# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1331 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1332 --- ## [Date parsing error in Elasticsearch 7.1](https://discuss.elastic.co/t/date-parsing-error-in-elasticsearch-7-1/240607)
**Author:** [@sharadha\_s](https://discuss.elastic.co/u/sharadha_s)\ **Replies:** 10\ **Last updated:** [July 15, 2020, 1:02am UTC](https://discuss.elastic.co/t/date-parsing-error-in-elasticsearch-7-1/240607 "2020-07-15T01:02:12Z")
We are using the AWS Elasticsearch 7.1 and we see some date formats are not being supported. It used to work in 5.5 and its a issue with only 7.1. Mapping : "dynamic": "strict", "dynamic\_templates… --- ## [Logstash Cache](https://discuss.elastic.co/t/logstash-cache/241202)
**Author:** [@csgeek](https://discuss.elastic.co/u/csgeek)\ **Replies:** 4\ **Last updated:** [July 14, 2020, 10:34pm UTC](https://discuss.elastic.co/t/logstash-cache/241202 "2020-07-14T22:34:58Z")
I'm working on an event filter written in ruby that needs to do a lookup. I have the data stored in a JSON file that i'm loading locally and I'd like to know if there is any concept of a shared cache that I can leverage… --- ## [JVM Heap Size settings defined are not the same as I can see now](https://discuss.elastic.co/t/jvm-heap-size-settings-defined-are-not-the-same-as-i-can-see-now/241160)
**Author:** [@jelocabral](https://discuss.elastic.co/u/jelocabral)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 3:52pm UTC](https://discuss.elastic.co/t/jvm-heap-size-settings-defined-are-not-the-same-as-i-can-see-now/241160 "2020-07-14T15:52:37Z")
Dear people, I have an ELK 7.8.0 server with 60GB RAM. It is a Debian 10 server and the ELK packages were installed by apt (DEB packages). I've setup the JVM heap size in: /etc/elasticsearch/jvm.options: -Xms30g -Xmx… --- ## [Rename Pipeline.yml](https://discuss.elastic.co/t/rename-pipeline-yml/241192)
**Author:** [@Thiago\_Paiva](https://discuss.elastic.co/u/Thiago_Paiva)\ **Replies:** 2\ **Last updated:** [July 14, 2020, 9:36pm UTC](https://discuss.elastic.co/t/rename-pipeline-yml/241192 "2020-07-14T21:36:07Z")
Hello folks, I currently need to upload my pipeline.yml to git, But my logstash exists in 5 (Five) servers. And Three(3) servers use the same pipeline.yml and Two use other pipeline.yml. So I want to rename one like Pip… --- ## [Mulitple terms highlight in the Kibana Logs App](https://discuss.elastic.co/t/mulitple-terms-highlight-in-the-kibana-logs-app/240803)
**Author:** [@curiousmind](https://discuss.elastic.co/u/curiousmind)\ **Replies:** 1\ **Last updated:** [July 14, 2020, 9:26pm UTC](https://discuss.elastic.co/t/mulitple-terms-highlight-in-the-kibana-logs-app/240803 "2020-07-14T21:26:01Z")
I was trying to use the "highlight" feature in the Kibana Logs app. I am not able to highlight multiple terms using this feature, when I enter like this I was expecting both the "app-01", and "logging" would get hig… --- ## [Cisco syslogs showing up as grokparsefailure when sent to Logstash](https://discuss.elastic.co/t/cisco-syslogs-showing-up-as-grokparsefailure-when-sent-to-logstash/240587)
**Author:** [@jabberwalker](https://discuss.elastic.co/u/jabberwalker)\ **Replies:** 4\ **Last updated:** [July 14, 2020, 8:39pm UTC](https://discuss.elastic.co/t/cisco-syslogs-showing-up-as-grokparsefailure-when-sent-to-logstash/240587 "2020-07-14T20:39:31Z")
I am working through a Udemy course to familiarize myself with Elasticsearch but I've ran into a wall when applying it to our current environment when it comes to Logstash. I am trying to send data from Cisco syslog but… --- ## [Running logstash using systemd with specific settings](https://discuss.elastic.co/t/running-logstash-using-systemd-with-specific-settings/241184)
