# Top

**URL:** https://discuss.elastic.co/top.md?page=1291&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1292

---

## [Logstash forwarder settings](https://discuss.elastic.co/t/logstash-forwarder-settings/77478)

<div class="topic-metadata">

**Author:** [@emilio](https://discuss.elastic.co/u/emilio)\
**Replies:** 8\
**Last updated:** [March 7, 2017, 10:27am UTC](https://discuss.elastic.co/t/logstash-forwarder-settings/77478 "2017-03-07T10:27:41Z")

</div>

Dear all, I have a lot of application logs on different hosts. I am going transfer all my application logs into time based index. So, i have couple of questions: 1.How and where i can mark transferring logs that …

---

## [BulkIngester and Integration Testing](https://discuss.elastic.co/t/bulkingester-and-integration-testing/341595)

<div class="topic-metadata">

**Author:** [@toddcarv](https://discuss.elastic.co/u/toddcarv)\
**Replies:** 7\
**Last updated:** [September 15, 2023, 12:29pm UTC](https://discuss.elastic.co/t/bulkingester-and-integration-testing/341595 "2023-09-15T12:29:29Z")

</div>

Can someone point me to some examples of integration testing while using the BulkIngester? Specifically how to test a class method that uses the BulkIngester. I'm having timing issues with calling flush on the BulkIngest…

---

## [Parsing JSON with a string at the beginning of each JSON Object](https://discuss.elastic.co/t/parsing-json-with-a-string-at-the-beginning-of-each-json-object/285480)

<div class="topic-metadata">

**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\
**Replies:** 7\
**Last updated:** [September 29, 2021, 2:57pm UTC](https://discuss.elastic.co/t/parsing-json-with-a-string-at-the-beginning-of-each-json-object/285480 "2021-09-29T14:57:03Z")

</div>

Hello, I'm trying to parse a json file with a string at the beginning of each object. What is the easiest way to bypass the initial string or parse the json with string at the beginning? Here is an example of the JSON: …

---

## [Filtering not working](https://discuss.elastic.co/t/filtering-not-working/234397)

<div class="topic-metadata">

**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\
**Replies:** 7\
**Last updated:** [June 11, 2020, 8:36am UTC](https://discuss.elastic.co/t/filtering-not-working/234397 "2020-06-11T08:36:05Z")

</div>

Hi, Running ELK 6.8.9 on premises Output in Winlogbeat config file is Eslasticsearch (not Logstash) I am trying to add some processing on the client side to filter only the Win events I need before sending the data t…

---

## [Plugin for custom visualization based on hits](https://discuss.elastic.co/t/plugin-for-custom-visualization-based-on-hits/129892)

<div class="topic-metadata">

**Author:** [@Marlen](https://discuss.elastic.co/u/Marlen)\
**Replies:** 7\
**Last updated:** [May 3, 2018, 7:43pm UTC](https://discuss.elastic.co/t/plugin-for-custom-visualization-based-on-hits/129892 "2018-05-03T19:43:24Z")

</div>

Hi, I'm trying to create some custom visualizations by developing kibana plugins, for example, one of them is for displaying a cumulative sum of uptime and downtime over the time, the sum should restart whenever I see a …

---

## [Facet and grouping](https://discuss.elastic.co/t/facet-and-grouping/8308)

<div class="topic-metadata">

**Author:** [@pric](https://discuss.elastic.co/u/pric)\
**Replies:** 7\
**Last updated:** [July 5, 2012, 7:10am UTC](https://discuss.elastic.co/t/facet-and-grouping/8308 "2012-07-05T07:10:24Z")

</div>

Hello, I would like to know if it's possible to do this with elasticsearch: my documents: (it's for the example, in the real there is more fields) doc 1 -\> brand: audi, color: black doc 2 -\> brand: audi, color: wh…

---

## [Filebeat disk queue not working as documented](https://discuss.elastic.co/t/filebeat-disk-queue-not-working-as-documented/308609)

<div class="topic-metadata">

**Author:** [@ulisses](https://discuss.elastic.co/u/ulisses)\
**Replies:** 4\
**Last updated:** [July 5, 2022, 7:19pm UTC](https://discuss.elastic.co/t/filebeat-disk-queue-not-working-as-documented/308609 "2022-07-05T19:19:50Z")

