# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1874 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1875 --- ## [Howto locate Logstash variables in Elasticsearch and Kibana](https://discuss.elastic.co/t/howto-locate-logstash-variables-in-elasticsearch-and-kibana/200957)
**Author:** [@mohamad.faisel](https://discuss.elastic.co/u/mohamad.faisel)\ **Replies:** 2\ **Last updated:** [September 26, 2019, 3:52am UTC](https://discuss.elastic.co/t/howto-locate-logstash-variables-in-elasticsearch-and-kibana/200957 "2019-09-26T03:52:50Z")
Hi, I have the following logstash config for filterlog stored in 'conf' subdirectory inside my home directory --- Begin ~/conf/filterlog.conf --- input { file{ path =\> "/var/log/10.9.8.1/filterlog.log" start\_positi… --- ## [Logstash JDBC query for LIKE operator](https://discuss.elastic.co/t/logstash-jdbc-query-for-like-operator/200949)
**Author:** [@Donny\_Nightfrost](https://discuss.elastic.co/u/Donny_Nightfrost)\ **Replies:** 1\ **Last updated:** [September 26, 2019, 2:49am UTC](https://discuss.elastic.co/t/logstash-jdbc-query-for-like-operator/200949 "2019-09-26T02:49:13Z")
Hi guys, I have a jdbc static query like this: local\_lookups =\> \[ { query =\> "select \* from servers WHERE ip LIKE = '%:ip%'" parameters =\> {ip =\> "\[from\_ip\]"} target =\> "server" } … --- ## [How can I remove the object in nested array by logstash?](https://discuss.elastic.co/t/how-can-i-remove-the-object-in-nested-array-by-logstash/201006)
**Author:** [@living](https://discuss.elastic.co/u/living)\ **Replies:** 5\ **Last updated:** [September 26, 2019, 2:24am UTC](https://discuss.elastic.co/t/how-can-i-remove-the-object-in-nested-array-by-logstash/201006 "2019-09-26T02:24:46Z")
Hi, The log output like this: { "@timestamp" =\> 2019-09-19T17:30:48.984Z, "characterid" =\> "20036815", "inventory\_item" =\> \[ \[ 0\] { "item\_equipped" =\> true, … --- ## [Netflow in Logstash does not find the logstash.yml file](https://discuss.elastic.co/t/netflow-in-logstash-does-not-find-the-logstash-yml-file/199115)
**Author:** [@eemtzc](https://discuss.elastic.co/u/eemtzc)\ **Replies:** 24\ **Last updated:** [September 26, 2019, 2:21am UTC](https://discuss.elastic.co/t/netflow-in-logstash-does-not-find-the-logstash-yml-file/199115 "2019-09-26T02:21:37Z")
Hello everyone, I am trying to use Netflow on my cluster, so I configured the logstash.yml file as describe on the articules as follows, this directory is located on /etc/logstash: modules: -name: netflow var.input.u… --- ## [Beats reference.yml is missing documentation for json.ignore\_decoding\_error](https://discuss.elastic.co/t/beats-reference-yml-is-missing-documentation-for-json-ignore-decoding-error/200892)
**Author:** [@m13u](https://discuss.elastic.co/u/m13u)\ **Replies:** 1\ **Last updated:** [September 26, 2019, 1:52am UTC](https://discuss.elastic.co/t/beats-reference-yml-is-missing-documentation-for-json-ignore-decoding-error/200892 "2019-09-26T01:52:38Z")
PR 6547 added a new option json.ignore\_decoding\_error but documentation for this option is missing in the Beats reference.yml. --- ## [Visualization with Top Hit Aggregation](https://discuss.elastic.co/t/visualization-with-top-hit-aggregation/201123)
**Author:** [@jjums](https://discuss.elastic.co/u/jjums)\ **Replies:** 0\ **Last updated:** [September 26, 2019, 12:59am UTC](https://discuss.elastic.co/t/visualization-with-top-hit-aggregation/201123 "2019-09-26T00:59:09Z")
Hello, I'm a beginner with Kibana. Now, I tried to make dashboard with hourly data. My problem is visualization. For example, every hour, 100 data comes in. I want to sum up only the top five values. The problem is t… --- ## [How to profile next\_doc take too long?](https://discuss.elastic.co/t/how-to-profile-next-doc-take-too-long/201120)
