# Top

**URL:** https://discuss.elastic.co/top.md?page=1324&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1325

---

## [What grok patterns are installed by default?](https://discuss.elastic.co/t/what-grok-patterns-are-installed-by-default/36663)

<div class="topic-metadata">

**Author:** [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\
**Replies:** 2\
**Last updated:** [December 8, 2015, 6:37pm UTC](https://discuss.elastic.co/t/what-grok-patterns-are-installed-by-default/36663 "2015-12-08T18:37:30Z")

</div>

I'm using Grok Constructor and it has 13 different "grok patterns" listed and all checked by default, e.g. "firewalls". So far I've been unchecking all of them except for "grok-patterns" not being sure the others were av…

---

## [Logstash file output creating wrong file?](https://discuss.elastic.co/t/logstash-file-output-creating-wrong-file/1349)

<div class="topic-metadata">

**Author:** [@Sam\_Barham](https://discuss.elastic.co/u/Sam_Barham)\
**Replies:** 2\
**Last updated:** [May 27, 2015, 12:57am UTC](https://discuss.elastic.co/t/logstash-file-output-creating-wrong-file/1349 "2015-05-27T00:57:14Z")

</div>

As well as outputting to ElasticSearch, I have Logstash outputting to a gzipped file with: file { path =\> "/var/data/logstash/archive-%{+YYYY-MM-dd}.log.gz" gzip =\> true } I then have a cronjob that runs …

---

## [Using 'traefik' module in combination with autodiscovery feature does not work as expected](https://discuss.elastic.co/t/using-traefik-module-in-combination-with-autodiscovery-feature-does-not-work-as-expected/120522)

<div class="topic-metadata">

**Author:** [@darkl0rd](https://discuss.elastic.co/u/darkl0rd)\
**Replies:** 1\
**Last updated:** [February 19, 2018, 7:58pm UTC](https://discuss.elastic.co/t/using-traefik-module-in-combination-with-autodiscovery-feature-does-not-work-as-expected/120522 "2018-02-19T19:58:13Z")

</div>

Hello, I'm using filebeat in combination with the new autodiscovery feature for docker containers. After some struggling (thank again @exekias!) I finally managed to get it to pick up and process the docker containers. …

---

## [Logstash : Reached open files limit](https://discuss.elastic.co/t/logstash-reached-open-files-limit/87903)

<div class="topic-metadata">

**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\
**Replies:** 0\
**Last updated:** [June 1, 2017, 12:13pm UTC](https://discuss.elastic.co/t/logstash-reached-open-files-limit/87903 "2017-06-01T12:13:44Z")

</div>

Hello, I have a common problem with other people about opening file with logstash 5.2. I work on RH 7.1 with rpm packages. \[logstash.inputs.file \] Reached open files limit: 4095, set by the 'max\_open\_files' optio…

---

## [Is there any problem that set ES heap size to 64G?](https://discuss.elastic.co/t/is-there-any-problem-that-set-es-heap-size-to-64g/326546)

<div class="topic-metadata">

**Author:** [@vsop\_479](https://discuss.elastic.co/u/vsop_479)\
**Replies:** 1\
**Last updated:** [February 27, 2023, 10:46pm UTC](https://discuss.elastic.co/t/is-there-any-problem-that-set-es-heap-size-to-64g/326546 "2023-02-27T22:46:26Z")

</div>

My machine has 512G memory, and i only need 2 ES nodes( 2 shards is enough for my index). So, is there any problem that set ES heap size to 64G or more bigger?

---

## [Split index into subindexes by dates like 'my-index-yyyy.MM.dd'](https://discuss.elastic.co/t/split-index-into-subindexes-by-dates-like-my-index-yyyy-mm-dd/339330)

<div class="topic-metadata">

**Author:** [@tyro\_plotter](https://discuss.elastic.co/u/tyro_plotter)\
**Replies:** 4\
**Last updated:** [July 31, 2023, 11:49am UTC](https://discuss.elastic.co/t/split-index-into-subindexes-by-dates-like-my-index-yyyy-mm-dd/339330 "2023-07-31T11:49:04Z")

</div>

I am considering two options: Time Series Ingest pipeline (Date index name processor) I am aware that they differ in their intended use, but I am trying to understand what risks there are. As a newbie to the time ser…

---

## [Filebeat cannot detect modified ingested files](https://discuss.elastic.co/t/filebeat-cannot-detect-modified-ingested-files/293837)

