# Top

**URL:** https://discuss.elastic.co/top.md?page=119&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 120

---

## [How to authenticate Docker kibana instance to AWS ES](https://discuss.elastic.co/t/how-to-authenticate-docker-kibana-instance-to-aws-es/185365)

<div class="topic-metadata">

**Author:** [@Merril](https://discuss.elastic.co/u/Merril)\
**Replies:** 9\
**Last updated:** [June 12, 2019, 2:15pm UTC](https://discuss.elastic.co/t/how-to-authenticate-docker-kibana-instance-to-aws-es/185365 "2019-06-12T14:15:46Z")

</div>

I am facing an issue to connect my Docker Kibana Instance to AWS ES. The error is Authorization exception. I can curl from the EC2 host and within the container. I have included the IP of the client to the access policy.…

---

## [Kibana crashes with default installation with FreeBSD](https://discuss.elastic.co/t/kibana-crashes-with-default-installation-with-freebsd/98909)

<div class="topic-metadata">

**Author:** [@GregTheHun](https://discuss.elastic.co/u/GregTheHun)\
**Replies:** 14\
**Last updated:** [September 27, 2017, 12:07am UTC](https://discuss.elastic.co/t/kibana-crashes-with-default-installation-with-freebsd/98909 "2017-09-27T00:07:58Z")

</div>

Hello all, There appears to be an issue and I didn’t know if anybody had any experience with Kibana on FreeBSD. Elasticsearch seems to install just fine after using the instructions with the package installer, but appa…

---

## [Logstash update elastic search when any update in a table](https://discuss.elastic.co/t/logstash-update-elastic-search-when-any-update-in-a-table/306133)

<div class="topic-metadata">

**Author:** [@ABHISHEK\_KUMAR\_SINGH](https://discuss.elastic.co/u/ABHISHEK_KUMAR_SINGH)\
**Replies:** 15\
**Last updated:** [June 6, 2022, 9:23am UTC](https://discuss.elastic.co/t/logstash-update-elastic-search-when-any-update-in-a-table/306133 "2022-06-06T09:23:45Z")

</div>

Hello, I have a Users table in my DB and I have successfully synced my logstash to update new records. But I want a way to update the existing records on Elasticsearch. I don't have any timestamp column in the table to …

---

## [Filebeat: Bug: Processor "decode\_json\_fields" with usage of "target"](https://discuss.elastic.co/t/filebeat-bug-processor-decode-json-fields-with-usage-of-target/296972)

<div class="topic-metadata">

**Author:** [@fwetzler](https://discuss.elastic.co/u/fwetzler)\
**Replies:** 13\
**Last updated:** [February 16, 2022, 5:07pm UTC](https://discuss.elastic.co/t/filebeat-bug-processor-decode-json-fields-with-usage-of-target/296972 "2022-02-16T17:07:17Z")

</div>

OS: SLES12, CentOS 7.9 Filebeat Versions: 7.8.0, 7.16.2 After using processor "decode\_json\_fields" WITH "target: 'sometarget' it's impossible to access some extracted json fields with following processors. If you le…

---

## [How to disable TTL feature for index after it has been enabled?](https://discuss.elastic.co/t/how-to-disable-ttl-feature-for-index-after-it-has-been-enabled/7012)

<div class="topic-metadata">

**Author:** [@Thomas\_Peuss](https://discuss.elastic.co/u/Thomas_Peuss)\
**Replies:** 10\
**Last updated:** [February 18, 2014, 1:40pm UTC](https://discuss.elastic.co/t/how-to-disable-ttl-feature-for-index-after-it-has-been-enabled/7012 "2014-02-18T13:40:54Z")

</div>

Hi! We have enabled the TTL feature for some of our indices. This works like a charm. But we want to disable this feature for one of our indices temporaryly. I tried with curl -v -XPUT 'http://localhost:9200/m…

---

## [Elasticsearch 8 Client is giving error The following method did not exist: ‘org.elasticsearch.client.RequestOptions$Builder org.elasticsearch.client.RequestOptions$Builder.removeHeader(java.lang.String)’](https://discuss.elastic.co/t/elasticsearch-8-client-is-giving-error-the-following-method-did-not-exist-org-elasticsearch-client-requestoptions-builder-org-elasticsearch-client-requestoptions-builder-removeheader-java-lang-string/335467)

