# Top

**URL:** https://discuss.elastic.co/top.md?page=1356&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1357

---

## [\[ERROR\] Cannot race. Fatal track or load generator indication 	Child Aborted](https://discuss.elastic.co/t/error-cannot-race-fatal-track-or-load-generator-indication-child-aborted/144267)

<div class="topic-metadata">

**Author:** [@rui\_dong](https://discuss.elastic.co/u/rui_dong)\
**Replies:** 1\
**Last updated:** [August 14, 2018, 7:45am UTC](https://discuss.elastic.co/t/error-cannot-race-fatal-track-or-load-generator-indication-child-aborted/144267 "2018-08-14T07:45:20Z")

</div>

I am trying to put max load on my cluster with distributed load-drivers. I start “benchmark coordinator” on 10.3.75.152 esrally race --pipeline=benchmark-only --target-hosts=x.x.x.x:9200,y.y.y.y:9200,z,z,z,z:9200 --loa…

---

## [Ignoring Newline (\\n) within double quotes for CSV Filter](https://discuss.elastic.co/t/ignoring-newline-n-within-double-quotes-for-csv-filter/27700)

<div class="topic-metadata">

**Author:** [@umangjain](https://discuss.elastic.co/u/umangjain)\
**Replies:** 1\
**Last updated:** [February 6, 2017, 3:23pm UTC](https://discuss.elastic.co/t/ignoring-newline-n-within-double-quotes-for-csv-filter/27700 "2017-02-06T15:23:26Z")

</div>

Hello, I have a CSV file and am trying to read it using my logstash configuration. Everything works great for each row. It doesn't work if we have newline character (\\n) in a value surrounded by double quotes. Exampl…

---

## [Codec rubydebug output not showing in 'docker logs' output](https://discuss.elastic.co/t/codec-rubydebug-output-not-showing-in-docker-logs-output/47799)

<div class="topic-metadata">

**Author:** [@Alex\_Harvey](https://discuss.elastic.co/u/Alex_Harvey)\
**Replies:** 1\
**Last updated:** [May 13, 2016, 11:32am UTC](https://discuss.elastic.co/t/codec-rubydebug-output-not-showing-in-docker-logs-output/47799 "2016-05-13T11:32:21Z")

</div>

I am trying to debug the official Logstash Docker container. All available documentation I can find seems to imply that if I add an output stdout { codec =\> rubydebug }, I should be able to see this in docker logs. It'…

---

## [Marvel not showing data](https://discuss.elastic.co/t/marvel-not-showing-data/31918)

<div class="topic-metadata">

**Author:** [@willyaranda](https://discuss.elastic.co/u/willyaranda)\
**Replies:** 1\
**Last updated:** [December 16, 2015, 11:07am UTC](https://discuss.elastic.co/t/marvel-not-showing-data/31918 "2015-12-16T11:07:34Z")

</div>

Hi there! I just installed Marvel in my cluster, consisting in 3 data nodes and 3 masters. Data from Marvel is flowing to the system, as I can see the marvel index has around 700 documents, but when I open the interf…

---

## [Setup.template.name not working with ILM (?)](https://discuss.elastic.co/t/setup-template-name-not-working-with-ilm/212562)

<div class="topic-metadata">

**Author:** [@john\_eapen](https://discuss.elastic.co/u/john_eapen)\
**Replies:** 1\
**Last updated:** [December 20, 2019, 2:51am UTC](https://discuss.elastic.co/t/setup-template-name-not-working-with-ilm/212562 "2019-12-20T02:51:10Z")

</div>

Hi, I have slightly confused about some of the posts I have seen on this. Does custom template not work when ILM is enabled in filebeat ? (Needless to say,I need both these features.) I hv specified my ES index as: …

---

## [Kibana problem visualize scripted fields](https://discuss.elastic.co/t/kibana-problem-visualize-scripted-fields/322934)

<div class="topic-metadata">

**Author:** [@Anonym123](https://discuss.elastic.co/u/Anonym123)\
**Replies:** 6\
**Last updated:** [January 12, 2023, 2:01pm UTC](https://discuss.elastic.co/t/kibana-problem-visualize-scripted-fields/322934 "2023-01-12T14:01:27Z")

</div>

Hello im trying to convert an integer field like "1,676,274,668" to an Date/Datetime field and visualize it afterwards with Kibana. I use a scripted field which can be seen on the next picture. Here everything look…

---

## [Monitoring UI can't find cluster data - 2h delay](https://discuss.elastic.co/t/monitoring-ui-cant-find-cluster-data-2h-delay/236055)

