# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=811 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 812 --- ## [Why Elasticsearch send more data between the cluster nodes](https://discuss.elastic.co/t/why-elasticsearch-send-more-data-between-the-cluster-nodes/285046)
**Author:** [@ravindrababua](https://discuss.elastic.co/u/ravindrababua)\ **Replies:** 6\ **Last updated:** [October 5, 2021, 6:36am UTC](https://discuss.elastic.co/t/why-elasticsearch-send-more-data-between-the-cluster-nodes/285046 "2021-10-05T06:36:01Z")
We have observed ELK sending the data with in the cluster nodes, we are not sending large data as a input to Elasticsearch. when the data is tool large it throws circuit break exception and cluster goes to YELLOW, but i… --- ## [Cross Cluster Search feature on free/Basic ECK](https://discuss.elastic.co/t/cross-cluster-search-feature-on-free-basic-eck/285865)
**Author:** [@surajbisht](https://discuss.elastic.co/u/surajbisht)\ **Replies:** 1\ **Last updated:** [October 5, 2021, 3:28am UTC](https://discuss.elastic.co/t/cross-cluster-search-feature-on-free-basic-eck/285865 "2021-10-05T03:28:17Z")
Is Cross Cluster Search feature supported on free/basic ECK version Thanks, Suraj --- ## [Does watcher input uses script](https://discuss.elastic.co/t/does-watcher-input-uses-script/285868)
**Author:** [@Munavir\_Chavody](https://discuss.elastic.co/u/Munavir_Chavody)\ **Replies:** 0\ **Last updated:** [October 5, 2021, 3:11am UTC](https://discuss.elastic.co/t/does-watcher-input-uses-script/285868 "2021-10-05T03:11:06Z")
I'm getting dynamic execution circuit breaking error for many watchers in our environment saying that the input search query failed to compile. What is the reason for the same. How can we avoid such errors at all? Erro… --- ## [Split a json array and then split on each object](https://discuss.elastic.co/t/split-a-json-array-and-then-split-on-each-object/285846)
**Author:** [@devtough](https://discuss.elastic.co/u/devtough)\ **Replies:** 7\ **Last updated:** [October 4, 2021, 10:20pm UTC](https://discuss.elastic.co/t/split-a-json-array-and-then-split-on-each-object/285846 "2021-10-04T22:20:21Z")
I would like to configure Logstash so that given a JSON input of \[ { "record": "a", "actions": \[ { "id": 1 }, { "id": 2 } \] }, { "record": "b", "actions": \[ { "id": 3 }, { "id": 4 } \] } \] it outputs {record: "a"… --- ## [Improving log ingestion speed and faster elasticsearch indexing](https://discuss.elastic.co/t/improving-log-ingestion-speed-and-faster-elasticsearch-indexing/285841)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 5\ **Last updated:** [October 4, 2021, 7:23pm UTC](https://discuss.elastic.co/t/improving-log-ingestion-speed-and-faster-elasticsearch-indexing/285841 "2021-10-04T19:23:37Z")
Hello, I currently have a single node set up (a single machine where E-L-K is installed ) where a couple of gzip files are being ingested , each of these files would be of ~600MB and has several thousand lines of logs… --- ## [How to sort percentage bar by date?](https://discuss.elastic.co/t/how-to-sort-percentage-bar-by-date/285764)
**Author:** [@ShayWeizman](https://discuss.elastic.co/u/ShayWeizman)\ **Replies:** 3\ **Last updated:** [October 4, 2021, 6:34pm UTC](https://discuss.elastic.co/t/how-to-sort-percentage-bar-by-date/285764 "2021-10-04T18:34:10Z")
Hi All, I'm using v 7.11.1 I have this data structure in elastic: { "\_index" : "testcases", "\_type" : "\_doc", "\_id" : "ub0ll3sB2oqJ9931yhZw", "\_score" : 1.0, "\_source" : { "buildVersion" : "1.1.1.1", "testcase"… --- ## [How to replace logstash read time with log timing?](https://discuss.elastic.co/t/how-to-replace-logstash-read-time-with-log-timing/285834)