<div class="topic-metadata">

**Author:** [@park\_rage](https://discuss.elastic.co/u/park_rage)\
**Replies:** 4\
**Last updated:** [January 10, 2022, 10:04pm UTC](https://discuss.elastic.co/t/filebeat-cannot-detect-modified-ingested-files/293837 "2022-01-10T22:04:23Z")

</div>

I am configuring the ELK + filebeat environment using docker-compose , but the environment and configuration are as follows. Environment: MacOS Functions to be implemented: Collect the /Users/mymac/dev/logs/app.log…

---

## [How can i filter errors in filebeat](https://discuss.elastic.co/t/how-can-i-filter-errors-in-filebeat/273893)

<div class="topic-metadata">

**Author:** [@Martin\_perez](https://discuss.elastic.co/u/Martin_perez)\
**Replies:** 4\
**Last updated:** [May 27, 2021, 8:20am UTC](https://discuss.elastic.co/t/how-can-i-filter-errors-in-filebeat/273893 "2021-05-27T08:20:14Z")

</div>

Hi, I have an elk stack mounted, which receives data from two filebeats. I want to configure my filebeat configuration files so that it only collects files whose error is anything other than 500, and I have tried to do …

---

## [How do I add a lifecycle policy to an index via the API?](https://discuss.elastic.co/t/how-do-i-add-a-lifecycle-policy-to-an-index-via-the-api/254295)

<div class="topic-metadata">

**Author:** [@jmcclelland](https://discuss.elastic.co/u/jmcclelland)\
**Replies:** 4\
**Last updated:** [November 4, 2020, 4:56pm UTC](https://discuss.elastic.co/t/how-do-i-add-a-lifecycle-policy-to-an-index-via-the-api/254295 "2020-11-04T16:56:12Z")

</div>

In Kibana, if I click on an index, and then click the Manage button, I have the option to "Add lifecycle policy" to that existing index - I'm asked for the policy to add and the rollover index. How do I do this via the …

---

## [Latest Record](https://discuss.elastic.co/t/latest-record/139981)

<div class="topic-metadata">

**Author:** [@fernando.costa](https://discuss.elastic.co/u/fernando.costa)\
**Replies:** 4\
**Last updated:** [July 18, 2018, 2:02pm UTC](https://discuss.elastic.co/t/latest-record/139981 "2018-07-18T14:02:01Z")

</div>

Hi all, I want to plot a coordinate map with only the latest records of an index. My problem is that the timestamp is different for each type of document I want to show. Is this possible? I have scrapped the whole inter…

---

## [Elasticsearch 5.x update dynamic settings](https://discuss.elastic.co/t/elasticsearch-5-x-update-dynamic-settings/88249)

<div class="topic-metadata">

**Author:** [@Marcello\_A](https://discuss.elastic.co/u/Marcello_A)\
**Replies:** 4\
**Last updated:** [June 20, 2017, 6:19am UTC](https://discuss.elastic.co/t/elasticsearch-5-x-update-dynamic-settings/88249 "2017-06-20T06:19:09Z")

</div>

Hi All, we have installed on our development environment the x-pack plugin but our cluster actually is in yellow state because we have only 1 node and there are some replicas/shards unassigned. We tried to fix this confi…

---

## [Rollover API not incrementing time based indices](https://discuss.elastic.co/t/rollover-api-not-incrementing-time-based-indices/86458)

<div class="topic-metadata">

**Author:** [@danwhitacre](https://discuss.elastic.co/u/danwhitacre)\
**Replies:** 4\
**Last updated:** [May 19, 2017, 5:30pm UTC](https://discuss.elastic.co/t/rollover-api-not-incrementing-time-based-indices/86458 "2017-05-19T17:30:44Z")

</div>

Hey all. I am on ES 5.1.1 and I am trying to use the \_rollover api. I have an index test-2017.05.18-1 with an alias test-w. When calling the rollover api with max\_age 0d, my new index associated with the test-w alias is t…

---

## [Distinct Values for Phrases Help](https://discuss.elastic.co/t/distinct-values-for-phrases-help/29924)

<div class="topic-metadata">

**Author:** [@jdb70](https://discuss.elastic.co/u/jdb70)\
**Replies:** 4\
**Last updated:** [September 25, 2015, 3:14pm UTC](https://discuss.elastic.co/t/distinct-values-for-phrases-help/29924 "2015-09-25T15:14:30Z")

