# Top

**URL:** https://discuss.elastic.co/top.md?page=1360&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1361

---

## [Creating dashboards for custom pattern from filebeat not working?](https://discuss.elastic.co/t/creating-dashboards-for-custom-pattern-from-filebeat-not-working/253615)

<div class="topic-metadata">

**Author:** [@Karel\_Cech](https://discuss.elastic.co/u/Karel_Cech)\
**Replies:** 5\
**Last updated:** [November 3, 2020, 10:07am UTC](https://discuss.elastic.co/t/creating-dashboards-for-custom-pattern-from-filebeat-not-working/253615 "2020-11-03T10:07:29Z")

</div>

Hi, I am unable to use a not-default index naming for filebeat. According to the documentation, I have these settings in my filebeat.yml: setup.template.name: "customname" setup.template.pattern: "customname-\*" setup.d…

---

## [Elastic SIEM](https://discuss.elastic.co/t/elastic-siem/251784)

<div class="topic-metadata">

**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\
**Replies:** 5\
**Last updated:** [October 14, 2020, 9:04pm UTC](https://discuss.elastic.co/t/elastic-siem/251784 "2020-10-14T21:04:24Z")

</div>

I am having issues starting the ML datafeeds for SIEM, I've tried manually putting in a mapping for @timestamp as date but i still get this error anyone else have this issue ? \` "{"error":{"root\_cause":\[{"type":"status…

---

## [Timelion & Unix Timestamp](https://discuss.elastic.co/t/timelion-unix-timestamp/177293)

<div class="topic-metadata">

**Author:** [@Andy\_Barber](https://discuss.elastic.co/u/Andy_Barber)\
**Replies:** 5\
**Last updated:** [May 21, 2019, 10:44pm UTC](https://discuss.elastic.co/t/timelion-unix-timestamp/177293 "2019-05-21T22:44:10Z")

</div>

Hi All, Firstly I am new to ELK and Kibana in general so I don't know what I don't know. I have some data where I have a unix timestamp that I would like to sue as the timefield in a timelion visual should timelion be ab…

---

## [Translog has incomplete operation written for large documents](https://discuss.elastic.co/t/translog-has-incomplete-operation-written-for-large-documents/31997)

<div class="topic-metadata">

**Author:** [@Mahathi](https://discuss.elastic.co/u/Mahathi)\
**Replies:** 5\
**Last updated:** [December 28, 2015, 3:30am UTC](https://discuss.elastic.co/t/translog-has-incomplete-operation-written-for-large-documents/31997 "2015-12-28T03:30:46Z")

</div>

Hi, We are using ElasticSearch 1.3.4 on Windows Azure IaaS VMs (using storage accounts/disks to house the actual data) and have seen this happen couple of times. The translog file fails to recover, with the following e…

---

## [Rebuilding corrupted index metadata](https://discuss.elastic.co/t/rebuilding-corrupted-index-metadata/5489)

<div class="topic-metadata">

**Author:** [@Curtis\_Caravone](https://discuss.elastic.co/u/Curtis_Caravone)\
**Replies:** 5\
**Last updated:** [October 3, 2011, 8:47am UTC](https://discuss.elastic.co/t/rebuilding-corrupted-index-metadata/5489 "2011-10-03T08:47:52Z")

</div>

Hey all, I thought I would share an experience I had recently in case it helps anybody having a similar problem: We are in the process up upgrading from es 0.16.2 to the latest 0.17.7. We did this by shutting do…

---

## [Json.ignore\_decoding\_error: true automatically enables json processing for everything?](https://discuss.elastic.co/t/json-ignore-decoding-error-true-automatically-enables-json-processing-for-everything/311721)

<div class="topic-metadata">

**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\
**Replies:** 2\
**Last updated:** [September 5, 2022, 10:15am UTC](https://discuss.elastic.co/t/json-ignore-decoding-error-true-automatically-enables-json-processing-for-everything/311721 "2022-09-05T10:15:53Z")

</div>

Hi folks, On our openshift clusters we have a wide range of applications and workloads running, which write logs in different ways. If some developers write logs in json we want to enable them to annotate their workloa…

---

## [Connecting Elastic search cloud with Jupiter notebook](https://discuss.elastic.co/t/connecting-elastic-search-cloud-with-jupiter-notebook/224004)

