# Top

**URL:** https://discuss.elastic.co/top.md?page=1262&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1263

---

## [Field "document\_type" sent via filebeat as "type" field to ES is ananlyzed](https://discuss.elastic.co/t/field-document-type-sent-via-filebeat-as-type-field-to-es-is-ananlyzed/100245)

<div class="topic-metadata">

**Author:** [@vijay.sangha](https://discuss.elastic.co/u/vijay.sangha)\
**Replies:** 4\
**Last updated:** [September 12, 2017, 5:42pm UTC](https://discuss.elastic.co/t/field-document-type-sent-via-filebeat-as-type-field-to-es-is-ananlyzed/100245 "2017-09-12T17:42:04Z")

</div>

I am using Filebeat 5.3--\>Logstash 5.3--\>Elasticserach 5.3. While sending my documents using filebeat I am using document\_type to tag a log file type as below :-1: input\_type: log paths: /my/log/location/server.log …

---

## [Scripted field throws exception](https://discuss.elastic.co/t/scripted-field-throws-exception/133968)

<div class="topic-metadata">

**Author:** [@Santhosh\_ic](https://discuss.elastic.co/u/Santhosh_ic)\
**Replies:** 2\
**Last updated:** [June 4, 2018, 8:37am UTC](https://discuss.elastic.co/t/scripted-field-throws-exception/133968 "2018-06-04T08:37:27Z")

</div>

// 128s Error: Request to Elasticsearch failed: {"error":{"root\_cause":\[{"type":"script\_exception","reason":"runtime error","script\_stack":\["java.util.regex.Matcher.getTextLength(Matcher.java:1283)","java.util.regex.Ma…

---

## [Scripted field issue](https://discuss.elastic.co/t/scripted-field-issue/120307)

<div class="topic-metadata">

**Author:** [@Eric\_Yin](https://discuss.elastic.co/u/Eric_Yin)\
**Replies:** 2\
**Last updated:** [February 21, 2018, 6:20am UTC](https://discuss.elastic.co/t/scripted-field-issue/120307 "2018-02-21T06:20:48Z")

</div>

Dear ELK developers, I would like to ask if there is any feature to involve putting the scripted field by txt or by other format to import the scripted field since we have thounsands of KPIs and we involve thounsands of…

---

## [Elasticsearch cluster occasional shutdown by itself](https://discuss.elastic.co/t/elasticsearch-cluster-occasional-shutdown-by-itself/69643)

<div class="topic-metadata">

**Author:** [@tfasun](https://discuss.elastic.co/u/tfasun)\
**Replies:** 2\
**Last updated:** [December 26, 2016, 9:01am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-occasional-shutdown-by-itself/69643 "2016-12-26T09:01:22Z")

</div>

Usually in the morning my elasticsearch cluster shutdown by itself. My elasticsearch log is below. Why Korvus node shutdown? After I restart my cluster .it work.My new node name is Master Khan -21 06:41:57,889\]\[INFO …

---

## [Dump an error event: error\_class=Fluent::Plugin::ElasticsearchErrorHandler::ElasticsearchError error="400](https://discuss.elastic.co/t/dump-an-error-event-error-class-fluent-elasticsearcherror-error-400/157122)

<div class="topic-metadata">

**Author:** [@vijayakrishna.rg](https://discuss.elastic.co/u/vijayakrishna.rg)\
**Replies:** 0\
**Last updated:** [November 16, 2018, 7:02pm UTC](https://discuss.elastic.co/t/dump-an-error-event-error-class-fluent-elasticsearcherror-error-400/157122 "2018-11-16T19:02:25Z")

</div>

Hi, i see below error keep logging in fluentd any suggestion please.. dump an error event: error\_class=Fluent::Plugin::ElasticsearchErrorHandler::ElasticsearchError error="400 - Rejected by Elasticsearch" location=nil t…

---

## [OpenTelemetry Metrics exporter (DotNet)](https://discuss.elastic.co/t/opentelemetry-metrics-exporter-dotnet/305578)

<div class="topic-metadata">

**Author:** [@piotrkula](https://discuss.elastic.co/u/piotrkula)\
**Replies:** 0\
**Last updated:** [May 25, 2022, 8:44am UTC](https://discuss.elastic.co/t/opentelemetry-metrics-exporter-dotnet/305578 "2022-05-25T08:44:23Z")

</div>

Hello I have hooked up metrics instrumentation in dotnet and use the OpenTelemetry exporter, which is supposed to map all metrics to the OTLP standard. I can see metrics in the metric analyser but I do not understand w…

