# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1533 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1534 --- ## [Nested flow to flat](https://discuss.elastic.co/t/nested-flow-to-flat/226448)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 0\ **Last updated:** [April 3, 2020, 5:49pm UTC](https://discuss.elastic.co/t/nested-flow-to-flat/226448 "2020-04-03T17:49:58Z")
This is json document that I get from one of the kafka topic. Steps are different and more/less in quantity. { "jobid" : 300872305, "dataflow" : { "phases" : { "SETUP" : { "s… --- ## [How to create a custom analyzer to ignore accents and pt-br stopwords using elasticsearch nest api?](https://discuss.elastic.co/t/how-to-create-a-custom-analyzer-to-ignore-accents-and-pt-br-stopwords-using-elasticsearch-nest-api/223211)
**Author:** [@gutospinelli](https://discuss.elastic.co/u/gutospinelli)\ **Replies:** 2\ **Last updated:** [April 3, 2020, 5:43pm UTC](https://discuss.elastic.co/t/how-to-create-a-custom-analyzer-to-ignore-accents-and-pt-br-stopwords-using-elasticsearch-nest-api/223211 "2020-04-03T17:43:24Z")
Hi community! First of all, consider that I am using a "News" Class (Noticia, in portuguese) that has a string field called "Content" (Conteudo in portuguese) public class Noticia { public string Conteudo { get; set; … --- ## [Divide Sums with conditions an d group by](https://discuss.elastic.co/t/divide-sums-with-conditions-an-d-group-by/223437)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 5:14pm UTC](https://discuss.elastic.co/t/divide-sums-with-conditions-an-d-group-by/223437 "2020-04-03T17:14:47Z")
Hi, I have documents that looks like { ... "\_source": { ... "Number\_2": 64, ... "Name\_A": "RANDOM\_A", ... "Number\_1": 4, ... "Name\_B": "RANDOM\_B" }, I would like to show a ratio calculation… --- ## [Ruby Script Adds a New Field to LS Data Record?](https://discuss.elastic.co/t/ruby-script-adds-a-new-field-to-ls-data-record/226431)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 4\ **Last updated:** [April 3, 2020, 5:07pm UTC](https://discuss.elastic.co/t/ruby-script-adds-a-new-field-to-ls-data-record/226431 "2020-04-03T17:07:44Z")
Hi Logstash Jedi Masters :slight\_smile: I need an example of a Ruby script which: Accepts a data record from Logstash Adds a new field to the record (e.g. : \[ “NewField” \] ) Fills in a default value (e.g. : \[ “NewFi… --- ## [No logs in Kibana logs app](https://discuss.elastic.co/t/no-logs-in-kibana-logs-app/221005)
**Author:** [@Vaishali\_Gupta](https://discuss.elastic.co/u/Vaishali_Gupta)\ **Replies:** 14\ **Last updated:** [April 3, 2020, 4:56pm UTC](https://discuss.elastic.co/t/no-logs-in-kibana-logs-app/221005 "2020-04-03T16:56:58Z")
I have configured the EFK stack and logs are visible in kibana under the discover button when i create index pattern fluentd\*. But same logs are not visible in logs app when I make custom settings. PFA the configuratio… --- ## [Logstash 6.8 Input File not using exit\_after\_read](https://discuss.elastic.co/t/logstash-6-8-input-file-not-using-exit-after-read/226420)
**Author:** [@seibelj](https://discuss.elastic.co/u/seibelj)\ **Replies:** 5\ **Last updated:** [April 3, 2020, 4:51pm UTC](https://discuss.elastic.co/t/logstash-6-8-input-file-not-using-exit-after-read/226420 "2020-04-03T16:51:44Z")
Working with a client that has ELK 6.8.1 Their system produces a JSON file every minute (obviously a lot of files). I've been successful getting them into ES but having an issue with the number open. I'd like it to close… --- ## [Create Kibana Watcher alerts for certain conditions](https://discuss.elastic.co/t/create-kibana-watcher-alerts-for-certain-conditions/226275)
