# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1186 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1187 --- ## [Adding screenshots to cases](https://discuss.elastic.co/t/adding-screenshots-to-cases/251556)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 4\ **Last updated:** [October 20, 2020, 3:38pm UTC](https://discuss.elastic.co/t/adding-screenshots-to-cases/251556 "2020-10-20T15:38:17Z")
Hello, An awesome enhancement to SIEM would be the ability to paste screenshots in the created cases. Although the timeline is a handy thing, a quick screenshot makes things a lot more clear. Is this a feature that woul… --- ## [Upgrade from 6.8.12 oss to 7.9.2 basic](https://discuss.elastic.co/t/upgrade-from-6-8-12-oss-to-7-9-2-basic/250028)
**Author:** [@searchy](https://discuss.elastic.co/u/searchy)\ **Replies:** 2\ **Last updated:** [October 20, 2020, 3:37pm UTC](https://discuss.elastic.co/t/upgrade-from-6-8-12-oss-to-7-9-2-basic/250028 "2020-10-20T15:37:33Z")
Greetings wonderful elasticsearch wizards! I was wondering if there was any way to do a ROLLING UPGRADE from oss to basic? Specifically, we are looking to go from 6.8.12 oss to 7.9.2 elastic basic. I do see in some p… --- ## [Avast triggering false positives](https://discuss.elastic.co/t/avast-triggering-false-positives/252584)
**Author:** [@0xDECAFBAD](https://discuss.elastic.co/u/0xDECAFBAD)\ **Replies:** 1\ **Last updated:** [October 20, 2020, 3:26pm UTC](https://discuss.elastic.co/t/avast-triggering-false-positives/252584 "2020-10-20T15:26:34Z")
I'm testing Elastic Endpoint on a handful of machines and one thing I noticed is that Avast Antivirus seems to trigger false positive file creation alerts. It sounds like this is the directory Avast will extract files in… --- ## [Forcing a Default Dashboard](https://discuss.elastic.co/t/forcing-a-default-dashboard/252586)
**Author:** [@teej](https://discuss.elastic.co/u/teej)\ **Replies:** 6\ **Last updated:** [October 20, 2020, 3:03pm UTC](https://discuss.elastic.co/t/forcing-a-default-dashboard/252586 "2020-10-20T15:03:13Z")
Hi, Curious how I can force a dashboard to appear as default when a user logs in. Currently, they have to go to the DASHBOARD section and select one but I want them to get one of my choosing the moment they log in. Than… --- ## [Logstash pipelines dose not work independently](https://discuss.elastic.co/t/logstash-pipelines-dose-not-work-independently/252704)
**Author:** [@chamiduz](https://discuss.elastic.co/u/chamiduz)\ **Replies:** 1\ **Last updated:** [October 20, 2020, 3:00pm UTC](https://discuss.elastic.co/t/logstash-pipelines-dose-not-work-independently/252704 "2020-10-20T15:00:18Z")
Hi, I want to implement a logstash pipeline to parallelly send unprocessed data to s3 and processed data to ES. I currently have this implementation but data is not publishing to s3 when ES is not responding. how can … --- ## [Canvas Time filter breaks other elements](https://discuss.elastic.co/t/canvas-time-filter-breaks-other-elements/251754)
**Author:** [@GavinBeattie](https://discuss.elastic.co/u/GavinBeattie)\ **Replies:** 12\ **Last updated:** [October 20, 2020, 2:59pm UTC](https://discuss.elastic.co/t/canvas-time-filter-breaks-other-elements/251754 "2020-10-20T14:59:47Z")
I am trying to add a Time filter element to a Canvas Workpad, but each time I do it breaks the existing table or chart elements. I think that I have followed all online guidance/tutorials to the letter e.g. Both… --- ## [Simple query string, avec l'opérateur pa défault "and" ne marche pas avec nested structure](https://discuss.elastic.co/t/simple-query-string-avec-loperateur-pa-default-and-ne-marche-pas-avec-nested-structure/240404)
