# Top **URL:** https://discuss.elastic.co/top.md?page=126&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 127 --- ## [Join Style Queries in Kibana](https://discuss.elastic.co/t/join-style-queries-in-kibana/237117)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 12\ **Last updated:** [June 24, 2020, 6:50pm UTC](https://discuss.elastic.co/t/join-style-queries-in-kibana/237117 "2020-06-24T18:50:44Z")
Hi, Can someone explain to me how I can formulate a query that: Matches documents where the message field contains "string 1" or "string 2" Where the transaction\_id is the same for all documents Thx D --- ## [How to use filebeat to collect only the day's logs](https://discuss.elastic.co/t/how-to-use-filebeat-to-collect-only-the-days-logs/269409)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 16\ **Last updated:** [April 14, 2021, 10:37am UTC](https://discuss.elastic.co/t/how-to-use-filebeat-to-collect-only-the-days-logs/269409 "2021-04-14T10:37:21Z")
I'm using filebeat to collect logs. The name of the target log is "api-yyyy-mm-dd.log". If you set the paths setting of filebeat as follows, all files will be collected. - type: log paths: - /var/log/api/api-\*.l… --- ## [Grok filter not being triggered in Logstash server](https://discuss.elastic.co/t/grok-filter-not-being-triggered-in-logstash-server/168608)
**Author:** [@Carlos\_Bodini](https://discuss.elastic.co/u/Carlos_Bodini)\ **Replies:** 16\ **Last updated:** [February 20, 2019, 2:18pm UTC](https://discuss.elastic.co/t/grok-filter-not-being-triggered-in-logstash-server/168608 "2019-02-20T14:18:52Z")
hey guys! I have a grok filter in my Logstash server for my IIS logs... but it seams the logs are not being filter by it, and there's no errors in the logstash's logs, what would happen if the problem was in the filter … --- ## [Logstash KV plugin, convert string values to timestamp](https://discuss.elastic.co/t/logstash-kv-plugin-convert-string-values-to-timestamp/99791)
**Author:** [@shashwat](https://discuss.elastic.co/u/shashwat)\ **Replies:** 11\ **Last updated:** [September 13, 2017, 4:41pm UTC](https://discuss.elastic.co/t/logstash-kv-plugin-convert-string-values-to-timestamp/99791 "2017-09-13T16:41:54Z")
Hi, I am using Logstash 5.5 to parse my logs. I have following format of the logs: time taken for doing transfer once for all files in seconds=23 transfer start time= 201708030959 transfer end time = 201708030959. I a… --- ## [Kv filter doubts](https://discuss.elastic.co/t/kv-filter-doubts/136846)
**Author:** [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\ **Replies:** 34\ **Last updated:** [August 1, 2018, 6:03am UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846 "2018-08-01T06:03:15Z")
Upon filtering the fields in kvs, can if or any other conditional statemnts be used on the keys and values. If so, how? --- ## [Partial update/add/delete of a document using java](https://discuss.elastic.co/t/partial-update-add-delete-of-a-document-using-java/169641)
**Author:** [@nikuland](https://discuss.elastic.co/u/nikuland)\ **Replies:** 10\ **Last updated:** [February 23, 2019, 6:37pm UTC](https://discuss.elastic.co/t/partial-update-add-delete-of-a-document-using-java/169641 "2019-02-23T18:37:54Z")
I would like to add/update/delete nested documents in java. If there is example can someone point me that please. Is it done only through scripts or there are api's to do dthat. --- ## [Logstash is reindexing lastline and newline](https://discuss.elastic.co/t/logstash-is-reindexing-lastline-and-newline/177120)
