# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1540 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1541 --- ## [Ingest attachment in nested type](https://discuss.elastic.co/t/ingest-attachment-in-nested-type/226014)
**Author:** [@mattiacareddu](https://discuss.elastic.co/u/mattiacareddu)\ **Replies:** 1\ **Last updated:** [April 1, 2020, 9:35am UTC](https://discuss.elastic.co/t/ingest-attachment-in-nested-type/226014 "2020-04-01T09:35:40Z")
Hi, I'm trying to index multiple documents in nested type using ingest attachment plugin. Simply I create my pipeline as follow: { "description": "Extract attachment information", "processors": \[ { … --- ## [Not able to set index.mapping.single\_type: true on an index](https://discuss.elastic.co/t/not-able-to-set-index-mapping-single-type-true-on-an-index/225967)
**Author:** [@nages](https://discuss.elastic.co/u/nages)\ **Replies:** 7\ **Last updated:** [April 1, 2020, 9:27am UTC](https://discuss.elastic.co/t/not-able-to-set-index-mapping-single-type-true-on-an-index/225967 "2020-04-01T09:27:18Z")
I had an index that had single type. Now, I am planning to enable "index.mapping.single\_type" and I triggered the following API to make it happen, got the following error. BTW, I closed the index before applying the ab… --- ## [When I tried to upsert using UpdateRequest object with type as "UPDATE", I met reject message](https://discuss.elastic.co/t/when-i-tried-to-upsert-using-updaterequest-object-with-type-as-update-i-met-reject-message/225826)
**Author:** [@Kooin-Shin](https://discuss.elastic.co/u/Kooin-Shin)\ **Replies:** 7\ **Last updated:** [April 1, 2020, 9:25am UTC](https://discuss.elastic.co/t/when-i-tried-to-upsert-using-updaterequest-object-with-type-as-update-i-met-reject-message/225826 "2020-04-01T09:25:39Z")
First of all, I did tried to upsert to Elastic Search with document. So I used org.elasticsearch.action.update.UpdateRequest object to upsert process. The code is blow. String type = map.remove("\<%=UPDATE%\>")+""; Strin… --- ## [Synonym token filter question](https://discuss.elastic.co/t/synonym-token-filter-question/225892)
**Author:** [@nages](https://discuss.elastic.co/u/nages)\ **Replies:** 2\ **Last updated:** [April 1, 2020, 9:03am UTC](https://discuss.elastic.co/t/synonym-token-filter-question/225892 "2020-04-01T09:03:43Z")
I created a test index with synonym token filter \> PUT /synonyms-index { "settings": { "analysis": { "filter": { "my\_synonym\_filter": { "type": "synonym", "synonyms": \[ "shares","equity","stock" \] } }, "ana… --- ## [Search using term on Next 7.6.1 not returning any result](https://discuss.elastic.co/t/search-using-term-on-next-7-6-1-not-returning-any-result/225687)
**Author:** [@Shahed\_Aziz](https://discuss.elastic.co/u/Shahed_Aziz)\ **Replies:** 5\ **Last updated:** [April 1, 2020, 8:58am UTC](https://discuss.elastic.co/t/search-using-term-on-next-7-6-1-not-returning-any-result/225687 "2020-04-01T08:58:18Z")
Hi, I inserted some data to an index. To search on that, when I use match all, I can see my data. var temp = \_elasticClient.SearchAsync\(s =\> s.MatchAll(), cancellationToken); But when I sea… --- ## [This writer hit an unrecoverable error; cannot merge](https://discuss.elastic.co/t/this-writer-hit-an-unrecoverable-error-cannot-merge/226009)
**Author:** [@tonysangyeop](https://discuss.elastic.co/u/tonysangyeop)\ **Replies:** 0\ **Last updated:** [April 1, 2020, 8:47am UTC](https://discuss.elastic.co/t/this-writer-hit-an-unrecoverable-error-cannot-merge/226009 "2020-04-01T08:47:07Z")
Elasticsearch version : 6.1.1 mapping =\> "\_routing" : { "required" : true } "join\_field" : { "type" : "join", "eager\_global\_ordinals": true, "relations": { "ques… --- ## [Why is docvalue\_fields much faster than source.includes?](https://discuss.elastic.co/t/why-is-docvalue-fields-much-faster-than-source-includes/225972)
