# Top **URL:** https://discuss.elastic.co/top.md?page=1111&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1112 --- ## [Grok pattern to match Filebeat multiline input up to the first new line character](https://discuss.elastic.co/t/grok-pattern-to-match-filebeat-multiline-input-up-to-the-first-new-line-character/253575)
**Author:** [@sjne](https://discuss.elastic.co/u/sjne)\ **Replies:** 5\ **Last updated:** [October 29, 2020, 12:35pm UTC](https://discuss.elastic.co/t/grok-pattern-to-match-filebeat-multiline-input-up-to-the-first-new-line-character/253575 "2020-10-29T12:35:57Z")
Logstash 6.8.10 Filebeat 6.8.9 Filebeat config: filebeat.inputs: - type: log enabled: true paths: - '/path/to/file' tags: - 'app' fields: app\_id: some\_app multiline.pattern: '^\\\[\[0-9\]{4}\\-\[0-9\]{2}-\[… --- ## [Logstash and elasticsearch mismatch](https://discuss.elastic.co/t/logstash-and-elasticsearch-mismatch/241758)
**Author:** [@elk6](https://discuss.elastic.co/u/elk6)\ **Replies:** 5\ **Last updated:** [July 19, 2020, 6:17pm UTC](https://discuss.elastic.co/t/logstash-and-elasticsearch-mismatch/241758 "2020-07-19T18:17:50Z")
I'm trying to ship logs from a server with filebeat to another server that hosts logstash and elasticsearch. Everything is latest and greatest (7.8.0). Problem is, I'm getting an error from logstash. This is the error I… --- ## [How to write processors?](https://discuss.elastic.co/t/how-to-write-processors/115458)
**Author:** [@benben](https://discuss.elastic.co/u/benben)\ **Replies:** 5\ **Last updated:** [January 22, 2018, 2:59pm UTC](https://discuss.elastic.co/t/how-to-write-processors/115458 "2018-01-22T14:59:21Z")
Hi, I recently wrote a new beat for serial data, called serialbeat. Now I want to add a processor to this beat, which does a few things with the data before sending it somewhere. Is there any documentation on how to wri… --- ## [Logstash-plugin fails with java errors on a clean install](https://discuss.elastic.co/t/logstash-plugin-fails-with-java-errors-on-a-clean-install/99744)
**Author:** [@rrue](https://discuss.elastic.co/u/rrue)\ **Replies:** 5\ **Last updated:** [September 7, 2017, 4:25pm UTC](https://discuss.elastic.co/t/logstash-plugin-fails-with-java-errors-on-a-clean-install/99744 "2017-09-07T16:25:51Z")
Hi All, Forgive what is likely a newbie question, I’m pretty green around ELK and especially ruby and gems. Just installed LS 5.5.2 via RPM to openSUSE LEAP 42.2 and if I cd to /usr/share/logstash and try to run any ca… --- ## [Variable fieldname to be used as GREEDYDATA field](https://discuss.elastic.co/t/variable-fieldname-to-be-used-as-greedydata-field/48170)
**Author:** [@Zfs](https://discuss.elastic.co/u/Zfs)\ **Replies:** 5\ **Last updated:** [April 25, 2016, 5:33am UTC](https://discuss.elastic.co/t/variable-fieldname-to-be-used-as-greedydata-field/48170 "2016-04-25T05:33:01Z")
Hi, I have the following logs: 2016-04-19 12:48:41,628 \[DefaultPool\] INFO DataXXXLog - some log data 2016-04-19 12:48:41,628 \[DefaultPool\] INFO DataYYYLog - some log data 2016-04-19 12:48:41,628 \[DefaultPool\] INFO Work… --- ## [What types of SSDs?](https://discuss.elastic.co/t/what-types-of-ssds/18588)
**Author:** [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)\ **Replies:** 5\ **Last updated:** [July 14, 2014, 8:08pm UTC](https://discuss.elastic.co/t/what-types-of-ssds/18588 "2014-07-14T20:08:35Z")
Using 1.2.1 I know each system and functionality is different but just curious when people say buy SSDs for ES, what types of SSDs are they buying? Fortunately for me I had some Fusion IO cards to test with, but … --- ## [Kibana plugin development: Error when creating plugin in Kibana 8.6](https://discuss.elastic.co/t/kibana-plugin-development-error-when-creating-plugin-in-kibana-8-6/329264)
