# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1446 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1447 --- ## [Introduce Time delay in Mutate Http Filter plugin](https://discuss.elastic.co/t/introduce-time-delay-in-mutate-http-filter-plugin/232731)
**Author:** [@Vinay\_Raju](https://discuss.elastic.co/u/Vinay_Raju)\ **Replies:** 1\ **Last updated:** [May 15, 2020, 3:32pm UTC](https://discuss.elastic.co/t/introduce-time-delay-in-mutate-http-filter-plugin/232731 "2020-05-15T15:32:54Z")
I have a requirement where we would be querying clientid's from postgres DB and pass each of clientid to one of HTTP API and dump the output to file output. Now the DB contains some 100K unique clientid's and i need to … --- ## [Inclusion and regex on conditionals](https://discuss.elastic.co/t/inclusion-and-regex-on-conditionals/232756)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 2\ **Last updated:** [May 15, 2020, 3:29pm UTC](https://discuss.elastic.co/t/inclusion-and-regex-on-conditionals/232756 "2020-05-15T15:29:54Z")
This will match the exact match of "SCD" or will also match "scd" or "SCD-abc"? works like a linux grep? if \[hostgroup\] =~ /SCD/ { mutate { add\_field =\> { "indexname" =\> "scd" }}} What is the diference with: … --- ## [Antivirus Exclustions & Performance considerations](https://discuss.elastic.co/t/antivirus-exclustions-performance-considerations/232845)
**Author:** [@vladtepes](https://discuss.elastic.co/u/vladtepes)\ **Replies:** 1\ **Last updated:** [May 15, 2020, 3:00pm UTC](https://discuss.elastic.co/t/antivirus-exclustions-performance-considerations/232845 "2020-05-15T15:00:52Z")
Hi, I would like to know what is the guidance on antivirus for Elasticsearch? Which paths should be excluded and with what justification? I am writing about the 7.6.2 version on Windows. --- ## [Node loop crashing](https://discuss.elastic.co/t/node-loop-crashing/232178)
**Author:** [@jsu](https://discuss.elastic.co/u/jsu)\ **Replies:** 18\ **Last updated:** [May 15, 2020, 2:51pm UTC](https://discuss.elastic.co/t/node-loop-crashing/232178 "2020-05-15T14:51:55Z")
Hey there, So, I currently have a cluster running for timeseries with security enabled. It has 5 nodes: 1 dedicated master-eligible node, let's call it node1 2 master-elligible, data and ingest nodes, tagged hot, le… --- ## [Get document from doc\_count](https://discuss.elastic.co/t/get-document-from-doc-count/232829)
**Author:** [@Unpolygon](https://discuss.elastic.co/u/Unpolygon)\ **Replies:** 2\ **Last updated:** [May 15, 2020, 2:22pm UTC](https://discuss.elastic.co/t/get-document-from-doc-count/232829 "2020-05-15T14:22:27Z")
Is there a way to get document after composite aggregation? Assume after I aggregated and I get doc\_count = 5. I want to know these 5 documents in doc\_count because I have to analyze these documents. --- ## [Would rolling restart cause continuous bulk data lost?](https://discuss.elastic.co/t/would-rolling-restart-cause-continuous-bulk-data-lost/232739)
**Author:** [@hackerwin7](https://discuss.elastic.co/u/hackerwin7)\ **Replies:** 8\ **Last updated:** [May 15, 2020, 2:09pm UTC](https://discuss.elastic.co/t/would-rolling-restart-cause-continuous-bulk-data-lost/232739 "2020-05-15T14:09:20Z")
Hi, According to this if default settings is only 1 primary shard is active, when rolling restart, the indexing write primary shard is down. primary have latest data, replicas haven't sync these latest data, when rolli… --- ## [How to use SLM to do snapshots ignoring hot and warm indices](https://discuss.elastic.co/t/how-to-use-slm-to-do-snapshots-ignoring-hot-and-warm-indices/232834)
