# Latest **URL:** https://discuss.elastic.co/latest.md?page=1469 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1470 --- ## [Extract a substring and assign to new field](https://discuss.elastic.co/t/extract-a-substring-and-assign-to-new-field/284692)
**Author:** [@Andrea\_Bozzano](https://discuss.elastic.co/u/Andrea_Bozzano)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 3:10pm UTC](https://discuss.elastic.co/t/extract-a-substring-and-assign-to-new-field/284692 "2021-09-21T15:10:18Z")
Hi everyone! Hope everyone's good. in my application, i'm sending a JSON wich has a string field always made of 16 char For example: XXXYYY12Y00K111H Is there a fine way, or do you have any particular hint to extract… --- ## [Needs to add few field from one log to another log](https://discuss.elastic.co/t/needs-to-add-few-field-from-one-log-to-another-log/284600)
**Author:** [@rajvel](https://discuss.elastic.co/u/rajvel)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 2:57pm UTC](https://discuss.elastic.co/t/needs-to-add-few-field-from-one-log-to-another-log/284600 "2021-09-21T14:57:29Z")
Hi Team, We have a ansible log, One is stream and another one is job status. Now i want to add few field from one log to another, then only i can able to create a table for my requirements. --- ## [Explain the function score of match\_phrase\_prefix](https://discuss.elastic.co/t/explain-the-function-score-of-match-phrase-prefix/283348)
**Author:** [@LazyMonster](https://discuss.elastic.co/u/LazyMonster)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 2:37pm UTC](https://discuss.elastic.co/t/explain-the-function-score-of-match-phrase-prefix/283348 "2021-09-21T14:37:59Z")
I have a problem with match\_phrase\_prefix query. Let me elaborate my case: I use a script similarity like this: { "similarity": { "custom\_tfidf": { "type": "scripted", "script": { "sou… --- ## [Keep a concrete character regular expressioon](https://discuss.elastic.co/t/keep-a-concrete-character-regular-expressioon/284696)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 1:44pm UTC](https://discuss.elastic.co/t/keep-a-concrete-character-regular-expressioon/284696 "2021-09-21T13:44:54Z")
i need to keep only two characters of a field but i dont know how to do it. I would like to keep the second and third character of the server name, which indicates the country code, for example T52EDFS011 (52). i'm new… --- ## [Kv filter usage](https://discuss.elastic.co/t/kv-filter-usage/284718)
**Author:** [@PaoloZhao](https://discuss.elastic.co/u/PaoloZhao)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 1:40pm UTC](https://discuss.elastic.co/t/kv-filter-usage/284718 "2021-09-21T13:40:27Z")
Hi guys! I am a fresh fish. I have some logs like blow. 15:08:16.2104 Info {"message":"BlankProcess execution started","level":"Information","logType":"Default","timeStamp":"2021-09-21T15:08:16.2015207+08:00","fingerp… --- ## [Elasticsearch Engineer Training - Lab 4.2/4.3 - 404 during update by query](https://discuss.elastic.co/t/elasticsearch-engineer-training-lab-4-2-4-3-404-during-update-by-query/284677)
**Author:** [@efd6](https://discuss.elastic.co/u/efd6)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 1:38pm UTC](https://discuss.elastic.co/t/elasticsearch-engineer-training-lab-4-2-4-3-404-during-update-by-query/284677 "2021-09-21T13:38:13Z")
I have a problem with the elasticsearch training in module 4.2 and 4.3 (only 4.3 included since it's shorter and the problems are the same). When I create a policy and execute the policy index creation and then construc… --- ## [Limiting axis to only integers](https://discuss.elastic.co/t/limiting-axis-to-only-integers/284296)
**Author:** [@Janujc](https://discuss.elastic.co/u/Janujc)\ **Replies:** 5\ **Last updated:** [September 21, 2021, 1:10pm UTC](https://discuss.elastic.co/t/limiting-axis-to-only-integers/284296 "2021-09-21T13:10:24Z")
Hello! I'm wondering if it is possible to limit the y-axis in different plots to show only integer values? We're showcasing the number of people doing different actions, therefore it really doesn't make sense to have de… --- ## [Storage size of an event](https://discuss.elastic.co/t/storage-size-of-an-event/284724)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 0\ **Last updated:** [September 21, 2021, 12:40pm UTC](https://discuss.elastic.co/t/storage-size-of-an-event/284724 "2021-09-21T12:40:54Z")
