# Top

**URL:** https://discuss.elastic.co/top.md?page=1202&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1203

---

## [Two Elasticsearch clusters in sync](https://discuss.elastic.co/t/two-elasticsearch-clusters-in-sync/222521)

<div class="topic-metadata">

**Author:** [@Bharath\_Italapur](https://discuss.elastic.co/u/Bharath_Italapur)\
**Replies:** 2\
**Last updated:** [March 10, 2020, 8:56pm UTC](https://discuss.elastic.co/t/two-elasticsearch-clusters-in-sync/222521 "2020-03-10T20:56:06Z")

</div>

Hi, Thank you in advance. Is there a way to keep two elasticsearch clusters in sync? I have a 5.6 elasticsearch cluster which is getting data inserted through spark and I have another 7.6 elasticsearch cluster that…

---

## [\[kibana\] Multi-levle pie chart issue](https://discuss.elastic.co/t/kibana-multi-levle-pie-chart-issue/194774)

<div class="topic-metadata">

**Author:** [@cheriemilk](https://discuss.elastic.co/u/cheriemilk)\
**Replies:** 2\
**Last updated:** [August 15, 2019, 8:15am UTC](https://discuss.elastic.co/t/kibana-multi-levle-pie-chart-issue/194774 "2019-08-15T08:15:23Z")

</div>

Hi Team, I have below set of data in elk. Inside the data, the values under ktf4 column describe the elements end user selected for Profile\_Criteria only on UI page. indent preformatted text by 4 spaces \> ktf2,ktf3,…

---

## [Multiple kibana instances](https://discuss.elastic.co/t/multiple-kibana-instances/148332)

<div class="topic-metadata">

**Author:** [@rkparkar](https://discuss.elastic.co/u/rkparkar)\
**Replies:** 2\
**Last updated:** [September 13, 2018, 7:43pm UTC](https://discuss.elastic.co/t/multiple-kibana-instances/148332 "2018-09-13T19:43:45Z")

</div>

Hi, I will be having 4 nodes for ES and 2 for Kibana (version 6.x). kibana will be installed on the same nodes as that of ES (any 2 out of 4). I understand that we cannot provide a list of ES urls in kibana . So, shou…

---

## [Embedding iframes into Kibana](https://discuss.elastic.co/t/embedding-iframes-into-kibana/29338)

<div class="topic-metadata">

**Author:** [@treehouse](https://discuss.elastic.co/u/treehouse)\
**Replies:** 2\
**Last updated:** [January 18, 2017, 6:54am UTC](https://discuss.elastic.co/t/embedding-iframes-into-kibana/29338 "2017-01-18T06:54:20Z")

</div>

I know Kibana 4 has a share link feature that you can use to embed Kibana iframes in other pages. We want to make Kibana the "one stop shop" for dashboarding. So question here is: Given other dashboarding services also …

---

## [Login page in kibana](https://discuss.elastic.co/t/login-page-in-kibana/71655)

<div class="topic-metadata">

**Author:** [@ssasporta](https://discuss.elastic.co/u/ssasporta)\
**Replies:** 2\
**Last updated:** [January 16, 2017, 11:55pm UTC](https://discuss.elastic.co/t/login-page-in-kibana/71655 "2017-01-16T23:55:55Z")

</div>

I am not getting a login page in kibana and I am also not able to see the users via kibana managment. I am automatically direct to : http://10.235.81.127:5601/app/kibana#/management?\_g=() \*It was working before Any…

---

## [Show Tooltip in Piechart](https://discuss.elastic.co/t/show-tooltip-in-piechart/60475)

<div class="topic-metadata">

**Author:** [@Marten](https://discuss.elastic.co/u/Marten)\
**Replies:** 2\
**Last updated:** [September 16, 2016, 6:21am UTC](https://discuss.elastic.co/t/show-tooltip-in-piechart/60475 "2016-09-16T06:21:43Z")

</div>

Hello, I like the new reporting feature but would like to see the numbers, shown in the tooltip in the interactive dashboard, in the visualisations. Without numbers the piecharts f.i. are pretty meaningless. The only …

---

## [Metricbeat is not sending cluster\_stats for elasticsearch module](https://discuss.elastic.co/t/metricbeat-is-not-sending-cluster-stats-for-elasticsearch-module/274378)

