# Top

**URL:** https://discuss.elastic.co/top.md?page=1437&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1438

---

## [Elastic-Agent - Collect Custom \[Linux\] text file logs](https://discuss.elastic.co/t/elastic-agent-collect-custom-linux-text-file-logs/339593)

<div class="topic-metadata">

**Author:** [@Bryan\_Hamilton](https://discuss.elastic.co/u/Bryan_Hamilton)\
**Replies:** 2\
**Last updated:** [August 2, 2023, 9:39pm UTC](https://discuss.elastic.co/t/elastic-agent-collect-custom-linux-text-file-logs/339593 "2023-08-02T21:39:08Z")

</div>

Hi, I have created a github issue for this question (Support for Custom \[Linux\] text file logs · Issue #7186 · elastic/integrations · GitHub), but I am also adding it here for greater visibility. We have custom applica…

---

## [Popular Fields](https://discuss.elastic.co/t/popular-fields/312827)

<div class="topic-metadata">

**Author:** [@tepus](https://discuss.elastic.co/u/tepus)\
**Replies:** 2\
**Last updated:** [September 6, 2022, 10:05am UTC](https://discuss.elastic.co/t/popular-fields/312827 "2022-09-06T10:05:36Z")

</div>

Hello Community, there are Popular fields collected out from the Available Fields on the left-hand side of Discover in Kibana. The customer wants them to be adjusted to each user as well as to each data view. Therefore…

---

## [How to get License for on-premise stack](https://discuss.elastic.co/t/how-to-get-license-for-on-premise-stack/271799)

<div class="topic-metadata">

**Author:** [@twilight](https://discuss.elastic.co/u/twilight)\
**Replies:** 2\
**Last updated:** [May 5, 2021, 10:46pm UTC](https://discuss.elastic.co/t/how-to-get-license-for-on-premise-stack/271799 "2021-05-05T22:46:43Z")

</div>

Hello, I have been using some Gold features on trial and now we have decided to buy and implement the license into our on-prem ES and Kibana setup. I have been trying to find where do we select the license type, pay an…

---

## [Fleet won't Work in Kibana](https://discuss.elastic.co/t/fleet-wont-work-in-kibana/259274)

<div class="topic-metadata">

**Author:** [@haythem](https://discuss.elastic.co/u/haythem)\
**Replies:** 2\
**Last updated:** [January 14, 2021, 10:54am UTC](https://discuss.elastic.co/t/fleet-wont-work-in-kibana/259274 "2021-01-14T10:54:36Z")

</div>

Hi guys , lately i downloaded the ELK latest version (7.10.1) and the latest version of the elastic Agent , when i start kibana the fleet tab won't show a thing, it keeps on loanding and then shows me this message \> Unab…

---

## [KIbana 7.6.2 with SSL](https://discuss.elastic.co/t/kibana-7-6-2-with-ssl/232471)

<div class="topic-metadata">

**Author:** [@jgarbora](https://discuss.elastic.co/u/jgarbora)\
**Replies:** 2\
**Last updated:** [May 13, 2020, 8:34pm UTC](https://discuss.elastic.co/t/kibana-7-6-2-with-ssl/232471 "2020-05-13T20:34:00Z")

</div>

I am trying to enable SSL in Kibana ... and I am getting: Error: 139959624402752:error:14094418:SSL routines:ssl3\_read\_bytes:tlsv1 alert unknown ca:../deps/openssl/openssl/ssl/record/rec\_layer\_s3.c:1544:SSL alert number…

---

## [Problem with custom filter sub aggregations in area visualization](https://discuss.elastic.co/t/problem-with-custom-filter-sub-aggregations-in-area-visualization/188376)

<div class="topic-metadata">

**Author:** [@letailli](https://discuss.elastic.co/u/letailli)\
**Replies:** 2\
**Last updated:** [July 2, 2019, 8:44am UTC](https://discuss.elastic.co/t/problem-with-custom-filter-sub-aggregations-in-area-visualization/188376 "2019-07-02T08:44:01Z")

</div>

I try to represent trough time documents containing reference to some countries and not containing them. I set 2 filters GET /article/\_search { "size": 0, "aggs" : { "country" : { "filter":{ "bo…

---

## [Painless Scripted Field - TimeStamp - Regex](https://discuss.elastic.co/t/painless-scripted-field-timestamp-regex/138229)