<div class="topic-metadata">

**Author:** [@Vasuji](https://discuss.elastic.co/u/Vasuji)\
**Replies:** 2\
**Last updated:** [March 18, 2020, 9:31pm UTC](https://discuss.elastic.co/t/connecting-elastic-search-cloud-with-jupiter-notebook/224004 "2020-03-18T21:31:04Z")

</div>

Hi all, I am getting trouble with connecting to the elastic cloud with the following code through Jupyter notebook: es = Elasticsearch(\["https://xxxxxxxxxxxxxxxx.us-west-1.aws.found.io:9243/"\]) es.info(pretty=True) =\> …

---

## [Use cases for es-hadoop](https://discuss.elastic.co/t/use-cases-for-es-hadoop/203317)

<div class="topic-metadata">

**Author:** [@Devendra\_Kumar](https://discuss.elastic.co/u/Devendra_Kumar)\
**Replies:** 2\
**Last updated:** [October 23, 2019, 8:58pm UTC](https://discuss.elastic.co/t/use-cases-for-es-hadoop/203317 "2019-10-23T20:58:13Z")

</div>

I want to know complete use cases for es-hadoop. I want to understand in what ways we can utilise es-hadoop.

---

## [Translate filter not working properly](https://discuss.elastic.co/t/translate-filter-not-working-properly/115297)

<div class="topic-metadata">

**Author:** [@cskowronnek](https://discuss.elastic.co/u/cskowronnek)\
**Replies:** 2\
**Last updated:** [January 22, 2018, 1:52pm UTC](https://discuss.elastic.co/t/translate-filter-not-working-properly/115297 "2018-01-22T13:52:02Z")

</div>

Hi, I'm using Logstash 6.1.1 to parse some Apache logs and ship them to ES. I use the translate filter in my config to translate software IDs to filenames. Logstash config: if \[request\] =~ /sdc/ and \[product\]\[softwar…

---

## [How to receive ack of publish in 6.0 libbeat](https://discuss.elastic.co/t/how-to-receive-ack-of-publish-in-6-0-libbeat/107964)

<div class="topic-metadata">

**Author:** [@JamesB](https://discuss.elastic.co/u/JamesB)\
**Replies:** 2\
**Last updated:** [November 17, 2017, 9:08am UTC](https://discuss.elastic.co/t/how-to-receive-ack-of-publish-in-6-0-libbeat/107964 "2017-11-17T09:08:39Z")

</div>

Hi, I've just started looking at creating a custom beat using the 6.0 branch. I want to guarantee delivery of events and also be notified when an event has been published. What is the best way to do this? I've found th…

---

## [Federated Search With ES](https://discuss.elastic.co/t/federated-search-with-es/93807)

<div class="topic-metadata">

**Author:** [@Bhupendra\_Jain](https://discuss.elastic.co/u/Bhupendra_Jain)\
**Replies:** 2\
**Last updated:** [July 20, 2017, 2:55pm UTC](https://discuss.elastic.co/t/federated-search-with-es/93807 "2017-07-20T14:55:35Z")

</div>

Hi , I am trying to design Federated search with Elasticsearch and kind of struggling with how to design it the right way . The following is what my use case is and any help or direction is highly appreciated . Use…

---

## [Logstash running extremely slow](https://discuss.elastic.co/t/logstash-running-extremely-slow/35373)

<div class="topic-metadata">

**Author:** [@brashendeavours](https://discuss.elastic.co/u/brashendeavours)\
**Replies:** 2\
**Last updated:** [November 24, 2015, 7:47am UTC](https://discuss.elastic.co/t/logstash-running-extremely-slow/35373 "2015-11-24T07:47:07Z")

</div>

So I'm running Bro + ELK on a Ubuntu 14.04 LTS box and I'm getting less than one request per second fed into elasticsearch... I'm running Bro 2.4.1 Logstash 2.0.0 Elasticsearch 2.0.0 Kibana 4.2.1 Bro peels through my…

---

## [Filebeat.autodiscover on Kubernetes not honoring multiline message config](https://discuss.elastic.co/t/filebeat-autodiscover-on-kubernetes-not-honoring-multiline-message-config/207167)

<div class="topic-metadata">

**Author:** [@Michael\_Davis](https://discuss.elastic.co/u/Michael_Davis)\
**Replies:** 1\
**Last updated:** [November 8, 2019, 8:42pm UTC](https://discuss.elastic.co/t/filebeat-autodiscover-on-kubernetes-not-honoring-multiline-message-config/207167 "2019-11-08T20:42:56Z")

