# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1511 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1512 --- ## [Best way to learn Elasticsearch internal](https://discuss.elastic.co/t/best-way-to-learn-elasticsearch-internal/227748)
**Author:** [@amitkg](https://discuss.elastic.co/u/amitkg)\ **Replies:** 8\ **Last updated:** [April 15, 2020, 5:07pm UTC](https://discuss.elastic.co/t/best-way-to-learn-elasticsearch-internal/227748 "2020-04-15T17:07:47Z")
Hi, I am new to Elasticsearch and fond of this system. I would like to learn more about internal design and motivation behind such design. I did follow some of youtube videos or blogs which covers the bottom up design.… --- ## [Aggregation on multiple fields with millions of buckets](https://discuss.elastic.co/t/aggregation-on-multiple-fields-with-millions-of-buckets/227502)
**Author:** [@Manish\_Kukreja](https://discuss.elastic.co/u/Manish_Kukreja)\ **Replies:** 5\ **Last updated:** [April 15, 2020, 5:03pm UTC](https://discuss.elastic.co/t/aggregation-on-multiple-fields-with-millions-of-buckets/227502 "2020-04-15T17:03:10Z")
Hi I have a requirement where in i need to aggregate over multiple fields which can result in millions of buckets. We have data with millions of records, and here i need to get average number of records for each unique… --- ## [Unable to reindex .security6](https://discuss.elastic.co/t/unable-to-reindex-security6/227345)
**Author:** [@Chris\_Wilmott](https://discuss.elastic.co/u/Chris_Wilmott)\ **Replies:** 2\ **Last updated:** [April 15, 2020, 4:59pm UTC](https://discuss.elastic.co/t/unable-to-reindex-security6/227345 "2020-04-15T16:59:21Z")
Hi, I am trying to upgrade Kibana from 6.8.8 to 7.6.2 but when I am trying to reindex .security6 I get the following error: You do not have sufficient privileges to reindex this index I am logged in as an Admin when p… --- ## [Running elasticsearch on mac gives could not find java error](https://discuss.elastic.co/t/running-elasticsearch-on-mac-gives-could-not-find-java-error/228170)
**Author:** [@chari](https://discuss.elastic.co/u/chari)\ **Replies:** 0\ **Last updated:** [April 15, 2020, 4:41pm UTC](https://discuss.elastic.co/t/running-elasticsearch-on-mac-gives-could-not-find-java-error/228170 "2020-04-15T16:41:45Z")
I have been using elasticsearch 7.3.0 on a mac for about a year now. I did a fresh download of the 7.6.2 version from this link https://www.elastic.co/guide/en/elasticsearch/reference/current/targz.html When I try to … --- ## [Logstash filter not working with Sysmon](https://discuss.elastic.co/t/logstash-filter-not-working-with-sysmon/228023)
**Author:** [@martinsrm](https://discuss.elastic.co/u/martinsrm)\ **Replies:** 2\ **Last updated:** [April 15, 2020, 4:36pm UTC](https://discuss.elastic.co/t/logstash-filter-not-working-with-sysmon/228023 "2020-04-15T16:36:11Z")
Hello everybody, I am trying to create a field called "Threat" just if I have a log from the "Microsoft-Windows-Sysmon" provider, but the "if" condition never works, could you guys give me an idea about it? Tks ######… --- ## [Deleted document count very high compared to the actual count of documents in the index](https://discuss.elastic.co/t/deleted-document-count-very-high-compared-to-the-actual-count-of-documents-in-the-index/224648)
