# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=966 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 967 --- ## [Filter by count of inner\_hits?](https://discuss.elastic.co/t/filter-by-count-of-inner-hits/271298)
**Author:** [@bkazez](https://discuss.elastic.co/u/bkazez)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 7:16pm UTC](https://discuss.elastic.co/t/filter-by-count-of-inner-hits/271298 "2021-04-27T19:16:36Z")
I'm using ES to search movements of baroque music, so someone can find e.g. music for flute, violin, and soprano or for 2 violins and soprano. The following works: Multilingual instrument names flûte à bec should find… --- ## [Need help aggregating strings from logs](https://discuss.elastic.co/t/need-help-aggregating-strings-from-logs/271428)
**Author:** [@nitishj](https://discuss.elastic.co/u/nitishj)\ **Replies:** 0\ **Last updated:** [April 27, 2021, 6:12pm UTC](https://discuss.elastic.co/t/need-help-aggregating-strings-from-logs/271428 "2021-04-27T18:12:03Z")
I wish to create a dashboard with a dataset consisting of 3 variables out of which I want to see average values of 2 (after theyr're grouped the third variable). For example, I would like to see the solverObjVal and Solv… --- ## [Can Elasticsearch on Kubernetes safely reuse data from PVs that were detached after a node went down?](https://discuss.elastic.co/t/can-elasticsearch-on-kubernetes-safely-reuse-data-from-pvs-that-were-detached-after-a-node-went-down/271207)
**Author:** [@mattwelke](https://discuss.elastic.co/u/mattwelke)\ **Replies:** 3\ **Last updated:** [April 27, 2021, 3:52pm UTC](https://discuss.elastic.co/t/can-elasticsearch-on-kubernetes-safely-reuse-data-from-pvs-that-were-detached-after-a-node-went-down/271207 "2021-04-27T15:52:51Z")
I'm looking into different ways to deploy Elasticsearch on Kubernetes. My understanding so far is that it's normal to use the ECK operator pattern to deploy if you're deploying to Kubernetes, and that this causes Statef… --- ## [Kibana maps type - search\_as\_you\_type as unknown in the index pattern](https://discuss.elastic.co/t/kibana-maps-type-search-as-you-type-as-unknown-in-the-index-pattern/271399)
**Author:** [@cvljayawardana](https://discuss.elastic.co/u/cvljayawardana)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 3:43pm UTC](https://discuss.elastic.co/t/kibana-maps-type-search-as-you-type-as-unknown-in-the-index-pattern/271399 "2021-04-27T15:43:56Z")
I am using elasticsearch/kibana - 7.9.8 and I am trying create a suggestions API using search\_as\_you\_type data type. However, when I add the mapping to the index with certain fields as search\_as\_you\_type kibana index pa… --- ## [Can I trust a PIT id once it has been replaced by a new PIT id?](https://discuss.elastic.co/t/can-i-trust-a-pit-id-once-it-has-been-replaced-by-a-new-pit-id/271054)
**Author:** [@Snav](https://discuss.elastic.co/u/Snav)\ **Replies:** 4\ **Last updated:** [April 27, 2021, 3:39pm UTC](https://discuss.elastic.co/t/can-i-trust-a-pit-id-once-it-has-been-replaced-by-a-new-pit-id/271054 "2021-04-27T15:39:06Z")
Hello there, I was wondering how the Point In Time works internally and if it is trustable for parallelization. Context Given this implementation: I have a search request to retrieve a list of offers. It may return … --- ## [What is Logstash regex engine?](https://discuss.elastic.co/t/what-is-logstash-regex-engine/271387)
**Author:** [@grumo35](https://discuss.elastic.co/u/grumo35)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 3:10pm UTC](https://discuss.elastic.co/t/what-is-logstash-regex-engine/271387 "2021-04-27T15:10:08Z")
Hi, Just came across some regex in config files today and i cannot figure out which engine it is based on and documentation about the syntax i should use in my config. the thing i've stumbled across : if \[field\] !~ /… --- ## [Mapping template field with keyword suffix](https://discuss.elastic.co/t/mapping-template-field-with-keyword-suffix/270989)
**Author:** [@benschiefer](https://discuss.elastic.co/u/benschiefer)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 2:55pm UTC](https://discuss.elastic.co/t/mapping-template-field-with-keyword-suffix/270989 "2021-04-27T14:55:55Z")
Hello, I am currently running into an issue where I am hitting the max fields for an index. In order to address this issue, I am defining mapping types for the different fields in my index. Many of the fields in my cu… --- ## [Substitution text if value missing](https://discuss.elastic.co/t/substitution-text-if-value-missing/271301)
