# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1626 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1627 --- ## [Logstash Error when starting up - EACCES - Permission denied - NUL](https://discuss.elastic.co/t/logstash-error-when-starting-up-eacces-permission-denied-nul/219424)
**Author:** [@peter.tu](https://discuss.elastic.co/u/peter.tu)\ **Replies:** 0\ **Last updated:** [February 14, 2020, 5:22pm UTC](https://discuss.elastic.co/t/logstash-error-when-starting-up-eacces-permission-denied-nul/219424 "2020-02-14T17:22:31Z")
When I start logstash, I get the following error: Logstash - java.lang.IllegalStateException: Logstash stopped processing because of an error: (EACCES) Permission denied - NUL It was working fine a couple of days ago,… --- ## [Documents not displaying any fields](https://discuss.elastic.co/t/documents-not-displaying-any-fields/218595)
**Author:** [@Jasonespo](https://discuss.elastic.co/u/Jasonespo)\ **Replies:** 2\ **Last updated:** [February 14, 2020, 5:11pm UTC](https://discuss.elastic.co/t/documents-not-displaying-any-fields/218595 "2020-02-14T17:11:13Z")
After an upgrade of Kibana and Elasticsearch from 7.1 to 7.5.2 (I read that this was a safe step up) I can no longer see all my fields in the documents. I only get a few fields such as: { "\_index": "tid.496e3cfd-672c… --- ## [Elasticsearch installation password issue?](https://discuss.elastic.co/t/elasticsearch-installation-password-issue/219376)
**Author:** [@benjatune](https://discuss.elastic.co/u/benjatune)\ **Replies:** 1\ **Last updated:** [February 14, 2020, 4:55pm UTC](https://discuss.elastic.co/t/elasticsearch-installation-password-issue/219376 "2020-02-14T16:55:38Z")
HI, I am installing elasticsearch 5.6.3 on ubuntu. I am using command service elasticsearch start user is ubuntu and the terminal ask for my password I have tried many default and I can't surpass it. Please advise. --- ## [Filebeat shared or per application server](https://discuss.elastic.co/t/filebeat-shared-or-per-application-server/219412)
**Author:** [@areller](https://discuss.elastic.co/u/areller)\ **Replies:** 3\ **Last updated:** [February 14, 2020, 4:54pm UTC](https://discuss.elastic.co/t/filebeat-shared-or-per-application-server/219412 "2020-02-14T16:54:40Z")
We have a .NET Framework stack where each application instance is deployed on its own windows server. We want to move to ELK instead of just writing log files to a shared network drive. What would be the best solution … --- ## [Realistic Sizing for ElasticSearch](https://discuss.elastic.co/t/realistic-sizing-for-elasticsearch/219404)
**Author:** [@rukmalf](https://discuss.elastic.co/u/rukmalf)\ **Replies:** 1\ **Last updated:** [February 14, 2020, 4:50pm UTC](https://discuss.elastic.co/t/realistic-sizing-for-elasticsearch/219404 "2020-02-14T16:50:54Z")
Hi, I am new to this forum. I have been playing around a bit with ES. The thing that confuses me is that how to size a ES setup. For example if we go with the official channels (with the SEs) they recommend to have hot… --- ## [Date format, how to change it?](https://discuss.elastic.co/t/date-format-how-to-change-it/219259)
**Author:** [@Mbt\_Mbt](https://discuss.elastic.co/u/Mbt_Mbt)\ **Replies:** 3\ **Last updated:** [February 14, 2020, 4:45pm UTC](https://discuss.elastic.co/t/date-format-how-to-change-it/219259 "2020-02-14T16:45:38Z")
Hello good afternoon, I am trying to change the way of displaying date type data but I am not able. Can someone help me on how to visualize the dates with the format: 2020-13-02T10:01:01.000Z Currently the field has t… --- ## [Cluster Design question](https://discuss.elastic.co/t/cluster-design-question/218674)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 2\ **Last updated:** [February 14, 2020, 4:36pm UTC](https://discuss.elastic.co/t/cluster-design-question/218674 "2020-02-14T16:36:55Z")
