# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=887 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 888 --- ## [JSON Processor to parse logs data into doc objects](https://discuss.elastic.co/t/json-processor-to-parse-logs-data-into-doc-objects/234949)
**Author:** [@Jalpesh1](https://discuss.elastic.co/u/Jalpesh1)\ **Replies:** 2\ **Last updated:** [June 18, 2020, 9:08am UTC](https://discuss.elastic.co/t/json-processor-to-parse-logs-data-into-doc-objects/234949 "2020-06-18T09:08:12Z")
Hi Team, We have below doc data in JSON format { "\_index": "jaeger-span-2020-05-29", "\_type": "\_doc", "\_id": "QDuvYHIBiNzxbOQnW-IN", "\_version": 1, "\_score": 0, "\_source": { "traceID": "1a9a6917049eff71", "span… --- ## [Es7.5.1 \_refresh taking 10+ seconds](https://discuss.elastic.co/t/es7-5-1-refresh-taking-10-seconds/237594)
**Author:** [@\_es1](https://discuss.elastic.co/u/_es1)\ **Replies:** 0\ **Last updated:** [June 18, 2020, 8:32am UTC](https://discuss.elastic.co/t/es7-5-1-refresh-taking-10-seconds/237594 "2020-06-18T08:32:53Z")
Hi, when I indexing a doc with refresh=true, it always take more than 10 seconds to response from my EsCluster (5 nodes each 8c32g) with all default settings. and if set refresh=false, it would take more than 40 seconds… --- ## [Kibana: Indices have lifecycle errors](https://discuss.elastic.co/t/kibana-indices-have-lifecycle-errors/237592)
**Author:** [@AJCandfield](https://discuss.elastic.co/u/AJCandfield)\ **Replies:** 0\ **Last updated:** [June 18, 2020, 8:21am UTC](https://discuss.elastic.co/t/kibana-indices-have-lifecycle-errors/237592 "2020-06-18T08:21:02Z")
Hi all, A few months after we deployed the ELK stack, we are not able to see logs on Kibana from some indexes (like filebeat, metricbeat, etc...) and we're not sure why. We can see we have a 5GB filebeat index but we ju… --- ## [Date-Type-Error on keyword field...what?](https://discuss.elastic.co/t/date-type-error-on-keyword-field-what/237588)
**Author:** [@creaticious](https://discuss.elastic.co/u/creaticious)\ **Replies:** 0\ **Last updated:** [June 18, 2020, 8:12am UTC](https://discuss.elastic.co/t/date-type-error-on-keyword-field-what/237588 "2020-06-18T08:12:47Z")
Hey guys, strange problem...i have a keyword field for different casual writing styles for the same date...so like "16.06.2020, 16.6.2020, 16.6., 16.06.20...". On the first indexing-loop everything works fine...on the n… --- ## [ES Cluster for Zipkin](https://discuss.elastic.co/t/es-cluster-for-zipkin/237568)
**Author:** [@ishan\_ji\_Gupta](https://discuss.elastic.co/u/ishan_ji_Gupta)\ **Replies:** 3\ **Last updated:** [June 18, 2020, 7:43am UTC](https://discuss.elastic.co/t/es-cluster-for-zipkin/237568 "2020-06-18T07:43:08Z")
ElasticSearch recommendation for Zipkin (hardware and cluster). --- ## [Is it possible to merge results of a search for two indexes based on a unique identifier in common? Like a join](https://discuss.elastic.co/t/is-it-possible-to-merge-results-of-a-search-for-two-indexes-based-on-a-unique-identifier-in-common-like-a-join/237547)
**Author:** [@Brendow\_Adriel](https://discuss.elastic.co/u/Brendow_Adriel)\ **Replies:** 4\ **Last updated:** [June 18, 2020, 7:25am UTC](https://discuss.elastic.co/t/is-it-possible-to-merge-results-of-a-search-for-two-indexes-based-on-a-unique-identifier-in-common-like-a-join/237547 "2020-06-18T07:25:17Z")
Elasticsearch 7.7 using Java API REST from what I understand, the merge generates a new index. I just want to merge the final result of 2 indexes based on an identifier. As a join query of a relational database. i'ts po… --- ## [Strategies for managing configuration, plugins](https://discuss.elastic.co/t/strategies-for-managing-configuration-plugins/236999)
