# Top

**URL:** https://discuss.elastic.co/top.md?page=1326&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1327

---

## [Using Logstash to correct timestamps](https://discuss.elastic.co/t/using-logstash-to-correct-timestamps/215379)

<div class="topic-metadata">

**Author:** [@Hyperion0](https://discuss.elastic.co/u/Hyperion0)\
**Replies:** 8\
**Last updated:** [January 17, 2020, 3:11pm UTC](https://discuss.elastic.co/t/using-logstash-to-correct-timestamps/215379 "2020-01-17T15:11:40Z")

</div>

I'm very new to the ELK stack. I have several logs that starts collecting data before the systems time is set. The result is I have several hundred log entries with in accurate time stamps. Is there a way I can edit th…

---

## [Excel export csv](https://discuss.elastic.co/t/excel-export-csv/200386)

<div class="topic-metadata">

**Author:** [@mr\_searchng](https://discuss.elastic.co/u/mr_searchng)\
**Replies:** 8\
**Last updated:** [September 27, 2019, 11:48am UTC](https://discuss.elastic.co/t/excel-export-csv/200386 "2019-09-27T11:48:19Z")

</div>

Is it possible to get the data in separate column in excel in kibana ?

---

## [Java.lang.NullPointerException: Cannot get property 'x' on null object - when running a groovy script](https://discuss.elastic.co/t/java-lang-nullpointerexception-cannot-get-property-x-on-null-object-when-running-a-groovy-script/47726)

<div class="topic-metadata">

**Author:** [@tpraizler](https://discuss.elastic.co/u/tpraizler)\
**Replies:** 0\
**Last updated:** [April 19, 2016, 12:29am UTC](https://discuss.elastic.co/t/java-lang-nullpointerexception-cannot-get-property-x-on-null-object-when-running-a-groovy-script/47726 "2016-04-19T00:29:29Z")

</div>

Hi, I run a groovy script through the transport client: The script looks like this: if (ctx.\_source.field.names == null) ctx.\_source.field.names=newItems else ctx.\_source.field.names\<\< new…

---

## [Split a field in elastic search](https://discuss.elastic.co/t/split-a-field-in-elastic-search/173030)

<div class="topic-metadata">

**Author:** [@Tim\_Rice](https://discuss.elastic.co/u/Tim_Rice)\
**Replies:** 6\
**Last updated:** [March 20, 2019, 1:16pm UTC](https://discuss.elastic.co/t/split-a-field-in-elastic-search/173030 "2019-03-20T13:16:16Z")

</div>

I have winbeats installed and things are working great. I have a field that is called: event\_data.RuleName and an actual value is: technique\_id=T1130,technique\_name=Install Root Certificate I would like to split tha…

---

## [Logstash Date Parse failure](https://discuss.elastic.co/t/logstash-date-parse-failure/289185)

<div class="topic-metadata">

**Author:** [@Stephy\_Jacob](https://discuss.elastic.co/u/Stephy_Jacob)\
**Replies:** 4\
**Last updated:** [November 15, 2021, 5:18pm UTC](https://discuss.elastic.co/t/logstash-date-parse-failure/289185 "2021-11-15T17:18:41Z")

</div>

Hello, I am banging my head for quite sometime to understand why am I getting dateparsefailure after trying multiple match combinations. Logstash Version = 7.9.2 sudo echo '2021-11-15T11:17:56.831Z' | /usr/share/logst…

---

## [Can't add a new node to an es cluster with x-pack:enabled](https://discuss.elastic.co/t/cant-add-a-new-node-to-an-es-cluster-with-x-pack-enabled/260862)

<div class="topic-metadata">

**Author:** [@KaZuKi\_Yashiro](https://discuss.elastic.co/u/KaZuKi_Yashiro)\
**Replies:** 4\
**Last updated:** [January 14, 2021, 3:04pm UTC](https://discuss.elastic.co/t/cant-add-a-new-node-to-an-es-cluster-with-x-pack-enabled/260862 "2021-01-14T15:04:43Z")

</div>

I need to transfer the elasticsearch cluster from two servers to another two servers, without downtime or restart. How can this be done? I've tried to add a new node to an existing cluster with x-pack, but it doesn't w…

