# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=86 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 87 --- ## [Explode a document into multiple documents by delimited text field](https://discuss.elastic.co/t/explode-a-document-into-multiple-documents-by-delimited-text-field/376141)
**Author:** [@wpm](https://discuss.elastic.co/u/wpm)\ **Replies:** 3\ **Last updated:** [March 21, 2025, 11:56pm UTC](https://discuss.elastic.co/t/explode-a-document-into-multiple-documents-by-delimited-text-field/376141 "2025-03-21T23:56:10Z")
I have the following index. colors,value "blue,red", 10 "red", 20 "green", 5 "blue,red", 15 "blue,green", 5 I want to aggregate value by color like so. blue = 10, 15, 5 red = 10, 20, 15 green = 5, 5 The problem is th… --- ## [How to test a pipeline with a CSV processor](https://discuss.elastic.co/t/how-to-test-a-pipeline-with-a-csv-processor/376197)
**Author:** [@wpm](https://discuss.elastic.co/u/wpm)\ **Replies:** 2\ **Last updated:** [March 21, 2025, 10:50pm UTC](https://discuss.elastic.co/t/how-to-test-a-pipeline-with-a-csv-processor/376197 "2025-03-21T22:50:14Z")
I want to ingest this csv file: text,value The triangle is blue.,10 The square is red.,20 There are two red circles.,30 The triangle is green.,40 I created this ingestion pipeline: \[ { "csv": { "field": "m… --- ## [Logstash - Garbage Collection Issue](https://discuss.elastic.co/t/logstash-garbage-collection-issue/376219)
**Author:** [@sujesh\_js](https://discuss.elastic.co/u/sujesh_js)\ **Replies:** 1\ **Last updated:** [March 21, 2025, 3:33pm UTC](https://discuss.elastic.co/t/logstash-garbage-collection-issue/376219 "2025-03-21T15:33:02Z")
I need help. My code retrieves data from an external API, converts the response to JSON, and then iterates over it n times. The entire process takes approximately 30 minutes to complete, and the final output is sent to … --- ## [Case insensitive regex query with character range](https://discuss.elastic.co/t/case-insensitive-regex-query-with-character-range/376136)
**Author:** [@petrsimon](https://discuss.elastic.co/u/petrsimon)\ **Replies:** 10\ **Last updated:** [March 21, 2025, 3:07pm UTC](https://discuss.elastic.co/t/case-insensitive-regex-query-with-character-range/376136 "2025-03-21T15:07:26Z")
Hi, I'm implementing regex search on ES 8.16 (using java client) against fields of type keyword and I came across strange issue when sending the case\_insensitive: true option. "\[abc\]+" -\> "abc", "ABC" "\[ABC\]+" -\> "ab… --- ## [Create a Custom Log not import in logstash](https://discuss.elastic.co/t/create-a-custom-log-not-import-in-logstash/376222)
**Author:** [@brunopsitech](https://discuss.elastic.co/u/brunopsitech)\ **Replies:** 2\ **Last updated:** [March 21, 2025, 2:18pm UTC](https://discuss.elastic.co/t/create-a-custom-log-not-import-in-logstash/376222 "2025-03-21T14:18:06Z")
Hi, i have a log customized, and when i try read and input in elastic, nothing happens. The logstash dont generate any error or message. File INPUT: /var/log/link.log 2025-03-21T07:43:22-03:00 Link2 ON 2025-03-21T07:4… --- ## [Missing status Field for IIS Application Pool in Metricbeat](https://discuss.elastic.co/t/missing-status-field-for-iis-application-pool-in-metricbeat/376234)
**Author:** [@Rutuja\_kaldhone](https://discuss.elastic.co/u/Rutuja_kaldhone)\ **Replies:** 0\ **Last updated:** [March 21, 2025, 2:14pm UTC](https://discuss.elastic.co/t/missing-status-field-for-iis-application-pool-in-metricbeat/376234 "2025-03-21T14:14:45Z")
Hello, I am using Elastic Agent to monitor IIS application pools, but I noticed that the status field is missing from the collected data. I expected Metricbeat to provide an indication of whether an application pool is … --- ## [Logstash and pipelines](https://discuss.elastic.co/t/logstash-and-pipelines/374287)
