# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=785 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 786 --- ## [How to achieve semantic search with ElasticSearch 8.4.2?](https://discuss.elastic.co/t/how-to-achieve-semantic-search-with-elasticsearch-8-4-2/315038)
**Author:** [@Dinesh\_Sonachalam](https://discuss.elastic.co/u/Dinesh_Sonachalam)\ **Replies:** 1\ **Last updated:** [September 23, 2022, 4:48pm UTC](https://discuss.elastic.co/t/how-to-achieve-semantic-search-with-elasticsearch-8-4-2/315038 "2022-09-23T16:48:13Z")
How to achieve semantic search with Elasticsearch 8.4.2? Hi guys, I have a basic understanding of adding semantic search support for ES and added them below. It would be beneficial if you guys share some working examp… --- ## [Detect sessions via timestamp and threshold](https://discuss.elastic.co/t/detect-sessions-via-timestamp-and-threshold/315019)
**Author:** [@SKiD](https://discuss.elastic.co/u/SKiD)\ **Replies:** 0\ **Last updated:** [September 23, 2022, 1:46pm UTC](https://discuss.elastic.co/t/detect-sessions-via-timestamp-and-threshold/315019 "2022-09-23T13:46:53Z")
Hey, I'm not sure if this is the right area to post it, maybe it might be Kibana, but I just give it a try. I'm currently having firewall logs in my indices with timestamp, IP adresses, sent and received bytes and sess… --- ## [Query\_string OR condition score explanation](https://discuss.elastic.co/t/query-string-or-condition-score-explanation/315017)
**Author:** [@Pazhaniyappan](https://discuss.elastic.co/u/Pazhaniyappan)\ **Replies:** 0\ **Last updated:** [September 23, 2022, 1:33pm UTC](https://discuss.elastic.co/t/query-string-or-condition-score-explanation/315017 "2022-09-23T13:33:43Z")
GET index/\_search { "\_source": \[ "\_id", "field" \], "explain": true, "query": { "bool": { "must": \[ { "bool": { "should": \[ { "query\_st… --- ## [Throttled merge](https://discuss.elastic.co/t/throttled-merge/314963)
**Author:** [@Ariel\_Zach](https://discuss.elastic.co/u/Ariel_Zach)\ **Replies:** 3\ **Last updated:** [September 23, 2022, 12:47pm UTC](https://discuss.elastic.co/t/throttled-merge/314963 "2022-09-23T12:47:18Z")
Hello, Currently we have an index of 33TB (ES 7.8), 48 shards (16 primary, 32 replicas), two months ago we deleted a lot of documents and we noticed that one of the shards (the primary and the 2 replicas) has a very lar… --- ## [Elk does not see indexes](https://discuss.elastic.co/t/elk-does-not-see-indexes/315012)
**Author:** [@holpa](https://discuss.elastic.co/u/holpa)\ **Replies:** 1\ **Last updated:** [September 23, 2022, 12:38pm UTC](https://discuss.elastic.co/t/elk-does-not-see-indexes/315012 "2022-09-23T12:38:56Z")
Hello. I'm just learning how to work at ELK. I want to set up the transfer of logs from AD Installed on 1 server: elasticsearch, kibana, logstash 8.4 v 2 server - windows forwarding event - winlogbeat winlogbeat.event… --- ## [How to clone multiple indices at once within Kibana DevTools](https://discuss.elastic.co/t/how-to-clone-multiple-indices-at-once-within-kibana-devtools/314939)
**Author:** [@fim01](https://discuss.elastic.co/u/fim01)\ **Replies:** 4\ **Last updated:** [September 23, 2022, 12:29pm UTC](https://discuss.elastic.co/t/how-to-clone-multiple-indices-at-once-within-kibana-devtools/314939 "2022-09-23T12:29:22Z")
Hello Is it possible to clone multiple indices in one shot? I tried: POST /test-13,test-14,test-15/\_clone/test-clone Unfortunately I'll get an error: { "error" : { "root\_cause" : \[ { "type" : "… --- ## [Score is same for single value match vs multiple match for an array field using terms query](https://discuss.elastic.co/t/score-is-same-for-single-value-match-vs-multiple-match-for-an-array-field-using-terms-query/314976)
