# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1982 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1983 --- ## [Parsing AWS Logs - field extraction](https://discuss.elastic.co/t/parsing-aws-logs-field-extraction/193635)
**Author:** [@Randy-312](https://discuss.elastic.co/u/Randy-312)\ **Replies:** 0\ **Last updated:** [August 3, 2019, 1:23pm UTC](https://discuss.elastic.co/t/parsing-aws-logs-field-extraction/193635 "2019-08-03T13:23:23Z")
I'm a fan of how the beats/logstash modules work, and can help provide logstash an easier way to break messages up so that we have explicit fields that are not originally in the metadata (ie apache logs). I'm looking to… --- ## [I have created two instance of elasticsearch in two different machine, both instance have same cluster name but still no.of nodes is one, but i want two node](https://discuss.elastic.co/t/i-have-created-two-instance-of-elasticsearch-in-two-different-machine-both-instance-have-same-cluster-name-but-still-no-of-nodes-is-one-but-i-want-two-node/192231)
**Author:** [@Ayush\_Verma](https://discuss.elastic.co/u/Ayush_Verma)\ **Replies:** 2\ **Last updated:** [August 3, 2019, 11:23am UTC](https://discuss.elastic.co/t/i-have-created-two-instance-of-elasticsearch-in-two-different-machine-both-instance-have-same-cluster-name-but-still-no-of-nodes-is-one-but-i-want-two-node/192231 "2019-08-03T11:23:51Z")
this is the output i am getting after using curl -X GET "localhost:9200/\_nodes" {"\_nodes":{"total":1,"successful":1,"failed":0},"cluster\_name":"ElasticsearchStagging","nodes":{"eLSFczi5TFOotlGdB9kpsw":{"name":"node-1",… --- ## [Shard size vs. query performance where all shard have the same terms](https://discuss.elastic.co/t/shard-size-vs-query-performance-where-all-shard-have-the-same-terms/193577)
**Author:** [@IanRC72](https://discuss.elastic.co/u/IanRC72)\ **Replies:** 5\ **Last updated:** [August 3, 2019, 10:35am UTC](https://discuss.elastic.co/t/shard-size-vs-query-performance-where-all-shard-have-the-same-terms/193577 "2019-08-03T10:35:27Z")
As I understand it, ES's query speed is a function of the term dictionary size, not the document count. In my scenario, I have a large set of data that can be distributed across any arbitrary number of shards. The terms… --- ## [How to select column name in my table?](https://discuss.elastic.co/t/how-to-select-column-name-in-my-table/193625)
**Author:** [@Huong\_Huong](https://discuss.elastic.co/u/Huong_Huong)\ **Replies:** 2\ **Last updated:** [August 3, 2019, 7:30am UTC](https://discuss.elastic.co/t/how-to-select-column-name-in-my-table/193625 "2019-08-03T07:30:20Z")
How to select column name in my table? --- ## [How to make elastic querying faster](https://discuss.elastic.co/t/how-to-make-elastic-querying-faster/193464)
**Author:** [@divyang](https://discuss.elastic.co/u/divyang)\ **Replies:** 5\ **Last updated:** [August 3, 2019, 5:30am UTC](https://discuss.elastic.co/t/how-to-make-elastic-querying-faster/193464 "2019-08-03T05:30:54Z")
Hi , I need to query a lot of data for a given elastic index . I cannot use fielddata true on the required index fields as it will increase the size of cached memory. Currently , it is taking approx 10 min to run the… --- ## [Recommended way to force date fields to be UTC](https://discuss.elastic.co/t/recommended-way-to-force-date-fields-to-be-utc/193404)
**Author:** [@jcaballero](https://discuss.elastic.co/u/jcaballero)\ **Replies:** 8\ **Last updated:** [August 3, 2019, 12:54am UTC](https://discuss.elastic.co/t/recommended-way-to-force-date-fields-to-be-utc/193404 "2019-08-03T00:54:53Z")
Hello, using LogStash and ElasticSearch 5.6.10. My documents have a few fields of type "date", besides @timestamp. The template includes, for each one of them, a section like this "my\_datefield\_1": { "type": "date",… --- ## [Canvas markdown is not showing data](https://discuss.elastic.co/t/canvas-markdown-is-not-showing-data/193442)
