# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=977 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 978 --- ## [Querying for null values](https://discuss.elastic.co/t/querying-for-null-values/270455)
**Author:** [@Ruth\_Smith](https://discuss.elastic.co/u/Ruth_Smith)\ **Replies:** 0\ **Last updated:** [April 17, 2021, 4:55pm UTC](https://discuss.elastic.co/t/querying-for-null-values/270455 "2021-04-17T16:55:45Z")
I'm new to Elasticsearch, using version 7.1.2. I am setting up an index which contains time-stamped records for users. I would like to find out how to search for all users who are not active (i.e. have no records) ove… --- ## [My\_index/\_stats/indexing (high number of "index\_failed" operations)](https://discuss.elastic.co/t/my-index-stats-indexing-high-number-of-index-failed-operations/270152)
**Author:** [@Logan\_H](https://discuss.elastic.co/u/Logan_H)\ **Replies:** 4\ **Last updated:** [April 17, 2021, 4:16pm UTC](https://discuss.elastic.co/t/my-index-stats-indexing-high-number-of-index-failed-operations/270152 "2021-04-17T16:16:44Z")
I'm supporting a cluster with an index that is seeing a high number in "indexed\_failed" operations as shown by the indexing stats. I'm trying to understand what type of scenarios would cause this counter to increment up.… --- ## [Issue using http\_poller to connect to streaming http api](https://discuss.elastic.co/t/issue-using-http-poller-to-connect-to-streaming-http-api/270434)
**Author:** [@metalshanked](https://discuss.elastic.co/u/metalshanked)\ **Replies:** 4\ **Last updated:** [April 17, 2021, 4:12pm UTC](https://discuss.elastic.co/t/issue-using-http-poller-to-connect-to-streaming-http-api/270434 "2021-04-17T16:12:22Z")
Hi Is there a way to implement a setting similar to Python requests "stream=True" setting in the Logstash http\_poller plugin. I am trying to pull streaming data from Shodan using logstash and get "no upstream" errors. … --- ## [Configuring Kibana darkMode via API Call](https://discuss.elastic.co/t/configuring-kibana-darkmode-via-api-call/270430)
**Author:** [@carlcauchi](https://discuss.elastic.co/u/carlcauchi)\ **Replies:** 2\ **Last updated:** [April 17, 2021, 12:18pm UTC](https://discuss.elastic.co/t/configuring-kibana-darkmode-via-api-call/270430 "2021-04-17T12:18:58Z")
Is there an API call you can do against the Kibana endpoint to setup the darkMode to the default space? The following POST command gives an error status code 409: curl -w '%%{http\_code}\\n' -u "${elasticadmin\_user}:${el… --- ## [Elasticsearch fuzziness global setting](https://discuss.elastic.co/t/elasticsearch-fuzziness-global-setting/270445)
**Author:** [@mohamad\_shalodi](https://discuss.elastic.co/u/mohamad_shalodi)\ **Replies:** 0\ **Last updated:** [April 17, 2021, 10:49am UTC](https://discuss.elastic.co/t/elasticsearch-fuzziness-global-setting/270445 "2021-04-17T10:49:45Z")
Hi Regarding fuzzy in elasticsearch queries, i wanted to ask if i can configure the fuzziness property in "fuzzy" and "query\_string" queries as a global setting for all queries instead of putting it in every query writt… --- ## [Creating App Search with Terraform?](https://discuss.elastic.co/t/creating-app-search-with-terraform/269234)
**Author:** [@Chanonry](https://discuss.elastic.co/u/Chanonry)\ **Replies:** 2\ **Last updated:** [April 17, 2021, 8:53am UTC](https://discuss.elastic.co/t/creating-app-search-with-terraform/269234 "2021-04-17T08:53:41Z")
We are in the early stages of exploring App Search and really like the abstraction on Elasticsearch as it gets up going much faster, the console lets us get a feel for the available parameters and autoscaling promises mu… --- ## [Implementation of ELK stack in large company with huge data](https://discuss.elastic.co/t/implementation-of-elk-stack-in-large-company-with-huge-data/269887)
