# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1191 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1192 --- ## [Aggregation not working in Logstash input elasticsearch filter](https://discuss.elastic.co/t/aggregation-not-working-in-logstash-input-elasticsearch-filter/252298)
**Author:** [@Vijay\_Barai](https://discuss.elastic.co/u/Vijay_Barai)\ **Replies:** 0\ **Last updated:** [October 16, 2020, 5:07am UTC](https://discuss.elastic.co/t/aggregation-not-working-in-logstash-input-elasticsearch-filter/252298 "2020-10-16T05:07:57Z")
Hi Team, I am trying to do a aggregation using ES query. Query is giving a result in develper tool but when I use it in logstash config file I am not getting a actual result. I am getting only few selected field, at lea… --- ## [Not able to view data in Discover after my local system restart](https://discuss.elastic.co/t/not-able-to-view-data-in-discover-after-my-local-system-restart/251865)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 2\ **Last updated:** [October 16, 2020, 9:12am UTC](https://discuss.elastic.co/t/not-able-to-view-data-in-discover-after-my-local-system-restart/251865 "2020-10-16T09:12:11Z")
Hi All, I am new to ELK and facing a weird issue, whenever I restart my system. I am not able to view data in Discover. Is there a way to prevent that. ELK is at some remote host, I am not able to understand how restar… --- ## [Delete by Query and Refresh Interval](https://discuss.elastic.co/t/delete-by-query-and-refresh-interval/251633)
**Author:** [@gavinlee](https://discuss.elastic.co/u/gavinlee)\ **Replies:** 6\ **Last updated:** [October 16, 2020, 8:54am UTC](https://discuss.elastic.co/t/delete-by-query-and-refresh-interval/251633 "2020-10-16T08:54:44Z")
Hi, I have a situation where I take the following steps retrieve lock delete by query refresh insert documents release lock These steps could happen in quick succession. The delete by query is supposed to find all the… --- ## [Grok filter multiple match](https://discuss.elastic.co/t/grok-filter-multiple-match/252016)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 1\ **Last updated:** [October 16, 2020, 8:32am UTC](https://discuss.elastic.co/t/grok-filter-multiple-match/252016 "2020-10-16T08:32:40Z")
Hi I have these lines in my log how do i make an array of rootcause using grok? Something like this rootcause=\> { text1, text2 } TIA. --- ## [Kibana field preview size](https://discuss.elastic.co/t/kibana-field-preview-size/252216)
**Author:** [@gborg](https://discuss.elastic.co/u/gborg)\ **Replies:** 3\ **Last updated:** [October 16, 2020, 8:11am UTC](https://discuss.elastic.co/t/kibana-field-preview-size/252216 "2020-10-16T08:11:28Z")
I am using elasticsearch and Kibana for log management, one developer asked me if I could make a field "larger", a field they look at all day is quite large and they need to hit the "toggle field details" to get to see t… --- ## [Slow force merge after 7.5.0 -\> 7.9.1 upgrade](https://discuss.elastic.co/t/slow-force-merge-after-7-5-0-7-9-1-upgrade/252311)
**Author:** [@Dmitry1](https://discuss.elastic.co/u/Dmitry1)\ **Replies:** 0\ **Last updated:** [October 16, 2020, 7:30am UTC](https://discuss.elastic.co/t/slow-force-merge-after-7-5-0-7-9-1-upgrade/252311 "2020-10-16T07:30:29Z")
Hello, I've upgraded elastic from 7.5.0 -\> 7.9.1 and notice, that force merge time for my daily index increased more than twice! I don't change any setting. Script do force merge like this : set this index parameters: … --- ## [Feature request kibana highlight off for a field](https://discuss.elastic.co/t/feature-request-kibana-highlight-off-for-a-field/252231)
**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Replies:** 2\ **Last updated:** [October 16, 2020, 6:38am UTC](https://discuss.elastic.co/t/feature-request-kibana-highlight-off-for-a-field/252231 "2020-10-16T06:38:38Z")
Can there be option to disable highlight for a specific field of a index. Kibana gives a option to disable highlighting using doc table highlights off but it then applies to all the indexes. Atleast there should be an op… --- ## [Geo Distance Search on Geo Shape with distance returned](https://discuss.elastic.co/t/geo-distance-search-on-geo-shape-with-distance-returned/252212)
