# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1302 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1303 --- ## [How to reference filebeat module fields in logstash filter?](https://discuss.elastic.co/t/how-to-reference-filebeat-module-fields-in-logstash-filter/242001)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 5\ **Last updated:** [August 3, 2020, 1:18pm UTC](https://discuss.elastic.co/t/how-to-reference-filebeat-module-fields-in-logstash-filter/242001 "2020-08-03T13:18:53Z")
We have filebeat apache module enabled which sends to data to logstash for further enrichment (geoip, add more fields for our visualizations etc). I tried this one but im not sure if its possible. this is what we're … --- ## [How to Replace a failed node with new node with same name and IP](https://discuss.elastic.co/t/how-to-replace-a-failed-node-with-new-node-with-same-name-and-ip/243518)
**Author:** [@Shoaib\_Rashid](https://discuss.elastic.co/u/Shoaib_Rashid)\ **Replies:** 6\ **Last updated:** [August 3, 2020, 1:18pm UTC](https://discuss.elastic.co/t/how-to-replace-a-failed-node-with-new-node-with-same-name-and-ip/243518 "2020-08-03T13:18:51Z")
Hello Everyone I Just want to know is there any way to replace an elasticsearch node with a new node having same name and IP in case of node failure. I have 3 dedicated master nodes and 3 Separate data nodes with repil… --- ## [Scripted field](https://discuss.elastic.co/t/scripted-field/242881)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 4\ **Last updated:** [August 3, 2020, 1:09pm UTC](https://discuss.elastic.co/t/scripted-field/242881 "2020-08-03T13:09:44Z")
Hi everyone I created a scripted field to extract the hour of the week from @timestamp doc\['@timestamp'\].value.hour and its working fine. But when i try to extract the day of week using this query in dev tools GET f… --- ## [Import csv files to two different index](https://discuss.elastic.co/t/import-csv-files-to-two-different-index/242456)
**Author:** [@peretz\_shlomi](https://discuss.elastic.co/u/peretz_shlomi)\ **Replies:** 5\ **Last updated:** [August 3, 2020, 1:09pm UTC](https://discuss.elastic.co/t/import-csv-files-to-two-different-index/242456 "2020-08-03T13:09:25Z")
hello I want to import two different CSV file types into two different index. What is the right way to do it ? --- ## [Winlogbeat not writing all events to Elasticsearch](https://discuss.elastic.co/t/winlogbeat-not-writing-all-events-to-elasticsearch/243559)
**Author:** [@mozam](https://discuss.elastic.co/u/mozam)\ **Replies:** 2\ **Last updated:** [August 3, 2020, 12:42pm UTC](https://discuss.elastic.co/t/winlogbeat-not-writing-all-events-to-elasticsearch/243559 "2020-08-03T12:42:24Z")
Hello, I'm using the Elastic Stack version 7.8.0 ( Winlogbeat -\> Elasticsearch pipeline) in Windows 10 Operating System . Issue : Winlogbeat not capturing all the events generated in Windows Machine. For eg: (Audit tri… --- ## [Using snapshots for replication](https://discuss.elastic.co/t/using-snapshots-for-replication/243520)
**Author:** [@eaa](https://discuss.elastic.co/u/eaa)\ **Replies:** 5\ **Last updated:** [August 3, 2020, 12:20pm UTC](https://discuss.elastic.co/t/using-snapshots-for-replication/243520 "2020-08-03T12:20:58Z")
Hi everyone, Say I can't afford the license required for the CCR feature (https://www.elastic.co/guide/en/elasticsearch/reference/current/xpack-ccr.html) but have two Elasticsearch dbs and need to replicate one into ano… --- ## [Failed to execute \[SearchRequest](https://discuss.elastic.co/t/failed-to-execute-searchrequest/243149)
