# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1232 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1233 --- ## [\[Error v7.12.1\] High Level Rest Client async search doesn't work](https://discuss.elastic.co/t/error-v7-12-1-high-level-rest-client-async-search-doesnt-work/283745)
**Author:** [@str8y](https://discuss.elastic.co/u/str8y)\ **Replies:** 3\ **Last updated:** [September 21, 2021, 11:04am UTC](https://discuss.elastic.co/t/error-v7-12-1-high-level-rest-client-async-search-doesnt-work/283745 "2021-09-21T11:04:37Z")
When using asyncSearch for long running queries, results that I get from asyncSearch.get requests can't be parsed. It looks like the aggregation types are missing in the result, which leads to errors like: java.io.IOEx… --- ## [Elasticsearch 7.13.4 and 7.14.1 request memory higher than actual heap size](https://discuss.elastic.co/t/elasticsearch-7-13-4-and-7-14-1-request-memory-higher-than-actual-heap-size/284614)
**Author:** [@dimitris\_sb](https://discuss.elastic.co/u/dimitris_sb)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 11:02am UTC](https://discuss.elastic.co/t/elasticsearch-7-13-4-and-7-14-1-request-memory-higher-than-actual-heap-size/284614 "2021-09-21T11:02:27Z")
Hi All, Is there a case that the memory is consumed by elasticsearch requests (and the circuit breaker kicks in) but it is not shown in heap usage? The circuit breaker is 70% of the JVM heap and what we see makes no sen… --- ## [How to set Thread Pool settings for all data nodes in 7.14 Elastic cloud](https://discuss.elastic.co/t/how-to-set-thread-pool-settings-for-all-data-nodes-in-7-14-elastic-cloud/284473)
**Author:** [@rohitnagarro](https://discuss.elastic.co/u/rohitnagarro)\ **Replies:** 10\ **Last updated:** [September 21, 2021, 10:49am UTC](https://discuss.elastic.co/t/how-to-set-thread-pool-settings-for-all-data-nodes-in-7-14-elastic-cloud/284473 "2021-09-21T10:49:34Z")
Hi, We have 200K video assets on Elastic cloud, consuming 500mb of space on single node. Configuration wise we have 32 GB RAM Elasticsearch in 3 Zone Dedicated Master with 1GB RAM | 8 vCPU | 3 Zone Coordinating nod… --- ## [Massive queue in "refresh" thread pool on a single node, causing timeouts](https://discuss.elastic.co/t/massive-queue-in-refresh-thread-pool-on-a-single-node-causing-timeouts/280732)
**Author:** [@BradVido](https://discuss.elastic.co/u/BradVido)\ **Replies:** 18\ **Last updated:** [September 21, 2021, 10:34am UTC](https://discuss.elastic.co/t/massive-queue-in-refresh-thread-pool-on-a-single-node-causing-timeouts/280732 "2021-09-21T10:34:03Z")
This is a difficult one because it only happens randomly, I can't figure out a way to reproduce it consistently. What happens is I'll notice a lot of timeouts trying to index to the cluster, and what I've found that s… --- ## [HTTP request in Ingest Pipeline](https://discuss.elastic.co/t/http-request-in-ingest-pipeline/284698)
**Author:** [@painless\_elastic](https://discuss.elastic.co/u/painless_elastic)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 10:24am UTC](https://discuss.elastic.co/t/http-request-in-ingest-pipeline/284698 "2021-09-21T10:24:46Z")
Hi, I have a document like the below, { "result":{ "id":"1", "date":"2020-03-31", "title":"Wait for It", "artist":"Leslie Odom Jr.", "spotify\_url":"https://open.spotify.com/track/7EqpEB… --- ## [Painless Scripting](https://discuss.elastic.co/t/painless-scripting/284366)
