# Top

**URL:** https://discuss.elastic.co/top.md?page=1234&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1235

---

## [Template inheritance: non-dynamic mappings](https://discuss.elastic.co/t/template-inheritance-non-dynamic-mappings/204306)

<div class="topic-metadata">

**Author:** [@jesus\_1](https://discuss.elastic.co/u/jesus_1)\
**Replies:** 2\
**Last updated:** [October 19, 2019, 12:15pm UTC](https://discuss.elastic.co/t/template-inheritance-non-dynamic-mappings/204306 "2019-10-19T12:15:14Z")

</div>

Hi, Using ES 7.0.0. I've been looking for docs/posts about this, but most info is very old or not clear, and after playing around with it I don't understand how it should work. I have different indexes that have a comm…

---

## [Kibana SAML Session TimeOut](https://discuss.elastic.co/t/kibana-saml-session-timeout/186297)

<div class="topic-metadata">

**Author:** [@SRE1](https://discuss.elastic.co/u/SRE1)\
**Replies:** 2\
**Last updated:** [June 19, 2019, 1:17pm UTC](https://discuss.elastic.co/t/kibana-saml-session-timeout/186297 "2019-06-19T13:17:25Z")

</div>

I have SAML configured between a hosted Kibana cluster, ElasticSearch Cloud, and AzureAD. Authentication works perfect but, if a user has a dashboard open and set to auto-refresh, they are logged out after 20 minutes. I…

---

## [Logstash's grok GREEDYDATA pattern takes word before it starts](https://discuss.elastic.co/t/logstashs-grok-greedydata-pattern-takes-word-before-it-starts/170973)

<div class="topic-metadata">

**Author:** [@Marko\_Todoric](https://discuss.elastic.co/u/Marko_Todoric)\
**Replies:** 2\
**Last updated:** [March 6, 2019, 5:22pm UTC](https://discuss.elastic.co/t/logstashs-grok-greedydata-pattern-takes-word-before-it-starts/170973 "2019-03-06T17:22:14Z")

</div>

Hello everyone, I've been modifying GROK patterns for postfix from GitHub - ActionScripted/elastic-kibana-postfix: Kibana dashboards, visualizations and searches for Postfix so that it can include "warning" from postfi…

---

## [How to edit the legends in kibana?](https://discuss.elastic.co/t/how-to-edit-the-legends-in-kibana/152991)

<div class="topic-metadata">

**Author:** [@pramodchoudhari](https://discuss.elastic.co/u/pramodchoudhari)\
**Replies:** 2\
**Last updated:** [October 19, 2018, 9:17am UTC](https://discuss.elastic.co/t/how-to-edit-the-legends-in-kibana/152991 "2018-10-19T09:17:37Z")

</div>

I want to edit the names of legends in the following visualization. this is how my visualization looks like. This is how my Filter looks :- filter { if \[fields\]\[log\_type\] == "syslog" { grok { match =\> { …

---

## [Latest centos AMI stuck initializing on boot](https://discuss.elastic.co/t/latest-centos-ami-stuck-initializing-on-boot/141623)

<div class="topic-metadata">

**Author:** [@tarp](https://discuss.elastic.co/u/tarp)\
**Replies:** 2\
**Last updated:** [July 27, 2018, 1:42pm UTC](https://discuss.elastic.co/t/latest-centos-ami-stuck-initializing-on-boot/141623 "2018-07-27T13:42:34Z")

</div>

Hi, I'm testing out building my ECE cluster at AWS, I'm using the centos AMI from July 16th, ami-6b5a6314. The EC2's are hung and I don't even get a network to login to. From the AWS system console is the following. …

---

## [Standard Deviation in Timelion](https://discuss.elastic.co/t/standard-deviation-in-timelion/131885)

<div class="topic-metadata">

**Author:** [@devika\_sudheer](https://discuss.elastic.co/u/devika_sudheer)\
**Replies:** 2\
**Last updated:** [May 15, 2018, 3:57pm UTC](https://discuss.elastic.co/t/standard-deviation-in-timelion/131885 "2018-05-15T15:57:40Z")

</div>

Hi Is it possible to use Standard Deviation as aggregation in Timelion. I know we can create it in line visualization. But I am using timelion. Is there any way to do the same in Timelion. I am not interested in moving …

---

## [Use information of first line in the rest of the file](https://discuss.elastic.co/t/use-information-of-first-line-in-the-rest-of-the-file/83115)

