# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1808 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1809 --- ## [Difference between analyzer and normalizer](https://discuss.elastic.co/t/difference-between-analyzer-and-normalizer/205897)
**Author:** [@daniele.saccon](https://discuss.elastic.co/u/daniele.saccon)\ **Replies:** 1\ **Last updated:** [October 30, 2019, 11:55pm UTC](https://discuss.elastic.co/t/difference-between-analyzer-and-normalizer/205897 "2019-10-30T23:55:39Z")
Hello, what is the difference between analyzer and normalizer? Thanks Daniele --- ## [Raw Log Size](https://discuss.elastic.co/t/raw-log-size/205958)
**Author:** [@uklipse](https://discuss.elastic.co/u/uklipse)\ **Replies:** 0\ **Last updated:** [October 30, 2019, 11:38pm UTC](https://discuss.elastic.co/t/raw-log-size/205958 "2019-10-30T23:38:35Z")
We are currently on Elasticstack and I've been charged with comparing to Azure Sentinel. Sentinel pricing is based on size of logs ingested. I can query for index sizes but I believe those include the parsed metadata as … --- ## [Wrong year selected Elastic search SQL Query (also any better way to do this)](https://discuss.elastic.co/t/wrong-year-selected-elastic-search-sql-query-also-any-better-way-to-do-this/201972)
**Author:** [@Avinash\_D\_Silva](https://discuss.elastic.co/u/Avinash_D_Silva)\ **Replies:** 2\ **Last updated:** [October 30, 2019, 10:54pm UTC](https://discuss.elastic.co/t/wrong-year-selected-elastic-search-sql-query-also-any-better-way-to-do-this/201972 "2019-10-30T22:54:30Z")
POST \_sql { "query": "SELECT AVG(parameters.strength.numericValue) as signal\_strength, DAY\_OF\_MONTH(timestamp) as dom, MONTH\_OF\_YEAR(timestamp) as moy, YEAR(timestamp) as yr FROM \\"performance\*\\" where name='Monitor'… --- ## [Group Same fieldvalue documents and aggreate on different field values](https://discuss.elastic.co/t/group-same-fieldvalue-documents-and-aggreate-on-different-field-values/204086)
**Author:** [@Vinothkumar\_Ganeshan](https://discuss.elastic.co/u/Vinothkumar_Ganeshan)\ **Replies:** 3\ **Last updated:** [October 30, 2019, 10:51pm UTC](https://discuss.elastic.co/t/group-same-fieldvalue-documents-and-aggreate-on-different-field-values/204086 "2019-10-30T22:51:28Z")
I have two indexes t-click and t-impression. I created a common index as t\*. index t-click tid: "sdalfk-234k" event: "click" tid: "sdalfk-234k" event: "click" index t-impression tid: "sdalfk-234k" site: "google… --- ## [Can't load dataset for offline lab of Elasticsearch Engineer I (blogs.csv)](https://discuss.elastic.co/t/cant-load-dataset-for-offline-lab-of-elasticsearch-engineer-i-blogs-csv/205947)
**Author:** [@saif3r](https://discuss.elastic.co/u/saif3r)\ **Replies:** 3\ **Last updated:** [October 30, 2019, 9:42pm UTC](https://discuss.elastic.co/t/cant-load-dataset-for-offline-lab-of-elasticsearch-engineer-i-blogs-csv/205947 "2019-10-30T21:42:29Z")
Hello, I would like to redo the entire Elasticsearch Engineer I training. I have my cluster setup using 3 virtual machines on my PC. Cluster is up and running, so is Kibana. How can i upload all the neccesary data used … --- ## [Logstash skips file while reading config](https://discuss.elastic.co/t/logstash-skips-file-while-reading-config/205770)
**Author:** [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\ **Replies:** 9\ **Last updated:** [October 30, 2019, 8:28pm UTC](https://discuss.elastic.co/t/logstash-skips-file-while-reading-config/205770 "2019-10-30T20:28:08Z")
Logstash just starts and shuts down due to configpathloader error. Please explain what the issue is. Below is the error - \[DEBUG\]\[logstash.config.source.local.configpathloader\] Skipping the following files while reading… --- ## [Viewing the Raw "Message" Line from Filebeat for a few thousand entries](https://discuss.elastic.co/t/viewing-the-raw-message-line-from-filebeat-for-a-few-thousand-entries/205508)
