# Latest **URL:** https://discuss.elastic.co/latest.md?page=1055 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1056 --- ## [Unable to search array values on filter](https://discuss.elastic.co/t/unable-to-search-array-values-on-filter/309196)
**Author:** [@Himanshu\_Joshi1](https://discuss.elastic.co/u/Himanshu_Joshi1)\ **Replies:** 2\ **Last updated:** [July 8, 2022, 1:07pm UTC](https://discuss.elastic.co/t/unable-to-search-array-values-on-filter/309196 "2022-07-08T13:07:43Z")
\*\*This is my data\*\* { "took" : 2, "timed\_out" : false, "\_shards" : { "total" : 6, "successful" : 6, "skipped" : 0, "failed" : 0 }, "hits" : { "total" : { "value" : 2, "relation" … --- ## [Elasticsearch - Score for a document pair](https://discuss.elastic.co/t/elasticsearch-score-for-a-document-pair/309172)
**Author:** [@Pazhaniyappan](https://discuss.elastic.co/u/Pazhaniyappan)\ **Replies:** 1\ **Last updated:** [July 8, 2022, 12:52pm UTC](https://discuss.elastic.co/t/elasticsearch-score-for-a-document-pair/309172 "2022-07-08T12:52:41Z")
Hello, Is there a way to find out the similarity between the two documents? For example, I have document A and document B in JSON format. I will select some parameters from the documents for calculating the match sco… --- ## [使用Filebeat创建新索引ILM的问题](https://discuss.elastic.co/t/filebeat-ilm/308777)
**Author:** [@busishe](https://discuss.elastic.co/u/busishe)\ **Replies:** 6\ **Last updated:** [July 8, 2022, 12:19pm UTC](https://discuss.elastic.co/t/filebeat-ilm/308777 "2022-07-08T12:19:42Z")
我编辑了 filebeat.yml 中的配置项"setup.ilm.policy\_name"指定索引的ilm策略为我在kibana中自建的测试策略。 filebeat日志启动的时候看到它做了相关的检测，这个配置是生效了的。 {"log.level":"info","@timestamp":"2022-07-04T02:51:11.473Z","log.logger":"index-management.ilm","log.origi… --- ## [Elasticsearch Unreachable Error](https://discuss.elastic.co/t/elasticsearch-unreachable-error/309185)
**Author:** [@pooja5](https://discuss.elastic.co/u/pooja5)\ **Replies:** 1\ **Last updated:** [July 8, 2022, 11:15am UTC](https://discuss.elastic.co/t/elasticsearch-unreachable-error/309185 "2022-07-08T11:15:55Z")
Hello! We have observed a log message \[ERROR\]\[logstash.outputs.elasticsearch\]\[.monitoring-logstash\] Attempted to send a bulk request to elasticsearch' but Elasticsearch appears to be unreachable or down! {:error\_messa… --- ## [PVC/PV for ECK](https://discuss.elastic.co/t/pvc-pv-for-eck/309192)
**Author:** [@Biplab](https://discuss.elastic.co/u/Biplab)\ **Replies:** 0\ **Last updated:** [July 8, 2022, 10:30am UTC](https://discuss.elastic.co/t/pvc-pv-for-eck/309192 "2022-07-08T10:30:55Z")
Hi, I wanted to create PVC (Persistence volume claim) for data node alone. For Master node and Kibana we are planning to have local/Network attached SSD. How do we create YAML file for such configuration, I have attach… --- ## [Bad parsing json with logstash](https://discuss.elastic.co/t/bad-parsing-json-with-logstash/309121)
**Author:** [@Lynow](https://discuss.elastic.co/u/Lynow)\ **Replies:** 4\ **Last updated:** [July 7, 2022, 2:55pm UTC](https://discuss.elastic.co/t/bad-parsing-json-with-logstash/309121 "2022-07-07T14:55:39Z")
Hello, I'm having trouble with logstash json parsing. I receive several events of this type: { "ignoreSimilarity" =\> false, "message" =\> "19/04/22 19h47\\n\\nLogin:\*\*\*", "@timestamp" =\> 2022-04… --- ## [Log UI doesn't show log.level](https://discuss.elastic.co/t/log-ui-doesnt-show-log-level/309191)
