# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1146 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1147 --- ## [Regex in Kibana Search bar?](https://discuss.elastic.co/t/regex-in-kibana-search-bar/255944)
**Author:** [@cskowronnek](https://discuss.elastic.co/u/cskowronnek)\ **Replies:** 2\ **Last updated:** [November 19, 2020, 9:51am UTC](https://discuss.elastic.co/t/regex-in-kibana-search-bar/255944 "2020-11-19T09:51:37Z")
Hi all, I have a text field which I want to query for values containing only digits. This search works just fine: "query": { "regexp":{ "Overall State": "\[0-9\]\*" } } When I try to p… --- ## [Unable to get X-Forwarded-For to display](https://discuss.elastic.co/t/unable-to-get-x-forwarded-for-to-display/255176)
**Author:** [@computerbart](https://discuss.elastic.co/u/computerbart)\ **Replies:** 6\ **Last updated:** [November 19, 2020, 9:24am UTC](https://discuss.elastic.co/t/unable-to-get-x-forwarded-for-to-display/255176 "2020-11-19T09:24:29Z")
Hi All, New user here. I set out to try Elastic Stack for some more visibility/search-ability for our IIS logs. Unfortunately I have bumped into something I cannot get to work. I set up a 3 node Elastic cluster + Kiban… --- ## [After adding new mapping half way through re-indexing fails](https://discuss.elastic.co/t/after-adding-new-mapping-half-way-through-re-indexing-fails/255951)
**Author:** [@NutaN\_Shrivastava](https://discuss.elastic.co/u/NutaN_Shrivastava)\ **Replies:** 2\ **Last updated:** [November 19, 2020, 9:17am UTC](https://discuss.elastic.co/t/after-adding-new-mapping-half-way-through-re-indexing-fails/255951 "2020-11-19T09:17:50Z")
I used the below code to add new mapping to a new index PUT \_index\_template/engage-logs { "index\_patterns": \[ "engage-log-reindexed-\*" \], "template": { "mappings": { "dynamic\_… --- ## [Create Kibana dashboard has problems](https://discuss.elastic.co/t/create-kibana-dashboard-has-problems/255015)
**Author:** [@bogdan.oproescu](https://discuss.elastic.co/u/bogdan.oproescu)\ **Replies:** 11\ **Last updated:** [November 19, 2020, 8:50am UTC](https://discuss.elastic.co/t/create-kibana-dashboard-has-problems/255015 "2020-11-19T08:50:29Z")
Hello discuss.elastic.co, My name is Bogdan Oproescu, and I am senior data architect for EasyDO Technologies in Bucharest. I am leading our Elastic projects and technology at EasyDO, and we currently have the following … --- ## [Aggregation with significant\_text on wildcard fields](https://discuss.elastic.co/t/aggregation-with-significant-text-on-wildcard-fields/255921)
**Author:** [@newman\_chiang](https://discuss.elastic.co/u/newman_chiang)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 8:39am UTC](https://discuss.elastic.co/t/aggregation-with-significant-text-on-wildcard-fields/255921 "2020-11-19T08:39:07Z")
Hi, everyone I have query below GET contract/\_search { "query": { "bool": { "should": \[ { "query\_string": { "fields": \[ … --- ## [Pipeline+geoip](https://discuss.elastic.co/t/pipeline-geoip/255665)
**Author:** [@es7x](https://discuss.elastic.co/u/es7x)\ **Replies:** 2\ **Last updated:** [November 19, 2020, 8:24am UTC](https://discuss.elastic.co/t/pipeline-geoip/255665 "2020-11-19T08:24:57Z")
Не могу сообразить, почему не обрабатывается geoip в pipeline.? Есть стандартный filebeat-7.10.0-haproxy-log-pipeline в нем присутствует geoip processorы "geoip" : { "field" : "source.ip", "… --- ## [How to setup 2 Node Cluster](https://discuss.elastic.co/t/how-to-setup-2-node-cluster/255937)
