# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=973 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 974 --- ## [Slow handling of documents when large text in a field](https://discuss.elastic.co/t/slow-handling-of-documents-when-large-text-in-a-field/302431)
**Author:** [@lubosvr](https://discuss.elastic.co/u/lubosvr)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 12:34pm UTC](https://discuss.elastic.co/t/slow-handling-of-documents-when-large-text-in-a-field/302431 "2022-04-14T12:34:54Z")
Hi, We have problems when handling for documents with large content in a single field. We have index with mapping like this: "mappings" : { "dynamic" : "false",... "properties" : { "created" : … --- ## [Netscout arbor legacy syslog parsing - Audit log issue](https://discuss.elastic.co/t/netscout-arbor-legacy-syslog-parsing-audit-log-issue/302340)
**Author:** [@Xor44](https://discuss.elastic.co/u/Xor44)\ **Replies:** 5\ **Last updated:** [April 14, 2022, 12:40pm UTC](https://discuss.elastic.co/t/netscout-arbor-legacy-syslog-parsing-audit-log-issue/302340 "2022-04-14T12:40:58Z")
Hi Folks , I need your help to resolve the issue below . I'm trying since many days to parse some audit logs .You will find some sample below . Idea is to simply extract these field . Field Need to be extracted … --- ## [How to retrieve the number of matched terms?](https://discuss.elastic.co/t/how-to-retrieve-the-number-of-matched-terms/302430)
**Author:** [@Filip4D](https://discuss.elastic.co/u/Filip4D)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 12:33pm UTC](https://discuss.elastic.co/t/how-to-retrieve-the-number-of-matched-terms/302430 "2022-04-14T12:33:57Z")
Hey everyone, is there a way to count the number of matching words in the results. I.e. if I have the following query, I'd like to know for the results set, how many of the words: african, american and male were matched … --- ## [Twitter Logstash pipeline stops after a certain period](https://discuss.elastic.co/t/twitter-logstash-pipeline-stops-after-a-certain-period/302425)
**Author:** [@dihiaselma](https://discuss.elastic.co/u/dihiaselma)\ **Replies:** 2\ **Last updated:** [April 14, 2022, 12:31pm UTC](https://discuss.elastic.co/t/twitter-logstash-pipeline-stops-after-a-certain-period/302425 "2022-04-14T12:31:21Z")
Hello; I have created a pipeline logstash to retrieve data from twitter, then insert these data into Elasticsearch. It works fine for a certain period then, it stops without any error in logs. I have just to restart i… --- ## [QDSL Query: date\_histogram aggregating the results of a date\_histogram](https://discuss.elastic.co/t/qdsl-query-date-histogram-aggregating-the-results-of-a-date-histogram/302414)
**Author:** [@sebneu](https://discuss.elastic.co/u/sebneu)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 9:29am UTC](https://discuss.elastic.co/t/qdsl-query-date-histogram-aggregating-the-results-of-a-date-histogram/302414 "2022-04-14T09:29:41Z")
Hi, I would like to stack two date-histograms, but I do not have a clue how to do it... Say, it's the traffic going through an interface and I want to receive the daily or hourly peaks of data in 60 minutes. For the p… --- ## [Elasticsearch immutable](https://discuss.elastic.co/t/elasticsearch-immutable/302413)
**Author:** [@111401](https://discuss.elastic.co/u/111401)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 9:28am UTC](https://discuss.elastic.co/t/elasticsearch-immutable/302413 "2022-04-14T09:28:58Z")
Hi, I try to understand immutable in Elasticsearch, and read the article Updating API and Partial Update API , but still not clear about it. The article said Documents in Elasticsearch are immutable, but the Update API… --- ## [Logstash UDP input losing messages](https://discuss.elastic.co/t/logstash-udp-input-losing-messages/302411)
