# Latest **URL:** https://discuss.elastic.co/latest.md?page=1099 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1100 --- ## [Explain API for Phrase Suggester](https://discuss.elastic.co/t/explain-api-for-phrase-suggester/306619)
**Author:** [@KR09](https://discuss.elastic.co/u/KR09)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 3:31am UTC](https://discuss.elastic.co/t/explain-api-for-phrase-suggester/306619 "2022-06-08T03:31:10Z")
Hi All, We are using Phrase Suggester to implement "Did you mean" functionality. We have added direct\_generator to control min\_word\_length,collate to only return the suggestion based on the documents present in the inde… --- ## [Elastic APM Data Retention and Enterprise edition policy](https://discuss.elastic.co/t/elastic-apm-data-retention-and-enterprise-edition-policy/306571)
**Author:** [@Namita\_Jaokar](https://discuss.elastic.co/u/Namita_Jaokar)\ **Replies:** 1\ **Last updated:** [June 8, 2022, 3:25am UTC](https://discuss.elastic.co/t/elastic-apm-data-retention-and-enterprise-edition-policy/306571 "2022-06-08T03:25:01Z")
Hi Team, I am currently using ELK along with dotnet and java APM agents for monitoring applications of respective technologies. I wanted to confirm on below points Data retention: Since Elasticsearch uses Lucene docu… --- ## [Query : GET average document count](https://discuss.elastic.co/t/query-get-average-document-count/306556)
**Author:** [@A\_j\_xx](https://discuss.elastic.co/u/A_j_xx)\ **Replies:** 2\ **Last updated:** [June 8, 2022, 1:46am UTC](https://discuss.elastic.co/t/query-get-average-document-count/306556 "2022-06-08T01:46:41Z")
Hi all , What would be the query to get average number of documents added per day on my index ? Is there any workaround or query to aggregate this data ? Thanks ! Hope to get a response --- ## [Change datastream target with Ingest pipeline](https://discuss.elastic.co/t/change-datastream-target-with-ingest-pipeline/306613)
**Author:** [@InJong\_Park](https://discuss.elastic.co/u/InJong_Park)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 12:59am UTC](https://discuss.elastic.co/t/change-datastream-target-with-ingest-pipeline/306613 "2022-06-08T00:59:46Z")
Can i change datastream target with ingest-pipeline? ex) set -\> data\_stream.namespace: {{{k8s.pod.name}}} or dynamic namespace with fleet's integration. ex) in integration ui Namespace: {{{k8s.pod.name}}} 'k8s.p… --- ## [Time Filter in Kibana Disappeared for Some Users](https://discuss.elastic.co/t/time-filter-in-kibana-disappeared-for-some-users/306494)
**Author:** [@Datt\_Mamon](https://discuss.elastic.co/u/Datt_Mamon)\ **Replies:** 5\ **Last updated:** [June 7, 2022, 7:57pm UTC](https://discuss.elastic.co/t/time-filter-in-kibana-disappeared-for-some-users/306494 "2022-06-07T19:57:06Z")
Hey all! Ran into a little issue with my Kibana instance that I'm hoping the wonderful community can help me out with. I created a new space and roles for a group of users to look at logs specific to their groups' work… --- ## [How to group logstash output files based on incoming input date?](https://discuss.elastic.co/t/how-to-group-logstash-output-files-based-on-incoming-input-date/306275)
**Author:** [@newelastic](https://discuss.elastic.co/u/newelastic)\ **Replies:** 6\ **Last updated:** [June 7, 2022, 10:56pm UTC](https://discuss.elastic.co/t/how-to-group-logstash-output-files-based-on-incoming-input-date/306275 "2022-06-07T22:56:20Z")
Hello, I've thousands of records in my Elasticsearch which span across different dates, month and year. I would like to output the data by year, month and date wise using output plugin. Here is my pipeline. Can someone… --- ## [Unassigned shards](https://discuss.elastic.co/t/unassigned-shards/306526)
