# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1604 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1605 --- ## [How to get splited tokens of query、 best matched document and those document's term vector at the same time when searching in elasticsearch](https://discuss.elastic.co/t/how-to-get-splited-tokens-of-query-best-matched-document-and-those-documents-term-vector-at-the-same-time-when-searching-in-elasticsearch/261094)
**Author:** [@Shiwei\_Zhang](https://discuss.elastic.co/u/Shiwei_Zhang)\ **Replies:** 0\ **Last updated:** [January 14, 2021, 8:43am UTC](https://discuss.elastic.co/t/how-to-get-splited-tokens-of-query-best-matched-document-and-those-documents-term-vector-at-the-same-time-when-searching-in-elasticsearch/261094 "2021-01-14T08:43:56Z")
I want to recalculate the score according to the tf and idf according to the term\_vector from elasticsearch, so I need : query's tokens splitted by analyzer(i use ik\_max\_word) of elasticsearch best matched document id t… --- ## [Range query on integer fields](https://discuss.elastic.co/t/range-query-on-integer-fields/261089)
**Author:** [@Jogi\_Michal](https://discuss.elastic.co/u/Jogi_Michal)\ **Replies:** 0\ **Last updated:** [January 14, 2021, 8:06am UTC](https://discuss.elastic.co/t/range-query-on-integer-fields/261089 "2021-01-14T08:06:43Z")
Hi all, My mapping: { 'doc': { 'sources': { 'properties': { 'depth': { 'type': 'integer' } } … --- ## [Retrying failed action with response code 503](https://discuss.elastic.co/t/retrying-failed-action-with-response-code-503/261088)
**Author:** [@Tabriz](https://discuss.elastic.co/u/Tabriz)\ **Replies:** 1\ **Last updated:** [January 14, 2021, 7:57am UTC](https://discuss.elastic.co/t/retrying-failed-action-with-response-code-503/261088 "2021-01-14T07:57:30Z")
Sometimes the logstash service stops automatically in ELK and the data is not displayed on the kibana web service. What could be the reason?may is the reason amount of the files? --- ## [Disable Elastic Cloud Login](https://discuss.elastic.co/t/disable-elastic-cloud-login/260967)
**Author:** [@apox](https://discuss.elastic.co/u/apox)\ **Replies:** 2\ **Last updated:** [January 14, 2021, 7:04am UTC](https://discuss.elastic.co/t/disable-elastic-cloud-login/260967 "2021-01-14T07:04:00Z")
Hi Guy, How can I disable the Elastic Cloud Login in Kibana and use online the Elasticsearch Login? --- ## [What will be the mapping and DSL for creating a organisation employee profile user with maximum upload of 3 photos for storing and searching his photos please of image with timestamp](https://discuss.elastic.co/t/what-will-be-the-mapping-and-dsl-for-creating-a-organisation-employee-profile-user-with-maximum-upload-of-3-photos-for-storing-and-searching-his-photos-please-of-image-with-timestamp/260427)
**Author:** [@rajends1](https://discuss.elastic.co/u/rajends1)\ **Replies:** 11\ **Last updated:** [January 14, 2021, 6:05am UTC](https://discuss.elastic.co/t/what-will-be-the-mapping-and-dsl-for-creating-a-organisation-employee-profile-user-with-maximum-upload-of-3-photos-for-storing-and-searching-his-photos-please-of-image-with-timestamp/260427 "2021-01-14T06:05:43Z")
A.What will be the mapping and DSL query structure example for creating a organisation employee profile user with maximum upload of n photo limit with image size nMb and x height , y width for storing and searching h… --- ## [How can I convert hexademical to binary?](https://discuss.elastic.co/t/how-can-i-convert-hexademical-to-binary/261073)
