# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1545 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1546 --- ## [Can Elasticsearch run together with a Cloudera instance?](https://discuss.elastic.co/t/can-elasticsearch-run-together-with-a-cloudera-instance/225593)
**Author:** [@Miguel\_Plazas](https://discuss.elastic.co/u/Miguel_Plazas)\ **Replies:** 2\ **Last updated:** [March 30, 2020, 1:16pm UTC](https://discuss.elastic.co/t/can-elasticsearch-run-together-with-a-cloudera-instance/225593 "2020-03-30T13:16:04Z")
I would like if it's possible to run elasticsearch with a cloudera instance? The nodes have 1TB of RAM. Thanks. --- ## [How do I search for this "#Success" in the message field?](https://discuss.elastic.co/t/how-do-i-search-for-this-success-in-the-message-field/225475)
**Author:** [@newmember](https://discuss.elastic.co/u/newmember)\ **Replies:** 1\ **Last updated:** [March 30, 2020, 1:05pm UTC](https://discuss.elastic.co/t/how-do-i-search-for-this-success-in-the-message-field/225475 "2020-03-30T13:05:37Z")
I have tried all kinds of syntax variations and I cant query for "#Success" #Success /\\W\[S\]uccess /\\W\[S\]uccess/ \\#Success Its tough because I don't see the "#" as a special character. Most of the search results show '… --- ## [Aggregations after upgrading to ES 7 - request slowed down](https://discuss.elastic.co/t/aggregations-after-upgrading-to-es-7-request-slowed-down/224992)
**Author:** [@egoMojKolego](https://discuss.elastic.co/u/egoMojKolego)\ **Replies:** 4\ **Last updated:** [March 30, 2020, 12:59pm UTC](https://discuss.elastic.co/t/aggregations-after-upgrading-to-es-7-request-slowed-down/224992 "2020-03-30T12:59:20Z")
Hi all, in our app, we updated version of ES from 6 to 7. Everything is working fine as it was but I spot one issue. Previously when we retrive aggregations for 200k of medias, it took 10-15 sec, right now same reques… --- ## [Problem elastic search not down](https://discuss.elastic.co/t/problem-elastic-search-not-down/225658)
**Author:** [@Youssef\_SBAI](https://discuss.elastic.co/u/Youssef_SBAI)\ **Replies:** 1\ **Last updated:** [March 30, 2020, 12:36pm UTC](https://discuss.elastic.co/t/problem-elastic-search-not-down/225658 "2020-03-30T12:36:22Z")
I have this problem when in start elastic search invalid mount config for type "bind": bind mount source path does not exist: /data/volumes/monitoring/elasticsearch/data --- ## [Bulk edit visualizations?](https://discuss.elastic.co/t/bulk-edit-visualizations/225547)
**Author:** [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\ **Replies:** 1\ **Last updated:** [March 30, 2020, 12:19pm UTC](https://discuss.elastic.co/t/bulk-edit-visualizations/225547 "2020-03-30T12:19:30Z")
Is there a way to do this? Maybe access JSON somehow? Rationale: On nearly every vis I have to edit the search params to include '.keyword'. The charts that are installed by packetbeat, auditbeat, etc don't work (for me… --- ## [Аггрегации с нулевыми полями](https://discuss.elastic.co/t/topic/225397)
**Author:** [@Ekaterina\_Nekrasova](https://discuss.elastic.co/u/Ekaterina_Nekrasova)\ **Replies:** 2\ **Last updated:** [March 30, 2020, 10:56am UTC](https://discuss.elastic.co/t/topic/225397 "2020-03-30T10:56:47Z")
Всем привет ! у меня есть тип Person, в котором есть поле GroupId, которое может быть заполненно , может быть нулевым, а так же может даже не существовать, { Id: 1 Name : TоTo, GroupId: 1 } { Id: 2 Name : TaTo, GroupId… --- ## [Using reindex api from kibana fails, but works from curl](https://discuss.elastic.co/t/using-reindex-api-from-kibana-fails-but-works-from-curl/225660)
