# Top **URL:** https://discuss.elastic.co/top.md?page=1102&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1103 --- ## [Elasticsearch - nested field with geo\_point type returns unsupported symbol in search](https://discuss.elastic.co/t/elasticsearch-nested-field-with-geo-point-type-returns-unsupported-symbol-in-search/304415)
**Author:** [@Pazhaniyappan](https://discuss.elastic.co/u/Pazhaniyappan)\ **Replies:** 7\ **Last updated:** [May 20, 2022, 5:14am UTC](https://discuss.elastic.co/t/elasticsearch-nested-field-with-geo-point-type-returns-unsupported-symbol-in-search/304415 "2022-05-20T05:14:13Z")
Mapping for the index: PUT /my\_locations { "mappings": { "properties": { "pin": { "type":"nested", "properties": { "location": { "type": "geo\_point" } … --- ## [This action would add \[2\] total shards, but this cluster currently has \[2000\]/\[2000\] maximum shards open;](https://discuss.elastic.co/t/this-action-would-add-2-total-shards-but-this-cluster-currently-has-2000-2000-maximum-shards-open/248255)
**Author:** [@Maricar\_Laygo](https://discuss.elastic.co/u/Maricar_Laygo)\ **Replies:** 1\ **Last updated:** [September 11, 2020, 5:12am UTC](https://discuss.elastic.co/t/this-action-would-add-2-total-shards-but-this-cluster-currently-has-2000-2000-maximum-shards-open/248255 "2020-09-11T05:12:05Z")
Invalid Bulk items: operation\[0\]: index returned 400 \_index: transactions-es-nfnxl530-20200911 \_type: \_doc \_id: 909090892 \_version: 0 error: Type: validation\_exception Reason: Validation Failed: 1: this action would add … --- ## [Send Kibana Dashboard screenshots in HTML email](https://discuss.elastic.co/t/send-kibana-dashboard-screenshots-in-html-email/238534)
**Author:** [@Lakshmy\_S](https://discuss.elastic.co/u/Lakshmy_S)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 9:15pm UTC](https://discuss.elastic.co/t/send-kibana-dashboard-screenshots-in-html-email/238534 "2020-06-24T21:15:20Z")
I have an use case which is to have a watcher check for RED/AMBER metrics in Kibana and it should automatically send a screenshot of the kibana dashboard via html email. In a nutshell the html email should have nice loo… --- ## [Is there good Kibana dashboard for web access log?](https://discuss.elastic.co/t/is-there-good-kibana-dashboard-for-web-access-log/232900)
**Author:** [@Slavik\_Fursov](https://discuss.elastic.co/u/Slavik_Fursov)\ **Replies:** 1\ **Last updated:** [May 18, 2020, 4:30pm UTC](https://discuss.elastic.co/t/is-there-good-kibana-dashboard-for-web-access-log/232900 "2020-05-18T16:30:13Z")
I'm collecting Nginx access logs from few websites. Looks like Kibana has Nginx dashboard, but it's for metrics. Is there any web analytics dashboard for web access logs? I see the screenshot of dashboard called "\[Log… --- ## [Kibana Reporting exceeds 10 MB](https://discuss.elastic.co/t/kibana-reporting-exceeds-10-mb/165725)
**Author:** [@iamaakashgoyal](https://discuss.elastic.co/u/iamaakashgoyal)\ **Replies:** 1\ **Last updated:** [January 25, 2019, 6:09pm UTC](https://discuss.elastic.co/t/kibana-reporting-exceeds-10-mb/165725 "2019-01-25T18:09:22Z")
The kibana reporting feature produces a partial report for size greater than 10 MB. Do increase the size for this we need to explicitly specify the size in kibana,yml using xpack.reporting.csv.maxSizeByte: value so do … --- ## [Unable to connect to elasticsearch with x-pack](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-with-x-pack/165639)
**Author:** [@ashalabh](https://discuss.elastic.co/u/ashalabh)\ **Replies:** 1\ **Last updated:** [January 24, 2019, 9:41pm UTC](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-with-x-pack/165639 "2019-01-24T21:41:31Z")
Sending Logstash logs to /home/elastic/logstash/logs which is now configured via log4j2.properties \[2019-01-24T12:50:23,035\]\[WARN \]\[logstash.config.source.multilocal\] Ignoring the 'pipelines.yml' file because modules or… --- ## [Elasticsearch2.1.0.0 plugin not work](https://discuss.elastic.co/t/elasticsearch2-1-0-0-plugin-not-work/36702)
