# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1966 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1967 --- ## [Tags not applied by json filter when source sets HTTP header Content-Type: application/json](https://discuss.elastic.co/t/tags-not-applied-by-json-filter-when-source-sets-http-header-content-type-application-json/194754)
**Author:** [@nnet](https://discuss.elastic.co/u/nnet)\ **Replies:** 3\ **Last updated:** [August 11, 2019, 10:24pm UTC](https://discuss.elastic.co/t/tags-not-applied-by-json-filter-when-source-sets-http-header-content-type-application-json/194754 "2019-08-11T22:24:38Z")
Hi, I set up an http listener, and json filter and discovered tag application inconsistencies. ELK components 5.6.16. Input: input { http { port =\> "5048" tags =\> \[ "CURL" \] type =\> "curl" } } Filter: filt… --- ## [How to read elasticsearch snapshots stored in hdfs](https://discuss.elastic.co/t/how-to-read-elasticsearch-snapshots-stored-in-hdfs/194757)
**Author:** [@Atul\_Srivastava](https://discuss.elastic.co/u/Atul_Srivastava)\ **Replies:** 1\ **Last updated:** [August 11, 2019, 6:52pm UTC](https://discuss.elastic.co/t/how-to-read-elasticsearch-snapshots-stored-in-hdfs/194757 "2019-08-11T18:52:12Z")
Hi, I am currently backing up my elasticsearch data to hdfs using curator and the repository-hdfs plugin. Is there a way I can query the snapshots stored in hdfs using hive? --- ## [Installed logstash, cannot find logstash-plugin](https://discuss.elastic.co/t/installed-logstash-cannot-find-logstash-plugin/194722)
**Author:** [@Jobe](https://discuss.elastic.co/u/Jobe)\ **Replies:** 2\ **Last updated:** [August 11, 2019, 3:45pm UTC](https://discuss.elastic.co/t/installed-logstash-cannot-find-logstash-plugin/194722 "2019-08-11T15:45:21Z")
I'm not sure if this is a version issue, I found a "plugin" executable in the bin directory that seems to be the same but I'm concerned that all the docs reference logstash-plugin and I cannot seem to find it in a basic … --- ## [How to parse this json](https://discuss.elastic.co/t/how-to-parse-this-json/194682)
**Author:** [@Sketchy](https://discuss.elastic.co/u/Sketchy)\ **Replies:** 6\ **Last updated:** [August 11, 2019, 2:50pm UTC](https://discuss.elastic.co/t/how-to-parse-this-json/194682 "2019-08-11T14:50:24Z")
I am new to logstash and have been trying to parse the below json with no luck. { "stat": "user", "Ref": "USER:\[5000,John Smith,3A37332D2659554F9CCE0CD754185269\]", "statistics": \[ "0", "", "", "0", 0… --- ## [How to create grok filter based on targeted word in message?](https://discuss.elastic.co/t/how-to-create-grok-filter-based-on-targeted-word-in-message/194686)
**Author:** [@Bob94](https://discuss.elastic.co/u/Bob94)\ **Replies:** 6\ **Last updated:** [August 11, 2019, 1:00pm UTC](https://discuss.elastic.co/t/how-to-create-grok-filter-based-on-targeted-word-in-message/194686 "2019-08-11T13:00:37Z")
Hi guys please verify whether this is the proper way to use grok ? If "i am happy: true" in \[message\] { grok { match =\> "message" , "%{GREEDYDATA:myfield"} } My intension is to create a new field based on spesific st… --- ## [Invalid FieldReference issue in logstash](https://discuss.elastic.co/t/invalid-fieldreference-issue-in-logstash/194742)
