# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1519 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1520 --- ## [Parsing url in log](https://discuss.elastic.co/t/parsing-url-in-log/227640)
**Author:** [@thedraketaylor](https://discuss.elastic.co/u/thedraketaylor)\ **Replies:** 2\ **Last updated:** [April 12, 2020, 12:20am UTC](https://discuss.elastic.co/t/parsing-url-in-log/227640 "2020-04-12T00:20:55Z")
I'm storing urls in the format "http://domain.com/showthread.php?10357-thread-title-and-such/page22" as "text". However, when I try to match the page number It fails to find anything. If I try to match anything before th… --- ## [How to make random\_score more random?](https://discuss.elastic.co/t/how-to-make-random-score-more-random/227635)
**Author:** [@i333](https://discuss.elastic.co/u/i333)\ **Replies:** 0\ **Last updated:** [April 11, 2020, 9:15pm UTC](https://discuss.elastic.co/t/how-to-make-random-score-more-random/227635 "2020-04-11T21:15:01Z")
With this query to randomize the search results, is it possible to set how randomized the results will be from the original results? How can I increase or decrease the amount of randomness that the search results have? G… --- ## [Grok pattern DATA vs GREEDYDATA mismatch](https://discuss.elastic.co/t/grok-pattern-data-vs-greedydata-mismatch/225300)
**Author:** [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\ **Replies:** 3\ **Last updated:** [April 11, 2020, 4:45pm UTC](https://discuss.elastic.co/t/grok-pattern-data-vs-greedydata-mismatch/225300 "2020-04-11T16:45:52Z")
In one log file, I have two different formats of log lines as below. Why does %{GREEDYDATA:loglevel} and %{DATA:loglevel} make a huge difference in loglevel output? 2020-03-26 11:31:10,324 \[Thread-40\] INFO … --- ## [Multiple disks on same node - shard allocation](https://discuss.elastic.co/t/multiple-disks-on-same-node-shard-allocation/227590)
**Author:** [@ItamarBenjamin](https://discuss.elastic.co/u/ItamarBenjamin)\ **Replies:** 3\ **Last updated:** [April 11, 2020, 4:22pm UTC](https://discuss.elastic.co/t/multiple-disks-on-same-node-shard-allocation/227590 "2020-04-11T16:22:34Z")
Hi, I have a cluster with 10 data nodes. some data nodes have multiple disks with different sizes (running on-prem, have to do with what i'm given). During the night my main index got locked due to 'flood stage disk wa… --- ## [Filter by a regexp inside a terms aggregation](https://discuss.elastic.co/t/filter-by-a-regexp-inside-a-terms-aggregation/227573)
**Author:** [@misterone](https://discuss.elastic.co/u/misterone)\ **Replies:** 2\ **Last updated:** [April 11, 2020, 4:05pm UTC](https://discuss.elastic.co/t/filter-by-a-regexp-inside-a-terms-aggregation/227573 "2020-04-11T16:05:42Z")
Hi, Is there a way to group by field1 only when field1 matches the following logic : field1 contains ALL of the keywords in this list : \[keyword1, keyword2, keyword3\] I have a working example for 1 keyword but I can't… --- ## [Querying 5.4 Billion JSON Documents occupying 2 TB - is it possible in Elasticsearch?](https://discuss.elastic.co/t/querying-5-4-billion-json-documents-occupying-2-tb-is-it-possible-in-elasticsearch/227617)
**Author:** [@somnath.choudhuri](https://discuss.elastic.co/u/somnath.choudhuri)\ **Replies:** 1\ **Last updated:** [April 11, 2020, 4:03pm UTC](https://discuss.elastic.co/t/querying-5-4-billion-json-documents-occupying-2-tb-is-it-possible-in-elasticsearch/227617 "2020-04-11T16:03:19Z")
Ingesting once a day (not real-time) 60 million JSON documents via a once run batch script Elasticsearch to query 90 days worth of data for a total of 5.4 billion documents Occupies about 2 TB of storage overall (23 GB … --- ## [Swift Library for Elasticsearch](https://discuss.elastic.co/t/swift-library-for-elasticsearch/227613)