**Author:** [@jie.li](https://discuss.elastic.co/u/jie.li)\ **Replies:** 5\ **Last updated:** [August 3, 2020, 12:19pm UTC](https://discuss.elastic.co/t/failed-to-execute-searchrequest/243149 "2020-08-03T12:19:02Z")
Hi Guys, i hava issues with qurrey, client is timed out. I am still new to Elasticsearch, please correct me if any wrong. Thanks \[2020-07-30T03:40:04,998\]\[DEBUG\]\[o.e.a.s.TransportSearchAction\] \[node-02\] \[goods04\]\[3\], … --- ## [How to add multiple logstash filter](https://discuss.elastic.co/t/how-to-add-multiple-logstash-filter/243554)
**Author:** [@Puneeth\_S\_B\_Gowda1](https://discuss.elastic.co/u/Puneeth_S_B_Gowda1)\ **Replies:** 0\ **Last updated:** [August 3, 2020, 12:06pm UTC](https://discuss.elastic.co/t/how-to-add-multiple-logstash-filter/243554 "2020-08-03T12:06:11Z")
how to add multiple logstash filter example my source file will come with JSON & XML i have 2 different logstash.conf for xml and JSON log so how do i add two logstash,conf? 5:16 JSON logs will parse from JSON filter a… --- ## [Standard overview dashboard?](https://discuss.elastic.co/t/standard-overview-dashboard/243531)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 3\ **Last updated:** [August 3, 2020, 11:58am UTC](https://discuss.elastic.co/t/standard-overview-dashboard/243531 "2020-08-03T11:58:49Z")
Hi, I have Metricbeats and it logs CPU/MEM etc, but I don't have any standard overview dashboard such as is on screenshot in documentation. How can I got it? My just looks like this: Metricbeats information are from … --- ## [Messages that contain more than 32766 bytes in a field](https://discuss.elastic.co/t/messages-that-contain-more-than-32766-bytes-in-a-field/243545)
**Author:** [@sarabande](https://discuss.elastic.co/u/sarabande)\ **Replies:** 0\ **Last updated:** [August 3, 2020, 11:36am UTC](https://discuss.elastic.co/t/messages-that-contain-more-than-32766-bytes-in-a-field/243545 "2020-08-03T11:36:20Z")
Hi, I have a general question. What happens with messages that contain fields longer than 32766 bytes? They will cause the error saying something like "Could not index event to Elasticsearch" and "caused\_by"=\>{"type"=\>"… --- ## [Display response body of Heartbeat in Kibana Uptime](https://discuss.elastic.co/t/display-response-body-of-heartbeat-in-kibana-uptime/242011)
**Author:** [@sbienert](https://discuss.elastic.co/u/sbienert)\ **Replies:** 8\ **Last updated:** [August 3, 2020, 11:33am UTC](https://discuss.elastic.co/t/display-response-body-of-heartbeat-in-kibana-uptime/242011 "2020-08-03T11:33:31Z")
Dear Elastic-Team, in Heartbeat I am calling the actuator (info) endpoints to verify if the services are running. The endpoints are responding with a json body that includes the version of the service. I would want to d… --- ## [Timeout exception when connecting to the Elastic search deployed in K8s cluster](https://discuss.elastic.co/t/timeout-exception-when-connecting-to-the-elastic-search-deployed-in-k8s-cluster/243498)
**Author:** [@vanikr](https://discuss.elastic.co/u/vanikr)\ **Replies:** 5\ **Last updated:** [August 3, 2020, 11:12am UTC](https://discuss.elastic.co/t/timeout-exception-when-connecting-to-the-elastic-search-deployed-in-k8s-cluster/243498 "2020-08-03T11:12:52Z")
Error 'Exception in thread "main" java.net.ConnectException: Timeout connecting to \[/IP:80\] at org.elasticsearch.client.RestClient.extractAndWrapCause(RestClient.java:823) at org.elasticsearch.client.RestClient.perfor… --- ## [Does early termination (sorted index) kick in in this case?](https://discuss.elastic.co/t/does-early-termination-sorted-index-kick-in-in-this-case/243370)