**Author:** [@Pradeep\_Kumar2](https://discuss.elastic.co/u/Pradeep_Kumar2)\ **Replies:** 9\ **Last updated:** [October 4, 2021, 6:25pm UTC](https://discuss.elastic.co/t/how-to-replace-logstash-read-time-with-log-timing/285834 "2021-10-04T18:25:56Z")
Hi, I am trying to configure logstash file which will replace the logstash read timestamp or system time with actual log time. In the kibana discover dashboard logs are displayed with logstash read time. How to replace … --- ## [How best to visually represent attempted (and not-attempted) combinations?](https://discuss.elastic.co/t/how-best-to-visually-represent-attempted-and-not-attempted-combinations/285692)
**Author:** [@cgmelastic](https://discuss.elastic.co/u/cgmelastic)\ **Replies:** 4\ **Last updated:** [October 4, 2021, 5:27pm UTC](https://discuss.elastic.co/t/how-best-to-visually-represent-attempted-and-not-attempted-combinations/285692 "2021-10-04T17:27:20Z")
In a game I'm playing, there is a recipe book type thing. The ingredients for a recipe are known but not the specific quantity of each ingredient required to create the recipe, only a minimum and maximum value for each. … --- ## [Parsing data from multiple application servers through logstash](https://discuss.elastic.co/t/parsing-data-from-multiple-application-servers-through-logstash/285069)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 10\ **Last updated:** [October 4, 2021, 3:27pm UTC](https://discuss.elastic.co/t/parsing-data-from-multiple-application-servers-through-logstash/285069 "2021-10-04T15:27:56Z")
Hi Team, I have application running on 2 servers and application logs are getting logged on both the servers, so i want to parse logs from both servers. filebeat is installed on two application servers, logstash is in… --- ## [Grok pattern issue](https://discuss.elastic.co/t/grok-pattern-issue/284247)
**Author:** [@Divya\_Bansal](https://discuss.elastic.co/u/Divya_Bansal)\ **Replies:** 1\ **Last updated:** [October 4, 2021, 3:24pm UTC](https://discuss.elastic.co/t/grok-pattern-issue/284247 "2021-10-04T15:24:51Z")
I have two logs: one with loglevel field and one without it as mentioned below. can anyone help me with thescript processing both type of logs from single pattern. the sample logs are:- 2021-09-13T23:58:22.676 \[\] loca… --- ## [Need help in understanding query search of elastic search with sub string search](https://discuss.elastic.co/t/need-help-in-understanding-query-search-of-elastic-search-with-sub-string-search/285833)
**Author:** [@S\_basu](https://discuss.elastic.co/u/S_basu)\ **Replies:** 0\ **Last updated:** [October 4, 2021, 2:52pm UTC](https://discuss.elastic.co/t/need-help-in-understanding-query-search-of-elastic-search-with-sub-string-search/285833 "2021-10-04T14:52:32Z")
Hi All, We have created an index with analyzer which uses "keyword" as tokenizer. We have values such in a field as role\_number which may or may not contain any special character such as - or \_, for examplecontains data… --- ## [API Bug? Error enabling rule: could not create API key - Unsupported scheme \\"ApiKey\\" for granting API Key](https://discuss.elastic.co/t/api-bug-error-enabling-rule-could-not-create-api-key-unsupported-scheme-apikey-for-granting-api-key/285407)
