# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1667 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1668 --- ## [Filtering one index with another](https://discuss.elastic.co/t/filtering-one-index-with-another/257265)
**Author:** [@adwaitjoshi](https://discuss.elastic.co/u/adwaitjoshi)\ **Replies:** 1\ **Last updated:** [December 2, 2020, 12:22am UTC](https://discuss.elastic.co/t/filtering-one-index-with-another/257265 "2020-12-02T00:22:28Z")
So I know there is no connection between 2 indexes in Elasticsearch. However some times its impossible to completely denormalize the data. For example I have the following two indexes Parent Index Child Index. One of … --- ## [Edge\_ngram tokenizer and edge\_ngram filter don't behave the same?](https://discuss.elastic.co/t/edge-ngram-tokenizer-and-edge-ngram-filter-dont-behave-the-same/257291)
**Author:** [@redec](https://discuss.elastic.co/u/redec)\ **Replies:** 0\ **Last updated:** [December 2, 2020, 12:10am UTC](https://discuss.elastic.co/t/edge-ngram-tokenizer-and-edge-ngram-filter-dont-behave-the-same/257291 "2020-12-02T00:10:57Z")
I'm trying to convert a field which currently uses the edge\_ngram tokenizer to use the edge\_ngram filter instead, and tokens created by the edge\_ngram filter are not scoring the same as the same tokens created by the edg… --- ## [Cant access machine learning index from Canvas](https://discuss.elastic.co/t/cant-access-machine-learning-index-from-canvas/257119)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 5\ **Last updated:** [December 1, 2020, 11:52pm UTC](https://discuss.elastic.co/t/cant-access-machine-learning-index-from-canvas/257119 "2020-12-01T23:52:19Z")
Hi, Im trying to display data from the .ml-anomalies-\* index on Canvas, but it doesnt show the values in the metric visualization. (the index pattern exists) SELECT COUNT(\*) as count\_documents FROM ".ml-anomalies-\*" WHE… --- ## [Sub partition in Machine Learning](https://discuss.elastic.co/t/sub-partition-in-machine-learning/257220)
**Author:** [@OmarDacca](https://discuss.elastic.co/u/OmarDacca)\ **Replies:** 1\ **Last updated:** [December 1, 2020, 11:50pm UTC](https://discuss.elastic.co/t/sub-partition-in-machine-learning/257220 "2020-12-01T23:50:32Z")
Hi, Is it possible to make sub partitions in Machine Learning ? domain and event are fields in every document. I created a categorization ml job, with partition\_field = domain, but this is not enough, I must split it … --- ## [How can achieve this with kibana?](https://discuss.elastic.co/t/how-can-achieve-this-with-kibana/257270)
**Author:** [@nino](https://discuss.elastic.co/u/nino)\ **Replies:** 4\ **Last updated:** [December 1, 2020, 11:46pm UTC](https://discuss.elastic.co/t/how-can-achieve-this-with-kibana/257270 "2020-12-01T23:46:38Z")
Hello, i need to calculate dynamically return column, but i don't know if we can get this with kibana: formula column return = value (today) / value(yesterday) -1 @timestamp account value return… --- ## [Kibana User with diferent GMT time](https://discuss.elastic.co/t/kibana-user-with-diferent-gmt-time/256917)
**Author:** [@Samuel\_Amico](https://discuss.elastic.co/u/Samuel_Amico)\ **Replies:** 7\ **Last updated:** [December 1, 2020, 11:39pm UTC](https://discuss.elastic.co/t/kibana-user-with-diferent-gmt-time/256917 "2020-12-01T23:39:43Z")
Ok guys this is very IMPORTANT !!! I have my admin Space with my elastic superuser and I put this setting: Advance Settings -\> Timezone for date formatting = America/Belem I the other Space (Supervisor space) that has… --- ## [Missing \_scroll\_id in search response when using Python library](https://discuss.elastic.co/t/missing-scroll-id-in-search-response-when-using-python-library/257288)
**Author:** [@bbunderson](https://discuss.elastic.co/u/bbunderson)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 11:22pm UTC](https://discuss.elastic.co/t/missing-scroll-id-in-search-response-when-using-python-library/257288 "2020-12-01T23:22:17Z")
The \_scroll\_id is missing from the search response when using the Python library version 7.9.0 but the response does contain the \_scroll\_id when I query the API using curl. For example, the following Python code: respo… --- ## [Function "eq" is not working](https://discuss.elastic.co/t/function-eq-is-not-working/255466)
