# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1762 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1763 --- ## [How to aggregate by value and get latest results](https://discuss.elastic.co/t/how-to-aggregate-by-value-and-get-latest-results/206514)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 2\ **Last updated:** [November 24, 2019, 9:58pm UTC](https://discuss.elastic.co/t/how-to-aggregate-by-value-and-get-latest-results/206514 "2019-11-24T21:58:17Z")
Hi, I am trying to build a table visualisation to show all clusters in storage. In my specific example, I am expecting to have only 2 clusters, as there are only 2 unique cluster IDs. I am not able to aggregate and ge… --- ## [Logstash-oss:7.4.0 geoip reports wrong lat/lon](https://discuss.elastic.co/t/logstash-oss-7-4-0-geoip-reports-wrong-lat-lon/209161)
**Author:** [@Long\_Thai](https://discuss.elastic.co/u/Long_Thai)\ **Replies:** 4\ **Last updated:** [November 24, 2019, 9:48pm UTC](https://discuss.elastic.co/t/logstash-oss-7-4-0-geoip-reports-wrong-lat-lon/209161 "2019-11-24T21:48:09Z")
I found some incorrect results when performing geoip of IP addresses through the geoip filter in Logsstash-oss:7.4.0. Two IP address in question are: 171.246.59.245 123.30.237.63 From logstash both IPs have the sam… --- ## [Problem with Logstash posing to ElasticSearch](https://discuss.elastic.co/t/problem-with-logstash-posing-to-elasticsearch/209201)
**Author:** [@JennS](https://discuss.elastic.co/u/JennS)\ **Replies:** 0\ **Last updated:** [November 24, 2019, 8:04pm UTC](https://discuss.elastic.co/t/problem-with-logstash-posing-to-elasticsearch/209201 "2019-11-24T20:04:32Z")
{ "template": "snmplogger-\*", "settings": { "index": { "refresh\_interval": "10s", "number\_of\_replicas": 1, "number\_of\_shards": 6 } }, "mappings" : { "default" : { "\_source" : { "enabled" : false } }, "doc" :… --- ## [Must\_Not aggregation double counting items](https://discuss.elastic.co/t/must-not-aggregation-double-counting-items/209198)
**Author:** [@ad\_rip](https://discuss.elastic.co/u/ad_rip)\ **Replies:** 0\ **Last updated:** [November 24, 2019, 7:41pm UTC](https://discuss.elastic.co/t/must-not-aggregation-double-counting-items/209198 "2019-11-24T19:41:45Z")
I'm hoping this is the right place to ask this. I've been trying to use a must\_not filter to get a count of all the items that don't contain a contain a specific field, but unfortunately the count is much higher than t… --- ## [Error while running logstash file](https://discuss.elastic.co/t/error-while-running-logstash-file/209191)
**Author:** [@sandy1](https://discuss.elastic.co/u/sandy1)\ **Replies:** 1\ **Last updated:** [November 24, 2019, 6:18pm UTC](https://discuss.elastic.co/t/error-while-running-logstash-file/209191 "2019-11-24T18:18:17Z")
D:\\logstash-7.4.2\\bin\>logstash -f sample.conf Thread.exclusive is deprecated, use Thread::Mutex Sending Logstash logs to D:/logstash-7.4.2/logs which is now configured via log4j2.properties \[2019-11-24T22:49:41,889\]\[W… --- ## [Kibana Map doesn't visualize any data](https://discuss.elastic.co/t/kibana-map-doesnt-visualize-any-data/209150)
**Author:** [@ElasticMaa](https://discuss.elastic.co/u/ElasticMaa)\ **Replies:** 6\ **Last updated:** [November 24, 2019, 3:33pm UTC](https://discuss.elastic.co/t/kibana-map-doesnt-visualize-any-data/209150 "2019-11-24T15:33:02Z")
Hi to all, I'm finding an issue with Kibana v. 7.4.2 cloud version. This is the mapping of my address field location (using php): .... 'location' =\> \[ 'type' =\> 'geo\_point' \], .... I checked that the mapping has … --- ## [Grok parse failure en CVS filter?](https://discuss.elastic.co/t/grok-parse-failure-en-cvs-filter/209181)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 1\ **Last updated:** [November 24, 2019, 2:59pm UTC](https://discuss.elastic.co/t/grok-parse-failure-en-cvs-filter/209181 "2019-11-24T14:59:38Z")
