# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=749 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 750 --- ## [Elastic Inconsistent log rotation(log4j2)](https://discuss.elastic.co/t/elastic-inconsistent-log-rotation-log4j2/292459)
**Author:** [@anandd4](https://discuss.elastic.co/u/anandd4)\ **Replies:** 0\ **Last updated:** [December 20, 2021, 11:55am UTC](https://discuss.elastic.co/t/elastic-inconsistent-log-rotation-log4j2/292459 "2021-12-20T11:55:36Z")
Problem Statement - Elastic log rotation(rolling.old & rolling) is inconsistent and displays random behavior across different nodes. We have noticed 3 main issues - log rotation doesn't happen daily as configured via … --- ## [Kibana timestamp shows incorrect time](https://discuss.elastic.co/t/kibana-timestamp-shows-incorrect-time/292193)
**Author:** [@peterreji94](https://discuss.elastic.co/u/peterreji94)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 10:58am UTC](https://discuss.elastic.co/t/kibana-timestamp-shows-incorrect-time/292193 "2021-12-20T10:58:19Z")
The kibana is not showing the actual time of log. It's delayed by a few milliseconds (at least 500ms) when compared to the actual timestamp of the log on the server. One of the discussions mentioned the use of @logtimest… --- ## [Query index patterns using ES nodejs client lib](https://discuss.elastic.co/t/query-index-patterns-using-es-nodejs-client-lib/292282)
**Author:** [@hamzahda](https://discuss.elastic.co/u/hamzahda)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 10:54am UTC](https://discuss.elastic.co/t/query-index-patterns-using-es-nodejs-client-lib/292282 "2021-12-20T10:54:13Z")
Hi, I wanted to know know if it's also possible to do this query GET \:\/api/index\_patterns/index\_pattern/\ in a script using the es client lib and thanks --- ## [Logstash CSV Timestamp extract](https://discuss.elastic.co/t/logstash-csv-timestamp-extract/292188)
**Author:** [@Robsen\_Inc](https://discuss.elastic.co/u/Robsen_Inc)\ **Replies:** 5\ **Last updated:** [December 20, 2021, 9:38am UTC](https://discuss.elastic.co/t/logstash-csv-timestamp-extract/292188 "2021-12-20T09:38:42Z")
Hello everyone, I have a problem with my log data. After hours of try-and-error I am now looking for help from you. An exemplary line looks like this: 09/04/2021 11:30:53 0 0 0 0 0 0 0 0 false false false false false … --- ## [Need help to evaluate Logstash for syncing Oracle data into Elasticsearch (combining multiple 25+ table records into single nested document)](https://discuss.elastic.co/t/need-help-to-evaluate-logstash-for-syncing-oracle-data-into-elasticsearch-combining-multiple-25-table-records-into-single-nested-document/292430)
**Author:** [@Tejas\_Damle](https://discuss.elastic.co/u/Tejas_Damle)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 9:38am UTC](https://discuss.elastic.co/t/need-help-to-evaluate-logstash-for-syncing-oracle-data-into-elasticsearch-combining-multiple-25-table-records-into-single-nested-document/292430 "2021-12-20T09:38:25Z")
Requirement: We are planning to use Logstash to sync data from Oracle to Elasticsearch. There are around 25+ tables in Oracle. Plan is to to have single index in Elasticsearch with nested/flattened documents which will… --- ## [Logstash настроить фильтр по шаблону](https://discuss.elastic.co/t/logstash/292414)
**Author:** [@cva](https://discuss.elastic.co/u/cva)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 6:11am UTC](https://discuss.elastic.co/t/logstash/292414 "2021-12-20T06:11:15Z")
Подскажите пожалуйста как в logstash настроить фильтр таким образом, чтобы он по шаблону извлекал из пути лога имя файла и вставлял его в новое поле или как другой вариант убирал путь оставляя только имя файла? Например: … --- ## [Help me! Search kanji and hikarana (kuromoji and Fuzziness)](https://discuss.elastic.co/t/help-me-search-kanji-and-hikarana-kuromoji-and-fuzziness/292272)
