# Latest **URL:** https://discuss.elastic.co/latest.md?page=1725 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1726 --- ## [How to create a comma separated KQL filter of field values with a colon](https://discuss.elastic.co/t/how-to-create-a-comma-separated-kql-filter-of-field-values-with-a-colon/270487)
**Author:** [@DanielV](https://discuss.elastic.co/u/DanielV)\ **Replies:** 3\ **Last updated:** [April 19, 2021, 3:30pm UTC](https://discuss.elastic.co/t/how-to-create-a-comma-separated-kql-filter-of-field-values-with-a-colon/270487 "2021-04-19T15:30:28Z")
One of the fields of the index I'm querying is 'sessionid' , it also has a sessionid.keyword field variant. Values contain a colon. Examples: 136:11 99:5 What I'm trying to accomplish is a filter in the KQL-query bar… --- ## [How to make it work?!](https://discuss.elastic.co/t/how-to-make-it-work/270534)
**Author:** [@tennaen](https://discuss.elastic.co/u/tennaen)\ **Replies:** 2\ **Last updated:** [April 19, 2021, 2:58pm UTC](https://discuss.elastic.co/t/how-to-make-it-work/270534 "2021-04-19T14:58:43Z")
Dears, i have a problem and i cannot deal with it. In my pipeline configuration i have this code: if "%{\[process\]\[thread\]\[id\]}" =~ "\[a-z0-9\]+/\[a-z0-9\]+" { mutate { split =\> { "\[process\]\[thr… --- ## [Kibana with routing awareness](https://discuss.elastic.co/t/kibana-with-routing-awareness/270582)
**Author:** [@GabrielM](https://discuss.elastic.co/u/GabrielM)\ **Replies:** 4\ **Last updated:** [April 19, 2021, 2:38pm UTC](https://discuss.elastic.co/t/kibana-with-routing-awareness/270582 "2021-04-19T14:38:51Z")
Hello everyone, I just saw that ElasticSearch is able to route requests according to the attributes attached to the cluster nodes (Cluster-level shard allocation and routing settings | Elasticsearch Guide \[7.7\] | Elastic)… --- ## [Search keywords contain numbers](https://discuss.elastic.co/t/search-keywords-contain-numbers/270471)
**Author:** [@Amer\_Enaya](https://discuss.elastic.co/u/Amer_Enaya)\ **Replies:** 1\ **Last updated:** [April 19, 2021, 2:31pm UTC](https://discuss.elastic.co/t/search-keywords-contain-numbers/270471 "2021-04-19T14:31:11Z")
If I search for Milk 1.5 Liter, how can I show the results Milk 1.5L before Milk 2.5L --- ## [Reindex automatization - detection of failures / missing documents](https://discuss.elastic.co/t/reindex-automatization-detection-of-failures-missing-documents/270594)
**Author:** [@plachor](https://discuss.elastic.co/u/plachor)\ **Replies:** 0\ **Last updated:** [April 19, 2021, 2:13pm UTC](https://discuss.elastic.co/t/reindex-automatization-detection-of-failures-missing-documents/270594 "2021-04-19T14:13:59Z")
Hi, I'm trying to automatize reindex operation. I'm looking for a robust way to determine that my reindex operation was indeed successful before start using new indexes. I always start reindex as an asynchronous operatio… --- ## [Performance Issue with Elasticsearch 7.11.1 Cluster](https://discuss.elastic.co/t/performance-issue-with-elasticsearch-7-11-1-cluster/270592)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 0\ **Last updated:** [April 19, 2021, 2:03pm UTC](https://discuss.elastic.co/t/performance-issue-with-elasticsearch-7-11-1-cluster/270592 "2021-04-19T14:03:55Z")
Hi, We've had an issue show itself in recent days with one of our clusters. High level behaviour is as follows: Ingestion Rate has collapsed 504 errors reported by logstash One node showing exceptionally high load ave… --- ## [ML/Alerting for amount of successful transactions](https://discuss.elastic.co/t/ml-alerting-for-amount-of-successful-transactions/270114)
**Author:** [@mattvl](https://discuss.elastic.co/u/mattvl)\ **Replies:** 5\ **Last updated:** [April 19, 2021, 2:02pm UTC](https://discuss.elastic.co/t/ml-alerting-for-amount-of-successful-transactions/270114 "2021-04-19T14:02:54Z")
Hello, I would like to create some sort of alert that uses the ML capability to notify me if the successful transaction rate for a specific service is anomalous. For example: Let's assume the trend of successful trans… --- ## [Relative index time metrics?](https://discuss.elastic.co/t/relative-index-time-metrics/270583)
