# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1864 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1865 --- ## [SQL Aggregations and Translate](https://discuss.elastic.co/t/sql-aggregations-and-translate/201550)
**Author:** [@aklys](https://discuss.elastic.co/u/aklys)\ **Replies:** 1\ **Last updated:** [October 1, 2019, 2:38pm UTC](https://discuss.elastic.co/t/sql-aggregations-and-translate/201550 "2019-10-01T14:38:00Z")
When I run an SQL query such as this via the Elasticsearch API: { "query": "SELECT SUM(field1) \\/ COUNT(field2) as ratio FROM \\"test\*\\"" } It will return a nice clean ratio. But when I do a \_sql\\translate on it I get … --- ## [Is there a way to configure Uptime for reading Kafka](https://discuss.elastic.co/t/is-there-a-way-to-configure-uptime-for-reading-kafka/201822)
**Author:** [@bkleynbok](https://discuss.elastic.co/u/bkleynbok)\ **Replies:** 0\ **Last updated:** [October 1, 2019, 2:16pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-configure-uptime-for-reading-kafka/201822 "2019-10-01T14:16:46Z")
Using ELK Stack 7.3.2 on Linux. Would like to use same layout as in Uptime Up/Down in Kibana to send a message to Kafka and get back a response. If this message was not received then show this as Down. --- ## [Geo\_point sort by distance](https://discuss.elastic.co/t/geo-point-sort-by-distance/201804)
**Author:** [@andrezenzen](https://discuss.elastic.co/u/andrezenzen)\ **Replies:** 7\ **Last updated:** [October 1, 2019, 2:00pm UTC](https://discuss.elastic.co/t/geo-point-sort-by-distance/201804 "2019-10-01T14:00:23Z")
I would like to know what would be the best way to perform a search and performing a sorting by distance, today \_geo\_distance filters and does not sort. What would be the best solution in which you need to perform two "s… --- ## [Multi field query](https://discuss.elastic.co/t/multi-field-query/201734)
**Author:** [@Aditya\_Kar](https://discuss.elastic.co/u/Aditya_Kar)\ **Replies:** 0\ **Last updated:** [October 1, 2019, 6:38am UTC](https://discuss.elastic.co/t/multi-field-query/201734 "2019-10-01T06:38:05Z")
Dear sir, If I want to search from the index from multiple keywords then which one is appropriate and we can get a better result. GET subject\_index/\_search { "query": { "bool": { "must": \[ { "bool": { "should": … --- ## [Document contains at least one immense term in field .. again](https://discuss.elastic.co/t/document-contains-at-least-one-immense-term-in-field-again/201814)
**Author:** [@Peter\_Vanleeuwen](https://discuss.elastic.co/u/Peter_Vanleeuwen)\ **Replies:** 0\ **Last updated:** [October 1, 2019, 1:43pm UTC](https://discuss.elastic.co/t/document-contains-at-least-one-immense-term-in-field-again/201814 "2019-10-01T13:43:29Z")
I have my mapping for my field setup properly I thought... "myField" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore\_above" : 256 … --- ## [Important system configuration for Windows](https://discuss.elastic.co/t/important-system-configuration-for-windows/201812)
**Author:** [@j.elastic](https://discuss.elastic.co/u/j.elastic)\ **Replies:** 0\ **Last updated:** [October 1, 2019, 1:31pm UTC](https://discuss.elastic.co/t/important-system-configuration-for-windows/201812 "2019-10-01T13:31:21Z")
In https://www.elastic.co/guide/en/elasticsearch/reference/current/system-config.html, I found an overview of settings that need to be considered for production usage. For some of these settings I see a note saying they'… --- ## [Grok multi-line problem extracting data from between two markers](https://discuss.elastic.co/t/grok-multi-line-problem-extracting-data-from-between-two-markers/201811)
