# Top

**URL:** https://discuss.elastic.co/top.md?page=1294&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1295

---

## [Filebeat 5.4.1 not updating registry when file closed/removed](https://discuss.elastic.co/t/filebeat-5-4-1-not-updating-registry-when-file-closed-removed/91952)

<div class="topic-metadata">

**Author:** [@Sean1e](https://discuss.elastic.co/u/Sean1e)\
**Replies:** 2\
**Last updated:** [July 6, 2017, 11:18am UTC](https://discuss.elastic.co/t/filebeat-5-4-1-not-updating-registry-when-file-closed-removed/91952 "2017-07-06T11:18:06Z")

</div>

Hello, I'm running Filebeat & ELK 5.4.1 on CentOS 7. The server where Filebeat runs hosts 2 applications whose logs get rotated weekly. Filebeat is setup to close an inactive file after 7 minutes and to remove a file…

---

## [Dynamically adding fields with ES field mapping template enabled](https://discuss.elastic.co/t/dynamically-adding-fields-with-es-field-mapping-template-enabled/89634)

<div class="topic-metadata">

**Author:** [@krishna\_chaitanya](https://discuss.elastic.co/u/krishna_chaitanya)\
**Replies:** 2\
**Last updated:** [June 19, 2017, 4:58pm UTC](https://discuss.elastic.co/t/dynamically-adding-fields-with-es-field-mapping-template-enabled/89634 "2017-06-19T16:58:05Z")

</div>

I am unable to decide between dynamic mapping and giving a template before hand. I have configured logstash with file input and ES output. Say, ES output plugin is configured with field mapping template. Currently, I…

---

## [\[SOLVED\] Drop when a field is equal to](https://discuss.elastic.co/t/solved-drop-when-a-field-is-equal-to/54003)

<div class="topic-metadata">

**Author:** [@Alex\_Lum](https://discuss.elastic.co/u/Alex_Lum)\
**Replies:** 2\
**Last updated:** [June 27, 2016, 8:12am UTC](https://discuss.elastic.co/t/solved-drop-when-a-field-is-equal-to/54003 "2016-06-27T08:12:36Z")

</div>

Hello all. A new question, i need to drop lines when a fieldname is equal to something. example : Jun 27 09:27:37 10.0.6.1 date=2016-06-27 time=09:27:37 logid=0000000013 type=traffic subtype=forward level=notice dsti…

---

## [Convert text field containg xml string](https://discuss.elastic.co/t/convert-text-field-containg-xml-string/238856)

<div class="topic-metadata">

**Author:** [@Mips128](https://discuss.elastic.co/u/Mips128)\
**Replies:** 5\
**Last updated:** [June 29, 2020, 6:57am UTC](https://discuss.elastic.co/t/convert-text-field-containg-xml-string/238856 "2020-06-29T06:57:54Z")

</div>

Hi, I am pretty new to elasticsearch and I have a problem that I can't even solve using google. Therefore, I really appreciate any help. I use a tool (log2timeline) to create an Index and add data to it. I am not able …

---

## [Timelion moving continusly](https://discuss.elastic.co/t/timelion-moving-continusly/94877)

<div class="topic-metadata">

**Author:** [@Amit2015](https://discuss.elastic.co/u/Amit2015)\
**Replies:** 5\
**Last updated:** [August 18, 2017, 5:21pm UTC](https://discuss.elastic.co/t/timelion-moving-continusly/94877 "2017-08-18T17:21:22Z")

</div>

Hi, I have created Timelion and also using it in Dashboard. Timelion is continuously moving, is there any setting we can set? Please suggest… Thanks!

---

## [Elastic 8.0.0 - Stack Monitoring - All nodes are listed as Master Nodes](https://discuss.elastic.co/t/elastic-8-0-0-stack-monitoring-all-nodes-are-listed-as-master-nodes/298260)

<div class="topic-metadata">

**Author:** [@AndreiRD](https://discuss.elastic.co/u/AndreiRD)\
**Replies:** 6\
**Last updated:** [March 1, 2022, 1:52pm UTC](https://discuss.elastic.co/t/elastic-8-0-0-stack-monitoring-all-nodes-are-listed-as-master-nodes/298260 "2022-03-01T13:52:26Z")

</div>

I just set Stack Monitoring with Metricbeat for an Elasticsearch 8.0 cluster and I noticed a weird thing: all nodes are reported as Master Nodes (see the star icon in the screenshot below). Any idea what I did wrong?

