# Latest **URL:** https://discuss.elastic.co/latest.md?page=1611 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1612 --- ## [Phrase Suggester doesn't work with short prefixes?](https://discuss.elastic.co/t/phrase-suggester-doesnt-work-with-short-prefixes/276569)
**Author:** [@sabetai](https://discuss.elastic.co/u/sabetai)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 5:56pm UTC](https://discuss.elastic.co/t/phrase-suggester-doesnt-work-with-short-prefixes/276569 "2021-06-21T17:56:49Z")
I'm trying to implement simple auto-complete where entering the prefix of a phrase will retrieve auto-complete suggestions (ie for phrase size of 3-5). However, the Phrase Suggester often doesn't yield results until the … --- ## [To much results](https://discuss.elastic.co/t/to-much-results/276572)
**Author:** [@Joni94](https://discuss.elastic.co/u/Joni94)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 6:34pm UTC](https://discuss.elastic.co/t/to-much-results/276572 "2021-06-21T18:34:59Z")
My problem first of all i try this query: GET /index/\_search { "query": { "simple\_query\_string": { "query": "(\\"cheaper+than,+therapy\\")", "analyzer": "standard", "flags": "OR|AND", … --- ## [Issue importing saved objects via API](https://discuss.elastic.co/t/issue-importing-saved-objects-via-api/276287)
**Author:** [@Kohlman](https://discuss.elastic.co/u/Kohlman)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 6:25pm UTC](https://discuss.elastic.co/t/issue-importing-saved-objects-via-api/276287 "2021-06-21T18:25:05Z")
We are using 7.11.2. From the documentation (Import objects API | Kibana Guide \[7.13\] | Elastic) it said "The request body must include the multipart/form-data type." So we created a python script to "export" and "impo… --- ## [How to multiply score of shouldClause and mustClause in booleanQuery?](https://discuss.elastic.co/t/how-to-multiply-score-of-shouldclause-and-mustclause-in-booleanquery/276566)
**Author:** [@lunablessing](https://discuss.elastic.co/u/lunablessing)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 5:12pm UTC](https://discuss.elastic.co/t/how-to-multiply-score-of-shouldclause-and-mustclause-in-booleanquery/276566 "2021-06-21T17:12:52Z")
I know booleanQuery will add score of should clauses and must clauses. I used to do log(scoreOfShould) + log(scoreOfMust) + log(\_score) for sorting as scoreOfShould \* scoreOfMust \* \_score. In my case, scoreOfShould is q… --- ## [Heartbeat: HTTP check with dynamic url prameter](https://discuss.elastic.co/t/heartbeat-http-check-with-dynamic-url-prameter/275813)
**Author:** [@ibexit](https://discuss.elastic.co/u/ibexit)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 4:43pm UTC](https://discuss.elastic.co/t/heartbeat-http-check-with-dynamic-url-prameter/275813 "2021-06-21T16:43:44Z")
Hi, we´re trying to have some kind of dynamic parameter in the monitored URL in order to prevent the existing cache infrastructure deliver the response. We need to check the underlying infrastructure and not the cache. … --- ## [How to extract JSON from lambda-generated cloudwatch logs with Functionbeat?](https://discuss.elastic.co/t/how-to-extract-json-from-lambda-generated-cloudwatch-logs-with-functionbeat/276564)
**Author:** [@achristensen](https://discuss.elastic.co/u/achristensen)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 4:17pm UTC](https://discuss.elastic.co/t/how-to-extract-json-from-lambda-generated-cloudwatch-logs-with-functionbeat/276564 "2021-06-21T16:17:56Z")
I have a fresh Elasticsearch/Kibana instance that I'm trying to feed data to from Cloudwatch. I was able to get Functionbeat set up easily and data flows in as expected, but all of the logs are simply being put into the … --- ## [ILM rollover works as expected, but write-index does not move](https://discuss.elastic.co/t/ilm-rollover-works-as-expected-but-write-index-does-not-move/275724)
**Author:** [@BradVido](https://discuss.elastic.co/u/BradVido)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 4:06pm UTC](https://discuss.elastic.co/t/ilm-rollover-works-as-expected-but-write-index-does-not-move/275724 "2021-06-21T16:06:06Z")
I'm using ES 6.8.1 and have ILM configured with a Hot, Warm, and Delete phase. When my index hits its rollover threshold (50gb), ES does trigger a rollover, and creates a new index with the number incremented. However,… --- ## [Vega control panel](https://discuss.elastic.co/t/vega-control-panel/276530)