<div class="topic-metadata">

**Author:** [@thix](https://discuss.elastic.co/u/thix)\
**Replies:** 2\
**Last updated:** [April 26, 2017, 3:25pm UTC](https://discuss.elastic.co/t/use-information-of-first-line-in-the-rest-of-the-file/83115 "2017-04-26T15:25:22Z")

</div>

Hi, everyone. First of all I'd like to do two things: Apologize to all about my bad English. Congratulate you about this amazing project (ELK). My case is.... I have millions of text files with the following s…

---

## [\[SOLVED\] Visualize and raw field](https://discuss.elastic.co/t/solved-visualize-and-raw-field/49530)

<div class="topic-metadata">

**Author:** [@axelfelix](https://discuss.elastic.co/u/axelfelix)\
**Replies:** 2\
**Last updated:** [May 10, 2016, 11:49am UTC](https://discuss.elastic.co/t/solved-visualize-and-raw-field/49530 "2016-05-10T11:49:09Z")

</div>

Hi all, I have a mapping like below: "properties" : { "@source\_host" : { "type" : "string", "analyzer" : "custom-analyzer", "fields" : { "raw" : { …

---

## [Error parsing json but data still thrown to elastic](https://discuss.elastic.co/t/error-parsing-json-but-data-still-thrown-to-elastic/328922)

<div class="topic-metadata">

**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\
**Replies:** 5\
**Last updated:** [March 31, 2023, 4:03am UTC](https://discuss.elastic.co/t/error-parsing-json-but-data-still-thrown-to-elastic/328922 "2023-03-31T04:03:40Z")

</div>

Hi there, i want to ask about this error. anyone know what this error is trying to tell ? exception=\>java.lang.ClassCastException: class org.jruby.RubyHash cannot be cast to class org.jruby.RubyIO (org.jruby.RubyHash a…

---

## [Kibana v7.1.0 docker image error "Kibana did not load properly. Check the server output for more information."](https://discuss.elastic.co/t/kibana-v7-1-0-docker-image-error-kibana-did-not-load-properly-check-the-server-output-for-more-information/184561)

<div class="topic-metadata">

**Author:** [@gauravsachan07](https://discuss.elastic.co/u/gauravsachan07)\
**Replies:** 5\
**Last updated:** [June 7, 2019, 5:15am UTC](https://discuss.elastic.co/t/kibana-v7-1-0-docker-image-error-kibana-did-not-load-properly-check-the-server-output-for-more-information/184561 "2019-06-07T05:15:22Z")

</div>

I deployed the kibana and elastic search docker images (v7.1.0) on server but I am not able to access Kibana. I am getting below error when I try http://hostname:5601 From firefox (v 67.0.1) From Chrome (v 74.0.3729.…

---

## [Optimal Memory allocation for Single Read Only, Single Shard index](https://discuss.elastic.co/t/optimal-memory-allocation-for-single-read-only-single-shard-index/31532)

<div class="topic-metadata">

**Author:** [@mgvarley](https://discuss.elastic.co/u/mgvarley)\
**Replies:** 5\
**Last updated:** [October 6, 2015, 8:38am UTC](https://discuss.elastic.co/t/optimal-memory-allocation-for-single-read-only-single-shard-index/31532 "2015-10-06T08:38:37Z")

</div>

Hi - I have a very simple index that I want to optimise for search speed. It is a 23gb read-only index - queries are randomly distributed across all documents (i.e. there are no real hot spots) and with the vast majorit…

---

## [Search xpack users](https://discuss.elastic.co/t/search-xpack-users/115698)

<div class="topic-metadata">

**Author:** [@jchannon](https://discuss.elastic.co/u/jchannon)\
**Replies:** 4\
**Last updated:** [January 16, 2018, 12:11pm UTC](https://discuss.elastic.co/t/search-xpack-users/115698 "2018-01-16T12:11:01Z")

</div>

I can't use POST /\_xpack/security/user/\_search {} as that thinks I'm trying to add a new user. What is the API to search users?