<div class="topic-metadata">

**Author:** [@rsustic](https://discuss.elastic.co/u/rsustic)\
**Replies:** 6\
**Last updated:** [June 29, 2020, 1:10pm UTC](https://discuss.elastic.co/t/monitoring-ui-cant-find-cluster-data-2h-delay/236055 "2020-06-29T13:10:24Z")

</div>

Hello guys, I am using ELK v6.8.5 and I recently came upon a problem with the Monitoring UI. It work just fine when I set the time to Today as seen in the image below. However, when I change the time to a smaller pe…

---

## [Change column headings for saved search or replicate in data table](https://discuss.elastic.co/t/change-column-headings-for-saved-search-or-replicate-in-data-table/274817)

<div class="topic-metadata">

**Author:** [@jteare](https://discuss.elastic.co/u/jteare)\
**Replies:** 2\
**Last updated:** [June 8, 2021, 9:09pm UTC](https://discuss.elastic.co/t/change-column-headings-for-saved-search-or-replicate-in-data-table/274817 "2021-06-08T21:09:16Z")

</div>

Hi, I know this question has been asked before and I have read and attempted to reproduce the accepted answers but can't get any to work. I am using Kibana v 7.11.2. I would simply like to add a saved search (with some …

---

## [Watcher: Password changes to ::es\_redacted::](https://discuss.elastic.co/t/watcher-password-changes-to/272628)

<div class="topic-metadata">

**Author:** [@Rohan-boogeyman](https://discuss.elastic.co/u/Rohan-boogeyman)\
**Replies:** 2\
**Last updated:** [May 11, 2021, 3:56am UTC](https://discuss.elastic.co/t/watcher-password-changes-to/272628 "2021-05-11T03:56:51Z")

</div>

Hello, Hope you all are doing great! Thought I'd bring this concern which I've been experiencing - When I add auth category in actions of watcher - after I hit save watch button password changes to "::es\_redacted::" W…

---

## [Filebeat 7.3.2 Cisco Module Parsing issue for ASA Syslog rfc3164](https://discuss.elastic.co/t/filebeat-7-3-2-cisco-module-parsing-issue-for-asa-syslog-rfc3164/204554)

<div class="topic-metadata">

**Author:** [@thurston](https://discuss.elastic.co/u/thurston)\
**Replies:** 2\
**Last updated:** [October 24, 2019, 8:46pm UTC](https://discuss.elastic.co/t/filebeat-7-3-2-cisco-module-parsing-issue-for-asa-syslog-rfc3164/204554 "2019-10-24T20:46:53Z")

</div>

Getting Error from Filebeat 7.3.2 related to CISCO module. Sending Cisco ASA logs to Filebeat / Cisco module. I have read several threads here on elastic, stackoverflow, and other random sites. Not finding a clear sol…

---

## [Get specific fields from csv file](https://discuss.elastic.co/t/get-specific-fields-from-csv-file/134200)

<div class="topic-metadata">

**Author:** [@kingprakatheesh](https://discuss.elastic.co/u/kingprakatheesh)\
**Replies:** 2\
**Last updated:** [June 1, 2018, 12:06pm UTC](https://discuss.elastic.co/t/get-specific-fields-from-csv-file/134200 "2018-06-01T12:06:56Z")

</div>

i am haing a csv file having 100 fields. i want to parse only 5 fields so i used Ruby filter and framed my conf. Upon executing getting {} in all lines instead of fields Conf file input{ file { path =\> path\_to\_file …

---

## [How to load index templates and dashboards from single place in beats 6.x](https://discuss.elastic.co/t/how-to-load-index-templates-and-dashboards-from-single-place-in-beats-6-x/100954)

<div class="topic-metadata">

**Author:** [@vb4t](https://discuss.elastic.co/u/vb4t)\
**Replies:** 2\
**Last updated:** [October 2, 2017, 5:42am UTC](https://discuss.elastic.co/t/how-to-load-index-templates-and-dashboards-from-single-place-in-beats-6-x/100954 "2017-10-02T05:42:42Z")

</div>

Hello. As elastic stack 6.0 will reach its GA soon I would like to know the best way to automatically load index templates and dashboards for all the beats from the single server. Beats 6.x changed the way index templa…

---

## [Optimize search speed / resource usage by writing good queries?](https://discuss.elastic.co/t/optimize-search-speed-resource-usage-by-writing-good-queries/78695)