</div>

According to this documentation Internal Queue: Queue data is deleted from disk after it has been successfully sent to the output. This is not happening. Sent data still exists in the files (\*.seg). And to make matt…

---

## [Update doc only if doc changes? noop?](https://discuss.elastic.co/t/update-doc-only-if-doc-changes-noop/299040)

<div class="topic-metadata">

**Author:** [@andy4324](https://discuss.elastic.co/u/andy4324)\
**Replies:** 4\
**Last updated:** [March 8, 2022, 7:02pm UTC](https://discuss.elastic.co/t/update-doc-only-if-doc-changes-noop/299040 "2022-03-08T19:02:54Z")

</div>

Hi ES team, newbie ES user. We have a use case where we want to store signals from various hosts inside ES (as documents of course) and query them later based on a specific field value. Each event might have different fi…

---

## [Geo\_shape size and elastic performance](https://discuss.elastic.co/t/geo-shape-size-and-elastic-performance/283920)

<div class="topic-metadata">

**Author:** [@rgwozdz](https://discuss.elastic.co/u/rgwozdz)\
**Replies:** 4\
**Last updated:** [September 14, 2021, 1:30pm UTC](https://discuss.elastic.co/t/geo-shape-size-and-elastic-performance/283920 "2021-09-14T13:30:44Z")

</div>

We have an index that contains about 5 million documents. About 20% will have a geo\_shape field that contains polygon data. I need to support intersect queries on these geo\_shapes. Some of these polygons are very comp…

---

## [Kibana reverse proxy](https://discuss.elastic.co/t/kibana-reverse-proxy/258856)

<div class="topic-metadata">

**Author:** [@vikram\_singh](https://discuss.elastic.co/u/vikram_singh)\
**Replies:** 4\
**Last updated:** [December 16, 2020, 2:26pm UTC](https://discuss.elastic.co/t/kibana-reverse-proxy/258856 "2020-12-16T14:26:30Z")

</div>

Hi, I am implementing apache reverse proxy on kibana. I want to make url http:url:5601/app/kibana to http:url/app/kibana. Thanks

---

## [About writing elasticsearch subquery DSL](https://discuss.elastic.co/t/about-writing-elasticsearch-subquery-dsl/178926)

<div class="topic-metadata">

**Author:** [@ivanli1990](https://discuss.elastic.co/u/ivanli1990)\
**Replies:** 4\
**Last updated:** [May 6, 2019, 2:35am UTC](https://discuss.elastic.co/t/about-writing-elasticsearch-subquery-dsl/178926 "2019-05-06T02:35:52Z")

</div>

I having a template mappings like this: { "template": "ones\_bug-\*", "settings": { "index": { "number\_of\_shards": "5", "number\_of\_replicas": "1" } }, "mappings": { "bug\_info": { "\_al…

---

## [Sqlite input plugin not working](https://discuss.elastic.co/t/sqlite-input-plugin-not-working/143073)

<div class="topic-metadata">

**Author:** [@arisbanach](https://discuss.elastic.co/u/arisbanach)\
**Replies:** 4\
**Last updated:** [August 6, 2018, 12:18am UTC](https://discuss.elastic.co/t/sqlite-input-plugin-not-working/143073 "2018-08-06T00:18:07Z")

</div>

Not sure what is wrong, but I am getting this output from the sqlite input plugin. Aug 05 19:54:55 ip-10-221-145-243 logstash\[22850\]: \[2018-08-05T19:54:55,346\]\[ERROR\]\[logstash.pipeline \] A plugin had an unr ecove…

---

## [Stdout parse into json](https://discuss.elastic.co/t/stdout-parse-into-json/115237)

<div class="topic-metadata">

**Author:** [@arght](https://discuss.elastic.co/u/arght)\
**Replies:** 4\
**Last updated:** [January 17, 2018, 1:28pm UTC](https://discuss.elastic.co/t/stdout-parse-into-json/115237 "2018-01-17T13:28:13Z")

</div>

hi, my application generate logs in json format and output it to stdout. Is there a way to have it visible in kibana as a list of dictionaries? Currently i see it as a string "level": "info", "message": "{"whatever": …

---

## [Grok failed to parse simple string and logstash stuck at 100% CPU](https://discuss.elastic.co/t/grok-failed-to-parse-simple-string-and-logstash-stuck-at-100-cpu/112895)