**Author:** [@ELKNub](https://discuss.elastic.co/u/ELKNub)\ **Replies:** 3\ **Last updated:** [October 30, 2019, 7:58pm UTC](https://discuss.elastic.co/t/viewing-the-raw-message-line-from-filebeat-for-a-few-thousand-entries/205508 "2019-10-30T19:58:53Z")
Hey Folks, So I have Filebeat pumping from a few IIS Servers into Kibana (YAY!) My question is this: Once I have a filter that makes say, 100,000 log-lines filtered down into 1,000, is there a way I can output the "Me… --- ## [Error: "no known master node" and "\[SERVICE\_UNAVAILABLE/1/state not recovered / initialized\]"](https://discuss.elastic.co/t/error-no-known-master-node-and-service-unavailable-1-state-not-recovered-initialized/205942)
**Author:** [@Thomas82](https://discuss.elastic.co/u/Thomas82)\ **Replies:** 0\ **Last updated:** [October 30, 2019, 7:47pm UTC](https://discuss.elastic.co/t/error-no-known-master-node-and-service-unavailable-1-state-not-recovered-initialized/205942 "2019-10-30T19:47:58Z")
Running a single-node cluster and was working great. I had to reboot the server and am now seeing errors regarding "no known master node" and "\[SERVICE\_UNAVAILABLE/1/state not recovered / initialized\]" (see logs below). … --- ## [Elasticsearch Index Rollover](https://discuss.elastic.co/t/elasticsearch-index-rollover/205763)
**Author:** [@eemtzc](https://discuss.elastic.co/u/eemtzc)\ **Replies:** 3\ **Last updated:** [October 30, 2019, 7:11pm UTC](https://discuss.elastic.co/t/elasticsearch-index-rollover/205763 "2019-10-30T19:11:04Z")
I have a problem, for some reason the previous Elasticsearch Admin configured an Index in a way that this index does not create a daily rollout. I will explain this better: I have a filebeat index running and every sing… --- ## [Installing Elasticsearch 7.4 on a Raspberry Pi 4 (Raspbian Buster)](https://discuss.elastic.co/t/installing-elasticsearch-7-4-on-a-raspberry-pi-4-raspbian-buster/202599)
**Author:** [@glassman](https://discuss.elastic.co/u/glassman)\ **Replies:** 10\ **Last updated:** [October 30, 2019, 6:01pm UTC](https://discuss.elastic.co/t/installing-elasticsearch-7-4-on-a-raspberry-pi-4-raspbian-buster/202599 "2019-10-30T18:01:28Z")
I'm currently trying to install ES on an RPi 4B. I've used this thread as a sort of guide. Here are the steps I've taken: sudo apt-get install default-jre sudo nano /etc/profile export JAVA\_HOME=$(readlink -f /usr/bi… --- ## [Logstash started successfully and within minute shuts down automatically](https://discuss.elastic.co/t/logstash-started-successfully-and-within-minute-shuts-down-automatically/205565)
**Author:** [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\ **Replies:** 2\ **Last updated:** [October 30, 2019, 5:54pm UTC](https://discuss.elastic.co/t/logstash-started-successfully-and-within-minute-shuts-down-automatically/205565 "2019-10-30T17:54:55Z")
\[2019-10-28T16:19:39,384\]\[INFO\]\[logstash.agent \] Successfully started Logstash API endpoint {:port=\>9600} \[2019-10-28T16:19:43,944\]\[INFO\]\[logstash.runner \] Logstash shut down --- ## [Limit of total fields \[num\] in index \[logstash-XX\] has been exceeded](https://discuss.elastic.co/t/limit-of-total-fields-num-in-index-logstash-xx-has-been-exceeded/205889)
