# Top

**URL:** https://discuss.elastic.co/top.md?page=1166&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1167

---

## [Does embedded kibana visualizaion automaticly update?](https://discuss.elastic.co/t/does-embedded-kibana-visualizaion-automaticly-update/106864)

<div class="topic-metadata">

**Author:** [@yishain11](https://discuss.elastic.co/u/yishain11)\
**Replies:** 2\
**Last updated:** [November 8, 2017, 1:37pm UTC](https://discuss.elastic.co/t/does-embedded-kibana-visualizaion-automaticly-update/106864 "2017-11-08T13:37:09Z")

</div>

Hi evryone! When I embbed Kibana visualization into my webapp (either TML file or full MEAN stack app), does it automaticly update when the data that kibana and elasticsearch listen to changes? Thanks, Yishai

---

## [Kibana decode base64 of heberw string into gibberish](https://discuss.elastic.co/t/kibana-decode-base64-of-heberw-string-into-gibberish/101846)

<div class="topic-metadata">

**Author:** [@napoxx1](https://discuss.elastic.co/u/napoxx1)\
**Replies:** 2\
**Last updated:** [September 27, 2017, 11:05am UTC](https://discuss.elastic.co/t/kibana-decode-base64-of-heberw-string-into-gibberish/101846 "2017-09-27T11:05:11Z")

</div>

Hey all, I'm using Kibana 5.2.2 and ES 5.2.0 In one of our projects we need to insert XMLs into the Elastic search. We are using JSON rest requests to insert the XML into the Elastic search. Since the XML sometime ha…

---

## [Can i combine values from different rows into one based on aggregations?](https://discuss.elastic.co/t/can-i-combine-values-from-different-rows-into-one-based-on-aggregations/81756)

<div class="topic-metadata">

**Author:** [@Madiha](https://discuss.elastic.co/u/Madiha)\
**Replies:** 2\
**Last updated:** [April 17, 2017, 5:09am UTC](https://discuss.elastic.co/t/can-i-combine-values-from-different-rows-into-one-based-on-aggregations/81756 "2017-04-17T05:09:22Z")

</div>

Actual: Expected: I want to display it in a data table vis.

---

## [Indexing fails with transport error](https://discuss.elastic.co/t/indexing-fails-with-transport-error/54846)

<div class="topic-metadata">

**Author:** [@HSA](https://discuss.elastic.co/u/HSA)\
**Replies:** 2\
**Last updated:** [July 6, 2016, 7:02pm UTC](https://discuss.elastic.co/t/indexing-fails-with-transport-error/54846 "2016-07-06T19:02:01Z")

</div>

Hi I\`m new to search and indexing. I am using nutch2.3.1/hbase1.1.5/elastic2.3.0 stack installed in an AWS m4.xlarge instance. Everything running in single-node configurations. After crawling a website, I can see the…

---

## [Synthetic monitoring using a pod](https://discuss.elastic.co/t/synthetic-monitoring-using-a-pod/261631)

<div class="topic-metadata">

**Author:** [@aman26ps](https://discuss.elastic.co/u/aman26ps)\
**Replies:** 5\
**Last updated:** [February 8, 2021, 8:45am UTC](https://discuss.elastic.co/t/synthetic-monitoring-using-a-pod/261631 "2021-02-08T08:45:09Z")

</div>

Hi Team, I am running my ECK stack on a managed kubernetes clusters with no access to login into any of the kube nodes, now with this implementation currently i wont be able to run docker container in the same namespace…

---

## [Filebeat log Not Coming to Logstash](https://discuss.elastic.co/t/filebeat-log-not-coming-to-logstash/239608)

<div class="topic-metadata">

**Author:** [@sumitsahay](https://discuss.elastic.co/u/sumitsahay)\
**Replies:** 5\
**Last updated:** [July 3, 2020, 10:09am UTC](https://discuss.elastic.co/t/filebeat-log-not-coming-to-logstash/239608 "2020-07-03T10:09:19Z")

</div>

Hi All, I am having fliebeat install on my client machine and elk masternode on different vm. I Configured everything though logs are not coming to Kibana index and index is not getting created.

