# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=807 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 808 --- ## [Is Elasticsearch the right solution for regularly updated content search?](https://discuss.elastic.co/t/is-elasticsearch-the-right-solution-for-regularly-updated-content-search/286322)
**Author:** [@renegademarketer](https://discuss.elastic.co/u/renegademarketer)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 1:24am UTC](https://discuss.elastic.co/t/is-elasticsearch-the-right-solution-for-regularly-updated-content-search/286322 "2021-10-11T01:24:26Z")
I have the following use case and I'm not sure if Elasticsearch/Elasticpress is the right solution. I want to do the following: User will search WordPress custom post types (CPT), its taxonomies, custom fields (CF), an… --- ## [What is proper index naming policy for log monitoring?](https://discuss.elastic.co/t/what-is-proper-index-naming-policy-for-log-monitoring/285898)
**Author:** [@Hur](https://discuss.elastic.co/u/Hur)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 1:14am UTC](https://discuss.elastic.co/t/what-is-proper-index-naming-policy-for-log-monitoring/285898 "2021-10-11T01:14:09Z")
Hello, I have an question about the index naming policy for log monitoring. As a purpose of saving log, what is the recommended index naming policy? Are there any good ES skills to handle a number of indices? Simply, … --- ## [No alive nodes found in your cluster](https://discuss.elastic.co/t/no-alive-nodes-found-in-your-cluster/285946)
**Author:** [@dreamte](https://discuss.elastic.co/u/dreamte)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 1:13am UTC](https://discuss.elastic.co/t/no-alive-nodes-found-in-your-cluster/285946 "2021-10-11T01:13:05Z")
Hello, periodically (with an increase in the frequency of the number of additions to the index) an error occurs - no active nodes were found in your cluster. My configuration: cluster.name: elk\_test node.name: elk\_tes… --- ## [Using Elastic Services with XenForo Forum software](https://discuss.elastic.co/t/using-elastic-services-with-xenforo-forum-software/285960)
**Author:** [@tommythejoat](https://discuss.elastic.co/u/tommythejoat)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 1:10am UTC](https://discuss.elastic.co/t/using-elastic-services-with-xenforo-forum-software/285960 "2021-10-11T01:10:27Z")
Does anyone have experience using Elastic services like Eastic Cloud with third party products like the Extended Search facility for XenForo forum system? We are currently running Elasticsearch 7.14.0 on an in house sys… --- ## [Logstash change port](https://discuss.elastic.co/t/logstash-change-port/285895)
**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\ **Replies:** 8\ **Last updated:** [October 11, 2021, 1:06am UTC](https://discuss.elastic.co/t/logstash-change-port/285895 "2021-10-11T01:06:54Z")
Logstash is running on 9600 by default and I want to run another logstash on same system Is there opion to change default port for logstash I don't want to use beats for this. beacuse I want to run two logstash with d… --- ## [Indexed documents with composite \_id collide](https://discuss.elastic.co/t/indexed-documents-with-composite-id-collide/286073)
**Author:** [@Jason-Leap](https://discuss.elastic.co/u/Jason-Leap)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 1:02am UTC](https://discuss.elastic.co/t/indexed-documents-with-composite-id-collide/286073 "2021-10-11T01:02:16Z")
Hi guys. I've found some interesting behaviour that I was hoping to get some clarification on. Let's say I perform a bulk index of two documents like so: curl --request POST \\ --url \/\/\_bulk \\ --header… --- ## [Could not find logstash.yml file despite the file being located in the default directory](https://discuss.elastic.co/t/could-not-find-logstash-yml-file-despite-the-file-being-located-in-the-default-directory/286084)
**Author:** [@Johnny\_Cash\_Cow](https://discuss.elastic.co/u/Johnny_Cash_Cow)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 12:52am UTC](https://discuss.elastic.co/t/could-not-find-logstash-yml-file-despite-the-file-being-located-in-the-default-directory/286084 "2021-10-11T00:52:42Z")
Good Evening, Here is the layout of my directory: Within /etc/logstash/ is the following files and directories: conf.d log4j2.properties logstash.yml startup.options jvm.options logstash-sample.conf piple… --- ## [Add data nodes in peak time](https://discuss.elastic.co/t/add-data-nodes-in-peak-time/286175)
