# Top

**URL:** https://discuss.elastic.co/top.md?page=1144&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1145

---

## [Watcher to Index](https://discuss.elastic.co/t/watcher-to-index/44669)

<div class="topic-metadata">

**Author:** [@gringo](https://discuss.elastic.co/u/gringo)\
**Replies:** 3\
**Last updated:** [March 21, 2016, 7:41am UTC](https://discuss.elastic.co/t/watcher-to-index/44669 "2016-03-21T07:41:04Z")

</div>

Watcher keep adding records to the index even when there is no change to the data.

---

## [What are the criteria for transaction&span?](https://discuss.elastic.co/t/what-are-the-criteria-for-transaction-span/218876)

<div class="topic-metadata">

**Author:** [@Yungyoung\_Ok](https://discuss.elastic.co/u/Yungyoung_Ok)\
**Replies:** 5\
**Last updated:** [February 26, 2020, 4:16pm UTC](https://discuss.elastic.co/t/what-are-the-criteria-for-transaction-span/218876 "2020-02-26T16:16:31Z")

</div>

Kibana version: 7.5.2 Elasticsearch version: 7.5.2 APM Server version: 7.5.2 APM Agent language and version: java agent 1.12 I know that one transaction is generated for every http request. So how is a transaction…

---

## [Best practice to organize Grok patterns in production](https://discuss.elastic.co/t/best-practice-to-organize-grok-patterns-in-production/36615)

<div class="topic-metadata">

**Author:** [@Krzysztof](https://discuss.elastic.co/u/Krzysztof)\
**Replies:** 1\
**Last updated:** [December 8, 2015, 11:55am UTC](https://discuss.elastic.co/t/best-practice-to-organize-grok-patterns-in-production/36615 "2015-12-08T11:55:59Z")

</div>

Hello, In our system we're progressing with ELK stack usage on a larger scale. We're are about to connect a large amount of systems and almost all of them require a custom Grok pattern for log parsing. I'm wondering wh…

---

## [Kibana logs?](https://discuss.elastic.co/t/kibana-logs/26058)

<div class="topic-metadata">

**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\
**Replies:** 1\
**Last updated:** [July 22, 2015, 10:01am UTC](https://discuss.elastic.co/t/kibana-logs/26058 "2015-07-22T10:01:13Z")

</div>

Hi, I am running kibana4 with command sudo nohup ./kibana, which create nohup.log. I want kibana to run in the background and logs to be created in some file /var/log/kibana.log Please guide me how to achieve it. thank…

---

## [Unable to install Elastic Agent 7.17.5 (Windows)](https://discuss.elastic.co/t/unable-to-install-elastic-agent-7-17-5-windows/311284)

<div class="topic-metadata">

**Author:** [@sirineb](https://discuss.elastic.co/u/sirineb)\
**Replies:** 2\
**Last updated:** [August 25, 2022, 12:19pm UTC](https://discuss.elastic.co/t/unable-to-install-elastic-agent-7-17-5-windows/311284 "2022-08-25T12:19:35Z")

</div>

Hi everyone, I have an issue trying to enroll elastic agent 7.17.5 in Windows. (My fleet server is 7.17.5 too) The first time I installed it, it worked perfectly but due to a storage issue on the machine that hosts ELK,…

---

## [Duplicate logs in kibana](https://discuss.elastic.co/t/duplicate-logs-in-kibana/301945)

<div class="topic-metadata">

**Author:** [@Dmitriy\_Esin](https://discuss.elastic.co/u/Dmitriy_Esin)\
**Replies:** 2\
**Last updated:** [April 11, 2022, 11:37am UTC](https://discuss.elastic.co/t/duplicate-logs-in-kibana/301945 "2022-04-11T11:37:51Z")

</div>

Hello, I have an issue: Logs injects more than one time. It has different IDs but log contains the same data: I use FluentD to collect logs from the k8s cluster with this config: extraConfigMaps: containe…

---

## [Change interval while viewing a dashboard, without editing?](https://discuss.elastic.co/t/change-interval-while-viewing-a-dashboard-without-editing/279158)

<div class="topic-metadata">

**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\
**Replies:** 2\
**Last updated:** [July 21, 2021, 7:50am UTC](https://discuss.elastic.co/t/change-interval-while-viewing-a-dashboard-without-editing/279158 "2021-07-21T07:50:26Z")

