# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=902 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 903 --- ## [Annotated text highlighter identifies incorrect phrase hit when wrapped in function\_score query](https://discuss.elastic.co/t/annotated-text-highlighter-identifies-incorrect-phrase-hit-when-wrapped-in-function-score-query/277073)
**Author:** [@robmartin11](https://discuss.elastic.co/u/robmartin11)\ **Replies:** 0\ **Last updated:** [June 25, 2021, 2:15pm UTC](https://discuss.elastic.co/t/annotated-text-highlighter-identifies-incorrect-phrase-hit-when-wrapped-in-function-score-query/277073 "2021-06-25T14:15:52Z")
Wondering if the following could be a bug or just user error? Given I create a new index with annotated text fields: PUT test\_index { "mappings": { "properties": { "a": { "type":… --- ## [Logstash Pipeline which works fine for file input but not working when set with filebeats](https://discuss.elastic.co/t/logstash-pipeline-which-works-fine-for-file-input-but-not-working-when-set-with-filebeats/277068)
**Author:** [@MuskanBeig](https://discuss.elastic.co/u/MuskanBeig)\ **Replies:** 1\ **Last updated:** [June 25, 2021, 1:42pm UTC](https://discuss.elastic.co/t/logstash-pipeline-which-works-fine-for-file-input-but-not-working-when-set-with-filebeats/277068 "2021-06-25T13:42:12Z")
My logstash pipeline works fine with the input as file or generator plugin But the same pipeline is not working when i use beats as input plugin the filebeat is working properly --- ## [Data table visualization that shows the end message combined with the start time of a particular case](https://discuss.elastic.co/t/data-table-visualization-that-shows-the-end-message-combined-with-the-start-time-of-a-particular-case/277065)
**Author:** [@hNiven](https://discuss.elastic.co/u/hNiven)\ **Replies:** 0\ **Last updated:** [June 25, 2021, 1:36pm UTC](https://discuss.elastic.co/t/data-table-visualization-that-shows-the-end-message-combined-with-the-start-time-of-a-particular-case/277065 "2021-06-25T13:36:59Z")
Hi, I am looking to create a data table using the visualize section, where I track the outcome of multiple cases. Each case will have its own unique identifier to be able to track its lifecycle. To simplify it, I am loo… --- ## [Signs of too few shards? Number of documents per shard?](https://discuss.elastic.co/t/signs-of-too-few-shards-number-of-documents-per-shard/276972)
**Author:** [@egalpin](https://discuss.elastic.co/u/egalpin)\ **Replies:** 2\ **Last updated:** [June 25, 2021, 1:13pm UTC](https://discuss.elastic.co/t/signs-of-too-few-shards-number-of-documents-per-shard/276972 "2021-06-25T13:13:49Z")
Hi all, I'm experiencing performance challenges with an ES cluster. The cluster consists of 6 data nodes (3 hot w/ ~30GB heap, 3 warm w/ ~15GB heap). The cluster holds around 4TB of data total, with a total of 20,000,00… --- ## [Using "message" in custom alert rule](https://discuss.elastic.co/t/using-message-in-custom-alert-rule/275899)
**Author:** [@EvanGertis](https://discuss.elastic.co/u/EvanGertis)\ **Replies:** 2\ **Last updated:** [June 25, 2021, 12:51pm UTC](https://discuss.elastic.co/t/using-message-in-custom-alert-rule/275899 "2021-06-25T12:51:31Z")
I would like to create an alert that follows: "message: some search string" When I create the alert and save it. I receive the following error "Bulk Indexing of signals failed: object mapping for \[source\] tried to par… --- ## [Is it possible to reindex using a source index including a wildcard?](https://discuss.elastic.co/t/is-it-possible-to-reindex-using-a-source-index-including-a-wildcard/277059)