**Author:** [@anon73256657](https://discuss.elastic.co/u/anon73256657)\ **Replies:** 20\ **Last updated:** [April 18, 2019, 9:29am UTC](https://discuss.elastic.co/t/logstash-is-reindexing-lastline-and-newline/177120 "2019-04-18T09:29:55Z")
Hello community. I am using logstash to parse a logfile and index to elastic I have seen that if I enter a new line in the file, logstash is indexing the newline but also the last indexed line Looks like a bug an it c… --- ## [Sincedb file is being created empty](https://discuss.elastic.co/t/sincedb-file-is-being-created-empty/305912)
**Author:** [@automation\_learner](https://discuss.elastic.co/u/automation_learner)\ **Replies:** 17\ **Last updated:** [May 31, 2022, 9:29am UTC](https://discuss.elastic.co/t/sincedb-file-is-being-created-empty/305912 "2022-05-31T09:29:19Z")
when i am trying to use file input plugin to created index it is not working as sincedb file is being created empty and in logs it says discovered files count =0 also when using disable sincedb it says open file /dev/nu… --- ## [Ssl\_certificate\_validation not working](https://discuss.elastic.co/t/ssl-certificate-validation-not-working/46304)
**Author:** [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Replies:** 9\ **Last updated:** [April 12, 2016, 5:48am UTC](https://discuss.elastic.co/t/ssl-certificate-validation-not-working/46304 "2016-04-12T05:48:13Z")
ssl\_certificate\_validation =\> false is not working in HTTP\_Poller configuration. My service URL is HTTPS but there is no need to pass any certs along with the call. Hence, I wanted to skip it. Even with the above op… --- ## [Couple of issues with logstash input file :(](https://discuss.elastic.co/t/couple-of-issues-with-logstash-input-file/49585)
**Author:** [@jamesl](https://discuss.elastic.co/u/jamesl)\ **Replies:** 9\ **Last updated:** [June 8, 2016, 5:00am UTC](https://discuss.elastic.co/t/couple-of-issues-with-logstash-input-file/49585 "2016-06-08T05:00:22Z")
Hello. Got a couple of questions relating to how the input file really works. I would like to brand (change type) for certain inputs, but the system doesn't seem to be picking up my 'type' comment. I also am having troub… --- ## [Elasticsearch cluster setup on 3 nodes](https://discuss.elastic.co/t/elasticsearch-cluster-setup-on-3-nodes/207510)
**Author:** [@balamurugan\_ravi](https://discuss.elastic.co/u/balamurugan_ravi)\ **Replies:** 10\ **Last updated:** [November 15, 2019, 9:21am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-setup-on-3-nodes/207510 "2019-11-15T09:21:22Z")
I am trying to setup the elasticsearch cluster on 3 nodes with AWS ELB. docker run \\ -p 9200:9200 \\ -p 9300:9300 \\ --name es-master1 \\ -v es-master1:/usr/share/elasticsearch/data \\ -v es-master1\_… --- ## [Deploy an Elasticsearch cluster with QuickStart](https://discuss.elastic.co/t/deploy-an-elasticsearch-cluster-with-quickstart/308656)
**Author:** [@Nortena](https://discuss.elastic.co/u/Nortena)\ **Replies:** 13\ **Last updated:** [July 8, 2022, 7:03am UTC](https://discuss.elastic.co/t/deploy-an-elasticsearch-cluster-with-quickstart/308656 "2022-07-08T07:03:40Z")
I have deployed ECK in a cluster and the quickstart has stayed in the "ApplyingChanges" phase and the quickstart pods are like this: NAMESPACE NAME HEALTH NODES VERSION PHASE AGE monitorin… --- ## [Unable to install ES license](https://discuss.elastic.co/t/unable-to-install-es-license/76850)