**Author:** [@mai\_quoc\_son](https://discuss.elastic.co/u/mai_quoc_son)\ **Replies:** 2\ **Last updated:** [December 20, 2021, 6:05am UTC](https://discuss.elastic.co/t/help-me-search-kanji-and-hikarana-kuromoji-and-fuzziness/292272 "2021-12-20T06:05:50Z")
I setting Index : mapping : Data : Create Index: Query search : Result : Please help me , i want result 3 row by query. Thanks I read info and demo in --- ## [How can we delete an index based on a scheduler using JAVA API's?](https://discuss.elastic.co/t/how-can-we-delete-an-index-based-on-a-scheduler-using-java-apis/292396)
**Author:** [@yash\_196](https://discuss.elastic.co/u/yash_196)\ **Replies:** 4\ **Last updated:** [December 20, 2021, 5:54am UTC](https://discuss.elastic.co/t/how-can-we-delete-an-index-based-on-a-scheduler-using-java-apis/292396 "2021-12-20T05:54:17Z")
Can anyone help me with a java code that can delete index based on a schedule? --- ## [Shard Siem cause cluster red](https://discuss.elastic.co/t/shard-siem-cause-cluster-red/292107)
**Author:** [@labate](https://discuss.elastic.co/u/labate)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 1:17am UTC](https://discuss.elastic.co/t/shard-siem-cause-cluster-red/292107 "2021-12-20T01:17:36Z")
Hello everyone, I have a problem with my .siem-signals-default index. The shard goes to red status and I can't reallocate the shard to another node. Because the shard seems to not be in my cluster and I can't get it bac… --- ## [Elasti search reindexing indexes only few 1000 or more documents but not to the original count of orginal index](https://discuss.elastic.co/t/elasti-search-reindexing-indexes-only-few-1000-or-more-documents-but-not-to-the-original-count-of-orginal-index/292044)
**Author:** [@Darshan\_R](https://discuss.elastic.co/u/Darshan_R)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 1:12am UTC](https://discuss.elastic.co/t/elasti-search-reindexing-indexes-only-few-1000-or-more-documents-but-not-to-the-original-count-of-orginal-index/292044 "2021-12-20T01:12:40Z")
Elasti csearch reindexing indexes only few 1000 or more documents but not to the original count of orginal index I am using using AWS step functions with lambda to run reindexing for all 33 index paralley out of 33 onl… --- ## [Adds a new field inside in the existing index](https://discuss.elastic.co/t/adds-a-new-field-inside-in-the-existing-index/292030)
**Author:** [@rav3n](https://discuss.elastic.co/u/rav3n)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 1:12am UTC](https://discuss.elastic.co/t/adds-a-new-field-inside-in-the-existing-index/292030 "2021-12-20T01:12:16Z")
Hey there, I'm trying to add a new field to the already existing index but every time I get this error : { "error" : { "root\_cause" : \[ { "type" : "mapper\_exception", "reason" : "the \[includ… --- ## [Manage error when indexing documents](https://discuss.elastic.co/t/manage-error-when-indexing-documents/292168)
**Author:** [@GinkoLucas](https://discuss.elastic.co/u/GinkoLucas)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 1:04am UTC](https://discuss.elastic.co/t/manage-error-when-indexing-documents/292168 "2021-12-20T01:04:46Z")
Hello, I want to know when a document is dismiss by Elasticsearch in case the mapping is configured with "dynamic : strict". So, when i send a document who got an "unknow fields" in the mapping, Elasticsearch will dism… --- ## [Calculate sum of run\_time without runtime fields?](https://discuss.elastic.co/t/calculate-sum-of-run-time-without-runtime-fields/292267)
