# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1602 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1603 --- ## [Logstash s3 output plugin folder structure](https://discuss.elastic.co/t/logstash-s3-output-plugin-folder-structure/261152)
**Author:** [@Ohad\_Elias](https://discuss.elastic.co/u/Ohad_Elias)\ **Replies:** 2\ **Last updated:** [January 14, 2021, 4:43pm UTC](https://discuss.elastic.co/t/logstash-s3-output-plugin-folder-structure/261152 "2021-01-14T16:43:47Z")
Our DevOps engineers have been using Logstash S3 plugin which simply puts all data in a S3 bucket location. Since we have configured files to be created in every hour on S3, the number of files in the S3 location touched… --- ## [Convert field data type from text to Date](https://discuss.elastic.co/t/convert-field-data-type-from-text-to-date/260781)
**Author:** [@Sathish22](https://discuss.elastic.co/u/Sathish22)\ **Replies:** 10\ **Last updated:** [January 15, 2021, 6:08am UTC](https://discuss.elastic.co/t/convert-field-data-type-from-text-to-date/260781 "2021-01-15T06:08:30Z")
Hi All, We have created an index that consists of text data type for all fields, but we need to convert timestamp field from text to date (format "2021-01-12 09:19:25.890") but unable to do. I have tried creating a new… --- ## [FIlebeat 7.10.1 logging.metrics.enabled: false appears to have no effect](https://discuss.elastic.co/t/filebeat-7-10-1-logging-metrics-enabled-false-appears-to-have-no-effect/261202)
**Author:** [@ernestr](https://discuss.elastic.co/u/ernestr)\ **Replies:** 1\ **Last updated:** [January 15, 2021, 5:53am UTC](https://discuss.elastic.co/t/filebeat-7-10-1-logging-metrics-enabled-false-appears-to-have-no-effect/261202 "2021-01-15T05:53:40Z")
Hi, I am running the Filebeat deb package on Ubuntu Server 20.04. I noticed that when I set logging.metrics.enabled: false Filebeat still writes monitoring messages to syslog and then forwards them when I have the syste… --- ## [GROK filter with KV](https://discuss.elastic.co/t/grok-filter-with-kv/261209)
**Author:** [@jerin](https://discuss.elastic.co/u/jerin)\ **Replies:** 0\ **Last updated:** [January 15, 2021, 5:44am UTC](https://discuss.elastic.co/t/grok-filter-with-kv/261209 "2021-01-15T05:44:25Z")
Hello Everyone and Badger , I am trying to do a GROK of KV.. attached the snapshot of what I am trying to do .. Expected results : Tstamp : date and time Loglevel : WARN But I am getting LogLevel: ""level\\ .. as yo… --- ## [Does adding data nodes increase write throughput](https://discuss.elastic.co/t/does-adding-data-nodes-increase-write-throughput/261205)
**Author:** [@rex-remind](https://discuss.elastic.co/u/rex-remind)\ **Replies:** 3\ **Last updated:** [January 15, 2021, 4:50am UTC](https://discuss.elastic.co/t/does-adding-data-nodes-increase-write-throughput/261205 "2021-01-15T04:50:46Z")
Question is, all other things equal, and assuming even distribution of shards, does adding data nodes increase write throughput? My assumption is yes, I'd imagine the new data nodes could take on the burden of dealing w… --- ## [K8s metricbeat data volume](https://discuss.elastic.co/t/k8s-metricbeat-data-volume/261201)
**Author:** [@tim11](https://discuss.elastic.co/u/tim11)\ **Replies:** 0\ **Last updated:** [January 15, 2021, 3:34am UTC](https://discuss.elastic.co/t/k8s-metricbeat-data-volume/261201 "2021-01-15T03:34:40Z")
I am following link: https://www.elastic.co/guide/en/beats/metricbeat/6.8/running-on-kubernetes.html I find in the metricbeat-kubernetes.yaml, I am wondering whether I shall mount external volume in? or the data fold… --- ## [Time parsing in logstash](https://discuss.elastic.co/t/time-parsing-in-logstash/261199)
