# Top **URL:** https://discuss.elastic.co/top.md?page=1139&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1140 --- ## [Include Data Streams in ILM Policy](https://discuss.elastic.co/t/include-data-streams-in-ilm-policy/319404)
**Author:** [@waleedkh](https://discuss.elastic.co/u/waleedkh)\ **Replies:** 5\ **Last updated:** [December 1, 2022, 4:28am UTC](https://discuss.elastic.co/t/include-data-streams-in-ilm-policy/319404 "2022-12-01T04:28:15Z")
Hi There, I am making use of Data Streams and an ILM Policy to delete data that is rolled over from Hot phase to delete phase, this happens after 3 days. I wanted to check if there is a way to include the actual deleti… --- ## [FORCE index rollover](https://discuss.elastic.co/t/force-index-rollover/315958)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 5\ **Last updated:** [October 7, 2022, 5:33pm UTC](https://discuss.elastic.co/t/force-index-rollover/315958 "2022-10-07T17:33:40Z")
Hello, I sheep logs from multiples servers via the winlogbeat agent that are stored with index name ecs-agent-windows. This index is managed by a test0 policy (ILM) and configured with the agent-wingbeat template. The … --- ## [Private key issues connecting beats to logstash & elasticsearch](https://discuss.elastic.co/t/private-key-issues-connecting-beats-to-logstash-elasticsearch/289412)
**Author:** [@K5SF](https://discuss.elastic.co/u/K5SF)\ **Replies:** 5\ **Last updated:** [November 19, 2021, 1:42am UTC](https://discuss.elastic.co/t/private-key-issues-connecting-beats-to-logstash-elasticsearch/289412 "2021-11-19T01:42:01Z")
Hi all, I am writing to you because I am doing an installation of the suite ELK with Logstash elastic kibana et file beat. Only, during my SSL configuration for logstash I end up with this error " Private key cannot be … --- ## [Curator no output](https://discuss.elastic.co/t/curator-no-output/238317)
**Author:** [@Yawn](https://discuss.elastic.co/u/Yawn)\ **Replies:** 5\ **Last updated:** [June 26, 2020, 2:12pm UTC](https://discuss.elastic.co/t/curator-no-output/238317 "2020-06-26T14:12:05Z")
Hello, I am having a weird issue with curator. I did some tests previously running curator manually to take a few snapshots, and it worked. Now I am running it again and I see nothing happening and nothing in the logs… --- ## [Can't replace real log time with @timestamp](https://discuss.elastic.co/t/cant-replace-real-log-time-with-timestamp/189669)
**Author:** [@Mohammad\_hossein\_Taj](https://discuss.elastic.co/u/Mohammad_hossein_Taj)\ **Replies:** 5\ **Last updated:** [July 11, 2019, 4:26am UTC](https://discuss.elastic.co/t/cant-replace-real-log-time-with-timestamp/189669 "2019-07-11T04:26:48Z")
hi I'm trying to replace my log time with @timestamp but it doesn't work. my log sample: 2019-07-08 01:00:13,564 INFO ir.ac.ut.sdrwebservice.SDRWebService @ batchAddStdDoc, System:G, User:25117, StudentIDs:\[450188215\]… --- ## [Conseils sur Index / Shards](https://discuss.elastic.co/t/conseils-sur-index-shards/85056)
**Author:** [@Sam67000](https://discuss.elastic.co/u/Sam67000)\ **Replies:** 5\ **Last updated:** [May 10, 2017, 8:42am UTC](https://discuss.elastic.co/t/conseils-sur-index-shards/85056 "2017-05-10T08:42:47Z")
Bonjour à tous, Je travaille actuellement sur une architecture ELK avec 3 nodes (2 data node et 1 non data). J’ai des logs de types différents qui sont produits par différentes applications pour différents clients à … --- ## [Grok parse failure. Why?](https://discuss.elastic.co/t/grok-parse-failure-why/78738)
