# Top **URL:** https://discuss.elastic.co/top.md?page=1226&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1227 --- ## [Logstash - parse/ filter lines having a specific string](https://discuss.elastic.co/t/logstash-parse-filter-lines-having-a-specific-string/288103)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 4\ **Last updated:** [November 4, 2021, 1:35pm UTC](https://discuss.elastic.co/t/logstash-parse-filter-lines-having-a-specific-string/288103 "2021-11-04T13:35:26Z")
Hi All, We are running ELK 7.6.2 stack in our environment. The log generated by our application throws out messages with different Log Levels. Please see below example: 2021-10-31 19:00:01,062|DEBUG|DispatcherServlet… --- ## [Kibana using docvalue\_fields for no apparent reason](https://discuss.elastic.co/t/kibana-using-docvalue-fields-for-no-apparent-reason/236333)
**Author:** [@Michiel\_Van\_Der\_Lee](https://discuss.elastic.co/u/Michiel_Van_Der_Lee)\ **Replies:** 4\ **Last updated:** [June 9, 2020, 1:12pm UTC](https://discuss.elastic.co/t/kibana-using-docvalue-fields-for-no-apparent-reason/236333 "2020-06-09T13:12:19Z")
I have a simple visualization: Metrics: Count Buckets: Split group: Date Histogram, @timestamp, Weekly Kibana builds the following request: { "aggs": { "2": { "date\_histogram": { "field": "@time… --- ## [System module and Nginx module dashboard](https://discuss.elastic.co/t/system-module-and-nginx-module-dashboard/147561)
**Author:** [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\ **Replies:** 4\ **Last updated:** [September 8, 2018, 3:38am UTC](https://discuss.elastic.co/t/system-module-and-nginx-module-dashboard/147561 "2018-09-08T03:38:07Z")
Hello Team, I have enabled the system module and nginx module for filebeat. I am getting the logs on kibana dashboard from both the modules. But when i am check the filebeat dashboard for nginx and syslog no data is ava… --- ## [Geo-points Bucket Aggregation based on density rather than geohash](https://discuss.elastic.co/t/geo-points-bucket-aggregation-based-on-density-rather-than-geohash/105389)
**Author:** [@MindFork](https://discuss.elastic.co/u/MindFork)\ **Replies:** 4\ **Last updated:** [November 3, 2017, 3:39pm UTC](https://discuss.elastic.co/t/geo-points-bucket-aggregation-based-on-density-rather-than-geohash/105389 "2017-11-03T15:39:46Z")
HI, I've got large set of documents containing coordinates. I want to present them on a map having limited number of pins - so I need certain aggs to do that. I can do this doing geo-hash aggregation, however it doeasn'… --- ## [Missing Converter handling for full class name=org.jruby.ext.date.RubyDateTime](https://discuss.elastic.co/t/missing-converter-handling-for-full-class-name-org-jruby-ext-date-rubydatetime/288757)
**Author:** [@Miria\_Bernardes](https://discuss.elastic.co/u/Miria_Bernardes)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 12:44pm UTC](https://discuss.elastic.co/t/missing-converter-handling-for-full-class-name-org-jruby-ext-date-rubydatetime/288757 "2021-11-09T12:44:22Z")
Hey guys, all right? I need help with an issue I've been experiencing when collecting data using jdbc\_streaming, running conf locally through docker the data collection by logstash is performed successfully, but when ap… --- ## [How to split vertical bar series in canvas?](https://discuss.elastic.co/t/how-to-split-vertical-bar-series-in-canvas/225705)
**Author:** [@Charlot](https://discuss.elastic.co/u/Charlot)\ **Replies:** 1\ **Last updated:** [March 31, 2020, 8:35pm UTC](https://discuss.elastic.co/t/how-to-split-vertical-bar-series-in-canvas/225705 "2020-03-31T20:35:47Z")
hi all: i created grouped bar chart by split serials in visualizate. the output is: so, can i create a similar vertical bar chart in canvas? and the column should be sidebyside on xaxis, not stack on top. thank yo… --- ## [Find Index name associated with ES/data folder](https://discuss.elastic.co/t/find-index-name-associated-with-es-data-folder/146586)
