# Top **URL:** https://discuss.elastic.co/top.md?page=1079&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1080 --- ## [How to move all the json fields at root level to a sub json node?](https://discuss.elastic.co/t/how-to-move-all-the-json-fields-at-root-level-to-a-sub-json-node/215522)
**Author:** [@STAR\_DEVX](https://discuss.elastic.co/u/STAR_DEVX)\ **Replies:** 2\ **Last updated:** [January 20, 2020, 9:55pm UTC](https://discuss.elastic.co/t/how-to-move-all-the-json-fields-at-root-level-to-a-sub-json-node/215522 "2020-01-20T21:55:32Z")
I want to move all the json node at the root level to a sub level jason node. What's the most efficient way to use filters to achieve that? root level { "a": 1, "b": "str", "c": {"key": "value"} } I want the resul… --- ## [Filebeat (Beats) install on Solaris](https://discuss.elastic.co/t/filebeat-beats-install-on-solaris/132294)
**Author:** [@Charaf\_Ahmed](https://discuss.elastic.co/u/Charaf_Ahmed)\ **Replies:** 2\ **Last updated:** [May 17, 2018, 9:51am UTC](https://discuss.elastic.co/t/filebeat-beats-install-on-solaris/132294 "2018-05-17T09:51:26Z")
Hello, currently, is it filebeat and the others are supported by the Solaris system? Merci beaucoup ! --- ## [English\_morphology](https://discuss.elastic.co/t/english-morphology/1605)
**Author:** [@lightsuner](https://discuss.elastic.co/u/lightsuner)\ **Replies:** 2\ **Last updated:** [July 4, 2015, 4:01pm UTC](https://discuss.elastic.co/t/english-morphology/1605 "2015-07-04T16:01:42Z")
Я использую: 1) elasticsearch - 1.4.4 2) плагин elasticsearch-analysis-morphology - 1.2.0 Я создал свой анализатор, в котором использую "english\_morphology" в качестве токен-фильтра. Пробле… --- ## [Bulk upload file data into app search from a json file](https://discuss.elastic.co/t/bulk-upload-file-data-into-app-search-from-a-json-file/264640)
**Author:** [@pakwai122](https://discuss.elastic.co/u/pakwai122)\ **Replies:** 4\ **Last updated:** [February 25, 2021, 12:41pm UTC](https://discuss.elastic.co/t/bulk-upload-file-data-into-app-search-from-a-json-file/264640 "2021-02-25T12:41:45Z")
I tried to use postman to post over 10 million lines of data into app search, but it returned i/o timeout. Think it's too large to digest in postman, how can I import the data into app search from a json file(3gb) --- ## [Logstash is failing if one of the ES is down](https://discuss.elastic.co/t/logstash-is-failing-if-one-of-the-es-is-down/92639)
**Author:** [@Narayanan\_Sukumar](https://discuss.elastic.co/u/Narayanan_Sukumar)\ **Replies:** 4\ **Last updated:** [July 13, 2017, 10:21am UTC](https://discuss.elastic.co/t/logstash-is-failing-if-one-of-the-es-is-down/92639 "2017-07-13T10:21:10Z")
I was doing some testing with my ELK setup before it is going into production. I have two ES clusters and based on the kafka topic it will push. I intentionally made the one of the ES down and the logstash is not pus… --- ## [After 5.4 upgrade, problems with Dev Tools](https://discuss.elastic.co/t/after-5-4-upgrade-problems-with-dev-tools/85166)
**Author:** [@prodrg](https://discuss.elastic.co/u/prodrg)\ **Replies:** 4\ **Last updated:** [May 17, 2017, 2:46pm UTC](https://discuss.elastic.co/t/after-5-4-upgrade-problems-with-dev-tools/85166 "2017-05-17T14:46:42Z")
Hello everybody, After upgrading the stack to 5.4 (with X-Pack enabled before and SSL settings), I am receiving the following issue using the console on Kibana: { "statusCode": 502, "error": "Bad Gateway", "me… --- ## [Elasticsearch SQL ODBC taking more time than previous version](https://discuss.elastic.co/t/elasticsearch-sql-odbc-taking-more-time-than-previous-version/269442)
