# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=957 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 958 --- ## [How to handle lots of small indices](https://discuss.elastic.co/t/how-to-handle-lots-of-small-indices/272063)
**Author:** [@fillg1](https://discuss.elastic.co/u/fillg1)\ **Replies:** 8\ **Last updated:** [May 5, 2021, 12:13pm UTC](https://discuss.elastic.co/t/how-to-handle-lots-of-small-indices/272063 "2021-05-05T12:13:31Z")
Hi folks We are using Elasticsearch as a kind of backend for our application. Due to security and privacy reasons, we create a per user index which is opened/ closed by the application. This size of the index is small… --- ## [Understand "reconnect" and "retries" settings in Kafka output](https://discuss.elastic.co/t/understand-reconnect-and-retries-settings-in-kafka-output/272157)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 2\ **Last updated:** [May 5, 2021, 9:52am UTC](https://discuss.elastic.co/t/understand-reconnect-and-retries-settings-in-kafka-output/272157 "2021-05-05T09:52:25Z")
Hello all, With this config : input { tcp { type =\> "NETWORK\_DEVICE" port =\> 1602 } filter{ } output { kafka { topic\_id =\> \["network.device"\] codec =\> json bootstrap\_servers =\> "kafka1:9092,kafka2:9092,k… --- ## [How is ES data distributed in each data nodes](https://discuss.elastic.co/t/how-is-es-data-distributed-in-each-data-nodes/272079)
**Author:** [@chaitra\_hegde](https://discuss.elastic.co/u/chaitra_hegde)\ **Replies:** 1\ **Last updated:** [May 5, 2021, 9:57am UTC](https://discuss.elastic.co/t/how-is-es-data-distributed-in-each-data-nodes/272079 "2021-05-05T09:57:56Z")
Hi, I am using Elasticsearch 7.8.0 in k8s environment. I have 20 ES ingest nodes for serving traffic, 25 data nodes , 3 master nodes. How is the data stored getting distributed across all ES data nodes because I see on … --- ## [Mutate Convert not working as I expect](https://discuss.elastic.co/t/mutate-convert-not-working-as-i-expect/272133)
**Author:** [@lachlan.simpson](https://discuss.elastic.co/u/lachlan.simpson)\ **Replies:** 3\ **Last updated:** [May 5, 2021, 9:29am UTC](https://discuss.elastic.co/t/mutate-convert-not-working-as-i-expect/272133 "2021-05-05T09:29:15Z")
RHEL8.3, ELK 7.12.1, I am using convert as documented, but I just can't see what I've done wrong. Here's the filter, per the docs filter { if \[pbs\_accounting\] { csv { separator =\> ";" columns =\> \["da… --- ## [Default dashboard without field](https://discuss.elastic.co/t/default-dashboard-without-field/272083)
**Author:** [@graimato](https://discuss.elastic.co/u/graimato)\ **Replies:** 2\ **Last updated:** [May 5, 2021, 9:16am UTC](https://discuss.elastic.co/t/default-dashboard-without-field/272083 "2021-05-05T09:16:40Z")
Dear all, I'm collect data from Nginx, apache, linux SO, using metribeat, the data arrive in to the index and I use standard dashboard to graph the data, I'm changing the source data, as example changing the index and f… --- ## [Pipeline to pipeline communication](https://discuss.elastic.co/t/pipeline-to-pipeline-communication/272140)
**Author:** [@bdn](https://discuss.elastic.co/u/bdn)\ **Replies:** 2\ **Last updated:** [May 5, 2021, 9:12am UTC](https://discuss.elastic.co/t/pipeline-to-pipeline-communication/272140 "2021-05-05T09:12:21Z")
I have a requirement. Events will be listening on some TCP ports in Logstash. using a filter plugin I will extract the username field from the event. After that, I have to query another API server providing that username… --- ## [Remove a key that starts with 0 to 9](https://discuss.elastic.co/t/remove-a-key-that-starts-with-0-to-9/272142)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 0\ **Last updated:** [May 5, 2021, 7:49am UTC](https://discuss.elastic.co/t/remove-a-key-that-starts-with-0-to-9/272142 "2021-05-05T07:49:54Z")
Hello team, I need to Remove a field that starts with an integer. I am using logstash & kv filter to parse this logs. Can you please help me. PFB sample log line: 2021-01-07 05:32:31,761 Method=get call SoapAction="Ri… --- ## [Directly accessing data from multiline log data](https://discuss.elastic.co/t/directly-accessing-data-from-multiline-log-data/272135)
