# Top

**URL:** https://discuss.elastic.co/top.md?page=1231&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1232

---

## [Bulk vs. BulkAsync](https://discuss.elastic.co/t/bulk-vs-bulkasync/43787)

<div class="topic-metadata">

**Author:** [@muthukumare](https://discuss.elastic.co/u/muthukumare)\
**Replies:** 0\
**Last updated:** [March 8, 2016, 2:34pm UTC](https://discuss.elastic.co/t/bulk-vs-bulkasync/43787 "2016-03-08T14:34:04Z")

</div>

In our application, we are using Bulk insert option to upload the multiple JSON documents in single insert command using Elasticsearch.net. We faced two issues while using BulkAsync, which is: BulkAsync method won't s…

---

## [Elasticsearch 8.1.0 on Windows VM running in Azure not showing or creating Indices](https://discuss.elastic.co/t/elasticsearch-8-1-0-on-windows-vm-running-in-azure-not-showing-or-creating-indices/299561)

<div class="topic-metadata">

**Author:** [@ddynamight](https://discuss.elastic.co/u/ddynamight)\
**Replies:** 5\
**Last updated:** [March 16, 2022, 12:04am UTC](https://discuss.elastic.co/t/elasticsearch-8-1-0-on-windows-vm-running-in-azure-not-showing-or-creating-indices/299561 "2022-03-16T00:04:01Z")

</div>

I have just set up Elasticsearch 8.1.0 on a Windows Server 2022 VM running inside Azure, but the indexing is not working. I am unable to create new indices or view the default indices. A get request to localhost:9200/\_c…

---

## [Parse XML by Document not Element](https://discuss.elastic.co/t/parse-xml-by-document-not-element/288028)

<div class="topic-metadata">

**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\
**Replies:** 5\
**Last updated:** [October 29, 2021, 10:32pm UTC](https://discuss.elastic.co/t/parse-xml-by-document-not-element/288028 "2021-10-29T22:32:21Z")

</div>

As a test, I am trying to ingest the following simple XML file (the actual production file is huge). \<note\> \<to\>Tove\</to\> \<from\>Jani\</from\> \<heading\>Reminder\</heading\> \<body\>Don't forget me this weekend!\</body\> \</note\> …

---

## [Separate Indexes Per Log File From Two Different Servers (Filebeat -\> Logstash - \> Elastic -\> Kibana)](https://discuss.elastic.co/t/separate-indexes-per-log-file-from-two-different-servers-filebeat-logstash-elastic-kibana/285262)

<div class="topic-metadata">

**Author:** [@kingmilo](https://discuss.elastic.co/u/kingmilo)\
**Replies:** 5\
**Last updated:** [September 27, 2021, 8:50pm UTC](https://discuss.elastic.co/t/separate-indexes-per-log-file-from-two-different-servers-filebeat-logstash-elastic-kibana/285262 "2021-09-27T20:50:28Z")

</div>

I have two servers configured with Filebeat to send logs to Logstash which is working properly. I would now like to view each of those logs separately under their respective indexes within Kibana Discover but I am strugg…

---

## [Kibana dashboard shows "Embeddable factory \[embeddableFactoryId = undefined\] does not exist."](https://discuss.elastic.co/t/kibana-dashboard-shows-embeddable-factory-embeddablefactoryid-undefined-does-not-exist/224497)

<div class="topic-metadata">

**Author:** [@magtaff](https://discuss.elastic.co/u/magtaff)\
**Replies:** 5\
**Last updated:** [March 31, 2020, 3:31pm UTC](https://discuss.elastic.co/t/kibana-dashboard-shows-embeddable-factory-embeddablefactoryid-undefined-does-not-exist/224497 "2020-03-31T15:31:15Z")

</div>

Hi, My Kibana versioin is 7.5.0, I'm did following steps: Created an Kibana dashboard firstly, and I can make sure Kibana dashboard was working well. Use Kibana's export REST API to export JSON of this dashboard. Dele…

---

## [RUM: CORS Missing Allowed Origin](https://discuss.elastic.co/t/rum-cors-missing-allowed-origin/310231)

<div class="topic-metadata">

**Author:** [@WorldDrknss](https://discuss.elastic.co/u/WorldDrknss)\
**Replies:** 2\
**Last updated:** [July 21, 2022, 4:19pm UTC](https://discuss.elastic.co/t/rum-cors-missing-allowed-origin/310231 "2022-07-21T16:19:24Z")