**Author:** [@Norman\_Khine](https://discuss.elastic.co/u/Norman_Khine)\ **Replies:** 0\ **Last updated:** [March 30, 2020, 10:56am UTC](https://discuss.elastic.co/t/using-reindex-api-from-kibana-fails-but-works-from-curl/225660 "2020-03-30T10:56:26Z")
Hello, A bit of strange issue which I am unclear as to why it could happen, it is related to https://discuss.elastic.co/t/merge-multiple-indices-in-one/220543 Currently I have a single index where I am reindexing this … --- ## [Move all fields to a subfield?](https://discuss.elastic.co/t/move-all-fields-to-a-subfield/225563)
**Author:** [@sliddjur](https://discuss.elastic.co/u/sliddjur)\ **Replies:** 2\ **Last updated:** [March 30, 2020, 10:29am UTC](https://discuss.elastic.co/t/move-all-fields-to-a-subfield/225563 "2020-03-30T10:29:00Z")
I want to move all my fields to a specified subfield. However, I don't know all the field names. Alternatively if there is a way for grok filter to set the target field or similar? I found an old post that did this, wh… --- ## [How to share custom Elasticsearch plugin specific data across nodes](https://discuss.elastic.co/t/how-to-share-custom-elasticsearch-plugin-specific-data-across-nodes/225654)
**Author:** [@sbrisi](https://discuss.elastic.co/u/sbrisi)\ **Replies:** 0\ **Last updated:** [March 30, 2020, 10:23am UTC](https://discuss.elastic.co/t/how-to-share-custom-elasticsearch-plugin-specific-data-across-nodes/225654 "2020-03-30T10:23:47Z")
How to share custom Elasticsearch plugin-specific data across nodes. Our plugin uses the temp filesystem to store data which would be re-used, how do I share this across multiple nodes in an Elasticsearch cluster without… --- ## [Multiple index search java](https://discuss.elastic.co/t/multiple-index-search-java/225643)
**Author:** [@rohit.singh3](https://discuss.elastic.co/u/rohit.singh3)\ **Replies:** 1\ **Last updated:** [March 30, 2020, 10:15am UTC](https://discuss.elastic.co/t/multiple-index-search-java/225643 "2020-03-30T10:15:53Z")
i want a searchstring to searched in multiple indices. i have written below code: SearchRequest searchRequest = new SearchRequest("indexA","indexB"); SearchSourceBuilder searchSourceBuilder = new SearchSourceBuilder(); … --- ## [Can't downgrade to a correct version of elastic after an attempt to upgrade to 7.6.2](https://discuss.elastic.co/t/cant-downgrade-to-a-correct-version-of-elastic-after-an-attempt-to-upgrade-to-7-6-2/225573)
**Author:** [@Ahmad\_Al-Masry](https://discuss.elastic.co/u/Ahmad_Al-Masry)\ **Replies:** 2\ **Last updated:** [March 30, 2020, 10:04am UTC](https://discuss.elastic.co/t/cant-downgrade-to-a-correct-version-of-elastic-after-an-attempt-to-upgrade-to-7-6-2/225573 "2020-03-30T10:04:49Z")
Hi By mistake, I have the assumption that 7.6.2 is released on container and so I upgraded thee configurations and applied and ECK accepted the configuration. Unfortunately the pods are failing to start and I can't rol… --- ## [Elasticsearch 7.1 have rediculously high disk read io (100%)](https://discuss.elastic.co/t/elasticsearch-7-1-have-rediculously-high-disk-read-io-100/225619)
**Author:** [@huntlyroad](https://discuss.elastic.co/u/huntlyroad)\ **Replies:** 2\ **Last updated:** [March 30, 2020, 9:56am UTC](https://discuss.elastic.co/t/elasticsearch-7-1-have-rediculously-high-disk-read-io-100/225619 "2020-03-30T09:56:00Z")
Hi, We are seeing unexpected write I/O on elasticsearch data nodes. this is what is captured by iotop: As you can see, the disk io is 100% all the time, following is captured detailed threads. Here is the output … --- ## [Return task\_Id after POST](https://discuss.elastic.co/t/return-task-id-after-post/225644)
