# Top **URL:** https://discuss.elastic.co/top.md?page=1448&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1449 --- ## [Rsyslog to logstash use mmsequence mod](https://discuss.elastic.co/t/rsyslog-to-logstash-use-mmsequence-mod/1680)
**Author:** [@lee62817](https://discuss.elastic.co/u/lee62817)\ **Replies:** 1\ **Last updated:** [June 2, 2015, 3:42am UTC](https://discuss.elastic.co/t/rsyslog-to-logstash-use-mmsequence-mod/1680 "2015-06-02T03:42:48Z")
HI! i want to use rsyslog mmsequence & omfwd send log to logstash but nothing log send to logstash please help me to fix error ! thank you rsyslog os:centos 7 10.5.1.189 elk os:centos 7 10.5.1.111 rsyslog.con… --- ## [HTTP request from Painless script?](https://discuss.elastic.co/t/http-request-from-painless-script/308884)
**Author:** [@kennyprisjakt](https://discuss.elastic.co/u/kennyprisjakt)\ **Replies:** 2\ **Last updated:** [July 5, 2022, 10:19am UTC](https://discuss.elastic.co/t/http-request-from-painless-script/308884 "2022-07-05T10:19:59Z")
Hey, I'm currently looking for a way to do HTTP requests from a Painless script. Is that possible? Because i have not seen any examples of it when searching for it. Use case: Basically what i'm trying to do is runtim… --- ## [Logs ML event.dataset type error](https://discuss.elastic.co/t/logs-ml-event-dataset-type-error/292510)
**Author:** [@Travis\_Marble](https://discuss.elastic.co/u/Travis_Marble)\ **Replies:** 2\ **Last updated:** [December 22, 2021, 12:08am UTC](https://discuss.elastic.co/t/logs-ml-event-dataset-type-error/292510 "2021-12-22T00:08:02Z")
I am trying to setup Logs ML anomaly detection and getting the following error at least one index has a field event.dataset without the correct type Here is the typings for my index, I have seen various questions abo… --- ## [How can I show average by 2 month from TSVB?](https://discuss.elastic.co/t/how-can-i-show-average-by-2-month-from-tsvb/234675)
**Author:** [@Ethonwu](https://discuss.elastic.co/u/Ethonwu)\ **Replies:** 2\ **Last updated:** [June 30, 2020, 8:26am UTC](https://discuss.elastic.co/t/how-can-i-show-average-by-2-month-from-tsvb/234675 "2020-06-30T08:26:44Z")
Hello , I am ELK rookie I have a small question wanna ask here How can I show average by 2 month from TSVB ? Here is sample data like this : date Execution Time Job Name 20200102 … --- ## [Scripting Query for returning cases where array size is larger than X](https://discuss.elastic.co/t/scripting-query-for-returning-cases-where-array-size-is-larger-than-x/214892)
**Author:** [@spdoes](https://discuss.elastic.co/u/spdoes)\ **Replies:** 2\ **Last updated:** [January 14, 2020, 8:36am UTC](https://discuss.elastic.co/t/scripting-query-for-returning-cases-where-array-size-is-larger-than-x/214892 "2020-01-14T08:36:20Z")
I want to make a query that counts how many elements there are in the field that is a array of jsons objects. When I run: {script: { script: "doc\['field\_name'\].values.length() \> 0"}} I get: "No field found for \[field… --- ## [Grok filter fails when met with new line in multiline log](https://discuss.elastic.co/t/grok-filter-fails-when-met-with-new-line-in-multiline-log/200837)
**Author:** [@TheNmaptomyHeartBeat](https://discuss.elastic.co/u/TheNmaptomyHeartBeat)\ **Replies:** 2\ **Last updated:** [September 25, 2019, 12:28pm UTC](https://discuss.elastic.co/t/grok-filter-fails-when-met-with-new-line-in-multiline-log/200837 "2019-09-25T12:28:54Z")
Hi, I'm trying to parse some logs into Ealsticsearch from Filebeat. The logs has a new line in them and their format is as follows: # error 123 failed attempt because blah blah I am changing the filter in the ingest… --- ## [Watcher HTTP Input request](https://discuss.elastic.co/t/watcher-http-input-request/176101)
