# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1256 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1257 --- ## [Wildcard queries on multiple fields and filtering by score](https://discuss.elastic.co/t/wildcard-queries-on-multiple-fields-and-filtering-by-score/247079)
**Author:** [@zamkinos](https://discuss.elastic.co/u/zamkinos)\ **Replies:** 0\ **Last updated:** [September 1, 2020, 11:22am UTC](https://discuss.elastic.co/t/wildcard-queries-on-multiple-fields-and-filtering-by-score/247079 "2020-09-01T11:22:31Z")
I have an index like below: For example user searchs "c 001", I look at search\_all\_fields and find it in two documents. With WildCardQuery for all searching keywords " c " and " 001 " But the second one is useless. … --- ## [Remove ignore\_above default mapping from logstash instead of changing it to each index from elastic search](https://discuss.elastic.co/t/remove-ignore-above-default-mapping-from-logstash-instead-of-changing-it-to-each-index-from-elastic-search/247077)
**Author:** [@Radha](https://discuss.elastic.co/u/Radha)\ **Replies:** 0\ **Last updated:** [September 1, 2020, 11:12am UTC](https://discuss.elastic.co/t/remove-ignore-above-default-mapping-from-logstash-instead-of-changing-it-to-each-index-from-elastic-search/247077 "2020-09-01T11:12:37Z")
Hello, I am having some multiple indexes and logs are being filtered in logstash and sending to elastic search and kibana, when I see in elastic searching mapping some text/keyword fields but with additional property o… --- ## [In\_flight\_request is too large and throw \[circuit\_breaking\_exception\] \[parent\] Data too large](https://discuss.elastic.co/t/in-flight-request-is-too-large-and-throw-circuit-breaking-exception-parent-data-too-large/246482)
**Author:** [@greyhats13](https://discuss.elastic.co/u/greyhats13)\ **Replies:** 25\ **Last updated:** [September 1, 2020, 10:21am UTC](https://discuss.elastic.co/t/in-flight-request-is-too-large-and-throw-circuit-breaking-exception-parent-data-too-large/246482 "2020-09-01T10:21:05Z")
{"statusCode":500,"error":"Internal Server Error","message":"\[parent\] Data too large, data for \[indices:data/read/get\[s\]\] would be \[32115499902/29.9gb\], which is larger than the limit of \[31621696716/29.4gb\], real usage:… --- ## [Shards unassigned after some nodes went down](https://discuss.elastic.co/t/shards-unassigned-after-some-nodes-went-down/246734)
**Author:** [@tmporary](https://discuss.elastic.co/u/tmporary)\ **Replies:** 7\ **Last updated:** [September 1, 2020, 9:51am UTC](https://discuss.elastic.co/t/shards-unassigned-after-some-nodes-went-down/246734 "2020-09-01T09:51:26Z")
Hi, We have a ES cluster consisted of 6 nodes, 3 in one data center 3 in another data center. Each of them is master eligible but 4 are data nodes. We have 3 indices, each has 5 primary shards with 1 replica. Now due to… --- ## [Drop grok failures](https://discuss.elastic.co/t/drop-grok-failures/246476)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 9\ **Last updated:** [September 1, 2020, 9:46am UTC](https://discuss.elastic.co/t/drop-grok-failures/246476 "2020-09-01T09:46:42Z")
I use Logstash to filter data from big files like mysqld.log and mongos.log. It receives thousands of entries from these logs and I use grok to filter data and display it in Kibana. There are many entries that logstash … --- ## [Levenshtein distance of 2 handles same Token differently?](https://discuss.elastic.co/t/levenshtein-distance-of-2-handles-same-token-differently/247065)
