# Top **URL:** https://discuss.elastic.co/top.md?page=1467&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1468 --- ## [How to make timeline from Hadoop data?](https://discuss.elastic.co/t/how-to-make-timeline-from-hadoop-data/116390)
**Author:** [@BicaLuv](https://discuss.elastic.co/u/BicaLuv)\ **Replies:** 4\ **Last updated:** [January 22, 2018, 5:46am UTC](https://discuss.elastic.co/t/how-to-make-timeline-from-hadoop-data/116390 "2018-01-22T05:46:34Z")
Hello! I'm currently using Elasticsearch Hadoop from my Spark Structured Streaming job which generates data having the following schema: root |-- id: string (nullable = true) |-- eventTime: timestamp (nullable = true… --- ## [Not able to Create Index in Kibana](https://discuss.elastic.co/t/not-able-to-create-index-in-kibana/81294)
**Author:** [@sriramsm04](https://discuss.elastic.co/u/sriramsm04)\ **Replies:** 4\ **Last updated:** [April 5, 2017, 11:07am UTC](https://discuss.elastic.co/t/not-able-to-create-index-in-kibana/81294 "2017-04-05T11:07:29Z")
Hi, I am trying to create a vritualization for adit.log. I have the config file as follows. input { file { path =\> \[ "/var/log/audit/audit.log" \] start\_position =\> beginning sincedb\_path =\> "/dev/null" … --- ## [ES return difference data version](https://discuss.elastic.co/t/es-return-difference-data-version/37324)
**Author:** [@Udomsak\_Donkhampai](https://discuss.elastic.co/u/Udomsak_Donkhampai)\ **Replies:** 4\ **Last updated:** [December 21, 2015, 4:07am UTC](https://discuss.elastic.co/t/es-return-difference-data-version/37324 "2015-12-21T04:07:30Z")
I query direct to data by GET, and result always show swapping between versions 393 and 825 and data inside also difference. How can we fix this? or any suggestion? Example: GET http://localhost:9300/zanroo/message/1… --- ## [ES 2.0 deb installation issues](https://discuss.elastic.co/t/es-2-0-deb-installation-issues/34604)
**Author:** [@Itamar\_Syn\_Hershko](https://discuss.elastic.co/u/Itamar_Syn_Hershko)\ **Replies:** 4\ **Last updated:** [December 5, 2015, 11:00pm UTC](https://discuss.elastic.co/t/es-2-0-deb-installation-issues/34604 "2015-12-05T23:00:41Z")
Heya, I'm using the following command to install ES 2.0 on Ubuntu LTS 14.04: es\_version=2.0.0 && curl -s "https://download.elasticsearch.org/elasticsearch/release/org/elasticsearch/distribution/deb/elasticsearch/$es… --- ## [Visualization issue in Kibana dashboard after upgrade to v8.17.1](https://discuss.elastic.co/t/visualization-issue-in-kibana-dashboard-after-upgrade-to-v8-17-1/374012)
**Author:** [@SaraAlshamsi](https://discuss.elastic.co/u/SaraAlshamsi)\ **Replies:** 8\ **Last updated:** [June 4, 2025, 6:01pm UTC](https://discuss.elastic.co/t/visualization-issue-in-kibana-dashboard-after-upgrade-to-v8-17-1/374012 "2025-06-04T18:01:29Z")
Hello, I have an issue with some visualization objects after we upgraded Kibana to v8.17.1. I created a dashboard when Kibana was v8.15.3. The dashboard contained multiple objects such as TSVB (markdown), Vega, lens (… --- ## [Winlogbeat 8.13.0 dont start service](https://discuss.elastic.co/t/winlogbeat-8-13-0-dont-start-service/356671)
**Author:** [@brunopsitech](https://discuss.elastic.co/u/brunopsitech)\ **Replies:** 8\ **Last updated:** [April 29, 2024, 1:42pm UTC](https://discuss.elastic.co/t/winlogbeat-8-13-0-dont-start-service/356671 "2024-04-29T13:42:47Z")
I install Winlogbeat and its not start service, i use the default config file and nothing, i recive error 1053 from windows service. I am using windows 11. --- ## [How to add the name of Ingest node that processed the pipeline to special field](https://discuss.elastic.co/t/how-to-add-the-name-of-ingest-node-that-processed-the-pipeline-to-special-field/288091)