---

## [Winlogbeat delayed data shipping](https://discuss.elastic.co/t/winlogbeat-delayed-data-shipping/183176)

<div class="topic-metadata">

**Author:** [@Alessio\_Creo](https://discuss.elastic.co/u/Alessio_Creo)\
**Replies:** 4\
**Last updated:** [May 30, 2019, 7:54pm UTC](https://discuss.elastic.co/t/winlogbeat-delayed-data-shipping/183176 "2019-05-30T19:54:33Z")

</div>

Hi there, I'm collecting security register data from Active Directory dedicated Windows Server 2012 host, that pass via Logstash and finally land in ES. After the week-end I've a found an huge delay of 15 hours between …

---

## [How to connect to Coordinating nodes from High level rest client](https://discuss.elastic.co/t/how-to-connect-to-coordinating-nodes-from-high-level-rest-client/168634)

<div class="topic-metadata">

**Author:** [@Sashi](https://discuss.elastic.co/u/Sashi)\
**Replies:** 4\
**Last updated:** [February 21, 2019, 8:06pm UTC](https://discuss.elastic.co/t/how-to-connect-to-coordinating-nodes-from-high-level-rest-client/168634 "2019-02-21T20:06:34Z")

</div>

Hello, I have a cluster with 9 nodes (3 master, 3 data and 3 client) ES version 6.4 I want my application to send all writes to data nodes and search to client nodes in a round robin fashion. We are using High level re…

---

## [CPU 100% after upgrading from 5.6.5 to 6.4.0](https://discuss.elastic.co/t/cpu-100-after-upgrading-from-5-6-5-to-6-4-0/148462)

<div class="topic-metadata">

**Author:** [@steno](https://discuss.elastic.co/u/steno)\
**Replies:** 4\
**Last updated:** [September 26, 2018, 6:54am UTC](https://discuss.elastic.co/t/cpu-100-after-upgrading-from-5-6-5-to-6-4-0/148462 "2018-09-26T06:54:21Z")

</div>

Hi there! After upgrading from 5.6.5 to 6.4.0 we are facing random CPU usage to 100% on elasticsearch java process. It happens when executing some queries from Kibana. But it's difficult to understand it from elasticsea…

---

## [Markdown and query](https://discuss.elastic.co/t/markdown-and-query/132991)

<div class="topic-metadata">

**Author:** [@RickT](https://discuss.elastic.co/u/RickT)\
**Replies:** 4\
**Last updated:** [May 23, 2018, 4:11pm UTC](https://discuss.elastic.co/t/markdown-and-query/132991 "2018-05-23T16:11:19Z")

</div>

hi, is it possible to code query in markdown visualize ? Actually, i'm coding url markdown to load a new dashboard, like this \>\>\> \[\*\*Jobs\*\*\] (http://localhost:5601/app/kibana#/dashboard/AAABBBCCCZZZ) it's correct but …

---

## [Collector timeouts and high CPU utilization after installing X-Pack](https://discuss.elastic.co/t/collector-timeouts-and-high-cpu-utilization-after-installing-x-pack/108678)

<div class="topic-metadata">

**Author:** [@mbsj](https://discuss.elastic.co/u/mbsj)\
**Replies:** 4\
**Last updated:** [November 28, 2017, 9:28am UTC](https://discuss.elastic.co/t/collector-timeouts-and-high-cpu-utilization-after-installing-x-pack/108678 "2017-11-28T09:28:56Z")

</div>

I have installed X-Pack to Kibana, LogStash and Elasticsearch and generally it working fine (all version 6.0). However, i do have some issues in elasticseach. When looking in the logs i get a lot of these errors: \[2017…

---

## [Sorting on nested fields containing null values in elasticsearch](https://discuss.elastic.co/t/sorting-on-nested-fields-containing-null-values-in-elasticsearch/193544)

<div class="topic-metadata">

**Author:** [@sakshi\_malik](https://discuss.elastic.co/u/sakshi_malik)\
**Replies:** 0\
**Last updated:** [August 2, 2019, 1:40pm UTC](https://discuss.elastic.co/t/sorting-on-nested-fields-containing-null-values-in-elasticsearch/193544 "2019-08-02T13:40:21Z")

</div>

I am trying to sort on nested field in elasticsearch, but it is always showing docs with null valued nested field at the top of the sorted list while sorting in ascending order. I want to sort (in ascending as well as de…

---

## [Oauth2 proxy and kibana authentication](https://discuss.elastic.co/t/oauth2-proxy-and-kibana-authentication/311840)

<div class="topic-metadata">

**Author:** [@crimson\_riot](https://discuss.elastic.co/u/crimson_riot)\
**Replies:** 1\
**Last updated:** [August 10, 2022, 2:51pm UTC](https://discuss.elastic.co/t/oauth2-proxy-and-kibana-authentication/311840 "2022-08-10T14:51:15Z")

</div>

We are using Oauth2 reverse proxy to authenticate the users via google. We want to use a static username and password from kibana+elasticsearch once the user gets authenticate via google so that we dont have to add or de…