**Author:** [@dmdm](https://discuss.elastic.co/u/dmdm)\ **Replies:** 2\ **Last updated:** [April 11, 2019, 2:01pm UTC](https://discuss.elastic.co/t/watcher-http-input-request/176101 "2019-04-11T14:01:36Z")
Is there a way to sort this on a field for example end\_time so that when I check this value ctx.payload.snapshots.0.state it will be the last snapshot that ran? "trigger": { "schedule": { "interval": "1h" … --- ## [Snapshot Strategy for archival](https://discuss.elastic.co/t/snapshot-strategy-for-archival/96672)
**Author:** [@cgspohn](https://discuss.elastic.co/u/cgspohn)\ **Replies:** 2\ **Last updated:** [August 10, 2017, 9:27pm UTC](https://discuss.elastic.co/t/snapshot-strategy-for-archival/96672 "2017-08-10T21:27:42Z")
Hello, for disclamer: I am well aware that snapshots created on a certain version of elasticsearch may only be restored in a cluster of the same version, and that snapshots are not a real archival full-proof solution, b… --- ## [Ruby filter limitations to hash tables?](https://discuss.elastic.co/t/ruby-filter-limitations-to-hash-tables/94946)
**Author:** [@markchagers](https://discuss.elastic.co/u/markchagers)\ **Replies:** 2\ **Last updated:** [July 28, 2017, 1:16pm UTC](https://discuss.elastic.co/t/ruby-filter-limitations-to-hash-tables/94946 "2017-07-28T13:16:24Z")
Are there any limitations to what you can do with a hash table in the ruby filter? I’m trying things that work well in regular ruby, but which cause logstash --config.test\_and\_exit to throw an error. I have searched the… --- ## [Getting ElasticsearchSecurityException while working with ES 5.4.0](https://discuss.elastic.co/t/getting-elasticsearchsecurityexception-while-working-with-es-5-4-0/86556)
**Author:** [@pkumar25](https://discuss.elastic.co/u/pkumar25)\ **Replies:** 2\ **Last updated:** [June 19, 2017, 1:58am UTC](https://discuss.elastic.co/t/getting-elasticsearchsecurityexception-while-working-with-es-5-4-0/86556 "2017-06-19T01:58:30Z")
I am trying to use ElasticSearch 5.4.0 to create a TransportClient and utilize it for indexing records in my local ES cluster. The client, I have created, is as follows: @SuppressWarnings({ "resource", "unchecked" }) p… --- ## [Logstash es\_bulk codec only processing last event](https://discuss.elastic.co/t/logstash-es-bulk-codec-only-processing-last-event/56771)
**Author:** [@esds2000](https://discuss.elastic.co/u/esds2000)\ **Replies:** 2\ **Last updated:** [August 1, 2016, 6:46pm UTC](https://discuss.elastic.co/t/logstash-es-bulk-codec-only-processing-last-event/56771 "2016-08-01T18:46:32Z")
Trying send bulk index request through a logstash pipeline using the http input with es\_bulk codec. Having an issue where only the last event in the payload is being passed through. Sending the same payload to elasticsea… --- ## [Meaning of topbeat fields](https://discuss.elastic.co/t/meaning-of-topbeat-fields/52844)
**Author:** [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Replies:** 2\ **Last updated:** [June 15, 2016, 10:15am UTC](https://discuss.elastic.co/t/meaning-of-topbeat-fields/52844 "2016-06-15T10:15:32Z")
I am using topbeat to feed metrics to the server, however, I do not quite understand the meaning of those fields after reading the documentation. For load.load1, it states that it is the number of jobs in run queue pe… --- ## [I would like to know about the limit on the maximum number of documents per index](https://discuss.elastic.co/t/i-would-like-to-know-about-the-limit-on-the-maximum-number-of-documents-per-index/339497)
