# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1973 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1974 --- ## [Kibana Maps: Results limited to first 10000 documents](https://discuss.elastic.co/t/kibana-maps-results-limited-to-first-10000-documents/194077)
**Author:** [@Celio\_Nogueira\_de\_Fa](https://discuss.elastic.co/u/Celio_Nogueira_de_Fa)\ **Replies:** 2\ **Last updated:** [August 7, 2019, 3:55pm UTC](https://discuss.elastic.co/t/kibana-maps-results-limited-to-first-10000-documents/194077 "2019-08-07T15:55:32Z")
Hi all, I'm testing the Kibana Maps feature (7.3 version) and it's really great, kudos! However, as I intend to work with a huge (about billions of documents) index, I could not help but notice that a message saying "Re… --- ## [Data loss using Json filter, messages dropped without any errors or warnings](https://discuss.elastic.co/t/data-loss-using-json-filter-messages-dropped-without-any-errors-or-warnings/194255)
**Author:** [@sherifabdlnaby](https://discuss.elastic.co/u/sherifabdlnaby)\ **Replies:** 3\ **Last updated:** [August 7, 2019, 3:48pm UTC](https://discuss.elastic.co/t/data-loss-using-json-filter-messages-dropped-without-any-errors-or-warnings/194255 "2019-08-07T15:48:50Z")
During setting up our ELK stack for application logs, some logs come structured and some aren't, I am running the JSON filter on every message to tag logs if they're structured or not. After some errors happened and we … --- ## [Is this type of query possible in one go?](https://discuss.elastic.co/t/is-this-type-of-query-possible-in-one-go/194275)
**Author:** [@Jason\_Baumgartner](https://discuss.elastic.co/u/Jason_Baumgartner)\ **Replies:** 0\ **Last updated:** [August 7, 2019, 3:43pm UTC](https://discuss.elastic.co/t/is-this-type-of-query-possible-in-one-go/194275 "2019-08-07T15:43:21Z")
I am working with reddit comments and want to extract bots for analysis. What I'd like to do is: Find all unique authors where the comment reply\_delay is less than a specific value. Example: curl -s -H "Content-Type: … --- ## [Reindex - add new fields not working](https://discuss.elastic.co/t/reindex-add-new-fields-not-working/194271)
**Author:** [@brjisc](https://discuss.elastic.co/u/brjisc)\ **Replies:** 0\ **Last updated:** [August 7, 2019, 3:33pm UTC](https://discuss.elastic.co/t/reindex-add-new-fields-not-working/194271 "2019-08-07T15:33:51Z")
Reindexing data from one index to a new index with a new mappings seems to be losing fields. My old index contains a document with the fields: "service": { "jid": "J00008", "action": { "species": "NEWS", "genus": "… --- ## [Map - Only bucket shape field available](https://discuss.elastic.co/t/map-only-bucket-shape-field-available/192697)
**Author:** [@Ragnar](https://discuss.elastic.co/u/Ragnar)\ **Replies:** 3\ **Last updated:** [August 7, 2019, 3:33pm UTC](https://discuss.elastic.co/t/map-only-bucket-shape-field-available/192697 "2019-08-07T15:33:41Z")
I have an Elastic cluster with Kibana on top (5.6.14). I just added the filter GeoIp to Logstash and have all the desired data from the original IP I have from the source, indexed to Elastic. Now I wanted to build a vi… --- ## [Bounding boxes in images](https://discuss.elastic.co/t/bounding-boxes-in-images/186692)
**Author:** [@covolution](https://discuss.elastic.co/u/covolution)\ **Replies:** 4\ **Last updated:** [August 7, 2019, 3:23pm UTC](https://discuss.elastic.co/t/bounding-boxes-in-images/186692 "2019-08-07T15:23:04Z")
I am interested in indexing metadata about images. In particular, what's the best way to be able to store and search on image tags with bounding boxes? For example a single image could have many items tagged in it, e.g … --- ## [Elasticsearch Setup Kibana and start on Linux server](https://discuss.elastic.co/t/elasticsearch-setup-kibana-and-start-on-linux-server/194203)
