# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1341 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1342 --- ## [Logstash Output dosent publishes logs while using systemctl](https://discuss.elastic.co/t/logstash-output-dosent-publishes-logs-while-using-systemctl/240410)
**Author:** [@Rahul\_Ravichandran](https://discuss.elastic.co/u/Rahul_Ravichandran)\ **Replies:** 6\ **Last updated:** [July 9, 2020, 11:55am UTC](https://discuss.elastic.co/t/logstash-output-dosent-publishes-logs-while-using-systemctl/240410 "2020-07-09T11:55:19Z")
If I start the logstash service using service or systemctl, it starts there are no errors started successfully but logs dosen't get published there in kibana. If i use " bin/logstash -f /etc/logstash/conf.d/logsta… --- ## [Aggregation by the first character of field](https://discuss.elastic.co/t/aggregation-by-the-first-character-of-field/240307)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 5\ **Last updated:** [July 9, 2020, 11:48am UTC](https://discuss.elastic.co/t/aggregation-by-the-first-character-of-field/240307 "2020-07-09T11:48:49Z")
Dears, Is there any way to do doc aggregation on the first character instead of whole field? My query in case of whole field: GET /log-2020.07.07/\_search?size=0 { "aggs": { "TEXT1": { "terms": { "f… --- ## [Kibana count and elasticsearch count are different](https://discuss.elastic.co/t/kibana-count-and-elasticsearch-count-are-different/240375)
**Author:** [@elisavet](https://discuss.elastic.co/u/elisavet)\ **Replies:** 2\ **Last updated:** [July 9, 2020, 11:44am UTC](https://discuss.elastic.co/t/kibana-count-and-elasticsearch-count-are-different/240375 "2020-07-09T11:44:18Z")
Hello! When I count docs in elasticsearch with the \_count API I get 844, while in kibana I get 623. Why does this happen? Thank you, elisavet --- ## [Check if restore operation is still running](https://discuss.elastic.co/t/check-if-restore-operation-is-still-running/239764)
**Author:** [@JacFal](https://discuss.elastic.co/u/JacFal)\ **Replies:** 13\ **Last updated:** [July 9, 2020, 11:40am UTC](https://discuss.elastic.co/t/check-if-restore-operation-is-still-running/239764 "2020-07-09T11:40:05Z")
Hello, Is there any way to monitor restore if wait\_for\_completion flag is set to false? For now I use the GET \_recovery API. I have few conditions for each shard in indices to check if restore operation is still runnin… --- ## [\[Filebeat\] "Configured paths: ... " log printed twice every time](https://discuss.elastic.co/t/filebeat-configured-paths-log-printed-twice-every-time/240518)
**Author:** [@wflyer](https://discuss.elastic.co/u/wflyer)\ **Replies:** 0\ **Last updated:** [July 9, 2020, 11:35am UTC](https://discuss.elastic.co/t/filebeat-configured-paths-log-printed-twice-every-time/240518 "2020-07-09T11:35:39Z")
Hello, I'm trying to upgrade filebeat daemonsets in my kubernetes cluster from 7.5.0 to 7.8.0 to fix some bugs. While evaluating new version, I found an issue in the filebeat log. 2020-07-09T11:15:26.303Z INFO … --- ## [Getting error in MAC OS](https://discuss.elastic.co/t/getting-error-in-mac-os/240500)
**Author:** [@inandi](https://discuss.elastic.co/u/inandi)\ **Replies:** 1\ **Last updated:** [July 9, 2020, 11:22am UTC](https://discuss.elastic.co/t/getting-error-in-mac-os/240500 "2020-07-09T11:22:30Z")
getting this error while starting elasticsearch in macOS Catalina via brew \[2020-07-09T14:38:59,510\]\[INFO \]\[o.e.n.Node \] \[node-testgobinda\] initialized \[2020-07-09T14:38:59,512\]\[INFO \]\[o.e.n.Node … --- ## [Error while injecting data from sqlite3 database](https://discuss.elastic.co/t/error-while-injecting-data-from-sqlite3-database/240509)