---

## [Kibana canvas is loading forever](https://discuss.elastic.co/t/kibana-canvas-is-loading-forever/166677)

<div class="topic-metadata">

**Author:** [@saiergon](https://discuss.elastic.co/u/saiergon)\
**Replies:** 5\
**Last updated:** [February 5, 2019, 8:34am UTC](https://discuss.elastic.co/t/kibana-canvas-is-loading-forever/166677 "2019-02-05T08:34:34Z")

</div>

my canvas in kibana is loading forever the error information is "http://\*\*\*/app/kibanasocket.io?EIO=3&transport=polling&t=MYdeoOO" use curl "http://\*\*\*\*:5601//app/kibanasocket.io?EIO=3&transport=polling&t=MYdf3hU", …

---

## [How to use AND operator inside Match](https://discuss.elastic.co/t/how-to-use-and-operator-inside-match/199507)

<div class="topic-metadata">

**Author:** [@Fosiul\_Alam](https://discuss.elastic.co/u/Fosiul_Alam)\
**Replies:** 8\
**Last updated:** [September 20, 2019, 10:07am UTC](https://discuss.elastic.co/t/how-to-use-and-operator-inside-match/199507 "2019-09-20T10:07:57Z")

</div>

Hi I am using dev Tools , Bellow Query works fine in Kibana Discover log.file.path:\*MY.log\* AND "\[COMMAND:HEARTBEAT\]" AND "\[CHARGING:0\]" but when i am doing the same in Dev tools, its only taking the HEARTBEAT bu…

---

## [Threshold Detection Ignoring Group By Field](https://discuss.elastic.co/t/threshold-detection-ignoring-group-by-field/264873)

<div class="topic-metadata">

**Author:** [@PhilA](https://discuss.elastic.co/u/PhilA)\
**Replies:** 6\
**Last updated:** [March 4, 2021, 3:02pm UTC](https://discuss.elastic.co/t/threshold-detection-ignoring-group-by-field/264873 "2021-03-04T15:02:10Z")

</div>

Hi I have upgraded to 7.11.0 and now 7.11.1 and I think there is an issue with Threshold detections. I have a simple detection based on my FW logs. It looks for flow\_denied or flow\_dropped messages and raises a detect…

---

## [Text query on multiple fields](https://discuss.elastic.co/t/text-query-on-multiple-fields/7002)

<div class="topic-metadata">

**Author:** [@Jan\_Fiedler](https://discuss.elastic.co/u/Jan_Fiedler)\
**Replies:** 6\
**Last updated:** [March 16, 2012, 5:13pm UTC](https://discuss.elastic.co/t/text-query-on-multiple-fields/7002 "2012-03-16T17:13:17Z")

</div>

I used to use the 'query\_string' query type to run searches across multiple fields (via the build in dismax capability). However, the Lucene parsing of the query phrase causes more harm than good for me so I thought …

---

## [How to effectively filter results based on another query (SQL JOIN -alike) against another type?](https://discuss.elastic.co/t/how-to-effectively-filter-results-based-on-another-query-sql-join-alike-against-another-type/84105)

<div class="topic-metadata">

**Author:** [@vmattila](https://discuss.elastic.co/u/vmattila)\
**Replies:** 1\
**Last updated:** [April 30, 2017, 6:02am UTC](https://discuss.elastic.co/t/how-to-effectively-filter-results-based-on-another-query-sql-join-alike-against-another-type/84105 "2017-04-30T06:02:06Z")

</div>

I have two different types in my index, representing the same entity but containing different body. Documents share the same ID. Type event is similar to { "\_id": "event1", "title": "Ville's Event", "date": "2017-04-30…

---

## [\[RESOLVED\] Double option problem -\> -Djava.io.tmpdir=/var/lib/logstash](https://discuss.elastic.co/t/resolved-double-option-problem-djava-io-tmpdir-var-lib-logstash/50047)

<div class="topic-metadata">

**Author:** [@netsuro](https://discuss.elastic.co/u/netsuro)\
**Replies:** 1\
**Last updated:** [May 15, 2016, 6:39am UTC](https://discuss.elastic.co/t/resolved-double-option-problem-djava-io-tmpdir-var-lib-logstash/50047 "2016-05-15T06:39:15Z")

</div>

Hi all, My system : Distributor ID: CentOS Description: CentOS Linux release 7.2.1511 (Core) Release: 7.2.1511 Codename: Core version : logstash-2.3.2-1.noarch I use logstash for send my logs with gelf on a graylo…

---

## [I/O exception (org.apache.http.conn.HttpHostConnectException)](https://discuss.elastic.co/t/i-o-exception-org-apache-http-conn-httphostconnectexception/27394)

<div class="topic-metadata">

**Author:** [@Ashok](https://discuss.elastic.co/u/Ashok)\
**Replies:** 1\
**Last updated:** [August 15, 2015, 10:44pm UTC](https://discuss.elastic.co/t/i-o-exception-org-apache-http-conn-httphostconnectexception/27394 "2015-08-15T22:44:33Z")

