# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=987 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 988 --- ## [Compare Two Indexes](https://discuss.elastic.co/t/compare-two-indexes/269254)
**Author:** [@Dinesh\_Sharma](https://discuss.elastic.co/u/Dinesh_Sharma)\ **Replies:** 16\ **Last updated:** [April 8, 2021, 7:31am UTC](https://discuss.elastic.co/t/compare-two-indexes/269254 "2021-04-08T07:31:12Z")
Hi, I have one document in one index and other document in other index. Now I want to compare the fields of these two documents of different indexes. Is it possible to do it, not sure did some couldn't find any satisfac… --- ## [Aggregation on substring of a specific field](https://discuss.elastic.co/t/aggregation-on-substring-of-a-specific-field/269412)
**Author:** [@111457](https://discuss.elastic.co/u/111457)\ **Replies:** 4\ **Last updated:** [April 8, 2021, 6:49am UTC](https://discuss.elastic.co/t/aggregation-on-substring-of-a-specific-field/269412 "2021-04-08T06:49:01Z")
Hi. I'm trying to aggregate on part of strings of a given field. For example, I have 5 documents in an index "Petroglyph". Each documents includes a field called "Site". In "Site", input values follow pattern like 'si… --- ## [One ES Data node's CPU jumps to 90%+ suddenly while in production](https://discuss.elastic.co/t/one-es-data-nodes-cpu-jumps-to-90-suddenly-while-in-production/267610)
**Author:** [@zxx\_bd](https://discuss.elastic.co/u/zxx_bd)\ **Replies:** 6\ **Last updated:** [April 8, 2021, 6:13am UTC](https://discuss.elastic.co/t/one-es-data-nodes-cpu-jumps-to-90-suddenly-while-in-production/267610 "2021-04-08T06:13:20Z")
Hi, guys, we are running an ES cluster with 7.1.1 in production, and everything looks good while one day, a data node's CPU jumps to 90%+ suddenly, and all of the queries related to the index on that nodes were time out… --- ## [Multiple highlight on one field](https://discuss.elastic.co/t/multiple-highlight-on-one-field/269549)
**Author:** [@futorio](https://discuss.elastic.co/u/futorio)\ **Replies:** 0\ **Last updated:** [April 8, 2021, 5:38am UTC](https://discuss.elastic.co/t/multiple-highlight-on-one-field/269549 "2021-04-08T05:38:45Z")
Hello, i need to use 2 highlights on one field. For example: "query": {...}, "highlight": { "fields": { "text": \[ "highlight\_1": {...}, "highlight\_2": {...} … --- ## [Is scroll id always same for one user](https://discuss.elastic.co/t/is-scroll-id-always-same-for-one-user/269517)
**Author:** [@IliaIsakhin](https://discuss.elastic.co/u/IliaIsakhin)\ **Replies:** 5\ **Last updated:** [April 8, 2021, 5:33am UTC](https://discuss.elastic.co/t/is-scroll-id-always-same-for-one-user/269517 "2021-04-08T05:33:52Z")
For example, I have an Elasticsearch cluster with a single user and two different applications that want to retrieve all documents from the index to process them. Both applications are using search with scroll mechanism … --- ## [Conditionally run aggregation](https://discuss.elastic.co/t/conditionally-run-aggregation/269546)
**Author:** [@bhimawan](https://discuss.elastic.co/u/bhimawan)\ **Replies:** 0\ **Last updated:** [April 8, 2021, 5:04am UTC](https://discuss.elastic.co/t/conditionally-run-aggregation/269546 "2021-04-08T05:04:26Z")
I'm wondering if there's any way to run aggregation conditionally. So I have a \_search request that have both query and aggs param. So the aggs is scoped by the query param. Now if the query return no hits, is there a … --- ## [Trying to setup logstash with a github repo](https://discuss.elastic.co/t/trying-to-setup-logstash-with-a-github-repo/269541)
