# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1215 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1216 --- ## [Lab material missing in "Elasticsearch Engineer 1 (On-Demand)" and Strigo not working](https://discuss.elastic.co/t/lab-material-missing-in-elasticsearch-engineer-1-on-demand-and-strigo-not-working/249337)
**Author:** [@marcus.konig](https://discuss.elastic.co/u/marcus.konig)\ **Replies:** 12\ **Last updated:** [September 30, 2020, 4:39pm UTC](https://discuss.elastic.co/t/lab-material-missing-in-elasticsearch-engineer-1-on-demand-and-strigo-not-working/249337 "2020-09-30T16:39:16Z")
Hi there, I am enrolled into "Elasticsearch Engineer 1 (On-Demand)" via my company account. Now there are several problems with the Strigo environment and a link to the dataset material ZIP is not provided - so I am loo… --- ## [Defining Source When Using Filebeat](https://discuss.elastic.co/t/defining-source-when-using-filebeat/249877)
**Author:** [@teej](https://discuss.elastic.co/u/teej)\ **Replies:** 2\ **Last updated:** [September 30, 2020, 4:32pm UTC](https://discuss.elastic.co/t/defining-source-when-using-filebeat/249877 "2020-09-30T16:32:08Z")
Hi, I am using filebeat to read xml files from a directory and then feed it to logstash where it is filetered then sent out to elastic. I thought that perhaps when the pipeline gets created in the logstash config, it do… --- ## [Question on populating SIEM dashboard with winlogbeat data and Logstash](https://discuss.elastic.co/t/question-on-populating-siem-dashboard-with-winlogbeat-data-and-logstash/250510)
**Author:** [@Johan-p](https://discuss.elastic.co/u/Johan-p)\ **Replies:** 1\ **Last updated:** [September 30, 2020, 4:14pm UTC](https://discuss.elastic.co/t/question-on-populating-siem-dashboard-with-winlogbeat-data-and-logstash/250510 "2020-09-30T16:14:35Z")
Hi everyone, My company is setting up a Proof of Concept with Elastic SIEM. Running an on-prem setup: 3 Elastic nodes in a cluster configuration with one Kibana server and one Logstash server. While testing the SIEM d… --- ## [How to draw a cummulative min chart (not cummulative sum) in kibana](https://discuss.elastic.co/t/how-to-draw-a-cummulative-min-chart-not-cummulative-sum-in-kibana/250226)
**Author:** [@Jayasri\_Cimba](https://discuss.elastic.co/u/Jayasri_Cimba)\ **Replies:** 2\ **Last updated:** [September 30, 2020, 3:57pm UTC](https://discuss.elastic.co/t/how-to-draw-a-cummulative-min-chart-not-cummulative-sum-in-kibana/250226 "2020-09-30T15:57:36Z")
I am trying to do cummulative min chart in kibana , is there a possibility to do that --- ## [Strange problem finding any documents/logs, other than from a specific container (Kubernetes)](https://discuss.elastic.co/t/strange-problem-finding-any-documents-logs-other-than-from-a-specific-container-kubernetes/250160)
**Author:** [@Christos\_Gitsis](https://discuss.elastic.co/u/Christos_Gitsis)\ **Replies:** 1\ **Last updated:** [September 30, 2020, 3:26pm UTC](https://discuss.elastic.co/t/strange-problem-finding-any-documents-logs-other-than-from-a-specific-container-kubernetes/250160 "2020-09-30T15:26:27Z")
Hello, I am using Elasticsearch to index logs from Kubernetes. I have the problem, that in Kibana (6.8.6) discover, visualize, etc. I can only see the logs coming from one pod, namely the kibana pod itself, in namespace … --- ## [Logstash parsing in JSON](https://discuss.elastic.co/t/logstash-parsing-in-json/249659)
