# Top **URL:** https://discuss.elastic.co/top.md?page=1299&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1300 --- ## [Using gsub for multi line patterns](https://discuss.elastic.co/t/using-gsub-for-multi-line-patterns/251458)
**Author:** [@Surya\_Iriventi](https://discuss.elastic.co/u/Surya_Iriventi)\ **Replies:** 2\ **Last updated:** [October 9, 2020, 5:26am UTC](https://discuss.elastic.co/t/using-gsub-for-multi-line-patterns/251458 "2020-10-09T05:26:38Z")
Hi, I am trying to use gsub to remove the prefix for the log line. I have a filebeat configuration which matches multiline conguration. The multi line log message (input to logstash) would look line this: \*\*\*\* Error … --- ## [Windows containers logging](https://discuss.elastic.co/t/windows-containers-logging/221997)
**Author:** [@alek](https://discuss.elastic.co/u/alek)\ **Replies:** 2\ **Last updated:** [March 4, 2020, 7:24pm UTC](https://discuss.elastic.co/t/windows-containers-logging/221997 "2020-03-04T19:24:40Z")
Hi, We have recently started using GKE ( Google managed Kubernetes service ) windows nodes. For all the linux deployments, we have filebeat deployed as daemonset that sends all the application logs into our Elasticsear… --- ## [Random Logout of Multiple Load Balanced Kibana on Multiple Elasticsearch Clusters](https://discuss.elastic.co/t/random-logout-of-multiple-load-balanced-kibana-on-multiple-elasticsearch-clusters/207942)
**Author:** [@AlessandroKP](https://discuss.elastic.co/u/AlessandroKP)\ **Replies:** 2\ **Last updated:** [November 15, 2019, 4:13pm UTC](https://discuss.elastic.co/t/random-logout-of-multiple-load-balanced-kibana-on-multiple-elasticsearch-clusters/207942 "2019-11-15T16:13:06Z")
Hi all, SETUP: Analytics Cluster 1 Kibana Load Balancer (Sticky Session configured) 2 Analytics Kibana instances connecting to Coordinating Nodes 2 Coordinating Nodes 3 Data Nodes Monitoring Cluster 1 Kibana Load… --- ## [Csv file is being deleted after process](https://discuss.elastic.co/t/csv-file-is-being-deleted-after-process/184041)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 2\ **Last updated:** [June 3, 2019, 7:06pm UTC](https://discuss.elastic.co/t/csv-file-is-being-deleted-after-process/184041 "2019-06-03T19:06:54Z")
I have a config which reads csv files. csv file gets to it's location via rcp from another system once a day. but that csv file gets deleted as soon it process reading it. I don't want that to be deleted. how do I do t… --- ## [Latency with 2 Elasticsearch systems](https://discuss.elastic.co/t/latency-with-2-elasticsearch-systems/170074)
**Author:** [@krknopp](https://discuss.elastic.co/u/krknopp)\ **Replies:** 2\ **Last updated:** [March 1, 2019, 1:41pm UTC](https://discuss.elastic.co/t/latency-with-2-elasticsearch-systems/170074 "2019-03-01T13:41:31Z")
I have the requirement of collecting logs and then sending some (based on source log file path name) to one elasticsearch server and the rest to another one. In order to accomplish this, I'm using Filebeat to send to a … --- ## [Fetch unique values of field in Similar logs](https://discuss.elastic.co/t/fetch-unique-values-of-field-in-similar-logs/140625)
**Author:** [@deadPix3l](https://discuss.elastic.co/u/deadPix3l)\ **Replies:** 2\ **Last updated:** [July 19, 2018, 1:24am UTC](https://discuss.elastic.co/t/fetch-unique-values-of-field-in-similar-logs/140625 "2018-07-19T01:24:37Z")
I have an index with about a quarter million logs and growing. many logs are exactly the same except one field. ie. (only an example) { event\_id: 1265, reason: "permission denied", file: "/etc/shadow" process: "chr… --- ## [HighLevelRestClient log4j configuration](https://discuss.elastic.co/t/highlevelrestclient-log4j-configuration/128577)
