# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1861 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1862 --- ## [How to remove filebeat (index/Data) to reclaim space](https://discuss.elastic.co/t/how-to-remove-filebeat-index-data-to-reclaim-space/202032)
**Author:** [@Fosiul\_Alam](https://discuss.elastic.co/u/Fosiul_Alam)\ **Replies:** 0\ **Last updated:** [October 2, 2019, 6:45pm UTC](https://discuss.elastic.co/t/how-to-remove-filebeat-index-data-to-reclaim-space/202032 "2019-10-02T18:45:32Z")
Hi my disk is almost full, i need to clear old data (i.e index or data or indices) what is the best way to do ? Can i just select filebeat-index which are more then 10 old and jsut click on Delete ? will that clear us… --- ## [Conditional statement ignored in output module](https://discuss.elastic.co/t/conditional-statement-ignored-in-output-module/202030)
**Author:** [@erikk](https://discuss.elastic.co/u/erikk)\ **Replies:** 1\ **Last updated:** [October 2, 2019, 6:42pm UTC](https://discuss.elastic.co/t/conditional-statement-ignored-in-output-module/202030 "2019-10-02T18:42:03Z")
I'm having an issues with Logstash 7.2.1 where conditional statements within the output module are being ignored. Example, I made up \[blahblahblah\], so it is empty. output { elasticsearch { id =\> "output\_elastics… --- ## [Visualization of multi-value field with aggregation](https://discuss.elastic.co/t/visualization-of-multi-value-field-with-aggregation/202021)
**Author:** [@elastic25](https://discuss.elastic.co/u/elastic25)\ **Replies:** 4\ **Last updated:** [October 2, 2019, 6:22pm UTC](https://discuss.elastic.co/t/visualization-of-multi-value-field-with-aggregation/202021 "2019-10-02T18:22:19Z")
Newbie to the ELK stack and semi-technical. Our use case is to use the stack to run some analytics for pricing and product data broken down by different multi-value fields. I will start with source data structure and wh… --- ## [INDEX or POSITION of an \_id within the result of a typical search query](https://discuss.elastic.co/t/index-or-position-of-an-id-within-the-result-of-a-typical-search-query/202026)
**Author:** [@hive](https://discuss.elastic.co/u/hive)\ **Replies:** 0\ **Last updated:** [October 2, 2019, 6:10pm UTC](https://discuss.elastic.co/t/index-or-position-of-an-id-within-the-result-of-a-typical-search-query/202026 "2019-10-02T18:10:33Z")
Is there anyway I can find the INDEX or POSITION of an \_id within the result of a typical search query? Requirement is to load the search page in its sorted order and by default load the range that matches a specific \_… --- ## [Mitigate performance impact of Beats](https://discuss.elastic.co/t/mitigate-performance-impact-of-beats/202025)
**Author:** [@kmiklas](https://discuss.elastic.co/u/kmiklas)\ **Replies:** 0\ **Last updated:** [October 2, 2019, 6:03pm UTC](https://discuss.elastic.co/t/mitigate-performance-impact-of-beats/202025 "2019-10-02T18:03:22Z")
Hello All, Any recommendations on how to address performance impact of Beats? For example, imagine a production server named "Cheddar." It is an Ultra-Low Latency server at the NYSE. The powers at be are concerned abo… --- ## ["search\_after" not working](https://discuss.elastic.co/t/search-after-not-working/202024)
**Author:** [@hive](https://discuss.elastic.co/u/hive)\ **Replies:** 0\ **Last updated:** [October 2, 2019, 6:01pm UTC](https://discuss.elastic.co/t/search-after-not-working/202024 "2019-10-02T18:01:37Z")
I am using a Java client to search. I see below request generated with appropriate "search\_after" values and sort columns (i also see result data sorted based on these columns). Response does NOT start with "Greg" as me… --- ## [Help parsing large CSV files](https://discuss.elastic.co/t/help-parsing-large-csv-files/201974)
