# Top **URL:** https://discuss.elastic.co/top.md?page=957&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 958 --- ## [Painless script not working as expected](https://discuss.elastic.co/t/painless-script-not-working-as-expected/185978)
**Author:** [@Nitish\_Jain](https://discuss.elastic.co/u/Nitish_Jain)\ **Replies:** 2\ **Last updated:** [June 20, 2019, 11:25pm UTC](https://discuss.elastic.co/t/painless-script-not-working-as-expected/185978 "2019-06-20T23:25:17Z")
Hi, I am trinyg to run this script and it's not working as expected. String messageValue = doc\['message.keyword'\]; if ( messageValue != null) { String val = messageValue .substring(0,30); return val + "678"; } else… --- ## [@timestamp error](https://discuss.elastic.co/t/timestamp-error/37369)
**Author:** [@Alleycat](https://discuss.elastic.co/u/Alleycat)\ **Replies:** 2\ **Last updated:** [December 22, 2015, 3:37pm UTC](https://discuss.elastic.co/t/timestamp-error/37369 "2015-12-22T15:37:34Z")
I have filebeat sending Apache logs to logstash which is located on another server. Logstash shows the following error: {:timestamp=\>"2015-12-16T15:32:05.053000+0000", :message=\>"Beats input: unhandled exception", :e… --- ## [How to Filter Desired Container Logs in Docker Integration in Fleet？](https://discuss.elastic.co/t/how-to-filter-desired-container-logs-in-docker-integration-in-fleet/329030)
**Author:** [@XYYYYY](https://discuss.elastic.co/u/XYYYYY)\ **Replies:** 5\ **Last updated:** [April 3, 2023, 9:20am UTC](https://discuss.elastic.co/t/how-to-filter-desired-container-logs-in-docker-integration-in-fleet/329030 "2023-04-03T09:20:10Z")
Hello everyone, I am a newcomer using elastic agent. I have tried to collect container logs using Docker integration, but I have a wide variety of container logs. I only want to obtain a few of them. How can I achieve th… --- ## [Comment déclarer une date découpée sur deux champs dans un fichier](https://discuss.elastic.co/t/comment-declarer-une-date-decoupee-sur-deux-champs-dans-un-fichier/148989)
**Author:** [@Mheni](https://discuss.elastic.co/u/Mheni)\ **Replies:** 1\ **Last updated:** [September 18, 2018, 1:23pm UTC](https://discuss.elastic.co/t/comment-declarer-une-date-decoupee-sur-deux-champs-dans-un-fichier/148989 "2018-09-18T13:23:54Z")
Bonjour J'ai un fichier csv, dans lequel la date est découper sur deux champs "date"|"time" exemple id= 5, Date = 18/09/2018 heure = 10:30:55 dans le fichier est écrit de cette manière 5|20180918|103055 comment je p… --- ## [Поиск по словосочетанию с разным порядком слов](https://discuss.elastic.co/t/topic/134022)
**Author:** [@zru](https://discuss.elastic.co/u/zru)\ **Replies:** 4\ **Last updated:** [June 1, 2018, 3:02pm UTC](https://discuss.elastic.co/t/topic/134022 "2018-06-01T15:02:43Z")
Можно ли средствами Elasticsearch 1.7 составить запрос, в котором будет поиск по словосочетанию по нескольким полям, чтобы пользователь ввел словосочетание ""красный цвет"", а нашлось и ""красный цвет"" и ""цвет красный"… --- ## [How to drop events only from specific module](https://discuss.elastic.co/t/how-to-drop-events-only-from-specific-module/254175)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 8\ **Last updated:** [November 4, 2020, 4:04pm UTC](https://discuss.elastic.co/t/how-to-drop-events-only-from-specific-module/254175 "2020-11-04T16:04:41Z")
Hello, I want to drop all events that filebeat was unable to parse. I tried a few things my last attempt looks like this. processors: - drop\_event: when: and: - equals.event.module: cisco… --- ## [Rollup vs Continuous Transform for historical data](https://discuss.elastic.co/t/rollup-vs-continuous-transform-for-historical-data/240178)