**Author:** [@miracle24](https://discuss.elastic.co/u/miracle24)\ **Replies:** 7\ **Last updated:** [December 10, 2015, 9:11am UTC](https://discuss.elastic.co/t/elasticsearch2-1-0-0-plugin-not-work/36702 "2015-12-10T09:11:01Z")
I want to use the 'delete-by-query' plugin.After installing the plugin, I had this query and got the result which I do not expect: query:curl -XDELETE 'localhost:9200/world/city/\_query?q=Name:2323' unexpected result:… --- ## [Logstash File input plugin not working Windows 10](https://discuss.elastic.co/t/logstash-file-input-plugin-not-working-windows-10/208312)
**Author:** [@Sudheesh\_P](https://discuss.elastic.co/u/Sudheesh_P)\ **Replies:** 2\ **Last updated:** [November 19, 2019, 3:39am UTC](https://discuss.elastic.co/t/logstash-file-input-plugin-not-working-windows-10/208312 "2019-11-19T03:39:25Z")
Hi, I am using Logstash File input plugin for debugging purposes. Currently I migrated to latest Logstash version 7.4.2. But the existing logstash configuration unable to read file from the disk. I am using Windows 10. … --- ## [Can I get the current path of file being processed by Logstash file input when searching through subdirectories?](https://discuss.elastic.co/t/can-i-get-the-current-path-of-file-being-processed-by-logstash-file-input-when-searching-through-subdirectories/125046)
**Author:** [@daved](https://discuss.elastic.co/u/daved)\ **Replies:** 2\ **Last updated:** [March 22, 2018, 4:42pm UTC](https://discuss.elastic.co/t/can-i-get-the-current-path-of-file-being-processed-by-logstash-file-input-when-searching-through-subdirectories/125046 "2018-03-22T16:42:44Z")
Hey, I'm wondering if there is anyway to tell what subdirectory/path to file is currently getting processed by Logstash when using the file input to look through a directory tree? From what I understand I could parse m… --- ## [Unable to register watcher](https://discuss.elastic.co/t/unable-to-register-watcher/1443)
**Author:** [@Priyanku\_konar](https://discuss.elastic.co/u/Priyanku_konar)\ **Replies:** 2\ **Last updated:** [May 28, 2015, 11:03pm UTC](https://discuss.elastic.co/t/unable-to-register-watcher/1443 "2015-05-28T23:03:34Z")
Continuing the discussion from Issue with Watcher: I am having issues in registering the watcher based on the getting started demo under Watch Log Data for Errors | Elasticsearch Watcher \[2.4\] | Elastic below is the e… --- ## [Wildcard queries and case (in)sensitivity](https://discuss.elastic.co/t/wildcard-queries-and-case-in-sensitivity/9014)
**Author:** [@LittleGrimmy](https://discuss.elastic.co/u/LittleGrimmy)\ **Replies:** 2\ **Last updated:** [September 14, 2012, 3:05pm UTC](https://discuss.elastic.co/t/wildcard-queries-and-case-in-sensitivity/9014 "2012-09-14T15:05:29Z")
Hi! I'm in the process of indexing a couple of millions of documents, and the requirements for the search are: \* Be able to search for documents in a case-insensitive way \* Be able to search for documents in a c… --- ## [Error about too many open files when allocating shard](https://discuss.elastic.co/t/error-about-too-many-open-files-when-allocating-shard/128055)
**Author:** [@Warren\_Turner](https://discuss.elastic.co/u/Warren_Turner)\ **Replies:** 5\ **Last updated:** [April 16, 2018, 6:11pm UTC](https://discuss.elastic.co/t/error-about-too-many-open-files-when-allocating-shard/128055 "2018-04-16T18:11:14Z")
I opened a closed index with 5 shards. All of the shards allocated fine except 1. When I check the logs I see an error about too many open files. \[WARN \]\[o.e.c.a.s.ShardStateAction\] \[bos1-es2\] \[px-web-server-2018.03.0… --- ## [How to make String Field to Non Analyzed?](https://discuss.elastic.co/t/how-to-make-string-field-to-non-analyzed/79809)
