# Latest **URL:** https://discuss.elastic.co/latest.md?page=1421 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1422 --- ## [Elasticsearch cluster performance](https://discuss.elastic.co/t/elasticsearch-cluster-performance/287214)
**Author:** [@Phandora](https://discuss.elastic.co/u/Phandora)\ **Replies:** 3\ **Last updated:** [October 22, 2021, 5:13pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-performance/287214 "2021-10-22T17:13:36Z")
Hi everyone, I am using Elasticsearch 7.10.2 version on EKS and I have some questions about the Elasticsearch cluster performance. Assuming that the total amount of cluster resources is the same in both cases, which is… --- ## [Should I use Simple Query or Match Query?](https://discuss.elastic.co/t/should-i-use-simple-query-or-match-query/287438)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 7\ **Last updated:** [October 22, 2021, 4:48pm UTC](https://discuss.elastic.co/t/should-i-use-simple-query-or-match-query/287438 "2021-10-22T16:48:15Z")
Dear all =) If I want to search for the following host:"10.250.11.11" and custom4:"errors occurred" then match-query and simple-query-string both looks like possible candidates. I will end up creating Kibana Rules, a… --- ## [How get 1million documents from elasticsearch?](https://discuss.elastic.co/t/how-get-1million-documents-from-elasticsearch/287446)
**Author:** [@psyapathy](https://discuss.elastic.co/u/psyapathy)\ **Replies:** 1\ **Last updated:** [October 22, 2021, 3:54pm UTC](https://discuss.elastic.co/t/how-get-1million-documents-from-elasticsearch/287446 "2021-10-22T15:54:56Z")
Hi all! Help me please. I have index and i want by api get all documents (~1million) from index for my report. I've seen the scroll, but I don't understand how to apply it to my case... How i can do? Thank for advanc… --- ## [JAX-RS/Servlet API transactions disappear with application\_packages parameter. How to get both?](https://discuss.elastic.co/t/jax-rs-servlet-api-transactions-disappear-with-application-packages-parameter-how-to-get-both/287164)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 2\ **Last updated:** [October 22, 2021, 3:51pm UTC](https://discuss.elastic.co/t/jax-rs-servlet-api-transactions-disappear-with-application-packages-parameter-how-to-get-both/287164 "2021-10-22T15:51:23Z")
Kibana version: 7.15 Elasticsearch version: 7.15 APM Server version: 7.15 APM Agent language and version: Java Agent 1.26 Original install method (e.g. download page, yum, deb, from source, etc.) and version: Java Ag… --- ## [Uri is not valid, Host is not specified](https://discuss.elastic.co/t/uri-is-not-valid-host-is-not-specified/287385)
**Author:** [@DeepakStile](https://discuss.elastic.co/u/DeepakStile)\ **Replies:** 1\ **Last updated:** [October 22, 2021, 3:44pm UTC](https://discuss.elastic.co/t/uri-is-not-valid-host-is-not-specified/287385 "2021-10-22T15:44:46Z")
Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:XXXXX, :exception=\>"Java::JavaLang::IllegalStateException", :message=\>"Unable to configure plugins: (ArgumentError) URI is not valid - host … --- ## [Geoip filter in logstash with Index Template not creating geo\_point object as expected](https://discuss.elastic.co/t/geoip-filter-in-logstash-with-index-template-not-creating-geo-point-object-as-expected/286768)
**Author:** [@ehfdub](https://discuss.elastic.co/u/ehfdub)\ **Replies:** 5\ **Last updated:** [October 22, 2021, 3:34pm UTC](https://discuss.elastic.co/t/geoip-filter-in-logstash-with-index-template-not-creating-geo-point-object-as-expected/286768 "2021-10-22T15:34:40Z")
Hello, I have a geoip in my logstash filter: geoip { source =\> "src\_ip" } and I created an index template via the Kibana DevTools for ALL new indexes: PUT /\_template/my\_template { "order": 0, "template": "\*", … --- ## [Unable to install elastic-logging-plugin (docker plugin) \>= 7.13.0 (beatSocket.sock: connect: no such file or directory)](https://discuss.elastic.co/t/unable-to-install-elastic-logging-plugin-docker-plugin-7-13-0-beatsocket-sock-connect-no-such-file-or-directory/287027)
