# Top **URL:** https://discuss.elastic.co/top.md?page=1388&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1389 --- ## [Elasticsearch array only contains query](https://discuss.elastic.co/t/elasticsearch-array-only-contains-query/298666)
**Author:** [@viswanathk243](https://discuss.elastic.co/u/viswanathk243)\ **Replies:** 1\ **Last updated:** [March 3, 2022, 3:07am UTC](https://discuss.elastic.co/t/elasticsearch-array-only-contains-query/298666 "2022-03-03T03:07:26Z")
Let's say I've data in this format: { "id": "doc0", "tags": \["a", "b", "c"\] } { "id": "doc1", "tags": \["a", "b", "c", "d"\] } { "id": "doc2", "tags": \["a", "b"\] } I need to form an ES query that fetches on… --- ## [Visualising Nested Objects in Kibana](https://discuss.elastic.co/t/visualising-nested-objects-in-kibana/254643)
**Author:** [@weiyentan](https://discuss.elastic.co/u/weiyentan)\ **Replies:** 7\ **Last updated:** [November 23, 2020, 6:59pm UTC](https://discuss.elastic.co/t/visualising-nested-objects-in-kibana/254643 "2020-11-23T18:59:44Z")
Hi, I am exploring using ELK and imported in this json document: { "\_index": "system-inventory-\[version\]}-2020.11.07", "\_type": "\_doc", "\_id": "O0X1o3UBD7PZ5Lh--gIu", "\_version": 1, "\_score": null, "\_source… --- ## [Create map layer from longitude and latitude](https://discuss.elastic.co/t/create-map-layer-from-longitude-and-latitude/251002)
**Author:** [@Luca\_Padovan](https://discuss.elastic.co/u/Luca_Padovan)\ **Replies:** 7\ **Last updated:** [October 5, 2020, 3:39pm UTC](https://discuss.elastic.co/t/create-map-layer-from-longitude-and-latitude/251002 "2020-10-05T15:39:34Z")
I want to create a kibana map using two float fields: lat and lon (latitude and longitude), but when i try to create a map in Kibana I can't do it because i don't have a geoip location field. How can i solve it? --- ## [Painless Scripted Field Based on Condition to Subtract Dates to get days](https://discuss.elastic.co/t/painless-scripted-field-based-on-condition-to-subtract-dates-to-get-days/219057)
**Author:** [@Ramya\_Tanikanti](https://discuss.elastic.co/u/Ramya_Tanikanti)\ **Replies:** 1\ **Last updated:** [February 12, 2020, 7:55pm UTC](https://discuss.elastic.co/t/painless-scripted-field-based-on-condition-to-subtract-dates-to-get-days/219057 "2020-02-12T19:55:53Z")
I want to find the difference between dates in days in a new field. I tried the following script and it's throwing error. What am I doing wrong? def diff = 0; if (doc\['delivery\_date'\].value != null) { diff = (doc\['de… --- ## [GeoIP filter - database file updated - restart required?](https://discuss.elastic.co/t/geoip-filter-database-file-updated-restart-required/155200)
**Author:** [@YaoChim](https://discuss.elastic.co/u/YaoChim)\ **Replies:** 1\ **Last updated:** [November 6, 2018, 12:21pm UTC](https://discuss.elastic.co/t/geoip-filter-database-file-updated-restart-required/155200 "2018-11-06T12:21:41Z")
I have the following filter in Logstash 6.4.2 if \[client\_ip\] !~ /^(10\\.|172\\.1\[6-9\]|172\\.2\[0-9\]|172\\.3\[0-1\]|192\\.168|127\\.)/ { geoip { database =\> "/opt/logstash/GeoLite2.mmdb" source =\> "client\_ip" … --- ## [Kafka messages not getting into elasticsearch/kibana](https://discuss.elastic.co/t/kafka-messages-not-getting-into-elasticsearch-kibana/139889)
**Author:** [@Jyothi\_Balla](https://discuss.elastic.co/u/Jyothi_Balla)\ **Replies:** 1\ **Last updated:** [July 20, 2018, 5:52pm UTC](https://discuss.elastic.co/t/kafka-messages-not-getting-into-elasticsearch-kibana/139889 "2018-07-20T17:52:11Z")
When i start the filebeat the log is sending from the filebeat to the kafka-topic(read by kafka-consumer) then this message is a input to the logstash which is getting in and then not able to view the message in the kiba… --- ## [Elasticsearch must\_not bool query is not working](https://discuss.elastic.co/t/elasticsearch-must-not-bool-query-is-not-working/127397)