**Author:** [@kaplan.dani](https://discuss.elastic.co/u/kaplan.dani)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 7:29pm UTC](https://discuss.elastic.co/t/running-logstash-using-systemd-with-specific-settings/241184 "2020-07-14T19:29:14Z")
I run logstash with this command line and it works correctly: bin/logstash -f my\_pipeline.conf --config.reload.automatic --path.settings /etc/logstash when I run it using systemctl (on debian) it will not work, I guess… --- ## [Custom Label field not available for MaxBucket aggregation](https://discuss.elastic.co/t/custom-label-field-not-available-for-maxbucket-aggregation/235045)
**Author:** [@vijay3](https://discuss.elastic.co/u/vijay3)\ **Replies:** 5\ **Last updated:** [July 14, 2020, 7:20pm UTC](https://discuss.elastic.co/t/custom-label-field-not-available-for-maxbucket-aggregation/235045 "2020-07-14T19:20:42Z")
Whenever i am using "Max Bucket" sibling aggregation in "Metrics" section, i am not able to get custom field. The title is always something like " Overall Max of Count". Using Kibana 7.7 . Please guide me how to get cus… --- ## [Searching multiple values in multiple fields](https://discuss.elastic.co/t/searching-multiple-values-in-multiple-fields/241177)
**Author:** [@brsntus](https://discuss.elastic.co/u/brsntus)\ **Replies:** 2\ **Last updated:** [July 14, 2020, 7:15pm UTC](https://discuss.elastic.co/t/searching-multiple-values-in-multiple-fields/241177 "2020-07-14T19:15:30Z")
Hi folks. I have an index with documents that have a product\_id (long) and product\_subtype (text). I'm trying to search for documents using multiple product\_ids and product\_subtypes. The data that I have is this: \[ … --- ## [Where are the configurations for "scripted fields/dashboards/visualisations" stored?](https://discuss.elastic.co/t/where-are-the-configurations-for-scripted-fields-dashboards-visualisations-stored/240712)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 3\ **Last updated:** [July 14, 2020, 7:13pm UTC](https://discuss.elastic.co/t/where-are-the-configurations-for-scripted-fields-dashboards-visualisations-stored/240712 "2020-07-14T19:13:29Z")
We wanted to centralise the configuration into version control and wanted to move away from updating Kibana directly in PROD environment. As part of it, we needed to have configurations (like scripted fields/dashboards/v… --- ## [Sorting TSVB by column in a dashboard](https://discuss.elastic.co/t/sorting-tsvb-by-column-in-a-dashboard/240802)
**Author:** [@haythem](https://discuss.elastic.co/u/haythem)\ **Replies:** 1\ **Last updated:** [July 14, 2020, 7:08pm UTC](https://discuss.elastic.co/t/sorting-tsvb-by-column-in-a-dashboard/240802 "2020-07-14T19:08:26Z")
Hi guys lately i've been working on a tsvb table but i'm facing a problem , when i try sorting a by column in a dashboard it says No data to display for the selected metrics and when i try to show 100 lines in a ts… --- ## [Your socket connection to the server was not read from or written to within the timeout period](https://discuss.elastic.co/t/your-socket-connection-to-the-server-was-not-read-from-or-written-to-within-the-timeout-period/237638)
**Author:** [@Annette1](https://discuss.elastic.co/u/Annette1)\ **Replies:** 12\ **Last updated:** [July 14, 2020, 6:58pm UTC](https://discuss.elastic.co/t/your-socket-connection-to-the-server-was-not-read-from-or-written-to-within-the-timeout-period/237638 "2020-07-14T18:58:08Z")
when using logstash to s3 output. have tried many strategies of file\_size, file\_time, an rotation strategy to fix with no joy. --- ## [Geospatial query with aggregations does not return any results ES7.6](https://discuss.elastic.co/t/geospatial-query-with-aggregations-does-not-return-any-results-es7-6/240762)