**Author:** [@Norman\_Khine](https://discuss.elastic.co/u/Norman_Khine)\ **Replies:** 0\ **Last updated:** [March 30, 2020, 9:40am UTC](https://discuss.elastic.co/t/return-task-id-after-post/225644 "2020-03-30T09:40:38Z")
Hello, Is there a way to return the task id after making a POST request, rather than parsing this out from GET /\_tasks/?detailed Any advice is much appreciated? --- ## [Unable to match data, e.g. \`/service/${id}\`](https://discuss.elastic.co/t/unable-to-match-data-e-g-service-id/224356)
**Author:** [@LiuDui](https://discuss.elastic.co/u/LiuDui)\ **Replies:** 4\ **Last updated:** [March 30, 2020, 9:40am UTC](https://discuss.elastic.co/t/unable-to-match-data-e-g-service-id/224356 "2020-03-30T09:40:24Z")
Dev Tools GET http-log/kong/\_search { "query": { "match": { "request.uri": "/service" } }, "size": 0, "aggs": { "group": { "terms": { "field": "request.uri.keyword", "si… --- ## [Indices having filter with required.\_id = NODE\_ID blocking replica shard to allocate](https://discuss.elastic.co/t/indices-having-filter-with-required-id-node-id-blocking-replica-shard-to-allocate/225641)
**Author:** [@oneoneonepig](https://discuss.elastic.co/u/oneoneonepig)\ **Replies:** 0\ **Last updated:** [March 30, 2020, 9:29am UTC](https://discuss.elastic.co/t/indices-having-filter-with-required-id-node-id-blocking-replica-shard-to-allocate/225641 "2020-03-30T09:29:24Z")
My indices are having 1 replicas and 3 shards (3x2) There are some indices having a filter "index.routing.allocation.required.\_id": id-of-a-certain-node, blocking the replica shard to allocate on any node due to two res… --- ## [Aggregating across indices](https://discuss.elastic.co/t/aggregating-across-indices/225215)
**Author:** [@mc\_teo](https://discuss.elastic.co/u/mc_teo)\ **Replies:** 2\ **Last updated:** [March 30, 2020, 9:19am UTC](https://discuss.elastic.co/t/aggregating-across-indices/225215 "2020-03-30T09:19:41Z")
Hi everyone, I've been dabbling with Elasticsearch on and off for a year, but I've recently dusted off an old project and wanted to retrofit it with Elasticsearch. One thing that has me very stumped is being able to ag… --- ## [Unable to Login as Active Directory User per Kibana (but API works)](https://discuss.elastic.co/t/unable-to-login-as-active-directory-user-per-kibana-but-api-works/223514)
**Author:** [@ksremo](https://discuss.elastic.co/u/ksremo)\ **Replies:** 2\ **Last updated:** [March 30, 2020, 9:10am UTC](https://discuss.elastic.co/t/unable-to-login-as-active-directory-user-per-kibana-but-api-works/223514 "2020-03-30T09:10:20Z")
Unable to Login as Active Directory User per Kibana, but Login per curl from kibana node works well, also the role mapping. How to debug/solve this problem? KIBANA per WEBINTERFACE: "error" : { "root\_cause" : \[ … --- ## [Shard fails because of java.lang.IllegalStateException: A document doesn't have a value for a field!](https://discuss.elastic.co/t/shard-fails-because-of-java-lang-illegalstateexception-a-document-doesnt-have-a-value-for-a-field/224440)
**Author:** [@leprovokateur](https://discuss.elastic.co/u/leprovokateur)\ **Replies:** 3\ **Last updated:** [March 30, 2020, 8:54am UTC](https://discuss.elastic.co/t/shard-fails-because-of-java-lang-illegalstateexception-a-document-doesnt-have-a-value-for-a-field/224440 "2020-03-30T08:54:37Z")
Hi, I am using Elasticsearch and Kibana in version 7.6.1, which I migrated from 6.8.5 I have a scripted field: // user String path = doc\['logmessage.keyword'\].value; String logger = doc\['logger.keyword'\].value; if… --- ## [Check where a query comes from](https://discuss.elastic.co/t/check-where-a-query-comes-from/225601)