**Author:** [@Nikolay\_Shushkin](https://discuss.elastic.co/u/Nikolay_Shushkin)\ **Replies:** 5\ **Last updated:** [March 27, 2017, 4:29pm UTC](https://discuss.elastic.co/t/grok-parse-failure-why/78738 "2017-03-27T16:29:06Z")
Input data: 11.111.111.11 222.222.22.222 - - \[12/Mar/2017:06:26:47 +0000\] "GET /aaa/bbb/ccc/eng/web/listings?sort=ї"&byStartTime=~1401496140000&byEndTime=1401487200000~&mode=summary&byLocationId=21656615412 HTTP/1.1" 4… --- ## [Indicator Match Detection Rule Error - indicators.map is not a function](https://discuss.elastic.co/t/indicator-match-detection-rule-error-indicators-map-is-not-a-function/280941)
**Author:** [@MakoWish](https://discuss.elastic.co/u/MakoWish)\ **Replies:** 8\ **Last updated:** [August 11, 2021, 3:27pm UTC](https://discuss.elastic.co/t/indicator-match-detection-rule-error-indicators-map-is-not-a-function/280941 "2021-08-11T15:27:48Z")
I have not had any issues with this rule until just this morning, but when I click into an Indicator Match Detection Rule we have, the page seems to start loading just fine, but then it gives an error: Error: indicators… --- ## [Using numbers in conditionals leads to fatal "java.lang.ClassCastException: class org.jruby.RubyFixnum cannot be cast to class java.lang.Long"](https://discuss.elastic.co/t/using-numbers-in-conditionals-leads-to-fatal-java-lang-classcastexception-class-org-jruby-rubyfixnum-cannot-be-cast-to-class-java-lang-long/231962)
**Author:** [@DavidFineboym](https://discuss.elastic.co/u/DavidFineboym)\ **Replies:** 3\ **Last updated:** [May 17, 2020, 2:00pm UTC](https://discuss.elastic.co/t/using-numbers-in-conditionals-leads-to-fatal-java-lang-classcastexception-class-org-jruby-rubyfixnum-cannot-be-cast-to-class-java-lang-long/231962 "2020-05-17T14:00:06Z")
Hi, I'm having trouble with conditional statements that include numbers in them in Logstash 7.6. The same pipeline configuration worked well in Logstash 6.8. I'm using Windows Server 2019 Datacenter, version 1809, and … --- ## [Assigning the date in a CSV column to the timestamp](https://discuss.elastic.co/t/assigning-the-date-in-a-csv-column-to-the-timestamp/142727)
**Author:** [@kolli\_dilip](https://discuss.elastic.co/u/kolli_dilip)\ **Replies:** 3\ **Last updated:** [August 2, 2018, 9:55am UTC](https://discuss.elastic.co/t/assigning-the-date-in-a-csv-column-to-the-timestamp/142727 "2018-08-02T09:55:20Z")
Hi All, Need assistance in assigning the date in a CSV column to the timestamp The sample set of the field is as below The config used is as below and the output is as below in stdout console, where the data is n… --- ## [Kibana Iframe Communicator](https://discuss.elastic.co/t/kibana-iframe-communicator/83037)
**Author:** [@Mehdi\_Chilla](https://discuss.elastic.co/u/Mehdi_Chilla)\ **Replies:** 3\ **Last updated:** [April 21, 2017, 2:10pm UTC](https://discuss.elastic.co/t/kibana-iframe-communicator/83037 "2017-04-21T14:10:18Z")
Hello, I'm start on kibana and javascript and i search how to work the plugin Kibana-Iframe-Communicator . I try to send to my dashboard different filters using windows.postmessage but I do not understand how to form… --- ## [Dateparsefailure - Error in Date value](https://discuss.elastic.co/t/dateparsefailure-error-in-date-value/52326)
**Author:** [@anon45970649](https://discuss.elastic.co/u/anon45970649)\ **Replies:** 3\ **Last updated:** [June 9, 2016, 8:11pm UTC](https://discuss.elastic.co/t/dateparsefailure-error-in-date-value/52326 "2016-06-09T20:11:57Z")
Hello everyone, I'm trying a few days to enter the csv file data, but I have not been able to take the lead in this error in the date field. This message: ←\[33mFailed parsing date from field {:field=\>"Datahora", :valu… --- ## [No. of Shards Per index in ES Cluster](https://discuss.elastic.co/t/no-of-shards-per-index-in-es-cluster/37466)
