# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=880 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 881 --- ## [Index in certain set of nodes](https://discuss.elastic.co/t/index-in-certain-set-of-nodes/278920)
**Author:** [@Roman\_Kagan](https://discuss.elastic.co/u/Roman_Kagan)\ **Replies:** 1\ **Last updated:** [July 19, 2021, 9:45am UTC](https://discuss.elastic.co/t/index-in-certain-set-of-nodes/278920 "2021-07-19T09:45:34Z")
Hello: I have 5 nodes cluster - would it be possible to set the primary and replicas to be on certain nodes and not others. For example, I'd like to achieve that index-1 would be on node-a, node-b and node-c and NOT on… --- ## [TimeValue - number\_format\_exception - Java client](https://discuss.elastic.co/t/timevalue-number-format-exception-java-client/279015)
**Author:** [@Leuteris](https://discuss.elastic.co/u/Leuteris)\ **Replies:** 1\ **Last updated:** [July 19, 2021, 9:36am UTC](https://discuss.elastic.co/t/timevalue-number-format-exception-java-client/279015 "2021-07-19T09:36:43Z")
I have a search request using PointInTimeBuilder: PointInTimeBuilder pointInTimeBuilder = new PointInTimeBuilder("id..."); pointInTimeBuilder.setKeepAlive(TimeValue.timeValueSeconds(66)); The keep\_alive value is 66 sec… --- ## [How to add http response header in Elasticsearch](https://discuss.elastic.co/t/how-to-add-http-response-header-in-elasticsearch/278981)
**Author:** [@yupengj](https://discuss.elastic.co/u/yupengj)\ **Replies:** 1\ **Last updated:** [July 19, 2021, 9:12am UTC](https://discuss.elastic.co/t/how-to-add-http-response-header-in-elasticsearch/278981 "2021-07-19T09:12:23Z")
I encountered three security-related issues when using elasticserrch version 7.6.1. Thank you for your help. How does elasticserrch configure http response headers, such as X-Content-Type-Options, X-XSS-Protection, Con… --- ## [Date type changed to text after upgrading from elastic and kiban 6.4.1 to 7.8.0](https://discuss.elastic.co/t/date-type-changed-to-text-after-upgrading-from-elastic-and-kiban-6-4-1-to-7-8-0/277803)
**Author:** [@karim.zahar](https://discuss.elastic.co/u/karim.zahar)\ **Replies:** 2\ **Last updated:** [July 19, 2021, 8:07am UTC](https://discuss.elastic.co/t/date-type-changed-to-text-after-upgrading-from-elastic-and-kiban-6-4-1-to-7-8-0/277803 "2021-07-19T08:07:38Z")
hello, I have developed a java springboot batch that collect data from middleware logs and insert it to elastic index, the index is created by the batch with some fields that have date type (datein, dateout...). After … --- ## [Performance issue in Azure](https://discuss.elastic.co/t/performance-issue-in-azure/279026)
**Author:** [@Kai\_Shen](https://discuss.elastic.co/u/Kai_Shen)\ **Replies:** 0\ **Last updated:** [July 19, 2021, 7:24am UTC](https://discuss.elastic.co/t/performance-issue-in-azure/279026 "2021-07-19T07:24:08Z")
Hi, a customer is running into performance issues on Azure. His environment: 3 nodes cluster, 8 GB RAM each. 1 index (around 10 fields), 4 GB storage for this index, so very small. Here are his observations: A query i… --- ## [What is the best way to store unique values of a field](https://discuss.elastic.co/t/what-is-the-best-way-to-store-unique-values-of-a-field/278548)
**Author:** [@OmarDacca](https://discuss.elastic.co/u/OmarDacca)\ **Replies:** 6\ **Last updated:** [July 19, 2021, 7:28am UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-store-unique-values-of-a-field/278548 "2021-07-19T07:28:51Z")
Hi, I have a raw data index, every document has the fields: device, country, browser, utm and many more... I need a way to extract the unique values of each field and store all of them in an index lets call it 'lookups… --- ## [Query for specific pair of fields in Elastic](https://discuss.elastic.co/t/query-for-specific-pair-of-fields-in-elastic/279025)