**Author:** [@malleable](https://discuss.elastic.co/u/malleable)\ **Replies:** 3\ **Last updated:** [April 3, 2020, 4:51pm UTC](https://discuss.elastic.co/t/create-kibana-watcher-alerts-for-certain-conditions/226275 "2020-04-03T16:51:00Z")
Hi all, I am trying to achieve the following with my Kibana watcher. 1\> I have added logs in my code with the text "Security Alert" where there is an appropriate security violation. So, in my code, in certain sections, … --- ## [SQL commands from Tutorial - SQL command skips "type"](https://discuss.elastic.co/t/sql-commands-from-tutorial-sql-command-skips-type/224582)
**Author:** [@debasisc](https://discuss.elastic.co/u/debasisc)\ **Replies:** 8\ **Last updated:** [April 3, 2020, 4:26pm UTC](https://discuss.elastic.co/t/sql-commands-from-tutorial-sql-command-skips-type/224582 "2020-04-03T16:26:26Z")
Although we mention Index (library) and type (book) when inserting records, SQL query only mentions index name. Can you please explain this? Thank you POST /\_sql?format=txt { "query": "SELECT \* FROM library WHERE rele… --- ## [Elasticsearch 6.8.6 pending\_tasks grows after 24 hours](https://discuss.elastic.co/t/elasticsearch-6-8-6-pending-tasks-grows-after-24-hours/226269)
**Author:** [@Chris\_Denneen](https://discuss.elastic.co/u/Chris_Denneen)\ **Replies:** 12\ **Last updated:** [April 3, 2020, 4:06pm UTC](https://discuss.elastic.co/t/elasticsearch-6-8-6-pending-tasks-grows-after-24-hours/226269 "2020-04-03T16:06:54Z")
CentOS 7.7 Elasticsearch 6.8.6 OpenJDK Runtime Environment (build 1.8.0\_242-b08) # curl -s localhost:9200/\_cluster/health?pretty { "cluster\_name" : "dev-gi-logging", "status" : "green", "time… --- ## [Join like operation java](https://discuss.elastic.co/t/join-like-operation-java/225717)
**Author:** [@rohit.singh3](https://discuss.elastic.co/u/rohit.singh3)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 4:02pm UTC](https://discuss.elastic.co/t/join-like-operation-java/225717 "2020-04-03T16:02:31Z")
i have two indices employee and organisation, both are linked via a common attribute organisationId. i want to do a search where searchString will be matched with EmpName, EmpDesignation and organisationName, and search … --- ## [Not able to put data in Kibana dev tools, any ideas?](https://discuss.elastic.co/t/not-able-to-put-data-in-kibana-dev-tools-any-ideas/225268)
**Author:** [@vernal](https://discuss.elastic.co/u/vernal)\ **Replies:** 5\ **Last updated:** [April 3, 2020, 3:56pm UTC](https://discuss.elastic.co/t/not-able-to-put-data-in-kibana-dev-tools-any-ideas/225268 "2020-04-03T15:56:54Z")
I installed new Kibana and elasticsearch. Then I typed in the following commands in "dev tools": PUT /ag2\_vehicle\_stats { "mappings": { "doc": { "properties": { "vin": { "type": "keyword" }, "error\_reported": { "type": … --- ## [Combiner plusieurs pipelines d'ingestion en parallèle et/ou en série](https://discuss.elastic.co/t/combiner-plusieurs-pipelines-dingestion-en-parallele-et-ou-en-serie/223710)
**Author:** [@oula\_oula](https://discuss.elastic.co/u/oula_oula)\ **Replies:** 3\ **Last updated:** [April 3, 2020, 3:45pm UTC](https://discuss.elastic.co/t/combiner-plusieurs-pipelines-dingestion-en-parallele-et-ou-en-serie/223710 "2020-04-03T15:45:22Z")
Salut, J'utilise des pipelines d'ingestions avec Filebeat pour traiter mes logs avant d'arriver dans Elasticsearch. Mes logs doivent passer par un pipeline spécifique (A ou B) selon les leurs provenances. J'arrive à le… --- ## [Weird match\_phrase\_prefix search behaviour with french analyzer](https://discuss.elastic.co/t/weird-match-phrase-prefix-search-behaviour-with-french-analyzer/222739)