</div>

I've search high and low trying to get this issue figured out. I am currently having CORS issues regarding POST via the RUM agent, but preflight OPTIONS passes. APM server is deployed using Fleet. Bind is set to 0.0.0.0…

---

## [Query for Unicode Character in process.name](https://discuss.elastic.co/t/query-for-unicode-character-in-process-name/270175)

<div class="topic-metadata">

**Author:** [@inf](https://discuss.elastic.co/u/inf)\
**Replies:** 2\
**Last updated:** [April 23, 2021, 2:49am UTC](https://discuss.elastic.co/t/query-for-unicode-character-in-process-name/270175 "2021-04-23T02:49:12Z")

</div>

Hi there, I am trying to query for a right-to-left override (RTLO) character (U+202E) within a process name. My query in Dev Tools in Kibana is this: GET /\[index\_name\]/\_eql/search { "query": """ process where pr…

---

## [\_delete\_by\_queryで空いたストレージを利用したい](https://discuss.elastic.co/t/delete-by-query/252176)

<div class="topic-metadata">

**Author:** [@aurantiacus](https://discuss.elastic.co/u/aurantiacus)\
**Replies:** 2\
**Last updated:** [October 19, 2020, 8:12am UTC](https://discuss.elastic.co/t/delete-by-query/252176 "2020-10-19T08:12:08Z")

</div>

elasticsearch6.4.0 インデックスから条件に該当するデータを\_delete\_by\_queryで削除し削除して確保できるであろうストレージを利用したいと考えています。 実際に試したところ、\_delete\_by\_query実行前と実行後で kibana-\>Management-\> Index managementで参照できる インデックスのPrimary Storage Sizeが下がるものだと思っていましたが、変化…

---

## [Unable to start elasticsearch 7.8 container with a password](https://discuss.elastic.co/t/unable-to-start-elasticsearch-7-8-container-with-a-password/245307)

<div class="topic-metadata">

**Author:** [@vorpal\_sledge](https://discuss.elastic.co/u/vorpal_sledge)\
**Replies:** 2\
**Last updated:** [August 17, 2020, 11:32pm UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-7-8-container-with-a-password/245307 "2020-08-17T23:32:59Z")

</div>

Hello, I am attempting to setup an elastisearch cluster using a series of nodes which each will run a docker-compose. However, when starting up the first node I am unable to log in, and see the following error in docker…

---

## [Stuck running docker logstash with pipelines.yml (binding)](https://discuss.elastic.co/t/stuck-running-docker-logstash-with-pipelines-yml-binding/245225)

<div class="topic-metadata">

**Author:** [@nino](https://discuss.elastic.co/u/nino)\
**Replies:** 2\
**Last updated:** [August 17, 2020, 5:03pm UTC](https://discuss.elastic.co/t/stuck-running-docker-logstash-with-pipelines-yml-binding/245225 "2020-08-17T17:03:10Z")

</div>

Dear all, i can't get logstash working multipipeline mode inside a docker container. pipelines.yml (inside container) /usr/share/logstash/config bash-4.2$ stat pipelines.yml File: ‘pipelines.yml’ Access: (0644/-rw-…

---

## [Duplicate logs with ingest pipeline](https://discuss.elastic.co/t/duplicate-logs-with-ingest-pipeline/220647)

<div class="topic-metadata">

**Author:** [@Ayush\_Mathur](https://discuss.elastic.co/u/Ayush_Mathur)\
**Replies:** 2\
**Last updated:** [February 26, 2020, 9:16am UTC](https://discuss.elastic.co/t/duplicate-logs-with-ingest-pipeline/220647 "2020-02-26T09:16:03Z")

</div>

I have a EFK cluster with version 6.8.2 and everything was running smoothly until I had a requirement to create specific type of index (project-large\_payload-$namespace) based on a field length. For this, I used script\_…

---

## [Translate on Ingest Node](https://discuss.elastic.co/t/translate-on-ingest-node/106338)

<div class="topic-metadata">

**Author:** [@Akumar](https://discuss.elastic.co/u/Akumar)\
**Replies:** 2\
**Last updated:** [November 10, 2017, 6:12pm UTC](https://discuss.elastic.co/t/translate-on-ingest-node/106338 "2017-11-10T18:12:54Z")

</div>

Is there an equivalent way of achieving the Logstash translate filter function with an ingest node processor? I want to capture fields with numerical error codes, but record in ES or display in KIbana the description of …