**Author:** [@adf4st](https://discuss.elastic.co/u/adf4st)\ **Replies:** 1\ **Last updated:** [April 10, 2018, 7:27am UTC](https://discuss.elastic.co/t/elasticsearch-must-not-bool-query-is-not-working/127397 "2018-04-10T07:27:18Z")
I have a bool query with a filter and a must\_not clause. But when I execute the query I get results that contain the values specified in the must\_not clause. Any idea what I'm doing wrong? Query POST /test/\_search { … --- ## [Needed each row as a separate document with the columns as field](https://discuss.elastic.co/t/needed-each-row-as-a-separate-document-with-the-columns-as-field/118304)
**Author:** [@Darpan\_Kukreja](https://discuss.elastic.co/u/Darpan_Kukreja)\ **Replies:** 1\ **Last updated:** [February 3, 2018, 10:03am UTC](https://discuss.elastic.co/t/needed-each-row-as-a-separate-document-with-the-columns-as-field/118304 "2018-02-03T10:03:40Z")
Hi,we are planning to implement elasticsearch for retrieving records,we have already installed elasticsearch which is working fine abhishek@CASSANDRA02 star\_sd\_24jan\]$ curl -X GET 'http://localhost:9200' { "name" : "n… --- ## [Extract Sub string and reverse](https://discuss.elastic.co/t/extract-sub-string-and-reverse/37033)
**Author:** [@mvenkat\_in](https://discuss.elastic.co/u/mvenkat_in)\ **Replies:** 1\ **Last updated:** [December 13, 2015, 4:03pm UTC](https://discuss.elastic.co/t/extract-sub-string-and-reverse/37033 "2015-12-13T16:03:37Z")
Hi I have date & time filed in the log as below, which I have parsed to a filed in the logstash. 11-12-2015 10:00:00,301 However I want the date only in 2015-12-11 (YYYY-MM-DD) format into a variable, say event date i… --- ## [Filter problems](https://discuss.elastic.co/t/filter-problems/34827)
**Author:** [@Jackal9301](https://discuss.elastic.co/u/Jackal9301)\ **Replies:** 7\ **Last updated:** [November 17, 2015, 7:01pm UTC](https://discuss.elastic.co/t/filter-problems/34827 "2015-11-17T19:01:53Z")
Hey guys I'm trying to match a string in a filter. But the output isn't giving me what i'm expecting. The input is: \<36\>Nov 02 15:48:57 LCE: \[not-matched\] 0.0.0.0:0 -\> 10.1.116.173:0 :: filter{ grok{ match =\> {"mess… --- ## [Try to make es-hadoop run](https://discuss.elastic.co/t/try-to-make-es-hadoop-run/23009)
**Author:** [@stephane\_Verdy](https://discuss.elastic.co/u/stephane_Verdy)\ **Replies:** 7\ **Last updated:** [April 9, 2015, 12:57pm UTC](https://discuss.elastic.co/t/try-to-make-es-hadoop-run/23009 "2015-04-09T12:57:21Z")
Hi all, HDFS 2.6.0.2.2.0.0 Apache Hadoop Distributed File System Es-Hadoop : 2.1.0.Beta3 OS : Centos 6 When i start elasticsearch (hadoop jar elasticsearch-yarn-2.1.0.Beta3.jar -start es.version=2.1… --- ## [Locking down cluster with iptables](https://discuss.elastic.co/t/locking-down-cluster-with-iptables/10767)
**Author:** [@Bruce\_Lysik](https://discuss.elastic.co/u/Bruce_Lysik)\ **Replies:** 1\ **Last updated:** [February 18, 2013, 8:04am UTC](https://discuss.elastic.co/t/locking-down-cluster-with-iptables/10767 "2013-02-18T08:04:47Z")
Hi, I'm trying to setup iptables to lockdown my ES cluster to only speak to itself, my kibana frontend, and the logstash indexers. I'm having a difficult time figuring out what ports I need to leave open. There … --- ## [Alert results are showing incorrect](https://discuss.elastic.co/t/alert-results-are-showing-incorrect/298647)
