# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=851 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 852 --- ## ["Cannot copy field \[ \] to fields \[ \]. Copy-to currently only works for value-type fields, not objects](https://discuss.elastic.co/t/cannot-copy-field-to-fields-copy-to-currently-only-works-for-value-type-fields-not-objects/280429)
**Author:** [@moziada](https://discuss.elastic.co/u/moziada)\ **Replies:** 2\ **Last updated:** [August 18, 2021, 11:28am UTC](https://discuss.elastic.co/t/cannot-copy-field-to-fields-copy-to-currently-only-works-for-value-type-fields-not-objects/280429 "2021-08-18T11:28:51Z")
ES = ver 7.14 Linux , mysql 8 The error happens after upgrade to 7.14 from 7.13 the issue : I use Logstash to input to ES from MySQL U used to add null (nil) value to copy\_to field, after upgrade it is not accepte… --- ## [How to delete only one document by its \_id no in kibana](https://discuss.elastic.co/t/how-to-delete-only-one-document-by-its-id-no-in-kibana/281857)
**Author:** [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\ **Replies:** 2\ **Last updated:** [August 18, 2021, 4:55pm UTC](https://discuss.elastic.co/t/how-to-delete-only-one-document-by-its-id-no-in-kibana/281857 "2021-08-18T16:55:19Z")
How to delete only one document by its \_id no in kibana Example: I just want to remove this document: id: 566a17d32bfbfe92df743764ec499321dc20e236d9a09c80305752c34541198d it is in this index: xxx-xxxxxx-xxxxx-xxxx-2… --- ## [Best practice in elasticsearch idnex](https://discuss.elastic.co/t/best-practice-in-elasticsearch-idnex/281815)
**Author:** [@naaviin](https://discuss.elastic.co/u/naaviin)\ **Replies:** 5\ **Last updated:** [August 18, 2021, 3:20pm UTC](https://discuss.elastic.co/t/best-practice-in-elasticsearch-idnex/281815 "2021-08-18T15:20:52Z")
I have few log with some same patter and some different patterh. Log name (same pattern) a.log b.log Log name (different pattern) c.log d.log Environment name env1 env2 env3 Is this good practice for index --MMYY… --- ## [Upgrade From 7.3.1 to 7.13.2 causing circuit breaker exceptions / slow performance](https://discuss.elastic.co/t/upgrade-from-7-3-1-to-7-13-2-causing-circuit-breaker-exceptions-slow-performance/281090)
**Author:** [@Justin\_Cross1](https://discuss.elastic.co/u/Justin_Cross1)\ **Replies:** 2\ **Last updated:** [August 18, 2021, 2:48pm UTC](https://discuss.elastic.co/t/upgrade-from-7-3-1-to-7-13-2-causing-circuit-breaker-exceptions-slow-performance/281090 "2021-08-18T14:48:30Z")
We upgraded from 7.3.1 to 7.13.2 using rolling upgrade and performance took a major hit. For example, a search on 7.3.1 that might take 100-200ms is taking 5000ms in 7.13.2. We had to backout the upgrade so we are on 7… --- ## [Ignore anomalies if the bucket count is lower than some threshold](https://discuss.elastic.co/t/ignore-anomalies-if-the-bucket-count-is-lower-than-some-threshold/281836)
**Author:** [@one](https://discuss.elastic.co/u/one)\ **Replies:** 0\ **Last updated:** [August 18, 2021, 2:41pm UTC](https://discuss.elastic.co/t/ignore-anomalies-if-the-bucket-count-is-lower-than-some-threshold/281836 "2021-08-18T14:41:08Z")
I am investigating anomalies as the mean value of a field over buckets. So far, the results seem to be correct. However, in the domain I am working with, if the number of documents in the buckets is lower than some thres… --- ## [How can I parse 2 log files to 2 index in Kibana](https://discuss.elastic.co/t/how-can-i-parse-2-log-files-to-2-index-in-kibana/281711)
