# \#none

**URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=789

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 790

---

## [ILM rollover not working on max\_size?](https://discuss.elastic.co/t/ilm-rollover-not-working-on-max-size/287999)

<div class="topic-metadata">

**Author:** [@TimWardFS](https://discuss.elastic.co/u/TimWardFS)\
**Replies:** 3\
**Last updated:** [October 31, 2021, 3:14pm UTC](https://discuss.elastic.co/t/ilm-rollover-not-working-on-max-size/287999 "2021-10-31T15:14:31Z")

</div>

I have an ILM policy with both max\_age and max\_size specified. Rollover happens as expected about ten minutes after max\_age, but does not seem to happen on max\_size. With max\_size set to 10MB I've seen shard sizes up to …

---

## [How can I parse nested JSON strings to JSON objects?](https://discuss.elastic.co/t/how-can-i-parse-nested-json-strings-to-json-objects/287944)

<div class="topic-metadata">

**Author:** [@dudwell](https://discuss.elastic.co/u/dudwell)\
**Replies:** 6\
**Last updated:** [October 31, 2021, 2:50pm UTC](https://discuss.elastic.co/t/how-can-i-parse-nested-json-strings-to-json-objects/287944 "2021-10-31T14:50:37Z")

</div>

Could some possibly provide some guidance on how to parse out an array of JSON strings into individual JSON objects with Logstash json parser??? My logstash filter look as follows... filter { grok { add\_tag =\> \[…

---

## [Disable dynamic mapping over all nodes](https://discuss.elastic.co/t/disable-dynamic-mapping-over-all-nodes/288062)

<div class="topic-metadata">

**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\
**Replies:** 1\
**Last updated:** [October 30, 2021, 8:54pm UTC](https://discuss.elastic.co/t/disable-dynamic-mapping-over-all-nodes/288062 "2021-10-30T20:54:49Z")

</div>

I want to disable dynamic mappings for all indices over all nodes of cluster. how can i do this?

---

## [Add date and seconds to odd(?) ISO 8601-ish timestamp?](https://discuss.elastic.co/t/add-date-and-seconds-to-odd-iso-8601-ish-timestamp/288031)

<div class="topic-metadata">

**Author:** [@tjswe](https://discuss.elastic.co/u/tjswe)\
**Replies:** 2\
**Last updated:** [October 30, 2021, 6:47pm UTC](https://discuss.elastic.co/t/add-date-and-seconds-to-odd-iso-8601-ish-timestamp/288031 "2021-10-30T18:47:20Z")

</div>

Im logging AIS-data (ship positions) into Elasticsearch. The "timestamp" field from the receiver is 99% of the time a regular ISO8601 timestamp like "2021-10-29T17:55:30Z" which logstash takes in without issues. But som…

---

## [Logstash - Grok dynamic parsing including nested fields](https://discuss.elastic.co/t/logstash-grok-dynamic-parsing-including-nested-fields/287919)

<div class="topic-metadata">

**Author:** [@anandd4](https://discuss.elastic.co/u/anandd4)\
**Replies:** 2\
**Last updated:** [October 30, 2021, 11:21am UTC](https://discuss.elastic.co/t/logstash-grok-dynamic-parsing-including-nested-fields/287919 "2021-10-30T11:21:11Z")

</div>

Hello, We have the following pattern which includes dynamic fields nested inside a tag(tag3 in the example below) that needs to be parsed & grok seems to be the go-to-filter to achieve this. However, given fields inside…

---

## [Rule hits visible in preview, but no alerts triggered](https://discuss.elastic.co/t/rule-hits-visible-in-preview-but-no-alerts-triggered/287457)

<div class="topic-metadata">

**Author:** [@mcreedjr](https://discuss.elastic.co/u/mcreedjr)\
**Replies:** 4\
**Last updated:** [October 27, 2021, 4:10pm UTC](https://discuss.elastic.co/t/rule-hits-visible-in-preview-but-no-alerts-triggered/287457 "2021-10-27T16:10:02Z")

</div>

I've imported the default Elastic rules, and duplicated the 'whoami' rule. When I preview the rule, it shows hits, but there are no alerts raised. I feel that I'm missing something super obvious, but I would expect to se…

