# Top

**URL:** https://discuss.elastic.co/top.md?page=1292&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1293

---

## [Is there a way to disable source mapping in fleet-managed APM?](https://discuss.elastic.co/t/is-there-a-way-to-disable-source-mapping-in-fleet-managed-apm/351531)

<div class="topic-metadata">

**Author:** [@Overl0rd](https://discuss.elastic.co/u/Overl0rd)\
**Replies:** 1\
**Last updated:** [January 24, 2024, 2:53am UTC](https://discuss.elastic.co/t/is-there-a-way-to-disable-source-mapping-in-fleet-managed-apm/351531 "2024-01-24T02:53:47Z")

</div>

Hi, I'm looking to disable to source.mapping in fleet-managed APM. Our APM is currently trying to read source maps of logs which do not have a source map, causing stack traces to be filled with ""error": unable to find …

---

## [X509: certificate signed by unknown authority](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority/316904)

<div class="topic-metadata">

**Author:** [@EExisT](https://discuss.elastic.co/u/EExisT)\
**Replies:** 2\
**Last updated:** [October 18, 2022, 10:53pm UTC](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority/316904 "2022-10-18T22:53:56Z")

</div>

Hello, I have an SSL connection between a Windows machine with Winlogbeat and Metricbeat and an Ubuntu machine with ES and Kibana on it. The beat's .ymls file are the same, with same configuration. With the elasticsea…

---

## [Transform missing data](https://discuss.elastic.co/t/transform-missing-data/308818)

<div class="topic-metadata">

**Author:** [@rokcarl](https://discuss.elastic.co/u/rokcarl)\
**Replies:** 2\
**Last updated:** [July 14, 2022, 2:12pm UTC](https://discuss.elastic.co/t/transform-missing-data/308818 "2022-07-14T14:12:08Z")

</div>

I have a transform that aggregates my stats index data for long-term storage, but the results are no longer correct. My stats index stores each request (one document = one request) and stores the credits used by that re…

---

## [Multiple small indexes or one index with potential mapping explosion](https://discuss.elastic.co/t/multiple-small-indexes-or-one-index-with-potential-mapping-explosion/244917)

<div class="topic-metadata">

**Author:** [@mcampster](https://discuss.elastic.co/u/mcampster)\
**Replies:** 2\
**Last updated:** [September 1, 2020, 4:22pm UTC](https://discuss.elastic.co/t/multiple-small-indexes-or-one-index-with-potential-mapping-explosion/244917 "2020-09-01T16:22:34Z")

</div>

Background Having read the various posts on multiple indexes with small number of document vs single index with all the documents, I still am not sure what to do in my situation... We have a approximately 2-3 million d…

---

## [Moving from ELK to EFK](https://discuss.elastic.co/t/moving-from-elk-to-efk/204073)

<div class="topic-metadata">

**Author:** [@yavidor](https://discuss.elastic.co/u/yavidor)\
**Replies:** 2\
**Last updated:** [October 29, 2019, 9:21am UTC](https://discuss.elastic.co/t/moving-from-elk-to-efk/204073 "2019-10-29T09:21:23Z")

</div>

Hi! were moving our infra to containers and we wold like to use filebeat to send the logs directly to Elasticsearch from Filebeat, instead of going trough Logstash. In this process we might lose our logstash filtering a…

---

## [Terms aggregation in Timelion](https://discuss.elastic.co/t/terms-aggregation-in-timelion/182137)

<div class="topic-metadata">

**Author:** [@6tUBp3gwd9Zp](https://discuss.elastic.co/u/6tUBp3gwd9Zp)\
**Replies:** 2\
**Last updated:** [May 23, 2019, 6:39am UTC](https://discuss.elastic.co/t/terms-aggregation-in-timelion/182137 "2019-05-23T06:39:59Z")

</div>

Is it somehow possible to aggregate over terms with Timelion?

---

## [Create Histogram Bucket Aggregation](https://discuss.elastic.co/t/create-histogram-bucket-aggregation/168462)

<div class="topic-metadata">

**Author:** [@Mariner191](https://discuss.elastic.co/u/Mariner191)\
**Replies:** 2\
**Last updated:** [February 19, 2019, 6:53pm UTC](https://discuss.elastic.co/t/create-histogram-bucket-aggregation/168462 "2019-02-19T18:53:38Z")

</div>

Request How to: Create Histogram Bucket Aggregation. Describes, but not How, at https://www.youtube.com/watch?v=j-eCKDhj-Os Thank you!

