# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=761 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 762 --- ## [Search\_after performance compared to querying with \_search](https://discuss.elastic.co/t/search-after-performance-compared-to-querying-with-search/291080)
**Author:** [@Praveen\_Balaji](https://discuss.elastic.co/u/Praveen_Balaji)\ **Replies:** 0\ **Last updated:** [December 6, 2021, 8:24pm UTC](https://discuss.elastic.co/t/search-after-performance-compared-to-querying-with-search/291080 "2021-12-06T20:24:39Z")
Our code switches over to search\_after past a threshold (10\_000). I'm considering switching to using search\_after always, irrespective of the size. Is there a loss in performance between plain search and search\_after? P… --- ## [Error on index template creation: "composable template \[...\] template after composition is invalid"](https://discuss.elastic.co/t/error-on-index-template-creation-composable-template-template-after-composition-is-invalid/291076)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 1\ **Last updated:** [December 6, 2021, 8:07pm UTC](https://discuss.elastic.co/t/error-on-index-template-creation-composable-template-template-after-composition-is-invalid/291076 "2021-12-06T20:07:57Z")
Subject really says it all. version 7.14 The cluster is new and has just one node for testing and this is the first datastream I have tried to create. One thing that is puzzling me is what does it mean by "composable … --- ## [Syslog filter issue with timestamp](https://discuss.elastic.co/t/syslog-filter-issue-with-timestamp/290468)
**Author:** [@mylvestre](https://discuss.elastic.co/u/mylvestre)\ **Replies:** 12\ **Last updated:** [December 6, 2021, 6:54pm UTC](https://discuss.elastic.co/t/syslog-filter-issue-with-timestamp/290468 "2021-12-06T18:54:22Z")
Greetings, I'm having an issue where my syslog is parsing the wrong date format. I get the following in Elastic: yyyy-11-Mo 11:37:17, while I get the following error in logstash: \[2021-11-29T11:34:43,644\]\[WARN \]\[logsta… --- ## [Filter basic file with Logstash](https://discuss.elastic.co/t/filter-basic-file-with-logstash/290991)
**Author:** [@algira37](https://discuss.elastic.co/u/algira37)\ **Replies:** 3\ **Last updated:** [December 6, 2021, 6:21pm UTC](https://discuss.elastic.co/t/filter-basic-file-with-logstash/290991 "2021-12-06T18:21:16Z")
Hello, I have a blocklist.txt which contains IP address in the following structure: 192.168.100.77 192.168.100.66 How can I create JSON with Logstash with a similar output: { IP: 192.168.100.77, IP: 192.168.100.66 … --- ## [Day of the week with non UTC timestamps](https://discuss.elastic.co/t/day-of-the-week-with-non-utc-timestamps/291066)
**Author:** [@Malec](https://discuss.elastic.co/u/Malec)\ **Replies:** 1\ **Last updated:** [December 6, 2021, 5:51pm UTC](https://discuss.elastic.co/t/day-of-the-week-with-non-utc-timestamps/291066 "2021-12-06T17:51:46Z")
Hi everyone, I have logs in a dd/MM/YYYY HH:mm:ss format using the CET timezone, and I am trying to extract the Day of the week for CET and not UTC. We used this at first date { match =\> \[ "date", "dd/MM/YYYY HH:mm:… --- ## [How to set network.host to listen to IPv6 as well?](https://discuss.elastic.co/t/how-to-set-network-host-to-listen-to-ipv6-as-well/290923)
