# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=836 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 837 --- ## [Ruby filter plugin does not read new field values](https://discuss.elastic.co/t/ruby-filter-plugin-does-not-read-new-field-values/283343)
**Author:** [@priyaankaa](https://discuss.elastic.co/u/priyaankaa)\ **Replies:** 8\ **Last updated:** [September 5, 2021, 2:22pm UTC](https://discuss.elastic.co/t/ruby-filter-plugin-does-not-read-new-field-values/283343 "2021-09-05T14:22:25Z")
How to get correct value of the field inside ruby code in logstash pipeline? sample 1: input { elasticsearch { hosts =\> "http://localhost:9200" index =\> "test1" } } filter { mutate { add\_field =\>… --- ## [Highlighting of exact search with simple\_query\_string](https://discuss.elastic.co/t/highlighting-of-exact-search-with-simple-query-string/283292)
**Author:** [@Wonder\_Garance](https://discuss.elastic.co/u/Wonder_Garance)\ **Replies:** 1\ **Last updated:** [September 5, 2021, 12:53pm UTC](https://discuss.elastic.co/t/highlighting-of-exact-search-with-simple-query-string/283292 "2021-09-05T12:53:23Z")
I use Elasticsearch 7.9 and I want to highlight an exact search filed with simple query string query, for a document. The following query doesn't highlight words in the document, although these words are in the document… --- ## [Influxdb and elasticsearch benchmarking for timeseries data](https://discuss.elastic.co/t/influxdb-and-elasticsearch-benchmarking-for-timeseries-data/283371)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 0\ **Last updated:** [September 5, 2021, 11:48am UTC](https://discuss.elastic.co/t/influxdb-and-elasticsearch-benchmarking-for-timeseries-data/283371 "2021-09-05T11:48:48Z")
Do we have the benchmarking stats for Elasticsearch and Influxdb considering the time series data (Metrics) Looking into the performance aspects as recent releases of elasticsearch have the additional optimization strat… --- ## [Using Kafka Stream for data transform and enrichment](https://discuss.elastic.co/t/using-kafka-stream-for-data-transform-and-enrichment/283370)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 0\ **Last updated:** [September 5, 2021, 11:40am UTC](https://discuss.elastic.co/t/using-kafka-stream-for-data-transform-and-enrichment/283370 "2021-09-05T11:40:04Z")
Is it possible to use Kafka Streaming for data transform and enrichment instead of logstash? What are the advantages and disadvantages? --- ## [Virustotal Module MISP attributes don't store in ELK](https://discuss.elastic.co/t/virustotal-module-misp-attributes-dont-store-in-elk/282834)
**Author:** [@Abanob\_Medhat](https://discuss.elastic.co/u/Abanob_Medhat)\ **Replies:** 3\ **Last updated:** [September 5, 2021, 11:20am UTC](https://discuss.elastic.co/t/virustotal-module-misp-attributes-dont-store-in-elk/282834 "2021-09-05T11:20:55Z")
hello, I integrated Virustotal with MISP and run virustotal on events and all virustotal attributes are saved in MISP. also , I integrated MISP with Elastic using Filebeats. the events are stored in Elastic and I can … --- ## [Elasticsearch is displaying correct result only after a space](https://discuss.elastic.co/t/elasticsearch-is-displaying-correct-result-only-after-a-space/283009)
**Author:** [@Drsaud](https://discuss.elastic.co/u/Drsaud)\ **Replies:** 9\ **Last updated:** [September 5, 2021, 10:43am UTC](https://discuss.elastic.co/t/elasticsearch-is-displaying-correct-result-only-after-a-space/283009 "2021-09-05T10:43:22Z")
I build react app the has search bar using elasticsearch, but the problem is when I search in my search bar earthier I have to write the word not complete or I write as complete word but after I click space. for example… --- ## [TSVB line chart has gaps](https://discuss.elastic.co/t/tsvb-line-chart-has-gaps/282529)
