# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1204 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1205 --- ## [\[Elastic Cloud\] Shipped JSON logs sometimes not parsed](https://discuss.elastic.co/t/elastic-cloud-shipped-json-logs-sometimes-not-parsed/251382)
**Author:** [@val](https://discuss.elastic.co/u/val)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 7:06am UTC](https://discuss.elastic.co/t/elastic-cloud-shipped-json-logs-sometimes-not-parsed/251382 "2020-10-08T07:06:51Z")
Recently, Elastic Cloud has added the ability to also ship logs to a remote monitoring cluster. Enabling that feature worked great, however, I'm seeing parsing issues in the elasticsearch.server dataset. Two subsequent … --- ## [Автодополнение/живой поиск](https://discuss.elastic.co/t/topic/251119)
**Author:** [@bikeformer](https://discuss.elastic.co/u/bikeformer)\ **Replies:** 4\ **Last updated:** [October 8, 2020, 6:56am UTC](https://discuss.elastic.co/t/topic/251119 "2020-10-08T06:56:57Z")
Здравствуйте, уже несколько дней мучаюсь над реализацией автодополнения. К примеру у нас есть документ с title: "маша ходила за зайцем и искала помидор". Я пытаюсь сделать так чтоб пользователь мог найти этот документ … --- ## [Queries get slow while indexing documents](https://discuss.elastic.co/t/queries-get-slow-while-indexing-documents/251243)
**Author:** [@taichi](https://discuss.elastic.co/u/taichi)\ **Replies:** 8\ **Last updated:** [October 8, 2020, 6:52am UTC](https://discuss.elastic.co/t/queries-get-slow-while-indexing-documents/251243 "2020-10-08T06:52:01Z")
I have an index with approximately 2.3M documents. It usually returns results of query within 1~2 seconds, but it gets very slow (sometimes as long as 20~30s) while I'm inserting data into the index. I insert data in R… --- ## [Bar Chart axis label not in center of bar](https://discuss.elastic.co/t/bar-chart-axis-label-not-in-center-of-bar/250955)
**Author:** [@Nicolas\_Deleplace](https://discuss.elastic.co/u/Nicolas_Deleplace)\ **Replies:** 3\ **Last updated:** [October 8, 2020, 6:41am UTC](https://discuss.elastic.co/t/bar-chart-axis-label-not-in-center-of-bar/250955 "2020-10-08T06:41:48Z")
Hi, exact same issue as https://discuss.elastic.co/t/bar-chart-axis-label-not-in-center-of-bar/247039 Why is this topic closed with no solution ? Thanks for helping :slight\_smile: Example : missing January and not c… --- ## [\[Elastic Cloud\] Logs are shipped without ILM policy](https://discuss.elastic.co/t/elastic-cloud-logs-are-shipped-without-ilm-policy/251377)
**Author:** [@val](https://discuss.elastic.co/u/val)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 6:41am UTC](https://discuss.elastic.co/t/elastic-cloud-logs-are-shipped-without-ilm-policy/251377 "2020-10-08T06:41:45Z")
Recently, Elastic Cloud has added the ability to also ship logs to a remote monitoring cluster. Enabling that feature worked great, except for one single thing. The index called elastic-cloud-logs-7-2020.10.08-000001 wa… --- ## [Reporting on Multiple Indices in elastic](https://discuss.elastic.co/t/reporting-on-multiple-indices-in-elastic/251376)
**Author:** [@Khushboo2908](https://discuss.elastic.co/u/Khushboo2908)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 6:37am UTC](https://discuss.elastic.co/t/reporting-on-multiple-indices-in-elastic/251376 "2020-10-08T06:37:28Z")
I have multiple indices in elastic and I need to generate reports using all of them. Description of indices: Ticket: Fields: Ticket\_id, campaign\_id, customer\_id, \ Campaign Fields: campaign\_id… --- ## [Pipeline name in body of \_update\_by\_query request](https://discuss.elastic.co/t/pipeline-name-in-body-of-update-by-query-request/251128)
**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\ **Replies:** 6\ **Last updated:** [October 8, 2020, 6:20am UTC](https://discuss.elastic.co/t/pipeline-name-in-body-of-update-by-query-request/251128 "2020-10-08T06:20:42Z")
Hello, is it possible to specify id/name of pipeline in body of \_update\_by\_query request? POST \_update\_by\_query?pipeline=id\_of\_pipeline { # How to specify pipeline here? Is it possible? } --- ## [Combine two queries](https://discuss.elastic.co/t/combine-two-queries/251346)
