# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1819 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1820 --- ## [How to add timestamp to aggregate filter](https://discuss.elastic.co/t/how-to-add-timestamp-to-aggregate-filter/205122)
**Author:** [@krishna\_bhargav](https://discuss.elastic.co/u/krishna_bhargav)\ **Replies:** 2\ **Last updated:** [October 24, 2019, 6:02pm UTC](https://discuss.elastic.co/t/how-to-add-timestamp-to-aggregate-filter/205122 "2019-10-24T18:02:15Z")
filter contents below, timeevent should display current timestamp aggregate { task\_id =\> "%{ENVIRONMENT\_ID}\_%{SPN\_FIRM\_ID}\_%{ENTITY\_TYPE}\_%{ENTITY\_ID}" code =\> ' map\["keyInformation"\] ||= {} map\["keyInformati… --- ## [Searching string terms within arrays](https://discuss.elastic.co/t/searching-string-terms-within-arrays/205125)
**Author:** [@Joao\_D\_Junior](https://discuss.elastic.co/u/Joao_D_Junior)\ **Replies:** 0\ **Last updated:** [October 24, 2019, 5:59pm UTC](https://discuss.elastic.co/t/searching-string-terms-within-arrays/205125 "2019-10-24T17:59:28Z")
I am trying to search for a particular element within an array through a term, but when querying, I get nothing p.s: I am using elasticsearch 7.x. I created the following query: POST spring/\_search { "query": { "… --- ## [Query question on search dependent on results](https://discuss.elastic.co/t/query-question-on-search-dependent-on-results/205108)
**Author:** [@berryma4](https://discuss.elastic.co/u/berryma4)\ **Replies:** 3\ **Last updated:** [October 24, 2019, 5:57pm UTC](https://discuss.elastic.co/t/query-question-on-search-dependent-on-results/205108 "2019-10-24T17:57:54Z")
Is it possible to have a single query where the returned hits match the following: search a field "a", but also return records which have the same value for field "b" as the records returned by field "a". --- ## [Netflow bandwidth usage in gauge or metric](https://discuss.elastic.co/t/netflow-bandwidth-usage-in-gauge-or-metric/205031)
**Author:** [@jquintard](https://discuss.elastic.co/u/jquintard)\ **Replies:** 1\ **Last updated:** [October 24, 2019, 5:28pm UTC](https://discuss.elastic.co/t/netflow-bandwidth-usage-in-gauge-or-metric/205031 "2019-10-24T17:28:59Z")
It's very easy to make a bandwidth graph with a timelion expression from netflow values : .es(index=filebeat-\*, metric='sum:network.bytes').divide(1048576).scale\_interval('1s').title('MB per second') But how to make a … --- ## [Scatter Plot with multiple Y values for each X using VEGA](https://discuss.elastic.co/t/scatter-plot-with-multiple-y-values-for-each-x-using-vega/205014)
**Author:** [@newkate12](https://discuss.elastic.co/u/newkate12)\ **Replies:** 1\ **Last updated:** [October 24, 2019, 5:27pm UTC](https://discuss.elastic.co/t/scatter-plot-with-multiple-y-values-for-each-x-using-vega/205014 "2019-10-24T17:27:00Z")
Hi I have a question visualizing multiple y values for each x in vega. In case of simple x,y data like this (one data per one timestamp) timestamp tag\_value 2019-10-24 10:00:00 10.9 2019-10-24 10:0:01 11.0 … --- ## [How rollup jobs memorize last processed document?](https://discuss.elastic.co/t/how-rollup-jobs-memorize-last-processed-document/204595)