**Author:** [@xirehat](https://discuss.elastic.co/u/xirehat)\ **Replies:** 9\ **Last updated:** [April 17, 2021, 6:49am UTC](https://discuss.elastic.co/t/implementation-of-elk-stack-in-large-company-with-huge-data/269887 "2021-04-17T06:49:21Z")
Hello We want to change implementation of ELK stack in our company, we having some challenge at this time: Kibana is too slow (sometimes getting response from Elasticsearch take time more than 5 minutes) Our service's … --- ## [Nginx access and error logs show incorroct value in kibana dashboard](https://discuss.elastic.co/t/nginx-access-and-error-logs-show-incorroct-value-in-kibana-dashboard/269453)
**Author:** [@fati](https://discuss.elastic.co/u/fati)\ **Replies:** 22\ **Last updated:** [April 17, 2021, 6:46am UTC](https://discuss.elastic.co/t/nginx-access-and-error-logs-show-incorroct-value-in-kibana-dashboard/269453 "2021-04-17T06:46:42Z")
I am new in ELK. I have ELK stack 7.12.0 (filebeat -\> logstash -\> elasticsearch cluster -\> kibana) I installed filebeat on nginx server and enabled nginx module. these are my configuration files: filebeat.yml fi… --- ## [Why is the logstash time difference of 5 minutes and 43 seconds before January 1, 1901？](https://discuss.elastic.co/t/why-is-the-logstash-time-difference-of-5-minutes-and-43-seconds-before-january-1-1901/270439)
**Author:** [@Fei1](https://discuss.elastic.co/u/Fei1)\ **Replies:** 0\ **Last updated:** [April 17, 2021, 6:39am UTC](https://discuss.elastic.co/t/why-is-the-logstash-time-difference-of-5-minutes-and-43-seconds-before-january-1-1901/270439 "2021-04-17T06:39:27Z")
Hello everyone, I am an ELK beginner, Background: Area: GMT+ 8 Time Zone Linux: CentOS Linux release 8.1.1911 (Core) Database：mysql Ver 15.1 Distrib 10.3.27-MariaDB, for Linux (x86\_64) using readline 5.1 logstash && … --- ## [Querying log.file.path returns no results](https://discuss.elastic.co/t/querying-log-file-path-returns-no-results/269794)
**Author:** [@strshp\_419](https://discuss.elastic.co/u/strshp_419)\ **Replies:** 15\ **Last updated:** [April 17, 2021, 5:19am UTC](https://discuss.elastic.co/t/querying-log-file-path-returns-no-results/269794 "2021-04-17T05:19:24Z")
Elasticsearch, Filebeat, and Kibana versions are 7.12.0 on Windows Server 2016 In Kibana, querying on log.file.path returns no results in certain scenarios. Example: In Kibana, I go to Observability \> Logs and submit … --- ## [Cluster Rerouting - Moving Primaries](https://discuss.elastic.co/t/cluster-rerouting-moving-primaries/270396)
**Author:** [@Eduardo\_Iglesias](https://discuss.elastic.co/u/Eduardo_Iglesias)\ **Replies:** 1\ **Last updated:** [April 17, 2021, 4:32am UTC](https://discuss.elastic.co/t/cluster-rerouting-moving-primaries/270396 "2021-04-17T04:32:15Z")
Hello Community, I'm trying to move my primary from Node-C to Node-D but I'm not able to perform this task. Is there any way to accomplish this? PUT rr\_index2 { "settings": { "number\_of\_shards": 1, "number\_of\_r… --- ## [Can ruby code be a speed bottleneck in logstash config file?](https://discuss.elastic.co/t/can-ruby-code-be-a-speed-bottleneck-in-logstash-config-file/270395)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 4\ **Last updated:** [April 17, 2021, 3:21am UTC](https://discuss.elastic.co/t/can-ruby-code-be-a-speed-bottleneck-in-logstash-config-file/270395 "2021-04-17T03:21:09Z")
