# Elastic Search **URL:** https://discuss.elastic.co/c/search/84.md?page=9 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 10 --- ## [OSquery issue](https://discuss.elastic.co/t/osquery-issue/371994)
**Author:** [@arcsons](https://discuss.elastic.co/u/arcsons)\ **Replies:** 0\ **Last updated:** [December 15, 2024, 6:26pm UTC](https://discuss.elastic.co/t/osquery-issue/371994 "2024-12-15T18:26:57Z")
Hi I have an issue with OSquery for my Windows server and I dont know how to troubleshoot this. I have tested with osquery commands: select \* from programs; and select \* from os\_version; I get following: 1 agent h… --- ## [Custom UDP/TCP Log Timestamp](https://discuss.elastic.co/t/custom-udp-tcp-log-timestamp/371970)
**Author:** [@lastshadow](https://discuss.elastic.co/u/lastshadow)\ **Replies:** 1\ **Last updated:** [December 13, 2024, 8:20pm UTC](https://discuss.elastic.co/t/custom-udp-tcp-log-timestamp/371970 "2024-12-13T20:20:21Z")
Hello, I'm a newbie with Elastic so patience please. I'm using the Custom UDP Log integration in a policy on my fleet server and sending logs from rsyslog on my linux box to the fleet server. I receive the logs just fin… --- ## [ESQL Specifiy time filter](https://discuss.elastic.co/t/esql-specifiy-time-filter/371961)
**Author:** [@etp](https://discuss.elastic.co/u/etp)\ **Replies:** 3\ **Last updated:** [December 13, 2024, 3:56pm UTC](https://discuss.elastic.co/t/esql-specifiy-time-filter/371961 "2024-12-13T15:56:33Z")
I'm trying to use the python elasticsearch library to pull data using the query function. I wanted to specify the timerange for the query to run on. How can this be done? Is there a way to specifiy the timerange in esql … --- ## [Technical Support Unavailable having Enterprise Subscription from Azure](https://discuss.elastic.co/t/technical-support-unavailable-having-enterprise-subscription-from-azure/371924)
**Author:** [@CarlosRovira](https://discuss.elastic.co/u/CarlosRovira)\ **Replies:** 2\ **Last updated:** [December 13, 2024, 12:01pm UTC](https://discuss.elastic.co/t/technical-support-unavailable-having-enterprise-subscription-from-azure/371924 "2024-12-13T12:01:02Z")
I have an Azure Elastic Search resource with an Enterprise Subscription monthly billled, but I need to request support and I cannot do it because Technical Support is Unavailable and after try to create a Billing support… --- ## [\[Q\]: Is there a 'LIKE' function in ES|QL?](https://discuss.elastic.co/t/q-is-there-a-like-function-in-es-ql/371942)
**Author:** [@cjessing](https://discuss.elastic.co/u/cjessing)\ **Replies:** 6\ **Last updated:** [December 13, 2024, 8:47am UTC](https://discuss.elastic.co/t/q-is-there-a-like-function-in-es-ql/371942 "2024-12-13T08:47:08Z")
So I have som data in filebeat where the following query will return some data: FROM filebeat-\* | WHERE event.dataset == "cert-info.log" | KEEP tags | LIMIT 2000 this results in something like this: Certificate \[Priva… --- ## [How to further filter data by applying conditions to grouped data](https://discuss.elastic.co/t/how-to-further-filter-data-by-applying-conditions-to-grouped-data/371502)
**Author:** [@leeheeseok](https://discuss.elastic.co/u/leeheeseok)\ **Replies:** 1\ **Last updated:** [December 12, 2024, 9:54am UTC](https://discuss.elastic.co/t/how-to-further-filter-data-by-applying-conditions-to-grouped-data/371502 "2024-12-12T09:54:21Z")
Hi, I am researching a way to filter data after grouping. For example, here is the data: index: domain\_user\_search doc: \[ { "domain\_key": "PElvL8li", "delete\_yn": "Y", "@timestamp": "2024-12-03T05:49:51.000Z" }, { "do… --- ## [Connection reset warning](https://discuss.elastic.co/t/connection-reset-warning/371857)