**Author:** [@painless\_elastic](https://discuss.elastic.co/u/painless_elastic)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 9:53am UTC](https://discuss.elastic.co/t/painless-scripting/284366 "2021-09-21T09:53:54Z")
Hi All, I am new to elastic search and trying to use ingest pipeline for modifying documents. I have a field in the document as JSON Array, I want to convert that into a string (Stringify JSON) and then save it into a … --- ## [Pro and cons between using daily and monthly indexes?](https://discuss.elastic.co/t/pro-and-cons-between-using-daily-and-monthly-indexes/284613)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 11\ **Last updated:** [September 21, 2021, 8:47am UTC](https://discuss.elastic.co/t/pro-and-cons-between-using-daily-and-monthly-indexes/284613 "2021-09-21T08:47:32Z")
Hello Following the advice given here (thank you), in a few months, Ill be able to reduce the total shards in my Elastic Stack single node from aprox 5000 to 160. This will generally give it better performance and not … --- ## [Could Not Index event to Elasticsearch](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch/284295)
**Author:** [@dayajamal](https://discuss.elastic.co/u/dayajamal)\ **Replies:** 3\ **Last updated:** [September 21, 2021, 8:27am UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch/284295 "2021-09-21T08:27:17Z")
Hello, I am running Logstash with 11 pipelines for 9 different log types, when I send those logs from Filebeat to Logstash, I tail the Logstash logs and get this error. Nonetheless, in Elasticsearch and Kibana I receive … --- ## [Search working only for case sensitive data while using SQL-ES LIKE](https://discuss.elastic.co/t/search-working-only-for-case-sensitive-data-while-using-sql-es-like/284646)
**Author:** [@Sammeta\_David\_Raju](https://discuss.elastic.co/u/Sammeta_David_Raju)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 7:19am UTC](https://discuss.elastic.co/t/search-working-only-for-case-sensitive-data-while-using-sql-es-like/284646 "2021-09-21T07:19:13Z")
Hi , I am trying to search a Text field using SQL-ES with LIKE here is the sample code GET /\_sql { "query":""select \* from indexname where customer LIKE '%AR-D'" } here I am getting resultset only AR-D ,but i want a… --- ## [Match Query Fuzziness](https://discuss.elastic.co/t/match-query-fuzziness/284633)
**Author:** [@emreorucoglu](https://discuss.elastic.co/u/emreorucoglu)\ **Replies:** 3\ **Last updated:** [September 21, 2021, 8:00am UTC](https://discuss.elastic.co/t/match-query-fuzziness/284633 "2021-09-21T08:00:22Z")
Hi everyone, I'm running into a problem when searching with fuzziness in a match query. The name I want to find is "Şaban Dişli", as seen in the images below, I am querying. But I am not getting results for some queries… --- ## [Restore from a 3-Node cluster to a stand alone cluster](https://discuss.elastic.co/t/restore-from-a-3-node-cluster-to-a-stand-alone-cluster/284670)
**Author:** [@alpot](https://discuss.elastic.co/u/alpot)\ **Replies:** 3\ **Last updated:** [September 21, 2021, 7:56am UTC](https://discuss.elastic.co/t/restore-from-a-3-node-cluster-to-a-stand-alone-cluster/284670 "2021-09-21T07:56:01Z")
I have a test environment with a 3-node cluster and a stand alone cluster. I created an index ('products') in the 3-node cluster and then performed a snapshot. I deleted the index and then use restore API to restore it… --- ## [Debug Kibana in Docker container](https://discuss.elastic.co/t/debug-kibana-in-docker-container/284688)
**Author:** [@masterThomas](https://discuss.elastic.co/u/masterThomas)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 7:54am UTC](https://discuss.elastic.co/t/debug-kibana-in-docker-container/284688 "2021-09-21T07:54:11Z")
Hi team, What a simpliest way to debug Kibana and custom apps in Docker container? I'm trying to print logs from my app in Kibana Docker, but it's empty. Although, in Kibana dev version all code prints its logs into co… --- ## [Guidance on Configuring an ELK Stack using seperate hosts for Logstash, Elastic (Master, Data, Ingest) and Kibana](https://discuss.elastic.co/t/guidance-on-configuring-an-elk-stack-using-seperate-hosts-for-logstash-elastic-master-data-ingest-and-kibana/284654)