**Author:** [@pilo](https://discuss.elastic.co/u/pilo)\ **Replies:** 3\ **Last updated:** [October 20, 2020, 2:47pm UTC](https://discuss.elastic.co/t/simple-query-string-avec-loperateur-pa-default-and-ne-marche-pas-avec-nested-structure/240404 "2020-10-20T14:47:14Z")
Bonjour tout le monde, j'ai un mapping comme celui-ci qui applique nested structure PUT test1 { "mappings": { "properties": { "nested\_articles" : { "type" : "nested", "properties" : { … --- ## [\[ERROR\]\[logstash.pipeline \] Error registering plugin {:pipeline\_id=\>"main", :plugin=\>"\\\"/usr/share/logstash/logstash-core/lib/jars/sqljdbc42.jar\\", jdbc\_connection\_string](https://discuss.elastic.co/t/error-logstash-pipeline-error-registering-plugin-pipeline-id-main-plugin-logstash-jdbc-jdbc-driver-library-usr-share-logstash-logstash-core-lib-jars-sqljdbc42-jar-jdbc-connection-string/252562)
**Author:** [@lynda](https://discuss.elastic.co/u/lynda)\ **Replies:** 11\ **Last updated:** [October 20, 2020, 2:27pm UTC](https://discuss.elastic.co/t/error-logstash-pipeline-error-registering-plugin-pipeline-id-main-plugin-logstash-jdbc-jdbc-driver-library-usr-share-logstash-logstash-core-lib-jars-sqljdbc42-jar-jdbc-connection-string/252562 "2020-10-20T14:27:14Z")
Hello, I have been trying to run logstash as a service but it keeps failing then restarting in a loop. I tried looking for a solution in similar topics without finding anything useful in my case. Here are the logs when… --- ## [Need help with setting up 1 masternode and two datanodes set up](https://discuss.elastic.co/t/need-help-with-setting-up-1-masternode-and-two-datanodes-set-up/251505)
**Author:** [@sk545](https://discuss.elastic.co/u/sk545)\ **Replies:** 10\ **Last updated:** [October 20, 2020, 2:09pm UTC](https://discuss.elastic.co/t/need-help-with-setting-up-1-masternode-and-two-datanodes-set-up/251505 "2020-10-20T14:09:56Z")
Hello All, As we are implementing ELK in our org as a pilot project, I'm trying to set up 3 nodes Elastic cluster (all acts master and data nodes ), I have created Ubuntu servers in Azure cloud with specific hardware c… --- ## [Configuring Logstash to index nested xml data](https://discuss.elastic.co/t/configuring-logstash-to-index-nested-xml-data/252692)
**Author:** [@andrew.laraia](https://discuss.elastic.co/u/andrew.laraia)\ **Replies:** 1\ **Last updated:** [October 20, 2020, 1:55pm UTC](https://discuss.elastic.co/t/configuring-logstash-to-index-nested-xml-data/252692 "2020-10-20T13:55:36Z")
With Logstash, is there a way to index nested serialized XML using the XML plugin? Can you provide an example? We have some data that we migrate from an existing SQL database via Logstash. These records have a handful o… --- ## [Calculate filtered document's size](https://discuss.elastic.co/t/calculate-filtered-documents-size/251969)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 2\ **Last updated:** [October 20, 2020, 1:52pm UTC](https://discuss.elastic.co/t/calculate-filtered-documents-size/251969 "2020-10-20T13:52:11Z")
Hi all, Is there a way to calculate the amount of filtered documents size inside a specific index? I mean, in a daily log index I would like to know the index total size is divided. --- ## [Allow different maxUnavailable settings based on type of node](https://discuss.elastic.co/t/allow-different-maxunavailable-settings-based-on-type-of-node/252605)
