# Top **URL:** https://discuss.elastic.co/top.md?page=1179&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1180 --- ## [Help to add new field from @timestamp](https://discuss.elastic.co/t/help-to-add-new-field-from-timestamp/152202)
**Author:** [@florentmair](https://discuss.elastic.co/u/florentmair)\ **Replies:** 2\ **Last updated:** [October 12, 2018, 1:19pm UTC](https://discuss.elastic.co/t/help-to-add-new-field-from-timestamp/152202 "2018-10-12T13:19:24Z")
Hello, i am not able to add new field, i want to date the hourofday value on a new field, but i have this error I don't find into the documentation why it doesn't work POST logstash-eno-2018.10\_v2/\_update\_by\_query { … --- ## [Display exact field value with no aggregation](https://discuss.elastic.co/t/display-exact-field-value-with-no-aggregation/136337)
**Author:** [@tlloyd0219](https://discuss.elastic.co/u/tlloyd0219)\ **Replies:** 2\ **Last updated:** [June 18, 2018, 6:00pm UTC](https://discuss.elastic.co/t/display-exact-field-value-with-no-aggregation/136337 "2018-06-18T18:00:15Z")
My team is wanting to use Kibana to display statistics contained in logs we generate and store in Elastic such as the number of executors used (x-axis) and the total time for that run (y-axis). I don't want to apply any … --- ## [Hot-Warm architecture - ES high CPU usage](https://discuss.elastic.co/t/hot-warm-architecture-es-high-cpu-usage/130064)
**Author:** [@cactus](https://discuss.elastic.co/u/cactus)\ **Replies:** 2\ **Last updated:** [May 4, 2018, 3:02pm UTC](https://discuss.elastic.co/t/hot-warm-architecture-es-high-cpu-usage/130064 "2018-05-04T15:02:13Z")
Hello, We are using ES for logging, logs are coming to ES in real time. To speed up logs searching and total logs capacity we using ES hot-warm architecture: 6 hot nodes (4 vCPUs, 26 GB memory, 500GB ssd ) 6 warm nod… --- ## [How can I reindex monthly indexes to weekly indexes](https://discuss.elastic.co/t/how-can-i-reindex-monthly-indexes-to-weekly-indexes/129867)
**Author:** [@kriket](https://discuss.elastic.co/u/kriket)\ **Replies:** 2\ **Last updated:** [May 3, 2018, 4:56am UTC](https://discuss.elastic.co/t/how-can-i-reindex-monthly-indexes-to-weekly-indexes/129867 "2018-05-03T04:56:07Z")
We have currently monthly indexes in the following format fabricxxx-access-log-monthly-2018.01 .. .. fabricxxx-access-log-monthly-2018.04 We have decided to move away from monthly indexes to weekly indexes due to da… --- ## [Specify search preference with Python API](https://discuss.elastic.co/t/specify-search-preference-with-python-api/70143)
**Author:** [@sam\_sak](https://discuss.elastic.co/u/sam_sak)\ **Replies:** 2\ **Last updated:** [January 2, 2017, 4:21pm UTC](https://discuss.elastic.co/t/specify-search-preference-with-python-api/70143 "2017-01-02T16:21:08Z")
Hi, I am an ES novice and I would be thankful if anyone would help with my 'silly' question. How can I set my search preference using Python API ? Specifically, I need to specify the shard at each request. I can't fin… --- ## [Output specific input to specific pipelines](https://discuss.elastic.co/t/output-specific-input-to-specific-pipelines/68686)
**Author:** [@dwjvaughan](https://discuss.elastic.co/u/dwjvaughan)\ **Replies:** 2\ **Last updated:** [December 12, 2016, 2:29pm UTC](https://discuss.elastic.co/t/output-specific-input-to-specific-pipelines/68686 "2016-12-12T14:29:37Z")
I have a filebeat on a server with multiple files to be ingested into a single Elasticsearch cluster. The issue I have is the files are very different, and as such, require very different ingest pipelines. So the ques… --- ## [How can I completely purge docs.deleted for an index?](https://discuss.elastic.co/t/how-can-i-completely-purge-docs-deleted-for-an-index/51524)
