# Top

**URL:** https://discuss.elastic.co/top.md?page=1274&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1275

---

## [How to use logstash filters](https://discuss.elastic.co/t/how-to-use-logstash-filters/42643)

<div class="topic-metadata">

**Author:** [@Aron\_Pedersen](https://discuss.elastic.co/u/Aron_Pedersen)\
**Replies:** 3\
**Last updated:** [February 25, 2016, 6:45pm UTC](https://discuss.elastic.co/t/how-to-use-logstash-filters/42643 "2016-02-25T18:45:00Z")

</div>

I am new to the whole BELK stack (or The Elastic Stack from 5.0.0) so sorry if the question is not well described. I have logs that looks like the example below that I ship with filebeat to logstash Log example: 2/24…

---

## [Install dependencies in the docker container](https://discuss.elastic.co/t/install-dependencies-in-the-docker-container/186506)

<div class="topic-metadata">

**Author:** [@thomas.heuberger](https://discuss.elastic.co/u/thomas.heuberger)\
**Replies:** 1\
**Last updated:** [July 10, 2019, 3:43pm UTC](https://discuss.elastic.co/t/install-dependencies-in-the-docker-container/186506 "2019-07-10T15:43:25Z")

</div>

I'm new to docker and I'm struggling a bit with installing the required prerequisites. I have this in my docker-composer.yml file, because I need the sflow plugin and I need the mysql jdbc driver: command: \> bash -c …

---

## [Convert a Json array of object (\[{},{},{}\] - this format) to {\[\],\[\],\[\]}](https://discuss.elastic.co/t/convert-a-json-array-of-object-this-format-to/157058)

<div class="topic-metadata">

**Author:** [@Panda8](https://discuss.elastic.co/u/Panda8)\
**Replies:** 1\
**Last updated:** [November 21, 2018, 7:13am UTC](https://discuss.elastic.co/t/convert-a-json-array-of-object-this-format-to/157058 "2018-11-21T07:13:48Z")

</div>

Hi I have a Json I/P which looks like: { "data": { "arrayField" :\[ {"id" : 7,"data" : "a"},{"id" : 3,"data" : "b"}\], "field1" : "value1" } } Where arrayField can contain any number of element. I want to acces…

---

## [Logstash not working when started via systemctl](https://discuss.elastic.co/t/logstash-not-working-when-started-via-systemctl/157409)

<div class="topic-metadata">

**Author:** [@Marlon\_Ruttmann](https://discuss.elastic.co/u/Marlon_Ruttmann)\
**Replies:** 1\
**Last updated:** [November 20, 2018, 12:25pm UTC](https://discuss.elastic.co/t/logstash-not-working-when-started-via-systemctl/157409 "2018-11-20T12:25:32Z")

</div>

Hello, I have all my environment configured and tested using the command bin/logstash -f myfile.conf --config.reload.automatic and everything works fine. Elasticsearch generates indices, all the filters defined in my .c…

---

## [Executable jar file not working for ElasticSearch](https://discuss.elastic.co/t/executable-jar-file-not-working-for-elasticsearch/81803)

<div class="topic-metadata">

**Author:** [@ahr12](https://discuss.elastic.co/u/ahr12)\
**Replies:** 1\
**Last updated:** [April 18, 2017, 8:06am UTC](https://discuss.elastic.co/t/executable-jar-file-not-working-for-elasticsearch/81803 "2017-04-18T08:06:07Z")

</div>

ElasticSearch - 5.3.0 Ubuntu- 14.04 Hello, I created the maven project for insert the data in ElasticSearch.It's working fine when I executed the code in eclipse.then I create the jar file with dependencies for this proj…

---

## [Multiple IIS applications logs configurations (multiple filebeat.prospectors)](https://discuss.elastic.co/t/multiple-iis-applications-logs-configurations-multiple-filebeat-prospectors/75580)

<div class="topic-metadata">

**Author:** [@ancross](https://discuss.elastic.co/u/ancross)\
**Replies:** 1\
**Last updated:** [February 20, 2017, 2:07pm UTC](https://discuss.elastic.co/t/multiple-iis-applications-logs-configurations-multiple-filebeat-prospectors/75580 "2017-02-20T14:07:04Z")

</div>

Hi. I'm trying to configure filebeat for IIS logs for multiple IIS application. IIS logs are stored in separate folders for each app. My main goal to achieve, is to have separate set of tags fields for each applicati…