**Author:** [@vijay\_kaali](https://discuss.elastic.co/u/vijay_kaali)\ **Replies:** 3\ **Last updated:** [September 5, 2021, 6:45am UTC](https://discuss.elastic.co/t/tsvb-line-chart-has-gaps/282529 "2021-09-05T06:45:20Z")
i have create a line chart and tsvb . line chart. in visualization , tsvb has gaps while normal line chart looks fine . 1st chart tsvb 2nd chart normal line chart . with same data, same avg( runqueue) formula wh… --- ## [S3 output plugin "upload\_worker\_count" logs](https://discuss.elastic.co/t/s3-output-plugin-upload-worker-count-logs/283357)
**Author:** [@Varsha1](https://discuss.elastic.co/u/Varsha1)\ **Replies:** 0\ **Last updated:** [September 5, 2021, 5:15am UTC](https://discuss.elastic.co/t/s3-output-plugin-upload-worker-count-logs/283357 "2021-09-05T05:15:32Z")
I've realized I don't see the detailed s3 log in console when running logstash for kafka input and s3 output. Also I've configured the S3 output plugin to run with multiple workers, how could I make sure the 5 workers ar… --- ## [I am trying to pass a fieldname in jdbc\_streaming plugin to the jdbc\_user parameter, but it fails to read the value of the field](https://discuss.elastic.co/t/i-am-trying-to-pass-a-fieldname-in-jdbc-streaming-plugin-to-the-jdbc-user-parameter-but-it-fails-to-read-the-value-of-the-field/283241)
**Author:** [@Varsha1](https://discuss.elastic.co/u/Varsha1)\ **Replies:** 4\ **Last updated:** [September 5, 2021, 5:07am UTC](https://discuss.elastic.co/t/i-am-trying-to-pass-a-fieldname-in-jdbc-streaming-plugin-to-the-jdbc-user-parameter-but-it-fails-to-read-the-value-of-the-field/283241 "2021-09-05T05:07:31Z")
jdbc\_streaming { jdbc\_driver\_class =\> "Java::oracle.jdbc.driver.OracleDriver" jdbc\_driver\_library =\> "/home/user/logstash-7.14.0/logstash-core/lib/jars/ojdbc8.jar" jdbc\_connection\_string =\> "jdbc:oracle:thin:@XXXXX" … --- ## [Many deleted indices, no recovery of disk space?](https://discuss.elastic.co/t/many-deleted-indices-no-recovery-of-disk-space/283328)
**Author:** [@NetwarSystem](https://discuss.elastic.co/u/NetwarSystem)\ **Replies:** 3\ **Last updated:** [September 5, 2021, 3:51am UTC](https://discuss.elastic.co/t/many-deleted-indices-no-recovery-of-disk-space/283328 "2021-09-05T03:51:21Z")
I have a 1.2TB backup of Elasticsearch data that I have restored to a standalone machine running 7.14.0. The restore worked fine and I began grooming the data - about half of the indices in the snapshot are not needed fo… --- ## [Apply aggregation result to values in the document \[Elasticsearch\]](https://discuss.elastic.co/t/apply-aggregation-result-to-values-in-the-document-elasticsearch/283350)
**Author:** [@me.mohammed](https://discuss.elastic.co/u/me.mohammed)\ **Replies:** 0\ **Last updated:** [September 4, 2021, 6:59pm UTC](https://discuss.elastic.co/t/apply-aggregation-result-to-values-in-the-document-elasticsearch/283350 "2021-09-04T18:59:58Z")
so what I'm trying to do is change the actual values in the document depending on the aggregation result, I'm not sure if this is possible or not but here are some examples to what I'm trying to do { "deals": \[ { … --- ## [Mixed kinds of rename option in single mutate filter won't work](https://discuss.elastic.co/t/mixed-kinds-of-rename-option-in-single-mutate-filter-wont-work/283278)
