# Top **URL:** https://discuss.elastic.co/top.md?page=1359&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1360 --- ## [Es 5.2.2 X-pack index permission error](https://discuss.elastic.co/t/es-5-2-2-x-pack-index-permission-error/78187)
**Author:** [@cfuhriman](https://discuss.elastic.co/u/cfuhriman)\ **Replies:** 3\ **Last updated:** [March 13, 2017, 5:29pm UTC](https://discuss.elastic.co/t/es-5-2-2-x-pack-index-permission-error/78187 "2017-03-13T17:29:08Z")
I am trying to create a user account who only has accesses to specific indexes when they log into Kibana, but when I log in I am getting just the navigation bar and a blank screen. The following error shows up in the br… --- ## [Phrase Suggester with multiple Fields](https://discuss.elastic.co/t/phrase-suggester-with-multiple-fields/18223)
**Author:** [@brupm](https://discuss.elastic.co/u/brupm)\ **Replies:** 0\ **Last updated:** [June 20, 2014, 2:01am UTC](https://discuss.elastic.co/t/phrase-suggester-with-multiple-fields/18223 "2014-06-20T02:01:21Z")
I am using the phrase suggester to implement did-you-mean functionality. My source field is named did\_you\_mean\_source which is a combination of first and last name with a space in the middle. When I search for say… --- ## [Search/Tag Rules with MITRE ATT&CK TTP](https://discuss.elastic.co/t/search-tag-rules-with-mitre-att-ck-ttp/277144)
**Author:** [@inf](https://discuss.elastic.co/u/inf)\ **Replies:** 0\ **Last updated:** [June 27, 2021, 8:05am UTC](https://discuss.elastic.co/t/search-tag-rules-with-mitre-att-ck-ttp/277144 "2021-06-27T08:05:35Z")
Hi there, Not sure if there is currently a way (else, this will be a suggestion) to search rules according to TTPs. Each rule appears to have at least TTP listed when we click into the rule, but it is not part of the t… --- ## [London Information Retrieval Meetup](https://discuss.elastic.co/t/london-information-retrieval-meetup/254072)
**Author:** [@Alessandro\_Benedett1](https://discuss.elastic.co/u/Alessandro_Benedett1)\ **Replies:** 0\ **Last updated:** [November 2, 2020, 6:54pm UTC](https://discuss.elastic.co/t/london-information-retrieval-meetup/254072 "2020-11-02T18:54:58Z")
Hi ! The London Information Retrieval Meetup has moved online: https://www.meetup.com/London-Information-Retrieval-Meetup-Group It is a free evening meetup aimed at Information Retrieval passionates and professional… --- ## [Is it possible to check that specific data matches the query without loading it to the index?](https://discuss.elastic.co/t/is-it-possible-to-check-that-specific-data-matches-the-query-without-loading-it-to-the-index/232014)
**Author:** [@pavlovdog](https://discuss.elastic.co/u/pavlovdog)\ **Replies:** 0\ **Last updated:** [May 11, 2020, 12:51pm UTC](https://discuss.elastic.co/t/is-it-possible-to-check-that-specific-data-matches-the-query-without-loading-it-to-the-index/232014 "2020-05-11T12:51:53Z")
Hi, there! Imagine that I have a specific data string and a specific query. The simple way to check that the query matches the data is to load the data into the Elastic index and run the online query. But can I do it wi… --- ## [DELETE api vs \_delete\_by\_query against index alias](https://discuss.elastic.co/t/delete-api-vs-delete-by-query-against-index-alias/238439)
**Author:** [@raulk89](https://discuss.elastic.co/u/raulk89)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 11:07am UTC](https://discuss.elastic.co/t/delete-api-vs-delete-by-query-against-index-alias/238439 "2020-06-24T11:07:46Z")
Hi Elastic 6.8.4 When I have 2 indices, A and B. I have created alias X for these. For index B is\_write\_index: true Both of these indexes has doc with \_id: 5 When I do DELETE /X/\_doc/5 Then the doc is deleted only … --- ## [ELK Stack configuration backup](https://discuss.elastic.co/t/elk-stack-configuration-backup/235335)
