# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1748 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1749 --- ## [Logstash 7.4.0 support Excel sheet filter plugin?](https://discuss.elastic.co/t/logstash-7-4-0-support-excel-sheet-filter-plugin/210209)
**Author:** [@sanurani](https://discuss.elastic.co/u/sanurani)\ **Replies:** 0\ **Last updated:** [December 2, 2019, 3:35pm UTC](https://discuss.elastic.co/t/logstash-7-4-0-support-excel-sheet-filter-plugin/210209 "2019-12-02T15:35:09Z")
Am looking for a input filter plugin to read data from excel sheet and am working on Logstash 7.4.0 version. I see the online resources for CSV filter plugin but not for excel sheet. Appreciate any help, thank you:) … --- ## [Avoid print of "original data now in message field" when "JSON parse error"](https://discuss.elastic.co/t/avoid-print-of-original-data-now-in-message-field-when-json-parse-error/210146)
**Author:** [@gghdr](https://discuss.elastic.co/u/gghdr)\ **Replies:** 1\ **Last updated:** [December 2, 2019, 3:31pm UTC](https://discuss.elastic.co/t/avoid-print-of-original-data-now-in-message-field-when-json-parse-error/210146 "2019-12-02T15:31:00Z")
Hi all, as the title suggests, i want to get the "JSON parse error" as usual, but without the print of the message (that in my situation can be really big, MBs) on the log, to avoid the saturation of the log itself. Fr… --- ## [How to get unique hosts in the visualisation](https://discuss.elastic.co/t/how-to-get-unique-hosts-in-the-visualisation/210208)
**Author:** [@Sreekanth3](https://discuss.elastic.co/u/Sreekanth3)\ **Replies:** 0\ **Last updated:** [December 2, 2019, 3:25pm UTC](https://discuss.elastic.co/t/how-to-get-unique-hosts-in-the-visualisation/210208 "2019-12-02T15:25:09Z")
How to get the unique hosts and recipients without repeating them. I have used TOP HIT , but there is unique count option which is showing only count but , I need the name of the hosts also . I have used the Table visu… --- ## [Time difference in log times](https://discuss.elastic.co/t/time-difference-in-log-times/210179)
**Author:** [@rj23495](https://discuss.elastic.co/u/rj23495)\ **Replies:** 1\ **Last updated:** [December 2, 2019, 3:21pm UTC](https://discuss.elastic.co/t/time-difference-in-log-times/210179 "2019-12-02T15:21:17Z")
Hi, i have added a new time field for my log parser and there is a time difference of 2:30 in time that is recorded in ES and the log time. PFA. grok { match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:time} \\\[%{DATA:pool}… --- ## [Different field types from same grok statement](https://discuss.elastic.co/t/different-field-types-from-same-grok-statement/209966)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 1\ **Last updated:** [December 2, 2019, 3:11pm UTC](https://discuss.elastic.co/t/different-field-types-from-same-grok-statement/209966 "2019-12-02T15:11:05Z")
Hi, I use the below grok to convert the source.address to source.ip and convert from string to IP as part of the ECS. I have firewall and IPS logs running through this. Prior to the grok i convert source.address to st… --- ## [Поделючение elasticsearch к другому elasticsearch](https://discuss.elastic.co/t/elasticsearch-elasticsearch/210128)
