# Top

**URL:** https://discuss.elastic.co/top.md?page=1301&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1302

---

## [Translate filter not working](https://discuss.elastic.co/t/translate-filter-not-working/87505)

<div class="topic-metadata">

**Author:** [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\
**Replies:** 1\
**Last updated:** [May 30, 2017, 6:35am UTC](https://discuss.elastic.co/t/translate-filter-not-working/87505 "2017-05-30T06:35:41Z")

</div>

Hi, I'm using the translation filter to look up some values. This works but the issue I'm running into is that I want to keep the original field untouched so I need to copy the field and replace the value in the new fi…

---

## [How to store array in elasticsearch from logstash](https://discuss.elastic.co/t/how-to-store-array-in-elasticsearch-from-logstash/87445)

<div class="topic-metadata">

**Author:** [@abhi\_chinchole](https://discuss.elastic.co/u/abhi_chinchole)\
**Replies:** 1\
**Last updated:** [May 29, 2017, 7:48pm UTC](https://discuss.elastic.co/t/how-to-store-array-in-elasticsearch-from-logstash/87445 "2017-05-29T19:48:09Z")

</div>

I am trying to store data in array field of elasticsearch from logstash Raw JSON event : {"user-metadata":{"tags":\["BCT-LTP-G109","Elasticsearch","logstash"\]},"data":"abc def xyz"} I want to take "tags" field out as…

---

## [How to embed time picker and search in Dashboard IFRAME link?](https://discuss.elastic.co/t/how-to-embed-time-picker-and-search-in-dashboard-iframe-link/33216)

<div class="topic-metadata">

**Author:** [@RohanKumbhar](https://discuss.elastic.co/u/RohanKumbhar)\
**Replies:** 1\
**Last updated:** [October 30, 2015, 7:22am UTC](https://discuss.elastic.co/t/how-to-embed-time-picker-and-search-in-dashboard-iframe-link/33216 "2015-10-30T07:22:08Z")

</div>

Hi Team, I have one requirement where i want to embed only Search Box and Time Picker in the dashboard IFRAME link? Any help on this would be really appreciated. Thanks, Rohan

---

## [Elasticsearch等の学習方法について](https://discuss.elastic.co/t/elasticsearch/305437)

<div class="topic-metadata">

**Author:** [@Yos](https://discuss.elastic.co/u/Yos)\
**Replies:** 2\
**Last updated:** [May 24, 2022, 2:09am UTC](https://discuss.elastic.co/t/elasticsearch/305437 "2022-05-24T02:09:50Z")

</div>

※このようなことをここに投稿してよいのかわかりませんので、 不適切であれば削除いたしますのでご返信ください。 私は仕事でElasticsearch＋Kibana＋Logstash＋Beatsを組み合わせたログ分析の仕組みを構築中ですが、そのための学習は書籍（ElasticStack実践ガイド）や公式ドキュメント、このコミュニティ、個人のブログで進めております。 皆様はElasticsearchやその他Kibana、Logstash…

---

## [User Journey visualizations](https://discuss.elastic.co/t/user-journey-visualizations/234510)

<div class="topic-metadata">

**Author:** [@gopikrishnan](https://discuss.elastic.co/u/gopikrishnan)\
**Replies:** 2\
**Last updated:** [June 3, 2020, 10:43pm UTC](https://discuss.elastic.co/t/user-journey-visualizations/234510 "2020-06-03T22:43:37Z")

</div>

HI All, Am new to ELK and I wanted to know have anyone tried to map user journey from elastic and if yes then what was the approach. It would be better if you can showcase some dashboard snaps. Also how will d3 or vega …

---

## [Help with aggregation to identify dups](https://discuss.elastic.co/t/help-with-aggregation-to-identify-dups/165868)

<div class="topic-metadata">

**Author:** [@LucasV](https://discuss.elastic.co/u/LucasV)\
**Replies:** 2\
**Last updated:** [February 4, 2019, 10:18pm UTC](https://discuss.elastic.co/t/help-with-aggregation-to-identify-dups/165868 "2019-02-04T22:18:27Z")

</div>

Hey folks, I am hoping someone could help me figure this issue out. Been at it for a few days and feel like i have hit a wall. I'd really appreciate any help on this topic. Here is the issue - I am populating address r…

---

## [Filebeat not creating index in ES 6.5.1](https://discuss.elastic.co/t/filebeat-not-creating-index-in-es-6-5-1/160785)