**Author:** [@Amine\_Maalfi](https://discuss.elastic.co/u/Amine_Maalfi)\ **Replies:** 1\ **Last updated:** [June 2, 2020, 12:58pm UTC](https://discuss.elastic.co/t/elk-stack-configuration-backup/235335 "2020-06-02T12:58:38Z")
Hi everyone, I want to backup all my elasticsearch and logstash configurations and i don't know in which files are some configurations stored. can anyone please help me know all the configuration files (settings,securi… --- ## [How to extract partial match using grok filtering?](https://discuss.elastic.co/t/how-to-extract-partial-match-using-grok-filtering/105649)
**Author:** [@AI\_Rumman](https://discuss.elastic.co/u/AI_Rumman)\ **Replies:** 1\ **Last updated:** [October 30, 2017, 12:45pm UTC](https://discuss.elastic.co/t/how-to-extract-partial-match-using-grok-filtering/105649 "2017-10-30T12:45:11Z")
Hi, I am trying to write a logstash conf file with grok filter to find out my cassandra clusters name and datacenter name. For example: Initial value: "metric\_path": "zabbix\_test-us-east-2-node0.KeyCache.HitRate" Her… --- ## [Show explicit timestamp in timelion?](https://discuss.elastic.co/t/show-explicit-timestamp-in-timelion/72986)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 1\ **Last updated:** [January 27, 2017, 12:42pm UTC](https://discuss.elastic.co/t/show-explicit-timestamp-in-timelion/72986 "2017-01-27T12:42:38Z")
Hi threre, in a bar / line / area-chart in kibana5, you see the detailed timestamp in the tooltip: I built the same query in timelion. What I like in timelon is: grid in the background drops a line to 0 if no resu… --- ## [Index name confusion with ILM enabled](https://discuss.elastic.co/t/index-name-confusion-with-ilm-enabled/190867)
**Author:** [@DPattee](https://discuss.elastic.co/u/DPattee)\ **Replies:** 2\ **Last updated:** [July 18, 2019, 1:12am UTC](https://discuss.elastic.co/t/index-name-confusion-with-ilm-enabled/190867 "2019-07-18T01:12:45Z")
Previously I used daily indexes defined like: output.elasticsearch: index: "filebeat-%{\[agent.version\]}-%{+yyyy.MM}" Now I'm trying to use ILM so my daily indexes are managed more rationally. I have this config now: s… --- ## [Filebeat setup error message](https://discuss.elastic.co/t/filebeat-setup-error-message/176750)
**Author:** [@KK23](https://discuss.elastic.co/u/KK23)\ **Replies:** 2\ **Last updated:** [April 14, 2019, 5:39am UTC](https://discuss.elastic.co/t/filebeat-setup-error-message/176750 "2019-04-14T05:39:58Z")
Hi, I am getting below error with file beat setup sudo filebeat setup gives "Exiting: 1 error: Error checking if xpack is available: 500 Internal Server Error: {"error":{"root\_cause":\[{"type":"security\_exception","rea… --- ## [Alert based on content of message](https://discuss.elastic.co/t/alert-based-on-content-of-message/144368)
**Author:** [@Magnus\_Therning](https://discuss.elastic.co/u/Magnus_Therning)\ **Replies:** 2\ **Last updated:** [August 15, 2018, 9:02am UTC](https://discuss.elastic.co/t/alert-based-on-content-of-message/144368 "2018-08-15T09:02:35Z")
I'd like to be alerted as soon as a message containing the string "ERROR" is logged in our production system. The corresponding Kibana search would be fields.env:production AND message:ERROR. Based on what I've found on… --- ## [Kibana:6.0.0 - X-Pack with Basic license?](https://discuss.elastic.co/t/kibana-6-0-0-x-pack-with-basic-license/108450)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 2\ **Last updated:** [November 20, 2017, 9:32pm UTC](https://discuss.elastic.co/t/kibana-6-0-0-x-pack-with-basic-license/108450 "2017-11-20T21:32:13Z")
