# Latest **URL:** https://discuss.elastic.co/latest.md?page=1627 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1628 --- ## [Need Suggestion on match\_phrase\_prefix and field priority result top to bottom order](https://discuss.elastic.co/t/need-suggestion-on-match-phrase-prefix-and-field-priority-result-top-to-bottom-order/275728)
**Author:** [@bikashelastic](https://discuss.elastic.co/u/bikashelastic)\ **Replies:** 0\ **Last updated:** [June 12, 2021, 9:47am UTC](https://discuss.elastic.co/t/need-suggestion-on-match-phrase-prefix-and-field-priority-result-top-to-bottom-order/275728 "2021-06-12T09:47:48Z")
Hy Team, I have implemented the bool query "match\_phrase\_prefix" with "slop" in my search functionality and the query is giving me the result as expected. but the order of the result is not giving the field priority. W… --- ## [All Nodes Failed Exception](https://discuss.elastic.co/t/all-nodes-failed-exception/275627)
**Author:** [@NLSVTN](https://discuss.elastic.co/u/NLSVTN)\ **Replies:** 15\ **Last updated:** [June 12, 2021, 5:43am UTC](https://discuss.elastic.co/t/all-nodes-failed-exception/275627 "2021-06-12T05:43:39Z")
Hi, We are getting the following error: Error summary: EsHadoopNoNodesLeftException: Connection error (check network and/or proxy settings)- all nodes failed; tried \[\[https://search-seqr-gris-prod-65wdlm6cncfxo5d326vkd… --- ## [Indices not rolling over](https://discuss.elastic.co/t/indices-not-rolling-over/275640)
**Author:** [@lchan](https://discuss.elastic.co/u/lchan)\ **Replies:** 2\ **Last updated:** [June 12, 2021, 4:55am UTC](https://discuss.elastic.co/t/indices-not-rolling-over/275640 "2021-06-12T04:55:14Z")
I am troubleshooting an issue where my indices (filebeats\*) are not rolling from hot to warm. I changed rollover max\_age=30d to max\_age=1d. However, the indices of the ILM action is "completed" and looks like they won't… --- ## [Rule for detecting email domain](https://discuss.elastic.co/t/rule-for-detecting-email-domain/273802)
**Author:** [@realtech2338](https://discuss.elastic.co/u/realtech2338)\ **Replies:** 1\ **Last updated:** [June 12, 2021, 4:07am UTC](https://discuss.elastic.co/t/rule-for-detecting-email-domain/273802 "2021-06-12T04:07:16Z")
I would like to create a rule to detect emails coming from specific domain for Strat malware email delivery. Please guide me how to do that: --- ## [WorkplaceSearch's search results and how to avoid them](https://discuss.elastic.co/t/workplacesearchs-search-results-and-how-to-avoid-them/275662)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 2\ **Last updated:** [June 12, 2021, 1:34am UTC](https://discuss.elastic.co/t/workplacesearchs-search-results-and-how-to-avoid-them/275662 "2021-06-12T01:34:58Z")
I have added some document sources to WokrplaceSearch and have been searching for them. At this time, I noticed that some of the search terms are not included in the search results. Is this using the "fuzzy query" tech… --- ## [Join the result of two different queries indices](https://discuss.elastic.co/t/join-the-result-of-two-different-queries-indices/275470)
**Author:** [@Walter\_Jimenez](https://discuss.elastic.co/u/Walter_Jimenez)\ **Replies:** 3\ **Last updated:** [June 11, 2021, 9:53pm UTC](https://discuss.elastic.co/t/join-the-result-of-two-different-queries-indices/275470 "2021-06-11T21:53:38Z")
Good morning, excuse my English. I am new to elastic and I am doing some tests with the queries, I have the following case: I have two indeces, metrics and a custom one of my own, I was able to make each one a separate … --- ## [Limiting dynamic properties/fields indexed](https://discuss.elastic.co/t/limiting-dynamic-properties-fields-indexed/275585)
**Author:** [@ronchalant](https://discuss.elastic.co/u/ronchalant)\ **Replies:** 3\ **Last updated:** [June 11, 2021, 9:48pm UTC](https://discuss.elastic.co/t/limiting-dynamic-properties-fields-indexed/275585 "2021-06-11T21:48:47Z")
We're migrating to ES7, and for one of our indexes which stores email data we are hitting the "Limit of total fields \[1000\]" error. The reason for this is we're indexing all headers, and for some emails the number of he… --- ## [Logstash drop based on size](https://discuss.elastic.co/t/logstash-drop-based-on-size/275610)