**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Replies:** 3\ **Last updated:** [September 23, 2022, 11:42am UTC](https://discuss.elastic.co/t/score-is-same-for-single-value-match-vs-multiple-match-for-an-array-field-using-terms-query/314976 "2022-09-23T11:42:48Z")
PUT dvt\_test\_long/\_doc/1 { "items" : \[1\] } PUT dvt\_test\_long/\_doc/2 { "items" : \[1, 2\] } PUT dvt\_test\_long/\_doc/3 { "items" : \[1, 2, 3\] } PUT dvt\_test\_long/\_doc/4 { "items" : \[1, 2, 3, 4\] } Query: GET d… --- ## [Kibana - Canvas - Conditional coloring in a Table (If Statut = KO -\> Cell Red)](https://discuss.elastic.co/t/kibana-canvas-conditional-coloring-in-a-table-if-statut-ko-cell-red/315008)
**Author:** [@riwalco](https://discuss.elastic.co/u/riwalco)\ **Replies:** 1\ **Last updated:** [September 23, 2022, 11:00am UTC](https://discuss.elastic.co/t/kibana-canvas-conditional-coloring-in-a-table-if-statut-ko-cell-red/315008 "2022-09-23T11:00:42Z")
Hello, I would like to highlight in RED the cells that have the value KO for column Statut : Juste below the code that I have : filters | essql query="SELECT Check\_Date, ID, Statut, Minimum, Valeur, Commentair… --- ## [AuditD module - right usage and syntax of -q flag in auditd rules](https://discuss.elastic.co/t/auditd-module-right-usage-and-syntax-of-q-flag-in-auditd-rules/315009)
**Author:** [@Lukas\_Hubl](https://discuss.elastic.co/u/Lukas_Hubl)\ **Replies:** 0\ **Last updated:** [September 23, 2022, 10:52am UTC](https://discuss.elastic.co/t/auditd-module-right-usage-and-syntax-of-q-flag-in-auditd-rules/315009 "2022-09-23T10:52:19Z")
Hi, I would like to use -q flag in auditd rule, but the rule with the -q flag is not working or even added into the rules list. I have rule like this: -a always,exit -F path=/home/lukashubl/ -q /home/lukashubl/dirtest… --- ## [Scheduling the generation of a visualisation and saving/caching the result or automated CSV export](https://discuss.elastic.co/t/scheduling-the-generation-of-a-visualisation-and-saving-caching-the-result-or-automated-csv-export/315002)
**Author:** [@Josh\_G](https://discuss.elastic.co/u/Josh_G)\ **Replies:** 1\ **Last updated:** [September 23, 2022, 10:46am UTC](https://discuss.elastic.co/t/scheduling-the-generation-of-a-visualisation-and-saving-caching-the-result-or-automated-csv-export/315002 "2022-09-23T10:46:06Z")
Hello, We are currently using Elastic table visualisations to obtain a record of network connections from a certain group of machines, an example: We are manually generating these on a machine-by-machine basis and e… --- ## [Pod annotation co.elastic.logs/pipeline does not work?](https://discuss.elastic.co/t/pod-annotation-co-elastic-logs-pipeline-does-not-work/313670)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 4\ **Last updated:** [September 23, 2022, 10:14am UTC](https://discuss.elastic.co/t/pod-annotation-co-elastic-logs-pipeline-does-not-work/313670 "2022-09-23T10:14:27Z")
Hi, I have a Logstash pipeline pipeline running in kubernetes. I am collecting all logs from the Kubernetes cluster using filebeat with activated hit based autodiscover. I would like to force filebeat to use a specific … --- ## [No monitoring data found](https://discuss.elastic.co/t/no-monitoring-data-found/314412)
**Author:** [@P-T-I](https://discuss.elastic.co/u/P-T-I)\ **Replies:** 17\ **Last updated:** [September 23, 2022, 10:13am UTC](https://discuss.elastic.co/t/no-monitoring-data-found/314412 "2022-09-23T10:13:51Z")
I'm running kibana/elasticsearch/metricbeats 8.4.1 in a docker configuration. Although I'm seeing the monitoring indexes being created ( .ds-metricbeat-8.4.1-2022.09.14-000001, .ds-.monitoring-kibana-8-mb-2022.09.14-0… --- ## [Query on timeseries data very slow](https://discuss.elastic.co/t/query-on-timeseries-data-very-slow/314815)