**Author:** [@saif3r](https://discuss.elastic.co/u/saif3r)\ **Replies:** 1\ **Last updated:** [July 19, 2021, 7:28am UTC](https://discuss.elastic.co/t/query-for-specific-pair-of-fields-in-elastic/279025 "2021-07-19T07:28:20Z")
Hello, I have two documents: POST query\_test/\_doc { "field": \[ { "field1": "Pam", "field2": "Beesly" }, { "field1": "Jim", "field2": "Halpert" } \] } POST query\_test/\_doc { … --- ## [Forward azure logs with syslog?](https://discuss.elastic.co/t/forward-azure-logs-with-syslog/279022)
**Author:** [@JaVa](https://discuss.elastic.co/u/JaVa)\ **Replies:** 0\ **Last updated:** [July 19, 2021, 6:57am UTC](https://discuss.elastic.co/t/forward-azure-logs-with-syslog/279022 "2021-07-19T06:57:59Z")
Sorry for the dumb questions (newbie here) but is there any way of forwarding azure logs from Logstash to another SIEM product? I configured our ELK stack to receive Azure events from the cloud with Logstash azure module… --- ## [Not able to get Floating value in Kibana](https://discuss.elastic.co/t/not-able-to-get-floating-value-in-kibana/279021)
**Author:** [@Saravana37](https://discuss.elastic.co/u/Saravana37)\ **Replies:** 0\ **Last updated:** [July 19, 2021, 6:57am UTC](https://discuss.elastic.co/t/not-able-to-get-floating-value-in-kibana/279021 "2021-07-19T06:57:20Z")
Hello All , I am trying to display one SQL column value TIME\_DIFF in Kibana. which is shown below. But it is displaying in Kibana as shown below . I am trying to convert this using mutate , \> filter { \> mutate { … --- ## [Elasticsearch storage problem](https://discuss.elastic.co/t/elasticsearch-storage-problem/277850)
**Author:** [@bab](https://discuss.elastic.co/u/bab)\ **Replies:** 5\ **Last updated:** [July 19, 2021, 5:27am UTC](https://discuss.elastic.co/t/elasticsearch-storage-problem/277850 "2021-07-19T05:27:27Z")
Hi guys, I am facing this problem from time to time, would like to know where does this come from and how can I get rid of this completely. the problem stays a few minutes u d after that goes away and can access my ES i… --- ## [Combination of APM, RUM agent and Opentelemetry agents](https://discuss.elastic.co/t/combination-of-apm-rum-agent-and-opentelemetry-agents/278887)
**Author:** [@Stanislav\_Samek](https://discuss.elastic.co/u/Stanislav_Samek)\ **Replies:** 1\ **Last updated:** [July 19, 2021, 3:08am UTC](https://discuss.elastic.co/t/combination-of-apm-rum-agent-and-opentelemetry-agents/278887 "2021-07-19T03:08:57Z")
Hi, it's possible to combine Elastic RUM agent, Elastic APM server and Opentelemetry? I have a case where Elastic RUM agent (frontend) is sending data directly to APM server and Opentelemetry agents (backend) are sendin… --- ## [Can we create alias for other aliases?](https://discuss.elastic.co/t/can-we-create-alias-for-other-aliases/278994)
**Author:** [@im-pratham](https://discuss.elastic.co/u/im-pratham)\ **Replies:** 1\ **Last updated:** [July 19, 2021, 2:11am UTC](https://discuss.elastic.co/t/can-we-create-alias-for-other-aliases/278994 "2021-07-19T02:11:38Z")
How can i create alias with other aliases? Is this possible? --- ## [Removal of Facebook authentication](https://discuss.elastic.co/t/removal-of-facebook-authentication/279004)
