# Top **URL:** https://discuss.elastic.co/top.md?page=1461&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1462 --- ## [Creating latency graph using timelion or line graph](https://discuss.elastic.co/t/creating-latency-graph-using-timelion-or-line-graph/171132)
**Author:** [@Dheerajbtu](https://discuss.elastic.co/u/Dheerajbtu)\ **Replies:** 3\ **Last updated:** [March 7, 2019, 3:41pm UTC](https://discuss.elastic.co/t/creating-latency-graph-using-timelion-or-line-graph/171132 "2019-03-07T15:41:28Z")
Hi, I have some documents in elasticsearch, below is the sample document. { "\_index": "mulesoft-log-mon-2019.03.05", "\_type": "doc", "\_id": "yCPzTWkBSDlUxQpoJfQf", "\_score": 1, "\_source": { "policyViolation": nul… --- ## [Number of Fields showing in Kibana](https://discuss.elastic.co/t/number-of-fields-showing-in-kibana/63795)
**Author:** [@vishnu](https://discuss.elastic.co/u/vishnu)\ **Replies:** 3\ **Last updated:** [October 25, 2016, 9:36pm UTC](https://discuss.elastic.co/t/number-of-fields-showing-in-kibana/63795 "2016-10-25T21:36:25Z")
Hi, I have create my own custom fields in kibana. when i expand that i see only field saying that it is based on Top 5 fields based on the documents in the table. Is there any way i can sort displaying unique values kib… --- ## [Dynamically changing user access](https://discuss.elastic.co/t/dynamically-changing-user-access/41266)
**Author:** [@djmcgreal](https://discuss.elastic.co/u/djmcgreal)\ **Replies:** 3\ **Last updated:** [February 10, 2016, 12:35am UTC](https://discuss.elastic.co/t/dynamically-changing-user-access/41266 "2016-02-10T00:35:21Z")
Hi Elastic Shield folks, Is it possible to have a dynamic set of changing rules at runtime? For example, I would like to have a social network approach to data access - where each user manages some groups other users… --- ## [Percolator TRACE logging](https://discuss.elastic.co/t/percolator-trace-logging/37463)
**Author:** [@anishek](https://discuss.elastic.co/u/anishek)\ **Replies:** 3\ **Last updated:** [December 28, 2015, 6:32am UTC](https://discuss.elastic.co/t/percolator-trace-logging/37463 "2015-12-28T06:32:20Z")
Hello, We are using es 1.7.3 and percolation heavily. We are having uneven distribution of load even will all shards being on all nodes in the cluster, hence i want to enable TRACE logs for \_percolate call. i tried en… --- ## [Help with indexing nested json object](https://discuss.elastic.co/t/help-with-indexing-nested-json-object/31800)
**Author:** [@Michael\_Washaya](https://discuss.elastic.co/u/Michael_Washaya)\ **Replies:** 3\ **Last updated:** [October 7, 2015, 7:34pm UTC](https://discuss.elastic.co/t/help-with-indexing-nested-json-object/31800 "2015-10-07T19:34:27Z")
how to i index this json object, please help. \[ { "id":1, "firstName":"John", "lastName":"Smith", "sex":"FEMALE", "birthdate":1444025680962, "address":\[{"id":1,"streetName":"100 Nzou Street","surbub":"Mufakose","… --- ## [Collector \[cluster\_stats\] failed to collect data](https://discuss.elastic.co/t/collector-cluster-stats-failed-to-collect-data/203376)
**Author:** [@yeziblo](https://discuss.elastic.co/u/yeziblo)\ **Replies:** 0\ **Last updated:** [October 14, 2019, 3:59am UTC](https://discuss.elastic.co/t/collector-cluster-stats-failed-to-collect-data/203376 "2019-10-14T03:59:45Z")
Hi, everyone. I got a error in es log: \[2019-10-14T11:34:20,210\]\[ERROR\]\[o.e.x.m.c.c.ClusterStatsCollector\] \[node2\] collector \[cluster\_stats\] failed to collect data java.lang.NullPointerException: null at org.elastics… --- ## [Kibana.alert.reason in actions](https://discuss.elastic.co/t/kibana-alert-reason-in-actions/290081)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 11:10pm UTC](https://discuss.elastic.co/t/kibana-alert-reason-in-actions/290081 "2021-12-09T23:10:50Z")
