# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1203 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1204 --- ## [How to get size disk closed index - Mapper size plugin](https://discuss.elastic.co/t/how-to-get-size-disk-closed-index-mapper-size-plugin/250685)
**Author:** [@Thomas74](https://discuss.elastic.co/u/Thomas74)\ **Replies:** 4\ **Last updated:** [October 8, 2020, 1:55pm UTC](https://discuss.elastic.co/t/how-to-get-size-disk-closed-index-mapper-size-plugin/250685 "2020-10-08T13:55:17Z")
Hi, Is it possible to retrieve disk size information of closed index with mapper size plugin ? I need to create index disk usage statistics but I don't really know how to get closed index information.. Kind regards, … --- ## [Nested Object Cardinality Aggregation not Working](https://discuss.elastic.co/t/nested-object-cardinality-aggregation-not-working/251400)
**Author:** [@hetvakil](https://discuss.elastic.co/u/hetvakil)\ **Replies:** 1\ **Last updated:** [October 8, 2020, 1:49pm UTC](https://discuss.elastic.co/t/nested-object-cardinality-aggregation-not-working/251400 "2020-10-08T13:49:11Z")
I want to get Total Unique email count in a Nested object. Below is the example of the document. When we keep Nested object as property in mapping then the count for cardinality is always showing zero while if that objec… --- ## [Engineer 1 training lab fails to allocate memory](https://discuss.elastic.co/t/engineer-1-training-lab-fails-to-allocate-memory/251448)
**Author:** [@JAG1](https://discuss.elastic.co/u/JAG1)\ **Replies:** 2\ **Last updated:** [October 8, 2020, 1:44pm UTC](https://discuss.elastic.co/t/engineer-1-training-lab-fails-to-allocate-memory/251448 "2020-10-08T13:44:39Z")
Engineer 1 training fails to allocate memory after instructions request memory to be changed. http://3.127.223.160/instructions/labs.html#\_lab\_1\_1\_elastic\_stack\_overview fails with a Run Time Expectation error insu… --- ## [Retrieve metricbeat parameters from Elasticsearch using java Rest high level client](https://discuss.elastic.co/t/retrieve-metricbeat-parameters-from-elasticsearch-using-java-rest-high-level-client/251416)
**Author:** [@pathfinder225](https://discuss.elastic.co/u/pathfinder225)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 10:48am UTC](https://discuss.elastic.co/t/retrieve-metricbeat-parameters-from-elasticsearch-using-java-rest-high-level-client/251416 "2020-10-08T10:48:53Z")
Hi Team, We have to retrieve below parameters from our metric beat index from elasticsearch, index pattern would look like something like metricbeat-appId All these parameters are not present in single document they ar… --- ## [Syslog data that is going into logstash not being picked up by elasticsearch](https://discuss.elastic.co/t/syslog-data-that-is-going-into-logstash-not-being-picked-up-by-elasticsearch/251332)
**Author:** [@tyrone](https://discuss.elastic.co/u/tyrone)\ **Replies:** 2\ **Last updated:** [October 8, 2020, 1:10pm UTC](https://discuss.elastic.co/t/syslog-data-that-is-going-into-logstash-not-being-picked-up-by-elasticsearch/251332 "2020-10-08T13:10:06Z")
I have all my servers pushing syslog data to 4 logstash servers, the logstash servers are not forwarding syslog information into elasticsearch, here is my conf file input { tcp { port =\> 5514 type =\> syslog } udp { … --- ## [Logstash filter doesn't apply on the output](https://discuss.elastic.co/t/logstash-filter-doesnt-apply-on-the-output/251443)
**Author:** [@BTH.S3](https://discuss.elastic.co/u/BTH.S3)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 1:00pm UTC](https://discuss.elastic.co/t/logstash-filter-doesnt-apply-on-the-output/251443 "2020-10-08T13:00:29Z")
Recently I've deployed FileBeat in two remote servers for gathering log messages and send to the logstash on the local server. The connection between FireBeat and Logstash is perfect. The messages have been transferring… --- ## [JSON Request With Saved Object Find API](https://discuss.elastic.co/t/json-request-with-saved-object-find-api/251265)
**Author:** [@git-blame](https://discuss.elastic.co/u/git-blame)\ **Replies:** 2\ **Last updated:** [October 8, 2020, 12:44pm UTC](https://discuss.elastic.co/t/json-request-with-saved-object-find-api/251265 "2020-10-08T12:44:58Z")
In the Find API, there is a has\_reference parameter which is an object with fields type and id. However, There is no example I can find of how to format that as a URL (e.g., for a curl get) This comment implies that I … --- ## [How to get the consolidated aggregartion on specfic part of String](https://discuss.elastic.co/t/how-to-get-the-consolidated-aggregartion-on-specfic-part-of-string/251432)
