# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1646 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1647 --- ## [Local + cross-cluster search as described in docs is not working](https://discuss.elastic.co/t/local-cross-cluster-search-as-described-in-docs-is-not-working/217271)
**Author:** [@matoro](https://discuss.elastic.co/u/matoro)\ **Replies:** 4\ **Last updated:** [February 5, 2020, 9:54am UTC](https://discuss.elastic.co/t/local-cross-cluster-search-as-described-in-docs-is-not-working/217271 "2020-02-05T09:54:20Z")
Hi, I am trying to create an index pattern in Kibana that will search both local and remote clusters, but I can only ever get it to do one or the other. The approach mentioned in the documentation and in the below forum… --- ## [Query Elasticsearch to get count of Keywords within matched Keywords](https://discuss.elastic.co/t/query-elasticsearch-to-get-count-of-keywords-within-matched-keywords/217945)
**Author:** [@rakmo](https://discuss.elastic.co/u/rakmo)\ **Replies:** 0\ **Last updated:** [February 5, 2020, 9:48am UTC](https://discuss.elastic.co/t/query-elasticsearch-to-get-count-of-keywords-within-matched-keywords/217945 "2020-02-05T09:48:08Z")
Data: Doc 1: field\_a : \["A", "B", 'C", "D", "E"\] Doc 2: field\_a : \["A", "D", "G", "Z", "Y"\] Doc 3: field\_a : \["F", "W", 'C"\] Doc 4: field\_a : \["A", "B", 'C", "D", "E", "Z", "Y"\] Doc 5: … --- ## [Http\_poller: how to use an environment variable for the url?](https://discuss.elastic.co/t/http-poller-how-to-use-an-environment-variable-for-the-url/217935)
**Author:** [@Michel99\_7](https://discuss.elastic.co/u/Michel99_7)\ **Replies:** 1\ **Last updated:** [February 5, 2020, 9:48am UTC](https://discuss.elastic.co/t/http-poller-how-to-use-an-environment-variable-for-the-url/217935 "2020-02-05T09:48:11Z")
I'm trying to use an env variable to define the url when using the http\_poller input plugin. But I have an error about the url encoding which is not good. How to encode it? http\_poller { urls =\> { test =\> { url … --- ## [Region Map drill down action](https://discuss.elastic.co/t/region-map-drill-down-action/217491)
**Author:** [@arunachala](https://discuss.elastic.co/u/arunachala)\ **Replies:** 2\ **Last updated:** [February 5, 2020, 9:45am UTC](https://discuss.elastic.co/t/region-map-drill-down-action/217491 "2020-02-05T09:45:57Z")
Hi, We have the following requirement from Region Map. By default show country wide map with states colored according to some metric. On clicking a particular state, show district/county wise map of that state accordi… --- ## [Index date starting with "Day of Week"](https://discuss.elastic.co/t/index-date-starting-with-day-of-week/217874)
**Author:** [@theonlyalterego](https://discuss.elastic.co/u/theonlyalterego)\ **Replies:** 1\ **Last updated:** [February 5, 2020, 9:45am UTC](https://discuss.elastic.co/t/index-date-starting-with-day-of-week/217874 "2020-02-05T09:45:13Z")
Elastic Error: Caused by: java.lang.IllegalArgumentException: failed to parse date field \[Tue Feb 06 2029 00:00:00 GMT-0500 (Eastern Standard Time)\] with format \[yyyy-MM-dd'T'HH:mm:ss.SSSZ||yyyy-MM-dd'T'HH:mm:ss.SSS'Z'|… --- ## [ES 6.8 Force primary shards of the same index to be allocated to different physical hosts](https://discuss.elastic.co/t/es-6-8-force-primary-shards-of-the-same-index-to-be-allocated-to-different-physical-hosts/217434)
**Author:** [@ld\_pvl](https://discuss.elastic.co/u/ld_pvl)\ **Replies:** 13\ **Last updated:** [February 5, 2020, 9:42am UTC](https://discuss.elastic.co/t/es-6-8-force-primary-shards-of-the-same-index-to-be-allocated-to-different-physical-hosts/217434 "2020-02-05T09:42:32Z")
Hi Team, Is there a way to force primary shards in the same index to be allocated to different physical hosts? (I mean a physical server and not an elasticsearch node.) I know we can do this for replicas of the same sh… --- ## [Email and SSN regex patterns for elastic search](https://discuss.elastic.co/t/email-and-ssn-regex-patterns-for-elastic-search/217869)
