# Top **URL:** https://discuss.elastic.co/top.md?page=1100&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1101 --- ## [Update a document in a watcher](https://discuss.elastic.co/t/update-a-document-in-a-watcher/184066)
**Author:** [@mostafa\_hassan](https://discuss.elastic.co/u/mostafa_hassan)\ **Replies:** 3\ **Last updated:** [June 7, 2019, 2:08pm UTC](https://discuss.elastic.co/t/update-a-document-in-a-watcher/184066 "2019-06-07T14:08:22Z")
Continuing the discussion from Is it possible to update a document in watcher: The proposed answer shows how to CREATE a document using index action, but the real question is how to update a document from a watcher. Th… --- ## [Fatal in logstash 6.0.0](https://discuss.elastic.co/t/fatal-in-logstash-6-0-0/114469)
**Author:** [@sbampa](https://discuss.elastic.co/u/sbampa)\ **Replies:** 3\ **Last updated:** [January 8, 2018, 9:23am UTC](https://discuss.elastic.co/t/fatal-in-logstash-6-0-0/114469 "2018-01-08T09:23:46Z")
Hi all, i receive the following error in logstash logs and the process died.: Error: unknown IOException: jnr.enxio.channels.NativeException: Error closing fd 371: Stale NFS file handle Exception: Java::JavaLang::Runt… --- ## [Trying to use custom patterns without success](https://discuss.elastic.co/t/trying-to-use-custom-patterns-without-success/75119)
**Author:** [@gcranshaw](https://discuss.elastic.co/u/gcranshaw)\ **Replies:** 3\ **Last updated:** [February 15, 2017, 4:08pm UTC](https://discuss.elastic.co/t/trying-to-use-custom-patterns-without-success/75119 "2017-02-15T16:08:20Z")
I have an ELK stack setup on Ubuntu 16.04 all using version 5.2. Everything is working fine. I am using the below 05-ciscoasa-filter.conf file in /etc/logstash/conf.d to sort logs from a Cisco ASA that are being dumped t… --- ## [Filebeat is resending all data](https://discuss.elastic.co/t/filebeat-is-resending-all-data/46652)
**Author:** [@NiteshBarnwal](https://discuss.elastic.co/u/NiteshBarnwal)\ **Replies:** 3\ **Last updated:** [April 8, 2016, 10:57am UTC](https://discuss.elastic.co/t/filebeat-is-resending-all-data/46652 "2016-04-08T10:57:48Z")
I have one query regarding the data pushed by filebeat to logstash. When I am opening and saving the log file, filebeat is resending all the data from the begining of the log. Is this the expected behaviour ? How can w… --- ## [Best practice for a logging cluster](https://discuss.elastic.co/t/best-practice-for-a-logging-cluster/37360)
**Author:** [@elvarb](https://discuss.elastic.co/u/elvarb)\ **Replies:** 3\ **Last updated:** [December 18, 2015, 9:13am UTC](https://discuss.elastic.co/t/best-practice-for-a-logging-cluster/37360 "2015-12-18T09:13:16Z")
I'm setting up a new logging cluster consisting of 3x dedicated master nodes, 6x dedicated data nodes and 1-2x client nodes to handle Kibana requests. Now I'm wondering what is the best practice of ingesting data from … --- ## [Changing the published port](https://discuss.elastic.co/t/changing-the-published-port/23203)
**Author:** [@Vinicius\_Carvalho](https://discuss.elastic.co/u/Vinicius_Carvalho)\ **Replies:** 3\ **Last updated:** [April 16, 2015, 1:53pm UTC](https://discuss.elastic.co/t/changing-the-published-port/23203 "2015-04-16T13:53:08Z")
Hi there, I'm trying to setup an ES infrastructure inside docker, and so far I was able to change the publish host from using docker's internal IP to use the HOST IP, but I have problems because the PORT used by the … --- ## [Types - Array vs Nested vs Object](https://discuss.elastic.co/t/types-array-vs-nested-vs-object/19773)
