# Top

**URL:** https://discuss.elastic.co/top.md?page=1439&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1440

---

## [Kibana Displays Total White Screen Behind Reverse Proxy](https://discuss.elastic.co/t/kibana-displays-total-white-screen-behind-reverse-proxy/222929)

<div class="topic-metadata">

**Author:** [@izm1chael](https://discuss.elastic.co/u/izm1chael)\
**Replies:** 2\
**Last updated:** [March 11, 2020, 9:39pm UTC](https://discuss.elastic.co/t/kibana-displays-total-white-screen-behind-reverse-proxy/222929 "2020-03-11T21:39:40Z")

</div>

I am currently trying to run kibana behind a nginx reverse proxy, However, when I access the subdomain associated with my kibana instance, it displays a totally white page, Has anyone had any experience with this?

---

## [Serial Diff in Visual Builder](https://discuss.elastic.co/t/serial-diff-in-visual-builder/156886)

<div class="topic-metadata">

**Author:** [@1862347ba9566e72a47d](https://discuss.elastic.co/u/1862347ba9566e72a47d)\
**Replies:** 2\
**Last updated:** [November 16, 2018, 4:55pm UTC](https://discuss.elastic.co/t/serial-diff-in-visual-builder/156886 "2018-11-16T16:55:22Z")

</div>

There are constantly increasing numerical data. To monitor need to get the difference between the two events. For this is used serial diff. When I draw a graph in a widget, it turns out the jumps on the graph in the pos…

---

## [Can't reindex from Remote \[Solved\]](https://discuss.elastic.co/t/cant-reindex-from-remote-solved/151800)

<div class="topic-metadata">

**Author:** [@geppo](https://discuss.elastic.co/u/geppo)\
**Replies:** 2\
**Last updated:** [October 11, 2018, 9:18am UTC](https://discuss.elastic.co/t/cant-reindex-from-remote-solved/151800 "2018-10-11T09:18:23Z")

</div>

Hi, I'm trying to use the reindex api from remote. I add to my locale elasticsearch.yml the ip and the port from remote source in reindex.remote.whitelist Then i retrieve the mapping of my index from remote and I have…

---

## [Help- Query DSL \_search POST](https://discuss.elastic.co/t/help-query-dsl-search-post/142402)

<div class="topic-metadata">

**Author:** [@Roberto\_Flores](https://discuss.elastic.co/u/Roberto_Flores)\
**Replies:** 2\
**Last updated:** [July 31, 2018, 4:55pm UTC](https://discuss.elastic.co/t/help-query-dsl-search-post/142402 "2018-07-31T16:55:10Z")

</div>

Please help me with this problem. I have a .net core client like this: var client = new RestClient(); client.BaseUrl = new Uri(Host); client.AddDefaultHeader("Content-Type", "application/json"); var request = ne…

---

## [Unable to write data to elasticsearch 5.3 from Databricks/Spark](https://discuss.elastic.co/t/unable-to-write-data-to-elasticsearch-5-3-from-databricks-spark/85299)

<div class="topic-metadata">

**Author:** [@bobby259](https://discuss.elastic.co/u/bobby259)\
**Replies:** 2\
**Last updated:** [May 10, 2017, 9:39pm UTC](https://discuss.elastic.co/t/unable-to-write-data-to-elasticsearch-5-3-from-databricks-spark/85299 "2017-05-10T21:39:45Z")

</div>

I am facing issue while trying to write data from Databricks Platform to Elasticsearch 5.3 cluster. Below is the error, please help. 17/05/10 19:50:13 ERROR Executor: Exception in task 14.1 in stage 533.0 (TID 3746…

---

## [Kibana 5.2: is there a way not to save (pinned) filters to vizualisations / dashboards?](https://discuss.elastic.co/t/kibana-5-2-is-there-a-way-not-to-save-pinned-filters-to-vizualisations-dashboards/74384)

<div class="topic-metadata">

**Author:** [@asp](https://discuss.elastic.co/u/asp)\
**Replies:** 2\
**Last updated:** [February 9, 2017, 7:32am UTC](https://discuss.elastic.co/t/kibana-5-2-is-there-a-way-not-to-save-pinned-filters-to-vizualisations-dashboards/74384 "2017-02-09T07:32:40Z")

</div>

Hi, we have logs of multiple stages (qa, dev, prod) in one elk. So i pinned 3 filters, where you can choose between the stages. But if I create a visualization or an dashboard with an activated pinned filter, this de…

---

## [\[Solved\] - Ignore\_older for infinite time](https://discuss.elastic.co/t/solved-ignore-older-for-infinite-time/44411)

<div class="topic-metadata">

**Author:** [@mikula](https://discuss.elastic.co/u/mikula)\
**Replies:** 2\
**Last updated:** [March 21, 2016, 11:24am UTC](https://discuss.elastic.co/t/solved-ignore-older-for-infinite-time/44411 "2016-03-21T11:24:13Z")

</div>

Is there any value of ignore\_older to disable this feature (I tried "0") but no luck.

