# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1119 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1120 --- ## [Elastic Parsing](https://discuss.elastic.co/t/elastic-parsing/258192)
**Author:** [@gcsrellis](https://discuss.elastic.co/u/gcsrellis)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 9:59pm UTC](https://discuss.elastic.co/t/elastic-parsing/258192 "2020-12-09T21:59:25Z")
I'm using Security Onion 2 and it uses logstash to ingest logs and sends them to elasticsearch. Their documents say elastic parses the logs and the parsers are located under elasticsearch/ingest/. In that directory the… --- ## [ELK and S3 input](https://discuss.elastic.co/t/elk-and-s3-input/257943)
**Author:** [@pavan45](https://discuss.elastic.co/u/pavan45)\ **Replies:** 5\ **Last updated:** [December 9, 2020, 9:20pm UTC](https://discuss.elastic.co/t/elk-and-s3-input/257943 "2020-12-09T21:20:14Z")
Hi, We have our application logs sent to AWS S3 in csv and text files. Looking to implement ELK with custom S3 plugins to create search and index patterns. --- ## [Missing value for number field](https://discuss.elastic.co/t/missing-value-for-number-field/257832)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 9:09pm UTC](https://discuss.elastic.co/t/missing-value-for-number-field/257832 "2020-12-09T21:09:49Z")
Hi all, I'm creating a data table to display set of data. For "string" type of fields, i'm able to display " missing" value for empty fields of data. For "number" type of fields, there is no option of "missing" values… --- ## [Curl: (7) Failed to connect to 172.16.128.208 port 9200: Connection refused](https://discuss.elastic.co/t/curl-7-failed-to-connect-to-172-16-128-208-port-9200-connection-refused/258067)
**Author:** [@danker00](https://discuss.elastic.co/u/danker00)\ **Replies:** 3\ **Last updated:** [December 9, 2020, 9:01pm UTC](https://discuss.elastic.co/t/curl-7-failed-to-connect-to-172-16-128-208-port-9200-connection-refused/258067 "2020-12-09T21:01:02Z")
Hi Everyone, I am installing elasticsearch on a VM (vmware workstation - NIC: bridged) Host machine (Windows Server) I am getting an error after trying to curl to the IP address of the machine running elasticsearch. I w… --- ## [Deleting Each Others Objects](https://discuss.elastic.co/t/deleting-each-others-objects/257922)
**Author:** [@teej](https://discuss.elastic.co/u/teej)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 7:13pm UTC](https://discuss.elastic.co/t/deleting-each-others-objects/257922 "2020-12-09T19:13:58Z")
Hi, I have created SPACES and put teams in those spaces. In order for them to be able to create dashboards I had to allow ALL for Dashboards and ALL for Visualizations. The problem is that one member can delete or alter… --- ## [Configure Kibana spaces via config file](https://discuss.elastic.co/t/configure-kibana-spaces-via-config-file/258096)
**Author:** [@Kostya\_Zgara](https://discuss.elastic.co/u/Kostya_Zgara)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 6:02pm UTC](https://discuss.elastic.co/t/configure-kibana-spaces-via-config-file/258096 "2020-12-09T18:02:08Z")
Hey everyone! I have a simple question, but no answer I cannot find in the documentation. I want to manage Kibana settings via a configuration file. I'm using ECK operator and bootstrapping Kibana via the operator. I wan… --- ## [Elasticsearch Aggregation - Return a list of array from documents found](https://discuss.elastic.co/t/elasticsearch-aggregation-return-a-list-of-array-from-documents-found/257990)
**Author:** [@KuntalP](https://discuss.elastic.co/u/KuntalP)\ **Replies:** 3\ **Last updated:** [December 9, 2020, 6:01pm UTC](https://discuss.elastic.co/t/elasticsearch-aggregation-return-a-list-of-array-from-documents-found/257990 "2020-12-09T18:01:37Z")
Hi All, I am querying a time series data using the aggregation functionality. The data to be queried is of categorical nature. I use date histogram to first create buckets. From these generated buckets, I wish to extra… --- ## [Can not create an index](https://discuss.elastic.co/t/can-not-create-an-index/258055)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 4\ **Last updated:** [December 9, 2020, 5:42pm UTC](https://discuss.elastic.co/t/can-not-create-an-index/258055 "2020-12-09T17:42:08Z")