**Author:** [@isharamadhawa](https://discuss.elastic.co/u/isharamadhawa)\ **Replies:** 3\ **Last updated:** [October 24, 2019, 5:10pm UTC](https://discuss.elastic.co/t/how-rollup-jobs-memorize-last-processed-document/204595 "2019-10-24T17:10:04Z")
I went through my rollup job JSON file and I think current\_position in below config is the way how a rollup job memorizes the last document it processed. "status": { "job\_state": "started", "current\_position": {… --- ## [Kibana query with widcard index pattern is giving timeout](https://discuss.elastic.co/t/kibana-query-with-widcard-index-pattern-is-giving-timeout/205005)
**Author:** [@srikarnaramsetty](https://discuss.elastic.co/u/srikarnaramsetty)\ **Replies:** 1\ **Last updated:** [October 24, 2019, 5:08pm UTC](https://discuss.elastic.co/t/kibana-query-with-widcard-index-pattern-is-giving-timeout/205005 "2019-10-24T17:08:09Z")
I have daily indices in elastic search(alerts-2019.10.22). For Kibana I have configured to use an wildcard index pattern(alerts-\*) to search over all the indices. When the data grows over 3 months(\>90 indices), Kibana qu… --- ## [Logstash Filter - creating list from multiple events](https://discuss.elastic.co/t/logstash-filter-creating-list-from-multiple-events/204561)
**Author:** [@krishna\_bhargav](https://discuss.elastic.co/u/krishna_bhargav)\ **Replies:** 3\ **Last updated:** [October 24, 2019, 5:04pm UTC](https://discuss.elastic.co/t/logstash-filter-creating-list-from-multiple-events/204561 "2019-10-24T17:04:41Z")
I am working on below schema, grouping multiple households based on the keyinformation. We could achieve this with the logstash aggregate filter. But this is having performance issue and also cannot run with multiple thr… --- ## [REST API using http\_poller](https://discuss.elastic.co/t/rest-api-using-http-poller/205107)
**Author:** [@akhilsharma.in](https://discuss.elastic.co/u/akhilsharma.in)\ **Replies:** 3\ **Last updated:** [October 24, 2019, 5:01pm UTC](https://discuss.elastic.co/t/rest-api-using-http-poller/205107 "2019-10-24T17:01:19Z")
We have to implement REST API using http\_poller if it is possible. It has two calls. 1st POST creates a token which has to be used by 2nd REST GET. Can I pass the output token of 1st call to the input of other http\_pol… --- ## [Logstash - Creating multiple pipelines for beats inputs on same port](https://discuss.elastic.co/t/logstash-creating-multiple-pipelines-for-beats-inputs-on-same-port/204562)
**Author:** [@krishna\_bhargav](https://discuss.elastic.co/u/krishna_bhargav)\ **Replies:** 2\ **Last updated:** [October 24, 2019, 4:43pm UTC](https://discuss.elastic.co/t/logstash-creating-multiple-pipelines-for-beats-inputs-on-same-port/204562 "2019-10-24T16:43:43Z")
Am trying to create multiple pipelines beatsPipeline1 and beatsPipeline2 in logstash listening to beats events from same port but getting error saying address in use for second pipeline: pipeline.id: beatsPipeline1 pa… --- ## [Split XML](https://discuss.elastic.co/t/split-xml/204949)
**Author:** [@Jim\_Thunder](https://discuss.elastic.co/u/Jim_Thunder)\ **Replies:** 12\ **Last updated:** [October 24, 2019, 4:14pm UTC](https://discuss.elastic.co/t/split-xml/204949 "2019-10-24T16:14:44Z")
I have an XML doc being sent to a logstash server/ELK server. This is the portion of the xml I'm trying to work with: \\\ \\\OMXEOC0\\\\\\100\\\\\\00E4\\\ \\\ \\\ **Author:** [@Rajiv](https://discuss.elastic.co/u/Rajiv)\ **Replies:** 1\ **Last updated:** [October 24, 2019, 4:05pm UTC](https://discuss.elastic.co/t/how-to-update-max-snapshot-bytes-per-sec-setting-for-an-existing-repository/204797 "2019-10-24T16:05:17Z") Hello: Is there a way to update the max\_snapshot\_bytes\_per\_sec setting on a repository without deleting and recreating it? We have an S3 repo configured with a bunch of snapshots. As the daily data volume has grown the… --- ## [Skewed shards on index even with enough disk space in all physical nodes](https://discuss.elastic.co/t/skewed-shards-on-index-even-with-enough-disk-space-in-all-physical-nodes/204974)