**Author:** [@seibelj](https://discuss.elastic.co/u/seibelj)\ **Replies:** 2\ **Last updated:** [April 19, 2018, 4:12pm UTC](https://discuss.elastic.co/t/highlevelrestclient-log4j-configuration/128577 "2018-04-19T16:12:13Z")
Hi. New to Elasticsearch and have a question about logging in the HighLevelRestClient. I wrote a java client that uses the Rest Client but everytime I crank it up to insert records into Elasticsearch I get the following… --- ## [Cannot install multiline filter on FreeBSD 11](https://discuss.elastic.co/t/cannot-install-multiline-filter-on-freebsd-11/106929)
**Author:** [@pdna](https://discuss.elastic.co/u/pdna)\ **Replies:** 2\ **Last updated:** [November 8, 2017, 9:42pm UTC](https://discuss.elastic.co/t/cannot-install-multiline-filter-on-freebsd-11/106929 "2017-11-08T21:42:43Z")
I installed ELK stack from the FreeBSD package manager. sudo /usr/local/logstash/bin/logstash-plugin install logstash-filter-multiline sudo: /usr/local/logstash/bin/logstash-plugin: command not found After making the f… --- ## [Kibana 5.2.2 dashboard for Openstack](https://discuss.elastic.co/t/kibana-5-2-2-dashboard-for-openstack/89714)
**Author:** [@dmcn\_es](https://discuss.elastic.co/u/dmcn_es)\ **Replies:** 2\ **Last updated:** [June 19, 2017, 8:58am UTC](https://discuss.elastic.co/t/kibana-5-2-2-dashboard-for-openstack/89714 "2017-06-19T08:58:41Z")
hi, we have a large OpenStack Mitaka installation using ELK and kibana version 5.2.2 to monitor with filebeats installed on the client sides. Would anyone have available advice or an exported json file of a kibana d… --- ## [Metric visualization with date range calculation](https://discuss.elastic.co/t/metric-visualization-with-date-range-calculation/267644)
**Author:** [@alytkowski](https://discuss.elastic.co/u/alytkowski)\ **Replies:** 1\ **Last updated:** [March 22, 2021, 10:15am UTC](https://discuss.elastic.co/t/metric-visualization-with-date-range-calculation/267644 "2021-03-22T10:15:07Z")
I have a metric type data that I get every 10s from the EMS Server and one of the properties is: inbound message count. It's a total inbound message count for the EMS server. What I'd like to achieve is to create a metri… --- ## [How to set kibana with google chatbot](https://discuss.elastic.co/t/how-to-set-kibana-with-google-chatbot/191836)
**Author:** [@brunoof1](https://discuss.elastic.co/u/brunoof1)\ **Replies:** 1\ **Last updated:** [July 23, 2019, 3:04pm UTC](https://discuss.elastic.co/t/how-to-set-kibana-with-google-chatbot/191836 "2019-07-23T15:04:26Z")
I have been testing kibana alerting and i need assistance setting up a custom webhook with google chatbot. I've already wrote a python code that take messages from sqs and send back to google chatbot so everything is ok… --- ## [Failed to connect to apmX port 8200: Connection refused](https://discuss.elastic.co/t/failed-to-connect-to-apmx-port-8200-connection-refused/142800)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 1\ **Last updated:** [August 2, 2018, 7:17pm UTC](https://discuss.elastic.co/t/failed-to-connect-to-apmx-port-8200-connection-refused/142800 "2018-08-02T19:17:56Z")
I'm getting following error (through my app's logs): sending transactions failed: sending request for SendTransactions failed: Post http://apmX:8200/v1/transactions: dial tcp 10.0.10.187:8200: connect: connection refuse… --- ## [No Nodes Available Exception](https://discuss.elastic.co/t/no-nodes-available-exception/114388)