**Author:** [@astickler](https://discuss.elastic.co/u/astickler)\ **Replies:** 0\ **Last updated:** [October 1, 2019, 1:27pm UTC](https://discuss.elastic.co/t/grok-multi-line-problem-extracting-data-from-between-two-markers/201811 "2019-10-01T13:27:48Z")
My source is filebeat with correctly configured multi-line support. Using logstash (v5.6.16), I am trying to extract the data between two marker strings, the second of which is optional. This all works fine unless the so… --- ## [Unable to run elasticsearch 7.2 with weblogic 12c](https://discuss.elastic.co/t/unable-to-run-elasticsearch-7-2-with-weblogic-12c/201368)
**Author:** [@Shubham\_Mittal](https://discuss.elastic.co/u/Shubham_Mittal)\ **Replies:** 6\ **Last updated:** [October 1, 2019, 1:26pm UTC](https://discuss.elastic.co/t/unable-to-run-elasticsearch-7-2-with-weblogic-12c/201368 "2019-10-01T13:26:39Z")
java.lang.IncompatibleClassChangeError: Implementing class at java.lang.ClassLoader.defineClass1(Native Method) at java.lang.ClassLoader.defineClass(ClassLoader.java:763) at java.security.SecureClassLoader.defineClass… --- ## [Couldn't find any Elasticsearch data - new install](https://discuss.elastic.co/t/couldnt-find-any-elasticsearch-data-new-install/201810)
**Author:** [@vigster72](https://discuss.elastic.co/u/vigster72)\ **Replies:** 0\ **Last updated:** [October 1, 2019, 1:26pm UTC](https://discuss.elastic.co/t/couldnt-find-any-elasticsearch-data-new-install/201810 "2019-10-01T13:26:34Z")
This was my first setup on a server. Followed the following article https://docs.fluentd.org/how-to-guides/free-alternative-to-splunk-by-fluentd rsyslog -\>FLuentd-\>eleastic search-\>Kibina curl -X GET http://localhost:… --- ## [7.x, refresh\_interval и alias](https://discuss.elastic.co/t/7-x-refresh-interval-alias/201540)
**Author:** [@Denis\_Lamanov](https://discuss.elastic.co/u/Denis_Lamanov)\ **Replies:** 2\ **Last updated:** [October 1, 2019, 1:26pm UTC](https://discuss.elastic.co/t/7-x-refresh-interval-alias/201540 "2019-10-01T13:26:26Z")
Перешли на 7.3 с 6.8 Один особо тяжелый индекс имеет template с "refresh\_interval" : -1 для ускорения индексации Начиная с 7.х данные по алиасу не видны с новых индексов. Даже если я вручную к индексам сделаю GET index… --- ## [No rollover info found for \[filebeat-7.1.1\] with alias , the index has not yet rolled over with that alias](https://discuss.elastic.co/t/no-rollover-info-found-for-filebeat-7-1-1-with-alias-the-index-has-not-yet-rolled-over-with-that-alias/201808)
**Author:** [@krish2](https://discuss.elastic.co/u/krish2)\ **Replies:** 0\ **Last updated:** [October 1, 2019, 1:21pm UTC](https://discuss.elastic.co/t/no-rollover-info-found-for-filebeat-7-1-1-with-alias-the-index-has-not-yet-rolled-over-with-that-alias/201808 "2019-10-01T13:21:16Z")
When I run the command "GET filebeat-7.1.1/\_ilm/explain" in Kibana console I am getting the below error . { "indices" : { "filebeat-7.1.1" : { "index" : "filebeat-7.1.1", "managed" : true, "policy" : "new\_policy\_1"… --- ## [Pulling date from Elastic and convert it to local time zone](https://discuss.elastic.co/t/pulling-date-from-elastic-and-convert-it-to-local-time-zone/201345)
