# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=774 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 775 --- ## [Query with wildcard do not return result if the item has data repeat more than 2 times](https://discuss.elastic.co/t/query-with-wildcard-do-not-return-result-if-the-item-has-data-repeat-more-than-2-times/289500)
**Author:** [@Tu\_Phan](https://discuss.elastic.co/u/Tu_Phan)\ **Replies:** 2\ **Last updated:** [November 19, 2021, 11:11am UTC](https://discuss.elastic.co/t/query-with-wildcard-do-not-return-result-if-the-item-has-data-repeat-more-than-2-times/289500 "2021-11-19T11:11:46Z")
Hi Elastic team & community, I got a trouble with wildcard query do not return expected result when having items with repeated data. With the code below I expected that search query returns 2 items but it returns only … --- ## [How to parse duplicated keys with different values](https://discuss.elastic.co/t/how-to-parse-duplicated-keys-with-different-values/288994)
**Author:** [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Replies:** 3\ **Last updated:** [November 19, 2021, 9:33am UTC](https://discuss.elastic.co/t/how-to-parse-duplicated-keys-with-different-values/288994 "2021-11-19T09:33:14Z")
Hello! I'm trying to parse CheckPoint log which contains duplicated keys but with different values. For example ... match\_id:"555"; match\_id:"777"; ... When I use kv plugin kv { source =\> "message" field\_split =\> … --- ## [Elasticsearch files in tmp folder: how to change there location](https://discuss.elastic.co/t/elasticsearch-files-in-tmp-folder-how-to-change-there-location/289543)
**Author:** [@1ac727ff300829bca0fa](https://discuss.elastic.co/u/1ac727ff300829bca0fa)\ **Replies:** 4\ **Last updated:** [November 19, 2021, 7:02am UTC](https://discuss.elastic.co/t/elasticsearch-files-in-tmp-folder-how-to-change-there-location/289543 "2021-11-19T07:02:16Z")
Hello guys, I have set up elk in linx server using tar, but my tmp directory gets filled with files in following formates /tmp/elasticsearch-17741669071348173933 How to change there location? --- ## [Do I need to clear all scroll id when get difference scroll id in mutiple scroll request?](https://discuss.elastic.co/t/do-i-need-to-clear-all-scroll-id-when-get-difference-scroll-id-in-mutiple-scroll-request/289574)
**Author:** [@yuhaowin](https://discuss.elastic.co/u/yuhaowin)\ **Replies:** 2\ **Last updated:** [November 19, 2021, 5:57am UTC](https://discuss.elastic.co/t/do-i-need-to-clear-all-scroll-id-when-get-difference-scroll-id-in-mutiple-scroll-request/289574 "2021-11-19T05:57:41Z")
I know in every scroll request we may get difference scroll id,, when I have a list of difference scroll id, need clear all of them? I see search-scroll api example in elasticsearch guide, just clear recently scroll id. … --- ## [Confluence(Cloud) Sync Error](https://discuss.elastic.co/t/confluence-cloud-sync-error/289516)
**Author:** [@sungho](https://discuss.elastic.co/u/sungho)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 4:28am UTC](https://discuss.elastic.co/t/confluence-cloud-sync-error/289516 "2021-11-19T04:28:57Z")
"incremental": \[ { "createdAt": "2021-11-17T22:40:41Z", "status": "complete", "fatalException": null, "errorReason": null, "completedAt": "2021-11-17T22:40:50Z", "durationSeconds": 9.0, "documentErrorCount": 1, … --- ## [How do I process sended data?](https://discuss.elastic.co/t/how-do-i-process-sended-data/288991)