**Author:** [@vishal\_bisa](https://discuss.elastic.co/u/vishal_bisa)\ **Replies:** 5\ **Last updated:** [March 10, 2022, 11:03am UTC](https://discuss.elastic.co/t/alert-results-are-showing-incorrect/298647 "2022-03-10T11:03:38Z")
Hi Team, I have created a watcher to detect for failed status in a particular index, attached the screenshot for reference. the watcher seems to be working fine, but when i have observed care fully the results are quit… --- ## [Elasticsearch is running but not showing in ElasticHead](https://discuss.elastic.co/t/elasticsearch-is-running-but-not-showing-in-elastichead/290377)
**Author:** [@userR](https://discuss.elastic.co/u/userR)\ **Replies:** 5\ **Last updated:** [November 29, 2021, 5:46pm UTC](https://discuss.elastic.co/t/elasticsearch-is-running-but-not-showing-in-elastichead/290377 "2021-11-29T17:46:40Z")
Hi, I checked the status of Elasticsearch and everything indicates that it is running. However, when I try to connect to elastichead or even look up the ip:port, it does not connect. Is this some sort of port issue? My E… --- ## [Bad charset encoding in field names (II)](https://discuss.elastic.co/t/bad-charset-encoding-in-field-names-ii/129715)
**Author:** [@Thiago\_Ruiz](https://discuss.elastic.co/u/Thiago_Ruiz)\ **Replies:** 5\ **Last updated:** [May 23, 2018, 6:02am UTC](https://discuss.elastic.co/t/bad-charset-encoding-in-field-names-ii/129715 "2018-05-23T06:02:18Z")
Hi! I have exactly the same issue as described by Ondřej Bílka on this thread: Since the discussion was closed I'm trying to reopen it again. All my files are in UTF-8 and just the dinamic fields are wrong - I have o… --- ## [Is it possible to remove the dev tools in the Kiban?](https://discuss.elastic.co/t/is-it-possible-to-remove-the-dev-tools-in-the-kiban/119430)
**Author:** [@aziz](https://discuss.elastic.co/u/aziz)\ **Replies:** 1\ **Last updated:** [February 12, 2018, 4:46pm UTC](https://discuss.elastic.co/t/is-it-possible-to-remove-the-dev-tools-in-the-kiban/119430 "2018-02-12T16:46:25Z")
Hello! Is it possible to set different accesses in kiban, so that for some users, for example, the "Dev tools" menu is not displayed? --- ## [Confluence Connector doesn't sync all the documents](https://discuss.elastic.co/t/confluence-connector-doesnt-sync-all-the-documents/249566)
**Author:** [@Prateek\_Yadav](https://discuss.elastic.co/u/Prateek_Yadav)\ **Replies:** 8\ **Last updated:** [September 25, 2020, 11:54am UTC](https://discuss.elastic.co/t/confluence-connector-doesnt-sync-all-the-documents/249566 "2020-09-25T11:54:12Z")
I have a cloud version of Elastic Enterprise search (7.9.1). I have integrated Confluence connector with it. After 2 weeks, it has just synced ~450 records, whereas there are more than 25k+ records in my space. There is … --- ## [ES Cluster Perf is lower than single node ES](https://discuss.elastic.co/t/es-cluster-perf-is-lower-than-single-node-es/243424)
**Author:** [@Yogesh\_BG](https://discuss.elastic.co/u/Yogesh_BG)\ **Replies:** 8\ **Last updated:** [August 5, 2020, 1:59pm UTC](https://discuss.elastic.co/t/es-cluster-perf-is-lower-than-single-node-es/243424 "2020-08-05T13:59:56Z")
Hi I am using ES veriosn 6.6.0 I use es for heavy load index, almost 20MBPS, ~80K rps HW deatails, each node is 88CPUc(44 core), 32GB(ES)+32GB(lucen) RAM, 5 SSDs RAID 10. each index is of size 60GB primary, total 120… --- ## [Pipeline config error](https://discuss.elastic.co/t/pipeline-config-error/197525)
**Author:** [@Philip\_Thomson1](https://discuss.elastic.co/u/Philip_Thomson1)\ **Replies:** 8\ **Last updated:** [August 30, 2019, 5:48pm UTC](https://discuss.elastic.co/t/pipeline-config-error/197525 "2019-08-30T17:48:28Z")
Maybe I have been staring at this too long and need another set of eyes to point out something silly.. Using logstash 7.3.1 started using pipelines, I have one running, but two defined, I get an error in the debug logs… --- ## [How to convert to JSON Query using Java HighlevelRestClient](https://discuss.elastic.co/t/how-to-convert-to-json-query-using-java-highlevelrestclient/196529)