<div class="topic-metadata">

**Author:** [@vishnujyothi](https://discuss.elastic.co/u/vishnujyothi)\
**Replies:** 2\
**Last updated:** [December 17, 2018, 9:53am UTC](https://discuss.elastic.co/t/filebeat-not-creating-index-in-es-6-5-1/160785 "2018-12-17T09:53:22Z")

</div>

Hi Am using filebeat 6.5.1 connected to ES 6.5 , was trying/googling to find a fix to index creation problem. metricbeat and heartbeat installed in same machine are working fine (creating index and all) ALL my ES/Kiban…

---

## [Kibana - custom menu item](https://discuss.elastic.co/t/kibana-custom-menu-item/132110)

<div class="topic-metadata">

**Author:** [@Faizan](https://discuss.elastic.co/u/Faizan)\
**Replies:** 2\
**Last updated:** [May 17, 2018, 2:45am UTC](https://discuss.elastic.co/t/kibana-custom-menu-item/132110 "2018-05-17T02:45:28Z")

</div>

Hello, Please advise how can i create custom menu on kibana sidebar. I am using version 6.2.2. Also, It will be really helpful if there is any latest video with regards to kibana plugin development. Thank you

---

## [Use special (null?) value for missing field](https://discuss.elastic.co/t/use-special-null-value-for-missing-field/125952)

<div class="topic-metadata">

**Author:** [@pkaramol](https://discuss.elastic.co/u/pkaramol)\
**Replies:** 2\
**Last updated:** [March 31, 2018, 7:14am UTC](https://discuss.elastic.co/t/use-special-null-value-for-missing-field/125952 "2018-03-31T07:14:45Z")

</div>

I want to import some data into ES. There is an integer field in my template and I want to use strict mapping. However, there might be the case that in some documents, the specific filed is missing. What I want to ach…

---

## [Meilleur méthode pour libérer du disque](https://discuss.elastic.co/t/meilleur-methode-pour-liberer-du-disque/119115)

<div class="topic-metadata">

**Author:** [@rbeg](https://discuss.elastic.co/u/rbeg)\
**Replies:** 2\
**Last updated:** [February 8, 2018, 8:41pm UTC](https://discuss.elastic.co/t/meilleur-methode-pour-liberer-du-disque/119115 "2018-02-08T20:41:35Z")

</div>

Bonjour, J'ai 1 index par jour. J'aimerai supprimer toutes les données qui ont plus d'une semaine pour des raisons d'espace disque. Quelle est la meilleur méthode pour ça : What should I do for that : Supprimer sim…

---

## [GET: command not found](https://discuss.elastic.co/t/get-command-not-found/106285)

<div class="topic-metadata">

**Author:** [@vikram\_m](https://discuss.elastic.co/u/vikram_m)\
**Replies:** 2\
**Last updated:** [November 3, 2017, 9:17am UTC](https://discuss.elastic.co/t/get-command-not-found/106285 "2017-11-03T09:17:22Z")

</div>

\[root@splunkqahead1 splunk\]# GET / bash: GET: command not found I am getting following error when I try to run GET command post Elastic search installation. Please help. Thanks. Vikram.

---

## [Problems with Snapshot Restore](https://discuss.elastic.co/t/problems-with-snapshot-restore/96921)

<div class="topic-metadata">

**Author:** [@agriffit](https://discuss.elastic.co/u/agriffit)\
**Replies:** 2\
**Last updated:** [August 21, 2017, 4:15pm UTC](https://discuss.elastic.co/t/problems-with-snapshot-restore/96921 "2017-08-21T16:15:28Z")

</div>

Hi, Attempting to restore a snapshot from one cluster into another (same version - 5.0.1). It seems that all indices that were created using forcemerge are failing to restore. When I do allocation/explain I get "fin…

---

## [Multi-language analyzers in Elastic Search](https://discuss.elastic.co/t/multi-language-analyzers-in-elastic-search/93994)

<div class="topic-metadata">

**Author:** [@rsswathi12](https://discuss.elastic.co/u/rsswathi12)\
**Replies:** 2\
**Last updated:** [July 20, 2017, 9:56pm UTC](https://discuss.elastic.co/t/multi-language-analyzers-in-elastic-search/93994 "2017-07-20T21:56:18Z")