**Author:** [@Jehutywong](https://discuss.elastic.co/u/Jehutywong)\ **Replies:** 1\ **Last updated:** [March 30, 2020, 8:25am UTC](https://discuss.elastic.co/t/check-where-a-query-comes-from/225601 "2020-03-30T08:25:56Z")
ES version 7.6.1 I notice that there are some problematic queries in my cluster, but i have no idea where they come from. I'd wonder if I can find the source IP/hostname of a query? Thanks --- ## [Logstash Unexpected character ('-' (code 45)): was expecting comma to separate Array entries](https://discuss.elastic.co/t/logstash-unexpected-character-code-45-was-expecting-comma-to-separate-array-entries/224821)
**Author:** [@Rahul\_Ravichandran](https://discuss.elastic.co/u/Rahul_Ravichandran)\ **Replies:** 5\ **Last updated:** [March 30, 2020, 8:05am UTC](https://discuss.elastic.co/t/logstash-unexpected-character-code-45-was-expecting-comma-to-separate-array-entries/224821 "2020-03-30T08:05:51Z")
Hi i am trying to move my application logs to kibana through logstash. 1.This is my logstash.conf file: input { file { path =\> "/home/ubuntu/\*" } } filter { json { source =\> "message" } … --- ## [Is there anyone know How to monitor the apm-server runtime status etc in kibana](https://discuss.elastic.co/t/is-there-anyone-know-how-to-monitor-the-apm-server-runtime-status-etc-in-kibana/225329)
**Author:** [@lucky-yang](https://discuss.elastic.co/u/lucky-yang)\ **Replies:** 1\ **Last updated:** [March 30, 2020, 7:58am UTC](https://discuss.elastic.co/t/is-there-anyone-know-how-to-monitor-the-apm-server-runtime-status-etc-in-kibana/225329 "2020-03-30T07:58:44Z")
Is there anyone know How to monitor the apm-server runtime status etc in kibana --- ## [Kibana visualization with two fields from prometheus data](https://discuss.elastic.co/t/kibana-visualization-with-two-fields-from-prometheus-data/225099)
**Author:** [@jf11](https://discuss.elastic.co/u/jf11)\ **Replies:** 5\ **Last updated:** [March 30, 2020, 7:53am UTC](https://discuss.elastic.co/t/kibana-visualization-with-two-fields-from-prometheus-data/225099 "2020-03-30T07:53:52Z")
Hello, I'm not sure whether this is possible or not but really hoping for some way to use sub-buckets on the Y-axis when doing a visualization. I've got a setup where metric beat collects prometheus metrics from various… --- ## [Lifecycle policy to a different cluster](https://discuss.elastic.co/t/lifecycle-policy-to-a-different-cluster/224257)
**Author:** [@chiara](https://discuss.elastic.co/u/chiara)\ **Replies:** 2\ **Last updated:** [March 30, 2020, 7:46am UTC](https://discuss.elastic.co/t/lifecycle-policy-to-a-different-cluster/224257 "2020-03-30T07:46:32Z")
I would like to maintain data 6 month on my main elasticsearch cluster. Then I would like to apply a lifecycle policy to move indexes to a DIFFERENT cluster. I can't use the same cluster because of security and complianc… --- ## [How to make logstash parse file in a parallel manner](https://discuss.elastic.co/t/how-to-make-logstash-parse-file-in-a-parallel-manner/225568)
**Author:** [@Mohsin\_Alam](https://discuss.elastic.co/u/Mohsin_Alam)\ **Replies:** 2\ **Last updated:** [March 30, 2020, 7:33am UTC](https://discuss.elastic.co/t/how-to-make-logstash-parse-file-in-a-parallel-manner/225568 "2020-03-30T07:33:24Z")
hey i am using 3 vms and on 2 of my vm i am running instance of logstash and what i notice is when i push logs to both the vm's at the same time logs from vm1 are first processed by logstash and then vm2 logs are process… --- ## [If grok\_parse failure Instead of drop. I want to process everything as greedy data](https://discuss.elastic.co/t/if-grok-parse-failure-instead-of-drop-i-want-to-process-everything-as-greedy-data/225585)
