# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1264 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1265 --- ## [Grok for IP then geoip and ip2proxy plugin?](https://discuss.elastic.co/t/grok-for-ip-then-geoip-and-ip2proxy-plugin/246362)
**Author:** [@mortimerj](https://discuss.elastic.co/u/mortimerj)\ **Replies:** 3\ **Last updated:** [August 26, 2020, 5:25pm UTC](https://discuss.elastic.co/t/grok-for-ip-then-geoip-and-ip2proxy-plugin/246362 "2020-08-26T17:25:20Z")
Hello! I'm trying to grok just the IP address from the field ClientIP, which can present as \[1.2.3.4:4444\] or 1.2.3.4:4444, then create a new field (clientipfixed), and apply the geoip and ip2proxy plugins to enrich it.… --- ## [Elasticsearch nested sorting is not working](https://discuss.elastic.co/t/elasticsearch-nested-sorting-is-not-working/246491)
**Author:** [@abhishek\_chaturvedi](https://discuss.elastic.co/u/abhishek_chaturvedi)\ **Replies:** 0\ **Last updated:** [August 26, 2020, 5:08pm UTC](https://discuss.elastic.co/t/elasticsearch-nested-sorting-is-not-working/246491 "2020-08-26T17:08:16Z")
I want to sort below query based on responseDate: And every time I am returning some wrong BIG\_INTEGER in sort with each data. I think nested sort is not working properly. Kindly help: { "size": 1000, "query": { … --- ## [Elasticsearch trouble](https://discuss.elastic.co/t/elasticsearch-trouble/246474)
**Author:** [@Anbu\_42\_x](https://discuss.elastic.co/u/Anbu_42_x)\ **Replies:** 2\ **Last updated:** [August 26, 2020, 4:43pm UTC](https://discuss.elastic.co/t/elasticsearch-trouble/246474 "2020-08-26T16:43:36Z")
Добрый день Помогите разобраться в проблемой ELK. Elasticsearch и kibana запущены. Вроде ошибок нет, но kibana дико виснет, когда захожу во вкладку discover в итоге предлагает сбросить сессию. --- ## [Set threshold or condition when to Email in logstash script](https://discuss.elastic.co/t/set-threshold-or-condition-when-to-email-in-logstash-script/246373)
**Author:** [@David03](https://discuss.elastic.co/u/David03)\ **Replies:** 1\ **Last updated:** [August 26, 2020, 4:33pm UTC](https://discuss.elastic.co/t/set-threshold-or-condition-when-to-email-in-logstash-script/246373 "2020-08-26T16:33:38Z")
Is it possible to set a threshold or condition when to email to avoid a continuous firing of email? This is my current script. if \[message\] =~ "Caused by:" { grok{ match =\>\["message", "Caused by:"\] add\_tag =\>\["shoul… --- ## [Parse Generic Nestaed json without splitting](https://discuss.elastic.co/t/parse-generic-nestaed-json-without-splitting/246435)
**Author:** [@Bhargav\_Patel1](https://discuss.elastic.co/u/Bhargav_Patel1)\ **Replies:** 1\ **Last updated:** [August 26, 2020, 4:28pm UTC](https://discuss.elastic.co/t/parse-generic-nestaed-json-without-splitting/246435 "2020-08-26T16:28:22Z")
Hello, I have valid json string which i want to parse as json and want to stored in elastic { "id": "101834545", "date": "06-Apr-2016", "Gender": "Male", "ActiveStatus": "Active", "NameDetails": { "Name": \[{ … --- ## [Convert Different timezones syslog time to datetime format](https://discuss.elastic.co/t/convert-different-timezones-syslog-time-to-datetime-format/246352)
**Author:** [@Pavani\_Reddy](https://discuss.elastic.co/u/Pavani_Reddy)\ **Replies:** 3\ **Last updated:** [August 26, 2020, 4:17pm UTC](https://discuss.elastic.co/t/convert-different-timezones-syslog-time-to-datetime-format/246352 "2020-08-26T16:17:41Z")
I have following timestamp with different timezones in the log messages. Aug 11 03:31:12.942 UTC Aug 11 04:31:12.819 GMT Aug 10 22:31:51.207 CST Aug 10 04:31:38.897 PAC Aug 10 22:31:13.210 CDT Aug 11 03:31:13.048 P… --- ## [Issue on creating index mapping](https://discuss.elastic.co/t/issue-on-creating-index-mapping/246475)
