# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1638 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1639 --- ## [\[Logstash\]\[jdbc input plugin\]sql\_last\_value with timestamp type support milliseconds?](https://discuss.elastic.co/t/logstash-jdbc-input-plugin-sql-last-value-with-timestamp-type-support-milliseconds/218520)
**Author:** [@ztkmkoo](https://discuss.elastic.co/u/ztkmkoo)\ **Replies:** 0\ **Last updated:** [February 10, 2020, 6:33am UTC](https://discuss.elastic.co/t/logstash-jdbc-input-plugin-sql-last-value-with-timestamp-type-support-milliseconds/218520 "2020-02-10T06:33:43Z")
Hi, I try to collect my data from mysql (or cubrid) to elasticsearch and hadoop. (test with logstash 7.5.2 on my local windows 10 desktop) And found sql\_last\_value is not worked as i expected. Its my config input { … --- ## [Group indexes multi searching?](https://discuss.elastic.co/t/group-indexes-multi-searching/218477)
**Author:** [@elink12](https://discuss.elastic.co/u/elink12)\ **Replies:** 4\ **Last updated:** [February 10, 2020, 6:28am UTC](https://discuss.elastic.co/t/group-indexes-multi-searching/218477 "2020-02-10T06:28:48Z")
Hi, I have 5 indexes with identical properties. How do I get 10 best results from each index when multi searching? $search = \[ 'index' =\> 'table\_\*', 'body' =\> \[ 'size' =\> '10', 'query' =\> \[ … --- ## [Create 1 document from multiple documents](https://discuss.elastic.co/t/create-1-document-from-multiple-documents/218519)
**Author:** [@hofrichterovak](https://discuss.elastic.co/u/hofrichterovak)\ **Replies:** 0\ **Last updated:** [February 10, 2020, 6:27am UTC](https://discuss.elastic.co/t/create-1-document-from-multiple-documents/218519 "2020-02-10T06:27:52Z")
Hello, I have an input field that contains values. For further processing I need to divide this field with a separator (";") and then work with it. In my case, this is the text of the script in which I search for consta… --- ## [Restore arcsight\_logs\_template index template created by ArcSight Module?](https://discuss.elastic.co/t/restore-arcsight-logs-template-index-template-created-by-arcsight-module/218103)
**Author:** [@undelete](https://discuss.elastic.co/u/undelete)\ **Replies:** 3\ **Last updated:** [February 10, 2020, 6:01am UTC](https://discuss.elastic.co/t/restore-arcsight-logs-template-index-template-created-by-arcsight-module/218103 "2020-02-10T06:01:19Z")
Hi, not sure if Elasticsearch is the correct category. However I used the Dev Tools in Kibana to update the pre-created index template arcsight\_logs\_template, created by the ArcSight Module. I updated the number\_of\_repli… --- ## [Elastic.elasticsearch role and Ansible Tower Dynamic Inventory](https://discuss.elastic.co/t/elastic-elasticsearch-role-and-ansible-tower-dynamic-inventory/218269)
**Author:** [@mudricd](https://discuss.elastic.co/u/mudricd)\ **Replies:** 1\ **Last updated:** [February 10, 2020, 5:55am UTC](https://discuss.elastic.co/t/elastic-elasticsearch-role-and-ansible-tower-dynamic-inventory/218269 "2020-02-10T05:55:13Z")
Hi, I am trying to configure Elasticsearch cluster over Ansible using official Elastic Ansible role elastic.elasticsearch. I set up Ansible tower and Dynamic Inventory for my AWS instances. I tagged my instances and hav… --- ## [Solution Design](https://discuss.elastic.co/t/solution-design/218510)
