# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1131 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1132 --- ## [Wildcard queries return responses in ES 6.8.0, but not in ES 7.9.3,](https://discuss.elastic.co/t/wildcard-queries-return-responses-in-es-6-8-0-but-not-in-es-7-9-3/257207)
**Author:** [@Tamil\_Selvan](https://discuss.elastic.co/u/Tamil_Selvan)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 1:26pm UTC](https://discuss.elastic.co/t/wildcard-queries-return-responses-in-es-6-8-0-but-not-in-es-7-9-3/257207 "2020-12-01T13:26:21Z")
{ "\_source": \[ "\_id" \], "query": { "bool": { "filter": { "bool": { "must": \[ { "query\_string": { "\_name": "0", "d… --- ## [Problems creating Alerts based on Logs Fields content](https://discuss.elastic.co/t/problems-creating-alerts-based-on-logs-fields-content/257191)
**Author:** [@Ayodele\_Ajayi](https://discuss.elastic.co/u/Ayodele_Ajayi)\ **Replies:** 1\ **Last updated:** [December 1, 2020, 1:23pm UTC](https://discuss.elastic.co/t/problems-creating-alerts-based-on-logs-fields-content/257191 "2020-12-01T13:23:30Z")
I am facing Problems creating Alerts for my Docker Application events based on Logs Fields content like error or warning or any other string in Kibana Discover, any guides or documentation that could help? --- ## [Workplace Search - Text extraction from big pdf files](https://discuss.elastic.co/t/workplace-search-text-extraction-from-big-pdf-files/257043)
**Author:** [@sam1325](https://discuss.elastic.co/u/sam1325)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 12:25pm UTC](https://discuss.elastic.co/t/workplace-search-text-extraction-from-big-pdf-files/257043 "2020-12-01T12:25:58Z")
I added Dropbox as a content source to my Enterprise-search cloud instance. All files got indexed as expected and I can search across multiple sources. But I noticed that for big pdf files (30+ pages), only the first ~10… --- ## [\_split\_type\_failure](https://discuss.elastic.co/t/split-type-failure/256959)
**Author:** [@salma\_widiarti](https://discuss.elastic.co/u/salma_widiarti)\ **Replies:** 6\ **Last updated:** [December 1, 2020, 4:03am UTC](https://discuss.elastic.co/t/split-type-failure/256959 "2020-12-01T04:03:44Z")
Hi all, i have config logstash like this input { http\_poller { urls =\> { users =\> { method =\> GET user =\> "user@gmail.com" password =\> "password" … --- ## [Auto balancer not working in the midst of disk space crisis](https://discuss.elastic.co/t/auto-balancer-not-working-in-the-midst-of-disk-space-crisis/257173)
**Author:** [@test\_tester](https://discuss.elastic.co/u/test_tester)\ **Replies:** 8\ **Last updated:** [December 1, 2020, 11:07am UTC](https://discuss.elastic.co/t/auto-balancer-not-working-in-the-midst-of-disk-space-crisis/257173 "2020-12-01T11:07:08Z")
Hello everyone, So in my cluster, i have 3 nodes, with 70%, 88% and 65% disk space usage. As you might expect, my autobalancer is not working despite my configuration being set as 'enabled:all'. Afraid that my 2nd nod… --- ## [Filebeat to Logatsh, csv header d'ont send in first](https://discuss.elastic.co/t/filebeat-to-logatsh-csv-header-dont-send-in-first/257075)
**Author:** [@Alexis\_Devleeschauwe](https://discuss.elastic.co/u/Alexis_Devleeschauwe)\ **Replies:** 4\ **Last updated:** [December 1, 2020, 11:04am UTC](https://discuss.elastic.co/t/filebeat-to-logatsh-csv-header-dont-send-in-first/257075 "2020-12-01T11:04:34Z")
Hi. Description I need import csv file logs to elasticsearch, for this, have 3 stack Filebeats \> logstash \> elasticsearch. Filebeat read csv , datas is filter by logstash and elasticsearch is stores datas Problem Th… --- ## [Help sorting an average bucket visualization](https://discuss.elastic.co/t/help-sorting-an-average-bucket-visualization/257190)
