# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=822 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 823 --- ## [Date histogram with different Timezones with Elasticsearch v.7.13.3](https://discuss.elastic.co/t/date-histogram-with-different-timezones-with-elasticsearch-v-7-13-3/280639)
**Author:** [@scorona85](https://discuss.elastic.co/u/scorona85)\ **Replies:** 9\ **Last updated:** [September 22, 2021, 5:09am UTC](https://discuss.elastic.co/t/date-histogram-with-different-timezones-with-elasticsearch-v-7-13-3/280639 "2021-09-22T05:09:33Z")
I have to acquire datas from different part of Timezones (example New York -6.00 and Rome +2.00). In the document I have a field 'timestamp' defined as "data" and I have for example create a "date\_histogram" for example … --- ## [Vm.max\_map\_count can we have any workaround without setting this value](https://discuss.elastic.co/t/vm-max-map-count-can-we-have-any-workaround-without-setting-this-value/284798)
**Author:** [@Sammeta\_David\_Raju](https://discuss.elastic.co/u/Sammeta_David_Raju)\ **Replies:** 2\ **Last updated:** [September 22, 2021, 4:46am UTC](https://discuss.elastic.co/t/vm-max-map-count-can-we-have-any-workaround-without-setting-this-value/284798 "2021-09-22T04:46:48Z")
Hi , I am using fargate and Elasticsearch version as 7.3.2 can i have any workaround to bypass vm.max\_map\_count issue \[65530\] is too low increase to atleast \[262144\] 1.Fargate environment is mandatory .we cannot switc… --- ## [Cannot download older versions of elastic?](https://discuss.elastic.co/t/cannot-download-older-versions-of-elastic/284787)
**Author:** [@bensalerno](https://discuss.elastic.co/u/bensalerno)\ **Replies:** 1\ **Last updated:** [September 22, 2021, 2:05am UTC](https://discuss.elastic.co/t/cannot-download-older-versions-of-elastic/284787 "2021-09-22T02:05:09Z")
I'm trying to download an older version of Elasticsearch here: https://www.elastic.co/downloads/past-releases/elasticsearch-7-10-0 But it's not working, instead throwing a 504 timeout. Is there another way to download … --- ## [What is the difference between boost and weight](https://discuss.elastic.co/t/what-is-the-difference-between-boost-and-weight/284714)
**Author:** [@Deepti](https://discuss.elastic.co/u/Deepti)\ **Replies:** 5\ **Last updated:** [September 22, 2021, 1:54am UTC](https://discuss.elastic.co/t/what-is-the-difference-between-boost-and-weight/284714 "2021-09-22T01:54:08Z")
Boost parameter is used in the below example wildcard": { "City": { "wildcard": "M", "boost": 10 } Can I use similar query for weight? --- ## [How to make doc which has more different words score higher?](https://discuss.elastic.co/t/how-to-make-doc-which-has-more-different-words-score-higher/284546)
**Author:** [@Bowen\_Liu](https://discuss.elastic.co/u/Bowen_Liu)\ **Replies:** 1\ **Last updated:** [September 22, 2021, 12:58am UTC](https://discuss.elastic.co/t/how-to-make-doc-which-has-more-different-words-score-higher/284546 "2021-09-22T00:58:39Z")
Hi everyone, I have a problem about scoring in es. The thing is that I use multi\_match to do full text search in muti-fields and use the type "best\_fields", say, user\_name, biz\_type, account\_name, content... When I use,… --- ## [Check version of Nest?](https://discuss.elastic.co/t/check-version-of-nest/284776)
**Author:** [@bensalerno](https://discuss.elastic.co/u/bensalerno)\ **Replies:** 0\ **Last updated:** [September 21, 2021, 11:06pm UTC](https://discuss.elastic.co/t/check-version-of-nest/284776 "2021-09-21T23:06:40Z")
I'd like to check was version of the Nest client I am using, and if possible, downgrade it to version 7.13. Is this possible? --- ## [Translate doesnt work when key in yml dictionary is a number](https://discuss.elastic.co/t/translate-doesnt-work-when-key-in-yml-dictionary-is-a-number/284767)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 5\ **Last updated:** [September 21, 2021, 10:53pm UTC](https://discuss.elastic.co/t/translate-doesnt-work-when-key-in-yml-dictionary-is-a-number/284767 "2021-09-21T22:53:09Z")
Hi, I have this yml dictionary 1967345056 : "VISACI nodata IIS" and this is the translate: translate { field =\> "\[monitorgroup\]" destination =\> "\[nuevo\_campo\]" dictionary\_path =\> "/etc/logs… --- ## [Directly query ES cluster through .NET without using Client?](https://discuss.elastic.co/t/directly-query-es-cluster-through-net-without-using-client/284772)