**Author:** [@saif3r](https://discuss.elastic.co/u/saif3r)\ **Replies:** 3\ **Last updated:** [October 1, 2019, 12:39pm UTC](https://discuss.elastic.co/t/pulling-date-from-elastic-and-convert-it-to-local-time-zone/201345 "2019-10-01T12:39:59Z")
Hello, I'm using Beats to to put data onto my Elasticsearch server. All machines incluing the monitored server are based in CET timezone. In Kibana i can see the @timestamp stored in CET, but when i pull it out using Lo… --- ## [Ship FortiGate logs to logstash](https://discuss.elastic.co/t/ship-fortigate-logs-to-logstash/201794)
**Author:** [@Asmaa\_Sarih](https://discuss.elastic.co/u/Asmaa_Sarih)\ **Replies:** 0\ **Last updated:** [October 1, 2019, 12:36pm UTC](https://discuss.elastic.co/t/ship-fortigate-logs-to-logstash/201794 "2019-10-01T12:36:10Z")
Hi, How to configure FortiGate firewall to send logs to Logstash --- ## [How to apply filter in a watcher query? "\[boosting\] query does not support \[filter\]"](https://discuss.elastic.co/t/how-to-apply-filter-in-a-watcher-query-boosting-query-does-not-support-filter/201740)
**Author:** [@sonal\_singh](https://discuss.elastic.co/u/sonal_singh)\ **Replies:** 0\ **Last updated:** [October 1, 2019, 7:20am UTC](https://discuss.elastic.co/t/how-to-apply-filter-in-a-watcher-query-boosting-query-does-not-support-filter/201740 "2019-10-01T07:20:12Z")
Hi Gurus, Here is a scenario: I have set up an alert based upon a keyword " Spamhaus", to check logs every hour. It is working fine. BUT, I want exclude any logs if Keywords comes in with "(Spamhaus/Invaluement/Retu… --- ## [Partial update vs Index](https://discuss.elastic.co/t/partial-update-vs-index/201793)
**Author:** [@111211](https://discuss.elastic.co/u/111211)\ **Replies:** 1\ **Last updated:** [October 1, 2019, 12:18pm UTC](https://discuss.elastic.co/t/partial-update-vs-index/201793 "2019-10-01T12:18:18Z")
I currently have a document of Elastic Search. My document has approximately 12000 fields. I'll try to update partially. Currently I am using Rest High level Client in Spring Framework. Just Push all data to POST … --- ## [How to enable elasticsearch audit logs in containers ES cluster (docker)](https://discuss.elastic.co/t/how-to-enable-elasticsearch-audit-logs-in-containers-es-cluster-docker/201790)
**Author:** [@arun.kumar92](https://discuss.elastic.co/u/arun.kumar92)\ **Replies:** 1\ **Last updated:** [October 1, 2019, 12:11pm UTC](https://discuss.elastic.co/t/how-to-enable-elasticsearch-audit-logs-in-containers-es-cluster-docker/201790 "2019-10-01T12:11:28Z")
Hi Could you please help me to enable audit logs in elastcisearch (dockerized cluster)? ENV details 4 node cluster 1 node act like load balancing --- ## [Kibana makes no requests to wms interface](https://discuss.elastic.co/t/kibana-makes-no-requests-to-wms-interface/200666)
**Author:** [@kulta](https://discuss.elastic.co/u/kulta)\ **Replies:** 4\ **Last updated:** [October 1, 2019, 11:19am UTC](https://discuss.elastic.co/t/kibana-makes-no-requests-to-wms-interface/200666 "2019-10-01T11:19:04Z")
I have a offline test environment running in virtualbox where I have set up a local geoserver providing locally hosted maps via wms interface to Kibana. I can access the hosted maps from the geoserver's layer preview ju… --- ## [How Replica from one node to another will move?](https://discuss.elastic.co/t/how-replica-from-one-node-to-another-will-move/201771)
