# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=837 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 838 --- ## [Merging search results across multiple related indexes](https://discuss.elastic.co/t/merging-search-results-across-multiple-related-indexes/282100)
**Author:** [@someguy](https://discuss.elastic.co/u/someguy)\ **Replies:** 8\ **Last updated:** [September 3, 2021, 3:01pm UTC](https://discuss.elastic.co/t/merging-search-results-across-multiple-related-indexes/282100 "2021-09-03T15:01:45Z")
Working on a project where we have a core document (one index) and each document can have multiple related files that we want searchable (a couple other indexes for different types of files). We want to implement a sear… --- ## [Aggregation for Individual Query in should Array](https://discuss.elastic.co/t/aggregation-for-individual-query-in-should-array/283251)
**Author:** [@Manisekhar\_techo](https://discuss.elastic.co/u/Manisekhar_techo)\ **Replies:** 3\ **Last updated:** [September 3, 2021, 2:05pm UTC](https://discuss.elastic.co/t/aggregation-for-individual-query-in-should-array/283251 "2021-09-03T14:05:40Z")
Hi All, is there a way for me to perform the aggregation for all the Matching documents inside the bool should array individually. { "query": { "bool": { "should": \[ { … --- ## [Sample Threat Intel Module Filebeat.YML File that you can share?](https://discuss.elastic.co/t/sample-threat-intel-module-filebeat-yml-file-that-you-can-share/283071)
**Author:** [@tanner8302](https://discuss.elastic.co/u/tanner8302)\ **Replies:** 10\ **Last updated:** [September 3, 2021, 1:53pm UTC](https://discuss.elastic.co/t/sample-threat-intel-module-filebeat-yml-file-that-you-can-share/283071 "2021-09-03T13:53:36Z")
Has anyone got the Threat Feed in elastic working? If so could you share your filebeat.yml sample so that I can refer to it. I cannot get filebeat to start using the module samples provided by elastic. --- ## [Not able to see the reply](https://discuss.elastic.co/t/not-able-to-see-the-reply/283279)
**Author:** [@subhp](https://discuss.elastic.co/u/subhp)\ **Replies:** 1\ **Last updated:** [September 3, 2021, 1:12pm UTC](https://discuss.elastic.co/t/not-able-to-see-the-reply/283279 "2021-09-03T13:12:33Z")
Continuing the discussion from Elaticsearch multiMatchQuery with wildcard: I am looking for similar search for all the fields. I am not able see the reply. If there is any solution please update --- ## [Fatal error starting fresh plain kibana on ubuntu20](https://discuss.elastic.co/t/fatal-error-starting-fresh-plain-kibana-on-ubuntu20/283277)
**Author:** [@wudy1978](https://discuss.elastic.co/u/wudy1978)\ **Replies:** 1\ **Last updated:** [September 3, 2021, 1:03pm UTC](https://discuss.elastic.co/t/fatal-error-starting-fresh-plain-kibana-on-ubuntu20/283277 "2021-09-03T13:03:27Z")
hello there, i did a fresh plain install from your repo and getting a strange error. not able to get rid of it or find any solutions or explanations anywhere. kibana.log says: {"type":"log","@timestamp":"2021-09-03T14:… --- ## [How to transfer data to a host with a username and password](https://discuss.elastic.co/t/how-to-transfer-data-to-a-host-with-a-username-and-password/283161)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 8\ **Last updated:** [September 3, 2021, 11:05am UTC](https://discuss.elastic.co/t/how-to-transfer-data-to-a-host-with-a-username-and-password/283161 "2021-09-03T11:05:13Z")