**Author:** [@onkark](https://discuss.elastic.co/u/onkark)\ **Replies:** 8\ **Last updated:** [April 14, 2021, 8:39am UTC](https://discuss.elastic.co/t/elasticsearch-sql-odbc-taking-more-time-than-previous-version/269442 "2021-04-14T08:39:29Z")
I'm using SQL ODBC driver to fetch the results from elastic. I'm getting problem while fetching the documents from elastic. The query is as simple as 'select empno, name, address from emp'. In Elasticsearch version 7.6.2… --- ## [Setting re-index batch size in curator tool](https://discuss.elastic.co/t/setting-re-index-batch-size-in-curator-tool/255579)
**Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Replies:** 3\ **Last updated:** [November 17, 2020, 4:30pm UTC](https://discuss.elastic.co/t/setting-re-index-batch-size-in-curator-tool/255579 "2020-11-17T16:30:46Z")
When using \_reindex api in Elasticsearch, we can set scroll batch size as below From https://www.elastic.co/guide/en/elasticsearch/reference/6.8/docs-reindex.html - By default \_reindex uses scroll batches of 1000. You c… --- ## [Accessing \_version metadata field from elasticsearch using logstash](https://discuss.elastic.co/t/accessing-version-metadata-field-from-elasticsearch-using-logstash/151307)
**Author:** [@lana](https://discuss.elastic.co/u/lana)\ **Replies:** 3\ **Last updated:** [October 6, 2018, 10:11am UTC](https://discuss.elastic.co/t/accessing-version-metadata-field-from-elasticsearch-using-logstash/151307 "2018-10-06T10:11:02Z")
Hi, I'm using the ELK- Stack to import CSV files. Each time the CSV files are imported the "\_version" field of a document increases, which is as expected. However, because the \_version field is a metadata field, is not … --- ## [How to design an architecture which can upgrade es on hot?](https://discuss.elastic.co/t/how-to-design-an-architecture-which-can-upgrade-es-on-hot/104000)
**Author:** [@chenjinyuan87](https://discuss.elastic.co/u/chenjinyuan87)\ **Replies:** 8\ **Last updated:** [October 15, 2017, 5:17pm UTC](https://discuss.elastic.co/t/how-to-design-an-architecture-which-can-upgrade-es-on-hot/104000 "2017-10-15T17:17:45Z")
We have more than 10 services who use es in different ways. So each service connect to the cluster themselves. That is, if i want to upgrade es to 6.0, we need to upgrade and test all the services at the same time, ful… --- ## [Using aws plugin and Shield](https://discuss.elastic.co/t/using-aws-plugin-and-shield/34952)
**Author:** [@Idarlington](https://discuss.elastic.co/u/Idarlington)\ **Replies:** 3\ **Last updated:** [November 18, 2015, 5:20pm UTC](https://discuss.elastic.co/t/using-aws-plugin-and-shield/34952 "2015-11-18T17:20:50Z")
Hello, I would like to know if there would be any setting in order to use an S3 repository with shield installed in elasticsearch. I would also like to use curator for the snapshots. @dadoonet @warkolm --- ## [Using .NET APM Agent to monitor server side SharePoint IIS sites](https://discuss.elastic.co/t/using-net-apm-agent-to-monitor-server-side-sharepoint-iis-sites/249695)
**Author:** [@tkuhns](https://discuss.elastic.co/u/tkuhns)\ **Replies:** 2\ **Last updated:** [October 16, 2020, 3:58pm UTC](https://discuss.elastic.co/t/using-net-apm-agent-to-monitor-server-side-sharepoint-iis-sites/249695 "2020-10-16T15:58:08Z")
I have been attempting to setup the .NET Agent for use on a SharePoint IIS site following the instructions that I found in https://discuss.elastic.co/t/cannot-make-apm-client-work-on-iis/211179. The sites are managed by … --- ## [Winlogbeat missing events](https://discuss.elastic.co/t/winlogbeat-missing-events/237961)