**Author:** [@Saptha\_AD](https://discuss.elastic.co/u/Saptha_AD)\ **Replies:** 1\ **Last updated:** [October 1, 2019, 11:15am UTC](https://discuss.elastic.co/t/how-replica-from-one-node-to-another-will-move/201771 "2019-10-01T11:15:30Z")
I have a 3 node cluster with 2 master eligible and all are data node & ingest node. Setting is 1 Primary Shard and 1 Replica shard. I have one index "nginx-2019.09" For example Node "A" is master node and haves a Prim… --- ## [Elassticsearch restart policy](https://discuss.elastic.co/t/elassticsearch-restart-policy/199996)
**Author:** [@arun.kumar92](https://discuss.elastic.co/u/arun.kumar92)\ **Replies:** 2\ **Last updated:** [October 1, 2019, 10:47am UTC](https://discuss.elastic.co/t/elassticsearch-restart-policy/199996 "2019-10-01T10:47:57Z")
Hi folks In my current is clustered to have 10 thousand plus shards available. Suppose I need to restart one node. Is there any restart policy for recovering all shards quickly? --- ## [While moving data from sql sever to elastic search taking moretime(logstash)](https://discuss.elastic.co/t/while-moving-data-from-sql-sever-to-elastic-search-taking-moretime-logstash/201775)
**Author:** [@rameshkr1994](https://discuss.elastic.co/u/rameshkr1994)\ **Replies:** 0\ **Last updated:** [October 1, 2019, 10:29am UTC](https://discuss.elastic.co/t/while-moving-data-from-sql-sever-to-elastic-search-taking-moretime-logstash/201775 "2019-10-01T10:29:41Z")
Dear All. while moving data from sql server to elastic search using logstash taking more time why. i have 25 crores records in sql server side and i am trying to move but its taking more time and giving some error. i… --- ## [Bucket sort on nested field](https://discuss.elastic.co/t/bucket-sort-on-nested-field/201774)
**Author:** [@klaus82](https://discuss.elastic.co/u/klaus82)\ **Replies:** 0\ **Last updated:** [October 1, 2019, 10:28am UTC](https://discuss.elastic.co/t/bucket-sort-on-nested-field/201774 "2019-10-01T10:28:19Z")
I have a problem with a bucket sort on nested field on Elastic 7.1.0: My index has the following mapping: { "mapping": { "dynamic": "strict", "properties": { "created\_at\_timestamp": { "type": "date" }, "url": { … --- ## [How to configure multiple pipelines with single input plugin?](https://discuss.elastic.co/t/how-to-configure-multiple-pipelines-with-single-input-plugin/201773)
**Author:** [@Ashish\_Khare](https://discuss.elastic.co/u/Ashish_Khare)\ **Replies:** 0\ **Last updated:** [October 1, 2019, 10:28am UTC](https://discuss.elastic.co/t/how-to-configure-multiple-pipelines-with-single-input-plugin/201773 "2019-10-01T10:28:02Z")
Hello, I have configured two separate piplines for two seperate log files. Both log streams are coming to single port 5044. How do I configure single input for both pipelines? --- ## [Java-ecs-logging](https://discuss.elastic.co/t/java-ecs-logging/201266)
**Author:** [@Rem](https://discuss.elastic.co/u/Rem)\ **Replies:** 6\ **Last updated:** [October 1, 2019, 10:21am UTC](https://discuss.elastic.co/t/java-ecs-logging/201266 "2019-10-01T10:21:39Z")
Hi, Hope there is someone that can help me. Config.xml for Log4j2 : \ \ \ \ \ **Author:** [@Eva](https://discuss.elastic.co/u/Eva)\ **Replies:** 20\ **Last updated:** [October 1, 2019, 10:01am UTC](https://discuss.elastic.co/t/ship-kafka-logs/200706 "2019-10-01T10:01:06Z") Hello, can anyone please give me some info or point me to the doc on how to ship kafka logs to elk. I did check some which did not work out. I also read that it is slightly different than other server logs that we ship T… --- ## [Filter and mapping by multiple fields in translate filter and dictionary](https://discuss.elastic.co/t/filter-and-mapping-by-multiple-fields-in-translate-filter-and-dictionary/201766)