**Author:** [@Vikash\_Singh1](https://discuss.elastic.co/u/Vikash_Singh1)\ **Replies:** 5\ **Last updated:** [July 9, 2020, 11:19am UTC](https://discuss.elastic.co/t/error-while-injecting-data-from-sqlite3-database/240509 "2020-07-09T11:19:55Z")
Hi I am trying to create index for sqlite3 database but I am getting error saying Pipeline\_id:main Plugin: \"/home/kagamee/liveshield/api-sqlite/Yogesh/SimpleSocketIO/db/networkdata.db", … --- ## [Unable to use variable in curl bash script](https://discuss.elastic.co/t/unable-to-use-variable-in-curl-bash-script/240003)
**Author:** [@Jose\_H](https://discuss.elastic.co/u/Jose_H)\ **Replies:** 2\ **Last updated:** [July 9, 2020, 11:03am UTC](https://discuss.elastic.co/t/unable-to-use-variable-in-curl-bash-script/240003 "2020-07-09T11:03:30Z")
Hi guys. I've been trying to use a variable called "Time Period Variable" in my bash script, but im unable to make it work: #!/bin/bash ES EVENT Threshold number=10 Time Period Variable es\_period=now-1d Elasticsearc… --- ## [Intercept all requests from Kibana to Elasticsearch by using the plugin](https://discuss.elastic.co/t/intercept-all-requests-from-kibana-to-elasticsearch-by-using-the-plugin/240507)
**Author:** [@Uldis\_Liepins](https://discuss.elastic.co/u/Uldis_Liepins)\ **Replies:** 0\ **Last updated:** [July 9, 2020, 10:19am UTC](https://discuss.elastic.co/t/intercept-all-requests-from-kibana-to-elasticsearch-by-using-the-plugin/240507 "2020-07-09T10:19:40Z")
Hi, I am trying to intercept all requests coming from browser to \_msearch (e.g. \_msearch?rest\_total\_hits\_as\_int=true&ignore\_throttled=true) by using the plugin. The idea is to be able to add additional search parameter… --- ## [Useragent plugin - android 9 and 10](https://discuss.elastic.co/t/useragent-plugin-android-9-and-10/239175)
**Author:** [@holiveira](https://discuss.elastic.co/u/holiveira)\ **Replies:** 4\ **Last updated:** [July 9, 2020, 10:49am UTC](https://discuss.elastic.co/t/useragent-plugin-android-9-and-10/239175 "2020-07-09T10:49:32Z")
The parse of an Android 9 or 10 useragent is partial. For example, the fields user\_agentos\_major, user\_agentos\_minor do not exist. Example useragent: Mozilla/5.0 (Linux; Android 9; Redmi Note 7 Build/PKQ1.180904.001; w… --- ## [Using tokenizer on rank\_feature fields](https://discuss.elastic.co/t/using-tokenizer-on-rank-feature-fields/240417)
**Author:** [@lukegil](https://discuss.elastic.co/u/lukegil)\ **Replies:** 1\ **Last updated:** [July 9, 2020, 10:45am UTC](https://discuss.elastic.co/t/using-tokenizer-on-rank-feature-fields/240417 "2020-07-09T10:45:57Z")
Hi! I was wondering if it's possible to apply tokenizer/analyzers to rank\_feature fields. When attempting to create a sample index on ES 7.6.2 it doesn't appear to work, but I don't see anything explicit in the docs. In… --- ## [Merge two datasets](https://discuss.elastic.co/t/merge-two-datasets/240506)
**Author:** [@lugano](https://discuss.elastic.co/u/lugano)\ **Replies:** 0\ **Last updated:** [July 9, 2020, 9:59am UTC](https://discuss.elastic.co/t/merge-two-datasets/240506 "2020-07-09T09:59:53Z")
I have two datasets which I want to merge into one. I am using Elastic stack v7.7 . I want to use composite key with Painless script processor. To get a unique document I need 4 fields. 3 of the fields they match exactly… --- ## [Cant update the mapping](https://discuss.elastic.co/t/cant-update-the-mapping/238031)