**Author:** [@variejx](https://discuss.elastic.co/u/variejx)\ **Replies:** 5\ **Last updated:** [December 11, 2024, 6:40pm UTC](https://discuss.elastic.co/t/connection-reset-warning/371857 "2024-12-11T18:40:49Z")
Hello, I'm not sure if this is an issue as this is being flagged as INFO/WARN. this is a 3 node cluster setup to be used with Liferay DXP. This cluster is not being used/accessed at this time. Services are started and … --- ## [Call to external application using scrip processor in ingest pipeline](https://discuss.elastic.co/t/call-to-external-application-using-scrip-processor-in-ingest-pipeline/371834)
**Author:** [@petersn](https://discuss.elastic.co/u/petersn)\ **Replies:** 6\ **Last updated:** [December 11, 2024, 2:51pm UTC](https://discuss.elastic.co/t/call-to-external-application-using-scrip-processor-in-ingest-pipeline/371834 "2024-12-11T14:51:26Z")
Hi there. It is possible to call an external application/WebService/REST API from a script processor as part of an ingest pipeline? We would like to do some custom processing and considering the option of calling an ext… --- ## [Dealing with a huge Index](https://discuss.elastic.co/t/dealing-with-a-huge-index/371638)
**Author:** [@numpty-boy](https://discuss.elastic.co/u/numpty-boy)\ **Replies:** 3\ **Last updated:** [December 11, 2024, 7:37am UTC](https://discuss.elastic.co/t/dealing-with-a-huge-index/371638 "2024-12-11T07:37:22Z")
Hi Team, I recently installed a Netflow package that stores data in Elasticsearch. What I didn't realise was, even though it came with an ILM policy, that policy did not enable rollover on hot phase by default. Thanks … --- ## [Prebuilt Security Detection Rules Integration](https://discuss.elastic.co/t/prebuilt-security-detection-rules-integration/371785)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 1\ **Last updated:** [December 11, 2024, 12:09am UTC](https://discuss.elastic.co/t/prebuilt-security-detection-rules-integration/371785 "2024-12-11T00:09:21Z")
Hello, Could someone explain me to which agent policy should I apply this integration taking into account that I have a separate server for each instance? 1 Logstash server 1 Elasticsearch server 1 Kibana server 1 F… --- ## [Guidance on Semantic Search Implementation with Vector Embeddings](https://discuss.elastic.co/t/guidance-on-semantic-search-implementation-with-vector-embeddings/371751)
**Author:** [@Shirley\_bk](https://discuss.elastic.co/u/Shirley_bk)\ **Replies:** 1\ **Last updated:** [December 10, 2024, 11:56am UTC](https://discuss.elastic.co/t/guidance-on-semantic-search-implementation-with-vector-embeddings/371751 "2024-12-10T11:56:50Z")
Hello, I am currently exploring the integration of semantic search into my web application, which already uses traditional keyword-based search. The keyword search functionality is working exceptionally well, and I want… --- ## [Filebeat Elasticsearch output data stream?](https://discuss.elastic.co/t/filebeat-elasticsearch-output-data-stream/371562)
**Author:** [@Kosmodrom](https://discuss.elastic.co/u/Kosmodrom)\ **Replies:** 4\ **Last updated:** [December 6, 2024, 2:54pm UTC](https://discuss.elastic.co/t/filebeat-elasticsearch-output-data-stream/371562 "2024-12-06T14:54:18Z")
Hi folks, do I understand right? For filebeat there is still no option to define data stream in the elasticsearch output like so: output.elasticsearch: hosts: \["https://elastic-cloud-endpoint.com:9243"\] user… --- ## [Trouble syncing from Confluence connector](https://discuss.elastic.co/t/trouble-syncing-from-confluence-connector/371421)