<div class="topic-metadata">

**Author:** [@vvaidya](https://discuss.elastic.co/u/vvaidya)\
**Replies:** 2\
**Last updated:** [July 2, 2018, 7:20pm UTC](https://discuss.elastic.co/t/painless-scripted-field-timestamp-regex/138229 "2018-07-02T19:20:26Z")

</div>

Hello Team, I need help fetching Timestamp from the specific Kibana field. I'm using below painless script, but I get unexpected character \\\\ error. Can you please suggest the correct way. I could use split, but the tim…

---

## [Русская морфология для 6.0](https://discuss.elastic.co/t/6-0/115838)

<div class="topic-metadata">

**Author:** [@bio](https://discuss.elastic.co/u/bio)\
**Replies:** 2\
**Last updated:** [January 30, 2018, 1:55pm UTC](https://discuss.elastic.co/t/6-0/115838 "2018-01-30T13:55:39Z")

</div>

Добрый день! Скажите пож-та, есть ли какие либо аналоги русской морфологии для 6й версии ? Насколько я понимаю, этот плагин зависит от другой библиотеки, которую нужно обновить, но пока не известно когда это произойдёт…

---

## [\[6.1.1\] User Management: Field/Document Level Security + Multi-Tenancy](https://discuss.elastic.co/t/6-1-1-user-management-field-document-level-security-multi-tenancy/114960)

<div class="topic-metadata">

**Author:** [@gmatheus](https://discuss.elastic.co/u/gmatheus)\
**Replies:** 2\
**Last updated:** [January 24, 2018, 6:32pm UTC](https://discuss.elastic.co/t/6-1-1-user-management-field-document-level-security-multi-tenancy/114960 "2018-01-24T18:32:38Z")

</div>

Hello! I'm having some issues configuring users and roles using Kibana 6.1.1 + X-Pack. Here's my config: User: { "limited-user": { "username": "limited-user", "roles": \[ "limited-user", "kibana…

---

## [Metricbeat service terminates when \`or\` condition in \`drop\_event\`](https://discuss.elastic.co/t/metricbeat-service-terminates-when-or-condition-in-drop-event/114365)

<div class="topic-metadata">

**Author:** [@amjadcas](https://discuss.elastic.co/u/amjadcas)\
**Replies:** 2\
**Last updated:** [January 8, 2018, 10:45pm UTC](https://discuss.elastic.co/t/metricbeat-service-terminates-when-or-condition-in-drop-event/114365 "2018-01-08T22:45:13Z")

</div>

I'm using Metricbeat 6.1.1 on a Windows Server 2012. My goal is to monitor services, but not all. I'm using the drop\_event processor to exclude events and the or condition to specify the services to exclude. - module:…

---

## [\_jsonparsefailure - What is the problem?](https://discuss.elastic.co/t/-jsonparsefailure-what-is-the-problem/96110)

<div class="topic-metadata">

**Author:** [@ssasporta](https://discuss.elastic.co/u/ssasporta)\
**Replies:** 2\
**Last updated:** [August 8, 2017, 8:18am UTC](https://discuss.elastic.co/t/-jsonparsefailure-what-is-the-problem/96110 "2017-08-08T08:18:13Z")

</div>

My input looks like that: 10.108.2.44 "73.91.231.150, 10.10.10.165" - - \[26/Jul/2017:00:00:00 -0500\] "GET /wod/landing?c=e&macId=90%3Ac7%3Ad8%3Afa%3A78%3Ae9&location=WODTrial&apMacId=10%3A56%3A11%3A15%3Ad3%3A8d&a=as&bn=…

---

## [Date range histogram visualisation incorrect](https://discuss.elastic.co/t/date-range-histogram-visualisation-incorrect/52632)

<div class="topic-metadata">

**Author:** [@sharon.c](https://discuss.elastic.co/u/sharon.c)\
**Replies:** 2\
**Last updated:** [June 14, 2016, 1:45pm UTC](https://discuss.elastic.co/t/date-range-histogram-visualisation-incorrect/52632 "2016-06-14T13:45:49Z")

</div>

I am using kibana 4.5 and elasticsearch 2.3 I generated a date histogram as follows, it compares two days values broken down by hours I actually want the histogram to be like this, the two days values are aligned pro…