---

## [Persist Filebeat registry on Kubernetes host](https://discuss.elastic.co/t/persist-filebeat-registry-on-kubernetes-host/137285)

<div class="topic-metadata">

**Author:** [@mariomechoulam](https://discuss.elastic.co/u/mariomechoulam)\
**Replies:** 2\
**Last updated:** [June 26, 2018, 1:54pm UTC](https://discuss.elastic.co/t/persist-filebeat-registry-on-kubernetes-host/137285 "2018-06-26T13:54:27Z")

</div>

Hello everyone! We have Filebeat running as a DaemonSet in our Kubernetes cluster, using, for the most part, the yaml provided in the Filebeat documentation. I am trying to decide whether we should be using the tail\_fi…

---

## [High CPU Usage by logstash processes](https://discuss.elastic.co/t/high-cpu-usage-by-logstash-processes/93697)

<div class="topic-metadata">

**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\
**Replies:** 2\
**Last updated:** [July 19, 2017, 7:51am UTC](https://discuss.elastic.co/t/high-cpu-usage-by-logstash-processes/93697 "2017-07-19T07:51:56Z")

</div>

When the logstash process is consuming high CPU cycles and CPU usage shoots up to more than 100%. The server is a 2 core machine. The standard GROK filters have been used to process the log files. There are 3 set of GROK…

---

## [Twitter Client Error "Connection Refused"](https://discuss.elastic.co/t/twitter-client-error-connection-refused/66205)

<div class="topic-metadata">

**Author:** [@Vikas\_Reddy\_Aravabhu](https://discuss.elastic.co/u/Vikas_Reddy_Aravabhu)\
**Replies:** 2\
**Last updated:** [November 21, 2016, 2:03am UTC](https://discuss.elastic.co/t/twitter-client-error-connection-refused/66205 "2016-11-21T02:03:54Z")

</div>

Twitter client error {:message=\>"Connection refused - Connection refused", :exception=\>"Errno::ECONNREFUSED", :backtrace=\>\["org/jruby/ext/socket/RubyTCPSocket.java:126:in initialize'", "org/jruby/RubyIO.java:871:innew'",…

---

## [Kibana4: Color formatter for Strings?](https://discuss.elastic.co/t/kibana4-color-formatter-for-strings/58217)

<div class="topic-metadata">

**Author:** [@MarcelHallmann](https://discuss.elastic.co/u/MarcelHallmann)\
**Replies:** 2\
**Last updated:** [October 8, 2016, 7:49pm UTC](https://discuss.elastic.co/t/kibana4-color-formatter-for-strings/58217 "2016-10-08T19:49:41Z")

</div>

Hi all, acording to https://github.com/elastic/kibana/blob/4cce8e878fe0f2aa7a59ea2000d9bdb018384297/docs/color-formatter.asciidoc the color formatter only works for numbers, but not for strings. When will the feature…

---

## [Ignore plugin error](https://discuss.elastic.co/t/ignore-plugin-error/36013)

<div class="topic-metadata">

**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\
**Replies:** 2\
**Last updated:** [December 9, 2015, 5:55pm UTC](https://discuss.elastic.co/t/ignore-plugin-error/36013 "2015-12-09T17:55:55Z")

</div>

I am using geoip plugin to geo code IP, but sometimes, event are coming with a wrong IP then geoip plugin throws error then nothing is output \[:confused:\] https://github.com/logstash-plugins/logstash-filter-geoip/blob…

---

## [Multi parent child relation](https://discuss.elastic.co/t/multi-parent-child-relation/36482)

<div class="topic-metadata">

**Author:** [@tpraizler](https://discuss.elastic.co/u/tpraizler)\
**Replies:** 2\
**Last updated:** [December 7, 2015, 8:54am UTC](https://discuss.elastic.co/t/multi-parent-child-relation/36482 "2015-12-07T08:54:37Z")

</div>

Hey, After reading a lot, looks like there is no support for multi parent documents in elasticsearch. It maybe indicate wrong modeling of my documents. The thing is I am not sure what or how I can handle this use case…