<div class="topic-metadata">

**Author:** [@Skander\_Mansouri](https://discuss.elastic.co/u/Skander_Mansouri)\
**Replies:** 9\
**Last updated:** [June 8, 2023, 7:32am UTC](https://discuss.elastic.co/t/elasticsearch-8-client-is-giving-error-the-following-method-did-not-exist-org-elasticsearch-client-requestoptions-builder-org-elasticsearch-client-requestoptions-builder-removeheader-java-lang-string/335467 "2023-06-08T07:32:58Z")

</div>

I have copied exactly the same steps as the documentation elastic8 docs @Bean public ElasticsearchClient getElasticSearchClient(){ RestClient restClient = RestClient.builder( new HttpHost("", 9200)).build();…

---

## [Not able to filter certian ganglia gmond ouput using logstash](https://discuss.elastic.co/t/not-able-to-filter-certian-ganglia-gmond-ouput-using-logstash/28779)

<div class="topic-metadata">

**Author:** [@dhar](https://discuss.elastic.co/u/dhar)\
**Replies:** 11\
**Last updated:** [September 8, 2015, 9:54am UTC](https://discuss.elastic.co/t/not-able-to-filter-certian-ganglia-gmond-ouput-using-logstash/28779 "2015-09-08T09:54:11Z")

</div>

The objective of this exercise is to visualise ganglia gmond output in kibana. I am trying to filter out certian lines from ganglia gmond though logstash. If i try listening to udp port in logstash and apply the filter…

---

## [Elastic Json parse into logstash](https://discuss.elastic.co/t/elastic-json-parse-into-logstash/151840)

<div class="topic-metadata">

**Author:** [@moughrom](https://discuss.elastic.co/u/moughrom)\
**Replies:** 29\
**Last updated:** [October 25, 2018, 5:36pm UTC](https://discuss.elastic.co/t/elastic-json-parse-into-logstash/151840 "2018-10-25T17:36:26Z")

</div>

Hello, I am retrieving indices from an elasticsearch containing syslogs messages through a curl commande then they are read by a logstash. and want to extract 4 fields from this messages (datetime\_received,"ip\_host\_pkt…

---

## [Performance difference using bool with filter](https://discuss.elastic.co/t/performance-difference-using-bool-with-filter/33912)

<div class="topic-metadata">

**Author:** [@milodky](https://discuss.elastic.co/u/milodky)\
**Replies:** 10\
**Last updated:** [November 19, 2015, 1:50pm UTC](https://discuss.elastic.co/t/performance-difference-using-bool-with-filter/33912 "2015-11-19T13:50:31Z")

</div>

Hi, I'm currently testing the performance of ElasticSearch 2.0. My original query is: "query":{ "filtered":{ "filter":{ "term":{ "last\_name":"brown" } } } } The took…

---

## [Haproxy Passthrough Endpoints for ECE](https://discuss.elastic.co/t/haproxy-passthrough-endpoints-for-ece/216695)

<div class="topic-metadata">

**Author:** [@balogan](https://discuss.elastic.co/u/balogan)\
**Replies:** 10\
**Last updated:** [February 7, 2020, 7:10pm UTC](https://discuss.elastic.co/t/haproxy-passthrough-endpoints-for-ece/216695 "2020-02-07T19:10:13Z")

</div>

I'm attempting to setup haproxy to service all endpoints within an ECE deployment. First step with getting wildcard DNS setup is done. The problem is getting the endpoints passed through to the proxy servers. After go…

---

## [Kibana server-size integration with R, Perl, and other tools](https://discuss.elastic.co/t/kibana-server-size-integration-with-r-perl-and-other-tools/19451)

<div class="topic-metadata">

**Author:** [@brian\_yoder](https://discuss.elastic.co/u/brian_yoder)\
**Replies:** 10\
**Last updated:** [October 1, 2014, 7:32pm UTC](https://discuss.elastic.co/t/kibana-server-size-integration-with-r-perl-and-other-tools/19451 "2014-10-01T19:32:28Z")

</div>

Is there some existing method to integrate processing between the Kibana/ Elasticsearch response JSON and the graphing? For example, I have a Perl script that can convert an Elasticsearch JSON response into a CSV,…

---

## [Can we change Java heap memory in Filebeat? If yes, how and where do we change?](https://discuss.elastic.co/t/can-we-change-java-heap-memory-in-filebeat-if-yes-how-and-where-do-we-change/168933)

<div class="topic-metadata">

**Author:** [@Chandana](https://discuss.elastic.co/u/Chandana)\
**Replies:** 9\
**Last updated:** [March 5, 2019, 8:13pm UTC](https://discuss.elastic.co/t/can-we-change-java-heap-memory-in-filebeat-if-yes-how-and-where-do-we-change/168933 "2019-03-05T20:13:52Z")