**Author:** [@sukku77](https://discuss.elastic.co/u/sukku77)\ **Replies:** 1\ **Last updated:** [August 11, 2019, 12:34pm UTC](https://discuss.elastic.co/t/invalid-fieldreference-issue-in-logstash/194742 "2019-08-11T12:34:36Z")
Hi All, I am getting the below logstash exception stack trace after migrated from 6.5.4 to 7.3.0. Does this mean Logstash is dropping out some events? Do I need to update any template to suppress these warnings. There … --- ## [How To parse Json in json](https://discuss.elastic.co/t/how-to-parse-json-in-json/194720)
**Author:** [@zbawio](https://discuss.elastic.co/u/zbawio)\ **Replies:** 1\ **Last updated:** [August 11, 2019, 12:16pm UTC](https://discuss.elastic.co/t/how-to-parse-json-in-json/194720 "2019-08-11T12:16:07Z")
Hi , i am new to ELK and i wonder how can i parse json have json For ex: my "Content" field have String but this string is also a json { "Method":"some string", "Request":"some string", "Time":"Datetime", "Content"… --- ## [Csv s3 format](https://discuss.elastic.co/t/csv-s3-format/194744)
**Author:** [@Vinay\_Kumar1](https://discuss.elastic.co/u/Vinay_Kumar1)\ **Replies:** 0\ **Last updated:** [August 11, 2019, 11:44am UTC](https://discuss.elastic.co/t/csv-s3-format/194744 "2019-08-11T11:44:02Z")
How to convert logstash output of JDBC input plugin (fetching data from psql DB) to csv format and store the same in s3 bucket? I want to store the files in s3 bucket only in csv gzip format. S3 plugin does not provide … --- ## [Best way to manage missing data of date type while using bulk to inject data into elasticsearch](https://discuss.elastic.co/t/best-way-to-manage-missing-data-of-date-type-while-using-bulk-to-inject-data-into-elasticsearch/194398)
**Author:** [@Saurabh\_Sharma\_IIT](https://discuss.elastic.co/u/Saurabh_Sharma_IIT)\ **Replies:** 3\ **Last updated:** [August 11, 2019, 8:09am UTC](https://discuss.elastic.co/t/best-way-to-manage-missing-data-of-date-type-while-using-bulk-to-inject-data-into-elasticsearch/194398 "2019-08-11T08:09:59Z")
Hi, I am trying to inject csv file into elasticsearch. I have a row named "starttime". In this columns some rows are missing. I have converted this to datetime format using pandas to\_datetime. Now when I inject this data… --- ## [Hello, may I ask you a question](https://discuss.elastic.co/t/hello-may-i-ask-you-a-question/194705)
**Author:** [@kakano.1](https://discuss.elastic.co/u/kakano.1)\ **Replies:** 4\ **Last updated:** [August 11, 2019, 8:05am UTC](https://discuss.elastic.co/t/hello-may-i-ask-you-a-question/194705 "2019-08-11T08:05:14Z")
es : v7.2 logstash: v7.2 kibana : v7.2 --- ## [Kafka input works but index not created in es](https://discuss.elastic.co/t/kafka-input-works-but-index-not-created-in-es/194734)
**Author:** [@real\_legend](https://discuss.elastic.co/u/real_legend)\ **Replies:** 0\ **Last updated:** [August 11, 2019, 6:48am UTC](https://discuss.elastic.co/t/kafka-input-works-but-index-not-created-in-es/194734 "2019-08-11T06:48:39Z")
i use : kafka input plugin es output plugin logstash 7.3 es 7.3 my config file for logstash: input{ kafka { bootstrap\_servers =\> "192.168.50.97:9092" topics =\> \["log-aggregator"… --- ## [Repeated record every time new events happens](https://discuss.elastic.co/t/repeated-record-every-time-new-events-happens/194714)
**Author:** [@Mohammad.ali](https://discuss.elastic.co/u/Mohammad.ali)\ **Replies:** 2\ **Last updated:** [August 10, 2019, 4:17pm UTC](https://discuss.elastic.co/t/repeated-record-every-time-new-events-happens/194714 "2019-08-10T16:17:44Z")
I have a very basic pipeline.config: input { file { path =\> \["/var/log/mylog.log"\] start\_position =\> "beginning" } } filter { } output { elasticsearch { hosts =\> \["localhost:9200"\] index =\> "test" } } let… --- ## [Logstash failed to index](https://discuss.elastic.co/t/logstash-failed-to-index/194712)