---

## [Logstash elasticsearch filter plugin - set index](https://discuss.elastic.co/t/logstash-elasticsearch-filter-plugin-set-index/37583)

<div class="topic-metadata">

**Author:** [@Julia\_Murinova](https://discuss.elastic.co/u/Julia_Murinova)\
**Replies:** 1\
**Last updated:** [December 29, 2015, 9:34am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-plugin-set-index/37583 "2015-12-29T09:34:20Z")

</div>

Hi, I am trying to use elasticsearch filter plugin in logstash to query previous messages for the same session. Code: elasticsearch { hosts =\> \["localhost"\] query =\> "tags:Connection\_new AND session\_id:%…

---

## [SIEM rule override not working as expected](https://discuss.elastic.co/t/siem-rule-override-not-working-as-expected/253933)

<div class="topic-metadata">

**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Replies:** 6\
**Last updated:** [November 4, 2020, 12:55pm UTC](https://discuss.elastic.co/t/siem-rule-override-not-working-as-expected/253933 "2020-11-04T12:55:22Z")

</div>

Hello, Recently tried to use the severity overrides functionality for a SIEM rule, but this doesn't seem to work as expected. While trying to find what's going wrong I'd like to point out several things: When editing…

---

## [Can I retrieve the payload of an indexed term in \_search or \_mget?](https://discuss.elastic.co/t/can-i-retrieve-the-payload-of-an-indexed-term-in--search-or--mget/37509)

<div class="topic-metadata">

**Author:** [@rjprice72](https://discuss.elastic.co/u/rjprice72)\
**Replies:** 6\
**Last updated:** [December 21, 2015, 5:15pm UTC](https://discuss.elastic.co/t/can-i-retrieve-the-payload-of-an-indexed-term-in--search-or--mget/37509 "2015-12-21T17:15:34Z")

</div>

We use a custom analyzer/token-filter on an index to produce some payload data on a specific term that gets added to the inverted index of the field. This payload supports a custom query, but sometimes it would be usefu…

---

## [Geo distance filter exceptions](https://discuss.elastic.co/t/geo-distance-filter-exceptions/18960)

<div class="topic-metadata">

**Author:** [@Madhavan\_Ramachandra](https://discuss.elastic.co/u/Madhavan_Ramachandra)\
**Replies:** 6\
**Last updated:** [July 31, 2014, 7:42am UTC](https://discuss.elastic.co/t/geo-distance-filter-exceptions/18960 "2014-07-31T07:42:55Z")

</div>

Hi Team, I am trying to find a solution for the below 1. Geo boundary based search.. My index have property for lat and lon as double.. not as a geopoint.. Here is my mapping for my index.. How do i u…

---

## [ML: count vs low/high-count detector functions](https://discuss.elastic.co/t/ml-count-vs-low-high-count-detector-functions/293329)

<div class="topic-metadata">

**Author:** [@shabnam](https://discuss.elastic.co/u/shabnam)\
**Replies:** 2\
**Last updated:** [January 26, 2022, 6:03am UTC](https://discuss.elastic.co/t/ml-count-vs-low-high-count-detector-functions/293329 "2022-01-26T06:03:26Z")

</div>

Hello I would like to know what is the difference between “count”, “low count”, and “high count”. I assume that “count” function includes the results from “low count”, "high count" and more ever. Please correct me if I…

---

## [ELK fails after enabling : readOnlyRootFilesystem in psp:restricted](https://discuss.elastic.co/t/elk-fails-after-enabling-readonlyrootfilesystem-in-psp-restricted/265711)

<div class="topic-metadata">

**Author:** [@Mayank\_Srivastava](https://discuss.elastic.co/u/Mayank_Srivastava)\
**Replies:** 2\
**Last updated:** [March 2, 2021, 9:07am UTC](https://discuss.elastic.co/t/elk-fails-after-enabling-readonlyrootfilesystem-in-psp-restricted/265711 "2021-03-02T09:07:58Z")

</div>

Hi , We are running elasticsearch container in k8s environment with root filesystems in read-only mode (readOnlyRootFilesystem: true). So we tried to enable this and we observed all the three pods of elk fails. we are …

---

## [Massive Heap Usage (99%) on our "Warm" nodes](https://discuss.elastic.co/t/massive-heap-usage-99-on-our-warm-nodes/129178)

