# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=687 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 688 --- ## [Unbalanced shards](https://discuss.elastic.co/t/unbalanced-shards/298520)
**Author:** [@Sashi](https://discuss.elastic.co/u/Sashi)\ **Replies:** 6\ **Last updated:** [March 7, 2022, 2:17pm UTC](https://discuss.elastic.co/t/unbalanced-shards/298520 "2022-03-07T14:17:40Z")
Hello, I have a cluster of over 25 nodes and the indices are balanced on all the nodes except for one node. Let's call the node as problematic node. The problematic node has less indices and shards when compared to othe… --- ## [How to pass variable base parameter in http\_poller logstash input plugin](https://discuss.elastic.co/t/how-to-pass-variable-base-parameter-in-http-poller-logstash-input-plugin/298621)
**Author:** [@Purushottam22](https://discuss.elastic.co/u/Purushottam22)\ **Replies:** 1\ **Last updated:** [March 2, 2022, 8:16pm UTC](https://discuss.elastic.co/t/how-to-pass-variable-base-parameter-in-http-poller-logstash-input-plugin/298621 "2022-03-02T20:16:41Z")
Hi All, Can you please help me with below issue, I am trying to hit two rest api for below two conditions: First is used for providing the login credentials and it will give an response as session id. I have to use t… --- ## [Flush syncing on rotated indicies](https://discuss.elastic.co/t/flush-syncing-on-rotated-indicies/298911)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 4\ **Last updated:** [March 7, 2022, 11:30am UTC](https://discuss.elastic.co/t/flush-syncing-on-rotated-indicies/298911 "2022-03-07T11:30:48Z")
Thinking about running an operation procedure that should do flushed sync on daily 'rotated' indices and wondering... Would this be a feasible and good idea and what to avoid? If we after midnight do synced flush per i… --- ## [Two DC cluster setup](https://discuss.elastic.co/t/two-dc-cluster-setup/298912)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 2\ **Last updated:** [March 7, 2022, 11:29am UTC](https://discuss.elastic.co/t/two-dc-cluster-setup/298912 "2022-03-07T11:29:34Z")
Have startedin a new position where we currently have a two Data Center cluster with 5 master/data nodes + 1 master-only node and indices having replication of 1. Wondering if we better ought to do few (+3) dedicated ma… --- ## [Elasticsearch-dsl python connection timeout](https://discuss.elastic.co/t/elasticsearch-dsl-python-connection-timeout/293762)
**Author:** [@maph](https://discuss.elastic.co/u/maph)\ **Replies:** 6\ **Last updated:** [March 7, 2022, 10:19am UTC](https://discuss.elastic.co/t/elasticsearch-dsl-python-connection-timeout/293762 "2022-03-07T10:19:42Z")
Hi all, Fairly new to Elasticsearch and hoping that some of you might be able to help me troubleshoot an attempt to use the python Elasticsearch-dsl to perform a search in a public database? I am able to access the dat… --- ## [Create a dashboard using two different Data stream index](https://discuss.elastic.co/t/create-a-dashboard-using-two-different-data-stream-index/298388)
**Author:** [@niveditakathal](https://discuss.elastic.co/u/niveditakathal)\ **Replies:** 3\ **Last updated:** [March 7, 2022, 9:57am UTC](https://discuss.elastic.co/t/create-a-dashboard-using-two-different-data-stream-index/298388 "2022-03-07T09:57:48Z")
Hi Experts, I want to create a dashboard using two different Data stream index {as mentioned below under notes}. when I checked the available options to do so , I read about \_aliases option; however in my use-case that … --- ## [Logstash Performance](https://discuss.elastic.co/t/logstash-performance/298942)
**Author:** [@mani1](https://discuss.elastic.co/u/mani1)\ **Replies:** 0\ **Last updated:** [March 7, 2022, 8:46am UTC](https://discuss.elastic.co/t/logstash-performance/298942 "2022-03-07T08:46:41Z")
Hello , We have maximize the Logstash performance in terms of processed events per sec, by tuning vcpus, Heap, pipeline workers, Consumer Threads, N/w bandwidth, Batch size etc. There is no scarcity of resources assigne… --- ## [Elasticsearch automatic reindex](https://discuss.elastic.co/t/elasticsearch-automatic-reindex/298847)
