# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=246 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 247 --- ## [Analyzer for numbers with commas?](https://discuss.elastic.co/t/analyzer-for-numbers-with-commas/358985)
**Author:** [@jakehschwartz](https://discuss.elastic.co/u/jakehschwartz)\ **Replies:** 0\ **Last updated:** [May 7, 2024, 7:33pm UTC](https://discuss.elastic.co/t/analyzer-for-numbers-with-commas/358985 "2024-05-07T19:33:04Z")
Version 7.10 A bug with our analyzer was recently found dealing with commas in numbers. Imagine a string like This car has like 10,000 HP, it can go very fast We have a custom analyzer called full\_text, will attach al… --- ## [Not all Available Fields are listed in visualization](https://discuss.elastic.co/t/not-all-available-fields-are-listed-in-visualization/358977)
**Author:** [@Mark\_Sarto](https://discuss.elastic.co/u/Mark_Sarto)\ **Replies:** 2\ **Last updated:** [May 7, 2024, 6:49pm UTC](https://discuss.elastic.co/t/not-all-available-fields-are-listed-in-visualization/358977 "2024-05-07T18:49:41Z")
it seems all fields with type : text are not available in visualisation and i need them to create certain visualizations like average rent per city etc... Elastics mapping : Discover data view : Visualization availabl… --- ## [How to bypass ssl in http\_poller](https://discuss.elastic.co/t/how-to-bypass-ssl-in-http-poller/358948)
**Author:** [@kishorkumar](https://discuss.elastic.co/u/kishorkumar)\ **Replies:** 2\ **Last updated:** [May 7, 2024, 6:24pm UTC](https://discuss.elastic.co/t/how-to-bypass-ssl-in-http-poller/358948 "2024-05-07T18:24:41Z")
How do i by pass sssl in the logstash input http\_poller logstash Logstash --- ## [View Query in PostgreSQL agent in dashboard](https://discuss.elastic.co/t/view-query-in-postgresql-agent-in-dashboard/358854)
**Author:** [@Fernandoc4d](https://discuss.elastic.co/u/Fernandoc4d)\ **Replies:** 13\ **Last updated:** [May 7, 2024, 3:08pm UTC](https://discuss.elastic.co/t/view-query-in-postgresql-agent-in-dashboard/358854 "2024-05-07T15:08:48Z")
Hi community I need to obtain in a dashboard, two specific queries to the databases of all the agents from which I receive data (for this purpose it is this entire project among other things for which I have gotten invo… --- ## [What is my grok pattern for Time](https://discuss.elastic.co/t/what-is-my-grok-pattern-for-time/358937)
**Author:** [@baber1223](https://discuss.elastic.co/u/baber1223)\ **Replies:** 1\ **Last updated:** [May 7, 2024, 2:57pm UTC](https://discuss.elastic.co/t/what-is-my-grok-pattern-for-time/358937 "2024-05-07T14:57:37Z")
I want to use grok pattern for follow : \[07/May/2024:13:47:19 +0530\] I am using follow grok \[%{HTTPDATE:logtimestamp}\] but it does not work . Would you please say what is grok pattern for that ? --- ## [Cannot use example Grok Pattern (official docs) in Grok Processor](https://discuss.elastic.co/t/cannot-use-example-grok-pattern-official-docs-in-grok-processor/358871)
**Author:** [@paolovalladolid](https://discuss.elastic.co/u/paolovalladolid)\ **Replies:** 3\ **Last updated:** [May 7, 2024, 2:43pm UTC](https://discuss.elastic.co/t/cannot-use-example-grok-pattern-official-docs-in-grok-processor/358871 "2024-05-07T14:43:35Z")
This is the pattern I'm trying to use in the Grok processor: %{IPORHOST:source.ip} %{USER:user.id} %{USER:user.name} \\\[%{HTTPDATE:@timestamp}\\\] "%{WORD:http.request.method} %{DATA:url.original} HTTP/%{NUMBER:http.versio… --- ## [How can I connect to langchain using elasticsearch as vectorb?](https://discuss.elastic.co/t/how-can-i-connect-to-langchain-using-elasticsearch-as-vectorb/358946)