**Author:** [@megajune](https://discuss.elastic.co/u/megajune)\ **Replies:** 2\ **Last updated:** [October 2, 2019, 5:57pm UTC](https://discuss.elastic.co/t/help-parsing-large-csv-files/201974 "2019-10-02T17:57:56Z")
Hello, I'm trying to write a logstash plugin for Symantec. JSON isn't an option for this product. Here's an example of the log I'm trying to parse. In actual product, this log will have many more fields. SymantecServer… --- ## [Granted documents query with filter by @timestamp](https://discuss.elastic.co/t/granted-documents-query-with-filter-by-timestamp/201834)
**Author:** [@Anton\_Matveev](https://discuss.elastic.co/u/Anton_Matveev)\ **Replies:** 1\ **Last updated:** [October 2, 2019, 5:40pm UTC](https://discuss.elastic.co/t/granted-documents-query-with-filter-by-timestamp/201834 "2019-10-02T17:40:17Z")
I have a similar issue with granted documents query (as https://discuss.elastic.co/t/document-level-security-combining-queries-together/136143) I use following query: { "bool": { "filter": \[ { … --- ## [Troubleshoot logstash. Find dropped events by logs](https://discuss.elastic.co/t/troubleshoot-logstash-find-dropped-events-by-logs/202018)
**Author:** [@smerzlyakov](https://discuss.elastic.co/u/smerzlyakov)\ **Replies:** 0\ **Last updated:** [October 2, 2019, 5:24pm UTC](https://discuss.elastic.co/t/troubleshoot-logstash-find-dropped-events-by-logs/202018 "2019-10-02T17:24:06Z")
Hello! Resently i noticed, that i doesn't get some Windows logs. I use WEF collector - Winlogbeat - Logstash - Elasticsearch. I checked WEF, messages were on it and it was ok, than i check winlogbeat logs - there is no… --- ## [Generating PDF report of dashboards and visualizations](https://discuss.elastic.co/t/generating-pdf-report-of-dashboards-and-visualizations/201758)
**Author:** [@Mitali\_Saxena](https://discuss.elastic.co/u/Mitali_Saxena)\ **Replies:** 3\ **Last updated:** [October 2, 2019, 5:07pm UTC](https://discuss.elastic.co/t/generating-pdf-report-of-dashboards-and-visualizations/201758 "2019-10-02T17:07:01Z")
Hi there, I have been trying to download dashboards as pdf. Opted for PhantomJS and wkhtmltopdf but getting blank page when trying to convert dashboard's iframe to html and then to pdf in kibana. However, these librarie… --- ## [ES site-local addressing scheme](https://discuss.elastic.co/t/es-site-local-addressing-scheme/202007)
**Author:** [@ldenitto](https://discuss.elastic.co/u/ldenitto)\ **Replies:** 1\ **Last updated:** [October 2, 2019, 4:49pm UTC](https://discuss.elastic.co/t/es-site-local-addressing-scheme/202007 "2019-10-02T16:49:20Z")
I'm fairly new to ES and looking forward to implementing it in my environment. When going through the config documentation, I came across this: https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-net… --- ## [S3 bcuket logs ingestion to Elastic search](https://discuss.elastic.co/t/s3-bcuket-logs-ingestion-to-elastic-search/201842)
**Author:** [@sk545](https://discuss.elastic.co/u/sk545)\ **Replies:** 1\ **Last updated:** [October 2, 2019, 4:44pm UTC](https://discuss.elastic.co/t/s3-bcuket-logs-ingestion-to-elastic-search/201842 "2019-10-02T16:44:44Z")
Can i please get list best methods to ingest data from AWS S3 bucket to Elastic search ? shall we use "Functionbeat" to monitor AWS S3 bucket and ship them to Elastic search ? --- ## [Kibana will not take SAML config changes in the User Settings Overrides](https://discuss.elastic.co/t/kibana-will-not-take-saml-config-changes-in-the-user-settings-overrides/202002)
