# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1554 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1555 --- ## [Parse](https://discuss.elastic.co/t/parse/224900)
**Author:** [@Claudio\_Ract\_Costa](https://discuss.elastic.co/u/Claudio_Ract_Costa)\ **Replies:** 1\ **Last updated:** [March 24, 2020, 6:30pm UTC](https://discuss.elastic.co/t/parse/224900 "2020-03-24T18:30:12Z")
SPCAS01-SpCas911-Gx-Test;1759780163;288613496;5e790ef9-37802|862|552(8783624|72455748963158|35487963214587|0|2|1|125874698\_191127017\_2020-03-23T23:53:58|191127017|0|0|4539489|466971741|51885749|0|26849|0|0|0|0|0|0|0|0|2… --- ## [Logstash shut down in spite of my pipelines.yml is configured](https://discuss.elastic.co/t/logstash-shut-down-in-spite-of-my-pipelines-yml-is-configured/224894)
**Author:** [@oula\_oula](https://discuss.elastic.co/u/oula_oula)\ **Replies:** 0\ **Last updated:** [March 24, 2020, 5:44pm UTC](https://discuss.elastic.co/t/logstash-shut-down-in-spite-of-my-pipelines-yml-is-configured/224894 "2020-03-24T17:44:03Z")
Hello, I have test my pipeline by running logstash with "-f path/to/my\_pipeline.conf" and everything worked very well. So now I would like to run logstash using my pipeline without the "-f", so I configured my pipelines… --- ## [Create a simple http status code watcher](https://discuss.elastic.co/t/create-a-simple-http-status-code-watcher/224891)
**Author:** [@leftright1](https://discuss.elastic.co/u/leftright1)\ **Replies:** 0\ **Last updated:** [March 24, 2020, 5:19pm UTC](https://discuss.elastic.co/t/create-a-simple-http-status-code-watcher/224891 "2020-03-24T17:19:45Z")
Hi I am pretty new to this and I have been studying the docs for the last two days but I am struggling to create a simple watcher that does following: From a Heartbeat that checks multiple URLs and sends the log to the… --- ## [Logstash aggregate filter never index same data from CSV file](https://discuss.elastic.co/t/logstash-aggregate-filter-never-index-same-data-from-csv-file/224883)
**Author:** [@leobr29](https://discuss.elastic.co/u/leobr29)\ **Replies:** 1\ **Last updated:** [March 24, 2020, 5:04pm UTC](https://discuss.elastic.co/t/logstash-aggregate-filter-never-index-same-data-from-csv-file/224883 "2020-03-24T17:04:43Z")
Hi everyone, I come to you because I think that I I don't understand something with aggregate filter or more generally with logstash. I'm trying to read a CSV file and use aggregate filter, trying to reproduce somethi… --- ## [Grok filter for logstash/filebeats](https://discuss.elastic.co/t/grok-filter-for-logstash-filebeats/216481)
**Author:** [@gsuboc](https://discuss.elastic.co/u/gsuboc)\ **Replies:** 42\ **Last updated:** [March 24, 2020, 4:59pm UTC](https://discuss.elastic.co/t/grok-filter-for-logstash-filebeats/216481 "2020-03-24T16:59:29Z")
I'm trying to extract my logs field using grok but it doesn't work. Here's my grok filter: filter { # parse the CSV structure generated from the log file into fields grok { match =\> {"message" =\> "%{GREEDYDATA:Job\_Name… --- ## [If conditional on nested field with IP address](https://discuss.elastic.co/t/if-conditional-on-nested-field-with-ip-address/224739)