**Author:** [@Robert\_Vilvert](https://discuss.elastic.co/u/Robert_Vilvert)\ **Replies:** 0\ **Last updated:** [May 15, 2020, 1:46pm UTC](https://discuss.elastic.co/t/how-to-use-slm-to-do-snapshots-ignoring-hot-and-warm-indices/232834 "2020-05-15T13:46:32Z")
Hi! I would like to know if it's possible to ignore my hot and warm indices on SLM. Could be something like ignoring some days too. Hot retention is already 7 days and warm 30 days, Can I make a policy like following pat… --- ## [Sending data to to different Elasticsearch instances from Logstash](https://discuss.elastic.co/t/sending-data-to-to-different-elasticsearch-instances-from-logstash/232830)
**Author:** [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\ **Replies:** 2\ **Last updated:** [May 15, 2020, 1:45pm UTC](https://discuss.elastic.co/t/sending-data-to-to-different-elasticsearch-instances-from-logstash/232830 "2020-05-15T13:45:41Z")
I'm looking to send data to two different Elasticsearch instances. If pretty sure that each one of these options will work but many months ago I had a similar setup in a different environment and the way I had implement… --- ## [Stack Monitoring only viewing current index](https://discuss.elastic.co/t/stack-monitoring-only-viewing-current-index/232604)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 6\ **Last updated:** [May 15, 2020, 1:44pm UTC](https://discuss.elastic.co/t/stack-monitoring-only-viewing-current-index/232604 "2020-05-15T13:44:37Z")
Hi, I am using ILM with metricbeat, within stack monitoring it seems i cannot view data beyond the current index, the previous indexs are available. My ILM policy is simply hot, 30 days or 50GB, no move to warm. I am … --- ## [GeoJSON from location/change datatype of location to Geo\_Point](https://discuss.elastic.co/t/geojson-from-location-change-datatype-of-location-to-geo-point/232805)
**Author:** [@shubham184](https://discuss.elastic.co/u/shubham184)\ **Replies:** 1\ **Last updated:** [May 15, 2020, 1:28pm UTC](https://discuss.elastic.co/t/geojson-from-location-change-datatype-of-location-to-geo-point/232805 "2020-05-15T13:28:07Z")
Hello, I have incoming data in the below format "TestItem": { "OriginCountry": "IN", "OriginCity": "Banglore", "DestinationCountry": "US", "DestinationCity":"New York"} I want to ch… --- ## [Logstash service failure ''Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError"](https://discuss.elastic.co/t/logstash-service-failure-failed-to-execute-action-action-logstash-create-pipeline-id-main-exception-logstash-configurationerror/232728)
**Author:** [@soufiane\_adn](https://discuss.elastic.co/u/soufiane_adn)\ **Replies:** 9\ **Last updated:** [May 15, 2020, 1:11pm UTC](https://discuss.elastic.co/t/logstash-service-failure-failed-to-execute-action-action-logstash-create-pipeline-id-main-exception-logstash-configurationerror/232728 "2020-05-15T13:11:38Z")
Hello, im trying to run logstash as service by systemctl start logstash but i found the following error on log file \[2020-05-15T00:12:10,751\]\[ERROR\]\[logstash.agent \] Failed to execute action {:action=\>LogStas… --- ## [Elasticsearch cluster crash due to circuit breakdown issue](https://discuss.elastic.co/t/elasticsearch-cluster-crash-due-to-circuit-breakdown-issue/232824)
