# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1238 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1239 --- ## [How to do a multi match that sorts all matches of one field before another field?](https://discuss.elastic.co/t/how-to-do-a-multi-match-that-sorts-all-matches-of-one-field-before-another-field/284313)
**Author:** [@maurienvy](https://discuss.elastic.co/u/maurienvy)\ **Replies:** 0\ **Last updated:** [September 15, 2021, 4:52pm UTC](https://discuss.elastic.co/t/how-to-do-a-multi-match-that-sorts-all-matches-of-one-field-before-another-field/284313 "2021-09-15T16:52:56Z")
Hello everyone! I am trying to build a search query for an e commerce, I have two requests that I will explain to detail: A) I want to sort results depending on if a search term is on one field or another. The use case… --- ## [Logstash filter plugin development](https://discuss.elastic.co/t/logstash-filter-plugin-development/284306)
**Author:** [@wssnetwork](https://discuss.elastic.co/u/wssnetwork)\ **Replies:** 0\ **Last updated:** [September 15, 2021, 3:44pm UTC](https://discuss.elastic.co/t/logstash-filter-plugin-development/284306 "2021-09-15T15:44:30Z")
Hello team. I would like to develop Logstash filter plugin. During build the gem file I got error as below: FAILURE: Build failed with an exception. \* Where: Script '/home/kali/github/logstash/rubyUtils.gradle' line: 2… --- ## [Fleet API vs Fleet UI](https://discuss.elastic.co/t/fleet-api-vs-fleet-ui/283918)
**Author:** [@weberr13](https://discuss.elastic.co/u/weberr13)\ **Replies:** 6\ **Last updated:** [September 15, 2021, 3:15pm UTC](https://discuss.elastic.co/t/fleet-api-vs-fleet-ui/283918 "2021-09-15T15:15:35Z")
I have been using the fleet openapi spec (Swagger UI) to programmatically control our agent polices. I have seen 2 issues (I found a work around for one, at a loss for the second). creating an Endpoint policy ignores … --- ## [Is removing cluster.initial\_master\_nodes still necessary?](https://discuss.elastic.co/t/is-removing-cluster-initial-master-nodes-still-necessary/284298)
**Author:** [@MSN](https://discuss.elastic.co/u/MSN)\ **Replies:** 2\ **Last updated:** [September 15, 2021, 3:00pm UTC](https://discuss.elastic.co/t/is-removing-cluster-initial-master-nodes-still-necessary/284298 "2021-09-15T15:00:27Z")
Hi, The documentation for elasticsearch 7.14 states, that the configuration setting cluster.initial\_master\_nodes has to be removed from the configuration file after a cluster has formed sucessfully and should be absent … --- ## [Passing location (geopoint) to stored scripts from java](https://discuss.elastic.co/t/passing-location-geopoint-to-stored-scripts-from-java/284297)
**Author:** [@Madhu\_Dasa](https://discuss.elastic.co/u/Madhu_Dasa)\ **Replies:** 0\ **Last updated:** [September 15, 2021, 2:39pm UTC](https://discuss.elastic.co/t/passing-location-geopoint-to-stored-scripts-from-java/284297 "2021-09-15T14:39:59Z")
I have a field "location : {"type":"geopoint"} in ES mapping. I wrote a script to get documents based on location. But how do I pass values to this field from Java? I used below way, but seems not working GeoPoint loca… --- ## [Restoring Snapshot to another cluster](https://discuss.elastic.co/t/restoring-snapshot-to-another-cluster/284292)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 1\ **Last updated:** [September 15, 2021, 2:48pm UTC](https://discuss.elastic.co/t/restoring-snapshot-to-another-cluster/284292 "2021-09-15T14:48:33Z")
I have two v7.12.0 elastic clusters. I want to snapshot data from one and restore to another. Both clusters have the same "type": "fs" snapshot repository configured with the same "settings.location" and the snapshot … --- ## [Out Of Memory errors after G1GC migration](https://discuss.elastic.co/t/out-of-memory-errors-after-g1gc-migration/284227)
**Author:** [@malcon-moreira-sm](https://discuss.elastic.co/u/malcon-moreira-sm)\ **Replies:** 12\ **Last updated:** [September 15, 2021, 2:26pm UTC](https://discuss.elastic.co/t/out-of-memory-errors-after-g1gc-migration/284227 "2021-09-15T14:26:14Z")
We have an Elastic environment with 83 nodes and 3 masters inside docker containers that recently were migrated from CMS Garbage Collector to G1. The version of the cluster is 7.4.2: "docker.elastic.co/elasticsearch/ela… --- ## [Configure ILM : Delete index = delete data?](https://discuss.elastic.co/t/configure-ilm-delete-index-delete-data/284273)