---

## [Solution for Logstash json file input - solution pour injecter un fichier json formaté comme ci dessous](https://discuss.elastic.co/t/solution-for-logstash-json-file-input-solution-pour-injecter-un-fichier-json-formate-comme-ci-dessous/255564)

<div class="topic-metadata">

**Author:** [@pmo](https://discuss.elastic.co/u/pmo)\
**Replies:** 0\
**Last updated:** [November 16, 2020, 3:37pm UTC](https://discuss.elastic.co/t/solution-for-logstash-json-file-input-solution-pour-injecter-un-fichier-json-formate-comme-ci-dessous/255564 "2020-11-16T15:37:53Z")

</div>

I've json file that are formated like this (j'ai des fichiers json formatés comme ci dessous - les données ont été changées) \[ { "crossConnectVlanRanges": "", "productAndRelease": "FX-I.2.0", "role": "", …

---

## [Bool should query with result limit for each condition](https://discuss.elastic.co/t/bool-should-query-with-result-limit-for-each-condition/132933)

<div class="topic-metadata">

**Author:** [@tushar\_chevulkar](https://discuss.elastic.co/u/tushar_chevulkar)\
**Replies:** 0\
**Last updated:** [May 23, 2018, 7:01am UTC](https://discuss.elastic.co/t/bool-should-query-with-result-limit-for-each-condition/132933 "2018-05-23T07:01:06Z")

</div>

Hello, Is there a way i can give limit to each should condition ? for e.g. in the below query i need only 10 results for each source. { "query": { "bool": { "should": \[ { "matc…

---

## [Can we create kibana dashboards as code?](https://discuss.elastic.co/t/can-we-create-kibana-dashboards-as-code/352783)

<div class="topic-metadata">

**Author:** [@senyam08](https://discuss.elastic.co/u/senyam08)\
**Replies:** 1\
**Last updated:** [February 8, 2024, 1:57pm UTC](https://discuss.elastic.co/t/can-we-create-kibana-dashboards-as-code/352783 "2024-02-08T13:57:53Z")

</div>

Is there a way we can automate kibana dashboard creation? It would be great if we could create via version controlled source for better tracking and easy maintenance. Thanks

---

## [Ilm rollover stuck in warm phase](https://discuss.elastic.co/t/ilm-rollover-stuck-in-warm-phase/228403)

<div class="topic-metadata">

**Author:** [@Michael\_Jackson1](https://discuss.elastic.co/u/Michael_Jackson1)\
**Replies:** 1\
**Last updated:** [April 20, 2020, 9:06pm UTC](https://discuss.elastic.co/t/ilm-rollover-stuck-in-warm-phase/228403 "2020-04-20T21:06:08Z")

</div>

I have tested a simple hot/delete index rollover with success. Now I am trying to add a warm node and to try a hot/warm/delete rollover pattern, but am not able to get the warm indices to move to the delete phase. My po…

---

## [reason=\>"Can't get text on a START\_OBJECT](https://discuss.elastic.co/t/reason-cant-get-text-on-a-start-object/147829)

<div class="topic-metadata">

**Author:** [@jmassari](https://discuss.elastic.co/u/jmassari)\
**Replies:** 1\
**Last updated:** [September 10, 2018, 6:03am UTC](https://discuss.elastic.co/t/reason-cant-get-text-on-a-start-object/147829 "2018-09-10T06:03:29Z")

</div>

Trying to route logs from a local machine to a logstash server in GCP, which then goes to elasticsearch as part of elastic cloud. Looks like this connection is breaking down trying to write to elasticsearch, but that isn…

---

## [Rollup not triggered](https://discuss.elastic.co/t/rollup-not-triggered/145930)

<div class="topic-metadata">

**Author:** [@ben\_f](https://discuss.elastic.co/u/ben_f)\
**Replies:** 7\
**Last updated:** [August 30, 2018, 1:32pm UTC](https://discuss.elastic.co/t/rollup-not-triggered/145930 "2018-08-30T13:32:56Z")

</div>

Hi, We are trying to use the new rollup feature. trigger\_count increases with time, but others metrics are sticking to 0, and the index remain empty. Are we missing something? Thanks ! PUT \_xpack/rollup/job/testroll…

---

## [Grok Pattern DNS Querys send via syslogd](https://discuss.elastic.co/t/grok-pattern-dns-querys-send-via-syslogd/114512)