**Author:** [@jrykowski-huron](https://discuss.elastic.co/u/jrykowski-huron)\ **Replies:** 2\ **Last updated:** [October 4, 2021, 2:48pm UTC](https://discuss.elastic.co/t/api-bug-error-enabling-rule-could-not-create-api-key-unsupported-scheme-apikey-for-granting-api-key/285407 "2021-10-04T14:48:08Z")
Authentication type is ApiKey. Version: 7.14.1 When rule is already Enabled, there is no trouble calling the API endpoint for \_enable. Returns Status Code 204. But if rule is actually Disabled (and therefore need to … --- ## [Customize Kibana URL and DNS](https://discuss.elastic.co/t/customize-kibana-url-and-dns/284744)
**Author:** [@netjammr](https://discuss.elastic.co/u/netjammr)\ **Replies:** 5\ **Last updated:** [October 4, 2021, 2:47pm UTC](https://discuss.elastic.co/t/customize-kibana-url-and-dns/284744 "2021-10-04T14:47:18Z")
I am looking at options for customizing the Kibana URL for an ECE deployment. As an example, if under Platform \> Settings the "Deployments domain name" is "myece.mydomain.com", I understand that the Kibana URL would be s… --- ## [Work with nested fields in logstash elasticsearch filter](https://discuss.elastic.co/t/work-with-nested-fields-in-logstash-elasticsearch-filter/285828)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 1\ **Last updated:** [October 4, 2021, 2:35pm UTC](https://discuss.elastic.co/t/work-with-nested-fields-in-logstash-elasticsearch-filter/285828 "2021-10-04T14:35:42Z")
hello! i want to enrich my data with the elastic filter . i tried to keep de host.hostname fields of metricbeat without success with this: elasticsearch { hosts =\> "https://xxxx:9200" index =\> "metricbeat" … --- ## [Kuromojiユーザ辞書に定義済みの単語で構成された複合語の形態素解析について](https://discuss.elastic.co/t/kuromoji/285149)
**Author:** [@hemi-n](https://discuss.elastic.co/u/hemi-n)\ **Replies:** 2\ **Last updated:** [October 4, 2021, 2:13pm UTC](https://discuss.elastic.co/t/kuromoji/285149 "2021-10-04T14:13:39Z")
Elasticsearch Version: 5.6.14 Kuromojiを使って形態素解析を行っているのですが、ユーザー辞書に登録済みの単語で構成された複合語を定義した際に想定通りに文章の単語分割が行われませんでした。 実施したいこと 文章にホタテが含まれる場合は、ホタテを1つの単語として取り扱いたい 文章にホタテのりが含まれる場合は、ホタテのりを1つの単語として取り扱いたい 設定例 curl -X PUT "localho… --- ## [Logstash does not send few log events generally the last ones](https://discuss.elastic.co/t/logstash-does-not-send-few-log-events-generally-the-last-ones/285802)
**Author:** [@Pratyush\_Rath](https://discuss.elastic.co/u/Pratyush_Rath)\ **Replies:** 6\ **Last updated:** [October 4, 2021, 1:44pm UTC](https://discuss.elastic.co/t/logstash-does-not-send-few-log-events-generally-the-last-ones/285802 "2021-10-04T13:44:28Z")
I am using an ELK stack in my local machine . I have tested sending log events from variety of inputs like file, stdin, filebeat and outputs like Elasticsearch, stdout and tried variety of combinations but the Outputs al… --- ## [Sinding date field to elastic search through logstash](https://discuss.elastic.co/t/sinding-date-field-to-elastic-search-through-logstash/285811)
**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\ **Replies:** 5\ **Last updated:** [October 4, 2021, 12:40pm UTC](https://discuss.elastic.co/t/sinding-date-field-to-elastic-search-through-logstash/285811 "2021-10-04T12:40:00Z")
I have log format as 2021-10-04 14:20:27,552 --- and I want field in Elasticsearch as date type but i am getting string type my logstash config file is input { file{ path =\> "D:/Project/ogs/\*\*/\*.log" #path =\> … --- ## [Multiple pipelines mixing records in indexes](https://discuss.elastic.co/t/multiple-pipelines-mixing-records-in-indexes/285705)
