# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1158 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1159 --- ## [Updating elasticsearch entities with bulk](https://discuss.elastic.co/t/updating-elasticsearch-entities-with-bulk/254936)
**Author:** [@Alex12](https://discuss.elastic.co/u/Alex12)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 3:30pm UTC](https://discuss.elastic.co/t/updating-elasticsearch-entities-with-bulk/254936 "2020-11-10T15:30:12Z")
I have this database data as below (ES 7.xx) version { "id":"1234", "expirationDate":"17343234234", "paths":"http:localhost:9090", "work":"software dev", "family":{ "baba":"jams", "mother"… --- ## [How to access nested docs in scripted\_metric after nested aggregation](https://discuss.elastic.co/t/how-to-access-nested-docs-in-scripted-metric-after-nested-aggregation/254947)
**Author:** [@drewblin](https://discuss.elastic.co/u/drewblin)\ **Replies:** 1\ **Last updated:** [November 10, 2020, 8:53pm UTC](https://discuss.elastic.co/t/how-to-access-nested-docs-in-scripted-metric-after-nested-aggregation/254947 "2020-11-10T20:53:55Z")
How can i access nested docs in scripted\_metric after nested aggregation? I make request { "query": { "match\_all": {} }, "aggs": { "q1": { "nested": { "path": "pp" }, "aggs": { "q2": { "scripted… --- ## [How to reindex after updating a field's ignore\_above attribute](https://discuss.elastic.co/t/how-to-reindex-after-updating-a-fields-ignore-above-attribute/254964)
**Author:** [@pheathers](https://discuss.elastic.co/u/pheathers)\ **Replies:** 2\ **Last updated:** [November 10, 2020, 8:47pm UTC](https://discuss.elastic.co/t/how-to-reindex-after-updating-a-fields-ignore-above-attribute/254964 "2020-11-10T20:47:21Z")
Hi. I have an index created using dynamic mapping with a field set to the default ignore\_above value of 256. I realized that the length is not nearly as high as I would need since the field can have stack traces. I u… --- ## [Using rank and partition in vega-lite](https://discuss.elastic.co/t/using-rank-and-partition-in-vega-lite/254831)
**Author:** [@smruthip](https://discuss.elastic.co/u/smruthip)\ **Replies:** 3\ **Last updated:** [November 10, 2020, 8:32pm UTC](https://discuss.elastic.co/t/using-rank-and-partition-in-vega-lite/254831 "2020-11-10T20:32:47Z")
Hi all, Can we do something like this in vega-lite or any other way in Kibana to display the count and state of the container? Select count(\*), state from ( select container\_id, state, rank() over (partition by co… --- ## [Count licences](https://discuss.elastic.co/t/count-licences/254180)
**Author:** [@jeleb](https://discuss.elastic.co/u/jeleb)\ **Replies:** 3\ **Last updated:** [November 10, 2020, 8:25pm UTC](https://discuss.elastic.co/t/count-licences/254180 "2020-11-10T20:25:41Z")
Hi all, I'm new to ELK I use ELK to parse flexlm log files, and I want to know the number of licenses used simultaneously A flexlm example log file : 22:26:18 (lmgrd) TIMESTAMP 5/22/2013 23:19:37 (MLM) OUT: … --- ## [Log stack freezing After starting API end point](https://discuss.elastic.co/t/log-stack-freezing-after-starting-api-end-point/253618)
**Author:** [@Srini12](https://discuss.elastic.co/u/Srini12)\ **Replies:** 23\ **Last updated:** [November 10, 2020, 8:24pm UTC](https://discuss.elastic.co/t/log-stack-freezing-after-starting-api-end-point/253618 "2020-11-10T20:24:44Z")
Hi Guys I am new to Logstash. I am trying to write small json file to Logstash. It is reading my config etc and freezing after Starting API End Point. No errors showing. Below is my config file; input { file { path… --- ## [CentOS: Failed to start Elasticsearch 7.3.1](https://discuss.elastic.co/t/centos-failed-to-start-elasticsearch-7-3-1/254767)
**Author:** [@obi134](https://discuss.elastic.co/u/obi134)\ **Replies:** 3\ **Last updated:** [November 10, 2020, 7:54pm UTC](https://discuss.elastic.co/t/centos-failed-to-start-elasticsearch-7-3-1/254767 "2020-11-10T19:54:34Z")
Hi there, Some time ago I installed ELKB-Stack on CentOS7. It was running great. Everything was working. Unfortunately it was broken about half a year ago, but I did not got time to look after it earlier. In meantime I… --- ## [Primary & replica shards with different size](https://discuss.elastic.co/t/primary-replica-shards-with-different-size/254849)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 3\ **Last updated:** [November 10, 2020, 7:54pm UTC](https://discuss.elastic.co/t/primary-replica-shards-with-different-size/254849 "2020-11-10T19:54:05Z")