Hello dear friends. I have a problem. I have been helped by this website in many ways before. First of all, thank you very much for all the help for helping me improve myself on elasticsearch. :slight\_smile: Current pro… --- ## [Pod state 0/1 Running after set up elasticseatch on k8s cluster using helm chart](https://discuss.elastic.co/t/pod-state-0-1-running-after-set-up-elasticseatch-on-k8s-cluster-using-helm-chart/283268)
**Author:** [@cezzarez](https://discuss.elastic.co/u/cezzarez)\ **Replies:** 0\ **Last updated:** [September 3, 2021, 10:15am UTC](https://discuss.elastic.co/t/pod-state-0-1-running-after-set-up-elasticseatch-on-k8s-cluster-using-helm-chart/283268 "2021-09-03T10:15:57Z")
Hey! As I already mentioned here: Database file changed error - #7 by cezzarez I have a problem with elasticsearch on my k8s cluster. Looks like everything works as expected, but my pods are stucks with state 0/1. In m… --- ## [Warning: Journal has been rotated since unit was started](https://discuss.elastic.co/t/warning-journal-has-been-rotated-since-unit-was-started/283131)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 4\ **Last updated:** [September 3, 2021, 9:56am UTC](https://discuss.elastic.co/t/warning-journal-has-been-rotated-since-unit-was-started/283131 "2021-09-03T09:56:02Z")
hi everyone, i need help. i have a warning at my kibana "elastic did not load properly..." after that i check mu elasticsearch's server. i check the status. it's running so well but there's a warning "journal has been … --- ## [Synonym\_graph + match\_phrase: Unexpected high score due to the sum up of IDF of all matched synonym words](https://discuss.elastic.co/t/synonym-graph-match-phrase-unexpected-high-score-due-to-the-sum-up-of-idf-of-all-matched-synonym-words/283260)
**Author:** [@Patrick\_N](https://discuss.elastic.co/u/Patrick_N)\ **Replies:** 0\ **Last updated:** [September 3, 2021, 9:28am UTC](https://discuss.elastic.co/t/synonym-graph-match-phrase-unexpected-high-score-due-to-the-sum-up-of-idf-of-all-matched-synonym-words/283260 "2021-09-03T09:28:35Z")
(ES 7.10) I use synonym\_graph (usa, united states north america) for the search\_analyzer of a field. When I perform a match\_phrase which contains usa, the score of any matching doc which contains the term usa will be su… --- ## [How to combine indexes in Kibana when searching](https://discuss.elastic.co/t/how-to-combine-indexes-in-kibana-when-searching/283211)
**Author:** [@Aleksei](https://discuss.elastic.co/u/Aleksei)\ **Replies:** 5\ **Last updated:** [September 3, 2021, 9:51am UTC](https://discuss.elastic.co/t/how-to-combine-indexes-in-kibana-when-searching/283211 "2021-09-03T09:51:09Z")
Hi. Maybe someone has already looked for this question. How do I get data from different indexes ? How to perform a search combining two or more indexes in elastic ? --- ## [Converting x axis values from UTC epoch to date time](https://discuss.elastic.co/t/converting-x-axis-values-from-utc-epoch-to-date-time/282050)
**Author:** [@TUMAAA](https://discuss.elastic.co/u/TUMAAA)\ **Replies:** 4\ **Last updated:** [September 3, 2021, 8:00am UTC](https://discuss.elastic.co/t/converting-x-axis-values-from-utc-epoch-to-date-time/282050 "2021-09-03T08:00:43Z")
Dear community, I have x axis values in a kibana histogram plot that are UTC epoch (in nano sec). These x values are hardly usable. It would help if I can convert them to sec. Even better is if I can convert them to dat… --- ## [Tweaking autocompleteTerminateAfter](https://discuss.elastic.co/t/tweaking-autocompleteterminateafter/283010)
