# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1837 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1838 --- ## [Elasticsearch.yml path config](https://discuss.elastic.co/t/elasticsearch-yml-path-config/202919)
**Author:** [@fvegaucr1](https://discuss.elastic.co/u/fvegaucr1)\ **Replies:** 2\ **Last updated:** [October 16, 2019, 6:36pm UTC](https://discuss.elastic.co/t/elasticsearch-yml-path-config/202919 "2019-10-16T18:36:30Z")
Im currently building a cluster following hot warm arch. I have 3 master nodes with 2 OS drives as RAID1 20 data nodes Each of them with 2 OS drives as RAID1 and 8 drives, configure as JBOD. Based on server roles. I o… --- ## [Term\_vectors and custom analyzers](https://discuss.elastic.co/t/term-vectors-and-custom-analyzers/202188)
**Author:** [@bbaronas](https://discuss.elastic.co/u/bbaronas)\ **Replies:** 2\ **Last updated:** [October 16, 2019, 6:30pm UTC](https://discuss.elastic.co/t/term-vectors-and-custom-analyzers/202188 "2019-10-16T18:30:34Z")
Hello, I'm running Elasticsearch 7.3.2 in Elastic Cloud. I have built a mapping for one of my indices where I have used a custom analyzer: "standard-uax-url-analyzer" that is essentially the standard analyzer, but it is… --- ## [Запись событий FileBeat в разные индексы](https://discuss.elastic.co/t/filebeat/203651)
**Author:** [@d1gger](https://discuss.elastic.co/u/d1gger)\ **Replies:** 6\ **Last updated:** [October 16, 2019, 5:37pm UTC](https://discuss.elastic.co/t/filebeat/203651 "2019-10-16T17:37:02Z")
Прошу не судить строго. С ELK только начинаю знакомиться, а есть одна срочная задача, которую нужно решить. Я собираю с МЭ Cisco ASA NetFlow и SysLog с помощью соответствующих модулей FileBeat и пишу их напрямую в Elast… --- ## [Archive old indices with data compression](https://discuss.elastic.co/t/archive-old-indices-with-data-compression/203879)
**Author:** [@kevinray0030](https://discuss.elastic.co/u/kevinray0030)\ **Replies:** 5\ **Last updated:** [October 16, 2019, 5:51pm UTC](https://discuss.elastic.co/t/archive-old-indices-with-data-compression/203879 "2019-10-16T17:51:33Z")
Hey all, I am trying to find a solution to where I can keep roughly 90 days of live data on my cluster but then archive anything over 90 days up to a year. This is a compliance requirement. I am currently looking into … --- ## [Match query with altered AND operator](https://discuss.elastic.co/t/match-query-with-altered-and-operator/203891)
**Author:** [@Matthijs](https://discuss.elastic.co/u/Matthijs)\ **Replies:** 0\ **Last updated:** [October 16, 2019, 5:09pm UTC](https://discuss.elastic.co/t/match-query-with-altered-and-operator/203891 "2019-10-16T17:09:47Z")
Hello, I would like to perform a query where I only match against results, where my query contains all the words in the given result. The existing AND operator does a similar thing, but demands that all of the words in … --- ## [Loading snort alerts into logstash (GROK PATTERN)](https://discuss.elastic.co/t/loading-snort-alerts-into-logstash-grok-pattern/203889)
**Author:** [@cottoncandyy](https://discuss.elastic.co/u/cottoncandyy)\ **Replies:** 0\ **Last updated:** [October 16, 2019, 4:58pm UTC](https://discuss.elastic.co/t/loading-snort-alerts-into-logstash-grok-pattern/203889 "2019-10-16T16:58:36Z")
hi I am new to the elk stack and im trying to load snort event log into logstash for analysis but i cant seem to figure out the grok pattern. This is a sample data of how the snort alert log looks like, can someone help … --- ## [How can I download the results of a query?](https://discuss.elastic.co/t/how-can-i-download-the-results-of-a-query/203870)
**Author:** [@Rosho](https://discuss.elastic.co/u/Rosho)\ **Replies:** 1\ **Last updated:** [October 16, 2019, 4:46pm UTC](https://discuss.elastic.co/t/how-can-i-download-the-results-of-a-query/203870 "2019-10-16T16:46:22Z")
Hi In the image attached, I queried an index for a time period of 3 months. Now I want to download that information. It can be .csv or json. Is it possible to do that? --- ## [Datas from Database](https://discuss.elastic.co/t/datas-from-database/203885)
