# Top **URL:** https://discuss.elastic.co/top.md?page=1502&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1503 --- ## [Logstash File pattern are more , how to reduce the number of patterns](https://discuss.elastic.co/t/logstash-file-pattern-are-more-how-to-reduce-the-number-of-patterns/167861)
**Author:** [@priya08](https://discuss.elastic.co/u/priya08)\ **Replies:** 8\ **Last updated:** [February 14, 2019, 1:30pm UTC](https://discuss.elastic.co/t/logstash-file-pattern-are-more-how-to-reduce-the-number-of-patterns/167861 "2019-02-14T13:30:20Z")
Hi Team, We are using logstash file , in that we are having so many Grok patterns , the lines of file is very huge , for debugging we are facing issue. Are we having any other option ? --- ## [SharePoint online connector fails with Microsoft Graph 404 error](https://discuss.elastic.co/t/sharepoint-online-connector-fails-with-microsoft-graph-404-error/330739)
**Author:** [@ClemensW](https://discuss.elastic.co/u/ClemensW)\ **Replies:** 1\ **Last updated:** [April 25, 2023, 2:37pm UTC](https://discuss.elastic.co/t/sharepoint-online-connector-fails-with-microsoft-graph-404-error/330739 "2023-04-25T14:37:34Z")
I have been trying to set up Elasticsearch with a SharePoint integration. I am hosting elasticsearch, kibana and enterprise-search all version 8.7 in docker container. I added Sharepoint Online as a Source for the enter… --- ## [How to change logstash default timezone](https://discuss.elastic.co/t/how-to-change-logstash-default-timezone/266771)
**Author:** [@sreedhar1](https://discuss.elastic.co/u/sreedhar1)\ **Replies:** 1\ **Last updated:** [March 10, 2021, 3:53pm UTC](https://discuss.elastic.co/t/how-to-change-logstash-default-timezone/266771 "2021-03-10T15:53:04Z")
I am using Logstash to populate data to Elasticsearch server. By default Elasticsearch using UTC format to populate the data. How to change UTC to local time zone? --- ## [How to access data from Elasticsearch in VEGA with nested aggregations](https://discuss.elastic.co/t/how-to-access-data-from-elasticsearch-in-vega-with-nested-aggregations/242871)
**Author:** [@elasticUser6](https://discuss.elastic.co/u/elasticUser6)\ **Replies:** 1\ **Last updated:** [August 13, 2020, 9:24am UTC](https://discuss.elastic.co/t/how-to-access-data-from-elasticsearch-in-vega-with-nested-aggregations/242871 "2020-08-13T09:24:28Z")
Hi, I try to do a, sort of gantt chart, in VEGA. This chart should display on x-axes the time and on y-axes devices been used. So the user can adjust with the time picker and sees all devices been used in this period of… --- ## [Elastic Security Detection Rule Management - Update of Duplicates](https://discuss.elastic.co/t/elastic-security-detection-rule-management-update-of-duplicates/337550)
**Author:** [@hanna](https://discuss.elastic.co/u/hanna)\ **Replies:** 0\ **Last updated:** [July 4, 2023, 10:28am UTC](https://discuss.elastic.co/t/elastic-security-detection-rule-management-update-of-duplicates/337550 "2023-07-04T10:28:57Z")
Hi everyone, does anyone have experience with managing prebuilt detection rules with your own index-patterns and exceptions? Right now I load the prebuilt rules into kibana and then duplicate them in order to add my ow… --- ## [Elasticsearch Engineer 1 - Lab 1.4 - can not find Java](https://discuss.elastic.co/t/elasticsearch-engineer-1-lab-1-4-can-not-find-java/251362)