**Author:** [@hazenvs](https://discuss.elastic.co/u/hazenvs)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 7:38am UTC](https://discuss.elastic.co/t/guidance-on-configuring-an-elk-stack-using-seperate-hosts-for-logstash-elastic-master-data-ingest-and-kibana/284654 "2021-09-21T07:38:40Z")
I'm looking to confiugre an ELK stack using the following seperated VM's for cost and scaling in a CSP. Lselk.gtld. (Logstash) Melk.gtld. (Master) Ielk.gtld. (Ingest) Delk.gtld (hot\_data) Wdelk.gtld (warm\_data) Kel… --- ## [Targeting elasticsearch](https://discuss.elastic.co/t/targeting-elasticsearch/284684)
**Author:** [@gunlomboy](https://discuss.elastic.co/u/gunlomboy)\ **Replies:** 4\ **Last updated:** [September 21, 2021, 7:14am UTC](https://discuss.elastic.co/t/targeting-elasticsearch/284684 "2021-09-21T07:14:36Z")
Hi, We run a small cluster, 2 x master, 4 x data, 2 x ingest in addition to a number of logstash servers. Can someone confirm that we are targeting the correct elasticsearch nodes from kibana and beats. From kibana (e… --- ## [Configure Charset used by Elasticsearch to minimize storage and boost searches](https://discuss.elastic.co/t/configure-charset-used-by-elasticsearch-to-minimize-storage-and-boost-searches/284679)
**Author:** [@FloFire](https://discuss.elastic.co/u/FloFire)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 7:03am UTC](https://discuss.elastic.co/t/configure-charset-used-by-elasticsearch-to-minimize-storage-and-boost-searches/284679 "2021-09-21T07:03:34Z")
Hi all, I'am currently try to use elastic to store a huge amount of text. I do not need UTF things I'am would be fine with ASCII. Also I would be fine if all chars are lower case because I dont care about uppercase and … --- ## [Dropdown in canvas does not filter visualization from 'Add from Kibana"](https://discuss.elastic.co/t/dropdown-in-canvas-does-not-filter-visualization-from-add-from-kibana/284631)
**Author:** [@MTV](https://discuss.elastic.co/u/MTV)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 7:01am UTC](https://discuss.elastic.co/t/dropdown-in-canvas-does-not-filter-visualization-from-add-from-kibana/284631 "2021-09-21T07:01:49Z")
Hi, I am working with canvas where I have several visualizations and a dropdown. I imported a treemap from lens to canvas but the treemap is not being filtered by the canvas dropdown. Am I missing something, or is this … --- ## [Kibana - strange behavior using search on long field](https://discuss.elastic.co/t/kibana-strange-behavior-using-search-on-long-field/284628)
**Author:** [@JimJ](https://discuss.elastic.co/u/JimJ)\ **Replies:** 8\ **Last updated:** [September 21, 2021, 6:53am UTC](https://discuss.elastic.co/t/kibana-strange-behavior-using-search-on-long-field/284628 "2021-09-21T06:53:44Z")
Hi, I am using an Elastic+Logstash+kibana 7.12 stack. And I get a very strange behavior. I send log files using filebeat to logstash. Log files contain lines in json format. logstash parses them using the std json f… --- ## [How to Convert array fields from beats to compatible array fields of Splunk HEC input viai Logstash](https://discuss.elastic.co/t/how-to-convert-array-fields-from-beats-to-compatible-array-fields-of-splunk-hec-input-viai-logstash/284683)
