# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1435 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1436 --- ## [Recommendation for Multiple index vs single index for small amounts of query](https://discuss.elastic.co/t/recommendation-for-multiple-index-vs-single-index-for-small-amounts-of-query/233661)
**Author:** [@yui98jaesok](https://discuss.elastic.co/u/yui98jaesok)\ **Replies:** 4\ **Last updated:** [May 21, 2020, 6:51am UTC](https://discuss.elastic.co/t/recommendation-for-multiple-index-vs-single-index-for-small-amounts-of-query/233661 "2020-05-21T06:51:18Z")
Hello everyone, I have read a lot on the forums for pros and cons of multiple indexs vs single index and I want to get some advice for my specific use case. I have a pipeline that ingests word documents from clients, an… --- ## [Watcherで割合をしきい値にしたり、出力したりする方法](https://discuss.elastic.co/t/watcher/233636)
**Author:** [@hashimoto](https://discuss.elastic.co/u/hashimoto)\ **Replies:** 1\ **Last updated:** [May 21, 2020, 6:12am UTC](https://discuss.elastic.co/t/watcher/233636 "2020-05-21T06:12:07Z")
現在nginxのアクセスログを蓄積しており過去n分間の取引のうち処理時間(duration.rpが当たります)m秒以上がx%以上だったら警告というような運用を考えています。 データとして以下のようにn秒以上の件数をすべて抜き出し0秒以上の全件で割れば算出できるのではと考えましたがctx.payload.aggregations.duration\_sla.bucketsの個別の要素へのアクセス方法と計算処理をどこに書けばよいかがいまいち… --- ## [Watcher with Index Action - Not writing data properly](https://discuss.elastic.co/t/watcher-with-index-action-not-writing-data-properly/232714)
**Author:** [@Bhavani\_Prasad](https://discuss.elastic.co/u/Bhavani_Prasad)\ **Replies:** 15\ **Last updated:** [May 21, 2020, 6:21am UTC](https://discuss.elastic.co/t/watcher-with-index-action-not-writing-data-properly/232714 "2020-05-21T06:21:07Z")
Hello, I am trying to create a watcher that scans a log index and once it finds a search term, writes the JSON payload to a new index with an Index action. I am seeing that the data that is reaching the Index this way i… --- ## [\[parent\] data too large](https://discuss.elastic.co/t/parent-data-too-large/233671)
**Author:** [@ted\_ye](https://discuss.elastic.co/u/ted_ye)\ **Replies:** 0\ **Last updated:** [May 21, 2020, 6:13am UTC](https://discuss.elastic.co/t/parent-data-too-large/233671 "2020-05-21T06:13:33Z")
Hello , I am seeking the frequent occurence of the CircuitBreakingException in our ES cluster. org.elasticsearch.xpack.monitoring.exporter.ExportException: RemoteTransportException\[\[mdwdata04\]\[10.10.30.66:9302\]\[indices… --- ## [How to send logs to AWS S3](https://discuss.elastic.co/t/how-to-send-logs-to-aws-s3/229977)
**Author:** [@suresh123](https://discuss.elastic.co/u/suresh123)\ **Replies:** 3\ **Last updated:** [May 21, 2020, 4:39am UTC](https://discuss.elastic.co/t/how-to-send-logs-to-aws-s3/229977 "2020-05-21T04:39:32Z")
I have setup ELK on AWS EC2. and started sending logs to it. But after 1 week logserver stopped working due to less space on device. So I need to move the logs (archive) to S3 . But no idea of that. Please help me to s… --- ## [Comparing records from different inventory systems](https://discuss.elastic.co/t/comparing-records-from-different-inventory-systems/233660)
**Author:** [@Jez1](https://discuss.elastic.co/u/Jez1)\ **Replies:** 0\ **Last updated:** [May 21, 2020, 4:30am UTC](https://discuss.elastic.co/t/comparing-records-from-different-inventory-systems/233660 "2020-05-21T04:30:06Z")
Hi All, I'm not sure if this is possible or advised with ElasticSearch but thought it would be a good place to start. What I'm working on is I have multiple systems that contain information of computers on my network (… --- ## [Elastic rollover performance thoughts](https://discuss.elastic.co/t/elastic-rollover-performance-thoughts/233535)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 2\ **Last updated:** [May 21, 2020, 4:28am UTC](https://discuss.elastic.co/t/elastic-rollover-performance-thoughts/233535 "2020-05-21T04:28:19Z")