**Author:** [@craigothy](https://discuss.elastic.co/u/craigothy)\ **Replies:** 2\ **Last updated:** [June 23, 2020, 9:04pm UTC](https://discuss.elastic.co/t/winlogbeat-missing-events/237961 "2020-06-23T21:04:36Z")
Can someone tell me the best way to troubleshoot missing windows events from winlogbeat in elastic. We are using WEC to get events to a central collector. That collector is running winlogbeat to send to logstash and then… --- ## [Beats instance detected Click 'Set up monitoring' below to start monitoring this instance](https://discuss.elastic.co/t/beats-instance-detected-click-set-up-monitoring-below-to-start-monitoring-this-instance/322008)
**Author:** [@ant2ne](https://discuss.elastic.co/u/ant2ne)\ **Replies:** 7\ **Last updated:** [December 28, 2022, 4:27pm UTC](https://discuss.elastic.co/t/beats-instance-detected-click-set-up-monitoring-below-to-start-monitoring-this-instance/322008 "2022-12-28T16:27:41Z")
All services are running. I log into 5601, click the drop down hamburger | Management | Stack Monitoring But there is no 'Set up monitoring' to click on. root@ub2204elk:/etc# cat metricbeat/metricbeat.yml | grep -v … --- ## [Backup and restore es 5.6.x restoring to a different cluster](https://discuss.elastic.co/t/backup-and-restore-es-5-6-x-restoring-to-a-different-cluster/137566)
**Author:** [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Replies:** 1\ **Last updated:** [June 27, 2018, 8:24am UTC](https://discuss.elastic.co/t/backup-and-restore-es-5-6-x-restoring-to-a-different-cluster/137566 "2018-06-27T08:24:27Z")
i have two clusters also is es 5.6.x . cluster a cluster b in one cluster a i with shard nfs backup data. i wan't to know how restore the backup in cluster a to cluster b, i find it support in https://www.elasti… --- ## [Elasticsearch watcher transform script](https://discuss.elastic.co/t/elasticsearch-watcher-transform-script/45232)
**Author:** [@santhosh](https://discuss.elastic.co/u/santhosh)\ **Replies:** 1\ **Last updated:** [March 24, 2016, 10:30am UTC](https://discuss.elastic.co/t/elasticsearch-watcher-transform-script/45232 "2016-03-24T10:30:27Z")
How to pass the payload as input to 'transform' process in ELK watcher? I have tried with following way but it pass them as string to groovy file. "transform": { "script": { "file": "error\_parser", "lang":… --- ## [Dec 5th, 2022: \[EN\] On-season troubleshooting](https://discuss.elastic.co/t/dec-5th-2022-en-on-season-troubleshooting/319857)
**Author:** [@gmarouli](https://discuss.elastic.co/u/gmarouli)\ **Replies:** 0\ **Last updated:** [December 5, 2022, 8:00am UTC](https://discuss.elastic.co/t/dec-5th-2022-en-on-season-troubleshooting/319857 "2022-12-05T08:00:03Z")
While many people are singing "It's the Most Wonderful Time of the Year...", I catch myself making a small adjustment: "It's the Most Exciting Time of the Year..." I live in the Netherlands and the mid November to m… --- ## [Filter in ids query](https://discuss.elastic.co/t/filter-in-ids-query/262902)
**Author:** [@yish-yish](https://discuss.elastic.co/u/yish-yish)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 8:40pm UTC](https://discuss.elastic.co/t/filter-in-ids-query/262902 "2021-02-01T20:40:29Z")
Hi elastic wizards. I have in my code base an ids query, and I need to add filtering capabilities to the query i.e. in addition to the ids filter, I need to be able to add additional term based filters. Is there a way … --- ## [Packetbeat "hanging" on high speed network](https://discuss.elastic.co/t/packetbeat-hanging-on-high-speed-network/262117)