**Author:** [@Lisahtwy](https://discuss.elastic.co/u/Lisahtwy)\ **Replies:** 1\ **Last updated:** [February 5, 2020, 9:39am UTC](https://discuss.elastic.co/t/email-and-ssn-regex-patterns-for-elastic-search/217869 "2020-02-05T09:39:56Z")
Hi, I am trying to recognize Email ids and SSNs in files using elastic search. Could somebody tell me the correct regexp patterns to recognize SSN and Email ids. I am using these below patterns: Email: "\[a-zA-Z0-9\]+@… --- ## [Sql\_Last\_Value date format seems to be irrelevant](https://discuss.elastic.co/t/sql-last-value-date-format-seems-to-be-irrelevant/217790)
**Author:** [@Mohan\_vel](https://discuss.elastic.co/u/Mohan_vel)\ **Replies:** 4\ **Last updated:** [February 5, 2020, 9:08am UTC](https://discuss.elastic.co/t/sql-last-value-date-format-seems-to-be-irrelevant/217790 "2020-02-05T09:08:14Z")
Hi All i am using logstash to index document from MSSQL server to elasticsearch, i am using below config file in order to do an incremental indexing, for that i am using using column called modified\_date but having probl… --- ## [How to make changes in config elasticsearch.yml from elasticsearch operator](https://discuss.elastic.co/t/how-to-make-changes-in-config-elasticsearch-yml-from-elasticsearch-operator/217840)
**Author:** [@viveknagar](https://discuss.elastic.co/u/viveknagar)\ **Replies:** 2\ **Last updated:** [February 5, 2020, 8:40am UTC](https://discuss.elastic.co/t/how-to-make-changes-in-config-elasticsearch-yml-from-elasticsearch-operator/217840 "2020-02-05T08:40:03Z")
Hello , I want to make changes in /usr/share/elasticsearch/config/elasticsearch.yml from elasticsearch operator. I am using docker.elastic.co/eck/eck-operator:1.0.0 image of operator . And I have deployed elasticsearc… --- ## [Visualise logs in data table using Terms Aggregation](https://discuss.elastic.co/t/visualise-logs-in-data-table-using-terms-aggregation/217818)
**Author:** [@MPiorunn](https://discuss.elastic.co/u/MPiorunn)\ **Replies:** 2\ **Last updated:** [February 5, 2020, 7:57am UTC](https://discuss.elastic.co/t/visualise-logs-in-data-table-using-terms-aggregation/217818 "2020-02-05T07:57:09Z")
Hello I am working on logs collecting using Elastic Stack and I wanted to present logs in a data table. They should be grouped by "Call ID", which I have achieved using Buckets with Terms aggregation. As you can see, e… --- ## [Elastic 6.3: Is there any way where I can define use same routing as parent?](https://discuss.elastic.co/t/elastic-6-3-is-there-any-way-where-i-can-define-use-same-routing-as-parent/217911)
**Author:** [@Antriksh\_Jain](https://discuss.elastic.co/u/Antriksh_Jain)\ **Replies:** 1\ **Last updated:** [February 5, 2020, 7:52am UTC](https://discuss.elastic.co/t/elastic-6-3-is-there-any-way-where-i-can-define-use-same-routing-as-parent/217911 "2020-02-05T07:52:25Z")
I am using Elastic6.3 version. Since parent and child must use same routing (in order to present in same shard) Is there any setting/parameter where while indexing child document mention that use routing same as parent… --- ## [Can't see 'message.keyword' in field when creating data table visualize](https://discuss.elastic.co/t/cant-see-message-keyword-in-field-when-creating-data-table-visualize/217797)
