# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=674 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 675 --- ## [Question: define default pipeline with different patterns depending on log.file.path](https://discuss.elastic.co/t/question-define-default-pipeline-with-different-patterns-depending-on-log-file-path/268636)
**Author:** [@Christos\_Gitsis](https://discuss.elastic.co/u/Christos_Gitsis)\ **Replies:** 2\ **Last updated:** [March 29, 2021, 3:13pm UTC](https://discuss.elastic.co/t/question-define-default-pipeline-with-different-patterns-depending-on-log-file-path/268636 "2021-03-29T15:13:53Z")
Hi, I would like to have my logs ingested by two different pipelines, depending on the log file which is the source of the document. Everything coming from /var/log/a.log should be processed by a\_pipeline everything f… --- ## [Elastic Search 5.1.1 - How to fetch all documents that contains/ startswith operator on a field in ElasticSearch](https://discuss.elastic.co/t/elastic-search-5-1-1-how-to-fetch-all-documents-that-contains-startswith-operator-on-a-field-in-elasticsearch/266945)
**Author:** [@HS161148](https://discuss.elastic.co/u/HS161148)\ **Replies:** 9\ **Last updated:** [March 29, 2021, 3:06pm UTC](https://discuss.elastic.co/t/elastic-search-5-1-1-how-to-fetch-all-documents-that-contains-startswith-operator-on-a-field-in-elasticsearch/266945 "2021-03-29T15:06:59Z")
How to fetch all documents that contains/ startswith with value on a field in ElasticSearch. --- ## [High performance](https://discuss.elastic.co/t/high-performance/267737)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 13\ **Last updated:** [March 29, 2021, 1:51pm UTC](https://discuss.elastic.co/t/high-performance/267737 "2021-03-29T13:51:54Z")
How can I increace high performance of ES? Is this possible to do high performance cluster? or cluster give me "only" data security / availability? Most important for me is not data stored in ES, but abiliti doing querie… --- ## [Searching for event completion](https://discuss.elastic.co/t/searching-for-event-completion/268658)
**Author:** [@ginu](https://discuss.elastic.co/u/ginu)\ **Replies:** 0\ **Last updated:** [March 29, 2021, 1:15pm UTC](https://discuss.elastic.co/t/searching-for-event-completion/268658 "2021-03-29T13:15:17Z")
Hi I have a application which logs everytime it get a file to process with 2021-03-19 10:59:44.8386| INFO|MY App||Starting 2021-03-19 10:59:44.9177| INFO|AppSetting||Exporting to file Appsetting.txt .... .... .... 202… --- ## [Where we can see our built in user's passwords in elasticsearch in plain text?](https://discuss.elastic.co/t/where-we-can-see-our-built-in-users-passwords-in-elasticsearch-in-plain-text/268653)
**Author:** [@Husnain](https://discuss.elastic.co/u/Husnain)\ **Replies:** 1\ **Last updated:** [March 29, 2021, 12:50pm UTC](https://discuss.elastic.co/t/where-we-can-see-our-built-in-users-passwords-in-elasticsearch-in-plain-text/268653 "2021-03-29T12:50:43Z")
Hii.I want to see my built in user's password in plain text.How can I see this? --- ## [Elastic Search Nest Slow Scroll Speed](https://discuss.elastic.co/t/elastic-search-nest-slow-scroll-speed/268648)
**Author:** [@markanalyzer](https://discuss.elastic.co/u/markanalyzer)\ **Replies:** 4\ **Last updated:** [March 29, 2021, 12:48pm UTC](https://discuss.elastic.co/t/elastic-search-nest-slow-scroll-speed/268648 "2021-03-29T12:48:39Z")
Hi everyone, Firstly i sorry for my bad english. I have one node in my server. My index stats below this : { "\_shards" : { "total" : 4, "successful" : 4, "failed" : 0 }, "\_all" : { "primaries" : … --- ## [Data from indices are shown on other indices](https://discuss.elastic.co/t/data-from-indices-are-shown-on-other-indices/268608)