**Author:** [@daniel7806](https://discuss.elastic.co/u/daniel7806)\ **Replies:** 0\ **Last updated:** [May 7, 2024, 2:56pm UTC](https://discuss.elastic.co/t/how-can-i-connect-to-langchain-using-elasticsearch-as-vectorb/358946 "2024-05-07T14:56:23Z")
I followed like a code like this: import elasticsearch from langchain\_elasticsearch import ElasticsearchStore es\_client= elasticsearch.Elasticsearch( hosts=\["https://ip:host"\], es\_user="elastic", es\_password… --- ## [Post elasticsearch LinkedIn](https://discuss.elastic.co/t/post-elasticsearch-linkedin/358938)
**Author:** [@Khadija\_BOUDINAR1](https://discuss.elastic.co/u/Khadija_BOUDINAR1)\ **Replies:** 0\ **Last updated:** [May 7, 2024, 2:27pm UTC](https://discuss.elastic.co/t/post-elasticsearch-linkedin/358938 "2024-05-07T14:27:32Z")
Hello All, I would like to know it's possible to suggest some topics to discus about elasticsearch, to improve my LinkedIn profile (installation, index creation...) Thanks --- ## [Feature State "ent\_search" for Snapshots not working](https://discuss.elastic.co/t/feature-state-ent-search-for-snapshots-not-working/358936)
**Author:** [@sebastianboelling](https://discuss.elastic.co/u/sebastianboelling)\ **Replies:** 0\ **Last updated:** [May 7, 2024, 2:16pm UTC](https://discuss.elastic.co/t/feature-state-ent-search-for-snapshots-not-working/358936 "2024-05-07T14:16:28Z")
Hi, I am trying to restore the feature state of the feature "ent\_search" from am Snapshot. I am using the Snapstot tool: Snapshot and restore | Elasticsearch Guide \[8.13\] | Elastic It is possible to snapshot and resto… --- ## [Help me install ELK in a Windows 7 environment](https://discuss.elastic.co/t/help-me-install-elk-in-a-windows-7-environment/358919)
**Author:** [@Tell045](https://discuss.elastic.co/u/Tell045)\ **Replies:** 5\ **Last updated:** [May 7, 2024, 1:43pm UTC](https://discuss.elastic.co/t/help-me-install-elk-in-a-windows-7-environment/358919 "2024-05-07T13:43:55Z")
Help me install ELK in a Windows 7 environment. Thanks! --- ## [The whole log of openedr is inside the message feild in kibana. Urgent!](https://discuss.elastic.co/t/the-whole-log-of-openedr-is-inside-the-message-feild-in-kibana-urgent/358535)
**Author:** [@sandraimmaculate](https://discuss.elastic.co/u/sandraimmaculate)\ **Replies:** 39\ **Last updated:** [May 7, 2024, 1:18pm UTC](https://discuss.elastic.co/t/the-whole-log-of-openedr-is-inside-the-message-feild-in-kibana-urgent/358535 "2024-05-07T13:18:00Z")
Hi, my openedr application is in windows i have downloaded filebeat there and configure it to send logs to logstash so that i can view in kibana and yes it done successfully. I'm able to see logs in kibana\>discover, B… --- ## [Get selected date from calendar in Kibana](https://discuss.elastic.co/t/get-selected-date-from-calendar-in-kibana/358765)
**Author:** [@jarcastillo](https://discuss.elastic.co/u/jarcastillo)\ **Replies:** 4\ **Last updated:** [May 7, 2024, 1:35pm UTC](https://discuss.elastic.co/t/get-selected-date-from-calendar-in-kibana/358765 "2024-05-07T13:35:07Z")
Hi there Can someone help me and explain how do I get the selected date in calendar either in a TSVB visualization or in a scripted field (java.calendar Class works but Calendar.Events not ) Thank you in advance --- ## [ElasticAgent 8.13 and Kafka](https://discuss.elastic.co/t/elasticagent-8-13-and-kafka/358704)