**Author:** [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Replies:** 9\ **Last updated:** [March 6, 2017, 5:25pm UTC](https://discuss.elastic.co/t/unable-to-install-es-license/76850 "2017-03-06T17:25:15Z")
ES: v2.4.4 I recently requested a new basic license for Elasticsearch. When I attempt to install the license remotely by following the documentation, I'm either being denied permission or being prompted for the admin p… --- ## [Not able to sign in using Keycloak in Kibana](https://discuss.elastic.co/t/not-able-to-sign-in-using-keycloak-in-kibana/318435)
**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\ **Replies:** 9\ **Last updated:** [November 9, 2022, 8:23am UTC](https://discuss.elastic.co/t/not-able-to-sign-in-using-keycloak-in-kibana/318435 "2022-11-09T08:23:52Z")
Hi, I have integrated ES, Kibana with Keycloak. Both Kibana and ES are https enabled. The below are the configurations I have made in the yml files. ## elasticsearch.yml #Open ID connect settings xpack.security.authc.… --- ## [Kibana is not working](https://discuss.elastic.co/t/kibana-is-not-working/338991)
**Author:** [@Miguel2](https://discuss.elastic.co/u/Miguel2)\ **Replies:** 11\ **Last updated:** [July 26, 2023, 7:29pm UTC](https://discuss.elastic.co/t/kibana-is-not-working/338991 "2023-07-26T19:29:34Z")
Hello I'm trying to learn the ELK stack from scratch, I'm currently having problems with kibana not getting active as shown below: myuser@myuser-pc:~$ systemctl status kibana × kibana.service - Kibana Loaded: loade… --- ## [Logstash plugin install : Error socket closed](https://discuss.elastic.co/t/logstash-plugin-install-error-socket-closed/328243)
**Author:** [@Julien069](https://discuss.elastic.co/u/Julien069)\ **Replies:** 22\ **Last updated:** [April 12, 2023, 7:50am UTC](https://discuss.elastic.co/t/logstash-plugin-install-error-socket-closed/328243 "2023-04-12T07:50:09Z")
Hi , I want to install a Stormshield plugin for Logstash I tried bin/logstash-plugin install --no-verify logstash-filter-SNS I have "ERROR : Something went wrong when installalling bin/logstash-filter-SNS , message s… --- ## [Distributed tracing - HTTP calls are not shown in span](https://discuss.elastic.co/t/distributed-tracing-http-calls-are-not-shown-in-span/158302)
**Author:** [@jaks](https://discuss.elastic.co/u/jaks)\ **Replies:** 12\ **Last updated:** [November 30, 2018, 3:11am UTC](https://discuss.elastic.co/t/distributed-tracing-http-calls-are-not-shown-in-span/158302 "2018-11-30T03:11:46Z")
When I piloting elastic apm, I found that it is not showing the HTTP calls in the spans. It shows the MySQL queries but not the HTTP calls. I use microservices architecture and there are 50 services which calls other in… --- ## [How does the updating put mapping API works to \_all field?](https://discuss.elastic.co/t/how-does-the-updating-put-mapping-api-works-to--all-field/38803)
**Author:** [@Red](https://discuss.elastic.co/u/Red)\ **Replies:** 13\ **Last updated:** [January 14, 2016, 3:01am UTC](https://discuss.elastic.co/t/how-does-the-updating-put-mapping-api-works-to--all-field/38803 "2016-01-14T03:01:27Z")
does the updating post using put mapping API cause reindexing of \_all field ???? i know the field type and something could not be updated, ive updated the date format successfully. 1 so i want to know whether the u… --- ## [Elasticsearch spark very high CPU](https://discuss.elastic.co/t/elasticsearch-spark-very-high-cpu/24952)
**Author:** [@israel](https://discuss.elastic.co/u/israel)\ **Replies:** 10\ **Last updated:** [July 14, 2015, 8:30pm UTC](https://discuss.elastic.co/t/elasticsearch-spark-very-high-cpu/24952 "2015-07-14T20:30:31Z")
Hi, I have a problem with a Spark job I have created that consumes data from Kafka, write it to Cassandra and then index it to Elasticsearch. Even when there is no data streaming through kafka, the CPU load is sky high… --- ## [Client node settitng](https://discuss.elastic.co/t/client-node-settitng/40448)