**Author:** [@DavidBokor](https://discuss.elastic.co/u/DavidBokor)\ **Replies:** 5\ **Last updated:** [October 16, 2020, 6:21am UTC](https://discuss.elastic.co/t/geo-distance-search-on-geo-shape-with-distance-returned/252212 "2020-10-16T06:21:26Z")
Based on the discussion here it looks like searching by distance on a geo shape field is supported as of v7.7.0. I'm using 7.9 and getting an error. I have two indices, one points and one polygons. I have no problem doi… --- ## [Error stacktrace not showing on the linux server](https://discuss.elastic.co/t/error-stacktrace-not-showing-on-the-linux-server/252303)
**Author:** [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\ **Replies:** 0\ **Last updated:** [October 16, 2020, 5:59am UTC](https://discuss.elastic.co/t/error-stacktrace-not-showing-on-the-linux-server/252303 "2020-10-16T05:59:53Z")
I've installed kibana,elasticsearch and logstash version 7.9.2 on the linux server. In local windows machine it working fine and showing error stracktrace of message. but over the linux it's not showing error stracktra… --- ## [What is the grok pattern for find userid from message?](https://discuss.elastic.co/t/what-is-the-grok-pattern-for-find-userid-from-message/252301)
**Author:** [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\ **Replies:** 0\ **Last updated:** [October 16, 2020, 5:50am UTC](https://discuss.elastic.co/t/what-is-the-grok-pattern-for-find-userid-from-message/252301 "2020-10-16T05:50:49Z")
I've two layouts one is error layout.in this layout have two additional fields like.requestUrl and requestmethod. the second one is common layout which is for warn,debug,info log levels. i've also added userId which is… --- ## [Kibana 7.9 won't start](https://discuss.elastic.co/t/kibana-7-9-wont-start/252177)
**Author:** [@wittrue](https://discuss.elastic.co/u/wittrue)\ **Replies:** 2\ **Last updated:** [October 16, 2020, 5:25am UTC](https://discuss.elastic.co/t/kibana-7-9-wont-start/252177 "2020-10-16T05:25:26Z")
Hi, last week I updated our elasticsearch server, but from then kibana refuses to start. Here is its log: Oct 15 12:26:55 sub.server.com systemd\[1\]: Started Kibana. Oct 15 12:27:05 sub.server.com kibana\[26328\]… --- ## [6-nodes cluster with uneven disk space](https://discuss.elastic.co/t/6-nodes-cluster-with-uneven-disk-space/252290)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 0\ **Last updated:** [October 16, 2020, 3:42am UTC](https://discuss.elastic.co/t/6-nodes-cluster-with-uneven-disk-space/252290 "2020-10-16T03:42:34Z")
Hello, I have 6 nodes in my cluster as follows: 2x 10TB disk space (masters + data nodes) 4x 100TB disk space (data nodes only) Most of my data is sent to the 2 masters with 10TB, will Elasticsearch make use of the re… --- ## [Upgrade Elasticsearch](https://discuss.elastic.co/t/upgrade-elasticsearch/250491)
**Author:** [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\ **Replies:** 9\ **Last updated:** [October 16, 2020, 1:33am UTC](https://discuss.elastic.co/t/upgrade-elasticsearch/250491 "2020-10-16T01:33:28Z")
Hello Team, Currently we are using Elasticsaerch 6.4 and all the other stack part like kibana, logstash and beats also have versio 6.4 But now we want to use the some security feature like Role-based access control for… --- ## [Custom Logstash pipeline configuration file](https://discuss.elastic.co/t/custom-logstash-pipeline-configuration-file/252277)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 5\ **Last updated:** [October 16, 2020, 12:29am UTC](https://discuss.elastic.co/t/custom-logstash-pipeline-configuration-file/252277 "2020-10-16T00:29:08Z")
Hi, I want to make a custom pipeline using SNMP walk plugin. I need some help in the first steps to properly understand syntax. So far I have something like this filter { mutate { add\_field =\> … --- ## [Perform mathematical functions from two index in Kibana](https://discuss.elastic.co/t/perform-mathematical-functions-from-two-index-in-kibana/251972)
**Author:** [@ibras](https://discuss.elastic.co/u/ibras)\ **Replies:** 5\ **Last updated:** [October 15, 2020, 11:33pm UTC](https://discuss.elastic.co/t/perform-mathematical-functions-from-two-index-in-kibana/251972 "2020-10-15T23:33:33Z")
Hello, I am trying to perform a multiplication functions between two fields in different index in Kibana. My first index looks like : My first index : { "\_index": "first\_index", "\_type": "type… --- ## [Configure Kibana Log UI settings per space using API](https://discuss.elastic.co/t/configure-kibana-log-ui-settings-per-space-using-api/251704)