**Author:** [@jmlucjav](https://discuss.elastic.co/u/jmlucjav)\ **Replies:** 2\ **Last updated:** [August 3, 2020, 11:27am UTC](https://discuss.elastic.co/t/does-early-termination-sorted-index-kick-in-in-this-case/243370 "2020-08-03T11:27:34Z")
I have such an index (ES 7.4): "index": { "sort.field": "date", "sort.order": "desc", And I query like this: { "sort": \[ "\_score", { "date": { "o… --- ## [How to access ES from hosts other than localhost?](https://discuss.elastic.co/t/how-to-access-es-from-hosts-other-than-localhost/243513)
**Author:** [@Aj\_t](https://discuss.elastic.co/u/Aj_t)\ **Replies:** 2\ **Last updated:** [August 3, 2020, 11:09am UTC](https://discuss.elastic.co/t/how-to-access-es-from-hosts-other-than-localhost/243513 "2020-08-03T11:09:26Z")
I just have one node where I am running ES and Kibana. In addition to the localhost, I would like to access ES from another host (remote\_ip1) as well. But, I would like to avoid setting the network.host to 0.0.0.0. When … --- ## [Kv split into next row](https://discuss.elastic.co/t/kv-split-into-next-row/241024)
**Author:** [@Puneeth\_S\_B\_Gowda1](https://discuss.elastic.co/u/Puneeth_S_B_Gowda1)\ **Replies:** 1\ **Last updated:** [August 3, 2020, 11:08am UTC](https://discuss.elastic.co/t/kv-split-into-next-row/241024 "2020-08-03T11:08:18Z")
input { beats { port =\> 5044 } } filter { kv {field\_split =\> "message" } kv { source =\> "n id" field\_split =\> "," }} output { elasticsearch { hosts =\> \["http://localhost:9200"\] index =\> "atpidev1" } } 11:… --- ## [How to select only one branch in bool query](https://discuss.elastic.co/t/how-to-select-only-one-branch-in-bool-query/242877)
**Author:** [@gitterhh](https://discuss.elastic.co/u/gitterhh)\ **Replies:** 1\ **Last updated:** [August 3, 2020, 11:02am UTC](https://discuss.elastic.co/t/how-to-select-only-one-branch-in-bool-query/242877 "2020-08-03T11:02:20Z")
I have a list of documents \[ { "shortName": "CA", "longName": "California" }, { "shortName": "New York", "longName": "New York" }, \] How to configure the query to select only the first field tha… --- ## [How to filter docs by text field length?](https://discuss.elastic.co/t/how-to-filter-docs-by-text-field-length/242941)
**Author:** [@IlyaEvseev](https://discuss.elastic.co/u/IlyaEvseev)\ **Replies:** 1\ **Last updated:** [August 3, 2020, 10:55am UTC](https://discuss.elastic.co/t/how-to-filter-docs-by-text-field-length/242941 "2020-08-03T10:55:01Z")
There is an ElasticSearch 7.3.2 instance, with index containing "message" field of text type. I need to get all docs with message length longer than 100000 chars (1million): curl -XPOST -H 'Content-Type: application/js… --- ## [Metricbeat shows same metrics data for 2 different environments](https://discuss.elastic.co/t/metricbeat-shows-same-metrics-data-for-2-different-environments/242577)
**Author:** [@Ahtesham](https://discuss.elastic.co/u/Ahtesham)\ **Replies:** 1\ **Last updated:** [August 3, 2020, 10:39am UTC](https://discuss.elastic.co/t/metricbeat-shows-same-metrics-data-for-2-different-environments/242577 "2020-08-03T10:39:43Z")
We have a service that runs in multiple environments 'qa' and 'Production'. we use fields.env in metricbeat.yml to set the environment. We see this service in 2 environments in Kibana. However it shows same metrics data… --- ## [java.io.IOException: An established connection was aborted by the software in your host machine](https://discuss.elastic.co/t/java-io-ioexception-an-established-connection-was-aborted-by-the-software-in-your-host-machine/242658)
