# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1916 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1917 --- ## [Aggregating on docvalue\_field from inner\_hits](https://discuss.elastic.co/t/aggregating-on-docvalue-field-from-inner-hits/198300)
**Author:** [@Jeff\_Potts](https://discuss.elastic.co/u/Jeff_Potts)\ **Replies:** 0\ **Last updated:** [September 5, 2019, 5:57pm UTC](https://discuss.elastic.co/t/aggregating-on-docvalue-field-from-inner-hits/198300 "2019-09-05T17:57:25Z")
I have a query that includes a nested query with inner\_hits enabled. I am using docvalue\_fields within inner\_hits to expose the value from within the nested object that I want to aggregate on: { "query": { "bool":… --- ## [ECE role-based access control](https://discuss.elastic.co/t/ece-role-based-access-control/198286)
**Author:** [@ippolito](https://discuss.elastic.co/u/ippolito)\ **Replies:** 1\ **Last updated:** [September 5, 2019, 5:54pm UTC](https://discuss.elastic.co/t/ece-role-based-access-control/198286 "2019-09-05T17:54:22Z")
All - I'm trying to script putting an allocator into maintenance mode, but I don't want to use platform admin privileges. I read this document: https://www.elastic.co/guide/en/cloud-enterprise/current/ece-configure-rbac… --- ## [Timeout: request did not complete within requested timeout 30s](https://discuss.elastic.co/t/timeout-request-did-not-complete-within-requested-timeout-30s/197432)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 4\ **Last updated:** [September 3, 2019, 6:11pm UTC](https://discuss.elastic.co/t/timeout-request-did-not-complete-within-requested-timeout-30s/197432 "2019-09-03T18:11:22Z")
Hello World! I'm just Deploy the Elasticsearch cluster, yet unable to delete it: $ kubectl version Client Version: version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.3", GitCommit:"2d3c76f9091b6bec110a5e63777c332469… --- ## [Query String Syntax for timestamp like this: 12:30:42:069](https://discuss.elastic.co/t/query-string-syntax-for-timestamp-like-this-1242-069/198287)
**Author:** [@kmiklas](https://discuss.elastic.co/u/kmiklas)\ **Replies:** 2\ **Last updated:** [September 5, 2019, 5:36pm UTC](https://discuss.elastic.co/t/query-string-syntax-for-timestamp-like-this-1242-069/198287 "2019-09-05T17:36:12Z")
I'm trying to isolate a range based on custom timestamps; example: myTimestamp: 12:30:42:069 Date type: string I'm getting this error: Discover: Expected AND, OR, end of input, whitespace but ":" found. Attempts… --- ## [Index settings: correct place for the analyzer section](https://discuss.elastic.co/t/index-settings-correct-place-for-the-analyzer-section/198295)
**Author:** [@jetnet](https://discuss.elastic.co/u/jetnet)\ **Replies:** 0\ **Last updated:** [September 5, 2019, 4:52pm UTC](https://discuss.elastic.co/t/index-settings-correct-place-for-the-analyzer-section/198295 "2019-09-05T16:52:51Z")
quick question - what is the correct place for the analysis configuration: PUT my\_index { "settings": { "index" : { "analysis" : { "analyzer" : { or PUT my\_index { "settings": { "analysis": {… --- ## [SQL Queries](https://discuss.elastic.co/t/sql-queries/198258)
**Author:** [@Sinan\_Kaplan](https://discuss.elastic.co/u/Sinan_Kaplan)\ **Replies:** 1\ **Last updated:** [September 5, 2019, 4:41pm UTC](https://discuss.elastic.co/t/sql-queries/198258 "2019-09-05T16:41:30Z")
Hi, SELECT \* FROM index where index.id NOT IN ( SELECT index.responseID from index where index.type=3) i am writing this sql in elastic search but it says "not in query not supported yet". I'm wondering can i write thi… --- ## [Kibana isolation to multiple users](https://discuss.elastic.co/t/kibana-isolation-to-multiple-users/198202)