**Author:** [@Wesley\_Hsiung](https://discuss.elastic.co/u/Wesley_Hsiung)\ **Replies:** 0\ **Last updated:** [September 26, 2019, 12:32am UTC](https://discuss.elastic.co/t/how-to-profile-next-doc-take-too-long/201120 "2019-09-26T00:32:04Z")
I have one index with 100 million docs, on 12 data nodes(with 12 shards), 16G ram, 500G storge each node; the query is filter on biz id(keyword) and date range and amt range; the biggest biz id have 20 million docs, and … --- ## [Logstash 特定データのみをフィールドに指定したい](https://discuss.elastic.co/t/logstash/200780)
**Author:** [@harue](https://discuss.elastic.co/u/harue)\ **Replies:** 4\ **Last updated:** [September 26, 2019, 12:20am UTC](https://discuss.elastic.co/t/logstash/200780 "2019-09-26T00:20:32Z")
Logstashのfilter句にて、 下記inputデータの「192.168.0.224」のみを「"client\_address" =\> "192.168.0.224"」のようにフィールドを指定したいです。 ▼inputデータ 1286536308.779 180 192.168.0.224 TCP\_MISS/200 411 GET http://liveupdate.symantecliveupdate.com/mini… --- ## [Unable to connect to Logstash from Remote](https://discuss.elastic.co/t/unable-to-connect-to-logstash-from-remote/201100)
**Author:** [@James\_Nobles](https://discuss.elastic.co/u/James_Nobles)\ **Replies:** 0\ **Last updated:** [September 25, 2019, 8:10pm UTC](https://discuss.elastic.co/t/unable-to-connect-to-logstash-from-remote/201100 "2019-09-25T20:10:23Z")
I've have installed ELK 6.8.3 on CENTOS 6.10. Elasticsearch and Kibana appear to work on so far. I can upload csv files in Kibana and create visualizations. This issue is sending syslog data to logstash. The goal is to … --- ## [Replace LAT and LON values](https://discuss.elastic.co/t/replace-lat-and-lon-values/201089)
**Author:** [@SirJune](https://discuss.elastic.co/u/SirJune)\ **Replies:** 4\ **Last updated:** [September 25, 2019, 7:52pm UTC](https://discuss.elastic.co/t/replace-lat-and-lon-values/201089 "2019-09-25T19:52:02Z")
my goal is to not plot the "dot" down to spcific state or city, just country. Sample data: "geoip" =\> { "latitude" =\> 44.6628, "location" =\> { "lon" =\> -93.1539, "lat" =\> 44.6628 … --- ## [Logstash Service does not start after running the Netflow module](https://discuss.elastic.co/t/logstash-service-does-not-start-after-running-the-netflow-module/201097)
**Author:** [@eemtzc](https://discuss.elastic.co/u/eemtzc)\ **Replies:** 0\ **Last updated:** [September 25, 2019, 7:46pm UTC](https://discuss.elastic.co/t/logstash-service-does-not-start-after-running-the-netflow-module/201097 "2019-09-25T19:46:01Z")
Ok, here is what happened. Originally we had a pipeline to receive logs from our firewalls devices to our ELK stack, and everything was working perfect. Then we will like to add, to the same logstash server, the Netflo… --- ## [What's the default registry and images for ECK and ES](https://discuss.elastic.co/t/whats-the-default-registry-and-images-for-eck-and-es/201083)
**Author:** [@gearoidibm](https://discuss.elastic.co/u/gearoidibm)\ **Replies:** 2\ **Last updated:** [September 25, 2019, 7:44pm UTC](https://discuss.elastic.co/t/whats-the-default-registry-and-images-for-eck-and-es/201083 "2019-09-25T19:44:02Z")
What's the default registry and images used for both the operator and ES itself. Where can I find the Dockerfiles for the ES images ? I've skimmed the operator repo but not sure where I'd find these in the code. --- ## [Wildcard \* is not working for my index](https://discuss.elastic.co/t/wildcard-is-not-working-for-my-index/201040)