**Author:** [@Amphagory](https://discuss.elastic.co/u/Amphagory)\ **Replies:** 0\ **Last updated:** [June 25, 2021, 12:47pm UTC](https://discuss.elastic.co/t/is-it-possible-to-reindex-using-a-source-index-including-a-wildcard/277059 "2021-06-25T12:47:02Z")
Hello, I'm trying to perform a reindex where the source index is split up into a number of indices all starting with my\_index. Also, I'm limiting the data I want between a certain range. The syntax I have is as follow… --- ## [Should I route "get by \_id" queries to improve performance?](https://discuss.elastic.co/t/should-i-route-get-by-id-queries-to-improve-performance/277046)
**Author:** [@Alexander\_Gamanyuk1](https://discuss.elastic.co/u/Alexander_Gamanyuk1)\ **Replies:** 1\ **Last updated:** [June 25, 2021, 12:33pm UTC](https://discuss.elastic.co/t/should-i-route-get-by-id-queries-to-improve-performance/277046 "2021-06-25T12:33:17Z")
I have an Elasticsearch index with hundreds of millions of documents that is used mostly for the "get by id" queries. I consider adding a route to documents when indexing. The route will be a random number from 0 to 9. … --- ## [Unable to use new multi\_terms aggregation via Java Client](https://discuss.elastic.co/t/unable-to-use-new-multi-terms-aggregation-via-java-client/277050)
**Author:** [@IliaIsakhin](https://discuss.elastic.co/u/IliaIsakhin)\ **Replies:** 0\ **Last updated:** [June 25, 2021, 11:19am UTC](https://discuss.elastic.co/t/unable-to-use-new-multi-terms-aggregation-via-java-client/277050 "2021-06-25T11:19:00Z")
Hello! I\`ve updated my ES cluster to the version 7.12 to use brand new multi-terms aggregations I want to do something like this in my Java Rest Client AggregationBuilders.multiTerms(field) But as i see, there is no b… --- ## [Logstash with Point to Point](https://discuss.elastic.co/t/logstash-with-point-to-point/277047)
**Author:** [@Michael\_Dylan\_McAloo](https://discuss.elastic.co/u/Michael_Dylan_McAloo)\ **Replies:** 0\ **Last updated:** [June 25, 2021, 11:03am UTC](https://discuss.elastic.co/t/logstash-with-point-to-point/277047 "2021-06-25T11:03:07Z")
In Kibana I try to use the "Point to Point" map but it doesn't show me anything because I only have two fields called "geoip.location" and "location" and I don't have the destination field to filter and "geoip.location" … --- ## [Removing granularity information from a TSVB graph](https://discuss.elastic.co/t/removing-granularity-information-from-a-tsvb-graph/277045)
**Author:** [@mdgElastic](https://discuss.elastic.co/u/mdgElastic)\ **Replies:** 0\ **Last updated:** [June 25, 2021, 11:01am UTC](https://discuss.elastic.co/t/removing-granularity-information-from-a-tsvb-graph/277045 "2021-06-25T11:01:54Z")
Hi all, Is it possible to hide the granularity information of a graph created using a TSBV? As an example: Many thanks in advance! Best! --- ## [ThreatIntel + module configuration](https://discuss.elastic.co/t/threatintel-module-configuration/276652)
**Author:** [@malvivent7](https://discuss.elastic.co/u/malvivent7)\ **Replies:** 1\ **Last updated:** [June 25, 2021, 10:18am UTC](https://discuss.elastic.co/t/threatintel-module-configuration/276652 "2021-06-25T10:18:18Z")
Hi to all, i have enabled through filebeat modules the threatintel module and after that i have configured threatintel.yml activating otx and abusemalware than filebeat -e setup . So far so good but till now i dont see … --- ## [Kibana Hyperlink](https://discuss.elastic.co/t/kibana-hyperlink/277042)