**Author:** [@fabrei](https://discuss.elastic.co/u/fabrei)\ **Replies:** 0\ **Last updated:** [October 1, 2019, 9:37am UTC](https://discuss.elastic.co/t/filter-and-mapping-by-multiple-fields-in-translate-filter-and-dictionary/201766 "2019-10-01T09:37:20Z")
I have a logstash event which e.g. looks like this: { "field1": "value1", "field2": "value2" } Now I want to perform a translate filter which filters and maps by the two fields ("field1" or/and "field2"). So, when … --- ## [Machine Learning Annotation Cleanup](https://discuss.elastic.co/t/machine-learning-annotation-cleanup/201660)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [October 1, 2019, 9:26am UTC](https://discuss.elastic.co/t/machine-learning-annotation-cleanup/201660 "2019-10-01T09:26:07Z")
Hello, It would be nice if there was some way to clean up ml job annotations in bulk from the ml gui. Tx Willem --- ## [First time query operations are pretty slow](https://discuss.elastic.co/t/first-time-query-operations-are-pretty-slow/201760)
**Author:** [@sudheervarmam](https://discuss.elastic.co/u/sudheervarmam)\ **Replies:** 0\ **Last updated:** [October 1, 2019, 9:06am UTC](https://discuss.elastic.co/t/first-time-query-operations-are-pretty-slow/201760 "2019-10-01T09:06:26Z")
For the first time elasticsearch query time is too long on a collection with 400+ million documents.The problem basically is "first time query operations are pretty slow". However, we want to understand the ROOT CAUSE a… --- ## [Wazuh monitoring unable to work after upgrade](https://discuss.elastic.co/t/wazuh-monitoring-unable-to-work-after-upgrade/201131)
**Author:** [@skyluke.1987](https://discuss.elastic.co/u/skyluke.1987)\ **Replies:** 3\ **Last updated:** [October 1, 2019, 8:48am UTC](https://discuss.elastic.co/t/wazuh-monitoring-unable-to-work-after-upgrade/201131 "2019-10-01T08:48:33Z")
I was running the update recently, after the update my wazuh-monitoring does not work, no data coming in while wazuh-alerts has data. May I know what could be the reason, it looks a bit strange. Thanks How do I know wh… --- ## [Logstash throwing error: Failed to publish events caused by: write tcp IP:PORT](https://discuss.elastic.co/t/logstash-throwing-error-failed-to-publish-events-caused-by-write-tcp-ip-port/201744)
**Author:** [@Ghassan\_Zein](https://discuss.elastic.co/u/Ghassan_Zein)\ **Replies:** 1\ **Last updated:** [October 1, 2019, 8:44am UTC](https://discuss.elastic.co/t/logstash-throwing-error-failed-to-publish-events-caused-by-write-tcp-ip-port/201744 "2019-10-01T08:44:38Z")
I am using filebeat on port 5064 to send logs with Index Pattern "dev-logs-arangodb-\*" from arangodb logs to logstash and then kibana. Filebeat is able to fetch the updates of logs, but not able to send them to logstash… --- ## [Strange error](https://discuss.elastic.co/t/strange-error/201437)
**Author:** [@BeMoore](https://discuss.elastic.co/u/BeMoore)\ **Replies:** 2\ **Last updated:** [October 1, 2019, 8:33am UTC](https://discuss.elastic.co/t/strange-error/201437 "2019-10-01T08:33:34Z")
Sep 27 17:22:55 ldnlinsocelk01 systemd\[1\]: Started logstash. Sep 27 17:22:55 ldnlinsocelk01 logstash\[15386\]: OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be r… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1863) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1865)