# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=709 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 710 --- ## [It is possible to limit amount of hits per token?](https://discuss.elastic.co/t/it-is-possible-to-limit-amount-of-hits-per-token/320561)
**Author:** [@va2dim](https://discuss.elastic.co/u/va2dim)\ **Replies:** 2\ **Last updated:** [December 6, 2022, 1:47pm UTC](https://discuss.elastic.co/t/it-is-possible-to-limit-amount-of-hits-per-token/320561 "2022-12-06T13:47:00Z")
I have indexed refBook of materials: doc/id name 1 polibutilen 5 polibutelenteraftalat 13 elastan, 23 elastodien, 25 elastodin query could contain many materials (using OR operator): elastan, polibutilen. (examp… --- ## [How to grok haproxy Log](https://discuss.elastic.co/t/how-to-grok-haproxy-log/320566)
**Author:** [@Roccof97](https://discuss.elastic.co/u/Roccof97)\ **Replies:** 3\ **Last updated:** [December 6, 2022, 1:59pm UTC](https://discuss.elastic.co/t/how-to-grok-haproxy-log/320566 "2022-12-06T13:59:13Z")
Hi, I'm parsing this log, but I get stuck in curly braces, I don't know what exception to add to export dns and ip. This is my log: Dec 6 10:31:43 eu01-test-test haproxy\[1311\]: eu01-test.test.lan x.x.x.x:xxxx \[06/Dec… --- ## [How to download only desired entry rows from Eland (Elasticsearch python+pandas client)?](https://discuss.elastic.co/t/how-to-download-only-desired-entry-rows-from-eland-elasticsearch-python-pandas-client/320591)
**Author:** [@Ivo\_Tavares](https://discuss.elastic.co/u/Ivo_Tavares)\ **Replies:** 0\ **Last updated:** [December 6, 2022, 1:58pm UTC](https://discuss.elastic.co/t/how-to-download-only-desired-entry-rows-from-eland-elasticsearch-python-pandas-client/320591 "2022-12-06T13:58:10Z")
Currently, if I want to create a dataframe with specific entries from an index, using Eland, I must first download a dataframe with all the entries, and then filter them out, locally... this is hardly desirable in terms … --- ## [Ingestion pipeline dynamically creates empty object upon nested JSON](https://discuss.elastic.co/t/ingestion-pipeline-dynamically-creates-empty-object-upon-nested-json/320480)
**Author:** [@Douglas\_Korgut](https://discuss.elastic.co/u/Douglas_Korgut)\ **Replies:** 2\ **Last updated:** [December 6, 2022, 1:37pm UTC](https://discuss.elastic.co/t/ingestion-pipeline-dynamically-creates-empty-object-upon-nested-json/320480 "2022-12-06T13:37:08Z")
Hello guys! I've been trying to ingest documents through the ingestion pipeline provided by elastic. The idea is quite simple, transform the original JSON into one that has well formatted field names that at some point … --- ## [Unable to retrieve version information from Elasticsearch nodes](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes/320128)
**Author:** [@ali\_haider](https://discuss.elastic.co/u/ali_haider)\ **Replies:** 4\ **Last updated:** [December 6, 2022, 1:21pm UTC](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes/320128 "2022-12-06T13:21:42Z")
I am using Elasticsearch and Kibana 7.17 free and basic version. I am trying to setting up the minimal security. I did all of the following steps mentioned in the following document : I saw multiple solutions in whic… --- ## [Cannot parse empty date](https://discuss.elastic.co/t/cannot-parse-empty-date/320575)
**Author:** [@stefanocog](https://discuss.elastic.co/u/stefanocog)\ **Replies:** 4\ **Last updated:** [December 6, 2022, 1:16pm UTC](https://discuss.elastic.co/t/cannot-parse-empty-date/320575 "2022-12-06T13:16:58Z")
Hi, I have a log that has a json field inside that can have empty fields, specifically I have a date field, the log can be like this "2022-11-28 09:24:46:705"|"+0100"|"transId: xxxxxx"|"resId: xxxxxx"|"1.1.1.1"|"https:… --- ## [Ingesting IBM BigFix Client Logs](https://discuss.elastic.co/t/ingesting-ibm-bigfix-client-logs/318437)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 2\ **Last updated:** [December 6, 2022, 12:47pm UTC](https://discuss.elastic.co/t/ingesting-ibm-bigfix-client-logs/318437 "2022-12-06T12:47:05Z")