I'm a little bit confused and I was hoping someone can clear it up for me... per Image types | Kibana User Guide \[6.0\] | Elastic, there are two type/configuration of images: x-pack and oss. I used oss version in the pa… --- ## [Data not coming in to Logstash](https://discuss.elastic.co/t/data-not-coming-in-to-logstash/99272)
**Author:** [@Maekee](https://discuss.elastic.co/u/Maekee)\ **Replies:** 2\ **Last updated:** [September 4, 2017, 3:48pm UTC](https://discuss.elastic.co/t/data-not-coming-in-to-logstash/99272 "2017-09-04T15:48:21Z")
Hi, Have tried both winlogbeat and filebeat, get same problem. I have configured an ELK-server that works just fine locally, now i am trying to send events from a remote server with winlogbeat or filebeat and the event… --- ## [SOLR to Elastic NEWEST](https://discuss.elastic.co/t/solr-to-elastic-newest/82818)
**Author:** [@billnbell](https://discuss.elastic.co/u/billnbell)\ **Replies:** 2\ **Last updated:** [April 27, 2017, 6:10pm UTC](https://discuss.elastic.co/t/solr-to-elastic-newest/82818 "2017-04-27T18:10:37Z")
Solr to Elastic. How do I covert: {!boost b=recip(ms(NOW/HOUR,%s),3.16e-11,%s,%s)} Which is to sort by NEWEST - want to change this to work on Elastic? --- ## [How to add a space or comma(,) between two concatenating fields using mutate?](https://discuss.elastic.co/t/how-to-add-a-space-or-comma-between-two-concatenating-fields-using-mutate/43945)
**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\ **Replies:** 2\ **Last updated:** [March 10, 2016, 7:55am UTC](https://discuss.elastic.co/t/how-to-add-a-space-or-comma-between-two-concatenating-fields-using-mutate/43945 "2016-03-10T07:55:17Z")
Hi Experts , Please help me to achieve as follow .I want something like Fullname= vikas , gopal With below mutate output is like vikasgopal. So I want to add , in-between first an last mutate {add\_field =\> {"Fullna… --- ## [Java API Multiple range queries](https://discuss.elastic.co/t/java-api-multiple-range-queries/12025)
**Author:** [@dantuff](https://discuss.elastic.co/u/dantuff)\ **Replies:** 2\ **Last updated:** [May 19, 2013, 1:20pm UTC](https://discuss.elastic.co/t/java-api-multiple-range-queries/12025 "2013-05-19T13:20:33Z")
Is it possible to add multiple range queries using the Java API? I can get to work with one range query using: searchRequestBuilder.setFilter(rangeFilterBuilder); Is there a way to add multiple range queries t… --- ## [How to get index data from kibana?](https://discuss.elastic.co/t/how-to-get-index-data-from-kibana/95820)
**Author:** [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)\ **Replies:** 1\ **Last updated:** [August 4, 2017, 8:55pm UTC](https://discuss.elastic.co/t/how-to-get-index-data-from-kibana/95820 "2017-08-04T20:55:23Z")
Hi i have a kibana 5.5.0 installed in my ubuntu machine. I have a index called filebeat-\* in it. What i need is i need to get datas from the speecified index like i used curl (GET metricbeat-2017.07.19/\_search) command … --- ## [Kibana 8.12.1 Security Update (ESA-2024-21)](https://discuss.elastic.co/t/kibana-8-12-1-security-update-esa-2024-21/379064)
**Author:** [@rodrigo\_silva](https://discuss.elastic.co/u/rodrigo_silva)\ **Replies:** 0\ **Last updated:** [June 10, 2025, 4:48pm UTC](https://discuss.elastic.co/t/kibana-8-12-1-security-update-esa-2024-21/379064 "2025-06-10T16:48:27Z")
Kibana Improper Authorization (ESA-2024-21) Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint. Affected Versions: Kibana versions before and includi… --- ## [KNN search with boost on specific field?](https://discuss.elastic.co/t/knn-search-with-boost-on-specific-field/362772)
