# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1532 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1533 --- ## [Export exact log message from elastic searc](https://discuss.elastic.co/t/export-exact-log-message-from-elastic-searc/226559)
**Author:** [@Baharul](https://discuss.elastic.co/u/Baharul)\ **Replies:** 0\ **Last updated:** [April 5, 2020, 9:39am UTC](https://discuss.elastic.co/t/export-exact-log-message-from-elastic-searc/226559 "2020-04-05T09:39:23Z")
Hi , As a part of docker application we are sending all logs (server logs , application logs) to ELK . For analyzing product behavior we need to extract some logs in exact format that server generate like below screen a… --- ## [Another multiple index question, I think](https://discuss.elastic.co/t/another-multiple-index-question-i-think/226265)
**Author:** [@john.barfield](https://discuss.elastic.co/u/john.barfield)\ **Replies:** 3\ **Last updated:** [April 5, 2020, 7:36am UTC](https://discuss.elastic.co/t/another-multiple-index-question-i-think/226265 "2020-04-05T07:36:38Z")
I am an elastic noob running on version 6.8 of the stack, who has been searching for a good way, I believe, to aggregate data from 2 or more indices for about 2 days now. Here is the scenario, I have an index that is ac… --- ## [Exporting and importing Elastic data](https://discuss.elastic.co/t/exporting-and-importing-elastic-data/224470)
**Author:** [@Daniel\_Lupisella](https://discuss.elastic.co/u/Daniel_Lupisella)\ **Replies:** 2\ **Last updated:** [April 5, 2020, 6:25am UTC](https://discuss.elastic.co/t/exporting-and-importing-elastic-data/224470 "2020-04-05T06:25:24Z")
Hello all, I recently was using Elastic to do some testing. I exported the data from my running instance of Elastic using the Save, Share, Generate CSV method. I started up a new instance to continue working at home (… --- ## [I am unable to parse certain JSON messages](https://discuss.elastic.co/t/i-am-unable-to-parse-certain-json-messages/225888)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 6\ **Last updated:** [April 5, 2020, 6:16am UTC](https://discuss.elastic.co/t/i-am-unable-to-parse-certain-json-messages/225888 "2020-04-05T06:16:48Z")
Hi Guys, I am trying to parse Json formatted messages certain messages are getting parsed properly; while certain are showing as jsonparsefailure. Then I checked the same message online json viewer and it gets parsed pe… --- ## [Logging Cluster Architecture](https://discuss.elastic.co/t/logging-cluster-architecture/225715)
**Author:** [@LaurentB1](https://discuss.elastic.co/u/LaurentB1)\ **Replies:** 2\ **Last updated:** [April 5, 2020, 3:26am UTC](https://discuss.elastic.co/t/logging-cluster-architecture/225715 "2020-04-05T03:26:19Z")
Dear all, I want to setup a logging cluster with ES. The ingestion should be 2000 Event per Seconds, meaning 160GB per day (hypothesis: 1 log is 1kb). The retention time is 365 days and the hot retention time is 15 days… --- ## [Unable to configure plugins](https://discuss.elastic.co/t/unable-to-configure-plugins/226526)
**Author:** [@jeffzhao](https://discuss.elastic.co/u/jeffzhao)\ **Replies:** 1\ **Last updated:** [April 4, 2020, 9:23pm UTC](https://discuss.elastic.co/t/unable-to-configure-plugins/226526 "2020-04-04T21:23:51Z")
Hi, I'm using Elasticsearch 1.7 and trying to copy documents from old index to new index using Logstash 7.6. Here is my configuration file: input { # We read from the "old" cluster elasticsearch { hosts =\> \[ "… --- ## [Completed my search ui app, node/react -- how do I deploy to website](https://discuss.elastic.co/t/completed-my-search-ui-app-node-react-how-do-i-deploy-to-website/226536)