**Author:** [@Vlad\_K](https://discuss.elastic.co/u/Vlad_K)\ **Replies:** 1\ **Last updated:** [July 7, 2020, 3:09pm UTC](https://discuss.elastic.co/t/rollup-vs-continuous-transform-for-historical-data/240178 "2020-07-07T15:09:48Z")
Are there any reasons to pick one over another to store historical data? As far as i can see rollups have limited ability for searching and aggregations (no filtered aggregations, etc.) while transformed index doesn't h… --- ## [Logstash HTTP plugin dynamic URL](https://discuss.elastic.co/t/logstash-http-plugin-dynamic-url/184451)
**Author:** [@hive](https://discuss.elastic.co/u/hive)\ **Replies:** 1\ **Last updated:** [June 5, 2019, 9:15pm UTC](https://discuss.elastic.co/t/logstash-http-plugin-dynamic-url/184451 "2019-06-05T21:15:19Z")
Dynamic URL with below does not work. When I replace the "oid" with a constant it works fine. Can I have values changed in URL? Thanks output{ http { format=\>"json" http\_method=\>"post" url=\>"http://localhost:9200/… --- ## [Please review my multi-client ELK infrastructure design](https://discuss.elastic.co/t/please-review-my-multi-client-elk-infrastructure-design/123462)
**Author:** [@Barney\_Skeggs](https://discuss.elastic.co/u/Barney_Skeggs)\ **Replies:** 1\ **Last updated:** [March 12, 2018, 11:17am UTC](https://discuss.elastic.co/t/please-review-my-multi-client-elk-infrastructure-design/123462 "2018-03-12T11:17:35Z")
Hi! I'm new to Elastic, and evaluating how I would use it for a business I am considering creating. The business is a Managed Security Service Provider (MSSP). I would like to collect logs from my client's endpoints an… --- ## [Searching fields for specific values](https://discuss.elastic.co/t/searching-fields-for-specific-values/64004)
**Author:** [@susrich0810](https://discuss.elastic.co/u/susrich0810)\ **Replies:** 1\ **Last updated:** [October 31, 2016, 3:29pm UTC](https://discuss.elastic.co/t/searching-fields-for-specific-values/64004 "2016-10-31T15:29:00Z")
I'm trying to search the fields of our indices for a specific value. The field I'm checking is 'topic', and I want to find indices that have a value that matches a search string. So, for example, how can I construct a cu… --- ## ['exec' only once](https://discuss.elastic.co/t/exec-only-once/28945)
**Author:** [@Jonathan\_Johnson](https://discuss.elastic.co/u/Jonathan_Johnson)\ **Replies:** 1\ **Last updated:** [September 9, 2015, 5:31pm UTC](https://discuss.elastic.co/t/exec-only-once/28945 "2015-09-09T17:31:29Z")
Hi -- I'm sure this is simple but I can't figure it out. my configuration: Input: ES query Filter: cipher Output: File, exec cmd So I query Elasticsearch and want to write those events to a single local file. That p… --- ## [Watcher notifications on Slack in Docker env](https://discuss.elastic.co/t/watcher-notifications-on-slack-in-docker-env/232840)
**Author:** [@maadhav](https://discuss.elastic.co/u/maadhav)\ **Replies:** 0\ **Last updated:** [May 15, 2020, 2:18pm UTC](https://discuss.elastic.co/t/watcher-notifications-on-slack-in-docker-env/232840 "2020-05-15T14:18:50Z")
Hi Team I am using Docker concept for ELK setup using v7.6.2. I want to configure slack notifications for watcher. Following is my docker-compose.yml file: version: '3.1' services: es01: image: docker.elastic.co/… --- ## [Logstash avro codec - adding support for stripping magic byte and schema id](https://discuss.elastic.co/t/logstash-avro-codec-adding-support-for-stripping-magic-byte-and-schema-id/64353)