**Author:** [@Shalinicts](https://discuss.elastic.co/u/Shalinicts)\ **Replies:** 0\ **Last updated:** [February 10, 2020, 5:22am UTC](https://discuss.elastic.co/t/solution-design/218510 "2020-02-10T05:22:21Z")
What would be the good solution to monitor application and infra logs of servers implemented in GCP . Considering server count ~500 servers (Most of them RHEL 6.x) Logs:Infra Logs , 2 Application Logs per server Will … --- ## [Logstash Configuarion file issue](https://discuss.elastic.co/t/logstash-configuarion-file-issue/218346)
**Author:** [@Syed.Ubaid](https://discuss.elastic.co/u/Syed.Ubaid)\ **Replies:** 9\ **Last updated:** [February 10, 2020, 5:06am UTC](https://discuss.elastic.co/t/logstash-configuarion-file-issue/218346 "2020-02-10T05:06:44Z")
I have connect elk stack with mysql configuration file showing error . My configuration file is following input { jdbc { jdbc\_connection\_string =\> "jdbc:mysql://localhost:3306/db\_ublfunds\_cc" jdbc\_user =\> "abcd" jd… --- ## [How to deal with password in watcher](https://discuss.elastic.co/t/how-to-deal-with-password-in-watcher/218497)
**Author:** [@janice](https://discuss.elastic.co/u/janice)\ **Replies:** 3\ **Last updated:** [February 10, 2020, 4:39am UTC](https://discuss.elastic.co/t/how-to-deal-with-password-in-watcher/218497 "2020-02-10T04:39:34Z")
I am using watcher with webhook to login an IM tool which can only put username and password in payload as a SOAP message. Thus, I cannot benefit from password field encryption in HTTP basic authentication block. May I… --- ## [IMAP Input Plugin and Gmail](https://discuss.elastic.co/t/imap-input-plugin-and-gmail/218155)
**Author:** [@manunc](https://discuss.elastic.co/u/manunc)\ **Replies:** 3\ **Last updated:** [February 10, 2020, 2:46am UTC](https://discuss.elastic.co/t/imap-input-plugin-and-gmail/218155 "2020-02-10T02:46:23Z")
This question has already been posted but wihtout answer. I got this error when tryiing to use IMAP plugin in order to collect email from Gmail Imap SSL account: \[2020-02-06T22:04:16,642\]\[ERROR\]\[logstash.inputs.imap … --- ## [Search requests for an exact mach on a value with ampersand](https://discuss.elastic.co/t/search-requests-for-an-exact-mach-on-a-value-with-ampersand/218260)
**Author:** [@StephenGoodall](https://discuss.elastic.co/u/StephenGoodall)\ **Replies:** 6\ **Last updated:** [February 10, 2020, 12:18am UTC](https://discuss.elastic.co/t/search-requests-for-an-exact-mach-on-a-value-with-ampersand/218260 "2020-02-10T00:18:01Z")
Hi all, I'm trying to resolve an issue we have where the field has an ampersand. I did a search on a different field (field\_id)and found this document (edited to remove most of it): { "\_index": "index\_v1",… --- ## [Why won't Logstash rename a parsed JSON field?](https://discuss.elastic.co/t/why-wont-logstash-rename-a-parsed-json-field/218447)
**Author:** [@Sylancer](https://discuss.elastic.co/u/Sylancer)\ **Replies:** 6\ **Last updated:** [February 10, 2020, 12:04am UTC](https://discuss.elastic.co/t/why-wont-logstash-rename-a-parsed-json-field/218447 "2020-02-10T00:04:24Z")
So I've got some Zeek logs. In particular I've got http.log which Filebeat is adding the tag "Zeek-HTTP" to. That's all working fine. I want to use the JSON plugin to parse the "message" field in Logstash to a new target… --- ## [Difficulties forming a new Elastic Stack possibly because of Elasticsearch discovery procedure](https://discuss.elastic.co/t/difficulties-forming-a-new-elastic-stack-possibly-because-of-elasticsearch-discovery-procedure/218482)
