# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1670 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1671 --- ## [Grok vs disect?](https://discuss.elastic.co/t/grok-vs-disect/216156)
**Author:** [@fallenreaper](https://discuss.elastic.co/u/fallenreaper)\ **Replies:** 0\ **Last updated:** [January 23, 2020, 12:03am UTC](https://discuss.elastic.co/t/grok-vs-disect/216156 "2020-01-23T00:03:06Z")
I was having a workshop today, and noticed that a guy kept bringing up dissect and that it is far more powerful from grok. To some extent. My question is, what is better for the use case? This is the filter in my lo… --- ## [Mixed JSON and other content throws a warning for JSON filter](https://discuss.elastic.co/t/mixed-json-and-other-content-throws-a-warning-for-json-filter/216152)
**Author:** [@Andrew\_LeCody](https://discuss.elastic.co/u/Andrew_LeCody)\ **Replies:** 0\ **Last updated:** [January 22, 2020, 11:04pm UTC](https://discuss.elastic.co/t/mixed-json-and-other-content-throws-a-warning-for-json-filter/216152 "2020-01-22T23:04:02Z")
Despite having skip\_on\_invalid\_json set to true I keep getting errors on content that isn't purely json, but is a mix of json and other content (null, int, strings). Here's my filter config: filter { json { sourc… --- ## [No detection of fields in query\_string query strings results in "field expansion matches too many fields"](https://discuss.elastic.co/t/no-detection-of-fields-in-query-string-query-strings-results-in-field-expansion-matches-too-many-fields/216137)
**Author:** [@aaron\_ximm](https://discuss.elastic.co/u/aaron_ximm)\ **Replies:** 1\ **Last updated:** [January 22, 2020, 10:22pm UTC](https://discuss.elastic.co/t/no-detection-of-fields-in-query-string-query-strings-results-in-field-expansion-matches-too-many-fields/216137 "2020-01-22T22:22:35Z")
Hi, I am migrating from 5.6.x to 7.5.1. Testing existing application use of query\_string queries (either via DSL or implicitly in URI search) is breaking. I believes this is because of changes to how these queries are… --- ## [Logstash Error 413](https://discuss.elastic.co/t/logstash-error-413/216055)
**Author:** [@bhargav\_bharat](https://discuss.elastic.co/u/bhargav_bharat)\ **Replies:** 2\ **Last updated:** [January 22, 2020, 9:44pm UTC](https://discuss.elastic.co/t/logstash-error-413/216055 "2020-01-22T21:44:30Z")
Hello, I am facing below mentioned error and logstash stop sending log to elasticsearch and communication also broken. ########################################################### Jan 22 10:21:33 logstash\_agent logstas… --- ## [Elasticsearch unreachable error with logstash configuration](https://discuss.elastic.co/t/elasticsearch-unreachable-error-with-logstash-configuration/213043)
**Author:** [@Aniket\_Salvi](https://discuss.elastic.co/u/Aniket_Salvi)\ **Replies:** 4\ **Last updated:** [January 22, 2020, 9:12pm UTC](https://discuss.elastic.co/t/elasticsearch-unreachable-error-with-logstash-configuration/213043 "2020-01-22T21:12:23Z")
I am getting error when I am trying to access elasticsearch from logstash configuration. elasticsearch and logstash version - 7.4.0 logstash configuration :- input{ } output { elasticsearch { hosts =\> \["icici-elk-… --- ## [Elasticsearch 6.8.5 License JAR for Transport Client](https://discuss.elastic.co/t/elasticsearch-6-8-5-license-jar-for-transport-client/216123)
