# Top **URL:** https://discuss.elastic.co/top.md?page=1225&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1226 --- ## [Dissect and kv filter](https://discuss.elastic.co/t/dissect-and-kv-filter/165250)
**Author:** [@Necus](https://discuss.elastic.co/u/Necus)\ **Replies:** 6\ **Last updated:** [January 28, 2019, 8:19pm UTC](https://discuss.elastic.co/t/dissect-and-kv-filter/165250 "2019-01-28T20:19:35Z")
Hi, I'm using dissect filter to quickly parse data. Then i would like to use kv to divide one of the newly created field into many values. new field: field1=value1,field2=value2,field3=\[abc, abc2, abc3\],field4=value4 … --- ## [Dynamic path indexing](https://discuss.elastic.co/t/dynamic-path-indexing/24203)
**Author:** [@german23](https://discuss.elastic.co/u/german23)\ **Replies:** 6\ **Last updated:** [June 25, 2015, 9:50am UTC](https://discuss.elastic.co/t/dynamic-path-indexing/24203 "2015-06-25T09:50:55Z")
hi guys, in windows event logs there are quite often paths like C:\\Program Files (x86)\\java\\java\\jre1.8\_45\\bin\\java.exe I wonder if it is possible to index every part of the path in separate fields like: path1:C: pa… --- ## [Possible bug with query\_string, no source stored, German umlaut and wildcard](https://discuss.elastic.co/t/possible-bug-with-query-string-no-source-stored-german-umlaut-and-wildcard/11525)
**Author:** [@Wolf\_3](https://discuss.elastic.co/u/Wolf_3)\ **Replies:** 6\ **Last updated:** [April 10, 2013, 10:17am UTC](https://discuss.elastic.co/t/possible-bug-with-query-string-no-source-stored-german-umlaut-and-wildcard/11525 "2013-04-10T10:17:51Z")
Before creating a new issue report I wanted to ask here if someone can please confirm the following situation. Searching for something with a German umlaut e.g. "Körbe" and using the "\*" wildcard results in zero h… --- ## [Elasticsearch in Docker : WARN "this node is locked into cluster UUID" on container restart](https://discuss.elastic.co/t/elasticsearch-in-docker-warn-this-node-is-locked-into-cluster-uuid-on-container-restart/333105)
**Author:** [@Bruno44](https://discuss.elastic.co/u/Bruno44)\ **Replies:** 3\ **Last updated:** [May 11, 2023, 1:41pm UTC](https://discuss.elastic.co/t/elasticsearch-in-docker-warn-this-node-is-locked-into-cluster-uuid-on-container-restart/333105 "2023-05-11T13:41:05Z")
Hello, I use Elasticsearch 8.7.1 in an official Docker container. I export the data (/usr/share/elasticsearch/data/) to the host to keep indexing data. If I delete the container (for update for example), when I recrea… --- ## [Filebeat: Incorrect HTTP method after upgrade to 7.13](https://discuss.elastic.co/t/filebeat-incorrect-http-method-after-upgrade-to-7-13/277964)
**Author:** [@PascalTurbo](https://discuss.elastic.co/u/PascalTurbo)\ **Replies:** 3\ **Last updated:** [July 9, 2021, 11:52am UTC](https://discuss.elastic.co/t/filebeat-incorrect-http-method-after-upgrade-to-7-13/277964 "2021-07-09T11:52:07Z")
Hi There, I'm using filebeat on a windows server with iis module enabled. After upgrading from 7.10 to 7.13 it starts writing this error. I don't understand why, because the documentation lists PUT method and I don't th… --- ## [Webhook watcher action to elastic no\_http\_response\_exception](https://discuss.elastic.co/t/webhook-watcher-action-to-elastic-no-http-response-exception/186240)
**Author:** [@nitzan.karni](https://discuss.elastic.co/u/nitzan.karni)\ **Replies:** 3\ **Last updated:** [June 18, 2019, 12:45pm UTC](https://discuss.elastic.co/t/webhook-watcher-action-to-elastic-no-http-response-exception/186240 "2019-06-18T12:45:49Z")
Keep on getting no\_http\_response\_exception on my watcher's webhook action. ctx.payload.body is the body of an update by query request. I create it in the transform section. the watcher: { . . . "actions": { "update\_… --- ## [Unable to establish connection to master when upgrading to 6.7.0](https://discuss.elastic.co/t/unable-to-establish-connection-to-master-when-upgrading-to-6-7-0/174839)
