# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1151 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1152 --- ## [Script field not returning value](https://discuss.elastic.co/t/script-field-not-returning-value/255549)
**Author:** [@pmo](https://discuss.elastic.co/u/pmo)\ **Replies:** 5\ **Last updated:** [November 16, 2020, 4:15pm UTC](https://discuss.elastic.co/t/script-field-not-returning-value/255549 "2020-11-16T16:15:15Z")
Hi support, I've created this Script Field in Kibana index pattern, but I've an issue, nothing is return... Each time I have a field name : category\_name that match "Router", I should have a value (netflow value), But … --- ## [Indices.breaker.request advice](https://discuss.elastic.co/t/indices-breaker-request-advice/255568)
**Author:** [@lechuck](https://discuss.elastic.co/u/lechuck)\ **Replies:** 0\ **Last updated:** [November 16, 2020, 3:59pm UTC](https://discuss.elastic.co/t/indices-breaker-request-advice/255568 "2020-11-16T15:59:47Z")
Hello - a quick one hopefully! Occasionally we experience issues when end users run heavy aggregations - the parent circuit breaker is tripped and this causes issues for other clients which may be performing lighter unr… --- ## [Solution for Logstash json file input - solution pour injecter un fichier json formaté comme ci dessous](https://discuss.elastic.co/t/solution-for-logstash-json-file-input-solution-pour-injecter-un-fichier-json-formate-comme-ci-dessous/255564)
**Author:** [@pmo](https://discuss.elastic.co/u/pmo)\ **Replies:** 0\ **Last updated:** [November 16, 2020, 3:37pm UTC](https://discuss.elastic.co/t/solution-for-logstash-json-file-input-solution-pour-injecter-un-fichier-json-formate-comme-ci-dessous/255564 "2020-11-16T15:37:53Z")
I've json file that are formated like this (j'ai des fichiers json formatés comme ci dessous - les données ont été changées) \[ { "crossConnectVlanRanges": "", "productAndRelease": "FX-I.2.0", "role": "", … --- ## [Droping log when missing time entry](https://discuss.elastic.co/t/droping-log-when-missing-time-entry/255521)
**Author:** [@iccMe](https://discuss.elastic.co/u/iccMe)\ **Replies:** 2\ **Last updated:** [November 16, 2020, 3:10pm UTC](https://discuss.elastic.co/t/droping-log-when-missing-time-entry/255521 "2020-11-16T15:10:42Z")
Hi, I was wondering if anyone could advise the best way to drop a log when the actual time is missing from the logged event. Normally the majority of the logs look like: \[19/10/2020 00:00:01\] servername - Processor… --- ## [Logstash Validation Failed: 1: no requests](https://discuss.elastic.co/t/logstash-validation-failed-1-no-requests/255379)
**Author:** [@Tosh](https://discuss.elastic.co/u/Tosh)\ **Replies:** 3\ **Last updated:** [November 16, 2020, 3:04pm UTC](https://discuss.elastic.co/t/logstash-validation-failed-1-no-requests/255379 "2020-11-16T15:04:11Z")
Hi , Logstash gives below error intermittently and then stops processing data after a while . Logstash version : 7.0.1 Elastic version : 7.0.1 Java : JDK8 Could it be due to malformed requests ? We do see some malfo… --- ## [Proper configuration of "server.host", "elasticsearch.host", and "network.host" settings on multinode cluster in production](https://discuss.elastic.co/t/proper-configuration-of-server-host-elasticsearch-host-and-network-host-settings-on-multinode-cluster-in-production/255378)
**Author:** [@Dennis1](https://discuss.elastic.co/u/Dennis1)\ **Replies:** 2\ **Last updated:** [November 16, 2020, 2:56pm UTC](https://discuss.elastic.co/t/proper-configuration-of-server-host-elasticsearch-host-and-network-host-settings-on-multinode-cluster-in-production/255378 "2020-11-16T14:56:55Z")
Hello, I'm building a multi-node elastic stack cluster with the following nodes: 3 master-eligible nodes (with all default roles) 1 coordinating-only node with Kibana additional data/ingest-dedicated nodes as needed A… --- ## [Logstash monitoring not showing one pipeline](https://discuss.elastic.co/t/logstash-monitoring-not-showing-one-pipeline/255559)
**Author:** [@mtudisco](https://discuss.elastic.co/u/mtudisco)\ **Replies:** 0\ **Last updated:** [November 16, 2020, 2:56pm UTC](https://discuss.elastic.co/t/logstash-monitoring-not-showing-one-pipeline/255559 "2020-11-16T14:56:12Z")
Hi, I have two machines with logstash Machine 1: only logstash 7.7 with 4 pipelines, one of them called "main" Machine 2: logstash 7.3, kibana 7.3 and elasticsearch 7.3. Logstash only one pipeline called "main" On bo… --- ## [Reindex / Consolidate Indizes](https://discuss.elastic.co/t/reindex-consolidate-indizes/255544)