</div>

Hi, I am getting following error while executing logstash conf file. And i want to connect the server with protocal https to monitor the IBM wepsphere logs.But i don't have any option in protocol for https. org.apache.…

---

## [LifeCycle policy doesn't delete index because of wrong index age](https://discuss.elastic.co/t/lifecycle-policy-doesnt-delete-index-because-of-wrong-index-age/295859)

<div class="topic-metadata">

**Author:** [@ashit\_pupu](https://discuss.elastic.co/u/ashit_pupu)\
**Replies:** 4\
**Last updated:** [February 1, 2022, 5:03am UTC](https://discuss.elastic.co/t/lifecycle-policy-doesnt-delete-index-because-of-wrong-index-age/295859 "2022-02-01T05:03:13Z")

</div>

Hi I have created an ILM which would delete an index after 5 days of creation. I have disabled the index rollover so my policy has the hot phase and delete phase . Below is the policy for reference . PUT \_ilm/policy/se…

---

## [Extract day, month and year from a date field. Changing Timezone](https://discuss.elastic.co/t/extract-day-month-and-year-from-a-date-field-changing-timezone/267646)

<div class="topic-metadata">

**Author:** [@Ernesto\_Guerra](https://discuss.elastic.co/u/Ernesto_Guerra)\
**Replies:** 4\
**Last updated:** [March 24, 2021, 11:30am UTC](https://discuss.elastic.co/t/extract-day-month-and-year-from-a-date-field-changing-timezone/267646 "2021-03-24T11:30:50Z")

</div>

Hi, I would like to add some fields extracting data from "\[layers\]\[frame\]\[frame\_frame\_time\]" field. My code is: date { match =\> \[ "\[layers\]\[frame\]\[frame\_frame\_time\]","ISO8601" \] target =\> "\[layers\]\[frame\]\[fr…

---

## [Can't send dashboard to kibana](https://discuss.elastic.co/t/cant-send-dashboard-to-kibana/243887)

<div class="topic-metadata">

**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\
**Replies:** 4\
**Last updated:** [August 6, 2020, 8:21am UTC](https://discuss.elastic.co/t/cant-send-dashboard-to-kibana/243887 "2020-08-06T08:21:51Z")

</div>

Because we like the default "failed logins" dashboard that auditbeat provides, in auditbeat.yml, we have setup.dashboards.enabled: true. It worked fine and now that I've enabled HTTPS for kibana I'm facing some issues. …

---

## [Indexing becomes slow when I start indexing data to two Elasticsearch cluster simultaneously](https://discuss.elastic.co/t/indexing-becomes-slow-when-i-start-indexing-data-to-two-elasticsearch-cluster-simultaneously/161989)

<div class="topic-metadata">

**Author:** [@vkeswarlal](https://discuss.elastic.co/u/vkeswarlal)\
**Replies:** 4\
**Last updated:** [January 9, 2019, 12:29pm UTC](https://discuss.elastic.co/t/indexing-becomes-slow-when-i-start-indexing-data-to-two-elasticsearch-cluster-simultaneously/161989 "2019-01-09T12:29:31Z")

</div>

Hi, We are using Logstash to read log data from redis and index it to Elasticsearch 1.7.9. We are in the process of upgrading the Elasticsearch to version 6.5.1, so we have set up a ES6.5 cluster of 11 nodes ( 3:master,…

---

## [Parse errors for IIS logs using ELK](https://discuss.elastic.co/t/parse-errors-for-iis-logs-using-elk/89385)

<div class="topic-metadata">

**Author:** [@desai.amogh](https://discuss.elastic.co/u/desai.amogh)\
**Replies:** 4\
**Last updated:** [June 19, 2017, 8:07am UTC](https://discuss.elastic.co/t/parse-errors-for-iis-logs-using-elk/89385 "2017-06-19T08:07:12Z")

</div>

My Logs are like below: 2017-06-14T10:39:30.105Z x.x.x.x 2017-06-14 10:39:27,827 Thread:'9' Level:'ERROR' Message:System error: Get security settings list service call failed. \[\[some.app\]\]some.app.ServiceResponseWrappe…

---

## [Shield document level security role hierarchy](https://discuss.elastic.co/t/shield-document-level-security-role-hierarchy/36460)

<div class="topic-metadata">

**Author:** [@avibh](https://discuss.elastic.co/u/avibh)\
**Replies:** 4\
**Last updated:** [December 7, 2015, 2:28pm UTC](https://discuss.elastic.co/t/shield-document-level-security-role-hierarchy/36460 "2015-12-07T14:28:24Z")

