# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1527 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1528 --- ## [Sorting by \_score on an aggregation](https://discuss.elastic.co/t/sorting-by-score-on-an-aggregation/224728)
**Author:** [@Tim\_Estes](https://discuss.elastic.co/u/Tim_Estes)\ **Replies:** 3\ **Last updated:** [April 7, 2020, 6:05pm UTC](https://discuss.elastic.co/t/sorting-by-score-on-an-aggregation/224728 "2020-04-07T18:05:57Z")
Hello, I have the following schema for an index, with some example documents. My use-case is that I'm indexing a book and I am indexing by page. I'm trying to make a query against the contents of each page and return the… --- ## [Monitor/Log search queries in elasticsearch/kibana](https://discuss.elastic.co/t/monitor-log-search-queries-in-elasticsearch-kibana/226970)
**Author:** [@OMW](https://discuss.elastic.co/u/OMW)\ **Replies:** 0\ **Last updated:** [April 7, 2020, 5:57pm UTC](https://discuss.elastic.co/t/monitor-log-search-queries-in-elasticsearch-kibana/226970 "2020-04-07T17:57:47Z")
Hello, I am trying to create a pipeline for monitoring user executed queries in elasticsearch. I followed this tutorial I successfully installed logstash, packetbeat and kibana. Both applications are configured loca… --- ## [Elasticsearch Consuming Massive Memory](https://discuss.elastic.co/t/elasticsearch-consuming-massive-memory/226783)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 1\ **Last updated:** [April 6, 2020, 10:58pm UTC](https://discuss.elastic.co/t/elasticsearch-consuming-massive-memory/226783 "2020-04-06T22:58:33Z")
Just curious as to what's going on here. jvm.options set to 20GB but this is what I see in Task Manager. Running Elasticsearch 7.6 on Server 2012 R2 --- ## [Using scripted nested sorting with missing fields](https://discuss.elastic.co/t/using-scripted-nested-sorting-with-missing-fields/226962)
**Author:** [@Jimmy](https://discuss.elastic.co/u/Jimmy)\ **Replies:** 0\ **Last updated:** [April 7, 2020, 5:24pm UTC](https://discuss.elastic.co/t/using-scripted-nested-sorting-with-missing-fields/226962 "2020-04-07T17:24:43Z")
Hi, I'm working with documents that looks like: { "product\_name": "abc", "prices": { "regular": 9.99, "pricing\_tables": \[ { "id": 1, "price": 8.99 }, { "id": 2, "price": 7.99 } \] } Where pr… --- ## [Summarization of text content](https://discuss.elastic.co/t/summarization-of-text-content/226958)
**Author:** [@Nathaniel\_Gonzalez](https://discuss.elastic.co/u/Nathaniel_Gonzalez)\ **Replies:** 0\ **Last updated:** [April 7, 2020, 4:42pm UTC](https://discuss.elastic.co/t/summarization-of-text-content/226958 "2020-04-07T16:42:38Z")
Hi, I'm looking for a way of extracting/returning a summarize version of the text that was ingested. Its there any plugin or functionality in elastic that can accomplished this. In a best case scenario the information w… --- ## [Why no native CSV import in bulk instead of JSON? It would make sense am I right?](https://discuss.elastic.co/t/why-no-native-csv-import-in-bulk-instead-of-json-it-would-make-sense-am-i-right/226836)
**Author:** [@emilebosch](https://discuss.elastic.co/u/emilebosch)\ **Replies:** 3\ **Last updated:** [April 7, 2020, 4:39pm UTC](https://discuss.elastic.co/t/why-no-native-csv-import-in-bulk-instead-of-json-it-would-make-sense-am-i-right/226836 "2020-04-07T16:39:24Z")
Hi all! I was wondering for some time now why doesn't Elasticsearch allow for native CSV import? I don't mean converting the CSV to JSON and then using the Bulk API, but uploading a CSV to the server and then the server … --- ## [Search UI and result ranking](https://discuss.elastic.co/t/search-ui-and-result-ranking/226953)