**Author:** [@bianca6](https://discuss.elastic.co/u/bianca6)\ **Replies:** 3\ **Last updated:** [March 7, 2022, 8:25am UTC](https://discuss.elastic.co/t/elasticsearch-automatic-reindex/298847 "2022-03-07T08:25:38Z")
Hello, I am using a pipeline with Filebeat / Logstash / Elasticsearch / Kibana version 8 to deal with logs. One of the field is a nano second timestamp. Long story, I can't send it as a 'date\_nanos', so, what I'm doin… --- ## [Alerts in kibana](https://discuss.elastic.co/t/alerts-in-kibana/298696)
**Author:** [@tharunkumar](https://discuss.elastic.co/u/tharunkumar)\ **Replies:** 4\ **Last updated:** [March 7, 2022, 6:19am UTC](https://discuss.elastic.co/t/alerts-in-kibana/298696 "2022-03-07T06:19:14Z")
log \[10:06:16.242\] \[error\]\[alerting\]\[alerts\]\[plugins\]\[plugins\] Executing Alert "34af2110-24f6-11ec-8071-63a4b456f636" has resulted in Error: Unable to create alerts client because the Encrypted Saved Objects plugin is … --- ## [Timepicker sync using mustache template kibana](https://discuss.elastic.co/t/timepicker-sync-using-mustache-template-kibana/298752)
**Author:** [@yangesh4u1](https://discuss.elastic.co/u/yangesh4u1)\ **Replies:** 1\ **Last updated:** [March 7, 2022, 4:40am UTC](https://discuss.elastic.co/t/timepicker-sync-using-mustache-template-kibana/298752 "2022-03-07T04:40:43Z")
Hi Team, I created a redirection link in kibana TSVB visualization using Mustache Template like below. I am wondering if Last selected timeframe in current page of Kibana can be synced if i am navigating to another… --- ## [How to use field-value-factor when mapping missing field in java?](https://discuss.elastic.co/t/how-to-use-field-value-factor-when-mapping-missing-field-in-java/298930)
**Author:** [@ifree-zm](https://discuss.elastic.co/u/ifree-zm)\ **Replies:** 1\ **Last updated:** [March 7, 2022, 2:56am UTC](https://discuss.elastic.co/t/how-to-use-field-value-factor-when-mapping-missing-field-in-java/298930 "2022-03-07T02:56:38Z")
If mapping does not have a field, field-value-factor is used; otherwise, field-value-factor is not used --- ## [False positive submit - Driver Genius](https://discuss.elastic.co/t/false-positive-submit-driver-genius/298928)
**Author:** [@Driver-Soft](https://discuss.elastic.co/u/Driver-Soft)\ **Replies:** 0\ **Last updated:** [March 7, 2022, 2:38am UTC](https://discuss.elastic.co/t/false-positive-submit-driver-genius/298928 "2022-03-07T02:38:09Z")
I followed your instruction and sent a false positive report to fp\_reports@elastic.co, but I haven't gotten a reply after a few days, please fix this false positive issue, thanks. Hello, Please fix the false positive… --- ## [Migration data from a cluster to another cluster](https://discuss.elastic.co/t/migration-data-from-a-cluster-to-another-cluster/298915)
**Author:** [@alicango](https://discuss.elastic.co/u/alicango)\ **Replies:** 6\ **Last updated:** [March 6, 2022, 11:41pm UTC](https://discuss.elastic.co/t/migration-data-from-a-cluster-to-another-cluster/298915 "2022-03-06T23:41:53Z")
Hello, dear community, Assume that I have got 2 different clusters(Cluster-A and Cluster-B). Each cluster has 3 master nodes, 2 hot nodes, 2 warm nodes, and 2 cold nodes. My goal is to migrate all data from Cluster-A t… --- ## [General question about Elasticsearch cluster](https://discuss.elastic.co/t/general-question-about-elasticsearch-cluster/298913)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 1\ **Last updated:** [March 6, 2022, 10:19pm UTC](https://discuss.elastic.co/t/general-question-about-elasticsearch-cluster/298913 "2022-03-06T22:19:02Z")
Hi, I am using ELK 8, if I have 4 servers with Logstash and one of them have also additionally Elasticsearch and Kibana... ..and if I will create Elasticsearch cluster, can each of Logstash report to local Elasticsearch… --- ## [Sample data](https://discuss.elastic.co/t/sample-data/298340)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 5\ **Last updated:** [March 6, 2022, 4:07pm UTC](https://discuss.elastic.co/t/sample-data/298340 "2022-03-06T16:07:39Z")
I have a lot sample/example/automatic data after install ELK, sometimes it is loaded again. Can I delete it somehow? or I need do it always manually :(? --- ## [Slow search in Kibana / ElasticSearch](https://discuss.elastic.co/t/slow-search-in-kibana-elasticsearch/297368)