<div class="topic-metadata">

**Author:** [@Vivien](https://discuss.elastic.co/u/Vivien)\
**Replies:** 4\
**Last updated:** [December 22, 2017, 2:34pm UTC](https://discuss.elastic.co/t/grok-failed-to-parse-simple-string-and-logstash-stuck-at-100-cpu/112895 "2017-12-22T14:34:13Z")

</div>

Hi! I've got a strange error: \[2017-12-21T20:54:31,450\]\[WARN \]\[logstash.filters.grok \] Timeout executing grok '%{UNIXPATH:path}/(?\[^\]\*)(?\<fs\_component\>\[-.0-9a-z\]+)\_(?\<fs\_logformat\>\[A-Z\]+).logs' against field 'source…

---

## [LOGSTASH to connect two UNIX server in a secure network](https://discuss.elastic.co/t/logstash-to-connect-two-unix-server-in-a-secure-network/98209)

<div class="topic-metadata">

**Author:** [@kosigamaani\_thirumoo](https://discuss.elastic.co/u/kosigamaani_thirumoo)\
**Replies:** 4\
**Last updated:** [September 1, 2017, 4:05am UTC](https://discuss.elastic.co/t/logstash-to-connect-two-unix-server-in-a-secure-network/98209 "2017-09-01T04:05:51Z")

</div>

Hi, I’ve two UNIX Servers A and B. I’ve installed installed Logstash in Server A and i would like to read logs present in Server B. Kindly suggest suitable input plugin. Note: Server B doesn’t contain Logstash Thanks

---

## [Winlogbeat configuration issues](https://discuss.elastic.co/t/winlogbeat-configuration-issues/74360)

<div class="topic-metadata">

**Author:** [@ArjunSISA](https://discuss.elastic.co/u/ArjunSISA)\
**Replies:** 4\
**Last updated:** [February 10, 2017, 10:06am UTC](https://discuss.elastic.co/t/winlogbeat-configuration-issues/74360 "2017-02-10T10:06:52Z")

</div>

hi everyone, I have recently installed winlogbeat and configured it to forward the logs but i am unable to receive the logs. Can anyone help me with this?

---

## [NGram Index implications](https://discuss.elastic.co/t/ngram-index-implications/49289)

<div class="topic-metadata">

**Author:** [@avibh](https://discuss.elastic.co/u/avibh)\
**Replies:** 4\
**Last updated:** [May 5, 2016, 4:13pm UTC](https://discuss.elastic.co/t/ngram-index-implications/49289 "2016-05-05T16:13:16Z")

</div>

Hi, I'd like to use NGram for my indexes using the autocomplete analyzer. my only concern is the implications on index ram/disk size. is there a rule of thumb of how much the index consumes in case of - "min\_gram": …

---

## [Not able to reindex data](https://discuss.elastic.co/t/not-able-to-reindex-data/37437)

<div class="topic-metadata">

**Author:** [@KavyaS](https://discuss.elastic.co/u/KavyaS)\
**Replies:** 4\
**Last updated:** [December 17, 2015, 9:32am UTC](https://discuss.elastic.co/t/not-able-to-reindex-data/37437 "2015-12-17T09:32:02Z")

</div>

I wanted to rename a field in my logs in an existing index. So i created an alias for the existing index and pointed it to a new index. It doesn't show any documents in the new index. When i use the scan and scroll appr…

---

## [How to get Combined results on tooltip in kibana maps](https://discuss.elastic.co/t/how-to-get-combined-results-on-tooltip-in-kibana-maps/311894)

<div class="topic-metadata">

**Author:** [@Ritikapawar](https://discuss.elastic.co/u/Ritikapawar)\
**Replies:** 3\
**Last updated:** [August 25, 2022, 6:53am UTC](https://discuss.elastic.co/t/how-to-get-combined-results-on-tooltip-in-kibana-maps/311894 "2022-08-25T06:53:50Z")

</div>

I'm visualizing map on kibana- guess if I have 4 layers on map shows the map for bihar state 2.shows the 10 pointers of hospitals in bihar. (fields: No of hospital, Name of hospital) Shows no of doctors in each ho…

