# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=818 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 819 --- ## [Recommanded shards size includes replicas or not?](https://discuss.elastic.co/t/recommanded-shards-size-includes-replicas-or-not/285203)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 2\ **Last updated:** [September 27, 2021, 9:03am UTC](https://discuss.elastic.co/t/recommanded-shards-size-includes-replicas-or-not/285203 "2021-09-27T09:03:19Z")
Hello, Documentation says : Aim for shard sizes between 10GB and 50GB but does not specifiy if it concerns only primary or primary AND replicas I mean, I have an index of 200GB and wants 1 replica. So total index size… --- ## [Graphic display of questions in different time frames](https://discuss.elastic.co/t/graphic-display-of-questions-in-different-time-frames/285150)
**Author:** [@cheerone](https://discuss.elastic.co/u/cheerone)\ **Replies:** 1\ **Last updated:** [September 27, 2021, 8:09am UTC](https://discuss.elastic.co/t/graphic-display-of-questions-in-different-time-frames/285150 "2021-09-27T08:09:00Z")
I use metricbeat system module collect servers data. When i choose "last 30 minutes" "last 24 hours" and "today",the data shown in the graph is too different. Can you explain why this is happening? Is it a statistical p… --- ## [Logstash неправильно интерпритирует входящие данные](https://discuss.elastic.co/t/logstash/284158)
**Author:** [@hellotty](https://discuss.elastic.co/u/hellotty)\ **Replies:** 3\ **Last updated:** [September 27, 2021, 7:46am UTC](https://discuss.elastic.co/t/logstash/284158 "2021-09-27T07:46:21Z")
Добрый день. Я передаю логи mdaemon с помощью filebeat и использую "multiline.pattern" для объединения строк в одно событие. С помощью logstash я создаю поля "mail from", "mail to", "message id" и т.д. И при написании … --- ## [Missing Hosts in Visulization](https://discuss.elastic.co/t/missing-hosts-in-visulization/285197)
**Author:** [@BoKu](https://discuss.elastic.co/u/BoKu)\ **Replies:** 0\ **Last updated:** [September 27, 2021, 7:41am UTC](https://discuss.elastic.co/t/missing-hosts-in-visulization/285197 "2021-09-27T07:41:33Z")
Hello, yesterday we noticed a strange problem. We depolyed 19 Nginx-VMs with Terraform / Ansible, those 19 VMs had the exactly the same configuration, regarding the filebeat config. In Kibana / Discover we were able to… --- ## [Kibana Crash after upgrade from 7.12](https://discuss.elastic.co/t/kibana-crash-after-upgrade-from-7-12/285128)
**Author:** [@ondemand](https://discuss.elastic.co/u/ondemand)\ **Replies:** 2\ **Last updated:** [September 27, 2021, 7:02am UTC](https://discuss.elastic.co/t/kibana-crash-after-upgrade-from-7-12/285128 "2021-09-27T07:02:53Z")
I previously install 7.12 on my Mac with Brew, after upgrade to 7.15, Kibana failed to start with below error: FATAL Error: Unable to complete saved object migrations for the \[.kibana\] index. Please check the health of… --- ## [Cannot change the field format back to milliseconds - Index Pattern field](https://discuss.elastic.co/t/cannot-change-the-field-format-back-to-milliseconds-index-pattern-field/285108)
**Author:** [@parinitha.nagaraja](https://discuss.elastic.co/u/parinitha.nagaraja)\ **Replies:** 1\ **Last updated:** [September 27, 2021, 5:24am UTC](https://discuss.elastic.co/t/cannot-change-the-field-format-back-to-milliseconds-index-pattern-field/285108 "2021-09-27T05:24:07Z")
Hi, I edited the field format to convert a field from milliseconds (input) to minutes (output). But when I revert it back to original or in other words when I remove the formatting, the data still appears in minutes and… --- ## [Question about grouping to get the total number of filtered buckets in a bucket](https://discuss.elastic.co/t/question-about-grouping-to-get-the-total-number-of-filtered-buckets-in-a-bucket/285183)