**Author:** [@bruce.szalwinski](https://discuss.elastic.co/u/bruce.szalwinski)\ **Replies:** 0\ **Last updated:** [October 29, 2016, 7:44pm UTC](https://discuss.elastic.co/t/logstash-avro-codec-adding-support-for-stripping-magic-byte-and-schema-id/64353 "2016-10-29T19:44:43Z")
Over at https://github.com/logstash-plugins/logstash-codec-avro/pull/20 I submitted a pull request against the avro codec to strip off the magic byte and schema id. I was hoping to get some eyeballs on the PR and move i… --- ## [How to use a custom scoring script that has a lot of dependencies?](https://discuss.elastic.co/t/how-to-use-a-custom-scoring-script-that-has-a-lot-of-dependencies/40515)
**Author:** [@apanimesh061](https://discuss.elastic.co/u/apanimesh061)\ **Replies:** 0\ **Last updated:** [January 29, 2016, 7:12pm UTC](https://discuss.elastic.co/t/how-to-use-a-custom-scoring-script-that-has-a-lot-of-dependencies/40515 "2016-01-29T19:12:41Z")
I have a java file that creates a custom scoring in: "similarity.default.type": "com.engine.scoring.elasticsearch.TweakedSimilarity" and there are other files also that define filters and analyzers which are similar k… --- ## [Install Elastic APM Agent on Windows Server](https://discuss.elastic.co/t/install-elastic-apm-agent-on-windows-server/309914)
**Author:** [@aji.shinde7](https://discuss.elastic.co/u/aji.shinde7)\ **Replies:** 6\ **Last updated:** [July 28, 2022, 1:35pm UTC](https://discuss.elastic.co/t/install-elastic-apm-agent-on-windows-server/309914 "2022-07-28T13:35:59Z")
Hello Experts, I am a beginner in Elasticsearch. I am looking for Installing Elastic APM Agent on windows servers. Followed Documentation but confused. Can anyone share any article / video where process is bit clear. … --- ## [Error Parsing JSON data in Logstash](https://discuss.elastic.co/t/error-parsing-json-data-in-logstash/267249)
**Author:** [@atharvak](https://discuss.elastic.co/u/atharvak)\ **Replies:** 3\ **Last updated:** [March 15, 2021, 3:16pm UTC](https://discuss.elastic.co/t/error-parsing-json-data-in-logstash/267249 "2021-03-15T15:16:18Z")
Hello guys, I am trying to debug this issue showing up related to Json Parsing. When my filebeat sends data to logstash, following error is showing up. My Logstash Filter filter { if "cost\_management" in \[tags\] { f… --- ## [Comparing two counts - gauge or percentage](https://discuss.elastic.co/t/comparing-two-counts-gauge-or-percentage/197999)
**Author:** [@goochjs](https://discuss.elastic.co/u/goochjs)\ **Replies:** 3\ **Last updated:** [September 6, 2019, 11:56am UTC](https://discuss.elastic.co/t/comparing-two-counts-gauge-or-percentage/197999 "2019-09-06T11:56:03Z")
Hi, We've got two metrics which we would like to compare. One is a count of total work items due for a day. This builds up as hundreds of thousands of events are received during the morning. Let's call the count of t… --- ## [Logstash server not starting on system reboot](https://discuss.elastic.co/t/logstash-server-not-starting-on-system-reboot/122008)
**Author:** [@dennis.1157](https://discuss.elastic.co/u/dennis.1157)\ **Replies:** 3\ **Last updated:** [March 2, 2018, 6:57am UTC](https://discuss.elastic.co/t/logstash-server-not-starting-on-system-reboot/122008 "2018-03-02T06:57:16Z")
I have the ELK stack installed on Ubuntu 14.04. Everything works when I run Logstash from the command line but as a service, the server does not seem to be able to start by itself. Here's the log from /var/log/logstash/… --- ## [Configuring thread size in jvm.dll when installing Elasticsearch as a service](https://discuss.elastic.co/t/configuring-thread-size-in-jvm-dll-when-installing-elasticsearch-as-a-service/71532)
