# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1827 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1828 --- ## [Does ECE have user audit trail](https://discuss.elastic.co/t/does-ece-have-user-audit-trail/204435)
**Author:** [@robrotheram](https://discuss.elastic.co/u/robrotheram)\ **Replies:** 7\ **Last updated:** [October 22, 2019, 12:46pm UTC](https://discuss.elastic.co/t/does-ece-have-user-audit-trail/204435 "2019-10-22T12:46:33Z")
Hello, I am experimenting with ECE and I trying to see if the admin console stores a audit trail of user actions. I can see the activity field but there is no user attribute. What I am looking for is something like "Use… --- ## [Boost should query](https://discuss.elastic.co/t/boost-should-query/204546)
**Author:** [@atef](https://discuss.elastic.co/u/atef)\ **Replies:** 1\ **Last updated:** [October 22, 2019, 12:42pm UTC](https://discuss.elastic.co/t/boost-should-query/204546 "2019-10-22T12:42:11Z")
Is there anyone can help me how to boost sould query my example is the following "should": \[ { "multi\_match": { "query": "apple", "fuzziness": "AUTO", "fields": \["name", "name.stemmed"\] }}, { "multi\_match": { "query":… --- ## [Logstash 7.1.0 won't start](https://discuss.elastic.co/t/logstash-7-1-0-wont-start/201695)
**Author:** [@robq](https://discuss.elastic.co/u/robq)\ **Replies:** 1\ **Last updated:** [October 22, 2019, 11:48am UTC](https://discuss.elastic.co/t/logstash-7-1-0-wont-start/201695 "2019-10-22T11:48:29Z")
I had logstash 7.1.0 running on two servers last week, but today systemctl keeps restarting it. I su'd the logstash user to see what it's doing, and when starting it manually, I get this error: \[ERROR\] 2019-09-30 15:25:… --- ## [Replace rsyslog with Filebeat?](https://discuss.elastic.co/t/replace-rsyslog-with-filebeat/204540)
**Author:** [@ajhstn](https://discuss.elastic.co/u/ajhstn)\ **Replies:** 1\ **Last updated:** [October 22, 2019, 11:29am UTC](https://discuss.elastic.co/t/replace-rsyslog-with-filebeat/204540 "2019-10-22T11:29:13Z")
Can Filebeat be used as a simple rsyslog replacement? Can i have 3 udp inputs on 10514, 10515 and 10516, and each of them outputting to ES to 3 different indices? --- ## [Filter on scripted field not working in Kibana UI](https://discuss.elastic.co/t/filter-on-scripted-field-not-working-in-kibana-ui/203823)
**Author:** [@maarten](https://discuss.elastic.co/u/maarten)\ **Replies:** 4\ **Last updated:** [October 22, 2019, 9:55am UTC](https://discuss.elastic.co/t/filter-on-scripted-field-not-working-in-kibana-ui/203823 "2019-10-22T09:55:52Z")
Using version 6.4.2. I have created a dashboard which contains multiple normal fields and scripted fields. On scripted fields, filtering works correctly; Standard filter queries are automatically created: { "query": {… --- ## [Unable to get filename pattern from log.file.path value](https://discuss.elastic.co/t/unable-to-get-filename-pattern-from-log-file-path-value/204541)
**Author:** [@durgaram](https://discuss.elastic.co/u/durgaram)\ **Replies:** 2\ **Last updated:** [October 22, 2019, 9:42am UTC](https://discuss.elastic.co/t/unable-to-get-filename-pattern-from-log-file-path-value/204541 "2019-10-22T09:42:40Z")
Hi The following pattern in logstash conf not extracting the logappname value. grok { match =\> { "log.file.path" =\> "%{GREEDYDATA:logappname}"} } filebeat value is "log.file.path: C:\\Data\\Logs\\Test\_1.log" --- ## [Add links in a vizualization](https://discuss.elastic.co/t/add-links-in-a-vizualization/204411)
