# Latest **URL:** https://discuss.elastic.co/latest.md?page=1853 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1854 --- ## [Use the index name in a scripted field](https://discuss.elastic.co/t/use-the-index-name-in-a-scripted-field/263496)
**Author:** [@Shalhevet](https://discuss.elastic.co/u/Shalhevet)\ **Replies:** 2\ **Last updated:** [February 6, 2021, 3:52pm UTC](https://discuss.elastic.co/t/use-the-index-name-in-a-scripted-field/263496 "2021-02-06T15:52:47Z")
I want to create a scripted field in an index pattern which takes the first word of the index's name and concatenate to it another value. How can I access the name of the index via painless in the scripted field? for e… --- ## [My elsticsearch cannot start](https://discuss.elastic.co/t/my-elsticsearch-cannot-start/263494)
**Author:** [@baber1223](https://discuss.elastic.co/u/baber1223)\ **Replies:** 3\ **Last updated:** [February 6, 2021, 2:39pm UTC](https://discuss.elastic.co/t/my-elsticsearch-cannot-start/263494 "2021-02-06T14:39:20Z")
I have installed elasticsearch-1.7.2-1.noarch now due start service show follow error : \[root@testopenbank ~\]# Exception in thread "main" java.lang.NoClassDefFoundError: Could not initialize class org.elasticsearch.Vers… --- ## [Combine two fields into one via add\_fields](https://discuss.elastic.co/t/combine-two-fields-into-one-via-add-fields/263468)
**Author:** [@bascht](https://discuss.elastic.co/u/bascht)\ **Replies:** 2\ **Last updated:** [February 6, 2021, 12:48pm UTC](https://discuss.elastic.co/t/combine-two-fields-into-one-via-add-fields/263468 "2021-02-06T12:48:07Z")
Hey everyone. I am trying to achieve something seemingly simple but cannot get this to work with the latest Filebeat 7.10: I want to combine the two fields foo.bar and foo.baz into a single new field that just joins th… --- ## [Beginner questions on Supervised ML](https://discuss.elastic.co/t/beginner-questions-on-supervised-ml/262744)
**Author:** [@kvtang](https://discuss.elastic.co/u/kvtang)\ **Replies:** 4\ **Last updated:** [February 6, 2021, 11:37am UTC](https://discuss.elastic.co/t/beginner-questions-on-supervised-ml/262744 "2021-02-06T11:37:31Z")
Hi all, Sorry if this question has been asked somewhere previously but I couldn't find any relevant information. For supervised ML, during training phase, do we have to provide label for each event that is already in E… --- ## [Base documentaire, stockage video, images, son, pdf](https://discuss.elastic.co/t/base-documentaire-stockage-video-images-son-pdf/263488)
**Author:** [@Corben\_Dallas](https://discuss.elastic.co/u/Corben_Dallas)\ **Replies:** 1\ **Last updated:** [February 6, 2021, 9:08am UTC](https://discuss.elastic.co/t/base-documentaire-stockage-video-images-son-pdf/263488 "2021-02-06T09:08:23Z")
Bonjour, Petite question, y a t'il moyen de stocker un champ dans un document de type "blob" pour contenir des image, video,son, pdf, etc.., indexer par des mot clé de recherche, pour faire une base documentaire. pour t… --- ## [From Coveo to Elasticsearch](https://discuss.elastic.co/t/from-coveo-to-elasticsearch/263457)
**Author:** [@manideep](https://discuss.elastic.co/u/manideep)\ **Replies:** 3\ **Last updated:** [February 6, 2021, 5:03am UTC](https://discuss.elastic.co/t/from-coveo-to-elasticsearch/263457 "2021-02-06T05:03:04Z")
Dear Community, I have a web application built for enterprise search using Coveo. It has lot of sources (CSVs, Excel, Sharepoint, S3, APIs, etc.) indexed using default Coveo Connectors and few custom Connector written … --- ## [Best way to resolve this out of memory error in my ES Data Nodes](https://discuss.elastic.co/t/best-way-to-resolve-this-out-of-memory-error-in-my-es-data-nodes/263478)
