# Latest **URL:** https://discuss.elastic.co/latest.md?page=1061 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1062 --- ## [Sending data to Logstash TCP](https://discuss.elastic.co/t/sending-data-to-logstash-tcp/308879)
**Author:** [@Johnnyboi](https://discuss.elastic.co/u/Johnnyboi)\ **Replies:** 0\ **Last updated:** [July 5, 2022, 9:15am UTC](https://discuss.elastic.co/t/sending-data-to-logstash-tcp/308879 "2022-07-05T09:15:51Z")
So I have logstash configured like this: input: tcp { port =\> 5401 } output: stdout { codec =\> rubydebug } When I try to connect to the port via browser, I can see the connection incoming in logstash lo… --- ## [Index not appearing in kibana via logstash](https://discuss.elastic.co/t/index-not-appearing-in-kibana-via-logstash/308178)
**Author:** [@bhatiac](https://discuss.elastic.co/u/bhatiac)\ **Replies:** 7\ **Last updated:** [July 5, 2022, 6:27am UTC](https://discuss.elastic.co/t/index-not-appearing-in-kibana-via-logstash/308178 "2022-07-05T06:27:31Z")
Hello, I am new to ELK, trying to read my application logs and wishing to show it on kibana dashboard for analysis purposes. Elasticsearch, kibana and logstash instances are up and running. While trying to see the newly… --- ## [To set a daily time range in kibana](https://discuss.elastic.co/t/to-set-a-daily-time-range-in-kibana/308738)
**Author:** [@hadi\_farzipour](https://discuss.elastic.co/u/hadi_farzipour)\ **Replies:** 1\ **Last updated:** [July 5, 2022, 9:03am UTC](https://discuss.elastic.co/t/to-set-a-daily-time-range-in-kibana/308738 "2022-07-05T09:03:35Z")
I am using ELK stack 7.6.1 to store and retrieve daily logs. I want to created a visualize(table) to show all daily logs between 00:00am to 10:00am automatically. while in the time span there is no option to select daily… --- ## [Elasticsearch Apply filters with results from aggregations](https://discuss.elastic.co/t/elasticsearch-apply-filters-with-results-from-aggregations/308744)
**Author:** [@Eddie\_Vuong](https://discuss.elastic.co/u/Eddie_Vuong)\ **Replies:** 7\ **Last updated:** [July 5, 2022, 8:53am UTC](https://discuss.elastic.co/t/elasticsearch-apply-filters-with-results-from-aggregations/308744 "2022-07-05T08:53:37Z")
Is there anyway I can using the results obtained from aggregations to filter out the final hits in the query? I want to obtain a list of users who have more than 2 devices and the list of their devices in the database. … --- ## [Remove Special character from message before sending to json filter](https://discuss.elastic.co/t/remove-special-character-from-message-before-sending-to-json-filter/308434)
**Author:** [@Basel](https://discuss.elastic.co/u/Basel)\ **Replies:** 4\ **Last updated:** [July 5, 2022, 8:10am UTC](https://discuss.elastic.co/t/remove-special-character-from-message-before-sending-to-json-filter/308434 "2022-07-05T08:10:46Z")
Hi, we are using ELK with Apigee to send the transaction logs, the logstash configuration is as recommended by the community as below: input { tcp { port =\> 8080 type =\> syslog } } filter { m… --- ## [Learn.elastic.co - Expired certificate - unable to access Elastic Learning Portal](https://discuss.elastic.co/t/learn-elastic-co-expired-certificate-unable-to-access-elastic-learning-portal/308807)