**Author:** [@viniciof](https://discuss.elastic.co/u/viniciof)\ **Replies:** 3\ **Last updated:** [October 24, 2019, 3:48pm UTC](https://discuss.elastic.co/t/skewed-shards-on-index-even-with-enough-disk-space-in-all-physical-nodes/204974 "2019-10-24T15:48:43Z")
Hi everyone, I have an index (shown below) which is not evenly distributed accross my 10 data nodes cluster. Each node in the cluster has at least 1.1 TB free, only the one called arm-lc-004 has ~700GB free only bu… --- ## [No Logstash menu in Kibana UI](https://discuss.elastic.co/t/no-logstash-menu-in-kibana-ui/205094)
**Author:** [@Devopsio](https://discuss.elastic.co/u/Devopsio)\ **Replies:** 1\ **Last updated:** [October 24, 2019, 3:38pm UTC](https://discuss.elastic.co/t/no-logstash-menu-in-kibana-ui/205094 "2019-10-24T15:38:09Z")
I have an entire ELK stack in docker compose but only Kibana and Elasticsearch are shown. Logs show no errors and it seems, that Logstash communicates with the rest of stack. Here's my logstash.yml: xpack.monitoring.ela… --- ## [Does read-only index option really affect the performace?](https://discuss.elastic.co/t/does-read-only-index-option-really-affect-the-performace/205081)
**Author:** [@boubakr](https://discuss.elastic.co/u/boubakr)\ **Replies:** 1\ **Last updated:** [October 24, 2019, 3:32pm UTC](https://discuss.elastic.co/t/does-read-only-index-option-really-affect-the-performace/205081 "2019-10-24T15:32:58Z")
Does read-only option really affect the performace? If yes, how? If not why? My scenario is this: I've daily indexes with lots of documets (from 5/10 to 100 GB per day, it depens). If each day I make the indexes of yes… --- ## [Logstash HA](https://discuss.elastic.co/t/logstash-ha/205112)
**Author:** [@dmoronta](https://discuss.elastic.co/u/dmoronta)\ **Replies:** 0\ **Last updated:** [October 24, 2019, 3:27pm UTC](https://discuss.elastic.co/t/logstash-ha/205112 "2019-10-24T15:27:37Z")
Hi all, please can someone tell me if is possible made a logstash HA solution? I can't use a third party load balancer. The logstash input is a very critical procces to me, so I am thinking in a kind of vip between two … --- ## [Logstash Filter for Specific Winlogs Value](https://discuss.elastic.co/t/logstash-filter-for-specific-winlogs-value/204962)
**Author:** [@uklipse](https://discuss.elastic.co/u/uklipse)\ **Replies:** 3\ **Last updated:** [October 24, 2019, 3:21pm UTC](https://discuss.elastic.co/t/logstash-filter-for-specific-winlogs-value/204962 "2019-10-24T15:21:34Z")
I'm trying to filter out some specific values for the Windows event id 4663. We have one computer that generates 99% of these events and we want to filter that out. Below is what I have but it's not working. The add\_tag … --- ## [Logstash create geo\_point](https://discuss.elastic.co/t/logstash-create-geo-point/205111)
**Author:** [@haythem](https://discuss.elastic.co/u/haythem)\ **Replies:** 0\ **Last updated:** [October 24, 2019, 3:16pm UTC](https://discuss.elastic.co/t/logstash-create-geo-point/205111 "2019-10-24T15:16:47Z")
hello guys , i'm having a problem when i insert a geopoint in elasticsearch,so i've created an index using this command PUT my\_index then i've created a geo point field in the created index using this command and then … --- ## [Logsatsh geopoint](https://discuss.elastic.co/t/logsatsh-geopoint/205090)