**Author:** [@nickdeckerdevs](https://discuss.elastic.co/u/nickdeckerdevs)\ **Replies:** 0\ **Last updated:** [April 7, 2020, 4:26pm UTC](https://discuss.elastic.co/t/search-ui-and-result-ranking/226953 "2020-04-07T16:26:13Z")
I'm trying to figure out how to use search ui (using react package) and determine if a result has been modified. Here there are "sponsored results" -- I was told this was done by result ranking (which I understand how t… --- ## [Host.hostname field\_data issue with SIEM and auditbeat](https://discuss.elastic.co/t/host-hostname-field-data-issue-with-siem-and-auditbeat/226945)
**Author:** [@rgeisman](https://discuss.elastic.co/u/rgeisman)\ **Replies:** 0\ **Last updated:** [April 7, 2020, 3:56pm UTC](https://discuss.elastic.co/t/host-hostname-field-data-issue-with-siem-and-auditbeat/226945 "2020-04-07T15:56:45Z")
Hello All, I am setting up an ELK stack and auditbeat and filebeat are sending logs to logstash and ingesting them correctly in Elasticsearch. When I go to SIEM, an error is thrown in the host and network section that … --- ## [Logstash generate a random number for an HTTP wait request?](https://discuss.elastic.co/t/logstash-generate-a-random-number-for-an-http-wait-request/226936)
**Author:** [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)\ **Replies:** 2\ **Last updated:** [April 7, 2020, 3:53pm UTC](https://discuss.elastic.co/t/logstash-generate-a-random-number-for-an-http-wait-request/226936 "2020-04-07T15:53:39Z")
hi, i have a logstash http filter that reaches out to a public API for enrichment of the data. i'm limited to 1 request per second. i've thrown a "sleep" filter in.. to make it wait 1 second.. i'm still getting "reques… --- ## [Shodan query returns an ugly result i cant seem to fix](https://discuss.elastic.co/t/shodan-query-returns-an-ugly-result-i-cant-seem-to-fix/226778)
**Author:** [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)\ **Replies:** 1\ **Last updated:** [April 7, 2020, 3:24pm UTC](https://discuss.elastic.co/t/shodan-query-returns-an-ugly-result-i-cant-seem-to-fix/226778 "2020-04-07T15:24:01Z")
hi, i'm querying shodan.io with some ip addresses.. every so often i get this message : \[2020-04-06T20:37:51,625\]\[WARN \]\[logstash.outputs.elasticsearch\]\[darkwebrdp-hospitals\] Could not index event to Elasticsearch. {:st… --- ## [Why Kibana alerts are not consistent?](https://discuss.elastic.co/t/why-kibana-alerts-are-not-consistent/223553)
**Author:** [@gunjan\_prmr](https://discuss.elastic.co/u/gunjan_prmr)\ **Replies:** 10\ **Last updated:** [April 7, 2020, 3:18pm UTC](https://discuss.elastic.co/t/why-kibana-alerts-are-not-consistent/223553 "2020-04-07T15:18:11Z")
I have Kibana alert where I am NOT getting all alerts. This is inconsistent behavior where it works some times and sometimes not. I am not sure why. Based on my condition I am checking certain status every minute (now -… --- ## [Need help with key-value pair extraction](https://discuss.elastic.co/t/need-help-with-key-value-pair-extraction/226819)
**Author:** [@Nithani25](https://discuss.elastic.co/u/Nithani25)\ **Replies:** 1\ **Last updated:** [April 7, 2020, 3:17pm UTC](https://discuss.elastic.co/t/need-help-with-key-value-pair-extraction/226819 "2020-04-07T15:17:51Z")
HI Team, I have split last field of my message has greedydata, however in some case, i have some key-value pair which needs extraction. key-value format message: CurrentURL = /google/search , UserID = nishchen83 I wa… --- ## [Move to pipeline-to-pipeline communiction](https://discuss.elastic.co/t/move-to-pipeline-to-pipeline-communiction/226379)
