# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=227 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 228 --- ## [Query String query with multiple terms](https://discuss.elastic.co/t/query-string-query-with-multiple-terms/360723)
**Author:** [@darrylds](https://discuss.elastic.co/u/darrylds)\ **Replies:** 2\ **Last updated:** [June 3, 2024, 4:13pm UTC](https://discuss.elastic.co/t/query-string-query-with-multiple-terms/360723 "2024-06-03T16:13:16Z")
I have a quite large index, well at least to me, 3 million records and adds between 500 to 2000 more a day. There are 150 categories, I want to be able to search for query strings within those categories. There are al… --- ## [Accented and non-accented characters in Elasticsearch](https://discuss.elastic.co/t/accented-and-non-accented-characters-in-elasticsearch/360703)
**Author:** [@navaneethan](https://discuss.elastic.co/u/navaneethan)\ **Replies:** 3\ **Last updated:** [June 3, 2024, 3:52pm UTC](https://discuss.elastic.co/t/accented-and-non-accented-characters-in-elasticsearch/360703 "2024-06-03T15:52:21Z")
Hi Team, We need to produce both accented & non-accented characters for the non-accented searches in elasticsearch EX: for Amelie, the search should show Amelie as well as Amélie, Amèlie, Amélié, Ámelié, Àmelie To r… --- ## [Ingesting Nginx access logs in custom log format](https://discuss.elastic.co/t/ingesting-nginx-access-logs-in-custom-log-format/360708)
**Author:** [@sai8274](https://discuss.elastic.co/u/sai8274)\ **Replies:** 2\ **Last updated:** [June 3, 2024, 3:52pm UTC](https://discuss.elastic.co/t/ingesting-nginx-access-logs-in-custom-log-format/360708 "2024-06-03T15:52:04Z")
Hi All, I had a question in regards to the nginx integration of elastic agent. We are using a custom format for nginx logs that has some additional metrics, so the grok in default ingest policy that comes with nginx in… --- ## [Need Help Searching for Similarities in my Logs](https://discuss.elastic.co/t/need-help-searching-for-similarities-in-my-logs/357322)
**Author:** [@vpolius](https://discuss.elastic.co/u/vpolius)\ **Replies:** 1\ **Last updated:** [June 3, 2024, 3:34pm UTC](https://discuss.elastic.co/t/need-help-searching-for-similarities-in-my-logs/357322 "2024-06-03T15:34:01Z")
I am trying to find a query or filter to help me solve an issue. I have MFA logs coming into Elastic and I am trying to create an alert to let me know when an account authenticates using a phone number that is already us… --- ## [There are many defunct process while esrally race success](https://discuss.elastic.co/t/there-are-many-defunct-process-while-esrally-race-success/360719)
**Author:** [@Andy\_Cong](https://discuss.elastic.co/u/Andy_Cong)\ **Replies:** 1\ **Last updated:** [June 3, 2024, 3:08pm UTC](https://discuss.elastic.co/t/there-are-many-defunct-process-while-esrally-race-success/360719 "2024-06-03T15:08:51Z")
There are many defunct process while esrally race success. I have commit a complete issue on GitHub, but there is no response. Has anyone encountered this problem before? Can you provide some suggestions? add: run es… --- ## [import new third party models into elastic](https://discuss.elastic.co/t/import-new-third-party-models-into-elastic/360721)
