# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=967 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 968 --- ## [Sort aggregation based on TopHits (ie top 10) average score](https://discuss.elastic.co/t/sort-aggregation-based-on-tophits-ie-top-10-average-score/271358)
**Author:** [@JF2018](https://discuss.elastic.co/u/JF2018)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 10:31am UTC](https://discuss.elastic.co/t/sort-aggregation-based-on-tophits-ie-top-10-average-score/271358 "2021-04-27T10:31:02Z")
Hi I wish to be able to sort my buckets from a termAggregation, based on the scores of the top N documents in each bucket. I know how to sort by min/max/avg/sum score for all documents in a bucket (See example I furthe… --- ## [New warm nodes are getting filled fast](https://discuss.elastic.co/t/new-warm-nodes-are-getting-filled-fast/269417)
**Author:** [@prajwalgmpp](https://discuss.elastic.co/u/prajwalgmpp)\ **Replies:** 12\ **Last updated:** [April 27, 2021, 9:35am UTC](https://discuss.elastic.co/t/new-warm-nodes-are-getting-filled-fast/269417 "2021-04-27T09:35:28Z")
Hi All, In the beginning, we had 4 data nodes. Two were ilm designated hot nodes and the other two were warm nodes. Newly created indices would be in the hot nodes under the hot phase and after 4 weeks of retention, wou… --- ## [Change Kibana highlighter](https://discuss.elastic.co/t/change-kibana-highlighter/271344)
**Author:** [@CaptainAmericaFan2](https://discuss.elastic.co/u/CaptainAmericaFan2)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 9:32am UTC](https://discuss.elastic.co/t/change-kibana-highlighter/271344 "2021-04-27T09:32:10Z")
Is it possible to configure Kibana to use fast vector highlighter in its queries instead of the default? I'm running version 7.8 Thanks! --- ## [Index data into Elasticsearch without setting trigger on database tables](https://discuss.elastic.co/t/index-data-into-elasticsearch-without-setting-trigger-on-database-tables/270821)
**Author:** [@e-fo](https://discuss.elastic.co/u/e-fo)\ **Replies:** 3\ **Last updated:** [April 27, 2021, 8:49am UTC](https://discuss.elastic.co/t/index-data-into-elasticsearch-without-setting-trigger-on-database-tables/270821 "2021-04-27T08:49:50Z")
Hi, Our company is a mobile game publisher, we need analyze our published games data from their database and we needs use elasticsearch and kibana for some analysis but the game developers who work with us only give us … --- ## [How to write compound queries on kibana to search multi records of logs](https://discuss.elastic.co/t/how-to-write-compound-queries-on-kibana-to-search-multi-records-of-logs/269812)
**Author:** [@ShashikanthKomandoor](https://discuss.elastic.co/u/ShashikanthKomandoor)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 8:40am UTC](https://discuss.elastic.co/t/how-to-write-compound-queries-on-kibana-to-search-multi-records-of-logs/269812 "2021-04-27T08:40:01Z")
Hi team, I am currently sending my MTAs' /var/log/maillog files to a centralized Elastic Stack Log Analyser. I am using Elastic Stack version 7.X. I have got a requirement to search set of message ids which look like m… --- ## [If else condition in ES query](https://discuss.elastic.co/t/if-else-condition-in-es-query/271319)
**Author:** [@Pallavibhushan](https://discuss.elastic.co/u/Pallavibhushan)\ **Replies:** 4\ **Last updated:** [April 27, 2021, 8:35am UTC](https://discuss.elastic.co/t/if-else-condition-in-es-query/271319 "2021-04-27T08:35:24Z")
Hi, I am trying to write a query for below data: sample data: { "\_index" : "target\_data", "\_type" : "\_doc", "\_id" : "Training\_2020", "\_score" : 1.0, "\_source" : { "year" : "2020", "date\_epoch" : 1577817000000, … --- ## [Discover table - multi line field](https://discuss.elastic.co/t/discover-table-multi-line-field/271248)
**Author:** [@amircogan](https://discuss.elastic.co/u/amircogan)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 8:31am UTC](https://discuss.elastic.co/t/discover-table-multi-line-field/271248 "2021-04-27T08:31:14Z")
Hi there, I have a string field which is multiline, say 20 lines, and I want to see all of them in the discover table, but it get truncated and I see only few lines. I tried field type String, and Truncated string with… --- ## [Transform usage - How to push event for all specific terms even if one of them is missing](https://discuss.elastic.co/t/transform-usage-how-to-push-event-for-all-specific-terms-even-if-one-of-them-is-missing/271326)
