# Latest **URL:** https://discuss.elastic.co/latest.md?page=1295 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1296 --- ## [Export Elasticsearch Index to local](https://discuss.elastic.co/t/export-elasticsearch-index-to-local/295193)
**Author:** [@AsakaRin](https://discuss.elastic.co/u/AsakaRin)\ **Replies:** 1\ **Last updated:** [January 24, 2022, 9:54am UTC](https://discuss.elastic.co/t/export-elasticsearch-index-to-local/295193 "2022-01-24T09:54:36Z")
I want to make a clone database Elasticsearch from server to my local. I already have permission to access API and create snapshots but I can't access the server direct and download snapshots to my local. Is there any wa… --- ## [Custom Logs Ingest Pipeline](https://discuss.elastic.co/t/custom-logs-ingest-pipeline/294409)
**Author:** [@jsteenkamp](https://discuss.elastic.co/u/jsteenkamp)\ **Replies:** 8\ **Last updated:** [January 24, 2022, 9:34am UTC](https://discuss.elastic.co/t/custom-logs-ingest-pipeline/294409 "2022-01-24T09:34:47Z")
@ruflin This is more or less a duplicate of Fleet Custom Logs Ingest Pipeline, but I still find it hard to figure out which steps I have to follow. I would really appreciate better documentation or some useful direction… --- ## [LogStash Special Character Split Error](https://discuss.elastic.co/t/logstash-special-character-split-error/295137)
**Author:** [@eagles40cnuh](https://discuss.elastic.co/u/eagles40cnuh)\ **Replies:** 6\ **Last updated:** [January 24, 2022, 9:10am UTC](https://discuss.elastic.co/t/logstash-special-character-split-error/295137 "2022-01-24T09:10:40Z")
Hi! I have some problem with Logstash Filter Filebeat collect -\> "aaa.log" file and then message field -\> "ID∮NAME∮TELNO" And Logstash.conf is input { beats { port =\> xxxx } filter { mutate { split =\> { "message"… --- ## [Right order to stop ELK](https://discuss.elastic.co/t/right-order-to-stop-elk/295199)
**Author:** [@Ram\_N](https://discuss.elastic.co/u/Ram_N)\ **Replies:** 1\ **Last updated:** [January 24, 2022, 9:01am UTC](https://discuss.elastic.co/t/right-order-to-stop-elk/295199 "2022-01-24T09:01:19Z")
Hi What is the recommended to stop Elasticsearch, logstash, kibana? Which should be stopped first? At times if Elasticsearch is stopped first, logstash is trying to establish connection and logstash is not getting stopp… --- ## [ElasticSearch won't search specific field](https://discuss.elastic.co/t/elasticsearch-wont-search-specific-field/295201)
**Author:** [@bert\_coenen](https://discuss.elastic.co/u/bert_coenen)\ **Replies:** 0\ **Last updated:** [January 24, 2022, 8:59am UTC](https://discuss.elastic.co/t/elasticsearch-wont-search-specific-field/295201 "2022-01-24T08:59:30Z")
I have a problem searching a specific field inside my index. little background: On my project we need to search inside a terminology Server like FHIR but then our own. So we have an object that contains a Code (123564/… --- ## [Number of shards and deployment sizing](https://discuss.elastic.co/t/number-of-shards-and-deployment-sizing/294618)
**Author:** [@yelloyonder](https://discuss.elastic.co/u/yelloyonder)\ **Replies:** 4\ **Last updated:** [January 24, 2022, 8:57am UTC](https://discuss.elastic.co/t/number-of-shards-and-deployment-sizing/294618 "2022-01-24T08:57:26Z")
We have created a small deployment on Elastic Cloud which we are testing with non-live data. Reading this blog post How many shards should I have in my Elasticsearch cluster? | Elastic Blog it suggests approximately 20 … --- ## [Custom time frame for charts](https://discuss.elastic.co/t/custom-time-frame-for-charts/294194)
