# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1324 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1325 --- ## [TAB in grok filter and delete mismatched records](https://discuss.elastic.co/t/tab-in-grok-filter-and-delete-mismatched-records/241767)
**Author:** [@merlock](https://discuss.elastic.co/u/merlock)\ **Replies:** 2\ **Last updated:** [July 19, 2020, 5:49am UTC](https://discuss.elastic.co/t/tab-in-grok-filter-and-delete-mismatched-records/241767 "2020-07-19T05:49:06Z")
hi all, (sorry for my english) hello everyone I have the following problem, the log I'm trying to read comes with tabs and I can't filter correctly. I have tried several options but I cannot read it correctly 100% this… --- ## [Could not activate monitoring in kibana](https://discuss.elastic.co/t/could-not-activate-monitoring-in-kibana/241755)
**Author:** [@Shubham\_Mittal](https://discuss.elastic.co/u/Shubham_Mittal)\ **Replies:** 1\ **Last updated:** [July 18, 2020, 11:12pm UTC](https://discuss.elastic.co/t/could-not-activate-monitoring-in-kibana/241755 "2020-07-18T23:12:23Z")
I have 3 nodes as both master and data nodes and 1 dedicated data node and 1 dedicated client node in the elasticsearch cluster. I have done the required settings in elasticsearch.yml files of each node. One of those se… --- ## [Logstash Input from Firestore (Firebase) to Elasticsearch](https://discuss.elastic.co/t/logstash-input-from-firestore-firebase-to-elasticsearch/241764)
**Author:** [@estack](https://discuss.elastic.co/u/estack)\ **Replies:** 0\ **Last updated:** [July 18, 2020, 10:18pm UTC](https://discuss.elastic.co/t/logstash-input-from-firestore-firebase-to-elasticsearch/241764 "2020-07-18T22:18:48Z")
Hi Guys, I have tried to implement a logstash config by installing a custom logstash input from the link below: I have made necessary configs, but getting below error: \]\[FATAL\]\[logstash.runner \] An unexpe… --- ## [Managing an arbitrary number of pipelines](https://discuss.elastic.co/t/managing-an-arbitrary-number-of-pipelines/241745)
**Author:** [@Sean.Lim](https://discuss.elastic.co/u/Sean.Lim)\ **Replies:** 1\ **Last updated:** [July 18, 2020, 5:58pm UTC](https://discuss.elastic.co/t/managing-an-arbitrary-number-of-pipelines/241745 "2020-07-18T17:58:29Z")
I am working on a project with these requirements: Each event contains a field identifying the syslog server to send the output to. Transport failure to any server should not block output to other servers. From requir… --- ## [Fetch command in elasticsearch queries, limit query results](https://discuss.elastic.co/t/fetch-command-in-elasticsearch-queries-limit-query-results/241179)
**Author:** [@liron\_gofberg](https://discuss.elastic.co/u/liron_gofberg)\ **Replies:** 22\ **Last updated:** [July 18, 2020, 4:43pm UTC](https://discuss.elastic.co/t/fetch-command-in-elasticsearch-queries-limit-query-results/241179 "2020-07-18T16:43:41Z")
I am using python as elastic client and I want to fetch only 1 document I have noticed that the search speed for fetching one document is exactly the same as fetching a lots of documents. In oracle sql there is a fetc… --- ## [Cluster Redundancy with VMware vSphere HA](https://discuss.elastic.co/t/cluster-redundancy-with-vmware-vsphere-ha/241685)