**Author:** [@Danny\_Dumenigo](https://discuss.elastic.co/u/Danny_Dumenigo)\ **Replies:** 2\ **Last updated:** [October 4, 2021, 12:35pm UTC](https://discuss.elastic.co/t/multiple-pipelines-mixing-records-in-indexes/285705 "2021-10-04T12:35:13Z")
Hello Community: Im a new user at ELK. I have deployed an ELK stack and everything works fine except for my Logstash pipelines. I explain myself: I have a Logstash server with 3 pipelines defined: Pipeline 1: Manage a… --- ## [Elastic SIEM - Keeps Logging me Out](https://discuss.elastic.co/t/elastic-siem-keeps-logging-me-out/259057)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 1\ **Last updated:** [October 4, 2021, 12:02pm UTC](https://discuss.elastic.co/t/elastic-siem-keeps-logging-me-out/259057 "2021-10-04T12:02:20Z")
Whenever I modify a rule I become forced logged out of the session. --- ## [My Indices are getting deleted automatically](https://discuss.elastic.co/t/my-indices-are-getting-deleted-automatically/285805)
**Author:** [@nnice](https://discuss.elastic.co/u/nnice)\ **Replies:** 2\ **Last updated:** [October 4, 2021, 11:58am UTC](https://discuss.elastic.co/t/my-indices-are-getting-deleted-automatically/285805 "2021-10-04T11:58:28Z")
Dear Community, I'm new to ELK. Need you assistance why my indices are getting deleted. if you could let me know what is the issue. I'll be highly obliged for that. Thank you soooo muchhhhh # ======================== E… --- ## [External provisioner is not creating volume](https://discuss.elastic.co/t/external-provisioner-is-not-creating-volume/285762)
**Author:** [@HoseinGhanbari](https://discuss.elastic.co/u/HoseinGhanbari)\ **Replies:** 4\ **Last updated:** [October 4, 2021, 11:44am UTC](https://discuss.elastic.co/t/external-provisioner-is-not-creating-volume/285762 "2021-10-04T11:44:58Z")
Recently deployed a brand new ECK and Elasticsearch Cluster using the official quickstart guide. but my external provisioner which is a NFS server through custom StorageClass is not creating the volume for Elasticsearch … --- ## [Elasticsearch - Change nodes to data only](https://discuss.elastic.co/t/elasticsearch-change-nodes-to-data-only/285007)
**Author:** [@voom](https://discuss.elastic.co/u/voom)\ **Replies:** 1\ **Last updated:** [October 4, 2021, 11:02am UTC](https://discuss.elastic.co/t/elasticsearch-change-nodes-to-data-only/285007 "2021-10-04T11:02:25Z")
Hi All, I have an 8 node cluster which is made up of the following roles: 3 master-only nodes 5 master + data nodes I am planning on having the 5 master + data nodes converted to data only and was planning on followi… --- ## [Logstash output to elasic with a pretty print JSON field, but as string (not scattered to fields)](https://discuss.elastic.co/t/logstash-output-to-elasic-with-a-pretty-print-json-field-but-as-string-not-scattered-to-fields/285804)
**Author:** [@dotaneli](https://discuss.elastic.co/u/dotaneli)\ **Replies:** 0\ **Last updated:** [October 4, 2021, 10:28am UTC](https://discuss.elastic.co/t/logstash-output-to-elasic-with-a-pretty-print-json-field-but-as-string-not-scattered-to-fields/285804 "2021-10-04T10:28:30Z")
Hi all. I have a pipline that take a JSON from filebeat. That json has fields that hold json themselvers. Escaped. I want to see in discover the json field as a pretty printed json, but think that I first need to send… --- ## [Logstash Rabbitmq connection refused?](https://discuss.elastic.co/t/logstash-rabbitmq-connection-refused/285801)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 0\ **Last updated:** [October 4, 2021, 10:15am UTC](https://discuss.elastic.co/t/logstash-rabbitmq-connection-refused/285801 "2021-10-04T10:15:56Z")