**Author:** [@tangkalo](https://discuss.elastic.co/u/tangkalo)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 10:46pm UTC](https://discuss.elastic.co/t/function-eq-is-not-working/255466 "2020-12-01T22:46:28Z")
Hi, all. I have been scratching my head as to how I can conditionally change color of the context for a markdown. For some reason, the equality function "eq" doesn't seem to compare correctly. Even though the markdown di… --- ## [Python3 Elastic Query returns large amount of results.. am i doing this right?](https://discuss.elastic.co/t/python3-elastic-query-returns-large-amount-of-results-am-i-doing-this-right/257283)
**Author:** [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 10:30pm UTC](https://discuss.elastic.co/t/python3-elastic-query-returns-large-amount-of-results-am-i-doing-this-right/257283 "2020-12-01T22:30:30Z")
hi, i'm still not sure i'm doing this right.. so any suggestions would be appreciated.. i have a LARGE data index of log data containing IP addresses.. ports.. and other network traffic info. its millions of entries a m… --- ## [ES 5.6 : stop spark indexing if active shard is not 100](https://discuss.elastic.co/t/es-5-6-stop-spark-indexing-if-active-shard-is-not-100/257206)
**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 1:20pm UTC](https://discuss.elastic.co/t/es-5-6-stop-spark-indexing-if-active-shard-is-not-100/257206 "2020-12-01T13:20:16Z")
Hello, When we restart a node in ES 5.6, active shard percent is about 96% We have noticed that spark jobs stop indexing in cluster as long as the value of active shard percent does not exceed 98%. have you heard of t… --- ## [Logstash exits after successfully installing plugin with docker-compose](https://discuss.elastic.co/t/logstash-exits-after-successfully-installing-plugin-with-docker-compose/255456)
**Author:** [@luka.klaric](https://discuss.elastic.co/u/luka.klaric)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 9:50pm UTC](https://discuss.elastic.co/t/logstash-exits-after-successfully-installing-plugin-with-docker-compose/255456 "2020-12-01T21:50:42Z")
I am trying to run an Elastic stack and I am trying to install a logstash plugin within the docker file. I am getting the message that the plugin is installed successful and right after that the container exits with code… --- ## [Multiple logstash output](https://discuss.elastic.co/t/multiple-logstash-output/257272)
**Author:** [@stijnvr](https://discuss.elastic.co/u/stijnvr)\ **Replies:** 1\ **Last updated:** [December 1, 2020, 9:09pm UTC](https://discuss.elastic.co/t/multiple-logstash-output/257272 "2020-12-01T21:09:30Z")
I would like to forward all source logs to Logstash. Logstash should have 2 outputs. Elasticsearch, for formatted logs S3, for untampered logs Is this possible ? Or do I need to configuring 2 outputs for the source l… --- ## [Median aggregation and routing](https://discuss.elastic.co/t/median-aggregation-and-routing/257276)
**Author:** [@pcb](https://discuss.elastic.co/u/pcb)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 9:01pm UTC](https://discuss.elastic.co/t/median-aggregation-and-routing/257276 "2020-12-01T21:01:06Z")
Hi ya, I'm working on spec'ing out a new datastore for aggregate calculations for near-real time dashboards and I'm evaluating Elasticsearch. I've read here that median is usually approximated: https://www.elastic.co/gu… --- ## [Doubts about Grok](https://discuss.elastic.co/t/doubts-about-grok/257129)
**Author:** [@rildo](https://discuss.elastic.co/u/rildo)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 8:37pm UTC](https://discuss.elastic.co/t/doubts-about-grok/257129 "2020-12-01T20:37:15Z")
Hello People , I have a doubt about my filter I have this content in my log file {"other\_logs": "127.0.0.1|28614|2018-11-28 23:51:57|srcport 50389 mwtype AvalancheBotnet-andromeda destaddr 2.2.2.2 destinyurl: dogs.ru|M… --- ## [Get all documents matching a list of values for a field](https://discuss.elastic.co/t/get-all-documents-matching-a-list-of-values-for-a-field/257274)
**Author:** [@jmaharjan](https://discuss.elastic.co/u/jmaharjan)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 8:19pm UTC](https://discuss.elastic.co/t/get-all-documents-matching-a-list-of-values-for-a-field/257274 "2020-12-01T20:19:48Z")
I am using multisearch (msearch from elasticsearch-py) to search for all documents using a list of document ids from a list of indices. The id's are explicitly assigned. The goal is to look for existing documents (using … --- ## [Query\_string with datetime](https://discuss.elastic.co/t/query-string-with-datetime/257271)