<div class="topic-metadata">

**Author:** [@Cousin\_John](https://discuss.elastic.co/u/Cousin_John)\
**Replies:** 0\
**Last updated:** [May 28, 2021, 8:30pm UTC](https://discuss.elastic.co/t/metricbeat-is-not-sending-cluster-stats-for-elasticsearch-module/274378 "2021-05-28T20:30:57Z")

</div>

I am having the same issue as this closed post: I am trying to monitor our Elasticsearch cluster 2.x with metricbeat 7.7.1. Metricbeat is sending over the data for node, node\_stats but for some reason it's not sending …

---

## [Filebeat Azure Activity Logs fail to index when field azure.activitylogs.identity.claims is string instead of json](https://discuss.elastic.co/t/filebeat-azure-activity-logs-fail-to-index-when-field-azure-activitylogs-identity-claims-is-string-instead-of-json/268516)

<div class="topic-metadata">

**Author:** [@tobias.berg](https://discuss.elastic.co/u/tobias.berg)\
**Replies:** 0\
**Last updated:** [March 26, 2021, 4:02pm UTC](https://discuss.elastic.co/t/filebeat-azure-activity-logs-fail-to-index-when-field-azure-activitylogs-identity-claims-is-string-instead-of-json/268516 "2021-03-26T16:02:47Z")

</div>

Hi, We have noticed that sometimes, the Azure Activity logs contains serilaized json instead of pure json in the azure.activitylogs.identity field. Thus, these logs fail to index with a mapping parsing exception. We ha…

---

## [Forcing shard reroute during rolling restart is faster than waiting for recovery](https://discuss.elastic.co/t/forcing-shard-reroute-during-rolling-restart-is-faster-than-waiting-for-recovery/122224)

<div class="topic-metadata">

**Author:** [@Guillaume\_Lederrey](https://discuss.elastic.co/u/Guillaume_Lederrey)\
**Replies:** 0\
**Last updated:** [March 2, 2018, 10:19am UTC](https://discuss.elastic.co/t/forcing-shard-reroute-during-rolling-restart-is-faster-than-waiting-for-recovery/122224 "2018-03-02T10:19:37Z")

</div>

I have been experimenting to optimize the time it takes to restart our 2 elasticsearch clusters of 36 notes each. And I found a somewhat unorthodox way to speed up things. Some context: We are at the moment running elas…

---

## ["analysis-smartcn"+"tag cloud" in Kibana?](https://discuss.elastic.co/t/analysis-smartcn-tag-cloud-in-kibana/85346)

<div class="topic-metadata">

**Author:** [@LmYjQ](https://discuss.elastic.co/u/LmYjQ)\
**Replies:** 0\
**Last updated:** [May 11, 2017, 8:22am UTC](https://discuss.elastic.co/t/analysis-smartcn-tag-cloud-in-kibana/85346 "2017-05-11T08:22:19Z")

</div>

I want to visualize tokenized term instead of full term in Kibana, can I do this? Any feedback is appreciated.

---

## [Logstash plugin and rspec -- internal logging output](https://discuss.elastic.co/t/logstash-plugin-and-rspec-internal-logging-output/42064)

<div class="topic-metadata">

**Author:** [@talvey](https://discuss.elastic.co/u/talvey)\
**Replies:** 0\
**Last updated:** [February 17, 2016, 6:47pm UTC](https://discuss.elastic.co/t/logstash-plugin-and-rspec-internal-logging-output/42064 "2016-02-17T18:47:13Z")

</div>

I'm writing a simple logstash plugin and associated rspec tests. I'd like to be able to see the internal logging of the plugin when I run the tests, but have been unable to enable logging. For instance, the following …

---

## [jakarta.json.stream.JsonParsingException when deserializing data retrieved from Elasticsearch](https://discuss.elastic.co/t/jakarta-json-stream-jsonparsingexception-when-deserializing-data-retrieved-from-elasticsearch/343367)

<div class="topic-metadata">

**Author:** [@Georgi\_Nikolov](https://discuss.elastic.co/u/Georgi_Nikolov)\
**Replies:** 4\
**Last updated:** [September 20, 2023, 11:44am UTC](https://discuss.elastic.co/t/jakarta-json-stream-jsonparsingexception-when-deserializing-data-retrieved-from-elasticsearch/343367 "2023-09-20T11:44:41Z")

</div>

for some time now I have been trying to incorporate the Elastic Java 8.10 client into my code, I have a big ELK stack with a lot of data. I am trying to fetch continuously data from it, but I am encountering some inconsi…

---

## [Logstash file input - output to different indices](https://discuss.elastic.co/t/logstash-file-input-output-to-different-indices/279906)