---

## [SIEM open rules](https://discuss.elastic.co/t/siem-open-rules/283710)

<div class="topic-metadata">

**Author:** [@wallacepalace](https://discuss.elastic.co/u/wallacepalace)\
**Replies:** 2\
**Last updated:** [September 9, 2021, 1:54am UTC](https://discuss.elastic.co/t/siem-open-rules/283710 "2021-09-09T01:54:06Z")

</div>

Hey there, how are ur? I'm posting here some rules I made for detecting communications with botnets, command and control (C2), VNC scanners, SSH, MySQL, RDP, DNS, Telnet, HTTP, TFTP. Using honeypots, blacklists, IP rank…

---

## [Kibana Sort in visualization is not correct](https://discuss.elastic.co/t/kibana-sort-in-visualization-is-not-correct/272607)

<div class="topic-metadata">

**Author:** [@lachlann562](https://discuss.elastic.co/u/lachlann562)\
**Replies:** 3\
**Last updated:** [May 11, 2021, 3:11pm UTC](https://discuss.elastic.co/t/kibana-sort-in-visualization-is-not-correct/272607 "2021-05-11T15:11:10Z")

</div>

In some visualizations, the sorting appears to not respect the selected values. for example, when using metricbeat i have a scripted field for "hour of day", "day of week" and "sundayOfWeek". Depending on how i filter my…

---

## [How many kibana spaces are recommended?](https://discuss.elastic.co/t/how-many-kibana-spaces-are-recommended/201815)

<div class="topic-metadata">

**Author:** [@surenraju](https://discuss.elastic.co/u/surenraju)\
**Replies:** 3\
**Last updated:** [October 2, 2019, 3:48pm UTC](https://discuss.elastic.co/t/how-many-kibana-spaces-are-recommended/201815 "2019-10-02T15:48:22Z")

</div>

Hi, We run around 200+ microservices. We wanted to create application dashboards from metrics scraped from individual services. We are wondering if we can have 200+ spaces for all micro service team so that microservice …

---

## [Elasticsearch Curator delete old-index after rollover?](https://discuss.elastic.co/t/elasticsearch-curator-delete-old-index-after-rollover/156836)

<div class="topic-metadata">

**Author:** [@ddregalo](https://discuss.elastic.co/u/ddregalo)\
**Replies:** 3\
**Last updated:** [November 19, 2018, 2:54pm UTC](https://discuss.elastic.co/t/elasticsearch-curator-delete-old-index-after-rollover/156836 "2018-11-19T14:54:27Z")

</div>

I have the following curator set-up in curator-actions.yml which is configured to delete indices based on age filter but I would like to set-up a config that deletes the old-index immediately after a rollover is successf…

---

## [Logstash Dissect Filter](https://discuss.elastic.co/t/logstash-dissect-filter/104907)

<div class="topic-metadata">

**Author:** [@maddie0726](https://discuss.elastic.co/u/maddie0726)\
**Replies:** 3\
**Last updated:** [October 23, 2017, 8:36pm UTC](https://discuss.elastic.co/t/logstash-dissect-filter/104907 "2017-10-23T20:36:30Z")

</div>

I have Logstash Kibana and Elasticsearch versions 5.6.2 installed on Windows 2012 R2. I have a grok pattern that reads in text file entries adequately. The end of each entry is a message field containing a couple differe…

---

## [\[newbie here\] can't seem to create snapshot using both fs and s3](https://discuss.elastic.co/t/newbie-here-cant-seem-to-create-snapshot-using-both-fs-and-s3/95974)

<div class="topic-metadata">

**Author:** [@blacksensei](https://discuss.elastic.co/u/blacksensei)\
**Replies:** 3\
**Last updated:** [August 9, 2017, 9:19am UTC](https://discuss.elastic.co/t/newbie-here-cant-seem-to-create-snapshot-using-both-fs-and-s3/95974 "2017-08-09T09:19:41Z")

</div>

Hello All, I am trying to learn elasticsearch by building an app. I wanted to see what snapshots looks like and finally have it in aws elasticsearch with some API gateway on top of it. It doesn't seem to go as planned.…

---

## [Filebeat reading remote log file](https://discuss.elastic.co/t/filebeat-reading-remote-log-file/84360)

<div class="topic-metadata">

**Author:** [@rabbit](https://discuss.elastic.co/u/rabbit)\
**Replies:** 3\
**Last updated:** [May 3, 2017, 8:45pm UTC](https://discuss.elastic.co/t/filebeat-reading-remote-log-file/84360 "2017-05-03T20:45:29Z")