**Author:** [@goldsky](https://discuss.elastic.co/u/goldsky)\ **Replies:** 1\ **Last updated:** [October 22, 2021, 2:56pm UTC](https://discuss.elastic.co/t/unable-to-install-elastic-logging-plugin-docker-plugin-7-13-0-beatsocket-sock-connect-no-such-file-or-directory/287027 "2021-10-22T14:56:50Z")
Hello, recently I decided to upgrade my stack to 7.15, during upgrade I discover that I can't install latest elastic-logging-plugin (docker plugin), future investigation shows that only following versions works in my ca… --- ## [Elastic Cloud and Filebeat setup](https://discuss.elastic.co/t/elastic-cloud-and-filebeat-setup/285927)
**Author:** [@Sakshee](https://discuss.elastic.co/u/Sakshee)\ **Replies:** 7\ **Last updated:** [October 22, 2021, 2:51pm UTC](https://discuss.elastic.co/t/elastic-cloud-and-filebeat-setup/285927 "2021-10-22T14:51:44Z")
Hello All, I am trying to send cloud Watch logs from a filebeat server to Elastic Cloud. I am getting following warnings. And not able to see any logs on Elastic cloud Kibana. Logs from Filebeat: 2021-10-05T12:56:… --- ## [Creating a filebeat module](https://discuss.elastic.co/t/creating-a-filebeat-module/287413)
**Author:** [@elasticfran](https://discuss.elastic.co/u/elasticfran)\ **Replies:** 6\ **Last updated:** [October 22, 2021, 2:14pm UTC](https://discuss.elastic.co/t/creating-a-filebeat-module/287413 "2021-10-22T14:14:25Z")
Hey there! I am trying to write a custom filebeat module, which are the proper guidelines to follow ? Found Creating a New Beat | Beats Developer Guide \[7.12\] | Elastic which i find pretty comprehensive but i wonder wh… --- ## [Quotation Marks + Prioritizing Exact Matches](https://discuss.elastic.co/t/quotation-marks-prioritizing-exact-matches/287354)
**Author:** [@Christian\_Adib](https://discuss.elastic.co/u/Christian_Adib)\ **Replies:** 4\ **Last updated:** [October 22, 2021, 1:59pm UTC](https://discuss.elastic.co/t/quotation-marks-prioritizing-exact-matches/287354 "2021-10-22T13:59:08Z")
Hi everyone, I’m trying to use App Search to search through the text field of a bunch of documents that I indexed, and I had a few questions I was hoping someone here can help with (or point me towards a resource / docum… --- ## [Pass access token received from http\_poller call to http filter](https://discuss.elastic.co/t/pass-access-token-received-from-http-poller-call-to-http-filter/287225)
**Author:** [@byoungman](https://discuss.elastic.co/u/byoungman)\ **Replies:** 2\ **Last updated:** [October 22, 2021, 1:25pm UTC](https://discuss.elastic.co/t/pass-access-token-received-from-http-poller-call-to-http-filter/287225 "2021-10-22T13:25:48Z")
I am able to successfully get an access token from the http\_poller plugin but now I need to pass that token on to the http filter in order to make my REST call. I'm assuming that I need to do this through the headers fi… --- ## [Cardinality, adding missing documents to a different bucket](https://discuss.elastic.co/t/cardinality-adding-missing-documents-to-a-different-bucket/287439)
**Author:** [@ibulut](https://discuss.elastic.co/u/ibulut)\ **Replies:** 0\ **Last updated:** [October 22, 2021, 12:41pm UTC](https://discuss.elastic.co/t/cardinality-adding-missing-documents-to-a-different-bucket/287439 "2021-10-22T12:41:18Z")
Hello everyone. I'm beginner with little experience and currently trying to gain experience with experiments. I have a problem with cardinality aggregation. When cardinality is used, it ignores docs with missing values … --- ## [IIS FTP Logs](https://discuss.elastic.co/t/iis-ftp-logs/287395)
**Author:** [@Bingdom](https://discuss.elastic.co/u/Bingdom)\ **Replies:** 1\ **Last updated:** [October 22, 2021, 12:16pm UTC](https://discuss.elastic.co/t/iis-ftp-logs/287395 "2021-10-22T12:16:00Z")
Hello, In our setup, I have managed to retrieve the webserver IIS logs - which works great However, it appears for the IIS module, it's only compatible with the IIS webserver. We host our FTP servers via IIS. I'm wond… --- ## [How to parase xml in logstash](https://discuss.elastic.co/t/how-to-parase-xml-in-logstash/285214)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 16\ **Last updated:** [October 14, 2021, 4:33pm UTC](https://discuss.elastic.co/t/how-to-parase-xml-in-logstash/285214 "2021-10-14T16:33:08Z")
Hi I'm wondering how can I can parse below structure of XML in logstash as XML in the single event. Maybe in that case would be use fluentd.??? This logs will be upload by filebeat. here it is worth mentioning that the… --- ## [How to find largest size document?](https://discuss.elastic.co/t/how-to-find-largest-size-document/287405)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 2\ **Last updated:** [October 22, 2021, 11:11am UTC](https://discuss.elastic.co/t/how-to-find-largest-size-document/287405 "2021-10-22T11:11:47Z")