</div>

Hi ES Team, We are building a real-time search system for one of our applications. Our customer base is huge and so does the data, we have data for around 13TB current day and it is intended to grow. The customer can s…

---

## [Starting Logstash without any configuration](https://discuss.elastic.co/t/starting-logstash-without-any-configuration/74159)

<div class="topic-metadata">

**Author:** [@ronakg](https://discuss.elastic.co/u/ronakg)\
**Replies:** 2\
**Last updated:** [February 7, 2017, 10:27pm UTC](https://discuss.elastic.co/t/starting-logstash-without-any-configuration/74159 "2017-02-07T22:27:40Z")

</div>

Hi, I'd like to know if there's a way to start logstash without any configuration. We're deploying logstash in kubernetes pod. When the pod comes up, the configuration is not ready yet. We're starting logstash with aut…

---

## [Pipeline is full, she can't take much more captain!](https://discuss.elastic.co/t/pipeline-is-full-she-cant-take-much-more-captain/67536)

<div class="topic-metadata">

**Author:** [@gchampion](https://discuss.elastic.co/u/gchampion)\
**Replies:** 2\
**Last updated:** [November 29, 2016, 9:41pm UTC](https://discuss.elastic.co/t/pipeline-is-full-she-cant-take-much-more-captain/67536 "2016-11-29T21:41:07Z")

</div>

Everything was going fine until I doubled the amount of log forwarders. I went from around 5,000/minute to 5/minute (not kidding). I've since cut the amount of log forwarders down to the original amount however I can't s…

---

## [JVM hang ,edn space 100%](https://discuss.elastic.co/t/jvm-hang-edn-space-100/53075)

<div class="topic-metadata">

**Author:** [@sanfengzhang](https://discuss.elastic.co/u/sanfengzhang)\
**Replies:** 2\
**Last updated:** [June 17, 2016, 3:31am UTC](https://discuss.elastic.co/t/jvm-hang-edn-space-100/53075 "2016-06-17T03:31:24Z")

</div>

hello: we have two servers,We use Elasticsearch 2.3.2 and run two data nodes in server with 32G RAM and 32 Core CPU. Elasticsearch java heap size is set to 24G and the index is configured to 5 shards with 0 replica. E…

---

## [Masking results with elastic search](https://discuss.elastic.co/t/masking-results-with-elastic-search/52861)

<div class="topic-metadata">

**Author:** [@Fryder](https://discuss.elastic.co/u/Fryder)\
**Replies:** 2\
**Last updated:** [June 15, 2016, 1:47pm UTC](https://discuss.elastic.co/t/masking-results-with-elastic-search/52861 "2016-06-15T13:47:46Z")

</div>

Hi Guys, a little help here. I am doing search with different queries in elastic search.I am also able to limit the no-of results in a search-result with includes/exclude's fields and filter aliases. My situation here …

---

## [Possible aggregation bug](https://discuss.elastic.co/t/possible-aggregation-bug/25553)

<div class="topic-metadata">

**Author:** [@theikell](https://discuss.elastic.co/u/theikell)\
**Replies:** 2\
**Last updated:** [July 14, 2015, 11:51pm UTC](https://discuss.elastic.co/t/possible-aggregation-bug/25553 "2015-07-14T23:51:20Z")

</div>

I've discovered what I feel is a bug, please correct me if I am wrong. The issue is that when executing an aggregation I get an error that says "org.elasticsearch.index.fielddata.plain.PagedBytesIndexFieldData cannot be …

---

## [ELK stack Implementation on Windows using nxlog - Help required](https://discuss.elastic.co/t/elk-stack-implementation-on-windows-using-nxlog-help-required/19363)

<div class="topic-metadata">

**Author:** [@Mathan\_Subramaniam](https://discuss.elastic.co/u/Mathan_Subramaniam)\
**Replies:** 2\
**Last updated:** [September 2, 2014, 3:27pm UTC](https://discuss.elastic.co/t/elk-stack-implementation-on-windows-using-nxlog-help-required/19363 "2014-09-02T15:27:16Z")

</div>

Hi , This is Mathan subramaniam Wintel Admin . I am a new using ELK . Before getting started with the ELK stack ,I have gone through the below mentioned links and videos . http://www.elasticsearch.or…

---

## [Scaling watchers to monitor a large number of environments](https://discuss.elastic.co/t/scaling-watchers-to-monitor-a-large-number-of-environments/183356)

