# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=550 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 551 --- ## [Get log not in right time](https://discuss.elastic.co/t/get-log-not-in-right-time/287916)
**Author:** [@quyennguyen](https://discuss.elastic.co/u/quyennguyen)\ **Replies:** 1\ **Last updated:** [October 29, 2021, 12:32am UTC](https://discuss.elastic.co/t/get-log-not-in-right-time/287916 "2021-10-29T00:32:38Z")
I got log of Apache (access.log). But I never get it at the right time. Example like this pic. The time in the Elastic with the time in Apache server I set up the same timezone. And Apache has log at that time too. W… --- ## [Startup script?](https://discuss.elastic.co/t/startup-script/287923)
**Author:** [@tamis-laan](https://discuss.elastic.co/u/tamis-laan)\ **Replies:** 1\ **Last updated:** [October 29, 2021, 12:32am UTC](https://discuss.elastic.co/t/startup-script/287923 "2021-10-29T00:32:18Z")
Is there some way to create startup scripts? I'm using monstache to connect mongodb and Elasticsearch and I need to add an index template before monstache starts syncing data. --- ## [Sudden High CPU with GC](https://discuss.elastic.co/t/sudden-high-cpu-with-gc/287908)
**Author:** [@nuwancs](https://discuss.elastic.co/u/nuwancs)\ **Replies:** 3\ **Last updated:** [October 29, 2021, 12:31am UTC](https://discuss.elastic.co/t/sudden-high-cpu-with-gc/287908 "2021-10-29T00:31:42Z")
Hi Team Please refer to the screenshot and we observe high CPU spikes with the GC. Please help us resolve this. ELS v 7.5.2 RAM: Total 32 GB, 16GB allocated to ES It's a 7 node cluster --- ## [Killing pending tasks](https://discuss.elastic.co/t/killing-pending-tasks/287795)
**Author:** [@lucien.guillermin](https://discuss.elastic.co/u/lucien.guillermin)\ **Replies:** 3\ **Last updated:** [October 29, 2021, 12:29am UTC](https://discuss.elastic.co/t/killing-pending-tasks/287795 "2021-10-29T00:29:33Z")
Hi everyone, We work on an Elasticsearch cluster which seems locked. We found out that we have critical tasks we launched a few days ago : curl -X GET 10.129.28.194:9200/\_cluster/pending\_tasks?pretty { "tasks" : \[ … --- ## [Additing Conditions to API Results](https://discuss.elastic.co/t/additing-conditions-to-api-results/287594)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 3\ **Last updated:** [October 29, 2021, 12:28am UTC](https://discuss.elastic.co/t/additing-conditions-to-api-results/287594 "2021-10-29T00:28:15Z")
I was wondering if there is any way to filter API results in Dev Tools to show conditions. For example, instead of this: GET \_cat/shards?v=true&h=index,shard,prirep,state,docs,store,node,segments.count,unassigned.detail… --- ## [Api\_key does not work behind reverse ssl proxy](https://discuss.elastic.co/t/api-key-does-not-work-behind-reverse-ssl-proxy/287945)
**Author:** [@gkiesecker](https://discuss.elastic.co/u/gkiesecker)\ **Replies:** 3\ **Last updated:** [October 29, 2021, 12:08am UTC](https://discuss.elastic.co/t/api-key-does-not-work-behind-reverse-ssl-proxy/287945 "2021-10-29T00:08:08Z")
This is my first time using ELK stack, and I have found it very useful. I wanted to deploy it behind a reverse ssl proxy using nginx, and have most of the features working fine. However, I am unable to get the xpack.sec… --- ## [Update the value of a field in index based on its value in another index](https://discuss.elastic.co/t/update-the-value-of-a-field-in-index-based-on-its-value-in-another-index/287952)
**Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Replies:** 2\ **Last updated:** [October 28, 2021, 9:38pm UTC](https://discuss.elastic.co/t/update-the-value-of-a-field-in-index-based-on-its-value-in-another-index/287952 "2021-10-28T21:38:57Z")
There's an index\_A that contains say about 10K docs. It has many fields like field\_1, field\_2, ...field\_n and one of the fields is product\_name. Then there's another index\_B that contains about 10 docs only and is a mas… --- ## [Watcher Timezone problem in email body](https://discuss.elastic.co/t/watcher-timezone-problem-in-email-body/285957)
**Author:** [@Tombal](https://discuss.elastic.co/u/Tombal)\ **Replies:** 2\ **Last updated:** [October 28, 2021, 7:39pm UTC](https://discuss.elastic.co/t/watcher-timezone-problem-in-email-body/285957 "2021-10-28T19:39:57Z")
Hello , Not a pro of painless language but while my ml job is working fine. It seems like timezone is GMT not GMT+3 in my mail body. "subject": "Apigw ML Time Alerts...", "body": { "html": "\\n \\n \\n Elasti… --- ## [Javascript and index templates](https://discuss.elastic.co/t/javascript-and-index-templates/287940)
