# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=894 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 895 --- ## [Logstash config for nested log](https://discuss.elastic.co/t/logstash-config-for-nested-log/277680)
**Author:** [@kriss332](https://discuss.elastic.co/u/kriss332)\ **Replies:** 10\ **Last updated:** [July 4, 2021, 1:55pm UTC](https://discuss.elastic.co/t/logstash-config-for-nested-log/277680 "2021-07-04T13:55:45Z")
Hello everyone... I have multiple event logs from windows. Converted them to csv using EvtxEcmd.exe. I combined lots of event logs into one csv file. I need to upload it to ELK. below are the column names- RecordNumb… --- ## [Search with nested Fields on multi index](https://discuss.elastic.co/t/search-with-nested-fields-on-multi-index/277403)
**Author:** [@12345](https://discuss.elastic.co/u/12345)\ **Replies:** 2\ **Last updated:** [July 5, 2021, 4:04am UTC](https://discuss.elastic.co/t/search-with-nested-fields-on-multi-index/277403 "2021-07-05T04:04:36Z")
I am using ES 7.1.I have my design in such a way each index contains single document type.For example - Suppose I have Order and some products in it. Order data is stored in one index and Products data in other index. I… --- ## [Understand this simple search query](https://discuss.elastic.co/t/understand-this-simple-search-query/277759)
**Author:** [@KS\_123](https://discuss.elastic.co/u/KS_123)\ **Replies:** 1\ **Last updated:** [July 5, 2021, 3:07am UTC](https://discuss.elastic.co/t/understand-this-simple-search-query/277759 "2021-07-05T03:07:43Z")
this is probably a very basic question but I have 2 searches below. search 1 returns 4 values, I just want it to return 1 value(DeviceCommandEvent). how do I do this? search 2 retruns 3 values which I would expect, tha… --- ## [Documentation suggestion](https://discuss.elastic.co/t/documentation-suggestion/277673)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 1\ **Last updated:** [July 5, 2021, 2:17am UTC](https://discuss.elastic.co/t/documentation-suggestion/277673 "2021-07-05T02:17:42Z")
Many fields are now complex, like winlog.event\_data.IpAddress, but few if any of the doc examples use any more than a simple field name: { "remove": { "field": "user\_agent" } } Finding when to use the dots vs w… --- ## [Modify Index name in Response](https://discuss.elastic.co/t/modify-index-name-in-response/277346)
**Author:** [@daksh0225](https://discuss.elastic.co/u/daksh0225)\ **Replies:** 2\ **Last updated:** [July 5, 2021, 2:13am UTC](https://discuss.elastic.co/t/modify-index-name-in-response/277346 "2021-07-05T02:13:55Z")
Hello!! I have made some changes to the codebase to modify the index name for certain types of requests. However, I don't want the user to know about any such changes that I have made. So, I want to modify the index nam… --- ## [OCI compute for GCP elasicsearch](https://discuss.elastic.co/t/oci-compute-for-gcp-elasicsearch/277718)
**Author:** [@Sayantan\_Chakraborty](https://discuss.elastic.co/u/Sayantan_Chakraborty)\ **Replies:** 1\ **Last updated:** [July 5, 2021, 2:13am UTC](https://discuss.elastic.co/t/oci-compute-for-gcp-elasicsearch/277718 "2021-07-05T02:13:32Z")
hi i want to use elasticsearch services of GCP in OCI with Magento2.4.x. previously I tried to connect them using vcp to vcn connectivity on AWS but it did not work as Route 53 did not detect elastic search as a resourc… --- ## [Extra memory required to accomodate extra buckets](https://discuss.elastic.co/t/extra-memory-required-to-accomodate-extra-buckets/277186)
