# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=777 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 778 --- ## [CSV quote char inside data](https://discuss.elastic.co/t/csv-quote-char-inside-data/289290)
**Author:** [@nosql\_injection](https://discuss.elastic.co/u/nosql_injection)\ **Replies:** 1\ **Last updated:** [November 16, 2021, 5:44pm UTC](https://discuss.elastic.co/t/csv-quote-char-inside-data/289290 "2021-11-16T17:44:38Z")
Hi there, I'm trying to ingest syslog data with the CSV filter. I guess the issue is related to the " inside the URL part (acme.org&iid={"-123456\*\*"\*\*:4}&sid=123458&tid=123) of the log, which is the same char as the "… --- ## [Does ES2 Support scroll and search\_after for Retrieving \>10K Data](https://discuss.elastic.co/t/does-es2-support-scroll-and-search-after-for-retrieving-10k-data/289104)
**Author:** [@theodoreandrew](https://discuss.elastic.co/u/theodoreandrew)\ **Replies:** 5\ **Last updated:** [November 16, 2021, 5:27pm UTC](https://discuss.elastic.co/t/does-es2-support-scroll-and-search-after-for-retrieving-10k-data/289104 "2021-11-16T17:27:17Z")
Hey guys, I have a question about ES version 2. Does ES2 support scroll and search\_after for retrieving \>10K data? If ES2 doesn't support scroll and search\_after, how can I retrieve \>10K data on ES2? Thanks … --- ## [Creating pipeline Using beats in Windows and sending logs to logstash in linux](https://discuss.elastic.co/t/creating-pipeline-using-beats-in-windows-and-sending-logs-to-logstash-in-linux/289191)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 4\ **Last updated:** [November 16, 2021, 4:30pm UTC](https://discuss.elastic.co/t/creating-pipeline-using-beats-in-windows-and-sending-logs-to-logstash-in-linux/289191 "2021-11-16T16:30:09Z")
Hi, I am creating a pipeline using beats in windows to extract logs in form of txt file in multiple directories and send it to the Linux(server) to logstash to es/kibana. While running logstash conf pipeline I am getti… --- ## [Fielddata error indexing string fields](https://discuss.elastic.co/t/fielddata-error-indexing-string-fields/289105)
**Author:** [@iamtheschmitzer](https://discuss.elastic.co/u/iamtheschmitzer)\ **Replies:** 2\ **Last updated:** [November 16, 2021, 4:18pm UTC](https://discuss.elastic.co/t/fielddata-error-indexing-string-fields/289105 "2021-11-16T16:18:25Z")
In notes of Part 5 of crash course I see By default, every string gets mapped twice as a text field and as a keyword multi-field. Each field type is primed for different types of requests. However, when I try to aggr… --- ## [Corelation Id not working](https://discuss.elastic.co/t/corelation-id-not-working/289243)
**Author:** [@Prabakar](https://discuss.elastic.co/u/Prabakar)\ **Replies:** 2\ **Last updated:** [November 16, 2021, 4:08pm UTC](https://discuss.elastic.co/t/corelation-id-not-working/289243 "2021-11-16T16:08:21Z")
We are passing co-relation id from postman GET request using Http header. But co-relation id is not getting printed in the logs. We would like to use co-relation id to monitor the logs to debug the issues. Can you guide … --- ## [Search\_after queries are not performing as expected](https://discuss.elastic.co/t/search-after-queries-are-not-performing-as-expected/289174)