**Author:** [@azeiner](https://discuss.elastic.co/u/azeiner)\ **Replies:** 4\ **Last updated:** [November 19, 2020, 8:20am UTC](https://discuss.elastic.co/t/how-to-setup-2-node-cluster/255937 "2020-11-19T08:20:03Z")
Hi everybody, i've got a question concerning a project we're doing currently where the customer is only willing to use his existing 2 VM's for an Elastic cluster which concerns me a little bit - normally we use 3+ nodes … --- ## [Indexing and reindexing index with single shard take too much time](https://discuss.elastic.co/t/indexing-and-reindexing-index-with-single-shard-take-too-much-time/255942)
**Author:** [@Dahea\_Moon](https://discuss.elastic.co/u/Dahea_Moon)\ **Replies:** 7\ **Last updated:** [November 19, 2020, 8:15am UTC](https://discuss.elastic.co/t/indexing-and-reindexing-index-with-single-shard-take-too-much-time/255942 "2020-11-19T08:15:06Z")
Hi, Elastic Team I cannot understand why indexing and reindexing my index takes too much time. I'm using Elasticsearch 7.9.0 with two nodes. (Nodes have default setting; both can be master and data.) There is only one… --- ## [Generate .csv using Elasticsearch API](https://discuss.elastic.co/t/generate-csv-using-elasticsearch-api/255841)
**Author:** [@Aniket\_Salvi](https://discuss.elastic.co/u/Aniket_Salvi)\ **Replies:** 5\ **Last updated:** [November 19, 2020, 7:48am UTC](https://discuss.elastic.co/t/generate-csv-using-elasticsearch-api/255841 "2020-11-19T07:48:45Z")
Hi team, Can I create .csv file using Elasticsearch REST API. Because I want automatic .csv file generation mechanism. Thanks --- ## [Failed to find action \[org.elasticsearch.script.mustache.SearchTemplateAction@76440dba\] to execute](https://discuss.elastic.co/t/failed-to-find-action-org-elasticsearch-script-mustache-searchtemplateaction-76440dba-to-execute/255644)
**Author:** [@rakeshdkaatkar](https://discuss.elastic.co/u/rakeshdkaatkar)\ **Replies:** 6\ **Last updated:** [November 19, 2020, 7:24am UTC](https://discuss.elastic.co/t/failed-to-find-action-org-elasticsearch-script-mustache-searchtemplateaction-76440dba-to-execute/255644 "2020-11-19T07:24:29Z")
Im getting below exception when im trying to use mustache template. failed to find action \[org.elasticsearch.script.mustache.SearchTemplateAction@76440dba\] to execute --- ## [ElasticSearch7.9.3 can't start successfully as a window service in win10 system](https://discuss.elastic.co/t/elasticsearch7-9-3-cant-start-successfully-as-a-window-service-in-win10-system/255784)
**Author:** [@sunweiconfidence](https://discuss.elastic.co/u/sunweiconfidence)\ **Replies:** 3\ **Last updated:** [November 19, 2020, 7:23am UTC](https://discuss.elastic.co/t/elasticsearch7-9-3-cant-start-successfully-as-a-window-service-in-win10-system/255784 "2020-11-19T07:23:09Z")
hi, i coonfigure the elasticsearch.yml and jvm.option, can work normally in cmd window, but when i put it as a window service, it can start and running, after several seconds, it stop the service, error log as below, i … --- ## [When I upgrade ES from 7.0.0 to 7.9.0 my custom plugin(which contain mustache) is not working](https://discuss.elastic.co/t/when-i-upgrade-es-from-7-0-0-to-7-9-0-my-custom-plugin-which-contain-mustache-is-not-working/255936)
**Author:** [@rakeshdkaatkar](https://discuss.elastic.co/u/rakeshdkaatkar)\ **Replies:** 0\ **Last updated:** [November 19, 2020, 7:21am UTC](https://discuss.elastic.co/t/when-i-upgrade-es-from-7-0-0-to-7-9-0-my-custom-plugin-which-contain-mustache-is-not-working/255936 "2020-11-19T07:21:38Z")
I have placed lang-mustache-client-7.9.0.jar to libs and deleted lang-mustache folder from modules.But im getting below error. TenantNull failed to find action \[org.elasticsearch.script.mustache.SearchTemplateAction@764… --- ## [Index management in Kibana](https://discuss.elastic.co/t/index-management-in-kibana/255771)