---

## [Logging request headers for queries taking time above a threshold](https://discuss.elastic.co/t/logging-request-headers-for-queries-taking-time-above-a-threshold/38778)

<div class="topic-metadata">

**Author:** [@Ashish\_Goel](https://discuss.elastic.co/u/Ashish_Goel)\
**Replies:** 2\
**Last updated:** [January 14, 2016, 1:30pm UTC](https://discuss.elastic.co/t/logging-request-headers-for-queries-taking-time-above-a-threshold/38778 "2016-01-14T13:30:07Z")

</div>

Hi there, In my ElasticSearch setup, I have placed logging configuration such that any query on a particular index taking more than 300ms is to be logged. The logging is working fine, it is just that I wanted to get on…

---

## [Kibana ElasticSearch issue "Error Could not contact Elasticsearch at http:/address:9200. Please ensure that Elasticsearch is reachable from your system."](https://discuss.elastic.co/t/kibana-elasticsearch-issue-error-could-not-contact-elasticsearch-at-http-address-9200-please-ensure-that-elasticsearch-is-reachable-from-your-system/19704)

<div class="topic-metadata">

**Author:** [@Jonathan\_H](https://discuss.elastic.co/u/Jonathan_H)\
**Replies:** 2\
**Last updated:** [September 10, 2014, 9:58am UTC](https://discuss.elastic.co/t/kibana-elasticsearch-issue-error-could-not-contact-elasticsearch-at-http-address-9200-please-ensure-that-elasticsearch-is-reachable-from-your-system/19704 "2014-09-10T09:58:38Z")

</div>

Hey everyone. I have installed logstash, elasticsearch and Kibana 3 successfully, however when I ask a member on my team to view kibana he see this "Error Could not contact Elasticsearch at http:/address:9200. Pl…

---

## [How to use Term Facet query with multivalue fields?](https://discuss.elastic.co/t/how-to-use-term-facet-query-with-multivalue-fields/11672)

<div class="topic-metadata">

**Author:** [@pulkitsinghal](https://discuss.elastic.co/u/pulkitsinghal)\
**Replies:** 2\
**Last updated:** [April 24, 2013, 1:33am UTC](https://discuss.elastic.co/t/how-to-use-term-facet-query-with-multivalue-fields/11672 "2013-04-24T01:33:16Z")

</div>

I have a document with multivalue fields: https://gist.github.com/pulkitsinghal/5447250#file-document-json But when I run a facet query on it: https://gist.github.com/pulkitsinghal/5447250#file-facetquery-json Ea…

---

## [Elasticsearch nodes are visible to each other in GCE, but won't form a cluster](https://discuss.elastic.co/t/elasticsearch-nodes-are-visible-to-each-other-in-gce-but-wont-form-a-cluster/240770)

<div class="topic-metadata">

**Author:** [@yagodorea](https://discuss.elastic.co/u/yagodorea)\
**Replies:** 6\
**Last updated:** [July 12, 2020, 7:00pm UTC](https://discuss.elastic.co/t/elasticsearch-nodes-are-visible-to-each-other-in-gce-but-wont-form-a-cluster/240770 "2020-07-12T19:00:58Z")

</div>

I'm trying to set up a simple cluster using 2 GCE VMs (test-elk1 and test-elk2) from inside docker containers. I've setup firewall rules so they are completely visible to each other, so performing: curl http://\<instanc…

---

## [Elasticsearch does not remove shards on closing due to locking issues](https://discuss.elastic.co/t/elasticsearch-does-not-remove-shards-on-closing-due-to-locking-issues/361321)

<div class="topic-metadata">

**Author:** [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Replies:** 7\
**Last updated:** [October 8, 2026, 9:38am UTC](https://discuss.elastic.co/t/elasticsearch-does-not-remove-shards-on-closing-due-to-locking-issues/361321 "2026-10-08T09:38:37Z")

