# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1113 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1114 --- ## [How to set java path for elasticsearch](https://discuss.elastic.co/t/how-to-set-java-path-for-elasticsearch/258686)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [December 15, 2020, 9:36am UTC](https://discuss.elastic.co/t/how-to-set-java-path-for-elasticsearch/258686 "2020-12-15T09:36:14Z")
I have java-11 i want to add JAVA\_HOME path in elasticsearch how can i do this i edit this in /etc/default/elasticsearch but when do GET /\_cluster/stats/ it give me output "jvm" : { "max\_uptime\_in\_millis" : 105897… --- ## [UDP Message from Filebeat to ElasticSearch to Grafana - How to filter for my value?](https://discuss.elastic.co/t/udp-message-from-filebeat-to-elasticsearch-to-grafana-how-to-filter-for-my-value/258302)
**Author:** [@dewell](https://discuss.elastic.co/u/dewell)\ **Replies:** 1\ **Last updated:** [December 15, 2020, 8:52am UTC](https://discuss.elastic.co/t/udp-message-from-filebeat-to-elasticsearch-to-grafana-how-to-filter-for-my-value/258302 "2020-12-15T08:52:06Z")
Hello, with the help of several guides I tried to show a constant UDP stream of double values (10 8byte double values each second) in a line chart in Grafana but I'm not sure how to get the value from elasticsearch into… --- ## [Detection Actions fields](https://discuss.elastic.co/t/detection-actions-fields/258304)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 2\ **Last updated:** [December 15, 2020, 8:49am UTC](https://discuss.elastic.co/t/detection-actions-fields/258304 "2020-12-15T08:49:03Z")
Hi, Is there any update on using other fields from the signal to form the action other than the listed fields of {{context.rule.name}} etc. Thanks --- ## [How to put filters for 700+ users to know their count of logins daily basis](https://discuss.elastic.co/t/how-to-put-filters-for-700-users-to-know-their-count-of-logins-daily-basis/258483)
**Author:** [@kirankrish](https://discuss.elastic.co/u/kirankrish)\ **Replies:** 4\ **Last updated:** [December 15, 2020, 8:23am UTC](https://discuss.elastic.co/t/how-to-put-filters-for-700-users-to-know-their-count-of-logins-daily-basis/258483 "2020-12-15T08:23:43Z")
We have logs which captures users logged in and these users can be upto 700+. We need to know the count of each user logged in on a daily basis. What is the optimum way to handle this? --- ## [Error registering Kibana Privileges with Elasticsearch for kibana-.kibana: \[exception\] Trying to create too many scroll contexts](https://discuss.elastic.co/t/error-registering-kibana-privileges-with-elasticsearch-for-kibana-kibana-exception-trying-to-create-too-many-scroll-contexts/257117)
**Author:** [@libbkmz](https://discuss.elastic.co/u/libbkmz)\ **Replies:** 4\ **Last updated:** [December 15, 2020, 8:31am UTC](https://discuss.elastic.co/t/error-registering-kibana-privileges-with-elasticsearch-for-kibana-kibana-exception-trying-to-create-too-many-scroll-contexts/257117 "2020-12-15T08:31:32Z")
Hello, I'm running many clusters of ElasticSearch with Kibana, we have version 7.6.2, this is version info: { "name" : "CLUSTER\_NAME...", "cluster\_name" : "CLUSTER\_NAME", "cluster\_uuid" : "4zR...", "version" : … --- ## [Snapshots - guarantee of correctness?](https://discuss.elastic.co/t/snapshots-guarantee-of-correctness/258025)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 5\ **Last updated:** [December 15, 2020, 7:35am UTC](https://discuss.elastic.co/t/snapshots-guarantee-of-correctness/258025 "2020-12-15T07:35:35Z")
Are the snapshots made by elasticsearch surely not to have any errors? Is there any additional option to quickly check the correctness of generated snapshots? --- ## [Save a "discover" configuration](https://discuss.elastic.co/t/save-a-discover-configuration/258513)