**Author:** [@Deb](https://discuss.elastic.co/u/Deb)\ **Replies:** 3\ **Last updated:** [December 17, 2015, 7:28pm UTC](https://discuss.elastic.co/t/no-of-shards-per-index-in-es-cluster/37466 "2015-12-17T19:28:28Z")
Can some one let me know how many shards each node can hold to prevent the under/over utilization of ES clusters having 3 Dedicated Data Nodes, 1 Dedicated Master Node & 1 Dedicated Client Node. The cluster is expected t… --- ## [Problem with count](https://discuss.elastic.co/t/problem-with-count/343068)
**Author:** [@arthurrita](https://discuss.elastic.co/u/arthurrita)\ **Replies:** 3\ **Last updated:** [October 2, 2023, 9:03am UTC](https://discuss.elastic.co/t/problem-with-count/343068 "2023-10-02T09:03:54Z")
Hi! I created a visualization with APM dataview, without any filter or aggregations, at this moment I have one value to count property (5598). When I put a date histogram aggregation the count total is bigger than when … --- ## [Weekly index cleanup using curator 5.8](https://discuss.elastic.co/t/weekly-index-cleanup-using-curator-5-8/267354)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 7\ **Last updated:** [March 18, 2021, 2:40pm UTC](https://discuss.elastic.co/t/weekly-index-cleanup-using-curator-5-8/267354 "2021-03-18T14:40:43Z")
I am trying to clean weekly indexes older than 4 weeks on elasticsearch 7.x however not able to figure out the curator config Current config is - filtertype: period period\_type: relative source: name … --- ## [Customized Look and Feel for Kibana](https://discuss.elastic.co/t/customized-look-and-feel-for-kibana/218359)
**Author:** [@Pablo\_Albertengo](https://discuss.elastic.co/u/Pablo_Albertengo)\ **Replies:** 1\ **Last updated:** [February 11, 2020, 12:15pm UTC](https://discuss.elastic.co/t/customized-look-and-feel-for-kibana/218359 "2020-02-11T12:15:45Z")
Hi community! I have the next question... From the Product area of my company pose the following dahsboard. As you will see, the layout has some significant differences with Kibana (custom side menu bar, custom comp… --- ## [Another Way to Stop/Restart Logstash inside 7.3.0 Docker Container?](https://discuss.elastic.co/t/another-way-to-stop-restart-logstash-inside-7-3-0-docker-container/194100)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 1\ **Last updated:** [August 11, 2019, 8:51pm UTC](https://discuss.elastic.co/t/another-way-to-stop-restart-logstash-inside-7-3-0-docker-container/194100 "2019-08-11T20:51:43Z")
Hi Elasticfolk, I’m new to Logstash / Elasticsearch / Kibana, slowly building my first pipeline. I’ve pulled and spun up the Docker 7.3.0 versions of L/E/K. I’m concentrating on Logstash at the moment. So right off t… --- ## [Nothing on 5601](https://discuss.elastic.co/t/nothing-on-5601/114729)
**Author:** [@DarkVodka34](https://discuss.elastic.co/u/DarkVodka34)\ **Replies:** 1\ **Last updated:** [January 9, 2018, 10:05pm UTC](https://discuss.elastic.co/t/nothing-on-5601/114729 "2018-01-09T22:05:58Z")
Very new to linux running ubuntu server and have been following this tut I get nothing on http://10.0.0.249:5601 curl http://localhost:5601 Gives darkvodka34@WebServer:~ netstat -anp | grep 5601 Gives (Not all proc… --- ## [400 Bad Request when trying to reindex Magento 2](https://discuss.elastic.co/t/400-bad-request-when-trying-to-reindex-magento-2/254688)
**Author:** [@StruggleSnuggl3](https://discuss.elastic.co/u/StruggleSnuggl3)\ **Replies:** 2\ **Last updated:** [November 9, 2020, 9:54am UTC](https://discuss.elastic.co/t/400-bad-request-when-trying-to-reindex-magento-2/254688 "2020-11-09T09:54:07Z")
I have a Magento 2 store running with Elasticsearch 7.x and Litemage. I’m getting the following error when trying to run an index job on Magento 2: Design Config Grid index has been rebuilt successfully in 00:00:00 Cus… --- ## [Treat missing data as zero](https://discuss.elastic.co/t/treat-missing-data-as-zero/207137)
