# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1534 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1535 --- ## [Match each token just once against each clause](https://discuss.elastic.co/t/match-each-token-just-once-against-each-clause/226261)
**Author:** [@sgomez](https://discuss.elastic.co/u/sgomez)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 2:10pm UTC](https://discuss.elastic.co/t/match-each-token-just-once-against-each-clause/226261 "2020-04-03T14:10:12Z")
Hi, I have a query that contains 2 different clauses. One for term query and one for prefix query. I want to know if there's a way for each of the tokens of the match field in the document I'm searching, to match just o… --- ## [Track alert state change](https://discuss.elastic.co/t/track-alert-state-change/226411)
**Author:** [@Haris\_Brackovic](https://discuss.elastic.co/u/Haris_Brackovic)\ **Replies:** 0\ **Last updated:** [April 3, 2020, 2:09pm UTC](https://discuss.elastic.co/t/track-alert-state-change/226411 "2020-04-03T14:09:45Z")
Hi, I am using Elasticsearch v 7.1. I have several alerts set in Kibana and I need to track when the alert state changes from triggerd back to OK. I need to send the notification when things go back to normal. Example: … --- ## [Not able to restore snap shot from 5.6.3 to 7.4.2 elastic search](https://discuss.elastic.co/t/not-able-to-restore-snap-shot-from-5-6-3-to-7-4-2-elastic-search/225679)
**Author:** [@abhishek1](https://discuss.elastic.co/u/abhishek1)\ **Replies:** 7\ **Last updated:** [April 3, 2020, 2:05pm UTC](https://discuss.elastic.co/t/not-able-to-restore-snap-shot-from-5-6-3-to-7-4-2-elastic-search/225679 "2020-04-03T14:05:45Z")
Hello , Actually i have installed 5.6.3 elasticsearch and created some indexes not i want to install new version of elastic search 7.4.2 so in that case i followed below steps 1.Take backup by creating snap shot for 5.… --- ## [Is it redundant to use file input plugin with persistent queue?](https://discuss.elastic.co/t/is-it-redundant-to-use-file-input-plugin-with-persistent-queue/226297)
**Author:** [@danielyahn](https://discuss.elastic.co/u/danielyahn)\ **Replies:** 2\ **Last updated:** [April 3, 2020, 2:04pm UTC](https://discuss.elastic.co/t/is-it-redundant-to-use-file-input-plugin-with-persistent-queue/226297 "2020-04-03T14:04:24Z")
is it redundant to use file input plugin with persistent queue? Does persistent queue provide any additional delivery guarantee? Let's say file input plugin uses read mode sinceDB --- ## [Field Collapsing not working](https://discuss.elastic.co/t/field-collapsing-not-working/226342)
**Author:** [@jseow](https://discuss.elastic.co/u/jseow)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 2:02pm UTC](https://discuss.elastic.co/t/field-collapsing-not-working/226342 "2020-04-03T14:02:19Z")
Hi, I'm having some issues with field-collapsing. I tried the following to no avail. The query: { "size": 1, "from": 1, "query": { "match": { "model": "Sonic"} }, "sort": \[ { "model": "desc" } \], "collapse"… --- ## [How can i make logstash to read file with same filename after processing](https://discuss.elastic.co/t/how-can-i-make-logstash-to-read-file-with-same-filename-after-processing/226187)
**Author:** [@yigene](https://discuss.elastic.co/u/yigene)\ **Replies:** 3\ **Last updated:** [April 3, 2020, 2:00pm UTC](https://discuss.elastic.co/t/how-can-i-make-logstash-to-read-file-with-same-filename-after-processing/226187 "2020-04-03T14:00:49Z")
Hi, I have tried many ways but still not able to get it work basically, i have logstash to watching one folder and load into ES with read model input { file { path =\> \[ "/tmp/\*csv" \] type =\> "stp" tags =\> \["aa"\] … --- ## [Graduated prices on documents](https://discuss.elastic.co/t/graduated-prices-on-documents/226378)
**Author:** [@Max\_van\_der\_Sluis](https://discuss.elastic.co/u/Max_van_der_Sluis)\ **Replies:** 4\ **Last updated:** [April 3, 2020, 1:59pm UTC](https://discuss.elastic.co/t/graduated-prices-on-documents/226378 "2020-04-03T13:59:33Z")
I'm having issues implementing graduated prices in Elasticsearch. This is the mapping I use (I can change it, as long as it all stays in the same index): PUT /sw\_shop1\_product/\_mapping { "properties": { … --- ## [Open index on restore snapshot action](https://discuss.elastic.co/t/open-index-on-restore-snapshot-action/226384)
