# Top **URL:** https://discuss.elastic.co/top.md?page=1168&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1169 --- ## [Discard changes to ElasticSearch after every test case](https://discuss.elastic.co/t/discard-changes-to-elasticsearch-after-every-test-case/13278)
**Author:** [@garnaes](https://discuss.elastic.co/u/garnaes)\ **Replies:** 6\ **Last updated:** [August 21, 2013, 10:50am UTC](https://discuss.elastic.co/t/discard-changes-to-elasticsearch-after-every-test-case/13278 "2013-08-21T10:50:53Z")
I have a test suite, which assumes a certain fixture dataset is loaded into MySQL and ElasticSearch prior to running. Loading this data is only done when the fixture data changes, which is quite infrequent. When runn… --- ## [Logstash split message by \\n into multiple message inputs](https://discuss.elastic.co/t/logstash-split-message-by-n-into-multiple-message-inputs/265620)
**Author:** [@Daniel\_Jankech](https://discuss.elastic.co/u/Daniel_Jankech)\ **Replies:** 1\ **Last updated:** [February 27, 2021, 1:08pm UTC](https://discuss.elastic.co/t/logstash-split-message-by-n-into-multiple-message-inputs/265620 "2021-02-27T13:08:40Z")
Hi , what im trying to do is pretty simple and straight forward but cant figure out why its not working. When I was using logstash with file input it parsed my logs correctly meaning that it separated my log file by \\n i… --- ## [What's with these crazy CPU spikes?](https://discuss.elastic.co/t/whats-with-these-crazy-cpu-spikes/149894)
**Author:** [@sysadmin](https://discuss.elastic.co/u/sysadmin)\ **Replies:** 1\ **Last updated:** [September 25, 2018, 7:59pm UTC](https://discuss.elastic.co/t/whats-with-these-crazy-cpu-spikes/149894 "2018-09-25T19:59:41Z")
Hey, I'm relatively new to ES and am building out a cluster for some pretty heavy lifting. Throughout my whole process of building and troubleshooting this thing so far, there's been a pattern of spikes to almost 100% CP… --- ## [Export/Import the scripted fields into Kibana](https://discuss.elastic.co/t/export-import-the-scripted-fields-into-kibana/120431)
**Author:** [@Eric\_Yin](https://discuss.elastic.co/u/Eric_Yin)\ **Replies:** 1\ **Last updated:** [February 20, 2018, 4:24pm UTC](https://discuss.elastic.co/t/export-import-the-scripted-fields-into-kibana/120431 "2018-02-20T16:24:59Z")
Dear all, Is there any way to export/ import the scripted into kibana for index? Since I use time level index with hundreds of scripted field. The workload would be huge if we add the scripted field in kibana one by one… --- ## [Lower case normalizer "search\_analyzer"?](https://discuss.elastic.co/t/lower-case-normalizer-search-analyzer/85289)
**Author:** [@billnbell](https://discuss.elastic.co/u/billnbell)\ **Replies:** 1\ **Last updated:** [May 12, 2017, 7:07am UTC](https://discuss.elastic.co/t/lower-case-normalizer-search-analyzer/85289 "2017-05-12T07:07:06Z")
I want to lowercase a "keyword" field, and then make sure the search is also lowercased. I am using normalizer. Is there an equivalent for "search\_analyzer" for normalizers on user input? "normalizer": { "lower\_n… --- ## [How to hide the unnecessary string 'filters' from label](https://discuss.elastic.co/t/how-to-hide-the-unnecessary-string-filters-from-label/51410)
**Author:** [@sinto\_paulson](https://discuss.elastic.co/u/sinto_paulson)\ **Replies:** 1\ **Last updated:** [June 2, 2016, 8:05pm UTC](https://discuss.elastic.co/t/how-to-hide-the-unnecessary-string-filters-from-label/51410 "2016-06-02T20:05:31Z")
I have created a bar chart and i have used split chart feature to split the graph into two. In split chart, i have selected filters as subaggregation and i have created two filters and given the custom label names X and … --- ## [X-pack plugin:reporting - Permission Denied Ubuntu](https://discuss.elastic.co/t/x-pack-plugin-reporting-permission-denied-ubuntu/46753)