**Author:** [@jacobmathews](https://discuss.elastic.co/u/jacobmathews)\ **Replies:** 2\ **Last updated:** [September 5, 2019, 4:18pm UTC](https://discuss.elastic.co/t/kibana-isolation-to-multiple-users/198202 "2019-09-05T16:18:03Z")
Hai,we are planning to build a shared soc using Wazuh-ELK...so let our ELK ip be 192.0.0.0(eg:).we are planning to add all the agents under single wazuh-elk..but now the problem is how can I control customer1accessing to… --- ## [Elastic Cloud Memory Split](https://discuss.elastic.co/t/elastic-cloud-memory-split/198111)
**Author:** [@shiredude95](https://discuss.elastic.co/u/shiredude95)\ **Replies:** 3\ **Last updated:** [September 5, 2019, 4:14pm UTC](https://discuss.elastic.co/t/elastic-cloud-memory-split/198111 "2019-09-05T16:14:33Z")
The Elasticsearch guide recommends giving half of the available memory to system cache for lucene-based caching. In the elasticcloud offering, all of the options seem to give everything but 1.5gb of the total memory to e… --- ## [Logstash with cloudfront](https://discuss.elastic.co/t/logstash-with-cloudfront/197729)
**Author:** [@M\_H](https://discuss.elastic.co/u/M_H)\ **Replies:** 4\ **Last updated:** [September 5, 2019, 4:09pm UTC](https://discuss.elastic.co/t/logstash-with-cloudfront/197729 "2019-09-05T16:09:21Z")
Hi, i am facing issue while i am using following code in my logstash config file. my other logs perfectly land into elasticsearch but somehow this filter didn't enter into elasticsearch. If i used following code separ… --- ## [Match\_phrase\_prefix on keyword field inconsistent behavior between ES 5.6.8 and ES 6+](https://discuss.elastic.co/t/match-phrase-prefix-on-keyword-field-inconsistent-behavior-between-es-5-6-8-and-es-6/198151)
**Author:** [@Khoa\_Le](https://discuss.elastic.co/u/Khoa_Le)\ **Replies:** 1\ **Last updated:** [September 5, 2019, 3:50pm UTC](https://discuss.elastic.co/t/match-phrase-prefix-on-keyword-field-inconsistent-behavior-between-es-5-6-8-and-es-6/198151 "2019-09-05T15:50:19Z")
I'm noticing different behavior on Elasticsearch 5.6.8 and Elasticsearch 6+ on doing a match\_phrase\_prefix on keyword. I was able to do a match\_phrase\_prefix on a keyword exact match on Elasticsearch 5.6.8 but not on Ela… --- ## [@timestamp not updated using date filter](https://discuss.elastic.co/t/timestamp-not-updated-using-date-filter/198277)
**Author:** [@holobolo0815](https://discuss.elastic.co/u/holobolo0815)\ **Replies:** 2\ **Last updated:** [September 5, 2019, 3:37pm UTC](https://discuss.elastic.co/t/timestamp-not-updated-using-date-filter/198277 "2019-09-05T15:37:07Z")
Hello, I have the following syslog message that I'm injecting using logstash into elasticsearch: \<189\>2019-09-05T16:44:31.766338+02:00 172.x.x.x date=2019-09-05 time=16:44:30 Using logstash I'm first putting the syslo… --- ## [JDBC connection not working](https://discuss.elastic.co/t/jdbc-connection-not-working/198175)
**Author:** [@zbawio](https://discuss.elastic.co/u/zbawio)\ **Replies:** 10\ **Last updated:** [September 5, 2019, 3:21pm UTC](https://discuss.elastic.co/t/jdbc-connection-not-working/198175 "2019-09-05T15:21:59Z")
Hi all, I have a database on my MSSQL 2012 server and i am trying to get my database to elasticsearch with logstash. I did I installed jdk 8 I installed sqljdbc 4.2 I Added the java and jdbc to Environment path Iam… --- ## [Send log files by filebeat cisco module to logstash](https://discuss.elastic.co/t/send-log-files-by-filebeat-cisco-module-to-logstash/198281)
