# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1469 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1470 --- ## [Multi\_match fuzzy matching on shingled field](https://discuss.elastic.co/t/multi-match-fuzzy-matching-on-shingled-field/269713)
**Author:** [@jamesgorrie](https://discuss.elastic.co/u/jamesgorrie)\ **Replies:** 0\ **Last updated:** [April 9, 2021, 2:01pm UTC](https://discuss.elastic.co/t/multi-match-fuzzy-matching-on-shingled-field/269713 "2021-04-09T14:01:53Z")
I am trying to get some fuzzy matching setup on a multi\_match query of a field that has been shingled. Here is my mappings and queries. Both fuzzy queries match all documents, which is what I would expect. However on … --- ## [Trial expired but it works](https://discuss.elastic.co/t/trial-expired-but-it-works/269682)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 0\ **Last updated:** [April 9, 2021, 8:38am UTC](https://discuss.elastic.co/t/trial-expired-but-it-works/269682 "2021-04-09T08:38:36Z")
Hi, I've used ElasticSearch on cloud for 14 days and now my trial period is expired. I've created a new deployment: and I haven't entered the billing bank details yet. But why can I use kibana without any problems… --- ## [Kibana maps does not show index pattern](https://discuss.elastic.co/t/kibana-maps-does-not-show-index-pattern/269312)
**Author:** [@jungsoo](https://discuss.elastic.co/u/jungsoo)\ **Replies:** 3\ **Last updated:** [April 9, 2021, 12:51pm UTC](https://discuss.elastic.co/t/kibana-maps-does-not-show-index-pattern/269312 "2021-04-09T12:51:32Z")
Hello, I was testing maps feature and got problem. Symptom: Kibana Maps \> add layers \> documents It does not show any index pattern, although I have kibana sample data with index pattern which has geo\_point. How I… --- ## [Parsing variable multiline text from event log](https://discuss.elastic.co/t/parsing-variable-multiline-text-from-event-log/269450)
**Author:** [@SimonR](https://discuss.elastic.co/u/SimonR)\ **Replies:** 3\ **Last updated:** [April 9, 2021, 11:35am UTC](https://discuss.elastic.co/t/parsing-variable-multiline-text-from-event-log/269450 "2021-04-09T11:35:13Z")
Hi Logstash experts. Im having big issues parsing MSSQL logs from the Windows event log, and i hope someone can assist. MSSQL logs event id 33205 to Windows event log, in a somewhat structured format, except the "State… --- ## [Formatted values in logstash are not displayed](https://discuss.elastic.co/t/formatted-values-in-logstash-are-not-displayed/268974)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 3\ **Last updated:** [April 9, 2021, 11:43am UTC](https://discuss.elastic.co/t/formatted-values-in-logstash-are-not-displayed/268974 "2021-04-09T11:43:54Z")
Formatted values in logstash are not displayed. want to I would like to split the log collected by logstash and get it by dissect, and check each in a different field in Kibana. issue However, the variable name o… --- ## [Error with ilm policy change for index](https://discuss.elastic.co/t/error-with-ilm-policy-change-for-index/269703)
**Author:** [@siiman](https://discuss.elastic.co/u/siiman)\ **Replies:** 0\ **Last updated:** [April 9, 2021, 11:35am UTC](https://discuss.elastic.co/t/error-with-ilm-policy-change-for-index/269703 "2021-04-09T11:35:26Z")
Hello, I encountered a problem with index-index-livecycle-management in elasticseach v7.10.2. I created an ilm policy named zeek\_cleanup with rolling indices settings and applied it to some indices via dev-console. Unf… --- ## [Problems with latest elasticsearch-ruby search using point in time](https://discuss.elastic.co/t/problems-with-latest-elasticsearch-ruby-search-using-point-in-time/269646)
**Author:** [@jeffkirk1](https://discuss.elastic.co/u/jeffkirk1)\ **Replies:** 1\ **Last updated:** [April 9, 2021, 11:28am UTC](https://discuss.elastic.co/t/problems-with-latest-elasticsearch-ruby-search-using-point-in-time/269646 "2021-04-09T11:28:42Z")
Hey folks, \< EDITED -- PROBLEM SOLVED -- SEE REPLY BELOW \> I'm trying to use the elasticsearch-ruby and elasticsearch-xpack Ruby gems to search using the new point in time interface now that the scrolling API has been … --- ## [Calculation of Average](https://discuss.elastic.co/t/calculation-of-average/269325)
