# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1227 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1228 --- ## [Performance for small index](https://discuss.elastic.co/t/performance-for-small-index/249329)
**Author:** [@Mathmarc](https://discuss.elastic.co/u/Mathmarc)\ **Replies:** 6\ **Last updated:** [September 22, 2020, 5:54am UTC](https://discuss.elastic.co/t/performance-for-small-index/249329 "2020-09-22T05:54:55Z")
Hi everyone, I have multiple question about the optimization of a cluster with: running on c5.xlarge (4cpu 8GB ram) huge read req/s and small write req/s. small index 20GB to 30GB. experimenting shard between 1GB to … --- ## [Kibana-7.8.1-1. Csv separator doesn't work in the Discovery -\> Share -\> CSV Reports](https://discuss.elastic.co/t/kibana-7-8-1-1-csv-separator-doesnt-work-in-the-discovery-share-csv-reports/248996)
**Author:** [@dsv](https://discuss.elastic.co/u/dsv)\ **Replies:** 1\ **Last updated:** [September 22, 2020, 6:30am UTC](https://discuss.elastic.co/t/kibana-7-8-1-1-csv-separator-doesnt-work-in-the-discovery-share-csv-reports/248996 "2020-09-22T06:30:33Z")
In Advanced settings the "CSV separator" is set to "backquote". And it works in the Visualize -\> "Export: Formatted". When i trying to export search results in the Discovery -\> Share -\> CSV Reports the format of the… --- ## [Logstash Events Latency using Stats API](https://discuss.elastic.co/t/logstash-events-latency-using-stats-api/249444)
**Author:** [@8wlgns](https://discuss.elastic.co/u/8wlgns)\ **Replies:** 0\ **Last updated:** [September 22, 2020, 5:14am UTC](https://discuss.elastic.co/t/logstash-events-latency-using-stats-api/249444 "2020-09-22T05:14:48Z")
I want to calculate Event duration per millisecond using logstash events stats api. Could I use events.out / events.duration\_in\_millis ? --- ## [Regarding NanoSecond Timestamps](https://discuss.elastic.co/t/regarding-nanosecond-timestamps/249320)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 1\ **Last updated:** [September 22, 2020, 6:17am UTC](https://discuss.elastic.co/t/regarding-nanosecond-timestamps/249320 "2020-09-22T06:17:37Z")
Hi, We have environments running elasticsearch/kibana 7.2.x. We have a need to enable nanosecond timestamps. What will be the effect on kibana of that change as it doesn't seem to be a supported type until 7.3.0? Thx D … --- ## [Difference between saved searches and saved queries](https://discuss.elastic.co/t/difference-between-saved-searches-and-saved-queries/249446)
**Author:** [@eviatt](https://discuss.elastic.co/u/eviatt)\ **Replies:** 1\ **Last updated:** [September 22, 2020, 6:14am UTC](https://discuss.elastic.co/t/difference-between-saved-searches-and-saved-queries/249446 "2020-09-22T06:14:14Z")
Hi Community Could someone explain me, whats the difference between saved searches and saved queries? Thanks --- ## [ECK - DISASTER RECOVERY](https://discuss.elastic.co/t/eck-disaster-recovery/249001)
**Author:** [@aman26ps](https://discuss.elastic.co/u/aman26ps)\ **Replies:** 2\ **Last updated:** [September 22, 2020, 6:07am UTC](https://discuss.elastic.co/t/eck-disaster-recovery/249001 "2020-09-22T06:07:54Z")
Hi Team, I have a very generic question here, hoping anyone can help here. I am looking for DR solution for ECK 1.2.1, preferably opensource. i have gone through couple of articles regarding cross cluster replication, … --- ## [ECK - "master not discovered yet, this node has not previously joined a bootstrapped (v7+) cluster](https://discuss.elastic.co/t/eck-master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster/237910)
**Author:** [@aman26ps](https://discuss.elastic.co/u/aman26ps)\ **Replies:** 3\ **Last updated:** [September 22, 2020, 6:06am UTC](https://discuss.elastic.co/t/eck-master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster/237910 "2020-09-22T06:06:38Z")
Hi team, We are facing a strange issue where when we are giving master node count in the elasticsearch Custom resource more than 1, the master nodes are not able to elect the master, we have tried giving odd numbers upt… --- ## [Sending syslog logs through logstash](https://discuss.elastic.co/t/sending-syslog-logs-through-logstash/249442)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [September 22, 2020, 5:07am UTC](https://discuss.elastic.co/t/sending-syslog-logs-through-logstash/249442 "2020-09-22T05:07:04Z")