**Author:** [@Trent-alex](https://discuss.elastic.co/u/Trent-alex)\ **Replies:** 15\ **Last updated:** [March 21, 2025, 2:13pm UTC](https://discuss.elastic.co/t/logstash-and-pipelines/374287 "2025-03-21T14:13:31Z")
Hello, I am attempting my first pipeline from a csv to logstash. I am running elasticsearch and kibana on a single alma linux machine. I downloaded elasticsearch, logstash and kibana from the 8.17 webpage and after extr… --- ## [Bulk Ingester flush timing issues with wait\_for Refresh Policy](https://discuss.elastic.co/t/bulk-ingester-flush-timing-issues-with-wait-for-refresh-policy/376122)
**Author:** [@mattar](https://discuss.elastic.co/u/mattar)\ **Replies:** 5\ **Last updated:** [March 21, 2025, 9:47am UTC](https://discuss.elastic.co/t/bulk-ingester-flush-timing-issues-with-wait-for-refresh-policy/376122 "2025-03-21T09:47:24Z")
Hello everyone, I’m working with the bulk ingester in Elastic 8.15.3 and encountering some timing issues with flush. I configured the bulk ingester with a refresh policy set to wait\_for in the global settings, expecting… --- ## [Semantic search with the new semantic\_text field](https://discuss.elastic.co/t/semantic-search-with-the-new-semantic-text-field/367169)
**Author:** [@JdKock](https://discuss.elastic.co/u/JdKock)\ **Replies:** 12\ **Last updated:** [March 21, 2025, 8:39am UTC](https://discuss.elastic.co/t/semantic-search-with-the-new-semantic-text-field/367169 "2025-03-21T08:39:19Z")
I did some testing with Elser and after that I used the E5 model to play around with semantic search. I use the knn search to create a query on multiple embedding fields. I also looked at the retrievers to create a hybri… --- ## [How to merge selected http headers into the doc fields](https://discuss.elastic.co/t/how-to-merge-selected-http-headers-into-the-doc-fields/376210)
**Author:** [@tmcarrara](https://discuss.elastic.co/u/tmcarrara)\ **Replies:** 1\ **Last updated:** [March 21, 2025, 8:03am UTC](https://discuss.elastic.co/t/how-to-merge-selected-http-headers-into-the-doc-fields/376210 "2025-03-21T08:03:15Z")
hello im trying to extract some headers from http request input and put into the document, but i dont know how to do that. this is what i tried: my environment: version: '3.8' services: elasticsearch: image: doc… --- ## [Timezone offset is not working for the custom date formats](https://discuss.elastic.co/t/timezone-offset-is-not-working-for-the-custom-date-formats/372010)
**Author:** [@Muskan\_Agarwal](https://discuss.elastic.co/u/Muskan_Agarwal)\ **Replies:** 1\ **Last updated:** [March 21, 2025, 6:53am UTC](https://discuss.elastic.co/t/timezone-offset-is-not-working-for-the-custom-date-formats/372010 "2025-03-21T06:53:27Z")
On 2012-05-18 11:41:48,452, with a timezone offset of +07:00, when applying the timezone to a custom date format such as yyyy-MM-dd HH:mm:ss,SSS, the following timestamp is produced: In contrast, when using a standard… --- ## [Why multi-fields display in kibana?](https://discuss.elastic.co/t/why-multi-fields-display-in-kibana/376206)
**Author:** [@Anson5](https://discuss.elastic.co/u/Anson5)\ **Replies:** 0\ **Last updated:** [March 20, 2025, 9:47pm UTC](https://discuss.elastic.co/t/why-multi-fields-display-in-kibana/376206 "2025-03-20T21:47:08Z")
I have three indexes: ta-logs-info, ta-logs-error, and ta-logs-trace, all using the same mapping. I’ve also created four different index patterns: ta-logs-info ta-logs-error ta-logs-trace ta-logs\* (covering all three i… --- ## [Index search: What is the opposite of is:isManaged](https://discuss.elastic.co/t/index-search-what-is-the-opposite-of-is-ismanaged/376192)