---

## [Logstash input with filtered output](https://discuss.elastic.co/t/logstash-input-with-filtered-output/266951)

<div class="topic-metadata">

**Author:** [@djehuty](https://discuss.elastic.co/u/djehuty)\
**Replies:** 8\
**Last updated:** [March 12, 2021, 3:48pm UTC](https://discuss.elastic.co/t/logstash-input-with-filtered-output/266951 "2021-03-12T15:48:18Z")

</div>

I need to divide Winlogbeat input and push it to two separate indices when a beat has a particular event ID. I used an if statement but the indices seems to have the same data. This is my pipeline configuration: i…

---

## [Validation Failed: 1: mapping type is missing](https://discuss.elastic.co/t/validation-failed-1-mapping-type-is-missing/166629)

<div class="topic-metadata">

**Author:** [@liran](https://discuss.elastic.co/u/liran)\
**Replies:** 0\
**Last updated:** [January 31, 2019, 7:03pm UTC](https://discuss.elastic.co/t/validation-failed-1-mapping-type-is-missing/166629 "2019-01-31T19:03:49Z")

</div>

Hi, I'm a newbie to the ELK stack and I'm probably stuck due a syntax error. Any help would be most appreciated. I've installed ES and I'm trying to create a mapping for my index to fit the following json: { "facets…

---

## [How to reach a cluster using http no matter which machine is master](https://discuss.elastic.co/t/how-to-reach-a-cluster-using-http-no-matter-which-machine-is-master/22447)

<div class="topic-metadata">

**Author:** [@Dennis](https://discuss.elastic.co/u/Dennis)\
**Replies:** 8\
**Last updated:** [March 1, 2015, 3:30am UTC](https://discuss.elastic.co/t/how-to-reach-a-cluster-using-http-no-matter-which-machine-is-master/22447 "2015-03-01T03:30:34Z")

</div>

One of the top level things I dnoj't understand about large installations is how to reach the cluster when a master node fails and a new master is elected. Let's say that I/we have this scenario: 5 machines in…

---

## [KNN search with Function score or Scoring script](https://discuss.elastic.co/t/knn-search-with-function-score-or-scoring-script/356432)

<div class="topic-metadata">

**Author:** [@Yevgeny\_Yurgenson](https://discuss.elastic.co/u/Yevgeny_Yurgenson)\
**Replies:** 3\
**Last updated:** [March 29, 2024, 4:59pm UTC](https://discuss.elastic.co/t/knn-search-with-function-score-or-scoring-script/356432 "2024-03-29T16:59:45Z")

</div>

I would like to incorporate a decay function based off of a time field attached to a vector when conducting a KNN search. I am using the Kotlin client. WIth a regular query, this would be done through the function score …

---

## [Some questions on system.diskio latency metrics](https://discuss.elastic.co/t/some-questions-on-system-diskio-latency-metrics/326817)

<div class="topic-metadata">

**Author:** [@CatLoveFishma](https://discuss.elastic.co/u/CatLoveFishma)\
**Replies:** 3\
**Last updated:** [March 2, 2023, 7:00am UTC](https://discuss.elastic.co/t/some-questions-on-system-diskio-latency-metrics/326817 "2023-03-02T07:00:31Z")

</div>

Hello, I am trying to get a better understanding of the disk io metrics below. Included are the definitions for each per the Elastic documentation online. system.diskio.read.time - total number of milliseconds spent by…

---

## [Visualization confusion - new pie chart layer includes previous layers](https://discuss.elastic.co/t/visualization-confusion-new-pie-chart-layer-includes-previous-layers/117523)

<div class="topic-metadata">

**Author:** [@dorj1234](https://discuss.elastic.co/u/dorj1234)\
**Replies:** 3\
**Last updated:** [January 30, 2018, 7:12pm UTC](https://discuss.elastic.co/t/visualization-confusion-new-pie-chart-layer-includes-previous-layers/117523 "2018-01-30T19:12:42Z")

</div>

Hello, I hope my screenshots can explain the problem simply. I created a pie chart that forms a range (percentage) of a few slices representing 0-100% Each slice counts a separate set. However, see screenshots - each s…

---

## [Elasticsearch API vs CURL calls](https://discuss.elastic.co/t/elasticsearch-api-vs-curl-calls/107911)

<div class="topic-metadata">

**Author:** [@Marek\_Steplewksi](https://discuss.elastic.co/u/Marek_Steplewksi)\
**Replies:** 3\
**Last updated:** [November 16, 2017, 1:09pm UTC](https://discuss.elastic.co/t/elasticsearch-api-vs-curl-calls/107911 "2017-11-16T13:09:57Z")