**Author:** [@syedsfayaz](https://discuss.elastic.co/u/syedsfayaz)\ **Replies:** 5\ **Last updated:** [August 2, 2019, 11:52pm UTC](https://discuss.elastic.co/t/canvas-markdown-is-not-showing-data/193442 "2019-08-02T23:52:06Z")
Hi In canvas markdown. I am using elastic sql to pull data from metric beat and sorting it to latest document as I wanted to see the latest result of the jenkins job. SELECT http.json\_test.building,http.json\_test.url,h… --- ## [Unable to change the datatype of an existing field](https://discuss.elastic.co/t/unable-to-change-the-datatype-of-an-existing-field/193598)
**Author:** [@Karthik2411](https://discuss.elastic.co/u/Karthik2411)\ **Replies:** 2\ **Last updated:** [August 2, 2019, 11:08pm UTC](https://discuss.elastic.co/t/unable-to-change-the-datatype-of-an-existing-field/193598 "2019-08-02T23:08:05Z")
Please take a look at this one . --- ## [Visual builder interval vs date filter](https://discuss.elastic.co/t/visual-builder-interval-vs-date-filter/193330)
**Author:** [@Ayden](https://discuss.elastic.co/u/Ayden)\ **Replies:** 1\ **Last updated:** [August 2, 2019, 10:33pm UTC](https://discuss.elastic.co/t/visual-builder-interval-vs-date-filter/193330 "2019-08-02T22:33:13Z")
Hello, I'm using visual builder to build a table since I need to use the filter ratio. My problem is when adding the visual builder table to a dashboard, since the interval (auto) of the visual builder is different of … --- ## [Search response accuracy](https://discuss.elastic.co/t/search-response-accuracy/192309)
**Author:** [@David\_Castillo](https://discuss.elastic.co/u/David_Castillo)\ **Replies:** 1\ **Last updated:** [August 2, 2019, 10:02pm UTC](https://discuss.elastic.co/t/search-response-accuracy/192309 "2019-08-02T22:02:14Z")
Warning this is probably not a good use case for Elasticsearch but... I have an index which will containing millions of documents. We have built a real-time API which allows customers search and return less than 1000 … --- ## [Getting full string in Kibana Datatable](https://discuss.elastic.co/t/getting-full-string-in-kibana-datatable/193368)
**Author:** [@Abdul\_Jaleel](https://discuss.elastic.co/u/Abdul_Jaleel)\ **Replies:** 1\ **Last updated:** [August 2, 2019, 10:01pm UTC](https://discuss.elastic.co/t/getting-full-string-in-kibana-datatable/193368 "2019-08-02T22:01:34Z")
One of the field I have with value is listed below "Category": \[ "Book", "Novel", "English" \] Creating datatable visualization with term shows only Category.keyword. since Category is non Aggregatable . Creating d… --- ## [DateRange Aggregation w/ a Script that produces the Dates instead of a static date field](https://discuss.elastic.co/t/daterange-aggregation-w-a-script-that-produces-the-dates-instead-of-a-static-date-field/193145)
**Author:** [@Thomas\_Doman](https://discuss.elastic.co/u/Thomas_Doman)\ **Replies:** 2\ **Last updated:** [August 2, 2019, 9:52pm UTC](https://discuss.elastic.co/t/daterange-aggregation-w-a-script-that-produces-the-dates-instead-of-a-static-date-field/193145 "2019-08-02T21:52:58Z")
ES: 6.1.1 NEST: 6.1.0 Is it possible to create a DateRange Aggregation where, instead of specifying a field, I can specify a script which will produce a Date from a number of source fields? In my case, there's a "good… --- ## [Is it possible to Snapshot ElasticSearch cluster on the Local Pc Machine](https://discuss.elastic.co/t/is-it-possible-to-snapshot-elasticsearch-cluster-on-the-local-pc-machine/192232)
