# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1216 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1217 --- ## [Doc\['field'\]. value not returning the correct value](https://discuss.elastic.co/t/doc-field-value-not-returning-the-correct-value/250386)
**Author:** [@raviswam](https://discuss.elastic.co/u/raviswam)\ **Replies:** 3\ **Last updated:** [September 30, 2020, 6:39am UTC](https://discuss.elastic.co/t/doc-field-value-not-returning-the-correct-value/250386 "2020-09-30T06:39:50Z")
\`indent preformatted text by 4 spaces\` Hi Guys, Very new to painless scripting and have the simplest of scripted fields which is not working. I am trying to extract a pattern from doc\["message"\] field but it fails. So… --- ## [How is data encrypted on Elastic Cloud for the scenarios: Data at rest and Data in Transit](https://discuss.elastic.co/t/how-is-data-encrypted-on-elastic-cloud-for-the-scenarios-data-at-rest-and-data-in-transit/249984)
**Author:** [@Pooja](https://discuss.elastic.co/u/Pooja)\ **Replies:** 4\ **Last updated:** [September 30, 2020, 5:59am UTC](https://discuss.elastic.co/t/how-is-data-encrypted-on-elastic-cloud-for-the-scenarios-data-at-rest-and-data-in-transit/249984 "2020-09-30T05:59:12Z")
When you host Elasticsearch on Elastic Cloud and send logs from Azure Cloud and Onprem Logstash instances, How is data encrypted while in transit and How is the data that is at rest encrypted? --- ## [Is a loadbalancer required before logstash, to maintain high availability?](https://discuss.elastic.co/t/is-a-loadbalancer-required-before-logstash-to-maintain-high-availability/250341)
**Author:** [@Pooja](https://discuss.elastic.co/u/Pooja)\ **Replies:** 2\ **Last updated:** [September 30, 2020, 5:58am UTC](https://discuss.elastic.co/t/is-a-loadbalancer-required-before-logstash-to-maintain-high-availability/250341 "2020-09-30T05:58:43Z")
If I am reading data from multiple OS, and flavours of OS, network devices, around 60 different log sources altogether. Do I need a load balancer or does elastic have a loadbalancer in bulit? FYI, I do not want to use Fi… --- ## [Use kv filter on newline & return split pattern](https://discuss.elastic.co/t/use-kv-filter-on-newline-return-split-pattern/249655)
**Author:** [@ParashB](https://discuss.elastic.co/u/ParashB)\ **Replies:** 2\ **Last updated:** [September 30, 2020, 5:39am UTC](https://discuss.elastic.co/t/use-kv-filter-on-newline-return-split-pattern/249655 "2020-09-30T05:39:56Z")
Hi, I am trying to use kv filter to parse the below logs Name: abc\\r\\nAge: 39\\r\\nGender: Male\\r\\nSalary: 87 My kv filter is as below kv { source =\> "log" field\_split\_pattern =\> "\\\\\\r\\\\\\n" value\_split =\> ":" } I h… --- ## [How can make a cluster with Logstash? Is it possible?!?](https://discuss.elastic.co/t/how-can-make-a-cluster-with-logstash-is-it-possible/250444)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 2\ **Last updated:** [September 30, 2020, 5:15am UTC](https://discuss.elastic.co/t/how-can-make-a-cluster-with-logstash-is-it-possible/250444 "2020-09-30T05:15:22Z")
Hi I have 3 nodes for logstash. each logstash has it own pipeline (for example, one logstash has http module and some metricfiles. another one has two jdbc driver and some filebeats and....) So, I can\`t use file and h… --- ## [Logstash http plugin 'threads'](https://discuss.elastic.co/t/logstash-http-plugin-threads/250310)