</div>

Background to this question Feedback from a user viewing a Kibana dashboard I've developed: can we set the interval of time-based charts to 1 hour? An excerpt of my response: Yes. However, I have deliberately set t…

---

## [How the heck do you setup the default password?](https://discuss.elastic.co/t/how-the-heck-do-you-setup-the-default-password/126267)

<div class="topic-metadata">

**Author:** [@craigvphillips](https://discuss.elastic.co/u/craigvphillips)\
**Replies:** 2\
**Last updated:** [April 5, 2018, 5:45pm UTC](https://discuss.elastic.co/t/how-the-heck-do-you-setup-the-default-password/126267 "2018-04-05T17:45:02Z")

</div>

I download elastic 6.1.4 Unzip elastic 6.1.4 install x-pack start elasticsearch 6.1.4 run setup-passwords auto Unexpected response code \[403\] from calling GET http://127.0.0.1:9200/\_xpack/security/\_authenticate?pret…

---

## [Graph API not working](https://discuss.elastic.co/t/graph-api-not-working/73797)

<div class="topic-metadata">

**Author:** [@ahr12](https://discuss.elastic.co/u/ahr12)\
**Replies:** 2\
**Last updated:** [February 3, 2017, 11:17am UTC](https://discuss.elastic.co/t/graph-api-not-working/73797 "2017-02-03T11:17:05Z")

</div>

I use graph Java API. but I am getting the NullPointerException Errors. This is my code -\> package org.formcept.orient; //import java.net.InetAddress; import java.net.InetAddress; import java.util.Collection; import or…

---

## [Modify Color on Tile Map](https://discuss.elastic.co/t/modify-color-on-tile-map/33854)

<div class="topic-metadata">

**Author:** [@sylv](https://discuss.elastic.co/u/sylv)\
**Replies:** 2\
**Last updated:** [June 6, 2016, 6:46am UTC](https://discuss.elastic.co/t/modify-color-on-tile-map/33854 "2016-06-06T06:46:25Z")

</div>

hello, is there someone who knows how to modify the color on tile map ? I want to cretae 3 diff group of towns but http doesn't give color choice.. thanks

---

## [Calculating Average of Average](https://discuss.elastic.co/t/calculating-average-of-average/31366)

<div class="topic-metadata">

**Author:** [@Pradeep\_Gowda](https://discuss.elastic.co/u/Pradeep_Gowda)\
**Replies:** 2\
**Last updated:** [September 30, 2015, 3:37pm UTC](https://discuss.elastic.co/t/calculating-average-of-average/31366 "2015-09-30T15:37:38Z")

</div>

Hello Everyone, I am trying to calculate Average of Average for the below data. First I want to group the items and calculate the average of values. In the next Iteration, I want to calculate the average of the avera…

---

## [Some questions about customHeaders in kibana.yml](https://discuss.elastic.co/t/some-questions-about-customheaders-in-kibana-yml/82865)

<div class="topic-metadata">

**Author:** [@star90](https://discuss.elastic.co/u/star90)\
**Replies:** 0\
**Last updated:** [April 19, 2017, 10:37am UTC](https://discuss.elastic.co/t/some-questions-about-customheaders-in-kibana-yml/82865 "2017-04-19T10:37:15Z")

</div>

what is the right format of elasticsearch.customHeaders? and is there an easy way to check whether the header has been added to the httprequest?

---

## [Detection Rules on previous past element](https://discuss.elastic.co/t/detection-rules-on-previous-past-element/357772)

<div class="topic-metadata">

**Author:** [@Ragn](https://discuss.elastic.co/u/Ragn)\
**Replies:** 1\
**Last updated:** [April 19, 2024, 11:25am UTC](https://discuss.elastic.co/t/detection-rules-on-previous-past-element/357772 "2024-04-19T11:25:00Z")

</div>

Hello, I'm facing a problem with detection rules on a stack ELK. I need to upload events from past timestamp and check it with detection rules. For example, I will upload a ton of event that look like this: {"timesta…

---

## [Remove wildcard fields in logstash](https://discuss.elastic.co/t/remove-wildcard-fields-in-logstash/248173)

<div class="topic-metadata">

**Author:** [@Yanick\_Quirion](https://discuss.elastic.co/u/Yanick_Quirion)\
**Replies:** 4\
**Last updated:** [September 10, 2020, 5:40pm UTC](https://discuss.elastic.co/t/remove-wildcard-fields-in-logstash/248173 "2020-09-10T17:40:10Z")