<div class="topic-metadata">

**Author:** [@A.Klos](https://discuss.elastic.co/u/A.Klos)\
**Replies:** 1\
**Last updated:** [January 8, 2018, 8:35pm UTC](https://discuss.elastic.co/t/grok-pattern-dns-querys-send-via-syslogd/114512 "2018-01-08T20:35:14Z")

</div>

Hi, we have a DNS server and send all dns queries to logstash / elastic. The message line seems to be like this: \<30\>Jan 8 12:32:35 10.243.XX.XX named\[21826\]: queries: client 10.243.YY.YY#43789 (111.236.ZZ.ZZ.in-addr…

---

## [Dashboard caching for a particular time range](https://discuss.elastic.co/t/dashboard-caching-for-a-particular-time-range/58228)

<div class="topic-metadata">

**Author:** [@Miloni\_Mehta](https://discuss.elastic.co/u/Miloni_Mehta)\
**Replies:** 1\
**Last updated:** [August 17, 2016, 3:48pm UTC](https://discuss.elastic.co/t/dashboard-caching-for-a-particular-time-range/58228 "2016-08-17T15:48:00Z")

</div>

I have created a dashboard using kibana 4 and was wondering if the results are being cached for a particular time stamp. I am sharing the dashboard link with my team members and it takes too long for the dashboard to loa…

---

## [Elasticsearch.yml config to solve the "Upgrade Required Your version of Elasticsearch is too old. Kibana requires Elasticsearch 0.90.9 or above." problem](https://discuss.elastic.co/t/elasticsearch-yml-config-to-solve-the-upgrade-required-your-version-of-elasticsearch-is-too-old-kibana-requires-elasticsearch-0-90-9-or-above-problem/25971)

<div class="topic-metadata">

**Author:** [@billy6](https://discuss.elastic.co/u/billy6)\
**Replies:** 1\
**Last updated:** [July 23, 2015, 6:47am UTC](https://discuss.elastic.co/t/elasticsearch-yml-config-to-solve-the-upgrade-required-your-version-of-elasticsearch-is-too-old-kibana-requires-elasticsearch-0-90-9-or-above-problem/25971 "2015-07-23T06:47:06Z")

</div>

Hi ! I want to access to Kibana by http://IP:80. Nevertheless when I visit the pageI obtain these errors\> "\> Upgrade Required Your version of Elasticsearch is too old. Kibana requires Elasticsearch 0.90.9 or above." …

---

## [Node doesn't join cluster](https://discuss.elastic.co/t/node-doesnt-join-cluster/232691)

<div class="topic-metadata">

**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\
**Replies:** 5\
**Last updated:** [May 14, 2020, 7:13pm UTC](https://discuss.elastic.co/t/node-doesnt-join-cluster/232691 "2020-05-14T19:13:14Z")

</div>

Is there a guide on how to add new nodes to a cluster? Cause this ain't it. The issue is both nodes are running, displaying no errors, but shards are not getting assigned. Nodes in the cluster (cluster.name: local) ha…

---

## [Kibana HTTPS - Impossible to use verification mode "full" for docker services?](https://discuss.elastic.co/t/kibana-https-impossible-to-use-verification-mode-full-for-docker-services/224917)

<div class="topic-metadata">

**Author:** [@J7mbo](https://discuss.elastic.co/u/J7mbo)\
**Replies:** 5\
**Last updated:** [March 25, 2020, 12:32pm UTC](https://discuss.elastic.co/t/kibana-https-impossible-to-use-verification-mode-full-for-docker-services/224917 "2020-03-25T12:32:38Z")

</div>

Docker services use their internal DNS to resolve "elasticsearch", so I can point kibana at "https://elasticsearch:9200". The problem is, I have to set verification mode to "certificate" because the https certificate is…

---

## ["Getting started" topic for new users who have been given dashboards with data?](https://discuss.elastic.co/t/getting-started-topic-for-new-users-who-have-been-given-dashboards-with-data/97710)

<div class="topic-metadata">

**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\
**Replies:** 5\
**Last updated:** [August 23, 2017, 2:42am UTC](https://discuss.elastic.co/t/getting-started-topic-for-new-users-who-have-been-given-dashboards-with-data/97710 "2017-08-23T02:42:12Z")

</div>

I’m about to distribute (to a specific set of interested users) a Docker image that contains: Elastic Stack Some dashboards Some data for use with those dashboards Some of the users might be new to Kibana. (Docker, to…

