# Latest **URL:** https://discuss.elastic.co/latest.md?page=970 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 971 --- ## [Data Streams vs "Traditionally" Elastic Indexes](https://discuss.elastic.co/t/data-streams-vs-traditionally-elastic-indexes/313980)
**Author:** [@huowen](https://discuss.elastic.co/u/huowen)\ **Replies:** 6\ **Last updated:** [September 12, 2022, 3:03pm UTC](https://discuss.elastic.co/t/data-streams-vs-traditionally-elastic-indexes/313980 "2022-09-12T15:03:21Z")
I have recently upgraded my ELK stack and deployed in a kubernetes cluster and wanted to optimise the way I'm using it. Use Case: Many developer teams push their logs to a logstash pipeline which then outputs into elas… --- ## [Unexpected pod restart after operator upgrade to 2.3](https://discuss.elastic.co/t/unexpected-pod-restart-after-operator-upgrade-to-2-3/314202)
**Author:** [@pup\_seba](https://discuss.elastic.co/u/pup_seba)\ **Replies:** 0\ **Last updated:** [September 12, 2022, 2:51pm UTC](https://discuss.elastic.co/t/unexpected-pod-restart-after-operator-upgrade-to-2-3/314202 "2022-09-12T14:51:17Z")
Hi, According to documentation, updating our current ECK operator from version 2.2 to 2.3 should have gone without operated pods being restarted. From our operated elasticsearch clusters running in this k8s cluster, 1 w… --- ## [Comment parser un fichier log avec grok](https://discuss.elastic.co/t/comment-parser-un-fichier-log-avec-grok/314166)
**Author:** [@dataslayer](https://discuss.elastic.co/u/dataslayer)\ **Replies:** 2\ **Last updated:** [September 12, 2022, 2:50pm UTC](https://discuss.elastic.co/t/comment-parser-un-fichier-log-avec-grok/314166 "2022-09-12T14:50:03Z")
Bonjour, Je souhaite que logstash récupère les champs "création", "modification" et "suppression" avec les lignes "Nb traitements", "dont crees" et "dont rejetes" mais je ne sais pas comment m'y prendre avec grok même e… --- ## [Watcher -\> How to return a value in a transform](https://discuss.elastic.co/t/watcher-how-to-return-a-value-in-a-transform/314194)
**Author:** [@StephaneRodier](https://discuss.elastic.co/u/StephaneRodier)\ **Replies:** 0\ **Last updated:** [September 12, 2022, 12:39pm UTC](https://discuss.elastic.co/t/watcher-how-to-return-a-value-in-a-transform/314194 "2022-09-12T12:39:01Z")
Hello, I am trying to return a mathematical result with the number of hits of two input chains which would return a percentage, but I am unable to get the value and use it in the actions email. It always returns a "0". A… --- ## [License server IPs](https://discuss.elastic.co/t/license-server-ips/314088)
**Author:** [@jonathanmreiter](https://discuss.elastic.co/u/jonathanmreiter)\ **Replies:** 3\ **Last updated:** [September 12, 2022, 2:30pm UTC](https://discuss.elastic.co/t/license-server-ips/314088 "2022-09-12T14:30:01Z")
Hi there, I'm part of a concern that runs licensed Elasticsearch instances within sensitive environments, and we have been noticing that our instance tries to call home to an unpredictable range of hostnames and IPs ass… --- ## [Logstash error : invalid setting for elasticsearch output plugin](https://discuss.elastic.co/t/logstash-error-invalid-setting-for-elasticsearch-output-plugin/314196)
**Author:** [@sirineb](https://discuss.elastic.co/u/sirineb)\ **Replies:** 2\ **Last updated:** [September 12, 2022, 1:50pm UTC](https://discuss.elastic.co/t/logstash-error-invalid-setting-for-elasticsearch-output-plugin/314196 "2022-09-12T13:50:41Z")
Hi, I have two pipeline configurations located in /etc/logstash/conf.d. I can make work both seperately by running /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/\*\*.conf -r, and it sends data to elasticsearch … --- ## [Autodiscover (k8s) and Kafka module](https://discuss.elastic.co/t/autodiscover-k8s-and-kafka-module/314198)
**Author:** [@AssafKatz3](https://discuss.elastic.co/u/AssafKatz3)\ **Replies:** 0\ **Last updated:** [September 12, 2022, 1:49pm UTC](https://discuss.elastic.co/t/autodiscover-k8s-and-kafka-module/314198 "2022-09-12T13:49:48Z")
Hi, I am trying to understand how can I use Hints based autodiscover with Kafka module while both are running on k8s. Thaksm --- ## [Hive to Elasticsearch index creation failing with dynamic template](https://discuss.elastic.co/t/hive-to-elasticsearch-index-creation-failing-with-dynamic-template/314106)
