# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1320 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1321 --- ## [From logstash i want forward message to an application that read syslog in from port 514 ... the applictaion read and support Octet counting or LF ... how to setup logstah to send Octect or LF?](https://discuss.elastic.co/t/from-logstash-i-want-forward-message-to-an-application-that-read-syslog-in-from-port-514-the-applictaion-read-and-support-octet-counting-or-lf-how-to-setup-logstah-to-send-octect-or-lf/242063)
**Author:** [@Maurizio\_Tarducci](https://discuss.elastic.co/u/Maurizio_Tarducci)\ **Replies:** 0\ **Last updated:** [July 21, 2020, 3:51pm UTC](https://discuss.elastic.co/t/from-logstash-i-want-forward-message-to-an-application-that-read-syslog-in-from-port-514-the-applictaion-read-and-support-octet-counting-or-lf-how-to-setup-logstah-to-send-octect-or-lf/242063 "2020-07-21T15:51:18Z")
from logstash i want forward message to an application that read syslog in from port 514 ... the applictaion read and support Octet counting or LF ... how to setup logstah to send Octect or LF ? --- ## [Gelf output to Logstash not working](https://discuss.elastic.co/t/gelf-output-to-logstash-not-working/242061)
**Author:** [@pointonj](https://discuss.elastic.co/u/pointonj)\ **Replies:** 0\ **Last updated:** [July 21, 2020, 3:44pm UTC](https://discuss.elastic.co/t/gelf-output-to-logstash-not-working/242061 "2020-07-21T15:44:58Z")
Hi, I'm trying to get the logs from my Graylog server into 3 Logstash Servers that are load balanced. I'm not sure if this is an issue with Graylog or Logstash but as i've posted this on the Graylog community and got no… --- ## [Salesforce and Logstash integration](https://discuss.elastic.co/t/salesforce-and-logstash-integration/242055)
**Author:** [@vtrezza](https://discuss.elastic.co/u/vtrezza)\ **Replies:** 0\ **Last updated:** [July 21, 2020, 3:22pm UTC](https://discuss.elastic.co/t/salesforce-and-logstash-integration/242055 "2020-07-21T15:22:23Z")
Hi, I have to integrate Salesforce and Logstash in order to sync data from Salesforce to Logstash. The only possible way I have found is using the plugin "Salesforce input plugin". This plugin is working on making a S… --- ## [Stop words filter works non-deterministically](https://discuss.elastic.co/t/stop-words-filter-works-non-deterministically/242050)
**Author:** [@Ewelina\_Zarebska](https://discuss.elastic.co/u/Ewelina_Zarebska)\ **Replies:** 0\ **Last updated:** [July 21, 2020, 2:42pm UTC](https://discuss.elastic.co/t/stop-words-filter-works-non-deterministically/242050 "2020-07-21T14:42:30Z")
Hi colleagues, I have following filter and custom analyzer: "custom\_address\_stopwords\_filter": { "type": "stop", "stopwords": \[ "po" , "p.o." , "box" , "n\\a" , "n\\a" , "n/a" , "n/a" , "-" , "-----" , "none" , "TBD" \] }… --- ## [Cannot login to the support portal](https://discuss.elastic.co/t/cannot-login-to-the-support-portal/241717)
**Author:** [@denis1](https://discuss.elastic.co/u/denis1)\ **Replies:** 2\ **Last updated:** [July 21, 2020, 2:25pm UTC](https://discuss.elastic.co/t/cannot-login-to-the-support-portal/241717 "2020-07-21T14:25:28Z")
Hello, does any body know how to login to the support portal, I type my credentials but it said that are not valid. https://support.elastic.co/customers/s/login/ I try with the elastic user and that don't work either. … --- ## [Percentage metric in Kibana](https://discuss.elastic.co/t/percentage-metric-in-kibana/241911)