**Author:** [@afkbrb](https://discuss.elastic.co/u/afkbrb)\ **Replies:** 0\ **Last updated:** [December 17, 2021, 6:56am UTC](https://discuss.elastic.co/t/calculate-sum-of-run-time-without-runtime-fields/292267 "2021-12-17T06:56:28Z")
I want to get the sum of run\_time variant, by using runtime\_mapping I got mistakes. I know that it'a new feature in ES 7.12, but I can't upgrade it because it's not depend on me. So how could I get the answer without … --- ## [Setup elastic-apm-agent for kafka](https://discuss.elastic.co/t/setup-elastic-apm-agent-for-kafka/291674)
**Author:** [@ChristianOelsner](https://discuss.elastic.co/u/ChristianOelsner)\ **Replies:** 2\ **Last updated:** [December 19, 2021, 11:01pm UTC](https://discuss.elastic.co/t/setup-elastic-apm-agent-for-kafka/291674 "2021-12-19T23:01:59Z")
Hey guys, I am playing around with elastic-apm-agent. The goal is to monitor kafka. I am using the agent config given to me in Kibana: java -javaagent:/root/kafka/elastic-apm-agent-1.28.1.jar \\ -Delastic.apm.service\_n… --- ## [How to add "index.mapping.total\_fields.limit" in command prompt](https://discuss.elastic.co/t/how-to-add-index-mapping-total-fields-limit-in-command-prompt/292415)
**Author:** [@Suparna\_Shankar](https://discuss.elastic.co/u/Suparna_Shankar)\ **Replies:** 1\ **Last updated:** [December 19, 2021, 8:51pm UTC](https://discuss.elastic.co/t/how-to-add-index-mapping-total-fields-limit-in-command-prompt/292415 "2021-12-19T20:51:29Z")
HI, am trying to add "index.mapping.total\_fields.limit" to 2000 using cmdline but getting below exception "curl -XPUT http://127.0.0.1:9200/log4j-2021.12.19/\_settings -H 'Content-Type: application/json' -d '{ "index.map… --- ## [Grok to multiline ingestion does not handle rows](https://discuss.elastic.co/t/grok-to-multiline-ingestion-does-not-handle-rows/292412)
**Author:** [@tjswe](https://discuss.elastic.co/u/tjswe)\ **Replies:** 2\ **Last updated:** [December 19, 2021, 8:17pm UTC](https://discuss.elastic.co/t/grok-to-multiline-ingestion-does-not-handle-rows/292412 "2021-12-19T20:17:56Z")
Hi! Im ingesting .txt-files containing navtex-messages (see example below). Each message comes in a separate .txt-file appearing continuously over 24h landning in a sub-directory with the current date. input { file… --- ## [Is elasticsearch verison 7.16.2 released?](https://discuss.elastic.co/t/is-elasticsearch-verison-7-16-2-released/292390)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 1\ **Last updated:** [December 19, 2021, 2:14pm UTC](https://discuss.elastic.co/t/is-elasticsearch-verison-7-16-2-released/292390 "2021-12-19T14:14:41Z")
is version 7.16.2 released? release notes have information about version 7.16.2 but unable to find the version for download --- ## [Logstash filter CSV inside email content](https://discuss.elastic.co/t/logstash-filter-csv-inside-email-content/292244)
**Author:** [@pcpdoc02](https://discuss.elastic.co/u/pcpdoc02)\ **Replies:** 2\ **Last updated:** [December 19, 2021, 8:08am UTC](https://discuss.elastic.co/t/logstash-filter-csv-inside-email-content/292244 "2021-12-19T08:08:13Z")
I would like to use Logstash to stream CSV data in email to Elasticsearch. IMAP and CSV filter seems suitable to extract email content and parse the CSV contents respectively. How can I use both filter together to output… --- ## [Dec 19th, 2021: \[en\] Explore field level data in-depth in Discover](https://discuss.elastic.co/t/dec-19th-2021-en-explore-field-level-data-in-depth-in-discover/290507)
**Author:** [@Quynh\_Nguyen](https://discuss.elastic.co/u/Quynh_Nguyen)\ **Replies:** 0\ **Last updated:** [December 19, 2021, 8:00am UTC](https://discuss.elastic.co/t/dec-19th-2021-en-explore-field-level-data-in-depth-in-discover/290507 "2021-12-19T08:00:44Z")
Exploring and understanding your data with Kibana Discover is an important first step to taking insightful, relevant actions. The Data Visualizer inside the Machine Learning app enables you to analyze the shape of the fi… --- ## [How to make Dev tools request automatic using the Pipeline?](https://discuss.elastic.co/t/how-to-make-dev-tools-request-automatic-using-the-pipeline/292377)