**Author:** [@Annie178](https://discuss.elastic.co/u/Annie178)\ **Replies:** 3\ **Last updated:** [January 23, 2017, 5:23pm UTC](https://discuss.elastic.co/t/configuring-thread-size-in-jvm-dll-when-installing-elasticsearch-as-a-service/71532 "2017-01-23T17:23:44Z")
Hi all, When I am installing elasticsearch (5.0.1) version as a service in Windows I receive the following error: thread stack size not set; configure using -Xss via C:\\Temp\\Elasticsearch\\elasticsearch-5.0.1\\confi… --- ## [How to add not analyzed field with dynamic tempate?](https://discuss.elastic.co/t/how-to-add-not-analyzed-field-with-dynamic-tempate/31391)
**Author:** [@colormegood](https://discuss.elastic.co/u/colormegood)\ **Replies:** 3\ **Last updated:** [October 1, 2015, 1:22am UTC](https://discuss.elastic.co/t/how-to-add-not-analyzed-field-with-dynamic-tempate/31391 "2015-10-01T01:22:22Z")
Hi. Elasticsearch ; 1.7.1 logstash : 1.5.3 kibana : 4 My logstash put my log file on elasticsearch. And I discover logstash raw data in kibana 4. But I hava a problem. kibana 4 seperate field's value by "-".. A val… --- ## [Getting JAVA ERROR when I run elasticsearch on UBUNTU](https://discuss.elastic.co/t/getting-java-error-when-i-run-elasticsearch-on-ubuntu/162466)
**Author:** [@venu.pgi](https://discuss.elastic.co/u/venu.pgi)\ **Replies:** 2\ **Last updated:** [December 31, 2018, 5:56am UTC](https://discuss.elastic.co/t/getting-java-error-when-i-run-elasticsearch-on-ubuntu/162466 "2018-12-31T05:56:28Z")
Hi All, I have installed the elasticsearch on my Ubuntu laptop . I have Java version 11 as well. However when I run the command ./elasticsearch , it is giving me the following errors. I am new to the elasticsearch, kindl… --- ## [Watchers Issue(S)](https://discuss.elastic.co/t/watchers-issue-s/123232)
**Author:** [@kamandohl](https://discuss.elastic.co/u/kamandohl)\ **Replies:** 2\ **Last updated:** [March 12, 2018, 8:28am UTC](https://discuss.elastic.co/t/watchers-issue-s/123232 "2018-03-12T08:28:11Z")
While attempting to setup Watchers received a 500 error in Kibana. Log entry from Kibana: Mar 09 08:36:58 kibana\[8532\]: {"type":"response","@timestamp":"2018-03-09T08:36:58Z","tags": ,"pid":8532,"method":"get","status… --- ## [How should I search data in hdfs](https://discuss.elastic.co/t/how-should-i-search-data-in-hdfs/45444)
**Author:** [@Benny](https://discuss.elastic.co/u/Benny)\ **Replies:** 2\ **Last updated:** [April 5, 2016, 3:04pm UTC](https://discuss.elastic.co/t/how-should-i-search-data-in-hdfs/45444 "2016-04-05T15:04:57Z")
We have stored a lot of log files in hdfs. How can I search some data in the files with es-hadoop? I am very confused what should I do. Method One: 1) Have to create an elasticsearch environment 2) Write and run the … --- ## [JavaScript 'undefined' Error](https://discuss.elastic.co/t/javascript-undefined-error/42153)
**Author:** [@Chris\_Decker](https://discuss.elastic.co/u/Chris_Decker)\ **Replies:** 2\ **Last updated:** [February 19, 2016, 2:16pm UTC](https://discuss.elastic.co/t/javascript-undefined-error/42153 "2016-02-19T14:16:58Z")
In commons.bundle.js:39568 I will occasionally receive the following error when trying to add a filter from a saved search within a Dashboard: Error: undefined is not an object (evaluating 'fieldName') https://hostname… --- ## [MergeMappingException when putting empty mapping](https://discuss.elastic.co/t/mergemappingexception-when-putting-empty-mapping/7723)
**Author:** [@q42jaap](https://discuss.elastic.co/u/q42jaap)\ **Replies:** 2\ **Last updated:** [May 17, 2012, 10:14pm UTC](https://discuss.elastic.co/t/mergemappingexception-when-putting-empty-mapping/7723 "2012-05-17T22:14:13Z")
I PUT the following json: {"mytype":{}} to: indexname/mytype/\_mapping I'm getting the following error: { "error": "MergeMappingException\[Merge failed with failures {\[mapper \[myProp\] of different type, current\_… --- ## [What is the recommended Java heap size for Elasticsearch?](https://discuss.elastic.co/t/what-is-the-recommended-java-heap-size-for-elasticsearch/73)