**Author:** [@Sivakumar\_M](https://discuss.elastic.co/u/Sivakumar_M)\ **Replies:** 1\ **Last updated:** [September 12, 2022, 1:27pm UTC](https://discuss.elastic.co/t/hive-to-elasticsearch-index-creation-failing-with-dynamic-template/314106 "2022-09-12T13:27:26Z")
I have a hive table connected to elasticsearch. Able to create index when I run insert query without an Elasticsearch template, but it is failing when I run with having a template in elastic first and then I run insert q… --- ## [Check if index value is substring of input string](https://discuss.elastic.co/t/check-if-index-value-is-substring-of-input-string/314191)
**Author:** [@rahulkothanath](https://discuss.elastic.co/u/rahulkothanath)\ **Replies:** 2\ **Last updated:** [September 12, 2022, 1:24pm UTC](https://discuss.elastic.co/t/check-if-index-value-is-substring-of-input-string/314191 "2022-09-12T13:24:27Z")
I have an index with field and value like(ES\_VAL: AMERICAN EXPRESS), I want to check if the entire ES\_VAL is substring of an input string(eg: CANADA AMERICAN EXPRESS). this is reverse of normal substring operation as w… --- ## [Ingest Lag or Pipeline not working?](https://discuss.elastic.co/t/ingest-lag-or-pipeline-not-working/314148)
**Author:** [@Ely\_96](https://discuss.elastic.co/u/Ely_96)\ **Replies:** 5\ **Last updated:** [September 12, 2022, 1:02pm UTC](https://discuss.elastic.co/t/ingest-lag-or-pipeline-not-working/314148 "2022-09-12T13:02:31Z")
Hi guys, I have a doubt my pipelines. I have 2 pipelines to see (in Kibana) the most recent requests within a platform. Each request is a json that has a couple of fields and: req-id req-timestamp My pipelines: T… --- ## [Analytics-Discover not displaying data](https://discuss.elastic.co/t/analytics-discover-not-displaying-data/313997)
**Author:** [@el-jefe3](https://discuss.elastic.co/u/el-jefe3)\ **Replies:** 3\ **Last updated:** [September 12, 2022, 12:37pm UTC](https://discuss.elastic.co/t/analytics-discover-not-displaying-data/313997 "2022-09-12T12:37:55Z")
Analytics - Discover is no longer displaying data that is ingested. I could see the data in Observability under stream but can't seem to figure out what would cause the data to not appear in the Analytics - Discover. D… --- ## [Monitoring Request Failed / Saved object not found](https://discuss.elastic.co/t/monitoring-request-failed-saved-object-not-found/313974)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 2\ **Last updated:** [September 12, 2022, 12:36pm UTC](https://discuss.elastic.co/t/monitoring-request-failed-saved-object-not-found/313974 "2022-09-12T12:36:51Z")
Hello World! I'm using Elastic stack v7.17.5 and whenever I go into Kibana =\> Stack Monitoring, I'm seeing flood of messages such as this: "workaround" (sort of) if one goes into Stack Management =\> Alerts and Insi… --- ## [Automatically Kibana Login](https://discuss.elastic.co/t/automatically-kibana-login/313940)
**Author:** [@Irwan\_Kurniawan](https://discuss.elastic.co/u/Irwan_Kurniawan)\ **Replies:** 7\ **Last updated:** [September 12, 2022, 12:21pm UTC](https://discuss.elastic.co/t/automatically-kibana-login/313940 "2022-09-12T12:21:36Z")
I have login page on my own website. How can I pass the login information from my own website to Kibana login so the user no need to login twice? --- ## [How to set priority and how to ignore some words in search query](https://discuss.elastic.co/t/how-to-set-priority-and-how-to-ignore-some-words-in-search-query/314193)
**Author:** [@Fakeknox](https://discuss.elastic.co/u/Fakeknox)\ **Replies:** 0\ **Last updated:** [September 12, 2022, 12:10pm UTC](https://discuss.elastic.co/t/how-to-set-priority-and-how-to-ignore-some-words-in-search-query/314193 "2022-09-12T12:10:38Z")
hello in our database we have title brands , categories , attribute and ... i want to set some priority for search for example we want to search blue jacket jacket is our category and blue is our attribute how can we … --- ## [Anomaly Detection for Rare IPs](https://discuss.elastic.co/t/anomaly-detection-for-rare-ips/314013)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 1\ **Last updated:** [September 12, 2022, 11:03am UTC](https://discuss.elastic.co/t/anomaly-detection-for-rare-ips/314013 "2022-09-12T11:03:24Z")
I am attempting to create a ML job to detect rare source IPs. Using the Anomaly Detection wizard, I selected Categorization, then picked Rare and picked the source.address for Categorization field. However, I get the fol… --- ## [Performance... what is faster using 1 or 2 keyword field in term search?](https://discuss.elastic.co/t/performance-what-is-faster-using-1-or-2-keyword-field-in-term-search/314185)