**Author:** [@bbasosuho](https://discuss.elastic.co/u/bbasosuho)\ **Replies:** 3\ **Last updated:** [July 28, 2023, 6:50am UTC](https://discuss.elastic.co/t/i-would-like-to-know-about-the-limit-on-the-maximum-number-of-documents-per-index/339497 "2023-07-28T06:50:17Z")
Hi We are going to use elasticsearch 8.7. I would like to know if there is a limit on the number of documents to be stored in one index. Is there a limit on the number of documents per index? Or is there a limit on th… --- ## [Search over all fields](https://discuss.elastic.co/t/search-over-all-fields/271511)
**Author:** [@Sander\_Marx](https://discuss.elastic.co/u/Sander_Marx)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 8:33pm UTC](https://discuss.elastic.co/t/search-over-all-fields/271511 "2021-04-28T20:33:13Z")
Hi, i have a index with multiple documents with severeal fields. I want to be able to search over all the fields without using multi\_match and manualy writing each field. Is there a way to do this? Here is an example of… --- ## ["Bad Request" loggued with debug level?](https://discuss.elastic.co/t/bad-request-loggued-with-debug-level/263230)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 3\ **Last updated:** [February 9, 2021, 8:32am UTC](https://discuss.elastic.co/t/bad-request-loggued-with-debug-level/263230 "2021-02-09T08:32:11Z")
I have to set log level DEBUG to see Bad Request error: {"type": "server", "timestamp": "2021-02-04T10:19:16,959Z", "level": "DEBUG", "component": "r.suppressed", "cluster.name": "conso", "node.name": "conso-es-client-0… --- ## [Filebeat do not send logs to kafka](https://discuss.elastic.co/t/filebeat-do-not-send-logs-to-kafka/238718)
**Author:** [@ramgold9](https://discuss.elastic.co/u/ramgold9)\ **Replies:** 3\ **Last updated:** [June 26, 2020, 9:47pm UTC](https://discuss.elastic.co/t/filebeat-do-not-send-logs-to-kafka/238718 "2020-06-26T21:47:01Z")
Hello Everyone, We are trying implement a centralized logging solution filebeats (on eks) -\>kafka -\> elasticsearch(aws). I have tried different versions of filebeat 6.X and 7.X with different valid versions of kafka. F… --- ## [Расчёт кластера ELK: сколько данных поступает?](https://discuss.elastic.co/t/elk/232911)
**Author:** [@sergey371](https://discuss.elastic.co/u/sergey371)\ **Replies:** 3\ **Last updated:** [May 19, 2020, 5:10pm UTC](https://discuss.elastic.co/t/elk/232911 "2020-05-19T17:10:33Z")
Основными исходными данными для расчёта кластера ELK являются сведения о количестве поступающих данных в единицу времени. Где в самом кластере ELK можно увидеть сколько же данных поступает? Какую именно статистику смот… --- ## [APM transaction data not compressed properly](https://discuss.elastic.co/t/apm-transaction-data-not-compressed-properly/224030)
**Author:** [@Rakesh\_B](https://discuss.elastic.co/u/Rakesh_B)\ **Replies:** 3\ **Last updated:** [March 18, 2020, 2:16pm UTC](https://discuss.elastic.co/t/apm-transaction-data-not-compressed-properly/224030 "2020-03-18T14:16:26Z")
If you are asking about a problem you are experiencing, please use the following template, as it will help us help you. If you have a different problem, please delete all of this text :slight\_smile: Kibana version: 7.5… --- ## [Config filebeat only to read last 5 minutes of log file](https://discuss.elastic.co/t/config-filebeat-only-to-read-last-5-minutes-of-log-file/200669)