**Author:** [@vmanohar1](https://discuss.elastic.co/u/vmanohar1)\ **Replies:** 4\ **Last updated:** [July 14, 2020, 6:27pm UTC](https://discuss.elastic.co/t/geospatial-query-with-aggregations-does-not-return-any-results-es7-6/240762 "2020-07-14T18:27:49Z")
1) MY template for indices of type myindex-YYYY-MM-DD is - PUT \_template/myindex\_template { "index\_patterns" : \["myindex-\*"\], "aliases" : { "myindex\_alias" : {} }, "settings": { "number\_of\_repl… --- ## [Grok working online but not in Kibana debugger or Logstash](https://discuss.elastic.co/t/grok-working-online-but-not-in-kibana-debugger-or-logstash/241176)
**Author:** [@HassaanSalik](https://discuss.elastic.co/u/HassaanSalik)\ **Replies:** 1\ **Last updated:** [July 14, 2020, 6:07pm UTC](https://discuss.elastic.co/t/grok-working-online-but-not-in-kibana-debugger-or-logstash/241176 "2020-07-14T18:07:48Z")
Hi, I am trying to parse gc-log file through grok as shown in this tutorial. The following grok is working fine in both Grok Constructor and Grok Debugger. %{TIMESTAMP\_ISO8601:timestamp}: %{NUMBER:jvm\_time}: \\\[%{DATA:… --- ## [Custom column names for Discover tab columns](https://discuss.elastic.co/t/custom-column-names-for-discover-tab-columns/241175)
**Author:** [@nielarshi](https://discuss.elastic.co/u/nielarshi)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 5:37pm UTC](https://discuss.elastic.co/t/custom-column-names-for-discover-tab-columns/241175 "2020-07-14T17:37:24Z")
I am adding Discover tab in a dashboard. However, by default it takes field name as header. Can that be modified to have a custom name to make it more readable? I am following Scripted field approach but I have concerns… --- ## [Can't connect filebeat to logstash on the separate instances](https://discuss.elastic.co/t/cant-connect-filebeat-to-logstash-on-the-separate-instances/241132)
**Author:** [@Denis\_Denis](https://discuss.elastic.co/u/Denis_Denis)\ **Replies:** 2\ **Last updated:** [July 14, 2020, 5:28pm UTC](https://discuss.elastic.co/t/cant-connect-filebeat-to-logstash-on-the-separate-instances/241132 "2020-07-14T17:28:31Z")
Hello, I'm new with Elastic Stack and currently trying to build logging system with infrastructure type filebeat -\> logstash -\> elastic search -\> kibana. I'm using the separate AWS EC2 instance for logstash, elastic sea… --- ## [Installation of plugins using initContainers stuck](https://discuss.elastic.co/t/installation-of-plugins-using-initcontainers-stuck/240811)
**Author:** [@bartversluijs](https://discuss.elastic.co/u/bartversluijs)\ **Replies:** 3\ **Last updated:** [July 14, 2020, 4:46pm UTC](https://discuss.elastic.co/t/installation-of-plugins-using-initcontainers-stuck/240811 "2020-07-14T16:46:21Z")
Hi, I was trying to install the repository-s3 plugin on my Kubernetes cluster using initContainers. However, the pod seems to get stuck when trying to install the plugin. So I removed the initContainer and went inside t… --- ## [Logstash Worker Threads Blocked by Pipeline](https://discuss.elastic.co/t/logstash-worker-threads-blocked-by-pipeline/241165)