<div class="topic-metadata">

**Author:** [@asp](https://discuss.elastic.co/u/asp)\
**Replies:** 2\
**Last updated:** [March 16, 2017, 11:45am UTC](https://discuss.elastic.co/t/optimize-search-speed-resource-usage-by-writing-good-queries/78695 "2017-03-16T11:45:24Z")

</div>

Hi, I would like to increase my the search speed in kibana. Since I am not that familar with lucene indexes / elasticsearch yet, I would like to ask you for your opinion. Searching is real easy via kibana. Just type …

---

## [Matching a word with filebeat multiline](https://discuss.elastic.co/t/matching-a-word-with-filebeat-multiline/62417)

<div class="topic-metadata">

**Author:** [@latiperneni](https://discuss.elastic.co/u/latiperneni)\
**Replies:** 2\
**Last updated:** [October 7, 2016, 12:07pm UTC](https://discuss.elastic.co/t/matching-a-word-with-filebeat-multiline/62417 "2016-10-07T12:07:39Z")

</div>

I am using Filebeat multiline pattern in filebeat.yml that is taking its input from a single file that has the following line indicating the start of a request 2016-10-06 09:40:01.775 DEBUG 10454 --- \[XNIO-2 task-9\] c.…

---

## [Elastic Edge\_Ngram with Whitespace Word Breaker](https://discuss.elastic.co/t/elastic-edge-ngram-with-whitespace-word-breaker/225280)

<div class="topic-metadata">

**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\
**Replies:** 3\
**Last updated:** [March 31, 2020, 10:14am UTC](https://discuss.elastic.co/t/elastic-edge-ngram-with-whitespace-word-breaker/225280 "2020-03-31T10:14:51Z")

</div>

We want our edge\_ngram search to only to word break on whitespace. If we use: "tokenizer": { "token\_chars": \["letter", "digit", "punctuation", "symbol"\], "min\_gram": "2", "type": "edge\_ngram…

---

## [How to enable SSL/TLS on ES 5.6 version](https://discuss.elastic.co/t/how-to-enable-ssl-tls-on-es-5-6-version/168664)

<div class="topic-metadata">

**Author:** [@prabhakar\_talari](https://discuss.elastic.co/u/prabhakar_talari)\
**Replies:** 3\
**Last updated:** [February 16, 2019, 6:05am UTC](https://discuss.elastic.co/t/how-to-enable-ssl-tls-on-es-5-6-version/168664 "2019-02-16T06:05:36Z")

</div>

Hi Team, Could any one suggest how to enable SSL/TLS on ES 5.6 version and gone through the documentation but confusion. If any one done already please provide steps to perform this. Thanks

---

## [Certificates between Filebeat and Kibana for Filebeat to do setup.dashboards.enabled: true](https://discuss.elastic.co/t/certificates-between-filebeat-and-kibana-for-filebeat-to-do-setup-dashboards-enabled-true/161904)

<div class="topic-metadata">

**Author:** [@RussellBateman](https://discuss.elastic.co/u/RussellBateman)\
**Replies:** 3\
**Last updated:** [January 4, 2019, 2:02pm UTC](https://discuss.elastic.co/t/certificates-between-filebeat-and-kibana-for-filebeat-to-do-setup-dashboards-enabled-true/161904 "2019-01-04T14:02:54Z")

</div>

I'm trying to enable dashboards in Kibana and, in the Filebeat log, I am getting: ERROR instance/beat.go:743 Exiting: Error importing Kibana dashboards: \\ fail to create the Kibana loader: \\ Error creating Kiban…

---

## [How to do i run 3 nodes in 2 different machines?](https://discuss.elastic.co/t/how-to-do-i-run-3-nodes-in-2-different-machines/54569)

<div class="topic-metadata">

**Author:** [@jeevan\_jeevanreddy](https://discuss.elastic.co/u/jeevan_jeevanreddy)\
**Replies:** 3\
**Last updated:** [July 4, 2016, 8:35am UTC](https://discuss.elastic.co/t/how-to-do-i-run-3-nodes-in-2-different-machines/54569 "2016-07-04T08:35:46Z")

</div>

i tried clustering 3 nodes (2 on one machine) .but i'm getting BindTransportException. can anyone specify the configurations ?