**Author:** [@data\_smith](https://discuss.elastic.co/u/data_smith)\ **Replies:** 2\ **Last updated:** [October 20, 2020, 1:49pm UTC](https://discuss.elastic.co/t/allow-different-maxunavailable-settings-based-on-type-of-node/252605 "2020-10-20T13:49:57Z")
I'm using ECK and I'd like to set different maxUnavailable settings based on type of node. For example, 2 client nodes can go down at the same time but i'd like only 1 data node to go down at a time. Unfortunately it s… --- ## [How to remove duplicate search result in elasticsearch?](https://discuss.elastic.co/t/how-to-remove-duplicate-search-result-in-elasticsearch/252319)
**Author:** [@yen\_l\_ng\_th](https://discuss.elastic.co/u/yen_l_ng_th)\ **Replies:** 4\ **Last updated:** [October 20, 2020, 1:49pm UTC](https://discuss.elastic.co/t/how-to-remove-duplicate-search-result-in-elasticsearch/252319 "2020-10-20T13:49:37Z")
I use a paginated search by elasticseach. But the items are duplicated between pages. It is at the bottom of this page and at the top of the other page. I did like this but it still doesn't work $aggregations = \[ "uni… --- ## [Email alert per sourceip](https://discuss.elastic.co/t/email-alert-per-sourceip/251864)
**Author:** [@ianvera](https://discuss.elastic.co/u/ianvera)\ **Replies:** 5\ **Last updated:** [October 20, 2020, 1:42pm UTC](https://discuss.elastic.co/t/email-alert-per-sourceip/251864 "2020-10-20T13:42:40Z")
we created one watcher having multiple sourceip so that whenever the watcher matches the messages it will send email alert. Will it be possible that the watcher having multiple sourceip will send multiple email alerts b… --- ## [Logstash](https://discuss.elastic.co/t/logstash/252689)
**Author:** [@Syed.Ubaid](https://discuss.elastic.co/u/Syed.Ubaid)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 1:24pm UTC](https://discuss.elastic.co/t/logstash/252689 "2020-10-20T13:24:56Z")
After installing xpack logstash is giving error my configuration file is input { file { path =\> "D:/csv/countriesdata.csv" start\_position =\> "beginning" sincedb\_path =\> "NUL" } } filter { csv { separator =\> ",… --- ## [Parsing syslogs using Grok](https://discuss.elastic.co/t/parsing-syslogs-using-grok/252673)
**Author:** [@pacy1](https://discuss.elastic.co/u/pacy1)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 11:59am UTC](https://discuss.elastic.co/t/parsing-syslogs-using-grok/252673 "2020-10-20T11:59:57Z")
Hi All, Hope you are good!! I need your help on how syslog configuration with the following raw event that is unstructured, how to parsing using grok filter: 2020-10-05T00:00:00+02:00 x.x.x.x 3 0 1 1 229eb9 1020 20201… --- ## [IOPS and elasticsearch](https://discuss.elastic.co/t/iops-and-elasticsearch/251576)
**Author:** [@Juicy45](https://discuss.elastic.co/u/Juicy45)\ **Replies:** 4\ **Last updated:** [October 20, 2020, 1:09pm UTC](https://discuss.elastic.co/t/iops-and-elasticsearch/251576 "2020-10-20T13:09:35Z")
Hi, I have an Elasticsearch cluster that needs to ingest 2000 EPS. What is the minimum amount of IOPS do I need on a virtual machine ? Thank you for your answer. --- ## [Separated filesystems for data and logs?](https://discuss.elastic.co/t/separated-filesystems-for-data-and-logs/252686)
**Author:** [@ffknob](https://discuss.elastic.co/u/ffknob)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 12:56pm UTC](https://discuss.elastic.co/t/separated-filesystems-for-data-and-logs/252686 "2020-10-20T12:56:29Z")
Hi, I'd like to know your thoughts on the best/recommended approach to organize the filesystem of a VM that will run an Elasticsearch instance. How should I separate things in such a way for the service to have some de… --- ## [Need help with a 2XX HTTP code 400 Error](https://discuss.elastic.co/t/need-help-with-a-2xx-http-code-400-error/252682)