---

## [Inconsistent search results?](https://discuss.elastic.co/t/inconsistent-search-results/26668)

<div class="topic-metadata">

**Author:** [@aarongu](https://discuss.elastic.co/u/aarongu)\
**Replies:** 2\
**Last updated:** [August 1, 2015, 5:20am UTC](https://discuss.elastic.co/t/inconsistent-search-results/26668 "2015-08-01T05:20:02Z")

</div>

Hello! When I do this query: "query": { "simple\_query\_string": { "query": "\[FSM:END\]: certificates configuration(FSM:sam:dme:PkiEpUpdateEp)" } }, "sort": { "time": { "order": "desc" } …

---

## [Avoiding duplicate data and work when using a shared filesystem](https://discuss.elastic.co/t/avoiding-duplicate-data-and-work-when-using-a-shared-filesystem/325)

<div class="topic-metadata">

**Author:** [@pweaver](https://discuss.elastic.co/u/pweaver)\
**Replies:** 2\
**Last updated:** [May 7, 2015, 7:15am UTC](https://discuss.elastic.co/t/avoiding-duplicate-data-and-work-when-using-a-shared-filesystem/325 "2015-05-07T07:15:05Z")

</div>

If two elasticsearch nodes share the same filesystem, then is there any way to prevent them from pointlessly copying data from one node to the other (e.g. don't actually copy anything when rebalancing), or duplicating th…

---

## [Indexing, transaction and isolation](https://discuss.elastic.co/t/indexing-transaction-and-isolation/4872)

<div class="topic-metadata">

**Author:** [@Spring\_Ninja](https://discuss.elastic.co/u/Spring_Ninja)\
**Replies:** 2\
**Last updated:** [July 15, 2011, 6:36pm UTC](https://discuss.elastic.co/t/indexing-transaction-and-isolation/4872 "2011-07-15T18:36:05Z")

</div>

Hi there all! I have an embedded ES running in a Spring backed application. I have synchronized ES with the TransactionManager. Updates and deletes are logged into a TransactionSynchronization context. If the tra…

---

## [Elastic enterprise throws 502 errors](https://discuss.elastic.co/t/elastic-enterprise-throws-502-errors/351615)

<div class="topic-metadata">

**Author:** [@Gerardo\_Zenobi](https://discuss.elastic.co/u/Gerardo_Zenobi)\
**Replies:** 4\
**Last updated:** [February 6, 2024, 8:27am UTC](https://discuss.elastic.co/t/elastic-enterprise-throws-502-errors/351615 "2024-02-06T08:27:57Z")

</div>

Hi there, We have been getting quite a few 5xx responses from Elastic Enterprise Request: both from our web client requests to App Search, as well as when browsing Enterprise Search within elastic cloud deployment UX. E…

---

## [Handlebar Helpers in TSVB Markdown](https://discuss.elastic.co/t/handlebar-helpers-in-tsvb-markdown/300991)

<div class="topic-metadata">

**Author:** [@Kirubanandhan](https://discuss.elastic.co/u/Kirubanandhan)\
**Replies:** 4\
**Last updated:** [March 31, 2022, 9:02am UTC](https://discuss.elastic.co/t/handlebar-helpers-in-tsvb-markdown/300991 "2022-03-31T09:02:35Z")

</div>

Hi Team, I want to add some Handlebar helpers like below. So that i can use it in TSVB Markdown. I need to use it for calculate difference between the two count values. @tsullivan @devon.thomson @bhavyarm Help required…

---

## [Copy value of @timestamp to another field](https://discuss.elastic.co/t/copy-value-of-timestamp-to-another-field/284634)

<div class="topic-metadata">

**Author:** [@mostpha456](https://discuss.elastic.co/u/mostpha456)\
**Replies:** 4\
**Last updated:** [September 22, 2021, 9:26am UTC](https://discuss.elastic.co/t/copy-value-of-timestamp-to-another-field/284634 "2021-09-22T09:26:03Z")

</div>

Hello, I am trying to copy the value of @timestamp to new field timestamp keeping the same format. Is that possible ? Do you have any suggestion ? Thank you. Mustapha

---

## [Privileges are missing and can't be removed, currently](https://discuss.elastic.co/t/privileges-are-missing-and-cant-be-removed-currently/156758)

<div class="topic-metadata">

**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\
**Replies:** 4\
**Last updated:** [November 16, 2018, 9:16pm UTC](https://discuss.elastic.co/t/privileges-are-missing-and-cant-be-removed-currently/156758 "2018-11-16T21:16:53Z")

</div>

I started new instance of Kibana, yet when I tried to access it, I've got following message: plugin:security@6.4.2 - Privileges are missing and can't be removed, currently. Please advise.

