# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=329 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 330 --- ## [Send Elasticsearch logs to Graylog](https://discuss.elastic.co/t/send-elasticsearch-logs-to-graylog/321199)
**Author:** [@tiwaxa4826](https://discuss.elastic.co/u/tiwaxa4826)\ **Replies:** 1\ **Last updated:** [December 14, 2022, 8:59am UTC](https://discuss.elastic.co/t/send-elasticsearch-logs-to-graylog/321199 "2022-12-14T08:59:58Z")
Hi! I have an on-premise infrastructure. I historically have a Graylog to centralize my logs. For my application needs, I have installed an Elasticsearch cluster and I would like to send Elasticsearch logs to Graylog. N… --- ## [Ordering on parent-aggregations based on sub-aggregrations](https://discuss.elastic.co/t/ordering-on-parent-aggregations-based-on-sub-aggregrations/320437)
**Author:** [@Rajamallikeerthana\_R](https://discuss.elastic.co/u/Rajamallikeerthana_R)\ **Replies:** 1\ **Last updated:** [December 14, 2022, 7:51am UTC](https://discuss.elastic.co/t/ordering-on-parent-aggregations-based-on-sub-aggregrations/320437 "2022-12-14T07:51:34Z")
Hi, I am using elasticsearch 6.3 . I have an index event\_v4 which store the data of all events handled by our company. Now i need to get a list of cities that satisfy a certain conditions. But if the count is less than r… --- ## [Elastic search in splitting the words if dot comes between](https://discuss.elastic.co/t/elastic-search-in-splitting-the-words-if-dot-comes-between/321187)
**Author:** [@jothi\_mano](https://discuss.elastic.co/u/jothi_mano)\ **Replies:** 1\ **Last updated:** [December 14, 2022, 7:21am UTC](https://discuss.elastic.co/t/elastic-search-in-splitting-the-words-if-dot-comes-between/321187 "2022-12-14T07:21:37Z")
If a dot comes between the search string , it is not returning the proper results. Example : search string ' 0002.AB' Need a result which should list the results that matches the whole word first and followed by other… --- ## [How to handle missing values for date datatype while ingesting the data in Elasticsearch](https://discuss.elastic.co/t/how-to-handle-missing-values-for-date-datatype-while-ingesting-the-data-in-elasticsearch/320524)
**Author:** [@Durga\_Prasad](https://discuss.elastic.co/u/Durga_Prasad)\ **Replies:** 3\ **Last updated:** [December 14, 2022, 5:49am UTC](https://discuss.elastic.co/t/how-to-handle-missing-values-for-date-datatype-while-ingesting-the-data-in-elasticsearch/320524 "2022-12-14T05:49:12Z")
There are few empty values for date datatype field in a csv file. So, while ingesting the data in Kibana (uploading csv file), getting the below error. Some documents could not be imported 1445 out of 45436 documents c… --- ## [Nested List Ingest Pipeline](https://discuss.elastic.co/t/nested-list-ingest-pipeline/320504)
**Author:** [@dwissm1](https://discuss.elastic.co/u/dwissm1)\ **Replies:** 1\ **Last updated:** [December 14, 2022, 1:01am UTC](https://discuss.elastic.co/t/nested-list-ingest-pipeline/320504 "2022-12-14T01:01:14Z")
Hey Folks. I have a nested list inside of a list (obs - below) in some data from my tempest weather station. I want to split out the csv and I have the field names. I tried a foreach and a foreach with an append... no… --- ## [Using Curl to change cluster settings](https://discuss.elastic.co/t/using-curl-to-change-cluster-settings/321086)
**Author:** [@matt\_dee](https://discuss.elastic.co/u/matt_dee)\ **Replies:** 2\ **Last updated:** [December 13, 2022, 10:21pm UTC](https://discuss.elastic.co/t/using-curl-to-change-cluster-settings/321086 "2022-12-13T22:21:39Z")
Hi. I'm quite new to ES and have done most of the admin through kibana I was doing a cluster restart and disabled shard allocation via dev tools through Kibana. Now I've started the nodes back up Kibana is giving an e… --- ## [Configure PKI authentication for Elasticsearch 7.7](https://discuss.elastic.co/t/configure-pki-authentication-for-elasticsearch-7-7/318686)