**Author:** [@dwjvaughan](https://discuss.elastic.co/u/dwjvaughan)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 9:23am UTC](https://discuss.elastic.co/t/logstash-udp-input-losing-messages/302411 "2022-04-14T09:23:54Z")
I'm using the official logstash container (7.17.0) to ingest some logs over UDP (~8k a minute, with spikes probably around 30k a minute). This is running in AWS Fargate (at the moment 2 containers running, with a load ba… --- ## [Doc count per day and avearge](https://discuss.elastic.co/t/doc-count-per-day-and-avearge/302317)
**Author:** [@meyer1](https://discuss.elastic.co/u/meyer1)\ **Replies:** 2\ **Last updated:** [April 14, 2022, 8:53am UTC](https://discuss.elastic.co/t/doc-count-per-day-and-avearge/302317 "2022-04-14T08:53:55Z")
hello everyone is it possible to get the number of documents that we have in our index per day? and then, after getting that (which I have already done) get the average of that, ie doc\_count per day. I aim to integrate… --- ## [Send all data to one index and specific fields to another at same time](https://discuss.elastic.co/t/send-all-data-to-one-index-and-specific-fields-to-another-at-same-time/302381)
**Author:** [@adrianfusco](https://discuss.elastic.co/u/adrianfusco)\ **Replies:** 2\ **Last updated:** [April 14, 2022, 8:50am UTC](https://discuss.elastic.co/t/send-all-data-to-one-index-and-specific-fields-to-another-at-same-time/302381 "2022-04-14T08:50:24Z")
Hello, I've been reading for a long time in different sources if it's possible to send all data processed by logstash to one index and at the same time send just some specific fields of this data to another different in… --- ## [Use field name in datastream namespace or dataset](https://discuss.elastic.co/t/use-field-name-in-datastream-namespace-or-dataset/302188)
**Author:** [@sirReeall](https://discuss.elastic.co/u/sirReeall)\ **Replies:** 5\ **Last updated:** [April 14, 2022, 8:17am UTC](https://discuss.elastic.co/t/use-field-name-in-datastream-namespace-or-dataset/302188 "2022-04-14T08:17:11Z")
I'm trying to use a field with logstash output to Elasticsearch but I can't seem to get this to work. My configuration is as below: output { elasticsearch { hosts =\> "es01" data\_stream =\> "true" data… --- ## [Waiting on default policy with Fleet Server integration](https://discuss.elastic.co/t/waiting-on-default-policy-with-fleet-server-integration/302398)
**Author:** [@tirelibirefe](https://discuss.elastic.co/u/tirelibirefe)\ **Replies:** 2\ **Last updated:** [April 14, 2022, 8:12am UTC](https://discuss.elastic.co/t/waiting-on-default-policy-with-fleet-server-integration/302398 "2022-04-14T08:12:14Z")
Hello, I am not able to run fleet 8.2.2 on EKS Kubernetes. I am not able to find what I'm missing and need to your adises. Here is my config: apiVersion: agent.k8s.elastic.co/v1alpha1 kind: Agent metadata: name: $FL… --- ## [How to export Kibana search query results to CSV file with more than one million records](https://discuss.elastic.co/t/how-to-export-kibana-search-query-results-to-csv-file-with-more-than-one-million-records/301412)
**Author:** [@fymaterials](https://discuss.elastic.co/u/fymaterials)\ **Replies:** 3\ **Last updated:** [April 14, 2022, 7:39am UTC](https://discuss.elastic.co/t/how-to-export-kibana-search-query-results-to-csv-file-with-more-than-one-million-records/301412 "2022-04-14T07:39:27Z")
I used Kibana to query the index, and use export under resource tab to export query results. How can I export query results if there are million records? --- ## [Eck does take metadata name as role name](https://discuss.elastic.co/t/eck-does-take-metadata-name-as-role-name/302186)