Is there something like grok parse failure in the CVS filter?, if it exist I want to include it in a conditional to output the failures to a file. --- ## [Painless regex](https://discuss.elastic.co/t/painless-regex/209089)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 2\ **Last updated:** [November 23, 2019, 9:57pm UTC](https://discuss.elastic.co/t/painless-regex/209089 "2019-11-23T21:57:10Z")
Hi, Im trying to extract the "ABCD\_123.123.123.123" part from an adress, can you help me figure it out? ABCD\_123.123.123.123\_DD\_FS This is what I have tried, but it trows me an error at the beggining of the regex def … --- ## [Conditional statement with String](https://discuss.elastic.co/t/conditional-statement-with-string/209179)
**Author:** [@gyana\_nayak](https://discuss.elastic.co/u/gyana_nayak)\ **Replies:** 0\ **Last updated:** [November 24, 2019, 1:24pm UTC](https://discuss.elastic.co/t/conditional-statement-with-string/209179 "2019-11-24T13:24:55Z")
I have below sample log lines in same file 2019-11-23T14:38:43.495 backendorg \[http-nio-8080-exec-45\] INFO http-nio-8080-exec-45 SessionController http://localhost:8080/ABC/session/login abc.nayak@zinier.com backendorg… --- ## [Histogram in reverse nested](https://discuss.elastic.co/t/histogram-in-reverse-nested/209048)
**Author:** [@Yamuna\_Mallikarjun](https://discuss.elastic.co/u/Yamuna_Mallikarjun)\ **Replies:** 1\ **Last updated:** [November 24, 2019, 12:25pm UTC](https://discuss.elastic.co/t/histogram-in-reverse-nested/209048 "2019-11-24T12:25:18Z")
Data format: Basically i want to do the aggregation with histogram for 4 minutes. The pattern was: 1st min send 2 requests from each port 2nd min send 3 requests from each port 3rd min send 4 requests from each por… --- ## [Upgrading from 5.6.8 to 6.8](https://discuss.elastic.co/t/upgrading-from-5-6-8-to-6-8/209177)
**Author:** [@Callonski](https://discuss.elastic.co/u/Callonski)\ **Replies:** 0\ **Last updated:** [November 24, 2019, 12:14pm UTC](https://discuss.elastic.co/t/upgrading-from-5-6-8-to-6-8/209177 "2019-11-24T12:14:07Z")
Hi, I'm having some trouble upgrading elasticsearch. Following : https://www.elastic.co/guide/en/elasticsearch/reference/6.8/rolling-upgrades.html And: https://www.elastic.co/guide/en/elasticsearch/reference/6.8/deb.ht… --- ## [Apm agent cannot connect to remote apm server](https://discuss.elastic.co/t/apm-agent-cannot-connect-to-remote-apm-server/209117)
**Author:** [@he11oworld](https://discuss.elastic.co/u/he11oworld)\ **Replies:** 1\ **Last updated:** [November 24, 2019, 7:49am UTC](https://discuss.elastic.co/t/apm-agent-cannot-connect-to-remote-apm-server/209117 "2019-11-24T07:49:21Z")
Kibana version: 7.4.0 Elasticsearch version: 7.4.0 APM Server version: 7.4.0 APM Agent language and version: Java, 1.11.0 Is there anything special in your setup? For example, are you using the Logstash or Kafka … --- ## [Tags /classification for elaticsearch BLOG](https://discuss.elastic.co/t/tags-classification-for-elaticsearch-blog/209168)