**Author:** [@ksremo](https://discuss.elastic.co/u/ksremo)\ **Replies:** 4\ **Last updated:** [November 16, 2020, 2:53pm UTC](https://discuss.elastic.co/t/reindex-consolidate-indizes/255544 "2020-11-16T14:53:12Z")
How to migrate from multiple timebased indizes \-\ to a single \ index without losing data? --- ## ["Migrating .kibana\_3 saved objects to .kibana\_4" - 7.9.3 upgrade to 7.10](https://discuss.elastic.co/t/migrating-kibana-3-saved-objects-to-kibana-4-7-9-3-upgrade-to-7-10/255259)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 3\ **Last updated:** [November 16, 2020, 2:51pm UTC](https://discuss.elastic.co/t/migrating-kibana-3-saved-objects-to-kibana-4-7-9-3-upgrade-to-7-10/255259 "2020-11-16T14:51:52Z")
Deleting the .kibana\_4 and restarting the kibana instance leaves me in a permanent death loop. This will run for 3+ hours and do nothing. Nothing happens checking the journlctl logs this is what always shows up "Migratin… --- ## [Issues setting up Lab for Observability Fundamentals](https://discuss.elastic.co/t/issues-setting-up-lab-for-observability-fundamentals/252563)
**Author:** [@gmlewis0](https://discuss.elastic.co/u/gmlewis0)\ **Replies:** 8\ **Last updated:** [November 16, 2020, 2:50pm UTC](https://discuss.elastic.co/t/issues-setting-up-lab-for-observability-fundamentals/252563 "2020-11-16T14:50:22Z")
Hi, I just signed up this morning for the Observability Fundamentals class and am running into issues trying to set the lab up. I followed the initial instructions to log into strigo and the machine appeared to start and… --- ## [Configure Kibana to use proxy](https://discuss.elastic.co/t/configure-kibana-to-use-proxy/253419)
**Author:** [@Yustas](https://discuss.elastic.co/u/Yustas)\ **Replies:** 4\ **Last updated:** [November 16, 2020, 2:45pm UTC](https://discuss.elastic.co/t/configure-kibana-to-use-proxy/253419 "2020-11-16T14:45:41Z")
Hello I have fresh cluster installation from docker images. Docker images version's - 7.9.3 Server work in isolated network. When i try look available plugins from kibana, application try connect directly to https://… --- ## [V1beta1 Beats and the note about upgrades](https://discuss.elastic.co/t/v1beta1-beats-and-the-note-about-upgrades/255103)
**Author:** [@SeanPlacchetti](https://discuss.elastic.co/u/SeanPlacchetti)\ **Replies:** 3\ **Last updated:** [November 16, 2020, 1:37pm UTC](https://discuss.elastic.co/t/v1beta1-beats-and-the-note-about-upgrades/255103 "2020-11-16T13:37:04Z")
Hello, I can't tell if the note in the documentation about Operator upgrades running on Openshift 3.11 applies to the Beats or just the Elasticsearch deployments through ECK. Our Beat yamls are based on the quickstarts … --- ## [SIEM Rule Use Case](https://discuss.elastic.co/t/siem-rule-use-case/255475)
**Author:** [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 12:29pm UTC](https://discuss.elastic.co/t/siem-rule-use-case/255475 "2020-11-16T12:29:27Z")
Hi, I have a use case which I am not yet sure can be fulfilled by Elastic SIEM. I have created some different behavioral rules to detect ransomware activities and they work such as the deletion of restore of files and m… --- ## [Signal - multiple login failure from same user](https://discuss.elastic.co/t/signal-multiple-login-failure-from-same-user/255517)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 12:24pm UTC](https://discuss.elastic.co/t/signal-multiple-login-failure-from-same-user/255517 "2020-11-16T12:24:57Z")
Please help me to create a signal for below logic. Alert if there is more than 3 login failure from same user in last 5min. I have mentioned below the watcher query written for same above logic. “query”: { “bool”: { … --- ## [Compare two fields in SIEM](https://discuss.elastic.co/t/compare-two-fields-in-siem/253927)
**Author:** [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Replies:** 13\ **Last updated:** [November 16, 2020, 11:50am UTC](https://discuss.elastic.co/t/compare-two-fields-in-siem/253927 "2020-11-16T11:50:59Z")
Hi, I want to trigger an alarm if two fields have the same value. is it possible or I have to use watcher? --- ## [Cluster with separate roles docker/ansible](https://discuss.elastic.co/t/cluster-with-separate-roles-docker-ansible/254977)