**Author:** [@bensalerno](https://discuss.elastic.co/u/bensalerno)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 10:42pm UTC](https://discuss.elastic.co/t/directly-query-es-cluster-through-net-without-using-client/284772 "2021-09-21T22:42:35Z")
I'm trying to run some ElasticSearch queries from my C# code. Is it possible to do this without the low-level or high-level clients? --- ## [Nested documents Sorting & faceting](https://discuss.elastic.co/t/nested-documents-sorting-faceting/284757)
**Author:** [@jai\_H](https://discuss.elastic.co/u/jai_H)\ **Replies:** 0\ **Last updated:** [September 21, 2021, 6:33pm UTC](https://discuss.elastic.co/t/nested-documents-sorting-faceting/284757 "2021-09-21T18:33:35Z")
I am working on an E-Commerce application. Catalog Data is being served by Elastic Search. I have document's for Product which is already indexed in Elastic Search. Document Looks something like this (Excluded few fiel… --- ## ["Result window is too large" http response depends on the presence of the sort field](https://discuss.elastic.co/t/result-window-is-too-large-http-response-depends-on-the-presence-of-the-sort-field/284738)
**Author:** [@franck.valentin](https://discuss.elastic.co/u/franck.valentin)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 5:14pm UTC](https://discuss.elastic.co/t/result-window-is-too-large-http-response-depends-on-the-presence-of-the-sort-field/284738 "2021-09-21T17:14:04Z")
Hi, I'm facing a strange behaviour on Elasticsearch 7.7 when I perform a search on several indexes and the result window is too large. If the query is: GET /\_search { "size": 500, "from": 10000, "query": { "… --- ## [Correlating Documents Based On Unique Field](https://discuss.elastic.co/t/correlating-documents-based-on-unique-field/283571)
**Author:** [@Nico\_Pampaloni](https://discuss.elastic.co/u/Nico_Pampaloni)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 4:12pm UTC](https://discuss.elastic.co/t/correlating-documents-based-on-unique-field/283571 "2021-09-21T16:12:07Z")
Good Afternoon, I have a question about correlating documents based on a search term that only exists in some of the results. Our data has two unique identifiers. The first one (X) exists throughout the lifetime of the … --- ## [CircuitBreakingException: \[parent\] Data too large](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large/284747)
**Author:** [@kyle\_che](https://discuss.elastic.co/u/kyle_che)\ **Replies:** 4\ **Last updated:** [September 21, 2021, 3:59pm UTC](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large/284747 "2021-09-21T15:59:29Z")
we upgraded a cluster from 6.8.8 to 7.8.1. ever since this, we are having elastic nodes die with the below error. everything was working fine before the upgrade. i've googled and haven't found anything to really point… --- ## [TSVB don't work only on Count Aggregation](https://discuss.elastic.co/t/tsvb-dont-work-only-on-count-aggregation/283457)
**Author:** [@Cap\_Ho](https://discuss.elastic.co/u/Cap_Ho)\ **Replies:** 17\ **Last updated:** [September 21, 2021, 3:51pm UTC](https://discuss.elastic.co/t/tsvb-dont-work-only-on-count-aggregation/283457 "2021-09-21T15:51:35Z")
I don't know why the TSVB suddenly don't work anymore only for "Count" Aggregation. it show "The request for this panel failed. Failed to compile inline script \[count \*1\] using lang \[expression\]. " But when i use the oth… --- ## [Kibana - Query difficulties in Canvas](https://discuss.elastic.co/t/kibana-query-difficulties-in-canvas/283563)
**Author:** [@Luis\_P](https://discuss.elastic.co/u/Luis_P)\ **Replies:** 14\ **Last updated:** [September 21, 2021, 3:47pm UTC](https://discuss.elastic.co/t/kibana-query-difficulties-in-canvas/283563 "2021-09-21T15:47:08Z")
Hello, Right now I'm facing an issue creating a vertical bar element. The values I'm looking to use are quite simple to obtain through Dev Tools by making a query, however Canvas doesn't allow to query that way, which I… --- ## [Extract a substring and assign to new field](https://discuss.elastic.co/t/extract-a-substring-and-assign-to-new-field/284692)