**Author:** [@Eric\_Rodriguez](https://discuss.elastic.co/u/Eric_Rodriguez)\ **Replies:** 0\ **Last updated:** [September 14, 2014, 6:47am UTC](https://discuss.elastic.co/t/types-array-vs-nested-vs-object/19773 "2014-09-14T06:47:55Z")
Hi, I'm trying to understand the difference and limitation of these "multi field" core types: - Array: http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/mapping-array-type.html - Nested: ht… --- ## [\_delete\_by\_query not working](https://discuss.elastic.co/t/delete-by-query-not-working/126826)
**Author:** [@john.bennett](https://discuss.elastic.co/u/john.bennett)\ **Replies:** 6\ **Last updated:** [April 11, 2018, 4:59pm UTC](https://discuss.elastic.co/t/delete-by-query-not-working/126826 "2018-04-11T16:59:42Z")
Due to a miss setting, we have some docs in the ES that are GZ compressed. We fixed the file, and the info we need is loaded ok. But we wish to delete the docs that are gz compressed. I find the docs I want to delete. O… --- ## [Query duration too high for ~200G logs a day](https://discuss.elastic.co/t/query-duration-too-high-for-200g-logs-a-day/98117)
**Author:** [@Moshe\_Saada](https://discuss.elastic.co/u/Moshe_Saada)\ **Replies:** 6\ **Last updated:** [August 28, 2017, 10:46am UTC](https://discuss.elastic.co/t/query-duration-too-high-for-200g-logs-a-day/98117 "2017-08-28T10:46:03Z")
Hi, We're using ES cluster (version 5.4.1) with 4 data nodes, 3 master, one client node (kibana). The data nodes are r4.2xlarge aws instance (61g memory, 8vCPU) with 30G memory allocated for the ES JAVA. We have writi… --- ## [Kibana Own Plugin Development - Kibana/Courier not Available](https://discuss.elastic.co/t/kibana-own-plugin-development-kibana-courier-not-available/67585)
**Author:** [@PrabakarKaruppasamy](https://discuss.elastic.co/u/PrabakarKaruppasamy)\ **Replies:** 6\ **Last updated:** [December 5, 2016, 7:55am UTC](https://discuss.elastic.co/t/kibana-own-plugin-development-kibana-courier-not-available/67585 "2016-12-05T07:55:27Z")
Hi, I am developing new custom plugin for kibana. I am trying to create the plugin same as visualizations. After adding the module dependency kibana/courier into my app i am getting the following errors. Uncaught E… --- ## [Missing required property on Elastic Cluster Health check](https://discuss.elastic.co/t/missing-required-property-on-elastic-cluster-health-check/371458)
**Author:** [@p4paul](https://discuss.elastic.co/u/p4paul)\ **Replies:** 5\ **Last updated:** [July 14, 2025, 9:21am UTC](https://discuss.elastic.co/t/missing-required-property-on-elastic-cluster-health-check/371458 "2025-07-14T09:21:00Z")
Very similar to Error: using Java API calling ElasticsearchClient method healthReport() Updating the Java client (from 8.15.3) to elasticsearch-java:8.16.1 and calling... HealthResponse healthModel = getEsClient().clus… --- ## [Beats Developer Guide \[master\] is out of date, creating new beat fails](https://discuss.elastic.co/t/beats-developer-guide-master-is-out-of-date-creating-new-beat-fails/263156)
**Author:** [@jackemuk-es](https://discuss.elastic.co/u/jackemuk-es)\ **Replies:** 5\ **Last updated:** [February 8, 2021, 10:10am UTC](https://discuss.elastic.co/t/beats-developer-guide-master-is-out-of-date-creating-new-beat-fails/263156 "2021-02-08T10:10:23Z")
There are errors in the documentation to get started with creating your own beats. If you search in the history, they have been around for some time and haven't been updated. This makes it extremely difficult to create a… --- ## [A shard closed suddenly on indexing data](https://discuss.elastic.co/t/a-shard-closed-suddenly-on-indexing-data/194170)