**Author:** [@since1976](https://discuss.elastic.co/u/since1976)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 6:17am UTC](https://discuss.elastic.co/t/index-management-in-kibana/255771 "2020-11-19T06:17:20Z")
Hi, From Kibana, dashboard, how do we know which are the indicies being used in the dashboard? And how do we remove these indices if its not needed Any beginner guide for indices management? --- ## [Get data from excel file into elasticsearch](https://discuss.elastic.co/t/get-data-from-excel-file-into-elasticsearch/255926)
**Author:** [@111411](https://discuss.elastic.co/u/111411)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 5:49am UTC](https://discuss.elastic.co/t/get-data-from-excel-file-into-elasticsearch/255926 "2020-11-19T05:49:36Z")
hello. I'm try get data from excel file into elasticsearch. Message: Error: wrong number of arguments (given 0, expected 3) Exception: ArgumentError Stack: /Users/nguyenzuanbka/logstash-7.10.0/vendor/bundle/jruby/2.… --- ## [Update\_by\_query/delete\_by\_query conflicts=proceed doesn't actually perform the operation?](https://discuss.elastic.co/t/update-by-query-delete-by-query-conflicts-proceed-doesnt-actually-perform-the-operation/255907)
**Author:** [@redec](https://discuss.elastic.co/u/redec)\ **Replies:** 1\ **Last updated:** [November 18, 2020, 10:28pm UTC](https://discuss.elastic.co/t/update-by-query-delete-by-query-conflicts-proceed-doesnt-actually-perform-the-operation/255907 "2020-11-18T22:28:08Z")
I just discovered that conflicts=proceed doesn't mean "proceed with the requested operation when a conflict occurs"...instead it apparently means "just skip doing the requested operation on that document". I really wish… --- ## [Date formatting](https://discuss.elastic.co/t/date-formatting/255898)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 2\ **Last updated:** [November 18, 2020, 9:56pm UTC](https://discuss.elastic.co/t/date-formatting/255898 "2020-11-18T21:56:31Z")
I have a datafile I wish to ingest using Logstash. Historically I've always used CLI tools to manipulate the date/time fields to be easier to map using a .conf file (my imports tend to be CSV in nature). I was just won… --- ## [Multiple publish\_host for nodes communication behind a firewall](https://discuss.elastic.co/t/multiple-publish-host-for-nodes-communication-behind-a-firewall/255821)
**Author:** [@Vincent\_DOS\_SANTOS](https://discuss.elastic.co/u/Vincent_DOS_SANTOS)\ **Replies:** 3\ **Last updated:** [November 18, 2020, 9:48pm UTC](https://discuss.elastic.co/t/multiple-publish-host-for-nodes-communication-behind-a-firewall/255821 "2020-11-18T21:48:15Z")
Hi, we currently have a cluster in version 7.6.0, composed of 28 nodes spread over 2 datacenters : 14 in datacenter A (named es1-A, es2-A, ..., es14-A) 14 in datacenter B (named es1-B, es2-B, ..., es14-B) 3 nodes are… --- ## [Impact if disabling shards rebalancing](https://discuss.elastic.co/t/impact-if-disabling-shards-rebalancing/255831)
**Author:** [@Shubham](https://discuss.elastic.co/u/Shubham)\ **Replies:** 2\ **Last updated:** [November 18, 2020, 9:46pm UTC](https://discuss.elastic.co/t/impact-if-disabling-shards-rebalancing/255831 "2020-11-18T21:46:18Z")
Hi , Will there be any negative impact if I disallow shards rebalancing? I want to disable rebalancing because my cluster is going into yellow state too frequently as some shards become unassigned. --- ## [ElasticSearch partial word search](https://discuss.elastic.co/t/elasticsearch-partial-word-search/255888)