</div>

Hello, I have this data: "winlog" =\> { "channel" =\> "Security", "record\_id" =\> 1401770357, "event\_data" =\> { "param14" =\> "-", "param9" =\> "-", "param21" =\> "-", "param13" =\> …

---

## [Need help with grok pattern for logstash config file for Oracle Alert log](https://discuss.elastic.co/t/need-help-with-grok-pattern-for-logstash-config-file-for-oracle-alert-log/232313)

<div class="topic-metadata">

**Author:** [@Gaurav\_Batta](https://discuss.elastic.co/u/Gaurav_Batta)\
**Replies:** 4\
**Last updated:** [May 13, 2020, 6:22pm UTC](https://discuss.elastic.co/t/need-help-with-grok-pattern-for-logstash-config-file-for-oracle-alert-log/232313 "2020-05-13T18:22:41Z")

</div>

Please help with grok pattern for following Oracle Database Alert.log message below to trap ORA- errors and its timestamp using logstash. Oracle Database alert log has following error log messages: ORA-12222: Test erro…

---

## [Multiple Clusters on the Same Network](https://discuss.elastic.co/t/multiple-clusters-on-the-same-network/75155)

<div class="topic-metadata">

**Author:** [@Onur](https://discuss.elastic.co/u/Onur)\
**Replies:** 1\
**Last updated:** [February 15, 2017, 8:12am UTC](https://discuss.elastic.co/t/multiple-clusters-on-the-same-network/75155 "2017-02-15T08:12:07Z")

</div>

Hello elasticsearch family I have a question and would like to hear your opinion on this. We have a server machine (elasticsearch service with 1 node only), and I have my personal PC on the same network. I was wonderin…

---

## [Replay old events as if they were new?](https://discuss.elastic.co/t/replay-old-events-as-if-they-were-new/268218)

<div class="topic-metadata">

**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\
**Replies:** 5\
**Last updated:** [March 26, 2021, 4:58pm UTC](https://discuss.elastic.co/t/replay-old-events-as-if-they-were-new/268218 "2021-03-26T16:58:01Z")

</div>

Suppose I have: A Kibana dashboard that shows the last few minutes, automatically refreshing every few seconds A Logstash config that reads JSON Lines from a file (via stdin), sets the event timestamp to the value of a…

---

## [Snmp v3 logstash not working in pipeline](https://discuss.elastic.co/t/snmp-v3-logstash-not-working-in-pipeline/254940)

<div class="topic-metadata">

**Author:** [@BenoitSERRA](https://discuss.elastic.co/u/BenoitSERRA)\
**Replies:** 5\
**Last updated:** [November 11, 2020, 9:48am UTC](https://discuss.elastic.co/t/snmp-v3-logstash-not-working-in-pipeline/254940 "2020-11-11T09:48:56Z")

</div>

Hello, I'm struggling with a strange problem with Logstash. I've created a config to query a few switches with SNMP v3 et get targeted interfaces statistics When I run logstash with the config file, everything works f…

---

## [Uninstalling ECK - hangs forever](https://discuss.elastic.co/t/uninstalling-eck-hangs-forever/215521)

<div class="topic-metadata">

**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\
**Replies:** 5\
**Last updated:** [March 5, 2020, 4:30pm UTC](https://discuss.elastic.co/t/uninstalling-eck-hangs-forever/215521 "2020-03-05T16:30:25Z")

</div>

Hello World! I'm tried to follow Uninstalling ECK | Elastic Cloud on Kubernetes \[1.0\] | Elastic, however bellow commands hangs forever: $ kubectl get namespaces --no-headers -o custom-columns=:metadata.name \\ \> | xargs…

---

## [How to enable Region Map in kibana7.6](https://discuss.elastic.co/t/how-to-enable-region-map-in-kibana7-6/220444)

<div class="topic-metadata">

**Author:** [@saiteja](https://discuss.elastic.co/u/saiteja)\
**Replies:** 5\
**Last updated:** [February 24, 2020, 9:06pm UTC](https://discuss.elastic.co/t/how-to-enable-region-map-in-kibana7-6/220444 "2020-02-24T21:06:28Z")