Hi. I am trying to create a new index in Kibana. My logstash conf file looks like below: if \[type\] == "uatelectron\_appLog" { mutate { split =\> \["message", "|"\] … --- ## [ELK Update - can not be imported as a dangling index, as index with same name already exists in cluster metadata](https://discuss.elastic.co/t/elk-update-can-not-be-imported-as-a-dangling-index-as-index-with-same-name-already-exists-in-cluster-metadata/256530)
**Author:** [@snolfi](https://discuss.elastic.co/u/snolfi)\ **Replies:** 3\ **Last updated:** [December 9, 2020, 5:33pm UTC](https://discuss.elastic.co/t/elk-update-can-not-be-imported-as-a-dangling-index-as-index-with-same-name-already-exists-in-cluster-metadata/256530 "2020-12-09T17:33:31Z")
Hello, we have updated an old version of elk from 5.6.4 to 6.8.13 (aiming to upgrade to 7.x). But when we restarted elasticsearch we had this error: \`\[2020-11-24T16:29:45,854\]\[WARN \]\[o.e.g.DanglingIndicesState\] \[coll01… --- ## [What does index pattern consist of?](https://discuss.elastic.co/t/what-does-index-pattern-consist-of/258163)
**Author:** [@jhagen92](https://discuss.elastic.co/u/jhagen92)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 5:23pm UTC](https://discuss.elastic.co/t/what-does-index-pattern-consist-of/258163 "2020-12-09T17:23:46Z")
Hi. I am new to Kibana. I already have existing index patterns and logs, so I mostly worked with visualization and dashboard. However, I don't quite understand index pattern. Can someone please explain index pattern in… --- ## [Rotate and remove old Logstash output logs](https://discuss.elastic.co/t/rotate-and-remove-old-logstash-output-logs/256803)
**Author:** [@denisdM](https://discuss.elastic.co/u/denisdM)\ **Replies:** 7\ **Last updated:** [December 9, 2020, 5:09pm UTC](https://discuss.elastic.co/t/rotate-and-remove-old-logstash-output-logs/256803 "2020-12-09T17:09:20Z")
Hello, I've got a Logstash installation (centos 7.6, Logstash 7.2.0) which work great but produce logs and never delete them. I've never changed any default configuration so the /etc/logstash/log4j2.properties files co… --- ## ["Visualizing Log Data with Kibana" needs a refresh](https://discuss.elastic.co/t/visualizing-log-data-with-kibana-needs-a-refresh/257964)
**Author:** [@jberanek](https://discuss.elastic.co/u/jberanek)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 5:03pm UTC](https://discuss.elastic.co/t/visualizing-log-data-with-kibana-needs-a-refresh/257964 "2020-12-09T17:03:42Z")
So, I just did this course (on a training subscription) and I really think it needs a refresh. It's based on Kibana 6.5.x, where TSVB was "experimental" and I think Lens wasn't a thing at all. Given the course covers "s… --- ## [Searching indices when creating vis's returns 0 results](https://discuss.elastic.co/t/searching-indices-when-creating-viss-returns-0-results/258158)
**Author:** [@Matt\_Klaver](https://discuss.elastic.co/u/Matt_Klaver)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 4:14pm UTC](https://discuss.elastic.co/t/searching-indices-when-creating-viss-returns-0-results/258158 "2020-12-09T16:14:04Z")
Our index naming convention uses dashes (-) in the names, and when creating a visualization and searching through that list of indices that pops up we're able to search on anything before the dash, but once we add the da… --- ## [Set a nested field with a variable](https://discuss.elastic.co/t/set-a-nested-field-with-a-variable/258153)
**Author:** [@dwatbmc](https://discuss.elastic.co/u/dwatbmc)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 4:00pm UTC](https://discuss.elastic.co/t/set-a-nested-field-with-a-variable/258153 "2020-12-09T16:00:29Z")
Can't find a way to do this with Mutate, so I am attempting it in Ruby, but still failing: I have two fields: \[log\]\[group\] = "panos" \[log\]\[type\] = "threat" Based on these two field values, I want to copy the JSON Obj… --- ## [How to Analyze field with elasticsearch](https://discuss.elastic.co/t/how-to-analyze-field-with-elasticsearch/258143)
