# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1404 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1405 --- ## [Why elasticsearch's query time per shard take little while the total query time is long](https://discuss.elastic.co/t/why-elasticsearchs-query-time-per-shard-take-little-while-the-total-query-time-is-long/235910)
**Author:** [@Matt-JN](https://discuss.elastic.co/u/Matt-JN)\ **Replies:** 6\ **Last updated:** [June 5, 2020, 3:17pm UTC](https://discuss.elastic.co/t/why-elasticsearchs-query-time-per-shard-take-little-while-the-total-query-time-is-long/235910 "2020-06-05T15:17:22Z")
Elasticserach cluster has 5 nodes with 16 cores and 64 gb memory each，boot heap size is 24GB. elasticsearch version 5.6.16. the index size is 150G(exclude replica), 300 million documents，5 primary shard, 2 replica. ind… --- ## [Build Error(PREMATURE error)](https://discuss.elastic.co/t/build-error-premature-error/235648)
**Author:** [@111305](https://discuss.elastic.co/u/111305)\ **Replies:** 1\ **Last updated:** [June 5, 2020, 3:03pm UTC](https://discuss.elastic.co/t/build-error-premature-error/235648 "2020-06-05T15:03:15Z")
Hi, when I build the kibana source code, I met the error message as below. \ ERROR failure ERROR Error \[ERR\_STREAM\_PREMATURE\_CLOSE\]: Premature close at Socket.onclose (internal/streams/… --- ## [Difference of count between count of field value](https://discuss.elastic.co/t/difference-of-count-between-count-of-field-value/235968)
**Author:** [@Guillaume\_RENARD](https://discuss.elastic.co/u/Guillaume_RENARD)\ **Replies:** 0\ **Last updated:** [June 5, 2020, 2:41pm UTC](https://discuss.elastic.co/t/difference-of-count-between-count-of-field-value/235968 "2020-06-05T14:41:01Z")
Hi, I have some URLs ending by end.gif and some other by start.gif. What I would like to get is the useragent for the one with the most start without end but I can't achieve that. Below a screenshot I would like a t… --- ## [Logstash tcp input load balancing](https://discuss.elastic.co/t/logstash-tcp-input-load-balancing/235924)
**Author:** [@daniele.saccon](https://discuss.elastic.co/u/daniele.saccon)\ **Replies:** 1\ **Last updated:** [June 5, 2020, 2:10pm UTC](https://discuss.elastic.co/t/logstash-tcp-input-load-balancing/235924 "2020-06-05T14:10:18Z")
Hi everybody, I have 2 logstash instances in 2 different hosts with the same configurations and a source that sends in tcp. It's possible to have a logstash cluster? Or do I have to put a load balancer that send events… --- ## [Kibana index with custom attributes](https://discuss.elastic.co/t/kibana-index-with-custom-attributes/235466)
**Author:** [@akshatsharma](https://discuss.elastic.co/u/akshatsharma)\ **Replies:** 7\ **Last updated:** [June 5, 2020, 1:58pm UTC](https://discuss.elastic.co/t/kibana-index-with-custom-attributes/235466 "2020-06-05T13:58:44Z")
Hi, Is it possible to create costum attributes while creating kibana index pattern? The goal is to be able to detect an index created with a Kubernetes Operator (among the others created by the Kibana GUI) I tried doi… --- ## [Method threw 'java.lang.NoClassDefFoundError' exception. Cannot evaluate org.elasticsearch.search.builder.SearchSourceBuilder.toString()](https://discuss.elastic.co/t/method-threw-java-lang-noclassdeffounderror-exception-cannot-evaluate-org-elasticsearch-search-builder-searchsourcebuilder-tostring/235956)