**Author:** [@vigneshr35](https://discuss.elastic.co/u/vigneshr35)\ **Replies:** 0\ **Last updated:** [April 27, 2021, 7:20am UTC](https://discuss.elastic.co/t/transform-usage-how-to-push-event-for-all-specific-terms-even-if-one-of-them-is-missing/271326 "2021-04-27T07:20:50Z")
Hi Team, I have a scenario. I have a transform created that groups all events of each day from the source index into 3 different status - Completed, Terminated and Retry. For example, if for 25th Apr 2021 we have Comple… --- ## [Logstash configuration best practices](https://discuss.elastic.co/t/logstash-configuration-best-practices/271051)
**Author:** [@Dzious](https://discuss.elastic.co/u/Dzious)\ **Replies:** 3\ **Last updated:** [April 27, 2021, 7:09am UTC](https://discuss.elastic.co/t/logstash-configuration-best-practices/271051 "2021-04-27T07:09:17Z")
Hi everyone, I would like to know a bit more about logstash best practices I need to setup a monitoring system for about 20 servers at the moment and more to come in the future. Onto these servers, i'll have multiple … --- ## [.kibana index template](https://discuss.elastic.co/t/kibana-index-template/271096)
**Author:** [@bentleg1](https://discuss.elastic.co/u/bentleg1)\ **Replies:** 4\ **Last updated:** [April 27, 2021, 7:08am UTC](https://discuss.elastic.co/t/kibana-index-template/271096 "2021-04-27T07:08:55Z")
Hello. I want to add several replicas for system .kibana index. I have created template. PUT \_template/kibana { "index\_patterns": ".kibana\*", "settings": { "number\_of\_replicas": "5" } } … --- ## [Shard allocation on cluster](https://discuss.elastic.co/t/shard-allocation-on-cluster/271323)
**Author:** [@bentleg1](https://discuss.elastic.co/u/bentleg1)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 6:59am UTC](https://discuss.elastic.co/t/shard-allocation-on-cluster/271323 "2021-04-27T06:59:17Z")
Hi to all. Imagine that we have 4 data nodes. N1 and N2 placed on main data center and N3 and N4 placed in backup data center. How to configure shard allocation to place all primary shards on N1 and N2 nodes and all re… --- ## [Grok: tag\_on\_failure is not working and has no effect](https://discuss.elastic.co/t/grok-tag-on-failure-is-not-working-and-has-no-effect/271320)
**Author:** [@meerlicht](https://discuss.elastic.co/u/meerlicht)\ **Replies:** 0\ **Last updated:** [April 27, 2021, 6:40am UTC](https://discuss.elastic.co/t/grok-tag-on-failure-is-not-working-and-has-no-effect/271320 "2021-04-27T06:40:34Z")
Hi there, I can't get my head around why this snippet successfully groks the message, but neither sets nor removes the tags. I've tried to set a custom tag and also removing all tags (as in the current snippet) grok { … --- ## [Using pre-defined grok patterns](https://discuss.elastic.co/t/using-pre-defined-grok-patterns/271216)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 4\ **Last updated:** [April 27, 2021, 4:48am UTC](https://discuss.elastic.co/t/using-pre-defined-grok-patterns/271216 "2021-04-27T04:48:21Z")
Hi, community. I just discovered that logstash has pre-defined grok patterns, for firewalls, for example (here logstash-patterns-core/patterns at master · logstash-plugins/logstash-patterns-core · GitHub). But I can't u… --- ## [Elasticsearch error license is not available](https://discuss.elastic.co/t/elasticsearch-error-license-is-not-available/271039)
**Author:** [@charles97](https://discuss.elastic.co/u/charles97)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 6:08am UTC](https://discuss.elastic.co/t/elasticsearch-error-license-is-not-available/271039 "2021-04-27T06:08:34Z")
es: 7.12 os:CentOS7 java : java-1.8.0-openjdk.x86\_64 (/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.282.b08-1.el7\_9.x86\_64/jre/bin/java) My cluster used to had 2 node, this node as : master another node as : data-1. I deci… --- ## [TSVB - Gauage - Bucket Script 오류 문의 (Top Hit)](https://discuss.elastic.co/t/tsvb-gauage-bucket-script-top-hit/268296)
**Author:** [@KANG](https://discuss.elastic.co/u/KANG)\ **Replies:** 4\ **Last updated:** [April 27, 2021, 5:10am UTC](https://discuss.elastic.co/t/tsvb-gauage-bucket-script-top-hit/268296 "2021-04-27T05:10:31Z")
안녕하세요. Gauage를 활용하여 메모리 사용률을 Kibana에서 시각화 하려고합니다. TSVB 활용 중 오류가 발생하여 해결방법에 대해 문의드립니다. \[구현내용\] 메모리 사용률(%) 메모리 사용량(memutilization) / 전체 메모리량(totalmem) \* 100 \[설정내용\] TSVB - Gauage - Metris 1번 Aggregation : Top Hit - t… --- ## [Fetch Agent Status](https://discuss.elastic.co/t/fetch-agent-status/271313)