**Author:** [@dsudduth](https://discuss.elastic.co/u/dsudduth)\ **Replies:** 1\ **Last updated:** [April 8, 2016, 1:27am UTC](https://discuss.elastic.co/t/x-pack-plugin-reporting-permission-denied-ubuntu/46753 "2016-04-08T01:27:49Z")
Thought I would give Elastic Stack 5 a try on Ubuntu, but I've bumped into a small problem. All X-Pack plugins are enabled with the exception of plugin:reporting. The error I'm getting is below. If anyone has any idea… --- ## [Monitor and alert on custom company windows services](https://discuss.elastic.co/t/monitor-and-alert-on-custom-company-windows-services/349202)
**Author:** [@CodeCraft](https://discuss.elastic.co/u/CodeCraft)\ **Replies:** 8\ **Last updated:** [December 14, 2023, 9:12pm UTC](https://discuss.elastic.co/t/monitor-and-alert-on-custom-company-windows-services/349202 "2023-12-14T21:12:01Z")
We need to monitor custom company windows services and send an alert when one of them stops. We have added the Windows Integration to the agent profile for the server that we want to monitor the Windows services on. We … --- ## [Generate grok custom pattern to message filed](https://discuss.elastic.co/t/generate-grok-custom-pattern-to-message-filed/237400)
**Author:** [@Mohan\_vel](https://discuss.elastic.co/u/Mohan_vel)\ **Replies:** 8\ **Last updated:** [June 18, 2020, 6:12pm UTC](https://discuss.elastic.co/t/generate-grok-custom-pattern-to-message-filed/237400 "2020-06-18T18:12:40Z")
Hi All, I am having a query related to grok processor. For example this is my message filed { "message":"agentId:agent003" } I want to Grok this and my output should me something like this { "message":"agentId:agent0… --- ## [Email alerting](https://discuss.elastic.co/t/email-alerting/121168)
**Author:** [@Pororo](https://discuss.elastic.co/u/Pororo)\ **Replies:** 8\ **Last updated:** [February 27, 2018, 12:47pm UTC](https://discuss.elastic.co/t/email-alerting/121168 "2018-02-27T12:47:49Z")
I was trying to set the email alerting according to the official doc. The configuration for email has been set up successfully. Here is my code segment. POST \_xpack/watcher/watches/email\_test { "trigger" : { "sc… --- ## [How can I expose new fields sourced from the log record?](https://discuss.elastic.co/t/how-can-i-expose-new-fields-sourced-from-the-log-record/62871)
**Author:** [@kpam](https://discuss.elastic.co/u/kpam)\ **Replies:** 2\ **Last updated:** [October 13, 2016, 5:00pm UTC](https://discuss.elastic.co/t/how-can-i-expose-new-fields-sourced-from-the-log-record/62871 "2016-10-13T17:00:20Z")
Hi all, I'm using a structured logging package (GitHub - sirupsen/logrus: Structured, pluggable logging for Go.) and then shipping with Filebeat directly to our ES cluster. Unfortunately, I'm losing queryability on the … --- ## [Datatable visualization - Trim the time from timestamp](https://discuss.elastic.co/t/datatable-visualization-trim-the-time-from-timestamp/58773)
**Author:** [@sruthi](https://discuss.elastic.co/u/sruthi)\ **Replies:** 2\ **Last updated:** [August 26, 2016, 5:31am UTC](https://discuss.elastic.co/t/datatable-visualization-trim-the-time-from-timestamp/58773 "2016-08-26T05:31:42Z")
I have created a datatable visualization to show per day logcount using DateHistogram. The timestamp is showing as - August 24th 2016, 00:00:00.000. Is there any way to trim the time part from this? Version: Kibana 4.5.2… --- ## [Duplicate entries in Logstash?](https://discuss.elastic.co/t/duplicate-entries-in-logstash/33571)