**Author:** [@Hacksign](https://discuss.elastic.co/u/Hacksign)\ **Replies:** 2\ **Last updated:** [June 1, 2016, 9:56am UTC](https://discuss.elastic.co/t/how-can-i-completely-purge-docs-deleted-for-an-index/51524 "2016-06-01T09:56:12Z")
I'v done cleaning index with following command: curl -XPOST 'http://localhost:9200/my-indices-\*/\_forcemerge?only\_expunge\_deletes=true&max\_num\_segments=1&flush=true' But there is still numbers of docs.deleted docs l… --- ## [Cross Cluster Replication for existing indexes](https://discuss.elastic.co/t/cross-cluster-replication-for-existing-indexes/334515)
**Author:** [@vvsh](https://discuss.elastic.co/u/vvsh)\ **Replies:** 8\ **Last updated:** [June 1, 2023, 3:58pm UTC](https://discuss.elastic.co/t/cross-cluster-replication-for-existing-indexes/334515 "2023-06-01T15:58:53Z")
Hello! I am considering CCR as a tool to migrate all the data (including historical data) from a source Elasticsearch single-node cluster to a target Elasticsearch multi-node cluster (both clusters have 7.17.7 version). … --- ## [Stop the search request once it finds first 10 hits](https://discuss.elastic.co/t/stop-the-search-request-once-it-finds-first-10-hits/270783)
**Author:** [@DEEPTHI\_SONA\_G](https://discuss.elastic.co/u/DEEPTHI_SONA_G)\ **Replies:** 8\ **Last updated:** [April 21, 2021, 9:02am UTC](https://discuss.elastic.co/t/stop-the-search-request-once-it-finds-first-10-hits/270783 "2021-04-21T09:02:35Z")
I am doing some performance testing on Elasticsearch. So I am comparing Oracle db with Elasticsearch. The Oracle query is able to stop it's search once it finds the first 10matches by using the code select \* from mtd\_s… --- ## [High cpu usage with marvel-agent (2.4)](https://discuss.elastic.co/t/high-cpu-usage-with-marvel-agent-2-4/126587)
**Author:** [@fnork](https://discuss.elastic.co/u/fnork)\ **Replies:** 8\ **Last updated:** [April 5, 2018, 11:01am UTC](https://discuss.elastic.co/t/high-cpu-usage-with-marvel-agent-2-4/126587 "2018-04-05T11:01:20Z")
We have an 8 node cluster with about 100 indexes and 1000 shards. The node with the primary marvel index shard shows a running \>80% cpu usage (in marvel :), while indexing about 60 docs/sec. hot threads shows the marve… --- ## [Terms aggregations cannot get accurate number of record](https://discuss.elastic.co/t/terms-aggregations-cannot-get-accurate-number-of-record/72497)
**Author:** [@111151](https://discuss.elastic.co/u/111151)\ **Replies:** 8\ **Last updated:** [January 24, 2017, 3:56am UTC](https://discuss.elastic.co/t/terms-aggregations-cannot-get-accurate-number-of-record/72497 "2017-01-24T03:56:20Z")
my aggregation query like this : { "size": 0, "query": { "bool": { "must": \[ { "term": { "month\_id": { "value": 154, … --- ## [Problem in Plurals (in snowball)](https://discuss.elastic.co/t/problem-in-plurals-in-snowball/13954)
**Author:** [@samaswin](https://discuss.elastic.co/u/samaswin)\ **Replies:** 8\ **Last updated:** [October 16, 2013, 9:31am UTC](https://discuss.elastic.co/t/problem-in-plurals-in-snowball/13954 "2013-10-16T09:31:04Z")
If I search goose it should return geese. But in snow field it's not. Any one know the solution? -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe … --- ## [Dec 14th, 2018: \[EN\]\[Kibana\] Canvas: From 0 to dashboard before the morning is out](https://discuss.elastic.co/t/dec-14th-2018-en-kibana-canvas-from-0-to-dashboard-before-the-morning-is-out/160428)