**Author:** [@dms6978](https://discuss.elastic.co/u/dms6978)\ **Replies:** 6\ **Last updated:** [April 18, 2023, 2:27am UTC](https://discuss.elastic.co/t/kibana-plugin-development-error-when-creating-plugin-in-kibana-8-6/329264 "2023-04-18T02:27:54Z")
When I create and run plugins, the following error occurs. Refused to execute script from 'http://localhost:5601/mvk/9007199254740991/bundles/plugin/helloKibana/1.0.0/helloKibana.plugin.js' because its MIME type ('appl… --- ## [Getting Configuration Error (No configuration found in the configured sources) : Logstash in Windows 11 Systems](https://discuss.elastic.co/t/getting-configuration-error-no-configuration-found-in-the-configured-sources-logstash-in-windows-11-systems/316784)
**Author:** [@SP003](https://discuss.elastic.co/u/SP003)\ **Replies:** 6\ **Last updated:** [October 17, 2022, 7:14pm UTC](https://discuss.elastic.co/t/getting-configuration-error-no-configuration-found-in-the-configured-sources-logstash-in-windows-11-systems/316784 "2022-10-17T19:14:07Z")
Hello, Greetings ! I am running Logstash from my system (windows 11) I have configured Elasticsearch and Kibana and its running fine. But Getting below error, while configuring log stash. Could you please tell me w… --- ## [Get some information in Message Watcher](https://discuss.elastic.co/t/get-some-information-in-message-watcher/225370)
**Author:** [@Downer](https://discuss.elastic.co/u/Downer)\ **Replies:** 6\ **Last updated:** [April 3, 2020, 1:29pm UTC](https://discuss.elastic.co/t/get-some-information-in-message-watcher/225370 "2020-04-03T13:29:25Z")
Hello ! I'm new in the world of elastic. I would like to know if it is possible with watcher to get some variables and use it in "Message" (example: slack). I would like to create a watcher that send me a message on sla… --- ## [Use greedy regexes in Curator filter](https://discuss.elastic.co/t/use-greedy-regexes-in-curator-filter/154200)
**Author:** [@dr01](https://discuss.elastic.co/u/dr01)\ **Replies:** 6\ **Last updated:** [October 31, 2018, 2:58pm UTC](https://discuss.elastic.co/t/use-greedy-regexes-in-curator-filter/154200 "2018-10-31T14:58:35Z")
I have set up Curator to delete old indexes via this filter: (...) filters: - filtertype: pattern kind: regex value: '^xyz-us-(prod|preprod)-(.\*)-' exclude: - filtertype: age source: name direction: older ti… --- ## [Indexing stopped - shards unassigned](https://discuss.elastic.co/t/indexing-stopped-shards-unassigned/136818)
**Author:** [@jon\_uk](https://discuss.elastic.co/u/jon_uk)\ **Replies:** 6\ **Last updated:** [June 21, 2018, 10:39am UTC](https://discuss.elastic.co/t/indexing-stopped-shards-unassigned/136818 "2018-06-21T10:39:32Z")
Hi All, I'm experiencing difficulties with indexing. We are shipping logs to logstash which is trying to index them but we are seeing the errors as shown below. Has anybody seen this before? It was working fine, then a… --- ## [Score of matched (nested) documents?](https://discuss.elastic.co/t/score-of-matched-nested-documents/8641)
**Author:** [@polyfractal](https://discuss.elastic.co/u/polyfractal)\ **Replies:** 6\ **Last updated:** [November 12, 2013, 10:09am UTC](https://discuss.elastic.co/t/score-of-matched-nested-documents/8641 "2013-11-12T10:09:30Z")
I believe the answer is "no", but wanted to check: Is there a way to return the individual score of the nested documents that match a query? I'm performing a query on nested docs which returns appropriate parents… --- ## [Regarding Elasticsearch and Docker](https://discuss.elastic.co/t/regarding-elasticsearch-and-docker/145579)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 4\ **Last updated:** [September 27, 2018, 2:25am UTC](https://discuss.elastic.co/t/regarding-elasticsearch-and-docker/145579 "2018-09-27T02:25:45Z")
