# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1754 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1755 --- ## [Multiple filebeat servers to configure single logstash](https://discuss.elastic.co/t/multiple-filebeat-servers-to-configure-single-logstash/209740)
**Author:** [@Raavi\_Arun](https://discuss.elastic.co/u/Raavi_Arun)\ **Replies:** 5\ **Last updated:** [November 28, 2019, 4:43am UTC](https://discuss.elastic.co/t/multiple-filebeat-servers-to-configure-single-logstash/209740 "2019-11-28T04:43:19Z")
Hi, I am new to ELK. I am configured single web servers to single logstash in production. Now i am add filebeat in different web servers but i don't know how to configure all web server access log into single logstash. … --- ## [Not able to get data after creating new index pattern](https://discuss.elastic.co/t/not-able-to-get-data-after-creating-new-index-pattern/209786)
**Author:** [@SheetalRIL](https://discuss.elastic.co/u/SheetalRIL)\ **Replies:** 0\ **Last updated:** [November 28, 2019, 4:10am UTC](https://discuss.elastic.co/t/not-able-to-get-data-after-creating-new-index-pattern/209786 "2019-11-28T04:10:43Z")
Hi Team, I have created Visualization using logs coming via APM. The index pattern used for visualization is 'apm-' and all worked fine. Now, we have data coming in with index named as 'apm-dt:span-2019-11-27' but the … --- ## [Geo\_point issue, need help in identifying the issue](https://discuss.elastic.co/t/geo-point-issue-need-help-in-identifying-the-issue/207801)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 4\ **Last updated:** [November 28, 2019, 3:29am UTC](https://discuss.elastic.co/t/geo-point-issue-need-help-in-identifying-the-issue/207801 "2019-11-28T03:29:09Z")
Hey Folks, Can someone please help me on geo\_point? I am using OSS version 7.2.1 and my data is properly being parsed and can see geo information however when I am plotting the geo map on Kibana this is giving me an err… --- ## [Can't running mutiple JDBC](https://discuss.elastic.co/t/cant-running-mutiple-jdbc/209778)
**Author:** [@sist](https://discuss.elastic.co/u/sist)\ **Replies:** 0\ **Last updated:** [November 28, 2019, 2:13am UTC](https://discuss.elastic.co/t/cant-running-mutiple-jdbc/209778 "2019-11-28T02:13:12Z")
I'm trying to import data from multiple database including mysql and sqlserver to es. With single JDBC it works just fine, but with multiple JDBC it doesn't work and gives no error message. Is this caused by using differ… --- ## [Filter winlog.event\_id in wineventlog](https://discuss.elastic.co/t/filter-winlog-event-id-in-wineventlog/206507)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 3\ **Last updated:** [November 28, 2019, 2:01am UTC](https://discuss.elastic.co/t/filter-winlog-event-id-in-wineventlog/206507 "2019-11-28T02:01:52Z")
Dear all I am trying to filter the window event\_id i want to remove the message field and add my own field But i have try 3 method i can think of like this \[winlog\]\[event\_id\] == 4624 winlog.event\_id == 4624 \[event\_i… --- ## [Replace legend values in Kibana visualizations using Elasticsearch](https://discuss.elastic.co/t/replace-legend-values-in-kibana-visualizations-using-elasticsearch/206862)
**Author:** [@EZprogramming](https://discuss.elastic.co/u/EZprogramming)\ **Replies:** 10\ **Last updated:** [November 24, 2019, 9:23am UTC](https://discuss.elastic.co/t/replace-legend-values-in-kibana-visualizations-using-elasticsearch/206862 "2019-11-24T09:23:28Z")
How can I replace the ID values at the bottom of this graph with something like A, B, C using Elasticsearch or Kibana UI tool? --- ## [Kibana 7.4.2 upgrade is not starting](https://discuss.elastic.co/t/kibana-7-4-2-upgrade-is-not-starting/209767)
