# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1137 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1138 --- ## [How to include some values and exclude some others on the same field?](https://discuss.elastic.co/t/how-to-include-some-values-and-exclude-some-others-on-the-same-field/291020)
**Author:** [@Huseyin\_Tunctepe](https://discuss.elastic.co/u/Huseyin_Tunctepe)\ **Replies:** 4\ **Last updated:** [December 7, 2021, 8:10am UTC](https://discuss.elastic.co/t/how-to-include-some-values-and-exclude-some-others-on-the-same-field/291020 "2021-12-07T08:10:36Z")
I have written a Lucene query and a KQL to show "puppet-disabled" and exclude values that contain "CHG", "INC" and "EXC" in the message field. However, all returned results include "puppet-disabled" text and the supposed… --- ## [Junit test for High level rest client query](https://discuss.elastic.co/t/junit-test-for-high-level-rest-client-query/291099)
**Author:** [@111505](https://discuss.elastic.co/u/111505)\ **Replies:** 0\ **Last updated:** [December 7, 2021, 7:58am UTC](https://discuss.elastic.co/t/junit-test-for-high-level-rest-client-query/291099 "2021-12-07T07:58:56Z")
Hello. I want to test Elasticsearch query in java Junit. It seems to be possible to use a test container, but the Elasticsearch documentation does not seem to provide it officially. doc: https://www.elastic.co/guide/e… --- ## [Does filebeat re-read the same .log file in a different directory?](https://discuss.elastic.co/t/does-filebeat-re-read-the-same-log-file-in-a-different-directory/290953)
**Author:** [@OAHstasy](https://discuss.elastic.co/u/OAHstasy)\ **Replies:** 2\ **Last updated:** [December 7, 2021, 7:06am UTC](https://discuss.elastic.co/t/does-filebeat-re-read-the-same-log-file-in-a-different-directory/290953 "2021-12-07T07:06:23Z")
Filebeat version: 7.15 OS: Windows 10 Hello everyone, Let me give you people a short description about my situtation: I configured my filebeat to read all .log files in "\\path\_to\_logs\\logs\\ \* \\ \*.log." My program tha… --- ## [Elasticsearch rescore plugin how to get query object from context?](https://discuss.elastic.co/t/elasticsearch-rescore-plugin-how-to-get-query-object-from-context/291094)
**Author:** [@oni7uka](https://discuss.elastic.co/u/oni7uka)\ **Replies:** 0\ **Last updated:** [December 7, 2021, 6:44am UTC](https://discuss.elastic.co/t/elasticsearch-rescore-plugin-how-to-get-query-object-from-context/291094 "2021-12-07T06:44:32Z")
I want to write a custom Elasticsearch rescore plugin, Similar to using Levenshtein algorithm to calculate the similarity between the original query string and the query result. But how do I get the query object? It seem… --- ## [Single word suggester or autocomplete single word](https://discuss.elastic.co/t/single-word-suggester-or-autocomplete-single-word/290754)
**Author:** [@pranjali\_dhumal](https://discuss.elastic.co/u/pranjali_dhumal)\ **Replies:** 8\ **Last updated:** [December 7, 2021, 6:27am UTC](https://discuss.elastic.co/t/single-word-suggester-or-autocomplete-single-word/290754 "2021-12-07T06:27:20Z")
Hello Everyone, Problem: Lets consider I have a index for books And I have following book documents with name "Manage your time" "Improvement management skills" "The making of manager" "How to manage people" "Man… --- ## [Pipeline/output.go:154 Failed to connect to backoff](https://discuss.elastic.co/t/pipeline-output-go-154-failed-to-connect-to-backoff/290767)