**Author:** [@DanielCC](https://discuss.elastic.co/u/DanielCC)\ **Replies:** 3\ **Last updated:** [January 24, 2022, 8:42am UTC](https://discuss.elastic.co/t/custom-time-frame-for-charts/294194 "2022-01-24T08:42:58Z")
Hello there, Which version of Kibana allows me to have this option for my panels? --- ## [Getting 502 bad gateway error while creating new index](https://discuss.elastic.co/t/getting-502-bad-gateway-error-while-creating-new-index/295183)
**Author:** [@Nikhil\_Sonkar](https://discuss.elastic.co/u/Nikhil_Sonkar)\ **Replies:** 3\ **Last updated:** [January 24, 2022, 8:23am UTC](https://discuss.elastic.co/t/getting-502-bad-gateway-error-while-creating-new-index/295183 "2022-01-24T08:23:54Z")
502 Bad Gateway 502 Bad Gateway --- ## [How to zoom in the Y-Axis in a line chart using kibana 7.16?](https://discuss.elastic.co/t/how-to-zoom-in-the-y-axis-in-a-line-chart-using-kibana-7-16/295162)
**Author:** [@GustavoEH](https://discuss.elastic.co/u/GustavoEH)\ **Replies:** 2\ **Last updated:** [January 24, 2022, 7:53am UTC](https://discuss.elastic.co/t/how-to-zoom-in-the-y-axis-in-a-line-chart-using-kibana-7-16/295162 "2022-01-24T07:53:47Z")
Hello everyone, I'm new in Elasticsearch/Kibana and this is my first post, maybe the question is simple but I already expend hours trying to solve this issue, also looking for something similar in many forums but nothin… --- ## [How is Kibana accessing Large amounts of data from Elasticsearch in few seconds?](https://discuss.elastic.co/t/how-is-kibana-accessing-large-amounts-of-data-from-elasticsearch-in-few-seconds/295039)
**Author:** [@Harish\_fragger](https://discuss.elastic.co/u/Harish_fragger)\ **Replies:** 3\ **Last updated:** [January 24, 2022, 7:20am UTC](https://discuss.elastic.co/t/how-is-kibana-accessing-large-amounts-of-data-from-elasticsearch-in-few-seconds/295039 "2022-01-24T07:20:52Z")
I am trying to understand how is kibana fetching 129,306,319 hits from Elasticsearch and displaying it in Discover -\> Inspect -\> Responses? I can see from the request query that they are retrieving only 500 records at a… --- ## [Users password expiration or blocked accounts](https://discuss.elastic.co/t/users-password-expiration-or-blocked-accounts/295086)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 6\ **Last updated:** [January 24, 2022, 6:35am UTC](https://discuss.elastic.co/t/users-password-expiration-or-blocked-accounts/295086 "2022-01-24T06:35:23Z")
Dears, In our Elastic cluster we have few local users which login to Kibana for browsing indexes with applications logs. Twice a week two users reports me problems with login to Kibana. After password reset these users… --- ## [How to migrate all dashboard, visualization, map, template, kibana settings data?](https://discuss.elastic.co/t/how-to-migrate-all-dashboard-visualization-map-template-kibana-settings-data/295173)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 7\ **Last updated:** [January 24, 2022, 6:31am UTC](https://discuss.elastic.co/t/how-to-migrate-all-dashboard-visualization-map-template-kibana-settings-data/295173 "2022-01-24T06:31:28Z")
I want to completely migrate the data of the 7.12 cluster to the 7.16 cluster, including all the data, which can be understood as mirroring. I suspect that the data on kibana is all on the kibana index. If it is copied … --- ## [Why do i see multiple nodes in the data folder](https://discuss.elastic.co/t/why-do-i-see-multiple-nodes-in-the-data-folder/295040)