I am needing to ingest the IBM BigFix client logs located at C:\\Program Files (x86)\\BigFix Enterprise\\BES Client\\\_BESData\\\_Global\\Logs. Is there either a Beat module or Logstash plugin which would handle parsing these lo… --- ## [ElasticSearch phrase search not working for wildcard search](https://discuss.elastic.co/t/elasticsearch-phrase-search-not-working-for-wildcard-search/320543)
**Author:** [@golofetuk](https://discuss.elastic.co/u/golofetuk)\ **Replies:** 6\ **Last updated:** [December 6, 2022, 12:18pm UTC](https://discuss.elastic.co/t/elasticsearch-phrase-search-not-working-for-wildcard-search/320543 "2022-12-06T12:18:55Z")
I have a word index and I can't search phrases on elasticsearch. there is no result. I check tons of solutions but I can't implement them to my query. My mapping looks like this; PUT /words/\_mapping { "properties": {… --- ## [Datafeed has missed 152 documents due to ingest latency](https://discuss.elastic.co/t/datafeed-has-missed-152-documents-due-to-ingest-latency/316267)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 4\ **Last updated:** [October 11, 2022, 4:19pm UTC](https://discuss.elastic.co/t/datafeed-has-missed-152-documents-due-to-ingest-latency/316267 "2022-10-11T16:19:52Z")
Running ELK 7.16.3 version Platinum Subscription. I am getting error message Datafeed has missed 152 documents due to ingest latency, latest bucket with missing data is \[2022-10-10T17:00:00.000Z\]. Consider increasing qu… --- ## [Indicator match](https://discuss.elastic.co/t/indicator-match/320569)
**Author:** [@ramiwashere](https://discuss.elastic.co/u/ramiwashere)\ **Replies:** 0\ **Last updated:** [December 6, 2022, 11:17am UTC](https://discuss.elastic.co/t/indicator-match/320569 "2022-12-06T11:17:22Z")
Hello, I'm sorry if this information had already been asked but I didn't find my answer on old topic. I'm stuck on a indicator match rule and idk if I misunderstand this type of rule: I have 2 index, lets call them in… --- ## [When adding a filter in kibana all string fields have a entry and .keyword entry](https://discuss.elastic.co/t/when-adding-a-filter-in-kibana-all-string-fields-have-a-entry-and-keyword-entry/320552)
**Author:** [@Rajesh\_R](https://discuss.elastic.co/u/Rajesh_R)\ **Replies:** 2\ **Last updated:** [December 6, 2022, 11:13am UTC](https://discuss.elastic.co/t/when-adding-a-filter-in-kibana-all-string-fields-have-a-entry-and-keyword-entry/320552 "2022-12-06T11:13:35Z")
When adding a filter in kibana all string fields have an entry and .keyword entry. please assist how to remove the keyword --- ## [Coordinating-only nodes are a \_significant\_ bottleneck for our cluster](https://discuss.elastic.co/t/coordinating-only-nodes-are-a-significant-bottleneck-for-our-cluster/319813)
**Author:** [@drs](https://discuss.elastic.co/u/drs)\ **Replies:** 9\ **Last updated:** [December 6, 2022, 10:50am UTC](https://discuss.elastic.co/t/coordinating-only-nodes-are-a-significant-bottleneck-for-our-cluster/319813 "2022-12-06T10:50:34Z")
We have a very large Elasticsearch cluster with the following node layout: masters: 5 ingest-only: 4 data-only: 98 coordinating-only: 3 Coordinating-only nodes have 32 cores and 64 GB of memory, data nodes typically… --- ## [Cannot change timestamp field in an existing data view in kibana](https://discuss.elastic.co/t/cannot-change-timestamp-field-in-an-existing-data-view-in-kibana/320532)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 4\ **Last updated:** [December 6, 2022, 8:45am UTC](https://discuss.elastic.co/t/cannot-change-timestamp-field-in-an-existing-data-view-in-kibana/320532 "2022-12-06T08:45:45Z")
