# Top

**URL:** https://discuss.elastic.co/top.md?page=1112&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1113

---

## [Does Filebeat's timestamp processor need the source field to only contain the time?](https://discuss.elastic.co/t/does-filebeats-timestamp-processor-need-the-source-field-to-only-contain-the-time/309130)

<div class="topic-metadata">

**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\
**Replies:** 6\
**Last updated:** [July 20, 2022, 8:20pm UTC](https://discuss.elastic.co/t/does-filebeats-timestamp-processor-need-the-source-field-to-only-contain-the-time/309130 "2022-07-20T20:20:01Z")

</div>

What my subject says. I'm currently telling timestamp to use the message field as the source, and I'm not sure it's actually working. Do I need to parse out the time from the message before using the timestamp processor? …

---

## [Converting Cisco Module](https://discuss.elastic.co/t/converting-cisco-module/206916)

<div class="topic-metadata">

**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\
**Replies:** 6\
**Last updated:** [November 11, 2019, 11:59pm UTC](https://discuss.elastic.co/t/converting-cisco-module/206916 "2019-11-11T23:59:46Z")

</div>

I'm learning to use filebeat, I was wondering if there is a way to convert the ingest pipeline from elasticsearch to logstash config I've had a look here https://www.elastic.co/guide/en/logstash/current/ingest-converte…

---

## [APM Server monitoring visualizations in Kibana](https://discuss.elastic.co/t/apm-server-monitoring-visualizations-in-kibana/196549)

<div class="topic-metadata">

**Author:** [@AlessandroKP](https://discuss.elastic.co/u/AlessandroKP)\
**Replies:** 3\
**Last updated:** [August 29, 2019, 7:45pm UTC](https://discuss.elastic.co/t/apm-server-monitoring-visualizations-in-kibana/196549 "2019-08-29T19:45:20Z")

</div>

Hi all, I have a question regarding APM and the Stack Monitoring feature of Kibana. I have an ES cluster with different components attached to it: beats, a Kibana instance, a Logstash instance with many pipelines and a…

---

## [FileBeats on Solaris 11.3](https://discuss.elastic.co/t/filebeats-on-solaris-11-3/155392)

<div class="topic-metadata">

**Author:** [@sarban.kumar](https://discuss.elastic.co/u/sarban.kumar)\
**Replies:** 3\
**Last updated:** [November 5, 2018, 2:42pm UTC](https://discuss.elastic.co/t/filebeats-on-solaris-11-3/155392 "2018-11-05T14:42:59Z")

</div>

Hi, I 've to ship log through Filebeats , its oracle EBS where weblogic is the core components. Looking for Filebeat installation on Solaris 11.3 SPARC system, came through below link , which says TOPBEAT does not supp…

---

## [Data stopped going to \*.keyword field](https://discuss.elastic.co/t/data-stopped-going-to-keyword-field/65871)

<div class="topic-metadata">

**Author:** [@DigiAngel](https://discuss.elastic.co/u/DigiAngel)\
**Replies:** 3\
**Last updated:** [November 15, 2016, 1:58pm UTC](https://discuss.elastic.co/t/data-stopped-going-to-keyword-field/65871 "2016-11-15T13:58:48Z")

</div>

And on the heels of my last post about this, elasticsearch has again swapped where the data goes. Previously data from logstash would go to the service field. After a few days however, data starts going to the service.…

---

## [Is it possible to use Apriori Algorithm in Elasticsearch?](https://discuss.elastic.co/t/is-it-possible-to-use-apriori-algorithm-in-elasticsearch/63952)

<div class="topic-metadata">

**Author:** [@gandhi](https://discuss.elastic.co/u/gandhi)\
**Replies:** 3\
**Last updated:** [October 26, 2016, 7:27am UTC](https://discuss.elastic.co/t/is-it-possible-to-use-apriori-algorithm-in-elasticsearch/63952 "2016-10-26T07:27:23Z")

</div>

Hey, guys! I wanna know that Elasticsearch can make this result. See the picture. It is a amazon page. If someone has a idea or information to make 'Customers Who Bought This Item Also Bought' feature by Elasticsearc…

---

## [Can any one help me with this exception](https://discuss.elastic.co/t/can-any-one-help-me-with-this-exception/300101)

