# Latest **URL:** https://discuss.elastic.co/latest.md?page=419 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 420 --- ## [Using one index and constantly removing from it would lead to a problem?](https://discuss.elastic.co/t/using-one-index-and-constantly-removing-from-it-would-lead-to-a-problem/351907)
**Author:** [@m4kkur0](https://discuss.elastic.co/u/m4kkur0)\ **Replies:** 0\ **Last updated:** [January 27, 2024, 6:20am UTC](https://discuss.elastic.co/t/using-one-index-and-constantly-removing-from-it-would-lead-to-a-problem/351907 "2024-01-27T06:20:46Z")
Hello, I wonder if using an index and constantly removing documents from it leads to problems? I upsert, daily, around 10 millions of documents so, there is a chance of removing 10 millions of documents. Why I am doing… --- ## [Converting Timeticks value to Duration value](https://discuss.elastic.co/t/converting-timeticks-value-to-duration-value/351903)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 1\ **Last updated:** [January 26, 2024, 11:34pm UTC](https://discuss.elastic.co/t/converting-timeticks-value-to-duration-value/351903 "2024-01-26T23:34:13Z")
Hello, I am polling snmp using Elastic's SNMP input. I am retrieving two values sysUptimeInstance : 2,029,071,549 ifLastChange: 2,026,800,920 These are time tick values or centiseconds (1/100th of a second). I want … --- ## [Regex not worked with filebeat](https://discuss.elastic.co/t/regex-not-worked-with-filebeat/351901)
**Author:** [@Ahmed\_Alsum](https://discuss.elastic.co/u/Ahmed_Alsum)\ **Replies:** 2\ **Last updated:** [January 26, 2024, 10:02pm UTC](https://discuss.elastic.co/t/regex-not-worked-with-filebeat/351901 "2024-01-26T22:02:58Z")
Hi Dear, I'm trying to exclude any files starting with gc but below regex did not work and regex is verified, myfilebeat version is :8.3.2 filebeat.inputs: # Each - is an input. Most options can be set at the input l… --- ## [Deletion of data within frozen tier](https://discuss.elastic.co/t/deletion-of-data-within-frozen-tier/351828)
**Author:** [@Steven\_Richards](https://discuss.elastic.co/u/Steven_Richards)\ **Replies:** 2\ **Last updated:** [January 26, 2024, 9:30pm UTC](https://discuss.elastic.co/t/deletion-of-data-within-frozen-tier/351828 "2024-01-26T21:30:42Z")
Hello, I realize this question goes a bit counter to the usage of a frozen tier, but I'll outline our use-case. We have an ILM policy of 10 days hot, 80 days frozen. Some of our customers have the need to remove data w… --- ## [Generating same token for related words](https://discuss.elastic.co/t/generating-same-token-for-related-words/351902)
**Author:** [@RabBit\_BR](https://discuss.elastic.co/u/RabBit_BR)\ **Replies:** 0\ **Last updated:** [January 26, 2024, 9:15pm UTC](https://discuss.elastic.co/t/generating-same-token-for-related-words/351902 "2024-01-26T21:15:51Z")
Hello everybody. I would like to know if it is possible using analyzer to generate the same token for the following words: "bronzeadora", "bronze", "bronzeado". The token I need for the three words would be "bronz". I … --- ## [Input Varnish Logs to Logstash](https://discuss.elastic.co/t/input-varnish-logs-to-logstash/351898)
**Author:** [@ugola](https://discuss.elastic.co/u/ugola)\ **Replies:** 1\ **Last updated:** [January 26, 2024, 8:54pm UTC](https://discuss.elastic.co/t/input-varnish-logs-to-logstash/351898 "2024-01-26T20:54:23Z")
My goal is to send varnish logs to Logstash, both are running on different servers. Currently I am able to perform this using rsyslog (I also saw examples of FileBeat being used) on the machine where varnish logs are sto… --- ## [Cannot find an FAQ - is there one?](https://discuss.elastic.co/t/cannot-find-an-faq-is-there-one/351487)