**Author:** [@jpappd](https://discuss.elastic.co/u/jpappd)\ **Replies:** 0\ **Last updated:** [January 22, 2020, 7:32pm UTC](https://discuss.elastic.co/t/elasticsearch-6-8-5-license-jar-for-transport-client/216123 "2020-01-22T19:32:42Z")
Starting a transport client in Elasticsearch 6.8.5 results in the following failure. Presumably a client license plugin of some sort is required. What is the Elastic Maven repository URL to download this missing binary? … --- ## [Is there a way to avoid very similar documents one after another in results?](https://discuss.elastic.co/t/is-there-a-way-to-avoid-very-similar-documents-one-after-another-in-results/216122)
**Author:** [@ffknob](https://discuss.elastic.co/u/ffknob)\ **Replies:** 0\ **Last updated:** [January 22, 2020, 7:25pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-avoid-very-similar-documents-one-after-another-in-results/216122 "2020-01-22T19:25:52Z")
Imagine a transactional system where sometimes the user can apply the same operation to a group of items. This operation generates a text based on a model provided by the user and only changes one or two specific terms: … --- ## [Search Engine and Elasticsearch](https://discuss.elastic.co/t/search-engine-and-elasticsearch/215930)
**Author:** [@Serhii\_Oleksenko](https://discuss.elastic.co/u/Serhii_Oleksenko)\ **Replies:** 6\ **Last updated:** [January 22, 2020, 7:01pm UTC](https://discuss.elastic.co/t/search-engine-and-elasticsearch/215930 "2020-01-22T19:01:40Z")
Hello! Are there search engines that use elastic? Search Engines that are completely independent of the search giants (Google, Bing). --- ## [ElasticSearch 6.7: Big difference between parent circuit breaker and jvm used heap](https://discuss.elastic.co/t/elasticsearch-6-7-big-difference-between-parent-circuit-breaker-and-jvm-used-heap/215967)
**Author:** [@musfiqur](https://discuss.elastic.co/u/musfiqur)\ **Replies:** 3\ **Last updated:** [January 22, 2020, 6:05pm UTC](https://discuss.elastic.co/t/elasticsearch-6-7-big-difference-between-parent-circuit-breaker-and-jvm-used-heap/215967 "2020-01-22T18:05:35Z")
Hi, We are using ES 6.7. We are looking at 2 metrics: Parent Circuit Breaker Used memory JVM used heap We see that ES circuit breaker are way off. We see that for the same timestamp: Used heap returns 17.85 GB where… --- ## [Ansible role elastic.elasticsearch - how to set listen address of http and api endpoints](https://discuss.elastic.co/t/ansible-role-elastic-elasticsearch-how-to-set-listen-address-of-http-and-api-endpoints/216096)
**Author:** [@jdelvecchio](https://discuss.elastic.co/u/jdelvecchio)\ **Replies:** 1\ **Last updated:** [January 22, 2020, 5:27pm UTC](https://discuss.elastic.co/t/ansible-role-elastic-elasticsearch-how-to-set-listen-address-of-http-and-api-endpoints/216096 "2020-01-22T17:27:50Z")
Hi, I'm using https://github.com/elastic/ansible-elasticsearch and cannot find the variables to set the listen address of the elasticsearch endpoints. By default, they are set to listen on 'localhost' which is a problem … --- ## [Can't get IIS Log row to match Grok-pattern](https://discuss.elastic.co/t/cant-get-iis-log-row-to-match-grok-pattern/215915)
**Author:** [@johanwallenborg](https://discuss.elastic.co/u/johanwallenborg)\ **Replies:** 4\ **Last updated:** [January 22, 2020, 5:03pm UTC](https://discuss.elastic.co/t/cant-get-iis-log-row-to-match-grok-pattern/215915 "2020-01-22T17:03:25Z")
Hello, I'm getting grokfailures on some of the lines on my IIS log parsing and currently i'm banging my head towards a wall. :slight\_smile: My pattern look like this: %{TIMESTAMP\_ISO8601:iis.access.time} %{IPORHOST:de… --- ## [Kafka input convert to json](https://discuss.elastic.co/t/kafka-input-convert-to-json/215785)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 5\ **Last updated:** [January 22, 2020, 4:23pm UTC](https://discuss.elastic.co/t/kafka-input-convert-to-json/215785 "2020-01-22T16:23:20Z")