**Author:** [@pwh589](https://discuss.elastic.co/u/pwh589)\ **Replies:** 2\ **Last updated:** [February 9, 2020, 11:48pm UTC](https://discuss.elastic.co/t/difficulties-forming-a-new-elastic-stack-possibly-because-of-elasticsearch-discovery-procedure/218482 "2020-02-09T23:48:35Z")
Hi, I am trying to form an Elastic Stack made of a single RHEL 7.4 Elasticsearch node, a RHEL 7.4 Kibana node, and RHEL 7.4 Logstash node, all 7.5.2 (current version as of now). For some reason, in 7.5.2 Elasticsearch … --- ## [Exact + partial match of text documents (with bool query?)](https://discuss.elastic.co/t/exact-partial-match-of-text-documents-with-bool-query/218454)
**Author:** [@hao9850](https://discuss.elastic.co/u/hao9850)\ **Replies:** 1\ **Last updated:** [February 9, 2020, 6:02pm UTC](https://discuss.elastic.co/t/exact-partial-match-of-text-documents-with-bool-query/218454 "2020-02-09T18:02:32Z")
Hi friends! I am building a news search engine and need a way to construct ES queries that delivers relevant results. Currently, I am using a combination of must and should clauses in a bool query for every news topic a … --- ## [Elasticsearch with OpenJDK Early Access build](https://discuss.elastic.co/t/elasticsearch-with-openjdk-early-access-build/217439)
**Author:** [@Sourav\_Paul](https://discuss.elastic.co/u/Sourav_Paul)\ **Replies:** 9\ **Last updated:** [February 9, 2020, 4:45pm UTC](https://discuss.elastic.co/t/elasticsearch-with-openjdk-early-access-build/217439 "2020-02-09T16:45:42Z")
Elasticsearch does not allow OpenJDK Early access build to start with. Is there a way to bypass this check? --- ## [Using Triple Quotes in Elastic Templates](https://discuss.elastic.co/t/using-triple-quotes-in-elastic-templates/218474)
**Author:** [@index](https://discuss.elastic.co/u/index)\ **Replies:** 0\ **Last updated:** [February 9, 2020, 4:16pm UTC](https://discuss.elastic.co/t/using-triple-quotes-in-elastic-templates/218474 "2020-02-09T16:16:21Z")
I am using templating to do query and rescoring work. The rescoring happens based on couple of values that are index in the document. Due to the logic that needs to happen based on the value in the document I decided to… --- ## [Parsed JSON object/hash requires a target configuration option with json message](https://discuss.elastic.co/t/parsed-json-object-hash-requires-a-target-configuration-option-with-json-message/218472)
**Author:** [@richzw](https://discuss.elastic.co/u/richzw)\ **Replies:** 1\ **Last updated:** [February 9, 2020, 4:06pm UTC](https://discuss.elastic.co/t/parsed-json-object-hash-requires-a-target-configuration-option-with-json-message/218472 "2020-02-09T16:06:54Z")
We met the following warning message as below under logstash 7.3 Parsed JSON object/hash requires a target configuration option {:source=\>"message", :raw=\>"\[{\\"itemBefore\\":0,\\"itemAward\\":1,\\"itemType\\":\\"hint\\"}\]"} a… --- ## [LogstashでFilebeatの送信ファイル名を取得する](https://discuss.elastic.co/t/logstash-filebeat/218434)
**Author:** [@echo](https://discuss.elastic.co/u/echo)\ **Replies:** 2\ **Last updated:** [February 9, 2020, 3:51pm UTC](https://discuss.elastic.co/t/logstash-filebeat/218434 "2020-02-09T15:51:54Z")
Logstash.conf で Filebeat から送信されたファイル名を grok で取得したいのですが、 下記で出来ませんでした。(バージョン7.5.2) 6.3.1 では出来ていて、ドキュメントを読んでも同様の動作が 可能な方法が見つからない状況です。 Filebeatの送信ファイルパスは、/var/log/2.log です。 どなたかご教示いただければと思います。 input { beats { por… --- ## [Multiple Elasticsearch instance on one node](https://discuss.elastic.co/t/multiple-elasticsearch-instance-on-one-node/218449)
**Author:** [@AndyGarcia](https://discuss.elastic.co/u/AndyGarcia)\ **Replies:** 5\ **Last updated:** [February 9, 2020, 9:44am UTC](https://discuss.elastic.co/t/multiple-elasticsearch-instance-on-one-node/218449 "2020-02-09T09:44:50Z")
I'm having an issue with setting up multiple instances of Elasticsearch 7.5 on one node. I've created 3 seperate directories, each with elasticsearch.yml, jvm.options, and log44j2.properties. I run the command "/bin/ela… --- ## [Logstash.inputs.twitter Twitter client error Connection reset exception IO Error](https://discuss.elastic.co/t/logstash-inputs-twitter-twitter-client-error-connection-reset-exception-io-error/218462)