<div class="topic-metadata">

**Author:** [@francisco.andrade](https://discuss.elastic.co/u/francisco.andrade)\
**Replies:** 0\
**Last updated:** [May 29, 2019, 2:12pm UTC](https://discuss.elastic.co/t/scaling-watchers-to-monitor-a-large-number-of-environments/183356 "2019-05-29T14:12:00Z")

</div>

Hi! Our organization is implementing a new monitor system and we want to use the Elastic Stack taking advantage of our previous experience using it as a log system for troubleshooting. Beside collect data, one of the …

---

## [Configuring index behavior between insert phase and query phase](https://discuss.elastic.co/t/configuring-index-behavior-between-insert-phase-and-query-phase/152087)

<div class="topic-metadata">

**Author:** [@Nirit\_Levi](https://discuss.elastic.co/u/Nirit_Levi)\
**Replies:** 0\
**Last updated:** [October 11, 2018, 3:43pm UTC](https://discuss.elastic.co/t/configuring-index-behavior-between-insert-phase-and-query-phase/152087 "2018-10-11T15:43:37Z")

</div>

Hi all We are struggling how to configure our index behavior between 3 phases it needs to cope with bravely (number of nodes,number of shards,merging segments, sorting the index, and size limitations and any other param…

---

## [Elasticsearch does not listen on ipv4](https://discuss.elastic.co/t/elasticsearch-does-not-listen-on-ipv4/300748)

<div class="topic-metadata">

**Author:** [@sharbich](https://discuss.elastic.co/u/sharbich)\
**Replies:** 1\
**Last updated:** [March 26, 2022, 10:15am UTC](https://discuss.elastic.co/t/elasticsearch-does-not-listen-on-ipv4/300748 "2022-03-26T10:15:34Z")

</div>

Hello, my dears, I installed Elasticsearch on my Debian Buster Server. The following ports have been opened. root@dsme01:~# netstat -tulpen | grep 192.168.150.20 tcp6 0 0 192.168.150.20:9200 :::\* …

---

## [Upgrading eck-operator is failing on spec.preserveUnknownFields: Invalid value: true: must be false in order to use defaults in the schema](https://discuss.elastic.co/t/upgrading-eck-operator-is-failing-on-spec-preserveunknownfields-invalid-value-true-must-be-false-in-order-to-use-defaults-in-the-schema/297529)

<div class="topic-metadata">

**Author:** [@FreshMike](https://discuss.elastic.co/u/FreshMike)\
**Replies:** 1\
**Last updated:** [February 21, 2022, 8:55am UTC](https://discuss.elastic.co/t/upgrading-eck-operator-is-failing-on-spec-preserveunknownfields-invalid-value-true-must-be-false-in-order-to-use-defaults-in-the-schema/297529 "2022-02-21T08:55:44Z")

</div>

Docker v20.10 K8s: v1.20 I'm using Rancher to upgrade the ECK operator from version 1.6.0 to 2.0.0 and the upgrade process fails with the following error from the UI. helm upgrade --history-max=5 --install=true --name…

---

## [Console only available on http://localhost:3002](https://discuss.elastic.co/t/console-only-available-on-http-localhost-3002/216272)

<div class="topic-metadata">

**Author:** [@Jo\_De\_Troy](https://discuss.elastic.co/u/Jo_De_Troy)\
**Replies:** 1\
**Last updated:** [January 23, 2020, 3:34pm UTC](https://discuss.elastic.co/t/console-only-available-on-http-localhost-3002/216272 "2020-01-23T15:34:45Z")

</div>

Hello, is there a way to expose the console that's default available via http://localhost:3002 to the outside world? I've tried using ent\_search.external\_url in config/enterprise-search.yml but after startup it still on…

---

## [Monitor the JSON payload from heartbeat.yml](https://discuss.elastic.co/t/monitor-the-json-payload-from-heartbeat-yml/199740)

<div class="topic-metadata">

**Author:** [@mfang329](https://discuss.elastic.co/u/mfang329)\
**Replies:** 1\
**Last updated:** [October 9, 2019, 12:52pm UTC](https://discuss.elastic.co/t/monitor-the-json-payload-from-heartbeat-yml/199740 "2019-10-09T12:52:14Z")

</div>

I'm new to the uptime / heartbeat service Version 6.8.3 that I'm trying to config brunch of urls which sends the healthbeat result to Uptime Kibana. The basic JSON payload body should return the following output, EG: …

---

## [Current date time in kibana watcher action body](https://discuss.elastic.co/t/current-date-time-in-kibana-watcher-action-body/197261)

<div class="topic-metadata">

**Author:** [@Karthik2411](https://discuss.elastic.co/u/Karthik2411)\
**Replies:** 1\
**Last updated:** [August 29, 2019, 6:10pm UTC](https://discuss.elastic.co/t/current-date-time-in-kibana-watcher-action-body/197261 "2019-08-29T18:10:14Z")

</div>

How can I print current time/watcher trigger time in action body of a kibana watcher?