**Author:** [@uklipse](https://discuss.elastic.co/u/uklipse)\ **Replies:** 9\ **Last updated:** [March 24, 2020, 4:58pm UTC](https://discuss.elastic.co/t/if-conditional-on-nested-field-with-ip-address/224739 "2020-03-24T16:58:30Z")
I'm trying to create a simple if conditional on the host.name field if it matches an IP address. This is originating from a syslog source and is a static IP. I've tried == with quotes around the IP, escaping the octet do… --- ## [Perform a single \_reindex request that has "index\_a" from the remote cluster, and another "index\_a" of the current cluster, and reindexing them both to "index\_b"?](https://discuss.elastic.co/t/perform-a-single-reindex-request-that-has-index-a-from-the-remote-cluster-and-another-index-a-of-the-current-cluster-and-reindexing-them-both-to-index-b/224734)
**Author:** [@Yotam\_Levy](https://discuss.elastic.co/u/Yotam_Levy)\ **Replies:** 1\ **Last updated:** [March 24, 2020, 4:39pm UTC](https://discuss.elastic.co/t/perform-a-single-reindex-request-that-has-index-a-from-the-remote-cluster-and-another-index-a-of-the-current-cluster-and-reindexing-them-both-to-index-b/224734 "2020-03-24T16:39:35Z")
I have "index\_a" on a remote elasticsearch cluster that looks like this: { \_index: "index\_a", \_type: "\_doc", \_id: "1", \_score: 1, \_source: { customer\_id: "1234", customer\_name: "spider", … --- ## [One shot search query by scroll from index \> 10'000](https://discuss.elastic.co/t/one-shot-search-query-by-scroll-from-index-10000/224396)
**Author:** [@missill](https://discuss.elastic.co/u/missill)\ **Replies:** 6\ **Last updated:** [March 23, 2020, 5:02pm UTC](https://discuss.elastic.co/t/one-shot-search-query-by-scroll-from-index-10000/224396 "2020-03-23T17:02:01Z")
Hi everybody, I'd like get result from a search query from start index \> 10000 but when i do it, i get this error : {"error":{"root\_cause":\[{"type":"query\_phase\_execution\_exception","reason":"Result window is too larg… --- ## [Date filter to yyyy/MM/dd HH:mm:ss format](https://discuss.elastic.co/t/date-filter-to-yyyy-mm-dd-hhss-format/224569)
**Author:** [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)\ **Replies:** 6\ **Last updated:** [March 24, 2020, 4:25pm UTC](https://discuss.elastic.co/t/date-filter-to-yyyy-mm-dd-hhss-format/224569 "2020-03-24T16:25:00Z")
Hello, I´m trying to parse a date field called "ReceiveTime" which has the following format: ReceiveTime=2020/03/03 16:47:56 i´m using the next filter in Logstash: date { match =\> \[ "ReceiveTime", "yyyy/MM/dd HH:mm:… --- ## [VolumeClaim emptyDir overwrite not working](https://discuss.elastic.co/t/volumeclaim-emptydir-overwrite-not-working/224809)
**Author:** [@TatsuKishi](https://discuss.elastic.co/u/TatsuKishi)\ **Replies:** 2\ **Last updated:** [March 24, 2020, 4:07pm UTC](https://discuss.elastic.co/t/volumeclaim-emptydir-overwrite-not-working/224809 "2020-03-24T16:07:26Z")
Hey, I'm trying to disable the PVC for a client/ingest nodeset like stated in documentation, however ECK is still creating the 1gb volume. nodeSet config: nodesets\[client\].config.podTemplate.volumes: - emptyDir: {} … --- ## [NEST Analyzer/Tokenization Example](https://discuss.elastic.co/t/nest-analyzer-tokenization-example/224877)
**Author:** [@Parakoopa](https://discuss.elastic.co/u/Parakoopa)\ **Replies:** 0\ **Last updated:** [March 24, 2020, 3:42pm UTC](https://discuss.elastic.co/t/nest-analyzer-tokenization-example/224877 "2020-03-24T15:42:50Z")
Hi Everyone, Wondering if I am going about this the wrong way; I have a simple signalR app sending data too and from a web page. Right now when I enter in one item with the prefix "https://" or anything with the reserve… --- ## [Split json message into a new column in kibana table](https://discuss.elastic.co/t/split-json-message-into-a-new-column-in-kibana-table/224565)