**Author:** [@iremmats](https://discuss.elastic.co/u/iremmats)\ **Replies:** 3\ **Last updated:** [April 2, 2019, 8:51am UTC](https://discuss.elastic.co/t/unable-to-establish-connection-to-master-when-upgrading-to-6-7-0/174839 "2019-04-02T08:51:09Z")
Background: We had a 7 node cluster running 6.4.2 which we want to upgrade to 6.7.0. Connecting new nodes to this cluster with version 6.7.0 did not work. Connecting nodes of version 6.5.4 and 6.6.2 worked fine. We went … --- ## [Use script fields to filter data](https://discuss.elastic.co/t/use-script-fields-to-filter-data/125771)
**Author:** [@TomTom](https://discuss.elastic.co/u/TomTom)\ **Replies:** 8\ **Last updated:** [April 2, 2018, 12:30pm UTC](https://discuss.elastic.co/t/use-script-fields-to-filter-data/125771 "2018-04-02T12:30:34Z")
Is possible use a script\_fields to filter/find data? Example: { "script\_fields": { "my\_custom\_field": { "script": { "inline": "int x; x = 0; x = ((doc\['deadline'\].empty)&&(doc\['s… --- ## [Elasticsearch 5.4.0 fails to cluster on ec2 and cloud.aws.region deprecation WARN](https://discuss.elastic.co/t/elasticsearch-5-4-0-fails-to-cluster-on-ec2-and-cloud-aws-region-deprecation-warn/84725)
**Author:** [@jecnua](https://discuss.elastic.co/u/jecnua)\ **Replies:** 3\ **Last updated:** [May 5, 2017, 2:09pm UTC](https://discuss.elastic.co/t/elasticsearch-5-4-0-fails-to-cluster-on-ec2-and-cloud-aws-region-deprecation-warn/84725 "2017-05-05T14:09:31Z")
Environment: - es 5.4.0 on docker - aws ec2 cluster == Hi all, I am trying to deploy a new cluser of es 5.4.0 on aws. I am using the same tf code and a similar docker image (I needed to change some minor details du… --- ## [Collect Network Device Data - Req Keep Raw and Feed Into Elastic](https://discuss.elastic.co/t/collect-network-device-data-req-keep-raw-and-feed-into-elastic/48990)
**Author:** [@tarheeljeff](https://discuss.elastic.co/u/tarheeljeff)\ **Replies:** 3\ **Last updated:** [May 3, 2016, 9:55pm UTC](https://discuss.elastic.co/t/collect-network-device-data-req-keep-raw-and-feed-into-elastic/48990 "2016-05-03T21:55:25Z")
I have ELK running on a single server at this point in time. I also have rsyslog server running on this same host. We have many network devices (Cisco Switches Routers/ASA's/etc.) in our environment. My requirement … --- ## [Redis-elasticsearch - Is this recommended? Not sure if it is working](https://discuss.elastic.co/t/redis-elasticsearch-is-this-recommended-not-sure-if-it-is-working/39575)
**Author:** [@skynardo](https://discuss.elastic.co/u/skynardo)\ **Replies:** 3\ **Last updated:** [January 19, 2016, 8:15pm UTC](https://discuss.elastic.co/t/redis-elasticsearch-is-this-recommended-not-sure-if-it-is-working/39575 "2016-01-19T20:15:05Z")
Very new to ELK and trying to set up the infrastructure to centrally log our in house application logs. What I am trying to set up looks something like this: Client Server … --- ## [Fail to Flush](https://discuss.elastic.co/t/fail-to-flush/23776)
**Author:** [@bdunbar](https://discuss.elastic.co/u/bdunbar)\ **Replies:** 3\ **Last updated:** [June 17, 2015, 4:32pm UTC](https://discuss.elastic.co/t/fail-to-flush/23776 "2015-06-17T16:32:24Z")
I'm getting 'failed to flush' error. I'm confused and not quite certain what I'm doing wrong. What can I look at in ES to tell me where I"m going astray? CentOs 6 ES 6.1 I have a plugin called Elastic HQ installed,… --- ## [Shield Authorization Exception: Percolation and Indexed shapes](https://discuss.elastic.co/t/shield-authorization-exception-percolation-and-indexed-shapes/43928)