---

## [How to use filename as index wiht beats input](https://discuss.elastic.co/t/how-to-use-filename-as-index-wiht-beats-input/128467)

<div class="topic-metadata">

**Author:** [@terminaattori](https://discuss.elastic.co/u/terminaattori)\
**Replies:** 1\
**Last updated:** [April 18, 2018, 8:29am UTC](https://discuss.elastic.co/t/how-to-use-filename-as-index-wiht-beats-input/128467 "2018-04-18T08:29:48Z")

</div>

Hey! How can I use the filename as an index when using beats input for multiple files? My filebeat.yml looks currently like this: filebeat.prospectors: - type: log paths: - /path/${CURRENT\_SERVER}/\*log\* fields…

---

## [Exception when there are duplicate words in search query](https://discuss.elastic.co/t/exception-when-there-are-duplicate-words-in-search-query/119791)

<div class="topic-metadata">

**Author:** [@Sachini\_Perera](https://discuss.elastic.co/u/Sachini_Perera)\
**Replies:** 1\
**Last updated:** [February 14, 2018, 1:12pm UTC](https://discuss.elastic.co/t/exception-when-there-are-duplicate-words-in-search-query/119791 "2018-02-14T13:12:40Z")

</div>

{"error":{"root\_cause":\[{"type":"parsing\_exception","reason":"\[terms\] query does not support \[0\] within lookup element","line":1,"col":150}\],"type":"parsing\_exception","reason":"\[terms\] query does not support \[0\] withi…

---

## [Hide Filter bar in an iframe](https://discuss.elastic.co/t/hide-filter-bar-in-an-iframe/96950)

<div class="topic-metadata">

**Author:** [@Luke\_Varley](https://discuss.elastic.co/u/Luke_Varley)\
**Replies:** 1\
**Last updated:** [August 14, 2017, 12:48pm UTC](https://discuss.elastic.co/t/hide-filter-bar-in-an-iframe/96950 "2017-08-14T12:48:27Z")

</div>

Hi, I’ve embedded a dashboard on my intranet and I would like to hide the filter bar (little grey bar which has “Add a filter+”) that from my users, is this possible?

---

## [Location of logstash.yml using brew?](https://discuss.elastic.co/t/location-of-logstash-yml-using-brew/72398)

<div class="topic-metadata">

**Author:** [@scheung38](https://discuss.elastic.co/u/scheung38)\
**Replies:** 1\
**Last updated:** [January 22, 2017, 7:53pm UTC](https://discuss.elastic.co/t/location-of-logstash-yml-using-brew/72398 "2017-01-22T19:53:50Z")

</div>

Hi I am a new user to logstash but could not work out where to put logstash.yml? $brew install logstash Am I supposed to generate this file?

---

## [Enabling http & https connections to elastic](https://discuss.elastic.co/t/enabling-http-https-connections-to-elastic/276141)

<div class="topic-metadata">

**Author:** [@jdswifty](https://discuss.elastic.co/u/jdswifty)\
**Replies:** 2\
**Last updated:** [June 17, 2021, 1:17am UTC](https://discuss.elastic.co/t/enabling-http-https-connections-to-elastic/276141 "2021-06-17T01:17:36Z")

</div>

Running Elasticsearch 7.11 & getting towards the end of a piece of work to enable TLS across the platform I'm now at the point i need to enable tls on the http connections for the ingest nodes but I need to be able to s…

---

## [“No results match your search criteria”](https://discuss.elastic.co/t/no-results-match-your-search-criteria/274043)

<div class="topic-metadata">

**Author:** [@sosogh](https://discuss.elastic.co/u/sosogh)\
**Replies:** 2\
**Last updated:** [May 27, 2021, 2:05am UTC](https://discuss.elastic.co/t/no-results-match-your-search-criteria/274043 "2021-05-27T02:05:51Z")

</div>

The timestamp format in the original log is "2021-05-26 18:00:00". I use fluentd to "modify" it to "2021-05-26T18:00:00.000Z" , supply it as the value of key "fulltime" , and then send it to ES. When creating index …

---

## [Logstash could not index event to Elasticsearch](https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch/228930)

<div class="topic-metadata">

**Author:** [@S3l3ct3d](https://discuss.elastic.co/u/S3l3ct3d)\
**Replies:** 2\
**Last updated:** [April 20, 2020, 9:05pm UTC](https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch/228930 "2020-04-20T21:05:03Z")