**Author:** [@mcosta](https://discuss.elastic.co/u/mcosta)\ **Replies:** 2\ **Last updated:** [June 11, 2021, 9:11pm UTC](https://discuss.elastic.co/t/logstash-drop-based-on-size/275610 "2021-06-11T21:11:12Z")
Hi all, Is it possible to drop a message based on it's size (ex: above 1 MB)? I'm reading from tcp port and writing into Kafka topic. All messages bigger then 1 MB give errors similar to this and then logstash retry t… --- ## [How use metricbeat for logstash logs files in docker container](https://discuss.elastic.co/t/how-use-metricbeat-for-logstash-logs-files-in-docker-container/275540)
**Author:** [@Atesrin](https://discuss.elastic.co/u/Atesrin)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 9:08pm UTC](https://discuss.elastic.co/t/how-use-metricbeat-for-logstash-logs-files-in-docker-container/275540 "2021-06-11T21:08:37Z")
Hi everyone, My first post, so sorry if I made some mistakes. I'm trying to use metricbeat to monitor Logstash. I have elastic, kibana, metricbeat and logstash running in docker containers with 2 docker-compose files … --- ## [Filebeat 503 method not allowed](https://discuss.elastic.co/t/filebeat-503-method-not-allowed/275720)
**Author:** [@burtonrs](https://discuss.elastic.co/u/burtonrs)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 9:02pm UTC](https://discuss.elastic.co/t/filebeat-503-method-not-allowed/275720 "2021-06-11T21:02:15Z")
Filebeat is attempting to send logs, but not working at all. Getting error below. HELP!!!! 2021-06-11T15:25:54.596-0400 DEBUG \[input\] input/input.go:139 Run input 2021-06-11T15:25:54.597-0400 DEBUG \[inpu… --- ## [Parsing csv file through Logstash](https://discuss.elastic.co/t/parsing-csv-file-through-logstash/274792)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 17\ **Last updated:** [June 11, 2021, 9:01pm UTC](https://discuss.elastic.co/t/parsing-csv-file-through-logstash/274792 "2021-06-11T21:01:28Z")
Hi All, I am running ELK stack 7.6.2. I need to parse a csv through Logstash. My logstash conf file looks like this: input { file { path =\> "/opt/gtal/ictal/elasticsearch/app/logstash/stage/STATS-01062021.txt" … --- ## [Aggregration Filter doesnt seem to work](https://discuss.elastic.co/t/aggregration-filter-doesnt-seem-to-work/275182)
**Author:** [@kapso](https://discuss.elastic.co/u/kapso)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 8:58pm UTC](https://discuss.elastic.co/t/aggregration-filter-doesnt-seem-to-work/275182 "2021-06-11T20:58:30Z")
I have document of type blog posts, here's what an example looks like Input: \[ { "id": 1, "post\_title": "Title 1", "published\_on": "2021-06-07", "tag\_ids": \[1, 2\], "authors": \[ { "id… --- ## [Bucket selector Kibana Data table visualization](https://discuss.elastic.co/t/bucket-selector-kibana-data-table-visualization/275573)
**Author:** [@theDor](https://discuss.elastic.co/u/theDor)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 8:53pm UTC](https://discuss.elastic.co/t/bucket-selector-kibana-data-table-visualization/275573 "2021-06-11T20:53:05Z")
Hello to every one, I have a simple data table visualization that using the sum metric on a field and displaying the results in a data table. Now my goal is to display only results that the sum is greater than X value.… --- ## [Possible bug in completion context suggester (6.8 and 7.10)](https://discuss.elastic.co/t/possible-bug-in-completion-context-suggester-6-8-and-7-10/275718)
**Author:** [@bklippel](https://discuss.elastic.co/u/bklippel)\ **Replies:** 0\ **Last updated:** [June 11, 2021, 8:10pm UTC](https://discuss.elastic.co/t/possible-bug-in-completion-context-suggester-6-8-and-7-10/275718 "2021-06-11T20:10:22Z")
Hi, I've come across some strange behavior using the completion suggest. In my scenario it seems that inputs over ~34 characters are ignored. I have steps to reproduce. Create this index, post this doc then try the qu… --- ## [Cannot start elastic search server](https://discuss.elastic.co/t/cannot-start-elastic-search-server/275700)
**Author:** [@elastic0](https://discuss.elastic.co/u/elastic0)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 8:08pm UTC](https://discuss.elastic.co/t/cannot-start-elastic-search-server/275700 "2021-06-11T20:08:02Z")
I downloaded elasticsearch-7.13.1-windows-x86\_64.zip, but when I run elasticsearch-service-x64.exe it immediately crashes briefly flashing a blank window. If I run elasticsearch.bat, it gets the following exception. un… --- ## [Can watchers write to an elasticsearch index?](https://discuss.elastic.co/t/can-watchers-write-to-an-elasticsearch-index/275597)
