# Latest **URL:** https://discuss.elastic.co/latest.md?page=1852 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1853 --- ## [Match\_phrase is not working with keep\_words\_filter in percolator index](https://discuss.elastic.co/t/match-phrase-is-not-working-with-keep-words-filter-in-percolator-index/263557)
**Author:** [@Dahea\_Moon](https://discuss.elastic.co/u/Dahea_Moon)\ **Replies:** 0\ **Last updated:** [February 8, 2021, 8:27am UTC](https://discuss.elastic.co/t/match-phrase-is-not-working-with-keep-words-filter-in-percolator-index/263557 "2021-02-08T08:27:55Z")
Hi, elastic team. I'm working on percolator index with match\_phrase query and keep\_words\_filter. I found that match\_phrase query is not working properly with keep\_words\_filter. I've tried both match\_phrase query and s… --- ## [Kibana Query DSL Sorting and size does not work](https://discuss.elastic.co/t/kibana-query-dsl-sorting-and-size-does-not-work/263078)
**Author:** [@Sudarshan\_Reddy](https://discuss.elastic.co/u/Sudarshan_Reddy)\ **Replies:** 4\ **Last updated:** [February 8, 2021, 7:14am UTC](https://discuss.elastic.co/t/kibana-query-dsl-sorting-and-size-does-not-work/263078 "2021-02-08T07:14:27Z")
Hi , how to make sorting works in kibana Query DSL . i am using the following script. --- ## [Whether to allow the profile to be opened on every query request](https://discuss.elastic.co/t/whether-to-allow-the-profile-to-be-opened-on-every-query-request/263540)
**Author:** [@asasas234](https://discuss.elastic.co/u/asasas234)\ **Replies:** 12\ **Last updated:** [February 8, 2021, 7:05am UTC](https://discuss.elastic.co/t/whether-to-allow-the-profile-to-be-opened-on-every-query-request/263540 "2021-02-08T07:05:29Z")
I want to turn on profile for each elasticsearch query request in my system, so that I can get the profile results to print the logs, combined with traceId, I can get what the reason for each slow request is, but I am wo… --- ## [Unable to connect enterprise search running through docker to elastic search instance running in AWS](https://discuss.elastic.co/t/unable-to-connect-enterprise-search-running-through-docker-to-elastic-search-instance-running-in-aws/262954)
**Author:** [@schawla](https://discuss.elastic.co/u/schawla)\ **Replies:** 7\ **Last updated:** [February 8, 2021, 6:57am UTC](https://discuss.elastic.co/t/unable-to-connect-enterprise-search-running-through-docker-to-elastic-search-instance-running-in-aws/262954 "2021-02-08T06:57:53Z")
Trying to run enterprise search through docker using following docker-compose.yml --- version: '2.2' services: enterprisesearch: image: docker.elastic.co/enterprise-search/enterprise-search:7.10.2 environmen… --- ## [How can use 'org.elasticsearch.spark.sql' with kerberos to read es data](https://discuss.elastic.co/t/how-can-use-org-elasticsearch-spark-sql-with-kerberos-to-read-es-data/263548)
**Author:** [@wenyangchou](https://discuss.elastic.co/u/wenyangchou)\ **Replies:** 0\ **Last updated:** [February 8, 2021, 6:39am UTC](https://discuss.elastic.co/t/how-can-use-org-elasticsearch-spark-sql-with-kerberos-to-read-es-data/263548 "2021-02-08T06:39:22Z")
I have tried use es-hadoop to read a elasticsearch which had configured kerberos. I have a reference to this https://www.elastic.co/guide/en/elasticsearch/hadoop/7.x/kerberos.html but not success. Is there any example I … --- ## [How to add nested datatype using Java api?](https://discuss.elastic.co/t/how-to-add-nested-datatype-using-java-api/263542)