**Author:** [@bf31415](https://discuss.elastic.co/u/bf31415)\ **Replies:** 2\ **Last updated:** [November 11, 2019, 7:27pm UTC](https://discuss.elastic.co/t/treat-missing-data-as-zero/207137 "2019-11-11T19:27:08Z")
when defining a visualization, is there a way to treat missing data as zero? i have counter data flowing into elastic but only when the counter has a \>0 value does it get written to elastic. so i might have some counte… --- ## [Fixed time interval in Kibana](https://discuss.elastic.co/t/fixed-time-interval-in-kibana/140054)
**Author:** [@Luan\_Ha\_Thanh](https://discuss.elastic.co/u/Luan_Ha_Thanh)\ **Replies:** 2\ **Last updated:** [July 19, 2018, 12:16pm UTC](https://discuss.elastic.co/t/fixed-time-interval-in-kibana/140054 "2018-07-19T12:16:54Z")
Hello everyone, I want to use Kibana by this scenario: If "This interval creates too many buckets to show in the selected time range, so it's has been scaled to 10 minutes.", the dasboard don't show visualizations. My f… --- ## [Logstash 5.0 :Ruby exception occurred](https://discuss.elastic.co/t/logstash-5-0-ruby-exception-occurred/63562)
**Author:** [@suntuo](https://discuss.elastic.co/u/suntuo)\ **Replies:** 2\ **Last updated:** [October 24, 2016, 7:55am UTC](https://discuss.elastic.co/t/logstash-5-0-ruby-exception-occurred/63562 "2016-10-24T07:55:21Z")
The filter works fine with logstash 2.X, when it upgrade to 5.0 Ruby exception occurred: undefined method \`\[\]' ruby { init =\>"@kname =\['time\_local','jsoncontent'\]" code =\>"event.append(H… --- ## [Extremely slow has\_child query. greater than 10 seconds](https://discuss.elastic.co/t/extremely-slow-has-child-query-greater-than-10-seconds/27218)
**Author:** [@emptyemail](https://discuss.elastic.co/u/emptyemail)\ **Replies:** 2\ **Last updated:** [August 12, 2015, 10:12pm UTC](https://discuss.elastic.co/t/extremely-slow-has-child-query-greater-than-10-seconds/27218 "2015-08-12T22:12:57Z")
Hi. Having trouble scaling has\_child query I am trying to search for all items that haven't been viewed by a user yet. Assumtions: 3 million users 3 million items 10 thousand items viewed per user. We have an i… --- ## [Logstash to handle multiline input from Filebeat](https://discuss.elastic.co/t/logstash-to-handle-multiline-input-from-filebeat/290116)
**Author:** [@grazia0912](https://discuss.elastic.co/u/grazia0912)\ **Replies:** 4\ **Last updated:** [November 25, 2021, 5:25am UTC](https://discuss.elastic.co/t/logstash-to-handle-multiline-input-from-filebeat/290116 "2021-11-25T05:25:28Z")
Hi, Would just like to ask how can Logstash handle multiline from input Filebeat. My filebeat already handles the multiline however the logstash still outputs only the first line. after the \\n all the rest are ignored … --- ## [Bug Report](https://discuss.elastic.co/t/bug-report/190822)
**Author:** [@snorris](https://discuss.elastic.co/u/snorris)\ **Replies:** 4\ **Last updated:** [July 25, 2019, 3:07pm UTC](https://discuss.elastic.co/t/bug-report/190822 "2019-07-25T15:07:39Z")
So I'm sure you all are well aware of the bug in Kibana under the visualizations tab. An error is generated stating that the listing limit of 100 has been exceeded when the listing limit actually defaults to 1000. Now, I… --- ## [Converting 1.7 "terms" with execution "and" query DSL to 2.1.1 due to "terms" breaking changes](https://discuss.elastic.co/t/converting-1-7-terms-with-execution-and-query-dsl-to-2-1-1-due-to-terms-breaking-changes/40291)
