# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1793 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1794 --- ## [Multiple filebeat to one logstash. How to optimize the configuration](https://discuss.elastic.co/t/multiple-filebeat-to-one-logstash-how-to-optimize-the-configuration/207045)
**Author:** [@katara](https://discuss.elastic.co/u/katara)\ **Replies:** 3\ **Last updated:** [November 8, 2019, 3:47pm UTC](https://discuss.elastic.co/t/multiple-filebeat-to-one-logstash-how-to-optimize-the-configuration/207045 "2019-11-08T15:47:56Z")
I have 10 servers that i have Filebeat installed in. Each server monitors 2 applications, a total of 20 applications. I have one Logstash server which collects all the above logs and passes it to Elasticsearch after fil… --- ## [What are best practices for matching incoming log sources?](https://discuss.elastic.co/t/what-are-best-practices-for-matching-incoming-log-sources/206496)
**Author:** [@meatwad](https://discuss.elastic.co/u/meatwad)\ **Replies:** 3\ **Last updated:** [November 8, 2019, 3:42pm UTC](https://discuss.elastic.co/t/what-are-best-practices-for-matching-incoming-log-sources/206496 "2019-11-08T15:42:50Z")
Hi, I'm getting started on sorting incoming log sources and was wondering what best practice is for doing so. For example, I'm collecting logs from a variety of sources including Palo Alto firewalls, Aruba NAC, PulseSe… --- ## [Multiple query with wildcard](https://discuss.elastic.co/t/multiple-query-with-wildcard/205920)
**Author:** [@icirco](https://discuss.elastic.co/u/icirco)\ **Replies:** 2\ **Last updated:** [November 8, 2019, 3:31pm UTC](https://discuss.elastic.co/t/multiple-query-with-wildcard/205920 "2019-11-08T15:31:10Z")
hello, How to query easily ? Is any tool to help to implement the query ? I've success to query on a range time but I would like to add a condition on a message pattern... How to do that ? I've tried something like th… --- ## [Term Agregation in Kibana: Fielddata is disabled on text fields by default](https://discuss.elastic.co/t/term-agregation-in-kibana-fielddata-is-disabled-on-text-fields-by-default/206370)
**Author:** [@AndresL](https://discuss.elastic.co/u/AndresL)\ **Replies:** 2\ **Last updated:** [November 8, 2019, 3:22pm UTC](https://discuss.elastic.co/t/term-agregation-in-kibana-fielddata-is-disabled-on-text-fields-by-default/206370 "2019-11-08T15:22:07Z")
HI, In a ESS cluster, Im sending log with Filebeat, and with kibana im trying to create a visualization, Pie Chart by host.hostname. Then I create a Term agregation by hostname and when i execute the visualization i ge… --- ## [Issue with date](https://discuss.elastic.co/t/issue-with-date/207028)
**Author:** [@mbrown007](https://discuss.elastic.co/u/mbrown007)\ **Replies:** 1\ **Last updated:** [November 8, 2019, 3:07pm UTC](https://discuss.elastic.co/t/issue-with-date/207028 "2019-11-08T15:07:47Z")
I have found when I add an entry there is no issue but when I attempt to modify the record I see the following and at no time do I have anything in my log file that says "tco". The only location for this is where It says… --- ## [Combine request and response based on field in log - ELK](https://discuss.elastic.co/t/combine-request-and-response-based-on-field-in-log-elk/207073)
**Author:** [@pdkgamage](https://discuss.elastic.co/u/pdkgamage)\ **Replies:** 1\ **Last updated:** [November 8, 2019, 3:02pm UTC](https://discuss.elastic.co/t/combine-request-and-response-based-on-field-in-log-elk/207073 "2019-11-08T15:02:51Z")
We have ELK setup with filebeat, logstash and elasticsearch and kibana. I need aggregate request and response at the logstash. I have configured pipeline configuration as below. now log aggregation working without any i… --- ## [Kibana index is not showing](https://discuss.elastic.co/t/kibana-index-is-not-showing/207112)
**Author:** [@saravana\_hariharan](https://discuss.elastic.co/u/saravana_hariharan)\ **Replies:** 1\ **Last updated:** [November 8, 2019, 3:00pm UTC](https://discuss.elastic.co/t/kibana-index-is-not-showing/207112 "2019-11-08T15:00:34Z")
In kibana its not showing index. in elasticsearch box but file successfully configured in logstash indexpattern below rectangular box cant show the elasticsearch indices how to i get that regards saravanan --- ## [Master not discovered or elected yet](https://discuss.elastic.co/t/master-not-discovered-or-elected-yet/206911)