**Author:** [@jwcw](https://discuss.elastic.co/u/jwcw)\ **Replies:** 1\ **Last updated:** [June 18, 2020, 7:00am UTC](https://discuss.elastic.co/t/strategies-for-managing-configuration-plugins/236999 "2020-06-18T07:00:58Z")
Hi, I'm wondering if there are any recommended strategies for managing the configuration files and plugins across nodes in an elastic cluster. For example, when modifying configurations in elasticsearch.yml, it's common… --- ## [Subset in an array](https://discuss.elastic.co/t/subset-in-an-array/237459)
**Author:** [@surendra\_gandham](https://discuss.elastic.co/u/surendra_gandham)\ **Replies:** 2\ **Last updated:** [June 18, 2020, 6:54am UTC](https://discuss.elastic.co/t/subset-in-an-array/237459 "2020-06-18T06:54:40Z")
Hi everyone, Thanks for reading. Here's my problem. I have an array with numbers on each document as such: Document 1: \[1, 2, 3\] Document 2: \[1, 4\] Document 3: \[6,12,2\] I want to query my documents and find those d… --- ## [How can I get all the fields and rows of the most recent write from Elastic with essql?](https://discuss.elastic.co/t/how-can-i-get-all-the-fields-and-rows-of-the-most-recent-write-from-elastic-with-essql/237563)
**Author:** [@jaffarkazi](https://discuss.elastic.co/u/jaffarkazi)\ **Replies:** 2\ **Last updated:** [June 18, 2020, 6:32am UTC](https://discuss.elastic.co/t/how-can-i-get-all-the-fields-and-rows-of-the-most-recent-write-from-elastic-with-essql/237563 "2020-06-18T06:32:50Z")
I have employee records, (say name, dob, address) and a timewritten field, which is time converted to seconds. This data is written to my index every 5 seconds. Suppose there are 5 records. Run 1 will write employee re… --- ## [ELK integration with Active Directory](https://discuss.elastic.co/t/elk-integration-with-active-directory/237562)
**Author:** [@Ohonaf](https://discuss.elastic.co/u/Ohonaf)\ **Replies:** 2\ **Last updated:** [June 18, 2020, 5:38am UTC](https://discuss.elastic.co/t/elk-integration-with-active-directory/237562 "2020-06-18T05:38:37Z")
Dear All, I have an ELK platform and all my users are locally managed. I have licenced version. I need to integrate my ELK with AD so that i can manage my user taking authentication from Active Directory. Can anyone h… --- ## [Elastic Cloud - team support?](https://discuss.elastic.co/t/elastic-cloud-team-support/237428)
**Author:** [@rokcarl](https://discuss.elastic.co/u/rokcarl)\ **Replies:** 2\ **Last updated:** [June 18, 2020, 5:28am UTC](https://discuss.elastic.co/t/elastic-cloud-team-support/237428 "2020-06-18T05:28:38Z")
We'd like to use the Elastic Cloud as a team. Is there support for teams? What I'd like to have: Multiple users with different account credentials can log into the same cloud "dashboard" (https://cloud.elastic.co/home)… --- ## [java.lang.IllegalStateException: The following nodes are not ready yet for enabling x-pack custom metadata:](https://discuss.elastic.co/t/java-lang-illegalstateexception-the-following-nodes-are-not-ready-yet-for-enabling-x-pack-custom-metadata/237555)
**Author:** [@Ankur\_Agarwal1](https://discuss.elastic.co/u/Ankur_Agarwal1)\ **Replies:** 1\ **Last updated:** [June 18, 2020, 5:08am UTC](https://discuss.elastic.co/t/java-lang-illegalstateexception-the-following-nodes-are-not-ready-yet-for-enabling-x-pack-custom-metadata/237555 "2020-06-18T05:08:48Z")
java.lang.IllegalStateException: The following nodes are not ready yet for enabling x-pack custom metadata: --- ## [Elastic SQL query to get data of today ONLY](https://discuss.elastic.co/t/elastic-sql-query-to-get-data-of-today-only/235867)