**Author:** [@haythem](https://discuss.elastic.co/u/haythem)\ **Replies:** 3\ **Last updated:** [October 24, 2019, 3:15pm UTC](https://discuss.elastic.co/t/logsatsh-geopoint/205090 "2019-10-24T15:15:12Z")
Hi guys , so i'm working on a project now when i have to load data from oracle database and convert two columns(longitude,latitude) to a geo\_point , so i've created an index in elasticsearch and i created a geo\_point map… --- ## [Enabling fips - ES 6.8](https://discuss.elastic.co/t/enabling-fips-es-6-8/204906)
**Author:** [@S\_Chase](https://discuss.elastic.co/u/S_Chase)\ **Replies:** 2\ **Last updated:** [October 24, 2019, 3:10pm UTC](https://discuss.elastic.co/t/enabling-fips-es-6-8/204906 "2019-10-24T15:10:14Z")
The ES docs for FIPS 140.2 compliance refers to making changes to the hashing methods. Those docs state. You must set the cache.hash\_algo realm settings and the xpack.security.authc.password\_hashing.algorithm setting t… --- ## [Bulk ingest of netflow and zeek logs into Elastic SIEM](https://discuss.elastic.co/t/bulk-ingest-of-netflow-and-zeek-logs-into-elastic-siem/204746)
**Author:** [@cks](https://discuss.elastic.co/u/cks)\ **Replies:** 1\ **Last updated:** [October 24, 2019, 3:07pm UTC](https://discuss.elastic.co/t/bulk-ingest-of-netflow-and-zeek-logs-into-elastic-siem/204746 "2019-10-24T15:07:17Z")
What would be best way to bulk ingest netflow and zeek logs into Elasticsearch, which I would like to access in SIEM in Kibana? I am looking to ingest several TBs of logs. I plan to bulk ingest other pcap, auth logs an… --- ## [Having two custom metrics for visualizations to sort by](https://discuss.elastic.co/t/having-two-custom-metrics-for-visualizations-to-sort-by/204928)
**Author:** [@planetracer](https://discuss.elastic.co/u/planetracer)\ **Replies:** 1\ **Last updated:** [October 24, 2019, 2:59pm UTC](https://discuss.elastic.co/t/having-two-custom-metrics-for-visualizations-to-sort-by/204928 "2019-10-24T14:59:37Z")
Is it possible to sort visualizations based on two different metrics? For example, if I have a duration field and a buildnumber field, and I wanted to sort the data from highest to lowest duration from lowest to highest … --- ## [Logstash Grok Filter failure with match](https://discuss.elastic.co/t/logstash-grok-filter-failure-with-match/204616)
**Author:** [@fuXz](https://discuss.elastic.co/u/fuXz)\ **Replies:** 5\ **Last updated:** [October 24, 2019, 2:55pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-failure-with-match/204616 "2019-10-24T14:55:41Z")
Unfortunately I'm stuck with some Logstash basics. I want to use Logstash to get logs from a Sophos UTM and do something with the data. I already tried different things from the documentation, only with little success ta… --- ## [Proxy\_url on Logstash with x-pack](https://discuss.elastic.co/t/proxy-url-on-logstash-with-x-pack/205101)
**Author:** [@hardwarehacker](https://discuss.elastic.co/u/hardwarehacker)\ **Replies:** 0\ **Last updated:** [October 24, 2019, 2:54pm UTC](https://discuss.elastic.co/t/proxy-url-on-logstash-with-x-pack/205101 "2019-10-24T14:54:59Z")
My Logstash is running behind a proxy server with all the logs successfully delivered to Elasticsearch Cloud. Now I'm trying to enable x-pack on logstash and looks like xpack is not following my proxy. Besides that I can… --- ## [Error startup with error SECCOMP\_SET\_MODE\_FILTER](https://discuss.elastic.co/t/error-startup-with-error-seccomp-set-mode-filter/205099)