**Author:** [@lilyyy](https://discuss.elastic.co/u/lilyyy)\ **Replies:** 2\ **Last updated:** [January 14, 2021, 6:05am UTC](https://discuss.elastic.co/t/how-can-i-convert-hexademical-to-binary/261073 "2021-01-14T06:05:02Z")
Hi. I have packet data and type is hexadecimal. when I change to json, it looks like 01:00:00:80:00:00:00:01:00:00:00 in kibana's discover. I want to change this hexadecimal type to binary in kibana. do I need to c… --- ## [How to change value on pie charts using lense](https://discuss.elastic.co/t/how-to-change-value-on-pie-charts-using-lense/260990)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 2\ **Last updated:** [January 14, 2021, 5:54am UTC](https://discuss.elastic.co/t/how-to-change-value-on-pie-charts-using-lense/260990 "2021-01-14T05:54:32Z")
Hi, I have a setup of ELK 7.10.0v. I made pie chart using lense there I want to change the value at the end of the number in pie chart to Million and in Billions for making easy to understand. Please suggest me how … --- ## [User Authentication/Lockout mechanism](https://discuss.elastic.co/t/user-authentication-lockout-mechanism/260980)
**Author:** [@Boopathi\_Raj](https://discuss.elastic.co/u/Boopathi_Raj)\ **Replies:** 2\ **Last updated:** [January 14, 2021, 3:44am UTC](https://discuss.elastic.co/t/user-authentication-lockout-mechanism/260980 "2021-01-14T03:44:41Z")
Hi Team, We want to implement the following user Authentication mechanism for Elastic/Kibana users. Lockout after 6 invalid tries Lockout for a minimum of 30 mins or until administrator enables the account ( After Loc… --- ## [About Logstash cloud service](https://discuss.elastic.co/t/about-logstash-cloud-service/261065)
**Author:** [@sungjin.kim](https://discuss.elastic.co/u/sungjin.kim)\ **Replies:** 8\ **Last updated:** [January 14, 2021, 2:39am UTC](https://discuss.elastic.co/t/about-logstash-cloud-service/261065 "2021-01-14T02:39:45Z")
I am using elasticsearch and kibana on elastic cloud(elastic.co) i am considering to use logstash to collect user events from application server log file. for this, I am setting up filebeats on app server and about to … --- ## [Error on an external ruby script](https://discuss.elastic.co/t/error-on-an-external-ruby-script/261069)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 0\ **Last updated:** [January 14, 2021, 2:32am UTC](https://discuss.elastic.co/t/error-on-an-external-ruby-script/261069 "2021-01-14T02:32:31Z")
Hi im getting the following error in an external ruby code: Could not process event: undefined method \`\[\]' for nil not every key in this hash, exist on the data being consumed by logstash, so I added a conditional that… --- ## [Cannot index event when using output pipeline definition](https://discuss.elastic.co/t/cannot-index-event-when-using-output-pipeline-definition/260822)
**Author:** [@subsonnic](https://discuss.elastic.co/u/subsonnic)\ **Replies:** 4\ **Last updated:** [January 14, 2021, 2:25am UTC](https://discuss.elastic.co/t/cannot-index-event-when-using-output-pipeline-definition/260822 "2021-01-14T02:25:51Z")
Hi, I am using filebeat/elasticsearch/kibana 7.10.0. My filebeat runs on Kubernetes. When I activate my ingest pipeline in my filebeat output config it runs into errors on client side. But if I test one event in my pi… --- ## [Logstash refuses to start](https://discuss.elastic.co/t/logstash-refuses-to-start/261013)
**Author:** [@Falikou1](https://discuss.elastic.co/u/Falikou1)\ **Replies:** 1\ **Last updated:** [January 14, 2021, 2:14am UTC](https://discuss.elastic.co/t/logstash-refuses-to-start/261013 "2021-01-14T02:14:44Z")
Logstash configuration parsing is: input { tcp { port =\> "5141" codec =\> json type =\> "syslog" } } filter { grok { match =\> { "message" =\> "%{SYSLOG5424PRI:syslog\_index}-\\s\*%{SYSLOGHOST:syslog\_hostnam… --- ## [CountRequest does not carry over default index for ElasticSearch 7.10.1](https://discuss.elastic.co/t/countrequest-does-not-carry-over-default-index-for-elasticsearch-7-10-1/261067)