---

## [LogStash config not parsing out log events even though config checks out in Grok Debugger](https://discuss.elastic.co/t/logstash-config-not-parsing-out-log-events-even-though-config-checks-out-in-grok-debugger/96653)

<div class="topic-metadata">

**Author:** [@cchooks2](https://discuss.elastic.co/u/cchooks2)\
**Replies:** 5\
**Last updated:** [August 16, 2017, 8:51pm UTC](https://discuss.elastic.co/t/logstash-config-not-parsing-out-log-events-even-though-config-checks-out-in-grok-debugger/96653 "2017-08-16T20:51:08Z")

</div>

First post and hoping this is the forum to post questions … I have the following GROK filter: if (\[service\] == “MY\_SERVICE”){ if(\[attributes\]\[file\_path\] == “/apps/log/mydoc/wso2carbon.log”) { grok { patterns\_dir =\> …

---

## [\[ES - v2.4.3\] Query performance issue of multiple shards of one index allocated on one single ES data node](https://discuss.elastic.co/t/es-v2-4-3-query-performance-issue-of-multiple-shards-of-one-index-allocated-on-one-single-es-data-node/73128)

<div class="topic-metadata">

**Author:** [@Prinice\_Tony](https://discuss.elastic.co/u/Prinice_Tony)\
**Replies:** 5\
**Last updated:** [February 1, 2017, 1:31am UTC](https://discuss.elastic.co/t/es-v2-4-3-query-performance-issue-of-multiple-shards-of-one-index-allocated-on-one-single-es-data-node/73128 "2017-02-01T01:31:52Z")

</div>

Hi all, I met a query performance issue when performance testing against Elastic Search V2.4.3: 1. When query performance testing against the cluster with 64 shards of one index( 64 = 16\*4, 16 shards, 1 primary and 3 r…

---

## [CSV filter duplicate output result](https://discuss.elastic.co/t/csv-filter-duplicate-output-result/216521)

<div class="topic-metadata">

**Author:** [@pierrejutard](https://discuss.elastic.co/u/pierrejutard)\
**Replies:** 6\
**Last updated:** [January 27, 2020, 5:59pm UTC](https://discuss.elastic.co/t/csv-filter-duplicate-output-result/216521 "2020-01-27T17:59:58Z")

</div>

Hello, Under windows 10, with 7.5.2 ES stack version, I try to make a pipeline from a csv file (";") delimiter to ES but the output is not stable. For instance it duplicates the result: The output is:{ "twod" =\> 0.…

---

## [Drop line rather than the whole message](https://discuss.elastic.co/t/drop-line-rather-than-the-whole-message/215133)

<div class="topic-metadata">

**Author:** [@whoatemyjam](https://discuss.elastic.co/u/whoatemyjam)\
**Replies:** 6\
**Last updated:** [January 15, 2020, 1:55pm UTC](https://discuss.elastic.co/t/drop-line-rather-than-the-whole-message/215133 "2020-01-15T13:55:14Z")

</div>

hi I am trying to drop lines which match a regex filter { if \[message\] =~ "\\e\\\[8mha.\*\\e\\\[0m" { drop{} } } this above one removes the whole message , how do i drop only the line that contains the matching regex Than…

---

## [Error loading accounts data set](https://discuss.elastic.co/t/error-loading-accounts-data-set/205248)

<div class="topic-metadata">

**Author:** [@BillW](https://discuss.elastic.co/u/BillW)\
**Replies:** 6\
**Last updated:** [October 30, 2019, 9:20am UTC](https://discuss.elastic.co/t/error-loading-accounts-data-set/205248 "2019-10-30T09:20:05Z")

</div>

Hi, I'm trying to follow the tutorial for current version (7.4) of kibana and I get a 404 error loading the data for the accounts.json data set. I don't get the error for shakespeare or logstash data. Not sure if it's a…

---

## [Can i run logstash without conf file, all conf data in command line?](https://discuss.elastic.co/t/can-i-run-logstash-without-conf-file-all-conf-data-in-command-line/111205)

<div class="topic-metadata">

**Author:** [@rkhapre](https://discuss.elastic.co/u/rkhapre)\
**Replies:** 6\
**Last updated:** [December 17, 2017, 11:46am UTC](https://discuss.elastic.co/t/can-i-run-logstash-without-conf-file-all-conf-data-in-command-line/111205 "2017-12-17T11:46:27Z")

</div>

Hi All Can i run logstash without conf file, all conf data in command line? I am using multiple conf files, for which it is hard for me to maintain these small conf files in server. I am looking a way wherein i can us…