**Author:** [@aaronm](https://discuss.elastic.co/u/aaronm)\ **Replies:** 1\ **Last updated:** [July 5, 2022, 8:11am UTC](https://discuss.elastic.co/t/learn-elastic-co-expired-certificate-unable-to-access-elastic-learning-portal/308807 "2022-07-05T08:11:54Z")
Hi, Myself and a few colleagues are unable to access the Elastic Learning portal as the site cert has expired. Thanks for your help. --- ## [Sort ctx.payload using Transformed field](https://discuss.elastic.co/t/sort-ctx-payload-using-transformed-field/308869)
**Author:** [@M.Naim](https://discuss.elastic.co/u/M.Naim)\ **Replies:** 0\ **Last updated:** [July 5, 2022, 7:59am UTC](https://discuss.elastic.co/t/sort-ctx-payload-using-transformed-field/308869 "2022-07-05T07:59:03Z")
I want to sort the email content of watcher based on transformed field,consider "HoursDelayed": from example below Any Idea ? "send\_email": { "transform": { "script": { "source": """ … --- ## [Logstash include filter](https://discuss.elastic.co/t/logstash-include-filter/308853)
**Author:** [@tharunkumar](https://discuss.elastic.co/u/tharunkumar)\ **Replies:** 2\ **Last updated:** [July 5, 2022, 7:02am UTC](https://discuss.elastic.co/t/logstash-include-filter/308853 "2022-07-05T07:02:34Z")
Hi i need to send the logs of particular lines to logstash .i have tried by using include filter is not working .can u provide me the solution Eg: 2022-06-30 00:00:07 10.32.13.12 POST /maruvayaparpaidhee-cug/MF/Mfajax… --- ## [Filebeat include filter](https://discuss.elastic.co/t/filebeat-include-filter/308860)
**Author:** [@tharunkumar](https://discuss.elastic.co/u/tharunkumar)\ **Replies:** 1\ **Last updated:** [July 5, 2022, 6:58am UTC](https://discuss.elastic.co/t/filebeat-include-filter/308860 "2022-07-05T06:58:11Z")
Hi i need to send the logs of particular lines to logstash by using filebeat .i have tried by using include filter is not working .can u provide me the solution Eg: 2022-06-30 00:00:07 10.32.13.12 POST /maruvayaparpa… --- ## [Ingest pipeline split MESSAGE field into multiple fields](https://discuss.elastic.co/t/ingest-pipeline-split-message-field-into-multiple-fields/308834)
**Author:** [@moberreiter](https://discuss.elastic.co/u/moberreiter)\ **Replies:** 6\ **Last updated:** [July 5, 2022, 6:20am UTC](https://discuss.elastic.co/t/ingest-pipeline-split-message-field-into-multiple-fields/308834 "2022-07-05T06:20:37Z")
Hello everybody, I am new to elasticsearch and kibana and wanted to ask how to split a message into multiple fields. I tried creating an ingest pipeline with MESSAGE field and "," as separator, but it doesn't work as I… --- ## [Circuit break exception](https://discuss.elastic.co/t/circuit-break-exception/308774)
**Author:** [@Rajesh\_Sahu](https://discuss.elastic.co/u/Rajesh_Sahu)\ **Replies:** 5\ **Last updated:** [July 5, 2022, 6:13am UTC](https://discuss.elastic.co/t/circuit-break-exception/308774 "2022-07-05T06:13:17Z")
Hi all, I have been using Elasticsearch with multiple node setup from last 2 years, but currently all of sudden , got below exception of circuit\_breaking\_exception . \< {"error":{"root\_cause":\[{"type":"circuit\_breaking… --- ## [Huge Difference in the throughput for index](https://discuss.elastic.co/t/huge-difference-in-the-throughput-for-index/308320)
**Author:** [@amitsa](https://discuss.elastic.co/u/amitsa)\ **Replies:** 2\ **Last updated:** [July 5, 2022, 5:39am UTC](https://discuss.elastic.co/t/huge-difference-in-the-throughput-for-index/308320 "2022-07-05T05:39:15Z")
I am running es-cluster on kubernetes on aws 14i\_16xlarge instance. These below pods are running on different aws instances. track :- nyc\_taxis 1 master 1 data nodes 1 esrally client i am trying to calculate index… --- ## [Unique id for multiple indices having same alias](https://discuss.elastic.co/t/unique-id-for-multiple-indices-having-same-alias/308854)
