# Top **URL:** https://discuss.elastic.co/top.md?page=144&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 145 --- ## [The problem about runing a big dataset](https://discuss.elastic.co/t/the-problem-about-runing-a-big-dataset/69862)
**Author:** [@a943013827](https://discuss.elastic.co/u/a943013827)\ **Replies:** 9\ **Last updated:** [December 26, 2016, 10:00am UTC](https://discuss.elastic.co/t/the-problem-about-runing-a-big-dataset/69862 "2016-12-26T10:00:54Z")
hi: I am runing rally benchmark-only indexing a 365G(1 billions docs) dataset, Racing on track \[geonames\], challenge \[append-only-no-conflicts-while-searching\] and car \[external\] I check the docs count every 30 seconds… --- ## [Elastic APM Transaction are not showing in ASP.NET MVC Classic Framework](https://discuss.elastic.co/t/elastic-apm-transaction-are-not-showing-in-asp-net-mvc-classic-framework/219677)
**Author:** [@pvssraju](https://discuss.elastic.co/u/pvssraju)\ **Replies:** 11\ **Last updated:** [March 3, 2020, 8:42pm UTC](https://discuss.elastic.co/t/elastic-apm-transaction-are-not-showing-in-asp-net-mvc-classic-framework/219677 "2020-03-03T20:42:01Z")
If you are asking about a problem you are experiencing, please use the following template, as it will help us help you. If you have a different problem, please delete all of this text :slight\_smile: Kibana version: 7.5 … --- ## [Unable to access elastic search over network](https://discuss.elastic.co/t/unable-to-access-elastic-search-over-network/241265)
**Author:** [@Bigranawab](https://discuss.elastic.co/u/Bigranawab)\ **Replies:** 10\ **Last updated:** [July 20, 2020, 9:57am UTC](https://discuss.elastic.co/t/unable-to-access-elastic-search-over-network/241265 "2020-07-20T09:57:41Z")
Hi, I am trying to update elasticsearch.yml file to access elasticsearch over network. but when ever i can configurations and restart services it gives an error. Here are my configuration in YML file network.host = lo… --- ## [LogStash::Json::ParserError: Unexpected character ('(' (code 40))](https://discuss.elastic.co/t/logstash-unexpected-character-code-40/309438)
**Author:** [@John\_snow](https://discuss.elastic.co/u/John_snow)\ **Replies:** 9\ **Last updated:** [July 12, 2022, 7:59pm UTC](https://discuss.elastic.co/t/logstash-unexpected-character-code-40/309438 "2022-07-12T19:59:26Z")
I'm getting following error Error: :exception=\>#\ **Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Replies:** 10\ **Last updated:** [September 15, 2020, 7:27am UTC](https://discuss.elastic.co/t/finding-which-indices-contain-hits-when-making-use-of-an-alias-in-elasticsearch-query/248465 "2020-09-15T07:27:49Z") I've 1000s of day-wise (time-based) indices in my cluster. Is there a way to monitor or find out at the ES Server side which indices return data when a query makes use of an alias . E.g. consider the below query that my … --- ## [Logstash Error after updating form 7.8.0 to 7.10.0, Pipeline error {:pipeline\_id=\>"main", :exception=\> javax.net.ssl.SSLException: failed to initialize the server-side SSL context](https://discuss.elastic.co/t/logstash-error-after-updating-form-7-8-0-to-7-10-0-pipeline-error-pipeline-id-main-exception-javax-net-ssl-sslexception-failed-to-initialize-the-server-side-ssl-context/255212)
**Author:** [@weeam\_Haj\_Ali](https://discuss.elastic.co/u/weeam_Haj_Ali)\ **Replies:** 15\ **Last updated:** [November 30, 2020, 8:13am UTC](https://discuss.elastic.co/t/logstash-error-after-updating-form-7-8-0-to-7-10-0-pipeline-error-pipeline-id-main-exception-javax-net-ssl-sslexception-failed-to-initialize-the-server-side-ssl-context/255212 "2020-11-30T08:13:15Z")
I update ELK stack from 7.8.0 to 7.10.0. I am facing this Error in logstash: \[ERROR\]\[logstash.javapipeline \]\[main\] Pipeline error {:pipeline\_id=\>"main", :exception=\> javax.net.ssl.SSLException: failed to initialize … --- ## [Trouble setting up marvel 2.1.1 with elasticsearch 2.1.1](https://discuss.elastic.co/t/trouble-setting-up-marvel-2-1-1-with-elasticsearch-2-1-1/38365)