---

## [Evaluating ElasticSearch: Is it possible to run multiple value aggregations on ~100M records?](https://discuss.elastic.co/t/evaluating-elasticsearch-is-it-possible-to-run-multiple-value-aggregations-on-100m-records/15771)

<div class="topic-metadata">

**Author:** [@Mex](https://discuss.elastic.co/u/Mex)\
**Replies:** 6\
**Last updated:** [February 13, 2014, 8:39pm UTC](https://discuss.elastic.co/t/evaluating-elasticsearch-is-it-possible-to-run-multiple-value-aggregations-on-100m-records/15771 "2014-02-13T20:39:50Z")

</div>

I am currently evaluating a set of technologies we hope to use in order to drive real-time analytic queries on a large dataset, I came across ElasticSearch and was wondering on its appropriateness for our use cases. …

---

## ["term" type query](https://discuss.elastic.co/t/term-type-query/4792)

<div class="topic-metadata">

**Author:** [@ChrisGedrim](https://discuss.elastic.co/u/ChrisGedrim)\
**Replies:** 6\
**Last updated:** [July 7, 2011, 2:41pm UTC](https://discuss.elastic.co/t/term-type-query/4792 "2011-07-07T14:41:37Z")

</div>

Hi all, First and foremost: I searched the archives and the only post I found which is similar to my issue was this http://elasticsearch-users.115913.n3.nabble.com/Search-query-issue-using-quot-term-quot-and-spaces…

---

## [Elasticsearch 8.19.23, 9.4.8, 9.5.5 Security Update (ESA-2026-199)](https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-199/390874)

<div class="topic-metadata">

**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\
**Replies:** 0\
**Last updated:** [October 6, 2026, 6:53pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-199/390874 "2026-10-06T18:53:22Z")

</div>

Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a sp…

---

## [Agent Unable to Start Service](https://discuss.elastic.co/t/agent-unable-to-start-service/358773)

<div class="topic-metadata">

**Author:** [@eleong](https://discuss.elastic.co/u/eleong)\
**Replies:** 3\
**Last updated:** [December 16, 2024, 10:28pm UTC](https://discuss.elastic.co/t/agent-unable-to-start-service/358773 "2024-12-16T22:28:14Z")

</div>

Hi, I am having issues with this 1 agent (I have 26 in my environment and all is running fine except for this 1 agent). When trying to start the service, it would start awhile and then shutdown on its own. Tried reins…

---

## [Build IndexRequest with elastic in 8.1.0](https://discuss.elastic.co/t/build-indexrequest-with-elastic-in-8-1-0/300146)

<div class="topic-metadata">

**Author:** [@Raushan](https://discuss.elastic.co/u/Raushan)\
**Replies:** 3\
**Last updated:** [March 24, 2022, 8:09am UTC](https://discuss.elastic.co/t/build-indexrequest-with-elastic-in-8-1-0/300146 "2022-03-24T08:09:01Z")

</div>

Hi, I am migrating from HLRC to Elasticsearch Java API Client. I need to transform below code private IndexRequest buildIndex(String indexName, CacheObject cacheObject) { IndexRequest indexRequest = new IndexReq…

---

## [How to resolve elasticsearch status red](https://discuss.elastic.co/t/how-to-resolve-elasticsearch-status-red/267266)

<div class="topic-metadata">

**Author:** [@asan](https://discuss.elastic.co/u/asan)\
**Replies:** 3\
**Last updated:** [March 17, 2021, 11:01am UTC](https://discuss.elastic.co/t/how-to-resolve-elasticsearch-status-red/267266 "2021-03-17T11:01:08Z")

</div>

hi I've got problem with elasticasearch which get in red status as you can see in bellow : curl -XGET localhost:9200/\_cluster/allocation/explain {"index":".async-search","shard":0,"primary":true,"current\_state":"unass…

---

## [Selecting Multiple Entries in Controls Visualization](https://discuss.elastic.co/t/selecting-multiple-entries-in-controls-visualization/262221)

<div class="topic-metadata">

**Author:** [@Prithwi\_Lahiri](https://discuss.elastic.co/u/Prithwi_Lahiri)\
**Replies:** 3\
**Last updated:** [February 15, 2021, 5:22am UTC](https://discuss.elastic.co/t/selecting-multiple-entries-in-controls-visualization/262221 "2021-02-15T05:22:10Z")

</div>

Hello Everyone, I am creating a control visualization by which I can select more than 300 entries. Is there a "Select All" option in Controls? When I want to select them one by one after 6 to 7 entries the dashboard pag…