**Author:** [@SeaBearYak](https://discuss.elastic.co/u/SeaBearYak)\ **Replies:** 1\ **Last updated:** [December 2, 2019, 2:47pm UTC](https://discuss.elastic.co/t/elasticsearch-elasticsearch/210128 "2019-12-02T14:47:44Z")
Доброго дня! Имеется два компьютера, на которых установлен ELK-стек. Возникла необходимость после обработки логов с помощью elasticsearch и elasticSIEM на первом ПК, отправлять данные на elasticsearch второго компьютер… --- ## [How does script caching work when the script is updated?](https://discuss.elastic.co/t/how-does-script-caching-work-when-the-script-is-updated/210199)
**Author:** [@brabster](https://discuss.elastic.co/u/brabster)\ **Replies:** 1\ **Last updated:** [December 2, 2019, 2:46pm UTC](https://discuss.elastic.co/t/how-does-script-caching-work-when-the-script-is-updated/210199 "2019-12-02T14:46:48Z")
Does Elasticsearch recognise that a previously cached script has been updated, and replace the cache entry with the new script compilation? I've seen code that manages script caching client-side, explicitly uploading ne… --- ## [Как настроить порядок вывода результатов запроса по релевантности?](https://discuss.elastic.co/t/topic/210036)
**Author:** [@111249](https://discuss.elastic.co/u/111249)\ **Replies:** 1\ **Last updated:** [December 2, 2019, 2:43pm UTC](https://discuss.elastic.co/t/topic/210036 "2019-12-02T14:43:35Z")
Смысл вопроса в следующем: у меня есть множество товаров, которые содержат к примеру слово "помидор". Я хочу настроить выборку следующим образом: приоритет должен отдаваться сначала точным совпадениям, то есть, если поль… --- ## [Ордер при поиске не такой как хочется](https://discuss.elastic.co/t/topic/209851)
**Author:** [@Ekaterina\_Nekrasova](https://discuss.elastic.co/u/Ekaterina_Nekrasova)\ **Replies:** 2\ **Last updated:** [December 2, 2019, 2:41pm UTC](https://discuss.elastic.co/t/topic/209851 "2019-12-02T14:41:49Z")
всем привет ! У меня PersonType со следующим маппингом "name" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore\_above" : 2… --- ## [Keeping latest document only](https://discuss.elastic.co/t/keeping-latest-document-only/207721)
**Author:** [@shankaran](https://discuss.elastic.co/u/shankaran)\ **Replies:** 2\ **Last updated:** [December 2, 2019, 2:40pm UTC](https://discuss.elastic.co/t/keeping-latest-document-only/207721 "2019-12-02T14:40:23Z")
in My application Every day 6 times (4hrs per run) index will be updated by latest exchange rates documents. Any one could guide me on best approach how to delete my old documents (having SourceCurrency=USD) from logsta… --- ## [How can i Update-by query and index events to elastic in the same pipeline?](https://discuss.elastic.co/t/how-can-i-update-by-query-and-index-events-to-elastic-in-the-same-pipeline/210200)
**Author:** [@evalufran](https://discuss.elastic.co/u/evalufran)\ **Replies:** 0\ **Last updated:** [December 2, 2019, 2:32pm UTC](https://discuss.elastic.co/t/how-can-i-update-by-query-and-index-events-to-elastic-in-the-same-pipeline/210200 "2019-12-02T14:32:54Z")
Hi! I have an index which represents a transaction of states, so i might have more than one doc with different states and with the same id. I thought that the best way to retrive the last state of an id was to add a new … --- ## [Help with Winlogbeat yaml config](https://discuss.elastic.co/t/help-with-winlogbeat-yaml-config/210041)
**Author:** [@xxstyler20xx](https://discuss.elastic.co/u/xxstyler20xx)\ **Replies:** 6\ **Last updated:** [December 2, 2019, 1:56pm UTC](https://discuss.elastic.co/t/help-with-winlogbeat-yaml-config/210041 "2019-12-02T13:56:56Z")
Hello I'm new to this and I just can't find the rigt answer for my problem.. I'm stuck with my winlogbeat yaml conf. // event\_logs: name: Security event\_id: 4625, 4624 processors: drop\_fields: fields: \["message"\] … --- ## [Nested Data](https://discuss.elastic.co/t/nested-data/210192)
