# Latest **URL:** https://discuss.elastic.co/latest.md?page=1994 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1995 --- ## [Full Index Rebuild with 5M documents on Elastic search 7.6 takes 1 week to complete](https://discuss.elastic.co/t/full-index-rebuild-with-5m-documents-on-elastic-search-7-6-takes-1-week-to-complete/255624)
**Author:** [@nimohara](https://discuss.elastic.co/u/nimohara)\ **Replies:** 14\ **Last updated:** [November 17, 2020, 2:46pm UTC](https://discuss.elastic.co/t/full-index-rebuild-with-5m-documents-on-elastic-search-7-6-takes-1-week-to-complete/255624 "2020-11-17T14:46:50Z")
Hey There Hope all are doing well Please have a look in to the below issue and provide your valuable suggestion on this. Currently Elastic 7.6 is running on cluster with 3 nodes and it's having 5M records in it. Whil… --- ## [FileBeat apache module log issue](https://discuss.elastic.co/t/filebeat-apache-module-log-issue/255718)
**Author:** [@psganeshk](https://discuss.elastic.co/u/psganeshk)\ **Replies:** 0\ **Last updated:** [November 17, 2020, 2:44pm UTC](https://discuss.elastic.co/t/filebeat-apache-module-log-issue/255718 "2020-11-17T14:44:18Z")
apache module configuration file Module: apache Docs: https://www.elastic.co/guide/en/beats/filebeat/7.9/filebeat-module-apache.html module: apache Access logs access: enabled: true Set custom paths for the log fi… --- ## [Field analyzer for matching concepts and names](https://discuss.elastic.co/t/field-analyzer-for-matching-concepts-and-names/254521)
**Author:** [@jporzelt](https://discuss.elastic.co/u/jporzelt)\ **Replies:** 3\ **Last updated:** [November 17, 2020, 2:38pm UTC](https://discuss.elastic.co/t/field-analyzer-for-matching-concepts-and-names/254521 "2020-11-17T14:38:12Z")
Dear Elasticsearch community, dear Elastic team, I have a question about field analyzers that I would like to discuss here. In our index we have fields (field cities in the below example) that store known concepts or n… --- ## [Mutate rename filter not working on nested fields](https://discuss.elastic.co/t/mutate-rename-filter-not-working-on-nested-fields/255713)
**Author:** [@blastodorm](https://discuss.elastic.co/u/blastodorm)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 2:33pm UTC](https://discuss.elastic.co/t/mutate-rename-filter-not-working-on-nested-fields/255713 "2020-11-17T14:33:03Z")
I'm trying to rename a field to work with my data. The field I'm attempting to rename is nested. My config: filter { mutate {rename =\> { "\[message\]\[context\]\[payload\]\[geolocation\]\[latitude\]" =\> "\[message\]\[context\]\[payl… --- ## [Kibana REST API not working](https://discuss.elastic.co/t/kibana-rest-api-not-working/255704)
**Author:** [@Maria20](https://discuss.elastic.co/u/Maria20)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 2:31pm UTC](https://discuss.elastic.co/t/kibana-rest-api-not-working/255704 "2020-11-17T14:31:46Z")
Hi, I tried to check index-patterns using kibana rest api, but it is not working. curl -XGET http://localhost:5601/api/saved\_objects/index-pattern/$indx I am using kibana 7.3.2 Thanks --- ## [ElasticSearch usage for logs with big size of entries](https://discuss.elastic.co/t/elasticsearch-usage-for-logs-with-big-size-of-entries/255197)
**Author:** [@andsm](https://discuss.elastic.co/u/andsm)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 2:24pm UTC](https://discuss.elastic.co/t/elasticsearch-usage-for-logs-with-big-size-of-entries/255197 "2020-11-17T14:24:10Z")
Hello, I think about usage of ElasticSearch for logging. System generates about 5-10k log entries per second, average, total size is about 500 Mb per second. Most of log entries are small, but some log entries have siz… --- ## [To create a log-level depends on string](https://discuss.elastic.co/t/to-create-a-log-level-depends-on-string/255712)
**Author:** [@Guhan\_S](https://discuss.elastic.co/u/Guhan_S)\ **Replies:** 0\ **Last updated:** [November 17, 2020, 2:09pm UTC](https://discuss.elastic.co/t/to-create-a-log-level-depends-on-string/255712 "2020-11-17T14:09:46Z")
message:{"level":30",hostname":"someserver.com","pid":1627," like this i am getting logs, i have filter accoding to level in message. level:30 means info level log, 20 means debug level log --- ## [Set kibana.autocompleteTerminateAfter via DevTools](https://discuss.elastic.co/t/set-kibana-autocompleteterminateafter-via-devtools/255685)
