# Latest **URL:** https://discuss.elastic.co/latest.md?page=1965 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1966 --- ## [Not properly formated XML](https://discuss.elastic.co/t/not-properly-formated-xml/257003)
**Author:** [@shani](https://discuss.elastic.co/u/shani)\ **Replies:** 0\ **Last updated:** [November 29, 2020, 7:20pm UTC](https://discuss.elastic.co/t/not-properly-formated-xml/257003 "2020-11-29T19:20:22Z")
Hi All, I have raw event logs like this \\\ **Author:** [@awer1967](https://discuss.elastic.co/u/awer1967)\ **Replies:** 1\ **Last updated:** [December 2, 2020, 1:02am UTC](https://discuss.elastic.co/t/a-question-from-newbie-about-an-index-structure/256993 "2020-12-02T01:02:58Z") Hi there ! I am completely new in Elasticsearch so I want to query about the things unclear to me. My first question is about amount of indices. Basically I am going to get a lot of a different data from different so… --- ## [Best way to ingest data from windows c++ app](https://discuss.elastic.co/t/best-way-to-ingest-data-from-windows-c-app/257093)
**Author:** [@robderon](https://discuss.elastic.co/u/robderon)\ **Replies:** 1\ **Last updated:** [December 2, 2020, 12:48am UTC](https://discuss.elastic.co/t/best-way-to-ingest-data-from-windows-c-app/257093 "2020-12-02T00:48:31Z")
Hello, I must create a Kibana dashboard to analyze a windows c++ application usage : screen viewed, actions, app launching, subscription etc.. Our plan is to send data from the clients to our server (not elastic) once … --- ## [Upgrading ELK stack to 7.10 along with filebeat](https://discuss.elastic.co/t/upgrading-elk-stack-to-7-10-along-with-filebeat/257099)
**Author:** [@Gokul6](https://discuss.elastic.co/u/Gokul6)\ **Replies:** 1\ **Last updated:** [December 2, 2020, 12:44am UTC](https://discuss.elastic.co/t/upgrading-elk-stack-to-7-10-along-with-filebeat/257099 "2020-12-02T00:44:34Z")
Hi, currently we are using ELK stack version 7.8.0 and to push the logs to ES we are using filebeat(7.8.0). we are planning to upgrade our ELK stack to 7.10. so my doubts are 1) after upgrading ELK to 7.10 should we al… --- ## [Custom Beat creation was not successful on windows10 machine](https://discuss.elastic.co/t/custom-beat-creation-was-not-successful-on-windows10-machine/257159)
**Author:** [@pradeep.kumarsk](https://discuss.elastic.co/u/pradeep.kumarsk)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 6:08am UTC](https://discuss.elastic.co/t/custom-beat-creation-was-not-successful-on-windows10-machine/257159 "2020-12-01T06:08:29Z")
Tried to create the custom beats following the officlial documentation on Windows 10 machine we were facing issue $mage GenerateCustomBeat ends in throwing the out of memory error error seems to be at $make update --- ## [Reindex: how to limit number of docs for testing:](https://discuss.elastic.co/t/reindex-how-to-limit-number-of-docs-for-testing/257137)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 1\ **Last updated:** [December 1, 2020, 6:44pm UTC](https://discuss.elastic.co/t/reindex-how-to-limit-number-of-docs-for-testing/257137 "2020-12-01T18:44:14Z")
I am having problem getting reindex to do what I want and the indexes I have available for testing have over 100,000 docs and when things fail this is 100.000 tracebacks in the logs! I see from the docs that there is a … --- ## [Watcher: How to execute "condition" after "transform"?](https://discuss.elastic.co/t/watcher-how-to-execute-condition-after-transform/257232)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 3:52pm UTC](https://discuss.elastic.co/t/watcher-how-to-execute-condition-after-transform/257232 "2020-12-01T15:52:48Z")
in Elastic Watcher, we have a situation whereby I need to do some transform and calculate some value. Once calculating these values, I need to do the condition logic But it seems like condition is executed BEFORE transf… --- ## [Filtering one index with another](https://discuss.elastic.co/t/filtering-one-index-with-another/257265)
**Author:** [@adwaitjoshi](https://discuss.elastic.co/u/adwaitjoshi)\ **Replies:** 1\ **Last updated:** [December 2, 2020, 12:22am UTC](https://discuss.elastic.co/t/filtering-one-index-with-another/257265 "2020-12-02T00:22:28Z")
So I know there is no connection between 2 indexes in Elasticsearch. However some times its impossible to completely denormalize the data. For example I have the following two indexes Parent Index Child Index. One of … --- ## [Edge\_ngram tokenizer and edge\_ngram filter don't behave the same?](https://discuss.elastic.co/t/edge-ngram-tokenizer-and-edge-ngram-filter-dont-behave-the-same/257291)
