# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=792 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 793 --- ## [How elasticsearch nested query work?](https://discuss.elastic.co/t/how-elasticsearch-nested-query-work/287821)
**Author:** [@tanvu](https://discuss.elastic.co/u/tanvu)\ **Replies:** 0\ **Last updated:** [October 27, 2021, 4:02pm UTC](https://discuss.elastic.co/t/how-elasticsearch-nested-query-work/287821 "2021-10-27T16:02:41Z")
I have a document: { "recipes": \[ { "name": "prepare", "ingredients": \["pork","beef"\], "steps": \[ { "ingredients": \["pork","beef"\] … --- ## [Is it possible to create an Elasticsearch Cluster with different OS?](https://discuss.elastic.co/t/is-it-possible-to-create-an-elasticsearch-cluster-with-different-os/287811)
**Author:** [@marti1](https://discuss.elastic.co/u/marti1)\ **Replies:** 1\ **Last updated:** [October 27, 2021, 3:18pm UTC](https://discuss.elastic.co/t/is-it-possible-to-create-an-elasticsearch-cluster-with-different-os/287811 "2021-10-27T15:18:13Z")
Hi, I have three servers, two are running Red Hat 8 and one Windows 10. Is it possible to set up a cluster (three nodes) with this configuration? Has any inconvenient or possible risks? Thanks in advance … --- ## [/var/lib/elasticsearch/nodes/0/indices/](https://discuss.elastic.co/t/var-lib-elasticsearch-nodes-0-indices/287462)
**Author:** [@marcio\_lima](https://discuss.elastic.co/u/marcio_lima)\ **Replies:** 4\ **Last updated:** [October 27, 2021, 1:25pm UTC](https://discuss.elastic.co/t/var-lib-elasticsearch-nodes-0-indices/287462 "2021-10-27T13:25:32Z")
I have the need to free up disk space by consuming elastic, the files are being generated in / var / lib / Elasticsearch / nodes / 0 / indices / how can i delete the indices? --- ## [Need help to create loglevel field](https://discuss.elastic.co/t/need-help-to-create-loglevel-field/287665)
**Author:** [@sushant12](https://discuss.elastic.co/u/sushant12)\ **Replies:** 3\ **Last updated:** [October 27, 2021, 2:51pm UTC](https://discuss.elastic.co/t/need-help-to-create-loglevel-field/287665 "2021-10-27T14:51:35Z")
filter{ if "ERROR" in \[LEVEl\]{ grok{ match =\> {· "message" =\> "%{TIME:timestamp} %{LOGLEVEL:LEVEL} %{GREEDYDATA:errormsg}"· } } } if "DEBUG" in \[LEVEl\]{ grok{····· match =\>… --- ## [Attempted to send a bulk request to Elasticsearch failed ClientProtocolException](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch-failed-clientprotocolexception/287720)
**Author:** [@makinda](https://discuss.elastic.co/u/makinda)\ **Replies:** 3\ **Last updated:** [October 27, 2021, 1:43pm UTC](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch-failed-clientprotocolexception/287720 "2021-10-27T13:43:05Z")
I am using Elasticsearch-2.3.1 and logstash-2.3.4 since quite long. Today I found a following warning in Elastic Search. I was trying to copy the logs but I think I press Ctrl+C and then an option appear to stop a job, I… --- ## [If cloud/availability\_zone in metric logs is set to number metadata view in kibana is failing](https://discuss.elastic.co/t/if-cloud-availability-zone-in-metric-logs-is-set-to-number-metadata-view-in-kibana-is-failing/285887)
**Author:** [@molsza](https://discuss.elastic.co/u/molsza)\ **Replies:** 4\ **Last updated:** [October 27, 2021, 1:18pm UTC](https://discuss.elastic.co/t/if-cloud-availability-zone-in-metric-logs-is-set-to-number-metadata-view-in-kibana-is-failing/285887 "2021-10-27T13:18:47Z")
In metricbeat settings I am setting cloud/availability\_zone to numbers. It is working in main views of metrics in kibana except this one: https://localhost/kibana/app/metrics/detail/host/\ You can navigate t… --- ## [Filebeat: How to convert data from bytes to mb in a Kibana panel?](https://discuss.elastic.co/t/filebeat-how-to-convert-data-from-bytes-to-mb-in-a-kibana-panel/287798)
**Author:** [@elasticfran](https://discuss.elastic.co/u/elasticfran)\ **Replies:** 1\ **Last updated:** [October 27, 2021, 1:17pm UTC](https://discuss.elastic.co/t/filebeat-how-to-convert-data-from-bytes-to-mb-in-a-kibana-panel/287798 "2021-10-27T13:17:47Z")
Hey there! I am building a panel in Kibana. My source is a field in Filebeat called network.bytes. Does anyone know how to convert it ( and visualize it ) from bytes to mb or even gb? Thanks --- ## [Resources for modeling application log data?](https://discuss.elastic.co/t/resources-for-modeling-application-log-data/285849)
