# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1942 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1943 --- ## [Useragent plugin - android 9 and 10](https://discuss.elastic.co/t/useragent-plugin-android-9-and-10/239175)
**Author:** [@holiveira](https://discuss.elastic.co/u/holiveira)\ **Replies:** 4\ **Last updated:** [July 9, 2020, 10:49am UTC](https://discuss.elastic.co/t/useragent-plugin-android-9-and-10/239175 "2020-07-09T10:49:32Z")
The parse of an Android 9 or 10 useragent is partial. For example, the fields user\_agentos\_major, user\_agentos\_minor do not exist. Example useragent: Mozilla/5.0 (Linux; Android 9; Redmi Note 7 Build/PKQ1.180904.001; w… --- ## [Using tokenizer on rank\_feature fields](https://discuss.elastic.co/t/using-tokenizer-on-rank-feature-fields/240417)
**Author:** [@lukegil](https://discuss.elastic.co/u/lukegil)\ **Replies:** 1\ **Last updated:** [July 9, 2020, 10:45am UTC](https://discuss.elastic.co/t/using-tokenizer-on-rank-feature-fields/240417 "2020-07-09T10:45:57Z")
Hi! I was wondering if it's possible to apply tokenizer/analyzers to rank\_feature fields. When attempting to create a sample index on ES 7.6.2 it doesn't appear to work, but I don't see anything explicit in the docs. In… --- ## [Merge two datasets](https://discuss.elastic.co/t/merge-two-datasets/240506)
**Author:** [@lugano](https://discuss.elastic.co/u/lugano)\ **Replies:** 0\ **Last updated:** [July 9, 2020, 9:59am UTC](https://discuss.elastic.co/t/merge-two-datasets/240506 "2020-07-09T09:59:53Z")
I have two datasets which I want to merge into one. I am using Elastic stack v7.7 . I want to use composite key with Painless script processor. To get a unique document I need 4 fields. 3 of the fields they match exactly… --- ## [Cant update the mapping](https://discuss.elastic.co/t/cant-update-the-mapping/238031)
**Author:** [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\ **Replies:** 0\ **Last updated:** [June 22, 2020, 7:56am UTC](https://discuss.elastic.co/t/cant-update-the-mapping/238031 "2020-06-22T07:56:41Z")
Hello, I cant map correctly the following field: http.request.body.original Currently part of my mapping looks like that for my apm indices: "http" : { "dynamic" : "false", "properties" : { … --- ## [LogStash is running but Not processing Logs](https://discuss.elastic.co/t/logstash-is-running-but-not-processing-logs/240491)
**Author:** [@singh.piyush862](https://discuss.elastic.co/u/singh.piyush862)\ **Replies:** 0\ **Last updated:** [July 9, 2020, 8:23am UTC](https://discuss.elastic.co/t/logstash-is-running-but-not-processing-logs/240491 "2020-07-09T08:23:36Z")
Hi All, We started Logstash service & it process the syslog data but suddenly it stopped processing logs (I could not see new logs in Kibaan/elastic search index) however Syslog is running. Elastic search is rusnning … --- ## [Issues with Wildcard Watcher](https://discuss.elastic.co/t/issues-with-wildcard-watcher/240315)
**Author:** [@LiamSwe](https://discuss.elastic.co/u/LiamSwe)\ **Replies:** 2\ **Last updated:** [July 9, 2020, 9:19am UTC](https://discuss.elastic.co/t/issues-with-wildcard-watcher/240315 "2020-07-09T09:19:15Z")
I am writing a watcher to monitor failures on a website of XML files imported that fail due to invalid character(s) in the XML. This is what I have right now, but for some reason it isn't working. Can anyone help me out? … --- ## [Quering nullable timstamp field](https://discuss.elastic.co/t/quering-nullable-timstamp-field/240478)