</div>

Hi guys ! I have some constraints in the servers that my applications servers are running. I'm not allowed to install Filebeat in the nodes. The solution was to copy the logs to the machine where filebeat is runnin…

---

## [Feature request: Set term colors, dashboard-global](https://discuss.elastic.co/t/feature-request-set-term-colors-dashboard-global/83511)

<div class="topic-metadata">

**Author:** [@luckydonald](https://discuss.elastic.co/u/luckydonald)\
**Replies:** 3\
**Last updated:** [April 25, 2017, 12:03pm UTC](https://discuss.elastic.co/t/feature-request-set-term-colors-dashboard-global/83511 "2017-04-25T12:03:00Z")

</div>

Dashboards already trying to use the same colors for each term. See the Status codes as an example: It would be great to have a color settings storable on the dashboard, not the used graphs. (Maybe later also a GUI …

---

## [OR statement braking the "NOT" statement ElasticSearch](https://discuss.elastic.co/t/or-statement-braking-the-not-statement-elasticsearch/31875)

<div class="topic-metadata">

**Author:** [@acv2](https://discuss.elastic.co/u/acv2)\
**Replies:** 3\
**Last updated:** [October 9, 2015, 3:28am UTC](https://discuss.elastic.co/t/or-statement-braking-the-not-statement-elasticsearch/31875 "2015-10-09T03:28:17Z")

</div>

Hi Everyone, I'm here to give back to community, i spent hours looking for an answer for my problem without luck, so I decided to share my findings with you all, so we can all take a look on the mystic of elasticsearch. …

---

## [JSON Request With Saved Object Find API](https://discuss.elastic.co/t/json-request-with-saved-object-find-api/251265)

<div class="topic-metadata">

**Author:** [@git-blame](https://discuss.elastic.co/u/git-blame)\
**Replies:** 2\
**Last updated:** [October 8, 2020, 12:44pm UTC](https://discuss.elastic.co/t/json-request-with-saved-object-find-api/251265 "2020-10-08T12:44:58Z")

</div>

In the Find API, there is a has\_reference parameter which is an object with fields type and id. However, There is no example I can find of how to format that as a URL (e.g., for a curl get) This comment implies that I …

---

## [Network.host on elk 7.5](https://discuss.elastic.co/t/network-host-on-elk-7-5/213107)

<div class="topic-metadata">

**Author:** [@es4dp](https://discuss.elastic.co/u/es4dp)\
**Replies:** 2\
**Last updated:** [December 27, 2019, 3:56pm UTC](https://discuss.elastic.co/t/network-host-on-elk-7-5/213107 "2019-12-27T15:56:10Z")

</div>

Hi All, My first post to ELK! I am trying 7.5 with following config: Host| Purpose | Status elk01| elasticsearch | running with network.host with default kibana01 | kibana | running but complains... log \[19:26:1…

---

## [Elasticsearch on AW ECS](https://discuss.elastic.co/t/elasticsearch-on-aw-ecs/201690)

<div class="topic-metadata">

**Author:** [@dhruvbakshi](https://discuss.elastic.co/u/dhruvbakshi)\
**Replies:** 2\
**Last updated:** [October 1, 2019, 5:36am UTC](https://discuss.elastic.co/t/elasticsearch-on-aw-ecs/201690 "2019-10-01T05:36:23Z")

</div>

Hi @DavidTurner, I have a couple of cases logged in with elasticsearch. This one was created recently (00390065) but still ties into the other ticket I have logged and we don't seem to be reaching anywhere. I'm not sure…

---

## [Reset Filebeat harversters](https://discuss.elastic.co/t/reset-filebeat-harversters/198848)

<div class="topic-metadata">

**Author:** [@tunigas](https://discuss.elastic.co/u/tunigas)\
**Replies:** 2\
**Last updated:** [September 11, 2019, 5:47pm UTC](https://discuss.elastic.co/t/reset-filebeat-harversters/198848 "2019-09-11T17:47:30Z")

</div>

Hello, After a lot of testing with logstash and filebeat, I need to reset filebeat to be able to ship all the log data again in a clean way. First, I deleted all the data from elasticsearch. Then, I went to /var/lib/fi…

---

## [Logstash: parsing fields from json in array of another json](https://discuss.elastic.co/t/logstash-parsing-fields-from-json-in-array-of-another-json/149854)