**Author:** [@anon65617794](https://discuss.elastic.co/u/anon65617794)\ **Replies:** 5\ **Last updated:** [April 8, 2021, 3:37am UTC](https://discuss.elastic.co/t/trying-to-setup-logstash-with-a-github-repo/269541 "2021-04-08T03:37:44Z")
I'm using this github repo \*as start point. Started elasticsearch,kibana from a docker-compose file and currently trying to add logstash -f logstash.conf to work in command prompt but reaches a error message. = GitHub … --- ## [Can Logstash read multiple text files , store config data available in first lines and add it to all other lines](https://discuss.elastic.co/t/can-logstash-read-multiple-text-files-store-config-data-available-in-first-lines-and-add-it-to-all-other-lines/267830)
**Author:** [@Svett](https://discuss.elastic.co/u/Svett)\ **Replies:** 2\ **Last updated:** [April 8, 2021, 12:00am UTC](https://discuss.elastic.co/t/can-logstash-read-multiple-text-files-store-config-data-available-in-first-lines-and-add-it-to-all-other-lines/267830 "2021-04-08T00:00:44Z")
Hi, I have multiple log files that I want to load in Kibana. Each file has at the beginning few lines with configuration information, that has to be added to each log line from this file. These lines look like that: … --- ## [The following indices are missing the timestamp override field "event.ingested"](https://discuss.elastic.co/t/the-following-indices-are-missing-the-timestamp-override-field-event-ingested/269532)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 0\ **Last updated:** [April 7, 2021, 10:46pm UTC](https://discuss.elastic.co/t/the-following-indices-are-missing-the-timestamp-override-field-event-ingested/269532 "2021-04-07T22:46:31Z")
How do I fix this? --- ## [Elasticsearch 7.9.3 fail to start](https://discuss.elastic.co/t/elasticsearch-7-9-3-fail-to-start/269463)
**Author:** [@FOMihai](https://discuss.elastic.co/u/FOMihai)\ **Replies:** 1\ **Last updated:** [April 7, 2021, 10:07pm UTC](https://discuss.elastic.co/t/elasticsearch-7-9-3-fail-to-start/269463 "2021-04-07T22:07:26Z")
Hello, I'm trying to install Elasticsearch 7.9.3 but when I'm trying to start elasticsearch I get this error: \[2021-04-07T14:31:59,501\]\[ERROR\]\[o.e.b.Bootstrap \] \[node-inopvdn23i\] Exception java.lang.IllegalSta… --- ## [Monitor queries ES and ECE](https://discuss.elastic.co/t/monitor-queries-es-and-ece/269505)
**Author:** [@usrigp](https://discuss.elastic.co/u/usrigp)\ **Replies:** 1\ **Last updated:** [April 7, 2021, 9:59pm UTC](https://discuss.elastic.co/t/monitor-queries-es-and-ece/269505 "2021-04-07T21:59:25Z")
Hi, We need to monitor queries, to get how many requests was made by users (not necesary slowlog queries) and which are these requests. Is it possible (by user)? In ECE we use proxy logs to get information about client… --- ## [Elastic - Logstash: Copy data from one field to another field within same index - both the fields are nested](https://discuss.elastic.co/t/elastic-logstash-copy-data-from-one-field-to-another-field-within-same-index-both-the-fields-are-nested/269529)
**Author:** [@Siri2](https://discuss.elastic.co/u/Siri2)\ **Replies:** 0\ **Last updated:** [April 7, 2021, 9:49pm UTC](https://discuss.elastic.co/t/elastic-logstash-copy-data-from-one-field-to-another-field-within-same-index-both-the-fields-are-nested/269529 "2021-04-07T21:49:10Z")
Hi, I am trying to copy data from one field to another field within the same index using filter -\> mutate -\> copy I want to mention that both the fields are nested. When I run the script it doesn't show me if it copied… --- ## [Kibana saved objects](https://discuss.elastic.co/t/kibana-saved-objects/269418)