I've configure rsyslog server logs are coming at the server side input { tcp { port =\> 10514 } } output { elasticsearch { hosts =\> "localhost:9200" index =\> "client-syslog-%{+YYYY.MM.dd}" } } the rsyslog logs are com… --- ## [Kiban metric ui bug](https://discuss.elastic.co/t/kiban-metric-ui-bug/249437)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 1\ **Last updated:** [September 22, 2020, 4:56am UTC](https://discuss.elastic.co/t/kiban-metric-ui-bug/249437 "2020-09-22T04:56:26Z")
kibana:7.8.0 --- ## [How to prevent Elasticsearch match on only one character with multi\_match](https://discuss.elastic.co/t/how-to-prevent-elasticsearch-match-on-only-one-character-with-multi-match/249441)
**Author:** [@EHH](https://discuss.elastic.co/u/EHH)\ **Replies:** 0\ **Last updated:** [September 22, 2020, 4:15am UTC](https://discuss.elastic.co/t/how-to-prevent-elasticsearch-match-on-only-one-character-with-multi-match/249441 "2020-09-22T04:15:43Z")
Hi there, I'm using elasiticsearch-dsl and SmartCN analyzer: from elasticsearch\_dsl import analyzer analyzer\_cn = analyzer( 'smartcn', tokenizer=tokenizer('smartcn\_tokenizer'), filter=\['lowercase'\] ) And I… --- ## [Logstash data transformation or Kibana scripted field?](https://discuss.elastic.co/t/logstash-data-transformation-or-kibana-scripted-field/249435)
**Author:** [@kimjavier43](https://discuss.elastic.co/u/kimjavier43)\ **Replies:** 2\ **Last updated:** [September 22, 2020, 4:12am UTC](https://discuss.elastic.co/t/logstash-data-transformation-or-kibana-scripted-field/249435 "2020-09-22T04:12:40Z")
Consider this data that I'm going to index in elastic search. Should I implement it using logstash transformation or kibana scripted field? Which is the best practice? Data mapping: 1 = apple 2 = orange 3 = mango El… --- ## [Interval and timestamp does not work as expected](https://discuss.elastic.co/t/interval-and-timestamp-does-not-work-as-expected/247345)
**Author:** [@Redcxx](https://discuss.elastic.co/u/Redcxx)\ **Replies:** 8\ **Last updated:** [September 22, 2020, 4:02am UTC](https://discuss.elastic.co/t/interval-and-timestamp-does-not-work-as-expected/247345 "2020-09-22T04:02:39Z")
Hi currently it is Sep 03 09:38 here, the explore tab shows that there is data of timestamp Sep 02 10:03, I set the interval in TSVB for 1d but there is no data, in fact it shows nothing for 2d as well. The data appear w… --- ## [Can't use scripted field in some visualisations](https://discuss.elastic.co/t/cant-use-scripted-field-in-some-visualisations/249432)
**Author:** [@Slavik\_Fursov](https://discuss.elastic.co/u/Slavik_Fursov)\ **Replies:** 1\ **Last updated:** [September 22, 2020, 3:49am UTC](https://discuss.elastic.co/t/cant-use-scripted-field-in-some-visualisations/249432 "2020-09-22T03:49:08Z")
I added scripted field "visitor" to my filibeat-\* pattern. doc\['source.address'\].value + '-' + doc\['user\_agent.original'\].value It works and I use it in some visualizations, for example in LINE. But, when I tried to u… --- ## [Invalid response for \_forcemerge, \_cache/clear APIs when unassigned shards](https://discuss.elastic.co/t/invalid-response-for-forcemerge-cache-clear-apis-when-unassigned-shards/248901)
**Author:** [@setiah](https://discuss.elastic.co/u/setiah)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 11:58pm UTC](https://discuss.elastic.co/t/invalid-response-for-forcemerge-cache-clear-apis-when-unassigned-shards/248901 "2020-09-21T23:58:42Z")
Hi, Issue When \_forcemerge is tried on an index or a group of indices that has some unassigned shards, the response returned does not indicate failures for unassigned shards. Even the total, failed and successful count… --- ## [Multiple version of filebeat in search impact](https://discuss.elastic.co/t/multiple-version-of-filebeat-in-search-impact/249361)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 9:31pm UTC](https://discuss.elastic.co/t/multiple-version-of-filebeat-in-search-impact/249361 "2020-09-21T21:31:29Z")
Hi, Our existing filebeat version (in staging) is 7.8.0 where we create a lot of visualization through it (using filebeat-\* index pattern) Most of this visualization is aggregation in terms using the agent.hostname and… --- ## [Adding new field to the mapping template](https://discuss.elastic.co/t/adding-new-field-to-the-mapping-template/249102)