Hi, I have a question regarding memory sizing for an elasticsearch docker container. If a node requires 8GB of HEAP then it is normal to provision 16GB of RAM for filesystem caching. When running elasticsearch in docker… --- ## [Filebeat mysql slowlog pipeline.json decoding failure](https://discuss.elastic.co/t/filebeat-mysql-slowlog-pipeline-json-decoding-failure/123797)
**Author:** [@Rytis](https://discuss.elastic.co/u/Rytis)\ **Replies:** 4\ **Last updated:** [March 14, 2018, 10:11am UTC](https://discuss.elastic.co/t/filebeat-mysql-slowlog-pipeline-json-decoding-failure/123797 "2018-03-14T10:11:04Z")
Hello, I have a problem with mysql slowlog parsing. I tried to change mysql slowlog pipeline.json file so it could parse my slowlogs. Now it looks like this: { "description": "Pipeline for parsing MySQL slow logs.",… --- ## [Sort grouped search result by formula](https://discuss.elastic.co/t/sort-grouped-search-result-by-formula/198223)
**Author:** [@yuriiH](https://discuss.elastic.co/u/yuriiH)\ **Replies:** 0\ **Last updated:** [September 5, 2019, 10:31am UTC](https://discuss.elastic.co/t/sort-grouped-search-result-by-formula/198223 "2019-09-05T10:31:17Z")
Hello. I am trying to implement query which will sort results by the formula. For example, we have the next entities: { "price":"1000", "zip":"77777", "field1":"1", "field2":"5" }, { "price":"2222", "zip":"777… --- ## [Table with color filter](https://discuss.elastic.co/t/table-with-color-filter/186718)
**Author:** [@optimistic](https://discuss.elastic.co/u/optimistic)\ **Replies:** 2\ **Last updated:** [July 12, 2019, 7:24am UTC](https://discuss.elastic.co/t/table-with-color-filter/186718 "2019-07-12T07:24:22Z")
I have such logic of logs aggregation. My first service send events id: 'user-refresh-test', id: 117 Than other service send: 'user-refresh-test', id: 117, serviceN1: 1 It means than serviceN1 did some job and s… --- ## [Geoip filter reports incorrect location](https://discuss.elastic.co/t/geoip-filter-reports-incorrect-location/165667)
**Author:** [@andrew](https://discuss.elastic.co/u/andrew)\ **Replies:** 3\ **Last updated:** [January 28, 2019, 8:20pm UTC](https://discuss.elastic.co/t/geoip-filter-reports-incorrect-location/165667 "2019-01-28T20:20:35Z")
I discovered some incorrect results when geocoding IP addresses through the geoip filter in Logsstash 6.5.4. The IP address in question is 185.234.217.248. If I go to https://www.maxmind.com/en/geoip-demo it gives me: … --- ## [Cluster health - High level REST client](https://discuss.elastic.co/t/cluster-health-high-level-rest-client/104794)
**Author:** [@eyasso](https://discuss.elastic.co/u/eyasso)\ **Replies:** 3\ **Last updated:** [October 22, 2017, 11:35am UTC](https://discuss.elastic.co/t/cluster-health-high-level-rest-client/104794 "2017-10-22T11:35:11Z")
Hello, I am looking for a way to get the cluster's health using High level REST client. I found it using transport API and low level REST client but nothing for High level REST client. Anyway to do this purely using Hi… --- ## [Unable to start Elasticsearch service in centos](https://discuss.elastic.co/t/unable-to-start-elasticsearch-service-in-centos/254439)
**Author:** [@Dhamodharan](https://discuss.elastic.co/u/Dhamodharan)\ **Replies:** 7\ **Last updated:** [November 6, 2020, 12:24pm UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-service-in-centos/254439 "2020-11-06T12:24:20Z")
Recently setup elk stack, but unable to start the es service, its throwing the below error when i run "journalctl -xe" Also the logs of elasticsearch Can someone help me on this? --- ## [Search problem within the attachment type field](https://discuss.elastic.co/t/search-problem-within-the-attachment-type-field/41700)