**Author:** [@Rael\_Rodrigues](https://discuss.elastic.co/u/Rael_Rodrigues)\ **Replies:** 0\ **Last updated:** [October 16, 2019, 4:39pm UTC](https://discuss.elastic.co/t/datas-from-database/203885 "2019-10-16T16:39:38Z")
how to get datas from some database? how to configure the jdbc? how to create the config file? --- ## [Elastic search couldnt start after deleting the nodes-HELP! URGENT](https://discuss.elastic.co/t/elastic-search-couldnt-start-after-deleting-the-nodes-help-urgent/203741)
**Author:** [@anusree\_arun](https://discuss.elastic.co/u/anusree_arun)\ **Replies:** 25\ **Last updated:** [October 16, 2019, 4:37pm UTC](https://discuss.elastic.co/t/elastic-search-couldnt-start-after-deleting-the-nodes-help-urgent/203741 "2019-10-16T16:37:23Z")
systemctl status elasticsearch â elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since Wed 2019… --- ## [Translate sql query](https://discuss.elastic.co/t/translate-sql-query/203827)
**Author:** [@Masdi](https://discuss.elastic.co/u/Masdi)\ **Replies:** 1\ **Last updated:** [October 16, 2019, 4:28pm UTC](https://discuss.elastic.co/t/translate-sql-query/203827 "2019-10-16T16:28:06Z")
Hi, Is it possible to translate the month name from a datetime? For example, I would like to get the result in Spanish for this query: SELECT MONTH\_NAME(CAST('2018-02-19T10:23:27Z' AS TIMESTAMP)) AS month; --- ## [How to aggregate many events?](https://discuss.elastic.co/t/how-to-aggregate-many-events/203836)
**Author:** [@RickT](https://discuss.elastic.co/u/RickT)\ **Replies:** 4\ **Last updated:** [October 16, 2019, 3:43pm UTC](https://discuss.elastic.co/t/how-to-aggregate-many-events/203836 "2019-10-16T15:43:50Z")
hi, i'm searching how to aggregate 2 or more events issued from a log file. The events have an common id. This is the criteria to aggregate events. I has tried the example of logstash 6.8 documentation, but it doesn't … --- ## [Using search\_after with a number larger than a 64bit integer crashes ES in 7.x](https://discuss.elastic.co/t/using-search-after-with-a-number-larger-than-a-64bit-integer-crashes-es-in-7-x/203874)
**Author:** [@fperks](https://discuss.elastic.co/u/fperks)\ **Replies:** 0\ **Last updated:** [October 16, 2019, 3:26pm UTC](https://discuss.elastic.co/t/using-search-after-with-a-number-larger-than-a-64bit-integer-crashes-es-in-7-x/203874 "2019-10-16T15:26:34Z")
Version: 7.3.1 Java: Java(TM) SE Runtime Environment (build 1.8.0\_201-b09) Passing search\_after parameter with a numeric value larger than 64bit causes Elasticsearch service to terminate. Doing this: curl -X POST \\ … --- ## [Using s3-repository with EC2 Instance Profile and kube2iam](https://discuss.elastic.co/t/using-s3-repository-with-ec2-instance-profile-and-kube2iam/203252)
**Author:** [@akappler](https://discuss.elastic.co/u/akappler)\ **Replies:** 3\ **Last updated:** [October 16, 2019, 3:28pm UTC](https://discuss.elastic.co/t/using-s3-repository-with-ec2-instance-profile-and-kube2iam/203252 "2019-10-16T15:28:07Z")
I am trying to configure my Elasticsearch instance for access to a S3 bucket. I want to secure access via an AWS Role, which should be assumed automatically via kube2iam. I am running into two problems: For kube2iam … --- ## [Error while starting logstash netflow module](https://discuss.elastic.co/t/error-while-starting-logstash-netflow-module/202802)
**Author:** [@Vikash\_Singh1](https://discuss.elastic.co/u/Vikash_Singh1)\ **Replies:** 2\ **Last updated:** [October 16, 2019, 3:17pm UTC](https://discuss.elastic.co/t/error-while-starting-logstash-netflow-module/202802 "2019-10-16T15:17:30Z")
Somehow after updating the logstash-7.3 to 7.4 I am getting error while starting the logstash. I have checked the logs and the error is: \[ERROR\] 2019-10-09 15:04:46.938 \[\ **Author:** [@jcampos](https://discuss.elastic.co/u/jcampos)\ **Replies:** 0\ **Last updated:** [October 16, 2019, 3:07pm UTC](https://discuss.elastic.co/t/log-http-requests-in-production/203871 "2019-10-16T15:07:39Z") I need to capture Http request to Elasticsearch in production. Does anyone know how i can do this? --- ## [Make a count on a list of values](https://discuss.elastic.co/t/make-a-count-on-a-list-of-values/203868)