**Author:** [@crayzeigh](https://discuss.elastic.co/u/crayzeigh)\ **Replies:** 0\ **Last updated:** [December 14, 2018, 12:00am UTC](https://discuss.elastic.co/t/dec-14th-2018-en-kibana-canvas-from-0-to-dashboard-before-the-morning-is-out/160428 "2018-12-14T00:00:01Z")
Canvas is probably my favorite new feature of Kibana. Since its first technology previews I was thrilled with the idea of live-data backed slide decks built inside of Kibana and beautiful free-form dashboards. It's only … --- ## [Logstash grok filter setting for php monolog multi-line(stacktrace) logs](https://discuss.elastic.co/t/logstash-grok-filter-setting-for-php-monolog-multi-line-stacktrace-logs/119467)
**Author:** [@rsathishtechit](https://discuss.elastic.co/u/rsathishtechit)\ **Replies:** 0\ **Last updated:** [February 12, 2018, 12:48pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-setting-for-php-monolog-multi-line-stacktrace-logs/119467 "2018-02-12T12:48:30Z")
\[2018-02-12 09:15:43\] development.WARNING: home page \[2018-02-12 09:15:43\] development.INFO: home page \[2018-02-12 10:22:50\] development.WARNING: home page \[2018-02-12 10:22:50\] development.INFO: home page \[2018-… --- ## [Unable to parse csv over 20000 with Data Visualizer](https://discuss.elastic.co/t/unable-to-parse-csv-over-20000-with-data-visualizer/236208)
**Author:** [@Thodoris\_Alexopoulos](https://discuss.elastic.co/u/Thodoris_Alexopoulos)\ **Replies:** 4\ **Last updated:** [June 23, 2020, 9:17am UTC](https://discuss.elastic.co/t/unable-to-parse-csv-over-20000-with-data-visualizer/236208 "2020-06-23T09:17:34Z")
Hello everyone, I am trying to parse a CSV file that is 22000 rows to Data visualizer and it fails with error , file could not be read. Unexpected token \< in JSON at position 0. But when I erase 3000 rows the file passe… --- ## [Use ecs with vpn server](https://discuss.elastic.co/t/use-ecs-with-vpn-server/235656)
**Author:** [@orsa](https://discuss.elastic.co/u/orsa)\ **Replies:** 4\ **Last updated:** [June 4, 2020, 3:33pm UTC](https://discuss.elastic.co/t/use-ecs-with-vpn-server/235656 "2020-06-04T15:33:59Z")
Hi, I parse Mikrotik log vpn server and and encountered difficulties in applying the ecs for some fields. Exsample: vpn session time - the total time of VPN session vpn session rx bits or packets vpn session tx bits… --- ## [Latest full document in transform](https://discuss.elastic.co/t/latest-full-document-in-transform/221435)
**Author:** [@Reshad](https://discuss.elastic.co/u/Reshad)\ **Replies:** 4\ **Last updated:** [March 3, 2020, 4:10am UTC](https://discuss.elastic.co/t/latest-full-document-in-transform/221435 "2020-03-03T04:10:44Z")
Hi, I am using elasticsearch, kibana and metricbeat to gather metrics from my systems. I want to build a few Data Table visualisation that have a list of: hosts that are currently at more than 80% RAM hosts that curre… --- ## [Expected json encoding for TCP input?](https://discuss.elastic.co/t/expected-json-encoding-for-tcp-input/172301)
**Author:** [@chmike](https://discuss.elastic.co/u/chmike)\ **Replies:** 4\ **Last updated:** [March 15, 2019, 10:38am UTC](https://discuss.elastic.co/t/expected-json-encoding-for-tcp-input/172301 "2019-03-15T10:38:32Z")
I need to implement a client that sends logging records to a logstash instance at a relative high rate (at least 2kHz). https can’t match this requirement. An option is to use the TCP input plugin, but I failed to find a… --- ## [Elasticsearch 6.0 and joining queries](https://discuss.elastic.co/t/elasticsearch-6-0-and-joining-queries/109353)
**Author:** [@danielburchardt](https://discuss.elastic.co/u/danielburchardt)\ **Replies:** 4\ **Last updated:** [December 1, 2017, 10:59am UTC](https://discuss.elastic.co/t/elasticsearch-6-0-and-joining-queries/109353 "2017-12-01T10:59:52Z")
Hello, I trying create relation parent-child as in docs (https://www.elastic.co/guide/en/elasticsearch/reference/current/parent-join.html) but when i querying: { "query": { "parent\_id": { "type": "answer",… --- ## [Converting string(Time) field to date field...!](https://discuss.elastic.co/t/converting-string-time-field-to-date-field/97339)