I have use input as kafka and my message is like 2020-01-20 10:47:48: partition=0 offset=187965 machine=host1 queue=qhost1 comman=1298316293 action=REMOVE I want this to be separated out. how do I use filter input { … --- ## [XPack Monitoring Issue](https://discuss.elastic.co/t/xpack-monitoring-issue/214312)
**Author:** [@aniaks](https://discuss.elastic.co/u/aniaks)\ **Replies:** 3\ **Last updated:** [January 22, 2020, 4:23pm UTC](https://discuss.elastic.co/t/xpack-monitoring-issue/214312 "2020-01-22T16:23:06Z")
In Kibana when i try to enable to monitoring i am getting the following error " We checked the cluster defaults settings and found that xpack.monitoring.enabled is set to false set, which disables monitoring. Removi… --- ## [Logstash can't seem to connect after years or working fine](https://discuss.elastic.co/t/logstash-cant-seem-to-connect-after-years-or-working-fine/216091)
**Author:** [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)\ **Replies:** 0\ **Last updated:** [January 22, 2020, 3:59pm UTC](https://discuss.elastic.co/t/logstash-cant-seem-to-connect-after-years-or-working-fine/216091 "2020-01-22T15:59:30Z")
Hi, I have logstash 6.4.2 running inside docker container. The logstash instance was working fine for over a year. Just last few hours the below errors started hapening... I loged into the container itself and I pigned … --- ## [Query index by two fields](https://discuss.elastic.co/t/query-index-by-two-fields/216046)
**Author:** [@namali](https://discuss.elastic.co/u/namali)\ **Replies:** 5\ **Last updated:** [January 22, 2020, 3:45pm UTC](https://discuss.elastic.co/t/query-index-by-two-fields/216046 "2020-01-22T15:45:20Z")
how to find subempcategoryid from emp\_category index emp\_category index structure mainempcategoryid mainempcategoryname subempcategoryid subempcategoryname used elasticseaxh fillter pluging. but query not working … --- ## [Can we get the result column 1 multiply or divide by another column 2 into ew column in visulization](https://discuss.elastic.co/t/can-we-get-the-result-column-1-multiply-or-divide-by-another-column-2-into-ew-column-in-visulization/215931)
**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\ **Replies:** 3\ **Last updated:** [January 22, 2020, 3:08pm UTC](https://discuss.elastic.co/t/can-we-get-the-result-column-1-multiply-or-divide-by-another-column-2-into-ew-column-in-visulization/215931 "2020-01-22T15:08:38Z")
If data table in visulaization is having column 1 and column 2, can we display in column 3 as column 1 multiply or divide by column 2 --- ## [Logs are not coming in logs folder in Windows](https://discuss.elastic.co/t/logs-are-not-coming-in-logs-folder-in-windows/216005)
**Author:** [@naveen\_kumar2](https://discuss.elastic.co/u/naveen_kumar2)\ **Replies:** 2\ **Last updated:** [January 22, 2020, 2:56pm UTC](https://discuss.elastic.co/t/logs-are-not-coming-in-logs-folder-in-windows/216005 "2020-01-22T14:56:41Z")
After Installing Elastic search in Windows 10, logs are not coming in logs folder , I have also changed the elasticsearch.yml file and update the path, still logs are not coming, Can anyone help here? --- ## [How to read a text file using elastic search](https://discuss.elastic.co/t/how-to-read-a-text-file-using-elastic-search/216045)