**Author:** [@justing](https://discuss.elastic.co/u/justing)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 2:31am UTC](https://discuss.elastic.co/t/elasticsearch-engineer-1-lab-1-4-can-not-find-java/251362 "2020-10-08T02:31:08Z")
I’m currently attempting to take ElasticSearch Engineer 1 (On-Demand) training and am stuck at Lab 1.4 in the Lab Environment (Strigo). When attempting to run the logstash command, I get the following error: \[elastic@s… --- ## [Fleet Managed Elastic Agent - add parameter to filebeat.yml](https://discuss.elastic.co/t/fleet-managed-elastic-agent-add-parameter-to-filebeat-yml/317521)
**Author:** [@lnx](https://discuss.elastic.co/u/lnx)\ **Replies:** 3\ **Last updated:** [November 12, 2022, 7:31pm UTC](https://discuss.elastic.co/t/fleet-managed-elastic-agent-add-parameter-to-filebeat-yml/317521 "2022-11-12T19:31:12Z")
I need to set the scan\_frequency config parameter for the Filebeat subprocess of Elastic Agent running on Windows managed by Fleet. I'm using the IIS integration. I would like to try to reduce CPU usage. How do I do th… --- ## [Call Elasticsearch service without exposing sensitive data in the client-side](https://discuss.elastic.co/t/call-elasticsearch-service-without-exposing-sensitive-data-in-the-client-side/266862)
**Author:** [@koyassan](https://discuss.elastic.co/u/koyassan)\ **Replies:** 3\ **Last updated:** [March 10, 2021, 10:27pm UTC](https://discuss.elastic.co/t/call-elasticsearch-service-without-exposing-sensitive-data-in-the-client-side/266862 "2021-03-10T22:27:35Z")
Hey guys, I've being playing with Kibana Plugins. Now I need to migrate one of my plugins from the Legacy to the Platform API, but I'm facing some problems when trying to made some Elasticsearch requests without exposit… --- ## [SIEM Detection alerts - Additional field adding in notification placeholders](https://discuss.elastic.co/t/siem-detection-alerts-additional-field-adding-in-notification-placeholders/264247)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 3\ **Last updated:** [February 18, 2021, 10:48pm UTC](https://discuss.elastic.co/t/siem-detection-alerts-additional-field-adding-in-notification-placeholders/264247 "2021-02-18T22:48:15Z")
Hi, How can i add additional fields in alert email action body in detection rules. I am using ELK 7.10. For eg: Need to include user.name and source.ip field in the rule alert in the body of alert email action. Rule L… --- ## [Composite aggregation after\_key](https://discuss.elastic.co/t/composite-aggregation-after-key/245789)
**Author:** [@Robert\_Pofuk](https://discuss.elastic.co/u/Robert_Pofuk)\ **Replies:** 0\ **Last updated:** [August 20, 2020, 3:14pm UTC](https://discuss.elastic.co/t/composite-aggregation-after-key/245789 "2020-08-20T15:14:45Z")
Hi all! I have question. If I use histogram composite aggregation with setting size. For example I have integer range. Each number bucket in aggregation represents 1 day (Using integer for date is not important). If I… --- ## [Unable to save default index pattern - Kibana-7.3](https://discuss.elastic.co/t/unable-to-save-default-index-pattern-kibana-7-3/207774)
**Author:** [@deeps](https://discuss.elastic.co/u/deeps)\ **Replies:** 3\ **Last updated:** [November 14, 2019, 4:12pm UTC](https://discuss.elastic.co/t/unable-to-save-default-index-pattern-kibana-7-3/207774 "2019-11-14T16:12:06Z")
I have an elk stack with basic auth enabled.. meaning I have setup the password for elastic, kibana etc users. Cluster was in fine state and kibana auth was working fine until I cleared indexes older than 30 days. Afte… --- ## [How to run Kibana](https://discuss.elastic.co/t/how-to-run-kibana/43483)
**Author:** [@arianayay](https://discuss.elastic.co/u/arianayay)\ **Replies:** 3\ **Last updated:** [March 4, 2016, 8:12am UTC](https://discuss.elastic.co/t/how-to-run-kibana/43483 "2016-03-04T08:12:15Z")
Hi! I've been trying to run kibana but I'm always stuck on the configure the index pattern. So far, this is what I did. I made an index using SENSE. But it seems that Kibana couldn't see my index that's why I can't … --- ## [Attachment Plugin doesn't index fulltext of PDF with not embedded fonts](https://discuss.elastic.co/t/attachment-plugin-doesnt-index-fulltext-of-pdf-with-not-embedded-fonts/31370)