**Author:** [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\ **Replies:** 0\ **Last updated:** [June 22, 2020, 7:56am UTC](https://discuss.elastic.co/t/cant-update-the-mapping/238031 "2020-06-22T07:56:41Z")
Hello, I cant map correctly the following field: http.request.body.original Currently part of my mapping looks like that for my apm indices: "http" : { "dynamic" : "false", "properties" : { … --- ## [LogStash is running but Not processing Logs](https://discuss.elastic.co/t/logstash-is-running-but-not-processing-logs/240491)
**Author:** [@singh.piyush862](https://discuss.elastic.co/u/singh.piyush862)\ **Replies:** 0\ **Last updated:** [July 9, 2020, 8:23am UTC](https://discuss.elastic.co/t/logstash-is-running-but-not-processing-logs/240491 "2020-07-09T08:23:36Z")
Hi All, We started Logstash service & it process the syslog data but suddenly it stopped processing logs (I could not see new logs in Kibaan/elastic search index) however Syslog is running. Elastic search is rusnning … --- ## [Quering nullable timstamp field](https://discuss.elastic.co/t/quering-nullable-timstamp-field/240478)
**Author:** [@recordable542](https://discuss.elastic.co/u/recordable542)\ **Replies:** 1\ **Last updated:** [July 9, 2020, 8:55am UTC](https://discuss.elastic.co/t/quering-nullable-timstamp-field/240478 "2020-07-09T08:55:28Z")
I have user index like below name: text frozen\_until: timestamp I want to query all users which... (frozen\_until == null || frozen\_until \< today) below is the query I'm struggling with: { "query": { "bool": { … --- ## [Need to integrate Logstash HTTP input plugin with my android application](https://discuss.elastic.co/t/need-to-integrate-logstash-http-input-plugin-with-my-android-application/240484)
**Author:** [@sheetalg](https://discuss.elastic.co/u/sheetalg)\ **Replies:** 0\ **Last updated:** [July 9, 2020, 8:01am UTC](https://discuss.elastic.co/t/need-to-integrate-logstash-http-input-plugin-with-my-android-application/240484 "2020-07-09T08:01:25Z")
I need to integrate Logstash HTTP input plugin with my android application so that I can errors logs to logstash server. Please guide me with example or sample android app --- ## [logstashのERRORとWARNのログの出力先について](https://discuss.elastic.co/t/logstash-error-warn/240486)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 0\ **Last updated:** [July 9, 2020, 8:05am UTC](https://discuss.elastic.co/t/logstash-error-warn/240486 "2020-07-09T08:05:13Z")
logstashのログは、/var/log/messagesとlogstash-plain.logの2か所になると認識しています。 メッセージによっては、messagesには出力されてlogstash-plain.logには出力されないケースがあるように見受けられるのですが、逆にlogstash-plain.logにのみ出力されてmessagesには出力されないERRORもしくはWARNメッセージは存在しますでしょうか？ メッセージ… --- ## [Logstash on Centos 6 with non-default java](https://discuss.elastic.co/t/logstash-on-centos-6-with-non-default-java/240361)
**Author:** [@Nekasas](https://discuss.elastic.co/u/Nekasas)\ **Replies:** 2\ **Last updated:** [July 9, 2020, 8:02am UTC](https://discuss.elastic.co/t/logstash-on-centos-6-with-non-default-java/240361 "2020-07-09T08:02:27Z")
Hello, We have an old Centos 6 server where java 1.7 is crucial and we can't update it to java 1.8 so we are using alternatives. Configure alternative with logstash is quite difficult ( at least for me) Problem is that… --- ## [Limitations for AWS hosted ES Instances](https://discuss.elastic.co/t/limitations-for-aws-hosted-es-instances/240303)