**Author:** [@nic](https://discuss.elastic.co/u/nic)\ **Replies:** 1\ **Last updated:** [March 11, 2016, 1:33pm UTC](https://discuss.elastic.co/t/shield-authorization-exception-percolation-and-indexed-shapes/43928 "2016-03-11T13:33:46Z")
We're having an issue with persisting percolate documents with Shield enabled. The issue stems from referencing indexed shapes which are documents from another index. A similar issue was reported a while ago, http://el… --- ## [Create a Automation Between List API and Github Repo](https://discuss.elastic.co/t/create-a-automation-between-list-api-and-github-repo/267434)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 6\ **Last updated:** [March 19, 2021, 4:10am UTC](https://discuss.elastic.co/t/create-a-automation-between-list-api-and-github-repo/267434 "2021-03-19T04:10:29Z")
I want to create a automation using the List API like the image below and a github repo so whenever I update the github repo that it will automatically update the corresponding lists in Elastic. How would I got about t… --- ## [\,](https://discuss.elastic.co/t/openssl-certificates-do-not-conform-to-algorithm-constraints/316180)
**Author:** [@Nikhitha\_Karennagari](https://discuss.elastic.co/u/Nikhitha_Karennagari)\ **Replies:** 4\ **Last updated:** [October 13, 2022, 4:01pm UTC](https://discuss.elastic.co/t/openssl-certificates-do-not-conform-to-algorithm-constraints/316180 "2022-10-13T16:01:04Z")
Getting the below error when trying to connect to remote syslog server using ssl-tcp protocol. SSL Error {:exception=\>#\, :backtrace=\>\['org/jr… --- ## [kafka.consumer.bytes.consumed.total=NaN causes Error sending data to APM server: Server returned HTTP response code: 400](https://discuss.elastic.co/t/kafka-consumer-bytes-consumed-total-nan-causes-error-sending-data-to-apm-server-server-returned-http-response-code-400/257544)
**Author:** [@antonro](https://discuss.elastic.co/u/antonro)\ **Replies:** 4\ **Last updated:** [December 7, 2020, 7:27pm UTC](https://discuss.elastic.co/t/kafka-consumer-bytes-consumed-total-nan-causes-error-sending-data-to-apm-server-server-returned-http-response-code-400/257544 "2020-12-07T19:27:23Z")
Hi, We started using Java APM agent and observe following errors in log files of our Java services with enabled agent. I see that some metrics are reported with NaN value which causes error with "expected number, but go… --- ## [CrowdStrike Module unable to convert value \[\]: value is not a valid IP address](https://discuss.elastic.co/t/crowdstrike-module-unable-to-convert-value-value-is-not-a-valid-ip-address/239187)
**Author:** [@James\_Cribbs](https://discuss.elastic.co/u/James_Cribbs)\ **Replies:** 4\ **Last updated:** [July 17, 2020, 7:48pm UTC](https://discuss.elastic.co/t/crowdstrike-module-unable-to-convert-value-value-is-not-a-valid-ip-address/239187 "2020-07-17T19:48:46Z")
The CrowdStrike Filebeat (version 7.8) module appears to have two issues. Null / non-existent values in event.UserIP field causing parse errors during ingest. Parsing of UTCTimestamp to crowdstrike.event.UTCTimestamp (… --- ## [Dropping events in Auditbeat](https://discuss.elastic.co/t/dropping-events-in-auditbeat/224483)
**Author:** [@AaronWF](https://discuss.elastic.co/u/AaronWF)\ **Replies:** 4\ **Last updated:** [March 26, 2020, 6:17pm UTC](https://discuss.elastic.co/t/dropping-events-in-auditbeat/224483 "2020-03-26T18:17:16Z")
I have Auditbeat shipping system processes directly to elastic cloud, I would like to drop the noisiest events such as Google Chrome + Renderer and 'System/Library/Frameworks' and their child processes. I have added thi… --- ## [\[KIBANA\] Afficher le contenu du champs "message" dans une visualisation](https://discuss.elastic.co/t/kibana-afficher-le-contenu-du-champs-message-dans-une-visualisation/188032)