<div class="topic-metadata">

**Author:** [@Kandlavath\_Dasaradhi](https://discuss.elastic.co/u/Kandlavath_Dasaradhi)\
**Replies:** 2\
**Last updated:** [March 21, 2022, 2:57am UTC](https://discuss.elastic.co/t/can-any-one-help-me-with-this-exception/300101 "2022-03-21T02:57:46Z")

</div>

C:\\Elasticsearch-7.3.2\\bin\>Elasticsearch Exception in thread "main" java.nio.file.NoSuchFileException: C:\\Elasticsearch-8.0.1\\config\\jvm.options at java.base/sun.nio.fs.WindowsException.translateToIOException(WindowsEx…

---

## [Bad Request error when creating a new Kibana index pattern](https://discuss.elastic.co/t/bad-request-error-when-creating-a-new-kibana-index-pattern/238831)

<div class="topic-metadata">

**Author:** [@Mark\_Duncan](https://discuss.elastic.co/u/Mark_Duncan)\
**Replies:** 2\
**Last updated:** [June 26, 2020, 10:56am UTC](https://discuss.elastic.co/t/bad-request-error-when-creating-a-new-kibana-index-pattern/238831 "2020-06-26T10:56:14Z")

</div>

I am getting an error when trying to create a new Kibana index pattern: Error: Bad Request I don't have any details about why it's not working. Any thoughts? ... I did apply the following the other day - intending …

---

## [How to remove specific response body content in Elasticsearch](https://discuss.elastic.co/t/how-to-remove-specific-response-body-content-in-elasticsearch/125319)

<div class="topic-metadata">

**Author:** [@muthu\_kutty](https://discuss.elastic.co/u/muthu_kutty)\
**Replies:** 2\
**Last updated:** [March 23, 2018, 8:33am UTC](https://discuss.elastic.co/t/how-to-remove-specific-response-body-content-in-elasticsearch/125319 "2018-03-23T08:33:13Z")

</div>

My response body from Elasticsearch is { "took": 67, "timed\_out": false, "\_shards": { "total": 331, "successful": 331, "skipped": 321, "failed": 0 }, "hits": { "total": 5344, "max\_score…

---

## [Extract field from json to the top-level](https://discuss.elastic.co/t/extract-field-from-json-to-the-top-level/84667)

<div class="topic-metadata">

**Author:** [@babayotakun](https://discuss.elastic.co/u/babayotakun)\
**Replies:** 2\
**Last updated:** [May 5, 2017, 8:30am UTC](https://discuss.elastic.co/t/extract-field-from-json-to-the-top-level/84667 "2017-05-05T08:30:19Z")

</div>

I have a json with the dynamic field, something like that: { field1: "value1", dynamicField: { innerField1: "...", innerField2: "...", ... } } How can I extract all contents from dynamicField to the top level of mes…

---

## [Connection via JDBC fails intermittently](https://discuss.elastic.co/t/connection-via-jdbc-fails-intermittently/60798)

<div class="topic-metadata">

**Author:** [@Dallas\_Toth](https://discuss.elastic.co/u/Dallas_Toth)\
**Replies:** 2\
**Last updated:** [September 19, 2016, 3:44pm UTC](https://discuss.elastic.co/t/connection-via-jdbc-fails-intermittently/60798 "2016-09-19T15:44:52Z")

</div>

My Logstash will work fine with the config for a few days but then after just some routine maintenance where I need to restart the logstash service I start to get this error. The I start to mess with the Conf scripts and…

---

## [Logstash combining all the grok pattern returns](https://discuss.elastic.co/t/logstash-combining-all-the-grok-pattern-returns/44058)

<div class="topic-metadata">

**Author:** [@athreya\_vc](https://discuss.elastic.co/u/athreya_vc)\
**Replies:** 2\
**Last updated:** [March 11, 2016, 4:35pm UTC](https://discuss.elastic.co/t/logstash-combining-all-the-grok-pattern-returns/44058 "2016-03-11T16:35:56Z")

</div>

Hi, I have a logfile like this 2016-03-10 04:49:41,586 p=8250 u=root | TASK \[filetester : Display messages\] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* 2016-03-10 04:49:41,619 p=8250 u=root | skipping: \[MYLABSERV…

---

## [Aborting enrolling to cluster. Could not communicate with the node on any of the addresses from the enrolment token](https://discuss.elastic.co/t/aborting-enrolling-to-cluster-could-not-communicate-with-the-node-on-any-of-the-addresses-from-the-enrolment-token/346174)