---

## [How to change 50 per page for search object in dashboard](https://discuss.elastic.co/t/how-to-change-50-per-page-for-search-object-in-dashboard/91437)

<div class="topic-metadata">

**Author:** [@Yong\_Zhang](https://discuss.elastic.co/u/Yong_Zhang)\
**Replies:** 2\
**Last updated:** [July 1, 2017, 2:34am UTC](https://discuss.elastic.co/t/how-to-change-50-per-page-for-search-object-in-dashboard/91437 "2017-07-01T02:34:20Z")

</div>

Hi, all I have a search object and I added it to dashboard, but I can't find a way to change the number per page below, any ideas? Kibana version is 5.4.0

---

## [ERROR: Something went wrong when installing file:///root/Plugins/x-pack-5.3.0 (1).zip](https://discuss.elastic.co/t/error-something-went-wrong-when-installing-file-root-plugins-x-pack-5-3-0-1-zip/81209)

<div class="topic-metadata">

**Author:** [@Ravikumar\_G](https://discuss.elastic.co/u/Ravikumar_G)\
**Replies:** 2\
**Last updated:** [April 4, 2017, 7:57pm UTC](https://discuss.elastic.co/t/error-something-went-wrong-when-installing-file-root-plugins-x-pack-5-3-0-1-zip/81209 "2017-04-04T19:57:59Z")

</div>

Hi I'm able to installing X-pack in 5.3.0 versions got into error not sure what exactly mean able to install x-pack sucessfully in kibana elastic search when i try logstash getting failed \[root@elk-cclab38 bin\]# ./log…

---

## [Unassigned shards still not working](https://discuss.elastic.co/t/unassigned-shards-still-not-working/28670)

<div class="topic-metadata">

**Author:** [@trekr5](https://discuss.elastic.co/u/trekr5)\
**Replies:** 2\
**Last updated:** [September 4, 2015, 11:34am UTC](https://discuss.elastic.co/t/unassigned-shards-still-not-working/28670 "2015-09-04T11:34:23Z")

</div>

Hi, I wondering if someone could please help. These are the results of an ES cluster health call: { "cluster\_name" : "ae-logstash\_esearch", "status" : "red", "timed\_out" : false, "number\_of\_nodes" : 2, "…

---

## [Input jdbc scheduler](https://discuss.elastic.co/t/input-jdbc-scheduler/27201)

<div class="topic-metadata">

**Author:** [@michaellizhou](https://discuss.elastic.co/u/michaellizhou)\
**Replies:** 2\
**Last updated:** [August 11, 2015, 6:11pm UTC](https://discuss.elastic.co/t/input-jdbc-scheduler/27201 "2015-08-11T18:11:03Z")

</div>

Is there a specific method to running logstash with jdbc input that has a schedule? What I have noticed for the paste 1-2 hours is that my schedule is not actually running! I have the schedule set to "\* \* \* \* \*" but it l…

---

## [Logstash - systemd-journald suppressed mensagens](https://discuss.elastic.co/t/logstash-systemd-journald-suppressed-mensagens/344080)

<div class="topic-metadata">

**Author:** [@SilasMuniz1](https://discuss.elastic.co/u/SilasMuniz1)\
**Replies:** 8\
**Last updated:** [October 14, 2023, 2:10pm UTC](https://discuss.elastic.co/t/logstash-systemd-journald-suppressed-mensagens/344080 "2023-10-14T14:10:38Z")

</div>

Hi, Always when I restarting my logstash I see this message below: Nowadays I have CPU problem and I am trying fix it. I saw a person in the forum talk about change RateLimitBurst parameter into /etc/systemd/journa…

---

## [org.elasticsearch.transport.ConnectTransportException: \[\]\[172.18.0.2:9300\] connect\_timeout\[30s\]](https://discuss.elastic.co/t/org-elasticsearch-transport-connecttransportexception-172-18-0-2-9300-connect-timeout-30s/236260)

<div class="topic-metadata">

**Author:** [@Vishnu\_Vardhan](https://discuss.elastic.co/u/Vishnu_Vardhan)\
**Replies:** 3\
**Last updated:** [June 10, 2020, 7:18am UTC](https://discuss.elastic.co/t/org-elasticsearch-transport-connecttransportexception-172-18-0-2-9300-connect-timeout-30s/236260 "2020-06-10T07:18:25Z")

</div>

Continuing the discussion from Failed to connect to node \[{}{}{localhost}{127.0.0.1:9300}\], removed from nodes list:

---

## [TSVB Table does not remember Sort Column unless you click on it](https://discuss.elastic.co/t/tsvb-table-does-not-remember-sort-column-unless-you-click-on-it/227546)

<div class="topic-metadata">

**Author:** [@qualispec](https://discuss.elastic.co/u/qualispec)\
**Replies:** 3\
**Last updated:** [April 10, 2020, 7:40pm UTC](https://discuss.elastic.co/t/tsvb-table-does-not-remember-sort-column-unless-you-click-on-it/227546 "2020-04-10T19:40:15Z")

</div>

I'm using Kibana 7.5.0. I'm working on a TSVB Table, where my Group by field is a date field (with mapping "type" : "date"). That date field is displaying in the TSVB Table with format like "Apr 9, 2020 @ 00:00:00.000". …

---

## [Elasticsearch Cluster Inside MapR Cluster](https://discuss.elastic.co/t/elasticsearch-cluster-inside-mapr-cluster/141305)

<div class="topic-metadata">

**Author:** [@Mark\_Dendrix\_Garcia](https://discuss.elastic.co/u/Mark_Dendrix_Garcia)\
**Replies:** 8\
**Last updated:** [July 24, 2018, 10:39am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-inside-mapr-cluster/141305 "2018-07-24T10:39:31Z")

</div>

Hi Elasticsearch Team, We are creating a Document Management System using FSCrawler, Elasticsearch & MapR-FS (File system) We choose a Big Data Platform since the usecases can be scaled to analytics. And is it possib…

---

## [How can I view logs from another client](https://discuss.elastic.co/t/how-can-i-view-logs-from-another-client/46071)

<div class="topic-metadata">

**Author:** [@rvaedex23](https://discuss.elastic.co/u/rvaedex23)\
**Replies:** 3\
**Last updated:** [April 1, 2016, 7:01pm UTC](https://discuss.elastic.co/t/how-can-i-view-logs-from-another-client/46071 "2016-04-01T19:01:26Z")

</div>

How can I view logs from another client in Kibana 4. Can I run a search and pull up the logs from a different client? I have about 5 clients configured.

---

## [Following developper's guide, beats won't compile](https://discuss.elastic.co/t/following-developpers-guide-beats-wont-compile/41592)

<div class="topic-metadata">

**Author:** [@rvlander](https://discuss.elastic.co/u/rvlander)\
**Replies:** 3\
**Last updated:** [February 16, 2016, 5:26pm UTC](https://discuss.elastic.co/t/following-developpers-guide-beats-wont-compile/41592 "2016-02-16T17:26:53Z")

</div>

Disclaimer: I am a total noob in Go. When running from Getting Ready section in Developpers's guide: go get github.com/elastic/beats I have the following error: package github.com/elastic/beats: no buildable …

---

## [Howto Decode64 attachment](https://discuss.elastic.co/t/howto-decode64-attachment/9992)

<div class="topic-metadata">

**Author:** [@dukr](https://discuss.elastic.co/u/dukr)\
**Replies:** 3\
**Last updated:** [December 10, 2012, 12:35pm UTC](https://discuss.elastic.co/t/howto-decode64-attachment/9992 "2012-12-10T12:35:00Z")

</div>

Hi, I would elasticserach used for indexing text files (PDF, DOC, XML), as well as their data storage. I used the example given on the web page for saving the file in base64 using the plugin to store/index in to ela…

---

## [ES hangs up when sending too much index requests](https://discuss.elastic.co/t/es-hangs-up-when-sending-too-much-index-requests/7121)

<div class="topic-metadata">

**Author:** [@Ihor\_Hnedysh](https://discuss.elastic.co/u/Ihor_Hnedysh)\
**Replies:** 8\
**Last updated:** [April 11, 2012, 10:07am UTC](https://discuss.elastic.co/t/es-hangs-up-when-sending-too-much-index-requests/7121 "2012-04-11T10:07:50Z")

</div>

Good day, we have faced with the ES handing by some reason, could you please take a look in it: Elastic search configuration if the following: Can you comment this somehow? Do you need any additional…

---

## [How to deploy ECK to a custom namespace](https://discuss.elastic.co/t/how-to-deploy-eck-to-a-custom-namespace/239819)

<div class="topic-metadata">

**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\
**Replies:** 1\
**Last updated:** [July 8, 2020, 9:45am UTC](https://discuss.elastic.co/t/how-to-deploy-eck-to-a-custom-namespace/239819 "2020-07-08T09:45:45Z")