**Author:** [@Sammeta\_David\_Raju](https://discuss.elastic.co/u/Sammeta_David_Raju)\ **Replies:** 8\ **Last updated:** [August 27, 2019, 9:41am UTC](https://discuss.elastic.co/t/how-to-convert-to-json-query-using-java-highlevelrestclient/196529 "2019-08-27T09:41:19Z")
ocalhost:9200/my\_index/\_mapping/doc { "properties": { "my\_field": { "type": "text", "fielddata": true } } } How to convert this to java API using HighLevelRestClient highlevelRestClient.se… --- ## [Mapping Type removal - Study of alternatives](https://discuss.elastic.co/t/mapping-type-removal-study-of-alternatives/102956)
**Author:** [@pokaleshrey](https://discuss.elastic.co/u/pokaleshrey)\ **Replies:** 2\ **Last updated:** [October 6, 2017, 8:10am UTC](https://discuss.elastic.co/t/mapping-type-removal-study-of-alternatives/102956 "2017-10-06T08:10:58Z")
Recently, i found that the mapping types will be removed once v6.0 is released. I would like to know the thoughts on suggested alternatives: Create index per type - I have around 30types. So indexes created will be 3… --- ## [Case Connectors](https://discuss.elastic.co/t/case-connectors/250733)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [October 7, 2020, 12:10pm UTC](https://discuss.elastic.co/t/case-connectors/250733 "2020-10-07T12:10:00Z")
Hello, Really like the Kibana case functionality. Unfortunately we aren't working with any of the supported case connector tools. Out ITSM tool is Ivanti Heat, which is not a small player in the ITSM market, see: I… --- ## [Cluster\_block\_exception: index \[.kibana\_security\_session\_1\] blocked by: \[TOO\_MANY\_REQUESTS/12/disk usage exceeded flood-stage watermark, index has read-only-allow-delete block\]](https://discuss.elastic.co/t/cluster-block-exception-index-kibana-security-session-1-blocked-by-too-many-requests-12-disk-usage-exceeded-flood-stage-watermark-index-has-read-only-allow-delete-block/366132)
**Author:** [@tuanlt7](https://discuss.elastic.co/u/tuanlt7)\ **Replies:** 2\ **Last updated:** [September 6, 2024, 8:46am UTC](https://discuss.elastic.co/t/cluster-block-exception-index-kibana-security-session-1-blocked-by-too-many-requests-12-disk-usage-exceeded-flood-stage-watermark-index-has-read-only-allow-delete-block/366132 "2024-09-06T08:46:19Z")
Dears Support Team, Today, I login to Elastic in Kibana but have error message \[2024-09-06T04:49:33.914+00:00\]\[ERROR\]\[plugins.security.user-profile\] Failed to activate user profile: { "error": { "root\_cause": \[ { … --- ## [Disable Elastic Cloud Login](https://discuss.elastic.co/t/disable-elastic-cloud-login/260967)
**Author:** [@apox](https://discuss.elastic.co/u/apox)\ **Replies:** 2\ **Last updated:** [January 14, 2021, 7:04am UTC](https://discuss.elastic.co/t/disable-elastic-cloud-login/260967 "2021-01-14T07:04:00Z")
Hi Guy, How can I disable the Elastic Cloud Login in Kibana and use online the Elasticsearch Login? --- ## [Kibana metricbeat default dashboard question about process count number?](https://discuss.elastic.co/t/kibana-metricbeat-default-dashboard-question-about-process-count-number/148277)
**Author:** [@Aftab\_Ali](https://discuss.elastic.co/u/Aftab_Ali)\ **Replies:** 2\ **Last updated:** [September 17, 2018, 10:34am UTC](https://discuss.elastic.co/t/kibana-metricbeat-default-dashboard-question-about-process-count-number/148277 "2018-09-17T10:34:56Z")
Dear ELK team, As you can see that in the image of my system there was showing in process count 25 or 26, i did not understand that what is that mean, i check in my system these was 256 task and 1 is running so that wh… --- ## [Viz of latest results of unique item: Not possible with Pie? Works for table, metric & bar chart](https://discuss.elastic.co/t/viz-of-latest-results-of-unique-item-not-possible-with-pie-works-for-table-metric-bar-chart/106427)