</div>

Hi, prerequisites - I have a "global" index which contains data from different sources. this is the baseline for my question. I want to add shield security to this "global" index so different users will get the data th…

---

## [Duplicate entries with Winlogbeat with WEF](https://discuss.elastic.co/t/duplicate-entries-with-winlogbeat-with-wef/231909)

<div class="topic-metadata">

**Author:** [@NightSpark](https://discuss.elastic.co/u/NightSpark)\
**Replies:** 3\
**Last updated:** [May 13, 2020, 10:42pm UTC](https://discuss.elastic.co/t/duplicate-entries-with-winlogbeat-with-wef/231909 "2020-05-13T22:42:35Z")

</div>

Hi New to elasticsearch and have just setup Winlogbeat on a central Windows 2008 R2 server which is collecting windows events from machines using Windows Event Forwarding I am using V 7.6.2 of elasticsearch and winlogb…

---

## [ES service is using more memory than the set Xmx (Java heap) that i set it and does not go back down](https://discuss.elastic.co/t/es-service-is-using-more-memory-than-the-set-xmx-java-heap-that-i-set-it-and-does-not-go-back-down/72563)

<div class="topic-metadata">

**Author:** [@kiet.tran](https://discuss.elastic.co/u/kiet.tran)\
**Replies:** 3\
**Last updated:** [January 25, 2017, 3:34am UTC](https://discuss.elastic.co/t/es-service-is-using-more-memory-than-the-set-xmx-java-heap-that-i-set-it-and-does-not-go-back-down/72563 "2017-01-25T03:34:42Z")

</div>

Hi everyone, Es version that we are using is 2.5 The set up of the ES search service is ES\_JAVA\_OPTS="-Xms1g -Xmx1g" and having bootstrap.mlockall: true on a windows server just hosting ES service. The window server …

---

## [Aggregationsについて](https://discuss.elastic.co/t/aggregations/59073)

<div class="topic-metadata">

**Author:** [@eng\_toshiki](https://discuss.elastic.co/u/eng_toshiki)\
**Replies:** 3\
**Last updated:** [August 30, 2016, 11:26am UTC](https://discuss.elastic.co/t/aggregations/59073 "2016-08-30T11:26:48Z")

</div>

お世話になっております。 aggsについて質問があります mapping抜粋 "tags" : { "type": "multi\_field", "fields": { "tags": { "analyzer": "kuromoji\_analyzer", "type": "string", "index"…

---

## [Timezone issue in Kibana](https://discuss.elastic.co/t/timezone-issue-in-kibana/221666)

<div class="topic-metadata">

**Author:** [@rcganesh](https://discuss.elastic.co/u/rcganesh)\
**Replies:** 2\
**Last updated:** [March 29, 2020, 11:12am UTC](https://discuss.elastic.co/t/timezone-issue-in-kibana/221666 "2020-03-29T11:12:23Z")

</div>

Hello, We are injecting data into elasticsearch from MQs. Both the MQ and elasticsearch servers are in the same time zone (AST). However, when data is displayed in Kibana, time zone changes to AST+3 hours. For instance…

---

## [Get a "illegal\_argument\_exception" error after upgrade](https://discuss.elastic.co/t/get-a-illegal-argument-exception-error-after-upgrade/189069)

<div class="topic-metadata">

**Author:** [@yeziblo](https://discuss.elastic.co/u/yeziblo)\
**Replies:** 2\
**Last updated:** [July 8, 2019, 2:10am UTC](https://discuss.elastic.co/t/get-a-illegal-argument-exception-error-after-upgrade/189069 "2019-07-08T02:10:07Z")

</div>

Hi, everyone. I'm trying to upgrade ES from 5.4.0 to 6.8.0. According to official documents, I execute this method after upgrade: curl -XPUT -H "Content-Type:application/json" 172.16.1.133:9200/\_cluster/settings -d' …

---

## [No query registered for \[facets\]\]](https://discuss.elastic.co/t/no-query-registered-for-facets/14516)

<div class="topic-metadata">

**Author:** [@Lucas\_Rutledge](https://discuss.elastic.co/u/Lucas_Rutledge)\
**Replies:** 2\
**Last updated:** [November 21, 2013, 3:21pm UTC](https://discuss.elastic.co/t/no-query-registered-for-facets/14516 "2013-11-21T15:21:42Z")

</div>

I'm trying to use the elasticsearch python client to send a query however I keep getting No query registered for \[facets\]\] back each time. Can anyone tell me what I am doing wrong here? query = { "facet…