**Author:** [@paolinux](https://discuss.elastic.co/u/paolinux)\ **Replies:** 2\ **Last updated:** [July 21, 2020, 2:23pm UTC](https://discuss.elastic.co/t/percentage-metric-in-kibana/241911 "2020-07-21T14:23:25Z")
Hi, what is the best way to calculate a percentage metric in Kibana, as a ratio of two other metrics? thanks! Paolo --- ## [How can I allow for fuzziness in a multimatch query for elasticsearch?](https://discuss.elastic.co/t/how-can-i-allow-for-fuzziness-in-a-multimatch-query-for-elasticsearch/242043)
**Author:** [@securisec](https://discuss.elastic.co/u/securisec)\ **Replies:** 0\ **Last updated:** [July 21, 2020, 2:20pm UTC](https://discuss.elastic.co/t/how-can-i-allow-for-fuzziness-in-a-multimatch-query-for-elasticsearch/242043 "2020-07-21T14:20:04Z")
Consider an index containing thousands of flowers and their descriptions in my ES. For example, a redacted json document would look like this: { "name": "rose", "description": "some long description about roses", … --- ## [Update by query performance question](https://discuss.elastic.co/t/update-by-query-performance-question/242042)
**Author:** [@ciocan](https://discuss.elastic.co/u/ciocan)\ **Replies:** 0\ **Last updated:** [July 21, 2020, 2:18pm UTC](https://discuss.elastic.co/t/update-by-query-performance-question/242042 "2020-07-21T14:18:25Z")
Hi, I'm quite new to elastic search. My problem is the following: There are two indexes: index1 - around 18m docs (~40gb of data) index2 - around 22k docs (10mb of data) I need to update all documents from index1 wit… --- ## [Handling IBM MQ messages with MQRFH2 header in logstash](https://discuss.elastic.co/t/handling-ibm-mq-messages-with-mqrfh2-header-in-logstash/242028)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 1\ **Last updated:** [July 21, 2020, 1:33pm UTC](https://discuss.elastic.co/t/handling-ibm-mq-messages-with-mqrfh2-header-in-logstash/242028 "2020-07-21T13:33:31Z")
Hi All, Can you please suggest , how to handle incoming IBM MQ messages MQRFH2 header in logstash, It is working fine when I pick a normal message without MQRFH2 header but whenever client is sending MQRFH2 header, thi… --- ## [Red dot in index data](https://discuss.elastic.co/t/red-dot-in-index-data/241694)
**Author:** [@bhumireddy](https://discuss.elastic.co/u/bhumireddy)\ **Replies:** 1\ **Last updated:** [July 21, 2020, 1:19pm UTC](https://discuss.elastic.co/t/red-dot-in-index-data/241694 "2020-07-21T13:19:10Z")
Unable to search based on a field, when i search the field has "red dot" in the suffix. If if copy and paste it is not showing dot. Search on missing is resulting many records. Not sure what is the error. There are t… --- ## [HTTP Proxy twitter client error for logstash-input-twitter plugin](https://discuss.elastic.co/t/http-proxy-twitter-client-error-for-logstash-input-twitter-plugin/242027)
**Author:** [@shaswatgupta](https://discuss.elastic.co/u/shaswatgupta)\ **Replies:** 0\ **Last updated:** [July 21, 2020, 12:58pm UTC](https://discuss.elastic.co/t/http-proxy-twitter-client-error-for-logstash-input-twitter-plugin/242027 "2020-07-21T12:58:46Z")
Logstash log: \[2020-07-21T12:08:19,838\]\[WARN \]\[logstash.inputs.twitter \] Twitter client error {:message=\>"End of file reached", :exception=\>"EOFError", :backtrace=\>\["org/jruby/RubyIO.java:2889:in \`readpartial'", "/us… --- ## [ES 2 to 7.5 migration](https://discuss.elastic.co/t/es-2-to-7-5-migration/242022)
**Author:** [@lhmzhou](https://discuss.elastic.co/u/lhmzhou)\ **Replies:** 1\ **Last updated:** [July 21, 2020, 12:46pm UTC](https://discuss.elastic.co/t/es-2-to-7-5-migration/242022 "2020-07-21T12:46:09Z")
Hi, I'm currently migrating from ES 2 to 7.5. Below query gives me results in the older version and no results/error in newer version when executed in Postman. {"query":{"constant\_score":{"filter":{"terms":{"templateI… --- ## [Records from all nodes are not searched by the custom plugin](https://discuss.elastic.co/t/records-from-all-nodes-are-not-searched-by-the-custom-plugin/242021)