**Author:** [@ka2](https://discuss.elastic.co/u/ka2)\ **Replies:** 3\ **Last updated:** [July 18, 2020, 2:45pm UTC](https://discuss.elastic.co/t/cluster-redundancy-with-vmware-vsphere-ha/241685 "2020-07-18T14:45:17Z")
I would like to use vSphere HA (or FT) to make my Elasticsearch cluster redundant, but I am wondering why I can't find a similar case study. Does anyone have any information that can help me with this question? The Ela… --- ## [How to put multiple lines in Kibana SQL search?](https://discuss.elastic.co/t/how-to-put-multiple-lines-in-kibana-sql-search/241708)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 2\ **Last updated:** [July 18, 2020, 8:12am UTC](https://discuss.elastic.co/t/how-to-put-multiple-lines-in-kibana-sql-search/241708 "2020-07-18T08:12:28Z")
hi I'm trying to put multiline sql search (as our source-code are long and in multile lines), but even if I put escape characters, error happens. Please find screenshot "type" : "json\_parse\_exception", "reas… --- ## [We are not receiving the log from kafka to logstash](https://discuss.elastic.co/t/we-are-not-receiving-the-log-from-kafka-to-logstash/241472)
**Author:** [@saravananveera](https://discuss.elastic.co/u/saravananveera)\ **Replies:** 3\ **Last updated:** [July 18, 2020, 5:08am UTC](https://discuss.elastic.co/t/we-are-not-receiving-the-log-from-kafka-to-logstash/241472 "2020-07-18T05:08:28Z")
Hi I have received the logs from beat to Kafaka, but i can't able to receive logs from kafka to logstash . Kafka log: \[root@ip kafka\]# bin/kafka-console-consumer.sh --bootstrap-server localhost:9092 --topic sscplblog… --- ## [\[WEIRD\] Only some Pipelines in Pipelines.yml stopped working, without making any changes to the conf](https://discuss.elastic.co/t/weird-only-some-pipelines-in-pipelines-yml-stopped-working-without-making-any-changes-to-the-conf/241719)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [July 18, 2020, 1:35am UTC](https://discuss.elastic.co/t/weird-only-some-pipelines-in-pipelines-yml-stopped-working-without-making-any-changes-to-the-conf/241719 "2020-07-18T01:35:22Z")
Hi, In monday about half of pipelines in my pipelines.yml, stopped working. I didn make any changes to the single pipelines configurations and to pipelines.yml. When I run them separately they work, when I run them vi… --- ## [Memory error when using scan In python to retrieve millions of documents](https://discuss.elastic.co/t/memory-error-when-using-scan-in-python-to-retrieve-millions-of-documents/241615)
**Author:** [@liron\_gofberg](https://discuss.elastic.co/u/liron_gofberg)\ **Replies:** 2\ **Last updated:** [July 17, 2020, 6:42pm UTC](https://discuss.elastic.co/t/memory-error-when-using-scan-in-python-to-retrieve-millions-of-documents/241615 "2020-07-17T18:42:32Z")
I’m using scan in python to retrieve my data It is working when I ask for thousands of documents but when I ask for millions of records I get an error after a while and that error relate to the memory What could be hap… --- ## [uiCapabilities is undefined](https://discuss.elastic.co/t/uicapabilities-is-undefined/241728)
**Author:** [@npm\_install](https://discuss.elastic.co/u/npm_install)\ **Replies:** 1\ **Last updated:** [July 17, 2020, 10:26pm UTC](https://discuss.elastic.co/t/uicapabilities-is-undefined/241728 "2020-07-17T22:26:50Z")
Hi, I am creating a custom plugin for Kibana, and I am running into an issue with the plugin registration feature in this documentation: https://www.elastic.co/guide/en/kibana/current/development-plugin-feature-registra… --- ## [Slowly term queries](https://discuss.elastic.co/t/slowly-term-queries/241591)