**Author:** [@tamis-laan](https://discuss.elastic.co/u/tamis-laan)\ **Replies:** 1\ **Last updated:** [October 28, 2021, 4:28pm UTC](https://discuss.elastic.co/t/javascript-and-index-templates/287940 "2021-10-28T16:28:27Z")
I'm trying to create an index template as followed: client.indices.putTemplate({name:"loctmplt", body: { index\_patterns: \['\*'\], template: { mappings: { properties: { location: { propertie… --- ## [Struggling to understand OneOfNPrior::addSamples formulae](https://discuss.elastic.co/t/struggling-to-understand-oneofnprior-addsamples-formulae/286929)
**Author:** [@ProfSimoes](https://discuss.elastic.co/u/ProfSimoes)\ **Replies:** 3\ **Last updated:** [October 28, 2021, 2:41pm UTC](https://discuss.elastic.co/t/struggling-to-understand-oneofnprior-addsamples-formulae/286929 "2021-10-28T14:41:29Z")
Hi guys! I've been trying to understand the way One of N Prior (COneOfNPrior::addSamples) deals with model selection. The code documentation does a neat work explaining all the formulae: This means that the joint pos… --- ## [Using where filter with multi values field on data table](https://discuss.elastic.co/t/using-where-filter-with-multi-values-field-on-data-table/285498)
**Author:** [@ishu](https://discuss.elastic.co/u/ishu)\ **Replies:** 3\ **Last updated:** [October 28, 2021, 2:32pm UTC](https://discuss.elastic.co/t/using-where-filter-with-multi-values-field-on-data-table/285498 "2021-10-28T14:32:29Z")
Hello, I used to work on Splunk and working with multi values field, and it's easy break multivalue fields using "stats x by xx" command and perform a where filter after. We considered this log with multi values field … --- ## [Best solution for this case](https://discuss.elastic.co/t/best-solution-for-this-case/287900)
**Author:** [@auto\_reply\_007](https://discuss.elastic.co/u/auto_reply_007)\ **Replies:** 1\ **Last updated:** [October 28, 2021, 2:31pm UTC](https://discuss.elastic.co/t/best-solution-for-this-case/287900 "2021-10-28T14:31:12Z")
I have a cluster consisting of 4 data and 1 master node each node has: cpu: 4 ram: 16 and we have 1 largest index of 215 gigabytes (1 primary and 1 replica shard) on peak days, this index is very heavily loaded (we … --- ## [Not all logs are being sent on ES, requests are timing out](https://discuss.elastic.co/t/not-all-logs-are-being-sent-on-es-requests-are-timing-out/287924)
**Author:** [@anis-eze](https://discuss.elastic.co/u/anis-eze)\ **Replies:** 0\ **Last updated:** [October 28, 2021, 1:51pm UTC](https://discuss.elastic.co/t/not-all-logs-are-being-sent-on-es-requests-are-timing-out/287924 "2021-10-28T13:51:30Z")
Hi All, We have been having issues with there being gaps in Metricbeats being sent to Kibana. When checking the Metricbeat logs, the following errors are displayed: \[2021-10-28T11:42:53,422\]\[INFO \]\[o.e.x.s.a.Authoriza… --- ## [TIMESTAMP behavior is not good](https://discuss.elastic.co/t/timestamp-behavior-is-not-good/287920)
**Author:** [@dasish](https://discuss.elastic.co/u/dasish)\ **Replies:** 0\ **Last updated:** [October 28, 2021, 1:23pm UTC](https://discuss.elastic.co/t/timestamp-behavior-is-not-good/287920 "2021-10-28T13:23:47Z")
logstash is shipping the data for the below query as expected cast(systimestamp at time zone 'UTC' as timestamp ) however cast( CREATION\_TIMESTAMP at time zone 'UTC' as timestamp) is providing additional 2 hour (if yo… --- ## [Performance upgrade in server logs, but degrade in full text search](https://discuss.elastic.co/t/performance-upgrade-in-server-logs-but-degrade-in-full-text-search/287257)
**Author:** [@vsop\_479](https://discuss.elastic.co/u/vsop_479)\ **Replies:** 1\ **Last updated:** [October 28, 2021, 12:45pm UTC](https://discuss.elastic.co/t/performance-upgrade-in-server-logs-but-degrade-in-full-text-search/287257 "2021-10-28T12:45:45Z")
According to Elasticsearch benchmarks, ES 7.15.0 became slower than ES 6.8.14 in term, pharse, mothly\_agg queris in pmc track, but faster in most of queries (except hourly\_agg) in http logs track. So, which changes of E… --- ## [How do I get rid of the message "Unexpected character ('\]' (code 93)): expected a value"](https://discuss.elastic.co/t/how-do-i-get-rid-of-the-message-unexpected-character-code-93-expected-a-value/287911)