</div>

Hi first post so excuse my lack of knowledge, I currently have a php script pushing data to elasticsearch via a curl call, and was thinking about changing this to use the API and have 2 questions :slight\_smile: Is th…

---

## [Kibana role for read logs](https://discuss.elastic.co/t/kibana-role-for-read-logs/99955)

<div class="topic-metadata">

**Author:** [@nsivabalan](https://discuss.elastic.co/u/nsivabalan)\
**Replies:** 3\
**Last updated:** [September 11, 2017, 6:55am UTC](https://discuss.elastic.co/t/kibana-role-for-read-logs/99955 "2017-09-11T06:55:17Z")

</div>

Hi Team, Which exisiting role will be used for give the user access with read only permission to search logs? Thanks in advance, Siva

---

## [Can a Beat read from the ES database and is message queuing built into the Beats architecture?](https://discuss.elastic.co/t/can-a-beat-read-from-the-es-database-and-is-message-queuing-built-into-the-beats-architecture/69342)

<div class="topic-metadata">

**Author:** [@baden0x1](https://discuss.elastic.co/u/baden0x1)\
**Replies:** 3\
**Last updated:** [December 19, 2016, 7:39pm UTC](https://discuss.elastic.co/t/can-a-beat-read-from-the-es-database-and-is-message-queuing-built-into-the-beats-architecture/69342 "2016-12-19T19:39:53Z")

</div>

From what I have read so far, Beats executes a cron job based on file-based configuration parameters. 1) Is there a way for a Beat to read from the ElasticSearch database to determine what to do - i.e. what URL to cr…

---

## [Downgrade from 5.0.0-alpha to 2.4.1 Fails](https://discuss.elastic.co/t/downgrade-from-5-0-0-alpha-to-2-4-1-fails/63024)

<div class="topic-metadata">

**Author:** [@Kobi\_Jacobson](https://discuss.elastic.co/u/Kobi_Jacobson)\
**Replies:** 3\
**Last updated:** [October 14, 2016, 7:43am UTC](https://discuss.elastic.co/t/downgrade-from-5-0-0-alpha-to-2-4-1-fails/63024 "2016-10-14T07:43:25Z")

</div>

Installed 5.0.0-alpha on CentOS 7 (VirtualBox) which worked ok but I had some issues with the JAVA API documentation. Tried to downgrade to 2.4.1 and when ES starts I get the following error (appears on the cluster log f…

---

## [Update\_by\_query python API](https://discuss.elastic.co/t/update-by-query-python-api/45947)

<div class="topic-metadata">

**Author:** [@alienmind](https://discuss.elastic.co/u/alienmind)\
**Replies:** 0\
**Last updated:** [March 31, 2016, 1:47pm UTC](https://discuss.elastic.co/t/update-by-query-python-api/45947 "2016-03-31T13:47:54Z")

</div>

I'm migrating some client side code (Python) that combined search with templates and update to the newest update\_by\_query API (https://www.elastic.co/guide/en/elasticsearch/reference/2.3/docs-update-by-query.html) I ha…

---

## [How can I generate a CEF output](https://discuss.elastic.co/t/how-can-i-generate-a-cef-output/331867)

<div class="topic-metadata">

**Author:** [@CyberGuy](https://discuss.elastic.co/u/CyberGuy)\
**Replies:** 1\
**Last updated:** [May 1, 2023, 4:53pm UTC](https://discuss.elastic.co/t/how-can-i-generate-a-cef-output/331867 "2023-05-01T16:53:42Z")

</div>

I have created a logstash configuration that successfully parses CEF logs and applies certain logic to it. The filter configuration extracts the CEF with a grok filter and then uses the kv plugin to extract the different…

---

## [Elasticsearch 5.3 EC2 Discovery Issue](https://discuss.elastic.co/t/elasticsearch-5-3-ec2-discovery-issue/84097)

<div class="topic-metadata">

**Author:** [@bobby259](https://discuss.elastic.co/u/bobby259)\
**Replies:** 1\
**Last updated:** [April 29, 2017, 8:56pm UTC](https://discuss.elastic.co/t/elasticsearch-5-3-ec2-discovery-issue/84097 "2017-04-29T20:56:44Z")