**Author:** [@Nikhil\_Pillai](https://discuss.elastic.co/u/Nikhil_Pillai)\ **Replies:** 3\ **Last updated:** [February 5, 2020, 7:49am UTC](https://discuss.elastic.co/t/cant-see-message-keyword-in-field-when-creating-data-table-visualize/217797 "2020-02-05T07:49:52Z")
Hi, I am using Kibana 7.5.2 and can't see "message.keyword" when trying to create a "data table" visualize. I need to display error/info/warn message in dashboard using it. I have refreshed the index pattern but it didn… --- ## [Querying elastic with Python API](https://discuss.elastic.co/t/querying-elastic-with-python-api/217922)
**Author:** [@sandeepduppalli](https://discuss.elastic.co/u/sandeepduppalli)\ **Replies:** 0\ **Last updated:** [February 5, 2020, 7:34am UTC](https://discuss.elastic.co/t/querying-elastic-with-python-api/217922 "2020-02-05T07:34:06Z")
Hi Team I have been given assignment of developing a Python API for connecting Elasticsearch and get the things that are requested. For this I have used Python flask. I am trying to test it with Postman. But I am failin… --- ## [How to increase the time for a get request in kibana?](https://discuss.elastic.co/t/how-to-increase-the-time-for-a-get-request-in-kibana/217912)
**Author:** [@irobot678](https://discuss.elastic.co/u/irobot678)\ **Replies:** 0\ **Last updated:** [February 5, 2020, 6:32am UTC](https://discuss.elastic.co/t/how-to-increase-the-time-for-a-get-request-in-kibana/217912 "2020-02-05T06:32:35Z")
Hi, i am using elk 7.1.1 with x-pack installed. I am trying to perform a get command in kibana dev console to get the list of all snapshots GET \_cat/snapshots/\/ output { "statusCode": 504, "err… --- ## [Storing aggregation in elasticsearch](https://discuss.elastic.co/t/storing-aggregation-in-elasticsearch/217904)
**Author:** [@shashwat001](https://discuss.elastic.co/u/shashwat001)\ **Replies:** 1\ **Last updated:** [February 5, 2020, 6:24am UTC](https://discuss.elastic.co/t/storing-aggregation-in-elasticsearch/217904 "2020-02-05T06:24:17Z")
I want to store summarized data in elasticsearch for a time series input. I want to get aggregated data per 5 minutes. Does elasticsearch provide any feature to aggregate data and store in it? I don't want to do aggregat… --- ## [Install elasticsearch rpm in different directory](https://discuss.elastic.co/t/install-elasticsearch-rpm-in-different-directory/217908)
**Author:** [@Ram\_29](https://discuss.elastic.co/u/Ram_29)\ **Replies:** 0\ **Last updated:** [February 5, 2020, 6:20am UTC](https://discuss.elastic.co/t/install-elasticsearch-rpm-in-different-directory/217908 "2020-02-05T06:20:55Z")
Hi I want to install elasticsearch rpm in /opt/ instead of /usr/share. Im planning to use rpm relocate. But then I have to update all startup scripts manually?? Is there any easy way? Regards Ram --- ## [Logstash-SNMP Trap: doesnt read yamlmibdir when it run as service](https://discuss.elastic.co/t/logstash-snmp-trap-doesnt-read-yamlmibdir-when-it-run-as-service/217897)
**Author:** [@Vian\_Handika](https://discuss.elastic.co/u/Vian_Handika)\ **Replies:** 1\ **Last updated:** [February 5, 2020, 6:20am UTC](https://discuss.elastic.co/t/logstash-snmp-trap-doesnt-read-yamlmibdir-when-it-run-as-service/217897 "2020-02-05T06:20:49Z")
Hello, i am sorry before i am a newbie here... i have stuck at this things, i have a problem that my logstash doesnt read snmptrap input for external yaml mib directory when its run as a service (systemctl start logstas… --- ## [Creating pipeline for windows using logstash](https://discuss.elastic.co/t/creating-pipeline-for-windows-using-logstash/217726)