---

## [How to match spans near the beginning of a field](https://discuss.elastic.co/t/how-to-match-spans-near-the-beginning-of-a-field/288055)

<div class="topic-metadata">

**Author:** [@Kev86](https://discuss.elastic.co/u/Kev86)\
**Replies:** 0\
**Last updated:** [October 30, 2021, 6:55am UTC](https://discuss.elastic.co/t/how-to-match-spans-near-the-beginning-of-a-field/288055 "2021-10-30T06:55:47Z")

</div>

I have this query and want a span first in SearchField. So that ES shows the string that match closest to the beginning of the field first: { "query": { "bool": { "should": \[ { …

---

## [Parse XML by Document not Element](https://discuss.elastic.co/t/parse-xml-by-document-not-element/288028)

<div class="topic-metadata">

**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\
**Replies:** 5\
**Last updated:** [October 29, 2021, 10:32pm UTC](https://discuss.elastic.co/t/parse-xml-by-document-not-element/288028 "2021-10-29T22:32:21Z")

</div>

As a test, I am trying to ingest the following simple XML file (the actual production file is huge). \<note\> \<to\>Tove\</to\> \<from\>Jani\</from\> \<heading\>Reminder\</heading\> \<body\>Don't forget me this weekend!\</body\> \</note\> …

---

## [Not able to connect kibana to remote instance](https://discuss.elastic.co/t/not-able-to-connect-kibana-to-remote-instance/287859)

<div class="topic-metadata">

**Author:** [@Tingda\_Du](https://discuss.elastic.co/u/Tingda_Du)\
**Replies:** 8\
**Last updated:** [October 29, 2021, 11:36pm UTC](https://discuss.elastic.co/t/not-able-to-connect-kibana-to-remote-instance/287859 "2021-10-29T23:36:56Z")

</div>

Got this error not sure why. kibana\_1 | {"type":"log","@timestamp":"2021-10-27T22:59:48Z","tags":\["info","plugins-system"\],"pid":8,"message":"Setting up \[2\] plugins: \[inspector,data\]"} kibana\_1 | {"type":"log","@times…

---

## [Timefilter refresh issues on Chromium and edge browsers](https://discuss.elastic.co/t/timefilter-refresh-issues-on-chromium-and-edge-browsers/287933)

<div class="topic-metadata">

**Author:** [@susmeeta](https://discuss.elastic.co/u/susmeeta)\
**Replies:** 1\
**Last updated:** [October 29, 2021, 11:18pm UTC](https://discuss.elastic.co/t/timefilter-refresh-issues-on-chromium-and-edge-browsers/287933 "2021-10-29T23:18:21Z")

</div>

We use Canvas dashboards on Kibana 7.9.1 and use time filters to retrieve data for different time period. We have been using Chrome browsers, but recently found that time filters and browsers are not editable on Chrome v…

---

## [TSVB is not working after ELK up gradation from 7.10 to 7.11.2 with the epoch time field](https://discuss.elastic.co/t/tsvb-is-not-working-after-elk-up-gradation-from-7-10-to-7-11-2-with-the-epoch-time-field/287928)

<div class="topic-metadata">

**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\
**Replies:** 1\
**Last updated:** [October 29, 2021, 10:28pm UTC](https://discuss.elastic.co/t/tsvb-is-not-working-after-elk-up-gradation-from-7-10-to-7-11-2-with-the-epoch-time-field/287928 "2021-10-29T22:28:48Z")

</div>

Hi, ELK is upgraded from 7.10 to 7.11.2, TSVB is working as expected. It is simple tsvb configuration. the aggrgation is count and group by everthing. The time stamp of the indexpattern is date but it is in epoch time…

---

## [Increase "ignore\_above" value for message.keyword](https://discuss.elastic.co/t/increase-ignore-above-value-for-message-keyword/287962)

<div class="topic-metadata">

**Author:** [@enryoku](https://discuss.elastic.co/u/enryoku)\
**Replies:** 1\
**Last updated:** [October 29, 2021, 10:04pm UTC](https://discuss.elastic.co/t/increase-ignore-above-value-for-message-keyword/287962 "2021-10-29T22:04:21Z")