</div>

Hey, we have an issue with out 7.18.18 cluster. It seems that closing a shard is throwing issues. This happens with several data nodes, so it's not a single glitch. This has never happened with out previous 7.12 version…

---

## [Running as service, continuously giving "No source loaders matched! This shouldn't happen"](https://discuss.elastic.co/t/running-as-service-continuously-giving-no-source-loaders-matched-this-shouldnt-happen/283487)

<div class="topic-metadata">

**Author:** [@matt.snyder](https://discuss.elastic.co/u/matt.snyder)\
**Replies:** 1\
**Last updated:** [September 8, 2021, 5:57pm UTC](https://discuss.elastic.co/t/running-as-service-continuously-giving-no-source-loaders-matched-this-shouldnt-happen/283487 "2021-09-08T17:57:26Z")

</div>

I am running logstash as a service, and it seems that an erroneous job is stuck in a queue somewhere, though I cannot find it. The error in the subject appears over and over in logstash-plain.log, no matter what files I…

---

## [Does increase refresh\_rate effect indexing time?](https://discuss.elastic.co/t/does-increase-refresh-rate-effect-indexing-time/251058)

<div class="topic-metadata">

**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\
**Replies:** 7\
**Last updated:** [October 7, 2020, 2:44pm UTC](https://discuss.elastic.co/t/does-increase-refresh-rate-effect-indexing-time/251058 "2020-10-07T14:44:15Z")

</div>

Like the title states. I am seeing indexing time on certain writes jump to close 30 seconds. I have configure all my index's refresh rate to 30 seconds. Is this normal? I have also bump machine by doubling the CPU fr…

---

## [Logstash aggregate query](https://discuss.elastic.co/t/logstash-aggregate-query/107827)

<div class="topic-metadata">

**Author:** [@Pratiksha\_Tewary](https://discuss.elastic.co/u/Pratiksha_Tewary)\
**Replies:** 1\
**Last updated:** [November 20, 2017, 6:48pm UTC](https://discuss.elastic.co/t/logstash-aggregate-query/107827 "2017-11-20T18:48:49Z")

</div>

Hi, We are trying to implement the aggregate query in Logstash using the Elasticsearch input plugin and have the following in our input portion of the Logstash configuration: input { elasticsearch { hosts =\> "\<ho…

---

## [Cannot restart Kibana without reboot](https://discuss.elastic.co/t/cannot-restart-kibana-without-reboot/103341)

<div class="topic-metadata">

**Author:** [@Milgo](https://discuss.elastic.co/u/Milgo)\
**Replies:** 1\
**Last updated:** [October 10, 2017, 1:15pm UTC](https://discuss.elastic.co/t/cannot-restart-kibana-without-reboot/103341 "2017-10-10T13:15:30Z")

</div>

I'm having a problem with Kibana 5.4.0. After a restart I have no problems using Kibana with Elasticsearch. But sometimes Kibana crashes (no logging output...) and then I have problems to get it started again. If I star…

---

## [Logstash altering defined Elasticsearch URL](https://discuss.elastic.co/t/logstash-altering-defined-elasticsearch-url/93066)

<div class="topic-metadata">

**Author:** [@Chris\_Gatto](https://discuss.elastic.co/u/Chris_Gatto)\
**Replies:** 1\
**Last updated:** [July 21, 2017, 3:46pm UTC](https://discuss.elastic.co/t/logstash-altering-defined-elasticsearch-url/93066 "2017-07-21T15:46:17Z")

</div>

Hello, I have my Logstash configured with the following output: output { hosts =\> \["http://myhost/elasticsearch"\] } This is a valid URL, as I can cURL commands to Elasticsearch with it, such as curl "http://myhos…

---

## [Elasticsearch Graph API](https://discuss.elastic.co/t/elasticsearch-graph-api/54228)

<div class="topic-metadata">

**Author:** [@Surya](https://discuss.elastic.co/u/Surya)\
**Replies:** 1\
**Last updated:** [June 29, 2016, 9:21am UTC](https://discuss.elastic.co/t/elasticsearch-graph-api/54228 "2016-06-29T09:21:29Z")

</div>

Hi, My requirement is to get the elasticsearch graph in my .net application UI through .Net client. I need to know whether this is possible. If yes, how it can be done?

