# Top

**URL:** https://discuss.elastic.co/top.md?page=128&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 129

---

## [Date parsing error](https://discuss.elastic.co/t/date-parsing-error/95493)

<div class="topic-metadata">

**Author:** [@asgoh05](https://discuss.elastic.co/u/asgoh05)\
**Replies:** 10\
**Last updated:** [August 3, 2017, 5:31am UTC](https://discuss.elastic.co/t/date-parsing-error/95493 "2017-08-03T05:31:15Z")

</div>

Hello, I’m beginner of ELK. I got a problem while mapping date of my log file. Does anybody know how to map this kind of date format ? (20170802-022130.497289) My mapping source --\> “column1”: { “type”: “date”, “fo…

---

## [Not able to index documents using app search(7.6.1)](https://discuss.elastic.co/t/not-able-to-index-documents-using-app-search-7-6-1/222893)

<div class="topic-metadata">

**Author:** [@Jaaved\_Ali\_Khan](https://discuss.elastic.co/u/Jaaved_Ali_Khan)\
**Replies:** 18\
**Last updated:** [March 20, 2020, 3:28pm UTC](https://discuss.elastic.co/t/not-able-to-index-documents-using-app-search-7-6-1/222893 "2020-03-20T15:28:42Z")

</div>

I was able successfully install app search on linux(ubuntu) with nginx as reverse proxy to app search, my configs are: Nginx: upstream kombare-search { server 127.0.0.1:3002; keepalive 15; } server { serve…

---

## [No errors but nothing gets indexed when using the Bulk API](https://discuss.elastic.co/t/no-errors-but-nothing-gets-indexed-when-using-the-bulk-api/240200)

<div class="topic-metadata">

**Author:** [@Rosho](https://discuss.elastic.co/u/Rosho)\
**Replies:** 13\
**Last updated:** [July 10, 2020, 3:48pm UTC](https://discuss.elastic.co/t/no-errors-but-nothing-gets-indexed-when-using-the-bulk-api/240200 "2020-07-10T15:48:23Z")

</div>

Hi I have written a script to read a list ("dummy") and index it into Elasticsearch. I converted the list into a list of dictionaries and used the "Bulk" API to index it into Elasticsearch. There are no errors but noth…

---

## [Kibana coordinate map doesn't load after installing kibana on centos 7](https://discuss.elastic.co/t/kibana-coordinate-map-doesnt-load-after-installing-kibana-on-centos-7/112017)

<div class="topic-metadata">

**Author:** [@yaser](https://discuss.elastic.co/u/yaser)\
**Replies:** 10\
**Last updated:** [December 18, 2017, 6:45am UTC](https://discuss.elastic.co/t/kibana-coordinate-map-doesnt-load-after-installing-kibana-on-centos-7/112017 "2017-12-18T06:45:57Z")

</div>

why after installing kibana 5.6.3 and insert location data to it , i want to visualize data by coordinate map chart in kibana but there is a problem , coordinate map doesnt load , !!!! after searching I concluded that u…

---

## [Elastic Cloud Console Showing Unhealthy Deployment](https://discuss.elastic.co/t/elastic-cloud-console-showing-unhealthy-deployment/298076)

<div class="topic-metadata">

**Author:** [@daniel.talbot](https://discuss.elastic.co/u/daniel.talbot)\
**Replies:** 9\
**Last updated:** [February 24, 2022, 8:26pm UTC](https://discuss.elastic.co/t/elastic-cloud-console-showing-unhealthy-deployment/298076 "2022-02-24T20:26:16Z")

</div>

I currently am seeing in my cloud ELK stack (2 hot, 2 warm, 1 Integration, 1 Kibana, 1 Master instance) showing that one of the warm instances and the master instance are both unhealthy. Both are under 30% JVM memory pr…

---

## [Not able to login to Kibana with gsuite saml](https://discuss.elastic.co/t/not-able-to-login-to-kibana-with-gsuite-saml/216793)

<div class="topic-metadata">

**Author:** [@Ravi\_Gusain](https://discuss.elastic.co/u/Ravi_Gusain)\
**Replies:** 12\
**Last updated:** [January 30, 2020, 5:55am UTC](https://discuss.elastic.co/t/not-able-to-login-to-kibana-with-gsuite-saml/216793 "2020-01-30T05:55:13Z")

</div>

HI, I have enabled all the necessary features for SAML to work with ELK stack following below article on a test elk setup hosted in AWS environment https://www.elastic.co/guide/en/elasticsearch/reference/6.5/saml-guide…

---

## [Cannot connect to elasticsearch but i have connected to kibana](https://discuss.elastic.co/t/cannot-connect-to-elasticsearch-but-i-have-connected-to-kibana/247224)

<div class="topic-metadata">

**Author:** [@talaatkamal](https://discuss.elastic.co/u/talaatkamal)\
**Replies:** 10\
**Last updated:** [September 3, 2020, 10:51am UTC](https://discuss.elastic.co/t/cannot-connect-to-elasticsearch-but-i-have-connected-to-kibana/247224 "2020-09-03T10:51:54Z")

</div>

I cannot connect to elasticsearch , when I try to connect it through client winlogbeat , connection refused by server.