---

## [Kibana 7.x support for ARM64 (Raspberry Pi 4 B)](https://discuss.elastic.co/t/kibana-7-x-support-for-arm64-raspberry-pi-4-b/190057)

<div class="topic-metadata">

**Author:** [@hegusung](https://discuss.elastic.co/u/hegusung)\
**Replies:** 1\
**Last updated:** [July 18, 2019, 11:19am UTC](https://discuss.elastic.co/t/kibana-7-x-support-for-arm64-raspberry-pi-4-b/190057 "2019-07-18T11:19:06Z")

</div>

Hi, Is there some plan to have Kibana support for ARM64, especially for the new raspberry pi 4 ? I have been trying to do it but am unable to make it work. It looks like the module nodegit cannot work on ARM64.

---

## [Login bypass in Kibana Cloud Embedded iFrame](https://discuss.elastic.co/t/login-bypass-in-kibana-cloud-embedded-iframe/153823)

<div class="topic-metadata">

**Author:** [@nikhil.bokil](https://discuss.elastic.co/u/nikhil.bokil)\
**Replies:** 1\
**Last updated:** [October 24, 2018, 3:36pm UTC](https://discuss.elastic.co/t/login-bypass-in-kibana-cloud-embedded-iframe/153823 "2018-10-24T15:36:55Z")

</div>

I have a dashboard created in Kibana Cloud which I have embedded into my local website using the iframe. The issue i'm facing here is, I'm not getting a way to bypass the user login page of kibana, when the user of my …

---

## [Kibana always crashes](https://discuss.elastic.co/t/kibana-always-crashes/42793)

<div class="topic-metadata">

**Author:** [@sk92129](https://discuss.elastic.co/u/sk92129)\
**Replies:** 1\
**Last updated:** [February 26, 2016, 3:02pm UTC](https://discuss.elastic.co/t/kibana-always-crashes/42793 "2016-02-26T15:02:49Z")

</div>

Every day or so, I noticed that my instance of kibana on AWS AMI disappears. It must have crashed. I have to log back into kibana to restart it. I look at the /var/log/kibana/ and see two log files kibana.stdout k…

---

## [Impact of ignore\_above property in ES mapping](https://discuss.elastic.co/t/impact-of-ignore-above-property-in-es-mapping/20745)

<div class="topic-metadata">

**Author:** [@thomasvdb](https://discuss.elastic.co/u/thomasvdb)\
**Replies:** 1\
**Last updated:** [March 11, 2015, 9:39pm UTC](https://discuss.elastic.co/t/impact-of-ignore-above-property-in-es-mapping/20745 "2015-03-11T21:39:03Z")

</div>

We've configured logstash in combination with elasticsearch and Kibana to centralize our server logs. In Kibana I want to setup a table which groups all error messages so we can create a top 10 of the most occuring …

---

## [Can we join two index fields in one index](https://discuss.elastic.co/t/can-we-join-two-index-fields-in-one-index/98624)

<div class="topic-metadata">

**Author:** [@vinay\_garg](https://discuss.elastic.co/u/vinay_garg)\
**Replies:** 6\
**Last updated:** [August 30, 2017, 2:05am UTC](https://discuss.elastic.co/t/can-we-join-two-index-fields-in-one-index/98624 "2017-08-30T02:05:40Z")

</div>

Hi All, Environment: ELK 5.5 We are having two index of different logs (haproxy-index and fuselog-index). Both index having different grok pattern. but in haproxy grok pattern having three fields ’col1-ID’:1 ’col2…

---

## [Reverse keyword vs new Wildcard data type](https://discuss.elastic.co/t/reverse-keyword-vs-new-wildcard-data-type/245751)