**Author:** [@Khajan\_Singh\_Bisht](https://discuss.elastic.co/u/Khajan_Singh_Bisht)\ **Replies:** 0\ **Last updated:** [May 15, 2020, 1:01pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-crash-due-to-circuit-breakdown-issue/232824 "2020-05-15T13:01:02Z")
Hi, Currently elasticsearch cluster is getting crashed and showing error related to circuit breakdown. While hitting kibana url I am getting below screen. While further debugging I found logs regarding circuit break… --- ## [Filebeat system module to kafka topic](https://discuss.elastic.co/t/filebeat-system-module-to-kafka-topic/232666)
**Author:** [@ismyhairnice](https://discuss.elastic.co/u/ismyhairnice)\ **Replies:** 4\ **Last updated:** [May 15, 2020, 12:37pm UTC](https://discuss.elastic.co/t/filebeat-system-module-to-kafka-topic/232666 "2020-05-15T12:37:03Z")
Hi all I have a setup currently sends snort logs to kafka topic and to logstash for ingest. Just wondering if is possible to send Filebeat System module logs to kafka topic ? Regards Yu Feng --- ## [Elasticsearch-keystore and docker](https://discuss.elastic.co/t/elasticsearch-keystore-and-docker/232820)
**Author:** [@maadhav](https://discuss.elastic.co/u/maadhav)\ **Replies:** 0\ **Last updated:** [May 15, 2020, 12:36pm UTC](https://discuss.elastic.co/t/elasticsearch-keystore-and-docker/232820 "2020-05-15T12:36:48Z")
Hi everyone How can we configure elastisearch-keystore in docker environment. We are using docker based architecture and all elasticsearch settings are passed as environment keys(not using elasticsearch.yml). I am tryi… --- ## [Unable to get Date Range Control to filter dates in Kibana Dashboard](https://discuss.elastic.co/t/unable-to-get-date-range-control-to-filter-dates-in-kibana-dashboard/228791)
**Author:** [@ChintanCParekh](https://discuss.elastic.co/u/ChintanCParekh)\ **Replies:** 3\ **Last updated:** [May 15, 2020, 12:32pm UTC](https://discuss.elastic.co/t/unable-to-get-date-range-control-to-filter-dates-in-kibana-dashboard/228791 "2020-05-15T12:32:53Z")
Hi Team, I am working on visualization and dashboard in kibana. We have field called created\_date with format datetime in an index pattern and so as in document. Hence we are trying to filter in visualization and dashbo… --- ## [Issue with reusing dashboard on another index](https://discuss.elastic.co/t/issue-with-reusing-dashboard-on-another-index/231289)
**Author:** [@manojkrishna561994](https://discuss.elastic.co/u/manojkrishna561994)\ **Replies:** 8\ **Last updated:** [May 15, 2020, 12:19pm UTC](https://discuss.elastic.co/t/issue-with-reusing-dashboard-on-another-index/231289 "2020-05-15T12:19:30Z")
I'm trying to reuse the dashboard i have on another index. I downloaded the file from saved objects which is in ndjson format and edited following fields index name, index id(uuid), dashboard name and dashboard id(uuid… --- ## [Doubt on how dashboard is selecting the index](https://discuss.elastic.co/t/doubt-on-how-dashboard-is-selecting-the-index/231541)
**Author:** [@manojkrishna561994](https://discuss.elastic.co/u/manojkrishna561994)\ **Replies:** 5\ **Last updated:** [May 15, 2020, 12:17pm UTC](https://discuss.elastic.co/t/doubt-on-how-dashboard-is-selecting-the-index/231541 "2020-05-15T12:17:12Z")
I have 3 indices namely index\_1, index\_2, index\_3. I have downloaded the dashboard by not selecting the include related objects switch from Management \> saved objects \> export \[switch off include related objects\] \> My d… --- ## [Filter for documents that only have one of possible values](https://discuss.elastic.co/t/filter-for-documents-that-only-have-one-of-possible-values/229949)