**Author:** [@HubertBonisseur](https://discuss.elastic.co/u/HubertBonisseur)\ **Replies:** 3\ **Last updated:** [October 22, 2019, 9:28am UTC](https://discuss.elastic.co/t/add-links-in-a-vizualization/204411 "2019-10-22T09:28:02Z")
Hello, I wish to do a vizualization in this style : radial viz but I want the elements of the viz (the marks) to be a clickable link to a webpage. Is it possible to do so in a kibana vega vizualization ? I heard about … --- ## [Setup Beats with Zeek](https://discuss.elastic.co/t/setup-beats-with-zeek/204478)
**Author:** [@tmans1991](https://discuss.elastic.co/u/tmans1991)\ **Replies:** 1\ **Last updated:** [October 22, 2019, 9:23am UTC](https://discuss.elastic.co/t/setup-beats-with-zeek/204478 "2019-10-22T09:23:05Z")
Hello, I am new to ELK and this is my first project with it. I currently have the following setup: 1 server (CentOS 7) that has zeek installed and logs all trafic it logs the current current day in /op/zeek/spool/log… --- ## [Quickstart Example (v0.8) SSL error](https://discuss.elastic.co/t/quickstart-example-v0-8-ssl-error/183992)
**Author:** [@MooseyMersa](https://discuss.elastic.co/u/MooseyMersa)\ **Replies:** 7\ **Last updated:** [October 22, 2019, 8:48am UTC](https://discuss.elastic.co/t/quickstart-example-v0-8-ssl-error/183992 "2019-10-22T08:48:22Z")
Hi, I've followed the guide https://www.elastic.co/guide/en/cloud-on-k8s/current/index.html and deployed the items described, everything seems to have been correctly created. However when the Elasticsearch logs are insp… --- ## [Beats input ssl problem](https://discuss.elastic.co/t/beats-input-ssl-problem/204606)
**Author:** [@Bartekk](https://discuss.elastic.co/u/Bartekk)\ **Replies:** 0\ **Last updated:** [October 22, 2019, 8:46am UTC](https://discuss.elastic.co/t/beats-input-ssl-problem/204606 "2019-10-22T08:46:20Z")
Info : Ubuntu 18.04 ELK : 7.4.0 OpenSSL : 1.1.1 I just followed the tutorial Configuring SSL, TLS, and HTTPS to secure Elasticsearch, Kibana, Beats, and Logstash | Elastic Blog Connected logstash + kibana + elastic n… --- ## [Alias update](https://discuss.elastic.co/t/alias-update/204481)
**Author:** [@QwerFact](https://discuss.elastic.co/u/QwerFact)\ **Replies:** 2\ **Last updated:** [October 22, 2019, 8:45am UTC](https://discuss.elastic.co/t/alias-update/204481 "2019-10-22T08:45:20Z")
Dear community, I'm looking for a solution to update alias based on time indices. Especially to clear old indices. I have created an indice template: PUT \_template/data { "index\_patterns": \["logs-data-\*"\], "setting… --- ## [Append documents based on a single id from different indexes](https://discuss.elastic.co/t/append-documents-based-on-a-single-id-from-different-indexes/204605)
**Author:** [@Vinothkumar\_Ganeshan](https://discuss.elastic.co/u/Vinothkumar_Ganeshan)\ **Replies:** 0\ **Last updated:** [October 22, 2019, 8:43am UTC](https://discuss.elastic.co/t/append-documents-based-on-a-single-id-from-different-indexes/204605 "2019-10-22T08:43:17Z")
Hello, I'm giving a scenario more than a code to understand more. Index - Shopping: field - product id field - time field - customer id field - event (- Value :Purchase) Index- Cart: field - product id field - ti… --- ## [Elasticsearch find "%40" in email text field](https://discuss.elastic.co/t/elasticsearch-find-40-in-email-text-field/204064)