**Author:** [@chenchuangc](https://discuss.elastic.co/u/chenchuangc)\ **Replies:** 5\ **Last updated:** [August 9, 2019, 9:47am UTC](https://discuss.elastic.co/t/a-shard-closed-suddenly-on-indexing-data/194170 "2019-08-09T09:47:13Z")
Elasticsearch version bin/elasticsearch --version 7.1.1 Logstash version 7.1.1 Plugins installed bin/elasticsearch-plugin list analysis-ik JVM version java -version java version "1.8.0\_91" Java(TM) SE Runtime Env… --- ## [Use API field as a variable in logstash input](https://discuss.elastic.co/t/use-api-field-as-a-variable-in-logstash-input/133689)
**Author:** [@AurelienG](https://discuss.elastic.co/u/AurelienG)\ **Replies:** 5\ **Last updated:** [June 1, 2018, 9:10am UTC](https://discuss.elastic.co/t/use-api-field-as-a-variable-in-logstash-input/133689 "2018-06-01T09:10:14Z")
Hello, What I am trying to do seems quite similar to what @dorj1234 was asking help for a few months ago in this topic but the answer provided is not enough for me so I hope you won't mind me opening a similar topic. W… --- ## [Cluster crash after upgrading Kibana to 6.0](https://discuss.elastic.co/t/cluster-crash-after-upgrading-kibana-to-6-0/109454)
**Author:** [@LogBabel](https://discuss.elastic.co/u/LogBabel)\ **Replies:** 5\ **Last updated:** [November 29, 2017, 10:11am UTC](https://discuss.elastic.co/t/cluster-crash-after-upgrading-kibana-to-6-0/109454 "2017-11-29T10:11:11Z")
Hello all, Our cluster was upgraded from 5.6.3 to 6.0.0 and has now crashed and will not recover. I followed the directions and used a rolling upgrade. It seems upgrading Kibana to 6.0.0 caused some sort of failure. … --- ## [How to prevent writing user credentials into .watcher-history index?](https://discuss.elastic.co/t/how-to-prevent-writing-user-credentials-into-watcher-history-index/104521)
**Author:** [@Martin\_Becker](https://discuss.elastic.co/u/Martin_Becker)\ **Replies:** 5\ **Last updated:** [October 23, 2017, 7:57am UTC](https://discuss.elastic.co/t/how-to-prevent-writing-user-credentials-into-watcher-history-index/104521 "2017-10-23T07:57:35Z")
I have a watch which checks the request\_cache. Therefore I need to query the elasticsearch API using basic auth for the watch which looks as follows: PUT \_xpack/watcher/watch/request-cache-watcher { "trigg… --- ## [Logstash not creating right number of documents when passing folder as an argument](https://discuss.elastic.co/t/logstash-not-creating-right-number-of-documents-when-passing-folder-as-an-argument/69720)
**Author:** [@saisn](https://discuss.elastic.co/u/saisn)\ **Replies:** 5\ **Last updated:** [December 27, 2016, 10:37am UTC](https://discuss.elastic.co/t/logstash-not-creating-right-number-of-documents-when-passing-folder-as-an-argument/69720 "2016-12-27T10:37:56Z")
Hi, What I'm doing: Created 4 conf files under a root directory called XYZ. Each of these conf files will import 1000 rows from SQL and tables being imported are unique in all 4 conf files. when ran separately the numb… --- ## [Supprimer champs envoyés par filebeat impossible?](https://discuss.elastic.co/t/supprimer-champs-envoyes-par-filebeat-impossible/41274)
**Author:** [@C\_H](https://discuss.elastic.co/u/C_H)\ **Replies:** 5\ **Last updated:** [February 10, 2016, 8:35am UTC](https://discuss.elastic.co/t/supprimer-champs-envoyes-par-filebeat-impossible/41274 "2016-02-10T08:35:11Z")
Bonjour, dans ma configuratoin LS (dont voici un extrait) je ne veux pas conserver certains champs envoyés par filebeat : if \[source\] =~ "backup\_restore" { if \[type\] == "crs" { # Generation du uuid pour re… --- ## [Logstash - .gz files - Error: Unexpected end of ZLIB input stream](https://discuss.elastic.co/t/logstash-gz-files-error-unexpected-end-of-zlib-input-stream/263028)