**Author:** [@shakesperoo](https://discuss.elastic.co/u/shakesperoo)\ **Replies:** 0\ **Last updated:** [February 9, 2020, 8:08am UTC](https://discuss.elastic.co/t/logstash-inputs-twitter-twitter-client-error-connection-reset-exception-io-error/218462 "2020-02-09T08:08:55Z")
I keep get below error from time to time with logstash twitter input and i dont know whats the issue or what shall i do ! \[2020-02-08T21:55:33,230\]\[WARN \]\[logstash.inputs.twitter \]\[main\] Twitter client error {:message… --- ## [Elasticsearc with xpack security enabled](https://discuss.elastic.co/t/elasticsearc-with-xpack-security-enabled/218282)
**Author:** [@kasim123](https://discuss.elastic.co/u/kasim123)\ **Replies:** 2\ **Last updated:** [February 9, 2020, 6:46am UTC](https://discuss.elastic.co/t/elasticsearc-with-xpack-security-enabled/218282 "2020-02-09T06:46:59Z")
Hi Team, I have configued elasticsearch statefulset object using official elasticsearch helm chart https://github.com/elastic/helm-charts. I enabeld xpack security feature and created a CA certificate on one of the ela… --- ## [Watcher Assistance](https://discuss.elastic.co/t/watcher-assistance/218451)
**Author:** [@ted1621](https://discuss.elastic.co/u/ted1621)\ **Replies:** 0\ **Last updated:** [February 8, 2020, 10:38pm UTC](https://discuss.elastic.co/t/watcher-assistance/218451 "2020-02-08T22:38:36Z")
Hello I am hoping someone can assist with this JSON watcher alert. I am simply trying to create an alert the triggers when any monitored host experiences 5 failed logon attempts within 1 minute. Thanks in advance for … --- ## [Pattern works on the grok debugger but fails in logstash](https://discuss.elastic.co/t/pattern-works-on-the-grok-debugger-but-fails-in-logstash/218410)
**Author:** [@moderable](https://discuss.elastic.co/u/moderable)\ **Replies:** 5\ **Last updated:** [February 8, 2020, 4:06pm UTC](https://discuss.elastic.co/t/pattern-works-on-the-grok-debugger-but-fails-in-logstash/218410 "2020-02-08T16:06:49Z")
Can someone please tell me how I can debug this pattern and corresponding log entry that works on the grok debugger but fails in logstash Here is the code that works on the grok debugger: (.\*)\\\]%{SPACE}\[-\]%{SPACE}(.\*)\[… --- ## [Multiple pipeline not processing with no errors](https://discuss.elastic.co/t/multiple-pipeline-not-processing-with-no-errors/218439)
**Author:** [@vijay\_kaali](https://discuss.elastic.co/u/vijay_kaali)\ **Replies:** 0\ **Last updated:** [February 8, 2020, 12:38pm UTC](https://discuss.elastic.co/t/multiple-pipeline-not-processing-with-no-errors/218439 "2020-02-08T12:38:01Z")
I have two input plug in kafka and csv . pipeline.id: main path.config: "/etc/logstash/conf.d/\*.conf" pipeline.id: hpux path.config: "/etc/logstash/conf.d/hpux\_conf/hpux.conf" but only main is working hpux it not pr… --- ## [Remove nested documents from index using logstash](https://discuss.elastic.co/t/remove-nested-documents-from-index-using-logstash/217606)
**Author:** [@Mohan\_vel](https://discuss.elastic.co/u/Mohan_vel)\ **Replies:** 4\ **Last updated:** [February 8, 2020, 11:14am UTC](https://discuss.elastic.co/t/remove-nested-documents-from-index-using-logstash/217606 "2020-02-08T11:14:31Z")
Hi All i am trying to index the data from MS SQL server to elastic search as nested documents it's working fine but the challenge is i have to remove the nested documents and main documnet if the is\_active column retriev… --- ## [Queries regarding snapshot APIs](https://discuss.elastic.co/t/queries-regarding-snapshot-apis/218422)