**Author:** [@jaffarkazi](https://discuss.elastic.co/u/jaffarkazi)\ **Replies:** 8\ **Last updated:** [June 18, 2020, 5:03am UTC](https://discuss.elastic.co/t/elastic-sql-query-to-get-data-of-today-only/235867 "2020-06-18T05:03:03Z")
Through an Elastic SQL query, how can I retrieve data belonging to today only? I've tried: select "@timestamp", today(), now(), TimeOfLastReceivedUpdate FROM "index\*" where Name = 'value' and ("@timestamp" \>= today() A… --- ## [401 Unauthorized : unable to authenticate user when local metricbeats tries to connect to dockerized ELK](https://discuss.elastic.co/t/401-unauthorized-unable-to-authenticate-user-when-local-metricbeats-tries-to-connect-to-dockerized-elk/237551)
**Author:** [@drjosephliu](https://discuss.elastic.co/u/drjosephliu)\ **Replies:** 0\ **Last updated:** [June 18, 2020, 2:46am UTC](https://discuss.elastic.co/t/401-unauthorized-unable-to-authenticate-user-when-local-metricbeats-tries-to-connect-to-dockerized-elk/237551 "2020-06-18T02:46:29Z")
Hi, I'm very new to ELK and could really do with some help. I've installed dockerized ELK on my computer and started it up with default configuration using docker-compose up -d. The default config uses username elastic … --- ## [Index template - index pattern does not match index name](https://discuss.elastic.co/t/index-template-index-pattern-does-not-match-index-name/237445)
**Author:** [@dorinand](https://discuss.elastic.co/u/dorinand)\ **Replies:** 0\ **Last updated:** [June 17, 2020, 10:02am UTC](https://discuss.elastic.co/t/index-template-index-pattern-does-not-match-index-name/237445 "2020-06-17T10:02:00Z")
I am playing with roolover of indices via ILM. I created index template for all printmessage\_charizard\_1 indices: { "order": 0, "index\_patterns": \[ "printmessage\_charizard\_1-\*" \], "se… --- ## [ElasticSearch.net AND NEST - Indexing without storing file content](https://discuss.elastic.co/t/elasticsearch-net-and-nest-indexing-without-storing-file-content/237526)
**Author:** [@kvickery](https://discuss.elastic.co/u/kvickery)\ **Replies:** 2\ **Last updated:** [June 17, 2020, 11:20pm UTC](https://discuss.elastic.co/t/elasticsearch-net-and-nest-indexing-without-storing-file-content/237526 "2020-06-17T23:20:49Z")
I am using the NEST API with Elasticsearch.NET, and Visual Basic. With the latest version of Elasticsearch how can I create an index so that the when a file is indexed the entire file content is not stored on the server… --- ## [How can I add internal subnets to elasticsearch geoip address](https://discuss.elastic.co/t/how-can-i-add-internal-subnets-to-elasticsearch-geoip-address/237487)
**Author:** [@genehunter29009](https://discuss.elastic.co/u/genehunter29009)\ **Replies:** 1\ **Last updated:** [June 17, 2020, 10:37pm UTC](https://discuss.elastic.co/t/how-can-i-add-internal-subnets-to-elasticsearch-geoip-address/237487 "2020-06-17T22:37:39Z")
at one time I had found a link that showed how to post a new ip range to the geoip database in elasticsearch so that I could show the office internal users were logged in from. I cant seem to find that link today. Does a… --- ## [How vector based text similarity works under the hood?](https://discuss.elastic.co/t/how-vector-based-text-similarity-works-under-the-hood/237498)
**Author:** [@yash\_budukh](https://discuss.elastic.co/u/yash_budukh)\ **Replies:** 3\ **Last updated:** [June 17, 2020, 7:35pm UTC](https://discuss.elastic.co/t/how-vector-based-text-similarity-works-under-the-hood/237498 "2020-06-17T19:35:32Z")
This blog says that we’ve provided a match\_all query, which means the script will be run over all documents in the index. This is a current limitation of vector similarity in Elasticsearch — vectors can be used for scor… --- ## [Client-options "verify\_certs:false" seems to be ignored](https://discuss.elastic.co/t/client-options-verify-certs-false-seems-to-be-ignored/237529)