**Author:** [@venkat\_venkat](https://discuss.elastic.co/u/venkat_venkat)\ **Replies:** 5\ **Last updated:** [March 27, 2017, 5:56pm UTC](https://discuss.elastic.co/t/how-to-make-string-field-to-non-analyzed/79809 "2017-03-27T17:56:27Z")
I am trying to Make String Field Analyzed to non-analyzed. But I am unable to make the string field the non-analyzed. My String field Hostname look like "q-gp2-qadebug-1". Please help me out how to make it non-analyzed. … --- ## [Why changing logstash filter config caused i/o timeout event](https://discuss.elastic.co/t/why-changing-logstash-filter-config-caused-i-o-timeout-event/109286)
**Author:** [@Yuri\_Sibirski](https://discuss.elastic.co/u/Yuri_Sibirski)\ **Replies:** 6\ **Last updated:** [December 21, 2017, 5:36pm UTC](https://discuss.elastic.co/t/why-changing-logstash-filter-config-caused-i-o-timeout-event/109286 "2017-12-21T17:36:44Z")
Hi there, i am really confused why changing my 10-syslog-filter.conf file caused i/o timeout event on all the clients and no data was saved. Initial config is: filter { if \[type\] == "syslog" { grok { match =\>… --- ## [Error fetching data for metricset windows.service: The data is invalid](https://discuss.elastic.co/t/error-fetching-data-for-metricset-windows-service-the-data-is-invalid/222079)
**Author:** [@adrianbumbas](https://discuss.elastic.co/u/adrianbumbas)\ **Replies:** 4\ **Last updated:** [March 18, 2020, 11:53am UTC](https://discuss.elastic.co/t/error-fetching-data-for-metricset-windows-service-the-data-is-invalid/222079 "2020-03-18T11:53:29Z")
Hello I'm trying to get Windows metrics using Metricbeat 7.6.0 and all I get in the logs is this message: Error fetching data for metricset windows.service: The data is invalid. The user under which I'm running Metric… --- ## [Allocator information](https://discuss.elastic.co/t/allocator-information/152872)
**Author:** [@phr0gz](https://discuss.elastic.co/u/phr0gz)\ **Replies:** 4\ **Last updated:** [October 22, 2018, 12:49pm UTC](https://discuss.elastic.co/t/allocator-information/152872 "2018-10-22T12:49:09Z")
Hello, we are currently using a simple hardware architecture: 1:VM = 1:Node and my company is looking about the best subscription program. And of course ECE is on the table. I've few questions despite the available docu… --- ## [Filebeat hint based autodiscovery not working](https://discuss.elastic.co/t/filebeat-hint-based-autodiscovery-not-working/144985)
**Author:** [@Alex\_Scoble](https://discuss.elastic.co/u/Alex_Scoble)\ **Replies:** 4\ **Last updated:** [August 21, 2018, 5:59am UTC](https://discuss.elastic.co/t/filebeat-hint-based-autodiscovery-not-working/144985 "2018-08-21T05:59:56Z")
I have filebeat 6.3.2 installed in kubernetes cluster as daemonset. Configs are at https://gist.github.com/ITBlogger/f50632d643ec4cb241bdd41355b295ba#file-filebeat-configmaps and deployment snippet is at https://gist.gi… --- ## [Index update strategy](https://discuss.elastic.co/t/index-update-strategy/58653)
**Author:** [@buinauskas\_evaldas](https://discuss.elastic.co/u/buinauskas_evaldas)\ **Replies:** 4\ **Last updated:** [August 23, 2016, 9:28am UTC](https://discuss.elastic.co/t/index-update-strategy/58653 "2016-08-23T09:28:03Z")
I'm looking for an advice for index update strategy. I'd like to import data from SQL Server to Elasticsearch in batches. Let's assume we have data in this format in SQL: ProjectID ProductID -----------------------… --- ## [Highlight not always shown](https://discuss.elastic.co/t/highlight-not-always-shown/3802)