**Author:** [@Mathu](https://discuss.elastic.co/u/Mathu)\ **Replies:** 1\ **Last updated:** [June 25, 2021, 10:34am UTC](https://discuss.elastic.co/t/kibana-hyperlink/277042 "2021-06-25T10:34:07Z")
I have a data table. I need to apply hyperlink to values in the table. User Jan Feb March Sam 11 22 33 Rob 44 55 66 Kim 77 88 99 Say for examp… --- ## [Threat detection rules VS beats](https://discuss.elastic.co/t/threat-detection-rules-vs-beats/275311)
**Author:** [@farciarz121](https://discuss.elastic.co/u/farciarz121)\ **Replies:** 1\ **Last updated:** [June 25, 2021, 10:26am UTC](https://discuss.elastic.co/t/threat-detection-rules-vs-beats/275311 "2021-06-25T10:26:30Z")
Can someone tell me if default detection rules are capable of triggering alerts base on logs from events (not from fleet). I.e. new user creation. I can not make it work. Also, how do I define my own custom policies that… --- ## [Connecting to elasticsearch through kibana using NEST](https://discuss.elastic.co/t/connecting-to-elasticsearch-through-kibana-using-nest/277030)
**Author:** [@mityai013](https://discuss.elastic.co/u/mityai013)\ **Replies:** 0\ **Last updated:** [June 25, 2021, 8:39am UTC](https://discuss.elastic.co/t/connecting-to-elasticsearch-through-kibana-using-nest/277030 "2021-06-25T08:39:02Z")
Hello everyone . We are using a kibana connection to elasticsearch using NEST. This is necessary to monitor the generated indexes. We updated our ELK stack to 7.13.2 and this stopped working. Before the update in version… --- ## [Logstash does not read 1st line of file which the header](https://discuss.elastic.co/t/logstash-does-not-read-1st-line-of-file-which-the-header/277035)
**Author:** [@Julius\_Gamboa](https://discuss.elastic.co/u/Julius_Gamboa)\ **Replies:** 1\ **Last updated:** [June 25, 2021, 9:58am UTC](https://discuss.elastic.co/t/logstash-does-not-read-1st-line-of-file-which-the-header/277035 "2021-06-25T09:58:05Z")
Hi, I am using logstash to ingest a pipe delimited file into elasticsearch. I am using the autodetect\_column\_names in the csv filter. Noticed when I run logstash, I get the following warnings below: \[2021-06-25T16:48:3… --- ## [Index update](https://discuss.elastic.co/t/index-update/277025)
**Author:** [@Abhishek\_Shinde](https://discuss.elastic.co/u/Abhishek_Shinde)\ **Replies:** 1\ **Last updated:** [June 25, 2021, 9:23am UTC](https://discuss.elastic.co/t/index-update/277025 "2021-06-25T09:23:56Z")
I would need to know, if we can take Snapshot of Indices during Index update operation? I know restore demands to keep indices in the close state. --- ## [Last and sum in Kibana ESSQL](https://discuss.elastic.co/t/last-and-sum-in-kibana-essql/277036)
**Author:** [@xquest](https://discuss.elastic.co/u/xquest)\ **Replies:** 0\ **Last updated:** [June 25, 2021, 9:17am UTC](https://discuss.elastic.co/t/last-and-sum-in-kibana-essql/277036 "2021-06-25T09:17:52Z")
Hi! I am using Kiban canvas and sometimes Kibana canvas expression editor. I got some search: SELECT host.name as n, system.diskio.name as s, last(system.diskio.io.time,"@timestamp") as v FROM "\ **Author:** [@Krunal](https://discuss.elastic.co/u/Krunal)\ **Replies:** 0\ **Last updated:** [June 25, 2021, 8:54am UTC](https://discuss.elastic.co/t/tooltip-filter-in-tsvb/277034 "2021-06-25T08:54:07Z") Hello Expert, I would like to remove all the 0% value which shows in the tooltip, means I would like to apply filter not equal to 0. Is it possible to remove it? --- ## [How can i replace multiple special characters in all fields?](https://discuss.elastic.co/t/how-can-i-replace-multiple-special-characters-in-all-fields/276922)