**Author:** [@GuyMark](https://discuss.elastic.co/u/GuyMark)\ **Replies:** 3\ **Last updated:** [January 26, 2024, 8:17pm UTC](https://discuss.elastic.co/t/cannot-find-an-faq-is-there-one/351487 "2024-01-26T20:17:01Z")
Apologies if the mandatory "tag" makes no sense, but I have no idea what the three options meant - so I chose the one in the middle. Is there an FAQ where noobs like myself can get most of the answers that we need, with… --- ## [Would like to search text and try to identify strings that could be a persons name](https://discuss.elastic.co/t/would-like-to-search-text-and-try-to-identify-strings-that-could-be-a-persons-name/351745)
**Author:** [@warrengoldman](https://discuss.elastic.co/u/warrengoldman)\ **Replies:** 3\ **Last updated:** [January 26, 2024, 8:03pm UTC](https://discuss.elastic.co/t/would-like-to-search-text-and-try-to-identify-strings-that-could-be-a-persons-name/351745 "2024-01-26T20:03:52Z")
Example I have text like the following: Jeremy went to the ice cream shop with David and they met Sharee there. of the above Jeremy, David and Sharee are names. Is there a query I might be able to run that can identify… --- ## [Daily schedule transform from different indices](https://discuss.elastic.co/t/daily-schedule-transform-from-different-indices/351718)
**Author:** [@tmslara.a](https://discuss.elastic.co/u/tmslara.a)\ **Replies:** 2\ **Last updated:** [January 26, 2024, 7:13pm UTC](https://discuss.elastic.co/t/daily-schedule-transform-from-different-indices/351718 "2024-01-26T19:13:31Z")
Hello, We are currently ingesting data to an Elasticsearch cluster using Filebeat. We have configured Filebeat to create a new index every day, so the index template has the form index\_{+yyyymmdd}. We want to schedule … --- ## [Executing JSON query directly using Java API ignore the query algother](https://discuss.elastic.co/t/executing-json-query-directly-using-java-api-ignore-the-query-algother/351897)
**Author:** [@vinitp](https://discuss.elastic.co/u/vinitp)\ **Replies:** 0\ **Last updated:** [January 26, 2024, 6:25pm UTC](https://discuss.elastic.co/t/executing-json-query-directly-using-java-api-ignore-the-query-algother/351897 "2024-01-26T18:25:23Z")
In my application, we build the search query in JSON format.e.g { "query": { "bool": { "must": \[ { "term": { "officeCode.keyword": { "value": "410" } … --- ## [Getting \_grokparsefailure for grok pattern on \[audit\_data\]\[messages\] field for modsecurity json log?](https://discuss.elastic.co/t/getting-grokparsefailure-for-grok-pattern-on-audit-data-messages-field-for-modsecurity-json-log/351831)
**Author:** [@sunnysigara](https://discuss.elastic.co/u/sunnysigara)\ **Replies:** 4\ **Last updated:** [January 26, 2024, 5:52pm UTC](https://discuss.elastic.co/t/getting-grokparsefailure-for-grok-pattern-on-audit-data-messages-field-for-modsecurity-json-log/351831 "2024-01-26T17:52:51Z")
Input Json {"transaction":{"time":"26/Jan/2024:00:54:31 +0530","transaction\_id":"16645304250678661185","remote\_address":"141.98.7.28","remote\_port":80,"local\_address":"127.0.0.1","local\_port":80},"request":{"request\_lin… --- ## [Fuzziness and Levenstein distance](https://discuss.elastic.co/t/fuzziness-and-levenstein-distance/351885)
**Author:** [@alba](https://discuss.elastic.co/u/alba)\ **Replies:** 2\ **Last updated:** [January 26, 2024, 5:46pm UTC](https://discuss.elastic.co/t/fuzziness-and-levenstein-distance/351885 "2024-01-26T17:46:15Z")
Hi guys, I have a multi\_match query with "fuzziness" : 2. When I search for "mexico" I get results with "medical" which have Levenstein distance 3 to "mexico". Could somebody explain it to me? --- ## [Search Query API Call Configuration for more than one conditions](https://discuss.elastic.co/t/search-query-api-call-configuration-for-more-than-one-conditions/351857)