**Author:** [@petezhang](https://discuss.elastic.co/u/petezhang)\ **Replies:** 2\ **Last updated:** [June 7, 2022, 10:55pm UTC](https://discuss.elastic.co/t/unassigned-shards/306526 "2022-06-07T22:55:38Z")
Really need help on the unassigned-shard: "unassigned\_info": { "reason": "INDEX\_REOPENED", "details": null, "allocation\_status": "no\_valid\_shard\_copy" }, "index": "\~\ **Author:** [@Dev220](https://discuss.elastic.co/u/Dev220)\ **Replies:** 5\ **Last updated:** [June 7, 2022, 9:01pm UTC](https://discuss.elastic.co/t/not-getting-the-latest-logs-in-kibana/306167 "2022-06-07T21:01:39Z") Hi Team, I am new to kibana. For collecting the logs from my application pods I am using fluent-bit configuration as a pod. Both the Elasticsearch and kiban services are up and running. I am able to see the logs in k… --- ## [Query help - return proximity between terms?](https://discuss.elastic.co/t/query-help-return-proximity-between-terms/306604)
**Author:** [@iross](https://discuss.elastic.co/u/iross)\ **Replies:** 0\ **Last updated:** [June 7, 2022, 8:57pm UTC](https://discuss.elastic.co/t/query-help-return-proximity-between-terms/306604 "2022-06-07T20:57:14Z")
Hello- I'm interested in returning the minimum "distance" between two terms within an (analyzed) text document. For example, given a sentence of "The quick brown fox jumped over the lazy dog," I'd like to be able to ext… --- ## [Alert to connectors](https://discuss.elastic.co/t/alert-to-connectors/306598)
**Author:** [@dlazure](https://discuss.elastic.co/u/dlazure)\ **Replies:** 0\ **Last updated:** [June 7, 2022, 6:25pm UTC](https://discuss.elastic.co/t/alert-to-connectors/306598 "2022-06-07T18:25:12Z")
Hi, I am sending elastic security alerts to microsoft teams. I am using suricata for IDS and the alerts are sending fine, however, it always show External Alerts as the name. It does not provide the real alert name. I… --- ## [The value in this field is too long and can't be searched or filtered](https://discuss.elastic.co/t/the-value-in-this-field-is-too-long-and-cant-be-searched-or-filtered/306597)
**Author:** [@Gaurav\_kr](https://discuss.elastic.co/u/Gaurav_kr)\ **Replies:** 0\ **Last updated:** [June 7, 2022, 6:18pm UTC](https://discuss.elastic.co/t/the-value-in-this-field-is-too-long-and-cant-be-searched-or-filtered/306597 "2022-06-07T18:18:49Z")
Hi Team, I am using ingest pipeline for dissect and i have given a pattern as %{key1} %{key2} which is working fine. But the i am unable to use the key1 and key2 for dashboard as it a ignore value warning is comming wh… --- ## [Logstash - Error to connecting ES and SQL Server](https://discuss.elastic.co/t/logstash-error-to-connecting-es-and-sql-server/306594)
**Author:** [@Furok](https://discuss.elastic.co/u/Furok)\ **Replies:** 0\ **Last updated:** [June 7, 2022, 4:45pm UTC](https://discuss.elastic.co/t/logstash-error-to-connecting-es-and-sql-server/306594 "2022-06-07T16:45:20Z")
Hi guys, I'm trying to connect SQL server with ES using logstash, nevertheless, I have the following error . \[Ruby-0-Thread-9: :1\] elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error… --- ## [Parse dynamic field names](https://discuss.elastic.co/t/parse-dynamic-field-names/306558)