**Author:** [@yanglingqiang](https://discuss.elastic.co/u/yanglingqiang)\ **Replies:** 0\ **Last updated:** [September 27, 2021, 3:04am UTC](https://discuss.elastic.co/t/question-about-grouping-to-get-the-total-number-of-filtered-buckets-in-a-bucket/285183 "2021-09-27T03:04:37Z")
this is my source data \[ { "buyer\_id\_std" : 35444337, "seller\_id\_std" : 3587575, "date" : "2021-02-24T00:00:00" }, { "buyer\_id\_std" : 35444337, "seller\_id\_std" : 75848633, "date… --- ## [How to parse a string json type field](https://discuss.elastic.co/t/how-to-parse-a-string-json-type-field/285162)
**Author:** [@Liangliang\_Qiu](https://discuss.elastic.co/u/Liangliang_Qiu)\ **Replies:** 2\ **Last updated:** [September 27, 2021, 2:39am UTC](https://discuss.elastic.co/t/how-to-parse-a-string-json-type-field/285162 "2021-09-27T02:39:01Z")
hi, i have a text type filed(index: false) -- detail , how to parse it into a geo\_shape field? { "took" : 23, "timed\_out" : false, "\_shards" : { "total" : 10, "successful" : 10, "skipped" : 0, "fai… --- ## [Elastic for Appointment Availability](https://discuss.elastic.co/t/elastic-for-appointment-availability/285176)
**Author:** [@updev](https://discuss.elastic.co/u/updev)\ **Replies:** 1\ **Last updated:** [September 27, 2021, 1:47am UTC](https://discuss.elastic.co/t/elastic-for-appointment-availability/285176 "2021-09-27T01:47:03Z")
Hi everyone, I'm in the process of evaluating the best technology stack for an appointment booking system, similar to that of Acuity and Calendly. Does anyone have any experience using ES for this sort of thing? Would… --- ## [Formatting a field as a link to a filtered view on its value](https://discuss.elastic.co/t/formatting-a-field-as-a-link-to-a-filtered-view-on-its-value/284357)
**Author:** [@malsioufi](https://discuss.elastic.co/u/malsioufi)\ **Replies:** 5\ **Last updated:** [September 27, 2021, 12:12am UTC](https://discuss.elastic.co/t/formatting-a-field-as-a-link-to-a-filtered-view-on-its-value/284357 "2021-09-27T00:12:27Z")
I have a field in my index called "labels" that contains an array of strings that is used as tags for the documents. Is there a way to format this field as a link that when a user click on it in the Discover area it lin… --- ## [Curl call for PUT and GET query on multi-node es cluster](https://discuss.elastic.co/t/curl-call-for-put-and-get-query-on-multi-node-es-cluster/284942)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 7\ **Last updated:** [September 27, 2021, 12:01am UTC](https://discuss.elastic.co/t/curl-call-for-put-and-get-query-on-multi-node-es-cluster/284942 "2021-09-27T00:01:40Z")
Hi Team, I would like to know on a multi-node Elasticsearch cluster (3 nodes), to which node we can send PUT curl call (say for creating ILM policy) or to fetch some results (by running query)? In a single node cluste… --- ## [Logstash fails on startup](https://discuss.elastic.co/t/logstash-fails-on-startup/285170)
**Author:** [@hazenvs](https://discuss.elastic.co/u/hazenvs)\ **Replies:** 2\ **Last updated:** [September 26, 2021, 7:36pm UTC](https://discuss.elastic.co/t/logstash-fails-on-startup/285170 "2021-09-26T19:36:16Z")
So I've narrowed this issue down to this line in my example.conf (/etc/logstash/conf.d/example.conf) input { tcp { port =\> 5002 type =\> syslog } udp { port =\> 5002 type =\> syslog } beats { … --- ## [Weird rebalancing strategy](https://discuss.elastic.co/t/weird-rebalancing-strategy/285034)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 3\ **Last updated:** [September 25, 2021, 9:25pm UTC](https://discuss.elastic.co/t/weird-rebalancing-strategy/285034 "2021-09-25T21:25:17Z")