**Author:** [@Sathish22](https://discuss.elastic.co/u/Sathish22)\ **Replies:** 4\ **Last updated:** [April 27, 2021, 5:04am UTC](https://discuss.elastic.co/t/fetch-agent-status/271313 "2021-04-27T05:04:49Z")
Dear Team, Currently, we have a requirement to fetch the agent status from all servers, is there any way to fetch the agent status from all servers (Windows & Linux) and save it in elasticsearch. Please help me.!!! Th… --- ## [How to speed up the segment merging at night?](https://discuss.elastic.co/t/how-to-speed-up-the-segment-merging-at-night/271267)
**Author:** [@wangxr1985](https://discuss.elastic.co/u/wangxr1985)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 3:22am UTC](https://discuss.elastic.co/t/how-to-speed-up-the-segment-merging-at-night/271267 "2021-04-27T03:22:16Z")
The ES version is 7.11.1 I use ilm to manage my log indices hot phase: rollover warm phase (12 hours from rollover): forcemerge、read only、data allocation cold phase (5 days from rollover): freeze delete phase(10 day… --- ## [Unable to create a transform that uses "min"](https://discuss.elastic.co/t/unable-to-create-a-transform-that-uses-min/271309)
**Author:** [@Sam\_Critchley](https://discuss.elastic.co/u/Sam_Critchley)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 3:12am UTC](https://discuss.elastic.co/t/unable-to-create-a-transform-that-uses-min/271309 "2021-04-27T03:12:00Z")
I'm trying to create a transform that aggregates on min of a date field. This field is mapped in the index like so: "event\_time": { "type": "date", "format": "yyyy-MM-dd HH:mm:ss.nnnnnn" }, I… --- ## [Kibana performance tuning](https://discuss.elastic.co/t/kibana-performance-tuning/271152)
**Author:** [@ARDiver86](https://discuss.elastic.co/u/ARDiver86)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 2:20am UTC](https://discuss.elastic.co/t/kibana-performance-tuning/271152 "2021-04-27T02:20:03Z")
We are having pretty bad performance in our new environment we setup with one Kibana server and two Elasticsearch nodes. We followed the best practices and adjusted the heap size to 31GB for both values, disabled swappin… --- ## [Logs disappeared after running applications for a few hours - ELK stack](https://discuss.elastic.co/t/logs-disappeared-after-running-applications-for-a-few-hours-elk-stack/271050)
**Author:** [@District](https://discuss.elastic.co/u/District)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 1:50am UTC](https://discuss.elastic.co/t/logs-disappeared-after-running-applications-for-a-few-hours-elk-stack/271050 "2021-04-27T01:50:39Z")
Hi, we are using ELK stack for monitoring our applications. However, it's been quite weird to us that logs kept disappearing after a few hours in kibana. The pattern was like: Deployed applications -\> logs appeared in … --- ## [Replication of shards with more nodes vs parallel cluster](https://discuss.elastic.co/t/replication-of-shards-with-more-nodes-vs-parallel-cluster/271035)
**Author:** [@nchalise](https://discuss.elastic.co/u/nchalise)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 1:35am UTC](https://discuss.elastic.co/t/replication-of-shards-with-more-nodes-vs-parallel-cluster/271035 "2021-04-27T01:35:36Z")
To reduce/mitigate downtime which approach is better and why? doubling the data/client nodes and having replication on the shards OR is it worth considering parallel clusters with a load balancer on the client nodes. Pl… --- ## [Ubuntu system log parsing](https://discuss.elastic.co/t/ubuntu-system-log-parsing/271293)
**Author:** [@Guncixx](https://discuss.elastic.co/u/Guncixx)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 1:30am UTC](https://discuss.elastic.co/t/ubuntu-system-log-parsing/271293 "2021-04-27T01:30:35Z")
Hi, I’m new to Elastic and trying to explore it’s security capabilities. For the testing purpose I set up some VMs and installed elastic agent to collect logs. I then tried to generate some successful and some unsuccess… --- ## [Deleted field, result is successfull, but field is still there](https://discuss.elastic.co/t/deleted-field-result-is-successfull-but-field-is-still-there/271287)
**Author:** [@NLSVTN](https://discuss.elastic.co/u/NLSVTN)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 12:53am UTC](https://discuss.elastic.co/t/deleted-field-result-is-successfull-but-field-is-still-there/271287 "2021-04-27T00:53:45Z")
Hi, I am using Kibana for interacting with my indices. I have a field in \_source: '\_nisc\_AC' which I am trying to delete in the following way: POST grch38\_test\_\_wes\_\_grch38/\_update\_by\_query?conflicts=proceed { "scr… --- ## [Pie chart w/ data from two diff indexes](https://discuss.elastic.co/t/pie-chart-w-data-from-two-diff-indexes/271199)
