# Top **URL:** https://discuss.elastic.co/top.md?page=1315&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1316 --- ## [WARN#011\[elasticsearch\]#011elasticsearch/client.go:408#011Cannot index event publisher.Event](https://discuss.elastic.co/t/warn-011-elasticsearch-011elasticsearch-client-go-408-011cannot-index-event-publisher-event/254608)
**Author:** [@oicfar](https://discuss.elastic.co/u/oicfar)\ **Replies:** 2\ **Last updated:** [November 21, 2020, 4:52pm UTC](https://discuss.elastic.co/t/warn-011-elasticsearch-011elasticsearch-client-go-408-011cannot-index-event-publisher-event/254608 "2020-11-21T16:52:50Z")
Hi, ES is flooting syslog. Nov 7 13:57:04 nuc-mini-server filebeat\[757\]: 2020-11-07T13:57:04.044+0100#011WARN#011\[elasticsearch\]#011elasticsearch/client.go:408#011Cannot index event publisher.Event{Content:beat.Event{… --- ## [Elastic search Kubernetes cluster\_uuid \_na\_](https://discuss.elastic.co/t/elastic-search-kubernetes-cluster-uuid-na/255756)
**Author:** [@rajkumar\_25](https://discuss.elastic.co/u/rajkumar_25)\ **Replies:** 2\ **Last updated:** [November 18, 2020, 12:04pm UTC](https://discuss.elastic.co/t/elastic-search-kubernetes-cluster-uuid-na/255756 "2020-11-18T12:04:17Z")
I have deployed the elastic search in GKE. I have scaled the elastic search manually and faced a 503 error when accessing the index count. I need to get the data stored in the persistence disk. I am unable to find the … --- ## [Allow monitoring of metricbeat uptime data in Kibana Uptime app](https://discuss.elastic.co/t/allow-monitoring-of-metricbeat-uptime-data-in-kibana-uptime-app/205395)
**Author:** [@bruce289](https://discuss.elastic.co/u/bruce289)\ **Replies:** 2\ **Last updated:** [November 7, 2019, 9:32pm UTC](https://discuss.elastic.co/t/allow-monitoring-of-metricbeat-uptime-data-in-kibana-uptime-app/205395 "2019-11-07T21:32:58Z")
Hi, The metricbeat system module is able to ship uptime metrics to elasticsearch: https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-metricset-system-uptime.html It would be great if these were made a… --- ## [Elasticseachでのpipeline指定](https://discuss.elastic.co/t/elasticseach-pipeline/199385)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 2\ **Last updated:** [September 19, 2019, 1:38am UTC](https://discuss.elastic.co/t/elasticseach-pipeline/199385 "2019-09-19T01:38:12Z")
filebeat→インジェストノードへのファイル転送を行おうとしているのですが、filebeatでpipelineを指定すると、インジェストノード側でエラーになってしまいます。 原因について、ご教示いただけないでしょうか \[2019-09-13T17:05:44,198\]\[DEBUG\]\[o.e.a.b.TransportBulkAction\] \[vm-phn5-sock201.fcxlocal\] failed to execute … --- ## [Can I use rsync tool to migrate closed index on a running elasticsearch cluster?](https://discuss.elastic.co/t/can-i-use-rsync-tool-to-migrate-closed-index-on-a-running-elasticsearch-cluster/175194)
**Author:** [@Adminstrator](https://discuss.elastic.co/u/Adminstrator)\ **Replies:** 2\ **Last updated:** [April 3, 2019, 1:27pm UTC](https://discuss.elastic.co/t/can-i-use-rsync-tool-to-migrate-closed-index-on-a-running-elasticsearch-cluster/175194 "2019-04-03T13:27:03Z")
I have many closed indices to migrate.But I do not want to open them,then use node tag attribute to migrate them dynamicly. \[root@test ~\]# curl -s 'localhost:9200/my\_index/\_settings?pretty' { "my\_index" : { "setti… --- ## [Elastic Apm Agent on PCF cloud foundry Java Build pack (automatic integration)](https://discuss.elastic.co/t/elastic-apm-agent-on-pcf-cloud-foundry-java-build-pack-automatic-integration/171359)