**Author:** [@Joseph\_John](https://discuss.elastic.co/u/Joseph_John)\ **Replies:** 1\ **Last updated:** [November 24, 2019, 3:09am UTC](https://discuss.elastic.co/t/tags-classification-for-elaticsearch-blog/209168 "2019-11-24T03:09:29Z")
HI All, Good morning Like to give this feedback. There are good resource for reference at Elastic Stack "https://www.elastic.co/blog/" Good for novice as well as experienced people. It would be great if they blog… --- ## [More like this query](https://discuss.elastic.co/t/more-like-this-query/208553)
**Author:** [@Giannis](https://discuss.elastic.co/u/Giannis)\ **Replies:** 2\ **Last updated:** [November 23, 2019, 9:55pm UTC](https://discuss.elastic.co/t/more-like-this-query/208553 "2019-11-23T21:55:51Z")
GET articles/\_search { "query": { "more\_like\_this" : { "fields" : \["title"\], "like" : " Creating the model Apache", "min\_term\_freq" : 1, "max\_query\_terms" : 12 } } } In articles it exists the exact title " Cre… --- ## [Search query does'nt find the token](https://discuss.elastic.co/t/search-query-doesnt-find-the-token/208543)
**Author:** [@Giannis](https://discuss.elastic.co/u/Giannis)\ **Replies:** 4\ **Last updated:** [November 23, 2019, 9:54pm UTC](https://discuss.elastic.co/t/search-query-doesnt-find-the-token/208543 "2019-11-23T21:54:03Z")
I have the sentence "Is with any job to take courses" in title field. If i query with token "cours" doesnt match anything. I must query with token "courses" and then is ok! I use the english analyser https://www.elastic.… --- ## [Logstash OSS license features and X-PACK](https://discuss.elastic.co/t/logstash-oss-license-features-and-x-pack/209124)
**Author:** [@Sunil\_Chadha](https://discuss.elastic.co/u/Sunil_Chadha)\ **Replies:** 3\ **Last updated:** [November 23, 2019, 8:04pm UTC](https://discuss.elastic.co/t/logstash-oss-license-features-and-x-pack/209124 "2019-11-23T20:04:23Z")
Hi, I am using Logstash OSS, and I want to be sure that I dont use x-pack features without Elastic license. I want to know Can i use TLS between Filebeat - Logstash, with Logstash/Filebeat OSS Apache 2.0. Or I need … --- ## [Logstash-filter-jdbc\_streaming -- parameter issue calling stored procedure (MSSQL)](https://discuss.elastic.co/t/logstash-filter-jdbc-streaming-parameter-issue-calling-stored-procedure-mssql/209085)
**Author:** [@Chris\_Lyons](https://discuss.elastic.co/u/Chris_Lyons)\ **Replies:** 1\ **Last updated:** [November 23, 2019, 6:41pm UTC](https://discuss.elastic.co/t/logstash-filter-jdbc-streaming-parameter-issue-calling-stored-procedure-mssql/209085 "2019-11-23T18:41:11Z")
Logstash Version: 6.4 hosted on Oracle Linux Server release 6.8 Database: MSSQL 2017 Running into an issue with the way logstash-filter-jdbc\_streaming adds parameters to statements. I am leveraging a stored procedu… --- ## [Why does some fields names in Elasticsearch's API output have \`\_\` in them](https://discuss.elastic.co/t/why-does-some-fields-names-in-elasticsearchs-api-output-have-in-them/209157)
**Author:** [@viveksinghggits](https://discuss.elastic.co/u/viveksinghggits)\ **Replies:** 0\ **Last updated:** [November 23, 2019, 4:44pm UTC](https://discuss.elastic.co/t/why-does-some-fields-names-in-elasticsearchs-api-output-have-in-them/209157 "2019-11-23T16:44:02Z")
If we take a look into the output of some of the APIs especially of search and run below command for a particular index let's say twitter curl \:9200/twitter/\_search/pretty below is response that we get { "t… --- ## [Managing traffic with multiple Nics](https://discuss.elastic.co/t/managing-traffic-with-multiple-nics/209153)