**Author:** [@Wallie](https://discuss.elastic.co/u/Wallie)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 1:52pm UTC](https://discuss.elastic.co/t/open-index-on-restore-snapshot-action/226384 "2020-04-03T13:52:58Z")
Am trying to move our ELK stack to a different machine to verify backup/restore procedure. A snapshot has been created on machine A, after creating a Repository. Moved full repository directory to machine B, added the r… --- ## [Divide a field by a number in ruby](https://discuss.elastic.co/t/divide-a-field-by-a-number-in-ruby/226306)
**Author:** [@lfuentes](https://discuss.elastic.co/u/lfuentes)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 1:45pm UTC](https://discuss.elastic.co/t/divide-a-field-by-a-number-in-ruby/226306 "2020-04-03T13:45:25Z")
Good, I need help please, I need to divide a number by 1000 using the ruby filter, could you help me with the code of that? I am really a beginner, I have something like this: ruby { code =\> "event.set('timetaken', eve… --- ## [Unable to create elasticsearch index from logstash.conf file](https://discuss.elastic.co/t/unable-to-create-elasticsearch-index-from-logstash-conf-file/225693)
**Author:** [@sachinarora](https://discuss.elastic.co/u/sachinarora)\ **Replies:** 6\ **Last updated:** [April 3, 2020, 1:37pm UTC](https://discuss.elastic.co/t/unable-to-create-elasticsearch-index-from-logstash-conf-file/225693 "2020-04-03T13:37:30Z")
I am trying to create index of elasticsearch using logstash.conf file but I am not able to create index. There is not any error in logs of elasticsearch and logstash. After starting the logstash whenever I do url/\_cat/in… --- ## [Max Shards allowed per Index](https://discuss.elastic.co/t/max-shards-allowed-per-index/224881)
**Author:** [@sreekanth](https://discuss.elastic.co/u/sreekanth)\ **Replies:** 3\ **Last updated:** [April 3, 2020, 1:34pm UTC](https://discuss.elastic.co/t/max-shards-allowed-per-index/224881 "2020-04-03T13:34:03Z")
We are planning to have 1 index which will host ~150TB of data. Ideally it is suggested to have 1 shard per 50GB. So i may end up in 3000 Shards!!! does ES really works with 3000 shards on 1 index? We don't have problem… --- ## [Put Elasticsearch behind Apache](https://discuss.elastic.co/t/put-elasticsearch-behind-apache/226233)
**Author:** [@Bergy27](https://discuss.elastic.co/u/Bergy27)\ **Replies:** 5\ **Last updated:** [April 3, 2020, 1:33pm UTC](https://discuss.elastic.co/t/put-elasticsearch-behind-apache/226233 "2020-04-03T13:33:04Z")
Hi guys, Maybe my question is dumb but I have an issue. I work on a remote server and I started Elasticsearch on default port (9200). The problem is that this port is closed from the outside. We can't access Elasticsear… --- ## [Initial remote and local Filebeat config for logstash](https://discuss.elastic.co/t/initial-remote-and-local-filebeat-config-for-logstash/226263)
**Author:** [@Engineer33](https://discuss.elastic.co/u/Engineer33)\ **Replies:** 0\ **Last updated:** [April 2, 2020, 5:55pm UTC](https://discuss.elastic.co/t/initial-remote-and-local-filebeat-config-for-logstash/226263 "2020-04-02T17:55:16Z")
Hi all, Ive been in the filebeat.yml file and tried to do the initial config myself. I'm pretty new to the ELK stack and it processes but i made sure all ports were open but it still doesn't seem to connect. Below is … --- ## [Ingest Node or Uploading data to website](https://discuss.elastic.co/t/ingest-node-or-uploading-data-to-website/225492)
**Author:** [@KaustubhB](https://discuss.elastic.co/u/KaustubhB)\ **Replies:** 5\ **Last updated:** [April 3, 2020, 1:30pm UTC](https://discuss.elastic.co/t/ingest-node-or-uploading-data-to-website/225492 "2020-04-03T13:30:03Z")
What I am doing currently is, fetching logs from one elastic search index. Now I want these logs to be accessible to other users through a good user interface. For that, I was thinking of two options- Create a small we… --- ## [Set-up Elastic Search and Kibana](https://discuss.elastic.co/t/set-up-elastic-search-and-kibana/226402)
**Author:** [@fmquasi](https://discuss.elastic.co/u/fmquasi)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 12:53pm UTC](https://discuss.elastic.co/t/set-up-elastic-search-and-kibana/226402 "2020-04-03T12:53:17Z")
im new to elastic search and was wondering if someone can assist me on setting up information for Elastic search and Kibana - this is to be used for Log management and SIEM start-up --- ## [Surprising error!](https://discuss.elastic.co/t/surprising-error/225582)