**Author:** [@houmie](https://discuss.elastic.co/u/houmie)\ **Replies:** 3\ **Last updated:** [December 6, 2021, 3:59pm UTC](https://discuss.elastic.co/t/how-to-set-network-host-to-listen-to-ipv6-as-well/290923 "2021-12-06T15:59:53Z")
Hello, After struggling for hours why Filebeat can't connect to ES, I realised that this setting in elasticsearch.yaml is the culprit. It is only listening to IPv4 and not IPv6. network.host: 0.0.0.0 I tried many d… --- ## [How to know which GeoPoint is hit while sorting on GeoPoint field containing multiple points](https://discuss.elastic.co/t/how-to-know-which-geopoint-is-hit-while-sorting-on-geopoint-field-containing-multiple-points/291052)
**Author:** [@Asif\_Mahmood](https://discuss.elastic.co/u/Asif_Mahmood)\ **Replies:** 0\ **Last updated:** [December 6, 2021, 2:08pm UTC](https://discuss.elastic.co/t/how-to-know-which-geopoint-is-hit-while-sorting-on-geopoint-field-containing-multiple-points/291052 "2021-12-06T14:08:14Z")
HI, I am new at using Elasticsearch. I have an index which has the GeoPoint field "Location" and each document can contains multiple points which are stored in GeoPoint field as array. Now, when I sort on the basis of t… --- ## [Map keyword values for display](https://discuss.elastic.co/t/map-keyword-values-for-display/291042)
**Author:** [@Senor\_K2n](https://discuss.elastic.co/u/Senor_K2n)\ **Replies:** 2\ **Last updated:** [December 6, 2021, 1:54pm UTC](https://discuss.elastic.co/t/map-keyword-values-for-display/291042 "2021-12-06T13:54:31Z")
Hi, I'm relatively new to working with ELK, and I haven't found a response to this question yet. For storage optimization reasons, I want to use some aliases in my input files to store fixed values. However I would li… --- ## [Prometheus queries fail if a source only snapshot was restored](https://discuss.elastic.co/t/prometheus-queries-fail-if-a-source-only-snapshot-was-restored/291046)
**Author:** [@str8y](https://discuss.elastic.co/u/str8y)\ **Replies:** 0\ **Last updated:** [December 6, 2021, 1:30pm UTC](https://discuss.elastic.co/t/prometheus-queries-fail-if-a-source-only-snapshot-was-restored/291046 "2021-12-06T13:30:00Z")
As part of our backup strategy, we are using source only repos and snapshots. As soon as such a snapshot is restored, the prometheus queries fail. Is there any chance to filter / skip these indices for the metrics? \[2… --- ## [Error: a container name must be specified for pod elk-monitoring-es-hot-0](https://discuss.elastic.co/t/error-a-container-name-must-be-specified-for-pod-elk-monitoring-es-hot-0/291038)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 4\ **Last updated:** [December 6, 2021, 1:13pm UTC](https://discuss.elastic.co/t/error-a-container-name-must-be-specified-for-pod-elk-monitoring-es-hot-0/291038 "2021-12-06T13:13:29Z")
Hi, On GCP Autopilot Cluster(v1.21.5) I have deployed via ECK(1.8) Elasticserach server using this config .yaml metadata: name: elk-monitoring namespace: xx spec: monitoring: metrics: elasticsearchRefs:… --- ## [Logstash output plugin for azure eventhub](https://discuss.elastic.co/t/logstash-output-plugin-for-azure-eventhub/291035)
**Author:** [@Mye1988](https://discuss.elastic.co/u/Mye1988)\ **Replies:** 0\ **Last updated:** [December 6, 2021, 11:59am UTC](https://discuss.elastic.co/t/logstash-output-plugin-for-azure-eventhub/291035 "2021-12-06T11:59:12Z")
Hello Everyone, I need to use logstash for sending data to Azure Event Hub.As much as I found, there is only an input plugin for reading data from Azure Hub. Is there a logstash output plugin for sending data to Azure … --- ## [Api/index\_patterns/\_fields\_for\_wildcard crashes Elasticsearch](https://discuss.elastic.co/t/api-index-patterns-fields-for-wildcard-crashes-elasticsearch/290908)