**Author:** [@Ayd\_Asraf](https://discuss.elastic.co/u/Ayd_Asraf)\ **Replies:** 3\ **Last updated:** [November 1, 2021, 3:36pm UTC](https://discuss.elastic.co/t/how-to-add-the-name-of-ingest-node-that-processed-the-pipeline-to-special-field/288091 "2021-11-01T15:36:00Z")
Hello, I am trying to get the ingest node name that ran the pipeline which produced the output final document and append it to the document by setting the value of a special extra field "ingested\_on" that was created fo… --- ## [Correlation in ELK dashboard](https://discuss.elastic.co/t/correlation-in-elk-dashboard/260160)
**Author:** [@Sivajanani](https://discuss.elastic.co/u/Sivajanani)\ **Replies:** 3\ **Last updated:** [January 21, 2021, 5:37am UTC](https://discuss.elastic.co/t/correlation-in-elk-dashboard/260160 "2021-01-21T05:37:21Z")
Hello All, I have an index with below fields and data set, 1.indicator:13.12.14.15 action:success 2.indicators:13.12.14.15 tags:elk-search 3.indicator:14.4.5.67.84 action:success I have built a das… --- ## [Strict order operator not working](https://discuss.elastic.co/t/strict-order-operator-not-working/219612)
**Author:** [@KrishK](https://discuss.elastic.co/u/KrishK)\ **Replies:** 8\ **Last updated:** [February 27, 2020, 12:53pm UTC](https://discuss.elastic.co/t/strict-order-operator-not-working/219612 "2020-02-27T12:53:14Z")
Hi Support, I have two documents in index. Document 1. 12-34-56 12/34/56 Document 2. 56-12-34 56/12/34 I just need result for Document 1, if i search with "12-34-56" this keyword. The Problem is that when i sea… --- ## [Bug: X-Pack install via Puppet breaks ES startup after meta-plugin introduction in 6.2.0](https://discuss.elastic.co/t/bug-x-pack-install-via-puppet-breaks-es-startup-after-meta-plugin-introduction-in-6-2-0/119477)
**Author:** [@st0nez](https://discuss.elastic.co/u/st0nez)\ **Replies:** 3\ **Last updated:** [February 14, 2018, 5:48pm UTC](https://discuss.elastic.co/t/bug-x-pack-install-via-puppet-breaks-es-startup-after-meta-plugin-introduction-in-6-2-0/119477 "2018-02-14T17:48:17Z")
Tested on Ubuntu 16.04, Elasticsearch/X-pack 6.2.0 and 6.2.1, puppet module elastic-elasticsearch v6.2.0. Issue: 6.2.0 included this merge regarding meta-plugins. When installing x-pack (a meta-plugin) via puppet, a fi… --- ## [Wired change of the amount of results by usage of min\_score](https://discuss.elastic.co/t/wired-change-of-the-amount-of-results-by-usage-of-min-score/53038)
**Author:** [@nnikolay](https://discuss.elastic.co/u/nnikolay)\ **Replies:** 3\ **Last updated:** [June 17, 2016, 11:04am UTC](https://discuss.elastic.co/t/wired-change-of-the-amount-of-results-by-usage-of-min-score/53038 "2016-06-17T11:04:09Z")
Hi guys! I am using a query like this: Select all results for Keyword "X" with min\_score = 0.25. Also I am doing aggregations for this results. But when I am clicking on an aggregation, the number of documents becom… --- ## [Consider comma separated values in a field as separate values while aggregating](https://discuss.elastic.co/t/consider-comma-separated-values-in-a-field-as-separate-values-while-aggregating/345804)
**Author:** [@Gagan\_Saluja](https://discuss.elastic.co/u/Gagan_Saluja)\ **Replies:** 2\ **Last updated:** [November 1, 2023, 4:26am UTC](https://discuss.elastic.co/t/consider-comma-separated-values-in-a-field-as-separate-values-while-aggregating/345804 "2023-11-01T04:26:34Z")
Hi, i want to do aggregation on a field which has values like doc1\_field: "A" doc2\_field: "A, B" doc3\_field: "A, B, C" What mappings / settings I can use so that when I aggregate on this field I should get results l… --- ## [Filebeat not connecting to elasticsearch cluster running with ECK](https://discuss.elastic.co/t/filebeat-not-connecting-to-elasticsearch-cluster-running-with-eck/278183)
