# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1041 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1042 --- ## [Perform aggregation on small set of documents](https://discuss.elastic.co/t/perform-aggregation-on-small-set-of-documents/264515)
**Author:** [@Madhu\_Dasa](https://discuss.elastic.co/u/Madhu_Dasa)\ **Replies:** 3\ **Last updated:** [February 21, 2021, 9:26pm UTC](https://discuss.elastic.co/t/perform-aggregation-on-small-set-of-documents/264515 "2021-02-21T21:26:50Z")
I have a query which returns 100 documents. While performing aggregation it considers all the documents . But I want to apply aggregation only on top 5 documents. Is there a way to achieve this? --- ## [Data directory on remort serever](https://discuss.elastic.co/t/data-directory-on-remort-serever/264972)
**Author:** [@Ankur\_Mahajan](https://discuss.elastic.co/u/Ankur_Mahajan)\ **Replies:** 4\ **Last updated:** [February 21, 2021, 9:18pm UTC](https://discuss.elastic.co/t/data-directory-on-remort-serever/264972 "2021-02-21T21:18:53Z")
Is there any possibility where I can put the data directory to a remort cloud instance? Cloud instance 1 Public IP: 1:11:11:111 (Dummy) Elasticsearch data directory path: /home/elasticsearch/data Cloud instance 2 El… --- ## [How can we add dynamic templates in existing elastic index](https://discuss.elastic.co/t/how-can-we-add-dynamic-templates-in-existing-elastic-index/264282)
**Author:** [@prakhara](https://discuss.elastic.co/u/prakhara)\ **Replies:** 5\ **Last updated:** [February 21, 2021, 9:16pm UTC](https://discuss.elastic.co/t/how-can-we-add-dynamic-templates-in-existing-elastic-index/264282 "2021-02-21T21:16:22Z")
I have a need to add more dynamic templates in my existing index mappings, how can I do that Tried doing below, but it didn't worked PUT {$indexname}\_mappings { "mappings" : { "dynamic\_templates" : \[ { "strings"… --- ## [Change analyzer into an existing index](https://discuss.elastic.co/t/change-analyzer-into-an-existing-index/264746)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 3\ **Last updated:** [February 21, 2021, 9:15pm UTC](https://discuss.elastic.co/t/change-analyzer-into-an-existing-index/264746 "2021-02-21T21:15:05Z")
Hey there, I have an existing index without any custom setting or mapping for any field, so everything is by default. Into the docs I have a field named category which contains words like Women's or Womens. POST my\_in… --- ## [Case Sensitive Query for Text fields in Elasticsearch](https://discuss.elastic.co/t/case-sensitive-query-for-text-fields-in-elasticsearch/264015)
**Author:** [@pathfinder225](https://discuss.elastic.co/u/pathfinder225)\ **Replies:** 6\ **Last updated:** [February 21, 2021, 9:01pm UTC](https://discuss.elastic.co/t/case-sensitive-query-for-text-fields-in-elasticsearch/264015 "2021-02-21T21:01:44Z")
I have a requirement of case sensitive search where I need to search for particular word(case sensitive ) in message field which is of type text. I am using Java Rest High level client. My search word is ERROR , query… --- ## [Hot warm architecture elasticsearch](https://discuss.elastic.co/t/hot-warm-architecture-elasticsearch/264935)
**Author:** [@testsemd\_email](https://discuss.elastic.co/u/testsemd_email)\ **Replies:** 5\ **Last updated:** [February 21, 2021, 6:49pm UTC](https://discuss.elastic.co/t/hot-warm-architecture-elasticsearch/264935 "2021-02-21T18:49:11Z")
Hi, I have 7 node cluster, master nodes - 3 hot nodes -2 warm nodes-2 An application creates daily indexes and sends indexes to a cluster. I want to use hot warm architecture for this cluster. I want to know how t… --- ## [New to Elastic/LogStash and have a few questions](https://discuss.elastic.co/t/new-to-elastic-logstash-and-have-a-few-questions/264322)