**Author:** [@micas](https://discuss.elastic.co/u/micas)\ **Replies:** 0\ **Last updated:** [June 17, 2020, 7:34pm UTC](https://discuss.elastic.co/t/client-options-verify-certs-false-seems-to-be-ignored/237529 "2020-06-17T19:34:57Z")
I seem to be getting this same problem as the issue https://github.com/elastic/rally/issues/472 with esrally 1.4.1 and 2.0.0 esrally --pipeline benchmark-only --track=nyc\_taxis --challenge append-no-conflicts-index-only… --- ## [Logstash to Elastic Cloud error 400](https://discuss.elastic.co/t/logstash-to-elastic-cloud-error-400/237524)
**Author:** [@zee67](https://discuss.elastic.co/u/zee67)\ **Replies:** 0\ **Last updated:** [June 17, 2020, 7:10pm UTC](https://discuss.elastic.co/t/logstash-to-elastic-cloud-error-400/237524 "2020-06-17T19:10:18Z")
Trying to connect Logstash to Elastic Cloud but getting error 400. My Logstash config is below, any help appreciated. input { tcp { port =\> 9600 } } filter { grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:sysl… --- ## [Trust two different certs on two nodes](https://discuss.elastic.co/t/trust-two-different-certs-on-two-nodes/235642)
**Author:** [@jthoni](https://discuss.elastic.co/u/jthoni)\ **Replies:** 11\ **Last updated:** [June 17, 2020, 6:04pm UTC](https://discuss.elastic.co/t/trust-two-different-certs-on-two-nodes/235642 "2020-06-17T18:04:55Z")
We are trying to add TLS security to our cluster. For compliance, all certs need to be generated via a in-house tool (they are signed by a 3rd party entity). I am currently testing with two nodes on my local box. The ce… --- ## [Kibana 6.4.2 to Kibana 7.0 simple scripted field issue](https://discuss.elastic.co/t/kibana-6-4-2-to-kibana-7-0-simple-scripted-field-issue/237367)
**Author:** [@chowpay](https://discuss.elastic.co/u/chowpay)\ **Replies:** 0\ **Last updated:** [June 16, 2020, 10:03pm UTC](https://discuss.elastic.co/t/kibana-6-4-2-to-kibana-7-0-simple-scripted-field-issue/237367 "2020-06-16T22:03:05Z")
Porting over my stuff from 6.4.2 I had a very simple scripted field that looks like this (all values are in format Number: doc\['ADN-KR'\].value+doc\['ADN-SSL-KR'\].value+doc\['LF-KR'.value\]+doc\['LF-SSL-KR'\].value... about 1… --- ## [Is it good to use NIOFS in hot data node?](https://discuss.elastic.co/t/is-it-good-to-use-niofs-in-hot-data-node/237500)
**Author:** [@KellyK313](https://discuss.elastic.co/u/KellyK313)\ **Replies:** 0\ **Last updated:** [June 17, 2020, 3:21pm UTC](https://discuss.elastic.co/t/is-it-good-to-use-niofs-in-hot-data-node/237500 "2020-06-17T15:21:10Z")
When our es cluster upgrade to v7.7,a big change is that the term index(.tip) is not in jvm heap but managed by mmap in pagecache. Our es cluster have hot data node and cold data node,hot data node used to storage last … --- ## [If-Else in an Index Template, and How Smart is the IP Field?](https://discuss.elastic.co/t/if-else-in-an-index-template-and-how-smart-is-the-ip-field/237496)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 0\ **Last updated:** [June 17, 2020, 3:07pm UTC](https://discuss.elastic.co/t/if-else-in-an-index-template-and-how-smart-is-the-ip-field/237496 "2020-06-17T15:07:15Z")
Hi Elasticsearch Jedi Masters, I have an Elasticsearch instance (ver 7.7.1) that is archiving network data. I also have an index template transforming the data type of the “IP.host” field from text string to IP address… --- ## [Repository verification exception when registering new ES snapshot](https://discuss.elastic.co/t/repository-verification-exception-when-registering-new-es-snapshot/237473)