**Author:** [@arkadyzalko](https://discuss.elastic.co/u/arkadyzalko)\ **Replies:** 3\ **Last updated:** [September 29, 2015, 11:24pm UTC](https://discuss.elastic.co/t/attachment-plugin-doesnt-index-fulltext-of-pdf-with-not-embedded-fonts/31370 "2015-09-29T23:24:31Z")
Hi, I have some problems when I'm trying to index some pdf files. Searching works fine for PDFs with embedded fonts but if the font is not embedded ElasticSearch is not able to index fulltext. I'm using this file: … --- ## [How can I keep track of each users disliked items and exclude them from the result in an efficient way](https://discuss.elastic.co/t/how-can-i-keep-track-of-each-users-disliked-items-and-exclude-them-from-the-result-in-an-efficient-way/24479)
**Author:** [@Jeppe](https://discuss.elastic.co/u/Jeppe)\ **Replies:** 3\ **Last updated:** [June 29, 2015, 6:15pm UTC](https://discuss.elastic.co/t/how-can-i-keep-track-of-each-users-disliked-items-and-exclude-them-from-the-result-in-an-efficient-way/24479 "2015-06-29T18:15:24Z")
Hi I have a question about how a specific use case should be modelled in ElasticSearch. I have an application where users can search for recommendations with several parameters and like/dislike each returned recommen… --- ## [Issue with installing plugins from github](https://discuss.elastic.co/t/issue-with-installing-plugins-from-github/5012)
**Author:** [@Ivan](https://discuss.elastic.co/u/Ivan)\ **Replies:** 3\ **Last updated:** [August 1, 2011, 11:38am UTC](https://discuss.elastic.co/t/issue-with-installing-plugins-from-github/5012 "2011-08-01T11:38:41Z")
While attempting to deploy my plugin from github.com, I noticed that the plugin manager was not finding the correct zip file. The filenames in the output looked correct, so I attempted to replicate the download via cod… --- ## [Continuous transform failures](https://discuss.elastic.co/t/continuous-transform-failures/302053)
**Author:** [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Replies:** 2\ **Last updated:** [April 11, 2022, 10:46am UTC](https://discuss.elastic.co/t/continuous-transform-failures/302053 "2022-04-11T10:46:14Z")
Hello, What can cause this error when running a continuous transform ? \[s1-aggs-xxx\] Search context missing, falling back to normal search; request \[apply\_results\] Caused by: org.Elasticsearch.search.SearchContextMiss… --- ## [Adding ECK Operator Liveness Probe](https://discuss.elastic.co/t/adding-eck-operator-liveness-probe/288235)
**Author:** [@MattThomson](https://discuss.elastic.co/u/MattThomson)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 12:44pm UTC](https://discuss.elastic.co/t/adding-eck-operator-liveness-probe/288235 "2021-11-09T12:44:52Z")
I've attempted to add liveness and readiness probes to the ECK operator itself (not the Elasticsearch,kibana,etc pods), but I can't find any documentation on exposed endpoints for health checks. So far I'm doing this wit… --- ## [Master not discovered or elected yet (elastic search 7.4)](https://discuss.elastic.co/t/master-not-discovered-or-elected-yet-elastic-search-7-4/208892)
**Author:** [@Alejandro\_Calvo](https://discuss.elastic.co/u/Alejandro_Calvo)\ **Replies:** 2\ **Last updated:** [November 22, 2019, 8:34am UTC](https://discuss.elastic.co/t/master-not-discovered-or-elected-yet-elastic-search-7-4/208892 "2019-11-22T08:34:49Z")
Hello, I am trying to do a install test of elasticsearc 7.4 en RedHat. As configuration file elasticsearch.yml use: cluster.name: my-application node.name: node-1 path.data: /var/lib/elasticsearch path.lo… --- ## [How to use logstash-input-http-poller from zabbix api method?](https://discuss.elastic.co/t/how-to-use-logstash-input-http-poller-from-zabbix-api-method/203231)