I am using multiple instances using logstash, First I get an error multiple instance error when I resolved that error. Now I am getting a new error. \[ERROR\]\[logstash.inputs.rabbitmq \] RabbitMQ connection error, will ret… --- ## [Kibana: top values and "missing" (other) values](https://discuss.elastic.co/t/kibana-top-values-and-missing-other-values/285736)
**Author:** [@fabbo](https://discuss.elastic.co/u/fabbo)\ **Replies:** 1\ **Last updated:** [October 4, 2021, 8:51am UTC](https://discuss.elastic.co/t/kibana-top-values-and-missing-other-values/285736 "2021-10-04T08:51:50Z")
I'm using Kibana 7.10.2, and I want to make a pie chart where the slices are the top values of a field. There is a slider to change the number of values. However, I seem to recall that, in older versions, there was a ti… --- ## [ECK - How to set context path for elasticsearch?](https://discuss.elastic.co/t/eck-how-to-set-context-path-for-elasticsearch/285442)
**Author:** [@x00m](https://discuss.elastic.co/u/x00m)\ **Replies:** 1\ **Last updated:** [October 4, 2021, 8:41am UTC](https://discuss.elastic.co/t/eck-how-to-set-context-path-for-elasticsearch/285442 "2021-10-04T08:41:11Z")
After eck is setup, i can reach an index via http://quickstart-es-http/ How to set a custom context path so that the Elasticsearch is reachable via http://quickstart-es-http/customcontextpath/ ? --- ## [Audit log rolling file retention question](https://discuss.elastic.co/t/audit-log-rolling-file-retention-question/283796)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 1\ **Last updated:** [October 4, 2021, 7:30am UTC](https://discuss.elastic.co/t/audit-log-rolling-file-retention-question/283796 "2021-10-04T07:30:23Z")
Our elasticsearch \_audit.json files get rolled over daily to -audit-YYYY-MM-DD.json files and appear to be kept for 8 days. For some test nodes, I'd like to reduce the number of days these are kept for disk space usage.… --- ## [Elasticsearch Reindex is slow compare to REALLOCATION](https://discuss.elastic.co/t/elasticsearch-reindex-is-slow-compare-to-reallocation/285785)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 7\ **Last updated:** [October 4, 2021, 7:19am UTC](https://discuss.elastic.co/t/elasticsearch-reindex-is-slow-compare-to-reallocation/285785 "2021-10-04T07:19:27Z")
Hello Team I am using Elasticsearch version 7.8.0. I have opened this thread for my understanding in regards to Elasticsearch internal operations. A Cluster Version : 5.6.3.0 B Cluster Version : 7.8.0.0 We are not u… --- ## [Alternative option of shingle token filter](https://discuss.elastic.co/t/alternative-option-of-shingle-token-filter/285787)
**Author:** [@ankurpatel](https://discuss.elastic.co/u/ankurpatel)\ **Replies:** 0\ **Last updated:** [October 4, 2021, 7:18am UTC](https://discuss.elastic.co/t/alternative-option-of-shingle-token-filter/285787 "2021-10-04T07:18:59Z")
I would like to implement auto suggest functionality just like google search. Shingle Token Filter is best suitable option for my requirement. Let me explain my index details. Index size is 16gb - 20 million documents.… --- ## [Elasticsearch Index Split](https://discuss.elastic.co/t/elasticsearch-index-split/285649)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 4\ **Last updated:** [October 4, 2021, 6:33am UTC](https://discuss.elastic.co/t/elasticsearch-index-split/285649 "2021-10-04T06:33:28Z")
Hello Team I am using Elasticsearch version 7.8.0 I used API "SPLIT" to break my big index into multiple shards. After split was concluded successfully.... I found that my new SPLITTED Index \[ myindex-000797-sp \] is … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=810) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=812)