**Author:** [@wpm](https://discuss.elastic.co/u/wpm)\ **Replies:** 1\ **Last updated:** [March 20, 2025, 8:27pm UTC](https://discuss.elastic.co/t/index-search-what-is-the-opposite-of-is-ismanaged/376192 "2025-03-20T20:27:54Z")
I'm on Stack Management/Ingest Pipelines in Kibana. I can search for all the managed pipelines by entering is:isManaged. What query string do I enter to find all the non-managed pipelines? I don't know what query langua… --- ## [Cisco not sending clean syslog message](https://discuss.elastic.co/t/cisco-not-sending-clean-syslog-message/376195)
**Author:** [@justin3](https://discuss.elastic.co/u/justin3)\ **Replies:** 1\ **Last updated:** [March 20, 2025, 6:27pm UTC](https://discuss.elastic.co/t/cisco-not-sending-clean-syslog-message/376195 "2025-03-20T18:27:54Z")
I have a cisco WLC that is sending syslog to my logstash server but isn't sending clean syslog messages. It is adding extra stuff before the hostname, special characters before other parts of the message. I've found on… --- ## [ES|QL fails with 'Data too large message for a small dataset](https://discuss.elastic.co/t/es-ql-fails-with-data-too-large-message-for-a-small-dataset/376120)
**Author:** [@GlebCA](https://discuss.elastic.co/u/GlebCA)\ **Replies:** 5\ **Last updated:** [March 20, 2025, 5:24pm UTC](https://discuss.elastic.co/t/es-ql-fails-with-data-too-large-message-for-a-small-dataset/376120 "2025-03-20T17:24:33Z")
I am running the following ES|QL query against 192M documents from filebeat-audit-\* | where user.name is not null AND source.ip is not null and host.name is not null | where event.outcome == "success" and cidr\_match(s… --- ## [Discard empty/null values](https://discuss.elastic.co/t/discard-empty-null-values/376170)
**Author:** [@paddington1](https://discuss.elastic.co/u/paddington1)\ **Replies:** 1\ **Last updated:** [March 20, 2025, 3:33pm UTC](https://discuss.elastic.co/t/discard-empty-null-values/376170 "2025-03-20T15:33:06Z")
Hi, Is there a way to KEEP fields which are not null/empty with ES|QL? I do not want to manually write KEEP for all of the fields which are not empty. --- ## [Error 499 when using http\_poller](https://discuss.elastic.co/t/error-499-when-using-http-poller/376142)
**Author:** [@O\_O\_O](https://discuss.elastic.co/u/O_O_O)\ **Replies:** 2\ **Last updated:** [March 20, 2025, 2:45pm UTC](https://discuss.elastic.co/t/error-499-when-using-http-poller/376142 "2025-03-20T14:45:44Z")
I'm using http\_poller to get JSON data from an endpoint that runs on nginx in the background, I set the request\_timeout =\> 500 so as to give enough time for the request to be fulfilled. I'm getting persistent HTTP error … --- ## [Create a ingest pattern form Postgresql](https://discuss.elastic.co/t/create-a-ingest-pattern-form-postgresql/376187)
**Author:** [@brunopsitech](https://discuss.elastic.co/u/brunopsitech)\ **Replies:** 0\ **Last updated:** [March 20, 2025, 2:23pm UTC](https://discuss.elastic.co/t/create-a-ingest-pattern-form-postgresql/376187 "2025-03-20T14:23:43Z")
I need change file /usr/share/filebeat/module/postgresql/log/ingest/pipeline-log.yml to my postgresql log customization, some one can help ? PostgreSQL configuration: ... log\_connections = on log\_hostname = off log\_… --- ## [Windows ETW logs (DNSServer Analytics logs) not getting ingested](https://discuss.elastic.co/t/windows-etw-logs-dnsserver-analytics-logs-not-getting-ingested/368606)