**Author:** [@Antonio\_Augusto\_Sant](https://discuss.elastic.co/u/Antonio_Augusto_Sant)\ **Replies:** 0\ **Last updated:** [January 25, 2021, 1:56pm UTC](https://discuss.elastic.co/t/packetbeat-hanging-on-high-speed-network/262117 "2021-01-25T13:56:50Z")
Gentlemen, I've configured packetbeat on a machine with plenty resources (72GB RAM, 24 cores Intel Xeon X5670), and its listening on two 10gb interfaces, that combined are reaching about 1gbps during peak hours. On this… --- ## [Logstash overrides input tcp codec from JSON to JSON\_Lines](https://discuss.elastic.co/t/logstash-overrides-input-tcp-codec-from-json-to-json-lines/202375)
**Author:** [@dmalhan](https://discuss.elastic.co/u/dmalhan)\ **Replies:** 0\ **Last updated:** [October 4, 2019, 6:54pm UTC](https://discuss.elastic.co/t/logstash-overrides-input-tcp-codec-from-json-to-json-lines/202375 "2019-10-04T18:54:57Z")
My config file: input { tcp { port =\> 5044 codec =\> json } } Everytime I run logstash, I get the following in my startup logs: \[INFO \]\[logstash.inputs.tcp \] Automatically switching from j… --- ## [Inspect Logstash resource consumption](https://discuss.elastic.co/t/inspect-logstash-resource-consumption/108902)
**Author:** [@ntviet18](https://discuss.elastic.co/u/ntviet18)\ **Replies:** 0\ **Last updated:** [November 23, 2017, 2:09pm UTC](https://discuss.elastic.co/t/inspect-logstash-resource-consumption/108902 "2017-11-23T14:09:53Z")
My Logstash cluster with 4 nodes was running perfectly fine and using 1 Gib of memory each. After I configured persistent queue, suddenly each node use up to 8-10 Gib each. I am suspecting some kind of buffering happen, … --- ## [External Source used for Scoring - Need Plugin Start](https://discuss.elastic.co/t/external-source-used-for-scoring-need-plugin-start/21038)
**Author:** [@Scott\_Decker](https://discuss.elastic.co/u/Scott_Decker)\ **Replies:** 0\ **Last updated:** [December 2, 2014, 5:43pm UTC](https://discuss.elastic.co/t/external-source-used-for-scoring-need-plugin-start/21038 "2014-12-02T17:43:49Z")
Hey All, I know we can use a plugin to get started in ES, every once in awhile load values for a key in our es index, and then use these values when running the scoring of a query run against the documents. Not… --- ## [Filebeat tail\_files in filestream input](https://discuss.elastic.co/t/filebeat-tail-files-in-filestream-input/296282)
**Author:** [@solnicki](https://discuss.elastic.co/u/solnicki)\ **Replies:** 2\ **Last updated:** [February 8, 2022, 10:04am UTC](https://discuss.elastic.co/t/filebeat-tail-files-in-filestream-input/296282 "2022-02-08T10:04:05Z")
Hi All, Starting from filebeat version 7.15 there is a recommendation to switch from log input type to filestream as log is deprecated. My problem is that filestream apparently does not includes tail\_files config optio… --- ## [Is sorting possible on search\_as\_you\_type field](https://discuss.elastic.co/t/is-sorting-possible-on-search-as-you-type-field/276449)
**Author:** [@kiko](https://discuss.elastic.co/u/kiko)\ **Replies:** 2\ **Last updated:** [June 20, 2021, 6:43am UTC](https://discuss.elastic.co/t/is-sorting-possible-on-search-as-you-type-field/276449 "2021-06-20T06:43:58Z")
I have mapped my product/category titles to search\_as\_you\_type fields. When I try to sort by those fields I get this error: "error": { "root\_cause": \[ { "type": "illegal\_argument\_e… --- ## [Bulk Request Monitoring](https://discuss.elastic.co/t/bulk-request-monitoring/198464)
**Author:** [@danielyahn](https://discuss.elastic.co/u/danielyahn)\ **Replies:** 2\ **Last updated:** [September 12, 2019, 9:23pm UTC](https://discuss.elastic.co/t/bulk-request-monitoring/198464 "2019-09-12T21:23:44Z")
According to the doc, it's important to monitor bulk requests to tune ES-Hadoop ingest. I think it will be beneficial to set up monitoring around the requests for production operation as well. I've tried few different r… --- ## [Scripted Field for Date to Quarter and adding names](https://discuss.elastic.co/t/scripted-field-for-date-to-quarter-and-adding-names/159053)