**Author:** [@as\_ES](https://discuss.elastic.co/u/as_ES)\ **Replies:** 0\ **Last updated:** [September 1, 2020, 9:07am UTC](https://discuss.elastic.co/t/levenshtein-distance-of-2-handles-same-token-differently/247065 "2020-09-01T09:07:25Z")
Hi, I created two indices with the exact same mapping. The specific field has an EdgeNGram Tokenizer (Min:1 Max:50, keeping only Letters and Digits) and an analyzer with "lowercase", "asciifolding" and "synonym" filters… --- ## [Logstash - Configuring Two output plugin](https://discuss.elastic.co/t/logstash-configuring-two-output-plugin/247059)
**Author:** [@tamilarasanbravo](https://discuss.elastic.co/u/tamilarasanbravo)\ **Replies:** 1\ **Last updated:** [September 1, 2020, 8:52am UTC](https://discuss.elastic.co/t/logstash-configuring-two-output-plugin/247059 "2020-09-01T08:52:20Z")
Hi Team, Currently, I have an output plugin configured as below. I am looking for another output method to send it to mongodb. input { http { host =\> "10.199.208.43" port =\> "8080" type =\> "… --- ## [Doc count with Path Hierarchy](https://discuss.elastic.co/t/doc-count-with-path-hierarchy/247062)
**Author:** [@Arun\_Kumar5](https://discuss.elastic.co/u/Arun_Kumar5)\ **Replies:** 0\ **Last updated:** [September 1, 2020, 8:34am UTC](https://discuss.elastic.co/t/doc-count-with-path-hierarchy/247062 "2020-09-01T08:34:11Z")
A index doc can belongs to multiple group (path) and i aggregated search result based on group like below: below doc have two path as you can see in nested structure: "NavigationCollection": \[ { "LangId": 1, "Path":… --- ## [Query to get one doc out of its duplicate](https://discuss.elastic.co/t/query-to-get-one-doc-out-of-its-duplicate/246396)
**Author:** [@Manikantaks](https://discuss.elastic.co/u/Manikantaks)\ **Replies:** 2\ **Last updated:** [September 1, 2020, 7:33am UTC](https://discuss.elastic.co/t/query-to-get-one-doc-out-of-its-duplicate/246396 "2020-09-01T07:33:39Z")
I have ELK set up . In specific index there are around 70Lac records , out of which some are duplicates . I need to create a filter in kibana so that only uniq records should be return. I need to check for two field for… --- ## [Creating "prod" cluster with ingest nodes?](https://discuss.elastic.co/t/creating-prod-cluster-with-ingest-nodes/247007)
**Author:** [@Andreas\_Falk](https://discuss.elastic.co/u/Andreas_Falk)\ **Replies:** 6\ **Last updated:** [September 1, 2020, 7:25am UTC](https://discuss.elastic.co/t/creating-prod-cluster-with-ingest-nodes/247007 "2020-09-01T07:25:30Z")
Hi, We are going to expand our test cluster with 3 "everything" nodes to split up ingest/master and data roles. We are mostly a logcluster with winlogbeat and filebeats. Something like this (sketch from supper table) :… --- ## [Index alias with wildcard?](https://discuss.elastic.co/t/index-alias-with-wildcard/247026)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 5\ **Last updated:** [September 1, 2020, 6:36am UTC](https://discuss.elastic.co/t/index-alias-with-wildcard/247026 "2020-09-01T06:36:05Z")
Hello, I am creating a daily index. Indices look like the following my-index-2020-08-31 my-index-2020-08-30 my-index-2020-08-29 my-index-yyyy-mm-dd Is t possible to add to the template an index alias with wildcard? … --- ## [Alternative for mapping type](https://discuss.elastic.co/t/alternative-for-mapping-type/246972)
