# Top **URL:** https://discuss.elastic.co/top.md?page=1469&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1470 --- ## [How to get context Alert Data in SUBJECT of Security Alert SIEM](https://discuss.elastic.co/t/how-to-get-context-alert-data-in-subject-of-security-alert-siem/312802)
**Author:** [@Rohit\_Kumbhar](https://discuss.elastic.co/u/Rohit_Kumbhar)\ **Replies:** 2\ **Last updated:** [August 30, 2022, 12:21pm UTC](https://discuss.elastic.co/t/how-to-get-context-alert-data-in-subject-of-security-alert-siem/312802 "2022-08-30T12:21:27Z")
Hi, I Have a Security Alert where I have to get data\_stream.namespace and host.name in SUBJECT of Alert Can someone please guide me through it? I have tried below but got blank in output mail subject Subject : AlertN… --- ## [Filebeat + cisco module - listening on other than localhost](https://discuss.elastic.co/t/filebeat-cisco-module-listening-on-other-than-localhost/212944)
**Author:** [@coltrane35](https://discuss.elastic.co/u/coltrane35)\ **Replies:** 2\ **Last updated:** [January 20, 2020, 10:18pm UTC](https://discuss.elastic.co/t/filebeat-cisco-module-listening-on-other-than-localhost/212944 "2020-01-20T22:18:57Z")
Hello, i have installed filebeat and enable cisco module Cico module default configuration make filebeat listenning on localhost 127.0.0.1 I want it to listen on all interfaces 0.0.0.0. Below is what is written in ci… --- ## [Must include query Json payload for ElasticSearch](https://discuss.elastic.co/t/must-include-query-json-payload-for-elasticsearch/180414)
**Author:** [@Vincent\_Stevenson](https://discuss.elastic.co/u/Vincent_Stevenson)\ **Replies:** 2\ **Last updated:** [May 10, 2019, 5:55pm UTC](https://discuss.elastic.co/t/must-include-query-json-payload-for-elasticsearch/180414 "2019-05-10T17:55:22Z")
Hi, I have a database where I want to see which countries an organization exists in (one organization can exist in multiple countries like USA and Mexico). What would the correct Json syntax be if I wanted to see organi… --- ## [Maven Java API for snapshot](https://discuss.elastic.co/t/maven-java-api-for-snapshot/172317)
**Author:** [@Hemant\_Kumar](https://discuss.elastic.co/u/Hemant_Kumar)\ **Replies:** 2\ **Last updated:** [March 14, 2019, 1:32pm UTC](https://discuss.elastic.co/t/maven-java-api-for-snapshot/172317 "2019-03-14T13:32:21Z")
Hi, I am writing java API code to take the snapshot of es. I am unable to find the maven repo for that. public CreateSnapshotResponse createSnapshot(Client client, String repositoryName, String snapshotName, String in… --- ## [Unable to find usable node.js executable while staring kibana server](https://discuss.elastic.co/t/unable-to-find-usable-node-js-executable-while-staring-kibana-server/159307)
**Author:** [@shubh235](https://discuss.elastic.co/u/shubh235)\ **Replies:** 2\ **Last updated:** [December 6, 2018, 8:39am UTC](https://discuss.elastic.co/t/unable-to-find-usable-node-js-executable-while-staring-kibana-server/159307 "2018-12-06T08:39:46Z")
Hi, While starting the Kibana server I am getting the below error : I'm running Kibana-6.5.1 development build on Windows 10 64-bit. I have installed all the dependencies with the yarn bootstrap command. The node.js … --- ## [Kibana access AWS remotely](https://discuss.elastic.co/t/kibana-access-aws-remotely/79933)
**Author:** [@ethomas](https://discuss.elastic.co/u/ethomas)\ **Replies:** 2\ **Last updated:** [March 24, 2017, 7:55pm UTC](https://discuss.elastic.co/t/kibana-access-aws-remotely/79933 "2017-03-24T19:55:53Z")
Hello, Is there way to use a local instance of Kibana to access a remote ES? I am using postman now to send commands but would like to use the latest version of Kibana. --- ## [Blocked outputs](https://discuss.elastic.co/t/blocked-outputs/78881)