</div>

Hi all, I'm using Filebeat as a DaemonSet in Kubernetes to capture logs from containers across the cluster. These logs are being pushed into an Elastic Cloud deployment by Filebeat. We're primarily a Java shop, so I'm t…

---

## [Upload several csv files to kibana](https://discuss.elastic.co/t/upload-several-csv-files-to-kibana/198513)

<div class="topic-metadata">

**Author:** [@yaharin\_ben\_ayon](https://discuss.elastic.co/u/yaharin_ben_ayon)\
**Replies:** 1\
**Last updated:** [September 13, 2019, 10:24am UTC](https://discuss.elastic.co/t/upload-several-csv-files-to-kibana/198513 "2019-09-13T10:24:09Z")

</div>

Hello, does anyone know how can i upload several csv files (i converted excel to csv) into kibana to work on the same dashboard? right now i can only upload one. Thank you.

---

## [Unable to send data to elasticsearch from apm server?](https://discuss.elastic.co/t/unable-to-send-data-to-elasticsearch-from-apm-server/179502)

<div class="topic-metadata">

**Author:** [@Mohammed\_khan](https://discuss.elastic.co/u/Mohammed_khan)\
**Replies:** 1\
**Last updated:** [May 3, 2019, 9:24am UTC](https://discuss.elastic.co/t/unable-to-send-data-to-elasticsearch-from-apm-server/179502 "2019-05-03T09:24:40Z")

</div>

Unable to send data to elasticsearch but connection is eshtablished, all elasticsearch, kibana, apm server are upto date.(version :- 7.0.0) Provide logs and/or server output (if relevant): 2019-05-03T13:32:17.425+0530 …

---

## [엘라스틱서치 php 관련 질문](https://discuss.elastic.co/t/php/96727)

<div class="topic-metadata">

**Author:** [@b3456ef9ab8344bd7216](https://discuss.elastic.co/u/b3456ef9ab8344bd7216)\
**Replies:** 1\
**Last updated:** [August 14, 2017, 2:09am UTC](https://discuss.elastic.co/t/php/96727 "2017-08-14T02:09:24Z")

</div>

우선 현재 진행 상황을 설명드리겠습니다. 서버 : ubuntu DB : mysql 언어 : php 서버는 aws ec2를 사용중입니다. 우선 테스트 서버를 현재 서비스와 동일하게 구축하여 테스트 서버에 elasticsearch과 logstash를 설치하였습니다. logstash를 사용하여 데이터베이스에 있는 데이터를 elasticsearch에 인덱싱 하는 작업은 테스트로 성공한 상…

---

## [Can elastic search read a csv or tsv file in hdfs?](https://discuss.elastic.co/t/can-elastic-search-read-a-csv-or-tsv-file-in-hdfs/16691)

<div class="topic-metadata">

**Author:** [@siva\_mannem](https://discuss.elastic.co/u/siva_mannem)\
**Replies:** 1\
**Last updated:** [March 31, 2014, 7:49pm UTC](https://discuss.elastic.co/t/can-elastic-search-read-a-csv-or-tsv-file-in-hdfs/16691 "2014-03-31T19:49:47Z")

</div>

Hi, can elastic search read a csv or tsv file in hdfs? i am able to read a json file from hadoop hdfs and write to elastic search and i am able to read that json data from elastic search index. is it possible to ach…

---

## [Filebeat setup kibana dashboard: limit to enabled modules](https://discuss.elastic.co/t/filebeat-setup-kibana-dashboard-limit-to-enabled-modules/239763)

<div class="topic-metadata">

**Author:** [@pauleccm](https://discuss.elastic.co/u/pauleccm)\
**Replies:** 1\
**Last updated:** [July 6, 2020, 3:24pm UTC](https://discuss.elastic.co/t/filebeat-setup-kibana-dashboard-limit-to-enabled-modules/239763 "2020-07-06T15:24:25Z")

</div>

When I enable a module https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-modules.html like this, and run the filebeat setup command, the kibana dashboards for ALL default modules are created, …

---

## [Http filter plugin adds \_jsonparsefailure in tag](https://discuss.elastic.co/t/http-filter-plugin-adds-jsonparsefailure-in-tag/277744)

<div class="topic-metadata">

**Author:** [@priyaankaa](https://discuss.elastic.co/u/priyaankaa)\
**Replies:** 4\
**Last updated:** [July 6, 2021, 9:47am UTC](https://discuss.elastic.co/t/http-filter-plugin-adds-jsonparsefailure-in-tag/277744 "2021-07-06T09:47:55Z")