---

## [Unable to create "Maps" visualization - Getting "Selected index pattern does not contain source and destination fields."](https://discuss.elastic.co/t/unable-to-create-maps-visualization-getting-selected-index-pattern-does-not-contain-source-and-destination-fields/276683)

<div class="topic-metadata">

**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\
**Replies:** 11\
**Last updated:** [June 30, 2021, 2:29pm UTC](https://discuss.elastic.co/t/unable-to-create-maps-visualization-getting-selected-index-pattern-does-not-contain-source-and-destination-fields/276683 "2021-06-30T14:29:25Z")

</div>

I'm unable to create "Maps" visualization. I get the error "Selected index pattern does not contain source and destination fields." I'm on version 7.13.2 ELK I used geoip to define the source and destination IP fields …

---

## [Unable to form cluster after half of cluster nodes was removed - ES 7.1](https://discuss.elastic.co/t/unable-to-form-cluster-after-half-of-cluster-nodes-was-removed-es-7-1/188063)

<div class="topic-metadata">

**Author:** [@plundgren](https://discuss.elastic.co/u/plundgren)\
**Replies:** 9\
**Last updated:** [June 28, 2019, 10:25pm UTC](https://discuss.elastic.co/t/unable-to-form-cluster-after-half-of-cluster-nodes-was-removed-es-7-1/188063 "2019-06-28T22:25:50Z")

</div>

Hi, Had six nodes (all master eligible) running in our cluster and then three nodes was removed, volumes gone. The three nodes that was removed were excluded from shard allocation with setting: "cluster.routing.alloca…

---

## [Logstash multiline filter not merging xml after new line](https://discuss.elastic.co/t/logstash-multiline-filter-not-merging-xml-after-new-line/57827)

<div class="topic-metadata">

**Author:** [@beelastic](https://discuss.elastic.co/u/beelastic)\
**Replies:** 14\
**Last updated:** [May 31, 2017, 7:54am UTC](https://discuss.elastic.co/t/logstash-multiline-filter-not-merging-xml-after-new-line/57827 "2017-05-31T07:54:41Z")

</div>

I want to parse xml files with logstash Example File: \<?xml version="1.0" encoding="UTF-8"?\> \<ns1:Alert\_E01 xmlns:ns1="urn:contoso.com:elasticSearch:alert"\>\<Alerts\>\<Alert\>\<PI\_SID\>SPI\</PI\_SID\>\</Alert\>\</Alerts\>\</ns1:Al…

---

## [LS environment variable handling doesn't appear to behave as documented](https://discuss.elastic.co/t/ls-environment-variable-handling-doesnt-appear-to-behave-as-documented/73828)

<div class="topic-metadata">

**Author:** [@nick-george](https://discuss.elastic.co/u/nick-george)\
**Replies:** 12\
**Last updated:** [February 8, 2017, 10:02am UTC](https://discuss.elastic.co/t/ls-environment-variable-handling-doesnt-appear-to-behave-as-documented/73828 "2017-02-08T10:02:07Z")

</div>

Hi, LS Version: 5.1.2 (RPM) From the docs (https://www.elastic.co/guide/en/logstash/current/environment-variables.html): You can add environment variable references in any plugin option type : string, number, bool…

---

## [Logstash on docker: configure sincedb file to use the last indexed position whenever container restarts/new](https://discuss.elastic.co/t/logstash-on-docker-configure-sincedb-file-to-use-the-last-indexed-position-whenever-container-restarts-new/241537)

<div class="topic-metadata">

**Author:** [@rahulnama](https://discuss.elastic.co/u/rahulnama)\
**Replies:** 11\
**Last updated:** [July 17, 2020, 9:22pm UTC](https://discuss.elastic.co/t/logstash-on-docker-configure-sincedb-file-to-use-the-last-indexed-position-whenever-container-restarts-new/241537 "2020-07-17T21:22:57Z")