**Author:** [@christof](https://discuss.elastic.co/u/christof)\ **Replies:** 1\ **Last updated:** [October 22, 2019, 8:38am UTC](https://discuss.elastic.co/t/elasticsearch-find-40-in-email-text-field/204064 "2019-10-22T08:38:38Z")
Hi, I have several emails in our es that have %40 instead of the @ in them (e.g. john%40test.com). I'm trying to search directly for them using the regex search function, but am having issues in identifying for these ca… --- ## [Different results between nest and kibana](https://discuss.elastic.co/t/different-results-between-nest-and-kibana/204251)
**Author:** [@vic2](https://discuss.elastic.co/u/vic2)\ **Replies:** 1\ **Last updated:** [October 22, 2019, 8:28am UTC](https://discuss.elastic.co/t/different-results-between-nest-and-kibana/204251 "2019-10-22T08:28:34Z")
Hi, Here is a nest code: var request=new SearchRequest\ { Aggregations = new AggregationDictionary { { … --- ## [Elasticsearch 6.5 installer is not compatible with Java 11](https://discuss.elastic.co/t/elasticsearch-6-5-installer-is-not-compatible-with-java-11/203898)
**Author:** [@sunnydrall](https://discuss.elastic.co/u/sunnydrall)\ **Replies:** 2\ **Last updated:** [October 22, 2019, 8:19am UTC](https://discuss.elastic.co/t/elasticsearch-6-5-installer-is-not-compatible-with-java-11/203898 "2019-10-22T08:19:47Z")
I installed Java 11 with Elasticsearch 6.5, but they aren't compatible together. The installer says that the installation is completed but the service does not start without any errors or logs. Even when I try to start t… --- ## [Potential issue with bool and nested term](https://discuss.elastic.co/t/potential-issue-with-bool-and-nested-term/204413)
**Author:** [@Spansh](https://discuss.elastic.co/u/Spansh)\ **Replies:** 2\ **Last updated:** [October 22, 2019, 7:58am UTC](https://discuss.elastic.co/t/potential-issue-with-bool-and-nested-term/204413 "2019-10-22T07:58:52Z")
I think I have found an issue with arrays of nested fields and bool matching. I have a nested field which has multiple values where I want to search for records which have multiple values within it. If I search for a s… --- ## [Add 32GB RAM node to cluster with 64GB RAM nodes](https://discuss.elastic.co/t/add-32gb-ram-node-to-cluster-with-64gb-ram-nodes/204600)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 0\ **Last updated:** [October 22, 2019, 7:58am UTC](https://discuss.elastic.co/t/add-32gb-ram-node-to-cluster-with-64gb-ram-nodes/204600 "2019-10-22T07:58:35Z")
I have a cluster of 4 nodes 4cores/64GB RAM and I want to add new 9 nodes 8Cores/32GB RAM. Is it bad idea to have nodes with different performance in the same cluster? Is cluster capable to handle these differencies a… --- ## [Index falling behind after minor version upgrade](https://discuss.elastic.co/t/index-falling-behind-after-minor-version-upgrade/204599)
**Author:** [@JacovanZyl](https://discuss.elastic.co/u/JacovanZyl)\ **Replies:** 0\ **Last updated:** [October 22, 2019, 7:48am UTC](https://discuss.elastic.co/t/index-falling-behind-after-minor-version-upgrade/204599 "2019-10-22T07:48:49Z")
Good morning, I recently updated minor version from 7.3.1 to 7.3.2 and found that my 2 busiest indexes (index rate 7K e/s) are falling behind by 10 to 20 minutes. They were up to date before the upgrade and I was happil… --- ## [Auto-update Logstash on Insert on SQL Server](https://discuss.elastic.co/t/auto-update-logstash-on-insert-on-sql-server/204522)