**Author:** [@Sivajanani](https://discuss.elastic.co/u/Sivajanani)\ **Replies:** 11\ **Last updated:** [September 30, 2020, 3:14pm UTC](https://discuss.elastic.co/t/logstash-parsing-in-json/249659 "2020-09-30T15:14:56Z")
Hello, I have a json in the following format. {"group" : \[{"name":"group1","tag":\[{"name":"tag1"},{"name":"tag2"},{"name":"tag3"},{"name":"tag4"}\]}\],"association" : } Using Logstash config I have to parse tag field an… --- ## [Where can I find an exhaustive list of search exceptions thrown by ES?](https://discuss.elastic.co/t/where-can-i-find-an-exhaustive-list-of-search-exceptions-thrown-by-es/250522)
**Author:** [@michele\_crudele](https://discuss.elastic.co/u/michele_crudele)\ **Replies:** 0\ **Last updated:** [September 30, 2020, 2:31pm UTC](https://discuss.elastic.co/t/where-can-i-find-an-exhaustive-list-of-search-exceptions-thrown-by-es/250522 "2020-09-30T14:31:47Z")
There are users sending bad queries. Some examples are queries with offending characters like /, : \\ and so on; queries with more than 1024 clauses; queries with syntax errors. We'd like to discriminate these cases fro… --- ## [Datastream gets no data](https://discuss.elastic.co/t/datastream-gets-no-data/250516)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 2\ **Last updated:** [September 30, 2020, 2:22pm UTC](https://discuss.elastic.co/t/datastream-gets-no-data/250516 "2020-09-30T14:22:18Z")
Hi, Being new to the datastream subject, I tried setting up a datastream using the documentation here: https://www.elastic.co/guide/en/elasticsearch/reference/current/set-up-a-data-stream.html and index towards it. … --- ## [Terms Aggregation Bucket Sort when doc\_count is equal](https://discuss.elastic.co/t/terms-aggregation-bucket-sort-when-doc-count-is-equal/250509)
**Author:** [@aan](https://discuss.elastic.co/u/aan)\ **Replies:** 0\ **Last updated:** [September 30, 2020, 1:13pm UTC](https://discuss.elastic.co/t/terms-aggregation-bucket-sort-when-doc-count-is-equal/250509 "2020-09-30T13:13:10Z")
Hey. The documentation states that: By default, the terms aggregation will return the buckets for the top ten terms ordered by the doc\_count I was just wondering what happens, when the doc\_count of several buckets i… --- ## [Update indexed docs based on a value from a new doc still does not indexed](https://discuss.elastic.co/t/update-indexed-docs-based-on-a-value-from-a-new-doc-still-does-not-indexed/250478)
**Author:** [@Marcelo\_Lavor](https://discuss.elastic.co/u/Marcelo_Lavor)\ **Replies:** 1\ **Last updated:** [September 30, 2020, 1:11pm UTC](https://discuss.elastic.co/t/update-indexed-docs-based-on-a-value-from-a-new-doc-still-does-not-indexed/250478 "2020-09-30T13:11:56Z")
Hello! I need to update several docs into an old index based on a value of new records still do not indexed? Is there any way to implement it with Logstash? This table below describes my index with old docs. The yellow … --- ## [Iterate parsing json in Logstash](https://discuss.elastic.co/t/iterate-parsing-json-in-logstash/249749)
**Author:** [@Sivajanani](https://discuss.elastic.co/u/Sivajanani)\ **Replies:** 11\ **Last updated:** [September 30, 2020, 1:02pm UTC](https://discuss.elastic.co/t/iterate-parsing-json-in-logstash/249749 "2020-09-30T13:02:16Z")
Hello All, My Json field looks like below, {"group" : \[{"name":"group1","tag":\[{"name":"tag1"},{"name":"tag2"},{"name":"tag3"},{"name":"tag4"}\]}\],"association" : } And my config file having mutate filter is as follows… --- ## [Logstash index format interpreted literally](https://discuss.elastic.co/t/logstash-index-format-interpreted-literally/250461)