<div class="topic-metadata">

**Author:** [@diranged](https://discuss.elastic.co/u/diranged)\
**Replies:** 2\
**Last updated:** [April 23, 2018, 9:10pm UTC](https://discuss.elastic.co/t/massive-heap-usage-99-on-our-warm-nodes/129178 "2018-04-23T21:10:27Z")

</div>

Our cluster is operating pretty well .. but we noticed that our warm data nodes are under some intense JVM pressure. This could be self inflicted with our mappings and data size, but I am looking for a way to confirm thi…

---

## [Gsub processor to replace null values](https://discuss.elastic.co/t/gsub-processor-to-replace-null-values/105584)

<div class="topic-metadata">

**Author:** [@Pratiksha\_Tewary](https://discuss.elastic.co/u/Pratiksha_Tewary)\
**Replies:** 2\
**Last updated:** [October 27, 2017, 7:04pm UTC](https://discuss.elastic.co/t/gsub-processor-to-replace-null-values/105584 "2017-10-27T19:04:15Z")

</div>

Hi, I was wondering if there was a way to substitute null values with other string values using gsub processor in ingest node pipelines. Thanks.

---

## [Kibana nested Dashboard](https://discuss.elastic.co/t/kibana-nested-dashboard/93343)

<div class="topic-metadata">

**Author:** [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)\
**Replies:** 2\
**Last updated:** [July 18, 2017, 6:17am UTC](https://discuss.elastic.co/t/kibana-nested-dashboard/93343 "2017-07-18T06:17:37Z")

</div>

Is there any possibility of creating the nested dashboard in kibana? Example: I have timestamp,no of devices and battery level details in my log file.i need to create 3 dashboard which should be nested , if i click…

---

## [Dashboard Grid](https://discuss.elastic.co/t/dashboard-grid/92476)

<div class="topic-metadata">

**Author:** [@Helix](https://discuss.elastic.co/u/Helix)\
**Replies:** 2\
**Last updated:** [July 10, 2017, 8:36pm UTC](https://discuss.elastic.co/t/dashboard-grid/92476 "2017-07-10T20:36:16Z")

</div>

Hello, I have created a new Dashboard on Kibana 5.5 and filled it with several line charts. When I created the visualizations, I went to the tab "Panel Settings" and activated Y-Axis Lines. However, when I switched…

---

## [Elasticsearch add mapping to existing index](https://discuss.elastic.co/t/elasticsearch-add-mapping-to-existing-index/67688)

<div class="topic-metadata">

**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\
**Replies:** 2\
**Last updated:** [December 1, 2016, 5:50pm UTC](https://discuss.elastic.co/t/elasticsearch-add-mapping-to-existing-index/67688 "2016-12-01T17:50:38Z")

</div>

I'm stumble upon Changing Mapping with Zero Downtime | Elastic blog post, however it's dated back in 2013. I need to add mapping to existing index, what is the best way to approach this? Thanks in advance.

---

## [Unable to filter more than 22 eventIDs](https://discuss.elastic.co/t/unable-to-filter-more-than-22-eventids/48358)

<div class="topic-metadata">

**Author:** [@Alreanaes](https://discuss.elastic.co/u/Alreanaes)\
**Replies:** 2\
**Last updated:** [April 27, 2016, 12:53pm UTC](https://discuss.elastic.co/t/unable-to-filter-more-than-22-eventids/48358 "2016-04-27T12:53:08Z")

</div>

The relevant output from -e -d "\*" DBG WinEventLog\[ForwardedEvents\] using subscription query=\<QueryList\> \<Query Id="0"\> \<Select Path="ForwardedEvents"\>\*\[System\[(EventID=1 or EventID=2 or EventID=3 or EventID=4 o…

---

## [Workplace /Salesforce connector missing data](https://discuss.elastic.co/t/workplace-salesforce-connector-missing-data/249193)

<div class="topic-metadata">

**Author:** [@Gertjan](https://discuss.elastic.co/u/Gertjan)\
**Replies:** 5\
**Last updated:** [September 22, 2020, 4:40pm UTC](https://discuss.elastic.co/t/workplace-salesforce-connector-missing-data/249193 "2020-09-22T16:40:40Z")

</div>

Hi there, I installed Enterprise Search 7.9.1 (Workplace) with Elasticsearch 7.9.0 on a Mac (localhost). I was able to connect the Github and Dropbox connector and retrieve the data in the index. I also activated the S…