**Author:** [@BobENose](https://discuss.elastic.co/u/BobENose)\ **Replies:** 2\ **Last updated:** [November 8, 2017, 1:20pm UTC](https://discuss.elastic.co/t/viz-of-latest-results-of-unique-item-not-possible-with-pie-works-for-table-metric-bar-chart/106427 "2017-11-08T13:20:24Z")
I'm looking to represent in a Pie chart only the most recent result per test of my data set. I've managed to do this with Data Table visualizations, Metrics, and Bar charts, but Pie Charts seem to lack this ability tod… --- ## [Offline installation of X-Pack 5.2.2 on elastic search 5.2.2](https://discuss.elastic.co/t/offline-installation-of-x-pack-5-2-2-on-elastic-search-5-2-2/83189)
**Author:** [@anthble](https://discuss.elastic.co/u/anthble)\ **Replies:** 2\ **Last updated:** [April 23, 2017, 7:40am UTC](https://discuss.elastic.co/t/offline-installation-of-x-pack-5-2-2-on-elastic-search-5-2-2/83189 "2017-04-23T07:40:06Z")
Hi, i having some issue installing X-Pack 5.2.2 on elastic search 5.2.2. see below the result of the offline installation command. D:\\apps\\elasticsearch-5.2.2\\bin\>elasticsearch-plugin.bat install file://D:/apps/Inst… --- ## [Elasticsearch 5.0.0 as windows service won't start](https://discuss.elastic.co/t/elasticsearch-5-0-0-as-windows-service-wont-start/69154)
**Author:** [@chrisinho](https://discuss.elastic.co/u/chrisinho)\ **Replies:** 2\ **Last updated:** [December 16, 2016, 10:53am UTC](https://discuss.elastic.co/t/elasticsearch-5-0-0-as-windows-service-wont-start/69154 "2016-12-16T10:53:35Z")
Hi, i want to start elasticsearch as a windows service. I installed it, but when i try to start it then it it doesn't work. This is the stderr.log 2016-12-15 11:53:41 Commons Daemon procrun stderr initialized Excepti… --- ## [Unable to register s3 repo](https://discuss.elastic.co/t/unable-to-register-s3-repo/275959)
**Author:** [@sonujatav35](https://discuss.elastic.co/u/sonujatav35)\ **Replies:** 6\ **Last updated:** [July 8, 2021, 4:19am UTC](https://discuss.elastic.co/t/unable-to-register-s3-repo/275959 "2021-07-08T04:19:15Z")
Hi, Can someone advice me what will be possible cause of this kind of error. while register the s3 repo i am getting below error. "error" : { "root\_cause" : \[ { "type" : "repository\_verification\_excep… --- ## [Painless script unable to recognize special chars in String](https://discuss.elastic.co/t/painless-script-unable-to-recognize-special-chars-in-string/160820)
**Author:** [@vchang](https://discuss.elastic.co/u/vchang)\ **Replies:** 1\ **Last updated:** [December 20, 2018, 8:45pm UTC](https://discuss.elastic.co/t/painless-script-unable-to-recognize-special-chars-in-string/160820 "2018-12-20T20:45:40Z")
Hi Everyone, PLEASE HELP!! Kibana 5.4 My team and I are trying to do a simple task: Given a string, extract a specific part of a URL. For example if my string is "GET path="/social/holiday-gift-guide/..." we want to… --- ## [Deploy Kibana Docker with ready Dashboards](https://discuss.elastic.co/t/deploy-kibana-docker-with-ready-dashboards/140572)
**Author:** [@tan-tan-kanarek](https://discuss.elastic.co/u/tan-tan-kanarek)\ **Replies:** 1\ **Last updated:** [July 18, 2018, 4:04pm UTC](https://discuss.elastic.co/t/deploy-kibana-docker-with-ready-dashboards/140572 "2018-07-18T16:04:58Z")
Hi, In our RnD we define Kibana dashboards on Kibana and Elastic that deployed on Docker. In order to deploy the dashboards that defined by RnD in our staging and later in our production environments we need to manuall… --- ## [Elasticsearch\_Server](https://discuss.elastic.co/t/elasticsearch-server/82296)