**Author:** [@mohankumarb](https://discuss.elastic.co/u/mohankumarb)\ **Replies:** 13\ **Last updated:** [April 15, 2020, 4:21pm UTC](https://discuss.elastic.co/t/deleted-document-count-very-high-compared-to-the-actual-count-of-documents-in-the-index/224648 "2020-04-15T16:21:03Z")
ES version: 7.5 Number of shards: 5 Number of replicas: 4 We have a use case, where we have a lot of updates happening to the document (location updates). So every update is deleting and creating a new document in th… --- ## ["Only value lists are allowed in serialized settings" error when creating new analyzer](https://discuss.elastic.co/t/only-value-lists-are-allowed-in-serialized-settings-error-when-creating-new-analyzer/228109)
**Author:** [@Aziz\_Holden](https://discuss.elastic.co/u/Aziz_Holden)\ **Replies:** 1\ **Last updated:** [April 15, 2020, 4:19pm UTC](https://discuss.elastic.co/t/only-value-lists-are-allowed-in-serialized-settings-error-when-creating-new-analyzer/228109 "2020-04-15T16:19:03Z")
I'm trying to create a custom analyzer that does the following: if a token length is greater than 14, include the token itself as well as the truncated token: PUT localhost:9200/assets/ { "settings": { … --- ## [SNMP input plugin - SNMP V3 not working](https://discuss.elastic.co/t/snmp-input-plugin-snmp-v3-not-working/228164)
**Author:** [@Thelmo\_Henrique\_Sant](https://discuss.elastic.co/u/Thelmo_Henrique_Sant)\ **Replies:** 0\ **Last updated:** [April 15, 2020, 4:01pm UTC](https://discuss.elastic.co/t/snmp-input-plugin-snmp-v3-not-working/228164 "2020-04-15T16:01:43Z")
Hi , I am new with ELK and I'm trying to configure my logstash to get SNMP V3 information from my devices, but unfortunately, I don't know what I am doing wrong. I followed the procedures from the SNMP input plugin pag… --- ## [Transforming objects with key and value fields into simple fields](https://discuss.elastic.co/t/transforming-objects-with-key-and-value-fields-into-simple-fields/228152)
**Author:** [@wfhartford](https://discuss.elastic.co/u/wfhartford)\ **Replies:** 2\ **Last updated:** [April 15, 2020, 4:00pm UTC](https://discuss.elastic.co/t/transforming-objects-with-key-and-value-fields-into-simple-fields/228152 "2020-04-15T16:00:36Z")
Logstash is receiving events which include a list of json objects, each with two fields key and value: { "details": \[ { "key": "foo", "value": "foo value" }, { "key": "bar", "value": "bar value… --- ## [How to parse few XML files with different number of tags in different files using Logstash?](https://discuss.elastic.co/t/how-to-parse-few-xml-files-with-different-number-of-tags-in-different-files-using-logstash/228156)
**Author:** [@Gerych](https://discuss.elastic.co/u/Gerych)\ **Replies:** 1\ **Last updated:** [April 15, 2020, 3:43pm UTC](https://discuss.elastic.co/t/how-to-parse-few-xml-files-with-different-number-of-tags-in-different-files-using-logstash/228156 "2020-04-15T15:43:31Z")
Can someone tell me how you can parse these types of files through the logstash and after that index it in elasticsearch. Files can contain a variable number of internal tags. Here is my config file, but unfortunately… --- ## [ELK Delete Indices](https://discuss.elastic.co/t/elk-delete-indices/228144)
**Author:** [@Anand\_Sakthivel](https://discuss.elastic.co/u/Anand_Sakthivel)\ **Replies:** 4\ **Last updated:** [April 15, 2020, 3:42pm UTC](https://discuss.elastic.co/t/elk-delete-indices/228144 "2020-04-15T15:42:12Z")
Hi, I'm new to ELK stack. Our server is running out of disk space and we have a cronjob running to delete the indices. 1 1 \* \* \* /usr/local/bin/curator /root/.curator/action\_remove\_old\_logs.yml But what is occupying m… --- ## [Delete old indexes](https://discuss.elastic.co/t/delete-old-indexes/226933)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 9\ **Last updated:** [April 15, 2020, 3:29pm UTC](https://discuss.elastic.co/t/delete-old-indexes/226933 "2020-04-15T15:29:27Z")
