# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1020 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1021 --- ## [I need to transform String field with numbers in format (yyyyddmmHHMM) to a Date field](https://discuss.elastic.co/t/i-need-to-transform-string-field-with-numbers-in-format-yyyyddmmhhmm-to-a-date-field/266727)
**Author:** [@jonhmb](https://discuss.elastic.co/u/jonhmb)\ **Replies:** 2\ **Last updated:** [March 9, 2021, 5:44pm UTC](https://discuss.elastic.co/t/i-need-to-transform-string-field-with-numbers-in-format-yyyyddmmhhmm-to-a-date-field/266727 "2021-03-09T17:44:38Z")
I have logs from a Jenkins application and I need this LastCommitDate to be really a date, but it is a String How can i transform it to a Date field? I need to transform even the past logs, so it will propably be need… --- ## [Convert field containing a timestamp from string to a date / time or timestamp?](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 47\ **Last updated:** [March 9, 2021, 5:34pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594 "2021-03-09T17:34:55Z")
Hello As you can observe here, I have a two fields containing date and time: Id like to change it so Elastic stores it as a date/time and maybe even change the order (yyyy/mm/dd hh/mm ) How can I change this? My lo… --- ## [Wildcard index pattern matching non-system indices, 7.10.2 edition](https://discuss.elastic.co/t/wildcard-index-pattern-matching-non-system-indices-7-10-2-edition/263934)
**Author:** [@Supermathie](https://discuss.elastic.co/u/Supermathie)\ **Replies:** 4\ **Last updated:** [March 9, 2021, 5:30pm UTC](https://discuss.elastic.co/t/wildcard-index-pattern-matching-non-system-indices-7-10-2-edition/263934 "2021-03-09T17:30:12Z")
Allegedly in Kibana 7.10.2 this pattern is supposed to match only user indices: but it's definitely picking up fields from system indices: Is this supposed to work now in 7+ or do we need to keep using this w… --- ## [Logstash ternary condition when a winlogbeat field doesn't exist](https://discuss.elastic.co/t/logstash-ternary-condition-when-a-winlogbeat-field-doesnt-exist/266721)
**Author:** [@mguttula](https://discuss.elastic.co/u/mguttula)\ **Replies:** 4\ **Last updated:** [March 9, 2021, 5:17pm UTC](https://discuss.elastic.co/t/logstash-ternary-condition-when-a-winlogbeat-field-doesnt-exist/266721 "2021-03-09T17:17:04Z")
Logstash is sending winlogbeat fields to Spunk and when the fields don't exist it is send something like %{\[winlog\]\[event\_data\]\[AuthenticationPackageName\]} I am trying to find a way to either not send the field if it do… --- ## [Sync data from mongodb](https://discuss.elastic.co/t/sync-data-from-mongodb/266719)
**Author:** [@Gharsa\_Khouloud](https://discuss.elastic.co/u/Gharsa_Khouloud)\ **Replies:** 1\ **Last updated:** [March 9, 2021, 4:24pm UTC](https://discuss.elastic.co/t/sync-data-from-mongodb/266719 "2021-03-09T16:24:43Z")
I just want to sync the data from mongodb to elastic using logstash. Its working good, when any new record comes in mongodb, logstash pushes into elastic. But when I update any record in mongodb then it does not change i… --- ## [Aggregation query returning single word results](https://discuss.elastic.co/t/aggregation-query-returning-single-word-results/266718)
**Author:** [@aanders50](https://discuss.elastic.co/u/aanders50)\ **Replies:** 0\ **Last updated:** [March 9, 2021, 4:06pm UTC](https://discuss.elastic.co/t/aggregation-query-returning-single-word-results/266718 "2021-03-09T16:06:54Z")
Hello! Just wanted to preface that I am new to ElasticSearch so I apologize if I am missing any basic concepts. I have an issue and I saw some other similar articles, but they were from quite awhile back and wanted to v… --- ## [Sending data from mongodb to Elasticsearch](https://discuss.elastic.co/t/sending-data-from-mongodb-to-elasticsearch/266706)
**Author:** [@Laetitia\_RICHARD](https://discuss.elastic.co/u/Laetitia_RICHARD)\ **Replies:** 2\ **Last updated:** [March 9, 2021, 3:42pm UTC](https://discuss.elastic.co/t/sending-data-from-mongodb-to-elasticsearch/266706 "2021-03-09T15:42:47Z")
Hello, I would like to send data from mongodb in Elasticsearch, I saw a lot of different plugins like monstache, mongo-connector, but I'd like to have your recommendations for indexing this data, knowing that I will hav… --- ## [How to make difference between 2 source of logs in Logstash input](https://discuss.elastic.co/t/how-to-make-difference-between-2-source-of-logs-in-logstash-input/266709)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 1\ **Last updated:** [March 9, 2021, 3:35pm UTC](https://discuss.elastic.co/t/how-to-make-difference-between-2-source-of-logs-in-logstash-input/266709 "2021-03-09T15:35:50Z")