**Author:** [@recordable542](https://discuss.elastic.co/u/recordable542)\ **Replies:** 1\ **Last updated:** [July 9, 2020, 8:55am UTC](https://discuss.elastic.co/t/quering-nullable-timstamp-field/240478 "2020-07-09T08:55:28Z")
I have user index like below name: text frozen\_until: timestamp I want to query all users which... (frozen\_until == null || frozen\_until \< today) below is the query I'm struggling with: { "query": { "bool": { … --- ## [Link index lifecycle policies to the snapshot policy](https://discuss.elastic.co/t/link-index-lifecycle-policies-to-the-snapshot-policy/240440)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 1\ **Last updated:** [July 9, 2020, 8:26am UTC](https://discuss.elastic.co/t/link-index-lifecycle-policies-to-the-snapshot-policy/240440 "2020-07-09T08:26:04Z")
Hi all. I currently need to backup old indices are like 3 month older that the current time and only that, then after that i will delete those indices. I don't really know how to since the way i name the indices makes … --- ## [Need to integrate Logstash HTTP input plugin with my android application](https://discuss.elastic.co/t/need-to-integrate-logstash-http-input-plugin-with-my-android-application/240484)
**Author:** [@sheetalg](https://discuss.elastic.co/u/sheetalg)\ **Replies:** 0\ **Last updated:** [July 9, 2020, 8:01am UTC](https://discuss.elastic.co/t/need-to-integrate-logstash-http-input-plugin-with-my-android-application/240484 "2020-07-09T08:01:25Z")
I need to integrate Logstash HTTP input plugin with my android application so that I can errors logs to logstash server. Please guide me with example or sample android app --- ## [Logstash on Centos 6 with non-default java](https://discuss.elastic.co/t/logstash-on-centos-6-with-non-default-java/240361)
**Author:** [@Nekasas](https://discuss.elastic.co/u/Nekasas)\ **Replies:** 2\ **Last updated:** [July 9, 2020, 8:02am UTC](https://discuss.elastic.co/t/logstash-on-centos-6-with-non-default-java/240361 "2020-07-09T08:02:27Z")
Hello, We have an old Centos 6 server where java 1.7 is crucial and we can't update it to java 1.8 so we are using alternatives. Configure alternative with logstash is quite difficult ( at least for me) Problem is that… --- ## [Limitations for AWS hosted ES Instances](https://discuss.elastic.co/t/limitations-for-aws-hosted-es-instances/240303)
**Author:** [@Flora\_Dev](https://discuss.elastic.co/u/Flora_Dev)\ **Replies:** 3\ **Last updated:** [July 9, 2020, 7:58am UTC](https://discuss.elastic.co/t/limitations-for-aws-hosted-es-instances/240303 "2020-07-09T07:58:48Z")
Hello Experts, We have m5.xlarge.elasticsearch instance hosted for product search and index purpose (retail products, images, product descriptions ect.,) In AWS cloudwatch perspective I want to set alarm for Index Rate … --- ## [Elastic down when I ask for more than 6 days](https://discuss.elastic.co/t/elastic-down-when-i-ask-for-more-than-6-days/240336)
**Author:** [@ISR\_FY](https://discuss.elastic.co/u/ISR_FY)\ **Replies:** 4\ **Last updated:** [July 9, 2020, 7:53am UTC](https://discuss.elastic.co/t/elastic-down-when-i-ask-for-more-than-6-days/240336 "2020-07-09T07:53:47Z")
Morning team. Actually, I have a problem with my ElasticStack. I have crashes on my main elastic search when i ask in grafana dashboards for more than 6 days. The memory and CPU is high but Ive increased the CPU and me… --- ## [Can I block document names in Elasticsearch?](https://discuss.elastic.co/t/can-i-block-document-names-in-elasticsearch/240455)