**Author:** [@manuel.pancorbo](https://discuss.elastic.co/u/manuel.pancorbo)\ **Replies:** 6\ **Last updated:** [November 16, 2021, 3:08pm UTC](https://discuss.elastic.co/t/search-after-queries-are-not-performing-as-expected/289174 "2021-11-16T15:08:42Z")
Hi all! I'm working on building a searcher for a site. This site generates a lot of writes (new or modified documents) so we need to use some mechanism to ensure pagination consistency by using certain criteria (freshne… --- ## [Visualising](https://discuss.elastic.co/t/visualising/289212)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 4\ **Last updated:** [November 16, 2021, 2:55pm UTC](https://discuss.elastic.co/t/visualising/289212 "2021-11-16T14:55:00Z")
So, I have managed to get data into elastic, in this case cpu, and uptime. What I want now is to display the latest cpu and uptime value for each host. I have gone into dashboard visualise and created a table with host… --- ## [Sort Parent by Count of Unique Values of a Child Field](https://discuss.elastic.co/t/sort-parent-by-count-of-unique-values-of-a-child-field/289333)
**Author:** [@amarjotbhullar](https://discuss.elastic.co/u/amarjotbhullar)\ **Replies:** 0\ **Last updated:** [November 16, 2021, 1:49pm UTC](https://discuss.elastic.co/t/sort-parent-by-count-of-unique-values-of-a-child-field/289333 "2021-11-16T13:49:09Z")
Hi, I am currently working on a feature where I have a parent child relationship between driver and trips taken by driver. I need to sort drivers by unique count of no. of cars driven irrespective of number of trips tak… --- ## [I can't record the current date from the log string in the @timestamp field](https://discuss.elastic.co/t/i-cant-record-the-current-date-from-the-log-string-in-the-timestamp-field/289201)
**Author:** [@vanro](https://discuss.elastic.co/u/vanro)\ **Replies:** 2\ **Last updated:** [November 16, 2021, 1:29pm UTC](https://discuss.elastic.co/t/i-cant-record-the-current-date-from-the-log-string-in-the-timestamp-field/289201 "2021-11-16T13:29:30Z")
Hello, I can't record the current date from the log string in the @timestamp field and convert the time field from the string type to the date type. Can you tell me what I'm doing wrong? My configuration is shown below.. … --- ## [Change advanced settings via API?](https://discuss.elastic.co/t/change-advanced-settings-via-api/289205)
**Author:** [@TimWardFS](https://discuss.elastic.co/u/TimWardFS)\ **Replies:** 4\ **Last updated:** [November 16, 2021, 1:02pm UTC](https://discuss.elastic.co/t/change-advanced-settings-via-api/289205 "2021-11-16T13:02:30Z")
I can't see how to change an advanced setting via the API. If I use /api/saved\_objects/\_bulk\_create and don't use overwrite then I get a 409 conflict failure, and if I do use overwrite then it appears that the entire set… --- ## [Big-ish line missing n Elasticsearch 7.9.0](https://discuss.elastic.co/t/big-ish-line-missing-n-elasticsearch-7-9-0/289145)
**Author:** [@Rayyan](https://discuss.elastic.co/u/Rayyan)\ **Replies:** 1\ **Last updated:** [November 16, 2021, 12:48pm UTC](https://discuss.elastic.co/t/big-ish-line-missing-n-elasticsearch-7-9-0/289145 "2021-11-16T12:48:54Z")
We are using a standalone Elasticsearch on EC2 and the stack looks like Application (JSON) --\> Fluent Bit --\> Elasticsearch (7.9.0) on EC2 --\> Kibana on EC2 We have a scenario wherein if the application generated JSON l… --- ## [How to extract fields of an array with logstash?](https://discuss.elastic.co/t/how-to-extract-fields-of-an-array-with-logstash/289289)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 1\ **Last updated:** [November 16, 2021, 11:36am UTC](https://discuss.elastic.co/t/how-to-extract-fields-of-an-array-with-logstash/289289 "2021-11-16T11:36:18Z")
hello! i have a field with this format value: \["x@correo.es","x@correo.com"\] and i want to use a scanner tu extract the nested fields with something like this: ruby { code =\> " event.set('prueba', ev… --- ## [Oracle 32bit on 64bit machine](https://discuss.elastic.co/t/oracle-32bit-on-64bit-machine/289301)