**Author:** [@tianzongqi](https://discuss.elastic.co/u/tianzongqi)\ **Replies:** 11\ **Last updated:** [February 1, 2016, 2:19am UTC](https://discuss.elastic.co/t/client-node-settitng/40448 "2016-02-01T02:19:45Z")
I setting two ES nodes as client node in my ES cluster, i want the application only connect the client node for query or index. But when set client node's IP for connection, found that my application also connect t… --- ## [Запись на сервер, процессор занят на 20%](https://discuss.elastic.co/t/topic/29740)
**Author:** [@Maksym\_Seleznev](https://discuss.elastic.co/u/Maksym_Seleznev)\ **Replies:** 14\ **Last updated:** [September 23, 2015, 8:14am UTC](https://discuss.elastic.co/t/topic/29740 "2015-09-23T08:14:45Z")
пытаюсь понять почему запись на сервер забирает 20% cpu сервера, это нормально? \_nodes/hot\_threads ничего интересного не показали сервер находится в google cloud Hot threads at 2015-09-22T04:02:49.774Z, interval=500ms… --- ## [Use field value to match custom Grok pattern](https://discuss.elastic.co/t/use-field-value-to-match-custom-grok-pattern/157681)
**Author:** [@apluchart](https://discuss.elastic.co/u/apluchart)\ **Replies:** 10\ **Last updated:** [November 21, 2018, 1:33pm UTC](https://discuss.elastic.co/t/use-field-value-to-match-custom-grok-pattern/157681 "2018-11-21T13:33:07Z")
Hi, I'm trying to parse some log (from cisco ironport) and I want to use a field value to access my custom patterns. To be clear there is my actual filter : dissect { mapping =\> {"message" =\> "\<%{syslog5424pri}\>%{moi… --- ## [Elastic Search Not Running on Linux](https://discuss.elastic.co/t/elastic-search-not-running-on-linux/125316)
**Author:** [@paul1243](https://discuss.elastic.co/u/paul1243)\ **Replies:** 10\ **Last updated:** [March 23, 2018, 4:47pm UTC](https://discuss.elastic.co/t/elastic-search-not-running-on-linux/125316 "2018-03-23T16:47:43Z")
Hi, Elastic search server stops working abruptly, and throws this message in the logs: Could you please let me know what could be the reason? Thanks ! org.elasticsearch.transport.ReceiveTimeoutTransportException: \[vCc… --- ## [Out of memory issue on one node caused cluster failure?](https://discuss.elastic.co/t/out-of-memory-issue-on-one-node-caused-cluster-failure/109207)
**Author:** [@BLZB0B](https://discuss.elastic.co/u/BLZB0B)\ **Replies:** 10\ **Last updated:** [November 27, 2017, 2:48pm UTC](https://discuss.elastic.co/t/out-of-memory-issue-on-one-node-caused-cluster-failure/109207 "2017-11-27T14:48:35Z")
Hi, Came in this morning to find our pre-prod environment has spat out it's dummy over the weekend... just in time for our planned go-live on Thursday! it would appear that we lost one out of three nodes - but the rest… --- ## [How to configure ELK for geoip](https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590)
**Author:** [@root\_linux](https://discuss.elastic.co/u/root_linux)\ **Replies:** 21\ **Last updated:** [November 25, 2021, 6:50pm UTC](https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590 "2021-11-25T18:50:21Z")
Hi, I want to configure ELK stack. Elasticsearch, Kibana and Logstash will configure at one server and there will be multiple filebeat client. How can I configure for geoip? What need to configure in Elasticsearch, Kiba… --- ## [Ingest data to DataStream Through Filebeat](https://discuss.elastic.co/t/ingest-data-to-datastream-through-filebeat/364510)