---

## [Sorting by timestamp](https://discuss.elastic.co/t/sorting-by-timestamp/49496)

<div class="topic-metadata">

**Author:** [@maher](https://discuss.elastic.co/u/maher)\
**Replies:** 1\
**Last updated:** [May 9, 2016, 9:06am UTC](https://discuss.elastic.co/t/sorting-by-timestamp/49496 "2016-05-09T09:06:51Z")

</div>

Hi, I am trying to get the last 3 consulted products : so i need to make an aggregation based on productcode then use the option order . here is what i am trying to do { "size" : 0, "aggs" : { "products" : { …

---

## [\_forcemerge query not working? (from Elastic Cloud - ES 2.1.1)](https://discuss.elastic.co/t/-forcemerge-query-not-working-from-elastic-cloud-es-2-1-1/41402)

<div class="topic-metadata">

**Author:** [@erikthered](https://discuss.elastic.co/u/erikthered)\
**Replies:** 1\
**Last updated:** [March 1, 2016, 2:49pm UTC](https://discuss.elastic.co/t/-forcemerge-query-not-working-from-elastic-cloud-es-2-1-1/41402 "2016-03-01T14:49:33Z")

</div>

Continuing the discussion from \_forcemerge query not working?: This is a very specific elasticsearch-centric question; I've reposted this in the appropriate topic. The issue in question is around Elasticsearch 2.1.1.

---

## [edgeNGram filter not keeping the whole words](https://discuss.elastic.co/t/edgengram-filter-not-keeping-the-whole-words/12951)

<div class="topic-metadata">

**Author:** [@Patrick\_Norwood](https://discuss.elastic.co/u/Patrick_Norwood)\
**Replies:** 1\
**Last updated:** [July 26, 2013, 9:20am UTC](https://discuss.elastic.co/t/edgengram-filter-not-keeping-the-whole-words/12951 "2013-07-26T09:20:51Z")

</div>

Hi guys, I have a problem with my analyzer. Following is the setup in elasticsearch.yml: analyzer : default\_index : type : custom tokenizer : whitespace …

---

## [Metricbeat x509 Certificate error](https://discuss.elastic.co/t/metricbeat-x509-certificate-error/342072)

<div class="topic-metadata">

**Author:** [@artschooldropout](https://discuss.elastic.co/u/artschooldropout)\
**Replies:** 4\
**Last updated:** [September 1, 2023, 7:52pm UTC](https://discuss.elastic.co/t/metricbeat-x509-certificate-error/342072 "2023-09-01T19:52:33Z")

</div>

I've got an Elasticsearch instance running nicely, and I'd like to use metricbeat to monitor system performance (running on the same host). I'm getting an x509 certificate error when I start metricbeat using metricbeat …

---

## [Can a logstash filter error be forwarded to elastic?](https://discuss.elastic.co/t/can-a-logstash-filter-error-be-forwarded-to-elastic/293742)

<div class="topic-metadata">

**Author:** [@DavidMarcu](https://discuss.elastic.co/u/DavidMarcu)\
**Replies:** 4\
**Last updated:** [January 10, 2022, 8:15am UTC](https://discuss.elastic.co/t/can-a-logstash-filter-error-be-forwarded-to-elastic/293742 "2022-01-10T08:15:44Z")

</div>

I'm having these json parsing errors from time to time: 2022-01-07T12:15:19,872\]\[WARN \]\[logstash.filters.json \] Error parsing json {:source=\>"message", :raw=\>" { the invalid json }", :exception=\>#\<LogStash::Json::Pa…

---

## [Letters in request headers' key are lowercase or uppercase in different version of apm agent and why?](https://discuss.elastic.co/t/letters-in-request-headers-key-are-lowercase-or-uppercase-in-different-version-of-apm-agent-and-why/284448)

<div class="topic-metadata">

**Author:** [@hanming](https://discuss.elastic.co/u/hanming)\
**Replies:** 4\
**Last updated:** [September 22, 2021, 8:00am UTC](https://discuss.elastic.co/t/letters-in-request-headers-key-are-lowercase-or-uppercase-in-different-version-of-apm-agent-and-why/284448 "2021-09-22T08:00:15Z")

</div>

Kibana version : 6.8.11 Elasticsearch version : 6.8.11 APM Server version : 6.8.11 APM Agent language and version : Java 1.25.0 & 1.21.0 Description of the problem including expected versus actual behavior. Please in…

---

## [Getting \_grokparsefailure when passing full log files](https://discuss.elastic.co/t/getting-grokparsefailure-when-passing-full-log-files/283207)