**Author:** [@alprde](https://discuss.elastic.co/u/alprde)\ **Replies:** 2\ **Last updated:** [June 25, 2021, 7:58am UTC](https://discuss.elastic.co/t/how-can-i-replace-multiple-special-characters-in-all-fields/276922 "2021-06-25T07:58:24Z")
Ç =\> Ç ç =\> ç Ş =\> Ş ş =\> ş İ =\> İ ı =\> ı Ü =\> Ü ü =\> ü Ö =\> Ö ö =\> ö Ğ =\> Ğ ğ =\> ğ I want to replace these characters in all fields. how can I … --- ## [Elasticsearch not saving all fields from logstash](https://discuss.elastic.co/t/elasticsearch-not-saving-all-fields-from-logstash/276957)
**Author:** [@mlassnig\_no](https://discuss.elastic.co/u/mlassnig_no)\ **Replies:** 1\ **Last updated:** [June 25, 2021, 7:50am UTC](https://discuss.elastic.co/t/elasticsearch-not-saving-all-fields-from-logstash/276957 "2021-06-25T07:50:14Z")
I got following situation: Im sending logs from my servers to logstash using filebeat. Im running a logstash pipeline that looks like this: input { beats { port =\> 5003 } } filter { grok { match =\> … --- ## [Elasticsearch deployment](https://discuss.elastic.co/t/elasticsearch-deployment/276700)
**Author:** [@porscheme](https://discuss.elastic.co/u/porscheme)\ **Replies:** 2\ **Last updated:** [June 25, 2021, 7:27am UTC](https://discuss.elastic.co/t/elasticsearch-deployment/276700 "2021-06-25T07:27:46Z")
We wanted to build Elasticsearch on cloud Azure. Source data size: 50TB Replicas count: 3 Shard count: 1000 For doing this, we are considering below two VM SKUs. L32sv2 is very processing we wanted to know SLAs for… --- ## [Count unique customers based on date range](https://discuss.elastic.co/t/count-unique-customers-based-on-date-range/277014)
**Author:** [@Sanjay\_Agnani1](https://discuss.elastic.co/u/Sanjay_Agnani1)\ **Replies:** 0\ **Last updated:** [June 25, 2021, 5:55am UTC](https://discuss.elastic.co/t/count-unique-customers-based-on-date-range/277014 "2021-06-25T05:55:53Z")
Need the stats in unique customer: index contains customers orders data. Ex: { "\_index" : "customers\_orders", "\_type" : "\_doc", "\_id" : "109126", "\_score" : 1.0, "\_source" : … --- ## [How can I start logstash from a script](https://discuss.elastic.co/t/how-can-i-start-logstash-from-a-script/277010)
**Author:** [@Mbartlett413](https://discuss.elastic.co/u/Mbartlett413)\ **Replies:** 2\ **Last updated:** [June 25, 2021, 5:30am UTC](https://discuss.elastic.co/t/how-can-i-start-logstash-from-a-script/277010 "2021-06-25T05:30:51Z")
Background: I have logstash and elasticsearch running on a server. I have a rails application which uploads a CSV to the server and logstash then processes. It works if I manually execute the generated script. If I try t… --- ## [Elasticsearch \_update\_by\_query in logstash error \[HTTP Output Failure\] Encountered non-2xx HTTP code 400](https://discuss.elastic.co/t/elasticsearch-update-by-query-in-logstash-error-http-output-failure-encountered-non-2xx-http-code-400/274405)
**Author:** [@priyaankaa](https://discuss.elastic.co/u/priyaankaa)\ **Replies:** 1\ **Last updated:** [June 25, 2021, 5:40am UTC](https://discuss.elastic.co/t/elasticsearch-update-by-query-in-logstash-error-http-output-failure-encountered-non-2xx-http-code-400/274405 "2021-06-25T05:40:42Z")
Properly working \_update\_by\_query call - POST /s1test-demo7/\_update\_by\_query { "script": { "source": "ctx.\_source.externaldata = params.externaldata", "lang": "painless", "params": { "externa… --- ## [Highlight behavior in Elasticsearch version 6.0.1](https://discuss.elastic.co/t/highlight-behavior-in-elasticsearch-version-6-0-1/277005)