**Author:** [@tapiojaa](https://discuss.elastic.co/u/tapiojaa)\ **Replies:** 9\ **Last updated:** [May 7, 2024, 1:22pm UTC](https://discuss.elastic.co/t/elasticagent-8-13-and-kafka/358704 "2024-05-07T13:22:24Z")
I'm using ElasticAgent to output data into Kafka. When using version 8.13.3 there is an error: status: (FAILED) could not start output: failed to reload output: topic '%{\[fields.kafka\_topic\]}' is invalid, it must match … --- ## [Multiple controls bug](https://discuss.elastic.co/t/multiple-controls-bug/358925)
**Author:** [@nnikushkin](https://discuss.elastic.co/u/nnikushkin)\ **Replies:** 4\ **Last updated:** [May 7, 2024, 1:14pm UTC](https://discuss.elastic.co/t/multiple-controls-bug/358925 "2024-05-07T13:14:43Z")
Hello! I found a weird behavior of Dashboard Controls and it looks like a bug to me Steps to reproduce: Create an index: PUT /controls { "mappings": { "properties": { "group": { "type": "keyword" }, "… --- ## [Moving average based on conditions for (moving avg\<50)](https://discuss.elastic.co/t/moving-average-based-on-conditions-for-moving-avg-50/358927)
**Author:** [@Ravisankar123](https://discuss.elastic.co/u/Ravisankar123)\ **Replies:** 0\ **Last updated:** [May 7, 2024, 1:04pm UTC](https://discuss.elastic.co/t/moving-average-based-on-conditions-for-moving-avg-50/358927 "2024-05-07T13:04:15Z")
Need Moving average formula for \<50 --- ## [Filebeat is skipping some older files and starts to send new ones](https://discuss.elastic.co/t/filebeat-is-skipping-some-older-files-and-starts-to-send-new-ones/358915)
**Author:** [@elk1985](https://discuss.elastic.co/u/elk1985)\ **Replies:** 0\ **Last updated:** [May 7, 2024, 11:31am UTC](https://discuss.elastic.co/t/filebeat-is-skipping-some-older-files-and-starts-to-send-new-ones/358915 "2024-05-07T11:31:54Z")
Hello. I have a problem. I have upgraded my cluster to 8.10.4 all together with filebeats. I have added new logs for 1 server. filebeat.yml contains over 40 input sections with multiline configuration, tags etc. When… --- ## [Request distribution in client nodes using AWS ELB](https://discuss.elastic.co/t/request-distribution-in-client-nodes-using-aws-elb/358913)
**Author:** [@nchalise](https://discuss.elastic.co/u/nchalise)\ **Replies:** 0\ **Last updated:** [May 7, 2024, 9:53am UTC](https://discuss.elastic.co/t/request-distribution-in-client-nodes-using-aws-elb/358913 "2024-05-07T09:53:49Z")
I have a cluster consisting of 3 master nodes, 4 client nodes, and 16 data nodes. I utilize AWS ELB for request balancing. Within the ELB setup, I allocate 4 client nodes and employ a Round Robin algorithm to distribute … --- ## [How to use the \_copy\_saved\_objects](https://discuss.elastic.co/t/how-to-use-the-copy-saved-objects/358851)
**Author:** [@lcarr](https://discuss.elastic.co/u/lcarr)\ **Replies:** 1\ **Last updated:** [May 7, 2024, 9:48am UTC](https://discuss.elastic.co/t/how-to-use-the-copy-saved-objects/358851 "2024-05-07T09:48:04Z")
This is totally not working - we are getting 404 errors - POST kbn:/s/source\_space/api/spaces/\_copy\_saved\_objects { "createNewCopies": true, "includeReferences": false, "objects": \[ { "Title": " Devices by Compone… --- ## [Arrange multiple fields into one line](https://discuss.elastic.co/t/arrange-multiple-fields-into-one-line/357482)