**Author:** [@shine](https://discuss.elastic.co/u/shine)\ **Replies:** 1\ **Last updated:** [August 30, 2018, 1:47pm UTC](https://discuss.elastic.co/t/find-index-name-associated-with-es-data-folder/146586 "2018-08-30T13:47:39Z")
I had to delete all my data from my elasticsearch/data/nodes/\* folder because index "cust\_name\_abc" had a transaction log read error. Which stopped my entire ELK stack. In the future how do I find the matching elasticse… --- ## [Diagnose high CPU usage of beats deployed by Agent](https://discuss.elastic.co/t/diagnose-high-cpu-usage-of-beats-deployed-by-agent/276998)
**Author:** [@netfire](https://discuss.elastic.co/u/netfire)\ **Replies:** 2\ **Last updated:** [June 26, 2021, 2:51am UTC](https://discuss.elastic.co/t/diagnose-high-cpu-usage-of-beats-deployed-by-agent/276998 "2021-06-26T02:51:32Z")
I'm testing fleet and I have noticed that filebeat and metricbeat use quite a few CPU cycles. I'm using the Windows, System and IIS integrations, and on an 8 vcpu VM, filebeat consistently consumes 20%. Metricbeat consum… --- ## [Replicas allocation issue in a hot cold architecture](https://discuss.elastic.co/t/replicas-allocation-issue-in-a-hot-cold-architecture/255953)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 6\ **Last updated:** [November 20, 2020, 2:45pm UTC](https://discuss.elastic.co/t/replicas-allocation-issue-in-a-hot-cold-architecture/255953 "2020-11-20T14:45:29Z")
Hello ! I have the following cluster : node1 with attributes box\_type: hot and zone: zone1 node2 with attributes box\_type: hot and zone: zone1 node3 with attributes box\_type: hot and zone: zone2 node4 with attributes b… --- ## [Get documents matching type 1 and not in type 2](https://discuss.elastic.co/t/get-documents-matching-type-1-and-not-in-type-2/102979)
**Author:** [@jaisharma](https://discuss.elastic.co/u/jaisharma)\ **Replies:** 6\ **Last updated:** [November 7, 2017, 10:39am UTC](https://discuss.elastic.co/t/get-documents-matching-type-1-and-not-in-type-2/102979 "2017-11-07T10:39:36Z")
I've an index structure where types are dates and each type has several documents. I want to get all documents present in type-1 but must be absent in type-2. As an example: Type-1 ---\> id list = \[1,2,3,4,5,6\] Type-2 --… --- ## [Term and Has\_Child Query Optimization](https://discuss.elastic.co/t/term-and-has-child-query-optimization/10913)
**Author:** [@David\_Hagar](https://discuss.elastic.co/u/David_Hagar)\ **Replies:** 6\ **Last updated:** [March 4, 2013, 9:56am UTC](https://discuss.elastic.co/t/term-and-has-child-query-optimization/10913 "2013-03-04T09:56:57Z")
Term and Has\_Child Query Optimization I'm doing large queries ( 20 terms and 20 has\_child queries) and am looking for ways to optimize the response time which is currently at 8 min on 4 million docs. A pure term … --- ## [Elasticsearch integrated with Google Map Clustering Marker (Aggregate Geolocation)](https://discuss.elastic.co/t/elasticsearch-integrated-with-google-map-clustering-marker-aggregate-geolocation/178760)
**Author:** [@LinJIngYun](https://discuss.elastic.co/u/LinJIngYun)\ **Replies:** 0\ **Last updated:** [April 27, 2019, 4:00pm UTC](https://discuss.elastic.co/t/elasticsearch-integrated-with-google-map-clustering-marker-aggregate-geolocation/178760 "2019-04-27T16:00:37Z")
Hello everyone now I use Elasticsearch 7.0, I try to aggregate the data from people this area and show it in elastic search for the example; I can zoom in-out in the Google Map API on my Frontend website and when the mar… --- ## [Kibana https ssl crt not working](https://discuss.elastic.co/t/kibana-https-ssl-crt-not-working/224968)