</div>

Hi Team I mounted the logstash sincedb position to a persistent volume assuming logstash will remember the position of last indexed log. But every time I create/restart a container it's pushing all the logs again to ela…

---

## [How to import 10 millions of documents (about 5G) into app search?](https://discuss.elastic.co/t/how-to-import-10-millions-of-documents-about-5g-into-app-search/211716)

<div class="topic-metadata">

**Author:** [@viphuangwei](https://discuss.elastic.co/u/viphuangwei)\
**Replies:** 13\
**Last updated:** [January 8, 2020, 3:50am UTC](https://discuss.elastic.co/t/how-to-import-10-millions-of-documents-about-5g-into-app-search/211716 "2020-01-08T03:50:14Z")

</div>

Hi There, How to import 10 million of documents (about 5G) into the App search (self-managed)? What's the best practice to do it? Is there any limitation to do this. Thanks, Wei.

---

## [Sharing of Pre-Configured Dashboard](https://discuss.elastic.co/t/sharing-of-pre-configured-dashboard/91052)

<div class="topic-metadata">

**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\
**Replies:** 11\
**Last updated:** [June 28, 2017, 1:22pm UTC](https://discuss.elastic.co/t/sharing-of-pre-configured-dashboard/91052 "2017-06-28T13:22:14Z")

</div>

Hello all, I created a Dashboard now i wants to export it to another person for visualization through shell script so i wants to know the location where the json format is stored Thanks & Regards Shrikant

---

## [How can i use kibana as plugin](https://discuss.elastic.co/t/how-can-i-use-kibana-as-plugin/92665)

<div class="topic-metadata">

**Author:** [@riyajohnsnow](https://discuss.elastic.co/u/riyajohnsnow)\
**Replies:** 21\
**Last updated:** [July 18, 2017, 8:50am UTC](https://discuss.elastic.co/t/how-can-i-use-kibana-as-plugin/92665 "2017-07-18T08:50:16Z")

</div>

Hello sir i install kibana into my project as a plugin from "https://www.npmjs.com/package/kibana" but how it's work i can't getting. if you have another idea for how can i used kibana as a plugin into my project plea…

---

## [Kibana:getting past login page with selenium](https://discuss.elastic.co/t/kibana-getting-past-login-page-with-selenium/269782)

<div class="topic-metadata">

**Author:** [@jmlucjav](https://discuss.elastic.co/u/jmlucjav)\
**Replies:** 14\
**Last updated:** [April 15, 2021, 6:20pm UTC](https://discuss.elastic.co/t/kibana-getting-past-login-page-with-selenium/269782 "2021-04-15T18:20:51Z")

</div>

I am trying to get some to some pages in kibana through selenium/crome dirver. I have seen some samples from some time ago where providing the user/pwd in the url worked, but now, if I do this, still gets me to the page …

---

## [\[filebeat\] no registry updates and high memory usage after changing tail\_files from true to false](https://discuss.elastic.co/t/filebeat-no-registry-updates-and-high-memory-usage-after-changing-tail-files-from-true-to-false/66908)

<div class="topic-metadata">

**Author:** [@shog](https://discuss.elastic.co/u/shog)\
**Replies:** 10\
**Last updated:** [November 28, 2016, 11:07pm UTC](https://discuss.elastic.co/t/filebeat-no-registry-updates-and-high-memory-usage-after-changing-tail-files-from-true-to-false/66908 "2016-11-28T23:07:12Z")

</div>

Unfortunately I've noticed yet another problem with registry file updates in my setup: Filebeat Version: 5.0.1 Steps to repro: 1) Start filebeat with tail\_files: true to get initial state of files. tail\_files: …

---

## [Cert error connecting standalone vm logstash to docker ece build?](https://discuss.elastic.co/t/cert-error-connecting-standalone-vm-logstash-to-docker-ece-build/221109)

<div class="topic-metadata">

**Author:** [@lcarr](https://discuss.elastic.co/u/lcarr)\
**Replies:** 13\
**Last updated:** [March 16, 2020, 10:35pm UTC](https://discuss.elastic.co/t/cert-error-connecting-standalone-vm-logstash-to-docker-ece-build/221109 "2020-03-16T22:35:37Z")

</div>

We are finding that the standalone logstash does not connect over to the ece build on docker. We are getting certificate errors. Is that because of stunnel handling the TLS activity or is there something else that we a…

---

## [Pipelines not working but work when launched separately](https://discuss.elastic.co/t/pipelines-not-working-but-work-when-launched-separately/154330)