**Author:** [@kenmac](https://discuss.elastic.co/u/kenmac)\ **Replies:** 2\ **Last updated:** [March 13, 2019, 12:27pm UTC](https://discuss.elastic.co/t/elastic-apm-agent-on-pcf-cloud-foundry-java-build-pack-automatic-integration/171359 "2019-03-13T12:27:11Z")
I've got a test MR pull request of code here: I've almost got the build pack to automatically load Elastic Apm Agent on startup. Except it's expecting the repo to have index.yml file in the maven repo. version:… --- ## [How to share dashboard with time picker?](https://discuss.elastic.co/t/how-to-share-dashboard-with-time-picker/133859)
**Author:** [@mamta](https://discuss.elastic.co/u/mamta)\ **Replies:** 2\ **Last updated:** [May 30, 2018, 5:00pm UTC](https://discuss.elastic.co/t/how-to-share-dashboard-with-time-picker/133859 "2018-05-30T17:00:15Z")
Hiieee, I am using ELK 5.6.8 version. I have shared dashboard by using iframe link. That embedded dashboard not giving me real-time data. How can I share time picker and search feature of kibana in my app? Is it possibl… --- ## [Create different Indices for different filebeat folder location](https://discuss.elastic.co/t/create-different-indices-for-different-filebeat-folder-location/132478)
**Author:** [@SumitV](https://discuss.elastic.co/u/SumitV)\ **Replies:** 2\ **Last updated:** [May 21, 2018, 10:55am UTC](https://discuss.elastic.co/t/create-different-indices-for-different-filebeat-folder-location/132478 "2018-05-21T10:55:09Z")
Hi There, I have different application logs sitting in different folders, for instance ../ABC/.logs ../XYZ/.logs In this case filebeat should take generate events for multiple location and according to these location… --- ## [Curator: ignore\_empty\_list & warn\_if\_no\_indices](https://discuss.elastic.co/t/curator-ignore-empty-list-warn-if-no-indices/90998)
**Author:** [@Sean1e](https://discuss.elastic.co/u/Sean1e)\ **Replies:** 2\ **Last updated:** [June 28, 2017, 9:17am UTC](https://discuss.elastic.co/t/curator-ignore-empty-list-warn-if-no-indices/90998 "2017-06-28T09:17:44Z")
I am using Curator to add & remove indexes from an alias (curator\_action.yml below). I have ignore\_empty\_list set to True. The indexes in question relate to an application server in our test environment that are used i… --- ## [ElasticsearchでConcurrent Modification Exceptionが発生してしまう件](https://discuss.elastic.co/t/elasticsearch-concurrent-modification-exception/78454)
**Author:** [@Kazuyuki\_Tateda](https://discuss.elastic.co/u/Kazuyuki_Tateda)\ **Replies:** 2\ **Last updated:** [March 21, 2017, 8:05am UTC](https://discuss.elastic.co/t/elasticsearch-concurrent-modification-exception/78454 "2017-03-21T08:05:17Z")
ElasticsearchでSearchRequestBuilderのsetSizeとaddSortを併用した際に、 ConcurrentModificationExceptionが発生しています。 実装側でソートすれば要求を満たせるため、緊急で困っているわけでないのですが、 もし他の回避方法や同様の事象に遭遇した方がいらっしゃっいましたら情報をいただきたいです。 【バージョン】 elasticsearch 5.1.1 【発生す… --- ## [Logstash 1.5 dies with SyntaxError: (eval):9841: syntax error, unexpected tRBRACK](https://discuss.elastic.co/t/logstash-1-5-dies-with-syntaxerror-eval-9841-syntax-error-unexpected-trbrack/1850)
**Author:** [@Suny](https://discuss.elastic.co/u/Suny)\ **Replies:** 2\ **Last updated:** [June 5, 2015, 8:37am UTC](https://discuss.elastic.co/t/logstash-1-5-dies-with-syntaxerror-eval-9841-syntax-error-unexpected-trbrack/1850 "2015-06-05T08:37:35Z")
Hi. We are switching to logstash 1.5.0-1 to be able to use Shield. But the --configtest throws SyntaxError: (eval):9841: syntax error, unexpected tRBRACK \[exception\]\[class\] == "javax.servlet.ServletException" … --- ## [Short-circuit in bool query?](https://discuss.elastic.co/t/short-circuit-in-bool-query/18693)
**Author:** [@11153](https://discuss.elastic.co/u/11153)\ **Replies:** 2\ **Last updated:** [July 16, 2014, 2:11pm UTC](https://discuss.elastic.co/t/short-circuit-in-bool-query/18693 "2014-07-16T14:11:38Z")
Hello, I would like to know if I send a bool query like { "bool": { "must": \[ { "term": { "user" : "john" } }, { "term": { "age" : 19 } } \] } } is the 2nd query (i.e. "age":19 … --- ## [High availability multiple data center / crash recovery](https://discuss.elastic.co/t/high-availability-multiple-data-center-crash-recovery/17628)