**Author:** [@photonic\_world\_2](https://discuss.elastic.co/u/photonic_world_2)\ **Replies:** 9\ **Last updated:** [January 6, 2016, 8:11am UTC](https://discuss.elastic.co/t/trouble-setting-up-marvel-2-1-1-with-elasticsearch-2-1-1/38365 "2016-01-06T08:11:21Z")
Hi, I am trying to setup marvel and kibana in the separate monitoring cluster with the following settings: Referred ES documentation here: Installing marvel Installed marvel-agent and license on my data+master no… --- ## [How to use Metricbeat with Kafka](https://discuss.elastic.co/t/how-to-use-metricbeat-with-kafka/94585)
**Author:** [@rahul01](https://discuss.elastic.co/u/rahul01)\ **Replies:** 13\ **Last updated:** [August 9, 2017, 10:24am UTC](https://discuss.elastic.co/t/how-to-use-metricbeat-with-kafka/94585 "2017-08-09T10:24:57Z")
Hello All, i am using Filebeat version 5.5 to send logs to kafka topic. But I am not able to send the TOP command logs. Is there any way to send TOP command logs to Kafka? Thank You --- ## [Difference between two aggregations](https://discuss.elastic.co/t/difference-between-two-aggregations/294405)
**Author:** [@walshe06](https://discuss.elastic.co/u/walshe06)\ **Replies:** 10\ **Last updated:** [February 28, 2022, 4:17pm UTC](https://discuss.elastic.co/t/difference-between-two-aggregations/294405 "2022-02-28T16:17:02Z")
Hi all I am looking for some help with a watcher that I am trying to run. Basically I am trying to run a search query that will return a value if there is a difference between two aggregations. Below is the script I am… --- ## [Unable to reindex data](https://discuss.elastic.co/t/unable-to-reindex-data/62223)
**Author:** [@chromechris](https://discuss.elastic.co/u/chromechris)\ **Replies:** 9\ **Last updated:** [October 13, 2016, 10:56pm UTC](https://discuss.elastic.co/t/unable-to-reindex-data/62223 "2016-10-13T22:56:49Z")
Hello Loggers, I am unable to reindex in my elasticsearch setup. I have tow indeces, from which I want to reindex one to the other. Index 1: Field: "timestamp" Type: "string" "timestamp": { "type"… --- ## [Infinite extent for field](https://discuss.elastic.co/t/infinite-extent-for-field/310091)
**Author:** [@Irwan\_Kurniawan](https://discuss.elastic.co/u/Irwan_Kurniawan)\ **Replies:** 13\ **Last updated:** [July 26, 2022, 6:49am UTC](https://discuss.elastic.co/t/infinite-extent-for-field/310091 "2022-07-26T06:49:21Z")
I copy and paste from Population Pyramid Example | Vega to Kibana and I got Infinite extent for field "people": \[Infinity, -Infinity\] { "$schema": "https://vega.github.io/schema/vega/v5.json", "description": "A popu… --- ## [Filebeat:7.10.0 not publishing/pushing logs to single node elasticsearch cluster deployed in kubernetes cluster](https://discuss.elastic.co/t/filebeat-7-10-0-not-publishing-pushing-logs-to-single-node-elasticsearch-cluster-deployed-in-kubernetes-cluster/263123)
**Author:** [@nirmal\_elastic](https://discuss.elastic.co/u/nirmal_elastic)\ **Replies:** 17\ **Last updated:** [February 10, 2021, 7:15pm UTC](https://discuss.elastic.co/t/filebeat-7-10-0-not-publishing-pushing-logs-to-single-node-elasticsearch-cluster-deployed-in-kubernetes-cluster/263123 "2021-02-10T19:15:18Z")
I have single node elasticsearch deployed on master node of k8s cluster and it's accessible using nodePort:30339 curl http://xx.xx.xx.xx:30339 { "name" : "elasticsearch-0", "cluster\_name" : "docker-cluster", "cluste… --- ## [Automating export from Elastic Cloud](https://discuss.elastic.co/t/automating-export-from-elastic-cloud/226045)