**Author:** [@wpirraglia](https://discuss.elastic.co/u/wpirraglia)\ **Replies:** 6\ **Last updated:** [October 30, 2019, 5:51pm UTC](https://discuss.elastic.co/t/limit-of-total-fields-num-in-index-logstash-xx-has-been-exceeded/205889 "2019-10-30T17:51:12Z")
Little background story first: We had an ELK 2.6 stack, which we decided to upgrade to 6.5. After creating the new stack, we decided to use the reindex API to copy our old Logstash indexes from the old stack to the new o… --- ## [Logstash reading from Redis Slows Significantly After Several Days](https://discuss.elastic.co/t/logstash-reading-from-redis-slows-significantly-after-several-days/205908)
**Author:** [@justin\_spies](https://discuss.elastic.co/u/justin_spies)\ **Replies:** 0\ **Last updated:** [October 30, 2019, 4:12pm UTC](https://discuss.elastic.co/t/logstash-reading-from-redis-slows-significantly-after-several-days/205908 "2019-10-30T16:12:11Z")
For our Kubernetes cluster we have ELK setup as follows: Filebeat -\> Redis (AWS ElastiCache) -\> Logstash -\> ElasticSearch Logstash is on one cluster and ElasticSearch is on a separate Cluster. Both Logstash and ES are … --- ## [Setup access dashboard per user](https://discuss.elastic.co/t/setup-access-dashboard-per-user/205497)
**Author:** [@martijndegroot](https://discuss.elastic.co/u/martijndegroot)\ **Replies:** 5\ **Last updated:** [October 30, 2019, 4:44pm UTC](https://discuss.elastic.co/t/setup-access-dashboard-per-user/205497 "2019-10-30T16:44:30Z")
Hi all,, We are running Elastic Cloud and latest version of Kibana. At this moment we are creating (in Kibana) new dashboards for different stakeholders. I would like to know how to setup the user rights and security … --- ## [Contributing to Logstash plugins open source](https://discuss.elastic.co/t/contributing-to-logstash-plugins-open-source/205903)
**Author:** [@AustinTag](https://discuss.elastic.co/u/AustinTag)\ **Replies:** 0\ **Last updated:** [October 30, 2019, 3:54pm UTC](https://discuss.elastic.co/t/contributing-to-logstash-plugins-open-source/205903 "2019-10-30T15:54:41Z")
I have had a PR to a logstash owned plugin open for a few weeks: https://github.com/logstash-plugins/logstash-mixin-aws/pull/39 Is there any way to escalate the PR, or does anyone have tips on getting this looked at by… --- ## [Auditbeat 7.3: Как добавить исключение auditd](https://discuss.elastic.co/t/auditbeat-7-3-auditd/205874)
**Author:** [@Igor\_Belyakov](https://discuss.elastic.co/u/Igor_Belyakov)\ **Replies:** 4\ **Last updated:** [October 30, 2019, 3:54pm UTC](https://discuss.elastic.co/t/auditbeat-7-3-auditd/205874 "2019-10-30T15:54:16Z")
Коллеги, добрый день. Столкнулся с задачей: Необходимо исключить определенный процесс из аудита. Для аудита использую модуль auditd в составе Auditbeat 7.3 на centos7. На сервере есть процесс с именем /usr/bin/process… --- ## [publicDir does not honour server.basePath](https://discuss.elastic.co/t/publicdir-does-not-honour-server-basepath/205520)
**Author:** [@Simone\_Scarduzio](https://discuss.elastic.co/u/Simone_Scarduzio)\ **Replies:** 2\ **Last updated:** [October 30, 2019, 3:52pm UTC](https://discuss.elastic.co/t/publicdir-does-not-honour-server-basepath/205520 "2019-10-30T15:52:50Z")
Hello, I generated a sample plugin from the Kibana scripts, and added the "publicDir" option in order to serve static files like images from within my plugin: // From my plugin's index.js export default function (kiban… --- ## [Field expansion matches too many fields, limit: 1024, got: 2089](https://discuss.elastic.co/t/field-expansion-matches-too-many-fields-limit-1024-got-2089/205896)
**Author:** [@vijayakrishna.rg](https://discuss.elastic.co/u/vijayakrishna.rg)\ **Replies:** 0\ **Last updated:** [October 30, 2019, 3:35pm UTC](https://discuss.elastic.co/t/field-expansion-matches-too-many-fields-limit-1024-got-2089/205896 "2019-10-30T15:35:12Z")
Elastic: 7.4 Kibana: 7.4 Elastic cluster contains 6 nodes, Each node has 1 TB HDD and 32GB RAM (24GB assigned to Elastic) service and 8vcpu I am getting too many fields issue while searching for string fromDiscovery t… --- ## [How I can delete element from array?](https://discuss.elastic.co/t/how-i-can-delete-element-from-array/205868)