Hi there, yesterday I saw that a primary shard and its replica do have a different size. GET /\_cat/shards/dus-log-3v\_mcc\_pp\_dev-6.6.0-2020.42 dus-log-3v\_mcc\_pp\_dev-6.6.0-2020.42 0 p STARTED 29677 35.9mb X.X.X.X node1 … --- ## [Logstash and RabbitMQ input duplicate messages](https://discuss.elastic.co/t/logstash-and-rabbitmq-input-duplicate-messages/254957)
**Author:** [@tomsozolins](https://discuss.elastic.co/u/tomsozolins)\ **Replies:** 7\ **Last updated:** [November 10, 2020, 7:50pm UTC](https://discuss.elastic.co/t/logstash-and-rabbitmq-input-duplicate-messages/254957 "2020-11-10T19:50:07Z")
Hello! I have annoying problem which i am trying to solve for like a week now and i have no idea where to look anymore... ElasticStack 7.9.3 on 3 node cluster (CentOS 7, 3.10.0-1127.19.1.el7.x86\_64). RabbitMQ 3.8.9 E… --- ## [Discover in Kibana show differrent data in Table vs. JSON](https://discuss.elastic.co/t/discover-in-kibana-show-differrent-data-in-table-vs-json/254892)
**Author:** [@Michaela\_Krkosova](https://discuss.elastic.co/u/Michaela_Krkosova)\ **Replies:** 4\ **Last updated:** [November 10, 2020, 7:13pm UTC](https://discuss.elastic.co/t/discover-in-kibana-show-differrent-data-in-table-vs-json/254892 "2020-11-10T19:13:37Z")
Hi there I use ELK Stack 7.2. and when I import data, I Discover in Kibana I see proper data, but in JSON, there is missing letter (Š). I see that Kibana can read it properly. I push data to Elastistack via Logstash (IS… --- ## [Question on the capability of elastic SIEM](https://discuss.elastic.co/t/question-on-the-capability-of-elastic-siem/254843)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 1\ **Last updated:** [November 10, 2020, 7:10pm UTC](https://discuss.elastic.co/t/question-on-the-capability-of-elastic-siem/254843 "2020-11-10T19:10:02Z")
Hi all I have a question on how extent SIEM can query for data. Can siem query for regex data like the api can. --- ## [Logstash--jackson-databind vulnerabilities for logstash-7.9.0](https://discuss.elastic.co/t/logstash-jackson-databind-vulnerabilities-for-logstash-7-9-0/254962)
**Author:** [@irfan5189](https://discuss.elastic.co/u/irfan5189)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 6:15pm UTC](https://discuss.elastic.co/t/logstash-jackson-databind-vulnerabilities-for-logstash-7-9-0/254962 "2020-11-10T18:15:57Z")
We found vulnerabilities with logstash version 7.9.0 for jackson-databind. below are the few CVE's for the versions: CVE-2020-24750 CVE-2017-18640 CVE-2020-24616 CVE-2020-14195 CVE-2020-14060 CVE-2020-14062 CVE-2… --- ## [Date\_time\_parse\_exception Warning message in Logstash while fetching data from CSV file](https://discuss.elastic.co/t/date-time-parse-exception-warning-message-in-logstash-while-fetching-data-from-csv-file/254922)
**Author:** [@Pavitra\_Poojary](https://discuss.elastic.co/u/Pavitra_Poojary)\ **Replies:** 5\ **Last updated:** [November 10, 2020, 5:54pm UTC](https://discuss.elastic.co/t/date-time-parse-exception-warning-message-in-logstash-while-fetching-data-from-csv-file/254922 "2020-11-10T17:54:11Z")
Hi, I am trying to fetch data from few csv file input { file { path =\> "/root/API\*" start\_position =\> "beginning" sincedb\_path =\> "/dev/null" type =\> "API" } } filter { csv { separator =\> ",… --- ## [Documents found in scroll, can't be updated?](https://discuss.elastic.co/t/documents-found-in-scroll-cant-be-updated/254956)
**Author:** [@coogle](https://discuss.elastic.co/u/coogle)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 5:36pm UTC](https://discuss.elastic.co/t/documents-found-in-scroll-cant-be-updated/254956 "2020-11-10T17:36:08Z")
Hello, I am using the PHP bindings to do a simple update of an index of about 60k documents via scroll. Basically I am just splitting one field of comma-separated values into two separate lists. I am encountering somet… --- ## [Shard unassigned NODE\_LEFT](https://discuss.elastic.co/t/shard-unassigned-node-left/254955)