Hello every body, Is there an estimate of the storage size of an event? Example sshd authentication event. Best regards --- ## [Add existing fields to my logstash](https://discuss.elastic.co/t/add-existing-fields-to-my-logstash/284626)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 8\ **Last updated:** [September 21, 2021, 12:24pm UTC](https://discuss.elastic.co/t/add-existing-fields-to-my-logstash/284626 "2021-09-21T12:24:49Z")
hello ! I would like to be able to add existing fields in an already stored index and to be able to work with them in logstash. I understand that there are enrichment policies but I would like not to have to use kibana… --- ## [Logstash changing Object events using ruby not working](https://discuss.elastic.co/t/logstash-changing-object-events-using-ruby-not-working/284722)
**Author:** [@antonisnyc94](https://discuss.elastic.co/u/antonisnyc94)\ **Replies:** 0\ **Last updated:** [September 21, 2021, 12:26pm UTC](https://discuss.elastic.co/t/logstash-changing-object-events-using-ruby-not-working/284722 "2021-09-21T12:26:53Z")
Hello, I am having the below logstash filter ruby code to change the name of an event with Object type but im still getting an error. Am i doing something wrong? if \[body\]\[json\]\[attr\]\[config\] { … --- ## [Single behavior generates several alerts](https://discuss.elastic.co/t/single-behavior-generates-several-alerts/283943)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 3\ **Last updated:** [September 21, 2021, 12:15pm UTC](https://discuss.elastic.co/t/single-behavior-generates-several-alerts/283943 "2021-09-21T12:15:54Z")
Hello evry body, I have a lot of alerts generated by a single behavior scan from the address IP x.x.x.x to the ip address Y (each time the rule is executed another alerts is created). Is there a way to have only one ale… --- ## [Filebeat configuration log file path won't load](https://discuss.elastic.co/t/filebeat-configuration-log-file-path-wont-load/284720)
**Author:** [@Vincent001](https://discuss.elastic.co/u/Vincent001)\ **Replies:** 0\ **Last updated:** [September 21, 2021, 12:14pm UTC](https://discuss.elastic.co/t/filebeat-configuration-log-file-path-wont-load/284720 "2021-09-21T12:14:21Z")
Hello, I have a custom configuration for filebeat for logging: logging.level: warning logging.to\_files: true logging.files: path: /var/log/filebeat/ name: filebeatVdpQueries keepfiles: 7 permissions: 0644 But … --- ## [Using certificates with ElasticSearch Nest client?](https://discuss.elastic.co/t/using-certificates-with-elasticsearch-nest-client/284656)
**Author:** [@bensalerno](https://discuss.elastic.co/u/bensalerno)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 12:14pm UTC](https://discuss.elastic.co/t/using-certificates-with-elasticsearch-nest-client/284656 "2021-09-21T12:14:20Z")
I am attempting to connect to an ElasticSearch cluster using a set of certificates given to me and a username + password. I have ca-chain public certificate private key I started my code out like this: var settings … --- ## [Docker compose error - cannot connect logstash to elastic search](https://discuss.elastic.co/t/docker-compose-error-cannot-connect-logstash-to-elastic-search/284685)
**Author:** [@Rashmika\_Gamage](https://discuss.elastic.co/u/Rashmika_Gamage)\ **Replies:** 3\ **Last updated:** [September 21, 2021, 12:13pm UTC](https://discuss.elastic.co/t/docker-compose-error-cannot-connect-logstash-to-elastic-search/284685 "2021-09-21T12:13:11Z")
I am trying to create a elastic search cluster with logstash and kibana using docker compose. Have been trying for a long time but i am getting an error. My log lines are kib01 | {"type":"log","@timestamp":"2021-… --- ## [Logstash duration management](https://discuss.elastic.co/t/logstash-duration-management/284716)
**Author:** [@simoamarca](https://discuss.elastic.co/u/simoamarca)\ **Replies:** 0\ **Last updated:** [September 21, 2021, 11:57am UTC](https://discuss.elastic.co/t/logstash-duration-management/284716 "2021-09-21T11:57:54Z")
Halloooo, I would like to ask you how to manage, with rubydebug in logstash, durations with format like 07:22:27. I wrote a script.. ruby { # code =\> " # s = event.get('Logon du… --- ## [\[Error v7.12.1\] High Level Rest Client async search doesn't work](https://discuss.elastic.co/t/error-v7-12-1-high-level-rest-client-async-search-doesnt-work/283745)