**Author:** [@rajan01](https://discuss.elastic.co/u/rajan01)\ **Replies:** 4\ **Last updated:** [October 8, 2020, 12:44pm UTC](https://discuss.elastic.co/t/how-to-get-the-consolidated-aggregartion-on-specfic-part-of-string/251432 "2020-10-08T12:44:44Z")
In the elastic search we have logs with fi\_id as BA-844, BAX-844, BA-SYSTEM-844 and BA-090, BAX-090, BA-SYSTEM-WER-090 and many more with same numeric value as last part of the string. I want to write the elastic query … --- ## [Upgrade cluster to 7.9.2, master\_not\_discovered\_exception](https://discuss.elastic.co/t/upgrade-cluster-to-7-9-2-master-not-discovered-exception/251287)
**Author:** [@JSkier](https://discuss.elastic.co/u/JSkier)\ **Replies:** 3\ **Last updated:** [October 8, 2020, 12:33pm UTC](https://discuss.elastic.co/t/upgrade-cluster-to-7-9-2-master-not-discovered-exception/251287 "2020-10-08T12:33:33Z")
Hi, This started out with Kibana not working, now seeing the root issue may be with my 3 node cluster no longer working. I get this error (telnet to 9300 works on all three search nodes): {"error":{"root\_cause":\[{"typ… --- ## [ECK Sudden rise in data disk usage](https://discuss.elastic.co/t/eck-sudden-rise-in-data-disk-usage/250932)
**Author:** [@rajkumar\_25](https://discuss.elastic.co/u/rajkumar_25)\ **Replies:** 3\ **Last updated:** [October 8, 2020, 12:15pm UTC](https://discuss.elastic.co/t/eck-sudden-rise-in-data-disk-usage/250932 "2020-10-08T12:15:43Z")
Deployed elastic search Kubernetes in GKE. With 2GB memory and 1GB persistence disk. We got an error out of storage exception. After that, we have Increased to 2GB on the next day itself it reached 2GB, but we haven’t r… --- ## [Group and keep only first result of that group](https://discuss.elastic.co/t/group-and-keep-only-first-result-of-that-group/250624)
**Author:** [@lanwin](https://discuss.elastic.co/u/lanwin)\ **Replies:** 4\ **Last updated:** [October 8, 2020, 11:18am UTC](https://discuss.elastic.co/t/group-and-keep-only-first-result-of-that-group/250624 "2020-10-08T11:18:44Z")
Is there any way to do a search, do a group (and discard all but one result of that group)? We have a simple parent-\>children relationship (building also a group). Our problem is now that we have a complex filter and it… --- ## [Make Readable message in kibana](https://discuss.elastic.co/t/make-readable-message-in-kibana/251428)
**Author:** [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 11:17am UTC](https://discuss.elastic.co/t/make-readable-message-in-kibana/251428 "2020-10-08T11:17:48Z")
In the above picture you can see message,timestamp and fields which is added by grok pattern. with use grok pattern take value from message and added into fields(set names in grok). now in fields you can see values b… --- ## [Query by max date](https://discuss.elastic.co/t/query-by-max-date/251424)
**Author:** [@Kennethtruyers](https://discuss.elastic.co/u/Kennethtruyers)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 11:10am UTC](https://discuss.elastic.co/t/query-by-max-date/251424 "2020-10-08T11:10:55Z")
I have an index that is append only. Every change gets saved as a new document, together with a date property. In order to get the current active data I need to group all entities by their ID and get the one with the lat… --- ## [How to sort with case insensitive in elasticsearch](https://discuss.elastic.co/t/how-to-sort-with-case-insensitive-in-elasticsearch/251420)
**Author:** [@Mak\_Mak](https://discuss.elastic.co/u/Mak_Mak)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 10:59am UTC](https://discuss.elastic.co/t/how-to-sort-with-case-insensitive-in-elasticsearch/251420 "2020-10-08T10:59:15Z")
My index name is data\_new Below is the code to insert into index test = \[ {'id':1,'name': 'Cost Accounting 400', 'professor': \['Bill Cage', 'accounting'\]}, { 'id':2, 'name': 'Computer Internals 250', 'professor'… --- ## [Unable to start logstash](https://discuss.elastic.co/t/unable-to-start-logstash/251396)
