# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1391 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1392 --- ## [Extract the message from an Alert FileBeat](https://discuss.elastic.co/t/extract-the-message-from-an-alert-filebeat/274475)
**Author:** [@Michael\_Dylan\_McAloo](https://discuss.elastic.co/u/Michael_Dylan_McAloo)\ **Replies:** 4\ **Last updated:** [May 31, 2021, 11:17am UTC](https://discuss.elastic.co/t/extract-the-message-from-an-alert-filebeat/274475 "2021-05-31T11:17:15Z")
I need help because I don't know how to select only the part of the message where it says "NMAP ping sweep Scan". 05/28-10:30:30:52.840974 \[\*\*\] \[1:10000004:1\] "NMAP ping sweep Scan" \[\*\*\] \[Priority: 0\] {TCP} I got this: … --- ## [Support for PKCS#5 v2.0 in LogStash](https://discuss.elastic.co/t/support-for-pkcs-5-v2-0-in-logstash/274487)
**Author:** [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\ **Replies:** 0\ **Last updated:** [May 31, 2021, 11:03am UTC](https://discuss.elastic.co/t/support-for-pkcs-5-v2-0-in-logstash/274487 "2021-05-31T11:03:00Z")
Hi all, We are currently migrating our Elastic Stack from RHEL 7 to RHEL 8 which also upgrades openssl from 1.0.2k to 1.1.1g At first we could not figure out why LogStash was not able to start our pipeline containing a… --- ## [How Sliced Scan Works in the background?](https://discuss.elastic.co/t/how-sliced-scan-works-in-the-background/274486)
**Author:** [@arkash20](https://discuss.elastic.co/u/arkash20)\ **Replies:** 0\ **Last updated:** [May 31, 2021, 10:53am UTC](https://discuss.elastic.co/t/how-sliced-scan-works-in-the-background/274486 "2021-05-31T10:53:21Z")
Hi, I used scan method to retrieve data from a huge indice we have (200M records), using multiprocessing. For that I used sliced scan and set it to 6 slices, as the number of my shards. Now here comes the theory questi… --- ## [Logstash "if" condition not working as expected](https://discuss.elastic.co/t/logstash-if-condition-not-working-as-expected/274483)
**Author:** [@suryarao67](https://discuss.elastic.co/u/suryarao67)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 10:51am UTC](https://discuss.elastic.co/t/logstash-if-condition-not-working-as-expected/274483 "2021-05-31T10:51:35Z")
Below is my input message to logstash { "object2": "", "headers": { "request\_path": "/", "request\_method": "POST", "http\_accept": "\*/\*", "content\_type": "application/json; charset=utf-8", "http\_version": "HT… --- ## [Search API error Elasticsearch](https://discuss.elastic.co/t/search-api-error-elasticsearch/274349)
**Author:** [@Jose\_Angel\_Morena\_Si](https://discuss.elastic.co/u/Jose_Angel_Morena_Si)\ **Replies:** 11\ **Last updated:** [May 31, 2021, 10:15am UTC](https://discuss.elastic.co/t/search-api-error-elasticsearch/274349 "2021-05-31T10:15:56Z")
Hello there, When I use python elasticsearch module to query for documents, there seems to be something strange going on: elasticsearch module: version 7.11.2 elasticsearch cluster: version 7.11.2 The following query: … --- ## [German compound words in an e-commerce search](https://discuss.elastic.co/t/german-compound-words-in-an-e-commerce-search/270280)
**Author:** [@thaarbach](https://discuss.elastic.co/u/thaarbach)\ **Replies:** 3\ **Last updated:** [May 31, 2021, 9:59am UTC](https://discuss.elastic.co/t/german-compound-words-in-an-e-commerce-search/270280 "2021-05-31T09:59:27Z")
Hi elastic! We are developing an e-commerce application and have been using elasticsearch 2.0 since 2014. We are prevented from upgrading by a problem that we simply cannot solve with the current ES version. The german… --- ## [Kibana. Long text fields are not displayed](https://discuss.elastic.co/t/kibana-long-text-fields-are-not-displayed/273346)
**Author:** [@yeryomenkom](https://discuss.elastic.co/u/yeryomenkom)\ **Replies:** 3\ **Last updated:** [May 31, 2021, 9:26am UTC](https://discuss.elastic.co/t/kibana-long-text-fields-are-not-displayed/273346 "2021-05-31T09:26:08Z")
Hi! I am observing strange behaviour when some text fields are displayed in "Discover" section and some are not. I store in this field java exception stacktraces. "exception" field from this record is displayed normally… --- ## [Master node missing path.data](https://discuss.elastic.co/t/master-node-missing-path-data/274338)