**Author:** [@Matt\_McGovern](https://discuss.elastic.co/u/Matt_McGovern)\ **Replies:** 2\ **Last updated:** [June 11, 2021, 7:55pm UTC](https://discuss.elastic.co/t/can-watchers-write-to-an-elasticsearch-index/275597 "2021-06-11T19:55:21Z")
Is there any possibility in any of the new versions of kibana/elasticsearch, for a watcher to write to an elasticsearch index in an action? --- ## [Kibana uses the kbn-version and kbn-name headers to prevent XSRF attacks](https://discuss.elastic.co/t/kibana-uses-the-kbn-version-and-kbn-name-headers-to-prevent-xsrf-attacks/275665)
**Author:** [@ravi\_yadav2](https://discuss.elastic.co/u/ravi_yadav2)\ **Replies:** 2\ **Last updated:** [June 11, 2021, 7:36pm UTC](https://discuss.elastic.co/t/kibana-uses-the-kbn-version-and-kbn-name-headers-to-prevent-xsrf-attacks/275665 "2021-06-11T19:36:58Z")
Could anyone please explain how Kibana uses the kbn-version and kbn-name headers to prevent XSRF attacks. --- ## [How do I read data from influxdb](https://discuss.elastic.co/t/how-do-i-read-data-from-influxdb/275711)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 7:22pm UTC](https://discuss.elastic.co/t/how-do-i-read-data-from-influxdb/275711 "2021-06-11T19:22:52Z")
I have a need to read data from influxdb. anyone has done this before can you give me example of input plugin for that? --- ## [How to replace @timestamp field in logstash aggregate filter map](https://discuss.elastic.co/t/how-to-replace-timestamp-field-in-logstash-aggregate-filter-map/275708)
**Author:** [@jratliff](https://discuss.elastic.co/u/jratliff)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 7:13pm UTC](https://discuss.elastic.co/t/how-to-replace-timestamp-field-in-logstash-aggregate-filter-map/275708 "2021-06-11T19:13:49Z")
I'm using the logstash aggregate filter. When the map is pushed upon timeout, I want to set the @timestamp field to be a specific valu. I've tried using timeout\_code =\> event.set('@timestamp', "2021-06-10T19:00:00.000Z"… --- ## [Ingest Pipeline for routing data into 2 different indexes](https://discuss.elastic.co/t/ingest-pipeline-for-routing-data-into-2-different-indexes/228189)
**Author:** [@Mack\_rogers](https://discuss.elastic.co/u/Mack_rogers)\ **Replies:** 3\ **Last updated:** [June 11, 2021, 7:13pm UTC](https://discuss.elastic.co/t/ingest-pipeline-for-routing-data-into-2-different-indexes/228189 "2021-06-11T19:13:38Z")
How can you write into 2 different indexes using a ingest pipeline? Example. a single doc with fields a , b, c, and d ? index A will receive fields A & B index B will receive fields C & D How can I accomplish this wi… --- ## [Filebeat 7.6.1 - persistence of logs](https://discuss.elastic.co/t/filebeat-7-6-1-persistence-of-logs/274702)
**Author:** [@ramachandranmr88](https://discuss.elastic.co/u/ramachandranmr88)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 7:10pm UTC](https://discuss.elastic.co/t/filebeat-7-6-1-persistence-of-logs/274702 "2021-06-11T19:10:02Z")
I am new to using ELK. I have the following configuration: Filebeat—\>Logstash—\>Elasticsearch—\>Kibana. I have the following questions When filebeat service is stopped while Logstash is still running and later when f… --- ## [Console use to find new accounts created](https://discuss.elastic.co/t/console-use-to-find-new-accounts-created/275709)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 0\ **Last updated:** [June 11, 2021, 6:29pm UTC](https://discuss.elastic.co/t/console-use-to-find-new-accounts-created/275709 "2021-06-11T18:29:36Z")
Good Afternoon. I have now been using and testing Elastic Stack for over a month and have been able to get pretty far in it. I am working with WinLogBeats, FileBeats and MetricBeats (All at version 7.12.1)now and one … --- ## [Shards](https://discuss.elastic.co/t/shards/275554)
**Author:** [@Abhishek\_Shinde](https://discuss.elastic.co/u/Abhishek_Shinde)\ **Replies:** 3\ **Last updated:** [June 11, 2021, 6:14pm UTC](https://discuss.elastic.co/t/shards/275554 "2021-06-11T18:14:23Z")
I was referring to following for sizing the shards, I referred the following sections in the article, #Aim for shard sizes between 10GB and 50GB #Aim for 20 shards or fewer per GB of heap memory I wanted to understa… --- ## [Kv filter has no support for this type of data {:type=\>Hash, :value=\>{"METHODNAME"=\>](https://discuss.elastic.co/t/kv-filter-has-no-support-for-this-type-of-data-type-hash-value-methodname/275659)