**Author:** [@Rasoul\_Ahmadi](https://discuss.elastic.co/u/Rasoul_Ahmadi)\ **Replies:** 1\ **Last updated:** [April 14, 2022, 7:35am UTC](https://discuss.elastic.co/t/eck-does-take-metadata-name-as-role-name/302186 "2022-04-14T07:35:52Z")
hi I have encountered a potentially ridiculous problem and can't find my way out I would appreciate any help my YAML file apiVersion: elasticsearch.k8s.elastic.co/v1 kind: Elasticsearch metadata: name: logging na… --- ## [Elasticsearch non blocking ElasticsearchAsyncSearchAsyncClient and ElasticsearchAsyncClient](https://discuss.elastic.co/t/elasticsearch-non-blocking-elasticsearchasyncsearchasyncclient-and-elasticsearchasyncclient/302077)
**Author:** [@saeed\_shahsavan](https://discuss.elastic.co/u/saeed_shahsavan)\ **Replies:** 1\ **Last updated:** [April 14, 2022, 6:57am UTC](https://discuss.elastic.co/t/elasticsearch-non-blocking-elasticsearchasyncsearchasyncclient-and-elasticsearchasyncclient/302077 "2022-04-14T06:57:32Z")
Recently I have upgraded my project to use Elasticsearch so I have changed my client to use ElasticsearchAsyncSearchAsyncClient and ElasticsearchAsyncClient unfortunately in both clients my response time increased huge… --- ## [Filebeat Barracuda module](https://discuss.elastic.co/t/filebeat-barracuda-module/300008)
**Author:** [@janis.cimins](https://discuss.elastic.co/u/janis.cimins)\ **Replies:** 4\ **Last updated:** [April 14, 2022, 6:34am UTC](https://discuss.elastic.co/t/filebeat-barracuda-module/300008 "2022-04-14T06:34:55Z")
Hello! I have a problem with ingest barracuda logs. But I have trouble on setting up barracuda module. It gives me this error when I enable module and run "sudo filebeat setup -e" 2022-03-15T15:32:39.986Z ERROR instanc… --- ## [Display data from external REST API in Kibana](https://discuss.elastic.co/t/display-data-from-external-rest-api-in-kibana/301317)
**Author:** [@SuprithaAradhya](https://discuss.elastic.co/u/SuprithaAradhya)\ **Replies:** 2\ **Last updated:** [April 14, 2022, 6:06am UTC](https://discuss.elastic.co/t/display-data-from-external-rest-api-in-kibana/301317 "2022-04-14T06:06:32Z")
I want to display some data in Kibana but this data is not present in Elasticsearch or Kibana. I want to read this data from an external REST API, i would be happy if I can do this inside Kibana page or can I add a new p… --- ## [Query array of keyword responce different in source and docfields](https://discuss.elastic.co/t/query-array-of-keyword-responce-different-in-source-and-docfields/302389)
**Author:** [@waitingF](https://discuss.elastic.co/u/waitingF)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 3:34am UTC](https://discuss.elastic.co/t/query-array-of-keyword-responce-different-in-source-and-docfields/302389 "2022-04-14T03:34:43Z")
I have an mapping of keyword field, like below PUT test-map { "mappings": { "properties": { "field": { "type": "keyword" } } } } And I post a doc: POST … --- ## [Track Queries with High Heap Usage](https://discuss.elastic.co/t/track-queries-with-high-heap-usage/302267)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 5\ **Last updated:** [April 14, 2022, 3:24am UTC](https://discuss.elastic.co/t/track-queries-with-high-heap-usage/302267 "2022-04-14T03:24:29Z")