**Author:** [@YvorL](https://discuss.elastic.co/u/YvorL)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 9:22pm UTC](https://discuss.elastic.co/t/adding-new-field-to-the-mapping-template/249102 "2020-09-21T21:22:49Z")
Hi, From time to time, I need to add a new field to my templates (mostly daily indices). Is there an easy way to apply that to an existing index? Thank you! --- ## [Update returned values in response](https://discuss.elastic.co/t/update-returned-values-in-response/249376)
**Author:** [@Cyril\_Guiet](https://discuss.elastic.co/u/Cyril_Guiet)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 9:08pm UTC](https://discuss.elastic.co/t/update-returned-values-in-response/249376 "2020-09-21T21:08:01Z")
Hello ! after my query I would like to know if it's possible to update the "instanceof" values by there labels equivalents ( municipalities and cities of Serbia == Q783930 ) . Thanks :slight\_smile: returned answer sam… --- ## [Matrix aggregate question](https://discuss.elastic.co/t/matrix-aggregate-question/249421)
**Author:** [@Aldo\_Sarmiento](https://discuss.elastic.co/u/Aldo_Sarmiento)\ **Replies:** 0\ **Last updated:** [September 21, 2020, 8:41pm UTC](https://discuss.elastic.co/t/matrix-aggregate-question/249421 "2020-09-21T20:41:52Z")
Hello I'm having a hard time figuring out if the aggregate functions would be able to achieve what I'm trying to do. It's hard to explain in text format, but I created a simple image: https://imgur.com/a/YPXmrBI Basical… --- ## [High Heap Usage](https://discuss.elastic.co/t/high-heap-usage/249060)
**Author:** [@yasir\_khatri](https://discuss.elastic.co/u/yasir_khatri)\ **Replies:** 3\ **Last updated:** [September 21, 2020, 8:31pm UTC](https://discuss.elastic.co/t/high-heap-usage/249060 "2020-09-21T20:31:43Z")
We are using single node of elasticsearch v7.9.1 with 3.0 Tb of data. The rollover size is 10 gb 3 shards per index, that makes in 3.33 gb per shard. I need help troubleshooting these issues: The heap usage is always … --- ## [Index only and do not store in source](https://discuss.elastic.co/t/index-only-and-do-not-store-in-source/249283)
**Author:** [@Ankit\_Mangal](https://discuss.elastic.co/u/Ankit_Mangal)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 7:31pm UTC](https://discuss.elastic.co/t/index-only-and-do-not-store-in-source/249283 "2020-09-21T19:31:37Z")
I was looking for a feature where i can pass first name, last name as plain string to Elasticsearch and just index these fields so i can search but do not store them in source (Due to PII data). Came across this copy\_to … --- ## [Logstash - Can't get text on a START\_OBJECT](https://discuss.elastic.co/t/logstash-cant-get-text-on-a-start-object/249400)
**Author:** [@bruno\_aleixo](https://discuss.elastic.co/u/bruno_aleixo)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 7:15pm UTC](https://discuss.elastic.co/t/logstash-cant-get-text-on-a-start-object/249400 "2020-09-21T19:15:36Z")
Hi, could help me with errors at the logstash \[2020-09-21T13:48:42,854\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>nil, :\_index=\>"apimanager-2… --- ## [How to connect to DB2 using JDBC with securityMechanism=13](https://discuss.elastic.co/t/how-to-connect-to-db2-using-jdbc-with-securitymechanism-13/249410)
**Author:** [@fsilveir](https://discuss.elastic.co/u/fsilveir)\ **Replies:** 0\ **Last updated:** [September 21, 2020, 6:40pm UTC](https://discuss.elastic.co/t/how-to-connect-to-db2-using-jdbc-with-securitymechanism-13/249410 "2020-09-21T18:40:18Z")
Hi there, I'm trying to extract some data from a DB2 database with securityMechanism 13. I've tried passing this parameter as part of the connection string as shown below: input { jdbc { jdbc\_connection\_string =\> … --- ## [Pipeline Delay 7.9](https://discuss.elastic.co/t/pipeline-delay-7-9/249148)
**Author:** [@AleksandrN](https://discuss.elastic.co/u/AleksandrN)\ **Replies:** 10\ **Last updated:** [September 21, 2020, 5:44pm UTC](https://discuss.elastic.co/t/pipeline-delay-7-9/249148 "2020-09-21T17:44:51Z")
Hello everyone, I have such work bench: 3 nodes of Elastic 1 node of Logstash 1 node of Kibana 1 Winlogbeat agent The Winlogbeat agent ships logs from the Windows machine, that collecting logs from all of my company… --- ## [How to install ELK in a raspberry PI](https://discuss.elastic.co/t/how-to-install-elk-in-a-raspberry-pi/249281)