**Author:** [@shaunak](https://discuss.elastic.co/u/shaunak)\ **Replies:** 0\ **Last updated:** [April 30, 2015, 11:23pm UTC](https://discuss.elastic.co/t/what-is-the-recommended-java-heap-size-for-elasticsearch/73 "2015-04-30T23:23:44Z")
It depends on what you will be doing. If you use faceting, aggregations, or parent/child queries you will need more heap space. It might make sense to run some performance tests and monitor the heap to figure out what a … --- ## [Upload Windows Event Logs](https://discuss.elastic.co/t/upload-windows-event-logs/295930)
**Author:** [@smam](https://discuss.elastic.co/u/smam)\ **Replies:** 4\ **Last updated:** [February 3, 2022, 12:26pm UTC](https://discuss.elastic.co/t/upload-windows-event-logs/295930 "2022-02-03T12:26:31Z")
Hello, Where do I find files that i sent via winlogbeat when using the Elasticsearch output? Can I add indexes? And how could I send just a selection of files, that is e.g. stored in some directory? I tried: - name: … --- ## [ES Cannot Index Monitoring Indices](https://discuss.elastic.co/t/es-cannot-index-monitoring-indices/262695)
**Author:** [@lnorman](https://discuss.elastic.co/u/lnorman)\ **Replies:** 4\ **Last updated:** [February 1, 2021, 8:57pm UTC](https://discuss.elastic.co/t/es-cannot-index-monitoring-indices/262695 "2021-02-01T20:57:48Z")
I am trying to turn on stack monitoring, however, metricbeat keeps logging something that starts like this: WARN \[elasticsearch\] elasticsearch/client.go:408 Cannot index event publisher.Event and in… --- ## [Trying to understand why filebeat dropped events during logstash failure](https://discuss.elastic.co/t/trying-to-understand-why-filebeat-dropped-events-during-logstash-failure/147937)
**Author:** [@Dheeraj\_Gupta](https://discuss.elastic.co/u/Dheeraj_Gupta)\ **Replies:** 4\ **Last updated:** [September 12, 2018, 4:40am UTC](https://discuss.elastic.co/t/trying-to-understand-why-filebeat-dropped-events-during-logstash-failure/147937 "2018-09-12T04:40:44Z")
Hi, I run filebeat to send Bro logs from a machine(sensor) to my logstash server. During the weekend, a power cycle caused all our infrastructure to reboot. While the sensor started up correctly, logstash server had som… --- ## [Logging options in logstash.yml are not working](https://discuss.elastic.co/t/logging-options-in-logstash-yml-are-not-working/142773)
**Author:** [@twan](https://discuss.elastic.co/u/twan)\ **Replies:** 4\ **Last updated:** [August 2, 2018, 2:57pm UTC](https://discuss.elastic.co/t/logging-options-in-logstash-yml-are-not-working/142773 "2018-08-02T14:57:24Z")
Hi there! We want Logstash to send its logging to a specified location. If we set (the data folder is mounted external from the docker): log.level: warn path.logs: /usr/share/logstash/data/log It does not create a f… --- ## [Run multiple logstash instances vs. one instance?](https://discuss.elastic.co/t/run-multiple-logstash-instances-vs-one-instance/43141)
**Author:** [@anhlqn](https://discuss.elastic.co/u/anhlqn)\ **Replies:** 4\ **Last updated:** [March 1, 2016, 11:55pm UTC](https://discuss.elastic.co/t/run-multiple-logstash-instances-vs-one-instance/43141 "2016-03-01T23:55:25Z")
Hi All, I have the following Logstash config input { # Receive logs tcp { port =\> 5544 type =\> "iis" } tcp { port =\> 5545 type =\> "perfmon" } } filter {} output { if \[type\] == "iis" { … --- ## [Can't build with beats-packer on Ubuntu 16.04: .../xgo: cannot download](https://discuss.elastic.co/t/cant-build-with-beats-packer-on-ubuntu-16-04-xgo-cannot-download/50460)
