# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1205 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1206 --- ## [Query for matching and not matching at same level](https://discuss.elastic.co/t/query-for-matching-and-not-matching-at-same-level/251331)
**Author:** [@Gopal\_Chauhan](https://discuss.elastic.co/u/Gopal_Chauhan)\ **Replies:** 1\ **Last updated:** [October 7, 2020, 6:15pm UTC](https://discuss.elastic.co/t/query-for-matching-and-not-matching-at-same-level/251331 "2020-10-07T18:15:42Z")
Hi , I have kind of below data in ES (version 6.2). I am trying to write a query with below condition Addresses.Type="Home" and Addresses.Suspended \<\> "B" and Addresses.Suspended \<\> "Y". these three condition should … --- ## [Would Data Too Large CiricuitBreakingException cause a node to go down?](https://discuss.elastic.co/t/would-data-too-large-ciricuitbreakingexception-cause-a-node-to-go-down/251315)
**Author:** [@Jtomage](https://discuss.elastic.co/u/Jtomage)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 4:44pm UTC](https://discuss.elastic.co/t/would-data-too-large-ciricuitbreakingexception-cause-a-node-to-go-down/251315 "2020-10-07T16:44:53Z")
Currently running Elasticsearch 7.0.1 Going through some logging data after being reported that a node has failed / the search application is not working. I m currently seeing a lot of CircuitBreakingException, Data too… --- ## [ES 7.9.2 showing wrong results for \_cat/allocation API](https://discuss.elastic.co/t/es-7-9-2-showing-wrong-results-for-cat-allocation-api/251324)
**Author:** [@prabhakar\_talari](https://discuss.elastic.co/u/prabhakar_talari)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 5:28pm UTC](https://discuss.elastic.co/t/es-7-9-2-showing-wrong-results-for-cat-allocation-api/251324 "2020-10-07T17:28:00Z")
Hi Team, We have recently installed ES 7.9.2, When i look at the \_cat/allocation API it is showing wrong results for disk.used column. Below are the details shards disk.indices disk.used disk.avail disk.total 6 … --- ## [TSVB Visualization takes only the default index pattern into account](https://discuss.elastic.co/t/tsvb-visualization-takes-only-the-default-index-pattern-into-account/251292)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 4\ **Last updated:** [October 7, 2020, 5:05pm UTC](https://discuss.elastic.co/t/tsvb-visualization-takes-only-the-default-index-pattern-into-account/251292 "2020-10-07T17:05:30Z")
Hi All, I am new to visualizations/ dashboards for Kibana 7.6.2 TSVB Visualization takes only the default index pattern into account. We want to create dashboards containing TSVB visualizations from different index pa… --- ## [Dissect filter plugin to map nested fields](https://discuss.elastic.co/t/dissect-filter-plugin-to-map-nested-fields/251314)
**Author:** [@carlos-bernad](https://discuss.elastic.co/u/carlos-bernad)\ **Replies:** 2\ **Last updated:** [October 7, 2020, 5:01pm UTC](https://discuss.elastic.co/t/dissect-filter-plugin-to-map-nested-fields/251314 "2020-10-07T17:01:11Z")
I am listening to events like this with logstash: {"MYSQL":{"eqp":"ST\_22","eqpId":"TT\_1","label":"MONITOR : BW\_TE\_TRACKING \[20\]","local":"2020-09-23T22:35:29.855+05:00"},"tags":\["MYSQL"\]} My goal is to store it in Mong… --- ## [Error - No handler for type \[wildcard\]](https://discuss.elastic.co/t/error-no-handler-for-type-wildcard/251157)
**Author:** [@ojoaquin](https://discuss.elastic.co/u/ojoaquin)\ **Replies:** 5\ **Last updated:** [October 7, 2020, 4:54pm UTC](https://discuss.elastic.co/t/error-no-handler-for-type-wildcard/251157 "2020-10-07T16:54:56Z")
Hi, I'm trying to experiment with the wildcard field since i'm trying to perform queries over text fields that seem to fit perfectly with the description in this article: https://www.elastic.co/blog/find-strings-within-s… --- ## [Custom css in Kibana 7.6.2](https://discuss.elastic.co/t/custom-css-in-kibana-7-6-2/251213)
**Author:** [@gulshann](https://discuss.elastic.co/u/gulshann)\ **Replies:** 1\ **Last updated:** [October 7, 2020, 4:51pm UTC](https://discuss.elastic.co/t/custom-css-in-kibana-7-6-2/251213 "2020-10-07T16:51:25Z")
Hi, How to change the css style i.e color codes , themes, images and text in Kibana 7.6.2 using elastic EUI. --- ## [Email Domain Normalizer](https://discuss.elastic.co/t/email-domain-normalizer/251316)