**Author:** [@skills-anand](https://discuss.elastic.co/u/skills-anand)\ **Replies:** 2\ **Last updated:** [November 7, 2019, 2:14pm UTC](https://discuss.elastic.co/t/master-not-discovered-or-elected-yet/206911 "2019-11-07T14:14:24Z")
Hello, I have a cluster with 4 nodes. Where node 1 is master and all other nodes i set master as false. I tried to connect with 3 nodes properly when i start connecting with node 4 in same cluster i got the following e… --- ## [Replace old documents](https://discuss.elastic.co/t/replace-old-documents/207126)
**Author:** [@shankaran](https://discuss.elastic.co/u/shankaran)\ **Replies:** 0\ **Last updated:** [November 8, 2019, 2:10pm UTC](https://discuss.elastic.co/t/replace-old-documents/207126 "2019-11-08T14:10:59Z")
in My application Every day 6 times (4hrs per run) index will be updated by latest exchange rates documents. Any one could guide me on best approach how to delete my old documents (having SourceCurrency=USD) from logsta… --- ## [Default\_operator 'AND' with query\_string does not work properly](https://discuss.elastic.co/t/default-operator-and-with-query-string-does-not-work-properly/203667)
**Author:** [@Flinou](https://discuss.elastic.co/u/Flinou)\ **Replies:** 4\ **Last updated:** [November 8, 2019, 1:55pm UTC](https://discuss.elastic.co/t/default-operator-and-with-query-string-does-not-work-properly/203667 "2019-11-08T13:55:55Z")
I have some issues trying to make default\_operator AND work with query\_string on multiple fields. (Elastic Search v 7.2) Here is my query and the document indexed : POST testeur/\_doc/document { "content": "attention … --- ## [Navbar](https://discuss.elastic.co/t/navbar/206336)
**Author:** [@Bhagyashree\_G\_R](https://discuss.elastic.co/u/Bhagyashree_G_R)\ **Replies:** 1\ **Last updated:** [November 8, 2019, 1:45pm UTC](https://discuss.elastic.co/t/navbar/206336 "2019-11-08T13:45:02Z")
i wanted to add new tab in kibana? can anyone tell me please.. our team wants to add new angular page in kibana --- ## ["No search context found for id" during reindex](https://discuss.elastic.co/t/no-search-context-found-for-id-during-reindex/206169)
**Author:** [@tomhe](https://discuss.elastic.co/u/tomhe)\ **Replies:** 1\ **Last updated:** [November 8, 2019, 1:39pm UTC](https://discuss.elastic.co/t/no-search-context-found-for-id-during-reindex/206169 "2019-11-08T13:39:40Z")
I've started to get the following exception during reindex operations: elasticsearch.exceptions.NotFoundError: NotFoundError(404, 'search\_phase\_execution\_exception', 'No search context found for id \[3764110\]') What can… --- ## [Top hits per type of each day](https://discuss.elastic.co/t/top-hits-per-type-of-each-day/206299)
**Author:** [@rahul\_saini](https://discuss.elastic.co/u/rahul_saini)\ **Replies:** 1\ **Last updated:** [November 8, 2019, 1:38pm UTC](https://discuss.elastic.co/t/top-hits-per-type-of-each-day/206299 "2019-11-08T13:38:11Z")
Hello, I've an application with two modules - frontend & backend. Both are getting scanned for defects multiple times a day. We're collecting these results and pushing them over Elasticsearch, so we can see the defect… --- ## [Spaces in Kibana](https://discuss.elastic.co/t/spaces-in-kibana/206252)
**Author:** [@ashish1490](https://discuss.elastic.co/u/ashish1490)\ **Replies:** 1\ **Last updated:** [November 8, 2019, 1:27pm UTC](https://discuss.elastic.co/t/spaces-in-kibana/206252 "2019-11-08T13:27:20Z")
Can we create SPACES automatically. Please suggest. Help need urgent asap. Thanks --- ## [Is it possible to bring SAR logs to kibana?](https://discuss.elastic.co/t/is-it-possible-to-bring-sar-logs-to-kibana/206232)
**Author:** [@anusree\_arun](https://discuss.elastic.co/u/anusree_arun)\ **Replies:** 1\ **Last updated:** [November 8, 2019, 1:26pm UTC](https://discuss.elastic.co/t/is-it-possible-to-bring-sar-logs-to-kibana/206232 "2019-11-08T13:26:34Z")
i want to open SAR logs in kibana.Is it possible --- ## [Match\_phrase + fuzziness query porting from ES 1.7.x to ES 7.1.x](https://discuss.elastic.co/t/match-phrase-fuzziness-query-porting-from-es-1-7-x-to-es-7-1-x/207109)
