# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=908 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 909 --- ## [Why does returning just the ID from a search fails?](https://discuss.elastic.co/t/why-does-returning-just-the-id-from-a-search-fails/276461)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 11:18am UTC](https://discuss.elastic.co/t/why-does-returning-just-the-id-from-a-search-fails/276461 "2021-06-21T11:18:51Z")
Dear all =) Can someone figure out why I am getting {"statusCode":400,"error":"Bad Request","message":"\[request query.fields\]: could not parse array value from json input"} when I search for a specific rule base="htt… --- ## [How To parse Multiline Message With Grok](https://discuss.elastic.co/t/how-to-parse-multiline-message-with-grok/276500)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 6\ **Last updated:** [June 21, 2021, 10:47am UTC](https://discuss.elastic.co/t/how-to-parse-multiline-message-with-grok/276500 "2021-06-21T10:47:09Z")
I am working with AWS Cloudwatchs' GuardDuty finding events, I am getting GuardDuty event in the following format : "message": "\\n\\"AWS MY\_ACCOUNTID has a severity 2 GuardDuty finding type Recon:EC2/PortProbeUnprotected… --- ## [Using Ngrams for building a autocomplete suggester](https://discuss.elastic.co/t/using-ngrams-for-building-a-autocomplete-suggester/276520)
**Author:** [@Hooman\_Bahreini](https://discuss.elastic.co/u/Hooman_Bahreini)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 10:19am UTC](https://discuss.elastic.co/t/using-ngrams-for-building-a-autocomplete-suggester/276520 "2021-06-21T10:19:47Z")
I have 2 fields in my index, Title and Description. Title obviously a short phrase (max 100 characters) and description is a long description (up to 5000 characters). I have built a autocomplete by building ngrams on T… --- ## [Conditional search in Lucene or Query DSL](https://discuss.elastic.co/t/conditional-search-in-lucene-or-query-dsl/276436)
**Author:** [@Eric\_Barreto](https://discuss.elastic.co/u/Eric_Barreto)\ **Replies:** 3\ **Last updated:** [June 21, 2021, 10:07am UTC](https://discuss.elastic.co/t/conditional-search-in-lucene-or-query-dsl/276436 "2021-06-21T10:07:56Z")
Hi guys, I'm trying to do a search via Lucene or Query DSL that does the following: I have a log that contains several fields, among them the sourceIp and resourceKey fields. I need to create a survey that shows me all… --- ## [Filter products in shared catalogs with price range](https://discuss.elastic.co/t/filter-products-in-shared-catalogs-with-price-range/276264)
**Author:** [@thangld](https://discuss.elastic.co/u/thangld)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 9:33am UTC](https://discuss.elastic.co/t/filter-products-in-shared-catalogs-with-price-range/276264 "2021-06-21T09:33:07Z")
Hi there, I have a store and use Elasticsearch for storing products. I need to filter products by price range. It is simple if products' price is the same to all customers, but in my case, customers from different grou… --- ## [Severe I/O performance degradation after Ubuntu 18.04 upgrade](https://discuss.elastic.co/t/severe-i-o-performance-degradation-after-ubuntu-18-04-upgrade/276509)
**Author:** [@amo1](https://discuss.elastic.co/u/amo1)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 9:19am UTC](https://discuss.elastic.co/t/severe-i-o-performance-degradation-after-ubuntu-18-04-upgrade/276509 "2021-06-21T09:19:24Z")
Hi, We recently upgraded the OS on a couple of independently running hot/warm clusters. Each cluster has 9 nodes (3 masters, 3 hot nodes and 3 warm nodes) and are running on pretty decent hardware (32GB-64GB RAM on each… --- ## [Any way for an Elasticsearch plugin to override default api behavior?](https://discuss.elastic.co/t/any-way-for-an-elasticsearch-plugin-to-override-default-api-behavior/276255)
**Author:** [@Dor\_Levi](https://discuss.elastic.co/u/Dor_Levi)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 9:10am UTC](https://discuss.elastic.co/t/any-way-for-an-elasticsearch-plugin-to-override-default-api-behavior/276255 "2021-06-21T09:10:30Z")
Hi, I'm playing around with Elastic, and wondered if there's anyway to dynamically override a default endpoint behavior. I tried creating a plugin which adds a BaseRestHandler, but when attempting to specify a route wh… --- ## [Want a fault tolerant search but got to much results](https://discuss.elastic.co/t/want-a-fault-tolerant-search-but-got-to-much-results/276311)