**Author:** [@bublik96](https://discuss.elastic.co/u/bublik96)\ **Replies:** 0\ **Last updated:** [September 5, 2019, 3:20pm UTC](https://discuss.elastic.co/t/send-log-files-by-filebeat-cisco-module-to-logstash/198281 "2019-09-05T15:20:25Z")
Hello!, I am using ELK to analyze log files for example from Cisco firewall by filebeat cisco module, and I want compare IP's from this logs with file which consist bad IP's. I came to the conclusion to send log files … --- ## [How to back monthly indices with curator day to day?](https://discuss.elastic.co/t/how-to-back-monthly-indices-with-curator-day-to-day/197367)
**Author:** [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)\ **Replies:** 3\ **Last updated:** [September 5, 2019, 3:16pm UTC](https://discuss.elastic.co/t/how-to-back-monthly-indices-with-curator-day-to-day/197367 "2019-09-05T15:16:30Z")
Hi running Curator 5.1 and Elasticsearch 6.4.2 I have the following Curator action... Which works. My concern is how do I catch the last day of the month? So on September 1st I would need to make sure the last bit of A… --- ## [After new install "Can not run elasticsearch as root"](https://discuss.elastic.co/t/after-new-install-can-not-run-elasticsearch-as-root/196796)
**Author:** [@Hortiks](https://discuss.elastic.co/u/Hortiks)\ **Replies:** 12\ **Last updated:** [September 5, 2019, 3:02pm UTC](https://discuss.elastic.co/t/after-new-install-can-not-run-elasticsearch-as-root/196796 "2019-09-05T15:02:43Z")
Hello, after the installation of elasticsearch\_7.3.1, i've got the message "can not run elasticsearch as root". I had a functionnal 1.7.3 with some changes : -/etc/default/elasticsearch =\> uncommented lines START\_DAEM… --- ## [ELK 7.1 - search filter - incomplete search](https://discuss.elastic.co/t/elk-7-1-search-filter-incomplete-search/196533)
**Author:** [@zen.xen](https://discuss.elastic.co/u/zen.xen)\ **Replies:** 1\ **Last updated:** [September 5, 2019, 2:32pm UTC](https://discuss.elastic.co/t/elk-7-1-search-filter-incomplete-search/196533 "2019-09-05T14:32:03Z")
Hello, I have problem and I don't understand that. I send logs with filebeat to logstash, it looks like this When I want to search something ex. a word error, I get something like below, rest default fields I c… --- ## [Logstash 6.8.2: Failing to Send to Elasticsearch](https://discuss.elastic.co/t/logstash-6-8-2-failing-to-send-to-elasticsearch/198270)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 0\ **Last updated:** [September 5, 2019, 2:12pm UTC](https://discuss.elastic.co/t/logstash-6-8-2-failing-to-send-to-elasticsearch/198270 "2019-09-05T14:12:43Z")
Hi, I have three logstashes processing logs and shipping to an elasticsearch 6.8.2 cluster with 18 data nodes via an haproxy loadbalancer. I regularly see the following errors in the logstash logs: \[2019-09-05T13:39:2… --- ## [Elasticsearch latest version support for win 2019](https://discuss.elastic.co/t/elasticsearch-latest-version-support-for-win-2019/198240)
**Author:** [@elitzur\_e](https://discuss.elastic.co/u/elitzur_e)\ **Replies:** 1\ **Last updated:** [September 5, 2019, 2:11pm UTC](https://discuss.elastic.co/t/elasticsearch-latest-version-support-for-win-2019/198240 "2019-09-05T14:11:09Z")
Hi i have seen other (locked) post about this with no official answer. is there any known issue running es or kibana on windows server 2019? (its not on support matix) thanks --- ## [New to logstash need help with config](https://discuss.elastic.co/t/new-to-logstash-need-help-with-config/197987)