</div>

Hi, Our filebeat installed server gives Swap Usage CRITICAL most of the time. Initially we used to restart the server, but we are trying for a solution for this. We have a 20GB RAM for that server. Do we have any opt…

---

## [About shards, nodes and cores](https://discuss.elastic.co/t/about-shards-nodes-and-cores/157190)

<div class="topic-metadata">

**Author:** [@lfv89](https://discuss.elastic.co/u/lfv89)\
**Replies:** 11\
**Last updated:** [November 19, 2018, 7:42pm UTC](https://discuss.elastic.co/t/about-shards-nodes-and-cores/157190 "2018-11-19T19:42:59Z")

</div>

I've been digging into Elastic's mechanism of shard distribution and I'd like to validate my understanding to see if I got something wrong or if there is something missing. With the aim of achieving a higher degree of p…

---

## [Filebeat fails when I configure an ingest-pipeline on filebeat.yml](https://discuss.elastic.co/t/filebeat-fails-when-i-configure-an-ingest-pipeline-on-filebeat-yml/290314)

<div class="topic-metadata">

**Author:** [@feliperuiz](https://discuss.elastic.co/u/feliperuiz)\
**Replies:** 15\
**Last updated:** [November 26, 2021, 9:59pm UTC](https://discuss.elastic.co/t/filebeat-fails-when-i-configure-an-ingest-pipeline-on-filebeat-yml/290314 "2021-11-26T21:59:27Z")

</div>

Hi. I have a filebeat working OK and shipping csv logs to ELK cloud. I have created a new ingest-pipeline on ELK, that takes the message and create some fields: \[ { "csv": { "field": "message", "targe…

---

## [Is Spark useful for reindexation?](https://discuss.elastic.co/t/is-spark-useful-for-reindexation/75919)

<div class="topic-metadata">

**Author:** [@geantbrun](https://discuss.elastic.co/u/geantbrun)\
**Replies:** 11\
**Last updated:** [February 24, 2017, 9:16pm UTC](https://discuss.elastic.co/t/is-spark-useful-for-reindexation/75919 "2017-02-24T21:16:02Z")

</div>

Hi all, I'm at the beginning process of writing an application to reindex all my data (in order to update my mapping, include new fields, etc). I would like to know the best way to go (in terms of speed, I have Tbytes of…

---

## [Filebeat 1.2.0. multiline](https://discuss.elastic.co/t/filebeat-1-2-0-multiline/46200)

<div class="topic-metadata">

**Author:** [@remco](https://discuss.elastic.co/u/remco)\
**Replies:** 11\
**Last updated:** [April 5, 2016, 11:46am UTC](https://discuss.elastic.co/t/filebeat-1-2-0-multiline/46200 "2016-04-05T11:46:05Z")

</div>

Hi, I new to the ELK, just learning the basics. Logstash (multiline implemented) =\> elasticsearch =\> kibana. This is working for me. However i want to start using filebeat =\> logstash =\> elastichsearch =\> kibana. No…

---

## [How to take snapshots in cluster](https://discuss.elastic.co/t/how-to-take-snapshots-in-cluster/69315)

<div class="topic-metadata">

**Author:** [@animageofmine](https://discuss.elastic.co/u/animageofmine)\
**Replies:** 13\
**Last updated:** [December 20, 2016, 4:19pm UTC](https://discuss.elastic.co/t/how-to-take-snapshots-in-cluster/69315 "2016-12-20T16:19:51Z")

</div>

Have a simple and a stupid question, since I couldn't find a direct answer (except here) We have a cluster of 8 servers, all dockerized with data volume mounted on the host (/var/lib/elasticsearch) and want to set up s…

---

## [Ubuntu 16.04 - ansible-elasticsearch: stuck at "Wait for elasticsearch to startup"](https://discuss.elastic.co/t/ubuntu-16-04-ansible-elasticsearch-stuck-at-wait-for-elasticsearch-to-startup/83338)

<div class="topic-metadata">

**Author:** [@Dextro](https://discuss.elastic.co/u/Dextro)\
**Replies:** 11\
**Last updated:** [June 13, 2017, 2:54pm UTC](https://discuss.elastic.co/t/ubuntu-16-04-ansible-elasticsearch-stuck-at-wait-for-elasticsearch-to-startup/83338 "2017-06-13T14:54:07Z")