</div>

Is it possible to deploy ECK to a different k8 namespace. https://www.elastic.co/guide/en/cloud-on-k8s/1.1/k8s-deploy-eck.html kubectl apply -f https://download.elastic.co/downloads/eck/1.1.2/all-in-one.yaml So i woul…

---

## [Display multiple values as one](https://discuss.elastic.co/t/display-multiple-values-as-one/257993)

<div class="topic-metadata">

**Author:** [@Shay\_Levy](https://discuss.elastic.co/u/Shay_Levy)\
**Replies:** 4\
**Last updated:** [December 10, 2020, 12:30pm UTC](https://discuss.elastic.co/t/display-multiple-values-as-one/257993 "2020-12-10T12:30:23Z")

</div>

I'm indexing computer hardware related info, one of the fields is called Vendor. Example values of Vendor: Intel INTEL\_ HP Hewlett Packard Microsoft Microsoft Corporation And so on... I want to unify and display…

---

## [Is there any out of box use elastic search ui?](https://discuss.elastic.co/t/is-there-any-out-of-box-use-elastic-search-ui/199915)

<div class="topic-metadata">

**Author:** [@atline](https://discuss.elastic.co/u/atline)\
**Replies:** 1\
**Last updated:** [September 18, 2019, 7:00am UTC](https://discuss.elastic.co/t/is-there-any-out-of-box-use-elastic-search-ui/199915 "2019-09-18T07:00:31Z")

</div>

See this topic: Which web ui is mostly used for ElasticSearch? For user-facing applications people tend to develop their own. For logs people tend to use Kibana directly What I need is some out of box use user-facing…

---

## [Stop search if client has disconnected](https://discuss.elastic.co/t/stop-search-if-client-has-disconnected/138873)

<div class="topic-metadata">

**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\
**Replies:** 4\
**Last updated:** [July 9, 2018, 1:10am UTC](https://discuss.elastic.co/t/stop-search-if-client-has-disconnected/138873 "2018-07-09T01:10:43Z")

</div>

Is it possible to stop the search if the main HTTP connection is closed by the client? My use case: "a web-site with Nginx+php+elasticsearch, public user does a search and closes the page immediately" Nginx connection…

---

## [Timelion filter data by hour](https://discuss.elastic.co/t/timelion-filter-data-by-hour/131948)

<div class="topic-metadata">

**Author:** [@RockD](https://discuss.elastic.co/u/RockD)\
**Replies:** 4\
**Last updated:** [May 16, 2018, 1:40pm UTC](https://discuss.elastic.co/t/timelion-filter-data-by-hour/131948 "2018-05-16T13:40:30Z")

</div>

Hi, I have the following problem, I need to compare the data of the current week with the past one, but the data I have to retrieve are only the ones that are between 10:00 AM to 2:00 PM. I tried with range(), but I get…

---

## [Filtering based on results of aggregations is not supported](https://discuss.elastic.co/t/filtering-based-on-results-of-aggregations-is-not-supported/158760)

<div class="topic-metadata">

**Author:** [@cezet](https://discuss.elastic.co/u/cezet)\
**Replies:** 0\
**Last updated:** [November 29, 2018, 12:43pm UTC](https://discuss.elastic.co/t/filtering-based-on-results-of-aggregations-is-not-supported/158760 "2018-11-29T12:43:33Z")

</div>

Hi! in 2014 there was a question regarding filtering over aggregation: the answer was: Filtering based on results of aggregations is not supported unfortunately Whether filtreing based on results of aggregation possi…

---

## [Custom routing based on date range](https://discuss.elastic.co/t/custom-routing-based-on-date-range/67446)

<div class="topic-metadata">

**Author:** [@subbu.nv](https://discuss.elastic.co/u/subbu.nv)\
**Replies:** 0\
**Last updated:** [November 29, 2016, 8:24am UTC](https://discuss.elastic.co/t/custom-routing-based-on-date-range/67446 "2016-11-29T08:24:37Z")

</div>

Hi , i am currently having index names like abc\_2014, abc\_2015, abc\_2016.. etc. (index names are dynamically created at the logstash level) is there a way i can apply custom routing on index names, so that if i have …

---

## [Logstash rename json fields](https://discuss.elastic.co/t/logstash-rename-json-fields/325399)

<div class="topic-metadata">

**Author:** [@yilmazbuhar](https://discuss.elastic.co/u/yilmazbuhar)\
**Replies:** 6\
**Last updated:** [February 15, 2023, 9:24pm UTC](https://discuss.elastic.co/t/logstash-rename-json-fields/325399 "2023-02-15T21:24:05Z")