**Author:** [@525125](https://discuss.elastic.co/u/525125)\ **Replies:** 0\ **Last updated:** [January 15, 2021, 2:48am UTC](https://discuss.elastic.co/t/time-parsing-in-logstash/261199 "2021-01-15T02:48:29Z")
I need tp parse below log line and extract the time into @apptimestamp . It throughing date parse failure. We need use the filed in kibana. We need to get whole timestamp with timezone and AM/PM log line: /start/scrip… --- ## [Most efficient way to limit search result to List of Ids](https://discuss.elastic.co/t/most-efficient-way-to-limit-search-result-to-list-of-ids/261082)
**Author:** [@Hooman\_Bahreini](https://discuss.elastic.co/u/Hooman_Bahreini)\ **Replies:** 0\ **Last updated:** [January 14, 2021, 6:57am UTC](https://discuss.elastic.co/t/most-efficient-way-to-limit-search-result-to-list-of-ids/261082 "2021-01-14T06:57:31Z")
I am working on an e-commerce website. I have an index called AdDocument which is the products that are synched to Elasticsearch. Each product belongs to a category. Now I want to write a query to get all products which… --- ## [Mapping document indexing with NEST](https://discuss.elastic.co/t/mapping-document-indexing-with-nest/261156)
**Author:** [@Izzy](https://discuss.elastic.co/u/Izzy)\ **Replies:** 0\ **Last updated:** [January 14, 2021, 5:06pm UTC](https://discuss.elastic.co/t/mapping-document-indexing-with-nest/261156 "2021-01-14T17:06:45Z")
I'm using .NET Core application with NEST client. My goal is to index a model with few modifications in its properties, for example, this model contains list of objects, and I would like to document list of the Ids of t… --- ## [Which is the best option for upload photo images and search?](https://discuss.elastic.co/t/which-is-the-best-option-for-upload-photo-images-and-search/261194)
**Author:** [@rajends1](https://discuss.elastic.co/u/rajends1)\ **Replies:** 1\ **Last updated:** [January 14, 2021, 11:50pm UTC](https://discuss.elastic.co/t/which-is-the-best-option-for-upload-photo-images-and-search/261194 "2021-01-14T23:50:26Z")
which is the best option for upload person profile photo images and search ? Three options of Implementation are put image base64 (fig green circle) string data in dynamodb table as new field of type Map list for … --- ## [iS their a better way than this fuzzy search for multi-match?](https://discuss.elastic.co/t/is-their-a-better-way-than-this-fuzzy-search-for-multi-match/261193)
**Author:** [@rajends1](https://discuss.elastic.co/u/rajends1)\ **Replies:** 0\ **Last updated:** [January 14, 2021, 11:41pm UTC](https://discuss.elastic.co/t/is-their-a-better-way-than-this-fuzzy-search-for-multi-match/261193 "2021-01-14T23:41:47Z")
{ "query": { "multi\_match": { "fields": \[ "text", "title" \], "query": "king”, "fuzziness": "AUTO", "type": "best\_fields" } } }’ The fuzziness parameter can be specified as: • 0… --- ## [Best option for Wildcard Search with multimatch](https://discuss.elastic.co/t/best-option-for-wildcard-search-with-multimatch/261192)
**Author:** [@rajends1](https://discuss.elastic.co/u/rajends1)\ **Replies:** 0\ **Last updated:** [January 14, 2021, 11:34pm UTC](https://discuss.elastic.co/t/best-option-for-wildcard-search-with-multimatch/261192 "2021-01-14T23:34:22Z")
which is the Best option for Wildcard Search with multimatch and why ? Wildcard with multi-match { "query": { "multi\_match": { "query": "\*king\*", "fields": \[ "text", "title" \] } } } Alternatively to multi\_ma… --- ## [Filebeat:aws:cloudtrail](https://discuss.elastic.co/t/filebeatcloudtrail/261190)