**Author:** [@Francisco\_Navarro](https://discuss.elastic.co/u/Francisco_Navarro)\ **Replies:** 4\ **Last updated:** [December 15, 2020, 7:28am UTC](https://discuss.elastic.co/t/save-a-discover-configuration/258513 "2020-12-15T07:28:14Z")
Hello there! When I use Kibana discover with an index it generates something like this by default: It is not useful for me to visualize this in that way. So I configure the shown fields to have this: I would like … --- ## [Logstash only reads files at startup](https://discuss.elastic.co/t/logstash-only-reads-files-at-startup/258224)
**Author:** [@BoKu](https://discuss.elastic.co/u/BoKu)\ **Replies:** 10\ **Last updated:** [December 15, 2020, 7:22am UTC](https://discuss.elastic.co/t/logstash-only-reads-files-at-startup/258224 "2020-12-15T07:22:54Z")
Hello there, if got a problem with logstash reading files. In generall my input, filter and output is working. The files are generated and copied to the correct path, every hour but logstash doesn't read them, only on (… --- ## [Pie chart of element count of an array](https://discuss.elastic.co/t/pie-chart-of-element-count-of-an-array/258612)
**Author:** [@NiclasK](https://discuss.elastic.co/u/NiclasK)\ **Replies:** 1\ **Last updated:** [December 15, 2020, 6:14am UTC](https://discuss.elastic.co/t/pie-chart-of-element-count-of-an-array/258612 "2020-12-15T06:14:21Z")
Hi, I'm indexing a documents that can look like this: { "ProcessID": "id1", "ErrorList": \[{ "ErrorCode": 123, "Time": "2020-01-01T12:23:45" }, { "ErrorCode": 123, "Time": "2020-01-01T12:44:00" }, … --- ## ["\\"\\\\xF8\\" from ASCII-8BIT to UTF-8", :error\_class=\>"LogStash::Json::GeneratorError"](https://discuss.elastic.co/t/xf8-from-ascii-8bit-to-utf-8-error-class-logstash-generatorerror/258668)
**Author:** [@charan\_teja\_sana](https://discuss.elastic.co/u/charan_teja_sana)\ **Replies:** 0\ **Last updated:** [December 15, 2020, 3:54am UTC](https://discuss.elastic.co/t/xf8-from-ascii-8bit-to-utf-8-error-class-logstash-generatorerror/258668 "2020-12-15T03:54:08Z")
Hello Team, I am getting below message while running JDBC Connection against MS-SQL DB, Could you please help Error Message: \[ERROR\] 2020-12-14 23:55:12.404 \[\[main\]\>worker0\] elasticsearch - An unknown error occurred s… --- ## [Logstash comma delimited csv file with quoted strings](https://discuss.elastic.co/t/logstash-comma-delimited-csv-file-with-quoted-strings/258671)
**Author:** [@nameisnotimportant](https://discuss.elastic.co/u/nameisnotimportant)\ **Replies:** 0\ **Last updated:** [December 15, 2020, 5:13am UTC](https://discuss.elastic.co/t/logstash-comma-delimited-csv-file-with-quoted-strings/258671 "2020-12-15T05:13:05Z")
Hi, I have following comma delimited csv file, which content has a comma in some of the columns. LogTime,Level,ApplicationId,UserId,ProcessId,FormId,Action,Status,Reference,TranRef,IP,SessionId,CIF\_REF\_NO,UserAgent 11… --- ## [Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. org.jruby.exceptions.ArgumentError: (ArgumentError) key cannot be blank](https://discuss.elastic.co/t/exception-in-pipelineworker-the-pipeline-stopped-processing-new-events-please-check-your-filter-configuration-and-restart-logstash-org-jruby-exceptions-argumenterror-argumenterror-key-cannot-be-blank/258670)
**Author:** [@bhavanikallam](https://discuss.elastic.co/u/bhavanikallam)\ **Replies:** 2\ **Last updated:** [December 15, 2020, 4:42am UTC](https://discuss.elastic.co/t/exception-in-pipelineworker-the-pipeline-stopped-processing-new-events-please-check-your-filter-configuration-and-restart-logstash-org-jruby-exceptions-argumenterror-argumenterror-key-cannot-be-blank/258670 "2020-12-15T04:42:17Z")
Plz kindly help --- ## [Searching local files/folders to test elastic search](https://discuss.elastic.co/t/searching-local-files-folders-to-test-elastic-search/258531)
