# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1686 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1687 --- ## [Streaming events from Elastic](https://discuss.elastic.co/t/streaming-events-from-elastic/214923)
**Author:** [@Olatunde\_Tokun](https://discuss.elastic.co/u/Olatunde_Tokun)\ **Replies:** 0\ **Last updated:** [January 14, 2020, 2:46am UTC](https://discuss.elastic.co/t/streaming-events-from-elastic/214923 "2020-01-14T02:46:06Z")
I currently use logstash to stream logs from Elasticsearch to an syslog connector on a schedule (say 5mins). Every 5 mins logstash runs and grabs events in the index then fires them off to the syslog output. Input (Elas… --- ## [入力ログファイルサイズとインデックスサイズの関係性](https://discuss.elastic.co/t/topic/213988)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 2\ **Last updated:** [January 14, 2020, 1:57am UTC](https://discuss.elastic.co/t/topic/213988 "2020-01-14T01:57:38Z")
elasticsearchにファイルを取り込む際の入力ログファイルのサイズと、作成されるインデックスサイズの関係性について教えて下さい。 入力ファイルとして、110byteのログAと2byteのログBを別々のインデックスに取り込んだところ、ログAを取り込んだインデックスサイズは12121byte、ログBを取り込んだインデックスサイズは5732byteとなりました。 入力ファイル1byteあたりのインデックスサイズで考えると、ログAは… --- ## [Parsing DNS Logs from GCP Cloud](https://discuss.elastic.co/t/parsing-dns-logs-from-gcp-cloud/214911)
**Author:** [@daniel\_a](https://discuss.elastic.co/u/daniel_a)\ **Replies:** 1\ **Last updated:** [January 13, 2020, 11:32pm UTC](https://discuss.elastic.co/t/parsing-dns-logs-from-gcp-cloud/214911 "2020-01-13T23:32:33Z")
Is there a parser for the DNS logs in Logstash? I've noticed some of my logs are not being parsed, the ones with multiple lines. This shows up as a single field. How can I parse it? jsonPayload.rdata google.com. 299 IN … --- ## [Extracting parts of different timestamp fields](https://discuss.elastic.co/t/extracting-parts-of-different-timestamp-fields/214915)
**Author:** [@Peter\_Li](https://discuss.elastic.co/u/Peter_Li)\ **Replies:** 1\ **Last updated:** [January 13, 2020, 11:30pm UTC](https://discuss.elastic.co/t/extracting-parts-of-different-timestamp-fields/214915 "2020-01-13T23:30:10Z")
I have many timestamp fields: AdmitDateTime DCDateTime etc. I want to pull out the yyyy, MM, dd parts individually from them, eg copy =\> { "AdmitDateTime" =\> "@timestamp" } add\_field =\> { AdmitYear =\> "%{+yyyy}" … --- ## [Drop filter is not working for certain string](https://discuss.elastic.co/t/drop-filter-is-not-working-for-certain-string/214901)
**Author:** [@hadars](https://discuss.elastic.co/u/hadars)\ **Replies:** 3\ **Last updated:** [January 13, 2020, 11:29pm UTC](https://discuss.elastic.co/t/drop-filter-is-not-working-for-certain-string/214901 "2020-01-13T23:29:09Z")
Hi, I am trying to apply filter only if message has certain string. For example my message has "skipping L1 entity store" and my config looks like, filter { if \[msg\] == "skipping L1 entity store" { dro… --- ## [Multiple Grok patterns or can I use Regex?](https://discuss.elastic.co/t/multiple-grok-patterns-or-can-i-use-regex/214910)
**Author:** [@IshanP1](https://discuss.elastic.co/u/IshanP1)\ **Replies:** 1\ **Last updated:** [January 13, 2020, 10:37pm UTC](https://discuss.elastic.co/t/multiple-grok-patterns-or-can-i-use-regex/214910 "2020-01-13T22:37:29Z")
I am making a centralised syslogging server. Do i have to make a different grok filter for every single different format of syslog or can I use something like regex to pick out certain elements of a log? Dec 16 15:01:13… --- ## [Timestamp explanation](https://discuss.elastic.co/t/timestamp-explanation/214749)