---

## [Display UTC on Timeseries axis](https://discuss.elastic.co/t/display-utc-on-timeseries-axis/156534)

<div class="topic-metadata">

**Author:** [@jrobinson](https://discuss.elastic.co/u/jrobinson)\
**Replies:** 4\
**Last updated:** [November 16, 2018, 8:17pm UTC](https://discuss.elastic.co/t/display-utc-on-timeseries-axis/156534 "2018-11-16T20:17:33Z")

</div>

I want to display UTC time everywhere. Using Management:Advanced Setttings: dateFormat:tz set to UTC I can get UTC time displayed on the discover page. On my dashboard, for example a timeseries visualization, on the x…

---

## [Kibana-1 hour gap](https://discuss.elastic.co/t/kibana-1-hour-gap/124046)

<div class="topic-metadata">

**Author:** [@K3vin](https://discuss.elastic.co/u/K3vin)\
**Replies:** 4\
**Last updated:** [March 19, 2018, 6:11pm UTC](https://discuss.elastic.co/t/kibana-1-hour-gap/124046 "2018-03-19T18:11:10Z")

</div>

Hello, I had implemented the stack and now I tried to improve my dashboard. I created a script field to get the day of week. It was very easy : doc\['@timestamp'\].date.dayOfWeek But when I create a visualize with @time…

---

## [Es5 index creation hanging](https://discuss.elastic.co/t/es5-index-creation-hanging/84747)

<div class="topic-metadata">

**Author:** [@fguery](https://discuss.elastic.co/u/fguery)\
**Replies:** 4\
**Last updated:** [May 13, 2017, 9:29pm UTC](https://discuss.elastic.co/t/es5-index-creation-hanging/84747 "2017-05-13T21:29:17Z")

</div>

Hello, We encountered an issue back in 5.0/5.1 that ElasticSearch was not able to create an index if the mapping contained lots of synonyms. We are still pushing all the synonyms directly via the mapping, and while this …

---

## [Export ES indices based on time](https://discuss.elastic.co/t/export-es-indices-based-on-time/29269)

<div class="topic-metadata">

**Author:** [@michaellizhou](https://discuss.elastic.co/u/michaellizhou)\
**Replies:** 4\
**Last updated:** [September 14, 2015, 9:01pm UTC](https://discuss.elastic.co/t/export-es-indices-based-on-time/29269 "2015-09-14T21:01:05Z")

</div>

Is there a way to export ES indices from a time range? i.e. 1:00 PM - 2:00PM? I want to be able to export this range and send it another ES instance.

---

## [\[Hadoop\] Setting Document ID in Map Reduce Mapper](https://discuss.elastic.co/t/hadoop-setting-document-id-in-map-reduce-mapper/17888)

<div class="topic-metadata">

**Author:** [@Daniel\_Tardon](https://discuss.elastic.co/u/Daniel_Tardon)\
**Replies:** 4\
**Last updated:** [September 2, 2014, 11:16am UTC](https://discuss.elastic.co/t/hadoop-setting-document-id-in-map-reduce-mapper/17888 "2014-09-02T11:16:41Z")

</div>

Hi all, I'm newbie with ES and i'm trying to set manually each document ID. I've seen in the documentation the es.mapping.id propperty and I'm trying to set it in the conf part of the driver class the same way i set t…

---

## [Issue with S3-repository with two different elasticsearch cluster](https://discuss.elastic.co/t/issue-with-s3-repository-with-two-different-elasticsearch-cluster/227995)

<div class="topic-metadata">

**Author:** [@Christophe.aron](https://discuss.elastic.co/u/Christophe.aron)\
**Replies:** 1\
**Last updated:** [April 28, 2020, 3:56pm UTC](https://discuss.elastic.co/t/issue-with-s3-repository-with-two-different-elasticsearch-cluster/227995 "2020-04-28T15:56:18Z")

</div>

Hello, I am having a configuration problem on two different elasticsearch cluster. I follow this documentation about s3-repository The context is that I have a cluster in version 5.6.x with which I configured the s3-…