**Author:** [@mdrdannyr](https://discuss.elastic.co/u/mdrdannyr)\ **Replies:** 0\ **Last updated:** [January 14, 2021, 11:13pm UTC](https://discuss.elastic.co/t/filebeatcloudtrail/261190 "2021-01-14T23:13:59Z")
Hi all, Had a question about the filebeat aws module - specifically the cloudtrail set. I've managed to get this up and running, and as far as i understand, the process used for the above can be broken down into the … --- ## [Created Index Pattern but does not save](https://discuss.elastic.co/t/created-index-pattern-but-does-not-save/261175)
**Author:** [@JLarue](https://discuss.elastic.co/u/JLarue)\ **Replies:** 1\ **Last updated:** [January 14, 2021, 10:00pm UTC](https://discuss.elastic.co/t/created-index-pattern-but-does-not-save/261175 "2021-01-14T22:00:59Z")
I am able to create an Index Pattern with fields however it does not save the pattern and I have no errors. There is no Save button. --- ## [Handling multiple logstream formats with Functionbeat](https://discuss.elastic.co/t/handling-multiple-logstream-formats-with-functionbeat/261181)
**Author:** [@Karl\_Falconer](https://discuss.elastic.co/u/Karl_Falconer)\ **Replies:** 0\ **Last updated:** [January 14, 2021, 9:00pm UTC](https://discuss.elastic.co/t/handling-multiple-logstream-formats-with-functionbeat/261181 "2021-01-14T21:00:20Z")
Hi, I have a working function beat sending logs from Cloudwatch containing mysql slow query data ES and am able to view the log data in Kibana. I am trying to understand a few things regarding various log types. What… --- ## [Does a bulk indexing request compact / unique?](https://discuss.elastic.co/t/does-a-bulk-indexing-request-compact-unique/261174)
**Author:** [@rex-remind](https://discuss.elastic.co/u/rex-remind)\ **Replies:** 5\ **Last updated:** [January 14, 2021, 8:45pm UTC](https://discuss.elastic.co/t/does-a-bulk-indexing-request-compact-unique/261174 "2021-01-14T20:45:11Z")
I'm curious if a bulk indexing API request compacts / uniques when ingested by Elasticsearch, i.e. will a create, then delete, then create, then update of a single document id collapse into just 1 create? If not, why no… --- ## [How to set up Filebeat to send geoip-info to our hosted instance?](https://discuss.elastic.co/t/how-to-set-up-filebeat-to-send-geoip-info-to-our-hosted-instance/260117)
**Author:** [@byoungman](https://discuss.elastic.co/u/byoungman)\ **Replies:** 9\ **Last updated:** [January 14, 2021, 8:39pm UTC](https://discuss.elastic.co/t/how-to-set-up-filebeat-to-send-geoip-info-to-our-hosted-instance/260117 "2021-01-14T20:39:14Z")
I am in the process of creating a POC presentation for my management team hoping to show the benefits and advantages of this approach as compared to what we are currently using which is a combination of AppDynamics, the … --- ## [Upgrade Help: The filter context has been removed in 7.X will old query work?](https://discuss.elastic.co/t/upgrade-help-the-filter-context-has-been-removed-in-7-x-will-old-query-work/261179)
**Author:** [@JonathanAaron](https://discuss.elastic.co/u/JonathanAaron)\ **Replies:** 0\ **Last updated:** [January 14, 2021, 8:28pm UTC](https://discuss.elastic.co/t/upgrade-help-the-filter-context-has-been-removed-in-7-x-will-old-query-work/261179 "2021-01-14T20:28:04Z")
Will my query from 6.X still work? I'm hoping I don't have to change the query since it's being ran on legacy apps. { "constant\_score": { "filter": { "bool": { "adjust\_pure\_ne… --- ## [Can't merge a non object mapping \[error.exception.stacktrace.vars.args\] with an object mapping \[error.exception.stacktrace.vars.args\]](https://discuss.elastic.co/t/cant-merge-a-non-object-mapping-error-exception-stacktrace-vars-args-with-an-object-mapping-error-exception-stacktrace-vars-args/260736)