**Author:** [@kk123](https://discuss.elastic.co/u/kk123)\ **Replies:** 0\ **Last updated:** [September 12, 2022, 10:41am UTC](https://discuss.elastic.co/t/performance-what-is-faster-using-1-or-2-keyword-field-in-term-search/314185 "2022-09-12T10:41:29Z")
Hi, I have ILM based indices that have multiple keyword fields. I want query the data based on these terms. As it turns out, the two keyword fields have the following property... Keyword2 is unique across the all Keywo… --- ## [How to create sla query](https://discuss.elastic.co/t/how-to-create-sla-query/314184)
**Author:** [@Rain\_Water](https://discuss.elastic.co/u/Rain_Water)\ **Replies:** 0\ **Last updated:** [September 12, 2022, 10:38am UTC](https://discuss.elastic.co/t/how-to-create-sla-query/314184 "2022-09-12T10:38:00Z")
Hi im very new to elasticsearch and Currently I am using ELK + Grafana stack i want to create a simple sla query and using the simple math formula to calculate percentage of sla. i have created the formula just dont kon… --- ## [Cluster\_health rule \[missing replica shards\] too much susceptible](https://discuss.elastic.co/t/cluster-health-rule-missing-replica-shards-too-much-susceptible/314183)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 0\ **Last updated:** [September 12, 2022, 10:35am UTC](https://discuss.elastic.co/t/cluster-health-rule-missing-replica-shards-too-much-susceptible/314183 "2022-09-12T10:35:11Z")
Hey there, I have a 7.17 ES cluster with the embedded infrastructure rules & alerts enabled and the usage of ILM for specific kind of indices. I have enabled the "Cluster\_health" rule and I saw that when my ILM policy … --- ## [Java Upgrade doesn't stop elasticsearch. Why?](https://discuss.elastic.co/t/java-upgrade-doesnt-stop-elasticsearch-why/314179)
**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Replies:** 1\ **Last updated:** [September 12, 2022, 10:13am UTC](https://discuss.elastic.co/t/java-upgrade-doesnt-stop-elasticsearch-why/314179 "2022-09-12T10:13:19Z")
I am using external JDK on Oracle Linux 7.9. Elasticsearch service is up and running when I upgrade the java. Also, there are no entries in log. I am not sure about this behavior. Elasticsearch uses ES\_JAVA\_HOME=/usr/bi… --- ## [Does sorting by \_doc remain consistent during paging](https://discuss.elastic.co/t/does-sorting-by-doc-remain-consistent-during-paging/314178)
**Author:** [@daniel-kr](https://discuss.elastic.co/u/daniel-kr)\ **Replies:** 0\ **Last updated:** [September 12, 2022, 9:48am UTC](https://discuss.elastic.co/t/does-sorting-by-doc-remain-consistent-during-paging/314178 "2022-09-12T09:48:08Z")
Hey, I want to page through my search results by using the parameters from and size (no scrolling or search after API with PIT involved). I don't care about the sort order of the whole result set. Therefore, I sort by \_… --- ## [Can't setup apm-integration-testing for debugging kibana](https://discuss.elastic.co/t/cant-setup-apm-integration-testing-for-debugging-kibana/314177)
**Author:** [@se.omarayman](https://discuss.elastic.co/u/se.omarayman)\ **Replies:** 0\ **Last updated:** [September 12, 2022, 9:40am UTC](https://discuss.elastic.co/t/cant-setup-apm-integration-testing-for-debugging-kibana/314177 "2022-09-12T09:40:31Z")
I'm following the developer's guide to contribute to kibana, and I want to debug the app with apm-integration-testing, so I cloned the apm-integration-testing repo, however when I run ./scripts/compose.py start master --… --- ## [Add client role to existing master node](https://discuss.elastic.co/t/add-client-role-to-existing-master-node/313666)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 4\ **Last updated:** [September 12, 2022, 9:19am UTC](https://discuss.elastic.co/t/add-client-role-to-existing-master-node/313666 "2022-09-12T09:19:08Z")
Hi Experts, I have 2 elasticsearch(7.16.2) monitoring cluster with 3 master + data eligible roles. I want enabling CCR between them, I am following document for doing this integration. CCR Link I have run the below c… --- ## [Benefit of Snapshot/Restore vs. raw data collection?](https://discuss.elastic.co/t/benefit-of-snapshot-restore-vs-raw-data-collection/314163)