**Author:** [@Cdnvballer](https://discuss.elastic.co/u/Cdnvballer)\ **Replies:** 2\ **Last updated:** [November 27, 2019, 10:46pm UTC](https://discuss.elastic.co/t/kibana-7-4-2-upgrade-is-not-starting/209767 "2019-11-27T22:46:28Z")
Just tried to upgrade elasticsearch and kibana from 6.8.5 to 7.4.2. elasticsearch seems to be running (based on output from curl) curl -X GET "localhost:9200" { "name" : "sjc1upp-logc01", "cluster\_name" : "elasticse… --- ## [CSV parsing meaning get rid of logstash csv plugin?](https://discuss.elastic.co/t/csv-parsing-meaning-get-rid-of-logstash-csv-plugin/209770)
**Author:** [@arnaudlemaignen](https://discuss.elastic.co/u/arnaudlemaignen)\ **Replies:** 0\ **Last updated:** [November 27, 2019, 10:39pm UTC](https://discuss.elastic.co/t/csv-parsing-meaning-get-rid-of-logstash-csv-plugin/209770 "2019-11-27T22:39:14Z")
Well I have an issue which is coming with a solution :slight\_smile: but I would like to know if someone has a better idea I am runnging logstash csv plugin 3.0.8 I had to treat unlimited different kind of CSV with diff… --- ## [Table Visualisation Failure After Adding a Property](https://discuss.elastic.co/t/table-visualisation-failure-after-adding-a-property/209219)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 4\ **Last updated:** [November 27, 2019, 9:56pm UTC](https://discuss.elastic.co/t/table-visualisation-failure-after-adding-a-property/209219 "2019-11-27T21:56:12Z")
Hey All, I have created a table visualisation. Metric is - Max (Timestamp) Then I split rows according to properties available in the doc. All works fine until I change the filter to show time that is more than the l… --- ## [(ES 6.5.4) filtering by nested date field](https://discuss.elastic.co/t/es-6-5-4-filtering-by-nested-date-field/209747)
**Author:** [@kev12123](https://discuss.elastic.co/u/kev12123)\ **Replies:** 1\ **Last updated:** [November 27, 2019, 9:03pm UTC](https://discuss.elastic.co/t/es-6-5-4-filtering-by-nested-date-field/209747 "2019-11-27T21:03:50Z")
Hi I'm relatively new ES and I've created an index with the following mapping: { "\_doc": { "date\_detection": "false", "properties": { "@fields": { "properties": { "client": { … --- ## [Elasticsearch constantly allocating shards after high disk usage](https://discuss.elastic.co/t/elasticsearch-constantly-allocating-shards-after-high-disk-usage/209758)
**Author:** [@Jesbourne](https://discuss.elastic.co/u/Jesbourne)\ **Replies:** 0\ **Last updated:** [November 27, 2019, 8:54pm UTC](https://discuss.elastic.co/t/elasticsearch-constantly-allocating-shards-after-high-disk-usage/209758 "2019-11-27T20:54:05Z")
We have a hot/warm data cluster setup where data transfers from our hot nodes to our warm nodes after a set number of days. The disks on the warm nodes got too full and a few reached the low watermark which caused alloca… --- ## [Add a field, when indexing, with string representation of another integer field](https://discuss.elastic.co/t/add-a-field-when-indexing-with-string-representation-of-another-integer-field/205957)
**Author:** [@NiclasK](https://discuss.elastic.co/u/NiclasK)\ **Replies:** 5\ **Last updated:** [November 27, 2019, 8:33pm UTC](https://discuss.elastic.co/t/add-a-field-when-indexing-with-string-representation-of-another-integer-field/205957 "2019-11-27T20:33:44Z")
Hi, I index data that contain a state which is represented as an integer. I would like to translate this number into a string which is easier to remember and search for. What is the recommended way to do this? Example: … --- ## [Line Chart with Y axis lines of field values](https://discuss.elastic.co/t/line-chart-with-y-axis-lines-of-field-values/209683)