**Author:** [@jakobdoering](https://discuss.elastic.co/u/jakobdoering)\ **Replies:** 2\ **Last updated:** [August 26, 2020, 4:09pm UTC](https://discuss.elastic.co/t/issue-on-creating-index-mapping/246475 "2020-08-26T16:09:21Z")
Hi, i would like to create the following structure with my index template: egress.bytes egress.test egress.test.delta egress.test.performance egress.test.state egress.test.state.performance.low … --- ## [Elastic Memory:Storage Ratio / Hot-warm](https://discuss.elastic.co/t/elastic-memory-storage-ratio-hot-warm/246389)
**Author:** [@skysbsb](https://discuss.elastic.co/u/skysbsb)\ **Replies:** 2\ **Last updated:** [August 26, 2020, 3:48pm UTC](https://discuss.elastic.co/t/elastic-memory-storage-ratio-hot-warm/246389 "2020-08-26T15:48:55Z")
I am setting up a cluster with the Elasticsearch BASIC version and one question I have is related to the memory: storage ratio. I saw in a webinar (https://www.elastic.co/pdf/elasticsearch-sizing-and-capacity-planning… --- ## [Elasticsearch with warm nodes setup, kibana not yet ready](https://discuss.elastic.co/t/elasticsearch-with-warm-nodes-setup-kibana-not-yet-ready/246324)
**Author:** [@souji](https://discuss.elastic.co/u/souji)\ **Replies:** 2\ **Last updated:** [August 26, 2020, 3:37pm UTC](https://discuss.elastic.co/t/elasticsearch-with-warm-nodes-setup-kibana-not-yet-ready/246324 "2020-08-26T15:37:11Z")
Hi I setup the 7.8 version elastic search with 3 master, 3 client, 3 warm, 3 data nodes in amazon ec2 machines. warm nodes: bootstrap.memory\_lock: true node.name: ${HOSTNAME} action.destructive\_requires\_name: true ind… --- ## [Display Metric Visualization in Abbrievated Number Format based on condition](https://discuss.elastic.co/t/display-metric-visualization-in-abbrievated-number-format-based-on-condition/246248)
**Author:** [@antony\_kavin](https://discuss.elastic.co/u/antony_kavin)\ **Replies:** 3\ **Last updated:** [August 26, 2020, 2:48pm UTC](https://discuss.elastic.co/t/display-metric-visualization-in-abbrievated-number-format-based-on-condition/246248 "2020-08-26T14:48:30Z")
Hi team, I have a question related to number formatting in kibana. I have created a metric visualization(sum) in Kibana using a number field(Sales). I want to display the metric in abbreviated number format(m or k). I… --- ## [Logstash parsing input filter beat csv file](https://discuss.elastic.co/t/logstash-parsing-input-filter-beat-csv-file/246314)
**Author:** [@Carlos\_Xavier](https://discuss.elastic.co/u/Carlos_Xavier)\ **Replies:** 0\ **Last updated:** [August 25, 2020, 3:25pm UTC](https://discuss.elastic.co/t/logstash-parsing-input-filter-beat-csv-file/246314 "2020-08-25T15:25:50Z")
Hi everoene, I getting an issue between filebeat and logstash that I can not uderstand what is gonig on, I need some help with that. Let me tell you what is going on... The filebeat setting is the following.... // f… --- ## [Dynamic Title for Kibana visualization](https://discuss.elastic.co/t/dynamic-title-for-kibana-visualization/246241)
**Author:** [@subash](https://discuss.elastic.co/u/subash)\ **Replies:** 3\ **Last updated:** [August 26, 2020, 2:42pm UTC](https://discuss.elastic.co/t/dynamic-title-for-kibana-visualization/246241 "2020-08-26T14:42:40Z")
Hi, I have created a visualization for CPU load, Disk load, memory load for the devices in our network. User can filter any particular device and check its load. The requirement is to add the Device name as the title … --- ## [Want to match against single grok pattern and multiple patterns in same filter](https://discuss.elastic.co/t/want-to-match-against-single-grok-pattern-and-multiple-patterns-in-same-filter/246470)