**Author:** [@Deepak\_Goel](https://discuss.elastic.co/u/Deepak_Goel)\ **Replies:** 1\ **Last updated:** [January 6, 2018, 5:32pm UTC](https://discuss.elastic.co/t/no-nodes-available-exception/114388 "2018-01-06T17:32:37Z")
Hello I created two nodes (elasticsearch-node, client-node) on the same machine. Started them. Configuration is as follows: cluster.name: production node.name: elasticsearch-node node.master: true node.data : tr… --- ## [Kibana license question](https://discuss.elastic.co/t/kibana-license-question/110856)
**Author:** [@arisbanach](https://discuss.elastic.co/u/arisbanach)\ **Replies:** 1\ **Last updated:** [December 8, 2017, 5:36pm UTC](https://discuss.elastic.co/t/kibana-license-question/110856 "2017-12-08T17:36:46Z")
Hi, my company is wondering about the license for Kibana regarding reselling/rebranding. Does anyone have experience with this? We want to create dashboards for our clients using Kibana and sell a service that uses Elast… --- ## [How to delete/hide fields in logstash filter](https://discuss.elastic.co/t/how-to-delete-hide-fields-in-logstash-filter/109021)
**Author:** [@Makra](https://discuss.elastic.co/u/Makra)\ **Replies:** 1\ **Last updated:** [November 24, 2017, 12:19pm UTC](https://discuss.elastic.co/t/how-to-delete-hide-fields-in-logstash-filter/109021 "2017-11-24T12:19:56Z")
Hi How should i delete the fields "\_id", "\_type", "\_index", "\_score" in logstash filter so that these fields does not show up in the kibana dashboard ? In the mutate filter, remove field does not delete these fields … --- ## [Rest API for Kibana](https://discuss.elastic.co/t/rest-api-for-kibana/40074)
**Author:** [@JPP](https://discuss.elastic.co/u/JPP)\ **Replies:** 1\ **Last updated:** [January 26, 2016, 1:45am UTC](https://discuss.elastic.co/t/rest-api-for-kibana/40074 "2016-01-26T01:45:44Z")
Currently we have issue with directly accessing ElasticSearch server. We cannot access the elastic search server directly due to multi-tenancy. However we can access the Kibana UI and create various queries. Does Kib… --- ## [Logstash CSV Timestamp extract](https://discuss.elastic.co/t/logstash-csv-timestamp-extract/292188)
**Author:** [@Robsen\_Inc](https://discuss.elastic.co/u/Robsen_Inc)\ **Replies:** 5\ **Last updated:** [December 20, 2021, 9:38am UTC](https://discuss.elastic.co/t/logstash-csv-timestamp-extract/292188 "2021-12-20T09:38:42Z")
Hello everyone, I have a problem with my log data. After hours of try-and-error I am now looking for help from you. An exemplary line looks like this: 09/04/2021 11:30:53 0 0 0 0 0 0 0 0 false false false false false … --- ## [Elastic: How to enable autodetect on metadata like container id in Elastic APM Agent/APM Server?](https://discuss.elastic.co/t/elastic-how-to-enable-autodetect-on-metadata-like-container-id-in-elastic-apm-agent-apm-server/227257)
**Author:** [@elk51211](https://discuss.elastic.co/u/elk51211)\ **Replies:** 5\ **Last updated:** [April 23, 2020, 7:04am UTC](https://discuss.elastic.co/t/elastic-how-to-enable-autodetect-on-metadata-like-container-id-in-elastic-apm-agent-apm-server/227257 "2020-04-23T07:04:41Z")
If you are asking about a problem you are experiencing, please use the following template, as it will help us help you. If you have a different problem, please delete all of this text :slight\_smile: Kibana version: 7.6.… --- ## [Custom filebeat index - same index name but diferent template](https://discuss.elastic.co/t/custom-filebeat-index-same-index-name-but-diferent-template/221671)
**Author:** [@bueka.torao](https://discuss.elastic.co/u/bueka.torao)\ **Replies:** 5\ **Last updated:** [March 2, 2020, 5:20pm UTC](https://discuss.elastic.co/t/custom-filebeat-index-same-index-name-but-diferent-template/221671 "2020-03-02T17:20:34Z")
Hi guys, I am setting my filebeat.yml in order to send logs to Elasticsearch. I created a template in Elasticsearch, I named it: filebeat . See below the configuration. I set the filebeat.yml as you guys can see below. … --- ## [Need to create latency graph in timelion](https://discuss.elastic.co/t/need-to-create-latency-graph-in-timelion/173753)