**Author:** [@Nupur](https://discuss.elastic.co/u/Nupur)\ **Replies:** 5\ **Last updated:** [September 1, 2020, 5:53am UTC](https://discuss.elastic.co/t/alternative-for-mapping-type/246972 "2020-09-01T05:53:22Z")
what is the best way to index data when i have two types .. and only one field in data is different based on the type. I have 4-5 fields for a single doc. is it good to use single index or two indexes . each for a type … --- ## [Add custom log files to stdout](https://discuss.elastic.co/t/add-custom-log-files-to-stdout/246950)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 12\ **Last updated:** [September 1, 2020, 5:52am UTC](https://discuss.elastic.co/t/add-custom-log-files-to-stdout/246950 "2020-09-01T05:52:37Z")
How can we add a custom log file to stdout. For example, can we add all the logs in /var/log folder . If possible, how can we achieve that? --- ## [Kibana discover shows disabled fields in "available fields" list](https://discuss.elastic.co/t/kibana-discover-shows-disabled-fields-in-available-fields-list/246806)
**Author:** [@Limus\_Anusauskas](https://discuss.elastic.co/u/Limus_Anusauskas)\ **Replies:** 2\ **Last updated:** [September 1, 2020, 5:47am UTC](https://discuss.elastic.co/t/kibana-discover-shows-disabled-fields-in-available-fields-list/246806 "2020-09-01T05:47:24Z")
I specifically used index mapping to disable some high cardinality fields: "siteEntity": { "properties": { "defaultPlacementsForMediaType": { "type": "object", … --- ## [How to make single jdbc connection to sql server in logstash configuration instead of making connection everytime to each table](https://discuss.elastic.co/t/how-to-make-single-jdbc-connection-to-sql-server-in-logstash-configuration-instead-of-making-connection-everytime-to-each-table/247045)
**Author:** [@tharak](https://discuss.elastic.co/u/tharak)\ **Replies:** 0\ **Last updated:** [September 1, 2020, 5:44am UTC](https://discuss.elastic.co/t/how-to-make-single-jdbc-connection-to-sql-server-in-logstash-configuration-instead-of-making-connection-everytime-to-each-table/247045 "2020-09-01T05:44:04Z")
I have 10 sql tables in my database, to index all those tables data i have logstash configuration where i am making jdbc connection to each and every table. Instead of doing that how can i make a connection only once to … --- ## [Cluster is down on 2 nodes server high disk watermark](https://discuss.elastic.co/t/cluster-is-down-on-2-nodes-server-high-disk-watermark/246859)
**Author:** [@Dilip\_Kumar](https://discuss.elastic.co/u/Dilip_Kumar)\ **Replies:** 12\ **Last updated:** [September 1, 2020, 3:42am UTC](https://discuss.elastic.co/t/cluster-is-down-on-2-nodes-server-high-disk-watermark/246859 "2020-09-01T03:42:20Z")
Hi All, I have two node cluster suddenly cluster got down. es version 5.6 and ram size of each node is 16 GB and heap size is given 8GB. I am sharing my nod1 log , please help to find solution.. \[2020-08-30T00:30:09,91… --- ## [Offloading old data to cheaper storage](https://discuss.elastic.co/t/offloading-old-data-to-cheaper-storage/247004)
**Author:** [@andywt123](https://discuss.elastic.co/u/andywt123)\ **Replies:** 2\ **Last updated:** [September 1, 2020, 3:33am UTC](https://discuss.elastic.co/t/offloading-old-data-to-cheaper-storage/247004 "2020-09-01T03:33:55Z")
We are currently using elastic to aggregate logs with filebeats. We want to be able to offload data that is older then 60 days and then store in AWS s3. The data does not need to be searchable but we may need to retrieve… --- ## [Elasticsearch service failed to start on CentOS](https://discuss.elastic.co/t/elasticsearch-service-failed-to-start-on-centos/247034)