</div>

Hi community, We have a json log as below { "Timestamp": "2023-02-09T17:41:54.5320239+03:00", "Level": "", "MessageTemplate": "", "Properties": { "responsetime": 4758, "SourceContext": "", "Username…

---

## [Incorrect Postgres Timestamp with Filebeat & ES](https://discuss.elastic.co/t/incorrect-postgres-timestamp-with-filebeat-es/280152)

<div class="topic-metadata">

**Author:** [@kellizer](https://discuss.elastic.co/u/kellizer)\
**Replies:** 6\
**Last updated:** [August 2, 2021, 5:24pm UTC](https://discuss.elastic.co/t/incorrect-postgres-timestamp-with-filebeat-es/280152 "2021-08-02T17:24:00Z")

</div>

I've been knocking my head on this one for days and can't seem to debug what is happening.. I've setup the filebeat module to stream postgres-13 csv logs into ES - everything works great except the time is out of sync (c…

---

## [Packetbeat Rare DNS Questions ML Job Customization](https://discuss.elastic.co/t/packetbeat-rare-dns-questions-ml-job-customization/247548)

<div class="topic-metadata">

**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Replies:** 6\
**Last updated:** [September 29, 2020, 10:31am UTC](https://discuss.elastic.co/t/packetbeat-rare-dns-questions-ml-job-customization/247548 "2020-09-29T10:31:11Z")

</div>

Hello, I have an issue with the packetbeat rare dns question ml job, which generates quite a bit of anomalies due to the fact that our hosts are frequently contacting \*.avqs.mcafee.com url's, which have a random part. F…

---

## [IP-Filtering API not showing rulesets](https://discuss.elastic.co/t/ip-filtering-api-not-showing-rulesets/205644)

<div class="topic-metadata">

**Author:** [@logger](https://discuss.elastic.co/u/logger)\
**Replies:** 6\
**Last updated:** [October 31, 2019, 7:26pm UTC](https://discuss.elastic.co/t/ip-filtering-api-not-showing-rulesets/205644 "2019-10-31T19:26:11Z")

</div>

Hi there, I am currently trying to script a few things for our ECE. Right now I am hurdling with the API for IP-filtering. curl -k -X GET -H "Authorization: Bearer mytoken" https://localhost:12443/api/v1/deployments/…

---

## [Issue with Timelion](https://discuss.elastic.co/t/issue-with-timelion/168406)

<div class="topic-metadata">

**Author:** [@Alvaro\_Garrido](https://discuss.elastic.co/u/Alvaro_Garrido)\
**Replies:** 6\
**Last updated:** [February 21, 2019, 8:37pm UTC](https://discuss.elastic.co/t/issue-with-timelion/168406 "2019-02-21T20:37:02Z")

</div>

Is it normal if I am able to see the documents I recently created in Elasticsearch in the Discover tab, but it is not to graph the parameters in Timelion? I can see these fields in Kibana Visualize graphs, though. Syste…

---

## [How i can convert the given SQl query to dsl query?](https://discuss.elastic.co/t/how-i-can-convert-the-given-sql-query-to-dsl-query/333878)

<div class="topic-metadata">

**Author:** [@babu\_dev](https://discuss.elastic.co/u/babu_dev)\
**Replies:** 2\
**Last updated:** [May 22, 2023, 7:58am UTC](https://discuss.elastic.co/t/how-i-can-convert-the-given-sql-query-to-dsl-query/333878 "2023-05-22T07:58:49Z")

</div>

Sql query SELECT \* FROM USER\_DB WHERE (NAME IN('BABU DEV', 'NIKHIL') OR AGE IN(23,45)) AND COUNTRY = 'INDIA' AND STATE ='DELHI';

---

## [Multiple log entries in filebeat each with its id and multiple processors](https://discuss.elastic.co/t/multiple-log-entries-in-filebeat-each-with-its-id-and-multiple-processors/314987)

<div class="topic-metadata">

**Author:** [@erwin339](https://discuss.elastic.co/u/erwin339)\
**Replies:** 2\
**Last updated:** [September 23, 2022, 6:41pm UTC](https://discuss.elastic.co/t/multiple-log-entries-in-filebeat-each-with-its-id-and-multiple-processors/314987 "2022-09-23T18:41:42Z")