**Author:** [@GavinBeattie](https://discuss.elastic.co/u/GavinBeattie)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 3:57pm UTC](https://discuss.elastic.co/t/vega-control-panel/276530 "2021-06-21T15:57:31Z")
Is there a way to hide on open/temporarily disable the Vega visualisation control panel. Basically, when more casual users open the visualisation, I don't want them to see the code. I can hide the panel using the control… --- ## [Rally throughput counter include data generation](https://discuss.elastic.co/t/rally-throughput-counter-include-data-generation/276366)
**Author:** [@Lasse\_Nedergaard](https://discuss.elastic.co/u/Lasse_Nedergaard)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 3:32pm UTC](https://discuss.elastic.co/t/rally-throughput-counter-include-data-generation/276366 "2021-06-21T15:32:34Z")
We have some large JSON doc’s we use for testing. The manipulation of the document before ingest takes some time. I can see Rally’s finally output score include throughputs but the time is Rally’s throughput and it’s in… --- ## [Отоброжение кракозябр](https://discuss.elastic.co/t/topic/276478)
**Author:** [@ksfe21](https://discuss.elastic.co/u/ksfe21)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 3:28pm UTC](https://discuss.elastic.co/t/topic/276478 "2021-06-21T15:28:45Z")
Доброго времени суток! Подскажите как исправить данную ошибку в Wazuh? --- ## [\[ANNOUNCEMENT\] - spring-elasticsearch 7.0 released](https://discuss.elastic.co/t/announcement-spring-elasticsearch-7-0-released/276557)
**Author:** [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 3:12pm UTC](https://discuss.elastic.co/t/announcement-spring-elasticsearch-7-0-released/276557 "2021-06-21T15:12:27Z")
The spring-elasticsearch team is pleased to announce the spring-elasticsearch-7.0 release! Spring factories for Elasticsearch Usage Add this library to you project: \ \fr.pilato.spring\ … --- ## [Filebeat install error on windows server 2003 32 bit](https://discuss.elastic.co/t/filebeat-install-error-on-windows-server-2003-32-bit/276556)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 3:04pm UTC](https://discuss.elastic.co/t/filebeat-install-error-on-windows-server-2003-32-bit/276556 "2021-06-21T15:04:57Z")
Hello team, I am trying to install filebeat 7.9.3 32 bit on windows server 2003 which is 32 bit OS. I tried with taking new file again I thought it is corrupted but no luck. But I am getting following error: Program '… --- ## [Logstash-output-syslog incorrect time](https://discuss.elastic.co/t/logstash-output-syslog-incorrect-time/276554)
**Author:** [@bambam](https://discuss.elastic.co/u/bambam)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 2:57pm UTC](https://discuss.elastic.co/t/logstash-output-syslog-incorrect-time/276554 "2021-06-21T14:57:46Z")
I'm having an issue with using the logstash-output-syslog plugin. The syslog message header is showing a timestamp for UTC and not the timezone for where I'm located. Can someone provide some input on how to change the t… --- ## [ElasticSearch Keystore Setup up error when deploying Docker image 7:10:2 to pod](https://discuss.elastic.co/t/elasticsearch-keystore-setup-up-error-when-deploying-docker-image-72-to-pod/276402)
**Author:** [@patelsop78](https://discuss.elastic.co/u/patelsop78)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 2:40pm UTC](https://discuss.elastic.co/t/elasticsearch-keystore-setup-up-error-when-deploying-docker-image-72-to-pod/276402 "2021-06-21T14:40:20Z")
Getting below error when deploying pod using Docker 7.10.2 image. Exception in thread "main" java.io.IOException: Is a directory: SimpleFSIndexInput(path="/usr/share/elasticsearch/config/elasticsearch.keystore") at org… --- ## [Setting up parent/child facets with web crawler](https://discuss.elastic.co/t/setting-up-parent-child-facets-with-web-crawler/276293)
**Author:** [@tchocky](https://discuss.elastic.co/u/tchocky)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 2:43pm UTC](https://discuss.elastic.co/t/setting-up-parent-child-facets-with-web-crawler/276293 "2021-06-21T14:43:23Z")
Hi all - I am using HTML meta tags to add facets to my content when it is crawled. Is there any way to make this hierarchal? I have parent and child categories that I would like to be shown as parent/child checkboxes wh… --- ## [Visualizing the latest Entries by a specific Field](https://discuss.elastic.co/t/visualizing-the-latest-entries-by-a-specific-field/276197)