**Author:** [@Ferhat\_Ozturk](https://discuss.elastic.co/u/Ferhat_Ozturk)\ **Replies:** 7\ **Last updated:** [February 15, 2016, 9:29pm UTC](https://discuss.elastic.co/t/search-problem-within-the-attachment-type-field/41700 "2016-02-15T21:29:39Z")
Hello, First of all, let me tell you that i am totally new on elasticsearch concept and trying to learn it in details. Now, i am having a problem about searching on an attachment field (I can query on other fields) Th… --- ## [Divide a field by a number in ruby](https://discuss.elastic.co/t/divide-a-field-by-a-number-in-ruby/226306)
**Author:** [@lfuentes](https://discuss.elastic.co/u/lfuentes)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 1:45pm UTC](https://discuss.elastic.co/t/divide-a-field-by-a-number-in-ruby/226306 "2020-04-03T13:45:25Z")
Good, I need help please, I need to divide a number by 1000 using the ruby filter, could you help me with the code of that? I am really a beginner, I have something like this: ruby { code =\> "event.set('timetaken', eve… --- ## [HTTP500 on logging into Kibana](https://discuss.elastic.co/t/http500-on-logging-into-kibana/201933)
**Author:** [@ben.west](https://discuss.elastic.co/u/ben.west)\ **Replies:** 1\ **Last updated:** [October 2, 2019, 10:39am UTC](https://discuss.elastic.co/t/http500-on-logging-into-kibana/201933 "2019-10-02T10:39:48Z")
Hello all, I have just come up against an issue with logging into Kibana following a rebuild of our new PoC 7.2.0 stack. I have done some basic investigation but the errors in the logs do not appear to be very helpful … --- ## [Count of two fields](https://discuss.elastic.co/t/count-of-two-fields/89893)
**Author:** [@Tal\_Shemesh](https://discuss.elastic.co/u/Tal_Shemesh)\ **Replies:** 1\ **Last updated:** [June 19, 2017, 6:33pm UTC](https://discuss.elastic.co/t/count-of-two-fields/89893 "2017-06-19T18:33:54Z")
Hi, I have events of all the request coming to a lots of domains. I would like to create a visualization of domain and the count of 200 / 204 status responses as a table with 3 columns is there a way to do that with … --- ## [\[INFO \]\[o.e.x.m.e.Exporters \] \[es-node1\] skipping exporter \[default\_local\] as it is not ready yet](https://discuss.elastic.co/t/info-o-e-x-m-e-exporters-es-node1-skipping-exporter-default-local-as-it-is-not-ready-yet/73735)
**Author:** [@maziyar](https://discuss.elastic.co/u/maziyar)\ **Replies:** 1\ **Last updated:** [February 2, 2017, 7:36pm UTC](https://discuss.elastic.co/t/info-o-e-x-m-e-exporters-es-node1-skipping-exporter-default-local-as-it-is-not-ready-yet/73735 "2017-02-02T19:36:20Z")
Hi, I am upgrading the cluster to 5.2.0 and suddenly seeing these INFO in my logs. There is no problem in terms of functionality so far, just wanted to know what am I missing in my elasticsearch.yaml to turn this off. I… --- ## [Questions to Buy Elasticsearch Enterprise](https://discuss.elastic.co/t/questions-to-buy-elasticsearch-enterprise/345774)
**Author:** [@jaeho](https://discuss.elastic.co/u/jaeho)\ **Replies:** 2\ **Last updated:** [October 31, 2023, 10:08am UTC](https://discuss.elastic.co/t/questions-to-buy-elasticsearch-enterprise/345774 "2023-10-31T10:08:39Z")
Hi! I have questions about Elasticsearch Enterprise. I like to use the eland for machine-learning using custom models. I was given an error message. elasticsearch.AuthorizationException: AuthorizationException(403, … --- ## [Sending a Kibana dashboard to React via iframe: security considerations](https://discuss.elastic.co/t/sending-a-kibana-dashboard-to-react-via-iframe-security-considerations/225932)