**Author:** [@Imen\_Bakir](https://discuss.elastic.co/u/Imen_Bakir)\ **Replies:** 1\ **Last updated:** [June 3, 2024, 2:42pm UTC](https://discuss.elastic.co/t/import-new-third-party-models-into-elastic/360721 "2024-06-03T14:42:16Z")
Hello, is there a solution for this problem? I wanted to load a model into Elastic, (it's a clustering model: hdbscan), but I've encountered an error: NotImplementedError: Importing ML models of type \ **Author:** [@PodarcisMuralis](https://discuss.elastic.co/u/PodarcisMuralis)\ **Replies:** 4\ **Last updated:** [June 3, 2024, 2:08pm UTC](https://discuss.elastic.co/t/ordering-terms-in-term-aggregation-in-the-new-java-api-client/360716 "2024-06-03T14:08:57Z") I have such an aggregation query in the old High Rest Client and want to convert it into the same query in the new Java API Client but there is not sort function in the terms query. How can we convert it? Or is it by def… --- ## [Boost field in the new Java API Client](https://discuss.elastic.co/t/boost-field-in-the-new-java-api-client/360715)
**Author:** [@PodarcisMuralis](https://discuss.elastic.co/u/PodarcisMuralis)\ **Replies:** 1\ **Last updated:** [June 3, 2024, 1:33pm UTC](https://discuss.elastic.co/t/boost-field-in-the-new-java-api-client/360715 "2024-06-03T13:33:41Z")
I am migrating old High Rest Java Api Client into Java Api Client but there are everywhere in queries of the old code, this "boost" field. I could not find out if these both fields are used in the new client by default… --- ## [Index template not getting applied to my index](https://discuss.elastic.co/t/index-template-not-getting-applied-to-my-index/360697)
**Author:** [@vijay117](https://discuss.elastic.co/u/vijay117)\ **Replies:** 7\ **Last updated:** [June 3, 2024, 1:33pm UTC](https://discuss.elastic.co/t/index-template-not-getting-applied-to-my-index/360697 "2024-06-03T13:33:05Z")
Hi Community, I have created a new index template( for total\_field\_limit) using Kibana console, but it is not getting applied with my index. I have deleted my index and then ran the code so that the index will pick the … --- ## [How query index data and indexed data](https://discuss.elastic.co/t/how-query-index-data-and-indexed-data/360537)
**Author:** [@Andy\_Cong](https://discuss.elastic.co/u/Andy_Cong)\ **Replies:** 2\ **Last updated:** [June 3, 2024, 11:49am UTC](https://discuss.elastic.co/t/how-query-index-data-and-indexed-data/360537 "2024-06-03T11:49:03Z")
Hi，andybody. I want to query an index table data and for other data related to this table, such as indexed data. I want to estimate how much disk storage capacity is needed based on the growth of index data. How can I… --- ## [Insert float data into Integer type success](https://discuss.elastic.co/t/insert-float-data-into-integer-type-success/360691)
**Author:** [@lht](https://discuss.elastic.co/u/lht)\ **Replies:** 2\ **Last updated:** [June 3, 2024, 8:57am UTC](https://discuss.elastic.co/t/insert-float-data-into-integer-type-success/360691 "2024-06-03T08:57:33Z")
I attempted to create a field of type integer in Elasticsearch, expecting to only be able to insert integers. However, I found that I was able to insert integers, floating-point numbers, and even strings (using co.elasti… --- ## [Elasticsearch output multiple hosts but no fault tolerance](https://discuss.elastic.co/t/elasticsearch-output-multiple-hosts-but-no-fault-tolerance/360667)
**Author:** [@Mahdi\_Moazami](https://discuss.elastic.co/u/Mahdi_Moazami)\ **Replies:** 2\ **Last updated:** [June 3, 2024, 8:56am UTC](https://discuss.elastic.co/t/elasticsearch-output-multiple-hosts-but-no-fault-tolerance/360667 "2024-06-03T08:56:26Z")
Hi Elastic team, We've designed an Elasticsearch cluster with 3 nodes and there is 2 independent Logstash instances that ingest data to this cluster. sometimes one of the ES cluster's node downs due to high load and can… --- ## [How to disable logstash add default field automatically?](https://discuss.elastic.co/t/how-to-disable-logstash-add-default-field-automatically/360695)