**Author:** [@leon.seng](https://discuss.elastic.co/u/leon.seng)\ **Replies:** 4\ **Last updated:** [October 15, 2020, 10:11pm UTC](https://discuss.elastic.co/t/configure-kibana-log-ui-settings-per-space-using-api/251704 "2020-10-15T22:11:13Z")
Hi, I am currently running Kibanamultiple spaces - each monitoring for different index patterns, in order the trigger alerts and actions on different indices. This page on Logs UI settings shows how we can configure th… --- ## [Sort Results in Discovery Kibana (KQL)](https://discuss.elastic.co/t/sort-results-in-discovery-kibana-kql/252151)
**Author:** [@Jesus\_Moyano\_Dona](https://discuss.elastic.co/u/Jesus_Moyano_Dona)\ **Replies:** 1\ **Last updated:** [October 15, 2020, 9:15pm UTC](https://discuss.elastic.co/t/sort-results-in-discovery-kibana-kql/252151 "2020-10-15T21:15:04Z")
Hello, I have a database about flights and I want to create a coordinate map, so I need the last entry of each flight. I'm new to Elastic and Kibana, I don't know about how to do it. In this example, I filtered by the … --- ## [EQL: Why basic query is different from dataset](https://discuss.elastic.co/t/eql-why-basic-query-is-different-from-dataset/252242)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 5\ **Last updated:** [October 15, 2020, 9:14pm UTC](https://discuss.elastic.co/t/eql-why-basic-query-is-different-from-dataset/252242 "2020-10-15T21:14:45Z")
I'm running a simple EQL query to test as follows, but NOT reporting anything back GET winlogbeat\*/\_eql/search { "query": """ process where process.name == "services.exe" """ } Quite lot of data is present and If… --- ## [Elasticsearch Engineer 1 - Lab 1.4 - can not find Java](https://discuss.elastic.co/t/elasticsearch-engineer-1-lab-1-4-can-not-find-java/251797)
**Author:** [@justing](https://discuss.elastic.co/u/justing)\ **Replies:** 2\ **Last updated:** [October 15, 2020, 8:53pm UTC](https://discuss.elastic.co/t/elasticsearch-engineer-1-lab-1-4-can-not-find-java/251797 "2020-10-15T20:53:01Z")
I’m currently attempting to take ElasticSearch Engineer 1 (On-Demand) training and am stuck at Lab 1.4 in the Lab Environment (Strigo). When attempting to run the logstash command, I get the following error: \[elastic@se… --- ## [Changing Elasticsearch + Fscrawler tokenizing methods to recognize Social Security Numbers/Passport Machine Readable Zones](https://discuss.elastic.co/t/changing-elasticsearch-fscrawler-tokenizing-methods-to-recognize-social-security-numbers-passport-machine-readable-zones/251502)
**Author:** [@morningkaren](https://discuss.elastic.co/u/morningkaren)\ **Replies:** 4\ **Last updated:** [October 15, 2020, 8:34pm UTC](https://discuss.elastic.co/t/changing-elasticsearch-fscrawler-tokenizing-methods-to-recognize-social-security-numbers-passport-machine-readable-zones/251502 "2020-10-15T20:34:09Z")
Hello, I have used fscrawler to index some files that have social security numbers in the format of XXX-XX-XXXX and also the machine readable zones of passports such as \<\<\<\<\<\ **Author:** [@David\_Hopkins](https://discuss.elastic.co/u/David_Hopkins)\ **Replies:** 8\ **Last updated:** [October 15, 2020, 8:15pm UTC](https://discuss.elastic.co/t/more-shards-more-throughput/252223 "2020-10-15T20:15:16Z") I've been trying to better understand the effect sharing has on performance but the theory doesn't seem to match the reality so clearly one of those things must be wrong :wink: After watching this video on Quantitative … --- ## [How do i create field Types such as geo\_point in a logstash conf file?](https://discuss.elastic.co/t/how-do-i-create-field-types-such-as-geo-point-in-a-logstash-conf-file/251922)
**Author:** [@fallenreaper](https://discuss.elastic.co/u/fallenreaper)\ **Replies:** 5\ **Last updated:** [October 15, 2020, 7:17pm UTC](https://discuss.elastic.co/t/how-do-i-create-field-types-such-as-geo-point-in-a-logstash-conf-file/251922 "2020-10-15T19:17:58Z")
I have location data I have been testing with various formats related to geo\_point in order for the machine to say "this is a geo\_point" but it doesnt. I said to myself "logstash handles parsing and should take the burd… --- ## [Increment field value when event occur in logstash output](https://discuss.elastic.co/t/increment-field-value-when-event-occur-in-logstash-output/252259)