**Author:** [@vivekshukla](https://discuss.elastic.co/u/vivekshukla)\ **Replies:** 2\ **Last updated:** [April 9, 2021, 11:23am UTC](https://discuss.elastic.co/t/calculation-of-average/269325 "2021-04-09T11:23:36Z")
Hi Team, I am using Metric Bar to find the average time for below scenario: Need to find Average time = Sum of Duration / Sum( Number of Attempts) Provided Aggregation are not helpful in Metric Bar for above calcula… --- ## [Multiple pipelines](https://discuss.elastic.co/t/multiple-pipelines/269689)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 0\ **Last updated:** [April 9, 2021, 9:15am UTC](https://discuss.elastic.co/t/multiple-pipelines/269689 "2021-04-09T09:15:29Z")
hi everyone I have multiple sources so I want to parse them with logstash , so if that need multiple pipelines or just a pipeline is enough , in my case I have multiple source ( filebeats , winlogbeats and syslog server… --- ## [Plot a line with different colours for evening than for morning](https://discuss.elastic.co/t/plot-a-line-with-different-colours-for-evening-than-for-morning/269687)
**Author:** [@Facu](https://discuss.elastic.co/u/Facu)\ **Replies:** 0\ **Last updated:** [April 9, 2021, 8:57am UTC](https://discuss.elastic.co/t/plot-a-line-with-different-colours-for-evening-than-for-morning/269687 "2021-04-09T08:57:38Z")
Hi All! Would it be possible to plot a line, or two lines, which will change the color depending on the time of the day I am plotting. Like grey in the afternoon and red in the morning using Timelion ? I'm doing someth… --- ## [How to add additional value in bucket aggregation?](https://discuss.elastic.co/t/how-to-add-additional-value-in-bucket-aggregation/269666)
**Author:** [@zeusfsx](https://discuss.elastic.co/u/zeusfsx)\ **Replies:** 4\ **Last updated:** [April 9, 2021, 8:56am UTC](https://discuss.elastic.co/t/how-to-add-additional-value-in-bucket-aggregation/269666 "2021-04-09T08:56:29Z")
Hi, I have documents in the index with the field sentimental\_keywords: sentimental\_keywords: \[ { rate: 0.2857143, keyword: "manager" }, ... { rate: -0.333333343, keyword: "project" }, \] When I do terms … --- ## [Update by query](https://discuss.elastic.co/t/update-by-query/269674)
**Author:** [@yen\_l\_ng\_th](https://discuss.elastic.co/u/yen_l_ng_th)\ **Replies:** 2\ **Last updated:** [April 9, 2021, 8:34am UTC](https://discuss.elastic.co/t/update-by-query/269674 "2021-04-09T08:34:54Z")
create by bluk, after update by quey =\> update run but not updated Timeout is 2m =\> not updated Can you help me? I using php client --- ## [Elasticsearch](https://discuss.elastic.co/t/elasticsearch/269615)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 7\ **Last updated:** [April 9, 2021, 8:23am UTC](https://discuss.elastic.co/t/elasticsearch/269615 "2021-04-09T08:23:09Z")
hi good day eveyone , why do we need 3 nodes in elasticsearch cluster for guarantee the high availibility and disaster recovery --- ## [Parsing date format](https://discuss.elastic.co/t/parsing-date-format/269488)
**Author:** [@tkkchan](https://discuss.elastic.co/u/tkkchan)\ **Replies:** 2\ **Last updated:** [April 9, 2021, 8:15am UTC](https://discuss.elastic.co/t/parsing-date-format/269488 "2021-04-09T08:15:46Z")
Dear All, I am currently learning how to parse data with logstash and pass them to Logstash. Right now I am confused on how to parse date correctly, as you can see, I have a timestamp with the format yyyy/MM/dd HH:mm:s… --- ## [Filebeat kafka output topic name always in lowercase？](https://discuss.elastic.co/t/filebeat-kafka-output-topic-name-always-in-lowercase/269593)
**Author:** [@xxr](https://discuss.elastic.co/u/xxr)\ **Replies:** 1\ **Last updated:** [April 9, 2021, 8:12am UTC](https://discuss.elastic.co/t/filebeat-kafka-output-topic-name-always-in-lowercase/269593 "2021-04-09T08:12:48Z")
when configure the kafka output topic, I configure the topic name in uppercase . but when start the filebeat it always create the lowercase topic in kafka and send message to that lowercase name topic. is this the fi… --- ## [Kibana not compressing HTTP responses](https://discuss.elastic.co/t/kibana-not-compressing-http-responses/266989)