---

## [Security Case Management](https://discuss.elastic.co/t/security-case-management/134101)

<div class="topic-metadata">

**Author:** [@stiltz](https://discuss.elastic.co/u/stiltz)\
**Replies:** 2\
**Last updated:** [June 1, 2018, 3:18pm UTC](https://discuss.elastic.co/t/security-case-management/134101 "2018-06-01T15:18:03Z")

</div>

Has anyone thought about building a cyber security case management solution on top of the ELK stack? I can imagine a streamlined workflow for cyber security analysts/incident response teams. Analysts on a "hunt" could m…

---

## [Advance settings : Ignore filter](https://discuss.elastic.co/t/advance-settings-ignore-filter/172576)

<div class="topic-metadata">

**Author:** [@joaquim](https://discuss.elastic.co/u/joaquim)\
**Replies:** 1\
**Last updated:** [March 20, 2019, 5:17pm UTC](https://discuss.elastic.co/t/advance-settings-ignore-filter/172576 "2019-03-20T17:17:03Z")

</div>

Hi, What i wanna do: I have a dashboard that uses two diferent index patterns, and i have created a filter that only restrain result from one index pattern. After enable that filter some visualizations send a message N…

---

## [Error registering plugin with jdbc\_static plugin](https://discuss.elastic.co/t/error-registering-plugin-with-jdbc-static-plugin/164536)

<div class="topic-metadata">

**Author:** [@roblopes](https://discuss.elastic.co/u/roblopes)\
**Replies:** 7\
**Last updated:** [January 23, 2019, 1:51pm UTC](https://discuss.elastic.co/t/error-registering-plugin-with-jdbc-static-plugin/164536 "2019-01-23T13:51:40Z")

</div>

Hi, This is a logstash (6.5.1) process that runs fine for months now, but in order to optimize its performance, I am trying to add the jdbc\_static plugin, so I don't have to lookup in logstash a "domain table", since it…

---

## [HTTPS TLS Error: SSL\_CTX\_use\_certificate\_chain](https://discuss.elastic.co/t/https-tls-error-ssl-ctx-use-certificate-chain/149190)

<div class="topic-metadata">

**Author:** [@Matt\_Vasquez](https://discuss.elastic.co/u/Matt_Vasquez)\
**Replies:** 1\
**Last updated:** [September 19, 2018, 9:03pm UTC](https://discuss.elastic.co/t/https-tls-error-ssl-ctx-use-certificate-chain/149190 "2018-09-19T21:03:34Z")

</div>

I am running Elastic Stack 6.4 (Single Node Elasticsearch and Single Node Kibana) on Windows Server 2008 R2. I have generated a CSR and had it signed by my local CA. I have elasticsearch working with HTTPS TLS just fine…

---

## [Asterisk in Mutate with GSUB](https://discuss.elastic.co/t/asterisk-in-mutate-with-gsub/126300)

<div class="topic-metadata">

**Author:** [@Suman\_Reddy1](https://discuss.elastic.co/u/Suman_Reddy1)\
**Replies:** 7\
**Last updated:** [April 6, 2018, 1:33am UTC](https://discuss.elastic.co/t/asterisk-in-mutate-with-gsub/126300 "2018-04-06T01:33:36Z")

</div>

@magnusbaeck Here is the thing, which broken in our production. mutate { gsub =\> \["message", "%{docNumber}", "%{docNumberMasked}"\] } I have to type all the configuration, if there is any typo or syntactical error…

---

## [Logstash.agent - Error in reactor loop escaped: Bad file descriptor](https://discuss.elastic.co/t/logstash-agent-error-in-reactor-loop-escaped-bad-file-descriptor/106519)

<div class="topic-metadata">

**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\
**Replies:** 1\
**Last updated:** [November 6, 2017, 1:48pm UTC](https://discuss.elastic.co/t/logstash-agent-error-in-reactor-loop-escaped-bad-file-descriptor/106519 "2017-11-06T13:48:50Z")

</div>

I've upgraded to 5.6.3 from 2.1.3 patched my config for breaking changes: # /usr/share/logstash/bin/logstash -t --path.config /etc/logstash/conf.d --path.settings /etc/logstash Sending Logstash's logs to /var/log/logst…

---

## [\[5.3\] Heap details & collection](https://discuss.elastic.co/t/5-3-heap-details-collection/103048)

<div class="topic-metadata">

**Author:** [@ebillaud](https://discuss.elastic.co/u/ebillaud)\
**Replies:** 7\
**Last updated:** [October 9, 2017, 7:18pm UTC](https://discuss.elastic.co/t/5-3-heap-details-collection/103048 "2017-10-09T19:18:20Z")