**Author:** [@Adello](https://discuss.elastic.co/u/Adello)\ **Replies:** 0\ **Last updated:** [April 11, 2020, 3:12pm UTC](https://discuss.elastic.co/t/swift-library-for-elasticsearch/227613 "2020-04-11T15:12:35Z")
Hello everyone :slight\_smile: I am looking for an Elasticsearch Swift library. Any recommendations? --- ## [Aggregate plugin sends all events to ES](https://discuss.elastic.co/t/aggregate-plugin-sends-all-events-to-es/227445)
**Author:** [@xyz2](https://discuss.elastic.co/u/xyz2)\ **Replies:** 7\ **Last updated:** [April 11, 2020, 2:28pm UTC](https://discuss.elastic.co/t/aggregate-plugin-sends-all-events-to-es/227445 "2020-04-11T14:28:17Z")
Hi , Need to use multiple events and build single aggregated event based on session id to send to ES Here is how data looks like: session open for user abc (session id :1) session open for user bbc (session id :2) .… --- ## [Performance degradation](https://discuss.elastic.co/t/performance-degradation/227508)
**Author:** [@Burga](https://discuss.elastic.co/u/Burga)\ **Replies:** 8\ **Last updated:** [April 11, 2020, 1:56pm UTC](https://discuss.elastic.co/t/performance-degradation/227508 "2020-04-11T13:56:50Z")
Hi Guys , I'm a new in EK , need your help I need to do performance review due to the slowness of the system How would you suggest to do this ? and what would you say regarding the amount of servers , do you sugg… --- ## [Net how to customize index and type](https://discuss.elastic.co/t/net-how-to-customize-index-and-type/227575)
**Author:** [@lzx538370](https://discuss.elastic.co/u/lzx538370)\ **Replies:** 5\ **Last updated:** [April 11, 2020, 1:34pm UTC](https://discuss.elastic.co/t/net-how-to-customize-index-and-type/227575 "2020-04-11T13:34:23Z")
Hi How to customize types? thanks --- ## [Is ElasticSearch a suitable tool to do time series comparison?](https://discuss.elastic.co/t/is-elasticsearch-a-suitable-tool-to-do-time-series-comparison/227533)
**Author:** [@Silverspur](https://discuss.elastic.co/u/Silverspur)\ **Replies:** 0\ **Last updated:** [April 10, 2020, 4:24pm UTC](https://discuss.elastic.co/t/is-elasticsearch-a-suitable-tool-to-do-time-series-comparison/227533 "2020-04-10T16:24:44Z")
Hi, The running of an industrial process I'm in charge of produces time series data (approximately several thousand parameters, each 1/8th of a second, during a month). My goal is to look at two month-long executions a… --- ## [I am trying to add ingore\_malformed to true on an existing field in elasticsearch 6.7 and see mapping type is missing error, How to handle this?](https://discuss.elastic.co/t/i-am-trying-to-add-ingore-malformed-to-true-on-an-existing-field-in-elasticsearch-6-7-and-see-mapping-type-is-missing-error-how-to-handle-this/227565)
**Author:** [@ssunkara](https://discuss.elastic.co/u/ssunkara)\ **Replies:** 4\ **Last updated:** [April 11, 2020, 12:52pm UTC](https://discuss.elastic.co/t/i-am-trying-to-add-ingore-malformed-to-true-on-an-existing-field-in-elasticsearch-6-7-and-see-mapping-type-is-missing-error-how-to-handle-this/227565 "2020-04-11T12:52:18Z")
PUT/\/\_mapping { "properties": { "max\_size":{ "type":"long", "ignore\_malformed": true } } } Response be like "error": { "root\_cause": \[ { "type": "action\_req… --- ## [Extract a integer from an array based in field values](https://discuss.elastic.co/t/extract-a-integer-from-an-array-based-in-field-values/227498)