**Author:** [@G-K-Patel](https://discuss.elastic.co/u/G-K-Patel)\ **Replies:** 2\ **Last updated:** [April 1, 2020, 8:44am UTC](https://discuss.elastic.co/t/why-is-docvalue-fields-much-faster-than-source-includes/225972 "2020-04-01T08:44:12Z")
Hi Elastic Community, I have seen drastic change in retrival speed when using docvalue\_fields instead of source.includes, as speficied in the documentation. Can someone explain to me what is the different between the t… --- ## [Parent-Child Relationship while upgrading ES 2.4 to 7.6](https://discuss.elastic.co/t/parent-child-relationship-while-upgrading-es-2-4-to-7-6/226008)
**Author:** [@Prasiddha](https://discuss.elastic.co/u/Prasiddha)\ **Replies:** 0\ **Last updated:** [April 1, 2020, 8:43am UTC](https://discuss.elastic.co/t/parent-child-relationship-while-upgrading-es-2-4-to-7-6/226008 "2020-04-01T08:43:51Z")
I am upgrading ES 2.4 to 7.6. Previously I had two different types in ES 2.4, say A and B. 'A' was parent and 'B' was child. Now, what would be the best way maintain this relationship in ES 7.6? Possibilities I came t… --- ## [Snapshot restore is very slow to get started](https://discuss.elastic.co/t/snapshot-restore-is-very-slow-to-get-started/225840)
**Author:** [@Guilherme\_Vieira](https://discuss.elastic.co/u/Guilherme_Vieira)\ **Replies:** 12\ **Last updated:** [April 1, 2020, 8:40am UTC](https://discuss.elastic.co/t/snapshot-restore-is-very-slow-to-get-started/225840 "2020-04-01T08:40:20Z")
I have been observing really slow start up times for restoring snapshots in elasticsearch. I am using graphana as a tool to monitor the cluster. As you can see the snapshot was started around 17:15 and only saw significa… --- ## [Space in key : remove\_char\_key is not working](https://discuss.elastic.co/t/space-in-key-remove-char-key-is-not-working/225873)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 9\ **Last updated:** [April 1, 2020, 8:08am UTC](https://discuss.elastic.co/t/space-in-key-remove-char-key-is-not-working/225873 "2020-04-01T08:08:27Z")
Hello ! I have a nested part in a log I can't succeed to parse : Here is my config : filter { #replace second "msg" field by "nested" field mutate { gsub =\> \["message", "Message=", " nested="\] } kv { … --- ## [Why node uuid replace by {bootstrap-placeholder}-{NodeName}](https://discuss.elastic.co/t/why-node-uuid-replace-by-bootstrap-placeholder-nodename/225869)
**Author:** [@yc1024](https://discuss.elastic.co/u/yc1024)\ **Replies:** 5\ **Last updated:** [April 1, 2020, 7:58am UTC](https://discuss.elastic.co/t/why-node-uuid-replace-by-bootstrap-placeholder-nodename/225869 "2020-04-01T07:58:12Z")
ES version: 7.6.0 I have 3 master and 3 node in my cluster. This is the first time i start the cluster,i have configed discovery.seed\_hosts and cluster.initial\_master\_nodes as follow: discovery.seed\_hosts: ipOfMaster1… --- ## [New indices created via rollover don't automatically inherit the policy used by the old index](https://discuss.elastic.co/t/new-indices-created-via-rollover-dont-automatically-inherit-the-policy-used-by-the-old-index/225996)
**Author:** [@prs](https://discuss.elastic.co/u/prs)\ **Replies:** 0\ **Last updated:** [April 1, 2020, 7:40am UTC](https://discuss.elastic.co/t/new-indices-created-via-rollover-dont-automatically-inherit-the-policy-used-by-the-old-index/225996 "2020-04-01T07:40:55Z")
Hi friends, I use Es, Logstash and Kibana on a VM and I receive Logs from filebeat on a few VMs. ES, Logstash and kibana version 7.3.0 and filebeat in 2 version 7.5.2 and 7.6.1 . I use filebeat Modules like apache and… --- ## [Why Composite Aggregation In Java make getBuckets() not public while another agg type is public](https://discuss.elastic.co/t/why-composite-aggregation-in-java-make-getbuckets-not-public-while-another-agg-type-is-public/225997)