**Author:** [@Dennis\_Anagno](https://discuss.elastic.co/u/Dennis_Anagno)\ **Replies:** 1\ **Last updated:** [November 27, 2019, 8:21pm UTC](https://discuss.elastic.co/t/line-chart-with-y-axis-lines-of-field-values/209683 "2019-11-27T20:21:11Z")
Hi, We have the following field data in our document : "\_source": { "counter\_name": "Counter\_A1", "counter\_value": 11, "group\_name": "group1", … --- ## [Limit results by field + aggregations over results](https://discuss.elastic.co/t/limit-results-by-field-aggregations-over-results/209754)
**Author:** [@neesha](https://discuss.elastic.co/u/neesha)\ **Replies:** 0\ **Last updated:** [November 27, 2019, 8:01pm UTC](https://discuss.elastic.co/t/limit-results-by-field-aggregations-over-results/209754 "2019-11-27T20:01:53Z")
In our index, documents may exist multiple times for the same id as we track each version. For our search, we only want to return one result for this field. And I know we can use aggregations to do a search that finds th… --- ## [Percolator node using too much CPU](https://discuss.elastic.co/t/percolator-node-using-too-much-cpu/206676)
**Author:** [@dwilches](https://discuss.elastic.co/u/dwilches)\ **Replies:** 2\ **Last updated:** [November 27, 2019, 7:58pm UTC](https://discuss.elastic.co/t/percolator-node-using-too-much-cpu/206676 "2019-11-27T19:58:22Z")
We have an ES cluster with 12 percolator nodes. Today, ingestion of data got slow and we noticed 2 of the percolator nodes were using more CPU than the other 10. In this image, user CPU usage of problematic percolators i… --- ## [ECK 1.0 with on premise K8s](https://discuss.elastic.co/t/eck-1-0-with-on-premise-k8s/209745)
**Author:** [@ikaposi](https://discuss.elastic.co/u/ikaposi)\ **Replies:** 1\ **Last updated:** [November 27, 2019, 7:51pm UTC](https://discuss.elastic.co/t/eck-1-0-with-on-premise-k8s/209745 "2019-11-27T19:51:33Z")
Hi, I have installed a basic k8s cluster with kubeadm; cluster node state is ready and I can deploy an nginx image.. so far so good. Next I installed the elastic operator (1.0.0-beta1) using the steps described on: htt… --- ## ["\_dateparsefailure" due to Timestamp Cisco IOS](https://discuss.elastic.co/t/dateparsefailure-due-to-timestamp-cisco-ios/208989)
**Author:** [@mfisher](https://discuss.elastic.co/u/mfisher)\ **Replies:** 6\ **Last updated:** [November 27, 2019, 7:41pm UTC](https://discuss.elastic.co/t/dateparsefailure-due-to-timestamp-cisco-ios/208989 "2019-11-27T19:41:33Z")
I used the conf file from here and the pattern below in a pattern file referenced by the conf file. .conf grok section grok { # There are a couple of custom patterns associated with this filter. patterns\_dir =\> \[ "… --- ## [NOt able to discover logtash in kibana](https://discuss.elastic.co/t/not-able-to-discover-logtash-in-kibana/209597)
**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\ **Replies:** 2\ **Last updated:** [November 27, 2019, 7:14pm UTC](https://discuss.elastic.co/t/not-able-to-discover-logtash-in-kibana/209597 "2019-11-27T19:14:26Z")
I am using version 7.3 for all elastic search, kibana, logstash and I have an APM agent installed on my application. I am trying to create a file beat and send the input using logstash to elastic search. below is the l… --- ## [Elasticsearch org.elasticsearch.index.engine.EngineException"failed to recover translog"](https://discuss.elastic.co/t/elasticsearch-org-elasticsearch-index-engine-engineexception-failed-to-recover-translog/209714)
