# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1784 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1785 --- ## [Storing logs containing several different XML types/schemas into ES](https://discuss.elastic.co/t/storing-logs-containing-several-different-xml-types-schemas-into-es/207764)
**Author:** [@zenluiz](https://discuss.elastic.co/u/zenluiz)\ **Replies:** 0\ **Last updated:** [November 13, 2019, 6:59pm UTC](https://discuss.elastic.co/t/storing-logs-containing-several-different-xml-types-schemas-into-es/207764 "2019-11-13T18:59:49Z")
Hi, I have millions of lines of logs that I want to index in ES, using Filebeat + Logstash. Each log line can have a different XML that represents a SOAP message that has been received by a WebService and logged, like … --- ## [Querying multiple condition on same field](https://discuss.elastic.co/t/querying-multiple-condition-on-same-field/207233)
**Author:** [@rsganesh83](https://discuss.elastic.co/u/rsganesh83)\ **Replies:** 2\ **Last updated:** [November 13, 2019, 6:49pm UTC](https://discuss.elastic.co/t/querying-multiple-condition-on-same-field/207233 "2019-11-13T18:49:44Z")
These are the sample documents(event based) indexed in my ES cluster version 6.8 { "user\_id": "user1", "account\_id": "account1", "event\_name": "event-1", "created\_dt": "2019-09-30T08:40:42.297Z" } { "user\_id": … --- ## [Indexing articles with attachments](https://discuss.elastic.co/t/indexing-articles-with-attachments/207419)
**Author:** [@bruinjoe](https://discuss.elastic.co/u/bruinjoe)\ **Replies:** 4\ **Last updated:** [November 13, 2019, 6:44pm UTC](https://discuss.elastic.co/t/indexing-articles-with-attachments/207419 "2019-11-13T18:44:16Z")
We are using a knowledge management system that allows authors to write articles and attach documents. The article contains the following fields. title description content locale categories issue date attachment… --- ## [Combining Clarifai image search with Elasticsearch](https://discuss.elastic.co/t/combining-clarifai-image-search-with-elasticsearch/207760)
**Author:** [@Paul\_Johnson](https://discuss.elastic.co/u/Paul_Johnson)\ **Replies:** 0\ **Last updated:** [November 13, 2019, 6:23pm UTC](https://discuss.elastic.co/t/combining-clarifai-image-search-with-elasticsearch/207760 "2019-11-13T18:23:03Z")
Is there some way to combine an external image search system like Clarifai with Elasticsearch? Basically using the external image search system to provide document ids and ordering that can then be filtered by additional… --- ## [Kibana: can I store "Time" as a variable and run a consecutive search?](https://discuss.elastic.co/t/kibana-can-i-store-time-as-a-variable-and-run-a-consecutive-search/206421)
**Author:** [@Francesco\_Mantovani](https://discuss.elastic.co/u/Francesco_Mantovani)\ **Replies:** 5\ **Last updated:** [November 13, 2019, 5:44pm UTC](https://discuss.elastic.co/t/kibana-can-i-store-time-as-a-variable-and-run-a-consecutive-search/206421 "2019-11-13T17:44:01Z")
I'm new to Kibana and I'm trying to automate the research we do every day. I already asked a question on StackOverflow but I'm not satisfied with the reply. I work in a company that produce a software for autonomous ve… --- ## [Why is preference a parameter only and not part of the request body itself?](https://discuss.elastic.co/t/why-is-preference-a-parameter-only-and-not-part-of-the-request-body-itself/207740)
**Author:** [@usteidj](https://discuss.elastic.co/u/usteidj)\ **Replies:** 4\ **Last updated:** [November 13, 2019, 5:24pm UTC](https://discuss.elastic.co/t/why-is-preference-a-parameter-only-and-not-part-of-the-request-body-itself/207740 "2019-11-13T17:24:20Z")
I'd like to be able to pass in preference as part of the body of the request, like "from", "size", "\_source", "query", etc., but it appears that is not an option. Why? --- ## [Logstash file input plugin duplicate events after log file rollover](https://discuss.elastic.co/t/logstash-file-input-plugin-duplicate-events-after-log-file-rollover/207750)
**Author:** [@Cristi\_Ruja](https://discuss.elastic.co/u/Cristi_Ruja)\ **Replies:** 0\ **Last updated:** [November 13, 2019, 4:58pm UTC](https://discuss.elastic.co/t/logstash-file-input-plugin-duplicate-events-after-log-file-rollover/207750 "2019-11-13T16:58:20Z")
I have an application writing a log file, with log4j through RollingFileAppender. Logstash listen to that file (control-engine.log) in order to retrieve and generate events: When log file rollover is happening, the fil… --- ## [Elasticsearch Node scalability on K8s](https://discuss.elastic.co/t/elasticsearch-node-scalability-on-k8s/207751)
