# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1078 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1079 --- ## [How to search with analyzed text](https://discuss.elastic.co/t/how-to-search-with-analyzed-text/261509)
**Author:** [@Myang\_G](https://discuss.elastic.co/u/Myang_G)\ **Replies:** 2\ **Last updated:** [January 20, 2021, 1:19am UTC](https://discuss.elastic.co/t/how-to-search-with-analyzed-text/261509 "2021-01-20T01:19:35Z")
Hi. I'd like to know if there's a way to use analyzed text when querying. The specific requirement is to search for a matched string in 'term' field && the document's 'term\_length' field should be less than equal to t… --- ## [Failed to parse date field, date\_time\_parse\_exception](https://discuss.elastic.co/t/failed-to-parse-date-field-date-time-parse-exception/261492)
**Author:** [@yulaika](https://discuss.elastic.co/u/yulaika)\ **Replies:** 6\ **Last updated:** [January 20, 2021, 1:02am UTC](https://discuss.elastic.co/t/failed-to-parse-date-field-date-time-parse-exception/261492 "2021-01-20T01:02:59Z")
Here is my configuration: "\[log\]\[timestamp\]" =\> "%{\[yearinlog\]}-%{\[monthinlog\]}-%{\[dateinlog\]} %{\[hourinlog\]}:%{\[minuteinlog\]}:%{\[secondinlog\]}" } } date { match =\> \[ "\[log\]\[timestamp\]", "yyyy-MM-dd HH:mm:ss.SSS00… --- ## [\_update\_by\_query column.column](https://discuss.elastic.co/t/update-by-query-column-column/261605)
**Author:** [@jcornejo](https://discuss.elastic.co/u/jcornejo)\ **Replies:** 5\ **Last updated:** [January 20, 2021, 12:41am UTC](https://discuss.elastic.co/t/update-by-query-column-column/261605 "2021-01-20T00:41:12Z")
I have this example mapping. I need to update the field "shirt.color" mapping { "shirts" : { "mappings" : { "properties" : { "shirt" : { "properties" : { "brand" : { "type" : "keyword" }, "color" : { "… --- ## [Elasticsearch Engineer 1 - Lab 1.1 no route to host](https://discuss.elastic.co/t/elasticsearch-engineer-1-lab-1-1-no-route-to-host/261601)
**Author:** [@Stef\_Nestor](https://discuss.elastic.co/u/Stef_Nestor)\ **Replies:** 1\ **Last updated:** [January 20, 2021, 12:05am UTC](https://discuss.elastic.co/t/elasticsearch-engineer-1-lab-1-1-no-route-to-host/261601 "2021-01-20T00:05:46Z")
Hi Elastic! I'm having trouble w/the beginning of Elastic Engineer I ondemand training 's Lab 1.1. The steps request However, upon attempting, I cannot ssh into server1 & when attempting to ping get a Destination Hos… --- ## [Datestamp to @timestamp](https://discuss.elastic.co/t/datestamp-to-timestamp/261604)
**Author:** [@cyberd](https://discuss.elastic.co/u/cyberd)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 11:21pm UTC](https://discuss.elastic.co/t/datestamp-to-timestamp/261604 "2021-01-19T23:21:34Z")
Hi, So i need to parse this date format from my log: 01/19/21-15:00:26.308390 to the @timestamp so i can filter it in Kibana. So far it looks like this: match =\> { "message" =\> "%{DATESTAMP:mystamp} date { m… --- ## [INITIALIZING shard with REALLOCATED\_REPLICA reason](https://discuss.elastic.co/t/initializing-shard-with-reallocated-replica-reason/261590)
**Author:** [@cmusser](https://discuss.elastic.co/u/cmusser)\ **Replies:** 1\ **Last updated:** [January 19, 2021, 11:03pm UTC](https://discuss.elastic.co/t/initializing-shard-with-reallocated-replica-reason/261590 "2021-01-19T23:03:33Z")
Hi, Our 5 node cluster (this is ES 7.10.1 on Ubuntu 18.04) went yellow last night and when we investigated it this morning, there is shard in the INITIALIZING state, with a "reason" of REALLOCATED\_REPLICA. The shard see… --- ## [Elasticsearch 7.7 - all shards failed and task cancelled with channel closed](https://discuss.elastic.co/t/elasticsearch-7-7-all-shards-failed-and-task-cancelled-with-channel-closed/261184)
**Author:** [@jamesp](https://discuss.elastic.co/u/jamesp)\ **Replies:** 5\ **Last updated:** [January 19, 2021, 7:57pm UTC](https://discuss.elastic.co/t/elasticsearch-7-7-all-shards-failed-and-task-cancelled-with-channel-closed/261184 "2021-01-19T19:57:24Z")
Hello all, I set up a 3 node cluster using the included JRE on Windows 2016 servers with 12 GB RAM (java min/max 6GB) which seemed to be running fine without a lot of traffic. After hooking it up to a search GUI I start… --- ## [Elastic Contributor Program: How to contribute code](https://discuss.elastic.co/t/elastic-contributor-program-how-to-contribute-code/261584)