</div>

My logstash pipeline - input { elasticsearch { hosts =\> "http://localhost:9200" index =\> "s1test-processcode-temp" user =\> "elastic" password =\> "elastic" schedule =\> "\*/10 \* \* \* \*" } } filter { j…

---

## [How to configure ANOMALY DETECTION with DAILY buckets](https://discuss.elastic.co/t/how-to-configure-anomaly-detection-with-daily-buckets/217451)

<div class="topic-metadata">

**Author:** [@alexisdrnt](https://discuss.elastic.co/u/alexisdrnt)\
**Replies:** 4\
**Last updated:** [February 3, 2020, 5:19pm UTC](https://discuss.elastic.co/t/how-to-configure-anomaly-detection-with-daily-buckets/217451 "2020-02-03T17:19:57Z")

</div>

Hi, I am having a hard trying to figure out how to setup the datafeed of my Anomaly Detection Job. I have a Transform job that aggregate all the daily data to the same day at 00:00. I wanna run a Anomaly Detection to …

---

## [A wrong position of Vega tooltips](https://discuss.elastic.co/t/a-wrong-position-of-vega-tooltips/157386)

<div class="topic-metadata">

**Author:** [@Lidiya\_Chernova](https://discuss.elastic.co/u/Lidiya_Chernova)\
**Replies:** 4\
**Last updated:** [November 29, 2018, 11:52am UTC](https://discuss.elastic.co/t/a-wrong-position-of-vega-tooltips/157386 "2018-11-29T11:52:01Z")

</div>

Hi there :raised\_hand\_with\_fingers\_splayed: I have a problem with a tooltip position on a dashboard for second and further visualizations which are placed one above one in a row. Why it happens? How can I set the right …

---

## [Courier Fetch : 5 of 15 shards failed. - Need Help Troubleshooting](https://discuss.elastic.co/t/courier-fetch-5-of-15-shards-failed-need-help-troubleshooting/124424)

<div class="topic-metadata">

**Author:** [@camay123](https://discuss.elastic.co/u/camay123)\
**Replies:** 4\
**Last updated:** [March 18, 2018, 1:05am UTC](https://discuss.elastic.co/t/courier-fetch-5-of-15-shards-failed-need-help-troubleshooting/124424 "2018-03-18T01:05:44Z")

</div>

Hi, I got this warning that appears every few other times in Kibana: Courier Fetch : 5 of 15 shards failed In my elasticSearch log i get the following error message: \[2018-03-17T23:23:22,723\]\[DEBUG\]\[o.e.a.s.Transport…

---

## [Elasticsearch - Ingest Plugin - Tika Configuration](https://discuss.elastic.co/t/elasticsearch-ingest-plugin-tika-configuration/92048)

<div class="topic-metadata">

**Author:** [@boopathi\_jothi](https://discuss.elastic.co/u/boopathi_jothi)\
**Replies:** 4\
**Last updated:** [July 6, 2017, 1:39pm UTC](https://discuss.elastic.co/t/elasticsearch-ingest-plugin-tika-configuration/92048 "2017-07-06T13:39:48Z")

</div>

Hi Team Would it possible to configure Tika from Elasticsearch through ingest plugin? We are using Ingest attachment plugin for parsing various types of documents. By default Tika parses content of PDF document and…

---

## [Elasticsearch search query](https://discuss.elastic.co/t/elasticsearch-search-query/83230)

<div class="topic-metadata">

**Author:** [@khaoulaari](https://discuss.elastic.co/u/khaoulaari)\
**Replies:** 4\
**Last updated:** [April 26, 2017, 11:51am UTC](https://discuss.elastic.co/t/elasticsearch-search-query/83230 "2017-04-26T11:51:58Z")

</div>

hello everyone i'm new on Es and i'm trying to run the following code function getClusters() { es\_client.search({ index: settings.cluster.index, type: 'metrics', body: { query: { bool: { …

---

## [Geoip](https://discuss.elastic.co/t/geoip/57235)

<div class="topic-metadata">

**Author:** [@kharbechtein](https://discuss.elastic.co/u/kharbechtein)\
**Replies:** 4\
**Last updated:** [August 5, 2016, 10:07am UTC](https://discuss.elastic.co/t/geoip/57235 "2016-08-05T10:07:32Z")

</div>

Hello , I am new to the Elastic Stack and I have no idea how to map my geoip data. I've tried the following mapping: curl -H "kbn-version: 4.5.2" -XPUT http://localhost:9200/geo\_ip -d' { "mappings" : { "default" :…