</div>

Ansible is stuck at "Wait for elasticsearch to startup" and just times out. Setup is Ubuntu 16.04.02 Playbook: - name: Install and configure elasticsearch hosts: localhost remote\_user: 'deploy' become: True rol…

---

## [Unable to download kibana dashboard](https://discuss.elastic.co/t/unable-to-download-kibana-dashboard/93381)

<div class="topic-metadata">

**Author:** [@SFace](https://discuss.elastic.co/u/SFace)\
**Replies:** 9\
**Last updated:** [July 24, 2017, 1:11pm UTC](https://discuss.elastic.co/t/unable-to-download-kibana-dashboard/93381 "2017-07-24T13:11:11Z")

</div>

Hi im having issues in setting up winlogbeats, i cant seem to get past the point ( currently following official logstash tutorial) of installing the kibana dash board whenever i run this command: scripts\\import\_das…

---

## [Unable to run Endpoint 8.4 on a Ubuntu 20.04 host hardened with CIS Level 2](https://discuss.elastic.co/t/unable-to-run-endpoint-8-4-on-a-ubuntu-20-04-host-hardened-with-cis-level-2/318559)

<div class="topic-metadata">

**Author:** [@dapster](https://discuss.elastic.co/u/dapster)\
**Replies:** 16\
**Last updated:** [January 9, 2023, 3:57pm UTC](https://discuss.elastic.co/t/unable-to-run-endpoint-8-4-on-a-ubuntu-20-04-host-hardened-with-cis-level-2/318559 "2023-01-09T15:57:38Z")

</div>

Hi, I am encountering difficulties to properly run Endpoint (deployed thanks to Fleet Server) on a Ubuntu 20.04 host (hardened with CIS Level 2 and I suspect the issue to be related to system hardening). When I run ela…

---

## [Query String Query exact word search](https://discuss.elastic.co/t/query-string-query-exact-word-search/211865)

<div class="topic-metadata">

**Author:** [@Kevin\_Juliano](https://discuss.elastic.co/u/Kevin_Juliano)\
**Replies:** 9\
**Last updated:** [December 16, 2019, 4:20am UTC](https://discuss.elastic.co/t/query-string-query-exact-word-search/211865 "2019-12-16T04:20:42Z")

</div>

Hi Guys! I want to return result that only has the exact word searched without appended characters like if I search "toy", it SHOULD NOT return "toys" or "toyed". Right now, when I do some searching, it is returning res…

---

## [Desired Balance Allocator stuck - preventing assignment of new shards](https://discuss.elastic.co/t/desired-balance-allocator-stuck-preventing-assignment-of-new-shards/328633)

<div class="topic-metadata">

**Author:** [@itizir](https://discuss.elastic.co/u/itizir)\
**Replies:** 15\
**Last updated:** [April 6, 2023, 7:17pm UTC](https://discuss.elastic.co/t/desired-balance-allocator-stuck-preventing-assignment-of-new-shards/328633 "2023-04-06T19:17:54Z")

</div>

Hello, On one of our larger stacks, we have recently seen (twice last week) a problem seemingly related to the new 'desired balance allocator'. The documentation seems to imply this is purely a background operation so t…

---

## [Elasticsearch cannot start a service "Mount point not found"](https://discuss.elastic.co/t/elasticsearch-cannot-start-a-service-mount-point-not-found/270449)

<div class="topic-metadata">

**Author:** [@Jakub\_Skapski](https://discuss.elastic.co/u/Jakub_Skapski)\
**Replies:** 16\
**Last updated:** [May 17, 2021, 3:55pm UTC](https://discuss.elastic.co/t/elasticsearch-cannot-start-a-service-mount-point-not-found/270449 "2021-05-17T15:55:36Z")

</div>

Hello, I'm not able to start Elasticsearch on my PC. Same error pops up with docker, or installing it standalone on my Manjaro Linux. \[2021-04-17T16:16:21,296\]\[ERROR\]\[o.e.b.Bootstrap \] \[kuba-ms7b87\] Exceptio…

---

## [About markdown syntax highlighter](https://discuss.elastic.co/t/about-markdown-syntax-highlighter/159628)

<div class="topic-metadata">

**Author:** [@thiago](https://discuss.elastic.co/u/thiago)\
**Replies:** 9\
**Last updated:** [January 3, 2019, 5:37pm UTC](https://discuss.elastic.co/t/about-markdown-syntax-highlighter/159628 "2019-01-03T17:37:02Z")

</div>

Hi @system, If I were to develop another markdown syntax highlighter (such as json, http, etc) would it be a markdown-it plugin such as markdown-it-sub? If not, can you please direct me where I could learn more about w…