Is it possible to use kibana.alert.reason within the actions. I have tried {{#context.alerts}}{{kibana.alert.reason}}{{/context.alerts}} --- ## [Elasticsearch 5.6 docker-compose x-pack license expired](https://discuss.elastic.co/t/elasticsearch-5-6-docker-compose-x-pack-license-expired/268068)
**Author:** [@s-light](https://discuss.elastic.co/u/s-light)\ **Replies:** 1\ **Last updated:** [March 23, 2021, 11:33pm UTC](https://discuss.elastic.co/t/elasticsearch-5-6-docker-compose-x-pack-license-expired/268068 "2021-03-23T23:33:44Z")
hello community, iam currently try to restart my elastic-search setup for my owncloud instance. sadly the newest elasticsearch version supported there is 5.6 :frowning: after my first setup all was fine. now i had so… --- ## [How include the hostname and location of the log within Watcher alerts?](https://discuss.elastic.co/t/how-include-the-hostname-and-location-of-the-log-within-watcher-alerts/135833)
**Author:** [@rishabh](https://discuss.elastic.co/u/rishabh)\ **Replies:** 1\ **Last updated:** [July 3, 2018, 8:40am UTC](https://discuss.elastic.co/t/how-include-the-hostname-and-location-of-the-log-within-watcher-alerts/135833 "2018-07-03T08:40:18Z")
How to include the hostname and location of the log within Watcher alerts? My watcher alerts are going to slack but not showing hostname. I am preety new in using kibana. Please help me know step by step How to do it… --- ## [Failed to start filebeat\_ drop\_fields processors](https://discuss.elastic.co/t/failed-to-start-filebeat-drop-fields-processors/299154)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 6\ **Last updated:** [March 14, 2022, 6:53pm UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-drop-fields-processors/299154 "2022-03-14T18:53:03Z")
good day I have a problem when I start filebeat I get the following error: and this is my configuration in filebeat.yml # ================================= Processors ================================= processors: #… --- ## [Composite aggregation returns old version documents](https://discuss.elastic.co/t/composite-aggregation-returns-old-version-documents/252353)
**Author:** [@And390](https://discuss.elastic.co/u/And390)\ **Replies:** 6\ **Last updated:** [October 19, 2020, 7:40am UTC](https://discuss.elastic.co/t/composite-aggregation-returns-old-version-documents/252353 "2020-10-19T07:40:47Z")
Hello. I found that in some cases composite aggregation returns old documents (the initial indexed version instead of updated). Steps to reproduce: curl -X PUT -H 'Content-Type: application/json' localhost:9200/test -d … --- ## [Failed to start elasticsearch 7.0 from service](https://discuss.elastic.co/t/failed-to-start-elasticsearch-7-0-from-service/177798)
**Author:** [@yama2k](https://discuss.elastic.co/u/yama2k)\ **Replies:** 6\ **Last updated:** [April 25, 2019, 2:21am UTC](https://discuss.elastic.co/t/failed-to-start-elasticsearch-7-0-from-service/177798 "2019-04-25T02:21:45Z")
Hi all. I' m trying to start elasticsearch from service following this instruction. https://www.elastic.co/guide/en/elasticsearch/reference/7.0/starting-elasticsearch.html I cannot start elasticsearch. Cannot find jav… --- ## [Finding the script/query behind a table](https://discuss.elastic.co/t/finding-the-script-query-behind-a-table/80032)
**Author:** [@tomer](https://discuss.elastic.co/u/tomer)\ **Replies:** 6\ **Last updated:** [March 27, 2017, 12:35pm UTC](https://discuss.elastic.co/t/finding-the-script-query-behind-a-table/80032 "2017-03-27T12:35:53Z")
How can I found the script/query behind a table (Kibana 5). For an example in this table: I want to see the query on how to get the field of hits.total (that is equal to 96) --- ## [River Plugin for postgresql db - deleting documents in ES that are deleted in postgresql db](https://discuss.elastic.co/t/river-plugin-for-postgresql-db-deleting-documents-in-es-that-are-deleted-in-postgresql-db/14722)