**Author:** [@rajdeep101](https://discuss.elastic.co/u/rajdeep101)\ **Replies:** 11\ **Last updated:** [September 5, 2019, 2:03pm UTC](https://discuss.elastic.co/t/new-to-logstash-need-help-with-config/197987 "2019-09-05T14:03:33Z")
Hi all, I basically want to visualize response time and api url in kibana with users. i have written a simple config file that should only parse the required log line but i am getting error at just before match in \_grok… --- ## [Inserting and Indexing Raw HTML into Elastic Search](https://discuss.elastic.co/t/inserting-and-indexing-raw-html-into-elastic-search/198268)
**Author:** [@hotelalpha](https://discuss.elastic.co/u/hotelalpha)\ **Replies:** 0\ **Last updated:** [September 5, 2019, 2:01pm UTC](https://discuss.elastic.co/t/inserting-and-indexing-raw-html-into-elastic-search/198268 "2019-09-05T14:01:18Z")
I have to index about 42 million raw html files and the end objective is to search through these html. Search is suppose to be from HTML tags and content. E.g. Insert following HTML \ \ **Author:** [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\ **Replies:** 6\ **Last updated:** [September 5, 2019, 1:52pm UTC](https://discuss.elastic.co/t/logstash-data-ouput-to-elasticsearch-calculation/195180 "2019-09-05T13:52:28Z") Hello, I am trying to find out how to see how much data is being outputted to elasticsearch from logstash servers. The logstash servers in question are hosted on VMWare at the moment. The logstash server hosted on AWS,… --- ## [Logstash Kafka Output Plugin loss of events or delay in delivering events](https://discuss.elastic.co/t/logstash-kafka-output-plugin-loss-of-events-or-delay-in-delivering-events/198035)
**Author:** [@giorgiogale](https://discuss.elastic.co/u/giorgiogale)\ **Replies:** 2\ **Last updated:** [September 5, 2019, 1:00pm UTC](https://discuss.elastic.co/t/logstash-kafka-output-plugin-loss-of-events-or-delay-in-delivering-events/198035 "2019-09-05T13:00:34Z")
Hi, I have a problem sending events to cluster kafka. The events read in input from a file are not always received on the kafka cluster ( it would seem only the first after the logstash process started). From the log… --- ## [Configuration if \[path\] =~ "access" not working](https://discuss.elastic.co/t/configuration-if-path-access-not-working/197570)
**Author:** [@Senthil\_ak](https://discuss.elastic.co/u/Senthil_ak)\ **Replies:** 6\ **Last updated:** [September 5, 2019, 12:59pm UTC](https://discuss.elastic.co/t/configuration-if-path-access-not-working/197570 "2019-09-05T12:59:44Z")
Hi Team, I am trying to filter apache logs messages, but its always goes to random\_logs than the apache\_access or apache\_error. When i tried to run as adhoc its parsing properly. # Logstash configuration # Beats -\> Log… --- ## [Log parsing by grok filter](https://discuss.elastic.co/t/log-parsing-by-grok-filter/198248)
**Author:** [@emilio](https://discuss.elastic.co/u/emilio)\ **Replies:** 0\ **Last updated:** [September 5, 2019, 12:47pm UTC](https://discuss.elastic.co/t/log-parsing-by-grok-filter/198248 "2019-09-05T12:47:28Z")
Dear all, Please, help me parse it with grok filter: 03-09-2019 00:00:01 \[DEBUG\] {SomeLoging.java:36} \[SOMEUSER:1:9999xxx888yyy-1234567\] - recieved \[Some\_Command, Some\_Command\_Name, SOMEUSER, 2099-01-02 00:00:01, SOME… --- ## [Drop the complete message containing specific strings](https://discuss.elastic.co/t/drop-the-complete-message-containing-specific-strings/197799)