**Author:** [@amhulli](https://discuss.elastic.co/u/amhulli)\ **Replies:** 2\ **Last updated:** [January 13, 2020, 10:07pm UTC](https://discuss.elastic.co/t/timestamp-explanation/214749 "2020-01-13T22:07:23Z")
Hi all, I'm using ELK 7.4.2 I have an issue where Kibana throws up an error when I click on any of the bars on the graph in the discover tab (it complains about: Request to Elasticsearch failed: {"error":{"root\_cause"… --- ## [Right configuration to send email (SES) alerts in ELK](https://discuss.elastic.co/t/right-configuration-to-send-email-ses-alerts-in-elk/214893)
**Author:** [@vpuvvala](https://discuss.elastic.co/u/vpuvvala)\ **Replies:** 2\ **Last updated:** [January 13, 2020, 10:02pm UTC](https://discuss.elastic.co/t/right-configuration-to-send-email-ses-alerts-in-elk/214893 "2020-01-13T22:02:03Z")
Hello, I'm trying to configure email notification alerts from Elasticsearch using SES SMTP server. Elasticsearch version: 7.4.2 Configuration: volumeMounts: - name: keystore mountPath: /usr/share/e… --- ## [How to send data from HTTP input to ElasticSearch using Logstash and jdbc\_streaming filter?](https://discuss.elastic.co/t/how-to-send-data-from-http-input-to-elasticsearch-using-logstash-and-jdbc-streaming-filter/214898)
**Author:** [@aliabbasifard](https://discuss.elastic.co/u/aliabbasifard)\ **Replies:** 1\ **Last updated:** [January 13, 2020, 9:52pm UTC](https://discuss.elastic.co/t/how-to-send-data-from-http-input-to-elasticsearch-using-logstash-and-jdbc-streaming-filter/214898 "2020-01-13T21:52:06Z")
I want to send data from Http to elasticsearch using logstash and I want to enrich my data using jdbc\_streaming filter plugin. This is my logstash config: input { http { id =\> "sensor\_data\_http\_input" use… --- ## [Logstash JDBC SSL Error](https://discuss.elastic.co/t/logstash-jdbc-ssl-error/209631)
**Author:** [@newtologstash](https://discuss.elastic.co/u/newtologstash)\ **Replies:** 9\ **Last updated:** [January 13, 2020, 8:54pm UTC](https://discuss.elastic.co/t/logstash-jdbc-ssl-error/209631 "2020-01-13T20:54:42Z")
Hi, I'm trying to use jdbc-input plugin to pull the data from oracle. It is working fine when using TCP connection string, but getting below error when trying to connect using TCP"S" connection (SSL). \[ERROR\]\[logstash.… --- ## [Refresh Field List](https://discuss.elastic.co/t/refresh-field-list/214899)
**Author:** [@mannam14387](https://discuss.elastic.co/u/mannam14387)\ **Replies:** 0\ **Last updated:** [January 13, 2020, 8:47pm UTC](https://discuss.elastic.co/t/refresh-field-list/214899 "2020-01-13T20:47:20Z")
Some times we fail to see any data in kibana for some indices but once i refresh the fields on that particular index it starts to show the data again , do i need to change the field types in this case or I am missing so… --- ## [Customizing kibana deployment (logos, css, etc.)](https://discuss.elastic.co/t/customizing-kibana-deployment-logos-css-etc/214305)
**Author:** [@ebalmeida](https://discuss.elastic.co/u/ebalmeida)\ **Replies:** 4\ **Last updated:** [January 13, 2020, 8:21pm UTC](https://discuss.elastic.co/t/customizing-kibana-deployment-logos-css-etc/214305 "2020-01-13T20:21:20Z")
Hello team, On a local kibana deployment it's possible (however unwieldy, because version updates) to customize logos and other graphical settings by directly changing the relevant files (svg logos or related css). Is t… --- ## [Parsing EventData field correctly from json input](https://discuss.elastic.co/t/parsing-eventdata-field-correctly-from-json-input/214891)