</div>

Hello, How to enable region map in kibana 7.6.0 I see in the documentation that xpack.maps.showMapVisualizationTypes to true I am not sure though where to add this. Thank you

---

## [JSON codec polluting logs with ERROR messages if input is plain string](https://discuss.elastic.co/t/json-codec-polluting-logs-with-error-messages-if-input-is-plain-string/184356)

<div class="topic-metadata">

**Author:** [@Ivan\_Smurygin](https://discuss.elastic.co/u/Ivan_Smurygin)\
**Replies:** 5\
**Last updated:** [June 5, 2019, 3:46pm UTC](https://discuss.elastic.co/t/json-codec-polluting-logs-with-error-messages-if-input-is-plain-string/184356 "2019-06-05T15:46:54Z")

</div>

Hello. I have a question about Generally we use the codec and it works fine. Our application has logs like { "profile": "dev", "logging-context": "default", "hostname": "xxx", "app": "xxx", "@time…

---

## [Canvas Bar charts : bars not always displaued in the same order](https://discuss.elastic.co/t/canvas-bar-charts-bars-not-always-displaued-in-the-same-order/169253)

<div class="topic-metadata">

**Author:** [@Ranakel](https://discuss.elastic.co/u/Ranakel)\
**Replies:** 5\
**Last updated:** [February 21, 2019, 10:27pm UTC](https://discuss.elastic.co/t/canvas-bar-charts-bars-not-always-displaued-in-the-same-order/169253 "2019-02-21T22:27:26Z")

</div>

Hi, I have a bar chart in a workpad canvas in which I also have a control menu to apply a filter on my workpad. When I use this control , my values are correctly uptdated in the bar chart but the order of the bars some…

---

## [How to maintain the order in which records are read](https://discuss.elastic.co/t/how-to-maintain-the-order-in-which-records-are-read/91015)

<div class="topic-metadata">

**Author:** [@Tejas\_Ghutukade](https://discuss.elastic.co/u/Tejas_Ghutukade)\
**Replies:** 5\
**Last updated:** [June 28, 2017, 6:06am UTC](https://discuss.elastic.co/t/how-to-maintain-the-order-in-which-records-are-read/91015 "2017-06-28T06:06:45Z")

</div>

M trying to read a csv file which is sorted by time-stamp. m trying to add a field with incremental value as per the ascending order of time-stamp But the incremental value is getting assigned in random order to the …

---

## [Elasticsearch service won't start](https://discuss.elastic.co/t/elasticsearch-service-wont-start/236591)

<div class="topic-metadata">

**Author:** [@ckunkel](https://discuss.elastic.co/u/ckunkel)\
**Replies:** 1\
**Last updated:** [June 11, 2020, 1:11am UTC](https://discuss.elastic.co/t/elasticsearch-service-wont-start/236591 "2020-06-11T01:11:40Z")

</div>

I started out by installing jdk-14.0.1 and setting JAVA\_HOME environment variable to C:\\Program Files\\Java\\jdk-14.0.1 elasticsearch-service install worked, but the service won't start. Logs say \[2020-06-10 03:10:14\] …

---

## [Previously stable Packer builds for Kibana now failing silently to run the service returning 503s only](https://discuss.elastic.co/t/previously-stable-packer-builds-for-kibana-now-failing-silently-to-run-the-service-returning-503s-only/161869)

<div class="topic-metadata">

**Author:** [@BenH](https://discuss.elastic.co/u/BenH)\
**Replies:** 7\
**Last updated:** [December 26, 2018, 10:29pm UTC](https://discuss.elastic.co/t/previously-stable-packer-builds-for-kibana-now-failing-silently-to-run-the-service-returning-503s-only/161869 "2018-12-26T22:29:39Z")

</div>

I've got a simple setup with Jenkins using Packer to pull down, install, and configure Kibana. The base code I used can be found here: https://github.com/synhershko/elasticsearch-cloud-deploy/ This has actually been run…

---

## [Large Array Performance Optimization, Resource Costs](https://discuss.elastic.co/t/large-array-performance-optimization-resource-costs/146279)