---

## [Starting Filebeat with large number of logs](https://discuss.elastic.co/t/starting-filebeat-with-large-number-of-logs/52938)

<div class="topic-metadata">

**Author:** [@avitash](https://discuss.elastic.co/u/avitash)\
**Replies:** 10\
**Last updated:** [June 28, 2016, 10:13am UTC](https://discuss.elastic.co/t/starting-filebeat-with-large-number-of-logs/52938 "2016-06-28T10:13:02Z")

</div>

I am trying to start using Filebeat and I have a huge number of log files. I have tried with option tail\_files to true but "too many files open" error comes. Then I tried setting ignore\_older to 2h and close\_older to 30m…

---

## [Logstash memory leak on RPi](https://discuss.elastic.co/t/logstash-memory-leak-on-rpi/234836)

<div class="topic-metadata">

**Author:** [@Sonkun](https://discuss.elastic.co/u/Sonkun)\
**Replies:** 13\
**Last updated:** [June 3, 2020, 2:04pm UTC](https://discuss.elastic.co/t/logstash-memory-leak-on-rpi/234836 "2020-06-03T14:04:13Z")

</div>

Hi, my Logstash (7.6.2) instance have some memory leak. Xms and Xms are set on 512m, I have 1 very simple pipeline rest-\>simple map-\>elastic - this pipeline is executed few times in hour. Logstash after up starting to …

---

## [Créer des filtres dynamiques pour requête QSL, NEST](https://discuss.elastic.co/t/creer-des-filtres-dynamiques-pour-requete-qsl-nest/122038)

<div class="topic-metadata">

**Author:** [@DiSiZ](https://discuss.elastic.co/u/DiSiZ)\
**Replies:** 13\
**Last updated:** [March 2, 2018, 2:57pm UTC](https://discuss.elastic.co/t/creer-des-filtres-dynamiques-pour-requete-qsl-nest/122038 "2018-03-02T14:57:50Z")

</div>

Salut, Seul le dernier filters.Add() est pris en compte, comment faire en sorte pour que dans ma requête ils soient tous pris en compte ? Voici mon code : Filtre dynamique : var filters = new List\<Func\<QueryContain…

---

## [Filebeat Connection to Elastic Search Error](https://discuss.elastic.co/t/filebeat-connection-to-elastic-search-error/285733)

<div class="topic-metadata">

**Author:** [@siddhesh\_jadhav](https://discuss.elastic.co/u/siddhesh_jadhav)\
**Replies:** 13\
**Last updated:** [October 3, 2021, 5:09pm UTC](https://discuss.elastic.co/t/filebeat-connection-to-elastic-search-error/285733 "2021-10-03T17:09:56Z")

</div>

HI, I tried installing filebeat on win10. used ' .\\filebeat.exe -e test config' the output says Config OK. but while testing output of filebeat using '.\\filebeat.exe -e test output' it dsiplays the following error. ple…

---

## [Elasticsearch index size using different analyzers](https://discuss.elastic.co/t/elasticsearch-index-size-using-different-analyzers/70440)

<div class="topic-metadata">

**Author:** [@ori.rubinfeld](https://discuss.elastic.co/u/ori.rubinfeld)\
**Replies:** 15\
**Last updated:** [January 4, 2017, 10:18am UTC](https://discuss.elastic.co/t/elasticsearch-index-size-using-different-analyzers/70440 "2017-01-04T10:18:48Z")

</div>

Hi, The goal is to reduce an index size. I have several String fields, on which, I am setting an nGram analyzer from 1 character to 45 characters. The overall index size is reached to 65GB. Then, I removed the nGram …

---

## [Syslog message is incomplete](https://discuss.elastic.co/t/syslog-message-is-incomplete/192384)

<div class="topic-metadata">

**Author:** [@mondei1](https://discuss.elastic.co/u/mondei1)\
**Replies:** 10\
**Last updated:** [July 26, 2019, 12:32pm UTC](https://discuss.elastic.co/t/syslog-message-is-incomplete/192384 "2019-07-26T12:32:38Z")

</div>

Hey community, I have to setup a ELK Stack and everything runs perfectly until I had to implement syslogs. My problem here is that the syslog I receive in Logstash differs from the syslog that I receive with rsyslog (lo…

---

## [Java Update Request (Upsert) pipeline not (supported) / working](https://discuss.elastic.co/t/java-update-request-upsert-pipeline-not-supported-working/141634)