**Author:** [@whyapenny](https://discuss.elastic.co/u/whyapenny)\ **Replies:** 2\ **Last updated:** [December 4, 2018, 2:55am UTC](https://discuss.elastic.co/t/scripted-field-for-date-to-quarter-and-adding-names/159053 "2018-12-04T02:55:11Z")
Im pretty new to scripted fields. I read the elastic blog post on it and checked lucene capabilities. So far I have the simple scripted field to convert the date to month. doc\['@timestamp'\].date.monthOfYear which ret… --- ## [Packetbeat will not GET Kibana HTTPS](https://discuss.elastic.co/t/packetbeat-will-not-get-kibana-https/267210)
**Author:** [@Elks2020](https://discuss.elastic.co/u/Elks2020)\ **Replies:** 6\ **Last updated:** [March 20, 2021, 4:09am UTC](https://discuss.elastic.co/t/packetbeat-will-not-get-kibana-https/267210 "2021-03-20T04:09:35Z")
Hello everyone, I need help to figure-out the following problem to be fixed where the packetbeat won't start! :tired\_face: ' ' ' packetbeat\[523584\]: Exiting: error connecting to Kibana: fail to get the Kibana version… --- ## [ES closed for no reason](https://discuss.elastic.co/t/es-closed-for-no-reason/75809)
**Author:** [@tramchamploo](https://discuss.elastic.co/u/tramchamploo)\ **Replies:** 6\ **Last updated:** [February 22, 2017, 6:40am UTC](https://discuss.elastic.co/t/es-closed-for-no-reason/75809 "2017-02-22T06:40:24Z")
Swap closed, and 40GB allocated for heap. \[2017-02-21T02:42:26,604\]\[INFO \]\[o.e.m.j.JvmGcMonitorService\] \[node-10.75.28.181\] \[gc\]\[10708\] overhead, spent \[331ms\] collecting in the last \[1s\] \[2017-02-21T02:44:31,127\]\[IN… --- ## [Date Format Error with Full ISO Date](https://discuss.elastic.co/t/date-format-error-with-full-iso-date/47153)
**Author:** [@CPoston](https://discuss.elastic.co/u/CPoston)\ **Replies:** 6\ **Last updated:** [April 13, 2016, 9:09pm UTC](https://discuss.elastic.co/t/date-format-error-with-full-iso-date/47153 "2016-04-13T21:09:17Z")
From logstash I'm getting (removed extraneous info) : :timestamp=\>"2016-04-12T12:14:08.428000-0500" :message=\>"Failed action. " "reason"=\>"Invalid format: "2016-04-12T12:14:04.7872034-05:00" is malformed at "-04-12T12:… --- ## [Couldn't connect to elasticsearch remotely](https://discuss.elastic.co/t/couldnt-connect-to-elasticsearch-remotely/175981)
**Author:** [@srimathi](https://discuss.elastic.co/u/srimathi)\ **Replies:** 5\ **Last updated:** [April 10, 2019, 3:34am UTC](https://discuss.elastic.co/t/couldnt-connect-to-elasticsearch-remotely/175981 "2019-04-10T03:34:41Z")
Hi All, I'm new to Elasticsearch. I've installed elasticsearch 6.7.0 on Centos6.9. It is a single cluster node. I can successfully curl it on same machine. curl -XGET "http://xxx.xxx.xx.xx:9200" I get the following resu… --- ## [Query terms with dash in string?](https://discuss.elastic.co/t/query-terms-with-dash-in-string/295780)
**Author:** [@Emporea](https://discuss.elastic.co/u/Emporea)\ **Replies:** 3\ **Last updated:** [January 30, 2022, 4:01pm UTC](https://discuss.elastic.co/t/query-terms-with-dash-in-string/295780 "2022-01-30T16:01:38Z")
GET /\_search { "query": { "terms": { "user.id": \[ "kimchy", "elkbee-test" \], } } } Result will only include kimchy, because I guess the dash is interpretet as a bool operator. How to fix this? --- ## [Failed to start kibana after adding more elasticsearch.host](https://discuss.elastic.co/t/failed-to-start-kibana-after-adding-more-elasticsearch-host/227846)