**Author:** [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\ **Replies:** 2\ **Last updated:** [April 7, 2020, 3:16pm UTC](https://discuss.elastic.co/t/move-to-pipeline-to-pipeline-communiction/226379 "2020-04-07T15:16:27Z")
Hi, Today we have a pretty complicated single pipeline comprised mostly of a lot of conditionals to route everything to its right place. One issue with this that we've noticed is if a output goes down, it affects the wh… --- ## [Help with basic filtering of eventID from winlogbeat](https://discuss.elastic.co/t/help-with-basic-filtering-of-eventid-from-winlogbeat/226909)
**Author:** [@sbagciva](https://discuss.elastic.co/u/sbagciva)\ **Replies:** 2\ **Last updated:** [April 7, 2020, 3:06pm UTC](https://discuss.elastic.co/t/help-with-basic-filtering-of-eventid-from-winlogbeat/226909 "2020-04-07T15:06:15Z")
so Im trying to filter out a event code in my logstash conf file.. so I have the basic conf.. input { beats { port =\> .... type =\> "log" } } to filter I put this filter { if \[type\] == "wineventlog" and \[event\_i… --- ## [How to configure filebeat for logstash cluster environment?](https://discuss.elastic.co/t/how-to-configure-filebeat-for-logstash-cluster-environment/226851)
**Author:** [@manish.sapariya](https://discuss.elastic.co/u/manish.sapariya)\ **Replies:** 3\ **Last updated:** [April 7, 2020, 2:52pm UTC](https://discuss.elastic.co/t/how-to-configure-filebeat-for-logstash-cluster-environment/226851 "2020-04-07T14:52:31Z")
I am missing something very basic when I think of how Filebeat will be configured in a clustered logstash setup. As per the article https://www.elastic.co/guide/en/logstash/current/deploying-and-scaling.html and this ar… --- ## [MITRE ATT&CK detection](https://discuss.elastic.co/t/mitre-att-ck-detection/226919)
**Author:** [@Mangolinux](https://discuss.elastic.co/u/Mangolinux)\ **Replies:** 0\ **Last updated:** [April 7, 2020, 2:51pm UTC](https://discuss.elastic.co/t/mitre-att-ck-detection/226919 "2020-04-07T14:51:50Z")
How do I configure Elastic to show MITRE ATT&CK technique ID's? I am using Atomic Red Team to simulate ATT&CK tactics against Windows and Linux host but I don't see the attacks in my logs. Using filebeat and winlogbeat --- ## [Logstash does not show outout in the console while using file plugin. But when i give same input from stdin the out is printed in the console](https://discuss.elastic.co/t/logstash-does-not-show-outout-in-the-console-while-using-file-plugin-but-when-i-give-same-input-from-stdin-the-out-is-printed-in-the-console/226872)
**Author:** [@saikumar374265](https://discuss.elastic.co/u/saikumar374265)\ **Replies:** 1\ **Last updated:** [April 7, 2020, 2:50pm UTC](https://discuss.elastic.co/t/logstash-does-not-show-outout-in-the-console-while-using-file-plugin-but-when-i-give-same-input-from-stdin-the-out-is-printed-in-the-console/226872 "2020-04-07T14:50:23Z")
logstash does not show outout in the console while using file plugin. But when i give same input from stdin the out is printed in the console. Here is my config file input { file { path =\> "C:\\Users\\503160527\\test.lo… --- ## [The differences between @timestamp and time in log file](https://discuss.elastic.co/t/the-differences-between-timestamp-and-time-in-log-file/226804)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 2\ **Last updated:** [April 7, 2020, 2:48pm UTC](https://discuss.elastic.co/t/the-differences-between-timestamp-and-time-in-log-file/226804 "2020-04-07T14:48:07Z")
Hi all I have a question about the @timestamp, i know that @timestamp are what generate by logstash but i dont really know how it work. For ex: i have a server that are config with time that are wrong. It set the date … --- ## [Log stash service not generating logs](https://discuss.elastic.co/t/log-stash-service-not-generating-logs/226887)