**Author:** [@max](https://discuss.elastic.co/u/max)\ **Replies:** 4\ **Last updated:** [January 21, 2011, 10:21am UTC](https://discuss.elastic.co/t/highlight-not-always-shown/3802 "2011-01-21T10:21:05Z")
Hi, we are using elasticsearch for indexing a lot of html-documents (right now around 90k, indexsize is around 2GB). everything is great, we love elasticsearch! but we noticed one thing we cannot understand. we u… --- ## [Mapping error: Please use a keyword field instead](https://discuss.elastic.co/t/mapping-error-please-use-a-keyword-field-instead/299240)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [March 9, 2022, 9:47pm UTC](https://discuss.elastic.co/t/mapping-error-please-use-a-keyword-field-instead/299240 "2022-03-09T21:47:00Z")
Hi, Im getting data from Azure with metricbeat, and also getting additional data from event hub. the data from metricbeat and Event Hub is shown in the same dashboard. In order to filter with a control visualization i… --- ## [Java api index request](https://discuss.elastic.co/t/java-api-index-request/143166)
**Author:** [@ritwikkaul](https://discuss.elastic.co/u/ritwikkaul)\ **Replies:** 1\ **Last updated:** [August 6, 2018, 12:41pm UTC](https://discuss.elastic.co/t/java-api-index-request/143166 "2018-08-06T12:41:04Z")
Hi, I am using IndexRequest to send data to an elasticsearch index. I had recently set up XPACK on my ES cluster. So now sending data to the index causes an authentication error. Could anyone please guide me as to how … --- ## [How to show the beat.hostname in watcher notificaiton](https://discuss.elastic.co/t/how-to-show-the-beat-hostname-in-watcher-notificaiton/86477)
**Author:** [@Balaram](https://discuss.elastic.co/u/Balaram)\ **Replies:** 1\ **Last updated:** [May 22, 2017, 6:42am UTC](https://discuss.elastic.co/t/how-to-show-the-beat-hostname-in-watcher-notificaiton/86477 "2017-05-22T06:42:05Z")
Hi, I am trying to create a watch for monitoring the system metrics ( for e.g load, Memory or disk usage) and send notifications when certain threshold is breached along with the beatname details. Currently have the be… --- ## [Error Handling in Logstash](https://discuss.elastic.co/t/error-handling-in-logstash/54179)
**Author:** [@Achilles](https://discuss.elastic.co/u/Achilles)\ **Replies:** 1\ **Last updated:** [June 29, 2016, 6:58am UTC](https://discuss.elastic.co/t/error-handling-in-logstash/54179 "2016-06-29T06:58:20Z")
Hi team, I am a newbie and I am using ELK as a reporting engine for the data from csv exported files. I am currently using 2.3.2 version of logstash to load csv data from a remote server through file beat. Since m… --- ## [How to create dashboard for tomcat using metricbeat?](https://discuss.elastic.co/t/how-to-create-dashboard-for-tomcat-using-metricbeat/148812)
**Author:** [@Aftab\_Ali](https://discuss.elastic.co/u/Aftab_Ali)\ **Replies:** 2\ **Last updated:** [September 18, 2018, 5:24am UTC](https://discuss.elastic.co/t/how-to-create-dashboard-for-tomcat-using-metricbeat/148812 "2018-09-18T05:24:14Z")
Dear Team, We have lots of module web-server like Apache, nginx and more but i am looking for tomcat and i want to view Tomcat up-time, CPU, JVM memory, Threads Status, online number of connection, how this is possible … --- ## [FileBeat Output to Solr](https://discuss.elastic.co/t/filebeat-output-to-solr/86450)
**Author:** [@Raja.Rangineni](https://discuss.elastic.co/u/Raja.Rangineni)\ **Replies:** 2\ **Last updated:** [May 22, 2017, 5:39pm UTC](https://discuss.elastic.co/t/filebeat-output-to-solr/86450 "2017-05-22T17:39:05Z")
Hi Filebeat Community, I have requirement to use Filebeat to collect logs and push them into Solr(SolrCloud cluster) directly as the client doesn't want use any management/enrichment layer like LogStash in the pipeline… --- ## [Where are mappings for indices stored?](https://discuss.elastic.co/t/where-are-mappings-for-indices-stored/3755)