**Author:** [@Victor\_Lee](https://discuss.elastic.co/u/Victor_Lee)\ **Replies:** 1\ **Last updated:** [June 3, 2024, 8:49am UTC](https://discuss.elastic.co/t/how-to-disable-logstash-add-default-field-automatically/360695 "2024-06-03T08:49:22Z")
I am using Logstash and Elasticsearch as my backup database. Recently, I discovered an error related to Logstash using the JSON codec to decode my input file JSON. If the JSON does not contain a 'host' field, Logstash au… --- ## [Unable to import ndjson file into kibana bashboard using API](https://discuss.elastic.co/t/unable-to-import-ndjson-file-into-kibana-bashboard-using-api/360670)
**Author:** [@koushii](https://discuss.elastic.co/u/koushii)\ **Replies:** 9\ **Last updated:** [June 3, 2024, 6:47am UTC](https://discuss.elastic.co/t/unable-to-import-ndjson-file-into-kibana-bashboard-using-api/360670 "2024-06-03T06:47:55Z")
Hey Everyone, I'm stuck at a point of importing dashboard(ndjson) file which I exported into kibana using API. I've tried below commands as per AWS Official documentation. curl -X POST https://\/\_plugin/kib… --- ## [Insert a new json-record into an indexed document](https://discuss.elastic.co/t/insert-a-new-json-record-into-an-indexed-document/360683)
**Author:** [@Noureddine\_Ettalhi](https://discuss.elastic.co/u/Noureddine_Ettalhi)\ **Replies:** 1\ **Last updated:** [June 3, 2024, 5:04am UTC](https://discuss.elastic.co/t/insert-a-new-json-record-into-an-indexed-document/360683 "2024-06-03T05:04:41Z")
I am new to Elasticsearch, and I am trying to find a way to have an analogy with Oracle / SQL culture : Create table. insert records. update a record. select a record ...etc my current example is so simple: PUT /ett… --- ## [ELK Enterprise License](https://discuss.elastic.co/t/elk-enterprise-license/360685)
**Author:** [@Rutuja\_More](https://discuss.elastic.co/u/Rutuja_More)\ **Replies:** 1\ **Last updated:** [June 3, 2024, 4:31am UTC](https://discuss.elastic.co/t/elk-enterprise-license/360685 "2024-06-03T04:31:29Z")
In the ELK stack enterprise license, there is a drill-down option for selecting visuals on the dashboard, and we can also access the cloud platform. What are the features we can get more --- ## [Kubernetes log to elasticsearch](https://discuss.elastic.co/t/kubernetes-log-to-elasticsearch/360684)
**Author:** [@Frances\_Chu](https://discuss.elastic.co/u/Frances_Chu)\ **Replies:** 0\ **Last updated:** [June 3, 2024, 4:03am UTC](https://discuss.elastic.co/t/kubernetes-log-to-elasticsearch/360684 "2024-06-03T04:03:10Z")
I would like to send the Kubernetes log to my ES. I found some solutions like fluentd. I also found some information about install the Kubernetes integration assets Is there any updated method to do that. Any idea? --- ## [Failing to serialize 2D arrays \[Elasticsearch.NET\]](https://discuss.elastic.co/t/failing-to-serialize-2d-arrays-elasticsearch-net/360094)
**Author:** [@Motsols](https://discuss.elastic.co/u/Motsols)\ **Replies:** 1\ **Last updated:** [June 2, 2024, 4:55pm UTC](https://discuss.elastic.co/t/failing-to-serialize-2d-arrays-elasticsearch-net/360094 "2024-06-02T16:55:52Z")
A simple 2D array (aka multi-dimensional array) for a linestring such as this fails to serialize into json: new\[,\] { { 10.0, 10.0 }, {15.0, 15.0 } } With the exception message Elastic.Transport.UnexpectedTran… --- ## [Implement custom code in Filter plugin for Logstash](https://discuss.elastic.co/t/implement-custom-code-in-filter-plugin-for-logstash/360615)