**Author:** [@nickdeckerdevs](https://discuss.elastic.co/u/nickdeckerdevs)\ **Replies:** 1\ **Last updated:** [April 4, 2020, 8:00pm UTC](https://discuss.elastic.co/t/completed-my-search-ui-app-node-react-how-do-i-deploy-to-website/226536 "2020-04-04T20:00:00Z")
Hey all, I'm a little confused on this and I've been trying to find some resources on this but I just think I'm not searching for the right words as I am not sure what I'm really trying to do. I'm trying to take my reac… --- ## [Sum with unique object](https://discuss.elastic.co/t/sum-with-unique-object/225425)
**Author:** [@Emna1](https://discuss.elastic.co/u/Emna1)\ **Replies:** 15\ **Last updated:** [April 4, 2020, 5:09pm UTC](https://discuss.elastic.co/t/sum-with-unique-object/225425 "2020-04-04T17:09:49Z")
For example if i have csv file with fields; Car, parking,date of entry V1, p1, 12-03-2020 12:30 V1, p1, 12-03-2020 11:30 V2, p2,12-03-2020 10:30 V2, p2,12-03-2020 10:45 How can i calculate number of time V1 enter… --- ## [How to handle network.direction:unknown?](https://discuss.elastic.co/t/how-to-handle-network-direction-unknown/226143)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 2\ **Last updated:** [April 4, 2020, 4:29pm UTC](https://discuss.elastic.co/t/how-to-handle-network-direction-unknown/226143 "2020-04-04T16:29:14Z")
I'm getting detections where the network.direction is "unknown". Upon investigation this is just the source port from a vulnerability scanner (Detectify) : "destination": { "bytes": 4128, "ip": "52.17.98.131",… --- ## [Gsub remove square bracket](https://discuss.elastic.co/t/gsub-remove-square-bracket/226508)
**Author:** [@mattiacareddu](https://discuss.elastic.co/u/mattiacareddu)\ **Replies:** 2\ **Last updated:** [April 4, 2020, 4:23pm UTC](https://discuss.elastic.co/t/gsub-remove-square-bracket/226508 "2020-04-04T16:23:43Z")
I'm trying to remove square bracket from my string using gsub filter. The string is something like this: '\["/path/to/1","/path/to/2"\]' I tried different ways to remove the square bracket "\[" and "\]" in order to get a … --- ## [Unable to start logstash. The same configuration works in another node and index is created](https://discuss.elastic.co/t/unable-to-start-logstash-the-same-configuration-works-in-another-node-and-index-is-created/226519)
**Author:** [@ranjini](https://discuss.elastic.co/u/ranjini)\ **Replies:** 0\ **Last updated:** [April 4, 2020, 3:15pm UTC](https://discuss.elastic.co/t/unable-to-start-logstash-the-same-configuration-works-in-another-node-and-index-is-created/226519 "2020-04-04T15:15:30Z")
Logstash configuration works fine when output is tested with output { stdout { codec =\> rubydebug } } when sent to ES it errors out. \`input { file { path =\> "/opt/tomcat/logs/ds.log" start\_position =\> "beginning" … --- ## [My nested json is not getting parsed correctly, need help pls](https://discuss.elastic.co/t/my-nested-json-is-not-getting-parsed-correctly-need-help-pls/226317)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 3\ **Last updated:** [April 4, 2020, 1:58pm UTC](https://discuss.elastic.co/t/my-nested-json-is-not-getting-parsed-correctly-need-help-pls/226317 "2020-04-04T13:58:13Z")
Hi Folks, Pertaining to my other thread I am trying to parse my below message with logstash however this is somehow is not happening. Can someone pls help me sorting out the issue pls? Or Any hint is really appreciated… --- ## [Suppress deprecation notice using 6.8](https://discuss.elastic.co/t/suppress-deprecation-notice-using-6-8/226494)