**Author:** [@katara](https://discuss.elastic.co/u/katara)\ **Replies:** 2\ **Last updated:** [March 25, 2020, 12:56pm UTC](https://discuss.elastic.co/t/kibana-https-ssl-crt-not-working/224968 "2020-03-25T12:56:47Z")
Hi All, i am facing an issue converting my Kibana url to a secured url. Here's what i did: Method 1: created a .csr and .key file in my elastic cluster. provided this .csr and .key file to my certificate team and re… --- ## [Difference between two DATETIMEs in ESSQL in Canvas (No script fields)](https://discuss.elastic.co/t/difference-between-two-datetimes-in-essql-in-canvas-no-script-fields/175471)
**Author:** [@ebalmeida](https://discuss.elastic.co/u/ebalmeida)\ **Replies:** 2\ **Last updated:** [April 5, 2019, 5:39pm UTC](https://discuss.elastic.co/t/difference-between-two-datetimes-in-essql-in-canvas-no-script-fields/175471 "2019-04-05T17:39:11Z")
Hello, I need to calculate the time difference between two DATETIMEs, more specifically, between an timestamp and NOW(), preferably in the essql query, in canvas. I found nothing like the TIMEDIFF() sql function, only da… --- ## [Importing data with cURL error. Newb here](https://discuss.elastic.co/t/importing-data-with-curl-error-newb-here/131381)
**Author:** [@mehdi-gital](https://discuss.elastic.co/u/mehdi-gital)\ **Replies:** 2\ **Last updated:** [May 11, 2018, 3:14pm UTC](https://discuss.elastic.co/t/importing-data-with-curl-error-newb-here/131381 "2018-05-11T15:14:35Z")
Hey guys, I've been learning Elasticsearch and Kibana for 2-3 days now. I'm super newbie and I know it but I was wondering if anyone can lend a hand. Issue: I'm trying to pass a json file to my kibana session using the… --- ## [Winlogbeat - seems always start from oldest eventlog entry](https://discuss.elastic.co/t/winlogbeat-seems-always-start-from-oldest-eventlog-entry/42603)
**Author:** [@rthl](https://discuss.elastic.co/u/rthl)\ **Replies:** 2\ **Last updated:** [April 12, 2016, 1:58pm UTC](https://discuss.elastic.co/t/winlogbeat-seems-always-start-from-oldest-eventlog-entry/42603 "2016-04-12T13:58:25Z")
Right no i try to evaluate elk for Windows eventlogs using winlogbeat. no matter what i put in the "ignore\_older"-Var, winlogbeat seems always to start from the oldest available eventlog-entry. So it takes very long to c… --- ## [Strange Marvel exception](https://discuss.elastic.co/t/strange-marvel-exception/36112)
**Author:** [@Chris\_Neal](https://discuss.elastic.co/u/Chris_Neal)\ **Replies:** 2\ **Last updated:** [December 2, 2015, 2:08pm UTC](https://discuss.elastic.co/t/strange-marvel-exception/36112 "2015-12-02T14:08:00Z")
Hi all. I have a dedicated Marvel cluster in my production environment. I noticed tonight that it was missing one of the nodes in my cluster. When I went to the missing data node (dedicated data only), I found this e… --- ## [Failed to perform snapshot (index files)\]; nested: FileNotFoundException](https://discuss.elastic.co/t/failed-to-perform-snapshot-index-files-nested-filenotfoundexception/19202)
**Author:** [@Aleh\_Aleshka](https://discuss.elastic.co/u/Aleh_Aleshka)\ **Replies:** 2\ **Last updated:** [August 14, 2014, 4:01pm UTC](https://discuss.elastic.co/t/failed-to-perform-snapshot-index-files-nested-filenotfoundexception/19202 "2014-08-14T16:01:05Z")
Hello I have a 1.2.2 cluster of 6 nodes with several indexes configured with 2 to 4 replicas. I'm trying to perform a snapshot but it completes only partially with failures like this: CreateSnapshotResponse\[snap… --- ## [502 Timeout with Delete by query](https://discuss.elastic.co/t/502-timeout-with-delete-by-query/357053)