---

## [Filebeat Azure Module Issue](https://discuss.elastic.co/t/filebeat-azure-module-issue/215297)

<div class="topic-metadata">

**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Replies:** 4\
**Last updated:** [January 17, 2020, 12:37pm UTC](https://discuss.elastic.co/t/filebeat-azure-module-issue/215297 "2020-01-17T12:37:01Z")

</div>

Hello, We seem to have issues getting the Filebeat Azure module to connect to our configured Azure namespace. Filebeat version is 7.5.1. Filebeat logs: Jan 16 11:42:31 myserver filebeat\[26155\]: 2020-01-16T11:42:31.680…

---

## [How I can drop anyone fields if a value in this field contains "null"?](https://discuss.elastic.co/t/how-i-can-drop-anyone-fields-if-a-value-in-this-field-contains-null/109543)

<div class="topic-metadata">

**Author:** [@srolskyi](https://discuss.elastic.co/u/srolskyi)\
**Replies:** 4\
**Last updated:** [November 29, 2017, 11:28am UTC](https://discuss.elastic.co/t/how-i-can-drop-anyone-fields-if-a-value-in-this-field-contains-null/109543 "2017-11-29T11:28:16Z")

</div>

How I can drop anyone fields if a value in this field contains "null"? I use plugins kv, xml, and json sometimes value in the field = null. I need a flexible solution, that so as not to describe each field separately. …

---

## [Better to have 1 daily metricbeat index with many filter index aliases or many daily metricbeat indices with no filtered aliases?](https://discuss.elastic.co/t/better-to-have-1-daily-metricbeat-index-with-many-filter-index-aliases-or-many-daily-metricbeat-indices-with-no-filtered-aliases/105765)

<div class="topic-metadata">

**Author:** [@tsullivan93](https://discuss.elastic.co/u/tsullivan93)\
**Replies:** 4\
**Last updated:** [October 30, 2017, 5:21pm UTC](https://discuss.elastic.co/t/better-to-have-1-daily-metricbeat-index-with-many-filter-index-aliases-or-many-daily-metricbeat-indices-with-no-filtered-aliases/105765 "2017-10-30T17:21:42Z")

</div>

Essentially what the topic says. Is it better to have 1 daily metricbeat index with many filter index aliases or many daily metricbeat indices with no filtered aliases in terms of optimizing cluster performance and healt…

---

## [Java client's scripts api](https://discuss.elastic.co/t/java-clients-scripts-api/95287)

<div class="topic-metadata">

**Author:** [@Hyojoung\_Shin](https://discuss.elastic.co/u/Hyojoung_Shin)\
**Replies:** 4\
**Last updated:** [August 4, 2017, 4:54am UTC](https://discuss.elastic.co/t/java-clients-scripts-api/95287 "2017-08-04T04:54:27Z")

</div>

Hi, Thank you for your work! I am trying to use Indexed Scripts API from java. This is the tutorial that I tested. my client does not have those methods and Response classes. I am using elastic cloud(v5.5.1). What i…

---

## [ES Cluster Name in different AWS Data Center](https://discuss.elastic.co/t/es-cluster-name-in-different-aws-data-center/42521)

<div class="topic-metadata">

**Author:** [@nkanchas](https://discuss.elastic.co/u/nkanchas)\
**Replies:** 4\
**Last updated:** [February 23, 2016, 7:07pm UTC](https://discuss.elastic.co/t/es-cluster-name-in-different-aws-data-center/42521 "2016-02-23T19:07:21Z")

</div>

Hi, I have a ES Cluster with name "log\_cluster" in Singapore AWS DC. Now I want to bring new ES Cluster on Ireland DC and this should run independent of Singapore DC. IF I give same ES cluster name "log\_cluster" to …

---

## [Kibana 4 upgrade?](https://discuss.elastic.co/t/kibana-4-upgrade/37240)

<div class="topic-metadata">

**Author:** [@Thamizharasu](https://discuss.elastic.co/u/Thamizharasu)\
**Replies:** 4\
**Last updated:** [December 18, 2015, 8:23am UTC](https://discuss.elastic.co/t/kibana-4-upgrade/37240 "2015-12-18T08:23:22Z")

</div>

We have our application running with Kibana 3. Since the earlier version of Kibana available with Tomcat bundle we shipped the required files along with our product. But the latest version of Kibana 4 is not in the ca…

