# Top **URL:** https://discuss.elastic.co/top.md?page=1465&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1466 --- ## [Migration issues from Logstash 2.4 to 5.6](https://discuss.elastic.co/t/migration-issues-from-logstash-2-4-to-5-6/119888)
**Author:** [@motts](https://discuss.elastic.co/u/motts)\ **Replies:** 5\ **Last updated:** [March 16, 2018, 4:36am UTC](https://discuss.elastic.co/t/migration-issues-from-logstash-2-4-to-5-6/119888 "2018-03-16T04:36:53Z")
Hello there, I am trying to migrate from 2.4 to 5.6 on CentOS 6.9 and I have a slight issue. When I try to start logstash via /etc/init.d/logstash.rpmsave start logstash I get an error in logstash.err stating WARNING… --- ## [Message not fully read (response) for SearchServiceTransportAction issue after upgrading to 0.90.0](https://discuss.elastic.co/t/message-not-fully-read-response-for-searchservicetransportaction-issue-after-upgrading-to-0-90-0/11896)
**Author:** [@keung2640](https://discuss.elastic.co/u/keung2640)\ **Replies:** 5\ **Last updated:** [June 5, 2013, 7:59am UTC](https://discuss.elastic.co/t/message-not-fully-read-response-for-searchservicetransportaction-issue-after-upgrading-to-0-90-0/11896 "2013-06-05T07:59:12Z")
Hi All, Sorry for this noob question. My index has 3 shards and 1 replica. There are 3 nodes(es version 0.90.0). When I do the query searching with search type DFS\_QUERY\_THEN\_FETCH on some special fields, ther… --- ## [ELK deploy no longer pulling in data. Logstash logs error, stops immediately](https://discuss.elastic.co/t/elk-deploy-no-longer-pulling-in-data-logstash-logs-error-stops-immediately/227503)
**Author:** [@EICAR-STANDARD-ANTIV](https://discuss.elastic.co/u/EICAR-STANDARD-ANTIV)\ **Replies:** 7\ **Last updated:** [April 10, 2020, 9:47pm UTC](https://discuss.elastic.co/t/elk-deploy-no-longer-pulling-in-data-logstash-logs-error-stops-immediately/227503 "2020-04-10T21:47:36Z")
Hi, I'm trying to run a log aggregation system based on ELK called LME \[1\]. I've pulled most of the text of this post out of the GitHub issue I created \[2\]. I was hoping maybe the community here would be able to e.g. t… --- ## [Bulk ingest of netflow and zeek logs into Elastic SIEM](https://discuss.elastic.co/t/bulk-ingest-of-netflow-and-zeek-logs-into-elastic-siem/204746)
**Author:** [@cks](https://discuss.elastic.co/u/cks)\ **Replies:** 1\ **Last updated:** [October 24, 2019, 3:07pm UTC](https://discuss.elastic.co/t/bulk-ingest-of-netflow-and-zeek-logs-into-elastic-siem/204746 "2019-10-24T15:07:17Z")
What would be best way to bulk ingest netflow and zeek logs into Elasticsearch, which I would like to access in SIEM in Kibana? I am looking to ingest several TBs of logs. I plan to bulk ingest other pcap, auth logs an… --- ## [Get all 3 million ids of a type very quickly](https://discuss.elastic.co/t/get-all-3-million-ids-of-a-type-very-quickly/107013)
**Author:** [@spotlight2001](https://discuss.elastic.co/u/spotlight2001)\ **Replies:** 1\ **Last updated:** [November 9, 2017, 10:14am UTC](https://discuss.elastic.co/t/get-all-3-million-ids-of-a-type-very-quickly/107013 "2017-11-09T10:14:04Z")
i want to get all ids of a type from elasticsearch via http i have approx. 3 million ids i am using scroll api scroll=1m size=10000 { "query": { "match\_all": { } }, "\_source": false, "sort": \["\_doc"\] } its f… --- ## [Tribe node to ignore cluster events](https://discuss.elastic.co/t/tribe-node-to-ignore-cluster-events/86328)
**Author:** [@bennett](https://discuss.elastic.co/u/bennett)\ **Replies:** 7\ **Last updated:** [May 20, 2017, 1:56pm UTC](https://discuss.elastic.co/t/tribe-node-to-ignore-cluster-events/86328 "2017-05-20T13:56:13Z")
Hi, I have tribe nodes that look at multiple clusters, but every time there's a index rotation or any sort of maintenance, the tribe node goes down until things are allocated and back to normal which could take over a… --- ## [Scored based on element present in array](https://discuss.elastic.co/t/scored-based-on-element-present-in-array/59541)
