# Latest **URL:** https://discuss.elastic.co/latest.md?page=1281 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1282 --- ## [How to convert transformed index pattern from keyword/string-\>long?](https://discuss.elastic.co/t/how-to-convert-transformed-index-pattern-from-keyword-string-long/295985)
**Author:** [@MLsuper](https://discuss.elastic.co/u/MLsuper)\ **Replies:** 1\ **Last updated:** [February 2, 2022, 3:15am UTC](https://discuss.elastic.co/t/how-to-convert-transformed-index-pattern-from-keyword-string-long/295985 "2022-02-02T03:15:05Z")
I'm trying to convert a field that is a keyword to a long but I cannot edit it, it is fixed in the transform index. So I tried to use a ingest node pipeline which use convert keyword to long but how do I use that ingest… --- ## [Elasticsearch: Configurations when adding new nodes to a running cluster (Discovery)](https://discuss.elastic.co/t/elasticsearch-configurations-when-adding-new-nodes-to-a-running-cluster-discovery/295901)
**Author:** [@ege](https://discuss.elastic.co/u/ege)\ **Replies:** 2\ **Last updated:** [February 2, 2022, 3:05am UTC](https://discuss.elastic.co/t/elasticsearch-configurations-when-adding-new-nodes-to-a-running-cluster-discovery/295901 "2022-02-02T03:05:01Z")
I have an Elastic cluster with 2 dedicated Master nodes and 2 dedicated Data nodes. I'm currently trying to add 4 new nodes to this running cluster. In the documentation, I have seen there should be at least 3 Master no… --- ## [Grok timeout for long messages](https://discuss.elastic.co/t/grok-timeout-for-long-messages/296009)
**Author:** [@Victorv18](https://discuss.elastic.co/u/Victorv18)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 11:57pm UTC](https://discuss.elastic.co/t/grok-timeout-for-long-messages/296009 "2022-02-01T23:57:02Z")
I have a grok filter parsing logs from a DB2 AIX server, and the logs are sent to Logstash in the .txt format, the file contains a lot of log messages, separated by a timestamp parameter And i receive a timeout message … --- ## [Remove strings from body\_content in Crawler](https://discuss.elastic.co/t/remove-strings-from-body-content-in-crawler/295287)
**Author:** [@ansamHox](https://discuss.elastic.co/u/ansamHox)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 10:27pm UTC](https://discuss.elastic.co/t/remove-strings-from-body-content-in-crawler/295287 "2022-02-01T22:27:13Z")
I have a WordPress page, and crawler always puts Menu, Footer, and all of it in body\_content field,e.g. Company name, Company description Home What We Do Mission Our Process Technology Who We Are About Us Our Team Comm… --- ## [Elastic App Search Analytics](https://discuss.elastic.co/t/elastic-app-search-analytics/295204)
**Author:** [@aly](https://discuss.elastic.co/u/aly)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 10:15pm UTC](https://discuss.elastic.co/t/elastic-app-search-analytics/295204 "2022-02-01T22:15:10Z")
Hello, I am building a custom dashboard where I would like to display all my users search queries, top queries, top queries no results and many other statistics for the past 1 year using elastic app search analytics API… --- ## [Case insensitive sort on a field using App Search](https://discuss.elastic.co/t/case-insensitive-sort-on-a-field-using-app-search/252990)
**Author:** [@grantgochnauer](https://discuss.elastic.co/u/grantgochnauer)\ **Replies:** 2\ **Last updated:** [February 1, 2022, 10:02pm UTC](https://discuss.elastic.co/t/case-insensitive-sort-on-a-field-using-app-search/252990 "2022-02-01T22:02:31Z")
We're using Elastic Enterprise App Search and want to be able to sort on field names without case sensitivity. It seems that the only way to to this is to bypass the App search APIs and hit the underlying Elastic cluster… --- ## [Elasticsearch 7.16.3 Log4j Vulnerability log4j-core-2.11.1.jar still persists](https://discuss.elastic.co/t/elasticsearch-7-16-3-log4j-vulnerability-log4j-core-2-11-1-jar-still-persists/295184)