**Author:** [@str8y](https://discuss.elastic.co/u/str8y)\ **Replies:** 3\ **Last updated:** [September 21, 2021, 11:04am UTC](https://discuss.elastic.co/t/error-v7-12-1-high-level-rest-client-async-search-doesnt-work/283745 "2021-09-21T11:04:37Z")
When using asyncSearch for long running queries, results that I get from asyncSearch.get requests can't be parsed. It looks like the aggregation types are missing in the result, which leads to errors like: java.io.IOEx… --- ## [Elasticsearch 7.13.4 and 7.14.1 request memory higher than actual heap size](https://discuss.elastic.co/t/elasticsearch-7-13-4-and-7-14-1-request-memory-higher-than-actual-heap-size/284614)
**Author:** [@dimitris\_sb](https://discuss.elastic.co/u/dimitris_sb)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 11:02am UTC](https://discuss.elastic.co/t/elasticsearch-7-13-4-and-7-14-1-request-memory-higher-than-actual-heap-size/284614 "2021-09-21T11:02:27Z")
Hi All, Is there a case that the memory is consumed by elasticsearch requests (and the circuit breaker kicks in) but it is not shown in heap usage? The circuit breaker is 70% of the JVM heap and what we see makes no sen… --- ## [How to set Thread Pool settings for all data nodes in 7.14 Elastic cloud](https://discuss.elastic.co/t/how-to-set-thread-pool-settings-for-all-data-nodes-in-7-14-elastic-cloud/284473)
**Author:** [@rohitnagarro](https://discuss.elastic.co/u/rohitnagarro)\ **Replies:** 10\ **Last updated:** [September 21, 2021, 10:49am UTC](https://discuss.elastic.co/t/how-to-set-thread-pool-settings-for-all-data-nodes-in-7-14-elastic-cloud/284473 "2021-09-21T10:49:34Z")
Hi, We have 200K video assets on Elastic cloud, consuming 500mb of space on single node. Configuration wise we have 32 GB RAM Elasticsearch in 3 Zone Dedicated Master with 1GB RAM | 8 vCPU | 3 Zone Coordinating nod… --- ## [Massive queue in "refresh" thread pool on a single node, causing timeouts](https://discuss.elastic.co/t/massive-queue-in-refresh-thread-pool-on-a-single-node-causing-timeouts/280732)
**Author:** [@BradVido](https://discuss.elastic.co/u/BradVido)\ **Replies:** 18\ **Last updated:** [September 21, 2021, 10:34am UTC](https://discuss.elastic.co/t/massive-queue-in-refresh-thread-pool-on-a-single-node-causing-timeouts/280732 "2021-09-21T10:34:03Z")
This is a difficult one because it only happens randomly, I can't figure out a way to reproduce it consistently. What happens is I'll notice a lot of timeouts trying to index to the cluster, and what I've found that s… --- ## [HTTP request in Ingest Pipeline](https://discuss.elastic.co/t/http-request-in-ingest-pipeline/284698)
**Author:** [@painless\_elastic](https://discuss.elastic.co/u/painless_elastic)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 10:24am UTC](https://discuss.elastic.co/t/http-request-in-ingest-pipeline/284698 "2021-09-21T10:24:46Z")
Hi, I have a document like the below, { "result":{ "id":"1", "date":"2020-03-31", "title":"Wait for It", "artist":"Leslie Odom Jr.", "spotify\_url":"https://open.spotify.com/track/7EqpEB… --- ## [Document\_id](https://discuss.elastic.co/t/document-id/283269)
**Author:** [@cva](https://discuss.elastic.co/u/cva)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 10:12am UTC](https://discuss.elastic.co/t/document-id/283269 "2021-09-21T10:12:38Z")
Добрый день! Имеется индекс test, в нем несколько тегов: tags1, tags2, tags3. Данные я получаю из jdbc запроса к БД. В output я меняю \_id elasticsearch =\> на document\_id и отправляю это все в один индекс test. В резул… --- ## [Painless Scripting](https://discuss.elastic.co/t/painless-scripting/284366)
**Author:** [@painless\_elastic](https://discuss.elastic.co/u/painless_elastic)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 9:53am UTC](https://discuss.elastic.co/t/painless-scripting/284366 "2021-09-21T09:53:54Z")
Hi All, I am new to elastic search and trying to use ingest pipeline for modifying documents. I have a field in the document as JSON Array, I want to convert that into a string (Stringify JSON) and then save it into a … --- ## [Pro and cons between using daily and monthly indexes?](https://discuss.elastic.co/t/pro-and-cons-between-using-daily-and-monthly-indexes/284613)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 11\ **Last updated:** [September 21, 2021, 8:47am UTC](https://discuss.elastic.co/t/pro-and-cons-between-using-daily-and-monthly-indexes/284613 "2021-09-21T08:47:32Z")