**Author:** [@vp096](https://discuss.elastic.co/u/vp096)\ **Replies:** 4\ **Last updated:** [September 15, 2021, 2:10pm UTC](https://discuss.elastic.co/t/configure-ilm-delete-index-delete-data/284273 "2021-09-15T14:10:25Z")
Hello everyone, I send data every day on a single index, and I would like to delete all the data that are older than one year in order to optimize the available space on my disk. Will choosing the "Delete after 2 days"… --- ## [Azure repository creation issue in 7.10.2](https://discuss.elastic.co/t/azure-repository-creation-issue-in-7-10-2/283896)
**Author:** [@margold](https://discuss.elastic.co/u/margold)\ **Replies:** 4\ **Last updated:** [September 15, 2021, 1:30pm UTC](https://discuss.elastic.co/t/azure-repository-creation-issue-in-7-10-2/283896 "2021-09-15T13:30:57Z")
(I'm using this image: amazon/opendistro-for-elasticsearch:1.13.2) Following the docs on setting up an azure repository: Added storage account name and key and reloaded settings (Azure Repository | Elasticsearch Plugi… --- ## [Checking if the output.logstash is going to valid host](https://discuss.elastic.co/t/checking-if-the-output-logstash-is-going-to-valid-host/284202)
**Author:** [@EvanGertis](https://discuss.elastic.co/u/EvanGertis)\ **Replies:** 16\ **Last updated:** [September 15, 2021, 1:22pm UTC](https://discuss.elastic.co/t/checking-if-the-output-logstash-is-going-to-valid-host/284202 "2021-09-15T13:22:31Z")
My goal is to verify that the output.logstash is actually being sent to the proper host. My filebeat configuration is set up like so filebeat.inputs: - input\_type: log paths: - /var/log/\*.log - /var/log/\*/\*.l… --- ## [Elastic Agent Issues Sending Logs - How much longer we need to wait?](https://discuss.elastic.co/t/elastic-agent-issues-sending-logs-how-much-longer-we-need-to-wait/284145)
**Author:** [@ikbal](https://discuss.elastic.co/u/ikbal)\ **Replies:** 1\ **Last updated:** [September 15, 2021, 12:54pm UTC](https://discuss.elastic.co/t/elastic-agent-issues-sending-logs-how-much-longer-we-need-to-wait/284145 "2021-09-15T12:54:39Z")
Hello Elastic, I believe you know that this issues has been circulated in the wild and it seems that the issues still exist whereby the agent installed is not transporting windows event logs etc to the Elastic. The one … --- ## [Canvas Kibana metric background color formating](https://discuss.elastic.co/t/canvas-kibana-metric-background-color-formating/283070)
**Author:** [@MTV](https://discuss.elastic.co/u/MTV)\ **Replies:** 6\ **Last updated:** [September 15, 2021, 12:54pm UTC](https://discuss.elastic.co/t/canvas-kibana-metric-background-color-formating/283070 "2021-09-15T12:54:09Z")
Hi, I am using canvas where I am trying to color format a metric background : color1 if value=0, color2 if value between 0 and 7, and color3 if value \>7 . I looked into several answers here (and also looked at the docs)… --- ## [While generating TSVB Viz, Index pattern ID is showing different](https://discuss.elastic.co/t/while-generating-tsvb-viz-index-pattern-id-is-showing-different/284276)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 1\ **Last updated:** [September 15, 2021, 12:26pm UTC](https://discuss.elastic.co/t/while-generating-tsvb-viz-index-pattern-id-is-showing-different/284276 "2021-09-15T12:26:57Z")
Hi, While I am trying to create TSVB viz for index pattern name-"xyz", it is showing me a different index pattern id. id:'61ca57f2-469d-11e7-af02-69e470af7417',index\_pattern:' While I am trying to create other viz … --- ## [Filebeat running in docker not creating ECS field \`host.name\`](https://discuss.elastic.co/t/filebeat-running-in-docker-not-creating-ecs-field-host-name/284279)
**Author:** [@xtruthx](https://discuss.elastic.co/u/xtruthx)\ **Replies:** 0\ **Last updated:** [September 15, 2021, 12:07pm UTC](https://discuss.elastic.co/t/filebeat-running-in-docker-not-creating-ecs-field-host-name/284279 "2021-09-15T12:07:17Z")
I am running a filebeat 7.14.1 in a docker container on a debian host. I am using the modules mysql and system. The filbeat is sending the documents directly to elasticsearch, those are my ingest nodes with the accordin… --- ## [GROK pattern for syslogs](https://discuss.elastic.co/t/grok-pattern-for-syslogs/284174)