**Author:** [@Soren\_vdc](https://discuss.elastic.co/u/Soren_vdc)\ **Replies:** 1\ **Last updated:** [June 7, 2022, 4:43pm UTC](https://discuss.elastic.co/t/parse-dynamic-field-names/306558 "2022-06-07T16:43:27Z")
Hi, I want to parse some code in message field where the field names contains a number. Example: responseGENERATED\_100=76 SENT\_100=76 responseGENERATED\_180=221 SENT\_180=221 responseGENERATED\_190=0 SENT\_183=0 The fil… --- ## [Logstash - Error parsing a concrete value into object field](https://discuss.elastic.co/t/logstash-error-parsing-a-concrete-value-into-object-field/306559)
**Author:** [@Thuunder7](https://discuss.elastic.co/u/Thuunder7)\ **Replies:** 1\ **Last updated:** [June 7, 2022, 4:38pm UTC](https://discuss.elastic.co/t/logstash-error-parsing-a-concrete-value-into-object-field/306559 "2022-06-07T16:38:35Z")
Hello guys, I have a pipeline on Logstash that is parsing and filtering some data from a kafka topic. Everything is working fine but from time to time i got this error message: "error"=\>{"type"=\>"mapper\_parsing\_excepti… --- ## [Remote cluster: licensing question](https://discuss.elastic.co/t/remote-cluster-licensing-question/306455)
**Author:** [@itizir](https://discuss.elastic.co/u/itizir)\ **Replies:** 6\ **Last updated:** [June 7, 2022, 4:32pm UTC](https://discuss.elastic.co/t/remote-cluster-licensing-question/306455 "2022-06-07T16:32:17Z")
Hello! The ECK automagic setup of remote clusters is locked behind the Enterprise subscription tier, whereas Elasticsearch itself allows cross-cluster search on a Basic license and only requires a higher one for cross-c… --- ## [Filebeat log with no new line character](https://discuss.elastic.co/t/filebeat-log-with-no-new-line-character/306591)
**Author:** [@Gaurav\_kr](https://discuss.elastic.co/u/Gaurav_kr)\ **Replies:** 0\ **Last updated:** [June 7, 2022, 4:15pm UTC](https://discuss.elastic.co/t/filebeat-log-with-no-new-line-character/306591 "2022-06-07T16:15:53Z")
Hi All, Wanted to know is their any way to use filebeat to harvest logs from a file which has only single line and with no new line character. I know harvester need a new line character to read the logs but do we have … --- ## [Do these "could not index" errors actually end up in Elastic anywhere?](https://discuss.elastic.co/t/do-these-could-not-index-errors-actually-end-up-in-elastic-anywhere/306582)
**Author:** [@ckes](https://discuss.elastic.co/u/ckes)\ **Replies:** 2\ **Last updated:** [June 7, 2022, 3:58pm UTC](https://discuss.elastic.co/t/do-these-could-not-index-errors-actually-end-up-in-elastic-anywhere/306582 "2022-06-07T15:58:40Z")
I've noticed quite a few of these errors with the elastic output plugin in /var/log/logstash/logstash-plain.log: "Could not index event to Elasticsearch. {:status=\>400, :action=\>\["create", ... The solution to fix the… --- ## [Hardware profiles - days of data available for fast access](https://discuss.elastic.co/t/hardware-profiles-days-of-data-available-for-fast-access/306574)
**Author:** [@sz\_bb](https://discuss.elastic.co/u/sz_bb)\ **Replies:** 1\ **Last updated:** [June 7, 2022, 3:51pm UTC](https://discuss.elastic.co/t/hardware-profiles-days-of-data-available-for-fast-access/306574 "2022-06-07T15:51:08Z")
My team is using Elastic Cloud (Azure cloud provider) and we recently noticed that the hardware profiles have changed when creating a new deployment. Previously, we had chosen the I/O optimized profile which is no longer… --- ## [Protecting kibana iFrame -](https://discuss.elastic.co/t/protecting-kibana-iframe/306456)