---

## [Performing delete operation in Kibana search bar](https://discuss.elastic.co/t/performing-delete-operation-in-kibana-search-bar/35300)

<div class="topic-metadata">

**Author:** [@KavyaS](https://discuss.elastic.co/u/KavyaS)\
**Replies:** 4\
**Last updated:** [November 25, 2015, 6:04am UTC](https://discuss.elastic.co/t/performing-delete-operation-in-kibana-search-bar/35300 "2015-11-25T06:04:04Z")

</div>

I could perform the delete operation on log lines using the sense plugin. The same syntax doesn't work in Kibana. How do we write queries in the Kibana search bar to delete data?

---

## [LogStack - Help with elasticsearch as data source](https://discuss.elastic.co/t/logstack-help-with-elasticsearch-as-data-source/34581)

<div class="topic-metadata">

**Author:** [@prsolucoes](https://discuss.elastic.co/u/prsolucoes)\
**Replies:** 4\
**Last updated:** [November 17, 2015, 3:07pm UTC](https://discuss.elastic.co/t/logstack-help-with-elasticsearch-as-data-source/34581 "2015-11-17T15:07:32Z")

</div>

Hi people, Im trying making a datasource using elasticsearch with my tool LogStack (https://github.com/prsolucoes/logstack/). But after try a lot i have one method that i dont know how to do solve the problem. This …

---

## [Loading field caused out of memory failure](https://discuss.elastic.co/t/loading-field-caused-out-of-memory-failure/11546)

<div class="topic-metadata">

**Author:** [@Matthieu](https://discuss.elastic.co/u/Matthieu)\
**Replies:** 4\
**Last updated:** [April 11, 2013, 3:24pm UTC](https://discuss.elastic.co/t/loading-field-caused-out-of-memory-failure/11546 "2013-04-11T15:24:05Z")

</div>

Hi, I've a strange failure on my ES cluster. I've 3 nodes with a daily index(4 actually) to store server's logs. When I execute this query: {"query" : {"match\_all" : {}},"facets" : {"Logs" : {"terms" : {"field" :…

---

## [Kibana : Error fetching users: An internal server error occurred](https://discuss.elastic.co/t/kibana-error-fetching-users-an-internal-server-error-occurred/244383)

<div class="topic-metadata">

**Author:** [@pawarrchetan](https://discuss.elastic.co/u/pawarrchetan)\
**Replies:** 3\
**Last updated:** [August 12, 2020, 1:53am UTC](https://discuss.elastic.co/t/kibana-error-fetching-users-an-internal-server-error-occurred/244383 "2020-08-12T01:53:54Z")

</div>

Hello Fellow Community users, Since a week I am continuously encountering Internal Server Error while accessing any link from my Kibana Console. We use Elastic Cloud subscription hosted on AWS. Elastic Stack version …

---

## [How Write throughput is calculated in Rally](https://discuss.elastic.co/t/how-write-throughput-is-calculated-in-rally/188997)

<div class="topic-metadata">

**Author:** [@suvarna](https://discuss.elastic.co/u/suvarna)\
**Replies:** 3\
**Last updated:** [July 9, 2019, 6:26am UTC](https://discuss.elastic.co/t/how-write-throughput-is-calculated-in-rally/188997 "2019-07-09T06:26:39Z")

</div>

Hi I have sending 1 Billion event data with below parameters.. Clients :60 Bulk indexing=10000 iteration = 1666 index.translog.durability= request i can see the indexing throughput as 368997.56 doc/sec. Can you pl…

---

## [Debug Unmatched Responses and tcp dropped because of gaps](https://discuss.elastic.co/t/debug-unmatched-responses-and-tcp-dropped-because-of-gaps/151722)

<div class="topic-metadata">

**Author:** [@manavkapoor](https://discuss.elastic.co/u/manavkapoor)\
**Replies:** 3\
**Last updated:** [October 13, 2018, 12:15am UTC](https://discuss.elastic.co/t/debug-unmatched-responses-and-tcp-dropped-because-of-gaps/151722 "2018-10-13T00:15:36Z")

</div>

Hello. I have configured Packetbeat and currently I have packetbeat flows going into a remote monitoring cluster. However, I am having trouble getting http logging sent to this same remote monitoring cluster and really …

---

## [Metricbeat reporting all processes as "Sleeping"](https://discuss.elastic.co/t/metricbeat-reporting-all-processes-as-sleeping/145897)