**Author:** [@xujohn](https://discuss.elastic.co/u/xujohn)\ **Replies:** 0\ **Last updated:** [October 24, 2019, 2:47pm UTC](https://discuss.elastic.co/t/error-startup-with-error-seccomp-set-mode-filter/205099 "2019-10-24T14:47:38Z")
When I start elasticsearch data nodes, it shows: \[DEBUG\]\[o.e.b.SystemCallFilter \] \[www.company.com\] seccomp(SECCOMP\_SET\_MODE\_FILTER): Function not implemented, falling back to prctl(PR\_SET\_SECCOMP)... And the process… --- ## [Nginx useragent mapper\_parsing\_exception](https://discuss.elastic.co/t/nginx-useragent-mapper-parsing-exception/205089)
**Author:** [@stevesimpson](https://discuss.elastic.co/u/stevesimpson)\ **Replies:** 2\ **Last updated:** [October 24, 2019, 2:40pm UTC](https://discuss.elastic.co/t/nginx-useragent-mapper-parsing-exception/205089 "2019-10-24T14:40:02Z")
Hi, I'm having a bit of trouble understanding why I'm getting the below errors when trying to Index Nginx access logs. \[2019-10-24T12:52:56,876\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index event to Elasticse… --- ## [Endpoint Introductions](https://discuss.elastic.co/t/endpoint-introductions/205093)
**Author:** [@Wadson](https://discuss.elastic.co/u/Wadson)\ **Replies:** 0\ **Last updated:** [October 24, 2019, 2:36pm UTC](https://discuss.elastic.co/t/endpoint-introductions/205093 "2019-10-24T14:36:53Z")
Welcome to Elastic Endpoint! I'm Wadson and I am on the Endpoint Implementation team here at Elastic on the East Coast. If you're new to Elastic Endpoint or have already purchased Endpoint please introduce yourself her… --- ## [Size limit in a query?](https://discuss.elastic.co/t/size-limit-in-a-query/204851)
**Author:** [@roy\_einhorn](https://discuss.elastic.co/u/roy_einhorn)\ **Replies:** 6\ **Last updated:** [October 24, 2019, 2:34pm UTC](https://discuss.elastic.co/t/size-limit-in-a-query/204851 "2019-10-24T14:34:33Z")
hi all , today i did a query in the dev tools in the visualize system, of course that the system gave me an error , when i try to make the same get request in the postman - i get great results , is there a size limit in … --- ## [Can not remove hits.hits.sort field from response of /\_search request with sort](https://discuss.elastic.co/t/can-not-remove-hits-hits-sort-field-from-response-of-search-request-with-sort/204992)
**Author:** [@muziyoshiz](https://discuss.elastic.co/u/muziyoshiz)\ **Replies:** 3\ **Last updated:** [October 24, 2019, 2:34pm UTC](https://discuss.elastic.co/t/can-not-remove-hits-hits-sort-field-from-response-of-search-request-with-sort/204992 "2019-10-24T14:34:27Z")
Hello Elasticsearch Team, In our use case, we want to get only document IDs of the matched documents as a result of search API /\_search. But when I call search API with a query including "sort" field, the response cont… --- ## [Create new field from existing field using REGEX](https://discuss.elastic.co/t/create-new-field-from-existing-field-using-regex/204709)
**Author:** [@Marta\_Zagrajek](https://discuss.elastic.co/u/Marta_Zagrajek)\ **Replies:** 3\ **Last updated:** [October 24, 2019, 2:19pm UTC](https://discuss.elastic.co/t/create-new-field-from-existing-field-using-regex/204709 "2019-10-24T14:19:46Z")
I have grok like that from apache logs: grok { match =\> { "message" =\> '%{IP:ip}\\s(%{GREEDYDATA:logname})?\\s(%{GREEDYDATA:remote\_user})?\\s\[%{HTTPDATE:timestamp}\]\\s"%{WORD:metoda}\\s%{NOTSPACE:request}\\s(HTTP/%{NUMBER:… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1818) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1820)