**Author:** [@GuyMuller](https://discuss.elastic.co/u/GuyMuller)\ **Replies:** 10\ **Last updated:** [April 3, 2020, 12:38pm UTC](https://discuss.elastic.co/t/surprising-error/225582 "2020-04-03T12:38:57Z")
Hello I have a problem with the creation of the config file and when launching the command. I have this error "do was unexpected." =\> do était inattendu. Command line : C:\\Program Files\\Elastic\\logstash\\bin\\logstash… --- ## [Optimize elasticsearch segment merge](https://discuss.elastic.co/t/optimize-elasticsearch-segment-merge/226327)
**Author:** [@quweiyu](https://discuss.elastic.co/u/quweiyu)\ **Replies:** 4\ **Last updated:** [April 3, 2020, 11:54am UTC](https://discuss.elastic.co/t/optimize-elasticsearch-segment-merge/226327 "2020-04-03T11:54:44Z")
All, We are running an elasticsearch load (48K documents / mins with elasticsearch 6.5) for 24 hours. There are 32 active main shards for each 8 hours (no replica shard). Here is what we see, Load runs well at the beg… --- ## [Generate chart from custom aggregation](https://discuss.elastic.co/t/generate-chart-from-custom-aggregation/226389)
**Author:** [@oula\_oula](https://discuss.elastic.co/u/oula_oula)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 11:31am UTC](https://discuss.elastic.co/t/generate-chart-from-custom-aggregation/226389 "2020-04-03T11:31:03Z")
Hi, I'm trying to make a chart that shows for each superhero the time he's spent between to cities. The problem is that I cannot add a field using "scripted field" method because it cannot match multiple docs at the sa… --- ## [Elastic delete query](https://discuss.elastic.co/t/elastic-delete-query/226366)
**Author:** [@niraj\_pandey](https://discuss.elastic.co/u/niraj_pandey)\ **Replies:** 2\ **Last updated:** [April 3, 2020, 11:17am UTC](https://discuss.elastic.co/t/elastic-delete-query/226366 "2020-04-03T11:17:43Z")
Hi , I need to delete some data based on time from a index. Using below qury I am able to get all the data. curl -XGET 'http://abc6:9200/data\*/\_search?pretty' -H 'Content-Type: application/json' -d' { "query":{ "bool":… --- ## [Enrich processor: enrich multiple documents into one array](https://discuss.elastic.co/t/enrich-processor-enrich-multiple-documents-into-one-array/225567)
**Author:** [@nitzan.karni](https://discuss.elastic.co/u/nitzan.karni)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 11:04am UTC](https://discuss.elastic.co/t/enrich-processor-enrich-multiple-documents-into-one-array/225567 "2020-04-03T11:04:27Z")
I have two indices. index1 and index2. Let say each document in index1 owes fields \[ "host.name", "ip"\] And each document in index2 owes fields \[ "host.name", "software"\] index2 can contain multiple documents fo… --- ## [Logstash multiple jdbc plugin ingestion](https://discuss.elastic.co/t/logstash-multiple-jdbc-plugin-ingestion/226391)
**Author:** [@Vladpov](https://discuss.elastic.co/u/Vladpov)\ **Replies:** 0\ **Last updated:** [April 3, 2020, 10:57am UTC](https://discuss.elastic.co/t/logstash-multiple-jdbc-plugin-ingestion/226391 "2020-04-03T10:57:28Z")
Hey guys, I have set up MariaDB database from which I transport data to Elasticsearch via Logstash jdbc plugin. The ingestion of the data from database processlist table is being done every second. So every second I got… --- ## [Is it possible to jump from a visualization to a deeper visualization?](https://discuss.elastic.co/t/is-it-possible-to-jump-from-a-visualization-to-a-deeper-visualization/226387)
**Author:** [@Sajumoet](https://discuss.elastic.co/u/Sajumoet)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 10:52am UTC](https://discuss.elastic.co/t/is-it-possible-to-jump-from-a-visualization-to-a-deeper-visualization/226387 "2020-04-03T10:52:03Z")
Is it possible to jump from a visualization to a deeper visualization? For example, if I'm in a pie chart and click on a pie piece so I see a different visualization. Let me give you an example. I create a pie chart that… --- ## [ECK 0.8.0 keeps creating and deleting nodes](https://discuss.elastic.co/t/eck-0-8-0-keeps-creating-and-deleting-nodes/225321)
**Author:** [@huntlyroad](https://discuss.elastic.co/u/huntlyroad)\ **Replies:** 5\ **Last updated:** [April 3, 2020, 10:12am UTC](https://discuss.elastic.co/t/eck-0-8-0-keeps-creating-and-deleting-nodes/225321 "2020-04-03T10:12:45Z")
Hi, I'm using ECK 0.8.0 to manage my es cluster in k8s. It started more than half year ago and worked fine. However, recently when I tried to scale up my data nodes ( from 5 to 8). Unexpected behaviours are observed. H… --- ## [Split data in message field to separate fields to display in kibana](https://discuss.elastic.co/t/split-data-in-message-field-to-separate-fields-to-display-in-kibana/226382)