</div>

Hello, I am indexing a document that has error message as a field. The error message of course could be a phrase. I am using term aggregation to determine the unique error messages that have occurred but the aggregation …

---

## [Canves, SQL can not order my query](https://discuss.elastic.co/t/canves-sql-can-not-order-my-query/225287)

<div class="topic-metadata">

**Author:** [@emad101](https://discuss.elastic.co/u/emad101)\
**Replies:** 2\
**Last updated:** [March 27, 2020, 2:39pm UTC](https://discuss.elastic.co/t/canves-sql-can-not-order-my-query/225287 "2020-03-27T14:39:55Z")

</div>

Hello, I wrote the following query in Canves SELECT (app\_code) AS appcodex , COUNT(DISTINCT component\_name) AS total, (COUNT(DISTINCT component\_name)/(COUNT(iipm.it\_executive))100) As p FROM "devops-ucd\*" WHERE ii…

---

## [Filebeat doesn't publish logs without "write" permission on index](https://discuss.elastic.co/t/filebeat-doesnt-publish-logs-without-write-permission-on-index/328870)

<div class="topic-metadata">

**Author:** [@Savva\_Morozov](https://discuss.elastic.co/u/Savva_Morozov)\
**Replies:** 5\
**Last updated:** [April 4, 2023, 10:30pm UTC](https://discuss.elastic.co/t/filebeat-doesnt-publish-logs-without-write-permission-on-index/328870 "2023-04-04T22:30:15Z")

</div>

Hello! I created API key for Filebeat to publish log records to Elasticsearch using this documentation as a reference: Grant privileges and roles needed for publishing | Filebeat Reference \[8.6\] | Elastic. But after I d…

---

## [How to Increase Kibana Storage](https://discuss.elastic.co/t/how-to-increase-kibana-storage/219602)

<div class="topic-metadata">

**Author:** [@Syed.Ubaid](https://discuss.elastic.co/u/Syed.Ubaid)\
**Replies:** 5\
**Last updated:** [February 19, 2020, 5:24am UTC](https://discuss.elastic.co/t/how-to-increase-kibana-storage/219602 "2020-02-19T05:24:12Z")

</div>

My kibana use full memory 195 out of 200gb how to increase space in kibana server i have 50 gb free disk space. Because of full memory i cannot edit anything like deleting old dashboard or visualization or create new vis…

---

## [Failed authentication after period of time](https://discuss.elastic.co/t/failed-authentication-after-period-of-time/194101)

<div class="topic-metadata">

**Author:** [@ayan](https://discuss.elastic.co/u/ayan)\
**Replies:** 5\
**Last updated:** [August 17, 2019, 1:03am UTC](https://discuss.elastic.co/t/failed-authentication-after-period-of-time/194101 "2019-08-17T01:03:21Z")

</div>

I generated a react app from the reference UI, and I am using npm start to start the react app. The react app works at first, but after a few hours, when I type some text, I am asked for a username/password because authe…

---

## [Logstash is not able to ingest data into elastic search after 1-2 hours of time span?](https://discuss.elastic.co/t/logstash-is-not-able-to-ingest-data-into-elastic-search-after-1-2-hours-of-time-span/191845)

<div class="topic-metadata">

**Author:** [@ldeepak](https://discuss.elastic.co/u/ldeepak)\
**Replies:** 5\
**Last updated:** [July 29, 2019, 11:01am UTC](https://discuss.elastic.co/t/logstash-is-not-able-to-ingest-data-into-elastic-search-after-1-2-hours-of-time-span/191845 "2019-07-29T11:01:30Z")

</div>

what should be the possible, as i have already checked below points. No connection issue. No error message received at log stash. I have tried to sending logs from a separate log file it is getting transferred success…

---

## [Plugin porting doesn't work - 6.4.4 =\> 7.0.0](https://discuss.elastic.co/t/plugin-porting-doesnt-work-6-4-4-7-0-0/182182)

<div class="topic-metadata">

**Author:** [@Lino\_Capalbo](https://discuss.elastic.co/u/Lino_Capalbo)\
**Replies:** 5\
**Last updated:** [May 29, 2019, 7:31am UTC](https://discuss.elastic.co/t/plugin-porting-doesnt-work-6-4-4-7-0-0/182182 "2019-05-29T07:31:06Z")