<div class="topic-metadata">

**Author:** [@Vyshak\_Sekhar](https://discuss.elastic.co/u/Vyshak_Sekhar)\
**Replies:** 1\
**Last updated:** [November 2, 2023, 3:47am UTC](https://discuss.elastic.co/t/aborting-enrolling-to-cluster-could-not-communicate-with-the-node-on-any-of-the-addresses-from-the-enrolment-token/346174 "2023-11-02T03:47:16Z")

</div>

I am trying to install a 2 node Elasticsearch cluster , i installed and my Elasticsearch that node is running fine and while im trying to connect the next node to the using enrollment token im getting this borting enroll…

---

## [Add css to existting visualizations](https://discuss.elastic.co/t/add-css-to-existting-visualizations/190557)

<div class="topic-metadata">

**Author:** [@sudeepvd](https://discuss.elastic.co/u/sudeepvd)\
**Replies:** 1\
**Last updated:** [July 15, 2019, 9:02pm UTC](https://discuss.elastic.co/t/add-css-to-existting-visualizations/190557 "2019-07-15T21:02:27Z")

</div>

I have currently set a CPU usage visualization using metricbeat. The graph as part of the visualization has a default width and height. Since I am importing the iframe in another app I cannot modify css for iframe(cross …

---

## [Aggregation is too slow](https://discuss.elastic.co/t/aggregation-is-too-slow/133424)

<div class="topic-metadata">

**Author:** [@cool\_arun](https://discuss.elastic.co/u/cool_arun)\
**Replies:** 7\
**Last updated:** [May 27, 2018, 6:15pm UTC](https://discuss.elastic.co/t/aggregation-is-too-slow/133424 "2018-05-27T18:15:44Z")

</div>

Hi sir, i'm new to elasticsearch, i have more than 2.5 crores of data in elasticsearch index on a single node cluster, when i perform aggregation query it takes lot of time and even get timeout. i think i'm doing somet…

---

## [Pipeline to pipeline communication - logstash](https://discuss.elastic.co/t/pipeline-to-pipeline-communication-logstash/235821)

<div class="topic-metadata">

**Author:** [@Pankaj\_Jadhav](https://discuss.elastic.co/u/Pankaj_Jadhav)\
**Replies:** 8\
**Last updated:** [June 5, 2020, 7:09am UTC](https://discuss.elastic.co/t/pipeline-to-pipeline-communication-logstash/235821 "2020-06-05T07:09:10Z")

</div>

Pipeline1 kafka { bootstrap\_servers =\> "172.20.188.11:9092,172.20.188.31:9092,172.20.188.30:9092" topics =\> \["DS\_Test"\] decorate\_events =\> true group\_id =\> "ds\_test" codec =\> json max\_poll\_recor…

---

## [Problem with POST xml request with http\_poller plugin](https://discuss.elastic.co/t/problem-with-post-xml-request-with-http-poller-plugin/234343)

<div class="topic-metadata">

**Author:** [@Ranjan\_Kumar](https://discuss.elastic.co/u/Ranjan_Kumar)\
**Replies:** 8\
**Last updated:** [May 29, 2020, 8:27pm UTC](https://discuss.elastic.co/t/problem-with-post-xml-request-with-http-poller-plugin/234343 "2020-05-29T20:27:56Z")

</div>

Hi , I am using logstash to send post data to elastic node but i am getting this. Please help me regarding this. logstash\_post.conf input { http\_poller { urls =\> { method =\> post schedule =\> {cron =\> "\* \* \* \* \* UT…

---

## [Shield-LDAP for Kibana](https://discuss.elastic.co/t/shield-ldap-for-kibana/60275)

<div class="topic-metadata">

**Author:** [@matrocker](https://discuss.elastic.co/u/matrocker)\
**Replies:** 1\
**Last updated:** [October 28, 2016, 11:13pm UTC](https://discuss.elastic.co/t/shield-ldap-for-kibana/60275 "2016-10-28T23:13:35Z")

</div>

Hello, I have Elasticsearch, Kibana, LDAP in my local setup. I have configured LDAP with Elasticsearch and it's working fine. I then followed this document: https://www.elastic.co/guide/en/shield/current/kibana.html I …