**Author:** [@vinci](https://discuss.elastic.co/u/vinci)\ **Replies:** 3\ **Last updated:** [September 30, 2020, 12:41pm UTC](https://discuss.elastic.co/t/logstash-index-format-interpreted-literally/250461 "2020-09-30T12:41:02Z")
Hello, I've created several indices with logstash using the following settings: output { stdout { codec =\> dots } elasticsearch { hosts =\> \["http://192.168.99.18… --- ## [ES query to match all elements in array](https://discuss.elastic.co/t/es-query-to-match-all-elements-in-array/250364)
**Author:** [@GeorgetaPojoga](https://discuss.elastic.co/u/GeorgetaPojoga)\ **Replies:** 1\ **Last updated:** [September 30, 2020, 12:03pm UTC](https://discuss.elastic.co/t/es-query-to-match-all-elements-in-array/250364 "2020-09-30T12:03:24Z")
So I got this document with a nested array that I want to filter with this query. I want ES to return all documents where all items have changes = 0 and that only. If document has even a single item in the list with a c… --- ## [Unable to install Kibana - Ubuntu 18.04.5 LTS Bionic - unable to locate package kibana](https://discuss.elastic.co/t/unable-to-install-kibana-ubuntu-18-04-5-lts-bionic-unable-to-locate-package-kibana/250247)
**Author:** [@eliteharbinger42](https://discuss.elastic.co/u/eliteharbinger42)\ **Replies:** 3\ **Last updated:** [September 30, 2020, 11:59am UTC](https://discuss.elastic.co/t/unable-to-install-kibana-ubuntu-18-04-5-lts-bionic-unable-to-locate-package-kibana/250247 "2020-09-30T11:59:50Z")
Hi, Am trying to install Kibana but i get the inable to locate package kibana. I was able to install elasticsearch without any issue and followed the notes on adding the repository etc but it fails for Kibana. Ubuntu … --- ## [Why do the greater than comparison and the greater than equal comparsion not return the same count of documents](https://discuss.elastic.co/t/why-do-the-greater-than-comparison-and-the-greater-than-equal-comparsion-not-return-the-same-count-of-documents/250497)
**Author:** [@Florian1](https://discuss.elastic.co/u/Florian1)\ **Replies:** 0\ **Last updated:** [September 30, 2020, 11:35am UTC](https://discuss.elastic.co/t/why-do-the-greater-than-comparison-and-the-greater-than-equal-comparsion-not-return-the-same-count-of-documents/250497 "2020-09-30T11:35:40Z")
I have create a new Index and then added two documents to it. PUT test\_index PUT /test\_index/\_doc/1 { "A" : "5" } PUT /test\_index/\_doc/2 { "B" : "5" } After that I searched for every document with A greater than … --- ## [Gc - allocation failure](https://discuss.elastic.co/t/gc-allocation-failure/250495)
**Author:** [@zen.xen](https://discuss.elastic.co/u/zen.xen)\ **Replies:** 0\ **Last updated:** [September 30, 2020, 11:33am UTC](https://discuss.elastic.co/t/gc-allocation-failure/250495 "2020-09-30T11:33:21Z")
Hello, I found something in gc.log. I try to find any info in the Internet what it means but I didn't. What should I do to fix it and where set proper value(s)? Entering safepoint region: GenCollectForAllocation GC(1) … --- ## [ダッシュボード上でPOSTリクエストを実行する方法](https://discuss.elastic.co/t/post/249923)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 1\ **Last updated:** [September 30, 2020, 11:29am UTC](https://discuss.elastic.co/t/post/249923 "2020-09-30T11:29:00Z")
kibanaのダッシュボード上で、あるボタンを押すとPOSTリクエストを送信するような実装は可能かどうか、ご教示頂けないでしょうか？ボタンでなくても良いですが、もし可能であればダッシュボード上からPOSTリクエストを送信したいと思っております --- ## [Kibanaでの描画時に他のindexの内容を利用して集計する方法](https://discuss.elastic.co/t/kibana-index/249929)
**Author:** [@sck\_345](https://discuss.elastic.co/u/sck_345)\ **Replies:** 1\ **Last updated:** [September 30, 2020, 11:15am UTC](https://discuss.elastic.co/t/kibana-index/249929 "2020-09-30T11:15:16Z")
初心者のため、質問内容がおかしかったら申し訳ありません。 あるindexの内容を集計してグラフを描画したいのですが、 目標に対する割合を合わせてDataTableなどで描画したいと考えています。 indexA：生ログ indexB：indexAに含まれる項目ごとの目標値 indexA category | cost A1| 100 A2| 200 A1| 250 A3| 150 indexB category | cos… --- ## [100% CPU after the upgrade from 7.6.1 to 7.8.1](https://discuss.elastic.co/t/100-cpu-after-the-upgrade-from-7-6-1-to-7-8-1/244822)