**Author:** [@Dheerajbtu](https://discuss.elastic.co/u/Dheerajbtu)\ **Replies:** 5\ **Last updated:** [March 28, 2019, 11:50am UTC](https://discuss.elastic.co/t/need-to-create-latency-graph-in-timelion/173753 "2019-03-28T11:50:41Z")
Hi, I need to create a timelion graph where I have receivedTs & repliedTs (which are date types) in documents. Following is the graph I need to create: Where, "min\_time\_to\_serve\_request" is 1 sec difference receive… --- ## [Logstash service stops every 42 seconds and restarts](https://discuss.elastic.co/t/logstash-service-stops-every-42-seconds-and-restarts/130332)
**Author:** [@dalamar666](https://discuss.elastic.co/u/dalamar666)\ **Replies:** 5\ **Last updated:** [May 4, 2018, 1:17pm UTC](https://discuss.elastic.co/t/logstash-service-stops-every-42-seconds-and-restarts/130332 "2018-05-04T13:17:45Z")
I have all ownership in /etc/logstash/ set to logstash:logstash I have all ownership in /usr/share/logstash set to logstash:logstash The logstash service runs as logstash. When I run logstash from the /usr/share/logst… --- ## [Logstash startup completed nothing proceeds after this command in logstash](https://discuss.elastic.co/t/logstash-startup-completed-nothing-proceeds-after-this-command-in-logstash/108715)
**Author:** [@ayushbij27](https://discuss.elastic.co/u/ayushbij27)\ **Replies:** 5\ **Last updated:** [November 23, 2017, 9:50am UTC](https://discuss.elastic.co/t/logstash-startup-completed-nothing-proceeds-after-this-command-in-logstash/108715 "2017-11-23T09:50:24Z")
I am trying to index the data from logs file to elastisearch but I was unable to do so because after the Logstash Startup completed message appears nothing actually happens. So I changed conf file to input { file { pa… --- ## [Curator \_alias is created for all the indices rather than specified?](https://discuss.elastic.co/t/curator--alias-is-created-for-all-the-indices-rather-than-specified/80905)
**Author:** [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\ **Replies:** 5\ **Last updated:** [May 2, 2017, 12:34am UTC](https://discuss.elastic.co/t/curator--alias-is-created-for-all-the-indices-rather-than-specified/80905 "2017-05-02T00:34:17Z")
HI, I created alias for indices that are in april , When i ran the command i got response like this: 2017-04-02 00:46:53,374 INFO Preparing Action ID: 1, "alias" 2017-04-02 00:46:53,389 INFO Trying Action … --- ## [How to read an encrypted quarantine file?](https://discuss.elastic.co/t/how-to-read-an-encrypted-quarantine-file/358714)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 1\ **Last updated:** [May 3, 2024, 3:56pm UTC](https://discuss.elastic.co/t/how-to-read-an-encrypted-quarantine-file/358714 "2024-05-03T15:56:27Z")
Hello, there's a malware on an endpoint I manage, Elastic Defend put that malware in C:\\.equarantine\\xxxxxxxxxxxxxxxxxxxxxxx something like that. I went there and grabbed the file for analysis in my sandbox. It is an en… --- ## [How to map timestamp with nano seconds?](https://discuss.elastic.co/t/how-to-map-timestamp-with-nano-seconds/300881)