**Author:** [@Thilak](https://discuss.elastic.co/u/Thilak)\ **Replies:** 1\ **Last updated:** [August 2, 2019, 9:27pm UTC](https://discuss.elastic.co/t/is-it-possible-to-snapshot-elasticsearch-cluster-on-the-local-pc-machine/192232 "2019-08-02T21:27:09Z")
Hi i have been working on migrating elastic search cluster from one service to another.Experimenting snapshot elastic-search cluster for migration. Is it possible to snapshot elastic-search cluster on local pc machine. i… --- ## [Append IP Addresses to "related.ip" ECS Field](https://discuss.elastic.co/t/append-ip-addresses-to-related-ip-ecs-field/192785)
**Author:** [@MakoWish](https://discuss.elastic.co/u/MakoWish)\ **Replies:** 2\ **Last updated:** [August 2, 2019, 8:51pm UTC](https://discuss.elastic.co/t/append-ip-addresses-to-related-ip-ecs-field/192785 "2019-08-02T20:51:13Z")
I would like to take advantage of the "related.ip" field for pivoting around different sources. I have everything running through Logstash, and I am attempting to append all IP fields to related.ip. Unfortunately, I am o… --- ## [How execute AND query in elasticsearch and aggregate](https://discuss.elastic.co/t/how-execute-and-query-in-elasticsearch-and-aggregate/192208)
**Author:** [@elasticpatrick](https://discuss.elastic.co/u/elasticpatrick)\ **Replies:** 1\ **Last updated:** [August 2, 2019, 8:33pm UTC](https://discuss.elastic.co/t/how-execute-and-query-in-elasticsearch-and-aggregate/192208 "2019-08-02T20:33:43Z")
Hello, I have product\_supplier Index which contains products and its suppliers. I have given suppliers names and I want to get the products which are supplied by the given suppliers. For eg. I have given supplier "suppl… --- ## [Filtering/aggregating by a timezone field in each document instead of the same timezone for all documents](https://discuss.elastic.co/t/filtering-aggregating-by-a-timezone-field-in-each-document-instead-of-the-same-timezone-for-all-documents/193003)
**Author:** [@oeed](https://discuss.elastic.co/u/oeed)\ **Replies:** 1\ **Last updated:** [August 2, 2019, 8:21pm UTC](https://discuss.elastic.co/t/filtering-aggregating-by-a-timezone-field-in-each-document-instead-of-the-same-timezone-for-all-documents/193003 "2019-08-02T20:21:36Z")
I'm fairly new to Elasticsearch so I'm not 100% sure it's appropriate for our use case, so let me know if it isn't. We are performing some basic analytics for exposure time from specific locations. I want to be able to … --- ## [Searching for response code, get results without the response code field](https://discuss.elastic.co/t/searching-for-response-code-get-results-without-the-response-code-field/193558)
**Author:** [@flex567](https://discuss.elastic.co/u/flex567)\ **Replies:** 1\ **Last updated:** [August 2, 2019, 7:54pm UTC](https://discuss.elastic.co/t/searching-for-response-code-get-results-without-the-response-code-field/193558 "2019-08-02T19:54:34Z")
I ma using the Discover tab and I am using the Search field with the following query: "NOT response-http-code:(202)". The problem is I am getting result with 403 which is correct, but I also see entries without the res… --- ## [Filter on fields.keyword doesn't return all values](https://discuss.elastic.co/t/filter-on-fields-keyword-doesnt-return-all-values/193566)
**Author:** [@Enzo\_RC](https://discuss.elastic.co/u/Enzo_RC)\ **Replies:** 1\ **Last updated:** [August 2, 2019, 7:14pm UTC](https://discuss.elastic.co/t/filter-on-fields-keyword-doesnt-return-all-values/193566 "2019-08-02T19:14:32Z")
Hello, When i do a simple query filter i have no results returned. But i do have the requested field value. Here is what i get in kibana when i want to filter on domaineA.keyword: (as we can see only few values are… --- ## [How can i retreive data from my elasticsearch index and plot it in kibana line chart](https://discuss.elastic.co/t/how-can-i-retreive-data-from-my-elasticsearch-index-and-plot-it-in-kibana-line-chart/193590)