**Author:** [@Tominator](https://discuss.elastic.co/u/Tominator)\ **Replies:** 1\ **Last updated:** [September 1, 2016, 2:43pm UTC](https://discuss.elastic.co/t/scored-based-on-element-present-in-array/59541 "2016-09-01T14:43:53Z")
Hi, I would like to receive a score for my documents based on whether or not a value is present in an array, not on how many other values are in the array. I have the query: { "query": { "multi\_match": { … --- ## [How to run Kibana 4.4.1 on IBM Bluemix PaaS](https://discuss.elastic.co/t/how-to-run-kibana-4-4-1-on-ibm-bluemix-paas/44433)
**Author:** [@apt275](https://discuss.elastic.co/u/apt275)\ **Replies:** 1\ **Last updated:** [March 16, 2016, 7:00pm UTC](https://discuss.elastic.co/t/how-to-run-kibana-4-4-1-on-ibm-bluemix-paas/44433 "2016-03-16T19:00:58Z")
I am trying to run Kibana 4.4.1 on an IBM Bluemix PaaS as a nodejs application. In my implementation, i use cloudfoundry to connect to the PaaS cloud. I was able to run Kibana 4.1.1 on PaaS using the following steps … --- ## [Logstash battle scars - metricbeat config and duplicate output](https://discuss.elastic.co/t/logstash-battle-scars-metricbeat-config-and-duplicate-output/261581)
**Author:** [@Declan\_at\_rm](https://discuss.elastic.co/u/Declan_at_rm)\ **Replies:** 0\ **Last updated:** [January 19, 2021, 6:14pm UTC](https://discuss.elastic.co/t/logstash-battle-scars-metricbeat-config-and-duplicate-output/261581 "2021-01-19T18:14:47Z")
Not so much a question but just wanted to share some things to look out for. I should start by saying that overall by experience of ELK is good and I'm certainly sticking with it. Just wanted to share a few details of … --- ## [Upgrade advice](https://discuss.elastic.co/t/upgrade-advice/163517)
**Author:** [@Madhukar](https://discuss.elastic.co/u/Madhukar)\ **Replies:** 0\ **Last updated:** [January 9, 2019, 11:19am UTC](https://discuss.elastic.co/t/upgrade-advice/163517 "2019-01-09T11:19:20Z")
Hi all, I want to upgrade my cluster from 6.2.4 to 6.5.4 (latest version) Below are the components: 1 master node 1 data node 1 kibana node 1 elastalert engine 1 kafka node (Kafka version kafka\_2.11) 2 logstash nodes … --- ## [Query from Kibana and from Elastic search Filter](https://discuss.elastic.co/t/query-from-kibana-and-from-elastic-search-filter/133301)
**Author:** [@UdaySingh\_Ghadage](https://discuss.elastic.co/u/UdaySingh_Ghadage)\ **Replies:** 0\ **Last updated:** [May 25, 2018, 10:13am UTC](https://discuss.elastic.co/t/query-from-kibana-and-from-elastic-search-filter/133301 "2018-05-25T10:13:54Z")
Hi, in logstash version 6.1.0 there is option of aggregation\_fields to read aggregation response in elasticSearch filter plugin. filter { elasticsearch { aggregation\_fields =\> { "my\_agg\_name" =\> "my\_ls\_field" } } … --- ## [Kibana status shows yellow because plugins are degraded after upgrading from 7.9 to 7.16.3](https://discuss.elastic.co/t/kibana-status-shows-yellow-because-plugins-are-degraded-after-upgrading-from-7-9-to-7-16-3/300361)
**Author:** [@Bhavb08](https://discuss.elastic.co/u/Bhavb08)\ **Replies:** 2\ **Last updated:** [March 24, 2022, 9:14pm UTC](https://discuss.elastic.co/t/kibana-status-shows-yellow-because-plugins-are-degraded-after-upgrading-from-7-9-to-7-16-3/300361 "2022-03-24T21:14:03Z")
Hi. I have been looking for answers in various forums for this. I looked into individual plugins dependencies and looks like alerting plugin might be the cause for all this. But I am unable find a solution. There wa… --- ## [How to manage long length text in data table viz?](https://discuss.elastic.co/t/how-to-manage-long-length-text-in-data-table-viz/255339)