**Author:** [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Replies:** 0\ **Last updated:** [July 19, 2021, 1:09am UTC](https://discuss.elastic.co/t/removal-of-facebook-authentication/279004 "2021-07-19T01:09:33Z")
Unfortunately we have had to remove Facebook authentication for our forums. Facebook has told us; As a reminder, your app is currently in violation of Developer Policy 3.2: “Only incentivize a person to log into your … --- ## [Increase in response time for aggregations in 7.10.1](https://discuss.elastic.co/t/increase-in-response-time-for-aggregations-in-7-10-1/276295)
**Author:** [@rgopalan](https://discuss.elastic.co/u/rgopalan)\ **Replies:** 6\ **Last updated:** [July 19, 2021, 12:54am UTC](https://discuss.elastic.co/t/increase-in-response-time-for-aggregations-in-7-10-1/276295 "2021-07-19T00:54:56Z")
Hi, We recently upgraded our ElasticSearch cluster from 7.7 to 7.10.1 and we are seeing an increase in the response time. One query that uses aggregations has seen the response time increase by 1-1.5s. Setup \* 3 Mast… --- ## [Kibana Circuit breaker exception -Data too large, data for \[\\]](https://discuss.elastic.co/t/kibana-circuit-breaker-exception-data-too-large-data-for-http-request/278959)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 2\ **Last updated:** [July 18, 2021, 7:24pm UTC](https://discuss.elastic.co/t/kibana-circuit-breaker-exception-data-too-large-data-for-http-request/278959 "2021-07-18T19:24:42Z")
Hi all, One of my Kibana instances crashes everytime with below message: {"statusCode":401,"error":"Unauthorized","message":"\[circuit\_breaking\_exception\] \[parent\] Data too large, data for \[\\] would be \[104… --- ## [Writing DSL Query to find documents for dyanmic fields in the index](https://discuss.elastic.co/t/writing-dsl-query-to-find-documents-for-dyanmic-fields-in-the-index/278985)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 1\ **Last updated:** [July 18, 2021, 4:35pm UTC](https://discuss.elastic.co/t/writing-dsl-query-to-find-documents-for-dyanmic-fields-in-the-index/278985 "2021-07-18T16:35:06Z")
Hi All, I want to write a DSL Query that will fetch results from fields. GET condition/\_search { "query": { "range" : { "tag.value" : { "gte" : "operational.threshold", … --- ## [Expected \[SRART\_OBJECT\] but found \[START\_ARRAY\]](https://discuss.elastic.co/t/expected-srart-object-but-found-start-array/278667)
**Author:** [@Eran1](https://discuss.elastic.co/u/Eran1)\ **Replies:** 4\ **Last updated:** [July 18, 2021, 12:23pm UTC](https://discuss.elastic.co/t/expected-srart-object-but-found-start-array/278667 "2021-07-18T12:23:13Z")
Hi, I'm using python to connect to elastic as following: import urllib3 from elasticsearch import Elasticsearch from elasticsearch.connection import create\_ssl\_context import configparser def get\_es\_session(es\_u… --- ## [Could Update/Get/Delete an document on an alias accociated to multiple indexes?](https://discuss.elastic.co/t/could-update-get-delete-an-document-on-an-alias-accociated-to-multiple-indexes/278986)
**Author:** [@light\_chen](https://discuss.elastic.co/u/light_chen)\ **Replies:** 1\ **Last updated:** [July 18, 2021, 12:02pm UTC](https://discuss.elastic.co/t/could-update-get-delete-an-document-on-an-alias-accociated-to-multiple-indexes/278986 "2021-07-18T12:02:25Z")
In order to reduce the size of index (I hear that it is better to keep the size lower than 25~30GB per index), I split the data into several indexes using Rollover API. Then I create two alias, in my expectation, the on… --- ## [Logstash and Json, How to ingest this fragment:](https://discuss.elastic.co/t/logstash-and-json-how-to-ingest-this-fragment/278966)