**Author:** [@nages](https://discuss.elastic.co/u/nages)\ **Replies:** 5\ **Last updated:** [April 4, 2020, 12:14pm UTC](https://discuss.elastic.co/t/suppress-deprecation-notice-using-6-8/226494 "2020-04-04T12:14:07Z")
I created a brand new index, the following deprecation notice is displayed. How to suppress it . Version : 6.8.8 #! Deprecation: the default number of shards will change from \[5\] to \[1\] in 7.0.0; if you wish to contin… --- ## [Elasticsearch sql is not working for some index](https://discuss.elastic.co/t/elasticsearch-sql-is-not-working-for-some-index/226223)
**Author:** [@sunitha.eswaraiah](https://discuss.elastic.co/u/sunitha.eswaraiah)\ **Replies:** 2\ **Last updated:** [April 4, 2020, 11:25am UTC](https://discuss.elastic.co/t/elasticsearch-sql-is-not-working-for-some-index/226223 "2020-04-04T11:25:02Z")
Hi, I'm unable to apply sql query on one index and i get this error, { "error": { "root\_cause": \[ { "type": "unsupported\_operation\_exception", "reason": null } \], "type": "unsu… --- ## [Lucene logging in ElasticSearch logs](https://discuss.elastic.co/t/lucene-logging-in-elasticsearch-logs/226497)
**Author:** [@dextermorgan](https://discuss.elastic.co/u/dextermorgan)\ **Replies:** 2\ **Last updated:** [April 4, 2020, 11:15am UTC](https://discuss.elastic.co/t/lucene-logging-in-elasticsearch-logs/226497 "2020-04-04T11:15:06Z")
I am on Elasticsearch 7.6.1 and to debug some issues, want to enable lucene logging in ES logs. Can anyone help with how can enable that? --- ## [Not able to change server.host to 0.0.0.0](https://discuss.elastic.co/t/not-able-to-change-server-host-to-0-0-0-0/226467)
**Author:** [@bikramsingh](https://discuss.elastic.co/u/bikramsingh)\ **Replies:** 2\ **Last updated:** [April 4, 2020, 9:31am UTC](https://discuss.elastic.co/t/not-able-to-change-server-host-to-0-0-0-0/226467 "2020-04-04T09:31:39Z")
I have elasticsearch running on a vm. I am trying to access it outside the vm. when i tired to assign the server.host to either the vm's ip or 0.0.0.0 elasticsearch service doesn't start. any tips? --- ## [\\Java\\jre1.8.0\_241\\bin\\java.exe" -cp "!ES\_CLASSPATH!" "org.elasticsearch.tools.launchers.TempDirectory""\` was unexpected at this time](https://discuss.elastic.co/t/java-jre1-8-0-241-bin-java-exe-cp-es-classpath-org-elasticsearch-tools-launchers-tempdirectory-was-unexpected-at-this-time/226503)
**Author:** [@Abhishek\_Pasupullete](https://discuss.elastic.co/u/Abhishek_Pasupullete)\ **Replies:** 0\ **Last updated:** [April 4, 2020, 9:23am UTC](https://discuss.elastic.co/t/java-jre1-8-0-241-bin-java-exe-cp-es-classpath-org-elasticsearch-tools-launchers-tempdirectory-was-unexpected-at-this-time/226503 "2020-04-04T09:23:32Z")
Hi All, I am getting following error when starting elastic search. \\Java\\jre1.8.0\_241\\bin\\java.exe" -cp "!ES\_CLASSPATH!" "org.elasticsearch.tools.launchers.TempDirectory""\` was unexpected at this time. JAVA\_HOME and … --- ## [않은 waldheim33.com/yes/ - 샌즈카지노](https://discuss.elastic.co/t/waldheim33-com-yes/226500)
**Author:** [@moondrew3w](https://discuss.elastic.co/u/moondrew3w)\ **Replies:** 0\ **Last updated:** [April 4, 2020, 8:31am UTC](https://discuss.elastic.co/t/waldheim33-com-yes/226500 "2020-04-04T08:31:56Z")
뭔가 좋지 않은 https://waldheim33.com/yes/ - 샌즈카지노기분을 더나인카지노느낀 코인카지노기현이 퍼스트카지노움찔하며 더킹카지노한영의 우리카지노등뒤로 물러섰다. 한영과 함께 온 유택천의 패거리도 왠지 모를 기선에 뒤로 물러났다. 민형 --- ## [For policies that include the rollover action, you must also bootstrap the index with a write alias after creating the index template](https://discuss.elastic.co/t/for-policies-that-include-the-rollover-action-you-must-also-bootstrap-the-index-with-a-write-alias-after-creating-the-index-template/226495)