**Author:** [@redec](https://discuss.elastic.co/u/redec)\ **Replies:** 0\ **Last updated:** [December 2, 2020, 12:10am UTC](https://discuss.elastic.co/t/edge-ngram-tokenizer-and-edge-ngram-filter-dont-behave-the-same/257291 "2020-12-02T00:10:57Z")
I'm trying to convert a field which currently uses the edge\_ngram tokenizer to use the edge\_ngram filter instead, and tokens created by the edge\_ngram filter are not scoring the same as the same tokens created by the edg… --- ## [Cant access machine learning index from Canvas](https://discuss.elastic.co/t/cant-access-machine-learning-index-from-canvas/257119)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 5\ **Last updated:** [December 1, 2020, 11:52pm UTC](https://discuss.elastic.co/t/cant-access-machine-learning-index-from-canvas/257119 "2020-12-01T23:52:19Z")
Hi, Im trying to display data from the .ml-anomalies-\* index on Canvas, but it doesnt show the values in the metric visualization. (the index pattern exists) SELECT COUNT(\*) as count\_documents FROM ".ml-anomalies-\*" WHE… --- ## [Sub partition in Machine Learning](https://discuss.elastic.co/t/sub-partition-in-machine-learning/257220)
**Author:** [@OmarDacca](https://discuss.elastic.co/u/OmarDacca)\ **Replies:** 1\ **Last updated:** [December 1, 2020, 11:50pm UTC](https://discuss.elastic.co/t/sub-partition-in-machine-learning/257220 "2020-12-01T23:50:32Z")
Hi, Is it possible to make sub partitions in Machine Learning ? domain and event are fields in every document. I created a categorization ml job, with partition\_field = domain, but this is not enough, I must split it … --- ## [How can achieve this with kibana?](https://discuss.elastic.co/t/how-can-achieve-this-with-kibana/257270)
**Author:** [@nino](https://discuss.elastic.co/u/nino)\ **Replies:** 4\ **Last updated:** [December 1, 2020, 11:46pm UTC](https://discuss.elastic.co/t/how-can-achieve-this-with-kibana/257270 "2020-12-01T23:46:38Z")
Hello, i need to calculate dynamically return column, but i don't know if we can get this with kibana: formula column return = value (today) / value(yesterday) -1 @timestamp account value return… --- ## [Kibana User with diferent GMT time](https://discuss.elastic.co/t/kibana-user-with-diferent-gmt-time/256917)
**Author:** [@Samuel\_Amico](https://discuss.elastic.co/u/Samuel_Amico)\ **Replies:** 7\ **Last updated:** [December 1, 2020, 11:39pm UTC](https://discuss.elastic.co/t/kibana-user-with-diferent-gmt-time/256917 "2020-12-01T23:39:43Z")
Ok guys this is very IMPORTANT !!! I have my admin Space with my elastic superuser and I put this setting: Advance Settings -\> Timezone for date formatting = America/Belem I the other Space (Supervisor space) that has… --- ## [Missing \_scroll\_id in search response when using Python library](https://discuss.elastic.co/t/missing-scroll-id-in-search-response-when-using-python-library/257288)
**Author:** [@bbunderson](https://discuss.elastic.co/u/bbunderson)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 11:22pm UTC](https://discuss.elastic.co/t/missing-scroll-id-in-search-response-when-using-python-library/257288 "2020-12-01T23:22:17Z")
The \_scroll\_id is missing from the search response when using the Python library version 7.9.0 but the response does contain the \_scroll\_id when I query the API using curl. For example, the following Python code: respo… --- ## [Function "eq" is not working](https://discuss.elastic.co/t/function-eq-is-not-working/255466)
**Author:** [@tangkalo](https://discuss.elastic.co/u/tangkalo)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 10:46pm UTC](https://discuss.elastic.co/t/function-eq-is-not-working/255466 "2020-12-01T22:46:28Z")
Hi, all. I have been scratching my head as to how I can conditionally change color of the context for a markdown. For some reason, the equality function "eq" doesn't seem to compare correctly. Even though the markdown di… --- ## [Python3 Elastic Query returns large amount of results.. am i doing this right?](https://discuss.elastic.co/t/python3-elastic-query-returns-large-amount-of-results-am-i-doing-this-right/257283)
