# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1130 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1131 --- ## [Missing \_scroll\_id in search response when using Python library](https://discuss.elastic.co/t/missing-scroll-id-in-search-response-when-using-python-library/257288)
**Author:** [@bbunderson](https://discuss.elastic.co/u/bbunderson)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 11:22pm UTC](https://discuss.elastic.co/t/missing-scroll-id-in-search-response-when-using-python-library/257288 "2020-12-01T23:22:17Z")
The \_scroll\_id is missing from the search response when using the Python library version 7.9.0 but the response does contain the \_scroll\_id when I query the API using curl. For example, the following Python code: respo… --- ## [Python3 Elastic Query returns large amount of results.. am i doing this right?](https://discuss.elastic.co/t/python3-elastic-query-returns-large-amount-of-results-am-i-doing-this-right/257283)
**Author:** [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 10:30pm UTC](https://discuss.elastic.co/t/python3-elastic-query-returns-large-amount-of-results-am-i-doing-this-right/257283 "2020-12-01T22:30:30Z")
hi, i'm still not sure i'm doing this right.. so any suggestions would be appreciated.. i have a LARGE data index of log data containing IP addresses.. ports.. and other network traffic info. its millions of entries a m… --- ## [Logstash exits after successfully installing plugin with docker-compose](https://discuss.elastic.co/t/logstash-exits-after-successfully-installing-plugin-with-docker-compose/255456)
**Author:** [@luka.klaric](https://discuss.elastic.co/u/luka.klaric)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 9:50pm UTC](https://discuss.elastic.co/t/logstash-exits-after-successfully-installing-plugin-with-docker-compose/255456 "2020-12-01T21:50:42Z")
I am trying to run an Elastic stack and I am trying to install a logstash plugin within the docker file. I am getting the message that the plugin is installed successful and right after that the container exits with code… --- ## [Multiple logstash output](https://discuss.elastic.co/t/multiple-logstash-output/257272)
**Author:** [@stijnvr](https://discuss.elastic.co/u/stijnvr)\ **Replies:** 1\ **Last updated:** [December 1, 2020, 9:09pm UTC](https://discuss.elastic.co/t/multiple-logstash-output/257272 "2020-12-01T21:09:30Z")
I would like to forward all source logs to Logstash. Logstash should have 2 outputs. Elasticsearch, for formatted logs S3, for untampered logs Is this possible ? Or do I need to configuring 2 outputs for the source l… --- ## [Median aggregation and routing](https://discuss.elastic.co/t/median-aggregation-and-routing/257276)
**Author:** [@pcb](https://discuss.elastic.co/u/pcb)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 9:01pm UTC](https://discuss.elastic.co/t/median-aggregation-and-routing/257276 "2020-12-01T21:01:06Z")
Hi ya, I'm working on spec'ing out a new datastore for aggregate calculations for near-real time dashboards and I'm evaluating Elasticsearch. I've read here that median is usually approximated: https://www.elastic.co/gu… --- ## [Doubts about Grok](https://discuss.elastic.co/t/doubts-about-grok/257129)
**Author:** [@rildo](https://discuss.elastic.co/u/rildo)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 8:37pm UTC](https://discuss.elastic.co/t/doubts-about-grok/257129 "2020-12-01T20:37:15Z")
Hello People , I have a doubt about my filter I have this content in my log file {"other\_logs": "127.0.0.1|28614|2018-11-28 23:51:57|srcport 50389 mwtype AvalancheBotnet-andromeda destaddr 2.2.2.2 destinyurl: dogs.ru|M… --- ## [Elastic detections and case sensitivity](https://discuss.elastic.co/t/elastic-detections-and-case-sensitivity/256788)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 4\ **Last updated:** [December 1, 2020, 8:31pm UTC](https://discuss.elastic.co/t/elastic-detections-and-case-sensitivity/256788 "2020-12-01T20:31:10Z")
We use logstash to lowercase most fields used in detections. I was hoping the new wildcard field type would get around the issue of case-insensitivity in the detections rules (not including EQL) Any recommendations or i… --- ## [Get all documents matching a list of values for a field](https://discuss.elastic.co/t/get-all-documents-matching-a-list-of-values-for-a-field/257274)