**Author:** [@kk123](https://discuss.elastic.co/u/kk123)\ **Replies:** 6\ **Last updated:** [September 23, 2022, 9:37am UTC](https://discuss.elastic.co/t/query-on-timeseries-data-very-slow/314815 "2022-09-23T09:37:49Z")
Hi, this follows previous questions. I have merged all my indices into 1 ilm based index, with a added field that contains the previous "index" name... Generally this is fine, with some performance hit. Queries are gene… --- ## [Best approach to reuse an already existing ELK enviroment to monitor a new E-Commerce Env](https://discuss.elastic.co/t/best-approach-to-reuse-an-already-existing-elk-enviroment-to-monitor-a-new-e-commerce-env/315006)
**Author:** [@Carlos\_T](https://discuss.elastic.co/u/Carlos_T)\ **Replies:** 0\ **Last updated:** [September 23, 2022, 9:36am UTC](https://discuss.elastic.co/t/best-approach-to-reuse-an-already-existing-elk-enviroment-to-monitor-a-new-e-commerce-env/315006 "2022-09-23T09:36:20Z")
Good morning. I've been requested to use an already existing ELK environment that until now has been used to monitor a single E-Commerce App environment. The client is asking me now to reuse this ELK environment to mon… --- ## [SNMP Pipeline didn't work](https://discuss.elastic.co/t/snmp-pipeline-didnt-work/315003)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 0\ **Last updated:** [September 23, 2022, 9:29am UTC](https://discuss.elastic.co/t/snmp-pipeline-didnt-work/315003 "2022-09-23T09:29:58Z")
Hello everyone, i'm struggling with snmp pipeline here. i have configured the pipeline like below picture. i used walk and define the tables too. when i run the logstash, there is no error log about this pipeline. it's … --- ## ["type"=\>"illegal\_argument\_exception", "reason"=\>"cannot parse empty date"} in logstash logs](https://discuss.elastic.co/t/type-illegal-argument-exception-reason-cannot-parse-empty-date-in-logstash-logs/314991)
**Author:** [@madurad](https://discuss.elastic.co/u/madurad)\ **Replies:** 2\ **Last updated:** [September 23, 2022, 7:36am UTC](https://discuss.elastic.co/t/type-illegal-argument-exception-reason-cannot-parse-empty-date-in-logstash-logs/314991 "2022-09-23T07:36:37Z")
Hello, Getting an error on pushing logs to logstash to elasticseacrch, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse field \[message\] of type \[date\] in document with id 'NVWQaIMBa0kW\_rfG7Lb1'… --- ## [Object mapping for \[data.value\] tried to parse field \[value\] as object, but found a concrete value](https://discuss.elastic.co/t/object-mapping-for-data-value-tried-to-parse-field-value-as-object-but-found-a-concrete-value/314867)
**Author:** [@shivendra95](https://discuss.elastic.co/u/shivendra95)\ **Replies:** 2\ **Last updated:** [September 23, 2022, 5:44am UTC](https://discuss.elastic.co/t/object-mapping-for-data-value-tried-to-parse-field-value-as-object-but-found-a-concrete-value/314867 "2022-09-23T05:44:03Z")
Hi, I'm trying to read log files from s3 bucket, but for some log lines I'm getting the below error \[WARN \] 2022-09-21 10:43:42.756 \[\[main\]\>worker0\] elasticsearch - Could not index event to Elasticsearch. {:status=\>4… --- ## [Elasticsearch::Transport::Transport::Errors::BadRequest](https://discuss.elastic.co/t/elasticsearch-badrequest/314860)
**Author:** [@Hunaid\_Nawaz](https://discuss.elastic.co/u/Hunaid_Nawaz)\ **Replies:** 1\ **Last updated:** [September 23, 2022, 3:27am UTC](https://discuss.elastic.co/t/elasticsearch-badrequest/314860 "2022-09-23T03:27:41Z")
Hi, I'm facing the error related to the Elasticsearch::Transport. I'm using searchkick gem in rails. elasticsearch version 7.17.4 When i'm doing reindex using searchkick gem it returned this error Elasticsearch::Tran… --- ## [Heroku review apps not able to access Elasticsearch add-on foundelasticsearch](https://discuss.elastic.co/t/heroku-review-apps-not-able-to-access-elasticsearch-add-on-foundelasticsearch/314984)