**Author:** [@Yann\_Barraud](https://discuss.elastic.co/u/Yann_Barraud)\ **Replies:** 2\ **Last updated:** [May 26, 2014, 11:21am UTC](https://discuss.elastic.co/t/high-availability-multiple-data-center-crash-recovery/17628 "2014-05-26T11:21:10Z")
Hi, Does anyone figured out how to get a working Elasticsearch installation with 2 data centers in 2 different zones ? How do you get consistency ? Is it an active/active configuration ? How do you manage netw… --- ## [Is indexing with HNSW required for kNN to work?](https://discuss.elastic.co/t/is-indexing-with-hnsw-required-for-knn-to-work/349598)
**Author:** [@mmaccou](https://discuss.elastic.co/u/mmaccou)\ **Replies:** 3\ **Last updated:** [December 19, 2023, 3:36pm UTC](https://discuss.elastic.co/t/is-indexing-with-hnsw-required-for-knn-to-work/349598 "2023-12-19T15:36:26Z")
While setting up some search templates for kNN, I discovered HNSW and the parameters for index options. "index\_options": { "type": "hnsw", "m": 32, "ef\_construction": 100 } When in… --- ## [\[threatintel Filebeat module\] MISP configuration errors with filebeat threatintel module](https://discuss.elastic.co/t/threatintel-filebeat-module-misp-configuration-errors-with-filebeat-threatintel-module/277448)
**Author:** [@Balor](https://discuss.elastic.co/u/Balor)\ **Replies:** 3\ **Last updated:** [June 30, 2021, 12:35pm UTC](https://discuss.elastic.co/t/threatintel-filebeat-module-misp-configuration-errors-with-filebeat-threatintel-module/277448 "2021-06-30T12:35:42Z")
Hello All, A question about the Filebeat module " threatintel ". On the MISP configuration . Using Filebeat 7.13.2.The below are the settings that I have tested but shows with errors in the filebeat logs. The config is … --- ## ["Service Unavailable" crashing the container](https://discuss.elastic.co/t/service-unavailable-crashing-the-container/220858)
**Author:** [@Matthew\_Petrie](https://discuss.elastic.co/u/Matthew_Petrie)\ **Replies:** 3\ **Last updated:** [March 3, 2020, 8:59pm UTC](https://discuss.elastic.co/t/service-unavailable-crashing-the-container/220858 "2020-03-03T20:59:41Z")
Kibana version : 7.6 Elasticsearch version : 7.6 APM Server version : 7.6 APM Agent language and version : Node.JS 3.3.0 Original install method : Elastic Cloud Other: Code running on Google Cloud Run (Knativ… --- ## [Problems installing plugins with Docker and no Internet](https://discuss.elastic.co/t/problems-installing-plugins-with-docker-and-no-internet/208865)
**Author:** [@Jonny3](https://discuss.elastic.co/u/Jonny3)\ **Replies:** 3\ **Last updated:** [November 22, 2019, 8:34pm UTC](https://discuss.elastic.co/t/problems-installing-plugins-with-docker-and-no-internet/208865 "2019-11-22T20:34:44Z")
Hello everyone, I'm working in a ELK system with docker and now I'm installing the Logstash plugins Grok, Mutate and Aggregate but I have the problem that my docker image has not access to Internet so I can't use the sim… --- ## [ElasticSearch stop on Centos 7](https://discuss.elastic.co/t/elasticsearch-stop-on-centos-7/189894)
**Author:** [@skazhikadyadya](https://discuss.elastic.co/u/skazhikadyadya)\ **Replies:** 3\ **Last updated:** [July 11, 2019, 3:13am UTC](https://discuss.elastic.co/t/elasticsearch-stop-on-centos-7/189894 "2019-07-11T03:13:19Z")
Hi. I have installed ES 5.6.16 on my Centos 7.3 from yum. After installation I was check status with service elasticsearch status: ● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasti… --- ## [Migration/ Conversion Tool](https://discuss.elastic.co/t/migration-conversion-tool/172826)