---

## [\[Logstash\] Aggregate filter - no timeout](https://discuss.elastic.co/t/logstash-aggregate-filter-no-timeout/279318)

<div class="topic-metadata">

**Author:** [@wedkarz014](https://discuss.elastic.co/u/wedkarz014)\
**Replies:** 6\
**Last updated:** [July 22, 2021, 2:24am UTC](https://discuss.elastic.co/t/logstash-aggregate-filter-no-timeout/279318 "2021-07-22T02:24:48Z")

</div>

Hi, In my logstash 7.9.3 I would like to create filter similar to that example https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html#plugins-filters-aggregate-example3 I want to create index w…

---

## [Configuring Metricbeat](https://discuss.elastic.co/t/configuring-metricbeat/140951)

<div class="topic-metadata">

**Author:** [@piedmont01](https://discuss.elastic.co/u/piedmont01)\
**Replies:** 2\
**Last updated:** [July 23, 2018, 9:51am UTC](https://discuss.elastic.co/t/configuring-metricbeat/140951 "2018-07-23T09:51:08Z")

</div>

Maybe it's me but the Elastic documentation isn't clear as to what's server and what's client :frowning: I have installed metricbeat on several clients and they appear to be sending data to Elasticsearch. But I don't h…

---

## [Using logical AND query in Kibana](https://discuss.elastic.co/t/using-logical-and-query-in-kibana/229276)

<div class="topic-metadata">

**Author:** [@adiksl](https://discuss.elastic.co/u/adiksl)\
**Replies:** 3\
**Last updated:** [April 23, 2020, 3:24pm UTC](https://discuss.elastic.co/t/using-logical-and-query-in-kibana/229276 "2020-04-23T15:24:03Z")

</div>

I am trying to implement a simple query in Kibana and then in C# NEST. I am from a SQL background and am struggling to find documentation to perform a relatively simple SQL query in Elasticsearch. The query I am trying t…

---

## [Cluster overflooded with tasks and growing!](https://discuss.elastic.co/t/cluster-overflooded-with-tasks-and-growing/170439)

<div class="topic-metadata">

**Author:** [@dropchew](https://discuss.elastic.co/u/dropchew)\
**Replies:** 3\
**Last updated:** [March 1, 2019, 8:11am UTC](https://discuss.elastic.co/t/cluster-overflooded-with-tasks-and-growing/170439 "2019-03-01T08:11:11Z")

</div>

Logstash are not able to ingest to the cluster now and tasks are still growing exponentially and no signs of slowing down. There are already 400k+ as of now. There are tasks that are running for days and new tasks insert…

---

## [Make Grok filter fields aggregatable](https://discuss.elastic.co/t/make-grok-filter-fields-aggregatable/137345)

<div class="topic-metadata">

**Author:** [@bobbytan](https://discuss.elastic.co/u/bobbytan)\
**Replies:** 3\
**Last updated:** [June 26, 2018, 7:02am UTC](https://discuss.elastic.co/t/make-grok-filter-fields-aggregatable/137345 "2018-06-26T07:02:47Z")

</div>

Hello, I have succesfully filtered out fields needed from logs by using GROK.The data within these field shown in stdout are correct,however these fields(error code &loglevel) are not aggregatable in kibana.How do I cha…

---

## [Different refresh rate within a dashboard](https://discuss.elastic.co/t/different-refresh-rate-within-a-dashboard/112905)

<div class="topic-metadata">

**Author:** [@Yiyi\_Chen](https://discuss.elastic.co/u/Yiyi_Chen)\
**Replies:** 3\
**Last updated:** [December 26, 2017, 9:55pm UTC](https://discuss.elastic.co/t/different-refresh-rate-within-a-dashboard/112905 "2017-12-26T21:55:07Z")

</div>

Hi all, I have built a dashboard which have several visualizations. I am wondering if I can have different auto-refresh rate for each visualization in this dashboard(like 5 sec for a pie chart, 10 sec for a line chart),…

---

## [Nested attachments struggle](https://discuss.elastic.co/t/nested-attachments-struggle/104059)

<div class="topic-metadata">

**Author:** [@Rutger](https://discuss.elastic.co/u/Rutger)\
**Replies:** 3\
**Last updated:** [October 17, 2017, 12:57pm UTC](https://discuss.elastic.co/t/nested-attachments-struggle/104059 "2017-10-17T12:57:19Z")

</div>

Hi there, I'm having a (very) hard time mapping and indexing nested attachments. What I have so far: Elasticsearch vesion: 5.5 Mapping: { "mappings": { "entry": { "properties": { …

---

## [Different disk watermark settings per node](https://discuss.elastic.co/t/different-disk-watermark-settings-per-node/47102)

