# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=531 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 532 --- ## [Best way to use Ingest Attachment Plugin](https://discuss.elastic.co/t/best-way-to-use-ingest-attachment-plugin/290884)
**Author:** [@sp7980](https://discuss.elastic.co/u/sp7980)\ **Replies:** 3\ **Last updated:** [December 3, 2021, 9:31pm UTC](https://discuss.elastic.co/t/best-way-to-use-ingest-attachment-plugin/290884 "2021-12-03T21:31:39Z")
I am trying to setup ES for indexing document content for full text search. The document types that will be indexed are .docx and pdf. Looks like ingest attachment plugin is to be used for this purpose and I've had a re… --- ## [Updated "hardware" recommendations?](https://discuss.elastic.co/t/updated-hardware-recommendations/290930)
**Author:** [@Jamshid](https://discuss.elastic.co/u/Jamshid)\ **Replies:** 0\ **Last updated:** [December 3, 2021, 8:34pm UTC](https://discuss.elastic.co/t/updated-hardware-recommendations/290930 "2021-12-03T20:34:51Z")
Just wondering if there is an updated doc similar to the very helpful 2.3 guide It summarized memory, disk, and network configuration information and is probably still relevant but I can't find a modern version of the … --- ## [Watcher daily trigger](https://discuss.elastic.co/t/watcher-daily-trigger/290927)
**Author:** [@shreya\_Das](https://discuss.elastic.co/u/shreya_Das)\ **Replies:** 0\ **Last updated:** [December 3, 2021, 6:44pm UTC](https://discuss.elastic.co/t/watcher-daily-trigger/290927 "2021-12-03T18:44:02Z")
I have created a advanced watcher alert to check a particular log message that excecutes daily. It triggers everyday at 8PM. I want to know when the watcher is triggered is it gonna consider only that days log or previou… --- ## [Google Cloud Kubernetes Elastic Interal LoadBalancer](https://discuss.elastic.co/t/google-cloud-kubernetes-elastic-interal-loadbalancer/290787)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 3\ **Last updated:** [December 3, 2021, 4:53pm UTC](https://discuss.elastic.co/t/google-cloud-kubernetes-elastic-interal-loadbalancer/290787 "2021-12-03T16:53:53Z")
Hello, I have a GCP project with /28 VPC(nodes network) the main network peered with another Shared VPC project that maintains connectivity with all other resources. So far I have deployed elasticserach and kibana using… --- ## [Partial substring search that contains whitespaces or special chars like file contains "1 - document" doesnt work](https://discuss.elastic.co/t/partial-substring-search-that-contains-whitespaces-or-special-chars-like-file-contains-1-document-doesnt-work/290883)
**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Replies:** 1\ **Last updated:** [December 3, 2021, 4:49pm UTC](https://discuss.elastic.co/t/partial-substring-search-that-contains-whitespaces-or-special-chars-like-file-contains-1-document-doesnt-work/290883 "2021-12-03T16:49:06Z")
We have an application that store and query data in Elasticsearch. We have a problem when searching for partial substrings that contains a word with special chats like "notepad++.exe" or "/folder1/file1.txt" or "new text… --- ## [Point in time snapshot (PIT id), original query required when paging?](https://discuss.elastic.co/t/point-in-time-snapshot-pit-id-original-query-required-when-paging/290097)
**Author:** [@tamis-laan](https://discuss.elastic.co/u/tamis-laan)\ **Replies:** 5\ **Last updated:** [December 3, 2021, 4:45pm UTC](https://discuss.elastic.co/t/point-in-time-snapshot-pit-id-original-query-required-when-paging/290097 "2021-12-03T16:45:53Z")
I implemented pagination inside an API using point in time snapshots for efficiency. In the first request a PIT is generated and in subsequent requests the PIT is being supplied with the request. What I would like to do… --- ## [Not able to search or aggregate values from a field included lately in the mapping](https://discuss.elastic.co/t/not-able-to-search-or-aggregate-values-from-a-field-included-lately-in-the-mapping/290836)