**Author:** [@alsyia](https://discuss.elastic.co/u/alsyia)\ **Replies:** 2\ **Last updated:** [April 19, 2021, 1:55pm UTC](https://discuss.elastic.co/t/relative-index-time-metrics/270583 "2021-04-19T13:55:11Z")
Hello, I'm running ESRally against an existing (test/staging) cluster (whose traffic I can stop if needed for the benchmark duration) and I would like to compare the resulting benchmark against a new, empty cluster. I'm… --- ## [%{\[Logs\]\[NET\] meaning](https://discuss.elastic.co/t/logs-net-meaning/270569)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 1\ **Last updated:** [April 19, 2021, 1:26pm UTC](https://discuss.elastic.co/t/logs-net-meaning/270569 "2021-04-19T13:26:51Z")
what is the meaning of index =\> "%{\[Logs\]\[NET\]-%{+YYYY.MM.dd}}" thanks --- ## [Synthetic Monitoring and progress inside Elastic Corp](https://discuss.elastic.co/t/synthetic-monitoring-and-progress-inside-elastic-corp/269828)
**Author:** [@Aiders](https://discuss.elastic.co/u/Aiders)\ **Replies:** 3\ **Last updated:** [April 19, 2021, 12:14pm UTC](https://discuss.elastic.co/t/synthetic-monitoring-and-progress-inside-elastic-corp/269828 "2021-04-19T12:14:18Z")
Hi Elastic people, Can you update where development is currently, is there any newer versions of the docker available for testing? Have some of the issues been resolved (in particular recording screens shots). Managem… --- ## [Addition and removal of URL in heartbeat.yml](https://discuss.elastic.co/t/addition-and-removal-of-url-in-heartbeat-yml/270572)
**Author:** [@Sujithra\_S](https://discuss.elastic.co/u/Sujithra_S)\ **Replies:** 1\ **Last updated:** [April 19, 2021, 12:12pm UTC](https://discuss.elastic.co/t/addition-and-removal-of-url-in-heartbeat-yml/270572 "2021-04-19T12:12:05Z")
Hello I have more than 200 url's to add into the heartbeat.yml, So that it will take more manual efforts. Is there any easiest way for adding and removing an url, Please help me to sort out this --- ## [Kibana Reports PDF export](https://discuss.elastic.co/t/kibana-reports-pdf-export/270477)
**Author:** [@prajganesh](https://discuss.elastic.co/u/prajganesh)\ **Replies:** 3\ **Last updated:** [April 19, 2021, 12:04pm UTC](https://discuss.elastic.co/t/kibana-reports-pdf-export/270477 "2021-04-19T12:04:22Z")
I'm having a basic Kibana for research purposes. How can I export Kibana dashboards to PDF? Is there any basic subscription for PDF export. I need it for On-prem and used only for personal development. Thanks for the he… --- ## [\[Filebeat 7.12\] \[Windows\] Failed to open store 'filebeat' after incorrect Windows reboot](https://discuss.elastic.co/t/filebeat-7-12-windows-failed-to-open-store-filebeat-after-incorrect-windows-reboot/270145)
**Author:** [@akelio](https://discuss.elastic.co/u/akelio)\ **Replies:** 2\ **Last updated:** [April 19, 2021, 12:01pm UTC](https://discuss.elastic.co/t/filebeat-7-12-windows-failed-to-open-store-filebeat-after-incorrect-windows-reboot/270145 "2021-04-19T12:01:32Z")
Hi! Filebeat 7.12 (x86) on Windows machine cannot start after incorrect OS reboot (possibly after power supply lost). Log shows that registry data files are corrupted. The only way I found to manually start filebeat is… --- ## [How to graph collapse search results?](https://discuss.elastic.co/t/how-to-graph-collapse-search-results/270349)
**Author:** [@Glen\_Ogilvie](https://discuss.elastic.co/u/Glen_Ogilvie)\ **Replies:** 1\ **Last updated:** [April 19, 2021, 11:59am UTC](https://discuss.elastic.co/t/how-to-graph-collapse-search-results/270349 "2021-04-19T11:59:47Z")
I've written a search that uses collapse: To get the latest records from a time series, that I would then like to graph. I can't however find a reasonable way in Kibana to do this, with the best I've found is the top\_… --- ## [Filebeats high IO WAIT version 7.9.2](https://discuss.elastic.co/t/filebeats-high-io-wait-version-7-9-2/270575)
**Author:** [@Ankur\_Mahajan](https://discuss.elastic.co/u/Ankur_Mahajan)\ **Replies:** 0\ **Last updated:** [April 19, 2021, 11:26am UTC](https://discuss.elastic.co/t/filebeats-high-io-wait-version-7-9-2/270575 "2021-04-19T11:26:07Z")
We are randomly facing a weird issue of IO wait with filebeat 7.9.2. We have around 30 filebeat, metricbeat and heartbeat pipeline to an elasticsearch cluster. I searched this a lot but couldn't find a solution. The ugl… --- ## [Error in Elasticsearch master pod that FileSystemException: /data/log: Input/output error](https://discuss.elastic.co/t/error-in-elasticsearch-master-pod-that-filesystemexception-data-log-input-output-error/270379)