**Author:** [@Juri\_P](https://discuss.elastic.co/u/Juri_P)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 9:23am UTC](https://discuss.elastic.co/t/master-node-missing-path-data/274338 "2021-05-31T09:23:18Z")
I have an ELK cluster, with two elasticsearch nodes, one with roles master, data and ingest, and the other with only data and ingest. There's also a script making backups each night to a shared disk on another server. I … --- ## [Winlogbeat Sysmon Configuration Registry fields seems to map the wrong value of the registry](https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/273733)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 9:17am UTC](https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/273733 "2021-05-31T09:17:43Z")
Hello, Just noticed something weird with Sysmon configuration in 7.11 (registry events) As you can see, the actual value of the registry key is in winlog.event\_data.Details while imho this should be in registry.valu… --- ## [Is there any way we can use list of vectors to store in ElasticSearch and what are the corresponding changes required in ES query for calculating cosine similarity](https://discuss.elastic.co/t/is-there-any-way-we-can-use-list-of-vectors-to-store-in-elasticsearch-and-what-are-the-corresponding-changes-required-in-es-query-for-calculating-cosine-similarity/273888)
**Author:** [@SagarPalyal](https://discuss.elastic.co/u/SagarPalyal)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 9:00am UTC](https://discuss.elastic.co/t/is-there-any-way-we-can-use-list-of-vectors-to-store-in-elasticsearch-and-what-are-the-corresponding-changes-required-in-es-query-for-calculating-cosine-similarity/273888 "2021-05-31T09:00:28Z")
Provided I am able to create single dense vector field and calculate cosine similarity using the ElasticSearch query mentioned in official documentation. Still not getting how to create list of dense vectors and apply co… --- ## [Calculating packet loss](https://discuss.elastic.co/t/calculating-packet-loss/274364)
**Author:** [@svenvg93](https://discuss.elastic.co/u/svenvg93)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 8:43am UTC](https://discuss.elastic.co/t/calculating-packet-loss/274364 "2021-05-31T08:43:45Z")
Hello everyone, i'm very new to ELK stack. I am running a home lab for testing. I’m using heartbeat to monitor endpoints availability by ping. Is there a way to calculate the percentage of packet loss. Can’t seem to fi… --- ## [Watcher unable to send number of hits in email](https://discuss.elastic.co/t/watcher-unable-to-send-number-of-hits-in-email/274292)
**Author:** [@tuli](https://discuss.elastic.co/u/tuli)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 8:50am UTC](https://discuss.elastic.co/t/watcher-unable-to-send-number-of-hits-in-email/274292 "2021-05-31T08:50:10Z")
Hello, We have a watcher which is sending a CSV attachment with the number of hosts matching the condition. However, we also want it writes in the body the total number of hits/hosts in the CSV found. For eg: if in the… --- ## [Custom similarity is really slow, even when very simple (using doc.freq)](https://discuss.elastic.co/t/custom-similarity-is-really-slow-even-when-very-simple-using-doc-freq/273936)
**Author:** [@JF2018](https://discuss.elastic.co/u/JF2018)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 8:48am UTC](https://discuss.elastic.co/t/custom-similarity-is-really-slow-even-when-very-simple-using-doc-freq/273936 "2021-05-31T08:48:54Z")
Hi I am trying to use custom similarities. I wish to have a very simple similarity, where the score is just doc.freq. As I understand this is stored in the statistics, so it should be very fast. When having ~30mill do… --- ## [Aggregeations with different keys and values (label and ID)](https://discuss.elastic.co/t/aggregeations-with-different-keys-and-values-label-and-id/274218)
**Author:** [@Julian\_Klotz](https://discuss.elastic.co/u/Julian_Klotz)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 8:39am UTC](https://discuss.elastic.co/t/aggregeations-with-different-keys-and-values-label-and-id/274218 "2021-05-31T08:39:38Z")
Dear ES community, I hope someone can help me out with a (honestly) very basic question. I’m posting this because I couldn’t find a simple answer, to my surprise. Let’s say I have a blog post indexed in ES (example bel… --- ## [How to create temporary tables in beeline SparkSQL for ElasticSearch. ElasticSearch is behind HAProxy](https://discuss.elastic.co/t/how-to-create-temporary-tables-in-beeline-sparksql-for-elasticsearch-elasticsearch-is-behind-haproxy/274461)