**Author:** [@JdKock](https://discuss.elastic.co/u/JdKock)\ **Replies:** 6\ **Last updated:** [July 10, 2024, 2:36pm UTC](https://discuss.elastic.co/t/knn-search-with-boost-on-specific-field/362772 "2024-07-10T14:36:43Z")
Is it possible to do some tweaking with a KNN search? For example I have documents with a title, description, country and a category. I have created the embeddings with the E5 model for the title & description fields (… --- ## [Filebeat 7.10 fails to collect events from multiple kubernetes pods](https://discuss.elastic.co/t/filebeat-7-10-fails-to-collect-events-from-multiple-kubernetes-pods/267406)
**Author:** [@bhavaniprasad\_reddy](https://discuss.elastic.co/u/bhavaniprasad_reddy)\ **Replies:** 6\ **Last updated:** [March 20, 2021, 1:31pm UTC](https://discuss.elastic.co/t/filebeat-7-10-fails-to-collect-events-from-multiple-kubernetes-pods/267406 "2021-03-20T13:31:55Z")
Filebeat is configured to collect events from multiple kubernetes pods using or condition. Events from a specific pod are continuously collected but events from another pod are collected very slowly and no events are col… --- ## [X-axis is not visible in vega visualization](https://discuss.elastic.co/t/x-axis-is-not-visible-in-vega-visualization/263981)
**Author:** [@saumya1](https://discuss.elastic.co/u/saumya1)\ **Replies:** 6\ **Last updated:** [February 11, 2021, 3:19pm UTC](https://discuss.elastic.co/t/x-axis-is-not-visible-in-vega-visualization/263981 "2021-02-11T15:19:46Z")
{ "$schema": "https://vega.github.io/schema/vega/v5.json", "description": "A basic bar chart example, with value labels shown upon mouse hover.", "signals": \[{ "name": "timeunit", "value": \["day"\], … --- ## [After enabling xpack in ES how do i login in Kibana](https://discuss.elastic.co/t/after-enabling-xpack-in-es-how-do-i-login-in-kibana/231530)
**Author:** [@persepherone](https://discuss.elastic.co/u/persepherone)\ **Replies:** 6\ **Last updated:** [May 9, 2020, 1:04pm UTC](https://discuss.elastic.co/t/after-enabling-xpack-in-es-how-do-i-login-in-kibana/231530 "2020-05-09T13:04:32Z")
I have version 7.6 of the ELK stack After enabling Xpack in ES and providing passwords to the elasticsearch-setup-passwords.bat file . Now i added one of the passwords to the kibana.yml file(to connect to ES). Now, kiba… --- ## [Vega Multiple Roots Error](https://discuss.elastic.co/t/vega-multiple-roots-error/290824)
**Author:** [@WhatImIDoing](https://discuss.elastic.co/u/WhatImIDoing)\ **Replies:** 4\ **Last updated:** [December 2, 2021, 8:46pm UTC](https://discuss.elastic.co/t/vega-multiple-roots-error/290824 "2021-12-02T20:46:44Z")
I am getting a multiple roots error from this vega script and i am not sure where in the transformation i am going wrong. { "$schema": "https://vega.github.io/schema/vega/v5.json", "description": "An example of a … --- ## [EVTX Windows logs to ES](https://discuss.elastic.co/t/evtx-windows-logs-to-es/228997)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 4\ **Last updated:** [April 23, 2020, 10:28pm UTC](https://discuss.elastic.co/t/evtx-windows-logs-to-es/228997 "2020-04-23T22:28:12Z")
Hi, what is most easy way to load static EVTX files to ES for forensics pourposes? Is there maybe some done setup for that? I just have dir with subdirectories for each system and in this subdirectories are evtx logs. Ju… --- ## [Kibana did not load properly. Check the server output for more information. -- Help!](https://discuss.elastic.co/t/kibana-did-not-load-properly-check-the-server-output-for-more-information-help/201799)