**Author:** [@Fabio\_Batalha](https://discuss.elastic.co/u/Fabio_Batalha)\ **Replies:** 4\ **Last updated:** [December 3, 2021, 4:12pm UTC](https://discuss.elastic.co/t/not-able-to-search-or-aggregate-values-from-a-field-included-lately-in-the-mapping/290836 "2021-12-03T16:12:02Z")
Hello there! I have a field (log\_file\_name) in my index that was not included in the mapping since de index was created. All records have the field but no mapping was defined to it. My mapping is configured as dynamic =… --- ## [How to get the most relevant fields from a single document?](https://discuss.elastic.co/t/how-to-get-the-most-relevant-fields-from-a-single-document/290895)
**Author:** [@IgnazK](https://discuss.elastic.co/u/IgnazK)\ **Replies:** 0\ **Last updated:** [December 3, 2021, 12:33pm UTC](https://discuss.elastic.co/t/how-to-get-the-most-relevant-fields-from-a-single-document/290895 "2021-12-03T12:33:08Z")
I have an index containing documents with information about various products. As the documents were created from paginated files, the information text is mapped on numerated fields representing the respective page in the… --- ## [Add operation on log messages](https://discuss.elastic.co/t/add-operation-on-log-messages/289466)
**Author:** [@cool999](https://discuss.elastic.co/u/cool999)\ **Replies:** 17\ **Last updated:** [December 3, 2021, 12:27pm UTC](https://discuss.elastic.co/t/add-operation-on-log-messages/289466 "2021-12-03T12:27:59Z")
Hi Team, I have logs, where when bank account is opened i am getting below messages. for APAC - bank account is opened in APAC for EMEA - bank account is opened in EMEA Say for a day, if there was 4 accounts opened… --- ## [Using FSCrawler as REST in simulate mode. How to disable communication with ES (Elasticsearch)](https://discuss.elastic.co/t/using-fscrawler-as-rest-in-simulate-mode-how-to-disable-communication-with-es-elasticsearch/290805)
**Author:** [@Francois\_Saab](https://discuss.elastic.co/u/Francois_Saab)\ **Replies:** 2\ **Last updated:** [December 3, 2021, 8:12am UTC](https://discuss.elastic.co/t/using-fscrawler-as-rest-in-simulate-mode-how-to-disable-communication-with-es-elasticsearch/290805 "2021-12-03T08:12:22Z")
Hello, We are using FSCrawler As Rest service and using it in simulate mode. We are uploading files to ES from our SDK. All is ok so far. However we want to configure FSCrawler to not communicate with ES , as we are o… --- ## [Relocation starts on network drops even though node\_left delay is set](https://discuss.elastic.co/t/relocation-starts-on-network-drops-even-though-node-left-delay-is-set/290797)
**Author:** [@jthoni](https://discuss.elastic.co/u/jthoni)\ **Replies:** 4\ **Last updated:** [December 3, 2021, 7:54am UTC](https://discuss.elastic.co/t/relocation-starts-on-network-drops-even-though-node-left-delay-is-set/290797 "2021-12-03T07:54:00Z")
We have a process (Patch Orchestration in Azure Service Fabric) that patches our VMs. As I expect node reboots during this, I have set a node\_left delay to cover the reboot time (i.e., ~10 min). This generally works well… --- ## [NEST Client.SearchAsync\() automatically deserializes an object with a Null value](https://discuss.elastic.co/t/nest-client-searchasync-t-automatically-deserializes-an-object-with-a-null-value/290847)