---

## [How to perform a search query on an indexed document using Java](https://discuss.elastic.co/t/how-to-perform-a-search-query-on-an-indexed-document-using-java/304259)

<div class="topic-metadata">

**Author:** [@Tasdiq\_Shaikh](https://discuss.elastic.co/u/Tasdiq_Shaikh)\
**Replies:** 5\
**Last updated:** [May 9, 2022, 4:30pm UTC](https://discuss.elastic.co/t/how-to-perform-a-search-query-on-an-indexed-document-using-java/304259 "2022-05-09T16:30:40Z")

</div>

Hello, I'm using Elasticsearch 17.12.0 and Java 1.8. I am able to perform a search operation on an indexed document via Kibana, I want to know how I can perform this task using my Java Springboot app which is already c…

---

## [Update a variable in a scripted field definition](https://discuss.elastic.co/t/update-a-variable-in-a-scripted-field-definition/301350)

<div class="topic-metadata">

**Author:** [@uncleAlbert](https://discuss.elastic.co/u/uncleAlbert)\
**Replies:** 5\
**Last updated:** [April 5, 2022, 10:57am UTC](https://discuss.elastic.co/t/update-a-variable-in-a-scripted-field-definition/301350 "2022-04-05T10:57:10Z")

</div>

Is there a way to update a variable within a scripted field in Kibana? Say I had the following scripted field. MAP car \["bob":"toyota"\]; if (car.containsKey(doc\["owner"\].value)){ return car.get(doc\["owner"\].value); …

---

## [Y-axis string,legend not visible in kibana reporting](https://discuss.elastic.co/t/y-axis-string-legend-not-visible-in-kibana-reporting/78103)

<div class="topic-metadata">

**Author:** [@iyyappan13391](https://discuss.elastic.co/u/iyyappan13391)\
**Replies:** 5\
**Last updated:** [March 20, 2017, 11:54am UTC](https://discuss.elastic.co/t/y-axis-string-legend-not-visible-in-kibana-reporting/78103 "2017-03-20T11:54:45Z")

</div>

Xpack reporting having issues with y-axis and legends ,please help me on this. Please refer to the attachment. y-axis upper and lower value , only half is visible legends are half cut.

---

## [How to visualise this data on a single stacked histogram?](https://discuss.elastic.co/t/how-to-visualise-this-data-on-a-single-stacked-histogram/76635)

<div class="topic-metadata">

**Author:** [@stevedearl](https://discuss.elastic.co/u/stevedearl)\
**Replies:** 5\
**Last updated:** [March 1, 2017, 10:37am UTC](https://discuss.elastic.co/t/how-to-visualise-this-data-on-a-single-stacked-histogram/76635 "2017-03-01T10:37:09Z")

</div>

Hi Kibana-peeps, Can anyone provide some advice on how to create a single, stacked histogram based on the following data. At the moment everything I'm trying results in split charts which I'd like to avoid. My data i…

---

## [The best way to collect custom data?](https://discuss.elastic.co/t/the-best-way-to-collect-custom-data/180230)

<div class="topic-metadata">

**Author:** [@Todd\_Sayers](https://discuss.elastic.co/u/Todd_Sayers)\
**Replies:** 0\
**Last updated:** [May 8, 2019, 6:14pm UTC](https://discuss.elastic.co/t/the-best-way-to-collect-custom-data/180230 "2019-05-08T18:14:15Z")

</div>

I'd like to know the "correct" or "best" way to get custom metrics (e.g., Lustre performance, OPA topology, etc) into ES using the Beats "system." My first thought was to create a Metricbeat module. I've also seen Execb…

---

## [Kibana Plugins Degraded](https://discuss.elastic.co/t/kibana-plugins-degraded/309748)

<div class="topic-metadata">

**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\
**Replies:** 4\
**Last updated:** [July 15, 2022, 4:22pm UTC](https://discuss.elastic.co/t/kibana-plugins-degraded/309748 "2022-07-15T16:22:42Z")

</div>

Hi there, I´ve done a few searchs for this kind of solution and I could not find anywhere. Can someone help me? Jul 15 12:00:36 kbn kibana\[3899\]: \[2022-07-15T12:00:36.438-03:00\]\[ERROR\]\[plugins.securitySolution\] Bulk…

---

## [Where could I find all fields content in event.action?](https://discuss.elastic.co/t/where-could-i-find-all-fields-content-in-event-action/307718)