**Author:** [@pavank](https://discuss.elastic.co/u/pavank)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 10:02pm UTC](https://discuss.elastic.co/t/elasticsearch-7-16-3-log4j-vulnerability-log4j-core-2-11-1-jar-still-persists/295184 "2022-02-01T22:02:28Z")
Hi Team, In the wake of recent log4j vulnerability, we have update our production stack to version 7.16.3. Post upgrade, under /usr/share/Elasticsearch/lib/ the log4j-core is of version 2.17.1. However in /etc/elastic… --- ## [Retrieving filter facets through search API](https://discuss.elastic.co/t/retrieving-filter-facets-through-search-api/295384)
**Author:** [@sdeal](https://discuss.elastic.co/u/sdeal)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 9:56pm UTC](https://discuss.elastic.co/t/retrieving-filter-facets-through-search-api/295384 "2022-02-01T21:56:15Z")
Hello, I'm working on creating a custom search UI using the search API. Is it possible to retrieve the filter facets that have been configured in the main Workplace Search UI through the search API? For example, I creat… --- ## [Crawler Regex help](https://discuss.elastic.co/t/crawler-regex-help/295480)
**Author:** [@ansamHox](https://discuss.elastic.co/u/ansamHox)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 9:46pm UTC](https://discuss.elastic.co/t/crawler-regex-help/295480 "2022-02-01T21:46:18Z")
I need help creating Regex rules for Crawler, because it seems that regex is not working as it should. I don't want to crawl anything in /wp-content/uploads folders, (images, media, etc.). I tried to set regex to: DISA… --- ## [Power of ElasticSearch with the App Search UI?](https://discuss.elastic.co/t/power-of-elasticsearch-with-the-app-search-ui/295500)
**Author:** [@sutty100](https://discuss.elastic.co/u/sutty100)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 9:36pm UTC](https://discuss.elastic.co/t/power-of-elasticsearch-with-the-app-search-ui/295500 "2022-02-01T21:36:45Z")
We are looking at using Elasticsearch to power our E-commerce site search but also need a tool to allow our search admins to make changes like Curations and Synonyms. However the App search Search API is too simplistic a… --- ## [Cannot search on field \[log.original\] since it is not indexed](https://discuss.elastic.co/t/cannot-search-on-field-log-original-since-it-is-not-indexed/295897)
**Author:** [@mevan](https://discuss.elastic.co/u/mevan)\ **Replies:** 12\ **Last updated:** [February 1, 2022, 9:32pm UTC](https://discuss.elastic.co/t/cannot-search-on-field-log-original-since-it-is-not-indexed/295897 "2022-02-01T21:32:09Z")
Hi --I am not sure how to diagnose this issue. My searching has offered no results. When I try to refine my iptables query with \> log.original: "ID=1234" I get the error: failed to create query: Cannot search on field … --- ## [App Search : Engines gives an internal server error...Please contact your system administrator if the problem persists](https://discuss.elastic.co/t/app-search-engines-gives-an-internal-server-error-please-contact-your-system-administrator-if-the-problem-persists/295521)