**Author:** [@suhasbhatt101](https://discuss.elastic.co/u/suhasbhatt101)\ **Replies:** 11\ **Last updated:** [March 20, 2025, 2:21pm UTC](https://discuss.elastic.co/t/windows-etw-logs-dnsserver-analytics-logs-not-getting-ingested/368606 "2025-03-20T14:21:38Z")
I am trying to ingest DNSServer Analytics logs to my ELK stack (V-8.14) but the logs are not getting ingested, below is the configurations i added in my elastic-agent.yml file: Trial 1: - type: etw id: etw-dnss… --- ## [When to index and when to data stream?](https://discuss.elastic.co/t/when-to-index-and-when-to-data-stream/374682)
**Author:** [@h.d.intodata](https://discuss.elastic.co/u/h.d.intodata)\ **Replies:** 2\ **Last updated:** [March 20, 2025, 12:44pm UTC](https://discuss.elastic.co/t/when-to-index-and-when-to-data-stream/374682 "2025-03-20T12:44:34Z")
Hi everyone, When is it best practise to use a data stream and when is it best practise to use an index? This would be from companies who are midsized to large enterprise. Best, H --- ## [Storing Open Telemetry metrics from Logstash to Elasticsearch Index](https://discuss.elastic.co/t/storing-open-telemetry-metrics-from-logstash-to-elasticsearch-index/376177)
**Author:** [@Dani\_Matar](https://discuss.elastic.co/u/Dani_Matar)\ **Replies:** 0\ **Last updated:** [March 20, 2025, 10:45am UTC](https://discuss.elastic.co/t/storing-open-telemetry-metrics-from-logstash-to-elasticsearch-index/376177 "2025-03-20T10:45:58Z")
I am integrating Open telemetry into my logging platform(elk stack). I have an application sending logs -\> otel collector(docker) -\> logstash(docker) -\> elasticsearch(docker). I am facing an issue when storing the metri… --- ## [Missing Data in Elasticsearch - Need Help Resolving](https://discuss.elastic.co/t/missing-data-in-elasticsearch-need-help-resolving/376166)
**Author:** [@SalehEska](https://discuss.elastic.co/u/SalehEska)\ **Replies:** 5\ **Last updated:** [March 20, 2025, 10:09am UTC](https://discuss.elastic.co/t/missing-data-in-elasticsearch-need-help-resolving/376166 "2025-03-20T10:09:26Z")
Hello Elasticsearch community, I'm currently facing an issue where I have missing data in my Elasticsearch index. I have been investigating the issue, but there have been no errors logged in Logstash itself. The cluster… --- ## [Multiline regex not working in heartbeat](https://discuss.elastic.co/t/multiline-regex-not-working-in-heartbeat/376132)
**Author:** [@jweeda](https://discuss.elastic.co/u/jweeda)\ **Replies:** 2\ **Last updated:** [March 20, 2025, 7:59am UTC](https://discuss.elastic.co/t/multiline-regex-not-working-in-heartbeat/376132 "2025-03-20T07:59:24Z")
Hi, I have a working RCE2 regex against below response but when applied on the heartbeat it doesn't pass the positive match. Goal is to assess if there are at east 11 countries returned (actually 200 but than tested stri… --- ## [Filebeat events are not distributed equally to the logstash pods](https://discuss.elastic.co/t/filebeat-events-are-not-distributed-equally-to-the-logstash-pods/376153)
**Author:** [@Nageswarrao\_Bandi](https://discuss.elastic.co/u/Nageswarrao_Bandi)\ **Replies:** 2\ **Last updated:** [March 20, 2025, 7:55am UTC](https://discuss.elastic.co/t/filebeat-events-are-not-distributed-equally-to-the-logstash-pods/376153 "2025-03-20T07:55:36Z")
I am using Filebeat, Logstash, Elastic search, Kibana in my Kubernetes cluster to monitor all my application logs. Let me explain the issue and share my configurations. Filebeat collecting the logs and sending the ev… --- ## [Intervals vs match\_phrase](https://discuss.elastic.co/t/intervals-vs-match-phrase/376163)