<div class="topic-metadata">

**Author:** [@tarabhavi](https://discuss.elastic.co/u/tarabhavi)\
**Replies:** 4\
**Last updated:** [September 3, 2021, 3:42pm UTC](https://discuss.elastic.co/t/getting-grokparsefailure-when-passing-full-log-files/283207 "2021-09-03T15:42:18Z")

</div>

have ping logs files used the excerpt of it as a sample for grok filter and tested with grok \_debugger and all good When I pass the full file will all logs instead of excerpt get \_grokparsefailure though was working w…

---

## [How to set distributed tracing setting in RUM agent?](https://discuss.elastic.co/t/how-to-set-distributed-tracing-setting-in-rum-agent/217329)

<div class="topic-metadata">

**Author:** [@Yungyoung\_Ok](https://discuss.elastic.co/u/Yungyoung_Ok)\
**Replies:** 4\
**Last updated:** [February 12, 2020, 12:30am UTC](https://discuss.elastic.co/t/how-to-set-distributed-tracing-setting-in-rum-agent/217329 "2020-02-12T00:30:08Z")

</div>

Kibana version:7.5.2 Elasticsearch version:7.5.2 APM Server version:7.5.2 APM Agent language and version:RUM agent 4.7.0 Browser version:chrome 79.0.3945.130 Description of the problem including expected versus actu…

---

## [Real time multi metric job analysis](https://discuss.elastic.co/t/real-time-multi-metric-job-analysis/107873)

<div class="topic-metadata">

**Author:** [@anomalyml](https://discuss.elastic.co/u/anomalyml)\
**Replies:** 4\
**Last updated:** [November 22, 2017, 10:49am UTC](https://discuss.elastic.co/t/real-time-multi-metric-job-analysis/107873 "2017-11-22T10:49:24Z")

</div>

Hi, Could anyone explain in detail what the "Interval" option is for in creating a watch for real-time job? \[Pic\_1\] The explanation provided in the documents are not elaborative and therefore any help would be appreci…

---

## [Xpack credit card alert](https://discuss.elastic.co/t/xpack-credit-card-alert/71095)

<div class="topic-metadata">

**Author:** [@Arpit\_Gupta](https://discuss.elastic.co/u/Arpit_Gupta)\
**Replies:** 4\
**Last updated:** [January 11, 2017, 11:51am UTC](https://discuss.elastic.co/t/xpack-credit-card-alert/71095 "2017-01-11T11:51:54Z")

</div>

Hi, How to get alert if credit card information is visible in logs. I am not able to get stuff for it. Thanks

---

## [How to apply Third Party or Custom Threat intel feeds with SIEM App?](https://discuss.elastic.co/t/how-to-apply-third-party-or-custom-threat-intel-feeds-with-siem-app/228312)

<div class="topic-metadata">

**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\
**Replies:** 2\
**Last updated:** [April 22, 2020, 2:58am UTC](https://discuss.elastic.co/t/how-to-apply-third-party-or-custom-threat-intel-feeds-with-siem-app/228312 "2020-04-22T02:58:32Z")

</div>

Hi Guys, Can anyone please suggest me the way to apply third party threat intel feed to SIEM App? Has that to be done with logstash translate dictionary feature? but since there are multiple indices involved can someone…

---

## [Can we use S3 bucket as input in function beat and send data to some ingest pipeline](https://discuss.elastic.co/t/can-we-use-s3-bucket-as-input-in-function-beat-and-send-data-to-some-ingest-pipeline/201560)

<div class="topic-metadata">

**Author:** [@akki2208](https://discuss.elastic.co/u/akki2208)\
**Replies:** 2\
**Last updated:** [October 10, 2019, 8:34am UTC](https://discuss.elastic.co/t/can-we-use-s3-bucket-as-input-in-function-beat-and-send-data-to-some-ingest-pipeline/201560 "2019-10-10T08:34:57Z")

</div>

Can we use S3 bucket as input in function beat and send data to some ingest pipeline.