---

## [How to enable CORS in Kibana server](https://discuss.elastic.co/t/how-to-enable-cors-in-kibana-server/348703)

<div class="topic-metadata">

**Author:** [@Prakash\_Gupta](https://discuss.elastic.co/u/Prakash_Gupta)\
**Replies:** 4\
**Last updated:** [December 9, 2023, 3:49pm UTC](https://discuss.elastic.co/t/how-to-enable-cors-in-kibana-server/348703 "2023-12-09T15:49:18Z")

</div>

Hi, I am using Kibana dashboards as iframes under a web application. The problem is that the Kibana server is authenticated by SSO and there is no guarantee that the user's browser session is having a valid active sessi…

---

## [Alerting - OR condition in Log threshold rule type](https://discuss.elastic.co/t/alerting-or-condition-in-log-threshold-rule-type/327458)

<div class="topic-metadata">

**Author:** [@flalar](https://discuss.elastic.co/u/flalar)\
**Replies:** 1\
**Last updated:** [March 10, 2023, 4:31pm UTC](https://discuss.elastic.co/t/alerting-or-condition-in-log-threshold-rule-type/327458 "2023-03-10T16:31:25Z")

</div>

We are currently migrating from the 3.party Elastalert package for alerting on data in Elasticsearch to the native Kibana Alerting capabilities. On that path we have come across the issue that it does not seem possible t…

---

## [Auditbeat Connection Refused](https://discuss.elastic.co/t/auditbeat-connection-refused/318809)

<div class="topic-metadata">

**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\
**Replies:** 4\
**Last updated:** [November 15, 2022, 3:21pm UTC](https://discuss.elastic.co/t/auditbeat-connection-refused/318809 "2022-11-15T15:21:33Z")

</div>

I'm trying to learn how to set up auditbeat on the same server as my elasticsearch and kibana instance verison 8.5 which is running off of ubuntu 20.04. But when I do a systemctl start auditbeat.service, I get the error…

---

## [Something went wrong error appear in kibana when we switch between under the Devtools tab](https://discuss.elastic.co/t/something-went-wrong-error-appear-in-kibana-when-we-switch-between-under-the-devtools-tab/234306)

<div class="topic-metadata">

**Author:** [@prashant1](https://discuss.elastic.co/u/prashant1)\
**Replies:** 4\
**Last updated:** [May 26, 2020, 1:39pm UTC](https://discuss.elastic.co/t/something-went-wrong-error-appear-in-kibana-when-we-switch-between-under-the-devtools-tab/234306 "2020-05-26T13:39:57Z")

</div>

An error is displayed in the browser while loading Kibana. When we switch between tabs (History, Settings, Help) under Devtools tab. We see an error something went wrong. Please refer the attachment.

---

## [Kibana markdown show json data](https://discuss.elastic.co/t/kibana-markdown-show-json-data/124326)

<div class="topic-metadata">

**Author:** [@philv](https://discuss.elastic.co/u/philv)\
**Replies:** 4\
**Last updated:** [March 29, 2018, 2:27pm UTC](https://discuss.elastic.co/t/kibana-markdown-show-json-data/124326 "2018-03-29T14:27:43Z")

</div>

Can the kibana markdown widget be used to show data from json objects retrived from Elasticsearch ? I have seen references to Mustache, but in kibana 6.0.0 I cannot get the syntax to work such that my data shows up in a…

---

## [Logstash crashing unexpectedly](https://discuss.elastic.co/t/logstash-crashing-unexpectedly/53188)

<div class="topic-metadata">

**Author:** [@tcouto](https://discuss.elastic.co/u/tcouto)\
**Replies:** 4\
**Last updated:** [June 22, 2016, 6:24pm UTC](https://discuss.elastic.co/t/logstash-crashing-unexpectedly/53188 "2016-06-22T18:24:32Z")

</div>

Hello, logstash keeps failing and spitting out this error: NoMethodError: undefined method \`join' for "\_grokparsefailure":String receive at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-gelf-1.0.0/lib/lo…

---

## [Elasticsearch "delete by query" not released disk space](https://discuss.elastic.co/t/elasticsearch-delete-by-query-not-released-disk-space/333768)

<div class="topic-metadata">

**Author:** [@sanjeevtomar](https://discuss.elastic.co/u/sanjeevtomar)\
**Replies:** 3\
**Last updated:** [May 18, 2023, 8:35pm UTC](https://discuss.elastic.co/t/elasticsearch-delete-by-query-not-released-disk-space/333768 "2023-05-18T20:35:10Z")

</div>

After running "delete by query ", disk space did not released. What should I do to make disk space release?

