# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1847 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1848 --- ## [Heap settings](https://discuss.elastic.co/t/heap-settings/203113)
**Author:** [@SirJune](https://discuss.elastic.co/u/SirJune)\ **Replies:** 1\ **Last updated:** [October 11, 2019, 3:02am UTC](https://discuss.elastic.co/t/heap-settings/203113 "2019-10-11T03:02:19Z")
My servers have 188GB RAM. I initially set heap to 16GB -Xms16g -Xmx16g Logs is showing: \[host04\] heap size \[15.8gb\], compressed ordinary object pointers \[true\] and Heap address: 0x0000000400000000, size: 16384 M… --- ## [What determines the size of SSD cache to install?](https://discuss.elastic.co/t/what-determines-the-size-of-ssd-cache-to-install/203129)
**Author:** [@neergttocsdivad](https://discuss.elastic.co/u/neergttocsdivad)\ **Replies:** 5\ **Last updated:** [October 11, 2019, 2:59am UTC](https://discuss.elastic.co/t/what-determines-the-size-of-ssd-cache-to-install/203129 "2019-10-11T02:59:30Z")
I am running ES on a Synology NAS VM. My data and indexes are also stored on the same NAS (same volume). Bays in the NAS may be allocated to filesystem cache. "Elasticsearch heavily relies on the filesystem cache in o… --- ## [\_grokparsefailure help](https://discuss.elastic.co/t/grokparsefailure-help/203124)
**Author:** [@TechGeekNZ](https://discuss.elastic.co/u/TechGeekNZ)\ **Replies:** 1\ **Last updated:** [October 11, 2019, 2:43am UTC](https://discuss.elastic.co/t/grokparsefailure-help/203124 "2019-10-11T02:43:49Z")
Hi all, Seem to be having trouble getting some of my logs into logstash. Have been able to sucessfully work through most of my logs, but this last one is giving me grief. Example line from logfile; 2019-10-01 22:25:54… --- ## [Elastic filter not executing query? Bool etc. supported?](https://discuss.elastic.co/t/elastic-filter-not-executing-query-bool-etc-supported/202948)
**Author:** [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Replies:** 2\ **Last updated:** [October 11, 2019, 2:17am UTC](https://discuss.elastic.co/t/elastic-filter-not-executing-query-bool-etc-supported/202948 "2019-10-11T02:17:28Z")
Hi, I'm trying to use the elastic filter to get some data from a index. However the elastic filter doesn't appear to be doing anything. When starting logstash I see New ElasticSearch filter client {:hosts=\>\["https://.ur… --- ## [Elasticsearch alphanumeric range search](https://discuss.elastic.co/t/elasticsearch-alphanumeric-range-search/200620)
**Author:** [@Anurup\_Borah](https://discuss.elastic.co/u/Anurup_Borah)\ **Replies:** 10\ **Last updated:** [October 11, 2019, 1:55am UTC](https://discuss.elastic.co/t/elasticsearch-alphanumeric-range-search/200620 "2019-10-11T01:55:07Z")
Hi , I need some suggestion on how to search for any alphanumeric range search if its possible in elasticsearch. I have gone through the below link , I am not able to find any solution for alphanumeric search. https:/… --- ## [How to have tsvb Gauge visualization showing the last value](https://discuss.elastic.co/t/how-to-have-tsvb-gauge-visualization-showing-the-last-value/203115)
**Author:** [@ferenc0521](https://discuss.elastic.co/u/ferenc0521)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 9:34pm UTC](https://discuss.elastic.co/t/how-to-have-tsvb-gauge-visualization-showing-the-last-value/203115 "2019-10-10T21:34:51Z")
When dashboarding netdata host metrics , using tsvb line graps, I can have the avg by 30s graphed which is more or less the last value I'm interested in. (netdata samples 3000 metrics every sec, logstash http poller sam… --- ## [ElasticSearch Crashes after Grok test in Kibana 7.4.0](https://discuss.elastic.co/t/elasticsearch-crashes-after-grok-test-in-kibana-7-4-0/203123)
**Author:** [@Nicholas\_Penning](https://discuss.elastic.co/u/Nicholas_Penning)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 10:56pm UTC](https://discuss.elastic.co/t/elasticsearch-crashes-after-grok-test-in-kibana-7-4-0/203123 "2019-10-10T22:56:05Z")
Playing around in our test cluster I think I may have uncovered an odd bug. I was testing some Grok expressions in Kibana Dev Tools and was able to crash a 3 node cluster with a simple pattern test. Can anyone else vali… --- ## [Can I use post\_filter with top\_hits?](https://discuss.elastic.co/t/can-i-use-post-filter-with-top-hits/203127)