**Author:** [@ManojKumar\_Julakanti](https://discuss.elastic.co/u/ManojKumar_Julakanti)\ **Replies:** 1\ **Last updated:** [June 5, 2020, 1:32pm UTC](https://discuss.elastic.co/t/method-threw-java-lang-noclassdeffounderror-exception-cannot-evaluate-org-elasticsearch-search-builder-searchsourcebuilder-tostring/235956 "2020-06-05T13:32:08Z")
I couldn't instantiate SearchSourceBuilder my elastic-search version is 7.6.0 I am using rest high level client --- ## [Doubts about hardware requirements for elasticsearch](https://discuss.elastic.co/t/doubts-about-hardware-requirements-for-elasticsearch/235545)
**Author:** [@eayala](https://discuss.elastic.co/u/eayala)\ **Replies:** 10\ **Last updated:** [June 5, 2020, 1:18pm UTC](https://discuss.elastic.co/t/doubts-about-hardware-requirements-for-elasticsearch/235545 "2020-06-05T13:18:40Z")
I'm trying to setup elasticsearch cluster. I will get maximum of 4GB of data every day. So what will be hardware required to set up ElasticSearch 7.6.2 and kibana 7.6.2 What is ideal configuration for server- side RAM/… --- ## [Is this forcemerge behaviour normal?](https://discuss.elastic.co/t/is-this-forcemerge-behaviour-normal/235896)
**Author:** [@slabajos](https://discuss.elastic.co/u/slabajos)\ **Replies:** 5\ **Last updated:** [June 5, 2020, 1:14pm UTC](https://discuss.elastic.co/t/is-this-forcemerge-behaviour-normal/235896 "2020-06-05T13:14:58Z")
Hello, just wanted to ask a quick question regarding forcemerge. We have a hot-warm architecture for logs and every night we move yesterday indices to our "warm" node. We only have 1 master (hot), 1 data (warm) and one … --- ## [Issues ingesting log files with fresh installation](https://discuss.elastic.co/t/issues-ingesting-log-files-with-fresh-installation/233564)
**Author:** [@ozonshak](https://discuss.elastic.co/u/ozonshak)\ **Replies:** 4\ **Last updated:** [June 5, 2020, 12:33pm UTC](https://discuss.elastic.co/t/issues-ingesting-log-files-with-fresh-installation/233564 "2020-06-05T12:33:59Z")
Hello. I'm hoping someone can please help me with an indexing issue that i'm having. I'm working with a fresh setup of ElasticSearch and Kibana. I have everything setup, Kibana loads, I can log in with security, and t… --- ## [Total Fields limit to 1000 in queries](https://discuss.elastic.co/t/total-fields-limit-to-1000-in-queries/235938)
**Author:** [@agiorgi](https://discuss.elastic.co/u/agiorgi)\ **Replies:** 0\ **Last updated:** [June 5, 2020, 10:57am UTC](https://discuss.elastic.co/t/total-fields-limit-to-1000-in-queries/235938 "2020-06-05T10:57:09Z")
Hello guys, I was wondering why the number of fields in indexes is by default capped at 1000. Same applies for the query maximum number of fields that can be targeted, which is also capped at 1024. I mean, this is fin… --- ## [Aggregate Filter not keeping fields](https://discuss.elastic.co/t/aggregate-filter-not-keeping-fields/235950)
**Author:** [@ThrowinSticks](https://discuss.elastic.co/u/ThrowinSticks)\ **Replies:** 0\ **Last updated:** [June 5, 2020, 12:30pm UTC](https://discuss.elastic.co/t/aggregate-filter-not-keeping-fields/235950 "2020-06-05T12:30:29Z")
Having many difficulties with Aggregate filter in logstash. Mainly I can create an aggregated event (although there are some errors there) but none of the fields are being populated except for the 2 I set myself. I'm t… --- ## [Correct syntax for log.file.path](https://discuss.elastic.co/t/correct-syntax-for-log-file-path/235949)
**Author:** [@Maria\_Daniel](https://discuss.elastic.co/u/Maria_Daniel)\ **Replies:** 0\ **Last updated:** [June 5, 2020, 12:26pm UTC](https://discuss.elastic.co/t/correct-syntax-for-log-file-path/235949 "2020-06-05T12:26:37Z")
Hello! I'm trying to attribute a "delivery\_conn\_r" tag to logs from files ending with ".results". All other files get a "delivery\_conn\_t" tag. This is what's on my pipeline thus far: if "delivery\_conn" in \[tags\] { i… --- ## [Kilograms to grams convert processor](https://discuss.elastic.co/t/kilograms-to-grams-convert-processor/235937)
