# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1990 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1991 --- ## [Replace substring and concat rest](https://discuss.elastic.co/t/replace-substring-and-concat-rest/237622)
**Author:** [@ksremo](https://discuss.elastic.co/u/ksremo)\ **Replies:** 2\ **Last updated:** [June 18, 2020, 12:52pm UTC](https://discuss.elastic.co/t/replace-substring-and-concat-rest/237622 "2020-06-18T12:52:27Z")
I have DNS Logs looks like (14)xxxxxxxxxxxx(11)keydelivery(13)mediaservices(7)windows(3)net(0) (4)mediaservices(7)windows(3)net(0) (3)windows.com(0) I want to remove all (...) and replace this with a dot "." if (..)… --- ## [Find one term result, or a list of match results](https://discuss.elastic.co/t/find-one-term-result-or-a-list-of-match-results/237472)
**Author:** [@darraghenright](https://discuss.elastic.co/u/darraghenright)\ **Replies:** 2\ **Last updated:** [June 18, 2020, 12:49pm UTC](https://discuss.elastic.co/t/find-one-term-result-or-a-list-of-match-results/237472 "2020-06-18T12:49:51Z")
Hi there :wave: Sorry, this is undoubtedly a bit of noob question but I am still trying to get to grips with compound queries in Elasticsearch. In my example, each document has a name field and we can assume that each n… --- ## [Problem with @timestamp](https://discuss.elastic.co/t/problem-with-timestamp/237587)
**Author:** [@Youssef\_SBAI](https://discuss.elastic.co/u/Youssef_SBAI)\ **Replies:** 6\ **Last updated:** [June 18, 2020, 12:44pm UTC](https://discuss.elastic.co/t/problem-with-timestamp/237587 "2020-06-18T12:44:53Z")
I use logstash for ingest in elasstic a CSV file, i have a error from the time stamps is not the daily date my config logstash is input { file { path =\> "/data/volumes/monitoring/logstash/logCtrlM/stock.csv" … --- ## [RabbitMQ output plugin](https://discuss.elastic.co/t/rabbitmq-output-plugin/236641)
**Author:** [@Marat](https://discuss.elastic.co/u/Marat)\ **Replies:** 1\ **Last updated:** [June 18, 2020, 12:44pm UTC](https://discuss.elastic.co/t/rabbitmq-output-plugin/236641 "2020-06-18T12:44:32Z")
I am a new user for Logstash, and I want to use Logstash's RabbitMQ output plugin to feed data to RabbitMQ, schema is pretty simple: Nginx -(input)-\>Logstash -(output)-\> RabbitMQ cat /etc/logstash/conf.d/10-nginx-f… --- ## [What Is The True Meaning Of IS NOT BETWEEN?](https://discuss.elastic.co/t/what-is-the-true-meaning-of-is-not-between/237615)
**Author:** [@Ethan777100](https://discuss.elastic.co/u/Ethan777100)\ **Replies:** 7\ **Last updated:** [June 18, 2020, 12:23pm UTC](https://discuss.elastic.co/t/what-is-the-true-meaning-of-is-not-between/237615 "2020-06-18T12:23:04Z")
i just implemented a filter to find the count of values that are not within -300 to 300 But in my results, why do i still see 3 rows of 300? I would interpret IS NOT BETWEEN to be inclusive of the range boundaries.… --- ## [Logstash translate and replace filter not working](https://discuss.elastic.co/t/logstash-translate-and-replace-filter-not-working/237582)
**Author:** [@marco2005](https://discuss.elastic.co/u/marco2005)\ **Replies:** 1\ **Last updated:** [June 18, 2020, 12:18pm UTC](https://discuss.elastic.co/t/logstash-translate-and-replace-filter-not-working/237582 "2020-06-18T12:18:56Z")
I have 5 log files using the below Golang log pattern: 2020-06-17 11:50:04 CEST | CORE | INFO | (pkg/collector/corechecks/net/ntp.go:162 in Run) | Failed to get clock offset from any ntp host And below is my filter: f… --- ## [Unable to see many custom index fields in Kibana Discover](https://discuss.elastic.co/t/unable-to-see-many-custom-index-fields-in-kibana-discover/237501)