**Author:** [@MSef](https://discuss.elastic.co/u/MSef)\ **Replies:** 0\ **Last updated:** [December 2, 2019, 1:42pm UTC](https://discuss.elastic.co/t/nested-data/210192 "2019-12-02T13:42:53Z")
Hello there, I have a CSV file and I am trying to filter the data using logstash. What i am having trouble with is that I have a column with data inside of it like this: Column name: endPlaces Data inside of column e… --- ## [BulkProcessor retry on connection timeout](https://discuss.elastic.co/t/bulkprocessor-retry-on-connection-timeout/210188)
**Author:** [@Shivesh\_Kumar](https://discuss.elastic.co/u/Shivesh_Kumar)\ **Replies:** 0\ **Last updated:** [December 2, 2019, 1:27pm UTC](https://discuss.elastic.co/t/bulkprocessor-retry-on-connection-timeout/210188 "2019-12-02T13:27:35Z")
Is there any way to retry in case of a socket or connection timeout? --- ## [Logstash 7.2 takes about atleast 5 mins to update ES 7.2](https://discuss.elastic.co/t/logstash-7-2-takes-about-atleast-5-mins-to-update-es-7-2/208812)
**Author:** [@katara](https://discuss.elastic.co/u/katara)\ **Replies:** 9\ **Last updated:** [December 2, 2019, 11:16am UTC](https://discuss.elastic.co/t/logstash-7-2-takes-about-atleast-5-mins-to-update-es-7-2/208812 "2019-12-02T11:16:49Z")
Hi, I have implemented a ELK setup of 7.2 version. Below is my logstash conf input { file { path =\> "/etc/logstash/conf.d/mytest.txt" start\_position =\> "beginning" sincedb\_path =\> "/d… --- ## [ECK and ES on EKS 1.12 installation / setup issue](https://discuss.elastic.co/t/eck-and-es-on-eks-1-12-installation-setup-issue/206401)
**Author:** [@sathia.thayathil](https://discuss.elastic.co/u/sathia.thayathil)\ **Replies:** 1\ **Last updated:** [December 2, 2019, 10:47am UTC](https://discuss.elastic.co/t/eck-and-es-on-eks-1-12-installation-setup-issue/206401 "2019-12-02T10:47:05Z")
{"type": "server", "timestamp": "2019-11-04T12:12:27,916Z", "level": "WARN", "component": "o.e.c.c.ClusterFormationFailureHelper", "cluster.name": "elastic", "node.name": "elastic-es-default-0", "message": "master not di… --- ## [ECK 1.0.0-beta1 doesn't start pod](https://discuss.elastic.co/t/eck-1-0-0-beta1-doesnt-start-pod/209886)
**Author:** [@dg\_hivebrite](https://discuss.elastic.co/u/dg_hivebrite)\ **Replies:** 2\ **Last updated:** [December 2, 2019, 10:37am UTC](https://discuss.elastic.co/t/eck-1-0-0-beta1-doesnt-start-pod/209886 "2019-12-02T10:37:12Z")
Hi, I'm beginning to use ECK, I deploy it on my kubernetes cluster hosted on GKE. The problem is when I'm checking if the elasticsearch cluster is running I can find my stateful sets but without pod. So I check, the c… --- ## [JDBC\_password config for logstash?](https://discuss.elastic.co/t/jdbc-password-config-for-logstash/210153)
**Author:** [@sampath1](https://discuss.elastic.co/u/sampath1)\ **Replies:** 0\ **Last updated:** [December 2, 2019, 10:19am UTC](https://discuss.elastic.co/t/jdbc-password-config-for-logstash/210153 "2019-12-02T10:19:15Z")
Continuing the discussion from Jdbc\_password configuration for logstash: Any update on this? --- ## [Show rollup in canvas](https://discuss.elastic.co/t/show-rollup-in-canvas/210152)