**Author:** [@abhi.logs](https://discuss.elastic.co/u/abhi.logs)\ **Replies:** 10\ **Last updated:** [December 7, 2021, 5:03am UTC](https://discuss.elastic.co/t/pipeline-output-go-154-failed-to-connect-to-backoff/290767 "2021-12-07T05:03:31Z")
Hello, I'm getting this error, does anyone knows how to solve this? ERROR \[publisher\_pipeline\_output\] pipeline/output.go:154 Failed to connect to backoff(elasticsearch(https://xxxxxx:9200)): Connection marked as failed… --- ## [Request without field - Case insensitive mystery](https://discuss.elastic.co/t/request-without-field-case-insensitive-mystery/290852)
**Author:** [@Florent\_Fauvin](https://discuss.elastic.co/u/Florent_Fauvin)\ **Replies:** 2\ **Last updated:** [December 7, 2021, 4:08am UTC](https://discuss.elastic.co/t/request-without-field-case-insensitive-mystery/290852 "2021-12-07T04:08:33Z")
Hello ! I have a mystery I can't explain. Request : process.name:calc.exe \> 9 hits Request : process.name:CALC.exe \> 0 hits Request : CALC.exe (just it) \> 11 hits (included the 9 previous hits ) When I do a request w… --- ## [Grok parsing in logstash for Windows DNS Debug Log](https://discuss.elastic.co/t/grok-parsing-in-logstash-for-windows-dns-debug-log/291085)
**Author:** [@craign30](https://discuss.elastic.co/u/craign30)\ **Replies:** 11\ **Last updated:** [December 7, 2021, 3:53am UTC](https://discuss.elastic.co/t/grok-parsing-in-logstash-for-windows-dns-debug-log/291085 "2021-12-07T03:53:17Z")
I'm using grok in Logstash (7.8.0) to parse data from a Windows Server (2019) DNS debug log (sent via filebeat) using the statement below. Most of the time, the data gets parsed correctly and fields are populated and vi… --- ## [Search\_phase\_execution\_error with script\_Score n cosine similarity ES 7.15.2](https://discuss.elastic.co/t/search-phase-execution-error-with-script-score-n-cosine-similarity-es-7-15-2/291068)
**Author:** [@Nikkie](https://discuss.elastic.co/u/Nikkie)\ **Replies:** 0\ **Last updated:** [December 6, 2021, 3:53pm UTC](https://discuss.elastic.co/t/search-phase-execution-error-with-script-score-n-cosine-similarity-es-7-15-2/291068 "2021-12-06T15:53:11Z")
Greetings! I had started with my Elasticsearch journey with 7.10.1 and could successfully run script\_score queries with cosine\_similarity earlier. But now when I am using 7.15 I get stuck with this error "Elasticsearch.e… --- ## [A question on throttling the alerts](https://discuss.elastic.co/t/a-question-on-throttling-the-alerts/288833)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 3\ **Last updated:** [December 6, 2021, 11:51pm UTC](https://discuss.elastic.co/t/a-question-on-throttling-the-alerts/288833 "2021-12-06T23:51:20Z")
Hi, Right now I have an alert configured which triggers every 5 mins. However it monitors if an error of a particular type has occured over last 24 hours. It sends emails and in ideal case the throttle period will be 2… --- ## [Zendesk to elastic](https://discuss.elastic.co/t/zendesk-to-elastic/291026)
**Author:** [@travlest](https://discuss.elastic.co/u/travlest)\ **Replies:** 1\ **Last updated:** [December 6, 2021, 9:59pm UTC](https://discuss.elastic.co/t/zendesk-to-elastic/291026 "2021-12-06T21:59:17Z")
Hi, is there any documentation on how to send data from zendesk to elastic? what I mean is, I want to display every ticket that has been closed/open from zendesk into kibana. thank you --- ## [Fast copy indexes between two deployments](https://discuss.elastic.co/t/fast-copy-indexes-between-two-deployments/291051)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 1\ **Last updated:** [December 6, 2021, 9:58pm UTC](https://discuss.elastic.co/t/fast-copy-indexes-between-two-deployments/291051 "2021-12-06T21:58:22Z")
Hi I've tried to copy in the fast way indexes (of count 25 per ~40GB each of them) I see that copy it over elasticdump it goes too very slow. How can I increase performance??? another thing is how to use a wildcard f… --- ## [Elastic access via PHP](https://discuss.elastic.co/t/elastic-access-via-php/291083)