**Author:** [@sam281](https://discuss.elastic.co/u/sam281)\ **Replies:** 2\ **Last updated:** [June 16, 2022, 6:54pm UTC](https://discuss.elastic.co/t/logstash-gz-files-error-unexpected-end-of-zlib-input-stream/263028 "2022-06-16T18:54:57Z")
Hi, I am using logstash to read .gz files. The gzip files are around 10 to 15GB for which logstash was unable to process and crashing. So I have split the .gz files using 7zip split based on size of 3GB .gz file chunks.… --- ## [Logstash 特定データのみを抽出し、フィールドに複製したい](https://discuss.elastic.co/t/logstash/267943)
**Author:** [@Ryosuke.mm](https://discuss.elastic.co/u/Ryosuke.mm)\ **Replies:** 2\ **Last updated:** [March 23, 2021, 3:48am UTC](https://discuss.elastic.co/t/logstash/267943 "2021-03-23T03:48:45Z")
Logstashのfilterにて、条件を満たす配列の要素を抽出し、別の属性として複製したいです。 inputのデータ { "id" : 1, "custom\_fields" : \[ { "name" : "customField\_1", "id" : A, "value" : "TestValue1" }, { … --- ## [2 Availability Zones in cluster](https://discuss.elastic.co/t/2-availability-zones-in-cluster/150592)
**Author:** [@Itay\_Bittan](https://discuss.elastic.co/u/Itay_Bittan)\ **Replies:** 2\ **Last updated:** [October 9, 2018, 8:01am UTC](https://discuss.elastic.co/t/2-availability-zones-in-cluster/150592 "2018-10-09T08:01:41Z")
We have separate nodes for each role: 3 master nodes, 2 client nodes and 8 data nodes. Each node is EC2 instance in AWS. Nodes are equally distributed among two availability zones (for high availability purpose). Rece… --- ## [JournalBeat Logstash configuration](https://discuss.elastic.co/t/journalbeat-logstash-configuration/107427)
**Author:** [@moriol](https://discuss.elastic.co/u/moriol)\ **Replies:** 2\ **Last updated:** [November 22, 2017, 1:23pm UTC](https://discuss.elastic.co/t/journalbeat-logstash-configuration/107427 "2017-11-22T13:23:16Z")
I am trying to get the JournalBeat installed and working, so it can take my systemd logs and send them to ElasticSearch. I am running Centos 7.3. The steps I completed: I have downloaded the zip file file from https:/… --- ## [Filebeat and EC2 Tags](https://discuss.elastic.co/t/filebeat-and-ec2-tags/98737)
**Author:** [@StivOstenberg](https://discuss.elastic.co/u/StivOstenberg)\ **Replies:** 2\ **Last updated:** [August 29, 2017, 9:14pm UTC](https://discuss.elastic.co/t/filebeat-and-ec2-tags/98737 "2017-08-29T21:14:36Z")
Howdy; There is a processor called “add\_cloud\_metadata” that adds 5 EC2 metadata fields, but does not appear to grab the tags. Since that is where instances user defined data is defined, would be nice if it also pulled… --- ## [Error while creating an Index](https://discuss.elastic.co/t/error-while-creating-an-index/72799)
**Author:** [@kpandran](https://discuss.elastic.co/u/kpandran)\ **Replies:** 2\ **Last updated:** [January 25, 2017, 6:45pm UTC](https://discuss.elastic.co/t/error-while-creating-an-index/72799 "2017-01-25T18:45:15Z")
Hi All, I'm trying to create an index on dep\_iv.json file which is of : {"index":{"index":"rv","type":"dept","\_id":795079 } } {"RetailerGroup":"EuroBeauty","Retailer":8996,"Dept":"WOMEN FRAGRANCE","Error":0,"PPWeek"… --- ## [Why do I loose data?](https://discuss.elastic.co/t/why-do-i-loose-data/62707)
**Author:** [@Attila\_Nagy](https://discuss.elastic.co/u/Attila_Nagy)\ **Replies:** 2\ **Last updated:** [October 12, 2016, 7:19pm UTC](https://discuss.elastic.co/t/why-do-i-loose-data/62707 "2016-10-12T19:19:43Z")
I have set up a cluster from 20 nodes with several indexes and shards. Each shard has one or two replicas set. The cluster is quiet, in the means that it doesn't receive any queries. In this state, I start to kill node… --- ## [JAVA API Usage, Building SearchResponse object from JSON String](https://discuss.elastic.co/t/java-api-usage-building-searchresponse-object-from-json-string/1241)