<div class="topic-metadata">

**Author:** [@oranciog](https://discuss.elastic.co/u/oranciog)\
**Replies:** 3\
**Last updated:** [April 5, 2017, 2:42pm UTC](https://discuss.elastic.co/t/different-disk-watermark-settings-per-node/47102 "2017-04-05T14:42:53Z")

</div>

Hello! I saw in documentation that disk watermark can be configured per cluster using the following settings: - cluster.routing.allocation.disk.watermark.low - cluster.routing.allocation.disk.watermark.high Is the…

---

## [Can ElasticSearch Clients be authenticated using Shield](https://discuss.elastic.co/t/can-elasticsearch-clients-be-authenticated-using-shield/69674)

<div class="topic-metadata">

**Author:** [@sss](https://discuss.elastic.co/u/sss)\
**Replies:** 3\
**Last updated:** [December 21, 2016, 9:14pm UTC](https://discuss.elastic.co/t/can-elasticsearch-clients-be-authenticated-using-shield/69674 "2016-12-21T21:14:22Z")

</div>

I happened to go through the below link in the shield documentation https://www.elastic.co/guide/en/shield/shield-1.3/\_using\_elasticsearch\_java\_clients\_with\_shield.html#transport-client where it says "Using the Java…

---

## [Post expiry of X-PACK license](https://discuss.elastic.co/t/post-expiry-of-x-pack-license/69005)

<div class="topic-metadata">

**Author:** [@Super\_Kingg](https://discuss.elastic.co/u/Super_Kingg)\
**Replies:** 3\
**Last updated:** [December 14, 2016, 10:45am UTC](https://discuss.elastic.co/t/post-expiry-of-x-pack-license/69005 "2016-12-14T10:45:55Z")

</div>

Hi, Could you please let me know if the security feature will be disabled once the trial license for 30 days expires ? What I read from the documentation is that "Commercial plugins operate with reduced functionality o…

---

## [Searching Wikipedia With Elasticsearch](https://discuss.elastic.co/t/searching-wikipedia-with-elasticsearch/57732)

<div class="topic-metadata">

**Author:** [@Imed\_Ben\_Ghozi](https://discuss.elastic.co/u/Imed_Ben_Ghozi)\
**Replies:** 3\
**Last updated:** [August 11, 2016, 8:25pm UTC](https://discuss.elastic.co/t/searching-wikipedia-with-elasticsearch/57732 "2016-08-11T20:25:32Z")

</div>

For my Application Need to get a Wikipedia Page based on a List of Weighted Keywords(Sometimes this List can contain only 1 Word). It is Critical for my application that the first Result be the most Relevant Document. F…

---

## [How to build indexes for Object Storage Statistics collection](https://discuss.elastic.co/t/how-to-build-indexes-for-object-storage-statistics-collection/54594)

<div class="topic-metadata">

**Author:** [@ranp](https://discuss.elastic.co/u/ranp)\
**Replies:** 3\
**Last updated:** [July 4, 2016, 10:47pm UTC](https://discuss.elastic.co/t/how-to-build-indexes-for-object-storage-statistics-collection/54594 "2016-07-04T22:47:16Z")

</div>

Hi Friends, Newbie to ELK, so patience with me. I have a grid product (Object storage) which is a cluster that is compound of nodes. It is based on nodes (server with disks) grouped into Zones, and the data is stored…

---

## [Benchmarking the Java Transport API](https://discuss.elastic.co/t/benchmarking-the-java-transport-api/54058)

<div class="topic-metadata">

**Author:** [@eugene\_miretsky](https://discuss.elastic.co/u/eugene_miretsky)\
**Replies:** 3\
**Last updated:** [June 28, 2016, 7:51am UTC](https://discuss.elastic.co/t/benchmarking-the-java-transport-api/54058 "2016-06-28T07:51:38Z")

</div>

Rally has been released recently and looks pretty awesome, but it uses the Python REST API. We are using the Java transport API which is suppose to be faster. Two questions: 1) Rally is used as the nightly benchmark to…

---

## [Packetbeat: http.content\_lenth fields is for request or response](https://discuss.elastic.co/t/packetbeat-http-content-lenth-fields-is-for-request-or-response/46468)

<div class="topic-metadata">

**Author:** [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\
**Replies:** 3\
**Last updated:** [April 7, 2016, 6:01am UTC](https://discuss.elastic.co/t/packetbeat-http-content-lenth-fields-is-for-request-or-response/46468 "2016-04-07T06:01:21Z")