---

## [Scripted field in Kibana](https://discuss.elastic.co/t/scripted-field-in-kibana/33238)

<div class="topic-metadata">

**Author:** [@rabeetwaqar](https://discuss.elastic.co/u/rabeetwaqar)\
**Replies:** 3\
**Last updated:** [October 29, 2015, 12:26pm UTC](https://discuss.elastic.co/t/scripted-field-in-kibana/33238 "2015-10-29T12:26:10Z")

</div>

Hi, I have a mySQL query : SELECT field1, field2, COUNT(field3) AS myfield FROM some\_table How will i create a scripted field as above in kibana? Thank you

---

## [Writing Kafka message headers using Logstash's Kafka output plugin](https://discuss.elastic.co/t/writing-kafka-message-headers-using-logstashs-kafka-output-plugin/268625)

<div class="topic-metadata">

**Author:** [@vigneshr35](https://discuss.elastic.co/u/vigneshr35)\
**Replies:** 0\
**Last updated:** [March 29, 2021, 5:25am UTC](https://discuss.elastic.co/t/writing-kafka-message-headers-using-logstashs-kafka-output-plugin/268625 "2021-03-29T05:25:04Z")

</div>

Hi All, I am looking to use Logstash's Kafka output plugin. This plugin allows us to post message to Kafka topic, but I don't see any configuration in the documentation that allows to post kafka message headers. Thank …

---

## [UpdateByQuery script update - when does ES update document?](https://discuss.elastic.co/t/updatebyquery-script-update-when-does-es-update-document/220642)

<div class="topic-metadata">

**Author:** [@MattJones](https://discuss.elastic.co/u/MattJones)\
**Replies:** 0\
**Last updated:** [February 24, 2020, 12:08pm UTC](https://discuss.elastic.co/t/updatebyquery-script-update-when-does-es-update-document/220642 "2020-02-24T12:08:38Z")

</div>

For an index with the following mapping: { "item\_code": { "type": "keyword", "index": true, }, "prices": { "type": "nested", "dynamic": false, "properties": { "pricing\_hash": { "t…

---

## [Plans for Containers](https://discuss.elastic.co/t/plans-for-containers/71451)

<div class="topic-metadata">

**Author:** [@mightyschwartz](https://discuss.elastic.co/u/mightyschwartz)\
**Replies:** 0\
**Last updated:** [January 12, 2017, 11:35pm UTC](https://discuss.elastic.co/t/plans-for-containers/71451 "2017-01-12T23:35:13Z")

</div>

I currently use Docker on Linux to spawn/manage an elastic cluster. While this works great in linux, the docker for windows variant will of course not run on a VM of Windows. Now looking to Windows 2016, we have containe…

---

## [Logstash - how to configure CSV filter for joining 2 CSV files based on a common field (mapping - one to many data) and ingest the data into single index](https://discuss.elastic.co/t/logstash-how-to-configure-csv-filter-for-joining-2-csv-files-based-on-a-common-field-mapping-one-to-many-data-and-ingest-the-data-into-single-index/259994)

<div class="topic-metadata">

**Author:** [@Jenisha\_Ramanathan](https://discuss.elastic.co/u/Jenisha_Ramanathan)\
**Replies:** 5\
**Last updated:** [January 6, 2021, 4:51pm UTC](https://discuss.elastic.co/t/logstash-how-to-configure-csv-filter-for-joining-2-csv-files-based-on-a-common-field-mapping-one-to-many-data-and-ingest-the-data-into-single-index/259994 "2021-01-06T16:51:21Z")

</div>

Hi Team, I have 2 CVS files which contains one similar column header say "faculty\_id", For the rows which has same "faculty\_id" value, I want the below steps to be done Join/combine the data from both the csv files i…

---

## [Auditd events are not captured for centos](https://discuss.elastic.co/t/auditd-events-are-not-captured-for-centos/247215)

<div class="topic-metadata">

**Author:** [@ajesh](https://discuss.elastic.co/u/ajesh)\
**Replies:** 5\
**Last updated:** [October 4, 2020, 5:52pm UTC](https://discuss.elastic.co/t/auditd-events-are-not-captured-for-centos/247215 "2020-10-04T17:52:00Z")

</div>

Hi There, We are running latest version of elastic stack 7.9. One issues we observed is auditd events are not captured for Centos 7 operating systems. Audit rules are already enabled and we see the events getting captur…

---

## [Can activemq be used as a broker?](https://discuss.elastic.co/t/can-activemq-be-used-as-a-broker/123068)

<div class="topic-metadata">

**Author:** [@asp](https://discuss.elastic.co/u/asp)\
**Replies:** 5\
**Last updated:** [March 12, 2018, 10:24am UTC](https://discuss.elastic.co/t/can-activemq-be-used-as-a-broker/123068 "2018-03-12T10:24:57Z")