**Author:** [@120GBSSD](https://discuss.elastic.co/u/120GBSSD)\ **Replies:** 0\ **Last updated:** [November 23, 2019, 3:16pm UTC](https://discuss.elastic.co/t/managing-traffic-with-multiple-nics/209153 "2019-11-23T15:16:08Z")
Hi, I'm in an environment where all nodes run multiple NIC's, If users access the servers on NIC 1, I would like to make all elasticsearch and \*beats traffic run across NIC 2 is it possible to configure this as i haven… --- ## [COUNT(DISTINCT field\_name) is returning null](https://discuss.elastic.co/t/count-distinct-field-name-is-returning-null/209148)
**Author:** [@Eswari\_Kallakuri](https://discuss.elastic.co/u/Eswari_Kallakuri)\ **Replies:** 0\ **Last updated:** [November 23, 2019, 10:08am UTC](https://discuss.elastic.co/t/count-distinct-field-name-is-returning-null/209148 "2019-11-23T10:08:27Z")
In ElasticSearch 7.4.2 version, COUNT(DISTINCT field\_name) is returning null instead of 0. Canvas is showing below error In ElasticSearch 7.3 version, COUNT(DISTINCT field\_name) is returning 0 --- ## [Extract only one line of message in logstash](https://discuss.elastic.co/t/extract-only-one-line-of-message-in-logstash/209146)
**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Replies:** 0\ **Last updated:** [November 23, 2019, 8:25am UTC](https://discuss.elastic.co/t/extract-only-one-line-of-message-in-logstash/209146 "2019-11-23T08:25:38Z")
Hello, I have a message that is in the format 2019-10-22 22:59:56 HOSTNAME \[Error\] Connection id ""ABCDEF"", Request id ""123ABCD"": An unhandled exception was thrown by the application. System.NullReferenceException:… --- ## [Bar Dashboard Filter Error](https://discuss.elastic.co/t/bar-dashboard-filter-error/209114)
**Author:** [@eogredici](https://discuss.elastic.co/u/eogredici)\ **Replies:** 2\ **Last updated:** [November 23, 2019, 7:13am UTC](https://discuss.elastic.co/t/bar-dashboard-filter-error/209114 "2019-11-23T07:13:55Z")
Hi, I created a new bar dashboard. My dashboard have filter and two split features. I click second split series anyone, but i can't see all filters to on screen pop-up filters. Why can't i see? i added screenshot. i … --- ## [Submit the Query with Role defined using Document Level Security](https://discuss.elastic.co/t/submit-the-query-with-role-defined-using-document-level-security/209128)
**Author:** [@shri\_palchuri](https://discuss.elastic.co/u/shri_palchuri)\ **Replies:** 1\ **Last updated:** [November 23, 2019, 6:40am UTC](https://discuss.elastic.co/t/submit-the-query-with-role-defined-using-document-level-security/209128 "2019-11-23T06:40:58Z")
Our system has around 100,000 users and each user has different permission on the data. I am planning to use elastic search roles concept to support permission/authorization. I will be defining one role on elasticsea… --- ## [How to reindex from an frozen index?](https://discuss.elastic.co/t/how-to-reindex-from-an-frozen-index/208801)
**Author:** [@stone\_xy](https://discuss.elastic.co/u/stone_xy)\ **Replies:** 2\ **Last updated:** [November 23, 2019, 6:04am UTC](https://discuss.elastic.co/t/how-to-reindex-from-an-frozen-index/208801 "2019-11-23T06:04:08Z")
ES Version: 7.4.2 Steps: create index and post some data: PUT logs { "settings": { "number\_of\_shards": 2, "number\_of\_replicas": 1 } } POST logs/\_doc { "msg": "hello there" } POST logs/\_doc { "msg": "hel… --- ## [Secure cURL connections and HTTP connections](https://discuss.elastic.co/t/secure-curl-connections-and-http-connections/209134)