**Author:** [@gyterpena](https://discuss.elastic.co/u/gyterpena)\ **Replies:** 4\ **Last updated:** [May 15, 2020, 11:41am UTC](https://discuss.elastic.co/t/filter-for-documents-that-only-have-one-of-possible-values/229949 "2020-05-15T11:41:12Z")
I have documents/web logs that have source IP and http method(GET,POST,PUT...) I need to query list of source IPs that only did POST in specified time window. Any ideas? --- ## [Curator does not backup all index on Azure](https://discuss.elastic.co/t/curator-does-not-backup-all-index-on-azure/232773)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 0\ **Last updated:** [May 15, 2020, 9:07am UTC](https://discuss.elastic.co/t/curator-does-not-backup-all-index-on-azure/232773 "2020-05-15T09:07:51Z")
Hi, everyone I use Curator tool in order to backup all my index on Azure. However, it only backup 46 index. On Kibana: PUT \_snapshot/azure { "type": "azure", "settings": { "container": "container-name-azure", … --- ## [Access to max\_score result property in elasticsearch result in script sorting](https://discuss.elastic.co/t/access-to-max-score-result-property-in-elasticsearch-result-in-script-sorting/232806)
**Author:** [@111338](https://discuss.elastic.co/u/111338)\ **Replies:** 0\ **Last updated:** [May 15, 2020, 11:35am UTC](https://discuss.elastic.co/t/access-to-max-score-result-property-in-elasticsearch-result-in-script-sorting/232806 "2020-05-15T11:35:05Z")
I have es query for search, like this { "track\_scores": true, "query": { "bool": { "must": \[ \, \, \] } and I got result l… --- ## [Retrieving sorted documents from large index](https://discuss.elastic.co/t/retrieving-sorted-documents-from-large-index/228499)
**Author:** [@itsash](https://discuss.elastic.co/u/itsash)\ **Replies:** 0\ **Last updated:** [April 17, 2020, 11:18am UTC](https://discuss.elastic.co/t/retrieving-sorted-documents-from-large-index/228499 "2020-04-17T11:18:37Z")
(topic withdrawn by author, will be automatically deleted in 24 hours unless flagged) --- ## [Convert timestamp formats in array of objects in a Nested Field](https://discuss.elastic.co/t/convert-timestamp-formats-in-array-of-objects-in-a-nested-field/232802)
**Author:** [@ckough](https://discuss.elastic.co/u/ckough)\ **Replies:** 0\ **Last updated:** [May 15, 2020, 11:16am UTC](https://discuss.elastic.co/t/convert-timestamp-formats-in-array-of-objects-in-a-nested-field/232802 "2020-05-15T11:16:57Z")
Hi There, I have an index that looks like so: { "\_index": "ec2\_logs-index-2020.05.11", "\_type": "\_doc", "\_id": "V3LAAnIBk2krYRHTuxCC", "\_version": 1, "\_score": null, "\_source": { "owner": "104115521938"… --- ## [Sending Data from MySql to ES](https://discuss.elastic.co/t/sending-data-from-mysql-to-es/232609)
**Author:** [@Jasmin](https://discuss.elastic.co/u/Jasmin)\ **Replies:** 7\ **Last updated:** [May 15, 2020, 11:08am UTC](https://discuss.elastic.co/t/sending-data-from-mysql-to-es/232609 "2020-05-15T11:08:11Z")
Hi , i am sending 447 documents from logstash but ES is recieving only 43 , my config file : input { jdbc { jdbc\_connection\_string =\> "jdbc:mysql://ipaddress:3306/zendb" jdbc\_user =\> "\*\*\*\*" jdbc\_password =\> "\*\*\*\*\*… --- ## [Cannot save to ElasticSearch via NLog](https://discuss.elastic.co/t/cannot-save-to-elasticsearch-via-nlog/232790)
**Author:** [@persepherone](https://discuss.elastic.co/u/persepherone)\ **Replies:** 2\ **Last updated:** [May 15, 2020, 10:47am UTC](https://discuss.elastic.co/t/cannot-save-to-elasticsearch-via-nlog/232790 "2020-05-15T10:47:59Z")
I have a password protected ElasticSearch instance. When i try to use NLog.Targets.ElasticSearch in my .net core 3.1 application to directly save logs to Elastic search. I am getting error. my Log .config file is as fol… --- ## [Duplicate keyword problem](https://discuss.elastic.co/t/duplicate-keyword-problem/232796)