**Author:** [@dviljoen](https://discuss.elastic.co/u/dviljoen)\ **Replies:** 5\ **Last updated:** [May 23, 2016, 3:53pm UTC](https://discuss.elastic.co/t/cant-build-with-beats-packer-on-ubuntu-16-04-xgo-cannot-download/50460 "2016-05-23T15:53:04Z")
Trying to build filebeat for arm. Using beats-packer w/docker. Make images and make pull-images both succeed. Make deps fails: go get github.com/tsg/xgo package github.com/tsg/xgo: cannot download, $GOPATH not set. … --- ## [Need advice for my term completion feature](https://discuss.elastic.co/t/need-advice-for-my-term-completion-feature/43683)
**Author:** [@basiclaser](https://discuss.elastic.co/u/basiclaser)\ **Replies:** 5\ **Last updated:** [March 8, 2016, 5:50pm UTC](https://discuss.elastic.co/t/need-advice-for-my-term-completion-feature/43683 "2016-03-08T17:50:37Z")
I have a website with a searchbar where users can search for documents. Currently I am using a term suggester ( https://www.elastic.co/guide/en/elasticsearch/reference/current/search-suggesters-term.html ) to provide w… --- ## [Bulk API Indexing Status 500 Error NullPointerException\[null\]](https://discuss.elastic.co/t/bulk-api-indexing-status-500-error-nullpointerexception-null/21331)
**Author:** [@drjz](https://discuss.elastic.co/u/drjz)\ **Replies:** 2\ **Last updated:** [December 19, 2014, 2:26pm UTC](https://discuss.elastic.co/t/bulk-api-indexing-status-500-error-nullpointerexception-null/21331 "2014-12-19T14:26:25Z")
Dear all, I am encountering a weird issue. When I use the Bulk API (REST) to index documents, I am getting for the same documents each time the following error returned: "status":500,"error":"NullPointerExcepti… --- ## [Rolling up Data Streams](https://discuss.elastic.co/t/rolling-up-data-streams/288328)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 7\ **Last updated:** [December 11, 2021, 6:21am UTC](https://discuss.elastic.co/t/rolling-up-data-streams/288328 "2021-12-11T06:21:24Z")
Hi there, I'm curious if making rollups from data streams is recommended/possible? It would be great after rolling over data from my data stream if I could also roll it up into bigger time chunks. Thanks! --- ## [Metrics dashboards not working as it should](https://discuss.elastic.co/t/metrics-dashboards-not-working-as-it-should/271555)
**Author:** [@Francisco\_Gomez1](https://discuss.elastic.co/u/Francisco_Gomez1)\ **Replies:** 7\ **Last updated:** [April 30, 2021, 4:21am UTC](https://discuss.elastic.co/t/metrics-dashboards-not-working-as-it-should/271555 "2021-04-30T04:21:26Z")
Hi there. Im using elastic agent to load all my system metrics in the dashboards given by kibana, the problem is that when i use the default metrics recollection time (10 seconds) it works well, giving me a perfect view… --- ## [When I tried to upsert using UpdateRequest object with type as "UPDATE", I met reject message](https://discuss.elastic.co/t/when-i-tried-to-upsert-using-updaterequest-object-with-type-as-update-i-met-reject-message/225826)
**Author:** [@Kooin-Shin](https://discuss.elastic.co/u/Kooin-Shin)\ **Replies:** 7\ **Last updated:** [April 1, 2020, 9:25am UTC](https://discuss.elastic.co/t/when-i-tried-to-upsert-using-updaterequest-object-with-type-as-update-i-met-reject-message/225826 "2020-04-01T09:25:39Z")
First of all, I did tried to upsert to Elastic Search with document. So I used org.elasticsearch.action.update.UpdateRequest object to upsert process. The code is blow. String type = map.remove("\<%=UPDATE%\>")+""; Strin… --- ## [ElasticSearch No Available connections error in Logstash](https://discuss.elastic.co/t/elasticsearch-no-available-connections-error-in-logstash/154581)