Hello, I have created a dataview that uses @timetamp field which is generated from logstash. I wanted to change (edit) the default timestamp field to another field (timestamp\_seconds) in the dataview, but it is greyed o… --- ## [Logstash input elasticsearch argument error](https://discuss.elastic.co/t/logstash-input-elasticsearch-argument-error/320538)
**Author:** [@CherryGoose](https://discuss.elastic.co/u/CherryGoose)\ **Replies:** 0\ **Last updated:** [December 6, 2022, 7:59am UTC](https://discuss.elastic.co/t/logstash-input-elasticsearch-argument-error/320538 "2022-12-06T07:59:32Z")
Hello. Im trying to setup my logstash to take docs from elastic and output them to console and im getting the following error \[ERROR\]\[logstash.agent \] Failed to execute action {:action=\>LogStash::PipelineActio… --- ## [DataNode disk full, despite on flood\_stage configuration](https://discuss.elastic.co/t/datanode-disk-full-despite-on-flood-stage-configuration/320468)
**Author:** [@gidonshn](https://discuss.elastic.co/u/gidonshn)\ **Replies:** 4\ **Last updated:** [December 6, 2022, 7:40am UTC](https://discuss.elastic.co/t/datanode-disk-full-despite-on-flood-stage-configuration/320468 "2022-12-06T07:40:22Z")
Hi All. I have a cluster (7.16.2) running on k8s, with multiple DataNodes, dedicated ClientNodes, and Dedicated MasterNodes. Some of the DataNodes are "hot" data nodes, and some of them are "warm". I have daily indice… --- ## [Access Secure Elastisearch Cluster from Ruby on Rails](https://discuss.elastic.co/t/access-secure-elastisearch-cluster-from-ruby-on-rails/320461)
**Author:** [@mbm1607](https://discuss.elastic.co/u/mbm1607)\ **Replies:** 4\ **Last updated:** [December 6, 2022, 7:31am UTC](https://discuss.elastic.co/t/access-secure-elastisearch-cluster-from-ruby-on-rails/320461 "2022-12-06T07:31:32Z")
I have setup a secure Elastisearch cluster with three nodes using the official installation with Docker Compose guide. It is being accessed from Kibana without issue. However now I need to access it from my custom ROR a… --- ## [How to write a painless script that get all the error from the EKS cluster as I want to create an error dashboad in kibana](https://discuss.elastic.co/t/how-to-write-a-painless-script-that-get-all-the-error-from-the-eks-cluster-as-i-want-to-create-an-error-dashboad-in-kibana/320533)
**Author:** [@ANIKET\_YADAV](https://discuss.elastic.co/u/ANIKET_YADAV)\ **Replies:** 0\ **Last updated:** [December 6, 2022, 7:31am UTC](https://discuss.elastic.co/t/how-to-write-a-painless-script-that-get-all-the-error-from-the-eks-cluster-as-i-want-to-create-an-error-dashboad-in-kibana/320533 "2022-12-06T07:31:28Z")
I want to create an error field in filebeat index pattern as I need to create an error dashboard that fetch me the error of my pods running in EKS cluster but for that it is required to write a script to add a field... P… --- ## [Filbeat with netflow as input and elastic output for oss elastic 7.6.1](https://discuss.elastic.co/t/filbeat-with-netflow-as-input-and-elastic-output-for-oss-elastic-7-6-1/320421)
**Author:** [@shaikmuzakkir](https://discuss.elastic.co/u/shaikmuzakkir)\ **Replies:** 4\ **Last updated:** [December 6, 2022, 7:09am UTC](https://discuss.elastic.co/t/filbeat-with-netflow-as-input-and-elastic-output-for-oss-elastic-7-6-1/320421 "2022-12-06T07:09:25Z")
Elastic cluster we have is of open source 7.6.1 version. We need filebeat to have netflow as input and elastic as output to write to our cluster. With filebeat open source, netflow is not enabled as input ERROR inst… --- ## [Logstash drop filter plugin](https://discuss.elastic.co/t/logstash-drop-filter-plugin/320526)