**Author:** [@tcouto](https://discuss.elastic.co/u/tcouto)\ **Replies:** 2\ **Last updated:** [March 17, 2017, 4:00pm UTC](https://discuss.elastic.co/t/blocked-outputs/78881 "2017-03-17T16:00:42Z")
Recently I had an issue where my Elastic Cloud instance was not responding well. Logstash was throwing a lot of errors about not being able to send events, and I noticed that some of my other outputs weren't getting proc… --- ## [Refactoring Java API code from 2.x to 5.x](https://discuss.elastic.co/t/refactoring-java-api-code-from-2-x-to-5-x/75496)
**Author:** [@living\_jordi](https://discuss.elastic.co/u/living_jordi)\ **Replies:** 2\ **Last updated:** [February 20, 2017, 7:57am UTC](https://discuss.elastic.co/t/refactoring-java-api-code-from-2-x-to-5-x/75496 "2017-02-20T07:57:42Z")
I've updated to elasticsearch java library version 5.2.0. In 2.x, I was used to take MetricsAggregationBuilder. What do I need to do in order to refactor my related code? I was using SearchRequestBuilder.addField() … --- ## [esRDD .count() is not working with my setup](https://discuss.elastic.co/t/esrdd-count-is-not-working-with-my-setup/74126)
**Author:** [@ArtemKoval](https://discuss.elastic.co/u/ArtemKoval)\ **Replies:** 2\ **Last updated:** [February 13, 2017, 8:12pm UTC](https://discuss.elastic.co/t/esrdd-count-is-not-working-with-my-setup/74126 "2017-02-13T20:12:03Z")
Hi all! This is the simplest sample I'm trying to get working (code + maven dependencies) And it's crushing on .count() call with stack java.lang.NoClassDefFoundError: scala/collection/GenTraversableOnce$… --- ## [ElasticSearch ignores the property 'http.cors.allow-methods'](https://discuss.elastic.co/t/elasticsearch-ignores-the-property-http-cors-allow-methods/45662)
**Author:** [@motty.green](https://discuss.elastic.co/u/motty.green)\ **Replies:** 2\ **Last updated:** [March 29, 2016, 9:10am UTC](https://discuss.elastic.co/t/elasticsearch-ignores-the-property-http-cors-allow-methods/45662 "2016-03-29T09:10:25Z")
Hi All, I have added both parameters to elasticsearch.yml: http.cors.enabled : true http.cors.allow-methods : GET, POST, PUT, DELETE OPTIONS & HEAD are not allowed - and still i can access to ElasticSearch with pos… --- ## [ClassLoading in Elasticsearch](https://discuss.elastic.co/t/classloading-in-elasticsearch/39061)
**Author:** [@ArivazhaganJ](https://discuss.elastic.co/u/ArivazhaganJ)\ **Replies:** 2\ **Last updated:** [January 13, 2016, 10:04am UTC](https://discuss.elastic.co/t/classloading-in-elasticsearch/39061 "2016-01-13T10:04:54Z")
I am using elasticsearch 1.5.1 and Java 7 with Spring Web application environment. In PROD, we got Out of Memory: Perm Gen error in Elasticsearch instance log file. So based out of this, I understand class loading happ… --- ## [Why is Kibana splitting my fields](https://discuss.elastic.co/t/why-is-kibana-splitting-my-fields/29271)
**Author:** [@scaarup](https://discuss.elastic.co/u/scaarup)\ **Replies:** 2\ **Last updated:** [September 14, 2015, 5:31pm UTC](https://discuss.elastic.co/t/why-is-kibana-splitting-my-fields/29271 "2015-09-14T17:31:41Z")
In "Discover" my fields are looking fine, but when I want to use them in "Visualize", Kibana decides to split the fields on "space", "/", etc, which is very annoying. It is also converting everything to lowercase. Can I … --- ## [Kibana 8.4 expanded document views objects in multiple rows](https://discuss.elastic.co/t/kibana-8-4-expanded-document-views-objects-in-multiple-rows/315252)