**Author:** [@Musled](https://discuss.elastic.co/u/Musled)\ **Replies:** 7\ **Last updated:** [April 9, 2024, 2:43pm UTC](https://discuss.elastic.co/t/502-timeout-with-delete-by-query/357053 "2024-04-09T14:43:15Z")
Hello there ! I have a problem when I run this query: \`POST /logs-nginx.cpcu.prod/\_delete\_by\_query { "query": { "range": { "@timestamp": { "lt": "now-30d" } } } } Basically I w… --- ## [Heartbeat: Ping TImeout on hosts causes state.duration\_ms to stay at 0?](https://discuss.elastic.co/t/heartbeat-ping-timeout-on-hosts-causes-state-duration-ms-to-stay-at-0/334051)
**Author:** [@scantron](https://discuss.elastic.co/u/scantron)\ **Replies:** 7\ **Last updated:** [July 4, 2023, 3:46pm UTC](https://discuss.elastic.co/t/heartbeat-ping-timeout-on-hosts-causes-state-duration-ms-to-stay-at-0/334051 "2023-07-04T15:46:49Z")
We are monitoring a few hosts using ICMP on heartbeat. Heartbeat accurately depicts the uptime using the state.duration\_ms field. However, shutting down a host for testing leads to the error.message field of "ping timeou… --- ## [Partial matching against dates](https://discuss.elastic.co/t/partial-matching-against-dates/294190)
**Author:** [@snoopy20](https://discuss.elastic.co/u/snoopy20)\ **Replies:** 7\ **Last updated:** [January 15, 2022, 7:45pm UTC](https://discuss.elastic.co/t/partial-matching-against-dates/294190 "2022-01-15T19:45:03Z")
I'm sure this is is easy but couldn't find a simple answer. If I have 'XXXX2000' in an index and I search '01022000' how can I accept that as a partial match, whereby the more of the word that matches the higher the sco… --- ## [Export a field's content from a Kibana Message](https://discuss.elastic.co/t/export-a-fields-content-from-a-kibana-message/210001)
**Author:** [@deeps](https://discuss.elastic.co/u/deeps)\ **Replies:** 1\ **Last updated:** [December 6, 2019, 1:15pm UTC](https://discuss.elastic.co/t/export-a-fields-content-from-a-kibana-message/210001 "2019-12-06T13:15:36Z")
I need to export the whole content in "message" field in a log message to grep some data. Is there a way to do that? Kibana version: 5.5.1 (No X-Pack). "\_source": { "message": "op=THIS, status=OK, zip=X, state=X… --- ## [elasticSearch installation is stuck, problem with security](https://discuss.elastic.co/t/elasticsearch-installation-is-stuck-problem-with-security/195534)
**Author:** [@Yana\_Karas](https://discuss.elastic.co/u/Yana_Karas)\ **Replies:** 1\ **Last updated:** [August 19, 2019, 7:23am UTC](https://discuss.elastic.co/t/elasticsearch-installation-is-stuck-problem-with-security/195534 "2019-08-19T07:23:14Z")
elasticsearch installation is stuck:Nothing happens after the last log,the security log \ \[2019-08-16T19:22:17,371\]\[INFO \]\[o.e.p.PluginsService \] \[HPC6\] loaded module \[lang-mustache\] \[2019-08-16T19:22:17,372\]\[I… --- ## [Sync data between MongoDB Atlas and Elastic search using logstash module](https://discuss.elastic.co/t/sync-data-between-mongodb-atlas-and-elastic-search-using-logstash-module/174253)
**Author:** [@vishal.k](https://discuss.elastic.co/u/vishal.k)\ **Replies:** 1\ **Last updated:** [April 5, 2019, 9:22am UTC](https://discuss.elastic.co/t/sync-data-between-mongodb-atlas-and-elastic-search-using-logstash-module/174253 "2019-04-05T09:22:58Z")
Hello, I wanted sync data between MongoDB Atlas and Elasticsearch (cloud) using logstash module, however I'm not finding any good way to do so. I tried using mongodb-connector however there are some SSL handshake issue… --- ## [Logstash parse docker container log](https://discuss.elastic.co/t/logstash-parse-docker-container-log/168816)