</div>

Hi, is it possible to ship data from filebeat to Active MQ? ActiveMQ is already used in our system environment and we have some knowledge about it. Kafka as broker would be new terrain for us, so I am interested if we…

---

## [Upgrade from ES 1.7 to ES 2.4 leads to loss of data](https://discuss.elastic.co/t/upgrade-from-es-1-7-to-es-2-4-leads-to-loss-of-data/88225)

<div class="topic-metadata">

**Author:** [@mosiddi](https://discuss.elastic.co/u/mosiddi)\
**Replies:** 5\
**Last updated:** [June 6, 2017, 3:37am UTC](https://discuss.elastic.co/t/upgrade-from-es-1-7-to-es-2-4-leads-to-loss-of-data/88225 "2017-06-06T03:37:31Z")

</div>

Hi, We have moved from ES 1.7 to ES 2.4 over a period of last 1 year in all our ES clusters. What we observed in some of our 1-node cluster is while upgrading from ES 1.7 to ES 2.4, all indices and aliases are gone. The …

---

## [Kibana Dashboard PDF and PNG reporting options missing](https://discuss.elastic.co/t/kibana-dashboard-pdf-and-png-reporting-options-missing/290407)

<div class="topic-metadata">

**Author:** [@Petteri](https://discuss.elastic.co/u/Petteri)\
**Replies:** 4\
**Last updated:** [December 1, 2021, 6:15am UTC](https://discuss.elastic.co/t/kibana-dashboard-pdf-and-png-reporting-options-missing/290407 "2021-12-01T06:15:17Z")

</div>

Hi! We just updated our Elastic to 7.14 version and enabled reporting for users by this guide: Configure reporting in Kibana | Kibana Guide \[7.14\] | Elastic After update the PDF and PNG reporting options are not availa…

---

## [Data Stream data retrieval and compression](https://discuss.elastic.co/t/data-stream-data-retrieval-and-compression/276272)

<div class="topic-metadata">

**Author:** [@prithvirajsivarajan](https://discuss.elastic.co/u/prithvirajsivarajan)\
**Replies:** 4\
**Last updated:** [June 20, 2021, 11:32pm UTC](https://discuss.elastic.co/t/data-stream-data-retrieval-and-compression/276272 "2021-06-20T23:32:54Z")

</div>

I'm working on a data stream. I have created a test ILM policy. Have a couple of question regarding that. Is there a huge difference time lag while retrieving data from hot, warm, cold phase indices. I tried inserting…

---

## [Is there a cloning engine feature?](https://discuss.elastic.co/t/is-there-a-cloning-engine-feature/249995)

<div class="topic-metadata">

**Author:** [@luberti](https://discuss.elastic.co/u/luberti)\
**Replies:** 4\
**Last updated:** [October 15, 2020, 8:59am UTC](https://discuss.elastic.co/t/is-there-a-cloning-engine-feature/249995 "2020-10-15T08:59:55Z")

</div>

Hello everyone, I recently created multiple engines to host our different environments. I have 3 engines, one for each environment : Production, Staging and Development. I wanted to know if we had an option to copy / …

---

## [Kibana usage monitoring](https://discuss.elastic.co/t/kibana-usage-monitoring/239485)

<div class="topic-metadata">

**Author:** [@Thomas74](https://discuss.elastic.co/u/Thomas74)\
**Replies:** 4\
**Last updated:** [July 1, 2020, 3:03pm UTC](https://discuss.elastic.co/t/kibana-usage-monitoring/239485 "2020-07-01T15:03:51Z")

</div>

Hi, Is something exist into Kibana to get users usage ? I mean : Authentication success/failure by users, role and by teams Dashboard consulted/created/modified Best regards, Thomas R.

---

## [Filebeat default dashboards: no results found](https://discuss.elastic.co/t/filebeat-default-dashboards-no-results-found/209317)

<div class="topic-metadata">

**Author:** [@Thijs\_Kunnen](https://discuss.elastic.co/u/Thijs_Kunnen)\
**Replies:** 4\
**Last updated:** [November 25, 2019, 2:00pm UTC](https://discuss.elastic.co/t/filebeat-default-dashboards-no-results-found/209317 "2019-11-25T14:00:23Z")

</div>

Hi, I just finished installing and configuring Logstash, Elasticsearch, Kibana and Filebeat. After having a lot of trouble receiving my Logstash data in Kibana, I decided to stop Logstash and switch over to Filebeat. No…

---

## [JVM HEAP usage over 85% during snapshots](https://discuss.elastic.co/t/jvm-heap-usage-over-85-during-snapshots/194568)