<div class="topic-metadata">

**Author:** [@TheWorkingDeveloper](https://discuss.elastic.co/u/TheWorkingDeveloper)\
**Replies:** 3\
**Last updated:** [August 20, 2020, 11:28am UTC](https://discuss.elastic.co/t/reverse-keyword-vs-new-wildcard-data-type/245751 "2020-08-20T11:28:09Z")

</div>

In email wildcard searching: user\_email\* \*@domain.com Would reverse keyword be faster in searching than wildcard given a single wildcard? moc.niamod@\* on reverse keyword vs \*@domain.com on wildcard For example. So…

---

## [How to get certificate from Windows MY store for ES call in python](https://discuss.elastic.co/t/how-to-get-certificate-from-windows-my-store-for-es-call-in-python/157624)

<div class="topic-metadata">

**Author:** [@jthoni](https://discuss.elastic.co/u/jthoni)\
**Replies:** 0\
**Last updated:** [November 21, 2018, 5:43am UTC](https://discuss.elastic.co/t/how-to-get-certificate-from-windows-my-store-for-es-call-in-python/157624 "2018-11-21T05:43:57Z")

</div>

We have a service that connects to Elasticsearch from C# and Python. We are using a reverse proxy with client certificate authentication. From C# we pull the certificate from the local store and include it with the req…

---

## [Creating drop-down lists](https://discuss.elastic.co/t/creating-drop-down-lists/100185)

<div class="topic-metadata">

**Author:** [@abhisek](https://discuss.elastic.co/u/abhisek)\
**Replies:** 3\
**Last updated:** [September 13, 2017, 9:59am UTC](https://discuss.elastic.co/t/creating-drop-down-lists/100185 "2017-09-13T09:59:12Z")

</div>

Hi , I am using Kibana v5.5 and I'm thinking to add a drop-down list to filter out the data on basis of selected field. Please let me know, how to achieve this in Kibana.

---

## [DNS traffic](https://discuss.elastic.co/t/dns-traffic/56617)

<div class="topic-metadata">

**Author:** [@pfe](https://discuss.elastic.co/u/pfe)\
**Replies:** 3\
**Last updated:** [July 28, 2016, 7:37pm UTC](https://discuss.elastic.co/t/dns-traffic/56617 "2016-07-28T19:37:43Z")

</div>

Hello everyone ! Please could you explain to me how can I use Packetbeat to monitor DNS traffic Thank you Ragards

---

## [Detection Rules don't alert](https://discuss.elastic.co/t/detection-rules-dont-alert/280736)

<div class="topic-metadata">

**Author:** [@omlette](https://discuss.elastic.co/u/omlette)\
**Replies:** 4\
**Last updated:** [August 13, 2021, 8:41pm UTC](https://discuss.elastic.co/t/detection-rules-dont-alert/280736 "2021-08-13T20:41:53Z")

</div>

I'm setting up detection rules, so I wanted to start small and verify that the workflows was functioning, so I've enabled the Whoami Process Activity. I've run the whoami command several times over the last several hours…

---

## [Filebeat is not sending logs to Logstash, logstash is localhost](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-logstash-logstash-is-localhost/250586)

<div class="topic-metadata">

**Author:** [@Sravan\_Kumar\_Guduru](https://discuss.elastic.co/u/Sravan_Kumar_Guduru)\
**Replies:** 4\
**Last updated:** [October 1, 2020, 7:06pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-logstash-logstash-is-localhost/250586 "2020-10-01T19:06:46Z")

</div>

Hi All, I am having trouble with my filebeat/logstash. connectivity seems to be inconsistenst. When i try it in debug mode it works fine but when i use it with systemctl start it fails . Below are my filebeat and logst…

---

## [Custom indexes didn't create using winlogbeat-7.2.1 version](https://discuss.elastic.co/t/custom-indexes-didnt-create-using-winlogbeat-7-2-1-version/209496)

<div class="topic-metadata">

**Author:** [@Orest\_Gulman](https://discuss.elastic.co/u/Orest_Gulman)\
**Replies:** 4\
**Last updated:** [December 11, 2019, 4:32pm UTC](https://discuss.elastic.co/t/custom-indexes-didnt-create-using-winlogbeat-7-2-1-version/209496 "2019-12-11T16:32:49Z")

</div>

hi, custom indexes didn't creating using winlogbeat-7.2.1 version. Below my winlogbeat configuration that properly works in winlogbeat 6.8.1. ###################### wlb Configuration ########################## winlogb…