**Author:** [@tamilarasanbravo](https://discuss.elastic.co/u/tamilarasanbravo)\ **Replies:** 2\ **Last updated:** [October 8, 2020, 10:58am UTC](https://discuss.elastic.co/t/unable-to-start-logstash/251396 "2020-10-08T10:58:51Z")
Team, I am trying to start logstash but unable to do so as it says the port is being used but there is no such port used in the host. \[2020-10-08T04:18:10,305\]\[INFO \]\[logstash.inputs.http \]\[httpd\]\[c8cb23d9d60ec3c13… --- ## [Logstash create value based on duplicate field](https://discuss.elastic.co/t/logstash-create-value-based-on-duplicate-field/250852)
**Author:** [@bbwolf](https://discuss.elastic.co/u/bbwolf)\ **Replies:** 5\ **Last updated:** [October 8, 2020, 10:19am UTC](https://discuss.elastic.co/t/logstash-create-value-based-on-duplicate-field/250852 "2020-10-08T10:19:42Z")
Hello, I wan't know if it's possible to get duplicate value un field and create another field based on that value. Supposed I have logs: Field1, Field2, Field3 A,B, C A,D, E B, E, T B, R, H S, V, X What I wan't … --- ## [Scripted field getting 12 hours date time difference](https://discuss.elastic.co/t/scripted-field-getting-12-hours-date-time-difference/248999)
**Author:** [@ahmadsayeed3](https://discuss.elastic.co/u/ahmadsayeed3)\ **Replies:** 11\ **Last updated:** [October 8, 2020, 10:16am UTC](https://discuss.elastic.co/t/scripted-field-getting-12-hours-date-time-difference/248999 "2020-10-08T10:16:22Z")
Hi, I am trying to get difference between current date time and a field(date time). Timezone for date formatting: UTC Date format: MM/D/YYYY HH:mm:ss.SSS Date with nanoseconds format: MMM D, YYYY @ HH:mm:ss.SSSSSSSS… --- ## [Logstash Fingerprint Issue](https://discuss.elastic.co/t/logstash-fingerprint-issue/251410)
**Author:** [@Pratik\_Sheth](https://discuss.elastic.co/u/Pratik_Sheth)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 10:10am UTC](https://discuss.elastic.co/t/logstash-fingerprint-issue/251410 "2020-10-08T10:10:47Z")
Hi.. I have been having issue with the logstash configuration. I have set the configuration such that fingerprint of few fields is considered as doc\_id but The ID is not getting populated even tho hash are coming correc… --- ## [Master can not be discovered](https://discuss.elastic.co/t/master-can-not-be-discovered/251237)
**Author:** [@dorcas](https://discuss.elastic.co/u/dorcas)\ **Replies:** 6\ **Last updated:** [October 8, 2020, 10:02am UTC](https://discuss.elastic.co/t/master-can-not-be-discovered/251237 "2020-10-08T10:02:14Z")
After i enabled xpack.security.enabled: true xpack.security.transport.ssl.enabled: true and i restart my two nodes i get this error master not discovered yet, this node has not previously joined a bootstrapped (v7+) … --- ## [Loosing node connection after update to 7.9.2](https://discuss.elastic.co/t/loosing-node-connection-after-update-to-7-9-2/251405)
**Author:** [@whysmer](https://discuss.elastic.co/u/whysmer)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 9:28am UTC](https://discuss.elastic.co/t/loosing-node-connection-after-update-to-7-9-2/251405 "2020-10-08T09:28:18Z")
Hello, I have one node which is not reconecting after updating from 7.7.1 to 7.9.2 my cluster of three nodes. Here is the error, I don't understand why it's a connection problem as nothing changed ? \[2020-10-08T11:22… --- ## [Get the top document from each group with sorting and paging](https://discuss.elastic.co/t/get-the-top-document-from-each-group-with-sorting-and-paging/251003)
**Author:** [@Sergii](https://discuss.elastic.co/u/Sergii)\ **Replies:** 3\ **Last updated:** [October 8, 2020, 8:34am UTC](https://discuss.elastic.co/t/get-the-top-document-from-each-group-with-sorting-and-paging/251003 "2020-10-08T08:34:36Z")
Hi! I have a collection of entities and I need to group them by RelationId and select entity with biggest Revision in each group. Result should be ordered by "title" and support paging. Is it possible to do this with El… --- ## [Nginx Log Dashboard Not Show Data](https://discuss.elastic.co/t/nginx-log-dashboard-not-show-data/251395)
**Author:** [@reza\_naipospos](https://discuss.elastic.co/u/reza_naipospos)\ **Replies:** 1\ **Last updated:** [October 8, 2020, 8:37am UTC](https://discuss.elastic.co/t/nginx-log-dashboard-not-show-data/251395 "2020-10-08T08:37:31Z")
No data after make dashboard from filebeat command the data requirement on kibana not same with my nginx log data Please help me --- ## [Limit script\_score rescoring to the top query matches](https://discuss.elastic.co/t/limit-script-score-rescoring-to-the-top-query-matches/251247)