</div>

I am trying to configure filebeat so that it obtains logs from a server which is running 3 applications, the most logical thing is that each one has its id as a reference, for this configure 3 entries with its specific p…

---

## [Exactly-once guarantee for Spark Structured Streaming](https://discuss.elastic.co/t/exactly-once-guarantee-for-spark-structured-streaming/200746)

<div class="topic-metadata">

**Author:** [@danielyahn](https://discuss.elastic.co/u/danielyahn)\
**Replies:** 2\
**Last updated:** [September 23, 2019, 9:07pm UTC](https://discuss.elastic.co/t/exactly-once-guarantee-for-spark-structured-streaming/200746 "2019-09-23T21:07:49Z")

</div>

The following blog that @james.baiera wrote says, Users of ES-Hadoop can specify one of their fields to be used as the document’s ID, and Elasticsearch manages ID based writes consistently. We can’t know ahead of time …

---

## [Alternative solution to composite aggregation in java high level rest client](https://discuss.elastic.co/t/alternative-solution-to-composite-aggregation-in-java-high-level-rest-client/165034)

<div class="topic-metadata">

**Author:** [@Mahendra\_Shinde](https://discuss.elastic.co/u/Mahendra_Shinde)\
**Replies:** 2\
**Last updated:** [January 30, 2019, 10:20am UTC](https://discuss.elastic.co/t/alternative-solution-to-composite-aggregation-in-java-high-level-rest-client/165034 "2019-01-30T10:20:02Z")

</div>

Hi, I am trying to solve one performance problem in our elasticsearch use case. Best solution is composite aggregations. But Composite aggregations not available in java high level rest client. Is there any alternative…

---

## [Multiline in TCP input](https://discuss.elastic.co/t/multiline-in-tcp-input/161279)

<div class="topic-metadata">

**Author:** [@elmar.vonlanthen](https://discuss.elastic.co/u/elmar.vonlanthen)\
**Replies:** 2\
**Last updated:** [January 8, 2019, 7:12am UTC](https://discuss.elastic.co/t/multiline-in-tcp-input/161279 "2019-01-08T07:12:17Z")

</div>

Hello I am wondering, if it is possible to use multiline parsing in TCP input. In my tests it is not working. But in UDP input, multiline parsing is working (but not recommended). Filebeat version: 6.5.3 OS: CentOS 7.…

---

## [Pipeline processor script error](https://discuss.elastic.co/t/pipeline-processor-script-error/149508)

<div class="topic-metadata">

**Author:** [@vvelichkovich](https://discuss.elastic.co/u/vvelichkovich)\
**Replies:** 2\
**Last updated:** [September 24, 2018, 4:33pm UTC](https://discuss.elastic.co/t/pipeline-processor-script-error/149508 "2018-09-24T16:33:14Z")

</div>

I have pipeline script that seams it works fine when I script it from Kibana, and it looks like this: PUT \_ingest/pipeline/vv\_test { "description": "changing NaN", "processors": \[ { "script": { "source": """ if(…

---

## [.keyword columns empty in "Discover"](https://discuss.elastic.co/t/keyword-columns-empty-in-discover/108531)

<div class="topic-metadata">

**Author:** [@sspilleman](https://discuss.elastic.co/u/sspilleman)\
**Replies:** 2\
**Last updated:** [November 21, 2017, 8:03pm UTC](https://discuss.elastic.co/t/keyword-columns-empty-in-discover/108531 "2017-11-21T20:03:22Z")

</div>

Hi, I'm indexing quite a few text mappings to alse have a .keyword couterpart with type keyword. Like: "country": { "type": "text", "fields": { "keyword": { "type"…

---

## [Can't parse a CSV file - message is coming through though](https://discuss.elastic.co/t/cant-parse-a-csv-file-message-is-coming-through-though/96855)

<div class="topic-metadata">

**Author:** [@dorj1234](https://discuss.elastic.co/u/dorj1234)\
**Replies:** 2\
**Last updated:** [August 14, 2017, 4:41am UTC](https://discuss.elastic.co/t/cant-parse-a-csv-file-message-is-coming-through-though/96855 "2017-08-14T04:41:03Z")

</div>

update - problem solved, explanations in the replies section Hi, I am using the conf file below to parse a csv. I cannot get the message to populate into the fields that are mapped. Instead I see the message in kibana,…

