# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=839 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 840 --- ## [Automatic Write Block on Index](https://discuss.elastic.co/t/automatic-write-block-on-index/283014)
**Author:** [@Aamir\_Rizwan](https://discuss.elastic.co/u/Aamir_Rizwan)\ **Replies:** 2\ **Last updated:** [September 1, 2021, 10:09pm UTC](https://discuss.elastic.co/t/automatic-write-block-on-index/283014 "2021-09-01T22:09:11Z")
I have 3 master and 3 data nodes. I was getting this error: AuthorizationException(403, 'cluster\_block\_exception', 'blocked by: \[FORBIDDEN/8/index write (api)\];') Increased the data nodes by 1 but still getting the sam… --- ## [ElasticSearch as primary database and other solutions](https://discuss.elastic.co/t/elasticsearch-as-primary-database-and-other-solutions/283021)
**Author:** [@xemyleex](https://discuss.elastic.co/u/xemyleex)\ **Replies:** 5\ **Last updated:** [September 1, 2021, 10:07pm UTC](https://discuss.elastic.co/t/elasticsearch-as-primary-database-and-other-solutions/283021 "2021-09-01T22:07:50Z")
I am using elasticsearch as primary database. But due to the lack of the ACID properties, I want to: or replace it with another database with similar or better performances ( maybe postgresql or kafka/ksql ). or use ot… --- ## [Simultaneous data use of 2 indices differentes | Utilisation simultanée de 2 indices differents](https://discuss.elastic.co/t/simultaneous-data-use-of-2-indices-differentes-utilisation-simultanee-de-2-indices-differents/281688)
**Author:** [@kalache](https://discuss.elastic.co/u/kalache)\ **Replies:** 5\ **Last updated:** [September 1, 2021, 9:54pm UTC](https://discuss.elastic.co/t/simultaneous-data-use-of-2-indices-differentes-utilisation-simultanee-de-2-indices-differents/281688 "2021-09-01T21:54:33Z")
Hello, I’m improving the IT inventory and I want to use the Elastic Stack to made it. Logstash collect data into CSV file, Elasticsearch analyze this data and Kibana let us to visualize the data. Why we want to use El… --- ## [Filter in aggregation not working with top hits](https://discuss.elastic.co/t/filter-in-aggregation-not-working-with-top-hits/282964)
**Author:** [@saurabh.biswas](https://discuss.elastic.co/u/saurabh.biswas)\ **Replies:** 2\ **Last updated:** [September 1, 2021, 8:17pm UTC](https://discuss.elastic.co/t/filter-in-aggregation-not-working-with-top-hits/282964 "2021-09-01T20:17:58Z")
Hello, I'm trying to write a query to form an aggregation of all the colleges under a university, put them into country id buckets and get the top colleges based out of each country. Somehow I'm not getting what I'm ex… --- ## [Multiple Elasticsearch Filters in one Logstash Pipeline](https://discuss.elastic.co/t/multiple-elasticsearch-filters-in-one-logstash-pipeline/283087)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 5\ **Last updated:** [September 1, 2021, 6:49pm UTC](https://discuss.elastic.co/t/multiple-elasticsearch-filters-in-one-logstash-pipeline/283087 "2021-09-01T18:49:29Z")
Is it possible to do multiple Elasticsearch lookup filters to search multiple indices in a single Logstash pipeline? --- ## [Troubleshooting logstash configs](https://discuss.elastic.co/t/troubleshooting-logstash-configs/282842)
**Author:** [@kriss332](https://discuss.elastic.co/u/kriss332)\ **Replies:** 8\ **Last updated:** [September 1, 2021, 6:14pm UTC](https://discuss.elastic.co/t/troubleshooting-logstash-configs/282842 "2021-09-01T18:14:11Z")
Hi all.. I've been working on ELK for about a couple of months now and I've been really liking it apart from the troubelshooting steps. I've just integrated a syslog for trial before going heavily onto production phase. … --- ## [Purpose of State files](https://discuss.elastic.co/t/purpose-of-state-files/282849)
**Author:** [@hyadavalli](https://discuss.elastic.co/u/hyadavalli)\ **Replies:** 5\ **Last updated:** [September 1, 2021, 5:17pm UTC](https://discuss.elastic.co/t/purpose-of-state-files/282849 "2021-09-01T17:17:17Z")
Hello Everyone, After searching everywhere, I couldn't find the purpose of state files. We started off with version 2.2 and then went to 5.6 and then at 6.8 atm. Below is the scenario we frequently run into: Elastics… --- ## [Counting events in a specific time range](https://discuss.elastic.co/t/counting-events-in-a-specific-time-range/282932)