**Author:** [@suj0](https://discuss.elastic.co/u/suj0)\ **Replies:** 1\ **Last updated:** [July 5, 2022, 5:03am UTC](https://discuss.elastic.co/t/unique-id-for-multiple-indices-having-same-alias/308854 "2022-07-05T05:03:00Z")
Is it possible to set unique id for multiple indices having same alias? for example I have 2 indices A001 and A002 under alias A . A001 have data with id as "1" and A002 dont have data with id "1" and my write index is… --- ## [Setting hour in KQL or Lucene](https://discuss.elastic.co/t/setting-hour-in-kql-or-lucene/308740)
**Author:** [@hadi\_farzipour](https://discuss.elastic.co/u/hadi_farzipour)\ **Replies:** 4\ **Last updated:** [July 5, 2022, 5:02am UTC](https://discuss.elastic.co/t/setting-hour-in-kql-or-lucene/308740 "2022-07-05T05:02:59Z")
Hello I have @timestamp field which is in following format Jul 3, 2022 @ 06:55:55.153 How can I filter logs between 06:00 and 10:00 without mentioning days and months in KQL or Lucene query language. --- ## [Statistics of requests' ip](https://discuss.elastic.co/t/statistics-of-requests-ip/306576)
**Author:** [@manropinxu](https://discuss.elastic.co/u/manropinxu)\ **Replies:** 1\ **Last updated:** [July 5, 2022, 2:17am UTC](https://discuss.elastic.co/t/statistics-of-requests-ip/306576 "2022-07-05T02:17:44Z")
Hi all, I would like to get metrics about how many requests does Elasticsearch receive grouped by ip of the request sender. My objective is to find which of my services are querying the most. I checked the stats endpo… --- ## [Question about create data view API](https://discuss.elastic.co/t/question-about-create-data-view-api/308530)
**Author:** [@busishe](https://discuss.elastic.co/u/busishe)\ **Replies:** 4\ **Last updated:** [July 5, 2022, 1:20am UTC](https://discuss.elastic.co/t/question-about-create-data-view-api/308530 "2022-07-05T01:20:32Z")
i want to create a dataview with only "message" field,how can i make the post request? the example only show "fields" is an object,but didnt tell the detail properties in the object. $ curl -X POST api/data\_views/dat… --- ## [My Logstash Docker container cannot start normally, please help me analyze it](https://discuss.elastic.co/t/my-logstash-docker-container-cannot-start-normally-please-help-me-analyze-it/308778)
**Author:** [@ahong](https://discuss.elastic.co/u/ahong)\ **Replies:** 5\ **Last updated:** [July 5, 2022, 12:35am UTC](https://discuss.elastic.co/t/my-logstash-docker-container-cannot-start-normally-please-help-me-analyze-it/308778 "2022-07-05T00:35:24Z")
I deployed ELK in the Docker container (version 8.2.3), but the Docker container wouldn't start when logStash was configured. The log error is as follows: {"log":"\[2022-07-04T03:29:27,007\]\[INFO \]\[logstash.javapipeline … --- ## [Curl command as streaming](https://discuss.elastic.co/t/curl-command-as-streaming/308838)
**Author:** [@Didi\_Sisi](https://discuss.elastic.co/u/Didi_Sisi)\ **Replies:** 0\ **Last updated:** [July 4, 2022, 11:38pm UTC](https://discuss.elastic.co/t/curl-command-as-streaming/308838 "2022-07-04T23:38:46Z")
Hello ; I want to use twitter streaming api V2. because the twitter plugin of logstash is not working with twitter api 2. I decided to use curl commands. I defined the rules. like this: curl --location --request POST … --- ## [Shrink and split APIs](https://discuss.elastic.co/t/shrink-and-split-apis/308752)