**Author:** [@Benjamin\_Carriou](https://discuss.elastic.co/u/Benjamin_Carriou)\ **Replies:** 4\ **Last updated:** [June 28, 2019, 12:01pm UTC](https://discuss.elastic.co/t/kibana-afficher-le-contenu-du-champs-message-dans-une-visualisation/188032 "2019-06-28T12:01:16Z")
Bonjour J'aimerai affiché le champs "message" dans une visualisation KIBANA mais quand je cherche ce champs, il ne s'affiche pas: Je le vois bien dans Discover: Une idée ? Merci --- ## [Logstash - json filter removes backslash](https://discuss.elastic.co/t/logstash-json-filter-removes-backslash/164285)
**Author:** [@Francisca\_Lima](https://discuss.elastic.co/u/Francisca_Lima)\ **Replies:** 4\ **Last updated:** [January 16, 2019, 2:08pm UTC](https://discuss.elastic.co/t/logstash-json-filter-removes-backslash/164285 "2019-01-16T14:08:57Z")
Hello, When I am doing a json filter in my logstash file, in fields where I have two backlashes ("\\") one of them is removed. Why this is happening? Besides replacing \\ to \\, what can I do? Thank you. --- ## [IF condition with XML filter](https://discuss.elastic.co/t/if-condition-with-xml-filter/106877)
**Author:** [@rm1890](https://discuss.elastic.co/u/rm1890)\ **Replies:** 4\ **Last updated:** [November 8, 2017, 2:55pm UTC](https://discuss.elastic.co/t/if-condition-with-xml-filter/106877 "2017-11-08T14:55:15Z")
hi all, I'm trying to apply an XML filter based on the value of one of the fields. So, the config for that part looks like this: filter{ if \[my\_field\] == "x.zhh"{ xml{ … --- ## [Перемешиваются события между воркерами?](https://discuss.elastic.co/t/topic/104609)
**Author:** [@11116](https://discuss.elastic.co/u/11116)\ **Replies:** 4\ **Last updated:** [October 24, 2017, 11:26am UTC](https://discuss.elastic.co/t/topic/104609 "2017-10-24T11:26:10Z")
Здравствуйте! Заметил такую странную вещь. Логи ко мне прилетают, увы, в куче не очень совместимых форматов, например 1 вариант: param1|param2|field3:param3|field4:param4 2 вариант: param1|param2|4.3|param4|field5:pa… --- ## [Ingest Node Index According to Timestamp](https://discuss.elastic.co/t/ingest-node-index-according-to-timestamp/67438)
**Author:** [@wenyao](https://discuss.elastic.co/u/wenyao)\ **Replies:** 4\ **Last updated:** [November 29, 2016, 10:31am UTC](https://discuss.elastic.co/t/ingest-node-index-according-to-timestamp/67438 "2016-11-29T10:31:27Z")
I just upgraded to version 5. Currently i am using Filebeat to send loglines into logstash which ill in turn filter the data and pass the document into elasticsearch. Now, I am hoping to use the elasticsearch ingest node… --- ## [Snowplow mini: Elastic search & kibana](https://discuss.elastic.co/t/snowplow-mini-elastic-search-kibana/47471)
**Author:** [@Jeetu\_Choudhary](https://discuss.elastic.co/u/Jeetu_Choudhary)\ **Replies:** 4\ **Last updated:** [April 18, 2016, 9:21am UTC](https://discuss.elastic.co/t/snowplow-mini-elastic-search-kibana/47471 "2016-04-18T09:21:50Z")
I am working with snowplow mini. I have stored my tracked events in elastic search. my first question is: Do i have to install it explicitly or can work with snowplow mini's version How to analysis events in elastic sear… --- ## [About embedded ElasticSearch](https://discuss.elastic.co/t/about-embedded-elasticsearch/24828)
**Author:** [@11123](https://discuss.elastic.co/u/11123)\ **Replies:** 4\ **Last updated:** [July 3, 2015, 12:21am UTC](https://discuss.elastic.co/t/about-embedded-elasticsearch/24828 "2015-07-03T00:21:57Z")
Hello everyone, Is it possible for me to embed ElasticSearch and use Kibana at the same time? --- ## [How to get aggregations with buckets of zero count only for the filter provided](https://discuss.elastic.co/t/how-to-get-aggregations-with-buckets-of-zero-count-only-for-the-filter-provided/238861)