Hello, in the past I used to have an index per month, and named them: logs-YYYY-MM when query them I used to build a list of indices, and concat them, with a date range filter. for example. if the date range is last … --- ## [Translateのdictionaryファイルのリロード](https://discuss.elastic.co/t/translate-dictionary/233047)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 1\ **Last updated:** [May 21, 2020, 3:43am UTC](https://discuss.elastic.co/t/translate-dictionary/233047 "2020-05-21T03:43:00Z")
logstashのtranslateにおけるdictionaryファイルのリロードについて質問させてください。 logstashでtranslateを使用する場合、デフォルトでは300秒ごとにdictionaryファイルをリロードする動作をする認識です。(refresh\_intervalの設定) 参考 https://www.elastic.co/guide/en/logstash/current/plugins-filters-… --- ## [Mutate gsub \\ not working](https://discuss.elastic.co/t/mutate-gsub-not-working/233455)
**Author:** [@Rafael\_Pereira\_Silva](https://discuss.elastic.co/u/Rafael_Pereira_Silva)\ **Replies:** 3\ **Last updated:** [May 21, 2020, 3:41am UTC](https://discuss.elastic.co/t/mutate-gsub-not-working/233455 "2020-05-21T03:41:45Z")
Hello, I have a log .... \\"pattern\\":\\"^\[0-9\]{9}$\\"},\\"typeId\\":{\\"enum\\":\[32\], \\"mysensitivefield\\":\\"ASDASDLAASDASDASLDASDAZ\\" , I need to replace mysensitivefield information. getting like this \*\*\*\*\*\*\*\*\*\* : \*\*\*\*\*… --- ## [Unable to get terms + terms + top hits aggregation](https://discuss.elastic.co/t/unable-to-get-terms-terms-top-hits-aggregation/233650)
**Author:** [@Andy93](https://discuss.elastic.co/u/Andy93)\ **Replies:** 0\ **Last updated:** [May 21, 2020, 2:45am UTC](https://discuss.elastic.co/t/unable-to-get-terms-terms-top-hits-aggregation/233650 "2020-05-21T02:45:18Z")
Hi, I am trying to do a terms + terms + top hits aggregation on an index of ~5.4m documents. The relevant fields are equipment ID, location, and the timestamp. I want to get the latest location of the equipment via the… --- ## [表示値を別フィールドの値にする](https://discuss.elastic.co/t/topic/229404)
**Author:** [@hashimoto](https://discuss.elastic.co/u/hashimoto)\ **Replies:** 2\ **Last updated:** [May 21, 2020, 2:44am UTC](https://discuss.elastic.co/t/topic/229404 "2020-05-21T02:44:09Z")
グラフを作成する際にX軸をユーザIDで分割するさいに軸に表示される値をユーザ名にするような方法はありますでしょうか。 Kibanaは 6.8.2です。 --- ## [\[Line chart\] Show threshold line for only right y-axis](https://discuss.elastic.co/t/line-chart-show-threshold-line-for-only-right-y-axis/233228)
**Author:** [@sreliable](https://discuss.elastic.co/u/sreliable)\ **Replies:** 2\ **Last updated:** [May 21, 2020, 1:53am UTC](https://discuss.elastic.co/t/line-chart-show-threshold-line-for-only-right-y-axis/233228 "2020-05-21T01:53:06Z")
Hi all, I'm creating a visualization to understand the relationship between two fields: Transactions and CPU (%) of underlying server. I want to set a threshold line of 60% for just the CPU, thus I've made the followin… --- ## [When I use OR condition in multiline.pattern each line comes in a separate message](https://discuss.elastic.co/t/when-i-use-or-condition-in-multiline-pattern-each-line-comes-in-a-separate-message/233639)