**Author:** [@Chemse](https://discuss.elastic.co/u/Chemse)\ **Replies:** 1\ **Last updated:** [April 13, 2017, 1:47pm UTC](https://discuss.elastic.co/t/elasticsearch-server/82296 "2017-04-13T13:47:21Z")
Hello, How can I be able to insert data dynamically to elasticsearch from an existing server as " IIS server " for windows and from a database already existing " RDMS Oracle " for Linux ?? I've learn how to insert d… --- ## [Metricbeat - Error creating runner from config: failed to initialize condition](https://discuss.elastic.co/t/metricbeat-error-creating-runner-from-config-failed-to-initialize-condition/317449)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 4\ **Last updated:** [October 26, 2022, 7:02am UTC](https://discuss.elastic.co/t/metricbeat-error-creating-runner-from-config-failed-to-initialize-condition/317449 "2022-10-26T07:02:53Z")
Attempting to fetch various bean data from Jboss instances by means of jolokia some works others fail though I can fetch them with curl, any hints appreciated on what/which condition is missing or faulty, TIA! Getting e… --- ## [Query Conditionally Between Fields](https://discuss.elastic.co/t/query-conditionally-between-fields/298294)
**Author:** [@\_PA](https://discuss.elastic.co/u/_PA)\ **Replies:** 4\ **Last updated:** [February 25, 2022, 3:59pm UTC](https://discuss.elastic.co/t/query-conditionally-between-fields/298294 "2022-02-25T15:59:08Z")
Hi, I want to know if it is possible to perform a query in kibana to get the following results. I have a records that have common values between them and I want to query and get the results for the records that have mo… --- ## [Filter data in Maps view with max field value](https://discuss.elastic.co/t/filter-data-in-maps-view-with-max-field-value/277435)
**Author:** [@MAvD](https://discuss.elastic.co/u/MAvD)\ **Replies:** 4\ **Last updated:** [July 6, 2021, 10:04am UTC](https://discuss.elastic.co/t/filter-data-in-maps-view-with-max-field-value/277435 "2021-07-06T10:04:53Z")
Hi, In one of our Maps visualisation we want to show the data of the latest available measurement day. We would like to filter this data dynamically using a function similar to the Scaling option "Show top hits per enti… --- ## [Strange behaviour kv field\_split](https://discuss.elastic.co/t/strange-behaviour-kv-field-split/219234)
**Author:** [@Fred3](https://discuss.elastic.co/u/Fred3)\ **Replies:** 4\ **Last updated:** [March 11, 2020, 4:21pm UTC](https://discuss.elastic.co/t/strange-behaviour-kv-field-split/219234 "2020-03-11T16:21:09Z")
Hi All, I'm trying to parse a log with the character "|" as split field value. It works fine for all fields but I get extra fields which are really broken and consists of multiple field-value-pairs, e.g. 01-01015173|… --- ## [Xpack 5.3.0 is installed . But Machine learning is not showing in Kibana](https://discuss.elastic.co/t/xpack-5-3-0-is-installed-but-machine-learning-is-not-showing-in-kibana/109016)
**Author:** [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Replies:** 4\ **Last updated:** [November 24, 2017, 12:32pm UTC](https://discuss.elastic.co/t/xpack-5-3-0-is-installed-but-machine-learning-is-not-showing-in-kibana/109016 "2017-11-24T12:32:40Z")
Hi All, I have ELK 5.3.0 Server and Xpack 5.3.0 is installed in it. All are working well. But in Kibana Machine learning option is not available. Graph and Monitoring are available. Xpack Cofiguration in elasticse… --- ## [Tribenode and network stream \[Solved\]](https://discuss.elastic.co/t/tribenode-and-network-stream-solved/51523)