**Author:** [@Manoilayans](https://discuss.elastic.co/u/Manoilayans)\ **Replies:** 3\ **Last updated:** [June 2, 2024, 2:21pm UTC](https://discuss.elastic.co/t/implement-custom-code-in-filter-plugin-for-logstash/360615 "2024-06-02T14:21:19Z")
While ingesting the data we can using Filters like filter { mutate { copy =\> { "source\_field" =\> "dest\_field" } } } But we need to implement as listed below.. · Proper case · Proper punctuation · Avoid duplicate… --- ## [Grok help not getting data](https://discuss.elastic.co/t/grok-help-not-getting-data/360664)
**Author:** [@wmei](https://discuss.elastic.co/u/wmei)\ **Replies:** 3\ **Last updated:** [June 2, 2024, 1:00pm UTC](https://discuss.elastic.co/t/grok-help-not-getting-data/360664 "2024-06-02T13:00:32Z")
Hi! Been scratching my head on this all day. Could use some help. I am using elasticsearch 7.17.6. I have filebeat set to read log file, use a dissect processor, sends to logstash. My problem is I am trying to grok thi… --- ## [Kibana Canvas Line Chart Y-axis Sorting](https://discuss.elastic.co/t/kibana-canvas-line-chart-y-axis-sorting/360659)
**Author:** [@Ercan\_OLMEZ](https://discuss.elastic.co/u/Ercan_OLMEZ)\ **Replies:** 1\ **Last updated:** [June 1, 2024, 2:41pm UTC](https://discuss.elastic.co/t/kibana-canvas-line-chart-y-axis-sorting/360659 "2024-06-01T14:41:40Z")
Hi, we use kibana canvas line chart element with 2 values comes from our custom indexes anybody knows how to sort y axis desc or asc it adds new values to top there is my expression filters | essql query="SELECT \* … --- ## [Unable to create an Index and send logs to Elasticsearch from Logstash getting 404 error](https://discuss.elastic.co/t/unable-to-create-an-index-and-send-logs-to-elasticsearch-from-logstash-getting-404-error/360657)
**Author:** [@Guptha\_Bayyana](https://discuss.elastic.co/u/Guptha_Bayyana)\ **Replies:** 1\ **Last updated:** [June 1, 2024, 10:40am UTC](https://discuss.elastic.co/t/unable-to-create-an-index-and-send-logs-to-elasticsearch-from-logstash-getting-404-error/360657 "2024-06-01T10:40:33Z")
We are not able to create an Index on Elasticsearch using logstash. when I try the access indices I see 404 on the Elasticsearch \<{ "error" : { "root\_cause" : \[ { "type" : "index\_not\_found\_exception"… --- ## [Lower performance after migrating from Ceph to OpenEbs](https://discuss.elastic.co/t/lower-performance-after-migrating-from-ceph-to-openebs/360652)
**Author:** [@Sajad\_Soltanian](https://discuss.elastic.co/u/Sajad_Soltanian)\ **Replies:** 1\ **Last updated:** [June 1, 2024, 9:05am UTC](https://discuss.elastic.co/t/lower-performance-after-migrating-from-ceph-to-openebs/360652 "2024-06-01T09:05:02Z")
We have previously gotten 16 warm-data-nodes (running on Kuber) all having the same resource (32Gb heap, 64Gb Ram, 3 Tb hdd). Since it is not much recommended to use a distributed storage system for Elasticsearch, we ha… --- ## [Exiting: error unpacking config data: more than one namespace configured accessing 'output' (source:'/etc/filebeat/filebeat.yml')](https://discuss.elastic.co/t/exiting-error-unpacking-config-data-more-than-one-namespace-configured-accessing-output-source-etc-filebeat-filebeat-yml/360650)