**Author:** [@Jehu\_T](https://discuss.elastic.co/u/Jehu_T)\ **Replies:** 5\ **Last updated:** [September 30, 2020, 10:29am UTC](https://discuss.elastic.co/t/100-cpu-after-the-upgrade-from-7-6-1-to-7-8-1/244822 "2020-09-30T10:29:57Z")
Hi, After upgrading to Elasticsearch 7.8.1 from 7.6.1, the CPU usage is reaching 100% most of the time on all 4 nodes. We didn't have this issue before the upgrade. The GC is almost 0% after the upgrade. It was noticed… --- ## [How to add a column that includes a mathematical operation](https://discuss.elastic.co/t/how-to-add-a-column-that-includes-a-mathematical-operation/250370)
**Author:** [@Max\_Handle](https://discuss.elastic.co/u/Max_Handle)\ **Replies:** 1\ **Last updated:** [September 30, 2020, 10:27am UTC](https://discuss.elastic.co/t/how-to-add-a-column-that-includes-a-mathematical-operation/250370 "2020-09-30T10:27:35Z")
Hi, I am trying to create a column that calculates the average Session Percentage. The operation is quite simple: take the session Total of each row and divide it by the overall session total. So in this case the "Sessi… --- ## [Script sorting](https://discuss.elastic.co/t/script-sorting/250338)
**Author:** [@flatmap101](https://discuss.elastic.co/u/flatmap101)\ **Replies:** 4\ **Last updated:** [September 30, 2020, 10:19am UTC](https://discuss.elastic.co/t/script-sorting/250338 "2020-09-30T10:19:20Z")
hi all! i am getting some very strange behavior while using scripted sorting. the script itself looks approximately like that: if (doc\['fieldName1'\].size() != 0 && doc\['fieldName2'\].size() != 0) { // 1 - might not be … --- ## [Logstash.conf filter doesn't work](https://discuss.elastic.co/t/logstash-conf-filter-doesnt-work/250091)
**Author:** [@zen.xen](https://discuss.elastic.co/u/zen.xen)\ **Replies:** 14\ **Last updated:** [September 30, 2020, 9:58am UTC](https://discuss.elastic.co/t/logstash-conf-filter-doesnt-work/250091 "2020-09-30T09:58:03Z")
Hello, I want to send events from my .log file with filebeat. I have created such filter but it doesn't work. input { beats { port =\> "5044" } } filter { grok { match =\> { "message" =\> "(%{TIMESTA… --- ## [Update indexed data based on a value from a new record still does not indexed](https://discuss.elastic.co/t/update-indexed-data-based-on-a-value-from-a-new-record-still-does-not-indexed/250429)
**Author:** [@Marcelo\_Lavor](https://discuss.elastic.co/u/Marcelo_Lavor)\ **Replies:** 2\ **Last updated:** [September 30, 2020, 9:34am UTC](https://discuss.elastic.co/t/update-indexed-data-based-on-a-value-from-a-new-record-still-does-not-indexed/250429 "2020-09-30T09:34:08Z")
Hello! I need to update a field of several records already indexed based on a value from a new record still not indexed? Is there any way to implement it? Thanks Marcelo --- ## [Case Heavy load : How we can search all search request cancellable to cancellation](https://discuss.elastic.co/t/case-heavy-load-how-we-can-search-all-search-request-cancellable-to-cancellation/250472)
**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\ **Replies:** 3\ **Last updated:** [September 30, 2020, 9:38am UTC](https://discuss.elastic.co/t/case-heavy-load-how-we-can-search-all-search-request-cancellable-to-cancellation/250472 "2020-09-30T09:38:17Z")
Hello, Maybe our cluster become unreacheable or with high latency. I personally believe that tasks cancellation can be help to decrease load in cluster ? I try this : GET /\_cat/thread\_pool/search?v&h=node\_name,name,a… --- ## [How to Cleanup Full Disk on Elasticsearch Node while Elasticsearch is not running](https://discuss.elastic.co/t/how-to-cleanup-full-disk-on-elasticsearch-node-while-elasticsearch-is-not-running/249640)