**Author:** [@ranjini](https://discuss.elastic.co/u/ranjini)\ **Replies:** 3\ **Last updated:** [March 30, 2020, 7:33am UTC](https://discuss.elastic.co/t/if-grok-parse-failure-instead-of-drop-i-want-to-process-everything-as-greedy-data/225585 "2020-03-30T07:33:20Z")
filter { if \[type\] == "chef-client" { grok { match =\> {"message" =\> "\\\[%{TIMESTAMP\_ISO8601:logtimestamp}\\\] %{SPACE}%{LOGLEVEL:loglevel}:%{SPACE}%{GREEDYDATA:message}"} … --- ## [Transform time-based event logs](https://discuss.elastic.co/t/transform-time-based-event-logs/224484)
**Author:** [@jpchev](https://discuss.elastic.co/u/jpchev)\ **Replies:** 10\ **Last updated:** [March 30, 2020, 6:14am UTC](https://discuss.elastic.co/t/transform-time-based-event-logs/224484 "2020-03-30T06:14:26Z")
Hello, I'd like to import raw logs from an application where I have time-based events reporting the change of items' state. I'd like to get a transformation on data where each point in time reports the latest known st… --- ## [How to get average document size in an index?](https://discuss.elastic.co/t/how-to-get-average-document-size-in-an-index/225610)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 2\ **Last updated:** [March 30, 2020, 6:07am UTC](https://discuss.elastic.co/t/how-to-get-average-document-size-in-an-index/225610 "2020-03-30T06:07:29Z")
HI, I am using Elastic Stack v6.3.0. I have multiple indices. Is is possible to get average document size (the size of a single entry in an index) of a particular index? Thank you --- ## [Issue while parsing xml data from a file](https://discuss.elastic.co/t/issue-while-parsing-xml-data-from-a-file/225132)
**Author:** [@Varun\_Saraf](https://discuss.elastic.co/u/Varun_Saraf)\ **Replies:** 4\ **Last updated:** [March 30, 2020, 6:06am UTC](https://discuss.elastic.co/t/issue-while-parsing-xml-data-from-a-file/225132 "2020-03-30T06:06:49Z")
I have xml data in a file and I am trying to parse it as a single event and visualise it in kibana below is the Configuration file for logstash. input { file { path =\> "/Users/varsaraf/outxr.xml" start\_position =\> "… --- ## [Ho wo get the average number of write events per second to all indices in my elasticsearch cluster](https://discuss.elastic.co/t/ho-wo-get-the-average-number-of-write-events-per-second-to-all-indices-in-my-elasticsearch-cluster/225392)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 4\ **Last updated:** [March 30, 2020, 5:36am UTC](https://discuss.elastic.co/t/ho-wo-get-the-average-number-of-write-events-per-second-to-all-indices-in-my-elasticsearch-cluster/225392 "2020-03-30T05:36:15Z")
Hi, I am using elasticserach 6.3.0. I have Kibana 6.3.0 with monitoring enabled. Is it possible to get the average write events to all indices in my elasticsearch cluster (i am pushing using multiple Logstash instances… --- ## [SIEM detections false positive](https://discuss.elastic.co/t/siem-detections-false-positive/219287)
**Author:** [@danielsnelling](https://discuss.elastic.co/u/danielsnelling)\ **Replies:** 4\ **Last updated:** [March 2, 2020, 9:50pm UTC](https://discuss.elastic.co/t/siem-detections-false-positive/219287 "2020-03-02T21:50:37Z")
We've upgraded our stack to 7.6.0 yesterday, and we love the new Detections mechanism! I'm aware these are in beta, but some of the definitions have a boolean 'or' where there should be an 'and'. This is particularly w… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1544) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1546)