# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1615 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1616 --- ## [Unknown setting error with s3 input plugin](https://discuss.elastic.co/t/unknown-setting-error-with-s3-input-plugin/220334)
**Author:** [@\_Alex](https://discuss.elastic.co/u/_Alex)\ **Replies:** 1\ **Last updated:** [February 21, 2020, 10:56am UTC](https://discuss.elastic.co/t/unknown-setting-error-with-s3-input-plugin/220334 "2020-02-21T10:56:43Z")
When using the s3 input plugin with this configuration: input { s3 { "bucket" =\> "my-bucket-name" "add\_field" =\> { "service" =\> "aws-access-log-alb" "environment" =\> "demo" } } } I get these… --- ## [Logstash - Aggregate filter - one more field](https://discuss.elastic.co/t/logstash-aggregate-filter-one-more-field/220312)
**Author:** [@hofrichterovak](https://discuss.elastic.co/u/hofrichterovak)\ **Replies:** 4\ **Last updated:** [February 21, 2020, 10:23am UTC](https://discuss.elastic.co/t/logstash-aggregate-filter-one-more-field/220312 "2020-02-21T10:23:19Z")
Hello, I created aggregate filter. --- ## [Search for startsWith and contains combined with sorting](https://discuss.elastic.co/t/search-for-startswith-and-contains-combined-with-sorting/220323)
**Author:** [@krisbude](https://discuss.elastic.co/u/krisbude)\ **Replies:** 0\ **Last updated:** [February 21, 2020, 9:40am UTC](https://discuss.elastic.co/t/search-for-startswith-and-contains-combined-with-sorting/220323 "2020-02-21T09:40:28Z")
Hello, I have a query that looks like the following: { "sort": \[ { "\_score": "DESC", "name.sort": "ASC" } \], "size": "250", "query": { "bool": { … --- ## [Logstash SSL enable to connect elastic cloud instance](https://discuss.elastic.co/t/logstash-ssl-enable-to-connect-elastic-cloud-instance/220110)
**Author:** [@Rahul12](https://discuss.elastic.co/u/Rahul12)\ **Replies:** 3\ **Last updated:** [February 21, 2020, 8:55am UTC](https://discuss.elastic.co/t/logstash-ssl-enable-to-connect-elastic-cloud-instance/220110 "2020-02-21T08:55:41Z")
Hi, I am using elastic cloud version 7.5.1. I have enable SAML to my elastic cloud instance. Before enabling SAML my logstash which is at my local able to connect with elastic cloud instance. But after enabling SAML s… --- ## [Kibana gets wrong timezone from my browser](https://discuss.elastic.co/t/kibana-gets-wrong-timezone-from-my-browser/220207)
**Author:** [@juanarmentia](https://discuss.elastic.co/u/juanarmentia)\ **Replies:** 5\ **Last updated:** [February 21, 2020, 8:24am UTC](https://discuss.elastic.co/t/kibana-gets-wrong-timezone-from-my-browser/220207 "2020-02-21T08:24:50Z")
Hi, I have a deployment in Elastic Cloud (7.6) and Kibana doesn't get the correct timezone from by browser. I have to configure it to "Europe/Madrid" instead of "Browser", because if not, the dates I see are 1 hour out … --- ## [Logstash : ingestion via Grok pattern does not work](https://discuss.elastic.co/t/logstash-ingestion-via-grok-pattern-does-not-work/220003)
**Author:** [@romainfoulono](https://discuss.elastic.co/u/romainfoulono)\ **Replies:** 4\ **Last updated:** [February 21, 2020, 8:12am UTC](https://discuss.elastic.co/t/logstash-ingestion-via-grok-pattern-does-not-work/220003 "2020-02-21T08:12:46Z")
Hello everybody, I wish to ingest some CSV and texts in Elasticsearch via Logstash. Problem is than Logstash generates a unique field named « message » with the text line inside. I would like to split this text line int… --- ## [Kibana Visualizeの凡例が見切れる](https://discuss.elastic.co/t/kibana-visualize/220304)