**Author:** [@Isabella](https://discuss.elastic.co/u/Isabella)\ **Replies:** 6\ **Last updated:** [December 7, 2013, 4:17pm UTC](https://discuss.elastic.co/t/river-plugin-for-postgresql-db-deleting-documents-in-es-that-are-deleted-in-postgresql-db/14722 "2013-12-07T16:17:59Z")
Hello everyone! I am creating an river plugin that synchronizes ES and a postgresql database. I work with an timestamp to check if my document in the database has changed, if it has changed it is re-indexed i… --- ## [Kubernetes agent with self signed certificate](https://discuss.elastic.co/t/kubernetes-agent-with-self-signed-certificate/312434)
**Author:** [@deborggraever](https://discuss.elastic.co/u/deborggraever)\ **Replies:** 1\ **Last updated:** [August 22, 2022, 12:57pm UTC](https://discuss.elastic.co/t/kubernetes-agent-with-self-signed-certificate/312434 "2022-08-22T12:57:30Z")
Hi, I have installed an on-prem elastic cluster with kibana and fleet. All use xpack with a self signed root certificate. I installed elastic agents for logging and metrics on multiple servers (Ubuntu 20.04) where the… --- ## [Kibana is not able to visit with error code 503 and 000](https://discuss.elastic.co/t/kibana-is-not-able-to-visit-with-error-code-503-and-000/287434)
**Author:** [@KypMon](https://discuss.elastic.co/u/KypMon)\ **Replies:** 1\ **Last updated:** [October 23, 2021, 5:29pm UTC](https://discuss.elastic.co/t/kibana-is-not-able-to-visit-with-error-code-503-and-000/287434 "2021-10-23T17:29:29Z")
I just follow along the tutorial helm-charts/elasticsearch/examples/security at main · elastic/helm-charts · GitHub and helm-charts/kibana/examples/security at main · elastic/helm-charts · GitHub Elasticsearch all works… --- ## [Automatically download dashboard csv file by api fail](https://discuss.elastic.co/t/automatically-download-dashboard-csv-file-by-api-fail/284441)
**Author:** [@luckygoodlily](https://discuss.elastic.co/u/luckygoodlily)\ **Replies:** 1\ **Last updated:** [October 1, 2021, 1:05pm UTC](https://discuss.elastic.co/t/automatically-download-dashboard-csv-file-by-api-fail/284441 "2021-10-01T13:05:24Z")
Hello, we are developing a project for company, and we are working with the ELK stack. I have a problem that I have some visualizations in Dashboard and I want to download csv file by shell script (Automatically generat… --- ## [Trying to pass mongodb id as elasticsearch id](https://discuss.elastic.co/t/trying-to-pass-mongodb-id-as-elasticsearch-id/262449)
**Author:** [@fidsamurai](https://discuss.elastic.co/u/fidsamurai)\ **Replies:** 1\ **Last updated:** [January 28, 2021, 6:40am UTC](https://discuss.elastic.co/t/trying-to-pass-mongodb-id-as-elasticsearch-id/262449 "2021-01-28T06:40:37Z")
Logstash 7.8 We have a case where we collect logs from a mobile app using parse-sdk. The data is sent to a MongoDB replicaset. Logstash is configured using the mongoschema jdbc driver to pull the data from Mongo and p… --- ## [Will replica shards in single node cluster consume jvm heap memory](https://discuss.elastic.co/t/will-replica-shards-in-single-node-cluster-consume-jvm-heap-memory/246940)
**Author:** [@divya\_lakshmi](https://discuss.elastic.co/u/divya_lakshmi)\ **Replies:** 7\ **Last updated:** [September 3, 2020, 4:14pm UTC](https://discuss.elastic.co/t/will-replica-shards-in-single-node-cluster-consume-jvm-heap-memory/246940 "2020-09-03T16:14:31Z")
Hi, I am using single node with 8 GB JVM (half of total 16 GB). Total shards = 1951 I know ES will refuse to allocate both the primary shard and a replica shard on the same machine.but is this replica shards consuming… --- ## [Kibana Authentication Exception issue after running 1 minute](https://discuss.elastic.co/t/kibana-authentication-exception-issue-after-running-1-minute/211649)