**Author:** [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Replies:** 2\ **Last updated:** [November 3, 2015, 2:46pm UTC](https://discuss.elastic.co/t/duplicate-entries-in-logstash/33571 "2015-11-03T14:46:35Z")
I am not to sure where the issue is if it is with Logstash or Log-courier. It seems that logstash keeps rereading the same log line and parses it multiple times. To check this i named the common field type %{WORD:field1}… --- ## [What is the best approach to capture Linux(Ubuntu) server logs?](https://discuss.elastic.co/t/what-is-the-best-approach-to-capture-linux-ubuntu-server-logs/93415)
**Author:** [@amruth](https://discuss.elastic.co/u/amruth)\ **Replies:** 5\ **Last updated:** [July 20, 2017, 6:33pm UTC](https://discuss.elastic.co/t/what-is-the-best-approach-to-capture-linux-ubuntu-server-logs/93415 "2017-07-20T18:33:39Z")
Can someone suggest me the best way to capture Ubuntu server logs and send it to Elasticsearch? I am trying to use Logstash but on top of that is there any other plugin? For windows event logs Winlogbeat and Logstash ca… --- ## [Unable to setup elasticsearch master slave architecture. Error "failed to send ping to"](https://discuss.elastic.co/t/unable-to-setup-elasticsearch-master-slave-architecture-error-failed-to-send-ping-to/61117)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 5\ **Last updated:** [September 22, 2016, 10:59am UTC](https://discuss.elastic.co/t/unable-to-setup-elasticsearch-master-slave-architecture-error-failed-to-send-ping-to/61117 "2016-09-22T10:59:50Z")
I am trying to setup 2 elasticsearch nodes in same ip, same cluster name, different node names, and different ports. I made 2 directories to put elasticsearch.yml and logging.yml, to launch 2 instances. My configuratio… --- ## [Compiling and testing Packetbeat for protocol development](https://discuss.elastic.co/t/compiling-and-testing-packetbeat-for-protocol-development/56888)
**Author:** [@jstangroome](https://discuss.elastic.co/u/jstangroome)\ **Replies:** 5\ **Last updated:** [August 2, 2016, 11:22am UTC](https://discuss.elastic.co/t/compiling-and-testing-packetbeat-for-protocol-development/56888 "2016-08-02T11:22:35Z")
Hi, I'm interested in developing new protocol support for Packetbeat. As such I've followed the beats "CONTRIBUTING.md" guide and the docs on "Adding a New Protocol". I've set up my Golang environment\* and I can succ… --- ## [IMAP-plugin logstash](https://discuss.elastic.co/t/imap-plugin-logstash/43240)
**Author:** [@petar.kozic](https://discuss.elastic.co/u/petar.kozic)\ **Replies:** 5\ **Last updated:** [March 30, 2016, 6:40am UTC](https://discuss.elastic.co/t/imap-plugin-logstash/43240 "2016-03-30T06:40:05Z")
Can it imap-plugin to receive mail from multiple folder, I think on Inbox and subfolder or only from Inbox ? --- ## [Parse logstash - rfc5424](https://discuss.elastic.co/t/parse-logstash-rfc5424/256992)
**Author:** [@Paulogbr](https://discuss.elastic.co/u/Paulogbr)\ **Replies:** 3\ **Last updated:** [November 30, 2020, 4:35pm UTC](https://discuss.elastic.co/t/parse-logstash-rfc5424/256992 "2020-11-30T16:35:25Z")
Hello guys, I need help to parse the syslog RFC 5424 with logstash. \<190\> 1 2020-11-28T14:18:03-02:00 workstantion1030.teste.corp WSEE - - \[message@01-\] @cee:{"type":"1","timestamp":"4698753981054","host\_name":"","user\_… --- ## [Converting Search Query To Filter](https://discuss.elastic.co/t/converting-search-query-to-filter/230595)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 3\ **Last updated:** [May 6, 2020, 6:27am UTC](https://discuss.elastic.co/t/converting-search-query-to-filter/230595 "2020-05-06T06:27:12Z")