<div class="topic-metadata">

**Author:** [@tecfu](https://discuss.elastic.co/u/tecfu)\
**Replies:** 1\
**Last updated:** [August 28, 2018, 2:14pm UTC](https://discuss.elastic.co/t/large-array-performance-optimization-resource-costs/146279 "2018-08-28T14:14:04Z")

</div>

I'm interested in discovering how to optimize Elasticsearch. Requirements: \[1\] Using an index that contains 100,000 documents. \[2\] Each document contains 2 fields: "id", "my\_array" \[3\] MATCH a KEYWORD against the "myA…

---

## [Index discussion - to split or not to split](https://discuss.elastic.co/t/index-discussion-to-split-or-not-to-split/117110)

<div class="topic-metadata">

**Author:** [@dorj1234](https://discuss.elastic.co/u/dorj1234)\
**Replies:** 1\
**Last updated:** [January 25, 2018, 8:37pm UTC](https://discuss.elastic.co/t/index-discussion-to-split-or-not-to-split/117110 "2018-01-25T20:37:47Z")

</div>

Hello, General question here, no problem to solve. Thanks in advance for your insights! Everywhere in the forums I see people creating documents on indexes, and those indexes are date-based. For example: index =\> "b…

---

## [Associating LDAP Roles to Tags](https://discuss.elastic.co/t/associating-ldap-roles-to-tags/107246)

<div class="topic-metadata">

**Author:** [@djtecha](https://discuss.elastic.co/u/djtecha)\
**Replies:** 7\
**Last updated:** [November 13, 2017, 9:48pm UTC](https://discuss.elastic.co/t/associating-ldap-roles-to-tags/107246 "2017-11-13T21:48:59Z")

</div>

I'm trying to use the list of Roles associated to an ldap user as a DLS security option. Currently we mark logs with tags upstream and I'm trying to use the template that's in your docs. I have gotten certain things to m…

---

## [Painless is a pain in my head](https://discuss.elastic.co/t/painless-is-a-pain-in-my-head/85612)

<div class="topic-metadata">

**Author:** [@mvleandro](https://discuss.elastic.co/u/mvleandro)\
**Replies:** 1\
**Last updated:** [May 12, 2017, 9:54pm UTC](https://discuss.elastic.co/t/painless-is-a-pain-in-my-head/85612 "2017-05-12T21:54:26Z")

</div>

Hello everyone! I am trying to start to use the painless language. I created a String field with just de follow code: if (true) { return 'R$ XX,xx' + doc\['AdditionalData.ResponseMessage.AmountAuthorized'\].valu…

---

## [I was deploying docker and ran into a problem, unable to access port 3002](https://discuss.elastic.co/t/i-was-deploying-docker-and-ran-into-a-problem-unable-to-access-port-3002/343197)

<div class="topic-metadata">

**Author:** [@qinskysky](https://discuss.elastic.co/u/qinskysky)\
**Replies:** 6\
**Last updated:** [September 19, 2023, 12:18am UTC](https://discuss.elastic.co/t/i-was-deploying-docker-and-ran-into-a-problem-unable-to-access-port-3002/343197 "2023-09-19T00:18:07Z")

</div>

Add the Enterprise Search host URL to the Kibana configuration In the config/kibana.yml file, set enterpriseSearch.host to the URL of the Enterprise Search instance. For example: enterpriseSearch.host: 'http://localhos…

---

## [How Translog Work on elastic](https://discuss.elastic.co/t/how-translog-work-on-elastic/325880)

<div class="topic-metadata">

**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\
**Replies:** 6\
**Last updated:** [March 11, 2023, 10:35am UTC](https://discuss.elastic.co/t/how-translog-work-on-elastic/325880 "2023-03-11T10:35:29Z")

</div>

Hi everyone, I have a question about translog. So here is the situation: I have one index with 1 primary and 1 replica shard and continuously ingesting data. If i read documentation, it says that primary and replica sh…

---

## [Elasticsearch Vulnerabilities](https://discuss.elastic.co/t/elasticsearch-vulnerabilities/258021)

<div class="topic-metadata">

**Author:** [@TerryQ](https://discuss.elastic.co/u/TerryQ)\
**Replies:** 6\
**Last updated:** [December 8, 2020, 4:55pm UTC](https://discuss.elastic.co/t/elasticsearch-vulnerabilities/258021 "2020-12-08T16:55:03Z")