---

## [Need compatible version of x-pack-transport of org.elasticsearch.client with ElasticSearch 6.8.2](https://discuss.elastic.co/t/need-compatible-version-of-x-pack-transport-of-org-elasticsearch-client-with-elasticsearch-6-8-2/209316)

<div class="topic-metadata">

**Author:** [@Avinaba\_Ghosh\_Hajra](https://discuss.elastic.co/u/Avinaba_Ghosh_Hajra)\
**Replies:** 7\
**Last updated:** [November 25, 2019, 9:21pm UTC](https://discuss.elastic.co/t/need-compatible-version-of-x-pack-transport-of-org-elasticsearch-client-with-elasticsearch-6-8-2/209316 "2019-11-25T21:21:04Z")

</div>

We are using elasticsearch 6.8.2. Existing code is using TrasportClient for connection with ElasticSEarch from Java code. Now there is ELastiSearch userid and password. So we are trying to use x-pack-transport depend…

---

## [I want to change the image color according to the conditions in canvas](https://discuss.elastic.co/t/i-want-to-change-the-image-color-according-to-the-conditions-in-canvas/208201)

<div class="topic-metadata">

**Author:** [@Yungyoung\_Ok](https://discuss.elastic.co/u/Yungyoung_Ok)\
**Replies:** 1\
**Last updated:** [November 18, 2019, 3:34pm UTC](https://discuss.elastic.co/t/i-want-to-change-the-image-color-according-to-the-conditions-in-canvas/208201 "2019-11-18T15:34:02Z")

</div>

I want to change the image color according to the conditions in canvas. for example, if count over 100 then red image show, count below 100 then green image show. is it possible? I think it's possible, but I don't kn…

---

## [RemoteTransportException without root cause](https://discuss.elastic.co/t/remotetransportexception-without-root-cause/14062)

<div class="topic-metadata">

**Author:** [@Justin\_Uang](https://discuss.elastic.co/u/Justin_Uang)\
**Replies:** 1\
**Last updated:** [October 25, 2013, 7:16am UTC](https://discuss.elastic.co/t/remotetransportexception-without-root-cause/14062 "2013-10-25T07:16:29Z")

</div>

I got this error java.util.concurrent.ExecutionException: org.elasticsearch.transport.RemoteTransportException: \[Sigyn\]\[inet\[/10.160.14.67:8600\]\]\[search\] and the stack trace was just of how I called exe…

---

## [Filebeat exclude\_files regex](https://discuss.elastic.co/t/filebeat-exclude-files-regex/321206)

<div class="topic-metadata">

**Author:** [@Shubham\_Singh](https://discuss.elastic.co/u/Shubham_Singh)\
**Replies:** 3\
**Last updated:** [December 20, 2022, 9:49am UTC](https://discuss.elastic.co/t/filebeat-exclude-files-regex/321206 "2022-12-20T09:49:15Z")

</div>

I want to exclude all access logs files from the filebeat except 2 service access logs. I'm using the regex but getting error and filebeat start is failing exclude\_files: \['\\/var\\/log\\/xxx\\/.\*(?!.\*(xxx)).\*\\/.\*(?!.\*(xxx)…

---

## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/313925)

<div class="topic-metadata">

**Author:** [@Boodle](https://discuss.elastic.co/u/Boodle)\
**Replies:** 8\
**Last updated:** [September 9, 2022, 7:07pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/313925 "2022-09-09T19:07:59Z")

</div>

Have a 3 node cluster for elasticsearch on docker server1(recently upgraded to 7.17.6), server2(On 7.10.1), server3(On 7.10.1) and a single Kibana(recently upgraded to 7.17.6) instance on server1. All 3 ES nodes & kib…

---

## [Logstash: Как заменить значение полей на основании содержимого](https://discuss.elastic.co/t/logstash/200204)

<div class="topic-metadata">

**Author:** [@Igor\_Belyakov](https://discuss.elastic.co/u/Igor_Belyakov)\
**Replies:** 3\
**Last updated:** [September 20, 2019, 11:56am UTC](https://discuss.elastic.co/t/logstash/200204 "2019-09-20T11:56:55Z")

</div>

Добрый день. Столкнулся с такой проблемой. У меня в логах вместо источников событий указываются индексы этих источников. Так как перечень источников конечен, то нет большой проблемы составить таблицу сопоставлений индек…