**Author:** [@gilang\_bilbisri](https://discuss.elastic.co/u/gilang_bilbisri)\ **Replies:** 3\ **Last updated:** [April 14, 2020, 4:32pm UTC](https://discuss.elastic.co/t/failed-to-start-kibana-after-adding-more-elasticsearch-host/227846 "2020-04-14T16:32:01Z")
hello. am using Centos 7, kibana 7.6,elasticsearch 7.6. i have problems with my kibana. It won't start after adding 1 more elasticsearch.host on kibana config. Before that i only have 2 elasticsearch host in my config.… --- ## [Visual Builder - "count" field definition](https://discuss.elastic.co/t/visual-builder-count-field-definition/101831)
**Author:** [@Akaren](https://discuss.elastic.co/u/Akaren)\ **Replies:** 3\ **Last updated:** [September 27, 2017, 6:07pm UTC](https://discuss.elastic.co/t/visual-builder-count-field-definition/101831 "2017-09-27T18:07:19Z")
Hi, I have created in Visual Builder chart. I am using "count" agg. "Count" should show "the last value in that case". What is definition of last value in that case? Is it the value from last event? What if in the same… --- ## [Can't list my plugins](https://discuss.elastic.co/t/cant-list-my-plugins/59912)
**Author:** [@mathias](https://discuss.elastic.co/u/mathias)\ **Replies:** 3\ **Last updated:** [October 26, 2016, 11:21am UTC](https://discuss.elastic.co/t/cant-list-my-plugins/59912 "2016-10-26T11:21:45Z")
Hi, I have installed marbel and sense plugins. Sese plugin seems to work but now marvel. Marvel says "No Marvel Data Found" I have googled for solution but not found anything that solved my problem. Staring elastic… --- ## [Dynamodb river - Update index](https://discuss.elastic.co/t/dynamodb-river-update-index/372)
**Author:** [@Niraj](https://discuss.elastic.co/u/Niraj)\ **Replies:** 1\ **Last updated:** [July 28, 2015, 6:02pm UTC](https://discuss.elastic.co/t/dynamodb-river-update-index/372 "2015-07-28T18:02:58Z")
Hi, I am new to Elasticsearch. I am facing issue with Dynamodb river plugin. does anyone know how to update index automatically while fetching data from dynamodb. i mean if any change occured in dynamodb data then it aut… --- ## [KQL query to retrieve list of servers which are running metricbeat](https://discuss.elastic.co/t/kql-query-to-retrieve-list-of-servers-which-are-running-metricbeat/260336)
**Author:** [@Sergius92](https://discuss.elastic.co/u/Sergius92)\ **Replies:** 4\ **Last updated:** [January 7, 2021, 9:11am UTC](https://discuss.elastic.co/t/kql-query-to-retrieve-list-of-servers-which-are-running-metricbeat/260336 "2021-01-07T09:11:22Z")
Hello, I am trying to retrieve the list of servers which are running metricbeat. At this moment I have build an query but I don't know how to get the output with every host.name and the number of hits in the last minut… --- ## [Kibana and vega aggregate](https://discuss.elastic.co/t/kibana-and-vega-aggregate/194450)
**Author:** [@Axel\_MORVAN](https://discuss.elastic.co/u/Axel_MORVAN)\ **Replies:** 4\ **Last updated:** [August 19, 2019, 6:42am UTC](https://discuss.elastic.co/t/kibana-and-vega-aggregate/194450 "2019-08-19T06:42:30Z")
Hello, I need to made a map with vega and kibana, and i need to aggregate 3 fields when i create the transform aggregate like this : { "type": "aggregate", "groupby": \["cit\_code\_insee"\] "f… --- ## [\[discovery.seed\_hosts, discovery.seed\_providers, cluster.initial\_master\_nodes\] must be configured helm chart](https://discuss.elastic.co/t/discovery-seed-hosts-discovery-seed-providers-cluster-initial-master-nodes-must-be-configured-helm-chart/187648)