I have a query I've built in the search menu I'd like to convert into a filter, if it's possible. I've tried it but I end up getting an error where it expects the end of the query but gets more. Below is my current que… --- ## [API Post role for kibana privileges - unexpected field \[kibana\]](https://discuss.elastic.co/t/api-post-role-for-kibana-privileges-unexpected-field-kibana/217123)
**Author:** [@Tennis](https://discuss.elastic.co/u/Tennis)\ **Replies:** 3\ **Last updated:** [January 31, 2020, 2:11pm UTC](https://discuss.elastic.co/t/api-post-role-for-kibana-privileges-unexpected-field-kibana/217123 "2020-01-31T14:11:03Z")
I want to create a role to control user access kibana feature (ref: Kibana privileges | Kibana Guide \[8.11\] | Elastic) My role in python code: my\_role = '{\\ "applications":\[\\ {\\ "application":"kiba… --- ## [Hash function in painless](https://discuss.elastic.co/t/hash-function-in-painless/169721)
**Author:** [@Yaming\_Ma](https://discuss.elastic.co/u/Yaming_Ma)\ **Replies:** 0\ **Last updated:** [February 24, 2019, 12:58pm UTC](https://discuss.elastic.co/t/hash-function-in-painless/169721 "2019-02-24T12:58:24Z")
Hi guys, I'm new to ES painless script. Is there any approach to do MD5 hash on certain fields in painless? I checked the API reference but found no such API. Or what the most efficient approach is if I want to do run M… --- ## [Limit to number of pipelines](https://discuss.elastic.co/t/limit-to-number-of-pipelines/133221)
**Author:** [@dalamar666](https://discuss.elastic.co/u/dalamar666)\ **Replies:** 3\ **Last updated:** [May 29, 2018, 4:08pm UTC](https://discuss.elastic.co/t/limit-to-number-of-pipelines/133221 "2018-05-29T16:08:20Z")
Hi, I have 5 pipelines on my machine. I have 8 CPU's and enough RAM and disk space for them. Only 3 of the pipelines are reporting data and creating indices. I have verified all of my configurations to make sure I di… --- ## [Kibana5 load balancing for HTTP requests](https://discuss.elastic.co/t/kibana5-load-balancing-for-http-requests/104818)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 3\ **Last updated:** [October 24, 2017, 10:08am UTC](https://discuss.elastic.co/t/kibana5-load-balancing-for-http-requests/104818 "2017-10-24T10:08:59Z")
Hi everybody, I would like to know the best possible way to implement the load balancing for Kibana. actually I have 3 nodes in a cluster; every node is master and data. I want to install kibana on another node (the fo… --- ## [Date parsing issue for getting timestamp](https://discuss.elastic.co/t/date-parsing-issue-for-getting-timestamp/82816)
**Author:** [@san\_maj](https://discuss.elastic.co/u/san_maj)\ **Replies:** 3\ **Last updated:** [April 20, 2017, 5:01am UTC](https://discuss.elastic.co/t/date-parsing-issue-for-getting-timestamp/82816 "2017-04-20T05:01:02Z")
I am aware that there have been many questions asked around this and this probably could be a repeat of sorts. But have to request someone guiding me on this. My log file looks like this - \ **Author:** [@Peque](https://discuss.elastic.co/u/Peque)\ **Replies:** 4\ **Last updated:** [June 18, 2021, 5:13am UTC](https://discuss.elastic.co/t/cannot-make-this-work/276090 "2021-06-18T05:13:28Z") Hi Group I struggling like H\*\*\* t omake this work I have created an ELK server on Ubuntu 20.04LTS - and would like to monitor both Normal Linux/Windows Server - and allso our PFsense Routers. I'm using the PFELK --\> G… --- ## [Heartbeat fatal error: concurrent map iteration and map write](https://discuss.elastic.co/t/heartbeat-fatal-error-concurrent-map-iteration-and-map-write/124716)