**Author:** [@bex](https://discuss.elastic.co/u/bex)\ **Replies:** 1\ **Last updated:** [December 6, 2022, 7:19am UTC](https://discuss.elastic.co/t/logstash-drop-filter-plugin/320526 "2022-12-06T07:19:31Z")
As we know, we can drop like that: if \[log\]\[file\]\[path\] == "/var/log/messages" { drop {} } But I have case when I am getting logs in format "/var/log/messages-20221212" or "/var/log/messages-date" But logstash drop … --- ## [Unable to restart a node - index.mapper.dynamic was removed after version 6.0.0](https://discuss.elastic.co/t/unable-to-restart-a-node-index-mapper-dynamic-was-removed-after-version-6-0-0/320506)
**Author:** [@newkidtopc](https://discuss.elastic.co/u/newkidtopc)\ **Replies:** 2\ **Last updated:** [December 6, 2022, 6:32am UTC](https://discuss.elastic.co/t/unable-to-restart-a-node-index-mapper-dynamic-was-removed-after-version-6-0-0/320506 "2022-12-06T06:32:08Z")
We have been running our ES cluster (ES Version 7.16.3) for a few months now. This cluster was built using the data from earlier ES version (ES 6.8) and the cluster has been running smoothly after the upgrade. We run on… --- ## [Boost results by yeke weights](https://discuss.elastic.co/t/boost-results-by-yeke-weights/320338)
**Author:** [@Ostr1969](https://discuss.elastic.co/u/Ostr1969)\ **Replies:** 4\ **Last updated:** [December 6, 2022, 6:27am UTC](https://discuss.elastic.co/t/boost-results-by-yeke-weights/320338 "2022-12-06T06:27:29Z")
This is a question for a possible strategic. I use yeke to get meaningful words from text. I want to ingest those words with the weights so that Elasticsearch could boost the doc using those weights. for example: doc… --- ## [Can we ingest csv directly into elastric search from python?](https://discuss.elastic.co/t/can-we-ingest-csv-directly-into-elastric-search-from-python/320404)
**Author:** [@Shashank02](https://discuss.elastic.co/u/Shashank02)\ **Replies:** 14\ **Last updated:** [December 6, 2022, 6:07am UTC](https://discuss.elastic.co/t/can-we-ingest-csv-directly-into-elastric-search-from-python/320404 "2022-12-06T06:07:24Z")
Actually, I've tried pushing the data but to no use. I'm using Elastic Search version '8.4.1'. I want to push the CSV directly into the Elasticsearch without uploading it manually using the File Data Visualizer option in… --- ## [Gaps in monitoring diagrams of cluster](https://discuss.elastic.co/t/gaps-in-monitoring-diagrams-of-cluster/320477)
**Author:** [@Erik\_Bors](https://discuss.elastic.co/u/Erik_Bors)\ **Replies:** 0\ **Last updated:** [December 5, 2022, 3:17pm UTC](https://discuss.elastic.co/t/gaps-in-monitoring-diagrams-of-cluster/320477 "2022-12-05T15:17:33Z")
We can see on the Cluster Overview dashboard some gaps in the diagrams like SearchRate, Search Latency etc. Thanx for any help, where to look more for the details. In the logs there is nothing really wrong, often only … --- ## [Proper Monitoring of specific Field - Fields missing in Alerts & Insights Rules](https://discuss.elastic.co/t/proper-monitoring-of-specific-field-fields-missing-in-alerts-insights-rules/320510)