**Author:** [@Flora\_Dev](https://discuss.elastic.co/u/Flora_Dev)\ **Replies:** 3\ **Last updated:** [July 9, 2020, 7:58am UTC](https://discuss.elastic.co/t/limitations-for-aws-hosted-es-instances/240303 "2020-07-09T07:58:48Z")
Hello Experts, We have m5.xlarge.elasticsearch instance hosted for product search and index purpose (retail products, images, product descriptions ect.,) In AWS cloudwatch perspective I want to set alarm for Index Rate … --- ## [Can I block document names in Elasticsearch?](https://discuss.elastic.co/t/can-i-block-document-names-in-elasticsearch/240455)
**Author:** [@Callonski](https://discuss.elastic.co/u/Callonski)\ **Replies:** 1\ **Last updated:** [July 9, 2020, 7:51am UTC](https://discuss.elastic.co/t/can-i-block-document-names-in-elasticsearch/240455 "2020-07-09T07:51:25Z")
My problem is ingesting data that does not come in order into elasticsearch. The data is customer profiles, and if a customer updates their profile and then deletes it. I will receive two messages. One Update and one Del… --- ## [Get the kubernetees application logs to Elasticsearch which is setup in Infra VM](https://discuss.elastic.co/t/get-the-kubernetees-application-logs-to-elasticsearch-which-is-setup-in-infra-vm/240317)
**Author:** [@Shalinicts](https://discuss.elastic.co/u/Shalinicts)\ **Replies:** 2\ **Last updated:** [July 9, 2020, 7:46am UTC](https://discuss.elastic.co/t/get-the-kubernetees-application-logs-to-elasticsearch-which-is-setup-in-infra-vm/240317 "2020-07-09T07:46:57Z")
Hi Team , I have a ELK enterprise version setup in 7 node (RHEL) , 2 Logstash servers(RHEL) , 1 Kibana Windows server in infra within GCP. I have a requirement to monitor application logs within kubernetees . How can I … --- ## [Time difference in last\_run\_metadata\_path file when Logstash and source database are in different timezones](https://discuss.elastic.co/t/time-difference-in-last-run-metadata-path-file-when-logstash-and-source-database-are-in-different-timezones/240190)
**Author:** [@saif3r](https://discuss.elastic.co/u/saif3r)\ **Replies:** 3\ **Last updated:** [July 9, 2020, 7:35am UTC](https://discuss.elastic.co/t/time-difference-in-last-run-metadata-path-file-when-logstash-and-source-database-are-in-different-timezones/240190 "2020-07-09T07:35:29Z")
Hello, Our ELK Stack is placed in UTC timezone (OS timezone is set to UTC). The database from which we pull the data from using JDBC is in CET (UTC+2) timezone. The config file for the pipeline looks like this: jdbc … --- ## [Problème avec la carte dans kibana](https://discuss.elastic.co/t/probleme-avec-la-carte-dans-kibana/240464)
**Author:** [@IneedHelp](https://discuss.elastic.co/u/IneedHelp)\ **Replies:** 0\ **Last updated:** [July 9, 2020, 7:24am UTC](https://discuss.elastic.co/t/probleme-avec-la-carte-dans-kibana/240464 "2020-07-09T07:24:18Z")
Bonjour, J'ai récemment changé de machine et j'ai donc réinstaller la suite elastic dans une version plus récente(7.5.0 -\> 7.8.0). J'ai transvasé les fichiers de configurations et les dashboards de l'ancienne machine à … --- ## [Showing icons for legends in place of text](https://discuss.elastic.co/t/showing-icons-for-legends-in-place-of-text/240316)
**Author:** [@VipinAgarwal](https://discuss.elastic.co/u/VipinAgarwal)\ **Replies:** 2\ **Last updated:** [July 9, 2020, 7:20am UTC](https://discuss.elastic.co/t/showing-icons-for-legends-in-place-of-text/240316 "2020-07-09T07:20:43Z")
Hello all, I'm a newbie to ELK stack, so apologies if this has already been answered. Would really appreciate if you can point me to right place. We have a requirement where we would like to show a horizontal bar with… --- ## [Issue with service account role binding](https://discuss.elastic.co/t/issue-with-service-account-role-binding/239857)