**Author:** [@riferrei](https://discuss.elastic.co/u/riferrei)\ **Replies:** 0\ **Last updated:** [January 19, 2021, 7:31pm UTC](https://discuss.elastic.co/t/elastic-contributor-program-how-to-contribute-code/261584 "2021-01-19T19:31:12Z")
If you are planning to submit code content for the Elastic Contributor Program but don't know how — I created the resources below to help you with this :partying\_face: :page\_facing\_up: Blog : https://www.elastic.co/bl… --- ## [Circuit Breaking Exception](https://discuss.elastic.co/t/circuit-breaking-exception/259405)
**Author:** [@gorek](https://discuss.elastic.co/u/gorek)\ **Replies:** 10\ **Last updated:** [January 19, 2021, 7:06pm UTC](https://discuss.elastic.co/t/circuit-breaking-exception/259405 "2021-01-19T19:06:20Z")
Hello, we using Elasticsearch for a while and we current have few hundred indices with about 120 millions documents in each index. From some days we often see warnings in elasticsearch logs: org.elasticsearch.common.b… --- ## [Logstash battle scars - metricbeat config and duplicate output](https://discuss.elastic.co/t/logstash-battle-scars-metricbeat-config-and-duplicate-output/261581)
**Author:** [@Declan\_at\_rm](https://discuss.elastic.co/u/Declan_at_rm)\ **Replies:** 0\ **Last updated:** [January 19, 2021, 6:14pm UTC](https://discuss.elastic.co/t/logstash-battle-scars-metricbeat-config-and-duplicate-output/261581 "2021-01-19T18:14:47Z")
Not so much a question but just wanted to share some things to look out for. I should start by saying that overall by experience of ELK is good and I'm certainly sticking with it. Just wanted to share a few details of … --- ## [Azure instance type for logstash](https://discuss.elastic.co/t/azure-instance-type-for-logstash/261580)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 0\ **Last updated:** [January 19, 2021, 6:05pm UTC](https://discuss.elastic.co/t/azure-instance-type-for-logstash/261580 "2021-01-19T18:05:21Z")
Any recommendation of Azure instance type for logstash? --- ## [\[SIEM\] Authentications table doesn't show 'Last Success/Failed Source' column if only 'source.ip' is present](https://discuss.elastic.co/t/siem-authentications-table-doesnt-show-last-success-failed-source-column-if-only-source-ip-is-present/261257)
**Author:** [@eextreemee](https://discuss.elastic.co/u/eextreemee)\ **Replies:** 6\ **Last updated:** [January 19, 2021, 5:25pm UTC](https://discuss.elastic.co/t/siem-authentications-table-doesnt-show-last-success-failed-source-column-if-only-source-ip-is-present/261257 "2021-01-19T17:25:17Z")
I found solution here but i don't know how to implement it. please help... --- ## [Make ES Queries from my Custom Kibana Plugin](https://discuss.elastic.co/t/make-es-queries-from-my-custom-kibana-plugin/261416)
**Author:** [@xenon-xenon](https://discuss.elastic.co/u/xenon-xenon)\ **Replies:** 7\ **Last updated:** [January 19, 2021, 5:10pm UTC](https://discuss.elastic.co/t/make-es-queries-from-my-custom-kibana-plugin/261416 "2021-01-19T17:10:49Z")
I'm looking for best way of create ES queries from my plugin like : without ES authentication stuff I mean best and recommended way --- ## [Parse JSON input file, extract fields and write them in output file](https://discuss.elastic.co/t/parse-json-input-file-extract-fields-and-write-them-in-output-file/261543)
**Author:** [@fantonio](https://discuss.elastic.co/u/fantonio)\ **Replies:** 1\ **Last updated:** [January 19, 2021, 4:29pm UTC](https://discuss.elastic.co/t/parse-json-input-file-extract-fields-and-write-them-in-output-file/261543 "2021-01-19T16:29:34Z")
I have an input file where each line is a JSON object like the following: { "status\_code" =\> "200", "method" =\> "GET", "country" =\> "US", "field" =\> "something", } T… --- ## [How do I keep my log level field from wrapping?](https://discuss.elastic.co/t/how-do-i-keep-my-log-level-field-from-wrapping/261479)
**Author:** [@Robert\_DiFalco](https://discuss.elastic.co/u/Robert_DiFalco)\ **Replies:** 3\ **Last updated:** [January 19, 2021, 4:25pm UTC](https://discuss.elastic.co/t/how-do-i-keep-my-log-level-field-from-wrapping/261479 "2021-01-19T16:25:39Z")
How do I prevent Kibana from wrapping the level field? I am using filebeat to post data. I'm assuming the only way is to make the field name longer? Really? --- ## [Multiple Enterprise Search Instances](https://discuss.elastic.co/t/multiple-enterprise-search-instances/261541)