<div class="topic-metadata">

**Author:** [@wheelq](https://discuss.elastic.co/u/wheelq)\
**Replies:** 12\
**Last updated:** [December 4, 2018, 7:43pm UTC](https://discuss.elastic.co/t/pipelines-not-working-but-work-when-launched-separately/154330 "2018-12-04T19:43:24Z")

</div>

Has anyone managed to get pipelines working? Here are my observations: My pipelines.yml file: pipeline.id: httppipeline path.config: "http.conf" pipeline.id: ftppipeline path.config: "ftp.conf" After launching …

---

## [Elasticsearch s3 plugin error "repository\_verification\_exception"](https://discuss.elastic.co/t/elasticsearch-s3-plugin-error-repository-verification-exception/286781)

<div class="topic-metadata">

**Author:** [@Mark\_Laff](https://discuss.elastic.co/u/Mark_Laff)\
**Replies:** 10\
**Last updated:** [October 18, 2021, 8:24pm UTC](https://discuss.elastic.co/t/elasticsearch-s3-plugin-error-repository-verification-exception/286781 "2021-10-18T20:24:17Z")

</div>

I'm running ES 6.8 locally (on Mac OS X installed via Homebrew) $ curl -sS -XGET 127.0.0.1:9200 { "name" : "JdRGfj8", "cluster\_name" : "elasticsearch\_brew", "cluster\_uuid" : "PahjUQpJTpy40myvs-sKMg", "version" :…

---

## [Confirm my steps on X-pack usage](https://discuss.elastic.co/t/confirm-my-steps-on-x-pack-usage/90809)

<div class="topic-metadata">

**Author:** [@vinod\_hy](https://discuss.elastic.co/u/vinod_hy)\
**Replies:** 10\
**Last updated:** [June 30, 2017, 9:35am UTC](https://discuss.elastic.co/t/confirm-my-steps-on-x-pack-usage/90809 "2017-06-30T09:35:42Z")

</div>

Hi , I have used x-pack in my ELK setup and i was able to achieve the secured communication. I will mention the steps that i have performed. Please tell me if i have followed it right. step1: i have installed x-pack …

---

## [Missing year set to 1970 by Logstash](https://discuss.elastic.co/t/missing-year-set-to-1970-by-logstash/265373)

<div class="topic-metadata">

**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\
**Replies:** 16\
**Last updated:** [February 24, 2021, 7:46pm UTC](https://discuss.elastic.co/t/missing-year-set-to-1970-by-logstash/265373 "2021-02-24T19:46:24Z")

</div>

Hi, Running ELK 7.10.1 Recently I started to process new type of logs that does not include the year, so they come with format "MMM dd HH:mm:ss". According to the Logstash documentation (and this post), in cases like…

---

## [UNABLE to filter the fields in the security alerts window](https://discuss.elastic.co/t/unable-to-filter-the-fields-in-the-security-alerts-window/324242)

<div class="topic-metadata">

**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\
**Replies:** 9\
**Last updated:** [February 18, 2023, 11:11pm UTC](https://discuss.elastic.co/t/unable-to-filter-the-fields-in-the-security-alerts-window/324242 "2023-02-18T23:11:07Z")

</div>

Hello every body, Many alerts are generated in the security Alerts window of elastic 8.3.1, Especially attempts of brute force: The winlog. event\_data. The TargetUserName field is the user-specific field. I'm no…

---

## [Adding added field to index](https://discuss.elastic.co/t/adding-added-field-to-index/335440)

<div class="topic-metadata">

**Author:** [@rexxdad](https://discuss.elastic.co/u/rexxdad)\
**Replies:** 12\
**Last updated:** [June 14, 2023, 2:33am UTC](https://discuss.elastic.co/t/adding-added-field-to-index/335440 "2023-06-14T02:33:17Z")

</div>

i use the docker elk stack on macos with the logstash http pipeline to accept our apps http posts as input it created an index (I didn't before) reviewing the content, there are two fields that combined could make a ge…

---

## [Invalid protocol when filebeat send to logstash](https://discuss.elastic.co/t/invalid-protocol-when-filebeat-send-to-logstash/316681)

<div class="topic-metadata">

**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\
**Replies:** 16\
**Last updated:** [October 15, 2022, 2:07pm UTC](https://discuss.elastic.co/t/invalid-protocol-when-filebeat-send-to-logstash/316681 "2022-10-15T14:07:06Z")