---

## [Possible problem with Elasticsearch readinessProbe?](https://discuss.elastic.co/t/possible-problem-with-elasticsearch-readinessprobe/217094)

<div class="topic-metadata">

**Author:** [@tadgh](https://discuss.elastic.co/u/tadgh)\
**Replies:** 3\
**Last updated:** [January 31, 2020, 4:33pm UTC](https://discuss.elastic.co/t/possible-problem-with-elasticsearch-readinessprobe/217094 "2020-01-31T16:33:52Z")

</div>

Hey all, I am trying to setup a google cloud Ingress object to route traffic to the Elasticsearch service in ECK, but it appears as though the Ingress object attempts the health check using the HTTP protocol, instead of …

---

## [Pricing?](https://discuss.elastic.co/t/pricing/78900)

<div class="topic-metadata">

**Author:** [@DigiAngel](https://discuss.elastic.co/u/DigiAngel)\
**Replies:** 3\
**Last updated:** [March 16, 2017, 4:22pm UTC](https://discuss.elastic.co/t/pricing/78900 "2017-03-16T16:22:58Z")

</div>

Since nobody at the sales@ email has gotten back to me I'll ask here. What's the pricing for Gold Xpack? Thank you.

---

## [Kafka establishes tls1.2 with openssl, but not filebeat](https://discuss.elastic.co/t/kafka-establishes-tls1-2-with-openssl-but-not-filebeat/126824)

<div class="topic-metadata">

**Author:** [@cement](https://discuss.elastic.co/u/cement)\
**Replies:** 5\
**Last updated:** [April 6, 2018, 8:29pm UTC](https://discuss.elastic.co/t/kafka-establishes-tls1-2-with-openssl-but-not-filebeat/126824 "2018-04-06T20:29:10Z")

</div>

Filebeat is configured to talk to kafka over tls, but it fails with "INFO kafka/log.go:36 Failed to connect to broker : tls: first record does not look like a TLS handshake" openssl s\_client, using the same key, ca and…

---

## [Index Update a column of a document cause the disk space temporary double](https://discuss.elastic.co/t/index-update-a-column-of-a-document-cause-the-disk-space-temporary-double/71008)

<div class="topic-metadata">

**Author:** [@kiet.tran](https://discuss.elastic.co/u/kiet.tran)\
**Replies:** 5\
**Last updated:** [January 11, 2017, 3:22am UTC](https://discuss.elastic.co/t/index-update-a-column-of-a-document-cause-the-disk-space-temporary-double/71008 "2017-01-11T03:22:31Z")

</div>

Hi There, We notice if we are updating just one column of the document that already indexed in ES for some reason the disk space size of the node temporary double to the document size. And then after it successful ind…

---

## [Dedicated master nodes](https://discuss.elastic.co/t/dedicated-master-nodes/45784)

<div class="topic-metadata">

**Author:** [@lucifer](https://discuss.elastic.co/u/lucifer)\
**Replies:** 5\
**Last updated:** [March 30, 2016, 1:18pm UTC](https://discuss.elastic.co/t/dedicated-master-nodes/45784 "2016-03-30T13:18:32Z")

</div>

Can I set multiple nodes as dedicated master nodes? Suppose I set 3 nodes as dedicated master nodes, and set minimum master nodes as 2, what benefit will I have as compared to having only a single dedicated master node? …

---

## [String Comparison is not working](https://discuss.elastic.co/t/string-comparison-is-not-working/41282)

<div class="topic-metadata">

**Author:** [@Rajnikant](https://discuss.elastic.co/u/Rajnikant)\
**Replies:** 5\
**Last updated:** [February 10, 2016, 6:17am UTC](https://discuss.elastic.co/t/string-comparison-is-not-working/41282 "2016-02-10T06:17:13Z")

</div>

When i query for the integer its working properly. but its not working properly for the string. //Its Working Fine. QueryBuilder qb = QueryBuilders.boolQuery() .must(QueryBuilders.termQuery("eventiypeid","123")); …

---

## [How to Disable allocation awareness attributes in indices level](https://discuss.elastic.co/t/how-to-disable-allocation-awareness-attributes-in-indices-level/204415)