**Author:** [@subha1](https://discuss.elastic.co/u/subha1)\ **Replies:** 2\ **Last updated:** [April 19, 2021, 11:15am UTC](https://discuss.elastic.co/t/error-in-elasticsearch-master-pod-that-filesystemexception-data-log-input-output-error/270379 "2021-04-19T11:15:59Z")
I found the below error logs in Elasticsearch master pod logs- Caused by: java.lang.IllegalStateException: Unable to access 'path.logs' (/data/log) at org.elasticsearch.bootstrap.FilePermissionUtils.addDirector… --- ## [How to delete a mapping field of an index?](https://discuss.elastic.co/t/how-to-delete-a-mapping-field-of-an-index/270371)
**Author:** [@KeithTt](https://discuss.elastic.co/u/KeithTt)\ **Replies:** 2\ **Last updated:** [April 19, 2021, 11:12am UTC](https://discuss.elastic.co/t/how-to-delete-a-mapping-field-of-an-index/270371 "2021-04-19T11:12:34Z")
I followed this page: Update mapping API | Elasticsearch Guide \[master\] | Elastic It seems ES does not support delete a mapping field directly? --- ## [How to reflect the DELETE operations in ES logs](https://discuss.elastic.co/t/how-to-reflect-the-delete-operations-in-es-logs/270564)
**Author:** [@yuriy.kasterin](https://discuss.elastic.co/u/yuriy.kasterin)\ **Replies:** 0\ **Last updated:** [April 19, 2021, 10:35am UTC](https://discuss.elastic.co/t/how-to-reflect-the-delete-operations-in-es-logs/270564 "2021-04-19T10:35:03Z")
Hello. I have an issue on ES server that an old records are constantly disappear from the server after 15 days. I have checked all the relevant logs related to an application that indexes a new records into ES server a… --- ## [Elasticsearch deletes my index out of nowhere](https://discuss.elastic.co/t/elasticsearch-deletes-my-index-out-of-nowhere/270551)
**Author:** [@Nikolaj\_Karpov](https://discuss.elastic.co/u/Nikolaj_Karpov)\ **Replies:** 5\ **Last updated:** [April 19, 2021, 10:27am UTC](https://discuss.elastic.co/t/elasticsearch-deletes-my-index-out-of-nowhere/270551 "2021-04-19T10:27:18Z")
I have Elasticsearch server on AWS . And every now and then my Elasticsearch index is being somehow deleted without me doing anything. Below are the logs from my Elasticsearch server. \[2021-04-19T01:30:00,001\]\[INFO… --- ## [How to sort my time field in descending order with size 1 to get graph with only the latest documents?](https://discuss.elastic.co/t/how-to-sort-my-time-field-in-descending-order-with-size-1-to-get-graph-with-only-the-latest-documents/270494)
**Author:** [@Shalhevet](https://discuss.elastic.co/u/Shalhevet)\ **Replies:** 2\ **Last updated:** [April 19, 2021, 10:24am UTC](https://discuss.elastic.co/t/how-to-sort-my-time-field-in-descending-order-with-size-1-to-get-graph-with-only-the-latest-documents/270494 "2021-04-19T10:24:29Z")
Hi. I have Vega-lite code for a graph in kibana. I need to sort my time field in descending order with size 1 in order to get the documents belonging to the latest time. I know I need to use the following lines, but I… --- ## [Find all documents containing array object field of size 0 or more](https://discuss.elastic.co/t/find-all-documents-containing-array-object-field-of-size-0-or-more/270562)
**Author:** [@dheeru4elastic](https://discuss.elastic.co/u/dheeru4elastic)\ **Replies:** 0\ **Last updated:** [April 19, 2021, 9:53am UTC](https://discuss.elastic.co/t/find-all-documents-containing-array-object-field-of-size-0-or-more/270562 "2021-04-19T09:53:14Z")
Please find below the sample documents that I have in my elasticsearch 7.7.0. How can i build a optimize query to fetch all the documents that contains the array field problemInvestigations . As you can see some document… --- ## [Hiding irrelevant results](https://discuss.elastic.co/t/hiding-irrelevant-results/270470)
**Author:** [@Amer\_Enaya](https://discuss.elastic.co/u/Amer_Enaya)\ **Replies:** 1\ **Last updated:** [April 19, 2021, 9:35am UTC](https://discuss.elastic.co/t/hiding-irrelevant-results/270470 "2021-04-19T09:35:43Z")
Is there any way to hide irrelevant search results based on the result calculated score ? --- ## [Aws plugin installation problem](https://discuss.elastic.co/t/aws-plugin-installation-problem/270085)
