# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1220 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1221 --- ## [Upgrade elasticsearch](https://discuss.elastic.co/t/upgrade-elasticsearch/249491)
**Author:** [@blomqc](https://discuss.elastic.co/u/blomqc)\ **Replies:** 3\ **Last updated:** [September 28, 2020, 12:34am UTC](https://discuss.elastic.co/t/upgrade-elasticsearch/249491 "2020-09-28T00:34:33Z")
after upgrading elasticsearch binaries from 1.7.x to 2.x, elasticsearch takes very long (~20h) get back online. From the log it looks like data is moved around ? Only seen this issue when elasticsearch is configured wi… --- ## [Browser Displays Text (No Dashboard)](https://discuss.elastic.co/t/browser-displays-text-no-dashboard/250067)
**Author:** [@LogMonitor](https://discuss.elastic.co/u/LogMonitor)\ **Replies:** 5\ **Last updated:** [September 27, 2020, 8:21pm UTC](https://discuss.elastic.co/t/browser-displays-text-no-dashboard/250067 "2020-09-27T20:21:43Z")
I am new to ELK. I have an ESXI environment and I created a single-node ELK stack using this guide: https://burnhamforensics.com/2018/08/14/creating-a-single-node-elk-stack/. When I access the URL (http://192.168.1.12:9… --- ## [Script for a Force Merge on indexes in ES](https://discuss.elastic.co/t/script-for-a-force-merge-on-indexes-in-es/250021)
**Author:** [@elasticuserxxx](https://discuss.elastic.co/u/elasticuserxxx)\ **Replies:** 1\ **Last updated:** [September 27, 2020, 6:04pm UTC](https://discuss.elastic.co/t/script-for-a-force-merge-on-indexes-in-es/250021 "2020-09-27T18:04:26Z")
I need to run force merge on indexes which are older (no longer being written to or not in active state) for more than "48hours for daily/quaterly indexes" and "33 days for monthly indexes". This should be run by a scri… --- ## [Tagging data based on lookup table](https://discuss.elastic.co/t/tagging-data-based-on-lookup-table/250097)
**Author:** [@Adi\_Pacht](https://discuss.elastic.co/u/Adi_Pacht)\ **Replies:** 0\ **Last updated:** [September 27, 2020, 5:09pm UTC](https://discuss.elastic.co/t/tagging-data-based-on-lookup-table/250097 "2020-09-27T17:09:48Z")
Hey everyone, I’m trying to tag my data according to a lookup table. The lookup table has these fields: • Key- represent the field name in the data I want to tag. In the real data the field is a subfield of “Headers”… --- ## [Kibana 403 forbidden](https://discuss.elastic.co/t/kibana-403-forbidden/250089)
**Author:** [@111380](https://discuss.elastic.co/u/111380)\ **Replies:** 1\ **Last updated:** [September 27, 2020, 4:41pm UTC](https://discuss.elastic.co/t/kibana-403-forbidden/250089 "2020-09-27T16:41:04Z")
Hi! After creating passwords "./elasticsearch-setup-password auto" it is impossible to log in to kibana, error 403 forbidden /etc/kibana/kibana.yml: elasticsearch.username: "kibana" elasticsearch.password: "password" … --- ## [ES is not starting after upgrading it to 7.9.2](https://discuss.elastic.co/t/es-is-not-starting-after-upgrading-it-to-7-9-2/250081)
**Author:** [@NiranjanMurali](https://discuss.elastic.co/u/NiranjanMurali)\ **Replies:** 8\ **Last updated:** [September 27, 2020, 2:37pm UTC](https://discuss.elastic.co/t/es-is-not-starting-after-upgrading-it-to-7-9-2/250081 "2020-09-27T14:37:14Z")
Elasticsearch is not starting after updating it to 7.9.2. It throws below error. OS-CentOS7 Exception in thread "main" java.lang.RuntimeException: starting java failed with \[1\] output: error: Unrecognized VM option … --- ## [Scoring individual documents](https://discuss.elastic.co/t/scoring-individual-documents/250090)
**Author:** [@thernstig](https://discuss.elastic.co/u/thernstig)\ **Replies:** 0\ **Last updated:** [September 27, 2020, 1:56pm UTC](https://discuss.elastic.co/t/scoring-individual-documents/250090 "2020-09-27T13:56:55Z")
I understand that Elasticsearch is a great database to search amongst documents and to score them amongst eachother, thus being able to return to most relevant document for the search. But I want to use Elasticsearch in… --- ## [Filebeat output to logstash and elasticsearch both](https://discuss.elastic.co/t/filebeat-output-to-logstash-and-elasticsearch-both/250064)