<div class="topic-metadata">

**Author:** [@LGans316](https://discuss.elastic.co/u/LGans316)\
**Replies:** 10\
**Last updated:** [July 30, 2018, 4:43pm UTC](https://discuss.elastic.co/t/java-update-request-upsert-pipeline-not-supported-working/141634 "2018-07-30T16:43:50Z")

</div>

ES version: 6.3.1 There is no way to setPipeline on UpdateRequest API. So tried the below and sadly it doesn't work. The existing document is being updated but without the pipeline transformations applied. Please can …

---

## [About creating a metricset issue](https://discuss.elastic.co/t/about-creating-a-metricset-issue/71464)

<div class="topic-metadata">

**Author:** [@Pikachu\_TEX](https://discuss.elastic.co/u/Pikachu_TEX)\
**Replies:** 14\
**Last updated:** [January 19, 2017, 3:28pm UTC](https://discuss.elastic.co/t/about-creating-a-metricset-issue/71464 "2017-01-19T15:28:19Z")

</div>

i refer to metricbeat document Run the following command inside my beat directory: make create-metricset The results are as follows: \[elk@oam2 metricbeat-5.0.1-linux-x86\_64\]$ make create-metricset make: \*\*\* No rul…

---

## [Marvel refusing to load : "Cannot read property 'cluster\_name' of undefined"](https://discuss.elastic.co/t/marvel-refusing-to-load-cannot-read-property-cluster-name-of-undefined/44640)

<div class="topic-metadata">

**Author:** [@Julien\_Lancien](https://discuss.elastic.co/u/Julien_Lancien)\
**Replies:** 9\
**Last updated:** [March 28, 2016, 8:56pm UTC](https://discuss.elastic.co/t/marvel-refusing-to-load-cannot-read-property-cluster-name-of-undefined/44640 "2016-03-28T20:56:07Z")

</div>

Hi there, I just installed Marvel for the first time on a production cluster running Kibana 4.4.2, ES 2.2.1. Followed the installation instructions, but when I try to load Marvel, I get: Marvel: Error 400 Bad Reque…

---

## [DNS lookup failure | Failed to connect to backoff(async(tcp | no such host](https://discuss.elastic.co/t/dns-lookup-failure-failed-to-connect-to-backoff-async-tcp-no-such-host/313111)

<div class="topic-metadata">

**Author:** [@kurdit](https://discuss.elastic.co/u/kurdit)\
**Replies:** 10\
**Last updated:** [August 28, 2022, 10:54pm UTC](https://discuss.elastic.co/t/dns-lookup-failure-failed-to-connect-to-backoff-async-tcp-no-such-host/313111 "2022-08-28T22:54:00Z")

</div>

dear friends, please help: I have several servers with beats, kibana, logstash and elasticsearch (these are not docker(!)). trying to send logs from metricbeat to elasticsearch via logstash. here is my metricbeat.yml con…

---

## [Dissect pattern not found](https://discuss.elastic.co/t/dissect-pattern-not-found/170143)

<div class="topic-metadata">

**Author:** [@OrangeDog](https://discuss.elastic.co/u/OrangeDog)\
**Replies:** 10\
**Last updated:** [February 27, 2019, 11:37am UTC](https://discuss.elastic.co/t/dissect-pattern-not-found/170143 "2019-02-27T11:37:51Z")

</div>

I cannot see why this isn't working (other event fields removed for clarity). Dissector mapping, pattern not found {"field"=\>"message", "pattern"=\>" \[%{level-\>}\] %{}", "event"=\>{"message"=\>" \[WARNING \] Test"}}

---

## [Please Suggest the config file for the XML data to load in logstash](https://discuss.elastic.co/t/please-suggest-the-config-file-for-the-xml-data-to-load-in-logstash/93362)

<div class="topic-metadata">

**Author:** [@abhisek](https://discuss.elastic.co/u/abhisek)\
**Replies:** 10\
**Last updated:** [July 25, 2017, 8:29pm UTC](https://discuss.elastic.co/t/please-suggest-the-config-file-for-the-xml-data-to-load-in-logstash/93362 "2017-07-25T20:29:17Z")

</div>

---

## [Visualize difference in growth between two time series](https://discuss.elastic.co/t/visualize-difference-in-growth-between-two-time-series/272143)

<div class="topic-metadata">

**Author:** [@snicoll](https://discuss.elastic.co/u/snicoll)\
**Replies:** 9\
**Last updated:** [May 7, 2021, 2:57pm UTC](https://discuss.elastic.co/t/visualize-difference-in-growth-between-two-time-series/272143 "2021-05-07T14:57:24Z")