**Author:** [@samhagin](https://discuss.elastic.co/u/samhagin)\ **Replies:** 12\ **Last updated:** [December 13, 2022, 8:45pm UTC](https://discuss.elastic.co/t/configure-pki-authentication-for-elasticsearch-7-7/318686 "2022-12-13T20:45:56Z")
This guide Elasticsearch Security: Configure TLS/SSL & PKI Authentication | Elastic Blog shows how to configure PKI for Elasticsearch version 6.5 however this doesn't work for version 7.7.0 ( the version I'm currently us… --- ## [Explain feature is not working in a search template](https://discuss.elastic.co/t/explain-feature-is-not-working-in-a-search-template/321060)
**Author:** [@Randall-McRee](https://discuss.elastic.co/u/Randall-McRee)\ **Replies:** 3\ **Last updated:** [December 13, 2022, 4:26pm UTC](https://discuss.elastic.co/t/explain-feature-is-not-working-in-a-search-template/321060 "2022-12-13T16:26:39Z")
When I put "explain=true" into a search template (as a parameter, so we can turn it on and off) it does not work. I see a similar problem long ago in .net...this is version 8.14. Following is simple kibana demonstrating… --- ## [GET Kibana API output in table format to send health and nodes details](https://discuss.elastic.co/t/get-kibana-api-output-in-table-format-to-send-health-and-nodes-details/321039)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 3\ **Last updated:** [December 13, 2022, 4:10pm UTC](https://discuss.elastic.co/t/get-kibana-api-output-in-table-format-to-send-health-and-nodes-details/321039 "2022-12-13T16:10:45Z")
Hi team, I need to send kibana report which contains all values from below API. We need to send this in one email. Is this possible to create table and send this report in table format. GET \_cluster/health GET /\_cat/… --- ## [ML problem](https://discuss.elastic.co/t/ml-problem/321144)
**Author:** [@alvaro\_ing](https://discuss.elastic.co/u/alvaro_ing)\ **Replies:** 1\ **Last updated:** [December 13, 2022, 4:04pm UTC](https://discuss.elastic.co/t/ml-problem/321144 "2022-12-13T16:04:05Z")
When I try to run an anomaly detection job in elastic I get an error and it does not execute me. The error I get in the elastic console is this: \[2022-12-13T16:30:18,711\]\[WARN \]\[o.e.p.PersistentTasksClusterService\] \[alv… --- ## [During terms aggregation with partition we get sum\_other\_doc\_count \> 0 in between partitions](https://discuss.elastic.co/t/during-terms-aggregation-with-partition-we-get-sum-other-doc-count-0-in-between-partitions/321140)
**Author:** [@akleiber](https://discuss.elastic.co/u/akleiber)\ **Replies:** 3\ **Last updated:** [December 13, 2022, 3:29pm UTC](https://discuss.elastic.co/t/during-terms-aggregation-with-partition-we-get-sum-other-doc-count-0-in-between-partitions/321140 "2022-12-13T15:29:10Z")
We are running ES 6.8 and move some documents to another ES Cluster with a more recent version. We also transform the documents during that process. We need to group documents by a field, so we do this via a terms aggre… --- ## [Inconsistency in the number of documents](https://discuss.elastic.co/t/inconsistency-in-the-number-of-documents/321129)
**Author:** [@Ariel\_Zach](https://discuss.elastic.co/u/Ariel_Zach)\ **Replies:** 4\ **Last updated:** [December 13, 2022, 3:25pm UTC](https://discuss.elastic.co/t/inconsistency-in-the-number-of-documents/321129 "2022-12-13T15:25:38Z")
I have an index with 2 shards which have 1600M documents each (~3200M total), but when I calculate a histogram, the sum does not give me the total number of documents, the result is much less, what is the reason? --- ## [Store query in cache](https://discuss.elastic.co/t/store-query-in-cache/318994)