**Author:** [@Skatman](https://discuss.elastic.co/u/Skatman)\ **Replies:** 6\ **Last updated:** [February 21, 2021, 5:37pm UTC](https://discuss.elastic.co/t/new-to-elastic-logstash-and-have-a-few-questions/264322 "2021-02-21T17:37:44Z")
Hi all, Just started using Elastic Stack after hearing rave reviews from friends in the security industry. I used the free trial thing just to have a prod around the interface before setting my own instance up. Got a f… --- ## [HTTP request failure on using the logstash-filter-http](https://discuss.elastic.co/t/http-request-failure-on-using-the-logstash-filter-http/264985)
**Author:** [@pratz](https://discuss.elastic.co/u/pratz)\ **Replies:** 0\ **Last updated:** [February 21, 2021, 2:11pm UTC](https://discuss.elastic.co/t/http-request-failure-on-using-the-logstash-filter-http/264985 "2021-02-21T14:11:45Z")
I'm using http filter to fetch some json data from a server. Below is my conf file input { file { path =\> "/opt/data/dum.txt" start\_position =\> "beginning" } } filter { http { url =\> "ht… --- ## [How to combine the complete data in a csv/txt file in to a single column in message field](https://discuss.elastic.co/t/how-to-combine-the-complete-data-in-a-csv-txt-file-in-to-a-single-column-in-message-field/264550)
**Author:** [@nikhilesh](https://discuss.elastic.co/u/nikhilesh)\ **Replies:** 4\ **Last updated:** [February 21, 2021, 2:16pm UTC](https://discuss.elastic.co/t/how-to-combine-the-complete-data-in-a-csv-txt-file-in-to-a-single-column-in-message-field/264550 "2021-02-21T14:16:07Z")
Hi all, I have a below kind of data in the file of csv format. when I try to pull the logs to kibana. its showing as a multiple lines in the kibana console(PFA) I want the complete data in the file to come as a single … --- ## [Is it possible to connect Elasticsearch with App Engine with flexible environment via VPC Connector in Google Cloud Platform?](https://discuss.elastic.co/t/is-it-possible-to-connect-elasticsearch-with-app-engine-with-flexible-environment-via-vpc-connector-in-google-cloud-platform/264961)
**Author:** [@white\_rabbit](https://discuss.elastic.co/u/white_rabbit)\ **Replies:** 3\ **Last updated:** [February 21, 2021, 1:31am UTC](https://discuss.elastic.co/t/is-it-possible-to-connect-elasticsearch-with-app-engine-with-flexible-environment-via-vpc-connector-in-google-cloud-platform/264961 "2021-02-21T01:31:57Z")
I have deployed my Django API in the App Engine with flexible environment. I have also created PostgreSQL instance in the Virtual Private Cloud and I connected my database with my Django App deployed in the App Engine us… --- ## [Percolator: Best Practice for Boost/Customizing Relevance Scoring](https://discuss.elastic.co/t/percolator-best-practice-for-boost-customizing-relevance-scoring/262164)
**Author:** [@jordannb](https://discuss.elastic.co/u/jordannb)\ **Replies:** 1\ **Last updated:** [February 21, 2021, 12:38am UTC](https://discuss.elastic.co/t/percolator-best-practice-for-boost-customizing-relevance-scoring/262164 "2021-02-21T00:38:45Z")
Per documentation, index-time boosting was replaced with query-time boosting in a previous release. This makes sense - here an explanation is given which explains that index time boost requires re-indexing, so it's bette… --- ## [Unrecognized VM option 'UseConcMarkSweepGC'](https://discuss.elastic.co/t/unrecognized-vm-option-useconcmarksweepgc/264960)