**Author:** [@Chilaka\_Ramakrishna](https://discuss.elastic.co/u/Chilaka_Ramakrishna)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 8:20am UTC](https://discuss.elastic.co/t/how-to-create-temporary-tables-in-beeline-sparksql-for-elasticsearch-elasticsearch-is-behind-haproxy/274461 "2021-05-31T08:20:36Z")
How to connect beeline to elasticsearch via HAPROXY. CREATE TEMPORARY TABLE temp\_table USING org.elasticsearch.spark.sql OPTIONS (resource 'temp\_index/\_doc', nodes 'preview.abc.com', mapping.date.rich 'false', nodes.pat… --- ## [Update index by query error large index](https://discuss.elastic.co/t/update-index-by-query-error-large-index/274079)
**Author:** [@Roy\_Levy](https://discuss.elastic.co/u/Roy_Levy)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 8:06am UTC](https://discuss.elastic.co/t/update-index-by-query-error-large-index/274079 "2021-05-31T08:06:52Z")
Hey, I'm trying to update my index by query like so: POST my\_index/\_update\_by\_query?pipeline=my\_pipeline&conflicts=proceed Because my index has alot of docs (nearly 40mil) the update stops after some thousand docs and… --- ## [Architecture of elasticsearch-xpack monitoring with Metricbeat](https://discuss.elastic.co/t/architecture-of-elasticsearch-xpack-monitoring-with-metricbeat/274168)
**Author:** [@kodka](https://discuss.elastic.co/u/kodka)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 8:03am UTC](https://discuss.elastic.co/t/architecture-of-elasticsearch-xpack-monitoring-with-metricbeat/274168 "2021-05-31T08:03:24Z")
Documentation (Collecting Elasticsearch monitoring data with Metricbeat | Elasticsearch Guide \[7.13\] | Elastic) says: "Ideally install a single Metricbeat instance configured with scope: cluster and configure hosts to po… --- ## [Similarly module code not working in Node.Js](https://discuss.elastic.co/t/similarly-module-code-not-working-in-node-js/274114)
**Author:** [@appydam](https://discuss.elastic.co/u/appydam)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 7:55am UTC](https://discuss.elastic.co/t/similarly-module-code-not-working-in-node-js/274114 "2021-05-31T07:55:30Z")
I have some data and I have to apply similarity module on it in settings part. I did that in Node.Js I sent data to Elasticsearch Kibana with Bulk API but similarity module is not working. I need help like how to integ… --- ## [Update boost value in index mapping is not taking effect](https://discuss.elastic.co/t/update-boost-value-in-index-mapping-is-not-taking-effect/274158)
**Author:** [@Anand\_Bhagwat](https://discuss.elastic.co/u/Anand_Bhagwat)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 7:54am UTC](https://discuss.elastic.co/t/update-boost-value-in-index-mapping-is-not-taking-effect/274158 "2021-05-31T07:54:34Z")
Hi, I have index configuration mapping file which I am using to create an index. The mapping contains dynamic mappings with boost value in it. Json snippet is given below: "mappings": { "dynamic\_templates":… --- ## [Elastic search wildcard search space issue](https://discuss.elastic.co/t/elastic-search-wildcard-search-space-issue/274263)
**Author:** [@Mithoon](https://discuss.elastic.co/u/Mithoon)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 7:53am UTC](https://discuss.elastic.co/t/elastic-search-wildcard-search-space-issue/274263 "2021-05-31T07:53:26Z")
Consider index field " ProductName " having the value " dove 3.75oz " and when user searches for "dove 3.75oz" text below bool query is working fine to retreive the document: {"bool":{"must":\[{"wildcard":{"ProductName":… --- ## [License is expired](https://discuss.elastic.co/t/license-is-expired/274464)
**Author:** [@kmz161](https://discuss.elastic.co/u/kmz161)\ **Replies:** 4\ **Last updated:** [May 31, 2021, 7:52am UTC](https://discuss.elastic.co/t/license-is-expired/274464 "2021-05-31T07:52:31Z")
I use free version of ELK stack and I receive message "Your trial license is expired". What needs to be done to renew the license? How I can resolve this issues? --- ## [How to merge two indices in Kibana?](https://discuss.elastic.co/t/how-to-merge-two-indices-in-kibana/274322)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 7:34am UTC](https://discuss.elastic.co/t/how-to-merge-two-indices-in-kibana/274322 "2021-05-31T07:34:55Z")