---

## [Syslog input decode json](https://discuss.elastic.co/t/syslog-input-decode-json/182645)

<div class="topic-metadata">

**Author:** [@soerenfrisk](https://discuss.elastic.co/u/soerenfrisk)\
**Replies:** 3\
**Last updated:** [June 11, 2019, 10:40am UTC](https://discuss.elastic.co/t/syslog-input-decode-json/182645 "2019-06-11T10:40:47Z")

</div>

I have a tcp syslog input in filebeat, the incoming data is json. i would want to decode json to top level keys in elastic search. To do this has been quite the challenge for me, and i hope someone is able to help. as t…

---

## [Logstash not uploading data on ES](https://discuss.elastic.co/t/logstash-not-uploading-data-on-es/119172)

<div class="topic-metadata">

**Author:** [@niraj\_pandey](https://discuss.elastic.co/u/niraj_pandey)\
**Replies:** 3\
**Last updated:** [February 9, 2018, 8:17am UTC](https://discuss.elastic.co/t/logstash-not-uploading-data-on-es/119172 "2018-02-09T08:17:40Z")

</div>

Hi, I have created a template and now using logstash to push the data on elasticsearch. And I see it's created the index but not uploaded the data. Any idea ? Here is template: PUT \_template/ltemplsbacct { "index\_p…

---

## [Return very slow when using ngram char split](https://discuss.elastic.co/t/return-very-slow-when-using-ngram-char-split/88345)

<div class="topic-metadata">

**Author:** [@linda](https://discuss.elastic.co/u/linda)\
**Replies:** 3\
**Last updated:** [June 7, 2017, 8:04am UTC](https://discuss.elastic.co/t/return-very-slow-when-using-ngram-char-split/88345 "2017-06-07T08:04:48Z")

</div>

\*we deploy elasticsearch 5. version using ngram char split in our 5 \*\* servers which one of them is master node, and others are data nodes. settings as follows: { "trimps2": { "settings": { "index": { …

---

## [Optional fields in filebeat](https://discuss.elastic.co/t/optional-fields-in-filebeat/48048)

<div class="topic-metadata">

**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\
**Replies:** 3\
**Last updated:** [April 22, 2016, 5:46am UTC](https://discuss.elastic.co/t/optional-fields-in-filebeat/48048 "2016-04-22T05:46:16Z")

</div>

Hi, I was using LSF with below extra fields in LSF.conf type and Application as below. { "paths": \[ "C:/logs/user-mgmt/user-mgmt.log" \], "fields": { "type": "iam-logs","Application":"iam" } } And I was creating ti…

---

## [Baselining for fetching the logs](https://discuss.elastic.co/t/baselining-for-fetching-the-logs/36498)

<div class="topic-metadata">

**Author:** [@praveen\_siem](https://discuss.elastic.co/u/praveen_siem)\
**Replies:** 3\
**Last updated:** [December 8, 2015, 9:55pm UTC](https://discuss.elastic.co/t/baselining-for-fetching-the-logs/36498 "2015-12-08T21:55:49Z")

</div>

Hi Team, I have a project in which, ELK implementation is done, and they have started collecting logs from some 2-3 log sources. The client wants to implement ELK as SIEM. I have a set of use-cases to be implemented,…

---

## [Java TransportClient problem](https://discuss.elastic.co/t/java-transportclient-problem/25986)

<div class="topic-metadata">

**Author:** [@davmrtl](https://discuss.elastic.co/u/davmrtl)\
**Replies:** 0\
**Last updated:** [July 21, 2015, 1:31pm UTC](https://discuss.elastic.co/t/java-transportclient-problem/25986 "2015-07-21T13:31:32Z")

</div>

Hi, After many hours, my java application shows stacktraces about cluster monitor infos timed out. I'm not sure why this is happening but my java application is running on the same server that hosts the Elasticsearch s…

---

## [How work rackIDs in ElasticSearch](https://discuss.elastic.co/t/how-work-rackids-in-elasticsearch/9690)

<div class="topic-metadata">

**Author:** [@Michael\_Rennecke](https://discuss.elastic.co/u/Michael_Rennecke)\
**Replies:** 3\
**Last updated:** [November 13, 2012, 11:51am UTC](https://discuss.elastic.co/t/how-work-rackids-in-elasticsearch/9690 "2012-11-13T11:51:19Z")