**Author:** [@krille.com](https://discuss.elastic.co/u/krille.com)\ **Replies:** 3\ **Last updated:** [April 11, 2020, 11:45am UTC](https://discuss.elastic.co/t/extract-a-integer-from-an-array-based-in-field-values/227498 "2020-04-11T11:45:23Z")
Hello... I am trying to extract a forex rate from an array based on the year and month fields. I have a array which is like this: // forexRate =\> // 2017;7;0.0001105093, 2017;8;0.0001116904, 2017;9;0.0001114438, 2017;1… --- ## [Elasticsearch considerations for ingesting large files](https://discuss.elastic.co/t/elasticsearch-considerations-for-ingesting-large-files/227464)
**Author:** [@adityaPsl](https://discuss.elastic.co/u/adityaPsl)\ **Replies:** 6\ **Last updated:** [April 11, 2020, 11:33am UTC](https://discuss.elastic.co/t/elasticsearch-considerations-for-ingesting-large-files/227464 "2020-04-11T11:33:37Z")
Hello Team, Just wanted to understand the limits , scaling and performance of Elasticsearch, what should be the considerations while ingesting large files (40-50) GB, metadata and making it searchable. For examples mic… --- ## [Zeek filebeat - HTTP and TLS events not fully populating](https://discuss.elastic.co/t/zeek-filebeat-http-and-tls-events-not-fully-populating/224830)
**Author:** [@lw24](https://discuss.elastic.co/u/lw24)\ **Replies:** 3\ **Last updated:** [April 11, 2020, 11:14am UTC](https://discuss.elastic.co/t/zeek-filebeat-http-and-tls-events-not-fully-populating/224830 "2020-04-11T11:14:10Z")
I have a Security Onion VM with Filebeats on it with Zeek module enabled. I've edited the zeek.yml file to point to /nsm/bro/logs/current and have all the events being pulled through to Kibana. DNS events are fully popu… --- ## [Filebeat - Suricata drop\_event not working](https://discuss.elastic.co/t/filebeat-suricata-drop-event-not-working/227597)
**Author:** [@lw24](https://discuss.elastic.co/u/lw24)\ **Replies:** 0\ **Last updated:** [April 11, 2020, 10:55am UTC](https://discuss.elastic.co/t/filebeat-suricata-drop-event-not-working/227597 "2020-04-11T10:55:15Z")
Hi, I'm trying to add a drop\_event condition to drop events with Suricata alert severity below a threshold. Currently I have modified /filebeat/module/suricata/eve/config/eve.yml to contain: drop\_event: when: equals… --- ## [Count by keyword](https://discuss.elastic.co/t/count-by-keyword/227595)
**Author:** [@sanjaye218](https://discuss.elastic.co/u/sanjaye218)\ **Replies:** 0\ **Last updated:** [April 11, 2020, 10:41am UTC](https://discuss.elastic.co/t/count-by-keyword/227595 "2020-04-11T10:41:14Z")
Hi, I am trying to get document count matching by each search term. Lets say am searching for terms vehicle & electric. I want to get document count where term matching anywhere in document and expecting result like veh… --- ## [How to make many conditions for one field?](https://discuss.elastic.co/t/how-to-make-many-conditions-for-one-field/227594)
**Author:** [@Emna1](https://discuss.elastic.co/u/Emna1)\ **Replies:** 0\ **Last updated:** [April 11, 2020, 10:23am UTC](https://discuss.elastic.co/t/how-to-make-many-conditions-for-one-field/227594 "2020-04-11T10:23:03Z")
Hi, i want to make many conditions associate to one field, itry this code if \[Duration\] \>= 336 { mutate { add\_field =\> { "price" =\> "50$" } } } else if \[Duration\] == 15{ mutate { add\_field =\> { "price" =\> "10$" } … --- ## [Type error no implicit conversion of NilClass into String with null date](https://discuss.elastic.co/t/type-error-no-implicit-conversion-of-nilclass-into-string-with-null-date/227547)