**Author:** [@saurabhc](https://discuss.elastic.co/u/saurabhc)\ **Replies:** 0\ **Last updated:** [August 26, 2020, 2:35pm UTC](https://discuss.elastic.co/t/want-to-match-against-single-grok-pattern-and-multiple-patterns-in-same-filter/246470 "2020-08-26T14:35:13Z")
I want to have below kinds of match patterns in my logstash configuration file to match different lines. (a) match =\> { "message" =\> "\\\[%{TIMESTAMP\_ISO8601:bip\_timestamp}\\\] \\\[%{WORD:app\_server}\] \\\[%{WORD:log\_level}\] \\\[… --- ## [Is it possible combine two index together in Kibana](https://discuss.elastic.co/t/is-it-possible-combine-two-index-together-in-kibana/246345)
**Author:** [@AKumar123](https://discuss.elastic.co/u/AKumar123)\ **Replies:** 12\ **Last updated:** [August 26, 2020, 2:27pm UTC](https://discuss.elastic.co/t/is-it-possible-combine-two-index-together-in-kibana/246345 "2020-08-26T14:27:44Z")
I have two index data which i am using in kibana.For that I created Visulazation as well and able to see Data in dashboard. But challange is when i am filtering data for Index1 after clicking on +Button other index data… --- ## [ECK managed cluster and elasticsearch-node](https://discuss.elastic.co/t/eck-managed-cluster-and-elasticsearch-node/246457)
**Author:** [@apostolos](https://discuss.elastic.co/u/apostolos)\ **Replies:** 1\ **Last updated:** [August 26, 2020, 2:15pm UTC](https://discuss.elastic.co/t/eck-managed-cluster-and-elasticsearch-node/246457 "2020-08-26T14:15:29Z")
Hi everyone! Is there a way to use elasticsearch-node tool in ECK managed pods? To be more exact, kubectl get elasticsearch returns 'unknown' state due to a loss of all masters at the same time, and although master pod… --- ## [Scale type option in TSVB visualization](https://discuss.elastic.co/t/scale-type-option-in-tsvb-visualization/246460)
**Author:** [@Rizin\_Hussain](https://discuss.elastic.co/u/Rizin_Hussain)\ **Replies:** 1\ **Last updated:** [August 26, 2020, 2:13pm UTC](https://discuss.elastic.co/t/scale-type-option-in-tsvb-visualization/246460 "2020-08-26T14:13:52Z")
Created a moving average visualization using TSVB, Since Y-Axis is generated large number scale value small digit number is marked on top of the '0' line. So difficult understand the analysis. In this screenshot, both … --- ## [Use part of the log files name for the index?](https://discuss.elastic.co/t/use-part-of-the-log-files-name-for-the-index/246366)
**Author:** [@hcker2000](https://discuss.elastic.co/u/hcker2000)\ **Replies:** 2\ **Last updated:** [August 26, 2020, 2:04pm UTC](https://discuss.elastic.co/t/use-part-of-the-log-files-name-for-the-index/246366 "2020-08-26T14:04:14Z")
I have my files all in the same directory names like such: /var/log/apache2/testsite1.com\_error.log /var/log/apache2/testsite1.com\_access.log /var/log/apache2/subdomain.testsite1.com\_error.log /var/log/apache2/subdomain… --- ## [Scaling with many custom log patterns](https://discuss.elastic.co/t/scaling-with-many-custom-log-patterns/246450)