**Author:** [@sreenivasulu](https://discuss.elastic.co/u/sreenivasulu)\ **Replies:** 0\ **Last updated:** [November 13, 2019, 5:04pm UTC](https://discuss.elastic.co/t/elasticsearch-node-scalability-on-k8s/207751 "2019-11-13T17:04:17Z")
Hi Team, The ES running successfully in our environment. But don't have a scalability of this cluster, it may go down any point of time. So what would be the best way to configure node scalability on kubernetes to maint… --- ## [Filebeat ILM duplicating index when rolling from hot to warm](https://discuss.elastic.co/t/filebeat-ilm-duplicating-index-when-rolling-from-hot-to-warm/207719)
**Author:** [@sgreszcz](https://discuss.elastic.co/u/sgreszcz)\ **Replies:** 3\ **Last updated:** [November 13, 2019, 4:39pm UTC](https://discuss.elastic.co/t/filebeat-ilm-duplicating-index-when-rolling-from-hot-to-warm/207719 "2019-11-13T16:39:19Z")
We are shipping server events using filebeat and metrics using metricbeat to our Elastic Cloud cluster that has a hot server and a warm server. The cluster is set up with no redundancy, ie just a single hot and a singl… --- ## [Хранение логов](https://discuss.elastic.co/t/topic/205392)
**Author:** [@Sans\_Contrefacon](https://discuss.elastic.co/u/Sans_Contrefacon)\ **Replies:** 5\ **Last updated:** [November 13, 2019, 4:36pm UTC](https://discuss.elastic.co/t/topic/205392 "2019-11-13T16:36:58Z")
Привет. Я только начал пользоваться ELK стаком,и у меня стоит задача хранить логи 2 года, под это дело выделено много места под хранилище. Вопрос состоит в том, где можно указать, определить и посмотреть сколько хранятся… --- ## [Inner Hits and Rescoring](https://discuss.elastic.co/t/inner-hits-and-rescoring/207745)
**Author:** [@ravensedge](https://discuss.elastic.co/u/ravensedge)\ **Replies:** 0\ **Last updated:** [November 13, 2019, 4:24pm UTC](https://discuss.elastic.co/t/inner-hits-and-rescoring/207745 "2019-11-13T16:24:39Z")
Hi all, I have the following problem: I want to do filtering on a nested field, then rescore based on the fields that matched the filter. In the minimum working example below, the query returns a score of 9000. However… --- ## [Добавление новой data-ноды в кластер](https://discuss.elastic.co/t/data/207533)
**Author:** [@111229](https://discuss.elastic.co/u/111229)\ **Replies:** 7\ **Last updated:** [November 13, 2019, 4:09pm UTC](https://discuss.elastic.co/t/data/207533 "2019-11-13T16:09:30Z")
Коллеги, добрый день! У нас кластер из 6 нод в SSL, хотим добавить еще 2 ноды. Вопрос: как можно выпустить сертификаты только для двух новых серверов ? Если я правильно понял, то если использовать elasticsearch-certge… --- ## [Некорректный вывод статы в TSVB](https://discuss.elastic.co/t/tsvb/207710)
**Author:** [@Anne\_Kim](https://discuss.elastic.co/u/Anne_Kim)\ **Replies:** 4\ **Last updated:** [November 13, 2019, 4:06pm UTC](https://discuss.elastic.co/t/tsvb/207710 "2019-11-13T16:06:41Z")
Есть TSVB-график, отображающий количество входов в приложение (синий) и количество игр там же (зелёный). Однако иногда количество входов = 0, а кол-во игр не равно 0 (см. скрин). Разумеется, такого не может быть в реаль… --- ## [Wrong values pass to index](https://discuss.elastic.co/t/wrong-values-pass-to-index/207564)
**Author:** [@namali](https://discuss.elastic.co/u/namali)\ **Replies:** 3\ **Last updated:** [November 13, 2019, 4:03pm UTC](https://discuss.elastic.co/t/wrong-values-pass-to-index/207564 "2019-11-13T16:03:40Z")
there are multiple config files in logstash server. all configs files transfer data to different indexes. values pass from other config files as well to particular index. Please let me know how to over come from to pass … --- ## [Is it possible to set jdbc input plugin retry counts?](https://discuss.elastic.co/t/is-it-possible-to-set-jdbc-input-plugin-retry-counts/207733)
**Author:** [@Jerry\_Zheng](https://discuss.elastic.co/u/Jerry_Zheng)\ **Replies:** 0\ **Last updated:** [November 13, 2019, 3:48pm UTC](https://discuss.elastic.co/t/is-it-possible-to-set-jdbc-input-plugin-retry-counts/207733 "2019-11-13T15:48:23Z")
As title, are there any jdbc input configuration options to set retry counts? Say, when jdbc unable connect to sql server, it will retry 3 times and exit. I have tried connection\_retry\_attempts with value 3, it is expec… --- ## [Building elasticsearch source code](https://discuss.elastic.co/t/building-elasticsearch-source-code/207540)