**Author:** [@liron\_gofberg](https://discuss.elastic.co/u/liron_gofberg)\ **Replies:** 2\ **Last updated:** [July 17, 2020, 10:14pm UTC](https://discuss.elastic.co/t/slowly-term-queries/241591 "2020-07-17T22:14:50Z")
Hi, I’m using scan function in Python to retrieve more than 10000 results There are only filter queries I search only for terms There is no aggregation, only simple term queries I executed two queries with the same … --- ## [Loading Custom Plugins in Kibana](https://discuss.elastic.co/t/loading-custom-plugins-in-kibana/241706)
**Author:** [@tinhn](https://discuss.elastic.co/u/tinhn)\ **Replies:** 3\ **Last updated:** [July 17, 2020, 10:00pm UTC](https://discuss.elastic.co/t/loading-custom-plugins-in-kibana/241706 "2020-07-17T22:00:15Z")
Hello, I'm new to ELK stack and am working on a Kibana plugin, a form that submits a request to some external api. I successfully got the plugin to set up and to work following the steps in the Kibana docs. The plugin w… --- ## [Slow queries](https://discuss.elastic.co/t/slow-queries/241723)
**Author:** [@liron\_gofberg](https://discuss.elastic.co/u/liron_gofberg)\ **Replies:** 1\ **Last updated:** [July 17, 2020, 9:43pm UTC](https://discuss.elastic.co/t/slow-queries/241723 "2020-07-17T21:43:22Z")
I execute a simple term filter query and I limit my results with size but part of the queries have bad performance(search time in minutes) while other perform well(search time is very fast) with the same limit of result… --- ## [I can't able to change the font size of Visualizations. Can someone help me here?](https://discuss.elastic.co/t/i-cant-able-to-change-the-font-size-of-visualizations-can-someone-help-me-here/241680)
**Author:** [@Prasad\_k](https://discuss.elastic.co/u/Prasad_k)\ **Replies:** 1\ **Last updated:** [July 17, 2020, 9:38pm UTC](https://discuss.elastic.co/t/i-cant-able-to-change-the-font-size-of-visualizations-can-someone-help-me-here/241680 "2020-07-17T21:38:33Z")
I can't able to change the font size of Visualizations. Can someone help me here? Also I want to change the percentage of pie charts to 1 decimal currently it is 3 decimals. --- ## [Kibana discover page URL with time filter](https://discuss.elastic.co/t/kibana-discover-page-url-with-time-filter/241724)
**Author:** [@christine-gong](https://discuss.elastic.co/u/christine-gong)\ **Replies:** 1\ **Last updated:** [July 17, 2020, 8:57pm UTC](https://discuss.elastic.co/t/kibana-discover-page-url-with-time-filter/241724 "2020-07-17T20:57:55Z")
Hi, I want to generate dynamic urls for logs viewing, but I have epoch time in my integrated service. So when i pass something like time:(from:1595007316121,mode:absolute,to:1595007816121) the time picker on the upper r… --- ## [Wildcards in logstash remove\_field](https://discuss.elastic.co/t/wildcards-in-logstash-remove-field/241644)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 11\ **Last updated:** [July 17, 2020, 8:40pm UTC](https://discuss.elastic.co/t/wildcards-in-logstash-remove-field/241644 "2020-07-17T20:40:27Z")
Hi All, I have a data source with almost 692 fields, out of which only 200 fields are valid, i want to remove those fields , i tried using below one, but no luck mutate { remove\_field =\> \[ ".value" \] } all the unwant… --- ## [Multiline is split from main log message - Any help please](https://discuss.elastic.co/t/multiline-is-split-from-main-log-message-any-help-please/241254)
**Author:** [@calanon](https://discuss.elastic.co/u/calanon)\ **Replies:** 4\ **Last updated:** [July 17, 2020, 8:00pm UTC](https://discuss.elastic.co/t/multiline-is-split-from-main-log-message-any-help-please/241254 "2020-07-17T20:00:43Z")
Here is a snippet of the raw log output: \[2020-07-15T08:21:58+02:00\] 172.16.35.104 ERROR Exception: \{"exception":"\[object\] (App\\\\Action\\\\Exception\\\\MethodNotAllowedException(code: 405): There is no action d… --- ## [ECK 7.8.0 on Code Ready Containers](https://discuss.elastic.co/t/eck-7-8-0-on-code-ready-containers/240861)