**Author:** [@Franke2u](https://discuss.elastic.co/u/Franke2u)\ **Replies:** 0\ **Last updated:** [December 6, 2021, 8:53pm UTC](https://discuss.elastic.co/t/elastic-access-via-php/291083 "2021-12-06T20:53:38Z")
Using PHP I can search and find data using the below command: $obj = $client-\>search($params); I add data using Logstash. But unable to use other commands like get and update: $obj = $client-\>get($params2); $obj = $… --- ## [Not able to login into the Kibana](https://discuss.elastic.co/t/not-able-to-login-into-the-kibana/291014)
**Author:** [@wizard](https://discuss.elastic.co/u/wizard)\ **Replies:** 4\ **Last updated:** [December 6, 2021, 8:46pm UTC](https://discuss.elastic.co/t/not-able-to-login-into-the-kibana/291014 "2021-12-06T20:46:23Z")
Hello, When I am trying to login into the kibana, it's sending me an error "Oops! Error. Try again.". I have checked my storage also it's only 92% in use. Please suggest me. --- ## [Search\_after performance compared to querying with \_search](https://discuss.elastic.co/t/search-after-performance-compared-to-querying-with-search/291080)
**Author:** [@Praveen\_Balaji](https://discuss.elastic.co/u/Praveen_Balaji)\ **Replies:** 0\ **Last updated:** [December 6, 2021, 8:24pm UTC](https://discuss.elastic.co/t/search-after-performance-compared-to-querying-with-search/291080 "2021-12-06T20:24:39Z")
Our code switches over to search\_after past a threshold (10\_000). I'm considering switching to using search\_after always, irrespective of the size. Is there a loss in performance between plain search and search\_after? P… --- ## [Error on index template creation: "composable template \[...\] template after composition is invalid"](https://discuss.elastic.co/t/error-on-index-template-creation-composable-template-template-after-composition-is-invalid/291076)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 1\ **Last updated:** [December 6, 2021, 8:07pm UTC](https://discuss.elastic.co/t/error-on-index-template-creation-composable-template-template-after-composition-is-invalid/291076 "2021-12-06T20:07:57Z")
Subject really says it all. version 7.14 The cluster is new and has just one node for testing and this is the first datastream I have tried to create. One thing that is puzzling me is what does it mean by "composable … --- ## [Syslog filter issue with timestamp](https://discuss.elastic.co/t/syslog-filter-issue-with-timestamp/290468)
**Author:** [@mylvestre](https://discuss.elastic.co/u/mylvestre)\ **Replies:** 12\ **Last updated:** [December 6, 2021, 6:54pm UTC](https://discuss.elastic.co/t/syslog-filter-issue-with-timestamp/290468 "2021-12-06T18:54:22Z")
Greetings, I'm having an issue where my syslog is parsing the wrong date format. I get the following in Elastic: yyyy-11-Mo 11:37:17, while I get the following error in logstash: \[2021-11-29T11:34:43,644\]\[WARN \]\[logsta… --- ## [Filter basic file with Logstash](https://discuss.elastic.co/t/filter-basic-file-with-logstash/290991)
**Author:** [@algira37](https://discuss.elastic.co/u/algira37)\ **Replies:** 3\ **Last updated:** [December 6, 2021, 6:21pm UTC](https://discuss.elastic.co/t/filter-basic-file-with-logstash/290991 "2021-12-06T18:21:16Z")
Hello, I have a blocklist.txt which contains IP address in the following structure: 192.168.100.77 192.168.100.66 How can I create JSON with Logstash with a similar output: { IP: 192.168.100.77, IP: 192.168.100.66 … --- ## [org.elasticsearch.ElasticsearchStatusException: Unable to parse response body](https://discuss.elastic.co/t/org-elasticsearch-elasticsearchstatusexception-unable-to-parse-response-body/291075)