**Author:** [@tpetersen](https://discuss.elastic.co/u/tpetersen)\ **Replies:** 1\ **Last updated:** [December 12, 2019, 2:50pm UTC](https://discuss.elastic.co/t/kibana-authentication-exception-issue-after-running-1-minute/211649 "2019-12-12T14:50:28Z")
Hi people, Got an annoying problem here with Kibana 6.8.0, setting up a test cluster with HTTPS and Xpack enabled. The Elastic cluster is running ok and our application can use this just fine. But Kibana can only run 1… --- ## [Discover Not Loading Data](https://discuss.elastic.co/t/discover-not-loading-data/106498)
**Author:** [@Staggerlee011](https://discuss.elastic.co/u/Staggerlee011)\ **Replies:** 1\ **Last updated:** [November 6, 2017, 12:07pm UTC](https://discuss.elastic.co/t/discover-not-loading-data/106498 "2017-11-06T12:07:53Z")
Hi, Im new to the elasticstack, so please bear with me. I have created an elasticsearch template to create rolling indexes. I am then pushing data in, I can run get sqltable/sqltable\_size/\_count which returns: { "… --- ## [Logstash if and Mutate hostname](https://discuss.elastic.co/t/logstash-if-and-mutate-hostname/90449)
**Author:** [@Sinethra\_Seneviratne](https://discuss.elastic.co/u/Sinethra_Seneviratne)\ **Replies:** 1\ **Last updated:** [June 22, 2017, 12:40pm UTC](https://discuss.elastic.co/t/logstash-if-and-mutate-hostname/90449 "2017-06-22T12:40:55Z")
hi, im trying to filter my S3 logs and change Original value of the " cs\_host " field to a different one, This is the filter block of my Logstash conf. But this isn't working. Please let me know whats wrong here. filte… --- ## [Grok parse failure in Logstash](https://discuss.elastic.co/t/grok-parse-failure-in-logstash/74601)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 1\ **Last updated:** [February 10, 2017, 8:22am UTC](https://discuss.elastic.co/t/grok-parse-failure-in-logstash/74601 "2017-02-10T08:22:00Z")
I am using filebeat to push files to kafka and then consume it using Logstash. Below is the filebeat output. { "@timestamp": "2017-02-10T05:07:06.895Z", "beat": { "hostname": "mypc", "name": "mybeat", "… --- ## [Mutate Add\_field](https://discuss.elastic.co/t/mutate-add-field/61791)
**Author:** [@13koushik](https://discuss.elastic.co/u/13koushik)\ **Replies:** 1\ **Last updated:** [September 30, 2016, 5:26am UTC](https://discuss.elastic.co/t/mutate-add-field/61791 "2016-09-30T05:26:10Z")
I'm new to Logstash and I would be thankful if you could help me out. Is it possible to create an array using add\_field of mutate. Below is my config file, input { file { path =\> "/opt/logAnalyzer/source/log\_/.txt" sta… --- ## [Packectbeat: Windows with multiple network interfaces](https://discuss.elastic.co/t/packectbeat-windows-with-multiple-network-interfaces/46836)
**Author:** [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\ **Replies:** 1\ **Last updated:** [April 8, 2016, 9:33pm UTC](https://discuss.elastic.co/t/packectbeat-windows-with-multiple-network-interfaces/46836 "2016-04-08T21:33:00Z")
packetbeat -devices listing multiple network interfaces, 0: \\Device\\NPF\_{2EB816F1-6B79-4A9A-AE86-2222FEE25ECB} (Microsoft) 1: \\Device\\NPF\_{FEAD6AD3-D7BF-4738-AA20-12222C6ECA6CF} (Microsoft) 2: \\Device\\NPF\_{287BF3DC-F… --- ## [How to run logstash-forwarder on unix](https://discuss.elastic.co/t/how-to-run-logstash-forwarder-on-unix/686)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 1\ **Last updated:** [May 14, 2015, 2:25pm UTC](https://discuss.elastic.co/t/how-to-run-logstash-forwarder-on-unix/686 "2015-05-14T14:25:23Z")