**Author:** [@tasneem-hyder](https://discuss.elastic.co/u/tasneem-hyder)\ **Replies:** 4\ **Last updated:** [September 4, 2021, 6:23pm UTC](https://discuss.elastic.co/t/mixed-kinds-of-rename-option-in-single-mutate-filter-wont-work/283278 "2021-09-04T18:23:11Z")
In a single mutate filter, we can't use the mixed kinds of rename option. This is not configuration issue but a runtime issue so it is hard to debug. As this kind of config setup doesn't compile to an expected config so … --- ## [How to calculate old date from today by subtracting given years, months, days in logstash?](https://discuss.elastic.co/t/how-to-calculate-old-date-from-today-by-subtracting-given-years-months-days-in-logstash/283349)
**Author:** [@priyaankaa](https://discuss.elastic.co/u/priyaankaa)\ **Replies:** 2\ **Last updated:** [September 4, 2021, 5:36pm UTC](https://discuss.elastic.co/t/how-to-calculate-old-date-from-today-by-subtracting-given-years-months-days-in-logstash/283349 "2021-09-04T17:36:53Z")
I want to subtract current date with given years, months, days using logstash pipeline. For example : Today = 1 Aug 2021 Given values : Years=25, Months=10, Days=10 Expected date : 22 Sept 1995 My logstash filter sec… --- ## [Logstash multiline issue - limit of size in single event](https://discuss.elastic.co/t/logstash-multiline-issue-limit-of-size-in-single-event/283335)
**Author:** [@ErSumit](https://discuss.elastic.co/u/ErSumit)\ **Replies:** 2\ **Last updated:** [September 4, 2021, 5:15pm UTC](https://discuss.elastic.co/t/logstash-multiline-issue-limit-of-size-in-single-event/283335 "2021-09-04T17:15:40Z")
Logstash file input configured with multiline pattern as codec =\> multiline { pattern =\> '^ {' negate =\> true what =\> previous } } Input file consist of multiple json objects. This mu… --- ## [Disk.size is 10 times more than disk.indices](https://discuss.elastic.co/t/disk-size-is-10-times-more-than-disk-indices/283280)
**Author:** [@mrudrego](https://discuss.elastic.co/u/mrudrego)\ **Replies:** 4\ **Last updated:** [September 4, 2021, 11:47am UTC](https://discuss.elastic.co/t/disk-size-is-10-times-more-than-disk-indices/283280 "2021-09-04T11:47:56Z")
We are facing shard allocation issues because of disk watermark and when checked allocation API, strangely disk.size is 5-6 times more than disk.indices \[root@bcmt-ovs-control-0 ~\]# curl -s elasticsearch.cgnat.svc.clust… --- ## [Logstash add field default type is string but check field in an array field must match type](https://discuss.elastic.co/t/logstash-add-field-default-type-is-string-but-check-field-in-an-array-field-must-match-type/283334)
**Author:** [@qinkkai](https://discuss.elastic.co/u/qinkkai)\ **Replies:** 1\ **Last updated:** [September 4, 2021, 7:56am UTC](https://discuss.elastic.co/t/logstash-add-field-default-type-is-string-but-check-field-in-an-array-field-must-match-type/283334 "2021-09-04T07:56:24Z")
My logstash config as follow，I want to output only when the field a in the arr. I think the condition in the output is always true. input { generator { message =\> '{"a":111}' codec =\> json add\_field =\>… --- ## [Should we adopt elasticsearch on top of postgres to handle our search/filtering?](https://discuss.elastic.co/t/should-we-adopt-elasticsearch-on-top-of-postgres-to-handle-our-search-filtering/283324)
**Author:** [@elastic\_yogi](https://discuss.elastic.co/u/elastic_yogi)\ **Replies:** 1\ **Last updated:** [September 4, 2021, 7:29am UTC](https://discuss.elastic.co/t/should-we-adopt-elasticsearch-on-top-of-postgres-to-handle-our-search-filtering/283324 "2021-09-04T07:29:02Z")
We have a web service that allows a ~10 customers to look at their data. Each customer has about 1M - 10M records. Our total datastore size will target the 10's of gigabytes. We currently store this data in postgres norm… --- ## [Web defacement monitoring](https://discuss.elastic.co/t/web-defacement-monitoring/283327)