**Author:** [@messi655](https://discuss.elastic.co/u/messi655)\ **Replies:** 1\ **Last updated:** [February 18, 2019, 1:16pm UTC](https://discuss.elastic.co/t/logstash-parse-docker-container-log/168816 "2019-02-18T13:16:38Z")
Hi, Our API is running by container and the log of our API inside container have format like this: {"log":"{"fields.time":"2019-02-16T02:53:00.606890428Z","ip":"xx.xxx.xxx.xxx","latency":303805427,"level":"info","meth… --- ## [Workaround for using wild cards in phrases and proximity searches(Elastic Search)](https://discuss.elastic.co/t/workaround-for-using-wild-cards-in-phrases-and-proximity-searches-elastic-search/18373)
**Author:** [@saud\_ur\_rehman](https://discuss.elastic.co/u/saud_ur_rehman)\ **Replies:** 1\ **Last updated:** [March 17, 2016, 8:44pm UTC](https://discuss.elastic.co/t/workaround-for-using-wild-cards-in-phrases-and-proximity-searches-elastic-search/18373 "2016-03-17T20:44:36Z")
Problem: Recently I wanted to do a proximity search on elastic search index. I wanted to search all docs where ‘measles’ and ‘vaccin\*’ were with 25 characters to each other. Plus I wanted both of them to be in or… --- ## [ElasticSearch Aggregation + Sorting in 5.3](https://discuss.elastic.co/t/elasticsearch-aggregation-sorting-in-5-3/222054)
**Author:** [@het](https://discuss.elastic.co/u/het)\ **Replies:** 3\ **Last updated:** [March 4, 2020, 12:32pm UTC](https://discuss.elastic.co/t/elasticsearch-aggregation-sorting-in-5-3/222054 "2020-03-04T12:32:57Z")
Hi Team, I wanted to aggregate the data on a different field and also wanted to get the aggregated data on sorted fashion based on the name. My data is : { "\_index": "testing-aggregation", "\_type": "employee",… --- ## [Journalbeat and Java exceptions](https://discuss.elastic.co/t/journalbeat-and-java-exceptions/172464)
**Author:** [@igorc](https://discuss.elastic.co/u/igorc)\ **Replies:** 3\ **Last updated:** [April 8, 2019, 7:22am UTC](https://discuss.elastic.co/t/journalbeat-and-java-exceptions/172464 "2019-04-08T07:22:08Z")
Hi all, I'm trying to catch java exceptions using multiline processor as follows: journalbeat.inputs: - paths: \[\] seek: cursor include\_matches: - "syslog.identifier=tomcat" multiline: pattern: '^\\d+\\serro… --- ## [ELK APM server not working](https://discuss.elastic.co/t/elk-apm-server-not-working/156654)
**Author:** [@MishMick](https://discuss.elastic.co/u/MishMick)\ **Replies:** 3\ **Last updated:** [November 14, 2018, 3:41pm UTC](https://discuss.elastic.co/t/elk-apm-server-not-working/156654 "2018-11-14T15:41:43Z")
Error: Elastic APM server is not available. (It seems like you are using a version of the APM server which isn't compatible with this agent. Please use APM server 6.5 or newer. ). But from what I have researched so far,… --- ## [Node crashes without logs randomly. StubRoutines::jbyte\_disjoint\_arraycopy](https://discuss.elastic.co/t/node-crashes-without-logs-randomly-stubroutines-jbyte-disjoint-arraycopy/127273)
**Author:** [@imehl](https://discuss.elastic.co/u/imehl)\ **Replies:** 3\ **Last updated:** [April 16, 2018, 10:50am UTC](https://discuss.elastic.co/t/node-crashes-without-logs-randomly-stubroutines-jbyte-disjoint-arraycopy/127273 "2018-04-16T10:50:32Z")
One node of my cluster randomly crashes without any log in /var/log/elasticsearch and I don't know how to solve/debug this problem :frowning: Here is the hs\_err\_pid.log https://pastebin.com/tKiGSUPh There is enough fr… --- ## [ES Rewriting range to @timestamp to BooleanQuery / TermQuery - Why?](https://discuss.elastic.co/t/es-rewriting-range-to-timestamp-to-booleanquery-termquery-why/56363)
**Author:** [@Asaf\_Mesika](https://discuss.elastic.co/u/Asaf_Mesika)\ **Replies:** 3\ **Last updated:** [September 12, 2016, 3:44pm UTC](https://discuss.elastic.co/t/es-rewriting-range-to-timestamp-to-booleanquery-termquery-why/56363 "2016-09-12T15:44:09Z")
Hi, I'm running a very simple query which uses range on @timestmap field (Type: date). From some reason I see using Profile API than it is rewritten to multiple TermQuery on this field. I was wondering why is that ha… --- ## [Topbeat on Windows](https://discuss.elastic.co/t/topbeat-on-windows/52942)