**Author:** [@spreet](https://discuss.elastic.co/u/spreet)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 8:10pm UTC](https://discuss.elastic.co/t/query-string-with-datetime/257271 "2020-12-01T20:10:07Z")
We recently migrated to ES 7.1 from 5.8. In the previous version query\_string with a datetime used to work. Query with date and time { "query": { "query\_string": { "query": "data.lastUpdateTime:\[\* TO 2018-1… --- ## [Multiline data to correlate into single line](https://discuss.elastic.co/t/multiline-data-to-correlate-into-single-line/257253)
**Author:** [@Ramesh535](https://discuss.elastic.co/u/Ramesh535)\ **Replies:** 1\ **Last updated:** [December 1, 2020, 6:38pm UTC](https://discuss.elastic.co/t/multiline-data-to-correlate-into-single-line/257253 "2020-12-01T18:38:58Z")
Hi Guys, Need some help I have the data in this format \[2020-11-27\] \[data\] \[country:India\] \[Capital:Delhi\] \[2020-11-27\] \[data\] \[country:India\] \[Currency:INR\] \[2020-11-27\] \[data\] \[country:India\] \[PM:Modi\] \[2020-11-2… --- ## [Incorrect result in Kibana TSVB chart](https://discuss.elastic.co/t/incorrect-result-in-kibana-tsvb-chart/257006)
**Author:** [@Agenobarb](https://discuss.elastic.co/u/Agenobarb)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 3:43pm UTC](https://discuss.elastic.co/t/incorrect-result-in-kibana-tsvb-chart/257006 "2020-12-01T15:43:21Z")
Please look at the field 'timestamp' in the screenshot from Discover: I am unable to understand why when I use metric max on this field - max(timestamp) I am getting a timestamp that is not within the range of timest… --- ## [Keystore does not update azure client secrets when changed - secrets seems to be persistent somehow](https://discuss.elastic.co/t/keystore-does-not-update-azure-client-secrets-when-changed-secrets-seems-to-be-persistent-somehow/257257)
**Author:** [@johanhaugland](https://discuss.elastic.co/u/johanhaugland)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 6:13pm UTC](https://discuss.elastic.co/t/keystore-does-not-update-azure-client-secrets-when-changed-secrets-seems-to-be-persistent-somehow/257257 "2020-12-01T18:13:59Z")
Short version: Unable to load new values into keystore secrets for azure plugin: azure.client.default.account azure.client.default.key They seem to be persistent - how do I purge the old values completely from the clu… --- ## [Nested Field can't access the nested field array using script query](https://discuss.elastic.co/t/nested-field-cant-access-the-nested-field-array-using-script-query/257256)
**Author:** [@khalilw1](https://discuss.elastic.co/u/khalilw1)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 6:12pm UTC](https://discuss.elastic.co/t/nested-field-cant-access-the-nested-field-array-using-script-query/257256 "2020-12-01T18:12:27Z")
Hello Guys, I have the following mapping PUT products/\_mapping { "properties": { "discounts": { "properties": { "KW": { "type": "nested" }, "SA": { "type": "neste… --- ## [Can we use filebeat to send data to AWS elasticsearch service?](https://discuss.elastic.co/t/can-we-use-filebeat-to-send-data-to-aws-elasticsearch-service/257166)
**Author:** [@Ashok4512](https://discuss.elastic.co/u/Ashok4512)\ **Replies:** 4\ **Last updated:** [December 1, 2020, 5:49pm UTC](https://discuss.elastic.co/t/can-we-use-filebeat-to-send-data-to-aws-elasticsearch-service/257166 "2020-12-01T17:49:52Z")
I am trying to send log data of my nginx server to AWS elasticsearch service. i am done with the changes in filebeat.yml file and then run the command "filebeat setup" but then i got the error like " Overwriting ILM poli… --- ## [Filebeats holding handles on rotated logs](https://discuss.elastic.co/t/filebeats-holding-handles-on-rotated-logs/256538)
**Author:** [@txmrlevine](https://discuss.elastic.co/u/txmrlevine)\ **Replies:** 3\ **Last updated:** [December 1, 2020, 5:20pm UTC](https://discuss.elastic.co/t/filebeats-holding-handles-on-rotated-logs/256538 "2020-12-01T17:20:53Z")
I am looking into why my disks are getting full and I found that filebeat is holding handles on logs that are rotated. I read some discussions on the topic and I did not see a definitive answer and all requests were rat… --- ## [Filebeat for just forwarding Full text log](https://discuss.elastic.co/t/filebeat-for-just-forwarding-full-text-log/256697)
