# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1678 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1679 --- ## [Elasticsearh internals](https://discuss.elastic.co/t/elasticsearh-internals/215367)
**Author:** [@adityaPsl](https://discuss.elastic.co/u/adityaPsl)\ **Replies:** 2\ **Last updated:** [January 18, 2020, 8:26am UTC](https://discuss.elastic.co/t/elasticsearh-internals/215367 "2020-01-18T08:26:57Z")
Hello Team, How can i learn elasticsearch internals like Index creation and storage , cross cluster code, storage API, text analysis etc. Thank you, Aditya --- ## [Multi-word, multi-term querystring query](https://discuss.elastic.co/t/multi-word-multi-term-querystring-query/215509)
**Author:** [@David\_Von\_Lehman](https://discuss.elastic.co/u/David_Von_Lehman)\ **Replies:** 1\ **Last updated:** [January 18, 2020, 7:59am UTC](https://discuss.elastic.co/t/multi-word-multi-term-querystring-query/215509 "2020-01-18T07:59:37Z")
When running a multi-term querystring query with multiple search fields, I get different results depending on if there is a boolean operator present. For example if I have the following document: { title: "Car", … --- ## [Index is not rolling over](https://discuss.elastic.co/t/index-is-not-rolling-over/215546)
**Author:** [@asrinivasan](https://discuss.elastic.co/u/asrinivasan)\ **Replies:** 0\ **Last updated:** [January 18, 2020, 6:01am UTC](https://discuss.elastic.co/t/index-is-not-rolling-over/215546 "2020-01-18T06:01:08Z")
I created a lifec cycle policy to rollover after size reaches 30G, i then changed it to 100MB, however this did not take effect and the index did not rollover Running GET xxx-filemgr-000004/\_ilm/explain Gives { "i… --- ## [Can we set request time through env var?](https://discuss.elastic.co/t/can-we-set-request-time-through-env-var/214635)
**Author:** [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)\ **Replies:** 5\ **Last updated:** [January 18, 2020, 5:29am UTC](https://discuss.elastic.co/t/can-we-set-request-time-through-env-var/214635 "2020-01-18T05:29:28Z")
Hi using 6.4.2, Can we set elasticsearch.requestTimeout as an env variable ELASTICSEARCH\_REQUEST\_TIMEOUT?? Thanks --- ## [Object mapping \[channels.channel\_people\] can't be changed from nested to non-nested](https://discuss.elastic.co/t/object-mapping-channels-channel-people-cant-be-changed-from-nested-to-non-nested/215543)
**Author:** [@Abhilash\_Sathe1](https://discuss.elastic.co/u/Abhilash_Sathe1)\ **Replies:** 0\ **Last updated:** [January 18, 2020, 4:47am UTC](https://discuss.elastic.co/t/object-mapping-channels-channel-people-cant-be-changed-from-nested-to-non-nested/215543 "2020-01-18T04:47:04Z")
I first created a mapping. PUT /my\_index/ { "mappings": { "properties": { "channels": { "type": "object", "properties": { "channel\_people": { "type": "nested", … --- ## [QUERY - not working](https://discuss.elastic.co/t/query-not-working/215538)
**Author:** [@GuessMyName](https://discuss.elastic.co/u/GuessMyName)\ **Replies:** 0\ **Last updated:** [January 18, 2020, 1:10am UTC](https://discuss.elastic.co/t/query-not-working/215538 "2020-01-18T01:10:38Z")
Hey @ll I don't understand why this query is not bringing any results data.win.eventdata.parentImage: "C:\\Windows\\explorer.exe" or data.win.eventdata.parentImage: "explorer.exe" data is there... Thank you! --- ## [I build a data set and the drop down filter dont work with some fields despite work with others](https://discuss.elastic.co/t/i-build-a-data-set-and-the-drop-down-filter-dont-work-with-some-fields-despite-work-with-others/215533)
**Author:** [@nir9](https://discuss.elastic.co/u/nir9)\ **Replies:** 1\ **Last updated:** [January 18, 2020, 1:06am UTC](https://discuss.elastic.co/t/i-build-a-data-set-and-the-drop-down-filter-dont-work-with-some-fields-despite-work-with-others/215533 "2020-01-18T01:06:46Z")
how i can filter data table --- ## [Adding characters to a field](https://discuss.elastic.co/t/adding-characters-to-a-field/215513)
**Author:** [@megajune](https://discuss.elastic.co/u/megajune)\ **Replies:** 1\ **Last updated:** [January 17, 2020, 10:52pm UTC](https://discuss.elastic.co/t/adding-characters-to-a-field/215513 "2020-01-17T22:52:52Z")
I have this value in a field: 881908396bfd I want to format it like this: 88:19:08:39:6b:fd What's the "best" way to do that? --- ## [Splitting a string to json like results](https://discuss.elastic.co/t/splitting-a-string-to-json-like-results/215503)