**Author:** [@aksh\_18](https://discuss.elastic.co/u/aksh_18)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 8:22am UTC](https://discuss.elastic.co/t/filebeat-not-connecting-to-elasticsearch-cluster-running-with-eck/278183 "2021-08-17T08:22:13Z")
Hi All, I have deployed ES cluster and kibana with the help of ECK. I am using filebeat-kubernetes.yaml to deploy filebeat. I deployed metricbeat with metricbeat-kubernetes.yaml and its running fine. But even after appl… --- ## [Base64 decoding & decompression of json](https://discuss.elastic.co/t/base64-decoding-decompression-of-json/280442)
**Author:** [@GitSpree23](https://discuss.elastic.co/u/GitSpree23)\ **Replies:** 2\ **Last updated:** [August 4, 2021, 3:54pm UTC](https://discuss.elastic.co/t/base64-decoding-decompression-of-json/280442 "2021-08-04T15:54:02Z")
I have a JSON input containing a \[message\]\[message\_json\] field which is compressed & base64 encoded at the source. This is the python code used to decode, decompress, and deserialize the field: message\['message\_json'\] … --- ## [Microsoft 365 Detection Rule/Machine Learning Rule](https://discuss.elastic.co/t/microsoft-365-detection-rule-machine-learning-rule/257669)
**Author:** [@Gary\_Blackwell](https://discuss.elastic.co/u/Gary_Blackwell)\ **Replies:** 2\ **Last updated:** [December 7, 2020, 2:46pm UTC](https://discuss.elastic.co/t/microsoft-365-detection-rule-machine-learning-rule/257669 "2020-12-07T14:46:07Z")
I went through the detection rules under SIEM security and did not find any related to Office 365. I opened a Github request for rules related to "impossible logins", "foreign country logins" "new inbox rule created", a… --- ## [Docker Elasticsearch Kibana Issues with Elastic-Agent sending data](https://discuss.elastic.co/t/docker-elasticsearch-kibana-issues-with-elastic-agent-sending-data/256581)
**Author:** [@cwobuzz](https://discuss.elastic.co/u/cwobuzz)\ **Replies:** 2\ **Last updated:** [November 25, 2020, 1:42pm UTC](https://discuss.elastic.co/t/docker-elasticsearch-kibana-issues-with-elastic-agent-sending-data/256581 "2020-11-25T13:42:56Z")
I want to use docker to host Elasticsearch and Kibana. I have that working with xpac. I will include my yml files below. I want to enable the elastic-agent on my host computer to ingest logs. This is just a small dev env… --- ## [Error when I'm launching logstash](https://discuss.elastic.co/t/error-when-im-launching-logstash/206561)
**Author:** [@lgllrd](https://discuss.elastic.co/u/lgllrd)\ **Replies:** 2\ **Last updated:** [November 5, 2019, 3:45pm UTC](https://discuss.elastic.co/t/error-when-im-launching-logstash/206561 "2019-11-05T15:45:09Z")
Hi, I'm trying to launch logstash with my .conf file but it tell me an error that I don't understand : OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be remov… --- ## [Essql can't find the FIRST or LAST functions in canvas](https://discuss.elastic.co/t/essql-cant-find-the-first-or-last-functions-in-canvas/175465)
**Author:** [@ebalmeida](https://discuss.elastic.co/u/ebalmeida)\ **Replies:** 2\ **Last updated:** [April 5, 2019, 5:36pm UTC](https://discuss.elastic.co/t/essql-cant-find-the-first-or-last-functions-in-canvas/175465 "2019-04-05T17:36:56Z")
I've been trying to represent a status based on elapsed time since the last e-mail update I received from one of two robots. I'm doing this using an image which changes its source asset based on an essql query. Currentl… --- ## [Kibana visualization edit mode is extreamly slow](https://discuss.elastic.co/t/kibana-visualization-edit-mode-is-extreamly-slow/149280)