**Author:** [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\ **Replies:** 1\ **Last updated:** [October 2, 2019, 4:29pm UTC](https://discuss.elastic.co/t/kibana-will-not-take-saml-config-changes-in-the-user-settings-overrides/202002 "2019-10-02T16:29:46Z")
I have a deployment that will not take the SAML settings that I'm trying to implement. I have tried to implement the Kibana settings needed to allow SAML access and the changes fail every time. This is occurring on anoth… --- ## [How many kibana spaces are recommended?](https://discuss.elastic.co/t/how-many-kibana-spaces-are-recommended/201815)
**Author:** [@surenraju](https://discuss.elastic.co/u/surenraju)\ **Replies:** 3\ **Last updated:** [October 2, 2019, 3:48pm UTC](https://discuss.elastic.co/t/how-many-kibana-spaces-are-recommended/201815 "2019-10-02T15:48:22Z")
Hi, We run around 200+ microservices. We wanted to create application dashboards from metrics scraped from individual services. We are wondering if we can have 200+ spaces for all micro service team so that microservice … --- ## [Change index mapping with minimal downtime](https://discuss.elastic.co/t/change-index-mapping-with-minimal-downtime/201994)
**Author:** [@MMH](https://discuss.elastic.co/u/MMH)\ **Replies:** 0\ **Last updated:** [October 2, 2019, 3:38pm UTC](https://discuss.elastic.co/t/change-index-mapping-with-minimal-downtime/201994 "2019-10-02T15:38:06Z")
I am using ElasticSearch 6.5. I need to change some mappings in my index. The way I am doing this right now is: Create a new index, with updated mapping. Use Reindex API to move data to new index. Delete an old index. … --- ## [How to configure the jdbc input plugin for mysql](https://discuss.elastic.co/t/how-to-configure-the-jdbc-input-plugin-for-mysql/201991)
**Author:** [@alejandro\_del\_rey](https://discuss.elastic.co/u/alejandro_del_rey)\ **Replies:** 0\ **Last updated:** [October 2, 2019, 3:30pm UTC](https://discuss.elastic.co/t/how-to-configure-the-jdbc-input-plugin-for-mysql/201991 "2019-10-02T15:30:41Z")
HI. I work in windows, and i need use input plugin for mysql, i have this: jdbc { jdbc\_connection\_string =\> "jdbc:mysql://127.0.0.1:3306/ruby" jdbc\_user =\> "ale" jdbc\_password =\> "ale" #DRIVER jdbc\_driver\_library… --- ## [I'm creating a snapshot successfully but when query GET snapshot I don't get a suited response - How come?](https://discuss.elastic.co/t/im-creating-a-snapshot-successfully-but-when-query-get-snapshot-i-dont-get-a-suited-response-how-come/201360)
**Author:** [@Yotam\_Levy](https://discuss.elastic.co/u/Yotam_Levy)\ **Replies:** 3\ **Last updated:** [October 2, 2019, 3:28pm UTC](https://discuss.elastic.co/t/im-creating-a-snapshot-successfully-but-when-query-get-snapshot-i-dont-get-a-suited-response-how-come/201360 "2019-10-02T15:28:28Z")
I get a good response after creating my snapshot, but right after that, I perform a GET to the snapshot I've created and sometimes I get an exception that claims there's no such snapshot in the repository. how can it be… --- ## [Start Elasticsearch as a Service in RHEL with a domain user](https://discuss.elastic.co/t/start-elasticsearch-as-a-service-in-rhel-with-a-domain-user/201990)
**Author:** [@nahiko2000](https://discuss.elastic.co/u/nahiko2000)\ **Replies:** 0\ **Last updated:** [October 2, 2019, 3:25pm UTC](https://discuss.elastic.co/t/start-elasticsearch-as-a-service-in-rhel-with-a-domain-user/201990 "2019-10-02T15:25:12Z")
Hi! We are starting all the stack (Filebeat, Logstash, Elastic and Kibana) with a local user. Can we start these services with a domain user? I mean, right now we have some Filebeats (some in windows, some in RHEL), a… --- ## [Elasticsearch 6.8 in Docker crashing with SIGILL after restart - corrupt state?](https://discuss.elastic.co/t/elasticsearch-6-8-in-docker-crashing-with-sigill-after-restart-corrupt-state/200452)