**Author:** [@aisyaharifin](https://discuss.elastic.co/u/aisyaharifin)\ **Replies:** 1\ **Last updated:** [January 26, 2024, 4:16pm UTC](https://discuss.elastic.co/t/search-query-api-call-configuration-for-more-than-one-conditions/351857 "2024-01-26T16:16:37Z")
Hello, I've been trying the API call from the Search Applications \> Connect features. Can see the screenshot and below is the sample : POST /\_application/search\_application/search-my/\_search { "params": { "que… --- ## [Set up remote cluster CA certificate in Elasticsearch 8.8.1](https://discuss.elastic.co/t/set-up-remote-cluster-ca-certificate-in-elasticsearch-8-8-1/351889)
**Author:** [@rachelyang](https://discuss.elastic.co/u/rachelyang)\ **Replies:** 0\ **Last updated:** [January 26, 2024, 2:53pm UTC](https://discuss.elastic.co/t/set-up-remote-cluster-ca-certificate-in-elasticsearch-8-8-1/351889 "2024-01-26T14:53:03Z")
I have a local cluster. Now I would like to set up a remote cluster to connect to the local cluster. How do I set up the CA certificate on the remote cluster node to make these two cluster to trust each other? Here is … --- ## [Detections API cant work with Unicode characters](https://discuss.elastic.co/t/detections-api-cant-work-with-unicode-characters/351781)
**Author:** [@gbL2k](https://discuss.elastic.co/u/gbL2k)\ **Replies:** 24\ **Last updated:** [January 26, 2024, 2:29pm UTC](https://discuss.elastic.co/t/detections-api-cant-work-with-unicode-characters/351781 "2024-01-26T14:29:10Z")
Hello everyone! I would like to to create detections with unicode characters in the description but I cant seem to find a way to make the API work with unicode characters. Anyone had the same problem? Thanks in advanc… --- ## [Packetbeat 7.x not working on Windows](https://discuss.elastic.co/t/packetbeat-7-x-not-working-on-windows/351533)
**Author:** [@eagle840](https://discuss.elastic.co/u/eagle840)\ **Replies:** 7\ **Last updated:** [January 26, 2024, 1:58pm UTC](https://discuss.elastic.co/t/packetbeat-7-x-not-working-on-windows/351533 "2024-01-26T13:58:13Z")
Any version of packetbeat.exe version 7.x on windows returns nothing. eg: user\> packetbeat -v user \> The same effect is seen in powershell and cmdline, and reproduced the effect on different machines. However remov… --- ## [Manage of very updated index through auto force segments](https://discuss.elastic.co/t/manage-of-very-updated-index-through-auto-force-segments/351883)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 0\ **Last updated:** [January 26, 2024, 1:48pm UTC](https://discuss.elastic.co/t/manage-of-very-updated-index-through-auto-force-segments/351883 "2024-01-26T13:48:34Z")
Hi is it possible to set the permanent value for max\_merged\_segment for internal auto force mode in elasticsearch? --- ## [How do I avoid including kubernetes.labels?](https://discuss.elastic.co/t/how-do-i-avoid-including-kubernetes-labels/351874)
**Author:** [@Ananym](https://discuss.elastic.co/u/Ananym)\ **Replies:** 4\ **Last updated:** [January 26, 2024, 1:44pm UTC](https://discuss.elastic.co/t/how-do-i-avoid-including-kubernetes-labels/351874 "2024-01-26T13:44:48Z")
kubernetes.labels represents a lot of clutter that isn't useful to me. Add Kubernetes metadata | Filebeat Reference \[8.12\] | Elastic explains how to drop labels from associated resources, but I can't work out how to avo… --- ## [My Agent not send Logs, Kibana Healthy Green](https://discuss.elastic.co/t/my-agent-not-send-logs-kibana-healthy-green/351600)
**Author:** [@aguskhohar](https://discuss.elastic.co/u/aguskhohar)\ **Replies:** 3\ **Last updated:** [January 26, 2024, 1:10pm UTC](https://discuss.elastic.co/t/my-agent-not-send-logs-kibana-healthy-green/351600 "2024-01-26T13:10:40Z")
Hi Guys, Could you please to help me, my kibana is green but my agent not send log. fyi, my elastic : http://localhost:9200 my kibana : http://10.xxx.xxx.xxx:5601 my fleet server : http://10.xxx.xxx.xxx:8220 --- ## [How to create an API Key with current user credentials?](https://discuss.elastic.co/t/how-to-create-an-api-key-with-current-user-credentials/351876)