</div>

Hi everyone, I’m getting a strange issue porting an AngularJS plugin from kibana 6.4.4 (it works fine with this release) to kibana 7.0.0; when I try to instantiate my plugin on a Visualize I get immediately the error sh…

---

## [ES 5.0-rc1 Sorting by script "... prevent cachability are disabled ..." problem](https://discuss.elastic.co/t/es-5-0-rc1-sorting-by-script-prevent-cachability-are-disabled-problem/63298)

<div class="topic-metadata">

**Author:** [@Alex\_Alexandre](https://discuss.elastic.co/u/Alex_Alexandre)\
**Replies:** 5\
**Last updated:** [October 20, 2016, 6:48am UTC](https://discuss.elastic.co/t/es-5-0-rc1-sorting-by-script-prevent-cachability-are-disabled-problem/63298 "2016-10-20T06:48:36Z")

</div>

Hi, I'm actually testing the ES 5.0 release candidate and i'm asking myself if it's still possible to sort results by scripting. In the 5.0 doc Sort | Elasticsearch Guide \[5.0\] | Elastic its says it's possible but when…

---

## [Unable to send data from Otel Collector to Elasticsearch using Elastic APM](https://discuss.elastic.co/t/unable-to-send-data-from-otel-collector-to-elasticsearch-using-elastic-apm/337871)

<div class="topic-metadata">

**Author:** [@Prateek\_Kumar](https://discuss.elastic.co/u/Prateek_Kumar)\
**Replies:** 3\
**Last updated:** [July 7, 2023, 12:30pm UTC](https://discuss.elastic.co/t/unable-to-send-data-from-otel-collector-to-elasticsearch-using-elastic-apm/337871 "2023-07-07T12:30:01Z")

</div>

Hi Team, I am new to OpenTelemetry. I am trying to do setup using yaml files appraoch but facing 'connection refused' issue while connecting apm to elasticsearch. What I have achieved so far: Able to receive data in …

---

## [ES query from spark returns all despite of filter](https://discuss.elastic.co/t/es-query-from-spark-returns-all-despite-of-filter/316643)

<div class="topic-metadata">

**Author:** [@aadhikari3711](https://discuss.elastic.co/u/aadhikari3711)\
**Replies:** 8\
**Last updated:** [October 25, 2022, 5:14pm UTC](https://discuss.elastic.co/t/es-query-from-spark-returns-all-despite-of-filter/316643 "2022-10-25T17:14:37Z")

</div>

Hello All, I am trying to access index from databricks via es query and wanted a result set based on query filter, add to data frame. Requirement: Get output with :cd.ID=1 and cd.s\_D\<\>0. I get: All the cd.ID both 0 …

---

## [Creating Index Patterns and Dashboards Using API](https://discuss.elastic.co/t/creating-index-patterns-and-dashboards-using-api/309548)

<div class="topic-metadata">

**Author:** [@christng](https://discuss.elastic.co/u/christng)\
**Replies:** 3\
**Last updated:** [July 13, 2022, 4:54pm UTC](https://discuss.elastic.co/t/creating-index-patterns-and-dashboards-using-api/309548 "2022-07-13T16:54:40Z")

</div>

I'm using Kubernetes and trying to create index patterns and dashboards on Kibana 7.17 using the curl commands but they do not seem to be working. I've followed everything at these sources: Saved objects APIs | Kibana Gu…

---

## [Subset match query](https://discuss.elastic.co/t/subset-match-query/261847)

<div class="topic-metadata">

**Author:** [@Josue-Salas](https://discuss.elastic.co/u/Josue-Salas)\
**Replies:** 3\
**Last updated:** [January 22, 2021, 10:03pm UTC](https://discuss.elastic.co/t/subset-match-query/261847 "2021-01-22T22:03:42Z")

</div>

Hi everyone, Thanks for reading. Here's my problem. I have the following documents: "course #1": { "requirements": \[ { "name": "AWS EC2 certification", "type": "certification" …

---

## [How to use json logs and also multiline together](https://discuss.elastic.co/t/how-to-use-json-logs-and-also-multiline-together/258347)

<div class="topic-metadata">

**Author:** [@user2416](https://discuss.elastic.co/u/user2416)\
**Replies:** 3\
**Last updated:** [December 16, 2020, 8:33am UTC](https://discuss.elastic.co/t/how-to-use-json-logs-and-also-multiline-together/258347 "2020-12-16T08:33:03Z")