**Author:** [@azulgrana](https://discuss.elastic.co/u/azulgrana)\ **Replies:** 4\ **Last updated:** [April 26, 2021, 9:13pm UTC](https://discuss.elastic.co/t/pie-chart-w-data-from-two-diff-indexes/271199 "2021-04-26T21:13:49Z")
Hi team, I have a use case where I need to graph on a single pie chart data from two different indexes. The feel that I need chart exists on both indexes and has the same name. So my question is, is it possible to creat… --- ## [Methods to loadbalance on logstash from Input data stream to Filter section](https://discuss.elastic.co/t/methods-to-loadbalance-on-logstash-from-input-data-stream-to-filter-section/271292)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 2\ **Last updated:** [April 26, 2021, 9:09pm UTC](https://discuss.elastic.co/t/methods-to-loadbalance-on-logstash-from-input-data-stream-to-filter-section/271292 "2021-04-26T21:09:13Z")
I'm looking for methods to loadbalance on logstash or elasticsearch . The requirement is that i have decently large log files with thousands of lines, while logstash is perfectly processing the log file as expected, i wa… --- ## [Json filter problème de brackets](https://discuss.elastic.co/t/json-filter-probleme-de-brackets/271024)
**Author:** [@Yahya\_Bouzoubaa](https://discuss.elastic.co/u/Yahya_Bouzoubaa)\ **Replies:** 12\ **Last updated:** [April 26, 2021, 8:27pm UTC](https://discuss.elastic.co/t/json-filter-probleme-de-brackets/271024 "2021-04-26T20:27:10Z")
Bonjour, J'ai une question en lien avec le parsing d'un JSON à l'aide du filtre JSON. J'ai appliqué le filter JSON pour parser un bout de message de type JSON. Le JSON en question est de ce format : { " ResponseHead… --- ## [Replace @timestamp with actual timestamp from log file with two different formats](https://discuss.elastic.co/t/replace-timestamp-with-actual-timestamp-from-log-file-with-two-different-formats/271264)
**Author:** [@kommineni24](https://discuss.elastic.co/u/kommineni24)\ **Replies:** 5\ **Last updated:** [April 26, 2021, 8:25pm UTC](https://discuss.elastic.co/t/replace-timestamp-with-actual-timestamp-from-log-file-with-two-different-formats/271264 "2021-04-26T20:25:38Z")
Hi, I am trying to index my mail-relay log files to Elastic search. All the log entries are being indexed into a field named message . @timestamp field shows the time the entry was indexed and not the timestamp from the… --- ## [App-Search vs Ent-Search difference in filter](https://discuss.elastic.co/t/app-search-vs-ent-search-difference-in-filter/254019)
**Author:** [@Rudolf1](https://discuss.elastic.co/u/Rudolf1)\ **Replies:** 3\ **Last updated:** [April 26, 2021, 5:34pm UTC](https://discuss.elastic.co/t/app-search-vs-ent-search-difference-in-filter/254019 "2021-04-26T17:34:45Z")
Hello, I'm a newbie in those topics, and really need to understand why the behavior in App-Search and Ent-Search is different in the case of empty string used in the filter. Example: When I use the filter in the query… --- ## [Improving fingerprint filter performance](https://discuss.elastic.co/t/improving-fingerprint-filter-performance/270573)
**Author:** [@vasu01](https://discuss.elastic.co/u/vasu01)\ **Replies:** 4\ **Last updated:** [April 26, 2021, 5:12pm UTC](https://discuss.elastic.co/t/improving-fingerprint-filter-performance/270573 "2021-04-26T17:12:23Z")
We are using the logstash fingerprint filter to avoid duplicate data in elasticsearch. But the data ingestion is taking more time. For Example - A file having ~15000-20000 rows takes approx 2~3 hours to load. Only two f… --- ## [Event correlation query not generating detection alerts](https://discuss.elastic.co/t/event-correlation-query-not-generating-detection-alerts/271224)
**Author:** [@Nil\_Battey\_Sannata](https://discuss.elastic.co/u/Nil_Battey_Sannata)\ **Replies:** 3\ **Last updated:** [April 26, 2021, 4:10pm UTC](https://discuss.elastic.co/t/event-correlation-query-not-generating-detection-alerts/271224 "2021-04-26T16:10:43Z")
This is prebuilt detection rule with event correlation. If I am executing query manually then it showing the correct hits. But this is not generating any alerts. Same story with every rule with event correlation.… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=966) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=968)