**Author:** [@azeiner](https://discuss.elastic.co/u/azeiner)\ **Replies:** 4\ **Last updated:** [September 12, 2022, 8:28am UTC](https://discuss.elastic.co/t/benefit-of-snapshot-restore-vs-raw-data-collection/314163 "2022-09-12T08:28:18Z")
I've got a general question about datamanagement in elastic - we're running a couple of on-premise clusters and the data we produce are mostly from textfiles or are generated in various systems, collected in Redis from w… --- ## [Export Transactions](https://discuss.elastic.co/t/export-transactions/314113)
**Author:** [@ahmedakkaya](https://discuss.elastic.co/u/ahmedakkaya)\ **Replies:** 4\ **Last updated:** [September 12, 2022, 8:24am UTC](https://discuss.elastic.co/t/export-transactions/314113 "2022-09-12T08:24:13Z")
hello my original file; #!/bin/bash export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin if \[ -z "$1" \]; then ADAYAGO=\`date --date="1 day ago" +%Y-%m-%d\` else ADAYAGO="$1… --- ## [Kibana Visulization Stats](https://discuss.elastic.co/t/kibana-visulization-stats/313999)
**Author:** [@krishns4](https://discuss.elastic.co/u/krishns4)\ **Replies:** 2\ **Last updated:** [September 12, 2022, 7:37am UTC](https://discuss.elastic.co/t/kibana-visulization-stats/313999 "2022-09-12T07:37:18Z")
Hi All, I was wondering if we have any way to find out what all fields from the logs in Elasticseach are referenced in a given visualization in kibana ? Thanks --- ## [Best way to reindex text to keyword](https://discuss.elastic.co/t/best-way-to-reindex-text-to-keyword/314119)
**Author:** [@Mark\_S](https://discuss.elastic.co/u/Mark_S)\ **Replies:** 2\ **Last updated:** [September 12, 2022, 6:35am UTC](https://discuss.elastic.co/t/best-way-to-reindex-text-to-keyword/314119 "2022-09-12T06:35:20Z")
I want to re-index a text field to keyword. I have multiple indices (myindex-000001, myindex-000002, etc) In order to reindex I must: a) get the mapping b) create a new index mynewindex-000001 same field name but diffe… --- ## [How get the \_source data when the \_source is disabled?](https://discuss.elastic.co/t/how-get-the-source-data-when-the-source-is-disabled/314160)
**Author:** [@Sarthak\_Agarwal](https://discuss.elastic.co/u/Sarthak_Agarwal)\ **Replies:** 2\ **Last updated:** [September 12, 2022, 6:07am UTC](https://discuss.elastic.co/t/how-get-the-source-data-when-the-source-is-disabled/314160 "2022-09-12T06:07:47Z")
I have one index whose \_source is disabled. Now I want to migrate data from this index to a different elasticsearch cluster ? The issue is I only get metadata fields while searching. How can I retrieve and transfer \_sour… --- ## [Filebeat output to file](https://discuss.elastic.co/t/filebeat-output-to-file/314135)
**Author:** [@sriramb12](https://discuss.elastic.co/u/sriramb12)\ **Replies:** 17\ **Last updated:** [September 12, 2022, 2:58am UTC](https://discuss.elastic.co/t/filebeat-output-to-file/314135 "2022-09-12T02:58:16Z")
New to the filebeat and to elastic. I need to fetch o365 logs from azure tenant. I dont want to use ELK stack but just get the json files I configured /etc/filebeat/modules.d/o365.yml also file output under /etc/file… --- ## [How to switch between multiple ES cluster from local kibana](https://discuss.elastic.co/t/how-to-switch-between-multiple-es-cluster-from-local-kibana/314081)
**Author:** [@pkv1982](https://discuss.elastic.co/u/pkv1982)\ **Replies:** 2\ **Last updated:** [September 12, 2022, 2:35am UTC](https://discuss.elastic.co/t/how-to-switch-between-multiple-es-cluster-from-local-kibana/314081 "2022-09-12T02:35:27Z")
is there a way to switch between multiple remote ES cluster from my local kibana? any documentation would be helpful. --- ## [ICU Analysis Plugin doesn't normalize some characters like other languages(PHP, Python)](https://discuss.elastic.co/t/icu-analysis-plugin-doesnt-normalize-some-characters-like-other-languages-php-python/314155)
**Author:** [@mictsai](https://discuss.elastic.co/u/mictsai)\ **Replies:** 0\ **Last updated:** [September 12, 2022, 2:15am UTC](https://discuss.elastic.co/t/icu-analysis-plugin-doesnt-normalize-some-characters-like-other-languages-php-python/314155 "2022-09-12T02:15:43Z")
Elasticsearch version: 7.10.1 Installed plugins: \[analysis-icu, analysis-kuromoji, analysis-nori\] 그래비티 and 그래비티 looks the same. When encoding to URL, 그래비티 is %EA%B7%B8%EB%9E%98%EB%B9%84%ED%8B%B0%20 and 그래비티 is … [Previous page](https://discuss.elastic.co/latest.md?page=969) [Next page](https://discuss.elastic.co/latest.md?page=971)