**Author:** [@t3fsx](https://discuss.elastic.co/u/t3fsx)\ **Replies:** 12\ **Last updated:** [April 6, 2020, 6:36pm UTC](https://discuss.elastic.co/t/automating-export-from-elastic-cloud/226045 "2020-04-06T18:36:10Z")
Hi, I read this thread (https://discuss.elastic.co/t/kibana-api-for-automatic-export-all/201243/3) which is attempting to do something very similar to what I'm trying and the information in it is valuable. That being s… --- ## [Search two slow](https://discuss.elastic.co/t/search-two-slow/155106)
**Author:** [@willam\_boss](https://discuss.elastic.co/u/willam_boss)\ **Replies:** 21\ **Last updated:** [November 8, 2018, 12:52pm UTC](https://discuss.elastic.co/t/search-two-slow/155106 "2018-11-08T12:52:28Z")
My index use ２T space, I have 10billion document， three nodes ,each node 4 cpus 13G mem , my match search is quite slow , it seem read io is use up , how to increase my search speed? --- ## ["MasterNotDiscoveredException" when working with multiple nodes](https://discuss.elastic.co/t/masternotdiscoveredexception-when-working-with-multiple-nodes/39506)
**Author:** [@anusha6](https://discuss.elastic.co/u/anusha6)\ **Replies:** 9\ **Last updated:** [January 20, 2016, 7:55am UTC](https://discuss.elastic.co/t/masternotdiscoveredexception-when-working-with-multiple-nodes/39506 "2016-01-20T07:55:32Z")
Hello Team, I have installed ES in two machines, and both nodes I setup as master nodes as shown Machine 1: cluster.name: elasticsearch node.name: "Franz Kafka1" node.master: true node.data: true discovery.zen.ping.m… --- ## [Stopping the entire cluster without any rebalancing](https://discuss.elastic.co/t/stopping-the-entire-cluster-without-any-rebalancing/5626)
**Author:** [@Steff](https://discuss.elastic.co/u/Steff)\ **Replies:** 10\ **Last updated:** [November 2, 2011, 2:07pm UTC](https://discuss.elastic.co/t/stopping-the-entire-cluster-without-any-rebalancing/5626 "2011-11-02T14:07:35Z")
Hi I am sure I have misunderstood something, so this question might be "stupid", but I ask anyway. As I understand it, when a node leaves the cluster, the rest of the cluster starts reestablishing (on the remaini… --- ## [ES Index performance](https://discuss.elastic.co/t/es-index-performance/6424)
**Author:** [@Oren\_Mazor](https://discuss.elastic.co/u/Oren_Mazor)\ **Replies:** 25\ **Last updated:** [February 16, 2012, 8:40pm UTC](https://discuss.elastic.co/t/es-index-performance/6424 "2012-02-16T20:40:35Z")
Hi all, We've deployed elasticsearch in our production and we're incredibly happy with search performance. However, we're seeing occasional issues where ES seems to return an older version of a record. In some cases… --- ## [How to add date format in \_delete\_by\_query](https://discuss.elastic.co/t/how-to-add-date-format-in-delete-by-query/254600)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 15\ **Last updated:** [November 11, 2020, 12:56pm UTC](https://discuss.elastic.co/t/how-to-add-date-format-in-delete-by-query/254600 "2020-11-11T12:56:30Z")
Hello Team Could you please help me how to add a format while performing operation of "\_delete\_by\_query" on Index were condition of deletion is based on range --\> on a field having type as "epoch" and i can pass the da… --- ## [Logstash CPU Problem](https://discuss.elastic.co/t/logstash-cpu-problem/348239)
**Author:** [@marcowiskhy](https://discuss.elastic.co/u/marcowiskhy)\ **Replies:** 13\ **Last updated:** [December 4, 2023, 3:37am UTC](https://discuss.elastic.co/t/logstash-cpu-problem/348239 "2023-12-04T03:37:54Z")
Hey guys, I am ingesting firewall logs through logstash via tcp input and am dealing with an issue. Event logs (e.g. vpn) and UTM arrive normally, but when I enable traffic logs (which jumps from 20 eps to 3k eps) logst… --- ## [Painless script to calculate elapsed time between two fields](https://discuss.elastic.co/t/painless-script-to-calculate-elapsed-time-between-two-fields/275133)