**Author:** [@Joni94](https://discuss.elastic.co/u/Joni94)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 9:04am UTC](https://discuss.elastic.co/t/want-a-fault-tolerant-search-but-got-to-much-results/276311 "2021-06-21T09:04:29Z")
Hello, I am trying to set up an error-tolerant search and have created the field "name" as "text" in my index and would like to search for it. I expect to search for exactly what I entered but normalise the string befo… --- ## [Update by query after mapping change](https://discuss.elastic.co/t/update-by-query-after-mapping-change/276397)
**Author:** [@YvorL](https://discuss.elastic.co/u/YvorL)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 8:57am UTC](https://discuss.elastic.co/t/update-by-query-after-mapping-change/276397 "2021-06-21T08:57:05Z")
Hi, In case I have a daily index and want to add a new field without waiting for the new index that would re-read the mapping template, I can use the Update mapping API. What I'm not 100% sure is that I would only need … --- ## [Does adding field collapsing improve the query latency](https://discuss.elastic.co/t/does-adding-field-collapsing-improve-the-query-latency/276426)
**Author:** [@Bhavik92](https://discuss.elastic.co/u/Bhavik92)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 8:46am UTC](https://discuss.elastic.co/t/does-adding-field-collapsing-improve-the-query-latency/276426 "2021-06-21T08:46:55Z")
In elastic-search, I am using phrase\_prefix queries for my use case. Surprisingly, the query returns results much faster when adding collapse clause based on a field. This feels counter-intuitive to me since collapse sho… --- ## [Elastic simple query with wildcard](https://discuss.elastic.co/t/elastic-simple-query-with-wildcard/276441)
**Author:** [@Vinoth\_G](https://discuss.elastic.co/u/Vinoth_G)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 8:42am UTC](https://discuss.elastic.co/t/elastic-simple-query-with-wildcard/276441 "2021-06-21T08:42:31Z")
I am new to elastic and planning to migrate my application from algolia to elastic cloud. In algolia after creating an index and writing a document I can search by passing a search query, no need to specify wildcard pat… --- ## [Overall traffic rollup](https://discuss.elastic.co/t/overall-traffic-rollup/276503)
**Author:** [@ghaithTK](https://discuss.elastic.co/u/ghaithTK)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 8:09am UTC](https://discuss.elastic.co/t/overall-traffic-rollup/276503 "2021-06-21T08:09:12Z")
Hi I am trying to rollup (daily) network inbound traffic using field system.network.in.bytes. but when i use inbound visualization with rollup index i got this(image) what the problem and is there another way to ro… --- ## [Field host.ip problem](https://discuss.elastic.co/t/field-host-ip-problem/276498)
**Author:** [@rebug](https://discuss.elastic.co/u/rebug)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 7:58am UTC](https://discuss.elastic.co/t/field-host-ip-problem/276498 "2021-06-21T07:58:25Z")
Hi guys. I have a problem, every index I made (using Filebeat modules or not) I have a field named host.ip with about 20 different IP address in it. I can't use it because it is unrelevant, anyone has the same problem … --- ## [Disabling "View single document"](https://discuss.elastic.co/t/disabling-view-single-document/275832)
**Author:** [@kerbero](https://discuss.elastic.co/u/kerbero)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 7:29am UTC](https://discuss.elastic.co/t/disabling-view-single-document/275832 "2021-06-21T07:29:47Z")
I have a doubt about kibana dashboard, Is it possible to disable the "View single document" button? This button is located when Kibana shows a document information both in table format as well as json. Thanks. --- ## [Logstash Application throwing up warning "Connection reset by peer"](https://discuss.elastic.co/t/logstash-application-throwing-up-warning-connection-reset-by-peer/276489)
**Author:** [@theju0805](https://discuss.elastic.co/u/theju0805)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 7:14am UTC](https://discuss.elastic.co/t/logstash-application-throwing-up-warning-connection-reset-by-peer/276489 "2021-06-21T07:14:08Z")
Logstash application throwing up warning "Connection reset by peer". Logstash is hosted on Azure. This warning doesn't exist or occur on the VM, but after the VM is scaled up(VMSS) I see the warning coming up continuous… --- ## [filter\>jdbc\_streaming\>\[Oracle\] Delete Query return “\[Warn\] ORA-01002”](https://discuss.elastic.co/t/filter-jdbc-streaming-oracle-delete-query-return-warn-ora-01002/273907)