**Author:** [@ksmamta](https://discuss.elastic.co/u/ksmamta)\ **Replies:** 0\ **Last updated:** [December 6, 2021, 6:07pm UTC](https://discuss.elastic.co/t/org-elasticsearch-elasticsearchstatusexception-unable-to-parse-response-body/291075 "2021-12-06T18:07:02Z")
Hi, Facing the below error quite frequently with Rest High level client. version of rest client and Elasticsearch jar is 7.3.2 and ES cluster version is 7.5.2. Any clue to find the root cause? why this error comes? o… --- ## [Day of the week with non UTC timestamps](https://discuss.elastic.co/t/day-of-the-week-with-non-utc-timestamps/291066)
**Author:** [@Malec](https://discuss.elastic.co/u/Malec)\ **Replies:** 1\ **Last updated:** [December 6, 2021, 5:51pm UTC](https://discuss.elastic.co/t/day-of-the-week-with-non-utc-timestamps/291066 "2021-12-06T17:51:46Z")
Hi everyone, I have logs in a dd/MM/YYYY HH:mm:ss format using the CET timezone, and I am trying to extract the Day of the week for CET and not UTC. We used this at first date { match =\> \[ "date", "dd/MM/YYYY HH:mm:… --- ## [How to set network.host to listen to IPv6 as well?](https://discuss.elastic.co/t/how-to-set-network-host-to-listen-to-ipv6-as-well/290923)
**Author:** [@houmie](https://discuss.elastic.co/u/houmie)\ **Replies:** 3\ **Last updated:** [December 6, 2021, 3:59pm UTC](https://discuss.elastic.co/t/how-to-set-network-host-to-listen-to-ipv6-as-well/290923 "2021-12-06T15:59:53Z")
Hello, After struggling for hours why Filebeat can't connect to ES, I realised that this setting in elasticsearch.yaml is the culprit. It is only listening to IPv4 and not IPv6. network.host: 0.0.0.0 I tried many d… --- ## [How to know which GeoPoint is hit while sorting on GeoPoint field containing multiple points](https://discuss.elastic.co/t/how-to-know-which-geopoint-is-hit-while-sorting-on-geopoint-field-containing-multiple-points/291052)
**Author:** [@Asif\_Mahmood](https://discuss.elastic.co/u/Asif_Mahmood)\ **Replies:** 0\ **Last updated:** [December 6, 2021, 2:08pm UTC](https://discuss.elastic.co/t/how-to-know-which-geopoint-is-hit-while-sorting-on-geopoint-field-containing-multiple-points/291052 "2021-12-06T14:08:14Z")
HI, I am new at using Elasticsearch. I have an index which has the GeoPoint field "Location" and each document can contains multiple points which are stored in GeoPoint field as array. Now, when I sort on the basis of t… --- ## [How to parse timestamp windows event log](https://discuss.elastic.co/t/how-to-parse-timestamp-windows-event-log/291043)
**Author:** [@Roccof97](https://discuss.elastic.co/u/Roccof97)\ **Replies:** 3\ **Last updated:** [December 6, 2021, 2:07pm UTC](https://discuss.elastic.co/t/how-to-parse-timestamp-windows-event-log/291043 "2021-12-06T14:07:23Z")
Hello to all, I have a problem with parsing this field(event.created) with the timestamp, here is the screen: this is the filter I created: thanks --- ## [Map keyword values for display](https://discuss.elastic.co/t/map-keyword-values-for-display/291042)
**Author:** [@Senor\_K2n](https://discuss.elastic.co/u/Senor_K2n)\ **Replies:** 2\ **Last updated:** [December 6, 2021, 1:54pm UTC](https://discuss.elastic.co/t/map-keyword-values-for-display/291042 "2021-12-06T13:54:31Z")
Hi, I'm relatively new to working with ELK, and I haven't found a response to this question yet. For storage optimization reasons, I want to use some aliases in my input files to store fixed values. However I would li… --- ## [Prometheus queries fail if a source only snapshot was restored](https://discuss.elastic.co/t/prometheus-queries-fail-if-a-source-only-snapshot-was-restored/291046)