**Author:** [@111417](https://discuss.elastic.co/u/111417)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 3:48pm UTC](https://discuss.elastic.co/t/how-to-analyze-field-with-elasticsearch/258143 "2020-12-09T15:48:46Z")
I want to parse field with spacial format (like Json) with using elasticsearch without logstash , is that possible with using elasticsearch analyze? If it's possible,where can i start? Or there is another way? exampl… --- ## [What does "include related object" mean in Export?](https://discuss.elastic.co/t/what-does-include-related-object-mean-in-export/258151)
**Author:** [@jhagen92](https://discuss.elastic.co/u/jhagen92)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 3:39pm UTC](https://discuss.elastic.co/t/what-does-include-related-object-mean-in-export/258151 "2020-12-09T15:39:13Z")
Hi. I am trying to export my dashboard that uses multiple visualizations. When I export it, there is option called "include related objects". I am not sure what it means. I tried exporting with and without it and compar… --- ## [Logstash - Output - Http - Message](https://discuss.elastic.co/t/logstash-output-http-message/258150)
**Author:** [@rguerrero](https://discuss.elastic.co/u/rguerrero)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 3:31pm UTC](https://discuss.elastic.co/t/logstash-output-http-message/258150 "2020-12-09T15:31:59Z")
The next pipeline work good. input { jdbc { jdbc\_driver\_library =\> "C:\\\\03\_ELK\\\\logstash\\\\drivers\\\\ojdbc6-11.2.0.3.jar" jdbc\_driver\_class =\> "Java::oracle.jdbc.driver.OracleDriver" jdbc\_connection\_string =\>… --- ## [Rule failure for Windows path exclusions?](https://discuss.elastic.co/t/rule-failure-for-windows-path-exclusions/258034)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 4\ **Last updated:** [December 9, 2020, 3:26pm UTC](https://discuss.elastic.co/t/rule-failure-for-windows-path-exclusions/258034 "2020-12-09T15:26:20Z")
Hello, Elastic 7.9.2 Results in: The working directory values were autocompleted, so this seems weird that this throws an error. When I try to escape the '\\' autocomplete does not work. Grtz Willem --- ## [Unable to install logstash-codec-sflow plugin in logstash 5.3.2 version](https://discuss.elastic.co/t/unable-to-install-logstash-codec-sflow-plugin-in-logstash-5-3-2-version/258148)
**Author:** [@praveen\_cs](https://discuss.elastic.co/u/praveen_cs)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 3:24pm UTC](https://discuss.elastic.co/t/unable-to-install-logstash-codec-sflow-plugin-in-logstash-5-3-2-version/258148 "2020-12-09T15:24:53Z")
Hi, Unable to install logstash-codec-sflow plugin in logstash 5.3.2 version ,Tried with logstash version 7.9.2 it is installing , why it is not allowing to install with logstash version 5.3.2 and am getting the foll… --- ## [Prefix query not analyzed](https://discuss.elastic.co/t/prefix-query-not-analyzed/257901)
**Author:** [@davide-martins](https://discuss.elastic.co/u/davide-martins)\ **Replies:** 3\ **Last updated:** [December 9, 2020, 3:11pm UTC](https://discuss.elastic.co/t/prefix-query-not-analyzed/257901 "2020-12-09T15:11:31Z")
Dear team, I'm trying to setup a query that contain a specific prefix in a provided text (not a keyword). PUT my-index { "mappings": { "properties": { "title": { "type": "text", … --- ## [Store value of filed as array](https://discuss.elastic.co/t/store-value-of-filed-as-array/258141)
**Author:** [@AayushPatel](https://discuss.elastic.co/u/AayushPatel)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 2:50pm UTC](https://discuss.elastic.co/t/store-value-of-filed-as-array/258141 "2020-12-09T14:50:41Z")
I am trying to store a json response from an API that received by http plugin of Logstash, in Elasticsearch. one of fields called users returns value like this "users" =\> \[ \[0\] { … --- ## [Dateparsefailure](https://discuss.elastic.co/t/dateparsefailure/258133)
**Author:** [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 2:15pm UTC](https://discuss.elastic.co/t/dateparsefailure/258133 "2020-12-09T14:15:06Z")
hi all, i have very simple input , why i am getting date parse failure here ? \`input { stdin{} } filter { date { match =\> \[ "message", "MMM dd yyyy HH:mm:ss" \] } } output { stdout { codec =\> "rubyde… --- ## [Index attributes from a multiline json string](https://discuss.elastic.co/t/index-attributes-from-a-multiline-json-string/258132)
