# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1169 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1170 --- ## [Elasticsearch G1GC tuning](https://discuss.elastic.co/t/elasticsearch-g1gc-tuning/253964)
**Author:** [@James\_D](https://discuss.elastic.co/u/James_D)\ **Replies:** 5\ **Last updated:** [November 3, 2020, 8:20am UTC](https://discuss.elastic.co/t/elasticsearch-g1gc-tuning/253964 "2020-11-03T08:20:40Z")
We are trying to evaluate an Elasticsearch upgrade from 5.6 to 7.8 and are seeing some unexpected memory pressure on our test 7.8 cluster. Production Cluster: Elasticsearch 5.6 - 12 Nodes - 3 Hot 9 Warm - 64GB RAM, 31G… --- ## [Unable to access secured Elasticsearch using logstash](https://discuss.elastic.co/t/unable-to-access-secured-elasticsearch-using-logstash/253093)
**Author:** [@aakash075](https://discuss.elastic.co/u/aakash075)\ **Replies:** 5\ **Last updated:** [November 3, 2020, 7:07am UTC](https://discuss.elastic.co/t/unable-to-access-secured-elasticsearch-using-logstash/253093 "2020-11-03T07:07:51Z")
Hello Team, I am using Openshift environment and i deployed EFK (Elasticsearch, fluentd and Kibana) stack in it using some logging operators . and then due to some requirement i deployed Logstash as docker container in… --- ## [Sum of bucket script](https://discuss.elastic.co/t/sum-of-bucket-script/254110)
**Author:** [@gokul275](https://discuss.elastic.co/u/gokul275)\ **Replies:** 0\ **Last updated:** [November 3, 2020, 7:00am UTC](https://discuss.elastic.co/t/sum-of-bucket-script/254110 "2020-11-03T07:00:48Z")
I am trying to achieve sum of bucket script values, Is it possible? { "aggs": { "NAME": { "terms": { "field": "date", "size": 10 }, "aggs": { "bal": { "sum": { "field": "balance" } }, "rdb" : { "sum": { "… --- ## [Source a file from inside a logstash config pipeline?](https://discuss.elastic.co/t/source-a-file-from-inside-a-logstash-config-pipeline/254103)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 0\ **Last updated:** [November 3, 2020, 5:22am UTC](https://discuss.elastic.co/t/source-a-file-from-inside-a-logstash-config-pipeline/254103 "2020-11-03T05:22:38Z")
Here's my logstash input config: input { snmp { tables =\> \[ { "name" =\> "interfaces" "columns" =\> \[ ".1.3.6.1.2.1.31.1.1.1.1" … --- ## [Metricbeat 의 disk 데이터 수집에서 DVD-ROM 의 용량이 100%로 나오는게 맞나요?](https://discuss.elastic.co/t/metricbeat-disk-dvd-rom-100/254101)
**Author:** [@jongpyo.lee](https://discuss.elastic.co/u/jongpyo.lee)\ **Replies:** 0\ **Last updated:** [November 3, 2020, 4:53am UTC](https://discuss.elastic.co/t/metricbeat-disk-dvd-rom-100/254101 "2020-11-03T04:53:29Z")
안녕하세요. Metricbeat 에서 Disk 정보를 수집해 올때, DVD-ROM Disk 의 용량이 항상 100%로 나타납니다. 내용이 있는 DVD가 삽입되어 있으면 사용량이 100%로 나오고, 내용이 없는 공 DVD를 삽입하거나 또는 DVD를 빼면 사용량이 0% 로 나옵니다. 실제 디스크의 크기와는 다르게 데이터가 표시되는데, 이것이 정상인가요? 100%가 아닌 실제 크기가 표시… --- ## [When I created logstash offline pack, it doesn't contain the change](https://discuss.elastic.co/t/when-i-created-logstash-offline-pack-it-doesnt-contain-the-change/253983)
**Author:** [@hyon](https://discuss.elastic.co/u/hyon)\ **Replies:** 1\ **Last updated:** [November 3, 2020, 4:52am UTC](https://discuss.elastic.co/t/when-i-created-logstash-offline-pack-it-doesnt-contain-the-change/253983 "2020-11-03T04:52:08Z")
I want to modify the logstash integration rabbitmq plugin and use it (https://github.com/logstash-plugins/logstash-integration-rabbitmq.git) I modified the inputs/rabbitmq.rb and confirmed that it works properly on my l… --- ## [Kibana Email and Call Button](https://discuss.elastic.co/t/kibana-email-and-call-button/253977)