**Author:** [@jmaharjan](https://discuss.elastic.co/u/jmaharjan)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 8:19pm UTC](https://discuss.elastic.co/t/get-all-documents-matching-a-list-of-values-for-a-field/257274 "2020-12-01T20:19:48Z")
I am using multisearch (msearch from elasticsearch-py) to search for all documents using a list of document ids from a list of indices. The id's are explicitly assigned. The goal is to look for existing documents (using … --- ## [Query\_string with datetime](https://discuss.elastic.co/t/query-string-with-datetime/257271)
**Author:** [@spreet](https://discuss.elastic.co/u/spreet)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 8:10pm UTC](https://discuss.elastic.co/t/query-string-with-datetime/257271 "2020-12-01T20:10:07Z")
We recently migrated to ES 7.1 from 5.8. In the previous version query\_string with a datetime used to work. Query with date and time { "query": { "query\_string": { "query": "data.lastUpdateTime:\[\* TO 2018-1… --- ## [Multiline data to correlate into single line](https://discuss.elastic.co/t/multiline-data-to-correlate-into-single-line/257253)
**Author:** [@Ramesh535](https://discuss.elastic.co/u/Ramesh535)\ **Replies:** 1\ **Last updated:** [December 1, 2020, 6:38pm UTC](https://discuss.elastic.co/t/multiline-data-to-correlate-into-single-line/257253 "2020-12-01T18:38:58Z")
Hi Guys, Need some help I have the data in this format \[2020-11-27\] \[data\] \[country:India\] \[Capital:Delhi\] \[2020-11-27\] \[data\] \[country:India\] \[Currency:INR\] \[2020-11-27\] \[data\] \[country:India\] \[PM:Modi\] \[2020-11-2… --- ## [Incorrect result in Kibana TSVB chart](https://discuss.elastic.co/t/incorrect-result-in-kibana-tsvb-chart/257006)
**Author:** [@Agenobarb](https://discuss.elastic.co/u/Agenobarb)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 3:43pm UTC](https://discuss.elastic.co/t/incorrect-result-in-kibana-tsvb-chart/257006 "2020-12-01T15:43:21Z")
Please look at the field 'timestamp' in the screenshot from Discover: I am unable to understand why when I use metric max on this field - max(timestamp) I am getting a timestamp that is not within the range of timest… --- ## [Keystore does not update azure client secrets when changed - secrets seems to be persistent somehow](https://discuss.elastic.co/t/keystore-does-not-update-azure-client-secrets-when-changed-secrets-seems-to-be-persistent-somehow/257257)
**Author:** [@johanhaugland](https://discuss.elastic.co/u/johanhaugland)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 6:13pm UTC](https://discuss.elastic.co/t/keystore-does-not-update-azure-client-secrets-when-changed-secrets-seems-to-be-persistent-somehow/257257 "2020-12-01T18:13:59Z")
Short version: Unable to load new values into keystore secrets for azure plugin: azure.client.default.account azure.client.default.key They seem to be persistent - how do I purge the old values completely from the clu… --- ## [Nested Field can't access the nested field array using script query](https://discuss.elastic.co/t/nested-field-cant-access-the-nested-field-array-using-script-query/257256)
**Author:** [@khalilw1](https://discuss.elastic.co/u/khalilw1)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 6:12pm UTC](https://discuss.elastic.co/t/nested-field-cant-access-the-nested-field-array-using-script-query/257256 "2020-12-01T18:12:27Z")
Hello Guys, I have the following mapping PUT products/\_mapping { "properties": { "discounts": { "properties": { "KW": { "type": "nested" }, "SA": { "type": "neste… --- ## [Field value factor based on matched term](https://discuss.elastic.co/t/field-value-factor-based-on-matched-term/257241)
**Author:** [@Tianyi\_Mao](https://discuss.elastic.co/u/Tianyi_Mao)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 4:44pm UTC](https://discuss.elastic.co/t/field-value-factor-based-on-matched-term/257241 "2020-12-01T16:44:18Z")
In https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-function-score-query.html#function-field-value-factor it is mentioned that one can use a numeric field in the document to influence scoring. C… --- ## [Inner hits in a double nested query fine in ES 7.7, but not working in 7.10](https://discuss.elastic.co/t/inner-hits-in-a-double-nested-query-fine-in-es-7-7-but-not-working-in-7-10/257239)
**Author:** [@timarkh](https://discuss.elastic.co/u/timarkh)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 4:25pm UTC](https://discuss.elastic.co/t/inner-hits-in-a-double-nested-query-fine-in-es-7-7-but-not-working-in-7-10/257239 "2020-12-01T16:25:46Z")
I have an index (sentences) where documents contain two kinds of nested objects, one (ana) inside the other (words). In my queries, I use two inner\_hits keys to highlight the matches. This worked fine in 5.6 and still wo… --- ## [Grok parse failures](https://discuss.elastic.co/t/grok-parse-failures/257230)