**Author:** [@Lilth](https://discuss.elastic.co/u/Lilth)\ **Replies:** 2\ **Last updated:** [July 9, 2020, 6:47am UTC](https://discuss.elastic.co/t/issue-with-service-account-role-binding/239857 "2020-07-09T06:47:42Z")
Hello, I have recently faced an issue with OpenShift service account access to ElasticSearch. I can access ElasticSearch only if a service account is mapped to the cluster-admin role. Idea is to create a new service a… --- ## [Help Searching the data from my index](https://discuss.elastic.co/t/help-searching-the-data-from-my-index/240286)
**Author:** [@snowfall\_2010](https://discuss.elastic.co/u/snowfall_2010)\ **Replies:** 3\ **Last updated:** [July 9, 2020, 6:14am UTC](https://discuss.elastic.co/t/help-searching-the-data-from-my-index/240286 "2020-07-09T06:14:18Z")
my index save data structure is the pic below: index info: "1":{ "aliases":{}, "mappings":{ "properties":{ "DeviceId":{ "type":"text", "fields":{ … --- ## [Semantically equivalent search leads to different results](https://discuss.elastic.co/t/semantically-equivalent-search-leads-to-different-results/240297)
**Author:** [@puschelfoo](https://discuss.elastic.co/u/puschelfoo)\ **Replies:** 4\ **Last updated:** [July 9, 2020, 5:13am UTC](https://discuss.elastic.co/t/semantically-equivalent-search-leads-to-different-results/240297 "2020-07-09T05:13:06Z")
Query \[1\] (exactly one result) and \[2\] (many results) differ in their results (quantity), although they are semantically equivalent according to the documentation (see "operator" parameter explanation for in Documentati… --- ## [Post Upgrading ElasticSearch to 6.8.10 its not receiving data from Logstash(5.6.16)](https://discuss.elastic.co/t/post-upgrading-elasticsearch-to-6-8-10-its-not-receiving-data-from-logstash-5-6-16/240445)
**Author:** [@vsudhaka](https://discuss.elastic.co/u/vsudhaka)\ **Replies:** 2\ **Last updated:** [July 9, 2020, 4:53am UTC](https://discuss.elastic.co/t/post-upgrading-elasticsearch-to-6-8-10-its-not-receiving-data-from-logstash-5-6-16/240445 "2020-07-09T04:53:05Z")
Hello, I am new in using ELK stack. I recently Upgraded Logstash from 5.6.13 -\> 5.6.16 ,ElasticSearch Nodes from 5.6.16 -\> 6.8.10 and Kibana from 5.6.16 -\> 6.8.10. I did not Upgrade Logstash and FileBeats to version 6… --- ## [Error in visualization \[esaggs\] \> Service unavailable when time filtering](https://discuss.elastic.co/t/error-in-visualization-esaggs-service-unavailable-when-time-filtering/239987)
**Author:** [@Kevin\_Renalda](https://discuss.elastic.co/u/Kevin_Renalda)\ **Replies:** 2\ **Last updated:** [July 8, 2020, 12:05pm UTC](https://discuss.elastic.co/t/error-in-visualization-esaggs-service-unavailable-when-time-filtering/239987 "2020-07-08T12:05:55Z")
Hi, I'm fairly new to kibana, I wanna ask about this error I keep getting every time I set the filter time range in my dashboard to a wide range and when I click the see the full error it just shows the exact same err… --- ## [Bug in elasticsearch search\_after rest api?](https://discuss.elastic.co/t/bug-in-elasticsearch-search-after-rest-api/240215)
**Author:** [@corbosman](https://discuss.elastic.co/u/corbosman)\ **Replies:** 5\ **Last updated:** [July 9, 2020, 3:14am UTC](https://discuss.elastic.co/t/bug-in-elasticsearch-search-after-rest-api/240215 "2020-07-09T03:14:04Z")
Hi all, im running into what I'm thinking might be a bug. I'm using the REST search api to return log entries stored in our elasticsearch cluster. This could run into the tens of thousands, so I'm using search\_after to r… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1340) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1342)