**Author:** [@Zelfapp](https://discuss.elastic.co/u/Zelfapp)\ **Replies:** 4\ **Last updated:** [January 31, 2016, 8:07pm UTC](https://discuss.elastic.co/t/converting-1-7-terms-with-execution-and-query-dsl-to-2-1-1-due-to-terms-breaking-changes/40291 "2016-01-31T20:07:10Z")
The following 1.7 Query DSL (php-client formatted) code makes use of the "terms" filter and execution "and" to require all terms to be found in documents. With the "terms" breaking change in 2.1.1 I need to rewrite the q… --- ## [Search in multi\_field type](https://discuss.elastic.co/t/search-in-multi-field-type/28516)
**Author:** [@div\_sriram\_Sriram](https://discuss.elastic.co/u/div_sriram_Sriram)\ **Replies:** 4\ **Last updated:** [September 2, 2015, 12:38pm UTC](https://discuss.elastic.co/t/search-in-multi-field-type/28516 "2015-09-02T12:38:24Z")
Usecase: Typeahead search: I have a question with Multi\_field search, the property with type I have is: content: { type: "string" fields: { raw: { type: "string" … --- ## [Date filter in logstash](https://discuss.elastic.co/t/date-filter-in-logstash/294431)
**Author:** [@MKH](https://discuss.elastic.co/u/MKH)\ **Replies:** 6\ **Last updated:** [January 16, 2022, 7:16pm UTC](https://discuss.elastic.co/t/date-filter-in-logstash/294431 "2022-01-16T19:16:06Z")
Hi, I am trying to use Date filter of the logstash to create a timestamp on my data stored in Elasticsearch. The timestamp in my data is in Linux format and I want to change it to some standard format like as "dd MMM yy… --- ## [Managing loss of master quorum from simultaneous restart of nodes](https://discuss.elastic.co/t/managing-loss-of-master-quorum-from-simultaneous-restart-of-nodes/225112)
**Author:** [@Dandy](https://discuss.elastic.co/u/Dandy)\ **Replies:** 6\ **Last updated:** [April 21, 2020, 4:51am UTC](https://discuss.elastic.co/t/managing-loss-of-master-quorum-from-simultaneous-restart-of-nodes/225112 "2020-04-21T04:51:14Z")
Similar in nature to this: In 7.X I have a scenario where the quorum is lost due to a restart of all the nodes at the same time. All the data is still present, so cluster state is OK. What's the solution to working … --- ## [Query String in Lucene syntax vs Term Filter Performance](https://discuss.elastic.co/t/query-string-in-lucene-syntax-vs-term-filter-performance/173622)
**Author:** [@smlbiobot](https://discuss.elastic.co/u/smlbiobot)\ **Replies:** 6\ **Last updated:** [March 26, 2019, 11:02pm UTC](https://discuss.elastic.co/t/query-string-in-lucene-syntax-vs-term-filter-performance/173622 "2019-03-26T23:02:59Z")
Is there any performance difference if I write out the query string in Lucene syntax vs using the term filter in dicts? In my particular use case, I find it easier to type out my logic in a list and join them with ANDs … --- ## [Is it possible to show videos in Canvas?](https://discuss.elastic.co/t/is-it-possible-to-show-videos-in-canvas/256675)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [November 26, 2020, 8:57am UTC](https://discuss.elastic.co/t/is-it-possible-to-show-videos-in-canvas/256675 "2020-11-26T08:57:41Z")
Hello, So is it possible to show videos in Canvas? (Youtube link) If yes, how would I do that? If no, could this functionality be added? Grtz Willem --- ## [DNS filter couldn't perform reverse lookup](https://discuss.elastic.co/t/dns-filter-couldnt-perform-reverse-lookup/230856)