**Author:** [@harue](https://discuss.elastic.co/u/harue)\ **Replies:** 0\ **Last updated:** [February 21, 2020, 7:41am UTC](https://discuss.elastic.co/t/kibana-visualize/220304 "2020-02-21T07:41:31Z")
お世話になります。 Kibana Visualizeのbar chart(横棒グラフ)の凡例ですが、 一定の文字数を超えると「AAA…」のように完全に表示されず見切れてしまいます。 PDFレポートも同様です。 凡例を完全に表示する方法はありますでしょうか？ お手数ですが、有識者の方に回答頂けますと幸いです。 --- ## [Can we join multiple index in Logstash after reading for elasticsearch and then create a new index](https://discuss.elastic.co/t/can-we-join-multiple-index-in-logstash-after-reading-for-elasticsearch-and-then-create-a-new-index/220086)
**Author:** [@Stephy\_Jacob](https://discuss.elastic.co/u/Stephy_Jacob)\ **Replies:** 1\ **Last updated:** [February 21, 2020, 7:25am UTC](https://discuss.elastic.co/t/can-we-join-multiple-index-in-logstash-after-reading-for-elasticsearch-and-then-create-a-new-index/220086 "2020-02-21T07:25:20Z")
Hi Team, I have my data of three different views ingested in Elasticsearch as three different indices. Now I have a requirement to create a Dashboard in Kibana with the combination of data from three views. So now I nee… --- ## [Rollup terms aggregation giving wrong result with array fields](https://discuss.elastic.co/t/rollup-terms-aggregation-giving-wrong-result-with-array-fields/220300)
**Author:** [@darkwarrior](https://discuss.elastic.co/u/darkwarrior)\ **Replies:** 0\ **Last updated:** [February 21, 2020, 7:15am UTC](https://discuss.elastic.co/t/rollup-terms-aggregation-giving-wrong-result-with-array-fields/220300 "2020-02-21T07:15:32Z")
Hello, I am trying to do rollup on array fields but when I use terms aggregation on that field I am getting wrong data in rollup query result. My index template looks like this : { "subjects" : { … --- ## [Is the HighLevelRestClient no supported in the Java Testing Framework?](https://discuss.elastic.co/t/is-the-highlevelrestclient-no-supported-in-the-java-testing-framework/218083)
**Author:** [@dg1](https://discuss.elastic.co/u/dg1)\ **Replies:** 12\ **Last updated:** [February 21, 2020, 7:05am UTC](https://discuss.elastic.co/t/is-the-highlevelrestclient-no-supported-in-the-java-testing-framework/218083 "2020-02-21T07:05:56Z")
After spending quite a bit of time fighting jar hell issues trying to setup the java testing framework, and tweaking intellij settings to accommodate it, I ended up not being able to get my HighLevelRestClient to connect… --- ## [Snapshot and restore to different disks](https://discuss.elastic.co/t/snapshot-and-restore-to-different-disks/220293)
**Author:** [@samiujan](https://discuss.elastic.co/u/samiujan)\ **Replies:** 1\ **Last updated:** [February 21, 2020, 7:00am UTC](https://discuss.elastic.co/t/snapshot-and-restore-to-different-disks/220293 "2020-02-21T07:00:28Z")
Hi I want to set up Elasticsearch 7.5 offline backups and I found the "Snapshot and Restore" functionality in Kibana (https://www.elastic.co/guide/en/elasticsearch/reference/7.5/snapshot-restore.html) This tells me tha… --- ## [Unable to start FileBeat "sends log files to Logstash or directly to Elasticsearch"](https://discuss.elastic.co/t/unable-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/220297)
**Author:** [@DavidSanchezGracia](https://discuss.elastic.co/u/DavidSanchezGracia)\ **Replies:** 0\ **Last updated:** [February 21, 2020, 6:44am UTC](https://discuss.elastic.co/t/unable-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/220297 "2020-02-21T06:44:04Z")
Hi, and thanks in advance for your help, I am having the following issue when starting FIleBeat on mi Ubuntu18.04 machine: \`filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch. Lo… --- ## [How to share components among Kibana plugins?](https://discuss.elastic.co/t/how-to-share-components-among-kibana-plugins/219890)