**Author:** [@Ananya\_Mohiley](https://discuss.elastic.co/u/Ananya_Mohiley)\ **Replies:** 2\ **Last updated:** [February 5, 2020, 4:02am UTC](https://discuss.elastic.co/t/creating-pipeline-for-windows-using-logstash/217726 "2020-02-05T04:02:20Z")
i have written the following code for ingesting the files into elastic search /\*input{ file{ path=\>"D:\\SOATE-41\\project\\DOCUMENTATION\\interim\\datacsv.csv" start\_position=\>"beginning" sincedb\_path=\>"/dev/null" } } … --- ## [Grok, variable lenght array beside normal fields](https://discuss.elastic.co/t/grok-variable-lenght-array-beside-normal-fields/217864)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 5\ **Last updated:** [February 5, 2020, 2:42am UTC](https://discuss.elastic.co/t/grok-variable-lenght-array-beside-normal-fields/217864 "2020-02-05T02:42:49Z")
Hi, I have a log tat contains an array and normal fields, separated by a space field1 field2 \['27', '32'\] field4 my grok will be %{DATA:field1} %{DATA:field2} ??????? %{DATA:field4} How can I grok this variable leng… --- ## [What is the grok pattern for this jenkins log?](https://discuss.elastic.co/t/what-is-the-grok-pattern-for-this-jenkins-log/216357)
**Author:** [@souravatta](https://discuss.elastic.co/u/souravatta)\ **Replies:** 1\ **Last updated:** [February 5, 2020, 2:17am UTC](https://discuss.elastic.co/t/what-is-the-grok-pattern-for-this-jenkins-log/216357 "2020-02-05T02:17:15Z")
Hi, Can you please help me with the grok pattern for this jenkins sample data or log. The log is only a single line. hudson.slaves.CommandLauncher launch\\nSEVERE: Unable to launch the agent for dot-dewsttlas403-ci\\njav… --- ## [Apply elastic plugin on array items](https://discuss.elastic.co/t/apply-elastic-plugin-on-array-items/216445)
**Author:** [@parosio](https://discuss.elastic.co/u/parosio)\ **Replies:** 1\ **Last updated:** [February 5, 2020, 2:15am UTC](https://discuss.elastic.co/t/apply-elastic-plugin-on-array-items/216445 "2020-02-05T02:15:18Z")
Hello, I need to apply a search/translate for a field which optionally contains multiple values: event\_id;ext\_ref; ... other fields "#123";"ref3"; . . . "#244";"ref2|ref7"; . . . the second field should be s… --- ## [How can I remove logstash process?](https://discuss.elastic.co/t/how-can-i-remove-logstash-process/216474)
**Author:** [@lilyyy](https://discuss.elastic.co/u/lilyyy)\ **Replies:** 1\ **Last updated:** [February 5, 2020, 2:14am UTC](https://discuss.elastic.co/t/how-can-i-remove-logstash-process/216474 "2020-02-05T02:14:24Z")
I killed logstash process, but this process still remain. so I tried to kill the process with 'kill -9 \[PID\]', but I got error message like bash: kill: (36888) - No such process even if it is existing and then chaning … --- ## [While Filebeat talking to Logstash, logstash throws this error](https://discuss.elastic.co/t/while-filebeat-talking-to-logstash-logstash-throws-this-error/216495)
**Author:** [@praveenmak](https://discuss.elastic.co/u/praveenmak)\ **Replies:** 1\ **Last updated:** [February 5, 2020, 2:11am UTC](https://discuss.elastic.co/t/while-filebeat-talking-to-logstash-logstash-throws-this-error/216495 "2020-02-05T02:11:45Z")
I see this error in Logstash logs (earlier I started with DEBUG mode but seems its all the time). The data is not getting ingested at all. Any idea how to resolve this ? please help \[2020-01-24T17:30:22,282\]\[INFO \]\[or… --- ## [Term Lookup Filter array Max size limit](https://discuss.elastic.co/t/term-lookup-filter-array-max-size-limit/217890)
**Author:** [@Rajesh\_Shetty](https://discuss.elastic.co/u/Rajesh_Shetty)\ **Replies:** 0\ **Last updated:** [February 4, 2020, 11:36pm UTC](https://discuss.elastic.co/t/term-lookup-filter-array-max-size-limit/217890 "2020-02-04T23:36:42Z")
We are on still using 1.7 using term lookup filter (https://www.elastic.co/blog/terms-filter-lookup) a lot for filtering out data thru id mapping . Question is what is the limit of how big a document can be in terms of a… --- ## [Exclude records by an existing value in a group](https://discuss.elastic.co/t/exclude-records-by-an-existing-value-in-a-group/217849)