**Author:** [@Arnab\_Banerjee](https://discuss.elastic.co/u/Arnab_Banerjee)\ **Replies:** 0\ **Last updated:** [October 11, 2019, 12:06am UTC](https://discuss.elastic.co/t/can-i-use-post-filter-with-top-hits/203127 "2019-10-11T00:06:41Z")
Hi, I am using top\_hits aggregation with sort aggregation and want to filter out some of the top\_hits based on a term. Can I use post filter to do that? If now how to use filter aggregation with top hits? So I've paste… --- ## [Grok unable to handle symbol](https://discuss.elastic.co/t/grok-unable-to-handle-symbol/203111)
**Author:** [@Senthil\_ak](https://discuss.elastic.co/u/Senthil_ak)\ **Replies:** 5\ **Last updated:** [October 10, 2019, 10:50pm UTC](https://discuss.elastic.co/t/grok-unable-to-handle-symbol/203111 "2019-10-10T22:50:32Z")
Hi Admin, I have a grok pattern from nginx which is working perfectly when the data is coming. grok { match =\> { "message" =\> '%{DATA:clientip} %{DATA:VirtualHost} %{DATA:User} \\\[%{HTTPDATE:timestamp}\\\] %{DATA:nginx.… --- ## [Using a missing aggregation for a Term, as opposed to a field](https://discuss.elastic.co/t/using-a-missing-aggregation-for-a-term-as-opposed-to-a-field/203118)
**Author:** [@ad\_rip](https://discuss.elastic.co/u/ad_rip)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 10:04pm UTC](https://discuss.elastic.co/t/using-a-missing-aggregation-for-a-term-as-opposed-to-a-field/203118 "2019-10-10T22:04:34Z")
Hi all, I'm hoping this is the right place to ask this. I'm trying to get an aggregation of the items that don't contain a specific field. They're items with a nested field, as follow: "customFields": … --- ## [Elastic Operator Juju Charm](https://discuss.elastic.co/t/elastic-operator-juju-charm/203117)
**Author:** [@jamesbeedy](https://discuss.elastic.co/u/jamesbeedy)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 9:59pm UTC](https://discuss.elastic.co/t/elastic-operator-juju-charm/203117 "2019-10-10T21:59:25Z")
Hello, I want to introduce the lifecycle ops we are building around ECK using Juju charms. elastic-operator charm home page discourse post explaining the elastic-operator charm and modeling custom objects via Juju lay… --- ## [Curl response giving "missing authentication token for REST request" despite xpack.security.enabled: false in config file](https://discuss.elastic.co/t/curl-response-giving-missing-authentication-token-for-rest-request-despite-xpack-security-enabled-false-in-config-file/202925)
**Author:** [@lschmid](https://discuss.elastic.co/u/lschmid)\ **Replies:** 3\ **Last updated:** [October 10, 2019, 9:21pm UTC](https://discuss.elastic.co/t/curl-response-giving-missing-authentication-token-for-rest-request-despite-xpack-security-enabled-false-in-config-file/202925 "2019-10-10T21:21:08Z")
I installed xpack on an elasticsearch instance, and now the output from any curl is: { "error" : { "root\_cause" : \[ { "type" : "security\_exception", "reason" : "missing authentication token for REST request \[/?pret… --- ## [Cloudwatch vs Cloudwatch Logs input plugins](https://discuss.elastic.co/t/cloudwatch-vs-cloudwatch-logs-input-plugins/203112)
**Author:** [@EZprogramming](https://discuss.elastic.co/u/EZprogramming)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 9:02pm UTC](https://discuss.elastic.co/t/cloudwatch-vs-cloudwatch-logs-input-plugins/203112 "2019-10-10T21:02:54Z")
Hi everyone, what is the difference between cloudwatch Logstash input plugin vs cloudwatch\_logs input plugin written by Lukewaite (Link)? My assumption is that the official cloudwatch input plugin is to scan and pull m… --- ## [When using Index Life Cycle Management, how to limit queries to hot indexes](https://discuss.elastic.co/t/when-using-index-life-cycle-management-how-to-limit-queries-to-hot-indexes/202088)
**Author:** [@seperman](https://discuss.elastic.co/u/seperman)\ **Replies:** 5\ **Last updated:** [October 10, 2019, 8:54pm UTC](https://discuss.elastic.co/t/when-using-index-life-cycle-management-how-to-limit-queries-to-hot-indexes/202088 "2019-10-10T20:54:50Z")
Hello, I'm using ILM to divide my time series data into hot, warm, cold indexes. The hot indexes use more expensive hardware. Warm is read-only and force-merged. And cold is frozen and contains data older than 60 days. … --- ## [How do you tag by multiple source IPs?](https://discuss.elastic.co/t/how-do-you-tag-by-multiple-source-ips/202917)