**Author:** [@theirfan](https://discuss.elastic.co/u/theirfan)\ **Replies:** 13\ **Last updated:** [June 10, 2021, 1:19pm UTC](https://discuss.elastic.co/t/painless-script-to-calculate-elapsed-time-between-two-fields/275133 "2021-06-10T13:19:05Z")
Hi All, i have two fields, up : "2021-06-03T07:01:56.159Z" down : "2021-06-03T10:01:29.978Z" Following the above link and solution, doc\['down'\].value.millis - doc\['up'\].value.millis shows me Script is invalid. Vi… --- ## [Can't restart kibana](https://discuss.elastic.co/t/cant-restart-kibana/312357)
**Author:** [@Sarindra\_Therese](https://discuss.elastic.co/u/Sarindra_Therese)\ **Replies:** 11\ **Last updated:** [August 26, 2022, 7:44am UTC](https://discuss.elastic.co/t/cant-restart-kibana/312357 "2022-08-26T07:44:22Z")
I've just started to learn elasticsearch and kibana yesterday, Today, when i try to restart kibana server, it's return me error: FATAL Error: Port 5601 is already in use. Another instance of Kibana may be running! Th… --- ## [Elastic 5 upgrade, groovy scripts dont execute](https://discuss.elastic.co/t/elastic-5-upgrade-groovy-scripts-dont-execute/65510)
**Author:** [@Justus](https://discuss.elastic.co/u/Justus)\ **Replies:** 9\ **Last updated:** [November 9, 2016, 4:07pm UTC](https://discuss.elastic.co/t/elastic-5-upgrade-groovy-scripts-dont-execute/65510 "2016-11-09T16:07:03Z")
I had a working set with groovy scripts on my Elastic server. Upgraded and no errors when running all as usual. Now I notice scripts dont execute or do anything. I copy the script files and Elastic compiles them fine. An… --- ## [Must not apply in must query result](https://discuss.elastic.co/t/must-not-apply-in-must-query-result/177042)
**Author:** [@Dilip\_Kumar](https://discuss.elastic.co/u/Dilip_Kumar)\ **Replies:** 13\ **Last updated:** [April 17, 2019, 3:09pm UTC](https://discuss.elastic.co/t/must-not-apply-in-must-query-result/177042 "2019-04-17T15:09:45Z")
Need to filter apply document having must FE=5 but if some FE=5 also having FE=17, then ignore those document. Please suggest "query": { "bool": { "must": \[ { "term": { "FE": { "value": "5" } } }, { "range": … --- ## [Beats and index naming](https://discuss.elastic.co/t/beats-and-index-naming/195073)
**Author:** [@Marcell0e](https://discuss.elastic.co/u/Marcell0e)\ **Replies:** 21\ **Last updated:** [August 19, 2019, 1:40am UTC](https://discuss.elastic.co/t/beats-and-index-naming/195073 "2019-08-19T01:40:56Z")
Here is an overview of what I am trying to do. I have my Logstash config file set up to index like this index =\> "%{\[@metadata\]\[beat\]}-%{+yyyy.ww}". When I try to load the winlogbeat beat template manually following th… --- ## [Webhook URL issue, always appending the query ? even without parameters](https://discuss.elastic.co/t/webhook-url-issue-always-appending-the-query-even-without-parameters/122577)
**Author:** [@sgrady](https://discuss.elastic.co/u/sgrady)\ **Replies:** 12\ **Last updated:** [March 23, 2018, 12:48am UTC](https://discuss.elastic.co/t/webhook-url-issue-always-appending-the-query-even-without-parameters/122577 "2018-03-23T00:48:14Z")
We setup an ElasticSearch watcher through the Kibana - ElasticSearch - Watcher - Watches. I added the JSON and our 'params' section is empty, but the generated URL always has a '?' appended even if we don't want any que… --- ## [Why is this (specific) mutate not working?](https://discuss.elastic.co/t/why-is-this-specific-mutate-not-working/219029)