**Author:** [@gitterhh](https://discuss.elastic.co/u/gitterhh)\ **Replies:** 2\ **Last updated:** [June 5, 2020, 12:15pm UTC](https://discuss.elastic.co/t/kilograms-to-grams-convert-processor/235937 "2020-06-05T12:15:56Z")
There is a standard processor for bytes https://www.elastic.co/guide/en/elasticsearch/reference/current/bytes-processor.html Is there similar processor for grams? Or which processor can be used to achieve same functiona… --- ## [Inters Section Query in elastic search](https://discuss.elastic.co/t/inters-section-query-in-elastic-search/235777)
**Author:** [@abba5](https://discuss.elastic.co/u/abba5)\ **Replies:** 2\ **Last updated:** [June 5, 2020, 11:37am UTC](https://discuss.elastic.co/t/inters-section-query-in-elastic-search/235777 "2020-06-05T11:37:41Z")
I am working on a project where I need to search for a person's name and it's college. Indexing: "attributes": { "type": "nested", "properties": { "name": { "type": "keyword" }, "value": { "type": "text",… --- ## [Kubernetes/ECK - ElasticSearc Master Pod](https://discuss.elastic.co/t/kubernetes-eck-elasticsearc-master-pod/235942)
**Author:** [@SadeekM](https://discuss.elastic.co/u/SadeekM)\ **Replies:** 0\ **Last updated:** [June 5, 2020, 11:29am UTC](https://discuss.elastic.co/t/kubernetes-eck-elasticsearc-master-pod/235942 "2020-06-05T11:29:38Z")
Trying to move elasticsearchMasper pod on Kubernetes master. Master Pod getting cCrashLoopBackOff with below error message. Error Exception in thread "main" java.nio.file.AccessDeniedException: /tmp/elasticsearch-xxxxx… --- ## [Is there an msearch performance gain if all queries are targeting the same field?](https://discuss.elastic.co/t/is-there-an-msearch-performance-gain-if-all-queries-are-targeting-the-same-field/235296)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 1\ **Last updated:** [June 5, 2020, 11:08am UTC](https://discuss.elastic.co/t/is-there-an-msearch-performance-gain-if-all-queries-are-targeting-the-same-field/235296 "2020-06-05T11:08:56Z")
I'm trying to query elastic with lots and lots of queries. I'm batching the queries into set-sized msearches according to our query queue settings. At the moment it's organised so that each msearch only contains queries… --- ## [Dashboard Display order](https://discuss.elastic.co/t/dashboard-display-order/234596)
**Author:** [@LJB999](https://discuss.elastic.co/u/LJB999)\ **Replies:** 1\ **Last updated:** [June 5, 2020, 11:06am UTC](https://discuss.elastic.co/t/dashboard-display-order/234596 "2020-06-05T11:06:49Z")
When I click on the "dashboard" icon on the left menu all the dashboards titles display in random order. Is it possible to predefine the sort order? Name does not work, any idea what they are sorted by as default so I c… --- ## [How to add custom query parameter to all kibana urls?](https://discuss.elastic.co/t/how-to-add-custom-query-parameter-to-all-kibana-urls/234264)
**Author:** [@Mohit\_Sharma\_IITK](https://discuss.elastic.co/u/Mohit_Sharma_IITK)\ **Replies:** 5\ **Last updated:** [June 5, 2020, 10:25am UTC](https://discuss.elastic.co/t/how-to-add-custom-query-parameter-to-all-kibana-urls/234264 "2020-06-05T10:25:50Z")
Hi Team, We have kibana dashboard behind a proxy. Our proxy requires one query parameter to be added to each url otherwise it doesnot pass the request. Something like this: https://PROXY\_URL?KEY=SECRET\_VALUE Kibana da… --- ## [ERROR Heap Memory](https://discuss.elastic.co/t/error-heap-memory/235680)