**Author:** [@ladakalina](https://discuss.elastic.co/u/ladakalina)\ **Replies:** 3\ **Last updated:** [May 4, 2020, 6:00pm UTC](https://discuss.elastic.co/t/dns-filter-couldnt-perform-reverse-lookup/230856 "2020-05-04T18:00:42Z")
Hello everyone! I have a problem with DNS filter in Logstash. Source data: I use logstash to parse ulogd logs from my router (based on Open-wrt). The last problem I faced it's problem with perform reverse lookup IP-add… --- ## [How to change beat output timestamp include timezone info](https://discuss.elastic.co/t/how-to-change-beat-output-timestamp-include-timezone-info/199645)
**Author:** [@varun1992](https://discuss.elastic.co/u/varun1992)\ **Replies:** 3\ **Last updated:** [September 16, 2019, 2:20pm UTC](https://discuss.elastic.co/t/how-to-change-beat-output-timestamp-include-timezone-info/199645 "2019-09-16T14:20:02Z")
I think by default beat timestamp output is UTC time. Is there a way to change time to local time in all the beats ? I tried add\_locale, but it didn't work --- ## [Configuring Synonyms.txt in AWS hosted elastic search](https://discuss.elastic.co/t/configuring-synonyms-txt-in-aws-hosted-elastic-search/196947)
**Author:** [@selvarap1](https://discuss.elastic.co/u/selvarap1)\ **Replies:** 1\ **Last updated:** [August 30, 2019, 4:05pm UTC](https://discuss.elastic.co/t/configuring-synonyms-txt-in-aws-hosted-elastic-search/196947 "2019-08-30T16:05:28Z")
I am trying to upload sysnonyms.txt in AWS hosted elastic search, but I couldn't find any feasible way to do that. All I have tried is the following. I am not supposed to use inline sysnonym, since i have a huge list of… --- ## [Filtering out stop words at search time only](https://discuss.elastic.co/t/filtering-out-stop-words-at-search-time-only/153144)
**Author:** [@newnewb](https://discuss.elastic.co/u/newnewb)\ **Replies:** 1\ **Last updated:** [October 26, 2018, 9:20am UTC](https://discuss.elastic.co/t/filtering-out-stop-words-at-search-time-only/153144 "2018-10-26T09:20:38Z")
Problem: I'm using a simple match query to return some results with filtered stop words. But if a stop word is searched for with a simple match query, it will have 0 hits since it's unable to match stop words which are … --- ## [Represent logstash output in proper json format](https://discuss.elastic.co/t/represent-logstash-output-in-proper-json-format/152185)
**Author:** [@balumurari1](https://discuss.elastic.co/u/balumurari1)\ **Replies:** 1\ **Last updated:** [October 12, 2018, 3:23pm UTC](https://discuss.elastic.co/t/represent-logstash-output-in-proper-json-format/152185 "2018-10-12T15:23:36Z")
How to represent logstash output in proper json format event name represents station name, event id represent station id. How can i combine them to get proper json data My conf file: input { file { path =\> "D:/EL… --- ## [Flatten the json array into field in filter of logstash](https://discuss.elastic.co/t/flatten-the-json-array-into-field-in-filter-of-logstash/135750)
**Author:** [@5b0eafdfbfb313f6ed17](https://discuss.elastic.co/u/5b0eafdfbfb313f6ed17)\ **Replies:** 1\ **Last updated:** [June 13, 2018, 4:43pm UTC](https://discuss.elastic.co/t/flatten-the-json-array-into-field-in-filter-of-logstash/135750 "2018-06-13T16:43:54Z")
Now I have the filed below in Kibana. { "steps": \[ { "stepName": "\*\*\*\*", "values": { "type": "\*\*", "startTime": "\*\*", "total": 0 } }, { "st… --- ## [Increase Logstash Java heap-size on Ubuntu 16.10](https://discuss.elastic.co/t/increase-logstash-java-heap-size-on-ubuntu-16-10/120825)
**Author:** [@Ryan\_Grannell](https://discuss.elastic.co/u/Ryan_Grannell)\ **Replies:** 1\ **Last updated:** [February 21, 2018, 11:35am UTC](https://discuss.elastic.co/t/increase-logstash-java-heap-size-on-ubuntu-16-10/120825 "2018-02-21T11:35:48Z")
Hi, We're currently running into problems where our Logstash VM is hitting the Java heap-size limit, despite having a large amount of free RAM on the VM. \[image\] {"level":"ERROR","loggerName":"logstash.filters.grok","… --- ## [Elasticfence - Invalid User](https://discuss.elastic.co/t/elasticfence-invalid-user/53020)