**Author:** [@Rohail\_Abbas](https://discuss.elastic.co/u/Rohail_Abbas)\ **Replies:** 5\ **Last updated:** [September 30, 2020, 9:36am UTC](https://discuss.elastic.co/t/how-to-cleanup-full-disk-on-elasticsearch-node-while-elasticsearch-is-not-running/249640 "2020-09-30T09:36:06Z")
I have Elasticsearch 7.4 with 1 master and 5 data nodes (Amazon ec2 instances). I have cluster.routing.allocation.disk.threshold\_enabled setting = false Now one of the disk in a node became full and elasticsearch stopped… --- ## [Elasticsearch maintenance procedure](https://discuss.elastic.co/t/elasticsearch-maintenance-procedure/250465)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 1\ **Last updated:** [September 30, 2020, 8:25am UTC](https://discuss.elastic.co/t/elasticsearch-maintenance-procedure/250465 "2020-09-30T08:25:08Z")
hi all, I'm starting to think about the correct procedure to apply security patches on the ES nodes (OS: CentOS). I have several clusters with different purpose but I focused on the most important; this cluster is comp… --- ## [Unable to initialize Ingest Manager behind proxy](https://discuss.elastic.co/t/unable-to-initialize-ingest-manager-behind-proxy/246255)
**Author:** [@iorfix](https://discuss.elastic.co/u/iorfix)\ **Replies:** 4\ **Last updated:** [September 30, 2020, 7:11am UTC](https://discuss.elastic.co/t/unable-to-initialize-ingest-manager-behind-proxy/246255 "2020-09-30T07:11:13Z")
Hi, I tried to use new beta Ingest Manager functionality. However, I got this error in Kibana when launching it: Unable to initialize Ingest Manager Error connecting to package registry at https://epr-7-9.elastic.co/s… --- ## [o.e.b.Bootstrap](https://discuss.elastic.co/t/o-e-b-bootstrap/250365)
**Author:** [@muthug](https://discuss.elastic.co/u/muthug)\ **Replies:** 4\ **Last updated:** [September 30, 2020, 6:52am UTC](https://discuss.elastic.co/t/o-e-b-bootstrap/250365 "2020-09-30T06:52:47Z")
\[2020-09-29T15:25:43,752\]\[ERROR\]\[o.e.b.Bootstrap \] \[VDCGraylogNode02\] Exception java.lang.IllegalArgumentException: node settings must not contain any index level settings at org.elasticsearch.common.settings.… --- ## [Query fails when value is empty - how do I work around this?](https://discuss.elastic.co/t/query-fails-when-value-is-empty-how-do-i-work-around-this/250439)
**Author:** [@M\_Gibbs](https://discuss.elastic.co/u/M_Gibbs)\ **Replies:** 1\ **Last updated:** [September 30, 2020, 6:44am UTC](https://discuss.elastic.co/t/query-fails-when-value-is-empty-how-do-i-work-around-this/250439 "2020-09-30T06:44:58Z")
Hi there, We are parsing our query via a form, and this form has 29+ inputs. Therefore there are many occassions where part of the full JSON query might have an empty value if the end user does not use one of the 29 + … --- ## [Elasticsearch Cluster Adding node](https://discuss.elastic.co/t/elasticsearch-cluster-adding-node/249637)
**Author:** [@kkhadka](https://discuss.elastic.co/u/kkhadka)\ **Replies:** 4\ **Last updated:** [September 30, 2020, 6:42am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-adding-node/249637 "2020-09-30T06:42:33Z")
Hi, I want to switch from single node elasticsearch to three node cluster without the data loss. For that, I have modified the configuration files correctly. Let node1 be the one with data and node2, node3 are new node… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1214) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1216)