**Author:** [@Mohith\_Vegi](https://discuss.elastic.co/u/Mohith_Vegi)\ **Replies:** 3\ **Last updated:** [April 7, 2021, 9:06pm UTC](https://discuss.elastic.co/t/kibana-saved-objects/269418 "2021-04-07T21:06:12Z")
Hi, For the kibana saved objects API , when we run the curl command for exporting saved objects, where does the json file be stored. curl -X POST "localhost:5601/api/saved\_objects/\_export -H 'kbn-xsrf: true' -H 'Conten… --- ## [Facing issue with occasional slow queries on 5 node ES cluster](https://discuss.elastic.co/t/facing-issue-with-occasional-slow-queries-on-5-node-es-cluster/269228)
**Author:** [@Vikash](https://discuss.elastic.co/u/Vikash)\ **Replies:** 11\ **Last updated:** [April 7, 2021, 9:04pm UTC](https://discuss.elastic.co/t/facing-issue-with-occasional-slow-queries-on-5-node-es-cluster/269228 "2021-04-07T21:04:57Z")
I have a 5 node ES cluster and it's performing well on an average but sometime 0.5% of the queries are taking 1 sec to respond. I have tried all the possible solutions/suggestions, not sure what is causing issue. Overvi… --- ## [Getting NodeClosedException while running the ES 6.8.14 through the systemctl start elasticsearch.service custom made for the zip installable ES](https://discuss.elastic.co/t/getting-nodeclosedexception-while-running-the-es-6-8-14-through-the-systemctl-start-elasticsearch-service-custom-made-for-the-zip-installable-es/269399)
**Author:** [@Amit\_raj\_khurdhara](https://discuss.elastic.co/u/Amit_raj_khurdhara)\ **Replies:** 5\ **Last updated:** [April 7, 2021, 9:01pm UTC](https://discuss.elastic.co/t/getting-nodeclosedexception-while-running-the-es-6-8-14-through-the-systemctl-start-elasticsearch-service-custom-made-for-the-zip-installable-es/269399 "2021-04-07T21:01:35Z")
\[2021-04-06T17:45:52,825\]\[WARN \]\[o.e.x.m.e.l.LocalExporter\] \[FN06jOJ\] unexpected error while indexing monitoring document org.elasticsearch.xpack.monitoring.exporter.ExportException: NodeClosedException\[node closed {FN0… --- ## [Remove duplicates based on the timestamp and another field](https://discuss.elastic.co/t/remove-duplicates-based-on-the-timestamp-and-another-field/269519)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [April 7, 2021, 8:05pm UTC](https://discuss.elastic.co/t/remove-duplicates-based-on-the-timestamp-and-another-field/269519 "2021-04-07T20:05:22Z")
What method do you recommend to remove duplicates in an index, based on @timestamp and a field? somthing like this: if @timestamp and interface\_name are equal, delete one of the document --- ## [Anomaly detection job failing to pull any data in](https://discuss.elastic.co/t/anomaly-detection-job-failing-to-pull-any-data-in/268940)
**Author:** [@timothyhutz](https://discuss.elastic.co/u/timothyhutz)\ **Replies:** 3\ **Last updated:** [April 7, 2021, 7:38pm UTC](https://discuss.elastic.co/t/anomaly-detection-job-failing-to-pull-any-data-in/268940 "2021-04-07T19:38:19Z")
So our ingestion mechanism for ingesting data had stopped for an hour, now my machine learning jobs refuse to pull in any new documents. I have verified it can see new latest document dates but just doesn't pull them in … --- ## [System fields for CPU load](https://discuss.elastic.co/t/system-fields-for-cpu-load/269485)
**Author:** [@hohooss](https://discuss.elastic.co/u/hohooss)\ **Replies:** 2\ **Last updated:** [April 7, 2021, 7:29pm UTC](https://discuss.elastic.co/t/system-fields-for-cpu-load/269485 "2021-04-07T19:29:50Z")
I have the following linux server specs and get the CPU load from two different fields, as shown further below: # lscpu Architecture: x86\_64 CPU op-mode(s): 32-bit, 64-bit Byte Order: Littl… --- ## [Where data nodes stored in ES Kuberenetes Statefulset](https://discuss.elastic.co/t/where-data-nodes-stored-in-es-kuberenetes-statefulset/269516)