**Author:** [@ozonshak](https://discuss.elastic.co/u/ozonshak)\ **Replies:** 6\ **Last updated:** [June 18, 2020, 12:11pm UTC](https://discuss.elastic.co/t/unable-to-see-many-custom-index-fields-in-kibana-discover/237501 "2020-06-18T12:11:00Z")
Hello. I'm attempting to load a new index into Elastic and Kibana. I have loaded it into ElasticSearch and I can see my fields just fine. Here is an example where I run a query against Dev Tools: { "took" : 2, "… --- ## [Best practice for Index and Shard Size](https://discuss.elastic.co/t/best-practice-for-index-and-shard-size/237627)
**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\ **Replies:** 0\ **Last updated:** [June 18, 2020, 12:04pm UTC](https://discuss.elastic.co/t/best-practice-for-index-and-shard-size/237627 "2020-06-18T12:04:06Z")
Hi, what is the best practice for index and shard size? I found sources that state that a good shard size is 10-30GB. But what is a good index size? I have timeseries data of over 300 GB split into 5 Indices and I am r… --- ## [Make the Benchmark dashboards available to all to be imported in kibana](https://discuss.elastic.co/t/make-the-benchmark-dashboards-available-to-all-to-be-imported-in-kibana/237527)
**Author:** [@micas](https://discuss.elastic.co/u/micas)\ **Replies:** 0\ **Last updated:** [June 17, 2020, 7:28pm UTC](https://discuss.elastic.co/t/make-the-benchmark-dashboards-available-to-all-to-be-imported-in-kibana/237527 "2020-06-17T19:28:31Z")
Even though i can run the esrally it would be useful if you guys can share the dashboards you have created: https://elasticsearch-benchmark-analytics.elastic.co/app/kibana#/dashboard/d02cc8e5-3f42-482a-a3d9-d09956db3040 … --- ## [Kibana dashboard - Input search field](https://discuss.elastic.co/t/kibana-dashboard-input-search-field/237126)
**Author:** [@cjabrantes](https://discuss.elastic.co/u/cjabrantes)\ **Replies:** 8\ **Last updated:** [June 18, 2020, 11:52am UTC](https://discuss.elastic.co/t/kibana-dashboard-input-search-field/237126 "2020-06-18T11:52:14Z")
Hi, I didn't found anything that suites this need, i found this thread with some years: Maybe better solution already exists. I want to present a dashboard with logs, from multiple indexes (to avoid colleagues to kno… --- ## [Can we use nested object in the parent-child relationship in elasticsearch?](https://discuss.elastic.co/t/can-we-use-nested-object-in-the-parent-child-relationship-in-elasticsearch/237625)
**Author:** [@sharathnasa](https://discuss.elastic.co/u/sharathnasa)\ **Replies:** 0\ **Last updated:** [June 18, 2020, 11:32am UTC](https://discuss.elastic.co/t/can-we-use-nested-object-in-the-parent-child-relationship-in-elasticsearch/237625 "2020-06-18T11:32:59Z")
i'm creating the mapping in elasticsearch. I have a four objects such as customer, promotion, product and agreement Customer - parent and promotion - child(child of customer) Promotion - parent and product - child(chil… --- ## [Add nfsiostat to metricbeat](https://discuss.elastic.co/t/add-nfsiostat-to-metricbeat/235499)
**Author:** [@coudenysj](https://discuss.elastic.co/u/coudenysj)\ **Replies:** 1\ **Last updated:** [June 18, 2020, 11:28am UTC](https://discuss.elastic.co/t/add-nfsiostat-to-metricbeat/235499 "2020-06-18T11:28:49Z")
Hi, I'm looking to get our nfsiostat information in metricbeat, but the documentation is bit overwhelming. I would like to use the diskio logic, but I'm not sure this is the right way to go, because: diskio is using h… --- ## [Missing documents when using partitions on a term aggregation](https://discuss.elastic.co/t/missing-documents-when-using-partitions-on-a-term-aggregation/237483)