**Author:** [@aceeric](https://discuss.elastic.co/u/aceeric)\ **Replies:** 2\ **Last updated:** [July 17, 2020, 7:26pm UTC](https://discuss.elastic.co/t/eck-7-8-0-on-code-ready-containers/240861 "2020-07-17T19:26:11Z")
Hello - I'm trying to run ECK on CRC v9: $ crc version: 1.9.0+a68b5e0 OpenShift version: 4.3.10 (embedded in binary) Just following the quick start in https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-openshift-… --- ## [Any way to use DEV tools page to query Kibana API?](https://discuss.elastic.co/t/any-way-to-use-dev-tools-page-to-query-kibana-api/241352)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 3\ **Last updated:** [July 17, 2020, 6:23pm UTC](https://discuss.elastic.co/t/any-way-to-use-dev-tools-page-to-query-kibana-api/241352 "2020-07-17T18:23:30Z")
The dev tools page in Kibana (\/app/kibana#/dev\_tools/console) seems to connect to elasticsearch API only (eg I can query elasticsearch data, searches etc) But the Kibana API's (like siem rules api, saved\_objects, … --- ## [Not seeing cloudwatch streamed logs via functionbeat in elasticsearch](https://discuss.elastic.co/t/not-seeing-cloudwatch-streamed-logs-via-functionbeat-in-elasticsearch/241005)
**Author:** [@randoran](https://discuss.elastic.co/u/randoran)\ **Replies:** 1\ **Last updated:** [July 17, 2020, 6:14pm UTC](https://discuss.elastic.co/t/not-seeing-cloudwatch-streamed-logs-via-functionbeat-in-elasticsearch/241005 "2020-07-17T18:14:53Z")
I am fairly new to Elastic stack and I am trying use functionbeat to stream logs to logstash and then to elasticsearch. I tested my streaming with the following logstash config: input { beats { port =\> … --- ## [Kibana Visualization of Pipeline Aggregation](https://discuss.elastic.co/t/kibana-visualization-of-pipeline-aggregation/241690)
**Author:** [@krenaut](https://discuss.elastic.co/u/krenaut)\ **Replies:** 2\ **Last updated:** [July 17, 2020, 6:13pm UTC](https://discuss.elastic.co/t/kibana-visualization-of-pipeline-aggregation/241690 "2020-07-17T18:13:50Z")
After much pain I was able to create the pipeline aggregation below in the console. But, I can't figure out how I am supposed to get it into a visualization. I just want to create a guage to display the "availabile\_per… --- ## [Boolean similarity module with fuzzy search scoring](https://discuss.elastic.co/t/boolean-similarity-module-with-fuzzy-search-scoring/241705)
**Author:** [@mckennajp](https://discuss.elastic.co/u/mckennajp)\ **Replies:** 0\ **Last updated:** [July 17, 2020, 5:59pm UTC](https://discuss.elastic.co/t/boolean-similarity-module-with-fuzzy-search-scoring/241705 "2020-07-17T17:59:23Z")
I've updated the default similarity module for my index to be boolean. The score should only be based on whether the query terms match or not. Boolean similarity gives terms a score equal to their query boost Howeve… --- ## [Anyone have a Signal rule to detect CVE-2020-1350 yet?](https://discuss.elastic.co/t/anyone-have-a-signal-rule-to-detect-cve-2020-1350-yet/241450)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 2\ **Last updated:** [July 17, 2020, 4:26pm UTC](https://discuss.elastic.co/t/anyone-have-a-signal-rule-to-detect-cve-2020-1350-yet/241450 "2020-07-17T16:26:02Z")
I'm wondering if packetbeat / auditbeat can be used to detect CVE-2020-1350 - some of the queries are documented at https://github.com/maxpl0it/CVE-2020-1350-DoS/blob/master/sigred\_dos.py --- ## [Query\_string & min\_score?](https://discuss.elastic.co/t/query-string-min-score/241693)