**Author:** [@pinakinab](https://discuss.elastic.co/u/pinakinab)\ **Replies:** 1\ **Last updated:** [February 8, 2020, 11:08am UTC](https://discuss.elastic.co/t/queries-regarding-snapshot-apis/218422 "2020-02-08T11:08:37Z")
We are trying to use backup/restore feature of Elasticsearch using Azure Storage. We are using OSS version of ES 7.2.0. During the process we came across following queries for which we could not find documentation: Is … --- ## [How to filter the following query?](https://discuss.elastic.co/t/how-to-filter-the-following-query/218430)
**Author:** [@abhijith\_chandran](https://discuss.elastic.co/u/abhijith_chandran)\ **Replies:** 1\ **Last updated:** [February 8, 2020, 10:57am UTC](https://discuss.elastic.co/t/how-to-filter-the-following-query/218430 "2020-02-08T10:57:42Z")
Hi, I am using the following search: { "\_source": \[ "title", "bench", "court", "id\_" \], "size": 10, "query": { "bool": { "must": { … --- ## [Prevent co-placement of daily heavy-duty indices](https://discuss.elastic.co/t/prevent-co-placement-of-daily-heavy-duty-indices/218432)
**Author:** [@Niteshade](https://discuss.elastic.co/u/Niteshade)\ **Replies:** 1\ **Last updated:** [February 8, 2020, 10:41am UTC](https://discuss.elastic.co/t/prevent-co-placement-of-daily-heavy-duty-indices/218432 "2020-02-08T10:41:38Z")
Hi We operate a \>100 nodes cluster, the size mainly intended to allow requests on a big temporal depth. We are daily creating a few separate indices for indexing ( up to ten shard per indice + replicas ). We notice t… --- ## [Logstash breaks my log line into multiple documets](https://discuss.elastic.co/t/logstash-breaks-my-log-line-into-multiple-documets/215156)
**Author:** [@kasra](https://discuss.elastic.co/u/kasra)\ **Replies:** 14\ **Last updated:** [February 8, 2020, 7:23am UTC](https://discuss.elastic.co/t/logstash-breaks-my-log-line-into-multiple-documets/215156 "2020-02-08T07:23:15Z")
I have nested JSON log files which I'm trying to parse and ship to my ES v.5 My logstash version is also 7.5. The problem is among for instance 3000 logs I get 250 \_jsonparsefailure! My log format is nested JSON. her… --- ## [ECK with Storage Class](https://discuss.elastic.co/t/eck-with-storage-class/218424)
**Author:** [@Nerbelir](https://discuss.elastic.co/u/Nerbelir)\ **Replies:** 1\ **Last updated:** [February 8, 2020, 4:23am UTC](https://discuss.elastic.co/t/eck-with-storage-class/218424 "2020-02-08T04:23:53Z")
Hola, I'm trying to something a bit novel and use the guides for quickstart and volume templates to get ECK working. The novel part is I'm mounting an SMB share with Azure's Flexvolume SMB driver. I can get the PV setup… --- ## [Multiline is not displayed in the "Visualize" or "Dashboard" screen](https://discuss.elastic.co/t/multiline-is-not-displayed-in-the-visualize-or-dashboard-screen/216427)
**Author:** [@totopo\_loco](https://discuss.elastic.co/u/totopo_loco)\ **Replies:** 6\ **Last updated:** [February 7, 2020, 11:51pm UTC](https://discuss.elastic.co/t/multiline-is-not-displayed-in-the-visualize-or-dashboard-screen/216427 "2020-02-07T23:51:34Z")
Hello Dear Community, I am having problems to display multi line messages after they were parsed in Kibana 7.5.2. In the visualization and dashboard in Kibana the "message.keyword" is not shown when multi line messag… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1637) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1639)