**Author:** [@Saravana37](https://discuss.elastic.co/u/Saravana37)\ **Replies:** 4\ **Last updated:** [January 24, 2022, 5:49am UTC](https://discuss.elastic.co/t/why-do-i-see-multiple-nodes-in-the-data-folder/295040 "2022-01-24T05:49:49Z")
Hello , I have upgraded Elasticsearch last month twice to fix log4j vulnerability . In EMEA i see only one folder and used disk space is 400GB. But in NAFTA i see 3 folders under node and overall it is consuming 750GB w… --- ## [Fingerprint option in logstash filter not working properly?](https://discuss.elastic.co/t/fingerprint-option-in-logstash-filter-not-working-properly/295115)
**Author:** [@Anjali\_Kushwaha](https://discuss.elastic.co/u/Anjali_Kushwaha)\ **Replies:** 9\ **Last updated:** [January 24, 2022, 5:39am UTC](https://discuss.elastic.co/t/fingerprint-option-in-logstash-filter-not-working-properly/295115 "2022-01-24T05:39:37Z")
I have used below code but its only inserting one record to ES . filter { fingerprint { target =\> "document\_id" method =\> "SHA256" key =\> "9ced3827c6a1c9dafac6da9abac41386ba1038ac95b3a865a0951bc2e948c58c" … --- ## [Change index name for threatintel module, good idea?](https://discuss.elastic.co/t/change-index-name-for-threatintel-module-good-idea/295158)
**Author:** [@xentoo](https://discuss.elastic.co/u/xentoo)\ **Replies:** 1\ **Last updated:** [January 24, 2022, 3:12am UTC](https://discuss.elastic.co/t/change-index-name-for-threatintel-module-good-idea/295158 "2022-01-24T03:12:09Z")
Hello, I am trying to change the name of the index for threatintel module from "filebeat" to "threatintel". It does not make much sense to me to bury these documents amongst millions of logs. Or does it? Am I missing s… --- ## [Elasticsearch top\_hits aggregation result and doc\_count are different](https://discuss.elastic.co/t/elasticsearch-top-hits-aggregation-result-and-doc-count-are-different/293400)
**Author:** [@hyun](https://discuss.elastic.co/u/hyun)\ **Replies:** 2\ **Last updated:** [January 23, 2022, 11:33pm UTC](https://discuss.elastic.co/t/elasticsearch-top-hits-aggregation-result-and-doc-count-are-different/293400 "2022-01-23T23:33:56Z")
Query GET /someindex/\_search { "size": 0, "query": { "ids": { "types": \[\], "values": \["08a2","08a3","03a2","03a3","84a1"\] } }, "aggregations": { "498": { "terms":… --- ## [Unmapped field in document not appearing in filter drop down](https://discuss.elastic.co/t/unmapped-field-in-document-not-appearing-in-filter-drop-down/295128)
**Author:** [@Tech\_solution](https://discuss.elastic.co/u/Tech_solution)\ **Replies:** 4\ **Last updated:** [January 23, 2022, 11:08pm UTC](https://discuss.elastic.co/t/unmapped-field-in-document-not-appearing-in-filter-drop-down/295128 "2022-01-23T23:08:58Z")
Hi, I am new to Kibana dashboard . The issue I came across is that I want to create a dashboard for an unmapped field while that field is not mapped in index ( it doesn't appear in drop down for filters or in the fields… --- ## [Elastic Community Conference 2022 - 11 and 12th February 2022](https://discuss.elastic.co/t/elastic-community-conference-2022-11-and-12th-february-2022/295166)
**Author:** [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Replies:** 0\ **Last updated:** [January 23, 2022, 9:25pm UTC](https://discuss.elastic.co/t/elastic-community-conference-2022-11-and-12th-february-2022/295166 "2022-01-23T21:25:48Z")
The second annual Elastic Community Conference (ElasticCC) is taking place February 11–12, 2022. Join us and hear success stories, lessons learned, tips, tricks, best practices, or funny anecdotes. ElasticCC is a free t… --- ## [Recreate index from GET mappings output](https://discuss.elastic.co/t/recreate-index-from-get-mappings-output/295159)