**Author:** [@bensonmp](https://discuss.elastic.co/u/bensonmp)\ **Replies:** 1\ **Last updated:** [January 13, 2020, 7:29pm UTC](https://discuss.elastic.co/t/parsing-eventdata-field-correctly-from-json-input/214891 "2020-01-13T19:29:47Z")
Hi, I'm new to using ELK. I'm looking for some help to properly parse the EventData field from my windows logs. Here's an example event: \ \ \<… --- ## [Adding master nodes to Existing cluster](https://discuss.elastic.co/t/adding-master-nodes-to-existing-cluster/214880)
**Author:** [@surya2](https://discuss.elastic.co/u/surya2)\ **Replies:** 6\ **Last updated:** [January 13, 2020, 6:55pm UTC](https://discuss.elastic.co/t/adding-master-nodes-to-existing-cluster/214880 "2020-01-13T18:55:30Z")
Hello All, I have 14 node elasticsearch cluster in which all nodes are data,master,client. Now i want to have separate master nodes. How do i achieve this without causing splitbrain or down time. I can bring one node at… --- ## [Append to a property if exists](https://discuss.elastic.co/t/append-to-a-property-if-exists/214889)
**Author:** [@Sbezgoan](https://discuss.elastic.co/u/Sbezgoan)\ **Replies:** 1\ **Last updated:** [January 13, 2020, 6:37pm UTC](https://discuss.elastic.co/t/append-to-a-property-if-exists/214889 "2020-01-13T18:37:56Z")
Hello, Input csv looks like : "","Code","Date","Time","Open","High","Low","Close","Volume" "1","3IINFOTECH",20150703,"09:16:00",5.55,4.55,4.55,4.55,835 "2","3IINFOTECH",20150703,"09:17:00",5.55,4.55,4.55,4.55,390 L… --- ## [Native controller process has stopped : no new native processes can be started](https://discuss.elastic.co/t/native-controller-process-has-stopped-no-new-native-processes-can-be-started/214077)
**Author:** [@StepBat](https://discuss.elastic.co/u/StepBat)\ **Replies:** 5\ **Last updated:** [January 13, 2020, 6:10pm UTC](https://discuss.elastic.co/t/native-controller-process-has-stopped-no-new-native-processes-can-be-started/214077 "2020-01-13T18:10:19Z")
Hello support I need your help in order to fix a crash of elasticsearch just after the starting with the message 'Native controller process has stopped - no new native processes can be started" Elasticsearch is started… --- ## [Connection reset by peer in 6.8 ES with 6.1.4 client](https://discuss.elastic.co/t/connection-reset-by-peer-in-6-8-es-with-6-1-4-client/209605)
**Author:** [@nikuland](https://discuss.elastic.co/u/nikuland)\ **Replies:** 6\ **Last updated:** [January 13, 2020, 5:59pm UTC](https://discuss.elastic.co/t/connection-reset-by-peer-in-6-8-es-with-6-1-4-client/209605 "2020-01-13T17:59:40Z")
Often we are seeing "Connection reset by Peer" after migrating to ES 6.8. We are still using ES 6.1.4 client. It recovers, but often there is Connection reset by Peer. Any solution or how can this be debugged. --- ## [Random indexing](https://discuss.elastic.co/t/random-indexing/214876)
**Author:** [@shankarana](https://discuss.elastic.co/u/shankarana)\ **Replies:** 1\ **Last updated:** [January 13, 2020, 5:58pm UTC](https://discuss.elastic.co/t/random-indexing/214876 "2020-01-13T17:58:37Z")
Hi Team, My usecase to update index whenever the new json document received. Logstash will receive event and update ES index. example: 01.00 AM: index name: currencies inserted with 5 documents source-destination… --- ## [APM agent not able to connect apm server](https://discuss.elastic.co/t/apm-agent-not-able-to-connect-apm-server/214874)