Hello everyone, I want to send log of the "auth.log" file using system module of filebeat, and I have another file that I want to parse using logstash (as there is no module for that type of log). And as I know, there … --- ## [No document in index, but index stats reports numerous docs](https://discuss.elastic.co/t/no-document-in-index-but-index-stats-reports-numerous-docs/266708)
**Author:** [@zarak](https://discuss.elastic.co/u/zarak)\ **Replies:** 4\ **Last updated:** [March 9, 2021, 3:13pm UTC](https://discuss.elastic.co/t/no-document-in-index-but-index-stats-reports-numerous-docs/266708 "2021-03-09T15:13:52Z")
Hi ! I have an index that reports me some documents in Kibana in Index management, as well as in its stats: GET /v2-logs-000003/\_stats { "\_shards" : { "total" : 6, "successful" : 6, "f… --- ## [Get only one level of documents when using path-hierarchy tokenizer](https://discuss.elastic.co/t/get-only-one-level-of-documents-when-using-path-hierarchy-tokenizer/266704)
**Author:** [@avhvr](https://discuss.elastic.co/u/avhvr)\ **Replies:** 0\ **Last updated:** [March 9, 2021, 1:53pm UTC](https://discuss.elastic.co/t/get-only-one-level-of-documents-when-using-path-hierarchy-tokenizer/266704 "2021-03-09T13:53:01Z")
Hi, I need to search documents (employee details) that are present in a tree structure. The number of levels in the hierarchy could be any. . Using path-hierarchy tokenizer and this post, I was able to index them and… --- ## [HPA for clients in helm chart](https://discuss.elastic.co/t/hpa-for-clients-in-helm-chart/266694)
**Author:** [@adrobisch](https://discuss.elastic.co/u/adrobisch)\ **Replies:** 0\ **Last updated:** [March 9, 2021, 12:27pm UTC](https://discuss.elastic.co/t/hpa-for-clients-in-helm-chart/266694 "2021-03-09T12:27:30Z")
Hi, we are running the official k8s helm chart are wondering why there is no HPA support for the client node group? We are aware that it would not be a good idea on the data / master nodes and that the clients also mai… --- ## [Increase in CPU usage when deleting snapshots](https://discuss.elastic.co/t/increase-in-cpu-usage-when-deleting-snapshots/266682)
**Author:** [@Norman\_Khine](https://discuss.elastic.co/u/Norman_Khine)\ **Replies:** 0\ **Last updated:** [March 9, 2021, 11:29am UTC](https://discuss.elastic.co/t/increase-in-cpu-usage-when-deleting-snapshots/266682 "2021-03-09T11:29:46Z")
Hello, I have a process which deletes outdated ES snapshots which are saved on AWS S3. Currently there are 326 snapshots which are scheduled for deletion. From the docs, https://www.elastic.co/guide/en/elasticsearch/re… --- ## [Logstash - In memory maps/Lookup tables?](https://discuss.elastic.co/t/logstash-in-memory-maps-lookup-tables/266673)
**Author:** [@scott\_stash](https://discuss.elastic.co/u/scott_stash)\ **Replies:** 0\ **Last updated:** [March 9, 2021, 10:56am UTC](https://discuss.elastic.co/t/logstash-in-memory-maps-lookup-tables/266673 "2021-03-09T10:56:44Z")
Filebeat sends data to logstash. I’m reading files that are up to about 500mb, about 2 million lines. On each longline I calculate certain fields based on patterns in the log file name, example, split the path, get the… --- ## [Index store size increased by 4X on new index created using slipt api](https://discuss.elastic.co/t/index-store-size-increased-by-4x-on-new-index-created-using-slipt-api/266633)
**Author:** [@sreekanth](https://discuss.elastic.co/u/sreekanth)\ **Replies:** 3\ **Last updated:** [March 9, 2021, 10:33am UTC](https://discuss.elastic.co/t/index-store-size-increased-by-4x-on-new-index-created-using-slipt-api/266633 "2021-03-09T10:33:47Z")
We had one index with 1 shard/1 replica config. As per /\_cat/indices, it shows docs.count =133213 docs.deleted=2430 store.size=819.1gb pri.store.size=409.5gb now we used split api to create new index with 40 shards. … --- ## [Kibana dashboard recovery](https://discuss.elastic.co/t/kibana-dashboard-recovery/266649)