**Author:** [@zen.xen](https://discuss.elastic.co/u/zen.xen)\ **Replies:** 1\ **Last updated:** [October 8, 2020, 6:19am UTC](https://discuss.elastic.co/t/combine-two-queries/251346 "2020-10-08T06:19:43Z")
Hello, I want to combine two queries into one: query 1: { "query": { "match\_phrase": { "m09-event-id.keyword": "DELIVER" } } } query 2: { "query": { "match\_phrase": { "m23-directionalit… --- ## [Restrict time range for users in kibana](https://discuss.elastic.co/t/restrict-time-range-for-users-in-kibana/251371)
**Author:** [@Saurabh\_Anand](https://discuss.elastic.co/u/Saurabh_Anand)\ **Replies:** 1\ **Last updated:** [October 8, 2020, 5:38am UTC](https://discuss.elastic.co/t/restrict-time-range-for-users-in-kibana/251371 "2020-10-08T05:38:24Z")
Is it possible to restrict time ranges for different users in Kibana? For example User1 can not search data before 90 days. User1 can only see those data available between now to 90 days before? --- ## [Logstash daily indices write to wrong (yesterday) date](https://discuss.elastic.co/t/logstash-daily-indices-write-to-wrong-yesterday-date/251339)
**Author:** [@dorinand](https://discuss.elastic.co/u/dorinand)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 8:44pm UTC](https://discuss.elastic.co/t/logstash-daily-indices-write-to-wrong-yesterday-date/251339 "2020-10-07T20:44:15Z")
I implement logstash elasticsearch output to create daily indices. The index name has this format: "default-%{\[kubernetes\]\[pod\]\[name\]}-%{+YYYY.MM.dd}" It works perfectly, it creates index, lets say for example for pod m… --- ## [How to change "ignore\_above" property of field in index pattern even index match pattern will be insert in the future?](https://discuss.elastic.co/t/how-to-change-ignore-above-property-of-field-in-index-pattern-even-index-match-pattern-will-be-insert-in-the-future/251208)
**Author:** [@le\_ba\_nam](https://discuss.elastic.co/u/le_ba_nam)\ **Replies:** 5\ **Last updated:** [October 8, 2020, 4:53am UTC](https://discuss.elastic.co/t/how-to-change-ignore-above-property-of-field-in-index-pattern-even-index-match-pattern-will-be-insert-in-the-future/251208 "2020-10-08T04:53:30Z")
I want to change "ignore\_above" property of field in index pattern. I have success with post request like: PUT myIndex-\*/doc/\_mapping { "properties": { "message": { "type": "text", "… --- ## [Logstash memory use keeps increasing linearly over time](https://discuss.elastic.co/t/logstash-memory-use-keeps-increasing-linearly-over-time/250927)
**Author:** [@SHINRA](https://discuss.elastic.co/u/SHINRA)\ **Replies:** 6\ **Last updated:** [October 8, 2020, 4:43am UTC](https://discuss.elastic.co/t/logstash-memory-use-keeps-increasing-linearly-over-time/250927 "2020-10-08T04:43:04Z")
I have a logstash pipelines that runs tasks every day on a fixed time using the http input. Each task completes executing (from input of first pipeline to outputs of the last one) within few minutes. Rest of the day i… --- ## [Elastic Search performance degraded after veriosn update from ES 1.4.2 to ES 7.9](https://discuss.elastic.co/t/elastic-search-performance-degraded-after-veriosn-update-from-es-1-4-2-to-es-7-9/251367)
**Author:** [@GauriA](https://discuss.elastic.co/u/GauriA)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 4:23am UTC](https://discuss.elastic.co/t/elastic-search-performance-degraded-after-veriosn-update-from-es-1-4-2-to-es-7-9/251367 "2020-10-08T04:23:20Z")
We want to upgrade the OLD ES 1.4.2 setup to new ES 7.9. For that we are testing the search performance. I am testing the search performance by querying the search queries returning different no. of documents simultaneou… --- ## [Best way to index user specific products on store index](https://discuss.elastic.co/t/best-way-to-index-user-specific-products-on-store-index/251364)
**Author:** [@roman731](https://discuss.elastic.co/u/roman731)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 3:49am UTC](https://discuss.elastic.co/t/best-way-to-index-user-specific-products-on-store-index/251364 "2020-10-08T03:49:14Z")
I have an index with ~20000 products for an e-commerce website. I would like to implement a "previously purchased feature" for specific users.. so only specific products will return for specific users in this case... but… --- ## [AWS CloudWatch Log Subscription to AWS Elasticsearch Service](https://discuss.elastic.co/t/aws-cloudwatch-log-subscription-to-aws-elasticsearch-service/251363)