**Author:** [@smam](https://discuss.elastic.co/u/smam)\ **Replies:** 6\ **Last updated:** [November 19, 2021, 4:04am UTC](https://discuss.elastic.co/t/how-do-i-process-sended-data/288991 "2021-11-19T04:04:28Z")
Hello, I managed to send my data to Elasticsearch via Logstash/Filebeat and the modules Plugin aknowledges that. ("Received data from this module") but how can I actually get from the Elasticsearch start page to the Ana… --- ## [Date\_histogram date formatter results in error in ElasticSearch Version 7.15 & above](https://discuss.elastic.co/t/date-histogram-date-formatter-results-in-error-in-elasticsearch-version-7-15-above/289626)
**Author:** [@inspirebharath](https://discuss.elastic.co/u/inspirebharath)\ **Replies:** 0\ **Last updated:** [November 18, 2021, 5:12pm UTC](https://discuss.elastic.co/t/date-histogram-date-formatter-results-in-error-in-elasticsearch-version-7-15-above/289626 "2021-11-18T17:12:48Z")
The below query used to work fine in the Elasticsearch Versions 6.8.x to 7.13.4. But the same breaks from 7.15.x version. Kindly suggest the fix for this. { "size": 0, "\_source": false, "query": { "… --- ## [How to enable https connection in the Bitnami ES](https://discuss.elastic.co/t/how-to-enable-https-connection-in-the-bitnami-es/289650)
**Author:** [@maulin](https://discuss.elastic.co/u/maulin)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 4:00am UTC](https://discuss.elastic.co/t/how-to-enable-https-connection-in-the-bitnami-es/289650 "2021-11-19T04:00:54Z")
Need to Enable HTTPS connection in Bitnami Elasticsearch cluster --- ## [If the condition is two fields equal how to write?](https://discuss.elastic.co/t/if-the-condition-is-two-fields-equal-how-to-write/289531)
**Author:** [@KhalidDu](https://discuss.elastic.co/u/KhalidDu)\ **Replies:** 2\ **Last updated:** [November 19, 2021, 3:10am UTC](https://discuss.elastic.co/t/if-the-condition-is-two-fields-equal-how-to-write/289531 "2021-11-19T03:10:48Z")
Excuse me, I am a novice, so I would like to ask about the query ES, if the condition is two fields equal how to write? --- ## [Private key issues connecting beats to logstash & elasticsearch](https://discuss.elastic.co/t/private-key-issues-connecting-beats-to-logstash-elasticsearch/289412)
**Author:** [@K5SF](https://discuss.elastic.co/u/K5SF)\ **Replies:** 5\ **Last updated:** [November 19, 2021, 1:42am UTC](https://discuss.elastic.co/t/private-key-issues-connecting-beats-to-logstash-elasticsearch/289412 "2021-11-19T01:42:01Z")
Hi all, I am writing to you because I am doing an installation of the suite ELK with Logstash elastic kibana et file beat. Only, during my SSL configuration for logstash I end up with this error " Private key cannot be … --- ## [Improve Logstash data resiliency](https://discuss.elastic.co/t/improve-logstash-data-resiliency/289378)
**Author:** [@Rodolffo](https://discuss.elastic.co/u/Rodolffo)\ **Replies:** 4\ **Last updated:** [November 19, 2021, 12:19am UTC](https://discuss.elastic.co/t/improve-logstash-data-resiliency/289378 "2021-11-19T00:19:41Z")
Hi everyone! I'm working on an architecture in which we will ingest transactions into Elasticsearch from our application servers, and want to make absolutely sure that we store 100% of the data. I just want to validate … --- ## [Automate update lists (threat intelligence)](https://discuss.elastic.co/t/automate-update-lists-threat-intelligence/288940)
**Author:** [@VellayLoket](https://discuss.elastic.co/u/VellayLoket)\ **Replies:** 1\ **Last updated:** [November 18, 2021, 11:18pm UTC](https://discuss.elastic.co/t/automate-update-lists-threat-intelligence/288940 "2021-11-18T23:18:11Z")
I have some lists which i use in some correlations. Ussually i update this lists manually. Is there some way to do this automatically? --- ## [Composite Aggregation Impact on ES Performance](https://discuss.elastic.co/t/composite-aggregation-impact-on-es-performance/289638)