**Author:** [@KhalidDu](https://discuss.elastic.co/u/KhalidDu)\ **Replies:** 0\ **Last updated:** [December 3, 2021, 6:57am UTC](https://discuss.elastic.co/t/nest-client-searchasync-t-automatically-deserializes-an-object-with-a-null-value/290847 "2021-12-03T06:57:14Z")
When I'm in the Nest Client, I use Client.SearchAsync\() , Some fields in the result are Null, Entity is the Index structure that I inserted. When I use Client.SearchAsync\(), I don't want to use Object, w… --- ## [Elasticsearch highlight](https://discuss.elastic.co/t/elasticsearch-highlight/290838)
**Author:** [@qixian](https://discuss.elastic.co/u/qixian)\ **Replies:** 0\ **Last updated:** [December 3, 2021, 3:46am UTC](https://discuss.elastic.co/t/elasticsearch-highlight/290838 "2021-12-03T03:46:00Z")
I want to have a accurate highlight match.for example ,then I search the string '2323',which will highlight the '2323' and don't highlight mathch '23231'、'23232' and so on.now I used the plain highlight type and default … --- ## [Nest query search with AND](https://discuss.elastic.co/t/nest-query-search-with-and/290793)
**Author:** [@Katgust](https://discuss.elastic.co/u/Katgust)\ **Replies:** 1\ **Last updated:** [December 2, 2021, 9:55pm UTC](https://discuss.elastic.co/t/nest-query-search-with-and/290793 "2021-12-02T21:55:51Z")
I'd like to convert this GET /financialfirms/\_search?q="Danske" AND "Bank" into DSL but can't find out how. Anyone wanna help? Right now every query I've made gives a result for "Danske" OR "Bank". I've tried differen… --- ## [Histogram aggregation on calculated field by script](https://discuss.elastic.co/t/histogram-aggregation-on-calculated-field-by-script/290829)
**Author:** [@Vladpov](https://discuss.elastic.co/u/Vladpov)\ **Replies:** 0\ **Last updated:** [December 2, 2021, 8:53pm UTC](https://discuss.elastic.co/t/histogram-aggregation-on-calculated-field-by-script/290829 "2021-12-02T20:53:16Z")
Hey everyone! We have index with products and every product (document in index) has several prices fields. We have query with script that calculates us finalPrice field because we do not know how many prices a document … --- ## [Custom Analyser for IPv4 Mapped IPv6](https://discuss.elastic.co/t/custom-analyser-for-ipv4-mapped-ipv6/290822)
**Author:** [@Sai\_Satwik\_Kuppili](https://discuss.elastic.co/u/Sai_Satwik_Kuppili)\ **Replies:** 0\ **Last updated:** [December 2, 2021, 7:55pm UTC](https://discuss.elastic.co/t/custom-analyser-for-ipv4-mapped-ipv6/290822 "2021-12-02T19:55:07Z")
Seems Elasticsearch doesn't allow IPv4 mapped IPv6 with CIDR to index. When I was trying to index IPv4-mapped-IPv6 ::ffff:127.12.0.1/108 I am getting the following error. PUT test PUT test/\_mapping/ { "dynamic\_t… --- ## [Scaling Out a Cloud Deployment](https://discuss.elastic.co/t/scaling-out-a-cloud-deployment/290650)
**Author:** [@nsouth](https://discuss.elastic.co/u/nsouth)\ **Replies:** 4\ **Last updated:** [December 2, 2021, 6:48pm UTC](https://discuss.elastic.co/t/scaling-out-a-cloud-deployment/290650 "2021-12-02T18:48:31Z")
We have an Elastic Cloud deployment and I'd like to scale out the hot data tier. However, it's not clear to me how to scale out vs. scaling up. Questions: Does changing "Size per zone" result in scaling out or only in … --- ## [How to export/import an ES snapshot to/from an external harddrive](https://discuss.elastic.co/t/how-to-export-import-an-es-snapshot-to-from-an-external-harddrive/290796)
**Author:** [@dancing\_ghosts](https://discuss.elastic.co/u/dancing_ghosts)\ **Replies:** 4\ **Last updated:** [December 2, 2021, 6:11pm UTC](https://discuss.elastic.co/t/how-to-export-import-an-es-snapshot-to-from-an-external-harddrive/290796 "2021-12-02T18:11:09Z")
We have our customers Filebeat/Winlogbeat data stored on our Elasticsearch instance. The customer has an Elasticsearch instance at their physical location which is the same version as ours. They wish to import this data … --- ## [Error saying request body or source is required](https://discuss.elastic.co/t/error-saying-request-body-or-source-is-required/147523)