**Author:** [@samgs](https://discuss.elastic.co/u/samgs)\ **Replies:** 4\ **Last updated:** [October 11, 2019, 12:36pm UTC](https://discuss.elastic.co/t/kibana-did-not-load-properly-check-the-server-output-for-more-information-help/201799 "2019-10-11T12:36:06Z")
Hello, Im wondering if someone could help me? When loading Kibana on our wifi I get the error: Kibana did not load properly. Check the server output for more information. In the console I see: & Interestingly… --- ## [Rally throughput metric as average instead of percentile](https://discuss.elastic.co/t/rally-throughput-metric-as-average-instead-of-percentile/148292)
**Author:** [@Sunil\_pandith](https://discuss.elastic.co/u/Sunil_pandith)\ **Replies:** 4\ **Last updated:** [September 17, 2018, 10:30am UTC](https://discuss.elastic.co/t/rally-throughput-metric-as-average-instead-of-percentile/148292 "2018-09-17T10:30:12Z")
Hi, I have been using the rally to benchmark the setup. The throughput latency and service time are in percentile. Is there any to way to get the throughput metrics in average response time (latency + service) rather t… --- ## [Are we bale to create scripted field to fetch current date timestamp value](https://discuss.elastic.co/t/are-we-bale-to-create-scripted-field-to-fetch-current-date-timestamp-value/57850)
**Author:** [@prabhuramsoft](https://discuss.elastic.co/u/prabhuramsoft)\ **Replies:** 4\ **Last updated:** [August 31, 2016, 1:57pm UTC](https://discuss.elastic.co/t/are-we-bale-to-create-scripted-field-to-fetch-current-date-timestamp-value/57850 "2016-08-31T13:57:35Z")
Are we able to create scripted field to fetch current date timestamp value. in milliseconds My requirement compare the field DATE1 & current date and if the difference is more than 10 mins then have to change the color… --- ## [Baselining relevancy scoring by creating one massiveindex instead of separate indices](https://discuss.elastic.co/t/baselining-relevancy-scoring-by-creating-one-massiveindex-instead-of-separate-indices/58736)
**Author:** [@tdicken73](https://discuss.elastic.co/u/tdicken73)\ **Replies:** 4\ **Last updated:** [August 25, 2016, 12:33pm UTC](https://discuss.elastic.co/t/baselining-relevancy-scoring-by-creating-one-massiveindex-instead-of-separate-indices/58736 "2016-08-25T12:33:14Z")
I'm working on being able to query across multiple indices in elasticsearch. Each data source has its own index and its own type. I'm then doing a should match query across in each relevant field across indices and hitti… --- ## [Logstash close\_older in tail mode](https://discuss.elastic.co/t/logstash-close-older-in-tail-mode/326896)
**Author:** [@akassabi](https://discuss.elastic.co/u/akassabi)\ **Replies:** 7\ **Last updated:** [March 3, 2023, 4:26am UTC](https://discuss.elastic.co/t/logstash-close-older-in-tail-mode/326896 "2023-03-03T04:26:01Z")
Suppose we have an input file input.dat and we are reading it in Logstash in tail mode. We set close\_older to 10 minutes. My questions are: Is the close\_older setting deprecated? The docs say it is "retained for back… --- ## [Collapse not working with search\_after with single sort field and PIT](https://discuss.elastic.co/t/collapse-not-working-with-search-after-with-single-sort-field-and-pit/316165)
**Author:** [@Reese\_Allison](https://discuss.elastic.co/u/Reese_Allison)\ **Replies:** 1\ **Last updated:** [October 11, 2022, 3:30pm UTC](https://discuss.elastic.co/t/collapse-not-working-with-search-after-with-single-sort-field-and-pit/316165 "2022-10-11T15:30:06Z")
I have an Elastic query that initially returns results. When I attempt the query again using search\_after for paging, I am getting the error: Cannot use \[collapse\] in conjunction with \[search\_after\] unless the search is … --- ## [Why cant i get k8s event?](https://discuss.elastic.co/t/why-cant-i-get-k8s-event/250320)