**Author:** [@meatwad](https://discuss.elastic.co/u/meatwad)\ **Replies:** 7\ **Last updated:** [October 10, 2019, 8:53pm UTC](https://discuss.elastic.co/t/how-do-you-tag-by-multiple-source-ips/202917 "2019-10-10T20:53:26Z")
Hi, I'm transitioning to logstash from an rsyslog config that ingests logs from a list of network devices (routers, switches, firewalls), then does something based on the source IP. Here's an abbreviated example: if … --- ## [Need help with filter for Visualization](https://discuss.elastic.co/t/need-help-with-filter-for-visualization/203104)
**Author:** [@calvinAtSelerity](https://discuss.elastic.co/u/calvinAtSelerity)\ **Replies:** 2\ **Last updated:** [October 10, 2019, 8:51pm UTC](https://discuss.elastic.co/t/need-help-with-filter-for-visualization/203104 "2019-10-10T20:51:16Z")
When I try to use the following query for Filter in Visualize, I am getting the following error. Request to Elasticsearch failed: {"error":{"root\_cause":\[{"type":"query\_shard\_exception","reason":"Failed to parse query \[… --- ## [Elasticsearch and Portworx](https://discuss.elastic.co/t/elasticsearch-and-portworx/201312)
**Author:** [@Nathan\_Julsrud](https://discuss.elastic.co/u/Nathan_Julsrud)\ **Replies:** 6\ **Last updated:** [October 10, 2019, 8:46pm UTC](https://discuss.elastic.co/t/elasticsearch-and-portworx/201312 "2019-10-10T20:46:43Z")
Hi All, Has anybody had success with using these two technologies together? We are running ES in a docker container, orchestrated by Hashicorp Nomad, and have successfully instantiated ES using portworx volumes. The … --- ## [Geo\_point and geohash in logstash](https://discuss.elastic.co/t/geo-point-and-geohash-in-logstash/202880)
**Author:** [@rohitg](https://discuss.elastic.co/u/rohitg)\ **Replies:** 13\ **Last updated:** [October 10, 2019, 8:28pm UTC](https://discuss.elastic.co/t/geo-point-and-geohash-in-logstash/202880 "2019-10-10T20:28:07Z")
Hi, I am trying to use coordinate maps in kibana for my visualization. I mutate my longitude and latitude fields with rename and convert to float, but when i tried in Kibana, it showing no compactible field geo\_point. … --- ## [Unable to parse nested JSON using logstash](https://discuss.elastic.co/t/unable-to-parse-nested-json-using-logstash/202906)
**Author:** [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Replies:** 9\ **Last updated:** [October 10, 2019, 8:09pm UTC](https://discuss.elastic.co/t/unable-to-parse-nested-json-using-logstash/202906 "2019-10-10T20:09:00Z")
Nested JSON response - { "application": "FinClient", "occurredOn": "2019-10-07T10:38:39", "host": "U8HPP213", "finEvents": \[ { "@xmlns": "http://jabber.org/protocol/pubsub", "data": { "apiErrors": { "apiError":… --- ## [Default value of Minimum should match in should clause](https://discuss.elastic.co/t/default-value-of-minimum-should-match-in-should-clause/202924)
**Author:** [@Seetha93](https://discuss.elastic.co/u/Seetha93)\ **Replies:** 2\ **Last updated:** [October 10, 2019, 7:55pm UTC](https://discuss.elastic.co/t/default-value-of-minimum-should-match-in-should-clause/202924 "2019-10-10T19:55:45Z")
Do we need to explicitly set minimum\_should\_match: 1, for bool query with only should clause? --- ## [How to split xml into different events](https://discuss.elastic.co/t/how-to-split-xml-into-different-events/203039)
**Author:** [@griffer98](https://discuss.elastic.co/u/griffer98)\ **Replies:** 2\ **Last updated:** [October 10, 2019, 7:10pm UTC](https://discuss.elastic.co/t/how-to-split-xml-into-different-events/203039 "2019-10-10T19:10:47Z")
I am trying to take certain parts of an xml document and split it into different events that I can look at separately in Kibana. Here is a sample xml document here. \ \ \some company\ **Author:** [@akalra](https://discuss.elastic.co/u/akalra)\ **Replies:** 4\ **Last updated:** [October 10, 2019, 7:07pm UTC](https://discuss.elastic.co/t/following-steps-for-setting-up-infrastructure-monitoring-app-does-not-work/202914 "2019-10-10T19:07:47Z") I am setting up the infrastructure monitoring for a Kubernetes cluster on GCP. I am using a hosted Elastic cloud. I followed the steps for setting up Metricbeat on kubernetes as stated online but the Infrastructure app o… --- ## [Unable to add index for parsed data from elastic search index management](https://discuss.elastic.co/t/unable-to-add-index-for-parsed-data-from-elastic-search-index-management/203005)