</div>

Hello { ES World }, The field, http.content\_length in HTTP field list, whether it is request content length or it is response content length? As we want to dashboard, Responses based on their sizes; we're gonna need …

---

## [MasterNotDiscoveredException when using the Java Node Client API](https://discuss.elastic.co/t/masternotdiscoveredexception-when-using-the-java-node-client-api/41064)

<div class="topic-metadata">

**Author:** [@Ramdev\_Wudali](https://discuss.elastic.co/u/Ramdev_Wudali)\
**Replies:** 3\
**Last updated:** [February 5, 2016, 1:28pm UTC](https://discuss.elastic.co/t/masternotdiscoveredexception-when-using-the-java-node-client-api/41064 "2016-02-05T13:28:56Z")

</div>

Hi All: I am running a long running java App that connects to ES Cluster (currently at 1.5.2) using the Node Client API. It connects and creates the requisite client nodes these are my settings : ImmutableSettin…

---

## [Conditional output to statsd](https://discuss.elastic.co/t/conditional-output-to-statsd/40022)

<div class="topic-metadata">

**Author:** [@tullis](https://discuss.elastic.co/u/tullis)\
**Replies:** 3\
**Last updated:** [January 25, 2016, 1:27pm UTC](https://discuss.elastic.co/t/conditional-output-to-statsd/40022 "2016-01-25T13:27:20Z")

</div>

Hi, I'm trying to use logstash (v 1.4.5) to increment a counter in statsd, based on a pattern match in an haproxy httplog file. I am already sending various metrics from each line in the file, but I'm now trying to a…

---

## [\[SERVICE\_UNAVAILABLE/1/state not recovered / initialized\]](https://discuss.elastic.co/t/service-unavailable-1-state-not-recovered-initialized/175913)

<div class="topic-metadata">

**Author:** [@sblancocr](https://discuss.elastic.co/u/sblancocr)\
**Replies:** 0\
**Last updated:** [April 8, 2019, 8:09pm UTC](https://discuss.elastic.co/t/service-unavailable-1-state-not-recovered-initialized/175913 "2019-04-08T20:09:49Z")

</div>

Hello I have installed an Elasticsearch 6.2.2 cluster but it shows up in red when I check its health status \[root@log-elasticsearch-client-01 cigestion\]# curl -X GET 'http://log-elasticsearch-client-01.alpha.ci.ucr.ac.…

---

## [Can't load CSV data into elasticsearch index](https://discuss.elastic.co/t/cant-load-csv-data-into-elasticsearch-index/153048)

<div class="topic-metadata">

**Author:** [@elk\_enthu](https://discuss.elastic.co/u/elk_enthu)\
**Replies:** 1\
**Last updated:** [October 22, 2018, 12:22pm UTC](https://discuss.elastic.co/t/cant-load-csv-data-into-elasticsearch-index/153048 "2018-10-22T12:22:40Z")

</div>

Hi there, Since last 3 days, I’m trying to explore ELK stack and importing CSV table into Elasticsearch through Logstash. Checked many forums and videos and tried the following. But, I get various errors. Here’s what I’…

---

## [How to recover after bad rolling upgrade](https://discuss.elastic.co/t/how-to-recover-after-bad-rolling-upgrade/224466)

<div class="topic-metadata">

**Author:** [@Michael\_Jackson1](https://discuss.elastic.co/u/Michael_Jackson1)\
**Replies:** 4\
**Last updated:** [March 20, 2020, 7:05pm UTC](https://discuss.elastic.co/t/how-to-recover-after-bad-rolling-upgrade/224466 "2020-03-20T19:05:45Z")

</div>

I was following the rolling upgrade documentation and the first node I was trying to upgrade from 7.3 to 7.6 didn't upgrade. It still shows that I am on 7.3 and now my cluster health shows red. Now I am seeing: .kibana…

---

## [Enroll missing](https://discuss.elastic.co/t/enroll-missing/158419)

<div class="topic-metadata">

**Author:** [@bering](https://discuss.elastic.co/u/bering)\
**Replies:** 3\
**Last updated:** [March 29, 2019, 11:49am UTC](https://discuss.elastic.co/t/enroll-missing/158419 "2019-03-29T11:49:42Z")

</div>

I am trying to create a new metricset with the Metricbeat 6.5.1 i have downloaded the sourcecode from here: https://github.com/elastic/beats/releases I can easily compile the metricbeat but running metricbeat --help show…