**Author:** [@Aviel\_Bashari](https://discuss.elastic.co/u/Aviel_Bashari)\ **Replies:** 8\ **Last updated:** [May 7, 2024, 9:42am UTC](https://discuss.elastic.co/t/arrange-multiple-fields-into-one-line/357482 "2024-05-07T09:42:23Z")
Hi, I have an execution of a bunch of tests that run with multiple devices with multiple roles(DEVICE\_1, DEVICE\_2, etc..) this means that for each test, I have for example 4 devices involved. each device pushes its ow… --- ## [Elasticsearch Set Processor Variable not define errror](https://discuss.elastic.co/t/elasticsearch-set-processor-variable-not-define-errror/358769)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 1\ **Last updated:** [May 7, 2024, 9:21am UTC](https://discuss.elastic.co/t/elasticsearch-set-processor-variable-not-define-errror/358769 "2024-05-07T09:21:38Z")
Hello Everyone: I am using Elasticsearch 7.8 version. I have a mutliple conditions to be checked using set processor ... I am using below code curl -X POST "localhost:9200/\_ingest/pipeline/\_simulate?pretty" -H 'Conte… --- ## [Json parse error on elastic output](https://discuss.elastic.co/t/json-parse-error-on-elastic-output/358910)
**Author:** [@matan21m](https://discuss.elastic.co/u/matan21m)\ **Replies:** 0\ **Last updated:** [May 7, 2024, 9:14am UTC](https://discuss.elastic.co/t/json-parse-error-on-elastic-output/358910 "2024-05-07T09:14:52Z")
I am trying to create a logging service using the elastic stack. I have some very large logs that also require filtering to adjust to JSON format, and one of them gives me the following json parse error: JSON parse err… --- ## [In the future we are moving Dev servers to the production cluster. The data currently in the dev-cluster for these servers not available in prod. We need to copy indices from dev to prod. How we can achieve we need only those development indices to prod?](https://discuss.elastic.co/t/in-the-future-we-are-moving-dev-servers-to-the-production-cluster-the-data-currently-in-the-dev-cluster-for-these-servers-not-available-in-prod-we-need-to-copy-indices-from-dev-to-prod-how-we-can-achieve-we-need-only-those-development-indices-to-prod/358905)
**Author:** [@Puneeth1](https://discuss.elastic.co/u/Puneeth1)\ **Replies:** 1\ **Last updated:** [May 7, 2024, 8:45am UTC](https://discuss.elastic.co/t/in-the-future-we-are-moving-dev-servers-to-the-production-cluster-the-data-currently-in-the-dev-cluster-for-these-servers-not-available-in-prod-we-need-to-copy-indices-from-dev-to-prod-how-we-can-achieve-we-need-only-those-development-indices-to-prod/358905 "2024-05-07T08:45:46Z")
Hi . Can anyone guide how we can achieve as mentioned in the description --- ## [Start logstash on docker -\> Could not find or load main class org](https://discuss.elastic.co/t/start-logstash-on-docker-could-not-find-or-load-main-class-org/358906)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 0\ **Last updated:** [May 7, 2024, 8:43am UTC](https://discuss.elastic.co/t/start-logstash-on-docker-could-not-find-or-load-main-class-org/358906 "2024-05-07T08:43:06Z")
Hi I'm struggling the case after upgrade from logstash 8.2.1 to 8.13.3 with Using bundled JDK: /usr/share/logstash/jdk Error: Could not find or load main class org.logstash.launchers.JvmOptionsParser Caused by: java.l… --- ## [Suggest? Move (Not copy) large volume (around 100m) data from one index to another](https://discuss.elastic.co/t/suggest-move-not-copy-large-volume-around-100m-data-from-one-index-to-another/358902)
**Author:** [@samadna](https://discuss.elastic.co/u/samadna)\ **Replies:** 1\ **Last updated:** [May 7, 2024, 8:21am UTC](https://discuss.elastic.co/t/suggest-move-not-copy-large-volume-around-100m-data-from-one-index-to-another/358902 "2024-05-07T08:21:02Z")
One Time Requirement to move unwanted data (around 200mi) from a large (500mi) index based on certain filter criteria to another (New) index. We are planning to write java code as below. Group certain list of ids and … --- ## [Help in migrating java client code 7x to 8x](https://discuss.elastic.co/t/help-in-migrating-java-client-code-7x-to-8x/358166)