---

## [ElasticSearch hadoop - .EsHadoopSerializationException](https://discuss.elastic.co/t/elasticsearch-hadoop-eshadoopserializationexception/21237)

<div class="topic-metadata">

**Author:** [@Kamil\_Dziublinski](https://discuss.elastic.co/u/Kamil_Dziublinski)\
**Replies:** 4\
**Last updated:** [December 18, 2014, 1:09pm UTC](https://discuss.elastic.co/t/elasticsearch-hadoop-eshadoopserializationexception/21237 "2014-12-18T13:09:18Z")

</div>

Hi guys, I am trying to run a MR job that reads from HDFS and stores into ElasticSearch cluster. I am getting following error: Error: org.elasticsearch.hadoop.serialization.EsHadoopSerializationException: Ca…

---

## [Unable to implement date range filter in elastic search query](https://discuss.elastic.co/t/unable-to-implement-date-range-filter-in-elastic-search-query/85192)

<div class="topic-metadata">

**Author:** [@kunalp](https://discuss.elastic.co/u/kunalp)\
**Replies:** 3\
**Last updated:** [May 10, 2017, 7:46am UTC](https://discuss.elastic.co/t/unable-to-implement-date-range-filter-in-elastic-search-query/85192 "2017-05-10T07:46:32Z")

</div>

Hi, When I am trying to execute below query curl -XGET 'http://localhost:9200/logstash\*/\_search' -d '{ "query" : { "filter" : \[ "range" : { "timestamp" : {"gt" : "2017-02-01 00:00:00","lt" : "2017-05-01 00:00:00"}}…

---

## [Watcher ES version](https://discuss.elastic.co/t/watcher-es-version/1087)

<div class="topic-metadata">

**Author:** [@Derry\_O\_Sullivan](https://discuss.elastic.co/u/Derry_O_Sullivan)\
**Replies:** 3\
**Last updated:** [May 21, 2015, 1:55pm UTC](https://discuss.elastic.co/t/watcher-es-version/1087 "2015-05-21T13:55:53Z")

</div>

Does Watcher have a 'minimum' elasticsearch version?

---

## [Can we use "/" (forward slash) inside the ID](https://discuss.elastic.co/t/can-we-use-forward-slash-inside-the-id/224404)

<div class="topic-metadata">

**Author:** [@arjun\_kumar](https://discuss.elastic.co/u/arjun_kumar)\
**Replies:** 2\
**Last updated:** [March 20, 2020, 12:43pm UTC](https://discuss.elastic.co/t/can-we-use-forward-slash-inside-the-id/224404 "2020-03-20T12:43:39Z")

</div>

can we use "/" (forward slash) inside the ID PUT test/\_doc/GD+GGAct+-+Avg+FIN201-02-01115ce07a-e5e7-4ba3-9117-4a7a49c3df01+N/A+03202020 { "foo": "bar" }

---

## [TLS / SSL with basic license?](https://discuss.elastic.co/t/tls-ssl-with-basic-license/178253)

<div class="topic-metadata">

**Author:** [@asp](https://discuss.elastic.co/u/asp)\
**Replies:** 2\
**Last updated:** [May 21, 2019, 7:20am UTC](https://discuss.elastic.co/t/tls-ssl-with-basic-license/178253 "2019-05-21T07:20:06Z")

</div>

Hi there, Is it possible to encrypt http and transport ports of kibana and elasticsearch with TLS / SSL with basic license? I just want to secure the transport via network between the components (logstash, kibana, elas…

---

## [Try to use heartbeat to ping thrift interface](https://discuss.elastic.co/t/try-to-use-heartbeat-to-ping-thrift-interface/108106)

<div class="topic-metadata">

**Author:** [@jiangzhileaf](https://discuss.elastic.co/u/jiangzhileaf)\
**Replies:** 2\
**Last updated:** [November 18, 2017, 4:36am UTC](https://discuss.elastic.co/t/try-to-use-heartbeat-to-ping-thrift-interface/108106 "2017-11-18T04:36:43Z")

</div>

try to use heartbeat to ping thrift interface(call ping method , receive string "pong") i ping through tcp and need to send a binary data as below: check.send: "\\x00\\x00\\x00\\x10\\x80\\x01\\x00\\x01\\x00\\x00\\x00\\x04\\x70\\x69\\…