**Author:** [@kadowning](https://discuss.elastic.co/u/kadowning)\ **Replies:** 2\ **Last updated:** [April 3, 2020, 10:04pm UTC](https://discuss.elastic.co/t/sending-a-kibana-dashboard-to-react-via-iframe-security-considerations/225932 "2020-04-03T22:04:14Z")
Hi all - Hoping someone might be able to suggest the best way to transfer a session cookie when I present the Kibana dashboard as an iFrame within my React component? Or must I disable security entirely to make this wor… --- ## [How to find correlated messages and time between them](https://discuss.elastic.co/t/how-to-find-correlated-messages-and-time-between-them/129775)
**Author:** [@quooston](https://discuss.elastic.co/u/quooston)\ **Replies:** 2\ **Last updated:** [April 27, 2018, 12:45pm UTC](https://discuss.elastic.co/t/how-to-find-correlated-messages-and-time-between-them/129775 "2018-04-27T12:45:45Z")
Hi, total newb here.. be nice! So, I have previously used Application Insights in Azure to do this and it was very simple. I am however finding it rather frustrating to get the same result using Timelion, which I assume… --- ## [Dynamic Mapping with properties](https://discuss.elastic.co/t/dynamic-mapping-with-properties/121759)
**Author:** [@pavithrakc](https://discuss.elastic.co/u/pavithrakc)\ **Replies:** 2\ **Last updated:** [February 28, 2018, 3:25pm UTC](https://discuss.elastic.co/t/dynamic-mapping-with-properties/121759 "2018-02-28T15:25:11Z")
Hello all, I am trying to use dynamic templates for all my string fields with an exception of my Time field so that I can set that one as type 'date'. I need to use these fields("TransactTime\_Tag\_60" and "ExpireDate\_Ta… --- ## [Indices:data/write/bulk\[s\] access denied for reporting user](https://discuss.elastic.co/t/indices-data-write-bulk-s-access-denied-for-reporting-user/88259)
**Author:** [@azelezni](https://discuss.elastic.co/u/azelezni)\ **Replies:** 2\ **Last updated:** [June 6, 2017, 12:42pm UTC](https://discuss.elastic.co/t/indices-data-write-bulk-s-access-denied-for-reporting-user/88259 "2017-06-06T12:42:52Z")
Hello, I've been configuring a user for auto generating and sending reports via watch. The user is an LDAP user and I have configured the "kibana\_user" and "reporting\_user" roles via "/etc/elasticsearch/x-pack/role\_mapp… --- ## [ERR Failed to RPUSH to redis list (read tcp 10.50.12.200:48343-\>172.27.30.102:6379: i/o timeout) with %!v(MISSING)](https://discuss.elastic.co/t/err-failed-to-rpush-to-redis-list-read-tcp-10-50-12-200-48343-172-27-30-102-6379-i-o-timeout-with-v-missing/62636)
**Author:** [@ivten](https://discuss.elastic.co/u/ivten)\ **Replies:** 2\ **Last updated:** [October 11, 2016, 2:09pm UTC](https://discuss.elastic.co/t/err-failed-to-rpush-to-redis-list-read-tcp-10-50-12-200-48343-172-27-30-102-6379-i-o-timeout-with-v-missing/62636 "2016-10-11T14:09:00Z")
Hi, I'm running filebeat version 5.0.0-beta1 on my local machine, with Redis output. Redis is running on an EC2 instance in AWS. I get the following errors in the filebeat log: ERR Failed to RPUSH to redis list (read… --- ## [Translating a simple Splunk query resulted into 200 lines of Elasticsearch DSL - is there a better way?](https://discuss.elastic.co/t/translating-a-simple-splunk-query-resulted-into-200-lines-of-elasticsearch-dsl-is-there-a-better-way/58917)
**Author:** [@norandom](https://discuss.elastic.co/u/norandom)\ **Replies:** 2\ **Last updated:** [August 25, 2016, 4:36pm UTC](https://discuss.elastic.co/t/translating-a-simple-splunk-query-resulted-into-200-lines-of-elasticsearch-dsl-is-there-a-better-way/58917 "2016-08-25T16:36:08Z")
Hi, I am translating a simple Splunk query. I have been working on populating fields for our Web logs, with Logstash and FluentD. So far that is all cool. We have a field named http.url for all used http URLs. For s… --- ## [SocketTimeoutException with JEST client on java](https://discuss.elastic.co/t/sockettimeoutexception-with-jest-client-on-java/67411)