**Author:** [@snobysmake](https://discuss.elastic.co/u/snobysmake)\ **Replies:** 5\ **Last updated:** [March 29, 2021, 12:17pm UTC](https://discuss.elastic.co/t/data-from-indices-are-shown-on-other-indices/268608 "2021-03-29T12:17:34Z")
I seem to be having a strange problem but quite possibly be a misconfiguration on my side. We are trying to monitor AWS S3 logs which have the following structure s3://bucket/projectA s3://bucket/projectB s3://bucket/p… --- ## [Cannot read field \\"outputs\\" because \\"this.fst\\" is null](https://discuss.elastic.co/t/cannot-read-field-outputs-because-this-fst-is-null/267060)
**Author:** [@yeziblo](https://discuss.elastic.co/u/yeziblo)\ **Replies:** 6\ **Last updated:** [March 29, 2021, 10:08am UTC](https://discuss.elastic.co/t/cannot-read-field-outputs-because-this-fst-is-null/267060 "2021-03-29T10:08:02Z")
Hi everyone. I've got a very strange problem: when I used dsl like: GET index/\_search { "query": { "bool": { "must": \[ { "match\_phrase": { "name": "some words here" } … --- ## [Index Search Percentege (\_sql or \_search)](https://discuss.elastic.co/t/index-search-percentege-sql-or-search/268546)
**Author:** [@Thiago\_Paiva](https://discuss.elastic.co/u/Thiago_Paiva)\ **Replies:** 1\ **Last updated:** [March 29, 2021, 9:52am UTC](https://discuss.elastic.co/t/index-search-percentege-sql-or-search/268546 "2021-03-29T09:52:33Z")
Hi Everyone, I'd like to get the total percentage of \_doc for each Server in a \_search or \_sql API request. In both options I can get total docs for the server and the total of all docs, Now I need a way to do calcula… --- ## [Multiple max aggs for last months](https://discuss.elastic.co/t/multiple-max-aggs-for-last-months/268639)
**Author:** [@pbroek](https://discuss.elastic.co/u/pbroek)\ **Replies:** 0\ **Last updated:** [March 29, 2021, 9:18am UTC](https://discuss.elastic.co/t/multiple-max-aggs-for-last-months/268639 "2021-03-29T09:18:27Z")
Hi, I am struggling with the query to search for 2 max values, mag and depth, over the last day or so. I have read in the topics here but cannot find the solution. Any help is appreciated. This portion works, but if … --- ## [Jdk upgrade for ES v7.x](https://discuss.elastic.co/t/jdk-upgrade-for-es-v7-x/268524)
**Author:** [@sb116](https://discuss.elastic.co/u/sb116)\ **Replies:** 3\ **Last updated:** [March 29, 2021, 6:49am UTC](https://discuss.elastic.co/t/jdk-upgrade-for-es-v7-x/268524 "2021-03-29T06:49:45Z")
is there a way to upgrade embedded jdk from 15.x to 15.0.2/3 for ES v7.x? --- ## [Why the speed of geoDistanceQuery is not increasing？](https://discuss.elastic.co/t/why-the-speed-of-geodistancequery-is-not-increasing/268627)
**Author:** [@Sakura1996](https://discuss.elastic.co/u/Sakura1996)\ **Replies:** 0\ **Last updated:** [March 29, 2021, 5:55am UTC](https://discuss.elastic.co/t/why-the-speed-of-geodistancequery-is-not-increasing/268627 "2021-03-29T05:55:31Z")
Hi ,I tested the geoDistanceQuery performance locally then found that it cost similar time to query 500,000 data or 2,000,000 data even through different amounts of data returned. geo-query filter distance is 100km… --- ## [Research topic related to Elasticsearch](https://discuss.elastic.co/t/research-topic-related-to-elasticsearch/268560)