---

## [Email sending error in elastalert. SMTPSenderRefused: (530, '5.5.1 Authentication Required)](https://discuss.elastic.co/t/email-sending-error-in-elastalert-smtpsenderrefused-530-5-5-1-authentication-required/109034)

<div class="topic-metadata">

**Author:** [@varun1992](https://discuss.elastic.co/u/varun1992)\
**Replies:** 0\
**Last updated:** [November 24, 2017, 1:17pm UTC](https://discuss.elastic.co/t/email-sending-error-in-elastalert-smtpsenderrefused-530-5-5-1-authentication-required/109034 "2017-11-24T13:17:04Z")

</div>

i got gmail authentication error. my config and error message as below I already allowed less secure apps in gmail Config.yaml file email section as below name: frequency\_rule type: frequency index: security num\_eve…

---

## [Grok formatting help](https://discuss.elastic.co/t/grok-formatting-help/179406)

<div class="topic-metadata">

**Author:** [@JB\_Pollard](https://discuss.elastic.co/u/JB_Pollard)\
**Replies:** 5\
**Last updated:** [May 3, 2019, 2:57pm UTC](https://discuss.elastic.co/t/grok-formatting-help/179406 "2019-05-03T14:57:06Z")

</div>

Just getting started with elastic this is my second attempt now that I have some free time I'm getting somewhere with it. Having some trouble finding the correct way to format my grok to correctly grab the fields. Main …

---

## [Logstash shutdown completed](https://discuss.elastic.co/t/logstash-shutdown-completed/45809)

<div class="topic-metadata">

**Author:** [@JoaquinS](https://discuss.elastic.co/u/JoaquinS)\
**Replies:** 5\
**Last updated:** [March 31, 2016, 1:43am UTC](https://discuss.elastic.co/t/logstash-shutdown-completed/45809 "2016-03-31T01:43:39Z")

</div>

Hello, What it means that if I'm consuming from an index of ES (that has always incoming data) Logstash says : "Logstash shutdown completed"?. My input config is this: input { elasticsearch { hosts =\> "192.16…

---

## [Nested objects and facets](https://discuss.elastic.co/t/nested-objects-and-facets/11156)

<div class="topic-metadata">

**Author:** [@Pawel\_Mlynarczyk](https://discuss.elastic.co/u/Pawel_Mlynarczyk)\
**Replies:** 5\
**Last updated:** [March 18, 2013, 3:45pm UTC](https://discuss.elastic.co/t/nested-objects-and-facets/11156 "2013-03-18T15:45:49Z")

</div>

Hello everybody I'm working on a facet navigation and I've encountered an issue. Let me explain what I'm trying to achieve first. Take a look at http://www.pricerunner.co.uk/cl/2/TVs (not my site, just a basic ex…

---

## [Tooltip not working with Vertical Bar Chart (Vega)](https://discuss.elastic.co/t/tooltip-not-working-with-vertical-bar-chart-vega/201572)

<div class="topic-metadata">

**Author:** [@Daggerhunt](https://discuss.elastic.co/u/Daggerhunt)\
**Replies:** 1\
**Last updated:** [October 23, 2019, 6:52pm UTC](https://discuss.elastic.co/t/tooltip-not-working-with-vertical-bar-chart-vega/201572 "2019-10-23T18:52:49Z")

</div>

I am trying to plot the data in a vertical bar chart and I've followed this writeup. The only difference is that I'm trying to fetch the data directly via a Elasticsearch Query. However, I'm unable to get the Tooltip w…

---

## [Most recent event for devices](https://discuss.elastic.co/t/most-recent-event-for-devices/119298)

<div class="topic-metadata">

**Author:** [@twojays](https://discuss.elastic.co/u/twojays)\
**Replies:** 1\
**Last updated:** [February 12, 2018, 1:05pm UTC](https://discuss.elastic.co/t/most-recent-event-for-devices/119298 "2018-02-12T13:05:58Z")

</div>

Hi, I have a fleet of IoT devices that post every couple of minutes their status which could be online or offline. My goal is to have a metric that will show a count of all devices that are currently online, and a count…

---

## [java.lang.NoSuchMethodError:](https://discuss.elastic.co/t/java-lang-nosuchmethoderror/118445)

<div class="topic-metadata">

**Author:** [@aravind\_apalya](https://discuss.elastic.co/u/aravind_apalya)\
**Replies:** 1\
**Last updated:** [February 5, 2018, 1:04pm UTC](https://discuss.elastic.co/t/java-lang-nosuchmethoderror/118445 "2018-02-05T13:04:47Z")

</div>

Hi Team, I have upgraded my elastic search java API's to v6.1.1 from v0.90.5 Everything compiled fine and have deployed in tomcat server While starting the server it's throwing following error. java.lang.NoSuchMethod…

---

## [Lab Guide: X-Pack Machine Learning - Lab 2 Multi-Metric Jobs: Fare Quote - Step 14](https://discuss.elastic.co/t/lab-guide-x-pack-machine-learning-lab-2-multi-metric-jobs-fare-quote-step-14/98110)