**Author:** [@yukai](https://discuss.elastic.co/u/yukai)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 12:36am UTC](https://discuss.elastic.co/t/add-data-nodes-in-peak-time/286175 "2021-10-11T00:36:34Z")
Hi, I have a self-managed Elasticsearch cluster with 3 dedicated master nodes, in peak time I would simply add data nodes to increase cluster throughput. And I don't think this action would bring any side affects to the… --- ## [How to assign an Alias in an existing Index](https://discuss.elastic.co/t/how-to-assign-an-alias-in-an-existing-index/286233)
**Author:** [@qttv](https://discuss.elastic.co/u/qttv)\ **Replies:** 5\ **Last updated:** [October 11, 2021, 12:26am UTC](https://discuss.elastic.co/t/how-to-assign-an-alias-in-an-existing-index/286233 "2021-10-11T00:26:22Z")
Good Morning, I'm using Kibana version 7.0, and I need to assign an alias to a filed into an existing Index that i can't delete. This field is named "processName" and I need to rename it as "processname". I read the do… --- ## [Queries about indexing data into elastic search](https://discuss.elastic.co/t/queries-about-indexing-data-into-elastic-search/285542)
**Author:** [@Magesh\_02](https://discuss.elastic.co/u/Magesh_02)\ **Replies:** 3\ **Last updated:** [October 10, 2021, 11:06pm UTC](https://discuss.elastic.co/t/queries-about-indexing-data-into-elastic-search/285542 "2021-10-10T23:06:24Z")
I have some questions regarding indexing the data. In my case, I needed to push 100 million JSON records into a single index on a specific date, and the date had to be included in the JSON field. I imported this data in… --- ## [How to create an array in logstash with already defined fields](https://discuss.elastic.co/t/how-to-create-an-array-in-logstash-with-already-defined-fields/286086)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 0\ **Last updated:** [October 7, 2021, 2:35am UTC](https://discuss.elastic.co/t/how-to-create-an-array-in-logstash-with-already-defined-fields/286086 "2021-10-07T02:35:28Z")
Good, I have a doubt and is that I have some specific oids already named and I would like to know how I can do to concatenate them, that is to say to put them in an array or table, so that it contains me all the oids tha… --- ## [Measure volume of events we are consuming(Size of all input events arrived)](https://discuss.elastic.co/t/measure-volume-of-events-we-are-consuming-size-of-all-input-events-arrived/286113)
**Author:** [@Dhananjay\_vispute](https://discuss.elastic.co/u/Dhananjay_vispute)\ **Replies:** 0\ **Last updated:** [October 7, 2021, 9:46am UTC](https://discuss.elastic.co/t/measure-volume-of-events-we-are-consuming-size-of-all-input-events-arrived/286113 "2021-10-07T09:46:55Z")
I have added metric to count number events as input, dropped and arrived at output. I also want to measure size of all input events bytes. Is there any way we achieve this through metrics ? --- ## [Thread pool queue size suddenly spikes to thousands](https://discuss.elastic.co/t/thread-pool-queue-size-suddenly-spikes-to-thousands/286176)
**Author:** [@vibgy](https://discuss.elastic.co/u/vibgy)\ **Replies:** 4\ **Last updated:** [October 10, 2021, 10:16pm UTC](https://discuss.elastic.co/t/thread-pool-queue-size-suddenly-spikes-to-thousands/286176 "2021-10-10T22:16:57Z")
Every once in a while, thread pool queue size suddenly spike to thousands When this happens, users start to notice that kibana becomes pretty much unresponsive, for minutes. In the above case, it became unresponsive … --- ## [How to parse two timestamp fields from one single log line message](https://discuss.elastic.co/t/how-to-parse-two-timestamp-fields-from-one-single-log-line-message/286282)
**Author:** [@Patr123](https://discuss.elastic.co/u/Patr123)\ **Replies:** 6\ **Last updated:** [October 10, 2021, 3:33pm UTC](https://discuss.elastic.co/t/how-to-parse-two-timestamp-fields-from-one-single-log-line-message/286282 "2021-10-10T15:33:30Z")
Hello All, I have log lines coming from K8's to logstash and they have two timestamps back to back. How can I parse those fields in let's say @timestamp field and timestamp2 field? My log lines look like: 2021-10-08 1… --- ## [Memory, storage and CPU requirements depending on node roles](https://discuss.elastic.co/t/memory-storage-and-cpu-requirements-depending-on-node-roles/286294)
**Author:** [@flavienbwk](https://discuss.elastic.co/u/flavienbwk)\ **Replies:** 3\ **Last updated:** [October 10, 2021, 2:58pm UTC](https://discuss.elastic.co/t/memory-storage-and-cpu-requirements-depending-on-node-roles/286294 "2021-10-10T14:58:38Z")
Hi, Has anyone any intuition about what are the memory, storage and CPU requirements depending on node roles ? Is the following intuition right ? Coordinating nodes : high CPU, low memory Master-only nodes : high CPU… --- ## [Some thoughts on adding new Analyzer to existing Index without reindex or close](https://discuss.elastic.co/t/some-thoughts-on-adding-new-analyzer-to-existing-index-without-reindex-or-close/285242)