**Author:** [@Syed.Ubaid](https://discuss.elastic.co/u/Syed.Ubaid)\ **Replies:** 5\ **Last updated:** [November 3, 2020, 4:08am UTC](https://discuss.elastic.co/t/kibana-email-and-call-button/253977 "2020-11-03T04:08:54Z")
Hello. I have made dashboard in Kibana. Can we create email and call button in Kibana visualisation. For example i have list of people who have expired identification card number i want to create action button of email a… --- ## [Memcached filter plugin issues](https://discuss.elastic.co/t/memcached-filter-plugin-issues/254095)
**Author:** [@aleksf](https://discuss.elastic.co/u/aleksf)\ **Replies:** 0\ **Last updated:** [November 3, 2020, 3:48am UTC](https://discuss.elastic.co/t/memcached-filter-plugin-issues/254095 "2020-11-03T03:48:06Z")
I was hoping this was fixed in https://github.com/logstash-plugins/logstash-filter-memcached/pull/25 with the plugin release v1.1.0 Related issue was already raised in https://discuss.elastic.co/t/catch-memcached-filter… --- ## [XML Filter Output to Ruby Code](https://discuss.elastic.co/t/xml-filter-output-to-ruby-code/253870)
**Author:** [@chayelastic](https://discuss.elastic.co/u/chayelastic)\ **Replies:** 7\ **Last updated:** [November 3, 2020, 2:22am UTC](https://discuss.elastic.co/t/xml-filter-output-to-ruby-code/253870 "2020-11-03T02:22:40Z")
Hello, In my Logstash config, I have an XML filter with xpath that allows me to read the XML tags and store in a variable/field. It works well. Next step, I had to use a Ruby Filter for I need to transpose a couple o… --- ## [Filtering all Fields/Events](https://discuss.elastic.co/t/filtering-all-fields-events/254088)
**Author:** [@faridNR](https://discuss.elastic.co/u/faridNR)\ **Replies:** 1\ **Last updated:** [November 3, 2020, 2:21am UTC](https://discuss.elastic.co/t/filtering-all-fields-events/254088 "2020-11-03T02:21:55Z")
Hello Having a centralized log-stream using Logstash with more than hundreds of fields/events types. I'm trying to apply filter to all events/fields and replacing a regex in this case email address. (removing PII) wha… --- ## [Kibana 7.9.3 in sublocation in Nginx](https://discuss.elastic.co/t/kibana-7-9-3-in-sublocation-in-nginx/253919)
**Author:** [@msteini](https://discuss.elastic.co/u/msteini)\ **Replies:** 2\ **Last updated:** [November 3, 2020, 1:58am UTC](https://discuss.elastic.co/t/kibana-7-9-3-in-sublocation-in-nginx/253919 "2020-11-03T01:58:24Z")
Since two days I tried several configurations to run Kibana 7.9.3 (via docker-compose) at a sublocation (for developing on my local machine at https://localhost/analytics/) via Nginx, but it do not work. I hope someone c… --- ## [Cant sent mail upon SIEM alert](https://discuss.elastic.co/t/cant-sent-mail-upon-siem-alert/253517)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 2\ **Last updated:** [November 3, 2020, 1:31am UTC](https://discuss.elastic.co/t/cant-sent-mail-upon-siem-alert/253517 "2020-11-03T01:31:18Z")
Hi all I have some problems with the alert and action with siem part i have config the alert and action to exacly like our watcher ( watcher worked ) I have turned on the xpack.eventLog.logEntries to true when i set … --- ## [Elasticserach stuck](https://discuss.elastic.co/t/elasticserach-stuck/253735)