**Author:** [@zeraf29](https://discuss.elastic.co/u/zeraf29)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 6:55am UTC](https://discuss.elastic.co/t/filter-jdbc-streaming-oracle-delete-query-return-warn-ora-01002/273907 "2021-06-21T06:55:28Z")
Hi. Nice to meet you. I try to make logstash-pipeline which works like below. (1)Input: JDBC plugin-Select data on Oracle DBMS (2)Filter: JDBC\_STREAMING plugin- Delete Data slected by input plugin results (3)Output: … --- ## [Question on using my own value as \_id](https://discuss.elastic.co/t/question-on-using-my-own-value-as-id/276470)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 4\ **Last updated:** [June 21, 2021, 6:15am UTC](https://discuss.elastic.co/t/question-on-using-my-own-value-as-id/276470 "2021-06-21T06:15:18Z")
Hi As per this post it is not advisable to bring your own \_id to elasticsearch. I have inherited a shared windows (horror of all the horrors) drive as a source of log file and already see re-ingestion happening occasion… --- ## [Logstash pipeline not inserting all data at first time](https://discuss.elastic.co/t/logstash-pipeline-not-inserting-all-data-at-first-time/276347)
**Author:** [@vikramdayma](https://discuss.elastic.co/u/vikramdayma)\ **Replies:** 4\ **Last updated:** [June 21, 2021, 4:28am UTC](https://discuss.elastic.co/t/logstash-pipeline-not-inserting-all-data-at-first-time/276347 "2021-06-21T04:28:27Z")
Hi, I setup a logstash conf file for data from sql to elasticsearch index. When I run conf file first time, it insert less data, every time with new index. Inserted data is less than from total data, randomly. But sec… --- ## [How to check if a document exists for a specified Id and alias name](https://discuss.elastic.co/t/how-to-check-if-a-document-exists-for-a-specified-id-and-alias-name/276464)
**Author:** [@Deepti](https://discuss.elastic.co/u/Deepti)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 3:00am UTC](https://discuss.elastic.co/t/how-to-check-if-a-document-exists-for-a-specified-id-and-alias-name/276464 "2021-06-21T03:00:42Z")
Iam trying to check if a document exists for the specified ID and alias using the search Api, In the response I just need the index name if the document exists. Adding to this, is there any api to check if the returned … --- ## [Sorting array items within single document](https://discuss.elastic.co/t/sorting-array-items-within-single-document/276440)
**Author:** [@peterlen](https://discuss.elastic.co/u/peterlen)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 1:17am UTC](https://discuss.elastic.co/t/sorting-array-items-within-single-document/276440 "2021-06-21T01:17:20Z")
One of our indices contains documents that include an internal array. Say within a given document it contains the following: "geoEntities" : \[ "France", "United States", "China", "Germany" \] I want to be able to … --- ## [Fine tune bert model on elasticsearch](https://discuss.elastic.co/t/fine-tune-bert-model-on-elasticsearch/276466)
**Author:** [@pakwai122](https://discuss.elastic.co/u/pakwai122)\ **Replies:** 0\ **Last updated:** [June 20, 2021, 3:56pm UTC](https://discuss.elastic.co/t/fine-tune-bert-model-on-elasticsearch/276466 "2021-06-20T15:56:19Z")
I got a simple page written in node.js for searching with Elasticsearch engine, and recently, I want to enhance the searching result, and wanna use Google fine tune bert model to do so. I'm not sure how to make two thin… --- ## [Simple search with wildcard not working](https://discuss.elastic.co/t/simple-search-with-wildcard-not-working/276442)
**Author:** [@Vinoth\_G](https://discuss.elastic.co/u/Vinoth_G)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 1:02am UTC](https://discuss.elastic.co/t/simple-search-with-wildcard-not-working/276442 "2021-06-21T01:02:29Z")
I am new to elastic and planning to migrate my application from algolia to elastic cloud. I created an index called products where I added this data { "dname": "mysore soap", "price": "150", "some": { "id": "… --- ## [Removed MDP (Multi Data path) how to configure new](https://discuss.elastic.co/t/removed-mdp-multi-data-path-how-to-configure-new/276467)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 2\ **Last updated:** [June 20, 2021, 10:34pm UTC](https://discuss.elastic.co/t/removed-mdp-multi-data-path-how-to-configure-new/276467 "2021-06-20T22:34:29Z")