**Author:** [@mattb1](https://discuss.elastic.co/u/mattb1)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 4:44pm UTC](https://discuss.elastic.co/t/logstash-worker-threads-blocked-by-pipeline/241165 "2020-07-14T16:44:56Z")
Hi, Im using the 7.4.2 Version of the elastic Stack. One of my Logstash Pipelines Keeps blocking the Worker Threads after a While. Essentialy grinding all of the ingestion to a halt. As no other Pipelines can be execu… --- ## [Seperate dynamic comma seperated field into multiple fields](https://discuss.elastic.co/t/seperate-dynamic-comma-seperated-field-into-multiple-fields/241103)
**Author:** [@sz5ps5](https://discuss.elastic.co/u/sz5ps5)\ **Replies:** 1\ **Last updated:** [July 14, 2020, 4:30pm UTC](https://discuss.elastic.co/t/seperate-dynamic-comma-seperated-field-into-multiple-fields/241103 "2020-07-14T16:30:18Z")
Apologies I am new to ELK and Logstash so this may be a simple solution. I have a field that is currently in the elk stack, it is passing through Logstash. The field is dynamic in that is can have any number of values. … --- ## [Adding additional fields for Logstash Kinesis Input](https://discuss.elastic.co/t/adding-additional-fields-for-logstash-kinesis-input/240542)
**Author:** [@beyondcompare](https://discuss.elastic.co/u/beyondcompare)\ **Replies:** 5\ **Last updated:** [July 14, 2020, 4:19pm UTC](https://discuss.elastic.co/t/adding-additional-fields-for-logstash-kinesis-input/240542 "2020-07-14T16:19:04Z")
Hi everyone, I'd like to ask for some help from you please about adding additional fields to Logstash Kinesis Input. I have three logstash servers consuming a Kinesis Stream using Kinesis Input Plugin. Example like th… --- ## [Search for a negative value](https://discuss.elastic.co/t/search-for-a-negative-value/241159)
**Author:** [@Katia](https://discuss.elastic.co/u/Katia)\ **Replies:** 1\ **Last updated:** [July 14, 2020, 4:18pm UTC](https://discuss.elastic.co/t/search-for-a-negative-value/241159 "2020-07-14T16:18:39Z")
I have indexed fields containing character codes such as 3 1 1 and 3 1 -1. But when I search 3 1 -1 it seems that the "-" is not supported! could you please help me? GET /\_search { "query": { "match\_phra… --- ## [Splitting nested /hierarchal documents in Logstash](https://discuss.elastic.co/t/splitting-nested-hierarchal-documents-in-logstash/241156)
**Author:** [@Ahmed\_Adly](https://discuss.elastic.co/u/Ahmed_Adly)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 3:33pm UTC](https://discuss.elastic.co/t/splitting-nested-hierarchal-documents-in-logstash/241156 "2020-07-14T15:33:58Z")
Hello, I'm using Logstash to read external REST API and feed elastic search. the API data looks like this: { ArrayOfParent: \[ Parent: { ArrayOfChildTypeOne: \[ {ID: 1, Name: child1} \], ArrayOfChil… --- ## [Logstash unable to parse with kv filter](https://discuss.elastic.co/t/logstash-unable-to-parse-with-kv-filter/240820)
**Author:** [@msk\_76](https://discuss.elastic.co/u/msk_76)\ **Replies:** 17\ **Last updated:** [July 14, 2020, 3:13pm UTC](https://discuss.elastic.co/t/logstash-unable-to-parse-with-kv-filter/240820 "2020-07-14T15:13:30Z")
My logstash configuration is working fine for most of the log cases but below exceptions are not working. My log has following format The json part consist of usual format "" "" both have space separator. In normal… --- ## [How to install Elasticsearch windows service on server with different versions of Java?](https://discuss.elastic.co/t/how-to-install-elasticsearch-windows-service-on-server-with-different-versions-of-java/240854)