---

## [Conditional counting in kibana](https://discuss.elastic.co/t/conditional-counting-in-kibana/87200)

<div class="topic-metadata">

**Author:** [@sureshboiina](https://discuss.elastic.co/u/sureshboiina)\
**Replies:** 2\
**Last updated:** [May 27, 2017, 1:33am UTC](https://discuss.elastic.co/t/conditional-counting-in-kibana/87200 "2017-05-27T01:33:53Z")

</div>

Hello we early use qlikview to do some aggregations like Count(Distinct IF((Tier = 'Tier 1' AND AGGR(Count({$}SiteID), ClusterCode, Week) \>= 6) OR (Tier = 'Tier 2' AND AGGR(Count({$}SiteID), ClusterCode, Week) \>= 5) …

---

## [Why does reindex stop at 1000 documents?](https://discuss.elastic.co/t/why-does-reindex-stop-at-1000-documents/65125)

<div class="topic-metadata">

**Author:** [@nvd](https://discuss.elastic.co/u/nvd)\
**Replies:** 2\
**Last updated:** [November 10, 2016, 4:16am UTC](https://discuss.elastic.co/t/why-does-reindex-stop-at-1000-documents/65125 "2016-11-10T04:16:30Z")

</div>

I have an index with 130,000 documents each about 1-3Mb geo\_shape data. I'm trying to map them to a different index (New index only has an greater number of shards). When I run the following reindex, it only runs for …

---

## [Index template file is not applied](https://discuss.elastic.co/t/index-template-file-is-not-applied/34095)

<div class="topic-metadata">

**Author:** [@byku](https://discuss.elastic.co/u/byku)\
**Replies:** 2\
**Last updated:** [November 8, 2015, 9:10pm UTC](https://discuss.elastic.co/t/index-template-file-is-not-applied/34095 "2015-11-08T21:10:36Z")

</div>

Hi all, I configuring docker container with ES v2. I use next template: { "template": "\*", "order": 10, "settings": {}, "mappings": { "\_default\_": { "dynamic\_templates": \[ { "string\_…

---

## [Elasticsearch 1.6.0 and Logstash 1.5.2 compatibility issues](https://discuss.elastic.co/t/elasticsearch-1-6-0-and-logstash-1-5-2-compatibility-issues/25692)

<div class="topic-metadata">

**Author:** [@toddysm](https://discuss.elastic.co/u/toddysm)\
**Replies:** 2\
**Last updated:** [July 19, 2015, 5:13am UTC](https://discuss.elastic.co/t/elasticsearch-1-6-0-and-logstash-1-5-2-compatibility-issues/25692 "2015-07-19T05:13:16Z")

</div>

Hello, I just downloaded the latest versions of ES (1.6.0) and LS (1.5.2) and am experiencing issues with parsing logs with LS and indexing with ES. The config file for LS works properly as I tested it with console out…

---

## [Issues with collecting Dependabot alerts using GitHub integration](https://discuss.elastic.co/t/issues-with-collecting-dependabot-alerts-using-github-integration/346277)

<div class="topic-metadata">

**Author:** [@bil15](https://discuss.elastic.co/u/bil15)\
**Replies:** 7\
**Last updated:** [November 3, 2023, 8:16am UTC](https://discuss.elastic.co/t/issues-with-collecting-dependabot-alerts-using-github-integration/346277 "2023-11-03T08:16:24Z")

</div>

Hello! I'm trying to ingest Dependabot alerts from a GitHub organization to Elastic but I'm encountering some issues. The most interesting part is that I use the same PAT and input parameters (organization, tag set, et…

---

## [Prometheus to Elasticsearch using remote\_write - server returned HTTP status 405 method not allowed](https://discuss.elastic.co/t/prometheus-to-elasticsearch-using-remote-write-server-returned-http-status-405-method-not-allowed/302661)

<div class="topic-metadata">

**Author:** [@r.ganeshbabu](https://discuss.elastic.co/u/r.ganeshbabu)\
**Replies:** 1\
**Last updated:** [April 19, 2022, 3:51am UTC](https://discuss.elastic.co/t/prometheus-to-elasticsearch-using-remote-write-server-returned-http-status-405-method-not-allowed/302661 "2022-04-19T03:51:30Z")

</div>

Hi All, I am working on sending data from prometheus to elasticsearch using remote\_write in k8s and I am using Prometheus 2.28 image. Below is the remote write configuration defined in configMap (k8s). --- kind: Confi…