</div>

\[2022-10-15T11:01:12,651\]\[INFO \]\[org.logstash.beats.BeatsHandler\]\[terza\]\[7bd5f0adbbfa46b9e9ef1e064135c6f8c54b821b69f260da353a735193b5fe7d\] \[local: 172.19.1.12:5044, remote: 172.19.0.1:53380\] Handling exception: io.netty.…

---

## [Sitemap for example.com located at sub.example.com](https://discuss.elastic.co/t/sitemap-for-example-com-located-at-sub-example-com/262631)

<div class="topic-metadata">

**Author:** [@Marcelo\_da\_Silva](https://discuss.elastic.co/u/Marcelo_da_Silva)\
**Replies:** 11\
**Last updated:** [February 23, 2021, 2:35pm UTC](https://discuss.elastic.co/t/sitemap-for-example-com-located-at-sub-example-com/262631 "2021-02-23T14:35:31Z")

</div>

Hi, the sitemap of a website is located on a subdomain. Something like example.com (main) sub.example.com/sitemap\_index.xml (sitemap for example.com) example.com/robots.txt (it has a Sitemap key indicating the loca…

---

## [404 - missing repository error when trying to restore snapshot](https://discuss.elastic.co/t/404-missing-repository-error-when-trying-to-restore-snapshot/161474)

<div class="topic-metadata">

**Author:** [@Eva](https://discuss.elastic.co/u/Eva)\
**Replies:** 11\
**Last updated:** [December 20, 2018, 10:40am UTC](https://discuss.elastic.co/t/404-missing-repository-error-when-trying-to-restore-snapshot/161474 "2018-12-20T10:40:38Z")

</div>

Hello there I have an ES cluster with 2 nodes and i'm now switching to AWS ES domain and trying to migrate existing ELK logs to new AWS domain. I have registered a repo and also taken a snapshot of existing ES cluster b…

---

## [Cost for x-pack](https://discuss.elastic.co/t/cost-for-x-pack/85194)

<div class="topic-metadata">

**Author:** [@ishgupta](https://discuss.elastic.co/u/ishgupta)\
**Replies:** 9\
**Last updated:** [May 16, 2017, 10:01am UTC](https://discuss.elastic.co/t/cost-for-x-pack/85194 "2017-05-16T10:01:00Z")

</div>

Hello, Can anyone let me know, the costs for subscribing to X-pack ? How does it work in terms of using as a Service, or building it in-house ? I have tried contacting through the website, but could not receive a res…

---

## [Can we import one elastic search cluster data into another?](https://discuss.elastic.co/t/can-we-import-one-elastic-search-cluster-data-into-another/300529)

<div class="topic-metadata">

**Author:** [@Prashant\_Kamble](https://discuss.elastic.co/u/Prashant_Kamble)\
**Replies:** 14\
**Last updated:** [March 25, 2022, 9:14am UTC](https://discuss.elastic.co/t/can-we-import-one-elastic-search-cluster-data-into-another/300529 "2022-03-25T09:14:48Z")

</div>

We have two different clusters created on Elasticsearch server cluster 6.8 cluster 7.10 Just wanted to check is there any way to import data from one cluster to another? If yes, what are the ways to do it without re-i…

---

## [Logstash crash / failed to connect to es cluster](https://discuss.elastic.co/t/logstash-crash-failed-to-connect-to-es-cluster/32268)

<div class="topic-metadata">

**Author:** [@quejinho](https://discuss.elastic.co/u/quejinho)\
**Replies:** 11\
**Last updated:** [October 21, 2015, 2:58am UTC](https://discuss.elastic.co/t/logstash-crash-failed-to-connect-to-es-cluster/32268 "2015-10-21T02:58:27Z")

</div>

I have an Issue that when i killed logstash and runned it again it it should pass 5k of messages and it does not. There are two errors there One about no nodes avaible Second :message=\>"Got error to send bulk of act…

---

## [JVM Crash with APM](https://discuss.elastic.co/t/jvm-crash-with-apm/250712)

<div class="topic-metadata">

**Author:** [@Jose\_Angel\_Morena\_Si](https://discuss.elastic.co/u/Jose_Angel_Morena_Si)\
**Replies:** 19\
**Last updated:** [October 18, 2020, 6:26am UTC](https://discuss.elastic.co/t/jvm-crash-with-apm/250712 "2020-10-18T06:26:13Z")

</div>

Hello there, For some reason, it seems that both methods (manual and automatic), crash the JVM of my JBOSS applicattion. This applicattion runs Java 7. I have tried running both agents with Java 8 and the same Java as t…