<div class="topic-metadata">

**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\
**Replies:** 4\
**Last updated:** [July 29, 2021, 4:02pm UTC](https://discuss.elastic.co/t/logstash-file-input-output-to-different-indices/279906 "2021-07-29T16:02:46Z")

</div>

Hello All, I am running ELK 7.6.2 stack. In my current set up, a single file gets ingested in logstash and creates an index successfully as below (only relevant part shown): input { file { path =\> "/opt/gtal/ita…

---

## [Cannot create Data Stream](https://discuss.elastic.co/t/cannot-create-data-stream/256621)

<div class="topic-metadata">

**Author:** [@Angelos](https://discuss.elastic.co/u/Angelos)\
**Replies:** 4\
**Last updated:** [December 4, 2020, 5:25pm UTC](https://discuss.elastic.co/t/cannot-create-data-stream/256621 "2020-12-04T17:25:52Z")

</div>

Hi, I am trying to create Data Streams by issuing: PUT \_data\_stream/test-index-pattern but I have this error: "error" : { "root\_cause" : \[ { "type" : "security\_exception", "reason" : "acti…

---

## [Centralized beats configuration](https://discuss.elastic.co/t/centralized-beats-configuration/158969)

<div class="topic-metadata">

**Author:** [@rpendela](https://discuss.elastic.co/u/rpendela)\
**Replies:** 4\
**Last updated:** [December 15, 2018, 12:04pm UTC](https://discuss.elastic.co/t/centralized-beats-configuration/158969 "2018-12-15T12:04:37Z")

</div>

I am trying to utilize the centralize beats feature but seems it requires to configure plain format of user credentials in filebeat.yml file. #========================= Central Management ===============================…

---

## [MultiSearchRequest{Builder} throws NullPointerException in elasticsearch 1.3.2](https://discuss.elastic.co/t/multisearchrequest-builder-throws-nullpointerexception-in-elasticsearch-1-3-2/21243)

<div class="topic-metadata">

**Author:** [@Veerapuram\_Varadhan](https://discuss.elastic.co/u/Veerapuram_Varadhan)\
**Replies:** 4\
**Last updated:** [December 13, 2016, 5:38pm UTC](https://discuss.elastic.co/t/multisearchrequest-builder-throws-nullpointerexception-in-elasticsearch-1-3-2/21243 "2016-12-13T17:38:49Z")

</div>

Hi, If this is already answered, please point me to the thread. TIA for that. Now, the problem: I am having the following code to test MultiSearchRequest{Buuilder} and it always throws me NullPointerException…

---

## [Fortinet module fails to install](https://discuss.elastic.co/t/fortinet-module-fails-to-install/284777)

<div class="topic-metadata">

**Author:** [@Gorillabiscuit](https://discuss.elastic.co/u/Gorillabiscuit)\
**Replies:** 8\
**Last updated:** [September 29, 2021, 7:22pm UTC](https://discuss.elastic.co/t/fortinet-module-fails-to-install/284777 "2021-09-29T19:22:58Z")

</div>

I inherited an ELK stack and recently upgraded my firewall. We can send syslog to filebeat, which I'm doing, and then filebeat should be sending to ES. When I try and run the filebeat setup -e from the remote server I ge…

---

## [Heartbeat setup failing because of incorrect user](https://discuss.elastic.co/t/heartbeat-setup-failing-because-of-incorrect-user/280870)

<div class="topic-metadata">

**Author:** [@Heroj04](https://discuss.elastic.co/u/Heroj04)\
**Replies:** 3\
**Last updated:** [August 11, 2021, 11:53pm UTC](https://discuss.elastic.co/t/heartbeat-setup-failing-because-of-incorrect-user/280870 "2021-08-11T23:53:58Z")

</div>

I'm trying to setup heartbeat on my new elastic stack server but it is failing because the user doesn't have permission to create indices. It seems to be using the writer user instead of the setup user that has the corr…

---

## [Running ELK Stack - Lab Environment - Ubuntu](https://discuss.elastic.co/t/running-elk-stack-lab-environment-ubuntu/272827)

<div class="topic-metadata">

**Author:** [@momo1104](https://discuss.elastic.co/u/momo1104)\
**Replies:** 8\
**Last updated:** [May 20, 2021, 6:30pm UTC](https://discuss.elastic.co/t/running-elk-stack-lab-environment-ubuntu/272827 "2021-05-20T18:30:00Z")