It is possible to merge to indices in kibana. In two indices some columns are same and some not. I want to merge that indices into one. I have merge two indices but they are appended. Means I get the appended data one ov… --- ## [Export CSV from Vegalite Visualization](https://discuss.elastic.co/t/export-csv-from-vegalite-visualization/274160)
**Author:** [@deeksha39](https://discuss.elastic.co/u/deeksha39)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 7:25am UTC](https://discuss.elastic.co/t/export-csv-from-vegalite-visualization/274160 "2021-05-31T07:25:01Z")
I want to export the data in csv format from vegalite visualization. is it possible in kibana? --- ## [Speed Up Query of huge indices](https://discuss.elastic.co/t/speed-up-query-of-huge-indices/274424)
**Author:** [@arkash20](https://discuss.elastic.co/u/arkash20)\ **Replies:** 6\ **Last updated:** [May 31, 2021, 7:24am UTC](https://discuss.elastic.co/t/speed-up-query-of-huge-indices/274424 "2021-05-31T07:24:09Z")
Hi, I would like to have your opinion about the next challenge I face: We have an index with about 200M records. We would like get all the records periodically, and send it to a service for some internal purpose. I t… --- ## [Elasticsearch Ram recommendation](https://discuss.elastic.co/t/elasticsearch-ram-recommendation/274300)
**Author:** [@godisdj007](https://discuss.elastic.co/u/godisdj007)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 7:23am UTC](https://discuss.elastic.co/t/elasticsearch-ram-recommendation/274300 "2021-05-31T07:23:50Z")
I'm deploying an Elasticsearch cluster with roughly 40GB a day with a time-to-live of 365 days. Write speed would be around 50 msgs/sec. Reads would be mostly driven by user dashboards, so the read frequency won't be hig… --- ## [Watcher 7.8 Do I have to modify the range of my query to match the timezone?](https://discuss.elastic.co/t/watcher-7-8-do-i-have-to-modify-the-range-of-my-query-to-match-the-timezone/274103)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 3\ **Last updated:** [May 31, 2021, 7:21am UTC](https://discuss.elastic.co/t/watcher-7-8-do-i-have-to-modify-the-range-of-my-query-to-match-the-timezone/274103 "2021-05-31T07:21:15Z")
Hi, I have create an alert whenever match a field, and Im having problems to make it work. the query works well in devs tools when I query for now-7d, but in the watch is never executed. this is my range "… --- ## [Watcher @timestamp timezone](https://discuss.elastic.co/t/watcher-timestamp-timezone/274167)
**Author:** [@toms130](https://discuss.elastic.co/u/toms130)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 7:19am UTC](https://discuss.elastic.co/t/watcher-timestamp-timezone/274167 "2021-05-31T07:19:07Z")
Hi there, I can't figure how t change timestamp timezone in watcher output I got . Below is my watcher alert { "trigger": { "schedule": { "interval": "15m" } }, "input": { "search": { "re… --- ## [Sending data from elasticsearch to mixpanel](https://discuss.elastic.co/t/sending-data-from-elasticsearch-to-mixpanel/274455)
**Author:** [@faizanammar](https://discuss.elastic.co/u/faizanammar)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 7:18am UTC](https://discuss.elastic.co/t/sending-data-from-elasticsearch-to-mixpanel/274455 "2021-05-31T07:18:13Z")
Hello, I wanna know and have guidance on any mechanism to send the data stored in ElasticSearch to MixPanel. Is there any way to accomplish this.? Thanks. F. --- ## [Mathlion](https://discuss.elastic.co/t/mathlion/274354)
**Author:** [@Krunal](https://discuss.elastic.co/u/Krunal)\ **Replies:** 3\ **Last updated:** [May 31, 2021, 6:45am UTC](https://discuss.elastic.co/t/mathlion/274354 "2021-05-31T06:45:18Z")
Hi I would like to use mathlion for calculation of daily data which is stored in elastic search.... I am using latest version of kibana 7.13 --- ## [Relevant data not coming in elasticsearch](https://discuss.elastic.co/t/relevant-data-not-coming-in-elasticsearch/274456)
**Author:** [@vikramdayma](https://discuss.elastic.co/u/vikramdayma)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 6:40am UTC](https://discuss.elastic.co/t/relevant-data-not-coming-in-elasticsearch/274456 "2021-05-31T06:40:25Z")
Hi, I am building a search with edge ngram. Here is my mapping: PUT xyz { "settings": { "analysis": { "filter": { "autocomplete": { "type": "edge\_ngram", "min\_gram": 2, "max\_g… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1390) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1392)