**Author:** [@mirellaj](https://discuss.elastic.co/u/mirellaj)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 9:29pm UTC](https://discuss.elastic.co/t/app-search-engines-gives-an-internal-server-error-please-contact-your-system-administrator-if-the-problem-persists/295521 "2022-02-01T21:29:23Z")
I have installed locally Elasticsearch/Kibana/EnterpriseSearch (7.16). If I log in as enterprise\_search user, the only thing available in the main menu is Management Menu. ( Kibana and Advance Settings). If I log in as e… --- ## [How to remove single word search queries from Swiftype analytics](https://discuss.elastic.co/t/how-to-remove-single-word-search-queries-from-swiftype-analytics/295853)
**Author:** [@pnanchu](https://discuss.elastic.co/u/pnanchu)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 9:20pm UTC](https://discuss.elastic.co/t/how-to-remove-single-word-search-queries-from-swiftype-analytics/295853 "2022-02-01T21:20:37Z")
I am using swiftype search, i see single word search queries in search analytics report, how to improve or remove those from analytics report. Thank you, ~Prem --- ## [Highlight exact phrases/keywords](https://discuss.elastic.co/t/highlight-exact-phrases-keywords/295982)
**Author:** [@Fidel\_Perez](https://discuss.elastic.co/u/Fidel_Perez)\ **Replies:** 0\ **Last updated:** [February 1, 2022, 6:40pm UTC](https://discuss.elastic.co/t/highlight-exact-phrases-keywords/295982 "2022-02-01T18:40:50Z")
hello everyone I want to highlight the query match but to be an exact match when words or phrases { "body": { "highlight": { "fields": { "textContent": { "fragment\_size": 150, "n… --- ## [Tagging events with extracts from grok patterns](https://discuss.elastic.co/t/tagging-events-with-extracts-from-grok-patterns/296004)
**Author:** [@zach\_trio](https://discuss.elastic.co/u/zach_trio)\ **Replies:** 0\ **Last updated:** [February 1, 2022, 9:11pm UTC](https://discuss.elastic.co/t/tagging-events-with-extracts-from-grok-patterns/296004 "2022-02-01T21:11:19Z")
Hi all, I am using Filebeat to pass logs to Logstash for parsing and ingestion into Elasticsearch. Take this config extract for example: filebeat.inputs: - type: filestream paths: - /opt/containers/sites/\*/html/var… --- ## [Convert Appsearch query to Elasticsearch query](https://discuss.elastic.co/t/convert-appsearch-query-to-elasticsearch-query/292795)
**Author:** [@ammarhaider](https://discuss.elastic.co/u/ammarhaider)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 9:03pm UTC](https://discuss.elastic.co/t/convert-appsearch-query-to-elasticsearch-query/292795 "2022-02-01T21:03:11Z")
I am using Appsearch/Enterprise search at the frontend, but I need some heavy processing / complex queries to be made at the backend for which I need more control. And as per my understanding appsearch is basically a wra… --- ## [Error when trying to reindex old indices thru Kibana 7.0 Upgrade Assistant](https://discuss.elastic.co/t/error-when-trying-to-reindex-old-indices-thru-kibana-7-0-upgrade-assistant/295362)
**Author:** [@willdennis](https://discuss.elastic.co/u/willdennis)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 8:58pm UTC](https://discuss.elastic.co/t/error-when-trying-to-reindex-old-indices-thru-kibana-7-0-upgrade-assistant/295362 "2022-02-01T20:58:50Z")
Getting this error when trying to reindex old indexes (which were created in 5.6.x) thru Kibana's 7.0 Upgrade Assistant: \[mapper\_parsing\_exception\]\[include\_in\_all\] is not allowed for indices created on or after version … --- ## [Placeholders within \`index.lifecycle.rollover\_alias\` to generalize index templates?](https://discuss.elastic.co/t/placeholders-within-index-lifecycle-rollover-alias-to-generalize-index-templates/296001)