**Author:** [@stsm](https://discuss.elastic.co/u/stsm)\ **Replies:** 2\ **Last updated:** [September 30, 2020, 4:59am UTC](https://discuss.elastic.co/t/logstash-http-plugin-threads/250310 "2020-09-30T04:59:50Z")
Hi there. I'm playing around with the "http" Logstash plugin. I ask myself, how should 'threads' be calculate? (As far as i remember, i read somewhere that the plugin depends on the "puma server") Can anyone give me a … --- ## [Primary vs replica inconsistency in ES5.6](https://discuss.elastic.co/t/primary-vs-replica-inconsistency-in-es5-6/249893)
**Author:** [@Priyanka\_Raju](https://discuss.elastic.co/u/Priyanka_Raju)\ **Replies:** 3\ **Last updated:** [September 30, 2020, 4:57am UTC](https://discuss.elastic.co/t/primary-vs-replica-inconsistency-in-es5-6/249893 "2020-09-30T04:57:30Z")
Hi, I recently noticed that some of our queries returned inconsistent results, digging deep, I found that the query returned 0 results when the query was executed against one replica and returned results when executed a… --- ## [Export CSV from search in Dashboard kibana](https://discuss.elastic.co/t/export-csv-from-search-in-dashboard-kibana/250441)
**Author:** [@umay\_fb](https://discuss.elastic.co/u/umay_fb)\ **Replies:** 1\ **Last updated:** [September 30, 2020, 4:24am UTC](https://discuss.elastic.co/t/export-csv-from-search-in-dashboard-kibana/250441 "2020-09-30T04:24:38Z")
hello.. i had a case i am using KIBANA 7.5. I create a Dashboard with Control filter and Discover. i using a filter from control and get 10548 data in discover. when i finish export it to csv i get csv with only 4 recor… --- ## [Logstash 7.9.2 service will not start on Ubuntu 18.04](https://discuss.elastic.co/t/logstash-7-9-2-service-will-not-start-on-ubuntu-18-04/250270)
**Author:** [@Xeny](https://discuss.elastic.co/u/Xeny)\ **Replies:** 4\ **Last updated:** [September 30, 2020, 4:09am UTC](https://discuss.elastic.co/t/logstash-7-9-2-service-will-not-start-on-ubuntu-18-04/250270 "2020-09-30T04:09:20Z")
Hello, I have a new installation on Ubuntu 18.04 where I have successfully installed "elasticsearch and kibana". However, after installing logstach and attempting to start it, it continues to fail with the following m… --- ## [Pass Envt Variables to Logstash config file](https://discuss.elastic.co/t/pass-envt-variables-to-logstash-config-file/250375)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 4\ **Last updated:** [September 30, 2020, 3:46am UTC](https://discuss.elastic.co/t/pass-envt-variables-to-logstash-config-file/250375 "2020-09-30T03:46:18Z")
Hello Team I am having Logstash v7.8.0 installed along with Elasticsearch v7.8.0. My Requirement is to run multiple logstash instances using pipelines via individual "conf" files. These conf files , are having va… --- ## [Adding analysers to an ES Index without downtime](https://discuss.elastic.co/t/adding-analysers-to-an-es-index-without-downtime/249614)
**Author:** [@Ryan\_Davey](https://discuss.elastic.co/u/Ryan_Davey)\ **Replies:** 1\ **Last updated:** [September 29, 2020, 11:43pm UTC](https://discuss.elastic.co/t/adding-analysers-to-an-es-index-without-downtime/249614 "2020-09-29T23:43:27Z")
Just looking for some direction on solving a problem. Our requirements need us to change our index occasionally to add new mappings and filters/normalizers/analyzers. These operations are not always allowed as an updat… --- ## [KIBANA CUSTOM FIELDS](https://discuss.elastic.co/t/kibana-custom-fields/250419)