**Author:** [@Christer\_Palmen](https://discuss.elastic.co/u/Christer_Palmen)\ **Replies:** 3\ **Last updated:** [September 15, 2021, 12:02pm UTC](https://discuss.elastic.co/t/grok-pattern-for-syslogs/284174 "2021-09-15T12:02:36Z")
"Hello. I have several sources of syslogs that I want to filter with logstash grok, have some issue and questions about this syslog event and how to use grok. {"@version":"1","message":"\<44\> Sep 14 09:01:09 172.24.4.202… --- ## [Logs to investigate constant shard initialization](https://discuss.elastic.co/t/logs-to-investigate-constant-shard-initialization/283310)
**Author:** [@Maycon\_Santos](https://discuss.elastic.co/u/Maycon_Santos)\ **Replies:** 4\ **Last updated:** [September 15, 2021, 11:59am UTC](https://discuss.elastic.co/t/logs-to-investigate-constant-shard-initialization/283310 "2021-09-15T11:59:17Z")
Hello, I would like to enable more verbose logs to help investigate what is causing constant shard initialization tasks in my cluster. I've set the following without any luck: org.elasticsearch.cluster.routing: TRACE … --- ## [Node communication](https://discuss.elastic.co/t/node-communication/284199)
**Author:** [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\ **Replies:** 4\ **Last updated:** [September 15, 2021, 11:20am UTC](https://discuss.elastic.co/t/node-communication/284199 "2021-09-15T11:20:30Z")
I have 3 elastic nodes, I am trying to establish connection between 3 nodes, but not able to establish communication between nodes. Below is the elasticsearch.yml file, please let me what am I doing wrong. # ===========… --- ## [Does applying custom rules on machine learning jobs altert the ML model?](https://discuss.elastic.co/t/does-applying-custom-rules-on-machine-learning-jobs-altert-the-ml-model/283797)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 5\ **Last updated:** [September 15, 2021, 11:17am UTC](https://discuss.elastic.co/t/does-applying-custom-rules-on-machine-learning-jobs-altert-the-ml-model/283797 "2021-09-15T11:17:51Z")
Hi, I was wondering if applying custom rules on machine learning jobs altert the ML model? or the ML model stays the same, just those anomalies are not shown? --- ## [Highlight not working with script\_score query?](https://discuss.elastic.co/t/highlight-not-working-with-script-score-query/282189)
**Author:** [@Ejaz\_Ahmed](https://discuss.elastic.co/u/Ejaz_Ahmed)\ **Replies:** 3\ **Last updated:** [September 15, 2021, 10:29am UTC](https://discuss.elastic.co/t/highlight-not-working-with-script-score-query/282189 "2021-09-15T10:29:56Z")
Highlights are not working script\_score query in elasticsearch version 7.13. Please suggest --- ## [Pattern matching issues in Logstash](https://discuss.elastic.co/t/pattern-matching-issues-in-logstash/284255)
**Author:** [@Vajb12](https://discuss.elastic.co/u/Vajb12)\ **Replies:** 1\ **Last updated:** [September 15, 2021, 10:27am UTC](https://discuss.elastic.co/t/pattern-matching-issues-in-logstash/284255 "2021-09-15T10:27:13Z")
I'm having issues with Pattern matching with Logstash. Sample log pattern \[DEBUG\] 2021-09-13T23:58:24.361 \[http-nio-8080-exec-1\] \[FB-3D\] localhost - \[i.i.i.a.f.AuthFilter\] :: doFilter :: formName B-3D Grok Pattern th… --- ## [How to add all field values in a single field?](https://discuss.elastic.co/t/how-to-add-all-field-values-in-a-single-field/284068)
**Author:** [@Husnain](https://discuss.elastic.co/u/Husnain)\ **Replies:** 2\ **Last updated:** [September 15, 2021, 10:16am UTC](https://discuss.elastic.co/t/how-to-add-all-field-values-in-a-single-field/284068 "2021-09-15T10:16:36Z")
Hii.I am trying to create a new\_field called "log\_data" and I want to add each value in "log\_data" field present in the message field.I want only one field with multiple values.How can I achieve this? This are the docu… --- ## [Wrong timestamp in kibana index](https://discuss.elastic.co/t/wrong-timestamp-in-kibana-index/284181)
**Author:** [@Tejas\_Bhosale](https://discuss.elastic.co/u/Tejas_Bhosale)\ **Replies:** 2\ **Last updated:** [September 15, 2021, 10:13am UTC](https://discuss.elastic.co/t/wrong-timestamp-in-kibana-index/284181 "2021-09-15T10:13:26Z")
I get worng time data in my index in kibana there is around lot of difference in @timestamp and log\_timestamp field. grok filter which i am using grok { match =\> \[ "message" , '%{IP:remote\_addr} -… --- ## [Reindex data from local to Server?](https://discuss.elastic.co/t/reindex-data-from-local-to-server/284262)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 1\ **Last updated:** [September 15, 2021, 10:13am UTC](https://discuss.elastic.co/t/reindex-data-from-local-to-server/284262 "2021-09-15T10:13:10Z")