**Author:** [@Newtoelastic](https://discuss.elastic.co/u/Newtoelastic)\ **Replies:** 10\ **Last updated:** [January 17, 2020, 8:07pm UTC](https://discuss.elastic.co/t/splitting-a-string-to-json-like-results/215503 "2020-01-17T20:07:03Z")
Hey there, I have my own logs coming into the logstash that are being created from my python script. The format for the logs is: %{DATA:Sender}|%{DATA:Recipient}|%{DATA:Subject}|(%{DATA:Links})?$ So far so good. Proble… --- ## [Bootstrap monitoring process did not exit as expected - Again](https://discuss.elastic.co/t/bootstrap-monitoring-process-did-not-exit-as-expected-again/215228)
**Author:** [@lcarr](https://discuss.elastic.co/u/lcarr)\ **Replies:** 9\ **Last updated:** [January 17, 2020, 6:25pm UTC](https://discuss.elastic.co/t/bootstrap-monitoring-process-did-not-exit-as-expected-again/215228 "2020-01-17T18:25:47Z")
I am asking to reopen this ticket. I need some kind of resolution on how to fix it. I have 7 deployments to do in the next 6 months. I had no issues with doing the install on Centos 7 but when I tried in RHEL 7.5 Maip… --- ## [Port forwarding to ELK Application in Ubuntu](https://discuss.elastic.co/t/port-forwarding-to-elk-application-in-ubuntu/215226)
**Author:** [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\ **Replies:** 1\ **Last updated:** [January 17, 2020, 6:24pm UTC](https://discuss.elastic.co/t/port-forwarding-to-elk-application-in-ubuntu/215226 "2020-01-17T18:24:23Z")
I am trying to make my kibana webpage application accessible to other computer from outside network. In Port forwarding, what should be the Host Ip, Host Port, Guest Ip, and Guest port? --- ## [Bulk Export More Than 10k Events](https://discuss.elastic.co/t/bulk-export-more-than-10k-events/215497)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 0\ **Last updated:** [January 17, 2020, 5:07pm UTC](https://discuss.elastic.co/t/bulk-export-more-than-10k-events/215497 "2020-01-17T17:07:09Z")
I occasionally have the need to pull events out of Elasticsearch. I built a script using PowerShell that utilizes scroll to pull all the records. The problem I have though is that I can only pull 10k events per request… --- ## [Index parent-child with \_id](https://discuss.elastic.co/t/index-parent-child-with-id/215491)
**Author:** [@johnkary](https://discuss.elastic.co/u/johnkary)\ **Replies:** 0\ **Last updated:** [January 17, 2020, 4:00pm UTC](https://discuss.elastic.co/t/index-parent-child-with-id/215491 "2020-01-17T16:00:46Z")
Hi all! I use parent-child model in my index "npk" and here are some questions basically on the ways i can search. I studied has-child and has-parent queries but i don't get any results for the docs i inserted to this in… --- ## [Couchdb\_changes gives Invalid FieldReference error when parsing couchdb which hosts couchapp](https://discuss.elastic.co/t/couchdb-changes-gives-invalid-fieldreference-error-when-parsing-couchdb-which-hosts-couchapp/214685)
**Author:** [@Raymond\_Tsang](https://discuss.elastic.co/u/Raymond_Tsang)\ **Replies:** 11\ **Last updated:** [January 17, 2020, 4:59pm UTC](https://discuss.elastic.co/t/couchdb-changes-gives-invalid-fieldreference-error-when-parsing-couchdb-which-hosts-couchapp/214685 "2020-01-17T16:59:58Z")
Here is the log: Jan 10 16:45:25 Andromeda logstash\[12489\]: \[2020-01-10T16:45:25,081\]\[INFO \]\[logstash.inputs.couchdbchanges\]\[main\] Connecting to CouchDB \_changes stream at: {:host=\>"localhost", :port=\>"5984", :db=\>"mate… --- ## [Eck and Prometheus](https://discuss.elastic.co/t/eck-and-prometheus/215495)
**Author:** [@jdambly](https://discuss.elastic.co/u/jdambly)\ **Replies:** 0\ **Last updated:** [January 17, 2020, 4:45pm UTC](https://discuss.elastic.co/t/eck-and-prometheus/215495 "2020-01-17T16:45:02Z")
What using eck what is the best way to send metrics to Prometheus for monitoring? I see there are a couple of projects for this And Are there any other that are better? --- ## [Grok positional structure problem](https://discuss.elastic.co/t/grok-positional-structure-problem/215475)