**Author:** [@Kiran\_Sriharsha](https://discuss.elastic.co/u/Kiran_Sriharsha)\ **Replies:** 2\ **Last updated:** [June 11, 2015, 10:01pm UTC](https://discuss.elastic.co/t/java-api-usage-building-searchresponse-object-from-json-string/1241 "2015-06-11T22:01:10Z")
Hi I am using ES 1.1.1 and Java 1.7u5. Deployed a intermediate WAR that queries Elasticsearch in Amazon EC2 instance. The problem with this approach is the querying is working fine for some time and after that there is… --- ## [\[email\] when no name use login instead of None](https://discuss.elastic.co/t/email-when-no-name-use-login-instead-of-none/1798)
**Author:** [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Replies:** 2\ **Last updated:** [June 3, 2015, 7:35am UTC](https://discuss.elastic.co/t/email-when-no-name-use-login-instead-of-none/1798 "2015-06-03T07:35:20Z")
When a user did not set a full name the mail we get from him is from None. Could we have his login/username instead? --- ## [Elasticsearch output plugin throws error on sniffing =\> true as it makes the pool to empty](https://discuss.elastic.co/t/elasticsearch-output-plugin-throws-error-on-sniffing-true-as-it-makes-the-pool-to-empty/62205)
**Author:** [@Tarini\_Dash](https://discuss.elastic.co/u/Tarini_Dash)\ **Replies:** 1\ **Last updated:** [October 28, 2016, 6:16pm UTC](https://discuss.elastic.co/t/elasticsearch-output-plugin-throws-error-on-sniffing-true-as-it-makes-the-pool-to-empty/62205 "2016-10-28T18:16:28Z")
Product : logstash-5.0.0-beta1 With the folowing output configuration I get error when start a pipeline output { elasticsearch { hosts =\> \["x.x.x.x:9200","y.y.y.y:9200"\] sniffing =\> true } } when run as b… --- ## [Log stream intermittently fails to display messages](https://discuss.elastic.co/t/log-stream-intermittently-fails-to-display-messages/306272)
**Author:** [@Torin\_Stepan](https://discuss.elastic.co/u/Torin_Stepan)\ **Replies:** 2\ **Last updated:** [July 26, 2022, 10:30pm UTC](https://discuss.elastic.co/t/log-stream-intermittently-fails-to-display-messages/306272 "2022-07-26T22:30:26Z")
Hi, Using a deployment of Kibana v8.0 on the Elastic cloud, I'm aggregating logs from a few systems under a data view and viewing them in the stream page of the Logs app. This works fine at first, but when live streamin… --- ## [Filebeat's default index mapping causes Kibana to display many empty date fields](https://discuss.elastic.co/t/filebeats-default-index-mapping-causes-kibana-to-display-many-empty-date-fields/238324)
**Author:** [@temp4746](https://discuss.elastic.co/u/temp4746)\ **Replies:** 2\ **Last updated:** [June 23, 2020, 8:42pm UTC](https://discuss.elastic.co/t/filebeats-default-index-mapping-causes-kibana-to-display-many-empty-date-fields/238324 "2020-06-23T20:42:32Z")
I tried a default dev setup of the ELK stack with Filebeat reading from some Docker container outputting Elastic Common Schema JSON. It looks like the default index mapping that Filebeat sets up causes Kibana to show man… --- ## [Alerting for multiple login failed in 10 minutes](https://discuss.elastic.co/t/alerting-for-multiple-login-failed-in-10-minutes/180502)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 2\ **Last updated:** [May 13, 2019, 3:50am UTC](https://discuss.elastic.co/t/alerting-for-multiple-login-failed-in-10-minutes/180502 "2019-05-13T03:50:22Z")
If there is multiple login failed in 10 minutes, how can I create alerting for it. Thanks, Regards --- ## [Mocking the .net client](https://discuss.elastic.co/t/mocking-the-net-client/330147)