**Author:** [@cpb14pk](https://discuss.elastic.co/u/cpb14pk)\ **Replies:** 4\ **Last updated:** [June 17, 2020, 1:53pm UTC](https://discuss.elastic.co/t/repository-verification-exception-when-registering-new-es-snapshot/237473 "2020-06-17T13:53:00Z")
Hi, I am trying to snapshot an elasticsearch repository. I have three different nodes across three different centos servers, e.g. 10.212.145.10, 10.212.145.20, 10.212.145.30. I have added the path.repo field in my ela… --- ## [Transform on fields of a nested object](https://discuss.elastic.co/t/transform-on-fields-of-a-nested-object/236986)
**Author:** [@sharad\_khandelwal1](https://discuss.elastic.co/u/sharad_khandelwal1)\ **Replies:** 5\ **Last updated:** [June 17, 2020, 1:45pm UTC](https://discuss.elastic.co/t/transform-on-fields-of-a-nested-object/236986 "2020-06-17T13:45:47Z")
Does transform support group by on nested fields? I was trying to group by on a field of a nested object but no results appear in the preview. --- ## [Node does not match global include filters](https://discuss.elastic.co/t/node-does-not-match-global-include-filters/237303)
**Author:** [@secumind](https://discuss.elastic.co/u/secumind)\ **Replies:** 5\ **Last updated:** [June 17, 2020, 1:18pm UTC](https://discuss.elastic.co/t/node-does-not-match-global-include-filters/237303 "2020-06-17T13:18:02Z")
I have a cluster of albeit older 2.4.6 Elasticsearch. We're upgrading soon but for right now we need to keep this version running. We have 3 master nodes, 1 search node, 6 data nodes. There are a couple of billion docum… --- ## [How properly rollover indices](https://discuss.elastic.co/t/how-properly-rollover-indices/237309)
**Author:** [@dorinand](https://discuss.elastic.co/u/dorinand)\ **Replies:** 2\ **Last updated:** [June 17, 2020, 11:16am UTC](https://discuss.elastic.co/t/how-properly-rollover-indices/237309 "2020-06-17T11:16:40Z")
I harvest logs with filebeat from all docker containers, sending them to logstash and from logstash are forwarded to elasticsearch. I would like to rollover my indices, that are automatically created, if they are too big… --- ## [Simple query string: minus (-) doesn't work if WHITESPACE not specified in flags](https://discuss.elastic.co/t/simple-query-string-minus-doesnt-work-if-whitespace-not-specified-in-flags/237347)
**Author:** [@pilo](https://discuss.elastic.co/u/pilo)\ **Replies:** 0\ **Last updated:** [June 16, 2020, 5:15pm UTC](https://discuss.elastic.co/t/simple-query-string-minus-doesnt-work-if-whitespace-not-specified-in-flags/237347 "2020-06-16T17:15:05Z")
Hi everyone, like mentionned in the title, i'm facing the problem with simple query string when WHITESPACE is not specified in flags. I'm using docker.elastic.co/elasticsearch/elasticsearch:7.4.1 I have a mapping like … --- ## [Unable to use the ODBC driver as a SQL Server Linked Server](https://discuss.elastic.co/t/unable-to-use-the-odbc-driver-as-a-sql-server-linked-server/230660)
**Author:** [@rgelb](https://discuss.elastic.co/u/rgelb)\ **Replies:** 15\ **Last updated:** [June 17, 2020, 10:39am UTC](https://discuss.elastic.co/t/unable-to-use-the-odbc-driver-as-a-sql-server-linked-server/230660 "2020-06-17T10:39:53Z")
I've setup an ODBC 64-bit driver on a server that runs SQL Server 2017. I picked the ODBC version to match the ElasticSearch installation (6.0.6). The installation of the ODBC driver and creation of a Linked Server wen… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=886) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=888)