I m trying to get as much throughput as possible from my setup. I am using the http input. The client sometimes sends a collection of events instead of a single event for efficiency sake. Here is the relevant thread with… --- ## [How to download data from an elasticsearch cloud index with elasticdump](https://discuss.elastic.co/t/how-to-download-data-from-an-elasticsearch-cloud-index-with-elasticdump/270431)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 9\ **Last updated:** [April 17, 2021, 12:20am UTC](https://discuss.elastic.co/t/how-to-download-data-from-an-elasticsearch-cloud-index-with-elasticdump/270431 "2021-04-17T00:20:51Z")
Hi, I am trying to download the data of an index with the elasticdump tool from the elasticsearch cloud but I get the following error : root@srvefevmmar:~# elasticdump \\ \> --input=https://elastic:secret@72dfe17217744236… --- ## [Problem in importing csv with logstrash](https://discuss.elastic.co/t/problem-in-importing-csv-with-logstrash/270332)
**Author:** [@Fady\_Hany](https://discuss.elastic.co/u/Fady_Hany)\ **Replies:** 8\ **Last updated:** [April 16, 2021, 9:51pm UTC](https://discuss.elastic.co/t/problem-in-importing-csv-with-logstrash/270332 "2021-04-16T21:51:38Z")
i have read a lot of similar problems in this nice forum , but non of them fit my situation my .conf file : input { file { path =\> "E:/test/\*.csv" start\_position =\> "beginning" sincedb\_pat… --- ## [Convert Packetbeat Field Contents to Lowercase](https://discuss.elastic.co/t/convert-packetbeat-field-contents-to-lowercase/270402)
**Author:** [@John\_Collins](https://discuss.elastic.co/u/John_Collins)\ **Replies:** 8\ **Last updated:** [April 16, 2021, 8:31pm UTC](https://discuss.elastic.co/t/convert-packetbeat-field-contents-to-lowercase/270402 "2021-04-16T20:31:58Z")
I am sending DNS queries from a windows DNS server to Logstash via Packetbeat. When I view the contents of the field dns.question.name in Kibana, some entries contain capitalizations. I have tried the following in a Lo… --- ## [How to download data from an elasticsearch index](https://discuss.elastic.co/t/how-to-download-data-from-an-elasticsearch-index/269354)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 12\ **Last updated:** [April 16, 2021, 8:29pm UTC](https://discuss.elastic.co/t/how-to-download-data-from-an-elasticsearch-index/269354 "2021-04-16T20:29:12Z")
Hi, guy's How can i download all the data of an index in elasticsearch? it downloads the CSV but it does not show all the data, I need to download the whole index, please help me? --- ## [Unknown key for a START\_OBJECT in \[runtime\_mappings\]](https://discuss.elastic.co/t/unknown-key-for-a-start-object-in-runtime-mappings/270317)
**Author:** [@plm](https://discuss.elastic.co/u/plm)\ **Replies:** 2\ **Last updated:** [April 16, 2021, 6:20pm UTC](https://discuss.elastic.co/t/unknown-key-for-a-start-object-in-runtime-mappings/270317 "2021-04-16T18:20:05Z")
Hi, I am getting the following error: upload completely sent off: 426 out of 426 bytes \< HTTP/1.1 400 Bad Request \< content-type: application/json; charset=UTF-8 \< content-length: 374 \< { “error” : { “ro… --- ## [Query on dense vectors](https://discuss.elastic.co/t/query-on-dense-vectors/270105)
**Author:** [@Yves\_Benigot](https://discuss.elastic.co/u/Yves_Benigot)\ **Replies:** 2\ **Last updated:** [April 16, 2021, 5:56pm UTC](https://discuss.elastic.co/t/query-on-dense-vectors/270105 "2021-04-16T17:56:54Z")
Is there a way to create a query in Kibana discover on dense vectors ? I found nothing in the documentation. I would be willing to compute the query dense vector outside Kibana and paste it to get my results. Currentl… --- ## [Map IP Address to geolocation and use of the anomaly detector](https://discuss.elastic.co/t/map-ip-address-to-geolocation-and-use-of-the-anomaly-detector/270027)