</div>

Hello, I tried to measure the impact of our datamodel on the heap (in terms of non-collectable objects) . Here is what I've done : Wait a long time after last insertion (no segments.index\_writer\_memory); for each type…

---

## [Elasticsearch OpenNLP Ingest Processor Question](https://discuss.elastic.co/t/elasticsearch-opennlp-ingest-processor-question/97043)

<div class="topic-metadata">

**Author:** [@brianz](https://discuss.elastic.co/u/brianz)\
**Replies:** 1\
**Last updated:** [August 18, 2017, 7:05pm UTC](https://discuss.elastic.co/t/elasticsearch-opennlp-ingest-processor-question/97043 "2017-08-18T19:05:36Z")

</div>

Thank you spinscale for the Elasticsearch OpenNLP Ingest Processor. Awesome! I installed elasticsearch, installed the plugin, tested the plugin, and it works. –test –build $ curl -XPUT -i “localhost:9200/my\_index/”…

---

## [Need to adjust zeroreplicas template to have a lot more shards](https://discuss.elastic.co/t/need-to-adjust-zeroreplicas-template-to-have-a-lot-more-shards/63459)

<div class="topic-metadata">

**Author:** [@somerandomguy](https://discuss.elastic.co/u/somerandomguy)\
**Replies:** 7\
**Last updated:** [October 20, 2016, 11:20pm UTC](https://discuss.elastic.co/t/need-to-adjust-zeroreplicas-template-to-have-a-lot-more-shards/63459 "2016-10-20T23:20:58Z")

</div>

Hi. I have the following template in my ES. I need to hard set the number of shards I would like each new index to have. I tried to add the following directly underneath the 'number of replicas' line but it compla…

---

## [Effect of \_optimize on disk usage](https://discuss.elastic.co/t/effect-of--optimize-on-disk-usage/34103)

<div class="topic-metadata">

**Author:** [@harvii](https://discuss.elastic.co/u/harvii)\
**Replies:** 7\
**Last updated:** [November 9, 2015, 12:47pm UTC](https://discuss.elastic.co/t/effect-of--optimize-on-disk-usage/34103 "2015-11-09T12:47:49Z")

</div>

I ran 'optimize' on old Logstash indices with 'max\_num\_segments=1' to improve search performance and maybe reclaim some disk space, however, I noticed that 'optimize' actually caused -most- indices to use more disk space…

---

## [Shard failure for the sorting case](https://discuss.elastic.co/t/shard-failure-for-the-sorting-case/6562)

<div class="topic-metadata">

**Author:** [@narinder\_izap](https://discuss.elastic.co/u/narinder_izap)\
**Replies:** 1\
**Last updated:** [February 1, 2012, 11:15am UTC](https://discuss.elastic.co/t/shard-failure-for-the-sorting-case/6562 "2012-02-01T11:15:07Z")

</div>

I am running the following query: { "size": 10, "from": 0, "sort": { "is\_usa": { "order": "desc" }, "state\_title": { "order": "asc" }, "sortable.title": { …

---

## [Extract base64 encoded field from JSON message and write the decoded field to a file](https://discuss.elastic.co/t/extract-base64-encoded-field-from-json-message-and-write-the-decoded-field-to-a-file/320398)

<div class="topic-metadata">

**Author:** [@Arinjay\_Jain](https://discuss.elastic.co/u/Arinjay_Jain)\
**Replies:** 5\
**Last updated:** [December 8, 2022, 7:48am UTC](https://discuss.elastic.co/t/extract-base64-encoded-field-from-json-message-and-write-the-decoded-field-to-a-file/320398 "2022-12-08T07:48:51Z")

</div>

Hi All, I have the following logstash pipeline configuration. input { tcp { port =\> 5102 codec =\> json } } filter { json { source =\> "message" } } output { stdout { c…

---

## [Dotnet core WPF application - how to get APM traces](https://discuss.elastic.co/t/dotnet-core-wpf-application-how-to-get-apm-traces/315035)

<div class="topic-metadata">

**Author:** [@SaEd](https://discuss.elastic.co/u/SaEd)\
**Replies:** 5\
**Last updated:** [September 30, 2022, 5:44am UTC](https://discuss.elastic.co/t/dotnet-core-wpf-application-how-to-get-apm-traces/315035 "2022-09-30T05:44:49Z")