**Author:** [@retzkek](https://discuss.elastic.co/u/retzkek)\ **Replies:** 1\ **Last updated:** [October 2, 2019, 3:22pm UTC](https://discuss.elastic.co/t/elasticsearch-6-8-in-docker-crashing-with-sigill-after-restart-corrupt-state/200452 "2019-10-02T15:22:10Z")
Somewhat recently we upgraded our cluster to 6.8, and in the process started running elasticsearch in Docker containers, one per host, using the elasticsearch:6.8.0 image from docker hub. Testing and deployment went fine… --- ## [Custom week intervals in date\_histogram aggregations](https://discuss.elastic.co/t/custom-week-intervals-in-date-histogram-aggregations/201961)
**Author:** [@mnv](https://discuss.elastic.co/u/mnv)\ **Replies:** 1\ **Last updated:** [October 2, 2019, 2:52pm UTC](https://discuss.elastic.co/t/custom-week-intervals-in-date-histogram-aggregations/201961 "2019-10-02T14:52:10Z")
Hello! I want create a buckets with date\_histogram with week interval, but I need a week that starts at Thursday and ends on Wednesday from next week: 29.08-04.09, 05.09-11.09, eg. Is that possible in one query? --- ## [How to remove double sign equal](https://discuss.elastic.co/t/how-to-remove-double-sign-equal/201973)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 2\ **Last updated:** [October 2, 2019, 2:49pm UTC](https://discuss.elastic.co/t/how-to-remove-double-sign-equal/201973 "2019-10-02T14:49:56Z")
Hello, I have logs like this : field1=value field2=value somedata==blablafoo field3=value I use kv to parse the logs. I have to remove double sign equal (==) because kv interpet this as a field, but when I use : mut… --- ## [Sebp/elk how to run multiple Elastic Stacks in Docker containers on the same host](https://discuss.elastic.co/t/sebp-elk-how-to-run-multiple-elastic-stacks-in-docker-containers-on-the-same-host/201979)
**Author:** [@kmiklas](https://discuss.elastic.co/u/kmiklas)\ **Replies:** 0\ **Last updated:** [October 2, 2019, 2:48pm UTC](https://discuss.elastic.co/t/sebp-elk-how-to-run-multiple-elastic-stacks-in-docker-containers-on-the-same-host/201979 "2019-10-02T14:48:35Z")
How can multiple Docker containers of the sebp/elk image be run on the same host? I've got a Stack running with the following command, default ports: sudo docker run --ulimit nofile=65536:65536 -p 5601:5601 -p 9200:920… --- ## [Index pattern and size calculation for aggregating logs and metrics for hundreds microservices](https://discuss.elastic.co/t/index-pattern-and-size-calculation-for-aggregating-logs-and-metrics-for-hundreds-microservices/201968)
**Author:** [@surenraju](https://discuss.elastic.co/u/surenraju)\ **Replies:** 0\ **Last updated:** [October 2, 2019, 2:16pm UTC](https://discuss.elastic.co/t/index-pattern-and-size-calculation-for-aggregating-logs-and-metrics-for-hundreds-microservices/201968 "2019-10-02T14:16:50Z")
Hello, We are going to provide elastic stack as service for our internal clients like micro service teams. We are expecting few hundred micro service team to consume elastic stack for application logs and application me… --- ## [Criar index com logstash utilizando settings customizado](https://discuss.elastic.co/t/criar-index-com-logstash-utilizando-settings-customizado/201795)
**Author:** [@fernando.vicente](https://discuss.elastic.co/u/fernando.vicente)\ **Replies:** 1\ **Last updated:** [October 2, 2019, 2:01pm UTC](https://discuss.elastic.co/t/criar-index-com-logstash-utilizando-settings-customizado/201795 "2019-10-02T14:01:44Z")
Boa tarde pessoal, estou tentando criar um Indice no Elasticsearch (7.0.1) a partir do Logstash (7.3.1) quando tento colocar um template de configurações não funciona (quando subo com as configurações padrões funciona s… --- ## [Docker Desktop used space increase +500Mb per day](https://discuss.elastic.co/t/docker-desktop-used-space-increase-500mb-per-day/201957)