**Author:** [@Flavio\_Fortes](https://discuss.elastic.co/u/Flavio_Fortes)\ **Replies:** 4\ **Last updated:** [March 21, 2018, 12:13pm UTC](https://discuss.elastic.co/t/heartbeat-fatal-error-concurrent-map-iteration-and-map-write/124716 "2018-03-21T12:13:52Z")
Hello, I'm trying to run Heartbeat version 6.1.1 up to 6.1.3 all failing, normally after 20 minutes running due to the following error: 2018/03/19 23:56:00.640256 scheduler.go:170: DBG \[scheduler\] Next wakeup time: 20… --- ## [Filebeat docker image](https://discuss.elastic.co/t/filebeat-docker-image/107033)
**Author:** [@Vivek\_Samaga](https://discuss.elastic.co/u/Vivek_Samaga)\ **Replies:** 4\ **Last updated:** [November 13, 2017, 10:56am UTC](https://discuss.elastic.co/t/filebeat-docker-image/107033 "2017-11-13T10:56:02Z")
Am trying to dockerize filebeat with https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html#\_custom\_image\_configuration Using the Dockerfile am building the image and starting the filebeat contai… --- ## [Ingest attachment plugin, 2 fields with content - one encoded and one decoded](https://discuss.elastic.co/t/ingest-attachment-plugin-2-fields-with-content-one-encoded-and-one-decoded/100213)
**Author:** [@mbedna](https://discuss.elastic.co/u/mbedna)\ **Replies:** 4\ **Last updated:** [September 13, 2017, 7:32am UTC](https://discuss.elastic.co/t/ingest-attachment-plugin-2-fields-with-content-one-encoded-and-one-decoded/100213 "2017-09-13T07:32:52Z")
Is it necessary to have content of pdf file in 2 fields in Elastic while using ingest attachment plugin? Example: "data": "JVBERi0xLjUNCiW1tbW1DQoxIDA "attachment": { "content\_type": "application/pdf", "author": "Sa… --- ## [inFilter() and inQuery() were removed - what to use instead?](https://discuss.elastic.co/t/infilter-and-inquery-were-removed-what-to-use-instead/41233)
**Author:** [@tbessie](https://discuss.elastic.co/u/tbessie)\ **Replies:** 4\ **Last updated:** [February 9, 2016, 8:31am UTC](https://discuss.elastic.co/t/infilter-and-inquery-were-removed-what-to-use-instead/41233 "2016-02-09T08:31:08Z")
I'm upgrading from Elasticsearch 1.5 to 2.2, and am trying to fix the code to work with it. I am using filters, and am changing them all to queries; however, I'm using inFilter(), and there is no longer an inQuery() me… --- ## [Doubts on Class exclusion](https://discuss.elastic.co/t/doubts-on-class-exclusion/246655)
**Author:** [@manohar\_deepu](https://discuss.elastic.co/u/manohar_deepu)\ **Replies:** 7\ **Last updated:** [September 7, 2020, 11:53am UTC](https://discuss.elastic.co/t/doubts-on-class-exclusion/246655 "2020-09-07T11:53:32Z")
Hey, In my application, I have specified to exclude a DAO class (extending hibernate dao) using classes\_excluded\_from\_instrumentation. When I see the dashboard, I can still the db calls via that class instrumented. Am… --- ## [Zoom out](https://discuss.elastic.co/t/zoom-out/214996)
**Author:** [@Voula\_Mikr](https://discuss.elastic.co/u/Voula_Mikr)\ **Replies:** 1\ **Last updated:** [February 6, 2020, 3:31pm UTC](https://discuss.elastic.co/t/zoom-out/214996 "2020-02-06T15:31:04Z")
Hi! I did zoom in at a histogram but there is no way to zoom out except pressing back botton. Is there any other way to zoom out that I am missing? Also when you zoom in in a visualization of an iframe there is no way… --- ## [Grok processor: Expected output to be decimal, but output was string](https://discuss.elastic.co/t/grok-processor-expected-output-to-be-decimal-but-output-was-string/180123)