Hi All, I was wondering the best way to track queries based on their Heap usage. Context: I've recently had to increase heap allocation (currently 20GB RAM - 18GB Heap, up from 10GB RAM - 8GB Heap) on coordinating node… --- ## [Forced-awareness in Elastic 8.0.1](https://discuss.elastic.co/t/forced-awareness-in-elastic-8-0-1/301738)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 10\ **Last updated:** [April 14, 2022, 2:44am UTC](https://discuss.elastic.co/t/forced-awareness-in-elastic-8-0-1/301738 "2022-04-14T02:44:57Z")
Hi I have a question: how I can ensure shard replication for to scatter shards to other hosts?, My Elastic cluster consist from 3 host (under 51 data nodes) As You can see Elasticsearch has made replicat on the same … --- ## [Editing and re-indexing large amounts of data in elasticsearch (millions of records)](https://discuss.elastic.co/t/editing-and-re-indexing-large-amounts-of-data-in-elasticsearch-millions-of-records/302373)
**Author:** [@jp184](https://discuss.elastic.co/u/jp184)\ **Replies:** 1\ **Last updated:** [April 14, 2022, 12:55am UTC](https://discuss.elastic.co/t/editing-and-re-indexing-large-amounts-of-data-in-elasticsearch-millions-of-records/302373 "2022-04-14T00:55:20Z")
I recently made a new version of an index for my Elasticsearch data with some new fields included. I re-indexed from the old index, so the new index has all of the old data with also the new mapping to include the new fi… --- ## [Weird / strange version number of cluster after migration to 8.1.2](https://discuss.elastic.co/t/weird-strange-version-number-of-cluster-after-migration-to-8-1-2/302378)
**Author:** [@Zdeno\_Liska](https://discuss.elastic.co/u/Zdeno_Liska)\ **Replies:** 4\ **Last updated:** [April 14, 2022, 12:24am UTC](https://discuss.elastic.co/t/weird-strange-version-number-of-cluster-after-migration-to-8-1-2/302378 "2022-04-14T00:24:46Z")
Hi, I have just upgraded from 7.17 ro 8.1.2. Anyway, what I see in Stack monitoring in cluster version is not 8.1.2, as before when it was there 7.17.2 but can you please help to solve it? Cluster state is green, all… --- ## [Problems getting logs in with winlogbeat](https://discuss.elastic.co/t/problems-getting-logs-in-with-winlogbeat/302169)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 10\ **Last updated:** [April 13, 2022, 8:56pm UTC](https://discuss.elastic.co/t/problems-getting-logs-in-with-winlogbeat/302169 "2022-04-13T20:56:38Z")
ES version 7.16.2 trying to upload sysmon data using winlogbeat. Cluster has "security" enabled and the winlogbeat clients are now connecting an there are no errors in the ES logs. We are using API keys -- this took so… --- ## [ElasticSearch using Docker and BitBucket DataCenter](https://discuss.elastic.co/t/elasticsearch-using-docker-and-bitbucket-datacenter/302163)
**Author:** [@ibmsorerer](https://discuss.elastic.co/u/ibmsorerer)\ **Replies:** 3\ **Last updated:** [April 13, 2022, 8:21pm UTC](https://discuss.elastic.co/t/elasticsearch-using-docker-and-bitbucket-datacenter/302163 "2022-04-13T20:21:34Z")
We were running BitBucket v6.10.3 as a monolithic server, which has reached EOL. I've been migrating this system to BB v7.21.0 (current release). I've been able to create an ES cluster under Docker/OpenShift without re… --- ## [Elastic Search Logstash input -\>output AWS s3](https://discuss.elastic.co/t/elastic-search-logstash-input-output-aws-s3/302376)
**Author:** [@MLsuper](https://discuss.elastic.co/u/MLsuper)\ **Replies:** 0\ **Last updated:** [April 13, 2022, 7:35pm UTC](https://discuss.elastic.co/t/elastic-search-logstash-input-output-aws-s3/302376 "2022-04-13T19:35:14Z")
Is it possible not to query all the data(duplication) when we ingest data from Elasticsearch input -\>aws s3 output? I want to ingest the data daily but it would duplicate it querying all the data from the start again bu… --- ## [How to parse json logs in logstash](https://discuss.elastic.co/t/how-to-parse-json-logs-in-logstash/302358)