**Author:** [@Klaus.Lucas](https://discuss.elastic.co/u/Klaus.Lucas)\ **Replies:** 8\ **Last updated:** [September 5, 2019, 12:40pm UTC](https://discuss.elastic.co/t/drop-the-complete-message-containing-specific-strings/197799 "2019-09-05T12:40:43Z")
Hello, I have the following definition to drop messages from a log file containing strings and text: input { file { path =\> "/opt/mapr/logs/cldb.log" tags =\> "mapr\_cldb" codec =\> plain {charset =\> "ISO-8859-1"} } … --- ## [Cluster Hangs for 20 seconds, on a single node crush](https://discuss.elastic.co/t/cluster-hangs-for-20-seconds-on-a-single-node-crush/198191)
**Author:** [@ran\_n](https://discuss.elastic.co/u/ran_n)\ **Replies:** 12\ **Last updated:** [September 5, 2019, 12:36pm UTC](https://discuss.elastic.co/t/cluster-hangs-for-20-seconds-on-a-single-node-crush/198191 "2019-09-05T12:36:05Z")
Hi, I have a simple setup, with test data of 10 documents. I have 3 nodes, 2 data 1 only master I have 5 shards with 1 replica. I run a search query every second via small simulator I then disable the network card o… --- ## [Forwarding logs from filebeat to logstash via a proxy server (or something similar)](https://discuss.elastic.co/t/forwarding-logs-from-filebeat-to-logstash-via-a-proxy-server-or-something-similar/198245)
**Author:** [@yotam\_h](https://discuss.elastic.co/u/yotam_h)\ **Replies:** 0\ **Last updated:** [September 5, 2019, 12:20pm UTC](https://discuss.elastic.co/t/forwarding-logs-from-filebeat-to-logstash-via-a-proxy-server-or-something-similar/198245 "2019-09-05T12:20:46Z")
Hi I'm looking for a way to forward my logs with filebeat from one environment to a remote logstash that sits in a different location than my environment. The issue is that the logstash server is closed to outside conn… --- ## [How to split array field in json and send it as separate event](https://discuss.elastic.co/t/how-to-split-array-field-in-json-and-send-it-as-separate-event/198227)
**Author:** [@uma\_rengasamy](https://discuss.elastic.co/u/uma_rengasamy)\ **Replies:** 2\ **Last updated:** [September 5, 2019, 12:13pm UTC](https://discuss.elastic.co/t/how-to-split-array-field-in-json-and-send-it-as-separate-event/198227 "2019-09-05T12:13:08Z")
Please find the debug o/p , We want each logEvents as separate event in kibana, since logEvents will be huge in count and it takes time to load in kibana { "logEvents" =\> \[ \[ 0\] { "message" =\> "id" =\> "timestamp"… --- ## [Ingress for Kibana dashboard when using kubernetes & traefik](https://discuss.elastic.co/t/ingress-for-kibana-dashboard-when-using-kubernetes-traefik/198236)
**Author:** [@vrider](https://discuss.elastic.co/u/vrider)\ **Replies:** 1\ **Last updated:** [September 5, 2019, 12:05pm UTC](https://discuss.elastic.co/t/ingress-for-kibana-dashboard-when-using-kubernetes-traefik/198236 "2019-09-05T12:05:02Z")
Dear Colleagues, I've followed a get started guide on https://www.elastic.co/elasticsearch-kubernetes I've deployed es + kibana in the way described there. If I curl from master instance , it works curl -I -k -u elas… --- ## [Confusing error logs when using pipelines.yml](https://discuss.elastic.co/t/confusing-error-logs-when-using-pipelines-yml/198187)
**Author:** [@trondhindenes](https://discuss.elastic.co/u/trondhindenes)\ **Replies:** 1\ **Last updated:** [September 5, 2019, 12:01pm UTC](https://discuss.elastic.co/t/confusing-error-logs-when-using-pipelines-yml/198187 "2019-09-05T12:01:27Z")
We have a bunch of pipelines defined in pipelines.yml, and while chasing down some exceptions we're noticing that there's not good way to find out which pipeline is failing, as there's one common logfile for all pipeline… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1915) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1917)