**Author:** [@rohit.singh3](https://discuss.elastic.co/u/rohit.singh3)\ **Replies:** 0\ **Last updated:** [February 8, 2021, 5:20am UTC](https://discuss.elastic.co/t/how-to-add-nested-datatype-using-java-api/263542 "2021-02-08T05:20:44Z")
Below is the sample snippet: "price":{ "type":"nested", --\> how to add this nested type? "properties":{ "activity\_price":{ "type":"double" }, … --- ## [How calculate session duration script field](https://discuss.elastic.co/t/how-calculate-session-duration-script-field/263313)
**Author:** [@ITchandj](https://discuss.elastic.co/u/ITchandj)\ **Replies:** 1\ **Last updated:** [February 8, 2021, 5:24am UTC](https://discuss.elastic.co/t/how-calculate-session-duration-script-field/263313 "2021-02-08T05:24:06Z")
Hi @Havana i am new to kibana and i need to create exactly one table that gives me the min and max of a session. please can you tell me how you did it. i would be very happy and thank you in advance --- ## [Help please.. to acchive json format](https://discuss.elastic.co/t/help-please-to-acchive-json-format/263330)
**Author:** [@onkarborade](https://discuss.elastic.co/u/onkarborade)\ **Replies:** 2\ **Last updated:** [February 8, 2021, 5:06am UTC](https://discuss.elastic.co/t/help-please-to-acchive-json-format/263330 "2021-02-08T05:06:05Z")
I have rosterentry field as bellow rosterentry = "100,01-JUL-20,01-AUG-22|100,02-JUL-20,02-AUG-22|101,03-JUL-19,03-AUG-19" I have converted to : rosterentry = \[ "100,01-JUL-20,01-AUG-22", … --- ## [X-axis is not visible in vega kibana while calling through index](https://discuss.elastic.co/t/x-axis-is-not-visible-in-vega-kibana-while-calling-through-index/263088)
**Author:** [@saumya1](https://discuss.elastic.co/u/saumya1)\ **Replies:** 2\ **Last updated:** [February 8, 2021, 4:59am UTC](https://discuss.elastic.co/t/x-axis-is-not-visible-in-vega-kibana-while-calling-through-index/263088 "2021-02-08T04:59:47Z")
{ "$schema": "https://vega.github.io/schema/vega/v5.json", "autosize":"none", "height":"350", "width":"300", "padding":"30" "title": { "text": "Sample incident data", "subtitle": "timeunit test", "subtitleFontSt… --- ## [Shrink shards not respecting node settings 7.10.0](https://discuss.elastic.co/t/shrink-shards-not-respecting-node-settings-7-10-0/262883)
**Author:** [@nz-1](https://discuss.elastic.co/u/nz-1)\ **Replies:** 1\ **Last updated:** [February 8, 2021, 4:49am UTC](https://discuss.elastic.co/t/shrink-shards-not-respecting-node-settings-7-10-0/262883 "2021-02-08T04:49:44Z")
I have a 5 node cluster with 4 nodes as the data\_warm, data\_hot and 1 node as the cold storage. When ES goes to shrink the node I see on some of the indexes it chooses the cold storage node (dx6MirFmT2y9AdXEF02pDw) whic… --- ## [Transforming into JSON-Documents](https://discuss.elastic.co/t/transforming-into-json-documents/262884)
**Author:** [@Werner](https://discuss.elastic.co/u/Werner)\ **Replies:** 9\ **Last updated:** [February 8, 2021, 4:48am UTC](https://discuss.elastic.co/t/transforming-into-json-documents/262884 "2021-02-08T04:48:33Z")
Hello ! I am an absolute beginner in elasticsearch and after some hours of reading an watching tutorial-videos I got the impression, that it needs a lot of knowledge and preparation, before I can make a fast search. In… --- ## [Questions on getting started with ELK](https://discuss.elastic.co/t/questions-on-getting-started-with-elk/263194)
**Author:** [@Anita2](https://discuss.elastic.co/u/Anita2)\ **Replies:** 3\ **Last updated:** [February 8, 2021, 4:46am UTC](https://discuss.elastic.co/t/questions-on-getting-started-with-elk/263194 "2021-02-08T04:46:28Z")
For reference, I have followed this guide to get me started: Hello, I'm extremely new to ELK, as in I have just now installed everything, as I will be needing it for a research project. My current goal is to be able t… --- ## [What does this error mean, and would it cause a data node to crash](https://discuss.elastic.co/t/what-does-this-error-mean-and-would-it-cause-a-data-node-to-crash/263173)