**Author:** [@notgurev](https://discuss.elastic.co/u/notgurev)\ **Replies:** 14\ **Last updated:** [March 6, 2022, 10:44am UTC](https://discuss.elastic.co/t/slow-search-in-kibana-elasticsearch/297368 "2022-03-06T10:44:29Z")
When trying to visualize data, it takes a lot of time to get even the most recent data. I'm trying to figure out what's wrong with our setup that causes this: 3 nodes (1 hot, 2 cold) Hourly indices, 1 shard per index (… --- ## [ELK6.8 vs Search on object/array elements](https://discuss.elastic.co/t/elk6-8-vs-search-on-object-array-elements/298291)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 6\ **Last updated:** [March 6, 2022, 9:18am UTC](https://discuss.elastic.co/t/elk6-8-vs-search-on-object-array-elements/298291 "2022-03-06T09:18:39Z")
Got doc.s in a v.6.8 cluster looking like these: and are wondering how to discover/search for doc.s, which has a specific array element value. Say logContext.processingIds\[\*\]="some value" as simple string search li… --- ## [Elastic upgrade results in spikes of IOPS](https://discuss.elastic.co/t/elastic-upgrade-results-in-spikes-of-iops/298874)
**Author:** [@Idan\_Koch](https://discuss.elastic.co/u/Idan_Koch)\ **Replies:** 2\ **Last updated:** [March 6, 2022, 9:11am UTC](https://discuss.elastic.co/t/elastic-upgrade-results-in-spikes-of-iops/298874 "2022-03-06T09:11:47Z")
Hi, We recently upgraded from v6 to v7. We hold 400M documents. in the processor the upgrade we: reduced document size by half made schema strict increased number of shards from 20 to 30 in v6 we used elastic4s clie… --- ## [Getting no error but data not saved in ES](https://discuss.elastic.co/t/getting-no-error-but-data-not-saved-in-es/298905)
**Author:** [@AkAmit](https://discuss.elastic.co/u/AkAmit)\ **Replies:** 0\ **Last updated:** [March 6, 2022, 7:24am UTC](https://discuss.elastic.co/t/getting-no-error-but-data-not-saved-in-es/298905 "2022-03-06T07:24:46Z")
Using bundled JDK: /usr/share/logstash/jdk OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release. Sending Logstash logs to /var/log/log… --- ## [Logstash 8.1, Protobuf error - add\_file](https://discuss.elastic.co/t/logstash-8-1-protobuf-error-add-file/298894)
**Author:** [@pdoten](https://discuss.elastic.co/u/pdoten)\ **Replies:** 2\ **Last updated:** [March 6, 2022, 4:06am UTC](https://discuss.elastic.co/t/logstash-8-1-protobuf-error-add-file/298894 "2022-03-06T04:06:57Z")
Long time user here, love Elasticstack but cant get over this problem. Trying to create input for protobuf. Input stanza below. LS stops after throwing java exception, cant get pass this -tried to get this to work in 7.… --- ## [Rejecting mapping update to \[xxx\] as the final mapping would have more than 1 type: \[\_doc, xxx\]](https://discuss.elastic.co/t/rejecting-mapping-update-to-xxx-as-the-final-mapping-would-have-more-than-1-type-doc-xxx/298839)
**Author:** [@Ramesh\_balasubramani](https://discuss.elastic.co/u/Ramesh_balasubramani)\ **Replies:** 11\ **Last updated:** [March 5, 2022, 6:57pm UTC](https://discuss.elastic.co/t/rejecting-mapping-update-to-xxx-as-the-final-mapping-would-have-more-than-1-type-doc-xxx/298839 "2022-03-05T18:57:31Z")
I am using Elasticsearch 7.10.2 version. I need to create one index, Index name = device \_type name = device But I am not able to create getting error. POST device/device/169062 { "device\_name": "DESK… --- ## [Get documents starting at a high from](https://discuss.elastic.co/t/get-documents-starting-at-a-high-from/298714)
**Author:** [@NominaSumpta](https://discuss.elastic.co/u/NominaSumpta)\ **Replies:** 9\ **Last updated:** [March 5, 2022, 6:21pm UTC](https://discuss.elastic.co/t/get-documents-starting-at-a-high-from/298714 "2022-03-05T18:21:26Z")
Hi, I have an with ~ 1.500.000 (million) documents or so. I only want to get 1.000 results from it, but I want to start counting backwards. So, I want to retrieve documents 1.499.000 (- 1.000) through 1.500.000. I've se… --- ## [Multi\_Match Vs Query\_String\_Query?](https://discuss.elastic.co/t/multi-match-vs-query-string-query/298892)