**Author:** [@prashant1](https://discuss.elastic.co/u/prashant1)\ **Replies:** 5\ **Last updated:** [July 5, 2021, 2:06am UTC](https://discuss.elastic.co/t/extra-memory-required-to-accomodate-extra-buckets/277186 "2021-07-05T02:06:10Z")
We are getting too many buckets exception error in viewing the visualization. The default limit for max.buckets is 10000 if we want to increase this parameter to 20000 to resolve the exception so how much would be the e… --- ## [Log fields are not parsing as expected using grok filter](https://discuss.elastic.co/t/log-fields-are-not-parsing-as-expected-using-grok-filter/277746)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 5\ **Last updated:** [July 4, 2021, 11:35pm UTC](https://discuss.elastic.co/t/log-fields-are-not-parsing-as-expected-using-grok-filter/277746 "2021-07-04T23:35:22Z")
Hi All, I am using below configuration and expecting it to get parse as per below fields. below is the pipeline.conf file. input { beats { port =\> "5044" } } filter { grok { match =\> { "mes… --- ## [Extract data from CSV column](https://discuss.elastic.co/t/extract-data-from-csv-column/277745)
**Author:** [@anon33720113](https://discuss.elastic.co/u/anon33720113)\ **Replies:** 3\ **Last updated:** [July 4, 2021, 8:49pm UTC](https://discuss.elastic.co/t/extract-data-from-csv-column/277745 "2021-07-04T20:49:44Z")
Hey I have logs as CSV and one column which is in string and has multiple values that need to extracted and stored as new fields. The column name is comment and it's value is VPN token auth failed. Destination was: 62.… --- ## [Why is TermQuery so much faster than PointRangeQuery?](https://discuss.elastic.co/t/why-is-termquery-so-much-faster-than-pointrangequery/277740)
**Author:** [@asasas234](https://discuss.elastic.co/u/asasas234)\ **Replies:** 0\ **Last updated:** [July 4, 2021, 2:42pm UTC](https://discuss.elastic.co/t/why-is-termquery-so-much-faster-than-pointrangequery/277740 "2021-07-04T14:42:25Z")
I have 1 index with data volume around 80 million. I had 1 slow query before, which was 3 conditions, including 1 date equivalent query as well as 2 numeric column equivalent queries, and the query time was at least 5 se… --- ## [Index Shrinking?](https://discuss.elastic.co/t/index-shrinking/277739)
**Author:** [@herzel.sapago](https://discuss.elastic.co/u/herzel.sapago)\ **Replies:** 1\ **Last updated:** [July 4, 2021, 2:18pm UTC](https://discuss.elastic.co/t/index-shrinking/277739 "2021-07-04T14:18:37Z")
Hi We are implementing elastic in our company. As the person who responsible for it, I had been ask from my manager to check for grow of index each day and report it to group of managers. well I did it, finding that … --- ## [Elasticsearch-7.9.2-amd64.deb exit status 78](https://discuss.elastic.co/t/elasticsearch-7-9-2-amd64-deb-exit-status-78/277717)
**Author:** [@Sayantan\_Chakraborty](https://discuss.elastic.co/u/Sayantan_Chakraborty)\ **Replies:** 8\ **Last updated:** [July 4, 2021, 1:29pm UTC](https://discuss.elastic.co/t/elasticsearch-7-9-2-amd64-deb-exit-status-78/277717 "2021-07-04T13:29:29Z")
hi, i am facing a few issues for the Magento2.4.x installation. The process' exit code is 'exited' and its exit status is 78. Jul 04 02:12:40 somehost systemd\[1\]: elasticsearch.service: Failed with result\> -- Subject: U… --- ## [Impact of increasing index.max\_result\_window size to 10 million?](https://discuss.elastic.co/t/impact-of-increasing-index-max-result-window-size-to-10-million/277241)