**Author:** [@Raghavv](https://discuss.elastic.co/u/Raghavv)\ **Replies:** 3\ **Last updated:** [March 18, 2019, 6:39pm UTC](https://discuss.elastic.co/t/migration-conversion-tool/172826 "2019-03-18T18:39:54Z")
Good Morning All, We are looking at migrating our existing Splunk Eco-system to Elastic Stack. The current Splunk eco-system has about 200 dashboards that are setup. Questions: Is there a mechanism(migration/conversi… --- ## [Logstash sqlite plugin can't output in elasticsearch](https://discuss.elastic.co/t/logstash-sqlite-plugin-cant-output-in-elasticsearch/63701)
**Author:** [@Rem](https://discuss.elastic.co/u/Rem)\ **Replies:** 3\ **Last updated:** [October 25, 2016, 3:43am UTC](https://discuss.elastic.co/t/logstash-sqlite-plugin-cant-output-in-elasticsearch/63701 "2016-10-25T03:43:28Z")
Hello, I really need to store my logs in a database because I will modify the data so I tried using the sqlite pluging of logstash. Here's my config file : input { sqlite { path =\> "C:/Users/Library/Documen… --- ## [Can I aggregate field values into rate?](https://discuss.elastic.co/t/can-i-aggregate-field-values-into-rate/45454)
**Author:** [@moryaden](https://discuss.elastic.co/u/moryaden)\ **Replies:** 3\ **Last updated:** [March 28, 2016, 3:49pm UTC](https://discuss.elastic.co/t/can-i-aggregate-field-values-into-rate/45454 "2016-03-28T15:49:51Z")
I have a field with values recorded in bits, like moduleA = 0x01 moduleB = 0x02 and one document would be recorded with values like: {name:john, flowflag:1} msg run into module a {name:foo, flowflag:2} msg run into … --- ## [Connecting remotely to elastic search cluster](https://discuss.elastic.co/t/connecting-remotely-to-elastic-search-cluster/21478)
**Author:** [@Vijay\_Tiwary](https://discuss.elastic.co/u/Vijay_Tiwary)\ **Replies:** 3\ **Last updated:** [January 5, 2015, 7:51pm UTC](https://discuss.elastic.co/t/connecting-remotely-to-elastic-search-cluster/21478 "2015-01-05T19:51:37Z")
I am trying to connect remotely to elastic search cluster having 2 nodes My question is I am able to query successfully only when we configure both the cluster name and host name of the individual nodes? Why it doesn'… --- ## [Action.admin.indices.create failed to create](https://discuss.elastic.co/t/action-admin-indices-create-failed-to-create/17113)
**Author:** [@miki\_haiat](https://discuss.elastic.co/u/miki_haiat)\ **Replies:** 3\ **Last updated:** [August 4, 2014, 12:27am UTC](https://discuss.elastic.co/t/action-admin-indices-create-failed-to-create/17113 "2014-08-04T00:27:30Z")
HI , I using elastic4s for an api client , i cant index anything im getting this error \[2014-04-21 20:34:02,735\]\[DEBUG\]\[action.admin.indices.create\] \[Captain UK\] \[\] failed to create java.lang.StringIndexOutO… --- ## [Question about index.translog.disable\_flush](https://discuss.elastic.co/t/question-about-index-translog-disable-flush/6930)
**Author:** [@yantsu](https://discuss.elastic.co/u/yantsu)\ **Replies:** 3\ **Last updated:** [March 7, 2012, 9:07pm UTC](https://discuss.elastic.co/t/question-about-index-translog-disable-flush/6930 "2012-03-07T21:07:05Z")
I'm trying to use the settings API to set index.translog.disable\_flush to true and backing up elasticsearch data afterwards. I'm using the local gateway as configured by default. Setting the disable\_flush paramete… --- ## [Filebeat in Container mode + multiline Parser](https://discuss.elastic.co/t/filebeat-in-container-mode-multiline-parser/320945)
**Author:** [@fidelgonzo](https://discuss.elastic.co/u/fidelgonzo)\ **Replies:** 1\ **Last updated:** [December 10, 2022, 5:47pm UTC](https://discuss.elastic.co/t/filebeat-in-container-mode-multiline-parser/320945 "2022-12-10T17:47:32Z")
I have a problem with Filebeat (7.17) that when trying to read multiline Java Stacktrace logs, it works without problems when input.type: filestream but when running the same in our Kubernetes stack, as input.type: conta… --- ## [Mapper\_parsing\_exception & illegal\_argument\_exception](https://discuss.elastic.co/t/mapper-parsing-exception-illegal-argument-exception/166083)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 1\ **Last updated:** [January 29, 2019, 1:13pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-illegal-argument-exception/166083 "2019-01-29T13:13:20Z")