**Author:** [@Learn\_Mulesoft\_With](https://discuss.elastic.co/u/Learn_Mulesoft_With)\ **Replies:** 0\ **Last updated:** [May 5, 2021, 5:50am UTC](https://discuss.elastic.co/t/directly-accessing-data-from-multiline-log-data/272135 "2021-05-05T05:50:52Z")
Hi Below is my sample plain text input to http input , is there any way in filter to directly jump to " Trace: " and then directly jump to "Error type" and retrieve value the part denoted by "XXX" is dynamic it will … --- ## [Logstash filter for muliple values not working](https://discuss.elastic.co/t/logstash-filter-for-muliple-values-not-working/272087)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 2\ **Last updated:** [May 5, 2021, 5:04am UTC](https://discuss.elastic.co/t/logstash-filter-for-muliple-values-not-working/272087 "2021-05-05T05:04:01Z")
Hi All, I am trying to remove message for few service tags, but I am facing below issue. Below is not working if \[SERVICE\] in \["GET", "UPDATE"\] { mutate { remove\_field =\> \["message"\] } } Below is working if "GET"… --- ## [SIEM with Basic License On-Prem?](https://discuss.elastic.co/t/siem-with-basic-license-on-prem/272109)
**Author:** [@R99Stny](https://discuss.elastic.co/u/R99Stny)\ **Replies:** 1\ **Last updated:** [May 5, 2021, 12:56am UTC](https://discuss.elastic.co/t/siem-with-basic-license-on-prem/272109 "2021-05-05T00:56:27Z")
We have a 3 node cluster on prem 7.6. Couple questions: Based on the docs we should be able to see and use pre-built detections with only a basic license? We do need (required to) have tls/ssl set up within the cluster… --- ## [Rule exception in SIEM Kibana 7.12](https://discuss.elastic.co/t/rule-exception-in-siem-kibana-7-12/272072)
**Author:** [@dsgamr](https://discuss.elastic.co/u/dsgamr)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 11:38pm UTC](https://discuss.elastic.co/t/rule-exception-in-siem-kibana-7-12/272072 "2021-05-04T23:38:22Z")
Hi, One of build in rules - Whoami Process Activity - generates a lot of false positives in my environment so I tried to add exception to the rule. Problem is that to do it properly one has to use wildcards which doesn… --- ## [Two nodes cluster questions](https://discuss.elastic.co/t/two-nodes-cluster-questions/272115)
**Author:** [@nuzolx](https://discuss.elastic.co/u/nuzolx)\ **Replies:** 2\ **Last updated:** [May 4, 2021, 9:06pm UTC](https://discuss.elastic.co/t/two-nodes-cluster-questions/272115 "2021-05-04T21:06:48Z")
Hi, I have a two nodes cluster in production. I know this not good but, right now, I cant afford a 3th node. I have read: Resilience in small clusters | Elasticsearch Guide \[7.12\] | Elastic For example node1 is maste… --- ## [Elastic Endopint fails deployment v7.12.1](https://discuss.elastic.co/t/elastic-endopint-fails-deployment-v7-12-1/271838)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 2\ **Last updated:** [May 4, 2021, 8:33pm UTC](https://discuss.elastic.co/t/elastic-endopint-fails-deployment-v7-12-1/271838 "2021-05-04T20:33:30Z")
Hi, Notes: ELK v7.12.1 Standalone OS Win 10 Pro, v20H2, build 19042.928 I recently upgraded to ELK v7.12.1 and have been testing it. Today I tried to update existing agents in Fleet to the most recent version. So far… --- ## [Kibana Visualization with different database](https://discuss.elastic.co/t/kibana-visualization-with-different-database/272107)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 8:31pm UTC](https://discuss.elastic.co/t/kibana-visualization-with-different-database/272107 "2021-05-04T20:31:08Z")
Hi all, We basically use Elasticsearch as database for Kibana. Should we always import data to Elasticsearch? Is there any way in which Kibana can directly read data from a database such as MongoDB and able to visuali… --- ## [What is role of .apm index in kibana?](https://discuss.elastic.co/t/what-is-role-of-apm-index-in-kibana/272106)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 8:29pm UTC](https://discuss.elastic.co/t/what-is-role-of-apm-index-in-kibana/272106 "2021-05-04T20:29:39Z")
Hi, I see .apm index in my kibana indices list. What is .apm and what is its role? --- ## [Classes descontinuadas](https://discuss.elastic.co/t/classes-descontinuadas/272113)
**Author:** [@Jair\_Gomes](https://discuss.elastic.co/u/Jair_Gomes)\ **Replies:** 0\ **Last updated:** [May 4, 2021, 8:29pm UTC](https://discuss.elastic.co/t/classes-descontinuadas/272113 "2021-05-04T20:29:28Z")
Eu estou atualizando um antigo código de um modelo de ranqueamento que utiliza as antigas classes (Acredito que sejam classes das versões 2.X ou 5.X): import org.elasticsearch.action.fieldstats.FieldStats; import org.el… --- ## [Usar pacote elasticsearch no código java](https://discuss.elastic.co/t/usar-pacote-elasticsearch-no-codigo-java/271149)