<div class="topic-metadata">

**Author:** [@gonzalomk](https://discuss.elastic.co/u/gonzalomk)\
**Replies:** 3\
**Last updated:** [September 4, 2018, 1:53pm UTC](https://discuss.elastic.co/t/metricbeat-reporting-all-processes-as-sleeping/145897 "2018-09-04T13:53:52Z")

</div>

Hi I have installed metricbeat 6.3.2 together with kube-state-metrics 1.3.1 in our openshift cluster and I'm able to see all the system metrics. The problem that I find is that all processes under system.process.state m…

---

## [Having troubles parsing dates](https://discuss.elastic.co/t/having-troubles-parsing-dates/14573)

<div class="topic-metadata">

**Author:** [@Ben\_Morrice](https://discuss.elastic.co/u/Ben_Morrice)\
**Replies:** 3\
**Last updated:** [December 12, 2013, 10:01am UTC](https://discuss.elastic.co/t/having-troubles-parsing-dates/14573 "2013-12-12T10:01:29Z")

</div>

Hello, I have a basic logstash -\> elasticsearch instance running to parse apache logs; or at least I did. I don't know what has changed but elasticsearch is now bailing on my timestamp field and is not able to cor…

---

## [Logstash filtering. Extract data between two strings](https://discuss.elastic.co/t/logstash-filtering-extract-data-between-two-strings/251276)

<div class="topic-metadata">

**Author:** [@Igor\_Olikh](https://discuss.elastic.co/u/Igor_Olikh)\
**Replies:** 6\
**Last updated:** [October 8, 2020, 3:04pm UTC](https://discuss.elastic.co/t/logstash-filtering-extract-data-between-two-strings/251276 "2020-10-08T15:04:33Z")

</div>

I have a UNIX log looks like: ACTION started Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s finished when an un…

---

## [Elasticsearch timeout after 30000ms](https://discuss.elastic.co/t/elasticsearch-timeout-after-30000ms/183126)

<div class="topic-metadata">

**Author:** [@matheusribeirogarcia](https://discuss.elastic.co/u/matheusribeirogarcia)\
**Replies:** 6\
**Last updated:** [May 28, 2019, 3:22pm UTC](https://discuss.elastic.co/t/elasticsearch-timeout-after-30000ms/183126 "2019-05-28T15:22:47Z")

</div>

Hello everyone, basically i'm importing several totalized indices into one indice, but after sometime I get this timeout, and it also totally freezes my elastic cluster. I'm using a RestHighLevelClient like this: …

---

## [Matching data in two different indexes](https://discuss.elastic.co/t/matching-data-in-two-different-indexes/317741)

<div class="topic-metadata">

**Author:** [@OlegBochkarev](https://discuss.elastic.co/u/OlegBochkarev)\
**Replies:** 2\
**Last updated:** [October 31, 2022, 11:59pm UTC](https://discuss.elastic.co/t/matching-data-in-two-different-indexes/317741 "2022-10-31T23:59:00Z")

</div>

Hi, team! I collect authorising logs from two systems into two separate indexes. Index content: Index1: system1\_timestamp system1\_username system1\_ip ... Index2: system2\_timesamp system2\_username system2\_ip ..…

---

## [Convert Timestamp in Elasticsearch Query Rule](https://discuss.elastic.co/t/convert-timestamp-in-elasticsearch-query-rule/297297)

<div class="topic-metadata">

**Author:** [@jdwinns](https://discuss.elastic.co/u/jdwinns)\
**Replies:** 2\
**Last updated:** [February 16, 2022, 4:18pm UTC](https://discuss.elastic.co/t/convert-timestamp-in-elasticsearch-query-rule/297297 "2022-02-16T16:18:20Z")

</div>

Hi folks, I am new to the ELK stack and have a question in regards to an Elastic query rule and e-mail alert that I've created. Currently, I am including the log @timestamp field in the e-mail alert using this variable…

---

## [Elasticsearch NEST - Documents values are NULL](https://discuss.elastic.co/t/elasticsearch-nest-documents-values-are-null/230291)

<div class="topic-metadata">

**Author:** [@iluvcode](https://discuss.elastic.co/u/iluvcode)\
**Replies:** 2\
**Last updated:** [April 29, 2020, 4:28pm UTC](https://discuss.elastic.co/t/elasticsearch-nest-documents-values-are-null/230291 "2020-04-29T16:28:48Z")

</div>

I upgraded Elasticsearch from 6.8 to 7.6 and after the upgrade values returned in the documents are all NULL. I do see the values coming in Debug information and total count is also correct but not sure why documents ar…