**Author:** [@akshay\_bhardwaj](https://discuss.elastic.co/u/akshay_bhardwaj)\ **Replies:** 2\ **Last updated:** [June 7, 2022, 3:37pm UTC](https://discuss.elastic.co/t/protecting-kibana-iframe/306456 "2022-06-07T15:37:03Z")
Can we protect kibana iFrame that Only allow it to work on one domain only. --- ## [Error in Java High Level Rest Client license page?](https://discuss.elastic.co/t/error-in-java-high-level-rest-client-license-page/306580)
**Author:** [@shuber](https://discuss.elastic.co/u/shuber)\ **Replies:** 1\ **Last updated:** [June 7, 2022, 3:36pm UTC](https://discuss.elastic.co/t/error-in-java-high-level-rest-client-license-page/306580 "2022-06-07T15:36:58Z")
On this page: It says the Java High Level Rest Client is under an Apache 2 license ? Isn't that a mistake ? From my understanding this was true until version 7.10 but after it's only available under the Elastic/SSPL r… --- ## [NEST product check call fails every time](https://discuss.elastic.co/t/nest-product-check-call-fails-every-time/306348)
**Author:** [@Kristinn\_Vikar](https://discuss.elastic.co/u/Kristinn_Vikar)\ **Replies:** 3\ **Last updated:** [June 7, 2022, 2:25pm UTC](https://discuss.elastic.co/t/nest-product-check-call-fails-every-time/306348 "2022-06-07T14:25:03Z")
Hello! I'm writing a program using .NET 6.0 and NEST 7.17.2 to import a bunch of data into Elasticsearch But whenever I try to import any data with BulkAll or Index I always run into the same exception service\_1 | Inv… --- ## [Using drop to filter messages](https://discuss.elastic.co/t/using-drop-to-filter-messages/306158)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 10\ **Last updated:** [June 7, 2022, 1:24pm UTC](https://discuss.elastic.co/t/using-drop-to-filter-messages/306158 "2022-06-07T13:24:16Z")
Hi All, I am using grok filter to parse messages coming into Logstash from filebeat. We have ELK 7.6.2 stack. I need to filter out and process "only" the following message(s) in the gc log as follows. Note that pretty… --- ## [Elasticsearch keystore reloadable settings](https://discuss.elastic.co/t/elasticsearch-keystore-reloadable-settings/306546)
**Author:** [@Dheeraj\_Lalwani](https://discuss.elastic.co/u/Dheeraj_Lalwani)\ **Replies:** 4\ **Last updated:** [June 7, 2022, 1:23pm UTC](https://discuss.elastic.co/t/elasticsearch-keystore-reloadable-settings/306546 "2022-06-07T13:23:52Z")
Hello we are using Elasticsearch 7.16.3 with ssl enabled. We have stored following settings in the Elasticsearch-keystore for that- xpack.security.http.ssl.keystore.secure\_password xpack.security.http.ssl.truststore.s… --- ## [How to Improve ES responsiveness when getting warning: retrying failed action with response code: 429](https://discuss.elastic.co/t/how-to-improve-es-responsiveness-when-getting-warning-retrying-failed-action-with-response-code-429/305173)
**Author:** [@truptir](https://discuss.elastic.co/u/truptir)\ **Replies:** 2\ **Last updated:** [June 7, 2022, 1:19pm UTC](https://discuss.elastic.co/t/how-to-improve-es-responsiveness-when-getting-warning-retrying-failed-action-with-response-code-429/305173 "2022-06-07T13:19:21Z")
My flow is Logs files will be processed from FileBeat \> Logstash \> Elasticsearch. I m getting the below 2 errors many times in Logstash logs. Error 1: \[INFO \]\[logstash.outputs.elasticsearch\]\[inventory\] retrying faile… --- ## [Custom Field in apm client side configuration](https://discuss.elastic.co/t/custom-field-in-apm-client-side-configuration/306130)