**Author:** [@Dennis\_Bohs](https://discuss.elastic.co/u/Dennis_Bohs)\ **Replies:** 10\ **Last updated:** [February 20, 2020, 2:39pm UTC](https://discuss.elastic.co/t/why-is-this-specific-mutate-not-working/219029 "2020-02-20T14:39:35Z")
Hi Folks, it has been some time since i asked my last question here and i learned a lot in the meantime, but i still feel like a bloody beginner from time to time. Here comes my Situation: I am filtering several logs … --- ## [Perl regex search support in elastic search](https://discuss.elastic.co/t/perl-regex-search-support-in-elastic-search/58273)
**Author:** [@subbu.nv](https://discuss.elastic.co/u/subbu.nv)\ **Replies:** 10\ **Last updated:** [August 19, 2016, 6:48pm UTC](https://discuss.elastic.co/t/perl-regex-search-support-in-elastic-search/58273 "2016-08-19T18:48:27Z")
Do we have perl regex support in elastic search? example: perl regex: \[a-z\]{3}#\\s(\[x,0-9,H,N,L,^,-\]){1,}\\^\\d{2}\\:\\d{2}\\:\\d{2}\\^\\d\*((\\^\\d+){1,})((\\^\\d.\\d+){1,}) equivalent java regex: \[a-z\]{1,3}\\# {1,}\\^\[0-9\]{1,2}\\:\[0-9… --- ## [\[2024-06-06T00:16:32,277\]\[ERROR\]\[o.e.b.Elasticsearch \] \[server.domain.co.uk\] fatal exception while booting Elasticsearch java.lang.NullPointerException: Cannot invoke "org.elasticsearch.nativeaccess.Systemd.notify\_ready()" because "this.systemd" is](https://discuss.elastic.co/t/2024-06-06t0032-277-error-o-e-b-elasticsearch-server-domain-co-uk-fatal-exception-while-booting-elasticsearch-java-lang-nullpointerexception-cannot-invoke-org-elasticsearch-nativeaccess-systemd-notify-ready-because-this-systemd-is/360895)
**Author:** [@Rezwan\_Ahmed\_Sami](https://discuss.elastic.co/u/Rezwan_Ahmed_Sami)\ **Replies:** 17\ **Last updated:** [June 12, 2024, 6:56pm UTC](https://discuss.elastic.co/t/2024-06-06t0032-277-error-o-e-b-elasticsearch-server-domain-co-uk-fatal-exception-while-booting-elasticsearch-java-lang-nullpointerexception-cannot-invoke-org-elasticsearch-nativeaccess-systemd-notify-ready-because-this-systemd-is/360895 "2024-06-12T18:56:04Z")
\[2024-06-06T00:16:32,277\]\[ERROR\]\[o.e.b.Elasticsearch \] \[server.domain.co.uk\] fatal exception while booting Elasticsearch java.lang.NullPointerException: Cannot invoke "org.elasticsearch.nativeaccess.Systemd.notify\_… --- ## [Mongodb river plugin](https://discuss.elastic.co/t/mongodb-river-plugin/10204)
**Author:** [@Janusz\_Dalecki](https://discuss.elastic.co/u/Janusz_Dalecki)\ **Replies:** 12\ **Last updated:** [June 4, 2013, 10:14pm UTC](https://discuss.elastic.co/t/mongodb-river-plugin/10204 "2013-06-04T22:14:47Z")
Hi, I am trying to use mongodb river plugin – unfortunately without any success. When I try to execute this command: http://localhost:9200/\_river/mongodb/\_meta { "type": "mongodb", "mongodb… --- ## [CSV files have different columns](https://discuss.elastic.co/t/csv-files-have-different-columns/185063)
**Author:** [@EZprogramming](https://discuss.elastic.co/u/EZprogramming)\ **Replies:** 15\ **Last updated:** [June 12, 2019, 7:08pm UTC](https://discuss.elastic.co/t/csv-files-have-different-columns/185063 "2019-06-12T19:08:54Z")
Hi everyone, Issue: I have two kinds CSV file, one kind (default) has two columns, and the other one (custom) has about seventeen columns. Default CSV: rosbagTimestamp data 1.56E+18 53829632 1.56E+18 538296… --- ## [Help parsing nested JSON from VirusTotal](https://discuss.elastic.co/t/help-parsing-nested-json-from-virustotal/98900)
**Author:** [@kolmai](https://discuss.elastic.co/u/kolmai)\ **Replies:** 11\ **Last updated:** [September 24, 2017, 12:52pm UTC](https://discuss.elastic.co/t/help-parsing-nested-json-from-virustotal/98900 "2017-09-24T12:52:20Z")
Hello everyone, I’m trying to get started with Elastic stack and my first attempt is to index a complex JSON into ES using the following config has failed. input { beats { port =\> 5044 tags =\> "beats" } } … --- ## [Error on running Elasticsearch from the command line](https://discuss.elastic.co/t/error-on-running-elasticsearch-from-the-command-line/324305)