**Author:** [@Kadir\_Goktas](https://discuss.elastic.co/u/Kadir_Goktas)\ **Replies:** 6\ **Last updated:** [September 28, 2022, 6:58am UTC](https://discuss.elastic.co/t/kibana-8-4-expanded-document-views-objects-in-multiple-rows/315252 "2022-09-28T06:58:57Z")
we have recently upgraded our stack to 8.4 and noticed that when we expand a document object fields are displayed in multiple rows as attached below; previously the field is displayed as a json with a toggle details … --- ## [Kibana server is not redy yet but the service running](https://discuss.elastic.co/t/kibana-server-is-not-redy-yet-but-the-service-running/313402)
**Author:** [@dvir8360](https://discuss.elastic.co/u/dvir8360)\ **Replies:** 6\ **Last updated:** [September 4, 2022, 11:33pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-redy-yet-but-the-service-running/313402 "2022-09-04T23:33:40Z")
Hello everyone, i have a elastic cluster and i'm trying to setup kibana but i allways get this message "kibana server is not redy yet" and i configured the kibana.yaml and the elasticsearch.yaml, the status of the servi… --- ## [Get List of Curations from Swiftype](https://discuss.elastic.co/t/get-list-of-curations-from-swiftype/296899)
**Author:** [@avidnewmedia](https://discuss.elastic.co/u/avidnewmedia)\ **Replies:** 6\ **Last updated:** [February 15, 2022, 5:40pm UTC](https://discuss.elastic.co/t/get-list-of-curations-from-swiftype/296899 "2022-02-15T17:40:28Z")
Hello! I have a question for anyone familiar with Swiftype / Search UI and curation implementations. We are wanting to utilize curations however we have some custom logic in beforeSearchCall hooks. Essentially I'd lik… --- ## [Filebeat logs not displaying to Kibana](https://discuss.elastic.co/t/filebeat-logs-not-displaying-to-kibana/283385)
**Author:** [@Codedestiny1](https://discuss.elastic.co/u/Codedestiny1)\ **Replies:** 6\ **Last updated:** [September 7, 2021, 10:27pm UTC](https://discuss.elastic.co/t/filebeat-logs-not-displaying-to-kibana/283385 "2021-09-07T22:27:22Z")
Filebeat YAML configuration files automated by Ansible playbook have been installed on two virtual machines (Web1 & Web2). I can SSH into them and find filebeat systemctl service is running (active). But no log data is d… --- ## [Multiple cron triggers](https://discuss.elastic.co/t/multiple-cron-triggers/143604)
**Author:** [@maxh](https://discuss.elastic.co/u/maxh)\ **Replies:** 6\ **Last updated:** [August 13, 2018, 7:12am UTC](https://discuss.elastic.co/t/multiple-cron-triggers/143604 "2018-08-13T07:12:01Z")
I am trying to trigger a watch twice using cron formatted triggers, but only the first one triggers. I have noticed that the first one continues to execute and never stops, but im not sure whats wrong. --- ## [Curator Older Than configuration does not work](https://discuss.elastic.co/t/curator-older-than-configuration-does-not-work/128190)
**Author:** [@tchoum](https://discuss.elastic.co/u/tchoum)\ **Replies:** 6\ **Last updated:** [April 17, 2018, 11:55am UTC](https://discuss.elastic.co/t/curator-older-than-configuration-does-not-work/128190 "2018-04-17T11:55:56Z")
Hello, I' m trying to delete logs older than 10 days within an indice, based on the timestamp of my logs indice, but it does not seem to work as curator seems to delete logs older than 5 days instead, The name of my in… --- ## [Adding json objets with Logstash but I get Strings](https://discuss.elastic.co/t/adding-json-objets-with-logstash-but-i-get-strings/105440)
**Author:** [@Alberto\_Diaz](https://discuss.elastic.co/u/Alberto_Diaz)\ **Replies:** 6\ **Last updated:** [October 31, 2017, 9:36am UTC](https://discuss.elastic.co/t/adding-json-objets-with-logstash-but-i-get-strings/105440 "2017-10-31T09:36:27Z")
Hello, I'm trying to add objets to an Array named "lineas". This is my initial document: \[quote="Alberto\_Diaz, post:1, topic:105440, full:true"\] Hello, I'm trying to add objets to an Array named "lineas". This is my … --- ## [Unable to start filebeat](https://discuss.elastic.co/t/unable-to-start-filebeat/102869)