---

## [Installing Elasticsearch Error](https://discuss.elastic.co/t/installing-elasticsearch-error/342976)

<div class="topic-metadata">

**Author:** [@heureux](https://discuss.elastic.co/u/heureux)\
**Replies:** 2\
**Last updated:** [September 14, 2023, 6:56am UTC](https://discuss.elastic.co/t/installing-elasticsearch-error/342976 "2023-09-14T06:56:38Z")

</div>

Hi, By executing the command: ./bin/elasticsearch I have this error: \< \[ERROR\]\[o.e.b.Elasticsearch \] \[wazuh-server\] fatal exception while booting Elasticsearchjava.lang.RuntimeException: can not run elasticsearc…

---

## [How to calculate gauss value](https://discuss.elastic.co/t/how-to-calculate-gauss-value/297106)

<div class="topic-metadata">

**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Replies:** 2\
**Last updated:** [February 15, 2022, 11:13am UTC](https://discuss.elastic.co/t/how-to-calculate-gauss-value/297106 "2022-02-15T11:13:13Z")

</div>

I want to know how this gauss value is calculated. POST sneaker/\_search { "query": { "function\_score": { "functions": \[ { "gauss": { "price": { "origin": "300", …

---

## [Constant session timeouts in Kibana 7.10.0 on OpenShift but not with 7.9.3](https://discuss.elastic.co/t/constant-session-timeouts-in-kibana-7-10-0-on-openshift-but-not-with-7-9-3/256000)

<div class="topic-metadata">

**Author:** [@ngilmore](https://discuss.elastic.co/u/ngilmore)\
**Replies:** 2\
**Last updated:** [November 20, 2020, 6:52am UTC](https://discuss.elastic.co/t/constant-session-timeouts-in-kibana-7-10-0-on-openshift-but-not-with-7-9-3/256000 "2020-11-20T06:52:30Z")

</div>

I have installed a secured Elastic 7.10.0 cluster (3 master, 2 client, 5 data nodes) on OpenShift and added Kibana (2 node cluster). However, with Kibana 7.10.0 installed it constantly experiences session timeouts. I h…

---

## [Index not created using log stash](https://discuss.elastic.co/t/index-not-created-using-log-stash/246443)

<div class="topic-metadata">

**Author:** [@Adarsh\_S](https://discuss.elastic.co/u/Adarsh_S)\
**Replies:** 2\
**Last updated:** [August 27, 2020, 12:31am UTC](https://discuss.elastic.co/t/index-not-created-using-log-stash/246443 "2020-08-27T00:31:36Z")

</div>

I am using elasticsearch with logstash \[Version : 7.9.0\] to visualize a data set with kibana. I am doing this task on Windows10. Logstash config file - input { jdbc { jdbc\_driver\_library =\> "$PATH\\mysql-connect…

---

## [Heap dump file created](https://discuss.elastic.co/t/heap-dump-file-created/134169)

<div class="topic-metadata">

**Author:** [@Nikhil\_Jaiswal](https://discuss.elastic.co/u/Nikhil_Jaiswal)\
**Replies:** 2\
**Last updated:** [June 4, 2018, 3:43am UTC](https://discuss.elastic.co/t/heap-dump-file-created/134169 "2018-06-04T03:43:44Z")

</div>

Hi All, i am getting below error mesgae while running logstash 6.2.4 \[image\] and this process is creating 8Gb dump file inside logstash and logstash is crashing after this. Any help would be appreciated.

---

## [Kibana logout is invalid](https://discuss.elastic.co/t/kibana-logout-is-invalid/124894)

<div class="topic-metadata">

**Author:** [@zxq209](https://discuss.elastic.co/u/zxq209)\
**Replies:** 2\
**Last updated:** [March 22, 2018, 1:51am UTC](https://discuss.elastic.co/t/kibana-logout-is-invalid/124894 "2018-03-22T01:51:29Z")

</div>

I‘m using elasticsearch6.2.2 +xpack kibana6.2.2 +xpack following is kibana.yml server.port: 5601 server.host: "0.0.0.0" elasticsearch.username: "elastic" elasticsearch.password: "abcdef" when I access localhost:560…

---

## [Error while starting elastic node: failed to load bundle \[file:/D:/elasticse arch/elasticsearch-5.3.0/modules/aggs-matrix-stats/aggs-matrix-stats-5.3.0.jar\] due to jar hell](https://discuss.elastic.co/t/error-while-starting-elastic-node-failed-to-load-bundle-file-d-elasticse-arch-elasticsearch-5-3-0-modules-aggs-matrix-stats-aggs-matrix-stats-5-3-0-jar-due-to-jar-hell/82379)