**Author:** [@anja1](https://discuss.elastic.co/u/anja1)\ **Replies:** 0\ **Last updated:** [October 15, 2020, 7:16pm UTC](https://discuss.elastic.co/t/increment-field-value-when-event-occur-in-logstash-output/252259 "2020-10-15T19:16:16Z")
Is it possible to increment a field value everytime an event occur? Inputs are received from a filebeat and i want to store the values in elasticsearch I have following in my logstash pipeline: \> filter \> { \> … --- ## [@timestamp field in a datastream](https://discuss.elastic.co/t/timestamp-field-in-a-datastream/252258)
**Author:** [@MichaelKopaniov](https://discuss.elastic.co/u/MichaelKopaniov)\ **Replies:** 0\ **Last updated:** [October 15, 2020, 7:15pm UTC](https://discuss.elastic.co/t/timestamp-field-in-a-datastream/252258 "2020-10-15T19:15:41Z")
Hi, I'm currently examining the migration of an old ES cluster into an ILM managed https://www.elastic.co/guide/en/elasticsearch/reference/master/data-streams.html. I do not fully understand the role of the required @t… --- ## [How to check Logstash logs appearing in Elasticsearch?](https://discuss.elastic.co/t/how-to-check-logstash-logs-appearing-in-elasticsearch/252174)
**Author:** [@deanwarrenuk](https://discuss.elastic.co/u/deanwarrenuk)\ **Replies:** 2\ **Last updated:** [October 15, 2020, 6:14pm UTC](https://discuss.elastic.co/t/how-to-check-logstash-logs-appearing-in-elasticsearch/252174 "2020-10-15T18:14:54Z")
Okay I am a noob I have ELK installed in Docker containers and am sending logs from a Python program using python-logstash. I can see Logstash receiving my logs when I do docker-compose logs . How do I check these are … --- ## [Update kibana style without plugin](https://discuss.elastic.co/t/update-kibana-style-without-plugin/252237)
**Author:** [@gizem](https://discuss.elastic.co/u/gizem)\ **Replies:** 1\ **Last updated:** [October 15, 2020, 4:52pm UTC](https://discuss.elastic.co/t/update-kibana-style-without-plugin/252237 "2020-10-15T16:52:20Z")
Hello, I want to update kibana style by updating css file. I updated before (v 7.0.1) by updating common.style.css file. But I am using now 7.9.2 and there is not common.style.css file in this version. Which css file … --- ## [Elasticsearch graceful restart without rebalancing shards](https://discuss.elastic.co/t/elasticsearch-graceful-restart-without-rebalancing-shards/251660)
**Author:** [@GabrielM](https://discuss.elastic.co/u/GabrielM)\ **Replies:** 3\ **Last updated:** [October 15, 2020, 3:54pm UTC](https://discuss.elastic.co/t/elasticsearch-graceful-restart-without-rebalancing-shards/251660 "2020-10-15T15:54:43Z")
Hello, I wanted to know if it is possible to restart a node of an Elasticsearch cluster in a graceful way? When I restart a node in the cluster, searches that use that node fail (shards are replicated). Is it possible … --- ## [Elasticsearch 6.8.1 xpack](https://discuss.elastic.co/t/elasticsearch-6-8-1-xpack/252076)
**Author:** [@chris1967](https://discuss.elastic.co/u/chris1967)\ **Replies:** 0\ **Last updated:** [October 14, 2020, 4:46pm UTC](https://discuss.elastic.co/t/elasticsearch-6-8-1-xpack/252076 "2020-10-14T16:46:04Z")
I enabled xpack.security (xpack.security.enabled: true) and i set the built in passwords initially with the elasticsearch-setup-passwords. But now i have to change the URL, because i want to change the network.node in th… --- ## [Elasticsearch Engineer 1 lab access issue](https://discuss.elastic.co/t/elasticsearch-engineer-1-lab-access-issue/252051)
**Author:** [@aerodynamic](https://discuss.elastic.co/u/aerodynamic)\ **Replies:** 2\ **Last updated:** [October 15, 2020, 3:47pm UTC](https://discuss.elastic.co/t/elasticsearch-engineer-1-lab-access-issue/252051 "2020-10-15T15:47:22Z")
Upon starting the course the first task is to start the lab. However the creds given to me do not work when attempting to log onto the strigo lab. --- ## [Coordinating nodes cpu usage dropped down while data nodes rise up after upgrade elastic 7.4.0 to 7.8.1](https://discuss.elastic.co/t/coordinating-nodes-cpu-usage-dropped-down-while-data-nodes-rise-up-after-upgrade-elastic-7-4-0-to-7-8-1/252228)
**Author:** [@hadars](https://discuss.elastic.co/u/hadars)\ **Replies:** 0\ **Last updated:** [October 15, 2020, 3:40pm UTC](https://discuss.elastic.co/t/coordinating-nodes-cpu-usage-dropped-down-while-data-nodes-rise-up-after-upgrade-elastic-7-4-0-to-7-8-1/252228 "2020-10-15T15:40:25Z")
Hey, A year +- we decided to change our ingesting pipeline to work with coordinating nodes. (https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-node.html#coordinating-node) This helped us a lot, al… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1190) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1192)