# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1134 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1135 --- ## [Logstash and frozen index](https://discuss.elastic.co/t/logstash-and-frozen-index/256593)
**Author:** [@mcantin](https://discuss.elastic.co/u/mcantin)\ **Replies:** 4\ **Last updated:** [November 30, 2020, 4:23am UTC](https://discuss.elastic.co/t/logstash-and-frozen-index/256593 "2020-11-30T04:23:19Z")
Hi, Last week, I froze old indexes (over a month). Everything worked and elasticsearch was faster. But since monday we have this error in loop in Logstash: \[2020-11-24T15:29:42,146\]\[INFO \]\[logstash.outputs.elasticsear… --- ## [Delete Elasticsearch logs](https://discuss.elastic.co/t/delete-elasticsearch-logs/256639)
**Author:** [@hzarrabi](https://discuss.elastic.co/u/hzarrabi)\ **Replies:** 3\ **Last updated:** [November 30, 2020, 12:55am UTC](https://discuss.elastic.co/t/delete-elasticsearch-logs/256639 "2020-11-30T00:55:51Z")
Hi guys, I would like to delete elasticsearch logs placed in /var/log/elasticsearch older then 7 days. I can not find any parameter in log4j2.properties from ELastic official site. Do you have any idea about it or sho… --- ## [Упал эластик в процессе работы с ошибкой all shards failed](https://discuss.elastic.co/t/all-shards-failed/256816)
**Author:** [@111311](https://discuss.elastic.co/u/111311)\ **Replies:** 4\ **Last updated:** [November 29, 2020, 11:37pm UTC](https://discuss.elastic.co/t/all-shards-failed/256816 "2020-11-29T23:37:25Z")
Здравствуйте, помогите разобраться с проблемкой. У нас эластик используется для определения категории, сейчас он работал около 6 часов и вечером упал с ошибкой Elasticsearch\\Common\\Exceptions\\ServerErrorResponseExceptio… --- ## [Extract xml attribute from xml](https://discuss.elastic.co/t/extract-xml-attribute-from-xml/257007)
**Author:** [@AA\_BB](https://discuss.elastic.co/u/AA_BB)\ **Replies:** 0\ **Last updated:** [November 29, 2020, 8:57pm UTC](https://discuss.elastic.co/t/extract-xml-attribute-from-xml/257007 "2020-11-29T20:57:48Z")
I am new to elastic search. Can someone help me to extract XML attributes like Name, LastName, FatherName from the below XML file? This is the XML which I need to parse:OUTPUT(20201112 12:15:23.356):\[IdExecution: '00001… --- ## [Filter conditionals not working as expected](https://discuss.elastic.co/t/filter-conditionals-not-working-as-expected/257002)
**Author:** [@blitzcrg](https://discuss.elastic.co/u/blitzcrg)\ **Replies:** 2\ **Last updated:** [November 29, 2020, 7:44pm UTC](https://discuss.elastic.co/t/filter-conditionals-not-working-as-expected/257002 "2020-11-29T19:44:09Z")
I'm new to logstash, and writing a config to parse logs from the firewall appliance in my home office. I've debugged a few issues with this config already and now I have it to a place where it works without any errors. H… --- ## [An unexpected error occurred! SocketError: initialize: name or service not known](https://discuss.elastic.co/t/an-unexpected-error-occurred-socketerror-initialize-name-or-service-not-known/256981)
**Author:** [@Barak](https://discuss.elastic.co/u/Barak)\ **Replies:** 2\ **Last updated:** [November 29, 2020, 3:23pm UTC](https://discuss.elastic.co/t/an-unexpected-error-occurred-socketerror-initialize-name-or-service-not-known/256981 "2020-11-29T15:23:52Z")
I am using a basic logstash config that used to work: input { s3 { "bucket" =\> "logs-alb-api" "prefix" =\> "AWSLogs/934###" "type" =\> "ELB\_logs" } } filter { m… --- ## [Logstash json line by line](https://discuss.elastic.co/t/logstash-json-line-by-line/256787)