</div>

Good afternoon all, I want to preface this post that I am completely new to Elastic and all its components. I am currently working on getting Logstash to produce an API call to our web proxy server. I have searched the …

---

## [Creating tabs in Kibana Dashboard 6.6.2](https://discuss.elastic.co/t/creating-tabs-in-kibana-dashboard-6-6-2/218542)

<div class="topic-metadata">

**Author:** [@Stephy\_Jacob](https://discuss.elastic.co/u/Stephy_Jacob)\
**Replies:** 2\
**Last updated:** [February 12, 2020, 2:04pm UTC](https://discuss.elastic.co/t/creating-tabs-in-kibana-dashboard-6-6-2/218542 "2020-02-12T14:04:41Z")

</div>

Hi, I have a scenario where I need to toggle between two tabs in a Kibana dashboard. As an eg: if you see the below dashboard (which is not developed in Kibana) they are able to toggle between two tabs, Country/Region …

---

## [Logstash - csv parsing failure](https://discuss.elastic.co/t/logstash-csv-parsing-failure/195415)

<div class="topic-metadata">

**Author:** [@cheriemilk](https://discuss.elastic.co/u/cheriemilk)\
**Replies:** 2\
**Last updated:** [August 16, 2019, 8:52pm UTC](https://discuss.elastic.co/t/logstash-csv-parsing-failure/195415 "2019-08-16T20:52:22Z")

</div>

Hi Team, I have below data in a csv file which has two columns only. As you see, the content in msg columns actually are a few of key-vlaue pairs, and I want logstash to parse these key-value pairs as well. indent pre…

---

## [Logstash Email error : email - Something happen while delivering an email {:exception=\>#\<Net::SMTPAuthenticationError: Must issue a STARTTLS command first](https://discuss.elastic.co/t/logstash-email-error-email-something-happen-while-delivering-an-email-exception-net-must-issue-a-starttls-command-first/191861)

<div class="topic-metadata">

**Author:** [@irobot678](https://discuss.elastic.co/u/irobot678)\
**Replies:** 2\
**Last updated:** [July 24, 2019, 11:40am UTC](https://discuss.elastic.co/t/logstash-email-error-email-something-happen-while-delivering-an-email-exception-net-must-issue-a-starttls-command-first/191861 "2019-07-24T11:40:48Z")

</div>

Hi , I am using elk stack of version 7.1.1 + X-pack on unbuntu 14.04 . i want to trigger a alert whenever the message contains "Exception " keyword in it. logstash.yml input { file { path =\> "/home/a.log" s…

---

## [MongoDB failed to send event](https://discuss.elastic.co/t/mongodb-failed-to-send-event/179266)

<div class="topic-metadata">

**Author:** [@gx0s](https://discuss.elastic.co/u/gx0s)\
**Replies:** 2\
**Last updated:** [May 2, 2019, 2:04pm UTC](https://discuss.elastic.co/t/mongodb-failed-to-send-event/179266 "2019-05-02T14:04:47Z")

</div>

Hi, I am getting this error on logstash \[WARN \] 2019-05-01 23:01:42.484 \[\[main\]\>worker1\] mongodb - Failed to send event to MongoDB, retrying in 3 seconds {:event=\>#LogStash::Event:0x527d46ff, :exception=\>java.lang.Null…

---

## [日本語版のWordNetを連携させる方法](https://discuss.elastic.co/t/wordnet/133403)

<div class="topic-metadata">

**Author:** [@Tarou\_Tanaka](https://discuss.elastic.co/u/Tarou_Tanaka)\
**Replies:** 2\
**Last updated:** [June 8, 2018, 5:01am UTC](https://discuss.elastic.co/t/wordnet/133403 "2018-06-08T05:01:32Z")

</div>

私は今、elasticsearchとWebアプリケーションを使って、日本語の全文検索システムを作っています。 そこで入力された単語の類義語も文章から検索できるようにしたいと思いました。 そこでWordnetをElasticSearchと連携させて、類義語検索を実装するのが良い方法だと考えました。 しかしこの連携をさせる良い方法が思いつきません。 私が調べた限りだと ElasticSearch with WordNet このリ…

---

## [Custom beats for statsd-like behavior (Python)](https://discuss.elastic.co/t/custom-beats-for-statsd-like-behavior-python/88914)