**Author:** [@marpa](https://discuss.elastic.co/u/marpa)\ **Replies:** 1\ **Last updated:** [October 31, 2018, 12:56pm UTC](https://discuss.elastic.co/t/elasticsearch-no-available-connections-error-in-logstash/154581 "2018-10-31T12:56:24Z")
I'm running a Logstash instance which is connected to an ES cluster behind a load balancer. The load balancer has an idle timeout of 5 minutes. Logstash is configured with the ES url corresponding to the loadbalancer i… --- ## [Utilisation de elasticsearch-py](https://discuss.elastic.co/t/utilisation-de-elasticsearch-py/80237)
**Author:** [@gabriel\_tessier](https://discuss.elastic.co/u/gabriel_tessier)\ **Replies:** 7\ **Last updated:** [April 7, 2017, 10:02am UTC](https://discuss.elastic.co/t/utilisation-de-elasticsearch-py/80237 "2017-04-07T10:02:20Z")
Bonjour, J'ai la configuration suivante: - un client en python (5.2.0) - deux serveurs elastic (5.2.2) Pour ma connexion j'ai un appel qui ressemble à ça: from elasticsearch import elasticsearch elasticsearch\_serv… --- ## [Querying attachment arrays \[ingest mapper plugin\]](https://discuss.elastic.co/t/querying-attachment-arrays-ingest-mapper-plugin/74269)
**Author:** [@tlovett1](https://discuss.elastic.co/u/tlovett1)\ **Replies:** 7\ **Last updated:** [February 9, 2017, 8:32pm UTC](https://discuss.elastic.co/t/querying-attachment-arrays-ingest-mapper-plugin/74269 "2017-02-09T20:32:06Z")
Hello, In this example, how can I search the nested attachments? A simple example would be super helpful. I am trying something like this but getting a nested object error: { "query": { "bool": { "must"… --- ## [Ngram search always returns same document](https://discuss.elastic.co/t/ngram-search-always-returns-same-document/54426)
**Author:** [@Mawalu](https://discuss.elastic.co/u/Mawalu)\ **Replies:** 7\ **Last updated:** [July 12, 2016, 1:33pm UTC](https://discuss.elastic.co/t/ngram-search-always-returns-same-document/54426 "2016-07-12T13:33:00Z")
I currently build a search for a contact list. The user should be allowed to search on any property and get results without typing full words / tokens. After I researched on the topic I found the ngram filter and tried t… --- ## [How to rename a field after extracting it from another field](https://discuss.elastic.co/t/how-to-rename-a-field-after-extracting-it-from-another-field/209050)
**Author:** [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)\ **Replies:** 6\ **Last updated:** [November 25, 2019, 9:14am UTC](https://discuss.elastic.co/t/how-to-rename-a-field-after-extracting-it-from-another-field/209050 "2019-11-25T09:14:48Z")
kv { source =\> "remain" field\_split =\> "," value\_split =\> "=" } mutate { rename =\> \["USERNAME", "user.name" \] … --- ## [Total shards per node calculation](https://discuss.elastic.co/t/total-shards-per-node-calculation/294829)
**Author:** [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\ **Replies:** 4\ **Last updated:** [January 24, 2022, 8:04pm UTC](https://discuss.elastic.co/t/total-shards-per-node-calculation/294829 "2022-01-24T20:04:57Z")
I've been working on Elastic for a while now but just wanted to do a quick check on learning that may also be useful to others. I've got a customer that would like 4 separate indices for logs. The only difference betwe… --- ## [Sum of Averages of individual in lens visualization](https://discuss.elastic.co/t/sum-of-averages-of-individual-in-lens-visualization/287574)
**Author:** [@Prasanth\_V](https://discuss.elastic.co/u/Prasanth_V)\ **Replies:** 8\ **Last updated:** [November 3, 2021, 5:39am UTC](https://discuss.elastic.co/t/sum-of-averages-of-individual-in-lens-visualization/287574 "2021-11-03T05:39:47Z")
Dear Team, Is it possible to calculate sum of averages of each individual(nodes) apache workers in single lens visualization? Kindly suggest us --- ## [Fortigate integration with ELK](https://discuss.elastic.co/t/fortigate-integration-with-elk/287323)