**Author:** [@vinci](https://discuss.elastic.co/u/vinci)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 11:25am UTC](https://discuss.elastic.co/t/cluster-with-separate-roles-docker-ansible/254977 "2020-11-16T11:25:41Z")
Hello, I'm trying to set up an elasticsearch cluster with 3 nodes, one master, the other two data. I'm doing this all through ansible and in order to also set up the ssl connection between the nodes, I'm making use of a… --- ## [Boolean Logic in Synonym Set?](https://discuss.elastic.co/t/boolean-logic-in-synonym-set/255384)
**Author:** [@ALK1](https://discuss.elastic.co/u/ALK1)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 11:20am UTC](https://discuss.elastic.co/t/boolean-logic-in-synonym-set/255384 "2020-11-16T11:20:02Z")
Hi all, I’m trying to create a synonym set for an acronym so it will match against an exact phrase, like "United Stated of America" for USA. It seems I can’t put quotation marks in the synonym set fields. Does anyone kn… --- ## [Behaviour of ES when using multiple path in path.data](https://discuss.elastic.co/t/behaviour-of-es-when-using-multiple-path-in-path-data/255483)
**Author:** [@anon17386273](https://discuss.elastic.co/u/anon17386273)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 11:05am UTC](https://discuss.elastic.co/t/behaviour-of-es-when-using-multiple-path-in-path-data/255483 "2020-11-16T11:05:31Z")
I would like to know how data is stored in ES when using multiple paths Each folder paths are RAID0. If a hard disk fails, how does ES allocate the data? Any help is appreciated. Thank you --- ## [Large file chunking with Ingest-Attachment](https://discuss.elastic.co/t/large-file-chunking-with-ingest-attachment/255134)
**Author:** [@MBResolution](https://discuss.elastic.co/u/MBResolution)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 10:49am UTC](https://discuss.elastic.co/t/large-file-chunking-with-ingest-attachment/255134 "2020-11-16T10:49:44Z")
We have recently upgraded ElasticSearch from version 2 to version 7.9. We index attachments like PDFs, Word and Excel files. We previously used the “mapper-attachment” plugin for this. Mapper-attachment is not supported … --- ## [Regex Pattern to read log from application server](https://discuss.elastic.co/t/regex-pattern-to-read-log-from-application-server/255492)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 0\ **Last updated:** [November 16, 2020, 10:40am UTC](https://discuss.elastic.co/t/regex-pattern-to-read-log-from-application-server/255492 "2020-11-16T10:40:22Z")
HI Team, WE are using ELK 6.4.0 in production and by using Rsyslog service we are sending log from application server to logstash. In application log we have multline data and we are not sure which we can use to send t… --- ## [Create Elastic index from Python script](https://discuss.elastic.co/t/create-elastic-index-from-python-script/255354)
**Author:** [@Jose\_Angel\_Morena\_Si](https://discuss.elastic.co/u/Jose_Angel_Morena_Si)\ **Replies:** 2\ **Last updated:** [November 16, 2020, 9:50am UTC](https://discuss.elastic.co/t/create-elastic-index-from-python-script/255354 "2020-11-16T09:50:41Z")
Hello, I am trying to create an index in ES 7.9.1 with python 3. In order to do so I am using elasticsearch python package. Script: doc\_id=hex(random.getrandbits(128))\[2:\] doc = { 'response\_time': … --- ## [Best query to only return documents matching a nested unique id 'id' and not the ES \_id field?](https://discuss.elastic.co/t/best-query-to-only-return-documents-matching-a-nested-unique-id-id-and-not-the-es-id-field/254986)
**Author:** [@M\_Gibbs](https://discuss.elastic.co/u/M_Gibbs)\ **Replies:** 8\ **Last updated:** [November 16, 2020, 9:26am UTC](https://discuss.elastic.co/t/best-query-to-only-return-documents-matching-a-nested-unique-id-id-and-not-the-es-id-field/254986 "2020-11-16T09:26:30Z")
Hey all, I've been pulling my hair out a bit with this. We are running a basic query which matches a set of unique id's - this works perfectly when querying the ES \_id field. But when we try to match a nested id field… --- ## [LambdaConversionException Invalid receiver type interface org.apache.http.Header -from RestHighLevelClient in Logstash Java plugin](https://discuss.elastic.co/t/lambdaconversionexception-invalid-receiver-type-interface-org-apache-http-header-from-resthighlevelclient-in-logstash-java-plugin/255393)