**Author:** [@cibernicola](https://discuss.elastic.co/u/cibernicola)\ **Replies:** 2\ **Last updated:** [July 18, 2021, 11:02am UTC](https://discuss.elastic.co/t/logstash-and-json-how-to-ingest-this-fragment/278966 "2021-07-18T11:02:59Z")
I'm trying to ingest json data with this format: {"info":{"page":1,"pages":53431,"results":53431},"plugins":\[{"name":"Contact Form 7","slug":"contact-form-7","version":"5.4.2","author":"\ **Author:** [@Sunflower](https://discuss.elastic.co/u/Sunflower)\ **Replies:** 5\ **Last updated:** [July 18, 2021, 6:52am UTC](https://discuss.elastic.co/t/filter-with-grok-and-kv/278697 "2021-07-18T06:52:22Z") Hi, I'm trying to understand if I'm using the correct configuration for the following logs, or if there is a more efficient option for it. 2021-07-13T10:05:06.061Z 10.20.30.40 \<110\>1 2021-07-13T08:46:58Z 44.236.133.39… --- ## [Lost data in kibana but show in syslog logstash](https://discuss.elastic.co/t/lost-data-in-kibana-but-show-in-syslog-logstash/278894)
**Author:** [@quyennguyen](https://discuss.elastic.co/u/quyennguyen)\ **Replies:** 11\ **Last updated:** [July 17, 2021, 7:49pm UTC](https://discuss.elastic.co/t/lost-data-in-kibana-but-show-in-syslog-logstash/278894 "2021-07-17T19:49:07Z")
I have conf file in logstash like this input { beats { host =\> "0.0.0.0" port =\> 5044 ssl =\> false } } filter { if \[fileset\]\[name\] == "auth" { grok { match =\> { "message" =\> "%{SYSLOGT… --- ## [HELP! Logstash restarting after ip2location plugin update](https://discuss.elastic.co/t/help-logstash-restarting-after-ip2location-plugin-update/278957)
**Author:** [@rojin](https://discuss.elastic.co/u/rojin)\ **Replies:** 4\ **Last updated:** [July 17, 2021, 6:33pm UTC](https://discuss.elastic.co/t/help-logstash-restarting-after-ip2location-plugin-update/278957 "2021-07-17T18:33:59Z")
I had an issue with logstash restarting so I updated ip2location plugin and now it keeps restarting every 15 seconds. The error before was ConcurrentModificationException: null. I use logstash v 7.4.2 and the plugin ver… --- ## [I am trying to pick a field from one event to another using aggregation filter](https://discuss.elastic.co/t/i-am-trying-to-pick-a-field-from-one-event-to-another-using-aggregation-filter/278955)
**Author:** [@Kamikaze\_K](https://discuss.elastic.co/u/Kamikaze_K)\ **Replies:** 1\ **Last updated:** [July 17, 2021, 6:10pm UTC](https://discuss.elastic.co/t/i-am-trying-to-pick-a-field-from-one-event-to-another-using-aggregation-filter/278955 "2021-07-17T18:10:01Z")
have log files that I am able to get fields based on two different if/grok statements and patterns. The output from the two are like below; { timestamp" =\> 2021-06-09T03:08:30.943Z, "Loc" =\> "91340", … --- ## [Ailed to parse field \[host\] of type \[text\] in document with id](https://discuss.elastic.co/t/ailed-to-parse-field-host-of-type-text-in-document-with-id/278963)
**Author:** [@Bhuwaneshwar](https://discuss.elastic.co/u/Bhuwaneshwar)\ **Replies:** 1\ **Last updated:** [July 17, 2021, 6:05pm UTC](https://discuss.elastic.co/t/ailed-to-parse-field-host-of-type-text-in-document-with-id/278963 "2021-07-17T18:05:00Z")
Dear Team I am getting below error on Logstash. "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse field \[host\] of type \[text\] in document with id '4qrUs3oBqKFEAtQHASue'. Preview of field's value:… --- ## [Covert logs to JSON in output section of Logstash before it leaves output](https://discuss.elastic.co/t/covert-logs-to-json-in-output-section-of-logstash-before-it-leaves-output/278975)