<div class="topic-metadata">

**Author:** [@smlbiobot](https://discuss.elastic.co/u/smlbiobot)\
**Replies:** 2\
**Last updated:** [June 12, 2017, 9:49am UTC](https://discuss.elastic.co/t/custom-beats-for-statsd-like-behavior-python/88914 "2017-06-12T09:49:28Z")

</div>

Hi— I came across your product: elastic search + beats and wonder if I can use it to do something similar to what I used to do with statsd and datadog. I looked into statsd + Graphite originally but it seems over-compl…

---

## [Logstash kafka input consumer group not sharing partitions](https://discuss.elastic.co/t/logstash-kafka-input-consumer-group-not-sharing-partitions/77705)

<div class="topic-metadata">

**Author:** [@Maxwell\_Flanders](https://discuss.elastic.co/u/Maxwell_Flanders)\
**Replies:** 2\
**Last updated:** [March 15, 2017, 8:09pm UTC](https://discuss.elastic.co/t/logstash-kafka-input-consumer-group-not-sharing-partitions/77705 "2017-03-15T20:09:13Z")

</div>

I have a really weird case where I have a 6 logstash consumers consuming from a kafka topic using the logstash-kafka-input plugin. The 6 logstash consumers are their own logstash instances on different machines (and have…

---

## [Namespaces and EKS](https://discuss.elastic.co/t/namespaces-and-eks/291904)

<div class="topic-metadata">

**Author:** [@George\_Leonard](https://discuss.elastic.co/u/George_Leonard)\
**Replies:** 3\
**Last updated:** [December 15, 2021, 2:30pm UTC](https://discuss.elastic.co/t/namespaces-and-eks/291904 "2021-12-15T14:30:20Z")

</div>

Hi all So I see EKS creates a elastic-system namespace during the CRD creations. So question, would/should we deploy our own cluster bits into elastic-system ns... when you follow the quickstart they don't mention nam…

---

## [How to create bar chart with time intervals x axis in kibana?](https://discuss.elastic.co/t/how-to-create-bar-chart-with-time-intervals-x-axis-in-kibana/257359)

<div class="topic-metadata">

**Author:** [@Cristiane\_Marcarini](https://discuss.elastic.co/u/Cristiane_Marcarini)\
**Replies:** 3\
**Last updated:** [December 3, 2020, 6:15pm UTC](https://discuss.elastic.co/t/how-to-create-bar-chart-with-time-intervals-x-axis-in-kibana/257359 "2020-12-03T18:15:57Z")

</div>

how to create bar chart with time intervals x axis in kibana? Can be with JSON or grok.

---

## [How to install plugin with .gem file?](https://discuss.elastic.co/t/how-to-install-plugin-with-gem-file/126060)

<div class="topic-metadata">

**Author:** [@zqc0512](https://discuss.elastic.co/u/zqc0512)\
**Replies:** 3\
**Last updated:** [April 3, 2018, 3:04am UTC](https://discuss.elastic.co/t/how-to-install-plugin-with-gem-file/126060 "2018-04-03T03:04:12Z")

</div>

./logstash-plugin install file:///opt/ES/logstash-filter-ip2location-1.0.2.gem ERROR: Invalid pack for: file:///opt/ES/logstash-filter-ip2location-1.0.2.gem, reason: Invalid format, the pack must be in zip format, messa…

---

## [Compound Indexes for User Based Data](https://discuss.elastic.co/t/compound-indexes-for-user-based-data/109887)

<div class="topic-metadata">

**Author:** [@Abhinav\_Tankha](https://discuss.elastic.co/u/Abhinav_Tankha)\
**Replies:** 3\
**Last updated:** [December 4, 2017, 4:45pm UTC](https://discuss.elastic.co/t/compound-indexes-for-user-based-data/109887 "2017-12-04T16:45:01Z")

</div>

For user-based-data for which the search query will always have some user reference(eg. user-id) and additional query params is there a way to maintain compound indexes in elasticsearch to reduce the search space. For o…

---

## [Packetbeat's Dashboard issue](https://discuss.elastic.co/t/packetbeats-dashboard-issue/39724)

<div class="topic-metadata">

**Author:** [@xiaobai\_Ye](https://discuss.elastic.co/u/xiaobai_Ye)\
**Replies:** 3\
**Last updated:** [January 21, 2016, 9:45am UTC](https://discuss.elastic.co/t/packetbeats-dashboard-issue/39724 "2016-01-21T09:45:00Z")

</div>

when i use Packetbeat, i have this issue, the HTTP requests is not accurate， for example: the "Top 10 HTTP requests" is like this,in the visualize the path term became "/api" and "check\_permission"，not "GET /api/oaut…