I am setting up new cluster. Will have few new systems. and have some question. four high end servers with faster disk, 192gig ram, faster network connection with multiple cpu. (master/data) one server will be little … --- ## [Optimizing process time](https://discuss.elastic.co/t/optimizing-process-time/218568)
**Author:** [@not\_found](https://discuss.elastic.co/u/not_found)\ **Replies:** 1\ **Last updated:** [February 14, 2020, 4:36pm UTC](https://discuss.elastic.co/t/optimizing-process-time/218568 "2020-02-14T16:36:34Z")
Hello everyone, I'm pretty new in the elastic ecosystem. For the work, I have to analyze logstash process, understand it and improve it if it's possible. So I'm wondering a lot of questions. Firstly, a little bit con… --- ## [Saved object is missing Could not locate that search (id: WallDetail.uat1)](https://discuss.elastic.co/t/saved-object-is-missing-could-not-locate-that-search-id-walldetail-uat1/218834)
**Author:** [@meiyuan](https://discuss.elastic.co/u/meiyuan)\ **Replies:** 6\ **Last updated:** [February 14, 2020, 4:36pm UTC](https://discuss.elastic.co/t/saved-object-is-missing-could-not-locate-that-search-id-walldetail-uat1/218834 "2020-02-14T16:36:09Z")
Hi there, We are using Elasticsearch and Kibana 7.0.1. We have a saved search Object called WallDetail.uat1. Here is how we set it up: columns \[ "\_source" \] kibanaSavedObjectMeta.searchSourceJSON { "highlight… --- ## [Search source code and also use as store for them at the same time](https://discuss.elastic.co/t/search-source-code-and-also-use-as-store-for-them-at-the-same-time/219365)
**Author:** [@ice3man543](https://discuss.elastic.co/u/ice3man543)\ **Replies:** 6\ **Last updated:** [February 14, 2020, 4:20pm UTC](https://discuss.elastic.co/t/search-source-code-and-also-use-as-store-for-them-at-the-same-time/219365 "2020-02-14T16:20:52Z")
I am building a search engine for some internal code and we decided to use elasticsearch. The issue is i also need access to those documents directly with an ID while providing search on them. Reading around, some forum… --- ## [Cluster Rolling Upgrade : Necessary to disable replica shard allocation for each node?](https://discuss.elastic.co/t/cluster-rolling-upgrade-necessary-to-disable-replica-shard-allocation-for-each-node/219399)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 3\ **Last updated:** [February 14, 2020, 4:07pm UTC](https://discuss.elastic.co/t/cluster-rolling-upgrade-necessary-to-disable-replica-shard-allocation-for-each-node/219399 "2020-02-14T16:07:07Z")
Hello Elasticers, I'm asking if it's really necessary to disable replica shard allocation for each node as described in the documentation As this is a cluster setting, why not disable replica shard allocation one time,… --- ## [VEGA LİTE TRANSFORMS TYPE STRATİFY AND URL İNDEX BOTH HOW İS WORK?](https://discuss.elastic.co/t/vega-lite-transforms-type-stratify-and-url-index-both-how-is-work/219368)
**Author:** [@mr\_searchng](https://discuss.elastic.co/u/mr_searchng)\ **Replies:** 1\ **Last updated:** [February 14, 2020, 3:38pm UTC](https://discuss.elastic.co/t/vega-lite-transforms-type-stratify-and-url-index-both-how-is-work/219368 "2020-02-14T15:38:08Z")
--- ## [How to split a string into several parts GROK](https://discuss.elastic.co/t/how-to-split-a-string-into-several-parts-grok/219396)