**Author:** [@pramod.kumar2](https://discuss.elastic.co/u/pramod.kumar2)\ **Replies:** 1\ **Last updated:** [August 7, 2019, 2:59pm UTC](https://discuss.elastic.co/t/elasticsearch-setup-kibana-and-start-on-linux-server/194203 "2019-08-07T14:59:08Z")
Hi Team, I have installed Elasticsearch 7.3.0 on Linux server and created one master node. On another server(Linux), i have installed Same Elasticsearch version and made it as data node. Also I have passed required conf… --- ## [Pattern matching filebeat to logstash](https://discuss.elastic.co/t/pattern-matching-filebeat-to-logstash/194268)
**Author:** [@Rovaldy\_Applyrs](https://discuss.elastic.co/u/Rovaldy_Applyrs)\ **Replies:** 1\ **Last updated:** [August 7, 2019, 3:21pm UTC](https://discuss.elastic.co/t/pattern-matching-filebeat-to-logstash/194268 "2019-08-07T15:21:41Z")
I wanted to know if it is possible to pattern match the path of the files coming in from file beat in log stash? I am trying to extract the path but it did not work. I tried something like this input { beats { port =\>… --- ## [CSV filter plugin and autodetect column names](https://discuss.elastic.co/t/csv-filter-plugin-and-autodetect-column-names/194244)
**Author:** [@Zedd](https://discuss.elastic.co/u/Zedd)\ **Replies:** 2\ **Last updated:** [August 7, 2019, 3:18pm UTC](https://discuss.elastic.co/t/csv-filter-plugin-and-autodetect-column-names/194244 "2019-08-07T15:18:17Z")
Hi, I'm wondering if there is a way to parse one single CSV log using two distinct logstash conf files assuming each conf file would have a CSV filter plugin with autodetect\_column\_names set to true. As I understand it… --- ## [1 of 105 shards failed with kibana 7.2.0](https://discuss.elastic.co/t/1-of-105-shards-failed-with-kibana-7-2-0/193756)
**Author:** [@dao](https://discuss.elastic.co/u/dao)\ **Replies:** 7\ **Last updated:** [August 7, 2019, 3:12pm UTC](https://discuss.elastic.co/t/1-of-105-shards-failed-with-kibana-7-2-0/193756 "2019-08-07T15:12:48Z")
Hello, I have a elastic cloud deployment with the elasticsearch and the kibana associated with. I have also a on-premise kibana instance ( idem: 7.2.0, see conf below ) I create some index patterns that refers to sever… --- ## [Ignore relevance score completely by using post\_filter only](https://discuss.elastic.co/t/ignore-relevance-score-completely-by-using-post-filter-only/192660)
**Author:** [@kshi\_yelpale000](https://discuss.elastic.co/u/kshi_yelpale000)\ **Replies:** 12\ **Last updated:** [August 7, 2019, 3:05pm UTC](https://discuss.elastic.co/t/ignore-relevance-score-completely-by-using-post-filter-only/192660 "2019-08-07T15:05:16Z")
Hi, In my product, i don't want to use relevance score in my search queries. I have my own sorting algorithm once i have results. On searching i found that to avoid scoring, use post\_filter insread of query clause. He… --- ## [Dockerized Logstash and netflow module install issue](https://discuss.elastic.co/t/dockerized-logstash-and-netflow-module-install-issue/193651)
**Author:** [@iukea](https://discuss.elastic.co/u/iukea)\ **Replies:** 11\ **Last updated:** [August 7, 2019, 2:54pm UTC](https://discuss.elastic.co/t/dockerized-logstash-and-netflow-module-install-issue/193651 "2019-08-07T14:54:40Z")
Hello, I am currently having issues with installing the Netflow module inside of dockerized logstash Docker file FROM docker.elastic.co/logstash/logstash:7.3.0 ADD modules.yml /usr/share/logstash/config/ RUN bin/logs… --- ## [Reading over multiple lines with grok](https://discuss.elastic.co/t/reading-over-multiple-lines-with-grok/193786)