**Author:** [@katja1](https://discuss.elastic.co/u/katja1)\ **Replies:** 2\ **Last updated:** [September 1, 2021, 5:50pm UTC](https://discuss.elastic.co/t/counting-events-in-a-specific-time-range/282932 "2021-09-01T17:50:02Z")
Our problem is the following; we are collecting information about customers visiting our page. We are intrested in counting repeated visits by the same customer in a specific time range - we would like to determine the n… --- ## [Kibana is extremely slow (Loading graphs, new pages, etc.)](https://discuss.elastic.co/t/kibana-is-extremely-slow-loading-graphs-new-pages-etc/282955)
**Author:** [@Dave\_Houser](https://discuss.elastic.co/u/Dave_Houser)\ **Replies:** 6\ **Last updated:** [September 1, 2021, 5:32pm UTC](https://discuss.elastic.co/t/kibana-is-extremely-slow-loading-graphs-new-pages-etc/282955 "2021-09-01T17:32:40Z")
System: Ubuntu 18.04 16 Cores 16Gb RAM ELK system ELK 7.14 Single node (Kibana, Elastic, Logstash) All was deployed with Ubuntu apt (Install Elasticsearch with Debian Package | Elasticsearch Guide \[7.14\] | Elastic)… --- ## [Kafka connectors/streaming for enriching the data](https://discuss.elastic.co/t/kafka-connectors-streaming-for-enriching-the-data/283083)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 0\ **Last updated:** [September 1, 2021, 4:56pm UTC](https://discuss.elastic.co/t/kafka-connectors-streaming-for-enriching-the-data/283083 "2021-09-01T16:56:38Z")
Is it possible to enrich/transform the data in Kafka connect/Streams and feed it to elasticsearch, without using logstash for data transformation/enrichment? --- ## [Как указать допустимую дистанцию между токенами в запросе query\_string?](https://discuss.elastic.co/t/query-string/283019)
**Author:** [@armada007](https://discuss.elastic.co/u/armada007)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 3:22pm UTC](https://discuss.elastic.co/t/query-string/283019 "2021-09-01T15:22:29Z")
Доброго времени суток! Делаю попытки реализовать полнотекстовый поиск по документам. Предполагается что в строку поиска можно будет вводить различные операторы: AND - логическое И OR - логическое ИЛИ NOT - указанное … --- ## [Multiple Grok patterns help](https://discuss.elastic.co/t/multiple-grok-patterns-help/282965)
**Author:** [@Zorkmid](https://discuss.elastic.co/u/Zorkmid)\ **Replies:** 4\ **Last updated:** [September 1, 2021, 3:17pm UTC](https://discuss.elastic.co/t/multiple-grok-patterns-help/282965 "2021-09-01T15:17:19Z")
Hi All, I'm doing something wrong with the following. The goal is parse 5 basic events from a PulseSecure VPN syslog feed. Is the following the correct?? filter { if "PulseSecure" in \[message\] { grok { … --- ## [Applying aggregation to query results](https://discuss.elastic.co/t/applying-aggregation-to-query-results/283042)
**Author:** [@me.mohammed](https://discuss.elastic.co/u/me.mohammed)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 2:52pm UTC](https://discuss.elastic.co/t/applying-aggregation-to-query-results/283042 "2021-09-01T14:52:22Z")
Hello everyone, I'm trying to apply an aggregation filter to my query, I basically have an array of objects which looks like this { "productDeals": \[ { "id": 1, "startAt": "2021-08-30T17:40:14.000Z", "end… --- ## [Alert if index has 0 documents in last X minutes (Rules and connectors or Detection Rules)](https://discuss.elastic.co/t/alert-if-index-has-0-documents-in-last-x-minutes-rules-and-connectors-or-detection-rules/282902)
**Author:** [@gneves](https://discuss.elastic.co/u/gneves)\ **Replies:** 3\ **Last updated:** [September 1, 2021, 2:36pm UTC](https://discuss.elastic.co/t/alert-if-index-has-0-documents-in-last-x-minutes-rules-and-connectors-or-detection-rules/282902 "2021-09-01T14:36:36Z")
Hello Guys, I've been working around with "Rules and Connectors" and "Detection Rules" in order to get a notification when one of my beats stops sending data. Each beat has different indexes, so i would like to "know" i… --- ## [Two node cluster - Keep certain indexes on primary instance](https://discuss.elastic.co/t/two-node-cluster-keep-certain-indexes-on-primary-instance/283050)