<div class="topic-metadata">

**Author:** [@EddieTurizo](https://discuss.elastic.co/u/EddieTurizo)\
**Replies:** 1\
**Last updated:** [August 23, 2017, 5:34pm UTC](https://discuss.elastic.co/t/lab-guide-x-pack-machine-learning-lab-2-multi-metric-jobs-fare-quote-step-14/98110 "2017-08-23T17:34:49Z")

</div>

Click on the Anomaly Timeline Overall on the date "December 8th 2015, 19:00". You'll notice that there is a breakout for each individual top-influencer but one of them has critical anomalies individually showing for it…

---

## [Is it possible to force Kibana to reload visualisation code?](https://discuss.elastic.co/t/is-it-possible-to-force-kibana-to-reload-visualisation-code/94257)

<div class="topic-metadata">

**Author:** [@Jack\_Judge](https://discuss.elastic.co/u/Jack_Judge)\
**Replies:** 1\
**Last updated:** [July 24, 2017, 5:33pm UTC](https://discuss.elastic.co/t/is-it-possible-to-force-kibana-to-reload-visualisation-code/94257 "2017-07-24T17:33:16Z")

</div>

Like the title says, is it possible to get Kibana to reload the code for a visualisation ? The vis is part of a dashboard and I'm updating it in response to events within my ingest (logstash) pipeline. I'm updating the v…

---

## [About the 6.x release plan](https://discuss.elastic.co/t/about-the-6-x-release-plan/87853)

<div class="topic-metadata">

**Author:** [@dreampuf](https://discuss.elastic.co/u/dreampuf)\
**Replies:** 1\
**Last updated:** [June 2, 2017, 12:48am UTC](https://discuss.elastic.co/t/about-the-6-x-release-plan/87853 "2017-06-02T00:48:18Z")

</div>

Is there any roadmap can be found includes the ELK release plan? When will the 6.x be release?

---

## [Unable to suppress duplicate alerts](https://discuss.elastic.co/t/unable-to-suppress-duplicate-alerts/354485)

<div class="topic-metadata">

**Author:** [@KraLot](https://discuss.elastic.co/u/KraLot)\
**Replies:** 4\
**Last updated:** [March 7, 2024, 4:59pm UTC](https://discuss.elastic.co/t/unable-to-suppress-duplicate-alerts/354485 "2024-03-07T16:59:02Z")

</div>

I am trying to build a rule to detect login activity from multiple countries (min 2 unique) within last 8 hours for a user and when matched alert should generate in 5mins. Run every: 5mins Additional Look-back: 8 hours …

---

## [Custom date\_format for parse\_origination\_date](https://discuss.elastic.co/t/custom-date-format-for-parse-origination-date/348042)

<div class="topic-metadata">

**Author:** [@tbabic](https://discuss.elastic.co/u/tbabic)\
**Replies:** 1\
**Last updated:** [November 27, 2023, 12:50pm UTC](https://discuss.elastic.co/t/custom-date-format-for-parse-origination-date/348042 "2023-11-27T12:50:05Z")

</div>

Currently date\_format is yyyy.MM.dd in index.lifecycle.parse\_origination\_date which is great if you have logs in format like logs-2016.10.31-000002, but since index name is custom and can be like eg logs-2016-10-31-00 th…

---

## [Curator is failing during authentication for elastic search on AWS](https://discuss.elastic.co/t/curator-is-failing-during-authentication-for-elastic-search-on-aws/289978)

<div class="topic-metadata">

**Author:** [@hudar01](https://discuss.elastic.co/u/hudar01)\
**Replies:** 2\
**Last updated:** [November 24, 2021, 5:27pm UTC](https://discuss.elastic.co/t/curator-is-failing-during-authentication-for-elastic-search-on-aws/289978 "2021-11-24T17:27:58Z")

</div>

I've setup an Elasticsearch backup and restore on S3, and I was trying to delete the backups using Curator (but it's always failing - i tried both ways using url\_prefix and without it). Could you please help how I can ma…

---

## [Size of nested array is always 0](https://discuss.elastic.co/t/size-of-nested-array-is-always-0/202569)

<div class="topic-metadata">

**Author:** [@igushev](https://discuss.elastic.co/u/igushev)\
**Replies:** 2\
**Last updated:** [October 9, 2019, 5:18pm UTC](https://discuss.elastic.co/t/size-of-nested-array-is-always-0/202569 "2019-10-09T17:18:20Z")