<div class="topic-metadata">

**Author:** [@cyril.r](https://discuss.elastic.co/u/cyril.r)\
**Replies:** 4\
**Last updated:** [August 27, 2019, 7:28am UTC](https://discuss.elastic.co/t/jvm-heap-usage-over-85-during-snapshots/194568 "2019-08-27T07:28:00Z")

</div>

Hello :slight\_smile: I have an issue with elasticsearch and HEAP usage during snapshots. My cluster have 7 nodes (2cpu & 7.5G of RAM per node, local SSD storage), about 220 millions of documents for a total size of 377…

---

## [KV plugin filter not working](https://discuss.elastic.co/t/kv-plugin-filter-not-working/133704)

<div class="topic-metadata">

**Author:** [@br14nb0](https://discuss.elastic.co/u/br14nb0)\
**Replies:** 4\
**Last updated:** [May 30, 2018, 8:43am UTC](https://discuss.elastic.co/t/kv-plugin-filter-not-working/133704 "2018-05-30T08:43:57Z")

</div>

This is my config filter grok { match =\> { "message" =\> "\<%{INT:number}\>%{SYSLOGTIMESTAMP:timestamp}%{SPACE}%{NOTSPACE:app}%{SPACE}%{NOTSPACE:logsource}\[%{WORD:status}\]%{SPACE}%{INT:eventid}%{SPACE}%{GREEDYDATA:mess}.%…

---

## [My log has the timestamp splited i need to join various fields into a timestamp unique field](https://discuss.elastic.co/t/my-log-has-the-timestamp-splited-i-need-to-join-various-fields-into-a-timestamp-unique-field/94247)

<div class="topic-metadata">

**Author:** [@marcelo](https://discuss.elastic.co/u/marcelo)\
**Replies:** 4\
**Last updated:** [July 26, 2017, 12:45pm UTC](https://discuss.elastic.co/t/my-log-has-the-timestamp-splited-i-need-to-join-various-fields-into-a-timestamp-unique-field/94247 "2017-07-26T12:45:43Z")

</div>

Hi guys, In my application log the fields separated by character ";" ab929caa-1c44-4a1d-bf76-c43e7a5fa4ca;rf;POST;https://my.domain.com/system/list.seam;2017;07;20;11;56;25;586;4;328;172.18.98.33;ajp-internalserver.t…

---

## [Beat meta info how to show ip?](https://discuss.elastic.co/t/beat-meta-info-how-to-show-ip/42802)

<div class="topic-metadata">

**Author:** [@szcountryboy](https://discuss.elastic.co/u/szcountryboy)\
**Replies:** 4\
**Last updated:** [February 29, 2016, 5:48am UTC](https://discuss.elastic.co/t/beat-meta-info-how-to-show-ip/42802 "2016-02-29T05:48:17Z")

</div>

Elastic-2.2 version Every event sent to Logstash contains additional metadata for indexing and filtering: { ... "@metadata": { "beat": "", "type": "" } The beat-meta info : "@timestamp" =\> "…

---

## [Obtaining Tags from Tags](https://discuss.elastic.co/t/obtaining-tags-from-tags/31531)

<div class="topic-metadata">

**Author:** [@billy6](https://discuss.elastic.co/u/billy6)\
**Replies:** 4\
**Last updated:** [October 2, 2015, 2:49pm UTC](https://discuss.elastic.co/t/obtaining-tags-from-tags/31531 "2015-10-02T14:49:14Z")

</div>

Hello, I would like to Slipt a Tag in several parts. I mean, I have the Tag "Comment" = "\[Module12\] Statblablabla" I would like to divide it in other two Tags "Module" = Module12 and "Status" = Statblablabla. But with …

---

## [Mapping namespace problem](https://discuss.elastic.co/t/mapping-namespace-problem/3928)

<div class="topic-metadata">

**Author:** [@Simone\_Zaninello](https://discuss.elastic.co/u/Simone_Zaninello)\
**Replies:** 4\
**Last updated:** [February 17, 2011, 1:03am UTC](https://discuss.elastic.co/t/mapping-namespace-problem/3928 "2011-02-17T01:03:02Z")

</div>

Hi, I'm having the following problem: - Initial state I put two different mappings with a field named the same way into a single index. After that I indexed two documents one for each mapping. Consider …

---

## [How to change index pattern used by visualization/widget in kibana dashboard in kibana 7.17.9?](https://discuss.elastic.co/t/how-to-change-index-pattern-used-by-visualization-widget-in-kibana-dashboard-in-kibana-7-17-9/347080)