**Author:** [@radhika](https://discuss.elastic.co/u/radhika)\ **Replies:** 0\ **Last updated:** [July 21, 2020, 11:57am UTC](https://discuss.elastic.co/t/records-from-all-nodes-are-not-searched-by-the-custom-plugin/242021 "2020-07-21T11:57:45Z")
Hi, I have recently migrated a custom scoring plugin from ES 1.7.5 to version 7.5.2. The plugin works fine and gives expected results when running in a single node environment. The issue arrises when there are 2 or more… --- ## [Repository-gcs high amount of requests](https://discuss.elastic.co/t/repository-gcs-high-amount-of-requests/241902)
**Author:** [@chaekew2xie1ohh2aoYe](https://discuss.elastic.co/u/chaekew2xie1ohh2aoYe)\ **Replies:** 5\ **Last updated:** [July 21, 2020, 11:42am UTC](https://discuss.elastic.co/t/repository-gcs-high-amount-of-requests/241902 "2020-07-21T11:42:00Z")
I followed the repository-gcs guide to install a snapshot repository for gcs a month ago. https://www.elastic.co/guide/en/elasticsearch/plugins/7.5/repository-gcs.html POST http://elasticsearch-cluster:9200/\_snapshot/da… --- ## [Bug in standard analyzer?](https://discuss.elastic.co/t/bug-in-standard-analyzer/242010)
**Author:** [@corbosman](https://discuss.elastic.co/u/corbosman)\ **Replies:** 0\ **Last updated:** [July 21, 2020, 10:51am UTC](https://discuss.elastic.co/t/bug-in-standard-analyzer/242010 "2020-07-21T10:51:27Z")
Hi all, we have a field that contains hostnames like "foo.bar.com". I noticed that when I searched for hostnames with only digits, I got too many results. Let's say I search for "1234.example.com", I would also get back… --- ## [Find offending index causing "unknown mapping" in v6.8.6](https://discuss.elastic.co/t/find-offending-index-causing-unknown-mapping-in-v6-8-6/242007)
**Author:** [@atmosx](https://discuss.elastic.co/u/atmosx)\ **Replies:** 0\ **Last updated:** [July 21, 2020, 10:40am UTC](https://discuss.elastic.co/t/find-offending-index-causing-unknown-mapping-in-v6-8-6/242007 "2020-07-21T10:40:55Z")
Hello, We have several ES clusters receiving logs from kubernetes apps (fluentd) and non kubernetes apps (filebeat). All clusters have the same configuration. The "sandbox" cluster contains "unknown" type fields in some… --- ## [Error while starting Logstash in WIndows](https://discuss.elastic.co/t/error-while-starting-logstash-in-windows/242006)
**Author:** [@Mitan\_Kumar\_Batu](https://discuss.elastic.co/u/Mitan_Kumar_Batu)\ **Replies:** 0\ **Last updated:** [July 21, 2020, 10:40am UTC](https://discuss.elastic.co/t/error-while-starting-logstash-in-windows/242006 "2020-07-21T10:40:42Z")
Getting below error while starting Logstash:- \[ERROR\] 2020-07-21 16:04:29.491 \[main\] Logstash - java.lang.IllegalStateException: Logstash stopped processing because of an error: (GemspecError) \[!\] There was an error wh… --- ## [No config files found and no configuration source found](https://discuss.elastic.co/t/no-config-files-found-and-no-configuration-source-found/242003)
**Author:** [@Bigranawab](https://discuss.elastic.co/u/Bigranawab)\ **Replies:** 0\ **Last updated:** [July 21, 2020, 10:27am UTC](https://discuss.elastic.co/t/no-config-files-found-and-no-configuration-source-found/242003 "2020-07-21T10:27:15Z")
\ WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults Could not find log4j2 configuration… --- ## [How to execute Must and Should query that matches an individual Nested field?](https://discuss.elastic.co/t/how-to-execute-must-and-should-query-that-matches-an-individual-nested-field/239648)