</div>

Schema looks like this: "mappings": { "\_doc": { "\_all": { "enabled": false }, "properties": { "category\_boost": { "type": "nested", "properties" : { …

---

## [Auditbeat with multiple outputs](https://discuss.elastic.co/t/auditbeat-with-multiple-outputs/136747)

<div class="topic-metadata">

**Author:** [@data\_smith](https://discuss.elastic.co/u/data_smith)\
**Replies:** 2\
**Last updated:** [June 21, 2018, 1:02pm UTC](https://discuss.elastic.co/t/auditbeat-with-multiple-outputs/136747 "2018-06-21T13:02:51Z")

</div>

Can users configure Auditbeat to have multiple outputs? For example one output Elasticsearch and one output the file system. It appears that's not possible.

---

## [Custom Logstash docker image creation](https://discuss.elastic.co/t/custom-logstash-docker-image-creation/99496)

<div class="topic-metadata">

**Author:** [@sayeedch](https://discuss.elastic.co/u/sayeedch)\
**Replies:** 2\
**Last updated:** [September 6, 2017, 7:23am UTC](https://discuss.elastic.co/t/custom-logstash-docker-image-creation/99496 "2017-09-06T07:23:06Z")

</div>

Is there a guide that describes how to create your own Logstash image, especially for Kubernetes/Openshift? I’m looking for something similar to this:

---

## [Cluster State Red - All Shards Were Deleted but Marvel Says 'Unassigned'](https://discuss.elastic.co/t/cluster-state-red-all-shards-were-deleted-but-marvel-says-unassigned/62116)

<div class="topic-metadata">

**Author:** [@seth.yes](https://discuss.elastic.co/u/seth.yes)\
**Replies:** 2\
**Last updated:** [October 4, 2016, 9:19pm UTC](https://discuss.elastic.co/t/cluster-state-red-all-shards-were-deleted-but-marvel-says-unassigned/62116 "2016-10-04T21:19:39Z")

</div>

I've been having an issue where my one client node just deletes the primary index.. I'm basically discussing it with myself here, as no one has really offered much help. Now I'm in a position where my cluster state has …

---

## [Multimatch + Boosting Query](https://discuss.elastic.co/t/multimatch-boosting-query/59859)

<div class="topic-metadata">

**Author:** [@Ryan\_Burnham](https://discuss.elastic.co/u/Ryan_Burnham)\
**Replies:** 2\
**Last updated:** [September 12, 2016, 1:33am UTC](https://discuss.elastic.co/t/multimatch-boosting-query/59859 "2016-09-12T01:33:24Z")

</div>

Is it possible to use MultiMatch and Boosting Query together. I'm trying to match againts 3 or so fields and there are some specific terms (words) that should be a lower score than the others. my template currently lo…

---

## [Possible to sort and filter on length(matched\_queries)?](https://discuss.elastic.co/t/possible-to-sort-and-filter-on-length-matched-queries/56556)

<div class="topic-metadata">

**Author:** [@cjbottaro](https://discuss.elastic.co/u/cjbottaro)\
**Replies:** 2\
**Last updated:** [July 27, 2016, 10:34pm UTC](https://discuss.elastic.co/t/possible-to-sort-and-filter-on-length-matched-queries/56556 "2016-07-27T22:34:15Z")

</div>

Hello. I'm using named queries which generates a "field" on returned documents called matched\_queries which is an array of the names of the queries that matched. Is it possible to sort and filter on the cardinality of…

---

## [Metrics to monitor in ElasticSearch in ELK Deployment](https://discuss.elastic.co/t/metrics-to-monitor-in-elasticsearch-in-elk-deployment/27876)

<div class="topic-metadata">

**Author:** [@Deb](https://discuss.elastic.co/u/Deb)\
**Replies:** 2\
**Last updated:** [August 24, 2015, 5:37pm UTC](https://discuss.elastic.co/t/metrics-to-monitor-in-elasticsearch-in-elk-deployment/27876 "2015-08-24T17:37:57Z")

</div>

In an ELK deployment what are metrics people typically monitor in Elastic Search. We are able to gather and monitor the following metrics using enter link description heredatadog. We have a 4nodes in the ELK cluster:- 3…

[Previous page](https://discuss.elastic.co/top.md?page=1438&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1440&per_page=50&period=all)