**Author:** [@umairsaeed](https://discuss.elastic.co/u/umairsaeed)\ **Replies:** 9\ **Last updated:** [February 1, 2023, 11:09am UTC](https://discuss.elastic.co/t/error-on-running-elasticsearch-from-the-command-line/324305 "2023-02-01T11:09:12Z")
I downloaded, unzipped, and run Elasticsearch from the command line successfully. But after closing the command line, I am trying to run the Elasticsearch from the command line again, but it is giving me an error "localh… --- ## [After migrating from 7.8.3 to 7.10.2 kibana keeps restarting](https://discuss.elastic.co/t/after-migrating-from-7-8-3-to-7-10-2-kibana-keeps-restarting/263261)
**Author:** [@cor](https://discuss.elastic.co/u/cor)\ **Replies:** 16\ **Last updated:** [February 10, 2021, 12:38pm UTC](https://discuss.elastic.co/t/after-migrating-from-7-8-3-to-7-10-2-kibana-keeps-restarting/263261 "2021-02-10T12:38:47Z")
Hi all, Ather upgrading Elasticsearch and Kibana to 7.10.2, Kibana keeps restarting. during logging it repeats the following message over and over using different PID codes. '{"type":"log","@timestamp":"2021-02-04T14:… --- ## [Receiving "timed out waiting for all nodes to process published state"](https://discuss.elastic.co/t/receiving-timed-out-waiting-for-all-nodes-to-process-published-state/291670)
**Author:** [@pratiksha](https://discuss.elastic.co/u/pratiksha)\ **Replies:** 13\ **Last updated:** [December 21, 2021, 7:44am UTC](https://discuss.elastic.co/t/receiving-timed-out-waiting-for-all-nodes-to-process-published-state/291670 "2021-12-21T07:44:44Z")
I am using Elasticsearch v6.6.1. There are total 16 nodes (10 data, 3 master, 3 client). I see a frequent message in elected master logs: {"type":"log","host":"Elasticsearch-master-55ff74b94d-ckhfw","level":"WARN", "ti… --- ## [Exclude last value in a line graph of kibana](https://discuss.elastic.co/t/exclude-last-value-in-a-line-graph-of-kibana/225348)
**Author:** [@vidhyadhara](https://discuss.elastic.co/u/vidhyadhara)\ **Replies:** 19\ **Last updated:** [April 2, 2020, 1:34pm UTC](https://discuss.elastic.co/t/exclude-last-value-in-a-line-graph-of-kibana/225348 "2020-04-02T13:34:26Z")
Hello, Here is my situation- I need to plot a line graph in kibana, which will have 2 lines. First Line(say line A) will represent 10 data points, Second line(say line B) should only represent 9 data points. To be exa… --- ## [Our elastic search query performance is VERY low](https://discuss.elastic.co/t/our-elastic-search-query-performance-is-very-low/82108)
**Author:** [@Indyan\_Minerva](https://discuss.elastic.co/u/Indyan_Minerva)\ **Replies:** 11\ **Last updated:** [April 13, 2017, 10:55am UTC](https://discuss.elastic.co/t/our-elastic-search-query-performance-is-very-low/82108 "2017-04-13T10:55:57Z")
Hi, I have a 5 node ES cluster (each node is single core and 4Gig RAM) which is receiving data from metricbeat and winbeat via logstash. The data generally amounts to 175 GB and is stored in a per-day index. Even wh… --- ## [Modsecurity Log Grok Filter](https://discuss.elastic.co/t/modsecurity-log-grok-filter/256057)
**Author:** [@reza\_naipospos](https://discuss.elastic.co/u/reza_naipospos)\ **Replies:** 10\ **Last updated:** [November 20, 2020, 4:21am UTC](https://discuss.elastic.co/t/modsecurity-log-grok-filter/256057 "2020-11-20T04:21:28Z")
I make grok filter with this condition but noting show anything on grok debugger. Log format is Modsecurity audit log (?%{YEAR}\[./\]%{MONTHNUM}\[./\]%{MONTHDAY} %{TIME}) \[%{LOGLEVEL:severity}\] %{POSINT:pid}#%{NUMBER:thread… --- ## [Finding in-process events by comparing time ranges](https://discuss.elastic.co/t/finding-in-process-events-by-comparing-time-ranges/63605)