**Author:** [@lvdiev](https://discuss.elastic.co/u/lvdiev)\ **Replies:** 3\ **Last updated:** [February 21, 2020, 6:24am UTC](https://discuss.elastic.co/t/how-to-share-components-among-kibana-plugins/219890 "2020-02-21T06:24:00Z")
I'm create several Kibana plugins that reuse some components. How can I properly share the components among them? What I'm doing now is to create a blank plugin (no APIs and UI exports), let say "plugin\_commons". In "pl… --- ## [Can we remove trace of data from elastic search query response](https://discuss.elastic.co/t/can-we-remove-trace-of-data-from-elastic-search-query-response/220199)
**Author:** [@Vishal\_Aggarwal](https://discuss.elastic.co/u/Vishal_Aggarwal)\ **Replies:** 2\ **Last updated:** [February 21, 2020, 6:30am UTC](https://discuss.elastic.co/t/can-we-remove-trace-of-data-from-elastic-search-query-response/220199 "2020-02-21T06:30:46Z")
I want to remove the search trace from elastic query response as below: Elastic query: curl -u username:password elasticURL/elastic\_index\_name/\_search?pretty&filter\_path=hits.hits.\_source,agggregations.\*\*.hits.hits.\_so… --- ## [How Update Type of field or Update all values of field](https://discuss.elastic.co/t/how-update-type-of-field-or-update-all-values-of-field/218760)
**Author:** [@thewasta](https://discuss.elastic.co/u/thewasta)\ **Replies:** 4\ **Last updated:** [February 21, 2020, 5:16am UTC](https://discuss.elastic.co/t/how-update-type-of-field-or-update-all-values-of-field/218760 "2020-02-21T05:16:21Z")
Hello there! This is the current mappings for a index, and I want to update/edit date field from text to date GET testing/\_search "mappings" : { "inventory" : { "properties" : { "date… --- ## [Need help with xpack security authentication in 6.3.1](https://discuss.elastic.co/t/need-help-with-xpack-security-authentication-in-6-3-1/220286)
**Author:** [@fory](https://discuss.elastic.co/u/fory)\ **Replies:** 1\ **Last updated:** [February 21, 2020, 3:48am UTC](https://discuss.elastic.co/t/need-help-with-xpack-security-authentication-in-6-3-1/220286 "2020-02-21T03:48:45Z")
I have two ElasticSearch server nodes configuration with "xpack.security.enabled: true" Created a transport\_client role user called "esi". When the ES server startup everything works fine as a single node, accessing r… --- ## [How to match a sentence that may contain delimiter](https://discuss.elastic.co/t/how-to-match-a-sentence-that-may-contain-delimiter/220070)
**Author:** [@kingjherold](https://discuss.elastic.co/u/kingjherold)\ **Replies:** 2\ **Last updated:** [February 21, 2020, 1:40am UTC](https://discuss.elastic.co/t/how-to-match-a-sentence-that-may-contain-delimiter/220070 "2020-02-21T01:40:52Z")
This is the log line msg: Malware/Virus detected - Rtf.Exploit.CVE\_2017\_11882-6584355-0:Message denied for delivery:Announcement: Holiday Tomorrow This is where i'm figuring out how to match the "Announcement: Holida… --- ## [Finding a sequence of events](https://discuss.elastic.co/t/finding-a-sequence-of-events/220269)