---

## [Dashboard для web-аналитики: количество посетителей и продолжительность сессии](https://discuss.elastic.co/t/dashboard-web/249415)

<div class="topic-metadata">

**Author:** [@Slavik\_Fursov](https://discuss.elastic.co/u/Slavik_Fursov)\
**Replies:** 7\
**Last updated:** [September 22, 2020, 4:33pm UTC](https://discuss.elastic.co/t/dashboard-web/249415 "2020-09-22T16:33:06Z")

</div>

Я собираю nginx web access and error logs в Elastic с помощью Filebeat. Хочу чтобы была dashboard, в которой была вот такая информация: количество посетителей за период времени. Сейчас есть количество requests, но нуж…

---

## [Timeout and failure in creating ECK in kubernetes version 1.14.4](https://discuss.elastic.co/t/timeout-and-failure-in-creating-eck-in-kubernetes-version-1-14-4/231122)

<div class="topic-metadata">

**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\
**Replies:** 7\
**Last updated:** [May 12, 2020, 5:05am UTC](https://discuss.elastic.co/t/timeout-and-failure-in-creating-eck-in-kubernetes-version-1-14-4/231122 "2020-05-12T05:05:02Z")

</div>

The same yaml can be created successfully under version 1.16.3 kubectl create -f test.yaml Error from server (Timeout): error when creating "test.yaml": Timeout: request did not complete within requested timeout 30s k…

---

## [Date processor timezone config problem](https://discuss.elastic.co/t/date-processor-timezone-config-problem/201575)

<div class="topic-metadata">

**Author:** [@ztyzbb](https://discuss.elastic.co/u/ztyzbb)\
**Replies:** 1\
**Last updated:** [October 3, 2019, 5:01am UTC](https://discuss.elastic.co/t/date-processor-timezone-config-problem/201575 "2019-10-03T05:01:12Z")

</div>

I'm trying to index Logstash log with filebeat Logstash module. Everything works fine except @timestamp. This is origin log text: \[2019-09-30T09:22:27,323\]\[DEBUG\]\[org.logstash.beats.BeatsHandler\] \[local: 0:0:0:0:0:0:0:…

---

## [Error while starting Kibana](https://discuss.elastic.co/t/error-while-starting-kibana/92216)

<div class="topic-metadata">

**Author:** [@Prateek\_Kshtriya](https://discuss.elastic.co/u/Prateek_Kshtriya)\
**Replies:** 1\
**Last updated:** [July 7, 2017, 5:12pm UTC](https://discuss.elastic.co/t/error-while-starting-kibana/92216 "2017-07-07T17:12:57Z")

</div>

Hi All, I am getting below error while trying to start kibana on command line- E:\\ELK\\kibana-5.4.2-windows-x86\\bin\>kibana fs.js:641 return binding.open(pathModule.\_makeLong(path), stringToFlags(flags), mode); …

---

## [Indexed Shape with multiple circles in one document](https://discuss.elastic.co/t/indexed-shape-with-multiple-circles-in-one-document/84168)

<div class="topic-metadata">

**Author:** [@Rory](https://discuss.elastic.co/u/Rory)\
**Replies:** 7\
**Last updated:** [May 8, 2017, 7:50pm UTC](https://discuss.elastic.co/t/indexed-shape-with-multiple-circles-in-one-document/84168 "2017-05-08T19:50:07Z")

</div>

Hi, I am trying to store multiple circles as part of one document to be used inside an Indexed Shape query. Can someone point me to the right documentation for how to create as many as 100 circle as part of one documen…

---

## [Integration with LDAP](https://discuss.elastic.co/t/integration-with-ldap/1651)

<div class="topic-metadata">

**Author:** [@Raman\_Saini](https://discuss.elastic.co/u/Raman_Saini)\
**Replies:** 1\
**Last updated:** [June 1, 2015, 3:55pm UTC](https://discuss.elastic.co/t/integration-with-ldap/1651 "2015-06-01T15:55:42Z")

</div>

Hi, Can someone let me know if we can integrate it with LDAP or Access Manager for AuthN/AuthZ. Regards, Raman

---

## [Mapper\_parsing\_exception when trying to append object to array](https://discuss.elastic.co/t/mapper-parsing-exception-when-trying-to-append-object-to-array/279071)