**Author:** [@Kapi](https://discuss.elastic.co/u/Kapi)\ **Replies:** 4\ **Last updated:** [August 7, 2019, 2:47pm UTC](https://discuss.elastic.co/t/reading-over-multiple-lines-with-grok/193786 "2019-08-07T14:47:47Z")
Hi I have this Log where I want to match the start of a thread of device with the corresponding spoolid. 30 Jul 2019 09:56:28 \ DEVICE0 START\_THREAD THREAD\_ID(B01234) 30 Jul 2019 09:56:28 \ DEVICE1 START\_THREAD… --- ## [Having multiple logstash instances (more than one server) for reading from same s3 bucket using s3 input plugin](https://discuss.elastic.co/t/having-multiple-logstash-instances-more-than-one-server-for-reading-from-same-s3-bucket-using-s3-input-plugin/194251)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 0\ **Last updated:** [August 7, 2019, 2:01pm UTC](https://discuss.elastic.co/t/having-multiple-logstash-instances-more-than-one-server-for-reading-from-same-s3-bucket-using-s3-input-plugin/194251 "2019-08-07T14:01:57Z")
Would like to run logstash instances on two servers for High availability. Would like to know how to configure logstash to read from the same S3 bucket so that if one logstash server goes down other logstash instance can… --- ## [Unfounded script recompilations](https://discuss.elastic.co/t/unfounded-script-recompilations/193575)
**Author:** [@Matt\_McGovern](https://discuss.elastic.co/u/Matt_McGovern)\ **Replies:** 6\ **Last updated:** [August 7, 2019, 1:37pm UTC](https://discuss.elastic.co/t/unfounded-script-recompilations/193575 "2019-08-07T13:37:28Z")
In preparation for upgrading our Prod environment, we've built up our Dev environment to have more processors and memory and are testing out our heavy watcher load to see if all is well there before doing the same upgrad… --- ## [Message in json but not full](https://discuss.elastic.co/t/message-in-json-but-not-full/194013)
**Author:** [@Arnodl](https://discuss.elastic.co/u/Arnodl)\ **Replies:** 3\ **Last updated:** [August 7, 2019, 1:39pm UTC](https://discuss.elastic.co/t/message-in-json-but-not-full/194013 "2019-08-07T13:39:25Z")
Hello, I have problem with parsing the message: fun.host.pl: /storage/test / applications / central / logger\_data\_20190801: prm: { "@timestamp": "2019-08-01T10:24:07.32", "appid": "prm", "tags": \["SUCC:AUTHEN"\], "c… --- ## [Help with installing 3rd party plugin](https://discuss.elastic.co/t/help-with-installing-3rd-party-plugin/194246)
**Author:** [@bigdamhero](https://discuss.elastic.co/u/bigdamhero)\ **Replies:** 0\ **Last updated:** [August 7, 2019, 1:38pm UTC](https://discuss.elastic.co/t/help-with-installing-3rd-party-plugin/194246 "2019-08-07T13:38:11Z")
I am trying to install the logtash-okta-input plugin. I believe I have built the jruby gem correctly. I build it on a separate machine which matched the Java ver as the server where this will run. I am trying to insta… --- ## [How to update alias to capture new matching index patterns?](https://discuss.elastic.co/t/how-to-update-alias-to-capture-new-matching-index-patterns/194051)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 3\ **Last updated:** [August 7, 2019, 1:35pm UTC](https://discuss.elastic.co/t/how-to-update-alias-to-capture-new-matching-index-patterns/194051 "2019-08-07T13:35:33Z")
TL;DR How do I continuously update an alias to capture new matching index patterns? Longer Version... We use a non-standard format that looks like this: myapp-beatname-version-YYYY.mm.dd I.e., a heartbeat index will l… --- ## [Is it possible to load fresh data in elasticsearch index again and again using logstash](https://discuss.elastic.co/t/is-it-possible-to-load-fresh-data-in-elasticsearch-index-again-and-again-using-logstash/194184)