**Author:** [@joneslee85](https://discuss.elastic.co/u/joneslee85)\ **Replies:** 0\ **Last updated:** [November 8, 2019, 12:25pm UTC](https://discuss.elastic.co/t/match-phrase-fuzziness-query-porting-from-es-1-7-x-to-es-7-1-x/207109 "2019-11-08T12:25:59Z")
Here is my ES 1.7.x match\_phrase query with fuzziness # https://www.elastic.co/guide/en/elasticsearch/reference/1.7/query-dsl-match-query.html # ES 1.7.x { "match\_phrase": { "highlightable": { "query": "this… --- ## [Issues with searching data in array](https://discuss.elastic.co/t/issues-with-searching-data-in-array/204420)
**Author:** [@karthiknpy](https://discuss.elastic.co/u/karthiknpy)\ **Replies:** 9\ **Last updated:** [November 8, 2019, 12:25pm UTC](https://discuss.elastic.co/t/issues-with-searching-data-in-array/204420 "2019-11-08T12:25:30Z")
Hi Team, Issues in searching the data in kibana. It is not working as expected. The situation is The kind of logs which are collected are firewall logs There are 2 fields Action and matches.action Action specif… --- ## [Get distinct term values but order by another value](https://discuss.elastic.co/t/get-distinct-term-values-but-order-by-another-value/206012)
**Author:** [@J\_Weeda](https://discuss.elastic.co/u/J_Weeda)\ **Replies:** 2\ **Last updated:** [November 8, 2019, 12:05pm UTC](https://discuss.elastic.co/t/get-distinct-term-values-but-order-by-another-value/206012 "2019-11-08T12:05:06Z")
Hello, I struggling with a query to get the unique values for a term called metric from my index while sorting the result on a different (numeric) field: metric\_order. Consider below example: metric: metric\_order: A … --- ## [No doc was generated while rollup job stats indicate processing](https://discuss.elastic.co/t/no-doc-was-generated-while-rollup-job-stats-indicate-processing/207076)
**Author:** [@simmonHuong](https://discuss.elastic.co/u/simmonHuong)\ **Replies:** 0\ **Last updated:** [November 8, 2019, 9:14am UTC](https://discuss.elastic.co/t/no-doc-was-generated-while-rollup-job-stats-indicate-processing/207076 "2019-11-08T09:14:31Z")
{ "config": { "id": "rollup\_myindex\_2018\_by\_7d", "index\_pattern": "myindex\_2018\*", "rollup\_index": "rolledup\_myindex\_2018", "cron": "0 \* \* \* \* ?", "groups": { "date\_histogram": { "inte… --- ## [Grouping documents in kibana based on a column without losing the rest columns](https://discuss.elastic.co/t/grouping-documents-in-kibana-based-on-a-column-without-losing-the-rest-columns/206976)
**Author:** [@kakavoul](https://discuss.elastic.co/u/kakavoul)\ **Replies:** 3\ **Last updated:** [November 8, 2019, 10:41am UTC](https://discuss.elastic.co/t/grouping-documents-in-kibana-based-on-a-column-without-losing-the-rest-columns/206976 "2019-11-08T10:41:44Z")
Hello, Let's assume that i have something like that in elastic search alarm\_id sequence date alarm\_text 1 1 2019-11-7 text of alarm1 2 1 2019-11-7 text of alarm2 2 2 … --- ## [Array of strings](https://discuss.elastic.co/t/array-of-strings/207075)
**Author:** [@irfanh94](https://discuss.elastic.co/u/irfanh94)\ **Replies:** 3\ **Last updated:** [November 8, 2019, 10:30am UTC](https://discuss.elastic.co/t/array-of-strings/207075 "2019-11-08T10:30:09Z")
Hey folks, I have this mapping for vehicles: "vehicles" : { "type": "text" } And documents inside, are like: "vehicles" : \[ "triumph daytona 750 749 1992", "triumph trident 750 2018" \] My questio… --- ## [ECE medium installation example, AWS, runner ip connectivity](https://discuss.elastic.co/t/ece-medium-installation-example-aws-runner-ip-connectivity/206040)
**Author:** [@mesiasc](https://discuss.elastic.co/u/mesiasc)\ **Replies:** 6\ **Last updated:** [November 8, 2019, 10:25am UTC](https://discuss.elastic.co/t/ece-medium-installation-example-aws-runner-ip-connectivity/206040 "2019-11-08T10:25:59Z")
I'm installing the second instance (step 3 here: https://www.elastic.co/guide/en/cloud-enterprise/current/ece-topology-example2.html) after the first instance seemed to install without problems. The second instance comp… --- ## [Cluster broken after 7.2 -\> 7.4 upgrade](https://discuss.elastic.co/t/cluster-broken-after-7-2-7-4-upgrade/206170)
**Author:** [@Grimur\_Danielsson](https://discuss.elastic.co/u/Grimur_Danielsson)\ **Replies:** 14\ **Last updated:** [November 8, 2019, 10:02am UTC](https://discuss.elastic.co/t/cluster-broken-after-7-2-7-4-upgrade/206170 "2019-11-08T10:02:00Z")
Hi I upgraded my cluster (3 master nodes) from 7.2 to 7.4 last night after which it completely fell apart. It looks like there is some communication issue between the nodes in the cluster and they keep on trying to ele… --- ## [Cluster health not reported accurately in ECE](https://discuss.elastic.co/t/cluster-health-not-reported-accurately-in-ece/206966)