Hello Firends, I am new to logstash/ELK. I have successfully configured logstash-forwarder, logstash, Elasticsearch and Kibana on windows 7 and indexed logs. When I copied all setup to unix, then all went OK except forwa… --- ## [Marking url as dead. Last error: HostUnreachableError](https://discuss.elastic.co/t/marking-url-as-dead-last-error-hostunreachableerror/228202)
**Author:** [@Chris\_Wilmott](https://discuss.elastic.co/u/Chris_Wilmott)\ **Replies:** 0\ **Last updated:** [April 15, 2020, 8:37pm UTC](https://discuss.elastic.co/t/marking-url-as-dead-last-error-hostunreachableerror/228202 "2020-04-15T20:37:37Z")
Hi, I have updated my ElasticSearch cluster from 6.6 to 7.6.2, as part of this upgrade the \_all field and the \_default\_ fields were removed. I updated the cluster, checked the logs, and sure enough, one of my templates… --- ## [Exploitation of the physical cores available on a Kibana server](https://discuss.elastic.co/t/exploitation-of-the-physical-cores-available-on-a-kibana-server/226756)
**Author:** [@Michael\_Nicemen](https://discuss.elastic.co/u/Michael_Nicemen)\ **Replies:** 4\ **Last updated:** [April 19, 2020, 4:55pm UTC](https://discuss.elastic.co/t/exploitation-of-the-physical-cores-available-on-a-kibana-server/226756 "2020-04-19T16:55:37Z")
Hi all, I'm testing a full Elastic Stack installation (v.7.6.0) and it seems Kibana web server ("node") is not trying to exploit at best the available cores on the server where it is up and running. Looking at the CPU … --- ## [Persistant mapping after deleting index (SOLVED - it was a template) \[noob\]](https://discuss.elastic.co/t/persistant-mapping-after-deleting-index-solved-it-was-a-template-noob/154613)
**Author:** [@dmnc](https://discuss.elastic.co/u/dmnc)\ **Replies:** 1\ **Last updated:** [October 30, 2018, 8:53pm UTC](https://discuss.elastic.co/t/persistant-mapping-after-deleting-index-solved-it-was-a-template-noob/154613 "2018-10-30T20:53:47Z")
Hi, I'm learning to ES and Logstash, and because I need to plot geopoints to the map, I've somehow created this mapping: { "mapping": { "\_doc": { "properties": { "location": { "type": "geo… --- ## [Logstash 2.2.0 vs Logstash 2.2.0 All Plugins](https://discuss.elastic.co/t/logstash-2-2-0-vs-logstash-2-2-0-all-plugins/40981)
**Author:** [@anhlqn](https://discuss.elastic.co/u/anhlqn)\ **Replies:** 4\ **Last updated:** [February 5, 2016, 5:35am UTC](https://discuss.elastic.co/t/logstash-2-2-0-vs-logstash-2-2-0-all-plugins/40981 "2016-02-05T05:35:27Z")
Hi everyone, Does anyone know what is the difference between the two packages? What plugins are not available in Logstash 2.2.0.tar.gz? Any pros or cons for using the Logstash 2.2.0 All Plugins vs. the other one? Th… --- ## [Get timestamp, date and time fields in date format in logstash](https://discuss.elastic.co/t/get-timestamp-date-and-time-fields-in-date-format-in-logstash/85020)
**Author:** [@gautamv](https://discuss.elastic.co/u/gautamv)\ **Replies:** 0\ **Last updated:** [May 9, 2017, 6:50am UTC](https://discuss.elastic.co/t/get-timestamp-date-and-time-fields-in-date-format-in-logstash/85020 "2017-05-09T06:50:30Z")
I'm trying to plot date histograms in kibana 5 for each day. Therefore, I want the x-axis to be just the time. Right now, I have a @timestamp field, which has the datetime captured as 2017-04-17T20:12:47.221Z. I'm captur… --- ## [HTTPJSON input : share request identifier among events](https://discuss.elastic.co/t/httpjson-input-share-request-identifier-among-events/293924)
**Author:** [@thopic](https://discuss.elastic.co/u/thopic)\ **Replies:** 5\ **Last updated:** [January 14, 2022, 10:23am UTC](https://discuss.elastic.co/t/httpjson-input-share-request-identifier-among-events/293924 "2022-01-14T10:23:41Z")
Hi, I've been struggling for a long time to configure my filebeat to request RESTful APIs when the response is a JSON array of multiple objects. Because I want to sum a metric over time (this metric is present in each … --- ## [Timestamp between certain hours any day?](https://discuss.elastic.co/t/timestamp-between-certain-hours-any-day/236535)