---

## [Netflow codec: No matching template](https://discuss.elastic.co/t/netflow-codec-no-matching-template/80150)

<div class="topic-metadata">

**Author:** [@prodrg](https://discuss.elastic.co/u/prodrg)\
**Replies:** 2\
**Last updated:** [March 27, 2017, 7:15pm UTC](https://discuss.elastic.co/t/netflow-codec-no-matching-template/80150 "2017-03-27T19:15:15Z")

</div>

Hello everybody, I'm receiving the following issues from the Netflow codec in logstash: \[2017-03-27T09:40:00,696\]\[WARN \]\[logstash.codecs.netflow \] No matching template for flow id 256 \[2017-03-27T09:40:00,707\]\[WARN …

---

## [Is it possible to use regex expressions on long fields?](https://discuss.elastic.co/t/is-it-possible-to-use-regex-expressions-on-long-fields/78899)

<div class="topic-metadata">

**Author:** [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\
**Replies:** 2\
**Last updated:** [March 16, 2017, 6:45pm UTC](https://discuss.elastic.co/t/is-it-possible-to-use-regex-expressions-on-long-fields/78899 "2017-03-16T18:45:14Z")

</div>

I have long field in my mapping . the field has some values but in that i want the documents of long field that has 130 (i.e i want all the documents that has the long field starting with 130) . Like below Scenario: D…

---

## [message=\>"Failed parsing date from field", :field=\>"timestamp", :value=\>"2016-09-14 15:43:48.258000", :exception=\>"Invalid format: \\"2016-09-14 15:43:48.258000\\"",](https://discuss.elastic.co/t/message-failed-parsing-date-from-field-field-timestamp-value-2016-09-14-15-43-48-258000-exception-invalid-format-2016-09-14-15-43-48-258000/60528)

<div class="topic-metadata">

**Author:** [@gentitope](https://discuss.elastic.co/u/gentitope)\
**Replies:** 2\
**Last updated:** [September 15, 2016, 8:43am UTC](https://discuss.elastic.co/t/message-failed-parsing-date-from-field-field-timestamp-value-2016-09-14-15-43-48-258000-exception-invalid-format-2016-09-14-15-43-48-258000/60528 "2016-09-15T08:43:34Z")

</div>

Hello, I have this error, {:timestamp=\>"2016-09-14T16:43:48.937000+0100", :message=\>"Failed parsing date from field", :field=\>"timestamp", :value=\>"2016-09-14 15:43:48.258000", :exception=\>"Invalid format: \\"2016-09-14…

---

## [Taking Snapshot in local repository on multiple nodes not having shared FS](https://discuss.elastic.co/t/taking-snapshot-in-local-repository-on-multiple-nodes-not-having-shared-fs/38779)

<div class="topic-metadata">

**Author:** [@Ashish\_Goel](https://discuss.elastic.co/u/Ashish_Goel)\
**Replies:** 2\
**Last updated:** [January 14, 2016, 1:25pm UTC](https://discuss.elastic.co/t/taking-snapshot-in-local-repository-on-multiple-nodes-not-having-shared-fs/38779 "2016-01-14T13:25:53Z")

</div>

Hi there, I have placed my cluster nodes on EC2 instances and when I try to take a snapshot on a local FS repository, it gives an error saying that the target location for snapshot is not shared. Then, I made use of a…

---

## [LSF has been deprecated in favour of Filebeat](https://discuss.elastic.co/t/lsf-has-been-deprecated-in-favour-of-filebeat/38696)

<div class="topic-metadata">

**Author:** [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Replies:** 2\
**Last updated:** [January 8, 2016, 7:39am UTC](https://discuss.elastic.co/t/lsf-has-been-deprecated-in-favour-of-filebeat/38696 "2016-01-08T07:39:33Z")

</div>

The Logstash Forwarder is being retired and replaced with Filebeat. Filebeat has improved functionality, including the ability to ship to multiple different outputs such as directly to Elasticsearch or to Logstash, b…

---

## [Parse date error](https://discuss.elastic.co/t/parse-date-error/107962)

<div class="topic-metadata">

**Author:** [@Luc](https://discuss.elastic.co/u/Luc)\
**Replies:** 1\
**Last updated:** [November 24, 2017, 6:01pm UTC](https://discuss.elastic.co/t/parse-date-error/107962 "2017-11-24T18:01:16Z")

</div>

Executing the query: { "query": { "bool": { "must": \[ { "match": { "foo": "pattern" } }, { "range": { "@timestamp": { "gte": "bar.start\_time", "format…

[Previous page](https://discuss.elastic.co/top.md?page=1230&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1232&per_page=50&period=all)