**Author:** [@Sergey\_Chernecov](https://discuss.elastic.co/u/Sergey_Chernecov)\ **Replies:** 2\ **Last updated:** [September 22, 2018, 7:46pm UTC](https://discuss.elastic.co/t/kibana-visualization-edit-mode-is-extreamly-slow/149280 "2018-09-22T19:46:01Z")
I use CCS-based index patterns to create dashboards and searches among ~50 projects. Something like that: logs-\*:logstash-\* Everything works as magic except... Every action in visualization edit mode freezes Kibana UI… --- ## [Counting buckets in Kibana?](https://discuss.elastic.co/t/counting-buckets-in-kibana/127507)
**Author:** [@tadgh](https://discuss.elastic.co/u/tadgh)\ **Replies:** 2\ **Last updated:** [April 12, 2018, 8:46pm UTC](https://discuss.elastic.co/t/counting-buckets-in-kibana/127507 "2018-04-12T20:46:59Z")
Hey! I have a slightly odd request. Our users perform an action which creates a document in elasticsearch, called a check-in. I want to build a boolean metric that shows whether the user has generated at least one check… --- ## [Multiple filters for syslog](https://discuss.elastic.co/t/multiple-filters-for-syslog/125407)
**Author:** [@irb7501](https://discuss.elastic.co/u/irb7501)\ **Replies:** 2\ **Last updated:** [March 26, 2018, 5:39pm UTC](https://discuss.elastic.co/t/multiple-filters-for-syslog/125407 "2018-03-26T17:39:00Z")
Can anyone suggest how i might include another match for syslog in this beats.conf? I'm looking to collect some fortigate syslogs in addition to what we are collecting from other syslog sources. input{ beats{ port =\> … --- ## [Fail to Run Elasticsearch after X-Pack Plugin](https://discuss.elastic.co/t/fail-to-run-elasticsearch-after-x-pack-plugin/111048)
**Author:** [@jpk](https://discuss.elastic.co/u/jpk)\ **Replies:** 2\ **Last updated:** [December 12, 2017, 6:35am UTC](https://discuss.elastic.co/t/fail-to-run-elasticsearch-after-x-pack-plugin/111048 "2017-12-12T06:35:27Z")
The following error occurred after installing X-Pack as a plugin to Elasticsearch on Windows Server 2012 VM: \[2017-12-11T00:34:15,318\]\[WARN \]\[o.e.b.ElasticsearchUncaughtExceptionHandler\] \[\] uncaught exception in thread … --- ## [Client\_server and server fields in packetbeat showing empty](https://discuss.elastic.co/t/client-server-and-server-fields-in-packetbeat-showing-empty/41111)
**Author:** [@harshafrnd4u](https://discuss.elastic.co/u/harshafrnd4u)\ **Replies:** 2\ **Last updated:** [February 11, 2016, 8:24am UTC](https://discuss.elastic.co/t/client-server-and-server-fields-in-packetbeat-showing-empty/41111 "2016-02-11T08:24:11Z")
I am using packetbeat for http and mysql, these services are running inside a virtual machine. "client\_server" and "server" fields are coming empty in output events. Can anyone suggest what might be the cause or any conf… --- ## [Parsing LEEF data](https://discuss.elastic.co/t/parsing-leef-data/314448)
**Author:** [@sta02](https://discuss.elastic.co/u/sta02)\ **Replies:** 1\ **Last updated:** [September 14, 2022, 11:48pm UTC](https://discuss.elastic.co/t/parsing-leef-data/314448 "2022-09-14T23:48:31Z")
Hello, How can I parse LEEF data. The format includes | separation in the heard and SPACE separation in Body. Below is a sample event, please advise. The objective is to parse both the LEEF header (LEEF:1.0|Cyber-Ark|V… --- ## [Filebeats on ECK](https://discuss.elastic.co/t/filebeats-on-eck/248849)
**Author:** [@ssurenr](https://discuss.elastic.co/u/ssurenr)\ **Replies:** 1\ **Last updated:** [September 17, 2020, 12:04pm UTC](https://discuss.elastic.co/t/filebeats-on-eck/248849 "2020-09-17T12:04:13Z")
While collecting logs from all pods using a filebeat daemonset in an ECK cluster, is there a way to use filebeat modules in this setup? Most filebeat modules expect a path value typically var.paths. In kubernetes enviro… --- ## [Security\_exception: action \[indices:admin/rollover\] is unauthorized for user \[beats\]](https://discuss.elastic.co/t/security-exception-action-indices-admin-rollover-is-unauthorized-for-user-beats/214345)