**Author:** [@fpug](https://discuss.elastic.co/u/fpug)\ **Replies:** 3\ **Last updated:** [October 8, 2020, 8:35am UTC](https://discuss.elastic.co/t/limit-script-score-rescoring-to-the-top-query-matches/251247 "2020-10-08T08:35:15Z")
Hi! I'm trying to score some documents via their a dense\_vector field, via a script\_score query. The cosine computation is relatively expensive, so I'd like to limit it to the best scoring results of the "query" clause… --- ## [GREEDYDATA in Grok doesn't pick up a leading \[](https://discuss.elastic.co/t/greedydata-in-grok-doesnt-pick-up-a-leading/250999)
**Author:** [@joesheps](https://discuss.elastic.co/u/joesheps)\ **Replies:** 11\ **Last updated:** [October 8, 2020, 8:18am UTC](https://discuss.elastic.co/t/greedydata-in-grok-doesnt-pick-up-a-leading/250999 "2020-10-08T08:18:05Z")
I am receiving syslogs like this: Oct 5 13:37:13 10.20.30.40 %ASA-4-733100: \[ HTTP 80\] drop rate-1 exceeded. Current burst rate is 7 per second, max configured rate is 40; Current average rate is 23 per seco… --- ## [Spammy Logs](https://discuss.elastic.co/t/spammy-logs/251046)
**Author:** [@animageofmine](https://discuss.elastic.co/u/animageofmine)\ **Replies:** 2\ **Last updated:** [October 8, 2020, 8:08am UTC](https://discuss.elastic.co/t/spammy-logs/251046 "2020-10-08T08:08:43Z")
We enabled security on Elastic recently (6.8). We see a crazy amount of logs with the following stacktrace even though all the requests we observe are using the right credentials. It has filed the docker logs by about 22… --- ## [Pointing to different Nodes](https://discuss.elastic.co/t/pointing-to-different-nodes/251198)
**Author:** [@Jtomage](https://discuss.elastic.co/u/Jtomage)\ **Replies:** 3\ **Last updated:** [October 8, 2020, 7:36am UTC](https://discuss.elastic.co/t/pointing-to-different-nodes/251198 "2020-10-08T07:36:17Z")
Hi all, New to elasticsearch I am currently for clarification on pointing to nodes with different roles. The current set up is a 3 Master-data node cluster and looking to possibly scale out. Currently there are 2 applic… --- ## [Getting errors after Logstash upgrade from 7.6.2 to 7.9.2](https://discuss.elastic.co/t/getting-errors-after-logstash-upgrade-from-7-6-2-to-7-9-2/251370)
**Author:** [@yummycake](https://discuss.elastic.co/u/yummycake)\ **Replies:** 2\ **Last updated:** [October 8, 2020, 7:33am UTC](https://discuss.elastic.co/t/getting-errors-after-logstash-upgrade-from-7-6-2-to-7-9-2/251370 "2020-10-08T07:33:11Z")
I recently upgraded my Logstash from 7.6.2 to the latest version 7.9.2. When I tested my configuration file, I received the output below. I did not get the error below output when I tested with version 7.6.2 May I know … --- ## [Logstash Grok pattern](https://discuss.elastic.co/t/logstash-grok-pattern/251373)
**Author:** [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\ **Replies:** 4\ **Last updated:** [October 8, 2020, 7:25am UTC](https://discuss.elastic.co/t/logstash-grok-pattern/251373 "2020-10-08T07:25:28Z")
Grok pattern isn't working . before I used grok pattern and it creates a fields which was I added into pattern. but now it's not creating a fields Help me out of this Here is my grok pattern : grok { match… --- ## [Kibana multiple line scripts json input](https://discuss.elastic.co/t/kibana-multiple-line-scripts-json-input/248374)
**Author:** [@sambart19](https://discuss.elastic.co/u/sambart19)\ **Replies:** 4\ **Last updated:** [October 8, 2020, 7:21am UTC](https://discuss.elastic.co/t/kibana-multiple-line-scripts-json-input/248374 "2020-10-08T07:21:38Z")
This is a duplicate of the question here from a different user that never got an answer. I would like to be able to use multiple lines in the json input for a script but the triple quote that is listed in documentation… --- ## [Get Sum value of an aggregation than group by a term looks not possible](https://discuss.elastic.co/t/get-sum-value-of-an-aggregation-than-group-by-a-term-looks-not-possible/251271)
**Author:** [@miri](https://discuss.elastic.co/u/miri)\ **Replies:** 5\ **Last updated:** [October 8, 2020, 7:13am UTC](https://discuss.elastic.co/t/get-sum-value-of-an-aggregation-than-group-by-a-term-looks-not-possible/251271 "2020-10-08T07:13:59Z")
Is there a way to get from a field value ( like "devices\_connected"), seperated by a term (like "servers") ... the sum of that? Example: There are 3 servers sending connected device information into elasticsearch //1se… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1202) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1204)