My indexes are created every day like xxx-yy-mm-dd, how can I automatic remove old indexes? I am looking for some easy way, because whole is generated automatic by tshark. To be honest I tried with index templates to a… --- ## [Parsing data using logstash](https://discuss.elastic.co/t/parsing-data-using-logstash/228155)
**Author:** [@Ananya\_Mohiley](https://discuss.elastic.co/u/Ananya_Mohiley)\ **Replies:** 0\ **Last updated:** [April 15, 2020, 3:26pm UTC](https://discuss.elastic.co/t/parsing-data-using-logstash/228155 "2020-04-15T15:26:06Z")
hi am trying to parse text files using a suitable filter however getting stuck, the file looks as under file name@@@@@@@@@@@@@@@@@@@@@@@@@@dummy report 1.docx data = ROUTINE REPORT from = 17 to = 70 orig = main o… --- ## [Kv filter with spaces in values](https://discuss.elastic.co/t/kv-filter-with-spaces-in-values/227962)
**Author:** [@parosio](https://discuss.elastic.co/u/parosio)\ **Replies:** 3\ **Last updated:** [April 15, 2020, 3:20pm UTC](https://discuss.elastic.co/t/kv-filter-with-spaces-in-values/227962 "2020-04-15T15:20:29Z")
Hello, I've got a log that seems a perfect candidate for the kv filter: msg=Start MID 1242272 ICID 1632662 categorySignificance=/Informational catdt=Web Filtering categoryObject=/Host/Application/Service deviceSeverity… --- ## [Extract certain watcher fields](https://discuss.elastic.co/t/extract-certain-watcher-fields/227751)
**Author:** [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\ **Replies:** 3\ **Last updated:** [April 15, 2020, 3:20pm UTC](https://discuss.elastic.co/t/extract-certain-watcher-fields/227751 "2020-04-15T15:20:14Z")
Hello, In this elastic search link: https://www.elastic.co/guide/en/watcher/2.3/input.html#input-search it specifies how to get a field value from a particular hit and it provides an example if we want to get the value … --- ## [10000+ results in aggregation](https://discuss.elastic.co/t/10000-results-in-aggregation/228154)
**Author:** [@pjanzen](https://discuss.elastic.co/u/pjanzen)\ **Replies:** 0\ **Last updated:** [April 15, 2020, 3:20pm UTC](https://discuss.elastic.co/t/10000-results-in-aggregation/228154 "2020-04-15T15:20:05Z")
Hi All, I am using a watcher to send data to an API, this works fine but my aggregation returns more than 10K buckets. Advised is to use composite aggregations but is that possible in an watcher? How do you paginate / l… --- ## [Performance of OR filter](https://discuss.elastic.co/t/performance-of-or-filter/228149)
**Author:** [@DreamStack](https://discuss.elastic.co/u/DreamStack)\ **Replies:** 0\ **Last updated:** [April 15, 2020, 3:03pm UTC](https://discuss.elastic.co/t/performance-of-or-filter/228149 "2020-04-15T15:03:00Z")
Hello, I'm having some issue with a part of my query leading to bad performance (about a 2-3x difference). Maybe someone can suggest an improvement. I already tried converting them over to a bool/match query, but seems … --- ## [No config files found in path \[Need Help\]](https://discuss.elastic.co/t/no-config-files-found-in-path-need-help/227915)
**Author:** [@elktail](https://discuss.elastic.co/u/elktail)\ **Replies:** 6\ **Last updated:** [April 15, 2020, 2:48pm UTC](https://discuss.elastic.co/t/no-config-files-found-in-path-need-help/227915 "2020-04-15T14:48:16Z")
I am very new to ELK stack. I have installed ELK stack via debian package on Ubuntu Server. I made two changes in logstash.yml: config.reload.automatic: true config.reload.interval: 3s Despite these two changes every… --- ## [Logstash PQ in conjuction with DLQ](https://discuss.elastic.co/t/logstash-pq-in-conjuction-with-dlq/228086)