</div>

a newbie trying to integrate zeek logs and import them to elk stack. Running a lab environment inside Ubuntu 20.04. Elk stack running using Google Cloud Platform Tried to config filebeats, but I might be getting the c…

---

## [Colors in Elastic Detections Alert Emails](https://discuss.elastic.co/t/colors-in-elastic-detections-alert-emails/267155)

<div class="topic-metadata">

**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Replies:** 3\
**Last updated:** [March 16, 2021, 12:05pm UTC](https://discuss.elastic.co/t/colors-in-elastic-detections-alert-emails/267155 "2021-03-16T12:05:59Z")

</div>

Hello, Can we use colors in Elastic Detections Alert Emails? Willem

---

## [Stopping Elastic Endpoint service](https://discuss.elastic.co/t/stopping-elastic-endpoint-service/260027)

<div class="topic-metadata">

**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Replies:** 3\
**Last updated:** [January 6, 2021, 12:19am UTC](https://discuss.elastic.co/t/stopping-elastic-endpoint-service/260027 "2021-01-06T00:19:58Z")

</div>

Hello, While testing with Elastic Endpoint on my home Windows 10, I noticed I can stop the service with no issue at all. Service Name: ElasticEndpoint What would stop a bad actor from stopping the service? if I rememb…

---

## [After add\_field, conversion from string to float unsuccessful](https://discuss.elastic.co/t/after-add-field-conversion-from-string-to-float-unsuccessful/192428)

<div class="topic-metadata">

**Author:** [@rj23495](https://discuss.elastic.co/u/rj23495)\
**Replies:** 8\
**Last updated:** [July 29, 2019, 6:12am UTC](https://discuss.elastic.co/t/after-add-field-conversion-from-string-to-float-unsuccessful/192428 "2019-07-29T06:12:43Z")

</div>

filter { grok { match =\> { "message" =\> "%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day} %{HOUR:hour}:%{MINUTE:min}:%{SECOND:sec} \\\[%{DATA:pool}\\\] %{DATA:metric} %{DATA:metricname} %{DATA:datatype} %{NUMBER:metricvalue:fl…

---

## [Indices.breaker.fielddata.limit](https://discuss.elastic.co/t/indices-breaker-fielddata-limit/189961)

<div class="topic-metadata">

**Author:** [@jeroen1](https://discuss.elastic.co/u/jeroen1)\
**Replies:** 3\
**Last updated:** [July 12, 2019, 12:41pm UTC](https://discuss.elastic.co/t/indices-breaker-fielddata-limit/189961 "2019-07-12T12:41:10Z")

</div>

I am running ES 6 in production and was testing our application in development for use with the latest ES 7. Things break. The issue is related to the default value of indices.breaker.fielddata.limit. In 6, the default i…

---

## [Is there any way to "pull" logs into logstash, rather than "pushing" them from Filebeat?](https://discuss.elastic.co/t/is-there-any-way-to-pull-logs-into-logstash-rather-than-pushing-them-from-filebeat/132371)

<div class="topic-metadata">

**Author:** [@jarnold](https://discuss.elastic.co/u/jarnold)\
**Replies:** 3\
**Last updated:** [June 12, 2018, 9:21am UTC](https://discuss.elastic.co/t/is-there-any-way-to-pull-logs-into-logstash-rather-than-pushing-them-from-filebeat/132371 "2018-06-12T09:21:59Z")

</div>

I've been tasked with implementing an Elastic stack cluster to deal with monitoring for some server logs - Some of the servers we need to monitor are based on an external network. Due to our security policy, I can't mak…

---

## [Dashboard Kibana en lecture seulement](https://discuss.elastic.co/t/dashboard-kibana-en-lecture-seulement/113929)

<div class="topic-metadata">

**Author:** [@mat.bst](https://discuss.elastic.co/u/mat.bst)\
**Replies:** 3\
**Last updated:** [January 3, 2018, 3:18pm UTC](https://discuss.elastic.co/t/dashboard-kibana-en-lecture-seulement/113929 "2018-01-03T15:18:16Z")

</div>

Bonjour tout le monde, J'ai maintenant presque de traiter toutes mes données sur mes différentes index. J'ai plusieurs dashboard, je cherche le moyen de les partager mais en lecture seule uniquement. Comment est-ce po…