**Author:** [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Replies:** 3\ **Last updated:** [June 16, 2016, 6:48pm UTC](https://discuss.elastic.co/t/topbeat-on-windows/52942 "2016-06-16T18:48:03Z")
I have been using topbeat to collect metrics on my server, however, I have found that the metrics load.load1 seem not to be available for Windows machine. Is that right? If true, how can I collect the system load on Wind… --- ## [ElasticSearch - search statistic - like google analytics](https://discuss.elastic.co/t/elasticsearch-search-statistic-like-google-analytics/18150)
**Author:** [@Jacob\_Dalgaard](https://discuss.elastic.co/u/Jacob_Dalgaard)\ **Replies:** 3\ **Last updated:** [June 19, 2014, 2:15am UTC](https://discuss.elastic.co/t/elasticsearch-search-statistic-like-google-analytics/18150 "2014-06-19T02:15:28Z")
Hello I am looking into using ElasticSearch as a search engine for one of the projects I am working on. There is still one thing which I need to find an answer for, and I hope someone inhere can help. The customer … --- ## [Elasticsearch on an existing jetty container](https://discuss.elastic.co/t/elasticsearch-on-an-existing-jetty-container/15192)
**Author:** [@Srividhya\_Umashanker](https://discuss.elastic.co/u/Srividhya_Umashanker)\ **Replies:** 3\ **Last updated:** [January 10, 2014, 10:43am UTC](https://discuss.elastic.co/t/elasticsearch-on-an-existing-jetty-container/15192 "2014-01-10T10:43:06Z")
I understand that there is a jetty plugin for elasticsearch, which enables us to run ES in a jetty container instead of using Netty for HTTP. Is there a way for us to bundle elasticsearch and run it on an existing … --- ## [Date processor ingest pipeline failed to parse](https://discuss.elastic.co/t/date-processor-ingest-pipeline-failed-to-parse/304515)
**Author:** [@alfianaf](https://discuss.elastic.co/u/alfianaf)\ **Replies:** 4\ **Last updated:** [May 12, 2022, 3:45am UTC](https://discuss.elastic.co/t/date-processor-ingest-pipeline-failed-to-parse/304515 "2022-05-12T03:45:41Z")
Hello, I'm using date processor on ingest pipeline, I've seen the documentation about the date processor, the syntax I wrote seems right, but the result is not. here's my date example 05/11/2022, 7:03:52 AM and here'… --- ## [Can't setup Winlogbeat or Filebeat dashboards for Kibana](https://discuss.elastic.co/t/cant-setup-winlogbeat-or-filebeat-dashboards-for-kibana/281962)
**Author:** [@JulienL](https://discuss.elastic.co/u/JulienL)\ **Replies:** 4\ **Last updated:** [August 30, 2021, 5:11pm UTC](https://discuss.elastic.co/t/cant-setup-winlogbeat-or-filebeat-dashboards-for-kibana/281962 "2021-08-30T17:11:06Z")
Hello! Firstly, sorry for any mistake in my english. I'm not a native english speaker :slight\_smile: Hope can someone help me with this. I have installed and configured ELK with "Basic Security plus HTTPS", I receive … --- ## [Problem with coding Grok filter](https://discuss.elastic.co/t/problem-with-coding-grok-filter/88484)
**Author:** [@ibrahimsharaf](https://discuss.elastic.co/u/ibrahimsharaf)\ **Replies:** 4\ **Last updated:** [June 7, 2017, 1:12pm UTC](https://discuss.elastic.co/t/problem-with-coding-grok-filter/88484 "2017-06-07T13:12:54Z")
Hi there, I have this message 2017-05-01 08:09:19 \[scraper.py\] ERROR: Error downloading \ I want to write a grok filter to extract this part Error downloading \ **Author:** [@oreno](https://discuss.elastic.co/u/oreno)\ **Replies:** 4\ **Last updated:** [June 25, 2014, 2:40am UTC](https://discuss.elastic.co/t/script-fields-vs-filter-script/12686 "2014-06-25T02:40:33Z") Hi, I notice that using a script\_fields that returns true or false values is going much faster then using the same script but with filter script declaration (so it will filter the docs returning false). I was sur… --- ## [ScrollID is coming as null](https://discuss.elastic.co/t/scrollid-is-coming-as-null/330938)