**Author:** [@abhi.kedari](https://discuss.elastic.co/u/abhi.kedari)\ **Replies:** 0\ **Last updated:** [November 28, 2016, 11:17pm UTC](https://discuss.elastic.co/t/sockettimeoutexception-with-jest-client-on-java/67411 "2016-11-28T23:17:52Z")
Exception while executing query { java.net.SocketTimeoutException: Read timed out|at java.net.SocketInputStream.socketRead0(Native Method)|at java.net.SocketInputStream.socketRead(SocketInputStream.java:116)|at java.net.… --- ## [Logstash Syslog Input - Capture the Connecting Host's IP Address](https://discuss.elastic.co/t/logstash-syslog-input-capture-the-connecting-hosts-ip-address/333602)
**Author:** [@m52](https://discuss.elastic.co/u/m52)\ **Replies:** 4\ **Last updated:** [May 17, 2023, 4:16am UTC](https://discuss.elastic.co/t/logstash-syslog-input-capture-the-connecting-hosts-ip-address/333602 "2023-05-17T04:16:35Z")
Hi, Newbie to Logstash here and could use some assistance regarding the Syslog input connector. I currently have the Syslog connector working successfully, but noticed the JSON output has a host.ip element that always… --- ## [Cannot authenticate with kibana user to the stack after I enabled security 7.7.1](https://discuss.elastic.co/t/cannot-authenticate-with-kibana-user-to-the-stack-after-i-enabled-security-7-7-1/254307)
**Author:** [@txmrlevine](https://discuss.elastic.co/u/txmrlevine)\ **Replies:** 4\ **Last updated:** [November 9, 2020, 1:25pm UTC](https://discuss.elastic.co/t/cannot-authenticate-with-kibana-user-to-the-stack-after-i-enabled-security-7-7-1/254307 "2020-11-09T13:25:10Z")
elasticsearch.yml sec setup. xpack.security.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification\_mode: certificate xpack.security.transport.ssl.keystore.path: elastic-certi… --- ## [How can i replace all values in a table with null using logstash](https://discuss.elastic.co/t/how-can-i-replace-all-values-in-a-table-with-null-using-logstash/68654)
**Author:** [@saisn](https://discuss.elastic.co/u/saisn)\ **Replies:** 4\ **Last updated:** [December 13, 2016, 4:20pm UTC](https://discuss.elastic.co/t/how-can-i-replace-all-values-in-a-table-with-null-using-logstash/68654 "2016-12-13T16:20:50Z")
Hi, Lets say i have a table A and it has 5 fields and 100 rows. I need to put a filter on the whole records and replace null values with 'no data available'. How can i do this on the whole table? Thanks, Sai --- ## [View last indexed data on elasticsearch](https://discuss.elastic.co/t/view-last-indexed-data-on-elasticsearch/61612)
**Author:** [@ANU\_SARA\_VARGHESE](https://discuss.elastic.co/u/ANU_SARA_VARGHESE)\ **Replies:** 4\ **Last updated:** [September 29, 2016, 5:56am UTC](https://discuss.elastic.co/t/view-last-indexed-data-on-elasticsearch/61612 "2016-09-29T05:56:47Z")
Hi, How can I see the last or the latest indexed data on elasticsearch? I tried out the url http://x.x.x.x:9200/myindex\_name But I can only see the the field names which I had filtered in logstash and not any d… --- ## [Modelling a directory structure](https://discuss.elastic.co/t/modelling-a-directory-structure/53960)
**Author:** [@djmcgreal](https://discuss.elastic.co/u/djmcgreal)\ **Replies:** 4\ **Last updated:** [July 5, 2016, 4:15pm UTC](https://discuss.elastic.co/t/modelling-a-directory-structure/53960 "2016-07-05T16:15:55Z")
Hi all, I remember documentation or blog post, or something which showed how one might model a directory structure system in ES, incorporating moving files, modifying folders, etc. I can't find it now, does anyone re… --- ## [Just starting - Advanced Pipeline tutorial issue](https://discuss.elastic.co/t/just-starting-advanced-pipeline-tutorial-issue/50152)