**Author:** [@juan.domenech](https://discuss.elastic.co/u/juan.domenech)\ **Replies:** 4\ **Last updated:** [April 9, 2021, 7:46am UTC](https://discuss.elastic.co/t/kibana-not-compressing-http-responses/266989 "2021-04-09T07:46:41Z")
Recently I've updated to Kibana 7.11.1 and I've noticed slow performance specially in Discover when many documents are returned. After some investigation I've noticed that Kibana is no longer compressing the response of… --- ## [Traiter des sous champs comme des logs à part entier à ingérer](https://discuss.elastic.co/t/traiter-des-sous-champs-comme-des-logs-a-part-entier-a-ingerer/268771)
**Author:** [@Yahya\_Bouzoubaa](https://discuss.elastic.co/u/Yahya_Bouzoubaa)\ **Replies:** 2\ **Last updated:** [April 9, 2021, 7:17am UTC](https://discuss.elastic.co/t/traiter-des-sous-champs-comme-des-logs-a-part-entier-a-ingerer/268771 "2021-04-09T07:17:29Z")
Bonjour, Je souhaite parser un log et parser aussi un sous log (qui est un champ du log parent) et les ingérer dans deux logs différents. Est ce que c'est possible et si oui quelle méthode ou script faudrait utiliser. … --- ## [TLS Between Elastic & Kibana…Alerts Not Working](https://discuss.elastic.co/t/tls-between-elastic-kibana-alerts-not-working/266367)
**Author:** [@Rok](https://discuss.elastic.co/u/Rok)\ **Replies:** 12\ **Last updated:** [April 9, 2021, 7:05am UTC](https://discuss.elastic.co/t/tls-between-elastic-kibana-alerts-not-working/266367 "2021-04-09T07:05:47Z")
Hi. I have established TLS on our cluster (v7.11.1). Entire cluster seems to be working fine except Alerts and Report section. The alerting section in kibana still says " You must enable Transport Layer Security Alerti… --- ## [Filebeat stopped after reaching EOF, with close\_eof:false](https://discuss.elastic.co/t/filebeat-stopped-after-reaching-eof-with-close-eof-false/269662)
**Author:** [@froheik](https://discuss.elastic.co/u/froheik)\ **Replies:** 0\ **Last updated:** [April 9, 2021, 5:54am UTC](https://discuss.elastic.co/t/filebeat-stopped-after-reaching-eof-with-close-eof-false/269662 "2021-04-09T05:54:07Z")
Hi guys. Need help in that case. Have some trouble with deploying daemonset of filebeat's (releases 7.12 or 7.11.2) in openshift cluster by runtime cri. After starting container, filebeat open harvesters for finded files… --- ## [ECK kibana dashboard show no result](https://discuss.elastic.co/t/eck-kibana-dashboard-show-no-result/269544)
**Author:** [@cuongnp](https://discuss.elastic.co/u/cuongnp)\ **Replies:** 2\ **Last updated:** [April 9, 2021, 3:13am UTC](https://discuss.elastic.co/t/eck-kibana-dashboard-show-no-result/269544 "2021-04-09T03:13:37Z")
Hi all, I have ECK operator installed on openshift. There are 2 indexes for metricbeat and filebeat. The discover tab still has document but there is no data in dashboard tab. I tried to delete old index and restart elas… --- ## [Not able to add host name to metric filter plugin output](https://discuss.elastic.co/t/not-able-to-add-host-name-to-metric-filter-plugin-output/269554)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 8\ **Last updated:** [April 9, 2021, 2:42am UTC](https://discuss.elastic.co/t/not-able-to-add-host-name-to-metric-filter-plugin-output/269554 "2021-04-09T02:42:41Z")
Hi, I wanted to see how rate at which the clients were sending logs to logstash. I wanted to use the metric filter plugin. And it is working. Except one thing. Here is the conf: input { http { … --- ## [Cost more time than normally](https://discuss.elastic.co/t/cost-more-time-than-normally/269576)
**Author:** [@panla](https://discuss.elastic.co/u/panla)\ **Replies:** 2\ **Last updated:** [April 9, 2021, 2:25am UTC](https://discuss.elastic.co/t/cost-more-time-than-normally/269576 "2021-04-09T02:25:03Z")
question restart after a while will cost more time than normally. how to solve it? --- ## [How to partially delete an index](https://discuss.elastic.co/t/how-to-partially-delete-an-index/269317)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 13\ **Last updated:** [April 9, 2021, 2:16am UTC](https://discuss.elastic.co/t/how-to-partially-delete-an-index/269317 "2021-04-09T02:16:11Z")