**Author:** [@rilcy](https://discuss.elastic.co/u/rilcy)\ **Replies:** 4\ **Last updated:** [December 6, 2021, 11:34am UTC](https://discuss.elastic.co/t/api-index-patterns-fields-for-wildcard-crashes-elasticsearch/290908 "2021-12-06T11:34:13Z")
Hi everyone, Could not find any post relating the problem i encounter so i here it is: Since a while i am unable to use Discover tab in Kibana ; when i try to, it basically crashes the Elasticsearch coordinating node w… --- ## [Queries for shard allocation failure](https://discuss.elastic.co/t/queries-for-shard-allocation-failure/291022)
**Author:** [@pratiksha](https://discuss.elastic.co/u/pratiksha)\ **Replies:** 4\ **Last updated:** [December 6, 2021, 10:27am UTC](https://discuss.elastic.co/t/queries-for-shard-allocation-failure/291022 "2021-12-06T10:27:24Z")
I am using Elasticsearch v7.10.2. I have cluster running with many unassigned shards. I want to determine the number of retries that has already finished for the shards. Is there any way to check that as in how many retr… --- ## [How to remove fields with - values in logstash filter?](https://discuss.elastic.co/t/how-to-remove-fields-with-values-in-logstash-filter/290879)
**Author:** [@Anusha\_Kusanghi](https://discuss.elastic.co/u/Anusha_Kusanghi)\ **Replies:** 4\ **Last updated:** [December 6, 2021, 9:58am UTC](https://discuss.elastic.co/t/how-to-remove-fields-with-values-in-logstash-filter/290879 "2021-12-06T09:58:35Z")
I have a patterns like : 2021-10-15 20:00:13 2396 tstur1 /ftp/workspace/ this is message 2020-10-15 18:00:13 - - this is the second message The fields are Date, Time, SessionId, path and message. The grok pattern use… --- ## [Try to Parsing Postfix Log Using Logstash](https://discuss.elastic.co/t/try-to-parsing-postfix-log-using-logstash/288397)
**Author:** [@RichYaNa](https://discuss.elastic.co/u/RichYaNa)\ **Replies:** 6\ **Last updated:** [December 6, 2021, 9:48am UTC](https://discuss.elastic.co/t/try-to-parsing-postfix-log-using-logstash/288397 "2021-12-06T09:48:12Z")
Hi, I'm currently parsing postfix logs using Logstash, you can check my config file here. and here is a sample log that I will parse: Nov 4 08:51:20 mail /postfix-script\[XPIDX\]: the Postfix mail system is running: PI… --- ## [Data Analysis with Kibana (On-demand) Lab 4.1: index not available](https://discuss.elastic.co/t/data-analysis-with-kibana-on-demand-lab-4-1-index-not-available/290968)
**Author:** [@rinnes](https://discuss.elastic.co/u/rinnes)\ **Replies:** 1\ **Last updated:** [December 6, 2021, 8:17am UTC](https://discuss.elastic.co/t/data-analysis-with-kibana-on-demand-lab-4-1-index-not-available/290968 "2021-12-06T08:17:51Z")
I'm trying to create an index pattern for "apachelogs\*" logs, but it does not match any indices. When I check Index Management, I don't see any indices whose name contains "apachelogs". Is my lab missing data? Is ther… --- ## [Dec 6th, 2021: \[en\] Using OSQuery in Elastic Stack](https://discuss.elastic.co/t/dec-6th-2021-en-using-osquery-in-elastic-stack/290456)
**Author:** [@aravindputrevu](https://discuss.elastic.co/u/aravindputrevu)\ **Replies:** 0\ **Last updated:** [December 6, 2021, 8:00am UTC](https://discuss.elastic.co/t/dec-6th-2021-en-using-osquery-in-elastic-stack/290456 "2021-12-06T08:00:42Z")
What is Osquery? Osquery is a Opensource project developed from Facebook. As the name suggests, Osquery helps in querying the Operating System resources using SQL. It exposes the underlying Operating system concepts like… --- ## [States condition to be allowed to write into index](https://discuss.elastic.co/t/states-condition-to-be-allowed-to-write-into-index/290891)