**Author:** [@Ismet](https://discuss.elastic.co/u/Ismet)\ **Replies:** 4\ **Last updated:** [December 13, 2022, 2:22pm UTC](https://discuss.elastic.co/t/store-query-in-cache/318994 "2022-12-13T14:22:53Z")
Hi, how to put query with aggregation in ram cache? I can't find an example. Version: 7.9 There is my query: GET product/\_search { "size": 0, "query": { "bool": { "must\_not": { "match": { … --- ## [Elastic search cluster showing unhealthy, Cluster "red"](https://discuss.elastic.co/t/elastic-search-cluster-showing-unhealthy-cluster-red/321070)
**Author:** [@Harsh3](https://discuss.elastic.co/u/Harsh3)\ **Replies:** 5\ **Last updated:** [December 13, 2022, 1:51pm UTC](https://discuss.elastic.co/t/elastic-search-cluster-showing-unhealthy-cluster-red/321070 "2022-12-13T13:51:35Z")
Hello ! I am new to Elasticsearch! This is the first time i am doing installation, if someone can pls help, have spent days searching for the issue but no luck .. We have kibana running inside EKS cluster and Elastic-s… --- ## [ElasticSearch Azure storage](https://discuss.elastic.co/t/elasticsearch-azure-storage/321124)
**Author:** [@OlLap](https://discuss.elastic.co/u/OlLap)\ **Replies:** 1\ **Last updated:** [December 13, 2022, 1:30pm UTC](https://discuss.elastic.co/t/elasticsearch-azure-storage/321124 "2022-12-13T13:30:54Z")
Hello everyone, is it possible to use Azure Storage account (Files share or Blob container) for Elasticsearch data nodes? --- ## [ECK managed elasticsearch (with TLS enabled) getting flooded with "received plaintext http traffic on an https channel" logs](https://discuss.elastic.co/t/eck-managed-elasticsearch-with-tls-enabled-getting-flooded-with-received-plaintext-http-traffic-on-an-https-channel-logs/321117)
**Author:** [@Daithi\_O\_Conchobhair](https://discuss.elastic.co/u/Daithi_O_Conchobhair)\ **Replies:** 4\ **Last updated:** [December 13, 2022, 12:36pm UTC](https://discuss.elastic.co/t/eck-managed-elasticsearch-with-tls-enabled-getting-flooded-with-received-plaintext-http-traffic-on-an-https-channel-logs/321117 "2022-12-13T12:36:33Z")
Hi there, This is such a strange issue I am not sure if it is a defect or something that I am doing wrong. I will say in my defence that I see it when I just use the quickstart guide also. Versions: IBM Kubernetes Se… --- ## [Elastic.Clients.Elasticsearch 8.0.1](https://discuss.elastic.co/t/elastic-clients-elasticsearch-8-0-1/320388)
**Author:** [@bobwiller](https://discuss.elastic.co/u/bobwiller)\ **Replies:** 1\ **Last updated:** [December 13, 2022, 12:36pm UTC](https://discuss.elastic.co/t/elastic-clients-elasticsearch-8-0-1/320388 "2022-12-13T12:36:30Z")
Does anyone know if the \[Text(Ignore = true)\] attribute is available in the new 8.x .Net Client yet? Or is there a new/different way of doing this? Thanks, Bob --- ## [Child Documents performance](https://discuss.elastic.co/t/child-documents-performance/321120)
**Author:** [@Emanuel\_Zienecker](https://discuss.elastic.co/u/Emanuel_Zienecker)\ **Replies:** 0\ **Last updated:** [December 13, 2022, 11:43am UTC](https://discuss.elastic.co/t/child-documents-performance/321120 "2022-12-13T11:43:26Z")
Hello, I am planning to change the model from nested of parent-child. The following model: Questions -\> Answer. Currently these were all stored nested, now just as parent-child. My question now is this: What makes more… --- ## [How to update the maapings of a certain index in Elastic Search 8.4.1. using Python?](https://discuss.elastic.co/t/how-to-update-the-maapings-of-a-certain-index-in-elastic-search-8-4-1-using-python/321107)