**Author:** [@Jeremy\_A](https://discuss.elastic.co/u/Jeremy_A)\ **Replies:** 3\ **Last updated:** [February 20, 2020, 9:42pm UTC](https://discuss.elastic.co/t/finding-a-sequence-of-events/220269 "2020-02-20T21:42:25Z")
Hi, I've seen some info online about this but much of it was a few years old so I was wondering what the best solution would be to this problem of finding a sequence of events from discreet logs. We have an index with a… --- ## [Do i need to re-index?](https://discuss.elastic.co/t/do-i-need-to-re-index/219704)
**Author:** [@Phie\_Albert](https://discuss.elastic.co/u/Phie_Albert)\ **Replies:** 1\ **Last updated:** [February 20, 2020, 8:43pm UTC](https://discuss.elastic.co/t/do-i-need-to-re-index/219704 "2020-02-20T20:43:51Z")
Hi, currently i have 10 nodes with 5 shards, 1 replica and i don't use dedicated master node. if i want to use 3 dedicated master node and increase the number of my nodes so the number of shards on every node is still… --- ## [AuditBeat Will Not Start](https://discuss.elastic.co/t/auditbeat-will-not-start/210005)
**Author:** [@nuffskillz](https://discuss.elastic.co/u/nuffskillz)\ **Replies:** 1\ **Last updated:** [February 20, 2020, 8:35pm UTC](https://discuss.elastic.co/t/auditbeat-will-not-start/210005 "2020-02-20T20:35:39Z")
Hi A fresh install of auditbeat will not start returning the following below. Exiting: 1 error: 1 error: system/socket dataset setup failed: unable to guess one or more required parameters: guess\_sk\_buff\_proto failed: … --- ## [Highlighting on ngram search](https://discuss.elastic.co/t/highlighting-on-ngram-search/220257)
**Author:** [@roman731](https://discuss.elastic.co/u/roman731)\ **Replies:** 0\ **Last updated:** [February 20, 2020, 7:27pm UTC](https://discuss.elastic.co/t/highlighting-on-ngram-search/220257 "2020-02-20T19:27:31Z")
Hello, I'm using ES7.5 and am trying to get highlighting to work on my ngram search (search results are working as expected). Currently I have a bunch of documents with a name field, and when i do a partial search with … --- ## [Load cloudwatch to logstash](https://discuss.elastic.co/t/load-cloudwatch-to-logstash/219812)
**Author:** [@Amna\_sayed\_ali](https://discuss.elastic.co/u/Amna_sayed_ali)\ **Replies:** 1\ **Last updated:** [February 20, 2020, 7:07pm UTC](https://discuss.elastic.co/t/load-cloudwatch-to-logstash/219812 "2020-02-20T19:07:46Z")
Hi, I use AWS ES and Logstash as an aggregator. I want to load Cloudwatch logs (that located in a different account, for example, account B) into Logstash (that located in account A) i use Logstash-cloudwatch plugin bu… --- ## [Adding another instance as a means to expand writable space](https://discuss.elastic.co/t/adding-another-instance-as-a-means-to-expand-writable-space/220080)
**Author:** [@fallenreaper](https://discuss.elastic.co/u/fallenreaper)\ **Replies:** 6\ **Last updated:** [February 20, 2020, 6:54pm UTC](https://discuss.elastic.co/t/adding-another-instance-as-a-means-to-expand-writable-space/220080 "2020-02-20T18:54:14Z")
we all run into the issue of running out of space on your initial ES instance. I launched a second and it spooled up but when i look at the summary for my instance it says: 1 primary and 1 replica. If i recall, my fir… --- ## [Using ruby filter to sum values of nested objects everytime the event matches](https://discuss.elastic.co/t/using-ruby-filter-to-sum-values-of-nested-objects-everytime-the-event-matches/220248)