**Author:** [@MT2021](https://discuss.elastic.co/u/MT2021)\ **Replies:** 5\ **Last updated:** [August 18, 2021, 2:31pm UTC](https://discuss.elastic.co/t/how-can-i-parse-2-log-files-to-2-index-in-kibana/281711 "2021-08-18T14:31:10Z")
Hi ELK community, I am a absolutely newbie in the Elasticsearch. I am getting a stuck in creating 2 pipelines towards 2 indexes of 2 log file (2 services in corresponding). My topo likes that: Filebeat ==\> logstash =… --- ## [Complex bucket aggregation](https://discuss.elastic.co/t/complex-bucket-aggregation/281689)
**Author:** [@Tkachleo](https://discuss.elastic.co/u/Tkachleo)\ **Replies:** 3\ **Last updated:** [August 18, 2021, 1:13pm UTC](https://discuss.elastic.co/t/complex-bucket-aggregation/281689 "2021-08-18T13:13:37Z")
Hi, I need some help with a complex aggregation. I have these 3 documents: { "id": 1, "@timestamp": "2021-08-17 12:00:00", "result": "FAIL" }, { "id": 2, "@timestamp": "2021-08-17 12:05:00", "result": "PAS… --- ## [Logstash file input not processing (windows)](https://discuss.elastic.co/t/logstash-file-input-not-processing-windows/281720)
**Author:** [@alejandroalv87](https://discuss.elastic.co/u/alejandroalv87)\ **Replies:** 5\ **Last updated:** [August 18, 2021, 12:23pm UTC](https://discuss.elastic.co/t/logstash-file-input-not-processing-windows/281720 "2021-08-18T12:23:43Z")
I am trying to process an apache log file to logstash and file is not getting process. My config file here: input { file { path =\> "C:\\Users\\alejandro.alvarez\\Downloads\\elasticsearch\_kibana\\data\\logs\\apache\_access.lo… --- ## [Property totalHits always 0](https://discuss.elastic.co/t/property-totalhits-always-0/281789)
**Author:** [@Christophe\_NOWOSAD](https://discuss.elastic.co/u/Christophe_NOWOSAD)\ **Replies:** 1\ **Last updated:** [August 18, 2021, 9:09am UTC](https://discuss.elastic.co/t/property-totalhits-always-0/281789 "2021-08-18T09:09:09Z")
Hello, I am using Elastic client in our Springboot API (client version 6.5.4). My application is using 2 different indexes, one is on version 6, the second on version 7. For the version 6, everything is working fine, … --- ## [Using Kibana REST API to generate visualization](https://discuss.elastic.co/t/using-kibana-rest-api-to-generate-visualization/281554)
**Author:** [@U2P](https://discuss.elastic.co/u/U2P)\ **Replies:** 2\ **Last updated:** [August 18, 2021, 9:06am UTC](https://discuss.elastic.co/t/using-kibana-rest-api-to-generate-visualization/281554 "2021-08-18T09:06:32Z")
Hello everyone, I'm looking to generate dashboards and visualizations using the Kibana API and run a Python script. I watch a lot of other threads but couldn't find what I needed. The context: A python script parses… --- ## [Logstash data unload](https://discuss.elastic.co/t/logstash-data-unload/281506)
**Author:** [@onlinekap](https://discuss.elastic.co/u/onlinekap)\ **Replies:** 8\ **Last updated:** [August 18, 2021, 7:30am UTC](https://discuss.elastic.co/t/logstash-data-unload/281506 "2021-08-18T07:30:17Z")
Hello, I am newbie here.. I have a bunch of ELK indexes that returns below output when querying via POSTMAN GET request. \ { "took": 5, "timed\_out": false, "\_shards": { "total": 1, "successful": 1, "skipped": 0… --- ## ["Precomputed hashes" on client side](https://discuss.elastic.co/t/precomputed-hashes-on-client-side/281774)
**Author:** [@jidetashuo](https://discuss.elastic.co/u/jidetashuo)\ **Replies:** 0\ **Last updated:** [August 18, 2021, 6:46am UTC](https://discuss.elastic.co/t/precomputed-hashes-on-client-side/281774 "2021-08-18T06:46:55Z")
I found documentation on "Precomputed hashes" on client side but it does not mention how,how I can generate murmur hash outside of ElasticSearch and later use that to find cardinality --- ## [Elasticsearch Restful API query string](https://discuss.elastic.co/t/elasticsearch-restful-api-query-string/281707)