**Author:** [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)\ **Replies:** 2\ **Last updated:** [June 20, 2020, 12:22am UTC](https://discuss.elastic.co/t/timestamp-between-certain-hours-any-day/236535 "2020-06-20T00:22:23Z")
hi, i'm working a DFIR case, i'm fairly new to KIbana. i'm got millions of log entries to sift through. i need to see the log entries of a certain kind that were created after normal business hours any day of the week. … --- ## [Logstash monitoring vs management](https://discuss.elastic.co/t/logstash-monitoring-vs-management/209387)
**Author:** [@ibexit](https://discuss.elastic.co/u/ibexit)\ **Replies:** 2\ **Last updated:** [November 26, 2019, 6:41pm UTC](https://discuss.elastic.co/t/logstash-monitoring-vs-management/209387 "2019-11-26T18:41:18Z")
using docker-compose I´m able to start and monitor my logstash instance with this environment settings: - XPACK\_SECURITY\_ENABLED=true - XPACK.MONITORING.ENABLED=true - XPACK.MONITORING.ELASTICSEARCH.HOSTS=\["https://192.… --- ## [Autocomplete in elasticsearch](https://discuss.elastic.co/t/autocomplete-in-elasticsearch/88549)
**Author:** [@arafath](https://discuss.elastic.co/u/arafath)\ **Replies:** 2\ **Last updated:** [June 7, 2017, 11:34am UTC](https://discuss.elastic.co/t/autocomplete-in-elasticsearch/88549 "2017-06-07T11:34:07Z")
currently, I'm building autocomplete. here my Elasticsearch query. PUT test\_index { "settings": { "index": { "analysis": { "filter": { "stemmer": { "type": "stemmer", … --- ## [PKI authentication with shield - client certificate not requested](https://discuss.elastic.co/t/pki-authentication-with-shield-client-certificate-not-requested/56830)
**Author:** [@Elad\_Benedict](https://discuss.elastic.co/u/Elad_Benedict)\ **Replies:** 2\ **Last updated:** [August 1, 2016, 6:29am UTC](https://discuss.elastic.co/t/pki-authentication-with-shield-client-certificate-not-requested/56830 "2016-08-01T06:29:04Z")
Hi, I'm trying to configure shield with PKI user authentication. SSL seems to be configured and working properly (e.g. I can query over https). When I configure a realm chain with PKI it appears that a client certifi… --- ## [Load balance the events between the Logstash hosts](https://discuss.elastic.co/t/load-balance-the-events-between-the-logstash-hosts/44952)
**Author:** [@Sumantha\_Kannantha](https://discuss.elastic.co/u/Sumantha_Kannantha)\ **Replies:** 2\ **Last updated:** [March 21, 2016, 10:48am UTC](https://discuss.elastic.co/t/load-balance-the-events-between-the-logstash-hosts/44952 "2016-03-21T10:48:15Z")
This is regarding load balancing option we have for filebeat. logstash: hosts: \["host1:5044","host2:5044"\] loadbalance: true What will be the algorithm it will be using if we enable load balance? We are using codec =\>… --- ## [Grok seems not working anymore](https://discuss.elastic.co/t/grok-seems-not-working-anymore/42840)
**Author:** [@Weizhen\_Yan](https://discuss.elastic.co/u/Weizhen_Yan)\ **Replies:** 2\ **Last updated:** [March 1, 2016, 9:48am UTC](https://discuss.elastic.co/t/grok-seems-not-working-anymore/42840 "2016-03-01T09:48:36Z")
I'm trying to import nginx logs into ES, i'm using this patterns NGUSERNAME \[a-zA-Z\\.\\@\\-\\+\_%\]+ NGUSER %{NGUSERNAME} NGINXACCESS %{IPORHOST:clientip} - %{NOTSPACE:remote\_user} \\\[%{HTTPDATE:timestamp}\\\] \\"(?:%{WORD:verb}… --- ## [My query result will change in same params](https://discuss.elastic.co/t/my-query-result-will-change-in-same-params/29208)