I am trying to send index npb\_bro to my server. But I am getting error. Below is my query POST \_reindex { "source": { "remote": { "host": "http://192.168.216.192:1992", "username": "xxxx", "passw… --- ## [How to change index pattern id?](https://discuss.elastic.co/t/how-to-change-index-pattern-id/284263)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 1\ **Last updated:** [September 15, 2021, 10:08am UTC](https://discuss.elastic.co/t/how-to-change-index-pattern-id/284263 "2021-09-15T10:08:26Z")
I want to change id 6ac6d870-85ea-11eb-81eb-fb2732b01c07 and I want to set another Id. It is possible to change this ID. --- ## [Elastic pipeline calculate value for field](https://discuss.elastic.co/t/elastic-pipeline-calculate-value-for-field/283752)
**Author:** [@111452](https://discuss.elastic.co/u/111452)\ **Replies:** 2\ **Last updated:** [September 15, 2021, 10:07am UTC](https://discuss.elastic.co/t/elastic-pipeline-calculate-value-for-field/283752 "2021-09-15T10:07:16Z")
I'm trying to calculate the time value inside elastic pipeline and set this value for field. I need something like this : curl -X PUT "localhost:9200/\_ingest/pipeline/time-pipeline?pretty" -H 'Content-Type: application/… --- ## [Windows integration for event logs error](https://discuss.elastic.co/t/windows-integration-for-event-logs-error/284169)
**Author:** [@PhilA](https://discuss.elastic.co/u/PhilA)\ **Replies:** 2\ **Last updated:** [September 15, 2021, 9:55am UTC](https://discuss.elastic.co/t/windows-integration-for-event-logs-error/284169 "2021-09-15T09:55:27Z")
Hi I have had a look at the Windows integration to collect events from the Windows event log but I believe there may be a mapping error. We have an environment where all Windows event logs are forwarded to a central lo… --- ## [Visualize two time series with nested objects](https://discuss.elastic.co/t/visualize-two-time-series-with-nested-objects/284171)
**Author:** [@maccn](https://discuss.elastic.co/u/maccn)\ **Replies:** 6\ **Last updated:** [September 15, 2021, 9:18am UTC](https://discuss.elastic.co/t/visualize-two-time-series-with-nested-objects/284171 "2021-09-15T09:18:40Z")
Hello everyone, I am trying to visualize two time series in Kibana reading the data from Elasticsearch. The structure of my document is the following: { "sensorName": "Sensor1", "values": \[ { "feature": … --- ## [Search timeouts during indexing](https://discuss.elastic.co/t/search-timeouts-during-indexing/284153)
**Author:** [@Drept](https://discuss.elastic.co/u/Drept)\ **Replies:** 10\ **Last updated:** [September 15, 2021, 8:49am UTC](https://discuss.elastic.co/t/search-timeouts-during-indexing/284153 "2021-09-15T08:49:06Z")
I have an index of around 90 million documents in Elasticsearch. I manage it via django-elasticsearch-dsl. The settings are the following: number\_of\_shards: 1 number\_of\_replicas: 0 The mapping is: { "series" : { … --- ## [Kibana dashboard display text line by line](https://discuss.elastic.co/t/kibana-dashboard-display-text-line-by-line/282078)
**Author:** [@hellotty](https://discuss.elastic.co/u/hellotty)\ **Replies:** 4\ **Last updated:** [September 15, 2021, 8:38am UTC](https://discuss.elastic.co/t/kibana-dashboard-display-text-line-by-line/282078 "2021-09-15T08:38:23Z")
Hello! In filebeat.yml I split my log file using multiline.pattern snippet filebeat: multiline.type: pattern multiline.pattern: '---------' multiline.negate: true multiline.match: after In discover, it is displaye… --- ## [Is it possible to make new property having default normalizer](https://discuss.elastic.co/t/is-it-possible-to-make-new-property-having-default-normalizer/284252)
**Author:** [@VincentGWZhang](https://discuss.elastic.co/u/VincentGWZhang)\ **Replies:** 0\ **Last updated:** [September 15, 2021, 6:55am UTC](https://discuss.elastic.co/t/is-it-possible-to-make-new-property-having-default-normalizer/284252 "2021-09-15T06:55:41Z")
Suppose I have a index having mapping setting as: { "settings": { "index": { "number\_of\_shards": 3, "number\_of\_replicas": 1 }, "analysis": { "normalizer": { "lowercase\_normalizer"… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1237) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1239)