**Author:** [@Guyk](https://discuss.elastic.co/u/Guyk)\ **Replies:** 1\ **Last updated:** [August 10, 2019, 1:47pm UTC](https://discuss.elastic.co/t/logstash-failed-to-index/194712 "2019-08-10T13:47:28Z")
Hey guys, last week i decide to add Logsatsh service to my Elasticsearch cluster(3 nodes in AWS vpc) until now we are use to index new docs using the Elastic Api without using Logstash. The data type is JSON, and some… --- ## [Multiple line and fully unstructured log file](https://discuss.elastic.co/t/multiple-line-and-fully-unstructured-log-file/194616)
**Author:** [@Mohammad.ali](https://discuss.elastic.co/u/Mohammad.ali)\ **Replies:** 6\ **Last updated:** [August 10, 2019, 12:40pm UTC](https://discuss.elastic.co/t/multiple-line-and-fully-unstructured-log-file/194616 "2019-08-10T12:40:40Z")
Hello my friends I got some logfiles that are fully unstructured what I am so far done is just for the first line of each log which are DATE HOUR TIMEZONE and some information %{DATE\_YMD:login\_date} %{TIME:login\_time}… --- ## [How to query terms which are neighbour of provided terms?](https://discuss.elastic.co/t/how-to-query-terms-which-are-neighbour-of-provided-terms/194710)
**Author:** [@elasticpatrick](https://discuss.elastic.co/u/elasticpatrick)\ **Replies:** 0\ **Last updated:** [August 10, 2019, 12:09pm UTC](https://discuss.elastic.co/t/how-to-query-terms-which-are-neighbour-of-provided-terms/194710 "2019-08-10T12:09:04Z")
Hello, I used to go market every day and take pictures of different products which contain brand names. A product can have zero brand names or multiple brand names. I do analysis on the products photos and retrieve brand… --- ## [Stuck in "Kibana server is not ready yet" for last 24 hr kibana not loading](https://discuss.elastic.co/t/stuck-in-kibana-server-is-not-ready-yet-for-last-24-hr-kibana-not-loading/194702)
**Author:** [@asad\_ali](https://discuss.elastic.co/u/asad_ali)\ **Replies:** 1\ **Last updated:** [August 10, 2019, 11:04am UTC](https://discuss.elastic.co/t/stuck-in-kibana-server-is-not-ready-yet-for-last-24-hr-kibana-not-loading/194702 "2019-08-10T11:04:15Z")
I'm running ELK ver 7.1 with kibana.yml that looks like server.port: 5601 server.host: 0.0.0.0 elasticsearch.hosts: \["https://illumin8.inboxbiz.com:9200"\] elasticsearch.username: "elastic" elasticsearch.password: "… --- ## [K8S Install Fails on version \< 7.2](https://discuss.elastic.co/t/k8s-install-fails-on-version-7-2/194476)
**Author:** [@engineertdog](https://discuss.elastic.co/u/engineertdog)\ **Replies:** 4\ **Last updated:** [August 10, 2019, 7:17am UTC](https://discuss.elastic.co/t/k8s-install-fails-on-version-7-2/194476 "2019-08-10T07:17:28Z")
I am able to install v7.2 with the statefulset config that is listed below, but for a service I'm running, it hasn't been updated to support v7 yet. Currently, the service only supports v6.3. The following is the error I… --- ## [Upsert / Update if exist, create if not](https://discuss.elastic.co/t/upsert-update-if-exist-create-if-not/194681)