</div>

Hi, We are using multiline pattern in filebeat but we also have Json logs which doesnt match that multiline pattern. We are seeing both multiline logs and json logs but some json logs are missing and also json logs are …

---

## [Elasticsearch refuses to start](https://discuss.elastic.co/t/elasticsearch-refuses-to-start/213108)

<div class="topic-metadata">

**Author:** [@emilio](https://discuss.elastic.co/u/emilio)\
**Replies:** 3\
**Last updated:** [December 27, 2019, 2:45pm UTC](https://discuss.elastic.co/t/elasticsearch-refuses-to-start/213108 "2019-12-27T14:45:18Z")

</div>

ES refuses to start. What is wrong with this config? path.data: /d02/elastic/data # # Path to log files: # path.logs: /d02/elastic/logs # path.work: /d02/elastic/data/work # path.con…

---

## [Use \* in canvas essql](https://discuss.elastic.co/t/use-in-canvas-essql/210891)

<div class="topic-metadata">

**Author:** [@anon42972578](https://discuss.elastic.co/u/anon42972578)\
**Replies:** 3\
**Last updated:** [December 10, 2019, 7:43am UTC](https://discuss.elastic.co/t/use-in-canvas-essql/210891 "2019-12-10T07:43:52Z")

</div>

Hello, i have a little question for canvas. Here is my code: following line is important: How can I use \* in single quotes ? When i use Chrome-Version-1 or Chrome-Version-2 everything is working fine. Now I wan…

---

## [Aggregation EPS and Average Elapsed Time](https://discuss.elastic.co/t/aggregation-eps-and-average-elapsed-time/169018)

<div class="topic-metadata">

**Author:** [@rtb](https://discuss.elastic.co/u/rtb)\
**Replies:** 8\
**Last updated:** [February 19, 2019, 8:27pm UTC](https://discuss.elastic.co/t/aggregation-eps-and-average-elapsed-time/169018 "2019-02-19T20:27:41Z")

</div>

I need to create an aggregation to provide a count of EPS and Average elapsed time for an operation every second. I have the following but with my test data, I don't get any output. Below is my filter and I am running…

---

## [Logstash - Metricbeat indice doesn't populate](https://discuss.elastic.co/t/logstash-metricbeat-indice-doesnt-populate/158648)

<div class="topic-metadata">

**Author:** [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\
**Replies:** 8\
**Last updated:** [November 29, 2018, 7:33pm UTC](https://discuss.elastic.co/t/logstash-metricbeat-indice-doesnt-populate/158648 "2018-11-29T19:33:06Z")

</div>

I'm trying to get Metricbeat to populate data in Elastic but can't seem to figure out the missing pieces are. I currently have a Windows 2016 Server sandbox setup with Elastic, Kibana and Logstash on one node, abc, and …

---

## [How to make a master detail report in Kibana](https://discuss.elastic.co/t/how-to-make-a-master-detail-report-in-kibana/141468)

<div class="topic-metadata">

**Author:** [@Steven\_Ensslen](https://discuss.elastic.co/u/Steven_Ensslen)\
**Replies:** 3\
**Last updated:** [July 27, 2018, 4:06am UTC](https://discuss.elastic.co/t/how-to-make-a-master-detail-report-in-kibana/141468 "2018-07-27T04:06:08Z")

</div>

I appreciate this isn't Kibana's usual use, but if I wanted to create a master-detail report in Kibana, how would I do so? By master detail report, I mean a data table style report where under each data row (perhaps sho…

---

## [Cumulative sum of derivatives](https://discuss.elastic.co/t/cumulative-sum-of-derivatives/128119)

<div class="topic-metadata">

**Author:** [@Narayana\_Pachava](https://discuss.elastic.co/u/Narayana_Pachava)\
**Replies:** 3\
**Last updated:** [April 23, 2018, 7:26am UTC](https://discuss.elastic.co/t/cumulative-sum-of-derivatives/128119 "2018-04-23T07:26:53Z")

</div>

cumulative sum of derivatives I am currently using elastic for storing time series of of data where I am storing the incoming packets( it is incremental counter) on a port-\>network device . I am doing aggregations to c…

---

## [Machine Learning create new single metric job is done but result not coming](https://discuss.elastic.co/t/machine-learning-create-new-single-metric-job-is-done-but-result-not-coming/109568)

