-08T19:10:44Z")
I am getting: unexpected character (',' (code 44)): was expecting a colon to seperate field name and value\\n at \[Source: org.elasticsearch.transport. netty4.ByteBufStreamInput@249c1586; line: 3, column:28\]" I am using … --- ## [Index ".async\_search" size growing fast](https://discuss.elastic.co/t/index-async-search-size-growing-fast/261788)
**Author:** [@parallelism](https://discuss.elastic.co/u/parallelism)\ **Replies:** 2\ **Last updated:** [February 9, 2021, 5:04pm UTC](https://discuss.elastic.co/t/index-async-search-size-growing-fast/261788 "2021-02-09T17:04:17Z")
Hello everyone, On a Elasticsearch and Kibana cluster that is monitoring another Elasticsearch cluster, we found that the size of the ".async\_search" index on the monitoring cluster is growing fast (about 2GB in only on… --- ## [Time Duration difference calculation in Logstash](https://discuss.elastic.co/t/time-duration-difference-calculation-in-logstash/263599)
**Author:** [@Rebin](https://discuss.elastic.co/u/Rebin)\ **Replies:** 7\ **Last updated:** [February 9, 2021, 5:01pm UTC](https://discuss.elastic.co/t/time-duration-difference-calculation-in-logstash/263599 "2021-02-09T17:01:43Z")
Hi All, i'm trying to calculate the time difference between 2 dates. I'm capturing the data through jdbc Input "opentime" : "2020-11-01T11:42:59.000Z", "resolvedtime" : "2020-11-02T22:38:37.000Z", Code filter { date… --- ## [Not able to use insert sql query in jdbc\_streaming filter](https://discuss.elastic.co/t/not-able-to-use-insert-sql-query-in-jdbc-streaming-filter/263725)
**Author:** [@Melvin\_Shaju](https://discuss.elastic.co/u/Melvin_Shaju)\ **Replies:** 3\ **Last updated:** [February 9, 2021, 4:57pm UTC](https://discuss.elastic.co/t/not-able-to-use-insert-sql-query-in-jdbc-streaming-filter/263725 "2021-02-09T16:57:37Z")
When I tried to insert some in local mysql using jdbc\_streaming filter, it is showing following error. But no error is shown for select statements. Ruby-0-Thread-12@\[main\]\>worker6: :1\] jdbcstreaming - Exception when exe… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1052) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1054)