**Author:** [@naveenrt23](https://discuss.elastic.co/u/naveenrt23)\ **Replies:** 3\ **Last updated:** [December 1, 2020, 4:12pm UTC](https://discuss.elastic.co/t/grok-parse-failures/257230 "2020-12-01T16:12:21Z")
Hello I'm playing around with grok filters and i'm running into parse failures..Any idea whats wrong ? Filters: filter { if \[type\] == "app-data" { mutate { rename =\> \["env", "environment"\] } grok { … --- ## [How can I drop preflight http requst( OPTIONS request)in Logstash](https://discuss.elastic.co/t/how-can-i-drop-preflight-http-requst-options-request-in-logstash/257235)
**Author:** [@abdoegy83](https://discuss.elastic.co/u/abdoegy83)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 4:09pm UTC](https://discuss.elastic.co/t/how-can-i-drop-preflight-http-requst-options-request-in-logstash/257235 "2020-12-01T16:09:51Z")
how can I drop preflight HTTP request( OPTIONS request)in Logstash, how can I get access to the HTTP method (post,get,...) --- ## [Logstash Grok](https://discuss.elastic.co/t/logstash-grok/256682)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 3\ **Last updated:** [December 1, 2020, 3:51pm UTC](https://discuss.elastic.co/t/logstash-grok/256682 "2020-12-01T15:51:45Z")
I need to start a grok at \<190\> I dont care about anything before that . What is the way to do this ? \<13\>Nov 25 15:36:31 servername.abc.com LOGSTASH\[-\]: \<190\>Nov 25 07:36:31 --- ## [Ingest pipeline not working but working in the simulate API](https://discuss.elastic.co/t/ingest-pipeline-not-working-but-working-in-the-simulate-api/205322)
**Author:** [@themarcusaurelius](https://discuss.elastic.co/u/themarcusaurelius)\ **Replies:** 6\ **Last updated:** [December 1, 2020, 3:42pm UTC](https://discuss.elastic.co/t/ingest-pipeline-not-working-but-working-in-the-simulate-api/205322 "2020-12-01T15:42:41Z")
I have a pipeline that is filtering Palo Alto logs through Grok patterns and other processors. Testing with the simulate API shows that it works but when I try to ingest into elasticsearch none of the documents go throug… --- ## [No geopoint for destination.ip but latitude and longitude field - 7.10](https://discuss.elastic.co/t/no-geopoint-for-destination-ip-but-latitude-and-longitude-field-7-10/256905)
**Author:** [@Camille](https://discuss.elastic.co/u/Camille)\ **Replies:** 3\ **Last updated:** [December 1, 2020, 3:23pm UTC](https://discuss.elastic.co/t/no-geopoint-for-destination-ip-but-latitude-and-longitude-field-7-10/256905 "2020-12-01T15:23:53Z")
Hi, i'm trying to use "geoip" module on a destination.ip. My logstash code is : if \[destination.ip\] { geoip { source =\> "destination.ip" target =\> "destination.geo" } … --- ## [Log rotation policy](https://discuss.elastic.co/t/log-rotation-policy/256683)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 3\ **Last updated:** [December 1, 2020, 3:17pm UTC](https://discuss.elastic.co/t/log-rotation-policy/256683 "2020-12-01T15:17:39Z")
I have deployed elasticsearch cluster in GCP with one master and data-ingest nodes. What is the default log rotation policy. How frequently logs are rotated? How much logs will be collected in pvc? --- ## [Logstash starts then stops after enabling tcp output config](https://discuss.elastic.co/t/logstash-starts-then-stops-after-enabling-tcp-output-config/257224)
**Author:** [@gprimm](https://discuss.elastic.co/u/gprimm)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 3:11pm UTC](https://discuss.elastic.co/t/logstash-starts-then-stops-after-enabling-tcp-output-config/257224 "2020-12-01T15:11:46Z")
I am trying to send logs to an address listening on a tcp port, but when I add the lines to an output config and restart the logstash service logstash will start for a minute and then fail. There are no errors anywhere a… --- ## [\[Pipeline to Pipeline communication\] - passing pipeline id dinamically to send\_to =\>](https://discuss.elastic.co/t/pipeline-to-pipeline-communication-passing-pipeline-id-dinamically-to-send-to/257222)