**Author:** [@kpiyush](https://discuss.elastic.co/u/kpiyush)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 5:34pm UTC](https://discuss.elastic.co/t/shard-unassigned-node-left/254955 "2020-11-10T17:34:30Z")
Hi, I have restarted the Elsaticsearch worker nodes. After restarting, one of the indexes is stuck on INITIALIZING mode and it is been quite a long time. I ran: curl -k -XGET 'https://eu1.elasticsearch.svc.cluster.loc… --- ## [Shards rebalance after node leaves cluster](https://discuss.elastic.co/t/shards-rebalance-after-node-leaves-cluster/254930)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 2\ **Last updated:** [November 10, 2020, 5:10pm UTC](https://discuss.elastic.co/t/shards-rebalance-after-node-leaves-cluster/254930 "2020-11-10T17:10:33Z")
Hello eveybody ! In a 6.8 cluster of 3 hot nodes and 2 cold nodes (with node attribute "Zone" and forced awareness option) : hot\_node1: Zone1 hot\_node2: Zone1 cold\_node\_4: Zone1 / hot\_node3: Zone2 hot\_node5: Zo… --- ## [Kibana - What privileges required for Save Search option?](https://discuss.elastic.co/t/kibana-what-privileges-required-for-save-search-option/254952)
**Author:** [@brapnda23](https://discuss.elastic.co/u/brapnda23)\ **Replies:** 2\ **Last updated:** [November 10, 2020, 4:55pm UTC](https://discuss.elastic.co/t/kibana-what-privileges-required-for-save-search-option/254952 "2020-11-10T16:55:50Z")
I am using a basic license. Created a few spaces and assigned folks to those spaces. What least index/cluster privilege I need to enable the Save search option for a user in a particular space. I have already given rep… --- ## [Ingesting from AWS & Azzure](https://discuss.elastic.co/t/ingesting-from-aws-azzure/254877)
**Author:** [@darkbeatz](https://discuss.elastic.co/u/darkbeatz)\ **Replies:** 1\ **Last updated:** [November 10, 2020, 4:40pm UTC](https://discuss.elastic.co/t/ingesting-from-aws-azzure/254877 "2020-11-10T16:40:22Z")
Hi All Just wondering if people are collecting logs from AWS or Azure and sending to elastic SIEM? Guard duty, cloudtrail etc.. How have you achieved this if so? --- ## [Call Elastic API to get an info on a parameter](https://discuss.elastic.co/t/call-elastic-api-to-get-an-info-on-a-parameter/254762)
**Author:** [@Baptiste\_Orsoni](https://discuss.elastic.co/u/Baptiste_Orsoni)\ **Replies:** 9\ **Last updated:** [November 10, 2020, 4:37pm UTC](https://discuss.elastic.co/t/call-elastic-api-to-get-an-info-on-a-parameter/254762 "2020-11-10T16:37:04Z")
Hello, I would like to use the Elastic Search API in order to get information on a parameter I have in one of my index. In concrete terms, I would like to know if there have been any hits for a particular client . ( pa… --- ## [Rescoring documents based on Author occurrence](https://discuss.elastic.co/t/rescoring-documents-based-on-author-occurrence/254942)
**Author:** [@Charles\_Lariviere](https://discuss.elastic.co/u/Charles_Lariviere)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 3:59pm UTC](https://discuss.elastic.co/t/rescoring-documents-based-on-author-occurrence/254942 "2020-11-10T15:59:59Z")
Hey! We have an index with documents that look like so: { "id": "1", "author\_id": "8", "popularity": 2.5, "tags": \["illustration", "book", "image"\] } We search this index for documents matching given t… --- ## [How to handle nonexistent index in Logstash Elasticsearch filter](https://discuss.elastic.co/t/how-to-handle-nonexistent-index-in-logstash-elasticsearch-filter/254938)
**Author:** [@egray](https://discuss.elastic.co/u/egray)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 3:46pm UTC](https://discuss.elastic.co/t/how-to-handle-nonexistent-index-in-logstash-elasticsearch-filter/254938 "2020-11-10T15:46:10Z")
Hi, I'm getting the exception Failed to query elasticsearch for previous event in Logstash when I use the Elasticsearch filter plugin, because index is dynamic and I can't guarantee that it exists. I could do this with … --- ## [Find static list of phrases in 32M ES index](https://discuss.elastic.co/t/find-static-list-of-phrases-in-32m-es-index/254924)
**Author:** [@mexekanez](https://discuss.elastic.co/u/mexekanez)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 3:04pm UTC](https://discuss.elastic.co/t/find-static-list-of-phrases-in-32m-es-index/254924 "2020-11-10T15:04:21Z")
SO I have a list of 140K records, how do perform a fast search in an index of 32M records? @elasticsearch Appreciate any suggest thanks --- ## [Mutate documentation error](https://discuss.elastic.co/t/mutate-documentation-error/254917)