**Author:** [@didier\_deshommes](https://discuss.elastic.co/u/didier_deshommes)\ **Replies:** 2\ **Last updated:** [January 11, 2011, 6:53pm UTC](https://discuss.elastic.co/t/where-are-mappings-for-indices-stored/3755 "2011-01-11T18:53:21Z")
Hi, I would like to be able to store mappings for my indices in a json/yml file, so that whenever I add a document to the index, I don't have to specify a mapping via the put\_mapping api call. The documentation seems… --- ## [\[Follow up github\] GET / give me 401, and Basic realm="undefined"](https://discuss.elastic.co/t/follow-up-github-get-give-me-401-and-basic-realm-undefined/2086)
**Author:** [@mandark](https://discuss.elastic.co/u/mandark)\ **Replies:** 0\ **Last updated:** [June 7, 2015, 11:24am UTC](https://discuss.elastic.co/t/follow-up-github-get-give-me-401-and-basic-realm-undefined/2086 "2015-06-07T11:24:15Z")
This is a follow-up from the issue 3974. TL;DR: On a freshly installed Kibana with no proxy here's what I get : $ curl -i 127.0.0.1:5601 HTTP/1.1 401 Unauthorized More info on github, with straces / netstat / curl… --- ## [What is Auditbeat audit syntax to exclude a process or path?](https://discuss.elastic.co/t/what-is-auditbeat-audit-syntax-to-exclude-a-process-or-path/295117)
**Author:** [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Replies:** 1\ **Last updated:** [January 22, 2022, 7:54pm UTC](https://discuss.elastic.co/t/what-is-auditbeat-audit-syntax-to-exclude-a-process-or-path/295117 "2022-01-22T19:54:56Z")
I have Auditbeat running with a bunch of CIS benchmark proposed auditd rules. One of my processes generates a bunch of false positive "time change" logs that I would like to filter out. audit: type=1300 audit(1642859012.… --- ## [Java High Level REST Client - order of fields in document during saving and retrieval](https://discuss.elastic.co/t/java-high-level-rest-client-order-of-fields-in-document-during-saving-and-retrieval/217621)
**Author:** [@jb79](https://discuss.elastic.co/u/jb79)\ **Replies:** 7\ **Last updated:** [February 16, 2020, 10:04pm UTC](https://discuss.elastic.co/t/java-high-level-rest-client-order-of-fields-in-document-during-saving-and-retrieval/217621 "2020-02-16T22:04:16Z")
Is the order of the saved document structure guaranteed in elasticsearch? Currently I see that it is, but I don't know if it's because of some default value of some option in the es-rest-client - generally I'd like to … --- ## [How does Elastic's term index work?](https://discuss.elastic.co/t/how-does-elastics-term-index-work/204062)
**Author:** [@nico127](https://discuss.elastic.co/u/nico127)\ **Replies:** 7\ **Last updated:** [October 18, 2019, 2:36pm UTC](https://discuss.elastic.co/t/how-does-elastics-term-index-work/204062 "2019-10-18T14:36:21Z")
Hello folks, I'm currently trying to improve the performance of an Elastic cluster, which isn't easy because I'm no expert. The cluster is made of 6 data nodes and 3 master nodes, the 6 data nodes having 64G of memory (~… --- ## [Elasticsearch Failure node lock error](https://discuss.elastic.co/t/elasticsearch-failure-node-lock-error/188015)
**Author:** [@Xelrod](https://discuss.elastic.co/u/Xelrod)\ **Replies:** 1\ **Last updated:** [June 28, 2019, 11:15am UTC](https://discuss.elastic.co/t/elasticsearch-failure-node-lock-error/188015 "2019-06-28T11:15:43Z")
Hi, I've changed the data path to a shared folder under /mnt/share/elasticsearch. And moved the elasticsearch folder there. When I try to start elasticsearch I get the following error. Caused by: java.nio.file.AccessDe… --- ## [Can have empty properties mapping?](https://discuss.elastic.co/t/can-have-empty-properties-mapping/70288)