**Author:** [@save4elastic](https://discuss.elastic.co/u/save4elastic)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 2:29pm UTC](https://discuss.elastic.co/t/two-node-cluster-keep-certain-indexes-on-primary-instance/283050 "2021-09-01T14:29:51Z")
Is it possible to keep certain high usage indices on the more powerful instance and offload indexes that are older to a low power instance? I am hoping to keep all shards of new indexes on the primary instance to increas… --- ## [From logstash how to lookup on a data in elastic index?](https://discuss.elastic.co/t/from-logstash-how-to-lookup-on-a-data-in-elastic-index/281387)
**Author:** [@sathish.mtech01](https://discuss.elastic.co/u/sathish.mtech01)\ **Replies:** 10\ **Last updated:** [August 18, 2021, 6:36pm UTC](https://discuss.elastic.co/t/from-logstash-how-to-lookup-on-a-data-in-elastic-index/281387 "2021-08-18T18:36:15Z")
Need a support, i have created a lookup index in elastic search index - lookup Username;Identifier;First name;Last name booker12;l9012;Rachel;Booker grey07;l2070;Laura;Grey johnson81;l4081;Craig;Johnson jenkins46;… --- ## [Is Update By Query API a good choice to update single document in elasticsearch?](https://discuss.elastic.co/t/is-update-by-query-api-a-good-choice-to-update-single-document-in-elasticsearch/283035)
**Author:** [@Karthikeyan\_Amaresan](https://discuss.elastic.co/u/Karthikeyan_Amaresan)\ **Replies:** 2\ **Last updated:** [September 1, 2021, 1:30pm UTC](https://discuss.elastic.co/t/is-update-by-query-api-a-good-choice-to-update-single-document-in-elasticsearch/283035 "2021-09-01T13:30:16Z")
I have a use case where i want to update the document without knowing its index. Currently i am querying by id and getting the index and then updating (2 operation). Update By Query API seems to perform this use case in … --- ## [Поиск в индексе с "грязными" данными](https://discuss.elastic.co/t/topic/282814)
**Author:** [@Jenya87](https://discuss.elastic.co/u/Jenya87)\ **Replies:** 7\ **Last updated:** [September 1, 2021, 1:21pm UTC](https://discuss.elastic.co/t/topic/282814 "2021-09-01T13:21:46Z")
Доброго времени суток. Иcпользую ES 7.13. Есть индекс, созданный программой FSCrawler. В самом индексе есть данные о номерах телефона, но вот беда, их формат может быть: 7(999)111-22-333 или 7-999-111-22-333 или 7.999.… --- ## [ElasticSearch version 7.14.0 can't highlight with search\_as\_you\_type datatype subfield](https://discuss.elastic.co/t/elasticsearch-version-7-14-0-cant-highlight-with-search-as-you-type-datatype-subfield/283005)
**Author:** [@andrewbien](https://discuss.elastic.co/u/andrewbien)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 1:17pm UTC](https://discuss.elastic.co/t/elasticsearch-version-7-14-0-cant-highlight-with-search-as-you-type-datatype-subfield/283005 "2021-09-01T13:17:05Z")
Here is my example to reproduce the problem: PUT mytest { "mappings": { "properties": { "title": { "type": "keyword", "fields": { "autocomplete": { "type": "search\_as\_y… --- ## [Mapping](https://discuss.elastic.co/t/mapping/281242)
**Author:** [@Hind](https://discuss.elastic.co/u/Hind)\ **Replies:** 4\ **Last updated:** [September 1, 2021, 11:44am UTC](https://discuss.elastic.co/t/mapping/281242 "2021-09-01T11:44:32Z")
Bonjour, j'ai une petite question. j'utilise logstash pour importer un fichier csv vers elasticsearch, comment pourrais-je créer mon propre mapping ? Je trouve souvent des tutos qui montrent comment le faire mais juste… --- ## [TSVB Variable Name Markdown Syntax](https://discuss.elastic.co/t/tsvb-variable-name-markdown-syntax/281352)
**Author:** [@Bustencio](https://discuss.elastic.co/u/Bustencio)\ **Replies:** 4\ **Last updated:** [September 1, 2021, 11:17am UTC](https://discuss.elastic.co/t/tsvb-variable-name-markdown-syntax/281352 "2021-09-01T11:17:49Z")
Hi, I'm trying to create a TSVB visualization using Markdown to show values and some text. My problem appears when accessing label names while using date fields in a Terms aggregation because it overwrites the label. Is… --- ## [Logstash Pipeline CSV Date Filter Issue](https://discuss.elastic.co/t/logstash-pipeline-csv-date-filter-issue/282994)
**Author:** [@piotr.krupinski](https://discuss.elastic.co/u/piotr.krupinski)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 10:40am UTC](https://discuss.elastic.co/t/logstash-pipeline-csv-date-filter-issue/282994 "2021-09-01T10:40:53Z")
Hello, I have an issue with pipeline which should fetch data from CSV file. When I'm adding a "Data" to filter section because I need to have it in Elastic as a date it does not want to work. The config is below: inpu… --- ## [Unexpected "Nesting" for Single Property on IndexRequests Failing](https://discuss.elastic.co/t/unexpected-nesting-for-single-property-on-indexrequests-failing/282930)