**Author:** [@Ingram\_Gultom](https://discuss.elastic.co/u/Ingram_Gultom)\ **Replies:** 3\ **Last updated:** [September 27, 2019, 4:39pm UTC](https://discuss.elastic.co/t/config-filebeat-only-to-read-last-5-minutes-of-log-file/200669 "2019-09-27T16:39:43Z")
Can filebeat read only last 5 minutes of log file? From the doc only found tail\_files but its for read latest line of log --- ## [Canvas -Display Time diff](https://discuss.elastic.co/t/canvas-display-time-diff/198935)
**Author:** [@cesarlino](https://discuss.elastic.co/u/cesarlino)\ **Replies:** 3\ **Last updated:** [September 12, 2019, 3:13pm UTC](https://discuss.elastic.co/t/canvas-display-time-diff/198935 "2019-09-12T15:13:20Z")
Hi, I read https://discuss.elastic.co/t/difference-between-two-datetimes-in-essql-in-canvas-no-script-fields/175471 that TIMESTAMPDIFF is not yet available for elasticsearch sql. I am wondering if there is another way t… --- ## [Problem in building libbeat according to the developer guide](https://discuss.elastic.co/t/problem-in-building-libbeat-according-to-the-developer-guide/61069)
**Author:** [@wing999](https://discuss.elastic.co/u/wing999)\ **Replies:** 3\ **Last updated:** [October 5, 2016, 6:29pm UTC](https://discuss.elastic.co/t/problem-in-building-libbeat-according-to-the-developer-guide/61069 "2016-10-05T18:29:24Z")
Hello All, I am following the "Developer Guide: Creating a New Beat" and trying to develop my own beat. However, I have encountered a problem in the step "Building and Running the Beat". After I execute "make", I get t… --- ## [Unable to restart LS with: Logstash failed to create queue](https://discuss.elastic.co/t/unable-to-restart-ls-with-logstash-failed-to-create-queue/226134)
**Author:** [@mtudisco](https://discuss.elastic.co/u/mtudisco)\ **Replies:** 0\ **Last updated:** [April 1, 2020, 11:26pm UTC](https://discuss.elastic.co/t/unable-to-restart-ls-with-logstash-failed-to-create-queue/226134 "2020-04-01T23:26:36Z")
Hi, We have Logstash 7.5.1 configure with pipelines, our pipelines configuration is: - pipeline.id: main path.config: "/etc/logstash/config/main/\*.conf" queue.type: persisted queue.checkpoint.writes: 1 pipeline… --- ## [Elasticsearch - start checks failing as rootless containers](https://discuss.elastic.co/t/elasticsearch-start-checks-failing-as-rootless-containers/361622)
**Author:** [@alro](https://discuss.elastic.co/u/alro)\ **Replies:** 4\ **Last updated:** [June 18, 2024, 11:53am UTC](https://discuss.elastic.co/t/elasticsearch-start-checks-failing-as-rootless-containers/361622 "2024-06-18T11:53:58Z")
Hi I'm trying to get an Elasctsearch cluster running on RHEL9.4 with Podman. My podman-compose files run and the cluster members try to start. but I get the following error message: {"@timestamp":"2024-06-18T09:25:08.… --- ## [Elastic search fails during restart with unknown setting \[metadata.labels.app\]](https://discuss.elastic.co/t/elastic-search-fails-during-restart-with-unknown-setting-metadata-labels-app/328804)
**Author:** [@sunil\_s](https://discuss.elastic.co/u/sunil_s)\ **Replies:** 4\ **Last updated:** [March 29, 2023, 10:20am UTC](https://discuss.elastic.co/t/elastic-search-fails-during-restart-with-unknown-setting-metadata-labels-app/328804 "2023-03-29T10:20:56Z")
.plugins.PluginsService","elasticsearch.node.name":"es-cluster-1","elasticsearch.cluster.name":"k8s-logs"} {"@timestamp":"2023-03-29T06:06:49.266Z", "log.level":"ERROR", "message":"fatal exception while booting Elasticse… --- ## [Wrong Timezone in Painless Function](https://discuss.elastic.co/t/wrong-timezone-in-painless-function/209905)