**Author:** [@dihpierrick](https://discuss.elastic.co/u/dihpierrick)\ **Replies:** 4\ **Last updated:** [June 2, 2016, 8:07am UTC](https://discuss.elastic.co/t/tribenode-and-network-stream-solved/51523 "2016-06-02T08:07:37Z")
Hello, I have configured a tribe node. It can talk to three data nodes. I see a constant TCP flow between a node and the tribe node. I wonder what is the tcp flow doing ? What sort of information it contains ? I can'… --- ## [Elasticsearch how to subtract field number value with specific number](https://discuss.elastic.co/t/elasticsearch-how-to-subtract-field-number-value-with-specific-number/318090)
**Author:** [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)\ **Replies:** 3\ **Last updated:** [November 3, 2022, 11:44am UTC](https://discuss.elastic.co/t/elasticsearch-how-to-subtract-field-number-value-with-specific-number/318090 "2022-11-03T11:44:36Z")
Hello I am looking for solution to prepare dashboard in which i need to prepare a visualization with difference value e.g. site performance field mentioned as 500ms but as per threshold it should be 200ms Field name "… --- ## [Logstash remove field](https://discuss.elastic.co/t/logstash-remove-field/297209)
**Author:** [@chandima\_jayamina](https://discuss.elastic.co/u/chandima_jayamina)\ **Replies:** 3\ **Last updated:** [February 15, 2022, 4:54pm UTC](https://discuss.elastic.co/t/logstash-remove-field/297209 "2022-02-15T16:54:10Z")
Hi I am new to ELK. I am thinking what is the best way to remove field. Just use mutate filter and remove field First set field to nil and then use mutate filter and remove What is the best way to remove the field. An… --- ## [Detecting empty fields not working as before in logstash 7.12.1](https://discuss.elastic.co/t/detecting-empty-fields-not-working-as-before-in-logstash-7-12-1/271764)
**Author:** [@mario\_wood](https://discuss.elastic.co/u/mario_wood)\ **Replies:** 3\ **Last updated:** [May 13, 2021, 3:18pm UTC](https://discuss.elastic.co/t/detecting-empty-fields-not-working-as-before-in-logstash-7-12-1/271764 "2021-05-13T15:18:34Z")
Hi, I'm migrating our logstash from 6.8 to 7.12 and I'm finding that the detection of empty fields is not working as it used to. For example given the input { "foo":"", "bar":"baz" } and the logstash filter if \[… --- ## [Can we use " :: " as a separator in csv filter in logstash](https://discuss.elastic.co/t/can-we-use-as-a-separator-in-csv-filter-in-logstash/246983)
**Author:** [@Shahid\_Mustafa](https://discuss.elastic.co/u/Shahid_Mustafa)\ **Replies:** 3\ **Last updated:** [September 1, 2020, 11:59am UTC](https://discuss.elastic.co/t/can-we-use-as-a-separator-in-csv-filter-in-logstash/246983 "2020-09-01T11:59:13Z")
Can we use following csv filter: I cannot test this directly in our system. csv { columns =\> \[ "LogLevel", "DateTime", "RequestID", "LogMessage" \] s… --- ## [Unknown state \<73\> for process with pid 22006](https://discuss.elastic.co/t/unknown-state-73-for-process-with-pid-22006/132604)
**Author:** [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Replies:** 3\ **Last updated:** [May 22, 2018, 11:01am UTC](https://discuss.elastic.co/t/unknown-state-73-for-process-with-pid-22006/132604 "2018-05-22T11:01:07Z")
This relates to https://github.com/elastic/beats/issues/6305 from what I can see. Running 6.2.4 with the docker and system modules enabled. From the verbose log to console; |2018-05-21T06:44:53.832+1000|INFO|template/l… --- ## [Delete runner(allocator?) failed](https://discuss.elastic.co/t/delete-runner-allocator-failed/75661)
**Author:** [@m-kiuchi](https://discuss.elastic.co/u/m-kiuchi)\ **Replies:** 3\ **Last updated:** [February 21, 2017, 12:53pm UTC](https://discuss.elastic.co/t/delete-runner-allocator-failed/75661 "2017-02-21T12:53:22Z")
When I'm going to remove one runner from ECE cluster, it failed. There is no log. I've checked following to see some log, but it shows nothing. docker logs -f \ docker logs -f \ journalctl … --- ## [Conditional filter in logstash](https://discuss.elastic.co/t/conditional-filter-in-logstash/61120)