**Author:** [@Seetharaman\_K](https://discuss.elastic.co/u/Seetharaman_K)\ **Replies:** 0\ **Last updated:** [April 7, 2020, 12:00pm UTC](https://discuss.elastic.co/t/log-stash-service-not-generating-logs/226887 "2020-04-07T12:00:53Z")
All , below is the only one one content am seeing in the log file , \[2020-04-07T11:32:07,198\]\[WARN \]\[logstash.runner \] SIGINT received. Shutting down. \[2020-04-07T11:32:10,086\]\[INFO \]\[logstash.javapipeline … --- ## [Disable cluster setting: xpack.monitoring.enabled](https://discuss.elastic.co/t/disable-cluster-setting-xpack-monitoring-enabled/226505)
**Author:** [@Itay\_Bittan](https://discuss.elastic.co/u/Itay_Bittan)\ **Replies:** 7\ **Last updated:** [April 7, 2020, 2:41pm UTC](https://discuss.elastic.co/t/disable-cluster-setting-xpack-monitoring-enabled/226505 "2020-04-07T14:41:53Z")
Setup: Elasticsearch 6.3.0 with 19 nodes: 12 data nodes 4 client nodes 3 master nodes We have around: Cluster size: ~820GB (~175GB of them are .monitoring indices) 1,030,000,000 documents in the cluster (900,000,00… --- ## [Breakdown Y-Axis value by other terms](https://discuss.elastic.co/t/breakdown-y-axis-value-by-other-terms/226911)
**Author:** [@ethranes](https://discuss.elastic.co/u/ethranes)\ **Replies:** 1\ **Last updated:** [April 7, 2020, 2:23pm UTC](https://discuss.elastic.co/t/breakdown-y-axis-value-by-other-terms/226911 "2020-04-07T14:23:40Z")
Hi, I am working on building a vizualisation that shows the amount of time a person has worked on tasks. I am able to create a vizualisation showing the total amount of time a person has spent on a task, but now I want t… --- ## [FSCrawler - Elastic Mapping Changes](https://discuss.elastic.co/t/fscrawler-elastic-mapping-changes/226867)
**Author:** [@Sarath\_Pullabhotla](https://discuss.elastic.co/u/Sarath_Pullabhotla)\ **Replies:** 3\ **Last updated:** [April 7, 2020, 2:19pm UTC](https://discuss.elastic.co/t/fscrawler-elastic-mapping-changes/226867 "2020-04-07T14:19:51Z")
Hi, Can anyone please guide me on the below. Q1) Is it possible for us to change the tag names in elastic search while ingesting documents using fscrawler. Example: The content that a file has is getting ingested und… --- ## [numHits must be \> 0; please use TotalHitCountCollector if you just need the total hit count](https://discuss.elastic.co/t/numhits-must-be-0-please-use-totalhitcountcollector-if-you-just-need-the-total-hit-count/226516)
**Author:** [@Casper\_Skydt](https://discuss.elastic.co/u/Casper_Skydt)\ **Replies:** 4\ **Last updated:** [April 7, 2020, 2:10pm UTC](https://discuss.elastic.co/t/numhits-must-be-0-please-use-totalhitcountcollector-if-you-just-need-the-total-hit-count/226516 "2020-04-07T14:10:24Z")
Once in a while i get the following error: numHits must be \> 0; please use TotalHitCountCollector if you just need the total hit count The query is the following, with varying 'from', but never larger than 750: { … --- ## [One of the kibana node not loading](https://discuss.elastic.co/t/one-of-the-kibana-node-not-loading/224629)
**Author:** [@priyashree](https://discuss.elastic.co/u/priyashree)\ **Replies:** 7\ **Last updated:** [April 7, 2020, 2:06pm UTC](https://discuss.elastic.co/t/one-of-the-kibana-node-not-loading/224629 "2020-04-07T14:06:49Z")
I have a ES cluster with 5 data nodes, 2 http nodes, 3 master nodes. On the 3 master nodes I have installed kibana, filebeat, metricbeat. However, the kibana takes a lot of time to load and finally gives error 'Request T… --- ## [Kibana showing bad gateway / not starting properly - 7.6.2](https://discuss.elastic.co/t/kibana-showing-bad-gateway-not-starting-properly-7-6-2/226724)