**Author:** [@Weathmious](https://discuss.elastic.co/u/Weathmious)\ **Replies:** 20\ **Last updated:** [April 19, 2021, 9:23am UTC](https://discuss.elastic.co/t/aws-plugin-installation-problem/270085 "2021-04-19T09:23:06Z")
Hello, In order to send my elasticsearch indexes to aws S3, I find myself having to install the aws-cloud plugin on my server For that, I have to enter this order while being in the file /usr/share/elasticsearch: sudo… --- ## [Support for getting API mapping in parameterized URLs](https://discuss.elastic.co/t/support-for-getting-api-mapping-in-parameterized-urls/270556)
**Author:** [@bimanarajesh](https://discuss.elastic.co/u/bimanarajesh)\ **Replies:** 0\ **Last updated:** [April 19, 2021, 9:05am UTC](https://discuss.elastic.co/t/support-for-getting-api-mapping-in-parameterized-urls/270556 "2021-04-19T09:05:11Z")
Elasticsearch version: 6.8.4 APM Server version: 7.6.0 APM Agent language and version: python 2.x Original install method (e.g. download page, yum, deb, from source, etc.) and version : Download page Fresh instal… --- ## [Snmp mib yamlmibdir](https://discuss.elastic.co/t/snmp-mib-yamlmibdir/270554)
**Author:** [@elastic\_study](https://discuss.elastic.co/u/elastic_study)\ **Replies:** 0\ **Last updated:** [April 19, 2021, 9:02am UTC](https://discuss.elastic.co/t/snmp-mib-yamlmibdir/270554 "2021-04-19T09:02:07Z")
How to convert a vendor mib file to an yaml mib ？ Is there any other tool？ --- ## [Shrink action turns cluster to yellow state](https://discuss.elastic.co/t/shrink-action-turns-cluster-to-yellow-state/270553)
**Author:** [@d4nnyx](https://discuss.elastic.co/u/d4nnyx)\ **Replies:** 0\ **Last updated:** [April 19, 2021, 8:51am UTC](https://discuss.elastic.co/t/shrink-action-turns-cluster-to-yellow-state/270553 "2021-04-19T08:51:08Z")
Hello, in our cluster we manage about 10K indices, all with ILM and every shrink action turns the cluster to yellow state, which is really annoying, because of our monitoring of cluster state. Is there any way to change… --- ## [Detection rule CLI error](https://discuss.elastic.co/t/detection-rule-cli-error/270333)
**Author:** [@Nil\_Battey\_Sannata](https://discuss.elastic.co/u/Nil_Battey_Sannata)\ **Replies:** 1\ **Last updated:** [April 19, 2021, 7:59am UTC](https://discuss.elastic.co/t/detection-rule-cli-error/270333 "2021-04-19T07:59:31Z")
Hi, I am trying to import Detection RUles with CLI but facing errors as per attached snapshot. I am using self signed cert. --- ## [Why elasticsearch mapping conflicts?](https://discuss.elastic.co/t/why-elasticsearch-mapping-conflicts/270544)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 0\ **Last updated:** [April 19, 2021, 7:49am UTC](https://discuss.elastic.co/t/why-elasticsearch-mapping-conflicts/270544 "2021-04-19T07:49:31Z")
I am facing some issues in elasticsearch mapping.Although i have check the forum the solution is reindexing but why? GET \_template/winlogbeat\_sysmon { "winlogbeat\_sysmon" : { "order" : 0, "index\_patterns" : \[ … --- ## [Could not index event to elasticsearch maximum shards open](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-maximum-shards-open/270524)
**Author:** [@TrAMT](https://discuss.elastic.co/u/TrAMT)\ **Replies:** 3\ **Last updated:** [April 19, 2021, 7:47am UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-maximum-shards-open/270524 "2021-04-19T07:47:06Z")
Hi I have problem with Elasticsearch and Logstash. Here is the detail of log: Apr 16 13:01:24 elastic7-logstash logstash\[980\]: \[2021-04-16T13:01:24,828\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index event to E… --- ## [Template mapping not being applied](https://discuss.elastic.co/t/template-mapping-not-being-applied/269848)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 5\ **Last updated:** [April 19, 2021, 7:41am UTC](https://discuss.elastic.co/t/template-mapping-not-being-applied/269848 "2021-04-19T07:41:56Z")
Hello I am currently setting a mapping in my template but it seems to not be working. My work flow is basically Data -\> Logstash -\> Elasticsearch In Logstash, I do NOT set a template SO it gets the default, which is … [Previous page](https://discuss.elastic.co/latest.md?page=1724) [Next page](https://discuss.elastic.co/latest.md?page=1726)