**Author:** [@huanqingdong](https://discuss.elastic.co/u/huanqingdong)\ **Replies:** 1\ **Last updated:** [January 13, 2020, 9:34am UTC](https://discuss.elastic.co/t/security-exception-action-indices-admin-rollover-is-unauthorized-for-user-beats/214345 "2020-01-13T09:34:05Z")
user beats now has two role : beats\_amdin(build in), beats\_c(created by myself). beats\_c role as the pic show what privilege shoud i add to beats\_c to avoid the error security\_exception: action \[indices:admin/rollov… --- ## [Curator - want to set http\_auth password and username through env from kubernetes secret](https://discuss.elastic.co/t/curator-want-to-set-http-auth-password-and-username-through-env-from-kubernetes-secret/149907)
**Author:** [@DStorck](https://discuss.elastic.co/u/DStorck)\ **Replies:** 1\ **Last updated:** [September 25, 2018, 11:35pm UTC](https://discuss.elastic.co/t/curator-want-to-set-http-auth-password-and-username-through-env-from-kubernetes-secret/149907 "2018-09-25T23:35:29Z")
I am installing curator with a helm chart that has the client configs in a values.yaml file. I also have a value in there for security.password and security.username that I want to be able to set when I run helm install… --- ## [Does ES 6.2 supports script files under config/scripts folder](https://discuss.elastic.co/t/does-es-6-2-supports-script-files-under-config-scripts-folder/132861)
**Author:** [@mingc](https://discuss.elastic.co/u/mingc)\ **Replies:** 1\ **Last updated:** [May 25, 2018, 4:58pm UTC](https://discuss.elastic.co/t/does-es-6-2-supports-script-files-under-config-scripts-folder/132861 "2018-05-25T16:58:27Z")
Hi all, I am currently using ES 1.6 and trying to upgrade to 6.2. As part of the upgrade, I need to add some scripting functionalities. In 1.6 documentation, I found ES allows you to put a script under config/scripts fo… --- ## [How ot show percentage scale on Y-Axis](https://discuss.elastic.co/t/how-ot-show-percentage-scale-on-y-axis/130917)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 1\ **Last updated:** [May 8, 2018, 1:33am UTC](https://discuss.elastic.co/t/how-ot-show-percentage-scale-on-y-axis/130917 "2018-05-08T01:33:30Z")
Hi, I am trying to create time-series graphs in Kibana 6.2. I am not able to make Y-axis showing percentage. It always give a option for number. There is on field percentCpu utiliziation which is nothing but the integ… --- ## [Filebeats @timestamp can remove or modify the format?](https://discuss.elastic.co/t/filebeats-timestamp-can-remove-or-modify-the-format/77098)
**Author:** [@zhenxing914](https://discuss.elastic.co/u/zhenxing914)\ **Replies:** 1\ **Last updated:** [March 2, 2017, 1:02pm UTC](https://discuss.elastic.co/t/filebeats-timestamp-can-remove-or-modify-the-format/77098 "2017-03-02T13:02:15Z")
I want to pass filebeats collect logs to eagle. but eagle cant parse the time format (2017-03-02T06:02:47.859Z) i can remove the @timestamp or modify time format ? i want @timestamp is 2017-03-2 06:02:48,859. --- ## [Dashboard Templates Kibana 5.0.0 alpha-2?](https://discuss.elastic.co/t/dashboard-templates-kibana-5-0-0-alpha-2/50883)
**Author:** [@Mick\_Mahoney](https://discuss.elastic.co/u/Mick_Mahoney)\ **Replies:** 1\ **Last updated:** [May 24, 2016, 8:23pm UTC](https://discuss.elastic.co/t/dashboard-templates-kibana-5-0-0-alpha-2/50883 "2016-05-24T20:23:32Z")
Hi, I'm quite new to ELK stack and deving on 5.0.0. I want a single Master Kibana Dashboard showing summary Topbeat statistics, and a Detail dashboard for each Server. I will use a Markup Visualization for navigati… --- ## [Visualization for showing filters (can be thought of tag cloud)](https://discuss.elastic.co/t/visualization-for-showing-filters-can-be-thought-of-tag-cloud/41595)