**Author:** [@Alon\_Goldenberg](https://discuss.elastic.co/u/Alon_Goldenberg)\ **Replies:** 0\ **Last updated:** [October 16, 2019, 2:58pm UTC](https://discuss.elastic.co/t/make-a-count-on-a-list-of-values/203868 "2019-10-16T14:58:24Z")
Hello, I want to create a query that will count the appearance of every value in a list of values. example: each line represents a different doc: |doc\_id|Name| |1|Sam| |2|Dan| |3|Sam| |4|Sam| |5|Billy| |6|Billy… --- ## [Adding fields to an index has caused a performance hit](https://discuss.elastic.co/t/adding-fields-to-an-index-has-caused-a-performance-hit/203865)
**Author:** [@J-Darv](https://discuss.elastic.co/u/J-Darv)\ **Replies:** 0\ **Last updated:** [October 16, 2019, 2:53pm UTC](https://discuss.elastic.co/t/adding-fields-to-an-index-has-caused-a-performance-hit/203865 "2019-10-16T14:53:29Z")
Hi all, was hoping someone could offer some advice. Elastic version 5.6 We have an elastic index (pretty large - around 300Gb) that we have recently added some additional fields to, and have seen a performance drop wit… --- ## [Using Kafka as a message queue for Logstash](https://discuss.elastic.co/t/using-kafka-as-a-message-queue-for-logstash/203712)
**Author:** [@amclaughlin](https://discuss.elastic.co/u/amclaughlin)\ **Replies:** 2\ **Last updated:** [October 16, 2019, 2:47pm UTC](https://discuss.elastic.co/t/using-kafka-as-a-message-queue-for-logstash/203712 "2019-10-16T14:47:30Z")
Hey all, I am currently setting up an environment with Elastic and Logstash 7.3.1 to serve as a baseline SIEM environment. We have Logstash running on the app server as a pivot point and receiver for our beats and syslo… --- ## [Dedicated master nodes, do data nodes need to be considered also?](https://discuss.elastic.co/t/dedicated-master-nodes-do-data-nodes-need-to-be-considered-also/203860)
**Author:** [@Ant](https://discuss.elastic.co/u/Ant)\ **Replies:** 0\ **Last updated:** [October 16, 2019, 2:35pm UTC](https://discuss.elastic.co/t/dedicated-master-nodes-do-data-nodes-need-to-be-considered-also/203860 "2019-10-16T14:35:30Z")
I know that dedicated master nodes allow for better cluster operations as you get larger node counts and I am currently growing my cluster. I have some fairly low power boxes in storage that I think would make good maste… --- ## [UPTIME bucket limit](https://discuss.elastic.co/t/uptime-bucket-limit/203857)
**Author:** [@Andres\_Man](https://discuss.elastic.co/u/Andres_Man)\ **Replies:** 0\ **Last updated:** [October 16, 2019, 2:32pm UTC](https://discuss.elastic.co/t/uptime-bucket-limit/203857 "2019-10-16T14:32:05Z")
I installed elastic 7.1 and I have everything working correctly as far as I can tell. I configure heartbeat with ICMP and tcp monitors that run every 5 seconds. When I try to use Uptime to view the status of my monitored… --- ## [Logstash parse Array of objects](https://discuss.elastic.co/t/logstash-parse-array-of-objects/203854)
**Author:** [@johnSph](https://discuss.elastic.co/u/johnSph)\ **Replies:** 0\ **Last updated:** [October 16, 2019, 2:02pm UTC](https://discuss.elastic.co/t/logstash-parse-array-of-objects/203854 "2019-10-16T14:02:53Z")
Hello, I'm having some issues with creating a proper logstash config that could parse an array of objects. I have the example data source as example: \[ { "id": 666, "time": 1561938911000, "view": { "current": { … --- ## [OS metrics](https://discuss.elastic.co/t/os-metrics/199876)
**Author:** [@Pierrelaurent](https://discuss.elastic.co/u/Pierrelaurent)\ **Replies:** 11\ **Last updated:** [October 16, 2019, 2:01pm UTC](https://discuss.elastic.co/t/os-metrics/199876 "2019-10-16T14:01:27Z")
Hi There, I managed to get data into elasticsearch via logstash. The data contains OS metrics. Now that we have the data I am trying to make sense of it. We are getting raw data in but we want to see everything in perce… --- ## [Removing items from an ArrayList with script](https://discuss.elastic.co/t/removing-items-from-an-arraylist-with-script/203729)
**Author:** [@Dennis\_Monsewicz](https://discuss.elastic.co/u/Dennis_Monsewicz)\ **Replies:** 3\ **Last updated:** [October 16, 2019, 1:48pm UTC](https://discuss.elastic.co/t/removing-items-from-an-arraylist-with-script/203729 "2019-10-16T13:48:44Z")
I'm attempting to try to remove items from an ArrayList on a doc, but not having any luck. source: "for(item in params.tags) { if(ctx.\_source.tag\_list.indexOf(item) !== -1) { ctx.\_source.tag\_list.remove(item) } … --- ## [Is there any way to search for only one element from an array?](https://discuss.elastic.co/t/is-there-any-way-to-search-for-only-one-element-from-an-array/203851)