**Author:** [@Hi\_u\_Nguy\_n](https://discuss.elastic.co/u/Hi_u_Nguy_n)\ **Replies:** 0\ **Last updated:** [April 1, 2020, 7:41am UTC](https://discuss.elastic.co/t/why-composite-aggregation-in-java-make-getbuckets-not-public-while-another-agg-type-is-public/225997 "2020-04-01T07:41:31Z")
Why Composite Aggregation In Java make InternalBucket not public ? So, I can't get buckets for my purporse ?? The class InternalBucket inside InternalComposite class (Result Aggration of the CompositeAggragation query … --- ## [Question regarding "current" columns in cat nodes API](https://discuss.elastic.co/t/question-regarding-current-columns-in-cat-nodes-api/225959)
**Author:** [@surilshah](https://discuss.elastic.co/u/surilshah)\ **Replies:** 1\ **Last updated:** [April 1, 2020, 7:27am UTC](https://discuss.elastic.co/t/question-regarding-current-columns-in-cat-nodes-api/225959 "2020-04-01T07:27:03Z")
Are the values that we receive from current columns like indexing.index\_current and search.query\_current, giving instantaneous or per second values? --- ## [How to install Kibana and Elastic search on the machine to get a login prompt on starting Kibana](https://discuss.elastic.co/t/how-to-install-kibana-and-elastic-search-on-the-machine-to-get-a-login-prompt-on-starting-kibana/225971)
**Author:** [@pranay\_bhatnagar](https://discuss.elastic.co/u/pranay_bhatnagar)\ **Replies:** 2\ **Last updated:** [April 1, 2020, 6:50am UTC](https://discuss.elastic.co/t/how-to-install-kibana-and-elastic-search-on-the-machine-to-get-a-login-prompt-on-starting-kibana/225971 "2020-04-01T06:50:08Z")
I want to have a login prompt in start of the Kibana custom plugin. I have created a custom app level plugin but there is no login prompt on opening the custom app level plugin. What are the steps to install Kibana/Elas… --- ## [Regarding Cluster State](https://discuss.elastic.co/t/regarding-cluster-state/225810)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 4\ **Last updated:** [April 1, 2020, 6:54am UTC](https://discuss.elastic.co/t/regarding-cluster-state/225810 "2020-04-01T06:54:36Z")
Hi, Can I ask, is there a metric which tell me the size of the cluster state? And how long it takes to be updated? And if there isn't, how might I go about measuring that? Thx D --- ## [Some logs are missing in elk](https://discuss.elastic.co/t/some-logs-are-missing-in-elk/225977)
**Author:** [@Afrin](https://discuss.elastic.co/u/Afrin)\ **Replies:** 0\ **Last updated:** [April 1, 2020, 5:51am UTC](https://discuss.elastic.co/t/some-logs-are-missing-in-elk/225977 "2020-04-01T05:51:44Z")
Hi, The problem we are facing is some logs are missing in elk while few are available. We cannot find the root cause for this issue because the logs which are missing and those which are available look similar. We canno… --- ## [Elasticsearch support on Centos 8](https://discuss.elastic.co/t/elasticsearch-support-on-centos-8/223253)
**Author:** [@shivani\_aggarwal](https://discuss.elastic.co/u/shivani_aggarwal)\ **Replies:** 2\ **Last updated:** [April 1, 2020, 6:32am UTC](https://discuss.elastic.co/t/elasticsearch-support-on-centos-8/223253 "2020-04-01T06:32:02Z")
Hello, Does ELK stack support Centos 8.1? If yes, from which ELK version is this support available? I have checked the support matrix https://www.elastic.co/support/matrix but there is no mention of Centos 8. Regards, … --- ## [Apply Composite Aggregation on Filtered Data](https://discuss.elastic.co/t/apply-composite-aggregation-on-filtered-data/225790)