**Author:** [@pesc](https://discuss.elastic.co/u/pesc)\ **Replies:** 1\ **Last updated:** [January 19, 2021, 4:14pm UTC](https://discuss.elastic.co/t/multiple-enterprise-search-instances/261541 "2021-01-19T16:14:07Z")
Hi Is it possible to setup multiple EnterpriseSearch Instance on a Elasticsearch Cluster? What I'd like to do: Server01: Part of Elasticsearch-Cluster (192.168.0.1:9200) + EnterpiseSearch (192.168.0.1:3200) Server02:… --- ## [No es posible borrar un index pattern en Kibana](https://discuss.elastic.co/t/no-es-posible-borrar-un-index-pattern-en-kibana/261296)
**Author:** [@Leo78](https://discuss.elastic.co/u/Leo78)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 3:54pm UTC](https://discuss.elastic.co/t/no-es-posible-borrar-un-index-pattern-en-kibana/261296 "2021-01-19T15:54:07Z")
Hola comunidad, buenas tardes. Admito que soy nuevo en Kibana, por tanto requiero de sus sugerencias. La cuestión es simple, lo que yo quiero es borrar un index-pattern para poder volver a crearlo desde cero. Hago c… --- ## [ECK elasticsearch - 500](https://discuss.elastic.co/t/eck-elasticsearch-500/261462)
**Author:** [@PaulRudin](https://discuss.elastic.co/u/PaulRudin)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 3:46pm UTC](https://discuss.elastic.co/t/eck-elasticsearch-500/261462 "2021-01-19T15:46:02Z")
I had elasticsearch running in a cluster and all was well... however now I get 500s and the logs are full of stack traces. The first few lines: "at org.elasticsearch.xpack.security.authc.AuthenticationService.authenti… --- ## [Elasticsearch raw events](https://discuss.elastic.co/t/elasticsearch-raw-events/261052)
**Author:** [@karanp](https://discuss.elastic.co/u/karanp)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 3:41pm UTC](https://discuss.elastic.co/t/elasticsearch-raw-events/261052 "2021-01-19T15:41:08Z")
So we have to create visualizations on raw event data in Elasticsearch. The data would include all the stages for that data in the same index for historical uses. The question is how do we look at data and only get the m… --- ## [Logstash text to array conversion](https://discuss.elastic.co/t/logstash-text-to-array-conversion/261393)
**Author:** [@thotakura2](https://discuss.elastic.co/u/thotakura2)\ **Replies:** 1\ **Last updated:** [January 19, 2021, 3:30pm UTC](https://discuss.elastic.co/t/logstash-text-to-array-conversion/261393 "2021-01-19T15:30:38Z")
Hi all, I am trying to index data from MySQL and one of the fields is delimited by ; and ,. I want to convert it into array by delimiting it with both the characters. Currently i am using the following filter: filt… --- ## [Multiple field formatters](https://discuss.elastic.co/t/multiple-field-formatters/261468)
**Author:** [@pfennema](https://discuss.elastic.co/u/pfennema)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 9:53am UTC](https://discuss.elastic.co/t/multiple-field-formatters/261468 "2021-01-19T09:53:58Z")
I currently have a dashboard (thanks to the enhanced table plugin) which shows a percentage in the table. The percentage is calculated by combining 2 fields into a scripted field ('percentage'). If the percentage is belo… --- ## [Restrict the kibana user for one machine only](https://discuss.elastic.co/t/restrict-the-kibana-user-for-one-machine-only/261546)
**Author:** [@mrunalini](https://discuss.elastic.co/u/mrunalini)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 3:10pm UTC](https://discuss.elastic.co/t/restrict-the-kibana-user-for-one-machine-only/261546 "2021-01-19T15:10:23Z")
HI , My basic requirement here is to restrict any Kibana user for one machine only ,so that same user can not login from different machine at the same time. is there any setting needs to modify in kibana.yml file or an… --- ## [Elastic Contributor Program: Tips for creating written content](https://discuss.elastic.co/t/elastic-contributor-program-tips-for-creating-written-content/261185)
**Author:** [@riferrei](https://discuss.elastic.co/u/riferrei)\ **Replies:** 0\ **Last updated:** [January 14, 2021, 10:17pm UTC](https://discuss.elastic.co/t/elastic-contributor-program-tips-for-creating-written-content/261185 "2021-01-14T22:17:47Z")
If you are planning to submit a written content (articles, blogs, tutorials, workshops) for the Elastic Contributor Program but don't know how — I created the resources below to help you with this :partying\_face: :pag… --- ## [How can I easily implement pseudo-relevance feedback in a full-text search application?](https://discuss.elastic.co/t/how-can-i-easily-implement-pseudo-relevance-feedback-in-a-full-text-search-application/261564)