**Author:** [@f26227279](https://discuss.elastic.co/u/f26227279)\ **Replies:** 1\ **Last updated:** [August 18, 2021, 6:16am UTC](https://discuss.elastic.co/t/elasticsearch-restful-api-query-string/281707 "2021-08-18T06:16:46Z")
The query String in Kibana is : system:APC AND host: F12\*R2R\* AND message:"Turn to Phase \[F12P7\]" , and I want to query through Restful API like below: String bodycontent="{" +" \\"\_source\\": \[\\"@timest… --- ## [Kibana Timestamp](https://discuss.elastic.co/t/kibana-timestamp/281761)
**Author:** [@irfanifse](https://discuss.elastic.co/u/irfanifse)\ **Replies:** 2\ **Last updated:** [August 18, 2021, 4:08am UTC](https://discuss.elastic.co/t/kibana-timestamp/281761 "2021-08-18T04:08:05Z")
Hi, I have requirement on Timestamp Time range calculation for particular hours Eg: if a document comes to kibana at 9AM i need to find how many document came from that time and waiting for further process from respect… --- ## [Endpoint-security State changed to DEGRADED: Protecting with policy](https://discuss.elastic.co/t/endpoint-security-state-changed-to-degraded-protecting-with-policy/281308)
**Author:** [@Alexey\_Shalin](https://discuss.elastic.co/u/Alexey_Shalin)\ **Replies:** 4\ **Last updated:** [August 17, 2021, 3:18am UTC](https://discuss.elastic.co/t/endpoint-security-state-changed-to-degraded-protecting-with-policy/281308 "2021-08-17T03:18:09Z")
Good Day, After some mins after staring agent Elastic Agent .. status changed from Health to UnHealth (with Endpoint Security Integration) I check logs and find line: endpoint-security State changed to DEGRADED: Protec… --- ## [Percolate query performance optimization](https://discuss.elastic.co/t/percolate-query-performance-optimization/281750)
**Author:** [@jesse\_c](https://discuss.elastic.co/u/jesse_c)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 9:41pm UTC](https://discuss.elastic.co/t/percolate-query-performance-optimization/281750 "2021-08-17T21:41:58Z")
We're on Elasticsearch 7.9. We have a percolate index that hosts about 120 queries. The index has 5 shards, each of which has two replicas. We started to encounter performance issues after adding around 10 queries that … --- ## [Single master node cluster dies when master node dies](https://discuss.elastic.co/t/single-master-node-cluster-dies-when-master-node-dies/281559)
**Author:** [@iojas](https://discuss.elastic.co/u/iojas)\ **Replies:** 4\ **Last updated:** [August 17, 2021, 11:05pm UTC](https://discuss.elastic.co/t/single-master-node-cluster-dies-when-master-node-dies/281559 "2021-08-17T23:05:41Z")
I am using ECK to deploy an ES cluster. my setup has 1 master node and 3 data nodes. If for some reason master nodes dies it comes back up (thanks to statefulsets in kubernetes), but associates itself with a different cl… --- ## [Logstash always outputting only 9 documents](https://discuss.elastic.co/t/logstash-always-outputting-only-9-documents/281751)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 10:19pm UTC](https://discuss.elastic.co/t/logstash-always-outputting-only-9-documents/281751 "2021-08-17T22:19:24Z")
I have a json file with 4K json objects in it. Each object is on its own line. I'm using the file plugin with the multiline codec to have Logstash parse all the objects. I'm also flattening the json objects and then send… --- ## [What happens to unampped fields? What are the performance disadvantage of not mapping a field?](https://discuss.elastic.co/t/what-happens-to-unampped-fields-what-are-the-performance-disadvantage-of-not-mapping-a-field/281746)
