# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=288 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 289 --- ## [Score highlighted fields](https://discuss.elastic.co/t/score-highlighted-fields/355213)
**Author:** [@Sudipta\_Bhowmick](https://discuss.elastic.co/u/Sudipta_Bhowmick)\ **Replies:** 6\ **Last updated:** [March 12, 2024, 12:17pm UTC](https://discuss.elastic.co/t/score-highlighted-fields/355213 "2024-03-12T12:17:59Z")
Hi, Unable to get solution for the following requirement. Can anyone suggest on this please ? I have a ES query that searches for 4 fields in my index and provides highlighted result. But i want to score the highlighte… --- ## [RAG - how is it used? - Context window - does it work out out of the box?](https://discuss.elastic.co/t/rag-how-is-it-used-context-window-does-it-work-out-out-of-the-box/355028)
**Author:** [@Chenko](https://discuss.elastic.co/u/Chenko)\ **Replies:** 4\ **Last updated:** [March 12, 2024, 11:30am UTC](https://discuss.elastic.co/t/rag-how-is-it-used-context-window-does-it-work-out-out-of-the-box/355028 "2024-03-12T11:30:13Z")
I am wondering how RAG is used, I see it has a context window in which it adds context, however what is this context? Another questions I am having is, does RAG work out of the box? if so how? if not, what would need … --- ## [Logstash parsing data incorrectly](https://discuss.elastic.co/t/logstash-parsing-data-incorrectly/355221)
**Author:** [@gyrao\_72](https://discuss.elastic.co/u/gyrao_72)\ **Replies:** 2\ **Last updated:** [March 12, 2024, 11:23am UTC](https://discuss.elastic.co/t/logstash-parsing-data-incorrectly/355221 "2024-03-12T11:23:41Z")
0 I am using Logstash version 6.5.4 Data is read and parsed using Filebeat -\> Logstash -\> Elasticsearch But as I can see on Kibana for a few cases, I am getting duplicate field data i.e data is converted into an array … --- ## [JDBC streaming filter with SQL IN () condition](https://discuss.elastic.co/t/jdbc-streaming-filter-with-sql-in-condition/354429)
**Author:** [@Joss](https://discuss.elastic.co/u/Joss)\ **Replies:** 1\ **Last updated:** [March 12, 2024, 11:19am UTC](https://discuss.elastic.co/t/jdbc-streaming-filter-with-sql-in-condition/354429 "2024-03-12T11:19:03Z")
Greetings community, I stuck with development of data processing pipeline where is one step is fetch data from DB by array of ids. Prerequisites: logstash 7.17 logstash-filter-jdbc\_streaming (OOTB) jdbc client for ma… --- ## [Cluster data retention settings](https://discuss.elastic.co/t/cluster-data-retention-settings/354993)
**Author:** [@gunlomboy](https://discuss.elastic.co/u/gunlomboy)\ **Replies:** 3\ **Last updated:** [March 12, 2024, 11:00am UTC](https://discuss.elastic.co/t/cluster-data-retention-settings/354993 "2024-03-12T11:00:21Z")
Hi, I am migrating from ILM to using the data retention settings. The documentation states: Currently, it defaults to max\_age=auto,max\_primary\_shard\_size=50gb,min\_docs=1,max\_primary\_shard\_docs=200000000 These setting… --- ## [Azure Integration for injecting logs and metrics properly from an Azure event hub?](https://discuss.elastic.co/t/azure-integration-for-injecting-logs-and-metrics-properly-from-an-azure-event-hub/355022)
**Author:** [@juanmgarciaf](https://discuss.elastic.co/u/juanmgarciaf)\ **Replies:** 5\ **Last updated:** [March 12, 2024, 10:37am UTC](https://discuss.elastic.co/t/azure-integration-for-injecting-logs-and-metrics-properly-from-an-azure-event-hub/355022 "2024-03-12T10:37:32Z")
Hello! I'm using an "Azure Event Hub Input" integration in Kibana for trying to inject logs and metrics previously saved in an Azure Event Hub. I select all checks in Azure for sending all logs and metrics to that Eve… --- ## [Report shows less data than shown in search results](https://discuss.elastic.co/t/report-shows-less-data-than-shown-in-search-results/355020)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 9\ **Last updated:** [March 12, 2024, 10:24am UTC](https://discuss.elastic.co/t/report-shows-less-data-than-shown-in-search-results/355020 "2024-03-12T10:24:14Z")