**Author:** [@honelight](https://discuss.elastic.co/u/honelight)\ **Replies:** 0\ **Last updated:** [January 14, 2021, 1:11am UTC](https://discuss.elastic.co/t/countrequest-does-not-carry-over-default-index-for-elasticsearch-7-10-1/261067 "2021-01-14T01:11:31Z")
Hi: I am fairly new to the NEST Library. I am using both the Count function and the Search function, below is some sample code I wrote to recreate the issue: using System; using Nest; namespace NestCountTe… --- ## [Filebeat dissect](https://discuss.elastic.co/t/filebeat-dissect/261062)
**Author:** [@Benoit\_Martin](https://discuss.elastic.co/u/Benoit_Martin)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 11:03pm UTC](https://discuss.elastic.co/t/filebeat-dissect/261062 "2021-01-13T23:03:38Z")
Hi, I'm trying to parse that type of line via dissect. I know that I can do pipeline/logstash grok but I want to find a way to do it with dissect directly on filebeat side :slight\_smile: filebeat.yml ##################… --- ## [Overriding Builtin Datastream Index / Component Templates](https://discuss.elastic.co/t/overriding-builtin-datastream-index-component-templates/259744)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 15\ **Last updated:** [January 13, 2021, 10:59pm UTC](https://discuss.elastic.co/t/overriding-builtin-datastream-index-component-templates/259744 "2021-01-13T22:59:06Z")
Hello, With legacy index templates, in order to add extra fields without risk that an Elastic update would ovverwrite changes, we created override templates with a higher order which contained extra fields settings etc. … --- ## [DateRangeQuery with NEST results with server error 400 - "all shards failed"](https://discuss.elastic.co/t/daterangequery-with-nest-results-with-server-error-400-all-shards-failed/261059)
**Author:** [@Izzy](https://discuss.elastic.co/u/Izzy)\ **Replies:** 1\ **Last updated:** [January 13, 2021, 10:40pm UTC](https://discuss.elastic.co/t/daterangequery-with-nest-results-with-server-error-400-all-shards-failed/261059 "2021-01-13T22:40:07Z")
I'm using NEST client on my .NET Core 3.1 (C#) application. I'm trying to write a search query by using QueryContainer. So far, search is working fine with textual fields, but when I'm trying to search according to Dat… --- ## [Is there a way to evaluate an expression and get the result?](https://discuss.elastic.co/t/is-there-a-way-to-evaluate-an-expression-and-get-the-result/260986)
**Author:** [@AgrPriyank](https://discuss.elastic.co/u/AgrPriyank)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 11:31am UTC](https://discuss.elastic.co/t/is-there-a-way-to-evaluate-an-expression-and-get-the-result/260986 "2021-01-13T11:31:06Z")
I have multiple nodes scattered around different regions. My application is deployed region wise, i.e. the application present in region A will only talk to resources in region A. However, in order to provide high avail… --- ## [Connecting to ElasticSearch via JavaAPI is slow on the first hit](https://discuss.elastic.co/t/connecting-to-elasticsearch-via-javaapi-is-slow-on-the-first-hit/260997)
**Author:** [@pcvijayvignesh](https://discuss.elastic.co/u/pcvijayvignesh)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 12:34pm UTC](https://discuss.elastic.co/t/connecting-to-elasticsearch-via-javaapi-is-slow-on-the-first-hit/260997 "2021-01-13T12:34:40Z")
I have a Java server running on one of our on-premise servers and it will connect to Elastic server hosted in AWS. Whenever a request is made from the Java application it will connect to elastic with the below piece of … --- ## [Json parser error](https://discuss.elastic.co/t/json-parser-error/261061)