**Author:** [@HenriqueNogueira](https://discuss.elastic.co/u/HenriqueNogueira)\ **Replies:** 2\ **Last updated:** [September 29, 2020, 11:00pm UTC](https://discuss.elastic.co/t/kibana-custom-fields/250419 "2020-09-29T23:00:55Z")
Hi Guys, can someone help me create custom fields in kibana? I have my json arriving at MESSAGE and I would like to create custom fields for each "attribute" in my log. I will paste an example: this is my MESSAGE, I w… --- ## [Best way to ensure logs from all hosts are being indexed](https://discuss.elastic.co/t/best-way-to-ensure-logs-from-all-hosts-are-being-indexed/250424)
**Author:** [@bruce289](https://discuss.elastic.co/u/bruce289)\ **Replies:** 1\ **Last updated:** [September 29, 2020, 10:29pm UTC](https://discuss.elastic.co/t/best-way-to-ensure-logs-from-all-hosts-are-being-indexed/250424 "2020-09-29T22:29:50Z")
Hi all, The log pipeline for our Linux systems is: rsyslog =\> logstash =\> elasticsearch We want to put something in place that would alert us if logs from any of our approximately 5000 hosts are not being indexed in E… --- ## [How to curl PUT timestamp correctly](https://discuss.elastic.co/t/how-to-curl-put-timestamp-correctly/250256)
**Author:** [@buhruce](https://discuss.elastic.co/u/buhruce)\ **Replies:** 3\ **Last updated:** [September 29, 2020, 9:16pm UTC](https://discuss.elastic.co/t/how-to-curl-put-timestamp-correctly/250256 "2020-09-29T21:16:55Z")
I admin a Configuration Management tool and it's data visualization is not good. So I'm scraping the data from this tool and dumping it into Elastic Search. Config Tool API -\> Python Script -\> Elast Search API. All the d… --- ## [How to set mapping to run on a daily basis?](https://discuss.elastic.co/t/how-to-set-mapping-to-run-on-a-daily-basis/250391)
**Author:** [@kercio](https://discuss.elastic.co/u/kercio)\ **Replies:** 2\ **Last updated:** [September 29, 2020, 7:56pm UTC](https://discuss.elastic.co/t/how-to-set-mapping-to-run-on-a-daily-basis/250391 "2020-09-29T19:56:07Z")
My script sends data to Kibana on a daily basis on this format "xxxx-flat-2020-09-21" I created an index pattern "xxxx-flat-\*" which is working almost fine. For each index I need to run this mapping below, otherwise, t… --- ## [Logstash - Output - Http - Enpoint](https://discuss.elastic.co/t/logstash-output-http-enpoint/249401)
**Author:** [@rguerrero](https://discuss.elastic.co/u/rguerrero)\ **Replies:** 4\ **Last updated:** [September 29, 2020, 8:36pm UTC](https://discuss.elastic.co/t/logstash-output-http-enpoint/249401 "2020-09-29T20:36:46Z")
I thank you in advance for your support. I am developing my pipeline that fetches data from DB and sends it to an EndPoint HTTP Post The input works fine, but I am having problems in my output, it does not get to send … --- ## [Run detection rule manually](https://discuss.elastic.co/t/run-detection-rule-manually/249780)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 1\ **Last updated:** [September 29, 2020, 8:23pm UTC](https://discuss.elastic.co/t/run-detection-rule-manually/249780 "2020-09-29T20:23:07Z")
Hi all How to run the detection rule manually, I have some rule that have query time of about few hour each, and i want to have a quick test of the rule to make quick change. Is there some curl or something to do that… --- ## [Elastic Agent for Mobile Android and iOS](https://discuss.elastic.co/t/elastic-agent-for-mobile-android-and-ios/250399)