**Author:** [@lquin1978](https://discuss.elastic.co/u/lquin1978)\ **Replies:** 4\ **Last updated:** [April 27, 2021, 2:54pm UTC](https://discuss.elastic.co/t/substitution-text-if-value-missing/271301 "2021-04-27T14:54:17Z")
Our firewall is sending log messages to our ELK stack. Most of these messages contain a source and destination IP address.. but occasionally these values are not present. These messages are being forward via email and … --- ## [Button URL when ELK server IP is changed](https://discuss.elastic.co/t/button-url-when-elk-server-ip-is-changed/270959)
**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 2:52pm UTC](https://discuss.elastic.co/t/button-url-when-elk-server-ip-is-changed/270959 "2021-04-27T14:52:12Z")
Kibana version : 7.9 Elasticsearch version : 7.9 APM Server version : 7.9 APM Agent language and version : java 1.8 Fresh install or upgraded from other version? fresh install Is there anything special in your setup… --- ## [If field == IPv6 assign a different value](https://discuss.elastic.co/t/if-field-ipv6-assign-a-different-value/271397)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 0\ **Last updated:** [April 27, 2021, 2:32pm UTC](https://discuss.elastic.co/t/if-field-ipv6-assign-a-different-value/271397 "2021-04-27T14:32:38Z")
I have the following configuration (partial output) # Check if SourceIP address is IPv4 or IPv6. In case SourceIP is IPv6 change its value #if \[SourceIP\] =~ ":" { mutate { rename =\> { "SourceIP" =\> "SourceIP… --- ## [Logstash is failing when running as a service due to logstash-core-plugin-api.gemspec error](https://discuss.elastic.co/t/logstash-is-failing-when-running-as-a-service-due-to-logstash-core-plugin-api-gemspec-error/271385)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 2:26pm UTC](https://discuss.elastic.co/t/logstash-is-failing-when-running-as-a-service-due-to-logstash-core-plugin-api-gemspec-error/271385 "2021-04-27T14:26:23Z")
Hi Team, My logstash was working completely fine till yesterday and suddenly it stopped working, now when I am trying to restart it using systemctl start logstash command , I am getting below error. Check your env for… --- ## [Kibana doesn't show all field form the document](https://discuss.elastic.co/t/kibana-doesnt-show-all-field-form-the-document/271381)
**Author:** [@apox](https://discuss.elastic.co/u/apox)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 2:25pm UTC](https://discuss.elastic.co/t/kibana-doesnt-show-all-field-form-the-document/271381 "2021-04-27T14:25:15Z")
Hi Guy, I have the problem that Kibana me the field what is call "stackTrace". The first JSON is from the index out of elasticsearch: { "\_index" : "filebeat-7.12.0-2021.04.27-000020", "\_type" : "\_doc", "\_id" : "… --- ## [Extract value from a multivalued field](https://discuss.elastic.co/t/extract-value-from-a-multivalued-field/271359)
**Author:** [@chriselk](https://discuss.elastic.co/u/chriselk)\ **Replies:** 3\ **Last updated:** [April 27, 2021, 2:16pm UTC](https://discuss.elastic.co/t/extract-value-from-a-multivalued-field/271359 "2021-04-27T14:16:22Z")
Hi, trying a simple stuff with logstash but could not get the expected result... I have a multivalued Field like: "PUB\_WEIGHT": \[ "3", "4", "6", "8" \] and in want to convert to Field\_1: 3 … --- ## [Date issue](https://discuss.elastic.co/t/date-issue/271322)
**Author:** [@sasvmware](https://discuss.elastic.co/u/sasvmware)\ **Replies:** 6\ **Last updated:** [April 27, 2021, 2:11pm UTC](https://discuss.elastic.co/t/date-issue/271322 "2021-04-27T14:11:46Z")
Log file date is on 26th but in elasticsearch date show as 25th why ? Logstash conf file. input { beats { port =\> 5044 } } filter { grok { match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:timestamp}%{GREEDYDATA:lt\_… --- ## [How do I separate stdout and stderr logs of Logstash service?](https://discuss.elastic.co/t/how-do-i-separate-stdout-and-stderr-logs-of-logstash-service/271393)
**Author:** [@hvardhan](https://discuss.elastic.co/u/hvardhan)\ **Replies:** 0\ **Last updated:** [April 27, 2021, 2:03pm UTC](https://discuss.elastic.co/t/how-do-i-separate-stdout-and-stderr-logs-of-logstash-service/271393 "2021-04-27T14:03:53Z")
Logstash is being run using systemd. I have tried adding: StandardError=/ebs/logs/some\_error.log in logstash.service but it doesn't work. Also added this in pipelines.yml output { if \[level\] == "WARN" { … --- ## [Results are not changed after index updating](https://discuss.elastic.co/t/results-are-not-changed-after-index-updating/271119)