**Author:** [@rionmonster](https://discuss.elastic.co/u/rionmonster)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 8:49am UTC](https://discuss.elastic.co/t/unexpected-nesting-for-single-property-on-indexrequests-failing/282930 "2021-09-01T08:49:48Z")
Hi all, I recently started using Elasticsearch and I was a bit baffled when I tried to create an IndexRequest to one of my indices using the following payload and receiving a limit of mapping depth exceeded message: "st… --- ## [Combine Exact/phrase search and \* to get results starting with firstname lastname\* - Robert will\*](https://discuss.elastic.co/t/combine-exact-phrase-search-and-to-get-results-starting-with-firstname-lastname-robert-will/282962)
**Author:** [@lakshmiteja\_salapu](https://discuss.elastic.co/u/lakshmiteja_salapu)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 8:48am UTC](https://discuss.elastic.co/t/combine-exact-phrase-search-and-to-get-results-starting-with-firstname-lastname-robert-will/282962 "2021-09-01T08:48:05Z")
I want to search for Robert Will\* and expecting results that include Robert willow , Robert wills But I am getting documents that contain Robert Smith with street address 18 willow street Question 1) How to get resul… --- ## [How to serialize SearchRequest?](https://discuss.elastic.co/t/how-to-serialize-searchrequest/282793)
**Author:** [@fatcloud](https://discuss.elastic.co/u/fatcloud)\ **Replies:** 6\ **Last updated:** [September 1, 2021, 8:33am UTC](https://discuss.elastic.co/t/how-to-serialize-searchrequest/282793 "2021-09-01T08:33:57Z")
Hi, I'm new to elastic search, I need to log SearchRequest and use them later for testing/analysis purpose, what's the best practice to serialize/deserialize a SearchRequest in Java? Thanks! --- ## [Logstash filter file issue](https://discuss.elastic.co/t/logstash-filter-file-issue/282993)
**Author:** [@Nazakat](https://discuss.elastic.co/u/Nazakat)\ **Replies:** 0\ **Last updated:** [September 1, 2021, 6:25am UTC](https://discuss.elastic.co/t/logstash-filter-file-issue/282993 "2021-09-01T06:25:17Z")
My winlogbeat new version is not parsing. new version is 7.14.0 and old version is same filter files is parse. --- ## [GEO data losing definition after changing index name](https://discuss.elastic.co/t/geo-data-losing-definition-after-changing-index-name/282917)
**Author:** [@john12](https://discuss.elastic.co/u/john12)\ **Replies:** 2\ **Last updated:** [September 1, 2021, 5:17am UTC](https://discuss.elastic.co/t/geo-data-losing-definition-after-changing-index-name/282917 "2021-09-01T05:17:21Z")
Hello , i was having geo data with no problems and visualize it on maps, after changing the index name then it not appeared as geo data. would u help me solve this? --- ## [データ登録時にIPアドレスの範囲をチェックする方法](https://discuss.elastic.co/t/ip/282866)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 3\ **Last updated:** [September 1, 2021, 1:50am UTC](https://discuss.elastic.co/t/ip/282866 "2021-09-01T01:50:39Z")
logstash→Elasticsearchというルートで、IPアドレスフィールドを保持するドキュメントを登録しています。登録時にIPアドレスをチェックし、指定の範囲内であればフラグを付与したいのですが可能でしょうか？LogstashもしくはIngestノードにて可能ではないかと思うのですが、情報が見当たらず投稿させて頂きました。ご教示いただけますでしょうか。 --- ## [Watcherで連続データに対する検知をする方法](https://discuss.elastic.co/t/watcher/282482)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 1:50am UTC](https://discuss.elastic.co/t/watcher/282482 "2021-09-01T01:50:15Z")
認証ログなどで、特定アカウントでログイン認証が連続で3回失敗した場合にアラートを発報するという仕組みをwatcherで実装したいです。 例) 発報する場合 UserA OK UserB NG UserC OK UserB NG UserB NG →発報あり(UserBは3回連続して失敗しているため) 例)発報なし UserA OK UserB NG UserC OK UserB NG UserB OK Use… --- ## [Simple full search](https://discuss.elastic.co/t/simple-full-search/282939)
**Author:** [@Chen\_Shacham](https://discuss.elastic.co/u/Chen_Shacham)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 12:46am UTC](https://discuss.elastic.co/t/simple-full-search/282939 "2021-09-01T00:46:04Z")
Hi I am using REST api to search my index. How can i use search api to look for phrase: "My name" in all fields? [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=838) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=840)