**Author:** [@sibiv196](https://discuss.elastic.co/u/sibiv196)\ **Replies:** 0\ **Last updated:** [September 21, 2021, 6:33am UTC](https://discuss.elastic.co/t/how-to-convert-array-fields-from-beats-to-compatible-array-fields-of-splunk-hec-input-viai-logstash/284683 "2021-09-21T06:33:46Z")
This is the logstash output to splunk HEC input event endpoint. "fields":"{\\"netcool\_fields\_community\\":\\"AGENT\_HB\\",\\"metric\_name:status\\":1}"}" I am not sure what is failing . Events are not getting indexed to metric… --- ## [What is the best way to represent a data using grok when an emailid is inside a quoted string?](https://discuss.elastic.co/t/what-is-the-best-way-to-represent-a-data-using-grok-when-an-emailid-is-inside-a-quoted-string/284673)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 6:19am UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-represent-a-data-using-grok-when-an-emailid-is-inside-a-quoted-string/284673 "2021-09-21T06:19:07Z")
We have got the predefined grok expressions EMAILADDRESS and QUOTEDSTRING available in elasticsearch/kibana In my log I have the pattern fromemailid="shi@gmail.com" toemailid="ela@gmail.com" What is the best way to r… --- ## [Multi - term aggregation with Flat field and nested aggregation](https://discuss.elastic.co/t/multi-term-aggregation-with-flat-field-and-nested-aggregation/284601)
**Author:** [@Balaji\_Arun](https://discuss.elastic.co/u/Balaji_Arun)\ **Replies:** 0\ **Last updated:** [September 20, 2021, 8:20am UTC](https://discuss.elastic.co/t/multi-term-aggregation-with-flat-field-and-nested-aggregation/284601 "2021-09-20T08:20:11Z")
Hi Guys, I just need a multi-term aggregation that has two fields "field1" and "nestedField" doc structure - { field1:"", field:{ nestedField:"" } } But don't know how to construct a query, need your help Thanks in … --- ## [Mapping geo\_shape dynamically](https://discuss.elastic.co/t/mapping-geo-shape-dynamically/284483)
**Author:** [@dersmon](https://discuss.elastic.co/u/dersmon)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 6:04am UTC](https://discuss.elastic.co/t/mapping-geo-shape-dynamically/284483 "2021-09-21T06:04:26Z")
I struggle to find a generic mapping for my GeoJSON data in 7.14.0. My documents are created using a composition pattern. This results in a collection document types that may have a field "geometry" containing GeoJSON G… --- ## [Getting Error 502,{"ok":false,"message":"backend closed connection"} for enriching fields to another index](https://discuss.elastic.co/t/getting-error-502-ok-false-message-backend-closed-connection-for-enriching-fields-to-another-index/284637)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 5:31am UTC](https://discuss.elastic.co/t/getting-error-502-ok-false-message-backend-closed-connection-for-enriching-fields-to-another-index/284637 "2021-09-21T05:31:42Z")
Hi, I have two index 1.ther 2.part. "ther" index has 24 fields, ''part" index has 19 fields. I have to enrich "ther" index with "part" index fields. Field "user\_id" is common between two indexes. Using enrich process… --- ## [Moving fields to root](https://discuss.elastic.co/t/moving-fields-to-root/283663)
**Author:** [@vijay\_kaali](https://discuss.elastic.co/u/vijay_kaali)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 5:14am UTC](https://discuss.elastic.co/t/moving-fields-to-root/283663 "2021-09-21T05:14:33Z")
i have metricbeat installed and for desupported version RHEL 4 we collect it via custom script we ingest them with type name devbeat and in elk it is showing all fields prefixed with devbeat. how to avoid prefixing … --- ## [Deploy ELK platinum in on-prem server](https://discuss.elastic.co/t/deploy-elk-platinum-in-on-prem-server/284452)
**Author:** [@EdisonDevadoss](https://discuss.elastic.co/u/EdisonDevadoss)\ **Replies:** 5\ **Last updated:** [September 21, 2021, 5:00am UTC](https://discuss.elastic.co/t/deploy-elk-platinum-in-on-prem-server/284452 "2021-09-21T05:00:01Z")
Hi Team, If we go for platinum subscription for ELK stack, can we deploy it on-prem server? I need your help. --- ## [Default Nginx access log pipeline does not process all user-agents from Logs](https://discuss.elastic.co/t/default-nginx-access-log-pipeline-does-not-process-all-user-agents-from-logs/284488)