**Author:** [@Hamzah](https://discuss.elastic.co/u/Hamzah)\ **Replies:** 3\ **Last updated:** [October 26, 2021, 9:27am UTC](https://discuss.elastic.co/t/fortigate-integration-with-elk/287323 "2021-10-26T09:27:34Z")
Hi, I am trying to integrate fortigate with Elasticstack. What should be the optimal solution for this integration? 1- Should I use logstash, send fortigate logs to logstash and parse them. 2- Should I use filebeat se… --- ## [Parse "message" field on Syslog](https://discuss.elastic.co/t/parse-message-field-on-syslog/265729)
**Author:** [@Santiago\_Fernandez](https://discuss.elastic.co/u/Santiago_Fernandez)\ **Replies:** 3\ **Last updated:** [February 28, 2021, 6:53pm UTC](https://discuss.elastic.co/t/parse-message-field-on-syslog/265729 "2021-02-28T18:53:17Z")
Hi Guys! I m new in ELK. have managed to get the Stack up and send my syslogs from my API Manager. I would like to be able to transform a Syslog field into JSON. The "message" field. This is my logstash.conf input { … --- ## [Elasticsearch query returning score of 1.0 for all documents?](https://discuss.elastic.co/t/elasticsearch-query-returning-score-of-1-0-for-all-documents/262567)
**Author:** [@sabetai](https://discuss.elastic.co/u/sabetai)\ **Replies:** 3\ **Last updated:** [January 29, 2021, 12:32am UTC](https://discuss.elastic.co/t/elasticsearch-query-returning-score-of-1-0-for-all-documents/262567 "2021-01-29T00:32:54Z")
For the following query GET /test/\_search { "query": "fire" } I get hits with no match all showing a score of 1.0. Any variations of queries I try gives the same results. What's going on here? Results: { "took" … --- ## [Aggregations based on filtered nested fields](https://discuss.elastic.co/t/aggregations-based-on-filtered-nested-fields/99443)
**Author:** [@willcosgrove](https://discuss.elastic.co/u/willcosgrove)\ **Replies:** 8\ **Last updated:** [September 6, 2017, 8:30pm UTC](https://discuss.elastic.co/t/aggregations-based-on-filtered-nested-fields/99443 "2017-09-06T20:30:35Z")
I’m trying to construct a query with some aggregations based on filters of nested fields. Let me briefly explain my data models so the examples are easier to follow. I’ve got a Winery model, which has many Wine models.… --- ## [Having a cron job scheduler for file type input in logstash 5.0?](https://discuss.elastic.co/t/having-a-cron-job-scheduler-for-file-type-input-in-logstash-5-0/65441)
**Author:** [@Kulasangar\_Gowrisang](https://discuss.elastic.co/u/Kulasangar_Gowrisang)\ **Replies:** 3\ **Last updated:** [November 9, 2016, 10:16am UTC](https://discuss.elastic.co/t/having-a-cron-job-scheduler-for-file-type-input-in-logstash-5-0/65441 "2016-11-09T10:16:47Z")
I'm having the logstash configuration where it picks up the log files from a folder and pushing it to the index. This is how my input looks like: input { file { path =\> "/home/chamith/work/ELK/s… --- ## [Integrate file and db search](https://discuss.elastic.co/t/integrate-file-and-db-search/60680)
**Author:** [@insecta](https://discuss.elastic.co/u/insecta)\ **Replies:** 3\ **Last updated:** [September 19, 2016, 8:23am UTC](https://discuss.elastic.co/t/integrate-file-and-db-search/60680 "2016-09-19T08:23:22Z")
Hi to all, I'm considering elasticsearch to replace our "db only" search in a php/oracle application. I have an oracle db which contains various data type, and also files in blob fields. I want to index the single row (v… [Previous page](https://discuss.elastic.co/top.md?page=956&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=958&per_page=50&period=all)