**Author:** [@RahulSingh1905](https://discuss.elastic.co/u/RahulSingh1905)\ **Replies:** 0\ **Last updated:** [November 18, 2021, 7:30pm UTC](https://discuss.elastic.co/t/composite-aggregation-impact-on-es-performance/289638 "2021-11-18T19:30:45Z")
The ES7.x doc for composite aggregation warns that : “The composite aggregation is expensive. Load test your application before deploying a composite aggregation in production.” Some context: My team and I are hoping to… --- ## [Assistance Multiplying 2 SQL Variables in Canvas](https://discuss.elastic.co/t/assistance-multiplying-2-sql-variables-in-canvas/289481)
**Author:** [@butchkelley](https://discuss.elastic.co/u/butchkelley)\ **Replies:** 5\ **Last updated:** [November 18, 2021, 6:50pm UTC](https://discuss.elastic.co/t/assistance-multiplying-2-sql-variables-in-canvas/289481 "2021-11-18T18:50:42Z")
Hello I'm trying to multiply 2 variables together in Canvas using tiny math. My Elastic version is 7.9. I started with this as an example (which works fine): filters | demodata | var\_set "val1" value=2 | var\_set "val… --- ## [Elasticsearch 7.10 .zip installation, Windows service will not start](https://discuss.elastic.co/t/elasticsearch-7-10-zip-installation-windows-service-will-not-start/289629)
**Author:** [@newschapmj1](https://discuss.elastic.co/u/newschapmj1)\ **Replies:** 1\ **Last updated:** [November 18, 2021, 6:31pm UTC](https://discuss.elastic.co/t/elasticsearch-7-10-zip-installation-windows-service-will-not-start/289629 "2021-11-18T18:31:42Z")
Followed the install steps. Installed Elastic as a service. Started service. Service failed to start Nothing in the logs folders Using dedicated service account (not local system) System error log error 7034 ...se… --- ## [Elastic migrating from 6.8.8 to 7.10.2 in cluster mode : 1st node not starting until 2nd node starts in earlier version this was not the case](https://discuss.elastic.co/t/elastic-migrating-from-6-8-8-to-7-10-2-in-cluster-mode-1st-node-not-starting-until-2nd-node-starts-in-earlier-version-this-was-not-the-case/289610)
**Author:** [@cssingh](https://discuss.elastic.co/u/cssingh)\ **Replies:** 3\ **Last updated:** [November 18, 2021, 6:03pm UTC](https://discuss.elastic.co/t/elastic-migrating-from-6-8-8-to-7-10-2-in-cluster-mode-1st-node-not-starting-until-2nd-node-starts-in-earlier-version-this-was-not-the-case/289610 "2021-11-18T18:03:56Z")
I am making 3 node cluster. Below is my elastic.yml file cluster.name: SpectrumCluster node.name: node-1 cluster.initial\_master\_nodes: 10.2.107.14:9300,172.30.6.22:9300,172.30.5.255:9300 discovery.seed\_hosts: 10.2.10… --- ## [Add Default Date Format on Mapping](https://discuss.elastic.co/t/add-default-date-format-on-mapping/289341)
**Author:** [@Mehmet\_Gencol](https://discuss.elastic.co/u/Mehmet_Gencol)\ **Replies:** 12\ **Last updated:** [November 18, 2021, 5:45pm UTC](https://discuss.elastic.co/t/add-default-date-format-on-mapping/289341 "2021-11-18T17:45:19Z")
I have a mapping that dynamically detects date and stores. Fields are dynamically created, and I don't have any configuration about date formatting. so dates are detected and stored as their formats. They are generally s… --- ## [Unable to Parse Syslog messages into Elasticsearch](https://discuss.elastic.co/t/unable-to-parse-syslog-messages-into-elasticsearch/288755)