<div class="topic-metadata">

**Author:** [@sandbender](https://discuss.elastic.co/u/sandbender)\
**Replies:** 5\
**Last updated:** [July 21, 2021, 9:55am UTC](https://discuss.elastic.co/t/mapper-parsing-exception-when-trying-to-append-object-to-array/279071 "2021-07-21T09:55:25Z")

</div>

Hello, I'm having trouble to append objects resulting from an enrich processor to a field, so that I'm ending up with an array of objects. This question seems to have been asked a lot but still I couldn't make it work s…

---

## [Template mapping not being applied](https://discuss.elastic.co/t/template-mapping-not-being-applied/269848)

<div class="topic-metadata">

**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\
**Replies:** 5\
**Last updated:** [April 19, 2021, 7:41am UTC](https://discuss.elastic.co/t/template-mapping-not-being-applied/269848 "2021-04-19T07:41:56Z")

</div>

Hello I am currently setting a mapping in my template but it seems to not be working. My work flow is basically Data -\> Logstash -\> Elasticsearch In Logstash, I do NOT set a template SO it gets the default, which is …

---

## [Search Result](https://discuss.elastic.co/t/search-result/38852)

<div class="topic-metadata">

**Author:** [@aungzawthan](https://discuss.elastic.co/u/aungzawthan)\
**Replies:** 5\
**Last updated:** [January 12, 2016, 3:42pm UTC](https://discuss.elastic.co/t/search-result/38852 "2016-01-12T15:42:30Z")

</div>

Dear All Experts, I am new to ElasticSearch. So, I am facing one problem now. I want to search with keyword 'IT' e.g 'IT manager' , but I don't want to see 'it' - e.g 'it is a car'. How can I s…

---

## [Restore kibana index](https://discuss.elastic.co/t/restore-kibana-index/162806)

<div class="topic-metadata">

**Author:** [@Ludovic9](https://discuss.elastic.co/u/Ludovic9)\
**Replies:** 1\
**Last updated:** [January 3, 2019, 11:54pm UTC](https://discuss.elastic.co/t/restore-kibana-index/162806 "2019-01-03T23:54:24Z")

</div>

Hello, I would like to perfom a restore of my production environnment in my test environnment. I have two clusters, they share the same folder for the snapshot. On production, I do a snapshot of my indices specially .…

---

## [Monitor running processes and their current state using a heat map](https://discuss.elastic.co/t/monitor-running-processes-and-their-current-state-using-a-heat-map/131276)

<div class="topic-metadata">

**Author:** [@joakim\_berg](https://discuss.elastic.co/u/joakim_berg)\
**Replies:** 1\
**Last updated:** [May 10, 2018, 9:03pm UTC](https://discuss.elastic.co/t/monitor-running-processes-and-their-current-state-using-a-heat-map/131276 "2018-05-10T21:03:35Z")

</div>

Hi, Im using a heat map visualization to show if a a set of specific processes are running and their current state "sleep" or "running". This scales fairly well and I can see if these 4-5 processes are running on 10-20…

---

## [ElasticSearch Write TPS?](https://discuss.elastic.co/t/elasticsearch-write-tps/121676)

<div class="topic-metadata">

**Author:** [@titan1978](https://discuss.elastic.co/u/titan1978)\
**Replies:** 1\
**Last updated:** [February 27, 2018, 2:32pm UTC](https://discuss.elastic.co/t/elasticsearch-write-tps/121676 "2018-02-27T14:32:43Z")

</div>

Hello : I have an upcoming requirement wherein I need to bulk upload to Elasticsearch at a massive scale. While I've seen instances of people claiming million writes per sec is supported, I couldnt find a resource on how…

---

## [Aggregation - Filter by Count](https://discuss.elastic.co/t/aggregation-filter-by-count/37441)

<div class="topic-metadata">

**Author:** [@inzanez](https://discuss.elastic.co/u/inzanez)\
**Replies:** 1\
**Last updated:** [December 17, 2015, 9:03am UTC](https://discuss.elastic.co/t/aggregation-filter-by-count/37441 "2015-12-17T09:03:09Z")

</div>

Hi I'm just doing some aggregation queries on logdata I've collected with elasticsearch. What I would love to do is something like "get a distinct count of 'xxx' but only if distinct\_count(xxx) is greater than 20" for …