**Author:** [@hassnain](https://discuss.elastic.co/u/hassnain)\ **Replies:** 1\ **Last updated:** [April 13, 2022, 7:02pm UTC](https://discuss.elastic.co/t/how-to-parse-json-logs-in-logstash/302358 "2022-04-13T19:02:10Z")
{"className":"HomePageBusiness.java","msisdn":"912345678902","method":"HOMEPAGE","externalAPI":"My project info","message":"Delta this is successfull","timestamp":"2022/04/06 21:49:14","timeElapsed":"0:0:0:109"} This is… --- ## [Default Search in Discover](https://discuss.elastic.co/t/default-search-in-discover/302362)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 1\ **Last updated:** [April 13, 2022, 4:28pm UTC](https://discuss.elastic.co/t/default-search-in-discover/302362 "2022-04-13T16:28:05Z")
Is there a way to set Discover to open to a default saved search? I know you can set the default index pattern, but my ideal would be that - for each Space's Discover - it would open with a default saved search with all … --- ## [Filebeat hangs on Windows Server](https://discuss.elastic.co/t/filebeat-hangs-on-windows-server/300654)
**Author:** [@Cuong\_Hoang](https://discuss.elastic.co/u/Cuong_Hoang)\ **Replies:** 0\ **Last updated:** [March 25, 2022, 3:23am UTC](https://discuss.elastic.co/t/filebeat-hangs-on-windows-server/300654 "2022-03-25T03:23:50Z")
Hi all. I have a problem with beats (winlogbeat, filebeat) on Windows Server 2016. I use filebeat to collect IIS logs. Server information: OS Name: Microsoft Windows Server 2016 Standard OS Version: 10.0.14393 N/A Bu… --- ## [Winlogbeat & Logstash - Ingest Pipelines](https://discuss.elastic.co/t/winlogbeat-logstash-ingest-pipelines/301758)
**Author:** [@bct.timo.crabbe](https://discuss.elastic.co/u/bct.timo.crabbe)\ **Replies:** 4\ **Last updated:** [April 13, 2022, 6:31pm UTC](https://discuss.elastic.co/t/winlogbeat-logstash-ingest-pipelines/301758 "2022-04-13T18:31:39Z")
Hi everyone, I am having an issue with the ingest pipelines for powershell while using winlogbeat and the logstash output (both version 8.1.0). The powershell events seem not to be processed by the pipeline. There is a… --- ## [Reducing relevance for viewed videos](https://discuss.elastic.co/t/reducing-relevance-for-viewed-videos/302352)
**Author:** [@Gustavo\_Leite\_Silvan](https://discuss.elastic.co/u/Gustavo_Leite_Silvan)\ **Replies:** 1\ **Last updated:** [April 13, 2022, 6:14pm UTC](https://discuss.elastic.co/t/reducing-relevance-for-viewed-videos/302352 "2022-04-13T18:14:05Z")
Hello there! We have a social network app that contains user's videos. The video URL is stored in a timeline index on Elastic. When the users opens the app, we will retrieve relevant videos for him based on the video p… --- ## [How to configure syslog output plugin to useboth tcp and udp protocols based on Remote syslog protocol](https://discuss.elastic.co/t/how-to-configure-syslog-output-plugin-to-useboth-tcp-and-udp-protocols-based-on-remote-syslog-protocol/302312)
**Author:** [@Nikhitha](https://discuss.elastic.co/u/Nikhitha)\ **Replies:** 1\ **Last updated:** [April 13, 2022, 5:58pm UTC](https://discuss.elastic.co/t/how-to-configure-syslog-output-plugin-to-useboth-tcp-and-udp-protocols-based-on-remote-syslog-protocol/302312 "2022-04-13T17:58:01Z")
logstash syslog output plugin protocol should be configured to use tcp or udp dynamically instead of being hardcoded to any one protocol. Can someone help me with this. [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=972) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=974)