---

## [Error while running logstash in linux](https://discuss.elastic.co/t/error-while-running-logstash-in-linux/110265)

<div class="topic-metadata">

**Author:** [@shivam\_bhagat](https://discuss.elastic.co/u/shivam_bhagat)\
**Replies:** 3\
**Last updated:** [December 5, 2017, 9:33am UTC](https://discuss.elastic.co/t/error-while-running-logstash-in-linux/110265 "2017-12-05T09:33:31Z")

</div>

Hi Iam getting following error when i execute following command in linux -sudo bin/logstash -f /etc/logstash/conf.d/dataLoader1.conf Error: NameError: cannot link Java class org.apache.logging.log4j.core.config.Logge…

---

## [Embedded dashboards and visualizations not working](https://discuss.elastic.co/t/embedded-dashboards-and-visualizations-not-working/68080)

<div class="topic-metadata">

**Author:** [@denniswalsh05](https://discuss.elastic.co/u/denniswalsh05)\
**Replies:** 3\
**Last updated:** [December 5, 2016, 7:10pm UTC](https://discuss.elastic.co/t/embedded-dashboards-and-visualizations-not-working/68080 "2016-12-05T19:10:48Z")

</div>

Hi, I'm attempting to embed Kibana visualizations and dashboards in a website I've created, which is currently hosted on Heroku. I've plugged the iframe into an html document on the website. However, when I go to the w…

---

## [Log files are not current](https://discuss.elastic.co/t/log-files-are-not-current/45391)

<div class="topic-metadata">

**Author:** [@rvaedex23](https://discuss.elastic.co/u/rvaedex23)\
**Replies:** 8\
**Last updated:** [March 25, 2016, 1:33pm UTC](https://discuss.elastic.co/t/log-files-are-not-current/45391 "2016-03-25T13:33:08Z")

</div>

I am running the Kibana GUI and the log files are not current: This the output of the first log: March 24th 2016, 15:17:08.747 message:2015-08-13 02:36:24,038 DEBUG \[AptService\] \[org.springframework.scheduling.quartz…

---

## [Location Path of Closed Indices](https://discuss.elastic.co/t/location-path-of-closed-indices/24395)

<div class="topic-metadata">

**Author:** [@tanveer3](https://discuss.elastic.co/u/tanveer3)\
**Replies:** 8\
**Last updated:** [June 26, 2015, 10:51am UTC](https://discuss.elastic.co/t/location-path-of-closed-indices/24395 "2015-06-26T10:51:17Z")

</div>

Hi All Location for Indices is at /var/lib/elasticsearch/elasticsearch/nodes/0/indices/logstash-date My query is, after closing of Indices whats the Path location of Closed Indices. Or how could we find the clos…

---

## [Enabling Native Multi-Factor Authentication in On-Premises versions](https://discuss.elastic.co/t/enabling-native-multi-factor-authentication-in-on-premises-versions/345108)

<div class="topic-metadata">

**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\
**Replies:** 1\
**Last updated:** [October 16, 2023, 1:18pm UTC](https://discuss.elastic.co/t/enabling-native-multi-factor-authentication-in-on-premises-versions/345108 "2023-10-16T13:18:32Z")

</div>

Hello everyone, I'm currently using Elasticsearch in an on-premises environment and I'm exploring options to enhance the security of my cluster. I was wondering if enabling a native multi-factor authentication is possib…

---

## [Allocation temporarily throttled issue](https://discuss.elastic.co/t/allocation-temporarily-throttled-issue/327629)

<div class="topic-metadata">

**Author:** [@nairobi](https://discuss.elastic.co/u/nairobi)\
**Replies:** 1\
**Last updated:** [March 14, 2023, 6:52am UTC](https://discuss.elastic.co/t/allocation-temporarily-throttled-issue/327629 "2023-03-14T06:52:59Z")

</div>

One of my node down accidently, and it joined cluster few minutes later. After that To allocate shard faster, I changed 'cluster.routing.allocation.node\_concurrent\_incoming\_recoveries' 10 to 50 And below issue happene…

---

## [javax.net.ssl.SSLHandshakeException: Received fatal alert: bad\_certificate](https://discuss.elastic.co/t/javax-net-ssl-sslhandshakeexception-received-fatal-alert-bad-certificate/265369)

<div class="topic-metadata">

**Author:** [@d.balaaji](https://discuss.elastic.co/u/d.balaaji)\
**Replies:** 1\
**Last updated:** [February 25, 2021, 7:35am UTC](https://discuss.elastic.co/t/javax-net-ssl-sslhandshakeexception-received-fatal-alert-bad-certificate/265369 "2021-02-25T07:35:02Z")