**Author:** [@Anusha\_Kusanghi](https://discuss.elastic.co/u/Anusha_Kusanghi)\ **Replies:** 4\ **Last updated:** [March 30, 2022, 5:06am UTC](https://discuss.elastic.co/t/how-to-map-timestamp-with-nano-seconds/300881 "2022-03-30T05:06:42Z")
Hie , I have a time where it is of the format : 2022- 03-28T16:51:11.637003013Z I tried to map like this : date{ match =\> \["Pretime","yyyy-MM-dd'T'HH:mm:ss.SSSSSSSSSZ"\] target =\> "@timestamp" remove\_field =\> "Preti… --- ## [Copy/Rename multiple field in the same field + adding multiples field to one field](https://discuss.elastic.co/t/copy-rename-multiple-field-in-the-same-field-adding-multiples-field-to-one-field/275264)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 4\ **Last updated:** [June 8, 2021, 10:07pm UTC](https://discuss.elastic.co/t/copy-rename-multiple-field-in-the-same-field-adding-multiples-field-to-one-field/275264 "2021-06-08T22:07:43Z")
Hello every body, I have two question about the mutate filter: The first one is about adding a0,a1 and a2 fiels that contain the process args to a same field \[process\]\[args\] (process.args=a0,a1,a2) how i can do it ? … --- ## [Elastic Password reset](https://discuss.elastic.co/t/elastic-password-reset/245578)
**Author:** [@bhargav\_bharat](https://discuss.elastic.co/u/bhargav_bharat)\ **Replies:** 4\ **Last updated:** [August 21, 2020, 12:27am UTC](https://discuss.elastic.co/t/elastic-password-reset/245578 "2020-08-21T00:27:45Z")
Whenever I try to reset password of elastic, I am getting bellow mention error: Request: curl -u user:Password -XPUT 'http://localhost:9200/\_xpack/security/user/elastic/\_password?pretty' -H 'Content-Type: application/j… --- ## [Increase performance for a PubSub module in Filebeat](https://discuss.elastic.co/t/increase-performance-for-a-pubsub-module-in-filebeat/210466)
**Author:** [@daniel\_a](https://discuss.elastic.co/u/daniel_a)\ **Replies:** 4\ **Last updated:** [December 10, 2019, 10:09pm UTC](https://discuss.elastic.co/t/increase-performance-for-a-pubsub-module-in-filebeat/210466 "2019-12-10T22:09:57Z")
How to improve performance for the Google Cloud module on a filebeat? I'm using Google Cloud module running on a filebeat: https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-googlecloud.html, and my e… --- ## [Multiple instances of Logstash](https://discuss.elastic.co/t/multiple-instances-of-logstash/75215)
**Author:** [@adrianolimit](https://discuss.elastic.co/u/adrianolimit)\ **Replies:** 4\ **Last updated:** [February 17, 2017, 1:16pm UTC](https://discuss.elastic.co/t/multiple-instances-of-logstash/75215 "2017-02-17T13:16:54Z")
Hello everyone, I want to use Logstash with the "Twitter input" in order to track tweets about different themes. For example, I want to use one Logstash instance by theme with the following configurations : Logstash… --- ## [Discovery.zen.ping.unicast.hosts configuration](https://discuss.elastic.co/t/discovery-zen-ping-unicast-hosts-configuration/69234)
**Author:** [@ginger](https://discuss.elastic.co/u/ginger)\ **Replies:** 4\ **Last updated:** [December 19, 2016, 2:36am UTC](https://discuss.elastic.co/t/discovery-zen-ping-unicast-hosts-configuration/69234 "2016-12-19T02:36:01Z")
Hi. When I setup our es cluster, discovery.zen.ping.unicast.hosts of all nodes is set to ip of three master nodes. After a period of time, all the master nodes are replaced one by one. Now, I restart some of the data n… --- ## [Unable to update existing index even though sincedb is deleted](https://discuss.elastic.co/t/unable-to-update-existing-index-even-though-sincedb-is-deleted/48306)
**Author:** [@Gunjan\_Gupta](https://discuss.elastic.co/u/Gunjan_Gupta)\ **Replies:** 4\ **Last updated:** [May 1, 2016, 10:37am UTC](https://discuss.elastic.co/t/unable-to-update-existing-index-even-though-sincedb-is-deleted/48306 "2016-05-01T10:37:53Z")
Step : Initial Logstash.conf file: input { file { path =\> "C:\\Users\\Downloads\\logstash-tutorial.log\\logstash-tutorial-dataset" start\_position =\> beginning ignore\_older =\> 0 } } fi… --- ## [Different results, with the same query (local, single node). Strange!](https://discuss.elastic.co/t/different-results-with-the-same-query-local-single-node-strange/44919)