**Author:** [@jianfeng\_ye](https://discuss.elastic.co/u/jianfeng_ye)\ **Replies:** 2\ **Last updated:** [September 14, 2015, 1:56am UTC](https://discuss.elastic.co/t/my-query-result-will-change-in-same-params/29208 "2015-09-14T01:56:38Z")
my query params like that $params = \[ 'index' =\> "questions", 'type' =\> "baichebao", 'body' =\> \[ 'from' =\> $from, 'size' =\> 1, 'sort' … --- ## [Query string query mini-language vs. grammar implementation?](https://discuss.elastic.co/t/query-string-query-mini-language-vs-grammar-implementation/18539)
**Author:** [@x0ne\_2](https://discuss.elastic.co/u/x0ne_2)\ **Replies:** 2\ **Last updated:** [July 10, 2014, 3:25pm UTC](https://discuss.elastic.co/t/query-string-query-mini-language-vs-grammar-implementation/18539 "2014-07-10T15:25:27Z")
Ever since I discovered the mini-language provided through the query string query (http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html), I have had a hard time go… --- ## [Duplicates when paging](https://discuss.elastic.co/t/duplicates-when-paging/14101)
**Author:** [@Juan](https://discuss.elastic.co/u/Juan)\ **Replies:** 2\ **Last updated:** [October 28, 2013, 7:46pm UTC](https://discuss.elastic.co/t/duplicates-when-paging/14101 "2013-10-28T19:46:34Z")
Hi, I am using ElasticSearch version 0.90.2 and when using the paging functionality I manage to get duplicates returned. The issue is that on our application we use the total records found, but when we start pag… --- ## [Grok to multiline ingestion does not handle rows](https://discuss.elastic.co/t/grok-to-multiline-ingestion-does-not-handle-rows/292412)
**Author:** [@tjswe](https://discuss.elastic.co/u/tjswe)\ **Replies:** 2\ **Last updated:** [December 19, 2021, 8:17pm UTC](https://discuss.elastic.co/t/grok-to-multiline-ingestion-does-not-handle-rows/292412 "2021-12-19T20:17:56Z")
Hi! Im ingesting .txt-files containing navtex-messages (see example below). Each message comes in a separate .txt-file appearing continuously over 24h landning in a sub-directory with the current date. input { file… --- ## [javax.security.auth.login.LoginException: Could not login: the client is being asked for a password, but the Kafka client code does not currently support obtaining a password from the user. not available to garner authentication information from the user](https://discuss.elastic.co/t/javax-security-auth-login-loginexception-could-not-login-the-client-is-being-asked-for-a-password-but-the-kafka-client-code-does-not-currently-support-obtaining-a-password-from-the-user-not-available-to-garner-authentication-information-from-the-user/321723)
**Author:** [@Balaganesh\_G](https://discuss.elastic.co/u/Balaganesh_G)\ **Replies:** 0\ **Last updated:** [December 21, 2022, 7:19am UTC](https://discuss.elastic.co/t/javax-security-auth-login-loginexception-could-not-login-the-client-is-being-asked-for-a-password-but-the-kafka-client-code-does-not-currently-support-obtaining-a-password-from-the-user-not-available-to-garner-authentication-information-from-the-user/321723 "2022-12-21T07:19:49Z")
Hi Team, I have using logstash 8.3.3 and migirated to new Logstash 8.5.3 facing below error. javax.security.auth.login.LoginException: Could not login: the client is being asked for a password, but the Kafka client cod… --- ## [ECK Fail to update status field of elasticsearch cluster on EKS 1.19](https://discuss.elastic.co/t/eck-fail-to-update-status-field-of-elasticsearch-cluster-on-eks-1-19/279246)
**Author:** [@Francesco\_Ciocchetti](https://discuss.elastic.co/u/Francesco_Ciocchetti)\ **Replies:** 3\ **Last updated:** [August 9, 2021, 3:51pm UTC](https://discuss.elastic.co/t/eck-fail-to-update-status-field-of-elasticsearch-cluster-on-eks-1-19/279246 "2021-08-09T15:51:40Z")
Hi, i am trying to get a cluster running on EKS 1.19 to sucessfully create an elasticsearchcluster using the ECK operator 1.6 the cluster gets created just fine when i create the elasticsearch resource and i can see the… --- ## [Time\_zone parameter](https://discuss.elastic.co/t/time-zone-parameter/275161)