**Author:** [@sc19](https://discuss.elastic.co/u/sc19)\ **Replies:** 1\ **Last updated:** [November 16, 2021, 11:33am UTC](https://discuss.elastic.co/t/oracle-32bit-on-64bit-machine/289301 "2021-11-16T11:33:26Z")
Hello everyone, I have 32 bit two instances ORACLE database (test and production) on Microsoft Windows Server 2019 (64bit), and I want to install metricbeat service on that machine, but after instalation process, I've g… --- ## [Logstash Error](https://discuss.elastic.co/t/logstash-error/289310)
**Author:** [@Angad\_Panesar1](https://discuss.elastic.co/u/Angad_Panesar1)\ **Replies:** 0\ **Last updated:** [November 16, 2021, 11:04am UTC](https://discuss.elastic.co/t/logstash-error/289310 "2021-11-16T11:04:27Z")
Hi, I am running the logstash config file and I am getting the error shown below. \[ERROR\]\[logstash.outputs.Elasticsearch\]\[main\] Failed to install template {:message=\>"Got response code '400' contacting Elasticsearch at … --- ## [Logstash Elasticsearch filer query to filter data from existing data](https://discuss.elastic.co/t/logstash-elasticsearch-filer-query-to-filter-data-from-existing-data/289304)
**Author:** [@DeepakStile](https://discuss.elastic.co/u/DeepakStile)\ **Replies:** 1\ **Last updated:** [November 16, 2021, 11:02am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filer-query-to-filter-data-from-existing-data/289304 "2021-11-16T11:02:38Z")
I am trying to add existing data from Elasticsearch index to a current event of logstash using Elasticsearch filter current logstash event is id,status,date 123456789,ByMobile,Success Existing Data like id,status,da… --- ## [Time panel Elasticsearch/kibana](https://discuss.elastic.co/t/time-panel-elasticsearch-kibana/289308)
**Author:** [@Ragazza\_gioiosa](https://discuss.elastic.co/u/Ragazza_gioiosa)\ **Replies:** 0\ **Last updated:** [November 16, 2021, 10:58am UTC](https://discuss.elastic.co/t/time-panel-elasticsearch-kibana/289308 "2021-11-16T10:58:25Z")
I would like to know if it is possible to translate the time panel that is inside a dashboard to another language. Thanks! --- ## [Z names with an elastic index](https://discuss.elastic.co/t/z-names-with-an-elastic-index/289066)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 4\ **Last updated:** [November 16, 2021, 10:56am UTC](https://discuss.elastic.co/t/z-names-with-an-elastic-index/289066 "2021-11-16T10:56:55Z")
I support an environment similar to AWS where the server names are of limited(/no) value in their raw form, so we have aliased them such that they are meaningful. If the server were rebuilt the zname would change, but t… --- ## [Filter in the front end for the end user in the dashboard](https://discuss.elastic.co/t/filter-in-the-front-end-for-the-end-user-in-the-dashboard/287874)
**Author:** [@Divya\_Bansal](https://discuss.elastic.co/u/Divya_Bansal)\ **Replies:** 2\ **Last updated:** [November 16, 2021, 10:47am UTC](https://discuss.elastic.co/t/filter-in-the-front-end-for-the-end-user-in-the-dashboard/287874 "2021-11-16T10:47:34Z")
Hi All, is there any option to add filter to a particular visualisation by a end user in a dashboard having multiple visualisation of different index? --- ## [Bucket selection (Elasticsearch 6.8)](https://discuss.elastic.co/t/bucket-selection-elasticsearch-6-8/287697)