Hello World! I've noticed following WARN message in my logstash's output: logstash | \[2019-01-29T04:39:23,166\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index event to Elasticsearch. {:status=>400, :action=&g… --- ## [Google pubsub input keeps sending 'Error 400: You have not specified an ack ID in the request.'](https://discuss.elastic.co/t/google-pubsub-input-keeps-sending-error-400-you-have-not-specified-an-ack-id-in-the-request/121052)
**Author:** [@michaelcheung](https://discuss.elastic.co/u/michaelcheung)\ **Replies:** 1\ **Last updated:** [February 27, 2018, 10:13am UTC](https://discuss.elastic.co/t/google-pubsub-input-keeps-sending-error-400-you-have-not-specified-an-ack-id-in-the-request/121052 "2018-02-27T10:13:02Z")
Hi, This is my Dockerfile. FROM docker.elastic.co/logstash/logstash:6.2.2 ENV SSL\_CERT\_FILE /opt/logstash/logstash-core/lib/logstash/certs/cacert.pem RUN logstash-plugin install logstash-input-google\_pubsub This is my… --- ## [Rename a field that has variable in name](https://discuss.elastic.co/t/rename-a-field-that-has-variable-in-name/37284)
**Author:** [@spuder](https://discuss.elastic.co/u/spuder)\ **Replies:** 1\ **Last updated:** [December 16, 2015, 6:55am UTC](https://discuss.elastic.co/t/rename-a-field-that-has-variable-in-name/37284 "2015-12-16T06:55:54Z")
What would be the best way to remove a nested field that has a variable in its name? For example, the logs I'm parsing as json { "foo": { "bar(987234)": "derp" } } Represented as nested field \[foo\]\[bar(23… --- ## [Ignore\_older - Infrequently updated log file](https://discuss.elastic.co/t/ignore-older-infrequently-updated-log-file/34532)
**Author:** [@ccannell](https://discuss.elastic.co/u/ccannell)\ **Replies:** 1\ **Last updated:** [November 13, 2015, 8:29pm UTC](https://discuss.elastic.co/t/ignore-older-infrequently-updated-log-file/34532 "2015-11-13T20:29:08Z")
I just migrated to filebeats yesterday, am just starting to look into how it's performing. Need some clarification on the ignore\_older parameter. Does this mean if a file hasn't been updated in the defined time, it is … --- ## [JMX CompositeDataSupport and Array](https://discuss.elastic.co/t/jmx-compositedatasupport-and-array/629)
**Author:** [@michaelT](https://discuss.elastic.co/u/michaelT)\ **Replies:** 1\ **Last updated:** [May 14, 2015, 12:33pm UTC](https://discuss.elastic.co/t/jmx-compositedatasupport-and-array/629 "2015-05-14T12:33:14Z")
Hi, Using the logstash jmx plugin, I'm retrieving a CompositeDataSupport Object which is then pushed to Elasticsearch. The problem is that the value pushed is not an array converted as a String but more something which… --- ## [Make \`message.text\` not required for Slack action](https://discuss.elastic.co/t/make-message-text-not-required-for-slack-action/120939)
**Author:** [@twardnw](https://discuss.elastic.co/u/twardnw)\ **Replies:** 5\ **Last updated:** [March 8, 2018, 2:55pm UTC](https://discuss.elastic.co/t/make-message-text-not-required-for-slack-action/120939 "2018-03-08T14:55:48Z")
The Slack action currently requires message.text to be present, though slack will gladly accept a message without it, as a message can have an attachment which contains the text to be displayed. The current requirement … --- ## [My 5.6 Index is not being read in Kibana 6.0](https://discuss.elastic.co/t/my-5-6-index-is-not-being-read-in-kibana-6-0/107843)