**Author:** [@pcosic](https://discuss.elastic.co/u/pcosic)\ **Replies:** 0\ **Last updated:** [August 26, 2020, 12:34pm UTC](https://discuss.elastic.co/t/scaling-with-many-custom-log-patterns/246450 "2020-08-26T12:34:26Z")
Hi Community, I'm wondering how would we write a filter with logs from a firewall like cisco asa with thousands of custom logs? Currently in the filebeat module for cisco there are supported 150 cisco asa log id's. If… --- ## [Does \_delete\_by\_query need a plugin or not? ES version 5.5](https://discuss.elastic.co/t/does-delete-by-query-need-a-plugin-or-not-es-version-5-5/246343)
**Author:** [@makons](https://discuss.elastic.co/u/makons)\ **Replies:** 2\ **Last updated:** [August 26, 2020, 12:22pm UTC](https://discuss.elastic.co/t/does-delete-by-query-need-a-plugin-or-not-es-version-5-5/246343 "2020-08-26T12:22:17Z")
So I've seen this post from way before in 2015 saying that delete by query is supported through a plugin delete-by-query. This was for the Elasticsearch version 2.0.0. However, there's a newer post which says that now th… --- ## [Accessing Query Object within my code](https://discuss.elastic.co/t/accessing-query-object-within-my-code/246296)
**Author:** [@Paul\_Gege](https://discuss.elastic.co/u/Paul_Gege)\ **Replies:** 3\ **Last updated:** [August 26, 2020, 11:42am UTC](https://discuss.elastic.co/t/accessing-query-object-within-my-code/246296 "2020-08-26T11:42:56Z")
Hi all, I'm just wondering if there's a way for me to grab the current query that's been run on a dashboard or visualization, and use it within a plugin that i'm developing. Thanks, Paul --- ## [Custom Logstash input plugin](https://discuss.elastic.co/t/custom-logstash-input-plugin/246437)
**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\ **Replies:** 0\ **Last updated:** [August 26, 2020, 11:11am UTC](https://discuss.elastic.co/t/custom-logstash-input-plugin/246437 "2020-08-26T11:11:56Z")
Hi all, Since the http\_poller has no support for paginated requests, I want to create a custom input plugin for logstash to solve this problem. is there a clear example to follow! --- ## [Detection engine permission issues after upgrade to 7.9](https://discuss.elastic.co/t/detection-engine-permission-issues-after-upgrade-to-7-9/246407)
**Author:** [@j91321](https://discuss.elastic.co/u/j91321)\ **Replies:** 2\ **Last updated:** [August 26, 2020, 10:41am UTC](https://discuss.elastic.co/t/detection-engine-permission-issues-after-upgrade-to-7-9/246407 "2020-08-26T10:41:57Z")
Hi, Yesterday we have upgraded our cluster to 7.9 and users are reporting problems with the Detection tab in SIEM app. When opened they get "Let's set up your detection engine" message. The role assigned to the users h… --- ## [Logging of mapper\_parsing\_exception](https://discuss.elastic.co/t/logging-of-mapper-parsing-exception/246433)
**Author:** [@huberttrz](https://discuss.elastic.co/u/huberttrz)\ **Replies:** 0\ **Last updated:** [August 26, 2020, 10:30am UTC](https://discuss.elastic.co/t/logging-of-mapper-parsing-exception/246433 "2020-08-26T10:30:53Z")
Hello, I've been googling for it with no luck to find out whether it is possible to have elasticsearch log any "mapper\_parsing\_exception" somewehre to a file / stdout wherever. I'm not using logstash, just elasticsearch… --- ## [Kibana doesn't show .keyword field under fields dropdown](https://discuss.elastic.co/t/kibana-doesnt-show-keyword-field-under-fields-dropdown/75104)
**Author:** [@Piyush\_Diwan](https://discuss.elastic.co/u/Piyush_Diwan)\ **Replies:** 3\ **Last updated:** [August 26, 2020, 10:24am UTC](https://discuss.elastic.co/t/kibana-doesnt-show-keyword-field-under-fields-dropdown/75104 "2020-08-26T10:24:33Z")
I have an ES index generated by logstash that has the keyword field for all the properties, visible using ES API in kibana but on visualize page when I try to apply aggregation on Term, Field drop-down doesn't show any .… --- ## [How to remove a field from document?](https://discuss.elastic.co/t/how-to-remove-a-field-from-document/246420)