**Author:** [@robert.bonagura](https://discuss.elastic.co/u/robert.bonagura)\ **Replies:** 10\ **Last updated:** [December 5, 2024, 9:20pm UTC](https://discuss.elastic.co/t/trouble-syncing-from-confluence-connector/371421 "2024-12-05T21:20:27Z")
Hello, I just did a make clean install and run using Elasticsearch 8.16.1 and am running into issues syncing from Confluence Cloud. this is what my local running make run returned: \[FMWK\]\[20:34:58\]\[INFO\] \[Connector id:… --- ## [Issue with kubernetes metric data fetch by meteicbeat](https://discuss.elastic.co/t/issue-with-kubernetes-metric-data-fetch-by-meteicbeat/371404)
**Author:** [@Sam96](https://discuss.elastic.co/u/Sam96)\ **Replies:** 4\ **Last updated:** [December 4, 2024, 6:37am UTC](https://discuss.elastic.co/t/issue-with-kubernetes-metric-data-fetch-by-meteicbeat/371404 "2024-12-04T06:37:53Z")
I have installed the Elasticsearch(8.16) and kibana(8.16) using RPMs in Centos vm.Also installed Metricbeats (8.16) in the centos vm using RPMS. In the same vm i have kubernetes cluster and our application is running in… --- ## [Issue with Communication Between Two Elasticsearch Nodes Using Docker](https://discuss.elastic.co/t/issue-with-communication-between-two-elasticsearch-nodes-using-docker/371174)
**Author:** [@Telos](https://discuss.elastic.co/u/Telos)\ **Replies:** 9\ **Last updated:** [November 28, 2024, 2:27pm UTC](https://discuss.elastic.co/t/issue-with-communication-between-two-elasticsearch-nodes-using-docker/371174 "2024-11-28T14:27:31Z")
Hello everyone, I am currently experimenting with Elasticsearch, and I would like to set up a small infrastructure with 2 nodes that are not on the same server but within the same cluster. I’m using Docker for this. Whi… --- ## [Please confirm QueryPhaseExecutionException and SearchPhaseExecutionException is supported in elasticsearch version 8.9.1](https://discuss.elastic.co/t/please-confirm-queryphaseexecutionexception-and-searchphaseexecutionexception-is-supported-in-elasticsearch-version-8-9-1/371191)
**Author:** [@kumar.niraj1](https://discuss.elastic.co/u/kumar.niraj1)\ **Replies:** 0\ **Last updated:** [November 28, 2024, 1:28pm UTC](https://discuss.elastic.co/t/please-confirm-queryphaseexecutionexception-and-searchphaseexecutionexception-is-supported-in-elasticsearch-version-8-9-1/371191 "2024-11-28T13:28:34Z")
please confirm is QueryPhaseExecutionException and SearchPhaseExecutionException class is supported in elasticsearch version 8.9.1 Which exception class we can use in Elasticsearch version 8.9.1 and if not required then… --- ## [How to collapse/deduplicate message (long text) field with Elastic Query](https://discuss.elastic.co/t/how-to-collapse-deduplicate-message-long-text-field-with-elastic-query/371021)
**Author:** [@turtle](https://discuss.elastic.co/u/turtle)\ **Replies:** 0\ **Last updated:** [November 25, 2024, 12:19pm UTC](https://discuss.elastic.co/t/how-to-collapse-deduplicate-message-long-text-field-with-elastic-query/371021 "2024-11-25T12:19:23Z")
We are currently logging user-related status messages, where each entry includes a detailed timestamp and various status information (e.g., "unauthorized request at 11:22:33... Access denied", "authorized request at 99:8… --- ## [Accessing Points in Order of Insertion in Elasticsearch](https://discuss.elastic.co/t/accessing-points-in-order-of-insertion-in-elasticsearch/371089)
**Author:** [@cecile\_d](https://discuss.elastic.co/u/cecile_d)\ **Replies:** 0\ **Last updated:** [November 26, 2024, 4:26pm UTC](https://discuss.elastic.co/t/accessing-points-in-order-of-insertion-in-elasticsearch/371089 "2024-11-26T16:26:47Z")
Hello , I'm facing an issue with accessing points in a geo\_point field called path in Elasticsearch. When using doc\['path'\]\[index\], the points are not returned in the order of insertion, which leads to incorrect results… --- ## [Replicate same quality of search via console as if I'm using Enterprise search](https://discuss.elastic.co/t/replicate-same-quality-of-search-via-console-as-if-im-using-enterprise-search/371024)