---

## [FSCrawler Ingest pdf error Exceeds maximum allowed document size of 102400 bytes](https://discuss.elastic.co/t/fscrawler-ingest-pdf-error-exceeds-maximum-allowed-document-size-of-102400-bytes/273054)

<div class="topic-metadata">

**Author:** [@jeje232](https://discuss.elastic.co/u/jeje232)\
**Replies:** 10\
**Last updated:** [May 17, 2021, 9:40pm UTC](https://discuss.elastic.co/t/fscrawler-ingest-pdf-error-exceeds-maximum-allowed-document-size-of-102400-bytes/273054 "2021-05-17T21:40:29Z")

</div>

Hello, I want to use FSCrawler to push my pdf books on Workplace Search. I tried with different bulk\_size and flush\_interval but no way. I have the same maximum allowed document size error. My traces logs are: 18:51:…

---

## [Filter, facets and filtered query](https://discuss.elastic.co/t/filter-facets-and-filtered-query/4169)

<div class="topic-metadata">

**Author:** [@ruflin\_2](https://discuss.elastic.co/u/ruflin_2)\
**Replies:** 10\
**Last updated:** [November 25, 2013, 4:31pm UTC](https://discuss.elastic.co/t/filter-facets-and-filtered-query/4169 "2013-11-25T16:31:29Z")

</div>

Hi I'm refactoring the elastica client at the moment. So I realized that I'm not completely sure how filters, facets and filtered queries can be combined. Lets take the last example in the link below: http://www.…

---

## [Elasticsearch BULK API with .NET for upsert](https://discuss.elastic.co/t/elasticsearch-bulk-api-with-net-for-upsert/370003)

<div class="topic-metadata">

**Author:** [@Moni\_Hazarika](https://discuss.elastic.co/u/Moni_Hazarika)\
**Replies:** 16\
**Last updated:** [November 6, 2024, 6:34am UTC](https://discuss.elastic.co/t/elasticsearch-bulk-api-with-net-for-upsert/370003 "2024-11-06T06:34:22Z")

</div>

Hi Team, I am using .NET 8 and ES Version="8.15.6". I an trying to use bulk api with a logic for upsert based on the document id. I tried the below index, update commands from Kibana as per documentation and they work f…

---

## [Sending logs to syslog using logstash](https://discuss.elastic.co/t/sending-logs-to-syslog-using-logstash/334952)

<div class="topic-metadata">

**Author:** [@mariya](https://discuss.elastic.co/u/mariya)\
**Replies:** 16\
**Last updated:** [June 9, 2023, 2:43pm UTC](https://discuss.elastic.co/t/sending-logs-to-syslog-using-logstash/334952 "2023-06-09T14:43:43Z")

</div>

I installed winlogbeat and Logstash on my WInodows and I want to send logs to Logstash that will forward the logs to pfSense,I mean using Logstash as an aggregator with the logstash-output-tcp to send events to Syslog. a…

---

## [Ignore relevance score completely by using post\_filter only](https://discuss.elastic.co/t/ignore-relevance-score-completely-by-using-post-filter-only/192660)

<div class="topic-metadata">

**Author:** [@kshi\_yelpale000](https://discuss.elastic.co/u/kshi_yelpale000)\
**Replies:** 12\
**Last updated:** [August 7, 2019, 3:05pm UTC](https://discuss.elastic.co/t/ignore-relevance-score-completely-by-using-post-filter-only/192660 "2019-08-07T15:05:16Z")

</div>

Hi, In my product, i don't want to use relevance score in my search queries. I have my own sorting algorithm once i have results. On searching i found that to avoid scoring, use post\_filter insread of query clause. He…

---

## [Filebeat 6.2.3 index is empty](https://discuss.elastic.co/t/filebeat-6-2-3-index-is-empty/125070)

<div class="topic-metadata">

**Author:** [@Wanderer](https://discuss.elastic.co/u/Wanderer)\
**Replies:** 13\
**Last updated:** [March 22, 2018, 4:57pm UTC](https://discuss.elastic.co/t/filebeat-6-2-3-index-is-empty/125070 "2018-03-22T16:57:04Z")

</div>

Since upgrading to 6.2.3 the filebeat index is empty. Any idea where to start looking? Filebeat debug output: 2018-03-21T16:11:28.994-0400 DEBUG \[publish\] pipeline/processor.go:275 Publish event: { "@…

---

## [ES: Indexing Rate dropping significantly while Indexing Latency staying about the same](https://discuss.elastic.co/t/es-indexing-rate-dropping-significantly-while-indexing-latency-staying-about-the-same/227960)