**Author:** [@neldreth](https://discuss.elastic.co/u/neldreth)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 3:44am UTC](https://discuss.elastic.co/t/aws-cloudwatch-log-subscription-to-aws-elasticsearch-service/251363 "2020-10-08T03:44:43Z")
For the past couple days I have been trying to identify how to code for an AWS CloudWatch subscription to my ES domain in AWS. My subscription passes into a Lambda function (written in node.js) that POSTs to the endpoint… --- ## [Logstash can't create separate indexes](https://discuss.elastic.co/t/logstash-cant-create-separate-indexes/251270)
**Author:** [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\ **Replies:** 2\ **Last updated:** [October 8, 2020, 3:31am UTC](https://discuss.elastic.co/t/logstash-cant-create-separate-indexes/251270 "2020-10-08T03:31:32Z")
I have two filebeat inputs which have tags and fields. In my pipeline.conf I used filter logs by theirs tags. but when the time of index create logstash takes index name as a %{\[fields\]\[log\_type\]}-2020-10-07. How can … --- ## [Elasticsearch Engineer 1 - Lab 1.4 - can not find Java](https://discuss.elastic.co/t/elasticsearch-engineer-1-lab-1-4-can-not-find-java/251362)
**Author:** [@justing](https://discuss.elastic.co/u/justing)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 2:31am UTC](https://discuss.elastic.co/t/elasticsearch-engineer-1-lab-1-4-can-not-find-java/251362 "2020-10-08T02:31:08Z")
I’m currently attempting to take ElasticSearch Engineer 1 (On-Demand) training and am stuck at Lab 1.4 in the Lab Environment (Strigo). When attempting to run the logstash command, I get the following error: \[elastic@s… --- ## [Watcherの実装内容に関して](https://discuss.elastic.co/t/watcher/249760)
**Author:** [@harue](https://discuss.elastic.co/u/harue)\ **Replies:** 4\ **Last updated:** [October 8, 2020, 12:30am UTC](https://discuss.elastic.co/t/watcher/249760 "2020-10-08T00:30:12Z")
※9/25 一部内容を変更しました。 お世話になります。 Watcherの実装に関して、質問させて頂きます。 ▼inputのindex ・A\_indexとB\_indexの紐づき項目は「tenantId」 ・tenantIdにaddressは一意 A\_index \_id tenantId eventid memo 1 001 111 test1 2 002 111 test2 B\_i… --- ## [Bulk loading with different fields for update](https://discuss.elastic.co/t/bulk-loading-with-different-fields-for-update/251350)
**Author:** [@dxunix](https://discuss.elastic.co/u/dxunix)\ **Replies:** 1\ **Last updated:** [October 8, 2020, 12:09am UTC](https://discuss.elastic.co/t/bulk-loading-with-different-fields-for-update/251350 "2020-10-08T00:09:40Z")
So I have a requirement to index some data repeatedly. Each time the data might have different data fields. I want to keep the superset of the fields in the index. I.e. initial load the document like {"\_id": 100, "f… --- ## [Logstash create and reference variables](https://discuss.elastic.co/t/logstash-create-and-reference-variables/251348)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 10:28pm UTC](https://discuss.elastic.co/t/logstash-create-and-reference-variables/251348 "2020-10-07T22:28:41Z")
Hi, Is there a way to pull and field:value from one event, store it in some sort of variable and then add it to the next event? For example: event1: {device:"router1", in-rate:"1", out-rate:"2", interface:"eth01", des… --- ## [Using "partial" terms aggregation](https://discuss.elastic.co/t/using-partial-terms-aggregation/251347)
**Author:** [@angauber](https://discuss.elastic.co/u/angauber)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 10:24pm UTC](https://discuss.elastic.co/t/using-partial-terms-aggregation/251347 "2020-10-07T22:24:06Z")
I have populate a test index with the following data: /test/\_bulk {"index": {}} {"types": \[1, 2, 4\]} {"index": {}} {"types": \[3\]} {"index": {}} {"types": \[1, 4\]} On that index I'm trying to a build a query where I filt… --- ## [Elastic Endpoint Security missing host](https://discuss.elastic.co/t/elastic-endpoint-security-missing-host/250420)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 20\ **Last updated:** [October 7, 2020, 9:32pm UTC](https://discuss.elastic.co/t/elastic-endpoint-security-missing-host/250420 "2020-10-07T21:32:39Z")
Hi, I am running ELK v7.9.2 standalone I just started to test Elastic Endpoint Security (from now on "EES"). I managed to enable all the necessary settings on the ELK host side and deployed EES in two different hosts: … --- ## [Threshold Rule for Detecting Brute force Attacks](https://discuss.elastic.co/t/threshold-rule-for-detecting-brute-force-attacks/245866)