I am seeing several active recovery tasks where 1 shard is moving from Node A -\> Node B, but at the same time for a different shard, it's moving from Node C to Node A. Wouldn't this cause rebalancing to never end? Why… --- ## [Create index template with K8S CRD](https://discuss.elastic.co/t/create-index-template-with-k8s-crd/285143)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 4\ **Last updated:** [September 26, 2021, 6:01pm UTC](https://discuss.elastic.co/t/create-index-template-with-k8s-crd/285143 "2021-09-26T18:01:50Z")
Is there a CRD to create an index template? I know rabbitMQ operator allow to declare queue like this: apiVersion: rabbitmq.com/v1beta1 kind: Queue metadata: name: test namespace: rabbitmq-system spec: name: test… --- ## [GET \_doc request not working as expected with routing aliases](https://discuss.elastic.co/t/get-doc-request-not-working-as-expected-with-routing-aliases/285039)
**Author:** [@vineethsuhas](https://discuss.elastic.co/u/vineethsuhas)\ **Replies:** 3\ **Last updated:** [September 26, 2021, 3:55am UTC](https://discuss.elastic.co/t/get-doc-request-not-working-as-expected-with-routing-aliases/285039 "2021-09-26T03:55:28Z")
Hi, Here is the scenario: 1. We created an index (routing\_test) =\> (with 2 Shards) 2. We created a couple of aliases on that index (routing\_test\_100 and routing\_test\_200) using: PUT routing\_test/\_alias/routing\_test\_100… --- ## [Elasticsearch cluster architecture with 6 nodes](https://discuss.elastic.co/t/elasticsearch-cluster-architecture-with-6-nodes/285147)
**Author:** [@dooger21](https://discuss.elastic.co/u/dooger21)\ **Replies:** 1\ **Last updated:** [September 26, 2021, 3:43am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-architecture-with-6-nodes/285147 "2021-09-26T03:43:58Z")
Hi everyone, Please I need your recommendations regarding the following architectures for a 6-node Elasticsearch cluster, based on the following characteristics: I have 2 zones (zn1, zn2) I have 3 nodes or servers in … --- ## [Obtaining each field score in the same document](https://discuss.elastic.co/t/obtaining-each-field-score-in-the-same-document/285132)
**Author:** [@ahmadnabil](https://discuss.elastic.co/u/ahmadnabil)\ **Replies:** 0\ **Last updated:** [September 25, 2021, 12:22pm UTC](https://discuss.elastic.co/t/obtaining-each-field-score-in-the-same-document/285132 "2021-09-25T12:22:22Z")
Assuming I have a document with three fields: name, company, email each one mapped with edge-ngram { "name": "John", "company": "John's company", "email": "johndoe@gmail.com" } When searching for "john" I want … --- ## [How to Ingest data into Elasticsearch with URL Callback?](https://discuss.elastic.co/t/how-to-ingest-data-into-elasticsearch-with-url-callback/284003)
**Author:** [@e-fo](https://discuss.elastic.co/u/e-fo)\ **Replies:** 4\ **Last updated:** [September 25, 2021, 12:10pm UTC](https://discuss.elastic.co/t/how-to-ingest-data-into-elasticsearch-with-url-callback/284003 "2021-09-25T12:10:33Z")
Hello, thanks for your great community I want to logging some data from some mobile app attribution service (such as Adjust or Appsflyer) into Elasticsearch the admin panel of attribution service allow me to set an url… --- ## [Terms query without sort](https://discuss.elastic.co/t/terms-query-without-sort/285126)