**Author:** [@Dibyakanta](https://discuss.elastic.co/u/Dibyakanta)\ **Replies:** 6\ **Last updated:** [September 25, 2019, 7:03pm UTC](https://discuss.elastic.co/t/wildcard-is-not-working-for-my-index/201040 "2019-09-25T19:03:11Z")
Hi, I have created an index with the following mapping: PUT abc { "mappings": { "type" : { "properties": { "title" : { "type": "text", "analyzer": "standard" } } } } } After this I added documents to it li… --- ## [Problem with join additional nodes to dockerized cluster elasticsearch 6.6.2 + xpack](https://discuss.elastic.co/t/problem-with-join-additional-nodes-to-dockerized-cluster-elasticsearch-6-6-2-xpack/200664)
**Author:** [@amilek](https://discuss.elastic.co/u/amilek)\ **Replies:** 1\ **Last updated:** [September 25, 2019, 6:02pm UTC](https://discuss.elastic.co/t/problem-with-join-additional-nodes-to-dockerized-cluster-elasticsearch-6-6-2-xpack/200664 "2019-09-25T18:02:56Z")
Hello, everybody! I try to deploy this configuration: ES 6.6.2 on several docker hosts, 3 nodes. Two nodes are master-eligible and one node is "data only". XPACK enabled (basic license). Inter node communication is… --- ## [Rest High Level Client Cluster State](https://discuss.elastic.co/t/rest-high-level-client-cluster-state/200789)
**Author:** [@Rohinaik](https://discuss.elastic.co/u/Rohinaik)\ **Replies:** 2\ **Last updated:** [September 25, 2019, 5:17pm UTC](https://discuss.elastic.co/t/rest-high-level-client-cluster-state/200789 "2019-09-25T17:17:48Z")
Is there any way to obtain the cluster state metadata via Rest High Level Client (using transport client we were able to fetch the metadata of the cluster via ClusterStateRequest,ClusterStateResponse APIs) --- ## [Dynamic-Template Errors After Upgrading to ES 6.8](https://discuss.elastic.co/t/dynamic-template-errors-after-upgrading-to-es-6-8/200771)
**Author:** [@elasticTrouble](https://discuss.elastic.co/u/elasticTrouble)\ **Replies:** 3\ **Last updated:** [September 25, 2019, 5:13pm UTC](https://discuss.elastic.co/t/dynamic-template-errors-after-upgrading-to-es-6-8/200771 "2019-09-25T17:13:53Z")
Evening ES. I'm having some trouble successfully indexing certain events after migrating / upgrading to ES 6.8 from 5.3. I believe the root cause of the error I'm experiencing is due to an improper mapping on one of the … --- ## [String values not showing up in Visualize 6.5](https://discuss.elastic.co/t/string-values-not-showing-up-in-visualize-6-5/200933)
**Author:** [@jwalls](https://discuss.elastic.co/u/jwalls)\ **Replies:** 2\ **Last updated:** [September 25, 2019, 5:00pm UTC](https://discuss.elastic.co/t/string-values-not-showing-up-in-visualize-6-5/200933 "2019-09-25T17:00:32Z")
I am trying to get two string values to show up under visualize as well as 2 timestamp values. the two string fields needed are site and klocker\_app\_name. to my knowledge, in order for a string to be visualized, it need… --- ## [Filtering by Long.MAX\_VALUE does not return any result](https://discuss.elastic.co/t/filtering-by-long-max-value-does-not-return-any-result/199786)