**Author:** [@Shashank02](https://discuss.elastic.co/u/Shashank02)\ **Replies:** 0\ **Last updated:** [December 13, 2022, 10:13am UTC](https://discuss.elastic.co/t/how-to-update-the-maapings-of-a-certain-index-in-elastic-search-8-4-1-using-python/321107 "2022-12-13T10:13:13Z")
So, I'm pushing CSV Data into Elastic Search using python. I'm able to push the data and an index is getting created but the mappings of the index contain only text and keyword. Even if there is a field with the type "lo… --- ## [Installation on ubantu](https://discuss.elastic.co/t/installation-on-ubantu/316961)
**Author:** [@smitak](https://discuss.elastic.co/u/smitak)\ **Replies:** 15\ **Last updated:** [December 13, 2022, 7:30am UTC](https://discuss.elastic.co/t/installation-on-ubantu/316961 "2022-12-13T07:30:02Z")
Hello Sir, I have done the search functionality with fscrawler on local server. It is working good. Now I am uploading on ubantu server. Elastic search is active. But for fscralwer getting error for file content. Elast… --- ## [Kubernetes Elasticsearch 8.5.3 Statefulset (not ECK) set up username / password](https://discuss.elastic.co/t/kubernetes-elasticsearch-8-5-3-statefulset-not-eck-set-up-username-password/321081)
**Author:** [@khteh](https://discuss.elastic.co/u/khteh)\ **Replies:** 0\ **Last updated:** [December 13, 2022, 2:54am UTC](https://discuss.elastic.co/t/kubernetes-elasticsearch-8-5-3-statefulset-not-eck-set-up-username-password/321081 "2022-12-13T02:54:22Z")
How to automatically setup the password of the default user elastic and add other username/password for Elasticsearch 8.5.3 running on kubernetes cluster with manifests? I am not using ECK. Setting environment variable E… --- ## [Can replicas serve kNN search requests?](https://discuss.elastic.co/t/can-replicas-serve-knn-search-requests/321059)
**Author:** [@robertdebug](https://discuss.elastic.co/u/robertdebug)\ **Replies:** 1\ **Last updated:** [December 12, 2022, 5:37pm UTC](https://discuss.elastic.co/t/can-replicas-serve-knn-search-requests/321059 "2022-12-12T17:37:32Z")
Hello, I have a question about kNN search and index replicas. According to the documentation, replicas can increase capacity to serve read requests like searching or retrieving a document. Does this also applies for ap… --- ## [Manually backup data from frozer tier](https://discuss.elastic.co/t/manually-backup-data-from-frozer-tier/320730)
**Author:** [@dimitris\_sb](https://discuss.elastic.co/u/dimitris_sb)\ **Replies:** 2\ **Last updated:** [December 12, 2022, 5:06pm UTC](https://discuss.elastic.co/t/manually-backup-data-from-frozer-tier/320730 "2022-12-12T17:06:44Z")
Hi All, What would be the correct way to make an independent backup (snapshot) of data in the frozen tier? If I take a snapshot of these indices, will the backup be usable as indices from hot/warm/cold tier or it will a… --- ## [Add multiple https API in watcher](https://discuss.elastic.co/t/add-multiple-https-api-in-watcher/321033)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 2\ **Last updated:** [December 12, 2022, 3:03pm UTC](https://discuss.elastic.co/t/add-multiple-https-api-in-watcher/321033 "2022-12-12T15:03:43Z")
Hi team, I am able to send cluster health data using GET \_cluster/health using below input and condition. Now in input section I want to use other two more APIs: GET /\_cat/allocation?v=true&s=node GET \_cat/nodes?v=tru… --- ## [Using transform with enrich pipeline to enrich ip with latest vulnerabilities](https://discuss.elastic.co/t/using-transform-with-enrich-pipeline-to-enrich-ip-with-latest-vulnerabilities/320553)