**Author:** [@vidhyadhara](https://discuss.elastic.co/u/vidhyadhara)\ **Replies:** 2\ **Last updated:** [November 13, 2020, 2:31pm UTC](https://discuss.elastic.co/t/how-to-manage-long-length-text-in-data-table-viz/255339 "2020-11-13T14:31:28Z")
Hello everyone, Below is the screenshot of a data table viz. here I have a lengthy column (story.keyword), I don't want to display so much of text. Is there any way to wrap it up and display only when needed ?? … --- ## [How to 'filter' in Discover when the field is a scripted field](https://discuss.elastic.co/t/how-to-filter-in-discover-when-the-field-is-a-scripted-field/204890)
**Author:** [@Ssingh12](https://discuss.elastic.co/u/Ssingh12)\ **Replies:** 2\ **Last updated:** [October 24, 2019, 6:33am UTC](https://discuss.elastic.co/t/how-to-filter-in-discover-when-the-field-is-a-scripted-field/204890 "2019-10-24T06:33:59Z")
I have a Discover table which contains several scripted fields. When I click on the a cell (corresponding to a scripted field) to filter values - nothing happens. I do see a filter query getting created, but it does not … --- ## [SortField in NEST 7.0 alpha 2 with Elasticsearch 7.1](https://discuss.elastic.co/t/sortfield-in-nest-7-0-alpha-2-with-elasticsearch-7-1/185421)
**Author:** [@vinkesh](https://discuss.elastic.co/u/vinkesh)\ **Replies:** 2\ **Last updated:** [June 13, 2019, 6:12pm UTC](https://discuss.elastic.co/t/sortfield-in-nest-7-0-alpha-2-with-elasticsearch-7-1/185421 "2019-06-13T18:12:24Z")
Hello, I recently upgraded elasticsearch to 7.1 and NEST to version 7.0 alpha 2 in my existing .NET core based application. I am generating search request where I am using SortField class to specify field to perform so… --- ## [Выгрузка данных в Elasticsearch через MSMQ](https://discuss.elastic.co/t/elasticsearch-msmq/174903)
**Author:** [@Vladimir\_Murzin](https://discuss.elastic.co/u/Vladimir_Murzin)\ **Replies:** 2\ **Last updated:** [April 2, 2019, 1:26pm UTC](https://discuss.elastic.co/t/elasticsearch-msmq/174903 "2019-04-02T13:26:07Z")
Вопрос от начинающего: Хочу выгружать документы в Elasticsearch через очередь MSMQ. Есть какое-то готовое решение для этого? Какие компоненты можно использовать, что почитать? --- ## [Could not able to create index-pattern in 6.x](https://discuss.elastic.co/t/could-not-able-to-create-index-pattern-in-6-x/119613)
**Author:** [@Rohit\_Raghoji](https://discuss.elastic.co/u/Rohit_Raghoji)\ **Replies:** 2\ **Last updated:** [February 15, 2018, 7:05am UTC](https://discuss.elastic.co/t/could-not-able-to-create-index-pattern-in-6-x/119613 "2018-02-15T07:05:07Z")
Hi i am trying to create index-pattern from query, index-pattern got created but no feilds are there in that and it is giving some errors i used bellow query to create index-pattern in elasticsearch POST /.kibana/doc… --- ## [ML Trend Analysis](https://discuss.elastic.co/t/ml-trend-analysis/85273)
**Author:** [@crickes](https://discuss.elastic.co/u/crickes)\ **Replies:** 2\ **Last updated:** [May 10, 2017, 5:26pm UTC](https://discuss.elastic.co/t/ml-trend-analysis/85273 "2017-05-10T17:26:04Z")
I'm trying the ML beta on a sample of the kind of data I wish to analyse and track with it. I'm not sure if I've got it set up correctly but I can't see this working properly for the traffic profile. I can see how the… --- ## [Shield user with index privileges set to 'all' unable to delete](https://discuss.elastic.co/t/shield-user-with-index-privileges-set-to-all-unable-to-delete/76260)