**Author:** [@rd8388](https://discuss.elastic.co/u/rd8388)\ **Replies:** 9\ **Last updated:** [July 21, 2020, 10:26am UTC](https://discuss.elastic.co/t/how-to-execute-must-and-should-query-that-matches-an-individual-nested-field/239648 "2020-07-21T10:26:52Z")
A record has two items/values indexed in a nested field type addresses.fulladdress. "11 High Street" and "88 West Avenue" If a user searched for "11 West" this record should not be matched. How should we structure the … --- ## [Aggregator \[load\_time\_outlier\] of type \[percentiles\] cannot accept sub-aggregations](https://discuss.elastic.co/t/aggregator-load-time-outlier-of-type-percentiles-cannot-accept-sub-aggregations/241981)
**Author:** [@shwesinhan](https://discuss.elastic.co/u/shwesinhan)\ **Replies:** 1\ **Last updated:** [July 21, 2020, 10:15am UTC](https://discuss.elastic.co/t/aggregator-load-time-outlier-of-type-percentiles-cannot-accept-sub-aggregations/241981 "2020-07-21T10:15:48Z")
i use percentiles aggregation for the response times low25% mid50% top25% partitions and then want to get min/max values based on each aggregated partitions. i try to write query like GET myindex-2020.06/\_search { "si… --- ## [Elasticsearch 7.7.1 ServiceConfigurationError Cannot instantiate FastCompressingCodec](https://discuss.elastic.co/t/elasticsearch-7-7-1-serviceconfigurationerror-cannot-instantiate-fastcompressingcodec/241971)
**Author:** [@Deb](https://discuss.elastic.co/u/Deb)\ **Replies:** 1\ **Last updated:** [July 21, 2020, 10:12am UTC](https://discuss.elastic.co/t/elasticsearch-7-7-1-serviceconfigurationerror-cannot-instantiate-fastcompressingcodec/241971 "2020-07-21T10:12:25Z")
I am trying to run a test by extending ESSingleNodeTestCase with elasticsearch 7.7.1. But I am getting the below error. I am not seeing any jar hell error and I have made the intellij settings as mentioned here java.uti… --- ## [Service States: No results found](https://discuss.elastic.co/t/service-states-no-results-found/240021)
**Author:** [@Kawther](https://discuss.elastic.co/u/Kawther)\ **Replies:** 6\ **Last updated:** [July 21, 2020, 9:45am UTC](https://discuss.elastic.co/t/service-states-no-results-found/240021 "2020-07-21T09:45:12Z")
Hello, I am working with metricbeat 7.7.0 , I enabled system module to monitor service status module: system period: 10s metricsets: cpu load memory network process process\_summary socket\_summary entropy core diski… --- ## [Logstash encountered retryable error](https://discuss.elastic.co/t/logstash-encountered-retryable-error/241991)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 0\ **Last updated:** [July 21, 2020, 9:02am UTC](https://discuss.elastic.co/t/logstash-encountered-retryable-error/241991 "2020-07-21T09:02:08Z")
hi All, We are ingesting documents using logstash, all of a sudden i'm getting the below error. \[\[main\]\>worker1\] elasticsearch - Encountered a retryable error. Will Retry with exponential backoff {:code=\>400, :url=\>"h… --- ## [ES 7.8.0: query\_string with fields: \["\*"\] vs default\_field: "\*" performance](https://discuss.elastic.co/t/es-7-8-0-query-string-with-fields-vs-default-field-performance/241990)
**Author:** [@jojo23](https://discuss.elastic.co/u/jojo23)\ **Replies:** 0\ **Last updated:** [July 21, 2020, 9:01am UTC](https://discuss.elastic.co/t/es-7-8-0-query-string-with-fields-vs-default-field-performance/241990 "2020-07-21T09:01:04Z")
I'm getting very different performance searching a small (\< 200MB) index with a query\_string filter, depending on how I specify the fields to be searched: fields: \["\*"\] - 1600ms consistently default\_field: "\*" - \< 100m… --- ## [Script field for search msg](https://discuss.elastic.co/t/script-field-for-search-msg/241879)