**Author:** [@uf012366](https://discuss.elastic.co/u/uf012366)\ **Replies:** 2\ **Last updated:** [October 12, 2019, 1:42am UTC](https://discuss.elastic.co/t/how-to-use-logstash-input-http-poller-from-zabbix-api-method/203231 "2019-10-12T01:42:52Z")
i try use Http\_poller input plugin loading Zabbix data, but cannot use ZABBIX api method loading data. how to use zabbix jsonrpc api method in the logstash Http\_poller input plugin ???? Are there any cases in this reg… --- ## [Using aggregate to add data to previous event](https://discuss.elastic.co/t/using-aggregate-to-add-data-to-previous-event/202904)
**Author:** [@Factor3](https://discuss.elastic.co/u/Factor3)\ **Replies:** 2\ **Last updated:** [October 10, 2019, 5:37pm UTC](https://discuss.elastic.co/t/using-aggregate-to-add-data-to-previous-event/202904 "2019-10-10T17:37:56Z")
Hi, I have a logfile that looks like this: 61f3483e-e7f4-4202-b34a-d85108f0fea9 - some log line 61f3483e-e7f4-4202-b34a-d85108f0fea9 - some other log line ID=123456 61f3483e-e7f4-4202-b34a-d85108f0fea9 - another log lin… --- ## [Get all docs with the occurrence of field values only once](https://discuss.elastic.co/t/get-all-docs-with-the-occurrence-of-field-values-only-once/166466)
**Author:** [@kaushik.vankayala](https://discuss.elastic.co/u/kaushik.vankayala)\ **Replies:** 2\ **Last updated:** [February 27, 2019, 9:19am UTC](https://discuss.elastic.co/t/get-all-docs-with-the-occurrence-of-field-values-only-once/166466 "2019-02-27T09:19:29Z")
Hi There, I have the documents in my index in the following format; { "\_index": "mt\_uat-app", "\_type": "doc", "\_source": { "Environment": "UAT", "loglevel": "INFO", "APITransactionId": "4d95e9b12cf048… --- ## [Posting my watcher body to a server via webhook](https://discuss.elastic.co/t/posting-my-watcher-body-to-a-server-via-webhook/140179)
**Author:** [@max17](https://discuss.elastic.co/u/max17)\ **Replies:** 2\ **Last updated:** [July 17, 2018, 6:52am UTC](https://discuss.elastic.co/t/posting-my-watcher-body-to-a-server-via-webhook/140179 "2018-07-17T06:52:55Z")
Hello, I have created a watcher to monitor my server memory usage, which is working fine but here I want to post the email result to a 3rd platform or the same server. I searched about it and found that we can do it via… --- ## [How do you use ESIntegTestCase?](https://discuss.elastic.co/t/how-do-you-use-esintegtestcase/71281)
**Author:** [@JonathanAaron](https://discuss.elastic.co/u/JonathanAaron)\ **Replies:** 2\ **Last updated:** [January 12, 2017, 1:38am UTC](https://discuss.elastic.co/t/how-do-you-use-esintegtestcase/71281 "2017-01-12T01:38:42Z")
Do I have to use an instance of elasticsearch with this or does this spin up a cluster/node all by itself? Would I be able to supply it mock data and query it like a normal elastic search node? Any good guides out there… --- ## [Metrticbeat does not output processes metrics on Win 2003](https://discuss.elastic.co/t/metrticbeat-does-not-output-processes-metrics-on-win-2003/70051)
**Author:** [@gilisade](https://discuss.elastic.co/u/gilisade)\ **Replies:** 2\ **Last updated:** [December 28, 2016, 5:25pm UTC](https://discuss.elastic.co/t/metrticbeat-does-not-output-processes-metrics-on-win-2003/70051 "2016-12-28T17:25:33Z")
Hi We have 3 - 2003 r2 windows (64X) - servers i have intalled metricbeat 5.0.0 on all three. Now the service works fine and metric sets are getting to elasticsearch - all but processes metrics. This only happens on the… --- ## [Send network traffic data to logstash and elasticsearch](https://discuss.elastic.co/t/send-network-traffic-data-to-logstash-and-elasticsearch/48791)