**Author:** [@amritaraj23](https://discuss.elastic.co/u/amritaraj23)\ **Replies:** 3\ **Last updated:** [August 7, 2019, 1:34pm UTC](https://discuss.elastic.co/t/is-it-possible-to-load-fresh-data-in-elasticsearch-index-again-and-again-using-logstash/194184 "2019-08-07T13:34:22Z")
Hi, I am new to logstash and elasticsearch. I have a query. I have a csv file and the data in the file will keep on changing after every 3 hours. Is it possible to load fresh data to elasticsearch index everytime and d… --- ## [\[HELP!\]prepare logs for ML](https://discuss.elastic.co/t/help-prepare-logs-for-ml/194232)
**Author:** [@c00ld](https://discuss.elastic.co/u/c00ld)\ **Replies:** 2\ **Last updated:** [August 7, 2019, 1:31pm UTC](https://discuss.elastic.co/t/help-prepare-logs-for-ml/194232 "2019-08-07T13:31:13Z")
Hello! I have logs from dns, i need prepare it to Machine Learning in url https://www.elastic.co/products/stack/machine-learning/recipes/dns-data-exfiltration-tunneling Have a field: "my.support.base.net" How to modi… --- ## [How much data can we keep or many months of log data do we retain in Elasticsearch?](https://discuss.elastic.co/t/how-much-data-can-we-keep-or-many-months-of-log-data-do-we-retain-in-elasticsearch/194106)
**Author:** [@Bjen\_Shah](https://discuss.elastic.co/u/Bjen_Shah)\ **Replies:** 1\ **Last updated:** [August 7, 2019, 1:25pm UTC](https://discuss.elastic.co/t/how-much-data-can-we-keep-or-many-months-of-log-data-do-we-retain-in-elasticsearch/194106 "2019-08-07T13:25:06Z")
Is it' okay to keep the all the 150 - 300 servers logs data on one cluster three node cluster ? if we can then how could we set up back up procedure or log rotation and what is best tools that I can use ? --- ## [Failed to recover from translog CurrentState\[CLOSED\]](https://discuss.elastic.co/t/failed-to-recover-from-translog-currentstate-closed/192529)
**Author:** [@Bukhtawar\_Khan](https://discuss.elastic.co/u/Bukhtawar_Khan)\ **Replies:** 2\ **Last updated:** [August 7, 2019, 12:51pm UTC](https://discuss.elastic.co/t/failed-to-recover-from-translog-currentstate-closed/192529 "2019-08-07T12:51:09Z")
The cluster has unassigned shards possibly due to shard corruption. The process on the node was flaky due to OOM errors and was frequently starting. Disk space was sufficient on the node. I'm yet to verify the hardware f… --- ## [Dedup Records According to Percentage](https://discuss.elastic.co/t/dedup-records-according-to-percentage/194025)
**Author:** [@Dawood\_Siddiq](https://discuss.elastic.co/u/Dawood_Siddiq)\ **Replies:** 7\ **Last updated:** [August 7, 2019, 12:44pm UTC](https://discuss.elastic.co/t/dedup-records-according-to-percentage/194025 "2019-08-07T12:44:17Z")
Greetings : I have Above than 1M records in ES. Now i want to dedup data on bases of percentage. For Example "Give me list of all records whose title are 90% matched or above". Lets take another example. "I need to retr… --- ## [I've been getting "retrying failed action with response code: 403" can someone help me fix this?](https://discuss.elastic.co/t/ive-been-getting-retrying-failed-action-with-response-code-403-can-someone-help-me-fix-this/194230)
**Author:** [@bharatwaj](https://discuss.elastic.co/u/bharatwaj)\ **Replies:** 1\ **Last updated:** [August 7, 2019, 12:36pm UTC](https://discuss.elastic.co/t/ive-been-getting-retrying-failed-action-with-response-code-403-can-someone-help-me-fix-this/194230 "2019-08-07T12:36:19Z")
I'm getting the following error "retrying failed action with response code: 403 ({"type"=\>"cluster\_block\_exception", "reason"=\>"index \[es\_attorney\] blocked by: \[FORBIDDEN/12/index read-only / allow delete (api)\];"})" C… --- ## [Elasticsearch two nodes config](https://discuss.elastic.co/t/elasticsearch-two-nodes-config/194193)