</div>

Do these security vulnerabilities apply to the OSS distributions of Elasticsearch? From https://www.elastic.co/community/security/ Thanks

---

## [How to Delete all entries for a particular coloumn](https://discuss.elastic.co/t/how-to-delete-all-entries-for-a-particular-coloumn/53783)

<div class="topic-metadata">

**Author:** [@Rajeev\_Gaurav](https://discuss.elastic.co/u/Rajeev_Gaurav)\
**Replies:** 6\
**Last updated:** [June 24, 2016, 7:26am UTC](https://discuss.elastic.co/t/how-to-delete-all-entries-for-a-particular-coloumn/53783 "2016-06-24T07:26:42Z")

</div>

Hi, I want to delete all entries for the Date as 2016-02-11. How can I achieve this . I tried DELETE //\_query?q=Date:2016-02-11 but it is giving response as :slight\_smile: { "found": false, "\_index": \<"indexname\>…

---

## [How to change ctx.trigger.trigerred\_time to CST](https://discuss.elastic.co/t/how-to-change-ctx-trigger-trigerred-time-to-cst/308525)

<div class="topic-metadata">

**Author:** [@ABHISHEK\_NEGI](https://discuss.elastic.co/u/ABHISHEK_NEGI)\
**Replies:** 1\
**Last updated:** [June 30, 2022, 1:06am UTC](https://discuss.elastic.co/t/how-to-change-ctx-trigger-trigerred-time-to-cst/308525 "2022-06-30T01:06:51Z")

</div>

I'm passing the ctx.trigger.trigerred\_time in subject of my email in kibana watcher but it is showing time is UTC when i receive the email. how to chane it to CST?

---

## [Input field - comments on documents](https://discuss.elastic.co/t/input-field-comments-on-documents/181119)

<div class="topic-metadata">

**Author:** [@MarkusT](https://discuss.elastic.co/u/MarkusT)\
**Replies:** 4\
**Last updated:** [May 15, 2019, 11:35am UTC](https://discuss.elastic.co/t/input-field-comments-on-documents/181119 "2019-05-15T11:35:18Z")

</div>

Dear es Team and Community, is there a possibility to add an input field to a visualization or a dashboard? I want some comment field, where the input is appended to the document as text (and loaded during dashboard sta…

---

## [Kibana 7.1.1 - Visual Builder vs Filters](https://discuss.elastic.co/t/kibana-7-1-1-visual-builder-vs-filters/233032)

<div class="topic-metadata">

**Author:** [@JimJ](https://discuss.elastic.co/u/JimJ)\
**Replies:** 8\
**Last updated:** [May 29, 2020, 6:19am UTC](https://discuss.elastic.co/t/kibana-7-1-1-visual-builder-vs-filters/233032 "2020-05-29T06:19:20Z")

</div>

Hi everybody, I got a strange behavior in the Visualize part. One of my colleague complained because he did not see the Filters bar anymore in the Visual Builder. I said it is normal because this part does not display…

---

## [Transport client throwing NPE when closing](https://discuss.elastic.co/t/transport-client-throwing-npe-when-closing/176648)

<div class="topic-metadata">

**Author:** [@Chris\_Gatihi](https://discuss.elastic.co/u/Chris_Gatihi)\
**Replies:** 8\
**Last updated:** [April 15, 2019, 2:46pm UTC](https://discuss.elastic.co/t/transport-client-throwing-npe-when-closing/176648 "2019-04-15T14:46:52Z")

</div>

Hi, I'm using ES and Transport 5.5.2 and getting an NPE thrown when closing the transport client: // Shut down existing client if open if (client != null) { logger.info("Detected open Transport client - closi…

---

## [Can I use filter inside filter?](https://discuss.elastic.co/t/can-i-use-filter-inside-filter/163259)

<div class="topic-metadata">

**Author:** [@et159](https://discuss.elastic.co/u/et159)\
**Replies:** 8\
**Last updated:** [February 2, 2019, 4:15pm UTC](https://discuss.elastic.co/t/can-i-use-filter-inside-filter/163259 "2019-02-02T16:15:57Z")

</div>

I had a logstash configuration as below : input { 3 input sources } filter { if \[field\] \[source\]== "source1" { do .... } else \[field\] \[source\]== "source2" { do .... } else…