**Author:** [@HarveyYang](https://discuss.elastic.co/u/HarveyYang)\ **Replies:** 7\ **Last updated:** [October 9, 2020, 7:04am UTC](https://discuss.elastic.co/t/why-cant-i-get-k8s-event/250320 "2020-10-09T07:04:17Z")
here is my metricbeat yaml: --- apiVersion: v1 kind: ConfigMap metadata: name: metricbeat-daemonset-config namespace: kube-system labels: k8s-app: metricbeat data: metricbeat.yml: |- metricbeat.config.mo… --- ## [Kibana Threshold line](https://discuss.elastic.co/t/kibana-threshold-line/221191)
**Author:** [@Alok](https://discuss.elastic.co/u/Alok)\ **Replies:** 1\ **Last updated:** [February 27, 2020, 11:02am UTC](https://discuss.elastic.co/t/kibana-threshold-line/221191 "2020-02-27T11:02:30Z")
Dear Extperts, As of ES 7.6 , The threshold line in Kibana takes only static values and accepts integers. Is there a way we can parameterize the threshold value? For example , I plot a bar chart showing marks obtained… --- ## [Конвертирование числа в миллисекунды](https://discuss.elastic.co/t/topic/210120)
**Author:** [@artem33region](https://discuss.elastic.co/u/artem33region)\ **Replies:** 7\ **Last updated:** [December 3, 2019, 4:53am UTC](https://discuss.elastic.co/t/topic/210120 "2019-12-03T04:53:30Z")
Всем привет, есть поле "duration" с числом, например 1823 это длительность сессии в секундах. Нужно перевести это число в формат HH:MM:SS. На сколько я понял, сначала это число нужно перевести в миллисекунды а потом чер… --- ## [Split Function in Painless](https://discuss.elastic.co/t/split-function-in-painless/204728)
**Author:** [@paul1243](https://discuss.elastic.co/u/paul1243)\ **Replies:** 1\ **Last updated:** [October 23, 2019, 12:02pm UTC](https://discuss.elastic.co/t/split-function-in-painless/204728 "2019-10-23T12:02:44Z")
Hi- I have a field name (Testjob/admin/pipeline#1) getting injected in the Elasticsearch, I'd like to split the field name by ('/') and take the last index value which is (pipeline#1) and show the field names on the gra… --- ## [Possible perf regression between 5.1.2 and 5.3.2?](https://discuss.elastic.co/t/possible-perf-regression-between-5-1-2-and-5-3-2/88995)
**Author:** [@dcausse](https://discuss.elastic.co/u/dcausse)\ **Replies:** 7\ **Last updated:** [June 13, 2017, 8:50am UTC](https://discuss.elastic.co/t/possible-perf-regression-between-5-1-2-and-5-3-2/88995 "2017-06-13T08:50:11Z")
Hi, we've just finished a rolling upgrade to bump from 5.1.2 to 5.3.2. We then noticed a visible perf regression in query percentiles 1: - fulltext queries (p75): 33ms =\> 50ms - morelike (p75): 90ms =\> 150ms - comp su… --- ## [A kibana Kibana 6.0.0-alpha2 question (always show status: RED)](https://discuss.elastic.co/t/a-kibana-kibana-6-0-0-alpha2-question-always-show-status-red/88406)
**Author:** [@fatyaha](https://discuss.elastic.co/u/fatyaha)\ **Replies:** 7\ **Last updated:** [June 13, 2017, 2:49am UTC](https://discuss.elastic.co/t/a-kibana-kibana-6-0-0-alpha2-question-always-show-status-red/88406 "2017-06-13T02:49:29Z")
Hello everyone, I firstly try to use kibana development version. Now I meet a problem in the process of "npm start". the browser on website of kibana always show STATUS: RED like this: the esvm have started, I can mo… --- ## [Decay Function question](https://discuss.elastic.co/t/decay-function-question/20615)
**Author:** [@marlo](https://discuss.elastic.co/u/marlo)\ **Replies:** 1\ **Last updated:** [November 10, 2014, 10:06am UTC](https://discuss.elastic.co/t/decay-function-question/20615 "2014-11-10T10:06:42Z")
I've begun using the decay function in order to promote more recent results in our index. In particular I'm using what's documented here: http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-d… --- ## [Windows defender logs](https://discuss.elastic.co/t/windows-defender-logs/344532)