**Author:** [@realtech2338](https://discuss.elastic.co/u/realtech2338)\ **Replies:** 10\ **Last updated:** [February 20, 2021, 11:26pm UTC](https://discuss.elastic.co/t/unrecognized-vm-option-useconcmarksweepgc/264960 "2021-02-20T23:26:55Z")
C:\\elastic\_stack\\logstash-7.11.1-windows-x86\_64\\logstash-7.11.1\\bin\>logstash -f logstash-simple.conf Using JAVA\_HOME defined java: C:\\Program Files\\Java\\jdk-15.0.2 WARNING, using JAVA\_HOME while Logstash distribution c… --- ## [How to use Ruby to preprocess k,v -pairs value](https://discuss.elastic.co/t/how-to-use-ruby-to-preprocess-k-v-pairs-value/263684)
**Author:** [@GL\_Choong](https://discuss.elastic.co/u/GL_Choong)\ **Replies:** 5\ **Last updated:** [February 20, 2021, 8:46pm UTC](https://discuss.elastic.co/t/how-to-use-ruby-to-preprocess-k-v-pairs-value/263684 "2021-02-20T20:46:07Z")
Hi, I\`m new to Logstash and Ruby. Would like to get help. Currently I have a data as below test:result testcase: #TEMP\_BTWLAN:ok; loop:24;Temperature:28; My initial target is by using ruby to generate as below Outpu… --- ## [How to get rid of nested field and other issues](https://discuss.elastic.co/t/how-to-get-rid-of-nested-field-and-other-issues/264945)
**Author:** [@jkost](https://discuss.elastic.co/u/jkost)\ **Replies:** 6\ **Last updated:** [February 20, 2021, 6:17pm UTC](https://discuss.elastic.co/t/how-to-get-rid-of-nested-field-and-other-issues/264945 "2021-02-20T18:17:25Z")
Hallo, I 'm using logstash 7.11 and my data have the following format: { field1: ..., field2: ..., aList: \[ { Id ... }, { fielda1 ... }, { fielda2 ... }, { fielda2 ... }, … --- ## [Kibana Authentication from AWS cognito](https://discuss.elastic.co/t/kibana-authentication-from-aws-cognito/264956)
**Author:** [@Dhamodharan](https://discuss.elastic.co/u/Dhamodharan)\ **Replies:** 0\ **Last updated:** [February 20, 2021, 5:54pm UTC](https://discuss.elastic.co/t/kibana-authentication-from-aws-cognito/264956 "2021-02-20T17:54:59Z")
Hi All, I am trying to authenticate kibana from AWS cognito user pool, I have got the procedure to connect AWS elasticsearch service from cognito. But my kibana is running on my own ec2 server. Can someone help me to co… --- ## [Issue with elasticsearch query - dot in field values](https://discuss.elastic.co/t/issue-with-elasticsearch-query-dot-in-field-values/264943)
**Author:** [@Sampson\_Light](https://discuss.elastic.co/u/Sampson_Light)\ **Replies:** 5\ **Last updated:** [February 20, 2021, 5:11pm UTC](https://discuss.elastic.co/t/issue-with-elasticsearch-query-dot-in-field-values/264943 "2021-02-20T17:11:45Z")
Hello, There's an issue with the use of . in my field value. The sample below is a 'valid' query that returns some hits Copy to clipboard { "query": { "bool": { "must": \[ { "wildcard": {… --- ## [Unable to create filebeat-\* index pattern in kibana 7.11 after running filebeat](https://discuss.elastic.co/t/unable-to-create-filebeat-index-pattern-in-kibana-7-11-after-running-filebeat/264781)
**Author:** [@Malcolm\_Haak](https://discuss.elastic.co/u/Malcolm_Haak)\ **Replies:** 17\ **Last updated:** [February 20, 2021, 3:53pm UTC](https://discuss.elastic.co/t/unable-to-create-filebeat-index-pattern-in-kibana-7-11-after-running-filebeat/264781 "2021-02-20T15:53:41Z")
I can see the filebeat index. I go to make an index pattern with @timestamp and it just won't complete. The logs are clean on ES and Kibana. So yeah I click Create Index pattern and It just goes to the spinny thing an… --- ## [Unable to replace my log\_timestamp with @timestamp](https://discuss.elastic.co/t/unable-to-replace-my-log-timestamp-with-timestamp/264796)