---

## [Number of hosts displayed in Kibana dashboard (is wrong)](https://discuss.elastic.co/t/number-of-hosts-displayed-in-kibana-dashboard-is-wrong/196256)

<div class="topic-metadata">

**Author:** [@JustinJ](https://discuss.elastic.co/u/JustinJ)\
**Replies:** 3\
**Last updated:** [August 25, 2019, 5:31am UTC](https://discuss.elastic.co/t/number-of-hosts-displayed-in-kibana-dashboard-is-wrong/196256 "2019-08-25T05:31:16Z")

</div>

In my cluster configuration, I have two ingest nodes, two data node and 1 kibana(coordinate node). Also, i have configured a central event collector in Windows server 2016 and installed winlog beat and filebeat on the sa…

---

## [Logstash HTTP\_Poller input plugin not sending output to Elasticsearch](https://discuss.elastic.co/t/logstash-http-poller-input-plugin-not-sending-output-to-elasticsearch/101193)

<div class="topic-metadata">

**Author:** [@VIJAYP](https://discuss.elastic.co/u/VIJAYP)\
**Replies:** 3\
**Last updated:** [September 28, 2017, 5:37pm UTC](https://discuss.elastic.co/t/logstash-http-poller-input-plugin-not-sending-output-to-elasticsearch/101193 "2017-09-28T17:37:53Z")

</div>

Hello, I'm trying to log IBM Liberty server's metrics to Elasticsearch for dashboard purposes. Here's my logstash config file: input { http\_poller { urls =\> { "service1" =\> "https://dc2-svzsys01.xxxx.com:11…

---

## [Performance monitoring of Elasticsearch server](https://discuss.elastic.co/t/performance-monitoring-of-elasticsearch-server/27673)

<div class="topic-metadata">

**Author:** [@puneetm](https://discuss.elastic.co/u/puneetm)\
**Replies:** 3\
**Last updated:** [August 20, 2015, 9:57pm UTC](https://discuss.elastic.co/t/performance-monitoring-of-elasticsearch-server/27673 "2015-08-20T21:57:57Z")

</div>

Hi, I am new to Elasticsearch and want to know how we can measure stats like CPU usage, memory etc. I want to create a customized report for a given period of time. I have looked into Marvel plugin, it is gathering d…

---

## [Firewall cisco ASA and beats](https://discuss.elastic.co/t/firewall-cisco-asa-and-beats/239612)

<div class="topic-metadata">

**Author:** [@Feriel\_Mufti](https://discuss.elastic.co/u/Feriel_Mufti)\
**Replies:** 5\
**Last updated:** [July 8, 2020, 4:28pm UTC](https://discuss.elastic.co/t/firewall-cisco-asa-and-beats/239612 "2020-07-08T16:28:51Z")

</div>

Hello , i am using elasticsearch and kibana on server centos 7 , i have configured beats directly sent to elasticsearch ( without need to configure logstash) and it works perfectly from both centos agents and windows age…

---

## [\_grokparsefailure tag](https://discuss.elastic.co/t/grokparsefailure-tag/168010)

<div class="topic-metadata">

**Author:** [@Nat](https://discuss.elastic.co/u/Nat)\
**Replies:** 5\
**Last updated:** [February 21, 2019, 3:02pm UTC](https://discuss.elastic.co/t/grokparsefailure-tag/168010 "2019-02-21T15:02:28Z")

</div>

Hello, I am trying to parse the message from some logs and split the message in different fields. I am using some custom made grok patterns that should apply to all the messages (tested at grok debugger). Nevertheless …

---

## [Elasticsearch poor indexing performance](https://discuss.elastic.co/t/elasticsearch-poor-indexing-performance/106327)

<div class="topic-metadata">

**Author:** [@apyshchyk](https://discuss.elastic.co/u/apyshchyk)\
**Replies:** 5\
**Last updated:** [November 3, 2017, 8:23pm UTC](https://discuss.elastic.co/t/elasticsearch-poor-indexing-performance/106327 "2017-11-03T20:23:03Z")

</div>

Hi everyone, I have issues with ES indexing performance. First of all - current cluster setup 15 data nodes 8CPU, 32RAM 3 Master nodes 4CPU, 16 RAM external monitoring cluster. For current performance testing I'm se…