**Author:** [@anton.potekhin](https://discuss.elastic.co/u/anton.potekhin)\ **Replies:** 0\ **Last updated:** [July 8, 2022, 10:26am UTC](https://discuss.elastic.co/t/log-ui-doesnt-show-log-level/309191 "2022-07-08T10:26:52Z")
I have filebeat that process my logs. Logs in the following format: {"@timestamp":"2022-07-08T10:01:43.181Z","log.level":"info","message":"verifyReceipt: found receipt","ecs":{"version":"1.6.0"}} When i use discover s… --- ## [Generar alerta compleja](https://discuss.elastic.co/t/generar-alerta-compleja/309189)
**Author:** [@magosama](https://discuss.elastic.co/u/magosama)\ **Replies:** 0\ **Last updated:** [July 8, 2022, 10:22am UTC](https://discuss.elastic.co/t/generar-alerta-compleja/309189 "2022-07-08T10:22:18Z")
Buenas a todos. Soy nuevo en esto de kibana y estoy aprendiendo. Me han planteado un problema que no soy capaz de resolver. Necesitan generar una alarma cuando se de una situación especial. En un dashboard visualizo todo… --- ## [Memory usage of completion/context suggester](https://discuss.elastic.co/t/memory-usage-of-completion-context-suggester/309186)
**Author:** [@mpinho](https://discuss.elastic.co/u/mpinho)\ **Replies:** 0\ **Last updated:** [July 8, 2022, 9:20am UTC](https://discuss.elastic.co/t/memory-usage-of-completion-context-suggester/309186 "2022-07-08T09:20:35Z")
Hello, I have a question regarding the context suggester implementation, on Elasticsearch 8.3.1. I have this mapping: { "mappings": { "properties": { "suggest": { "type": "completion", "contexts": \[ … --- ## [Dashboard - field Host.hostname not found error](https://discuss.elastic.co/t/dashboard-field-host-hostname-not-found-error/309173)
**Author:** [@Darshana](https://discuss.elastic.co/u/Darshana)\ **Replies:** 3\ **Last updated:** [July 8, 2022, 7:55am UTC](https://discuss.elastic.co/t/dashboard-field-host-hostname-not-found-error/309173 "2022-07-08T07:55:36Z")
Hi, I'm getting error for Kibana Dashboard : "Field host.hostname was not found Edit in Lens editor to see more errors" --- ## [Bulk Partial update of a Nested object List by condition](https://discuss.elastic.co/t/bulk-partial-update-of-a-nested-object-list-by-condition/308948)
**Author:** [@krishnapss](https://discuss.elastic.co/u/krishnapss)\ **Replies:** 2\ **Last updated:** [July 8, 2022, 7:28am UTC](https://discuss.elastic.co/t/bulk-partial-update-of-a-nested-object-list-by-condition/308948 "2022-07-08T07:28:08Z")
Hi, I have an index which has nested list object. I need to only update certain values based on a condition. List of history with dates and values I need to update only certain dates values. In the below example I only … --- ## [Python elasticsearch client : TypeError: index() got an unexpected keyword argument 'document'](https://discuss.elastic.co/t/python-elasticsearch-client-typeerror-index-got-an-unexpected-keyword-argument-document/308758)
**Author:** [@Jay\_Urbain](https://discuss.elastic.co/u/Jay_Urbain)\ **Replies:** 1\ **Last updated:** [July 8, 2022, 7:04am UTC](https://discuss.elastic.co/t/python-elasticsearch-client-typeerror-index-got-an-unexpected-keyword-argument-document/308758 "2022-07-08T07:04:34Z")
elasticsearch: 8.3.1 python 3.9 Mac OS: Montery 12.4, ARM architecture. Running the getting started example from elasticsearch docs (Python Elasticsearch Client — Python Elasticsearch client 8.3.1 documentation) I'm g… --- ## [Deploy an Elasticsearch cluster with QuickStart](https://discuss.elastic.co/t/deploy-an-elasticsearch-cluster-with-quickstart/308656)