**Author:** [@jsvac](https://discuss.elastic.co/u/jsvac)\ **Replies:** 2\ **Last updated:** [June 18, 2020, 11:25am UTC](https://discuss.elastic.co/t/missing-documents-when-using-partitions-on-a-term-aggregation/237483 "2020-06-18T11:25:07Z")
Hi all, I have a relatively small index (about 5M docs) and each document has an organization\_id field. I need to list all the unique values for this field and I've implemented this using partitions by following this: h… --- ## [How can I split up my message log lines in separate tabs/fields?](https://discuss.elastic.co/t/how-can-i-split-up-my-message-log-lines-in-separate-tabs-fields/237531)
**Author:** [@Roger\_Payne](https://discuss.elastic.co/u/Roger_Payne)\ **Replies:** 1\ **Last updated:** [June 18, 2020, 11:22am UTC](https://discuss.elastic.co/t/how-can-i-split-up-my-message-log-lines-in-separate-tabs-fields/237531 "2020-06-18T11:22:15Z")
Hello All, Yesterday, I set up ELK so I can send my routers syslogs to make it easier to view. I've completed this by installing a ubuntu server with rsyslogd, ELK and beats from a few online how to's. Next I sent the l… --- ## [How to recover streaming data even if the connection lost with Python client Elasticsearch?](https://discuss.elastic.co/t/how-to-recover-streaming-data-even-if-the-connection-lost-with-python-client-elasticsearch/237273)
**Author:** [@New\_user](https://discuss.elastic.co/u/New_user)\ **Replies:** 4\ **Last updated:** [June 18, 2020, 10:12am UTC](https://discuss.elastic.co/t/how-to-recover-streaming-data-even-if-the-connection-lost-with-python-client-elasticsearch/237273 "2020-06-18T10:12:44Z")
I stream RESTful API data from https://www.n2yo.com/api/ which for tracking satellite positions. I use python client with Elasticsearch. I save the streamed data to ES every 10 seconds and visualized by Kibana. My ES ves… --- ## [Elastic Rollup Job , Error while creating visualization](https://discuss.elastic.co/t/elastic-rollup-job-error-while-creating-visualization/237577)
**Author:** [@brijeshpallath](https://discuss.elastic.co/u/brijeshpallath)\ **Replies:** 0\ **Last updated:** [June 18, 2020, 7:10am UTC](https://discuss.elastic.co/t/elastic-rollup-job-error-while-creating-visualization/237577 "2020-06-18T07:10:53Z")
Hi I have created rollup Job as per the specification given below. This will roll up data on an hourly basis. I have also created a rollup index pattern combining the rollup index and source/original index pattern. Pl… --- ## [JSON Processor to parse logs data into doc objects](https://discuss.elastic.co/t/json-processor-to-parse-logs-data-into-doc-objects/234949)
**Author:** [@Jalpesh1](https://discuss.elastic.co/u/Jalpesh1)\ **Replies:** 2\ **Last updated:** [June 18, 2020, 9:08am UTC](https://discuss.elastic.co/t/json-processor-to-parse-logs-data-into-doc-objects/234949 "2020-06-18T09:08:12Z")
Hi Team, We have below doc data in JSON format { "\_index": "jaeger-span-2020-05-29", "\_type": "\_doc", "\_id": "QDuvYHIBiNzxbOQnW-IN", "\_version": 1, "\_score": 0, "\_source": { "traceID": "1a9a6917049eff71", "span… --- ## [Count the number of rows(lines) in a CSV file](https://discuss.elastic.co/t/count-the-number-of-rows-lines-in-a-csv-file/237601)
**Author:** [@inchirah](https://discuss.elastic.co/u/inchirah)\ **Replies:** 0\ **Last updated:** [June 18, 2020, 9:02am UTC](https://discuss.elastic.co/t/count-the-number-of-rows-lines-in-a-csv-file/237601 "2020-06-18T09:02:12Z")
Hey guys, i'm trying to count the number of rows in my csv file (it contain 2631 row) and save it in a variable. I used ruby filter but it didn't work so i tried using the metric filter but i get an result that i even … --- ## [Close Csv File when Logstash is run as a windows service](https://discuss.elastic.co/t/close-csv-file-when-logstash-is-run-as-a-windows-service/235363)