**Author:** [@Nirajan](https://discuss.elastic.co/u/Nirajan)\ **Replies:** 0\ **Last updated:** [October 16, 2019, 1:46pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-search-for-only-one-element-from-an-array/203851 "2019-10-16T13:46:09Z")
Hello Everyone, I am searching for any suggestions that would get me only one element from an array in Elasticsearch index. I have tried the composite aggregation, nested aggregation and nested query but all of these a… --- ## [Calculate time difference between two log lines in a file](https://discuss.elastic.co/t/calculate-time-difference-between-two-log-lines-in-a-file/203606)
**Author:** [@basavyr](https://discuss.elastic.co/u/basavyr)\ **Replies:** 3\ **Last updated:** [October 16, 2019, 1:33pm UTC](https://discuss.elastic.co/t/calculate-time-difference-between-two-log-lines-in-a-file/203606 "2019-10-16T13:33:06Z")
Hello there, I have a log file (given by the SLURM workload manager) that looks something like this: 2019-07-15 13:26:40 Started - job id: V3gNDm1MD7unkvVVEmSjiJLoABFKDmABFKDmtdGKDmABFKDmN8Erlm, unix user: 45001:45000,… --- ## [Elastic searh Query problem](https://discuss.elastic.co/t/elastic-searh-query-problem/203809)
**Author:** [@Andree\_Tago](https://discuss.elastic.co/u/Andree_Tago)\ **Replies:** 1\ **Last updated:** [October 16, 2019, 1:16pm UTC](https://discuss.elastic.co/t/elastic-searh-query-problem/203809 "2019-10-16T13:16:05Z")
Hi all i have this query and when i un it i get some result error { "query": { "bool": { "must": \[ { "range": { "timestamp":{"from" : "01/01/2015 00:00:00.0", "to" : "12/01/2015 23:59:59.999" } } } \] } } } B… --- ## [Histogram bucket first and last record](https://discuss.elastic.co/t/histogram-bucket-first-and-last-record/203751)
**Author:** [@Yogesh\_BG](https://discuss.elastic.co/u/Yogesh_BG)\ **Replies:** 1\ **Last updated:** [October 16, 2019, 12:58pm UTC](https://discuss.elastic.co/t/histogram-bucket-first-and-last-record/203751 "2019-10-16T12:58:46Z")
Hi I am using ES 6.6.0 I have time series cumulative data, i want to do histogram on the data with time being the field and get first and last records in each bucket. How can we do this? One crude way am thinking is, … --- ## [Showing relevancy in percentage](https://discuss.elastic.co/t/showing-relevancy-in-percentage/203764)
**Author:** [@Rick\_Choo](https://discuss.elastic.co/u/Rick_Choo)\ **Replies:** 1\ **Last updated:** [October 16, 2019, 12:54pm UTC](https://discuss.elastic.co/t/showing-relevancy-in-percentage/203764 "2019-10-16T12:54:58Z")
Hi may I know how do I show the relevancy of the search result? I understand the search will have some score for the result, however, in order to make sense of the number I was hoping for a best score which I can draw c… --- ## [Watcher Microsoft teams webhook](https://discuss.elastic.co/t/watcher-microsoft-teams-webhook/203811)
**Author:** [@wellerbar](https://discuss.elastic.co/u/wellerbar)\ **Replies:** 1\ **Last updated:** [October 16, 2019, 12:53pm UTC](https://discuss.elastic.co/t/watcher-microsoft-teams-webhook/203811 "2019-10-16T12:53:30Z")
Hi, I would like to send a notification to a Microsoft Teams webhook but I don't understand why this isn't workin, can someone help me please? Here is my watch : { "trigger": { "schedule": { "interval": "2… --- ## [Too many dynamic script compilations within max](https://discuss.elastic.co/t/too-many-dynamic-script-compilations-within-max/203793)
**Author:** [@rvanegmond](https://discuss.elastic.co/u/rvanegmond)\ **Replies:** 2\ **Last updated:** [October 16, 2019, 12:50pm UTC](https://discuss.elastic.co/t/too-many-dynamic-script-compilations-within-max/203793 "2019-10-16T12:50:58Z")
I know there are some posts about this but they didn't completely awnser my question. I'm processing millions of data in terms of documents which need to be updated by a "where query" using two fields. The data in the q… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1836) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1838)