**Author:** [@Nortena](https://discuss.elastic.co/u/Nortena)\ **Replies:** 13\ **Last updated:** [July 8, 2022, 7:03am UTC](https://discuss.elastic.co/t/deploy-an-elasticsearch-cluster-with-quickstart/308656 "2022-07-08T07:03:40Z")
I have deployed ECK in a cluster and the quickstart has stayed in the "ApplyingChanges" phase and the quickstart pods are like this: NAMESPACE NAME HEALTH NODES VERSION PHASE AGE monitorin… --- ## [Deletion time - index managed by ilm](https://discuss.elastic.co/t/deletion-time-index-managed-by-ilm/308987)
**Author:** [@gerardgorrion](https://discuss.elastic.co/u/gerardgorrion)\ **Replies:** 2\ **Last updated:** [July 8, 2022, 6:30am UTC](https://discuss.elastic.co/t/deletion-time-index-managed-by-ilm/308987 "2022-07-08T06:30:13Z")
We are using this ILM: PUT \_ilm/policy/ilm-custom { "policy": { "phases": { "hot": { "min\_age": "0ms", "actions": { "set\_priority": { "priority": 10 } … --- ## [ElasticSearch POST \_doc and doc issue](https://discuss.elastic.co/t/elasticsearch-post-doc-and-doc-issue/309097)
**Author:** [@Even\_Zhang](https://discuss.elastic.co/u/Even_Zhang)\ **Replies:** 5\ **Last updated:** [July 8, 2022, 5:36am UTC](https://discuss.elastic.co/t/elasticsearch-post-doc-and-doc-issue/309097 "2022-07-08T05:36:58Z")
Hi everyone, I through curl to POST new index with doc like curl -XPOST -H "Content-Type: application/json" 'http://localhost:9200/portstats/doc/' -d '{"bytesReceived":0,"bytesSent":0,"@timestamp":"2022-07-10T23:43:01.… --- ## [Filebeat using IAM role for ECS tasks does not work](https://discuss.elastic.co/t/filebeat-using-iam-role-for-ecs-tasks-does-not-work/308851)
**Author:** [@masato](https://discuss.elastic.co/u/masato)\ **Replies:** 1\ **Last updated:** [July 8, 2022, 5:01am UTC](https://discuss.elastic.co/t/filebeat-using-iam-role-for-ecs-tasks-does-not-work/308851 "2022-07-08T05:01:30Z")
Hi team, I've tried to run filebeat with the cisco module (umbrella) in the ECS task. The umbrella module is configured without access\_key\_id and secret\_access\_key. I think I can now achieve filebeat using the IAM role … --- ## [Elasticsearch-plugin install nlp plugin remain error](https://discuss.elastic.co/t/elasticsearch-plugin-install-nlp-plugin-remain-error/309015)
**Author:** [@zhigang9521](https://discuss.elastic.co/u/zhigang9521)\ **Replies:** 4\ **Last updated:** [July 8, 2022, 2:37am UTC](https://discuss.elastic.co/t/elasticsearch-plugin-install-nlp-plugin-remain-error/309015 "2022-07-08T02:37:45Z")
appuser@elasticsearch:~/app/elasticsearch-7.14.1$ ./bin/elasticsearch-plugin install file:///data/elasticsearch-data/analysis-hanlp -\> Installing file:///data/elasticsearch-data/analysis-hanlp -\> Downloading file:///data… --- ## [Anomaly detection](https://discuss.elastic.co/t/anomaly-detection/309098)
**Author:** [@Amit\_Thombre](https://discuss.elastic.co/u/Amit_Thombre)\ **Replies:** 1\ **Last updated:** [July 8, 2022, 2:14am UTC](https://discuss.elastic.co/t/anomaly-detection/309098 "2022-07-08T02:14:23Z")
We are trying to use anomaly detection from Machine Learning. But very little information is available on the internet regarding it. Can you please help us with the following? Details of anomaly detection algorithm, whi… --- ## [Delegate Authorization from Saml](https://discuss.elastic.co/t/delegate-authorization-from-saml/309013)