**Author:** [@Maxwell\_Flanders](https://discuss.elastic.co/u/Maxwell_Flanders)\ **Replies:** 1\ **Last updated:** [December 30, 2016, 6:21pm UTC](https://discuss.elastic.co/t/can-have-empty-properties-mapping/70288 "2016-12-30T18:21:06Z")
I only want to pre-define a field as an object datatype, but i do not know what fields will go in it, they will be added later by various bits of a logstash kv filter. Can i define it like so without errors?? "my-field… --- ## [Logstash grok pattern - optional fields](https://discuss.elastic.co/t/logstash-grok-pattern-optional-fields/68880)
**Author:** [@txisme](https://discuss.elastic.co/u/txisme)\ **Replies:** 1\ **Last updated:** [December 13, 2016, 2:39pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-optional-fields/68880 "2016-12-13T14:39:33Z")
Hey, im using Logstash 2.4 and i need to process log files so i am using grok patterns. I am having trouble with optional fields, i have several logs wich can have or not have a specific field, in this case "correlation… --- ## [Connecting elastic search with microsoft fabric](https://discuss.elastic.co/t/connecting-elastic-search-with-microsoft-fabric/335000)
**Author:** [@waqar\_jamali](https://discuss.elastic.co/u/waqar_jamali)\ **Replies:** 3\ **Last updated:** [June 1, 2023, 3:04pm UTC](https://discuss.elastic.co/t/connecting-elastic-search-with-microsoft-fabric/335000 "2023-06-01T15:04:19Z")
Microsoft has released fabric for data analysis. It can connect to many types and sources of data How to connect elasticsearch data to microsoft fabric? --- ## [ElasticSearch C# Nested List Filter Not Working when i compare array using 7.5.1](https://discuss.elastic.co/t/elasticsearch-c-nested-list-filter-not-working-when-i-compare-array-using-7-5-1/246052)
**Author:** [@kotishwerreddy](https://discuss.elastic.co/u/kotishwerreddy)\ **Replies:** 3\ **Last updated:** [August 24, 2020, 6:46am UTC](https://discuss.elastic.co/t/elasticsearch-c-nested-list-filter-not-working-when-i-compare-array-using-7-5-1/246052 "2020-08-24T06:46:35Z")
Hello Every one, i'm using Elasticsearch 7.5.1 with .Net core 3.1, in that i'm want to search using country filters in the nested object (list detail object), but when i trying to filter i'm unable to filter returning… --- ## [Kibana Security in conjunction with nginx](https://discuss.elastic.co/t/kibana-security-in-conjunction-with-nginx/184828)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 3\ **Last updated:** [June 11, 2019, 3:15am UTC](https://discuss.elastic.co/t/kibana-security-in-conjunction-with-nginx/184828 "2019-06-11T03:15:07Z")
I've been trying to setup security so I've enabled xpack and the p12 certificate on elasticsearch elasticsearch.yml xpack.security.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.transport.ss… --- ## [Option List host.name not all values](https://discuss.elastic.co/t/option-list-host-name-not-all-values/171762)
**Author:** [@jeckgit](https://discuss.elastic.co/u/jeckgit)\ **Replies:** 3\ **Last updated:** [March 19, 2019, 7:37pm UTC](https://discuss.elastic.co/t/option-list-host-name-not-all-values/171762 "2019-03-19T19:37:03Z")
I don't get all the host names in the optionlist, which were sent via filebeat to elasticsearch. You will see what I mean in the Screenshots: In the second screen you can see, that there are obviously more than 3 h… --- ## [How to build a docker image with kibana-docker and the kibana source code](https://discuss.elastic.co/t/how-to-build-a-docker-image-with-kibana-docker-and-the-kibana-source-code/123005)
**Author:** [@596375269](https://discuss.elastic.co/u/596375269)\ **Replies:** 3\ **Last updated:** [March 8, 2018, 6:30pm UTC](https://discuss.elastic.co/t/how-to-build-a-docker-image-with-kibana-docker-and-the-kibana-source-code/123005 "2018-03-08T18:30:38Z")
Hello. I noticed there are two repos in github for kibana. I think the second repository are used to build docker mirrors from the first repository. How should I build the image? Thanks --- ## [Timelion: Making expression independent of field values (Use of condition() and first())](https://discuss.elastic.co/t/timelion-making-expression-independent-of-field-values-use-of-condition-and-first/79402)