**Author:** [@Debasis\_Mallick](https://discuss.elastic.co/u/Debasis_Mallick)\ **Replies:** 21\ **Last updated:** [August 20, 2024, 7:30am UTC](https://discuss.elastic.co/t/ingest-data-to-datastream-through-filebeat/364510 "2024-08-20T07:30:24Z")
Hi Team, Could you please advise how can we ingest data to data streams by using filebeat. Thanks, Debasis --- ## [Elasticsearch 2.0 aws-cloud network issue](https://discuss.elastic.co/t/elasticsearch-2-0-aws-cloud-network-issue/35385)
**Author:** [@Liran\_Shani](https://discuss.elastic.co/u/Liran_Shani)\ **Replies:** 10\ **Last updated:** [November 26, 2015, 6:36am UTC](https://discuss.elastic.co/t/elasticsearch-2-0-aws-cloud-network-issue/35385 "2015-11-26T06:36:32Z")
I use aws (VPC) for ES cluster. After upgrading fron ES 1.7.2 to ES 2.0 i have network issues -\> \[WARN \]\[transport.netty \] \[es2-data.localdomain\] exception caught on transport layer \[\[id: 0xd878a1ca, /10.111.112… --- ## [Document-level metadata (noop)](https://discuss.elastic.co/t/document-level-metadata-noop/222532)
**Author:** [@lukas-gitl](https://discuss.elastic.co/u/lukas-gitl)\ **Replies:** 9\ **Last updated:** [March 25, 2020, 1:26am UTC](https://discuss.elastic.co/t/document-level-metadata-noop/222532 "2020-03-25T01:26:59Z")
Use Case - Why document level meta data would be really handy: We store big document with lots of nested child documents, so updating a document is very expensive When a document is "synced" from a persistent data stor… --- ## [Filebeat slowness issue due to Continuously keeping 200+ open files](https://discuss.elastic.co/t/filebeat-slowness-issue-due-to-continuously-keeping-200-open-files/271876)
**Author:** [@rohitguptaggg](https://discuss.elastic.co/u/rohitguptaggg)\ **Replies:** 9\ **Last updated:** [May 10, 2021, 11:45am UTC](https://discuss.elastic.co/t/filebeat-slowness-issue-due-to-continuously-keeping-200-open-files/271876 "2021-05-10T11:45:05Z")
Hi team, Suffering with issue of filebeat (version 7.0.1) slowness.Our application is generating logs in different file locations and after reaching the log file size to 2 gb, it is generating another new file after ren… --- ## [Kibana-4.4.1 installation issue](https://discuss.elastic.co/t/kibana-4-4-1-installation-issue/43383)
**Author:** [@subodh\_kant](https://discuss.elastic.co/u/subodh_kant)\ **Replies:** 11\ **Last updated:** [March 9, 2016, 1:04pm UTC](https://discuss.elastic.co/t/kibana-4-4-1-installation-issue/43383 "2016-03-09T13:04:03Z")
Hello, I am trying to install ELK. I have already installed “elasticsearch-2.2.0” and “logstash-2.2.2” and both working fine for me. I am installing on RHEL7.1. Now I am trying to install “kibana-4.4.1”. But I am get… --- ## [5.5.3 Node stalls for no apparent reason](https://discuss.elastic.co/t/5-5-3-node-stalls-for-no-apparent-reason/119801)
**Author:** [@quintonparker](https://discuss.elastic.co/u/quintonparker)\ **Replies:** 18\ **Last updated:** [February 22, 2018, 8:18am UTC](https://discuss.elastic.co/t/5-5-3-node-stalls-for-no-apparent-reason/119801 "2018-02-22T08:18:47Z")
We're experiencing an intermittent issue for weeks/months since upgrading to elasticsearch 5.5.3 (from 5.2.x) In short, one or both elasticsearch nodes will suddenly and without no apparent warning stop accepting search… --- ## [Elasticsearch aggregation encounters circuit\_breaking\_exception](https://discuss.elastic.co/t/elasticsearch-aggregation-encounters-circuit-breaking-exception/115454)