**Author:** [@Soumya\_Ranjan\_Sahoo](https://discuss.elastic.co/u/Soumya_Ranjan_Sahoo)\ **Replies:** 0\ **Last updated:** [January 19, 2021, 3:01pm UTC](https://discuss.elastic.co/t/how-can-i-easily-implement-pseudo-relevance-feedback-in-a-full-text-search-application/261564 "2021-01-19T15:01:33Z")
Hi, I want to implement pseudo-relevance feedback, together with a bm25 ranking function, for a full-text search application. Is there any reference that I can look up for implementing this? I have just one field in my … --- ## [Logstash fails to start](https://discuss.elastic.co/t/logstash-fails-to-start/261558)
**Author:** [@karthik\_s2](https://discuss.elastic.co/u/karthik_s2)\ **Replies:** 0\ **Last updated:** [January 19, 2021, 2:32pm UTC](https://discuss.elastic.co/t/logstash-fails-to-start/261558 "2021-01-19T14:32:34Z")
When i tired to start with the command (logstash.bat -f logstash.conf) in the prompt. The below output is written and logstash doesn't start. Using JAVA\_HOME defined java: C:\\Program Files\\Java\\jdk1.8.0\_221; WARNING, … --- ## [Redundancy in logstash for syslog devices](https://discuss.elastic.co/t/redundancy-in-logstash-for-syslog-devices/261557)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 0\ **Last updated:** [January 19, 2021, 2:32pm UTC](https://discuss.elastic.co/t/redundancy-in-logstash-for-syslog-devices/261557 "2021-01-19T14:32:10Z")
We are in process of upgrading our ELK stack to 7.6 and i need suggestions on configuration for network devices ( Big IP LTM ) for example. The current config has one logstash IP as syslog server , in an event of failur… --- ## [Custom Plugin in restricted network](https://discuss.elastic.co/t/custom-plugin-in-restricted-network/261556)
**Author:** [@mastersmit](https://discuss.elastic.co/u/mastersmit)\ **Replies:** 0\ **Last updated:** [January 19, 2021, 2:17pm UTC](https://discuss.elastic.co/t/custom-plugin-in-restricted-network/261556 "2021-01-19T14:17:52Z")
I was trying to write a custom plugin, however when i am trying to build bundle install it is saying unable to connect to online ruby gems. Is there a way to avoid going to the official source of ruby gems, as downloadi… --- ## [Logstash - replace @timestamp](https://discuss.elastic.co/t/logstash-replace-timestamp/261553)
**Author:** [@iccMe](https://discuss.elastic.co/u/iccMe)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 2:16pm UTC](https://discuss.elastic.co/t/logstash-replace-timestamp/261553 "2021-01-19T14:16:49Z")
Hi, Looking for help with a date and time filter in logstash. I created a new Time field putting together a previous date and time field that I subsequently drop. The new Time field looks like the below in my output: "… --- ## [Why \`elastic-es-default-0\` (which is the pod name for my Elasticsearch) becomes a "host"?](https://discuss.elastic.co/t/why-elastic-es-default-0-which-is-the-pod-name-for-my-elasticsearch-becomes-a-host/261490)
**Author:** [@fzyzcjy](https://discuss.elastic.co/u/fzyzcjy)\ **Replies:** 1\ **Last updated:** [January 19, 2021, 2:12pm UTC](https://discuss.elastic.co/t/why-elastic-es-default-0-which-is-the-pod-name-for-my-elasticsearch-becomes-a-host/261490 "2021-01-19T14:12:08Z")
It behaves like a host... For example, see the screenshot. The test-one-01106 is a real kubernetes worker machine, but the elastic-es-default-0 is not... Thanks! --- ## [Terms Aggregation Partitioning + filter buckets](https://discuss.elastic.co/t/terms-aggregation-partitioning-filter-buckets/261550)
**Author:** [@Nam\_Nguyen](https://discuss.elastic.co/u/Nam_Nguyen)\ **Replies:** 0\ **Last updated:** [January 19, 2021, 1:40pm UTC](https://discuss.elastic.co/t/terms-aggregation-partitioning-filter-buckets/261550 "2021-01-19T13:40:05Z")
Hey :wave:, Context I am currently struggling to create a proper query for the following use case. Let's say I wanted to create a group-by aggregation for e.g. term app:.\*, I would do the following: "terms":… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1077) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1079)