**Author:** [@Elie\_Sbat1](https://discuss.elastic.co/u/Elie_Sbat1)\ **Replies:** 9\ **Last updated:** [November 18, 2021, 5:34pm UTC](https://discuss.elastic.co/t/unable-to-parse-syslog-messages-into-elasticsearch/288755 "2021-11-18T17:34:48Z")
Hello, I am sending syslog messages from barracuda mail spammer directly into Elasticsearch database. The index got populated with data but the data are not parsed correctly. The log attributes are all shown in the mes… --- ## [Date format in Elasticsearch](https://discuss.elastic.co/t/date-format-in-elasticsearch/289608)
**Author:** [@kibanauser4](https://discuss.elastic.co/u/kibanauser4)\ **Replies:** 8\ **Last updated:** [November 18, 2021, 5:30pm UTC](https://discuss.elastic.co/t/date-format-in-elasticsearch/289608 "2021-11-18T17:30:20Z")
Hello. I am trying to import a .csv file to Elasticsearch. In the .csv file there is a date field in the "yyyyMMdd" format (for example 20220326). This is what I have in my logstash conf file: filter { date { m… --- ## [About repeating parameters when using if/else conditions](https://discuss.elastic.co/t/about-repeating-parameters-when-using-if-else-conditions/289448)
**Author:** [@espala](https://discuss.elastic.co/u/espala)\ **Replies:** 4\ **Last updated:** [November 18, 2021, 5:04pm UTC](https://discuss.elastic.co/t/about-repeating-parameters-when-using-if-else-conditions/289448 "2021-11-18T17:04:44Z")
Hello there, I'm using the config I've added as "original" below on my logstash server. My configuration works fine. my purpose; I have a lot of servers and I collect the general system logs of all of them on elk. I i… --- ## [Combined nested query returning wrong result](https://discuss.elastic.co/t/combined-nested-query-returning-wrong-result/289612)
**Author:** [@identify](https://discuss.elastic.co/u/identify)\ **Replies:** 1\ **Last updated:** [November 18, 2021, 3:56pm UTC](https://discuss.elastic.co/t/combined-nested-query-returning-wrong-result/289612 "2021-11-18T15:56:51Z")
Hello, I am trying to do a query with two conditions within the "must" part of a "bool" query. Each condition is a nested query. The query is as follows: { "query":{ "bool":{ "filter":\[ { … --- ## [Comparar dos eventos en logstash](https://discuss.elastic.co/t/comparar-dos-eventos-en-logstash/289617)
**Author:** [@EduardoM](https://discuss.elastic.co/u/EduardoM)\ **Replies:** 0\ **Last updated:** [November 18, 2021, 3:49pm UTC](https://discuss.elastic.co/t/comparar-dos-eventos-en-logstash/289617 "2021-11-18T15:49:01Z")
Hola a todos, estoy trabajando con logstash, esto es muy nuevo para mí, pero no sé si es posible, hacer lo siguiente: tener un mensaje o evento como este: { "itemstatus": 4, "@timestamp": "2021-11-18T13:01:59.259Z","p… --- ## [Elasticsearch query](https://discuss.elastic.co/t/elasticsearch-query/288504)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 5\ **Last updated:** [November 18, 2021, 3:06pm UTC](https://discuss.elastic.co/t/elasticsearch-query/288504 "2021-11-18T15:06:23Z")
I cannot get this query to work. Note i cannot use the Filter field i GET /index-\*/\_search { "query": { "term": { "result": "Reputation" }, "range": { "@timestamp": { "gte":… --- ## [Error in creating Index patterns for Join Field](https://discuss.elastic.co/t/error-in-creating-index-patterns-for-join-field/288554)
**Author:** [@painless\_elastic](https://discuss.elastic.co/u/painless_elastic)\ **Replies:** 4\ **Last updated:** [November 18, 2021, 2:04pm UTC](https://discuss.elastic.co/t/error-in-creating-index-patterns-for-join-field/288554 "2021-11-18T14:04:42Z")
Hi, I am following this tutorial Parent ID query | Elasticsearch Guide \[7.15\] | Elastic After creating an index and inserting documents, the search is working fine both in my local and dev server. But when I am creatin… --- ## [elasticsearch.exceptions.RequestError: RequestError(400, 'search\_phase\_execution\_exception', '\[match\] analyzer \[name\_phonetic\] not found')](https://discuss.elastic.co/t/elasticsearch-exceptions-requesterror-requesterror-400-search-phase-execution-exception-match-analyzer-name-phonetic-not-found/289572)