**Author:** [@Yongyao\_Jiang](https://discuss.elastic.co/u/Yongyao_Jiang)\ **Replies:** 4\ **Last updated:** [March 20, 2016, 5:14am UTC](https://discuss.elastic.co/t/different-results-with-the-same-query-local-single-node-strange/44919 "2016-03-20T05:14:51Z")
Hey guys, Just came across this strange thing. What I have is the simplest case, nothing fancy: local, single node, 1 index, 6 docs in them. Mapping I used are: { "settings": { "analysis": { "filter": { … --- ## [Delete old Index](https://discuss.elastic.co/t/delete-old-index/44617)
**Author:** [@evasu](https://discuss.elastic.co/u/evasu)\ **Replies:** 4\ **Last updated:** [March 16, 2016, 8:36pm UTC](https://discuss.elastic.co/t/delete-old-index/44617 "2016-03-16T20:36:05Z")
Hi, I would like to know is there anyway I could write cron job to delete the index that is older than 3 months. my index on elasticsearch looks like this abc-2015.10 abc-2015.11 abc-2015.12 abc-2016.01 abc-2016.02 abc.… --- ## [Does Logstash 2.1.1 work well with Kafka 0.9.0?](https://discuss.elastic.co/t/does-logstash-2-1-1-work-well-with-kafka-0-9-0/38831)
**Author:** [@Kenny\_Qiao](https://discuss.elastic.co/u/Kenny_Qiao)\ **Replies:** 4\ **Last updated:** [January 13, 2016, 1:39am UTC](https://discuss.elastic.co/t/does-logstash-2-1-1-work-well-with-kafka-0-9-0/38831 "2016-01-13T01:39:47Z")
I plan to upgrade Kafka to 0.9.0 and wondering if logstash 2.1.1 could work well with Kafka 0.9.0. Does anyone have experience using logstash 2.1.1 with Kafka0.9.0 in production? Thanks. --- ## [Analytics on data stored in ES](https://discuss.elastic.co/t/analytics-on-data-stored-in-es/21229)
**Author:** [@Ramchandra\_Phadake](https://discuss.elastic.co/u/Ramchandra_Phadake)\ **Replies:** 4\ **Last updated:** [December 15, 2014, 5:31am UTC](https://discuss.elastic.co/t/analytics-on-data-stored-in-es/21229 "2014-12-15T05:31:16Z")
Hi, We are storing lots of mail messages in ES with multiple fields. 600 Millions+ messages across 3 ES nodes. There is a custom algorithm which works on batch of messages to correlate based on fields & other m… --- ## [\[FIlebeat\] How to get logs default paths for modules?](https://discuss.elastic.co/t/filebeat-how-to-get-logs-default-paths-for-modules/252648)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 3\ **Last updated:** [October 27, 2020, 1:53pm UTC](https://discuss.elastic.co/t/filebeat-how-to-get-logs-default-paths-for-modules/252648 "2020-10-27T13:53:34Z")
Hello ! I'm using Filebeat (7.8) and module system. For the var.paths of the syslog fileset, documentation says : "If this setting is left empty, Filebeat will choose log paths based on your operating system." How can… --- ## [Multiple logstash](https://discuss.elastic.co/t/multiple-logstash/253009)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 3\ **Last updated:** [October 24, 2020, 1:32am UTC](https://discuss.elastic.co/t/multiple-logstash/253009 "2020-10-24T01:32:30Z")
I want to add 2 logstash in my application for scalability.From availablity point... I have a question does 2 logstash works simultaneously or they works as a active-passive (one stop other takes) or they automatically m… --- ## [Running Multiple nodes on localhost, but Kibana shows number\_of\_nodes=1](https://discuss.elastic.co/t/running-multiple-nodes-on-localhost-but-kibana-shows-number-of-nodes-1/220388)