---

## [Markdown: unable to parse URL](https://discuss.elastic.co/t/markdown-unable-to-parse-url/141273)

<div class="topic-metadata">

**Author:** [@d\_s](https://discuss.elastic.co/u/d_s)\
**Replies:** 2\
**Last updated:** [July 25, 2018, 2:04am UTC](https://discuss.elastic.co/t/markdown-unable-to-parse-url/141273 "2018-07-25T02:04:29Z")

</div>

Hello! I am trying to use markdown to link one dashboard to another but when I click the link I get the error "Unable to parse URL." I found this: How to create a link in the markdown to open another dashboard or visuli…

---

## [Logstash-ES communication issue and Kibana not coming up](https://discuss.elastic.co/t/logstash-es-communication-issue-and-kibana-not-coming-up/55613)

<div class="topic-metadata">

**Author:** [@vienodp](https://discuss.elastic.co/u/vienodp)\
**Replies:** 2\
**Last updated:** [July 17, 2016, 7:44am UTC](https://discuss.elastic.co/t/logstash-es-communication-issue-and-kibana-not-coming-up/55613 "2016-07-17T07:44:47Z")

</div>

I have 2 nodes in a cluster , 35 and 72 with ELK/Shield installed on it. After enabling the Shield parameters in elasticsearch.yml, Logstash to ES communications not working and Kibana is not starting up. I have enabled…

---

## [New GC metrics in Elastic 8.10](https://discuss.elastic.co/t/new-gc-metrics-in-elastic-8-10/343384)

<div class="topic-metadata">

**Author:** [@senyam08](https://discuss.elastic.co/u/senyam08)\
**Replies:** 7\
**Last updated:** [October 17, 2023, 12:14pm UTC](https://discuss.elastic.co/t/new-gc-metrics-in-elastic-8-10/343384 "2023-10-17T12:14:45Z")

</div>

We are using elastic stack 8.10.1 and elastic java agent 1.42. With new changes to GC collection and memory pools usage, would like to clarify the following GC collection count per min is too high (i see 510000 per mi…

---

## [ML anomaly detection question](https://discuss.elastic.co/t/ml-anomaly-detection-question/214090)

<div class="topic-metadata">

**Author:** [@iamtheliquor](https://discuss.elastic.co/u/iamtheliquor)\
**Replies:** 7\
**Last updated:** [January 14, 2020, 11:43am UTC](https://discuss.elastic.co/t/ml-anomaly-detection-question/214090 "2020-01-14T11:43:36Z")

</div>

Hello, We have a scenario whereby we have a number (hundreds) of remote servers on customer sites. Each server periodically (once an hour) runs a speed test and feeds these results back to Elasticsearch via Filebeat. Ea…

---

## [Change Source for Dashboard? Or VIsualization](https://discuss.elastic.co/t/change-source-for-dashboard-or-visualization/195425)

<div class="topic-metadata">

**Author:** [@Joao\_Correia](https://discuss.elastic.co/u/Joao_Correia)\
**Replies:** 1\
**Last updated:** [August 16, 2019, 4:42pm UTC](https://discuss.elastic.co/t/change-source-for-dashboard-or-visualization/195425 "2019-08-16T16:42:09Z")

</div>

Hi fellow ELKs, I've built several visualizations and then applied a filter to the dashboard. But not that I'm sure these are the filters I want to use I would like to make them permanent for this dashboard. Is it poss…

---

## [Zipping log files once they reach a threshold of 1 Gb](https://discuss.elastic.co/t/zipping-log-files-once-they-reach-a-threshold-of-1-gb/141078)

<div class="topic-metadata">

**Author:** [@Sakshi\_Aggarwal](https://discuss.elastic.co/u/Sakshi_Aggarwal)\
**Replies:** 7\
**Last updated:** [July 26, 2018, 9:21am UTC](https://discuss.elastic.co/t/zipping-log-files-once-they-reach-a-threshold-of-1-gb/141078 "2018-07-26T09:21:42Z")

</div>

Hello Everyone! We are taking logs from around 50 machines throughout the day . So we need to reduce the size of the log files. I wanted to ask if we can zip the log files once they become so many in number that they r…

---

## [Difficulty with elasticSearch SSL with .Net](https://discuss.elastic.co/t/difficulty-with-elasticsearch-ssl-with-net/106896)