**Author:** [@gburtenshaw](https://discuss.elastic.co/u/gburtenshaw)\ **Replies:** 0\ **Last updated:** [February 1, 2022, 8:58pm UTC](https://discuss.elastic.co/t/placeholders-within-index-lifecycle-rollover-alias-to-generalize-index-templates/296001 "2022-02-01T20:58:00Z")
Our data is indexed on a per customer basis... for example, customer abc, xyz, etc... We are trying to use ILM rollover on these indices. The data is mutable nor is it strictly time based, so we are not using data strea… --- ## [Watcher works in simulation, but not live](https://discuss.elastic.co/t/watcher-works-in-simulation-but-not-live/296000)
**Author:** [@Mhughes01](https://discuss.elastic.co/u/Mhughes01)\ **Replies:** 0\ **Last updated:** [February 1, 2022, 8:55pm UTC](https://discuss.elastic.co/t/watcher-works-in-simulation-but-not-live/296000 "2022-02-01T20:55:49Z")
Hi Everyone, I'm somewhat new to Kibana and this is my first watcher. It's pretty simple, it looks for a hit on the previous day and if it finds one, it sends an email. When I simulate it, by setting the gte to -2d (the… --- ## [Getting different results for the same query](https://discuss.elastic.co/t/getting-different-results-for-the-same-query/295997)
**Author:** [@hamzahda](https://discuss.elastic.co/u/hamzahda)\ **Replies:** 2\ **Last updated:** [February 1, 2022, 8:53pm UTC](https://discuss.elastic.co/t/getting-different-results-for-the-same-query/295997 "2022-02-01T20:53:24Z")
When I execute this search with Postmn or the Elastic console I get different results as when I do it in a script using axios any ideas.. {"query":{"exists":{"field":"RefreshOrderNo"}}} I can't share the whole data eca… --- ## [Maximum number of concurrent reindexing tasks in ES cluster](https://discuss.elastic.co/t/maximum-number-of-concurrent-reindexing-tasks-in-es-cluster/295949)
**Author:** [@yabhishek](https://discuss.elastic.co/u/yabhishek)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 8:45pm UTC](https://discuss.elastic.co/t/maximum-number-of-concurrent-reindexing-tasks-in-es-cluster/295949 "2022-02-01T20:45:17Z")
Hi I was working with reindexing tasks and wanted to understand if ES sets any restriction on the number of concurrent reindexing tasks that can run in the cluster at any point of time and fails the new tasks if cluster… --- ## [Config logstash with elasticsearch cloud](https://discuss.elastic.co/t/config-logstash-with-elasticsearch-cloud/295962)
**Author:** [@Cheroufa](https://discuss.elastic.co/u/Cheroufa)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 8:34pm UTC](https://discuss.elastic.co/t/config-logstash-with-elasticsearch-cloud/295962 "2022-02-01T20:34:54Z")
hi guys i want to configure logstash with elasticsearch cloud to use the Centralized Pipeline Management but logstash can't reach the cloud elasticsearch cluster. logs : \[2022-02-02T16:19:25,986\]\[ERROR\]\[logstash.lice… --- ## [Failed to start Elasticsearch in AlmaLinux](https://discuss.elastic.co/t/failed-to-start-elasticsearch-in-almalinux/295995)
**Author:** [@MBekhit](https://discuss.elastic.co/u/MBekhit)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 8:24pm UTC](https://discuss.elastic.co/t/failed-to-start-elasticsearch-in-almalinux/295995 "2022-02-01T20:24:07Z")
Elasticsearch stopped working and this is a error log Feb 1 20:17:25 server33 systemd\[1\]: Starting Elasticsearch... Feb 1 20:17:30 server33 systemd-entrypoint\[93293\]: encountered \[2\] errors parsing \[/etc/elasticsearch… --- ## [Decode\_xml fails on UTF-16 formatted input](https://discuss.elastic.co/t/decode-xml-fails-on-utf-16-formatted-input/295996)
**Author:** [@mesposito](https://discuss.elastic.co/u/mesposito)\ **Replies:** 0\ **Last updated:** [February 1, 2022, 8:17pm UTC](https://discuss.elastic.co/t/decode-xml-fails-on-utf-16-formatted-input/295996 "2022-02-01T20:17:21Z")
Hi, I am facing an issue where xml\_decode and xml\_decode\_wineventlog fail to parse input data when it is in UTF-16. The following errors are produced: failed in decode\_xml on the "winlog.event\_data.TaskContent" field: e… --- ## [ELK - Elasticsearch nodes High CPU](https://discuss.elastic.co/t/elk-elasticsearch-nodes-high-cpu/295373)