</div>

Hello All, I configured 4 node Elasticsearch cluster. 1 -M, 2-M/D and 1 - D nodes. I have encrypted TLS using p12 and generated pem to get the organisation signed certificates. Certificate was generated as below. ./ke…

---

## [Where does Deprecated field \[inline\] used, expected \[source\] instead come from?](https://discuss.elastic.co/t/where-does-deprecated-field-inline-used-expected-source-instead-come-from/119104)

<div class="topic-metadata">

**Author:** [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)\
**Replies:** 1\
**Last updated:** [February 9, 2018, 8:46pm UTC](https://discuss.elastic.co/t/where-does-deprecated-field-inline-used-expected-source-instead-come-from/119104 "2018-02-09T20:46:16Z")

</div>

Hi running 6.1.2, I see a bunch of these messages in my coordinator nodes only. I don't see what process is causing this... I have free monitoring enabled, I have some logstash pipelines filebeat -\> kafka -\> logstash -\> …

---

## [{"expected:'\[', actual:'{', at offset:2058"}](https://discuss.elastic.co/t/expected-actual-at-offset-2058/308012)

<div class="topic-metadata">

**Author:** [@Zedson.Sagar](https://discuss.elastic.co/u/Zedson.Sagar)\
**Replies:** 2\
**Last updated:** [June 23, 2022, 3:31pm UTC](https://discuss.elastic.co/t/expected-actual-at-offset-2058/308012 "2022-06-23T15:31:45Z")

</div>

Hi, I'm new to elastic and FSCrawler. I have an index created using FSCrawler. It has only a single document which looks like below - { "content" : """MotorColour - CoatingColor - CSV """, …

---

## [Search by datetime range query](https://discuss.elastic.co/t/search-by-datetime-range-query/282463)

<div class="topic-metadata">

**Author:** [@rehannali](https://discuss.elastic.co/u/rehannali)\
**Replies:** 2\
**Last updated:** [August 25, 2021, 9:51am UTC](https://discuss.elastic.co/t/search-by-datetime-range-query/282463 "2021-08-25T09:51:21Z")

</div>

Hi, I have issue related to search through datetime range query. I tried to search some data which is oldest after a certain period. I read documentation and try to make query and I'm unable to get any of the data. GET …

---

## [Kibana handle multiple authentication methods](https://discuss.elastic.co/t/kibana-handle-multiple-authentication-methods/265202)

<div class="topic-metadata">

**Author:** [@anon42972578](https://discuss.elastic.co/u/anon42972578)\
**Replies:** 2\
**Last updated:** [March 12, 2021, 5:33am UTC](https://discuss.elastic.co/t/kibana-handle-multiple-authentication-methods/265202 "2021-03-12T05:33:54Z")

</div>

Hello, we have some questions about how to handle multiple authentication methods in Kibana. It would be great if we can learn from you and your solutions or your ideas. at the moment we can offer three different authe…

---

## [Merge multiple fields in document into json array](https://discuss.elastic.co/t/merge-multiple-fields-in-document-into-json-array/266036)

<div class="topic-metadata">

**Author:** [@mussa572](https://discuss.elastic.co/u/mussa572)\
**Replies:** 2\
**Last updated:** [March 3, 2021, 5:09pm UTC](https://discuss.elastic.co/t/merge-multiple-fields-in-document-into-json-array/266036 "2021-03-03T17:09:56Z")

</div>

Hi, I have following document Ingesting into Elasticsearch using the logstash \_source": { "server\_name": "abc", "server\_ip": "0.0.0.0", "server\_location: "us" "type" : "…

---

## [APM adding query params causing 400 bad request error during ES query](https://discuss.elastic.co/t/apm-adding-query-params-causing-400-bad-request-error-during-es-query/186749)

<div class="topic-metadata">

**Author:** [@gram](https://discuss.elastic.co/u/gram)\
**Replies:** 2\
**Last updated:** [June 20, 2019, 8:14pm UTC](https://discuss.elastic.co/t/apm-adding-query-params-causing-400-bad-request-error-during-es-query/186749 "2019-06-20T20:14:11Z")

</div>

Elasticsearch version: 7.0.1 APM Agent language and version: Python 4.2.2 Description of the problem including expected versus actual behavior. Please include screenshots (if relevant): I am seeing the follow error mu…

---

## [Unknown setting '"index"' for elasticsearch](https://discuss.elastic.co/t/unknown-setting-index-for-elasticsearch/177497)