**Author:** [@samlane](https://discuss.elastic.co/u/samlane)\ **Replies:** 1\ **Last updated:** [April 26, 2023, 9:42am UTC](https://discuss.elastic.co/t/mocking-the-net-client/330147 "2023-04-26T09:42:23Z")
In 8.0 Release notes it mentions: " In order to support user testing scenarios, we have unsealed the ElasticsearchClient type and made its methods virtual. This supports mocking the type directly for unit testing." I h… --- ## [Loading large table from Mysql to ES via Logstash](https://discuss.elastic.co/t/loading-large-table-from-mysql-to-es-via-logstash/323442)
**Author:** [@Het\_Desai](https://discuss.elastic.co/u/Het_Desai)\ **Replies:** 7\ **Last updated:** [January 20, 2023, 7:07pm UTC](https://discuss.elastic.co/t/loading-large-table-from-mysql-to-es-via-logstash/323442 "2023-01-20T19:07:53Z")
Hello, I have multiple large tables (each table contains ~15M records and consumes ~70GB of data). My logstash configuration is as given below. input { jdbc { jdbc\_connection\_string =\> "jdbc:mysql:… --- ## [Split of JSON array into multiple events in Kibana](https://discuss.elastic.co/t/split-of-json-array-into-multiple-events-in-kibana/271018)
**Author:** [@pedro\_gonzalez](https://discuss.elastic.co/u/pedro_gonzalez)\ **Replies:** 7\ **Last updated:** [April 25, 2021, 5:55pm UTC](https://discuss.elastic.co/t/split-of-json-array-into-multiple-events-in-kibana/271018 "2021-04-25T17:55:28Z")
Hi, I am trying to split into different events (logs) this log schema: "\_index": "cocacola", "\_type": "raw", "\_id": "CqwJ63MBEQS11DmXsDyRZl", "\_score": 1, "\_source": { … --- ## [Noob index management - naming / cleanup](https://discuss.elastic.co/t/noob-index-management-naming-cleanup/148032)
**Author:** [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\ **Replies:** 7\ **Last updated:** [September 12, 2018, 10:10am UTC](https://discuss.elastic.co/t/noob-index-management-naming-cleanup/148032 "2018-09-12T10:10:52Z")
Ive setup a new beat-\>logstash-\>elastic system and have started collecting data from a number of sources (files, metrics, etc). Looking through the indexes available via Kibana Im seeing nearly a hundred entries marked '… --- ## [Comment logstash ignore les fichiers supprimés (plus existés)](https://discuss.elastic.co/t/comment-logstash-ignore-les-fichiers-supprimes-plus-existes/143167)
**Author:** [@alicia1](https://discuss.elastic.co/u/alicia1)\ **Replies:** 7\ **Last updated:** [August 10, 2018, 2:43pm UTC](https://discuss.elastic.co/t/comment-logstash-ignore-les-fichiers-supprimes-plus-existes/143167 "2018-08-10T14:43:25Z")
Bonjour, J'ai rencontré une erreur logstash ci-dessous lorsqu'un fichier déjà index n'existe plus dans le répertoire source. Car on supprime régulièrement les anciens fichiers de logs. Existe-il un moyen d'ignorer ce… --- ## [Date filter: Text Time zone names (z) cannot be parsed](https://discuss.elastic.co/t/date-filter-text-time-zone-names-z-cannot-be-parsed/88304)
**Author:** [@oraclept](https://discuss.elastic.co/u/oraclept)\ **Replies:** 1\ **Last updated:** [June 5, 2017, 5:36pm UTC](https://discuss.elastic.co/t/date-filter-text-time-zone-names-z-cannot-be-parsed/88304 "2017-06-05T17:36:26Z")
Hi - I am having a. May 30, 2017 10:13:48 PM EST date and time format. b. grokking with (?\\s?%{MONTH}\\s+%{MONTHDAY},\\s+%{YEAR}\\s?%{HOUR}:%{MINUTE}:%{SECOND}\\s+\[\[Aa\]|\[Pp\]\]\[Mm\]?\\s+%{TZ}) - Grok works perfect. c… --- ## [Consumption calculation](https://discuss.elastic.co/t/consumption-calculation/79682)