**Author:** [@swainstead](https://discuss.elastic.co/u/swainstead)\ **Replies:** 3\ **Last updated:** [October 27, 2021, 12:58pm UTC](https://discuss.elastic.co/t/resources-for-modeling-application-log-data/285849 "2021-10-27T12:58:21Z")
I've been working with our application logging and creating Kibana dashboards for a little while now. I wonder though if I'm missing some best practices or techniques for designing the log messages themselves to get the… --- ## [Security error after re-install of ElasticSearch](https://discuss.elastic.co/t/security-error-after-re-install-of-elasticsearch/287593)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 4\ **Last updated:** [October 27, 2021, 12:16pm UTC](https://discuss.elastic.co/t/security-error-after-re-install-of-elasticsearch/287593 "2021-10-27T12:16:37Z")
Good Morning I have been receiving multiple messages that read Error: \[object Object\]: shard\_not\_found\_exception at http://10.12.36.50:5601/41022/bundles/plugin/data/kibana/data.plugin.js:1:361224 at async index… --- ## [Values of type: VALUE\_NULL](https://discuss.elastic.co/t/values-of-type-value-null/286492)
**Author:** [@ebosdev](https://discuss.elastic.co/u/ebosdev)\ **Replies:** 3\ **Last updated:** [October 27, 2021, 12:12pm UTC](https://discuss.elastic.co/t/values-of-type-value-null/286492 "2021-10-27T12:12:34Z")
Hello everyone, I am trying to visualize a timelion and this is the query i am using: .es(index=investigation\_master\_index,timefield=uco-observable:sentTime.@value,split=uco-observable:messageText.keyword:1000) the me… --- ## [\_source is stored in elasticsearch?](https://discuss.elastic.co/t/source-is-stored-in-elasticsearch/287789)
**Author:** [@Francisco\_Gomez1](https://discuss.elastic.co/u/Francisco_Gomez1)\ **Replies:** 0\ **Last updated:** [October 27, 2021, 11:21am UTC](https://discuss.elastic.co/t/source-is-stored-in-elasticsearch/287789 "2021-10-27T11:21:27Z")
Hi. We are currently checking the capabilities of our cluster, and we noticed that when consult the information in Kibana discover, a json document contains both a "\_source" with all the fields and a separate field call… --- ## [Not able to access Kibana remotely. Request timeout after 3000ms](https://discuss.elastic.co/t/not-able-to-access-kibana-remotely-request-timeout-after-3000ms/287776)
**Author:** [@The\_Man](https://discuss.elastic.co/u/The_Man)\ **Replies:** 1\ **Last updated:** [October 27, 2021, 11:13am UTC](https://discuss.elastic.co/t/not-able-to-access-kibana-remotely-request-timeout-after-3000ms/287776 "2021-10-27T11:13:06Z")
I am not able to remotely access kibana using my http://publicip:5601 kibana.yml # Kibana is served by a back end server. This setting specifies the port to use. #server.port: 5601 # Specifies the address to which the… --- ## [Get key field mapping of flatten field](https://discuss.elastic.co/t/get-key-field-mapping-of-flatten-field/287783)
**Author:** [@ewolfman](https://discuss.elastic.co/u/ewolfman)\ **Replies:** 0\ **Last updated:** [October 27, 2021, 10:01am UTC](https://discuss.elastic.co/t/get-key-field-mapping-of-flatten-field/287783 "2021-10-27T10:01:20Z")
Hi, I have a use case for storing a map of key-value items. The keys are not likely to vary from one document to another, but I do not know them in advance. Therefore I am using dynamic\_templates in order to index them.… --- ## [Suricata logs logstash filter](https://discuss.elastic.co/t/suricata-logs-logstash-filter/287779)
**Author:** [@algira37](https://discuss.elastic.co/u/algira37)\ **Replies:** 0\ **Last updated:** [October 27, 2021, 9:29am UTC](https://discuss.elastic.co/t/suricata-logs-logstash-filter/287779 "2021-10-27T09:29:55Z")
Hello guys, Filbeat shipping eve.json to logstash and logstash dynamically maps fields and sends to Elasticsearch. Unfortunately, these logs are too much, lots of useless information for my project so I would like to c… --- ## [20 seconds downtime when swapping alias](https://discuss.elastic.co/t/20-seconds-downtime-when-swapping-alias/287739)
**Author:** [@morland96](https://discuss.elastic.co/u/morland96)\ **Replies:** 7\ **Last updated:** [October 27, 2021, 9:14am UTC](https://discuss.elastic.co/t/20-seconds-downtime-when-swapping-alias/287739 "2021-10-27T09:14:11Z")
Hi all. I have a service requires zero down time. Since the data need to be versionized, our pipeline will ingest data every day into a new index. After the new index is "green" and able to search, we simply swap the ali… --- ## [Elasticsearch output pipeline error with api\_key](https://discuss.elastic.co/t/elasticsearch-output-pipeline-error-with-api-key/287618)