**Author:** [@Saif\_Faidi](https://discuss.elastic.co/u/Saif_Faidi)\ **Replies:** 1\ **Last updated:** [August 2, 2019, 6:59pm UTC](https://discuss.elastic.co/t/how-can-i-retreive-data-from-my-elasticsearch-index-and-plot-it-in-kibana-line-chart/193590 "2019-08-02T18:59:23Z")
Hello , is there any way to plot Y-axis1 = "proj1" , Y-axis2 = "proj2" and X-axis ="sh1" where my elastic data is the following : } --- ## [Remove duplicate documents that have the same field value](https://discuss.elastic.co/t/remove-duplicate-documents-that-have-the-same-field-value/193604)
**Author:** [@gabrielconte14](https://discuss.elastic.co/u/gabrielconte14)\ **Replies:** 3\ **Last updated:** [August 2, 2019, 6:47pm UTC](https://discuss.elastic.co/t/remove-duplicate-documents-that-have-the-same-field-value/193604 "2019-08-02T18:47:20Z")
I'm trying to retrieve data from MongoDB and remove documents that have the same values on a specific field. For example: If the value of the field "device\_uuid" of multiple documents are equal, I would like to filter t… --- ## [Cross-cluster search not returning all hits from IDs query, sometimes](https://discuss.elastic.co/t/cross-cluster-search-not-returning-all-hits-from-ids-query-sometimes/192323)
**Author:** [@loren](https://discuss.elastic.co/u/loren)\ **Replies:** 2\ **Last updated:** [August 2, 2019, 6:02pm UTC](https://discuss.elastic.co/t/cross-cluster-search-not-returning-all-hits-from-ids-query-sometimes/192323 "2019-08-02T18:02:13Z")
Why do my cross-cluster IDs queries sometimes return all but 1 or 2 of the results? I have a 7.2.0 cluster executing an IDs query across 3 remote clusters usually with 500-1000 IDs in each query. I set the size paramete… --- ## [Collect jmx tabular data and visualize it into kibana](https://discuss.elastic.co/t/collect-jmx-tabular-data-and-visualize-it-into-kibana/193488)
**Author:** [@HenryDuong](https://discuss.elastic.co/u/HenryDuong)\ **Replies:** 0\ **Last updated:** [August 2, 2019, 8:54am UTC](https://discuss.elastic.co/t/collect-jmx-tabular-data-and-visualize-it-into-kibana/193488 "2019-08-02T08:54:48Z")
Hi guys, I'm new with ELK. Currently, I'm working with logstash-input-jmx plugin to collect MBean data and visualize it into Kibana. So technically, I stuck at 2 points: JMX data, I can collect the attribute with numb… --- ## [Update document while uploading mapping with logstash](https://discuss.elastic.co/t/update-document-while-uploading-mapping-with-logstash/193596)
**Author:** [@leeyu](https://discuss.elastic.co/u/leeyu)\ **Replies:** 0\ **Last updated:** [August 2, 2019, 4:43pm UTC](https://discuss.elastic.co/t/update-document-while-uploading-mapping-with-logstash/193596 "2019-08-02T16:43:33Z")
Hi all, I have some map for mapping and data on elasticsearch. My filter plugin is the following elasticsearch{ hosts =\> \["localhost:9200"\] index =\> "mapping\_av" query =\> "signature:%{\[id\]}" result\_siz… --- ## [Mutate filter - Convert a hash data-type to something else](https://discuss.elastic.co/t/mutate-filter-convert-a-hash-data-type-to-something-else/193580)