</div>

Hi everyone, I have built 3 master nodes and 6 data nodes on ec2 instances. I am unable to have my nodes discover each other. Is there any reference? I have looked at the documentation and followed the same but it does…

---

## [Index Patterns Warning No default index pattern](https://discuss.elastic.co/t/index-patterns-warning-no-default-index-pattern/63097)

<div class="topic-metadata">

**Author:** [@syswombat](https://discuss.elastic.co/u/syswombat)\
**Replies:** 1\
**Last updated:** [October 15, 2016, 9:06pm UTC](https://discuss.elastic.co/t/index-patterns-warning-no-default-index-pattern/63097 "2016-10-15T21:06:06Z")

</div>

Hello after a lot of trial and error with the Installation i have got a running ELK. But when i went to the homepage it say Index Patterns Warning No default index pattern. You must select or create one to continue. …

---

## [複数のlogを重ねて表示するには？](https://discuss.elastic.co/t/log/54587)

<div class="topic-metadata">

**Author:** [@beginer](https://discuss.elastic.co/u/beginer)\
**Replies:** 1\
**Last updated:** [July 7, 2016, 1:50am UTC](https://discuss.elastic.co/t/log/54587 "2016-07-07T01:50:15Z")

</div>

度々すいません、ビギナーです 現在 nginxのlogとcloud frontのlogをelasticsearchに蓄積しています これらはlogの形式は異なりますが 同一時刻の送信量をkibanaで表示したいのですが 現在はkibanaのダッシュボードで別々のグラフとして表示して それを目視で合計して これぐらいの配信だろうと見ています もし可能なら この蓄積されたlogから kabana上で１つのグラフに 積み重ねたよう…

---

## [Allow only localhost access](https://discuss.elastic.co/t/allow-only-localhost-access/11208)

<div class="topic-metadata">

**Author:** [@Samuel\_Molnar](https://discuss.elastic.co/u/Samuel_Molnar)\
**Replies:** 1\
**Last updated:** [March 19, 2013, 3:25pm UTC](https://discuss.elastic.co/t/allow-only-localhost-access/11208 "2013-03-19T15:25:42Z")

</div>

How can allow only local requests for elasticsearch? So command like: curl -XGET 'http://localhost:9200/twitter/\_settings' can only be running on localhost and request like: curl -XGET 'http://mydomain.com:9200…

---

## [Elastic Cloud - Datadog Integration - Failing](https://discuss.elastic.co/t/elastic-cloud-datadog-integration-failing/354100)

<div class="topic-metadata">

**Author:** [@csr1](https://discuss.elastic.co/u/csr1)\
**Replies:** 4\
**Last updated:** [February 26, 2024, 4:23pm UTC](https://discuss.elastic.co/t/elastic-cloud-datadog-integration-failing/354100 "2024-02-26T16:23:18Z")

</div>

I am trying to integrate Datadog with Elastic Cloud for monitoring the deployments. But I am getting the below error when following the instructions. Any suggestions: Error: Your Elastic Cloud credentials are not auth…

---

## [Transform aggregation creates flattened record](https://discuss.elastic.co/t/transform-aggregation-creates-flattened-record/309657)

<div class="topic-metadata">

**Author:** [@dimuskin](https://discuss.elastic.co/u/dimuskin)\
**Replies:** 4\
**Last updated:** [July 19, 2022, 6:09am UTC](https://discuss.elastic.co/t/transform-aggregation-creates-flattened-record/309657 "2022-07-19T06:09:31Z")

</div>

I use transformation for data preprocessing, in my case every second rps are created for each host { "id": "appgw-rps-host", "source": { "index": \[ "logs-azure.platformlogs-default" \] }, "dest": { …

---

## [Node communication](https://discuss.elastic.co/t/node-communication/284199)

<div class="topic-metadata">

**Author:** [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\
**Replies:** 4\
**Last updated:** [September 15, 2021, 11:20am UTC](https://discuss.elastic.co/t/node-communication/284199 "2021-09-15T11:20:30Z")

</div>

I have 3 elastic nodes, I am trying to establish connection between 3 nodes, but not able to establish communication between nodes. Below is the elasticsearch.yml file, please let me what am I doing wrong. # ===========…