**Author:** [@siginigin](https://discuss.elastic.co/u/siginigin)\ **Replies:** 6\ **Last updated:** [December 12, 2022, 2:51pm UTC](https://discuss.elastic.co/t/using-transform-with-enrich-pipeline-to-enrich-ip-with-latest-vulnerabilities/320553 "2022-12-12T14:51:05Z")
Hi, I want to enrich incoming event that contains local source.ip/destination.ip with vulnerability field with this logic: match source.ip with server.ip, get highest vulnerability.severity\_num from latest vulnerabilit… --- ## [Ctx.payload variable to be used to send nodes and allocation API details](https://discuss.elastic.co/t/ctx-payload-variable-to-be-used-to-send-nodes-and-allocation-api-details/321041)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 0\ **Last updated:** [December 12, 2022, 2:29pm UTC](https://discuss.elastic.co/t/ctx-payload-variable-to-be-used-to-send-nodes-and-allocation-api-details/321041 "2022-12-12T14:29:47Z")
Hello team, I need to send output of below two API in one email . Unable to find which variable used to send below data for below API. Can you please help me with this. GET \_cat/nodes?v=true&s=name : ip he… --- ## [Audit log time based deletion policy not working](https://discuss.elastic.co/t/audit-log-time-based-deletion-policy-not-working/321022)
**Author:** [@irivas95](https://discuss.elastic.co/u/irivas95)\ **Replies:** 3\ **Last updated:** [December 12, 2022, 12:59pm UTC](https://discuss.elastic.co/t/audit-log-time-based-deletion-policy-not-working/321022 "2022-12-12T12:59:00Z")
Hi, I have the following policy for deleting audit logs older than 7 days in my log4j2.properties config file: appender.audit\_rolling.type = RollingFile appender.audit\_rolling.name = audit\_rolling appender.audit\_rollin… --- ## [Is there any way to get past logs with elasticsearch?](https://discuss.elastic.co/t/is-there-any-way-to-get-past-logs-with-elasticsearch/320001)
**Author:** [@Halil\_Ibrahim\_Celik](https://discuss.elastic.co/u/Halil_Ibrahim_Celik)\ **Replies:** 2\ **Last updated:** [December 12, 2022, 12:16pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-get-past-logs-with-elasticsearch/320001 "2022-12-12T12:16:14Z")
Hello everyone, I am using Elasticsearch and Kibana version 7.17.6 with UiPath orchestrator to view logs. I created dashboard in Kibana to view UiPath robot's usage. Sometimes Elasticsearch and Kibana is closing because… --- ## [Index size increased in Data Stream, in ES 8.x version](https://discuss.elastic.co/t/index-size-increased-in-data-stream-in-es-8-x-version/320986)
**Author:** [@da-head0](https://discuss.elastic.co/u/da-head0)\ **Replies:** 12\ **Last updated:** [December 12, 2022, 11:52am UTC](https://discuss.elastic.co/t/index-size-increased-in-data-stream-in-es-8-x-version/320986 "2022-12-12T11:52:10Z")
Hello, I have a ES 7.10 version Cluster with normal index, and recently I make a ECK cluster with 8.4.2 version with same data but with data stream. But I figured out in new cluster with data stream, the same data woul… --- ## [Ordering of two fields in ELastic, specifically first one is of text and second is from integer](https://discuss.elastic.co/t/ordering-of-two-fields-in-elastic-specifically-first-one-is-of-text-and-second-is-from-integer/321026)
**Author:** [@rvadiga](https://discuss.elastic.co/u/rvadiga)\ **Replies:** 0\ **Last updated:** [December 12, 2022, 11:50am UTC](https://discuss.elastic.co/t/ordering-of-two-fields-in-elastic-specifically-first-one-is-of-text-and-second-is-from-integer/321026 "2022-12-12T11:50:12Z")
Hi Team, Could someone please show hints to implement the below requirement? I have an index where two fields, first one is text field, and second is of integer. I need to take the highest number row from the unique(f… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=328) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=330)