</div>

Hello all, I have a .net core WPF application (not asp.net core). I'm also using Serilog for logging. From Elastic Stack: Fleet with integrations: APM 8.4.2, Custom Log 1.0.0, System 1.16.2 Also using Elastic-agent 8.…

---

## [SourceMaps don't show for all Errors](https://discuss.elastic.co/t/sourcemaps-dont-show-for-all-errors/209978)

<div class="topic-metadata">

**Author:** [@akosanovic](https://discuss.elastic.co/u/akosanovic)\
**Replies:** 5\
**Last updated:** [December 3, 2019, 1:23pm UTC](https://discuss.elastic.co/t/sourcemaps-dont-show-for-all-errors/209978 "2019-12-03T13:23:11Z")

</div>

Some errors are pointing to the bundle.js files event tho I have uploaded the Source Maps. Kibana version: 7.1 Elasticsearch version: 7.1 APM Server version: APM Agent language and version: Original install metho…

---

## [Logstash fails to start with central configuration(bug in 6.0.0-beta1)](https://discuss.elastic.co/t/logstash-fails-to-start-with-central-configuration-bug-in-6-0-0-beta1/96648)

<div class="topic-metadata">

**Author:** [@arthur](https://discuss.elastic.co/u/arthur)\
**Replies:** 5\
**Last updated:** [August 13, 2017, 7:16am UTC](https://discuss.elastic.co/t/logstash-fails-to-start-with-central-configuration-bug-in-6-0-0-beta1/96648 "2017-08-13T07:16:13Z")

</div>

I have Elasticsearch6.0.0beta1 and logstash6.0.0beta1 installed on my Mac. Both have x-pack plugin installed. My Elasticsearch.yml contains “xpack.security.enabled: false” and everything works. When trying to start Logs…

---

## [Feed Logstash with gzipped multiline inputs](https://discuss.elastic.co/t/feed-logstash-with-gzipped-multiline-inputs/92963)

<div class="topic-metadata">

**Author:** [@gilbertotcc](https://discuss.elastic.co/u/gilbertotcc)\
**Replies:** 4\
**Last updated:** [July 21, 2017, 12:21pm UTC](https://discuss.elastic.co/t/feed-logstash-with-gzipped-multiline-inputs/92963 "2017-07-21T12:21:49Z")

</div>

Hi All, I'm implementing an ELK stack for Java logs indexing and analysis. At the moment, it's only a proof of concept and I cannot feed Logstash with plain text log files; I've got gzipped past log files and I want to…

---

## [Cross fields +different analyzers +profile API](https://discuss.elastic.co/t/cross-fields-different-analyzers-profile-api/92120)

<div class="topic-metadata">

**Author:** [@klara](https://discuss.elastic.co/u/klara)\
**Replies:** 4\
**Last updated:** [July 7, 2017, 7:51am UTC](https://discuss.elastic.co/t/cross-fields-different-analyzers-profile-api/92120 "2017-07-07T07:51:07Z")

</div>

Столкнулась с неожиданным поведением: Запрос dus\_max-multi\_match-cross field Среди полей есть: Brand.string analyzer1 Brand.hyphen\_string analyzer1 Goodsname.string analyzer2 Есть товар 1: {Goodsname.string : "ф…

---

## [ES5 - Search in wildcard field name](https://discuss.elastic.co/t/es5-search-in-wildcard-field-name/83659)

<div class="topic-metadata">

**Author:** [@idanhagai](https://discuss.elastic.co/u/idanhagai)\
**Replies:** 4\
**Last updated:** [April 26, 2017, 8:47am UTC](https://discuss.elastic.co/t/es5-search-in-wildcard-field-name/83659 "2017-04-26T08:47:56Z")

</div>

Hi all, I have multiple fields with different analyzers: text\_english, text\_spanish, text\_french, etc.. I'm executing the follow query string: { "query": { "query\_string": { "fields": \[ "text\_\*…

---

## [Windows logstash problem](https://discuss.elastic.co/t/windows-logstash-problem/77672)

<div class="topic-metadata">

**Author:** [@ssi](https://discuss.elastic.co/u/ssi)\
**Replies:** 4\
**Last updated:** [March 8, 2017, 9:33am UTC](https://discuss.elastic.co/t/windows-logstash-problem/77672 "2017-03-08T09:33:27Z")

</div>

hi im running version 2,4.1 on a windows 2012 server, I have run the ELK stack sucessfully on linux but in order to get it in production i must migrate to windows. I thought i could just move everything to the wintel p…

---

## [Kibana 502s When I Set ES As A Client Node](https://discuss.elastic.co/t/kibana-502s-when-i-set-es-as-a-client-node/32410)