**Author:** [@pchr-srf](https://discuss.elastic.co/u/pchr-srf)\ **Replies:** 10\ **Last updated:** [October 21, 2016, 1:33pm UTC](https://discuss.elastic.co/t/finding-in-process-events-by-comparing-time-ranges/63605 "2016-10-21T13:33:50Z")
Hi! We're getting all events that happen (=start and end) during a certain time span: { "filter": { "range": { "start": { "gte": "2016-10-21T05:00:00+02:00", "lt": "2016-10-2… --- ## [Ingest attachment plugin (Index files multiple time to same \_id)](https://discuss.elastic.co/t/ingest-attachment-plugin-index-files-multiple-time-to-same-id/138006)
**Author:** [@workland](https://discuss.elastic.co/u/workland)\ **Replies:** 15\ **Last updated:** [August 13, 2018, 10:29pm UTC](https://discuss.elastic.co/t/ingest-attachment-plugin-index-files-multiple-time-to-same-id/138006 "2018-08-13T22:29:31Z")
I had a document stored in Elastic Search under unique id which has an array of pdf files indexed in it along with other information(Name, Phone No, etc...). Now i want to update same document(\_id) by adding new pdf file… --- ## [Outofmemory exception on ES 1.7.0](https://discuss.elastic.co/t/outofmemory-exception-on-es-1-7-0/26908)
**Author:** [@kkomv](https://discuss.elastic.co/u/kkomv)\ **Replies:** 9\ **Last updated:** [August 11, 2015, 3:20pm UTC](https://discuss.elastic.co/t/outofmemory-exception-on-es-1-7-0/26908 "2015-08-11T15:20:13Z")
Hi, We are seeing an out of memory exception on the Elasticsearech JVM , as it is running out of heap space after a while. We are using elastic search version 1.7.0, with 1.7.0\_79 version of java, when we looked at the… --- ## [Logstash rss plugin not storing field](https://discuss.elastic.co/t/logstash-rss-plugin-not-storing-field/106447)
**Author:** [@prophoto](https://discuss.elastic.co/u/prophoto)\ **Replies:** 14\ **Last updated:** [November 27, 2017, 2:02pm UTC](https://discuss.elastic.co/t/logstash-rss-plugin-not-storing-field/106447 "2017-11-27T14:02:23Z")
I have successfully setup the logstash-rss-plugin and its working fine except one field is not being stored. I need it since the feed items are updated regularly, and without it I am getting duplicate entries in Elastics… --- ## [ElasticSearch 1.7.3 vs 2.0 vs 2.1 missing data](https://discuss.elastic.co/t/elasticsearch-1-7-3-vs-2-0-vs-2-1-missing-data/36502)
**Author:** [@Adam\_Wrobel](https://discuss.elastic.co/u/Adam_Wrobel)\ **Replies:** 9\ **Last updated:** [December 16, 2015, 8:31am UTC](https://discuss.elastic.co/t/elasticsearch-1-7-3-vs-2-0-vs-2-1-missing-data/36502 "2015-12-16T08:31:30Z")
Hi. I have ES cluster running on 1.7.3 storing logs parsed by logstash. I want to upgrade to ES 2.x, so I ran migration plugin to check what I needed to change. I prepare new logstash template compatible with ES 2.x a… --- ## [Invalid User Agent String](https://discuss.elastic.co/t/invalid-user-agent-string/181048)
**Author:** [@anushshukla](https://discuss.elastic.co/u/anushshukla)\ **Replies:** 11\ **Last updated:** [June 3, 2019, 12:07pm UTC](https://discuss.elastic.co/t/invalid-user-agent-string/181048 "2019-06-03T12:07:33Z")
We have observed that the user agent string (user\_agent.original field name) in kibana logs is showing as fp/f99c5a for all or any web view browsers instead of the actual user agent string. To verify and confirm it,… --- ## [ES cluster break after install x-pack](https://discuss.elastic.co/t/es-cluster-break-after-install-x-pack/135509)
**Author:** [@Vikrant\_Aggarwal](https://discuss.elastic.co/u/Vikrant_Aggarwal)\ **Replies:** 11\ **Last updated:** [June 13, 2018, 6:41am UTC](https://discuss.elastic.co/t/es-cluster-break-after-install-x-pack/135509 "2018-06-13T06:41:05Z")
I have created ES cluster on MAC laptop with 1 client, 3 master and 3 data nodes. $ cat multinode\_es.sh #!/bin/bash ### Client node $HOME/Documents/ELK/ELASTIC/clientnode/elasticsearch-6.2.4/bin/elasticsearch & ### M… --- ## [Elasticsearch pending\_tasks](https://discuss.elastic.co/t/elasticsearch-pending-tasks/150459)