**Author:** [@samiujan](https://discuss.elastic.co/u/samiujan)\ **Replies:** 3\ **Last updated:** [September 27, 2020, 9:57am UTC](https://discuss.elastic.co/t/filebeat-output-to-logstash-and-elasticsearch-both/250064 "2020-09-27T09:57:32Z")
Hi I am using Elasticstack 7.9 on-prem - I am wondering about a scenario if it's possible I have 2 services on 1 VM - one is an haproxy service and the other is an nginx service Both services generate log files on dis… --- ## [Create visualize exactly with field values](https://discuss.elastic.co/t/create-visualize-exactly-with-field-values/250062)
**Author:** [@arp220](https://discuss.elastic.co/u/arp220)\ **Replies:** 1\ **Last updated:** [September 27, 2020, 9:36am UTC](https://discuss.elastic.co/t/create-visualize-exactly-with-field-values/250062 "2020-09-27T09:36:12Z")
Hi. We have filed elapse and values are in milliseconds. Now we want to create a visualize Area or TSVB (time series) with exactly elapse values and not Aggregations, we don't want to use count or max or average or etc,… --- ## [Elasticsearch cross-index query with aggregations](https://discuss.elastic.co/t/elasticsearch-cross-index-query-with-aggregations/249100)
**Author:** [@ArtemSavelev](https://discuss.elastic.co/u/ArtemSavelev)\ **Replies:** 1\ **Last updated:** [September 26, 2020, 11:22pm UTC](https://discuss.elastic.co/t/elasticsearch-cross-index-query-with-aggregations/249100 "2020-09-26T23:22:10Z")
I use: Elasticsearch 7.7 , Kibana 7.7 For example, lets take two indexes: User index with simple mapping: PUT /user\_index { "mappings": { "properties": { "user\_id": { "type": "text" }, "user\_phone… --- ## [ElasticSearch filter plugin "Failed to parse query" Was Expecting TO](https://discuss.elastic.co/t/elasticsearch-filter-plugin-failed-to-parse-query-was-expecting-to/250061)
**Author:** [@subash](https://discuss.elastic.co/u/subash)\ **Replies:** 1\ **Last updated:** [September 26, 2020, 3:25pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-failed-to-parse-query-was-expecting-to/250061 "2020-09-26T15:25:36Z")
Hi, I am using Elasicsearch filter plugin to check the current event with the previous events. My elasticsearch filter plugin looks like this elasticsearch { hosts =\> "xx.xx.xx.xx" index … --- ## [Unable to download Logstash Avro Codec for Kafka Input](https://discuss.elastic.co/t/unable-to-download-logstash-avro-codec-for-kafka-input/250040)
**Author:** [@mastersmit](https://discuss.elastic.co/u/mastersmit)\ **Replies:** 1\ **Last updated:** [September 26, 2020, 2:33pm UTC](https://discuss.elastic.co/t/unable-to-download-logstash-avro-codec-for-kafka-input/250040 "2020-09-26T14:33:08Z")
In the organisation, the Kafka data is being sent in a Avro Schema and I am trying to load the data into Logstash using Kafka Input however without Avro Codec, I am getting the data in the below charset: \\u0001\\u000E\\u0… --- ## [Documentation on Elastic search upgrade](https://discuss.elastic.co/t/documentation-on-elastic-search-upgrade/250043)
**Author:** [@GOKUL\_R](https://discuss.elastic.co/u/GOKUL_R)\ **Replies:** 1\ **Last updated:** [September 26, 2020, 1:45pm UTC](https://discuss.elastic.co/t/documentation-on-elastic-search-upgrade/250043 "2020-09-26T13:45:46Z")
Hi, I have been trying to upgrade the ELasticsearch version from 7.1.1 to 7.8.0 and unfortunately it has broke our Kibana. I had a good reference on breaking changes and new upgrades for each version with the help of do… --- ## [Data loss incase of elasticsearch data node going down](https://discuss.elastic.co/t/data-loss-incase-of-elasticsearch-data-node-going-down/250042)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 2\ **Last updated:** [September 26, 2020, 9:28am UTC](https://discuss.elastic.co/t/data-loss-incase-of-elasticsearch-data-node-going-down/250042 "2020-09-26T09:28:01Z")
Hi All, We have 5 data nodes in our cluster, out of these 2 nodes went down and it looks like , I will take at-least a week to recover it. Is there a way to work with remaining 3 data nodes and we can recover other 2 da… --- ## [Error in loading data set](https://discuss.elastic.co/t/error-in-loading-data-set/249244)
**Author:** [@glitch](https://discuss.elastic.co/u/glitch)\ **Replies:** 2\ **Last updated:** [September 26, 2020, 7:34am UTC](https://discuss.elastic.co/t/error-in-loading-data-set/249244 "2020-09-26T07:34:46Z")
As a complete beginner I was following the official tutorial on Kibana. While having created a map for Shakespeare data set PUT /shakespeare { "mappings": { "properties": { "speaker": {"type": "keyword"}, "play\_n… --- ## [Re-evaluating shard setup](https://discuss.elastic.co/t/re-evaluating-shard-setup/249793)