**Author:** [@karlpy](https://discuss.elastic.co/u/karlpy)\ **Replies:** 3\ **Last updated:** [February 21, 2020, 4:24pm UTC](https://discuss.elastic.co/t/running-multiple-nodes-on-localhost-but-kibana-shows-number-of-nodes-1/220388 "2020-02-21T16:24:39Z")
I'm running 2 nodes on my localhost. The nodes found each other successfully as shown in the log of the second node below. But when running GET /\_cluster/health in kibana, it shows only 1 node. { "cluster\_name" : "elas… --- ## [Merge 2 indexes in one with same id](https://discuss.elastic.co/t/merge-2-indexes-in-one-with-same-id/179526)
**Author:** [@olpru](https://discuss.elastic.co/u/olpru)\ **Replies:** 3\ **Last updated:** [May 8, 2019, 9:06am UTC](https://discuss.elastic.co/t/merge-2-indexes-in-one-with-same-id/179526 "2019-05-08T09:06:56Z")
Hello, I try to merge 2 indexes into one. The first index (index\_1) looks like this: { "\_index" : "index\_1", "\_id" : "1", "\_source" : { "a":"1" } }, { "\_index"… --- ## [How to create scripted(String + painless) field in Kibana?](https://discuss.elastic.co/t/how-to-create-scripted-string-painless-field-in-kibana/90091)
**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\ **Replies:** 3\ **Last updated:** [June 20, 2017, 12:35pm UTC](https://discuss.elastic.co/t/how-to-create-scripted-string-painless-field-in-kibana/90091 "2017-06-20T12:35:20Z")
Hi Kibana Experts, I got a very simple requirement I need to achieve following if(doc\["logSourceGroup"\].value =="Palo Alto Firewall Group" OR doc\["logSourceGroup"\].value =="ASA Firewall"){return "Firewall";} else i… --- ## [Newbie question: looking for correct workflow](https://discuss.elastic.co/t/newbie-question-looking-for-correct-workflow/47419)
**Author:** [@DTownSMR](https://discuss.elastic.co/u/DTownSMR)\ **Replies:** 3\ **Last updated:** [April 15, 2016, 4:07pm UTC](https://discuss.elastic.co/t/newbie-question-looking-for-correct-workflow/47419 "2016-04-15T16:07:32Z")
I'm trying to make a change to Kibana core. I'm trying to start out very small and I've made a single change to a .js file and a .html file (specifically \_create.\*). After issuing a "npm run build" I am not seeing all of… --- ## [ES update API with script via Python client](https://discuss.elastic.co/t/es-update-api-with-script-via-python-client/40196)
**Author:** [@Patrick\_Lam](https://discuss.elastic.co/u/Patrick_Lam)\ **Replies:** 0\ **Last updated:** [January 27, 2016, 7:27am UTC](https://discuss.elastic.co/t/es-update-api-with-script-via-python-client/40196 "2016-01-27T07:27:24Z")
Hi, I'm trying to use the Update API via the Python client on ES 2.1.1 and I'm having trouble. es.index(index='boston', doc\_type='stem\_map', id=111, body={'word': 'showing', 'counter': 29}) es.get(index='boston', do… --- ## [Elasticsearch Cluster for distributed mode](https://discuss.elastic.co/t/elasticsearch-cluster-for-distributed-mode/28143)
**Author:** [@sivapuvvada](https://discuss.elastic.co/u/sivapuvvada)\ **Replies:** 3\ **Last updated:** [August 27, 2015, 9:56pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-for-distributed-mode/28143 "2015-08-27T21:56:06Z")
I would like to setup an elastic cluster for 200 GB data per day with replication factor 2 and 1 month data retention period .. but my disk space is having only 1TB maximum per instance .. Could you please provide an… --- ## [Issue with escaping pipe "|" in Ingest Pipeline](https://discuss.elastic.co/t/issue-with-escaping-pipe-in-ingest-pipeline/286279)