**Author:** [@hanbj](https://discuss.elastic.co/u/hanbj)\ **Replies:** 10\ **Last updated:** [October 1, 2018, 1:27am UTC](https://discuss.elastic.co/t/elasticsearch-pending-tasks/150459 "2018-10-01T01:27:32Z")
Hello everyone: ES nodes are normal, cluster state is green, but the cluster appears a large number of pending\_tasks, and the task in the queue for several minutes, how should be processed, there is no solution. The fo… --- ## [Beats =\> Logstash =\> Elasticsearch ingestion](https://discuss.elastic.co/t/beats-logstash-elasticsearch-ingestion/195986)
**Author:** [@payneb25827](https://discuss.elastic.co/u/payneb25827)\ **Replies:** 13\ **Last updated:** [August 27, 2019, 6:52pm UTC](https://discuss.elastic.co/t/beats-logstash-elasticsearch-ingestion/195986 "2019-08-27T18:52:49Z")
Hello, I am new user of the elastic components. I am trying to get a FileBeats =\> Logstash =\> ElasticSearch pipeline working. I have been able to verify LS =\> ES working, but nothing is happening with FB =\> LS. I have ch… --- ## [Struggling to get Top-Hits Visualization to work](https://discuss.elastic.co/t/struggling-to-get-top-hits-visualization-to-work/151848)
**Author:** [@faulander](https://discuss.elastic.co/u/faulander)\ **Replies:** 11\ **Last updated:** [October 11, 2018, 2:11pm UTC](https://discuss.elastic.co/t/struggling-to-get-top-hits-visualization-to-work/151848 "2018-10-11T14:11:27Z")
I did understand that Top-Hits always shows the latest value. In my visualization it jumps from Zero Values to real values every 2-3 refreshs, and i cannot figure out why. Here is the setting: Running Elastic and… --- ## [Elasticsearch 6.3.0 unavailable in maven repository](https://discuss.elastic.co/t/elasticsearch-6-3-0-unavailable-in-maven-repository/138782)
**Author:** [@Rick\_Cole](https://discuss.elastic.co/u/Rick_Cole)\ **Replies:** 11\ **Last updated:** [August 1, 2018, 3:20pm UTC](https://discuss.elastic.co/t/elasticsearch-6-3-0-unavailable-in-maven-repository/138782 "2018-08-01T15:20:54Z")
When attempting to download the elasticsearch distribution zip from the maven global repository, I am getting a 404. Is anyone else having this issue? https://repo1.maven.org/maven2/org/elasticsearch/distribution/zip/el… --- ## [Restoring indexes with curator](https://discuss.elastic.co/t/restoring-indexes-with-curator/158925)
**Author:** [@Dmytro\_Kulyk](https://discuss.elastic.co/u/Dmytro_Kulyk)\ **Replies:** 10\ **Last updated:** [December 4, 2018, 1:31pm UTC](https://discuss.elastic.co/t/restoring-indexes-with-curator/158925 "2018-12-04T13:31:41Z")
Hi, I have a problem with restoring indexes from one cluster to another. I'm using curator tool with actionfile: \> actions: \> 1: \> action: close \> options: \> delete\_aliases: False \> … --- ## [Logstash has fetched the data but not shipped into Elasticsearch no error in logstash cmd](https://discuss.elastic.co/t/logstash-has-fetched-the-data-but-not-shipped-into-elasticsearch-no-error-in-logstash-cmd/210632)
**Author:** [@swati\_dupare](https://discuss.elastic.co/u/swati_dupare)\ **Replies:** 14\ **Last updated:** [December 6, 2019, 5:02am UTC](https://discuss.elastic.co/t/logstash-has-fetched-the-data-but-not-shipped-into-elasticsearch-no-error-in-logstash-cmd/210632 "2019-12-06T05:02:51Z")
Hi, I am fetching data from another database server. data is fetching but not inserted into elastcisearch, No error is showing in logstash cmd [Previous page](https://discuss.elastic.co/top.md?page=143&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=145&per_page=50&period=all)