**Author:** [@wifi](https://discuss.elastic.co/u/wifi)\ **Replies:** 0\ **Last updated:** [December 2, 2019, 10:11am UTC](https://discuss.elastic.co/t/show-rollup-in-canvas/210152 "2019-12-02T10:11:56Z")
I have set up a rollup job to summarize data. Now i want to display it in a canvas but it seems like the canvas can't handle rollup data. I try to use my\_date\_field.date\_histogram.timestamp but it won't recognize the ti… --- ## [What is the best approach for streaming large number of docs from ES 7.1v scrolling vs slicing?](https://discuss.elastic.co/t/what-is-the-best-approach-for-streaming-large-number-of-docs-from-es-7-1v-scrolling-vs-slicing/210115)
**Author:** [@yash.tandon](https://discuss.elastic.co/u/yash.tandon)\ **Replies:** 8\ **Last updated:** [December 2, 2019, 9:40am UTC](https://discuss.elastic.co/t/what-is-the-best-approach-for-streaming-large-number-of-docs-from-es-7-1v-scrolling-vs-slicing/210115 "2019-12-02T09:40:24Z")
--- ## [Each time logstash instance dies, the number of data stored in elasticsearch increases](https://discuss.elastic.co/t/each-time-logstash-instance-dies-the-number-of-data-stored-in-elasticsearch-increases/209320)
**Author:** [@securecode99](https://discuss.elastic.co/u/securecode99)\ **Replies:** 2\ **Last updated:** [December 2, 2019, 9:38am UTC](https://discuss.elastic.co/t/each-time-logstash-instance-dies-the-number-of-data-stored-in-elasticsearch-increases/209320 "2019-12-02T09:38:34Z")
I'm using ELK(Elasticsearch, Logstash, Kibana, Beat) with a Kafka in front of Logstash. However, I noticed something unusual during the failover test of Logstash. The test was carried out by suddenly killing the one lo… --- ## [Simple queries takes lots of time and uses 100% cpu](https://discuss.elastic.co/t/simple-queries-takes-lots-of-time-and-uses-100-cpu/206243)
**Author:** [@aimarjg](https://discuss.elastic.co/u/aimarjg)\ **Replies:** 33\ **Last updated:** [December 2, 2019, 9:38am UTC](https://discuss.elastic.co/t/simple-queries-takes-lots-of-time-and-uses-100-cpu/206243 "2019-12-02T09:38:20Z")
Hi! I'm having an issue with filtering data gathered using winlogbeat to ES - whenever I want to filter for single host.name or winlog.computer\_name (kinda the same) only for last 24 hours - it takes more than 60 000ms … --- ## [Performance difference in 'must' and 'must\_not'](https://discuss.elastic.co/t/performance-difference-in-must-and-must-not/210147)
**Author:** [@Prasiddha](https://discuss.elastic.co/u/Prasiddha)\ **Replies:** 0\ **Last updated:** [December 2, 2019, 9:33am UTC](https://discuss.elastic.co/t/performance-difference-in-must-and-must-not/210147 "2019-12-02T09:33:57Z")
I wanted to know the performance difference between using 'must' clause and 'must\_not'. I am getting different timings trying from both of them. Suppose I have 10 groups, and I want to make 5 groups accessible to a use… --- ## [Search multiple words within the same paragraph in the target document?](https://discuss.elastic.co/t/search-multiple-words-within-the-same-paragraph-in-the-target-document/210093)
**Author:** [@ddream777](https://discuss.elastic.co/u/ddream777)\ **Replies:** 1\ **Last updated:** [December 2, 2019, 9:32am UTC](https://discuss.elastic.co/t/search-multiple-words-within-the-same-paragraph-in-the-target-document/210093 "2019-12-02T09:32:28Z")
I was wondering whether it's possible to set a condition so as to limit the range of the search to within a paragraph, the query being a multiple-word one. --- ## [Count in other index based on Current Index field](https://discuss.elastic.co/t/count-in-other-index-based-on-current-index-field/209971)