**Author:** [@Si\_Si](https://discuss.elastic.co/u/Si_Si)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 4:45pm UTC](https://discuss.elastic.co/t/email-domain-normalizer/251316 "2020-10-07T16:45:30Z")
Anyone know how i would add a searchable domain keyword field in elasticsearch, i tried using patterns but had no luck with it. --- ## [Count active docs and display by date in Line Chart](https://discuss.elastic.co/t/count-active-docs-and-display-by-date-in-line-chart/251129)
**Author:** [@r97](https://discuss.elastic.co/u/r97)\ **Replies:** 5\ **Last updated:** [October 7, 2020, 4:00pm UTC](https://discuss.elastic.co/t/count-active-docs-and-display-by-date-in-line-chart/251129 "2020-10-07T16:00:45Z")
Hi, I have an index with the fields: @timestamp, boolean: active and solved\_date (see below). If I import the values, the solved\_date field is not set and the boolean is true. When I want to make the document inactive… --- ## [Snaphost Creation to S3 for huge indexes](https://discuss.elastic.co/t/snaphost-creation-to-s3-for-huge-indexes/251299)
**Author:** [@awstrain34](https://discuss.elastic.co/u/awstrain34)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 3:47pm UTC](https://discuss.elastic.co/t/snaphost-creation-to-s3-for-huge-indexes/251299 "2020-10-07T15:47:37Z")
Hello All, Looking for suggestions! We have multiple indices in ES with size greater than 8TB. We are trying to create a snapshot of the indices to s3 and then restore it to another cluster. From initial tests, we esti… --- ## [Timestamp field reordering events from patterns?](https://discuss.elastic.co/t/timestamp-field-reordering-events-from-patterns/251249)
**Author:** [@grumo35](https://discuss.elastic.co/u/grumo35)\ **Replies:** 4\ **Last updated:** [October 7, 2020, 3:33pm UTC](https://discuss.elastic.co/t/timestamp-field-reordering-events-from-patterns/251249 "2020-10-07T15:33:45Z")
Hi, Yesterday i cam across something i can't understand. Let's say i stopped my logstash at 10 AM and put it back on at 12, usually logs are coming and re-ordered as normal ( i can't figure how since @timestamp field s… --- ## [Unable to view debug logs](https://discuss.elastic.co/t/unable-to-view-debug-logs/251011)
**Author:** [@rohit\_kumar1](https://discuss.elastic.co/u/rohit_kumar1)\ **Replies:** 4\ **Last updated:** [October 7, 2020, 3:25pm UTC](https://discuss.elastic.co/t/unable-to-view-debug-logs/251011 "2020-10-07T15:25:52Z")
While instrumenting python framework, where to view the debug logs. example: In transport/http.py: there is a call as given below: logger.debug("Sent request, url=%s size=%.2fkb status=%s", url, len(data) / 1024.0, r… --- ## [Extract only certain tags from an XML using XML filter plugin](https://discuss.elastic.co/t/extract-only-certain-tags-from-an-xml-using-xml-filter-plugin/251277)
**Author:** [@HariniGajendran](https://discuss.elastic.co/u/HariniGajendran)\ **Replies:** 2\ **Last updated:** [October 7, 2020, 3:21pm UTC](https://discuss.elastic.co/t/extract-only-certain-tags-from-an-xml-using-xml-filter-plugin/251277 "2020-10-07T15:21:05Z")
Hi, I am using XML filter to extract certain tags from an XML input. But the filter doesnt seem to be working correctly. PFB sample XML. \ **Author:** [@OmarDacca](https://discuss.elastic.co/u/OmarDacca)\ **Replies:** 1\ **Last updated:** [October 7, 2020, 2:41pm UTC](https://discuss.elastic.co/t/query-optimization/251258 "2020-10-07T14:41:20Z") We have Elastic v 7.8.0 We have monthly indices for each client, i.e: client\_data\_{cliendId}\_2020-09. 1 primary shard, 1 replica for each index. One of the queries are taking too much time, and I'm trying understand w… --- ## [Searching word with special characters](https://discuss.elastic.co/t/searching-word-with-special-characters/251244)
**Author:** [@Kevin\_Juliano](https://discuss.elastic.co/u/Kevin_Juliano)\ **Replies:** 6\ **Last updated:** [October 7, 2020, 2:33pm UTC](https://discuss.elastic.co/t/searching-word-with-special-characters/251244 "2020-10-07T14:33:32Z")
Hi! I am having a little problem, I wanted to search a word on elasticsearch but the result that I am expecting is not coming up because it has a tailing special character. Here’s an example: The result that I want to … --- ## [Proper way to remove external access from Kibana or Elasticsearch resource](https://discuss.elastic.co/t/proper-way-to-remove-external-access-from-kibana-or-elasticsearch-resource/251283)