**Author:** [@cis4life](https://discuss.elastic.co/u/cis4life)\ **Replies:** 7\ **Last updated:** [February 8, 2021, 4:45am UTC](https://discuss.elastic.co/t/what-does-this-error-mean-and-would-it-cause-a-data-node-to-crash/263173 "2021-02-08T04:45:21Z")
I have a cluster on ES 5.x and suddenly some of the data nodes simply crash randomly. I see this error and want to know what it is and is this something I'm overlooking to fix it??? Any insight would be GREATLY appreci… --- ## [How to pass a variable to elasticsearch query javascript](https://discuss.elastic.co/t/how-to-pass-a-variable-to-elasticsearch-query-javascript/263536)
**Author:** [@adonnini](https://discuss.elastic.co/u/adonnini)\ **Replies:** 0\ **Last updated:** [February 8, 2021, 3:07am UTC](https://discuss.elastic.co/t/how-to-pass-a-variable-to-elasticsearch-query-javascript/263536 "2021-02-08T03:07:13Z")
Hi, I am a nebie to ElasticSearch. I have searched for an answer to this question before making this post. I am trying to run an ElasticSearch query from a JavaScript app using a variable for the search string. I have … --- ## [Format metricbeat field value in watcher alert](https://discuss.elastic.co/t/format-metricbeat-field-value-in-watcher-alert/263306)
**Author:** [@twilight](https://discuss.elastic.co/u/twilight)\ **Replies:** 6\ **Last updated:** [February 8, 2021, 3:05am UTC](https://discuss.elastic.co/t/format-metricbeat-field-value-in-watcher-alert/263306 "2021-02-08T03:05:23Z")
Hello, I am using a number of watcher with various conditions and alert to be sent via email and slack. I am receiving some values in the alert which are not easily readable e.g. disk free space which is sent by metric… --- ## [If else condition with logstash filter](https://discuss.elastic.co/t/if-else-condition-with-logstash-filter/263517)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 3\ **Last updated:** [February 7, 2021, 3:24pm UTC](https://discuss.elastic.co/t/if-else-condition-with-logstash-filter/263517 "2021-02-07T15:24:13Z")
Hi Folks, I am trying to achive certain conditions with logstash and wondering \\if - if-else statement or validation is possible in Logstash filter? I have below messages in json and parsing DMARC logs with logstash. I… --- ## [Get subset of values that exist for a given search](https://discuss.elastic.co/t/get-subset-of-values-that-exist-for-a-given-search/263523)
**Author:** [@cozzbp](https://discuss.elastic.co/u/cozzbp)\ **Replies:** 0\ **Last updated:** [February 7, 2021, 2:25pm UTC](https://discuss.elastic.co/t/get-subset-of-values-that-exist-for-a-given-search/263523 "2021-02-07T14:25:20Z")
Is it possible to query for which values of a given set are represented/not represented in the data set? If I have documents that look like: { "category": "fiction", "tags": \["horror", "thriller"\] }… --- ## [Force Read few files from start when filebeat restarts](https://discuss.elastic.co/t/force-read-few-files-from-start-when-filebeat-restarts/263362)
**Author:** [@rsgupta0110](https://discuss.elastic.co/u/rsgupta0110)\ **Replies:** 2\ **Last updated:** [February 7, 2021, 1:49pm UTC](https://discuss.elastic.co/t/force-read-few-files-from-start-when-filebeat-restarts/263362 "2021-02-07T13:49:48Z")
Filebeat maintains the registry and just uploads new logs between filebeat restarts. Is there a way to specify to read few log files from beginning everytime filebeat restarts while maintaining the registry for other fil… --- ## [How to monitor a file for its version, code signature etc](https://discuss.elastic.co/t/how-to-monitor-a-file-for-its-version-code-signature-etc/263178)