**Author:** [@Vova\_Marchev](https://discuss.elastic.co/u/Vova_Marchev)\ **Replies:** 4\ **Last updated:** [September 25, 2019, 4:44pm UTC](https://discuss.elastic.co/t/filtering-by-long-max-value-does-not-return-any-result/199786 "2019-09-25T16:44:17Z")
Hi all! I found an issue when I try to filter documents by range where second parameter is Long.MAX\_VALUE. For example, let's create a schema of the document: PUT /example { "mappings": { "\_doc": { … --- ## [Message: Missed Logs Details: 10000](https://discuss.elastic.co/t/message-missed-logs-details-10000/201086)
**Author:** [@sbarry](https://discuss.elastic.co/u/sbarry)\ **Replies:** 0\ **Last updated:** [September 25, 2019, 4:38pm UTC](https://discuss.elastic.co/t/message-missed-logs-details-10000/201086 "2019-09-25T16:38:15Z")
We are missing a lot of logs coming from cloud foundry into kibana, and on the ingestor vms we get this error message Message: Missed Logs Details: 10000 Tried scaling the ingestor vms but still missing logs. Any idea… --- ## [Hardware requirement ELK](https://discuss.elastic.co/t/hardware-requirement-elk/200934)
**Author:** [@dranovskiydima](https://discuss.elastic.co/u/dranovskiydima)\ **Replies:** 3\ **Last updated:** [September 25, 2019, 4:23pm UTC](https://discuss.elastic.co/t/hardware-requirement-elk/200934 "2019-09-25T16:23:00Z")
Dear Elk support team, One point I'd like to consider with you and ask you assistance is the hardware requirements, which we should use for the reliable and efficient operation. This has likely been discussed many time… --- ## [Merge information from separated databases into a single document](https://discuss.elastic.co/t/merge-information-from-separated-databases-into-a-single-document/201078)
**Author:** [@ricardo.almeida](https://discuss.elastic.co/u/ricardo.almeida)\ **Replies:** 0\ **Last updated:** [September 25, 2019, 3:45pm UTC](https://discuss.elastic.co/t/merge-information-from-separated-databases-into-a-single-document/201078 "2019-09-25T15:45:54Z")
I would like to merge information from two different tables in different database. In table t\_a from database db\_a I have information about the users, like username, Name, Phone Number, etc. In table t\_b from database … --- ## [Elasticsearch - information about index](https://discuss.elastic.co/t/elasticsearch-information-about-index/201044)
**Author:** [@Marek\_Siwiec](https://discuss.elastic.co/u/Marek_Siwiec)\ **Replies:** 1\ **Last updated:** [September 25, 2019, 3:58pm UTC](https://discuss.elastic.co/t/elasticsearch-information-about-index/201044 "2019-09-25T15:58:40Z")
I have question about how updating information about indicies works. I processing logs by filebeat to elasticsearch using ingest pipelines and using elastic stack 7.3.0. And I checked if logs was harvested by looking o… --- ## [Word Count](https://discuss.elastic.co/t/word-count/200753)
**Author:** [@shampoo](https://discuss.elastic.co/u/shampoo)\ **Replies:** 3\ **Last updated:** [September 25, 2019, 3:35pm UTC](https://discuss.elastic.co/t/word-count/200753 "2019-09-25T15:35:54Z")
Hi, I am trying to do the following: Perform a standard search on a series of documents with a given search term. (easy enough) Count the amount of times another series of words appears within that result set. The qu… --- ## [Transform datetime to @timestamp](https://discuss.elastic.co/t/transform-datetime-to-timestamp/201062)
**Author:** [@fernrguez](https://discuss.elastic.co/u/fernrguez)\ **Replies:** 4\ **Last updated:** [September 25, 2019, 3:22pm UTC](https://discuss.elastic.co/t/transform-datetime-to-timestamp/201062 "2019-09-25T15:22:00Z")
I'm trying to use a datetime field (startTime) from the input xml logs and use it as @timestamp but something is not properly set as it idenfies the field as string but is not able to apply the transformation leaving the… --- ## [Logstash and Postgres Error](https://discuss.elastic.co/t/logstash-and-postgres-error/201074)