**Author:** [@Bender](https://discuss.elastic.co/u/Bender)\ **Replies:** 4\ **Last updated:** [June 18, 2020, 8:50am UTC](https://discuss.elastic.co/t/close-csv-file-when-logstash-is-run-as-a-windows-service/235363 "2020-06-18T08:50:33Z")
Hello Community, iam very new in this topic. I start a windows service via nssm.exe to observe a file for a csv to start the logstash.bat and specified config. Now i have the problem that after the logstash is triggere… --- ## [Output condition filter on filebeat module](https://discuss.elastic.co/t/output-condition-filter-on-filebeat-module/237505)
**Author:** [@tvander](https://discuss.elastic.co/u/tvander)\ **Replies:** 3\ **Last updated:** [June 18, 2020, 8:46am UTC](https://discuss.elastic.co/t/output-condition-filter-on-filebeat-module/237505 "2020-06-18T08:46:11Z")
Hi, i have my kafka server with two filebeat module enabled: kafka and system, the filebeat config also include a "kafka" tags. On my logstash server i use multi pipeline, what i'm trying to do is separate kafka logs fr… --- ## [Es7.5.1 \_refresh taking 10+ seconds](https://discuss.elastic.co/t/es7-5-1-refresh-taking-10-seconds/237594)
**Author:** [@\_es1](https://discuss.elastic.co/u/_es1)\ **Replies:** 0\ **Last updated:** [June 18, 2020, 8:32am UTC](https://discuss.elastic.co/t/es7-5-1-refresh-taking-10-seconds/237594 "2020-06-18T08:32:53Z")
Hi, when I indexing a doc with refresh=true, it always take more than 10 seconds to response from my EsCluster (5 nodes each 8c32g) with all default settings. and if set refresh=false, it would take more than 40 seconds… --- ## [Kibana: Indices have lifecycle errors](https://discuss.elastic.co/t/kibana-indices-have-lifecycle-errors/237592)
**Author:** [@AJCandfield](https://discuss.elastic.co/u/AJCandfield)\ **Replies:** 0\ **Last updated:** [June 18, 2020, 8:21am UTC](https://discuss.elastic.co/t/kibana-indices-have-lifecycle-errors/237592 "2020-06-18T08:21:02Z")
Hi all, A few months after we deployed the ELK stack, we are not able to see logs on Kibana from some indexes (like filebeat, metricbeat, etc...) and we're not sure why. We can see we have a 5GB filebeat index but we ju… --- ## [Date-Type-Error on keyword field...what?](https://discuss.elastic.co/t/date-type-error-on-keyword-field-what/237588)
**Author:** [@creaticious](https://discuss.elastic.co/u/creaticious)\ **Replies:** 0\ **Last updated:** [June 18, 2020, 8:12am UTC](https://discuss.elastic.co/t/date-type-error-on-keyword-field-what/237588 "2020-06-18T08:12:47Z")
Hey guys, strange problem...i have a keyword field for different casual writing styles for the same date...so like "16.06.2020, 16.6.2020, 16.6., 16.06.20...". On the first indexing-loop everything works fine...on the n… --- ## [ES Cluster for Zipkin](https://discuss.elastic.co/t/es-cluster-for-zipkin/237568)
**Author:** [@ishan\_ji\_Gupta](https://discuss.elastic.co/u/ishan_ji_Gupta)\ **Replies:** 3\ **Last updated:** [June 18, 2020, 7:43am UTC](https://discuss.elastic.co/t/es-cluster-for-zipkin/237568 "2020-06-18T07:43:08Z")
ElasticSearch recommendation for Zipkin (hardware and cluster). --- ## [Scripted Field not working](https://discuss.elastic.co/t/scripted-field-not-working/237365)