**Author:** [@suresh\_chaudhari](https://discuss.elastic.co/u/suresh_chaudhari)\ **Replies:** 5\ **Last updated:** [May 12, 2023, 1:47pm UTC](https://discuss.elastic.co/t/scrollid-is-coming-as-null/330938 "2023-05-12T13:47:59Z")
I am using elastic8. with java client. I first used elasticclient.search() request this returned scrollId then i used same scrollID to call client.scroll(scrollID) api however the first call elasticclient.search() i… --- ## [Keeping same log events once instead of multiple time](https://discuss.elastic.co/t/keeping-same-log-events-once-instead-of-multiple-time/239301)
**Author:** [@ksaha](https://discuss.elastic.co/u/ksaha)\ **Replies:** 5\ **Last updated:** [July 1, 2020, 3:36pm UTC](https://discuss.elastic.co/t/keeping-same-log-events-once-instead-of-multiple-time/239301 "2020-07-01T15:36:03Z")
Hello, I have a running ELK stack, and I am collecting the logs from various source using beats and parsing them using Logstash and finally visualizing in Kibana through elasticsearch. It is working fine. I have one que… --- ## [Visual Builder is unabled to add more than 5 series](https://discuss.elastic.co/t/visual-builder-is-unabled-to-add-more-than-5-series/91057)
**Author:** [@AndreAga](https://discuss.elastic.co/u/AndreAga)\ **Replies:** 5\ **Last updated:** [June 28, 2017, 1:23pm UTC](https://discuss.elastic.co/t/visual-builder-is-unabled-to-add-more-than-5-series/91057 "2017-06-28T13:23:28Z")
Hi all, I'm playing with the new Visual Builder in Kibana 5.4 and I noticed that if I add more than 5/6 series in the same visualization, I get this error: Oops! Looks like something went wrong. Refreshing may do t… --- ## [In case of Massive number of Filter items, which is faster? Filter by \_id or Filter by a long field..?](https://discuss.elastic.co/t/in-case-of-massive-number-of-filter-items-which-is-faster-filter-by--id-or-filter-by-a-long-field/8977)
**Author:** [@Pradeep\_2](https://discuss.elastic.co/u/Pradeep_2)\ **Replies:** 5\ **Last updated:** [September 11, 2012, 4:48pm UTC](https://discuss.elastic.co/t/in-case-of-massive-number-of-filter-items-which-is-faster-filter-by--id-or-filter-by-a-long-field/8977 "2012-09-11T16:48:31Z")
In my query I have to pass many values to filter on.. like "ids" : { "values" : \[1, 4, 100 ....... (upto 300k such values) \] } as \_id is of type String.. I am wondering if ,I store the value… --- ## [ILM policy for .monitoring indexes](https://discuss.elastic.co/t/ilm-policy-for-monitoring-indexes/285433)
**Author:** [@dabo](https://discuss.elastic.co/u/dabo)\ **Replies:** 2\ **Last updated:** [October 4, 2021, 6:51am UTC](https://discuss.elastic.co/t/ilm-policy-for-monitoring-indexes/285433 "2021-10-04T06:51:13Z")
Hi, How do I properly set up an ILM policy for .monitoring-\* indexes? When I create a policy and add it to the index templates I get some error about rollover\_alias Then when I add rollover alias and I get another err… --- ## [Apm-server not start Cannot index event publisher.Event{Content:beat.Event](https://discuss.elastic.co/t/apm-server-not-start-cannot-index-event-publisher-event-content-beat-event/191778)
**Author:** [@resa](https://discuss.elastic.co/u/resa)\ **Replies:** 2\ **Last updated:** [July 23, 2019, 3:29pm UTC](https://discuss.elastic.co/t/apm-server-not-start-cannot-index-event-publisher-event-content-beat-event/191778 "2019-07-23T15:29:47Z")
I got error when try to run apm-server -e: 2019-07-23T05:29:47.931-0400 WARN elasticsearch/client.go:527 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xbf45d2c2b44ab9a1, ext:6… --- ## [Can we add a normalizer while adding a new field to an existing index. I tried to but it doesn't seem to be working](https://discuss.elastic.co/t/can-we-add-a-normalizer-while-adding-a-new-field-to-an-existing-index-i-tried-to-but-it-doesnt-seem-to-be-working/184543)