<div class="topic-metadata">

**Author:** [@rijinmp](https://discuss.elastic.co/u/rijinmp)\
**Replies:** 3\
**Last updated:** [December 1, 2017, 8:40am UTC](https://discuss.elastic.co/t/machine-learning-create-new-single-metric-job-is-done-but-result-not-coming/109568 "2017-12-01T08:40:50Z")

</div>

\*\* Using ELK And Xpack 5.4.1 . Apache accesslog indexed successfully.\*\* When creating new single metric job : Aggregation : SUM Field : Offset Bucket span : 5 Running |\> Graph loaded . creating job : Entered Nam…

---

## [Markdown widget query](https://discuss.elastic.co/t/markdown-widget-query/96181)

<div class="topic-metadata">

**Author:** [@Vivek\_Sharma](https://discuss.elastic.co/u/Vivek_Sharma)\
**Replies:** 3\
**Last updated:** [August 16, 2017, 10:07am UTC](https://discuss.elastic.co/t/markdown-widget-query/96181 "2017-08-16T10:07:24Z")

</div>

Hi I have created 3 visualizations as below: Visualization\_1 ====\> Markdown Visualization\_2 ====\> bar chart Visualization\_3 ====\> bar chart I have created two dashboards also as below: Dashboard\_1 ====\> This contai…

---

## [Filebeat \> elasticsearch to filebeat \> logstash \> elasticsearch (syslog)](https://discuss.elastic.co/t/filebeat-elasticsearch-to-filebeat-logstash-elasticsearch-syslog/86671)

<div class="topic-metadata">

**Author:** [@Rgn](https://discuss.elastic.co/u/Rgn)\
**Replies:** 3\
**Last updated:** [May 31, 2017, 1:59pm UTC](https://discuss.elastic.co/t/filebeat-elasticsearch-to-filebeat-logstash-elasticsearch-syslog/86671 "2017-05-31T13:59:43Z")

</div>

Hi there. i'm was using syslog module from filebeat to send data to elasticseach. In my kibana a can saw my data with all the additionnal field (ex: system.syslog.hostname, system.syslog.message system.syslog.pid, etc…

---

## [Multiple proxy routes in elasticsearch plugin](https://discuss.elastic.co/t/multiple-proxy-routes-in-elasticsearch-plugin/81502)

<div class="topic-metadata">

**Author:** [@ccrecana](https://discuss.elastic.co/u/ccrecana)\
**Replies:** 3\
**Last updated:** [April 7, 2017, 11:52pm UTC](https://discuss.elastic.co/t/multiple-proxy-routes-in-elasticsearch-plugin/81502 "2017-04-07T23:52:33Z")

</div>

I want to use multiple kibana indexes for multiple users. I've already built a plugin in which I dinnamically change the elasticsearch request payload and path and reroute it to kibana server. My problem is that the core…

---

## [File meta data fields](https://discuss.elastic.co/t/file-meta-data-fields/51356)

<div class="topic-metadata">

**Author:** [@wmcdonald](https://discuss.elastic.co/u/wmcdonald)\
**Replies:** 3\
**Last updated:** [May 31, 2016, 6:47am UTC](https://discuss.elastic.co/t/file-meta-data-fields/51356 "2016-05-31T06:47:43Z")

</div>

We have a file that contains information written by another application. It only has one line, but doesn't contain any timestamp information. I'd like to use the timestamp on the file itself. In general, since filebea…

---

## [How to link SHIELD with SSO port](https://discuss.elastic.co/t/how-to-link-shield-with-sso-port/33709)

<div class="topic-metadata">

**Author:** [@Pierre\_Jacquot](https://discuss.elastic.co/u/Pierre_Jacquot)\
**Replies:** 3\
**Last updated:** [November 5, 2015, 9:35pm UTC](https://discuss.elastic.co/t/how-to-link-shield-with-sso-port/33709 "2015-11-05T21:35:48Z")

</div>

Hello, I have successfully installed and configure shield on my test environment. My environment use an LDAP connectivity to perform authentification and group authorization. But my production environment will use an S…

---

## [Search terms matching order of precedence?](https://discuss.elastic.co/t/search-terms-matching-order-of-precedence/19414)

<div class="topic-metadata">

**Author:** [@Eric\_Greene](https://discuss.elastic.co/u/Eric_Greene)\
**Replies:** 3\
**Last updated:** [August 22, 2014, 6:25pm UTC](https://discuss.elastic.co/t/search-terms-matching-order-of-precedence/19414 "2014-08-22T18:25:55Z")