**Author:** [@zvazquez](https://discuss.elastic.co/u/zvazquez)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 2:12pm UTC](https://discuss.elastic.co/t/proper-way-to-remove-external-access-from-kibana-or-elasticsearch-resource/251283 "2020-10-07T14:12:22Z")
Hi, We are in the process to enhance our Elasticsearch deployment within Kubernetes, we use the ECK tool to deploy elasticsearch and Kibana and in our original deployment we used the "http" tag to expose Elasticsearch a… --- ## [Importing ruby class fails in the ruby plugin](https://discuss.elastic.co/t/importing-ruby-class-fails-in-the-ruby-plugin/251281)
**Author:** [@thdesy](https://discuss.elastic.co/u/thdesy)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 2:01pm UTC](https://discuss.elastic.co/t/importing-ruby-class-fails-in-the-ruby-plugin/251281 "2020-10-07T14:01:36Z")
Hi all, I am trying to use/offload some Ruby code in a filter to process XML events (due to various reasons, I have to move away from the XML input plugin). The problem is, that the import of 'nori' class fails within … --- ## [Index Block Read - Elasticsearch](https://discuss.elastic.co/t/index-block-read-elasticsearch/251280)
**Author:** [@Luan\_Souza](https://discuss.elastic.co/u/Luan_Souza)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 1:50pm UTC](https://discuss.elastic.co/t/index-block-read-elasticsearch/251280 "2020-10-07T13:50:09Z")
Hello everyone I was trying to apply a case to elasticsearch by manipulating the index.block.read settings. The idea is the following, as long as the logstash is loading data into a new index, this index remains blocke… --- ## [Join 2 indexes with 1 primary key logstash filter elasticsearch](https://discuss.elastic.co/t/join-2-indexes-with-1-primary-key-logstash-filter-elasticsearch/251279)
**Author:** [@charles97](https://discuss.elastic.co/u/charles97)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 1:43pm UTC](https://discuss.elastic.co/t/join-2-indexes-with-1-primary-key-logstash-filter-elasticsearch/251279 "2020-10-07T13:43:09Z")
So tried to join a transfrom index to index table. I saw this as reference : How to join fields from multi events into single event? and it seems like it should work by using elasticsearch filter plugin. transform index… --- ## [Sum / Aggregations - Kibana/Logstash](https://discuss.elastic.co/t/sum-aggregations-kibana-logstash/251214)
**Author:** [@jafri6](https://discuss.elastic.co/u/jafri6)\ **Replies:** 6\ **Last updated:** [October 7, 2020, 1:12pm UTC](https://discuss.elastic.co/t/sum-aggregations-kibana-logstash/251214 "2020-10-07T13:12:41Z")
I am working on a project where the log data can be used to determine a user's performance everyday. The work users do is converting physical documents to digital ones. I have successfully loaded the data into elasticse… --- ## [Issues with GeopIP resolution](https://discuss.elastic.co/t/issues-with-geopip-resolution/251192)
**Author:** [@Roman\_Kournjaev](https://discuss.elastic.co/u/Roman_Kournjaev)\ **Replies:** 4\ **Last updated:** [October 7, 2020, 12:57pm UTC](https://discuss.elastic.co/t/issues-with-geopip-resolution/251192 "2020-10-07T12:57:27Z")
I have issues with GeoIP resolution I have a Google Cloud IP address that resolves in Elasticsearch to "geo" : { "continent\_name" : "North America", "country\_iso\_code" : "US", "location" : { … --- ## [Add policy to indextemplate index templates names are unsorted and not easy to use](https://discuss.elastic.co/t/add-policy-to-indextemplate-index-templates-names-are-unsorted-and-not-easy-to-use/251272)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 12:52pm UTC](https://discuss.elastic.co/t/add-policy-to-indextemplate-index-templates-names-are-unsorted-and-not-easy-to-use/251272 "2020-10-07T12:52:55Z")
I have elastic and kibana v"7.9.2" When I want to add ILM to index template by going to ILM-\>action-\>add\_policy\_to\_index button I receive the screen - see attached screenshot the index templates are in unsorted order … --- ## [User password](https://discuss.elastic.co/t/user-password/251268)