**Author:** [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)\ **Replies:** 4\ **Last updated:** [August 17, 2017, 9:22am UTC](https://discuss.elastic.co/t/converting-string-time-field-to-date-field/97339 "2017-08-17T09:22:58Z")
Hi I’ve a Time field in my log file which is a string type, i want that field to be date field. #my logstash filter config file kv{ value\_split =\> “=” } date { match =\> \[“Time”,“yyyy-MM-dd\_HH:mm:ss.SSS”\] target =\>… --- ## [Heap usage of client node is continuously increasing as I run queries](https://discuss.elastic.co/t/heap-usage-of-client-node-is-continuously-increasing-as-i-run-queries/77032)
**Author:** [@vangap](https://discuss.elastic.co/u/vangap)\ **Replies:** 4\ **Last updated:** [March 3, 2017, 6:05am UTC](https://discuss.elastic.co/t/heap-usage-of-client-node-is-continuously-increasing-as-i-run-queries/77032 "2017-03-03T06:05:33Z")
ES 5.2.2, Ubuntu 16.04, Oracle JRE8 I have a 6x m4.large nodes, 120 M docs split into nearly 70 indices with 5 shards, 1 replica. Querying is only done on latest data about 1 M docs using time filters. This is a test … --- ## [Default install of logstash 8.1 results in error](https://discuss.elastic.co/t/default-install-of-logstash-8-1-results-in-error/300854)
**Author:** [@Louis\_Bohm](https://discuss.elastic.co/u/Louis_Bohm)\ **Replies:** 5\ **Last updated:** [March 29, 2022, 4:50pm UTC](https://discuss.elastic.co/t/default-install-of-logstash-8-1-results-in-error/300854 "2022-03-29T16:50:12Z")
I am running Centos 7.9 and followed the directions on this web to install logstash. After doing a yum -y install logstash to get logstash 8.1 installed did the following: Removed the logstash-sample.conf. Ran the fol… --- ## [Work with GeoLocation](https://discuss.elastic.co/t/work-with-geolocation/215242)
**Author:** [@malik\_aditya](https://discuss.elastic.co/u/malik_aditya)\ **Replies:** 5\ **Last updated:** [March 27, 2020, 10:24am UTC](https://discuss.elastic.co/t/work-with-geolocation/215242 "2020-03-27T10:24:06Z")
Hi. I'm trying to implement the near me feature using geolocation type field. However i don't see any documentation regarding quering using geolocation, so if you can please help me or just point to the right documentati… --- ## [Adding patterns in ES on AWS, pipeline definition through API](https://discuss.elastic.co/t/adding-patterns-in-es-on-aws-pipeline-definition-through-api/151378)
**Author:** [@bizmate](https://discuss.elastic.co/u/bizmate)\ **Replies:** 5\ **Last updated:** [October 11, 2018, 11:31pm UTC](https://discuss.elastic.co/t/adding-patterns-in-es-on-aws-pipeline-definition-through-api/151378 "2018-10-11T23:31:46Z")
Overall objective conversion from Logstash to Filebeat with ES pipeline, looking for pointers about: Migrate Logstash filters into an ES pipeline Migrated the patterns currently loaded in a directory but as I am using … --- ## [Import json](https://discuss.elastic.co/t/import-json/119690)
**Author:** [@Pororo](https://discuss.elastic.co/u/Pororo)\ **Replies:** 5\ **Last updated:** [February 14, 2018, 7:09am UTC](https://discuss.elastic.co/t/import-json/119690 "2018-02-14T07:09:00Z")
Hi, I was trying to import json file to ES thru logstash but it seems something wrong with my operation. Here is my json sample: {"jurHash":"112256955","txnId":"vipus0E48BEC71E28C81F","ts":"2018-01-29 00:03:30.085 +000… --- ## [Adding management plugin](https://discuss.elastic.co/t/adding-management-plugin/102561)