**Author:** [@mamadly](https://discuss.elastic.co/u/mamadly)\ **Replies:** 3\ **Last updated:** [November 13, 2019, 3:40pm UTC](https://discuss.elastic.co/t/building-elasticsearch-source-code/207540 "2019-11-13T15:40:12Z")
Hi, This is my first time trying to build elasticsearch source code. Wiki is saying that at least java12 is require to build source code. I am running ubuntu 18.04. From the google that I have done it doesn't seem that … --- ## [How to deal with \*big\* payload fields in events?](https://discuss.elastic.co/t/how-to-deal-with-big-payload-fields-in-events/207727)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 1\ **Last updated:** [November 13, 2019, 3:35pm UTC](https://discuss.elastic.co/t/how-to-deal-with-big-payload-fields-in-events/207727 "2019-11-13T15:35:01Z")
Hi, I am indexing logs which contains a field payload. The payload is some soap / xml statement which may become very big. I notice that if I want to view this event in discover panel, it the browser is hanging, the pag… --- ## [Kubernetes autodiscovery: pod with multiple log files](https://discuss.elastic.co/t/kubernetes-autodiscovery-pod-with-multiple-log-files/207405)
**Author:** [@DominicWatson](https://discuss.elastic.co/u/DominicWatson)\ **Replies:** 2\ **Last updated:** [November 13, 2019, 3:29pm UTC](https://discuss.elastic.co/t/kubernetes-autodiscovery-pod-with-multiple-log-files/207405 "2019-11-13T15:29:57Z")
Hi there, I'm struggling to get filebeats to pick up log files in my pods using autodiscovery annotations. My filebeat daemonset config looks like this: --- apiVersion: v1 kind: ConfigMap metadata: name: filebeat-conf… --- ## [Ecs version 1.1.0 on latest winlogbeats](https://discuss.elastic.co/t/ecs-version-1-1-0-on-latest-winlogbeats/207589)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 1\ **Last updated:** [November 13, 2019, 3:25pm UTC](https://discuss.elastic.co/t/ecs-version-1-1-0-on-latest-winlogbeats/207589 "2019-11-13T15:25:29Z")
Has ecs 1.2 not been integrated yet into beats? This is a fresh install of the elastic stack and winlogbeats. Thanks Phil --- ## [Does logstash has a size limit for events?](https://discuss.elastic.co/t/does-logstash-has-a-size-limit-for-events/207728)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 0\ **Last updated:** [November 13, 2019, 3:12pm UTC](https://discuss.elastic.co/t/does-logstash-has-a-size-limit-for-events/207728 "2019-11-13T15:12:03Z")
Hi, I have payloads (soap) in my logfiles which want to save within the events in elastic stack. These payloads can get big. I've seen about 25MB but I've heard about 100MB+. Is logstash capable of inserting such big … --- ## [Beats in docker: logging so filebeat picks up logs via "docker logs" API](https://discuss.elastic.co/t/beats-in-docker-logging-so-filebeat-picks-up-logs-via-docker-logs-api/205869)
**Author:** [@sgreszcz](https://discuss.elastic.co/u/sgreszcz)\ **Replies:** 3\ **Last updated:** [November 13, 2019, 3:07pm UTC](https://discuss.elastic.co/t/beats-in-docker-logging-so-filebeat-picks-up-logs-via-docker-logs-api/205869 "2019-11-13T15:07:57Z")
I'm running several containers in docker and using filebeat and metricbeat to poll the Docker APIs to get metrics and logfiles. However I can't see any of the filebeat or metricbeat logs (also running in containers) usi… --- ## [Could not locate that index-pattern \[semi-fixed\]](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-semi-fixed/207506)
**Author:** [@pdeelman](https://discuss.elastic.co/u/pdeelman)\ **Replies:** 4\ **Last updated:** [November 13, 2019, 3:07pm UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-semi-fixed/207506 "2019-11-13T15:07:22Z")
Okay, so I've ran into this "famous" issue where the index pattern cannot be located. This was a fresh install, although I was experimenting a bit with the index patterns. At one moment some visualizations in the Metricb… --- ## [Cannot change similarity with put\_mapping: conflict with existing mapping](https://discuss.elastic.co/t/cannot-change-similarity-with-put-mapping-conflict-with-existing-mapping/206653)