**Author:** [@luiz.miguelsl](https://discuss.elastic.co/u/luiz.miguelsl)\ **Replies:** 4\ **Last updated:** [August 2, 2019, 4:30pm UTC](https://discuss.elastic.co/t/mutate-filter-convert-a-hash-data-type-to-something-else/193580 "2019-08-02T16:30:44Z")
Hey there guys, How are you doing? I came across this problem and thought you'd be able to help me figure it out. I created a CSV filter to parse my httpd access log file and it's working fine. We have a field "HttpSta… --- ## [Elastic as service](https://discuss.elastic.co/t/elastic-as-service/193395)
**Author:** [@aniaks](https://discuss.elastic.co/u/aniaks)\ **Replies:** 4\ **Last updated:** [August 2, 2019, 4:11pm UTC](https://discuss.elastic.co/t/elastic-as-service/193395 "2019-08-02T16:11:37Z")
I have downloaded the ES tar file to install. How do i configure as init service to start and stop ES as a service. --- ## [UserAgent Transformation in Logstash](https://discuss.elastic.co/t/useragent-transformation-in-logstash/193548)
**Author:** [@chimbu3306](https://discuss.elastic.co/u/chimbu3306)\ **Replies:** 3\ **Last updated:** [August 2, 2019, 3:54pm UTC](https://discuss.elastic.co/t/useragent-transformation-in-logstash/193548 "2019-08-02T15:54:50Z")
I have the below useragent captured as a string in our application logs, we are publishing this logs to elastic search from logstash and currently storing it as string, We would like to convert this string to json object… --- ## [Evidence/Benchmarking behind Shards/Datanode Recommendation](https://discuss.elastic.co/t/evidence-benchmarking-behind-shards-datanode-recommendation/193585)
**Author:** [@YKNFS](https://discuss.elastic.co/u/YKNFS)\ **Replies:** 1\ **Last updated:** [August 2, 2019, 3:53pm UTC](https://discuss.elastic.co/t/evidence-benchmarking-behind-shards-datanode-recommendation/193585 "2019-08-02T15:53:59Z")
I'm curious about the recommendation put forth in How many shards should I have in my Elasticsearch cluster? | Elastic Blog, specifically that A good rule-of-thumb is to ensure you keep the number of shards per node be… --- ## [Error while creating cluster](https://discuss.elastic.co/t/error-while-creating-cluster/193504)
**Author:** [@pathri](https://discuss.elastic.co/u/pathri)\ **Replies:** 1\ **Last updated:** [August 2, 2019, 3:40pm UTC](https://discuss.elastic.co/t/error-while-creating-cluster/193504 "2019-08-02T15:40:26Z")
i need to create a cluster of 3 node on AWS but getting below error. "type" : "master\_not\_discovered\_exception". i am using elasticsearch as a service Please help in resolving the same. i am creating all 3 as master &… --- ## [Write a Python file that is able to read a Logstash query and that execute controls on that](https://discuss.elastic.co/t/write-a-python-file-that-is-able-to-read-a-logstash-query-and-that-execute-controls-on-that/193583)
**Author:** [@Nora](https://discuss.elastic.co/u/Nora)\ **Replies:** 0\ **Last updated:** [August 2, 2019, 3:31pm UTC](https://discuss.elastic.co/t/write-a-python-file-that-is-able-to-read-a-logstash-query-and-that-execute-controls-on-that/193583 "2019-08-02T15:31:59Z")
Hi I want to write a python program that execute controls. Those controls must be execute on the results of a query. The questions are the following: if I've created a python file that includes both the query and th… --- ## [Multi value coordinate map](https://discuss.elastic.co/t/multi-value-coordinate-map/193158)
**Author:** [@Axel\_MORVAN](https://discuss.elastic.co/u/Axel_MORVAN)\ **Replies:** 1\ **Last updated:** [August 2, 2019, 3:24pm UTC](https://discuss.elastic.co/t/multi-value-coordinate-map/193158 "2019-08-02T15:24:14Z")
Hi, I have create a coordinate map and now i need to display 3 values bind to one point, and hide coordinates when you hover over the map points. someone can help me ? [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1981) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1983)