Hello dear friends, you have helped me in many ways before, thank you very much for this. Again I am facing a problem. The problem is that I want to find the largest size document in my index. Is it possible for me to do… --- ## [How to perform math formula in Elasticsearch script score based on field value conditions?](https://discuss.elastic.co/t/how-to-perform-math-formula-in-elasticsearch-script-score-based-on-field-value-conditions/287034)
**Author:** [@Mariusz\_Liksza](https://discuss.elastic.co/u/Mariusz_Liksza)\ **Replies:** 6\ **Last updated:** [October 22, 2021, 12:10pm UTC](https://discuss.elastic.co/t/how-to-perform-math-formula-in-elasticsearch-script-score-based-on-field-value-conditions/287034 "2021-10-22T12:10:44Z")
I would like to apply a simple math formula to all documents in Elasticsearch DB. The tricky thing is that each variables consists of multiply values which are at the same time person attributes. { "\_id" : "1",… --- ## [Increasing the heap size](https://discuss.elastic.co/t/increasing-the-heap-size/287410)
**Author:** [@alicango](https://discuss.elastic.co/u/alicango)\ **Replies:** 1\ **Last updated:** [October 22, 2021, 11:50am UTC](https://discuss.elastic.co/t/increasing-the-heap-size/287410 "2021-10-22T11:50:22Z")
Hi, We are getting this error. \[2021-10-01 08:11:12\] local.ERROR: ReportDataProcess Job Exception: {“error”:{“root\_cause”:\[{“type”:“circuit\_breaking\_exception”,“reason”:“\[in\_flight\_requests\] Data too large, data for \[\ **Author:** [@nehaltrivedi96](https://discuss.elastic.co/u/nehaltrivedi96)\ **Replies:** 3\ **Last updated:** [October 22, 2021, 11:46am UTC](https://discuss.elastic.co/t/regex-kibana/287362 "2021-10-22T11:46:06Z") Hello, I am trying to create a regex query in kibana. I want to get a result which has sanitation followed by access meaning I am trying to find sanitation access\*. I am entering the following query but I am not getting… --- ## [Using wildcard and fuzziness in Elasticsearch](https://discuss.elastic.co/t/using-wildcard-and-fuzziness-in-elasticsearch/286822)
**Author:** [@jpllana](https://discuss.elastic.co/u/jpllana)\ **Replies:** 3\ **Last updated:** [October 22, 2021, 11:41am UTC](https://discuss.elastic.co/t/using-wildcard-and-fuzziness-in-elasticsearch/286822 "2021-10-22T11:41:42Z")
I have a query to search for an address where I am using also the wildcard. So if I am searching for Kennedy using the query below, I have these addresses: Query: GET my\_index/\_search { "query": { "query\_string":… --- ## [Elasticsearch tuning](https://discuss.elastic.co/t/elasticsearch-tuning/286623)
**Author:** [@Vishal\_Tomar](https://discuss.elastic.co/u/Vishal_Tomar)\ **Replies:** 2\ **Last updated:** [October 22, 2021, 11:28am UTC](https://discuss.elastic.co/t/elasticsearch-tuning/286623 "2021-10-22T11:28:55Z")
We are developing a platform where millions of records update or insert on a daily basis. For developing this platform we are working with MongoDB as primary database and Elasticsearch for secondary database(Only for se… --- ## [A question regarding querying only the index's latest documents](https://discuss.elastic.co/t/a-question-regarding-querying-only-the-indexs-latest-documents/286295)
**Author:** [@nivo](https://discuss.elastic.co/u/nivo)\ **Replies:** 7\ **Last updated:** [October 21, 2021, 10:35pm UTC](https://discuss.elastic.co/t/a-question-regarding-querying-only-the-indexs-latest-documents/286295 "2021-10-21T22:35:06Z")
Hi everyone, I'm doing a POC on a rolling indexes alternative approach in order to avoid deleting documents. I encounter some difficulties querying the data I need and I'm not sure if that's just me looking at the quer… --- ## [How to add field "id"](https://discuss.elastic.co/t/how-to-add-field-id/287336)
**Author:** [@khouloud](https://discuss.elastic.co/u/khouloud)\ **Replies:** 2\ **Last updated:** [October 22, 2021, 10:29am UTC](https://discuss.elastic.co/t/how-to-add-field-id/287336 "2021-10-22T10:29:16Z")
Hello, I wanna add a unique id identifier per file log in logstash. Thank you --- ## [Highlight subset of characters](https://discuss.elastic.co/t/highlight-subset-of-characters/285370)