**Author:** [@Daniel\_Merege](https://discuss.elastic.co/u/Daniel_Merege)\ **Replies:** 5\ **Last updated:** [November 16, 2017, 6:39pm UTC](https://discuss.elastic.co/t/my-5-6-index-is-not-being-read-in-kibana-6-0/107843 "2017-11-16T18:39:48Z")
Hi, I just updated Elastic Stack to 6.0 from 5.6 version. I had an index created in the previous major version, and in order to visualize it on Kibana 6.0, I had first to change the path.data in elasticsearch.yml. I can… --- ## [Why elasticsearch/kibana changes format of data?](https://discuss.elastic.co/t/why-elasticsearch-kibana-changes-format-of-data/94358)
**Author:** [@eminiar](https://discuss.elastic.co/u/eminiar)\ **Replies:** 5\ **Last updated:** [July 24, 2017, 10:04pm UTC](https://discuss.elastic.co/t/why-elasticsearch-kibana-changes-format-of-data/94358 "2017-07-24T22:04:01Z")
Hello! I have the following values of build Duration (seconds) in Jenkins. Failed #28 0.75 sec master Failed #27 0.44 sec master Failed #26 0.46 sec master Failed #25 0.55 sec master Logstash plugin's in jenkin… --- ## [Filebeat file\_identity inode\_uuid](https://discuss.elastic.co/t/filebeat-file-identity-inode-uuid/307665)
**Author:** [@bernhard.fluehmann](https://discuss.elastic.co/u/bernhard.fluehmann)\ **Replies:** 0\ **Last updated:** [June 20, 2022, 2:01pm UTC](https://discuss.elastic.co/t/filebeat-file-identity-inode-uuid/307665 "2022-06-20T14:01:57Z")
This may be an old discussion and we have seen some improvements in the past, but I would like to bring it up again. The issue is that by default, filebeat indentifies files by inode and device id. The problem with the … --- ## [Repo for Grok Patterns](https://discuss.elastic.co/t/repo-for-grok-patterns/175606)
**Author:** [@tyler\_hilsabeck](https://discuss.elastic.co/u/tyler_hilsabeck)\ **Replies:** 0\ **Last updated:** [April 5, 2019, 1:37pm UTC](https://discuss.elastic.co/t/repo-for-grok-patterns/175606 "2019-04-05T13:37:53Z")
Hi Everyone! I was wondering if there is a central repository for community created grok patterns? I often find really useful patterns around and was wondering if there is place that they are often hosted in one place. … --- ## [Aggregate on array objects](https://discuss.elastic.co/t/aggregate-on-array-objects/138122)
**Author:** [@ksarsecha](https://discuss.elastic.co/u/ksarsecha)\ **Replies:** 0\ **Last updated:** [July 2, 2018, 6:21am UTC](https://discuss.elastic.co/t/aggregate-on-array-objects/138122 "2018-07-02T06:21:54Z")
I want to aggregate document based on entire array object and not single value inside array object. For example, given are the following documents { "took": 15, "timed\_out": false, "\_shards": { "total": 5, "succes… --- ## [Dropped Netflow packets in filebeat](https://discuss.elastic.co/t/dropped-netflow-packets-in-filebeat/283837)
**Author:** [@hjazz6](https://discuss.elastic.co/u/hjazz6)\ **Replies:** 1\ **Last updated:** [October 6, 2021, 10:28am UTC](https://discuss.elastic.co/t/dropped-netflow-packets-in-filebeat/283837 "2021-10-06T10:28:08Z")
Hi, I'm ingesting Netflow traffic using filebeat's netflow module (for the first time), and I think there are dropped packets. I'm wondering if there is anything I can do to reduce or eliminate dropped packets. I start… --- ## [Average for a string field in Kibana visualization](https://discuss.elastic.co/t/average-for-a-string-field-in-kibana-visualization/299819)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 2\ **Last updated:** [March 17, 2022, 6:37am UTC](https://discuss.elastic.co/t/average-for-a-string-field-in-kibana-visualization/299819 "2022-03-17T06:37:45Z")