**Author:** [@Kennedy\_Kan](https://discuss.elastic.co/u/Kennedy_Kan)\ **Replies:** 2\ **Last updated:** [April 30, 2016, 5:28pm UTC](https://discuss.elastic.co/t/send-network-traffic-data-to-logstash-and-elasticsearch/48791 "2016-04-30T17:28:22Z")
I have been browsing for different sites on how to send network traffic data to logstash and elasticsearch; nevertheless, could not find an effective way to do so. Wonder could anyone give me some steps and guidelines … --- ## [Please add note to install Guide to edit where ES lives](https://discuss.elastic.co/t/please-add-note-to-install-guide-to-edit-where-es-lives/47276)
**Author:** [@neu5ron](https://discuss.elastic.co/u/neu5ron)\ **Replies:** 2\ **Last updated:** [April 13, 2016, 6:56pm UTC](https://discuss.elastic.co/t/please-add-note-to-install-guide-to-edit-where-es-lives/47276 "2016-04-13T18:56:08Z")
There is no note for the graph install process to change where ES is running if not running on localhost:9200. To avoid other users making this mistake please add the note. The file I needed to edit was /opt/kibana/in… --- ## [Kibana keeps dying](https://discuss.elastic.co/t/kibana-keeps-dying/41102)
**Author:** [@AdaYang](https://discuss.elastic.co/u/AdaYang)\ **Replies:** 2\ **Last updated:** [February 8, 2016, 6:25pm UTC](https://discuss.elastic.co/t/kibana-keeps-dying/41102 "2016-02-08T18:25:07Z")
I have a 3 nodes(ec2 instance) cluster with 4 GB memory each. I assign 2 GB for Elasticsearch server(2.1). And on one of the instance, I installed kibana 4.3.1 and sense. The issue is this instance keeps dying. probabl… --- ## [Logstash pipeline filter](https://discuss.elastic.co/t/logstash-pipeline-filter/294018)
**Author:** [@max\_cyril](https://discuss.elastic.co/u/max_cyril)\ **Replies:** 7\ **Last updated:** [January 12, 2022, 6:36pm UTC](https://discuss.elastic.co/t/logstash-pipeline-filter/294018 "2022-01-12T18:36:47Z")
Hi, I am new to ELK and struggling to write my first logstash pipeline. Can anyone help me to write the filter section? Thanks in advance. i want to filter and only output the maximum of completion per users fo… --- ## [.Net Core Console App APM Integrations](https://discuss.elastic.co/t/net-core-console-app-apm-integrations/271909)
**Author:** [@KARAOGLU](https://discuss.elastic.co/u/KARAOGLU)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 5:39am UTC](https://discuss.elastic.co/t/net-core-console-app-apm-integrations/271909 "2021-05-04T05:39:27Z")
Hello, Can we only use APM in .net web-based applications? I was able to run it in a simple web-based application, but I could not run it in a console application with the same settings. I haven't seen a sample or work… --- ## [Skipping duplicates with search\_as\_you\_type field in Elasticsearch](https://discuss.elastic.co/t/skipping-duplicates-with-search-as-you-type-field-in-elasticsearch/248845)
**Author:** [@zaidw21](https://discuss.elastic.co/u/zaidw21)\ **Replies:** 1\ **Last updated:** [September 17, 2020, 12:35pm UTC](https://discuss.elastic.co/t/skipping-duplicates-with-search-as-you-type-field-in-elasticsearch/248845 "2020-09-17T12:35:35Z")
We are using the completion suggester for showing text suggestions and autocomplete functionality in our search implementation. We recently migrated to the Elasticsearch v7.4 from v7.1. As a new field (search\_as\_you\_typ… --- ## [Logstash to logstash cluster with or without load balancer](https://discuss.elastic.co/t/logstash-to-logstash-cluster-with-or-without-load-balancer/178694)