**Author:** [@prudhvi](https://discuss.elastic.co/u/prudhvi)\ **Replies:** 6\ **Last updated:** [January 22, 2020, 2:50pm UTC](https://discuss.elastic.co/t/how-to-read-a-text-file-using-elastic-search/216045 "2020-01-22T14:50:01Z")
i am trying to read a text file using logstash and to push it to elasticsearch. How can i know if the input file is read, where can i see the data read by logstash. --- ## [Recommendation on very large text fields](https://discuss.elastic.co/t/recommendation-on-very-large-text-fields/216079)
**Author:** [@Jimmy](https://discuss.elastic.co/u/Jimmy)\ **Replies:** 0\ **Last updated:** [January 22, 2020, 2:45pm UTC](https://discuss.elastic.co/t/recommendation-on-very-large-text-fields/216079 "2020-01-22T14:45:38Z")
Hi, I have an index which one of the fields can contain thousands of characters, it's a field which an user can input some html information, and in some cases a base64 encoded image. This field does not need to be sear… --- ## [Rolling upgrade from 5.6 to 6.8 fails to start](https://discuss.elastic.co/t/rolling-upgrade-from-5-6-to-6-8-fails-to-start/215918)
**Author:** [@pmadley](https://discuss.elastic.co/u/pmadley)\ **Replies:** 2\ **Last updated:** [January 22, 2020, 2:29pm UTC](https://discuss.elastic.co/t/rolling-upgrade-from-5-6-to-6-8-fails-to-start/215918 "2020-01-22T14:29:38Z")
Pretty sure I exactly followed the instructions here: Install Elasticsearch with RPM | Elasticsearch Guide \[6.8\] | Elastic However tailing journalctl says the following. Anybody got any suggestions. I've very much a D… --- ## [Query for automplete feature?](https://discuss.elastic.co/t/query-for-automplete-feature/215949)
**Author:** [@rishabh\_jain](https://discuss.elastic.co/u/rishabh_jain)\ **Replies:** 1\ **Last updated:** [January 22, 2020, 2:21pm UTC](https://discuss.elastic.co/t/query-for-automplete-feature/215949 "2020-01-22T14:21:40Z")
should we use edge\_ngram for autocomplete? If yes will it have any any impact on query execution? If no then what is the use of ngram if one can search using query\_string query? Also let suppose want to create ngram o… --- ## [\[logstash.outputs.elasticsearch\] Attempted to resurrect connection to dead ES instance](https://discuss.elastic.co/t/logstash-outputs-elasticsearch-attempted-to-resurrect-connection-to-dead-es-instance/216027)
**Author:** [@pyerunka](https://discuss.elastic.co/u/pyerunka)\ **Replies:** 3\ **Last updated:** [January 22, 2020, 2:05pm UTC](https://discuss.elastic.co/t/logstash-outputs-elasticsearch-attempted-to-resurrect-connection-to-dead-es-instance/216027 "2020-01-22T14:05:48Z")
Hello, I am trying to use jdbc input plugin using logstash so that i can fetch data from sql database and create the index. But when i am running config file for logstash. It is showing me below error: \[2020-01-22T10… --- ## [DISK I/O Monitor alert from new relic for Elastic search nodes](https://discuss.elastic.co/t/disk-i-o-monitor-alert-from-new-relic-for-elastic-search-nodes/215981)
**Author:** [@Ajay16](https://discuss.elastic.co/u/Ajay16)\ **Replies:** 7\ **Last updated:** [January 22, 2020, 1:39pm UTC](https://discuss.elastic.co/t/disk-i-o-monitor-alert-from-new-relic-for-elastic-search-nodes/215981 "2020-01-22T13:39:53Z")
i am getting disk i/o monitor alert from new relic for the elastic search nodes(2 nodes)., how can i resolve this issue., help me out of this.,new to elastic search --- ## [Master node not discovered exception while executing /\_cat/indices query in elasticsearch](https://discuss.elastic.co/t/master-node-not-discovered-exception-while-executing-cat-indices-query-in-elasticsearch/216072)