**Author:** [@Callonski](https://discuss.elastic.co/u/Callonski)\ **Replies:** 1\ **Last updated:** [July 9, 2020, 7:51am UTC](https://discuss.elastic.co/t/can-i-block-document-names-in-elasticsearch/240455 "2020-07-09T07:51:25Z")
My problem is ingesting data that does not come in order into elasticsearch. The data is customer profiles, and if a customer updates their profile and then deletes it. I will receive two messages. One Update and one Del… --- ## [Time difference in last\_run\_metadata\_path file when Logstash and source database are in different timezones](https://discuss.elastic.co/t/time-difference-in-last-run-metadata-path-file-when-logstash-and-source-database-are-in-different-timezones/240190)
**Author:** [@saif3r](https://discuss.elastic.co/u/saif3r)\ **Replies:** 3\ **Last updated:** [July 9, 2020, 7:35am UTC](https://discuss.elastic.co/t/time-difference-in-last-run-metadata-path-file-when-logstash-and-source-database-are-in-different-timezones/240190 "2020-07-09T07:35:29Z")
Hello, Our ELK Stack is placed in UTC timezone (OS timezone is set to UTC). The database from which we pull the data from using JDBC is in CET (UTC+2) timezone. The config file for the pipeline looks like this: jdbc … --- ## [Showing icons for legends in place of text](https://discuss.elastic.co/t/showing-icons-for-legends-in-place-of-text/240316)
**Author:** [@VipinAgarwal](https://discuss.elastic.co/u/VipinAgarwal)\ **Replies:** 2\ **Last updated:** [July 9, 2020, 7:20am UTC](https://discuss.elastic.co/t/showing-icons-for-legends-in-place-of-text/240316 "2020-07-09T07:20:43Z")
Hello all, I'm a newbie to ELK stack, so apologies if this has already been answered. Would really appreciate if you can point me to right place. We have a requirement where we would like to show a horizontal bar with… --- ## [Help Searching the data from my index](https://discuss.elastic.co/t/help-searching-the-data-from-my-index/240286)
**Author:** [@snowfall\_2010](https://discuss.elastic.co/u/snowfall_2010)\ **Replies:** 3\ **Last updated:** [July 9, 2020, 6:14am UTC](https://discuss.elastic.co/t/help-searching-the-data-from-my-index/240286 "2020-07-09T06:14:18Z")
my index save data structure is the pic below: index info: "1":{ "aliases":{}, "mappings":{ "properties":{ "DeviceId":{ "type":"text", "fields":{ … --- ## [Semantically equivalent search leads to different results](https://discuss.elastic.co/t/semantically-equivalent-search-leads-to-different-results/240297)
**Author:** [@puschelfoo](https://discuss.elastic.co/u/puschelfoo)\ **Replies:** 4\ **Last updated:** [July 9, 2020, 5:13am UTC](https://discuss.elastic.co/t/semantically-equivalent-search-leads-to-different-results/240297 "2020-07-09T05:13:06Z")
Query \[1\] (exactly one result) and \[2\] (many results) differ in their results (quantity), although they are semantically equivalent according to the documentation (see "operator" parameter explanation for in Documentati… --- ## [Post Upgrading ElasticSearch to 6.8.10 its not receiving data from Logstash(5.6.16)](https://discuss.elastic.co/t/post-upgrading-elasticsearch-to-6-8-10-its-not-receiving-data-from-logstash-5-6-16/240445)
**Author:** [@vsudhaka](https://discuss.elastic.co/u/vsudhaka)\ **Replies:** 2\ **Last updated:** [July 9, 2020, 4:53am UTC](https://discuss.elastic.co/t/post-upgrading-elasticsearch-to-6-8-10-its-not-receiving-data-from-logstash-5-6-16/240445 "2020-07-09T04:53:05Z")
Hello, I am new in using ELK stack. I recently Upgraded Logstash from 5.6.13 -\> 5.6.16 ,ElasticSearch Nodes from 5.6.16 -\> 6.8.10 and Kibana from 5.6.16 -\> 6.8.10. I did not Upgrade Logstash and FileBeats to version 6… --- ## [How to send Json logs to Elastic Search using File Beats without extra fields](https://discuss.elastic.co/t/how-to-send-json-logs-to-elastic-search-using-file-beats-without-extra-fields/239972)