**Author:** [@kal1s](https://discuss.elastic.co/u/kal1s)\ **Replies:** 1\ **Last updated:** [September 29, 2020, 6:29pm UTC](https://discuss.elastic.co/t/elastic-agent-for-mobile-android-and-ios/250399 "2020-09-29T18:29:33Z")
Hi, We're using the Elastic Agent with Metricbeat , Filebeat , and Endpoint Security for Linux , macOS , and Windows and it's working nicely ! For Monitoring , Data Analysis , Alerts , and Machine Learn… --- ## [Logstash persistent queues with pipelines behaivour](https://discuss.elastic.co/t/logstash-persistent-queues-with-pipelines-behaivour/250404)
**Author:** [@mtudisco](https://discuss.elastic.co/u/mtudisco)\ **Replies:** 0\ **Last updated:** [September 29, 2020, 6:19pm UTC](https://discuss.elastic.co/t/logstash-persistent-queues-with-pipelines-behaivour/250404 "2020-09-29T18:19:02Z")
Hi, I have the following configuration: 1 logstash machine l1 with 4 pipelines, p1 p2 p3 and p4 p1 has the input, does some procesing and then outputs to pipelines p2 p3 and p4 p2 does some procesing and outputs to s… --- ## [Logstash + SSL](https://discuss.elastic.co/t/logstash-ssl/250234)
**Author:** [@brapnda23](https://discuss.elastic.co/u/brapnda23)\ **Replies:** 4\ **Last updated:** [September 29, 2020, 6:16pm UTC](https://discuss.elastic.co/t/logstash-ssl/250234 "2020-09-29T18:16:15Z")
Hey guys, As soon as I add below three SSL\* lines to the input section of logstash.conf, service gives me below error; \*\[2020-09-28T12:19:05,245\]\[ERROR\]\[logstash.agent \] Failed to execute action {:id=\>:main, … --- ## [Logstash Aggregate plugin not working](https://discuss.elastic.co/t/logstash-aggregate-plugin-not-working/250371)
**Author:** [@rfferrao](https://discuss.elastic.co/u/rfferrao)\ **Replies:** 6\ **Last updated:** [September 29, 2020, 5:55pm UTC](https://discuss.elastic.co/t/logstash-aggregate-plugin-not-working/250371 "2020-09-29T17:55:39Z")
Trying to implement aggregate plugin based on the documentation, but I'm having problems. Here's how I've configured it: aggregate { task\_id =\> "%{tunnelid}" code =\> " map\['user'\] = event.get('user') … --- ## [Date freeze in index after rollover (only in windows) logstah 7.9.2](https://discuss.elastic.co/t/date-freeze-in-index-after-rollover-only-in-windows-logstah-7-9-2/250300)
**Author:** [@benji\_c](https://discuss.elastic.co/u/benji_c)\ **Replies:** 3\ **Last updated:** [September 29, 2020, 5:36pm UTC](https://discuss.elastic.co/t/date-freeze-in-index-after-rollover-only-in-windows-logstah-7-9-2/250300 "2020-09-29T17:36:17Z")
Hi! After a few hours reviewing configurations and creating and deleting index and creating ILM noticed an issue with the logstash 7.9.2 windows version, that freezes date fields in new index when doing rollover. Let … --- ## [Adding warm node to existing cluster, how to avoid existing indices to spread to these nodes](https://discuss.elastic.co/t/adding-warm-node-to-existing-cluster-how-to-avoid-existing-indices-to-spread-to-these-nodes/250239)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 5\ **Last updated:** [September 29, 2020, 4:05pm UTC](https://discuss.elastic.co/t/adding-warm-node-to-existing-cluster-how-to-avoid-existing-indices-to-spread-to-these-nodes/250239 "2020-09-29T16:05:16Z")
I plan to add 3 warm nodes into my cluster. (version 7.9 and 15 hot nodes) I modified elasticsearch.yml with these new lines: node.attr.data: hot # on existing nodes node.attr.data: warm # on new nodes when I s… --- ## [Mapping elasticsearch](https://discuss.elastic.co/t/mapping-elasticsearch/250392)