**Author:** [@cis4life](https://discuss.elastic.co/u/cis4life)\ **Replies:** 2\ **Last updated:** [February 6, 2021, 4:04am UTC](https://discuss.elastic.co/t/best-way-to-resolve-this-out-of-memory-error-in-my-es-data-nodes/263478 "2021-02-06T04:04:57Z")
I have a cluster and now my data nodes are crashing. Looking over the logs i see this error. Its an out of memory error. Is there something i should set in the Elastic yml file to help lock memory? Add more data nodes… --- ## [How to export \`alerts\` as backup?](https://discuss.elastic.co/t/how-to-export-alerts-as-backup/261715)
**Author:** [@fzyzcjy](https://discuss.elastic.co/u/fzyzcjy)\ **Replies:** 12\ **Last updated:** [February 6, 2021, 3:58am UTC](https://discuss.elastic.co/t/how-to-export-alerts-as-backup/261715 "2021-02-06T03:58:02Z")
Hi thanks for the lib! I am trying to monitor my server by using monitoring and alerting. When, for example, CPU is too high or memory is almost full, I want to send an email to myself. Thus I use Kibana Alerting (is it … --- ## [Difference on dotted notation vs dictionary](https://discuss.elastic.co/t/difference-on-dotted-notation-vs-dictionary/263450)
**Author:** [@oskrdt](https://discuss.elastic.co/u/oskrdt)\ **Replies:** 2\ **Last updated:** [February 6, 2021, 3:00am UTC](https://discuss.elastic.co/t/difference-on-dotted-notation-vs-dictionary/263450 "2021-02-06T03:00:38Z")
I'm using a python script to populate data to elasticsearch using pandas to transform the data before the population. I was creating columns on pandas using dotted notation expecting that the elasticsearch index process… --- ## [Custom coloring in Kibana Visualize? e.g. the "failed" tag is red, "success" is green](https://discuss.elastic.co/t/custom-coloring-in-kibana-visualize-e-g-the-failed-tag-is-red-success-is-green/263346)
**Author:** [@fzyzcjy](https://discuss.elastic.co/u/fzyzcjy)\ **Replies:** 2\ **Last updated:** [February 6, 2021, 1:04am UTC](https://discuss.elastic.co/t/custom-coloring-in-kibana-visualize-e-g-the-failed-tag-is-red-success-is-green/263346 "2021-02-06T01:04:23Z")
Hi thanks for the lib! I wonder how can I custom the coloringin Kibana Visualize? e.g. the "failed" tag is red, "success" is green. Currently I cannot control it. See the following figure: where the "failed" and "suc… --- ## [Time of Day filter](https://discuss.elastic.co/t/time-of-day-filter/263277)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 4\ **Last updated:** [February 5, 2021, 11:20pm UTC](https://discuss.elastic.co/t/time-of-day-filter/263277 "2021-02-05T23:20:15Z")
I am trying to produce a dashboard that has some visualizations but also some data tables. In order to produce the results I need in the data tables, there are times that I must filter based on the time of day. For exa… --- ## [Cluster Health yellow because of unassigned shards](https://discuss.elastic.co/t/cluster-health-yellow-because-of-unassigned-shards/263459)
**Author:** [@maheshe](https://discuss.elastic.co/u/maheshe)\ **Replies:** 2\ **Last updated:** [February 5, 2021, 10:48pm UTC](https://discuss.elastic.co/t/cluster-health-yellow-because-of-unassigned-shards/263459 "2021-02-05T22:48:13Z")
The Cluster Health is yellow because of unassigned shards I have 1 master and 1 data node deployed through helm2 elastic repo. This is the getShards output, How can I turn cluster health to green by just having 1 master… --- ## [Swapping values within a field](https://discuss.elastic.co/t/swapping-values-within-a-field/263473)