**Author:** [@mesiasc](https://discuss.elastic.co/u/mesiasc)\ **Replies:** 2\ **Last updated:** [November 8, 2019, 9:52am UTC](https://discuss.elastic.co/t/cluster-health-not-reported-accurately-in-ece/206966 "2019-11-08T09:52:20Z")
I have clusters where the health is degraded by indices in read only state. Clicking through to the individual deployment UI for those clusters, the health is often not reportedly the same state. Within ECE deployments … --- ## [Multimatch with filter](https://discuss.elastic.co/t/multimatch-with-filter/206593)
**Author:** [@rogermerz](https://discuss.elastic.co/u/rogermerz)\ **Replies:** 2\ **Last updated:** [November 8, 2019, 8:25am UTC](https://discuss.elastic.co/t/multimatch-with-filter/206593 "2019-11-08T08:25:23Z")
Hey there I got product data with nested articles and the products got different types. Now I should search in the product.name and product.description and in the product.articles.gtin and should retrieve only product… --- ## [Unable to access Discover tab](https://discuss.elastic.co/t/unable-to-access-discover-tab/206459)
**Author:** [@arseni-lipinski](https://discuss.elastic.co/u/arseni-lipinski)\ **Replies:** 3\ **Last updated:** [November 8, 2019, 6:53am UTC](https://discuss.elastic.co/t/unable-to-access-discover-tab/206459 "2019-11-08T06:53:19Z")
The plugin i'm working on creates default index patterns based on tenant's id during the first start of Kibana in browser. The problem is that whilst doing it, the ' Create index pattern' menu appears and besides index p… --- ## ["master not discovered exception" after having 999 of 1000 max. shards open](https://discuss.elastic.co/t/master-not-discovered-exception-after-having-999-of-1000-max-shards-open/207066)
**Author:** [@anli](https://discuss.elastic.co/u/anli)\ **Replies:** 1\ **Last updated:** [November 8, 2019, 8:06am UTC](https://discuss.elastic.co/t/master-not-discovered-exception-after-having-999-of-1000-max-shards-open/207066 "2019-11-08T08:06:56Z")
Hello there, I'm migrating my live data from our live elasticsearch server to our archive elasticsearch server. Both are single nodes. While doing this I missed to close indices on the archive server. Using curator I go… --- ## [Default/other index pattern goes missing after some time, need to be created again,](https://discuss.elastic.co/t/default-other-index-pattern-goes-missing-after-some-time-need-to-be-created-again/206925)
**Author:** [@Parvatayya\_Malimath](https://discuss.elastic.co/u/Parvatayya_Malimath)\ **Replies:** 4\ **Last updated:** [November 8, 2019, 8:02am UTC](https://discuss.elastic.co/t/default-other-index-pattern-goes-missing-after-some-time-need-to-be-created-again/206925 "2019-11-08T08:02:34Z")
Hi The default and other index patterns goes missing after a certain period of time. I am not sure why. Version: 6.4.2. advise --- ## [What are the search optimizations possible without scoring?](https://discuss.elastic.co/t/what-are-the-search-optimizations-possible-without-scoring/207058)
**Author:** [@aqiank](https://discuss.elastic.co/u/aqiank)\ **Replies:** 2\ **Last updated:** [November 8, 2019, 7:49am UTC](https://discuss.elastic.co/t/what-are-the-search-optimizations-possible-without-scoring/207058 "2019-11-08T07:49:19Z")
Hi guys, I have 30 terabytes of Elasticsearch data spread across 11 nodes. Each index is separated by month and has 5 primary shards with 5 replica shards. Some shards are big (over 200G) and some are small (less than 1… --- ## [Merging two documents from existing ES indices into a new document](https://discuss.elastic.co/t/merging-two-documents-from-existing-es-indices-into-a-new-document/206794)
**Author:** [@domino](https://discuss.elastic.co/u/domino)\ **Replies:** 3\ **Last updated:** [November 8, 2019, 7:55am UTC](https://discuss.elastic.co/t/merging-two-documents-from-existing-es-indices-into-a-new-document/206794 "2019-11-08T07:55:44Z")
Hi all I'd like to have logstash running through all documents in the index "timeseries" and merge them with documents in another index called "contract". The resulting new merged document should be written into a desti… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1792) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1794)