**Author:** [@chitresh\_jain](https://discuss.elastic.co/u/chitresh_jain)\ **Replies:** 3\ **Last updated:** [December 2, 2021, 5:27pm UTC](https://discuss.elastic.co/t/error-saying-request-body-or-source-is-required/147523 "2021-12-02T17:27:20Z")
So I am testing my analyzer after I created it successfully using - { "settings" : { "analysis": { "filter": { "autocomplete\_filter" : { "type" : "edge\_ngram", "min\_gram" : 1, "max\_gram" : 20 } }, "analyzer":… --- ## [Help with Winlogbeat and filtering computer accounts](https://discuss.elastic.co/t/help-with-winlogbeat-and-filtering-computer-accounts/290792)
**Author:** [@joachim\_johannesen](https://discuss.elastic.co/u/joachim_johannesen)\ **Replies:** 0\ **Last updated:** [December 2, 2021, 3:57pm UTC](https://discuss.elastic.co/t/help-with-winlogbeat-and-filtering-computer-accounts/290792 "2021-12-02T15:57:48Z")
I have a few ELK stacks up and running but I'm getting a lot of false 'Admin User Sessions' which are the computer accounts eg computer$. I'm using Windows Event forwarding to send all security related events over to my … --- ## [Elasticsearch-curator 5.8.2 is failing during TypeError: load() missing 1 required positional argument: 'Loader'](https://discuss.elastic.co/t/elasticsearch-curator-5-8-2-is-failing-during-typeerror-load-missing-1-required-positional-argument-loader/290608)
**Author:** [@hudar01](https://discuss.elastic.co/u/hudar01)\ **Replies:** 2\ **Last updated:** [December 2, 2021, 3:53pm UTC](https://discuss.elastic.co/t/elasticsearch-curator-5-8-2-is-failing-during-typeerror-load-missing-1-required-positional-argument-loader/290608 "2021-12-02T15:53:49Z")
Hello, I'm trying to execute a dry run for delete snapshot when I got this error: TypeError: load() missing 1 required positional argument: 'Loader' Note that it worked before (like 5 days ago). It started failing afte… --- ## [\[Grafana\]\[Elastic Search\] :: Plot IPs hitting website with their Distinct Count](https://discuss.elastic.co/t/grafana-elastic-search-plot-ips-hitting-website-with-their-distinct-count/290675)
**Author:** [@thejusjose-mindcurv](https://discuss.elastic.co/u/thejusjose-mindcurv)\ **Replies:** 1\ **Last updated:** [December 2, 2021, 2:07pm UTC](https://discuss.elastic.co/t/grafana-elastic-search-plot-ips-hitting-website-with-their-distinct-count/290675 "2021-12-02T14:07:35Z")
Hi all, Requirement Get the Top hitting IPs and their count and visualize in Grafana We had this implemented already in Kibana visualization where we have metrics and buckets to filter out the required fields. We a… --- ## [Getting issue during running a api command](https://discuss.elastic.co/t/getting-issue-during-running-a-api-command/290142)
**Author:** [@Linuxuser](https://discuss.elastic.co/u/Linuxuser)\ **Replies:** 10\ **Last updated:** [December 2, 2021, 1:44pm UTC](https://discuss.elastic.co/t/getting-issue-during-running-a-api-command/290142 "2021-12-02T13:44:10Z")
http://192.168.1.211:9000/api/sources?range=36000&size=5000 By running this command getting issue. "ElasticsearchException{message=Unable to perform search query\\n\\n\[parent\] Data too large, data for \[\… --- ## [Question about latency and response time](https://discuss.elastic.co/t/question-about-latency-and-response-time/290753)
**Author:** [@Ain\_Ryushika](https://discuss.elastic.co/u/Ain_Ryushika)\ **Replies:** 0\ **Last updated:** [December 2, 2021, 10:56am UTC](https://discuss.elastic.co/t/question-about-latency-and-response-time/290753 "2021-12-02T10:56:53Z")
Hi, I have 2 question regarding latency and response time in Elasticsearch. Why on different monitoring clients there are different response time? For example in Kibana average request time is 700ms: In Graphana a… --- ## [Elasticsearch fuzziness with multi\_match and bool\_prefix type](https://discuss.elastic.co/t/elasticsearch-fuzziness-with-multi-match-and-bool-prefix-type/290735)