**Author:** [@cara\_es](https://discuss.elastic.co/u/cara_es)\ **Replies:** 3\ **Last updated:** [October 11, 2023, 1:59pm UTC](https://discuss.elastic.co/t/windows-defender-logs/344532 "2023-10-11T13:59:45Z")
Hi. How can i get logs from windows defender to Elasticsearch the log are in EventViewer -\> Applications and Services Logs Microsoft - Windows - Windows Defender - Operational Kind regards Carsten --- ## [Issue with RecyclerBytesStreamOutput](https://discuss.elastic.co/t/issue-with-recyclerbytesstreamoutput/325996)
**Author:** [@aurelien.guillaume](https://discuss.elastic.co/u/aurelien.guillaume)\ **Replies:** 3\ **Last updated:** [March 7, 2023, 4:03pm UTC](https://discuss.elastic.co/t/issue-with-recyclerbytesstreamoutput/325996 "2023-03-07T16:03:26Z")
Hi, I'm new in the usage of Elasticsearch (integrated into a security onion appliance) I'm working to get a huge query (2.5M logs), and I'm stuck with this error message { "error": { "root\_cause": \[ { … --- ## [How to generate multiple time granular indexes?](https://discuss.elastic.co/t/how-to-generate-multiple-time-granular-indexes/219325)
**Author:** [@ziyang](https://discuss.elastic.co/u/ziyang)\ **Replies:** 3\ **Last updated:** [February 17, 2020, 10:32am UTC](https://discuss.elastic.co/t/how-to-generate-multiple-time-granular-indexes/219325 "2020-02-17T10:32:33Z")
I want to write monitoring data in ES. At present, there are 4 indicators, each indicator is 5 minutes granularity, every 5 minutes has more than 10,000 data, about 3 million data a day. The requirements are: How shou… --- ## [Throttle key?](https://discuss.elastic.co/t/throttle-key/169864)
**Author:** [@oscario](https://discuss.elastic.co/u/oscario)\ **Replies:** 3\ **Last updated:** [February 26, 2019, 12:11pm UTC](https://discuss.elastic.co/t/throttle-key/169864 "2019-02-26T12:11:20Z")
Dear all, I want the throttle plugin to group every line (not only lines matching a specific key value). Since a key is required and the only thing all lines have in common is at least one space I use a space for the k… --- ## [Logstash 對於 postgresql log的filter 問題](https://discuss.elastic.co/t/logstash-postgresql-log-filter/102816)
**Author:** [@stephen\_luan](https://discuss.elastic.co/u/stephen_luan)\ **Replies:** 3\ **Last updated:** [November 12, 2017, 1:50am UTC](https://discuss.elastic.co/t/logstash-postgresql-log-filter/102816 "2017-11-12T01:50:13Z")
Hi All, 不知道這裡有沒有人使用logstash , 把postgresql log 做fileter, 找了很多方法，都無法實現，postgresql log 大致如下， 不知道各位有沒有比較好的解決方法 2017-10-02 16:00:06 CST\[2017-10-02 15:59:13 CST\]59d1f1d1.61ad\[25005\]10.0.10.\* username || LOG: duration: 9904.… --- ## [Logstash 5.4 Plugins - Unable to install plugins - Errors with httparty](https://discuss.elastic.co/t/logstash-5-4-plugins-unable-to-install-plugins-errors-with-httparty/87013)
**Author:** [@techpanga](https://discuss.elastic.co/u/techpanga)\ **Replies:** 3\ **Last updated:** [May 29, 2017, 6:14pm UTC](https://discuss.elastic.co/t/logstash-5-4-plugins-unable-to-install-plugins-errors-with-httparty/87013 "2017-05-29T18:14:20Z")
Logstash - 5.4, Ruby 1.9 (default comes with logstash) I do see below errors for DEBUG=1 bin/logstash-plugin update. Due to these errors (httparty), I am unable to install any plugins like email, hipchat etc. Gem::… --- ## [GROK matches nothing. Ever](https://discuss.elastic.co/t/grok-matches-nothing-ever/62696)