**Author:** [@vinodjv3](https://discuss.elastic.co/u/vinodjv3)\ **Replies:** 6\ **Last updated:** [October 9, 2017, 2:26pm UTC](https://discuss.elastic.co/t/unable-to-start-filebeat/102869 "2017-10-09T14:26:33Z")
Downloaded filebeat to Linux machine. Kernel version of the machine is "2.6.18-238.5.1.el5". I get error as below. ksh\> ./filebeat Memory fault Please suggest --- ## [Slow elasticsearch results when data is big](https://discuss.elastic.co/t/slow-elasticsearch-results-when-data-is-big/11283)
**Author:** [@Ophir\_Michaeli](https://discuss.elastic.co/u/Ophir_Michaeli)\ **Replies:** 6\ **Last updated:** [April 1, 2013, 11:40am UTC](https://discuss.elastic.co/t/slow-elasticsearch-results-when-data-is-big/11283 "2013-04-01T11:40:40Z")
Hi, We're considering moving our own lucene based distributed index and search system to elasticsearch. From tests I ran for 1 million indexed documents I get that elasticsearch is running faster, … --- ## [I am trying to convert unix timestamp(string) coming from my dynamo db by using lambda function to date format to visualize in kibana](https://discuss.elastic.co/t/i-am-trying-to-convert-unix-timestamp-string-coming-from-my-dynamo-db-by-using-lambda-function-to-date-format-to-visualize-in-kibana/303622)
**Author:** [@Kedhar1006](https://discuss.elastic.co/u/Kedhar1006)\ **Replies:** 3\ **Last updated:** [May 2, 2022, 2:35pm UTC](https://discuss.elastic.co/t/i-am-trying-to-convert-unix-timestamp-string-coming-from-my-dynamo-db-by-using-lambda-function-to-date-format-to-visualize-in-kibana/303622 "2022-05-02T14:35:44Z")
'use strict'; var moment = require('moment'); //var Elasticsearch = require('Elasticsearch'); //var client = new Elasticsearch.Clinet({ // host: 'https://.us-east-2.es.amazonaws.com', // log: 'error' //}); const… --- ## [Timelion 5.0.0 alpha2 not working](https://discuss.elastic.co/t/timelion-5-0-0-alpha2-not-working/49422)
**Author:** [@wq\_Huang](https://discuss.elastic.co/u/wq_Huang)\ **Replies:** 3\ **Last updated:** [May 6, 2016, 9:05pm UTC](https://discuss.elastic.co/t/timelion-5-0-0-alpha2-not-working/49422 "2016-05-06T21:05:39Z")
Environment: Chrome Version 50.0.2661.86 (64-bit) OS X 10.11.4 --- ## [Does the new Reindex API always reindex to a single shard?](https://discuss.elastic.co/t/does-the-new-reindex-api-always-reindex-to-a-single-shard/46537)
**Author:** [@ChrisR](https://discuss.elastic.co/u/ChrisR)\ **Replies:** 3\ **Last updated:** [April 6, 2016, 3:14pm UTC](https://discuss.elastic.co/t/does-the-new-reindex-api-always-reindex-to-a-single-shard/46537 "2016-04-06T15:14:12Z")
I used the new reindex API recently and noticed it reduced the old index of 5 primary shards to a new index with only 1 primary shard. Is the idea that we should typically create the new index with n shards first befor… --- ## [Is it possible to update Index Mapping in version 1.7.3?](https://discuss.elastic.co/t/is-it-possible-to-update-index-mapping-in-version-1-7-3/35507)
**Author:** [@Jason\_Zheng](https://discuss.elastic.co/u/Jason_Zheng)\ **Replies:** 3\ **Last updated:** [November 25, 2015, 5:44am UTC](https://discuss.elastic.co/t/is-it-possible-to-update-index-mapping-in-version-1-7-3/35507 "2015-11-25T05:44:56Z")
Hi All, I see v2.0 document shown update mapping page, but cannot see the page in 1.7.3, is it possible to update index mapping or some other way to do it? Jason --- ## [Pattern replace apostrophes?](https://discuss.elastic.co/t/pattern-replace-apostrophes/20113)