---

## [Cannot build custom plugin due to logstash-core-plugin-api version issue](https://discuss.elastic.co/t/cannot-build-custom-plugin-due-to-logstash-core-plugin-api-version-issue/52991)

<div class="topic-metadata">

**Author:** [@chrstphrhrt](https://discuss.elastic.co/u/chrstphrhrt)\
**Replies:** 0\
**Last updated:** [June 16, 2016, 12:23pm UTC](https://discuss.elastic.co/t/cannot-build-custom-plugin-due-to-logstash-core-plugin-api-version-issue/52991 "2016-06-16T12:23:34Z")

</div>

Hi, I've created a custom plugin derived from logstash-input-redis that adds support for additional processing of output that redis emits but which is not parsed by the upstream plugin. I have successfully built the ge…

---

## [Distributed tracing for java application on windows system](https://discuss.elastic.co/t/distributed-tracing-for-java-application-on-windows-system/302870)

<div class="topic-metadata">

**Author:** [@yahire](https://discuss.elastic.co/u/yahire)\
**Replies:** 6\
**Last updated:** [April 27, 2022, 9:30am UTC](https://discuss.elastic.co/t/distributed-tracing-for-java-application-on-windows-system/302870 "2022-04-27T09:30:19Z")

</div>

Kibana version: 8.1.1 Elasticsearch version: 8.1.1 APM Server version:8.1.1 APM Agent language and version: Java 17 open jdk Setup is done on Windows system and java agent of version 1.30 is used as java agent, for t…

---

## [LDAP authentication error](https://discuss.elastic.co/t/ldap-authentication-error/250118)

<div class="topic-metadata">

**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\
**Replies:** 6\
**Last updated:** [September 28, 2020, 8:36am UTC](https://discuss.elastic.co/t/ldap-authentication-error/250118 "2020-09-28T08:36:32Z")

</div>

Hi all I have a little problems with authenticate to ldap server, i set it to work already but sometime the authen give me an error timeout, and all the time all of our account have to wait for some time to log in the…

---

## [XML response from unstructured log](https://discuss.elastic.co/t/xml-response-from-unstructured-log/213916)

<div class="topic-metadata">

**Author:** [@Kishorekolla](https://discuss.elastic.co/u/Kishorekolla)\
**Replies:** 6\
**Last updated:** [January 20, 2020, 7:25am UTC](https://discuss.elastic.co/t/xml-response-from-unstructured-log/213916 "2020-01-20T07:25:07Z")

</div>

Hi Team, I'm a beginner to logstash. Till now worked on configuring basic Input, Filebeats and Output plugins by following product documents which are available in the official website. Now I have a real time scenario …

---

## [Rollover request failed but the index is created](https://discuss.elastic.co/t/rollover-request-failed-but-the-index-is-created/206091)

<div class="topic-metadata">

**Author:** [@Alex\_Huo](https://discuss.elastic.co/u/Alex_Huo)\
**Replies:** 6\
**Last updated:** [November 6, 2019, 9:23pm UTC](https://discuss.elastic.co/t/rollover-request-failed-but-the-index-is-created/206091 "2019-11-06T21:23:29Z")

</div>

Hey there, I got a 503 response when using \_rollover API. Here is the response. { "error": { "root\_cause": \[ { "type": "process\_cluster\_event\_timeout\_exception", …

---

## [Filebeat 6.3.2 doesn´t detect every started container](https://discuss.elastic.co/t/filebeat-6-3-2-doesn-t-detect-every-started-container/146643)

<div class="topic-metadata">

**Author:** [@Christian\_Wohrle](https://discuss.elastic.co/u/Christian_Wohrle)\
**Replies:** 6\
**Last updated:** [August 30, 2018, 5:31pm UTC](https://discuss.elastic.co/t/filebeat-6-3-2-doesn-t-detect-every-started-container/146643 "2018-08-30T17:31:39Z")

</div>

I´m using filebeat 6.3.2 to ship container logs. This is my current filebeat configuration (see below). --- filebeat.autodiscover: providers: - type: docker templates: - condition: conta…

---

## [Filebeat configuration to create different elasticsearch index](https://discuss.elastic.co/t/filebeat-configuration-to-create-different-elasticsearch-index/128607)