**Author:** [@konman1989](https://discuss.elastic.co/u/konman1989)\ **Replies:** 0\ **Last updated:** [December 2, 2021, 7:35am UTC](https://discuss.elastic.co/t/elasticsearch-fuzziness-with-multi-match-and-bool-prefix-type/290735 "2021-12-02T07:35:39Z")
I have a set of search\_as\_you\_type\_fields I need to search against. Here is my mapping "mappings" : { "properties" : { "description" : { "type" : "search\_as\_you\_type", "doc\_values" : fa… --- ## [How many indices / shards for graylog](https://discuss.elastic.co/t/how-many-indices-shards-for-graylog/290734)
**Author:** [@lkeijser](https://discuss.elastic.co/u/lkeijser)\ **Replies:** 1\ **Last updated:** [December 2, 2021, 7:00am UTC](https://discuss.elastic.co/t/how-many-indices-shards-for-graylog/290734 "2021-12-02T07:00:19Z")
Hi there, I'm running Graylog which uses Elasticsearch as backend. RIght now we have about 1.5TB data (about 2 weeks of logging) and I've created 10G indices (about 120 in total, I expect, it's still a process) and 4 sh… --- ## [How to delete multiple fields with the same name when Reindexing](https://discuss.elastic.co/t/how-to-delete-multiple-fields-with-the-same-name-when-reindexing/290691)
**Author:** [@hNiven](https://discuss.elastic.co/u/hNiven)\ **Replies:** 1\ **Last updated:** [December 2, 2021, 12:02am UTC](https://discuss.elastic.co/t/how-to-delete-multiple-fields-with-the-same-name-when-reindexing/290691 "2021-12-02T00:02:37Z")
Hi, We have reached the maximum fields limit on an index and after doing some research it looks like the best way to get rid of the unneeded fields we need to reindex. Specifically we have many fields called activity.i… --- ## [GET /\_security/api\_key?name=any\_key returns 200 when no key present](https://discuss.elastic.co/t/get-security-api-key-name-any-key-returns-200-when-no-key-present/290682)
**Author:** [@JGreene](https://discuss.elastic.co/u/JGreene)\ **Replies:** 0\ **Last updated:** [December 1, 2021, 2:48pm UTC](https://discuss.elastic.co/t/get-security-api-key-name-any-key-returns-200-when-no-key-present/290682 "2021-12-01T14:48:19Z")
ES Version: 7.15.2 and prior The /\_security/api\_key api returns a 200 response code even when the requested key does not exists. Example: curl -X GET "https://172.19.18.17:9200/\_security/api\_key?name=bobs\_key" -u elas… --- ## [Custom event parsing](https://discuss.elastic.co/t/custom-event-parsing/290568)
**Author:** [@ohliuw](https://discuss.elastic.co/u/ohliuw)\ **Replies:** 7\ **Last updated:** [December 1, 2021, 9:52pm UTC](https://discuss.elastic.co/t/custom-event-parsing/290568 "2021-12-01T21:52:04Z")
I am relatively new to SO. I am trying to understand how to ingest and parse customs logs in ELS. I currently use the NXLog agent to send json formatted data (coming from the SYSMON windows eventlog) from a host to the … --- ## [Kibana watcher rule Elasticsearch query bug](https://discuss.elastic.co/t/kibana-watcher-rule-elasticsearch-query-bug/290664)
**Author:** [@can.ozdemir](https://discuss.elastic.co/u/can.ozdemir)\ **Replies:** 1\ **Last updated:** [December 1, 2021, 9:44pm UTC](https://discuss.elastic.co/t/kibana-watcher-rule-elasticsearch-query-bug/290664 "2021-12-01T21:44:45Z")
Hello there, On our cluster we are indexing logs from machine pairs i.e. machine01 and machine02 is a pair, thus I have created an Elasticsearch query Alert when my query which returns log amount containing hostname mac… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=530) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=532)