**Author:** [@Miao](https://discuss.elastic.co/u/Miao)\ **Replies:** 1\ **Last updated:** [May 8, 2019, 8:22am UTC](https://discuss.elastic.co/t/grok-processor-expected-output-to-be-decimal-but-output-was-string/180123 "2019-05-08T08:22:48Z")
I created a pipeline called parse\_duration: { "description" : "ParseDuration", "processors": \[ { "grok": { "field": "Duration", "patterns": \["%{NUMBER:DrillDuration}"\] } } \] } I… --- ## [Logstash beta - 1 does not include logrotate file](https://discuss.elastic.co/t/logstash-beta-1-does-not-include-logrotate-file/61680)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 7\ **Last updated:** [September 29, 2016, 7:37am UTC](https://discuss.elastic.co/t/logstash-beta-1-does-not-include-logrotate-file/61680 "2016-09-29T07:37:48Z")
I just installed brandnew logstash 5.0 beta1 but it seem that package does not include the logrotate script. \[root@BS-POC-Test-Env logstash\]# yum install logstash Loaded plugins: fastestmirror, langpacks Loading mirror… --- ## [Term Query for short keywords that include spaces](https://discuss.elastic.co/t/term-query-for-short-keywords-that-include-spaces/190351)
**Author:** [@droplet](https://discuss.elastic.co/u/droplet)\ **Replies:** 2\ **Last updated:** [July 15, 2019, 11:44am UTC](https://discuss.elastic.co/t/term-query-for-short-keywords-that-include-spaces/190351 "2019-07-15T11:44:02Z")
Hi there, stuck on a simple problem. I have an index containing various RAM sizes (1GB, 2GB, 3GB, 4GB...24GB) Is there a way to use Term query to check if RAM size exists in the index? Search for "4 GB" (notice the s… --- ## [Sense Issue with mapper attachment](https://discuss.elastic.co/t/sense-issue-with-mapper-attachment/52541)
**Author:** [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Replies:** 2\ **Last updated:** [June 12, 2016, 5:02pm UTC](https://discuss.elastic.co/t/sense-issue-with-mapper-attachment/52541 "2016-06-12T17:02:08Z")
I have been using mapper attachment plugin in Sense to create index, however, it is giving me some kinds of error as shown below Uncaught QuotaExceededError: Failed to execute 'setItem' on 'Storage': Setting the value … --- ## [Error Visualize: Field data loading is forbidden on IIS\_Method](https://discuss.elastic.co/t/error-visualize-field-data-loading-is-forbidden-on-iis-method/45063)
**Author:** [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Replies:** 2\ **Last updated:** [March 22, 2016, 4:12pm UTC](https://discuss.elastic.co/t/error-visualize-field-data-loading-is-forbidden-on-iis-method/45063 "2016-03-22T16:12:10Z")
I have added a new field called "IIS\_HTTPVerb". It contains values such as GET, POST, DELETE and PUT. I am trying to add a BAR visualization on this field. Based on these values I need to create multiple bars(X AXIS) and… --- ## [Getting a filebeat error when trying to send filebeat logs to elasticsearch](https://discuss.elastic.co/t/getting-a-filebeat-error-when-trying-to-send-filebeat-logs-to-elasticsearch/290319)
**Author:** [@mandude77](https://discuss.elastic.co/u/mandude77)\ **Replies:** 6\ **Last updated:** [November 26, 2021, 10:23pm UTC](https://discuss.elastic.co/t/getting-a-filebeat-error-when-trying-to-send-filebeat-logs-to-elasticsearch/290319 "2021-11-26T22:23:57Z")
Please advise --- ## [On startup run filebeat restart upon fail](https://discuss.elastic.co/t/on-startup-run-filebeat-restart-upon-fail/262204)