</div>

Hello, work the 'node.rack' config parameter, like the rackID by Hadoop? For example: I have 3 replicas, some indizes and 4 rackIDs. Places ElasticSearch a 'complete' index in every rack? regards, michael -…

---

## [Problems with Query\_String and different field types](https://discuss.elastic.co/t/problems-with-query-string-and-different-field-types/4504)

<div class="topic-metadata">

**Author:** [@maho](https://discuss.elastic.co/u/maho)\
**Replies:** 3\
**Last updated:** [June 1, 2011, 11:13am UTC](https://discuss.elastic.co/t/problems-with-query-string-and-different-field-types/4504 "2011-06-01T11:13:41Z")

</div>

Hi, I have an index with two fields: - name: description, type: string - name: price, type: double If I send following query, I get an NumberFormatException\[For input string: \\"car\\"\] curl -XGET 'h…

---

## [Elastic KNN search questions](https://discuss.elastic.co/t/elastic-knn-search-questions/344684)

<div class="topic-metadata">

**Author:** [@AdarshPrabhakara](https://discuss.elastic.co/u/AdarshPrabhakara)\
**Replies:** 2\
**Last updated:** [October 9, 2023, 7:14pm UTC](https://discuss.elastic.co/t/elastic-knn-search-questions/344684 "2023-10-09T19:14:12Z")

</div>

I am looking into using Elastic KNN search feature and from what I see this is how we query ES for KNN search. GET my-index/\_knn\_search { "knn": { "field": "image\_vector", "query\_vector": \[0.3, 0.1, 1.2\], …

---

## [Kibana Discover page sorting when Hide 'Time' column enabled](https://discuss.elastic.co/t/kibana-discover-page-sorting-when-hide-time-column-enabled/251326)

<div class="topic-metadata">

**Author:** [@CODE-REaD](https://discuss.elastic.co/u/CODE-REaD)\
**Replies:** 2\
**Last updated:** [October 8, 2020, 2:52pm UTC](https://discuss.elastic.co/t/kibana-discover-page-sorting-when-hide-time-column-enabled/251326 "2020-10-08T14:52:32Z")

</div>

Background: Kibana and Elasticsearch version: 7.9.2, installed with yum from repo elasticsearch-7.x, running on free license. Platform: CentOS 7 I had enabled Kibana's Advanced setting titled Hide 'Time' column (doc\_ta…

---

## [Creating roles with limited Kibana permissions](https://discuss.elastic.co/t/creating-roles-with-limited-kibana-permissions/236502)

<div class="topic-metadata">

**Author:** [@maxdanilov](https://discuss.elastic.co/u/maxdanilov)\
**Replies:** 2\
**Last updated:** [June 10, 2020, 4:01pm UTC](https://discuss.elastic.co/t/creating-roles-with-limited-kibana-permissions/236502 "2020-06-10T16:01:57Z")

</div>

Hi, I'm following this tutorial to create users with eck: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-users-and-roles.html The examples there specify roles with Elasticsearch capabilities only, but can I d…

---

## [Kibana Canvas - Support for Interactive features](https://discuss.elastic.co/t/kibana-canvas-support-for-interactive-features/202651)

<div class="topic-metadata">

**Author:** [@sreed](https://discuss.elastic.co/u/sreed)\
**Replies:** 2\
**Last updated:** [October 9, 2019, 12:24pm UTC](https://discuss.elastic.co/t/kibana-canvas-support-for-interactive-features/202651 "2019-10-09T12:24:55Z")

</div>

Does Canvas support interactivity through features like click-to-filter, drill-down, zoom, tooltips etc?

---

## [Exception removing x-pack 6.2.2 - duplicated pluging](https://discuss.elastic.co/t/exception-removing-x-pack-6-2-2-duplicated-pluging/121050)

<div class="topic-metadata">

**Author:** [@dcam](https://discuss.elastic.co/u/dcam)\
**Replies:** 2\
**Last updated:** [February 22, 2018, 9:29pm UTC](https://discuss.elastic.co/t/exception-removing-x-pack-6-2-2-duplicated-pluging/121050 "2018-02-22T21:29:37Z")

</div>

ES throws an exception about duplicated pluging. Then trying to reinstall x-pack I get the same exception: /usr/share/elasticsearch # bin/elasticsearch-plugin remove x-pack Exception in thread "main" java.lang.IllegalSt…

---

## [Logstash 6.0 breaks winlogbeat agent indexing](https://discuss.elastic.co/t/logstash-6-0-breaks-winlogbeat-agent-indexing/108595)