**Author:** [@fribse](https://discuss.elastic.co/u/fribse)\ **Replies:** 0\ **Last updated:** [October 28, 2021, 12:33pm UTC](https://discuss.elastic.co/t/how-do-i-get-rid-of-the-message-unexpected-character-code-93-expected-a-value/287911 "2021-10-28T12:33:06Z")
I can see the error reappearing all the time. Is there a way I can fix this without loosing the indexes? elasticsearch | \[2021-10-28T12:18:59,524\]\[WARN \]\[r.suppressed \] \[es01\] path: /winlog\*/\_search, pa… --- ## [API call to elasticsearch](https://discuss.elastic.co/t/api-call-to-elasticsearch/286980)
**Author:** [@AlexM566](https://discuss.elastic.co/u/AlexM566)\ **Replies:** 4\ **Last updated:** [October 28, 2021, 12:07pm UTC](https://discuss.elastic.co/t/api-call-to-elasticsearch/286980 "2021-10-28T12:07:40Z")
Hello everyone, I am thinking to something and I am not sure if it is possible and i was thinking you can guide or say if it is possible or not So I want to query directly the Elasticsearch, get the output in csv or w… --- ## [\_data\_stream\_timestamp conflicts?](https://discuss.elastic.co/t/data-stream-timestamp-conflicts/287814)
**Author:** [@TimWardFS](https://discuss.elastic.co/u/TimWardFS)\ **Replies:** 1\ **Last updated:** [October 28, 2021, 10:58am UTC](https://discuss.elastic.co/t/data-stream-timestamp-conflicts/287814 "2021-10-28T10:58:56Z")
Does anyone know what this means please? I get this on every attempt Logstash makes to index an event. "status"=\>400, "error"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"Mapper for \[\_data\_stream\_timestamp\] confli… --- ## [Search with multiple filters involved all the time](https://discuss.elastic.co/t/search-with-multiple-filters-involved-all-the-time/287702)
**Author:** [@itokai](https://discuss.elastic.co/u/itokai)\ **Replies:** 3\ **Last updated:** [October 28, 2021, 10:27am UTC](https://discuss.elastic.co/t/search-with-multiple-filters-involved-all-the-time/287702 "2021-10-28T10:27:11Z")
Hello, Specific use-case is to optimize querying that includes many (approximately 50) constant search filters. These filters might change 1-2x per year. How to involve those filters optimally, is it just by appending… --- ## [Multiple standalone nodes](https://discuss.elastic.co/t/multiple-standalone-nodes/287837)
**Author:** [@keepcalm](https://discuss.elastic.co/u/keepcalm)\ **Replies:** 4\ **Last updated:** [October 28, 2021, 9:27am UTC](https://discuss.elastic.co/t/multiple-standalone-nodes/287837 "2021-10-28T09:27:48Z")
hi, on version 6.6.1 we already have a single server deployed and i want to bring a new server online as a completely separate instance. How can i do this without the new server trying to form a cluster with the original… --- ## [Is update by query async operation or sync operation?](https://discuss.elastic.co/t/is-update-by-query-async-operation-or-sync-operation/287890)
**Author:** [@Giovanni\_Di\_Lembo](https://discuss.elastic.co/u/Giovanni_Di_Lembo)\ **Replies:** 1\ **Last updated:** [October 28, 2021, 8:36am UTC](https://discuss.elastic.co/t/is-update-by-query-async-operation-or-sync-operation/287890 "2021-10-28T08:36:34Z")
And if so , how to know when update is done ? --- ## [How to configure basic security on elastic stack?](https://discuss.elastic.co/t/how-to-configure-basic-security-on-elastic-stack/286479)
**Author:** [@Mamol27](https://discuss.elastic.co/u/Mamol27)\ **Replies:** 8\ **Last updated:** [October 28, 2021, 8:03am UTC](https://discuss.elastic.co/t/how-to-configure-basic-security-on-elastic-stack/286479 "2021-10-28T08:03:03Z")
I have elastic stack. I need to configure basic security. When I add xpack.security.enabled: true in elasticsearch.yml it fails to start with message bootstrap check failure \[1\] of \[1\]: Transport SSL must be enabled i… --- ## [Delete index automatically after particular days](https://discuss.elastic.co/t/delete-index-automatically-after-particular-days/287875)
**Author:** [@Divya\_Bansal](https://discuss.elastic.co/u/Divya_Bansal)\ **Replies:** 6\ **Last updated:** [October 28, 2021, 6:47am UTC](https://discuss.elastic.co/t/delete-index-automatically-after-particular-days/287875 "2021-10-28T06:47:39Z")
Hi, I am using Logstash to ingest log data to Elasticsearch, Indices are created daily, that every day's index has a unique name like index\_name-YYYY-MM-DD . So, after 30 days, there will be 30 indices. On day 31st, I w… --- ## [Does regex work on timestamp?](https://discuss.elastic.co/t/does-regex-work-on-timestamp/287794)