**Author:** [@Vaibhav\_Singal](https://discuss.elastic.co/u/Vaibhav_Singal)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 9:59pm UTC](https://discuss.elastic.co/t/what-happens-to-unampped-fields-what-are-the-performance-disadvantage-of-not-mapping-a-field/281746 "2021-08-17T21:59:37Z")
I have an index with dynamic mapping set to false. PUT index\_a { "mappings": { "\_doc": { "dynamic": false, "properties": { "\_doc": { "properties": { "id": { … --- ## [Add nodes or add CPU](https://discuss.elastic.co/t/add-nodes-or-add-cpu/281744)
**Author:** [@terrainc](https://discuss.elastic.co/u/terrainc)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 9:08pm UTC](https://discuss.elastic.co/t/add-nodes-or-add-cpu/281744 "2021-08-17T21:08:46Z")
Hi! I have 3 nodes cluster (build on virtual machines 24 cores 72Gb mem each). 120k/s messages. Cpu usage about 75-80% so, probably, I need to add more CPU. Also I want to add more disk space (x2 more). So I have two w… --- ## [Can I get BM25 score as part of script field?](https://discuss.elastic.co/t/can-i-get-bm25-score-as-part-of-script-field/281747)
**Author:** [@12minutes](https://discuss.elastic.co/u/12minutes)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 7:59pm UTC](https://discuss.elastic.co/t/can-i-get-bm25-score-as-part-of-script-field/281747 "2021-08-17T19:59:30Z")
The default score will be calculated in a different way. Just wondering is there any easy way to get default bm25 score as part of script function/script field? --- ## [Not able to edit alert in kibana 7.14 "Transaction error rate threshold"](https://discuss.elastic.co/t/not-able-to-edit-alert-in-kibana-7-14-transaction-error-rate-threshold/281501)
**Author:** [@prashant.j.singh](https://discuss.elastic.co/u/prashant.j.singh)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 7:53pm UTC](https://discuss.elastic.co/t/not-able-to-edit-alert-in-kibana-7-14-transaction-error-rate-threshold/281501 "2021-08-17T19:53:54Z")
I have upgrade kibana 7.13 to 7.14 but I am not able to edit or change threshold value and time for kibana alert " Transaction error rate threshold" kibana version : 7.14 please find attachment for screen shot. --- ## [Change indices.memory.index\_buffer\_size on a working elasticsearch cluster](https://discuss.elastic.co/t/change-indices-memory-index-buffer-size-on-a-working-elasticsearch-cluster/281737)
**Author:** [@Voula\_Mikr](https://discuss.elastic.co/u/Voula_Mikr)\ **Replies:** 3\ **Last updated:** [August 17, 2021, 6:43pm UTC](https://discuss.elastic.co/t/change-indices-memory-index-buffer-size-on-a-working-elasticsearch-cluster/281737 "2021-08-17T18:43:42Z")
Hi, Is there any way to change indices.memory.index\_buffer\_size on a working elasticsearch cluster? Is that possible through an API? Thank you in advance. --- ## [Get task ids after executing search query](https://discuss.elastic.co/t/get-task-ids-after-executing-search-query/281719)
**Author:** [@NLSVTN](https://discuss.elastic.co/u/NLSVTN)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 4:46pm UTC](https://discuss.elastic.co/t/get-task-ids-after-executing-search-query/281719 "2021-08-17T16:46:37Z")
I need to give a user an ability to terminate a query initiated by Elasticsearch-DSL or Elasticsearch-py. I know how to get a list of tasks running on the server but I can't just terminate all of them since there is a ch… --- ## [Logstash forwarding MSFT Server logs into Azure](https://discuss.elastic.co/t/logstash-forwarding-msft-server-logs-into-azure/281708)