**Author:** [@Jamen\_McGranahan](https://discuss.elastic.co/u/Jamen_McGranahan)\ **Replies:** 4\ **Last updated:** [May 17, 2016, 7:37pm UTC](https://discuss.elastic.co/t/just-starting-advanced-pipeline-tutorial-issue/50152 "2016-05-17T19:37:00Z")
I am using Redhat 5 with an installation of Logstash 2.3.1 (since it appears 2.3.2 does not have the plugins and I could not figure out how to get those installed) and I am trying to work through the Advanced Pipeline tu… --- ## [Huge database I'm wondering if Elasticsearch can handle](https://discuss.elastic.co/t/huge-database-im-wondering-if-elasticsearch-can-handle/28974)
**Author:** [@razvant](https://discuss.elastic.co/u/razvant)\ **Replies:** 4\ **Last updated:** [September 11, 2015, 12:56am UTC](https://discuss.elastic.co/t/huge-database-im-wondering-if-elasticsearch-can-handle/28974 "2015-09-11T00:56:38Z")
Hello! I need to store a maximum of 200 billion records, each having 2 fields: A, and B, both strings of no more than 255 characters. I'll be inserting records into this database at a pace of about 50 000 per second. A… --- ## [Changer \_id](https://discuss.elastic.co/t/changer--id/2313)
**Author:** [@Baptiste\_Rochez](https://discuss.elastic.co/u/Baptiste_Rochez)\ **Replies:** 4\ **Last updated:** [June 10, 2015, 1:46pm UTC](https://discuss.elastic.co/t/changer--id/2313 "2015-06-10T13:46:07Z")
Bonjour J'aimerais changer la valeur de \_id par une valeur d'un champ lorsque je creer un document. J'ai essaye avec cette page : https://www.elastic.co/guide/en/elasticsearch/reference/1.4/mapping-id-field.html mais … --- ## [Sort After Aggregation](https://discuss.elastic.co/t/sort-after-aggregation/293081)
**Author:** [@aosrc](https://discuss.elastic.co/u/aosrc)\ **Replies:** 1\ **Last updated:** [December 29, 2021, 5:02am UTC](https://discuss.elastic.co/t/sort-after-aggregation/293081 "2021-12-29T05:02:09Z")
I need to aggregate by multi fields : \[srcMac, dstMac, srcIp, dstIp, srcPort, dstPort, protocol\], so I add a field "groupKey" and then aggregate by it. the mappings is: { "mappings": { "\_doc": { … --- ## [Logstash can not start](https://discuss.elastic.co/t/logstash-can-not-start/247509)
**Author:** [@psanggabuana](https://discuss.elastic.co/u/psanggabuana)\ **Replies:** 1\ **Last updated:** [September 4, 2020, 3:12pm UTC](https://discuss.elastic.co/t/logstash-can-not-start/247509 "2020-09-04T15:12:38Z")
I have problem with my logstash. When I start the logstash service, I have this log: 2020-09-04 16:21:19,830 main ERROR Unable to invoke factory method in class org.apache.logging.log4j.core.appender.RollingFileAppender… --- ## [Canvas Dropdowncontrol filter limit](https://discuss.elastic.co/t/canvas-dropdowncontrol-filter-limit/169989)
**Author:** [@prasadasokan](https://discuss.elastic.co/u/prasadasokan)\ **Replies:** 1\ **Last updated:** [February 27, 2019, 4:49pm UTC](https://discuss.elastic.co/t/canvas-dropdowncontrol-filter-limit/169989 "2019-02-27T16:49:48Z")
When trying to use Canvas Drop down control filter, we see that it is able to fetch only 100 records. We are able to use order by to sort these 100. But is there a way for us to apply time filter first, and then get this… --- ## [Performance Issues with Logstash UDP/IPFIX](https://discuss.elastic.co/t/performance-issues-with-logstash-udp-ipfix/75069)
**Author:** [@beshbesh](https://discuss.elastic.co/u/beshbesh)\ **Replies:** 1\ **Last updated:** [February 21, 2017, 1:04pm UTC](https://discuss.elastic.co/t/performance-issues-with-logstash-udp-ipfix/75069 "2017-02-21T13:04:33Z")
Hello, I have been trying to get Logstash to be able to process as many IPFIX (Netflow v10) packets as possible. I have seen some cases where Logstash users easily reached 40k events per second, or even up to 90k: I… --- ## [Disabling anonymous access](https://discuss.elastic.co/t/disabling-anonymous-access/50001)