**Author:** [@munwarrior](https://discuss.elastic.co/u/munwarrior)\ **Replies:** 1\ **Last updated:** [September 1, 2020, 3:15am UTC](https://discuss.elastic.co/t/elasticsearch-service-failed-to-start-on-centos/247034 "2020-09-01T03:15:04Z")
Hi, I've follow the steps in https://casesup.com/category/knowledgebase/installation/how-to-install-elasticsearch-on-linux-server to install elasticsearch in Centos 8. but it stuck at step 3 when I tried to create serv… --- ## [How to centre the text in the dashboard visualisation? I am really struggling to center the text without the top white portion](https://discuss.elastic.co/t/how-to-centre-the-text-in-the-dashboard-visualisation-i-am-really-struggling-to-center-the-text-without-the-top-white-portion/246828)
**Author:** [@krishnendu](https://discuss.elastic.co/u/krishnendu)\ **Replies:** 2\ **Last updated:** [September 1, 2020, 1:07am UTC](https://discuss.elastic.co/t/how-to-centre-the-text-in-the-dashboard-visualisation-i-am-really-struggling-to-center-the-text-without-the-top-white-portion/246828 "2020-09-01T01:07:21Z")
--- ## [Ilm-history-2-000001 UNASSIGNED, primary shard for this replica is not yet active](https://discuss.elastic.co/t/ilm-history-2-000001-unassigned-primary-shard-for-this-replica-is-not-yet-active/246978)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 3\ **Last updated:** [August 31, 2020, 9:44pm UTC](https://discuss.elastic.co/t/ilm-history-2-000001-unassigned-primary-shard-for-this-replica-is-not-yet-active/246978 "2020-08-31T21:44:17Z")
Please I need critical help with cluster in state RED after upgrade 7.4.2-\>7.9 during upgrade of 5th node of 15 it did not recover it health to 100% but 99% all indices are green except 2 shards index … --- ## [Date Parse failures](https://discuss.elastic.co/t/date-parse-failures/246821)
**Author:** [@vvwood](https://discuss.elastic.co/u/vvwood)\ **Replies:** 7\ **Last updated:** [August 31, 2020, 9:37pm UTC](https://discuss.elastic.co/t/date-parse-failures/246821 "2020-08-31T21:37:51Z")
I have tried opening an official support case without getting any help on the following topic. Hoping someone here can help.... I have several log sources with a date field like this: Mar 22 2020 21:52:00 In my Index T… --- ## [Fail to send data to elastic unexpected EOF](https://discuss.elastic.co/t/fail-to-send-data-to-elastic-unexpected-eof/246732)
**Author:** [@greyhats13](https://discuss.elastic.co/u/greyhats13)\ **Replies:** 3\ **Last updated:** [August 31, 2020, 9:31pm UTC](https://discuss.elastic.co/t/fail-to-send-data-to-elastic-unexpected-eof/246732 "2020-08-31T21:31:13Z")
Hi guys, we are shipping the logs to elastic public endpoint (internet) from go microservices using this modulule elastic https://github.com/elastic/go-elasticsearch, but we encounter this error: 1. "could not get index… --- ## [Output logs to host based on timestamp](https://discuss.elastic.co/t/output-logs-to-host-based-on-timestamp/246357)
**Author:** [@ManjaroBlack](https://discuss.elastic.co/u/ManjaroBlack)\ **Replies:** 7\ **Last updated:** [August 31, 2020, 9:30pm UTC](https://discuss.elastic.co/t/output-logs-to-host-based-on-timestamp/246357 "2020-08-31T21:30:52Z")
I have logs that are a mix of old and new. I'd like to send any logs that are newer than 2 weeks to fast SSD, otherwise send to slower HDD. Can someone point me in the direction to figure this out? --- ## [Creating dynamic rollup indexes](https://discuss.elastic.co/t/creating-dynamic-rollup-indexes/246578)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 3\ **Last updated:** [August 31, 2020, 9:26pm UTC](https://discuss.elastic.co/t/creating-dynamic-rollup-indexes/246578 "2020-08-31T21:26:49Z")
Hi Team, I am working on rollup indices for the first time and don't have much idea about its capabilities. I want to rollup my data every month and can have all the visualization/scripts/dashboards in the current indi… --- ## [No TLS details](https://discuss.elastic.co/t/no-tls-details/222593)