**Author:** [@garyzjq](https://discuss.elastic.co/u/garyzjq)\ **Replies:** 5\ **Last updated:** [October 10, 2021, 12:19pm UTC](https://discuss.elastic.co/t/some-thoughts-on-adding-new-analyzer-to-existing-index-without-reindex-or-close/285242 "2021-10-10T12:19:57Z")
Hi team, (Elasticsearch 7.5) My scenario is to add a new custom Analyzer to an existing Index. Analyzer definition may like below: { "analyzer": { "ngram\_analyzer": { "type": "custom", … --- ## [Get a count of buckets from a terms agg, but not the buckets themselves](https://discuss.elastic.co/t/get-a-count-of-buckets-from-a-terms-agg-but-not-the-buckets-themselves/286259)
**Author:** [@annmarie-switzer](https://discuss.elastic.co/u/annmarie-switzer)\ **Replies:** 1\ **Last updated:** [October 10, 2021, 7:58am UTC](https://discuss.elastic.co/t/get-a-count-of-buckets-from-a-terms-agg-but-not-the-buckets-themselves/286259 "2021-10-10T07:58:40Z")
Is there any way to get the bucket count from a terms agg, but just the count, not the buckets themselves? I have a scenario where I want to display a table (with pagination) of all the non-unique values (buckets) for … --- ## [Error: Unknown key for a VALUE\_STRING in \[analyzer\]](https://discuss.elastic.co/t/error-unknown-key-for-a-value-string-in-analyzer/286105)
**Author:** [@Drsaud](https://discuss.elastic.co/u/Drsaud)\ **Replies:** 10\ **Last updated:** [October 10, 2021, 7:37am UTC](https://discuss.elastic.co/t/error-unknown-key-for-a-value-string-in-analyzer/286105 "2021-10-10T07:37:23Z")
Hi, I'm having this error in postman Unknown key for a VALUE\_STRING in \[analyzer\]. when I search like this: (note I get this after I add the analyzer) { "query": { "terms": { "username": … --- ## [Parsing nested json with logstash](https://discuss.elastic.co/t/parsing-nested-json-with-logstash/286287)
**Author:** [@diaztech](https://discuss.elastic.co/u/diaztech)\ **Replies:** 3\ **Last updated:** [October 10, 2021, 12:44am UTC](https://discuss.elastic.co/t/parsing-nested-json-with-logstash/286287 "2021-10-10T00:44:57Z")
I'm trying to import a collection from mongo with the following input input { mongodb { uri =\> "uripath" placeholder\_db\_dir =\> "../opt/logstash-mongodb/" placeholder\_db\_name =\> "logstash\_sqli… --- ## [Import text file to logstash](https://discuss.elastic.co/t/import-text-file-to-logstash/286303)
**Author:** [@quyennguyen](https://discuss.elastic.co/u/quyennguyen)\ **Replies:** 1\ **Last updated:** [October 9, 2021, 6:45pm UTC](https://discuss.elastic.co/t/import-text-file-to-logstash/286303 "2021-10-09T18:45:24Z")
I had some text files with formats like this. 10/09-22:09:34.989323 \[\*\*\] \[1:100000015:3\] "OR SQL Injection Detected" \[\*\*\] \[Priority: 0\] {TCP} 192.168.186.25:44748 -\> 192.168.186.162:80 10/09-22:09:34.989323 \[\*\*\] \[1:1000… --- ## [Custom Plugin add filter to search query by external access policies](https://discuss.elastic.co/t/custom-plugin-add-filter-to-search-query-by-external-access-policies/285723)
**Author:** [@David\_Sheard](https://discuss.elastic.co/u/David_Sheard)\ **Replies:** 5\ **Last updated:** [October 9, 2021, 12:24am UTC](https://discuss.elastic.co/t/custom-plugin-add-filter-to-search-query-by-external-access-policies/285723 "2021-10-09T00:24:46Z")
Hi, I'm wanting to create a custom plugin. The purpose is to make a rest call to an external service to apply access control polices to search requests. Is there any sample code or an article that would assist? Appreci… --- ## [Searching through every document in ES?](https://discuss.elastic.co/t/searching-through-every-document-in-es/286281)
**Author:** [@bensalerno](https://discuss.elastic.co/u/bensalerno)\ **Replies:** 7\ **Last updated:** [October 8, 2021, 11:13pm UTC](https://discuss.elastic.co/t/searching-through-every-document-in-es/286281 "2021-10-08T23:13:56Z")
My cluster has roughly 300,000 documents in it. Right now, I'm only able to query 10,000 at a time. Is there a way to query through all documents? Or is this bad practice? Many of search queries are returning 0 results … --- ## [Frozen Indices Deprecation](https://discuss.elastic.co/t/frozen-indices-deprecation/286288)