**Author:** [@Lakshan\_Chamidu](https://discuss.elastic.co/u/Lakshan_Chamidu)\ **Replies:** 0\ **Last updated:** [September 4, 2021, 4:55am UTC](https://discuss.elastic.co/t/web-defacement-monitoring/283327 "2021-09-04T04:55:48Z")
how can we monitor web defacement using elk stack? --- ## [What does this error mean - Data too large, data for \[\\]](https://discuss.elastic.co/t/what-does-this-error-mean-data-too-large-data-for-transport-request/209345)
**Author:** [@Dmitry1](https://discuss.elastic.co/u/Dmitry1)\ **Replies:** 7\ **Last updated:** [September 4, 2021, 3:38am UTC](https://discuss.elastic.co/t/what-does-this-error-mean-data-too-large-data-for-transport-request/209345 "2021-09-04T03:38:37Z")
Hello, please explain me what this error mean ? And what I need to do to get rid of it : \[2019-11-25T00:20:58,521\]\[WARN \]\[o.e.x.m.e.l.LocalExporter\] \[host\] unexpected error while indexing monitoring document org.elastic… --- ## [Query to display the results contains speicifed string](https://discuss.elastic.co/t/query-to-display-the-results-contains-speicifed-string/48570)
**Author:** [@nagesh](https://discuss.elastic.co/u/nagesh)\ **Replies:** 8\ **Last updated:** [September 4, 2021, 3:32am UTC](https://discuss.elastic.co/t/query-to-display-the-results-contains-speicifed-string/48570 "2021-09-04T03:32:15Z")
Hi, Application name is property in the fields list of Kibana dashboard viewlet. Suppose if I need to display logs which contains application name in the log message then what query I need to use in dashboard. Thanks… --- ## [Total number of clicks of one document](https://discuss.elastic.co/t/total-number-of-clicks-of-one-document/283088)
**Author:** [@ntruongsinh](https://discuss.elastic.co/u/ntruongsinh)\ **Replies:** 3\ **Last updated:** [September 3, 2021, 11:48pm UTC](https://discuss.elastic.co/t/total-number-of-clicks-of-one-document/283088 "2021-09-03T23:48:33Z")
Hi everyone, I'm struggling with getting the total number of clicks of one document. As I see here Analytics clicks API | Elastic App Search Documentation \[7.14\] | Elastic, we only can get the total number of clicks in … --- ## [Date Time shows empty in lens, but not in discover pane](https://discuss.elastic.co/t/date-time-shows-empty-in-lens-but-not-in-discover-pane/283318)
**Author:** [@Tydorius](https://discuss.elastic.co/u/Tydorius)\ **Replies:** 1\ **Last updated:** [September 3, 2021, 10:08pm UTC](https://discuss.elastic.co/t/date-time-shows-empty-in-lens-but-not-in-discover-pane/283318 "2021-09-03T22:08:50Z")
I'm working on a beat to pull in GPU/CPU temperature data into Elasticsearch. My date is correctly parsed from "yyyy'-'MM'-'dd'T'HH':'mm':'ss" into a date time. You can see my original object datetimestamp vs the same d… --- ## [Many js file being downloaded while loading dashbaord](https://discuss.elastic.co/t/many-js-file-being-downloaded-while-loading-dashbaord/283253)
**Author:** [@Lakhan\_Rathi](https://discuss.elastic.co/u/Lakhan_Rathi)\ **Replies:** 1\ **Last updated:** [September 3, 2021, 7:40pm UTC](https://discuss.elastic.co/t/many-js-file-being-downloaded-while-loading-dashbaord/283253 "2021-09-03T19:40:21Z")
I am trying to load kibana dashboard on my website with help of ifream but while loading its downloading many js files Which on search found to be from x-pack Its almost 100 js files for one dashboard can someone sugg… --- ## [Deleting multiple kibana documents](https://discuss.elastic.co/t/deleting-multiple-kibana-documents/283267)
**Author:** [@LL\_FED](https://discuss.elastic.co/u/LL_FED)\ **Replies:** 1\ **Last updated:** [September 3, 2021, 5:28pm UTC](https://discuss.elastic.co/t/deleting-multiple-kibana-documents/283267 "2021-09-03T17:28:52Z")
Hi! I know i can delete single documents with the "Dev-Tool", but is it possible to delete multiple documents at once? For example I want to delete all documents, which include a specific field. Thanks for any kind of… --- ## [Point in Time with Search After missing a few logs](https://discuss.elastic.co/t/point-in-time-with-search-after-missing-a-few-logs/283296)