**Author:** [@aastha](https://discuss.elastic.co/u/aastha)\ **Replies:** 2\ **Last updated:** [June 13, 2019, 5:47pm UTC](https://discuss.elastic.co/t/can-we-add-a-normalizer-while-adding-a-new-field-to-an-existing-index-i-tried-to-but-it-doesnt-seem-to-be-working/184543 "2019-06-13T17:47:00Z")
The index is already in elasticsearch, I'm trying to add a new field "my\_field" with a custom analyzer but this doesn't work. PUT my\_index { "settings": { "analysis": { "normalizer": { "my\_normalizer": { "type": "… --- ## [Reasons for upsert failure in bulk request](https://discuss.elastic.co/t/reasons-for-upsert-failure-in-bulk-request/114448)
**Author:** [@karthik\_s1](https://discuss.elastic.co/u/karthik_s1)\ **Replies:** 2\ **Last updated:** [January 12, 2018, 5:22am UTC](https://discuss.elastic.co/t/reasons-for-upsert-failure-in-bulk-request/114448 "2018-01-12T05:22:44Z")
I would like to know under which circumstances upserts can fail. We had been doings inserts and upserts through logstash. Many a times we have noticed that some upsert doesn't happen at the same time inserts would have g… --- ## [IndicesOptions ignoreUnavailable not working](https://discuss.elastic.co/t/indicesoptions-ignoreunavailable-not-working/18548)
**Author:** [@T\_Vinod\_Gupta](https://discuss.elastic.co/u/T_Vinod_Gupta)\ **Replies:** 2\ **Last updated:** [November 12, 2014, 12:45am UTC](https://discuss.elastic.co/t/indicesoptions-ignoreunavailable-not-working/18548 "2014-11-12T00:45:29Z")
Hi, Im on ES 1.2.1 and the below usage is not working for me. even if i pass the option of ignoring unavailable or closed indices, i get an error response (ClusterBlockException\[blocked by: \[FORBIDDEN/4/index closed\];… --- ## [Add dropdown box in Kibana Interface](https://discuss.elastic.co/t/add-dropdown-box-in-kibana-interface/14995)
**Author:** [@Salih\_Kardan](https://discuss.elastic.co/u/Salih_Kardan)\ **Replies:** 2\ **Last updated:** [December 23, 2013, 12:03pm UTC](https://discuss.elastic.co/t/add-dropdown-box-in-kibana-interface/14995 "2013-12-23T12:03:42Z")
Hi folks I want to add a small feature to Kibana, however I could not understand whole structure of Kibana. Particularly I want to add a dropdown menu to be able to choose host to display the logs accordingly. … --- ## [New Theme in Kibana](https://discuss.elastic.co/t/new-theme-in-kibana/216400)
**Author:** [@jeeva](https://discuss.elastic.co/u/jeeva)\ **Replies:** 1\ **Last updated:** [January 24, 2020, 10:53am UTC](https://discuss.elastic.co/t/new-theme-in-kibana/216400 "2020-01-24T10:53:40Z")
Hi Team, I intend to create new Theme like Dark and Default themes. I like to create Blue theme for my customers , please advise me how to customize Kibana to attain this requirement. Thanks S.Jeeva --- ## [Metricbeat can't output to logstash](https://discuss.elastic.co/t/metricbeat-cant-output-to-logstash/355491)
**Author:** [@h.d.intodata](https://discuss.elastic.co/u/h.d.intodata)\ **Replies:** 6\ **Last updated:** [March 21, 2024, 2:55pm UTC](https://discuss.elastic.co/t/metricbeat-cant-output-to-logstash/355491 "2024-03-21T14:55:04Z")
Hi team, I had my metricbeat configured to elasticsearch, everything was working fine. I now need to include logstash, however, after changing the metricbeat output to logstash with my host, "http://\:5044"(e… [Previous page](https://discuss.elastic.co/top.md?page=1225&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1227&per_page=50&period=all)