**Author:** [@Gosforth](https://discuss.elastic.co/u/Gosforth)\ **Replies:** 1\ **Last updated:** [July 14, 2020, 3:05pm UTC](https://discuss.elastic.co/t/how-to-install-elasticsearch-windows-service-on-server-with-different-versions-of-java/240854 "2020-07-14T15:05:25Z")
I have at least two versions of Java on server so JAVA\_HOME points to version 8 not 11. To start manually start ES I just modified elasticsearch-env.bat: if "%JAVA\_HOME%" == "" ( set JAVA="%ES\_HOME%\\jdk\\bin\\java.exe"… --- ## [Filebeat Fortinet Default Ingest Pipeline fails](https://discuss.elastic.co/t/filebeat-fortinet-default-ingest-pipeline-fails/238893)
**Author:** [@Mercwri](https://discuss.elastic.co/u/Mercwri)\ **Replies:** 5\ **Last updated:** [July 14, 2020, 2:28pm UTC](https://discuss.elastic.co/t/filebeat-fortinet-default-ingest-pipeline-fails/238893 "2020-07-14T14:28:45Z")
I have multiple Fortinet devices pushing logs to a collector running Filebeat 7.8.0 with the Fortinet module enabled. All of the logs are being ingested but the pipeline fails at decoding/normalizing the timestamps. I g… --- ## [Wrong result in Bool Query](https://discuss.elastic.co/t/wrong-result-in-bool-query/241136)
**Author:** [@buka\_bidzina](https://discuss.elastic.co/u/buka_bidzina)\ **Replies:** 11\ **Last updated:** [July 14, 2020, 2:19pm UTC](https://discuss.elastic.co/t/wrong-result-in-bool-query/241136 "2020-07-14T14:19:02Z")
Mapping PUT index PUT /index/\_mapping { "properties": { "categories": { "type": "nested", "properties": { "id": { "type": "integer" } } }, "deleted": { "… --- ## [Make the elasticsearch-input return only one hit](https://discuss.elastic.co/t/make-the-elasticsearch-input-return-only-one-hit/241146)
**Author:** [@Alessio\_Creo](https://discuss.elastic.co/u/Alessio_Creo)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 2:10pm UTC](https://discuss.elastic.co/t/make-the-elasticsearch-input-return-only-one-hit/241146 "2020-07-14T14:10:20Z")
Hi, I'm trying to use Logstash to ingest just one hit from an Elasticsearch index. This is my input configuration input{ elasticsearch{ hosts=\>\["logmgrappa.risorse.int:9200","logmgrappb.risorse.int:9200","logmgr… --- ## [Options List (Control) Default Value Issue/Question](https://discuss.elastic.co/t/options-list-control-default-value-issue-question/241144)
**Author:** [@tenet\_testuser1](https://discuss.elastic.co/u/tenet_testuser1)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 2:10pm UTC](https://discuss.elastic.co/t/options-list-control-default-value-issue-question/241144 "2020-07-14T14:10:14Z")
Hello, Using kibana 7.8. I created a drop down list control to use in a Dashboard. The drop down is for dates. I would like the default to be the most recent date in the dropdown. However, I am unable to make this work… --- ## [Rejected execution](https://discuss.elastic.co/t/rejected-execution/240984)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 8\ **Last updated:** [July 14, 2020, 2:05pm UTC](https://discuss.elastic.co/t/rejected-execution/240984 "2020-07-14T14:05:58Z")
Hello World! I'm using Elasticsearch 6.8.10 and trying to run a query, yet running into following issue: { "shard" : 3, "node" : "koEOgkkDBhOVfKHA7QXBjj", "reason" : { "reason" : "rejected execution of o… --- ## [Target node question](https://discuss.elastic.co/t/target-node-question/241105)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 2\ **Last updated:** [July 14, 2020, 1:55pm UTC](https://discuss.elastic.co/t/target-node-question/241105 "2020-07-14T13:55:06Z")
Hi, Just a question. The amount of data my old (6.7 / 6.8) platform needs to process explodes. So I'm busy tuning that until my new (7.x) platform is ready. Now I have a bunch of indexes of which 2 or 3 are large and … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1330) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1332)