**Author:** [@sinugaud](https://discuss.elastic.co/u/sinugaud)\ **Replies:** 3\ **Last updated:** [May 7, 2024, 8:07am UTC](https://discuss.elastic.co/t/help-in-migrating-java-client-code-7x-to-8x/358166 "2024-05-07T08:07:12Z")
I have written java code in Spring boot using elasticsearch-rest-high-level-client 7.17.4 now I want to migrate to elastic-search 8 how I can write term query SearchRequest searchRequest = new SearchRequest(ZE… --- ## [Reindexing with inflight indexing](https://discuss.elastic.co/t/reindexing-with-inflight-indexing/358897)
**Author:** [@post90](https://discuss.elastic.co/u/post90)\ **Replies:** 0\ **Last updated:** [May 7, 2024, 7:11am UTC](https://discuss.elastic.co/t/reindexing-with-inflight-indexing/358897 "2024-05-07T07:11:57Z")
Is there a way to index data in destination index as well while doing remapping (source\_idx -\> destination\_idx) of an index? We could re-index the data between the two once more after switching the alias but that is not … --- ## [How does elasticsearch calculates clauses of a query?](https://discuss.elastic.co/t/how-does-elasticsearch-calculates-clauses-of-a-query/358895)
**Author:** [@Aditya\_Teltia](https://discuss.elastic.co/u/Aditya_Teltia)\ **Replies:** 0\ **Last updated:** [May 7, 2024, 6:31am UTC](https://discuss.elastic.co/t/how-does-elasticsearch-calculates-clauses-of-a-query/358895 "2024-05-07T06:31:40Z")
Hello everyone, Hope you are doing good. How does elasticsearch clauses of a query? Which it eventually compares with max\_clause\_count and throws an RuntimeException if query exceeds maxClauseCount. I understand how i… --- ## [Drop event doesnt drop any](https://discuss.elastic.co/t/drop-event-doesnt-drop-any/358894)
**Author:** [@ninab](https://discuss.elastic.co/u/ninab)\ **Replies:** 0\ **Last updated:** [May 7, 2024, 6:17am UTC](https://discuss.elastic.co/t/drop-event-doesnt-drop-any/358894 "2024-05-07T06:17:18Z")
I am trying to config elastic-agent.yml to drop some events using processors but not filtering occures. Please advise: type: windows/metrics data\_stream.namespace: default use\_output: default period: 60s streams: m… --- ## [Max\_shards\_per\_node best practice](https://discuss.elastic.co/t/max-shards-per-node-best-practice/358622)
**Author:** [@Frances\_Chu](https://discuss.elastic.co/u/Frances_Chu)\ **Replies:** 3\ **Last updated:** [May 7, 2024, 3:47am UTC](https://discuss.elastic.co/t/max-shards-per-node-best-practice/358622 "2024-05-07T03:47:38Z")
By default the cluster.max\_shards\_per\_node is 1000. I would like to increase the value. Any impact to the system. How to determine the best value of cluster.max\_shards\_per\_node? --- ## [When using logstash to consume binary data, some bytes are replaced with ef bf bd](https://discuss.elastic.co/t/when-using-logstash-to-consume-binary-data-some-bytes-are-replaced-with-ef-bf-bd/358797)
**Author:** [@imdong](https://discuss.elastic.co/u/imdong)\ **Replies:** 3\ **Last updated:** [May 7, 2024, 3:12am UTC](https://discuss.elastic.co/t/when-using-logstash-to-consume-binary-data-some-bytes-are-replaced-with-ef-bf-bd/358797 "2024-05-07T03:12:56Z")
The original data is avro data, but only plain =\> { charset =\> "BINARY" } is used for debugging to reduce interference. avro data original (hexadecimal) 00000000: 00 80 40 00 cc e1 85 98 0e 00 3a 32 30 32 34 2d ..@...… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=245) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=247)