</div>

Hi everyone, I would like to take a search query with multiple terms and possibly define an order of precedence in the following way. (bare with me as I become familiar with elasticsearch lingo!) Can I specify th…

---

## [Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock](https://discuss.elastic.co/t/got-permission-denied-while-trying-to-connect-to-the-docker-daemon-socket-at-unix-var-run-docker-sock/307692)

<div class="topic-metadata">

**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\
**Replies:** 1\
**Last updated:** [July 13, 2022, 5:31pm UTC](https://discuss.elastic.co/t/got-permission-denied-while-trying-to-connect-to-the-docker-daemon-socket-at-unix-var-run-docker-sock/307692 "2022-07-13T17:31:03Z")

</div>

Hello World! I'm trying to Run Filebeat on Docker | Filebeat Reference \[7.17\] | Elastic yet running into following issue: % docker-compose logs --tail 2 filebeat filebeat | 2022-06-20T19:05:12.965Z ERROR instance…

---

## [Kibana - API to get status of report generation?](https://discuss.elastic.co/t/kibana-api-to-get-status-of-report-generation/278482)

<div class="topic-metadata">

**Author:** [@peteryann](https://discuss.elastic.co/u/peteryann)\
**Replies:** 1\
**Last updated:** [July 13, 2021, 9:34pm UTC](https://discuss.elastic.co/t/kibana-api-to-get-status-of-report-generation/278482 "2021-07-13T21:34:26Z")

</div>

How do I get the status of a report generation job after I've issued the POST request to generate said report? I have the job ID, but there doesn't seem to be any API that allows me to query for my job and check its stat…

---

## [Kibana unable to find Elasticsearch Indexes, even though they exist in Index Management](https://discuss.elastic.co/t/kibana-unable-to-find-elasticsearch-indexes-even-though-they-exist-in-index-management/235096)

<div class="topic-metadata">

**Author:** [@AlanMark](https://discuss.elastic.co/u/AlanMark)\
**Replies:** 1\
**Last updated:** [June 17, 2020, 7:37am UTC](https://discuss.elastic.co/t/kibana-unable-to-find-elasticsearch-indexes-even-though-they-exist-in-index-management/235096 "2020-06-17T07:37:29Z")

</div>

I've set up an ELK server for a client for testing purposes. It's running on an Ubuntu 18.04 server. Current setup: ElasticSearch, Logstash, FileBeat, Kibana all running latest versions. Elasticsearch is set to netw…

---

## [Need help to reindex with date format changed](https://discuss.elastic.co/t/need-help-to-reindex-with-date-format-changed/171980)

<div class="topic-metadata">

**Author:** [@piet](https://discuss.elastic.co/u/piet)\
**Replies:** 1\
**Last updated:** [March 12, 2019, 3:19pm UTC](https://discuss.elastic.co/t/need-help-to-reindex-with-date-format-changed/171980 "2019-03-12T15:19:23Z")

</div>

I try to re-index a index to a new one. Reason is i wan't to change the date format. But it throws error: "cause": { "type": "mapper\_parsing\_exception", "reason": "failed to parse \[start\_date\]", "caused\_by…

---

## [Using filters with logstash-forwarder](https://discuss.elastic.co/t/using-filters-with-logstash-forwarder/1262)

<div class="topic-metadata">

**Author:** [@palmerabollo](https://discuss.elastic.co/u/palmerabollo)\
**Replies:** 1\
**Last updated:** [May 26, 2015, 4:37am UTC](https://discuss.elastic.co/t/using-filters-with-logstash-forwarder/1262 "2015-05-26T04:37:35Z")

</div>

I can use filters such as "environment" to add an environment variable to my logs with the logstash agent. This is very useful when you need to enrich your logs with metadata, for example: filter { environment { …

---

## [\[Kibana\]\[ML\] The job id cannot contain more than 64 characters](https://discuss.elastic.co/t/kibana-ml-the-job-id-cannot-contain-more-than-64-characters/303047)

<div class="topic-metadata">

**Author:** [@marone](https://discuss.elastic.co/u/marone)\
**Replies:** 3\
**Last updated:** [April 25, 2022, 3:00pm UTC](https://discuss.elastic.co/t/kibana-ml-the-job-id-cannot-contain-more-than-64-characters/303047 "2022-04-25T15:00:31Z")