**Author:** [@Lee\_Gee](https://discuss.elastic.co/u/Lee_Gee)\ **Replies:** 3\ **Last updated:** [October 9, 2014, 9:53am UTC](https://discuss.elastic.co/t/pattern-replace-apostrophes/20113 "2014-10-09T09:53:59Z")
My users have issues with apostrophes: I need to index and search "aaa's" as it is, and without the apostrophe, as "aaas". If I use a char\_filter to remove apostrophes when indexing and when searching, the \_analyz… --- ## [Transform API is not updating automaticly when i add some data in the source index](https://discuss.elastic.co/t/transform-api-is-not-updating-automaticly-when-i-add-some-data-in-the-source-index/294263)
**Author:** [@waelboss](https://discuss.elastic.co/u/waelboss)\ **Replies:** 1\ **Last updated:** [January 13, 2022, 11:28am UTC](https://discuss.elastic.co/t/transform-api-is-not-updating-automaticly-when-i-add-some-data-in-the-source-index/294263 "2022-01-13T11:28:47Z")
I am using a API transform to get specific metrics here my query PUT \_transform/index-transform { "description": "Calculate the duration of an event from multiple status updates (based on its uniqueID)", "frequency… --- ## [Logstash and RabbitMQ](https://discuss.elastic.co/t/logstash-and-rabbitmq/35724)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 1\ **Last updated:** [November 27, 2015, 9:18am UTC](https://discuss.elastic.co/t/logstash-and-rabbitmq/35724 "2015-11-27T09:18:22Z")
I read some post about using RabbitMQ with logstash. So what best deplyoyment Model for RabbitMQ and Logstash ? I have many Server (150GB log/day - \> 100 Server), so i need load balance for logstash and for RabbitMQ ??? --- ## [Difference between sorting in index level and inside query](https://discuss.elastic.co/t/difference-between-sorting-in-index-level-and-inside-query/205385)
**Author:** [@liorisme6](https://discuss.elastic.co/u/liorisme6)\ **Replies:** 4\ **Last updated:** [November 4, 2019, 9:52am UTC](https://discuss.elastic.co/t/difference-between-sorting-in-index-level-and-inside-query/205385 "2019-11-04T09:52:18Z")
Hi, What's the difference between sorting according to a specific field (adding a sort clause in the query itself) and adding sorting in the index definition (meaning, sorting it on the segment level), without adding so… --- ## [Elastic Search Memory Alert](https://discuss.elastic.co/t/elastic-search-memory-alert/171066)
**Author:** [@surajdalvi](https://discuss.elastic.co/u/surajdalvi)\ **Replies:** 4\ **Last updated:** [March 13, 2019, 6:06am UTC](https://discuss.elastic.co/t/elastic-search-memory-alert/171066 "2019-03-13T06:06:22Z")
Hi there, With respect to https://discuss.elastic.co/t/elastic-search-heap-alert/155479 I have updated the Elasticsearch mapping. Currently, I have 1 index with 5 shards and 1 replica. Still, I am getting the following … --- ## [CCR vs Replicas](https://discuss.elastic.co/t/ccr-vs-replicas/169079)
**Author:** [@manoj\_faria](https://discuss.elastic.co/u/manoj_faria)\ **Replies:** 4\ **Last updated:** [February 20, 2019, 4:24pm UTC](https://discuss.elastic.co/t/ccr-vs-replicas/169079 "2019-02-20T16:24:28Z")
For which scenarios would it make sense to still account for "setting up replicas within a single cluster" as compared to "CCR" - given the constraint that "one is limited to a single data center". i.e. we are not making… --- ## [Capture Body in request errors is not working (Java agent)](https://discuss.elastic.co/t/capture-body-in-request-errors-is-not-working-java-agent/158565)