**Author:** [@CoffeeDog](https://discuss.elastic.co/u/CoffeeDog)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 10:46pm UTC](https://discuss.elastic.co/t/swapping-values-within-a-field/263473 "2021-02-05T22:46:24Z")
I already have some data that is the following format: example\_field : test\_1,test\_2 I'd like to flip it to say example\_field: test\_2,test\_1 is painless the way to do this? Or should I leverage something else within … --- ## [Sum with negative fields (double type) strange result](https://discuss.elastic.co/t/sum-with-negative-fields-double-type-strange-result/263438)
**Author:** [@Maurip00](https://discuss.elastic.co/u/Maurip00)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 4:43pm UTC](https://discuss.elastic.co/t/sum-with-negative-fields-double-type-strange-result/263438 "2021-02-05T16:43:00Z")
There is someone that could me explain why by this simple aggregation: \> GET cfo1/\_search \> { \> "size": 0, \> "aggs": { \> "NAME": { \> "filter": {...}, \> "aggs": { \> … --- ## [ElasticSearch: L2 norm script\_score returns false distances](https://discuss.elastic.co/t/elasticsearch-l2-norm-script-score-returns-false-distances/257384)
**Author:** [@christiana](https://discuss.elastic.co/u/christiana)\ **Replies:** 1\ **Last updated:** [February 5, 2021, 9:57pm UTC](https://discuss.elastic.co/t/elasticsearch-l2-norm-script-score-returns-false-distances/257384 "2021-02-05T21:57:44Z")
i'm trying to calculate the L2-Norm between the fields of my database. To validate the correctness I setup a testing database with two documents, which are having equal vectors. My db look like this: Documents \_index:… --- ## [KQL to filter for documents where a field exists and its value is less than a fixed number?](https://discuss.elastic.co/t/kql-to-filter-for-documents-where-a-field-exists-and-its-value-is-less-than-a-fixed-number/262385)
**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\ **Replies:** 20\ **Last updated:** [February 5, 2021, 9:45pm UTC](https://discuss.elastic.co/t/kql-to-filter-for-documents-where-a-field-exists-and-its-value-is-less-than-a-fixed-number/262385 "2021-02-05T21:45:16Z")
In Kibana 7.7.1, is it possible to specify a KQL filter that selects only the documents where both of the following conditions are true: Field XYZ exists The value of field XYZ (the same field) is less than some fixed … --- ## [Intermittent exception using high-level-rest-client. Unable to load a DateTransformer](https://discuss.elastic.co/t/intermittent-exception-using-high-level-rest-client-unable-to-load-a-datetransformer/262375)
**Author:** [@Srikar\_Yekollu](https://discuss.elastic.co/u/Srikar_Yekollu)\ **Replies:** 10\ **Last updated:** [February 5, 2021, 9:29pm UTC](https://discuss.elastic.co/t/intermittent-exception-using-high-level-rest-client-unable-to-load-a-datetransformer/262375 "2021-02-05T21:29:42Z")
Elastic Search Version: 7.9.2 Client: Java: elasticsearch-rest-high-level-client We use elastic search on Kubernetes in AWS. We are noticing these errors sporadically in our server logs. When this happens, all searche… --- ## [Linux auditd to ECS mapping](https://discuss.elastic.co/t/linux-auditd-to-ecs-mapping/263150)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 0\ **Last updated:** [February 3, 2021, 4:48pm UTC](https://discuss.elastic.co/t/linux-auditd-to-ecs-mapping/263150 "2021-02-03T16:48:22Z")
hi We got data coming via syslog-\> logstash from certain Linux devices and don't have auditbeats. Is there a logstash pattern, where I can map the auditd fields to ECS (common schema) format? --- ## [Synthetic monitoring script handle multi-factor authentication](https://discuss.elastic.co/t/synthetic-monitoring-script-handle-multi-factor-authentication/263469)