We are running 7.17.x Elasticsearch and have setup a reporting for a search query. The team needs a weekly dump and it appears the number of results are not matching the one shown in search query results For example: 7 … --- ## [Which version of elasticsearch solve the CVE-2022-1471(snakeyaml need bump to 2.0 version)](https://discuss.elastic.co/t/which-version-of-elasticsearch-solve-the-cve-2022-1471-snakeyaml-need-bump-to-2-0-version/355162)
**Author:** [@DeBruyne2020](https://discuss.elastic.co/u/DeBruyne2020)\ **Replies:** 1\ **Last updated:** [March 12, 2024, 10:12am UTC](https://discuss.elastic.co/t/which-version-of-elasticsearch-solve-the-cve-2022-1471-snakeyaml-need-bump-to-2-0-version/355162 "2024-03-12T10:12:03Z")
I have a question ： the elasticsearch that I use now( version 7.11.2) has CVE-2022-1471 (about snakeyaml), which version of elasticsearch solve this problem ? (As I know, snakeyaml need bump to 2.0 version which solv… --- ## [How to capture http response from elasticsearch watcher action block?](https://discuss.elastic.co/t/how-to-capture-http-response-from-elasticsearch-watcher-action-block/355132)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 1\ **Last updated:** [March 12, 2024, 9:45am UTC](https://discuss.elastic.co/t/how-to-capture-http-response-from-elasticsearch-watcher-action-block/355132 "2024-03-12T09:45:56Z")
Hi All, I'm struggling to capture the http response coming from execution of an action block. Is there any way to store it in a separate index? "actions": { "my\_webhook": { "webhook": { "method": "post", … --- ## [After expunge command still docs.deleted is not reducing](https://discuss.elastic.co/t/after-expunge-command-still-docs-deleted-is-not-reducing/355207)
**Author:** [@Siva\_Karan](https://discuss.elastic.co/u/Siva_Karan)\ **Replies:** 3\ **Last updated:** [March 12, 2024, 9:52am UTC](https://discuss.elastic.co/t/after-expunge-command-still-docs-deleted-is-not-reducing/355207 "2024-03-12T09:52:36Z")
HI Team, In one of our index we are going to remove the docs.deleted documents,but after the execution still the docs.deleted is not reducing health status index uuid pri rep docs.count docs.deleted … --- ## [About big data seach](https://discuss.elastic.co/t/about-big-data-seach/354891)
**Author:** [@vahid\_alvandi](https://discuss.elastic.co/u/vahid_alvandi)\ **Replies:** 0\ **Last updated:** [March 6, 2024, 11:36pm UTC](https://discuss.elastic.co/t/about-big-data-seach/354891 "2024-03-06T23:36:54Z")
Following this link, I have decided to index all the information in elasticsearch in addition to the main database of the site, and then the information displayed to the users of the site will be taken from Elasticsearch… --- ## [Replacement of NamedXContentRegistry in Java API Client](https://discuss.elastic.co/t/replacement-of-namedxcontentregistry-in-java-api-client/355209)
**Author:** [@roypiyali92](https://discuss.elastic.co/u/roypiyali92)\ **Replies:** 0\ **Last updated:** [March 12, 2024, 7:50am UTC](https://discuss.elastic.co/t/replacement-of-namedxcontentregistry-in-java-api-client/355209 "2024-03-12T07:50:59Z")
I am using the Java Api Client and need to write Mockito Test Cases where I can read a Json file and convert it into a SearchResponse Object . With the High Level Rest Client this was possible using the NamedXContentRegi… --- ## [Who ate my memory](https://discuss.elastic.co/t/who-ate-my-memory/355208)