**Author:** [@gilleo24](https://discuss.elastic.co/u/gilleo24)\ **Replies:** 1\ **Last updated:** [November 18, 2020, 9:41pm UTC](https://discuss.elastic.co/t/elasticsearch-partial-word-search/255888 "2020-11-18T21:41:39Z")
I'm trying to search for a result by using part of a word and not getting a result. i.e. Bob's Wood Fried Pizzaeria The term "Pizza" in my search application does not bring this result back. Neither does "Woo". But … --- ## [Can anyone please explain me a query hierarchy?](https://discuss.elastic.co/t/can-anyone-please-explain-me-a-query-hierarchy/255904)
**Author:** [@lessless](https://discuss.elastic.co/u/lessless)\ **Replies:** 0\ **Last updated:** [November 18, 2020, 9:41pm UTC](https://discuss.elastic.co/t/can-anyone-please-explain-me-a-query-hierarchy/255904 "2020-11-18T21:41:36Z")
Hi, today I faced a situation when putting filters in query -\> bool -\> filter -\> bool -\> should and query -\> bool -\> filter lead to completely different results. Can anyone explain to me why is that and also please t… --- ## [Continuously copy specific documents to another index?](https://discuss.elastic.co/t/continuously-copy-specific-documents-to-another-index/255765)
**Author:** [@Thomas\_D1](https://discuss.elastic.co/u/Thomas_D1)\ **Replies:** 8\ **Last updated:** [November 18, 2020, 9:28pm UTC](https://discuss.elastic.co/t/continuously-copy-specific-documents-to-another-index/255765 "2020-11-18T21:28:16Z")
Hi All, we're using Elasticsearch for storing our application logs using daily indexes, which we delete after two weeks. Now we would like to keep all logs with the loglevel "error" for another 2 months. We thought abo… --- ## [Node.processors setting](https://discuss.elastic.co/t/node-processors-setting/255879)
**Author:** [@wazzu62](https://discuss.elastic.co/u/wazzu62)\ **Replies:** 1\ **Last updated:** [November 18, 2020, 9:27pm UTC](https://discuss.elastic.co/t/node-processors-setting/255879 "2020-11-18T21:27:12Z")
I have an ES cluster running 7.4.2. 14 physical servers, 37 ES nodes. Some of the servers run 2 ES nodes, some run 3 ES nodes. Would like to use the node-processor setting. The servers have 48 processors in them. T… --- ## [Transform date to ELK](https://discuss.elastic.co/t/transform-date-to-elk/255878)
**Author:** [@Matias\_Aguero\_Escoba](https://discuss.elastic.co/u/Matias_Aguero_Escoba)\ **Replies:** 1\ **Last updated:** [November 18, 2020, 9:26pm UTC](https://discuss.elastic.co/t/transform-date-to-elk/255878 "2020-11-18T21:26:20Z")
Hi everyone! my name is Matias Aguero, I need to transform a date value field with the format "2019-08-23 17:28:22 UTC" through a logstash pipeline to the format "2020-10-22T14:42:10". how i do this? Thanks! --- ## [Extraction Elastic SIEM security events](https://discuss.elastic.co/t/extraction-elastic-siem-security-events/254927)
**Author:** [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\ **Replies:** 5\ **Last updated:** [November 18, 2020, 8:38pm UTC](https://discuss.elastic.co/t/extraction-elastic-siem-security-events/254927 "2020-11-18T20:38:02Z")
Hi There, Is there a possibility of extracting all the raw documents of elasticsearch with respect to SIEM events . For example if we have rule name : \[Unusual Login Activity\] and we have enabled this particular out o… --- ## [Date aggregation query based out of a range](https://discuss.elastic.co/t/date-aggregation-query-based-out-of-a-range/255895)