**Author:** [@johnnythunders](https://discuss.elastic.co/u/johnnythunders)\ **Replies:** 2\ **Last updated:** [February 27, 2017, 12:21pm UTC](https://discuss.elastic.co/t/shield-user-with-index-privileges-set-to-all-unable-to-delete/76260 "2017-02-27T12:21:01Z")
Topic title sez it. I have a user w/ privileges set to all on a watcher index. The user is able to create, read, etc... unable to delete watches. --- ## [Some trouble with if / else in logstash filter block](https://discuss.elastic.co/t/some-trouble-with-if-else-in-logstash-filter-block/48975)
**Author:** [@kheraud](https://discuss.elastic.co/u/kheraud)\ **Replies:** 2\ **Last updated:** [May 10, 2016, 7:29am UTC](https://discuss.elastic.co/t/some-trouble-with-if-else-in-logstash-filter-block/48975 "2016-05-10T07:29:20Z")
Hello, First of all I discover ELK a bit late but I am very enthusiastic about these products. I am starting to play with it but I face a weird issue : impossible to do a simple if / else in my logstash filter block. I t… --- ## [MultiLingual Index](https://discuss.elastic.co/t/multilingual-index/38150)
**Author:** [@hash\_include](https://discuss.elastic.co/u/hash_include)\ **Replies:** 2\ **Last updated:** [December 30, 2015, 8:23pm UTC](https://discuss.elastic.co/t/multilingual-index/38150 "2015-12-30T20:23:46Z")
Hi All I have document corpus with few documents in chinese, few in German and others in english. I cannot create multiple indexes based on languages owing to current infrastructure. I need to have one index with mu… --- ## [Marvel 2.0 - Index Template Override](https://discuss.elastic.co/t/marvel-2-0-index-template-override/35443)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 2\ **Last updated:** [November 25, 2015, 12:56am UTC](https://discuss.elastic.co/t/marvel-2-0-index-template-override/35443 "2015-11-25T00:56:42Z")
Hi, Does kibana/marvel handle overriding the default index template e.g. to raise the shard value? I tried doing this the other day only to find that kibana/marvel could no longer find the cluster and I started to see Se… --- ## [Starting Kibana on AIX v7](https://discuss.elastic.co/t/starting-kibana-on-aix-v7/34205)
**Author:** [@Russ](https://discuss.elastic.co/u/Russ)\ **Replies:** 2\ **Last updated:** [November 9, 2015, 11:18pm UTC](https://discuss.elastic.co/t/starting-kibana-on-aix-v7/34205 "2015-11-09T23:18:21Z")
I've installed Kibana on AIX v7, I'm logged in as root, and have verified that the directory (kibana-4.2.0-linux-x64) and all of the subdirectories and files are rwxrwxrwx (wide open). I don't understand why execute p… --- ## [Index existing data and integrate elasticsearch with PHP](https://discuss.elastic.co/t/index-existing-data-and-integrate-elasticsearch-with-php/16028)
**Author:** [@santosh](https://discuss.elastic.co/u/santosh)\ **Replies:** 2\ **Last updated:** [February 26, 2014, 1:46pm UTC](https://discuss.elastic.co/t/index-existing-data-and-integrate-elasticsearch-with-php/16028 "2014-02-26T13:46:01Z")
Dear All, I have gone through the link - http://www.elasticsearch.org/guide/en/elasticsearch/client/php-api/current/\_quickstart.html to understand the setup. Can someone point to the documentation where I can 1… --- ## [Issues setting up Lab for Observability Fundamentals](https://discuss.elastic.co/t/issues-setting-up-lab-for-observability-fundamentals/252563)
**Author:** [@gmlewis0](https://discuss.elastic.co/u/gmlewis0)\ **Replies:** 8\ **Last updated:** [November 16, 2020, 2:50pm UTC](https://discuss.elastic.co/t/issues-setting-up-lab-for-observability-fundamentals/252563 "2020-11-16T14:50:22Z")
Hi, I just signed up this morning for the Observability Fundamentals class and am running into issues trying to set the lab up. I followed the initial instructions to log into strigo and the machine appeared to start and… --- ## [How to get particular document using cmd from an index in Elastic Search](https://discuss.elastic.co/t/how-to-get-particular-document-using-cmd-from-an-index-in-elastic-search/219020)