**Author:** [@Ratch54](https://discuss.elastic.co/u/Ratch54)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 12:46pm UTC](https://discuss.elastic.co/t/need-help-with-a-2xx-http-code-400-error/252682 "2020-10-20T12:46:31Z")
I am receiving the \[ERROR\]\[logstash.outputs.http\]\[HTTP Output Failure\] Encountered non-2XX HTTP code 400 {:response\_code=\>400, :url"https://some url:8086/write?db=db", :event=\>%{host} %{message}, will\_retry=\>false The c… --- ## [How to extract data from Json](https://discuss.elastic.co/t/how-to-extract-data-from-json/252595)
**Author:** [@rildo](https://discuss.elastic.co/u/rildo)\ **Replies:** 4\ **Last updated:** [October 20, 2020, 12:25pm UTC](https://discuss.elastic.co/t/how-to-extract-data-from-json/252595 "2020-10-20T12:25:36Z")
input { stdin { } } output { stdout { codec =\> rubydebug } } filter { json { source =\> "message" } mutate { gsub =\> \[ "message" , "\\n", "," \] } mutate { gsub =\> \[ "message" , "\[\\\]", "" \] gsub =\> \[ "other\_… --- ## [How to get all worlds which goes after "search word"](https://discuss.elastic.co/t/how-to-get-all-worlds-which-goes-after-search-word/252579)
**Author:** [@tfe2012](https://discuss.elastic.co/u/tfe2012)\ **Replies:** 4\ **Last updated:** [October 20, 2020, 12:16pm UTC](https://discuss.elastic.co/t/how-to-get-all-worlds-which-goes-after-search-word/252579 "2020-10-20T12:16:12Z")
Hi, for example, I have three documents like: { "description": "Small red fox" } { "description": "I see blue fox" } { "description": "I see small orange fox" } Is it possible to get all words which go after word… --- ## [Field \_source added to mapping automatically is shown in Discovery as empty](https://discuss.elastic.co/t/field-source-added-to-mapping-automatically-is-shown-in-discovery-as-empty/252324)
**Author:** [@Rudolf\_Reddy\_Macejka](https://discuss.elastic.co/u/Rudolf_Reddy_Macejka)\ **Replies:** 3\ **Last updated:** [October 20, 2020, 11:56am UTC](https://discuss.elastic.co/t/field-source-added-to-mapping-automatically-is-shown-in-discovery-as-empty/252324 "2020-10-20T11:56:06Z")
Hello, I have a mapping which is "dynamic": false. By POST first message, there was automatically added few fields which i didn't defined. I understood that it is mandatory to have there: \_id | string \_index | stri… --- ## [JMX Input Plugin - Error in connecting to Weblogic JMX](https://discuss.elastic.co/t/jmx-input-plugin-error-in-connecting-to-weblogic-jmx/252670)
**Author:** [@abidub](https://discuss.elastic.co/u/abidub)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 11:30am UTC](https://discuss.elastic.co/t/jmx-input-plugin-error-in-connecting-to-weblogic-jmx/252670 "2020-10-20T11:30:20Z")
Hi there, I am using the JMX Input Plugin and trying to connect to a Weblogic JMX service URL and getting the following error: \[ERROR\]\[logstash.inputs.jmx\] "failed to retrieve RMIServe stub: javax.naming.NoInitialConte… --- ## [Can Logstash implement a data flow from Elastic to other database?](https://discuss.elastic.co/t/can-logstash-implement-a-data-flow-from-elastic-to-other-database/252672)