**Author:** [@banditd](https://discuss.elastic.co/u/banditd)\ **Replies:** 3\ **Last updated:** [October 11, 2016, 11:18am UTC](https://discuss.elastic.co/t/grok-matches-nothing-ever/62696 "2016-10-11T11:18:03Z")
Hi, I am new to logstash and want to read to read FHEM logs. A logline looks like this: 2016-10-08\_22:06:23 Sensor\_Garden T: 7.9 H: 89 This is my logstash configuration: input { file { path =\> \[ "c:/… --- ## [Elastic search synonym match involving numeric characters](https://discuss.elastic.co/t/elastic-search-synonym-match-involving-numeric-characters/23700)
**Author:** [@sivamurugan](https://discuss.elastic.co/u/sivamurugan)\ **Replies:** 3\ **Last updated:** [May 28, 2015, 7:16pm UTC](https://discuss.elastic.co/t/elastic-search-synonym-match-involving-numeric-characters/23700 "2015-05-28T19:16:54Z")
I have documents indexed in elastic cluster with the below mapping. basically i have a field named model which holds car model names like "Silverado 2500HD", "Silverado 1500HD" "LX 350" etc etc. POST /location-… --- ## [TransportClient timeout / webserver configuration - JAVA Api](https://discuss.elastic.co/t/transportclient-timeout-webserver-configuration-java-api/16265)
**Author:** [@roblangenfeld](https://discuss.elastic.co/u/roblangenfeld)\ **Replies:** 3\ **Last updated:** [March 10, 2014, 7:54pm UTC](https://discuss.elastic.co/t/transportclient-timeout-webserver-configuration-java-api/16265 "2014-03-10T19:54:17Z")
Hello, I'm developing a tomcat webserver application that uses ElasticSearch 1.0 (Java API). There is a client facing desktop application that communicates with the server so all the code for ElasticSearch is on t… --- ## [Is there a way to place one or more elasticsearch shards on a separate disk?](https://discuss.elastic.co/t/is-there-a-way-to-place-one-or-more-elasticsearch-shards-on-a-separate-disk/309797)
**Author:** [@jalustig](https://discuss.elastic.co/u/jalustig)\ **Replies:** 5\ **Last updated:** [July 17, 2022, 8:21am UTC](https://discuss.elastic.co/t/is-there-a-way-to-place-one-or-more-elasticsearch-shards-on-a-separate-disk/309797 "2022-07-17T08:21:52Z")
I have a large elasticsearch index which is stored on an external blob storage device attached to my server, but I also have a large amount of free space on the main hard disk. Id like to put that space to use, if possib… --- ## [\[7.14.1\] Linearly increasing latency in task manager index searches](https://discuss.elastic.co/t/7-14-1-linearly-increasing-latency-in-task-manager-index-searches/286010)
**Author:** [@spiqueras](https://discuss.elastic.co/u/spiqueras)\ **Replies:** 5\ **Last updated:** [October 20, 2021, 7:27am UTC](https://discuss.elastic.co/t/7-14-1-linearly-increasing-latency-in-task-manager-index-searches/286010 "2021-10-20T07:27:57Z")
We're migrating from a 6.8 cluster to a 7.14 cluster and we're seeing some abnormal behavior with Kibana's task manager index. Sorry if this is the wrong forum. For context, this is a 3-node ES v7.14.1 cluster that as o… --- ## [Curator stopped working after 7.14.0 upgrade (KeyError: indices)](https://discuss.elastic.co/t/curator-stopped-working-after-7-14-0-upgrade-keyerror-indices/285578)
**Author:** [@hunsw](https://discuss.elastic.co/u/hunsw)\ **Replies:** 5\ **Last updated:** [October 1, 2021, 2:02pm UTC](https://discuss.elastic.co/t/curator-stopped-working-after-7-14-0-upgrade-keyerror-indices/285578 "2021-10-01T14:02:06Z")
After upgrading Elasticsearch from 7.10 to 7.14, Curator 5.4.8 has stopped working: simple delete jobs, create alias jobs, etc. that previously worked fine are now throwing this error: 2021-09-29 15:12:25,343 DEBUG … [Previous page](https://discuss.elastic.co/top.md?page=1358&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1360&per_page=50&period=all)