**Author:** [@NogNeetMachinaal](https://discuss.elastic.co/u/NogNeetMachinaal)\ **Replies:** 2\ **Last updated:** [August 31, 2020, 8:54pm UTC](https://discuss.elastic.co/t/no-tls-details/222593 "2020-08-31T20:54:11Z")
See also attached image: While there seem to be thousands of TLS handshakes, the SIEM-network table with TLS details is empty. The Packetbeat config details: - type: tls # Configure the ports where to listen for T… --- ## [Hitting 'too\_many\_clauses' exception when used in aggregation filter context](https://discuss.elastic.co/t/hitting-too-many-clauses-exception-when-used-in-aggregation-filter-context/247010)
**Author:** [@Karthik\_Arun](https://discuss.elastic.co/u/Karthik_Arun)\ **Replies:** 0\ **Last updated:** [August 31, 2020, 8:13pm UTC](https://discuss.elastic.co/t/hitting-too-many-clauses-exception-when-used-in-aggregation-filter-context/247010 "2020-08-31T20:13:44Z")
I have a terms query returning over 5k clauses and when this is used within the filter context of the query, I never hit this 'too\_many\_clauses exception - you have exceeded 1024 clauses'. However if I use this terms qu… --- ## [Logstash will not create an index pattern in elastic search](https://discuss.elastic.co/t/logstash-will-not-create-an-index-pattern-in-elastic-search/246992)
**Author:** [@stor314](https://discuss.elastic.co/u/stor314)\ **Replies:** 3\ **Last updated:** [August 31, 2020, 6:08pm UTC](https://discuss.elastic.co/t/logstash-will-not-create-an-index-pattern-in-elastic-search/246992 "2020-08-31T18:08:23Z")
I am an extreme beginner with the elastic stack, I'm simply trying to create a very simple setup with elasticsearch logstash and kibana on my local machine. All of them are installed and are able to run, using versions 7… --- ## [Disable/enable in kibana 7.9 through roles](https://discuss.elastic.co/t/disable-enable-in-kibana-7-9-through-roles/246436)
**Author:** [@Muhammad\_Umair\_Baig](https://discuss.elastic.co/u/Muhammad_Umair_Baig)\ **Replies:** 1\ **Last updated:** [August 31, 2020, 6:04pm UTC](https://discuss.elastic.co/t/disable-enable-in-kibana-7-9-through-roles/246436 "2020-08-31T18:04:13Z")
Hi Team, i am using Kibana/elasticsearch 7.9 version. I have couple of questions. Is there anyway that i can hide navbar for a specific user based on the role? Hide "Edit profile" menu item and remove dashboard ca… --- ## [Dangling links error](https://discuss.elastic.co/t/dangling-links-error/245601)
**Author:** [@keraghu](https://discuss.elastic.co/u/keraghu)\ **Replies:** 11\ **Last updated:** [August 31, 2020, 5:55pm UTC](https://discuss.elastic.co/t/dangling-links-error/245601 "2020-08-31T17:55:23Z")
Hi We have elastic search setup on docker swarm. The elastic search data nodes automatically restarted, but all the nodes did not up and running, then, we did manual retstart ( portainer) But now we are getting an da… --- ## [Kibana - Visualization shows 0 results](https://discuss.elastic.co/t/kibana-visualization-shows-0-results/246993)
**Author:** [@spiri](https://discuss.elastic.co/u/spiri)\ **Replies:** 2\ **Last updated:** [August 31, 2020, 5:45pm UTC](https://discuss.elastic.co/t/kibana-visualization-shows-0-results/246993 "2020-08-31T17:45:53Z")
Hello, I integrated my syslog-ng with Elasticsearch + Kibana and I want to show the count of denied and allowed connections in a pie. So I created a new visualization for a pie, then splitted the slice twice and select… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1255) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1257)