**Author:** [@louisdeveloper](https://discuss.elastic.co/u/louisdeveloper)\ **Replies:** 3\ **Last updated:** [November 23, 2019, 5:44am UTC](https://discuss.elastic.co/t/secure-curl-connections-and-http-connections/209134 "2019-11-23T05:44:44Z")
I currently use ElasticSearch 6. \* installed on my server. In it I make cURL connections and access via HTTP directly, without having to enter username and password, just sending the request with HTTP to create and sear… --- ## [Elasticsearch 5.4.1 service stuck in windows](https://discuss.elastic.co/t/elasticsearch-5-4-1-service-stuck-in-windows/209139)
**Author:** [@Greg\_Kh](https://discuss.elastic.co/u/Greg_Kh)\ **Replies:** 0\ **Last updated:** [November 23, 2019, 4:26am UTC](https://discuss.elastic.co/t/elasticsearch-5-4-1-service-stuck-in-windows/209139 "2019-11-23T04:26:52Z")
Elasticsearch 5.4.1 was remove from Windows 2016 server as part of the removing MS DevOps Server 2019... While it was removed, somehow it is still listed in the local services on the server, attempt to start it fails as … --- ## [Configure a snapshot repository using GCS](https://discuss.elastic.co/t/configure-a-snapshot-repository-using-gcs/209009)
**Author:** [@Rajith\_konara](https://discuss.elastic.co/u/Rajith_konara)\ **Replies:** 2\ **Last updated:** [November 23, 2019, 2:45am UTC](https://discuss.elastic.co/t/configure-a-snapshot-repository-using-gcs/209009 "2019-11-23T02:45:52Z")
Hi Team, We tried to configure a custom snapshot repository using GCS as per the below documentation. \[Configure a snapshot repository using GCS | Elasticsearch Service Documentation | Elastic\] We are stucked in the 3… --- ## [Rename snmp dynamic fields](https://discuss.elastic.co/t/rename-snmp-dynamic-fields/208236)
**Author:** [@richard\_N](https://discuss.elastic.co/u/richard_N)\ **Replies:** 4\ **Last updated:** [November 23, 2019, 1:44am UTC](https://discuss.elastic.co/t/rename-snmp-dynamic-fields/208236 "2019-11-23T01:44:54Z")
How can I strip off everything after the . in my fields. Using SNMP the field names a very dynamic across devices and interfaces. ifDescr.27 to IfDescr ifInOctects.50 to IfInOctects IfInErrors.19 to IfInErrors --- ## [Is allow partial indices a valid option snapshot option?](https://discuss.elastic.co/t/is-allow-partial-indices-a-valid-option-snapshot-option/209132)
**Author:** [@kyles](https://discuss.elastic.co/u/kyles)\ **Replies:** 0\ **Last updated:** [November 23, 2019, 1:32am UTC](https://discuss.elastic.co/t/is-allow-partial-indices-a-valid-option-snapshot-option/209132 "2019-11-23T01:32:44Z")
In 7.4.2 I noticed that SLM has a snapshot policy option of "Allow partial indices". I noticed in the snapshot and restore documentation this option is not mentioned anywhere (link to docs) Although if I add it to a sta… --- ## [Issue with ES 6.8 supporting \_all field within index created in ES 5.6](https://discuss.elastic.co/t/issue-with-es-6-8-supporting-all-field-within-index-created-in-es-5-6/209130)
**Author:** [@blindwitness](https://discuss.elastic.co/u/blindwitness)\ **Replies:** 0\ **Last updated:** [November 23, 2019, 1:00am UTC](https://discuss.elastic.co/t/issue-with-es-6-8-supporting-all-field-within-index-created-in-es-5-6/209130 "2019-11-23T01:00:53Z")
Hello, In production, we use Elasticsearch to index our data for search related purposes. To interact with our current ES 5.6 cluster, we use the Java transport client. We are in the process of preparing for an upgrade … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1761) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1763)