**Author:** [@sathiez](https://discuss.elastic.co/u/sathiez)\ **Replies:** 1\ **Last updated:** [September 25, 2021, 7:54am UTC](https://discuss.elastic.co/t/terms-query-without-sort/285126 "2021-09-25T07:54:52Z")
My document: { "\_index": "comb\_index", "\_type": "\_doc", "\_id": "i\_ZFO3sB\_48g2JrGjt9P", "\_version": 2, "\_seq\_no": 5057859, "\_primary\_term": 1, "found": true, "\_source": { "row": "54,9658", "value": 1481985587… --- ## [Issue parsing db2diag log using grok filter](https://discuss.elastic.co/t/issue-parsing-db2diag-log-using-grok-filter/281957)
**Author:** [@Atta](https://discuss.elastic.co/u/Atta)\ **Replies:** 3\ **Last updated:** [August 28, 2021, 2:13pm UTC](https://discuss.elastic.co/t/issue-parsing-db2diag-log-using-grok-filter/281957 "2021-08-28T14:13:09Z")
Hi all, I am new in ELK solution and currently I am working on Logstash -\> Elasticsearch -\> Kibana. I need to parse db2diag.log. I am using grok filter for this. The problem is when I use grok debugger website everythi… --- ## [Error with elasricsearch](https://discuss.elastic.co/t/error-with-elasricsearch/285113)
**Author:** [@ahaashoor](https://discuss.elastic.co/u/ahaashoor)\ **Replies:** 1\ **Last updated:** [September 25, 2021, 6:16am UTC](https://discuss.elastic.co/t/error-with-elasricsearch/285113 "2021-09-25T06:16:42Z")
i run this line sudo -i service elasticsearch start i got this error Job for elasticsearch.service failed because a fatal signal was delivered to the control process. See "systemctl status elasticsearch.service" and "… --- ## [Nested fields Visualization - Examples](https://discuss.elastic.co/t/nested-fields-visualization-examples/284500)
**Author:** [@Vishal\_Patil](https://discuss.elastic.co/u/Vishal_Patil)\ **Replies:** 1\ **Last updated:** [September 24, 2021, 9:14pm UTC](https://discuss.elastic.co/t/nested-fields-visualization-examples/284500 "2021-09-24T21:14:08Z")
Can someone please point me to some examples of Kibana visualizations utilized nested fields in elasticsearch documents ? --- ## [Kibana Table Visualization of documents with nested array of JSON](https://discuss.elastic.co/t/kibana-table-visualization-of-documents-with-nested-array-of-json/284740)
**Author:** [@fefontana](https://discuss.elastic.co/u/fefontana)\ **Replies:** 5\ **Last updated:** [September 24, 2021, 8:42pm UTC](https://discuss.elastic.co/t/kibana-table-visualization-of-documents-with-nested-array-of-json/284740 "2021-09-24T20:42:13Z")
Hi, I have the following json documents stored in Elasticsearch. It is a json with a nested array with json items: { "took": 40, "timed\_out": false, "\_shards": { "total": 1, "successful": 1, "skipped": 0, "faile… --- ## [Match\_bool\_prefix query acts different than Prefix query when searching on a single token](https://discuss.elastic.co/t/match-bool-prefix-query-acts-different-than-prefix-query-when-searching-on-a-single-token/285105)
**Author:** [@Mike\_M1](https://discuss.elastic.co/u/Mike_M1)\ **Replies:** 0\ **Last updated:** [September 24, 2021, 5:45pm UTC](https://discuss.elastic.co/t/match-bool-prefix-query-acts-different-than-prefix-query-when-searching-on-a-single-token/285105 "2021-09-24T17:45:31Z")
Having an issue with match\_bool\_prefix behaving weirdly when having an ampersand at the end of a one token query. According to docs, it should build out a term query with a prefix at the end. However, it does that fine e… --- ## [ELK sentiment classification](https://discuss.elastic.co/t/elk-sentiment-classification/285099)