**Author:** [@kiranvpawar](https://discuss.elastic.co/u/kiranvpawar)\ **Replies:** 0\ **Last updated:** [June 26, 2020, 12:57pm UTC](https://discuss.elastic.co/t/how-to-get-aggregations-with-buckets-of-zero-count-only-for-the-filter-provided/238861 "2020-06-26T12:57:59Z")
Elastic search aggregation using min\_doc\_count=0 returns all the buckets which are not related to query results or hits or provided filter within the query. It is correct based on documentation provided by Elastic Search… --- ## [Kibana의 Discover 탭에서, \_source.date 필드를 기준으로 정렬해서 \_source를 보여줄 수 있나요?](https://discuss.elastic.co/t/kibana-discover-source-date-source/165155)
**Author:** [@teemoGod](https://discuss.elastic.co/u/teemoGod)\ **Replies:** 1\ **Last updated:** [January 23, 2019, 11:07am UTC](https://discuss.elastic.co/t/kibana-discover-source-date-source/165155 "2019-01-23T11:07:58Z")
안녕하세요. Kibana 6.4.1을 이용해서 모니터링을 구축하고 있는데요. Visualize쪽에서 Vega를 사용하는건 어떻게 해결을 하고 있는 편인데 (아직 지원이 안되는 기능도 좀 있네요) 의외로 Discover에서 이슈가 생겼습니다. 원하는 것은 Discover 탭에서 특정 인덱스에 대해 모든 documents를 \_source.date 필드 값 기준으로 내림차순 정렬하는 것으로… --- ## [Comment parser les logs de HaProxy](https://discuss.elastic.co/t/comment-parser-les-logs-de-haproxy/159318)
**Author:** [@Momo](https://discuss.elastic.co/u/Momo)\ **Replies:** 7\ **Last updated:** [December 4, 2018, 4:38pm UTC](https://discuss.elastic.co/t/comment-parser-les-logs-de-haproxy/159318 "2018-12-04T16:38:08Z")
Bonjour, Je débute sur la stack elastic et j'aimerai parser des logs de HaProxy. exemple : Dec 4 09:09:51 f6047fe55160 local0.info haproxy\[1\]: 10.255.0.2:11323 \[04/Dec/2018:09:09:51.199\] http http.actuators.css-1/htt… --- ## [Error regarding log4j: well worn topic](https://discuss.elastic.co/t/error-regarding-log4j-well-worn-topic/87943)
**Author:** [@reswob](https://discuss.elastic.co/u/reswob)\ **Replies:** 1\ **Last updated:** [June 14, 2017, 9:31pm UTC](https://discuss.elastic.co/t/error-regarding-log4j-well-worn-topic/87943 "2017-06-14T21:31:33Z")
I'm brand new to Logstash, I'm trying to get an Filebeats - LogStash - Elasticsearch pipeline set up using the online documentation. But I'm running into a problem where I get the following error: \[root@elastic-01 logs… --- ## [Script score expressions in Elasticsearch 1.4](https://discuss.elastic.co/t/script-score-expressions-in-elasticsearch-1-4/27031)
**Author:** [@sam\_growthintel](https://discuss.elastic.co/u/sam_growthintel)\ **Replies:** 1\ **Last updated:** [August 7, 2015, 9:24am UTC](https://discuss.elastic.co/t/script-score-expressions-in-elasticsearch-1-4/27031 "2015-08-07T09:24:47Z")
Hi, We have a query that uses the function\_score query. Each function in the functions array contains a script\_score object where the script value is an integer. e.g. "script\_score": { "script": 0.335 } This w… --- ## [Adding mutliple types to an index](https://discuss.elastic.co/t/adding-mutliple-types-to-an-index/15038)
**Author:** [@jsp](https://discuss.elastic.co/u/jsp)\ **Replies:** 1\ **Last updated:** [December 27, 2013, 11:34pm UTC](https://discuss.elastic.co/t/adding-mutliple-types-to-an-index/15038 "2013-12-27T23:34:33Z")
Hi, I have recently started playing with ES for a site search project. My search query runs against multiple tables across two databases, masterDb & clientDb. So my plan is to create two indexes one for each databas… --- ## [Kibana rules/alerts "If alert matches a query" not working for custom fields](https://discuss.elastic.co/t/kibana-rules-alerts-if-alert-matches-a-query-not-working-for-custom-fields/343580)