**Author:** [@Nishad\_Angre](https://discuss.elastic.co/u/Nishad_Angre)\ **Replies:** 0\ **Last updated:** [September 17, 2021, 1:47pm UTC](https://discuss.elastic.co/t/default-nginx-access-log-pipeline-does-not-process-all-user-agents-from-logs/284488 "2021-09-17T13:47:10Z")
Hi, I have configured a Nginx access log with filebeat using default pipeline. I am using elasticsearch version 7.14.1 This pipeline however does not parse all the user-agents which come from nginx logs. PFB few examp… --- ## [Is there a way to visualize the scoring (for a non coder guy)?](https://discuss.elastic.co/t/is-there-a-way-to-visualize-the-scoring-for-a-non-coder-guy/284621)
**Author:** [@Smyken](https://discuss.elastic.co/u/Smyken)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 1:27am UTC](https://discuss.elastic.co/t/is-there-a-way-to-visualize-the-scoring-for-a-non-coder-guy/284621 "2021-09-21T01:27:42Z")
Hi all As a non coder (but responsible for our site) I am curios what scores our elastic search are using when ranking search terms (is that the correct wording?). I often get questions from my colleges why a specific … --- ## [How to handle different spellings of names?](https://discuss.elastic.co/t/how-to-handle-different-spellings-of-names/284622)
**Author:** [@Smyken](https://discuss.elastic.co/u/Smyken)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 1:17am UTC](https://discuss.elastic.co/t/how-to-handle-different-spellings-of-names/284622 "2021-09-21T01:17:17Z")
As a no coding person I´m trying to figure out which approach that is the best to handle person names with different spellings. Like my name that can be spelled Michael, Mickael, or Mikael. Or names like Desiré that peo… --- ## [Understanding HTTP\_Poller](https://discuss.elastic.co/t/understanding-http-poller/284639)
**Author:** [@tofubeats](https://discuss.elastic.co/u/tofubeats)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 1:13am UTC](https://discuss.elastic.co/t/understanding-http-poller/284639 "2021-09-21T01:13:06Z")
Hi, if I were to use HTTP\_Poller plugin on a logstash instance to query an ES API on another machine, would it hit the transport interface or the HTTP interface? Thank you! --- ## [Best practice for JSON logging (e.g. timestamp processing)](https://discuss.elastic.co/t/best-practice-for-json-logging-e-g-timestamp-processing/284472)
**Author:** [@crazylogging](https://discuss.elastic.co/u/crazylogging)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 1:04am UTC](https://discuss.elastic.co/t/best-practice-for-json-logging-e-g-timestamp-processing/284472 "2021-09-21T01:04:59Z")
Hi, I'm quite new to the elastic stack so please excuse the question if it doesn't make any sense. I've got an application (let's call it JBoss) which runs in a docker container (all components in my scenario do so) an… --- ## [Kibana pod lost index pattern and dashboards after deleting pod](https://discuss.elastic.co/t/kibana-pod-lost-index-pattern-and-dashboards-after-deleting-pod/284449)
**Author:** [@humartinez](https://discuss.elastic.co/u/humartinez)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 12:55am UTC](https://discuss.elastic.co/t/kibana-pod-lost-index-pattern-and-dashboards-after-deleting-pod/284449 "2021-09-21T00:55:48Z")
Hi, I just delete the kibana pod that I build with eck and I lost all the dashboards and index patterns that I've created. I thought that that info was loaded in the .kibana index. Its theres a way that I can recover th… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1231) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1233)