**Author:** [@sanath\_ind](https://discuss.elastic.co/u/sanath_ind)\ **Replies:** 4\ **Last updated:** [February 20, 2021, 10:08am UTC](https://discuss.elastic.co/t/unable-to-replace-my-log-timestamp-with-timestamp/264796 "2021-02-20T10:08:07Z")
Hi, I am facing an issue while trying to set my log\_timestamp to @timestamp. I have tried many combinations from various date filter topics from here. But it is not giving me any positive result. My original logstash.c… --- ## [Metricbeat not showing info on Kibana](https://discuss.elastic.co/t/metricbeat-not-showing-info-on-kibana/264839)
**Author:** [@gpalazov](https://discuss.elastic.co/u/gpalazov)\ **Replies:** 2\ **Last updated:** [February 20, 2021, 7:58am UTC](https://discuss.elastic.co/t/metricbeat-not-showing-info-on-kibana/264839 "2021-02-20T07:58:43Z")
Hello everyone:), Metricbeat not showing info on Kibana for me. I have Packetbeat configured and everything there is running as it should. Probably i'm missing some info on the conf side of metricbeat. Please tell me wh… --- ## [Cost of searchable fields](https://discuss.elastic.co/t/cost-of-searchable-fields/264913)
**Author:** [@abhishekc92](https://discuss.elastic.co/u/abhishekc92)\ **Replies:** 1\ **Last updated:** [February 20, 2021, 3:06am UTC](https://discuss.elastic.co/t/cost-of-searchable-fields/264913 "2021-02-20T03:06:46Z")
I'm very new to Elastic. I am thinking of a document structure of a reasonable size, with quite a few fields, which I don't necessarily need to be able to search on. What I could not find in the documentation is the exac… --- ## [Grok Filter on Spring Logs](https://discuss.elastic.co/t/grok-filter-on-spring-logs/264930)
**Author:** [@seshu\_rao](https://discuss.elastic.co/u/seshu_rao)\ **Replies:** 0\ **Last updated:** [February 20, 2021, 2:57am UTC](https://discuss.elastic.co/t/grok-filter-on-spring-logs/264930 "2021-02-20T02:57:03Z")
i was trying to apply grok pattern on below log and couldn't make it successfully. some one please help me on this. this is the log file pattern coming to kibana. {"@timestamp":"2021-02-19T10:27:42.275+00:00","severity… --- ## [Skip to end of filter if the grok pattern does not match](https://discuss.elastic.co/t/skip-to-end-of-filter-if-the-grok-pattern-does-not-match/264925)
**Author:** [@newmember](https://discuss.elastic.co/u/newmember)\ **Replies:** 2\ **Last updated:** [February 20, 2021, 2:50am UTC](https://discuss.elastic.co/t/skip-to-end-of-filter-if-the-grok-pattern-does-not-match/264925 "2021-02-20T02:50:21Z")
Is there a option for a filter so that when the grok pattern does not match skip all the other filter plugins and leave the filter? Ideal situation is if the grok pattern does not match skip the rest of the filter plu… --- ## [Config file is not processed by logstash](https://discuss.elastic.co/t/config-file-is-not-processed-by-logstash/264903)
**Author:** [@Antonis\_Michael](https://discuss.elastic.co/u/Antonis_Michael)\ **Replies:** 15\ **Last updated:** [February 20, 2021, 1:13am UTC](https://discuss.elastic.co/t/config-file-is-not-processed-by-logstash/264903 "2021-02-20T01:13:15Z")
Hello, I am having my pipeline set to look for .conf files under /etc/logstash/conf.d/, there i have multiple config files and I make sure to tag each one for filtering indices. Everything works fine for all the other c… --- ## [Logstash problems with xml filter](https://discuss.elastic.co/t/logstash-problems-with-xml-filter/264667)
