# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1300 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1301 --- ## [Help reindexing to change date format](https://discuss.elastic.co/t/help-reindexing-to-change-date-format/243356)
**Author:** [@gius78](https://discuss.elastic.co/u/gius78)\ **Replies:** 3\ **Last updated:** [August 4, 2020, 2:01pm UTC](https://discuss.elastic.co/t/help-reindexing-to-change-date-format/243356 "2020-08-04T14:01:04Z")
Hi all, I have to change the timestamp format of documents in my index. Currently I have a "yyyymmddhhmmssZ" format. I have to change it to something that grafana can understand. So I think Epoch\_millis or ISO. can y… --- ## [CCS set-up](https://discuss.elastic.co/t/ccs-set-up/243711)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 1:05pm UTC](https://discuss.elastic.co/t/ccs-set-up/243711 "2020-08-04T13:05:34Z")
Hi, On 2 locations I setup an elasticsearch cluster. Both run ok individually. Both also have a coordinating node. These nodes I want to connect to eachother to be able to do cross cluster search. So in the yml files … --- ## [Tls handshake timeout tcp input plugin](https://discuss.elastic.co/t/tls-handshake-timeout-tcp-input-plugin/243715)
**Author:** [@f3lang](https://discuss.elastic.co/u/f3lang)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 1:34pm UTC](https://discuss.elastic.co/t/tls-handshake-timeout-tcp-input-plugin/243715 "2020-08-04T13:34:14Z")
Hi Everyone, I hope, you can help me with my problem :slight\_smile: I have configured a logstash server with the tcp input plugin and client tls authentication enabled. So far everything works great and as long as th… --- ## [Logstash to Logstash Certificate Error](https://discuss.elastic.co/t/logstash-to-logstash-certificate-error/243713)
**Author:** [@Yawn](https://discuss.elastic.co/u/Yawn)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 1:21pm UTC](https://discuss.elastic.co/t/logstash-to-logstash-certificate-error/243713 "2020-08-04T13:21:51Z")
Hello everyone Would really appreciate anyone's input on this.. I've been struggling with a certificate problem between 2 logstash servers. I have the following setup basically: agents \> LogstashA \> LogstashB \> Elast… --- ## [Logstash filebeat Performance](https://discuss.elastic.co/t/logstash-filebeat-performance/243707)
**Author:** [@eth](https://discuss.elastic.co/u/eth)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 12:54pm UTC](https://discuss.elastic.co/t/logstash-filebeat-performance/243707 "2020-08-04T12:54:54Z")
I am sending kubernetes pod logs from filebeat to logstash via kafka plugin. Filebeat, Logstash and kafka running as pods in the single host. filebeat ==\> Kafka ==\> Logstash when i checked the network bandw… --- ## [Transfering logs from a namespace to another](https://discuss.elastic.co/t/transfering-logs-from-a-namespace-to-another/243477)
**Author:** [@LomigFR](https://discuss.elastic.co/u/LomigFR)\ **Replies:** 9\ **Last updated:** [August 4, 2020, 12:46pm UTC](https://discuss.elastic.co/t/transfering-logs-from-a-namespace-to-another/243477 "2020-08-04T12:46:29Z")
Hello, After a lot of testing, I have a complete stack that works with, in the same namespace: nginx, Filebeat, Logstash, ES, Kibana. Now, I try to run these same components but spread over two different namespaces: n… --- ## [What's the preferred way to update part of a nested document](https://discuss.elastic.co/t/whats-the-preferred-way-to-update-part-of-a-nested-document/243705)
**Author:** [@viebel](https://discuss.elastic.co/u/viebel)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 12:36pm UTC](https://discuss.elastic.co/t/whats-the-preferred-way-to-update-part-of-a-nested-document/243705 "2020-08-04T12:36:26Z")
My document has a nested structure like this: PUT /customer/\_doc/1 { "name": "hello", "body": { "module": "aa", "config": "bb" } } Now, I'd like to update body field to be: { "module": "cc", "arg… --- ## [Can I change the primary key for identifying hosts in the SIEM app?](https://discuss.elastic.co/t/can-i-change-the-primary-key-for-identifying-hosts-in-the-siem-app/242372)