**Author:** [@MdRashid](https://discuss.elastic.co/u/MdRashid)\ **Replies:** 0\ **Last updated:** [April 7, 2021, 7:28pm UTC](https://discuss.elastic.co/t/where-data-nodes-stored-in-es-kuberenetes-statefulset/269516 "2021-04-07T19:28:27Z")
Hi All, I have deploy Elasticsearch statefulset in my ubuntu terminal after that i check pod of elasticsearch and found that there is not folder with name of /usr/share/elasticsearch/data in ES pod. When i check logs it… --- ## [Check if string is in field](https://discuss.elastic.co/t/check-if-string-is-in-field/269479)
**Author:** [@Automation\_Scripts](https://discuss.elastic.co/u/Automation_Scripts)\ **Replies:** 9\ **Last updated:** [April 7, 2021, 7:20pm UTC](https://discuss.elastic.co/t/check-if-string-is-in-field/269479 "2021-04-07T19:20:18Z")
Hi, I need some help checking if a string is contained within the value of a field. my json has a key "log.file.path.keyword":\["myfolder/mypath/mylog.log" I tried to parse it with filter{ if "mylog.log" in \[log.file… --- ## [Configure translog parameters and flush period](https://discuss.elastic.co/t/configure-translog-parameters-and-flush-period/269509)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 0\ **Last updated:** [April 7, 2021, 6:29pm UTC](https://discuss.elastic.co/t/configure-translog-parameters-and-flush-period/269509 "2021-04-07T18:29:32Z")
hey there, I'm trying to understand correctly how to configure translog parameters. Taking a look to official documentation I have a doubt regarding index.translog.sync\_interval I am moving in this scenario: index.tra… --- ## [Connecting Kibana with Runscope](https://discuss.elastic.co/t/connecting-kibana-with-runscope/269460)
**Author:** [@JaroslawNiec](https://discuss.elastic.co/u/JaroslawNiec)\ **Replies:** 2\ **Last updated:** [April 7, 2021, 5:37pm UTC](https://discuss.elastic.co/t/connecting-kibana-with-runscope/269460 "2021-04-07T17:37:27Z")
Hi, I would like to create dashboard in Kibana that will display status of our API tests in Runscope. Runscope has some REST API that could return test metrics in json format. Is this somehow possible to configure Kib… --- ## [Custom match pattern based on log message type](https://discuss.elastic.co/t/custom-match-pattern-based-on-log-message-type/269423)
**Author:** [@sergle](https://discuss.elastic.co/u/sergle)\ **Replies:** 1\ **Last updated:** [April 7, 2021, 4:53pm UTC](https://discuss.elastic.co/t/custom-match-pattern-based-on-log-message-type/269423 "2021-04-07T16:53:46Z")
Hey there, Would very much appreciate some input on something I am trying to achieve. The setup: NLog -\> (UDP) -\> Logstash (ELK) The NLog is configured to send different message structures to Logstash, all in the for… --- ## [Rollover\_alias errors on logstash daily indices from client application (fluentd)](https://discuss.elastic.co/t/rollover-alias-errors-on-logstash-daily-indices-from-client-application-fluentd/267519)
**Author:** [@cotjoey](https://discuss.elastic.co/u/cotjoey)\ **Replies:** 3\ **Last updated:** [April 7, 2021, 4:51pm UTC](https://discuss.elastic.co/t/rollover-alias-errors-on-logstash-daily-indices-from-client-application-fluentd/267519 "2021-04-07T16:51:29Z")
This is the error I am getting on the indices that fluentd is sending directly to Elasticsearch: illegal\_argument\_exception: index.lifecycle.rollover\_alias \[logstash\] does not point to index \[logstash-2021.02.09\] The i… --- ## [Safely remove tcp input plugin's "host" and "port" fields](https://discuss.elastic.co/t/safely-remove-tcp-input-plugins-host-and-port-fields/269492)