**Author:** [@markrity](https://discuss.elastic.co/u/markrity)\ **Replies:** 0\ **Last updated:** [January 23, 2022, 8:30pm UTC](https://discuss.elastic.co/t/recreate-index-from-get-mappings-output/295159 "2022-01-23T20:30:26Z")
I'm trying to find a way to recreate all index mappings from when I use GET /\_all/\_mapping or iterate over each index. For creating development cluster purposes. I have tried to use the json I get from get all mappings… --- ## [Xpath Functions in Logstash](https://discuss.elastic.co/t/xpath-functions-in-logstash/295119)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 4\ **Last updated:** [January 23, 2022, 6:43pm UTC](https://discuss.elastic.co/t/xpath-functions-in-logstash/295119 "2022-01-23T18:43:31Z")
I am needing to use xpath functions like string-join() and concat() to extract what I need from my XML file, however whenever I use these functions I get the following warning in my logstash-plain.log: \[2022-01-21T20:4… --- ## [Getting every 2nd element from \_source](https://discuss.elastic.co/t/getting-every-2nd-element-from-source/295123)
**Author:** [@EnJay](https://discuss.elastic.co/u/EnJay)\ **Replies:** 6\ **Last updated:** [January 23, 2022, 6:19pm UTC](https://discuss.elastic.co/t/getting-every-2nd-element-from-source/295123 "2022-01-23T18:19:25Z")
Hello dear community. I have been looking for information for a very long time. I need to make mapping from search for every 2nd element. For example, I have "size": 1000, while I want to get every second element as a … --- ## [Kibana vega context and timefield](https://discuss.elastic.co/t/kibana-vega-context-and-timefield/295102)
**Author:** [@Tingda\_Du](https://discuss.elastic.co/u/Tingda_Du)\ **Replies:** 8\ **Last updated:** [January 23, 2022, 5:09pm UTC](https://discuss.elastic.co/t/kibana-vega-context-and-timefield/295102 "2022-01-23T17:09:05Z")
When I include the lines of // Apply dashboard context filters when set %context%: true // Filter the time picker (upper right corner) with this field %timefield%: @timestamp I got this error: \* Infinite extent for fi… --- ## [How to different syslog in the same port?](https://discuss.elastic.co/t/how-to-different-syslog-in-the-same-port/295134)
**Author:** [@baalchina](https://discuss.elastic.co/u/baalchina)\ **Replies:** 6\ **Last updated:** [January 23, 2022, 3:22pm UTC](https://discuss.elastic.co/t/how-to-different-syslog-in-the-same-port/295134 "2022-01-23T15:22:24Z")
Hi all, I have many network devices, I forward their syslog to a logstash server, and then to elastisearch. In logstash, I start many ports, such 514,515,516... and each port to different log types, and when output to e… --- ## [Logstash Aggregate Problem tag in subdirectories Please Help](https://discuss.elastic.co/t/logstash-aggregate-problem-tag-in-subdirectories-please-help/295116)
**Author:** [@melorium](https://discuss.elastic.co/u/melorium)\ **Replies:** 7\ **Last updated:** [January 23, 2022, 3:20pm UTC](https://discuss.elastic.co/t/logstash-aggregate-problem-tag-in-subdirectories-please-help/295116 "2022-01-23T15:20:04Z")
Hi i trying to use logstash aggregate to tag all log events i main and sub folders. I want all logs in APP1 folders and subfolders to have tag "APP1" and all logs in app2 folders to have APP2 etc. My friend did some ki… --- ## [Filter to remember field accross lines with between start and stop tag](https://discuss.elastic.co/t/filter-to-remember-field-accross-lines-with-between-start-and-stop-tag/295147)