</div>

Hello, I am trying to increase the default value for "ignore\_above" from 256 to 1024 for the message.keyword field by adding a component index template in Elasticsearch and apply it to the base index pattern. My index …

---

## [Emulate region map max(field) in Maps](https://discuss.elastic.co/t/emulate-region-map-max-field-in-maps/287863)

<div class="topic-metadata">

**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\
**Replies:** 2\
**Last updated:** [October 29, 2021, 7:38pm UTC](https://discuss.elastic.co/t/emulate-region-map-max-field-in-maps/287863 "2021-10-29T19:38:32Z")

</div>

Hello, I want to emulate the region map on a min field value, not the document count, but I can not get it with the New Maps layout because is grouping by document count. How can I get this old functionality? I just wa…

---

## [How can I use query\_string to match both nested and non-nested fields at the same time?](https://discuss.elastic.co/t/how-can-i-use-query-string-to-match-both-nested-and-non-nested-fields-at-the-same-time/288023)

<div class="topic-metadata">

**Author:** [@Max\_Carey](https://discuss.elastic.co/u/Max_Carey)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 4:43pm UTC](https://discuss.elastic.co/t/how-can-i-use-query-string-to-match-both-nested-and-non-nested-fields-at-the-same-time/288023 "2021-10-29T16:43:43Z")

</div>

I have an index with a mapping something like this: "email" : { "type" : "nested", "properties" : { "from" : { "type" : "text", "analyzer" : "lowercase\_keyword", "fielddata" : true }, "…

---

## [Version of elastic db and elastic API are different](https://discuss.elastic.co/t/version-of-elastic-db-and-elastic-api-are-different/288020)

<div class="topic-metadata">

**Author:** [@kathirnk2](https://discuss.elastic.co/u/kathirnk2)\
**Replies:** 1\
**Last updated:** [October 29, 2021, 4:38pm UTC](https://discuss.elastic.co/t/version-of-elastic-db-and-elastic-api-are-different/288020 "2021-10-29T16:38:56Z")

</div>

We are using elastic db version 6.3.1. In our spring boot application also, we have put the elastic api version as 6.3.1 in our build.gradle file. We recently upgraded our spring boot version from 2.1 to 2.4 We remove…

---

## [Adding a synthetic field to documents generated by Transforms](https://discuss.elastic.co/t/adding-a-synthetic-field-to-documents-generated-by-transforms/288014)

<div class="topic-metadata">

**Author:** [@romainneutron](https://discuss.elastic.co/u/romainneutron)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 3:29pm UTC](https://discuss.elastic.co/t/adding-a-synthetic-field-to-documents-generated-by-transforms/288014 "2021-10-29T15:29:36Z")

</div>

Hello, I'm playing with Elastic Transforms (Create transform API | Elasticsearch Guide \[7.15\] | Elastic) I have questions about those: I've created a transform like this: PUT \_transform/transform\_test\_2s { "source"…

---

## [Bug when aggregating histogram fields](https://discuss.elastic.co/t/bug-when-aggregating-histogram-fields/288013)

<div class="topic-metadata">

**Author:** [@romainneutron](https://discuss.elastic.co/u/romainneutron)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 3:24pm UTC](https://discuss.elastic.co/t/bug-when-aggregating-histogram-fields/288013 "2021-10-29T15:24:43Z")

</div>

Hello, I encounter an issue with some particular values using histogram aggregations: Here's a reproducer: PUT test-index { "mappings" : { "properties" : { "my\_histogram" : { "type" : "histogram" …

---

## [Kafka-logstash-elastic disaster resistant](https://discuss.elastic.co/t/kafka-logstash-elastic-disaster-resistant/287994)

<div class="topic-metadata">

**Author:** [@Mamol27](https://discuss.elastic.co/u/Mamol27)\
**Replies:** 2\
**Last updated:** [October 29, 2021, 2:45pm UTC](https://discuss.elastic.co/t/kafka-logstash-elastic-disaster-resistant/287994 "2021-10-29T14:45:47Z")