**Author:** [@Vannessa\_Kemeni](https://discuss.elastic.co/u/Vannessa_Kemeni)\ **Replies:** 4\ **Last updated:** [April 16, 2021, 5:55pm UTC](https://discuss.elastic.co/t/map-ip-address-to-geolocation-and-use-of-the-anomaly-detector/270027 "2021-04-16T17:55:24Z")
Hello everyone, i am using the wazuh software combined with ELK. I get some ip adress from Wazuh and i want to find the corresponding geolocation. How i can do that. Furthermore, i want to use the anomaly detector in or… --- ## [Too many dynamic script compilations within max](https://discuss.elastic.co/t/too-many-dynamic-script-compilations-within-max/270355)
**Author:** [@IYABAO](https://discuss.elastic.co/u/IYABAO)\ **Replies:** 1\ **Last updated:** [April 16, 2021, 4:42pm UTC](https://discuss.elastic.co/t/too-many-dynamic-script-compilations-within-max/270355 "2021-04-16T16:42:10Z")
\[script\] Too many dynamic script compilations within, max: \[75/5m\]; please use indexed, or scripts with parameters instead; this limit can be changed by the \[script.max\_compilations\_rate\] setting How can I get the dynam… --- ## [How to exclude XML & json key-value if key length is greater than 15 char and value length is greater than 100 char](https://discuss.elastic.co/t/how-to-exclude-xml-json-key-value-if-key-length-is-greater-than-15-char-and-value-length-is-greater-than-100-char/270248)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 14\ **Last updated:** [April 16, 2021, 4:19pm UTC](https://discuss.elastic.co/t/how-to-exclude-xml-json-key-value-if-key-length-is-greater-than-15-char-and-value-length-is-greater-than-100-char/270248 "2021-04-16T16:19:18Z")
@Badger I want to exclude XML & json key-value if key length is greater than 15 char and value length is greater than 100 char. Is this possible can you please suggest way for it. --- ## [How to convert extract month from date](https://discuss.elastic.co/t/how-to-convert-extract-month-from-date/270035)
**Author:** [@Pallavibhushan](https://discuss.elastic.co/u/Pallavibhushan)\ **Replies:** 5\ **Last updated:** [April 16, 2021, 2:35pm UTC](https://discuss.elastic.co/t/how-to-convert-extract-month-from-date/270035 "2021-04-16T14:35:16Z")
Hi, I have below date format . First\_date : Feb-21 (MMM-yy) Second\_date: 12/02/2021 (MM/dd/yyyy) first, I want new field like below: from first date I need month . so output should be first\_date\_month : 02 second … --- ## [Date parse failure](https://discuss.elastic.co/t/date-parse-failure/270276)
**Author:** [@Wilfried](https://discuss.elastic.co/u/Wilfried)\ **Replies:** 2\ **Last updated:** [April 16, 2021, 1:42pm UTC](https://discuss.elastic.co/t/date-parse-failure/270276 "2021-04-16T13:42:12Z")
Hello, I struggle to understand why my date matching is failing. We trying to build a reporting application using elasticsearch for our Storage. I've that kind of data in an XML: \ \ \0\ **Author:** [@abhishek\_s1](https://discuss.elastic.co/u/abhishek_s1)\ **Replies:** 5\ **Last updated:** [April 16, 2021, 11:47am UTC](https://discuss.elastic.co/t/help-me-writing-watcher-query/270103 "2021-04-16T11:47:39Z") Hello, We are defining an activity of user to be suspicious if he logs in after very long period (1 month). So, I need to find if there exists a log entry or request with some username whose last request was \>= 1 month… --- ## [Logstash data load error for a different format data](https://discuss.elastic.co/t/logstash-data-load-error-for-a-different-format-data/270375)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 0\ **Last updated:** [April 16, 2021, 10:58am UTC](https://discuss.elastic.co/t/logstash-data-load-error-for-a-different-format-data/270375 "2021-04-16T10:58:58Z")