<div class="topic-metadata">

**Author:** [@joostdb](https://discuss.elastic.co/u/joostdb)\
**Replies:** 2\
**Last updated:** [April 19, 2019, 9:46am UTC](https://discuss.elastic.co/t/unknown-setting-index-for-elasticsearch/177497 "2019-04-19T09:46:32Z")

</div>

I'm new to the elastic search concept. I followed multiple tutorials to install but I'm getting these errors: Unknown setting '"index"', '"host'" and "'document\_type'" for elasticsearch The output of sudo -Hu root /us…

---

## [Elasticsearch is gone Red after delete index](https://discuss.elastic.co/t/elasticsearch-is-gone-red-after-delete-index/165538)

<div class="topic-metadata">

**Author:** [@merceskoba](https://discuss.elastic.co/u/merceskoba)\
**Replies:** 2\
**Last updated:** [January 24, 2019, 7:54am UTC](https://discuss.elastic.co/t/elasticsearch-is-gone-red-after-delete-index/165538 "2019-01-24T07:54:57Z")

</div>

This ES instance is in staging server but i am still curious to solve this case. So, yesterday i deleted one index. And then, the server is red suddenly. I am using Cerebro for understand it visually …

---

## [AWS elasticsearch service reindexing documents](https://discuss.elastic.co/t/aws-elasticsearch-service-reindexing-documents/122405)

<div class="topic-metadata">

**Author:** [@Sagar\_Tambe](https://discuss.elastic.co/u/Sagar_Tambe)\
**Replies:** 2\
**Last updated:** [March 5, 2018, 7:06am UTC](https://discuss.elastic.co/t/aws-elasticsearch-service-reindexing-documents/122405 "2018-03-05T07:06:11Z")

</div>

I want to transfer data from one index to another on AWS elasticsearch service. I am using following CURL command. Assume I want to transfer data from index1 to index2. However its not copying all records from index1. In…

---

## [Elastic Cloudでのユーザー辞書、シノニムファイルの登録](https://discuss.elastic.co/t/elastic-cloud/106363)

<div class="topic-metadata">

**Author:** [@shshimamo](https://discuss.elastic.co/u/shshimamo)\
**Replies:** 2\
**Last updated:** [November 13, 2017, 7:16am UTC](https://discuss.elastic.co/t/elastic-cloud/106363 "2017-11-13T07:16:45Z")

</div>

現在Elastic Cloud の利用を検討しています。 kuromoji\_tokenizerを使用して全文検索を行いたいと考えているのですが、 Elastic Cloudではどのようにuser\_dictionaryを登録することになりますでしょうか？ （サポートに都度ご依頼する形でしょうか？） またsynonyms\_pathに指定するファイルの登録についてもお伺いしたいです。 こちらを見た感じサポートにご依頼すれば機能が使え…

---

## [(v2.2 watcher ES) Convert complete payload to json to send via webhook](https://discuss.elastic.co/t/v2-2-watcher-es-convert-complete-payload-to-json-to-send-via-webhook/61205)

<div class="topic-metadata">

**Author:** [@Pransh](https://discuss.elastic.co/u/Pransh)\
**Replies:** 2\
**Last updated:** [September 26, 2016, 10:44am UTC](https://discuss.elastic.co/t/v2-2-watcher-es-convert-complete-payload-to-json-to-send-via-webhook/61205 "2016-09-26T10:44:56Z")

</div>

HI @spinscale Please help me with this i am using watcher 2.2 with es 2.2.0 Cannot upgrade, complete setup is in this version I want to send the entire payload in the json format via webhook so that python can reci…

---

## [Kibana is struck at the startup page](https://discuss.elastic.co/t/kibana-is-struck-at-the-startup-page/52598)

<div class="topic-metadata">

**Author:** [@ramkchirra](https://discuss.elastic.co/u/ramkchirra)\
**Replies:** 2\
**Last updated:** [June 14, 2016, 3:53am UTC](https://discuss.elastic.co/t/kibana-is-struck-at-the-startup-page/52598 "2016-06-14T03:53:29Z")

</div>

Hi, When i try to load kibana, it is struck up at the startup page forever as shown below. Please let me know how can i get out of it. Thanks, RK

---

## [Difference between filter\_path and \_source\_include?](https://discuss.elastic.co/t/difference-between-filter-path-and--source-include/31903)