</div>

Hi! I am testing disaster resistant of pipeline kafka-\>logstash-\>elastic Logstash config input { kafka { bootstrap\_servers =\> "172.29.39.115:9093, 172.29.39.116:9093" topics =\> "test-test" #consumer\_thre…

---

## [Failed to parse a date field in Logstash](https://discuss.elastic.co/t/failed-to-parse-a-date-field-in-logstash/288008)

<div class="topic-metadata">

**Author:** [@dedi27](https://discuss.elastic.co/u/dedi27)\
**Replies:** 2\
**Last updated:** [October 29, 2021, 2:36pm UTC](https://discuss.elastic.co/t/failed-to-parse-a-date-field-in-logstash/288008 "2021-10-29T14:36:00Z")

</div>

Fail to parse a date field in Logstash Hello, I'm trying to parse a date field from a log file coming from an Exim Mail Server where I have a date string like this "2021-10-28 15:44:40". In my filter in Logstash, firs…

---

## [Logstash performance and jdbc\_streaming](https://discuss.elastic.co/t/logstash-performance-and-jdbc-streaming/288009)

<div class="topic-metadata">

**Author:** [@Roberto\_B](https://discuss.elastic.co/u/Roberto_B)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 2:00pm UTC](https://discuss.elastic.co/t/logstash-performance-and-jdbc-streaming/288009 "2021-10-29T14:00:16Z")

</div>

Hi all, i'm using in this days Logstash (I love logstash if I could I would use it to make coffee too :upside\_down\_face: ), like an ETL get the data from mysql transform it enriching the data with multiple jdbc\_stream…

---

## [Kibana date format mapping](https://discuss.elastic.co/t/kibana-date-format-mapping/287597)

<div class="topic-metadata">

**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\
**Replies:** 5\
**Last updated:** [October 29, 2021, 1:58pm UTC](https://discuss.elastic.co/t/kibana-date-format-mapping/287597 "2021-10-29T13:58:54Z")

</div>

Hi, I'm trying to configure a template inside Kibana for a date field but I don't see a date format that matches it. My date field looks like this: 2021-05-05 09:38:47 +0000 UTC If I map the date field as "text" insid…

---

## [Elastic Search Aggregations Slow](https://discuss.elastic.co/t/elastic-search-aggregations-slow/286701)

<div class="topic-metadata">

**Author:** [@Srini12](https://discuss.elastic.co/u/Srini12)\
**Replies:** 20\
**Last updated:** [October 29, 2021, 1:55pm UTC](https://discuss.elastic.co/t/elastic-search-aggregations-slow/286701 "2021-10-29T13:55:16Z")

</div>

Good day I have an Elasticsearch index with 50 million records in it. This is working as expected. If I add aggregations to my query it is taking quite a long time to get the results. Any advise ? Thanks in advance. K…

---

## [Transform API update documents already inserted](https://discuss.elastic.co/t/transform-api-update-documents-already-inserted/288006)

<div class="topic-metadata">

**Author:** [@marone](https://discuss.elastic.co/u/marone)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 1:40pm UTC](https://discuss.elastic.co/t/transform-api-update-documents-already-inserted/288006 "2021-10-29T13:40:56Z")

</div>

Hey I am facing a big issue as we are going to production using Transform API. What we are facing is the aggregation calculated with a transform API are updated once a term aggregation already exist in the destination in…

---

## [How to boost results on the basis of fields values](https://discuss.elastic.co/t/how-to-boost-results-on-the-basis-of-fields-values/287826)

<div class="topic-metadata">

**Author:** [@Ashutosh\_Dwivedi](https://discuss.elastic.co/u/Ashutosh_Dwivedi)\
**Replies:** 7\
**Last updated:** [October 29, 2021, 1:10pm UTC](https://discuss.elastic.co/t/how-to-boost-results-on-the-basis-of-fields-values/287826 "2021-10-29T13:10:12Z")

</div>

Hi Everyone, I have stuck into creating query for a specific problem. Can anyone please help me ? I have these list of products \[ { "name":"pro", "clickCount":110, "bookingCount":57, "isPromoted":0 }, { "na…

---

## [Distance\_feature and optimal pagination?](https://discuss.elastic.co/t/distance-feature-and-optimal-pagination/287949)