**Author:** [@Wonder\_Garance](https://discuss.elastic.co/u/Wonder_Garance)\ **Replies:** 3\ **Last updated:** [October 27, 2021, 8:49am UTC](https://discuss.elastic.co/t/elasticsearch-output-pipeline-error-with-api-key/287618 "2021-10-27T08:49:09Z")
Hello, I created a Logstash config to send files on index of Elasticsearch 7.15.1, on the same server. I got this error \[ERROR\]\[logstash.javapipeline \]\[main\] Pipeline error {:pipeline\_id=\>"main", :exception=\>#\ **Author:** [@KeithTt](https://discuss.elastic.co/u/KeithTt)\ **Replies:** 0\ **Last updated:** [October 27, 2021, 7:56am UTC](https://discuss.elastic.co/t/how-to-specify-the-time-range-with-search-api/287769 "2021-10-27T07:56:40Z") The request body like this: "range": { "time\_iso8601": { "gte": now.shift(days=-1).floor('day').timestamp() \* 1000, "lte": now.shift(days=-1).ceil('day').timestamp() \* 1000, "format": "epoch\_… --- ## [How to integrate one kibana with multiple elatsicsearch](https://discuss.elastic.co/t/how-to-integrate-one-kibana-with-multiple-elatsicsearch/287764)
**Author:** [@Radhikag815](https://discuss.elastic.co/u/Radhikag815)\ **Replies:** 1\ **Last updated:** [October 27, 2021, 7:34am UTC](https://discuss.elastic.co/t/how-to-integrate-one-kibana-with-multiple-elatsicsearch/287764 "2021-10-27T07:34:39Z")
I need to integrate multiple elaticsearch with one kibana dashboard so whenever I search for query it will search in both the elastic and display result in one console. Please help me I am new in this ELK. --- ## [Rejections in Thread\_Pool v6.2.4](https://discuss.elastic.co/t/rejections-in-thread-pool-v6-2-4/287689)
**Author:** [@CCCowboy](https://discuss.elastic.co/u/CCCowboy)\ **Replies:** 4\ **Last updated:** [October 27, 2021, 7:02am UTC](https://discuss.elastic.co/t/rejections-in-thread-pool-v6-2-4/287689 "2021-10-27T07:02:42Z")
I have a problem with a node (different each time) that stops responding. When checking \_cat/thread\_pool in "hanging mode", the GET queue is full and have started rejected requests. The log file, though, indicates that … --- ## [EOL / End of life and support topic](https://discuss.elastic.co/t/eol-end-of-life-and-support-topic/287756)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 2\ **Last updated:** [October 27, 2021, 6:54am UTC](https://discuss.elastic.co/t/eol-end-of-life-and-support-topic/287756 "2021-10-27T06:54:45Z")
Dear Elastic Team, I have a gold support. My 7.8 environment reaches EOL in the mid of December. Does it mean I cannot open issues anymore in case of need after that day? By the way: I am planning the follwoing upgrad… --- ## [How to find which IP most requests to elasticsearch come from?](https://discuss.elastic.co/t/how-to-find-which-ip-most-requests-to-elasticsearch-come-from/287538)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 7\ **Last updated:** [October 27, 2021, 6:41am UTC](https://discuss.elastic.co/t/how-to-find-which-ip-most-requests-to-elasticsearch-come-from/287538 "2021-10-27T06:41:46Z")
Hello friends, my Elasticsearch server is constantly receiving requests from other IPs. Is it possible to find out from which IP the most requests are received? Any ideas will help me thank you in advance. --- ## [How to add a timestamp from the previous line to the current line](https://discuss.elastic.co/t/how-to-add-a-timestamp-from-the-previous-line-to-the-current-line/287600)
**Author:** [@anoopahamad](https://discuss.elastic.co/u/anoopahamad)\ **Replies:** 6\ **Last updated:** [October 27, 2021, 5:18am UTC](https://discuss.elastic.co/t/how-to-add-a-timestamp-from-the-previous-line-to-the-current-line/287600 "2021-10-27T05:18:32Z")
In my log file, some of the lines don't have a timestamp. I want to assign the previous line's timestamp to the lines that don't have the timestamp. I tried "memorize" but that's giving some errors. Is there a way we… --- ## [Agg results can't support long words](https://discuss.elastic.co/t/agg-results-cant-support-long-words/286590)
**Author:** [@carpeDiem](https://discuss.elastic.co/u/carpeDiem)\ **Replies:** 4\ **Last updated:** [October 27, 2021, 3:41am UTC](https://discuss.elastic.co/t/agg-results-cant-support-long-words/286590 "2021-10-27T03:41:34Z")
Hello experts, I'm currently trying to excute aggregate request,but I can't get some results which the field value is a little long,and I can't find any information for the length of field value to aggregate on guide,th… --- ## [\[DOCS\] Where can I find the newest 7.15 guide docs zh-CN versions?](https://discuss.elastic.co/t/docs-where-can-i-find-the-newest-7-15-guide-docs-zh-cn-versions/287662)