**Author:** [@sebastienf](https://discuss.elastic.co/u/sebastienf)\ **Replies:** 2\ **Last updated:** [December 6, 2021, 7:25am UTC](https://discuss.elastic.co/t/states-condition-to-be-allowed-to-write-into-index/290891 "2021-12-06T07:25:59Z")
Hi, I want to bulk-insert into an index. This index is made of 3 shards (0, 1, 2) and 1 replica distributed over 2 nodes as follow : N1: shard 0 p shard 1 r shard 2 p N2 : shard 0 r shard 1 p shard 2 r I loose… --- ## [Error in threshold rules when using ECS](https://discuss.elastic.co/t/error-in-threshold-rules-when-using-ecs/290899)
**Author:** [@nameless](https://discuss.elastic.co/u/nameless)\ **Replies:** 2\ **Last updated:** [December 6, 2021, 7:12am UTC](https://discuss.elastic.co/t/error-in-threshold-rules-when-using-ecs/290899 "2021-12-06T07:12:33Z")
Hello The following error occurs when the rule is running. Please help me understand the reason Bulk Indexing of signals failed: Could not dynamically add mapping for field \[source.ip.keyword\]. Existing mapping for \[s… --- ## [Unable start elasticsearch](https://discuss.elastic.co/t/unable-start-elasticsearch/290940)
**Author:** [@karthick\_kn](https://discuss.elastic.co/u/karthick_kn)\ **Replies:** 4\ **Last updated:** [December 6, 2021, 5:57am UTC](https://discuss.elastic.co/t/unable-start-elasticsearch/290940 "2021-12-06T05:57:09Z")
here I attached my log sudo tail -f /var/log/elasticsearch/my-application.log \[2021-12-03T17:10:26,220\]\[INFO \]\[o.e.x.w.WatcherService \] \[node-1\] stopping watch service, reason \[shutdown initiated\] \[2021-12-03T17:10:2… --- ## [Logstash upgrade crashing (6.4.2--\> 6.8.20)](https://discuss.elastic.co/t/logstash-upgrade-crashing-6-4-2-6-8-20/290360)
**Author:** [@arunpatchaivy](https://discuss.elastic.co/u/arunpatchaivy)\ **Replies:** 1\ **Last updated:** [December 6, 2021, 5:30am UTC](https://discuss.elastic.co/t/logstash-upgrade-crashing-6-4-2-6-8-20/290360 "2021-12-06T05:30:48Z")
we are trying to upgrade logstash to new version we doing 2 step upgrade 6.4.2 --\> 6.8.2 --\> 7.15.2 we have downloaded rpm based installer and performed upgrade. Currently we are stuck at logstash version 6.8.2 . we are… --- ## [Sum of each element of array](https://discuss.elastic.co/t/sum-of-each-element-of-array/291009)
**Author:** [@Dimple\_Goyal](https://discuss.elastic.co/u/Dimple_Goyal)\ **Replies:** 2\ **Last updated:** [December 6, 2021, 5:13am UTC](https://discuss.elastic.co/t/sum-of-each-element-of-array/291009 "2021-12-06T05:13:52Z")
I'm trying to use an Elasticsearch aggregation to 'merge' an array of integers based on a set of filters. I have documents that look like: { "arr": \[5, 4, 3, 2, 1\], "name": "test" } { "arr": \[4, 3, 2, 1, 0\], "na… --- ## [Spike Search is too often in elastic](https://discuss.elastic.co/t/spike-search-is-too-often-in-elastic/291007)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 8\ **Last updated:** [December 6, 2021, 5:06am UTC](https://discuss.elastic.co/t/spike-search-is-too-often-in-elastic/291007 "2021-12-06T05:06:31Z")
Hello Everobody, I just want to know, if Elasticsearch there is often a spike like this. What caused of it? can anyone explain to me? FYI: i'm newbie in elastic --- ## [Indexing of empty arrays affecting search results](https://discuss.elastic.co/t/indexing-of-empty-arrays-affecting-search-results/291006)