<div class="topic-metadata">

**Author:** [@ImdotnetJunkie](https://discuss.elastic.co/u/ImdotnetJunkie)\
**Replies:** 2\
**Last updated:** [April 14, 2017, 5:12pm UTC](https://discuss.elastic.co/t/error-while-starting-elastic-node-failed-to-load-bundle-file-d-elasticse-arch-elasticsearch-5-3-0-modules-aggs-matrix-stats-aggs-matrix-stats-5-3-0-jar-due-to-jar-hell/82379 "2017-04-14T17:12:15Z")

</div>

Getting below error while starting elastic node: \[2017-04-14T07:09:26,402\]\[WARN \]\[o.e.b.ElasticsearchUncaughtExceptionHandler\] \[lonms29910\] uncaught exception in thread \[main\] org.elasticsearch.bootstrap.StartupExcepti…

---

## [Filebeat start endless reconnectiosn when connect error happen to kafka cluster](https://discuss.elastic.co/t/filebeat-start-endless-reconnectiosn-when-connect-error-happen-to-kafka-cluster/56241)

<div class="topic-metadata">

**Author:** [@DeeeFOX](https://discuss.elastic.co/u/DeeeFOX)\
**Replies:** 2\
**Last updated:** [July 26, 2016, 3:39am UTC](https://discuss.elastic.co/t/filebeat-start-endless-reconnectiosn-when-connect-error-happen-to-kafka-cluster/56241 "2016-07-26T03:39:45Z")

</div>

Version: latest stable Operating System: Debian 8 Steps to Reproduce: Description There is 4 filebeat nodes, a 2 node kafka cluster, and data is being send from beat to kafka correctly in this structure. fb fb…

---

## [Logstash subscribe Kafka message gets ClosedChannelException](https://discuss.elastic.co/t/logstash-subscribe-kafka-message-gets-closedchannelexception/31445)

<div class="topic-metadata">

**Author:** [@Jason\_Zheng](https://discuss.elastic.co/u/Jason_Zheng)\
**Replies:** 2\
**Last updated:** [October 1, 2015, 2:52pm UTC](https://discuss.elastic.co/t/logstash-subscribe-kafka-message-gets-closedchannelexception/31445 "2015-10-01T14:52:22Z")

</div>

Hi All, I would like to get message from kafka but get ClosedChannelException (loops) log4j, \[2015-10-01T15:44:28.569\] WARN: kafka.consumer.ConsumerFetcherManager$LeaderFinderThread: \[logstash\_logstashsubkafka-14436…

---

## [Winlogbeat wrong values](https://discuss.elastic.co/t/winlogbeat-wrong-values/326070)

<div class="topic-metadata">

**Author:** [@objectprogr](https://discuss.elastic.co/u/objectprogr)\
**Replies:** 7\
**Last updated:** [April 12, 2023, 1:36pm UTC](https://discuss.elastic.co/t/winlogbeat-wrong-values/326070 "2023-04-12T13:36:40Z")

</div>

I see the flows from my Windows computer, but I have for example: account name: %1 domain name: %2 logon type: %9 ect. For example, on Windows %1 is Computer1, domain name is testDomian ect.

---

## [URGENT! Elastic search: Unable to perform jdbc query because of Exception when executing JDBC query](https://discuss.elastic.co/t/urgent-elastic-search-unable-to-perform-jdbc-query-because-of-exception-when-executing-jdbc-query/291181)

<div class="topic-metadata">

**Author:** [@Leo\_Baby\_Jacob](https://discuss.elastic.co/u/Leo_Baby_Jacob)\
**Replies:** 1\
**Last updated:** [December 8, 2021, 2:27pm UTC](https://discuss.elastic.co/t/urgent-elastic-search-unable-to-perform-jdbc-query-because-of-exception-when-executing-jdbc-query/291181 "2021-12-08T14:27:24Z")

</div>

I have a sample logstash conf file, However when I. run it I can see a logstash error caused Error is \[371de1f7cad8c35c02e4a3047ec831da42b9b5048183b45a3916162ab248f3f7\] Exception when executing JDBC query {:excepti…

---

## [Errors are not logged/visible on APM UI](https://discuss.elastic.co/t/errors-are-not-logged-visible-on-apm-ui/240899)

<div class="topic-metadata">

**Author:** [@Pankaj\_Navneet](https://discuss.elastic.co/u/Pankaj_Navneet)\
**Replies:** 7\
**Last updated:** [July 26, 2020, 7:12am UTC](https://discuss.elastic.co/t/errors-are-not-logged-visible-on-apm-ui/240899 "2020-07-26T07:12:00Z")