**Author:** [@Thanura\_Kannangara](https://discuss.elastic.co/u/Thanura_Kannangara)\ **Replies:** 7\ **Last updated:** [October 8, 2021, 9:20pm UTC](https://discuss.elastic.co/t/issue-with-escaping-pipe-in-ingest-pipeline/286279 "2021-10-08T21:20:37Z")
Hi Guys, I have a log patern that look like this (windows event log) Dummy request has been approved.|Node=blah-blah.example.net\_iam|BatchSig=jhsdjahsdgsjahdg|Requester=john.test|Recipient=ex0000123456 below grok pat… --- ## [Harvest logs between a certain date](https://discuss.elastic.co/t/harvest-logs-between-a-certain-date/149194)
**Author:** [@mgreco2k](https://discuss.elastic.co/u/mgreco2k)\ **Replies:** 7\ **Last updated:** [September 21, 2018, 1:54pm UTC](https://discuss.elastic.co/t/harvest-logs-between-a-certain-date/149194 "2018-09-21T13:54:11Z")
I want filebeat to harvest logs that have a date between 9/14/2018 @ 12:00:00 to 9/17/2018 @ 18:00:00 and I'm not sure how to do that ? --- ## [Cluster name in config file not updated (first install)](https://discuss.elastic.co/t/cluster-name-in-config-file-not-updated-first-install/61364)
**Author:** [@ebarrier](https://discuss.elastic.co/u/ebarrier)\ **Replies:** 7\ **Last updated:** [September 23, 2016, 1:43pm UTC](https://discuss.elastic.co/t/cluster-name-in-config-file-not-updated-first-install/61364 "2016-09-23T13:43:31Z")
Hi, I am running Ubuntu 16.04 LTS. I have started to install Graylog which need Elasticsearch, following this tutorial (http://docs.graylog.org/en/2.1/pages/installation/os/ubuntu.html). As it says, in the /etc/elasticse… --- ## [Documentation for Monitoring Elasticsearch with Metricbeat is outdated](https://discuss.elastic.co/t/documentation-for-monitoring-elasticsearch-with-metricbeat-is-outdated/315804)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 1\ **Last updated:** [October 12, 2022, 2:54am UTC](https://discuss.elastic.co/t/documentation-for-monitoring-elasticsearch-with-metricbeat-is-outdated/315804 "2022-10-12T02:54:20Z")
Hello, I've created a new production cluster on 8.4 and a new monitoring cluster as well, following the documentation to configure monitoring using metricbeat there is this step: Set xpack.monitoring.collection.enable… --- ## [Uri is not valid, Host is not specified](https://discuss.elastic.co/t/uri-is-not-valid-host-is-not-specified/287385)
**Author:** [@DeepakStile](https://discuss.elastic.co/u/DeepakStile)\ **Replies:** 1\ **Last updated:** [October 22, 2021, 3:44pm UTC](https://discuss.elastic.co/t/uri-is-not-valid-host-is-not-specified/287385 "2021-10-22T15:44:46Z")
Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:XXXXX, :exception=\>"Java::JavaLang::IllegalStateException", :message=\>"Unable to configure plugins: (ArgumentError) URI is not valid - host … --- ## [Migration elk to hadoop](https://discuss.elastic.co/t/migration-elk-to-hadoop/135204)
**Author:** [@oumeyma](https://discuss.elastic.co/u/oumeyma)\ **Replies:** 1\ **Last updated:** [June 8, 2018, 11:51pm UTC](https://discuss.elastic.co/t/migration-elk-to-hadoop/135204 "2018-06-08T23:51:41Z")
i need to integrate elk and hadoop to analyze logs real time who can send me document of configuration or help me --- ## [Does anyone have a grok for Barracuda SPAM filter?](https://discuss.elastic.co/t/does-anyone-have-a-grok-for-barracuda-spam-filter/47944)
**Author:** [@shanecentreedu](https://discuss.elastic.co/u/shanecentreedu)\ **Replies:** 1\ **Last updated:** [December 24, 2016, 1:41pm UTC](https://discuss.elastic.co/t/does-anyone-have-a-grok-for-barracuda-spam-filter/47944 "2016-12-24T13:41:50Z")
I'm wanting to send my Barracuda SPAM filter logs into ELK and wanted to know if anyone had already worked of a grok and filter for it? Barracuda has a great page that explains what the fields mean, but I'm still new … [Previous page](https://discuss.elastic.co/top.md?page=1298&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1300&per_page=50&period=all)