**Author:** [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 10:30pm UTC](https://discuss.elastic.co/t/python3-elastic-query-returns-large-amount-of-results-am-i-doing-this-right/257283 "2020-12-01T22:30:30Z")
hi, i'm still not sure i'm doing this right.. so any suggestions would be appreciated.. i have a LARGE data index of log data containing IP addresses.. ports.. and other network traffic info. its millions of entries a m… --- ## [ES 5.6 : stop spark indexing if active shard is not 100](https://discuss.elastic.co/t/es-5-6-stop-spark-indexing-if-active-shard-is-not-100/257206)
**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 1:20pm UTC](https://discuss.elastic.co/t/es-5-6-stop-spark-indexing-if-active-shard-is-not-100/257206 "2020-12-01T13:20:16Z")
Hello, When we restart a node in ES 5.6, active shard percent is about 96% We have noticed that spark jobs stop indexing in cluster as long as the value of active shard percent does not exceed 98%. have you heard of t… --- ## [Logstash exits after successfully installing plugin with docker-compose](https://discuss.elastic.co/t/logstash-exits-after-successfully-installing-plugin-with-docker-compose/255456)
**Author:** [@luka.klaric](https://discuss.elastic.co/u/luka.klaric)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 9:50pm UTC](https://discuss.elastic.co/t/logstash-exits-after-successfully-installing-plugin-with-docker-compose/255456 "2020-12-01T21:50:42Z")
I am trying to run an Elastic stack and I am trying to install a logstash plugin within the docker file. I am getting the message that the plugin is installed successful and right after that the container exits with code… --- ## [Multiple logstash output](https://discuss.elastic.co/t/multiple-logstash-output/257272)
**Author:** [@stijnvr](https://discuss.elastic.co/u/stijnvr)\ **Replies:** 1\ **Last updated:** [December 1, 2020, 9:09pm UTC](https://discuss.elastic.co/t/multiple-logstash-output/257272 "2020-12-01T21:09:30Z")
I would like to forward all source logs to Logstash. Logstash should have 2 outputs. Elasticsearch, for formatted logs S3, for untampered logs Is this possible ? Or do I need to configuring 2 outputs for the source l… --- ## [Median aggregation and routing](https://discuss.elastic.co/t/median-aggregation-and-routing/257276)
**Author:** [@pcb](https://discuss.elastic.co/u/pcb)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 9:01pm UTC](https://discuss.elastic.co/t/median-aggregation-and-routing/257276 "2020-12-01T21:01:06Z")
Hi ya, I'm working on spec'ing out a new datastore for aggregate calculations for near-real time dashboards and I'm evaluating Elasticsearch. I've read here that median is usually approximated: https://www.elastic.co/gu… --- ## [Doubts about Grok](https://discuss.elastic.co/t/doubts-about-grok/257129)
**Author:** [@rildo](https://discuss.elastic.co/u/rildo)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 8:37pm UTC](https://discuss.elastic.co/t/doubts-about-grok/257129 "2020-12-01T20:37:15Z")
Hello People , I have a doubt about my filter I have this content in my log file {"other\_logs": "127.0.0.1|28614|2018-11-28 23:51:57|srcport 50389 mwtype AvalancheBotnet-andromeda destaddr 2.2.2.2 destinyurl: dogs.ru|M… --- ## [Elastic detections and case sensitivity](https://discuss.elastic.co/t/elastic-detections-and-case-sensitivity/256788)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 4\ **Last updated:** [December 1, 2020, 8:31pm UTC](https://discuss.elastic.co/t/elastic-detections-and-case-sensitivity/256788 "2020-12-01T20:31:10Z")
We use logstash to lowercase most fields used in detections. I was hoping the new wildcard field type would get around the issue of case-insensitivity in the detections rules (not including EQL) Any recommendations or i… --- ## [Get all documents matching a list of values for a field](https://discuss.elastic.co/t/get-all-documents-matching-a-list-of-values-for-a-field/257274)
**Author:** [@jmaharjan](https://discuss.elastic.co/u/jmaharjan)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 8:19pm UTC](https://discuss.elastic.co/t/get-all-documents-matching-a-list-of-values-for-a-field/257274 "2020-12-01T20:19:48Z")
I am using multisearch (msearch from elasticsearch-py) to search for all documents using a list of document ids from a list of indices. The id's are explicitly assigned. The goal is to look for existing documents (using … --- ## [Query\_string with datetime](https://discuss.elastic.co/t/query-string-with-datetime/257271)