Hi all, I'm trying to find average for a string field and I want to show in a bar chart in Kibana by date. In my dataset, Say I have hundreds of computers with a computer\_id ( string field). I have hundreds of Virus a… --- ## [CentOs vs Ubuntu for elastic](https://discuss.elastic.co/t/centos-vs-ubuntu-for-elastic/238865)
**Author:** [@KrishK](https://discuss.elastic.co/u/KrishK)\ **Replies:** 2\ **Last updated:** [June 29, 2020, 10:53am UTC](https://discuss.elastic.co/t/centos-vs-ubuntu-for-elastic/238865 "2020-06-29T10:53:27Z")
Hi Support, I just need to confirm that, is there any difference / any issue/performance-related issue between CentOs - 7 and Ubuntu 18.04 LTS. UAT Testing was on CentOs, now the Production setup is in Ubuntu. So will… --- ## [Logstash.inputs.redis - Redis connection problem](https://discuss.elastic.co/t/logstash-inputs-redis-redis-connection-problem/130207)
**Author:** [@Gaurav\_Agarwal](https://discuss.elastic.co/u/Gaurav_Agarwal)\ **Replies:** 2\ **Last updated:** [May 9, 2018, 3:02pm UTC](https://discuss.elastic.co/t/logstash-inputs-redis-redis-connection-problem/130207 "2018-05-09T15:02:19Z")
Hello I am using redis-server to queue my data which is sent from the logstash shipper. From the redis queue the logstash indexers picks the data. But for some reason after some time again and again there is a connecti… --- ## [Does Snapshot/Restore to a different target cluster retain system indices?](https://discuss.elastic.co/t/does-snapshot-restore-to-a-different-target-cluster-retain-system-indices/115775)
**Author:** [@Senor](https://discuss.elastic.co/u/Senor)\ **Replies:** 2\ **Last updated:** [January 18, 2018, 7:46pm UTC](https://discuss.elastic.co/t/does-snapshot-restore-to-a-different-target-cluster-retain-system-indices/115775 "2018-01-18T19:46:30Z")
As the title states, if I were to perform a snapshot on one cluster and restore it to another target cluster, will it retain the .\* system indices? In particular, .security, .kibana, .monitoring, .watcher-history and so … --- ## [File creates empty sincedb file and no data is processed](https://discuss.elastic.co/t/file-creates-empty-sincedb-file-and-no-data-is-processed/69368)
**Author:** [@chromechris](https://discuss.elastic.co/u/chromechris)\ **Replies:** 2\ **Last updated:** [December 20, 2016, 5:25pm UTC](https://discuss.elastic.co/t/file-creates-empty-sincedb-file-and-no-data-is-processed/69368 "2016-12-20T17:25:28Z")
I'm sure there is a logical reason for this. I have a file that is parsed most of the times but sometimes it is not. I have deleted the sincedb file pattern for this file multiple times, tried setting the "sincedb\_path" … --- ## [Logstash doesn't recognize "Feb 29" as a valid date](https://discuss.elastic.co/t/logstash-doesnt-recognize-feb-29-as-a-valid-date/42965)
**Author:** [@s0mb00n](https://discuss.elastic.co/u/s0mb00n)\ **Replies:** 2\ **Last updated:** [March 1, 2016, 2:50am UTC](https://discuss.elastic.co/t/logstash-doesnt-recognize-feb-29-as-a-valid-date/42965 "2016-03-01T02:50:58Z")
Logstash continuously output the following error when the clock hit February 29th, 2016: {"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse \[timestamp\]", "caused\_by"=\>{"type"=\>"illegal\_field\_value\_excepti… --- ## [Is it best practice to allow auto scale out/down ES cluster nodes?](https://discuss.elastic.co/t/is-it-best-practice-to-allow-auto-scale-out-down-es-cluster-nodes/42595)
**Author:** [@Youxu](https://discuss.elastic.co/u/Youxu)\ **Replies:** 2\ **Last updated:** [February 26, 2016, 1:39am UTC](https://discuss.elastic.co/t/is-it-best-practice-to-allow-auto-scale-out-down-es-cluster-nodes/42595 "2016-02-26T01:39:20Z")
I am building my Elasticsearch cluster on Azure VMs. I am thinking to enable auto scale out/in the VMs in the cluster based on the some performance throttle, such as CPU usage. But my concern is, since the scale out/down… --- ## [ElasticSearch reindex suddenly cut docs by half and went red](https://discuss.elastic.co/t/elasticsearch-reindex-suddenly-cut-docs-by-half-and-went-red/27280)