**Author:** [@Carlos\_Arturo\_Bernal](https://discuss.elastic.co/u/Carlos_Arturo_Bernal)\ **Replies:** 3\ **Last updated:** [February 4, 2020, 11:04pm UTC](https://discuss.elastic.co/t/exclude-records-by-an-existing-value-in-a-group/217849 "2020-02-04T23:04:42Z")
Hello, I'm currently storing in ElasticSearch build data from Jenkins, related to the success of client deployments. If we see such data as a table, this is what I have: client\_id build\_url result 123456 http:/… --- ## [Nested aggregation of 7 documents takes 1 min](https://discuss.elastic.co/t/nested-aggregation-of-7-documents-takes-1-min/217823)
**Author:** [@naoko](https://discuss.elastic.co/u/naoko)\ **Replies:** 21\ **Last updated:** [February 4, 2020, 10:33pm UTC](https://discuss.elastic.co/t/nested-aggregation-of-7-documents-takes-1-min/217823 "2020-02-04T22:33:36Z")
I have the following query where query will return 7 hits and if execute without agg, it complete in 62ms. removing nested "hour\_bucket" agg will complete in 180ms but executing nested aggs takes about 1 min is the qu… --- ## [How to paginate items with specified order with ElasticSearch](https://discuss.elastic.co/t/how-to-paginate-items-with-specified-order-with-elasticsearch/217888)
**Author:** [@jmessin1](https://discuss.elastic.co/u/jmessin1)\ **Replies:** 0\ **Last updated:** [February 4, 2020, 10:27pm UTC](https://discuss.elastic.co/t/how-to-paginate-items-with-specified-order-with-elasticsearch/217888 "2020-02-04T22:27:24Z")
Im trying to browse a user's ratings sorted by their rating date with pagination. If it's simply getting a page of results then I can just paginate before calling ElasticSearch, i.e. fetch 20 items sorted by rating date,… --- ## [Alerting on metrics](https://discuss.elastic.co/t/alerting-on-metrics/217873)
**Author:** [@stuart475898](https://discuss.elastic.co/u/stuart475898)\ **Replies:** 1\ **Last updated:** [February 4, 2020, 10:20pm UTC](https://discuss.elastic.co/t/alerting-on-metrics/217873 "2020-02-04T22:20:44Z")
Hello, Currently doing some initial research into elastic for use among other things as an infrastructure monitoring tool. Metricbeat + elastic appear to give us exactly the sort of thing we want, so I started the 14 da… --- ## [Pretty JSON format of recieved (dot separated) log data fields](https://discuss.elastic.co/t/pretty-json-format-of-recieved-dot-separated-log-data-fields/217796)
**Author:** [@Roman\_Konkol](https://discuss.elastic.co/u/Roman_Konkol)\ **Replies:** 3\ **Last updated:** [February 4, 2020, 10:06pm UTC](https://discuss.elastic.co/t/pretty-json-format-of-recieved-dot-separated-log-data-fields/217796 "2020-02-04T22:06:43Z")
Hi all, can you help me, please? I want to see my whole log entries in pretty JSON format on Kibana Discovery page. What I received from logstash: log entries with "dot case format" fields like: http.host, http.body,… --- ## [Updating the dictionary file used in translate filter while logs are being processed](https://discuss.elastic.co/t/updating-the-dictionary-file-used-in-translate-filter-while-logs-are-being-processed/214494)
**Author:** [@dmalhan](https://discuss.elastic.co/u/dmalhan)\ **Replies:** 8\ **Last updated:** [February 4, 2020, 10:00pm UTC](https://discuss.elastic.co/t/updating-the-dictionary-file-used-in-translate-filter-while-logs-are-being-processed/214494 "2020-02-04T22:00:53Z")
Currently the Logstash instance that we're running basically runs 24 hours a day (processes millions of logs everyday). It's using a file as a mapping dictionary through a Translate filter with the default refresh interv… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1645) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1647)