**Author:** [@StringerBell](https://discuss.elastic.co/u/StringerBell)\ **Replies:** 2\ **Last updated:** [July 4, 2021, 1:34pm UTC](https://discuss.elastic.co/t/impact-of-increasing-index-max-result-window-size-to-10-million/277241 "2021-07-04T13:34:24Z")
I have a scenario where I want to increase the index.max\_result\_window size to about 10 million. My query only cares about fetching the sort order and not the actual \_source field. Does changing the max\_result\_window si… --- ## [Elasticsearch-plugin install PLUGIN hangs](https://discuss.elastic.co/t/elasticsearch-plugin-install-plugin-hangs/277732)
**Author:** [@mlrodrigo](https://discuss.elastic.co/u/mlrodrigo)\ **Replies:** 0\ **Last updated:** [July 4, 2021, 11:09am UTC](https://discuss.elastic.co/t/elasticsearch-plugin-install-plugin-hangs/277732 "2021-07-04T11:09:02Z")
Installing an Elasticsearch plugin hangs after a few tries due to (likely) a lack of entropy in /dev/random: bin/elasticsearch-plugin install analysis-smartcn --verbose -\> Installing analysis-smartcn Checking if url exi… --- ## [Elasticsearch Query Expansion problem, multi-field search](https://discuss.elastic.co/t/elasticsearch-query-expansion-problem-multi-field-search/277729)
**Author:** [@Federico\_Bottarelli](https://discuss.elastic.co/u/Federico_Bottarelli)\ **Replies:** 0\ **Last updated:** [July 4, 2021, 10:16am UTC](https://discuss.elastic.co/t/elasticsearch-query-expansion-problem-multi-field-search/277729 "2021-07-04T10:16:17Z")
Hi guys. I'm trying to expand some queries via Blind Relevance Feedback for an Information Retrieval project using TREC evaluation system, (CORD-19 database) I would like to use prefixes of the best terms instead of who… --- ## [HEXADECIMAL string to Binary and Binary to decimal in log-stash using ruby filter](https://discuss.elastic.co/t/hexadecimal-string-to-binary-and-binary-to-decimal-in-log-stash-using-ruby-filter/277715)
**Author:** [@Kamikaze\_K](https://discuss.elastic.co/u/Kamikaze_K)\ **Replies:** 2\ **Last updated:** [July 4, 2021, 2:30am UTC](https://discuss.elastic.co/t/hexadecimal-string-to-binary-and-binary-to-decimal-in-log-stash-using-ruby-filter/277715 "2021-07-04T02:30:05Z")
I am working with logstash and I am using ruby filter to change HEX to decimal which works fine for one set of data. What I use for this is ; ruby{ code =\> "event.set('xxx', event.get('xx').hex)" } I am looking for s… --- ## [Json @timestamp vs date {}](https://discuss.elastic.co/t/json-timestamp-vs-date/277713)
**Author:** [@danielmotaleite](https://discuss.elastic.co/u/danielmotaleite)\ **Replies:** 2\ **Last updated:** [July 4, 2021, 12:23am UTC](https://discuss.elastic.co/t/json-timestamp-vs-date/277713 "2021-07-04T00:23:14Z")
From what i see, one should use in logstash the date {} to modify the event date, but setting the @timestamp field to seems to also work, at least when using json {}, @timestamp object seems to set the date correctly. I… --- ## [Dynamically Re-Indexing Old Indices After A Long Time](https://discuss.elastic.co/t/dynamically-re-indexing-old-indices-after-a-long-time/275302)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 1\ **Last updated:** [July 3, 2021, 7:42pm UTC](https://discuss.elastic.co/t/dynamically-re-indexing-old-indices-after-a-long-time/275302 "2021-07-03T19:42:53Z")
I have some indices like below; people\_in\_maribor people\_in\_rome etc. This indices get bigger after a long time. I want to ask how to reindex automatically old indices after a long time. As an example, I mean after… --- ## [Rally benchmarking Elasticsearch with 429 error code](https://discuss.elastic.co/t/rally-benchmarking-elasticsearch-with-429-error-code/276917)