**Author:** [@rsgupta0110](https://discuss.elastic.co/u/rsgupta0110)\ **Replies:** 2\ **Last updated:** [February 7, 2021, 1:29pm UTC](https://discuss.elastic.co/t/how-to-monitor-a-file-for-its-version-code-signature-etc/263178 "2021-02-07T13:29:15Z")
I would like to monitor files inside a directory for the file description like version, code signature etc. without uploading the files to Elastic Search. I found this File fields but not sure how to add these fields in… --- ## [Syslog filter for IP](https://discuss.elastic.co/t/syslog-filter-for-ip/263512)
**Author:** [@dandotwalker](https://discuss.elastic.co/u/dandotwalker)\ **Replies:** 3\ **Last updated:** [February 7, 2021, 9:57am UTC](https://discuss.elastic.co/t/syslog-filter-for-ip/263512 "2021-02-07T09:57:01Z")
Hi, I am learning Elastic so I have set it up in my home to prepare for when we start designing it at work. I have a simple set up where logstash is listening for syslog messages. It works great with most hosts but my … --- ## [Elasticsearch master node start failed. There is insufficient memory for the Java Runtime Environment to continue](https://discuss.elastic.co/t/elasticsearch-master-node-start-failed-there-is-insufficient-memory-for-the-java-runtime-environment-to-continue/263520)
**Author:** [@Jinlian\_Chen](https://discuss.elastic.co/u/Jinlian_Chen)\ **Replies:** 0\ **Last updated:** [February 7, 2021, 9:16am UTC](https://discuss.elastic.co/t/elasticsearch-master-node-start-failed-there-is-insufficient-memory-for-the-java-runtime-environment-to-continue/263520 "2021-02-07T09:16:51Z")
I have setup a elasticsearch cluster with 3 master node and 2 data node on k8s. While start master node , it failed. System config: ulimit -n 65535 ulimit -l unlimited sysctl -w vm.max\_map\_count=262144 sysctl -w vm.ove… --- ## [Logstash SPLIT plugin help](https://discuss.elastic.co/t/logstash-split-plugin-help/263462)
**Author:** [@Zdeno\_Liska](https://discuss.elastic.co/u/Zdeno_Liska)\ **Replies:** 5\ **Last updated:** [February 7, 2021, 12:51am UTC](https://discuss.elastic.co/t/logstash-split-plugin-help/263462 "2021-02-07T00:51:11Z")
Hi, I would like to ask thing about Split plugin. I have event like: {"name":"JASON", "phones":\[{ "mark":"Nokia", "model":"3310"},{"mark":"Apple","model":"12 Pro"}\]} I use clone, and want object like: {"name":"JAS… --- ## [Coordinating node](https://discuss.elastic.co/t/coordinating-node/263510)
**Author:** [@leemase004](https://discuss.elastic.co/u/leemase004)\ **Replies:** 2\ **Last updated:** [February 7, 2021, 12:39am UTC](https://discuss.elastic.co/t/coordinating-node/263510 "2021-02-07T00:39:31Z")
I know data nodes can act as coordinating nodes if one is not set; but, if I set up a designated coordinating-only node does that mean the data nodes will completely stop performing the coordinating function? Or will the… --- ## [Elasticsearch Nodes Crash After Attempt to Create Scripted Filed](https://discuss.elastic.co/t/elasticsearch-nodes-crash-after-attempt-to-create-scripted-filed/263179)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 3\ **Last updated:** [February 6, 2021, 11:33pm UTC](https://discuss.elastic.co/t/elasticsearch-nodes-crash-after-attempt-to-create-scripted-filed/263179 "2021-02-06T23:33:05Z")
Hello Community, I am trying to create a scripted field. I want to parse a string into a date format. I have created the following script DateTimeFormatter formatter = DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss… --- ## [Question in elastic search to get specific records with specific date and time range](https://discuss.elastic.co/t/question-in-elastic-search-to-get-specific-records-with-specific-date-and-time-range/261217)