**Author:** [@gyterpena](https://discuss.elastic.co/u/gyterpena)\ **Replies:** 1\ **Last updated:** [November 10, 2020, 3:34pm UTC](https://discuss.elastic.co/t/mutate-documentation-error/254917 "2020-11-10T15:34:41Z")
Mistake in documentation In above image mutate rename example differs with --- ## [\_grokparsingfailure with Cisco Catalyst switch syslogs](https://discuss.elastic.co/t/grokparsingfailure-with-cisco-catalyst-switch-syslogs/254932)
**Author:** [@Christer\_Palmen](https://discuss.elastic.co/u/Christer_Palmen)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 3:21pm UTC](https://discuss.elastic.co/t/grokparsingfailure-with-cisco-catalyst-switch-syslogs/254932 "2020-11-10T15:21:32Z")
'Hello everybody!' 'I am setting up an Elastic PoC logserver and I am trying to setup Logstash for parsing syslogs from a Cisco switch. Everything is going forward but now I need some help with the filter part of the c… --- ## [CreateJavaVM Failed](https://discuss.elastic.co/t/createjavavm-failed/254928)
**Author:** [@Vitalii\_Kolomiichuk](https://discuss.elastic.co/u/Vitalii_Kolomiichuk)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 3:10pm UTC](https://discuss.elastic.co/t/createjavavm-failed/254928 "2020-11-10T15:10:40Z")
Please help. Can't start elasticsearch service. All configured. JAVA\_HOME in system variables. I tried all solutions that found. Nothing helps. \[2020-11-10 16:28:28\] \[debug\] ( prunsrv.c:1729) \[ 7340\] Commons Daemon pro… --- ## [Combine App and Workplace search](https://discuss.elastic.co/t/combine-app-and-workplace-search/254466)
**Author:** [@icechunk\_k9](https://discuss.elastic.co/u/icechunk_k9)\ **Replies:** 7\ **Last updated:** [November 10, 2020, 3:03pm UTC](https://discuss.elastic.co/t/combine-app-and-workplace-search/254466 "2020-11-10T15:03:21Z")
If we want to use workplace search with an application sources (Confluence) and then include content from our website (Wordpress) into a unified search. How can we do that? it seems like App search (Wordpress) and Workpl… --- ## [Number of grok filters per logstash.conf file](https://discuss.elastic.co/t/number-of-grok-filters-per-logstash-conf-file/254914)
**Author:** [@Carlos\_Fernando\_Palm](https://discuss.elastic.co/u/Carlos_Fernando_Palm)\ **Replies:** 7\ **Last updated:** [November 10, 2020, 2:28pm UTC](https://discuss.elastic.co/t/number-of-grok-filters-per-logstash-conf-file/254914 "2020-11-10T14:28:23Z")
Hello everybody. I am trying to parse logs using multiple grok filters. I have noticed that I can use 8 filters so far, each one with its own pattern, like this: grok{ tag\_on\_failure =\> \[\] pattern\_definitions =\> {"… --- ## [Grok regex with or](https://discuss.elastic.co/t/grok-regex-with-or/254815)
**Author:** [@Carlos\_Fernando\_Palm](https://discuss.elastic.co/u/Carlos_Fernando_Palm)\ **Replies:** 4\ **Last updated:** [November 10, 2020, 2:14pm UTC](https://discuss.elastic.co/t/grok-regex-with-or/254815 "2020-11-10T14:14:34Z")
Hello. I am trying to get some info from a message field using regular expressions. Concretely I want to get what's after certain keywords. This is the regex: (?\<="title" :)(.+?)(?=,)|((?\<="description" :)(.+?)(?=,)) N… --- ## [Fail for update certificate elastic cloud enterprise](https://discuss.elastic.co/t/fail-for-update-certificate-elastic-cloud-enterprise/253607)
**Author:** [@grfneto](https://discuss.elastic.co/u/grfneto)\ **Replies:** 1\ **Last updated:** [November 10, 2020, 1:45pm UTC](https://discuss.elastic.co/t/fail-for-update-certificate-elastic-cloud-enterprise/253607 "2020-11-10T13:45:26Z")
Hi everyone, I'm new with Elastic Cloud Enterprise and installation worked fine but when tested in my web browser, say that certificate not trusted. So i tryed updated certificate generated with the "certbot" the EC… --- ## [Bug Metricbeat -\> Logstash](https://discuss.elastic.co/t/bug-metricbeat-logstash/254916)
**Author:** [@Vlad\_Piratov](https://discuss.elastic.co/u/Vlad_Piratov)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 1:26pm UTC](https://discuss.elastic.co/t/bug-metricbeat-logstash/254916 "2020-11-10T13:26:25Z")
Version stack = 7.6.2 Errors \[2020-11-10T16:26:23,295\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\] Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>nil, :\_index=\>"metricbeat-7.6.2-202… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1157) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1159)