**Author:** [@ClubberLang](https://discuss.elastic.co/u/ClubberLang)\ **Replies:** 0\ **Last updated:** [July 17, 2020, 4:18pm UTC](https://discuss.elastic.co/t/query-string-min-score/241693 "2020-07-17T16:18:26Z")
Hi, I have a basic query, and I wish to exclude all the results when the score is \< 0.5. It seems that min\_score does not work with! Noticed that I have a random\_score, if I use min\_score in "functions" it will be app… --- ## [On-prem Deployment Question](https://discuss.elastic.co/t/on-prem-deployment-question/241552)
**Author:** [@jasonwomack](https://discuss.elastic.co/u/jasonwomack)\ **Replies:** 2\ **Last updated:** [July 17, 2020, 4:17pm UTC](https://discuss.elastic.co/t/on-prem-deployment-question/241552 "2020-07-17T16:17:28Z")
Can someone help me understand when it would be necessary or appropriate to include Logstash in a SIEM deployment? The Getting Started information suggests it's not a default component of a SIEM deployment and it may jus… --- ## [Logstash filter basted on log file age](https://discuss.elastic.co/t/logstash-filter-basted-on-log-file-age/241350)
**Author:** [@Bader](https://discuss.elastic.co/u/Bader)\ **Replies:** 6\ **Last updated:** [July 17, 2020, 4:16pm UTC](https://discuss.elastic.co/t/logstash-filter-basted-on-log-file-age/241350 "2020-07-17T16:16:48Z")
Hello. I am running ELK 6.6 on a CentOS 7 box. I have filebeat configured on a Windows machine to forward specific logs to Logstash. The problem I have is that my Logstash filter has a throttling mechanism setup as to … --- ## [Write log into 2 elasticsearch in realtime](https://discuss.elastic.co/t/write-log-into-2-elasticsearch-in-realtime/241111)
**Author:** [@elk2](https://discuss.elastic.co/u/elk2)\ **Replies:** 4\ **Last updated:** [July 17, 2020, 3:44pm UTC](https://discuss.elastic.co/t/write-log-into-2-elasticsearch-in-realtime/241111 "2020-07-17T15:44:53Z")
I would like to write with logstash into elasticsearch pseudonymized data in a way that it can no be linked to a single subject without the use of additional data. Also this additional data should be kept separate … --- ## [Migrating 3 millions of records from RDBMS to Elastic Search using logstash](https://discuss.elastic.co/t/migrating-3-millions-of-records-from-rdbms-to-elastic-search-using-logstash/240427)
**Author:** [@rao7806](https://discuss.elastic.co/u/rao7806)\ **Replies:** 7\ **Last updated:** [July 17, 2020, 3:27pm UTC](https://discuss.elastic.co/t/migrating-3-millions-of-records-from-rdbms-to-elastic-search-using-logstash/240427 "2020-07-17T15:27:33Z")
Hi All, We are trying to migrate around 3 million records from oracle to Elastic Search using Logstash. We are applying a couple of jdbc\_streaming filters as a part of our logstash script, one to load connecting nested… --- ## [Voting exclusion api wrong HTTP method](https://discuss.elastic.co/t/voting-exclusion-api-wrong-http-method/241638)
**Author:** [@tmporary](https://discuss.elastic.co/u/tmporary)\ **Replies:** 1\ **Last updated:** [July 17, 2020, 3:26pm UTC](https://discuss.elastic.co/t/voting-exclusion-api-wrong-http-method/241638 "2020-07-17T15:26:36Z")
Im using this dcumentation as a reference: https://www.elastic.co/guide/en/elasticsearch/reference/current/voting-config-exclusions.html POST https://MY\_DOMAIN/\_cluster/voting\_config\_exclusions?node\_ids=firstId,secondI… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1323) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1325)