**Author:** [@gael17](https://discuss.elastic.co/u/gael17)\ **Replies:** 2\ **Last updated:** [September 3, 2021, 7:03am UTC](https://discuss.elastic.co/t/tweaking-autocompleteterminateafter/283010 "2021-09-03T07:03:42Z")
Hey there, I've been using controls for my kibana 7.14 dashboard. I'm wondering if there is a way to tweak the autocompleteTerminateAfter, like an "autocompleteTerminateBefore" ? Let me explain: My documents look like… --- ## [How can kibana compare two fields?](https://discuss.elastic.co/t/how-can-kibana-compare-two-fields/282918)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 7\ **Last updated:** [September 3, 2021, 6:51am UTC](https://discuss.elastic.co/t/how-can-kibana-compare-two-fields/282918 "2021-09-03T06:51:22Z")
hello! I want to compare two fields in the query bar. is it posible to do it in kibana ? example: field\_1 == value\_1 field\_2 == value\_2 thanks in advance! --- ## [Adding a node from a single node cluster to a different cluster](https://discuss.elastic.co/t/adding-a-node-from-a-single-node-cluster-to-a-different-cluster/282627)
**Author:** [@prithvirajsivarajan](https://discuss.elastic.co/u/prithvirajsivarajan)\ **Replies:** 11\ **Last updated:** [September 3, 2021, 6:26am UTC](https://discuss.elastic.co/t/adding-a-node-from-a-single-node-cluster-to-a-different-cluster/282627 "2021-09-03T06:26:47Z")
I'm using a multi node cluster with 2 master eligible nodes. I want to add a master eligible voting only node to the cluster. This node was was previously part of a single node cluster. I had setup SSH with different pas… --- ## [About the kibana error "Kibana server is not ready yetroot"](https://discuss.elastic.co/t/about-the-kibana-error-kibana-server-is-not-ready-yetroot/283231)
**Author:** [@vamei\_T](https://discuss.elastic.co/u/vamei_T)\ **Replies:** 13\ **Last updated:** [September 3, 2021, 6:17am UTC](https://discuss.elastic.co/t/about-the-kibana-error-kibana-server-is-not-ready-yetroot/283231 "2021-09-03T06:17:12Z")
my es and kibana version is 7.9.2 anyone hava method to solove is? --- ## [How to (re)include a (new) node in a cluster without impact performances?](https://discuss.elastic.co/t/how-to-re-include-a-new-node-in-a-cluster-without-impact-performances/283145)
**Author:** [@sebastienf](https://discuss.elastic.co/u/sebastienf)\ **Replies:** 3\ **Last updated:** [September 3, 2021, 6:09am UTC](https://discuss.elastic.co/t/how-to-re-include-a-new-node-in-a-cluster-without-impact-performances/283145 "2021-09-03T06:09:17Z")
Hello, Still in 5.6 ES version... I am wondering, when a node is included into a cluster, how to avoid that this one gets all new index / shards, regarding the fact that he is empty or unbalanced versus other nodes : i… --- ## [Elasticsearch - recency boost error: 'Unknown key for a START\_OBJECT in \[boosts\].'](https://discuss.elastic.co/t/elasticsearch-recency-boost-error-unknown-key-for-a-start-object-in-boosts/283194)
**Author:** [@brutal\_logic](https://discuss.elastic.co/u/brutal_logic)\ **Replies:** 3\ **Last updated:** [September 3, 2021, 5:37am UTC](https://discuss.elastic.co/t/elasticsearch-recency-boost-error-unknown-key-for-a-start-object-in-boosts/283194 "2021-09-03T05:37:43Z")
I'm using the python elasticsearch api to hit a elasticsearch on some data that has the following fields: "id", "dateCreated", "title", "text\_body" The "dateCreated" is of the form '2021-09-01T23:09:54.79362+00:00' I'… --- ## [Getting ConnectTimeoutException When joining in cluster Even if nodes are reachable](https://discuss.elastic.co/t/getting-connecttimeoutexception-when-joining-in-cluster-even-if-nodes-are-reachable/281998)