**Author:** [@amrohit](https://discuss.elastic.co/u/amrohit)\ **Replies:** 0\ **Last updated:** [January 11, 2021, 3:13pm UTC](https://discuss.elastic.co/t/cant-merge-a-non-object-mapping-error-exception-stacktrace-vars-args-with-an-object-mapping-error-exception-stacktrace-vars-args/260736 "2021-01-11T15:13:14Z")
agent = python-apm technology = django index-mapping = dynamic in error doc the error.exception.stacktrace.vars.args have the value: \[ "GET", "/hdshvjkdfhkghfdkjhgdfkhgjdks-2020.12.28/\_search", {}, "{\\"query\\":{\\"b… --- ## [Can't find curator rpm / yum](https://discuss.elastic.co/t/cant-find-curator-rpm-yum/260702)
**Author:** [@CedricB](https://discuss.elastic.co/u/CedricB)\ **Replies:** 1\ **Last updated:** [January 14, 2021, 8:19pm UTC](https://discuss.elastic.co/t/cant-find-curator-rpm-yum/260702 "2021-01-14T20:19:18Z")
Hello there, I'm new here, hope this question was not already answered or documented anywhere. I'm trying to install ElasticSearch-curator on a Centos7 server. Reading this documentation : https://www.elastic.co/guide… --- ## [Heartbeat with Domain name target is not working](https://discuss.elastic.co/t/heartbeat-with-domain-name-target-is-not-working/260637)
**Author:** [@folderman](https://discuss.elastic.co/u/folderman)\ **Replies:** 5\ **Last updated:** [January 14, 2021, 7:18pm UTC](https://discuss.elastic.co/t/heartbeat-with-domain-name-target-is-not-working/260637 "2021-01-14T19:18:21Z")
Hi All, I have done a simple test with heartbeat to monitor the up/down of host, however, it is found that if I use IP, it works normal, however, once I change to use domain name, it doesn't work (attached). Do I mis… --- ## [Reindex string to date field exception](https://discuss.elastic.co/t/reindex-string-to-date-field-exception/260863)
**Author:** [@thanhlam](https://discuss.elastic.co/u/thanhlam)\ **Replies:** 1\ **Last updated:** [January 14, 2021, 7:15pm UTC](https://discuss.elastic.co/t/reindex-string-to-date-field-exception/260863 "2021-01-14T19:15:36Z")
Hello, I've done much searching on the topics of converting a field that's defined or mapped as "text string" to type date but can't find a specific example like what I'm trying. Any help would be appreciated. This ind… --- ## [Use analyzer in Completion Suggester](https://discuss.elastic.co/t/use-analyzer-in-completion-suggester/261161)
**Author:** [@RabBit\_BR](https://discuss.elastic.co/u/RabBit_BR)\ **Replies:** 0\ **Last updated:** [January 14, 2021, 6:00pm UTC](https://discuss.elastic.co/t/use-analyzer-in-completion-suggester/261161 "2021-01-14T18:00:29Z")
I have a question when using the analyzer in Completion Suggestion. I understand that CS performs the prefix search. Shouldn't the analyzer allow you to search for another term in the text other than the first? { "se… --- ## [Blacklisted domains](https://discuss.elastic.co/t/blacklisted-domains/261033)
**Author:** [@vinu89](https://discuss.elastic.co/u/vinu89)\ **Replies:** 3\ **Last updated:** [January 14, 2021, 5:59pm UTC](https://discuss.elastic.co/t/blacklisted-domains/261033 "2021-01-14T17:59:11Z")
i have dns logs and in that i have to check whether there is any malicious domains.i have a csv file containing malicious domain how to do a comparison.i used translate field it didnt work --- ## [Elastic stack hardware requirements, (look for recommendation)](https://discuss.elastic.co/t/elastic-stack-hardware-requirements-look-for-recommendation/261148)