**Author:** [@karnamonkster](https://discuss.elastic.co/u/karnamonkster)\ **Replies:** 7\ **Last updated:** [March 26, 2017, 10:24am UTC](https://discuss.elastic.co/t/consumption-calculation/79682 "2017-03-26T10:24:13Z")
Hi, I am running a test environment with following: ES & Kibana:5.2.2 \* I imported 2 .csv files from different paths using logstash input \* I have created one index "meters" for both csv files. \* These contain metering s… --- ## [Ship logs to Logstash from public&private IP addresses](https://discuss.elastic.co/t/ship-logs-to-logstash-from-public-private-ip-addresses/44163)
**Author:** [@cazorla19](https://discuss.elastic.co/u/cazorla19)\ **Replies:** 1\ **Last updated:** [March 15, 2016, 6:32am UTC](https://discuss.elastic.co/t/ship-logs-to-logstash-from-public-private-ip-addresses/44163 "2016-03-15T06:32:48Z")
Hi. I'm trying to meet Logstash with all servers I have by Filebeat. The subject: some servers with private IP's (like 192.168.0.0/24) and some servers with public IP's (like 11.22.33.44). Personally Logstash is a privat… --- ## [Grok pattern for snort alerts](https://discuss.elastic.co/t/grok-pattern-for-snort-alerts/306625)
**Author:** [@anushka1203](https://discuss.elastic.co/u/anushka1203)\ **Replies:** 4\ **Last updated:** [June 9, 2022, 1:54pm UTC](https://discuss.elastic.co/t/grok-pattern-for-snort-alerts/306625 "2022-06-09T13:54:27Z")
HI everyone, Need help constructing grok pattern for the snort alert log file. I have the so far, but the output is incomplete - %{MONTHNUM:month}\\/%{MONTHDAY:day}-%{HOUR:hour}:%{MINUTE:minute}:%{SECOND:second}\\s+\\\[\\\*\\… --- ## [Label template for a link in a script field](https://discuss.elastic.co/t/label-template-for-a-link-in-a-script-field/282649)
**Author:** [@ippo](https://discuss.elastic.co/u/ippo)\ **Replies:** 4\ **Last updated:** [September 2, 2021, 8:04pm UTC](https://discuss.elastic.co/t/label-template-for-a-link-in-a-script-field/282649 "2021-09-02T20:04:07Z")
Hello guys , Since i use multiple fields to create my url my script field return the value of the link . is there any way to put a in label template an emoji :grinning: instead of just some text. ? Also when i click on… --- ## [Add custom information to Error Context](https://discuss.elastic.co/t/add-custom-information-to-error-context/263701)
**Author:** [@sadu](https://discuss.elastic.co/u/sadu)\ **Replies:** 4\ **Last updated:** [March 8, 2021, 1:31pm UTC](https://discuss.elastic.co/t/add-custom-information-to-error-context/263701 "2021-03-08T13:31:14Z")
Kibana version: 7.10.2 Elasticsearch version: 7.10.2 APM Server version: 1.17.0 APM Agent language and version: Java Browser version: Chrome 79.0.3945.117 Original install method (e.g. download page, yum, deb, fr… --- ## [RabbitMQ output is missing queue parameter](https://discuss.elastic.co/t/rabbitmq-output-is-missing-queue-parameter/129858)
**Author:** [@smetj](https://discuss.elastic.co/u/smetj)\ **Replies:** 4\ **Last updated:** [April 27, 2018, 10:31pm UTC](https://discuss.elastic.co/t/rabbitmq-output-is-missing-queue-parameter/129858 "2018-04-27T22:31:30Z")
Hi, The RabbitMQ output plugin is missing the queue parameter hence it can't create queues. This makes any serious RabbitMQ usage impossible. When writing to AMQP it should be possible to do 3 things: create exchang… --- ## [UI tool for elastic search 2.2](https://discuss.elastic.co/t/ui-tool-for-elastic-search-2-2/40882)
**Author:** [@ven2286](https://discuss.elastic.co/u/ven2286)\ **Replies:** 4\ **Last updated:** [February 5, 2016, 5:25am UTC](https://discuss.elastic.co/t/ui-tool-for-elastic-search-2-2/40882 "2016-02-05T05:25:05Z")
Can some body mention the UI tool for elastic search latest version? What ever tools i see so far is not working for elastic search latest versions, they are working for older versions of elastic search. --- ## [Правильное использование script в aggs](https://discuss.elastic.co/t/script-aggs/37576)