<div class="topic-metadata">

**Author:** [@trycoon](https://discuss.elastic.co/u/trycoon)\
**Replies:** 0\
**Last updated:** [October 9, 2015, 11:20am UTC](https://discuss.elastic.co/t/difference-between-filter-path-and--source-include/31903 "2015-10-09T11:20:32Z")

</div>

Currently I have made two different APIs in my application, one does a Search against Elastic Search and the other one does a Template Search. In the first one I use sourceinclude to let the client specify which field in…

---

## [Explain the kibana dashboard link](https://discuss.elastic.co/t/explain-the-kibana-dashboard-link/86317)

<div class="topic-metadata">

**Author:** [@ELKibana](https://discuss.elastic.co/u/ELKibana)\
**Replies:** 5\
**Last updated:** [May 22, 2017, 3:31pm UTC](https://discuss.elastic.co/t/explain-the-kibana-dashboard-link/86317 "2017-05-22T15:31:43Z")

</div>

I have created a dashboard in kibana. It has a share link that goes llike this https://localhost:5601/txg/app/kibana#/dashboard/934c1210-3bf2-11e7-8d3e-e77474f85c64?\_g=() I am using kibana 6.0 in dev mode. First the t…

---

## [How to add timestamp before each event, timestamp is present at the beginning of the interval](https://discuss.elastic.co/t/how-to-add-timestamp-before-each-event-timestamp-is-present-at-the-beginning-of-the-interval/56761)

<div class="topic-metadata">

**Author:** [@Sri\_ram](https://discuss.elastic.co/u/Sri_ram)\
**Replies:** 5\
**Last updated:** [August 1, 2016, 7:21pm UTC](https://discuss.elastic.co/t/how-to-add-timestamp-before-each-event-timestamp-is-present-at-the-beginning-of-the-interval/56761 "2016-08-01T19:21:14Z")

</div>

Looking to parse vmstat data using Logstash. There will be a timestamp at the beginning of each interval, followed by metrics. Here, i need a timestamp value from vmstat data so that i can use it to overwrite the defaul…

---

## [Error running input: error receiving slowlog data: ERR unknown command \`SLOWLOG\`, with args beginning with: \`GET\`](https://discuss.elastic.co/t/error-running-input-error-receiving-slowlog-data-err-unknown-command-slowlog-with-args-beginning-with-get/246826)

<div class="topic-metadata">

**Author:** [@fzyzcjy](https://discuss.elastic.co/u/fzyzcjy)\
**Replies:** 1\
**Last updated:** [August 28, 2020, 11:52pm UTC](https://discuss.elastic.co/t/error-running-input-error-receiving-slowlog-data-err-unknown-command-slowlog-with-args-beginning-with-get/246826 "2020-08-28T23:52:05Z")

</div>

Hi I am using redis filebeat with the following config. However the error Error running input: error receiving slowlog data: ERR unknown command SLOWLOG, with args beginning with: GET occurs very frequently. Thanks for …

---

## ["exclude\_lines" not working with docker input](https://discuss.elastic.co/t/exclude-lines-not-working-with-docker-input/208211)

<div class="topic-metadata">

**Author:** [@Gimpiron](https://discuss.elastic.co/u/Gimpiron)\
**Replies:** 7\
**Last updated:** [December 8, 2019, 12:59pm UTC](https://discuss.elastic.co/t/exclude-lines-not-working-with-docker-input/208211 "2019-12-08T12:59:36Z")

</div>

Greetings, My Filebeat logs are getting spammed and I find it impossible to exclude certain lines in my log (the reverse proxy ones). EDIT: Im pretty sure that my ignore configurations are not valid, as I tried to test…

---

## [Google sheets to elasticsearch missing data in 'successful' push](https://discuss.elastic.co/t/google-sheets-to-elasticsearch-missing-data-in-successful-push/116749)

<div class="topic-metadata">

**Author:** [@geoff\_yalo](https://discuss.elastic.co/u/geoff_yalo)\
**Replies:** 7\
**Last updated:** [January 26, 2018, 4:33am UTC](https://discuss.elastic.co/t/google-sheets-to-elasticsearch-missing-data-in-successful-push/116749 "2018-01-26T04:33:52Z")

</div>

Hi, I'm using the Google sheets add-on "Spreadsheets to Elasticsearch" to upload a Google sheet to Elasticsearch. I'm able to "successfully" upload the spreadsheet, however, when looking in Elasticsearch the index appea…

[Previous page](https://discuss.elastic.co/top.md?page=1201&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1203&per_page=50&period=all)