**Author:** [@Jair\_Gomes](https://discuss.elastic.co/u/Jair_Gomes)\ **Replies:** 4\ **Last updated:** [May 4, 2021, 8:23pm UTC](https://discuss.elastic.co/t/usar-pacote-elasticsearch-no-codigo-java/271149 "2021-05-04T20:23:44Z")
Eu estou tentando reproduzir um código em java (uma linguagem que não sou muito familiar) que utiliza o elastic search, eu acredito que sei como compilar e executar o código usando o jvm que vem com o elastic search. Mas… --- ## [Getting NaN in our data and its killing our C# code, but returns in Kibana?](https://discuss.elastic.co/t/getting-nan-in-our-data-and-its-killing-our-c-code-but-returns-in-kibana/272112)
**Author:** [@cis4life](https://discuss.elastic.co/u/cis4life)\ **Replies:** 0\ **Last updated:** [May 4, 2021, 8:10pm UTC](https://discuss.elastic.co/t/getting-nan-in-our-data-and-its-killing-our-c-code-but-returns-in-kibana/272112 "2021-05-04T20:10:26Z")
Good Day, Maybe you can help me with this. We have data being indexed into our system and appartantly there are times when there are sections of data that are not just there and may not be populated at certain times of… --- ## [Parsing Palo Alto System Logs with Date Filter](https://discuss.elastic.co/t/parsing-palo-alto-system-logs-with-date-filter/271836)
**Author:** [@6igwig](https://discuss.elastic.co/u/6igwig)\ **Replies:** 7\ **Last updated:** [May 4, 2021, 7:23pm UTC](https://discuss.elastic.co/t/parsing-palo-alto-system-logs-with-date-filter/271836 "2021-05-04T19:23:24Z")
I am trying to parse the Palo Alto System logs with logstash using the following dissect pattern inside a logstash filter: dissect { mapping =\> { "message" =\> '%{?date} %{?date} %{?date} %{?network} - %{?version},%{@… --- ## [Nested Query: Nested document returns unmatched documents](https://discuss.elastic.co/t/nested-query-nested-document-returns-unmatched-documents/272096)
**Author:** [@tkumar](https://discuss.elastic.co/u/tkumar)\ **Replies:** 0\ **Last updated:** [May 4, 2021, 5:17pm UTC](https://discuss.elastic.co/t/nested-query-nested-document-returns-unmatched-documents/272096 "2021-05-04T17:17:23Z")
Hi - We have indexed the document using nested mapping and the document also created in nested format in the Elasticsearch. But while retrieving using nested query it also returns unmatched documents from both the datas… --- ## [Elasticsearch migrating from mesos container framework to K8s](https://discuss.elastic.co/t/elasticsearch-migrating-from-mesos-container-framework-to-k8s/272104)
**Author:** [@guthurti](https://discuss.elastic.co/u/guthurti)\ **Replies:** 0\ **Last updated:** [May 4, 2021, 6:15pm UTC](https://discuss.elastic.co/t/elasticsearch-migrating-from-mesos-container-framework-to-k8s/272104 "2021-05-04T18:15:54Z")
Team, Can you please someone suggest what is the best way to migrate Elasticsearch Mesos to k8s. I tried one solution but not succeeded, Mesos mount volume same as used k8s statefulset and pix-boot the nodes. I am not … --- ## [Logstash date filter, kibana index template warning in logs](https://discuss.elastic.co/t/logstash-date-filter-kibana-index-template-warning-in-logs/272094)
**Author:** [@wmei](https://discuss.elastic.co/u/wmei)\ **Replies:** 2\ **Last updated:** [May 4, 2021, 5:43pm UTC](https://discuss.elastic.co/t/logstash-date-filter-kibana-index-template-warning-in-logs/272094 "2021-05-04T17:43:23Z")
Hi, Original log, these dates are in the format 20210504-15:40:02.601 and I have a date filter to convert that in my logstash.yml. I am doing the same filter for both the SendingTime and the TransactTime. if \[layers\]\[f… --- ## [Failed to execute pipeline for a bulk request](https://discuss.elastic.co/t/failed-to-execute-pipeline-for-a-bulk-request/271290)
**Author:** [@lacarrillo](https://discuss.elastic.co/u/lacarrillo)\ **Replies:** 12\ **Last updated:** [May 4, 2021, 5:43pm UTC](https://discuss.elastic.co/t/failed-to-execute-pipeline-for-a-bulk-request/271290 "2021-05-04T17:43:20Z")
Hello everyone. I have a cluster with 20 data nodes with 4 CPU and 16 GB of RAM. I'm indexing in avg 300 million documents per day (500 GB avg ) into this cluster. The cluster works perfectly during most of the day but e… --- ## [Query\_string with wildcard fields sends "Can't parse boolean value"](https://discuss.elastic.co/t/query-string-with-wildcard-fields-sends-cant-parse-boolean-value/271245)