<div class="topic-metadata">

**Author:** [@Shadow\_CHN](https://discuss.elastic.co/u/Shadow_CHN)\
**Replies:** 4\
**Last updated:** [June 22, 2022, 3:28am UTC](https://discuss.elastic.co/t/where-could-i-find-all-fields-content-in-event-action/307718 "2022-06-22T03:28:56Z")

</div>

field event.action can be found in Discover and Security module, my question is where can I find a document explains event.action includes how many and what actions? Like Winlogbeat\\module\\security\\ingest\\security.yml, e…

---

## [Kibana alert condition](https://discuss.elastic.co/t/kibana-alert-condition/262645)

<div class="topic-metadata">

**Author:** [@Guy\_Assaf](https://discuss.elastic.co/u/Guy_Assaf)\
**Replies:** 1\
**Last updated:** [January 29, 2021, 1:13pm UTC](https://discuss.elastic.co/t/kibana-alert-condition/262645 "2021-01-29T13:13:10Z")

</div>

See the image, I'm trying to define an alert such that a certain percentage will trigger the alert. Two issues: how to take the ERROR/SUCCESS doc from the list, I tried with (buckets{key:SUCCESS} which does not work) t…

---

## [Filebeat S3 issue](https://discuss.elastic.co/t/filebeat-s3-issue/230441)

<div class="topic-metadata">

**Author:** [@cbeprem](https://discuss.elastic.co/u/cbeprem)\
**Replies:** 4\
**Last updated:** [May 7, 2020, 9:53pm UTC](https://discuss.elastic.co/t/filebeat-s3-issue/230441 "2020-05-07T21:53:49Z")

</div>

Hi team , I am trying to ingest logs from S3 using filebeat and SQS. It works fine when the format is logss/source/year2020/month04/day10/hour08/2020-04-10.log but the original format for some logs is as below and …

---

## [Kibana 7.6 crashing in docker](https://discuss.elastic.co/t/kibana-7-6-crashing-in-docker/228910)

<div class="topic-metadata">

**Author:** [@vbhat](https://discuss.elastic.co/u/vbhat)\
**Replies:** 4\
**Last updated:** [April 21, 2020, 2:52pm UTC](https://discuss.elastic.co/t/kibana-7-6-crashing-in-docker/228910 "2020-04-21T14:52:35Z")

</div>

Hi, While trying to run kibana 7.6.2 in docker I am constantly facing the below issue where kibana crashes. I am running this inside HahsiCorp Nomad. \<--- Last few GCs ---\> \[6:0x41307d0\] 184257 ms: Mark-sweep 1020.5…

---

## [Blank page with sidebar after upgrading from 2.4 to 5.3](https://discuss.elastic.co/t/blank-page-with-sidebar-after-upgrading-from-2-4-to-5-3/81857)

<div class="topic-metadata">

**Author:** [@quimnuss](https://discuss.elastic.co/u/quimnuss)\
**Replies:** 4\
**Last updated:** [April 13, 2017, 7:48pm UTC](https://discuss.elastic.co/t/blank-page-with-sidebar-after-upgrading-from-2-4-to-5-3/81857 "2017-04-13T19:48:23Z")

</div>

Hello everyone, Today I decided to upgrade ELK following the instructions on https://www.elastic.co/guide/en/kibana/current/upgrade.html and friends (elasticsearch, filebeat, logstash) After all was completed, I onl…

---

## [Elasticsearch/data size reduction after restart](https://discuss.elastic.co/t/elasticsearch-data-size-reduction-after-restart/62555)

<div class="topic-metadata">

**Author:** [@espogian](https://discuss.elastic.co/u/espogian)\
**Replies:** 4\
**Last updated:** [October 8, 2016, 9:17am UTC](https://discuss.elastic.co/t/elasticsearch-data-size-reduction-after-restart/62555 "2016-10-08T09:17:55Z")

</div>

Hello, I'm running Elasticsearch on a Docker container. I start the container mapping the folder /usr/share/elasticsearch/data on a local folder in order to retain the data even if the container is destroyed. I have noti…

---

## [Numeric term(and terms) query much slower after 5.6.15 -\> 7.1.1 upgrade](https://discuss.elastic.co/t/numeric-term-and-terms-query-much-slower-after-5-6-15-7-1-1-upgrade/222894)