**Author:** [@oldbam](https://discuss.elastic.co/u/oldbam)\ **Replies:** 1\ **Last updated:** [February 18, 2016, 6:50pm UTC](https://discuss.elastic.co/t/visualization-for-showing-filters-can-be-thought-of-tag-cloud/41595 "2016-02-18T18:50:41Z")
We index data that has 1:1 mapping to a category. There are many categories that we need to show (\>20). We want to have a visualization with a list of all the possible categories sorted alphabetically which the users can… --- ## [Packetbeat interfere with defender for identity on Windows Server 2012-2022](https://discuss.elastic.co/t/packetbeat-interfere-with-defender-for-identity-on-windows-server-2012-2022/314509)
**Author:** [@splitmessage88](https://discuss.elastic.co/u/splitmessage88)\ **Replies:** 3\ **Last updated:** [September 29, 2022, 10:51am UTC](https://discuss.elastic.co/t/packetbeat-interfere-with-defender-for-identity-on-windows-server-2012-2022/314509 "2022-09-29T10:51:58Z")
Hi, We are using Packetbeat for capturing DNS traffic from our Windows servers (10 servers) and are having an issue with packetbeat interfering with the defender sensor. We are getting the following error message from D… --- ## [Metric beats and WMI](https://discuss.elastic.co/t/metric-beats-and-wmi/289063)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 5\ **Last updated:** [November 21, 2021, 10:09pm UTC](https://discuss.elastic.co/t/metric-beats-and-wmi/289063 "2021-11-21T22:09:12Z")
It has been suggested that it is possible to configure beats to collect data based on a WMI query. Is this true, and if so is there any useful documentation that you might be able to point me towards? thanks --- ## [Grok extract the PR number](https://discuss.elastic.co/t/grok-extract-the-pr-number/103024)
**Author:** [@erikkn](https://discuss.elastic.co/u/erikkn)\ **Replies:** 5\ **Last updated:** [October 6, 2017, 3:11pm UTC](https://discuss.elastic.co/t/grok-extract-the-pr-number/103024 "2017-10-06T15:11:17Z")
Hey guys, I have a log file with ~500 lines and I need to extract a few lines. One of the lines I want to extract is: pullrequest=pull request number . Could someone tell me what custom grok pattern I should use to 'onl… --- ## [Copy ES indexes back to new clean disk , feasible to work?](https://discuss.elastic.co/t/copy-es-indexes-back-to-new-clean-disk-feasible-to-work/71059)
**Author:** [@Faye](https://discuss.elastic.co/u/Faye)\ **Replies:** 5\ **Last updated:** [January 13, 2017, 3:52am UTC](https://discuss.elastic.co/t/copy-es-indexes-back-to-new-clean-disk-feasible-to-work/71059 "2017-01-13T03:52:49Z")
Hello We have elasticsearch directories "data, work, logs" in one local disk /dev/xvdc1, the indexes data are in "data" directory The local disk will be used up soon, for some reason we only can change the existing loca… --- ## [Reindexing with zero downtime - update document ](https://discuss.elastic.co/t/reindexing-with-zero-downtime-update-document/360186)
**Author:** [@anto-tl](https://discuss.elastic.co/u/anto-tl)\ **Replies:** 6\ **Last updated:** [May 27, 2024, 1:48pm UTC](https://discuss.elastic.co/t/reindexing-with-zero-downtime-update-document/360186 "2024-05-27T13:48:33Z")
Hello, I am looking for solution to do zero downtime reindexing with all read, write, delete and update without any interruption/data loss. In our case, we are doing data encryption using encryption keys in index data.… --- ## [Complex filters in app searchui](https://discuss.elastic.co/t/complex-filters-in-app-searchui/311922)