**Author:** [@cyrildaniel](https://discuss.elastic.co/u/cyrildaniel)\ **Replies:** 0\ **Last updated:** [January 26, 2024, 12:47pm UTC](https://discuss.elastic.co/t/how-to-create-an-api-key-with-current-user-credentials/351876 "2024-01-26T12:47:00Z")
Hey, I would like to create an API Key on the ui/server side of my plugin without having to pass any credentials/authorization. I would like to create an API Key based on the credentials that user has input while loadin… --- ## [Why \_grokparsefailure?](https://discuss.elastic.co/t/why-grokparsefailure/351859)
**Author:** [@emoxam](https://discuss.elastic.co/u/emoxam)\ **Replies:** 5\ **Last updated:** [January 26, 2024, 12:38pm UTC](https://discuss.elastic.co/t/why-grokparsefailure/351859 "2024-01-26T12:38:14Z")
Part of a config filter { if \[message\] =~ /actions/ or \[message\] =~ /172\\.16\\.10\\.78/ or \[message\] =~ /172\\.16\\.10\\.77/ { grok { match =\> \[ "message", "%{GREEDYDATA:timestamp}%{LOGLEVEL:level}%{GR… --- ## [Bucket script aggregation, do not return parameter values](https://discuss.elastic.co/t/bucket-script-aggregation-do-not-return-parameter-values/351872)
**Author:** [@Mert\_Uygur](https://discuss.elastic.co/u/Mert_Uygur)\ **Replies:** 0\ **Last updated:** [January 26, 2024, 11:26am UTC](https://discuss.elastic.co/t/bucket-script-aggregation-do-not-return-parameter-values/351872 "2024-01-26T11:26:23Z")
Hi, I am running Elasticsearch version 7.10, and I use Elasticsearch Java Client version 8. I basically run some aggregations to calculate a bucket script. I have defined scripts on elasticsearch, and use them in my requ… --- ## [Shrink operation in ILM is unusable when same\_shard is set in multinode cluster](https://discuss.elastic.co/t/shrink-operation-in-ilm-is-unusable-when-same-shard-is-set-in-multinode-cluster/351869)
**Author:** [@john90](https://discuss.elastic.co/u/john90)\ **Replies:** 3\ **Last updated:** [January 26, 2024, 11:45am UTC](https://discuss.elastic.co/t/shrink-operation-in-ilm-is-unusable-when-same-shard-is-set-in-multinode-cluster/351869 "2024-01-26T11:45:41Z")
Hi, I am trying to find out if this is really the case: shrink operation via API or ILM is unusable or at least unreliable when when both these conditions apply: cluster.routing.allocation.same\_shard.host is set to tru… --- ## [FSCrawler - Folder index is not getting created in the latest version](https://discuss.elastic.co/t/fscrawler-folder-index-is-not-getting-created-in-the-latest-version/351544)
**Author:** [@kamalsharma](https://discuss.elastic.co/u/kamalsharma)\ **Replies:** 8\ **Last updated:** [January 26, 2024, 9:46am UTC](https://discuss.elastic.co/t/fscrawler-folder-index-is-not-getting-created-in-the-latest-version/351544 "2024-01-26T09:46:28Z")
The index name is fs-test-001 (Example) in the \_settings.json file. After running the FsCrawler, Template is automatically added in the Elastic. I am able to see the Templates for the index as well as for the folders alo… --- ## [How to invoke custom rescorer plugin using elasticsearch-java 8 client](https://discuss.elastic.co/t/how-to-invoke-custom-rescorer-plugin-using-elasticsearch-java-8-client/351868)
**Author:** [@baji](https://discuss.elastic.co/u/baji)\ **Replies:** 0\ **Last updated:** [January 26, 2024, 9:27am UTC](https://discuss.elastic.co/t/how-to-invoke-custom-rescorer-plugin-using-elasticsearch-java-8-client/351868 "2024-01-26T09:27:49Z")
Hi, I have migrated a custom rescorer plugin from Elasticsearch version 7 to 8. I can invoke the plugin using the following request. However, I am unable to generate a similar request using elasticsearch-java 8.10.4. I … --- ## [Failed to install template {:message=\>"Got response code '400' contacting Elasticsearch at URL 'http://x.x.x.x:9200/\_template/ecs-logstash'",](https://discuss.elastic.co/t/failed-to-install-template-message-got-response-code-400-contacting-elasticsearch-at-url-http-x-x-x-x-9200-template-ecs-logstash/351578)