**Author:** [@lu\_pan](https://discuss.elastic.co/u/lu_pan)\ **Replies:** 0\ **Last updated:** [March 12, 2024, 7:14am UTC](https://discuss.elastic.co/t/who-ate-my-memory/355208 "2024-03-12T07:14:24Z")
In my production environment, the ES cluster frequently encounters data too large exception. When I dumped the heap memory and analyzed it through MAT, I found the following confusing points: There are a large number … --- ## [High CPU Utilisation in 8.11.4](https://discuss.elastic.co/t/high-cpu-utilisation-in-8-11-4/354564)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 6\ **Last updated:** [March 12, 2024, 6:11am UTC](https://discuss.elastic.co/t/high-cpu-utilisation-in-8-11-4/354564 "2024-03-12T06:11:00Z")
We are using ELK version 8.11.4 and we have 6 hot nodes and 3 warm nodes and 3 master nodes 2 coordinator nodes When users try to query in kibana discover for example field : value OR field1 : value2 , in the backend (… --- ## [Automate ELSER v2 Trained Models download](https://discuss.elastic.co/t/automate-elser-v2-trained-models-download/355177)
**Author:** [@GlebCA](https://discuss.elastic.co/u/GlebCA)\ **Replies:** 3\ **Last updated:** [March 12, 2024, 3:27am UTC](https://discuss.elastic.co/t/automate-elser-v2-trained-models-download/355177 "2024-03-12T03:27:19Z")
Hi, I need to automate ELSER v2 Machine Learning Trained Models download into Elastic for integration testing purposes. There is documentation on how to download ELSER v2 from local files https://www.elastic.co/guide/e… --- ## [The calculated node size\_in\_bytes value is very different from the actual df value](https://discuss.elastic.co/t/the-calculated-node-size-in-bytes-value-is-very-different-from-the-actual-df-value/354706)
**Author:** [@524186aa](https://discuss.elastic.co/u/524186aa)\ **Replies:** 4\ **Last updated:** [March 12, 2024, 3:15am UTC](https://discuss.elastic.co/t/the-calculated-node-size-in-bytes-value-is-very-different-from-the-actual-df-value/354706 "2024-03-12T03:15:08Z")
The calculated node size\_in\_bytes value is very different from the actual df value I use "size\_in\_bytes" to check the usage of 2.6tb The usage of du is 3.7 TB What's extra? It will be released when it reboots --- ## [Some log missing in elasticsearch](https://discuss.elastic.co/t/some-log-missing-in-elasticsearch/355122)
**Author:** [@Frances\_Chu](https://discuss.elastic.co/u/Frances_Chu)\ **Replies:** 1\ **Last updated:** [March 12, 2024, 1:49am UTC](https://discuss.elastic.co/t/some-log-missing-in-elasticsearch/355122 "2024-03-12T01:49:56Z")
I try to transfer logs from filebeat to logstash at time A The log is located in the filebeat server //filebeatserver/log/LogtoLogstash/\* (including log before time A) The log is OK starting from time A. However, it … --- ## [Powershell can't start-service filebeat](https://discuss.elastic.co/t/powershell-cant-start-service-filebeat/355120)
**Author:** [@Zidane](https://discuss.elastic.co/u/Zidane)\ **Replies:** 3\ **Last updated:** [March 12, 2024, 1:34am UTC](https://discuss.elastic.co/t/powershell-cant-start-service-filebeat/355120 "2024-03-12T01:34:29Z")
hello, I had a problem, after I change es's password which used keystore value, the service can't run like this... my filebeat.yml variables: app\_type: "API" logging\_ip: "10.111.244.62" filebeat.config: inputs: … --- ## [JDBC connection issue after upgrade to v8](https://discuss.elastic.co/t/jdbc-connection-issue-after-upgrade-to-v8/355197)