**Author:** [@Angad\_Panesar1](https://discuss.elastic.co/u/Angad_Panesar1)\ **Replies:** 1\ **Last updated:** [December 18, 2021, 6:14pm UTC](https://discuss.elastic.co/t/how-to-make-dev-tools-request-automatic-using-the-pipeline/292377 "2021-12-18T18:14:39Z")
Hi, I tried to create an ingest pipeline to run every time new data is ingested but unfortunately it still does not work. Here is what I have done: The create pipeline method: PUT \_ingest/pipeline/set\_place { "descri… --- ## [No results when searching by a null value](https://discuss.elastic.co/t/no-results-when-searching-by-a-null-value/292385)
**Author:** [@AlexBulls20](https://discuss.elastic.co/u/AlexBulls20)\ **Replies:** 1\ **Last updated:** [December 18, 2021, 3:23pm UTC](https://discuss.elastic.co/t/no-results-when-searching-by-a-null-value/292385 "2021-12-18T15:23:15Z")
I'm trying to fill some value for an autocomplete search box and I had this old code (from Elasticsearch 1.5) and I want to implement it into Elasticsearch 7.16 When I use this sentence curl -H 'Content-Type: applicati… --- ## [Issector mapping, pattern not found error in Logstash](https://discuss.elastic.co/t/issector-mapping-pattern-not-found-error-in-logstash/292226)
**Author:** [@arunpmohan](https://discuss.elastic.co/u/arunpmohan)\ **Replies:** 2\ **Last updated:** [December 18, 2021, 1:45am UTC](https://discuss.elastic.co/t/issector-mapping-pattern-not-found-error-in-logstash/292226 "2021-12-18T01:45:07Z")
I have an log message which I split using grok and then use an if conditional to parse a field using dissect filter. But it is giving me Dissector mapping, pattern not found error. I tried the dissect pattern with http… --- ## [Is index\_prefixes intended to be used with text fields only?](https://discuss.elastic.co/t/is-index-prefixes-intended-to-be-used-with-text-fields-only/292366)
**Author:** [@mp3000](https://discuss.elastic.co/u/mp3000)\ **Replies:** 0\ **Last updated:** [December 17, 2021, 11:07pm UTC](https://discuss.elastic.co/t/is-index-prefixes-intended-to-be-used-with-text-fields-only/292366 "2021-12-17T23:07:31Z")
Hello, It seems index\_prefixes mapping parameter is only available for text fields but it is not really obvious in the doc. Why this parameter is not available for keyword fields ? Is it because the performance on sma… --- ## [Can elasticsearch incorrectly show search threadpool rejected count](https://discuss.elastic.co/t/can-elasticsearch-incorrectly-show-search-threadpool-rejected-count/291343)
**Author:** [@taugusti](https://discuss.elastic.co/u/taugusti)\ **Replies:** 1\ **Last updated:** [December 17, 2021, 7:04pm UTC](https://discuss.elastic.co/t/can-elasticsearch-incorrectly-show-search-threadpool-rejected-count/291343 "2021-12-17T19:04:39Z")
I have been load testing my elastic cluster by sending a large number of search requests. I see a lot of "rejected" when I do GET /\_cat/thread\_pool/search in kibana. However, I see that all the queries got successful re… --- ## [Tried "mutate" convert", logstash getting error from elasticsearch: "type \[float\] to \[long\]"](https://discuss.elastic.co/t/tried-mutate-convert-logstash-getting-error-from-elasticsearch-type-float-to-long/292356)
**Author:** [@4art4](https://discuss.elastic.co/u/4art4)\ **Replies:** 2\ **Last updated:** [December 17, 2021, 6:25pm UTC](https://discuss.elastic.co/t/tried-mutate-convert-logstash-getting-error-from-elasticsearch-type-float-to-long/292356 "2021-12-17T18:25:32Z")
My expectation is that adding the 'convert' would insure that all data for that field will be of type "float", but I guess I did it wrong? relevant part of data: "metrics"=\>\[ { "Unit"=\>"Count", "MetricName"=\>"Res… --- ## [Kibana - Affichage d'un champ message (string) dans un dashboard](https://discuss.elastic.co/t/kibana-affichage-dun-champ-message-string-dans-un-dashboard/292348)