**Author:** [@gleb](https://discuss.elastic.co/u/gleb)\ **Replies:** 2\ **Last updated:** [October 30, 2019, 3:04pm UTC](https://discuss.elastic.co/t/how-i-can-delete-element-from-array/205868 "2019-10-30T15:04:47Z")
Hello! I receive messages like this: "app\_risk = 0 app\_risk =2" or "app\_risk = 0" After kv filter, I have field "app\_risk": \[ "0", "2"\] or \["0"\]. How I can delete the first element of array - "0", if app\_risk\[1\] exis… --- ## [Webhdfs write path](https://discuss.elastic.co/t/webhdfs-write-path/205892)
**Author:** [@sidi](https://discuss.elastic.co/u/sidi)\ **Replies:** 0\ **Last updated:** [October 30, 2019, 3:04pm UTC](https://discuss.elastic.co/t/webhdfs-write-path/205892 "2019-10-30T15:04:18Z")
Hi, I'm using logstash to write data from elasticsearch to hdfs. Everything is going well but th eproblem is when logstash write data in hdfs there is the following exception: webhdfs write caused an exception: {"Remo… --- ## [Run script inside hmtl of field formatter](https://discuss.elastic.co/t/run-script-inside-hmtl-of-field-formatter/205805)
**Author:** [@Elaak](https://discuss.elastic.co/u/Elaak)\ **Replies:** 5\ **Last updated:** [October 30, 2019, 2:57pm UTC](https://discuss.elastic.co/t/run-script-inside-hmtl-of-field-formatter/205805 "2019-10-30T14:57:13Z")
I have a fieldformatter that in its \_convert method needs to do a HTTP (POST/PUT) request to a url using one of two different buttons (or allow user to input a value and post that). I have created an html \ and fo… --- ## [Search Vietnamese character](https://discuss.elastic.co/t/search-vietnamese-character/205888)
**Author:** [@Hoang\_Nguyen1](https://discuss.elastic.co/u/Hoang_Nguyen1)\ **Replies:** 0\ **Last updated:** [October 30, 2019, 2:55pm UTC](https://discuss.elastic.co/t/search-vietnamese-character/205888 "2019-10-30T14:55:48Z")
I want to search accent character in my language. For example: I want to find the word "vành đúc" when i type "vanh duc" --- ## [Index for NETFLOW Filebeat module](https://discuss.elastic.co/t/index-for-netflow-filebeat-module/205885)
**Author:** [@thirty2](https://discuss.elastic.co/u/thirty2)\ **Replies:** 0\ **Last updated:** [October 30, 2019, 2:49pm UTC](https://discuss.elastic.co/t/index-for-netflow-filebeat-module/205885 "2019-10-30T14:49:02Z")
Hi, i have two filebeat modules (kafka and netflow) enable. How to configure netflow module to write data to a different index? Thanks --- ## [\[LogStash::Runner\] Logstash - java.lang.OutOfMemoryError: Java heap space](https://discuss.elastic.co/t/logstash-runner-logstash-java-lang-outofmemoryerror-java-heap-space/205881)
**Author:** [@Bharath\_Pusuluri](https://discuss.elastic.co/u/Bharath_Pusuluri)\ **Replies:** 1\ **Last updated:** [October 30, 2019, 2:47pm UTC](https://discuss.elastic.co/t/logstash-runner-logstash-java-lang-outofmemoryerror-java-heap-space/205881 "2019-10-30T14:47:40Z")
I am trying to run a Logstash service ingesting the data returning from curl command. Somehow, the Logstash is failing saying with the following warnings and errors. I tried running the Logstash with option - LS\_HEAP\_SI… --- ## [I cann't choose one value of AWS filters (cloud region , machine type , available zone ) on \[Metricbeat AWS\] EC2 Overview dashboard on kibana](https://discuss.elastic.co/t/i-cannt-choose-one-value-of-aws-filters-cloud-region-machine-type-available-zone-on-metricbeat-aws-ec2-overview-dashboard-on-kibana/205405)