**Author:** [@robo20](https://discuss.elastic.co/u/robo20)\ **Replies:** 4\ **Last updated:** [December 15, 2020, 4:36am UTC](https://discuss.elastic.co/t/searching-local-files-folders-to-test-elastic-search/258531 "2020-12-15T04:36:55Z")
Is there a simple way to do full text search on a bunch of files in various formats (e.g. PDF, EPUB, TXT, DOC) - on locally connected storage? I see the connectors for the cloud services, I just want to do local search. … --- ## [Elastitcsearch 7 : mapping types](https://discuss.elastic.co/t/elastitcsearch-7-mapping-types/258584)
**Author:** [@nages](https://discuss.elastic.co/u/nages)\ **Replies:** 3\ **Last updated:** [December 15, 2020, 3:55am UTC](https://discuss.elastic.co/t/elastitcsearch-7-mapping-types/258584 "2020-12-15T03:55:16Z")
I come across the following phrase and I am under impression that a valid 6.x query with type might give an error. I am using the cluster ES 7.10 Note that in 7.0, \_doc is a permanent part of the path, and represents t… --- ## [Getting unique results on highlight or multiple fields](https://discuss.elastic.co/t/getting-unique-results-on-highlight-or-multiple-fields/258650)
**Author:** [@sec\_r\_and\_d](https://discuss.elastic.co/u/sec_r_and_d)\ **Replies:** 2\ **Last updated:** [December 15, 2020, 3:41am UTC](https://discuss.elastic.co/t/getting-unique-results-on-highlight-or-multiple-fields/258650 "2020-12-15T03:41:53Z")
My indices contain various analyses of executable files. DELETE static\_index,strings\_index PUT static\_index/\_doc/1 { "md5": "85e9e2c4a9c0a7af309c906516aa4548", "static\_api": "ShellExecuteW" } PUT static\_index/\_doc/2… --- ## [How to calculate shard\_size](https://discuss.elastic.co/t/how-to-calculate-shard-size/258664)
**Author:** [@mohammad\_hanifah\_nur](https://discuss.elastic.co/u/mohammad_hanifah_nur)\ **Replies:** 4\ **Last updated:** [December 15, 2020, 2:41am UTC](https://discuss.elastic.co/t/how-to-calculate-shard-size/258664 "2020-12-15T02:41:20Z")
this issue came when i trying to find a top ten summary amount with aggregation by term variable A. variable A have a lot of unique data . that makes the result of the top ten summary amount is invalid. the first thing… --- ## [How to specify Default Quote Analyzer](https://discuss.elastic.co/t/how-to-specify-default-quote-analyzer/258659)
**Author:** [@jacksumit](https://discuss.elastic.co/u/jacksumit)\ **Replies:** 2\ **Last updated:** [December 15, 2020, 2:27am UTC](https://discuss.elastic.co/t/how-to-specify-default-quote-analyzer/258659 "2020-12-15T02:27:30Z")
Is there a way to specify default quote analyzer on index level? We can specify default index analyzer using analysis.analyzer.default. Similarly we can specify default search analyzer using analysis.analyzer.default\_se… --- ## [Best option to parse some data GROK or reindex?](https://discuss.elastic.co/t/best-option-to-parse-some-data-grok-or-reindex/258663)
**Author:** [@fastxl](https://discuss.elastic.co/u/fastxl)\ **Replies:** 0\ **Last updated:** [December 15, 2020, 2:08am UTC](https://discuss.elastic.co/t/best-option-to-parse-some-data-grok-or-reindex/258663 "2020-12-15T02:08:30Z")
I am collecting machine tool data and the logs I am getting are in the JSON format that can be sent to logstash. However I need to break down one of the JSON lines into some more documents. Should I try to run this throu… --- ## [Diff documents](https://discuss.elastic.co/t/diff-documents/258565)