**Author:** [@sam.cook](https://discuss.elastic.co/u/sam.cook)\ **Replies:** 2\ **Last updated:** [October 22, 2019, 7:40am UTC](https://discuss.elastic.co/t/auto-update-logstash-on-insert-on-sql-server/204522 "2019-10-22T07:40:43Z")
Hi, I am working with Logstash and Elasticsearch but I have a problem. In my case I want Elasticsearch to be updated with the new data added into a SQL Database, all done via Logstash. I set the configuration file as b… --- ## [How to install bulk data into elasticsearch via curl](https://discuss.elastic.co/t/how-to-install-bulk-data-into-elasticsearch-via-curl/204590)
**Author:** [@Sukhen](https://discuss.elastic.co/u/Sukhen)\ **Replies:** 1\ **Last updated:** [October 22, 2019, 7:35am UTC](https://discuss.elastic.co/t/how-to-install-bulk-data-into-elasticsearch-via-curl/204590 "2019-10-22T07:35:35Z")
How to a upload a bulk data to elastic search via curl.. --- ## [Bucket Aggregation Query inside Composite Aggregation giving wrong answer](https://discuss.elastic.co/t/bucket-aggregation-query-inside-composite-aggregation-giving-wrong-answer/204588)
**Author:** [@nitish1402](https://discuss.elastic.co/u/nitish1402)\ **Replies:** 0\ **Last updated:** [October 22, 2019, 7:07am UTC](https://discuss.elastic.co/t/bucket-aggregation-query-inside-composite-aggregation-giving-wrong-answer/204588 "2019-10-22T07:07:37Z")
I am using elastic version 6.2.4 , and my document looks like this \[ { "viewingSessionId": "7484954c-1b4b-40b1-8557-4eccf1515691\_0", "browserType": "Chrome", "programId": "program:703", "sessionStartTi… --- ## [Insert {now-1m/d} failure](https://discuss.elastic.co/t/insert-now-1m-d-failure/204160)
**Author:** [@ajhstn](https://discuss.elastic.co/u/ajhstn)\ **Replies:** 1\ **Last updated:** [October 22, 2019, 6:42am UTC](https://discuss.elastic.co/t/insert-now-1m-d-failure/204160 "2019-10-22T06:42:59Z")
Hello is it possible to insert a document using the current time, like this? PUT /tmp { "mappings": { "properties": { "@timestamp": { "type": "date" } } } } POST tmp/\_doc/1 { "@times… --- ## [Index lifecycle Management: Index Name](https://discuss.elastic.co/t/index-lifecycle-management-index-name/204428)
**Author:** [@ZMMWMY](https://discuss.elastic.co/u/ZMMWMY)\ **Replies:** 6\ **Last updated:** [October 22, 2019, 6:12am UTC](https://discuss.elastic.co/t/index-lifecycle-management-index-name/204428 "2019-10-22T06:12:43Z")
If I want to use the life cycle, then the index is named after the end of 00001? --- ## [Transfer json format data from external service to elasticseach](https://discuss.elastic.co/t/transfer-json-format-data-from-external-service-to-elasticseach/204464)
**Author:** [@namali](https://discuss.elastic.co/u/namali)\ **Replies:** 2\ **Last updated:** [October 22, 2019, 5:54am UTC](https://discuss.elastic.co/t/transfer-json-format-data-from-external-service-to-elasticseach/204464 "2019-10-22T05:54:38Z")
trying to transfer data in json format which in external service to elasticseach. data provide page by page. next page define in previous page how to transfer data from all pages to elasticseach sample json file coun… --- ## [What's the best way to improve performance if thousands of filters?](https://discuss.elastic.co/t/whats-the-best-way-to-improve-performance-if-thousands-of-filters/204250)
**Author:** [@Morriaty](https://discuss.elastic.co/u/Morriaty)\ **Replies:** 6\ **Last updated:** [October 22, 2019, 5:42am UTC](https://discuss.elastic.co/t/whats-the-best-way-to-improve-performance-if-thousands-of-filters/204250 "2019-10-22T05:42:36Z")
The situation is about document level security. A sample document would be like the following { "create\_time": 1500000000, "title": "xxxxxxxxxxxxxxxxxxx", "access\_group": \["g1", "g2716", "… --- ## [Logstash installation on older version](https://discuss.elastic.co/t/logstash-installation-on-older-version/199771)