<div class="topic-metadata">

**Author:** [@Akshay\_Deep\_Lamba](https://discuss.elastic.co/u/Akshay_Deep_Lamba)\
**Replies:** 1\
**Last updated:** [November 8, 2017, 10:28pm UTC](https://discuss.elastic.co/t/difficulty-with-elasticsearch-ssl-with-net/106896 "2017-11-08T22:28:09Z")

</div>

I have Two Servers ..One Installed with Elastic Search on Ubuntu(ip address 192.168.0.2) and Other Working as a Webserver IIS having .NET Application ... I am Able to Access the Elastic Search on Ubuntu using the Web B…

---

## [Results offset with 2w interval](https://discuss.elastic.co/t/results-offset-with-2w-interval/77246)

<div class="topic-metadata">

**Author:** [@jonsgreen](https://discuss.elastic.co/u/jonsgreen)\
**Replies:** 7\
**Last updated:** [March 3, 2017, 4:04pm UTC](https://discuss.elastic.co/t/results-offset-with-2w-interval/77246 "2017-03-03T16:04:05Z")

</div>

I am finding some strange behavior with a date histogram query with a '2w' interval. I am finding that the start date of the intervals are not corresponding with the range of my data but instead seem to be determined by …

---

## [Kibana 4.3 Event time based index names](https://discuss.elastic.co/t/kibana-4-3-event-time-based-index-names/36443)

<div class="topic-metadata">

**Author:** [@Drew\_Town](https://discuss.elastic.co/u/Drew_Town)\
**Replies:** 1\
**Last updated:** [December 5, 2015, 5:25pm UTC](https://discuss.elastic.co/t/kibana-4-3-event-time-based-index-names/36443 "2015-12-05T17:25:03Z")

</div>

Using event times to create index names is deprecated in this release of Kibana. Support for this functionality will be removed entirely in the next major Kibana release. Elasticsearch 2.1 includes sophisticated date pa…

---

## [Elasticsearch Migration from Windows to Linux – Swap Enabled and SELinux Enforcing](https://discuss.elastic.co/t/elasticsearch-migration-from-windows-to-linux-swap-enabled-and-selinux-enforcing/388113)

<div class="topic-metadata">

**Author:** [@Shubham\_Khodpe](https://discuss.elastic.co/u/Shubham_Khodpe)\
**Replies:** 5\
**Last updated:** [July 15, 2026, 9:58am UTC](https://discuss.elastic.co/t/elasticsearch-migration-from-windows-to-linux-swap-enabled-and-selinux-enforcing/388113 "2026-07-15T09:58:57Z")

</div>

Hi Team, We are migrating our Elasticsearch 9.1.3 cluster from Windows Server to RHEL Linux (9.8). The environment consists of 2 dedicated master nodes, 4 data nodes, nodes, and 2 Logstash nodes. As part of the Linux p…

---

## [Metricbeat issue: failed to parse: Limit of total fields \[10000\] has been exceeded while adding new fields](https://discuss.elastic.co/t/metricbeat-issue-failed-to-parse-limit-of-total-fields-10000-has-been-exceeded-while-adding-new-fields/369405)

<div class="topic-metadata">

**Author:** [@alexns](https://discuss.elastic.co/u/alexns)\
**Replies:** 5\
**Last updated:** [December 18, 2024, 2:06pm UTC](https://discuss.elastic.co/t/metricbeat-issue-failed-to-parse-limit-of-total-fields-10000-has-been-exceeded-while-adding-new-fields/369405 "2024-12-18T14:06:33Z")

</div>

We use the AWS module to push SQS and RDS metrics to Metricbeat. Everything is setup with ECK on Kubernetes and Helm. Recently, probably after updating to 8.15.2, these metrics weren't being pushed anymore. The metricb…

---

## [Log stoppage alert using Machine learning in ELK 7.12](https://discuss.elastic.co/t/log-stoppage-alert-using-machine-learning-in-elk-7-12/274105)

<div class="topic-metadata">

**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\
**Replies:** 5\
**Last updated:** [June 22, 2021, 2:02pm UTC](https://discuss.elastic.co/t/log-stoppage-alert-using-machine-learning-in-elk-7-12/274105 "2021-06-22T14:02:06Z")

</div>

Hi, Please help to create a log stoppage alert for critical devices using machine learning. For example: Index "A" contains 10 Active directory server logs. Need to generate an email alert if Elasticsearch stop receiv…

[Previous page](https://discuss.elastic.co/top.md?page=1359&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1361&per_page=50&period=all)