**Author:** [@ENG618](https://discuss.elastic.co/u/ENG618)\ **Replies:** 5\ **Last updated:** [October 10, 2017, 8:23pm UTC](https://discuss.elastic.co/t/adding-management-plugin/102561 "2017-10-10T20:23:40Z")
I'm trying to add a section to the management landing page. Similar to how xpack adds sections there with there own configuration pages. I could not find any documentation or examples of there. Something similar to th… --- ## [Decompressing Elasticsearch 2 snapshot metadata](https://discuss.elastic.co/t/decompressing-elasticsearch-2-snapshot-metadata/47466)
**Author:** [@nvitucci](https://discuss.elastic.co/u/nvitucci)\ **Replies:** 5\ **Last updated:** [April 15, 2016, 2:50pm UTC](https://discuss.elastic.co/t/decompressing-elasticsearch-2-snapshot-metadata/47466 "2016-04-15T14:50:15Z")
Hello, I used to be able to manually decompress Elasticsearch 1.7 snapshot metadata (and thus read index settings and mappings) by using a LZF decompressor. With Elasticsearch 2.x this appears to be no longer the case.… --- ## [Agent stuck on updating after install](https://discuss.elastic.co/t/agent-stuck-on-updating-after-install/322641)
**Author:** [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\ **Replies:** 0\ **Last updated:** [January 6, 2023, 9:37pm UTC](https://discuss.elastic.co/t/agent-stuck-on-updating-after-install/322641 "2023-01-06T21:37:45Z")
Continuing the discussion from Agent stuck on updating but still send index: We are also seeing this. We have Fleet deployed in ECK. We have 2 fleet servers listed in Kibana, one url is the k8s internal Cluster DNS FQ… --- ## [Restore Snapshot in a new Index](https://discuss.elastic.co/t/restore-snapshot-in-a-new-index/116656)
**Author:** [@Shalvin\_Kumar](https://discuss.elastic.co/u/Shalvin_Kumar)\ **Replies:** 0\ **Last updated:** [January 23, 2018, 11:25am UTC](https://discuss.elastic.co/t/restore-snapshot-in-a-new-index/116656 "2018-01-23T11:25:16Z")
Hi Team, Its slightly urgent to get this done. I will detail my problem below: So I had an index named 'tradeflow' where I had created atleast 20 scripted fields to generate few reports required by Business of our orga… --- ## [Cannot read property 'start' of null with Mongodb instrumentation crashes the app](https://discuss.elastic.co/t/cannot-read-property-start-of-null-with-mongodb-instrumentation-crashes-the-app/122400)
**Author:** [@Shimi](https://discuss.elastic.co/u/Shimi)\ **Replies:** 3\ **Last updated:** [March 5, 2018, 8:00am UTC](https://discuss.elastic.co/t/cannot-read-property-start-of-null-with-mongodb-instrumentation-crashes-the-app/122400 "2018-03-05T08:00:54Z")
Exception message Cannot read property 'start' of null Culprit wrappedFunction (node\_modules/elastic-apm-node/lib/instrumentation/modules/mongodb-core.js) node\_modules/elastic-apm-node/lib/instrumentation/modules/mon… --- ## [Node data synchronize problem](https://discuss.elastic.co/t/node-data-synchronize-problem/110828)
**Author:** [@f26227279](https://discuss.elastic.co/u/f26227279)\ **Replies:** 3\ **Last updated:** [December 8, 2017, 12:04pm UTC](https://discuss.elastic.co/t/node-data-synchronize-problem/110828 "2017-12-08T12:04:15Z")
Hi everyone, I have two nodes in a cluster. Now, if I close the master node, then another node become master node. But if I reopen the died node,there would become two master node in a cluster. is it correctly? Besi… --- ## [Logstash http server custom log format which includes values set in header](https://discuss.elastic.co/t/logstash-http-server-custom-log-format-which-includes-values-set-in-header/84647)