**Author:** [@Joseph\_Raj](https://discuss.elastic.co/u/Joseph_Raj)\ **Replies:** 8\ **Last updated:** [February 13, 2020, 4:45pm UTC](https://discuss.elastic.co/t/how-to-get-particular-document-using-cmd-from-an-index-in-elastic-search/219020 "2020-02-13T16:45:31Z")
We want to see the particular document is available in ES under the particular index, so we tried the below query in cerebro visualization tool. GET Method en\_y\_91/basic\_type/denmod\_y\_107722 Output: { "\_index": "… --- ## [How to use elastic in wiki js](https://discuss.elastic.co/t/how-to-use-elastic-in-wiki-js/329978)
**Author:** [@Kwa](https://discuss.elastic.co/u/Kwa)\ **Replies:** 0\ **Last updated:** [April 14, 2023, 7:13am UTC](https://discuss.elastic.co/t/how-to-use-elastic-in-wiki-js/329978 "2023-04-14T07:13:00Z")
Hi everyone, i have elasticsearch installed locally in a VM with version 7.17.8. By calling http://localhost:9200 in the browser i get the information like cluster\_name, cluster\_uuid etc. In elasticsearch.yml i have en… --- ## [eS no object data given error](https://discuss.elastic.co/t/es-no-object-data-given-error/87923)
**Author:** [@Min\_Qiu](https://discuss.elastic.co/u/Min_Qiu)\ **Replies:** 1\ **Last updated:** [June 15, 2017, 1:53pm UTC](https://discuss.elastic.co/t/es-no-object-data-given-error/87923 "2017-06-15T13:53:00Z")
I got the following error all the time when using EsSpark.saveJsonToEs in Spark streaming app. Some data were save to ES but it the driver log always show this error 17/05/31 23:46:06 WARN TaskSetManager: Lost task 15… --- ## [Collapse results by multipli fields( highRestClient java](https://discuss.elastic.co/t/collapse-results-by-multipli-fields-highrestclient-java/298740)
**Author:** [@Anna\_Kuranda](https://discuss.elastic.co/u/Anna_Kuranda)\ **Replies:** 4\ **Last updated:** [March 13, 2022, 2:26pm UTC](https://discuss.elastic.co/t/collapse-results-by-multipli-fields-highrestclient-java/298740 "2022-03-13T14:26:06Z")
Hi I need do collapse by two fields :field1 and field2 I use java collapse by field1 searchSourceBuilder.collapse(new CollapseBuilder("field1").setInnerHits(innerHitBuilder)); In my case I need additional colla… --- ## [Solr APM transactions not showing](https://discuss.elastic.co/t/solr-apm-transactions-not-showing/288607)
**Author:** [@Shubham\_Singh](https://discuss.elastic.co/u/Shubham_Singh)\ **Replies:** 4\ **Last updated:** [November 9, 2021, 2:29pm UTC](https://discuss.elastic.co/t/solr-apm-transactions-not-showing/288607 "2021-11-09T14:29:03Z")
Implemented solr APM but under transactions it shows- --- ## [Logstash converting data from a flattened table from a SQL query into JSON inner object](https://discuss.elastic.co/t/logstash-converting-data-from-a-flattened-table-from-a-sql-query-into-json-inner-object/196403)
**Author:** [@aohsie](https://discuss.elastic.co/u/aohsie)\ **Replies:** 4\ **Last updated:** [August 22, 2019, 9:55pm UTC](https://discuss.elastic.co/t/logstash-converting-data-from-a-flattened-table-from-a-sql-query-into-json-inner-object/196403 "2019-08-22T21:55:58Z")
I'm looking to index flattened data into Elasticsearch without creating duplicate data. For example, if a person has multiple cars, then a flattened table will look something like this: | Name | Car … --- ## [Using a Discover Saved Search in a Dashboard does not show properly](https://discuss.elastic.co/t/using-a-discover-saved-search-in-a-dashboard-does-not-show-properly/189747)