**Author:** [@111291](https://discuss.elastic.co/u/111291)\ **Replies:** 1\ **Last updated:** [February 14, 2020, 3:30pm UTC](https://discuss.elastic.co/t/how-to-split-a-string-into-several-parts-grok/219396 "2020-02-14T15:30:22Z")
Hello, I have a cropped string: "20021416", format "yymmddhh". How to break it into a date ("yy-mm-dd") and an hour of time Best regards --- ## [Filter visualization data by cookie identity claims](https://discuss.elastic.co/t/filter-visualization-data-by-cookie-identity-claims/219331)
**Author:** [@KTH](https://discuss.elastic.co/u/KTH)\ **Replies:** 1\ **Last updated:** [February 14, 2020, 3:26pm UTC](https://discuss.elastic.co/t/filter-visualization-data-by-cookie-identity-claims/219331 "2020-02-14T15:26:06Z")
Hi there, The website embed the Kibana dashboard and pulling resource data from Kibana. Is there a way to authorize resource filtering by looking into what values are contained in identity claims field value? For exampl… --- ## [Easiest way to check which visualizations are unused?](https://discuss.elastic.co/t/easiest-way-to-check-which-visualizations-are-unused/219354)
**Author:** [@TimB1](https://discuss.elastic.co/u/TimB1)\ **Replies:** 2\ **Last updated:** [February 14, 2020, 3:17pm UTC](https://discuss.elastic.co/t/easiest-way-to-check-which-visualizations-are-unused/219354 "2020-02-14T15:17:19Z")
Hi, I'm trying to tidy up our Elastic Stack instance getting rid of old dashboards and visualizations that aren't used anymore. For visualizations is there an easy way to see which visualizations aren't used on any das… --- ## [Using a "missing" field option in a group by statement in a Data Transform](https://discuss.elastic.co/t/using-a-missing-field-option-in-a-group-by-statement-in-a-data-transform/219069)
**Author:** [@ebalmeida](https://discuss.elastic.co/u/ebalmeida)\ **Replies:** 2\ **Last updated:** [February 14, 2020, 3:07pm UTC](https://discuss.elastic.co/t/using-a-missing-field-option-in-a-group-by-statement-in-a-data-transform/219069 "2020-02-14T15:07:47Z")
Hi guys, I'm trying to create a data transform (using kibana's interface) in elasticsearch that includes missing docs for one of it's group by parameters as such: However, once I hit apply changes, it obliterates the… --- ## [Grok pattern works but not applied on Kibana (2nd)](https://discuss.elastic.co/t/grok-pattern-works-but-not-applied-on-kibana-2nd/219187)
**Author:** [@Cuju](https://discuss.elastic.co/u/Cuju)\ **Replies:** 1\ **Last updated:** [February 14, 2020, 2:55pm UTC](https://discuss.elastic.co/t/grok-pattern-works-but-not-applied-on-kibana-2nd/219187 "2020-02-14T14:55:56Z")
Hello, I have an issue I try to fix for a couple of days, without success. I posted it on the wrong channel so here we go again. I need to grok the message field (they don't have the same syntax) from my Kibana but it f… --- ## [Behavior of a deleted pipeline](https://discuss.elastic.co/t/behavior-of-a-deleted-pipeline/219213)
**Author:** [@Cuju](https://discuss.elastic.co/u/Cuju)\ **Replies:** 2\ **Last updated:** [February 14, 2020, 2:54pm UTC](https://discuss.elastic.co/t/behavior-of-a-deleted-pipeline/219213 "2020-02-14T14:54:43Z")
Hello, I had to delete and reinstall Filebeat because of some things I did wrong. In the old configuration I had, it gave me some available fields which are also in the new old, even if the pipeline doesn't exist (like … --- ## [ES 2 master node configuration](https://discuss.elastic.co/t/es-2-master-node-configuration/219175)
**Author:** [@Tushar\_Khanna](https://discuss.elastic.co/u/Tushar_Khanna)\ **Replies:** 2\ **Last updated:** [February 14, 2020, 2:52pm UTC](https://discuss.elastic.co/t/es-2-master-node-configuration/219175 "2020-02-14T14:52:21Z")
Hi Team, There are 2 master eligible nodes with below configuration. Node 1 (only master) , Node2(master and data and belonging to one of the data center) , in addition there are 4 more only data nodes belonging to one … --- ## [AquaSec / TwistLock features for containers?](https://discuss.elastic.co/t/aquasec-twistlock-features-for-containers/219388)