**Author:** [@kharvey](https://discuss.elastic.co/u/kharvey)\ **Replies:** 1\ **Last updated:** [April 26, 2019, 9:53pm UTC](https://discuss.elastic.co/t/logstash-to-logstash-cluster-with-or-without-load-balancer/178694 "2019-04-26T21:53:42Z")
My current setup is: Local Filebeats Logstash Output =\> Local Logstash TCP Input =\> Local Logstash TCP Output =\> Cloud Load Balancer =\> Cloud Cluster (Logstash1 TCP Input, Logstash2 TCP Input) =\> Cloud Elastic Search … --- ## [ES 6.4.1: Almost empty cluster doesn't perform as expected](https://discuss.elastic.co/t/es-6-4-1-almost-empty-cluster-doesnt-perform-as-expected/150871)
**Author:** [@marten1](https://discuss.elastic.co/u/marten1)\ **Replies:** 7\ **Last updated:** [October 23, 2018, 1:06pm UTC](https://discuss.elastic.co/t/es-6-4-1-almost-empty-cluster-doesnt-perform-as-expected/150871 "2018-10-23T13:06:22Z")
Hi, I've set up a cluster consisting of 3 nodes. Each node has 128 GB RAM of which 30 GB is allocated by ES, so 90 GB in total. Disks are SSD. I have an index of about 5 mil documents, 2 primary shards and 2 replicas… --- ## [How do I re-index when I'm using logstash to apply an index template](https://discuss.elastic.co/t/how-do-i-re-index-when-im-using-logstash-to-apply-an-index-template/87294)
**Author:** [@red888](https://discuss.elastic.co/u/red888)\ **Replies:** 1\ **Last updated:** [May 29, 2017, 7:02pm UTC](https://discuss.elastic.co/t/how-do-i-re-index-when-im-using-logstash-to-apply-an-index-template/87294 "2017-05-29T19:02:41Z")
This is the output section of my logstash config: output { if \[type\] == "syslog" { elasticsearch { hosts =\> myserver index =\> "logstash-syslog-%{+YYYY-MM-dd}" template\_name =\> "MyTemplateIWantTo… --- ## [SparkSQL: How to specify custom ROUTING when writting to ES](https://discuss.elastic.co/t/sparksql-how-to-specify-custom-routing-when-writting-to-es/78236)
**Author:** [@Eduardo\_Curonisy](https://discuss.elastic.co/u/Eduardo_Curonisy)\ **Replies:** 1\ **Last updated:** [March 12, 2017, 5:45pm UTC](https://discuss.elastic.co/t/sparksql-how-to-specify-custom-routing-when-writting-to-es/78236 "2017-03-12T17:45:08Z")
Hello, This code is working fine for me ES : 5.2 Spark: 1.6 es-hadoop: elasticsearch-spark-13\_2.10... ...... ...... val sc = new SparkContext(sparkConf) val sqlContext = new org.apache.spark.sql.hive.HiveContex… --- ## [Dendrogram visualization](https://discuss.elastic.co/t/dendrogram-visualization/42504)
**Author:** [@LiorK](https://discuss.elastic.co/u/LiorK)\ **Replies:** 1\ **Last updated:** [February 23, 2016, 8:29pm UTC](https://discuss.elastic.co/t/dendrogram-visualization/42504 "2016-02-23T20:29:38Z")
hi all, has anyone try to import this visualization https://www.elastic.co/blog/data-visualization-elasticsearch-aggregations somehow to kibana? it is possible with some work? didn't try to build a visualization before… --- ## [Out Of Memory error on cardinality aggregation](https://discuss.elastic.co/t/out-of-memory-error-on-cardinality-aggregation/20752)
**Author:** [@Mikalai](https://discuss.elastic.co/u/Mikalai)\ **Replies:** 1\ **Last updated:** [September 29, 2015, 11:30am UTC](https://discuss.elastic.co/t/out-of-memory-error-on-cardinality-aggregation/20752 "2015-09-29T11:30:53Z")
Hi, We are using terms aggregation on high cardinality field and limiting results to 5000 (using “size” parameter). We also have a cardinality sub aggregation on this terms aggregation to get the number of uniq… --- ## [Performance problems with large data volumes](https://discuss.elastic.co/t/performance-problems-with-large-data-volumes/20560)