**Author:** [@Srinivas\_AR](https://discuss.elastic.co/u/Srinivas_AR)\ **Replies:** 1\ **Last updated:** [April 1, 2020, 6:01am UTC](https://discuss.elastic.co/t/apply-composite-aggregation-on-filtered-data/225790 "2020-04-01T06:01:10Z")
I'm using "Composite Aggregation" as my use case requires "Pagination" on buckets returned by Aggregation, as the number of returned buckets could be huge. I also need to run "Composite aggregation" on a specific time r… --- ## [Cant able to find csv reports in kibana](https://discuss.elastic.co/t/cant-able-to-find-csv-reports-in-kibana/223771)
**Author:** [@irobot678](https://discuss.elastic.co/u/irobot678)\ **Replies:** 4\ **Last updated:** [April 1, 2020, 5:22am UTC](https://discuss.elastic.co/t/cant-able-to-find-csv-reports-in-kibana/223771 "2020-04-01T05:22:04Z")
Hi, i am using kibana of version 7.1.1 with x-pack enaled, Still I'm not able to generate csv reports. In the share section i am able to see only permalinks and not csv report. Please help me solve it. --- ## [Need to create a timestamp by concatenating the fields](https://discuss.elastic.co/t/need-to-create-a-timestamp-by-concatenating-the-fields/225922)
**Author:** [@ranjini](https://discuss.elastic.co/u/ranjini)\ **Replies:** 6\ **Last updated:** [April 1, 2020, 5:11am UTC](https://discuss.elastic.co/t/need-to-create-a-timestamp-by-concatenating-the-fields/225922 "2020-04-01T05:11:19Z")
log file : INFO \[Thread-6\] (newcleintt.java:1400) - Trying to connect to broker: local-broker (ssl://localhost:1234) filter used : grok { match =\> {"message" =\> "%{LOGLEVEL:loglevel} \\{%{Y… --- ## [Parsing logs from audit.log from /var/log/audit/audit.log](https://discuss.elastic.co/t/parsing-logs-from-audit-log-from-var-log-audit-audit-log/225577)
**Author:** [@ranjini](https://discuss.elastic.co/u/ranjini)\ **Replies:** 5\ **Last updated:** [March 30, 2020, 11:05am UTC](https://discuss.elastic.co/t/parsing-logs-from-audit-log-from-var-log-audit-audit-log/225577 "2020-03-30T11:05:52Z")
Logfile contents type=USER\_END msg=audit(1585509001.049:14007): pid=15642 uid=0 auid=0 ses=1100 msg='op=PAM:session\_close grantors=pam\_loginuid,pam\_keyinit,pam\_limits,pam\_systemd acct="root" exe="/usr/sbin/crond" hostnam… --- ## [How to get the json api data into message field in http poller using logsatsh config file](https://discuss.elastic.co/t/how-to-get-the-json-api-data-into-message-field-in-http-poller-using-logsatsh-config-file/225686)
**Author:** [@Mithuna](https://discuss.elastic.co/u/Mithuna)\ **Replies:** 6\ **Last updated:** [April 1, 2020, 4:16am UTC](https://discuss.elastic.co/t/how-to-get-the-json-api-data-into-message-field-in-http-poller-using-logsatsh-config-file/225686 "2020-04-01T04:16:52Z")
Hi, Im using http poller to get API data output to be ingested into elastic search. I'm not getting any error but the message field is empty. My config file is input { stdin{} http\_poller { urls =\> { q1 =\> { … --- ## [Getting Alias definition for most recent index when index name is unknown](https://discuss.elastic.co/t/getting-alias-definition-for-most-recent-index-when-index-name-is-unknown/225968)
**Author:** [@lmit](https://discuss.elastic.co/u/lmit)\ **Replies:** 0\ **Last updated:** [April 1, 2020, 3:37am UTC](https://discuss.elastic.co/t/getting-alias-definition-for-most-recent-index-when-index-name-is-unknown/225968 "2020-04-01T03:37:25Z")
I am trying to write a single query to retrieve the most recent Alias definition , where I do NOT know the name of the most recent index ( because index names include a date stamp, e.g. canpi-v1-2020.03.02 ) The API doc… --- ## [Failed to create filtered alias with terms lookup](https://discuss.elastic.co/t/failed-to-create-filtered-alias-with-terms-lookup/225531)