**Author:** [@dev\_test](https://discuss.elastic.co/u/dev_test)\ **Replies:** 2\ **Last updated:** [November 16, 2021, 10:29am UTC](https://discuss.elastic.co/t/bucket-selection-elasticsearch-6-8/287697 "2021-11-16T10:29:39Z")
Hi, I'm running this query GET assignment/\_search?size=0 { "query": { "bool": { "must": \[ { "term": { "user\_post": "post" } }, { "nested": { … --- ## [Sort search results when sorted by double\_range or float\_range field return array\_index\_out\_of\_bounds\_exception](https://discuss.elastic.co/t/sort-search-results-when-sorted-by-double-range-or-float-range-field-return-array-index-out-of-bounds-exception/287753)
**Author:** [@carpeDiem](https://discuss.elastic.co/u/carpeDiem)\ **Replies:** 1\ **Last updated:** [November 16, 2021, 10:05am UTC](https://discuss.elastic.co/t/sort-search-results-when-sorted-by-double-range-or-float-range-field-return-array-index-out-of-bounds-exception/287753 "2021-11-16T10:05:15Z")
Hello experts, I'm currently trying to sort search results by double\_range or float\_range field,but return a server error:array\_index\_out\_of\_bounds\_exception,I've included the query and the error output, is this support… --- ## [Elastic search takes up a lot of virtual memory under Linux](https://discuss.elastic.co/t/elastic-search-takes-up-a-lot-of-virtual-memory-under-linux/289279)
**Author:** [@zekaifeng](https://discuss.elastic.co/u/zekaifeng)\ **Replies:** 2\ **Last updated:** [November 16, 2021, 8:37am UTC](https://discuss.elastic.co/t/elastic-search-takes-up-a-lot-of-virtual-memory-under-linux/289279 "2021-11-16T08:37:05Z")
Our Elasticsearch version is 7.10.2. It runs on Linux system. The JVM memory allocation is about 3G, and the node memory is about 8G. It is a three node cluster system. The cluster has eight shard, each of which is about… --- ## [Aggregation with large data set using bucket aggregation](https://discuss.elastic.co/t/aggregation-with-large-data-set-using-bucket-aggregation/288141)
**Author:** [@RAVI\_GOPALANI](https://discuss.elastic.co/u/RAVI_GOPALANI)\ **Replies:** 1\ **Last updated:** [November 16, 2021, 8:01am UTC](https://discuss.elastic.co/t/aggregation-with-large-data-set-using-bucket-aggregation/288141 "2021-11-16T08:01:34Z")
Hi , We are using Elasticsearch to get the top hits based on large volumes of data using bucket aggregation. But we see there is default limit in max\_result\_window attribute of initial 10000 records which will be proce… --- ## [Elastic Agent output to Kafka](https://discuss.elastic.co/t/elastic-agent-output-to-kafka/289068)
**Author:** [@marti1](https://discuss.elastic.co/u/marti1)\ **Replies:** 2\ **Last updated:** [November 16, 2021, 7:32am UTC](https://discuss.elastic.co/t/elastic-agent-output-to-kafka/289068 "2021-11-16T07:32:25Z")
Hi, I would like to know if it's possible to connect Elastic Agents to Logstash through Kafka. Elastic Agent -\> Kafka \<- Logstash -\> Elasticsearch I have already read the documentation and I don't understant what mean… --- ## [Elasticsearch thread count leak - threads not closed on index delete](https://discuss.elastic.co/t/elasticsearch-thread-count-leak-threads-not-closed-on-index-delete/289250)
**Author:** [@NelsonBurton](https://discuss.elastic.co/u/NelsonBurton)\ **Replies:** 2\ **Last updated:** [November 16, 2021, 6:38am UTC](https://discuss.elastic.co/t/elasticsearch-thread-count-leak-threads-not-closed-on-index-delete/289250 "2021-11-16T06:38:18Z")
Hi Elasticsearch community, does Elasticsearch cleanly close the per-index threads after deleting an index? ES Version: 7.6.1 I have encountered an issue with my Elasticsearch set up, where the thread count slowly grow… --- ## [How to Resolve In\_flight\_request Data too Large Errors](https://discuss.elastic.co/t/how-to-resolve-in-flight-request-data-too-large-errors/289193)