**Author:** [@Flavio1](https://discuss.elastic.co/u/Flavio1)\ **Replies:** 1\ **Last updated:** [December 1, 2020, 3:08pm UTC](https://discuss.elastic.co/t/pipeline-to-pipeline-communication-passing-pipeline-id-dinamically-to-send-to/257222 "2020-12-01T15:08:30Z")
Hi everybody, does exist a method to pass the value of pipeline id dinamically in send\_to. in my environment every log has a field with a value corresponding to a pipeline id present in my pipelines.yml. A hoped that wit… --- ## [Logstash not restarting/stoping](https://discuss.elastic.co/t/logstash-not-restarting-stoping/257153)
**Author:** [@PraveenKT](https://discuss.elastic.co/u/PraveenKT)\ **Replies:** 1\ **Last updated:** [December 1, 2020, 2:55pm UTC](https://discuss.elastic.co/t/logstash-not-restarting-stoping/257153 "2020-12-01T14:55:12Z")
Logstash is not restarting/stoping? How do we stop/restart? OS is CentOS 8 Logstash version using : 7.10 ( on previous versions also it is not stoping). \[root@INHY-PAPP-ELK01 conf.d\]# \[root@INHY-PAPP-ELK01 conf.d\]# … --- ## [Truncate filter adds tag even if no fileds were truncated](https://discuss.elastic.co/t/truncate-filter-adds-tag-even-if-no-fileds-were-truncated/257179)
**Author:** [@sarabande](https://discuss.elastic.co/u/sarabande)\ **Replies:** 1\ **Last updated:** [December 1, 2020, 2:34pm UTC](https://discuss.elastic.co/t/truncate-filter-adds-tag-even-if-no-fileds-were-truncated/257179 "2020-12-01T14:34:40Z")
Hi, I'm using truncate filter to truncate messages longer than 32766 bytes. In that case I'd like the tag 'truncated\_message' to be added to the message. This is how I use truncate filter in my logstash configuration: … --- ## [Logstash parse csv file with a column that contains multiple comma separated data points?](https://discuss.elastic.co/t/logstash-parse-csv-file-with-a-column-that-contains-multiple-comma-separated-data-points/256874)
**Author:** [@reillye](https://discuss.elastic.co/u/reillye)\ **Replies:** 7\ **Last updated:** [December 1, 2020, 2:33pm UTC](https://discuss.elastic.co/t/logstash-parse-csv-file-with-a-column-that-contains-multiple-comma-separated-data-points/256874 "2020-12-01T14:33:10Z")
I have a CSV file with multiple entries in the following format (the headers are not included in the actual data): Time, FT Data (2048 entries), SNR, Frequency 430201865, 1000, 2000, 8500,... 4.50, 1266.255 2… --- ## [Pushing data from one elastic search to another elastic search](https://discuss.elastic.co/t/pushing-data-from-one-elastic-search-to-another-elastic-search/257214)
**Author:** [@Nkrb](https://discuss.elastic.co/u/Nkrb)\ **Replies:** 1\ **Last updated:** [December 1, 2020, 2:20pm UTC](https://discuss.elastic.co/t/pushing-data-from-one-elastic-search-to-another-elastic-search/257214 "2020-12-01T14:20:05Z")
Hi, We have a need to pull Elasticsearch data from our environment and push the same to another Elasticsearch database, which is on another environment. Our indices are of time-based pattern, hence data push should be i… --- ## [Elasticsearch stores plain text](https://discuss.elastic.co/t/elasticsearch-stores-plain-text/257212)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 1\ **Last updated:** [December 1, 2020, 2:18pm UTC](https://discuss.elastic.co/t/elasticsearch-stores-plain-text/257212 "2020-12-01T14:18:39Z")
Did elasticsearch allows only to store data in json format? or is to possible to pass plain text to store in elasticsearch? --- ## [Why alias field name does not show in discover mode, and index pattern has created](https://discuss.elastic.co/t/why-alias-field-name-does-not-show-in-discover-mode-and-index-pattern-has-created/257087)
**Author:** [@qub123](https://discuss.elastic.co/u/qub123)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 4:21pm UTC](https://discuss.elastic.co/t/why-alias-field-name-does-not-show-in-discover-mode-and-index-pattern-has-created/257087 "2020-11-30T16:21:01Z")
I have 24 actual fields in each document, and also with alias on each actual field name, so in total 24 aliases with string , number and date type. I also have created index pattern for that, but I am not sure why I am… --- ## [Message Parsing](https://discuss.elastic.co/t/message-parsing/256572)
**Author:** [@droidus](https://discuss.elastic.co/u/droidus)\ **Replies:** 5\ **Last updated:** [December 1, 2020, 1:32pm UTC](https://discuss.elastic.co/t/message-parsing/256572 "2020-12-01T13:32:25Z")
Here is what my logstash output looks like: output { elasticsearch { index =\> "%{\[@metadata\]\[beat\]}" hosts =\> "192.168.0.103" } } Logstash errors are as follows: \[2020-11-18T13:08:12,824\]\[WARN \]\[logstash.c… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1129) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1131)