**Author:** [@Luca\_P](https://discuss.elastic.co/u/Luca_P)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 1:43pm UTC](https://discuss.elastic.co/t/index-attributes-from-a-multiline-json-string/258132 "2020-12-09T13:43:12Z")
Hi All, I need some advice here, I don't want to reinvent the wheel. With Filebeat 6.7.0 I'm picking up logs in typical docker format, , i.e. json strings with "log", "stream" and "time" attributes. In the logs, each … --- ## [Only partial data getting deciphered using cipher filter](https://discuss.elastic.co/t/only-partial-data-getting-deciphered-using-cipher-filter/258129)
**Author:** [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 1:38pm UTC](https://discuss.elastic.co/t/only-partial-data-getting-deciphered-using-cipher-filter/258129 "2020-12-09T13:38:06Z")
Hi Team, I want to decipher a cipher text using logstash. My client is using AES128 encryption. So in logstash I am using cipher filter to decipher the ciphertext. They have also provided me the key , but unfortunately… --- ## [Dashboard - show only last distinct values](https://discuss.elastic.co/t/dashboard-show-only-last-distinct-values/257035)
**Author:** [@Vita\_Rosenberg](https://discuss.elastic.co/u/Vita_Rosenberg)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 1:34pm UTC](https://discuss.elastic.co/t/dashboard-show-only-last-distinct-values/257035 "2020-12-09T13:34:58Z")
I want to show only the last distinct values. Hence without the records with yellow color. Is it possible? --- ## [Kibana settings API](https://discuss.elastic.co/t/kibana-settings-api/258100)
**Author:** [@6NMgfDwZ3](https://discuss.elastic.co/u/6NMgfDwZ3)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 1:08pm UTC](https://discuss.elastic.co/t/kibana-settings-api/258100 "2020-12-09T13:08:10Z")
Hello, ELK 7.10.0 / Kibana Is there any way to change Kibana options Stack Managament / Advanced Settings / "dateFormat" + "dateFormat:tz" + etc. through an API? I haven't found any info about that in the documentatio… --- ## [Kibana Discover order by field](https://discuss.elastic.co/t/kibana-discover-order-by-field/258102)
**Author:** [@Kapila](https://discuss.elastic.co/u/Kapila)\ **Replies:** 5\ **Last updated:** [December 9, 2020, 1:03pm UTC](https://discuss.elastic.co/t/kibana-discover-order-by-field/258102 "2020-12-09T13:03:49Z")
I want to order documents in Discover by a date field using KQL or Lucene. Can you guide me please? --- ## [Memory issue in elasticsearch](https://discuss.elastic.co/t/memory-issue-in-elasticsearch/258027)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 11\ **Last updated:** [December 9, 2020, 12:50pm UTC](https://discuss.elastic.co/t/memory-issue-in-elasticsearch/258027 "2020-12-09T12:50:11Z")
Hi Team, I deployed multi-node cluster few days back and it was working fine. Today I saw elasticsearch service went down due to less memory availability. It is running fine on other two elasticsearch nodes. System ha… --- ## [docFreq for multi\_match with type cross\_fields](https://discuss.elastic.co/t/docfreq-for-multi-match-with-type-cross-fields/258121)
**Author:** [@Lea\_Lacoste](https://discuss.elastic.co/u/Lea_Lacoste)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 12:48pm UTC](https://discuss.elastic.co/t/docfreq-for-multi-match-with-type-cross-fields/258121 "2020-12-09T12:48:49Z")
I am having problems understanding the docFreq for multi\_match queries when using the type cross\_fields. I created a one shard test index, onto which I pushed 4 documents: { "random0": "banana", "random1": "banana", "r… --- ## [Performance Issues during data-ingestion](https://discuss.elastic.co/t/performance-issues-during-data-ingestion/258092)
**Author:** [@M-O](https://discuss.elastic.co/u/M-O)\ **Replies:** 3\ **Last updated:** [December 9, 2020, 12:42pm UTC](https://discuss.elastic.co/t/performance-issues-during-data-ingestion/258092 "2020-12-09T12:42:10Z")
Hi everyone, i am currently testing the elastic stack for observerability use-cases in my company. For testing purposes we build a small elasticsearch cluster (3 nodes) and ingesting http-logs with filebeat. Our PoC-se… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1118) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1120)