**Author:** [@WLM](https://discuss.elastic.co/u/WLM)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 12:22pm UTC](https://discuss.elastic.co/t/user-password/251268 "2020-10-07T12:22:11Z")
How can I prevent a user from changing his password through curl in elasticsearch? How to track from what height the password in elasticsearch was changed using curl? --- ## [Case Connectors](https://discuss.elastic.co/t/case-connectors/250733)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [October 7, 2020, 12:10pm UTC](https://discuss.elastic.co/t/case-connectors/250733 "2020-10-07T12:10:00Z")
Hello, Really like the Kibana case functionality. Unfortunately we aren't working with any of the supported case connector tools. Out ITSM tool is Ivanti Heat, which is not a small player in the ITSM market, see: I… --- ## [Dashboard for file access logs](https://discuss.elastic.co/t/dashboard-for-file-access-logs/251260)
**Author:** [@Craig2188](https://discuss.elastic.co/u/Craig2188)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 11:47am UTC](https://discuss.elastic.co/t/dashboard-for-file-access-logs/251260 "2020-10-07T11:47:16Z")
Hi, We are being tasked with pushing event logs for file access to Kibana: Winlogbeat \> Logstash \> ES/Kibana I will filter it down to specific Event ID's in the winlog YML file and then let it run for 30 days to colla… --- ## [Elastic Search - Load balancer - AWS Cloud](https://discuss.elastic.co/t/elastic-search-load-balancer-aws-cloud/251123)
**Author:** [@Learner4](https://discuss.elastic.co/u/Learner4)\ **Replies:** 1\ **Last updated:** [October 7, 2020, 1:52am UTC](https://discuss.elastic.co/t/elastic-search-load-balancer-aws-cloud/251123 "2020-10-07T01:52:06Z")
Assuming there are two ACTIVE CLUSTERS in two different REGIONS in Elastic Search and both are receiving data and both the Regions having GSLB Configuration in place. I want to switch the network to Active Region automa… --- ## [\_source always zero in cardinality aggregation](https://discuss.elastic.co/t/source-always-zero-in-cardinality-aggregation/250677)
**Author:** [@autogenerated\_id](https://discuss.elastic.co/u/autogenerated_id)\ **Replies:** 11\ **Last updated:** [October 7, 2020, 10:59am UTC](https://discuss.elastic.co/t/source-always-zero-in-cardinality-aggregation/250677 "2020-10-07T10:59:02Z")
Hi! I've come across something that looks like a bug. When \_score is used in a cardinality aggregation, it always returns 0, no matter what the actual document scores are. Here's an example that illustrates it. A funct… --- ## [ES crash with fatal error on search thread](https://discuss.elastic.co/t/es-crash-with-fatal-error-on-search-thread/251125)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 3\ **Last updated:** [October 7, 2020, 10:58am UTC](https://discuss.elastic.co/t/es-crash-with-fatal-error-on-search-thread/251125 "2020-10-07T10:58:12Z")
hi, I tried a query with AND operator but ES crashed everytime with the following stacktrace error: \[2020-10-06T14:45:54,221\]\[ERROR\]\[o.e.b.ElasticsearchUncaughtExceptionHandler\] \[node1\] fatal error in thread \[elasticse… --- ## [Nested json inside a json also getting parsed into different fields using JSON Filter Plugin](https://discuss.elastic.co/t/nested-json-inside-a-json-also-getting-parsed-into-different-fields-using-json-filter-plugin/250939)
**Author:** [@ParashB](https://discuss.elastic.co/u/ParashB)\ **Replies:** 4\ **Last updated:** [October 7, 2020, 10:27am UTC](https://discuss.elastic.co/t/nested-json-inside-a-json-also-getting-parsed-into-different-fields-using-json-filter-plugin/250939 "2020-10-07T10:27:33Z")
Hi, I have a nested JSON inside a JSON field which is also getting parsed. I do not want to parse the nested JSON. example json: log : {"name":"abc","location":{"city":"New York","country":"US"}} Logstash filter: jso… --- ## [DHCP Logs to Logstash](https://discuss.elastic.co/t/dhcp-logs-to-logstash/250777)
**Author:** [@Craig2188](https://discuss.elastic.co/u/Craig2188)\ **Replies:** 8\ **Last updated:** [October 7, 2020, 10:03am UTC](https://discuss.elastic.co/t/dhcp-logs-to-logstash/250777 "2020-10-07T10:03:06Z")
I plan to use Filebeat to send the DHCP log file to Logstash. I have the following setup in Logstash to send the file to Elasticsearch: # Beats -\> Logstash -\> Elasticsearch pipeline. input { beats { port =\> 5044… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1204) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1206)