**Author:** [@Voula\_Mikr](https://discuss.elastic.co/u/Voula_Mikr)\ **Replies:** 8\ **Last updated:** [November 17, 2020, 2:08pm UTC](https://discuss.elastic.co/t/set-kibana-autocompleteterminateafter-via-devtools/255685 "2020-11-17T14:08:39Z")
Hi, Is there a way to set kibana.autocompleteTerminateAfter via DevTools or via curl command? Thank you in advance! BR Voula --- ## [Garbage collection old vs young](https://discuss.elastic.co/t/garbage-collection-old-vs-young/255361)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 2:07pm UTC](https://discuss.elastic.co/t/garbage-collection-old-vs-young/255361 "2020-11-17T14:07:35Z")
Hi, Question, On my nodes (7.9.3) I see the following graph's in stackmonitoring: What strikes me is the 0 for old . As far as I know, the default ratio is 2? So I would not expect 0 here, but about double of what y… --- ## [How can a replica recover from another replica but not the primary shard](https://discuss.elastic.co/t/how-can-a-replica-recover-from-another-replica-but-not-the-primary-shard/255703)
**Author:** [@chemboking](https://discuss.elastic.co/u/chemboking)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 2:03pm UTC](https://discuss.elastic.co/t/how-can-a-replica-recover-from-another-replica-but-not-the-primary-shard/255703 "2020-11-17T14:03:41Z")
Here is my scenario: create one index with 0 replica; merge this index to one segment; stop all the write operations and set the num of replica to 20; The question is that the replicas can only be recovere… --- ## [Kibana dashbord trading candle](https://discuss.elastic.co/t/kibana-dashbord-trading-candle/255600)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 8\ **Last updated:** [November 17, 2020, 1:58pm UTC](https://discuss.elastic.co/t/kibana-dashbord-trading-candle/255600 "2020-11-17T13:58:24Z")
Hello, giving this example data, Is It possible to make trading candle in kibana? Maybe using timelion? {'crypto.candle.close': '16746.10000000', 'crypto.candle.closeTime': '2020-11-16T22:59:59Z', 'crypto.candle.h… --- ## [Downgrade from 7.9 to 7.8](https://discuss.elastic.co/t/downgrade-from-7-9-to-7-8/255672)
**Author:** [@amralieg](https://discuss.elastic.co/u/amralieg)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 1:55pm UTC](https://discuss.elastic.co/t/downgrade-from-7-9-to-7-8/255672 "2020-11-17T13:55:57Z")
Hi All, need some thoughts on this. for some reasons I need to move from v7.9.3 to v7.8. I know I can not do a snapshot and restore. but what are my other options here? I thought for reindex from the old cluster to the … --- ## [Elasticsearch stopped allocating shards due to missing kuromoji\_part\_of\_speech filter](https://discuss.elastic.co/t/elasticsearch-stopped-allocating-shards-due-to-missing-kuromoji-part-of-speech-filter/254871)
**Author:** [@phoerious](https://discuss.elastic.co/u/phoerious)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 1:49pm UTC](https://discuss.elastic.co/t/elasticsearch-stopped-allocating-shards-due-to-missing-kuromoji-part-of-speech-filter/254871 "2020-11-17T13:49:28Z")
Hi, We have a web index containing Japanese documents, which are using analyzers from the analysis-icu and analysis-kuromoji plugins. Our Elasticsearch cluster is deployed via ECK and pulls the plugins inside the init c… --- ## [Logstash shut down after pipeline terminated](https://discuss.elastic.co/t/logstash-shut-down-after-pipeline-terminated/255478)
**Author:** [@Amir\_Almian](https://discuss.elastic.co/u/Amir_Almian)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 1:24pm UTC](https://discuss.elastic.co/t/logstash-shut-down-after-pipeline-terminated/255478 "2020-11-17T13:24:27Z")
i,m running elastic stack on docker and with ssl security enable. this is my logstash.yml file http.host: "0.0.0.0" xpack.monitoring.elasticsearch.hosts: \[ "https://elasticsearch:9200" \] xpack.monitoring.enabled: true … --- ## [Elasticsearch-certutil: generate both pem certificates and PKCS#12 keystores](https://discuss.elastic.co/t/elasticsearch-certutil-generate-both-pem-certificates-and-pkcs-12-keystores/255486)
**Author:** [@flavienbwk](https://discuss.elastic.co/u/flavienbwk)\ **Replies:** 4\ **Last updated:** [November 17, 2020, 1:00pm UTC](https://discuss.elastic.co/t/elasticsearch-certutil-generate-both-pem-certificates-and-pkcs-12-keystores/255486 "2020-11-17T13:00:38Z")
Hi, I am currently using elasticsearch-certutil to generate my PEM certificates (.crt and .key) for Elasticsearch and Kibana through a certutil .yml file. However I want to setup SSL for my Enterprise Search instance b… --- ## [Ingest node pipeline error](https://discuss.elastic.co/t/ingest-node-pipeline-error/255694)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 12:42pm UTC](https://discuss.elastic.co/t/ingest-node-pipeline-error/255694 "2020-11-17T12:42:46Z")