</div>

Hello, I have an index where each document in the index provides the number of open items and the number of closed items. I'd like to build a visualization that shows if the team is catching up closing issues or, if at …

---

## [No results found for View transaction in Discover](https://discuss.elastic.co/t/no-results-found-for-view-transaction-in-discover/148740)

<div class="topic-metadata">

**Author:** [@rcoundon](https://discuss.elastic.co/u/rcoundon)\
**Replies:** 16\
**Last updated:** [September 19, 2018, 8:58am UTC](https://discuss.elastic.co/t/no-results-found-for-view-transaction-in-discover/148740 "2018-09-19T08:58:03Z")

</div>

If I load a transaction in APM and then select to View Transaction in Discover, no results are returned. The IDs are copied over to the search bar successfully: processor.event:transaction AND transaction.id:b2355f9f-f…

---

## [How Can I use Kibana to see indices in another ES Cluster?](https://discuss.elastic.co/t/how-can-i-use-kibana-to-see-indices-in-another-es-cluster/62306)

<div class="topic-metadata">

**Author:** [@Allie\_Yang](https://discuss.elastic.co/u/Allie_Yang)\
**Replies:** 9\
**Last updated:** [October 5, 2016, 10:55pm UTC](https://discuss.elastic.co/t/how-can-i-use-kibana-to-see-indices-in-another-es-cluster/62306 "2016-10-05T22:55:25Z")

</div>

I am trying to see data from a totally different ES Cluster set up by others. How Could see them in Kibana? Shall I change the elasticsearch.url in the kibana.yml file and fill it with the new Cluster's server address?…

---

## [Unable to send json to elastic](https://discuss.elastic.co/t/unable-to-send-json-to-elastic/227639)

<div class="topic-metadata">

**Author:** [@Magnuss](https://discuss.elastic.co/u/Magnuss)\
**Replies:** 15\
**Last updated:** [April 13, 2020, 7:25pm UTC](https://discuss.elastic.co/t/unable-to-send-json-to-elastic/227639 "2020-04-13T19:25:45Z")

</div>

Hi, I have some issues sending a json file to elastic. Logstash can connect to elastic and also in the logging are no errors. I may think it has to do with the json file or maybe the format.(or do i need to use the filt…

---

## [Logstash stopped working after upgrade 6.2.4 --\> 6.4.0](https://discuss.elastic.co/t/logstash-stopped-working-after-upgrade-6-2-4-6-4-0/146626)

<div class="topic-metadata">

**Author:** [@RonGros](https://discuss.elastic.co/u/RonGros)\
**Replies:** 15\
**Last updated:** [October 22, 2018, 2:58pm UTC](https://discuss.elastic.co/t/logstash-stopped-working-after-upgrade-6-2-4-6-4-0/146626 "2018-10-22T14:58:40Z")

</div>

Hi, Yesterday I tried migrating logstash from 6.2.4 to 6.4 because I've been waiting for the "Read" mode for ages!! then I found that logstash did nothing after I started it - the sincedb is being updated when logstash…

---

## [Vega, How to draw 2 Threshold/Limit lines](https://discuss.elastic.co/t/vega-how-to-draw-2-threshold-limit-lines/240337)

<div class="topic-metadata">

**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\
**Replies:** 12\
**Last updated:** [July 14, 2020, 3:10pm UTC](https://discuss.elastic.co/t/vega-how-to-draw-2-threshold-limit-lines/240337 "2020-07-14T15:10:41Z")

</div>

Hi, I currently have this vega visualiation (example): { "$schema": "https://vega.github.io/schema/vega/v4.3.json", "description": "A basic line chart example.", "padding": 5, data: \[ { name:"table" ur…

---

## [Verify working logstash installation](https://discuss.elastic.co/t/verify-working-logstash-installation/135737)

<div class="topic-metadata">

**Author:** [@heskez](https://discuss.elastic.co/u/heskez)\
**Replies:** 9\
**Last updated:** [June 13, 2018, 3:34pm UTC](https://discuss.elastic.co/t/verify-working-logstash-installation/135737 "2018-06-13T15:34:33Z")

</div>

Hi there, I ran a logstash instance from April and it was working. For some reason now it has stopped. Restarting all ELK services doesn't solve the problem. Is there a way to troubleshoot this? What are the steps? To ma…