**Author:** [@Surjiths](https://discuss.elastic.co/u/Surjiths)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 10:05pm UTC](https://discuss.elastic.co/t/json-parser-error/261061 "2021-01-13T22:05:29Z")
Hi Team, I am getting the following error from logstash \[2020-12-09T08:20:57.962Z\]\[ERROR\]\[logstash.codecs.json \] JSON parse error, original data now in message field {:error=\>#\ **Author:** [@Minor\_Vargas](https://discuss.elastic.co/u/Minor_Vargas)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 10:01pm UTC](https://discuss.elastic.co/t/inges-pipeline-kv-processor-not-working-with-foreach/261060 "2021-01-13T22:01:32Z") hello guys! I'm using an ingest pipeline. I'm using the foreach processor and inside of it the kv processor but it's not really working.. Having the following array (made after using the split processor) "detail" : \[ … --- ## [Upgrading from 5.6 to 7.5.0 -\> What problems could I face on the query/aggregation side and indexing side](https://discuss.elastic.co/t/upgrading-from-5-6-to-7-5-0-what-problems-could-i-face-on-the-query-aggregation-side-and-indexing-side/261054)
**Author:** [@JonathanAaron](https://discuss.elastic.co/u/JonathanAaron)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 9:29pm UTC](https://discuss.elastic.co/t/upgrading-from-5-6-to-7-5-0-what-problems-could-i-face-on-the-query-aggregation-side-and-indexing-side/261054 "2021-01-13T21:29:23Z")
We do basic bool/must type queries based a couple of fields and several nested terms aggregations with some sum aggs. On the indexing side of things we're going with bulk indexing. My team is getting a new cluster set … --- ## [Index.lifecycle.rollover\_alias \[filebeat-7.9.1\] does not point to index \[filebeat-7.9.1-2020.09.30\]](https://discuss.elastic.co/t/index-lifecycle-rollover-alias-filebeat-7-9-1-does-not-point-to-index-filebeat-7-9-1-2020-09-30/259798)
**Author:** [@NaiaraSS](https://discuss.elastic.co/u/NaiaraSS)\ **Replies:** 6\ **Last updated:** [January 13, 2021, 9:25pm UTC](https://discuss.elastic.co/t/index-lifecycle-rollover-alias-filebeat-7-9-1-does-not-point-to-index-filebeat-7-9-1-2020-09-30/259798 "2021-01-13T21:25:28Z")
Hi everyone! I was balancing my nodes, and after i get sucessfull i needed to improve my storeage, after i finish this procedure, i got this error in node master: \[ERROR\]\[o.e.b.ElasticsearchUncaughtExceptionHandler\] \[n… --- ## [Can we configure logstash to listen only to a paricular set of hosts](https://discuss.elastic.co/t/can-we-configure-logstash-to-listen-only-to-a-paricular-set-of-hosts/261049)
**Author:** [@prashant\_Rajenderan](https://discuss.elastic.co/u/prashant_Rajenderan)\ **Replies:** 2\ **Last updated:** [January 13, 2021, 9:21pm UTC](https://discuss.elastic.co/t/can-we-configure-logstash-to-listen-only-to-a-paricular-set-of-hosts/261049 "2021-01-13T21:21:32Z")
Currently my logstash input is listening to filebeat on port XXXX,my requirement is to collect log data only from a particular hosts(let's say only from Webservers). I dont want to modify the filebeat configuration direc… --- ## [Parsing syslog RFC 5424 format](https://discuss.elastic.co/t/parsing-syslog-rfc-5424-format/261021)
**Author:** [@S3l3ct3d](https://discuss.elastic.co/u/S3l3ct3d)\ **Replies:** 2\ **Last updated:** [January 13, 2021, 9:07pm UTC](https://discuss.elastic.co/t/parsing-syslog-rfc-5424-format/261021 "2021-01-13T21:07:56Z")
Good morning, I have a log source that sends syslog messages in RFC 5424 format. I have searched everywhere to figure out how to parse these syslog messages. Since logstash's syslog input is for RFC 3164 format, nothing… --- ## [GROK Custom Pattern help. Drop leading and trailing spaces](https://discuss.elastic.co/t/grok-custom-pattern-help-drop-leading-and-trailing-spaces/261037)