**Author:** [@Jay\_Joshi](https://discuss.elastic.co/u/Jay_Joshi)\ **Replies:** 3\ **Last updated:** [March 22, 2017, 5:44pm UTC](https://discuss.elastic.co/t/timelion-making-expression-independent-of-field-values-use-of-condition-and-first/79402 "2017-03-22T17:44:43Z")
Hi, Fields of my index in which I'm interested in are method and status, both are of type string. method can take from dozens of different values. status can be "success", "pending" or "failure". I want to plot succe… --- ## [How to ignore a specific IP?](https://discuss.elastic.co/t/how-to-ignore-a-specific-ip/75097)
**Author:** [@Ben\_Hoffman](https://discuss.elastic.co/u/Ben_Hoffman)\ **Replies:** 3\ **Last updated:** [February 16, 2017, 5:03pm UTC](https://discuss.elastic.co/t/how-to-ignore-a-specific-ip/75097 "2017-02-16T17:03:14Z")
So I am doing a data visualization of netflow traffic, and I am running packetbeat in "af mode" to gather all of the netflow data. The problem is that the IP that I am connecting to the box with packetbeat on it, is s… --- ## [Use Curator to delete indices before a specific date](https://discuss.elastic.co/t/use-curator-to-delete-indices-before-a-specific-date/58661)
**Author:** [@Jeremy\_Lecour](https://discuss.elastic.co/u/Jeremy_Lecour)\ **Replies:** 3\ **Last updated:** [August 24, 2016, 9:12am UTC](https://discuss.elastic.co/t/use-curator-to-delete-indices-before-a-specific-date/58661 "2016-08-24T09:12:10Z")
Hi, I've easily found how to delete indices older than X days, but I'd like to delete indices before a specific date. Should I use "epoch" in the "age" filter ? Thanks --- ## [Grokparsefailure with NXlog and Logstash](https://discuss.elastic.co/t/grokparsefailure-with-nxlog-and-logstash/36210)
**Author:** [@Sandeep\_Krishnankutt](https://discuss.elastic.co/u/Sandeep_Krishnankutt)\ **Replies:** 3\ **Last updated:** [June 21, 2016, 1:36pm UTC](https://discuss.elastic.co/t/grokparsefailure-with-nxlog-and-logstash/36210 "2016-06-21T13:36:34Z")
I seem to have a strange(or not) issue with logstash where I am seeing random grokparsefailure. I am using NXLog to ship IIS logs from 5 of my webservers to Logstash. The NXlog config is as below Module xm\_json … --- ## [How to compare the cost of Search Request](https://discuss.elastic.co/t/how-to-compare-the-cost-of-search-request/228881)
**Author:** [@jeffzhao](https://discuss.elastic.co/u/jeffzhao)\ **Replies:** 2\ **Last updated:** [April 26, 2020, 4:19pm UTC](https://discuss.elastic.co/t/how-to-compare-the-cost-of-search-request/228881 "2020-04-26T16:19:57Z")
Hi, I want to optimize index settings, for example, customized \_routing parameter, to see if it can improve search performance. The problem is Elasticsearch always cache the query result, so when I run the search for th… --- ## [How to restart an Elasticsearch cluster (2 master node, 2 data node, 1 voting-only master-eligible node) after a 1 master node and 1 data node failed due to hardware failure without losing data?](https://discuss.elastic.co/t/how-to-restart-an-elasticsearch-cluster-2-master-node-2-data-node-1-voting-only-master-eligible-node-after-a-1-master-node-and-1-data-node-failed-due-to-hardware-failure-without-losing-data/345027)
**Author:** [@ThuyNguyen](https://discuss.elastic.co/u/ThuyNguyen)\ **Replies:** 5\ **Last updated:** [October 17, 2023, 3:36am UTC](https://discuss.elastic.co/t/how-to-restart-an-elasticsearch-cluster-2-master-node-2-data-node-1-voting-only-master-eligible-node-after-a-1-master-node-and-1-data-node-failed-due-to-hardware-failure-without-losing-data/345027 "2023-10-17T03:36:05Z")
Hi team, I have an Elasticsearch cluster which is setup across 3 servers through docker. Here is the configuration that I used: server 1: 1 voting-only master server 2: 1 master node, 1 data node, and snapshot server … --- ## [Taking too much time to index](https://discuss.elastic.co/t/taking-too-much-time-to-index/87918)