**Author:** [@sovanghosh7](https://discuss.elastic.co/u/sovanghosh7)\ **Replies:** 13\ **Last updated:** [January 15, 2018, 4:32pm UTC](https://discuss.elastic.co/t/elasticsearch-aggregation-encounters-circuit-breaking-exception/115454 "2018-01-15T16:32:42Z")
I am using elasticsearch 6.1.1 and creating a single shard per index. The cluster settings is as follows - { "persistent": { "cluster": { "routing": { "allocation": { … --- ## [Set a filter to parses out a timestamp and uses it as the timestamp for the event](https://discuss.elastic.co/t/set-a-filter-to-parses-out-a-timestamp-and-uses-it-as-the-timestamp-for-the-event/67956)
**Author:** [@ssasporta](https://discuss.elastic.co/u/ssasporta)\ **Replies:** 11\ **Last updated:** [December 5, 2016, 10:24am UTC](https://discuss.elastic.co/t/set-a-filter-to-parses-out-a-timestamp-and-uses-it-as-the-timestamp-for-the-event/67956 "2016-12-05T10:24:27Z")
Hi, I am trying to configure logstash to parse out a field from the event and use it as timestamp. My input looks like that: \ \ \ \ \ **Author:** [@wo7387196](https://discuss.elastic.co/u/wo7387196)\ **Replies:** 10\ **Last updated:** [January 31, 2022, 6:29am UTC](https://discuss.elastic.co/t/why-agent-configuration-always-not-aplied/293846 "2022-01-31T06:29:04Z") how to apply the config ? my agent is alive --- ## [Filebeat running on remote serverand sending logs to elasticsearch but not visible on kibana](https://discuss.elastic.co/t/filebeat-running-on-remote-serverand-sending-logs-to-elasticsearch-but-not-visible-on-kibana/184265)
**Author:** [@sandra1234](https://discuss.elastic.co/u/sandra1234)\ **Replies:** 14\ **Last updated:** [June 6, 2019, 9:56pm UTC](https://discuss.elastic.co/t/filebeat-running-on-remote-serverand-sending-logs-to-elasticsearch-but-not-visible-on-kibana/184265 "2019-06-06T21:56:07Z")
Hi, i have my elastic search configured as master and data node on same machine. The filebeats installed on that machine ships logs to kibana and its indexed but when i install filebeat on the remote server , and point i… --- ## [503 Service Unavailable at search](https://discuss.elastic.co/t/503-service-unavailable-at-search/270070)
**Author:** [@Francisco\_Gomez1](https://discuss.elastic.co/u/Francisco_Gomez1)\ **Replies:** 10\ **Last updated:** [April 14, 2021, 1:54am UTC](https://discuss.elastic.co/t/503-service-unavailable-at-search/270070 "2021-04-14T01:54:13Z")
Hi, Im trying to access my cluster from the web to be able to show my index using flexmonster, at this point all goes great. I manage to connect and access all my information, the problem is that... for example i can acc… --- ## [Unable to login to Kibana using API\_KEY with restrictions](https://discuss.elastic.co/t/unable-to-login-to-kibana-using-api-key-with-restrictions/312258)
**Author:** [@Bikram\_Kundu](https://discuss.elastic.co/u/Bikram_Kundu)\ **Replies:** 12\ **Last updated:** [August 22, 2022, 12:37pm UTC](https://discuss.elastic.co/t/unable-to-login-to-kibana-using-api-key-with-restrictions/312258 "2022-08-22T12:37:58Z")
Use case: I am implementing Attribute Based Access Control as mentioned on the official blog. How can I create an API\_Key that has access to the Kibana dashboard with restricted attribute-based access control? Steps f… --- ## [Less than or equal not working logstash filter and crashing](https://discuss.elastic.co/t/less-than-or-equal-not-working-logstash-filter-and-crashing/283729)
**Author:** [@Shaiju\_Sam](https://discuss.elastic.co/u/Shaiju_Sam)\ **Replies:** 21\ **Last updated:** [September 17, 2021, 10:02am UTC](https://discuss.elastic.co/t/less-than-or-equal-not-working-logstash-filter-and-crashing/283729 "2021-09-17T10:02:19Z")
Hi Team, I'm shipping logs from windows servers using filebeat. I have created a field which shows the reponse time in milliseconds. I have created a field "Create\_Indexing\_response\_time\_ms" using grok and it works per… --- ## [Make logstash send logs via lumberjack to logstash](https://discuss.elastic.co/t/make-logstash-send-logs-via-lumberjack-to-logstash/2261)