**Author:** [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)\ **Replies:** 6\ **Last updated:** [October 7, 2020, 9:20pm UTC](https://discuss.elastic.co/t/threshold-rule-for-detecting-brute-force-attacks/245866 "2020-10-07T21:20:48Z")
Hi, with the release of 7.9 I tried creating a threshold rule for detecting and alerting Windows Brute Force Attacks. The query is Event.code 4625 and the threshold field is host.name greater than equal to 5. But the ru… --- ## [Dashboard Navigation \[Filebeat Netflow\] not working](https://discuss.elastic.co/t/dashboard-navigation-filebeat-netflow-not-working/249144)
**Author:** [@HelpComputer](https://discuss.elastic.co/u/HelpComputer)\ **Replies:** 12\ **Last updated:** [October 7, 2020, 9:05pm UTC](https://discuss.elastic.co/t/dashboard-navigation-filebeat-netflow-not-working/249144 "2020-10-07T21:05:08Z")
Hello, I recently upgraded our Elastic Stack from 6.8 to 7.9.1 and I am unable to get several Dashboards to work in Kibana. Specifically, the \[Filebeat Netflow\] Overview dashboard. Whenever I select it in Kibana I recei… --- ## [How to create a baseline chart](https://discuss.elastic.co/t/how-to-create-a-baseline-chart/251288)
**Author:** [@WassimDhib](https://discuss.elastic.co/u/WassimDhib)\ **Replies:** 2\ **Last updated:** [October 7, 2020, 8:11pm UTC](https://discuss.elastic.co/t/how-to-create-a-baseline-chart/251288 "2020-10-07T20:11:41Z")
Hi, I have a time series of application performance monitoring data (response times). I need to create a baseline chart ( it is something like mean value plus and minus standard deviation multiplied by some coefficient… --- ## [Aggregate Performing Unpredictably](https://discuss.elastic.co/t/aggregate-performing-unpredictably/251336)
**Author:** [@NomadicCodeGuy](https://discuss.elastic.co/u/NomadicCodeGuy)\ **Replies:** 2\ **Last updated:** [October 7, 2020, 8:05pm UTC](https://discuss.elastic.co/t/aggregate-performing-unpredictably/251336 "2020-10-07T20:05:21Z")
I am using the aggregate filter plugin to copy a field to all entries from the same file path that have a "nil" entry for that field. It works perfectly for around 95 percent of the time. The strange thing is that with e… --- ## [Shard allocation not working](https://discuss.elastic.co/t/shard-allocation-not-working/250720)
**Author:** [@jdambly](https://discuss.elastic.co/u/jdambly)\ **Replies:** 2\ **Last updated:** [October 7, 2020, 7:05pm UTC](https://discuss.elastic.co/t/shard-allocation-not-working/250720 "2020-10-07T19:05:20Z")
ECK Version: 1.2.1 ElasticSearch Version: 7.9.2 I'm trying to tier my storage in my ES clusters, I have 12 data nodes, 6 are label hot (node.attr.data: hot) and 6 are labeled warm (node.attr.data: warm) I set the shar… --- ## [All data nodes are visible in the elasticHQ](https://discuss.elastic.co/t/all-data-nodes-are-visible-in-the-elastichq/250830)
**Author:** [@keraghu](https://discuss.elastic.co/u/keraghu)\ **Replies:** 1\ **Last updated:** [October 7, 2020, 6:51pm UTC](https://discuss.elastic.co/t/all-data-nodes-are-visible-in-the-elastichq/250830 "2020-10-07T18:51:43Z")
As in the portainer i can see that there 3 data nodes and 1 master nodes are running, but when i see in the elasticHQ, it is showing only 1 master and 1 data node.. Can you please help me how to make it visible all the… --- ## [Stateful or cached search](https://discuss.elastic.co/t/stateful-or-cached-search/250872)
**Author:** [@vadben](https://discuss.elastic.co/u/vadben)\ **Replies:** 4\ **Last updated:** [October 7, 2020, 6:35pm UTC](https://discuss.elastic.co/t/stateful-or-cached-search/250872 "2020-10-07T18:35:44Z")
hi all, I wondering if there is some possibility to store (cache) a result set under some name or ID and use it in further queries, combining with new constraints? We use only the filter context and the index is relative… --- ## [Does increase refresh\_rate effect indexing time?](https://discuss.elastic.co/t/does-increase-refresh-rate-effect-indexing-time/251058)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 7\ **Last updated:** [October 7, 2020, 2:44pm UTC](https://discuss.elastic.co/t/does-increase-refresh-rate-effect-indexing-time/251058 "2020-10-07T14:44:15Z")
Like the title states. I am seeing indexing time on certain writes jump to close 30 seconds. I have configure all my index's refresh rate to 30 seconds. Is this normal? I have also bump machine by doubling the CPU fr… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1203) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1205)