**Author:** [@parthu](https://discuss.elastic.co/u/parthu)\ **Replies:** 1\ **Last updated:** [June 17, 2016, 10:02am UTC](https://discuss.elastic.co/t/elasticfence-invalid-user/53020 "2016-06-17T10:02:36Z")
I have installed the plugin "Elasticfence" (for Basic HTTP Auth for my ES 2.3.2). And wrote the following two lines in my elasticsearch.yml: elasticfence.disabled: false elasticfence.root.password: rootpassword When… --- ## [Amazon Elasticsearch Service without port](https://discuss.elastic.co/t/amazon-elasticsearch-service-without-port/51845)
**Author:** [@shantanuo](https://discuss.elastic.co/u/shantanuo)\ **Replies:** 1\ **Last updated:** [June 5, 2016, 5:24pm UTC](https://discuss.elastic.co/t/amazon-elasticsearch-service-without-port/51845 "2016-06-05T17:24:40Z")
packetbeat configuration file adds the port 9200 to the URL. But Amazon Elasticsearch service does not use that port. In fact there is no port but https needs to be used. How do I configure packetbeat.yml file to connect… --- ## [How to find polygons that contain a given point in Elasticsearch](https://discuss.elastic.co/t/how-to-find-polygons-that-contain-a-given-point-in-elasticsearch/343769)
**Author:** [@Pranav\_Kapur](https://discuss.elastic.co/u/Pranav_Kapur)\ **Replies:** 5\ **Last updated:** [September 25, 2023, 4:05pm UTC](https://discuss.elastic.co/t/how-to-find-polygons-that-contain-a-given-point-in-elasticsearch/343769 "2023-09-25T16:05:57Z")
I need to build a query on a database with around 50k terrain polygons (stored as geo\_shape polygons on ES) where I give a point and it returns every polygon that contains this point. I tried to create it, but getting i… --- ## [Improving log ingestion speed and faster elasticsearch indexing](https://discuss.elastic.co/t/improving-log-ingestion-speed-and-faster-elasticsearch-indexing/285841)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 5\ **Last updated:** [October 4, 2021, 7:23pm UTC](https://discuss.elastic.co/t/improving-log-ingestion-speed-and-faster-elasticsearch-indexing/285841 "2021-10-04T19:23:37Z")
Hello, I currently have a single node set up (a single machine where E-L-K is installed ) where a couple of gzip files are being ingested , each of these files would be of ~600MB and has several thousand lines of logs… --- ## [Creating alert when event didn't occur](https://discuss.elastic.co/t/creating-alert-when-event-didnt-occur/282195)
**Author:** [@Marduuk](https://discuss.elastic.co/u/Marduuk)\ **Replies:** 5\ **Last updated:** [August 24, 2021, 5:44am UTC](https://discuss.elastic.co/t/creating-alert-when-event-didnt-occur/282195 "2021-08-24T05:44:46Z")
Hey, For past few days I have been trying to create a rule that will trigger when something doesn't happen. So let's say we have two executables, malware.exe and antivirus.exe. I want to write a rule that would trigger … --- ## [Aggregation 504 bad gateway](https://discuss.elastic.co/t/aggregation-504-bad-gateway/251740)
**Author:** [@Liyes](https://discuss.elastic.co/u/Liyes)\ **Replies:** 5\ **Last updated:** [October 14, 2020, 2:13am UTC](https://discuss.elastic.co/t/aggregation-504-bad-gateway/251740 "2020-10-14T02:13:44Z")
When I use script to do aggregation and want to find two documents with the same fields in es, 504 bad gateway. Maybe it is caused by too much data. Is there any solution? I used partition. { "size": 0, "aggs": { … --- ## [How to update Lucene version of an huge indices?](https://discuss.elastic.co/t/how-to-update-lucene-version-of-an-huge-indices/247460)