---

## [User Agent Filter Not Working](https://discuss.elastic.co/t/user-agent-filter-not-working/198795)

<div class="topic-metadata">

**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Replies:** 4\
**Last updated:** [September 10, 2019, 2:44pm UTC](https://discuss.elastic.co/t/user-agent-filter-not-working/198795 "2019-09-10T14:44:46Z")

</div>

I'm not sure what happend but in my migration from 7.0 to 7.2, the user agent filter has stopped identifying properly. For example, given the following user agent mozilla/5.0 (windows nt 10.0; win64; x64; rv:69.0) gecko…

---

## [Kibana 5.5.0 - Node Advanced Tab Error](https://discuss.elastic.co/t/kibana-5-5-0-node-advanced-tab-error/93932)

<div class="topic-metadata">

**Author:** [@godber](https://discuss.elastic.co/u/godber)\
**Replies:** 4\
**Last updated:** [May 25, 2018, 7:14pm UTC](https://discuss.elastic.co/t/kibana-5-5-0-node-advanced-tab-error/93932 "2018-05-25T19:14:43Z")

</div>

I've just upgraded some of my clusters to ES 5.5.0, this included upgrading the associated monitoring and kibana nodes to 5.5.0 as well. After doing so the "Advanced" Tab for each node shows the following error: Look…

---

## [Configuring Slack info in elasticsearch.yml file](https://discuss.elastic.co/t/configuring-slack-info-in-elasticsearch-yml-file/85465)

<div class="topic-metadata">

**Author:** [@sLuvpreet33](https://discuss.elastic.co/u/sLuvpreet33)\
**Replies:** 4\
**Last updated:** [May 15, 2017, 9:24pm UTC](https://discuss.elastic.co/t/configuring-slack-info-in-elasticsearch-yml-file/85465 "2017-05-15T21:24:11Z")

</div>

The options for configuring Slack are not present in the elasticsearch.yml file by default. Do we have to write them manually OR they are present already ? Can anyone give a little hint ?

---

## [Elasticsearch 5.2.2 Raspberry pi 3 low cpu memory optimization](https://discuss.elastic.co/t/elasticsearch-5-2-2-raspberry-pi-3-low-cpu-memory-optimization/77529)

<div class="topic-metadata">

**Author:** [@Alex\_Kefallonitis](https://discuss.elastic.co/u/Alex_Kefallonitis)\
**Replies:** 4\
**Last updated:** [March 8, 2017, 9:07pm UTC](https://discuss.elastic.co/t/elasticsearch-5-2-2-raspberry-pi-3-low-cpu-memory-optimization/77529 "2017-03-08T21:07:18Z")

</div>

I have successfully installed elasticsearch 5.2.2 on arm raspberry pi3 and i have 100% all cpus. Except max memory , shards and rellocation is there any other settings to apply for low resources machines? Eg threads an…

---

## [Search and filter with the lists](https://discuss.elastic.co/t/search-and-filter-with-the-lists/72154)

<div class="topic-metadata">

**Author:** [@sacherus](https://discuss.elastic.co/u/sacherus)\
**Replies:** 4\
**Last updated:** [January 23, 2017, 9:30am UTC](https://discuss.elastic.co/t/search-and-filter-with-the-lists/72154 "2017-01-23T09:30:12Z")

</div>

I would like to search ES and then filter it by the list of name: "query\_string": { "query": "car" } and I have list of names which I want to match: l = \["super name 1", "super name 2"\]. So I will use …

---

## [Share Rebalancing on large clusters (2.4)](https://discuss.elastic.co/t/share-rebalancing-on-large-clusters-2-4/68957)

<div class="topic-metadata">

**Author:** [@eperry](https://discuss.elastic.co/u/eperry)\
**Replies:** 4\
**Last updated:** [December 22, 2016, 5:32pm UTC](https://discuss.elastic.co/t/share-rebalancing-on-large-clusters-2-4/68957 "2016-12-22T17:32:58Z")

</div>

Hey guys got a question. I have a cluster with over 20k total shards (each index is 30 shards + 1 replication and is oh about 300GB each) on 18 Data nodes with ~24 cores on each node. oh and we are indexing 10K messag…

---

## [Creating a watcher to check for no data in all the indices](https://discuss.elastic.co/t/creating-a-watcher-to-check-for-no-data-in-all-the-indices/305232)