**Author:** [@rursprung](https://discuss.elastic.co/u/rursprung)\ **Replies:** 7\ **Last updated:** [April 3, 2020, 3:42pm UTC](https://discuss.elastic.co/t/weird-match-phrase-prefix-search-behaviour-with-french-analyzer/222739 "2020-04-03T15:42:04Z")
i noticed a weird search behaviour with the french analyzer (could probably also affect other languages). i have boiled down our example to a minimal PoC, the original index & query were much bigger. our query is used i… --- ## [Mettre à jour / remplacer les données de l'index](https://discuss.elastic.co/t/mettre-a-jour-remplacer-les-donnees-de-lindex/223307)
**Author:** [@dbviz](https://discuss.elastic.co/u/dbviz)\ **Replies:** 7\ **Last updated:** [April 3, 2020, 3:40pm UTC](https://discuss.elastic.co/t/mettre-a-jour-remplacer-les-donnees-de-lindex/223307 "2020-04-03T15:40:09Z")
Bonjour, J'ai une entrée sous logstash par commande. La commande est programmée toutes les 5 minutes qui me renvoi des résultats anciens et de nouvelles données (avec des champs dates, user, webservice). Pour éviter le… --- ## [Work on elasticsearch data](https://discuss.elastic.co/t/work-on-elasticsearch-data/222688)
**Author:** [@Vishkaha](https://discuss.elastic.co/u/Vishkaha)\ **Replies:** 3\ **Last updated:** [April 3, 2020, 3:34pm UTC](https://discuss.elastic.co/t/work-on-elasticsearch-data/222688 "2020-04-03T15:34:15Z")
Dear All, I am working with logstash , by logstash query elastic search got data ad it shows in index of kibana and then I create the visualization. But now I want to apply some calculation or code on data which is com… --- ## [Shared limit](https://discuss.elastic.co/t/shared-limit/222057)
**Author:** [@Amna\_sayed\_ali](https://discuss.elastic.co/u/Amna_sayed_ali)\ **Replies:** 18\ **Last updated:** [April 3, 2020, 3:33pm UTC](https://discuss.elastic.co/t/shared-limit/222057 "2020-04-03T15:33:24Z")
Hi, i got this error when i tried to add some indices in AWS-ES but this cluster currently has \[1992\]/\[2000\] maximum shards open how can i solve this, if i want to keep that ES creates a delay index for each logs --- ## [QueryString to search String with colon](https://discuss.elastic.co/t/querystring-to-search-string-with-colon/226369)
**Author:** [@gyana\_nayak](https://discuss.elastic.co/u/gyana_nayak)\ **Replies:** 4\ **Last updated:** [April 3, 2020, 3:20pm UTC](https://discuss.elastic.co/t/querystring-to-search-string-with-colon/226369 "2020-04-03T15:20:28Z")
i am trying to achieve below condition loginId = "z2store" and type = "web" and dateTime = "12:17:08" below query i have written GET /sample/\_search { "bool" : { "must" : \[ { "term" : { "… --- ## [Sorting for date field](https://discuss.elastic.co/t/sorting-for-date-field/226205)
**Author:** [@pyerunka](https://discuss.elastic.co/u/pyerunka)\ **Replies:** 8\ **Last updated:** [April 3, 2020, 3:14pm UTC](https://discuss.elastic.co/t/sorting-for-date-field/226205 "2020-04-03T15:14:37Z")
Hello, I am using last\_modified\_date field from my index. I am sorting my results using this same field. field data is enabled on this column. but i am not getting correct results for sorting. I want to convert this … --- ## [Moving Elasticsearch 6.2.4 data to Elasticsearch 7.6.1](https://discuss.elastic.co/t/moving-elasticsearch-6-2-4-data-to-elasticsearch-7-6-1/226364)