**Author:** [@JBHuber](https://discuss.elastic.co/u/JBHuber)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 4:45pm UTC](https://discuss.elastic.co/t/logstash-forwarding-msft-server-logs-into-azure/281708 "2021-08-17T16:45:54Z")
Hoping someone here has tried to do this same thing. We are using Logstash as a forwarder of linux & windows logs into MSFT Azure Sentinel. We do segregate (or TAG) the logs as "windows" and "linux". Linux is fine and … --- ## [AppSearch: Error during document insert. "There was a decoding error. Please ensure your request is valid."](https://discuss.elastic.co/t/appsearch-error-during-document-insert-there-was-a-decoding-error-please-ensure-your-request-is-valid/279783)
**Author:** [@mbrimmer83](https://discuss.elastic.co/u/mbrimmer83)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 2:58pm UTC](https://discuss.elastic.co/t/appsearch-error-during-document-insert-there-was-a-decoding-error-please-ensure-your-request-is-valid/279783 "2021-08-17T14:58:37Z")
Error Message: "There was a decoding error. Please ensure your request is valid." I am receiving an error while inserting document. I am within the limit and this is occurring randomly during a large insert process wher… --- ## [XML filter - processing of an array of values](https://discuss.elastic.co/t/xml-filter-processing-of-an-array-of-values/281601)
**Author:** [@Robo](https://discuss.elastic.co/u/Robo)\ **Replies:** 4\ **Last updated:** [August 17, 2021, 2:55pm UTC](https://discuss.elastic.co/t/xml-filter-processing-of-an-array-of-values/281601 "2021-08-17T14:55:23Z")
We're processing some xml events using the xml filter. The filter setup it's quite simple: filter { xml { source =\> "message" target =\> "xml" } } This filter generates two fields with an array of v… --- ## ["This event cannot be analyzed since it has incompatible field mappings" On my own log](https://discuss.elastic.co/t/this-event-cannot-be-analyzed-since-it-has-incompatible-field-mappings-on-my-own-log/280319)
**Author:** [@nberens](https://discuss.elastic.co/u/nberens)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 2:43pm UTC](https://discuss.elastic.co/t/this-event-cannot-be-analyzed-since-it-has-incompatible-field-mappings-on-my-own-log/280319 "2021-08-17T14:43:56Z")
Hello, i am currently integrating our watchguard vpn logs into our Elasticsearch siem. I basically build a logstash rule that takes its Syslog output and mapps it onto ECS. While everthing now works as expected, i no… --- ## [Filter out the same event and send to different outputs](https://discuss.elastic.co/t/filter-out-the-same-event-and-send-to-different-outputs/281611)
**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\ **Replies:** 4\ **Last updated:** [August 17, 2021, 2:40pm UTC](https://discuss.elastic.co/t/filter-out-the-same-event-and-send-to-different-outputs/281611 "2021-08-17T14:40:24Z")
What I want is, the event i get from the Beats by listening to the port 5044, to send a filtered version of the event to one output and send a differently filtered version to the other output. That is the general questi… --- ## [Compare float value generated from Glok Pattern](https://discuss.elastic.co/t/compare-float-value-generated-from-glok-pattern/281616)
**Author:** [@Athul\_Devkar](https://discuss.elastic.co/u/Athul_Devkar)\ **Replies:** 4\ **Last updated:** [August 17, 2021, 2:38pm UTC](https://discuss.elastic.co/t/compare-float-value-generated-from-glok-pattern/281616 "2021-08-17T14:38:26Z")
Dear All, I am trying to compare 2 float fields, which are created from Grok patterns match. But this is crashing the pipeline. Not able to figure out what is missing here! Kindly help. if \[message\] =~ "Customer Type … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=850) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=852)