**Author:** [@abhishek.gpt1806](https://discuss.elastic.co/u/abhishek.gpt1806)\ **Replies:** 7\ **Last updated:** [June 7, 2022, 12:51pm UTC](https://discuss.elastic.co/t/custom-field-in-apm-client-side-configuration/306130 "2022-06-07T12:51:03Z")
I am intending to add a field so that apart from service.name we get application.name as well. Please suggest. We have java apm elastic agent Kibana version: 7.17.3 Elasticsearch version: 7.17.3 APM Server version: 7… --- ## [Create New Index Using Mapping from another index](https://discuss.elastic.co/t/create-new-index-using-mapping-from-another-index/306567)
**Author:** [@SUMANT\_MISHRA](https://discuss.elastic.co/u/SUMANT_MISHRA)\ **Replies:** 0\ **Last updated:** [June 7, 2022, 12:50pm UTC](https://discuss.elastic.co/t/create-new-index-using-mapping-from-another-index/306567 "2022-06-07T12:50:02Z")
Hi, Is there a way to create index by using mapping from another index? The requirement is here to copy data from one index to another that can be achieved using reindex API but the mapping updates in the source index. … --- ## [Logstash filter date match not replacing @timestamp](https://discuss.elastic.co/t/logstash-filter-date-match-not-replacing-timestamp/306364)
**Author:** [@yhache](https://discuss.elastic.co/u/yhache)\ **Replies:** 20\ **Last updated:** [June 7, 2022, 12:42pm UTC](https://discuss.elastic.co/t/logstash-filter-date-match-not-replacing-timestamp/306364 "2022-06-07T12:42:31Z")
Hi, I have a bunch of PHP log to add to my ELK cluster and i cannot get the @timestamp to work. I'm pretty sure it has something to do with the config file and the date format used in the PHP logs. Here's my config file… --- ## [Error while connecting Elastic Enterprise search](https://discuss.elastic.co/t/error-while-connecting-elastic-enterprise-search/306565)
**Author:** [@Vishal\_Gurung](https://discuss.elastic.co/u/Vishal_Gurung)\ **Replies:** 3\ **Last updated:** [June 7, 2022, 12:39pm UTC](https://discuss.elastic.co/t/error-while-connecting-elastic-enterprise-search/306565 "2022-06-07T12:39:56Z")
Hello everyone can anybody help me out setting up Enterprise search in elastic. i have deployed elastic in ubuntu 22 whereas kibana ,logstash and elastic is working fine but when i tried to set up enterprise search an e… --- ## [Custom date format in elasticsearch](https://discuss.elastic.co/t/custom-date-format-in-elasticsearch/306218)
**Author:** [@Pranjal\_Sett](https://discuss.elastic.co/u/Pranjal_Sett)\ **Replies:** 3\ **Last updated:** [June 7, 2022, 12:08pm UTC](https://discuss.elastic.co/t/custom-date-format-in-elasticsearch/306218 "2022-06-07T12:08:03Z")
Hi, I am trying to index the data with the data as May 26 2022 17:41:24 . I have given the format in my index template as MMM d Y H:m:s . I have been following this link for formatting http://joda-time.sourceforge.net… --- ## [Query - How to monitor a process running on multiple hosts using Kibana Rules?](https://discuss.elastic.co/t/query-how-to-monitor-a-process-running-on-multiple-hosts-using-kibana-rules/304466)
**Author:** [@sangameshcs](https://discuss.elastic.co/u/sangameshcs)\ **Replies:** 1\ **Last updated:** [June 7, 2022, 11:21am UTC](https://discuss.elastic.co/t/query-how-to-monitor-a-process-running-on-multiple-hosts-using-kibana-rules/304466 "2022-06-07T11:21:16Z")
Hi, is there any way to monitor a process running on multiple remote hosts using Kibana Rules, I tried using Metric threshold type of rule and was checking the number of documents related to the process to monitor if a… [Previous page](https://discuss.elastic.co/latest.md?page=1098) [Next page](https://discuss.elastic.co/latest.md?page=1100)