**Author:** [@Kalilou\_Diaby](https://discuss.elastic.co/u/Kalilou_Diaby)\ **Replies:** 1\ **Last updated:** [April 15, 2020, 2:40pm UTC](https://discuss.elastic.co/t/logstash-pq-in-conjuction-with-dlq/228086 "2020-04-15T14:40:54Z")
Hello, Hope everyone is safe during this covid19 crisis. I have a logstash related question, today we are using Logstash Persistent Queue which seems to me enough to guarantee once an at-least-once delivery. Is there a… --- ## [Multiple Kibana Logs settings](https://discuss.elastic.co/t/multiple-kibana-logs-settings/228082)
**Author:** [@laurentiusoica](https://discuss.elastic.co/u/laurentiusoica)\ **Replies:** 2\ **Last updated:** [April 15, 2020, 2:39pm UTC](https://discuss.elastic.co/t/multiple-kibana-logs-settings/228082 "2020-04-15T14:39:32Z")
Hi, I use elastic stack as a log aggregator for a k8s cluster. I'm creating a separate index from filebeat for each namespace in the cluster for multiple reasons, one of them being to speed up search on a specific names… --- ## [Update elastic search document](https://discuss.elastic.co/t/update-elastic-search-document/228102)
**Author:** [@hariskhalique](https://discuss.elastic.co/u/hariskhalique)\ **Replies:** 1\ **Last updated:** [April 15, 2020, 2:38pm UTC](https://discuss.elastic.co/t/update-elastic-search-document/228102 "2020-04-15T14:38:28Z")
Hi, I have create following conf file input { jdbc { jdbc\_driver\_library =\> "/usr/share/java/mysql.jar" jdbc\_driver\_class =\> "com.mysql.jdbc.Driver" jdbc\_connection\_string =\> "jdbc:mysql://… --- ## [How to give multiple files in different paths as input to logstash](https://discuss.elastic.co/t/how-to-give-multiple-files-in-different-paths-as-input-to-logstash/228094)
**Author:** [@poddraj](https://discuss.elastic.co/u/poddraj)\ **Replies:** 1\ **Last updated:** [April 15, 2020, 2:35pm UTC](https://discuss.elastic.co/t/how-to-give-multiple-files-in-different-paths-as-input-to-logstash/228094 "2020-04-15T14:35:28Z")
Hi All, I have a scenario where two log files are in different directory paths but the log structure of them is same. I want to pass both of them as input files in a single config file so that the filter in it will pars… --- ## [API to backup and restore settings from Infrastructure and Metric Explorer apps](https://discuss.elastic.co/t/api-to-backup-and-restore-settings-from-infrastructure-and-metric-explorer-apps/228024)
**Author:** [@johncollaros](https://discuss.elastic.co/u/johncollaros)\ **Replies:** 1\ **Last updated:** [April 15, 2020, 2:34pm UTC](https://discuss.elastic.co/t/api-to-backup-and-restore-settings-from-infrastructure-and-metric-explorer-apps/228024 "2020-04-15T14:34:57Z")
Hi, I have noticed there are settings for the Infrastructure app, particularly in the metric explorer where you can save and load views. How can we backup and restore these settings, and export them and import via API? … --- ## [How to replace "No results found" with other words or emoji](https://discuss.elastic.co/t/how-to-replace-no-results-found-with-other-words-or-emoji/228050)
**Author:** [@janefeng](https://discuss.elastic.co/u/janefeng)\ **Replies:** 5\ **Last updated:** [April 15, 2020, 2:28pm UTC](https://discuss.elastic.co/t/how-to-replace-no-results-found-with-other-words-or-emoji/228050 "2020-04-15T14:28:16Z")
Is it possible to replace "No results found" in dashboard with other words or emoji? Even if a picture is better. --- ## [CURL -X GET \ is not working from bash script for checking Kibana installation with Nginx](https://discuss.elastic.co/t/curl-x-get-url-is-not-working-from-bash-script-for-checking-kibana-installation-with-nginx/228041)