**Author:** [@davidnavalho](https://discuss.elastic.co/u/davidnavalho)\ **Replies:** 4\ **Last updated:** [July 11, 2019, 12:51pm UTC](https://discuss.elastic.co/t/using-a-discover-saved-search-in-a-dashboard-does-not-show-properly/189747 "2019-07-11T12:51:59Z")
We're adding a simple Saved Search from Discover into a Dashboard, but it does not seem to present data in the same manner it is presented in the actual Discover tab. Specifically, the un-expanded entries seem to be show… --- ## [ASCII value is not inserting to Elastic search index](https://discuss.elastic.co/t/ascii-value-is-not-inserting-to-elastic-search-index/183039)
**Author:** [@SudevPK](https://discuss.elastic.co/u/SudevPK)\ **Replies:** 4\ **Last updated:** [May 30, 2019, 4:27am UTC](https://discuss.elastic.co/t/ascii-value-is-not-inserting-to-elastic-search-index/183039 "2019-05-30T04:27:20Z")
I have 2 elastic search nodes, Elastic search NODE 1 ( version 6.5.1 ) Elastic search NODE 2 ( version 7.0.1 ) I am able to insert ASCII value in index in Elastic search NODE 1 but getting error while inserting to… --- ## [Elasticsearch (6.8) is causing server load](https://discuss.elastic.co/t/elasticsearch-6-8-is-causing-server-load/182416)
**Author:** [@Marko\_Todoric](https://discuss.elastic.co/u/Marko_Todoric)\ **Replies:** 4\ **Last updated:** [May 23, 2019, 4:22pm UTC](https://discuss.elastic.co/t/elasticsearch-6-8-is-causing-server-load/182416 "2019-05-23T16:22:10Z")
Hello everyone, I'm having strange issue with elasticsearch. Basically it's causing high server load occasionally on one of three nodes in a cluster. I mean, considering the amount of CPUs (2 physical, 16 logical) it's … --- ## [Did file beat 5.4 version compatible On Solaris 11.3 version?](https://discuss.elastic.co/t/did-file-beat-5-4-version-compatible-on-solaris-11-3-version/99353)
**Author:** [@yogeswararao](https://discuss.elastic.co/u/yogeswararao)\ **Replies:** 4\ **Last updated:** [September 5, 2017, 11:19pm UTC](https://discuss.elastic.co/t/did-file-beat-5-4-version-compatible-on-solaris-11-3-version/99353 "2017-09-05T23:19:22Z")
Hi, Can some one help on this. which version of the file beat version is compatible on Solaris 11.3 version ? --- ## [Kibana visualization options tab does not save HTML fields](https://discuss.elastic.co/t/kibana-visualization-options-tab-does-not-save-html-fields/73326)
**Author:** [@satyad](https://discuss.elastic.co/u/satyad)\ **Replies:** 4\ **Last updated:** [February 7, 2017, 6:51am UTC](https://discuss.elastic.co/t/kibana-visualization-options-tab-does-not-save-html-fields/73326 "2017-02-07T06:51:21Z")
We developed a Visualization on Kibana 5.1.1. In the "Options" tab of the Visualization, there is an "Add Range" button which when clicked adds a block of HTML code (text boxes and color fields) to the Options tab. Based… --- ## [ES Indexing from Hadoop Issues](https://discuss.elastic.co/t/es-indexing-from-hadoop-issues/23661)
**Author:** [@Sudhir\_Rao](https://discuss.elastic.co/u/Sudhir_Rao)\ **Replies:** 4\ **Last updated:** [May 26, 2015, 10:11am UTC](https://discuss.elastic.co/t/es-indexing-from-hadoop-issues/23661 "2015-05-26T10:11:14Z")
Hi all, I have 4 node ES running ElasticSearch : 1.5.2 OS : RHEL 6.x Java : 1.7 CPU : 16 cores 2 machines : 60 GB RAM, 10 TB disk 2 machines : 120 GB RAM, 5 TB disk I also have a 500 node hadoop cluster … --- ## [Create an index if not exist and add a document to it](https://discuss.elastic.co/t/create-an-index-if-not-exist-and-add-a-document-to-it/281945)
**Author:** [@ChenChuang](https://discuss.elastic.co/u/ChenChuang)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 10:00am UTC](https://discuss.elastic.co/t/create-an-index-if-not-exist-and-add-a-document-to-it/281945 "2021-08-25T10:00:15Z")
I tried to dynamically create an index (if not exist) with static mapping, then added a document to it immediately. After that, I checked mapping of the index and found that the mapping is not what I described in request… --- ## [Error after switching to ECS: 1 of 2 shards failed The data you are seeing might be incomplete or wrong](https://discuss.elastic.co/t/error-after-switching-to-ecs-1-of-2-shards-failed-the-data-you-are-seeing-might-be-incomplete-or-wrong/250540)