**Author:** [@Phildefer](https://discuss.elastic.co/u/Phildefer)\ **Replies:** 2\ **Last updated:** [December 17, 2021, 5:59pm UTC](https://discuss.elastic.co/t/kibana-affichage-dun-champ-message-string-dans-un-dashboard/292348 "2021-12-17T17:59:29Z")
Bonjour je souhaite afficher dans un dashboard de manière simple les messages reçus des plugins RSS et Twitter de logstash qui ont été indexés. Je ne trouve aucune manière de le faire dans les éléments qui peuvent const… --- ## [Not able to read indices](https://discuss.elastic.co/t/not-able-to-read-indices/292302)
**Author:** [@AnkitaPujare](https://discuss.elastic.co/u/AnkitaPujare)\ **Replies:** 1\ **Last updated:** [December 17, 2021, 5:58pm UTC](https://discuss.elastic.co/t/not-able-to-read-indices/292302 "2021-12-17T17:58:36Z")
Dear Team, I have ELK stack installed (ELK version-7.8.0) on one Linux server(say host1). Due to high severity vulnerability of apache log4j2, I have tried to install updated ELK stack (ELK version-7.16.1) on new server… --- ## [Why does elasticsearch return inconsistent result on version 7.8.1 and return correct result on 5.6.7 for the same match\_phrase\_prefix query? How can i get consistent result on elasticsearch 7.8.1?](https://discuss.elastic.co/t/why-does-elasticsearch-return-inconsistent-result-on-version-7-8-1-and-return-correct-result-on-5-6-7-for-the-same-match-phrase-prefix-query-how-can-i-get-consistent-result-on-elasticsearch-7-8-1/290722)
**Author:** [@animesh\_dhokare](https://discuss.elastic.co/u/animesh_dhokare)\ **Replies:** 7\ **Last updated:** [December 17, 2021, 1:02pm UTC](https://discuss.elastic.co/t/why-does-elasticsearch-return-inconsistent-result-on-version-7-8-1-and-return-correct-result-on-5-6-7-for-the-same-match-phrase-prefix-query-how-can-i-get-consistent-result-on-elasticsearch-7-8-1/290722 "2021-12-17T13:02:11Z")
Hi there, I have observed inconsistency in the result for the below match\_phrase\_prefix query on elasticsearch 7.8.1. QUERY: { "sort": \[{ "created": { "order": "desc" } … --- ## [Logstash fails to parse valid json, I need a "split" but I get "Only String and Array types are splittable."](https://discuss.elastic.co/t/logstash-fails-to-parse-valid-json-i-need-a-split-but-i-get-only-string-and-array-types-are-splittable/292228)
**Author:** [@4art4](https://discuss.elastic.co/u/4art4)\ **Replies:** 4\ **Last updated:** [December 17, 2021, 5:19pm UTC](https://discuss.elastic.co/t/logstash-fails-to-parse-valid-json-i-need-a-split-but-i-get-only-string-and-array-types-are-splittable/292228 "2021-12-17T17:19:37Z")
The logfile I need to ingest: { "policy": { "name": "account-cloudtrail-enabled", "resource": "account", "description": "Checks to make sure CloudTrail is enabled on the account\\nfor all regions.\\n", "… --- ## [Logstash using multiline for big log file](https://discuss.elastic.co/t/logstash-using-multiline-for-big-log-file/292150)
**Author:** [@pan1](https://discuss.elastic.co/u/pan1)\ **Replies:** 3\ **Last updated:** [December 17, 2021, 5:18pm UTC](https://discuss.elastic.co/t/logstash-using-multiline-for-big-log-file/292150 "2021-12-17T17:18:50Z")
Hello everyone, I have to handle big log-files (arround 50k lines) using ELK and want to extract some information out of it. A long story short, I want to use filter for searching for specific informations, store thos… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=748) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=750)