**Author:** [@ebisada](https://discuss.elastic.co/u/ebisada)\ **Replies:** 0\ **Last updated:** [May 21, 2020, 1:20am UTC](https://discuss.elastic.co/t/when-i-use-or-condition-in-multiline-pattern-each-line-comes-in-a-separate-message/233639 "2020-05-21T01:20:24Z")
When I use OR condition in multiline.pattern each line comes in a separate message: When I use the following lines, I can successfully parse multiple line logs starting with \[INFO\], \[ERROR\] or \[DEBUG\]: multiline.patter… --- ## [Logstash Translate Dictionary not working](https://discuss.elastic.co/t/logstash-translate-dictionary-not-working/233420)
**Author:** [@AliMalik](https://discuss.elastic.co/u/AliMalik)\ **Replies:** 16\ **Last updated:** [May 21, 2020, 1:41am UTC](https://discuss.elastic.co/t/logstash-translate-dictionary-not-working/233420 "2020-05-21T01:41:29Z")
Hi All, I need some help. I am trying to use a translate filter in logstash to translate winlog.event\_data.AccessList value to some meaningful field but it's not working. below is my code in the filter file. Looks like … --- ## [If the es-watcher webhook link is down, why does it directly affect the work of the elasticsearch cluster](https://discuss.elastic.co/t/if-the-es-watcher-webhook-link-is-down-why-does-it-directly-affect-the-work-of-the-elasticsearch-cluster/233638)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 0\ **Last updated:** [May 21, 2020, 1:13am UTC](https://discuss.elastic.co/t/if-the-es-watcher-webhook-link-is-down-why-does-it-directly-affect-the-work-of-the-elasticsearch-cluster/233638 "2020-05-21T01:13:11Z")
I want to make a suggestion, is es and watcher too coupled? es log https://paste.ubuntu.com/p/JMWYbMtb6W/ 304 will always appear in the log of kibana --- ## [Copying Incremental Data](https://discuss.elastic.co/t/copying-incremental-data/232356)
**Author:** [@alajangi](https://discuss.elastic.co/u/alajangi)\ **Replies:** 6\ **Last updated:** [May 21, 2020, 12:41am UTC](https://discuss.elastic.co/t/copying-incremental-data/232356 "2020-05-21T00:41:55Z")
Hi, I am using elasticsearch version 6.5.1 I have 2 indexes, say index1 and index2, index2 is reindexed from index1 with same mapping, new data will keep come to index1, i want to copy incremental data to index2 from … --- ## [Unable to create index in Elastic search using API](https://discuss.elastic.co/t/unable-to-create-index-in-elastic-search-using-api/233446)
**Author:** [@rupini](https://discuss.elastic.co/u/rupini)\ **Replies:** 3\ **Last updated:** [May 21, 2020, 12:24am UTC](https://discuss.elastic.co/t/unable-to-create-index-in-elastic-search-using-api/233446 "2020-05-21T00:24:59Z")
Hi, I am trying to create index in Elastic search using API in Kibana dev tools. PUT /ipflow-logs { "ipflow-logs" : { "mappings" : { "properties" : { "conn\_state" : { "type" : "keyword" … --- ## [Not able to get results in dashboards from few days back in kibana, index looks ok](https://discuss.elastic.co/t/not-able-to-get-results-in-dashboards-from-few-days-back-in-kibana-index-looks-ok/233214)
**Author:** [@Ari1](https://discuss.elastic.co/u/Ari1)\ **Replies:** 5\ **Last updated:** [May 21, 2020, 12:19am UTC](https://discuss.elastic.co/t/not-able-to-get-results-in-dashboards-from-few-days-back-in-kibana-index-looks-ok/233214 "2020-05-21T00:19:10Z")
Hi all I am not able to get results from 21st from dashboards in kibana, cluster, nodes, looks ok, and I can get queries from \_cat/indices of current day. What would happen? I appreciate your advise kibana ver 6.0.0!… --- ## [What recomendations could you give to redesign my cluster.. ( I need to boost it)](https://discuss.elastic.co/t/what-recomendations-could-you-give-to-redesign-my-cluster-i-need-to-boost-it/233619)