**Author:** [@Roberto\_Iglesias](https://discuss.elastic.co/u/Roberto_Iglesias)\ **Replies:** 3\ **Last updated:** [September 26, 2016, 12:57pm UTC](https://discuss.elastic.co/t/conditional-filter-in-logstash/61120 "2016-09-26T12:57:16Z")
Hi and thanks for reading, i really appreciate that. I continue having troubles with logstash filters. In this case, i don't know how to handle conditionals with arrays. I have this field "amavis\_action" and its content… --- ## [Using KV filter](https://discuss.elastic.co/t/using-kv-filter/56221)
**Author:** [@soodlikesjava](https://discuss.elastic.co/u/soodlikesjava)\ **Replies:** 3\ **Last updated:** [July 24, 2016, 2:11am UTC](https://discuss.elastic.co/t/using-kv-filter/56221 "2016-07-24T02:11:49Z")
Hi team I have a requirement to create fields by matching key\>value in the event . but KV filter should consider only those KV filters which are enclosed under brackets like message : logging data (key1\>value1,key2\>val… --- ## [Help with org.xbib.logging.log4j2 appender](https://discuss.elastic.co/t/help-with-org-xbib-logging-log4j2-appender/53825)
**Author:** [@jonas.lima](https://discuss.elastic.co/u/jonas.lima)\ **Replies:** 3\ **Last updated:** [June 23, 2016, 10:17pm UTC](https://discuss.elastic.co/t/help-with-org-xbib-logging-log4j2-appender/53825 "2016-06-23T22:17:46Z")
The appender not send my logs to elastic. What's wrong ?? In kibana or quering in elasticsearch doesn't find any index. In java code using log4j2: private static final Logger log = LogManager.getLogger(ApplicationMain.… --- ## [Parsing .db file in Logstash](https://discuss.elastic.co/t/parsing-db-file-in-logstash/52087)
**Author:** [@anonymus123](https://discuss.elastic.co/u/anonymus123)\ **Replies:** 3\ **Last updated:** [June 8, 2016, 6:39am UTC](https://discuss.elastic.co/t/parsing-db-file-in-logstash/52087 "2016-06-08T06:39:25Z")
Hello, Im looking for a way in which i can forward .db file to logstash and parse the events in this file. What is the best way for doing so? The logs are aggregated in one .db file on a windows workstation by some appli… --- ## [List of fields in Indicies - Configure Index Pattern in Kibana](https://discuss.elastic.co/t/list-of-fields-in-indicies-configure-index-pattern-in-kibana/41565)
**Author:** [@Karthik\_Ramachandran](https://discuss.elastic.co/u/Karthik_Ramachandran)\ **Replies:** 3\ **Last updated:** [February 12, 2016, 12:03am UTC](https://discuss.elastic.co/t/list-of-fields-in-indicies-configure-index-pattern-in-kibana/41565 "2016-02-12T00:03:57Z")
I created an index with type mapping and uploaded few contents. In type mapping, I created types for attributes "PublishedTime" and "PublishedTimeGMT". I also ensured that all the documents/content I indexed do have the … --- ## [My ZXTM logs not shipping to Elastic Search From Logstash](https://discuss.elastic.co/t/my-zxtm-logs-not-shipping-to-elastic-search-from-logstash/94945)
**Author:** [@kolli\_dilip](https://discuss.elastic.co/u/kolli_dilip)\ **Replies:** 5\ **Last updated:** [August 4, 2017, 11:58am UTC](https://discuss.elastic.co/t/my-zxtm-logs-not-shipping-to-elastic-search-from-logstash/94945 "2017-08-04T11:58:12Z")
Dear All, Can some one help me to resolve the issue, where the ZXTM logs are not being shipped to ES. The logstash config is as below input { file { type =\> “ZXTMLogs” path =\>\[ “F:/UKBlogsstachconfiguration/Log… [Previous page](https://discuss.elastic.co/top.md?page=1387&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1389&per_page=50&period=all)