Hi All, We are trying to ingest few data into logstash, the data is pretty different like mentioned below, How do i map the collection\_time with 1618556220 and d\_check to 1 I gave a split filter it didnt work. FYI. … --- ## [Provided Grok patterns do not match data in the input](https://discuss.elastic.co/t/provided-grok-patterns-do-not-match-data-in-the-input/270265)
**Author:** [@Cris\_R](https://discuss.elastic.co/u/Cris_R)\ **Replies:** 4\ **Last updated:** [April 16, 2021, 6:57am UTC](https://discuss.elastic.co/t/provided-grok-patterns-do-not-match-data-in-the-input/270265 "2021-04-16T06:57:17Z")
Hi, Trying to create my own grok patterns, I'm using the following with the Grok Debugger : Sample data : \[ 4812 6032\]\[15 Feb 18:23:15\]\[LdManInit\] Loading Library in Load mode Grok Pattern : %{IDLOG:whom} %{TIMEST:… --- ## [Vlookup type of thing](https://discuss.elastic.co/t/vlookup-type-of-thing/270298)
**Author:** [@Elitlogik](https://discuss.elastic.co/u/Elitlogik)\ **Replies:** 3\ **Last updated:** [April 16, 2021, 6:01am UTC](https://discuss.elastic.co/t/vlookup-type-of-thing/270298 "2021-04-16T06:01:39Z")
I generate a table of MAC addresses in Kibana. However I’d like to translate the MAC address into a readable name. The MAC, Readable name table is and will forever be static and have and will forever have 50 rows. What’… --- ## [I have a query regarding dense\_vector in elastic search](https://discuss.elastic.co/t/i-have-a-query-regarding-dense-vector-in-elastic-search/270327)
**Author:** [@Rahul\_Singh](https://discuss.elastic.co/u/Rahul_Singh)\ **Replies:** 0\ **Last updated:** [April 16, 2021, 5:55am UTC](https://discuss.elastic.co/t/i-have-a-query-regarding-dense-vector-in-elastic-search/270327 "2021-04-16T05:55:14Z")
Hi, I am using elastic search using python, i am creating dense\_vector in mapping and then trying to add the feild via python a list of float value e.g - \[1.02,2,1.01..\] and am unable to ad it. the error says cant chan… --- ## [Upgrarding from logstash 5.6.16 to 6.8 results in errors for logstash tcp input plugin](https://discuss.elastic.co/t/upgrarding-from-logstash-5-6-16-to-6-8-results-in-errors-for-logstash-tcp-input-plugin/270316)
**Author:** [@mchoudhary](https://discuss.elastic.co/u/mchoudhary)\ **Replies:** 0\ **Last updated:** [April 16, 2021, 1:19am UTC](https://discuss.elastic.co/t/upgrarding-from-logstash-5-6-16-to-6-8-results-in-errors-for-logstash-tcp-input-plugin/270316 "2021-04-16T01:19:43Z")
After upgrading the logstash version from 5.6.16 to 6.8, the logstash tcp plugin from 4.2.2 to 5.2.2 After upgrade, we do see the following errors in the logstash logs: \[2021-04-16T01:14:50,392\]\[ERROR\]\[logstash.inputs.… --- ## [Kibana unable to query index data from ES](https://discuss.elastic.co/t/kibana-unable-to-query-index-data-from-es/270134)
**Author:** [@GregoryBrown](https://discuss.elastic.co/u/GregoryBrown)\ **Replies:** 10\ **Last updated:** [April 16, 2021, 1:14am UTC](https://discuss.elastic.co/t/kibana-unable-to-query-index-data-from-es/270134 "2021-04-16T01:14:36Z")
I am able to upload the following data into my ES Cluster, and have an index template apply to it. However the default search of kibana (using an index pattern) doesn't query the data. Index Template that gets applied t… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=976) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=978)