**Author:** [@munotshubham](https://discuss.elastic.co/u/munotshubham)\ **Replies:** 5\ **Last updated:** [June 2, 2017, 1:33am UTC](https://discuss.elastic.co/t/taking-too-much-time-to-index/87918 "2017-06-02T01:33:27Z")
So I'm trying to index a DB with 91 columns and around 300,000 rows. It is in a CSV file and I'm using logstash to load it in ES. It's been running since 20 hours, it still hasn't been indexed. For test purposes I had … --- ## [\`ignore\` in index creation](https://discuss.elastic.co/t/ignore-in-index-creation/84078)
**Author:** [@Bhargavi\_Sri](https://discuss.elastic.co/u/Bhargavi_Sri)\ **Replies:** 5\ **Last updated:** [April 29, 2017, 11:17am UTC](https://discuss.elastic.co/t/ignore-in-index-creation/84078 "2017-04-29T11:17:41Z")
I have the following statement: es.indices.create(index=index\_name,ignore=\[400,404\]) In a sample program that I created, the index got created again though it was already existing on the cluster. So what exactly does… --- ## [Is it possible to make arithmetic operation on kibana dashboard?](https://discuss.elastic.co/t/is-it-possible-to-make-arithmetic-operation-on-kibana-dashboard/330033)
**Author:** [@FTOR](https://discuss.elastic.co/u/FTOR)\ **Replies:** 4\ **Last updated:** [April 18, 2023, 11:16am UTC](https://discuss.elastic.co/t/is-it-possible-to-make-arithmetic-operation-on-kibana-dashboard/330033 "2023-04-18T11:16:42Z")
I would like to visualise the average of a processing time of a file according to its size over time. I receive the fields as follows: start\_date end\_date length So I need to calculate length / (end\_date - start\_dat… --- ## [Elasticsearch won’t start after upgrade to 8.4.1](https://discuss.elastic.co/t/elasticsearch-won-t-start-after-upgrade-to-8-4-1/314583)
**Author:** [@Ubuxa](https://discuss.elastic.co/u/Ubuxa)\ **Replies:** 4\ **Last updated:** [September 17, 2022, 2:12am UTC](https://discuss.elastic.co/t/elasticsearch-won-t-start-after-upgrade-to-8-4-1/314583 "2022-09-17T02:12:40Z")
Similar issue, but this ticket has since been closed: I upgraded Elasticsearch from 7.17.5 to 8.4.1, and unfortunately I did not check for any incompatibilities. I am now unable to start Elasticsearch, and downgrading … --- ## [Elastic detections and case sensitivity](https://discuss.elastic.co/t/elastic-detections-and-case-sensitivity/256788)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 4\ **Last updated:** [December 1, 2020, 8:31pm UTC](https://discuss.elastic.co/t/elastic-detections-and-case-sensitivity/256788 "2020-12-01T20:31:10Z")
We use logstash to lowercase most fields used in detections. I was hoping the new wildcard field type would get around the issue of case-insensitivity in the detections rules (not including EQL) Any recommendations or i… --- ## [If statement not working with gsub](https://discuss.elastic.co/t/if-statement-not-working-with-gsub/215030)
**Author:** [@nino](https://discuss.elastic.co/u/nino)\ **Replies:** 4\ **Last updated:** [January 15, 2020, 12:23pm UTC](https://discuss.elastic.co/t/if-statement-not-working-with-gsub/215030 "2020-01-15T12:23:11Z")
Hello all, i want to remove "ZC" in a field and converted in a negative float "account\_value" =\> "767.19ZC", "@timestamp" =\> 2020-01-06T23:00:00.000Z why this statement is not working? filter{ if "ZC" in "fi… [Previous page](https://discuss.elastic.co/top.md?page=1101&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1103&per_page=50&period=all)