**Author:** [@Didi\_Sisi](https://discuss.elastic.co/u/Didi_Sisi)\ **Replies:** 3\ **Last updated:** [November 29, 2020, 2:44pm UTC](https://discuss.elastic.co/t/logstash-json-line-by-line/256787 "2020-11-29T14:44:45Z")
Hello; I have this logstash.conf file: input { exec { command =\> "python3 news.py" interval =\> 30 codec =\> "json" } } output { stdout { } } without the code =\> json I obtain this result: "message" =\> " {\\n … --- ## [Auditbeat not logging started process that run very short](https://discuss.elastic.co/t/auditbeat-not-logging-started-process-that-run-very-short/255877)
**Author:** [@bertr](https://discuss.elastic.co/u/bertr)\ **Replies:** 1\ **Last updated:** [November 29, 2020, 1:42pm UTC](https://discuss.elastic.co/t/auditbeat-not-logging-started-process-that-run-very-short/255877 "2020-11-29T13:42:55Z")
The process dataset of the system module of auditbeat does not register short running processes. (version = 7.8.1). E.g. cat of small file will not show up in auditbeat index, cat of a bigger file will. Both cat's do sho… --- ## [Already deleted indices comes back as dangling whenever a node restarts](https://discuss.elastic.co/t/already-deleted-indices-comes-back-as-dangling-whenever-a-node-restarts/256841)
**Author:** [@jatin\_gupta](https://discuss.elastic.co/u/jatin_gupta)\ **Replies:** 14\ **Last updated:** [November 29, 2020, 7:55am UTC](https://discuss.elastic.co/t/already-deleted-indices-comes-back-as-dangling-whenever-a-node-restarts/256841 "2020-11-29T07:55:12Z")
Hi, I am running a 8 node ES cluster with version 7.4.2 Everytime a node on the cluster restarts the state becomes red as a lot of dangling indices which are already deleted tries to get restored on the cluster. Only … --- ## [Document\_id is value](https://discuss.elastic.co/t/document-id-is-value/256969)
**Author:** [@salma\_widiarti](https://discuss.elastic.co/u/salma_widiarti)\ **Replies:** 2\ **Last updated:** [November 29, 2020, 12:57am UTC](https://discuss.elastic.co/t/document-id-is-value/256969 "2020-11-29T00:57:12Z")
Hi all, when I run the logstash config, why is my document id its value? Any one can help me? This is my configuration logstash input { http\_poller { urls =\> { users =\> { metho… --- ## [Index on Elastic search contains and starts with search](https://discuss.elastic.co/t/index-on-elastic-search-contains-and-starts-with-search/256968)
**Author:** [@arup\_chakraborty](https://discuss.elastic.co/u/arup_chakraborty)\ **Replies:** 0\ **Last updated:** [November 28, 2020, 11:47pm UTC](https://discuss.elastic.co/t/index-on-elastic-search-contains-and-starts-with-search/256968 "2020-11-28T23:47:54Z")
We are using elastic search for faster searching on our organization data . The data model has organization id, address, organization name, business start date and organization contacts array . We have asked to perform … --- ## [Logstash monitoring data not showing in Stack Monitoring](https://discuss.elastic.co/t/logstash-monitoring-data-not-showing-in-stack-monitoring/256920)
**Author:** [@ffknob](https://discuss.elastic.co/u/ffknob)\ **Replies:** 1\ **Last updated:** [November 28, 2020, 11:05pm UTC](https://discuss.elastic.co/t/logstash-monitoring-data-not-showing-in-stack-monitoring/256920 "2020-11-28T23:05:28Z")
Hello, I'm not managing to get my Logstash metrics to be shown in Kibana's Stack Monitoring UI: Even though it looks like Metricbeat is sending events to the cluster: GET .monitoring-logstash-7-mb-2020.11.27/\_search… --- ## [Logstash json filter plugin values as string](https://discuss.elastic.co/t/logstash-json-filter-plugin-values-as-string/256912)