<div class="topic-metadata">

**Author:** [@luyuncheng](https://discuss.elastic.co/u/luyuncheng)\
**Replies:** 2\
**Last updated:** [October 21, 2019, 9:17am UTC](https://discuss.elastic.co/t/how-to-disable-allocation-awareness-attributes-in-indices-level/204415 "2019-10-21T09:17:20Z")

</div>

When allocation-awareness set to zone. It make primary and replicas shard must split into different zone. When we need make cluster how-warm or shrink , we need move all shards which is warm indices into one zone. but w…

---

## [ElasticSearch custom Service not working](https://discuss.elastic.co/t/elasticsearch-custom-service-not-working/131712)

<div class="topic-metadata">

**Author:** [@Giuseppe\_Merlo](https://discuss.elastic.co/u/Giuseppe_Merlo)\
**Replies:** 2\
**Last updated:** [May 15, 2018, 1:24pm UTC](https://discuss.elastic.co/t/elasticsearch-custom-service-not-working/131712 "2018-05-15T13:24:58Z")

</div>

Hi everyone! I'm just trying to run Elasticsearch on machine startup. I have Elasticsearch directory and execute ./elasticsearch from bin manually. I can not use elasticsearch.service and i try to make it on my own. S…

---

## [Simple compound search in Kibana](https://discuss.elastic.co/t/simple-compound-search-in-kibana/72353)

<div class="topic-metadata">

**Author:** [@elastimed](https://discuss.elastic.co/u/elastimed)\
**Replies:** 2\
**Last updated:** [January 24, 2017, 11:52pm UTC](https://discuss.elastic.co/t/simple-compound-search-in-kibana/72353 "2017-01-24T23:52:35Z")

</div>

When in Kibana I enter say (src\_ip=10.3.25.23 AND dest\_port=22) and click search - I get back syslog entries ehter dst\_ip is 10.3.25.23 and 22 will be in there as say a an ethernet switch port number - but not the TCP de…

---

## [Logstash forwarder is sending a message to multiple servers](https://discuss.elastic.co/t/logstash-forwarder-is-sending-a-message-to-multiple-servers/35574)

<div class="topic-metadata">

**Author:** [@tsvivek](https://discuss.elastic.co/u/tsvivek)\
**Replies:** 2\
**Last updated:** [November 26, 2015, 5:59am UTC](https://discuss.elastic.co/t/logstash-forwarder-is-sending-a-message-to-multiple-servers/35574 "2015-11-26T05:59:01Z")

</div>

We have multiple ELK environments (dev, test etc) and have observed recently that the forwarder is sending messages to multiple environments. In all environments, the forwarder config looks like this: { # The netwo…

---

## [Average doc\_count per hour?](https://discuss.elastic.co/t/average-doc-count-per-hour/16995)

<div class="topic-metadata">

**Author:** [@Shrinath\_M](https://discuss.elastic.co/u/Shrinath_M)\
**Replies:** 2\
**Last updated:** [April 14, 2014, 9:11am UTC](https://discuss.elastic.co/t/average-doc-count-per-hour/16995 "2014-04-14T09:11:03Z")

</div>

Is there a way I can use "avg" aggregation to return just the "average documents" in an hour/min/date-range? What I am trying to do is this - I have fed the Nginx server logs to elasticsearch, now I want to know…

---

## [Failed to add match 'elasticsearch': Invalid argument](https://discuss.elastic.co/t/failed-to-add-match-elasticsearch-invalid-argument/294388)

<div class="topic-metadata">

**Author:** [@Penchev](https://discuss.elastic.co/u/Penchev)\
**Replies:** 1\
**Last updated:** [January 14, 2022, 3:17pm UTC](https://discuss.elastic.co/t/failed-to-add-match-elasticsearch-invalid-argument/294388 "2022-01-14T15:17:20Z")

</div>

Hi, I have the following issue after upgrading ELasticsearch from 6.8.22 to 7.14.2. When trying to start the service: Job for elasticsearch.service failed because the control process exited with error code. See "syste…

---

## [How to sort based on field in search ouput](https://discuss.elastic.co/t/how-to-sort-based-on-field-in-search-ouput/42704)

<div class="topic-metadata">

**Author:** [@lamp0chka](https://discuss.elastic.co/u/lamp0chka)\
**Replies:** 1\
**Last updated:** [February 26, 2016, 8:37pm UTC](https://discuss.elastic.co/t/how-to-sort-based-on-field-in-search-ouput/42704 "2016-02-26T20:37:00Z")