<div class="topic-metadata">

**Author:** [@tamis-laan](https://discuss.elastic.co/u/tamis-laan)\
**Replies:** 0\
**Last updated:** [October 28, 2021, 5:44pm UTC](https://discuss.elastic.co/t/distance-feature-and-optimal-pagination/287949 "2021-10-28T17:44:52Z")

</div>

I want to implement pagination over a search query that uses the distance\_feature using location and time and implement pagination. Now because each request is unique in terms of it's location and time the sorting will …

---

## [Store time lapsed between two events](https://discuss.elastic.co/t/store-time-lapsed-between-two-events/287991)

<div class="topic-metadata">

**Author:** [@Frederick\_Faria](https://discuss.elastic.co/u/Frederick_Faria)\
**Replies:** 1\
**Last updated:** [October 29, 2021, 12:15pm UTC](https://discuss.elastic.co/t/store-time-lapsed-between-two-events/287991 "2021-10-29T12:15:24Z")

</div>

I need to store a time duration two events and have as in HH:mm:ss.SSS. I tried using Date type with basic\_time format but it do now allows me to save more than 23 hours. How would you recommend to proceed in this case? …

---

## [Bulk Upsert isn't Importing All Records](https://discuss.elastic.co/t/bulk-upsert-isnt-importing-all-records/287011)

<div class="topic-metadata">

**Author:** [@selectedpixel](https://discuss.elastic.co/u/selectedpixel)\
**Replies:** 3\
**Last updated:** [October 29, 2021, 11:44am UTC](https://discuss.elastic.co/t/bulk-upsert-isnt-importing-all-records/287011 "2021-10-29T11:44:17Z")

</div>

I'm doing a bulk upsert using the Elasticsearch NodeJS library Helper classes. const response = await ELSClient.helpers.bulk({ concurrency: 20, datasource: data, onDocument (doc) { return \[{ up…

---

## [Aggregate filter plugin - timeout function bug](https://discuss.elastic.co/t/aggregate-filter-plugin-timeout-function-bug/286383)

<div class="topic-metadata">

**Author:** [@MarcelOs](https://discuss.elastic.co/u/MarcelOs)\
**Replies:** 6\
**Last updated:** [October 29, 2021, 7:22am UTC](https://discuss.elastic.co/t/aggregate-filter-plugin-timeout-function-bug/286383 "2021-10-29T07:22:44Z")

</div>

Hello everyone, I have some problems with the Timeout command from the aggregate filter plugin. I want to create a script that calculates the meantime between two log entries. There are examples of such a function (http…

---

## [CircuitBreakingException (Heap size issue)](https://discuss.elastic.co/t/circuitbreakingexception-heap-size-issue/287985)

<div class="topic-metadata">

**Author:** [@Balaji\_Arun](https://discuss.elastic.co/u/Balaji_Arun)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 9:43am UTC](https://discuss.elastic.co/t/circuitbreakingexception-heap-size-issue/287985 "2021-10-29T09:43:10Z")

</div>

Hi everyone, I'm facing a issue with heap size don't know how to increase it tried changing the env var in the kube config (using Kubernetes for deployment ) but it struck at applying changes phase thanks in advance …

---

## [Logstashで複数の種類のログを一つのパイプラインで処理したい](https://discuss.elastic.co/t/logstash/287869)

<div class="topic-metadata">

**Author:** [@kapibara824](https://discuss.elastic.co/u/kapibara824)\
**Replies:** 2\
**Last updated:** [October 29, 2021, 4:51am UTC](https://discuss.elastic.co/t/logstash/287869 "2021-10-29T04:51:25Z")

</div>

同一パイプラインで複数の種類のログを処理したいです。 具体的に言うと同じfilebeatでタグ等で分けずにlogstashに送信し、 grokを書いてAのパターンにマッチするログはそこで処理し、AにマッチせずBパターンにマッチするログはそこで処理し...みたいな感じでやりたいです ログの配置上フォーマットごとにタグ分けやfilebeatを分けると言ったことが難しいので上記のやり方もしくは別のやり方でいい方法があれば教えていただきた…

[Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=788)

[Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=790)