---

## [Multisearch request with aggregations](https://discuss.elastic.co/t/multisearch-request-with-aggregations/28978)

<div class="topic-metadata">

**Author:** [@esap](https://discuss.elastic.co/u/esap)\
**Replies:** 1\
**Last updated:** [September 10, 2015, 4:04pm UTC](https://discuss.elastic.co/t/multisearch-request-with-aggregations/28978 "2015-09-10T16:04:06Z")

</div>

Hi, When I perform a single search request with aggregations it works fine. But when I try to perform a multisearch request, aggregations don't seem to work. Isn't it supposed to? Below is my code, am I doing somethi…

---

## [Eland: How to access and filter nested fields in a DataFrame?](https://discuss.elastic.co/t/eland-how-to-access-and-filter-nested-fields-in-a-dataframe/292672)

<div class="topic-metadata">

**Author:** [@Paddyns](https://discuss.elastic.co/u/Paddyns)\
**Replies:** 2\
**Last updated:** [January 4, 2022, 12:10pm UTC](https://discuss.elastic.co/t/eland-how-to-access-and-filter-nested-fields-in-a-dataframe/292672 "2022-01-04T12:10:20Z")

</div>

Hi, I'm trying to use the examples from the ELAND docs e.g. this filtering example from github df\[(df.Carrier=="Kibana Airlines") & (df.AvgTicketPrice \> 900.0) & (df.Cancelled == True)\].head() But the fields I have al…

---

## [The time zone of the time stamp is incorrect](https://discuss.elastic.co/t/the-time-zone-of-the-time-stamp-is-incorrect/252081)

<div class="topic-metadata">

**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Replies:** 2\
**Last updated:** [October 14, 2020, 9:24pm UTC](https://discuss.elastic.co/t/the-time-zone-of-the-time-stamp-is-incorrect/252081 "2020-10-14T21:24:14Z")

</div>

I have a problem with the time stamp, I have the correct date, but the time is wrong, I have like 5 hours in advance, the date is correct but I do not know why I have another time of execution, I put the time zone but it…

---

## [Cause of use\_field\_mapping warning?](https://discuss.elastic.co/t/cause-of-use-field-mapping-warning/204828)

<div class="topic-metadata">

**Author:** [@tomhe](https://discuss.elastic.co/u/tomhe)\
**Replies:** 2\
**Last updated:** [October 28, 2019, 11:49am UTC](https://discuss.elastic.co/t/cause-of-use-field-mapping-warning/204828 "2019-10-28T11:49:19Z")

</div>

Regarding the question about use\_field\_mapping warnings in the linked post above: "\[use\_field\_mapping\] is a special format that was only used to ease the transition to 7.x. It has become the default and shouldn't be s…

---

## [Logstash plugin installation issue- unable to download data](https://discuss.elastic.co/t/logstash-plugin-installation-issue-unable-to-download-data/181105)

<div class="topic-metadata">

**Author:** [@sahere37](https://discuss.elastic.co/u/sahere37)\
**Replies:** 2\
**Last updated:** [May 15, 2019, 9:28am UTC](https://discuss.elastic.co/t/logstash-plugin-installation-issue-unable-to-download-data/181105 "2019-05-15T09:28:22Z")

</div>

hi all I am using logstash version 6.6.0 on windows, and now I am interested of logstash plugin installation. for this purpose, i ran following command in CMD which gives me Error. C:\\logstash-6.6.0\\bin\>logstash-plugin…

---

## [Persistent Queue details](https://discuss.elastic.co/t/persistent-queue-details/143133)

<div class="topic-metadata">

**Author:** [@JST](https://discuss.elastic.co/u/JST)\
**Replies:** 2\
**Last updated:** [August 8, 2018, 12:26pm UTC](https://discuss.elastic.co/t/persistent-queue-details/143133 "2018-08-08T12:26:50Z")

</div>

All, I have the following setup: \[tcp, http, file, udp\] ---\> logstash ---\> \[custom output plugin\] And a few questions on persistent queues. As per the limitions do the tcp and udp inputs enter the persistent queue or…

---

## [Similar text search](https://discuss.elastic.co/t/similar-text-search/119211)

<div class="topic-metadata">

**Author:** [@GrigoryPtashko](https://discuss.elastic.co/u/GrigoryPtashko)\
**Replies:** 2\
**Last updated:** [February 9, 2018, 11:50am UTC](https://discuss.elastic.co/t/similar-text-search/119211 "2018-02-09T11:50:38Z")