**Author:** [@TheOne](https://discuss.elastic.co/u/TheOne)\ **Replies:** 6\ **Last updated:** [April 3, 2020, 3:13pm UTC](https://discuss.elastic.co/t/moving-elasticsearch-6-2-4-data-to-elasticsearch-7-6-1/226364 "2020-04-03T15:13:51Z")
Hi, I am trying to copy the data from our old Elasticsearch 6.2.4 to the new elasticsearch 7.6.1 I tried the following methods. Snapshot and restore Re-index from a remote cluster. Both methods seem working but I go… --- ## [Timestamp of When ElasticSearch Receives Data?](https://discuss.elastic.co/t/timestamp-of-when-elasticsearch-receives-data/226408)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 2\ **Last updated:** [April 3, 2020, 3:12pm UTC](https://discuss.elastic.co/t/timestamp-of-when-elasticsearch-receives-data/226408 "2020-04-03T15:12:44Z")
Hi ELK Gurus, I have a pipeline of Docker containers, ending in an ELK stack of Logstash/Elasticsearch/Kibana. (ELK versions are 7.4.0, I know I need to upgrade.) Data flows into the pipeline from an external source, … --- ## [Doc vs \_doc again](https://discuss.elastic.co/t/doc-vs-doc-again/226417)
**Author:** [@OffColour](https://discuss.elastic.co/u/OffColour)\ **Replies:** 0\ **Last updated:** [April 3, 2020, 2:52pm UTC](https://discuss.elastic.co/t/doc-vs-doc-again/226417 "2020-04-03T14:52:29Z")
Hi, Can we have a single page put together explaining best practice to upgrade to v7.0 with regard to document\_type and "doc" and "\_doc" please? I don't need an explanation of why this is being done as that's already be… --- ## [Find source code of index date in elasticsearch output plugin](https://discuss.elastic.co/t/find-source-code-of-index-date-in-elasticsearch-output-plugin/226394)
**Author:** [@mabr3](https://discuss.elastic.co/u/mabr3)\ **Replies:** 2\ **Last updated:** [April 3, 2020, 2:40pm UTC](https://discuss.elastic.co/t/find-source-code-of-index-date-in-elasticsearch-output-plugin/226394 "2020-04-03T14:40:04Z")
Hi, After some research I found the confirmation that when using the elasticsearch output plugin and using the date for the index name, it automatically uses the '@timestamp' field. I was also interested in finding in t… --- ## [Metricbeat behind logstash (index and dashboard generation)](https://discuss.elastic.co/t/metricbeat-behind-logstash-index-and-dashboard-generation/226295)
**Author:** [@Trolldemorted](https://discuss.elastic.co/u/Trolldemorted)\ **Replies:** 2\ **Last updated:** [April 3, 2020, 2:36pm UTC](https://discuss.elastic.co/t/metricbeat-behind-logstash-index-and-dashboard-generation/226295 "2020-04-03T14:36:59Z")
Hi, I have several servers with beats which talk to my logstash, and each should go into a separate index: input { beats { port =\> 5044 } } output { elasticsearch { hosts =\> \["http://elasticsearch:9200"\]… --- ## [Predefined boost scores](https://discuss.elastic.co/t/predefined-boost-scores/226353)
**Author:** [@Venkatram\_Akkineni](https://discuss.elastic.co/u/Venkatram_Akkineni)\ **Replies:** 2\ **Last updated:** [April 3, 2020, 2:36pm UTC](https://discuss.elastic.co/t/predefined-boost-scores/226353 "2020-04-03T14:36:36Z")
Hi I found the documentation which says one should use boost queries to enable boosting. But is there a way to specify the boost scores inside the index so that the clients don't have to specify on each call ? --- ## [Unable to start the elastic search in centos 7](https://discuss.elastic.co/t/unable-to-start-the-elastic-search-in-centos-7/226039)