**Author:** [@chelawatankit](https://discuss.elastic.co/u/chelawatankit)\ **Replies:** 4\ **Last updated:** [August 3, 2020, 10:35am UTC](https://discuss.elastic.co/t/java-io-ioexception-an-established-connection-was-aborted-by-the-software-in-your-host-machine/242658 "2020-08-03T10:35:10Z")
Hi Team, We are using single node cluster of elasticsearch 7.1.1 version on one of our machine. System details as follow OS : windows server 2012 R2 Xmx : 6GB System RAM : 64 GB We are getting following error freque… --- ## [Tracking user time that is spent on kibana](https://discuss.elastic.co/t/tracking-user-time-that-is-spent-on-kibana/241512)
**Author:** [@Michael\_Tsikerdekis](https://discuss.elastic.co/u/Michael_Tsikerdekis)\ **Replies:** 2\ **Last updated:** [August 3, 2020, 10:14am UTC](https://discuss.elastic.co/t/tracking-user-time-that-is-spent-on-kibana/241512 "2020-08-03T10:14:57Z")
Is there any way that I can track the amount of user time that is spent on kibana? Even indirectly through events or actions? If this is possible to be stored in elasticsearch and navigated through kibana, then even bet… --- ## [Analysis of identifiers with dashes](https://discuss.elastic.co/t/analysis-of-identifiers-with-dashes/243350)
**Author:** [@romansitina](https://discuss.elastic.co/u/romansitina)\ **Replies:** 1\ **Last updated:** [August 3, 2020, 10:11am UTC](https://discuss.elastic.co/t/analysis-of-identifiers-with-dashes/243350 "2020-08-03T10:11:54Z")
Hello, I'm trying to solve this issue: I have text Information about CD-3568 can be found in document DKF-98346-B-261 and I need to get it analysed as information about cd-3568 can be found in document dkf 98346 … --- ## [Newbie question - need suggestion - NFS share + 1 node](https://discuss.elastic.co/t/newbie-question-need-suggestion-nfs-share-1-node/243534)
**Author:** [@dan00bielb](https://discuss.elastic.co/u/dan00bielb)\ **Replies:** 1\ **Last updated:** [August 3, 2020, 10:00am UTC](https://discuss.elastic.co/t/newbie-question-need-suggestion-nfs-share-1-node/243534 "2020-08-03T10:00:17Z")
Good morning community, i am a newnubbie to ES and i would like a design suggestion from you. We need to index 5 years old logs taken from a SIEM from a subset of applications, we have one server (system spec should be… --- ## [Automatic backup like SLM in 6.8 version](https://discuss.elastic.co/t/automatic-backup-like-slm-in-6-8-version/243344)
**Author:** [@Agzem](https://discuss.elastic.co/u/Agzem)\ **Replies:** 1\ **Last updated:** [August 3, 2020, 9:54am UTC](https://discuss.elastic.co/t/automatic-backup-like-slm-in-6-8-version/243344 "2020-08-03T09:54:08Z")
Hi, I'm playing around with snapshot and restore in elasticsearch trying to do automatic backup, but I noticed that in 6.8 version, SLM policy is not available. Is there any methods to automatically take snapshot other… --- ## [Avg Aggregation Histogram fields](https://discuss.elastic.co/t/avg-aggregation-histogram-fields/243333)
**Author:** [@kartheek91](https://discuss.elastic.co/u/kartheek91)\ **Replies:** 1\ **Last updated:** [August 3, 2020, 9:51am UTC](https://discuss.elastic.co/t/avg-aggregation-histogram-fields/243333 "2020-08-03T09:51:18Z")
Hi I'm working on Elasticsearch since 2015 . Today when I'm going through the documentation I found some interesting stuff i.e PUT metrics\_index/\_doc/1 { "network.name" : "net-1", "latency\_histo" : { "values" : \[0.… --- ## [BST conversion on Kibana Visualization](https://discuss.elastic.co/t/bst-conversion-on-kibana-visualization/239840)