**Author:** [@avinash221988](https://discuss.elastic.co/u/avinash221988)\ **Replies:** 0\ **Last updated:** [April 3, 2020, 10:05am UTC](https://discuss.elastic.co/t/split-data-in-message-field-to-separate-fields-to-display-in-kibana/226382 "2020-04-03T10:05:48Z")
Hi, I am using logstash and ES to feed data into kibana. Sending Json data to kibana.Below is the json data: {"Qmgrs":\[{"QueueManager":"QM1","Status":"Running"},{"QueueManager":"QM2","Status":"Ended immediately"},{"Que… --- ## [Nodes randomly, temporarily, leaving 7.3.2 cluster](https://discuss.elastic.co/t/nodes-randomly-temporarily-leaving-7-3-2-cluster/224925)
**Author:** [@lag13](https://discuss.elastic.co/u/lag13)\ **Replies:** 16\ **Last updated:** [April 3, 2020, 9:49am UTC](https://discuss.elastic.co/t/nodes-randomly-temporarily-leaving-7-3-2-cluster/224925 "2020-04-03T09:49:55Z")
I'm really stumped here so I'm hoping that someone can point me in the right direction. Thanks! Over the past couple weeks I've noticed that nodes will occasionally leave our cluster and then rejoin a short time later a… --- ## [Tracing a log from Filebeat to Kibana](https://discuss.elastic.co/t/tracing-a-log-from-filebeat-to-kibana/226375)
**Author:** [@Axl](https://discuss.elastic.co/u/Axl)\ **Replies:** 0\ **Last updated:** [April 3, 2020, 9:49am UTC](https://discuss.elastic.co/t/tracing-a-log-from-filebeat-to-kibana/226375 "2020-04-03T09:49:45Z")
Hi, Is there a way to see the log entries at all levels: in my case Filebeat, then Logstash, then Elasticsearch, then Kibana? Indeed, I have some logs that I see in Filebeat, and logstash, which "disappear" afterwards :… --- ## [Logstash output Elasticsearch - mapper\_parsing\_exception](https://discuss.elastic.co/t/logstash-output-elasticsearch-mapper-parsing-exception/226256)
**Author:** [@abrejuin](https://discuss.elastic.co/u/abrejuin)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 9:41am UTC](https://discuss.elastic.co/t/logstash-output-elasticsearch-mapper-parsing-exception/226256 "2020-04-03T09:41:04Z")
Hello, I upgraded Elastic from 5.3 to 6.0, I also upgraded Logstash from 5.6 to 6.8. Since then I have error messages on Logstash while trying to send logs to Elastic : \[WARN \] 2020-04-02 15:01:03.754 \[\[main\]\>worker0\]… --- ## [IMPORT .mib to Logstash snmptrap input](https://discuss.elastic.co/t/import-mib-to-logstash-snmptrap-input/226371)
**Author:** [@Diego\_Gutierrez](https://discuss.elastic.co/u/Diego_Gutierrez)\ **Replies:** 0\ **Last updated:** [April 3, 2020, 9:23am UTC](https://discuss.elastic.co/t/import-mib-to-logstash-snmptrap-input/226371 "2020-04-03T09:23:57Z")
Hi, I am having a lot of problem to import .mib files to logstash and transform it to .yaml file 'cause is the file that logstash can read. I've use the import.rb with ruby but I receive errors or directly I dont recei… --- ## [Add Field on the fly to the returned result](https://discuss.elastic.co/t/add-field-on-the-fly-to-the-returned-result/226361)
**Author:** [@keshara](https://discuss.elastic.co/u/keshara)\ **Replies:** 0\ **Last updated:** [April 3, 2020, 7:57am UTC](https://discuss.elastic.co/t/add-field-on-the-fly-to-the-returned-result/226361 "2020-04-03T07:57:58Z")
Hi, Think about a elasticsearch query result where i get two matched documents in two buckets as below. bucket1 =\> { "product": "abc", "price: "$100" } bucket2 =\> { "product": "xyz", "price": "$50" } now my require… --- ## [Read input from text file, use the same input in IF condition](https://discuss.elastic.co/t/read-input-from-text-file-use-the-same-input-in-if-condition/226362)
**Author:** [@Yogi\_1224](https://discuss.elastic.co/u/Yogi_1224)\ **Replies:** 0\ **Last updated:** [April 3, 2020, 7:58am UTC](https://discuss.elastic.co/t/read-input-from-text-file-use-the-same-input-in-if-condition/226362 "2020-04-03T07:58:03Z")
I want to read an input from text file and use the same input in IF condition to process some thing. Example: input =\> retrieve from file IF( input == "value" ) { Process Something......... } Can someone please hel… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1533) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1535)