---

## [Index mapping shows key as "object", Kibana Management as "string"](https://discuss.elastic.co/t/index-mapping-shows-key-as-object-kibana-management-as-string/243595)

<div class="topic-metadata">

**Author:** [@A\_B](https://discuss.elastic.co/u/A_B)\
**Replies:** 4\
**Last updated:** [August 5, 2020, 3:05pm UTC](https://discuss.elastic.co/t/index-mapping-shows-key-as-object-kibana-management-as-string/243595 "2020-08-05T15:05:49Z")

</div>

Hello all, I'm trying to understand why Kibana \> Management \> Index Patterns shows me one thing and using Dev Tools to query API shows me another. Some of our logs have the key json.user\_agent. In Kibana \> Management \>…

---

## [Elasticsearch Upgrade 1.x to 2.x](https://discuss.elastic.co/t/elasticsearch-upgrade-1-x-to-2-x/136302)

<div class="topic-metadata">

**Author:** [@Mozuffer](https://discuss.elastic.co/u/Mozuffer)\
**Replies:** 4\
**Last updated:** [June 19, 2018, 8:21am UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-1-x-to-2-x/136302 "2018-06-19T08:21:09Z")

</div>

Hi Guys, I'm trying to upgrade elasticsearch-1.4.5 to elasticsearch 2.x but I'm getting the following error on elasticsearch.log, and I can see from error message it's something related to index mapping. but I have arou…

---

## [DRP and ElasticSearch](https://discuss.elastic.co/t/drp-and-elasticsearch/104355)

<div class="topic-metadata">

**Author:** [@jfortias](https://discuss.elastic.co/u/jfortias)\
**Replies:** 4\
**Last updated:** [October 18, 2017, 10:20am UTC](https://discuss.elastic.co/t/drp-and-elasticsearch/104355 "2017-10-18T10:20:45Z")

</div>

Hello I have a problem of architecture (infra) : I have an ES Cluster running well. But I would lile to deploy a copy of this cluster in another site (far 1000 km) .... I would like to align in almost real time both sit…

---

## [Query match in elasticsearch](https://discuss.elastic.co/t/query-match-in-elasticsearch/42607)

<div class="topic-metadata">

**Author:** [@Hilal](https://discuss.elastic.co/u/Hilal)\
**Replies:** 4\
**Last updated:** [February 25, 2016, 9:09am UTC](https://discuss.elastic.co/t/query-match-in-elasticsearch/42607 "2016-02-25T09:09:25Z")

</div>

Hi, I want to do text query but my query result is not true. For example: Text1: Road will be made in Turkey Text2: Mosque will be made Text3: They are comming Query: http://10.0.2.15:8080/filter.php?text\_field=Road…

---

## [Tabs in kibana dashboard?](https://discuss.elastic.co/t/tabs-in-kibana-dashboard/337041)

<div class="topic-metadata">

**Author:** [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\
**Replies:** 5\
**Last updated:** [June 28, 2023, 9:35am UTC](https://discuss.elastic.co/t/tabs-in-kibana-dashboard/337041 "2023-06-28T09:35:13Z")

</div>

Hi, is it possible to add tabs in a kibana dashboard? with different visualizations in different tabs?

---

## [Logstash aggregate array of objects based on key field](https://discuss.elastic.co/t/logstash-aggregate-array-of-objects-based-on-key-field/250249)

<div class="topic-metadata">

**Author:** [@rfferrao](https://discuss.elastic.co/u/rfferrao)\
**Replies:** 5\
**Last updated:** [September 29, 2020, 12:11am UTC](https://discuss.elastic.co/t/logstash-aggregate-array-of-objects-based-on-key-field/250249 "2020-09-29T00:11:22Z")

</div>

I'm receiving some logs like these: datetime="2020-09-2020T14:40:00-0300" action="tunnel-up" tunneltype="ssl-tunnel" tunnelid=1171992131 remip=192.168.0.1 user="someuser" group="vpn\_ssl\_group" and datetime="2020-09-20…

---

## [Wildcard query on text field](https://discuss.elastic.co/t/wildcard-query-on-text-field/311676)

<div class="topic-metadata">

**Author:** [@maxfriz](https://discuss.elastic.co/u/maxfriz)\
**Replies:** 2\
**Last updated:** [August 16, 2022, 2:11pm UTC](https://discuss.elastic.co/t/wildcard-query-on-text-field/311676 "2022-08-16T14:11:41Z")