---

## [Vegalite integration with Kibana](https://discuss.elastic.co/t/vegalite-integration-with-kibana/122439)

<div class="topic-metadata">

**Author:** [@paul1243](https://discuss.elastic.co/u/paul1243)\
**Replies:** 8\
**Last updated:** [March 12, 2018, 11:20pm UTC](https://discuss.elastic.co/t/vegalite-integration-with-kibana/122439 "2018-03-12T23:20:28Z")

</div>

Hi, I've tried creating a Visualization with Vega, I've the response something like below, how do I create a property for the highlighted data. Could someone please help. "took": 765, "timed\_out": false, "\_shards": { …

---

## [More thread pool and circuit breaker metrics](https://discuss.elastic.co/t/more-thread-pool-and-circuit-breaker-metrics/80943)

<div class="topic-metadata">

**Author:** [@wyukawa](https://discuss.elastic.co/u/wyukawa)\
**Replies:** 3\
**Last updated:** [April 11, 2017, 9:10am UTC](https://discuss.elastic.co/t/more-thread-pool-and-circuit-breaker-metrics/80943 "2017-04-11T09:10:14Z")

</div>

Hi, I use Elastic Stack 5.3 If X-Pack Monitoring has thread pool aggregate stats(for example, max bulk queue size between the nodes) in overview and has circuit breaker metrics, it would be nice.

---

## [Snapshot & Restore in a cluster of two nodes](https://discuss.elastic.co/t/snapshot-restore-in-a-cluster-of-two-nodes/18211)

<div class="topic-metadata">

**Author:** [@Daniel\_Bubenheim](https://discuss.elastic.co/u/Daniel_Bubenheim)\
**Replies:** 3\
**Last updated:** [June 30, 2014, 7:17am UTC](https://discuss.elastic.co/t/snapshot-restore-in-a-cluster-of-two-nodes/18211 "2014-06-30T07:17:36Z")

</div>

Hello, we have a cluster of two nodes. Every index in this cluster consists of 2 shards and one replica. We want to make use of snapshots & restore to transfer data between two clusters. When we make our snapshot…

---

## [When do the delete happen in the lifecycle policy](https://discuss.elastic.co/t/when-do-the-delete-happen-in-the-lifecycle-policy/335798)

<div class="topic-metadata">

**Author:** [@vinbeau](https://discuss.elastic.co/u/vinbeau)\
**Replies:** 2\
**Last updated:** [June 13, 2023, 8:23am UTC](https://discuss.elastic.co/t/when-do-the-delete-happen-in-the-lifecycle-policy/335798 "2023-06-13T08:23:25Z")

</div>

Hello all, I'm having a hard time finding a clear answer about this, sorry if it was already answered elsewhere: I have an index lifecycle policy setup to rollover the hot phase with a max age of 7 days. There are no …

---

## [Json parse exception with status 500 post upgrade to 7.4.0](https://discuss.elastic.co/t/json-parse-exception-with-status-500-post-upgrade-to-7-4-0/201936)

<div class="topic-metadata">

**Author:** [@starrynight](https://discuss.elastic.co/u/starrynight)\
**Replies:** 2\
**Last updated:** [October 2, 2019, 12:05pm UTC](https://discuss.elastic.co/t/json-parse-exception-with-status-500-post-upgrade-to-7-4-0/201936 "2019-10-02T12:05:59Z")

</div>

I've upgraded from 7.3.2 to 7.4.0 and in attempting to follow the rolling upgrades document -- I've issued a: \[root@host elasticsearch\]# curl -X PUT -u elastic "ipaddy:9200/\_cluster/settings?pretty" -H 'Content-Type: ap…

---

## [Connecting hadoop and elasticsearch](https://discuss.elastic.co/t/connecting-hadoop-and-elasticsearch/196170)

<div class="topic-metadata">

**Author:** [@varunakuraju](https://discuss.elastic.co/u/varunakuraju)\
**Replies:** 2\
**Last updated:** [August 23, 2019, 7:45pm UTC](https://discuss.elastic.co/t/connecting-hadoop-and-elasticsearch/196170 "2019-08-23T19:45:10Z")

</div>

Hi all, I am new to Elasticsearch and kibana I want establish two-way connection between hdfs and elasticsearch. I used Hive external tables but its not working. I am not finding a way , steps i have done installed…