<div class="topic-metadata">

**Author:** [@kwslavens](https://discuss.elastic.co/u/kwslavens)\
**Replies:** 2\
**Last updated:** [November 27, 2017, 11:57pm UTC](https://discuss.elastic.co/t/logstash-6-0-breaks-winlogbeat-agent-indexing/108595 "2017-11-27T23:57:12Z")

</div>

I've got a winlogbeat agents version 5.x sending data to a kafka queue with a topic name of winlogbeat. Our indexer cluster is pulling out of that topic. With 6.0 Elasticsearch and 5.6.4 agents / logstash 5.6.4 all is g…

---

## [Are different OS versions supported in the same cluster?](https://discuss.elastic.co/t/are-different-os-versions-supported-in-the-same-cluster/70470)

<div class="topic-metadata">

**Author:** [@pshroads](https://discuss.elastic.co/u/pshroads)\
**Replies:** 2\
**Last updated:** [January 3, 2017, 8:08pm UTC](https://discuss.elastic.co/t/are-different-os-versions-supported-in-the-same-cluster/70470 "2017-01-03T20:08:21Z")

</div>

We have an 8 node cluster with all nodes running CentOS 6.5 and elasticsearch 1.7.5. We have purchased 10 new machines and want migrate off the 8 old nodes by adding the 10 new machines to the cluster and then removing t…

---

## [If Conditional around input filter doesn't appear to be working](https://discuss.elastic.co/t/if-conditional-around-input-filter-doesnt-appear-to-be-working/66166)

<div class="topic-metadata">

**Author:** [@sjivan](https://discuss.elastic.co/u/sjivan)\
**Replies:** 2\
**Last updated:** [November 16, 2016, 10:27am UTC](https://discuss.elastic.co/t/if-conditional-around-input-filter-doesnt-appear-to-be-working/66166 "2016-11-16T10:27:00Z")

</div>

I'm trying to setup conditional file input sources based on an environment variable and it was reading the file even when the condition was false. To simplify the test I setup input { if 1 == 2 { fil…

---

## [Why does X-Pack require root permissions for installation?](https://discuss.elastic.co/t/why-does-x-pack-require-root-permissions-for-installation/64301)

<div class="topic-metadata">

**Author:** [@CoaxVex](https://discuss.elastic.co/u/CoaxVex)\
**Replies:** 2\
**Last updated:** [October 28, 2016, 3:09pm UTC](https://discuss.elastic.co/t/why-does-x-pack-require-root-permissions-for-installation/64301 "2016-10-28T15:09:12Z")

</div>

I'm currently setting up an elasticsearch cluster for a client, who prefers to not have me run anything as root. This works quite ok with the tarball release, but I get stuck at installing x-pack. It looks like the x-p…

---

## [溜まったthreadpool search queueのクリア方法と溜めない方法について](https://discuss.elastic.co/t/threadpool-search-queue/53865)

<div class="topic-metadata">

**Author:** [@r4-keisuke](https://discuss.elastic.co/u/r4-keisuke)\
**Replies:** 2\
**Last updated:** [July 1, 2016, 2:29am UTC](https://discuss.elastic.co/t/threadpool-search-queue/53865 "2016-07-01T02:29:58Z")

</div>

いつもお世話になっております。 普段300-500/secで推移しているsearch rateが、 1000+/secで瞬間的に増えることがあり、 thread pool のsearch queueが上限に達してしまうことがありました。 queueの上限を増やすことで対応もしましたが、 それはそれで増やした上限にも達してしまい、 CPUへの負荷が高くなってしまうことが起きてます。 急激に増えるsearchクエリの数は物の作り…

---

## [Memcached error saturate the syslog](https://discuss.elastic.co/t/memcached-error-saturate-the-syslog/52487)

<div class="topic-metadata">

**Author:** [@dfaropennetwork](https://discuss.elastic.co/u/dfaropennetwork)\
**Replies:** 2\
**Last updated:** [June 14, 2016, 5:53am UTC](https://discuss.elastic.co/t/memcached-error-saturate-the-syslog/52487 "2016-06-14T05:53:55Z")

</div>

Hi eveyone, I need some help, i'm experimenting problems with packetbeat, i've the following error: Jun 11 03:16:43 nombrehost /usr/bin/packetbeat\[29569\]: log.go:114: Stacktrace: /go/src/github.com/elastic/beats/libb…

[Previous page](https://discuss.elastic.co/top.md?page=1261&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1263&per_page=50&period=all)