**Author:** [@Landong.Zuo](https://discuss.elastic.co/u/Landong.Zuo)\ **Replies:** 2\ **Last updated:** [August 3, 2020, 9:49am UTC](https://discuss.elastic.co/t/bst-conversion-on-kibana-visualization/239840 "2020-08-03T09:49:11Z")
Hello, I installed ELK V7.6.1 on an AWS Linux 2 EC2. When I ran a Data Histogram Aggregation in Kibana visualization with a time filter crossing over UTC and BST, e.g. from 2020-03-01T00:00:00.000 to 2020-04-01T00:00:0… --- ## [Using environment variables in elasticsearch config file](https://discuss.elastic.co/t/using-environment-variables-in-elasticsearch-config-file/243390)
**Author:** [@cms95](https://discuss.elastic.co/u/cms95)\ **Replies:** 3\ **Last updated:** [August 3, 2020, 9:37am UTC](https://discuss.elastic.co/t/using-environment-variables-in-elasticsearch-config-file/243390 "2020-08-03T09:37:44Z")
Im trying to use environment variables to define network.host. Ive tried ${var}, var, "{var}", etc all with no luck. ive tried doing whats mentioned here too: https://www.elastic.co/guide/en/elasticsearch/reference/curr… --- ## [Search results returned are incomplete](https://discuss.elastic.co/t/search-results-returned-are-incomplete/243519)
**Author:** [@Phil795](https://discuss.elastic.co/u/Phil795)\ **Replies:** 5\ **Last updated:** [August 3, 2020, 9:31am UTC](https://discuss.elastic.co/t/search-results-returned-are-incomplete/243519 "2020-08-03T09:31:18Z")
I use ES7 to search PDF files. When I search something with match\_phrase, I get 2 word occurrences, even though the document has 59 occurrences. What can be the reason for this? How can I optimize the query? { … --- ## [Performance Optimization for Multi-Index Search on Small Data Set](https://discuss.elastic.co/t/performance-optimization-for-multi-index-search-on-small-data-set/243378)
**Author:** [@Piyush\_Gupta](https://discuss.elastic.co/u/Piyush_Gupta)\ **Replies:** 2\ **Last updated:** [August 3, 2020, 6:29am UTC](https://discuss.elastic.co/t/performance-optimization-for-multi-index-search-on-small-data-set/243378 "2020-08-03T06:29:46Z")
We have different document structures/schema that we on-board into different indices. We have ~50 such indices, and one of our primary use cases is to perform search across all these document types i.e. across all 50 ind… --- ## [Creating a raw field mapping searchable by regexes with spaces](https://discuss.elastic.co/t/creating-a-raw-field-mapping-searchable-by-regexes-with-spaces/243117)
**Author:** [@Supermathie](https://discuss.elastic.co/u/Supermathie)\ **Replies:** 1\ **Last updated:** [August 3, 2020, 8:59am UTC](https://discuss.elastic.co/t/creating-a-raw-field-mapping-searchable-by-regexes-with-spaces/243117 "2020-08-03T08:59:26Z")
On Elastic 6.6, I'm trying to create an index that supports a regex search when the regex has spaces in it. I see older references to not\_analyzed that no longer apply to modern versions of Elasticsearch. I've tried, f… --- ## [Kibana script field still Loading to save, cannot create and update scripted field index pattern](https://discuss.elastic.co/t/kibana-script-field-still-loading-to-save-cannot-create-and-update-scripted-field-index-pattern/243512)
**Author:** [@umay\_fb](https://discuss.elastic.co/u/umay_fb)\ **Replies:** 2\ **Last updated:** [August 3, 2020, 8:31am UTC](https://discuss.elastic.co/t/kibana-script-field-still-loading-to-save-cannot-create-and-update-scripted-field-index-pattern/243512 "2020-08-03T08:31:40Z")
Hello all, i am using kibana 7.5 and elastic 7.5. I am trying to update scripted filed in kibana, but when i click save field button it loading and not finished, then i try to create new scripted field but its meet same… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1301) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1303)