**Author:** [@Er1csson](https://discuss.elastic.co/u/Er1csson)\ **Replies:** 8\ **Last updated:** [February 19, 2021, 11:15pm UTC](https://discuss.elastic.co/t/logstash-problems-with-xml-filter/264667 "2021-02-19T23:15:26Z")
Hi all, I want to collect only certain tags from my xml file (data with Parameter tag). Here is the example of xml file I want to parse: // \ // \ **Author:** [@Shahsha\_21](https://discuss.elastic.co/u/Shahsha_21)\ **Replies:** 0\ **Last updated:** [February 19, 2021, 6:11pm UTC](https://discuss.elastic.co/t/syntax-issue-with-customized-query/264899 "2021-02-19T18:11:08Z") I am trying to create a Boolean query which takes in user input(stored in a variable) and appends it with an existing string for e.g. User enters: "ABC" AND "CDE" which will be stored in a temporary variable: var input… --- ## [Date Parse Fail](https://discuss.elastic.co/t/date-parse-fail/264483)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 2\ **Last updated:** [February 19, 2021, 6:55pm UTC](https://discuss.elastic.co/t/date-parse-fail/264483 "2021-02-19T18:55:00Z")
Trying to ingest the below event: {"modified": "2019-12-27 16:08:00", "published": "2015-03-08 02:59:00", "access": {"authentication": "none", "complexity": "low", "vector": "network"}, "assigner": "cve@mitre.org", "cap… --- ## [Updating the geoLite2 Database](https://discuss.elastic.co/t/updating-the-geolite2-database/264722)
**Author:** [@Falikou1](https://discuss.elastic.co/u/Falikou1)\ **Replies:** 6\ **Last updated:** [February 19, 2021, 6:42pm UTC](https://discuss.elastic.co/t/updating-the-geolite2-database/264722 "2021-02-19T18:42:30Z")
I have configured the geoLite2 Database in logstash. geoip { default\_database\_type =\> 'City' database =\> '/usr/share/logstash/GeoLite2-City/GeoLite2-City.mmdb' source =\> "src" target =\> "src\_geoip" } Is there … --- ## [Logstash events count and get alert](https://discuss.elastic.co/t/logstash-events-count-and-get-alert/264850)
**Author:** [@bdn](https://discuss.elastic.co/u/bdn)\ **Replies:** 2\ **Last updated:** [February 19, 2021, 6:16pm UTC](https://discuss.elastic.co/t/logstash-events-count-and-get-alert/264850 "2021-02-19T18:16:51Z")
I want to count events in Logstash and get me alert if events hit more than 10 times within 2mins. E.g. I have a log like below. Feb 19 15:22:01 DEVICE-01 Device is online. Feb 19 15:22:01 DEVICE-02 Device is online. F… --- ## [Combine data from multiple rows based on aggregation](https://discuss.elastic.co/t/combine-data-from-multiple-rows-based-on-aggregation/264608)
**Author:** [@hayo](https://discuss.elastic.co/u/hayo)\ **Replies:** 6\ **Last updated:** [February 19, 2021, 6:07pm UTC](https://discuss.elastic.co/t/combine-data-from-multiple-rows-based-on-aggregation/264608 "2021-02-19T18:07:02Z")
I have searched but was not able to find the answer or i just didnt see it! I have data like: BookTitle | Author | Category A | Writer1 | Thriller A | Writer1 | Action B | Writer1 | Science fiction B … --- ## [Unable to index a json string (array of json objects) to elastic search](https://discuss.elastic.co/t/unable-to-index-a-json-string-array-of-json-objects-to-elastic-search/264851)
**Author:** [@schawla](https://discuss.elastic.co/u/schawla)\ **Replies:** 7\ **Last updated:** [February 19, 2021, 5:47pm UTC](https://discuss.elastic.co/t/unable-to-index-a-json-string-array-of-json-objects-to-elastic-search/264851 "2021-02-19T17:47:10Z")
I have an array of objects in the form of a single json string something like "\[{"id": 1, "name":"test"}, {"id": 2, "name":"test2"}\]" I want to be able to bulk index this json string directly to elastic search without … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1040) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1042)