**Author:** [@sattishv](https://discuss.elastic.co/u/sattishv)\ **Replies:** 1\ **Last updated:** [January 13, 2020, 5:05pm UTC](https://discuss.elastic.co/t/apm-agent-not-able-to-connect-apm-server/214874 "2020-01-13T17:05:04Z")
Hi Team, We were able to install elastic search, kibana and apm server successfully on MacOS and apm agent was hooked with the application deployed in ubuntu but not able to connect to apm server. Kibana version: 7.5.… --- ## [FieldData or Nested optimization. Doubt](https://discuss.elastic.co/t/fielddata-or-nested-optimization-doubt/214877)
**Author:** [@EliuFlorez](https://discuss.elastic.co/u/EliuFlorez)\ **Replies:** 0\ **Last updated:** [January 13, 2020, 4:41pm UTC](https://discuss.elastic.co/t/fielddata-or-nested-optimization-doubt/214877 "2020-01-13T16:41:51Z")
Hi guys, I find myself making some changes to an old scrits and I have the doubt that it would be more optimal if I continue using 'fielddata' or 'nested' that is to say the scripts do the searches or aggregations from a… --- ## [Default\_field setting](https://discuss.elastic.co/t/default-field-setting/214311)
**Author:** [@Matt\_McGovern](https://discuss.elastic.co/u/Matt_McGovern)\ **Replies:** 7\ **Last updated:** [January 13, 2020, 4:21pm UTC](https://discuss.elastic.co/t/default-field-setting/214311 "2020-01-13T16:21:05Z")
Is there any way to set a default field for an index, such that when a user types an expression in kibana discover, the query will be to that default field and not every field in the index? I'm looking all over the docu… --- ## [Retieve element in an array object](https://discuss.elastic.co/t/retieve-element-in-an-array-object/214785)
**Author:** [@pilo](https://discuss.elastic.co/u/pilo)\ **Replies:** 4\ **Last updated:** [January 13, 2020, 4:11pm UTC](https://discuss.elastic.co/t/retieve-element-in-an-array-object/214785 "2020-01-13T16:11:21Z")
Hi everyone, I have a question about array object in elasticsearch For example i have a mapping like this one: PUT test { "settings": { ...}, "mappings": { "properties": { "id":{ "type": "keyword… --- ## [Ideal data/ingester node count](https://discuss.elastic.co/t/ideal-data-ingester-node-count/214612)
**Author:** [@Naseem](https://discuss.elastic.co/u/Naseem)\ **Replies:** 5\ **Last updated:** [January 13, 2020, 3:36pm UTC](https://discuss.elastic.co/t/ideal-data-ingester-node-count/214612 "2020-01-13T15:36:07Z")
tl;dr fewer data nodes with more disk space each vs more data nodes with smaller disk space each? Our current setup consists of 3 master nodes, and 4 data/ingest nodes with large amounts of disk size each. Our daily in… --- ## [How to potentially flatten a nested document design?](https://discuss.elastic.co/t/how-to-potentially-flatten-a-nested-document-design/214650)
**Author:** [@cgremakes](https://discuss.elastic.co/u/cgremakes)\ **Replies:** 2\ **Last updated:** [January 13, 2020, 3:34pm UTC](https://discuss.elastic.co/t/how-to-potentially-flatten-a-nested-document-design/214650 "2020-01-13T15:34:33Z")
I am probably like many people that have more of a SQL background, and am attempting to branch out into using Elasticsearch. I am attempting to make a design choice that I'm hoping I can get some input on. We have a pr… --- ## [Percentage Metric outside of Visual Builder](https://discuss.elastic.co/t/percentage-metric-outside-of-visual-builder/214484)