**Author:** [@Vinothkumar\_Ganeshan](https://discuss.elastic.co/u/Vinothkumar_Ganeshan)\ **Replies:** 5\ **Last updated:** [December 2, 2019, 9:31am UTC](https://discuss.elastic.co/t/count-in-other-index-based-on-current-index-field/209971 "2019-12-02T09:31:00Z")
Scenario: Index - 2019-05\*, 2019-06\*, 2019-07\*, 2019-08\*, 2019-09\* I have ID field in all the index which Contains Millions of documents. I want to analyse, how many id appeared in 2019-05\* is repeated in other … --- ## [Logstash - Elastic Search Input plugin](https://discuss.elastic.co/t/logstash-elastic-search-input-plugin/210145)
**Author:** [@rsumit](https://discuss.elastic.co/u/rsumit)\ **Replies:** 0\ **Last updated:** [December 2, 2019, 9:30am UTC](https://discuss.elastic.co/t/logstash-elastic-search-input-plugin/210145 "2019-12-02T09:30:55Z")
Hi Team I am creating a query using elastic search input plugin. when I ran it on developer tool on kibana before running on LS I am getting the following error: POST /sbl\_nmon2019.12.02/\_search?size=0 {"query": {"… --- ## [Dashboardの表示の時にエラーになる。](https://discuss.elastic.co/t/dashboard/210143)
**Author:** [@mono113](https://discuss.elastic.co/u/mono113)\ **Replies:** 0\ **Last updated:** [December 2, 2019, 9:15am UTC](https://discuss.elastic.co/t/dashboard/210143 "2019-12-02T09:15:13Z")
visualizeで作成したグラフをDashboardで表示しようとした際に、以下のようなエラーが画面右側に出てしまいます。 Error in visualization unknown error visualizeではbucketsのFiltersを利用して、以下のような指定方法でabcを含むパス毎のアクセス数をカウントしています。 {"wildcard":{"cs\_uri\_query.keyword":"abc"}} 新… --- ## [Error when trying to use snmp trap with Logstash](https://discuss.elastic.co/t/error-when-trying-to-use-snmp-trap-with-logstash/210141)
**Author:** [@peterthief](https://discuss.elastic.co/u/peterthief)\ **Replies:** 0\ **Last updated:** [December 2, 2019, 9:08am UTC](https://discuss.elastic.co/t/error-when-trying-to-use-snmp-trap-with-logstash/210141 "2019-12-02T09:08:55Z")
Hi all, I try to use this config below to start logstash: input { snmp { hosts =\> \[{host =\> "udp:192.27.18.351/5000" version =\> "3"}\] security\_name =\> "admin" auth\_protocol =\> "sha2" auth\_pass =\> "Loc… --- ## [Show latest value](https://discuss.elastic.co/t/show-latest-value/210064)
**Author:** [@Shahar](https://discuss.elastic.co/u/Shahar)\ **Replies:** 1\ **Last updated:** [December 2, 2019, 8:37am UTC](https://discuss.elastic.co/t/show-latest-value/210064 "2019-12-02T08:37:42Z")
Hi, I searched the forum and saw a few options but none solved my problem. (ex example link ) Anyway. Im facing a problem which I have 3 relevant fields: organization, userName and vmCount I want to show for each org… --- ## [Grok vs real life - kibana](https://discuss.elastic.co/t/grok-vs-real-life-kibana/210136)
**Author:** [@Marta\_Zagrajek](https://discuss.elastic.co/u/Marta_Zagrajek)\ **Replies:** 0\ **Last updated:** [December 2, 2019, 8:26am UTC](https://discuss.elastic.co/t/grok-vs-real-life-kibana/210136 "2019-12-02T08:26:39Z")
I finally made good grok pattern with my log and in grok debugger all was fine. When I implemented it in my stack, I do not have proper fields, my "exception" field is empty or one char. Log sample: 21:35:13.242 p… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1747) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1749)