**Author:** [@Junjun\_Zhang](https://discuss.elastic.co/u/Junjun_Zhang)\ **Replies:** 3\ **Last updated:** [April 1, 2020, 1:16am UTC](https://discuss.elastic.co/t/failed-to-create-filtered-alias-with-terms-lookup/225531 "2020-04-01T01:16:02Z")
Hello, I have run into exactly the same problem reported in this closed topic: https://discuss.elastic.co/t/terms-lookup-in-a-filtered-alias/206838. Since it's not been answered, I am posting it again. Much appreciated… --- ## [Reducing processing/storage size with post transaction reporting decision in agent?](https://discuss.elastic.co/t/reducing-processing-storage-size-with-post-transaction-reporting-decision-in-agent/225723)
**Author:** [@rrupp\_mgp](https://discuss.elastic.co/u/rrupp_mgp)\ **Replies:** 5\ **Last updated:** [April 1, 2020, 1:06am UTC](https://discuss.elastic.co/t/reducing-processing-storage-size-with-post-transaction-reporting-decision-in-agent/225723 "2020-04-01T01:06:59Z")
Kibana version: 7.6.1 Elasticsearch version: 7.6.1 APM Server version: 7.6.1 APM Agent language and version: Java Agent 1.14.0 Hi, I'm experimenting with APM with the Java Agent and am exploring ways to reduce proce… --- ## [Weird issue with keyword field](https://discuss.elastic.co/t/weird-issue-with-keyword-field/225733)
**Author:** [@tsgdphillips](https://discuss.elastic.co/u/tsgdphillips)\ **Replies:** 2\ **Last updated:** [April 1, 2020, 12:37am UTC](https://discuss.elastic.co/t/weird-issue-with-keyword-field/225733 "2020-04-01T00:37:53Z")
I'm working on an issue with a client's kibana installation, where no results are returned for a specific keyword entry, but direct queries to elasticsearch do return a result. There are three values in the field; the ot… --- ## [How to create a Visualization with %](https://discuss.elastic.co/t/how-to-create-a-visualization-with/225259)
**Author:** [@Claudio\_Ract\_Costa](https://discuss.elastic.co/u/Claudio_Ract_Costa)\ **Replies:** 2\ **Last updated:** [March 31, 2020, 11:41pm UTC](https://discuss.elastic.co/t/how-to-create-a-visualization-with/225259 "2020-03-31T23:41:59Z")
HI Guys, How can I create a Visualization like this one bellow ? I would like to insert it in a Dashboard. --- ## [Logstash change default @timestamp value by field from mongo](https://discuss.elastic.co/t/logstash-change-default-timestamp-value-by-field-from-mongo/225911)
**Author:** [@7cinquante](https://discuss.elastic.co/u/7cinquante)\ **Replies:** 6\ **Last updated:** [March 31, 2020, 11:07pm UTC](https://discuss.elastic.co/t/logstash-change-default-timestamp-value-by-field-from-mongo/225911 "2020-03-31T23:07:51Z")
Hello, I would like get @timestamp to be my mongo field "created\_at", i do input { jdbc { jdbc\_driver\_library =\> "/usr/share/logstash/logstash-core/lib/jars/mongojdbc1.8.jar" jdbc\_driver\_class =\> "com.dbschem… --- ## [Logstash: Replace @timestamp with time like this 2020-03-27T16:00:40.982652300+00:00](https://discuss.elastic.co/t/logstash-replace-timestamp-with-time-like-this-2020-03-27t1640-982652300-00-00/225938)
**Author:** [@Paul\_Offord](https://discuss.elastic.co/u/Paul_Offord)\ **Replies:** 5\ **Last updated:** [March 31, 2020, 11:06pm UTC](https://discuss.elastic.co/t/logstash-replace-timestamp-with-time-like-this-2020-03-27t1640-982652300-00-00/225938 "2020-03-31T23:06:44Z")
Hi, I need to replace the @timestamp value with a field value (called SystemTime) that looks like this: 2020-03-27T16:00:40.982652300+00:00 I have tried numerous variations of mutate gsub and the date filter but it's o… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1539) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1541)