**Author:** [@winklefr](https://discuss.elastic.co/u/winklefr)\ **Replies:** 5\ **Last updated:** [November 13, 2019, 2:48pm UTC](https://discuss.elastic.co/t/cannot-change-similarity-with-put-mapping-conflict-with-existing-mapping/206653 "2019-11-13T14:48:52Z")
Hello, I recently set up an elastic search cluster. I have created an index with some text field. I managed to add a new text field using the put\_mapping API. But I cannot update the related similarity. I get the follo… --- ## [Сравнение общей динамики с индивидуальной](https://discuss.elastic.co/t/topic/206197)
**Author:** [@Anne\_Kim](https://discuss.elastic.co/u/Anne_Kim)\ **Replies:** 3\ **Last updated:** [November 13, 2019, 3:02pm UTC](https://discuss.elastic.co/t/topic/206197 "2019-11-13T15:02:12Z")
Ситуация такая: есть TSVB-визуализация, отображающая среднее значение по всем игрокам (синяя) и отдельные показатели игроков (красные линии): Данная визуализация затем используется в дешборде, отфильтрованном по одном… --- ## [Dedicated private temporary directory cleanup policy](https://discuss.elastic.co/t/dedicated-private-temporary-directory-cleanup-policy/207720)
**Author:** [@imrimt](https://discuss.elastic.co/u/imrimt)\ **Replies:** 0\ **Last updated:** [November 13, 2019, 2:21pm UTC](https://discuss.elastic.co/t/dedicated-private-temporary-directory-cleanup-policy/207720 "2019-11-13T14:21:02Z")
As per this documentation: https://www.elastic.co/guide/en/elasticsearch/reference/6.8/es-tmpdir.html, we should configure a dedicated temp directory when running Elasticsearch on Linux using the tar.gz distribution so t… --- ## [CLUSTER\_RECOVERED and unassigned](https://discuss.elastic.co/t/cluster-recovered-and-unassigned/207717)
**Author:** [@jiangchenghua](https://discuss.elastic.co/u/jiangchenghua)\ **Replies:** 0\ **Last updated:** [November 13, 2019, 2:13pm UTC](https://discuss.elastic.co/t/cluster-recovered-and-unassigned/207717 "2019-11-13T14:13:47Z")
reason:"cluster\_recovered" allocate\_explanation:cannot allocate because a previous copy of the primary shard existed but can no longer be found on node in the cluster --- ## [Error: "no handler found for uri \[/api/security/role/my\_kibana\_role?pretty\] and method \[PUT\]"](https://discuss.elastic.co/t/error-no-handler-found-for-uri-api-security-role-my-kibana-role-pretty-and-method-put/207482)
**Author:** [@daniellienert](https://discuss.elastic.co/u/daniellienert)\ **Replies:** 2\ **Last updated:** [November 13, 2019, 2:11pm UTC](https://discuss.elastic.co/t/error-no-handler-found-for-uri-api-security-role-my-kibana-role-pretty-and-method-put/207482 "2019-11-13T14:11:28Z")
Hey there, I would like to add Kibana roles using the role management API as described in: https://www.elastic.co/guide/en/kibana/7.4/role-management-api-put.html For a PUT /api/security/role/my\_kibana\_role { "meta… --- ## [Beats writing logs to messages](https://discuss.elastic.co/t/beats-writing-logs-to-messages/205144)
**Author:** [@Senthil\_ak](https://discuss.elastic.co/u/Senthil_ak)\ **Replies:** 6\ **Last updated:** [November 13, 2019, 1:59pm UTC](https://discuss.elastic.co/t/beats-writing-logs-to-messages/205144 "2019-11-13T13:59:16Z")
Hi Team, Even though I've setting for writing beat logs to file its still writing the logs to messages only. Below is the config for metricbeat i have the same for filebeat too. But both writing ton of logs to /var/logs… --- ## [How to reference value of field in translate?](https://discuss.elastic.co/t/how-to-reference-value-of-field-in-translate/207561)
**Author:** [@Andrew22](https://discuss.elastic.co/u/Andrew22)\ **Replies:** 16\ **Last updated:** [November 13, 2019, 1:28pm UTC](https://discuss.elastic.co/t/how-to-reference-value-of-field-in-translate/207561 "2019-11-13T13:28:57Z")
I would like to use the device name I have in the dictionary\_path in the translate filter but I am having issues with it. is it even possible? something like translate { field =\> "name" destination =\> "lookUp" dicti… --- ## [Kibana requires a restart daily](https://discuss.elastic.co/t/kibana-requires-a-restart-daily/207440)
**Author:** [@Aalok\_Sharma](https://discuss.elastic.co/u/Aalok_Sharma)\ **Replies:** 1\ **Last updated:** [November 13, 2019, 1:28pm UTC](https://discuss.elastic.co/t/kibana-requires-a-restart-daily/207440 "2019-11-13T13:28:38Z")
Hi, I'm pretty new to Kibana+elasticsearch setup and I've been facing an issue with my current pipeline. I have kibana + 2 data-nodes(Master+slave) ver 6.5.1. Now my problem is that once, everyday the Kibana-\>ES conne… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1783) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1785)