**Author:** [@pskhanapur](https://discuss.elastic.co/u/pskhanapur)\ **Replies:** 1\ **Last updated:** [December 15, 2020, 12:36am UTC](https://discuss.elastic.co/t/diff-documents/258565 "2020-12-15T00:36:19Z")
Is there a way to show diff between two documents in Kibana? Ref. example attached screenshot. Any visualizations or any plugg-in that can do that sort of the diff? Json in the screenshot is just an example, basically … --- ## [How can I delete all indices that don't have documents?](https://discuss.elastic.co/t/how-can-i-delete-all-indices-that-dont-have-documents/258571)
**Author:** [@mahalabobis](https://discuss.elastic.co/u/mahalabobis)\ **Replies:** 1\ **Last updated:** [December 15, 2020, 12:35am UTC](https://discuss.elastic.co/t/how-can-i-delete-all-indices-that-dont-have-documents/258571 "2020-12-15T00:35:09Z")
How can I delete all Elasticsearch that have no documents within? Also, is this safe ? I mean if an index has no documents then it's practically useless right? --- ## [Index pattern's Time Filter on multiple fields](https://discuss.elastic.co/t/index-patterns-time-filter-on-multiple-fields/258644)
**Author:** [@Qazeer](https://discuss.elastic.co/u/Qazeer)\ **Replies:** 1\ **Last updated:** [December 15, 2020, 12:29am UTC](https://discuss.elastic.co/t/index-patterns-time-filter-on-multiple-fields/258644 "2020-12-15T00:29:02Z")
Hello! I have an use case where events have multiple timestamps. Would it be possible to create an index pattern with a Time Filter on those multiple timestamp fields? I would prefer to it through Kibana rather than t… --- ## [Query Data in ELK](https://discuss.elastic.co/t/query-data-in-elk/258628)
**Author:** [@hassan.rana](https://discuss.elastic.co/u/hassan.rana)\ **Replies:** 4\ **Last updated:** [December 14, 2020, 11:56pm UTC](https://discuss.elastic.co/t/query-data-in-elk/258628 "2020-12-14T23:56:05Z")
I need to query messages that are sent from syslog server to logstash via filebeat . I need to curl some data out of the filebeat index. How can I write that query to get the field that what I need? Anyone? Thank you. --- ## [Logstash - SNS output plugin - Pipeline - MissingCredentialsError](https://discuss.elastic.co/t/logstash-sns-output-plugin-pipeline-missingcredentialserror/258649)
**Author:** [@chandra2037](https://discuss.elastic.co/u/chandra2037)\ **Replies:** 0\ **Last updated:** [December 14, 2020, 9:41pm UTC](https://discuss.elastic.co/t/logstash-sns-output-plugin-pipeline-missingcredentialserror/258649 "2020-12-14T21:41:09Z")
Currently configured Logstash V 7.8.1 with SNS output plugin . It is running okay for a while then getting the following error message, then pipeline stops and never recovers. {"level":"ERROR","loggerName":"logstash.… --- ## [Missing Converter handling for full class name=org.postgresql.util.PGobject, simple name=PGobject](https://discuss.elastic.co/t/missing-converter-handling-for-full-class-name-org-postgresql-util-pgobject-simple-name-pgobject/258645)
**Author:** [@frankfoti](https://discuss.elastic.co/u/frankfoti)\ **Replies:** 0\ **Last updated:** [December 14, 2020, 8:52pm UTC](https://discuss.elastic.co/t/missing-converter-handling-for-full-class-name-org-postgresql-util-pgobject-simple-name-pgobject/258645 "2020-12-14T20:52:09Z")
Getting this error trying to use logstash jjdbc to extract complex objects from postgres. Converting to TEXT did not work as well \]\[WARN \]\[logstash.inputs.jdbc \]\[rivi-poc\_people\]\[ed94f8a65daf945d07d8fd7ebea8d75acad… --- ## [Indexing realtime data to elastic search](https://discuss.elastic.co/t/indexing-realtime-data-to-elastic-search/258486)