</div>

Hi Team, I have successfully use the APM for my java application. All the requests/tranasactions with status code 200, 404, etc are showing in the UI. But i am not seeing any traces of Error's in the UI (screenshot atta…

---

## [Bookmarking Kibana dashboard](https://discuss.elastic.co/t/bookmarking-kibana-dashboard/204695)

<div class="topic-metadata">

**Author:** [@savage](https://discuss.elastic.co/u/savage)\
**Replies:** 1\
**Last updated:** [October 22, 2019, 8:10pm UTC](https://discuss.elastic.co/t/bookmarking-kibana-dashboard/204695 "2019-10-22T20:10:14Z")

</div>

(Using Kibana 6.7) We have customers who bookmark Kibana dashboards. The bookmark refers to a URL that obviously has volatile portions, (e.g. \_\_\_h@44136fa&\_a=h@32698d5). When those users open the bookmark to reload a das…

---

## [Unable to read email from outlook](https://discuss.elastic.co/t/unable-to-read-email-from-outlook/204187)

<div class="topic-metadata">

**Author:** [@ashokchinna](https://discuss.elastic.co/u/ashokchinna)\
**Replies:** 1\
**Last updated:** [October 19, 2019, 10:00pm UTC](https://discuss.elastic.co/t/unable-to-read-email-from-outlook/204187 "2019-10-19T22:00:26Z")

</div>

I am trying to read the emails from the outlook. input { imap { host =\> "outlook.office365.com" password =\> "\*\*\*\*\*\*\*\*" user =\> "\*\*\*\*\*\*\*\*\*" port =\> 993 secure =\> true check\_interval =\> 10 folder =\> "XYZ" } } out…

---

## [Can filebeat monitoring send data to Kafka?](https://discuss.elastic.co/t/can-filebeat-monitoring-send-data-to-kafka/200006)

<div class="topic-metadata">

**Author:** [@arunpmohan](https://discuss.elastic.co/u/arunpmohan)\
**Replies:** 7\
**Last updated:** [September 28, 2019, 3:43pm UTC](https://discuss.elastic.co/t/can-filebeat-monitoring-send-data-to-kafka/200006 "2019-09-28T15:43:06Z")

</div>

As per the monitoring options for Filebeat given here, the monitoring stats can be send to Elasticsearch. But I would like the data to be sent to Kafka. Is this possible?.

---

## [Logstash 6.2.2 unable to start](https://discuss.elastic.co/t/logstash-6-2-2-unable-to-start/124510)

<div class="topic-metadata">

**Author:** [@Dvikas](https://discuss.elastic.co/u/Dvikas)\
**Replies:** 1\
**Last updated:** [March 31, 2018, 9:56pm UTC](https://discuss.elastic.co/t/logstash-6-2-2-unable-to-start/124510 "2018-03-31T21:56:25Z")

</div>

I got the following error when i started logstash. error no 1=\>\[ERROR\]\[logstash.pipeline \] Error registering plugin {:pipeline\_id=\>"main", :plugin=\>"#\<LogStash::OutputDelegator:0x2edd9e81 @namespaced\_metric=#\<Log…

---

## [Best practices for "debugging" and problem solving logstash problems](https://discuss.elastic.co/t/best-practices-for-debugging-and-problem-solving-logstash-problems/121154)

<div class="topic-metadata">

**Author:** [@digirave](https://discuss.elastic.co/u/digirave)\
**Replies:** 1\
**Last updated:** [February 23, 2018, 7:10am UTC](https://discuss.elastic.co/t/best-practices-for-debugging-and-problem-solving-logstash-problems/121154 "2018-02-23T07:10:08Z")

</div>

Hello, I'm new to logstash and testing filebeat -\> logstash -\> elasticsearch -\> kibana for viewing log data. I have managed to use logstash to parse and format log formats, but I am worried that some log lines may b…

---

## [Type casting in Groovy reduce script of scripted metric aggregation](https://discuss.elastic.co/t/type-casting-in-groovy-reduce-script-of-scripted-metric-aggregation/32513)

<div class="topic-metadata">

**Author:** [@loren](https://discuss.elastic.co/u/loren)\
**Replies:** 1\
**Last updated:** [October 21, 2015, 5:52pm UTC](https://discuss.elastic.co/t/type-casting-in-groovy-reduce-script-of-scripted-metric-aggregation/32513 "2015-10-21T17:52:46Z")

</div>

I'm using the output of a scripted metric aggregation like the one I describe here as the payload for a Watcher condition. I'd expect the ratio of two numbers to also be a number, but it's coming back as a string unless …