**Author:** [@fastxl](https://discuss.elastic.co/u/fastxl)\ **Replies:** 1\ **Last updated:** [January 13, 2021, 8:41pm UTC](https://discuss.elastic.co/t/grok-custom-pattern-help-drop-leading-and-trailing-spaces/261037 "2021-01-13T20:41:36Z")
Looking to GROK the following data "(DATA: SOME STUFF)" What I am after is "SOME STUFF". When I use the following \\(DATA: (?\ \*(.+?) \*)\\) I get this result in the debugger { "DATA": "SOME STUFF" } but if my da… --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/261019)
**Author:** [@Gustavo](https://discuss.elastic.co/u/Gustavo)\ **Replies:** 5\ **Last updated:** [January 13, 2021, 8:00pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/261019 "2021-01-13T20:00:56Z")
Guys, after updating the system to 7.10 Kibana does not start. Elastic ''' { "name" : "Ubuntu20", "cluster\_name" : "elasticsearch", "cluster\_uuid" : "gS3kil9cSqC2c8b3ENegow", "version" : { "number" : "7.10.1", "… --- ## [Match query with best match at top](https://discuss.elastic.co/t/match-query-with-best-match-at-top/261036)
**Author:** [@Padam\_Sethia](https://discuss.elastic.co/u/Padam_Sethia)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 6:46pm UTC](https://discuss.elastic.co/t/match-query-with-best-match-at-top/261036 "2021-01-13T18:46:30Z")
Hello , I am having real difficulty getting best matches at top. Here's a sample of my document { "\_index": "finished\_goods", "\_type": "\_doc", "\_id": "1", "\_score": 1, … --- ## [Unified Highlighter throws too\_complex\_to\_determinize\_exception with \>288 filter terms](https://discuss.elastic.co/t/unified-highlighter-throws-too-complex-to-determinize-exception-with-288-filter-terms/261035)
**Author:** [@idoub](https://discuss.elastic.co/u/idoub)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 6:35pm UTC](https://discuss.elastic.co/t/unified-highlighter-throws-too-complex-to-determinize-exception-with-288-filter-terms/261035 "2021-01-13T18:35:04Z")
There seems to be a problem with the Unified Highlighter in Lucene 8.6.2 that is affecting ElasticSearch 7.9.1. I already asked the Lucene developers if they knew of the bug and they said it's an ElasticSearch specific i… --- ## [Annotated-text field in Kibana](https://discuss.elastic.co/t/annotated-text-field-in-kibana/260770)
**Author:** [@Naid](https://discuss.elastic.co/u/Naid)\ **Replies:** 3\ **Last updated:** [January 13, 2021, 6:07pm UTC](https://discuss.elastic.co/t/annotated-text-field-in-kibana/260770 "2021-01-13T18:07:15Z")
Hi, I've created an index with a field type annotated-text and then an index pattern for this index. The type shows up as 'unknown' and therefore there are limitations in what I can do with it in Kibana. Is this type n… --- ## [Clone and display input from filebeat to logstash](https://discuss.elastic.co/t/clone-and-display-input-from-filebeat-to-logstash/261032)
**Author:** [@umesh2020](https://discuss.elastic.co/u/umesh2020)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 5:59pm UTC](https://discuss.elastic.co/t/clone-and-display-input-from-filebeat-to-logstash/261032 "2021-01-13T17:59:34Z")
Hi I would like to check what input LogStash is receiving without changing output plugin. Is there a way to duplicate and display input data to LogStash coming from filebeat ? I don't have tcpdump installed, so I can't… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1603) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1605)