<div class="topic-metadata">

**Author:** [@hyf\_bd](https://discuss.elastic.co/u/hyf_bd)\
**Replies:** 7\
**Last updated:** [March 11, 2020, 2:30pm UTC](https://discuss.elastic.co/t/numeric-term-and-terms-query-much-slower-after-5-6-15-7-1-1-upgrade/222894 "2020-03-11T14:30:23Z")

</div>

the same settings, mapping , query, and the data. all of things is the same, except es version. the follow query cost 400+ms in es5, but cost 600+ms in es7. we compare the profile, had found that: term query ( term…

---

## [InvalidIndexNameException must not contain whitespace](https://discuss.elastic.co/t/invalidindexnameexception-must-not-contain-whitespace/4590)

<div class="topic-metadata">

**Author:** [@Jack\_Park](https://discuss.elastic.co/u/Jack_Park)\
**Replies:** 7\
**Last updated:** [June 10, 2011, 8:31am UTC](https://discuss.elastic.co/t/invalidindexnameexception-must-not-contain-whitespace/4590 "2011-06-10T08:31:33Z")

</div>

Sent again from my email account: the message I posted online is hung up in approval even though I registered, and it's followed by two spam messages. I missed the "subscribe" part after registering. Running 0.16.2 …

---

## [Index.mapping.ignore\_malformed for all new indices](https://discuss.elastic.co/t/index-mapping-ignore-malformed-for-all-new-indices/83026)

<div class="topic-metadata">

**Author:** [@A\_B](https://discuss.elastic.co/u/A_B)\
**Replies:** 1\
**Last updated:** [April 20, 2017, 10:11am UTC](https://discuss.elastic.co/t/index-mapping-ignore-malformed-for-all-new-indices/83026 "2017-04-20T10:11:25Z")

</div>

Hello all, I have struggled with this for a few days now trying all the documentation and this forum without much luck... I'm using Elastic Stack for a classic centralised logging use case. ES 5.2.2. Logstash is crea…

---

## [No matching template for flow id 257](https://discuss.elastic.co/t/no-matching-template-for-flow-id-257/49233)

<div class="topic-metadata">

**Author:** [@stecino](https://discuss.elastic.co/u/stecino)\
**Replies:** 1\
**Last updated:** [May 6, 2016, 1:49am UTC](https://discuss.elastic.co/t/no-matching-template-for-flow-id-257/49233 "2016-05-06T01:49:39Z")

</div>

Hello, I have the following Netflow config: input { udp { host =\> "0.0.0.0" port =\> 5599 codec =\> netflow { definitions =\> "/home/t/logstash-2.2.2/vendor/bundle/jruby/1.9/gems/logstash-…

---

## [SSLException](https://discuss.elastic.co/t/sslexception/33842)

<div class="topic-metadata">

**Author:** [@Pradeep\_Gowda](https://discuss.elastic.co/u/Pradeep_Gowda)\
**Replies:** 1\
**Last updated:** [November 10, 2015, 1:47pm UTC](https://discuss.elastic.co/t/sslexception/33842 "2015-11-10T13:47:48Z")

</div>

I am getting below exception after enabling SSL. I am using self signed. \[ netty.handler.ssl.SslHandler\] Failed to clean up SSLEngine. javax.net.ssl.SSLException: Inbound closed before receiving peer's close\_notify: po…

---

## [Elastic Defend - Is default logging on the endpoint enough?](https://discuss.elastic.co/t/elastic-defend-is-default-logging-on-the-endpoint-enough/346296)

<div class="topic-metadata">

**Author:** [@h49nakxs](https://discuss.elastic.co/u/h49nakxs)\
**Replies:** 2\
**Last updated:** [November 14, 2023, 9:27am UTC](https://discuss.elastic.co/t/elastic-defend-is-default-logging-on-the-endpoint-enough/346296 "2023-11-14T09:27:54Z")

</div>

Hello, If I use "Elastic Defend" integration, will all the Elastic Security detection rules get enough information to be triggered or do I need to enhance the logging on the endpoints (for example with Sysmon on Windows…

---

## [Elasticsearch.keystore location](https://discuss.elastic.co/t/elasticsearch-keystore-location/248575)

<div class="topic-metadata">

**Author:** [@ben-charles](https://discuss.elastic.co/u/ben-charles)\
**Replies:** 1\
**Last updated:** [September 15, 2020, 11:47am UTC](https://discuss.elastic.co/t/elasticsearch-keystore-location/248575 "2020-09-15T11:47:49Z")

</div>

Is it possible to configure where elasticsearch.keystore is created? We would like to have it in a separate directory from the config/ directory.