**Author:** [@es\_com](https://discuss.elastic.co/u/es_com)\ **Replies:** 5\ **Last updated:** [November 25, 2024, 5:48pm UTC](https://discuss.elastic.co/t/replicate-same-quality-of-search-via-console-as-if-im-using-enterprise-search/371024 "2024-11-25T17:48:24Z")
I'm trying to get same results when I use search through the console as if I'm using Enterprise search through UI. Enterprise works so much better. Here are some of the approaches I took: POST /my-index/\_search { "s… --- ## [What is the best practise to set up a router for multi-node elasticsearch for high availability?](https://discuss.elastic.co/t/what-is-the-best-practise-to-set-up-a-router-for-multi-node-elasticsearch-for-high-availability/370945)
**Author:** [@hariv0](https://discuss.elastic.co/u/hariv0)\ **Replies:** 0\ **Last updated:** [November 22, 2024, 11:02am UTC](https://discuss.elastic.co/t/what-is-the-best-practise-to-set-up-a-router-for-multi-node-elasticsearch-for-high-availability/370945 "2024-11-22T11:02:38Z")
Hello, I have a multi-zone (2 zones), multi-node (3 data nodes, 1 tie-breaker node) elasticsearch set-up for high availability. And each node is set up as its own docker container. My doubts are : Since I have 3 data… --- ## [Unexpected duplicate documents created by Elastic Search](https://discuss.elastic.co/t/unexpected-duplicate-documents-created-by-elastic-search/370906)
**Author:** [@go81816](https://discuss.elastic.co/u/go81816)\ **Replies:** 0\ **Last updated:** [November 21, 2024, 5:42pm UTC](https://discuss.elastic.co/t/unexpected-duplicate-documents-created-by-elastic-search/370906 "2024-11-21T17:42:18Z")
I use the BulkAll C# ElasticClient API to create a new index of ~500,000 documents everyday. No other documents are added to this index after this initial creation. In my code, I also immediately check the Count C# Ela… --- ## [Index ILM+logstash](https://discuss.elastic.co/t/index-ilm-logstash/370823)
**Author:** [@Marek\_Galbavy](https://discuss.elastic.co/u/Marek_Galbavy)\ **Replies:** 5\ **Last updated:** [November 21, 2024, 3:26pm UTC](https://discuss.elastic.co/t/index-ilm-logstash/370823 "2024-11-21T15:26:13Z")
Hi i try use logstash for my data with ILM policy. Index rollover and create new index with template and so on. But the name of the index just increase a number but not wroks with date. Date is still the same. Here is … --- ## [Need to enable http logs on elasticseach 7.17](https://discuss.elastic.co/t/need-to-enable-http-logs-on-elasticseach-7-17/370894)
**Author:** [@Nishant\_Hurnekar](https://discuss.elastic.co/u/Nishant_Hurnekar)\ **Replies:** 2\ **Last updated:** [November 21, 2024, 1:45pm UTC](https://discuss.elastic.co/t/need-to-enable-http-logs-on-elasticseach-7-17/370894 "2024-11-21T13:45:33Z")
Dear sir, I am using Elasticsearch v7.17 on our production infra. I need to enable http logs on it to analysis data post migration. Thanks in advance. Regards Nishant --- ## [Unexpected 0 Results for Queries on Custom Analyzed Field (title)](https://discuss.elastic.co/t/unexpected-0-results-for-queries-on-custom-analyzed-field-title/370882)
**Author:** [@Sanjeet.123](https://discuss.elastic.co/u/Sanjeet.123)\ **Replies:** 0\ **Last updated:** [November 21, 2024, 9:54am UTC](https://discuss.elastic.co/t/unexpected-0-results-for-queries-on-custom-analyzed-field-title/370882 "2024-11-21T09:54:16Z")
I am using Elasticsearch and Kibana version 8.12.0. I am encountering an issue where certain queries on the title field of my index unexpectedly return 0 results. Ideally, these queries (query\_string and regexp) should … --- ## [Mongodb river](https://discuss.elastic.co/t/mongodb-river/370835)