**Author:** [@mertkaant](https://discuss.elastic.co/u/mertkaant)\ **Replies:** 2\ **Last updated:** [November 16, 2021, 6:33am UTC](https://discuss.elastic.co/t/how-to-resolve-in-flight-request-data-too-large-errors/289193 "2021-11-16T06:33:54Z")
Hello, dear community, We are constantly getting this OutOfMemory error with our master-1 machine. \[in\_flight\_requests\] New used memory 4567112664 \[4.2gb\] for data of \[\\] would be larger than configured br… --- ## [KibanaReportsAutomation](https://discuss.elastic.co/t/kibanareportsautomation/289261)
**Author:** [@vish24](https://discuss.elastic.co/u/vish24)\ **Replies:** 0\ **Last updated:** [November 16, 2021, 5:34am UTC](https://discuss.elastic.co/t/kibanareportsautomation/289261 "2021-11-16T05:34:06Z")
I came to know that few people need some automation in generating Kibana reports. Please find the snippet below: This snippet needs a base file so that script edits it and then executes. Some modifications might be ne… --- ## [Logstash Nested JSON Parsing and Transforming data](https://discuss.elastic.co/t/logstash-nested-json-parsing-and-transforming-data/289255)
**Author:** [@zx8086](https://discuss.elastic.co/u/zx8086)\ **Replies:** 2\ **Last updated:** [November 16, 2021, 5:18am UTC](https://discuss.elastic.co/t/logstash-nested-json-parsing-and-transforming-data/289255 "2021-11-16T05:18:58Z")
How would I using the json filter to split the following json document and target / modify the time stamp (event.ts) ? {"peer":"EC2LEBOQ77XSF46QEKYYYNKBTVATU33K","agent\_name":"test-device","event":{"ts":1637034155000,"t… --- ## [The load of ES cluster CPU is high, but the utilization rate is not high](https://discuss.elastic.co/t/the-load-of-es-cluster-cpu-is-high-but-the-utilization-rate-is-not-high/289246)
**Author:** [@ktpktr0](https://discuss.elastic.co/u/ktpktr0)\ **Replies:** 6\ **Last updated:** [November 16, 2021, 3:37am UTC](https://discuss.elastic.co/t/the-load-of-es-cluster-cpu-is-high-but-the-utilization-rate-is-not-high/289246 "2021-11-16T03:37:54Z")
I have an elk cluster with 3 master nodes, 4 hot data nodes and 4 cold data nodes, and the disks are SSDs. Recently, it was found that the CPU load of the ES cluster is high, but the utilization rate is not high. The fol… --- ## [Expand limit of chars in field (truncated to 100,000 chars)](https://discuss.elastic.co/t/expand-limit-of-chars-in-field-truncated-to-100-000-chars/289209)
**Author:** [@christiancj](https://discuss.elastic.co/u/christiancj)\ **Replies:** 2\ **Last updated:** [November 16, 2021, 1:22am UTC](https://discuss.elastic.co/t/expand-limit-of-chars-in-field-truncated-to-100-000-chars/289209 "2021-11-16T01:22:18Z")
Hi, I'm facing an issue with one of our fields in Elasticsearch, I'm using FSCrawler to extract content and then ingest in Elasticsearch, however we've few large size files where the content extracted exceed 100,000 c… --- ## [Effectively partial update array field in ElasticSearch](https://discuss.elastic.co/t/effectively-partial-update-array-field-in-elasticsearch/288984)
**Author:** [@fatcloud](https://discuss.elastic.co/u/fatcloud)\ **Replies:** 1\ **Last updated:** [November 15, 2021, 11:22pm UTC](https://discuss.elastic.co/t/effectively-partial-update-array-field-in-elasticsearch/288984 "2021-11-15T23:22:40Z")
Hi elastic experts, I'm wondering if there is a way to effectively partial update an element in an array field? For example, a document has a commands field like this: "commands": \[ { "id": 1000, "content": "a… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=776) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=778)