**Author:** [@mduduzi](https://discuss.elastic.co/u/mduduzi)\ **Replies:** 1\ **Last updated:** [October 10, 2019, 7:01pm UTC](https://discuss.elastic.co/t/unable-to-add-index-for-parsed-data-from-elastic-search-index-management/203005 "2019-10-10T19:01:04Z")
I'm new in the ELK system building and configuration and have a few challenges. I am unable to add index for parsed data from elastic search index management. I however can see the the parsed data from Kibana index patt… --- ## [Listing all files in S3 everytime new file is added](https://discuss.elastic.co/t/listing-all-files-in-s3-everytime-new-file-is-added/203102)
**Author:** [@user2416](https://discuss.elastic.co/u/user2416)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 6:57pm UTC](https://discuss.elastic.co/t/listing-all-files-in-s3-everytime-new-file-is-added/203102 "2019-10-10T18:57:58Z")
Hi, We are using logstash to read logs from S3, we have millions of files in S3 bucket for Cloudtrail logs. When a new file is added, logstash is listing all files first and then reading the logs from new file, its taki… --- ## [Elevate your ELK Stack skills with Elastic’s new flexible annual training subscriptions](https://discuss.elastic.co/t/elevate-your-elk-stack-skills-with-elastic-s-new-flexible-annual-training-subscriptions/203098)
**Author:** [@elyssaemrich](https://discuss.elastic.co/u/elyssaemrich)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 6:40pm UTC](https://discuss.elastic.co/t/elevate-your-elk-stack-skills-with-elastic-s-new-flexible-annual-training-subscriptions/203098 "2019-10-10T18:40:23Z")
New Annual Training Subscriptions Released :woman\_student: Elastic just launched three new Annual Training Subscriptions, giving you the flexibility to learn on your own or with guidance from our team. All subscriptions… --- ## [Date filter - how to parse separately grokked DATE and TIME](https://discuss.elastic.co/t/date-filter-how-to-parse-separately-grokked-date-and-time/202712)
**Author:** [@kmiklas](https://discuss.elastic.co/u/kmiklas)\ **Replies:** 2\ **Last updated:** [October 10, 2019, 6:32pm UTC](https://discuss.elastic.co/t/date-filter-how-to-parse-separately-grokked-date-and-time/202712 "2019-10-10T18:32:11Z")
Hello All, I have separately grokked DATE and TIME fields from a comma-separated string. I now wish to filter them from two string into a date/time format with the Logstash date filter plugin. I'm struggling with the … --- ## [Offline backup](https://discuss.elastic.co/t/offline-backup/203069)
**Author:** [@SirJune](https://discuss.elastic.co/u/SirJune)\ **Replies:** 4\ **Last updated:** [October 10, 2019, 6:27pm UTC](https://discuss.elastic.co/t/offline-backup/203069 "2019-10-10T18:27:33Z")
i would like to do an offline backup of nodes. Say, i stop elasticsearch on all nodes, rsync /data/elasticsearch/nodes/ to a remote NFS server. would i get the same data(indices, visualization,etc) if i rsync from… --- ## [Accepting late events after force-merge](https://discuss.elastic.co/t/accepting-late-events-after-force-merge/203034)
**Author:** [@amitavmohanty01](https://discuss.elastic.co/u/amitavmohanty01)\ **Replies:** 4\ **Last updated:** [October 10, 2019, 6:02pm UTC](https://discuss.elastic.co/t/accepting-late-events-after-force-merge/203034 "2019-10-10T18:02:01Z")
As mentioned in docs, when we define force-merge as part of an ILM policy, it also makes the index read-only. I want to force-merge an index to compact it and get some size benefit but I don't want to make it read-only. … --- ## [Kibana missing functionality question](https://discuss.elastic.co/t/kibana-missing-functionality-question/203067)
**Author:** [@jms2019](https://discuss.elastic.co/u/jms2019)\ **Replies:** 1\ **Last updated:** [October 10, 2019, 5:56pm UTC](https://discuss.elastic.co/t/kibana-missing-functionality-question/203067 "2019-10-10T17:56:04Z")
Hi, I'm a newbie to Kibana. My company started using UiPath and it came with Kibana 6.6 for reporting. Below are two features that I'm unable to find when I started using Kibana. So my question is are these features … --- ## [How to modify output codec for logstash](https://discuss.elastic.co/t/how-to-modify-output-codec-for-logstash/201296)
**Author:** [@shazbot](https://discuss.elastic.co/u/shazbot)\ **Replies:** 7\ **Last updated:** [October 10, 2019, 5:53pm UTC](https://discuss.elastic.co/t/how-to-modify-output-codec-for-logstash/201296 "2019-10-10T17:53:45Z")
I'm not expecting a step by step on this. But here is the backstory and what I hope to achieve. I have logstash decoding netflow and putting it out using json\_lines This is working well, but it's very verbose and too … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1846) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1848)