**Author:** [@pk5859](https://discuss.elastic.co/u/pk5859)\ **Replies:** 3\ **Last updated:** [November 18, 2021, 2:03pm UTC](https://discuss.elastic.co/t/elasticsearch-exceptions-requesterror-requesterror-400-search-phase-execution-exception-match-analyzer-name-phonetic-not-found/289572 "2021-11-18T14:03:40Z")
Mapping example- spouseNameQuery = { "match": { "Spouse\_Name": { # "query": input\_dict\['Spouse\_Name'\], "query": val, "analyzer": "name\_phonetic", … --- ## [Kibana removing fields from index pattern](https://discuss.elastic.co/t/kibana-removing-fields-from-index-pattern/288330)
**Author:** [@hellotty](https://discuss.elastic.co/u/hellotty)\ **Replies:** 4\ **Last updated:** [November 18, 2021, 1:57pm UTC](https://discuss.elastic.co/t/kibana-removing-fields-from-index-pattern/288330 "2021-11-18T13:57:27Z")
Hello. During the test, I created a lot of fields that are now irrelevant and interfere with the search. Can I delete fields that I don't need? --- ## [How to match all tokens? (get rid of false positive result)](https://discuss.elastic.co/t/how-to-match-all-tokens-get-rid-of-false-positive-result/289602)
**Author:** [@vavra7](https://discuss.elastic.co/u/vavra7)\ **Replies:** 0\ **Last updated:** [November 18, 2021, 1:54pm UTC](https://discuss.elastic.co/t/how-to-match-all-tokens-get-rid-of-false-positive-result/289602 "2021-11-18T13:54:02Z")
Hi, I need to find out by the title whether searched game already exists in my ES. I use custom analyzer to meet my needs with features like transform roman numerals, lowercase, custom stopwords etc... So when I create… --- ## [Replace file path with it's content](https://discuss.elastic.co/t/replace-file-path-with-its-content/289599)
**Author:** [@Mohammed\_Sayeed](https://discuss.elastic.co/u/Mohammed_Sayeed)\ **Replies:** 0\ **Last updated:** [November 18, 2021, 1:33pm UTC](https://discuss.elastic.co/t/replace-file-path-with-its-content/289599 "2021-11-18T13:33:14Z")
I'm trying to read a csv and replace file path with it's content. for example i have a csv file like this: data1, data2, path1 data3, data4, path2 path1 data:- data5 path2 data:- data6 i want to create a document l… --- ## [How to Find a document with maximum number of fields in ElasticSearch](https://discuss.elastic.co/t/how-to-find-a-document-with-maximum-number-of-fields-in-elasticsearch/289593)
**Author:** [@amars39](https://discuss.elastic.co/u/amars39)\ **Replies:** 0\ **Last updated:** [November 18, 2021, 1:19pm UTC](https://discuss.elastic.co/t/how-to-find-a-document-with-maximum-number-of-fields-in-elasticsearch/289593 "2021-11-18T13:19:25Z")
Hi, we are trying to find a document in elastic index with maximum number of fields , my document is below format . is there any way to get the document or the highest number of fields count in the document. { "caseId"… --- ## [Query error with .keywords](https://discuss.elastic.co/t/query-error-with-keywords/289587)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 0\ **Last updated:** [November 18, 2021, 12:41pm UTC](https://discuss.elastic.co/t/query-error-with-keywords/289587 "2021-11-18T12:41:42Z")
Hello! I am trying to enrich my index with logstash's elastic filter. the problem is that it analyzes instead of taking the concrete value. How can I query to use the .keyword? im want something like this: elasti… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=773) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=775)