**Author:** [@aumthanki](https://discuss.elastic.co/u/aumthanki)\ **Replies:** 3\ **Last updated:** [February 1, 2022, 7:44pm UTC](https://discuss.elastic.co/t/elk-elasticsearch-nodes-high-cpu/295373 "2022-02-01T19:44:05Z")
Setup: 3 nodes in Azure. 2 masters and one voting\_only. Info: (Nodes) { "name" : "\<\>", "cluster\_name" : "\<\>", "cluster\_uuid" : "\<\>", "version" : { "number" : "7.16.1", "build\_flavor" : "default", "… --- ## [Multiple Count Aggregations With Multiple Fields](https://discuss.elastic.co/t/multiple-count-aggregations-with-multiple-fields/293909)
**Author:** [@bsmith](https://discuss.elastic.co/u/bsmith)\ **Replies:** 4\ **Last updated:** [February 1, 2022, 7:29pm UTC](https://discuss.elastic.co/t/multiple-count-aggregations-with-multiple-fields/293909 "2022-02-01T19:29:48Z")
Is it possible to filter individual Count aggregations? I'm trying to get a count of all items that were opened in a month vs all items that were closed in a month. Each document will have an OPEN\_DT field and if closed … --- ## [Token filter predicate script and query-time 'params'](https://discuss.elastic.co/t/token-filter-predicate-script-and-query-time-params/295752)
**Author:** [@softwaredoug](https://discuss.elastic.co/u/softwaredoug)\ **Replies:** 4\ **Last updated:** [February 1, 2022, 6:50pm UTC](https://discuss.elastic.co/t/token-filter-predicate-script-and-query-time-params/295752 "2022-02-01T18:50:32Z")
Hello! I have been spelunking through Elastic code to try to understand how the following is possible. The Analysis Predicate Context says that painless scripts run at analysis can accept query-time params" params ( M… --- ## [Rollover ILM policy for existing Index](https://discuss.elastic.co/t/rollover-ilm-policy-for-existing-index/295885)
**Author:** [@Vani1](https://discuss.elastic.co/u/Vani1)\ **Replies:** 5\ **Last updated:** [February 1, 2022, 6:39pm UTC](https://discuss.elastic.co/t/rollover-ilm-policy-for-existing-index/295885 "2022-02-01T18:39:59Z")
Hi Can anyone help me on Rollover ILM for existing index , which needs to be rolled over on reaching certain age/ gb. Thankyou in advance. --- ## [Splitting the log into a csv file](https://discuss.elastic.co/t/splitting-the-log-into-a-csv-file/295922)
**Author:** [@PanPiotr](https://discuss.elastic.co/u/PanPiotr)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 6:08pm UTC](https://discuss.elastic.co/t/splitting-the-log-into-a-csv-file/295922 "2022-02-01T18:08:31Z")
Hi, I want to use logstash to separate the appropriate logs by a constant value appearing in these logs, and then divide the log into pieces after the separator ("|") and put it into a csv file with headers. The logs I'… --- ## [Unable to view logs on February 1st in Discover Kibana](https://discuss.elastic.co/t/unable-to-view-logs-on-february-1st-in-discover-kibana/295971)
**Author:** [@Amedisetti](https://discuss.elastic.co/u/Amedisetti)\ **Replies:** 0\ **Last updated:** [February 1, 2022, 6:06pm UTC](https://discuss.elastic.co/t/unable-to-view-logs-on-february-1st-in-discover-kibana/295971 "2022-02-01T18:06:10Z")
While we are trying to check logs in Discover-Kibana, we noticed popup that showed 1 of 17 shards failed and its not showing up logs for today- 1st feb Request logs: "took": 34, "timed\_out": false, "\_shards": { … [Previous page](https://discuss.elastic.co/latest.md?page=1280) [Next page](https://discuss.elastic.co/latest.md?page=1282)