**Author:** [@manojkrishna561994](https://discuss.elastic.co/u/manojkrishna561994)\ **Replies:** 1\ **Last updated:** [April 15, 2020, 2:19pm UTC](https://discuss.elastic.co/t/curl-x-get-url-is-not-working-from-bash-script-for-checking-kibana-installation-with-nginx/228041 "2020-04-15T14:19:44Z")
Hi, I'm installing ELK stack on my Ubuntu VM using bash script I have made. I'm following this tutorial Install ELK on Ubuntu. After installing Nginx from this tutorial, I'm trying to hit curl -X GET http://server-ip/st… --- ## [Upgrade elasticsearch opensource for basic](https://discuss.elastic.co/t/upgrade-elasticsearch-opensource-for-basic/228013)
**Author:** [@George\_Oliveira](https://discuss.elastic.co/u/George_Oliveira)\ **Replies:** 7\ **Last updated:** [April 15, 2020, 1:55pm UTC](https://discuss.elastic.co/t/upgrade-elasticsearch-opensource-for-basic/228013 "2020-04-15T13:55:22Z")
I have an opensource elasticseach environment, I want to upgrade to the basic version, only by uninstalling opensource and installing basic does the cluster work stable ? --- ## [Invoke Logstash Ondemand dynamically like REST API invocation](https://discuss.elastic.co/t/invoke-logstash-ondemand-dynamically-like-rest-api-invocation/228135)
**Author:** [@subbareddy](https://discuss.elastic.co/u/subbareddy)\ **Replies:** 0\ **Last updated:** [April 15, 2020, 1:50pm UTC](https://discuss.elastic.co/t/invoke-logstash-ondemand-dynamically-like-rest-api-invocation/228135 "2020-04-15T13:50:21Z")
Hi, I have logstash pipeline running in vm which pulls historical data for x months. I want to run this pipeline on demand when ever i want. here i don't have direct access to vm. --- ## ["xml2js" files empty in node\_modules kibana 7.6.0](https://discuss.elastic.co/t/xml2js-files-empty-in-node-modules-kibana-7-6-0/228057)
**Author:** [@prernarana](https://discuss.elastic.co/u/prernarana)\ **Replies:** 1\ **Last updated:** [April 15, 2020, 1:45pm UTC](https://discuss.elastic.co/t/xml2js-files-empty-in-node-modules-kibana-7-6-0/228057 "2020-04-15T13:45:46Z")
I am developing a kibana app plugin and using xml2js module in it. When I am integrating it in release version of Kibana, it is failing as required node modules "xml2js" and its dependencies "xmlbuilder" and "sax" exists… --- ## [Get Ratio of Daily Active Users and Montly Active Users](https://discuss.elastic.co/t/get-ratio-of-daily-active-users-and-montly-active-users/228127)
**Author:** [@Julius\_Kukonenko](https://discuss.elastic.co/u/Julius_Kukonenko)\ **Replies:** 2\ **Last updated:** [April 15, 2020, 1:45pm UTC](https://discuss.elastic.co/t/get-ratio-of-daily-active-users-and-montly-active-users/228127 "2020-04-15T13:45:11Z")
Hi, im new to kibana and trying to figure it out how to make calculation of already filtered documents. For example, I need to count a ratio of my Daily Active Users and my Monthly Active Users. So I need to make two qu… --- ## [Hot Cold architecture question?](https://discuss.elastic.co/t/hot-cold-architecture-question/225811)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 6\ **Last updated:** [April 15, 2020, 1:42pm UTC](https://discuss.elastic.co/t/hot-cold-architecture-question/225811 "2020-04-15T13:42:07Z")
Dear all I have a question about hot warm cold architecture. So basically i want to skip the warm node and just have the hot and the cold node only, is it possible, and also i hear from a friend that cold node has bet… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1510) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1512)