**Author:** [@afammartino](https://discuss.elastic.co/u/afammartino)\ **Replies:** 0\ **Last updated:** [December 6, 2022, 1:02am UTC](https://discuss.elastic.co/t/proper-monitoring-of-specific-field-fields-missing-in-alerts-insights-rules/320510 "2022-12-06T01:02:03Z")
Hello, my goal is to monitor a specific value from an index in ELK. Concretely I would like to alert if the 95th percentile of my nginx request\_time is greater than some threshold. What is the best way to accomplish this… --- ## [Install Integration on one or multiple endpoints?](https://discuss.elastic.co/t/install-integration-on-one-or-multiple-endpoints/320511)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 0\ **Last updated:** [December 6, 2022, 1:23am UTC](https://discuss.elastic.co/t/install-integration-on-one-or-multiple-endpoints/320511 "2022-12-06T01:23:49Z")
Hello, How do we know if an Integration should be installed on one endpoint of multiple? Microsoft 365 Integration, if pushed to multiple endpoints, would be redundant and duplicate the data right? Elastic Defend,… --- ## [Display average of every 100 records](https://discuss.elastic.co/t/display-average-of-every-100-records/320521)
**Author:** [@Yungxin\_Shin](https://discuss.elastic.co/u/Yungxin_Shin)\ **Replies:** 0\ **Last updated:** [December 6, 2022, 4:08am UTC](https://discuss.elastic.co/t/display-average-of-every-100-records/320521 "2022-12-06T04:08:33Z")
I want to display the average of every 100 records, which works similarly to grouping 100 records as a "batch"/"group". So far the moving average only works on the time field, is it possible to apply the moving average t… --- ## [Can i update child document while update parent document from script](https://discuss.elastic.co/t/can-i-update-child-document-while-update-parent-document-from-script/320515)
**Author:** [@robocon20x](https://discuss.elastic.co/u/robocon20x)\ **Replies:** 0\ **Last updated:** [December 6, 2022, 3:20am UTC](https://discuss.elastic.co/t/can-i-update-child-document-while-update-parent-document-from-script/320515 "2022-12-06T03:20:07Z")
can i update special document while update a document? For example: i have 2 docs, doc parent A and doc child B. whenever i update doc child B, i want filed a1 of doc A have value v1. is it possible? cause as i know 1 … --- ## [Filebeat nginx module](https://discuss.elastic.co/t/filebeat-nginx-module/320400)
**Author:** [@amir\_Bialek](https://discuss.elastic.co/u/amir_Bialek)\ **Replies:** 5\ **Last updated:** [December 5, 2022, 11:36pm UTC](https://discuss.elastic.co/t/filebeat-nginx-module/320400 "2022-12-05T23:36:21Z")
Hello, I am trying to use filebeat with nginx module to collect logs from nginx-ingress-controller and send directly to elasti but I keep getting an error: Provided Grok expressions do not match field value: \[172.17.0.… --- ## [Kibana error while querying in Discover](https://discuss.elastic.co/t/kibana-error-while-querying-in-discover/318764)
**Author:** [@Michael\_Sanchez](https://discuss.elastic.co/u/Michael_Sanchez)\ **Replies:** 34\ **Last updated:** [December 5, 2022, 10:00pm UTC](https://discuss.elastic.co/t/kibana-error-while-querying-in-discover/318764 "2022-12-05T22:00:28Z")
Hello team, I'm seeing the following error while making a search in "Discover": search\_phase\_execution\_exception Error: Bad Request at Fetch.\_callee3$ (kibana/36063/bundles/core/core.entry.js:6:59535) at l (k… --- ## [Xpath fails to extract](https://discuss.elastic.co/t/xpath-fails-to-extract/320479)
**Author:** [@stefanocog](https://discuss.elastic.co/u/stefanocog)\ **Replies:** 4\ **Last updated:** [December 5, 2022, 8:36pm UTC](https://discuss.elastic.co/t/xpath-fails-to-extract/320479 "2022-12-05T20:36:49Z")
Hi, i need extract one value from a parsed XML, my logstash configuration is xml { source =\> "contentRequest" target =\> "contentRequest\_field" store\_xml =\> false xpath =\> \[ "/datianagrafici/datipersonali… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=708) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=710)