<div class="topic-metadata">

**Author:** [@UsreTX](https://discuss.elastic.co/u/UsreTX)\
**Replies:** 4\
**Last updated:** [October 20, 2015, 8:14pm UTC](https://discuss.elastic.co/t/kibana-502s-when-i-set-es-as-a-client-node/32410 "2015-10-20T20:14:49Z")

</div>

First time caller, long time listener: I was able to complete this tutorial successfully: https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-4-on-centos-7 which let m…

---

## [Multiline Gets Cutoff For No Reason (so strange)](https://discuss.elastic.co/t/multiline-gets-cutoff-for-no-reason-so-strange/24112)

<div class="topic-metadata">

**Author:** [@michaellizhou](https://discuss.elastic.co/u/michaellizhou)\
**Replies:** 4\
**Last updated:** [June 25, 2015, 1:17pm UTC](https://discuss.elastic.co/t/multiline-gets-cutoff-for-no-reason-so-strange/24112 "2015-06-25T13:17:02Z")

</div>

So I currently have about 3-5 log files that have multiline in them which is normal. I usually start parsing them 1 file at a time in separate logstash instances and everything runs great no grokparsefailures. The proble…

---

## [Replica assignement on the same host](https://discuss.elastic.co/t/replica-assignement-on-the-same-host/19526)

<div class="topic-metadata">

**Author:** [@ElasticSearch\_Users\_](https://discuss.elastic.co/u/ElasticSearch_Users_)\
**Replies:** 4\
**Last updated:** [August 30, 2014, 12:14am UTC](https://discuss.elastic.co/t/replica-assignement-on-the-same-host/19526 "2014-08-30T00:14:41Z")

</div>

Hi, I have an ES cluster with 12 data nodes spread on 6 servers (so 2 nodes per server) and I saw that replicas of a shard can be allocated on the same server(on each nodes hosted by a server) To avoid this I h…

---

## [EuiOverlayMask is over the EuiCollapsibleNav it comes from](https://discuss.elastic.co/t/euioverlaymask-is-over-the-euicollapsiblenav-it-comes-from/266410)

<div class="topic-metadata">

**Author:** [@Thomas\_Vaudry-Read](https://discuss.elastic.co/u/Thomas_Vaudry-Read)\
**Replies:** 6\
**Last updated:** [March 10, 2021, 3:57pm UTC](https://discuss.elastic.co/t/euioverlaymask-is-over-the-euicollapsiblenav-it-comes-from/266410 "2021-03-10T15:57:00Z")

</div>

Developing a Kibana plugin, and have a 3rd header layer in the page. When I set-up a button in the EuiHeader to open a EuiCollapsibleNav, the overlay covers the nav element and nothing is selectable. Here is a slice of t…

---

## [How to index now as a field value](https://discuss.elastic.co/t/how-to-index-now-as-a-field-value/85447)

<div class="topic-metadata">

**Author:** [@Matthew\_Vines](https://discuss.elastic.co/u/Matthew_Vines)\
**Replies:** 6\
**Last updated:** [May 12, 2017, 8:53am UTC](https://discuss.elastic.co/t/how-to-index-now-as-a-field-value/85447 "2017-05-12T08:53:06Z")

</div>

I'm trying to set 'now' as the timestamp in an index query, but can't seem to find the right syntax. POST /patient-admit/patientAdmit { "systemId": 123, "mrn": "xxxx", "firstName": "xxx", "lastName": "xxx", "mi…

---

## [Error: BadRequestError(400, 'parsing\_exception', 'Unknown key for a START\_OBJECT in \[knn\].')](https://discuss.elastic.co/t/error-badrequesterror-400-parsing-exception-unknown-key-for-a-start-object-in-knn/358551)

<div class="topic-metadata">

**Author:** [@Sharmishtha\_Paliwal](https://discuss.elastic.co/u/Sharmishtha_Paliwal)\
**Replies:** 2\
**Last updated:** [May 1, 2024, 2:42pm UTC](https://discuss.elastic.co/t/error-badrequesterror-400-parsing-exception-unknown-key-for-a-start-object-in-knn/358551 "2024-05-01T14:42:10Z")

</div>

I am not able to figure to this issue response = es.search(index="cv\_resume\_dense",query= { "match": { "work\_experience": { "query": query, "boost": 0.9 }, }, }, knn= { "field": "vector\_skills", "query\_vector"…

[Previous page](https://discuss.elastic.co/top.md?page=1165&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1167&per_page=50&period=all)