I want to set up an ingest node pipeline that will add new field based on host.hostname that is all lower cased. I made something like this But I got this error that I don't understand. 2020-11-17T13:31:41.473+0100 … --- ## [Logstash config to ingest data by filtering the data that is already present in another index in ES](https://discuss.elastic.co/t/logstash-config-to-ingest-data-by-filtering-the-data-that-is-already-present-in-another-index-in-es/255692)
**Author:** [@Sivajanani](https://discuss.elastic.co/u/Sivajanani)\ **Replies:** 0\ **Last updated:** [November 17, 2020, 12:29pm UTC](https://discuss.elastic.co/t/logstash-config-to-ingest-data-by-filtering-the-data-that-is-already-present-in-another-index-in-es/255692 "2020-11-17T12:29:46Z")
Hello All, I have a requirement to ingest only the data which already exists in another index. For example I have a index in ES like index1 =\[source=a,time=b,value=c,id=d\] and data set to be ingested like sample=\[value=… --- ## [Logstash pipeline terminates immediately after logstash container starts up](https://discuss.elastic.co/t/logstash-pipeline-terminates-immediately-after-logstash-container-starts-up/255208)
**Author:** [@Sam\_Mellors](https://discuss.elastic.co/u/Sam_Mellors)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 12:18pm UTC](https://discuss.elastic.co/t/logstash-pipeline-terminates-immediately-after-logstash-container-starts-up/255208 "2020-11-17T12:18:32Z")
Hi everyone I'm trying to set up logstash in a kubernetes cluster, but whenever the container starts the logs say it terminates the pipeline I have: \[\[.monitoring-logstash\]-pipeline-manager\] javapipeline - Pipeline term… --- ## [Failed to install S3 repository](https://discuss.elastic.co/t/failed-to-install-s3-repository/255566)
**Author:** [@jovan](https://discuss.elastic.co/u/jovan)\ **Replies:** 9\ **Last updated:** [November 17, 2020, 12:08pm UTC](https://discuss.elastic.co/t/failed-to-install-s3-repository/255566 "2020-11-17T12:08:33Z")
Hi team, recently we upgraded our cluster to be close to latest release. We are using OSS version of stack, with current version 7.9.1: rpm -qa | grep elasticsearch-oss elasticsearch-oss-7.9.1-1.x86\_64 However, we … --- ## [Logstash docker error -\> exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of \[ \\\\t\\\\r\\\\n\], \\"#\\", \\"input\\", \\"filter\\", \\"output\\" at line 1, column 1 (byte 1)"](https://discuss.elastic.co/t/logstash-docker-error-exception-logstash-configurationerror-message-expected-one-of-t-r-n-input-filter-output-at-line-1-column-1-byte-1/255210)
**Author:** [@s0umen](https://discuss.elastic.co/u/s0umen)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 11:55am UTC](https://discuss.elastic.co/t/logstash-docker-error-exception-logstash-configurationerror-message-expected-one-of-t-r-n-input-filter-output-at-line-1-column-1-byte-1/255210 "2020-11-17T11:55:59Z")
Hi, I am facing a peculiar issue. I have seen the error faced by many before me, but the solution (only a few of them said resolved by fresh creation by typing the logstash.conf file) is not working for me. Please help… --- ## [Filebeat i/o timeout on output to Redis](https://discuss.elastic.co/t/filebeat-i-o-timeout-on-output-to-redis/255677)
**Author:** [@ushaopusnet](https://discuss.elastic.co/u/ushaopusnet)\ **Replies:** 0\ **Last updated:** [November 17, 2020, 11:32am UTC](https://discuss.elastic.co/t/filebeat-i-o-timeout-on-output-to-redis/255677 "2020-11-17T11:32:55Z")
Hi, I've a simple setup using filebeat (v7.8.0) pushing logs to redis v4.0.9 and seeing the following error in logs. Please help troubleshoot. redis/client.go:239 Failed to RPUSH to redis list with: write… --- ## [Per user data retention](https://discuss.elastic.co/t/per-user-data-retention/255552)
**Author:** [@10aRK](https://discuss.elastic.co/u/10aRK)\ **Replies:** 4\ **Last updated:** [November 17, 2020, 11:25am UTC](https://discuss.elastic.co/t/per-user-data-retention/255552 "2020-11-17T11:25:45Z")
Hi I've been looking into how best to model data whilst accounting for customisable data retention periods at a user / document level vs the whole index. ILM seems perfect when reasoning about the whole index, old vers… --- ## [TimeSeries Graph with a factor to multiple for Count Value](https://discuss.elastic.co/t/timeseries-graph-with-a-factor-to-multiple-for-count-value/255645)