**Author:** [@ziw028](https://discuss.elastic.co/u/ziw028)\ **Replies:** 5\ **Last updated:** [September 3, 2021, 4:56am UTC](https://discuss.elastic.co/t/getting-connecttimeoutexception-when-joining-in-cluster-even-if-nodes-are-reachable/281998 "2021-09-03T04:56:01Z")
I have elasticsearch deployed on 2 node deployment setup (node1, node2) on remote machine & using the Java API to connect to it. Originally both nodes were in different clusters, and each of them is master node. Then we … --- ## [Can we parse XML data without giving xpath details using logstash?](https://discuss.elastic.co/t/can-we-parse-xml-data-without-giving-xpath-details-using-logstash/283128)
**Author:** [@Shruti\_Gupta1](https://discuss.elastic.co/u/Shruti_Gupta1)\ **Replies:** 2\ **Last updated:** [September 3, 2021, 4:03am UTC](https://discuss.elastic.co/t/can-we-parse-xml-data-without-giving-xpath-details-using-logstash/283128 "2021-09-03T04:03:53Z")
Hi Team, We are monitoring google apigee apiProxy messaging logs with ELK Stack. As we are not aware which fields will be sent by workflows in the request and response body of XML, We need help to understand how can we … --- ## [Does logstash can automatically consume new kafka topic?](https://discuss.elastic.co/t/does-logstash-can-automatically-consume-new-kafka-topic/283149)
**Author:** [@a1114066506](https://discuss.elastic.co/u/a1114066506)\ **Replies:** 2\ **Last updated:** [September 3, 2021, 1:24am UTC](https://discuss.elastic.co/t/does-logstash-can-automatically-consume-new-kafka-topic/283149 "2021-09-03T01:24:02Z")
I use input-kafka,configured by below code. input{ kafka{ bootstrap\_servers =\> "127.0.0.1:9092,127.0.0.1:9093,127.0.0.1:9094" topics\_pattern =\> "elk.\*" consumer\_threads =\> 3 decorate\_events =\> true … --- ## [Shard routing](https://discuss.elastic.co/t/shard-routing/283137)
**Author:** [@kbi753](https://discuss.elastic.co/u/kbi753)\ **Replies:** 4\ **Last updated:** [September 3, 2021, 12:26am UTC](https://discuss.elastic.co/t/shard-routing/283137 "2021-09-03T00:26:09Z")
Hello, TL; DR; How to route all indices to some nodes except some other indices to other dedicated nodes ? Or... explain me why am I on the wrong way :slight\_smile: We use ELK for a few months mostly for logging cen… --- ## [JDBC Logstash Plugin issue](https://discuss.elastic.co/t/jdbc-logstash-plugin-issue/283224)
**Author:** [@valleram](https://discuss.elastic.co/u/valleram)\ **Replies:** 1\ **Last updated:** [September 2, 2021, 11:19pm UTC](https://discuss.elastic.co/t/jdbc-logstash-plugin-issue/283224 "2021-09-02T23:19:23Z")
Hi All, I'm trying to impletement a Logstash pipeline using the JDBC plugin to fetch events from an Oracle database, but I'm receiving following errors. Java::JavaSql::SQLSyntaxErrorException: ORA-00936: missing expres… --- ## [Using variables inside of API](https://discuss.elastic.co/t/using-variables-inside-of-api/283219)
**Author:** [@lcarr](https://discuss.elastic.co/u/lcarr)\ **Replies:** 0\ **Last updated:** [September 2, 2021, 9:48pm UTC](https://discuss.elastic.co/t/using-variables-inside-of-api/283219 "2021-09-02T21:48:27Z")
OK - am losing my hair over this - I have a query that I am pulling data from the sample data index - I want to put the value of that query into the Put\_role api via python script - I am getting errors as I am sure tha… --- ## [Develop ELK Cluster](https://discuss.elastic.co/t/develop-elk-cluster/283004)
**Author:** [@psanggabuana](https://discuss.elastic.co/u/psanggabuana)\ **Replies:** 9\ **Last updated:** [September 2, 2021, 10:21pm UTC](https://discuss.elastic.co/t/develop-elk-cluster/283004 "2021-09-02T22:21:05Z")
Hi All, I have plan to create Elastic Cluster. I have prepared 3 elastic servers and SAN Storage. I will create cluster which the three nodes. I need insight to join SAN Storage to the cluster. How to join the SAN S… --- ## [Label template for a link in a script field](https://discuss.elastic.co/t/label-template-for-a-link-in-a-script-field/282649)