**Author:** [@rajsolanki](https://discuss.elastic.co/u/rajsolanki)\ **Replies:** 3\ **Last updated:** [May 8, 2017, 12:38pm UTC](https://discuss.elastic.co/t/logstash-http-server-custom-log-format-which-includes-values-set-in-header/84647 "2017-05-08T12:38:53Z")
Hi I have following LogFormat for my apache http server. LogFormat "%h %l %u %t \\"%r\\" %\>s %b %D \\"%{Referer}i\\" \\"%{User-Agent}i\\" \\"%{JWT-elapsed-time}i\\" \\"%{userID}i\\" \\"%{userRole}o\\" \\"%{localServiceAddress}i… --- ## [Elasticsearch Curator index pattern](https://discuss.elastic.co/t/elasticsearch-curator-index-pattern/81488)
**Author:** [@randreucetti](https://discuss.elastic.co/u/randreucetti)\ **Replies:** 3\ **Last updated:** [April 6, 2017, 3:49pm UTC](https://discuss.elastic.co/t/elasticsearch-curator-index-pattern/81488 "2017-04-06T15:49:24Z")
Hi, I'm trying to delete my old indexes with curator, however because of my index format I'm having trouble. The format of my indices is sg-YYYY-WW but the weeks start at sg-2017-1 not sg-2017-01. This is causing my … --- ## [Basic bytes/octets per second](https://discuss.elastic.co/t/basic-bytes-octets-per-second/33272)
**Author:** [@Chris\_Clifton](https://discuss.elastic.co/u/Chris_Clifton)\ **Replies:** 3\ **Last updated:** [October 30, 2015, 8:27pm UTC](https://discuss.elastic.co/t/basic-bytes-octets-per-second/33272 "2015-10-30T20:27:17Z")
Does packetbeat + elk support showing basic interface stats like pps or bytes/octets rates? --- ## [Index lifetime policy -\> remove link between policy and index template](https://discuss.elastic.co/t/index-lifetime-policy-remove-link-between-policy-and-index-template/181527)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 1\ **Last updated:** [May 24, 2019, 9:31pm UTC](https://discuss.elastic.co/t/index-lifetime-policy-remove-link-between-policy-and-index-template/181527 "2019-05-24T21:31:50Z")
Hi all, I was just playing a bit with index lifetime policy in 6.6.2. As I understand I create a policy and then I add the policy to an index template. I created it with kibana. I have following questions: I want t… --- ## [SQL query from Logstash causes an error PGobject](https://discuss.elastic.co/t/sql-query-from-logstash-causes-an-error-pgobject/138648)
**Author:** [@Igorr](https://discuss.elastic.co/u/Igorr)\ **Replies:** 1\ **Last updated:** [July 9, 2018, 11:36am UTC](https://discuss.elastic.co/t/sql-query-from-logstash-causes-an-error-pgobject/138648 "2018-07-09T11:36:02Z")
Logstash passes a request type: SELECT \* from dbmon\_stat\_activity() I get an error in the log: \_\[2018-07-02T14:00:00,384\]\[WARN \]\[logstash.inputs.jdbc \] Exception when executing JDBC query {:exception=\>#\ **Author:** [@Arvind\_Kumar1988](https://discuss.elastic.co/u/Arvind_Kumar1988)\ **Replies:** 1\ **Last updated:** [February 13, 2018, 9:26pm UTC](https://discuss.elastic.co/t/file-output-plugins-file-rotation-based-on-size-or-say-after-every-4-hours/119369 "2018-02-13T21:26:28Z") I am using file output plugin to write the logs processed by Logstash to files which are rotated day-wise but I want rotation of the output files based on the file size or after every say 4 hours. How can I achieve this? … --- ## [Configuring a Watcher to detect document changes in an Index](https://discuss.elastic.co/t/configuring-a-watcher-to-detect-document-changes-in-an-index/104096)
**Author:** [@MarkG](https://discuss.elastic.co/u/MarkG)\ **Replies:** 1\ **Last updated:** [October 18, 2017, 10:20am UTC](https://discuss.elastic.co/t/configuring-a-watcher-to-detect-document-changes-in-an-index/104096 "2017-10-18T10:20:33Z")
What I'm trying to achieve is to see if it's possible to detect changes to a document in an index. Basically if any part of the document changes I want the watcher to trigger a microservice to capture the changes. I wa… --- ## [Logstash mutate split](https://discuss.elastic.co/t/logstash-mutate-split/88097)