**Author:** [@pabloborh](https://discuss.elastic.co/u/pabloborh)\ **Replies:** 4\ **Last updated:** [November 28, 2018, 4:11pm UTC](https://discuss.elastic.co/t/capture-body-in-request-errors-is-not-working-java-agent/158565 "2018-11-28T16:11:12Z")
Hi, I have APM 6.5 and java agent v1. The agent is configured with -Delastic.apm.capture\_body=errors But in APM UI, when I go to errors tab, the body has the value \[REDACTED\]. Also i have configured the transaction\_s… --- ## [Hardware & approach Recommendation to implement elasticsearch](https://discuss.elastic.co/t/hardware-approach-recommendation-to-implement-elasticsearch/120996)
**Author:** [@subhraakanil](https://discuss.elastic.co/u/subhraakanil)\ **Replies:** 4\ **Last updated:** [February 22, 2018, 6:01pm UTC](https://discuss.elastic.co/t/hardware-approach-recommendation-to-implement-elasticsearch/120996 "2018-02-22T18:01:39Z")
Hi All, We are planning to use Elastic search in production for searching financial transactions considering its exceptional throughput time.We will call the APIs exposed by elasticsearch from our java application not f… --- ## [During reindex, cpu spike](https://discuss.elastic.co/t/during-reindex-cpu-spike/83786)
**Author:** [@weibin.wu](https://discuss.elastic.co/u/weibin.wu)\ **Replies:** 4\ **Last updated:** [May 11, 2017, 2:59am UTC](https://discuss.elastic.co/t/during-reindex-cpu-spike/83786 "2017-05-11T02:59:46Z")
Hi Elasticsearch: Data volume: 212mb Shards: 5 version: 2.4 nodes: 3 replica: 1 Our cluster will create a new index and reindex to the new index every night. During the reindex period, CPU bump up from 20% to 80%. … --- ## [Search For Url returning no results](https://discuss.elastic.co/t/search-for-url-returning-no-results/6939)
**Author:** [@Ian\_Carvell](https://discuss.elastic.co/u/Ian_Carvell)\ **Replies:** 4\ **Last updated:** [March 14, 2012, 4:58am UTC](https://discuss.elastic.co/t/search-for-url-returning-no-results/6939 "2012-03-14T04:58:25Z")
Hello, We are trying to search for urls within text in a field. For example we have a field called content that has the value "use http://elasticsearch.org for search and email kimchy@elasticsearch.org for questions… --- ## [What do we mean by OPEN Index](https://discuss.elastic.co/t/what-do-we-mean-by-open-index/43811)
**Author:** [@soodlikesjava](https://discuss.elastic.co/u/soodlikesjava)\ **Replies:** 4\ **Last updated:** [March 13, 2016, 11:57pm UTC](https://discuss.elastic.co/t/what-do-we-mean-by-open-index/43811 "2016-03-13T23:57:13Z")
Can anyone tell me what do we mean by OPEN Index , does it mean that Index is loaded in RAM and also stored in Disk . And how it behaves at Shard level . Will all the shards of the Index opened in RAM for the OPENED Inde… --- ## [Unique URL and query param patching](https://discuss.elastic.co/t/unique-url-and-query-param-patching/32298)
**Author:** [@intenta](https://discuss.elastic.co/u/intenta)\ **Replies:** 4\ **Last updated:** [October 16, 2015, 1:32am UTC](https://discuss.elastic.co/t/unique-url-and-query-param-patching/32298 "2015-10-16T01:32:46Z")
I'm trying to solve this problem: Goal To build a system that supports a highly concurrent & scalable URL matching algorithm. I'm looking for tools, technologies, patterns & strategies. Task Imagine you have an I… --- ## [Use ctx in if condition is always null\_pointer\_exception](https://discuss.elastic.co/t/use-ctx-in-if-condition-is-always-null-pointer-exception/317121)
**Author:** [@HiganFish](https://discuss.elastic.co/u/HiganFish)\ **Replies:** 1\ **Last updated:** [October 20, 2022, 2:53pm UTC](https://discuss.elastic.co/t/use-ctx-in-if-condition-is-always-null-pointer-exception/317121 "2022-10-20T14:53:15Z")
PUT \_ingest/pipeline/test1 { "processors": \[ {"dissect": { "field": "message", "pattern": "%{logdata}" }} \] } POST \_ingest/pipeline/\_simulate { "pipeline": { "processors": \[ { … --- ## [Filebeat Multiline Not Working At All, Please Help](https://discuss.elastic.co/t/filebeat-multiline-not-working-at-all-please-help/242537)