**Author:** [@seddikalaouiismaili](https://discuss.elastic.co/u/seddikalaouiismaili)\ **Replies:** 8\ **Last updated:** [December 1, 2020, 4:49pm UTC](https://discuss.elastic.co/t/filebeat-for-just-forwarding-full-text-log/256697 "2020-12-01T16:49:14Z")
Hello team, Is there any way using filebat (7.10), for just forwarding logs ? The main goals is : shipping log from differents sources (file log text) forward them to another (file log text), without do any changes i… --- ## [Field value factor based on matched term](https://discuss.elastic.co/t/field-value-factor-based-on-matched-term/257241)
**Author:** [@Tianyi\_Mao](https://discuss.elastic.co/u/Tianyi_Mao)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 4:44pm UTC](https://discuss.elastic.co/t/field-value-factor-based-on-matched-term/257241 "2020-12-01T16:44:18Z")
In https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-function-score-query.html#function-field-value-factor it is mentioned that one can use a numeric field in the document to influence scoring. C… --- ## [Inner hits in a double nested query fine in ES 7.7, but not working in 7.10](https://discuss.elastic.co/t/inner-hits-in-a-double-nested-query-fine-in-es-7-7-but-not-working-in-7-10/257239)
**Author:** [@timarkh](https://discuss.elastic.co/u/timarkh)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 4:25pm UTC](https://discuss.elastic.co/t/inner-hits-in-a-double-nested-query-fine-in-es-7-7-but-not-working-in-7-10/257239 "2020-12-01T16:25:46Z")
I have an index (sentences) where documents contain two kinds of nested objects, one (ana) inside the other (words). In my queries, I use two inner\_hits keys to highlight the matches. This worked fine in 5.6 and still wo… --- ## [Vega request @timestamp not mapped to timestamp field](https://discuss.elastic.co/t/vega-request-timestamp-not-mapped-to-timestamp-field/257200)
**Author:** [@ewolfman](https://discuss.elastic.co/u/ewolfman)\ **Replies:** 6\ **Last updated:** [December 1, 2020, 4:14pm UTC](https://discuss.elastic.co/t/vega-request-timestamp-not-mapped-to-timestamp-field/257200 "2020-12-01T16:14:52Z")
Hi, I am using Kibana and ES 7.10.0. I have a vega-lite widget that works and fetches from Elasticsearch the data. When trying using @timestamp in a vega-lite widget I get no results, and the warning: "Infinite extent … --- ## [Grok parse failures](https://discuss.elastic.co/t/grok-parse-failures/257230)
**Author:** [@naveenrt23](https://discuss.elastic.co/u/naveenrt23)\ **Replies:** 3\ **Last updated:** [December 1, 2020, 4:12pm UTC](https://discuss.elastic.co/t/grok-parse-failures/257230 "2020-12-01T16:12:21Z")
Hello I'm playing around with grok filters and i'm running into parse failures..Any idea whats wrong ? Filters: filter { if \[type\] == "app-data" { mutate { rename =\> \["env", "environment"\] } grok { … --- ## [How can I drop preflight http requst( OPTIONS request)in Logstash](https://discuss.elastic.co/t/how-can-i-drop-preflight-http-requst-options-request-in-logstash/257235)
**Author:** [@abdoegy83](https://discuss.elastic.co/u/abdoegy83)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 4:09pm UTC](https://discuss.elastic.co/t/how-can-i-drop-preflight-http-requst-options-request-in-logstash/257235 "2020-12-01T16:09:51Z")
how can I drop preflight HTTP request( OPTIONS request)in Logstash, how can I get access to the HTTP method (post,get,...) --- ## [Logstash Grok](https://discuss.elastic.co/t/logstash-grok/256682)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 3\ **Last updated:** [December 1, 2020, 3:51pm UTC](https://discuss.elastic.co/t/logstash-grok/256682 "2020-12-01T15:51:45Z")
I need to start a grok at \<190\> I dont care about anything before that . What is the way to do this ? \<13\>Nov 25 15:36:31 servername.abc.com LOGSTASH\[-\]: \<190\>Nov 25 07:36:31 --- ## [Ingest pipeline not working but working in the simulate API](https://discuss.elastic.co/t/ingest-pipeline-not-working-but-working-in-the-simulate-api/205322)
**Author:** [@themarcusaurelius](https://discuss.elastic.co/u/themarcusaurelius)\ **Replies:** 6\ **Last updated:** [December 1, 2020, 3:42pm UTC](https://discuss.elastic.co/t/ingest-pipeline-not-working-but-working-in-the-simulate-api/205322 "2020-12-01T15:42:41Z")
I have a pipeline that is filtering Palo Alto logs through Grok patterns and other processors. Testing with the simulate API shows that it works but when I try to ingest into elasticsearch none of the documents go throug… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1666) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1668)