</div>

Hello, I'm trying to create a ML job to test the anomalies feature with observability, the Log rate job was created successfully, but when I try to create a "Categorization" job it's saying "The job id cannot contain mor…

---

## [Exclude version conflict, document already exists from logstash.log](https://discuss.elastic.co/t/exclude-version-conflict-document-already-exists-from-logstash-log/352186)

<div class="topic-metadata">

**Author:** [@lduvnjak](https://discuss.elastic.co/u/lduvnjak)\
**Replies:** 2\
**Last updated:** [January 31, 2024, 3:42pm UTC](https://discuss.elastic.co/t/exclude-version-conflict-document-already-exists-from-logstash-log/352186 "2024-01-31T15:42:08Z")

</div>

Hey Everyone, I'm having some issues with too much noise in my Logstash logs. What's happening is because I'm using the Threat Intel integrations it's spamming my logs with version conflict, document already exists WAR…

---

## [Elastic agent elastic-agent-control.sock does not exist](https://discuss.elastic.co/t/elastic-agent-elastic-agent-control-sock-does-not-exist/316619)

<div class="topic-metadata">

**Author:** [@stoza](https://discuss.elastic.co/u/stoza)\
**Replies:** 2\
**Last updated:** [October 17, 2022, 7:23am UTC](https://discuss.elastic.co/t/elastic-agent-elastic-agent-control-sock-does-not-exist/316619 "2022-10-17T07:23:40Z")

</div>

Hi Everyone, I'm trying to install an elastic agent and to enroll it with fleet. The enrollment is working, I can see the agent on my fleet server but after few seconds it goes into the unhealthy state. when I run ela…

---

## [Access policy issue](https://discuss.elastic.co/t/access-policy-issue/272761)

<div class="topic-metadata">

**Author:** [@ANSON\_SHAJI](https://discuss.elastic.co/u/ANSON_SHAJI)\
**Replies:** 2\
**Last updated:** [May 12, 2021, 7:04am UTC](https://discuss.elastic.co/t/access-policy-issue/272761 "2021-05-12T07:04:53Z")

</div>

Hi, I created an elastic search domain using amplify framework using the @searchable method. It creates a domain in elastic search. But I can't able to modify the access policy to allow open access to the domain. There …

---

## [Ingest pipeline merge subfields to JSON string?](https://discuss.elastic.co/t/ingest-pipeline-merge-subfields-to-json-string/222819)

<div class="topic-metadata">

**Author:** [@jsosic](https://discuss.elastic.co/u/jsosic)\
**Replies:** 2\
**Last updated:** [March 12, 2020, 1:50am UTC](https://discuss.elastic.co/t/ingest-pipeline-merge-subfields-to-json-string/222819 "2020-03-12T01:50:24Z")

</div>

Hi guys, I have my apps set to write JSON logs, and filebeat sends them enriched with host metadata to Elasticsearch cluster. There they get processed by ingest pipeline which basically runs the following GROK: "p…

---

## [Version Missmatch](https://discuss.elastic.co/t/version-missmatch/182736)

<div class="topic-metadata">

**Author:** [@ajhstn](https://discuss.elastic.co/u/ajhstn)\
**Replies:** 2\
**Last updated:** [May 29, 2019, 12:13am UTC](https://discuss.elastic.co/t/version-missmatch/182736 "2019-05-29T00:13:32Z")

</div>

Is there any way to use Winlogbeat v7 with Elasticsearch v6.4? In a working 6.4 Winlogbeat, ES, Kibana environment, i tried to upgrade just winlogbeat to v7 to make use of the new add\_fields processor, however i now get…

---

## [Kibana did not load properly. check the server output for more information](https://discuss.elastic.co/t/kibana-did-not-load-properly-check-the-server-output-for-more-information/100666)

<div class="topic-metadata">

**Author:** [@shijiebei2009](https://discuss.elastic.co/u/shijiebei2009)\
**Replies:** 2\
**Last updated:** [September 15, 2017, 10:09am UTC](https://discuss.elastic.co/t/kibana-did-not-load-properly-check-the-server-output-for-more-information/100666 "2017-09-15T10:09:06Z")

</div>

sometimes, when I open kibana, it prompt message "kibana did not load properly. check the server output for more information" but it does not appear every time. Usually when I press F5 or refresh in chrome the prompt mes…

[Previous page](https://discuss.elastic.co/top.md?page=1323&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1325&per_page=50&period=all)