**Author:** [@Kin\_Wan](https://discuss.elastic.co/u/Kin_Wan)\ **Replies:** 8\ **Last updated:** [February 6, 2021, 11:32pm UTC](https://discuss.elastic.co/t/question-in-elastic-search-to-get-specific-records-with-specific-date-and-time-range/261217 "2021-02-06T23:32:28Z")
Hello all, I would like to perform a query to get last weeks records on our log which the record are within Mon-Fri from (19:00-07:00) and Sat from (15:00-00:00) and full day on Sunday. How should I write the query? Than… --- ## [Securing Elasticsearch cluster](https://discuss.elastic.co/t/securing-elasticsearch-cluster/263509)
**Author:** [@ehsan\_kabiri\_33](https://discuss.elastic.co/u/ehsan_kabiri_33)\ **Replies:** 2\ **Last updated:** [February 6, 2021, 11:24pm UTC](https://discuss.elastic.co/t/securing-elasticsearch-cluster/263509 "2021-02-06T23:24:13Z")
I have a 3 nodes cluster in my local VM ware workstation. I followed the instructions on below to make my Elasticsearch 7.10 secure: configuring-security getting-started-with-elasticsearch-security I could complete th… --- ## [Error when build kibana 7.7 from source code](https://discuss.elastic.co/t/error-when-build-kibana-7-7-from-source-code/263502)
**Author:** [@Thien\_Hoang](https://discuss.elastic.co/u/Thien_Hoang)\ **Replies:** 2\ **Last updated:** [February 6, 2021, 11:13pm UTC](https://discuss.elastic.co/t/error-when-build-kibana-7-7-from-source-code/263502 "2021-02-06T23:13:51Z")
I get error about module 'static-extend' when build kibana from branch 7.7 version 7.7.2 run yarn kbn bootstrap F:\\Project\\kibana\>yarn kbn bootstrap yarn run v1.22.4 $ node scripts/kbn bootstrap F:\\Project\\kibana\\packa… --- ## [Service Map not linking services](https://discuss.elastic.co/t/service-map-not-linking-services/262096)
**Author:** [@jhai](https://discuss.elastic.co/u/jhai)\ **Replies:** 4\ **Last updated:** [February 6, 2021, 7:31pm UTC](https://discuss.elastic.co/t/service-map-not-linking-services/262096 "2021-02-06T19:31:39Z")
Kibana version: 7.9 Elasticsearch version: 7.9 APM Server version: 7.10 APM Agent language and version: Elastic.Apm.AspNetCore 1.7.1 Browser version: Chrome 87 Original install method (e.g. download page, yum, deb, … --- ## [Question on what Elasticsearch considers data vs logs](https://discuss.elastic.co/t/question-on-what-elasticsearch-considers-data-vs-logs/263506)
**Author:** [@halfbakedprod](https://discuss.elastic.co/u/halfbakedprod)\ **Replies:** 1\ **Last updated:** [February 6, 2021, 6:10pm UTC](https://discuss.elastic.co/t/question-on-what-elasticsearch-considers-data-vs-logs/263506 "2021-02-06T18:10:12Z")
Hello all, I just setup Graylog + Elasticsearch for my first time. I'm trying to change the default location that ingested logs are saved. Currently, the default filepath is the OS drive, which will fill up in no time. … --- ## [Cluster with mix of cloud and self hosted](https://discuss.elastic.co/t/cluster-with-mix-of-cloud-and-self-hosted/263489)
**Author:** [@efftee](https://discuss.elastic.co/u/efftee)\ **Replies:** 2\ **Last updated:** [February 6, 2021, 5:35pm UTC](https://discuss.elastic.co/t/cluster-with-mix-of-cloud-and-self-hosted/263489 "2021-02-06T17:35:53Z")
Hi Are there any difficulties or limitations to have a cluster of instances mixing cloud-hosted Elasticsearch with self-hosted instances ? I have a main cloud instance, hosted by Elasticsearch. And I am wondering if it… [Previous page](https://discuss.elastic.co/latest.md?page=1851) [Next page](https://discuss.elastic.co/latest.md?page=1853)