**Author:** [@zebu14](https://discuss.elastic.co/u/zebu14)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 10:39am UTC](https://discuss.elastic.co/t/help-sorting-an-average-bucket-visualization/257190 "2020-12-01T10:39:45Z")
Hello, I am trying to sort results by their "Y axis" value, but I am using an average bucket aggregation and it seems that the sort option I use is bad... Context: I have users (field "penta\_source.keyword") sending a… --- ## [Not able to sort data in kibana UI](https://discuss.elastic.co/t/not-able-to-sort-data-in-kibana-ui/254102)
**Author:** [@Varun\_S](https://discuss.elastic.co/u/Varun_S)\ **Replies:** 15\ **Last updated:** [December 1, 2020, 10:24am UTC](https://discuss.elastic.co/t/not-able-to-sort-data-in-kibana-ui/254102 "2020-12-01T10:24:11Z")
Hi Team, I am not able to sort data in kibana, Data in kibana UI are jumbled . Is there any way to sort data in Kibana UI? --- ## [Logstash file read , mode read, sincedb, duplicate events after restart logstash](https://discuss.elastic.co/t/logstash-file-read-mode-read-sincedb-duplicate-events-after-restart-logstash/257126)
**Author:** [@slast](https://discuss.elastic.co/u/slast)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 10:15am UTC](https://discuss.elastic.co/t/logstash-file-read-mode-read-sincedb-duplicate-events-after-restart-logstash/257126 "2020-12-01T10:15:12Z")
Hi Guys Can you help me I have a problem with reading files from logstash. After restarting logstash, it rereads the files again and sends events to Elastic. This folder is mounted from another server /opt/Logstore/… --- ## [Use json and plain text beats from filebeat to output to syslog configured in logstash](https://discuss.elastic.co/t/use-json-and-plain-text-beats-from-filebeat-to-output-to-syslog-configured-in-logstash/257186)
**Author:** [@Arjun\_kochhar](https://discuss.elastic.co/u/Arjun_kochhar)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 10:13am UTC](https://discuss.elastic.co/t/use-json-and-plain-text-beats-from-filebeat-to-output-to-syslog-configured-in-logstash/257186 "2020-12-01T10:13:05Z")
Hi, Very new to logstash and have a use case that I want to achieve. I have two different filebeat instances that write to same logstash instance. filebeat instance 1 sends json output and also sets field as json, while … --- ## [Cross cluster replication in different regions in aws elasticsearch](https://discuss.elastic.co/t/cross-cluster-replication-in-different-regions-in-aws-elasticsearch/257067)
**Author:** [@guest123](https://discuss.elastic.co/u/guest123)\ **Replies:** 8\ **Last updated:** [December 1, 2020, 9:18am UTC](https://discuss.elastic.co/t/cross-cluster-replication-in-different-regions-in-aws-elasticsearch/257067 "2020-12-01T09:18:42Z")
Hi .. i am migrating to aws managed elasticsearch from self hosted es.. as part of migration facing an issue with backup(snapshot) and restore. we have 2 distinct clusters preferably us-east and us-west , snapshot repos… --- ## [Elasticsearch available on internal and public ip](https://discuss.elastic.co/t/elasticsearch-available-on-internal-and-public-ip/257170)
**Author:** [@Bertram\_van\_de\_Ven](https://discuss.elastic.co/u/Bertram_van_de_Ven)\ **Replies:** 1\ **Last updated:** [December 1, 2020, 8:32am UTC](https://discuss.elastic.co/t/elasticsearch-available-on-internal-and-public-ip/257170 "2020-12-01T08:32:57Z")
We have an ElasticSearch cluster running, it's local (company network) available and everything works. And I also made each node available on an external ip by configuring the network.bind\_host on localhost, local and pu… --- ## [FATAL Error: \[config validation of \[server\].cors\]: expected value of type \[boolean\] but got \[Object\]](https://discuss.elastic.co/t/fatal-error-config-validation-of-server-cors-expected-value-of-type-boolean-but-got-object/254576)