<div class="topic-metadata">

**Author:** [@Jiri\_Petak](https://discuss.elastic.co/u/Jiri_Petak)\
**Replies:** 2\
**Last updated:** [September 26, 2018, 9:09am UTC](https://discuss.elastic.co/t/logstash-parsing-fields-from-json-in-array-of-another-json/149854 "2018-09-26T09:09:19Z")

</div>

Hi, i would like to parse some fields from json logs from AWS WAF. On input logstash use: s3 { bucket =\> "XXXX" access\_key\_id =\> "XXXX" secret\_access\_key =\> "XXXX" prefix =\> "waf/" region =\> "X…

---

## [Having problem in reverse mapping of hostname to ip address using DNS filter](https://discuss.elastic.co/t/having-problem-in-reverse-mapping-of-hostname-to-ip-address-using-dns-filter/97769)

<div class="topic-metadata">

**Author:** [@Ram\_Prasath](https://discuss.elastic.co/u/Ram_Prasath)\
**Replies:** 2\
**Last updated:** [August 21, 2017, 3:13pm UTC](https://discuss.elastic.co/t/having-problem-in-reverse-mapping-of-hostname-to-ip-address-using-dns-filter/97769 "2017-08-21T15:13:26Z")

</div>

I am trying to use the DNS filter to map the hostname to IPaddress , below is the sample configuration I tried to map google.com to ipaddress filter{ mutate { add\_field =\> {"hostname", "google.com"} } …

---

## [How to visualize the sparklines in the table?](https://discuss.elastic.co/t/how-to-visualize-the-sparklines-in-the-table/79888)

<div class="topic-metadata">

**Author:** [@AlexM](https://discuss.elastic.co/u/AlexM)\
**Replies:** 2\
**Last updated:** [March 27, 2017, 12:35pm UTC](https://discuss.elastic.co/t/how-to-visualize-the-sparklines-in-the-table/79888 "2017-03-27T12:35:02Z")

</div>

Hi all, I have the table type of visualisation. Is there in Kibana a type of visualisation as "sparklines"? I'm going create and show the sparklines in the table visualizations on each string as shown in the picture: …

---

## [Access timepicker range from within visualization plugin](https://discuss.elastic.co/t/access-timepicker-range-from-within-visualization-plugin/63424)

<div class="topic-metadata">

**Author:** [@nathanc](https://discuss.elastic.co/u/nathanc)\
**Replies:** 2\
**Last updated:** [October 20, 2016, 2:52pm UTC](https://discuss.elastic.co/t/access-timepicker-range-from-within-visualization-plugin/63424 "2016-10-20T14:52:51Z")

</div>

I am trying to access the queried date range from within a plugin, so that I can do calculations based on the length of time being queried. Is there a way to do this? For example, I may have an aggregated sum of hits a…

---

## [Protractor.NET + Internet Explorer 11 + Kibana](https://discuss.elastic.co/t/protractor-net-internet-explorer-11-kibana/48299)

<div class="topic-metadata">

**Author:** [@Yury](https://discuss.elastic.co/u/Yury)\
**Replies:** 2\
**Last updated:** [April 26, 2016, 9:12am UTC](https://discuss.elastic.co/t/protractor-net-internet-explorer-11-kibana/48299 "2016-04-26T09:12:41Z")

</div>

Hello everybody. I'm trying to use the port of Protractor on .NET-platform for Kibana UI-testing, because Kibana is built with AngularJS. Does anybody have some experience with this? I can't even make a helloworld app. …

---

## [Auto\_expand\_replicas and shard allocation filtering](https://discuss.elastic.co/t/auto-expand-replicas-and-shard-allocation-filtering/8928)

<div class="topic-metadata">

**Author:** [@Mauri](https://discuss.elastic.co/u/Mauri)\
**Replies:** 2\
**Last updated:** [April 7, 2013, 6:10pm UTC](https://discuss.elastic.co/t/auto-expand-replicas-and-shard-allocation-filtering/8928 "2013-04-07T18:10:09Z")

</div>

Hello, If I configure the nodes in my cluster to have a node attribute 'node.zone' with values "zone1", "zone1", etc and then configure an index as follows: curl -XPUT localhost:9200/test/\_settings -d '{ "inde…