**Author:** [@Andrea\_Bozzano](https://discuss.elastic.co/u/Andrea_Bozzano)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 3:10pm UTC](https://discuss.elastic.co/t/extract-a-substring-and-assign-to-new-field/284692 "2021-09-21T15:10:18Z")
Hi everyone! Hope everyone's good. in my application, i'm sending a JSON wich has a string field always made of 16 char For example: XXXYYY12Y00K111H Is there a fine way, or do you have any particular hint to extract… --- ## [Needs to add few field from one log to another log](https://discuss.elastic.co/t/needs-to-add-few-field-from-one-log-to-another-log/284600)
**Author:** [@rajvel](https://discuss.elastic.co/u/rajvel)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 2:57pm UTC](https://discuss.elastic.co/t/needs-to-add-few-field-from-one-log-to-another-log/284600 "2021-09-21T14:57:29Z")
Hi Team, We have a ansible log, One is stream and another one is job status. Now i want to add few field from one log to another, then only i can able to create a table for my requirements. --- ## [Explain the function score of match\_phrase\_prefix](https://discuss.elastic.co/t/explain-the-function-score-of-match-phrase-prefix/283348)
**Author:** [@LazyMonster](https://discuss.elastic.co/u/LazyMonster)\ **Replies:** 1\ **Last updated:** [September 21, 2021, 2:37pm UTC](https://discuss.elastic.co/t/explain-the-function-score-of-match-phrase-prefix/283348 "2021-09-21T14:37:59Z")
I have a problem with match\_phrase\_prefix query. Let me elaborate my case: I use a script similarity like this: { "similarity": { "custom\_tfidf": { "type": "scripted", "script": { "sou… --- ## [Keep a concrete character regular expressioon](https://discuss.elastic.co/t/keep-a-concrete-character-regular-expressioon/284696)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 1:44pm UTC](https://discuss.elastic.co/t/keep-a-concrete-character-regular-expressioon/284696 "2021-09-21T13:44:54Z")
i need to keep only two characters of a field but i dont know how to do it. I would like to keep the second and third character of the server name, which indicates the country code, for example T52EDFS011 (52). i'm new… --- ## [Kv filter usage](https://discuss.elastic.co/t/kv-filter-usage/284718)
**Author:** [@PaoloZhao](https://discuss.elastic.co/u/PaoloZhao)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 1:40pm UTC](https://discuss.elastic.co/t/kv-filter-usage/284718 "2021-09-21T13:40:27Z")
Hi guys! I am a fresh fish. I have some logs like blow. 15:08:16.2104 Info {"message":"BlankProcess execution started","level":"Information","logType":"Default","timeStamp":"2021-09-21T15:08:16.2015207+08:00","fingerp… --- ## [Elasticsearch Engineer Training - Lab 4.2/4.3 - 404 during update by query](https://discuss.elastic.co/t/elasticsearch-engineer-training-lab-4-2-4-3-404-during-update-by-query/284677)
**Author:** [@efd6](https://discuss.elastic.co/u/efd6)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 1:38pm UTC](https://discuss.elastic.co/t/elasticsearch-engineer-training-lab-4-2-4-3-404-during-update-by-query/284677 "2021-09-21T13:38:13Z")
I have a problem with the elasticsearch training in module 4.2 and 4.3 (only 4.3 included since it's shorter and the problems are the same). When I create a policy and execute the policy index creation and then construc… --- ## [Limiting axis to only integers](https://discuss.elastic.co/t/limiting-axis-to-only-integers/284296)
**Author:** [@Janujc](https://discuss.elastic.co/u/Janujc)\ **Replies:** 5\ **Last updated:** [September 21, 2021, 1:10pm UTC](https://discuss.elastic.co/t/limiting-axis-to-only-integers/284296 "2021-09-21T13:10:24Z")
Hello! I'm wondering if it is possible to limit the y-axis in different plots to show only integer values? We're showcasing the number of people doing different actions, therefore it really doesn't make sense to have de… --- ## [Storage size of an event](https://discuss.elastic.co/t/storage-size-of-an-event/284724)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 0\ **Last updated:** [September 21, 2021, 12:40pm UTC](https://discuss.elastic.co/t/storage-size-of-an-event/284724 "2021-09-21T12:40:54Z")
Hello every body, Is there an estimate of the storage size of an event? Example sshd authentication event. Best regards --- ## [Add existing fields to my logstash](https://discuss.elastic.co/t/add-existing-fields-to-my-logstash/284626)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 8\ **Last updated:** [September 21, 2021, 12:24pm UTC](https://discuss.elastic.co/t/add-existing-fields-to-my-logstash/284626 "2021-09-21T12:24:49Z")