**Author:** [@khergner](https://discuss.elastic.co/u/khergner)\ **Replies:** 8\ **Last updated:** [August 7, 2019, 12:11pm UTC](https://discuss.elastic.co/t/elasticsearch-two-nodes-config/194193 "2019-08-07T12:11:19Z")
Hi everyone; I have a question for high availability System Info -5 different logs -Data size ~75 GB per daily -Total servers 2 nodes (1 master and node) -Daily Indices -ı use xms and xmx 8GB -Master = ram 56 GB … --- ## [How to keep syslog header when saving to file?](https://discuss.elastic.co/t/how-to-keep-syslog-header-when-saving-to-file/194130)
**Author:** [@dickens88](https://discuss.elastic.co/u/dickens88)\ **Replies:** 4\ **Last updated:** [August 7, 2019, 11:52am UTC](https://discuss.elastic.co/t/how-to-keep-syslog-header-when-saving-to-file/194130 "2019-08-07T11:52:13Z")
Guys, when I use logstash to input syslog and keep the message to file, I found it seems logstash won't keep syslog header. my configuration looks like this: input{ syslog { port =\> 1522 } } output{ … --- ## [Add Dev tools query on Discover](https://discuss.elastic.co/t/add-dev-tools-query-on-discover/193980)
**Author:** [@Kwiskas](https://discuss.elastic.co/u/Kwiskas)\ **Replies:** 2\ **Last updated:** [August 7, 2019, 7:29am UTC](https://discuss.elastic.co/t/add-dev-tools-query-on-discover/193980 "2019-08-07T07:29:45Z")
Hello I would like to add the dev tools console, or at least a response from a request on it on discover on Kibana, so that i can add it to a dashboard later Does anyone know how to do it? Thanks --- ## [Getting error in importing multiple collections from mongodb to elasticsearch 7.7.0](https://discuss.elastic.co/t/getting-error-in-importing-multiple-collections-from-mongodb-to-elasticsearch-7-7-0/194226)
**Author:** [@Kunal\_Adhikari](https://discuss.elastic.co/u/Kunal_Adhikari)\ **Replies:** 0\ **Last updated:** [August 7, 2019, 11:38am UTC](https://discuss.elastic.co/t/getting-error-in-importing-multiple-collections-from-mongodb-to-elasticsearch-7-7-0/194226 "2019-08-07T11:38:33Z")
\ ERRO\[0001\] \_bulk failed list \[0\] error="&elastic.ErrorDetails{Type:"illegal\_argument\_exception", Reason:"Rejecting mapping update to \[my\_application1\] as the final mapping would have more tha… --- ## [Deleting an index does not seem to delete external versioning](https://discuss.elastic.co/t/deleting-an-index-does-not-seem-to-delete-external-versioning/194091)
**Author:** [@Philiiiiiipp](https://discuss.elastic.co/u/Philiiiiiipp)\ **Replies:** 10\ **Last updated:** [August 7, 2019, 11:35am UTC](https://discuss.elastic.co/t/deleting-an-index-does-not-seem-to-delete-external-versioning/194091 "2019-08-07T11:35:01Z")
I am running into an issue using the external versioning where deleting the index does not seem to clear the external versioning for that given index. Steps to recreate: Create an index Put an item with id: 'someid',… --- ## [Handle timeouts with the syslog output](https://discuss.elastic.co/t/handle-timeouts-with-the-syslog-output/194194)
**Author:** [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\ **Replies:** 1\ **Last updated:** [August 7, 2019, 11:33am UTC](https://discuss.elastic.co/t/handle-timeouts-with-the-syslog-output/194194 "2019-08-07T11:33:46Z")
Hi, We have a use case of sending logs to two ELK stacks and letting the first ELK stack forward some events to a second ELK stack. So messages arrive at ELK-Stack1. Logstash receives the messages and outputs to its El… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1972) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1974)