**Author:** [@Daniel\_Kozlowski](https://discuss.elastic.co/u/Daniel_Kozlowski)\ **Replies:** 6\ **Last updated:** [August 12, 2022, 5:58pm UTC](https://discuss.elastic.co/t/complex-filters-in-app-searchui/311922 "2022-08-12T17:58:06Z")
I have a complex quiery that I have working find in the search API via post to elastic app search. Basically its a nested all and any query like so I have a very complex nested query filter that i can get working in th… --- ## [\[Kibana/Vega\] "inveted" EMS vector maps in Vega](https://discuss.elastic.co/t/kibana-vega-inveted-ems-vector-maps-in-vega/285825)
**Author:** [@Kayak007](https://discuss.elastic.co/u/Kayak007)\ **Replies:** 6\ **Last updated:** [October 26, 2021, 5:54am UTC](https://discuss.elastic.co/t/kibana-vega-inveted-ems-vector-maps-in-vega/285825 "2021-10-26T05:54:49Z")
Hi, I'm trying to use EMS vector maps in Vega. I manage to retrieve the data and map it with the following bits of code: \[...\] {name:"franceDept" url:{ %type%:"emsfile" name:"France Departments" } … --- ## [Unix time to timestamp error: "Wrong argument type Integer, expected LogStash::Timestamp"](https://discuss.elastic.co/t/unix-time-to-timestamp-error-wrong-argument-type-integer-expected-logstash-timestamp/212722)
**Author:** [@wconnell](https://discuss.elastic.co/u/wconnell)\ **Replies:** 2\ **Last updated:** [December 21, 2019, 5:12pm UTC](https://discuss.elastic.co/t/unix-time-to-timestamp-error-wrong-argument-type-integer-expected-logstash-timestamp/212722 "2019-12-21T17:12:43Z")
I'm reading logs into logstash from kafka that all have a field,ts. This field stores the unix time in seconds (for example 1576275878). I'm using the date plugin in logstash to convert it as follows to be stored in the @… --- ## [Logstash JDBC Input Complete Action](https://discuss.elastic.co/t/logstash-jdbc-input-complete-action/108620)
**Author:** [@Jeff\_Bursik](https://discuss.elastic.co/u/Jeff_Bursik)\ **Replies:** 2\ **Last updated:** [November 22, 2017, 3:29pm UTC](https://discuss.elastic.co/t/logstash-jdbc-input-complete-action/108620 "2017-11-22T15:29:51Z")
This has been asked in other threads however a resolution or a solution doesn't appear to have ever been posted so I'd like to ask agin: Is it possible to have a post action once Logstash has completed the stream/output… --- ## [Timeout executing grok 5.4.3](https://discuss.elastic.co/t/timeout-executing-grok-5-4-3/92222)
**Author:** [@steveng](https://discuss.elastic.co/u/steveng)\ **Replies:** 2\ **Last updated:** [July 13, 2017, 9:47am UTC](https://discuss.elastic.co/t/timeout-executing-grok-5-4-3/92222 "2017-07-13T09:47:58Z")
Hi, I send with Filebeat the file /usr/local/tomcat/current/logs/filieredistribution\_vodpublish.log in Logstash. I want to extract the filename without extension like this : grok { match =\> { "source" =\>… --- ## [MySQL \> JDBC \> Logstash \> Elastic](https://discuss.elastic.co/t/mysql-jdbc-logstash-elastic/85748)
**Author:** [@open7](https://discuss.elastic.co/u/open7)\ **Replies:** 2\ **Last updated:** [May 16, 2017, 12:47pm UTC](https://discuss.elastic.co/t/mysql-jdbc-logstash-elastic/85748 "2017-05-16T12:47:44Z")
I got some Fields in MySQL that holds JSON Encoded Strings. I want them in Elastic also to get stored as Object, but they are Stored as Stings. When i post them normally to the API everything looks good. But i have t… --- ## [Facing issue while Update by Query With Upsert](https://discuss.elastic.co/t/facing-issue-while-update-by-query-with-upsert/81252)