**Author:** [@guilherme\_maranhao](https://discuss.elastic.co/u/guilherme_maranhao)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 1:59pm UTC](https://discuss.elastic.co/t/results-are-not-changed-after-index-updating/271119 "2021-04-27T13:59:41Z")
Hi everyone, I have a bool query: from: 0, size: 10, query: { bool: { must: \[ { term: { boolean\_field: false } }, { term: { integer\_field: \*something\* } }, … --- ## [Forward Logs from Elasticsearch to external destination application](https://discuss.elastic.co/t/forward-logs-from-elasticsearch-to-external-destination-application/271021)
**Author:** [@vishakh](https://discuss.elastic.co/u/vishakh)\ **Replies:** 7\ **Last updated:** [April 27, 2021, 1:59pm UTC](https://discuss.elastic.co/t/forward-logs-from-elasticsearch-to-external-destination-application/271021 "2021-04-27T13:59:34Z")
I'm looking to forward already stored logs from Elasticsearch to an external application-source. We're quite aware that we could leverage Logstash to distribute/split the new future-incoming logs between Elasticsearch a… --- ## [From CloudTrail S3 SQS to Elastic via Logstash](https://discuss.elastic.co/t/from-cloudtrail-s3-sqs-to-elastic-via-logstash/271391)
**Author:** [@Dimitri\_Goldshtein](https://discuss.elastic.co/u/Dimitri_Goldshtein)\ **Replies:** 0\ **Last updated:** [April 27, 2021, 1:58pm UTC](https://discuss.elastic.co/t/from-cloudtrail-s3-sqs-to-elastic-via-logstash/271391 "2021-04-27T13:58:49Z")
Hi all ! I try get logs from my aws s3 via logstash ! I generate get logs from CloudTrail to s3 with format \*\*\*\*.json.gz in logstash i use this input file input { sqs { queue =\> "test\_log… --- ## [How can I set new shard and replica number with re-index?](https://discuss.elastic.co/t/how-can-i-set-new-shard-and-replica-number-with-re-index/271337)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 1:53pm UTC](https://discuss.elastic.co/t/how-can-i-set-new-shard-and-replica-number-with-re-index/271337 "2021-04-27T13:53:51Z")
I have an index consisting of 40 shards and I want to make 50 shards with reindex. How can I determine the new shard and replica number with the reindex? --- ## [Pushing Distinct values from an index to another index](https://discuss.elastic.co/t/pushing-distinct-values-from-an-index-to-another-index/271318)
**Author:** [@CSehra](https://discuss.elastic.co/u/CSehra)\ **Replies:** 3\ **Last updated:** [April 27, 2021, 1:51pm UTC](https://discuss.elastic.co/t/pushing-distinct-values-from-an-index-to-another-index/271318 "2021-04-27T13:51:25Z")
Is there a way to push distinct values of a field from indexA to a new indexB on a regular basis(daily or monthly)? Use Case: I want to create indexB from one of the fields of indexA, and on a daily basis do an update o… --- ## [I can’t install logstash-plug](https://discuss.elastic.co/t/i-can-t-install-logstash-plug/271268)
**Author:** [@Dimitri\_Goldshtein](https://discuss.elastic.co/u/Dimitri_Goldshtein)\ **Replies:** 4\ **Last updated:** [April 27, 2021, 1:45pm UTC](https://discuss.elastic.co/t/i-can-t-install-logstash-plug/271268 "2021-04-27T13:45:13Z")
Hi all gurus ! I can’t install any plugin logstash ! For example this plugin : https://github.com/logstash-plugins/logstash-input-sqs If I run install to plug I get this error : usr/share/logstash/bin/logstash-plugi… --- ## [Open Kibana dashboard in a new browser tab from an application with authentication](https://discuss.elastic.co/t/open-kibana-dashboard-in-a-new-browser-tab-from-an-application-with-authentication/271336)
**Author:** [@abitoprakash](https://discuss.elastic.co/u/abitoprakash)\ **Replies:** 3\ **Last updated:** [April 27, 2021, 12:50pm UTC](https://discuss.elastic.co/t/open-kibana-dashboard-in-a-new-browser-tab-from-an-application-with-authentication/271336 "2021-04-27T12:50:24Z")
I have a requirement in which we have to provide a link "View logs" in our application and on click of this link we have to open a separate browser tab and show the Kibana dashboard, but we want to avoid login to Kibana … --- ## [Field analyzer ignored on query string regex - 7.10.2](https://discuss.elastic.co/t/field-analyzer-ignored-on-query-string-regex-7-10-2/271375)