---

## [Выгрузить Event журнал Windows](https://discuss.elastic.co/t/event-windows/104883)

<div class="topic-metadata">

**Author:** [@komito](https://discuss.elastic.co/u/komito)\
**Replies:** 2\
**Last updated:** [October 25, 2017, 12:22pm UTC](https://discuss.elastic.co/t/event-windows/104883 "2017-10-25T12:22:39Z")

</div>

Здравствуйте. На сервере установлен Elasticsearch 5.6.3, Kibana 5.6.3, Logstash. C виндовых машин логи собираю winlogbeat'ом. Когда тестировал ELK, то на тестовый windows сервер установил winlogbeat агента, настроил конф…

---

## [How to tag and exclude filters?](https://discuss.elastic.co/t/how-to-tag-and-exclude-filters/11277)

<div class="topic-metadata">

**Author:** [@Greg\_3](https://discuss.elastic.co/u/Greg_3)\
**Replies:** 2\
**Last updated:** [March 26, 2013, 1:04am UTC](https://discuss.elastic.co/t/how-to-tag-and-exclude-filters/11277 "2013-03-26T01:04:09Z")

</div>

Hi all I have come from a Solr background and am looking for a way to tag and exclude filters using Elasticsearch: http://wiki.apache.org/solr/SimpleFacetParameters#Tagging\_and\_excluding\_Filters I have read the …

---

## [Clarify difference between opening/closing an index and a shard becoming active/inactive?](https://discuss.elastic.co/t/clarify-difference-between-opening-closing-an-index-and-a-shard-becoming-active-inactive/6004)

<div class="topic-metadata">

**Author:** [@Matt1](https://discuss.elastic.co/u/Matt1)\
**Replies:** 2\
**Last updated:** [December 1, 2011, 5:35am UTC](https://discuss.elastic.co/t/clarify-difference-between-opening-closing-an-index-and-a-shard-becoming-active-inactive/6004 "2011-12-01T05:35:45Z")

</div>

I see in the logs that shards will become inactive "index-wise", and I was wondering if anybody could explain in a little detail what that means? In particular: 1) Is the shard is still available for searching? I'…

---

## [How to add permission for short url for user?](https://discuss.elastic.co/t/how-to-add-permission-for-short-url-for-user/349713)

<div class="topic-metadata">

**Author:** [@PeLbmaN](https://discuss.elastic.co/u/PeLbmaN)\
**Replies:** 1\
**Last updated:** [December 20, 2023, 4:23pm UTC](https://discuss.elastic.co/t/how-to-add-permission-for-short-url-for-user/349713 "2023-12-20T16:23:04Z")

</div>

I have a question about how to add the ability to create short links, which role is responsible for this (I have a basic license)?

---

## [Trouble Handling Large Volume data - Slow Kibana Dashboard](https://discuss.elastic.co/t/trouble-handling-large-volume-data-slow-kibana-dashboard/187635)

<div class="topic-metadata">

**Author:** [@shikhar\_singh](https://discuss.elastic.co/u/shikhar_singh)\
**Replies:** 4\
**Last updated:** [June 26, 2019, 7:53pm UTC](https://discuss.elastic.co/t/trouble-handling-large-volume-data-slow-kibana-dashboard/187635 "2019-06-26T19:53:44Z")

</div>

Hello , I have an index which is giving me some trouble. The index gets somewhere around 40 GB of data per hour. I have a 3 node setup. With 32 GB of RAM on each node and 12 cores for processing. I have allocated 20GB…

---

## [Watcher auto acknowledgment, throttle\_period reset](https://discuss.elastic.co/t/watcher-auto-acknowledgment-throttle-period-reset/107915)

<div class="topic-metadata">

**Author:** [@Sergey\_Urushkin](https://discuss.elastic.co/u/Sergey_Urushkin)\
**Replies:** 4\
**Last updated:** [November 22, 2017, 10:39am UTC](https://discuss.elastic.co/t/watcher-auto-acknowledgment-throttle-period-reset/107915 "2017-11-22T10:39:50Z")

</div>

This has been discussed earlier. In my case I need oneshot messages for PROBLEM (hits \< N) and OK (hist =\>N). Throttling with large time period will not help in this situation, since condition=false doesn't reset thro…

[Previous page](https://discuss.elastic.co/top.md?page=1143&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1145&per_page=50&period=all)