**Author:** [@arislawrence](https://discuss.elastic.co/u/arislawrence)\ **Replies:** 0\ **Last updated:** [September 21, 2023, 11:54pm UTC](https://discuss.elastic.co/t/kibana-rules-alerts-if-alert-matches-a-query-not-working-for-custom-fields/343580 "2023-09-21T23:54:25Z")
Elasticsearch, Kibana, Logstash and Beats using version 8.9.1 or 8.10.1 When creating Kibana rules for Log threshold or Metric threshold, the "If alert matches a query" defined is a custom fields, it will not process th… --- ## [I have taken the Logs source of OpenCTI to make threatIntelligence but there is an error when displaying](https://discuss.elastic.co/t/i-have-taken-the-logs-source-of-opencti-to-make-threatintelligence-but-there-is-an-error-when-displaying/333746)
**Author:** [@Hoang\_Vu](https://discuss.elastic.co/u/Hoang_Vu)\ **Replies:** 0\ **Last updated:** [May 18, 2023, 8:55am UTC](https://discuss.elastic.co/t/i-have-taken-the-logs-source-of-opencti-to-make-threatintelligence-but-there-is-an-error-when-displaying/333746 "2023-05-18T08:55:05Z")
Before, I took MISP logs to do threatIntelligence but after I switch to Open CTI the same error shows again --- ## [Embed Kibana Visualizations in HTML Page](https://discuss.elastic.co/t/embed-kibana-visualizations-in-html-page/306040)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 0\ **Last updated:** [May 31, 2022, 1:34pm UTC](https://discuss.elastic.co/t/embed-kibana-visualizations-in-html-page/306040 "2022-05-31T13:34:16Z")
Similarly to this question we want to embed a vizualisation in an external web page. However, the solution given there, "use the iframe src from the dashboard" does not work. The dashboard does not use iframes and when w… --- ## [Script query - iterating through nested docs](https://discuss.elastic.co/t/script-query-iterating-through-nested-docs/268877)
**Author:** [@bruno\_v](https://discuss.elastic.co/u/bruno_v)\ **Replies:** 0\ **Last updated:** [March 31, 2021, 8:20am UTC](https://discuss.elastic.co/t/script-query-iterating-through-nested-docs/268877 "2021-03-31T08:20:14Z")
I have the following nested property in my mapping: "books": { "type": "nested", "properties": { "book\_id": { "type": "keyword" }, "book\_name": { "type": "keyword" } … --- ## [Boost with score from child or parent](https://discuss.elastic.co/t/boost-with-score-from-child-or-parent/52576)
**Author:** [@Ulrik\_Pedersen](https://discuss.elastic.co/u/Ulrik_Pedersen)\ **Replies:** 0\ **Last updated:** [June 13, 2016, 8:36am UTC](https://discuss.elastic.co/t/boost-with-score-from-child-or-parent/52576 "2016-06-13T08:36:05Z")
My mapping is done so every parent have one or more children. The trick is to query the childrens and when a hit is found - do the same query against the parent and then boost the result with the score from the parent. … --- ## [Unable to compile custom beat based on metricbeat](https://discuss.elastic.co/t/unable-to-compile-custom-beat-based-on-metricbeat/123085)
**Author:** [@dcroonen](https://discuss.elastic.co/u/dcroonen)\ **Replies:** 2\ **Last updated:** [March 12, 2018, 9:18am UTC](https://discuss.elastic.co/t/unable-to-compile-custom-beat-based-on-metricbeat/123085 "2018-03-12T09:18:29Z")
Hi all After upgrading the Beat library from 6.0 to 6.2 I'm unable to package my custom Beat based on Metricbeat. The error message is: Step 4/9 : RUN apt-get -o Acquire::Check-Valid-Until=false update && apt-get in… --- ## [If condition not working in Output](https://discuss.elastic.co/t/if-condition-not-working-in-output/106849)