**Author:** [@Jerry\_Hoffmeister](https://discuss.elastic.co/u/Jerry_Hoffmeister)\ **Replies:** 9\ **Last updated:** [June 10, 2015, 5:07pm UTC](https://discuss.elastic.co/t/make-logstash-send-logs-via-lumberjack-to-logstash/2261 "2015-06-10T17:07:48Z")
I'd like to send logs, jmx data and collectd data to a central elasticsearch server from several clients. I've setup collectd on the client to send data to LS running on the ES server and that works just fine. I can se… --- ## [Filebeat 5.0 beta 1 is not closing deleted files](https://discuss.elastic.co/t/filebeat-5-0-beta-1-is-not-closing-deleted-files/62759)
**Author:** [@chris.mcdermott](https://discuss.elastic.co/u/chris.mcdermott)\ **Replies:** 13\ **Last updated:** [October 25, 2016, 7:23am UTC](https://discuss.elastic.co/t/filebeat-5-0-beta-1-is-not-closing-deleted-files/62759 "2016-10-25T07:23:35Z")
Hello, I am having an issue with beta1. It is holding open a lot of deleted files even though the files have not been updated for a time much greater than close\_older. I am not setting close\_after so it should be defa… --- ## [Sending data to elasticsearch](https://discuss.elastic.co/t/sending-data-to-elasticsearch/232941)
**Author:** [@nityaraj06](https://discuss.elastic.co/u/nityaraj06)\ **Replies:** 19\ **Last updated:** [May 19, 2020, 8:43am UTC](https://discuss.elastic.co/t/sending-data-to-elasticsearch/232941 "2020-05-19T08:43:25Z")
Hi, Below is the configuration I have for my 2 node elasticsearch cluster. Pls let me know how I should configure the logstash elasticsearch output. Should the data be sent to both the below nodes? I am fully aware th… --- ## [Logstash not able to create index](https://discuss.elastic.co/t/logstash-not-able-to-create-index/239941)
**Author:** [@sumitsahay](https://discuss.elastic.co/u/sumitsahay)\ **Replies:** 19\ **Last updated:** [July 15, 2020, 10:35am UTC](https://discuss.elastic.co/t/logstash-not-able-to-create-index/239941 "2020-07-15T10:35:03Z")
Hi All, My logstash file is not able to create the Index pattern in Kibana. My logstash.conf file /etc/logstash/conf.d/logstash.conf \< input { beats { port =\> 5044 type =\> syslog ssl\_certificate =\> "/etc… --- ## [Async query not returning results + search context failures](https://discuss.elastic.co/t/async-query-not-returning-results-search-context-failures/248746)
**Author:** [@csewack\_asym](https://discuss.elastic.co/u/csewack_asym)\ **Replies:** 13\ **Last updated:** [September 28, 2020, 9:08am UTC](https://discuss.elastic.co/t/async-query-not-returning-results-search-context-failures/248746 "2020-09-28T09:08:15Z")
We recently added many frozen indices to our cluster. We have been having trouble querying them using the regular search api, with a frequent error that there is no search context found. We believe this is because some s… --- ## [Replication of field using scripted field on Kibana causes error](https://discuss.elastic.co/t/replication-of-field-using-scripted-field-on-kibana-causes-error/64653)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 9\ **Last updated:** [December 22, 2016, 10:06am UTC](https://discuss.elastic.co/t/replication-of-field-using-scripted-field-on-kibana-causes-error/64653 "2016-12-22T10:06:12Z")