**Author:** [@mouna\_boujrad](https://discuss.elastic.co/u/mouna_boujrad)\ **Replies:** 4\ **Last updated:** [June 27, 2019, 1:11pm UTC](https://discuss.elastic.co/t/discovery-seed-hosts-discovery-seed-providers-cluster-initial-master-nodes-must-be-configured-helm-chart/187648 "2019-06-27T13:11:31Z")
hello I have installed elasticsearch using this helm chart , which is by default a version 6.7.0 of elasticsearch , I wanted to install version 7.1.1 so I changed the value file : appVersion: "7.1.1" image: rep… --- ## [Trouble parsing date with date filter](https://discuss.elastic.co/t/trouble-parsing-date-with-date-filter/79646)
**Author:** [@jclose](https://discuss.elastic.co/u/jclose)\ **Replies:** 4\ **Last updated:** [March 23, 2017, 2:51pm UTC](https://discuss.elastic.co/t/trouble-parsing-date-with-date-filter/79646 "2017-03-23T14:51:33Z")
I'm having trouble with some date parsing. The entry I'm getting doesn't have a year in the datestamp, so I'm trying to pull the year out of @timestamp, and then put the proper timestamp back into @timestamp. So my da… --- ## [Error in elasticsearch logs](https://discuss.elastic.co/t/error-in-elasticsearch-logs/118233)
**Author:** [@Kaouther\_Mechri](https://discuss.elastic.co/u/Kaouther_Mechri)\ **Replies:** 8\ **Last updated:** [February 7, 2018, 10:55am UTC](https://discuss.elastic.co/t/error-in-elasticsearch-logs/118233 "2018-02-07T10:55:52Z")
Hello everyone, I have this Error in my Elasticsearch logs . Do you have any idea please ? ELK 6.1.1 thanks \[2018-02-02T14:20:03,624\]\[DEBUG\]\[o.e.a.b.TransportShardBulkAction\] \[logstash-2018.02.02\]\[2\] failed to execut… --- ## [Trouble parsing apache log using custom grok pattern](https://discuss.elastic.co/t/trouble-parsing-apache-log-using-custom-grok-pattern/157833)
**Author:** [@Havoc45](https://discuss.elastic.co/u/Havoc45)\ **Replies:** 2\ **Last updated:** [November 29, 2018, 1:55am UTC](https://discuss.elastic.co/t/trouble-parsing-apache-log-using-custom-grok-pattern/157833 "2018-11-29T01:55:17Z")
Hai, I'm new to Elastic Stack and I'm an intern to a company. One of the managers give me this project and I need you guys help. The use-case here is they want to categorize and analyse old logs from a variety of devices… --- ## [Free Text search not working in Kibana Discover tab](https://discuss.elastic.co/t/free-text-search-not-working-in-kibana-discover-tab/88001)
**Author:** [@Roopa\_Chandrasekarai](https://discuss.elastic.co/u/Roopa_Chandrasekarai)\ **Replies:** 2\ **Last updated:** [June 2, 2017, 10:59pm UTC](https://discuss.elastic.co/t/free-text-search-not-working-in-kibana-discover-tab/88001 "2017-06-02T22:59:21Z")
We are using ELK for log processing. But unable to do free text search in Kibana. I wanted to search for a text "future" (Which I copy pasted from the document which appeared in the Discover tab) but Kibana showed "No … --- ## [Configuring logstash to listen to Filebeat](https://discuss.elastic.co/t/configuring-logstash-to-listen-to-filebeat/75160)
**Author:** [@agrawalsaurabh](https://discuss.elastic.co/u/agrawalsaurabh)\ **Replies:** 2\ **Last updated:** [February 15, 2017, 10:26am UTC](https://discuss.elastic.co/t/configuring-logstash-to-listen-to-filebeat/75160 "2017-02-15T10:26:10Z")
Hi, I have installed Logstash version 5.2.0 and File Beat 5.2.0. Next I configured file beat to send events to logstash. Next I configured logstash to listen to file beat by the following configuration: input { beat… --- ## [Problem with geoip.location field conflict](https://discuss.elastic.co/t/problem-with-geoip-location-field-conflict/73483)
**Author:** [@ruby](https://discuss.elastic.co/u/ruby)\ **Replies:** 2\ **Last updated:** [February 1, 2017, 11:55pm UTC](https://discuss.elastic.co/t/problem-with-geoip-location-field-conflict/73483 "2017-02-01T23:55:43Z")
hello, I am facing an issue with the geoip.location. This is the error screen shot The filebeat indexed template is { "mappings": { "\_default\_": { "\_all": { "enabled": true, "norms": { … --- ## [Visualization with stat data](https://discuss.elastic.co/t/visualization-with-stat-data/33745)