**Author:** [@parallelism](https://discuss.elastic.co/u/parallelism)\ **Replies:** 1\ **Last updated:** [July 3, 2021, 6:11pm UTC](https://discuss.elastic.co/t/rally-benchmarking-elasticsearch-with-429-error-code/276917 "2021-07-03T18:11:18Z")
Hello, We are testing a new Elasticsearch cluster with Rally. The indexing task is getting an error rate greater than zero and we also found that the total number of indexed documents does not match the target number of… --- ## [Elasticsearch high load on some nodes](https://discuss.elastic.co/t/elasticsearch-high-load-on-some-nodes/276907)
**Author:** [@bxl](https://discuss.elastic.co/u/bxl)\ **Replies:** 1\ **Last updated:** [July 3, 2021, 6:08pm UTC](https://discuss.elastic.co/t/elasticsearch-high-load-on-some-nodes/276907 "2021-07-03T18:08:36Z")
os :CentOS Linux release 7.5.1804 (Core) java:1.8.0\_275 elasticsearch:6.8.1 ::: {192.168.1.3\_hot}{r6gbkwdTRDSUUooaLfWZPw}{djXsTjmBS3OM1IBzw4E2hA}{192.168.1.3}{192.168.1.3:9300}{ml.machine\_memory=540476571648, ml.max\_o… --- ## [ElasticSearch Segment merge not happening when deleted documents count is greater than 50%](https://discuss.elastic.co/t/elasticsearch-segment-merge-not-happening-when-deleted-documents-count-is-greater-than-50/277209)
**Author:** [@Vignesh\_Ramesh](https://discuss.elastic.co/u/Vignesh_Ramesh)\ **Replies:** 1\ **Last updated:** [July 3, 2021, 5:54pm UTC](https://discuss.elastic.co/t/elasticsearch-segment-merge-not-happening-when-deleted-documents-count-is-greater-than-50/277209 "2021-07-03T17:54:47Z")
Elasticsearch version: 7.10.0 I have an elasticsearch index with 8 shards in 8 different nodes and with a document count greater than 25 million documents(nested not included). It's an heavy update index. The document s… --- ## ["\_dateparsefailure"](https://discuss.elastic.co/t/dateparsefailure/277700)
**Author:** [@RoteEdition](https://discuss.elastic.co/u/RoteEdition)\ **Replies:** 3\ **Last updated:** [July 3, 2021, 5:12pm UTC](https://discuss.elastic.co/t/dateparsefailure/277700 "2021-07-03T17:12:21Z")
Hi there, i am trying to parse a .CSV file with a pretty horrible date format. I am using the Date filter: date { match =\> \[ "HelperDate", "dMMyyyy", "ddMMyyyy" \] } Some example data: 6112019 -\> … --- ## [Help with Features of Kibana Interactive filters](https://discuss.elastic.co/t/help-with-features-of-kibana-interactive-filters/277587)
**Author:** [@Jason2073](https://discuss.elastic.co/u/Jason2073)\ **Replies:** 2\ **Last updated:** [July 3, 2021, 4:50pm UTC](https://discuss.elastic.co/t/help-with-features-of-kibana-interactive-filters/277587 "2021-07-03T16:50:24Z")
I am working with the kibana controls panels, pictured here And some functionality seems very restrictive. I want to have these drop down options to be put in any order, and for the options under the others to update… --- ## [Logstash split log and insert it separately into elasticsearch](https://discuss.elastic.co/t/logstash-split-log-and-insert-it-separately-into-elasticsearch/277694)
**Author:** [@shifenglim](https://discuss.elastic.co/u/shifenglim)\ **Replies:** 1\ **Last updated:** [July 3, 2021, 4:18pm UTC](https://discuss.elastic.co/t/logstash-split-log-and-insert-it-separately-into-elasticsearch/277694 "2021-07-03T16:18:56Z")
I am writing a logstash config file and a log I am receiving is giving me issues, the team sent me multiple logs merged into one eg. message: \[logitem(aaa=1, bbb=1, ccc=1), logitem(aaa=2, bbb=2, ccc=2), logitem(aaa=3, b… --- ## [Elasticsearch 7.13.2 linux(centos) service - Custom JVM - Doesn't start](https://discuss.elastic.co/t/elasticsearch-7-13-2-linux-centos-service-custom-jvm-doesnt-start/277668)