**Author:** [@N\_P](https://discuss.elastic.co/u/N_P)\ **Replies:** 1\ **Last updated:** [June 18, 2020, 7:38am UTC](https://discuss.elastic.co/t/scripted-field-not-working/237365 "2020-06-18T07:38:31Z")
Hi Folks, I am trying to make a scripted field that takes the "@timestamp" field converts it to PST (pacific standard time) and then extracts the hour. Can anyone see where I am going wrong with the below scripted fi… --- ## [Is it possible to merge results of a search for two indexes based on a unique identifier in common? Like a join](https://discuss.elastic.co/t/is-it-possible-to-merge-results-of-a-search-for-two-indexes-based-on-a-unique-identifier-in-common-like-a-join/237547)
**Author:** [@Brendow\_Adriel](https://discuss.elastic.co/u/Brendow_Adriel)\ **Replies:** 4\ **Last updated:** [June 18, 2020, 7:25am UTC](https://discuss.elastic.co/t/is-it-possible-to-merge-results-of-a-search-for-two-indexes-based-on-a-unique-identifier-in-common-like-a-join/237547 "2020-06-18T07:25:17Z")
Elasticsearch 7.7 using Java API REST from what I understand, the merge generates a new index. I just want to merge the final result of 2 indexes based on an identifier. As a join query of a relational database. i'ts po… --- ## [DNS Logs: Packetbeat or Filebeat?](https://discuss.elastic.co/t/dns-logs-packetbeat-or-filebeat/237519)
**Author:** [@uklipse](https://discuss.elastic.co/u/uklipse)\ **Replies:** 1\ **Last updated:** [June 18, 2020, 7:08am UTC](https://discuss.elastic.co/t/dns-logs-packetbeat-or-filebeat/237519 "2020-06-18T07:08:42Z")
I need to implement internal DNS logging and I'm trying to determine which is better filebeat or packetbeat. This is a Windows DNS server and the logs can be written to a local file which we can read with filebeat or we … --- ## [Strategies for managing configuration, plugins](https://discuss.elastic.co/t/strategies-for-managing-configuration-plugins/236999)
**Author:** [@jwcw](https://discuss.elastic.co/u/jwcw)\ **Replies:** 1\ **Last updated:** [June 18, 2020, 7:00am UTC](https://discuss.elastic.co/t/strategies-for-managing-configuration-plugins/236999 "2020-06-18T07:00:58Z")
Hi, I'm wondering if there are any recommended strategies for managing the configuration files and plugins across nodes in an elastic cluster. For example, when modifying configurations in elasticsearch.yml, it's common… --- ## [Creating a dashboard that will show all messages/entries in Elastic that meet a certain requirement](https://discuss.elastic.co/t/creating-a-dashboard-that-will-show-all-messages-entries-in-elastic-that-meet-a-certain-requirement/236755)
**Author:** [@Rietty](https://discuss.elastic.co/u/Rietty)\ **Replies:** 1\ **Last updated:** [June 18, 2020, 7:00am UTC](https://discuss.elastic.co/t/creating-a-dashboard-that-will-show-all-messages-entries-in-elastic-that-meet-a-certain-requirement/236755 "2020-06-18T07:00:28Z")
Hi, I'm very new to Kibana and Elasticsearch and have been fiddling with this for a few hours trying to get it to work. My use case is probably very simple but I can't seem to make it show both filters at once. What I w… --- ## [Subset in an array](https://discuss.elastic.co/t/subset-in-an-array/237459)
**Author:** [@surendra\_gandham](https://discuss.elastic.co/u/surendra_gandham)\ **Replies:** 2\ **Last updated:** [June 18, 2020, 6:54am UTC](https://discuss.elastic.co/t/subset-in-an-array/237459 "2020-06-18T06:54:40Z")
Hi everyone, Thanks for reading. Here's my problem. I have an array with numbers on each document as such: Document 1: \[1, 2, 3\] Document 2: \[1, 4\] Document 3: \[6,12,2\] I want to query my documents and find those d… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1989) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1991)