**Author:** [@Ashish\_kapoor](https://discuss.elastic.co/u/Ashish_kapoor)\ **Replies:** 4\ **Last updated:** [July 9, 2020, 4:50am UTC](https://discuss.elastic.co/t/how-to-send-json-logs-to-elastic-search-using-file-beats-without-extra-fields/239972 "2020-07-09T04:50:16Z")
Hi there, I am trying to send JSON logs to Elastic Search using file beats. My logs file looks like this {"timestamp":1581386084780,"message":"User 'Test' connected","eventId":107,"metadata":{"userID":"Test","serviceID… --- ## [Error in visualization \[esaggs\] \> Service unavailable when time filtering](https://discuss.elastic.co/t/error-in-visualization-esaggs-service-unavailable-when-time-filtering/239987)
**Author:** [@Kevin\_Renalda](https://discuss.elastic.co/u/Kevin_Renalda)\ **Replies:** 2\ **Last updated:** [July 8, 2020, 12:05pm UTC](https://discuss.elastic.co/t/error-in-visualization-esaggs-service-unavailable-when-time-filtering/239987 "2020-07-08T12:05:55Z")
Hi, I'm fairly new to kibana, I wanna ask about this error I keep getting every time I set the filter time range in my dashboard to a wide range and when I click the see the full error it just shows the exact same err… --- ## [Bug in elasticsearch search\_after rest api?](https://discuss.elastic.co/t/bug-in-elasticsearch-search-after-rest-api/240215)
**Author:** [@corbosman](https://discuss.elastic.co/u/corbosman)\ **Replies:** 5\ **Last updated:** [July 9, 2020, 3:14am UTC](https://discuss.elastic.co/t/bug-in-elasticsearch-search-after-rest-api/240215 "2020-07-09T03:14:04Z")
Hi all, im running into what I'm thinking might be a bug. I'm using the REST search api to return log entries stored in our elasticsearch cluster. This could run into the tens of thousands, so I'm using search\_after to r… --- ## [Can't access kibana when enable xpack.security](https://discuss.elastic.co/t/cant-access-kibana-when-enable-xpack-security/240114)
**Author:** [@Jinlian\_Chen](https://discuss.elastic.co/u/Jinlian_Chen)\ **Replies:** 4\ **Last updated:** [July 9, 2020, 3:08am UTC](https://discuss.elastic.co/t/cant-access-kibana-when-enable-xpack-security/240114 "2020-07-09T03:08:19Z")
Os: macOS Mojave 10.14.5 Elasticsearch version: 7.8.0 Kibana version: 7.8.0 Chrome version: Version 83.0.4103.106 (Official Build) (64-bit) Safari version: Version 12.1.1 (14607.2.6.1.1) Issue: Use Chrome can't acc… --- ## [Questions about default sorting！！！](https://discuss.elastic.co/t/questions-about-default-sorting/240362)
**Author:** [@111365](https://discuss.elastic.co/u/111365)\ **Replies:** 2\ **Last updated:** [July 9, 2020, 1:50am UTC](https://discuss.elastic.co/t/questions-about-default-sorting/240362 "2020-07-09T01:50:56Z")
When I use elasticsearch's search function, matchall always returns documents in a fixed order, without relevance ranking. So what is the sort order without using sort? --- ## [Help parsing a date field](https://discuss.elastic.co/t/help-parsing-a-date-field/240253)
**Author:** [@ajhstn](https://discuss.elastic.co/u/ajhstn)\ **Replies:** 3\ **Last updated:** [July 9, 2020, 1:24am UTC](https://discuss.elastic.co/t/help-parsing-a-date-field/240253 "2020-07-09T01:24:34Z")
Hello, my source data has the following dates, which i am struggling to create the correct field mapping. "notBefore": "Jun 9 00:31:02 2020 GMT", "notAfter": "Jun 9 00:31:02 2025 GMT" i have tried various combination… --- ## [ML: how to find anomaly from ip address](https://discuss.elastic.co/t/ml-how-to-find-anomaly-from-ip-address/239996)