**Author:** [@elenoir](https://discuss.elastic.co/u/elenoir)\ **Replies:** 0\ **Last updated:** [February 14, 2020, 2:45pm UTC](https://discuss.elastic.co/t/aquasec-twistlock-features-for-containers/219388 "2020-02-14T14:45:48Z")
Hi, I was wondering if you plan to develop some features such as AquaSec or TwistLock provides for containers? I think this question is valuable since the Endgame buying as Elastic could cover almost the whole perimet… --- ## [How to use another field for query if the first does not exist value](https://discuss.elastic.co/t/how-to-use-another-field-for-query-if-the-first-does-not-exist-value/219291)
**Author:** [@adrianog3](https://discuss.elastic.co/u/adrianog3)\ **Replies:** 2\ **Last updated:** [February 14, 2020, 2:45pm UTC](https://discuss.elastic.co/t/how-to-use-another-field-for-query-if-the-first-does-not-exist-value/219291 "2020-02-14T14:45:28Z")
I would like to do a date filter on a field called "last\_update\_date", however, if the value is "null", I should use another field called "creation\_date". Is there any way to do this? The filter for the "last\_update\_dat… --- ## [Overlap between Endgame binary and Auditbeat/Packetbeat](https://discuss.elastic.co/t/overlap-between-endgame-binary-and-auditbeat-packetbeat/219386)
**Author:** [@elenoir](https://discuss.elastic.co/u/elenoir)\ **Replies:** 0\ **Last updated:** [February 14, 2020, 2:39pm UTC](https://discuss.elastic.co/t/overlap-between-endgame-binary-and-auditbeat-packetbeat/219386 "2020-02-14T14:39:12Z")
Hi, Since I've watched the Endpoint Security webinar I was wondering about the differences between endgame binary and AuditBeat/PacketBeat ones. Indeed, let's assume that the endgame binary is installed on one host, it… --- ## [Why do shards seem to get recreated when they already exist?](https://discuss.elastic.co/t/why-do-shards-seem-to-get-recreated-when-they-already-exist/219228)
**Author:** [@mikewillis](https://discuss.elastic.co/u/mikewillis)\ **Replies:** 5\ **Last updated:** [February 14, 2020, 2:29pm UTC](https://discuss.elastic.co/t/why-do-shards-seem-to-get-recreated-when-they-already-exist/219228 "2020-02-14T14:29:24Z")
Elasticsearch 6.8.6. I'm wondering if someone can explain why after opening, unfreezing and freezing an index, some replica shards sometimes appear to be get recreated from primaries even though they already exist on di… --- ## [How to remove the last byte from an IP address?](https://discuss.elastic.co/t/how-to-remove-the-last-byte-from-an-ip-address/219241)
**Author:** [@Aleksandra\_Minko](https://discuss.elastic.co/u/Aleksandra_Minko)\ **Replies:** 1\ **Last updated:** [February 14, 2020, 2:21pm UTC](https://discuss.elastic.co/t/how-to-remove-the-last-byte-from-an-ip-address/219241 "2020-02-14T14:21:31Z")
Hello, I have a NetFlow field named \[flow\]\[addr\] which represents an IP address. For example \[flow\]\[addr\] looks like: 10.96.31.41 . I would like to remove the last Byte of my field and keep only 10.96.31. I also would… --- ## [Logstash not sending ACK to Filebeat thereby causing duplicate events](https://discuss.elastic.co/t/logstash-not-sending-ack-to-filebeat-thereby-causing-duplicate-events/218686)