---

## [Reindexing Strategy](https://discuss.elastic.co/t/reindexing-strategy/8884)

<div class="topic-metadata">

**Author:** [@stratawing](https://discuss.elastic.co/u/stratawing)\
**Replies:** 2\
**Last updated:** [August 29, 2012, 11:10pm UTC](https://discuss.elastic.co/t/reindexing-strategy/8884 "2012-08-29T23:10:20Z")

</div>

I have a need to update my mappings and will therefore need to reindex - but will be doing so directly from an existing ES index (I'm using ES as my data store). I've read other posts, and think the following strateg…

---

## [Logstash was having pipeline error: event executor terminated. What would possibly be the problem?](https://discuss.elastic.co/t/logstash-was-having-pipeline-error-event-executor-terminated-what-would-possibly-be-the-problem/316212)

<div class="topic-metadata">

**Author:** [@prashanthk](https://discuss.elastic.co/u/prashanthk)\
**Replies:** 5\
**Last updated:** [October 11, 2022, 3:52am UTC](https://discuss.elastic.co/t/logstash-was-having-pipeline-error-event-executor-terminated-what-would-possibly-be-the-problem/316212 "2022-10-11T03:52:28Z")

</div>

input { http { host =\> "0.0.0.0" port =\> 8443 user =\> provider password =\> "c6N65uxZ$M5@" # ssl =\> true # keystore =\> "/etc/logstash/keystore.jks" # keystore\_password =\> "password" } } filter { mutate { add\_f…

---

## [Getting pop-up in kibana](https://discuss.elastic.co/t/getting-pop-up-in-kibana/269213)

<div class="topic-metadata">

**Author:** [@vikramp](https://discuss.elastic.co/u/vikramp)\
**Replies:** 5\
**Last updated:** [April 7, 2021, 7:48am UTC](https://discuss.elastic.co/t/getting-pop-up-in-kibana/269213 "2021-04-07T07:48:15Z")

</div>

We are using Kibana 7.3, after disabling login security(i dont want to enter login credentials) using xpack.security.enabled: false in kibana.yml, i am getting pop-up in browser to enter the credentials.

---

## [Elasticsearch-setup-password kills elastic process](https://discuss.elastic.co/t/elasticsearch-setup-password-kills-elastic-process/254067)

<div class="topic-metadata">

**Author:** [@martinsz](https://discuss.elastic.co/u/martinsz)\
**Replies:** 5\
**Last updated:** [November 3, 2020, 4:13pm UTC](https://discuss.elastic.co/t/elasticsearch-setup-password-kills-elastic-process/254067 "2020-11-03T16:13:03Z")

</div>

Hi, I'm setting up a new cluster with security after successfully fixing it (earlier post https://discuss.elastic.co/t/help-a-non-profit-stir-the-data/251589). The difference is that I've now configured TLS on the HTTP …

---

## [Logstash split function](https://discuss.elastic.co/t/logstash-split-function/233164)

<div class="topic-metadata">

**Author:** [@hariskhalique](https://discuss.elastic.co/u/hariskhalique)\
**Replies:** 5\
**Last updated:** [May 18, 2020, 7:38pm UTC](https://discuss.elastic.co/t/logstash-split-function/233164 "2020-05-18T19:38:16Z")

</div>

Hi, I have this tag fields with value Beige, Black, Blue, boohoo, Brown, cat:dresses, DZZ56895, Green, Grey, New Arrivals, Orange, Pink, Purple, Red, subcat:cocktail:cat:dresses, White, women, Yellow, z\_global\_id:3903…

---

## [Coordina map zoom limitation -- how get full zoom 21/22](https://discuss.elastic.co/t/coordina-map-zoom-limitation-how-get-full-zoom-21-22/118072)

<div class="topic-metadata">

**Author:** [@pedrosk](https://discuss.elastic.co/u/pedrosk)\
**Replies:** 5\
**Last updated:** [February 8, 2018, 3:48pm UTC](https://discuss.elastic.co/t/coordina-map-zoom-limitation-how-get-full-zoom-21-22/118072 "2018-02-08T15:48:36Z")

</div>

I created a real world model of a building and host it on my own geoserver. I noticed that I can't achieve the maximum zoom 21 or 22 which translates to about 1:133 scale. However Kibana I guess may go maybe to zoom 17…