---

## [Is there a way to get all visualizations of ".kibana-6" index using curl](https://discuss.elastic.co/t/is-there-a-way-to-get-all-visualizations-of-kibana-6-index-using-curl/151998)

<div class="topic-metadata">

**Author:** [@sahil\_sawhney](https://discuss.elastic.co/u/sahil_sawhney)\
**Replies:** 1\
**Last updated:** [October 11, 2018, 10:30am UTC](https://discuss.elastic.co/t/is-there-a-way-to-get-all-visualizations-of-kibana-6-index-using-curl/151998 "2018-10-11T10:30:28Z")

</div>

Our kibana index was reindexed and it had a name ".kibana-6" Initially we used to get all visualizations via command localhost:9200/.kibana/visualization/\_search?pretty But now the index is changed and the following c…

---

## [Mutate gsub \\ not working](https://discuss.elastic.co/t/mutate-gsub-not-working/233455)

<div class="topic-metadata">

**Author:** [@Rafael\_Pereira\_Silva](https://discuss.elastic.co/u/Rafael_Pereira_Silva)\
**Replies:** 3\
**Last updated:** [May 21, 2020, 3:41am UTC](https://discuss.elastic.co/t/mutate-gsub-not-working/233455 "2020-05-21T03:41:45Z")

</div>

Hello, I have a log .... \\"pattern\\":\\"^\[0-9\]{9}$\\"},\\"typeId\\":{\\"enum\\":\[32\], \\"mysensitivefield\\":\\"ASDASDLAASDASDASLDASDAZ\\" , I need to replace mysensitivefield information. getting like this \*\*\*\*\*\*\*\*\*\* : \*\*\*\*\*…

---

## [Index lifecycle management runs into IndexNotFoundException](https://discuss.elastic.co/t/index-lifecycle-management-runs-into-indexnotfoundexception/169625)

<div class="topic-metadata">

**Author:** [@wei1](https://discuss.elastic.co/u/wei1)\
**Replies:** 3\
**Last updated:** [February 25, 2019, 7:59pm UTC](https://discuss.elastic.co/t/index-lifecycle-management-runs-into-indexnotfoundexception/169625 "2019-02-25T19:59:58Z")

</div>

Hi, I'm starting to use index lifecycle management policy to delete index that's been created for xx time. Here's the policy: { "policy": { "phases": { "hot": { "actions": {}}, "delete": …

---

## [Flush.total numbers are big different in cluster](https://discuss.elastic.co/t/flush-total-numbers-are-big-different-in-cluster/162886)

<div class="topic-metadata">

**Author:** [@jasony](https://discuss.elastic.co/u/jasony)\
**Replies:** 8\
**Last updated:** [January 7, 2019, 6:13am UTC](https://discuss.elastic.co/t/flush-total-numbers-are-big-different-in-cluster/162886 "2019-01-07T06:13:25Z")

</div>

Hello, My cluster consists of 9nodes and uses hot-warm architecture. 01: coordinating 02,03: master eligible nodes 04,05,06: hot 07,08,09: warm I have questions about flush.total results from \_cat api's. As we see…

---

## [Using grok on just one field](https://discuss.elastic.co/t/using-grok-on-just-one-field/142234)

<div class="topic-metadata">

**Author:** [@CoopTang](https://discuss.elastic.co/u/CoopTang)\
**Replies:** 3\
**Last updated:** [July 30, 2018, 6:40pm UTC](https://discuss.elastic.co/t/using-grok-on-just-one-field/142234 "2018-07-30T18:40:26Z")

</div>

So I have been trying to figure out how to use grok on just one field from the input. Specifically, I'm using the beats input to get all my logs, and it automatically produces a bunch of fields for kibana. One of those f…

---

## [Count number of occurences based on a condition](https://discuss.elastic.co/t/count-number-of-occurences-based-on-a-condition/134446)

<div class="topic-metadata">

**Author:** [@javidr](https://discuss.elastic.co/u/javidr)\
**Replies:** 3\
**Last updated:** [June 5, 2018, 3:07pm UTC](https://discuss.elastic.co/t/count-number-of-occurences-based-on-a-condition/134446 "2018-06-05T15:07:45Z")