hello ! I would like to be able to add existing fields in an already stored index and to be able to work with them in logstash. I understand that there are enrichment policies but I would like not to have to use kibana… --- ## [Logstash changing Object events using ruby not working](https://discuss.elastic.co/t/logstash-changing-object-events-using-ruby-not-working/284722)
**Author:** [@antonisnyc94](https://discuss.elastic.co/u/antonisnyc94)\ **Replies:** 0\ **Last updated:** [September 21, 2021, 12:26pm UTC](https://discuss.elastic.co/t/logstash-changing-object-events-using-ruby-not-working/284722 "2021-09-21T12:26:53Z")
Hello, I am having the below logstash filter ruby code to change the name of an event with Object type but im still getting an error. Am i doing something wrong? if \[body\]\[json\]\[attr\]\[config\] { … --- ## [Single behavior generates several alerts](https://discuss.elastic.co/t/single-behavior-generates-several-alerts/283943)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 3\ **Last updated:** [September 21, 2021, 12:15pm UTC](https://discuss.elastic.co/t/single-behavior-generates-several-alerts/283943 "2021-09-21T12:15:54Z")
Hello evry body, I have a lot of alerts generated by a single behavior scan from the address IP x.x.x.x to the ip address Y (each time the rule is executed another alerts is created). Is there a way to have only one ale… --- ## [Elasticsearch 7.13.4 and 7.14.1 request memory higher than actual heap size](https://discuss.elastic.co/t/elasticsearch-7-13-4-and-7-14-1-request-memory-higher-than-actual-heap-size/284614)
**Author:** [@dimitris\_sb](https://discuss.elastic.co/u/dimitris_sb)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 11:02am UTC](https://discuss.elastic.co/t/elasticsearch-7-13-4-and-7-14-1-request-memory-higher-than-actual-heap-size/284614 "2021-09-21T11:02:27Z")
Hi All, Is there a case that the memory is consumed by elasticsearch requests (and the circuit breaker kicks in) but it is not shown in heap usage? The circuit breaker is 70% of the JVM heap and what we see makes no sen… --- ## [Massive queue in "refresh" thread pool on a single node, causing timeouts](https://discuss.elastic.co/t/massive-queue-in-refresh-thread-pool-on-a-single-node-causing-timeouts/280732)
**Author:** [@BradVido](https://discuss.elastic.co/u/BradVido)\ **Replies:** 18\ **Last updated:** [September 21, 2021, 10:34am UTC](https://discuss.elastic.co/t/massive-queue-in-refresh-thread-pool-on-a-single-node-causing-timeouts/280732 "2021-09-21T10:34:03Z")
This is a difficult one because it only happens randomly, I can't figure out a way to reproduce it consistently. What happens is I'll notice a lot of timeouts trying to index to the cluster, and what I've found that s… --- ## [Document\_id](https://discuss.elastic.co/t/document-id/283269)
**Author:** [@cva](https://discuss.elastic.co/u/cva)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 10:12am UTC](https://discuss.elastic.co/t/document-id/283269 "2021-09-21T10:12:38Z")
Добрый день! Имеется индекс test, в нем несколько тегов: tags1, tags2, tags3. Данные я получаю из jdbc запроса к БД. В output я меняю \_id elasticsearch =\> на document\_id и отправляю это все в один индекс test. В резул… --- ## [Pro and cons between using daily and monthly indexes?](https://discuss.elastic.co/t/pro-and-cons-between-using-daily-and-monthly-indexes/284613)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 11\ **Last updated:** [September 21, 2021, 8:47am UTC](https://discuss.elastic.co/t/pro-and-cons-between-using-daily-and-monthly-indexes/284613 "2021-09-21T08:47:32Z")
Hello Following the advice given here (thank you), in a few months, Ill be able to reduce the total shards in my Elastic Stack single node from aprox 5000 to 160. This will generally give it better performance and not … --- ## [Could Not Index event to Elasticsearch](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch/284295)
**Author:** [@dayajamal](https://discuss.elastic.co/u/dayajamal)\ **Replies:** 3\ **Last updated:** [September 21, 2021, 8:27am UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch/284295 "2021-09-21T08:27:17Z")
Hello, I am running Logstash with 11 pipelines for 9 different log types, when I send those logs from Filebeat to Logstash, I tail the Logstash logs and get this error. Nonetheless, in Elasticsearch and Kibana I receive … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=821) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=823)