**Author:** [@TomTom](https://discuss.elastic.co/u/TomTom)\ **Replies:** 4\ **Last updated:** [December 2, 2019, 2:33pm UTC](https://discuss.elastic.co/t/wrong-timezone-in-painless-function/209905 "2019-12-02T14:33:55Z")
The government of our country recently canceled daylight saving time, and now functions using timezone return to America / Sao\_Paulo the value -02 instead of -03, but if I test with America / Buenos\_Aires, the value retu… --- ## [How does synonym filter work in search phase](https://discuss.elastic.co/t/how-does-synonym-filter-work-in-search-phase/148401)
**Author:** [@merlinv](https://discuss.elastic.co/u/merlinv)\ **Replies:** 4\ **Last updated:** [September 27, 2018, 2:28am UTC](https://discuss.elastic.co/t/how-does-synonym-filter-work-in-search-phase/148401 "2018-09-27T02:28:07Z")
Hi there, I create a sample synonym filter like below PUT /test\_index { "settings": { "index" : { "analysis" : { "analyzer" : { "synonym" : { … --- ## [Translate filter is not working](https://discuss.elastic.co/t/translate-filter-is-not-working/130526)
**Author:** [@bijay](https://discuss.elastic.co/u/bijay)\ **Replies:** 4\ **Last updated:** [May 7, 2018, 5:38pm UTC](https://discuss.elastic.co/t/translate-filter-is-not-working/130526 "2018-05-07T17:38:38Z")
Logstash Version - 6.6.2 Translate Filter Version - 3.0.4 Drop Filter Version - 3.0.5 logstash-config ============= input { stdin { codec =\> json } } filter { translate { field =\> "comp" dictionary\_path =\> "/e… --- ## [How to count the quantity of documents?](https://discuss.elastic.co/t/how-to-count-the-quantity-of-documents/113522)
**Author:** [@f26227279](https://discuss.elastic.co/u/f26227279)\ **Replies:** 4\ **Last updated:** [December 30, 2017, 11:15am UTC](https://discuss.elastic.co/t/how-to-count-the-quantity-of-documents/113522 "2017-12-30T11:15:06Z")
this is my restful api: I want to sum the document(total),besides the protocol 17 and 6 . How can I do. "Udp|Tcp" : { "terms" : { "field" : "PROTOCOL", "include" : \["17", "6"\] } } response: "Udp|Tcp": { "doc\_c… --- ## [Kibana freezes on Document level security on shield](https://discuss.elastic.co/t/kibana-freezes-on-document-level-security-on-shield/62339)
**Author:** [@Yasho](https://discuss.elastic.co/u/Yasho)\ **Replies:** 4\ **Last updated:** [October 6, 2016, 12:59pm UTC](https://discuss.elastic.co/t/kibana-freezes-on-document-level-security-on-shield/62339 "2016-10-06T12:59:34Z")
Hi, I am setting up LDAP auth using shield. I want to establish document level security , so that the Kibana users will not be able to view certain data on the reports. I am using Trail version of Shield. Both ES and sh… --- ## [How can I apply a term filter on percolator's id?](https://discuss.elastic.co/t/how-can-i-apply-a-term-filter-on-percolators-id/54085)
**Author:** [@giovannialbero1992](https://discuss.elastic.co/u/giovannialbero1992)\ **Replies:** 4\ **Last updated:** [June 28, 2016, 3:45pm UTC](https://discuss.elastic.co/t/how-can-i-apply-a-term-filter-on-percolators-id/54085 "2016-06-28T15:45:21Z")
Hello everybody, today I've tried to apply a filter on percolator's id something like this GET index\_test/type/75143/\_percolate { "filter": { "term": { "\_id": "percolator\_29684" } } } but the resp… --- ## [How to manage logstash deployments?](https://discuss.elastic.co/t/how-to-manage-logstash-deployments/44768)
**Author:** [@Joshua\_P](https://discuss.elastic.co/u/Joshua_P)\ **Replies:** 4\ **Last updated:** [March 18, 2016, 11:20am UTC](https://discuss.elastic.co/t/how-to-manage-logstash-deployments/44768 "2016-03-18T11:20:41Z")
What's the best way to manage multiple Logstash deployments? I have a testing environment and a production environment and each has it's own configuration file pulling data from its respective data store and sending t… --- ## [Adding analyzer to dynamic fields](https://discuss.elastic.co/t/adding-analyzer-to-dynamic-fields/11727)