**Author:** [@ippo](https://discuss.elastic.co/u/ippo)\ **Replies:** 4\ **Last updated:** [September 2, 2021, 8:04pm UTC](https://discuss.elastic.co/t/label-template-for-a-link-in-a-script-field/282649 "2021-09-02T20:04:07Z")
Hello guys , Since i use multiple fields to create my url my script field return the value of the link . is there any way to put a in label template an emoji :grinning: instead of just some text. ? Also when i click on… --- ## [Query\_string DSL fails when just one search term word changes - reliably](https://discuss.elastic.co/t/query-string-dsl-fails-when-just-one-search-term-word-changes-reliably/282602)
**Author:** [@steveh](https://discuss.elastic.co/u/steveh)\ **Replies:** 6\ **Last updated:** [September 2, 2021, 4:05pm UTC](https://discuss.elastic.co/t/query-string-dsl-fails-when-just-one-search-term-word-changes-reliably/282602 "2021-09-02T16:05:14Z")
Weird problem I cannot explain or solve! On my production server queries can fail if one word changes. This is reliable. Its just the word change that triggers the error, not a fluke of unfortunate timing (i.e. the se… --- ## [Reverse the autocompleteTerminateAfter parameter?](https://discuss.elastic.co/t/reverse-the-autocompleteterminateafter-parameter/283045)
**Author:** [@gael17](https://discuss.elastic.co/u/gael17)\ **Replies:** 1\ **Last updated:** [September 2, 2021, 4:03pm UTC](https://discuss.elastic.co/t/reverse-the-autocompleteterminateafter-parameter/283045 "2021-09-02T16:03:34Z")
Hey there, I've been using controls in my kibana 7.14 setup. The autocompleteTerminateAfter is not really what I'm looking for. Let me explain: My documents look like: { type: "a" } I've been adding documents of … --- ## [Multiple field value in URL (scripted field)](https://discuss.elastic.co/t/multiple-field-value-in-url-scripted-field/283051)
**Author:** [@Loulou](https://discuss.elastic.co/u/Loulou)\ **Replies:** 1\ **Last updated:** [September 2, 2021, 4:02pm UTC](https://discuss.elastic.co/t/multiple-field-value-in-url-scripted-field/283051 "2021-09-02T16:02:07Z")
Hi, What I want to do is exactly what this user wanted to do as well: How to pass multiple field values of a table to URL So basically the possibility to pass multiple values in a field URL. I tried using the Scripted … --- ## [Match date field on day in the month](https://discuss.elastic.co/t/match-date-field-on-day-in-the-month/283069)
**Author:** [@orly\_spivak](https://discuss.elastic.co/u/orly_spivak)\ **Replies:** 1\ **Last updated:** [September 2, 2021, 3:58pm UTC](https://discuss.elastic.co/t/match-date-field-on-day-in-the-month/283069 "2021-09-02T15:58:47Z")
Hey, I have a date type field that I wont to match by, and get all documents that the date field in them is the first day of the month. I tried regex but it does not work because it's not a string field. I will be happ… --- ## [Slow query with aggregations](https://discuss.elastic.co/t/slow-query-with-aggregations/283143)
**Author:** [@Drept](https://discuss.elastic.co/u/Drept)\ **Replies:** 7\ **Last updated:** [September 2, 2021, 3:47pm UTC](https://discuss.elastic.co/t/slow-query-with-aggregations/283143 "2021-09-02T15:47:17Z")
I have implemented a system of aggregations for search filters and am enduring speed problems with a bit longer queries: there are no problems when a query contains up to 4 words but extremely slow queries onward. I hav… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=836) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=838)