**Author:** [@nameisnotimportant](https://discuss.elastic.co/u/nameisnotimportant)\ **Replies:** 5\ **Last updated:** [July 9, 2020, 12:48am UTC](https://discuss.elastic.co/t/ml-how-to-find-anomaly-from-ip-address/239996 "2020-07-09T00:48:38Z")
Hi, I have been trying to figure out how to use the multi metric to find anomaly in IP address. Objective is to do something like gmail login notification if IP address or device type are different. I created sample da… --- ## [Is there a way to bring back in clause without using OR in query string](https://discuss.elastic.co/t/is-there-a-way-to-bring-back-in-clause-without-using-or-in-query-string/240374)
**Author:** [@dcengl](https://discuss.elastic.co/u/dcengl)\ **Replies:** 1\ **Last updated:** [July 9, 2020, 12:48am UTC](https://discuss.elastic.co/t/is-there-a-way-to-bring-back-in-clause-without-using-or-in-query-string/240374 "2020-07-09T00:48:14Z")
Is there a way to bring back the "in" query without using OR in ES 7. For example: q=my-field:(value1 value2 value3) instead of q=my-field:(value1 OR value2 OR value3) --- ## [Conditionally merge values from 2 fields into 1 new field](https://discuss.elastic.co/t/conditionally-merge-values-from-2-fields-into-1-new-field/240436)
**Author:** [@ericl](https://discuss.elastic.co/u/ericl)\ **Replies:** 1\ **Last updated:** [July 9, 2020, 12:44am UTC](https://discuss.elastic.co/t/conditionally-merge-values-from-2-fields-into-1-new-field/240436 "2020-07-09T00:44:53Z")
I'm looking for a recommended way to copy value either from field1 or field2, whichever is not empty and field2 take precedence over field1, into a third field name field3 I was trying to do that with scripted fields, I… --- ## [Filter with multiple string queries with wildcard](https://discuss.elastic.co/t/filter-with-multiple-string-queries-with-wildcard/240432)
**Author:** [@okemu](https://discuss.elastic.co/u/okemu)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 9:41pm UTC](https://discuss.elastic.co/t/filter-with-multiple-string-queries-with-wildcard/240432 "2020-07-08T21:41:32Z")
Hello, I'm new to Elasticsearch and would greatly appreciate help on this In the query below I only want the first document to be returned, but instead both documents are returned. How can I write a query to allow wildc… --- ## [How many user are logging in to kibana?](https://discuss.elastic.co/t/how-many-user-are-logging-in-to-kibana/240430)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 2\ **Last updated:** [July 8, 2020, 10:06pm UTC](https://discuss.elastic.co/t/how-many-user-are-logging-in-to-kibana/240430 "2020-07-08T22:06:43Z")
I am running 7.8.0 enable xpack.security.audit.enabled: true in kibana.yml where are these two information going, which index or log? saved\_objects\_authorization\_success saved\_objects\_authorization\_failure --- ## [Question in using elasticsearch-certutil to generate cert](https://discuss.elastic.co/t/question-in-using-elasticsearch-certutil-to-generate-cert/240433)
**Author:** [@azteker](https://discuss.elastic.co/u/azteker)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 9:46pm UTC](https://discuss.elastic.co/t/question-in-using-elasticsearch-certutil-to-generate-cert/240433 "2020-07-08T21:46:04Z")
I have generated elastic-stack-ca.p12 Then I use this command to generate crt and key files for logstash. ./bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12 --name logstash --dns \[?\] --ip \[elk server's ip\] --p… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1941) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1943)