**Author:** [@Onur\_Aktas](https://discuss.elastic.co/u/Onur_Aktas)\ **Replies:** 4\ **Last updated:** [April 30, 2013, 4:27pm UTC](https://discuss.elastic.co/t/adding-analyzer-to-dynamic-fields/11727 "2013-04-30T16:27:40Z")
Hi, I'm new to ES and need some advice about mapping / adding analyzers to dynamic fields. The product document I want to Index in ES has some dynamic fields (fields starting with "f\_") based on the Product type. … --- ## [Forcing Analysis of Terms and Span Terms?](https://discuss.elastic.co/t/forcing-analysis-of-terms-and-span-terms/9838)
**Author:** [@Michael\_Sander](https://discuss.elastic.co/u/Michael_Sander)\ **Replies:** 4\ **Last updated:** [November 27, 2012, 11:40pm UTC](https://discuss.elastic.co/t/forcing-analysis-of-terms-and-span-terms/9838 "2012-11-27T23:40:23Z")
Is there any way to force term queries to be analyzed? How about span\_term queries? I would like to use the span\_near query but it only accepts other span-type queries as part of its clauses. The other span-type … --- ## [Parse Error json object](https://discuss.elastic.co/t/parse-error-json-object/264534)
**Author:** [@ljeganathan](https://discuss.elastic.co/u/ljeganathan)\ **Replies:** 1\ **Last updated:** [February 17, 2021, 5:05pm UTC](https://discuss.elastic.co/t/parse-error-json-object/264534 "2021-02-17T17:05:47Z")
Hi, I am getting parse error like below JSON parse error, original data now in message field {:error=\>#\ **Author:** [@waynebloss](https://discuss.elastic.co/u/waynebloss)\ **Replies:** 1\ **Last updated:** [June 11, 2020, 8:27pm UTC](https://discuss.elastic.co/t/how-to-update-elasticsearch-search-analyzer-mapping-without-conflict-on-analyzer/236533 "2020-06-11T20:27:35Z") Also asked on StackOverflow I'm using version 7.7 of ElasticSearch, LogStash and Kibana and trying to update an index mapping for a field is resulting in one of 2 errors: mapper\_parsing\_exception: analyzer on field \[t… --- ## [Empty Slices with Scan/Scroll](https://discuss.elastic.co/t/empty-slices-with-scan-scroll/127255)
**Author:** [@bevans88](https://discuss.elastic.co/u/bevans88)\ **Replies:** 1\ **Last updated:** [April 9, 2018, 6:15pm UTC](https://discuss.elastic.co/t/empty-slices-with-scan-scroll/127255 "2018-04-09T18:15:35Z")
Hi, We're currently using Spark with es-hadoop to read 1 million documents from an Elasticsearch index. The sliced scan scroll that it is using internally is not evenly distributing the results across the slices; in fac… --- ## [Kibana UI not displaying after Install on virtual box VM](https://discuss.elastic.co/t/kibana-ui-not-displaying-after-install-on-virtual-box-vm/121215)
**Author:** [@amit\_ahuja](https://discuss.elastic.co/u/amit_ahuja)\ **Replies:** 1\ **Last updated:** [February 23, 2018, 3:39pm UTC](https://discuss.elastic.co/t/kibana-ui-not-displaying-after-install-on-virtual-box-vm/121215 "2018-02-23T15:39:53Z")
Hello, i have install Kibana and elastic search and both are running but Kibana UI not getting opened on my windows browser. i have instaled kibana on centos 7 VM running on oracle virtual box. httpd page is coming fin… --- ## [スコア計算について](https://discuss.elastic.co/t/topic/82578)