**Author:** [@SunnyClara](https://discuss.elastic.co/u/SunnyClara)\ **Replies:** 3\ **Last updated:** [October 30, 2019, 2:42pm UTC](https://discuss.elastic.co/t/i-cannt-choose-one-value-of-aws-filters-cloud-region-machine-type-available-zone-on-metricbeat-aws-ec2-overview-dashboard-on-kibana/205405 "2019-10-30T14:42:11Z")
I'm using the aws Metricbeat module on kibana 7.3 . It looks good running when i check aws metrics data(metricbeat-\*) on a Discover page. there's many variable datas with cloud.\* data , aws.\* data , host.\* data Bu… --- ## [JDBC Input with Aggregate Filter](https://discuss.elastic.co/t/jdbc-input-with-aggregate-filter/205617)
**Author:** [@Ahmad\_Samir](https://discuss.elastic.co/u/Ahmad_Samir)\ **Replies:** 6\ **Last updated:** [October 30, 2019, 2:41pm UTC](https://discuss.elastic.co/t/jdbc-input-with-aggregate-filter/205617 "2019-10-30T14:41:06Z")
Hello, I have a plugin that gets data from SQL server and aggregates some records with a unique ID, But unfortaintly I didn't get any output. My config file is as bellow. input { jdbc { jdbc\_connection\_string =\> … --- ## [Single large cluster or multiple smaller clusters with remote search](https://discuss.elastic.co/t/single-large-cluster-or-multiple-smaller-clusters-with-remote-search/205879)
**Author:** [@o1o1o11o1](https://discuss.elastic.co/u/o1o1o11o1)\ **Replies:** 0\ **Last updated:** [October 30, 2019, 2:29pm UTC](https://discuss.elastic.co/t/single-large-cluster-or-multiple-smaller-clusters-with-remote-search/205879 "2019-10-30T14:29:44Z")
We migrated from ES 5.6 with one large cluster hosting 2TB of daily indices and things were working pretty good to 6 smaller ES 7.1 clusters with remote cluster search. We've noticed that the performance was not so great… --- ## [\[7.2-7.3\] Plugin development routes best practices](https://discuss.elastic.co/t/7-2-7-3-plugin-development-routes-best-practices/204967)
**Author:** [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\ **Replies:** 4\ **Last updated:** [October 30, 2019, 2:14pm UTC](https://discuss.elastic.co/t/7-2-7-3-plugin-development-routes-best-practices/204967 "2019-10-30T14:14:18Z")
Hi there! I'm developing (trying to, actually) a Kibana plugin (already opened couple of threads about it). Here I wanted to ask you which was the best way to implement routing across the plugin pages. Let's say in th… --- ## [Netflow Module : Logstash geoip2.exception](https://discuss.elastic.co/t/netflow-module-logstash-geoip2-exception/205873)
**Author:** [@Elena\_Kaidrikov](https://discuss.elastic.co/u/Elena_Kaidrikov)\ **Replies:** 0\ **Last updated:** [October 30, 2019, 1:58pm UTC](https://discuss.elastic.co/t/netflow-module-logstash-geoip2-exception/205873 "2019-10-30T13:58:39Z")
The Kibana Dashboard is empty, despite of Logstash receives the netflow traffic. The logstash log has the following prints : \[DEBUG\]\[org.logstash.filters.GeoIPFilter\] IP not found! exception=com.maxmind.geoip2.excepti… --- ## [\[Logstash 6.5.2\] Problem parsing long messages](https://discuss.elastic.co/t/logstash-6-5-2-problem-parsing-long-messages/205872)
**Author:** [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\ **Replies:** 1\ **Last updated:** [October 30, 2019, 1:57pm UTC](https://discuss.elastic.co/t/logstash-6-5-2-problem-parsing-long-messages/205872 "2019-10-30T13:57:25Z")
Hi there, I'm using Logstash to parse a java json log which may have a stacktrace nested field. I wanted to use json filter to automatically parse the input (since it is a json with possible nested jsons). Now, if I ap… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1807) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1809)