**Author:** [@bigshark](https://discuss.elastic.co/u/bigshark)\ **Replies:** 0\ **Last updated:** [May 15, 2020, 10:47am UTC](https://discuss.elastic.co/t/duplicate-keyword-problem/232796 "2020-05-15T10:47:37Z")
Hi everyone, I have a trouble with Elastic search. Let's say I have about 1 millions articles. Within them, there are about 100k articles talk about Corona virus. The thing is when lecturers and students search for "cor… --- ## [Copy single field from one index to another existing index](https://discuss.elastic.co/t/copy-single-field-from-one-index-to-another-existing-index/232794)
**Author:** [@thekozak](https://discuss.elastic.co/u/thekozak)\ **Replies:** 0\ **Last updated:** [May 15, 2020, 10:39am UTC](https://discuss.elastic.co/t/copy-single-field-from-one-index-to-another-existing-index/232794 "2020-05-15T10:39:48Z")
Is it possible to take a field from one index and copy it to another existing index without loosing fields it already contains? For example I have an index abc having fields field\_a, field\_b, field\_c and index def havin… --- ## [Blue/Green Deployment to 7.7](https://discuss.elastic.co/t/blue-green-deployment-to-7-7/232780)
**Author:** [@spike83](https://discuss.elastic.co/u/spike83)\ **Replies:** 4\ **Last updated:** [May 15, 2020, 10:25am UTC](https://discuss.elastic.co/t/blue-green-deployment-to-7-7/232780 "2020-05-15T10:25:56Z")
Hi, I'm running a 3 node cluster running 1 shard 2 replica for most indexes. Is it possible to carry out a Blue/Green deployment type upgrade to Elasticsearch whereby I shutdown a node and bring up a brand new node on 7… --- ## [Kibana - date histogram vizualization with unique count per user with login and logout](https://discuss.elastic.co/t/kibana-date-histogram-vizualization-with-unique-count-per-user-with-login-and-logout/232671)
**Author:** [@Nuno\_Barros](https://discuss.elastic.co/u/Nuno_Barros)\ **Replies:** 2\ **Last updated:** [May 15, 2020, 9:50am UTC](https://discuss.elastic.co/t/kibana-date-histogram-vizualization-with-unique-count-per-user-with-login-and-logout/232671 "2020-05-15T09:50:23Z")
Hi, I am importing data from a license database into elastic through logstash. The data comes with this structure: user\_name, timelogin, elapsedtime, timeofrelease I want to build a visualization with the unique coun… --- ## [.keyword field not filled?](https://discuss.elastic.co/t/keyword-field-not-filled/232778)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 0\ **Last updated:** [May 15, 2020, 9:19am UTC](https://discuss.elastic.co/t/keyword-field-not-filled/232778 "2020-05-15T09:19:23Z")
Hi folks, Running elk 6.7 here. I have these indexes. 2 from different applications. These applications use the same logstash cluster and this goes to the same elastic coördinating node. Now I have these 2 indexes, le… --- ## [Elasticsearch6.2.1 remove field](https://discuss.elastic.co/t/elasticsearch6-2-1-remove-field/232558)
**Author:** [@jerry-chen-315](https://discuss.elastic.co/u/jerry-chen-315)\ **Replies:** 3\ **Last updated:** [May 15, 2020, 9:36am UTC](https://discuss.elastic.co/t/elasticsearch6-2-1-remove-field/232558 "2020-05-15T09:36:43Z")
Is there any method remove field from some docs when don't know doc id or don't specified doc id? Like higher version provide delete\_by\_query API. [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1445) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1447)