**Author:** [@ARoy](https://discuss.elastic.co/u/ARoy)\ **Replies:** 12\ **Last updated:** [March 24, 2020, 3:07pm UTC](https://discuss.elastic.co/t/split-json-message-into-a-new-column-in-kibana-table/224565 "2020-03-24T15:07:28Z")
Hi, I need to add new column in kibana from the json message. The message is as follows : {"results":\[{"gender":"female","name":{"title":"Ms","first":"Eden","last":"Morel"},"location":{"street":{"number":1412,"name":"R… --- ## [Elasticsearch 5.3.3: filter docs with same value](https://discuss.elastic.co/t/elasticsearch-5-3-3-filter-docs-with-same-value/224868)
**Author:** [@domanskyi](https://discuss.elastic.co/u/domanskyi)\ **Replies:** 0\ **Last updated:** [March 24, 2020, 3:06pm UTC](https://discuss.elastic.co/t/elasticsearch-5-3-3-filter-docs-with-same-value/224868 "2020-03-24T15:06:56Z")
I have next mapping: { "mappings": { "jobs": { "properties": { "bullets": { "type": "text" }, "description": { "type": "text" }, "title": { … --- ## [Web socket input issue with certstream](https://discuss.elastic.co/t/web-socket-input-issue-with-certstream/224862)
**Author:** [@Alfalab](https://discuss.elastic.co/u/Alfalab)\ **Replies:** 2\ **Last updated:** [March 24, 2020, 2:52pm UTC](https://discuss.elastic.co/t/web-socket-input-issue-with-certstream/224862 "2020-03-24T14:52:54Z")
hi, here is a tail of log \[2020-03-24T10:41:35,144\]\[WARN \]\[logstash.inputs.websocket\]\[main\] websocket input client threw exception, restarting {:exception=\>#\ **Author:** [@Sagar\_Mandal](https://discuss.elastic.co/u/Sagar_Mandal)\ **Replies:** 2\ **Last updated:** [March 24, 2020, 2:51pm UTC](https://discuss.elastic.co/t/adding-xxxx-in-a-column-through-logstash/224837 "2020-03-24T14:51:07Z") Hi Team, I have this task where I'm inputing some csv data which contain Accc number, which is 10 digit long. so what i want to do is that before storing it into elasticsearch, I want to change the end 5 digit to X. so… --- ## [Winlogbeat won't start as a Service](https://discuss.elastic.co/t/winlogbeat-wont-start-as-a-service/224864)
**Author:** [@illopssec](https://discuss.elastic.co/u/illopssec)\ **Replies:** 0\ **Last updated:** [March 24, 2020, 2:38pm UTC](https://discuss.elastic.co/t/winlogbeat-wont-start-as-a-service/224864 "2020-03-24T14:38:41Z")
Hello, I've downloaded, extracted, and renamed the latest Winlogbeat to the following folder: C:\\Program Files\\Elastic\\Beats\\Winlogbeat I've corrected the install-service-winlogbeat.ps1to reflect the correct data folde… --- ## [How to install Extended Metric Plugin in version 7.6.1](https://discuss.elastic.co/t/how-to-install-extended-metric-plugin-in-version-7-6-1/224756)
**Author:** [@Yungyoung\_Ok](https://discuss.elastic.co/u/Yungyoung_Ok)\ **Replies:** 1\ **Last updated:** [March 24, 2020, 1:56pm UTC](https://discuss.elastic.co/t/how-to-install-extended-metric-plugin-in-version-7-6-1/224756 "2020-03-24T13:56:49Z")
I downloaded it as a 'zip' file from git to install the plugin. After that, I opened package.json and modified kibana version to 7.6.1. And the following command was executed by compressing the plugin file back into a … --- ## [Elasticsearch stopping and getting network exception](https://discuss.elastic.co/t/elasticsearch-stopping-and-getting-network-exception/224515)
**Author:** [@shubham\_hate](https://discuss.elastic.co/u/shubham_hate)\ **Replies:** 3\ **Last updated:** [March 24, 2020, 1:54pm UTC](https://discuss.elastic.co/t/elasticsearch-stopping-and-getting-network-exception/224515 "2020-03-24T13:54:22Z")
Hello, I have deployed single node on machine, while starting the elasticsearch is getting stopped and returns and exception no-up and running site-local private address found, got... Please find the below log of ES. N… --- ## [Using Distance Feature query with matches as possible origins](https://discuss.elastic.co/t/using-distance-feature-query-with-matches-as-possible-origins/224446)