**Author:** [@Yashasvi\_Raj\_Pant](https://discuss.elastic.co/u/Yashasvi_Raj_Pant)\ **Replies:** 4\ **Last updated:** [March 29, 2021, 5:37am UTC](https://discuss.elastic.co/t/research-topic-related-to-elasticsearch/268560 "2021-03-29T05:37:02Z")
Can anybody suggest to me any research topic related to Elasticsearch for the master thesis? --- ## [Aggregate records type based on a field type - but allow for searching with normal filters](https://discuss.elastic.co/t/aggregate-records-type-based-on-a-field-type-but-allow-for-searching-with-normal-filters/268623)
**Author:** [@M\_Gibbs](https://discuss.elastic.co/u/M_Gibbs)\ **Replies:** 0\ **Last updated:** [March 29, 2021, 4:23am UTC](https://discuss.elastic.co/t/aggregate-records-type-based-on-a-field-type-but-allow-for-searching-with-normal-filters/268623 "2021-03-29T04:23:58Z")
Hey all, I might be overcomplicating this (most likely!). I have a huge data set. Within that data set there are 'organisations' these appear nested within the main record as an array, as there will be multiple of the… --- ## [Wish the search method for elasticsearch is working on rails](https://discuss.elastic.co/t/wish-the-search-method-for-elasticsearch-is-working-on-rails/268620)
**Author:** [@HeppokoNeet](https://discuss.elastic.co/u/HeppokoNeet)\ **Replies:** 0\ **Last updated:** [March 29, 2021, 1:56am UTC](https://discuss.elastic.co/t/wish-the-search-method-for-elasticsearch-is-working-on-rails/268620 "2021-03-29T01:56:46Z")
■The environment ・MacOS ・RailsServer ・Ruby 2.4.1 ・Ruby on Rails 5.1.7 ・MySQL ・Elasticsearch 7.10.2-SNAPSHOT ・kuromoji ・elasticsearch (7.4.0) ・elasticsearch-api (7.4.0) ・elasticsearch-model (7.1.0 80822d6) ・el… --- ## [Deleting Indexes From Kibana Not Freed Any Disk Space On Hosts](https://discuss.elastic.co/t/deleting-indexes-from-kibana-not-freed-any-disk-space-on-hosts/268610)
**Author:** [@sefacanacar](https://discuss.elastic.co/u/sefacanacar)\ **Replies:** 1\ **Last updated:** [March 29, 2021, 12:23am UTC](https://discuss.elastic.co/t/deleting-indexes-from-kibana-not-freed-any-disk-space-on-hosts/268610 "2021-03-29T00:23:24Z")
Hi, i deleted some big indexes from Kibana but no disk space is freed on my elasticsearch hosts. So i found this Elasticsearch index deletion and disk space reclamation here and tried this: curl -XPOST "https://:9200/\_… --- ## [Filebeat and ELK stack question](https://discuss.elastic.co/t/filebeat-and-elk-stack-question/268521)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 1\ **Last updated:** [March 29, 2021, 12:12am UTC](https://discuss.elastic.co/t/filebeat-and-elk-stack-question/268521 "2021-03-29T00:12:01Z")
Hi I have two servers (one that is running suricata and filebeat) the other is running ELK stack. They are on the same network and I want to send the suricata logs via filebeat to the ELK stack (that as basic license an… --- ## [Circuit\_breaking\_exception \[parent\] Data too large](https://discuss.elastic.co/t/circuit-breaking-exception-parent-data-too-large/268528)
**Author:** [@jfs1](https://discuss.elastic.co/u/jfs1)\ **Replies:** 1\ **Last updated:** [March 29, 2021, 12:10am UTC](https://discuss.elastic.co/t/circuit-breaking-exception-parent-data-too-large/268528 "2021-03-29T00:10:57Z")
Got this dreadful circuit\_breaking\_exception The cause is known : I accidentally started creating one index per event. Bad idea ! I stopped the offending logstash instance, so my cluster is not under load anymore. Unfo… --- ## [This behavior is deprecated. Specify JAVA\_HOME](https://discuss.elastic.co/t/this-behavior-is-deprecated-specify-java-home/268544)