**Author:** [@vdelburgo](https://discuss.elastic.co/u/vdelburgo)\ **Replies:** 4\ **Last updated:** [June 5, 2020, 10:14am UTC](https://discuss.elastic.co/t/error-heap-memory/235680 "2020-06-05T10:14:13Z")
Hello, I have the following error: \[circuit\_breaking\_exception\] \[parent\] Data too large, data for \[\\] would be \[995677744/949.5mb\], which is larger than the limit of \[986061209/940.3mb\], real usage: \[99567… --- ## [Sort string versions in kibana](https://discuss.elastic.co/t/sort-string-versions-in-kibana/235698)
**Author:** [@Angelos](https://discuss.elastic.co/u/Angelos)\ **Replies:** 5\ **Last updated:** [June 5, 2020, 9:59am UTC](https://discuss.elastic.co/t/sort-string-versions-in-kibana/235698 "2020-06-05T09:59:33Z")
Elastic/Kibana version: 7.7(Platinum) Hi, In my case I have version fields that look like that "NAME-10.1.0" or "NAME-10.1.1\_beta". So when I sort them in a visualisation(Histogram), they are sorted like this: NAME-… --- ## [Looking for help with ingest pipeline](https://discuss.elastic.co/t/looking-for-help-with-ingest-pipeline/235926)
**Author:** [@DelphicOkami](https://discuss.elastic.co/u/DelphicOkami)\ **Replies:** 0\ **Last updated:** [June 5, 2020, 9:32am UTC](https://discuss.elastic.co/t/looking-for-help-with-ingest-pipeline/235926 "2020-06-05T09:32:50Z")
Hi there, I'm having trouble with an ingest pipeline in elasticsearch, I've clearly missed something obvious. Filebeat config\`filebeat.inputs: type: log enabled: true paths: D:/artifactory/logs/access.log pipeline… --- ## [Pod template and secureSettings fails with failed quota](https://discuss.elastic.co/t/pod-template-and-securesettings-fails-with-failed-quota/235836)
**Author:** [@robrotheram](https://discuss.elastic.co/u/robrotheram)\ **Replies:** 2\ **Last updated:** [June 5, 2020, 9:13am UTC](https://discuss.elastic.co/t/pod-template-and-securesettings-fails-with-failed-quota/235836 "2020-06-05T09:13:02Z")
Hello, I have a name space with a resource limits and when I try do deploy Elasticsearch it fails with: create Pod ldap-test-3-es-55b787q5-0 in StatefulSet ldap-test-3-es-55b787q5 failed error: pods "ldap-test-3-es-55b7… --- ## [How can I flatten an array in my document](https://discuss.elastic.co/t/how-can-i-flatten-an-array-in-my-document/235807)
**Author:** [@genehunter29009](https://discuss.elastic.co/u/genehunter29009)\ **Replies:** 5\ **Last updated:** [June 5, 2020, 8:58am UTC](https://discuss.elastic.co/t/how-can-i-flatten-an-array-in-my-document/235807 "2020-06-05T08:58:15Z")
I am attempting to flatten an array either in logstash or ingestion processor. "clientType" : "Desktop Browser", "stringProperties" : \[ { "key" : "usertype", "applicationId" : "Client", "internalApplicationId" : "A… --- ## [Invalid\_index\_name\_exception when version up to 7.x](https://discuss.elastic.co/t/invalid-index-name-exception-when-version-up-to-7-x/235919)
**Author:** [@carlostevez](https://discuss.elastic.co/u/carlostevez)\ **Replies:** 0\ **Last updated:** [June 5, 2020, 8:55am UTC](https://discuss.elastic.co/t/invalid-index-name-exception-when-version-up-to-7-x/235919 "2020-06-05T08:55:06Z")
I've upgrade ELK 6.x to 7.X But I got error I haven't got when I use 6.x. I used with below index name pattern when 6.x If I modify the index name , it suffer to change whole system. Q1. Is it added index naming rule… --- ## [ELK Integration with SAP HANA](https://discuss.elastic.co/t/elk-integration-with-sap-hana/235913)