**Author:** [@macg](https://discuss.elastic.co/u/macg)\ **Replies:** 3\ **Last updated:** [August 4, 2020, 12:12pm UTC](https://discuss.elastic.co/t/can-i-change-the-primary-key-for-identifying-hosts-in-the-siem-app/242372 "2020-08-04T12:12:51Z")
I'm shipping logs from a number of hosts via a single filebeat running on a collector. As a result, the default primary key used by the SIEM app host.name is not very useful to me. host.hostname would work a lot better. … --- ## [Need help in jq parser with my aggregrations](https://discuss.elastic.co/t/need-help-in-jq-parser-with-my-aggregrations/243701)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 12:03pm UTC](https://discuss.elastic.co/t/need-help-in-jq-parser-with-my-aggregrations/243701 "2020-08-04T12:03:12Z")
Hi Guys, I am trying to figure out the Json data parsing out using jq from elastic 7.8. However I am confused and data is not being parsed correctly. Can someone pls help me with? "took": 1, "timed\_out": false, … --- ## [Multiline Logstah file txt](https://discuss.elastic.co/t/multiline-logstah-file-txt/243613)
**Author:** [@Daniel\_Bergmann](https://discuss.elastic.co/u/Daniel_Bergmann)\ **Replies:** 6\ **Last updated:** [August 4, 2020, 11:53am UTC](https://discuss.elastic.co/t/multiline-logstah-file-txt/243613 "2020-08-04T11:53:30Z")
I have a TXT file that I want to import into Elasticsearch via LogStash, it is a fixed type of columns, in which I used grok and if to separate the columns of this file, that's fine, but I want to use the multiline to g… --- ## [Import only beats relevant dashoard from the whole default dashboards](https://discuss.elastic.co/t/import-only-beats-relevant-dashoard-from-the-whole-default-dashboards/243526)
**Author:** [@StefanoM](https://discuss.elastic.co/u/StefanoM)\ **Replies:** 5\ **Last updated:** [August 4, 2020, 11:46am UTC](https://discuss.elastic.co/t/import-only-beats-relevant-dashoard-from-the-whole-default-dashboards/243526 "2020-08-04T11:46:02Z")
Hi there, is there some best practice or a trick for this: as everyone knowsthe default dashboards are quite many. How / What can I do it if I only want to import the default stuff (dashboards, templates and so on) for … --- ## [Opening terminal for operator fails on OpenShift](https://discuss.elastic.co/t/opening-terminal-for-operator-fails-on-openshift/243691)
**Author:** [@misz](https://discuss.elastic.co/u/misz)\ **Replies:** 1\ **Last updated:** [August 4, 2020, 11:34am UTC](https://discuss.elastic.co/t/opening-terminal-for-operator-fails-on-openshift/243691 "2020-08-04T11:34:08Z")
Hi, I have successfully deployed the ECK 1.2.0 Operator and Elasticsearch on my OpenShift cluster 3.11. However, I cannot open a terminal for the Operator pod. It fails with: rpc error: code = 2 desc = oci runtime erro… --- ## [Rally 2.0.1 released](https://discuss.elastic.co/t/rally-2-0-1-released/243697)
**Author:** [@dliappis](https://discuss.elastic.co/u/dliappis)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 11:26am UTC](https://discuss.elastic.co/t/rally-2-0-1-released/243697 "2020-08-04T11:26:15Z")
We have just released Rally 2.0.1. This is mostly a bug fix release also adding a few enhancements: With 2.0.0 the offline package failed to install on Linux. There is now a Linux specific artifact available for offlin… --- ## [Upgrading my application from ES 5.3 to 7.7](https://discuss.elastic.co/t/upgrading-my-application-from-es-5-3-to-7-7/243527)
**Author:** [@taichi](https://discuss.elastic.co/u/taichi)\ **Replies:** 5\ **Last updated:** [August 4, 2020, 11:22am UTC](https://discuss.elastic.co/t/upgrading-my-application-from-es-5-3-to-7-7/243527 "2020-08-04T11:22:50Z")
I'm going to ES of my application (it's large) from version 5.3 to 7.7 I have to fix my application codes, finding difference between the two versions. Elastic documentation has many Breaking changes pages, correspondi… --- ## [Elastic stack hardware requirements](https://discuss.elastic.co/t/elastic-stack-hardware-requirements/243521)
**Author:** [@Gomeisa](https://discuss.elastic.co/u/Gomeisa)\ **Replies:** 3\ **Last updated:** [August 4, 2020, 11:16am UTC](https://discuss.elastic.co/t/elastic-stack-hardware-requirements/243521 "2020-08-04T11:16:04Z")
Hi I want to set up a cluster and I have these scenarios: I'm using ES, Kibana, filebeat(for logs) \[basic license\], a custom project instead of logstash Index heavy data, Not very frequent querying Monthly index with … --- ## [Error While Installing Elastic search plugins](https://discuss.elastic.co/t/error-while-installing-elastic-search-plugins/243170)