**Author:** [@michael.shell](https://discuss.elastic.co/u/michael.shell)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 9:02pm UTC](https://discuss.elastic.co/t/synthetic-monitoring-script-handle-multi-factor-authentication/263469 "2021-02-05T21:02:04Z")
Can we write script that handle the use of a one time PIN via a soft token? Thanks, --- ## [Build constant score as sum of fields matching](https://discuss.elastic.co/t/build-constant-score-as-sum-of-fields-matching/263423)
**Author:** [@Maor\_Nissan](https://discuss.elastic.co/u/Maor_Nissan)\ **Replies:** 1\ **Last updated:** [February 5, 2021, 8:29pm UTC](https://discuss.elastic.co/t/build-constant-score-as-sum-of-fields-matching/263423 "2021-02-05T20:29:29Z")
hi, i have documents that have the following fields: title, gender,brand, category i want to run an exact query and score each hit with a constant score, lets say: title = 100, gender = 50, color = 200, category =… --- ## [Outils import export collection en python pour elasticsearch 2.3.x](https://discuss.elastic.co/t/outils-import-export-collection-en-python-pour-elasticsearch-2-3-x/263359)
**Author:** [@Corben\_Dallas](https://discuss.elastic.co/u/Corben_Dallas)\ **Replies:** 5\ **Last updated:** [February 5, 2021, 8:14pm UTC](https://discuss.elastic.co/t/outils-import-export-collection-en-python-pour-elasticsearch-2-3-x/263359 "2021-02-05T20:14:45Z")
Bonjour, Je cherche un outil en python pour faire un export import de collection sur un elastic 2.3.1, pour faire un backup, pas du npm, j'ai du python installé partout, c'est pas le cas du npm Est ce quelqu'un en co… --- ## [Using processor in Filebeat Nginx module](https://discuss.elastic.co/t/using-processor-in-filebeat-nginx-module/263368)
**Author:** [@jz1603](https://discuss.elastic.co/u/jz1603)\ **Replies:** 2\ **Last updated:** [February 5, 2021, 7:47pm UTC](https://discuss.elastic.co/t/using-processor-in-filebeat-nginx-module/263368 "2021-02-05T19:47:02Z")
I am trying to drop some fields on the indices ingested by the filebeat Nginx module. I followed the instructions on the thread https://discuss.elastic.co/t/how-to-use-processors-in-filebeat-haproxys-module/216256/3, bu… --- ## [ES Data node global metadata not found](https://discuss.elastic.co/t/es-data-node-global-metadata-not-found/263452)
**Author:** [@Gratien](https://discuss.elastic.co/u/Gratien)\ **Replies:** 3\ **Last updated:** [February 5, 2021, 7:42pm UTC](https://discuss.elastic.co/t/es-data-node-global-metadata-not-found/263452 "2021-02-05T19:42:04Z")
Hello everyone, I'm working on a marathon hosted cluster (7.6.2) which is not very stable sometimes. Occasionnaly when there is a host failure, I end up with the following on a data node : java.lang.IllegalStateExcept… --- ## [Nodes being dropped from cluster](https://discuss.elastic.co/t/nodes-being-dropped-from-cluster/263161)
**Author:** [@khuang](https://discuss.elastic.co/u/khuang)\ **Replies:** 7\ **Last updated:** [February 5, 2021, 7:20pm UTC](https://discuss.elastic.co/t/nodes-being-dropped-from-cluster/263161 "2021-02-05T19:20:04Z")
I am currently trying to set up a 17 node cluster. 3 master nodes - 4 vCPU, 12 GB RAM, 7 GB Heap 10 data nodes - 15 vCPU, 116 GB RAM, 32 GB Heap 3 ingest nodes - 7 vCPU, 8 GB RAM, 2 GB Heap (Is this enough?) 1 coordi… --- ## [Logstash HTTP input plugin](https://discuss.elastic.co/t/logstash-http-input-plugin/263456)