**Author:** [@skyluke.1987](https://discuss.elastic.co/u/skyluke.1987)\ **Replies:** 4\ **Last updated:** [October 22, 2019, 3:38am UTC](https://discuss.elastic.co/t/logstash-installation-on-older-version/199771 "2019-10-22T03:38:11Z")
Hi how can I install Logstash 7.1.1 on Centos 6.10 ? So far cant get any guide on this. Reason, my other servers are using Kibana and ES version 7.1.1. Thanks --- ## [Encountering "only value lists are allowed in serialized settings" while creating a new index](https://discuss.elastic.co/t/encountering-only-value-lists-are-allowed-in-serialized-settings-while-creating-a-new-index/204467)
**Author:** [@Avhirup\_Chakraborty](https://discuss.elastic.co/u/Avhirup_Chakraborty)\ **Replies:** 2\ **Last updated:** [October 22, 2019, 3:12am UTC](https://discuss.elastic.co/t/encountering-only-value-lists-are-allowed-in-serialized-settings-while-creating-a-new-index/204467 "2019-10-22T03:12:11Z")
Hello all, I am trying to create an index and trying to define mappings for index. My Elasticsearch version is 7.3.2. Below is the code snippet I am trying. PUT dish { "settings": { "index": { "number\_of\_… --- ## [Elasticsearch 7.x and geo\_point Type: can not do it via index\_template mapping?](https://discuss.elastic.co/t/elasticsearch-7-x-and-geo-point-type-can-not-do-it-via-index-template-mapping/204544)
**Author:** [@lrsmith](https://discuss.elastic.co/u/lrsmith)\ **Replies:** 2\ **Last updated:** [October 22, 2019, 2:46am UTC](https://discuss.elastic.co/t/elasticsearch-7-x-and-geo-point-type-can-not-do-it-via-index-template-mapping/204544 "2019-10-22T02:46:16Z")
I have an ES 7.1 cluster running locally. I forward some AWS ELB logs to it, via logstash. I am getting geoip data, but I want to use a Kibana visualization that relies on geo\_point data type. RIght now I get an error in… --- ## [Kibana login page detail "authenticity\_token is not allowed" when enable SAML to login](https://discuss.elastic.co/t/kibana-login-page-detail-authenticity-token-is-not-allowed-when-enable-saml-to-login/203972)
**Author:** [@rambo](https://discuss.elastic.co/u/rambo)\ **Replies:** 6\ **Last updated:** [October 21, 2019, 2:14pm UTC](https://discuss.elastic.co/t/kibana-login-page-detail-authenticity-token-is-not-allowed-when-enable-saml-to-login/203972 "2019-10-21T14:14:02Z")
Hi, I met an error after enable SSO function when I login kibana. The kibana login page detail below error message, I don't know how to fix it. {"statusCode":400,"error":"Bad Request","message":""utf8" is not allowed… --- ## [Is it possible to downgrade a cluster without any data loss?](https://discuss.elastic.co/t/is-it-possible-to-downgrade-a-cluster-without-any-data-loss/203755)
**Author:** [@geethusureshkrishna](https://discuss.elastic.co/u/geethusureshkrishna)\ **Replies:** 10\ **Last updated:** [October 22, 2019, 2:02am UTC](https://discuss.elastic.co/t/is-it-possible-to-downgrade-a-cluster-without-any-data-loss/203755 "2019-10-22T02:02:51Z")
I have an upgraded the Elasticsearch cluster with version 7.3.2 and now I want to downgrade it to the version 6.8.1. Is it possible to make it happen without any data loss? Live data is pushing to the cluster. [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1826) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1828)