**Author:** [@emy.comin](https://discuss.elastic.co/u/emy.comin)\ **Replies:** 0\ **Last updated:** [September 25, 2019, 2:54pm UTC](https://discuss.elastic.co/t/logstash-and-postgres-error/201074 "2019-09-25T14:54:09Z")
Hey everyone, I had several problems with the configuration of logstash, jumping from post to post, but the error I had now I do not have much information and now began to move cok ELK, I have little knowledge ... Could … --- ## [ELK стек под 600гб в день](https://discuss.elastic.co/t/elk-600/201055)
**Author:** [@dranovskiydima](https://discuss.elastic.co/u/dranovskiydima)\ **Replies:** 3\ **Last updated:** [September 25, 2019, 2:53pm UTC](https://discuss.elastic.co/t/elk-600/201055 "2019-09-25T14:53:49Z")
Уважаемая команда поддержки Elk, Один момент, который я хотел бы обсудить с вами и попросить вас о помощи, - это требования к оборудованию, которые мы должны использовать для надежной и эффективной работы. У нас есть в… --- ## [Logstash unacceptable code point error](https://discuss.elastic.co/t/logstash-unacceptable-code-point-error/201073)
**Author:** [@mrstone](https://discuss.elastic.co/u/mrstone)\ **Replies:** 0\ **Last updated:** [September 25, 2019, 2:50pm UTC](https://discuss.elastic.co/t/logstash-unacceptable-code-point-error/201073 "2019-09-25T14:50:55Z")
Hi We had a period, when number of our Logstash scripts refused to run. The error reported in the log file was as follows: Pipeline aborted due to error {:pipeline\_id=\>"xxxxx", :exception=\>#\ **Author:** [@satyam2593](https://discuss.elastic.co/u/satyam2593)\ **Replies:** 2\ **Last updated:** [September 25, 2019, 2:41pm UTC](https://discuss.elastic.co/t/what-is-the-limitation-number-to-define-the-index-names-while-creating-the-template/200979 "2019-09-25T14:41:45Z") I have scenario where i want to include the 10 different indices for the same template. Is it recommendable to do so, if not how can we approach this kind of scenario. How the order will work in the template? Below is… --- ## [How do I run netflow setup when using elasticsearch as config store in Azure?](https://discuss.elastic.co/t/how-do-i-run-netflow-setup-when-using-elasticsearch-as-config-store-in-azure/201070)
**Author:** [@wmassingham](https://discuss.elastic.co/u/wmassingham)\ **Replies:** 0\ **Last updated:** [September 25, 2019, 2:36pm UTC](https://discuss.elastic.co/t/how-do-i-run-netflow-setup-when-using-elasticsearch-as-config-store-in-azure/201070 "2019-09-25T14:36:26Z")
I'm trying to get netflow set up for the SIEM tools in my Azure instance. I have data coming into ES through a logstash pipeline (summarized here): input { udp { port =\> 2055 codec =\> netflow type =\> netf… --- ## [Limit on number of convert statements?](https://discuss.elastic.co/t/limit-on-number-of-convert-statements/201060)
**Author:** [@gyterpena](https://discuss.elastic.co/u/gyterpena)\ **Replies:** 1\ **Last updated:** [September 25, 2019, 2:33pm UTC](https://discuss.elastic.co/t/limit-on-number-of-convert-statements/201060 "2019-09-25T14:33:51Z")
When I use mutate convert with 45 different convert statements logstash fails to start. When I split it into two different convert groups it works fine. Below is error message when it fails. Seems like there is limit on… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1873) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1875)