**Author:** [@shadu88](https://discuss.elastic.co/u/shadu88)\ **Replies:** 1\ **Last updated:** [July 17, 2021, 5:59pm UTC](https://discuss.elastic.co/t/covert-logs-to-json-in-output-section-of-logstash-before-it-leaves-output/278975 "2021-07-17T17:59:29Z")
Hello ELkan's Hope all are safe!!! I'm using kustos output plugin to forward logs to azure data explore which only supports json format, I want to convert my syslog input logs on TCP port to JSON only in kustos output … --- ## [How to parse names like "This+is+name%2+field" in links?](https://discuss.elastic.co/t/how-to-parse-names-like-this-is-name-2-field-in-links/278858)
**Author:** [@rojin](https://discuss.elastic.co/u/rojin)\ **Replies:** 8\ **Last updated:** [July 17, 2021, 5:23pm UTC](https://discuss.elastic.co/t/how-to-parse-names-like-this-is-name-2-field-in-links/278858 "2021-07-17T17:23:32Z")
Hi! I have a name field like: "This+is+name%2+field" How can I parse it in logstash grok filters so that I can have: "This is name 2 field" in Kibana? --- ## [Date\_nano field is not considered as a time field in rollup](https://discuss.elastic.co/t/date-nano-field-is-not-considered-as-a-time-field-in-rollup/278933)
**Author:** [@malsioufi](https://discuss.elastic.co/u/malsioufi)\ **Replies:** 1\ **Last updated:** [July 17, 2021, 11:08am UTC](https://discuss.elastic.co/t/date-nano-field-is-not-considered-as-a-time-field-in-rollup/278933 "2021-07-17T11:08:24Z")
I have an index template with @timestamp field of type date\_nano. I can see this field in Discover, and it is treated as a normal time field, but when I want to create a rollup job for the index pattern that has this fi… --- ## [Version conflict for bulk index - do the all the docs included into the bulk index fail?](https://discuss.elastic.co/t/version-conflict-for-bulk-index-do-the-all-the-docs-included-into-the-bulk-index-fail/278951)
**Author:** [@smlbiobot](https://discuss.elastic.co/u/smlbiobot)\ **Replies:** 3\ **Last updated:** [July 17, 2021, 10:07am UTC](https://discuss.elastic.co/t/version-conflict-for-bulk-index-do-the-all-the-docs-included-into-the-bulk-index-fail/278951 "2021-07-17T10:07:14Z")
From time to time, I’ve seen bulk index fails because of version conflicts. Because of how things are, I’m ok with some docs failing to index because it exists already. However, in these cases, do all the documents get r… --- ## [Bulk insert is too slow](https://discuss.elastic.co/t/bulk-insert-is-too-slow/278794)
**Author:** [@Hooman\_Bahreini](https://discuss.elastic.co/u/Hooman_Bahreini)\ **Replies:** 8\ **Last updated:** [July 17, 2021, 9:35am UTC](https://discuss.elastic.co/t/bulk-insert-is-too-slow/278794 "2021-07-17T09:35:32Z")
I have a 2 node Elasticsearch (Version 6.8) cluster (they are running on 2 Ubuntu servers with 4GB RAM) and I am running MySQL on the same servers. The bulk insert is writing 100 documents at a time and each insert take… --- ## [Wrong examples in the rank feature query documentation](https://discuss.elastic.co/t/wrong-examples-in-the-rank-feature-query-documentation/278956)
**Author:** [@rueian](https://discuss.elastic.co/u/rueian)\ **Replies:** 0\ **Last updated:** [July 17, 2021, 4:52am UTC](https://discuss.elastic.co/t/wrong-examples-in-the-rank-feature-query-documentation/278956 "2021-07-17T04:52:01Z")
Hi, I noticed that the rank feature query documentation contains the following examples: PUT /test/\_doc/2?refresh { .... "topics": { "sports": 35, "formula one": 65, "brazil": 20 } } PUT /test/\_doc/3?… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=879) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=881)