**Author:** [@MasonNorris](https://discuss.elastic.co/u/MasonNorris)\ **Replies:** 1\ **Last updated:** [October 28, 2021, 6:36am UTC](https://discuss.elastic.co/t/does-regex-work-on-timestamp/287794 "2021-10-28T06:36:11Z")
I have created a regex to search for certain time periods in the data(ie search for all data out side of working hours). This regex should only return values from 00:00:00-07:59:59 or 16:00:00-23:59:59. It doesn't return… --- ## [Unique query id for slow log](https://discuss.elastic.co/t/unique-query-id-for-slow-log/287883)
**Author:** [@shawndu](https://discuss.elastic.co/u/shawndu)\ **Replies:** 0\ **Last updated:** [October 28, 2021, 6:36am UTC](https://discuss.elastic.co/t/unique-query-id-for-slow-log/287883 "2021-10-28T06:36:01Z")
As I know, query log is per shard. If a index has 5 shards and slow query log is enabled. when issue a query, There will be 5 query logs. I am collecting these logs for analysis. I want to aggregate these 5 logs into a … --- ## [Curl\_rc 7 error when using nfs trident](https://discuss.elastic.co/t/curl-rc-7-error-when-using-nfs-trident/287882)
**Author:** [@zahar](https://discuss.elastic.co/u/zahar)\ **Replies:** 0\ **Last updated:** [October 28, 2021, 6:34am UTC](https://discuss.elastic.co/t/curl-rc-7-error-when-using-nfs-trident/287882 "2021-10-28T06:34:41Z")
hello, i installed Elasticsearch 7.15.0 on openshift 4.6, our openshift is running on vmware vms. we have 2 storage classes: the vmware datastore that provides storage for pods with iscsi. the trident that connects to… --- ## [How to distinguish ”true“ from true（they are all Booleans）](https://discuss.elastic.co/t/how-to-distinguish-true-from-true-they-are-all-booleans/287676)
**Author:** [@casterQ](https://discuss.elastic.co/u/casterQ)\ **Replies:** 5\ **Last updated:** [October 28, 2021, 5:16am UTC](https://discuss.elastic.co/t/how-to-distinguish-true-from-true-they-are-all-booleans/287676 "2021-10-28T05:16:33Z")
v: 7.10.2 There are some docs in index such as {"tag":"true"} {"tag":true}，the tag is boolean type ...... i want to find out docs with tag==”true“，i tried script query use instanceof but it didn't work --- ## [Elasticsearch reduce latency with allow\_partial\_search\_results](https://discuss.elastic.co/t/elasticsearch-reduce-latency-with-allow-partial-search-results/287865)
**Author:** [@niketpatel2525](https://discuss.elastic.co/u/niketpatel2525)\ **Replies:** 0\ **Last updated:** [October 28, 2021, 2:33am UTC](https://discuss.elastic.co/t/elasticsearch-reduce-latency-with-allow-partial-search-results/287865 "2021-10-28T02:33:37Z")
I have an index with 60 shards. I am trying to get total counts which match my Elasticsearch query. I am using the "allow\_partial\_search\_results" query param to get total results. Without this query param, some of the s… --- ## [Looking for ElasticSearch Cluster Server Specifications Documentation](https://discuss.elastic.co/t/looking-for-elasticsearch-cluster-server-specifications-documentation/287857)
**Author:** [@TonyLuc](https://discuss.elastic.co/u/TonyLuc)\ **Replies:** 0\ **Last updated:** [October 27, 2021, 9:34pm UTC](https://discuss.elastic.co/t/looking-for-elasticsearch-cluster-server-specifications-documentation/287857 "2021-10-27T21:34:04Z")
Looking for Elasticsearch Cluster Server Specifications Documentation Could someone point me to any documentations or whitepapers on the topics of the Elasticsearch Cluster Servers Specifications? I could not find what … --- ## [What are the ways to make a field of an index , not indexed but stored?](https://discuss.elastic.co/t/what-are-the-ways-to-make-a-field-of-an-index-not-indexed-but-stored/287808)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 1\ **Last updated:** [October 27, 2021, 9:26pm UTC](https://discuss.elastic.co/t/what-are-the-ways-to-make-a-field-of-an-index-not-indexed-but-stored/287808 "2021-10-27T21:26:02Z")
what are the ways to make a field of an index , not indexed but stored?. \*Is it by not defining the filed and type explicitly and then defining dynamic : runtime ? \*Are there any other methods? Is it possible to to … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=549) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=551)