**Author:** [@hakanw](https://discuss.elastic.co/u/hakanw)\ **Replies:** 1\ **Last updated:** [May 13, 2016, 1:49pm UTC](https://discuss.elastic.co/t/disabling-anonymous-access/50001 "2016-05-13T13:49:46Z")
Hello, I just set up a trial for the elastic found stack here. But I can't see any way to disable anonymous access (once you have the link to my cluster, you can query it). Shield is enabled, and I haven't explici… --- ## [Fatal Error in Starting Kibana for Adding New Plugin](https://discuss.elastic.co/t/fatal-error-in-starting-kibana-for-adding-new-plugin/260549)
**Author:** [@xenon-xenon](https://discuss.elastic.co/u/xenon-xenon)\ **Replies:** 5\ **Last updated:** [January 8, 2021, 5:13pm UTC](https://discuss.elastic.co/t/fatal-error-in-starting-kibana-for-adding-new-plugin/260549 "2021-01-08T17:13:39Z")
I created a plugin with plugin generator script in scripts/ folder (I used script in 7.10.1 with git checkout v7.10.1) and then i just copied it in kibana/plugins folder to check if it works on my kibana which it is vers… --- ## [Hi i'm trying to harvest the docker logs of one of our application and configured outputs to Elasticsearch and File. Its neither harvesting any . I'm sharing the filebeat logs for reference](https://discuss.elastic.co/t/hi-im-trying-to-harvest-the-docker-logs-of-one-of-our-application-and-configured-outputs-to-elasticsearch-and-file-its-neither-harvesting-any-im-sharing-the-filebeat-logs-for-reference/60652)
**Author:** [@niharvarma](https://discuss.elastic.co/u/niharvarma)\ **Replies:** 5\ **Last updated:** [September 19, 2016, 7:29am UTC](https://discuss.elastic.co/t/hi-im-trying-to-harvest-the-docker-logs-of-one-of-our-application-and-configured-outputs-to-elasticsearch-and-file-its-neither-harvesting-any-im-sharing-the-filebeat-logs-for-reference/60652 "2016-09-19T07:29:34Z")
2016/09/15 22:13:01.859214 outputs.go:126: INFO Activated elasticsearch as output plugin. 2016/09/15 22:13:01.859242 file.go:39: INFO File output base filename set to: filebeat\_log 2016/09/15 22:13:01.859252 file.go:50: … --- ## [Ngram not working for multivalued field](https://discuss.elastic.co/t/ngram-not-working-for-multivalued-field/22218)
**Author:** [@krishna](https://discuss.elastic.co/u/krishna)\ **Replies:** 5\ **Last updated:** [February 18, 2015, 9:00am UTC](https://discuss.elastic.co/t/ngram-not-working-for-multivalued-field/22218 "2015-02-18T09:00:56Z")
Hi, Couple of questions: 1) We are trying to create an index having an analyzed multi value field (filter used is n-gram). But we are not able to query the partial values. But when we have single valued f… --- ## [Multi Field Aggregation](https://discuss.elastic.co/t/multi-field-aggregation/20286)
**Author:** [@Alastair\_James](https://discuss.elastic.co/u/Alastair_James)\ **Replies:** 5\ **Last updated:** [October 19, 2014, 9:01pm UTC](https://discuss.elastic.co/t/multi-field-aggregation/20286 "2014-10-19T21:01:54Z")
Hi there. I am trying to create an aggregation that mimics the following SQL query: SELECT col1, col2, COUNT(\*), SUM(metric) FROM table GROUP BY col1, col2 ORDER BY SUM(metric) DESC On the face of it, I could … --- ## [Cannot disable "xpack.monitoring.collection.enabled" setting](https://discuss.elastic.co/t/cannot-disable-xpack-monitoring-collection-enabled-setting/357358)
**Author:** [@SamehSaeed](https://discuss.elastic.co/u/SamehSaeed)\ **Replies:** 6\ **Last updated:** [June 17, 2026, 7:50am UTC](https://discuss.elastic.co/t/cannot-disable-xpack-monitoring-collection-enabled-setting/357358 "2026-06-17T07:50:56Z")
Hello, I'm using Kibana upgrade assistant to fix a vulnerability issue, the problem is I need to resolve all warnings, one warning that i couldn't fix is this : the setting \[xpack.monitoring.collection.enabled\] is curr… [Previous page](https://discuss.elastic.co/top.md?page=1110&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1112&per_page=50&period=all)