**Author:** [@saeed](https://discuss.elastic.co/u/saeed)\ **Replies:** 1\ **Last updated:** [November 20, 2024, 1:11pm UTC](https://discuss.elastic.co/t/mongodb-river/370835 "2024-11-20T13:11:44Z")
How can I connect Mongodb to Elasticsearch? I'm useing elasticsearch as a windows service. I dont use docker. --- ## [Use roles instead of ApiKey for Search Applications](https://discuss.elastic.co/t/use-roles-instead-of-apikey-for-search-applications/370284)
**Author:** [@Artem\_Ruzak](https://discuss.elastic.co/u/Artem_Ruzak)\ **Replies:** 13\ **Last updated:** [November 20, 2024, 10:11am UTC](https://discuss.elastic.co/t/use-roles-instead-of-apikey-for-search-applications/370284 "2024-11-20T10:11:58Z")
Hello Elastic community, I'm looking to implement a scenario where a client (the user's browser) makes API requests directly to the Elasticsearch service, allowing the client to access the Elasticsearch cluster directly… --- ## [How to fix error unknown secure setting \[elastic-certificates.p12\] Elasticsearch version 7.17 after add TLS certificate?](https://discuss.elastic.co/t/how-to-fix-error-unknown-secure-setting-elastic-certificates-p12-elasticsearch-version-7-17-after-add-tls-certificate/370818)
**Author:** [@L1ghtsou1](https://discuss.elastic.co/u/L1ghtsou1)\ **Replies:** 0\ **Last updated:** [November 20, 2024, 7:57am UTC](https://discuss.elastic.co/t/how-to-fix-error-unknown-secure-setting-elastic-certificates-p12-elasticsearch-version-7-17-after-add-tls-certificate/370818 "2024-11-20T07:57:03Z")
I want to install a fleet server and require a TLS certificate. I followed the documentation in the instruction link Set up basic security for the Elastic Stack plus secured HTTPS traffic | Elasticsearch Guide \[8.16\] | E… --- ## [How do you exclude subnets from search results in Kibana?](https://discuss.elastic.co/t/how-do-you-exclude-subnets-from-search-results-in-kibana/370781)
**Author:** [@meatwad](https://discuss.elastic.co/u/meatwad)\ **Replies:** 4\ **Last updated:** [November 20, 2024, 12:22am UTC](https://discuss.elastic.co/t/how-do-you-exclude-subnets-from-search-results-in-kibana/370781 "2024-11-20T00:22:54Z")
Hi there, The Google search results I've found seem old and no longer applicable but I was wondering how you can exclude (or include) subnets from search results in Kibana. I've tried using NOT source.ip:10.0.0.0/8 for… --- ## [Bulk Ingester flush timing issues with wait\_for Refresh Policy](https://discuss.elastic.co/t/bulk-ingester-flush-timing-issues-with-wait-for-refresh-policy/370568)
**Author:** [@Daniel\_Abadi](https://discuss.elastic.co/u/Daniel_Abadi)\ **Replies:** 1\ **Last updated:** [November 19, 2024, 6:35pm UTC](https://discuss.elastic.co/t/bulk-ingester-flush-timing-issues-with-wait-for-refresh-policy/370568 "2024-11-19T18:35:55Z")
Hello, I’m working with the bulk ingester in Elastic 8.15.3 and encountering some timing issues with flush. I configured the bulk ingester with a refresh policy set to wait\_for in the global settings, expecting that flu… --- ## [Optimizing Checkbox State Handling in @elastic/react-search-ui to Prevent Unnecessary Re-renders](https://discuss.elastic.co/t/optimizing-checkbox-state-handling-in-elastic-react-search-ui-to-prevent-unnecessary-re-renders/370560)
**Author:** [@kudumine](https://discuss.elastic.co/u/kudumine)\ **Replies:** 1\ **Last updated:** [November 19, 2024, 9:54am UTC](https://discuss.elastic.co/t/optimizing-checkbox-state-handling-in-elastic-react-search-ui-to-prevent-unnecessary-re-renders/370560 "2024-11-19T09:54:36Z")
I'm using @elastic/react-search-ui to display a list of search results and each one has a checkbox attached to it. I’m encountering an issue where, whenever a checkbox in a result item is toggled, all results are re-rend… [Previous page](https://discuss.elastic.co/c/search/84.md?page=8) [Next page](https://discuss.elastic.co/c/search/84.md?page=10)