</div>

Hi Im having some issues with Kibana, as it doesnt work well with nested data (it is, a json inside the main json) To solve it, i have had to flatten it, so, for example {"car": "Ford, "Model": "Mondeo", "details"…

---

## [Downgrade 7.16.1 to 7.10](https://discuss.elastic.co/t/downgrade-7-16-1-to-7-10/310144)

<div class="topic-metadata">

**Author:** [@sameer\_khamkar](https://discuss.elastic.co/u/sameer_khamkar)\
**Replies:** 2\
**Last updated:** [July 20, 2022, 9:46pm UTC](https://discuss.elastic.co/t/downgrade-7-16-1-to-7-10/310144 "2022-07-20T21:46:24Z")

</div>

Hello Team, We are in situation where we want to downgrade from7.16.1 to 7.10.2 , we are using Graylog 4 , Mongodb & Elasticsearch Do I need to downgrade the whole stack, or can I downgrade partly? Please guide, Reg…

---

## [Only Exact Search Matches for Quoted Phrases](https://discuss.elastic.co/t/only-exact-search-matches-for-quoted-phrases/176698)

<div class="topic-metadata">

**Author:** [@timlwhite](https://discuss.elastic.co/u/timlwhite)\
**Replies:** 2\
**Last updated:** [April 15, 2019, 2:47pm UTC](https://discuss.elastic.co/t/only-exact-search-matches-for-quoted-phrases/176698 "2019-04-15T14:47:18Z")

</div>

Hello - I need to enable searches that return only exact matches for quoted phrases. For example "Bank of America" should not return results that only contain "America" or "bank" as these are common words in the search…

---

## [Cannot delete watchers when using basic license](https://discuss.elastic.co/t/cannot-delete-watchers-when-using-basic-license/110800)

<div class="topic-metadata">

**Author:** [@tjliu](https://discuss.elastic.co/u/tjliu)\
**Replies:** 2\
**Last updated:** [December 8, 2017, 10:56am UTC](https://discuss.elastic.co/t/cannot-delete-watchers-when-using-basic-license/110800 "2017-12-08T10:56:03Z")

</div>

Hi, I got same issue with this link which happened from trial license to basic license. Cannot delete watchers when using basic license · Issue #23490 · elastic/elasticsearch · GitHub, but I can not find answer at her…

---

## [Modify Kibana UI](https://discuss.elastic.co/t/modify-kibana-ui/70575)

<div class="topic-metadata">

**Author:** [@pratheek\_k](https://discuss.elastic.co/u/pratheek_k)\
**Replies:** 2\
**Last updated:** [January 4, 2017, 10:17pm UTC](https://discuss.elastic.co/t/modify-kibana-ui/70575 "2017-01-04T22:17:41Z")

</div>

I am using kibana 5.0.0. I would like to customize kibana UI. Here are my requirements 1) After user logs into kibana via sheild, can i restrict the access of the users to few pages. I dont want users to access Manageme…

---

## [Elasticsearch Filter - how to query term in a specific index](https://discuss.elastic.co/t/elasticsearch-filter-how-to-query-term-in-a-specific-index/44168)

<div class="topic-metadata">

**Author:** [@MikeM](https://discuss.elastic.co/u/MikeM)\
**Replies:** 2\
**Last updated:** [March 12, 2016, 10:44pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-how-to-query-term-in-a-specific-index/44168 "2016-03-12T22:44:38Z")

</div>

I'm trying to use the Elasticsearch filter in my logstash configuration to search a specific index for a term. I need help building the query. Would the following be valid? { "indices" : { "indices" : \[ …

---

## [Format of system.uptime.duration.ms in Metricbeat 7.2 (WIndows)](https://discuss.elastic.co/t/format-of-system-uptime-duration-ms-in-metricbeat-7-2-windows/187614)

<div class="topic-metadata">

**Author:** [@kagoadvs](https://discuss.elastic.co/u/kagoadvs)\
**Replies:** 3\
**Last updated:** [July 16, 2019, 2:52pm UTC](https://discuss.elastic.co/t/format-of-system-uptime-duration-ms-in-metricbeat-7-2-windows/187614 "2019-07-16T14:52:03Z")

</div>

Does anyone know the format of system.uptime.duration.ms send by Metricbeat 7.2 (Windows). The number jumped a lot when I upgraded to Metricbeat 7.2 on my Windows Servers (2016).

[Previous page](https://discuss.elastic.co/top.md?page=1273&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1275&per_page=50&period=all)