**Author:** [@Rajnish\_Kumar](https://discuss.elastic.co/u/Rajnish_Kumar)\ **Replies:** 2\ **Last updated:** [July 3, 2021, 2:56pm UTC](https://discuss.elastic.co/t/elasticsearch-7-13-2-linux-centos-service-custom-jvm-doesnt-start/277668 "2021-07-03T14:56:49Z")
It's installed as a linux service. It comes up and works fine using the bundled jdk(16). \[tsadmin@tsmkmslin04 ~\]$ curl -XGET 'http://localhost:9200' { "name" : "tsmkmslin04", "cluster\_name" : "elasticsearch", "clu… --- ## [How to fetch kibana Visualisation data to Powershell automation](https://discuss.elastic.co/t/how-to-fetch-kibana-visualisation-data-to-powershell-automation/277532)
**Author:** [@Sahithi\_V](https://discuss.elastic.co/u/Sahithi_V)\ **Replies:** 2\ **Last updated:** [July 3, 2021, 9:04am UTC](https://discuss.elastic.co/t/how-to-fetch-kibana-visualisation-data-to-powershell-automation/277532 "2021-07-03T09:04:55Z")
Continuing the discussion from Get data from visualize/ dashboard using the API: I tried to get data from visualization present in Dashboard but I am able to navigate till saved objects of visualizatin with its id but d… --- ## [ElasticSearch distinct results by multiple fields with pagination](https://discuss.elastic.co/t/elasticsearch-distinct-results-by-multiple-fields-with-pagination/277455)
**Author:** [@adolbik](https://discuss.elastic.co/u/adolbik)\ **Replies:** 2\ **Last updated:** [July 3, 2021, 7:52am UTC](https://discuss.elastic.co/t/elasticsearch-distinct-results-by-multiple-fields-with-pagination/277455 "2021-07-03T07:52:08Z")
I have index with bunch of events (user viewed page, clicked something and etc.). I have a page in the system where I need to display uniq results (only one row per user + event + itemId). It means if we have 7 rows like… --- ## [Type date\_range formatting v6.8 vs v7.12](https://discuss.elastic.co/t/type-date-range-formatting-v6-8-vs-v7-12/277698)
**Author:** [@elasticfish](https://discuss.elastic.co/u/elasticfish)\ **Replies:** 0\ **Last updated:** [July 3, 2021, 7:38am UTC](https://discuss.elastic.co/t/type-date-range-formatting-v6-8-vs-v7-12/277698 "2021-07-03T07:38:33Z")
Hello, I am upgrading from ES 6.8 to ES 7.12.1 and I have a dynamic template like: "dynamic\_templates": \[ { "ecom\_data": { "mapping": { "type": "date\_range", "f… --- ## [Setting up http services on ECK](https://discuss.elastic.co/t/setting-up-http-services-on-eck/277497)
**Author:** [@Francisco\_Gomez1](https://discuss.elastic.co/u/Francisco_Gomez1)\ **Replies:** 1\ **Last updated:** [July 2, 2021, 11:59pm UTC](https://discuss.elastic.co/t/setting-up-http-services-on-eck/277497 "2021-07-02T23:59:33Z")
Hi, i currently a development cluster doing some test before setting it up for production, for my use case im currently trying to configure the HTTP services of my cluster using the OpenShift loadbalancer. Following t… --- ## [Vertica connection with ELK](https://discuss.elastic.co/t/vertica-connection-with-elk/277691)
**Author:** [@simran96](https://discuss.elastic.co/u/simran96)\ **Replies:** 0\ **Last updated:** [July 2, 2021, 10:33pm UTC](https://discuss.elastic.co/t/vertica-connection-with-elk/277691 "2021-07-02T22:33:49Z")
hi, im trying to connect Vertica with ELastic search and writing the conf file for the same. input { jdbc { jdbc\_validate\_connection =\> true … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=893) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=895)