**Author:** [@Kamalesh\_Seervi](https://discuss.elastic.co/u/Kamalesh_Seervi)\ **Replies:** 0\ **Last updated:** [June 1, 2024, 3:40am UTC](https://discuss.elastic.co/t/exiting-error-unpacking-config-data-more-than-one-namespace-configured-accessing-output-source-etc-filebeat-filebeat-yml/360650 "2024-06-01T03:40:14Z")
This is my filebeat.yml file I have commented the Logstash Now when I run this below command I get this error. sudo filebeat setup --index-management -E output.logstash.enable=false -E 'output.elasticsearch.hosts=\[… --- ## [Retrieve the configured max\_clause\_count setting 8.x](https://discuss.elastic.co/t/retrieve-the-configured-max-clause-count-setting-8-x/359873)
**Author:** [@mengjiann](https://discuss.elastic.co/u/mengjiann)\ **Replies:** 5\ **Last updated:** [June 1, 2024, 3:16am UTC](https://discuss.elastic.co/t/retrieve-the-configured-max-clause-count-setting-8-x/359873 "2024-06-01T03:16:25Z")
Hi, I understand that indices.query.bool.max\_clause\_count is deprecated in 8.x. The calculation is performed dynamically depending on the heap size and also the thread pool. But is there is a way to retrieve it durin… --- ## [Logstash Date does not match system](https://discuss.elastic.co/t/logstash-date-does-not-match-system/360459)
**Author:** [@iceman0410](https://discuss.elastic.co/u/iceman0410)\ **Replies:** 3\ **Last updated:** [June 1, 2024, 2:35am UTC](https://discuss.elastic.co/t/logstash-date-does-not-match-system/360459 "2024-06-01T02:35:29Z")
Hi everyone, I have 2 logs below need to parse. The out put timestamp match time but does not match date. Can anyone help me review m logstash conf ? Log message 1: \[13:35:32.727:\]ipr\_tcp\_open\_connect\_i(): fail openin… --- ## [How to swap field values](https://discuss.elastic.co/t/how-to-swap-field-values/360619)
**Author:** [@Zlobny\_Raven](https://discuss.elastic.co/u/Zlobny_Raven)\ **Replies:** 4\ **Last updated:** [May 31, 2024, 9:48pm UTC](https://discuss.elastic.co/t/how-to-swap-field-values/360619 "2024-05-31T21:48:42Z")
Hi, I need to swap values between two fields. I have: "field1" : "value1" "field2" : "value2" I need: "field1" : "value2" "field2" : "value1" Can I do it with help of some filter-plugin? --- ## [Logstash output S3 performance tunning](https://discuss.elastic.co/t/logstash-output-s3-performance-tunning/360640)
**Author:** [@Quan\_Le\_H\_i](https://discuss.elastic.co/u/Quan_Le_H_i)\ **Replies:** 0\ **Last updated:** [May 31, 2024, 5:06pm UTC](https://discuss.elastic.co/t/logstash-output-s3-performance-tunning/360640 "2024-05-31T17:06:38Z")
I have logstash server read events from input kafka and output to S3. My logstash pipeline have set pipeline.worker to 1 to set event in same order when write to file. After change other config such as pipeline.batchsi… --- ## [Deprecated Nest library](https://discuss.elastic.co/t/deprecated-nest-library/360635)
**Author:** [@tchaudhry](https://discuss.elastic.co/u/tchaudhry)\ **Replies:** 0\ **Last updated:** [May 31, 2024, 4:23pm UTC](https://discuss.elastic.co/t/deprecated-nest-library/360635 "2024-05-31T16:23:17Z")
Has anyone tried replacing Nest v7 library with Elastic.Clients.Elasticsearch? --- ## [Two instance of es is failing unexpectedly error code 137](https://discuss.elastic.co/t/two-instance-of-es-is-failing-unexpectedly-error-code-137/360631)
**Author:** [@nagkumar](https://discuss.elastic.co/u/nagkumar)\ **Replies:** 4\ **Last updated:** [May 31, 2024, 3:12pm UTC](https://discuss.elastic.co/t/two-instance-of-es-is-failing-unexpectedly-error-code-137/360631 "2024-05-31T15:12:11Z")
two instance of Elasticsearch are failing to start any clues why it says unexpected exit.. [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=226) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=228)