**Author:** [@jnick1982](https://discuss.elastic.co/u/jnick1982)\ **Replies:** 0\ **Last updated:** [October 2, 2019, 1:27pm UTC](https://discuss.elastic.co/t/docker-desktop-used-space-increase-500mb-per-day/201957 "2019-10-02T13:27:38Z")
Since migrating from 6.4 to 6.8 and now 7.3.2 I notice that the used space from Docker Desktop on Windows 10 increased every day. I am running a very simple elk stack Elasticsearch/Kibana/Logstash from a docker compose.… --- ## [Logstash XML Filter Issue](https://discuss.elastic.co/t/logstash-xml-filter-issue/201699)
**Author:** [@niall](https://discuss.elastic.co/u/niall)\ **Replies:** 3\ **Last updated:** [October 2, 2019, 1:22pm UTC](https://discuss.elastic.co/t/logstash-xml-filter-issue/201699 "2019-10-02T13:22:19Z")
Hi, I'm new to Logstash and i'm trying to parse the following sample XML file. I've tried using XPATH and Split filter plugins and still can't get it working. Can someone please advice or guide me please? Thanks a lot. … --- ## [5 logs for every audit event](https://discuss.elastic.co/t/5-logs-for-every-audit-event/201864)
**Author:** [@crazedmeph](https://discuss.elastic.co/u/crazedmeph)\ **Replies:** 2\ **Last updated:** [October 2, 2019, 1:19pm UTC](https://discuss.elastic.co/t/5-logs-for-every-audit-event/201864 "2019-10-02T13:19:16Z")
I am testing out how auditbeats work and upon logging into the box that auditbeat is enabled I get 5 authentication\_success messages. All 5 of the logs are exactly the same, the only value that is not the same is the \_id… --- ## [Setting "max\_determinized\_states" when using \_source to filter fields during match\_all](https://discuss.elastic.co/t/setting-max-determinized-states-when-using-source-to-filter-fields-during-match-all/201956)
**Author:** [@doruchiulan](https://discuss.elastic.co/u/doruchiulan)\ **Replies:** 0\ **Last updated:** [October 2, 2019, 1:17pm UTC](https://discuss.elastic.co/t/setting-max-determinized-states-when-using-source-to-filter-fields-during-match-all/201956 "2019-10-02T13:17:43Z")
I have a long list of fields that I want to include in my results during a match\_all query (1600+) This triggers the following error: { \* "error": { \* "root\_cause": \[ \* { \* "type": "too\_complex\_to\_determini… --- ## [Migrating nested data from mysql to elasticsearch](https://discuss.elastic.co/t/migrating-nested-data-from-mysql-to-elasticsearch/201953)
**Author:** [@saifrehman](https://discuss.elastic.co/u/saifrehman)\ **Replies:** 1\ **Last updated:** [October 2, 2019, 1:05pm UTC](https://discuss.elastic.co/t/migrating-nested-data-from-mysql-to-elasticsearch/201953 "2019-10-02T13:05:50Z")
I have got following error when i run my script. ilsa@ILSA-LAPTOP-01:/usr/share/logstash$ sudo bin/logstash -f /etc/logstash/conf.d/mysql.conf WARNING: Could not find logstash.yml which is typically located in $LS\_HO… --- ## [Writing aggregate with filtering](https://discuss.elastic.co/t/writing-aggregate-with-filtering/200930)
**Author:** [@Dennis\_Monsewicz](https://discuss.elastic.co/u/Dennis_Monsewicz)\ **Replies:** 4\ **Last updated:** [October 2, 2019, 1:04pm UTC](https://discuss.elastic.co/t/writing-aggregate-with-filtering/200930 "2019-10-02T13:04:06Z")
I'm trying to write an ElasticSearch aggregate query that includes filtering where I am wanting to grab all of the tags off a all of the documents where a user id matches the one I specify. I have this code: { "size"… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1860) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1862)