---

## [Frustrated with REST API](https://discuss.elastic.co/t/frustrated-with-rest-api/19045)

<div class="topic-metadata">

**Author:** [@crimondi](https://discuss.elastic.co/u/crimondi)\
**Replies:** 3\
**Last updated:** [August 2, 2014, 6:28pm UTC](https://discuss.elastic.co/t/frustrated-with-rest-api/19045 "2014-08-02T18:28:11Z")

</div>

This is going to sound like a bit of a gripe session so I apologize in advance. There seems to be a lot of instability and ineffectiveness around using the REST API to make configuration changes. I realize there have…

---

## [Compare fields with an external file](https://discuss.elastic.co/t/compare-fields-with-an-external-file/172492)

<div class="topic-metadata">

**Author:** [@theo1991](https://discuss.elastic.co/u/theo1991)\
**Replies:** 6\
**Last updated:** [March 15, 2019, 9:52pm UTC](https://discuss.elastic.co/t/compare-fields-with-an-external-file/172492 "2019-03-15T21:52:58Z")

</div>

Hi everybody, I'm dealing with a problem since a few days. First, I'm unable to delete the field message in kibana. I try with mutate, or directly in the grok filter, but there's always the field in kibana after a refr…

---

## [Kibana Dashboard by default not fetching data from elastic with given hyper link](https://discuss.elastic.co/t/kibana-dashboard-by-default-not-fetching-data-from-elastic-with-given-hyper-link/136798)

<div class="topic-metadata">

**Author:** [@Guru\_swamy](https://discuss.elastic.co/u/Guru_swamy)\
**Replies:** 6\
**Last updated:** [July 2, 2018, 3:02pm UTC](https://discuss.elastic.co/t/kibana-dashboard-by-default-not-fetching-data-from-elastic-with-given-hyper-link/136798 "2018-07-02T15:02:59Z")

</div>

I have created summary dashboard, in that I have embedded with sub dashboard hyper link, when I select it or click on the link, it is not fetching data, I have to explicitly refresh it using play button or else have to c…

---

## [Duplicate fleet instances after Docker compose restart](https://discuss.elastic.co/t/duplicate-fleet-instances-after-docker-compose-restart/342039)

<div class="topic-metadata">

**Author:** [@MBender](https://discuss.elastic.co/u/MBender)\
**Replies:** 7\
**Last updated:** [August 30, 2024, 9:04am UTC](https://discuss.elastic.co/t/duplicate-fleet-instances-after-docker-compose-restart/342039 "2024-08-30T09:04:22Z")

</div>

We're using a single compose file for our on-prem Elastic Stack, which includes a fleet server as well as a default agent (currently running APM). In general, this works and starts up nicely, BUT on every restart of the…

---

## [Illegal\_argument\_exception: index.lifecycle.rollover\_alias \[actions-logs\] does not point to index \[actions-logs\]](https://discuss.elastic.co/t/illegal-argument-exception-index-lifecycle-rollover-alias-actions-logs-does-not-point-to-index-actions-logs/350916)

<div class="topic-metadata">

**Author:** [@emoxam](https://discuss.elastic.co/u/emoxam)\
**Replies:** 7\
**Last updated:** [January 14, 2024, 11:04am UTC](https://discuss.elastic.co/t/illegal-argument-exception-index-lifecycle-rollover-alias-actions-logs-does-not-point-to-index-actions-logs/350916 "2024-01-14T11:04:16Z")

</div>

Got a template with this { "index": { "lifecycle": { "name": "logstash-policy", "rollover\_alias": "actions-logs" }, "number\_of\_replicas": "0" } } Got index with name "actions-logs" But at index "actiong-logs…

---

## [Download CSV report from kibana discover of size greater than 10 MB](https://discuss.elastic.co/t/download-csv-report-from-kibana-discover-of-size-greater-than-10-mb/251801)

<div class="topic-metadata">

**Author:** [@neil12345](https://discuss.elastic.co/u/neil12345)\
**Replies:** 1\
**Last updated:** [October 13, 2020, 5:50pm UTC](https://discuss.elastic.co/t/download-csv-report-from-kibana-discover-of-size-greater-than-10-mb/251801 "2020-10-13T17:50:21Z")

</div>

Hi Team, I want to download the logs as csv report from Discover. I am using kibana@7.9.2. Can you please help me how can I get this? When I change the max file size to greater than 10 MB and I get error, even after in…