**Author:** [@Rafael\_Valverde](https://discuss.elastic.co/u/Rafael_Valverde)\ **Replies:** 2\ **Last updated:** [November 3, 2020, 1:27am UTC](https://discuss.elastic.co/t/elasticserach-stuck/253735 "2020-11-03T01:27:56Z")
Elasticsearch after restart it. I ran curl -u admin\_elasticsearch -X DELETE https://elasticsearch.bitbucket.com/bitbucket-search then I rebuilt it curl -u rxv112 -X POST -H 'Content-Type: application/json' -H 'Accept:… --- ## ["failed to update expiration time for async-search" in elastic search logs](https://discuss.elastic.co/t/failed-to-update-expiration-time-for-async-search-in-elastic-search-logs/253903)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 6\ **Last updated:** [November 3, 2020, 1:10am UTC](https://discuss.elastic.co/t/failed-to-update-expiration-time-for-async-search-in-elastic-search-logs/253903 "2020-11-03T01:10:16Z")
Hello, I constantly encounter a problem that throws error failed to update expiration time for async-search in elastichserach cluster application log. Not always but especially when I had haven't query an index for a lo… --- ## [Pre-built set of rules still using SYSMON based detection (winlogbeat- \*, event.code: 1, etc.) or using linguistic terms specific to an operating system (eg: Win 10 EN system user is SYSTEM, but Win 10 PT-BR system user is SISTEMA)](https://discuss.elastic.co/t/pre-built-set-of-rules-still-using-sysmon-based-detection-winlogbeat-event-code-1-etc-or-using-linguistic-terms-specific-to-an-operating-system-eg-win-10-en-system-user-is-system-but-win-10-pt-br-system-user-is-sistema/252933)
**Author:** [@skysbsb](https://discuss.elastic.co/u/skysbsb)\ **Replies:** 1\ **Last updated:** [November 3, 2020, 12:42am UTC](https://discuss.elastic.co/t/pre-built-set-of-rules-still-using-sysmon-based-detection-winlogbeat-event-code-1-etc-or-using-linguistic-terms-specific-to-an-operating-system-eg-win-10-en-system-user-is-system-but-win-10-pt-br-system-user-is-sistema/252933 "2020-11-03T00:42:25Z")
Pre-built set of rules still using SYSMON-based detection (winlogbeat- \*, event.code: 1, etc.) or using linguistic terms specific to an operating system (eg Win 10 EN system user is SYSTEM, but Win 10 PT-BR system user i… --- ## [Getting uniform results from ES](https://discuss.elastic.co/t/getting-uniform-results-from-es/253649)
**Author:** [@IliaIsakhin](https://discuss.elastic.co/u/IliaIsakhin)\ **Replies:** 1\ **Last updated:** [November 3, 2020, 12:23am UTC](https://discuss.elastic.co/t/getting-uniform-results-from-es/253649 "2020-11-03T00:23:10Z")
I would like to get flat and uniform results from my ES index. I have 3 different types of documents in one index and when user types search query I want to return up to 10 documents of each document type even if results… --- ## [Elasticsearch service throwing failed to parse exception while indexing content](https://discuss.elastic.co/t/elasticsearch-service-throwing-failed-to-parse-exception-while-indexing-content/253651)
**Author:** [@PravinC](https://discuss.elastic.co/u/PravinC)\ **Replies:** 1\ **Last updated:** [November 3, 2020, 12:15am UTC](https://discuss.elastic.co/t/elasticsearch-service-throwing-failed-to-parse-exception-while-indexing-content/253651 "2020-11-03T00:15:21Z")
We are trying to index document in Elasticsearch with below structure, { "data": { "blocks": \[ { "block": { "note": "\Test\", "digital-asset-service": "" } }, … --- ## [How can i access the Kibana indices if i am connected to Kibana via SSH tunnel Putty](https://discuss.elastic.co/t/how-can-i-access-the-kibana-indices-if-i-am-connected-to-kibana-via-ssh-tunnel-putty/253705)
**Author:** [@Saket\_Shankar](https://discuss.elastic.co/u/Saket_Shankar)\ **Replies:** 1\ **Last updated:** [November 3, 2020, 12:09am UTC](https://discuss.elastic.co/t/how-can-i-access-the-kibana-indices-if-i-am-connected-to-kibana-via-ssh-tunnel-putty/253705 "2020-11-03T00:09:35Z")
Elasticsearch : localhost:9200 Kibana : connected via SSH Tunnel Putty Problem : Kibana Indices not reflecting in Elasticsearch --- ## [Watcher Alert on Agg Field & Painless Script Condition Error](https://discuss.elastic.co/t/watcher-alert-on-agg-field-painless-script-condition-error/253060)