**Author:** [@str8y](https://discuss.elastic.co/u/str8y)\ **Replies:** 0\ **Last updated:** [December 6, 2021, 1:30pm UTC](https://discuss.elastic.co/t/prometheus-queries-fail-if-a-source-only-snapshot-was-restored/291046 "2021-12-06T13:30:00Z")
As part of our backup strategy, we are using source only repos and snapshots. As soon as such a snapshot is restored, the prometheus queries fail. Is there any chance to filter / skip these indices for the metrics? \[2… --- ## [Logstash output plugin for azure eventhub](https://discuss.elastic.co/t/logstash-output-plugin-for-azure-eventhub/291035)
**Author:** [@Mye1988](https://discuss.elastic.co/u/Mye1988)\ **Replies:** 0\ **Last updated:** [December 6, 2021, 11:59am UTC](https://discuss.elastic.co/t/logstash-output-plugin-for-azure-eventhub/291035 "2021-12-06T11:59:12Z")
Hello Everyone, I need to use logstash for sending data to Azure Event Hub.As much as I found, there is only an input plugin for reading data from Azure Hub. Is there a logstash output plugin for sending data to Azure … --- ## [Api/index\_patterns/\_fields\_for\_wildcard crashes Elasticsearch](https://discuss.elastic.co/t/api-index-patterns-fields-for-wildcard-crashes-elasticsearch/290908)
**Author:** [@rilcy](https://discuss.elastic.co/u/rilcy)\ **Replies:** 4\ **Last updated:** [December 6, 2021, 11:34am UTC](https://discuss.elastic.co/t/api-index-patterns-fields-for-wildcard-crashes-elasticsearch/290908 "2021-12-06T11:34:13Z")
Hi everyone, Could not find any post relating the problem i encounter so i here it is: Since a while i am unable to use Discover tab in Kibana ; when i try to, it basically crashes the Elasticsearch coordinating node w… --- ## [Filebeat decode\_json\_fields failed](https://discuss.elastic.co/t/filebeat-decode-json-fields-failed/291019)
**Author:** [@haoma2514](https://discuss.elastic.co/u/haoma2514)\ **Replies:** 0\ **Last updated:** [December 6, 2021, 8:25am UTC](https://discuss.elastic.co/t/filebeat-decode-json-fields-failed/291019 "2021-12-06T08:25:25Z")
If the length of the message above is greater than 1116, it will be lost after formatting! When using filebeat decode\_json\_fields to parse json object, if the field content of json key is too long, it will be discarde… --- ## [New Elasticsearch installation takes all memory during the startup results get killed by OOM (7.15.2)](https://discuss.elastic.co/t/new-elasticsearch-installation-takes-all-memory-during-the-startup-results-get-killed-by-oom-7-15-2/291010)
**Author:** [@cryonix\_pod](https://discuss.elastic.co/u/cryonix_pod)\ **Replies:** 6\ **Last updated:** [December 6, 2021, 10:57am UTC](https://discuss.elastic.co/t/new-elasticsearch-installation-takes-all-memory-during-the-startup-results-get-killed-by-oom-7-15-2/291010 "2021-12-06T10:57:08Z")
I was trying to install Elasticsearch last few hours and I was unable to do so. It turns out systemd got timed out trying to start the elasticsearch service. Initially I was trying to install it in a vm of 2 Gig mem (ora… --- ## [Rally 2.3.0 now throwing "should include an inner object describing the mapping" but 2.2.1 was fine?](https://discuss.elastic.co/t/rally-2-3-0-now-throwing-should-include-an-inner-object-describing-the-mapping-but-2-2-1-was-fine/290714)
**Author:** [@ddtombb](https://discuss.elastic.co/u/ddtombb)\ **Replies:** 3\ **Last updated:** [December 6, 2021, 10:28am UTC](https://discuss.elastic.co/t/rally-2-3-0-now-throwing-should-include-an-inner-object-describing-the-mapping-but-2-2-1-was-fine/290714 "2021-12-06T10:28:33Z")
Hey, when I was running rally on 2.2.1 it would run fine without issue but as I'm not specifying a version to use it picked up the latest 2.3.0 and now on run is throwing the following, but I don't get how the templates … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1136) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1138)