<div class="topic-metadata">

**Author:** [@Ferdous\_Shibly](https://discuss.elastic.co/u/Ferdous_Shibly)\
**Replies:** 6\
**Last updated:** [April 30, 2018, 4:08pm UTC](https://discuss.elastic.co/t/filebeat-configuration-to-create-different-elasticsearch-index/128607 "2018-04-30T16:08:58Z")

</div>

Hi, We are trying to configure Filebeat to send logs to Elasticsearch. We want to create different index than the default one. Here is the configuration - input\_type: log paths: - /var/log/application1/\*.err …

---

## [Protecting endpoints in Kibana with fragment identifier](https://discuss.elastic.co/t/protecting-endpoints-in-kibana-with-fragment-identifier/115155)

<div class="topic-metadata">

**Author:** [@dr\_dob](https://discuss.elastic.co/u/dr_dob)\
**Replies:** 6\
**Last updated:** [January 11, 2018, 8:21pm UTC](https://discuss.elastic.co/t/protecting-endpoints-in-kibana-with-fragment-identifier/115155 "2018-01-11T20:21:35Z")

</div>

Hi, I am trying to protect certain endpoints in Kibana, specifically dashboards, with Nginx. The problem is that the fragment identifier does not get sent in the request, so everything after /app/kibana is ignored, only…

---

## [Metricbeat creates a Standalone Cluster](https://discuss.elastic.co/t/metricbeat-creates-a-standalone-cluster/285492)

<div class="topic-metadata">

**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\
**Replies:** 1\
**Last updated:** [September 30, 2021, 11:15am UTC](https://discuss.elastic.co/t/metricbeat-creates-a-standalone-cluster/285492 "2021-09-30T11:15:00Z")

</div>

Hi folks, I have running 3 nodes elastic cluster and 2 nodes of logstash and I use metricbeat to monitor them and filebeat to collect logs. Everything is in 7.13.2 version Currently I am experiencing following issue wh…

---

## [Get earliest timestamp per day](https://discuss.elastic.co/t/get-earliest-timestamp-per-day/191722)

<div class="topic-metadata">

**Author:** [@EZprogramming](https://discuss.elastic.co/u/EZprogramming)\
**Replies:** 1\
**Last updated:** [July 23, 2019, 5:14pm UTC](https://discuss.elastic.co/t/get-earliest-timestamp-per-day/191722 "2019-07-23T17:14:53Z")

</div>

I am trying to get the earliest (minimum) timestamp per day for a specfici message and log group. However, my output is not what I'm expecting, I only get the minimum timestamp among all timestamp and not the minimum ti…

---

## [Logstash Google Pub Sub - results in error java.lang.NoSuchMethodError: com.google.common.base.Preconditions.checkArgument(ZLjava/lang/String](https://discuss.elastic.co/t/logstash-google-pub-sub-results-in-error-java-lang-nosuchmethoderror-com-google-common-base-preconditions-checkargument-zljava-lang-string/132001)

<div class="topic-metadata">

**Author:** [@Pinkesh\_Valdria](https://discuss.elastic.co/u/Pinkesh_Valdria)\
**Replies:** 1\
**Last updated:** [May 16, 2018, 5:51pm UTC](https://discuss.elastic.co/t/logstash-google-pub-sub-results-in-error-java-lang-nosuchmethoderror-com-google-common-base-preconditions-checkargument-zljava-lang-string/132001 "2018-05-16T17:51:01Z")

</div>

I installed logstash on a debian OS and then installed the Google Pub Sub plugin . Simple pipeline test works fine, but using Google pub/sub as input results in below error. last line of stacktrace: \[ERROR\] 2018-05-1…

---

## [How to create a date and hour field into a timestamp](https://discuss.elastic.co/t/how-to-create-a-date-and-hour-field-into-a-timestamp/108213)

<div class="topic-metadata">

**Author:** [@pgervais](https://discuss.elastic.co/u/pgervais)\
**Replies:** 1\
**Last updated:** [November 21, 2017, 6:25am UTC](https://discuss.elastic.co/t/how-to-create-a-date-and-hour-field-into-a-timestamp/108213 "2017-11-21T06:25:37Z")

</div>

I need to combine two fields , one of which contains a date field and the other an hour field into a timestamp . For example, the Date field : "01OCT17" i.e. 1'st of OCT 2017. The Hour field is a numeric value from 0-2…

[Previous page](https://discuss.elastic.co/top.md?page=1291&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1293&per_page=50&period=all)