**Author:** [@claohr](https://discuss.elastic.co/u/claohr)\ **Replies:** 9\ **Last updated:** [September 26, 2020, 6:58am UTC](https://discuss.elastic.co/t/re-evaluating-shard-setup/249793 "2020-09-26T06:58:25Z")
I'm running 3 node (26 GB EBS volume, 4GB Memory, c5.large) ES cluster v7.7 (AWS) for 1 index with the following setting PUT /my-index { "settings": { "number\_of\_shards": 1, "number\_of\_replicas": 1 } } A… --- ## [Dynamic facets with applied filters](https://discuss.elastic.co/t/dynamic-facets-with-applied-filters/250039)
**Author:** [@cmodijk](https://discuss.elastic.co/u/cmodijk)\ **Replies:** 0\ **Last updated:** [September 26, 2020, 4:51am UTC](https://discuss.elastic.co/t/dynamic-facets-with-applied-filters/250039 "2020-09-26T04:51:08Z")
Hi, I have been looking for a solution for the following case and tried searching for multiple terms on the Google and here on the forum. I'm not sure what the best solution is for this case so maybe someone here can po… --- ## [Unable to set search.max\_buckets for \_cluster/settings](https://discuss.elastic.co/t/unable-to-set-search-max-buckets-for-cluster-settings/250015)
**Author:** [@Suparna\_Shankar](https://discuss.elastic.co/u/Suparna_Shankar)\ **Replies:** 5\ **Last updated:** [September 25, 2020, 10:00pm UTC](https://discuss.elastic.co/t/unable-to-set-search-max-buckets-for-cluster-settings/250015 "2020-09-25T22:00:00Z")
m trying to curl -XPUT "http://localhost:9200/\_cluster/settings -H 'Content-Type: application/json'{"transient":{"search.max\_buckets": 200000}} but am getting below error please correct me if i am wrong C:\\Users\\ssuparn… --- ## [Parsing issues with Logstash CSV plugin](https://discuss.elastic.co/t/parsing-issues-with-logstash-csv-plugin/249856)
**Author:** [@petehalatsis](https://discuss.elastic.co/u/petehalatsis)\ **Replies:** 3\ **Last updated:** [September 25, 2020, 8:13pm UTC](https://discuss.elastic.co/t/parsing-issues-with-logstash-csv-plugin/249856 "2020-09-25T20:13:19Z")
I have been beating my head on this for a while. My syslog is hitting my if statement and using the columns I have below but they are off by one. I tried adding/removing the first column to account for the shift but it d… --- ## [Plugin fails to install](https://discuss.elastic.co/t/plugin-fails-to-install/250012)
**Author:** [@tyrone](https://discuss.elastic.co/u/tyrone)\ **Replies:** 1\ **Last updated:** [September 25, 2020, 6:37pm UTC](https://discuss.elastic.co/t/plugin-fails-to-install/250012 "2020-09-25T18:37:34Z")
I am unable to install the logstash-syslog-output plugin locally I am running rhel7.8, logstash 7.8.1 I have downloaded logstash-output-syslog-master.zip from git and am running \[root@us3lpvinfelk004 bin\]# ./logstas… --- ## [Logstash 7.9.1 have issues in ARM](https://discuss.elastic.co/t/logstash-7-9-1-have-issues-in-arm/249596)
**Author:** [@goutham968](https://discuss.elastic.co/u/goutham968)\ **Replies:** 10\ **Last updated:** [September 25, 2020, 5:13pm UTC](https://discuss.elastic.co/t/logstash-7-9-1-have-issues-in-arm/249596 "2020-09-25T17:13:14Z")
\[2020-09-23T00:58:12,480\]\[ERROR\]\[logstash.javapipeline \]\[main\]\[167820c884ed4020909a7d2491232c40eac5b47a3f91495a85db21bdf02afeca\] A plugin had an unrecoverable error. Will restart this plugin. Pipeline\_id:main Plugin: \ **Author:** [@novaksam](https://discuss.elastic.co/u/novaksam)\ **Replies:** 0\ **Last updated:** [September 25, 2020, 4:37pm UTC](https://discuss.elastic.co/t/outofmemoryerror-occurred-on-es-host-accessed-via-kibana/250005 "2020-09-25T16:37:10Z") Kinda similar to OutOfMemoryError occurred in coordinating node · Issue #49699 · elastic/elasticsearch · GitHub in that I have a significant amount of my heap being consumed by byte arrays, seemingly being utilized by th… --- ## [Can we see how many users are active on the terminal server through Metricbeat](https://discuss.elastic.co/t/can-we-see-how-many-users-are-active-on-the-terminal-server-through-metricbeat/249453)