**Author:** [@vikas2](https://discuss.elastic.co/u/vikas2)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 2:27pm UTC](https://discuss.elastic.co/t/unable-to-start-the-elastic-search-in-centos-7/226039 "2020-04-03T14:27:28Z")
Hi Team am setting up Elasticsearch kibana instance to setup Wazuh . I am facing the below error while checking the status of service. Please let me know where I went wrong. I have modified /etc/elasticsearch/elasticse… --- ## [My field \`input\` is modified, and some events are filtered (against my will ;-))](https://discuss.elastic.co/t/my-field-input-is-modified-and-some-events-are-filtered-against-my-will/225690)
**Author:** [@Axl](https://discuss.elastic.co/u/Axl)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 2:23pm UTC](https://discuss.elastic.co/t/my-field-input-is-modified-and-some-events-are-filtered-against-my-will/225690 "2020-04-03T14:23:05Z")
(Edited on March 31 with example) I have a working Filebeat+ELK config used to process logs from Cowrie (a honeypot). Except some log entries of Cowrie do not show in the end in Kibana, as if they had been filtered (by… --- ## [Log entry disappears between Logstash and Kibana](https://discuss.elastic.co/t/log-entry-disappears-between-logstash-and-kibana/225850)
**Author:** [@Axl](https://discuss.elastic.co/u/Axl)\ **Replies:** 6\ **Last updated:** [April 3, 2020, 2:20pm UTC](https://discuss.elastic.co/t/log-entry-disappears-between-logstash-and-kibana/225850 "2020-04-03T14:20:09Z")
Hello, Logstash is processing an event with: eventid set to cowrie.command.input message and input containing Unix commands Mar 31 10:26:02 instance-42 logstash\[22592\]: { Mar 31 10:26:02 instance-42 logstash\[22592… --- ## [Data synchronization between databases](https://discuss.elastic.co/t/data-synchronization-between-databases/226200)
**Author:** [@111310](https://discuss.elastic.co/u/111310)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 2:18pm UTC](https://discuss.elastic.co/t/data-synchronization-between-databases/226200 "2020-04-03T14:18:00Z")
I have a website, the main database is MYSQL, I add a search for entities that are often updated and new ones are added. Elastic as the second DB. Question: how to avoid data inconsistency? some values ​​in mysql, others… --- ## [Difficulty installing ECK in a single namespace](https://discuss.elastic.co/t/difficulty-installing-eck-in-a-single-namespace/225891)
**Author:** [@data\_smith](https://discuss.elastic.co/u/data_smith)\ **Replies:** 4\ **Last updated:** [April 3, 2020, 2:14pm UTC](https://discuss.elastic.co/t/difficulty-installing-eck-in-a-single-namespace/225891 "2020-04-03T14:14:03Z")
I ran the script: OPERATOR\_NAME=myelastic-op OPERATOR\_IMAGE=docker.elastic.co/eck/eck-operator:1.0.1 NAMESPACE=myns MANAGED\_NAMESPACE=myns make generate-namespace | kubectl apply -f - And it works up until I g… --- ## [Ingest pipeline in Update Api](https://discuss.elastic.co/t/ingest-pipeline-in-update-api/226412)
**Author:** [@mattiacareddu](https://discuss.elastic.co/u/mattiacareddu)\ **Replies:** 0\ **Last updated:** [April 3, 2020, 2:11pm UTC](https://discuss.elastic.co/t/ingest-pipeline-in-update-api/226412 "2020-04-03T14:11:12Z")
Hi, I'm trying to use an ingest pipeline in an update api: POST /my\_index/\_update/\_id?pipeline=attachment I find out this issue but it is 4 years old. Is there any update on that after 4 years? I really don't like the… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1532) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1534)