**Author:** [@Supermathie](https://discuss.elastic.co/u/Supermathie)\ **Replies:** 3\ **Last updated:** [April 7, 2021, 4:44pm UTC](https://discuss.elastic.co/t/safely-remove-tcp-input-plugins-host-and-port-fields/269492 "2021-04-07T16:44:56Z")
The tcp input plugin adds host and port fields to received events. Ideally we don't want to add these but since this isn't documented, there doesn't seem to be a way to remove them. What is the best filter to safely re… --- ## [Troubles with German Umlaute ä ö ü ß](https://discuss.elastic.co/t/troubles-with-german-umlaute-a-o-u-ss/269428)
**Author:** [@feva](https://discuss.elastic.co/u/feva)\ **Replies:** 1\ **Last updated:** [April 7, 2021, 4:26pm UTC](https://discuss.elastic.co/t/troubles-with-german-umlaute-a-o-u-ss/269428 "2021-04-07T16:26:40Z")
I have problems with German Umlaute ä ü ö ß. I send a json logmessage from IBMi (AS400) to logstash encoded in ISO8859-1. It is not possible to send them in UTF-8. So I tried to set input { http { host =\> "0.0.0.… --- ## [Detection-rules](https://discuss.elastic.co/t/detection-rules/269219)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 8\ **Last updated:** [April 7, 2021, 4:26pm UTC](https://discuss.elastic.co/t/detection-rules/269219 "2021-04-07T16:26:26Z")
Hi, i hope this message finds you well , so how to add the project elastic/detection-rules to my elk stack regards and thanks --- ## [Filebeat autodiscovery in Kubernetes/EKS and multiple outputs](https://discuss.elastic.co/t/filebeat-autodiscovery-in-kubernetes-eks-and-multiple-outputs/268272)
**Author:** [@bplies](https://discuss.elastic.co/u/bplies)\ **Replies:** 1\ **Last updated:** [April 7, 2021, 4:02pm UTC](https://discuss.elastic.co/t/filebeat-autodiscovery-in-kubernetes-eks-and-multiple-outputs/268272 "2021-04-07T16:02:26Z")
Scenario A shared K8s cluster with several different apps all needing their app-specific logs collected by Filebeat. Each different app's logs are substantially different (some plaintext, some json with differing field… --- ## [Download CSV from dashboard panel](https://discuss.elastic.co/t/download-csv-from-dashboard-panel/268638)
**Author:** [@AlessandroKP](https://discuss.elastic.co/u/AlessandroKP)\ **Replies:** 2\ **Last updated:** [April 7, 2021, 3:59pm UTC](https://discuss.elastic.co/t/download-csv-from-dashboard-panel/268638 "2021-04-07T15:59:49Z")
Hi, I'm having trouble exporting saved searches from a Kibana dashboard in CSV format through the Download CSV tool. The download works as usual when I set the time interval (through the time picker of the dashboard) t… --- ## [Change color of Line Graph when it crosses a threshold \[7.12\]](https://discuss.elastic.co/t/change-color-of-line-graph-when-it-crosses-a-threshold-7-12/269468)
**Author:** [@B2A3R9C9A](https://discuss.elastic.co/u/B2A3R9C9A)\ **Replies:** 1\ **Last updated:** [April 7, 2021, 3:36pm UTC](https://discuss.elastic.co/t/change-color-of-line-graph-when-it-crosses-a-threshold-7-12/269468 "2021-04-07T15:36:49Z")
Hi, I have a visualization showcasing CPU Utilization over a given time series. I have set a threshold line of 80 to indicate when utilization is higher than normal. Is it possible on Kibana to change color of the li… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=986) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=988)