<div class="topic-metadata">

**Author:** [@gurtgurt](https://discuss.elastic.co/u/gurtgurt)\
**Replies:** 9\
**Last updated:** [April 15, 2020, 1:40am UTC](https://discuss.elastic.co/t/es-indexing-rate-dropping-significantly-while-indexing-latency-staying-about-the-same/227960 "2020-04-15T01:40:37Z")

</div>

Hi, I'm indexing ~140 GB of data via the bulk API on a managed AWS instance. I'm noticing the Indexing rate is almost at 30% of what it started at, while the indexing latency is staying the same. I'm using EBS SSD as…

---

## [Problem with accessing elasticsearch remotly](https://discuss.elastic.co/t/problem-with-accessing-elasticsearch-remotly/134779)

<div class="topic-metadata">

**Author:** [@Muneer\_Ahmad](https://discuss.elastic.co/u/Muneer_Ahmad)\
**Replies:** 9\
**Last updated:** [June 7, 2018, 8:35am UTC](https://discuss.elastic.co/t/problem-with-accessing-elasticsearch-remotly/134779 "2018-06-07T08:35:24Z")

</div>

Hi, i am trying to access elastic search using my server public ip address since last week but not able to do so. i have tried so many solutions but not succeeded. My elasticsearch.yml file settings are like: http.host…

---

## [How to sort ResultView data](https://discuss.elastic.co/t/how-to-sort-resultview-data/288798)

<div class="topic-metadata">

**Author:** [@pradeepjanga](https://discuss.elastic.co/u/pradeepjanga)\
**Replies:** 16\
**Last updated:** [November 22, 2021, 6:42pm UTC](https://discuss.elastic.co/t/how-to-sort-resultview-data/288798 "2021-11-22T18:42:00Z")

</div>

I have custom result view but i want to do some sorting before data is being rendered. is that possible? \<React.Fragment\> {wasSearched && (totalResults \> 0) ? \<CurrentFilterSelection filter…

---

## [Slow search in Kibana / ElasticSearch](https://discuss.elastic.co/t/slow-search-in-kibana-elasticsearch/297368)

<div class="topic-metadata">

**Author:** [@notgurev](https://discuss.elastic.co/u/notgurev)\
**Replies:** 14\
**Last updated:** [March 6, 2022, 10:44am UTC](https://discuss.elastic.co/t/slow-search-in-kibana-elasticsearch/297368 "2022-03-06T10:44:29Z")

</div>

When trying to visualize data, it takes a lot of time to get even the most recent data. I'm trying to figure out what's wrong with our setup that causes this: 3 nodes (1 hot, 2 cold) Hourly indices, 1 shard per index (…

---

## [Bulk throughput issues](https://discuss.elastic.co/t/bulk-throughput-issues/14962)

<div class="topic-metadata">

**Author:** [@tdjb](https://discuss.elastic.co/u/tdjb)\
**Replies:** 14\
**Last updated:** [January 6, 2014, 2:40pm UTC](https://discuss.elastic.co/t/bulk-throughput-issues/14962 "2014-01-06T14:40:23Z")

</div>

Hi all, I'm currently working on a project where elasticsearch is our backend but have been running into issues with insert rates. Some background is our cluster is four physical boxes, each with 32 CPU cores and 2…

---

## [Loaded template is not appearing in Elastic](https://discuss.elastic.co/t/loaded-template-is-not-appearing-in-elastic/77499)

<div class="topic-metadata">

**Author:** [@111148](https://discuss.elastic.co/u/111148)\
**Replies:** 11\
**Last updated:** [March 7, 2017, 1:06pm UTC](https://discuss.elastic.co/t/loaded-template-is-not-appearing-in-elastic/77499 "2017-03-07T13:06:04Z")

</div>

Hello, I am currently trying to load existing template from Previous Elastic version 2.\* to the new nodes with version 5.\*. Using this command: C:\\Users\\admin\> Invoke-RestMethod -Uri 'http://localhost:9200/\_template/n…

---

## [300K file increases index diskspace with 400K](https://discuss.elastic.co/t/300k-file-increases-index-diskspace-with-400k/27310)

<div class="topic-metadata">

**Author:** [@e\_ariens](https://discuss.elastic.co/u/e_ariens)\
**Replies:** 9\
**Last updated:** [August 17, 2015, 8:38am UTC](https://discuss.elastic.co/t/300k-file-increases-index-diskspace-with-400k/27310 "2015-08-17T08:38:31Z")

</div>

Hi, I have a question. We do a lot of work for acounting oficces. When testing we discoverd that a 300K file increased the index store with 400K. The file it self is not stored. The file contain mainly numbers. I have …