**Author:** [@itokai](https://discuss.elastic.co/u/itokai)\ **Replies:** 2\ **Last updated:** [October 18, 2021, 10:56am UTC](https://discuss.elastic.co/t/highlight-subset-of-characters/285370 "2021-10-18T10:56:26Z")
Hello, how to highlight subset of characters in word(s) within sentence? For sentence: It makes website content ingestion easier than ever, so you can add search to your websites and apps in record time. if chars arr… --- ## [Unexpected result on Query Tester](https://discuss.elastic.co/t/unexpected-result-on-query-tester/286999)
**Author:** [@aguiro05](https://discuss.elastic.co/u/aguiro05)\ **Replies:** 2\ **Last updated:** [October 22, 2021, 9:26am UTC](https://discuss.elastic.co/t/unexpected-result-on-query-tester/286999 "2021-10-22T09:26:56Z")
Hello everyone, I was wondering why my Query Tester search gives me the following result, using the query "albert": First result has a score of 6.36 and second one has a score of 6.24. First result match field is sh… --- ## [How to create custom message info for monitors in Elastic?](https://discuss.elastic.co/t/how-to-create-custom-message-info-for-monitors-in-elastic/283456)
**Author:** [@Maddyle0](https://discuss.elastic.co/u/Maddyle0)\ **Replies:** 3\ **Last updated:** [October 22, 2021, 8:46am UTC](https://discuss.elastic.co/t/how-to-create-custom-message-info-for-monitors-in-elastic/283456 "2021-10-22T08:46:31Z")
Hello, I'm new to Elastic, I have configured the Email alerts for port violation monitor, but I getting emails with default Messages info, not Specific details about the alert. How can I edit the default template and add… --- ## [Unable to connect to elasticsearch when Xpack is configured](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-when-xpack-is-configured/287279)
**Author:** [@Kadhem](https://discuss.elastic.co/u/Kadhem)\ **Replies:** 3\ **Last updated:** [October 22, 2021, 8:34am UTC](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-when-xpack-is-configured/287279 "2021-10-22T08:34:25Z")
Hi, i've configured Xpack to get users and roles. it's all working fine but when i want to run logstash file.conf to push data i get an error saying: \[2021-10-21T09:34:55,359\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main… --- ## [Heartbeat Down Counter](https://discuss.elastic.co/t/heartbeat-down-counter/285817)
**Author:** [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\ **Replies:** 3\ **Last updated:** [October 22, 2021, 7:59am UTC](https://discuss.elastic.co/t/heartbeat-down-counter/285817 "2021-10-22T07:59:18Z")
How do I make a simple counter, that show how many of my hosts are down? We are running heartbeat. I'd think it was simple to make this, but I can't figure it out. How do I make a simple counter that show how many of … --- ## [How to learn index with most queries?](https://discuss.elastic.co/t/how-to-learn-index-with-most-queries/287407)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 2\ **Last updated:** [October 22, 2021, 7:27am UTC](https://discuss.elastic.co/t/how-to-learn-index-with-most-queries/287407 "2021-10-22T07:27:21Z")
Hello dear friends, I would like to ask you a question that has been on my mind before. This question is: I wonder if we can find which indexes get the most queries. So I have more than one index and these indexes are us… --- ## [Add "time" chart on kibana](https://discuss.elastic.co/t/add-time-chart-on-kibana/287271)
**Author:** [@christbiz86](https://discuss.elastic.co/u/christbiz86)\ **Replies:** 6\ **Last updated:** [October 22, 2021, 6:31am UTC](https://discuss.elastic.co/t/add-time-chart-on-kibana/287271 "2021-10-22T06:31:24Z")
hi all, i want adding time chart like the screenshot. kibana only show the "document" field ony. i've add the index pattern and it doesn't work. any help please! my kibana currently --- ## [別indexデータとの差分出力](https://discuss.elastic.co/t/index/287249)
**Author:** [@yuta.yokoyama](https://discuss.elastic.co/u/yuta.yokoyama)\ **Replies:** 2\ **Last updated:** [October 22, 2021, 6:10am UTC](https://discuss.elastic.co/t/index/287249 "2021-10-22T06:10:13Z")
お世話になっております。 現在予定のデータを「p\_test」、実績のデータを「r\_test」というindexに登録しています。 予実の差を知りたいのですが、当日の「p\_test」の数から「r\_test」の数を引いた値を取得してVisualizeに表示する方法はないでしょうか。 [Previous page](https://discuss.elastic.co/latest.md?page=1420) [Next page](https://discuss.elastic.co/latest.md?page=1422)