**Author:** [@mattiacareddu](https://discuss.elastic.co/u/mattiacareddu)\ **Replies:** 2\ **Last updated:** [April 11, 2020, 10:00am UTC](https://discuss.elastic.co/t/type-error-no-implicit-conversion-of-nilclass-into-string-with-null-date/227547 "2020-04-11T10:00:22Z")
I'm having the following error when logstash try to index a null value in date field: Type error no implicit conversion of NilClass into String This is the complete stacktrace 2458 rufus-scheduler intercepted an er… --- ## [O365beat v1.2.0 released - Office 365 log shipper](https://discuss.elastic.co/t/o365beat-v1-2-0-released-office-365-log-shipper/197985)
**Author:** [@chris-counteractive](https://discuss.elastic.co/u/chris-counteractive)\ **Replies:** 8\ **Last updated:** [April 11, 2020, 9:46am UTC](https://discuss.elastic.co/t/o365beat-v1-2-0-released-office-365-log-shipper/197985 "2020-04-11T09:46:09Z")
The first production release of o365beat is now available as v1.2.0 on github. O365beat is an open source log shipper used to fetch Office 365 audit logs from the Office 365 Management Activity API and forward them with… --- ## [Watcher output message](https://discuss.elastic.co/t/watcher-output-message/227591)
**Author:** [@Silver](https://discuss.elastic.co/u/Silver)\ **Replies:** 0\ **Last updated:** [April 11, 2020, 9:17am UTC](https://discuss.elastic.co/t/watcher-output-message/227591 "2020-04-11T09:17:16Z")
This is the output i am getting for my aggregation.. "aggregations": { "users": { "doc\_count\_error\_upper\_bound": 0, "sum\_other\_doc\_count": 0, "buckets": \[ { "doc\_count… --- ## [Does Elasticsearch have capability to form ES cluster with only one ES docker service running multiple replicas of it in Docker-Swarm](https://discuss.elastic.co/t/does-elasticsearch-have-capability-to-form-es-cluster-with-only-one-es-docker-service-running-multiple-replicas-of-it-in-docker-swarm/224943)
**Author:** [@admin\_labs](https://discuss.elastic.co/u/admin_labs)\ **Replies:** 1\ **Last updated:** [April 11, 2020, 6:29am UTC](https://discuss.elastic.co/t/does-elasticsearch-have-capability-to-form-es-cluster-with-only-one-es-docker-service-running-multiple-replicas-of-it-in-docker-swarm/224943 "2020-04-11T06:29:05Z")
I wanna run only one elasticsearch service in docker-swarm cluster having multiple replicas or at least one replica of this service in each node of docker-swarm cluster. Does Elasticsearch have capability to form ES cl… --- ## [Looking for Kibana Demo video](https://discuss.elastic.co/t/looking-for-kibana-demo-video/227231)
**Author:** [@andrew\_vo](https://discuss.elastic.co/u/andrew_vo)\ **Replies:** 2\ **Last updated:** [April 11, 2020, 2:55am UTC](https://discuss.elastic.co/t/looking-for-kibana-demo-video/227231 "2020-04-11T02:55:01Z")
Hi. I saw an elasticsearch kibana video few days ago. In the video, CTO or Engineer of a company I forgot the name, he introduces his elasticsearch dashboard that he built, it can convert nature language questions into q… --- ## [Log line with multiple JSON Objects](https://discuss.elastic.co/t/log-line-with-multiple-json-objects/227562)
**Author:** [@ccabral](https://discuss.elastic.co/u/ccabral)\ **Replies:** 2\ **Last updated:** [April 10, 2020, 11:52pm UTC](https://discuss.elastic.co/t/log-line-with-multiple-json-objects/227562 "2020-04-10T23:52:13Z")
Hello, apologies if this has already been asked and answered but I can't seem to find a way to achieve what I'm looking for. I'm using logstash to break down log lines and I have everything separated but I run into a str… --- ## [Mapper\_parsing\_exception: object mapping tried to parse field as object, but found a concrete value](https://discuss.elastic.co/t/mapper-parsing-exception-object-mapping-tried-to-parse-field-as-object-but-found-a-concrete-value/227572)