**Author:** [@stratmike](https://discuss.elastic.co/u/stratmike)\ **Replies:** 2\ **Last updated:** [February 14, 2020, 2:08pm UTC](https://discuss.elastic.co/t/logstash-not-sending-ack-to-filebeat-thereby-causing-duplicate-events/218686 "2020-02-14T14:08:17Z")
I have configured the following on a Windows 10 machine running on VMWare: Filebeat-\>Logstash-\>Elasticsearch All of these are running on the same machine. The problem is that Logstash is not sending an ACK to Filebeat… --- ## [Capture a substring from a windows path](https://discuss.elastic.co/t/capture-a-substring-from-a-windows-path/218533)
**Author:** [@Radha\_Krishna](https://discuss.elastic.co/u/Radha_Krishna)\ **Replies:** 7\ **Last updated:** [February 14, 2020, 8:36am UTC](https://discuss.elastic.co/t/capture-a-substring-from-a-windows-path/218533 "2020-02-14T08:36:01Z")
I need to capture services.exe from the path C:\\Windows\\System32\\services.exe, but for every event the path changes dynamically. What would be a generic way to capture whatever is there after the last \\. Thanks in advan… --- ## [\[Kibana\]: Nested child fields can not be visualized in discovery and be used like a filter aggregation](https://discuss.elastic.co/t/kibana-nested-child-fields-can-not-be-visualized-in-discovery-and-be-used-like-a-filter-aggregation/218739)
**Author:** [@AlekssM](https://discuss.elastic.co/u/AlekssM)\ **Replies:** 6\ **Last updated:** [February 14, 2020, 12:30pm UTC](https://discuss.elastic.co/t/kibana-nested-child-fields-can-not-be-visualized-in-discovery-and-be-used-like-a-filter-aggregation/218739 "2020-02-14T12:30:56Z")
Hello, Could you please give me an advice on how to be able to visualize and count field which is in the child doc and it is type: nested. I have seen several questions since '15 but no workarounds for this specific is… --- ## [6.4 to 7.3, After Upgrade Elasticsearch uses 50% more Disk storage](https://discuss.elastic.co/t/6-4-to-7-3-after-upgrade-elasticsearch-uses-50-more-disk-storage/218766)
**Author:** [@oshan](https://discuss.elastic.co/u/oshan)\ **Replies:** 3\ **Last updated:** [February 14, 2020, 12:24pm UTC](https://discuss.elastic.co/t/6-4-to-7-3-after-upgrade-elasticsearch-uses-50-more-disk-storage/218766 "2020-02-14T12:24:25Z")
I am using ES 6.4 and after full indexing its size is 64GB for the Geo shapes index. then I did all the code migrations and did the full indexing using ES 7.3 setup. now that index size is 97GB. Is this an expected cha… --- ## [None of the configured nodes are available when GC took more than 30 sec](https://discuss.elastic.co/t/none-of-the-configured-nodes-are-available-when-gc-took-more-than-30-sec/218965)
**Author:** [@chelawatankit](https://discuss.elastic.co/u/chelawatankit)\ **Replies:** 12\ **Last updated:** [February 14, 2020, 11:38am UTC](https://discuss.elastic.co/t/none-of-the-configured-nodes-are-available-when-gc-took-more-than-30-sec/218965 "2020-02-14T11:38:14Z")
Hi, I am using Elasticsearch 7.1.1 version. To connect with elasticsearch node I am using java transport client of 7.1.1 version. When I perform continuously insert, fetch and delete records from the index. (Night run)… --- ## [Elasticsearch Engineer I - aggregations problem/question](https://discuss.elastic.co/t/elasticsearch-engineer-i-aggregations-problem-question/219335)
**Author:** [@dyjo](https://discuss.elastic.co/u/dyjo)\ **Replies:** 2\ **Last updated:** [February 14, 2020, 11:04am UTC](https://discuss.elastic.co/t/elasticsearch-engineer-i-aggregations-problem-question/219335 "2020-02-14T11:04:54Z")
During exam preparation I run across the following: I wanted to see requests per country: GET logs\_server\*/\_search { "size": 0, "aggs": { "top\_countries": { "terms": { "field": "geoip.country\_name… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1625) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1627)