**Author:** [@korali](https://discuss.elastic.co/u/korali)\ **Replies:** 0\ **Last updated:** [April 27, 2021, 12:45pm UTC](https://discuss.elastic.co/t/field-analyzer-ignored-on-query-string-regex-7-10-2/271375 "2021-04-27T12:45:39Z")
Hey, I search with query of type query\_string with regex and when I try to run the same code in elasticsearch 7.1.1 and elasticsearch 7.10.2 I get different results Index Mapping&Settings PUT index\_name … --- ## [Parsing audit log SAP](https://discuss.elastic.co/t/parsing-audit-log-sap/271373)
**Author:** [@San9](https://discuss.elastic.co/u/San9)\ **Replies:** 0\ **Last updated:** [April 27, 2021, 12:41pm UTC](https://discuss.elastic.co/t/parsing-audit-log-sap/271373 "2021-04-27T12:41:20Z")
hello team, there was a need to analyze SAP audit logs. A filebeat was installed on the machines to transfer logs from to logstash. Format of audit logs - a file is created every day and data is written in one line (me… --- ## [Failed to start Elasticsearch](https://discuss.elastic.co/t/failed-to-start-elasticsearch/271251)
**Author:** [@Rizky\_Hudha](https://discuss.elastic.co/u/Rizky_Hudha)\ **Replies:** 9\ **Last updated:** [April 27, 2021, 12:11pm UTC](https://discuss.elastic.co/t/failed-to-start-elasticsearch/271251 "2021-04-27T12:11:16Z")
hello, I have a problem regarding elasticsearch, where to start, the error "Failed to start Elasticsearch" always appears, please help to solve my error, thank you Apr 27 02:48:09 bigdata systemd\[1\]: Unit elasticsearch.… --- ## [Big mapping and few fields on index](https://discuss.elastic.co/t/big-mapping-and-few-fields-on-index/270999)
**Author:** [@pereyrdi](https://discuss.elastic.co/u/pereyrdi)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 12:03pm UTC](https://discuss.elastic.co/t/big-mapping-and-few-fields-on-index/270999 "2021-04-27T12:03:06Z")
Hello folks! A question about index template, because Im creating a template for many indexs and not in alls indexs, all fields available in template are used. In some case less than ten, and in template are available a… --- ## [Visualisation Painless script between two characters](https://discuss.elastic.co/t/visualisation-painless-script-between-two-characters/271296)
**Author:** [@georgejolliffe](https://discuss.elastic.co/u/georgejolliffe)\ **Replies:** 7\ **Last updated:** [April 27, 2021, 11:50am UTC](https://discuss.elastic.co/t/visualisation-painless-script-between-two-characters/271296 "2021-04-27T11:50:03Z")
Hi guys, I have this example string in a field called querystring: utm\_medium=inapp&utm\_source=crm&utm\_campaign=newsl&utm\_term=fishandchips I am trying to visualise occurrences of all the possible "utm\_source". I can'… --- ## [Two-node graylog+elasticsearch failover cluster](https://discuss.elastic.co/t/two-node-graylog-elasticsearch-failover-cluster/271355)
**Author:** [@dunhillers](https://discuss.elastic.co/u/dunhillers)\ **Replies:** 5\ **Last updated:** [April 27, 2021, 11:29am UTC](https://discuss.elastic.co/t/two-node-graylog-elasticsearch-failover-cluster/271355 "2021-04-27T11:29:17Z")
Hi, I have deployed graylog+elastic on two servers (Centos 7.8). The goal: to create a failover cluster of two nodes with support for index replication. So that if one of the nodes falls, the indexes continue to be writt… --- ## [Elasticsearch terms aggregation with partition does not honor the “size” value](https://discuss.elastic.co/t/elasticsearch-terms-aggregation-with-partition-does-not-honor-the-size-value/271294)
**Author:** [@sayali\_hinge](https://discuss.elastic.co/u/sayali_hinge)\ **Replies:** 4\ **Last updated:** [April 27, 2021, 11:26am UTC](https://discuss.elastic.co/t/elasticsearch-terms-aggregation-with-partition-does-not-honor-the-size-value/271294 "2021-04-27T11:26:55Z")
I have a nested field in the ES index. I used the cardinality aggregation to get the total number of buckets and then came up with num\_partitions, and size values to fetch the buckets. E.g. the total number of term buck… --- ## [Very often FileSystemException : Operation not permitted](https://discuss.elastic.co/t/very-often-filesystemexception-operation-not-permitted/271079)
**Author:** [@rzrucher](https://discuss.elastic.co/u/rzrucher)\ **Replies:** 12\ **Last updated:** [April 27, 2021, 11:17am UTC](https://discuss.elastic.co/t/very-often-filesystemexception-operation-not-permitted/271079 "2021-04-27T11:17:48Z")
Hello, I've a cluster of elasticsearch 6.1.2 and very often in the elasticsearch log I've : \[2021-04-15T01:03:38,388\]\[WARN \]\[o.e.c.a.s.ShardStateAction\] \[ELK1\] \[events-202104\]\[2\] received shard failed for shard… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=965) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=967)