**Author:** [@JonathanDSSOUZA](https://discuss.elastic.co/u/JonathanDSSOUZA)\ **Replies:** 5\ **Last updated:** [December 1, 2020, 7:23am UTC](https://discuss.elastic.co/t/fatal-error-config-validation-of-server-cors-expected-value-of-type-boolean-but-got-object/254576 "2020-12-01T07:23:08Z")
After updating the ELK from version 7.6.1 to 7.9.2, the kibana does not start, presenting the errors: kibana: FATAL Error: \[config validation of \[server\].cors\]: expected value of type \[boolean\] but got \[Object\] {"type… --- ## [Data node constantly dropping out of the cluster](https://discuss.elastic.co/t/data-node-constantly-dropping-out-of-the-cluster/257163)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 7:05am UTC](https://discuss.elastic.co/t/data-node-constantly-dropping-out-of-the-cluster/257163 "2020-12-01T07:05:04Z")
The data node is constantly falling from the cluster, I don't understand why.Can you please help me? I'm too new to find out why myself. I shared it all here --- ## [How to build Elasticsearch from source without xpack](https://discuss.elastic.co/t/how-to-build-elasticsearch-from-source-without-xpack/256299)
**Author:** [@kayshu](https://discuss.elastic.co/u/kayshu)\ **Replies:** 6\ **Last updated:** [December 1, 2020, 6:13am UTC](https://discuss.elastic.co/t/how-to-build-elasticsearch-from-source-without-xpack/256299 "2020-12-01T06:13:04Z")
Hi, i am trying to build a non-snapshot build of elasticsearch from source using gradle assemble -Dbuild.snapshot=false But I am getting the following exception Property license.key must be set for release build I th… --- ## [How to add a field if the string matches a word in message](https://discuss.elastic.co/t/how-to-add-a-field-if-the-string-matches-a-word-in-message/255804)
**Author:** [@Guhan\_S](https://discuss.elastic.co/u/Guhan_S)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 6:10am UTC](https://discuss.elastic.co/t/how-to-add-a-field-if-the-string-matches-a-word-in-message/255804 "2020-12-01T06:10:40Z")
{"level":30,"time":1605686969640,"pid":1,"hostname":"ip-100-91-70-500","name":"ZA-dev", this is my sample logs, here i am trying to achieve, if level:30 in message it has to create info log-level, i tired filter { … --- ## [Mapping field as geo\_point](https://discuss.elastic.co/t/mapping-field-as-geo-point/257108)
**Author:** [@blitzcrg](https://discuss.elastic.co/u/blitzcrg)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 5:26am UTC](https://discuss.elastic.co/t/mapping-field-as-geo-point/257108 "2020-12-01T05:26:23Z")
I am having some issues with the logstash geoip plugin that I think stem from a lack of understanding with respect to how the elasticsearch output plugin and index mappings interact. Specifically, I need to ensure that s… --- ## [Cannot allocate because a previous copy of the primary shard existed but can no longer be found on the nodes in the cluster](https://discuss.elastic.co/t/cannot-allocate-because-a-previous-copy-of-the-primary-shard-existed-but-can-no-longer-be-found-on-the-nodes-in-the-cluster/257148)
**Author:** [@wfeng888](https://discuss.elastic.co/u/wfeng888)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 4:03am UTC](https://discuss.elastic.co/t/cannot-allocate-because-a-previous-copy-of-the-primary-shard-existed-but-can-no-longer-be-found-on-the-nodes-in-the-cluster/257148 "2020-12-01T04:03:07Z")
I have a cluster with two nodes , version es5.4.3. About 26 shards unassigned after machine down. I get these message GET /\_cluster/allocation/explain { "index": "dcvs\_nonmotorvehicle", "shard": 3, "primary":… --- ## [Use of URL template](https://discuss.elastic.co/t/use-of-url-template/256641)