**Author:** [@New\_ElasticFan](https://discuss.elastic.co/u/New_ElasticFan)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 2:29pm UTC](https://discuss.elastic.co/t/visualizing-the-latest-entries-by-a-specific-field/276197 "2021-06-21T14:29:17Z")
So, I am new to Elastic Stack. My index have different entries like the following. { "\_index": "events", "\_type": "\_doc", "\_id": "irkkDFHoBkM1o5v\_kC", "\_score": null, "fields": { "@timestamp": \[ "2021-02-18T15:46:47.000… --- ## [Infinite extent for field "count": \[Infinity, -Infinity\]](https://discuss.elastic.co/t/infinite-extent-for-field-count-infinity-infinity/276333)
**Author:** [@Nisha2297](https://discuss.elastic.co/u/Nisha2297)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 2:26pm UTC](https://discuss.elastic.co/t/infinite-extent-for-field-count-infinity-infinity/276333 "2021-06-21T14:26:55Z")
I am building a bar chart in Vega visualization and it is getting created as expected. But when I change the time range or put some filter for which I don't have data, then ideally the chart should be blank and display n… --- ## [Elastic Observability Training Material - Possible Error](https://discuss.elastic.co/t/elastic-observability-training-material-possible-error/276484)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 2:21pm UTC](https://discuss.elastic.co/t/elastic-observability-training-material-possible-error/276484 "2021-06-21T14:21:39Z")
Hi all, While I was reviewing the course's material in Extracting Data Types (page 181) it shows how to convert a token directly in the tokenizer .. The problem is that date is not a valid data type From the doc: … --- ## [How to "remove" cluster.routing.allocation.awareness.attributes](https://discuss.elastic.co/t/how-to-remove-cluster-routing-allocation-awareness-attributes/276537)
**Author:** [@Maxime\_Poirier-Journ](https://discuss.elastic.co/u/Maxime_Poirier-Journ)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 2:20pm UTC](https://discuss.elastic.co/t/how-to-remove-cluster-routing-allocation-awareness-attributes/276537 "2021-06-21T14:20:29Z")
Hi there, We're using Elastic in all our environments from dev, qa to prod. We're currently using cluster.routing.allocation.awareness.attributes on all our clusters based on the attribute "aws\_availability\_zone" meanin… --- ## [Log4j2.properties- Rolling File Issue](https://discuss.elastic.co/t/log4j2-properties-rolling-file-issue/276551)
**Author:** [@anguri\_sudhakar](https://discuss.elastic.co/u/anguri_sudhakar)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 2:14pm UTC](https://discuss.elastic.co/t/log4j2-properties-rolling-file-issue/276551 "2021-06-21T14:14:16Z")
Hi Team, we have 4-node cluster elasticsearch-7.5.2 installed and configure Centos 7 in Dev- Environment Like below : master-1 master-2 hotnode warmnode We are using default log4j2.properties file for roll the lo… --- ## [Kibana map date format](https://discuss.elastic.co/t/kibana-map-date-format/276369)
**Author:** [@jvidin](https://discuss.elastic.co/u/jvidin)\ **Replies:** 7\ **Last updated:** [June 21, 2021, 2:02pm UTC](https://discuss.elastic.co/t/kibana-map-date-format/276369 "2021-06-21T14:02:26Z")
Hi There , Im ingesting some 'date type' data using the following mapping properties. "processed\_date": { "type": "date", "format": "yyyy/MM/dd HH:mm:ss.SSSZZ||yyyy/MM/dd HH:mm:ss.SSS||yyyy/MM/dd" … --- ## [\[ANNOUNCEMENT\] - Elasticsearch Beyonder 7.13.1 released](https://discuss.elastic.co/t/announcement-elasticsearch-beyonder-7-13-1-released/276544)
**Author:** [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 1:37pm UTC](https://discuss.elastic.co/t/announcement-elasticsearch-beyonder-7-13-1-released/276544 "2021-06-21T13:37:40Z")
The Elasticsearch Beyonder team is pleased to announce the elasticsearch-beyonder-7.13.1 release! Elasticsearch Beyonder Elasticsearch beyonder provides automatic index, mapping, alias or template creation when an elas… --- ## [Elasticsearch Kibana Preference](https://discuss.elastic.co/t/elasticsearch-kibana-preference/276423)