**Author:** [@yuji\_kumada](https://discuss.elastic.co/u/yuji_kumada)\ **Replies:** 1\ **Last updated:** [April 28, 2017, 8:34am UTC](https://discuss.elastic.co/t/topic/82578 "2017-04-28T08:34:59Z")
いつもお世話になります。 Elasticsearchの検索スコア計算について、アドバイスをお願いします。 Elasticserach ver.1.4.1 TF（Document内のTermのマッチ率） IDF（INDEX内の全Documentに対する、Termを含んだDocumentの比率） DocumentのLengthがより短いもの 50音順 Boost より、スコアを計算し検索結果をソートしていると考えておりますが… --- ## [Watcher Email Action - Connection Refused!](https://discuss.elastic.co/t/watcher-email-action-connection-refused/75546)
**Author:** [@rlonberg](https://discuss.elastic.co/u/rlonberg)\ **Replies:** 1\ **Last updated:** [February 17, 2017, 10:14pm UTC](https://discuss.elastic.co/t/watcher-email-action-connection-refused/75546 "2017-02-17T22:14:01Z")
I've been experimenting with elastic watcher over the past few days and have been pretty impressed with the alerting API so far. One thing I have had trouble with is configuring email action. We have a passwordless SMTP … --- ## [How do I download logs messages/documents from Kibana 4/Elastic server?](https://discuss.elastic.co/t/how-do-i-download-logs-messages-documents-from-kibana-4-elastic-server/64012)
**Author:** [@mkhapali](https://discuss.elastic.co/u/mkhapali)\ **Replies:** 1\ **Last updated:** [October 26, 2016, 11:56pm UTC](https://discuss.elastic.co/t/how-do-i-download-logs-messages-documents-from-kibana-4-elastic-server/64012 "2016-10-26T23:56:07Z")
Hi there, I want to download a set of log message/documents from elastic server, I know that we have "request" json in the Kibana 4 dashboard, Can I use a CURL to get the messages with request json? If yes, do we h… --- ## [Get latest document of each unique record](https://discuss.elastic.co/t/get-latest-document-of-each-unique-record/52356)
**Author:** [@esap](https://discuss.elastic.co/u/esap)\ **Replies:** 1\ **Last updated:** [June 9, 2016, 8:18pm UTC](https://discuss.elastic.co/t/get-latest-document-of-each-unique-record/52356 "2016-06-09T20:18:46Z")
We have about 300,000 unique customers. We have one document each for every order placed, so we have several million order documents since the past 3 years. How can I get the latest order document for each unique custo… --- ## [Elastic Watcher License?](https://discuss.elastic.co/t/elastic-watcher-license/27125)
**Author:** [@Mark\_Vervuurt](https://discuss.elastic.co/u/Mark_Vervuurt)\ **Replies:** 1\ **Last updated:** [August 10, 2015, 2:20pm UTC](https://discuss.elastic.co/t/elastic-watcher-license/27125 "2015-08-10T14:20:09Z")
Hi Everyone, Does the usage of Watcher in Development or Production require a license? Thanks. Regards, Mark --- ## [Problem with indexing Cisco Logfiles](https://discuss.elastic.co/t/problem-with-indexing-cisco-logfiles/309724)
**Author:** [@MADxHAWK](https://discuss.elastic.co/u/MADxHAWK)\ **Replies:** 5\ **Last updated:** [August 3, 2022, 7:40am UTC](https://discuss.elastic.co/t/problem-with-indexing-cisco-logfiles/309724 "2022-08-03T07:40:18Z")
Hello Community, i am quite new to ELK-Stack and i ran into some problems with indexing Cisco Logfiles to make them searchable in Kibana. Background informations: Server A: xx.xxx.xxx.102 (Loghost) Running syslog-ng… --- ## [Archive data elastic stack](https://discuss.elastic.co/t/archive-data-elastic-stack/276034)
**Author:** [@ima](https://discuss.elastic.co/u/ima)\ **Replies:** 5\ **Last updated:** [June 15, 2021, 10:36pm UTC](https://discuss.elastic.co/t/archive-data-elastic-stack/276034 "2021-06-15T22:36:33Z")
hello everybody can anyone please help me i need to know if it is possible to archive the ELK logs to an external storage off the current platform, and the data will still be searchable. and does anybody know of a method… --- ## [How does elasticsearch rank matching results?](https://discuss.elastic.co/t/how-does-elasticsearch-rank-matching-results/274325)