**Author:** [@Man-kyun\_Choi](https://discuss.elastic.co/u/Man-kyun_Choi)\ **Replies:** 1\ **Last updated:** [June 2, 2017, 4:32pm UTC](https://discuss.elastic.co/t/logstash-mutate-split/88097 "2017-06-02T16:32:10Z")
I installed ELK and try to configured logstash to parse our Web Application FIrewall security log. The WAF log is below May 31 13:47:11 2017 WAFK\_TAC (warning) log\_processor: \[WEBFRONT/0x00727001\] Violated Cross Site… --- ## [Use logstash to combine fields of nested object into one array of values](https://discuss.elastic.co/t/use-logstash-to-combine-fields-of-nested-object-into-one-array-of-values/67192)
**Author:** [@jettro](https://discuss.elastic.co/u/jettro)\ **Replies:** 1\ **Last updated:** [November 25, 2016, 3:37pm UTC](https://discuss.elastic.co/t/use-logstash-to-combine-fields-of-nested-object-into-one-array-of-values/67192 "2016-11-25T15:37:41Z")
Hi I am having a challenge which I did not find a solution for yet. I am using logstash to parse some input documents and I would like to do the following: { "groups": \[ { "id": 1, "name": "one" }… --- ## [.NET: Using NEST 7.x high-level client against Elasticsearch 6.x:](https://discuss.elastic.co/t/net-using-nest-7-x-high-level-client-against-elasticsearch-6-x/340768)
**Author:** [@Thomas\_Doman](https://discuss.elastic.co/u/Thomas_Doman)\ **Replies:** 6\ **Last updated:** [August 24, 2023, 7:12pm UTC](https://discuss.elastic.co/t/net-using-nest-7-x-high-level-client-against-elasticsearch-6-x/340768 "2023-08-24T19:12:08Z")
Continuing the discussion from .NET: Using newer NEST high-level client against previous version of Elasticsearch: @stephenb we've gotten to point of trying this out now. We've seen that using NEST 7.x against an ES 6.… --- ## [Unable to install ingest attachment plugin in windows using elasticsearch-plugin install ingest-attachment](https://discuss.elastic.co/t/unable-to-install-ingest-attachment-plugin-in-windows-using-elasticsearch-plugin-install-ingest-attachment/220104)
**Author:** [@samanvi\_sweety](https://discuss.elastic.co/u/samanvi_sweety)\ **Replies:** 6\ **Last updated:** [February 20, 2020, 9:24am UTC](https://discuss.elastic.co/t/unable-to-install-ingest-attachment-plugin-in-windows-using-elasticsearch-plugin-install-ingest-attachment/220104 "2020-02-20T09:24:51Z")
Exception in thread "main" java.net.ConnectException: Connection timed out: connect at java.base/java.net.PlainSocketImpl.connect0(Native Method) at java.base/java.net.PlainSocketImpl.socketConnect(PlainS… --- ## [ECE Saml Error still persists after upgrade](https://discuss.elastic.co/t/ece-saml-error-still-persists-after-upgrade/188104)
**Author:** [@afuggetta](https://discuss.elastic.co/u/afuggetta)\ **Replies:** 6\ **Last updated:** [October 1, 2019, 8:58pm UTC](https://discuss.elastic.co/t/ece-saml-error-still-persists-after-upgrade/188104 "2019-10-01T20:58:50Z")
Hi @Alex\_Piggott, I saw that ECE 2.2.3 came out and it had a SAML bug fix. However, after upgrading I still see the same error as explained in here: https://discuss.elastic.co/t/ece-saml-integration-error/180616 . Any … --- ## [Logstash grok for change field value](https://discuss.elastic.co/t/logstash-grok-for-change-field-value/167069)
**Author:** [@lukatoni](https://discuss.elastic.co/u/lukatoni)\ **Replies:** 6\ **Last updated:** [February 5, 2019, 12:21pm UTC](https://discuss.elastic.co/t/logstash-grok-for-change-field-value/167069 "2019-02-05T12:21:45Z")
Hi, I just wanna change my field value like this: I have a log json with field: "source\_host": "dev-host-test.com.pl", and i need to remove only .com.pl leave the old field and create new field with value: "new\_fiel… --- ## [Error when starting Elasticsearch single node](https://discuss.elastic.co/t/error-when-starting-elasticsearch-single-node/328207)