**Author:** [@apizano](https://discuss.elastic.co/u/apizano)\ **Replies:** 4\ **Last updated:** [November 27, 2019, 5:58pm UTC](https://discuss.elastic.co/t/elasticsearch-org-elasticsearch-index-engine-engineexception-failed-to-recover-translog/209714 "2019-11-27T17:58:12Z")
Hi guys, I'm an intern at my software engineering company adding a health endpoint (using Spring Actuator) to our API for our Elasticsearch service. I am using POSTMAN to view the JSON response and it's sending it corre… --- ## [Accident deletion of kibana index but visualization is still intact](https://discuss.elastic.co/t/accident-deletion-of-kibana-index-but-visualization-is-still-intact/205766)
**Author:** [@ark516](https://discuss.elastic.co/u/ark516)\ **Replies:** 12\ **Last updated:** [November 27, 2019, 6:54pm UTC](https://discuss.elastic.co/t/accident-deletion-of-kibana-index-but-visualization-is-still-intact/205766 "2019-11-27T18:54:17Z")
Hello We accidently applied ILM policy to system indexes and it deleted (?) kibana index we are still able to see saved spaces in visualization but can not create new index pattern and can not make any new changes to … --- ## [Issue with date format](https://discuss.elastic.co/t/issue-with-date-format/209598)
**Author:** [@ShaneLillie\_RAD](https://discuss.elastic.co/u/ShaneLillie_RAD)\ **Replies:** 7\ **Last updated:** [November 27, 2019, 6:46pm UTC](https://discuss.elastic.co/t/issue-with-date-format/209598 "2019-11-27T18:46:12Z")
We're using this date filter: filter { date { … --- ## [Filebeat to match IIS logs timestamp](https://discuss.elastic.co/t/filebeat-to-match-iis-logs-timestamp/209565)
**Author:** [@alexserd](https://discuss.elastic.co/u/alexserd)\ **Replies:** 2\ **Last updated:** [November 27, 2019, 6:27pm UTC](https://discuss.elastic.co/t/filebeat-to-match-iis-logs-timestamp/209565 "2019-11-27T18:27:21Z")
Currently @timestamp is showing as a time when logs get ingested. We need to match it with timestamp from IIS logs. Here is our ingest default.json from filebeat { "description": "Pipeline for parsing IIS access logs. … --- ## [When or how often does setup need to be done?](https://discuss.elastic.co/t/when-or-how-often-does-setup-need-to-be-done/209743)
**Author:** [@joberly](https://discuss.elastic.co/u/joberly)\ **Replies:** 0\ **Last updated:** [November 27, 2019, 6:10pm UTC](https://discuss.elastic.co/t/when-or-how-often-does-setup-need-to-be-done/209743 "2019-11-27T18:10:23Z")
In reference to setup of any of the Beats, but specifically Filebeat (e.g. filebeat setup -e, see https://www.elastic.co/guide/en/beats/filebeat/7.4/load-kibana-dashboards.html), how often should setup be run? Is this on… --- ## [Disk space and read\_only\_allow\_delete](https://discuss.elastic.co/t/disk-space-and-read-only-allow-delete/209739)
**Author:** [@dale.busse](https://discuss.elastic.co/u/dale.busse)\ **Replies:** 0\ **Last updated:** [November 27, 2019, 5:42pm UTC](https://discuss.elastic.co/t/disk-space-and-read-only-allow-delete/209739 "2019-11-27T17:42:00Z")
Question about the setting read\_only\_allow\_delete. We ran out of disk space, created more space and set that setting to false so indexes could be written to again and all is working fine. So now that we are operational… --- ## [Where is \_dateparsefailure?](https://discuss.elastic.co/t/where-is-dateparsefailure/209355)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 6\ **Last updated:** [November 27, 2019, 5:25pm UTC](https://discuss.elastic.co/t/where-is-dateparsefailure/209355 "2019-11-27T17:25:58Z")