**Author:** [@Luis\_Alfredo\_Gonzale](https://discuss.elastic.co/u/Luis_Alfredo_Gonzale)\ **Replies:** 1\ **Last updated:** [May 20, 2020, 11:17pm UTC](https://discuss.elastic.co/t/what-recomendations-could-you-give-to-redesign-my-cluster-i-need-to-boost-it/233619 "2020-05-20T23:17:31Z")
We are currently receiving about 200 gb of information per day. Distributed in approximately two million logs. We need to increase the capacity of our cluster in order to generate some reports in less time than now. Wh… --- ## [Notification on successful load of data to elasticsearch](https://discuss.elastic.co/t/notification-on-successful-load-of-data-to-elasticsearch/233587)
**Author:** [@mnrdammu](https://discuss.elastic.co/u/mnrdammu)\ **Replies:** 1\ **Last updated:** [May 20, 2020, 11:05pm UTC](https://discuss.elastic.co/t/notification-on-successful-load-of-data-to-elasticsearch/233587 "2020-05-20T23:05:42Z")
I need some help on one of the use case I am working on.. Basically, Its a simple use case where, log stash is reading data from the csv file from a directory and loading into the elastic search. Every time when there i… --- ## [Tengo este error](https://discuss.elastic.co/t/tengo-este-error/233601)
**Author:** [@ferhogan](https://discuss.elastic.co/u/ferhogan)\ **Replies:** 1\ **Last updated:** [May 20, 2020, 10:44pm UTC](https://discuss.elastic.co/t/tengo-este-error/233601 "2020-05-20T22:44:27Z")
{ "timestamp": "2020-05-20T19:15:10.645+0000", "status": 500, "error": "Internal Server Error", "message": "None of the configured nodes are available: \[{#transport#-1}{7GYeCRnnT5mX5INtz3ScOw}{localhost}{127.0.0.1:92… --- ## [Shards Resizing](https://discuss.elastic.co/t/shards-resizing/233606)
**Author:** [@hsalim](https://discuss.elastic.co/u/hsalim)\ **Replies:** 3\ **Last updated:** [May 20, 2020, 10:17pm UTC](https://discuss.elastic.co/t/shards-resizing/233606 "2020-05-20T22:17:01Z")
Hello, This topic has been discussed in-depth, and I am still looking for a better understanding. So hoping someone can provide insights. How do we actually allocate storage to a shard? I know we can increase number of… --- ## [Configuration with Filebeat and S3](https://discuss.elastic.co/t/configuration-with-filebeat-and-s3/233622)
**Author:** [@Annette1](https://discuss.elastic.co/u/Annette1)\ **Replies:** 0\ **Last updated:** [May 20, 2020, 9:50pm UTC](https://discuss.elastic.co/t/configuration-with-filebeat-and-s3/233622 "2020-05-20T21:50:58Z")
I currently have a logstash configuration running with filebeat using pipelines that is somewhat simplistic. Logstash is load balanced across two instances in the file beats configuration. The logstash pipelines are co… --- ## [Reversing The Order Of Characters to a date valid format](https://discuss.elastic.co/t/reversing-the-order-of-characters-to-a-date-valid-format/233443)
**Author:** [@Claudio\_Ract\_Costa](https://discuss.elastic.co/u/Claudio_Ract_Costa)\ **Replies:** 4\ **Last updated:** [May 20, 2020, 9:48pm UTC](https://discuss.elastic.co/t/reversing-the-order-of-characters-to-a-date-valid-format/233443 "2020-05-20T21:48:53Z")
Hi guys, Does anyone know how can I reverse the order of the number bellow to transform it in a valid date format ? I am trying to figure out how do it using mutate gsub or ruby but it is very complex. from: 02404231… --- ## [Not able to export CSV file from Kibana 6.4.3](https://discuss.elastic.co/t/not-able-to-export-csv-file-from-kibana-6-4-3/229816)