**Author:** [@nunogt](https://discuss.elastic.co/u/nunogt)\ **Replies:** 4\ **Last updated:** [November 28, 2020, 10:03pm UTC](https://discuss.elastic.co/t/logstash-json-filter-plugin-values-as-string/256912 "2020-11-28T22:03:50Z")
Hi there, Consider the following logstash json filter snippet: json { skip\_on\_invalid\_json =\> true source =\> "message\_body" target =\> "jsondoc" } which results on the following logstash… --- ## [Mutate convert - Logstash shut down](https://discuss.elastic.co/t/mutate-convert-logstash-shut-down/256237)
**Author:** [@JoAnner](https://discuss.elastic.co/u/JoAnner)\ **Replies:** 3\ **Last updated:** [November 28, 2020, 9:35pm UTC](https://discuss.elastic.co/t/mutate-convert-logstash-shut-down/256237 "2020-11-28T21:35:16Z")
This config doesn't work (mutate, convert create shut down). Could somebody explain me a way to resolve this please? # Sample Logstash configuration for creating a simple # Beats -\> Logstash -\> Elasticsearch pipeline. … --- ## [Dynamic template to convert all types to string](https://discuss.elastic.co/t/dynamic-template-to-convert-all-types-to-string/256960)
**Author:** [@nunogt](https://discuss.elastic.co/u/nunogt)\ **Replies:** 0\ **Last updated:** [November 28, 2020, 6:03pm UTC](https://discuss.elastic.co/t/dynamic-template-to-convert-all-types-to-string/256960 "2020-11-28T18:03:46Z")
Hi there, Consider the following logstash json filter snippet: json { skip\_on\_invalid\_json =\> true source =\> "message\_body" target =\> "jsondoc" } which results on the following logstash… --- ## [How to use go-elasticsearch library with gin framework?](https://discuss.elastic.co/t/how-to-use-go-elasticsearch-library-with-gin-framework/256941)
**Author:** [@iooi](https://discuss.elastic.co/u/iooi)\ **Replies:** 0\ **Last updated:** [November 28, 2020, 8:59am UTC](https://discuss.elastic.co/t/how-to-use-go-elasticsearch-library-with-gin-framework/256941 "2020-11-28T08:59:56Z")
Using gin for API. Its route.go func Init(api \*gin.Engine) { r := api.Group("/v1") r.GET("/sites/search/:url", site.Search) } In the controller file, want to use go-elasticsearch for searching ES data. import… --- ## [Cannot remove field with ingest processor](https://discuss.elastic.co/t/cannot-remove-field-with-ingest-processor/256828)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 3\ **Last updated:** [November 28, 2020, 8:07am UTC](https://discuss.elastic.co/t/cannot-remove-field-with-ingest-processor/256828 "2020-11-28T08:07:29Z")
I using ES 7.9.0 My data { "\_index": "original-index-2020.11", "\_type": "\_doc", "\_id": "7K27Bas23a", "\_version": 1, "\_score": null, "\_source": { "http.request.auth": "-", … --- ## [Adding Image to the dashboard or to canvas from local server](https://discuss.elastic.co/t/adding-image-to-the-dashboard-or-to-canvas-from-local-server/256835)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 2\ **Last updated:** [November 28, 2020, 6:33am UTC](https://discuss.elastic.co/t/adding-image-to-the-dashboard-or-to-canvas-from-local-server/256835 "2020-11-28T06:33:29Z")
Hello, I would like to present images from the kibana/elastic server in a dashboard or in a canvas workpad. There are a few discussions around this but none worked for me. In this discussion the URL given is /usr/shar… --- ## [Default logs format filebeat](https://discuss.elastic.co/t/default-logs-format-filebeat/256933)