**Author:** [@Nishikant\_Tayade](https://discuss.elastic.co/u/Nishikant_Tayade)\ **Replies:** 0\ **Last updated:** [March 5, 2022, 1:46pm UTC](https://discuss.elastic.co/t/multi-match-vs-query-string-query/298892 "2022-03-05T13:46:49Z")
I am using ES 7.10.2 I have fields with keyword and text mappings. When user specifies the search string, I wanted to parse the pieces of search string, for each specific field, in the specific way that field mapping i… --- ## [Как изменить ранжирование если слово встречается более чем 1 раз в разных полях](https://discuss.elastic.co/t/topic/298889)
**Author:** [@Igor\_Batanov](https://discuss.elastic.co/u/Igor_Batanov)\ **Replies:** 0\ **Last updated:** [March 5, 2022, 8:20am UTC](https://discuss.elastic.co/t/topic/298889 "2022-03-05T08:20:52Z")
После выполнения запроса { "query": { "simple\_query\_string": { "query": "масло моторное", "minimum\_should\_match": "90%", "default\_operator": "or" } } } Получа… --- ## [Elastic search upgrade](https://discuss.elastic.co/t/elastic-search-upgrade/298827)
**Author:** [@aman123](https://discuss.elastic.co/u/aman123)\ **Replies:** 4\ **Last updated:** [March 5, 2022, 8:27am UTC](https://discuss.elastic.co/t/elastic-search-upgrade/298827 "2022-03-05T08:27:14Z")
Hi All, I'm upgrading the Elasticsearch cluster, currently I have 10 node clusters running on individual instances , All nodes are having older version, if I upgrade one by one all nodes starting from data node to maste… --- ## [White Papers on Using Elastic for Unstructured Data Queries on ZFS Filesystem](https://discuss.elastic.co/t/white-papers-on-using-elastic-for-unstructured-data-queries-on-zfs-filesystem/298877)
**Author:** [@minorsatellite](https://discuss.elastic.co/u/minorsatellite)\ **Replies:** 4\ **Last updated:** [March 5, 2022, 4:36am UTC](https://discuss.elastic.co/t/white-papers-on-using-elastic-for-unstructured-data-queries-on-zfs-filesystem/298877 "2022-03-05T04:36:32Z")
Im new to Elastic. Im wondering if anyone has successfully used Elastic alongside a ZFS Dataset in order to perform filesystem searches, and if so, what might that look like, and would it a user-friendly solution for non… --- ## [Reattaching Cold Data](https://discuss.elastic.co/t/reattaching-cold-data/298785)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 7\ **Last updated:** [March 5, 2022, 4:19am UTC](https://discuss.elastic.co/t/reattaching-cold-data/298785 "2022-03-05T04:19:29Z")
If you were to have cold data on removable hard disks (for long-term offline storage), what is the best way to re-attach one of these disks to the cold data node without causing trouble? For example, I was wondering if t… --- ## [Logstash Date parsing error](https://discuss.elastic.co/t/logstash-date-parsing-error/298780)
**Author:** [@userR](https://discuss.elastic.co/u/userR)\ **Replies:** 11\ **Last updated:** [March 4, 2022, 10:11pm UTC](https://discuss.elastic.co/t/logstash-date-parsing-error/298780 "2022-03-04T22:11:27Z")
Hi! I am trying to parse the following date format: 2022-03-03 10:45:02,520 My current configuration for logstash to parse is: grok { match =\> \[ "message", "%{TIMESTAMP\_ISO8601:logdate}....." \] } d… --- ## [Multi-field mapping/search "highlighting" difference between 7.10.2 and 7.16.3?](https://discuss.elastic.co/t/multi-field-mapping-search-highlighting-difference-between-7-10-2-and-7-16-3/298739)
**Author:** [@mrodent](https://discuss.elastic.co/u/mrodent)\ **Replies:** 1\ **Last updated:** [March 4, 2022, 6:28pm UTC](https://discuss.elastic.co/t/multi-field-mapping-search-highlighting-difference-between-7-10-2-and-7-16-3/298739 "2022-03-04T18:28:15Z")
The following mapping and query DSL dict work OK when the version of ES is 7.10.2, but they never work where the version of ES is 7.16.3: mappings = \\ { "mappings": { "properties": … --- ## [Design practice to prevent oversharding](https://discuss.elastic.co/t/design-practice-to-prevent-oversharding/298759)
**Author:** [@cyril.r](https://discuss.elastic.co/u/cyril.r)\ **Replies:** 8\ **Last updated:** [March 4, 2022, 4:57pm UTC](https://discuss.elastic.co/t/design-practice-to-prevent-oversharding/298759 "2022-03-04T16:57:03Z")
Hi there, I'm strugling with an application design and the impact that it has on the cluster. Let me explain the use case: My customers can create databases inside my application to store and retrieve data. Every tim… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=686) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=688)