**Author:** [@Atul\_Gunjal](https://discuss.elastic.co/u/Atul_Gunjal)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 5:12am UTC](https://discuss.elastic.co/t/use-of-url-template/256641 "2020-12-01T05:12:20Z")
How can I use context.panel.filters to open another dashboard in Kibana using URL drill-down in a new tab as new tab support is not available for dashboard drill down in kibana 7.10. Thanks in Advance. --- ## [How to rename some fields by using regex statement](https://discuss.elastic.co/t/how-to-rename-some-fields-by-using-regex-statement/257031)
**Author:** [@xrubick](https://discuss.elastic.co/u/xrubick)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 2:45am UTC](https://discuss.elastic.co/t/how-to-rename-some-fields-by-using-regex-statement/257031 "2020-12-01T02:45:04Z")
this's my logstash output: "prometheus" =\> { "metrics" =\> { "container\_cpu\_load\_average\_10s" =\> 0, "container\_cpu\_user\_seconds\_total" =\> 18.15, "container\_cpu\_syst… --- ## [Reindex from a remote cluster](https://discuss.elastic.co/t/reindex-from-a-remote-cluster/256922)
**Author:** [@twang](https://discuss.elastic.co/u/twang)\ **Replies:** 4\ **Last updated:** [December 1, 2020, 1:44am UTC](https://discuss.elastic.co/t/reindex-from-a-remote-cluster/256922 "2020-12-01T01:44:44Z")
Hi, I am trying to copy my index from one source to another source from a remote cluster. to follow this link I got an error: my cluster is not on reindex.remote.whitelist. I were using - Elasticsearch (Self-Manage… --- ## [Looking for suggestions about mapping](https://discuss.elastic.co/t/looking-for-suggestions-about-mapping/257140)
**Author:** [@MassimoIvaldi](https://discuss.elastic.co/u/MassimoIvaldi)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 12:54am UTC](https://discuss.elastic.co/t/looking-for-suggestions-about-mapping/257140 "2020-12-01T00:54:27Z")
Hello, I am an Italian developer, newbye of Elasticsearch, actually in training. I would experiment as exercice a parser of articles in some French newspaper in order to analyze the text usin Natural Language Processin… --- ## [インデックス、マッピング定義の作成エラー](https://discuss.elastic.co/t/topic/256987)
**Author:** [@miya2](https://discuss.elastic.co/u/miya2)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 1:04am UTC](https://discuss.elastic.co/t/topic/256987 "2020-12-01T01:04:20Z")
以下のマッピング定義を使用したインデックスの作成で エラーが発生しており色々調べてはいるのですが解決せず、 回答頂けますと幸いです。 ElasticsearchのVersion7.5.0を使用しています。 ・mapping.json { "mappings" : { "text" : { "properties" : { "text1" : { "… --- ## [Grok filter does not work pipeline creation error, while its parsing with no issue on grok parser](https://discuss.elastic.co/t/grok-filter-does-not-work-pipeline-creation-error-while-its-parsing-with-no-issue-on-grok-parser/257037)
**Author:** [@amitnirmal01](https://discuss.elastic.co/u/amitnirmal01)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 11:48pm UTC](https://discuss.elastic.co/t/grok-filter-does-not-work-pipeline-creation-error-while-its-parsing-with-no-issue-on-grok-parser/257037 "2020-11-30T23:48:52Z")
\`\`\`%{TIMESTAMP\_ISO8601:timestamp} %{LOGLEVEL:loglevel}.\*\\\[%{THREADNAME:thread}.\*IdamAuthHandler.\*\\\].\* - \\\[carrier:%{GREEDYDATA:carrier}\\\]. \*\\\[product:%{ANYDATA:product}\\\].\*\\\[version:%{ANYDATA:version}\].\*\\\[call:%{ANYDATA:… --- ## [Parse KV:s beginning with a \key=value](https://discuss.elastic.co/t/parse-kv-s-beginning-with-a-xxx-key-value/257055)