**Author:** [@Sanchit\_Agrawal](https://discuss.elastic.co/u/Sanchit_Agrawal)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 11:26am UTC](https://discuss.elastic.co/t/elasticsearch-kibana-preference/276423 "2021-06-21T11:26:16Z")
GET /executives/\_search?request\_cache=true&preference=sa GET /executives/\_search?request\_cache=true When hitting from Kibana both with the same query doesn't make any difference. Is it true preferences are ignored in … --- ## [I get error with Logstash: IllegalStateException](https://discuss.elastic.co/t/i-get-error-with-logstash-illegalstateexception/276486)
**Author:** [@an\_dinh](https://discuss.elastic.co/u/an_dinh)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 12:09pm UTC](https://discuss.elastic.co/t/i-get-error-with-logstash-illegalstateexception/276486 "2021-06-21T12:09:02Z")
Here is my logstash.conf: input { mongodb{ uri =\> 'mongodb://localhost:27017/vnExpressCrawler?authSource=vnExpressCrawler' placeholder\_db\_dir =\> '/opt/logstash-mongodb/' placeholder\_db\_name =\> 'logstash\_s… --- ## [Append hostname in each index name](https://discuss.elastic.co/t/append-hostname-in-each-index-name/276519)
**Author:** [@connectgeeks](https://discuss.elastic.co/u/connectgeeks)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 12:00pm UTC](https://discuss.elastic.co/t/append-hostname-in-each-index-name/276519 "2021-06-21T12:00:49Z")
I would like to append hostname in each index name for classification of files based on the source hostname. output{ elasticsearch { hosts =\> \["127.0.0.1:9200"\] index =\> "sample-%{\[@metadata\]\[hostname\]}-%{\[@me… --- ## [Parsing a Concatenated Field to Extract Sub-Fields](https://discuss.elastic.co/t/parsing-a-concatenated-field-to-extract-sub-fields/276523)
**Author:** [@fmaginga](https://discuss.elastic.co/u/fmaginga)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 11:29am UTC](https://discuss.elastic.co/t/parsing-a-concatenated-field-to-extract-sub-fields/276523 "2021-06-21T11:29:23Z")
Hello, I am trying to write a logstash filter to extract individual sub-fields from on concatenated field. Example: I have a field CGI = 640070003110080 CGI = 640070003110080 I want to split the CGI field in to four… --- ## [Filebeat fortinet module](https://discuss.elastic.co/t/filebeat-fortinet-module/276529)
**Author:** [@Dvir\_Solomon](https://discuss.elastic.co/u/Dvir_Solomon)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 11:26am UTC](https://discuss.elastic.co/t/filebeat-fortinet-module/276529 "2021-06-21T11:26:32Z")
Hi, totally Newby, I have have setup elastic + kibana + filebeat all on windows server 2019 manually (no service yet). i am using filebeat(syslog) + Fortinet module. Fortinet module was working, after I restarted fil… --- ## [Why does returning just the ID from a search fails?](https://discuss.elastic.co/t/why-does-returning-just-the-id-from-a-search-fails/276461)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 11:18am UTC](https://discuss.elastic.co/t/why-does-returning-just-the-id-from-a-search-fails/276461 "2021-06-21T11:18:51Z")
Dear all =) Can someone figure out why I am getting {"statusCode":400,"error":"Bad Request","message":"\[request query.fields\]: could not parse array value from json input"} when I search for a specific rule base="htt… --- ## [How to use filebeat for pushing misp feeds](https://discuss.elastic.co/t/how-to-use-filebeat-for-pushing-misp-feeds/274293)
**Author:** [@Drupad\_Soni](https://discuss.elastic.co/u/Drupad_Soni)\ **Replies:** 5\ **Last updated:** [June 21, 2021, 11:02am UTC](https://discuss.elastic.co/t/how-to-use-filebeat-for-pushing-misp-feeds/274293 "2021-06-21T11:02:14Z")
Hi Community, I have been working on MISP and Elasticsearch. I have tried with MISP module and Threatintel module. No feeds are getting pushed in ELK. Please guide/ --- ## [Monthly indices for rollover using data stream](https://discuss.elastic.co/t/monthly-indices-for-rollover-using-data-stream/276527)
**Author:** [@Bryce\_Fernandes](https://discuss.elastic.co/u/Bryce_Fernandes)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 10:59am UTC](https://discuss.elastic.co/t/monthly-indices-for-rollover-using-data-stream/276527 "2021-06-21T10:59:33Z")
Hi, Using the blog below I was able to get indices as mentioned in last step. https://www.elastic.co/blog/how-to-manage-elasticsearch-data-multiple-indices-filebeat-ilm-data-streams I am able to get indices as well as… [Previous page](https://discuss.elastic.co/latest.md?page=1610) [Next page](https://discuss.elastic.co/latest.md?page=1612)