**Author:** [@Keemtaker](https://discuss.elastic.co/u/Keemtaker)\ **Replies:** 3\ **Last updated:** [July 8, 2022, 12:35am UTC](https://discuss.elastic.co/t/delegate-authorization-from-saml/309013 "2022-07-08T00:35:46Z")
I have setup single sign-on via saml and also completed a basic role map. I will like to switch from using role mapping to delegated authorization. So users authenticate via saml but authorization is handled by different… --- ## [The certificate is not trusted elasticsearch, but I do have the SSL certificates](https://discuss.elastic.co/t/the-certificate-is-not-trusted-elasticsearch-but-i-do-have-the-ssl-certificates/309164)
**Author:** [@Xavier\_Font](https://discuss.elastic.co/u/Xavier_Font)\ **Replies:** 0\ **Last updated:** [July 8, 2022, 12:28am UTC](https://discuss.elastic.co/t/the-certificate-is-not-trusted-elasticsearch-but-i-do-have-the-ssl-certificates/309164 "2022-07-08T00:28:26Z")
when trying to access endpoints of my self-hosted elasticsearch, On Safari I https://i.stack.imgur.com/YA6Be.png)\](https://i.stack.imgur.com/YA6Be.png And on my Rust client I get code: -67843, message: "The certificate… --- ## [Logstash output question](https://discuss.elastic.co/t/logstash-output-question/309138)
**Author:** [@jlbai](https://discuss.elastic.co/u/jlbai)\ **Replies:** 3\ **Last updated:** [July 7, 2022, 10:25pm UTC](https://discuss.elastic.co/t/logstash-output-question/309138 "2022-07-07T22:25:25Z")
sh-4.2$ sudo /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/firewall.conf Using bundled JDK: /usr/share/logstash/jdk OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 a… --- ## [How do I check if field contains certain string?](https://discuss.elastic.co/t/how-do-i-check-if-field-contains-certain-string/309148)
**Author:** [@DataStorageMuse](https://discuss.elastic.co/u/DataStorageMuse)\ **Replies:** 4\ **Last updated:** [July 7, 2022, 9:23pm UTC](https://discuss.elastic.co/t/how-do-i-check-if-field-contains-certain-string/309148 "2022-07-07T21:23:21Z")
How do I query an index to return documents where a field contains only a certain string (analagous to SQL contains). This is the corresponding SQL query I would like to do in ElasticSearch. SELECT \* FROM table WHERE CON… --- ## [Elastic SIEM miss leading text on analyzer](https://discuss.elastic.co/t/elastic-siem-miss-leading-text-on-analyzer/309150)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 2\ **Last updated:** [July 7, 2022, 9:02pm UTC](https://discuss.elastic.co/t/elastic-siem-miss-leading-text-on-analyzer/309150 "2022-07-07T21:02:22Z")
Elastic Endpoint is Detect mode. All SIEM triggered alerts do the same for Endpoint injected events. Detect and Prevent should be clearly marked. In this example "Suspicious WMI Image Load from MS Office" is going to b… --- ## [No recovery message generated when using Elasticsearch query Kibana Alert type](https://discuss.elastic.co/t/no-recovery-message-generated-when-using-elasticsearch-query-kibana-alert-type/309126)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 4\ **Last updated:** [July 7, 2022, 8:24pm UTC](https://discuss.elastic.co/t/no-recovery-message-generated-when-using-elasticsearch-query-kibana-alert-type/309126 "2022-07-07T20:24:11Z")
Hello, I want to deploy notification based on custom query. For this scenario, I use logstash to fetch data from devices I want to catch all new documents where i.e. the field "failover.status.message" has a different… --- ## [Java client hangs](https://discuss.elastic.co/t/java-client-hangs/309152)