How can I delete only the records that meet the criteria of the index registered in elasticsearch? I don't want to delete the entire index. In other words, not the following instruction. curl -XDELETE localhost:9200/i… --- ## [Geo-Point Mapping](https://discuss.elastic.co/t/geo-point-mapping/269504)
**Author:** [@caitlyn.carlisle](https://discuss.elastic.co/u/caitlyn.carlisle)\ **Replies:** 22\ **Last updated:** [April 9, 2021, 2:01am UTC](https://discuss.elastic.co/t/geo-point-mapping/269504 "2021-04-09T02:01:51Z")
mutate { add\_field =\> { "location" =\> \["%{\[location\_lat\]}","%{\[location\_lon\]}"\] } } This is my mutate field in my conf file to create my geopoint mapping of the location\_lat and location\_lon value in the… --- ## [Elasticsearch response alway return total hits is 0?](https://discuss.elastic.co/t/elasticsearch-response-alway-return-total-hits-is-0/269603)
**Author:** [@NinhNM](https://discuss.elastic.co/u/NinhNM)\ **Replies:** 2\ **Last updated:** [April 9, 2021, 2:00am UTC](https://discuss.elastic.co/t/elasticsearch-response-alway-return-total-hits-is-0/269603 "2021-04-09T02:00:22Z")
I have use ELS 7.11. I make single query with multiple conditions Query: { "bool" : { "filter" : \[ { "term" : { "loa" : { "value" : "2", "boost" : 1.0 }… --- ## [How to combine default BM25 score of Elasticsearch and Dense Vectors similarity](https://discuss.elastic.co/t/how-to-combine-default-bm25-score-of-elasticsearch-and-dense-vectors-similarity/269614)
**Author:** [@xiaoma](https://discuss.elastic.co/u/xiaoma)\ **Replies:** 2\ **Last updated:** [April 9, 2021, 1:11am UTC](https://discuss.elastic.co/t/how-to-combine-default-bm25-score-of-elasticsearch-and-dense-vectors-similarity/269614 "2021-04-09T01:11:57Z")
i found a issue about how to combine the both default bm25 and vectors, but i try it and found the result was poor, is there any official document about how to combine default BM25 score of Elasticsearch and Dense Vect… --- ## [Collect multiple line in stdin](https://discuss.elastic.co/t/collect-multiple-line-in-stdin/269647)
**Author:** [@elk\_newbie](https://discuss.elastic.co/u/elk_newbie)\ **Replies:** 4\ **Last updated:** [April 8, 2021, 11:46pm UTC](https://discuss.elastic.co/t/collect-multiple-line-in-stdin/269647 "2021-04-08T23:46:34Z")
Hi, Is it possible to read multiple lines at once? The first line indicates the error. I would like to log the statement that causes the error. \< 2021-04-07 10:19:18.883 CEST db dbuser App 37386 \> ERROR: operator… --- ## [Zeek ingest using logstash on elastic cloud](https://discuss.elastic.co/t/zeek-ingest-using-logstash-on-elastic-cloud/269522)
**Author:** [@kajira](https://discuss.elastic.co/u/kajira)\ **Replies:** 8\ **Last updated:** [April 8, 2021, 10:55pm UTC](https://discuss.elastic.co/t/zeek-ingest-using-logstash-on-elastic-cloud/269522 "2021-04-08T22:55:16Z")
Hi, I am trying the elastic cloud for the first time using 7.12 stack. I would like to send zeek logs to my elastic cloud deployment and the default method recommended is to use filebeats. I would like to stream the log… --- ## [Using Numeral.js in Vega graphs to format numbers](https://discuss.elastic.co/t/using-numeral-js-in-vega-graphs-to-format-numbers/269537)
**Author:** [@walrusVision](https://discuss.elastic.co/u/walrusVision)\ **Replies:** 4\ **Last updated:** [April 8, 2021, 9:30pm UTC](https://discuss.elastic.co/t/using-numeral-js-in-vega-graphs-to-format-numbers/269537 "2021-04-08T21:30:25Z")
I was wondering if its possible to use Numeral.js in custom vega graphs to format results into human readable values, and if so, how to do it. In my use case I want to format bytes to a number with the best prefix as per… --- ## [Duplicate data Logstash](https://discuss.elastic.co/t/duplicate-data-logstash/269635)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 4\ **Last updated:** [April 8, 2021, 9:13pm UTC](https://discuss.elastic.co/t/duplicate-data-logstash/269635 "2021-04-08T21:13:53Z")
Hi, guy's i need your help, please with this... I have a problem with the indexing of data from logstash to elastic, I have two pipelines and when I run the service I duplicate the data from one pipeline to the other, … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1468) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1470)