**Author:** [@michael-jaxsta](https://discuss.elastic.co/u/michael-jaxsta)\ **Replies:** 0\ **Last updated:** [December 6, 2021, 4:20am UTC](https://discuss.elastic.co/t/indexing-of-empty-arrays-affecting-search-results/291006 "2021-12-06T04:20:46Z")
Hi all, We are using Elasticsearch for searching content on our website which is primarily musician names. The primary search field is "name" but we also have a number of secondary index fields included in the search s… --- ## [How to create birds eye visualization in kibana?](https://discuss.elastic.co/t/how-to-create-birds-eye-visualization-in-kibana/290628)
**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\ **Replies:** 6\ **Last updated:** [December 6, 2021, 3:51am UTC](https://discuss.elastic.co/t/how-to-create-birds-eye-visualization-in-kibana/290628 "2021-12-06T03:51:35Z")
Hi Team, I want to create a similar visualization in kibana dashboard which kind of visualization should I use? I am trying to create a visualization where users could see pod distribution across the nodes. I want s… --- ## [Illegal\_argument\_exception](https://discuss.elastic.co/t/illegal-argument-exception/290743)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 1\ **Last updated:** [December 6, 2021, 2:05am UTC](https://discuss.elastic.co/t/illegal-argument-exception/290743 "2021-12-06T02:05:39Z")
Hi, I have problem with elastic error illegal\_argument\_exception because I changed field from text to number. However only new indexes have number field, old still have text field - I guess. "type": "illegal\_argument\_ex… --- ## [Specifications required](https://discuss.elastic.co/t/specifications-required/290778)
**Author:** [@Ajinkya\_Yadav](https://discuss.elastic.co/u/Ajinkya_Yadav)\ **Replies:** 1\ **Last updated:** [December 6, 2021, 2:01am UTC](https://discuss.elastic.co/t/specifications-required/290778 "2021-12-06T02:01:03Z")
Hello guys, I'm new to Elasticsearch, can anyone please tell me what are the minimum spec's for Elastic Endpoint? Thanks. --- ## [Mapping definition has unsupported parameters: \[norms : false\]](https://discuss.elastic.co/t/mapping-definition-has-unsupported-parameters-norms-false/290911)
**Author:** [@NLSVTN](https://discuss.elastic.co/u/NLSVTN)\ **Replies:** 1\ **Last updated:** [December 6, 2021, 1:50am UTC](https://discuss.elastic.co/t/mapping-definition-has-unsupported-parameters-norms-false/290911 "2021-12-06T01:50:58Z")
I am trying to disable norms in Elasticsearch 6.8 but getting the error: elasticsearch.exceptions.RequestError: TransportError(400, 'mapper\_parsing\_exception', 'Mapping definition for \[AC\] has unsupported parameters: … --- ## [Unable to remove Root Node](https://discuss.elastic.co/t/unable-to-remove-root-node/290978)
**Author:** [@salim-buet03](https://discuss.elastic.co/u/salim-buet03)\ **Replies:** 3\ **Last updated:** [December 6, 2021, 1:49am UTC](https://discuss.elastic.co/t/unable-to-remove-root-node/290978 "2021-12-06T01:49:14Z")
I have 2 nodes cluster, both are mastered enabled. node-1 cluster.name: test node.name: "node-1" node.master: true node.data: true path.data: /var/lib/elasticsearch path.logs: /var/log/elasticsearch http.port: 8200 net… --- ## [Need to apply ILM policy on existing index](https://discuss.elastic.co/t/need-to-apply-ilm-policy-on-existing-index/290984)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 1\ **Last updated:** [December 5, 2021, 11:49pm UTC](https://discuss.elastic.co/t/need-to-apply-ilm-policy-on-existing-index/290984 "2021-12-05T23:49:44Z")
Hello team, I have created one index kafka-facebook and missed to apply ILM policies. Now all data is going into S3 bucket like: partials:kafka-facebook-2021-12-04-000035 The above index has almost 500 GB of data. ca… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=760) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=762)