Hello Following the advice given here (thank you), in a few months, Ill be able to reduce the total shards in my Elastic Stack single node from aprox 5000 to 160. This will generally give it better performance and not … --- ## [Could Not Index event to Elasticsearch](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch/284295)
**Author:** [@dayajamal](https://discuss.elastic.co/u/dayajamal)\ **Replies:** 3\ **Last updated:** [September 21, 2021, 8:27am UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch/284295 "2021-09-21T08:27:17Z")
Hello, I am running Logstash with 11 pipelines for 9 different log types, when I send those logs from Filebeat to Logstash, I tail the Logstash logs and get this error. Nonetheless, in Elasticsearch and Kibana I receive … --- ## [Search working only for case sensitive data while using SQL-ES LIKE](https://discuss.elastic.co/t/search-working-only-for-case-sensitive-data-while-using-sql-es-like/284646)
**Author:** [@Sammeta\_David\_Raju](https://discuss.elastic.co/u/Sammeta_David_Raju)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 7:19am UTC](https://discuss.elastic.co/t/search-working-only-for-case-sensitive-data-while-using-sql-es-like/284646 "2021-09-21T07:19:13Z")
Hi , I am trying to search a Text field using SQL-ES with LIKE here is the sample code GET /\_sql { "query":""select \* from indexname where customer LIKE '%AR-D'" } here I am getting resultset only AR-D ,but i want a… --- ## [Match Query Fuzziness](https://discuss.elastic.co/t/match-query-fuzziness/284633)
**Author:** [@emreorucoglu](https://discuss.elastic.co/u/emreorucoglu)\ **Replies:** 3\ **Last updated:** [September 21, 2021, 8:00am UTC](https://discuss.elastic.co/t/match-query-fuzziness/284633 "2021-09-21T08:00:22Z")
Hi everyone, I'm running into a problem when searching with fuzziness in a match query. The name I want to find is "Şaban Dişli", as seen in the images below, I am querying. But I am not getting results for some queries… --- ## [Restore from a 3-Node cluster to a stand alone cluster](https://discuss.elastic.co/t/restore-from-a-3-node-cluster-to-a-stand-alone-cluster/284670)
**Author:** [@alpot](https://discuss.elastic.co/u/alpot)\ **Replies:** 3\ **Last updated:** [September 21, 2021, 7:56am UTC](https://discuss.elastic.co/t/restore-from-a-3-node-cluster-to-a-stand-alone-cluster/284670 "2021-09-21T07:56:01Z")
I have a test environment with a 3-node cluster and a stand alone cluster. I created an index ('products') in the 3-node cluster and then performed a snapshot. I deleted the index and then use restore API to restore it… --- ## [Debug Kibana in Docker container](https://discuss.elastic.co/t/debug-kibana-in-docker-container/284688)
**Author:** [@masterThomas](https://discuss.elastic.co/u/masterThomas)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 7:54am UTC](https://discuss.elastic.co/t/debug-kibana-in-docker-container/284688 "2021-09-21T07:54:11Z")
Hi team, What a simpliest way to debug Kibana and custom apps in Docker container? I'm trying to print logs from my app in Kibana Docker, but it's empty. Although, in Kibana dev version all code prints its logs into co… --- ## [Rules not triggering alerts](https://discuss.elastic.co/t/rules-not-triggering-alerts/282899)
**Author:** [@john12](https://discuss.elastic.co/u/john12)\ **Replies:** 5\ **Last updated:** [September 21, 2021, 7:40am UTC](https://discuss.elastic.co/t/rules-not-triggering-alerts/282899 "2021-09-21T07:40:47Z")
Hello, I am creating so simple custom rules, which supposed to trigger alerts my ELK version is 7.14 i have tested the query in the discover section and it retrieve a result, so the rule should trigger and alert is t… --- ## [Guidance on Configuring an ELK Stack using seperate hosts for Logstash, Elastic (Master, Data, Ingest) and Kibana](https://discuss.elastic.co/t/guidance-on-configuring-an-elk-stack-using-seperate-hosts-for-logstash-elastic-master-data-ingest-and-kibana/284654)
**Author:** [@hazenvs](https://discuss.elastic.co/u/hazenvs)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 7:38am UTC](https://discuss.elastic.co/t/guidance-on-configuring-an-elk-stack-using-seperate-hosts-for-logstash-elastic-master-data-ingest-and-kibana/284654 "2021-09-21T07:38:40Z")
I'm looking to confiugre an ELK stack using the following seperated VM's for cost and scaling in a CSP. Lselk.gtld. (Logstash) Melk.gtld. (Master) Ielk.gtld. (Ingest) Delk.gtld (hot\_data) Wdelk.gtld (warm\_data) Kel… [Previous page](https://discuss.elastic.co/latest.md?page=1468) [Next page](https://discuss.elastic.co/latest.md?page=1470)