**Author:** [@ginu](https://discuss.elastic.co/u/ginu)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 11:09am UTC](https://discuss.elastic.co/t/timeseries-graph-with-a-factor-to-multiple-for-count-value/255645 "2020-11-17T11:09:39Z")
Hi I have a requirement where I need to multiple a time-series count value with a factor n any idea how to achieve this? --- ## [Kibana anomaly explorer](https://discuss.elastic.co/t/kibana-anomaly-explorer/254887)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 10:56am UTC](https://discuss.elastic.co/t/kibana-anomaly-explorer/254887 "2020-11-17T10:56:16Z")
Hello, It seems that there is a bug in the ml display in Kibana ( Categorization\> rare occurrences job) you can see below red squares, but actually there aren't any major anomalies --- ## [Elastic ILM is not rolling](https://discuss.elastic.co/t/elastic-ilm-is-not-rolling/254527)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 10:39am UTC](https://discuss.elastic.co/t/elastic-ilm-is-not-rolling/254527 "2020-11-17T10:39:02Z")
Hello, I have configured my ILM to rollover when the indice size be 20GB or after passing 30 days in the hot node as it's mentioned in this pic : but my indice passed 20GB and still didn't pass to the cold node: a… --- ## [We can't find products matching the selection](https://discuss.elastic.co/t/we-cant-find-products-matching-the-selection/255653)
**Author:** [@AndrewsG](https://discuss.elastic.co/u/AndrewsG)\ **Replies:** 3\ **Last updated:** [November 17, 2020, 10:34am UTC](https://discuss.elastic.co/t/we-cant-find-products-matching-the-selection/255653 "2020-11-17T10:34:34Z")
Hi, I have installed Elasticsearch onto a Magento 2.4 site. I keep receiving the error "We can't find products matching the selection" after a period of time of the Elasticsearch working. Please can anyone advise? --- ## [How to filter a list of word with kibana](https://discuss.elastic.co/t/how-to-filter-a-list-of-word-with-kibana/255515)
**Author:** [@slim-hmidi](https://discuss.elastic.co/u/slim-hmidi)\ **Replies:** 9\ **Last updated:** [November 17, 2020, 10:32am UTC](https://discuss.elastic.co/t/how-to-filter-a-list-of-word-with-kibana/255515 "2020-11-17T10:32:23Z")
I tried to fetch some word using regexp in the filter but does not work: { "query": { "regexp": { "message": { "value": "\*.word1.word2.word3.\*" } } } } I want to fetch messages that contai… --- ## [Threat Intel and SIEM](https://discuss.elastic.co/t/threat-intel-and-siem/255404)
**Author:** [@randomguy](https://discuss.elastic.co/u/randomguy)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 10:27am UTC](https://discuss.elastic.co/t/threat-intel-and-siem/255404 "2020-11-17T10:27:10Z")
Hi, I'm looking for a SIEM solution for our company. At the moment I'm trying to do it with ELK. My goal is: I would like to create fancy dashboards, alerts with events correlated from Threat Intel. I would like to u… --- ## [Converting value in field](https://discuss.elastic.co/t/converting-value-in-field/255527)
**Author:** [@Lokesh\_Mayan](https://discuss.elastic.co/u/Lokesh_Mayan)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 9:57am UTC](https://discuss.elastic.co/t/converting-value-in-field/255527 "2020-11-17T09:57:17Z")
Hi i am having a log list like this \<#\> 20200924 15:14:44.552 000000997 FD.WRN \[ MVINB-LSL2.T1G1\_ATMTH\_SL main.main ConfigService.ConfigService \] Unable to get CommonParamConfig of \[DAC\_TEST\_WHILE\_IDLE… --- ## [Elasticsearch cannot find a non-existing file](https://discuss.elastic.co/t/elasticsearch-cannot-find-a-non-existing-file/255636)
**Author:** [@vaclav1](https://discuss.elastic.co/u/vaclav1)\ **Replies:** 5\ **Last updated:** [November 17, 2020, 9:54am UTC](https://discuss.elastic.co/t/elasticsearch-cannot-find-a-non-existing-file/255636 "2020-11-17T09:54:43Z")
Hello, after enabling and configuring ES to use s3 repository plugin when we restart each node we got a following error right after restarting nodes and only. When I enter the directory the file is missing. Els process … [Previous page](https://discuss.elastic.co/latest.md?page=1993) [Next page](https://discuss.elastic.co/latest.md?page=1995)