**Author:** [@Supun\_Madushanka](https://discuss.elastic.co/u/Supun_Madushanka)\ **Replies:** 0\ **Last updated:** [November 28, 2020, 5:21am UTC](https://discuss.elastic.co/t/default-logs-format-filebeat/256933 "2020-11-28T05:21:47Z")
I am new to elk stack. i configure filebeat and elk and kibana I have nodejs application. I write logs in to file. now i send the row log for the elk. here is my log format {phase} {ip} {room} {message} ${JSON.stringif… --- ## [TimeOut Error during indexing](https://discuss.elastic.co/t/timeout-error-during-indexing/256312)
**Author:** [@amir\_veyseh](https://discuss.elastic.co/u/amir_veyseh)\ **Replies:** 5\ **Last updated:** [November 28, 2020, 4:51am UTC](https://discuss.elastic.co/t/timeout-error-during-indexing/256312 "2020-11-28T04:51:12Z")
I have installed EleasticSearch using the instructions from here. I run it using systemd. I have also made the following changes in the configuration: Disabling swap Change heap size to 20 GB Set refresh interval to -1 … --- ## [Monitoring older stack in a the newer one (Logstash Version Mismatch)](https://discuss.elastic.co/t/monitoring-older-stack-in-a-the-newer-one-logstash-version-mismatch/256918)
**Author:** [@ffknob](https://discuss.elastic.co/u/ffknob)\ **Replies:** 1\ **Last updated:** [November 27, 2020, 10:53pm UTC](https://discuss.elastic.co/t/monitoring-older-stack-in-a-the-newer-one-logstash-version-mismatch/256918 "2020-11-27T22:53:51Z")
Hello, I'm trying to set a monitoring cluster up to monitor Elastic Stacks from our different customers. Each stack is in a different version. To begin with, I tried to set a 7.10 Metricbeat to send data for a 7.3 Logs… --- ## [Problem with WinlogBeat Dashboard ECS](https://discuss.elastic.co/t/problem-with-winlogbeat-dashboard-ecs/256848)
**Author:** [@tesla](https://discuss.elastic.co/u/tesla)\ **Replies:** 1\ **Last updated:** [November 27, 2020, 9:42pm UTC](https://discuss.elastic.co/t/problem-with-winlogbeat-dashboard-ecs/256848 "2020-11-27T21:42:03Z")
Hi Guys I have node Centos 8 kibana version 7.10.0, nano /etc/kibana/kibana.yml server.port: 5601 server.host: 0.0.0.0 elasticsearch.hosts: \["http://elasticsearch:9200"\] kibana.index: ".kibana" I have node Cento… --- ## [Logstash does not forget the previous csv header coming from filebeat](https://discuss.elastic.co/t/logstash-does-not-forget-the-previous-csv-header-coming-from-filebeat/256910)
**Author:** [@jason.greffier](https://discuss.elastic.co/u/jason.greffier)\ **Replies:** 2\ **Last updated:** [November 27, 2020, 8:36pm UTC](https://discuss.elastic.co/t/logstash-does-not-forget-the-previous-csv-header-coming-from-filebeat/256910 "2020-11-27T20:36:40Z")
Hi, My issue: When I pass csv files from filebeat with different header, csv output does not match the right column with the right value. Does someone know to manage that, forget the previous csv header read by log … --- ## [Ingesting O365 logs but having issues with specific mappings](https://discuss.elastic.co/t/ingesting-o365-logs-but-having-issues-with-specific-mappings/256081)
**Author:** [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\ **Replies:** 5\ **Last updated:** [November 27, 2020, 8:33pm UTC](https://discuss.elastic.co/t/ingesting-o365-logs-but-having-issues-with-specific-mappings/256081 "2020-11-27T20:33:52Z")
Hi, We are using Filebeat with the O365 module. These events get shipped to Redis which then Logstash fetches from. The logs are getting ingested but some of the events are having mapping issues with the field "o365.aud… --- ## [Having an issue while trying to reindex using a script](https://discuss.elastic.co/t/having-an-issue-while-trying-to-reindex-using-a-script/256915)