**Author:** [@TrentB2000](https://discuss.elastic.co/u/TrentB2000)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 6:57pm UTC](https://discuss.elastic.co/t/logstash-http-input-plugin/263456 "2021-02-05T18:57:01Z")
I am attempting to use the logstash HTTP input plugin with my Docker container that I am running Elk in. I am currently using Docker Compose to run my stack and in trying to follow this page (below) I have been unsuc… --- ## [Kibana specific dashboard show for users](https://discuss.elastic.co/t/kibana-specific-dashboard-show-for-users/263449)
**Author:** [@Shayan\_Delavarkhan](https://discuss.elastic.co/u/Shayan_Delavarkhan)\ **Replies:** 1\ **Last updated:** [February 5, 2021, 6:46pm UTC](https://discuss.elastic.co/t/kibana-specific-dashboard-show-for-users/263449 "2021-02-05T18:46:22Z")
Dear guys, I wanna set a permission for a user which can see only single specific dashboard instead of list of all dashboards. My question is that how can I achieve this view? thanks in advanced --- ## [GSUB & Regular Expression](https://discuss.elastic.co/t/gsub-regular-expression/263442)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 1\ **Last updated:** [February 5, 2021, 6:12pm UTC](https://discuss.elastic.co/t/gsub-regular-expression/263442 "2021-02-05T18:12:39Z")
I have a text field being ingested that I want to remove an email disclaimer from, unfortunately, I can't figure out the correct syntax to remove it. I've got the mutate filter setup in the following way: mutate { gs… --- ## [Elastic SIEM - Detection Rules - Combination of Time-based, Threshold, Aggregation and Sequence Events](https://discuss.elastic.co/t/elastic-siem-detection-rules-combination-of-time-based-threshold-aggregation-and-sequence-events/263175)
**Author:** [@tushar.bansal](https://discuss.elastic.co/u/tushar.bansal)\ **Replies:** 6\ **Last updated:** [February 5, 2021, 6:11pm UTC](https://discuss.elastic.co/t/elastic-siem-detection-rules-combination-of-time-based-threshold-aggregation-and-sequence-events/263175 "2021-02-05T18:11:20Z")
How to create rule to detect: "Successful Brute Force Attack" (When more than 10 Windows logout events (ID 4625) occur AND followed by a Windows login event (ID 4624) on a same host) in 5 minutes timespan Thresholds: N… --- ## [Elastic SIEM - Detection Rules - Multiple Thresholds in a Rule](https://discuss.elastic.co/t/elastic-siem-detection-rules-multiple-thresholds-in-a-rule/263411)
**Author:** [@tushar.bansal](https://discuss.elastic.co/u/tushar.bansal)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 3:11pm UTC](https://discuss.elastic.co/t/elastic-siem-detection-rules-multiple-thresholds-in-a-rule/263411 "2021-02-05T15:11:01Z")
Is there a way to apply multiple Thresholds in a single rule? example: More than 10 Identical event.actions on more than 10 destination.hostnames in a span of 10 minutes Threshold 1: Results aggregated by event.action… --- ## [Removal of mapping types in 7.x: why not include index aliases in results?](https://discuss.elastic.co/t/removal-of-mapping-types-in-7-x-why-not-include-index-aliases-in-results/263293)
**Author:** [@Thomas\_Doman](https://discuss.elastic.co/u/Thomas_Doman)\ **Replies:** 0\ **Last updated:** [February 4, 2021, 7:10pm UTC](https://discuss.elastic.co/t/removal-of-mapping-types-in-7-x-why-not-include-index-aliases-in-results/263293 "2021-02-04T19:10:56Z")
ES: 6.8.13 NEST: 6.8.6 We're preparing to upgrade to ES 7.x and are considering the type removal. We've reviewed the suggestions in Removal of mapping types. Since the 1.x days, we haven't had multiple types in any o… [Previous page](https://discuss.elastic.co/latest.md?page=1852) [Next page](https://discuss.elastic.co/latest.md?page=1854)