I am trying to replicate a field using the scripted field in Kibana (5.0 GA). However, it causes below error when I search. Below is my scripted field definition. "type" is the filed automatically generated by fil… --- ## [Conditions and filters not applying](https://discuss.elastic.co/t/conditions-and-filters-not-applying/142637)
**Author:** [@pooch](https://discuss.elastic.co/u/pooch)\ **Replies:** 10\ **Last updated:** [August 7, 2018, 6:53pm UTC](https://discuss.elastic.co/t/conditions-and-filters-not-applying/142637 "2018-08-07T18:53:34Z")
Greetings All, I am new to ELK and stumbled all day yesterday trying to filter out logs that met a certain condition. Any insight as to how I should approach this is much appreciated. \*\*Failed attempt #1 input { bea… --- ## [Fail to configure Xpack AD Realms](https://discuss.elastic.co/t/fail-to-configure-xpack-ad-realms/229818)
**Author:** [@ckough](https://discuss.elastic.co/u/ckough)\ **Replies:** 15\ **Last updated:** [May 10, 2020, 5:35am UTC](https://discuss.elastic.co/t/fail-to-configure-xpack-ad-realms/229818 "2020-05-10T05:35:42Z")
Hi there, I'm using ELK 7.6 with xpack security. The error I'm getting is Authentication to realm foo\_ad failed - authenticate failed (Caused by LDAPException(resultCode=49 (invalid credentials), diagnosticMessage='800… --- ## [\[ URLHaus threat intelligence \]: create a new rule](https://discuss.elastic.co/t/urlhaus-threat-intelligence-create-a-new-rule/260857)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 17\ **Last updated:** [January 19, 2021, 2:49pm UTC](https://discuss.elastic.co/t/urlhaus-threat-intelligence-create-a-new-rule/260857 "2021-01-19T14:49:23Z")
Hello, I am using logsatsh to enrich my SIEM with malicious Urls that I downloaded from URLHaus, and I wanna create a rule that send an alert everytime a user connect to one of the malicious urls. The problem is that … --- ## [How to make use of \_meta when using search API](https://discuss.elastic.co/t/how-to-make-use-of-meta-when-using-search-api/121920)
**Author:** [@peter-ponzel](https://discuss.elastic.co/u/peter-ponzel)\ **Replies:** 13\ **Last updated:** [April 3, 2018, 8:25am UTC](https://discuss.elastic.co/t/how-to-make-use-of-meta-when-using-search-api/121920 "2018-04-03T08:25:22Z")
hello, is there a way to include the \_meta data of an index when doing a search on multiple indices? In my case I have lots of indices which makes it kind of hard to provide them for a search on "Multiple Indices" and … --- ## [Can't start the filebeat for windows](https://discuss.elastic.co/t/cant-start-the-filebeat-for-windows/123217)
**Author:** [@KWLam](https://discuss.elastic.co/u/KWLam)\ **Replies:** 13\ **Last updated:** [March 26, 2018, 10:41am UTC](https://discuss.elastic.co/t/cant-start-the-filebeat-for-windows/123217 "2018-03-26T10:41:42Z")
I am just new to elastic. my elasticsearch is up and kibana is up too. however, I can't start my Filebeat to load the log into elastic. I can't start the filebeat services. When I run this C:\\Program Files\\filebeat\>.\\f… --- ## [End to end latency with traces](https://discuss.elastic.co/t/end-to-end-latency-with-traces/338452)
**Author:** [@sangramreddy](https://discuss.elastic.co/u/sangramreddy)\ **Replies:** 14\ **Last updated:** [July 17, 2023, 3:58pm UTC](https://discuss.elastic.co/t/end-to-end-latency-with-traces/338452 "2023-07-17T15:58:57Z")
Elastic APM transactions tab shows a nice graph about the latency distribution as shown below w: However, this latency distribution is only for taht specific app. How to visualize latency distribution for traces whi… [Previous page](https://discuss.elastic.co/top.md?page=125&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=127&per_page=50&period=all)