**Author:** [@Elitlogik](https://discuss.elastic.co/u/Elitlogik)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 10:14pm UTC](https://discuss.elastic.co/t/parse-kv-s-beginning-with-a-xxx-key-value/257055 "2020-11-30T22:14:52Z")
Is there a way to easily remove the leading in a key-value sequence? \key1=value1 key2=value2 key3=value3 Filter looks like this now: filter { kv {} } Thank you for your support! --- ## [Filebeat: Ingest logs to Datastream](https://discuss.elastic.co/t/filebeat-ingest-logs-to-datastream/256164)
**Author:** [@vishakh](https://discuss.elastic.co/u/vishakh)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 10:06pm UTC](https://discuss.elastic.co/t/filebeat-ingest-logs-to-datastream/256164 "2020-11-30T22:06:56Z")
ELK-stack: 7.10 Currently, I'm using filebeat to ingest logs to elasticsearch directly to an index (example: useract-\*) Since 7.9.1, I see a new feature called data-stream. Question: How can we specify and make filebe… --- ## [No metricbeat data sent via Logstash is shown in Kibana "Metrics" section](https://discuss.elastic.co/t/no-metricbeat-data-sent-via-logstash-is-shown-in-kibana-metrics-section/257091)
**Author:** [@phlegx](https://discuss.elastic.co/u/phlegx)\ **Replies:** 3\ **Last updated:** [November 30, 2020, 7:23pm UTC](https://discuss.elastic.co/t/no-metricbeat-data-sent-via-logstash-is-shown-in-kibana-metrics-section/257091 "2020-11-30T19:23:00Z")
Hi there, I'm sending Metricbeat data via Logstash to Elasticsearch. Data is there and I can query the index just fine in Kibana "Discover". However, even if I add the index in "Observability -\> Metrics - \> Settings",… --- ## [\[ERROR\] Ruby exception occurred: undefined method \`time' for nil:NilClass](https://discuss.elastic.co/t/error-ruby-exception-occurred-undefined-method-time-for-nil-nilclass/256062)
**Author:** [@artem33region](https://discuss.elastic.co/u/artem33region)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 9:09pm UTC](https://discuss.elastic.co/t/error-ruby-exception-occurred-undefined-method-time-for-nil-nilclass/256062 "2020-11-30T21:09:11Z")
Всем привет, в logstash логе возникает ошибка, в моем конфиге есть только одно упоминание про Ruby, вот оно: ruby { code =\> " event.set('duration\_call', event.get('Duration\_temp').time.strftime('%H:%M:… --- ## [New installation - Unable to connect to kibana 7.9.2](https://discuss.elastic.co/t/new-installation-unable-to-connect-to-kibana-7-9-2/256579)
**Author:** [@drivera](https://discuss.elastic.co/u/drivera)\ **Replies:** 4\ **Last updated:** [November 30, 2020, 8:05pm UTC](https://discuss.elastic.co/t/new-installation-unable-to-connect-to-kibana-7-9-2/256579 "2020-11-30T20:05:27Z")
Unable to connect to my kibana server. When connecting through my browser I get the message "refused to connect". This is a new installation. No visible errors in the kibana.log file. Not sure where to go from here. I'm … --- ## [Best Possible way to implement two words search](https://discuss.elastic.co/t/best-possible-way-to-implement-two-words-search/256837)
**Author:** [@Vipul\_Sharma](https://discuss.elastic.co/u/Vipul_Sharma)\ **Replies:** 0\ **Last updated:** [November 27, 2020, 5:37am UTC](https://discuss.elastic.co/t/best-possible-way-to-implement-two-words-search/256837 "2020-11-27T05:37:39Z")
Hi, I was wondering what would be the best possible way to write a ES query to fetch the documents in a way that if the search query is like: 'elastic search' Then on the top it will show all the documents with 'elast… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1130) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1132)