Now that I just learned that Elk is removing MDP that means I won't be assign multiple raw disk. :sob: ( which is bad idea) but now it is there how do I configure. which is step back. if I use raid1 then I am loosing … --- ## [Logstash Ruby : Find Matching Value From Two Different Array](https://discuss.elastic.co/t/logstash-ruby-find-matching-value-from-two-different-array/276460)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 1\ **Last updated:** [June 20, 2021, 5:51pm UTC](https://discuss.elastic.co/t/logstash-ruby-find-matching-value-from-two-different-array/276460 "2021-06-20T17:51:30Z")
I have two different arrays outputs and info.policy.rules coming in the same log document and I would like to run a ruby loop to find if there is any matching value available for adderss field in the array of outputs aga… --- ## [File upload issue with Data Visualizer in Kibana](https://discuss.elastic.co/t/file-upload-issue-with-data-visualizer-in-kibana/276320)
**Author:** [@rai](https://discuss.elastic.co/u/rai)\ **Replies:** 1\ **Last updated:** [June 20, 2021, 1:01pm UTC](https://discuss.elastic.co/t/file-upload-issue-with-data-visualizer-in-kibana/276320 "2021-06-20T13:01:59Z")
I am trying to upload a simple JSON file { "address":{ "serviceLocationId":"873784937", "billerLocationId":"2234243", "locationType":"RESI", "dwellingType":"SINGLE", "taxGeoCode":"2342325" } } but getting follo… --- ## [Logstash error when converting field \[http\]\[response\]\[status\_code\] into integer](https://discuss.elastic.co/t/logstash-error-when-converting-field-http-response-status-code-into-integer/276456)
**Author:** [@bertr](https://discuss.elastic.co/u/bertr)\ **Replies:** 0\ **Last updated:** [June 20, 2021, 7:55am UTC](https://discuss.elastic.co/t/logstash-error-when-converting-field-http-response-status-code-into-integer/276456 "2021-06-20T07:55:48Z")
Tried this with logtsash 7.10.2 and 7.12.1: The following code results in "(TypeError) no implicit conversion of nil into Integer": mutate { add\_field =\> { "\[http\]\[response\]\[status\_code\]" =\> "200" } } \<== this sta… --- ## [Is sorting possible on search\_as\_you\_type field](https://discuss.elastic.co/t/is-sorting-possible-on-search-as-you-type-field/276449)
**Author:** [@kiko](https://discuss.elastic.co/u/kiko)\ **Replies:** 2\ **Last updated:** [June 20, 2021, 6:43am UTC](https://discuss.elastic.co/t/is-sorting-possible-on-search-as-you-type-field/276449 "2021-06-20T06:43:58Z")
I have mapped my product/category titles to search\_as\_you\_type fields. When I try to sort by those fields I get this error: "error": { "root\_cause": \[ { "type": "illegal\_argument\_e… --- ## [Elasticsearch rellocation shard stucks](https://discuss.elastic.co/t/elasticsearch-rellocation-shard-stucks/276448)
**Author:** [@KA3AXCTAH](https://discuss.elastic.co/u/KA3AXCTAH)\ **Replies:** 0\ **Last updated:** [June 20, 2021, 5:01am UTC](https://discuss.elastic.co/t/elasticsearch-rellocation-shard-stucks/276448 "2021-06-20T05:01:31Z")
I'm delete node from my cluster using this command curl -u elastig:themoststrongpasswordever -XPUT 10.0.10.10:9200/\_cluster/settings -H 'Content-Type: application/json' -d '{ "transient" :{ "cluster.routing.allocati… --- ## [Logstash mapping not working correctly](https://discuss.elastic.co/t/logstash-mapping-not-working-correctly/276446)
**Author:** [@Jeremy\_D](https://discuss.elastic.co/u/Jeremy_D)\ **Replies:** 1\ **Last updated:** [June 20, 2021, 2:47am UTC](https://discuss.elastic.co/t/logstash-mapping-not-working-correctly/276446 "2021-06-20T02:47:26Z")
Really unclear as to what I need to do to make this work right. My logs coming from my Python application are nested within "message" rather than being mapped to the proper fields. Notice how "message" has all the co… --- ## [Using huge NVMe disks with elasticsearch](https://discuss.elastic.co/t/using-huge-nvme-disks-with-elasticsearch/276228)
**Author:** [@Timur\_Makarchuk](https://discuss.elastic.co/u/Timur_Makarchuk)\ **Replies:** 8\ **Last updated:** [June 20, 2021, 1:03am UTC](https://discuss.elastic.co/t/using-huge-nvme-disks-with-elasticsearch/276228 "2021-06-20T01:03:44Z")
Hello everyone. We're currently in process of choosing new hardware for our elasticsearch cluster. Our current cluster consists of 32 nodes and holds 42TB of data across 2000 indices. We're choosing hardware from the … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=907) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=909)