**Author:** [@Telstra\_Aus](https://discuss.elastic.co/u/Telstra_Aus)\ **Replies:** 2\ **Last updated:** [November 10, 2017, 3:02am UTC](https://discuss.elastic.co/t/if-condition-not-working-in-output/106849 "2017-11-10T03:02:08Z")
Hi, Below is my logstash.conf file content and if condition in output and is not working, input { beats { type =\> beats port =\> 5044 host =\> "XX.XX.XX.XX" } } filter { multiline { pattern =\> "^####" negate =\>… --- ## [Migration of LSF to filebeat](https://discuss.elastic.co/t/migration-of-lsf-to-filebeat/46493)
**Author:** [@NiteshBarnwal](https://discuss.elastic.co/u/NiteshBarnwal)\ **Replies:** 2\ **Last updated:** [April 7, 2016, 9:18am UTC](https://discuss.elastic.co/t/migration-of-lsf-to-filebeat/46493 "2016-04-07T09:18:34Z")
I am trying to migrate logstash-forwarder to filebeat. getting certificate error in filebeat though same is being used in logstash-forwarder. I have changed the template and the index is good with %type. logstash version… --- ## [@timestamp not set when parsing nginx logs](https://discuss.elastic.co/t/timestamp-not-set-when-parsing-nginx-logs/35432)
**Author:** [@jon\_black](https://discuss.elastic.co/u/jon_black)\ **Replies:** 2\ **Last updated:** [November 24, 2015, 12:35pm UTC](https://discuss.elastic.co/t/timestamp-not-set-when-parsing-nginx-logs/35432 "2015-11-24T12:35:53Z")
For a long time I assumed @timestamp was being parsed correctly; the time in the kibana Time field matches the @timestamp field, which matched the data being logged; however, logstash crashed over the weekend so I starte… --- ## [Kibana - ES scroll returned fewer total hits than expected!](https://discuss.elastic.co/t/kibana-es-scroll-returned-fewer-total-hits-than-expected/300931)
**Author:** [@hocho](https://discuss.elastic.co/u/hocho)\ **Replies:** 3\ **Last updated:** [March 31, 2022, 2:16pm UTC](https://discuss.elastic.co/t/kibana-es-scroll-returned-fewer-total-hits-than-expected/300931 "2022-03-31T14:16:05Z")
Hello, I have run into an issue where all the events that are displayed in Discover are not exported to the CSV file. When this happens Kibana generates the following log message in kibana.log: ES scroll returned fewe… --- ## [Use Copy-to with different delimiters i.e "," , ";" etc](https://discuss.elastic.co/t/use-copy-to-with-different-delimiters-i-e-etc/233494)
**Author:** [@farhanAamir](https://discuss.elastic.co/u/farhanAamir)\ **Replies:** 3\ **Last updated:** [May 20, 2020, 1:12pm UTC](https://discuss.elastic.co/t/use-copy-to-with-different-delimiters-i-e-etc/233494 "2020-05-20T13:12:18Z")
hi, I am trying to concatenate two fields firstName and last name to build a field as fullName. After some R&D I have found copy-to feature in mapping that can help to copy fields to a certain field. But here I am tryin… --- ## [Logstash error- Received an event that has a different character encoding](https://discuss.elastic.co/t/logstash-error-received-an-event-that-has-a-different-character-encoding/174231)
**Author:** [@sharon92](https://discuss.elastic.co/u/sharon92)\ **Replies:** 0\ **Last updated:** [March 28, 2019, 4:08am UTC](https://discuss.elastic.co/t/logstash-error-received-an-event-that-has-a-different-character-encoding/174231 "2019-03-28T04:08:53Z")
I use logspout v3.2.6 by gliderlab to route docker logs to Logstash 6.6.2. But the characters were scrambled. I tried many codes and charset nothing seems working. Need help. I will share the configurations and logs for… --- ## [Probéme avec logstash](https://discuss.elastic.co/t/probeme-avec-logstash/60919)
**Author:** [@aboumejd\_younes](https://discuss.elastic.co/u/aboumejd_younes)\ **Replies:** 3\ **Last updated:** [September 19, 2016, 6:56pm UTC](https://discuss.elastic.co/t/probeme-avec-logstash/60919 "2016-09-19T18:56:33Z")
je veux consulter des logs avec ELK (ElasticSearch – Logstash – Kibana) j'ai des problème avec logstash j'ai crée un fichier config (logstash.conf) input { file { path =\> 'C:\\Users\\younes\\Desktop\\projet\\… --- ## [Field created as float still shows as string in kibana Settings](https://discuss.elastic.co/t/field-created-as-float-still-shows-as-string-in-kibana-settings/57060)