**Author:** [@qwerty123](https://discuss.elastic.co/u/qwerty123)\ **Replies:** 3\ **Last updated:** [June 7, 2021, 2:41pm UTC](https://discuss.elastic.co/t/time-zone-parameter/275161 "2021-06-07T14:41:34Z")
hi !! does elasticsearch range query always work based on UTC time zone ?? if so, is it possible to change this and make it work according to user required time zone ?? even when i use time\_zone parameter in my query, t… --- ## [Query to get distinct values satisfying two or more conditions](https://discuss.elastic.co/t/query-to-get-distinct-values-satisfying-two-or-more-conditions/202659)
**Author:** [@ajsal\_shereef](https://discuss.elastic.co/u/ajsal_shereef)\ **Replies:** 3\ **Last updated:** [October 9, 2019, 11:42am UTC](https://discuss.elastic.co/t/query-to-get-distinct-values-satisfying-two-or-more-conditions/202659 "2019-10-09T11:42:43Z")
Hi, I'm a newbie to elastic search. I was working on some example queries. I have loaded Kibana flight data to the console. Now, I wanted to know the query which will fetch distict flights which land in Italy. Any help … --- ## [Mikrotik logs](https://discuss.elastic.co/t/mikrotik-logs/196610)
**Author:** [@Anand\_Malhotra](https://discuss.elastic.co/u/Anand_Malhotra)\ **Replies:** 0\ **Last updated:** [August 24, 2019, 7:06am UTC](https://discuss.elastic.co/t/mikrotik-logs/196610 "2019-08-24T07:06:24Z")
I want to parse the logs from mikrotik router..... My logs are of type..... "tags" =\> \[ \[0\] "\_geoip\_lookup\_failure" \], "type" =\> "syslog", "@version" =\> "1", "@timestamp" =\> 2019-08-24T05:09:51.875Z, "message" =\> … --- ## [Repository verification exception in kibana](https://discuss.elastic.co/t/repository-verification-exception-in-kibana/186042)
**Author:** [@swapnali](https://discuss.elastic.co/u/swapnali)\ **Replies:** 3\ **Last updated:** [June 19, 2019, 7:56am UTC](https://discuss.elastic.co/t/repository-verification-exception-in-kibana/186042 "2019-06-19T07:56:35Z")
Hi, I want to take snapshot of my cluster, i have three nodes elsearchdv1,elsearchdv2 , elsearchdv3 and master is elsearchdv2. I am using curator, version 5.7.6. i created repository using below command: PUT /\_snapsh… --- ## [Need recommended FileBeat config for logs that replace file every hour](https://discuss.elastic.co/t/need-recommended-filebeat-config-for-logs-that-replace-file-every-hour/145755)
**Author:** [@HackerHurricane](https://discuss.elastic.co/u/HackerHurricane)\ **Replies:** 3\ **Last updated:** [August 27, 2018, 8:49pm UTC](https://discuss.elastic.co/t/need-recommended-filebeat-config-for-logs-that-replace-file-every-hour/145755 "2018-08-27T20:49:48Z")
Hello all, I have a tool that we slurp up the files to Humio and FileBeat works perfectly if I delete the file before the task runs, but we would like not to delete the file so we don't get all the lines every hour, jus… --- ## [How to fetch ~12M documents(may be even more) quickly from ES using scroll API?](https://discuss.elastic.co/t/how-to-fetch-12m-documents-may-be-even-more-quickly-from-es-using-scroll-api/109822)
**Author:** [@harshil](https://discuss.elastic.co/u/harshil)\ **Replies:** 3\ **Last updated:** [November 30, 2017, 11:48pm UTC](https://discuss.elastic.co/t/how-to-fetch-12m-documents-may-be-even-more-quickly-from-es-using-scroll-api/109822 "2017-11-30T23:48:49Z")
Hello, I have a requirement to fetch ~12M documents (it could get more than that also..). I tried using scroll API with GET {index}/{type}/\_search?scroll=1m { "size": 10000, "sort": \["\_doc"\], "\_source": \["field\_1"… [Previous page](https://discuss.elastic.co/top.md?page=1460&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1462&per_page=50&period=all)