**Author:** [@11116](https://discuss.elastic.co/u/11116)\ **Replies:** 4\ **Last updated:** [December 23, 2015, 7:45am UTC](https://discuss.elastic.co/t/script-aggs/37576 "2015-12-23T07:45:42Z")
Добрый день! Из индекса нужно выделить количество пользовательских сессий с различными ошибками. Для этого используется такого вида запрос: "aggs": { "ERBL": { "cardinality": { … --- ## [Is a restart required to see new log files matching glob?](https://discuss.elastic.co/t/is-a-restart-required-to-see-new-log-files-matching-glob/33192)
**Author:** [@bryan](https://discuss.elastic.co/u/bryan)\ **Replies:** 4\ **Last updated:** [October 29, 2015, 7:53am UTC](https://discuss.elastic.co/t/is-a-restart-required-to-see-new-log-files-matching-glob/33192 "2015-10-29T07:53:16Z")
If I use, e.g., '/var/logs/\*.log' as a prospector path, and only 'a.log' and 'b.log' exist at startup, is a restart required to begin harvesting a new file 'c.log'? IOW, will the system periodically re-run the search a… --- ## [Endpoint Security Not Working](https://discuss.elastic.co/t/endpoint-security-not-working/304755)
**Author:** [@Reda-BELHAJ](https://discuss.elastic.co/u/Reda-BELHAJ)\ **Replies:** 3\ **Last updated:** [June 1, 2022, 4:31pm UTC](https://discuss.elastic.co/t/endpoint-security-not-working/304755 "2022-06-01T16:31:06Z")
Hey everyone, I am using an agent that have a personalised policy with: Endpoint Security Windows System And my issue is when I test a malicious behavior (with MITRE ATT&CK Techniques) I can't see the alerts and in m… --- ## [\[0\] "\_jsonparsefailure" how do you remove this?](https://discuss.elastic.co/t/0-jsonparsefailure-how-do-you-remove-this/298225)
**Author:** [@itschobot](https://discuss.elastic.co/u/itschobot)\ **Replies:** 3\ **Last updated:** [February 26, 2022, 3:41am UTC](https://discuss.elastic.co/t/0-jsonparsefailure-how-do-you-remove-this/298225 "2022-02-26T03:41:51Z")
how do you get rid of the \[0\] "\_jsonparsefailure? { "origin" =\> "some\_platform", "ls-source" =\> "some\_platform", "port" =\> 1234, "event" =\> { … --- ## [Beats privileges documentation](https://discuss.elastic.co/t/beats-privileges-documentation/214190)
**Author:** [@jsu](https://discuss.elastic.co/u/jsu)\ **Replies:** 8\ **Last updated:** [February 4, 2020, 1:00pm UTC](https://discuss.elastic.co/t/beats-privileges-documentation/214190 "2020-02-04T13:00:11Z")
Hi there, I had a problem that I managed to resolve but it seems then that the documentation isn't completely accurate. Let me know if I should post this somewhere else. So, when configuring Beats agents to send data t… --- ## [Finding why long GCs occur and fixing efficiency issues in Elastic Cluster](https://discuss.elastic.co/t/finding-why-long-gcs-occur-and-fixing-efficiency-issues-in-elastic-cluster/162377)
**Author:** [@Alexandre\_Juma](https://discuss.elastic.co/u/Alexandre_Juma)\ **Replies:** 3\ **Last updated:** [December 28, 2018, 10:09pm UTC](https://discuss.elastic.co/t/finding-why-long-gcs-occur-and-fixing-efficiency-issues-in-elastic-cluster/162377 "2018-12-28T22:09:22Z")
Hi all, I'm trying to figure out why some of my elasticsearch cluster data nodes have frequent long GC Pauses, which in one month can actually cause around 1 or 2 daily Green -\> Red State Changes due to "failed to ping"… [Previous page](https://discuss.elastic.co/top.md?page=1099&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1101&per_page=50&period=all)