**Author:** [@ELK-Developer](https://discuss.elastic.co/u/ELK-Developer)\ **Replies:** 2\ **Last updated:** [August 10, 2019, 6:59am UTC](https://discuss.elastic.co/t/upsert-update-if-exist-create-if-not/194681 "2019-08-10T06:59:33Z")
Hello, how do I use upsert, to create or update entries = documents via the output-plugin to elasticsearch, dependent on the document with the given id is already in elasticsearch or even not. My data will come from tw… --- ## [Kibana\[7.3\] load custom vector shape from http server](https://discuss.elastic.co/t/kibana-7-3-load-custom-vector-shape-from-http-server/194558)
**Author:** [@Scorpion21](https://discuss.elastic.co/u/Scorpion21)\ **Replies:** 3\ **Last updated:** [August 10, 2019, 5:24am UTC](https://discuss.elastic.co/t/kibana-7-3-load-custom-vector-shape-from-http-server/194558 "2019-08-10T05:24:33Z")
Hi There, I am trying to add a few vector shape files in geojson format to Kibana (running on ubuntu 18.04) Here are what I did: 1- set up a http server for my geojson files using: python3 -m http.server 8080 2- set … --- ## [Add\_fields processor not working](https://discuss.elastic.co/t/add-fields-processor-not-working/194688)
**Author:** [@ajhstn](https://discuss.elastic.co/u/ajhstn)\ **Replies:** 1\ **Last updated:** [August 10, 2019, 4:33am UTC](https://discuss.elastic.co/t/add-fields-processor-not-working/194688 "2019-08-10T04:33:13Z")
Hello - can you spot any problem with this processor. when i .\\winlogbeat.exe test config i get a good Config OK as expected, however when events that i feel should match the processor occur, the field is not being adde… --- ## [Invalid checksum in DLQ](https://discuss.elastic.co/t/invalid-checksum-in-dlq/194480)
**Author:** [@amitavmohanty01](https://discuss.elastic.co/u/amitavmohanty01)\ **Replies:** 1\ **Last updated:** [August 8, 2019, 6:08pm UTC](https://discuss.elastic.co/t/invalid-checksum-in-dlq/194480 "2019-08-08T18:08:22Z")
I am getting an exception as follows: \[2019-08-08T09:52:26,478\]\[ERROR\]\[logstash.pipeline \] A plugin had an unrecoverable error. Will restart this plugin. Pipeline\_id:dlqInstance Plugin: \ **Author:** [@Johntdyer](https://discuss.elastic.co/u/Johntdyer)\ **Replies:** 1\ **Last updated:** [August 10, 2019, 2:35am UTC](https://discuss.elastic.co/t/how-to-use-fields-and-attributes-in-uptime/185203 "2019-08-10T02:35:41Z") I have configured Heartbeat to send fields via config but I am not sure how I would actually make use of those fields in the "Uptime" panel in Elasticsearch ? Are there any examples of how to make use of these attributes… --- ## [Uptime Just Spins](https://discuss.elastic.co/t/uptime-just-spins/193900)
**Author:** [@richard\_N](https://discuss.elastic.co/u/richard_N)\ **Replies:** 2\ **Last updated:** [August 10, 2019, 2:34am UTC](https://discuss.elastic.co/t/uptime-just-spins/193900 "2019-08-10T02:34:11Z")
Just setup a fresh 7.3 cluster across the board. Everything was working but I deleted an old heartbeat index and now my Uptime dashboard just spins. The index recreated correctly and I can view all heartbeats on the Disc… --- ## [timepicker:quickRanges ignored in Kibana 7.x?](https://discuss.elastic.co/t/timepicker-quickranges-ignored-in-kibana-7-x/194648)
**Author:** [@Kickinsix](https://discuss.elastic.co/u/Kickinsix)\ **Replies:** 1\ **Last updated:** [August 10, 2019, 12:36am UTC](https://discuss.elastic.co/t/timepicker-quickranges-ignored-in-kibana-7-x/194648 "2019-08-10T00:36:29Z")
I'm running Kibana 7.2.0 and the new time picker dropdown is now missing the timepicker:quickRanges list. I would like to know (1) why is the quickRanges not visible anymore and (2) why have the setting if it's not used? … --- ## [Active Directory configuration issue](https://discuss.elastic.co/t/active-directory-configuration-issue/192028)