**Author:** [@Fernando1](https://discuss.elastic.co/u/Fernando1)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 11:45am UTC](https://discuss.elastic.co/t/can-logstash-implement-a-data-flow-from-elastic-to-other-database/252672 "2020-10-20T11:45:33Z")
Hello!! How are you? Can Logstash implement a reverse flow? Like instead of pulling data from, for example, PostgreSQL into Elasticsearch, do the contrary? Like pulling from Elasticsearch into PostgreSQL? Best Wishes, … --- ## [Bad cluster name - change on the fly possible?](https://discuss.elastic.co/t/bad-cluster-name-change-on-the-fly-possible/252475)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 2\ **Last updated:** [October 20, 2020, 11:45am UTC](https://discuss.elastic.co/t/bad-cluster-name-change-on-the-fly-possible/252475 "2020-10-20T11:45:09Z")
Hi there, I have a cluster name defined in the elasticsearch.ym defined as follows cluster.name: CLUSTERNAME" resulting e.g. in: 'CLUSTERNAME".log' So, I want to correct this. The cluster is made of 3 production nod… --- ## [500 Internal Server Error: no such index \[Default\]](https://discuss.elastic.co/t/500-internal-server-error-no-such-index-default/252217)
**Author:** [@OrangeDog](https://discuss.elastic.co/u/OrangeDog)\ **Replies:** 2\ **Last updated:** [October 20, 2020, 11:26am UTC](https://discuss.elastic.co/t/500-internal-server-error-no-such-index-default/252217 "2020-10-20T11:26:18Z")
Autocomplete suggestions for filters have started causing 500 Internal Server Errors Request: POST https://example.com/kibana/api/kibana/suggestions/values/Default {"query":"","field":"hostname.keyword","boolFilter":\[… --- ## [Is it necessary to have elasticsearch ingest node?](https://discuss.elastic.co/t/is-it-necessary-to-have-elasticsearch-ingest-node/252661)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [October 20, 2020, 11:25am UTC](https://discuss.elastic.co/t/is-it-necessary-to-have-elasticsearch-ingest-node/252661 "2020-10-20T11:25:59Z")
I am using elk stack and i want to ask that if i have logstash do i need another elasticsearch as ingest node ? becuase logstash can also preprocess the data --- ## [Syslog plugin multiple grok](https://discuss.elastic.co/t/syslog-plugin-multiple-grok/252665)
**Author:** [@mutt13y](https://discuss.elastic.co/u/mutt13y)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 10:27am UTC](https://discuss.elastic.co/t/syslog-plugin-multiple-grok/252665 "2020-10-20T10:27:13Z")
Hi, The syslog plugin parameter grok\_pattern only accepts a string. Is there a reason it cant be changed to accept a list ? Currently we have to trap for parse failure and parse alternate patterns manually. --- ## [\[Watcher\] - Alerting on metricbeat monitored processes](https://discuss.elastic.co/t/watcher-alerting-on-metricbeat-monitored-processes/252660)
**Author:** [@bevano](https://discuss.elastic.co/u/bevano)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 10:11am UTC](https://discuss.elastic.co/t/watcher-alerting-on-metricbeat-monitored-processes/252660 "2020-10-20T10:11:43Z")
Hi All, I need some advice on how to implement watcher alerting. For example, we have 10 application servers, that have 5 programs running as processes. I have already installed metricbeat on these servers, and can see … --- ## [Getting items with Qty equal to 0](https://discuss.elastic.co/t/getting-items-with-qty-equal-to-0/252657)
**Author:** [@Padam\_Sethia](https://discuss.elastic.co/u/Padam_Sethia)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 9:55am UTC](https://discuss.elastic.co/t/getting-items-with-qty-equal-to-0/252657 "2020-10-20T09:55:52Z")
Hello , I am quite a beginner in elasticsearch . I really can't figure out how to get back items with qty as 0 , the problem is my index document is structured like this : { "children": \[\], "created": "2020-10-15T16:… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1185) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1187)