---

## [Can't create esuser in shield](https://discuss.elastic.co/t/cant-create-esuser-in-shield/42132)

<div class="topic-metadata">

**Author:** [@chenbe2204](https://discuss.elastic.co/u/chenbe2204)\
**Replies:** 10\
**Last updated:** [February 21, 2016, 8:45am UTC](https://discuss.elastic.co/t/cant-create-esuser-in-shield/42132 "2016-02-21T08:45:28Z")

</div>

Hi , I'm trying to create after installing shield , the error I receive: Error: Could not find or load main class org.elasticsearch.shield.authc.esusers.tool.ESUsersTool My Elasticsearch is 1.7 , Kibana 4.0.2 , Shield…

---

## [Discrepancy in logstash timestamp output and kibana](https://discuss.elastic.co/t/discrepancy-in-logstash-timestamp-output-and-kibana/76677)

<div class="topic-metadata">

**Author:** [@abd.wsu](https://discuss.elastic.co/u/abd.wsu)\
**Replies:** 11\
**Last updated:** [February 27, 2017, 11:15pm UTC](https://discuss.elastic.co/t/discrepancy-in-logstash-timestamp-output-and-kibana/76677 "2017-02-27T23:15:40Z")

</div>

Hello, I have a csv with line like following "Broker Name","Flow Name","Record Start Date","Record Start Time","Record GMT Start Timestamp","Record End Date","Record End Time","Record GMT End Timestamp","Average CPU …

---

## [Where is defined new\_user\_tips?](https://discuss.elastic.co/t/where-is-defined-new-user-tips/54508)

<div class="topic-metadata">

**Author:** [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Replies:** 10\
**Last updated:** [August 11, 2016, 4:30pm UTC](https://discuss.elastic.co/t/where-is-defined-new-user-tips/54508 "2016-08-11T16:30:26Z")

</div>

Hey I'd like to change the text coming from field new\_user\_tips which is used when a new user joins discuss.elastic.co. Change proposal BTW so @warkolm can also comment, enhance... If you have any trouble, please tel…

---

## [Combined grok pattern for customized logs](https://discuss.elastic.co/t/combined-grok-pattern-for-customized-logs/338535)

<div class="topic-metadata">

**Author:** [@shailendra1](https://discuss.elastic.co/u/shailendra1)\
**Replies:** 20\
**Last updated:** [August 8, 2023, 3:09am UTC](https://discuss.elastic.co/t/combined-grok-pattern-for-customized-logs/338535 "2023-08-08T03:09:23Z")

</div>

i am looking some help and guidenace for parsing the customized logs in one file. i have httpd access logs which have two format and i need to prepare the logstash config/filtering the data. so i tried two different pat…

---

## [Queue.drain: true not working for logstash as K8s setup](https://discuss.elastic.co/t/queue-drain-true-not-working-for-logstash-as-k8s-setup/329236)

<div class="topic-metadata">

**Author:** [@Karthik\_N](https://discuss.elastic.co/u/Karthik_N)\
**Replies:** 18\
**Last updated:** [May 9, 2023, 12:21pm UTC](https://discuss.elastic.co/t/queue-drain-true-not-working-for-logstash-as-k8s-setup/329236 "2023-05-09T12:21:47Z")

</div>

Hi Team, We have issues in draining the logstash queue, this config is queue.drain: true not working. Our Current logstash setup in K8s and persistence queue setup in EBS volume, after killing our one of the logstash po…

---

## [Fscrawler pipeline feature](https://discuss.elastic.co/t/fscrawler-pipeline-feature/136041)

<div class="topic-metadata">

**Author:** [@pa26992](https://discuss.elastic.co/u/pa26992)\
**Replies:** 10\
**Last updated:** [June 28, 2018, 6:02am UTC](https://discuss.elastic.co/t/fscrawler-pipeline-feature/136041 "2018-06-28T06:02:17Z")

</div>

Hey I am unable to use the fscrawler pipeline feature. I wanted to use it to replace '\_' in path.real to '/'. I am using 6.X kibana and elasticsearch and 2.4 fscrawler. Config is as follows. { "name" : "test1…

---

## [About how to embed kibana](https://discuss.elastic.co/t/about-how-to-embed-kibana/32248)

<div class="topic-metadata">

**Author:** [@Kruthika](https://discuss.elastic.co/u/Kruthika)\
**Replies:** 9\
**Last updated:** [December 11, 2015, 5:52am UTC](https://discuss.elastic.co/t/about-how-to-embed-kibana/32248 "2015-12-11T05:52:15Z")

</div>

How can we embed kibana dashboard into HTML ?

[Previous page](https://discuss.elastic.co/top.md?page=118&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=120&per_page=50&period=all)