**Author:** [@jtvdw](https://discuss.elastic.co/u/jtvdw)\ **Replies:** 1\ **Last updated:** [March 29, 2021, 12:09am UTC](https://discuss.elastic.co/t/this-behavior-is-deprecated-specify-java-home/268544 "2021-03-29T00:09:46Z")
Hi, I ran into a error when I installed the latest version of ActiveCollab, it makes use of ES6 and not ES7, not sure why, I had ES7 installed but ActiveCollab confirmed I need to use ES6 for it to work. Here is the er… --- ## [All-in-one deployement of Wazuh](https://discuss.elastic.co/t/all-in-one-deployement-of-wazuh/268289)
**Author:** [@SafiaSo](https://discuss.elastic.co/u/SafiaSo)\ **Replies:** 2\ **Last updated:** [March 28, 2021, 6:56pm UTC](https://discuss.elastic.co/t/all-in-one-deployement-of-wazuh/268289 "2021-03-28T18:56:13Z")
Hi I'm trying to deploy Wazuh and ELK on a Centos 7 from the Wazuh official documentation. I'm blocking here : Run the Elasticsearch’s "securityadmin" script to load the new certificates information and start the clu… --- ## [Find document position in query](https://discuss.elastic.co/t/find-document-position-in-query/268581)
**Author:** [@vradder](https://discuss.elastic.co/u/vradder)\ **Replies:** 8\ **Last updated:** [March 28, 2021, 5:35pm UTC](https://discuss.elastic.co/t/find-document-position-in-query/268581 "2021-03-28T17:35:15Z")
Hi, I am using ES for log viewer.. logs are displayed in timestamp ascending order with some boolQuery filters.. initially 10,000 records are displayed in first page there could be around 10 pages of query results.. and … --- ## [Store secrets in keystore using ansible](https://discuss.elastic.co/t/store-secrets-in-keystore-using-ansible/268595)
**Author:** [@cruggiero](https://discuss.elastic.co/u/cruggiero)\ **Replies:** 0\ **Last updated:** [March 28, 2021, 3:33pm UTC](https://discuss.elastic.co/t/store-secrets-in-keystore-using-ansible/268595 "2021-03-28T15:33:50Z")
Hello, I would like to store AWS credentials in the keystore. To deploy elasticsearch I used the official ansible playbook. Following the documentation I prepared this test node configuration: - hosts: 192.168.17… --- ## [Filtering by multiple rows](https://discuss.elastic.co/t/filtering-by-multiple-rows/268594)
**Author:** [@kevinevans](https://discuss.elastic.co/u/kevinevans)\ **Replies:** 0\ **Last updated:** [March 28, 2021, 3:31pm UTC](https://discuss.elastic.co/t/filtering-by-multiple-rows/268594 "2021-03-28T15:31:11Z")
I'm pretty new to ES, so this might be an obvious question. I have an index that contains rows of (field\_id, value, company\_id) where field\_id describes what kind of data value represents. I'd like to create a filtering… --- ## [Pipelines get event.duration from event.start and event.end](https://discuss.elastic.co/t/pipelines-get-event-duration-from-event-start-and-event-end/268561)
**Author:** [@Oliver2](https://discuss.elastic.co/u/Oliver2)\ **Replies:** 3\ **Last updated:** [March 28, 2021, 2:23pm UTC](https://discuss.elastic.co/t/pipelines-get-event-duration-from-event-start-and-event-end/268561 "2021-03-28T14:23:10Z")
what can i do in an elastic search pipeline to workout the event.duration from event.start and event.end --- ## [Find time difference between documents in search hits](https://discuss.elastic.co/t/find-time-difference-between-documents-in-search-hits/268580)