**Author:** [@WaseemSiddiqui](https://discuss.elastic.co/u/WaseemSiddiqui)\ **Replies:** 4\ **Last updated:** [August 4, 2020, 10:28am UTC](https://discuss.elastic.co/t/error-while-installing-elastic-search-plugins/243170 "2020-08-04T10:28:23Z")
Installing the ICU analysis 7.3.1. for Elastic Search 7.3.1 unfortunately I am getting a java error .C:\\Program Files\\Elastic\\Elasticsearch\\7.3.1\\bin\>elasticsearch-plugin.bat instal l path\\analysis-icu-7.3.1.zip -\> … --- ## [Incremental search on geo\_point](https://discuss.elastic.co/t/incremental-search-on-geo-point/243649)
**Author:** [@ocmvin](https://discuss.elastic.co/u/ocmvin)\ **Replies:** 3\ **Last updated:** [August 4, 2020, 9:59am UTC](https://discuss.elastic.co/t/incremental-search-on-geo-point/243649 "2020-08-04T09:59:40Z")
Wish to search a closest person from input geo\_point location . Quick steps to explain the requirement. Steps : 1: Add documents with person name and their lat /long details Expected result Request body shall contain g… --- ## [Changing mapping fields structure flow](https://discuss.elastic.co/t/changing-mapping-fields-structure-flow/243576)
**Author:** [@gitterhh](https://discuss.elastic.co/u/gitterhh)\ **Replies:** 1\ **Last updated:** [August 4, 2020, 9:50am UTC](https://discuss.elastic.co/t/changing-mapping-fields-structure-flow/243576 "2020-08-04T09:50:57Z")
I have an index with the mappings { "mappings": { "properties": { "title": { "type": "text" }, "location": { "type": "keyword" } } } } In lo… --- ## [Filter results by the length of the nested objects returned, similar to min\_child](https://discuss.elastic.co/t/filter-results-by-the-length-of-the-nested-objects-returned-similar-to-min-child/243582)
**Author:** [@Dustin\_Silk](https://discuss.elastic.co/u/Dustin_Silk)\ **Replies:** 1\ **Last updated:** [August 4, 2020, 9:48am UTC](https://discuss.elastic.co/t/filter-results-by-the-length-of-the-nested-objects-returned-similar-to-min-child/243582 "2020-08-04T09:48:55Z")
I'm trying to filter my results based on the number of nested objects found for a document. I've tried using scores but I cant get scores to work with filters, and I've tried a script but can't get that working either. … --- ## [How export logs from Kibana 4?](https://discuss.elastic.co/t/how-export-logs-from-kibana-4/186)
**Author:** [@Dnyaneshwar](https://discuss.elastic.co/u/Dnyaneshwar)\ **Replies:** 9\ **Last updated:** [August 4, 2020, 8:53am UTC](https://discuss.elastic.co/t/how-export-logs-from-kibana-4/186 "2020-08-04T08:53:32Z")
I have tried the export button in kibana 4, but it export the table with timestamp and count column.. there is not logs. How export logs from Kibana 4 ? Thanks --- ## [Is it necessary to upgrade?](https://discuss.elastic.co/t/is-it-necessary-to-upgrade/243668)
**Author:** [@Benjamin\_Gathmann](https://discuss.elastic.co/u/Benjamin_Gathmann)\ **Replies:** 3\ **Last updated:** [August 4, 2020, 8:53am UTC](https://discuss.elastic.co/t/is-it-necessary-to-upgrade/243668 "2020-08-04T08:53:31Z")
We are running Elasticsearch v2.4 and are still happy with it. Are there any reasons to upgrade besides new features and performance improvements? E.g. are there any security issues with the 2.x branch? I could not fin… --- ## [How to group unique statistics records with overlapping fields (account and fingerprint)?](https://discuss.elastic.co/t/how-to-group-unique-statistics-records-with-overlapping-fields-account-and-fingerprint/243667)
**Author:** [@ange007](https://discuss.elastic.co/u/ange007)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 8:01am UTC](https://discuss.elastic.co/t/how-to-group-unique-statistics-records-with-overlapping-fields-account-and-fingerprint/243667 "2020-08-04T08:01:45Z")
Hi. There is an index with fields: account\_id fingerprint etc. Each record may or may not have an account\_id , the same is with fingerprint . It is necessary to group them by account\_id along the way adding to th… --- ## [How To search on all the Ids in a Index in TermLookUp Mechanism](https://discuss.elastic.co/t/how-to-search-on-all-the-ids-in-a-index-in-termlookup-mechanism/243658)
**Author:** [@kashifa](https://discuss.elastic.co/u/kashifa)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 7:23am UTC](https://discuss.elastic.co/t/how-to-search-on-all-the-ids-in-a-index-in-termlookup-mechanism/243658 "2020-08-04T07:23:14Z")
I have two indices namely "School" and "Student" and I have to join these two indices based on some criteria and populate the results. Let me state the example scenario here. School Data Example: { "resourceT… --- ## [Elasticsearch-service on windows 10 not starting (es.path.conf not set)](https://discuss.elastic.co/t/elasticsearch-service-on-windows-10-not-starting-es-path-conf-not-set/243172)