<div class="topic-metadata">

**Author:** [@Daemon1](https://discuss.elastic.co/u/Daemon1)\
**Replies:** 2\
**Last updated:** [November 16, 2023, 7:09pm UTC](https://discuss.elastic.co/t/how-to-change-index-pattern-used-by-visualization-widget-in-kibana-dashboard-in-kibana-7-17-9/347080 "2023-11-16T19:09:31Z")

</div>

Steps: click on All type\>\>\>Aggregation based\>\>\>data table\>\> select index pattern(index-pattern1) from the list(index-pattern1, index-pattern2, index-pattern3) save the widget. Now I want to change the index-pattern1 u…

---

## [Path.repo on ECK environment](https://discuss.elastic.co/t/path-repo-on-eck-environment/302255)

<div class="topic-metadata">

**Author:** [@Prabakar](https://discuss.elastic.co/u/Prabakar)\
**Replies:** 2\
**Last updated:** [April 13, 2022, 12:46pm UTC](https://discuss.elastic.co/t/path-repo-on-eck-environment/302255 "2022-04-13T12:46:54Z")

</div>

We set path.repo on YAML file like below. path: repo: - But we are unable to add this path into kibana--\> Snapshot --\> Register Repository, it throws below error Cannot register new repository \[test\] failed to cr…

---

## [Getting "\_groktimeout" error for a particular filter sometimes. Need help optimizing the filter](https://discuss.elastic.co/t/getting-groktimeout-error-for-a-particular-filter-sometimes-need-help-optimizing-the-filter/246342)

<div class="topic-metadata">

**Author:** [@saurabhc](https://discuss.elastic.co/u/saurabhc)\
**Replies:** 2\
**Last updated:** [August 26, 2020, 5:36am UTC](https://discuss.elastic.co/t/getting-groktimeout-error-for-a-particular-filter-sometimes-need-help-optimizing-the-filter/246342 "2020-08-26T05:36:04Z")

</div>

The particular line is a "multiline". Hence using "codec =\> multiline" to get the line and then applying grok filter to it. But sometimes when the particular line is having large content the parsing fails with "\_groktim…

---

## [One index to rule them all... or separate ones on a microservice architecture](https://discuss.elastic.co/t/one-index-to-rule-them-all-or-separate-ones-on-a-microservice-architecture/207192)

<div class="topic-metadata">

**Author:** [@nicolas.orbes](https://discuss.elastic.co/u/nicolas.orbes)\
**Replies:** 2\
**Last updated:** [November 11, 2019, 7:31pm UTC](https://discuss.elastic.co/t/one-index-to-rule-them-all-or-separate-ones-on-a-microservice-architecture/207192 "2019-11-11T19:31:19Z")

</div>

Hi guys! We are migrating our monolith into a new microservice architecture and want to start using ELK just from the beginning. We are using Spring Boot to create the microservices and logging using Logback with this …

---

## [How to choose size parameter when using partitioning](https://discuss.elastic.co/t/how-to-choose-size-parameter-when-using-partitioning/175031)

<div class="topic-metadata">

**Author:** [@Anindya\_Roy](https://discuss.elastic.co/u/Anindya_Roy)\
**Replies:** 2\
**Last updated:** [April 2, 2019, 8:36pm UTC](https://discuss.elastic.co/t/how-to-choose-size-parameter-when-using-partitioning/175031 "2019-04-02T20:36:37Z")

</div>

Hello, How should I choose the size parameter when using partitioning query ? E.g Suppose the aggregation query result returns 60K hits and say I use num\_partitions = 20, then is it correct to expect the total result …

---

## ['make clean' and 'permssion denied'](https://discuss.elastic.co/t/make-clean-and-permssion-denied/155578)

<div class="topic-metadata">

**Author:** [@sentient](https://discuss.elastic.co/u/sentient)\
**Replies:** 2\
**Last updated:** [November 6, 2018, 6:21pm UTC](https://discuss.elastic.co/t/make-clean-and-permssion-denied/155578 "2018-11-06T18:21:26Z")

</div>

I'm building a custom metric module. Running into some issues: 'make package' is currently failing on me. A rerun causes also causes permission issues: rm: cannot remove 'build/package/modules.d-darwin/golang\_push.ym…

---

## [Painless converts float to integer](https://discuss.elastic.co/t/painless-converts-float-to-integer/148414)

<div class="topic-metadata">

**Author:** [@Jerzy\_Stopa](https://discuss.elastic.co/u/Jerzy_Stopa)\
**Replies:** 2\
**Last updated:** [September 15, 2018, 9:16am UTC](https://discuss.elastic.co/t/painless-converts-float-to-integer/148414 "2018-09-15T09:16:35Z")