**Author:** [@John16](https://discuss.elastic.co/u/John16)\ **Replies:** 2\ **Last updated:** [July 7, 2022, 8:04pm UTC](https://discuss.elastic.co/t/java-client-hangs/309152 "2022-07-07T20:04:21Z")
Hello! I am writing a Java program to work with Elasticsearch server. My Java client version is 7.17.4, server version is 7.17.0. Consider the following code: RestClient restClient = RestClient.builder(new HttpHost("… --- ## [More complicated calculation/visualisaton - is it possible?](https://discuss.elastic.co/t/more-complicated-calculation-visualisaton-is-it-possible/309136)
**Author:** [@Frantisek\_Sitler](https://discuss.elastic.co/u/Frantisek_Sitler)\ **Replies:** 1\ **Last updated:** [July 7, 2022, 7:52pm UTC](https://discuss.elastic.co/t/more-complicated-calculation-visualisaton-is-it-possible/309136 "2022-07-07T19:52:52Z")
Hello, I have an issue to create a bit more complex calculation and visualization. It should take data from multiple indices, always an record will be connected via one field - IN number. There is always multiple recor… --- ## [Create multiple index for each agent policy](https://discuss.elastic.co/t/create-multiple-index-for-each-agent-policy/309151)
**Author:** [@dlazure](https://discuss.elastic.co/u/dlazure)\ **Replies:** 0\ **Last updated:** [July 7, 2022, 7:32pm UTC](https://discuss.elastic.co/t/create-multiple-index-for-each-agent-policy/309151 "2022-07-07T19:32:20Z")
Hi, I am trying to create different index per tenant on elastic cloud. I guess we need to assign the index per agent policy? What is the easiest way to do this Thank you --- ## [Question about EQL capabilities](https://discuss.elastic.co/t/question-about-eql-capabilities/309147)
**Author:** [@nicole.oresme](https://discuss.elastic.co/u/nicole.oresme)\ **Replies:** 0\ **Last updated:** [July 7, 2022, 7:14pm UTC](https://discuss.elastic.co/t/question-about-eql-capabilities/309147 "2022-07-07T19:14:21Z")
I'm evaluating EQL for use in some sequence analysis software we are working on. I'm having trouble figuring out two things: (1) it seems order is always fixed in sequence queries. Is this correct? Can I, for instance,… --- ## [Project monitor | push throwing cannot be marked as external""](https://discuss.elastic.co/t/project-monitor-push-throwing-cannot-be-marked-as-external/309142)
**Author:** [@Harsha\_Nagasamudra](https://discuss.elastic.co/u/Harsha_Nagasamudra)\ **Replies:** 0\ **Last updated:** [July 7, 2022, 7:02pm UTC](https://discuss.elastic.co/t/project-monitor-push-throwing-cannot-be-marked-as-external/309142 "2022-07-07T19:02:53Z")
Hay Team. This is regarding the Synthetic monitoring, we were trying out project monitors . We followed all the steps but we ar getting " .ts file cannot be marked as external" on doing the npx push command. Can any one … --- ## [Drop Processors on .yml file](https://discuss.elastic.co/t/drop-processors-on-yml-file/309109)
**Author:** [@maviles](https://discuss.elastic.co/u/maviles)\ **Replies:** 6\ **Last updated:** [July 7, 2022, 6:17pm UTC](https://discuss.elastic.co/t/drop-processors-on-yml-file/309109 "2022-07-07T18:17:07Z")
Hi, I am unable to use the following drop processors on yml processors: drop\_event.when: network: destination.ip: \['8.8.8.8/32', '8.8.4.4/32', '10.10.10.10/32'\] [Previous page](https://discuss.elastic.co/latest.md?page=1054) [Next page](https://discuss.elastic.co/latest.md?page=1056)