---

## [APM server is not listening in netstat tupln](https://discuss.elastic.co/t/apm-server-is-not-listening-in-netstat-tupln/316540)

<div class="topic-metadata">

**Author:** [@lekshmir80](https://discuss.elastic.co/u/lekshmir80)\
**Replies:** 5\
**Last updated:** [October 31, 2022, 9:40am UTC](https://discuss.elastic.co/t/apm-server-is-not-listening-in-netstat-tupln/316540 "2022-10-31T09:40:03Z")

</div>

Kibana version: 7.8.0 Elasticsearch version: 7.8.0 APM Server version: 7.8.0 APM Agent language and version: 6.12.0 Browser version: Chrome 105.0.5195.125 Original install method (e.g. download page, yum, deb, from…

---

## [Elastic SIEM showing duplicate hosts when Defender ATP logs are shipped in](https://discuss.elastic.co/t/elastic-siem-showing-duplicate-hosts-when-defender-atp-logs-are-shipped-in/249152)

<div class="topic-metadata">

**Author:** [@InnerJoin](https://discuss.elastic.co/u/InnerJoin)\
**Replies:** 5\
**Last updated:** [September 23, 2020, 2:44pm UTC](https://discuss.elastic.co/t/elastic-siem-showing-duplicate-hosts-when-defender-atp-logs-are-shipped-in/249152 "2020-09-23T14:44:54Z")

</div>

I am currently working on getting together a POC of the Elastic SIEM solution. I already have a machine shipping logs into Elasticsearch with a winlogbeat agent and I am showing in the Hosts section of the SIEM that logs…

---

## [Logstash not able to output to ES error occurred sending bulk request](https://discuss.elastic.co/t/logstash-not-able-to-output-to-es-error-occurred-sending-bulk-request/157000)

<div class="topic-metadata">

**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\
**Replies:** 5\
**Last updated:** [November 22, 2018, 12:07pm UTC](https://discuss.elastic.co/t/logstash-not-able-to-output-to-es-error-occurred-sending-bulk-request/157000 "2018-11-22T12:07:30Z")

</div>

I am able to see the output in stout but when I am indexing to ES it gives this error The thing is if I am connecting to Hive from jdbc input this error comes. I am able to index data from oracle. An error occurred sen…

---

## [Regarding cluster.routing.allocation.disk.include\_relocations](https://discuss.elastic.co/t/regarding-cluster-routing-allocation-disk-include-relocations/110255)

<div class="topic-metadata">

**Author:** [@akshaymaniyar](https://discuss.elastic.co/u/akshaymaniyar)\
**Replies:** 5\
**Last updated:** [January 4, 2018, 4:10pm UTC](https://discuss.elastic.co/t/regarding-cluster-routing-allocation-disk-include-relocations/110255 "2018-01-04T16:10:39Z")

</div>

Hi, I have a confusion regarding the setting cluster.routing.allocation.disk.include\_relocations =\> Defaults to true, which means that Elasticsearch will take into account shards that are currently being relocated to t…

---

## [How to stem adjectives that end with y](https://discuss.elastic.co/t/how-to-stem-adjectives-that-end-with-y/80187)

<div class="topic-metadata">

**Author:** [@jerolomy](https://discuss.elastic.co/u/jerolomy)\
**Replies:** 5\
**Last updated:** [March 27, 2017, 9:32pm UTC](https://discuss.elastic.co/t/how-to-stem-adjectives-that-end-with-y/80187 "2017-03-27T21:32:20Z")

</div>

I want to know how to stem adjectives that end with y (english). For example I want a search of "funky song" to match "funk song" higher than "random song". How do I do that? I have tried a few out-of-the-box stemmers bu…

---

## [Logstash: формирование @timestamp, используя имя файла лога и данные самого лога (ч. 2)](https://discuss.elastic.co/t/logstash-timestamp-2/276144)

<div class="topic-metadata">

**Author:** [@lkfmasd](https://discuss.elastic.co/u/lkfmasd)\
**Replies:** 3\
**Last updated:** [June 22, 2021, 7:06pm UTC](https://discuss.elastic.co/t/logstash-timestamp-2/276144 "2021-06-22T19:06:35Z")

</div>

Добрый день. Продолжение темы: Logstash: формирование @timestamp, используя имя файла лога и данные самого лога. Продублирую задачу: На текущий момент поле @timestamp формируется, исходя из даты, когда данные были пер…

[Previous page](https://discuss.elastic.co/top.md?page=1293&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1295&per_page=50&period=all)