**Author:** [@feva](https://discuss.elastic.co/u/feva)\ **Replies:** 1\ **Last updated:** [August 4, 2020, 6:33am UTC](https://discuss.elastic.co/t/elasticsearch-service-on-windows-10-not-starting-es-path-conf-not-set/243172 "2020-08-04T06:33:24Z")
I have some troubles installing elasticsearch as a service. I am working on Windows 10 with elasticsearch-7.8.0 The log files say Failed to start service 2020-07-30 08:50:17 Commons Daemon procrun stderr initialized … --- ## [How to Filter nested aggregations (busket results)](https://discuss.elastic.co/t/how-to-filter-nested-aggregations-busket-results/243190)
**Author:** [@aakhiezer](https://discuss.elastic.co/u/aakhiezer)\ **Replies:** 2\ **Last updated:** [August 4, 2020, 6:23am UTC](https://discuss.elastic.co/t/how-to-filter-nested-aggregations-busket-results/243190 "2020-08-04T06:23:22Z")
Hi all, I'm trying to filter an aggregations. I created aggregation for nested fields(pipe of id|value) of Badge field. It works good and return me buskets with pipe and doc\_count. But I want to filter them to return m… --- ## [Warning regarding jvm option UseConcMarkSweepGC was deprecated](https://discuss.elastic.co/t/warning-regarding-jvm-option-useconcmarksweepgc-was-deprecated/241398)
**Author:** [@pratiksha](https://discuss.elastic.co/u/pratiksha)\ **Replies:** 5\ **Last updated:** [August 4, 2020, 6:10am UTC](https://discuss.elastic.co/t/warning-regarding-jvm-option-useconcmarksweepgc-was-deprecated/241398 "2020-08-04T06:10:21Z")
Hi, We are currently on elasticsearch version 7.0.1 and about to upgrade to 7.8. In our elastic search logs, we observe a warning "OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version … --- ## [Logstash if conditions connected with and](https://discuss.elastic.co/t/logstash-if-conditions-connected-with-and/243199)
**Author:** [@Souji\_T](https://discuss.elastic.co/u/Souji_T)\ **Replies:** 8\ **Last updated:** [August 4, 2020, 6:08am UTC](https://discuss.elastic.co/t/logstash-if-conditions-connected-with-and/243199 "2020-08-04T06:08:02Z")
Hello, I am trying to add a field with logstash. For example, I have following line in the filter section of my config file from logstash: if \[dest\_ip\] == "194.175.245.9" and \[alert\]\[signature\_id\] == "2009702" { … --- ## [Repair index after too many open files error](https://discuss.elastic.co/t/repair-index-after-too-many-open-files-error/243542)
**Author:** [@hunsw](https://discuss.elastic.co/u/hunsw)\ **Replies:** 1\ **Last updated:** [August 4, 2020, 5:41am UTC](https://discuss.elastic.co/t/repair-index-after-too-many-open-files-error/243542 "2020-08-04T05:41:30Z")
We had 'too many open files' error on several nodes and even though we fixed the problem, one shard fell into a sort of a limbo. # Relevant \_cluster/allocation/explain output: node01.example.com = {"in\_sync":true,"alloc… --- ## [I deleted the elasticsearch folder in /etc/elasticsearch/ , not sure how to restore back?](https://discuss.elastic.co/t/i-deleted-the-elasticsearch-folder-in-etc-elasticsearch-not-sure-how-to-restore-back/243585)
**Author:** [@Athiq\_Ahmed](https://discuss.elastic.co/u/Athiq_Ahmed)\ **Replies:** 3\ **Last updated:** [August 4, 2020, 5:33am UTC](https://discuss.elastic.co/t/i-deleted-the-elasticsearch-folder-in-etc-elasticsearch-not-sure-how-to-restore-back/243585 "2020-08-04T05:33:21Z")
I have built the Flask application(Python) which is linked to Elasticsearch(port:9200), Now I need to deploy this application within AWS EC2, however while performing I deleted the Elasticsearch folder within /etc and no… --- ## [Does Elasticsearch automatically compress indexes?](https://discuss.elastic.co/t/does-elasticsearch-automatically-compress-indexes/243354)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 5\ **Last updated:** [August 4, 2020, 5:27am UTC](https://discuss.elastic.co/t/does-elasticsearch-automatically-compress-indexes/243354 "2020-08-04T05:27:23Z")
Dears, We have ELK in version 7.7.1. Everyday we send to ELK logs is size about 30GB. I'm worried about FS space. My question is does Elasticsearch automatically compress indexes? or Should it be forced with the corr… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1299) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1301)