**Author:** [@snakeapit](https://discuss.elastic.co/u/snakeapit)\ **Replies:** 0\ **Last updated:** [March 12, 2024, 12:14am UTC](https://discuss.elastic.co/t/jdbc-connection-issue-after-upgrade-to-v8/355197 "2024-03-12T00:14:21Z")
Our elastics-logstash solution unable to index due to JDBC connection timeout. From the logs, I could see a "Caused by: java.net.SocketTimeoutException: Connect timed out" error in there Confirm there is no issue with … --- ## [Failed to parse field \[host\] of type \[text\] after upgrade from 7.17 to 8.12](https://discuss.elastic.co/t/failed-to-parse-field-host-of-type-text-after-upgrade-from-7-17-to-8-12/353734)
**Author:** [@snakeapit](https://discuss.elastic.co/u/snakeapit)\ **Replies:** 2\ **Last updated:** [March 11, 2024, 10:37pm UTC](https://discuss.elastic.co/t/failed-to-parse-field-host-of-type-text-after-upgrade-from-7-17-to-8-12/353734 "2024-03-11T22:37:14Z")
Seeing this error below in logstash after upgrade from 7.17 to 8.12, data unable to index to Elasticsearch. I'm new in Elastics, hopefully someone can assist here. Suspect the change in version 8.12 causing different ty… --- ## [What privilege required for Dev Tools to show in Kibana?](https://discuss.elastic.co/t/what-privilege-required-for-dev-tools-to-show-in-kibana/354881)
**Author:** [@qd-danh](https://discuss.elastic.co/u/qd-danh)\ **Replies:** 1\ **Last updated:** [March 11, 2024, 10:30pm UTC](https://discuss.elastic.co/t/what-privilege-required-for-dev-tools-to-show-in-kibana/354881 "2024-03-11T22:30:28Z")
Title pretty much says it all. I have added the Kibana Privilege for "Dev Tools" to the space, but users with this role still don't see Dev Tools in the menu, or can't type it in the search bar at the top. I understand… --- ## [Logstash http input plugin acknowledge, when message is persisted](https://discuss.elastic.co/t/logstash-http-input-plugin-acknowledge-when-message-is-persisted/355167)
**Author:** [@Casper\_Thrane](https://discuss.elastic.co/u/Casper_Thrane)\ **Replies:** 3\ **Last updated:** [March 11, 2024, 9:50pm UTC](https://discuss.elastic.co/t/logstash-http-input-plugin-acknowledge-when-message-is-persisted/355167 "2024-03-11T21:50:18Z")
Hi Is it correct understood, to make logstash return 200 after message is persisted, a persistent queue is needed. The input plugin will return it's status code, before the output pipeline is done. Br Casper --- ## [Custom Logs - json - Why do we need to map fields?](https://discuss.elastic.co/t/custom-logs-json-why-do-we-need-to-map-fields/354542)
**Author:** [@jjwallaby](https://discuss.elastic.co/u/jjwallaby)\ **Replies:** 7\ **Last updated:** [March 11, 2024, 9:32pm UTC](https://discuss.elastic.co/t/custom-logs-json-why-do-we-need-to-map-fields/354542 "2024-03-11T21:32:05Z")
Hi, json objects fields are meant to be dynamic. Does 'Custom Logs' from the 'Elastic Agent' have a facility to map json fields on the fly as entry comes in ? If you do not have any mapping an error occurs 'could no… --- ## [Shared custom integration repository](https://discuss.elastic.co/t/shared-custom-integration-repository/355194)
**Author:** [@Ross\_Wakelin](https://discuss.elastic.co/u/Ross_Wakelin)\ **Replies:** 0\ **Last updated:** [March 11, 2024, 8:39pm UTC](https://discuss.elastic.co/t/shared-custom-integration-repository/355194 "2024-03-11T20:39:19Z")
Morning I was wondering if there is a location anywhere that hosts a public repository of custom Elastic integrations, ingest pipelines, Logstash configs etc. I have created ingest pipelines for MS DNS logs, MS NPS log… --- ## [How do I debug Agent custom logs and ingest pipeline?](https://discuss.elastic.co/t/how-do-i-debug-agent-custom-logs-and-ingest-pipeline/355193)