**Author:** [@aramperes](https://discuss.elastic.co/u/aramperes)\ **Replies:** 2\ **Last updated:** [March 24, 2020, 1:47pm UTC](https://discuss.elastic.co/t/using-distance-feature-query-with-matches-as-possible-origins/224446 "2020-03-24T13:47:21Z")
If my index is comprised of documents with a "date" field, how can I find all the closest neighbors considering there may be multiple origins? For example, we're interested in finding movies that were released around an… --- ## [S3 permissions](https://discuss.elastic.co/t/s3-permissions/224531)
**Author:** [@thoth](https://discuss.elastic.co/u/thoth)\ **Replies:** 3\ **Last updated:** [March 24, 2020, 1:44pm UTC](https://discuss.elastic.co/t/s3-permissions/224531 "2020-03-24T13:44:08Z")
The documentation has become outdated on the S3 permissions. https://www.elastic.co/guide/en/elasticsearch/plugins/current/repository-s3-repository.html#repository-s3-permissions If you try to apply this policy AWS com… --- ## [Intervals search with complicated before/after requirements](https://discuss.elastic.co/t/intervals-search-with-complicated-before-after-requirements/224850)
**Author:** [@andrew-matteson](https://discuss.elastic.co/u/andrew-matteson)\ **Replies:** 0\ **Last updated:** [March 24, 2020, 1:30pm UTC](https://discuss.elastic.co/t/intervals-search-with-complicated-before-after-requirements/224850 "2020-03-24T13:30:51Z")
I'm trying to develop a query that's based on several interval searches. One of the searches needs to exclude intervals containing a particular word if it appears in the interval, within the 10 preceding words before the… --- ## [Changing Column data in elasticsearch](https://discuss.elastic.co/t/changing-column-data-in-elasticsearch/224844)
**Author:** [@Sagar\_Mandal](https://discuss.elastic.co/u/Sagar_Mandal)\ **Replies:** 0\ **Last updated:** [March 24, 2020, 1:24pm UTC](https://discuss.elastic.co/t/changing-column-data-in-elasticsearch/224844 "2020-03-24T13:24:49Z")
Hii Team, I have another task where i want to change some data which is already stored in ES, for example Phone Number 9876543210 into Phone Number 98765xxxxx I just need to change this column in the indices which… --- ## [Kubernetes - Logstash or Fluentd?](https://discuss.elastic.co/t/kubernetes-logstash-or-fluentd/223532)
**Author:** [@Mauricio\_Borges](https://discuss.elastic.co/u/Mauricio_Borges)\ **Replies:** 6\ **Last updated:** [March 24, 2020, 1:18pm UTC](https://discuss.elastic.co/t/kubernetes-logstash-or-fluentd/223532 "2020-03-24T13:18:38Z")
Hi Team! I have started working with ELK since last year and has been using a lot Beats, Elasticsearch, Kibana and a bit about Logstash. I have started POC case using ELK on-premise supporting OCP 4.x and customer aske… --- ## [Sankey Flow Chart in Kibana](https://discuss.elastic.co/t/sankey-flow-chart-in-kibana/224549)
**Author:** [@Sajal](https://discuss.elastic.co/u/Sajal)\ **Replies:** 6\ **Last updated:** [March 24, 2020, 1:16pm UTC](https://discuss.elastic.co/t/sankey-flow-chart-in-kibana/224549 "2020-03-24T13:16:51Z")
Hi All, Can anyone help me in understanding Sankey diagram in Kibana ? Thanks Sajal --- ## [Elasticsearch Cluster size](https://discuss.elastic.co/t/elasticsearch-cluster-size/224382)