**Author:** [@Aniket\_Salvi](https://discuss.elastic.co/u/Aniket_Salvi)\ **Replies:** 7\ **Last updated:** [May 20, 2020, 9:16pm UTC](https://discuss.elastic.co/t/not-able-to-export-csv-file-from-kibana-6-4-3/229816 "2020-05-20T21:16:20Z")
Hi, I used openshift platform and I installed elasticsearch and kibana on that. Now I want to export csv file from discover tab but I am not able to do that. I check share button, under share button only copy link optio… --- ## [Kibana Integration with nagios](https://discuss.elastic.co/t/kibana-integration-with-nagios/233615)
**Author:** [@kumar6](https://discuss.elastic.co/u/kumar6)\ **Replies:** 0\ **Last updated:** [May 20, 2020, 8:52pm UTC](https://discuss.elastic.co/t/kibana-integration-with-nagios/233615 "2020-05-20T20:52:30Z")
We use ELK for log management and nagios for centralized monitoring. I want to setup pattern match alerts in kibana and notify via nagios. Can you please let me know if this is feasible. --- ## [Inconsistent doc\_freq in \_mtermvectors](https://discuss.elastic.co/t/inconsistent-doc-freq-in-mtermvectors/233610)
**Author:** [@Xheneta](https://discuss.elastic.co/u/Xheneta)\ **Replies:** 0\ **Last updated:** [May 20, 2020, 8:42pm UTC](https://discuss.elastic.co/t/inconsistent-doc-freq-in-mtermvectors/233610 "2020-05-20T20:42:02Z")
Hi there, I have been using Elasticsearch to analyze a text with a customized analyzer in Elasticsearch. Then using the \_mtermvectors to get for each keyword the statistics. While trying it out, I found an inconsistency… --- ## ["numHits must be \> 0; please use TotalHitCountCollector if you just need the total hit count" following upgrade to ES 7.7](https://discuss.elastic.co/t/numhits-must-be-0-please-use-totalhitcountcollector-if-you-just-need-the-total-hit-count-following-upgrade-to-es-7-7/233174)
**Author:** [@toby\_jn](https://discuss.elastic.co/u/toby_jn)\ **Replies:** 3\ **Last updated:** [May 20, 2020, 8:41pm UTC](https://discuss.elastic.co/t/numhits-must-be-0-please-use-totalhitcountcollector-if-you-just-need-the-total-hit-count-following-upgrade-to-es-7-7/233174 "2020-05-20T20:41:05Z")
Following an upgrade from 7.5.1 to 7.7.0 we've started seeing an unusual error with queries used to count the number of documents in an index. In 7.7.0 this query now returns an error: curl -X POST '127.0.0.1:9200/v33.… --- ## [Data Format Conversion From Kibana not working for Range buckets](https://discuss.elastic.co/t/data-format-conversion-from-kibana-not-working-for-range-buckets/233543)
**Author:** [@PRODIPTO](https://discuss.elastic.co/u/PRODIPTO)\ **Replies:** 4\ **Last updated:** [May 20, 2020, 8:24pm UTC](https://discuss.elastic.co/t/data-format-conversion-from-kibana-not-working-for-range-buckets/233543 "2020-05-20T20:24:51Z")
Hi I have an index pattern having a field that contains data in microseconds format. After ingesting the data , i am changing the format of the field from Kibana to show the data in seconds format . When I am seeing the… --- ## [Metricbeat vsphere dashboards](https://discuss.elastic.co/t/metricbeat-vsphere-dashboards/233594)
**Author:** [@thatone08](https://discuss.elastic.co/u/thatone08)\ **Replies:** 1\ **Last updated:** [May 20, 2020, 7:51pm UTC](https://discuss.elastic.co/t/metricbeat-vsphere-dashboards/233594 "2020-05-20T19:51:58Z")
I am getting this when trying to view the vsphere dashboards [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1434) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1436)