**Author:** [@Eric\_Lee1](https://discuss.elastic.co/u/Eric_Lee1)\ **Replies:** 0\ **Last updated:** [September 23, 2022, 1:10am UTC](https://discuss.elastic.co/t/heroku-review-apps-not-able-to-access-elasticsearch-add-on-foundelasticsearch/314984 "2022-09-23T01:10:15Z")
I am trying to deploy my node application with Elasicsearch and I want to use the official Elasticsearch add-on foundelasticsearch into my Heroku application. Here is my workflow: In my node application, I created a… --- ## [Problems getting filebeats to work with API keys](https://discuss.elastic.co/t/problems-getting-filebeats-to-work-with-api-keys/314982)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 0\ **Last updated:** [September 23, 2022, 12:43am UTC](https://discuss.elastic.co/t/problems-getting-filebeats-to-work-with-api-keys/314982 "2022-09-23T00:43:02Z")
I have just got filebeats (7.17.1) working on a bunch of ubuntu systems. I initially tried to use API keys for authentication but got errors from filebeat "API key: invalid ApiKey value" when it connects to the ES serv… --- ## [Issue with output plugin type elasticsearch in logstash](https://discuss.elastic.co/t/issue-with-output-plugin-type-elasticsearch-in-logstash/314967)
**Author:** [@sbk-elk](https://discuss.elastic.co/u/sbk-elk)\ **Replies:** 4\ **Last updated:** [September 22, 2022, 8:39pm UTC](https://discuss.elastic.co/t/issue-with-output-plugin-type-elasticsearch-in-logstash/314967 "2022-09-22T20:39:39Z")
Hello All, Below is my logstash configuration. I have a few questions with respect to how i added the fields and how they carry over in the stages of my pipeline. Do the fields set in hash in my input plugin are added… --- ## [Is there anyway to use Logstash on Cloud?](https://discuss.elastic.co/t/is-there-anyway-to-use-logstash-on-cloud/314975)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 1\ **Last updated:** [September 22, 2022, 9:37pm UTC](https://discuss.elastic.co/t/is-there-anyway-to-use-logstash-on-cloud/314975 "2022-09-22T21:37:02Z")
So far I'm aware of the Ingest Pipelines and they are really useful, but I've been using a lot of Logstash plugins (mostly JDBC and HTTP) plusm mutates in a daily basis and so I started wondering if there is also a solut… --- ## [Convert my doc.timestamp as date](https://discuss.elastic.co/t/convert-my-doc-timestamp-as-date/314973)
**Author:** [@erwin339](https://discuss.elastic.co/u/erwin339)\ **Replies:** 3\ **Last updated:** [September 22, 2022, 9:08pm UTC](https://discuss.elastic.co/t/convert-my-doc-timestamp-as-date/314973 "2022-09-22T21:08:07Z")
I am currently trying to get the date the logs were generated since I only have the date they were processed, I am receiving the logs in log4j xml format. I am unable to convert the UNIX date to this format Sep 22, 2022 … --- ## [O365 module: No such input type exist: 'o365audit'](https://discuss.elastic.co/t/o365-module-no-such-input-type-exist-o365audit/314848)
**Author:** [@sriramb12](https://discuss.elastic.co/u/sriramb12)\ **Replies:** 4\ **Last updated:** [September 22, 2022, 7:52pm UTC](https://discuss.elastic.co/t/o365-module-no-such-input-type-exist-o365audit/314848 "2022-09-22T19:52:58Z")
The beat is throwing this error: Sep 21 14:57:51 xxxx.lan filebeat\[17245\]: {"log.level":"debug","@timestamp":"2022-09-21T14:57:51.483+0530","log.logger":"processors","log.origin":{"file.name":"processors/processor.go","… --- ## [Elasticsearch 7.10 durability permanent](https://discuss.elastic.co/t/elasticsearch-7-10-durability-permanent/314875)