</div>

Hello. I have a database of text objects where some of them are a variant of some others in a certain level of similarity. Specifically, these are news posts where some pieces of news are just slightly modified clones o…

---

## [GCS Repository creation Issue](https://discuss.elastic.co/t/gcs-repository-creation-issue/109070)

<div class="topic-metadata">

**Author:** [@Hanish\_Bansal](https://discuss.elastic.co/u/Hanish_Bansal)\
**Replies:** 2\
**Last updated:** [November 25, 2017, 2:28am UTC](https://discuss.elastic.co/t/gcs-repository-creation-issue/109070 "2017-11-25T02:28:46Z")

</div>

Hi, We have recently upgraded our ES version from 5.6 to 6.0. After that we are facing issue in taking snapshot of data. In 6.0 ES, service.account option from repository has been removed so we need to add authenticat…

---

## [Multiple field\_value\_factors in function\_score?](https://discuss.elastic.co/t/multiple-field-value-factors-in-function-score/21971)

<div class="topic-metadata">

**Author:** [@AS1](https://discuss.elastic.co/u/AS1)\
**Replies:** 2\
**Last updated:** [April 2, 2017, 5:46am UTC](https://discuss.elastic.co/t/multiple-field-value-factors-in-function-score/21971 "2017-04-02T05:46:51Z")

</div>

Hello, From the docs it's not clear if and how I can have multiple field\_value\_factors inside a function\_score. I would like to boost by ratingCount and by averageRating. I was expecting something like this: …

---

## [Joining data from multiple types in visualization](https://discuss.elastic.co/t/joining-data-from-multiple-types-in-visualization/75968)

<div class="topic-metadata">

**Author:** [@Reno](https://discuss.elastic.co/u/Reno)\
**Replies:** 2\
**Last updated:** [February 22, 2017, 9:56pm UTC](https://discuss.elastic.co/t/joining-data-from-multiple-types-in-visualization/75968 "2017-02-22T21:56:19Z")

</div>

Hi, Currently I'm using JDBC and logstash to import my SQL database into Elasticsearch. I've got three tables, which I'm putting under the same index and using a different type for each table. For ease of explanation, t…

---

## [Deleted index docs coming back automatically](https://discuss.elastic.co/t/deleted-index-docs-coming-back-automatically/74941)

<div class="topic-metadata">

**Author:** [@masud](https://discuss.elastic.co/u/masud)\
**Replies:** 2\
**Last updated:** [February 14, 2017, 5:14pm UTC](https://discuss.elastic.co/t/deleted-index-docs-coming-back-automatically/74941 "2017-02-14T17:14:06Z")

</div>

Hi, I'm using elasticsearch 1.3. I'm trying to delete older docs with delete by query java api. I'm able to delete, its showing deleted and I'm seeing no docs in kibana. But after few seconds its automatically coming bac…

---

## [Problem with exec output](https://discuss.elastic.co/t/problem-with-exec-output/49072)

<div class="topic-metadata">

**Author:** [@marcmga](https://discuss.elastic.co/u/marcmga)\
**Replies:** 2\
**Last updated:** [May 9, 2016, 7:25am UTC](https://discuss.elastic.co/t/problem-with-exec-output/49072 "2016-05-09T07:25:25Z")

</div>

Hello, I'm having problems when using exec output. What i'm trying is exec a command. This command is aws cli (which is installed). However i get no errors when logstash executes the command. I think it deals with th…

---

## [Native log reader?](https://discuss.elastic.co/t/native-log-reader/34495)

<div class="topic-metadata">

**Author:** [@ablanchet](https://discuss.elastic.co/u/ablanchet)\
**Replies:** 2\
**Last updated:** [November 14, 2015, 7:42pm UTC](https://discuss.elastic.co/t/native-log-reader/34495 "2015-11-14T19:42:11Z")

</div>

Hi guys, I'm using Logstash, Elasticsearch and Kibana to process, store and visualize my logs. My setup works fine but now I'm looking for a new tool : before ELK is was used to read my logs on Notepad++ or Glogg (on …

[Previous page](https://discuss.elastic.co/top.md?page=1325&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1327&per_page=50&period=all)