**Author:** [@dadadima](https://discuss.elastic.co/u/dadadima)\ **Replies:** 1\ **Last updated:** [March 24, 2020, 1:07pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-size/224382 "2020-03-24T13:07:32Z")
I have a dataset, on which I would like to perform Anomaly Detection. The data size until now is 15-20TB and it grows 10-15GB per day. I do not need to query much the data (of course I will do some data exploration on m… --- ## [Format numbers with color and decimal places in metric aggregation](https://discuss.elastic.co/t/format-numbers-with-color-and-decimal-places-in-metric-aggregation/221703)
**Author:** [@mtudisco](https://discuss.elastic.co/u/mtudisco)\ **Replies:** 2\ **Last updated:** [March 24, 2020, 12:58pm UTC](https://discuss.elastic.co/t/format-numbers-with-color-and-decimal-places-in-metric-aggregation/221703 "2020-03-24T12:58:16Z")
Hi, I have a metric that i sotore with 2 decimal places, it is a number between 0 and 100 representing a percentage. Then i have a table visualization in kibana showing that number with the top hit aggregation. I want t… --- ## [Split a DateTime field to all Documents in logstash](https://discuss.elastic.co/t/split-a-datetime-field-to-all-documents-in-logstash/224726)
**Author:** [@panwarsagar](https://discuss.elastic.co/u/panwarsagar)\ **Replies:** 3\ **Last updated:** [March 24, 2020, 12:44pm UTC](https://discuss.elastic.co/t/split-a-datetime-field-to-all-documents-in-logstash/224726 "2020-03-24T12:44:18Z")
Hi, I have a Start\_Time field that I wants to split in all documents using the split filter. But split filter only takes string and array, So i tried to use mutate filter to covert Start\_Time field to string. But stil… --- ## [Does Kibana dashboard inherits filters from visualization?](https://discuss.elastic.co/t/does-kibana-dashboard-inherits-filters-from-visualization/224751)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 2\ **Last updated:** [March 24, 2020, 12:40pm UTC](https://discuss.elastic.co/t/does-kibana-dashboard-inherits-filters-from-visualization/224751 "2020-03-24T12:40:11Z")
I have filter by hostgroup in my visualization, and seems that dashboard inherits this filter, but when I press filters in dahboard, Im still habe the posibility to change the hostgroup. this will override my previous f… --- ## [My logstash conf file is not creating a test field](https://discuss.elastic.co/t/my-logstash-conf-file-is-not-creating-a-test-field/223711)
**Author:** [@Axl](https://discuss.elastic.co/u/Axl)\ **Replies:** 16\ **Last updated:** [March 24, 2020, 12:36pm UTC](https://discuss.elastic.co/t/my-logstash-conf-file-is-not-creating-a-test-field/223711 "2020-03-24T12:36:48Z")
I am using ELK 7.6.1. My configuration file /etc/logstash/conf.d/logstash-cowrie.conf does not appear to be taken in account. The logs show however that the file is being read (see below). So, probably it is not doing w… --- ## [Problems with run logstash as a service](https://discuss.elastic.co/t/problems-with-run-logstash-as-a-service/224289)
**Author:** [@mimimike](https://discuss.elastic.co/u/mimimike)\ **Replies:** 2\ **Last updated:** [March 24, 2020, 12:31pm UTC](https://discuss.elastic.co/t/problems-with-run-logstash-as-a-service/224289 "2020-03-24T12:31:04Z")
Hi everyone, I am not be able to run logstash as a service. When i run the command 'sudo systemctl start logstash.service', the status of logstash change to active (running) but it isn't true. When I check the status o… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1553) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1555)