**Author:** [@tt\_cc](https://discuss.elastic.co/u/tt_cc)\ **Replies:** 1\ **Last updated:** [March 9, 2021, 9:50am UTC](https://discuss.elastic.co/t/kibana-dashboard-recovery/266649 "2021-03-09T09:50:05Z")
When reinstalling elk, how do I apply the existing kibana dashboard visualizations to the newly installed kibana? --- ## [Alert on an existing visualization of type "metric"](https://discuss.elastic.co/t/alert-on-an-existing-visualization-of-type-metric/266471)
**Author:** [@fml2](https://discuss.elastic.co/u/fml2)\ **Replies:** 1\ **Last updated:** [March 9, 2021, 9:18am UTC](https://discuss.elastic.co/t/alert-on-an-existing-visualization-of-type-metric/266471 "2021-03-09T09:18:35Z")
Hello, I've created a dashboard with a visualization of type "metric". The visualization displays the number of the log entries of type "ERROR" in the selected time span. Is it possible to define an alert on this visual… --- ## [Alert When - system\_fails\_to\_provide\_data - dynamic group of sending hosts](https://discuss.elastic.co/t/alert-when-system-fails-to-provide-data-dynamic-group-of-sending-hosts/265094)
**Author:** [@bbek](https://discuss.elastic.co/u/bbek)\ **Replies:** 5\ **Last updated:** [March 9, 2021, 9:08am UTC](https://discuss.elastic.co/t/alert-when-system-fails-to-provide-data-dynamic-group-of-sending-hosts/265094 "2021-03-09T09:08:48Z")
I have a use case to alert when a host fails to send logs. There is a watcher configured here, which is similar to what I'm trying to achieve: I like the logic, aggregate hosts on last 24 hours, then check for last 5 … --- ## [Ruby script and boolean](https://discuss.elastic.co/t/ruby-script-and-boolean/266535)
**Author:** [@logger](https://discuss.elastic.co/u/logger)\ **Replies:** 2\ **Last updated:** [March 9, 2021, 8:25am UTC](https://discuss.elastic.co/t/ruby-script-and-boolean/266535 "2021-03-09T08:25:43Z")
Hi there, I have a question about the ruby filter. I am getting logs in Json they are working quite good, but ofcourse I have inconsistence in the mapping. Usually the logs arrive with the fields arg0, arg1, arg,2 T… --- ## [Pipeline computed Field](https://discuss.elastic.co/t/pipeline-computed-field/266558)
**Author:** [@graimato](https://discuss.elastic.co/u/graimato)\ **Replies:** 2\ **Last updated:** [March 9, 2021, 8:18am UTC](https://discuss.elastic.co/t/pipeline-computed-field/266558 "2021-03-09T08:18:28Z")
Hello, I wrote a pipeline to parse log files, I'm trying to create a computed field I have es. timerequest timeresponse It is possible to create a new field latency { "set" : { "field" : "latency… --- ## [Schema design and query - aggregation within nested document](https://discuss.elastic.co/t/schema-design-and-query-aggregation-within-nested-document/266629)
**Author:** [@cuongthamhl](https://discuss.elastic.co/u/cuongthamhl)\ **Replies:** 1\ **Last updated:** [March 9, 2021, 8:14am UTC](https://discuss.elastic.co/t/schema-design-and-query-aggregation-within-nested-document/266629 "2021-03-09T08:14:32Z")
I have a simple schema with a nested field. A sample product document look like this: { "name": "product name", "events": \[ { "startDate": "2021-01-01 00:00:00", "endDate": "2021-01-01 00:00:00", … --- ## [Date timezone issue](https://discuss.elastic.co/t/date-timezone-issue/266644)
**Author:** [@Priyank07](https://discuss.elastic.co/u/Priyank07)\ **Replies:** 3\ **Last updated:** [March 9, 2021, 8:04am UTC](https://discuss.elastic.co/t/date-timezone-issue/266644 "2021-03-09T08:04:39Z")
Hi, I am pushing some documents to elastic and passing time as local time. So my question is.. Will that time converts to utc or it will be in local only. --- ## [How can I split string in Elasticsearch](https://discuss.elastic.co/t/how-can-i-split-string-in-elasticsearch/266576)
**Author:** [@pakwai122](https://discuss.elastic.co/u/pakwai122)\ **Replies:** 5\ **Last updated:** [March 9, 2021, 7:57am UTC](https://discuss.elastic.co/t/how-can-i-split-string-in-elasticsearch/266576 "2021-03-09T07:57:04Z")
I'm using nodejs as the client-side for Elasticsearch and got the following settings for the query. I want to split the text while users input text like "aa123 bb234" into "aa123 bb" "234". Only split the pattern like "b… --- ## [How to get date difference in weeks between today and date\_timestamp field](https://discuss.elastic.co/t/how-to-get-date-difference-in-weeks-between-today-and-date-timestamp-field/266378)