**Author:** [@raffis](https://discuss.elastic.co/u/raffis)\ **Replies:** 2\ **Last updated:** [November 5, 2015, 9:12am UTC](https://discuss.elastic.co/t/visualization-with-stat-data/33745 "2015-11-05T09:12:17Z")
I want to create graphs with stat data, but I've realized that this is impossible as far as I understood kibana correctly. @see similar topics: https://discuss.elastic.co/t/how-to-get-latest-entry-for-all-users/29222 I… --- ## [Bloom Filter and other Lucene utils](https://discuss.elastic.co/t/bloom-filter-and-other-lucene-utils/4238)
**Author:** [@MJ\_Suhonos](https://discuss.elastic.co/u/MJ_Suhonos)\ **Replies:** 2\ **Last updated:** [April 14, 2011, 4:58pm UTC](https://discuss.elastic.co/t/bloom-filter-and-other-lucene-utils/4238 "2011-04-14T16:58:21Z")
Hi all (but mostly Shay), I came across this posting from the Grepling blog today (I'm not really familiar with Greplin, the link was passed by a friend): http://tech.blog.greplin.com/lucene-utilities-and-bloom-filte… --- ## [Usage of filestream](https://discuss.elastic.co/t/usage-of-filestream/320009)
**Author:** [@anon90868141](https://discuss.elastic.co/u/anon90868141)\ **Replies:** 7\ **Last updated:** [January 4, 2023, 6:24am UTC](https://discuss.elastic.co/t/usage-of-filestream/320009 "2023-01-04T06:24:54Z")
Hello, I have a few question about the topic filestream and it's difference to the input log. Do I only need an id when using multiple filebeat inputs in a single yml or always? Currently im not using any ids but im … --- ## [The label of kibanaAddFilter doesn't work](https://discuss.elastic.co/t/the-label-of-kibanaaddfilter-doesnt-work/301795)
**Author:** [@karlanakamura](https://discuss.elastic.co/u/karlanakamura)\ **Replies:** 7\ **Last updated:** [May 2, 2022, 1:50pm UTC](https://discuss.elastic.co/t/the-label-of-kibanaaddfilter-doesnt-work/301795 "2022-05-02T13:50:37Z")
Hi, I am using Vega to create an age pyramid and I would like to filter the data by clicking on a bar. Thus, I created a signal and used kibanaAddFilter to define the query, as shown in the code below. "signals": \[ {… --- ## [Logstash unexpected message - crypto/rsa verification error](https://discuss.elastic.co/t/logstash-unexpected-message-crypto-rsa-verification-error/267484)
**Author:** [@dkdlv38](https://discuss.elastic.co/u/dkdlv38)\ **Replies:** 3\ **Last updated:** [March 30, 2021, 12:29pm UTC](https://discuss.elastic.co/t/logstash-unexpected-message-crypto-rsa-verification-error/267484 "2021-03-30T12:29:49Z")
Hi all, I'm new here and I have an issue with the configuration of my Windows machines sending logs to a Logstash server through Winlogbeat (for what I understand as I recovered this installation undocumented from a col… --- ## [Auditbeat not capturing Windows failure events](https://discuss.elastic.co/t/auditbeat-not-capturing-windows-failure-events/168963)
**Author:** [@arunpmohan](https://discuss.elastic.co/u/arunpmohan)\ **Replies:** 3\ **Last updated:** [February 21, 2019, 1:50pm UTC](https://discuss.elastic.co/t/auditbeat-not-capturing-windows-failure-events/168963 "2019-02-21T13:50:20Z")
I have created a standard user in Windows and tried to create a file in the C:\\windows\\system32 folder and it failed. My Auditbeat is configured to listen to the above folder. But it does not capture any events during th… [Previous page](https://discuss.elastic.co/top.md?page=1078&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1080&per_page=50&period=all)