**Author:** [@Peter\_Boos](https://discuss.elastic.co/u/Peter_Boos)\ **Replies:** 6\ **Last updated:** [January 26, 2021, 10:51am UTC](https://discuss.elastic.co/t/on-startup-run-filebeat-restart-upon-fail/262204 "2021-01-26T10:51:21Z")
On a test machine with Debian 10 with a desktop, filebeat did not startup after a hard VM reset. I would like to be sure that on Debian systems with a desktop and headless systems this service restart it self upon failu… --- ## [How to drop some fields with mysql module using filebeat](https://discuss.elastic.co/t/how-to-drop-some-fields-with-mysql-module-using-filebeat/131861)
**Author:** [@pcleon](https://discuss.elastic.co/u/pcleon)\ **Replies:** 6\ **Last updated:** [May 22, 2018, 12:30pm UTC](https://discuss.elastic.co/t/how-to-drop-some-fields-with-mysql-module-using-filebeat/131861 "2018-05-22T12:30:43Z")
i want to drop some fields in filebeat.yml when load mysql module, just like mysql.slowlog.id, but it doesn't affect when i use processors: - include\_fields: fields: \["mysql.slow"\] - drop\_fields: fields: \["mysq… --- ## [./Kibana not starting](https://discuss.elastic.co/t/kibana-not-starting/93160)
**Author:** [@Joe\_Abraham](https://discuss.elastic.co/u/Joe_Abraham)\ **Replies:** 6\ **Last updated:** [July 17, 2017, 1:22pm UTC](https://discuss.elastic.co/t/kibana-not-starting/93160 "2017-07-17T13:22:54Z")
When I execute ./kibana, following error occurs {"@timestamp":"2017-07-14T09:51:52.033Z","level":"fatal","message":{"root\_cause":\[{"type":"index\_not\_found\_exception","reason":"no such index","resource.type":"index\_or\_a… --- ## [Logs duplicated in all indices](https://discuss.elastic.co/t/logs-duplicated-in-all-indices/127375)
**Author:** [@killbartonking](https://discuss.elastic.co/u/killbartonking)\ **Replies:** 1\ **Last updated:** [April 10, 2018, 9:08am UTC](https://discuss.elastic.co/t/logs-duplicated-in-all-indices/127375 "2018-04-10T09:08:28Z")
currently running the latest release of the whole stack- at the moment, i have several inputs with a different logstash config file for each, but for some reason, data from one input is showing up in a different index. f… --- ## [Filter/sort by location when migrate from 1.7 to 2.4](https://discuss.elastic.co/t/filter-sort-by-location-when-migrate-from-1-7-to-2-4/73736)
**Author:** [@tomas-stefano](https://discuss.elastic.co/u/tomas-stefano)\ **Replies:** 3\ **Last updated:** [February 6, 2017, 7:35pm UTC](https://discuss.elastic.co/t/filter-sort-by-location-when-migrate-from-1-7-to-2-4/73736 "2017-02-06T19:35:56Z")
Hello all, I am trying to upgrade an elastic search app from 1.7.X to 2.4 version, but I am not able to reproduce the same search results on the new version. First thing that I identify is the sort by location is not… --- ## [Functionbeat Sending to Wrong Index](https://discuss.elastic.co/t/functionbeat-sending-to-wrong-index/187415)
**Author:** [@jeffreygatsby](https://discuss.elastic.co/u/jeffreygatsby)\ **Replies:** 0\ **Last updated:** [June 25, 2019, 6:55pm UTC](https://discuss.elastic.co/t/functionbeat-sending-to-wrong-index/187415 "2019-06-25T18:55:19Z")
I'm attempting to change the index that FunctionBeat sends to. Here is my configuration: functionbeat.provider.aws.deploy\_bucket: "gatsby-deploy" functionbeat.provider.aws.functions: - name: EcsStagingLogs enable… --- ## [Empty inner\_hits in compound filter](https://discuss.elastic.co/t/empty-inner-hits-in-compound-filter/74134)
**Author:** [@njahncke](https://discuss.elastic.co/u/njahncke)\ **Replies:** 0\ **Last updated:** [February 6, 2017, 10:21pm UTC](https://discuss.elastic.co/t/empty-inner-hits-in-compound-filter/74134 "2017-02-06T22:21:41Z")
I'm seeing what appears to be aberrant behavior in inner\_hits results within nested boolean queries. Test data (abbreviated due to character limit): # MAPPING PUT unit\_testing { "mappings": { "document": … --- ## [Microsoft Filebeat Module - Lack of ECS utilization](https://discuss.elastic.co/t/microsoft-filebeat-module-lack-of-ecs-utilization/315125)