**Author:** [@Rakesh\_Rayabarapu](https://discuss.elastic.co/u/Rakesh_Rayabarapu)\ **Replies:** 4\ **Last updated:** [March 9, 2021, 7:36am UTC](https://discuss.elastic.co/t/how-to-get-date-difference-in-weeks-between-today-and-date-timestamp-field/266378 "2021-03-09T07:36:56Z")
Hello Team, could any one help me to write scripted field to get date difference in weeks between current datetime and doc\['timestamp'\]. to get current date time used datetime.new date().getTime() Used this script. (… --- ## [Elasticsearch](https://discuss.elastic.co/t/elasticsearch/266528)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 5\ **Last updated:** [March 9, 2021, 6:43am UTC](https://discuss.elastic.co/t/elasticsearch/266528 "2021-03-09T06:43:13Z")
what files are pulled from the target server to elastic and where are they stored? how long is the file stored? How do I set the file I want to drag to elastic? --- ## [CSV::MalformedCSVError: Unclosed quoted field on line 1](https://discuss.elastic.co/t/csv-unclosed-quoted-field-on-line-1/266509)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 2\ **Last updated:** [March 9, 2021, 6:10am UTC](https://discuss.elastic.co/t/csv-unclosed-quoted-field-on-line-1/266509 "2021-03-09T06:10:07Z")
After running code, getting this error. How to resolve this error. In front of date I am getting this symbol ∩╗┐ while running my configuration file. It appears once(first line). Error parsing csv {:field=\>"message", :… --- ## [I want to output log to elasticsearch index from only specific "host.ip"](https://discuss.elastic.co/t/i-want-to-output-log-to-elasticsearch-index-from-only-specific-host-ip/266494)
**Author:** [@BlackCat](https://discuss.elastic.co/u/BlackCat)\ **Replies:** 4\ **Last updated:** [March 9, 2021, 3:51am UTC](https://discuss.elastic.co/t/i-want-to-output-log-to-elasticsearch-index-from-only-specific-host-ip/266494 "2021-03-09T03:51:57Z")
"host.ip" is at "\_source" displayed on Kibana. Please teach me how to resolve. logstash config input { beats { port =\> 5044 } } filter { grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:Time} %{HO… --- ## [Cannot seem to get ingest pipelines to work, please help!](https://discuss.elastic.co/t/cannot-seem-to-get-ingest-pipelines-to-work-please-help/264259)
**Author:** [@mhare](https://discuss.elastic.co/u/mhare)\ **Replies:** 11\ **Last updated:** [March 9, 2021, 3:16am UTC](https://discuss.elastic.co/t/cannot-seem-to-get-ingest-pipelines-to-work-please-help/264259 "2021-03-09T03:16:25Z")
I am trying to understand ES ingest pipelines and Filebeat. I am using version 7.11 ES and K and FB in docker containers. If I do not add the pipeline, I get the log lines in ES/K from FB, but they are not formatted … --- ## [ES version rollback problem](https://discuss.elastic.co/t/es-version-rollback-problem/266551)
**Author:** [@haipeng.zhao](https://discuss.elastic.co/u/haipeng.zhao)\ **Replies:** 2\ **Last updated:** [March 9, 2021, 2:08am UTC](https://discuss.elastic.co/t/es-version-rollback-problem/266551 "2021-03-09T02:08:11Z")
hi all When I tried to upgrade es to 7.10.2, it was successful, but when I rolled back to my previous version 7.10.1, I found an error. Currently my ECK version 1.4 I also found that someone has opened this issue, but… --- ## [Exclude and include not working on script\_score](https://discuss.elastic.co/t/exclude-and-include-not-working-on-script-score/266498)
**Author:** [@Min-Young](https://discuss.elastic.co/u/Min-Young)\ **Replies:** 0\ **Last updated:** [March 8, 2021, 2:12am UTC](https://discuss.elastic.co/t/exclude-and-include-not-working-on-script-score/266498 "2021-03-08T02:12:05Z")
Hi guys, if query is something like that... { "size": 30, "\_source": { "includes": "source\_sentence", "excludes": \["source\_embedding", "target\_embedding"\] }, "query": { "script\_score": { "quer… --- ## [Logstash elastic as input](https://discuss.elastic.co/t/logstash-elastic-as-input/266280)
**Author:** [@Kiyoka](https://discuss.elastic.co/u/Kiyoka)\ **Replies:** 3\ **Last updated:** [March 8, 2021, 11:47pm UTC](https://discuss.elastic.co/t/logstash-elastic-as-input/266280 "2021-03-08T23:47:27Z")
Hi. I am using existing index as input and enriching it with the data from SQL server. This enriching process needs to run weekly for now. Currently I am loading past 10 days, but that cause duplicate. Preformatted … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1019) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1021)