**Author:** [@jc034240](https://discuss.elastic.co/u/jc034240)\ **Replies:** 1\ **Last updated:** [November 3, 2020, 12:02am UTC](https://discuss.elastic.co/t/watcher-alert-on-agg-field-painless-script-condition-error/253060 "2020-11-03T00:02:37Z")
Hello everyone, My goal of the Watcher is to fire when the unique count of hosts, from the hostname field drops below 110. I have tried both .value and .doc\_count in the script portion of the condition but still get th… --- ## [Is it time to rearchitect my clusters?](https://discuss.elastic.co/t/is-it-time-to-rearchitect-my-clusters/253863)
**Author:** [@reshippie](https://discuss.elastic.co/u/reshippie)\ **Replies:** 1\ **Last updated:** [November 2, 2020, 11:40pm UTC](https://discuss.elastic.co/t/is-it-time-to-rearchitect-my-clusters/253863 "2020-11-02T23:40:30Z")
I currently have 3 main clusters, 1 with 19 nodes and 2 with 15 nodes. In all 3 cases I've left things mostly in their default state, with all nodes as data and master eligible. After a disastrous upgrade followed by a… --- ## [Logstash out knesis](https://discuss.elastic.co/t/logstash-out-knesis/253923)
**Author:** [@111387](https://discuss.elastic.co/u/111387)\ **Replies:** 0\ **Last updated:** [November 1, 2020, 4:55am UTC](https://discuss.elastic.co/t/logstash-out-knesis/253923 "2020-11-01T04:55:43Z")
In logstash, input plugin has knesis, but output plugin is not. There is https://github.com/samcday/logstash-output-kinesis, but it doesn't seem to be being updated anymore. Is there no knesis output method in logstash… --- ## [How to manage elasticsearch logs: disk almost full](https://discuss.elastic.co/t/how-to-manage-elasticsearch-logs-disk-almost-full/254061)
**Author:** [@Mauro\_Tridici](https://discuss.elastic.co/u/Mauro_Tridici)\ **Replies:** 13\ **Last updated:** [November 2, 2020, 8:25pm UTC](https://discuss.elastic.co/t/how-to-manage-elasticsearch-logs-disk-almost-full/254061 "2020-11-02T20:25:11Z")
Dear Users, I'm a newbie and this is the first time I use ELK stack. I was able to deploy ELK stack and capture needed information. I created my first dashboard and visualizations. They are working as expected: we are … --- ## [Parameterized looping in watcher query](https://discuss.elastic.co/t/parameterized-looping-in-watcher-query/253323)
**Author:** [@fredrick.bb](https://discuss.elastic.co/u/fredrick.bb)\ **Replies:** 3\ **Last updated:** [November 2, 2020, 8:19pm UTC](https://discuss.elastic.co/t/parameterized-looping-in-watcher-query/253323 "2020-11-02T20:19:02Z")
Hello, I have created a watcher using advanced query in ver 7.8.0. The watcher runs and fulfills my requirement. But I have to reuse the same query for different values (integer). like a function For each value, The … --- ## [Enabling Encryption for Nodes with basic license](https://discuss.elastic.co/t/enabling-encryption-for-nodes-with-basic-license/254071)
**Author:** [@nikeee](https://discuss.elastic.co/u/nikeee)\ **Replies:** 2\ **Last updated:** [November 2, 2020, 7:20pm UTC](https://discuss.elastic.co/t/enabling-encryption-for-nodes-with-basic-license/254071 "2020-11-02T19:20:18Z")
The license comparison matrix states: ...so I guess encrypted communication is included in the "basic" license. According to the docs, xpack.security.enabled must be set to true for this. Also according to the docs,… --- ## [Advice on query against nested objects](https://discuss.elastic.co/t/advice-on-query-against-nested-objects/254077)