**Author:** [@gratefulted](https://discuss.elastic.co/u/gratefulted)\ **Replies:** 1\ **Last updated:** [July 30, 2020, 6:39am UTC](https://discuss.elastic.co/t/filebeat-multiline-not-working-at-all-please-help/242537 "2020-07-30T06:39:46Z")
Hi all, I'm fairly new to ELK stack and am helping a client with an issue they are having getting multiline logs formatted in kibana. Here is my filebeat.yml: #=========================== Filebeat inputs ==============… --- ## [Logstash-filter-jdbc\_streaming -- parameter issue calling stored procedure (MSSQL)](https://discuss.elastic.co/t/logstash-filter-jdbc-streaming-parameter-issue-calling-stored-procedure-mssql/209085)
**Author:** [@Chris\_Lyons](https://discuss.elastic.co/u/Chris_Lyons)\ **Replies:** 1\ **Last updated:** [November 23, 2019, 6:41pm UTC](https://discuss.elastic.co/t/logstash-filter-jdbc-streaming-parameter-issue-calling-stored-procedure-mssql/209085 "2019-11-23T18:41:11Z")
Logstash Version: 6.4 hosted on Oracle Linux Server release 6.8 Database: MSSQL 2017 Running into an issue with the way logstash-filter-jdbc\_streaming adds parameters to statements. I am leveraging a stored procedu… --- ## [Optimising Elasticsearch for timeseries data with high search query QPS](https://discuss.elastic.co/t/optimising-elasticsearch-for-timeseries-data-with-high-search-query-qps/200715)
**Author:** [@viswanathk243](https://discuss.elastic.co/u/viswanathk243)\ **Replies:** 1\ **Last updated:** [October 19, 2019, 7:59am UTC](https://discuss.elastic.co/t/optimising-elasticsearch-for-timeseries-data-with-high-search-query-qps/200715 "2019-10-19T07:59:09Z")
Hey, We are using ElasticSearch 2.2.0 with an expected search QPS of 80K with an expected p99 of 180ms. Current cluster is of 40 nodes with 12 cores, 24 GB memory (12 GB heap size). Data is 150K documents, one shard wi… --- ## [Filebeat shows i/o timeout when pushing file](https://discuss.elastic.co/t/filebeat-shows-i-o-timeout-when-pushing-file/170976)
**Author:** [@vladiulianbogdan](https://discuss.elastic.co/u/vladiulianbogdan)\ **Replies:** 1\ **Last updated:** [March 6, 2019, 3:22pm UTC](https://discuss.elastic.co/t/filebeat-shows-i-o-timeout-when-pushing-file/170976 "2019-03-06T15:22:49Z")
Hi, I have a very simple setup. I have the ELK stack in a docker container. I am using the latest image from here https://hub.docker.com/r/sebp/elk/. I've installed Filebeat (6.6.1) on the machine. The configuration fi… --- ## [Increasing cluster event (put-mapping) timeout from 30s](https://discuss.elastic.co/t/increasing-cluster-event-put-mapping-timeout-from-30s/159821)
**Author:** [@bobbyi](https://discuss.elastic.co/u/bobbyi)\ **Replies:** 1\ **Last updated:** [December 7, 2018, 3:41am UTC](https://discuss.elastic.co/t/increasing-cluster-event-put-mapping-timeout-from-30s/159821 "2018-12-07T03:41:03Z")
While bulk-loading data into a new ES index, I am hitting the "failed to process cluster event (put-mapping) within 30s" error on the first chunk of data. I have read the previous threads on this topic and understand wha… --- ## [Threadpool search rejections](https://discuss.elastic.co/t/threadpool-search-rejections/141336)
**Author:** [@mfabry](https://discuss.elastic.co/u/mfabry)\ **Replies:** 1\ **Last updated:** [July 28, 2018, 3:17am UTC](https://discuss.elastic.co/t/threadpool-search-rejections/141336 "2018-07-28T03:17:58Z")
Hi everyone, I have been unable to figure out (or find in documentation) what exactly happens when elasticsearch data node starts rejecting search requests, so I am hoping you guys could help me to understand. My main … --- ## [Timestamp field being passed in epoch with Hadoop Library](https://discuss.elastic.co/t/timestamp-field-being-passed-in-epoch-with-hadoop-library/138774)