**Author:** [@pksinghal](https://discuss.elastic.co/u/pksinghal)\ **Replies:** 3\ **Last updated:** [December 14, 2020, 8:50pm UTC](https://discuss.elastic.co/t/indexing-realtime-data-to-elastic-search/258486 "2020-12-14T20:50:54Z")
Hi, I am creating a new user profiling system. I am using Elasticsearch to store user data for fast search. User profiles have various data like registration-data, comment-added-data, reply-data, etc. So whenever the … --- ## [Elasticsearch error: missing authentication credentials for REST request \[/logstash-filebeat-2020.12.11/\_mapping\]](https://discuss.elastic.co/t/elasticsearch-error-missing-authentication-credentials-for-rest-request-logstash-filebeat-2020-12-11-mapping/258435)
**Author:** [@mjcammilleri](https://discuss.elastic.co/u/mjcammilleri)\ **Replies:** 1\ **Last updated:** [December 14, 2020, 8:21pm UTC](https://discuss.elastic.co/t/elasticsearch-error-missing-authentication-credentials-for-rest-request-logstash-filebeat-2020-12-11-mapping/258435 "2020-12-14T20:21:37Z")
Hi Everyone, This could be an issue that crosses with Grafana, but I'm hoping for some insight here. I am able to access the Elasticsearch API using my active token. I can test using curl in various python scripts to pu… --- ## [Problems with Java and Elasticsearch: JVM flavor 'sun6' not understood](https://discuss.elastic.co/t/problems-with-java-and-elasticsearch-jvm-flavor-sun6-not-understood/258510)
**Author:** [@waynesmallman](https://discuss.elastic.co/u/waynesmallman)\ **Replies:** 1\ **Last updated:** [December 14, 2020, 7:56pm UTC](https://discuss.elastic.co/t/problems-with-java-and-elasticsearch-jvm-flavor-sun6-not-understood/258510 "2020-12-14T19:56:49Z")
Hello! I'm preparing a Raspberry Pi 4 as a development environment, and I've hit a snag having installed and configured Java. I've installed Elastic from the official documentation here on Elastic for Debian. However,… --- ## [Unusual Parent-Child Relationship Query and process parent hyphen value](https://discuss.elastic.co/t/unusual-parent-child-relationship-query-and-process-parent-hyphen-value/258570)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [December 14, 2020, 7:18pm UTC](https://discuss.elastic.co/t/unusual-parent-child-relationship-query-and-process-parent-hyphen-value/258570 "2020-12-14T19:18:12Z")
Hello, I'm noticing a large amount of detections on the "Unusual Parent-Child Relationship" detection rule whichs seems to be related to the fact that some processes don't have a parent process. Data source are sysmon f… --- ## [Push\_previous\_map\_as\_event if fields exist](https://discuss.elastic.co/t/push-previous-map-as-event-if-fields-exist/250566)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 39\ **Last updated:** [December 14, 2020, 6:31pm UTC](https://discuss.elastic.co/t/push-previous-map-as-event-if-fields-exist/250566 "2020-12-14T18:31:00Z")
Hi, I need help figuring out a way for Logstash to check if a specific filed exists for a specific task\_id and then aggregate those fields using push\_previous\_map\_as\_event. For example, my current aggregate filter looks… --- ## [Failed to find geo\_point field \[destination.geo.location\]](https://discuss.elastic.co/t/failed-to-find-geo-point-field-destination-geo-location/256966)
**Author:** [@secopsgeek](https://discuss.elastic.co/u/secopsgeek)\ **Replies:** 8\ **Last updated:** [December 14, 2020, 5:17pm UTC](https://discuss.elastic.co/t/failed-to-find-geo-point-field-destination-geo-location/256966 "2020-12-14T17:17:02Z")
Hello everyone, I am having some problems with geo.location showing up on that maps with errors. This is my errors" query\_shard\_exception at \`shard\` 0 \`index\` .ds-logs-windows.security-default-000001 \`node\` stUuKb8ZR4… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1112) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1114)