**Author:** [@spreet](https://discuss.elastic.co/u/spreet)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 8:10pm UTC](https://discuss.elastic.co/t/query-string-with-datetime/257271 "2020-12-01T20:10:07Z")
We recently migrated to ES 7.1 from 5.8. In the previous version query\_string with a datetime used to work. Query with date and time { "query": { "query\_string": { "query": "data.lastUpdateTime:\[\* TO 2018-1… --- ## [Multiline data to correlate into single line](https://discuss.elastic.co/t/multiline-data-to-correlate-into-single-line/257253)
**Author:** [@Ramesh535](https://discuss.elastic.co/u/Ramesh535)\ **Replies:** 1\ **Last updated:** [December 1, 2020, 6:38pm UTC](https://discuss.elastic.co/t/multiline-data-to-correlate-into-single-line/257253 "2020-12-01T18:38:58Z")
Hi Guys, Need some help I have the data in this format \[2020-11-27\] \[data\] \[country:India\] \[Capital:Delhi\] \[2020-11-27\] \[data\] \[country:India\] \[Currency:INR\] \[2020-11-27\] \[data\] \[country:India\] \[PM:Modi\] \[2020-11-2… --- ## [Incorrect result in Kibana TSVB chart](https://discuss.elastic.co/t/incorrect-result-in-kibana-tsvb-chart/257006)
**Author:** [@Agenobarb](https://discuss.elastic.co/u/Agenobarb)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 3:43pm UTC](https://discuss.elastic.co/t/incorrect-result-in-kibana-tsvb-chart/257006 "2020-12-01T15:43:21Z")
Please look at the field 'timestamp' in the screenshot from Discover: I am unable to understand why when I use metric max on this field - max(timestamp) I am getting a timestamp that is not within the range of timest… --- ## [Keystore does not update azure client secrets when changed - secrets seems to be persistent somehow](https://discuss.elastic.co/t/keystore-does-not-update-azure-client-secrets-when-changed-secrets-seems-to-be-persistent-somehow/257257)
**Author:** [@johanhaugland](https://discuss.elastic.co/u/johanhaugland)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 6:13pm UTC](https://discuss.elastic.co/t/keystore-does-not-update-azure-client-secrets-when-changed-secrets-seems-to-be-persistent-somehow/257257 "2020-12-01T18:13:59Z")
Short version: Unable to load new values into keystore secrets for azure plugin: azure.client.default.account azure.client.default.key They seem to be persistent - how do I purge the old values completely from the clu… --- ## [Nested Field can't access the nested field array using script query](https://discuss.elastic.co/t/nested-field-cant-access-the-nested-field-array-using-script-query/257256)
**Author:** [@khalilw1](https://discuss.elastic.co/u/khalilw1)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 6:12pm UTC](https://discuss.elastic.co/t/nested-field-cant-access-the-nested-field-array-using-script-query/257256 "2020-12-01T18:12:27Z")
Hello Guys, I have the following mapping PUT products/\_mapping { "properties": { "discounts": { "properties": { "KW": { "type": "nested" }, "SA": { "type": "neste… --- ## [Can we use filebeat to send data to AWS elasticsearch service?](https://discuss.elastic.co/t/can-we-use-filebeat-to-send-data-to-aws-elasticsearch-service/257166)
**Author:** [@Ashok4512](https://discuss.elastic.co/u/Ashok4512)\ **Replies:** 4\ **Last updated:** [December 1, 2020, 5:49pm UTC](https://discuss.elastic.co/t/can-we-use-filebeat-to-send-data-to-aws-elasticsearch-service/257166 "2020-12-01T17:49:52Z")
I am trying to send log data of my nginx server to AWS elasticsearch service. i am done with the changes in filebeat.yml file and then run the command "filebeat setup" but then i got the error like " Overwriting ILM poli… --- ## [Filebeats holding handles on rotated logs](https://discuss.elastic.co/t/filebeats-holding-handles-on-rotated-logs/256538)
**Author:** [@txmrlevine](https://discuss.elastic.co/u/txmrlevine)\ **Replies:** 3\ **Last updated:** [December 1, 2020, 5:20pm UTC](https://discuss.elastic.co/t/filebeats-holding-handles-on-rotated-logs/256538 "2020-12-01T17:20:53Z")
I am looking into why my disks are getting full and I found that filebeat is holding handles on logs that are rotated. I read some discussions on the topic and I did not see a definitive answer and all requests were rat… [Previous page](https://discuss.elastic.co/latest.md?page=1964) [Next page](https://discuss.elastic.co/latest.md?page=1966)