**Author:** [@Wayne\_Taylor](https://discuss.elastic.co/u/Wayne_Taylor)\ **Replies:** 1\ **Last updated:** [July 17, 2018, 12:33pm UTC](https://discuss.elastic.co/t/timestamp-field-being-passed-in-epoch-with-hadoop-library/138774 "2018-07-17T12:33:18Z")
HI Team, I have been able to follow instructions to get my ORC data passed to Elasticsearch but having issues with my data source not having a timestamp and even with formatting the timestamp shows as numeric. Below ar… --- ## [Automatic string splitting in aggregation](https://discuss.elastic.co/t/automatic-string-splitting-in-aggregation/81240)
**Author:** [@GavinSong123](https://discuss.elastic.co/u/GavinSong123)\ **Replies:** 1\ **Last updated:** [April 5, 2017, 1:55pm UTC](https://discuss.elastic.co/t/automatic-string-splitting-in-aggregation/81240 "2017-04-05T13:55:27Z")
AggregationBuilder group = AggregationBuilders.terms("agg1") .field("requestId").subAggregation(AggregationBuilders .max("agg2").field("startTime")); The value of field requestId… --- ## [For time field, create buckets by day for a terms visualization](https://discuss.elastic.co/t/for-time-field-create-buckets-by-day-for-a-terms-visualization/43301)
**Author:** [@jenoldyoung](https://discuss.elastic.co/u/jenoldyoung)\ **Replies:** 1\ **Last updated:** [March 2, 2016, 9:43pm UTC](https://discuss.elastic.co/t/for-time-field-create-buckets-by-day-for-a-terms-visualization/43301 "2016-03-02T21:43:52Z")
I want to create a visualization like the one in the image attached, where, instead of a straight time histogram, the dates are sorted in descending order by how many records there are. My current time field goes all … --- ## [Filebeat Exception Handling](https://discuss.elastic.co/t/filebeat-exception-handling/39088)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 1\ **Last updated:** [January 13, 2016, 1:08pm UTC](https://discuss.elastic.co/t/filebeat-exception-handling/39088 "2016-01-13T13:08:44Z")
Hi, What does beats do with exceptions in source files? Does it do nothing? if so, what is the recommended way to handle them in a beats context? By setting the input codec to multi-line in logstash or using multi-line … --- ## [ES JAVA API | QueryBuilders.java | FilterBuilders does not have nullable queryBuilder as arguement](https://discuss.elastic.co/t/es-java-api-querybuilders-java-filterbuilders-does-not-have-nullable-querybuilder-as-arguement/22059)
**Author:** [@Piyush\_Goyal](https://discuss.elastic.co/u/Piyush_Goyal)\ **Replies:** 7\ **Last updated:** [February 11, 2015, 8:27am UTC](https://discuss.elastic.co/t/es-java-api-querybuilders-java-filterbuilders-does-not-have-nullable-querybuilder-as-arguement/22059 "2015-02-11T08:27:15Z")
Hi All, If I try to write a filtered query through sense, it allows me to just add a filter and query is not a mandatory field. For example: { "query": { "filtered": { "filter": { "term": { … --- ## [How to deploy logstash with persistent volume on kubernetes?](https://discuss.elastic.co/t/how-to-deploy-logstash-with-persistent-volume-on-kubernetes/258505)
**Author:** [@iooi](https://discuss.elastic.co/u/iooi)\ **Replies:** 0\ **Last updated:** [December 13, 2020, 1:17pm UTC](https://discuss.elastic.co/t/how-to-deploy-logstash-with-persistent-volume-on-kubernetes/258505 "2020-12-13T13:17:59Z")
Using GKE to deploy logstash by statefulset kind with pvc. Also need to install an output plugin. When don't use while true; do sleep 1000; done; in container's command args, it can't deploy with pvc successfully. The … [Previous page](https://discuss.elastic.co/top.md?page=1468&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1470&per_page=50&period=all)