**Author:** [@Ahmad\_Moh\_d\_El\_Hasan](https://discuss.elastic.co/u/Ahmad_Moh_d_El_Hasan)\ **Replies:** 4\ **Last updated:** [January 17, 2020, 4:25pm UTC](https://discuss.elastic.co/t/grok-positional-structure-problem/215475 "2020-01-17T16:25:18Z")
Dear sirs I have a question about the grok plugin: I have some logs which are built in the following way and my problem is that the order of my fields can mutate from log to log (in the example here I should extract f… --- ## [How to get all unique values of a field for a single index?](https://discuss.elastic.co/t/how-to-get-all-unique-values-of-a-field-for-a-single-index/215492)
**Author:** [@Tom\_Somerville](https://discuss.elastic.co/u/Tom_Somerville)\ **Replies:** 0\ **Last updated:** [January 17, 2020, 4:12pm UTC](https://discuss.elastic.co/t/how-to-get-all-unique-values-of-a-field-for-a-single-index/215492 "2020-01-17T16:12:26Z")
Hey All, Running into an issue that I cannot seem to find a solution. I currently have a number of indexes, all of them billions of docs large, and I need a way to extract all unique values for any given field in the in… --- ## [Logstash Input From Elastic HTTPS](https://discuss.elastic.co/t/logstash-input-from-elastic-https/215313)
**Author:** [@reyhanadp](https://discuss.elastic.co/u/reyhanadp)\ **Replies:** 1\ **Last updated:** [January 17, 2020, 4:05pm UTC](https://discuss.elastic.co/t/logstash-input-from-elastic-https/215313 "2020-01-17T16:05:18Z")
hi I want to retrieve data from an elasticsearch server that uses https. logstash config that I use to retrieve data from elasticsearch as follows : input { elasticsearch { hosts =\> \["https://RVRPAOR1ABC19WD:9200"… --- ## [License API for Put](https://discuss.elastic.co/t/license-api-for-put/215490)
**Author:** [@balogan](https://discuss.elastic.co/u/balogan)\ **Replies:** 0\ **Last updated:** [January 17, 2020, 3:53pm UTC](https://discuss.elastic.co/t/license-api-for-put/215490 "2020-01-17T15:53:42Z")
I'm working on writing a play to update the license key. Get and delete works well, but when I put the license I got from the get it throws this error. { "errors": \[{ "code": "license.invalid\_license", "message": "I… --- ## [Differentiate Linux syslog log from Windows event log](https://discuss.elastic.co/t/differentiate-linux-syslog-log-from-windows-event-log/215449)
**Author:** [@claud81](https://discuss.elastic.co/u/claud81)\ **Replies:** 5\ **Last updated:** [January 17, 2020, 3:43pm UTC](https://discuss.elastic.co/t/differentiate-linux-syslog-log-from-windows-event-log/215449 "2020-01-17T15:43:32Z")
Hi everyone, we have 2 conf file in Logstash (version 6.8.6) conf.d directory to differentiate Microsoft log from Linux log, the first: input { tcp { port =\> 3515 codec =\> json … --- ## [Kibana not fetching fields of an index pattern with predefined mapping (PUT request)](https://discuss.elastic.co/t/kibana-not-fetching-fields-of-an-index-pattern-with-predefined-mapping-put-request/215349)
**Author:** [@AlekssM](https://discuss.elastic.co/u/AlekssM)\ **Replies:** 2\ **Last updated:** [January 17, 2020, 3:24pm UTC](https://discuss.elastic.co/t/kibana-not-fetching-fields-of-an-index-pattern-with-predefined-mapping-put-request/215349 "2020-01-17T15:24:05Z")
I have read the exact same question but the problem was automatically closed. "When configuring an index pattern in Kibana, it's unable to fetch the field details of a particular index in Kibana, if I am using a predefi… --- ## [Elastic Stack Helm Charts](https://discuss.elastic.co/t/elastic-stack-helm-charts/187598)
**Author:** [@LaurentGoderre](https://discuss.elastic.co/u/LaurentGoderre)\ **Replies:** 5\ **Last updated:** [January 17, 2020, 3:29pm UTC](https://discuss.elastic.co/t/elastic-stack-helm-charts/187598 "2020-01-17T15:29:16Z")
I had started an epic to fix the elastic-stack helm chart in helm/stable: https://github.com/helm/charts/issues/14564 I think this work is still desirable because it should be easy to install the stack using helm withou… --- ## [Query\_string using '\*' wildcard VS prefix query](https://discuss.elastic.co/t/query-string-using-wildcard-vs-prefix-query/215481)