**Author:** [@Kassio\_Silva](https://discuss.elastic.co/u/Kassio_Silva)\ **Replies:** 0\ **Last updated:** [February 20, 2020, 6:20pm UTC](https://discuss.elastic.co/t/using-ruby-filter-to-sum-values-of-nested-objects-everytime-the-event-matches/220248 "2020-02-20T18:20:15Z")
Hello guys, I trying to sum the value of a specific field everytime it shows: the field is in this format: "\[cdr\]\[Service-Information\]\[PS-Information\]\[Service-Data-Container\]\[Accounting-Output-Octets\]" and it's value i… --- ## [Logstash split xml filter](https://discuss.elastic.co/t/logstash-split-xml-filter/220018)
**Author:** [@MarcoV](https://discuss.elastic.co/u/MarcoV)\ **Replies:** 5\ **Last updated:** [February 20, 2020, 6:02pm UTC](https://discuss.elastic.co/t/logstash-split-xml-filter/220018 "2020-02-20T18:02:35Z")
Hi all, I have a some problem with my logstash filter. I read data from an xml and I want to split them to send to elasticsearch. The xml is like this: \ \ \/Subasio.aac\ … --- ## [Kibana in kubernetes - persistence?](https://discuss.elastic.co/t/kibana-in-kubernetes-persistence/220222)
**Author:** [@ceastman-ibm](https://discuss.elastic.co/u/ceastman-ibm)\ **Replies:** 1\ **Last updated:** [February 20, 2020, 6:01pm UTC](https://discuss.elastic.co/t/kibana-in-kubernetes-persistence/220222 "2020-02-20T18:01:52Z")
How does Kibana persist its data (dashboards, etc.) in kubernetes? --- ## [Erro logstash](https://discuss.elastic.co/t/erro-logstash/220241)
**Author:** [@FernandoMOTA](https://discuss.elastic.co/u/FernandoMOTA)\ **Replies:** 0\ **Last updated:** [February 20, 2020, 5:45pm UTC](https://discuss.elastic.co/t/erro-logstash/220241 "2020-02-20T17:45:21Z")
Even using version 11 of the jdk this error occurs, I am using the most current version . /bin/logstash -e 'input { stdin { } } output { stdout {} }' Unrecognized option: - Error: Could not create the Java Virtual Mac… --- ## [Logstash / input - Elasticsearch query question](https://discuss.elastic.co/t/logstash-input-elasticsearch-query-question/220239)
**Author:** [@RoNo](https://discuss.elastic.co/u/RoNo)\ **Replies:** 0\ **Last updated:** [February 20, 2020, 5:42pm UTC](https://discuss.elastic.co/t/logstash-input-elasticsearch-query-question/220239 "2020-02-20T17:42:32Z")
is it possible to query frozen indexes with the elasticsearch input module in logstash? i am trying to query all my frozen indexes with logstash and the ES input module if i try to query a frozen index in kibana or cur… --- ## [Stop-start an elasticsearch instance having all the primary shards](https://discuss.elastic.co/t/stop-start-an-elasticsearch-instance-having-all-the-primary-shards/220028)
**Author:** [@Chimu](https://discuss.elastic.co/u/Chimu)\ **Replies:** 13\ **Last updated:** [February 20, 2020, 5:26pm UTC](https://discuss.elastic.co/t/stop-start-an-elasticsearch-instance-having-all-the-primary-shards/220028 "2020-02-20T17:26:56Z")
I have an Elasticsearch (v5.6.10) cluster with 3 nodes. Node A : Master Node B : Master + Data Node C : Master + Data There are 6 shards per data node with replication set as 1. All 6 primary nodes are in Node B and a… --- ## [Get count of indexing conflicts](https://discuss.elastic.co/t/get-count-of-indexing-conflicts/220232)
**Author:** [@mmarkzon](https://discuss.elastic.co/u/mmarkzon)\ **Replies:** 0\ **Last updated:** [February 20, 2020, 4:58pm UTC](https://discuss.elastic.co/t/get-count-of-indexing-conflicts/220232 "2020-02-20T16:58:45Z")
I have some indices with duplicate id's that I am using Logstash to de-dupe into another index in another cluster. Is there a way to have logstash report the number of conflicts that occurred? This would be comparable … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1614) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1616)