<div class="topic-metadata">

**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\
**Replies:** 5\
**Last updated:** [May 23, 2022, 12:08pm UTC](https://discuss.elastic.co/t/creating-a-watcher-to-check-for-no-data-in-all-the-indices/305232 "2022-05-23T12:08:12Z")

</div>

Hi Team, I am trying to create a watcher in our elastic cloud 7.17.3 env to get an alert when there is no data in the indices. The problem here is i have more than 50 indices in the cluster and it will be difficult to c…

---

## [REST API Post /api/kibana/settings/defaultIndex gives 403](https://discuss.elastic.co/t/rest-api-post-api-kibana-settings-defaultindex-gives-403/250406)

<div class="topic-metadata">

**Author:** [@annanicotera](https://discuss.elastic.co/u/annanicotera)\
**Replies:** 5\
**Last updated:** [October 30, 2020, 7:19pm UTC](https://discuss.elastic.co/t/rest-api-post-api-kibana-settings-defaultindex-gives-403/250406 "2020-10-30T19:19:47Z")

</div>

Elasticsearch 7.9.1 and KIbana 7.91. with X-pack security enabled. I have a role that can create index patterns. See attached index and space privileges screen shots. When calling the API: POST /api/kibana/settin…

---

## [Terms aggregation for emails list](https://discuss.elastic.co/t/terms-aggregation-for-emails-list/204222)

<div class="topic-metadata">

**Author:** [@isamzwuairi](https://discuss.elastic.co/u/isamzwuairi)\
**Replies:** 5\
**Last updated:** [October 18, 2019, 1:51pm UTC](https://discuss.elastic.co/t/terms-aggregation-for-emails-list/204222 "2019-10-18T13:51:03Z")

</div>

Hello all, I have problem with terms aggregation; the problem is when am trying to make an aggregation out of multiple lists of emails, elasticsearch is splitting the response in buckets.key by the "@" sign in the email…

---

## [Emergency, All shards failed for phase](https://discuss.elastic.co/t/emergency-all-shards-failed-for-phase/143161)

<div class="topic-metadata">

**Author:** [@ercancavusoglu](https://discuss.elastic.co/u/ercancavusoglu)\
**Replies:** 5\
**Last updated:** [August 6, 2018, 1:42pm UTC](https://discuss.elastic.co/t/emergency-all-shards-failed-for-phase/143161 "2018-08-06T13:42:12Z")

</div>

Hi, I am getting this error today. How can I handle this error? \[2018-08-06T13:22:17,640\]\[DEBUG\]\[o.e.a.s.TransportSearchAction\] \[machine\] All shards failed for phase: \[query\] org.elasticsearch.transport.RemoteTransport…

---

## [How to add ip (any specific parameters) to filter in logstash?](https://discuss.elastic.co/t/how-to-add-ip-any-specific-parameters-to-filter-in-logstash/39398)

<div class="topic-metadata">

**Author:** [@Mohamed\_Ibrahim](https://discuss.elastic.co/u/Mohamed_Ibrahim)\
**Replies:** 5\
**Last updated:** [January 18, 2016, 9:39pm UTC](https://discuss.elastic.co/t/how-to-add-ip-any-specific-parameters-to-filter-in-logstash/39398 "2016-01-18T21:39:14Z")

</div>

i successfully revived the below masses on my web server 10.29.10.204 - - \[17/Jan/2016:00:12:16 +0300\] "GET /POS-WS-Client/mTopup?uid=\*\*\*\*&password=\*\*\*\*&amount=20&msisdn=012&tid=0 HTTP/1.1" 200 21 actually i need …

---

## [3 server design recomendations](https://discuss.elastic.co/t/3-server-design-recomendations/37165)

<div class="topic-metadata">

**Author:** [@l1carter](https://discuss.elastic.co/u/l1carter)\
**Replies:** 5\
**Last updated:** [December 19, 2015, 5:41am UTC](https://discuss.elastic.co/t/3-server-design-recomendations/37165 "2015-12-19T05:41:47Z")

</div>

all, any input on previous experience would be greatly appreciated. I've got access to 3 Dell R610's with 6 (74Gig 15k SAS drives). I'm not certain on the RAM yet but most systems were between 24-32Gig. the main fu…

[Previous page](https://discuss.elastic.co/top.md?page=1300&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1302&per_page=50&period=all)