**Author:** [@Bengagi\_Foued](https://discuss.elastic.co/u/Bengagi_Foued)\ **Replies:** 1\ **Last updated:** [September 29, 2020, 3:48pm UTC](https://discuss.elastic.co/t/mapping-elasticsearch/250392 "2020-09-29T15:48:42Z")
hello is there a way to make elasticsearch store a field (which is not declared in the mapping) by default with type keyword instead of text ? --- ## [Is there a way to validate or dry run the index templates config before applying?](https://discuss.elastic.co/t/is-there-a-way-to-validate-or-dry-run-the-index-templates-config-before-applying/250244)
**Author:** [@ShenWan](https://discuss.elastic.co/u/ShenWan)\ **Replies:** 2\ **Last updated:** [September 29, 2020, 3:07pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-validate-or-dry-run-the-index-templates-config-before-applying/250244 "2020-09-29T15:07:58Z")
We plan to store index templates in Phabricator and would like to validate a diff before landing it and HTTP PUT to ES. --- ## [Multiline filter failure](https://discuss.elastic.co/t/multiline-filter-failure/250354)
**Author:** [@vikramaddagulla](https://discuss.elastic.co/u/vikramaddagulla)\ **Replies:** 2\ **Last updated:** [September 29, 2020, 3:01pm UTC](https://discuss.elastic.co/t/multiline-filter-failure/250354 "2020-09-29T15:01:36Z")
Hello, I am trying to parse a log file in multiline format and each new linestarts with the date : 28-Sep-2020 18:26:19.982 I tried to configure the config as below : filebeat.inputs: - type: log tags: \["PROD\_CATAL… --- ## [Datetime format](https://discuss.elastic.co/t/datetime-format/250360)
**Author:** [@RPL\_Developer](https://discuss.elastic.co/u/RPL_Developer)\ **Replies:** 1\ **Last updated:** [September 29, 2020, 2:12pm UTC](https://discuss.elastic.co/t/datetime-format/250360 "2020-09-29T14:12:08Z")
I am using MariaDB database there I have enter simple date without any timestamp but when data is going to Elasticsearch there is some timestamp along with the date. Please someone help me out in this --- ## [Kibana maps Sum Aggregation returns 0](https://discuss.elastic.co/t/kibana-maps-sum-aggregation-returns-0/250367)
**Author:** [@haythem](https://discuss.elastic.co/u/haythem)\ **Replies:** 0\ **Last updated:** [September 29, 2020, 1:48pm UTC](https://discuss.elastic.co/t/kibana-maps-sum-aggregation-returns-0/250367 "2020-09-29T13:48:18Z")
Hi guys , i'm having a problem with sum aggregation on maps , so when i change the time filter to last 100 days it gives me the exact result but any lesser than that the result would be 0 , though i have data on document… --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/250212)
**Author:** [@Israel\_Braga](https://discuss.elastic.co/u/Israel_Braga)\ **Replies:** 6\ **Last updated:** [September 29, 2020, 1:47pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/250212 "2020-09-29T13:47:21Z")
After upgrade elk to 7.9.2: root@log:/# systemctl status kibana ● kibana.service - Kibana Loaded: loaded (/etc/systemd/system/kibana.service; enabled; vendor preset: enabled) Active: active (running) since Mon 2020-0… --- ## [Rolling upgrade from ES 6.8 to ES 7.9](https://discuss.elastic.co/t/rolling-upgrade-from-es-6-8-to-es-7-9/250344)
**Author:** [@amishar](https://discuss.elastic.co/u/amishar)\ **Replies:** 3\ **Last updated:** [September 29, 2020, 1:03pm UTC](https://discuss.elastic.co/t/rolling-upgrade-from-es-6-8-to-es-7-9/250344 "2020-09-29T13:03:13Z")
While performing rolling upgrade from 6.8 to 7.9, the documentation suggest that cluster continue to operate in backward compatibility mode until all nodes are upgraded to newer version. How do we avoid issues with newer… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1215) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1217)