---

## [Cluster ID "5d1f1d" - Logstash startup is super slow](https://discuss.elastic.co/t/cluster-id-5d1f1d-logstash-startup-is-super-slow/85963)

<div class="topic-metadata">

**Author:** [@vidagh](https://discuss.elastic.co/u/vidagh)\
**Replies:** 5\
**Last updated:** [May 17, 2017, 9:38am UTC](https://discuss.elastic.co/t/cluster-id-5d1f1d-logstash-startup-is-super-slow/85963 "2017-05-17T09:38:19Z")

</div>

Hi, Logstash is taking hours to execute as the filter size is growing, and CPU usage goes to max. It works fine for a parser of around 2000 lines, but then it would slow down, almost stops, as it grows. CentOS ma…

---

## [Remove suggestions for deleted index patterns](https://discuss.elastic.co/t/remove-suggestions-for-deleted-index-patterns/43142)

<div class="topic-metadata">

**Author:** [@yahoo](https://discuss.elastic.co/u/yahoo)\
**Replies:** 5\
**Last updated:** [March 1, 2016, 11:53pm UTC](https://discuss.elastic.co/t/remove-suggestions-for-deleted-index-patterns/43142 "2016-03-01T23:53:28Z")

</div>

Hi I deleted 6 indices from Elasticsearch 2.1.1. However their patterns still show up as suggestions in Kibana. I even reinstalled Logstash, ES, and Kibana 4.3.1 Windows in a separate directory. But the suggestions s…

---

## [TokenStream implementation in ElasticSearch](https://discuss.elastic.co/t/tokenstream-implementation-in-elasticsearch/7055)

<div class="topic-metadata">

**Author:** [@thinusp](https://discuss.elastic.co/u/thinusp)\
**Replies:** 5\
**Last updated:** [March 25, 2012, 10:20am UTC](https://discuss.elastic.co/t/tokenstream-implementation-in-elasticsearch/7055 "2012-03-25T10:20:42Z")

</div>

In Lucene I am able to inject my own stream of tokens, should I choose to do so: GenericTokenStream customToken = new GenericTokenStream(...); doc.add(new Field("tags", customToken)); where GenericTokenStream is…

---

## [How to emit console.log output when using javascript-lang for custom scripts?](https://discuss.elastic.co/t/how-to-emit-console-log-output-when-using-javascript-lang-for-custom-scripts/21374)

<div class="topic-metadata">

**Author:** [@Tim\_Heckel](https://discuss.elastic.co/u/Tim_Heckel)\
**Replies:** 1\
**Last updated:** [January 16, 2015, 10:23am UTC](https://discuss.elastic.co/t/how-to-emit-console-log-output-when-using-javascript-lang-for-custom-scripts/21374 "2015-01-16T10:23:36Z")

</div>

Hi all -- I'd like to emit to stdout information within my custom .js script (located in /elasticsearch/1.4.2/config/scripts/test.js). I've tried both console.log and print (just a guess), but neither work: "erro…

---

## [Dashboard data showing 0 in intervals](https://discuss.elastic.co/t/dashboard-data-showing-0-in-intervals/187992)

<div class="topic-metadata">

**Author:** [@maasid](https://discuss.elastic.co/u/maasid)\
**Replies:** 6\
**Last updated:** [June 28, 2019, 1:21pm UTC](https://discuss.elastic.co/t/dashboard-data-showing-0-in-intervals/187992 "2019-06-28T13:21:51Z")

</div>

Hello, I have setup multiple dashboards, ranging from Metricbeat, Filebeat, Packetbeat etc. When I'm looking at my Metricbeat dashboards I have the refresh set to 10 sec and the span set to 15m, on each refresh I may or…

---

## [Mapping index template](https://discuss.elastic.co/t/mapping-index-template/97540)

<div class="topic-metadata">

**Author:** [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)\
**Replies:** 6\
**Last updated:** [August 19, 2017, 5:11am UTC](https://discuss.elastic.co/t/mapping-index-template/97540 "2017-08-19T05:11:12Z")

</div>

I need to map my filebeat index template in kibana. https://pastebin.com/raw/7fmbBfTc This is my index and i need to put it into kibana. When i used PUT /\_template/filebeat command it throws validation exception, temp…

[Previous page](https://discuss.elastic.co/top.md?page=1290&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1292&per_page=50&period=all)