**Author:** [@hellopcz](https://discuss.elastic.co/u/hellopcz)\ **Replies:** 4\ **Last updated:** [November 16, 2020, 9:17am UTC](https://discuss.elastic.co/t/lambdaconversionexception-invalid-receiver-type-interface-org-apache-http-header-from-resthighlevelclient-in-logstash-java-plugin/255393 "2020-11-16T09:17:55Z")
My RestHighLevelClient can run well in Win10 IDEA enviroment for testing, but when I "gradlew gem" the gem package, and run it in CentOS8 logstash-plugin enviroment(Logstash 7.9.0), there will be: \[2020-11-10T00:09:04,… --- ## ["reason": "\[nested\] nested path \[variants.string\_facet\] is not nested"](https://discuss.elastic.co/t/reason-nested-nested-path-variants-string-facet-is-not-nested/255448)
**Author:** [@Guillaume\_R](https://discuss.elastic.co/u/Guillaume_R)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 8:28am UTC](https://discuss.elastic.co/t/reason-nested-nested-path-variants-string-facet-is-not-nested/255448 "2020-11-16T08:28:20Z")
Hi all, I'm facing an error and I really don't understand the problem. I'm using ES6.8. If any one could help me, I would really appreciate. PUT prestashop\_ch { "settings": { "number\_of\_shards": 1, … --- ## [Elasticsearch 7.10.0 support Tableau with JDBC driver?](https://discuss.elastic.co/t/elasticsearch-7-10-0-support-tableau-with-jdbc-driver/255364)
**Author:** [@FTLJ](https://discuss.elastic.co/u/FTLJ)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 8:11am UTC](https://discuss.elastic.co/t/elasticsearch-7-10-0-support-tableau-with-jdbc-driver/255364 "2020-11-16T08:11:50Z")
Will 7.10 support JDBC driver and Elasticsearch Connector for Tableau as same as 7.9? Version 7.9.0 Tableau Desktop uses JDBC driver and Elasticsearch Connector for Tableau. But Version 7.10.0 Tableau Desktop uses … --- ## [Scripted field from sql api not working](https://discuss.elastic.co/t/scripted-field-from-sql-api-not-working/253464)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 6\ **Last updated:** [November 16, 2020, 8:08am UTC](https://discuss.elastic.co/t/scripted-field-from-sql-api-not-working/253464 "2020-11-16T08:08:51Z")
Hi All, I recently started using sql from elasticsearch. i am trying to use below API POST \_sql?format=csv { "query": "SELECT SERVICE\_NAME,Success,count() From"my\_inde" WHERE "@timestamp" \>= NOW() - INTERVAL 3 HOURS… --- ## [Shipping all ElasticSearch logs to AWS S3 on Regular Basis](https://discuss.elastic.co/t/shipping-all-elasticsearch-logs-to-aws-s3-on-regular-basis/252776)
**Author:** [@inf](https://discuss.elastic.co/u/inf)\ **Replies:** 2\ **Last updated:** [November 16, 2020, 7:06am UTC](https://discuss.elastic.co/t/shipping-all-elasticsearch-logs-to-aws-s3-on-regular-basis/252776 "2020-11-16T07:06:44Z")
As title goes, I am currently looking for a solution to ship all ElasticSearch logs to AWS S3 on a regular basis, with the aim of having my EC2 instance hosting the ElasticStack (yes, I have only got one as a trial into … --- ## [Conditional query for SIEM](https://discuss.elastic.co/t/conditional-query-for-siem/255330)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 3\ **Last updated:** [November 16, 2020, 6:03am UTC](https://discuss.elastic.co/t/conditional-query-for-siem/255330 "2020-11-16T06:03:50Z")
Hi all I have some ability that i require SIEM do. i want to make a query and then if that query match then the second query will be call to search for that specific case since not all security case that happen in sing… --- ## [Disk Usage problem](https://discuss.elastic.co/t/disk-usage-problem/255292)
**Author:** [@since1976](https://discuss.elastic.co/u/since1976)\ **Replies:** 3\ **Last updated:** [November 16, 2020, 5:26am UTC](https://discuss.elastic.co/t/disk-usage-problem/255292 "2020-11-16T05:26:52Z")
Hi, A bit of background in our environment, our logstash is installed with elastiflow. 1 cluster of 4 nodes elasticsearch with 2 P and 2 R in 2 zones. The setup is collecting logs from 2 WAN routers with netflow configu… --- ## [Logstash to log file processing start and end time](https://discuss.elastic.co/t/logstash-to-log-file-processing-start-and-end-time/255462)
**Author:** [@sam281](https://discuss.elastic.co/u/sam281)\ **Replies:** 2\ **Last updated:** [November 16, 2020, 3:59am UTC](https://discuss.elastic.co/t/logstash-to-log-file-processing-start-and-end-time/255462 "2020-11-16T03:59:41Z")
Hello, I am trying to forward like 365 gzip historical data files to another log management tool through syslog output plugin and using file input with Read mode. I need to track and log timestamp for every file when i… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1150) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1152)