</div>

From a best practice and cautionary perspective, am I missing any other critical information I should be considering specific to a wildcard query on a text field? See bullets below. I have reviewed the documentation i…

---

## [Dense\_vector in oss ES 7.6](https://discuss.elastic.co/t/dense-vector-in-oss-es-7-6/288471)

<div class="topic-metadata">

**Author:** [@gchakkalakkal](https://discuss.elastic.co/u/gchakkalakkal)\
**Replies:** 2\
**Last updated:** [November 5, 2021, 7:38am UTC](https://discuss.elastic.co/t/dense-vector-in-oss-es-7-6/288471 "2021-11-05T07:38:39Z")

</div>

hi All, Is dense\_vector available in OSS version of ES 7.6. As i getting below error while trying to create index using dense\_vector field type. "reason" : "No handler for type \[dense\_vector\] declared on field \[my\_vec…

---

## [Stemming en français?](https://discuss.elastic.co/t/stemming-en-francais/236480)

<div class="topic-metadata">

**Author:** [@bkazez](https://discuss.elastic.co/u/bkazez)\
**Replies:** 2\
**Last updated:** [June 18, 2020, 8:32am UTC](https://discuss.elastic.co/t/stemming-en-francais/236480 "2020-06-18T08:32:11Z")

</div>

Bonjour, J'ai posté dans le forum principal sur mes difficultés avec les algorithmes pour du stemming en français et je voulais juste demander ici si quelqu'un avait déjà trouvé des solutions ? Brèvement : le stemmer f…

---

## [Sudo password for elastic user](https://discuss.elastic.co/t/sudo-password-for-elastic-user/227806)

<div class="topic-metadata">

**Author:** [@wavehunter](https://discuss.elastic.co/u/wavehunter)\
**Replies:** 2\
**Last updated:** [April 19, 2020, 8:55pm UTC](https://discuss.elastic.co/t/sudo-password-for-elastic-user/227806 "2020-04-19T20:55:26Z")

</div>

I am taking the intro to observability course and kind of hit a road block. There is a strigo lab environment which I need to download and install filebeats. The instructions send you to the page below to download but yo…

---

## [How to add and process private custom attributes in elastic-apm-traceparent?](https://discuss.elastic.co/t/how-to-add-and-process-private-custom-attributes-in-elastic-apm-traceparent/213033)

<div class="topic-metadata">

**Author:** [@EDDYCJY](https://discuss.elastic.co/u/EDDYCJY)\
**Replies:** 2\
**Last updated:** [January 6, 2020, 8:19am UTC](https://discuss.elastic.co/t/how-to-add-and-process-private-custom-attributes-in-elastic-apm-traceparent/213033 "2020-01-06T08:19:34Z")

</div>

Kibana version: v7.4.2 Elasticsearch version: v7.4.2 APM Server version: v7.4.2 APM Agent language and version: v1.6.0 Question: We hope to implement a requirement to add a private attribute identifier to the ex…

---

## [Elastic user not able to authenticate after full cluster restart](https://discuss.elastic.co/t/elastic-user-not-able-to-authenticate-after-full-cluster-restart/168684)

<div class="topic-metadata">

**Author:** [@prabhakar\_talari](https://discuss.elastic.co/u/prabhakar_talari)\
**Replies:** 2\
**Last updated:** [February 18, 2019, 8:28am UTC](https://discuss.elastic.co/t/elastic-user-not-able-to-authenticate-after-full-cluster-restart/168684 "2019-02-18T08:28:52Z")

</div>

All, We have enabled TLS and restarted full cluster. but elastic user is not able to authenticate with cluster getting below error { "error" : { "root\_cause" : \[ { "type" : "security\_exception", "reason" : "failed…

---

## [Filebeat kubernetes](https://discuss.elastic.co/t/filebeat-kubernetes/150345)

<div class="topic-metadata">

**Author:** [@garcia](https://discuss.elastic.co/u/garcia)\
**Replies:** 2\
**Last updated:** [October 5, 2018, 11:25am UTC](https://discuss.elastic.co/t/filebeat-kubernetes/150345 "2018-10-05T11:25:51Z")

</div>

hello, I have installed this documentation https://www.elastic.co/guide/en/beats/filebeat/master/running-on-kubernetes.html#running-on-kubernetes but I have a problem, logs elasticsearch \[filebeat-6.4.1-2018.09.28\] \[0…