**Author:** [@michielvoo](https://discuss.elastic.co/u/michielvoo)\ **Replies:** 1\ **Last updated:** [October 1, 2020, 1:20pm UTC](https://discuss.elastic.co/t/error-after-switching-to-ecs-1-of-2-shards-failed-the-data-you-are-seeing-might-be-incomplete-or-wrong/250540 "2020-10-01T13:20:01Z")
I recently changed the logging configuration in my .NET application to use the official Serilog ECS formatter from Elastic (based on the recommendation in this official documentation). Now when I go to the discover app … --- ## [Explain Periodic\_flush in logsatsh common fields](https://discuss.elastic.co/t/explain-periodic-flush-in-logsatsh-common-fields/247328)
**Author:** [@SKumarMN](https://discuss.elastic.co/u/SKumarMN)\ **Replies:** 1\ **Last updated:** [September 3, 2020, 3:35pm UTC](https://discuss.elastic.co/t/explain-periodic-flush-in-logsatsh-common-fields/247328 "2020-09-03T15:35:29Z")
Hi, Under Logstash common fields, I see a field names Periodic\_flush. Could you please explain whats is used for and also give an example with respect to translate plugin https://www.elastic.co/guide/en/logstash/curren… --- ## [Setting a different homepage (kibana.defaultAppId) per space / user / role](https://discuss.elastic.co/t/setting-a-different-homepage-kibana-defaultappid-per-space-user-role/185830)
**Author:** [@Duella](https://discuss.elastic.co/u/Duella)\ **Replies:** 1\ **Last updated:** [June 14, 2019, 11:16am UTC](https://discuss.elastic.co/t/setting-a-different-homepage-kibana-defaultappid-per-space-user-role/185830 "2019-06-14T11:16:05Z")
Is it possible to set a different homepage (dashboard) per user / role? I know that you can set a general homepage using kibana.defaultAppId in Kibana.yml but I was wondering if there was a similar setting per space or w… --- ## [6.2.4 upgrade causes CorruptIndexException via bin/xpack/set\_password](https://discuss.elastic.co/t/6-2-4-upgrade-causes-corruptindexexception-via-bin-xpack-set-password/138905)
**Author:** [@hokiegeek2](https://discuss.elastic.co/u/hokiegeek2)\ **Replies:** 1\ **Last updated:** [July 6, 2018, 12:31pm UTC](https://discuss.elastic.co/t/6-2-4-upgrade-causes-corruptindexexception-via-bin-xpack-set-password/138905 "2018-07-06T12:31:38Z")
I am attempting to upgrade our cluster to 6.2.4. Now that elastic/changeme login is disabled one has to execute bin/xpack/set\_password. When I attempt to do this, I get the following exception: Exception in thread "main… --- ## [How do I run the core rspec unit tests for logstash from rake without this error?](https://discuss.elastic.co/t/how-do-i-run-the-core-rspec-unit-tests-for-logstash-from-rake-without-this-error/67554)
**Author:** [@PaulChernoch](https://discuss.elastic.co/u/PaulChernoch)\ **Replies:** 1\ **Last updated:** [November 29, 2016, 9:59pm UTC](https://discuss.elastic.co/t/how-do-i-run-the-core-rspec-unit-tests-for-logstash-from-rake-without-this-error/67554 "2016-11-29T21:59:59Z")
I am building logstash 1.5.3-1 from source. When I run the core unit tests using rspec, they all pass, but when I run them using rake, a bunch fail. My environment is an ubuntu trusty docker container on Docker for Mac… --- ## [Kafka input/output swapped?](https://discuss.elastic.co/t/kafka-input-output-swapped/56285)
**Author:** [@memelet](https://discuss.elastic.co/u/memelet)\ **Replies:** 1\ **Last updated:** [July 25, 2016, 12:10pm UTC](https://discuss.elastic.co/t/kafka-input-output-swapped/56285 "2016-07-25T12:10:58Z")
I seem to getting my input and output swapped: \[ops-elk-1\]$ sudo ./logstash-plugin install --version='3.0.2' logstash-input-kafka Validating logstash-input-kafka-3.0.2 Installing logstash-input-kafka Installation succe… --- ## [Maximum and minimum @timestamp value](https://discuss.elastic.co/t/maximum-and-minimum-timestamp-value/24857)