**Author:** [@Gautam\_Vanani](https://discuss.elastic.co/u/Gautam_Vanani)\ **Replies:** 2\ **Last updated:** [April 5, 2017, 2:04pm UTC](https://discuss.elastic.co/t/facing-issue-while-update-by-query-with-upsert/81252 "2017-04-05T14:04:13Z")
Hi, I'm trying to use updateby\_query with upsert but facing issue. \> POST /search\_history/stone/\_update\_by\_query \> { \> "script" : { \> "inline": "ctx.\_source.stone\_ids.addAll(params.ids)", \> "lang": "painless", \> … --- ## [Elasticsearch 2.1.1 is recovery can skip translog stage](https://discuss.elastic.co/t/elasticsearch-2-1-1-is-recovery-can-skip-translog-stage/57403)
**Author:** [@win1027](https://discuss.elastic.co/u/win1027)\ **Replies:** 2\ **Last updated:** [August 8, 2016, 8:42am UTC](https://discuss.elastic.co/t/elasticsearch-2-1-1-is-recovery-can-skip-translog-stage/57403 "2016-08-08T08:42:50Z")
this is show how slow when recovery. some info: index shard time type stage source\_host target\_host repository snapshot files files\_percent bytes bytes\_percent total\_files total\_bytes tra… --- ## [ElasticSearch Aggs Query](https://discuss.elastic.co/t/elasticsearch-aggs-query/45250)
**Author:** [@rakesh76](https://discuss.elastic.co/u/rakesh76)\ **Replies:** 2\ **Last updated:** [March 23, 2016, 5:23pm UTC](https://discuss.elastic.co/t/elasticsearch-aggs-query/45250 "2016-03-23T17:23:18Z")
I have a following elasticsearch query and result. I want something like group by with count(\*) =1 in sql statement { "size": 0, "aggs": { "group\_by\_RequestID": { "terms": { "field": "RequestID" … --- ## [Mapping IPv6 address with type IP in ES 1.7.4](https://discuss.elastic.co/t/mapping-ipv6-address-with-type-ip-in-es-1-7-4/38901)
**Author:** [@cterron](https://discuss.elastic.co/u/cterron)\ **Replies:** 2\ **Last updated:** [January 12, 2016, 2:11am UTC](https://discuss.elastic.co/t/mapping-ipv6-address-with-type-ip-in-es-1-7-4/38901 "2016-01-12T02:11:35Z")
Does ES 1.7.4 support mapping an IPv6 address in a field of type "ip"? . In the forum all posts I read about the issue are dated (circa 2012) --- ## [Почему запросы возвращают разные данные?](https://discuss.elastic.co/t/topic/35277)
**Author:** [@Anton\_Kotelev](https://discuss.elastic.co/u/Anton_Kotelev)\ **Replies:** 2\ **Last updated:** [November 23, 2015, 6:35pm UTC](https://discuss.elastic.co/t/topic/35277 "2015-11-23T18:35:33Z")
Всем привет. Используется ES версии 1.7.х. Создаю индекс с вот таким маппингом: put nestobj { "settings" : { "number\_of\_shards" : 3, "number\_of\_replicas" : 1 }, "mappings": { "mytype" : { "dynamic\_templates"… --- ## [Differences between \_source in Kibana and in elasticsearch](https://discuss.elastic.co/t/differences-between--source-in-kibana-and-in-elasticsearch/21084)
**Author:** [@Stefan\_Meisner\_Larse](https://discuss.elastic.co/u/Stefan_Meisner_Larse)\ **Replies:** 2\ **Last updated:** [December 5, 2014, 11:09am UTC](https://discuss.elastic.co/t/differences-between--source-in-kibana-and-in-elasticsearch/21084 "2014-12-05T11:09:21Z")
Hi, I use logstash's syslog plugin to collect logs, searching elastic search and kibana for the same object gives different results in the \_source field... Elasticsearch version 1.4.0, Kibana 4.0.0-BETA2 Whe… --- ## [Converting queries returning certain distinct records to ES](https://discuss.elastic.co/t/converting-queries-returning-certain-distinct-records-to-es/15156)
**Author:** [@heather](https://discuss.elastic.co/u/heather)\ **Replies:** 2\ **Last updated:** [January 9, 2014, 10:21am UTC](https://discuss.elastic.co/t/converting-queries-returning-certain-distinct-records-to-es/15156 "2014-01-09T10:21:28Z")
Hello I am currently trying to migrate an sql application to Elasticsearch. I need to be able to select a collection of results from an index which, for given search conditions, have distinct pairings of two … [Previous page](https://discuss.elastic.co/top.md?page=1466&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1468&per_page=50&period=all)