**Author:** [@melorium](https://discuss.elastic.co/u/melorium)\ **Replies:** 3\ **Last updated:** [January 23, 2022, 2:41pm UTC](https://discuss.elastic.co/t/filter-to-remember-field-accross-lines-with-between-start-and-stop-tag/295147 "2022-01-23T14:41:07Z")
Hi. I have a log with a s tart and stop tag. 2021-12-30 13:15:08.614 +0100 \[AWT-EventQueue-0\] 51818 INFO com.nuix.data.keystore.b - Read 0 passwords from C:\\CASE\\Test Log 1-1\\Stores\\DecryptionKeys\\pgpkeylist.dat This… --- ## [UnexpectedElasticsearchClientException](https://discuss.elastic.co/t/unexpectedelasticsearchclientexception/294794)
**Author:** [@Katgust](https://discuss.elastic.co/u/Katgust)\ **Replies:** 1\ **Last updated:** [January 23, 2022, 10:42am UTC](https://discuss.elastic.co/t/unexpectedelasticsearchclientexception/294794 "2022-01-23T10:42:22Z")
Im getting the following error Elasticsearch.Net.UnexpectedElasticsearchClientException: Message: expected:'{', actual:'" "', at offset:390 I understand the reason why but I'm not sure if it's solvable. Im trying to g… --- ## [Cant get grok working with nginx log](https://discuss.elastic.co/t/cant-get-grok-working-with-nginx-log/293061)
**Author:** [@Constantine](https://discuss.elastic.co/u/Constantine)\ **Replies:** 5\ **Last updated:** [December 29, 2021, 12:59pm UTC](https://discuss.elastic.co/t/cant-get-grok-working-with-nginx-log/293061 "2021-12-29T12:59:55Z")
Hi, Can someone help me with nginx logs please. I have full nginx log: 2021-12-28T17:00:34+00:00 site="demo" server="demotest" dest\_port="443" dest\_ip="172.19.0.3" src="172.31.27.65" src\_ip="172.31.27.65" user="-" tim… --- ## [Data to large](https://discuss.elastic.co/t/data-to-large/295133)
**Author:** [@eden\_shirazi](https://discuss.elastic.co/u/eden_shirazi)\ **Replies:** 1\ **Last updated:** [January 23, 2022, 8:36am UTC](https://discuss.elastic.co/t/data-to-large/295133 "2022-01-23T08:36:05Z")
Hi, I have Elasticsearch cluster version 5.1.2 on windows 2012 r2 server. One of the servers in the cluster having an issue that I don't know how to solve... (i'm new at the elastic) In the log file it seems like that… --- ## [Date field shows different values](https://discuss.elastic.co/t/date-field-shows-different-values/294788)
**Author:** [@Aviel\_Bashari](https://discuss.elastic.co/u/Aviel_Bashari)\ **Replies:** 2\ **Last updated:** [January 23, 2022, 7:08am UTC](https://discuss.elastic.co/t/date-field-shows-different-values/294788 "2022-01-23T07:08:22Z")
Hi, i have a python script that converts CSV files into ndjson files, add a date custom field with iso format and pushes to elk using the 'Elasticsearch' package. I'm having an issue with the values shows in the Kibana… --- ## [Intermittent issues with Elasticsearch. Where do I even start?](https://discuss.elastic.co/t/intermittent-issues-with-elasticsearch-where-do-i-even-start/295064)
**Author:** [@Henrik41](https://discuss.elastic.co/u/Henrik41)\ **Replies:** 5\ **Last updated:** [January 23, 2022, 6:18am UTC](https://discuss.elastic.co/t/intermittent-issues-with-elasticsearch-where-do-i-even-start/295064 "2022-01-23T06:18:27Z")
Using Magento 2.3.4 Elasticsearch 7.16.3 java 1.8.0\_312 I installed it on Ubuntu 20.04 with 2cpu and 2g RAM. /etc/default/Elasticsearch ES\_HEAP\_SIZE=1g ES\_STARTUP\_SLEEP\_TIME=5 MAX\_OPEN\_FILES=65535 MAX\_LOCKED\_MEM… [Previous page](https://discuss.elastic.co/latest.md?page=1294) [Next page](https://discuss.elastic.co/latest.md?page=1296)