**Author:** [@Thek10patil](https://discuss.elastic.co/u/Thek10patil)\ **Replies:** 5\ **Last updated:** [September 4, 2020, 8:44pm UTC](https://discuss.elastic.co/t/how-to-update-lucene-version-of-an-huge-indices/247460 "2020-09-04T20:44:19Z")
Hello Geeks, I have 10 indices of 2 TB size each on ES 7.7 version. Lucene version of those indices is around 7.x. I want to update Lucene version of these indices to latest version that is 8.5? I am aware of following… --- ## [Kibana 6.2.3 -\> 6.2.4: Error: Invalid dimensions for plot, width = 473, height = 0](https://discuss.elastic.co/t/kibana-6-2-3-6-2-4-error-invalid-dimensions-for-plot-width-473-height-0/129140)
**Author:** [@diranged](https://discuss.elastic.co/u/diranged)\ **Replies:** 5\ **Last updated:** [April 23, 2018, 8:15pm UTC](https://discuss.elastic.co/t/kibana-6-2-3-6-2-4-error-invalid-dimensions-for-plot-width-473-height-0/129140 "2018-04-23T20:15:56Z")
We recently upgraded from ES 6.2.3 -\> 6.2.4 due to a leaky file handle issue (Open File Handles leaking on 6.2.3 nodes..?). To keep Kibana happy, we upgraded it as well to 6.2.4. We have a new issue now though - the Kib… --- ## [How to achieve Clusters in Logstash?](https://discuss.elastic.co/t/how-to-achieve-clusters-in-logstash/108387)
**Author:** [@akshay](https://discuss.elastic.co/u/akshay)\ **Replies:** 5\ **Last updated:** [November 21, 2017, 8:21am UTC](https://discuss.elastic.co/t/how-to-achieve-clusters-in-logstash/108387 "2017-11-21T08:21:23Z")
Hello, Following is the deployment scenario. We are using ELK stack (ElasticSearch,Logstash and Kibana for UI) Elastic Search will be deployed on 3 nodes which form one Cluster. We also want to Cluster Logstash which… --- ## [Searching boolean keys within nested object in Elasticsearch](https://discuss.elastic.co/t/searching-boolean-keys-within-nested-object-in-elasticsearch/27779)
**Author:** [@sach](https://discuss.elastic.co/u/sach)\ **Replies:** 5\ **Last updated:** [August 20, 2015, 11:03pm UTC](https://discuss.elastic.co/t/searching-boolean-keys-within-nested-object-in-elasticsearch/27779 "2015-08-20T23:03:04Z")
I have "user" object and it has nested object "status" which has few boolean flags. I am able to search with name and phone values. I need to search all the users which has that boolean flag. For example search all users… --- ## [How can I check loglevel with use of If else condition in logstash filter?](https://discuss.elastic.co/t/how-can-i-check-loglevel-with-use-of-if-else-condition-in-logstash-filter/250844)
**Author:** [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\ **Replies:** 2\ **Last updated:** [October 3, 2020, 7:34am UTC](https://discuss.elastic.co/t/how-can-i-check-loglevel-with-use-of-if-else-condition-in-logstash-filter/250844 "2020-10-03T07:34:08Z")
filter{ # 1. for LogLevel.Error logs grok{ match=\> \["message","%{DATESTAMP:timestamp} %{LOGLEVEL:level} %{USERNAME:logger} %{USER:user} %{URI:url} %{USER:method} %{IPV4:clientIp} %{GREEDYDATA:message}"\] } # 2. for… --- ## [Sql\_last\_value getting reset](https://discuss.elastic.co/t/sql-last-value-getting-reset/141478)
**Author:** [@Sunil\_Khullar](https://discuss.elastic.co/u/Sunil_Khullar)\ **Replies:** 2\ **Last updated:** [July 25, 2018, 9:16am UTC](https://discuss.elastic.co/t/sql-last-value-getting-reset/141478 "2018-07-25T09:16:32Z")
It seems the variable sql\_last\_value gets reset everytime we restart logstash, instead of reading from the value stored in the file defined in last\_run\_metadata\_path is this the correct behavior? or is something wrong? … [Previous page](https://discuss.elastic.co/top.md?page=1138&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1140&per_page=50&period=all)