**Author:** [@byul](https://discuss.elastic.co/u/byul)\ **Replies:** 0\ **Last updated:** [September 24, 2021, 4:15pm UTC](https://discuss.elastic.co/t/elk-sentiment-classification/285099 "2021-09-24T16:15:54Z")
Hello everybody, I got this technical test from an employer, it is about using ELK an integrate a sentiment classification service in it. Here are the questions: install ELK (I have already done it in a virtual machine… --- ## [Creating separate elasticsearch docs with batched log messages](https://discuss.elastic.co/t/creating-separate-elasticsearch-docs-with-batched-log-messages/284902)
**Author:** [@sdndude](https://discuss.elastic.co/u/sdndude)\ **Replies:** 2\ **Last updated:** [September 24, 2021, 3:44pm UTC](https://discuss.elastic.co/t/creating-separate-elasticsearch-docs-with-batched-log-messages/284902 "2021-09-24T15:44:22Z")
I have searched for this and have found a few forum entries that can help me figure out how to get the batch msgs (below) separated but I have no idea what to do with them after they are separated. As an example, here i… --- ## [Using multiple hosts in env var / Elasticsearch filter](https://discuss.elastic.co/t/using-multiple-hosts-in-env-var-elasticsearch-filter/285090)
**Author:** [@whatgeorgemade](https://discuss.elastic.co/u/whatgeorgemade)\ **Replies:** 1\ **Last updated:** [September 24, 2021, 2:56pm UTC](https://discuss.elastic.co/t/using-multiple-hosts-in-env-var-elasticsearch-filter/285090 "2021-09-24T14:56:07Z")
Hi all, I have a three node Elasticsearch cluster. I'm using Logstash to do some enrichment by pulling un-enriched documents from an index, using the elasticsearch filter to look up values, then output again to Elastics… --- ## [FSCrawler - Best approach to load massive amount of document](https://discuss.elastic.co/t/fscrawler-best-approach-to-load-massive-amount-of-document/284900)
**Author:** [@classless\_oak](https://discuss.elastic.co/u/classless_oak)\ **Replies:** 2\ **Last updated:** [September 24, 2021, 2:25pm UTC](https://discuss.elastic.co/t/fscrawler-best-approach-to-load-massive-amount-of-document/284900 "2021-09-24T14:25:57Z")
Hello, I am trying to come up with a solution to load massive amount of documents (xlx, xlsx, doc, xml, txt, pdf, etd.) 30+ terabytes into Elastic. I have spun up the stack with the FSCrawler and have been adding docume… --- ## [\_search field added to mappings long before installing plugins](https://discuss.elastic.co/t/search-field-added-to-mappings-long-before-installing-plugins/284867)
**Author:** [@BogdanD](https://discuss.elastic.co/u/BogdanD)\ **Replies:** 2\ **Last updated:** [September 24, 2021, 2:25pm UTC](https://discuss.elastic.co/t/search-field-added-to-mappings-long-before-installing-plugins/284867 "2021-09-24T14:25:45Z")
Hi all, I'm having an issue with setting up the mapper-size plugin, specifically: I have an ES instance that I've been upgrading since 6.x, now at 7.14. My mappings for my indices have always included: "\_size": { "en… --- ## [Don't auto discard unsaved work to log back in](https://discuss.elastic.co/t/dont-auto-discard-unsaved-work-to-log-back-in/284281)
**Author:** [@nahoj](https://discuss.elastic.co/u/nahoj)\ **Replies:** 2\ **Last updated:** [September 24, 2021, 12:18pm UTC](https://discuss.elastic.co/t/dont-auto-discard-unsaved-work-to-log-back-in/284281 "2021-09-24T12:18:28Z")
Hi, I started to use Kibana 7.8.1 a few days ago and even though I think it's a great tool overall, I would like to report a misfeature I just ran in: Two hours ago I was working in several browser tabs on a visualizat… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=817) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=819)