**Author:** [@nsanthosh](https://discuss.elastic.co/u/nsanthosh)\ **Replies:** 0\ **Last updated:** [April 10, 2020, 11:39pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-object-mapping-tried-to-parse-field-as-object-but-found-a-concrete-value/227572 "2020-04-10T23:39:19Z")
Could you suggest how to handle different value types mapped to a filed i.e. object and text? I have an index that has a mapping as listed below. The same is started failing to accept the text value. I don't have contro… --- ## [Kibana is not loading and resulting in timeout](https://discuss.elastic.co/t/kibana-is-not-loading-and-resulting-in-timeout/226978)
**Author:** [@Daud\_Ahmed](https://discuss.elastic.co/u/Daud_Ahmed)\ **Replies:** 1\ **Last updated:** [April 10, 2020, 10:57pm UTC](https://discuss.elastic.co/t/kibana-is-not-loading-and-resulting-in-timeout/226978 "2020-04-10T22:57:03Z")
hi, {"type":"log","@timestamp":"2020-04-07T17:20:25Z","tags":\["info","optimize"\],"pid":8025,"message":"Optimizing and caching bundles for core, graph, monnitoring, space\_selector, login, overwritten\_session, logout, log… --- ## [Custom bar visualization in kibana](https://discuss.elastic.co/t/custom-bar-visualization-in-kibana/227062)
**Author:** [@Lokesh\_Mutra](https://discuss.elastic.co/u/Lokesh_Mutra)\ **Replies:** 1\ **Last updated:** [April 10, 2020, 10:56pm UTC](https://discuss.elastic.co/t/custom-bar-visualization-in-kibana/227062 "2020-04-10T22:56:20Z")
i want to visualize the data which is in different " \_id" something like this field name is level\_1.words: \_id : 1 \_index :training level\_1.words : \[ {"happy":\[{"total":30,"today":10,"before\_day":20}\],"sad":\[{"tota… --- ## [Weird behavior with "Show partial rows" in data table](https://discuss.elastic.co/t/weird-behavior-with-show-partial-rows-in-data-table/227079)
**Author:** [@Rom1](https://discuss.elastic.co/u/Rom1)\ **Replies:** 1\ **Last updated:** [April 10, 2020, 10:47pm UTC](https://discuss.elastic.co/t/weird-behavior-with-show-partial-rows-in-data-table/227079 "2020-04-10T22:47:55Z")
Dear all, I'm using Kibana 7.5.1 and I'm facing weird behavior when using datatable visualization: When I activate "Show partial rows", it seems that the 'Formatted' export is disabled (nothing happens when I click o… --- ## [How to change the Sankey diagram colors?](https://discuss.elastic.co/t/how-to-change-the-sankey-diagram-colors/227229)
**Author:** [@Krishna94](https://discuss.elastic.co/u/Krishna94)\ **Replies:** 1\ **Last updated:** [April 10, 2020, 10:44pm UTC](https://discuss.elastic.co/t/how-to-change-the-sankey-diagram-colors/227229 "2020-04-10T22:44:44Z")
Hello Team, We use a dark theme and I want to set other light colors for the 3 -node Sankey diagram. I followed the example for the Sankey Diagram from the Elastic Blog Post \[ Kibana/Vega Sankey Post. \] . Please help… --- ## [CanMatch search phase and AliasFilter](https://discuss.elastic.co/t/canmatch-search-phase-and-aliasfilter/227515)
**Author:** [@yfful](https://discuss.elastic.co/u/yfful)\ **Replies:** 2\ **Last updated:** [April 10, 2020, 9:39pm UTC](https://discuss.elastic.co/t/canmatch-search-phase-and-aliasfilter/227515 "2020-04-10T21:39:00Z")
Hi, If an aliased index contains a filter, the SearchService#canMatch method would rewrite it. However, that method doesn't check if the alias filter got rewritten to a match\_none which would indicate that the shard cou… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1518) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1520)