**Author:** [@ltm](https://discuss.elastic.co/u/ltm)\ **Replies:** 3\ **Last updated:** [April 7, 2020, 1:54pm UTC](https://discuss.elastic.co/t/kibana-showing-bad-gateway-not-starting-properly-7-6-2/226724 "2020-04-07T13:54:54Z")
Hello guys, I've a cluster on 7.6.2 on top of Oracle Linux distro. Master Nodes - 3 DataNodes - 3 When I try to install the Kibana 7.62, I always get "bad gateway 502" when I reach the 5601 port. I've tested with th… --- ## [Elastic watcher - modify query result value before condition](https://discuss.elastic.co/t/elastic-watcher-modify-query-result-value-before-condition/226908)
**Author:** [@vdelcampo](https://discuss.elastic.co/u/vdelcampo)\ **Replies:** 0\ **Last updated:** [April 7, 2020, 1:40pm UTC](https://discuss.elastic.co/t/elastic-watcher-modify-query-result-value-before-condition/226908 "2020-04-07T13:40:04Z")
Hi. Im trying to create a watcher to compare two query results. Here is my code (it works): { "trigger": { "schedule": { "interval": "1m" } }, "input": { "chain": { "inputs": \[ { "first": … --- ## [How to ingest kv field values as seperate records in kibana](https://discuss.elastic.co/t/how-to-ingest-kv-field-values-as-seperate-records-in-kibana/226904)
**Author:** [@Mithuna](https://discuss.elastic.co/u/Mithuna)\ **Replies:** 0\ **Last updated:** [April 7, 2020, 1:28pm UTC](https://discuss.elastic.co/t/how-to-ingest-kv-field-values-as-seperate-records-in-kibana/226904 "2020-04-07T13:28:31Z")
Hi, I'm trying to ingest API data into kibana with Logstash. In this i'm not getting the value as expected. My config file is input { stdin{} http\_poller { urls =\> { q1 =\> { method =\> get user =\> "me" password … --- ## [Get the number of documents of index in snapshot?](https://discuss.elastic.co/t/get-the-number-of-documents-of-index-in-snapshot/226875)
**Author:** [@Arp](https://discuss.elastic.co/u/Arp)\ **Replies:** 3\ **Last updated:** [April 7, 2020, 12:57pm UTC](https://discuss.elastic.co/t/get-the-number-of-documents-of-index-in-snapshot/226875 "2020-04-07T12:57:27Z")
Hi, Is it possible to get the number of documents an index in a snapshot has? I know how to do this for actual indices. I can see which indices are in snapshot, but I can't figure out how to get the number of documents … --- ## [No Endpoints for port 9300](https://discuss.elastic.co/t/no-endpoints-for-port-9300/221542)
**Author:** [@dtapia](https://discuss.elastic.co/u/dtapia)\ **Replies:** 3\ **Last updated:** [April 7, 2020, 12:54pm UTC](https://discuss.elastic.co/t/no-endpoints-for-port-9300/221542 "2020-04-07T12:54:09Z")
When I deploy a new instance of ECK, I only see services with port 9200 service/r4e-elasticsearch-datastore-cluster-es-http ClusterIP 10.224.83.227 \ 9200/TCP … --- ## [Logstash: TypeError: no implicit conversion of nil into string](https://discuss.elastic.co/t/logstash-typeerror-no-implicit-conversion-of-nil-into-string/224219)
**Author:** [@manojkrishna561994](https://discuss.elastic.co/u/manojkrishna561994)\ **Replies:** 2\ **Last updated:** [April 7, 2020, 12:48pm UTC](https://discuss.elastic.co/t/logstash-typeerror-no-implicit-conversion-of-nil-into-string/224219 "2020-04-07T12:48:08Z")
I'm new to ELK and trying to input 3rd party REST API to Logstash to feed data into it. I'm getting TypeError: no implicit conversion of nil into string. I'm using http\_input\_poller plugin to feed data. Here is configur… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1526) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1528)