**Author:** [@zoplex](https://discuss.elastic.co/u/zoplex)\ **Replies:** 3\ **Last updated:** [August 3, 2016, 3:59pm UTC](https://discuss.elastic.co/t/field-created-as-float-still-shows-as-string-in-kibana-settings/57060 "2016-08-03T15:59:28Z")
HI, I am creating field as float type on the fly in logstash: mutate { add\_field =\> { "slowq\_time" =\> {} } convert =\> { "slowq\_time" =\> "float" } } grok { patterns\_dir =\> \["/elk/lo… --- ## [Statsd - send metric only if exists](https://discuss.elastic.co/t/statsd-send-metric-only-if-exists/24072)
**Author:** [@matejzero](https://discuss.elastic.co/u/matejzero)\ **Replies:** 3\ **Last updated:** [July 25, 2015, 12:42am UTC](https://discuss.elastic.co/t/statsd-send-metric-only-if-exists/24072 "2015-07-25T00:42:56Z")
Hello! I'm using logstash to send apache and amavis metrics to statsd. I define all fields that should be sent to statsd but sometimes, some of the fields doesn't exist and I get error on stasd side. Statsd config: … --- ## [Product/price modeling with nested sort problem](https://discuss.elastic.co/t/product-price-modeling-with-nested-sort-problem/11652)
**Author:** [@Nicolas\_Colomer](https://discuss.elastic.co/u/Nicolas_Colomer)\ **Replies:** 3\ **Last updated:** [April 24, 2013, 2:28pm UTC](https://discuss.elastic.co/t/product-price-modeling-with-nested-sort-problem/11652 "2013-04-24T14:28:12Z")
Hi community ! I'm posting here about a data modeling problem we are facing with elasticsearch. Here is the situation: Our business model is relatively simple: we have products that each contains a (potentially… --- ## [Logstash behaivour when elasticsearch fail to index](https://discuss.elastic.co/t/logstash-behaivour-when-elasticsearch-fail-to-index/209904)
**Author:** [@mtudisco](https://discuss.elastic.co/u/mtudisco)\ **Replies:** 5\ **Last updated:** [November 29, 2019, 2:29pm UTC](https://discuss.elastic.co/t/logstash-behaivour-when-elasticsearch-fail-to-index/209904 "2019-11-29T14:29:43Z")
Hi, I'm running a test environment with one node only with elasticsearch and generating indexes with the patern prefix-\[type\]-yyyy.mm.dd. Information is generated in logfiles, that are sent with filebeat to logstash to… --- ## [Loading and indexing dbpedia datasets in ES](https://discuss.elastic.co/t/loading-and-indexing-dbpedia-datasets-in-es/171739)
**Author:** [@Furabio](https://discuss.elastic.co/u/Furabio)\ **Replies:** 5\ **Last updated:** [March 11, 2019, 7:17pm UTC](https://discuss.elastic.co/t/loading-and-indexing-dbpedia-datasets-in-es/171739 "2019-03-11T19:17:12Z")
Hello, I'm new to Elasticsearch and I am trying to load and index dbpedia datasets (RDF triples) into ES. The datasets are available in ttl format from https://wiki.dbpedia.org/downloads-2016-04. My question is how do … --- ## [Getting packetbeat to pull MySQL data](https://discuss.elastic.co/t/getting-packetbeat-to-pull-mysql-data/113650)
**Author:** [@sarman](https://discuss.elastic.co/u/sarman)\ **Replies:** 5\ **Last updated:** [January 4, 2018, 1:19pm UTC](https://discuss.elastic.co/t/getting-packetbeat-to-pull-mysql-data/113650 "2018-01-04T13:19:10Z")
Hi all, and thanks in advance. I am having issues getting packetbeat to pull some MySQL data. I have reviewed several different threads related to this same type of issue, but none have quit been like mine, or have help… [Previous page](https://discuss.elastic.co/top.md?page=1224&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1226&per_page=50&period=all)