**Author:** [@Daud\_Ahmed](https://discuss.elastic.co/u/Daud_Ahmed)\ **Replies:** 0\ **Last updated:** [April 4, 2020, 4:01am UTC](https://discuss.elastic.co/t/for-policies-that-include-the-rollover-action-you-must-also-bootstrap-the-index-with-a-write-alias-after-creating-the-index-template/226495 "2020-04-04T04:01:06Z")
I was reading this great article ... https://www.elastic.co/blog/implementing-hot-warm-cold-in-elasticsearch-with-index-lifecycle-management But in this article there is a line as following For policies that include t… --- ## [Terms Aggregration on Array of Strings with repeated values](https://discuss.elastic.co/t/terms-aggregration-on-array-of-strings-with-repeated-values/226490)
**Author:** [@daveisfera](https://discuss.elastic.co/u/daveisfera)\ **Replies:** 0\ **Last updated:** [April 4, 2020, 2:21am UTC](https://discuss.elastic.co/t/terms-aggregration-on-array-of-strings-with-repeated-values/226490 "2020-04-04T02:21:54Z")
As a follow on to this previous post ( https://discuss.elastic.co/t/terms-aggregation-on-array-of-string/195775 ), how can value\_count be used to get the actual count of repeated values in an array? If a value\_count is u… --- ## [Data table bucket over multiple fields](https://discuss.elastic.co/t/data-table-bucket-over-multiple-fields/225234)
**Author:** [@craigh](https://discuss.elastic.co/u/craigh)\ **Replies:** 2\ **Last updated:** [April 4, 2020, 12:59am UTC](https://discuss.elastic.co/t/data-table-bucket-over-multiple-fields/225234 "2020-04-04T00:59:18Z")
Hi, I have league game's linescores stored in an index. For each game, the team could be in either: for Boston Bruin away games: linescore.teams.away.team.name: Boston Bruins or for Boston Bruin home games: linesco… --- ## [Elastic Search Query to fetch data control or special characters](https://discuss.elastic.co/t/elastic-search-query-to-fetch-data-control-or-special-characters/223839)
**Author:** [@MangeshTech](https://discuss.elastic.co/u/MangeshTech)\ **Replies:** 4\ **Last updated:** [April 3, 2020, 10:38pm UTC](https://discuss.elastic.co/t/elastic-search-query-to-fetch-data-control-or-special-characters/223839 "2020-04-03T22:38:58Z")
Trying to search for severity values with special characters in it e.g. "1 - Critical". tried with backslashes to see if I can get the exact results. If I change the query below with "\*2 \\\\- Cri\*", it also returns doc… --- ## [How to build a grok filter for only part of the log line/parsing data multiple times for different fields](https://discuss.elastic.co/t/how-to-build-a-grok-filter-for-only-part-of-the-log-line-parsing-data-multiple-times-for-different-fields/226073)
**Author:** [@ajmcateer](https://discuss.elastic.co/u/ajmcateer)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 10:26pm UTC](https://discuss.elastic.co/t/how-to-build-a-grok-filter-for-only-part-of-the-log-line-parsing-data-multiple-times-for-different-fields/226073 "2020-04-03T22:26:41Z")
I apologize if this is something not allowed, I am new to Kibana and having issues parsing logs. I want to parse the log below but I am unsure exactly how to go about it. 2020-03-31T13:35:31.83186256Z stdout F 31-Mar-20… --- ## [User in xpack security not added](https://discuss.elastic.co/t/user-in-xpack-security-not-added/223983)
**Author:** [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\ **Replies:** 13\ **Last updated:** [April 3, 2020, 8:57pm UTC](https://discuss.elastic.co/t/user-in-xpack-security-not-added/223983 "2020-04-03T20:57:52Z")
I am trying to add user in kibana after running the ./bin/kibana-keystore add elasticsearch.username --allow-root and password command in Kibana folder. But when I restart kibana after setting username and password, i ge… --- ## [Logstash input multiline codec Entire file is getting merged into single line](https://discuss.elastic.co/t/logstash-input-multiline-codec-entire-file-is-getting-merged-into-single-line/226453)