---

## [Alternative lucene query to implement rate() function in elasticsearch](https://discuss.elastic.co/t/alternative-lucene-query-to-implement-rate-function-in-elasticsearch/249143)

<div class="topic-metadata">

**Author:** [@Sankpra34](https://discuss.elastic.co/u/Sankpra34)\
**Replies:** 1\
**Last updated:** [September 21, 2020, 11:59am UTC](https://discuss.elastic.co/t/alternative-lucene-query-to-implement-rate-function-in-elasticsearch/249143 "2020-09-21T11:59:45Z")

</div>

I need to convert my PromQL query from my Grafana dashboard into Elasticsearch supported Lucene's query. Currently, there is no such function that can be used as rate() function. Is there any way to implement rate() func…

---

## [Significant terms buggy due to wrong bg\_count](https://discuss.elastic.co/t/significant-terms-buggy-due-to-wrong-bg-count/219637)

<div class="topic-metadata">

**Author:** [@Yonatan\_Omer](https://discuss.elastic.co/u/Yonatan_Omer)\
**Replies:** 7\
**Last updated:** [February 19, 2020, 3:03pm UTC](https://discuss.elastic.co/t/significant-terms-buggy-due-to-wrong-bg-count/219637 "2020-02-19T15:03:18Z")

</div>

We use significant terms to find services related to specified group of users. each user is a document, having a field 'services' which is an array of strings. The query bellow returns false report of anomalies due to …

---

## [Logstash 7.0 does ignore index\_patterns / template fields in template and overrules that with "logstash-\*"](https://discuss.elastic.co/t/logstash-7-0-does-ignore-index-patterns-template-fields-in-template-and-overrules-that-with-logstash/179341)

<div class="topic-metadata">

**Author:** [@seilre](https://discuss.elastic.co/u/seilre)\
**Replies:** 1\
**Last updated:** [May 2, 2019, 11:37am UTC](https://discuss.elastic.co/t/logstash-7-0-does-ignore-index-patterns-template-fields-in-template-and-overrules-that-with-logstash/179341 "2019-05-02T11:37:13Z")

</div>

I was using elastic stack 6.52 before and upgraded to 7.0 recently. Now it seems that my index templates are no longer updated correctly. I use the elasticsearch output plugin to install my template with following confi…

---

## [Cannot use RestHighLevelClient.performRequest() because of protected access](https://discuss.elastic.co/t/cannot-use-resthighlevelclient-performrequest-because-of-protected-access/157615)

<div class="topic-metadata">

**Author:** [@mikeg008](https://discuss.elastic.co/u/mikeg008)\
**Replies:** 1\
**Last updated:** [November 21, 2018, 2:46pm UTC](https://discuss.elastic.co/t/cannot-use-resthighlevelclient-performrequest-because-of-protected-access/157615 "2018-11-21T14:46:58Z")

</div>

I'm currently in the process of switching our system from using the TransportClient, to the RestHighLevel client. We are using the Rest Client v5.6 and following these instructions for migrating: https://www.elastic.co/…

---

## [ILM policy not applied](https://discuss.elastic.co/t/ilm-policy-not-applied/359780)

<div class="topic-metadata">

**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\
**Replies:** 5\
**Last updated:** [June 6, 2024, 8:21pm UTC](https://discuss.elastic.co/t/ilm-policy-not-applied/359780 "2024-06-06T20:21:41Z")

</div>

Hello, I have an indice that does not follow the applied lifecycle policy. Other indexes for the indice are rotating correctly. The current size of the index is over 230 GB for the primary shard. Here is the ILM co…

---

## [Settings SSL/TLS with xpack](https://discuss.elastic.co/t/settings-ssl-tls-with-xpack/127640)

<div class="topic-metadata">

**Author:** [@souf\_el\_badraoui](https://discuss.elastic.co/u/souf_el_badraoui)\
**Replies:** 5\
**Last updated:** [April 12, 2018, 4:49am UTC](https://discuss.elastic.co/t/settings-ssl-tls-with-xpack/127640 "2018-04-12T04:49:06Z")

</div>

Hello, I'm trying to set up SSL/TLS with x-pack and running into this on some nodes : \[WARN \]\[o.e.b.ElasticsearchUncaughtExceptionHandler\] uncaught exception in thread \[main\] org.elasticsearch.bootstrap.StartupExcepti…

[Previous page](https://discuss.elastic.co/top.md?page=1233&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1235&per_page=50&period=all)