**Author:** [@shubhendra](https://discuss.elastic.co/u/shubhendra)\ **Replies:** 0\ **Last updated:** [June 25, 2021, 4:09am UTC](https://discuss.elastic.co/t/highlight-behavior-in-elasticsearch-version-6-0-1/277005 "2021-06-25T04:09:53Z")
I'm facing this issue in Elastic search which I cannot explain. Highlight appears sometimes but other times they do not. Following is the way to reproduce it through kibana. My index and mapping - PUT test\_index { "ma… --- ## [Question about indexing large numbers](https://discuss.elastic.co/t/question-about-indexing-large-numbers/276758)
**Author:** [@Jurgen\_Debedts](https://discuss.elastic.co/u/Jurgen_Debedts)\ **Replies:** 2\ **Last updated:** [June 25, 2021, 1:29am UTC](https://discuss.elastic.co/t/question-about-indexing-large-numbers/276758 "2021-06-25T01:29:29Z")
This is somewhat a mix of conceptual and a technical question. I am working on a search integration between an ECM platform and ES. Everything is working fine except for 1 thing. In the ECM platform metadata field also… --- ## [Process Ghosting Tool - 64 bits Only!](https://discuss.elastic.co/t/process-ghosting-tool-64-bits-only/276826)
**Author:** [@Iker](https://discuss.elastic.co/u/Iker)\ **Replies:** 1\ **Last updated:** [June 24, 2021, 11:32pm UTC](https://discuss.elastic.co/t/process-ghosting-tool-64-bits-only/276826 "2021-06-24T23:32:27Z")
Based in the excellent article published by Gabriel Landau (Process Ghosting a New Executable Image Tampering Attack, I have developed a tool for Process Ghosting, this should be of help for the detection of such behavio… --- ## [GCS Keystore](https://discuss.elastic.co/t/gcs-keystore/276869)
**Author:** [@davidwebb535649](https://discuss.elastic.co/u/davidwebb535649)\ **Replies:** 3\ **Last updated:** [June 24, 2021, 11:16pm UTC](https://discuss.elastic.co/t/gcs-keystore/276869 "2021-06-24T23:16:40Z")
I have a Google Cloud instance I would like to work with. The GCS plugin is installed but I'm having trouble adding the Google credentials to the Elastic Keystore but I keep getting an error I have not been able to solve… --- ## [Aggregation to count consecutive instances of a given field value?](https://discuss.elastic.co/t/aggregation-to-count-consecutive-instances-of-a-given-field-value/276982)
**Author:** [@gpaciga](https://discuss.elastic.co/u/gpaciga)\ **Replies:** 0\ **Last updated:** [June 24, 2021, 9:08pm UTC](https://discuss.elastic.co/t/aggregation-to-count-consecutive-instances-of-a-given-field-value/276982 "2021-06-24T21:08:00Z")
I have an index that has a series of events: \[{ @timestamp: "...", jobId: "123", result: "failure", },{ @timestamp: "...", jobId: "567", result: "success", },{ @timestamp: "...", jobId: "12… --- ## [Lost All Indices After Adding Additional Pipelines](https://discuss.elastic.co/t/lost-all-indices-after-adding-additional-pipelines/276858)
**Author:** [@Steve\_K](https://discuss.elastic.co/u/Steve_K)\ **Replies:** 2\ **Last updated:** [June 24, 2021, 1:58pm UTC](https://discuss.elastic.co/t/lost-all-indices-after-adding-additional-pipelines/276858 "2021-06-24T13:58:08Z")
So after I cleared all of the indices and added an additional method to my pipeline configuration, my indices will not repopulate. I have added my code below for the original configuration and then reconfiguration. Ori… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=901) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=903)