---

## [Unstable cluster](https://discuss.elastic.co/t/unstable-cluster/5516)

<div class="topic-metadata">

**Author:** [@Thibaut\_Britz](https://discuss.elastic.co/u/Thibaut_Britz)\
**Replies:** 10\
**Last updated:** [October 5, 2011, 5:11pm UTC](https://discuss.elastic.co/t/unstable-cluster/5516 "2011-10-05T17:11:26Z")

</div>

Hi, We have a farily large elasticsearch cluster (40 nodes) in production and recently upgraded to 0.17.7. We have many rivers rivers (custom plugin, which also searches the same cluster while indexing) running on…

---

## [Already deleted indices comes back as dangling whenever a node restarts](https://discuss.elastic.co/t/already-deleted-indices-comes-back-as-dangling-whenever-a-node-restarts/256841)

<div class="topic-metadata">

**Author:** [@jatin\_gupta](https://discuss.elastic.co/u/jatin_gupta)\
**Replies:** 14\
**Last updated:** [November 29, 2020, 7:55am UTC](https://discuss.elastic.co/t/already-deleted-indices-comes-back-as-dangling-whenever-a-node-restarts/256841 "2020-11-29T07:55:12Z")

</div>

Hi, I am running a 8 node ES cluster with version 7.4.2 Everytime a node on the cluster restarts the state becomes red as a lot of dangling indices which are already deleted tries to get restored on the cluster. Only …

---

## [Create index for filebeat with idicated host or log path](https://discuss.elastic.co/t/create-index-for-filebeat-with-idicated-host-or-log-path/252840)

<div class="topic-metadata">

**Author:** [@Charakterny](https://discuss.elastic.co/u/Charakterny)\
**Replies:** 11\
**Last updated:** [October 24, 2020, 10:19am UTC](https://discuss.elastic.co/t/create-index-for-filebeat-with-idicated-host-or-log-path/252840 "2020-10-24T10:19:21Z")

</div>

Hi, I'm new in ELK and my main goal is to share logs for created users from different hosts. So at this moment I have two hosts A and B where I installed and configured filebeat. I need to create index for filebeat, b…

---

## [Split a json array with same fields names](https://discuss.elastic.co/t/split-a-json-array-with-same-fields-names/233008)

<div class="topic-metadata">

**Author:** [@Claudio\_Ract\_Costa](https://discuss.elastic.co/u/Claudio_Ract_Costa)\
**Replies:** 16\
**Last updated:** [May 19, 2020, 3:01pm UTC](https://discuss.elastic.co/t/split-a-json-array-with-same-fields-names/233008 "2020-05-19T15:01:44Z")

</div>

Hi, I'm trying to split a JSON array into multiple events. Here's a sample input: "chargingContextSpecific" : \[ { "parameterID" : 16778241, "para…

---

## [Aggregating and sending multiple error logs to FileBeat 6](https://discuss.elastic.co/t/aggregating-and-sending-multiple-error-logs-to-filebeat-6/116405)

<div class="topic-metadata">

**Author:** [@Revekius](https://discuss.elastic.co/u/Revekius)\
**Replies:** 9\
**Last updated:** [January 22, 2018, 6:29pm UTC](https://discuss.elastic.co/t/aggregating-and-sending-multiple-error-logs-to-filebeat-6/116405 "2018-01-22T18:29:10Z")

</div>

Hi, I have a WHM server with multiple accounts. On each account I have error logs from PHP. I would like to send all error logs to FileBeat for processing and reading. There is a big issue though... I don't know where …

---

## [Topbeat sometimes returns an invalid value for cpu.system\_p on Windows](https://discuss.elastic.co/t/topbeat-sometimes-returns-an-invalid-value-for-cpu-system-p-on-windows/43706)

<div class="topic-metadata">

**Author:** [@MarcoPonton](https://discuss.elastic.co/u/MarcoPonton)\
**Replies:** 9\
**Last updated:** [March 17, 2016, 3:29pm UTC](https://discuss.elastic.co/t/topbeat-sometimes-returns-an-invalid-value-for-cpu-system-p-on-windows/43706 "2016-03-17T15:29:21Z")

</div>

Hi, I've been running Topbeats on servers for a PoC at a client for about 3 weeks. Every now and then, Topbeat returns an invalid cpu.system\_p value. This of course does not look very good on a graph... So far I've see…

[Previous page](https://discuss.elastic.co/top.md?page=127&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=129&per_page=50&period=all)