**Author:** [@moonrazer](https://discuss.elastic.co/u/moonrazer)\ **Replies:** 0\ **Last updated:** [March 20, 2025, 7:44am UTC](https://discuss.elastic.co/t/intervals-vs-match-phrase/376163 "2025-03-20T07:44:35Z")
I am trying to convince myself that I should be using a match\_phrase query instead of an intervals query for my use case. Are there any notable differences between the following two queries? { "\_source": { "includes":… --- ## [Split function not working when canvas is created](https://discuss.elastic.co/t/split-function-not-working-when-canvas-is-created/375899)
**Author:** [@JensHaglof](https://discuss.elastic.co/u/JensHaglof)\ **Replies:** 3\ **Last updated:** [March 20, 2025, 7:24am UTC](https://discuss.elastic.co/t/split-function-not-working-when-canvas-is-created/375899 "2025-03-20T07:24:38Z")
Hi everyone! I'm experiencing a strange issue. We have data coming into Elastic as a CSV file, delimited by semicolons. When I create a table in Canvas, some rows contain data from another column. Additionally, in one… --- ## [Finding the search as you type match for multi value fields](https://discuss.elastic.co/t/finding-the-search-as-you-type-match-for-multi-value-fields/375806)
**Author:** [@elasticfan1](https://discuss.elastic.co/u/elasticfan1)\ **Replies:** 7\ **Last updated:** [March 20, 2025, 12:26am UTC](https://discuss.elastic.co/t/finding-the-search-as-you-type-match-for-multi-value-fields/375806 "2025-03-20T00:26:04Z")
I have a multi value field called tags. Let's say my doc has the following values for the tags field: \["test trim", "yellow boat", "nice car"\] If I query for "boa", I want to get back "yellow boat". However result retu… --- ## [Time Out on @elastic/elasticsearch node js](https://discuss.elastic.co/t/time-out-on-elastic-elasticsearch-node-js/376144)
**Author:** [@Santos\_Cocom](https://discuss.elastic.co/u/Santos_Cocom)\ **Replies:** 0\ **Last updated:** [March 19, 2025, 10:12pm UTC](https://discuss.elastic.co/t/time-out-on-elastic-elasticsearch-node-js/376144 "2025-03-19T22:12:27Z")
I've set up a cluster, but I've created an index to perform semantic searches. When I try to send a request, I always get a timeout. I use @elastic/elasticsearch with NodeJS. const elastichSearchClient = new Client({ … --- ## [Partition and Index by Text Field Contents](https://discuss.elastic.co/t/partition-and-index-by-text-field-contents/376139)
**Author:** [@wpm](https://discuss.elastic.co/u/wpm)\ **Replies:** 3\ **Last updated:** [March 19, 2025, 9:28pm UTC](https://discuss.elastic.co/t/partition-and-index-by-text-field-contents/376139 "2025-03-19T21:28:15Z")
I have an index with the following records. text The triangle is blue. The square is red. There are two red circles. The triangle is green. I want to partition them by mentions of color in the text field, meaning that … --- ## [Need advice on improving the performance of restoring large backup from GCS repository](https://discuss.elastic.co/t/need-advice-on-improving-the-performance-of-restoring-large-backup-from-gcs-repository/376097)
**Author:** [@lzz118](https://discuss.elastic.co/u/lzz118)\ **Replies:** 7\ **Last updated:** [March 19, 2025, 9:16pm UTC](https://discuss.elastic.co/t/need-advice-on-improving-the-performance-of-restoring-large-backup-from-gcs-repository/376097 "2025-03-19T21:16:46Z")
Hi there, I am looking for some advice on improving the performance of restoring large backup from GCS repository. In my test, I am restoring about 400TB data from the GCS bucket to the 50 nodes elasticsearch cluster r… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=85) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=87)