</div>

I have field 'payload.temperature\[c\]' in one of the indexes. I cannot use it in Timelion due to \[\] therefore I created simple scripted field Temp defined as follows:return doc\['payload.temperature\[c\]'\].value But instea…

---

## [Mots les plus utilisés dans un documents](https://discuss.elastic.co/t/mots-les-plus-utilises-dans-un-documents/107462)

<div class="topic-metadata">

**Author:** [@Astarion](https://discuss.elastic.co/u/Astarion)\
**Replies:** 2\
**Last updated:** [November 18, 2017, 9:55am UTC](https://discuss.elastic.co/t/mots-les-plus-utilises-dans-un-documents/107462 "2017-11-18T09:55:45Z")

</div>

Bonjour, Je souhaite récupérer les "mots clés" les plus présents dans un champs description d'un document, j'ai vu plusieurs façons de le faire mais aucune ne semble donner le résultat que j'espère... La solution qui s…

---

## [Finding gaps in event time](https://discuss.elastic.co/t/finding-gaps-in-event-time/84728)

<div class="topic-metadata">

**Author:** [@Arthur\_Francis](https://discuss.elastic.co/u/Arthur_Francis)\
**Replies:** 2\
**Last updated:** [May 8, 2017, 8:51am UTC](https://discuss.elastic.co/t/finding-gaps-in-event-time/84728 "2017-05-08T08:51:48Z")

</div>

Hello, I am feeding in some Apache request data into kibana for some analysis and have plotted some very useful stuff, but at the moment I am investigating an issue which I found and am trying to use Kibana to help me …

---

## [Async Replication and Multi DC](https://discuss.elastic.co/t/async-replication-and-multi-dc/22122)

<div class="topic-metadata">

**Author:** [@Parag\_Shah](https://discuss.elastic.co/u/Parag_Shah)\
**Replies:** 2\
**Last updated:** [February 12, 2015, 1:58am UTC](https://discuss.elastic.co/t/async-replication-and-multi-dc/22122 "2015-02-12T01:58:51Z")

</div>

Hi all, I am trying to setup async replication with a multi-dc setup. Here is my scenario: 1. I will have 3 nodes in each DC. For now, assume I have only 2 DCs. 2. I would like to use async replication, su…

---

## [Beats connection to elasticsearch](https://discuss.elastic.co/t/beats-connection-to-elasticsearch/309701)

<div class="topic-metadata">

**Author:** [@Amiya\_Pani](https://discuss.elastic.co/u/Amiya_Pani)\
**Replies:** 8\
**Last updated:** [July 20, 2022, 8:30am UTC](https://discuss.elastic.co/t/beats-connection-to-elasticsearch/309701 "2022-07-20T08:30:07Z")

</div>

I am trying to start a filebeat on docker to point the output to elasticsearch which is on same docker. While giving the command docker run docker.elastic.co/beats/filebeat:8.3.2 setup -E setup.kibana.host=192.168.0.109…

---

## [Elasticsearch shield relam problem](https://discuss.elastic.co/t/elasticsearch-shield-relam-problem/22688)

<div class="topic-metadata">

**Author:** [@Phani\_Nadiminti](https://discuss.elastic.co/u/Phani_Nadiminti)\
**Replies:** 8\
**Last updated:** [March 24, 2015, 5:34pm UTC](https://discuss.elastic.co/t/elasticsearch-shield-relam-problem/22688 "2015-03-24T17:34:14Z")

</div>

Hi All, I am using elastic version 1.4.2 in development i installed elasticsearch shield on each node of my cluster i have 3 nodes in my cluster. i followed the below procedure to install shield. \*…

---

## [Custom Interactive Filters in Kibana](https://discuss.elastic.co/t/custom-interactive-filters-in-kibana/294216)

<div class="topic-metadata">

**Author:** [@Jason2073](https://discuss.elastic.co/u/Jason2073)\
**Replies:** 3\
**Last updated:** [January 18, 2022, 10:30pm UTC](https://discuss.elastic.co/t/custom-interactive-filters-in-kibana/294216 "2022-01-18T22:30:46Z")

</div>

Hello! I have been working to make a kibana dashboard more interactive for a very picky client that wants a way of interacting with filters that I can't seem to find a way of doing with the features I have seen in kibana…

[Previous page](https://discuss.elastic.co/top.md?page=1355&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1357&per_page=50&period=all)