**Author:** [@CLEMENT\_CAZEAUX](https://discuss.elastic.co/u/CLEMENT_CAZEAUX)\ **Replies:** 7\ **Last updated:** [May 4, 2021, 5:40pm UTC](https://discuss.elastic.co/t/query-string-with-wildcard-fields-sends-cant-parse-boolean-value/271245 "2021-05-04T17:40:41Z")
Hello, Basic query such as the documentation here Query string query | Elasticsearch Guide \[7.9\] | Elastic results in error: I've tested with version 7.9, I'll try next with the current 7.12 GET \_search?error\_trace=… --- ## [Date data type and time for kibana](https://discuss.elastic.co/t/date-data-type-and-time-for-kibana/272047)
**Author:** [@LombardoAndrea195](https://discuss.elastic.co/u/LombardoAndrea195)\ **Replies:** 6\ **Last updated:** [May 4, 2021, 4:10pm UTC](https://discuss.elastic.co/t/date-data-type-and-time-for-kibana/272047 "2021-05-04T16:10:30Z")
Hi all experts, I'm a beginner of this new techonolgy. I've some doubt about data type: I used the data like this and using python for interacting I manage to use this script to incorporate data+ time in order to be co… --- ## [Logstash conf file, difference between multiple input/output vs consolidated input/output](https://discuss.elastic.co/t/logstash-conf-file-difference-between-multiple-input-output-vs-consolidated-input-output/272066)
**Author:** [@Baygon](https://discuss.elastic.co/u/Baygon)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 4:09pm UTC](https://discuss.elastic.co/t/logstash-conf-file-difference-between-multiple-input-output-vs-consolidated-input-output/272066 "2021-05-04T16:09:03Z")
Hi, I'm having about 25 pipelines to configure. I used to have all my jdbc sources inside one input block, then in the output I would have a if condition on the 'tags' value. That would mean on input with 25 jdbbc sec… --- ## [Elasticsearch nodes are going to out of memory when ~100 fluentd tries to contact it](https://discuss.elastic.co/t/elasticsearch-nodes-are-going-to-out-of-memory-when-100-fluentd-tries-to-contact-it/272073)
**Author:** [@chaitra\_hegde](https://discuss.elastic.co/u/chaitra_hegde)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 3:47pm UTC](https://discuss.elastic.co/t/elasticsearch-nodes-are-going-to-out-of-memory-when-100-fluentd-tries-to-contact-it/272073 "2021-05-04T15:47:38Z")
Hi, I am using Elasticsearch 7.8.0 in k8s environment. I have 20 ES ingest nodes for serving traffic, 25 data nodes , 3 master nodes. I have around 100 fluentd's for pushing data to ES(data push is not uniform. Some day… --- ## [Elasticsearch stuck with cluster\_uuid NA](https://discuss.elastic.co/t/elasticsearch-stuck-with-cluster-uuid-na/271870)
**Author:** [@mouli\_v](https://discuss.elastic.co/u/mouli_v)\ **Replies:** 6\ **Last updated:** [May 4, 2021, 2:46pm UTC](https://discuss.elastic.co/t/elasticsearch-stuck-with-cluster-uuid-na/271870 "2021-05-04T14:46:21Z")
We have a production elastic cluster with a 1.0.1 operator version. We planned to upgrade the version to the latest 1.5 so that we can opt for the dynamic storage changes. When we ran upgrade of the operator; pods in th… --- ## [Master node failure](https://discuss.elastic.co/t/master-node-failure/272080)
**Author:** [@Mohammad\_N](https://discuss.elastic.co/u/Mohammad_N)\ **Replies:** 0\ **Last updated:** [May 4, 2021, 2:43pm UTC](https://discuss.elastic.co/t/master-node-failure/272080 "2021-05-04T14:43:27Z")
I have a k3s kubernetes cluster and an elasticsearch cluster deployment. I am trying to install minhash plugin and playing around with the plugin. everything is normal and I can restore some old snapshots successfuly in… --- ## [SQL expression to calculate the percentage](https://discuss.elastic.co/t/sql-expression-to-calculate-the-percentage/271732)
**Author:** [@saintjohn](https://discuss.elastic.co/u/saintjohn)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 2:36pm UTC](https://discuss.elastic.co/t/sql-expression-to-calculate-the-percentage/271732 "2021-05-04T14:36:36Z")
Hi experts, I have a dataset like below, separated with data range. Field name is set to "test" where number of "≧-∞ and \< 1" is 1, and "≧1 and \<+∞" is 15. What I'm trying to do is to add a metric element in the cent… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=956) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=958)