**Author:** [@Chandana](https://discuss.elastic.co/u/Chandana)\ **Replies:** 2\ **Last updated:** [June 11, 2021, 5:56pm UTC](https://discuss.elastic.co/t/kv-filter-has-no-support-for-this-type-of-data-type-hash-value-methodname/275659 "2021-06-11T17:56:38Z")
Can some please help me to parse the below log, I need the key-value pairs in DEBUGMESSAGE as my fields. Here is my sample logs snippet: {"thread":"default task-131","TimeStamp":"06/08/2021:00:58:02,848-08:00","level":… --- ## [Force logstash to recreate/ update the same index](https://discuss.elastic.co/t/force-logstash-to-recreate-update-the-same-index/275705)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 0\ **Last updated:** [June 11, 2021, 5:23pm UTC](https://discuss.elastic.co/t/force-logstash-to-recreate-update-the-same-index/275705 "2021-06-11T17:23:50Z")
Hello. I need to force logstash to recreate (re-read) the "same" index and update it. Is there an option for that? Please guide for ELK stack 7.6.2 Thanks --- ## [Bulk index app search API](https://discuss.elastic.co/t/bulk-index-app-search-api/275684)
**Author:** [@Meurling](https://discuss.elastic.co/u/Meurling)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 5:13pm UTC](https://discuss.elastic.co/t/bulk-index-app-search-api/275684 "2021-06-11T17:13:51Z")
Hello! First and foremost I wonder if the bulk-API applies to Elastic AppSearch? If so, the bulk API for indexing requires data in the following format: { "index" : { "\_index" : "test", "\_id" : "1" } } { "field1" : "… --- ## [How to pass user credential to REST api?](https://discuss.elastic.co/t/how-to-pass-user-credential-to-rest-api/275562)
**Author:** [@Ashwin\_Srivastav](https://discuss.elastic.co/u/Ashwin_Srivastav)\ **Replies:** 5\ **Last updated:** [June 11, 2021, 4:44pm UTC](https://discuss.elastic.co/t/how-to-pass-user-credential-to-rest-api/275562 "2021-06-11T16:44:56Z")
I have coded a REST api which basically inserts, gets and updates the data from Elasticsearch. After implementing the basic security when I pass a curl command to the api providing credentials along with it (using -u), I… --- ## [Does ECK supports cert manger](https://discuss.elastic.co/t/does-eck-supports-cert-manger/275561)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 3\ **Last updated:** [June 11, 2021, 4:35pm UTC](https://discuss.elastic.co/t/does-eck-supports-cert-manger/275561 "2021-06-11T16:35:32Z")
Instead of operator generator certificates, Can we use cert manager to take care of certificates. I was following the below documentation Custom HTTP certificate | Elastic Cloud on Kubernetes \[1.6\] | Elastic. I have t… --- ## [Filtering Index or custom rules for Elastic ML anomaly detection](https://discuss.elastic.co/t/filtering-index-or-custom-rules-for-elastic-ml-anomaly-detection/275326)
**Author:** [@elizobee](https://discuss.elastic.co/u/elizobee)\ **Replies:** 5\ **Last updated:** [June 11, 2021, 4:22pm UTC](https://discuss.elastic.co/t/filtering-index-or-custom-rules-for-elastic-ml-anomaly-detection/275326 "2021-06-11T16:22:32Z")
I would like to run anomaly detection on a subset of an index. It looks like I am supposed to set up a filter list containing the values I wish to select, and then create a custom rule to associate a field with a filter… --- ## [Endpoint 7.12.x migration to 7.13 Lesson learned with Fleet "On-Prim"](https://discuss.elastic.co/t/endpoint-7-12-x-migration-to-7-13-lesson-learned-with-fleet-on-prim/274244)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 7\ **Last updated:** [June 11, 2021, 4:10pm UTC](https://discuss.elastic.co/t/endpoint-7-12-x-migration-to-7-13-lesson-learned-with-fleet-on-prim/274244 "2021-06-11T16:10:44Z")
EDIT: Use caution on 7.13 and laptops/tablets. Normal runtime on my test machines are 7 hours. With Endpoint 7.13 its down to 1.5 hours due to excessive CPU utilization. This is AMD and Intel platforms with current Win 1… [Previous page](https://discuss.elastic.co/latest.md?page=1626) [Next page](https://discuss.elastic.co/latest.md?page=1628)