**Author:** [@Alok\_Ranjan](https://discuss.elastic.co/u/Alok_Ranjan)\ **Replies:** 0\ **Last updated:** [November 18, 2020, 8:15pm UTC](https://discuss.elastic.co/t/date-aggregation-query-based-out-of-a-range/255895 "2020-11-18T20:15:13Z")
Hi All, I have a simple requirement to get the aggregated result as per the posted date like documents posted any day, today, less than 7 days, less than 30 days, or greater than 30 days. I wrote a simple date range qu… --- ## [Pipeline to Pipelines configuration](https://discuss.elastic.co/t/pipeline-to-pipelines-configuration/255343)
**Author:** [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\ **Replies:** 3\ **Last updated:** [November 18, 2020, 8:11pm UTC](https://discuss.elastic.co/t/pipeline-to-pipelines-configuration/255343 "2020-11-18T20:11:11Z")
Hello, I want to use the pipeline to pipeline communication in pipeline creation in kibana, But i want the same input to send to 2 different pipelines. My code is the following but doesn't seem to work. input { be… --- ## [Сбор логов кластера Elasticsearch и audit logging из контейнеров](https://discuss.elastic.co/t/elasticsearch-audit-logging/253296)
**Author:** [@Sergei\_Frolov](https://discuss.elastic.co/u/Sergei_Frolov)\ **Replies:** 2\ **Last updated:** [November 18, 2020, 7:55pm UTC](https://discuss.elastic.co/t/elasticsearch-audit-logging/253296 "2020-11-18T19:55:49Z")
Добрый день! Кластер Elasticsearch запущен из docker-compose. Посоветуйте, возможно ли собирать логи кластера и логи audit logging из контейнеров с помощью Filebeat? Или стоит пробрасывать логи наружу и собирать традицио… --- ## [ElasticSearch Optimizing questions](https://discuss.elastic.co/t/elasticsearch-optimizing-questions/253233)
**Author:** [@Joran](https://discuss.elastic.co/u/Joran)\ **Replies:** 4\ **Last updated:** [November 18, 2020, 6:30pm UTC](https://discuss.elastic.co/t/elasticsearch-optimizing-questions/253233 "2020-11-18T18:30:13Z")
Just a heads-up, this is the first time I post something on this forum. I'm a data scientist working at a start-up and we use elasticsearch to store, and query our data. We have used ES with much success over the last y… --- ## [Kibana can't open through nginx](https://discuss.elastic.co/t/kibana-cant-open-through-nginx/255335)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 12\ **Last updated:** [November 18, 2020, 4:47pm UTC](https://discuss.elastic.co/t/kibana-cant-open-through-nginx/255335 "2020-11-18T16:47:56Z")
I am using elk stack 7.9 with xpack-security. When i dont use nginx it works properly( a login page comes up of kibana).When i use nginx.. i provide the user name and password of nginx but kibana page doesn't open.. i … --- ## [Invalid index name \[\_all\], must not start with '\_'\]](https://discuss.elastic.co/t/invalid-index-name-all-must-not-start-with/255808)
**Author:** [@lankin1](https://discuss.elastic.co/u/lankin1)\ **Replies:** 1\ **Last updated:** [November 18, 2020, 4:35pm UTC](https://discuss.elastic.co/t/invalid-index-name-all-must-not-start-with/255808 "2020-11-18T16:35:00Z")
Hi all, When I try to delete all documents by id: POST /\_all/\_delete\_by\_query {"query": {"match": {"id":"xxxxxxxx"} }} I get the following error: 400 Bad Request: \[{"error":"RemoteTransportException\[\[Launch\_001\]\[inet… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1145) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1147)