**Author:** [@CesarPozo](https://discuss.elastic.co/u/CesarPozo)\ **Replies:** 1\ **Last updated:** [January 17, 2020, 3:28pm UTC](https://discuss.elastic.co/t/query-string-using-wildcard-vs-prefix-query/215481 "2020-01-17T15:28:32Z")
I wrote a query for get all clients whose name start with c. I am getting the same results with the two following queries: #Q1 Query String and \* wildcard GET /client/\_search { "query": { "query\_string": { "… --- ## [Logstash Date parsing error from Kinesis](https://discuss.elastic.co/t/logstash-date-parsing-error-from-kinesis/215310)
**Author:** [@Chris\_Broll](https://discuss.elastic.co/u/Chris_Broll)\ **Replies:** 1\ **Last updated:** [January 17, 2020, 3:22pm UTC](https://discuss.elastic.co/t/logstash-date-parsing-error-from-kinesis/215310 "2020-01-17T15:22:01Z")
I have picked up a Logstash server to look after and I can see some incoming events from a Kinesis input that is failing to be indexed: Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>n… --- ## [Migrate Billing to Google Cloud](https://discuss.elastic.co/t/migrate-billing-to-google-cloud/215485)
**Author:** [@Edgar\_Peixoto](https://discuss.elastic.co/u/Edgar_Peixoto)\ **Replies:** 0\ **Last updated:** [January 17, 2020, 3:11pm UTC](https://discuss.elastic.co/t/migrate-billing-to-google-cloud/215485 "2020-01-17T15:11:52Z")
My team already have a Cluster in Elastic Cloud. But now we want to migrate the billing to our Google Cloud. Is it possible or do we have to recreate the cluster using Google Cloud Marketplace and delete the cluster we … --- ## [Using Logstash to correct timestamps](https://discuss.elastic.co/t/using-logstash-to-correct-timestamps/215379)
**Author:** [@Hyperion0](https://discuss.elastic.co/u/Hyperion0)\ **Replies:** 8\ **Last updated:** [January 17, 2020, 3:11pm UTC](https://discuss.elastic.co/t/using-logstash-to-correct-timestamps/215379 "2020-01-17T15:11:40Z")
I'm very new to the ELK stack. I have several logs that starts collecting data before the systems time is set. The result is I have several hundred log entries with in accurate time stamps. Is there a way I can edit th… --- ## [How to skip some lines from a log file without skipping the complete message](https://discuss.elastic.co/t/how-to-skip-some-lines-from-a-log-file-without-skipping-the-complete-message/215399)
**Author:** [@Daniel\_Gonzalez1](https://discuss.elastic.co/u/Daniel_Gonzalez1)\ **Replies:** 1\ **Last updated:** [January 17, 2020, 3:04pm UTC](https://discuss.elastic.co/t/how-to-skip-some-lines-from-a-log-file-without-skipping-the-complete-message/215399 "2020-01-17T15:04:06Z")
Hello Everyone! I'm working with a file that has some lines that I want to skip when they come to logstash. These are a sample of the log lines: \> 15Jan20 11:34:10.39 PRHTGRCE MXP1 RACF CONNECT success for PRHTGRCE: C… --- ## [DNS Lookup result in Discover Apache Logs](https://discuss.elastic.co/t/dns-lookup-result-in-discover-apache-logs/215253)
**Author:** [@coolmac](https://discuss.elastic.co/u/coolmac)\ **Replies:** 1\ **Last updated:** [January 17, 2020, 3:01pm UTC](https://discuss.elastic.co/t/dns-lookup-result-in-discover-apache-logs/215253 "2020-01-17T15:01:22Z")
Hello. Faced with the need to see in the Apache log report the host name by ip-address (dns lookup reverse). I use Elastic Cloud and do not fully understand how this can be done. I added settings to filebeat.yml (on th… --- ## [Logstash is not pulling data from s3 bucket](https://discuss.elastic.co/t/logstash-is-not-pulling-data-from-s3-bucket/215470)
**Author:** [@Sreekanth3](https://discuss.elastic.co/u/Sreekanth3)\ **Replies:** 0\ **Last updated:** [January 17, 2020, 1:47pm UTC](https://discuss.elastic.co/t/logstash-is-not-pulling-data-from-s3-bucket/215470 "2020-01-17T13:47:38Z")
Hi , This is my logstash conf input { s3 { access\_key\_id =\> "xxxx" secret\_access\_key =\> "xxx" #bucket =\> "mybucketname/2020/01/16" bucket =\> "sftlcloudtrail" sincedb\_path =\> "/tmp/last-s3-file-s3-access-logs" ad… --- ## [Исправление опечаток для русского языка](https://discuss.elastic.co/t/topic/215296)
**Author:** [@lynxoft](https://discuss.elastic.co/u/lynxoft)\ **Replies:** 2\ **Last updated:** [January 17, 2020, 2:53pm UTC](https://discuss.elastic.co/t/topic/215296 "2020-01-17T14:53:52Z")
Добрый день. Есть поисковый индекс с настройками: 'settings' =\> \[ 'number\_of\_shards' =\> 1, 'number\_of\_replicas' =\> 0, 'analysis'=\>\[ 'c… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1677) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1679)