**Author:** [@ewolfman](https://discuss.elastic.co/u/ewolfman)\ **Replies:** 4\ **Last updated:** [July 4, 2022, 9:42pm UTC](https://discuss.elastic.co/t/shrink-and-split-apis/308752 "2022-07-04T21:42:57Z")
Hi, I tried the shrink API on a 30GB index and shrinked from 15 shards to 5 shards. What I am not sure about is that this seemed to have happened instantaneously. I checked the \_cat/recovery endpoint and saw that ther… --- ## [Editing a managed policy can break Kibana](https://discuss.elastic.co/t/editing-a-managed-policy-can-break-kibana/308836)
**Author:** [@kmp](https://discuss.elastic.co/u/kmp)\ **Replies:** 0\ **Last updated:** [July 4, 2022, 9:12pm UTC](https://discuss.elastic.co/t/editing-a-managed-policy-can-break-kibana/308836 "2022-07-04T21:12:41Z")
Just upgraded a Cloud deployment to 8.3.1 ... I'm still working on tuning usage, to try to figure out how to ensure that we're using resources efficiently. I've been looking at storage usage, and using lifecycle polici… --- ## [Logstash MySQL pakcet too large exception](https://discuss.elastic.co/t/logstash-mysql-pakcet-too-large-exception/308541)
**Author:** [@Simone1](https://discuss.elastic.co/u/Simone1)\ **Replies:** 3\ **Last updated:** [July 4, 2022, 7:41pm UTC](https://discuss.elastic.co/t/logstash-mysql-pakcet-too-large-exception/308541 "2022-07-04T19:41:50Z")
I'm trying to retreive data from a remote MySQL Server through the 22 port and i receive this error: \[ERROR\] 2022-06-29 15:21:37.081 \[\[main\]\"Ja… --- ## [Processor in auditd module fails](https://discuss.elastic.co/t/processor-in-auditd-module-fails/308693)
**Author:** [@parisila](https://discuss.elastic.co/u/parisila)\ **Replies:** 2\ **Last updated:** [July 4, 2022, 6:38pm UTC](https://discuss.elastic.co/t/processor-in-auditd-module-fails/308693 "2022-07-04T18:38:41Z")
I have a processor defined in the auditd module and seems to be correct based on other posts I have read. No configuration errors and filebeat starts up but I get an error ERROR instance/beat.go:989 Exit… --- ## [Curl -X GET http://localhost:9200 returns Access Denied](https://discuss.elastic.co/t/curl-x-get-http-localhost-9200-returns-access-denied/308687)
**Author:** [@Alaa\_Omar](https://discuss.elastic.co/u/Alaa_Omar)\ **Replies:** 2\ **Last updated:** [July 4, 2022, 6:35pm UTC](https://discuss.elastic.co/t/curl-x-get-http-localhost-9200-returns-access-denied/308687 "2022-07-04T18:35:03Z")
am trying to install and setup Elasticsearch 8 on Centos 7 server, the service started but when I do curl -x GET HTTP://localhost:9200 , or curl -x GET HTTP://127.0.0.1:9200 or curl -x GET HTTP://(local IP of the host):9… --- ## [Get all spaces dev tools](https://discuss.elastic.co/t/get-all-spaces-dev-tools/308827)
**Author:** [@Gabriel\_Vasconcelos](https://discuss.elastic.co/u/Gabriel_Vasconcelos)\ **Replies:** 0\ **Last updated:** [July 4, 2022, 4:18pm UTC](https://discuss.elastic.co/t/get-all-spaces-dev-tools/308827 "2022-07-04T16:18:12Z")
Hello everyone, I would like to know how to return all my spaces through dev tools. The documentation says it would be GET api/spaces/apace, but when I use this path, it only returns the spaces I created with index api. … --- ## [Enrichment policy based on multiple fields / complex query?](https://discuss.elastic.co/t/enrichment-policy-based-on-multiple-fields-complex-query/308826)