**Author:** [@Siddhant\_Agarwal](https://discuss.elastic.co/u/Siddhant_Agarwal)\ **Replies:** 1\ **Last updated:** [October 25, 2015, 6:35pm UTC](https://discuss.elastic.co/t/maximum-and-minimum-timestamp-value/24857 "2015-10-25T18:35:41Z")
Is there a way to convert @timestamp from iso8601 to unix seconds in log stash so that i can use timer in metrics function? I want minimum and maximum @timestamp value. Also it would work if I know the first and last tim… --- ## [Is it possible to send one email with several Dashboard PDF reports?](https://discuss.elastic.co/t/is-it-possible-to-send-one-email-with-several-dashboard-pdf-reports/291359)
**Author:** [@Luis\_P](https://discuss.elastic.co/u/Luis_P)\ **Replies:** 3\ **Last updated:** [December 15, 2021, 9:16pm UTC](https://discuss.elastic.co/t/is-it-possible-to-send-one-email-with-several-dashboard-pdf-reports/291359 "2021-12-15T21:16:30Z")
I've been building a watcher with the purpose of when the condition is met, it should send one email with several Dashboard PDF reports as attachments, one for each process. So far I've only been able to make it so it se… --- ## [No matching indices found: No indices match pattern](https://discuss.elastic.co/t/no-matching-indices-found-no-indices-match-pattern/286108)
**Author:** [@driveirk](https://discuss.elastic.co/u/driveirk)\ **Replies:** 3\ **Last updated:** [October 8, 2021, 5:25am UTC](https://discuss.elastic.co/t/no-matching-indices-found-no-indices-match-pattern/286108 "2021-10-08T05:25:56Z")
I have a lot of index patterns and not all of them now have an index in the elasticity, after updating the kibana from 7.8.1 to 7.14.0 I cannot go to Management - Index Patterns because of: Heavy load during transition … --- ## [Zeek Import - Timestamp & Geo Failing](https://discuss.elastic.co/t/zeek-import-timestamp-geo-failing/198536)
**Author:** [@0x00](https://discuss.elastic.co/u/0x00)\ **Replies:** 3\ **Last updated:** [September 19, 2019, 2:37am UTC](https://discuss.elastic.co/t/zeek-import-timestamp-geo-failing/198536 "2019-09-19T02:37:52Z")
I am attempting to use Filebeat on Ubuntu Linux to import a JSON formatted conn.log as the obfuscated sample is shown below: {"\_path":"conn","\_system\_name":"sensor","\_write\_ts":"2019-07-02T15:53:03.511364Z","ts":"2019-0… --- ## [Unable to calculate duration by 2 dates fields](https://discuss.elastic.co/t/unable-to-calculate-duration-by-2-dates-fields/194833)
**Author:** [@Rudolf\_Reddy\_Macejka](https://discuss.elastic.co/u/Rudolf_Reddy_Macejka)\ **Replies:** 3\ **Last updated:** [August 13, 2019, 8:21am UTC](https://discuss.elastic.co/t/unable-to-calculate-duration-by-2-dates-fields/194833 "2019-08-13T08:21:48Z")
Hello, I am trying to crated new field in indices by recalculate duration based on response and request timestamps. I have this document: { "request" : { "time" : "2019-08-04T20:02:15.459Z" }, "respo… --- ## [Watcher post data](https://discuss.elastic.co/t/watcher-post-data/165642)
**Author:** [@pjanzen](https://discuss.elastic.co/u/pjanzen)\ **Replies:** 3\ **Last updated:** [January 29, 2019, 8:59am UTC](https://discuss.elastic.co/t/watcher-post-data/165642 "2019-01-29T08:59:36Z")
Hi All, I am executing a watcher which post data to an API. In it self this works fine, however the data format is something I am struggling with. My watcher looks like this. { "trigger": { "schedule": { "c… [Previous page](https://discuss.elastic.co/top.md?page=1464&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1466&per_page=50&period=all)