**Author:** [@aforfot](https://discuss.elastic.co/u/aforfot)\ **Replies:** 6\ **Last updated:** [September 27, 2022, 7:12am UTC](https://discuss.elastic.co/t/microsoft-filebeat-module-lack-of-ecs-utilization/315125 "2022-09-27T07:12:21Z")
We are ingesting Microsoft ATP and M365 Defender data into our Elasticsearch for search, detection in Elastic Security, and visualization through Kibana. However, we have noticed a few specific fields where the Microsoft… --- ## [How do I save Kibana dev tools console or history log](https://discuss.elastic.co/t/how-do-i-save-kibana-dev-tools-console-or-history-log/244965)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 1\ **Last updated:** [August 14, 2020, 2:01pm UTC](https://discuss.elastic.co/t/how-do-i-save-kibana-dev-tools-console-or-history-log/244965 "2020-08-14T14:01:55Z")
Hi guys , I want to save the queries or historical records I run in Devtools console into an index, is that possible? --- ## [Need some help with ruby split](https://discuss.elastic.co/t/need-some-help-with-ruby-split/189368)
**Author:** [@lostsoul352](https://discuss.elastic.co/u/lostsoul352)\ **Replies:** 1\ **Last updated:** [July 8, 2019, 3:19pm UTC](https://discuss.elastic.co/t/need-some-help-with-ruby-split/189368 "2019-07-08T15:19:19Z")
I have a field called 'path' which contains alinux filesystem path, and I'm trying to use ruby split to get the last and 3rd fields. These will be stored in two new fields called 'log\_filename' and 'deployment' like this… --- ## [Logstash stops randomly with NoMethodError: undefined method \`split' for nil:NilClass Exception](https://discuss.elastic.co/t/logstash-stops-randomly-with-nomethoderror-undefined-method-split-for-nil-nilclass-exception/98596)
**Author:** [@amit.karir](https://discuss.elastic.co/u/amit.karir)\ **Replies:** 1\ **Last updated:** [August 29, 2017, 5:30am UTC](https://discuss.elastic.co/t/logstash-stops-randomly-with-nomethoderror-undefined-method-split-for-nil-nilclass-exception/98596 "2017-08-29T05:30:21Z")
Hi, Logstash stops running randomly with below exception message. Would really appreciate any pointers to resolve this issue: Exception in pipelineworker, the pipeline stopped processing new events, please check your … --- ## [Bug when attempting to use logstash-output-s3 with encryption](https://discuss.elastic.co/t/bug-when-attempting-to-use-logstash-output-s3-with-encryption/89775)
**Author:** [@Josh\_Harrison](https://discuss.elastic.co/u/Josh_Harrison)\ **Replies:** 1\ **Last updated:** [June 16, 2017, 10:04pm UTC](https://discuss.elastic.co/t/bug-when-attempting-to-use-logstash-output-s3-with-encryption/89775 "2017-06-16T22:04:54Z")
I have an s3 bucket where I have policy set like { "Version": "2012-10-17", "Id": "PutObjPolicy", "Statement": \[ { "Sid": "DenyIncorrectEncryptionHeader", "Effect": "Deny", … --- ## [Most popular keywords statistic?](https://discuss.elastic.co/t/most-popular-keywords-statistic/49914)
**Author:** [@batmaci](https://discuss.elastic.co/u/batmaci)\ **Replies:** 1\ **Last updated:** [May 12, 2016, 4:02pm UTC](https://discuss.elastic.co/t/most-popular-keywords-statistic/49914 "2016-05-12T16:02:44Z")
Hi, Does Marvel plugin display what customers are searching? I mean the keywords they type. thanks [Previous page](https://discuss.elastic.co/top.md?page=1167&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1169&per_page=50&period=all)