**Author:** [@akb](https://discuss.elastic.co/u/akb)\ **Replies:** 0\ **Last updated:** [July 4, 2022, 4:09pm UTC](https://discuss.elastic.co/t/enrichment-policy-based-on-multiple-fields-complex-query/308826 "2022-07-04T16:09:58Z")
I am investigating a way to normalize / prettify geo data during ingestion. I realize there is a way to normalize by lat / lon, however we don't always have these properties availble. Master geo data: { "country": "… --- ## [Regarding grok Date Time](https://discuss.elastic.co/t/regarding-grok-date-time/308636)
**Author:** [@suresh\_u](https://discuss.elastic.co/u/suresh_u)\ **Replies:** 2\ **Last updated:** [July 4, 2022, 3:54pm UTC](https://discuss.elastic.co/t/regarding-grok-date-time/308636 "2022-07-04T15:54:30Z")
In my oracle DB, I have with timestamp like this: "createdDate" =\> 2022-04-02T17:00:44.339Z But in my elasticsearch index, having createdDate as "createdDate": "2022-04-02T17:00:44Z" How can we change the format in Log… --- ## [AGgregation query not working related to child document](https://discuss.elastic.co/t/aggregation-query-not-working-related-to-child-document/308822)
**Author:** [@Udayaprakash\_S\_10d](https://discuss.elastic.co/u/Udayaprakash_S_10d)\ **Replies:** 0\ **Last updated:** [July 4, 2022, 2:38pm UTC](https://discuss.elastic.co/t/aggregation-query-not-working-related-to-child-document/308822 "2022-07-04T14:38:24Z")
"aggregations": { "terms\_parent\_id": { "terms": { "field": "user\_id", "size": 10000, "min\_doc\_count": 1, "shard\_min\_doc\_count": 0, "show\_term\_doc\_count\_error": false, … --- ## [Average search latency increase 900% from 7.4 to 7.10](https://discuss.elastic.co/t/average-search-latency-increase-900-from-7-4-to-7-10/308760)
**Author:** [@fgarsombke](https://discuss.elastic.co/u/fgarsombke)\ **Replies:** 2\ **Last updated:** [July 4, 2022, 2:07pm UTC](https://discuss.elastic.co/t/average-search-latency-increase-900-from-7-4-to-7-10/308760 "2022-07-04T14:07:47Z")
We recently did an upgrade from 7.4 to 7.10 and have seen over a 900% increase in search latency. Before the upgrade our average search latency was about 0.5ms and after the upgrade our average search latency is now at … --- ## [Rally 2.6.0](https://discuss.elastic.co/t/rally-2-6-0/308819)
**Author:** [@Quentin\_Pradet](https://discuss.elastic.co/u/Quentin_Pradet)\ **Replies:** 0\ **Last updated:** [July 4, 2022, 2:06pm UTC](https://discuss.elastic.co/t/rally-2-6-0/308819 "2022-07-04T14:06:37Z")
Shortly after Rally 2.5.0, we have just released Rally 2.6.0. Highlights: Rally can now create and use unique ES API keys for each simulated client (#1520) Rally can now paginate through composite aggregations results … --- ## [Could not index event to Elasticsearch - no write index is defined for alias](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-no-write-index-is-defined-for-alias/308783)
**Author:** [@teesr5](https://discuss.elastic.co/u/teesr5)\ **Replies:** 1\ **Last updated:** [July 4, 2022, 1:15pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-no-write-index-is-defined-for-alias/308783 "2022-07-04T13:15:31Z")
Hi guys, we are facing an issue on our ELK infrastructure: \[WARN \]\[logstash.outputs.elasticsearch\]\[main\] Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>nil, :\_index=\>"logstash-rollover… [Previous page](https://discuss.elastic.co/latest.md?page=1060) [Next page](https://discuss.elastic.co/latest.md?page=1062)