**Author:** [@genericusername](https://discuss.elastic.co/u/genericusername)\ **Replies:** 0\ **Last updated:** [November 2, 2020, 7:41pm UTC](https://discuss.elastic.co/t/advice-on-query-against-nested-objects/254077 "2020-11-02T19:41:13Z")
We are using ElasticSearch 6.8, and performing searches against an index of "locations" that have nested "offers" within them. A location can have many nested offers and offers can be nested within many locations. Locati… --- ## [Elasticsearch 7.9: using a suggester for every field in multiple indexes](https://discuss.elastic.co/t/elasticsearch-7-9-using-a-suggester-for-every-field-in-multiple-indexes/254076)
**Author:** [@Alex11](https://discuss.elastic.co/u/Alex11)\ **Replies:** 0\ **Last updated:** [November 2, 2020, 7:37pm UTC](https://discuss.elastic.co/t/elasticsearch-7-9-using-a-suggester-for-every-field-in-multiple-indexes/254076 "2020-11-02T19:37:32Z")
I have indexed multiple documents for my website with Elasticsearch and would like to use a suggester on all of the fields in all of the indices. I'm trying to create a site wide search that searches all indexed content … --- ## [London Information Retrieval Meetup](https://discuss.elastic.co/t/london-information-retrieval-meetup/254072)
**Author:** [@Alessandro\_Benedett1](https://discuss.elastic.co/u/Alessandro_Benedett1)\ **Replies:** 0\ **Last updated:** [November 2, 2020, 6:54pm UTC](https://discuss.elastic.co/t/london-information-retrieval-meetup/254072 "2020-11-02T18:54:58Z")
Hi ! The London Information Retrieval Meetup has moved online: https://www.meetup.com/London-Information-Retrieval-Meetup-Group It is a free evening meetup aimed at Information Retrieval passionates and professional… --- ## [Kibana not showing values lower than 1](https://discuss.elastic.co/t/kibana-not-showing-values-lower-than-1/253994)
**Author:** [@sfischer](https://discuss.elastic.co/u/sfischer)\ **Replies:** 2\ **Last updated:** [November 2, 2020, 6:14pm UTC](https://discuss.elastic.co/t/kibana-not-showing-values-lower-than-1/253994 "2020-11-02T18:14:16Z")
Hello, I am using Kibana v 7.6.2 to visualize some log data. I have a problem when analysing data of decimal number values between 0 and 1. e.g. 0, 0, 0.163, 0.037, 0.164, 0.25, 0.202, 0 I tried visualizing the data … --- ## [Data node can't find the master on elasticsearch cluster](https://discuss.elastic.co/t/data-node-cant-find-the-master-on-elasticsearch-cluster/254043)
**Author:** [@Pavle\_Ilic](https://discuss.elastic.co/u/Pavle_Ilic)\ **Replies:** 1\ **Last updated:** [November 2, 2020, 6:08pm UTC](https://discuss.elastic.co/t/data-node-cant-find-the-master-on-elasticsearch-cluster/254043 "2020-11-02T18:08:22Z")
So, I have two elasticsearch servers and wanted to form a cluster with master and data node, but I'm facing some difficulties in connecting them in a same cluster, these are my .yml files and the things I've tried so far… --- ## [Error while genrating reports](https://discuss.elastic.co/t/error-while-genrating-reports/251051)
**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\ **Replies:** 5\ **Last updated:** [November 2, 2020, 6:03pm UTC](https://discuss.elastic.co/t/error-while-genrating-reports/251051 "2020-11-02T18:03:25Z")
I am working with Kibana versio 7.9 and I tried to generate a PDF report of my dashboad. Keep getting the below error Unable to generate report Error: Error spawning Chromium browser: \[Error: Protocol error (Target.se… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1168) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1170)