**Author:** [@pankaj0172](https://discuss.elastic.co/u/pankaj0172)\ **Replies:** 2\ **Last updated:** [September 25, 2020, 4:10pm UTC](https://discuss.elastic.co/t/can-we-see-how-many-users-are-active-on-the-terminal-server-through-metricbeat/249453 "2020-09-25T16:10:23Z")
Hi, Can someone please let me know what does meant by user in Cpu usage graph? Can we see how many users are active on terminal server through metricbeat or other beats? --- ## [Workplace search using SSL with Elasticsearch invalid key error](https://discuss.elastic.co/t/workplace-search-using-ssl-with-elasticsearch-invalid-key-error/249989)
**Author:** [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Replies:** 4\ **Last updated:** [September 25, 2020, 3:55pm UTC](https://discuss.elastic.co/t/workplace-search-using-ssl-with-elasticsearch-invalid-key-error/249989 "2020-09-25T15:55:42Z")
I am trying to connect Workplace search to a secured elasticsearch cluster The es cluster is secured using TLS at the http & transport level ( i used bin\\elasticsearch-certutil cert --keep-ca-key --pem --in instance.yml… --- ## [How to compare the current event with the previous 2 events in logstash?](https://discuss.elastic.co/t/how-to-compare-the-current-event-with-the-previous-2-events-in-logstash/249864)
**Author:** [@subash](https://discuss.elastic.co/u/subash)\ **Replies:** 3\ **Last updated:** [September 25, 2020, 2:53pm UTC](https://discuss.elastic.co/t/how-to-compare-the-current-event-with-the-previous-2-events-in-logstash/249864 "2020-09-25T14:53:22Z")
I am receiving logs every 5 minutes from many devices. In the log, there is field called crc\_error which holds numeric value For a particular Device, if the value of the crc\_error field increases consecutively for 3 lo… --- ## [Parsing nested JSON fields to separate fields](https://discuss.elastic.co/t/parsing-nested-json-fields-to-separate-fields/249973)
**Author:** [@ottramst](https://discuss.elastic.co/u/ottramst)\ **Replies:** 2\ **Last updated:** [September 25, 2020, 2:51pm UTC](https://discuss.elastic.co/t/parsing-nested-json-fields-to-separate-fields/249973 "2020-09-25T14:51:51Z")
Hello everyone! I need to create a Logstash configuration that allows me to parse nested JSON fields to single fields. Input event looks like this: { "cloud": { "instance": { "id": "XXXX" }, "machine": { … --- ## [Filter logstash - Add simple field](https://discuss.elastic.co/t/filter-logstash-add-simple-field/249490)
**Author:** [@Thomas74](https://discuss.elastic.co/u/Thomas74)\ **Replies:** 3\ **Last updated:** [September 25, 2020, 2:39pm UTC](https://discuss.elastic.co/t/filter-logstash-add-simple-field/249490 "2020-09-25T14:39:04Z")
Hi, I'm trying to assign a value to a field. This one is the same than another variable. Here is my filter : filter{ if !(\[fields\]\[hostgroup\]) { mutate { update =\> { "\[fields\]\[hostgroup\]" … --- ## [Encryption used by Logstash to talk to Elastic Search](https://discuss.elastic.co/t/encryption-used-by-logstash-to-talk-to-elastic-search/249755)
**Author:** [@Pooja](https://discuss.elastic.co/u/Pooja)\ **Replies:** 1\ **Last updated:** [September 25, 2020, 2:20pm UTC](https://discuss.elastic.co/t/encryption-used-by-logstash-to-talk-to-elastic-search/249755 "2020-09-25T14:20:56Z")
How do you ensure data processing between logstash on premise is secured while in transit to Elasticsearch --- ## [SIEM detection rule apply for difference time](https://discuss.elastic.co/t/siem-detection-rule-apply-for-difference-time/249750)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 1\ **Last updated:** [September 25, 2020, 2:15pm UTC](https://discuss.elastic.co/t/siem-detection-rule-apply-for-difference-time/249750 "2020-09-25T14:15:39Z")
Hi all I have a question regarding the SIEM detection, i have some windows log that are from 2019, and now when index them in to our elastic the @timestamp for it is 2019, now i want the detection engine to also search… --- ## [Dynamic variable in Http\_poller url](https://discuss.elastic.co/t/dynamic-variable-in-http-poller-url/249943)
**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\ **Replies:** 2\ **Last updated:** [September 25, 2020, 2:03pm UTC](https://discuss.elastic.co/t/dynamic-variable-in-http-poller-url/249943 "2020-09-25T14:03:13Z")
Hi all, i try to make the endDate in the url , dynamic ( take the date of the system) ? but i got error in logstash . \[2020-09-25T10:24:22,616\]\[INFO \]\[logstash.outputs.elasticsearch\]\[main\] Attempting to install templa… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1219) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1221)