**Author:** [@RODRIGO\_P](https://discuss.elastic.co/u/RODRIGO_P)\ **Replies:** 1\ **Last updated:** [January 14, 2021, 4:24pm UTC](https://discuss.elastic.co/t/elastic-stack-hardware-requirements-look-for-recommendation/261148 "2021-01-14T16:24:32Z")
Hi, I want setting up a cluster and I have these scenarios: 28 servers generate log per daily; EPS logs are 300 /s per server; EPD logs are ~5MM/day; RAW DATA BYTES is ~ 460BYTES; Size GB Day ~ 1.2TB; My required ret… --- ## [Issue with: Inference usage to ingest index pattern to trained and tested model](https://discuss.elastic.co/t/issue-with-inference-usage-to-ingest-index-pattern-to-trained-and-tested-model/260271)
**Author:** [@rtest\_9](https://discuss.elastic.co/u/rtest_9)\ **Replies:** 1\ **Last updated:** [January 14, 2021, 4:47pm UTC](https://discuss.elastic.co/t/issue-with-inference-usage-to-ingest-index-pattern-to-trained-and-tested-model/260271 "2021-01-14T16:47:06Z")
I am trying to predict a field after training and testing a model. I believe since I've created a Data Analytics Job to do this, I will be needing inference. A similar project has been issued in this following article. … --- ## [Get duration between 2 dates in logs](https://discuss.elastic.co/t/get-duration-between-2-dates-in-logs/261155)
**Author:** [@A\_Chichi](https://discuss.elastic.co/u/A_Chichi)\ **Replies:** 0\ **Last updated:** [January 14, 2021, 4:45pm UTC](https://discuss.elastic.co/t/get-duration-between-2-dates-in-logs/261155 "2021-01-14T16:45:47Z")
Hello, I would like to get the duration of a job depending on my logs. I've checked this link : Documentation and this one Elastic forum which is exactly what I would like to do but I don't find the solution... here is… --- ## [Unable to find the cluster in the selected time range. HTTP 404](https://discuss.elastic.co/t/unable-to-find-the-cluster-in-the-selected-time-range-http-404/260656)
**Author:** [@Finley](https://discuss.elastic.co/u/Finley)\ **Replies:** 5\ **Last updated:** [January 14, 2021, 4:40pm UTC](https://discuss.elastic.co/t/unable-to-find-the-cluster-in-the-selected-time-range-http-404/260656 "2021-01-14T16:40:08Z")
Hello, I have an elastic cluster and i'm trying to setup the stack monitoring. I followed the instructions on these pages : Collect Kibana monitoring data with Metricbeat | Kibana Guide \[8.11\] | Elastic View monitori… --- ## [How can I use facets in Vega-lite with sub aggregations?](https://discuss.elastic.co/t/how-can-i-use-facets-in-vega-lite-with-sub-aggregations/260920)
**Author:** [@marcosvrrs](https://discuss.elastic.co/u/marcosvrrs)\ **Replies:** 8\ **Last updated:** [January 14, 2021, 4:29pm UTC](https://discuss.elastic.co/t/how-can-i-use-facets-in-vega-lite-with-sub-aggregations/260920 "2021-01-14T16:29:24Z")
Hi all! I am trying to make this sub aggregation turn into a Vega-lite bar visualization in Kibana: GET index\_do/\_search { "size" : 0, "aggs": { "sube": { "terms": { … --- ## [\[Kibana\] Visualize / Heatmap / Filter Size & Label Display](https://discuss.elastic.co/t/kibana-visualize-heatmap-filter-size-label-display/260947)
**Author:** [@Andreasau](https://discuss.elastic.co/u/Andreasau)\ **Replies:** 7\ **Last updated:** [January 14, 2021, 4:27pm UTC](https://discuss.elastic.co/t/kibana-visualize-heatmap-filter-size-label-display/260947 "2021-01-14T16:27:15Z")
Hi all, I created a Heatmap which y-axis (Product #) against x-axis (Store location) and would like to apply a filter on y-axis which only included 15000 product # However, when I apply the filter by json input or Ela… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1601) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1603)