**Author:** [@Michael\_Sanchez](https://discuss.elastic.co/u/Michael_Sanchez)\ **Replies:** 14\ **Last updated:** [September 22, 2022, 6:45pm UTC](https://discuss.elastic.co/t/elasticsearch-7-10-durability-permanent/314875 "2022-09-22T18:45:11Z")
Hello team, My Elasticsearch cluster v7.10 has the following error: reason" : "\[parent\] Data too large, data for \[\\] would be \[17110531128/15.9gb\], which is larger than the limit of \[16320875724/15.1gb\], r… --- ## [\[ERROR\]\[elasticsearch-service\] Unable to retrieve version information from Elasticsearch nodes](https://discuss.elastic.co/t/error-elasticsearch-service-unable-to-retrieve-version-information-from-elasticsearch-nodes/306399)
**Author:** [@HKN\_MZ](https://discuss.elastic.co/u/HKN_MZ)\ **Replies:** 5\ **Last updated:** [September 22, 2022, 6:10pm UTC](https://discuss.elastic.co/t/error-elasticsearch-service-unable-to-retrieve-version-information-from-elasticsearch-nodes/306399 "2022-09-22T18:10:35Z")
Hi Everyone, I try to install Elasticsearch8.2.2 and Kibana8.2.2 on the one ubuntu20.04 virtual machine. I installed and configured Elasticsearch8.2.2 and get accessed from my local browser successfully. As below picture… --- ## [API Key not enabled](https://discuss.elastic.co/t/api-key-not-enabled/314962)
**Author:** [@SilasMuniz1](https://discuss.elastic.co/u/SilasMuniz1)\ **Replies:** 2\ **Last updated:** [September 22, 2022, 5:21pm UTC](https://discuss.elastic.co/t/api-key-not-enabled/314962 "2022-09-22T17:21:11Z")
Hello, I have a cluster with 3 nodes of elasticsearch. In the first node I've installed kibana. Configured TLS/SSL in all cluster nodes. And use credential to communicate with kibana and logstash. My problem is about … --- ## [Search\_coordination thread queue filling up. Can we change the setting?](https://discuss.elastic.co/t/search-coordination-thread-queue-filling-up-can-we-change-the-setting/314813)
**Author:** [@elastic\_dude](https://discuss.elastic.co/u/elastic_dude)\ **Replies:** 6\ **Last updated:** [September 22, 2022, 4:38pm UTC](https://discuss.elastic.co/t/search-coordination-thread-queue-filling-up-can-we-change-the-setting/314813 "2022-09-22T16:38:35Z")
Hello, We are operating some Elasticsearch clusters and have noticed in the most queried cluster periodically the search\_coordination thread pool can't keep up, resulting in a queue that then translates to high latency … --- ## [Maximum age in hot phase vs. Move data into phase in warm phase](https://discuss.elastic.co/t/maximum-age-in-hot-phase-vs-move-data-into-phase-in-warm-phase/314934)
**Author:** [@rosaLux161](https://discuss.elastic.co/u/rosaLux161)\ **Replies:** 1\ **Last updated:** [September 22, 2022, 4:21pm UTC](https://discuss.elastic.co/t/maximum-age-in-hot-phase-vs-move-data-into-phase-in-warm-phase/314934 "2022-09-22T16:21:17Z")
Hey there, I don't understand the difference between the two options. First, in the hot phase I can enter a maximum age after a rollover happens, but then in the warm phase I can also enter a maximum duration when the r… --- ## [Trying to upload a csv to an index fails](https://discuss.elastic.co/t/trying-to-upload-a-csv-to-an-index-fails/314954)
**Author:** [@alter1](https://discuss.elastic.co/u/alter1)\ **Replies:** 1\ **Last updated:** [September 22, 2022, 3:53pm UTC](https://discuss.elastic.co/t/trying-to-upload-a-csv-to-an-index-fails/314954 "2022-09-22T15:53:54Z")
I am trying to load a csv file to an index associated with ILM policies, the first time it was executed it was successful, then I have deleted and recreated the index and the load has not worked again. This is the pipel… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=784) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=786)