**Author:** [@javidr](https://discuss.elastic.co/u/javidr)\ **Replies:** 5\ **Last updated:** [September 21, 2020, 6:04pm UTC](https://discuss.elastic.co/t/how-to-install-elk-in-a-raspberry-pi/249281 "2020-09-21T18:04:18Z")
Hi Im trying to install ELK in a raspberry PI and i have little success by now. I have installed the package via apt-get install, and the java version is not compatible. I have downgraded java to jre8 and i have problem… --- ## [Master Elasticsearch node on same host as data node?](https://discuss.elastic.co/t/master-elasticsearch-node-on-same-host-as-data-node/249149)
**Author:** [@dshih](https://discuss.elastic.co/u/dshih)\ **Replies:** 5\ **Last updated:** [September 21, 2020, 6:03pm UTC](https://discuss.elastic.co/t/master-elasticsearch-node-on-same-host-as-data-node/249149 "2020-09-21T18:03:11Z")
Is there any benefit to enabling Elasticsearch master nodes if they will run on the same hosts as a data nodes? Background My company ships a product with a hosted (AWS-based) and on-premises offering. For hosted, we … --- ## [How to query for anomalous state changes based on duration](https://discuss.elastic.co/t/how-to-query-for-anomalous-state-changes-based-on-duration/248551)
**Author:** [@ehausig1](https://discuss.elastic.co/u/ehausig1)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 5:44pm UTC](https://discuss.elastic.co/t/how-to-query-for-anomalous-state-changes-based-on-duration/248551 "2020-09-21T17:44:06Z")
I'm trying to determine if there is a way that I can query an Elasticsearch index for a particular data anomaly we sometimes encounter. Here is a contrived example of the dataset (with some annotations): \[ { "\_id… --- ## [Warning about ambiguous (mutate filter + split)](https://discuss.elastic.co/t/warning-about-ambiguous-mutate-filter-split/248881)
**Author:** [@dooger21](https://discuss.elastic.co/u/dooger21)\ **Replies:** 3\ **Last updated:** [September 21, 2020, 4:33pm UTC](https://discuss.elastic.co/t/warning-about-ambiguous-mutate-filter-split/248881 "2020-09-21T16:33:12Z")
Hi everyone, I have a Log that I read using the file plugin and the multiline codec (so far so good), I separate the columns that I want to get using a mutate and split in the filter, however in the execution of my .con… --- ## [How to match IP address to hostname (dns filter)](https://discuss.elastic.co/t/how-to-match-ip-address-to-hostname-dns-filter/246988)
**Author:** [@lilyyy](https://discuss.elastic.co/u/lilyyy)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 4:26pm UTC](https://discuss.elastic.co/t/how-to-match-ip-address-to-hostname-dns-filter/246988 "2020-09-21T16:26:30Z")
Hi all, I'm trying to match the IP address to hostname. Data is json file and it is originally pcap file. I used dns filter in logstash.conf file. mutate { add\_field =\> { "src\_hostname" =\> "%{\[layers\]\[ip\]\[ip\_ip\_sr… --- ## [Grok Syntax](https://discuss.elastic.co/t/grok-syntax/249372)
**Author:** [@kotis](https://discuss.elastic.co/u/kotis)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 4:13pm UTC](https://discuss.elastic.co/t/grok-syntax/249372 "2020-09-21T16:13:26Z")
Hi all :slight\_smile: , I need help with a log file that I need to make a filter from it but I can't since I am not very experienced with grok.. The log is like 2020-07-27 03:04:04,708 INFO hosty.bow.hh.hsw\_5421 Targ… --- ## [Update values by curl cmd](https://discuss.elastic.co/t/update-values-by-curl-cmd/249386)
**Author:** [@Cyril\_Guiet](https://discuss.elastic.co/u/Cyril_Guiet)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 3:59pm UTC](https://discuss.elastic.co/t/update-values-by-curl-cmd/249386 "2020-09-21T15:59:18Z")
Hello ! Can I update the "instanceof" values by there equivalents labels ( municipalities and cities of Serbia == Q783930 ) by curl API ? Thanks :slight\_smile: returned answer sample: { "\_index" : "enwiki\_latest", … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1226) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1228)