**Author:** [@vthacker](https://discuss.elastic.co/u/vthacker)\ **Replies:** 1\ **Last updated:** [October 9, 2021, 12:06am UTC](https://discuss.elastic.co/t/frozen-indices-deprecation/286288 "2021-10-09T00:06:50Z")
Watching this recent talk frozen indices sounds like a feature recommended to users However when I look at the doc here the feature is deprecated. I'm not sure which one to read into - Is the feature going to exist goi… --- ## [Issue with FSCrawler (fscrawler-es7-2.7) . Refusing to upload new files . Warning: set filename as stored field!](https://discuss.elastic.co/t/issue-with-fscrawler-fscrawler-es7-2-7-refusing-to-upload-new-files-warning-set-filename-as-stored-field/286272)
**Author:** [@Francois\_Saab](https://discuss.elastic.co/u/Francois_Saab)\ **Replies:** 1\ **Last updated:** [October 8, 2021, 11:15pm UTC](https://discuss.elastic.co/t/issue-with-fscrawler-fscrawler-es7-2-7-refusing-to-upload-new-files-warning-set-filename-as-stored-field/286272 "2021-10-08T23:15:06Z")
We are facing an issue with FSCrawler (fscrawler-es7-2.7). FSCrawler is refusing to upload new files and raises the below error: 08:37:04,730 WARN \[f.p.e.c.f.FsParserAbstract\] Error while crawling \\SearchEngineFiles\\D… --- ## [Warn users when they do unindexed searches](https://discuss.elastic.co/t/warn-users-when-they-do-unindexed-searches/286164)
**Author:** [@vibgy](https://discuss.elastic.co/u/vibgy)\ **Replies:** 5\ **Last updated:** [October 8, 2021, 6:23pm UTC](https://discuss.elastic.co/t/warn-users-when-they-do-unindexed-searches/286164 "2021-10-08T18:23:58Z")
We have observed in our stack that a lot of the users are making queries without specifying a single indexed field. And we would like to soft-warn our users when they do so. What would be the best way to implement somet… --- ## [Append nested variable's value to a string](https://discuss.elastic.co/t/append-nested-variables-value-to-a-string/285470)
**Author:** [@Voolkan](https://discuss.elastic.co/u/Voolkan)\ **Replies:** 6\ **Last updated:** [October 8, 2021, 3:10pm UTC](https://discuss.elastic.co/t/append-nested-variables-value-to-a-string/285470 "2021-10-08T15:10:49Z")
Hello, I'm trying to setup a bit of a dynamic solution to the logstash config, and especially the json filter part. When setting the json part, I need to provide a source and a target fields. With source it's easy, howe… --- ## [Subtracting 2 fields different document on Scripted Field / json input](https://discuss.elastic.co/t/subtracting-2-fields-different-document-on-scripted-field-json-input/286203)
**Author:** [@rikizita3](https://discuss.elastic.co/u/rikizita3)\ **Replies:** 1\ **Last updated:** [October 8, 2021, 2:44pm UTC](https://discuss.elastic.co/t/subtracting-2-fields-different-document-on-scripted-field-json-input/286203 "2021-10-08T14:44:12Z")
I have a set of data below. I want to add the red marker then subtract it to the blue marker. I tried using Scripted Field. But when I go back to discovery I have this error. If I will put it on the line gra… --- ## [Dissect Logs](https://discuss.elastic.co/t/dissect-logs/286048)
**Author:** [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\ **Replies:** 7\ **Last updated:** [October 8, 2021, 2:41pm UTC](https://discuss.elastic.co/t/dissect-logs/286048 "2021-10-08T14:41:53Z")
I simply want to turn key:value data from a message string into fields in Elastic, so I can analyze the logs with Kibana. I'd like to use Dissect to do the following: Dissecting this log: conn=10 op=221996 RESULT err=… --- ## [Pipeline error {:pipeline\_id=\>"main", :exception=\>#\ **Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 1\ **Last updated:** [October 8, 2021, 2:35pm UTC](https://discuss.elastic.co/t/pipeline-error-pipeline-id-main-exception-logstash-unexpected-character-code-58-expected-a-valid-value-number-string-array-object-true-false-or-null/286252 "2021-10-08T14:35:30Z") Hello friends, I want to add some data to a new index according to a query from an existing index in elasticsearch. But I am facing a problem while doing this, I would be very happy if you could help me. my conf file: i… --- ## [Mutate gsub - re-using regex](https://discuss.elastic.co/t/mutate-gsub-re-using-regex/286243)
**Author:** [@JimJ](https://discuss.elastic.co/u/JimJ)\ **Replies:** 2\ **Last updated:** [October 8, 2021, 2:13pm UTC](https://discuss.elastic.co/t/mutate-gsub-re-using-regex/286243 "2021-10-08T14:13:06Z")
Hi everybody, I would like to parttially remove the end of a string like that: mutate { gsub =\> \[ "fieldname", "(:\[0-5\]\[0-9\].\\d{3})\\d\*$", "what\_is\_between\_brackets" \] } Context: I parse… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=806) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=808)