**Author:** [@ranjith](https://discuss.elastic.co/u/ranjith)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 8:40pm UTC](https://discuss.elastic.co/t/logstash-input-multiline-codec-entire-file-is-getting-merged-into-single-line/226453 "2020-04-03T20:40:55Z")
Hi All, I am creating a logstash pipeline to process the following logs My logstash config is input{ file{ path =\> "E:/Grok\_Practice/Practice/e.log" start\_position =\> "beginning" sincedb\_path =\> "LOG\_NULL" co… --- ## [Reading Config Files in pipeline.yml from another location](https://discuss.elastic.co/t/reading-config-files-in-pipeline-yml-from-another-location/225511)
**Author:** [@InfiniteLoops](https://discuss.elastic.co/u/InfiniteLoops)\ **Replies:** 2\ **Last updated:** [April 3, 2020, 8:37pm UTC](https://discuss.elastic.co/t/reading-config-files-in-pipeline-yml-from-another-location/225511 "2020-04-03T20:37:40Z")
I have all of my setup working fine. One issue is around the config files for the filters. Logstash is sitting on a remote machine and when a particular part of a filter needs to be changed this needs to be logged into a… --- ## [One logstash http input with multiple basic auth users](https://discuss.elastic.co/t/one-logstash-http-input-with-multiple-basic-auth-users/226442)
**Author:** [@mindhunt3r](https://discuss.elastic.co/u/mindhunt3r)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 8:36pm UTC](https://discuss.elastic.co/t/one-logstash-http-input-with-multiple-basic-auth-users/226442 "2020-04-03T20:36:41Z")
I want to setup a logstash pipeline with multiple users/passwords and use the different usernames to direct output to different elasticsearch indexes where each username has read/write access to the specific index so sam… --- ## [High Level Rest Client client.inces().create(...) is deprecated](https://discuss.elastic.co/t/high-level-rest-client-client-inces-create-is-deprecated/225708)
**Author:** [@Cat](https://discuss.elastic.co/u/Cat)\ **Replies:** 2\ **Last updated:** [April 3, 2020, 7:56pm UTC](https://discuss.elastic.co/t/high-level-rest-client-client-inces-create-is-deprecated/225708 "2020-04-03T19:56:49Z")
what is the replacement method for this? --- ## [Cisco ASA Logging to Elastic Stack](https://discuss.elastic.co/t/cisco-asa-logging-to-elastic-stack/226386)
**Author:** [@msalax](https://discuss.elastic.co/u/msalax)\ **Replies:** 3\ **Last updated:** [April 3, 2020, 7:43pm UTC](https://discuss.elastic.co/t/cisco-asa-logging-to-elastic-stack/226386 "2020-04-03T19:43:56Z")
Hi All, I'm new to elastic stack and have built x2 dedicated logstash servers and a cluster of 3 elasticsearch servers and kibana install on all of them. I'm not sure if that last part is correct but any advise would be… --- ## [Active Guests Count](https://discuss.elastic.co/t/active-guests-count/225549)
**Author:** [@deutschermann](https://discuss.elastic.co/u/deutschermann)\ **Replies:** 2\ **Last updated:** [April 3, 2020, 6:50pm UTC](https://discuss.elastic.co/t/active-guests-count/225549 "2020-04-03T18:50:37Z")
I want to know the count and details of active guests in hotel. I have check-in time and check-out time. Check-out time is null, if guest is still in the hotel. I have another column, which says "Status", like, 'checke… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1531) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1533)