**Author:** [@thyagobr](https://discuss.elastic.co/u/thyagobr)\ **Replies:** 2\ **Last updated:** [August 14, 2015, 12:15pm UTC](https://discuss.elastic.co/t/elasticsearch-reindex-suddenly-cut-docs-by-half-and-went-red/27280 "2015-08-14T12:15:38Z")
Hi, everyone. I have a 25GB elasticsearch index and I have to add an analyzer to some fields, so I'm reindexing the entire index. I wrote a ruby script that ran fine, but, this time, it behaved oddly: when I was reach… --- ## [ES 0.90.10 - NullPointerException on Script Filter - Query Failed \[Failed to execute main query\]\]; nested: NullPointerException; }\]](https://discuss.elastic.co/t/es-0-90-10-nullpointerexception-on-script-filter-query-failed-failed-to-execute-main-query-nested-nullpointerexception/15722)
**Author:** [@Erwin\_Rijss](https://discuss.elastic.co/u/Erwin_Rijss)\ **Replies:** 2\ **Last updated:** [February 11, 2014, 7:41pm UTC](https://discuss.elastic.co/t/es-0-90-10-nullpointerexception-on-script-filter-query-failed-failed-to-execute-main-query-nested-nullpointerexception/15722 "2014-02-11T19:41:57Z")
Hi, The setup The setup I'm using is ES 0.90.10 with the FileServer River to index corporate file server. Setup is pretty straightforward. Only the mapping has been changed (differences between standard mapping o… --- ## [Elastic Certified Analyst Exam](https://discuss.elastic.co/t/elastic-certified-analyst-exam/318360)
**Author:** [@linhz](https://discuss.elastic.co/u/linhz)\ **Replies:** 4\ **Last updated:** [November 8, 2022, 10:47am UTC](https://discuss.elastic.co/t/elastic-certified-analyst-exam/318360 "2022-11-08T10:47:20Z")
Hi, Im super disappointed that this is the 2nd time i failed the Elastic Certified Analyst Exam. Understand the concept by go through all exam objectives, attended all the training materials and make lots of practice ye… --- ## [Logstash Filter to parse a string](https://discuss.elastic.co/t/logstash-filter-to-parse-a-string/192780)
**Author:** [@Gabriel\_Shen](https://discuss.elastic.co/u/Gabriel_Shen)\ **Replies:** 4\ **Last updated:** [July 30, 2019, 4:03pm UTC](https://discuss.elastic.co/t/logstash-filter-to-parse-a-string/192780 "2019-07-30T16:03:05Z")
I have a log file with each line being a long string (each being very similar). An example line is = "12345555678890,1234567890ABBCCDDEEFFGG123456789GGFFFEEDDCCBBAA" All I want is the numbers in between the two G's. Thos… --- ## [How to get data from call manager](https://discuss.elastic.co/t/how-to-get-data-from-call-manager/170199)
**Author:** [@biggizod](https://discuss.elastic.co/u/biggizod)\ **Replies:** 4\ **Last updated:** [March 17, 2019, 3:12am UTC](https://discuss.elastic.co/t/how-to-get-data-from-call-manager/170199 "2019-03-17T03:12:01Z")
Hi, is it possible to for dashboard on KIbana based on data from cisco call manager? Can Kibana send script/commands, curl commands to call manager and receive data and form dashboard/tables? --- ## [Run match query over specific documents](https://discuss.elastic.co/t/run-match-query-over-specific-documents/164961)
**Author:** [@jmngpt](https://discuss.elastic.co/u/jmngpt)\ **Replies:** 4\ **Last updated:** [January 30, 2019, 11:58am UTC](https://discuss.elastic.co/t/run-match-query-over-specific-documents/164961 "2019-01-30T11:58:07Z")
I have a large index (10M+ docs with large bodies of text) and I'm trying to speed up queries for large bodies of text over it. I know in advance in which documents the "text" is likely to be (i.e. I know the doc's like… [Previous page](https://discuss.elastic.co/top.md?page=1314&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1316&per_page=50&period=all)