**Author:** [@Ross\_Wakelin](https://discuss.elastic.co/u/Ross_Wakelin)\ **Replies:** 0\ **Last updated:** [March 11, 2024, 8:33pm UTC](https://discuss.elastic.co/t/how-do-i-debug-agent-custom-logs-and-ingest-pipeline/355193 "2024-03-11T20:33:18Z")
Morning... I have created a custom log integration on some Windows servers to read the DNS debug logs. The logs get sent to a custom ingest pipeline which parses them into ECS and writes them to a data stream. I have i… --- ## [Different result ordering with regard to 10000 limitation](https://discuss.elastic.co/t/different-result-ordering-with-regard-to-10000-limitation/355171)
**Author:** [@sliu](https://discuss.elastic.co/u/sliu)\ **Replies:** 2\ **Last updated:** [March 11, 2024, 6:18pm UTC](https://discuss.elastic.co/t/different-result-ordering-with-regard-to-10000-limitation/355171 "2024-03-11T18:18:46Z")
I have a search that has lot results, only "first" 10000 are accessible as commonly known. If I allow users change the ordering of search results (for instance, "order by column 1", "order by column 2", etc.), will user … --- ## [Installing ELSER Model on Docker Instance Fails](https://discuss.elastic.co/t/installing-elser-model-on-docker-instance-fails/354988)
**Author:** [@Steve\_Stefanovich](https://discuss.elastic.co/u/Steve_Stefanovich)\ **Replies:** 8\ **Last updated:** [March 11, 2024, 5:00pm UTC](https://discuss.elastic.co/t/installing-elser-model-on-docker-instance-fails/354988 "2024-03-11T17:00:26Z")
I followed the official documentation to create a single-node 8.12.2 cluster. Trial license is activated. When I attempt to deploy the elser\_model\_2\_linux-x86\_64 model, I receive the following 429 error: Could not start … --- ## [Case Insensitive aggregation not working](https://discuss.elastic.co/t/case-insensitive-aggregation-not-working/354633)
**Author:** [@raanup](https://discuss.elastic.co/u/raanup)\ **Replies:** 4\ **Last updated:** [March 11, 2024, 4:56pm UTC](https://discuss.elastic.co/t/case-insensitive-aggregation-not-working/354633 "2024-03-11T16:56:34Z")
ES version - 7.17.7 I've an index for which I' running an aggregation to get all field matching certain regex. This should be case-insensitive i.e. new york should match New York and NEW YORK and New YORK Have added a… --- ## [org.elasticsearch.hadoop.EsHadoopException: Could not write all entries for bulk operation \[1/1\]. Error sample (first \[5\] error messages):](https://discuss.elastic.co/t/org-elasticsearch-hadoop-eshadoopexception-could-not-write-all-entries-for-bulk-operation-1-1-error-sample-first-5-error-messages/355175)
**Author:** [@programmer\_123](https://discuss.elastic.co/u/programmer_123)\ **Replies:** 0\ **Last updated:** [March 11, 2024, 4:53pm UTC](https://discuss.elastic.co/t/org-elasticsearch-hadoop-eshadoopexception-could-not-write-all-entries-for-bulk-operation-1-1-error-sample-first-5-error-messages/355175 "2024-03-11T16:53:44Z")
Hi @all, I am using pyspark program to write the data into elastic index by using upsert operation (sample code snippet below). def writeDataToES(final\_df): write\_options = { "es.nodes": elastic\_host, "es.net.ssl":… --- ## [Reindex throttled after a few hours](https://discuss.elastic.co/t/reindex-throttled-after-a-few-hours/355059)
**Author:** [@elijah\_voigt](https://discuss.elastic.co/u/elijah_voigt)\ **Replies:** 3\ **Last updated:** [March 11, 2024, 4:45pm UTC](https://discuss.elastic.co/t/reindex-throttled-after-a-few-hours/355059 "2024-03-11T16:45:42Z")
I am on my 3rd attempt at re-indexing an index. The re-index task reliably demonstrates the following failure mode: The re-index task starts with high throughput, processing ~12,000 documents per second. After ~12-24 h… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=287) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=289)