**Author:** [@xiongjiamu](https://discuss.elastic.co/u/xiongjiamu)\ **Replies:** 3\ **Last updated:** [October 27, 2021, 2:04am UTC](https://discuss.elastic.co/t/docs-where-can-i-find-the-newest-7-15-guide-docs-zh-cn-versions/287662 "2021-10-27T02:04:22Z")
HI there I am a beginner for Elasticsearch, and it is not very convenient for me to read the guide book with English. I't very nice that you have gave us a Chinese guide book here https://www.elastic.co/guide/cn/elasti… --- ## [Suricata integration parsing issues](https://discuss.elastic.co/t/suricata-integration-parsing-issues/284954)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 3\ **Last updated:** [October 27, 2021, 2:02am UTC](https://discuss.elastic.co/t/suricata-integration-parsing-issues/284954 "2021-10-27T02:02:07Z")
I'm running 7.14.1 with an Elastic agent trying to pick up eve.json files using the suricata integration. Somewhere along the line it is not able to correctly parse the events. Here is the error I'm getting : {\\"type\\… --- ## [Tomcat logs are seeing appearing in order in discover section in kibana](https://discuss.elastic.co/t/tomcat-logs-are-seeing-appearing-in-order-in-discover-section-in-kibana/286969)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 31\ **Last updated:** [October 26, 2021, 10:03pm UTC](https://discuss.elastic.co/t/tomcat-logs-are-seeing-appearing-in-order-in-discover-section-in-kibana/286969 "2021-10-26T22:03:55Z")
Hi Team, I have tomcat application running on two servers and sending logs to logstash through filebeat, when checking logs in discover section of kibana, I am not seeing exact sequence of logs in kibana as in server. f… --- ## [Handle event if http output finally fails](https://discuss.elastic.co/t/handle-event-if-http-output-finally-fails/287727)
**Author:** [@jporzelt](https://discuss.elastic.co/u/jporzelt)\ **Replies:** 1\ **Last updated:** [October 26, 2021, 9:50pm UTC](https://discuss.elastic.co/t/handle-event-if-http-output-finally-fails/287727 "2021-10-26T21:50:11Z")
Hi all, we are using Logstash for first time in a project and we are using it to process e-mails (imap input), transform some fields and send the event to an http output (Http output plugin | Logstash Reference \[7.15\] |… --- ## [Implicit search terms](https://discuss.elastic.co/t/implicit-search-terms/287710)
**Author:** [@Ramzay](https://discuss.elastic.co/u/Ramzay)\ **Replies:** 1\ **Last updated:** [October 26, 2021, 9:44pm UTC](https://discuss.elastic.co/t/implicit-search-terms/287710 "2021-10-26T21:44:01Z")
Our index contains documents with the optional field Category. We need to search by default only the documents that have no category, and search for the documents with category only if the specific category provided exp… --- ## [Output When Data in Field is a Specific Value](https://discuss.elastic.co/t/output-when-data-in-field-is-a-specific-value/287733)
**Author:** [@Wilks](https://discuss.elastic.co/u/Wilks)\ **Replies:** 1\ **Last updated:** [October 26, 2021, 9:43pm UTC](https://discuss.elastic.co/t/output-when-data-in-field-is-a-specific-value/287733 "2021-10-26T21:43:49Z")
Hi, I want to know only output a field called network.application when it contains the value ALPHA but I am getting an error that Expected one of \[ \\t\\r\\n\], "#", "{" at line 152, column 7 (byte 3941) after output { if… --- ## [Inconsistent results when search\_after is used for pagination sorted by score and id](https://discuss.elastic.co/t/inconsistent-results-when-search-after-is-used-for-pagination-sorted-by-score-and-id/286554)
**Author:** [@vjgorla](https://discuss.elastic.co/u/vjgorla)\ **Replies:** 3\ **Last updated:** [October 26, 2021, 7:14pm UTC](https://discuss.elastic.co/t/inconsistent-results-when-search-after-is-used-for-pagination-sorted-by-score-and-id/286554 "2021-10-26T19:14:28Z")
We have implemented pagination using search\_after and sorting the results by \_score and a unique id field as a tie-breaker. However sometimes we are getting duplicate results across pages, and other times matches do not … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=791) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=793)