**Author:** [@tarek](https://discuss.elastic.co/u/tarek)\ **Replies:** 1\ **Last updated:** [November 27, 2020, 8:29pm UTC](https://discuss.elastic.co/t/having-an-issue-while-trying-to-reindex-using-a-script/256915 "2020-11-27T20:29:38Z")
Hello, So, I'm trying to reindex documents into a new index with a stored script. the used script has a parameter called "increment". when I start reindexing, I get a null pointer exception. This is my code. POST \_sc… --- ## [Perform search on ES but limit to hot nodes only?](https://discuss.elastic.co/t/perform-search-on-es-but-limit-to-hot-nodes-only/256782)
**Author:** [@smlbiobot](https://discuss.elastic.co/u/smlbiobot)\ **Replies:** 8\ **Last updated:** [November 27, 2020, 8:16pm UTC](https://discuss.elastic.co/t/perform-search-on-es-but-limit-to-hot-nodes-only/256782 "2020-11-27T20:16:34Z")
We have employed a hot-warm architecture in our cluster, and the indices share the same prefix. Right now, to keep our process sane, we do this to our indices: Reindex the original index named name-YYYY.MM into a new i… --- ## [Can any one tell me to make aggregation on dynamic field\_name or restructure data](https://discuss.elastic.co/t/can-any-one-tell-me-to-make-aggregation-on-dynamic-field-name-or-restructure-data/255412)
**Author:** [@tushar.sharma.cse](https://discuss.elastic.co/u/tushar.sharma.cse)\ **Replies:** 2\ **Last updated:** [November 27, 2020, 6:54pm UTC](https://discuss.elastic.co/t/can-any-one-tell-me-to-make-aggregation-on-dynamic-field-name-or-restructure-data/255412 "2020-11-27T18:54:58Z")
{"updated\_on":"2020-11-15","journal":{"2020-10-20":"a","2020-10-21":"b"}} {"updated\_on":"2020-11-14","journal":{"2020-10-21":"c","2020-10-23":"b"}} How to form aggregation query based on “journal” hash key’s(where k… --- ## [Kibana: Configure Security - missing authentication credentials for REST request](https://discuss.elastic.co/t/kibana-configure-security-missing-authentication-credentials-for-rest-request/256790)
**Author:** [@Jurilz](https://discuss.elastic.co/u/Jurilz)\ **Replies:** 7\ **Last updated:** [November 27, 2020, 7:06pm UTC](https://discuss.elastic.co/t/kibana-configure-security-missing-authentication-credentials-for-rest-request/256790 "2020-11-27T19:06:43Z")
Good day, I'm curious about the alert-functionality in Kibana. Therefore I'm setting up the security in Kibana. I already set the elasticsearch passwords (interactive). This are my configs kibana.yml server.name: ki… --- ## [Filter Aggregation on nested object ... not working as expected!](https://discuss.elastic.co/t/filter-aggregation-on-nested-object-not-working-as-expected/256718)
**Author:** [@Guillaume\_R](https://discuss.elastic.co/u/Guillaume_R)\ **Replies:** 6\ **Last updated:** [November 27, 2020, 6:53pm UTC](https://discuss.elastic.co/t/filter-aggregation-on-nested-object-not-working-as-expected/256718 "2020-11-27T18:53:08Z")
Hello, I have some product like this { "id\_product" : "180", "name" : "Domane AL 3 femme", "manufacturer" : "TREK", "cat\_path" : "Product\>377~velos~Vélos\>35~route~Route\>44~course… --- ## [Network.host or http.host - documentation problem?](https://discuss.elastic.co/t/network-host-or-http-host-documentation-problem/64179)
**Author:** [@tsmori](https://discuss.elastic.co/u/tsmori)\ **Replies:** 28\ **Last updated:** [November 27, 2020, 5:01pm UTC](https://discuss.elastic.co/t/network-host-or-http-host-documentation-problem/64179 "2020-11-27T17:01:04Z")
The default works fine, however it's only binding to localhost. I want to be able to bind elasticsearch to a non-loopback IP. Docs say this is possible, but setting 0.0.0.0 or the actual adapater IP results in the follo… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1133) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1135)