**Author:** [@Ashok\_Sharma](https://discuss.elastic.co/u/Ashok_Sharma)\ **Replies:** 1\ **Last updated:** [August 9, 2019, 11:28pm UTC](https://discuss.elastic.co/t/active-directory-configuration-issue/192028 "2019-08-09T23:28:30Z")
I am using trying to configure active directory from ES 6.8 and getting error. Below is the snippet from active directory configuration from elasticsearch.yml file xpack: security: authc: realms: my\_ad: type: acti… --- ## [Scripted update to select minimum value in list](https://discuss.elastic.co/t/scripted-update-to-select-minimum-value-in-list/192116)
**Author:** [@neesha](https://discuss.elastic.co/u/neesha)\ **Replies:** 3\ **Last updated:** [August 9, 2019, 10:21pm UTC](https://discuss.elastic.co/t/scripted-update-to-select-minimum-value-in-list/192116 "2019-08-09T22:21:00Z")
I have series of documents that currently have a field that is a list of integers (date timestamps, but this doesn't really matter). Some have a single value, some have many (possibly hundreds). For example: "date" : \[… --- ## [Rollover max\_size precision](https://discuss.elastic.co/t/rollover-max-size-precision/194326)
**Author:** [@jimyoo](https://discuss.elastic.co/u/jimyoo)\ **Replies:** 1\ **Last updated:** [August 9, 2019, 9:37pm UTC](https://discuss.elastic.co/t/rollover-max-size-precision/194326 "2019-08-09T21:37:26Z")
I am seeing an interesting behavior on Rollover Index. When "max\_size" is given with little bit smaller than the current index size, sometimes (or some indices) the rollover succeeds sometime it fails. For example, the… --- ## [Get Hierarchical Data...Pls Helppp!](https://discuss.elastic.co/t/get-hierarchical-data-pls-helppp/193419)
**Author:** [@Bidzina\_Goginashvili](https://discuss.elastic.co/u/Bidzina_Goginashvili)\ **Replies:** 0\ **Last updated:** [August 1, 2019, 10:37pm UTC](https://discuss.elastic.co/t/get-hierarchical-data-pls-helppp/193419 "2019-08-01T22:37:23Z")
I have a little problem with Elasticsearch... I have products table.which looks something like this ID NAME MODELNAME IsParentModel 1 IPhone 7 16 gb IPhone 7 1 2 IPhone 7 32 gb IPhone 7 0 3 IPhone 7 64 gb IPhone 7 0 … --- ## [Skip first two grok pattern matches](https://discuss.elastic.co/t/skip-first-two-grok-pattern-matches/194666)
**Author:** [@Jim\_Thunder](https://discuss.elastic.co/u/Jim_Thunder)\ **Replies:** 1\ **Last updated:** [August 9, 2019, 7:58pm UTC](https://discuss.elastic.co/t/skip-first-two-grok-pattern-matches/194666 "2019-08-09T19:58:13Z")
I am trying to parse out the last number of a field (that is a string). My grok pattern, currently, pulls the first number and puts it in the new field. How can make that grok pattern skip the first 2 numbers it comes ac… --- ## [Parse any field that has a specific name](https://discuss.elastic.co/t/parse-any-field-that-has-a-specific-name/194664)
**Author:** [@baselai](https://discuss.elastic.co/u/baselai)\ **Replies:** 8\ **Last updated:** [August 9, 2019, 7:56pm UTC](https://discuss.elastic.co/t/parse-any-field-that-has-a-specific-name/194664 "2019-08-09T19:56:20Z")
Is it possible to parse any field in Json, under any root, that has a unix time format? I might have in my json file this field "timestamp": 1554940800000 it might be at any root in the json, with this naming conventi… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1965) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1967)