---

## [Packetbeat: Disable return\_value for Redis protocol](https://discuss.elastic.co/t/packetbeat-disable-return-value-for-redis-protocol/50418)

<div class="topic-metadata">

**Author:** [@spa-87](https://discuss.elastic.co/u/spa-87)\
**Replies:** 2\
**Last updated:** [May 26, 2016, 7:43am UTC](https://discuss.elastic.co/t/packetbeat-disable-return-value-for-redis-protocol/50418 "2016-05-26T07:43:44Z")

</div>

Hi, in my usecase Redis is used as a cache-server and stores big bunches of data. All that data is returned at redis.return\_value field for each request what can lead to high resources consumption at ElasticSearch server…

---

## [How to send email](https://discuss.elastic.co/t/how-to-send-email/43633)

<div class="topic-metadata">

**Author:** [@szcountryboy](https://discuss.elastic.co/u/szcountryboy)\
**Replies:** 2\
**Last updated:** [March 7, 2016, 3:27pm UTC](https://discuss.elastic.co/t/how-to-send-email/43633 "2016-03-07T15:27:45Z")

</div>

I used logstash 2.2 version,Use the following configuration output { if \[beat\_ip\] != "%{tags\[1\]}" { elasticsearch { hosts =\> \["localhost:9200"\] index =\> "logstash-%{type}-%{+YYYY.MM.dd}" doc…

---

## [Add image in visualization](https://discuss.elastic.co/t/add-image-in-visualization/322472)

<div class="topic-metadata">

**Author:** [@Alice\_Ionescu](https://discuss.elastic.co/u/Alice_Ionescu)\
**Replies:** 1\
**Last updated:** [January 4, 2023, 3:12pm UTC](https://discuss.elastic.co/t/add-image-in-visualization/322472 "2023-01-04T15:12:31Z")

</div>

Hello, I would like to display pictures in visualizations, the pictures are stored in in eleasticsearch in a base64 format. So I have a field on an index that is the base64 format of an image and I want to display it i…

---

## [Handlebars syntax in TSVB Markdown panel with conditional output for multiple items?](https://discuss.elastic.co/t/handlebars-syntax-in-tsvb-markdown-panel-with-conditional-output-for-multiple-items/273797)

<div class="topic-metadata">

**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\
**Replies:** 1\
**Last updated:** [May 25, 2021, 1:43am UTC](https://discuss.elastic.co/t/handlebars-syntax-in-tsvb-markdown-panel-with-conditional-output-for-multiple-items/273797 "2021-05-25T01:43:07Z")

</div>

Background I have two dashboards: Dashboard A is designed to present information about multiple items. Dashboard B is designed to present information about one of those items. Visualizations in dashboard A drill-down …

---

## [Filter and sort based on attributes in Terms lookup document](https://discuss.elastic.co/t/filter-and-sort-based-on-attributes-in-terms-lookup-document/200241)

<div class="topic-metadata">

**Author:** [@come\_along\_bort](https://discuss.elastic.co/u/come_along_bort)\
**Replies:** 1\
**Last updated:** [September 27, 2019, 1:36pm UTC](https://discuss.elastic.co/t/filter-and-sort-based-on-attributes-in-terms-lookup-document/200241 "2019-09-27T13:36:51Z")

</div>

I have documents which contain a users collection which are linked to other documents through the documents id attribute like so: PUT /collection/1 { "items": \[ {"id": 1, "time\_added": "2017-08-07T09:07:15.0…

---

## [Display Dashboard like a slide show](https://discuss.elastic.co/t/display-dashboard-like-a-slide-show/112377)

<div class="topic-metadata">

**Author:** [@Sridhar](https://discuss.elastic.co/u/Sridhar)\
**Replies:** 1\
**Last updated:** [December 19, 2017, 11:44am UTC](https://discuss.elastic.co/t/display-dashboard-like-a-slide-show/112377 "2017-12-19T11:44:43Z")

</div>

All, I have 4 dashboards which is projected on a screens. since it has 48+ Visualize charts added in the dashboard, its doesn't look good. Hence I'm planning to split the 48 to 20 / 20 in 3 dashboards, I'm not sure how …

[Previous page](https://discuss.elastic.co/top.md?page=1436&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1438&per_page=50&period=all)