**Author:** [@woal\_idal](https://discuss.elastic.co/u/woal_idal)\ **Replies:** 0\ **Last updated:** [September 3, 2021, 3:01pm UTC](https://discuss.elastic.co/t/point-in-time-with-search-after-missing-a-few-logs/283296 "2021-09-03T15:01:36Z")
When I run a regular query search in elasticsearch, I will get all the values. Now, when I implement the point in time api and search after because using the regular search api can handle up to 10K hits/results the query… --- ## [Heartbeat autodiscover with Synthetic Monitoring](https://discuss.elastic.co/t/heartbeat-autodiscover-with-synthetic-monitoring/283303)
**Author:** [@Andres\_Altamirano](https://discuss.elastic.co/u/Andres_Altamirano)\ **Replies:** 0\ **Last updated:** [September 3, 2021, 3:33pm UTC](https://discuss.elastic.co/t/heartbeat-autodiscover-with-synthetic-monitoring/283303 "2021-09-03T15:33:46Z")
Hi, Is there a way to use autodiscover from docker to create synthetic monitoring? The problem is that for autodiscovery there is a need to read /var/run/docker.sock which only can be achieved running as root. In the o… --- ## [Best way to create a list of all \_ids in an index (Up to date version)](https://discuss.elastic.co/t/best-way-to-create-a-list-of-all-ids-in-an-index-up-to-date-version/283195)
**Author:** [@steveh](https://discuss.elastic.co/u/steveh)\ **Replies:** 1\ **Last updated:** [September 3, 2021, 3:16pm UTC](https://discuss.elastic.co/t/best-way-to-create-a-list-of-all-ids-in-an-index-up-to-date-version/283195 "2021-09-03T15:16:08Z")
So what's the current best way to query (and therefore dump to say a file) all the document \_ids in an index? I have a 218,000 doc database with about 8000 documents missing (according to the document counts). To inves… --- ## [Meta fields in a query](https://discuss.elastic.co/t/meta-fields-in-a-query/283217)
**Author:** [@rgopalan](https://discuss.elastic.co/u/rgopalan)\ **Replies:** 1\ **Last updated:** [September 3, 2021, 3:13pm UTC](https://discuss.elastic.co/t/meta-fields-in-a-query/283217 "2021-09-03T15:13:41Z")
Hi, I am trying to isolate application flows that cause slow queries that are being logged in the slow log. Many of our search requests are very similar and it is hard to figure out which user was performing what actio… --- ## [Extact costum field from log](https://discuss.elastic.co/t/extact-costum-field-from-log/283288)
**Author:** [@lemahdois](https://discuss.elastic.co/u/lemahdois)\ **Replies:** 1\ **Last updated:** [September 3, 2021, 3:13pm UTC](https://discuss.elastic.co/t/extact-costum-field-from-log/283288 "2021-09-03T15:13:26Z")
Hello, I have a compicated log that does not follow commun format ......... RType: XXX ....... I want to find an easy way to extract the RType field and the value that corresponds to it XXX (for example). note that i… --- ## [How to ignore malformed query for IP property](https://discuss.elastic.co/t/how-to-ignore-malformed-query-for-ip-property/283221)
**Author:** [@hZhYNXaCbgkgjyFBJ](https://discuss.elastic.co/u/hZhYNXaCbgkgjyFBJ)\ **Replies:** 1\ **Last updated:** [September 3, 2021, 3:12pm UTC](https://discuss.elastic.co/t/how-to-ignore-malformed-query-for-ip-property/283221 "2021-09-03T15:12:52Z")
Hi there, I have an Elasticsearch index whose mapping has two properties - one is of type keyword and the other is of type ip: "mappings": { "properties": { "user\_id": { "… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=835) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=837)