**Author:** [@sunnysigara](https://discuss.elastic.co/u/sunnysigara)\ **Replies:** 5\ **Last updated:** [January 26, 2024, 7:13am UTC](https://discuss.elastic.co/t/failed-to-install-template-message-got-response-code-400-contacting-elasticsearch-at-url-http-x-x-x-x-9200-template-ecs-logstash/351578 "2024-01-26T07:13:27Z")
Using a default mapping template {:es\_version=\>7, :ecs\_compatibility=\>:v8} gives me this error, \[2024-01-23T02:24:07,381\]\[INFO \]\[logstash.outputs.elasticsearch\]\[main\] Elasticsearch version determined (7.13.3) {:es\_versi… --- ## [When kafka broker timeout ,my filebeat always retrying](https://discuss.elastic.co/t/when-kafka-broker-timeout-my-filebeat-always-retrying/351814)
**Author:** [@zhaoting1667](https://discuss.elastic.co/u/zhaoting1667)\ **Replies:** 2\ **Last updated:** [January 26, 2024, 7:03am UTC](https://discuss.elastic.co/t/when-kafka-broker-timeout-my-filebeat-always-retrying/351814 "2024-01-26T07:03:07Z")
my filebeat version 6.4.0 (amd64), libbeat 6.4.0 when kafka broker timeout ,my filebeat always retrying, don't put log,util restart filebeat,Please help me take a look。 filebeat log is this.....2024-01-23T20:38:21.439… --- ## [I have installed Elasticsearch 7.17.17 version. i am doing semantic search, but at final search it give me the error which is give below:BadRequestError(400, 'illegal\_argument\_exception', 'Invalid type: expecting \[\_doc\] but got \[\_knn\_search\]')](https://discuss.elastic.co/t/i-have-installed-elasticsearch-7-17-17-version-i-am-doing-semantic-search-but-at-final-search-it-give-me-the-error-which-is-give-below-badrequesterror-400-illegal-argument-exception-invalid-type-expecting-doc-but-got-knn-search/351853)
**Author:** [@Muhammad\_Adnan1](https://discuss.elastic.co/u/Muhammad_Adnan1)\ **Replies:** 2\ **Last updated:** [January 26, 2024, 6:46am UTC](https://discuss.elastic.co/t/i-have-installed-elasticsearch-7-17-17-version-i-am-doing-semantic-search-but-at-final-search-it-give-me-the-error-which-is-give-below-badrequesterror-400-illegal-argument-exception-invalid-type-expecting-doc-but-got-knn-search/351853 "2024-01-26T06:46:07Z")
BadRequestError(400, 'illegal\_argument\_exception', 'Invalid type: expecting \[\_doc\] but got \[\_knn\_search\]') --- ## [Not able to use profiling on fargate enviroment](https://discuss.elastic.co/t/not-able-to-use-profiling-on-fargate-enviroment/350688)
**Author:** [@julianep](https://discuss.elastic.co/u/julianep)\ **Replies:** 3\ **Last updated:** [January 26, 2024, 6:40am UTC](https://discuss.elastic.co/t/not-able-to-use-profiling-on-fargate-enviroment/350688 "2024-01-26T06:40:00Z")
I'm using the elastic agent to implement the Universal Profiling feature in our AWS ECS Fargate clusters, but I'm facing strange errors and we got stuck trying to get this working properly, i know this is related to ebpf… --- ## [The Java API client verifies the alias of the remote cluster](https://discuss.elastic.co/t/the-java-api-client-verifies-the-alias-of-the-remote-cluster/351848)
**Author:** [@cwh1663044117](https://discuss.elastic.co/u/cwh1663044117)\ **Replies:** 0\ **Last updated:** [January 26, 2024, 4:36am UTC](https://discuss.elastic.co/t/the-java-api-client-verifies-the-alias-of-the-remote-cluster/351848 "2024-01-26T04:36:32Z")
1.The remote cluster verifies the index alias Hello, when you use Java API Client to verify the remote cluster alias, this alias index exists in the remote cluster, However, the API interface returns false and does not … [Previous page](https://discuss.elastic.co/latest.md?page=418) [Next page](https://discuss.elastic.co/latest.md?page=420)