**Author:** [@Later](https://discuss.elastic.co/u/Later)\ **Replies:** 5\ **Last updated:** [May 28, 2021, 3:36pm UTC](https://discuss.elastic.co/t/how-does-elasticsearch-rank-matching-results/274325 "2021-05-28T15:36:35Z")
Hello. Can you explain lucidly (My knowledge in this field is almost zero) how the search engine rank matching results when a user performs a search (I think this is called search engine algorithm)? What are ranking fac… --- ## [ML Datafeed lookback retrieved no data](https://discuss.elastic.co/t/ml-datafeed-lookback-retrieved-no-data/256864)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 5\ **Last updated:** [November 30, 2020, 2:40pm UTC](https://discuss.elastic.co/t/ml-datafeed-lookback-retrieved-no-data/256864 "2020-11-30T14:40:15Z")
Hello, I am trying to run the job "windows\_rare\_user\_type10\_remote\_login" in my cluster and It process no data, and I am getting ML Datafeed lookback retrieved no data Knowing that I already installed winlogbeat in s… --- ## [Logstash pipelines not working together, but separately yes](https://discuss.elastic.co/t/logstash-pipelines-not-working-together-but-separately-yes/244973)
**Author:** [@Andrea\_Bozzano](https://discuss.elastic.co/u/Andrea_Bozzano)\ **Replies:** 5\ **Last updated:** [August 14, 2020, 12:46pm UTC](https://discuss.elastic.co/t/logstash-pipelines-not-working-together-but-separately-yes/244973 "2020-08-14T12:46:00Z")
Hi everyone, and sorry to bother you but i can't find a proper solution to this. I'm trying to setup a pipelines.yml file to ingest data with Logstash through 3 pipelines. I'm running Logstash on a single node ELK stac… --- ## [Send data in seperate lines from beats](https://discuss.elastic.co/t/send-data-in-seperate-lines-from-beats/210169)
**Author:** [@Saravana37](https://discuss.elastic.co/u/Saravana37)\ **Replies:** 5\ **Last updated:** [December 17, 2019, 12:30pm UTC](https://discuss.elastic.co/t/send-data-in-seperate-lines-from-beats/210169 "2019-12-17T12:30:41Z")
Hi , We are configuring Siebel app server monitoring and we are running a batch file in execbeat . our output looks like below . Siebel Enterprise Applications Siebel Server Manager, Version 16.19.0.0 \[23057\] LANG\_IND… --- ## [ELPASED Filter - Works differently 6.8.1 vs 7.1 - Possible Bug?](https://discuss.elastic.co/t/elpased-filter-works-differently-6-8-1-vs-7-1-possible-bug/187400)
**Author:** [@AquaX](https://discuss.elastic.co/u/AquaX)\ **Replies:** 5\ **Last updated:** [July 1, 2019, 2:12pm UTC](https://discuss.elastic.co/t/elpased-filter-works-differently-6-8-1-vs-7-1-possible-bug/187400 "2019-07-01T14:12:58Z")
I have noticed something interesting. I have a configuration that uses the logstash-filter-elapsed plugin (latest version) to get the time difference between two log entries. Log entries: 2019.04.25|09:36:49.850||B8CA… --- ## [Multi-metric Job](https://discuss.elastic.co/t/multi-metric-job/176213)
**Author:** [@Prabhav](https://discuss.elastic.co/u/Prabhav)\ **Replies:** 5\ **Last updated:** [April 12, 2019, 7:41pm UTC](https://discuss.elastic.co/t/multi-metric-job/176213 "2019-04-12T19:41:26Z")
I have been trying to perform some tasks for anomaly detection and was using the multi metric viewer to analyze so. But couldn't understand why the the split data field was showing so many metrics? In all the tutoria… [Previous page](https://discuss.elastic.co/top.md?page=1447&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1449&per_page=50&period=all)