**Author:** [@SpinDORK](https://discuss.elastic.co/u/SpinDORK)\ **Replies:** 3\ **Last updated:** [January 13, 2020, 3:27pm UTC](https://discuss.elastic.co/t/percentage-metric-outside-of-visual-builder/214484 "2020-01-13T15:27:14Z")
Hi, Will we ever get an easy to use Percentage tool for the Metric Visualisation and not simply the Visualisation Builder as this does not accurately show data over multiple years as we can only select the most recent d… --- ## [Filebeat / Logstash pipeline exception parsing csv](https://discuss.elastic.co/t/filebeat-logstash-pipeline-exception-parsing-csv/212896)
**Author:** [@galexander87](https://discuss.elastic.co/u/galexander87)\ **Replies:** 1\ **Last updated:** [January 13, 2020, 3:14pm UTC](https://discuss.elastic.co/t/filebeat-logstash-pipeline-exception-parsing-csv/212896 "2020-01-13T15:14:31Z")
I am trying to send some reports in CSV format to logstash and then Elasticsearch. I am getting this pipeline error: \[WARN \] \[io.netty.channel.DefaultChannelPipeline\] An exceptionCaught() event was fired, and it reache… --- ## [Elasticsearch ngram tokenizer](https://discuss.elastic.co/t/elasticsearch-ngram-tokenizer/214398)
**Author:** [@mirec](https://discuss.elastic.co/u/mirec)\ **Replies:** 3\ **Last updated:** [January 13, 2020, 3:12pm UTC](https://discuss.elastic.co/t/elasticsearch-ngram-tokenizer/214398 "2020-01-13T15:12:30Z")
Hi, \[Elasticsearch version 6.7.2\] I am trying to index my data using ngram tokenizer but sometimes it takes too much time to index. What I am trying to do is to make user to be able to search for any word or part of t… --- ## [Elasticsearch 6.4 xpack password enabling shows error](https://discuss.elastic.co/t/elasticsearch-6-4-xpack-password-enabling-shows-error/214722)
**Author:** [@Amarsha\_N.G](https://discuss.elastic.co/u/Amarsha_N.G)\ **Replies:** 2\ **Last updated:** [January 13, 2020, 3:09pm UTC](https://discuss.elastic.co/t/elasticsearch-6-4-xpack-password-enabling-shows-error/214722 "2020-01-13T15:09:53Z")
Path to directory where to store the data (separate multiple locations by comma): #path.data: /path/to/data Path to log files: #path.logs: /path/to/logs ----------------------------------- Memory ------------------… --- ## [Extracting the last word of an event/line (Grok)](https://discuss.elastic.co/t/extracting-the-last-word-of-an-event-line-grok/214774)
**Author:** [@nino](https://discuss.elastic.co/u/nino)\ **Replies:** 4\ **Last updated:** [January 13, 2020, 3:04pm UTC](https://discuss.elastic.co/t/extracting-the-last-word-of-an-event-line-grok/214774 "2020-01-13T15:04:11Z")
Hello all, i am looking for a Grok pattern to retrieve the last word a matching line with literal. input (file content) THISLINE 1,011.53EUR 12,815.50EUR 2,940.17 100,011.53EUR filter grok{ match =\> { … --- ## [Alerts and passing additional detail in message body](https://discuss.elastic.co/t/alerts-and-passing-additional-detail-in-message-body/214857)
**Author:** [@Michael\_Schellhouse](https://discuss.elastic.co/u/Michael_Schellhouse)\ **Replies:** 0\ **Last updated:** [January 13, 2020, 3:00pm UTC](https://discuss.elastic.co/t/alerts-and-passing-additional-detail-in-message-body/214857 "2020-01-13T15:00:10Z")
Currently have alerts setup based on extraction query. I have used aggregation to get summary counts by two fields. I would like to output the agg results in the body of the alert message. problem is, message will onl… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1685) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1687)