</div>

Hi, It seems that .raw fields are not displayed in search results output (both discover and dashboard) and Kibana throws an error if I try to sort based on analyzed field. For example I would like to sort by host, bu…

---

## [Enriching MMDB files with your own data using Go](https://discuss.elastic.co/t/enriching-mmdb-files-with-your-own-data-using-go/247158)

<div class="topic-metadata">

**Author:** [@nchelluri](https://discuss.elastic.co/u/nchelluri)\
**Replies:** 1\
**Last updated:** [September 2, 2020, 2:49am UTC](https://discuss.elastic.co/t/enriching-mmdb-files-with-your-own-data-using-go/247158 "2020-09-02T02:49:14Z")

</div>

I work for MaxMind and it was pointed out to me that a popular blog post of ours around here was this post from 2015 showing how to build an MMDB using Perl. Well, it's 2020 now and we've got a post showing how to enric…

---

## [Kibana error after using key ca certs instead of plaintext password](https://discuss.elastic.co/t/kibana-error-after-using-key-ca-certs-instead-of-plaintext-password/193991)

<div class="topic-metadata">

**Author:** [@akshay\_singh2](https://discuss.elastic.co/u/akshay_singh2)\
**Replies:** 6\
**Last updated:** [August 9, 2019, 7:29am UTC](https://discuss.elastic.co/t/kibana-error-after-using-key-ca-certs-instead-of-plaintext-password/193991 "2019-08-09T07:29:09Z")

</div>

Hello Team, I have recently implemented certs and keys for Kibana (ELK 6.8.0) instead of username and password, but getting, but getting missing authentication token. Details logs are as: log \[10:50:19.005\] \[info\]\[…

---

## [Filesystem metricset not reporting nfs and some host filesystems](https://discuss.elastic.co/t/filesystem-metricset-not-reporting-nfs-and-some-host-filesystems/191866)

<div class="topic-metadata">

**Author:** [@Mario\_Fimiani](https://discuss.elastic.co/u/Mario_Fimiani)\
**Replies:** 6\
**Last updated:** [August 1, 2019, 2:36pm UTC](https://discuss.elastic.co/t/filesystem-metricset-not-reporting-nfs-and-some-host-filesystems/191866 "2019-08-01T14:36:16Z")

</div>

Continuing the discussion from Filesystem metricset not reporting nfs and other host filesystems: we have the same problem on our environment (7.1 elk and stack). Some info regarding this issue ?

---

## [Logstash how to solve the problem about jackson-databind CVE-2020-9548](https://discuss.elastic.co/t/logstash-how-to-solve-the-problem-about-jackson-databind-cve-2020-9548/249526)

<div class="topic-metadata">

**Author:** [@geraintj](https://discuss.elastic.co/u/geraintj)\
**Replies:** 0\
**Last updated:** [September 22, 2020, 1:13pm UTC](https://discuss.elastic.co/t/logstash-how-to-solve-the-problem-about-jackson-databind-cve-2020-9548/249526 "2020-09-22T13:13:21Z")

</div>

Hi. We're using Logstash 6.8.6, which has a dependency on jackson-databind 2.9.9.3. Our scans are flagging it as vulnerable to CVE-2020-9548: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction b…

---

## [Split - Only String and Array types are splittable. field:\[value\] is of type = NilClass](https://discuss.elastic.co/t/split-only-string-and-array-types-are-splittable-field-value-is-of-type-nilclass/213154)

<div class="topic-metadata">

**Author:** [@exilemirror](https://discuss.elastic.co/u/exilemirror)\
**Replies:** 0\
**Last updated:** [December 27, 2019, 8:11am UTC](https://discuss.elastic.co/t/split-only-string-and-array-types-are-splittable-field-value-is-of-type-nilclass/213154 "2019-12-27T08:11:08Z")

</div>

Hi I'm trying to filter a JSON file extracted from Microsoft Graph API. JSON file content below. { "@odata.context": "https://microsoft.com", "value": \[ { "currentScore": 203.0, "maxScore": 802.0, "createdDateTim…

---

## [Where is the real API documentation?](https://discuss.elastic.co/t/where-is-the-real-api-documentation/229387)

<div class="topic-metadata">

**Author:** [@svbernem](https://discuss.elastic.co/u/svbernem)\
**Replies:** 7\
**Last updated:** [April 27, 2020, 2:55pm UTC](https://discuss.elastic.co/t/where-is-the-real-api-documentation/229387 "2020-04-27T14:55:52Z")