**Author:** [@vradder](https://discuss.elastic.co/u/vradder)\ **Replies:** 0\ **Last updated:** [March 28, 2021, 10:16am UTC](https://discuss.elastic.co/t/find-time-difference-between-documents-in-search-hits/268580 "2021-03-28T10:16:22Z")
Hi, I am using ES for log viewer application, how can i add new script filed(hasTimeDifference) in search hits if the time difference between current and previous log is more than specified seconds(for ex: 10 seconds).. … --- ## [How to include custom key/value in webhook?](https://discuss.elastic.co/t/how-to-include-custom-key-value-in-webhook/268570)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 1\ **Last updated:** [March 28, 2021, 12:09am UTC](https://discuss.elastic.co/t/how-to-include-custom-key-value-in-webhook/268570 "2021-03-28T00:09:47Z")
Dear all =) Does anyone know how to include a custom key/value in a webhook? E.g. "ExampleKey": "ExampleValue" My current webhook json encodes the payload, so the custom key/value would have to be part of the json bl… --- ## [Delete field mapping is impossible, but what is the technical restriction to add this feature?](https://discuss.elastic.co/t/delete-field-mapping-is-impossible-but-what-is-the-technical-restriction-to-add-this-feature/268572)
**Author:** [@timotta](https://discuss.elastic.co/u/timotta)\ **Replies:** 1\ **Last updated:** [March 27, 2021, 11:47pm UTC](https://discuss.elastic.co/t/delete-field-mapping-is-impossible-but-what-is-the-technical-restriction-to-add-this-feature/268572 "2021-03-27T23:47:47Z")
I have no knowledge yet in Elastic Search source code, so I don't know if i'm too much naive thinking that if we had a feature to delete a field mapping, the only think to do would be to delete the inverted index for thi… --- ## [New Settings for Cluster Replication on Multiple VMs](https://discuss.elastic.co/t/new-settings-for-cluster-replication-on-multiple-vms/268335)
**Author:** [@Automation\_Scripts](https://discuss.elastic.co/u/Automation_Scripts)\ **Replies:** 1\ **Last updated:** [March 25, 2021, 1:01pm UTC](https://discuss.elastic.co/t/new-settings-for-cluster-replication-on-multiple-vms/268335 "2021-03-25T13:01:00Z")
Guys, Can you please provide an updated post with regards on how can I set 3 ES VMs that can communicate with one another? I found on the web or here some old settings that do not work. With the new files some settings… --- ## [Shard Size is 50gb](https://discuss.elastic.co/t/shard-size-is-50gb/268441)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 3\ **Last updated:** [March 27, 2021, 5:58am UTC](https://discuss.elastic.co/t/shard-size-is-50gb/268441 "2021-03-27T05:58:38Z")
I have an index called log-wlb-sysmon-2021.03.20-00002 and i am using ILM Policy for this index { "winlogbeat\_sysmon\_policy" : { "version" : 8, "modified\_date" : "2021-03-26T05:06:42.599Z", "policy" : { … --- ## [Es docker 10.2 version is upgraded to 12.0, log "SearchPhaseExecutionException: all shards failed"](https://discuss.elastic.co/t/es-docker-10-2-version-is-upgraded-to-12-0-log-searchphaseexecutionexception-all-shards-failed/268547)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 2\ **Last updated:** [March 27, 2021, 5:37am UTC](https://discuss.elastic.co/t/es-docker-10-2-version-is-upgraded-to-12-0-log-searchphaseexecutionexception-all-shards-failed/268547 "2021-03-27T05:37:37Z")
{"type": "server", "timestamp": "2021-03-27T00:33:09,519Z", "level": "WARN", "component": "r.suppressed", "cluster.name": "es-single-node", "node.name": "es-docker", "message": "path: /elastalert\_status\_test/\_search, pa… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=673) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=675)