**Author:** [@Shivakarasani](https://discuss.elastic.co/u/Shivakarasani)\ **Replies:** 0\ **Last updated:** [June 5, 2020, 8:43am UTC](https://discuss.elastic.co/t/elk-integration-with-sap-hana/235913 "2020-06-05T08:43:17Z")
anyone integrated ELK with SAP HANA DB, I am trying to integrate using JDBC connector and not able to connect. Is there any document available for this? I have not an appropriate one till now. my conf file jdbc { jd… --- ## [How to split log data into message fields when we have dynamic logs](https://discuss.elastic.co/t/how-to-split-log-data-into-message-fields-when-we-have-dynamic-logs/235725)
**Author:** [@hemant\_472](https://discuss.elastic.co/u/hemant_472)\ **Replies:** 4\ **Last updated:** [June 5, 2020, 8:40am UTC](https://discuss.elastic.co/t/how-to-split-log-data-into-message-fields-when-we-have-dynamic-logs/235725 "2020-06-05T08:40:26Z")
i have created some log patterns in logstash but when i get new log pattern it is parsed into the kibana as a message filed but is not split up into other fields. I would like to know do i need to add log patterns for e… --- ## [Limit of total fields \[1000\] in index \[p\_bs\_api\_abcd\_2020\_23\] has been exceeded](https://discuss.elastic.co/t/limit-of-total-fields-1000-in-index-p-bs-api-abcd-2020-23-has-been-exceeded/235476)
**Author:** [@Saravana\_Maadavan](https://discuss.elastic.co/u/Saravana_Maadavan)\ **Replies:** 8\ **Last updated:** [June 5, 2020, 8:25am UTC](https://discuss.elastic.co/t/limit-of-total-fields-1000-in-index-p-bs-api-abcd-2020-23-has-been-exceeded/235476 "2020-06-05T08:25:05Z")
I have followed the steps discussed in link Increase total fields limit via creation of index in logstash but not able to resolve it. Kindly find below few snippets of the configuration files. output { elasticsearch { … --- ## [Disabled syscall filter but still issue](https://discuss.elastic.co/t/disabled-syscall-filter-but-still-issue/234894)
**Author:** [@elk2](https://discuss.elastic.co/u/elk2)\ **Replies:** 5\ **Last updated:** [June 5, 2020, 7:57am UTC](https://discuss.elastic.co/t/disabled-syscall-filter-but-still-issue/234894 "2020-06-05T07:57:48Z")
I have a cluster with 10 nodes with elasticsearch 2.4 version. I disabled in elasticsearch.yml syscall filter with this configuration: \[...\] bootstrap.system\_call\_filter: false \[...\] Unfortunately, elasticsearch sti… --- ## [Data filter input](https://discuss.elastic.co/t/data-filter-input/235796)
**Author:** [@seddikalaouiismaili](https://discuss.elastic.co/u/seddikalaouiismaili)\ **Replies:** 2\ **Last updated:** [June 5, 2020, 7:56am UTC](https://discuss.elastic.co/t/data-filter-input/235796 "2020-06-05T07:56:26Z")
Hello For a technical constraint we want to change the format of the data in the logs processed by filebeat . On the logs there are time fields that will be modified to milliseconds in input, in this case we want to ap… --- ## [Getting 'missing auth credentials' after setting SSL in Elasticsearch](https://discuss.elastic.co/t/getting-missing-auth-credentials-after-setting-ssl-in-elasticsearch/235906)
**Author:** [@tmporary](https://discuss.elastic.co/u/tmporary)\ **Replies:** 0\ **Last updated:** [June 5, 2020, 7:54am UTC](https://discuss.elastic.co/t/getting-missing-auth-credentials-after-setting-ssl-in-elasticsearch/235906 "2020-06-05T07:54:18Z")
Hi, Recently I set up ssl for HTTP and TCP in elasticsearch but I'm constantly getting below error when trying to call elastic API curl -k --cert MY\_CERT.pem:Password 'https://localhost:9200/\_xpack/security/\_authentica… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1403) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1405)