</div>

I am looking for documentation, that lists every possible command I can execute via the Rest-API, and every possible piece of data/url I can apply them to. Currently, I want to delete an index pattern via the rest API an…

---

## [Using Kibana and Elasticsearch for non-log large datasets](https://discuss.elastic.co/t/using-kibana-and-elasticsearch-for-non-log-large-datasets/29599)

<div class="topic-metadata">

**Author:** [@huksley](https://discuss.elastic.co/u/huksley)\
**Replies:** 1\
**Last updated:** [September 19, 2015, 1:23am UTC](https://discuss.elastic.co/t/using-kibana-and-elasticsearch-for-non-log-large-datasets/29599 "2015-09-19T01:23:51Z")

</div>

Hello! I am trying to use Kibana 4.1 (with Elasticsearch 1.7.2) for initial 100k+ dataset of LARGE objects (900+ fields) for visualization and analysis of data. Here is my experiences so far \[Discover\] step in kib…

---

## [Mapping use dynamic strict](https://discuss.elastic.co/t/mapping-use-dynamic-strict/264957)

<div class="topic-metadata">

**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Replies:** 7\
**Last updated:** [February 22, 2021, 4:03pm UTC](https://discuss.elastic.co/t/mapping-use-dynamic-strict/264957 "2021-02-22T16:03:07Z")

</div>

I am trying to test out this feature but not getting what I want for example PUT \_index\_template/sachin\_quick\_test { "index\_patterns": \["sachin\_quick\_test-\*"\], "template": { "settings": { "number\_of\_shard…

---

## [Average bucket in histogram change when time filter change](https://discuss.elastic.co/t/average-bucket-in-histogram-change-when-time-filter-change/258285)

<div class="topic-metadata">

**Author:** [@vbarai](https://discuss.elastic.co/u/vbarai)\
**Replies:** 7\
**Last updated:** [December 28, 2020, 5:15am UTC](https://discuss.elastic.co/t/average-bucket-in-histogram-change-when-time-filter-change/258285 "2020-12-28T05:15:09Z")

</div>

Hi All, I am using latest ELK 7.10. I am facing weired issue with the Lens and Average Bucket Histogram. STEP 1 : Created 4 Index for Dec-2020 Days as below idx\_agg\_test\_20201201 idx\_agg\_test\_20201207 idx\_agg\_test\_2…

---

## [Docker image root access](https://discuss.elastic.co/t/docker-image-root-access/112515)

<div class="topic-metadata">

**Author:** [@StianOvrevage](https://discuss.elastic.co/u/StianOvrevage)\
**Replies:** 1\
**Last updated:** [December 19, 2017, 10:39pm UTC](https://discuss.elastic.co/t/docker-image-root-access/112515 "2017-12-19T22:39:55Z")

</div>

How can I log in to the official docker image as root? For example, using kubectl on Kubernetes to start a session within a container gives an unprivileged user shell. I have not found any way to start a root shell, or …

---

## [Json vs plaintext output](https://discuss.elastic.co/t/json-vs-plaintext-output/100669)

<div class="topic-metadata">

**Author:** [@drmason13](https://discuss.elastic.co/u/drmason13)\
**Replies:** 1\
**Last updated:** [September 15, 2017, 11:47am UTC](https://discuss.elastic.co/t/json-vs-plaintext-output/100669 "2017-09-15T11:47:24Z")

</div>

I am confused by the exact role of output codec plugins. In particular I have been struggling to understand why the syslog output plugin appears to output json. When running the following config: input { file { path =\>…

---

## [Modifications in Kibana](https://discuss.elastic.co/t/modifications-in-kibana/73625)

<div class="topic-metadata">

**Author:** [@Dan](https://discuss.elastic.co/u/Dan)\
**Replies:** 1\
**Last updated:** [February 2, 2017, 3:33pm UTC](https://discuss.elastic.co/t/modifications-in-kibana/73625 "2017-02-02T15:33:11Z")

</div>

I am doing some modification in Kibana common.style.css file. for example i am changing logo path. instead of Kibana.svg i am giving xyz.png. changes are working fine.After some time when i restart kibana common.styl…

[Previous page](https://discuss.elastic.co/top.md?page=1111&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1113&per_page=50&period=all)