I have many column csv files with few thousands lines getting \_dateparsefailure how do I find out which field is throwing this error? I understand that it is one of the date field is doing this. but which one? I have… --- ## [Unavailable\_shards\_exception, reason=index\_xyz 0 primary shard is not active Timeout: 1m](https://discuss.elastic.co/t/unavailable-shards-exception-reason-index-xyz-0-primary-shard-is-not-active-timeout-1m/209730)
**Author:** [@Shivesh\_Kumar](https://discuss.elastic.co/u/Shivesh_Kumar)\ **Replies:** 0\ **Last updated:** [November 27, 2019, 4:36pm UTC](https://discuss.elastic.co/t/unavailable-shards-exception-reason-index-xyz-0-primary-shard-is-not-active-timeout-1m/209730 "2019-11-27T16:36:54Z")
I am using Elasticsearch 7 and it keeps throwing the below Error. My application is just trying to push a document with index document\_published\_data. For the same, I have created the BulkProcessor and using the bulk A… --- ## [Add json indies another json when uploading data to ES](https://discuss.elastic.co/t/add-json-indies-another-json-when-uploading-data-to-es/209734)
**Author:** [@Anuwa\_A](https://discuss.elastic.co/u/Anuwa_A)\ **Replies:** 0\ **Last updated:** [November 27, 2019, 5:15pm UTC](https://discuss.elastic.co/t/add-json-indies-another-json-when-uploading-data-to-es/209734 "2019-11-27T17:15:06Z")
When uploading data to ES i need to have a json structure like "Countries" : { "Asia" : { "name" : "Srilanka" }, "Africa" : { "name" : "Kenya" } } Aggregate inside Aggregate. is it possible to do this … --- ## [Rebooted vm that hosted elasticsearch and not nothing is working](https://discuss.elastic.co/t/rebooted-vm-that-hosted-elasticsearch-and-not-nothing-is-working/209729)
**Author:** [@happycampo](https://discuss.elastic.co/u/happycampo)\ **Replies:** 1\ **Last updated:** [November 27, 2019, 5:00pm UTC](https://discuss.elastic.co/t/rebooted-vm-that-hosted-elasticsearch-and-not-nothing-is-working/209729 "2019-11-27T17:00:25Z")
So I rebooted my elasticsearch vm and now I can't seem to get anything working again. I REALLY need to restore this. Anyone able to help me work through this? \> \[root@elasticsearch etc\]# curl -k -u elastic -XGET 'ht… --- ## [Resolution problems with kibana monitoring](https://discuss.elastic.co/t/resolution-problems-with-kibana-monitoring/209592)
**Author:** [@jmartori](https://discuss.elastic.co/u/jmartori)\ **Replies:** 4\ **Last updated:** [November 27, 2019, 4:47pm UTC](https://discuss.elastic.co/t/resolution-problems-with-kibana-monitoring/209592 "2019-11-27T16:47:14Z")
Hi there, we have noticed that unless we use the "Last 4 hours" resolution while using kibana's monitoring dashboards, we obtain some saw-like pattern. At the same time some other plots will just show 0's when the time… --- ## [Unable to convert string to integer in log stash in XML](https://discuss.elastic.co/t/unable-to-convert-string-to-integer-in-log-stash-in-xml/209622)
**Author:** [@gangireddy\_l](https://discuss.elastic.co/u/gangireddy_l)\ **Replies:** 1\ **Last updated:** [November 27, 2019, 4:46pm UTC](https://discuss.elastic.co/t/unable-to-convert-string-to-integer-in-log-stash-in-xml/209622 "2019-11-27T16:46:39Z")
Hi Team, I am unable to convert data type in logstash, my configurations are shown below. Logstash filter{ if ("ccn" in \[tags\]) { xml { store\_xml =\> false source =\> "message" xpath =\> \[ "/mv/moid/text()", "ccnc… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1753) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1755)