**Author:** [@Ali4](https://discuss.elastic.co/u/Ali4)\ **Replies:** 2\ **Last updated:** [July 21, 2020, 8:57am UTC](https://discuss.elastic.co/t/script-field-for-search-msg/241879 "2020-07-21T08:57:03Z")
Hello, Please i need your help. I need to create script field to search msg "error" in field message. the field message is: ''' {"@timestamp":"2020-07-20T12:14:43+02:00","@version":"1","message":" time="Jul 20 12:14… --- ## [Should we continue or stop indexing during rolling upgrades of Elastic-Search?](https://discuss.elastic.co/t/should-we-continue-or-stop-indexing-during-rolling-upgrades-of-elastic-search/240779)
**Author:** [@het](https://discuss.elastic.co/u/het)\ **Replies:** 7\ **Last updated:** [July 21, 2020, 8:56am UTC](https://discuss.elastic.co/t/should-we-continue-or-stop-indexing-during-rolling-upgrades-of-elastic-search/240779 "2020-07-21T08:56:56Z")
Hi team, Should we continue or stop indexing during rolling upgrades of Elastic-Search? I read in the upgrade documentation that it is optional steps to stop indexing and do flush sync. My query is if we do not stop in… --- ## [”\_grokparsefailure” even though the grok pattern works](https://discuss.elastic.co/t/grokparsefailure-even-though-the-grok-pattern-works/241647)
**Author:** [@Mathis\_Gourc](https://discuss.elastic.co/u/Mathis_Gourc)\ **Replies:** 4\ **Last updated:** [July 21, 2020, 8:30am UTC](https://discuss.elastic.co/t/grokparsefailure-even-though-the-grok-pattern-works/241647 "2020-07-21T08:30:35Z")
I am trying to parse different logs lines from two different type of file : slave and master. I did test my pattern in the Grok Dubugger and it is working fine but tags field in kibana is \_grokparsefailure. Here is my c… --- ## [Csv filter don't work in realtime](https://discuss.elastic.co/t/csv-filter-dont-work-in-realtime/241979)
**Author:** [@elk2](https://discuss.elastic.co/u/elk2)\ **Replies:** 0\ **Last updated:** [July 21, 2020, 7:43am UTC](https://discuss.elastic.co/t/csv-filter-dont-work-in-realtime/241979 "2020-07-21T07:43:48Z")
I send a csv file with filebeat to logstash but csv filter plugin fails when it tries to parse csv with error "unclosed quoted field on line 1" If I save csv in file with logstash and with another conf I use csv filter … --- ## [How to query logstash for all incoming or outgoing records](https://discuss.elastic.co/t/how-to-query-logstash-for-all-incoming-or-outgoing-records/241977)
**Author:** [@rustyweise](https://discuss.elastic.co/u/rustyweise)\ **Replies:** 0\ **Last updated:** [July 21, 2020, 7:40am UTC](https://discuss.elastic.co/t/how-to-query-logstash-for-all-incoming-or-outgoing-records/241977 "2020-07-21T07:40:37Z")
We are using logstash as a proxy between beats, syslog, fluentbit, etc and logz.io. I would like to inspect ('tee') the input stream, specifically from a vCSA syslog stream, or query logstash for in-memory records, or ('… --- ## [Kibana crash on re-index of own index](https://discuss.elastic.co/t/kibana-crash-on-re-index-of-own-index/236863)
**Author:** [@raulgs](https://discuss.elastic.co/u/raulgs)\ **Replies:** 5\ **Last updated:** [July 21, 2020, 7:27am UTC](https://discuss.elastic.co/t/kibana-crash-on-re-index-of-own-index/236863 "2020-07-21T07:27:07Z")
Hi this morning I found my kibana pods in non-ready state with the following log entry {"type":"log","@timestamp":"2020-06-12T08:32:29Z","tags":\["info","plugins","monitoring","monitoring"\],"pid":7,"message":"config sour… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1319) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1321)