**Author:** [@abctha1234](https://discuss.elastic.co/u/abctha1234)\ **Replies:** 2\ **Last updated:** [March 22, 2023, 5:17pm UTC](https://discuss.elastic.co/t/error-when-starting-elasticsearch-single-node/328207 "2023-03-22T17:17:20Z")
My docker-compose.yaml elasticsearch: container\_name: elasticsearch image: docker.elastic.co/elasticsearch/elasticsearch:8.6.2 volumes: - elasticsearch\_data:/usr/share/elasticsearch/data - cert… --- ## [Redis input socketerror, Error: initialize: name or service not known](https://discuss.elastic.co/t/redis-input-socketerror-error-initialize-name-or-service-not-known/137721)
**Author:** [@layla](https://discuss.elastic.co/u/layla)\ **Replies:** 2\ **Last updated:** [June 28, 2018, 7:44am UTC](https://discuss.elastic.co/t/redis-input-socketerror-error-initialize-name-or-service-not-known/137721 "2018-06-28T07:44:09Z")
I have configured a logstash before the log comes to elasticache for redis, below is the configuration and I can send the syslog to elasticache for redis successfully. indent preformatted text by 4 spaces input { s… --- ## [Index patterns - comma-separated list](https://discuss.elastic.co/t/index-patterns-comma-separated-list/128013)
**Author:** [@aidofitz](https://discuss.elastic.co/u/aidofitz)\ **Replies:** 2\ **Last updated:** [April 17, 2018, 4:51pm UTC](https://discuss.elastic.co/t/index-patterns-comma-separated-list/128013 "2018-04-17T16:51:14Z")
Hi ELK 6.2.3 - In Kibana I can define an index pattern based on a comma-separated list of indexes, rather than using wildcards. Kibana appears to accept this and shows me the correct list of indexes matching pattern, w… --- ## [Issue Integrating Elasticsearch with JIRA REST API](https://discuss.elastic.co/t/issue-integrating-elasticsearch-with-jira-rest-api/102616)
**Author:** [@Olatunde\_Tokun](https://discuss.elastic.co/u/Olatunde_Tokun)\ **Replies:** 2\ **Last updated:** [October 11, 2017, 3:56pm UTC](https://discuss.elastic.co/t/issue-integrating-elasticsearch-with-jira-rest-api/102616 "2017-10-11T15:56:27Z")
Hello, Im configuring watcher to create tickets using JIRA rest api. Our JIRA API is not hosted on the default path, and this causes and error in the watcher action. (watcher cannot find the rest api). The default JIRA… --- ## [Plugin Installation Error](https://discuss.elastic.co/t/plugin-installation-error/63902)
**Author:** [@Harinath](https://discuss.elastic.co/u/Harinath)\ **Replies:** 2\ **Last updated:** [October 26, 2016, 11:51am UTC](https://discuss.elastic.co/t/plugin-installation-error/63902 "2016-10-26T11:51:06Z")
I have developed a Kibana 4.x plugin. I usually compress my files GUI in Ubuntu by right clicking the folder(compress..) and install the plugin in test machine (it was working fine). Recently when I tried to do it in co… --- ## [What is the encryptionKey for?](https://discuss.elastic.co/t/what-is-the-encryptionkey-for/67162)
**Author:** [@tmshn](https://discuss.elastic.co/u/tmshn)\ **Replies:** 2\ **Last updated:** [November 28, 2016, 2:32am UTC](https://discuss.elastic.co/t/what-is-the-encryptionkey-for/67162 "2016-11-28T02:32:59Z")
According to the getting started guide for the reporting plugin, the reporting.encryptionKey property need to be set in kibana.yml. And without setting it, I got the following error as expected: FATAL { \[Error: repor… [Previous page](https://discuss.elastic.co/top.md?page=1178&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1180&per_page=50&period=all)