**Author:** [@jake\_hickory](https://discuss.elastic.co/u/jake_hickory)\ **Replies:** 5\ **Last updated:** [August 26, 2020, 9:57am UTC](https://discuss.elastic.co/t/how-to-remove-a-field-from-document/246420 "2020-08-26T09:57:26Z")
Hello, I am new to the forum so hi. I have the old \_type field from previous elasticsearch versions in all my documents and want it removed from my documents. How can I do this? Document: "\_index": "new-index", "\_type… --- ## [When searchable snapshot release?](https://discuss.elastic.co/t/when-searchable-snapshot-release/246209)
**Author:** [@ginger](https://discuss.elastic.co/u/ginger)\ **Replies:** 4\ **Last updated:** [August 26, 2020, 9:22am UTC](https://discuss.elastic.co/t/when-searchable-snapshot-release/246209 "2020-08-26T09:22:50Z")
We have seen search snapshot feature. We are looking forward to know when this feature release? --- ## [How can we aggregate SUM on column of type text in Elastic Search?](https://discuss.elastic.co/t/how-can-we-aggregate-sum-on-column-of-type-text-in-elastic-search/246422)
**Author:** [@anupambharti](https://discuss.elastic.co/u/anupambharti)\ **Replies:** 0\ **Last updated:** [August 26, 2020, 9:17am UTC](https://discuss.elastic.co/t/how-can-we-aggregate-sum-on-column-of-type-text-in-elastic-search/246422 "2020-08-26T09:17:55Z")
I have been trying to apply aggregate function for eg : sum on type of text my index mappings are below : \`\`\` { "my\_elastic\_search\_index" : { "mappings" : { "properties" : { "@timest… --- ## [Multiple user setup with elasticsearch docker-compose](https://discuss.elastic.co/t/multiple-user-setup-with-elasticsearch-docker-compose/246419)
**Author:** [@gkman](https://discuss.elastic.co/u/gkman)\ **Replies:** 0\ **Last updated:** [August 26, 2020, 9:10am UTC](https://discuss.elastic.co/t/multiple-user-setup-with-elasticsearch-docker-compose/246419 "2020-08-26T09:10:49Z")
Hi, I am deploying ELK stack using docker compose. I will be using x-pack security features (users + tls) I have found a few examples of how to set a single user in elk (How to set passwords for built-in users with doc… --- ## [Kibana stuck in login loop](https://discuss.elastic.co/t/kibana-stuck-in-login-loop/246101)
**Author:** [@ayushr](https://discuss.elastic.co/u/ayushr)\ **Replies:** 17\ **Last updated:** [August 26, 2020, 9:00am UTC](https://discuss.elastic.co/t/kibana-stuck-in-login-loop/246101 "2020-08-26T09:00:35Z")
Hi I am using Kibana version 7.5.2 which is linked to my elasticsearch instance. I have created a dashboard of visualizations on Kibana and have embedded the dashboard in a web page that I make available to the users of… --- ## [Unsynchronized time in Elasticsearch](https://discuss.elastic.co/t/unsynchronized-time-in-elasticsearch/246083)
**Author:** [@bornatalebi](https://discuss.elastic.co/u/bornatalebi)\ **Replies:** 2\ **Last updated:** [August 26, 2020, 8:28am UTC](https://discuss.elastic.co/t/unsynchronized-time-in-elasticsearch/246083 "2020-08-26T08:28:20Z")
Hi Today when I created a rule in SIEM the "last run" field showed "in 3 hours". after some digging, I found that the clock in the ELK machine(single node cluster, centos 7) was behind. I correct it using ntp and now wh… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1263) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1265)