**Author:** [@VIGNESHkumar](https://discuss.elastic.co/u/VIGNESHkumar)\ **Replies:** 0\ **Last updated:** [January 22, 2020, 1:36pm UTC](https://discuss.elastic.co/t/master-node-not-discovered-exception-while-executing-cat-indices-query-in-elasticsearch/216072 "2020-01-22T13:36:46Z")
cannot able to execute any query in elasticsearch. Masternode not discoverd exception occurs --- ## [Remove alias winlog from fields](https://discuss.elastic.co/t/remove-alias-winlog-from-fields/216069)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 0\ **Last updated:** [January 22, 2020, 1:28pm UTC](https://discuss.elastic.co/t/remove-alias-winlog-from-fields/216069 "2020-01-22T13:28:33Z")
Hi there, I would like to know if is possivel to remove winlog alias from winlogbeat fields? eg: winlog.channel =\> channel winlog.user.domain =\> user.domain ??? Thanks for the attention. --- ## [Remote tomcat logs](https://discuss.elastic.co/t/remote-tomcat-logs/216063)
**Author:** [@sagi](https://discuss.elastic.co/u/sagi)\ **Replies:** 0\ **Last updated:** [January 22, 2020, 1:01pm UTC](https://discuss.elastic.co/t/remote-tomcat-logs/216063 "2020-01-22T13:01:23Z")
I have configured ELK 6.8.2 on ubuntu 16.04, remote Syslog are loaded using filebeat , please anyone help me how to load remote tomcat logs are catalina.out. I am new to ELK. --- ## [Consul discovery plugin?](https://discuss.elastic.co/t/consul-discovery-plugin/215960)
**Author:** [@rgarrigue](https://discuss.elastic.co/u/rgarrigue)\ **Replies:** 4\ **Last updated:** [January 22, 2020, 12:31pm UTC](https://discuss.elastic.co/t/consul-discovery-plugin/215960 "2020-01-22T12:31:57Z")
Hi there I'm wondering if there's any plan for a discovery plugin based on Consul ? Best regards, Rémy --- ## [Index Management CISCO ASA device](https://discuss.elastic.co/t/index-management-cisco-asa-device/216051)
**Author:** [@Yashwant\_Shettigar](https://discuss.elastic.co/u/Yashwant_Shettigar)\ **Replies:** 0\ **Last updated:** [January 22, 2020, 12:06pm UTC](https://discuss.elastic.co/t/index-management-cisco-asa-device/216051 "2020-01-22T12:06:03Z")
Hello, I have a centralized ELK server, where data is getting shipped via winlogbeat and filebeat installed on client machines. Now I am trying to route cisco-asa devices logs to this server. Upto some extent I am bit s… --- ## [Help with grok pattern for haproxy](https://discuss.elastic.co/t/help-with-grok-pattern-for-haproxy/215441)
**Author:** [@mmikulic](https://discuss.elastic.co/u/mmikulic)\ **Replies:** 3\ **Last updated:** [January 22, 2020, 12:02pm UTC](https://discuss.elastic.co/t/help-with-grok-pattern-for-haproxy/215441 "2020-01-22T12:02:55Z")
Hi,please assit with creating custom grok pattern for logstash. I've created a custom log format in haproxy conf for purpose of logging mutual ssl authentication details for client certificates. log-format %ci:%cp\\ \[%t… --- ## [Kibana visualization search only the latest value](https://discuss.elastic.co/t/kibana-visualization-search-only-the-latest-value/215594)
**Author:** [@Ashutosh\_Pachisia](https://discuss.elastic.co/u/Ashutosh_Pachisia)\ **Replies:** 4\ **Last updated:** [January 22, 2020, 12:00pm UTC](https://discuss.elastic.co/t/kibana-visualization-search-only-the-latest-value/215594 "2020-01-22T12:00:52Z")
Is there any way in kibana to search data only of the latest timestamp I have a dataset that repeats every (10min-15 min ) not fixed interval with a different set of values I want the historic data as well as the lates… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1669) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1671)