**Author:** [@John\_D\_Ament](https://discuss.elastic.co/u/John_D_Ament)\ **Replies:** 7\ **Last updated:** [November 6, 2014, 7:20pm UTC](https://discuss.elastic.co/t/performance-problems-with-large-data-volumes/20560 "2014-11-06T19:20:04Z")
Hi, So I have what you might want to consider a large set of data. We have about 25k records in our index, and the disk space is taking up around 2.5 gb, spread across a little more than 4000 indices. Currently … --- ## [Elasticsearch script execution on missing field](https://discuss.elastic.co/t/elasticsearch-script-execution-on-missing-field/19840)
**Author:** [@manoj\_2](https://discuss.elastic.co/u/manoj_2)\ **Replies:** 1\ **Last updated:** [September 17, 2014, 12:24pm UTC](https://discuss.elastic.co/t/elasticsearch-script-execution-on-missing-field/19840 "2014-09-17T12:24:51Z")
I am currently using ES version 0.19. For a feature requirement, I wanted to execute script on missing field through terms facet. The curl which I tried is something like below { "query": { "ter… --- ## [Example config file](https://discuss.elastic.co/t/example-config-file/2842)
**Author:** [@Clinton\_Gormley](https://discuss.elastic.co/u/Clinton_Gormley)\ **Replies:** 7\ **Last updated:** [March 9, 2010, 5:58pm UTC](https://discuss.elastic.co/t/example-config-file/2842 "2010-03-09T17:58:51Z")
Hiya Does anybody have a real life example of an elasticsearch config file. I'm somewhat confused about what goes into the config file, and what gets specified when (eg) creating an index. thanks Clint --… --- ## [Migrating from RestClient to ElasticsearchClient](https://discuss.elastic.co/t/migrating-from-restclient-to-elasticsearchclient/352575)
**Author:** [@Tony\_Clarke](https://discuss.elastic.co/u/Tony_Clarke)\ **Replies:** 6\ **Last updated:** [February 8, 2024, 3:54pm UTC](https://discuss.elastic.co/t/migrating-from-restclient-to-elasticsearchclient/352575 "2024-02-08T15:54:36Z")
Hi, I'm trying to migrate from using the org.elasticsearch.client.RestClient to co.elastic.clients.elasticsearch.ElasticsearchClient. However, I'm noticing one difference in behavior. The ElasticsearchClient has bespoke… --- ## [ECK apm server failed to to index event (security\_exception): action \[indices:admin/auto\_create\]](https://discuss.elastic.co/t/eck-apm-server-failed-to-to-index-event-security-exception-action-indices-admin-auto-create/343741)
**Author:** [@jijil](https://discuss.elastic.co/u/jijil)\ **Replies:** 6\ **Last updated:** [September 26, 2023, 9:19am UTC](https://discuss.elastic.co/t/eck-apm-server-failed-to-to-index-event-security-exception-action-indices-admin-auto-create/343741 "2023-09-26T09:19:41Z")
Kibana version:8.5.3 Elasticsearch version:8.5.3 APM Server version:8.5.3 I used the below code for ECK APM apiVersion: apm.k8s.elastic.co/v1 kind: ApmServer metadata: name: apm-server-stg spec: version: 8.5.3 … --- ## [Help on IF statement in Kibana painless script](https://discuss.elastic.co/t/help-on-if-statement-in-kibana-painless-script/320024)
**Author:** [@auato](https://discuss.elastic.co/u/auato)\ **Replies:** 6\ **Last updated:** [November 30, 2022, 2:07pm UTC](https://discuss.elastic.co/t/help-on-if-statement-in-kibana-painless-script/320024 "2022-11-30T14:07:51Z")
This script below works fine but I would like to insert an IF statement that executes these lines of code only in the case a third '\_' character is present in the field 'measurement', otherwise it does not execute anythi… --- ## [Elasticsearch gmail config works in windows fails in MAC](https://discuss.elastic.co/t/elasticsearch-gmail-config-works-in-windows-fails-in-mac/175737)
**Author:** [@vkank](https://discuss.elastic.co/u/vkank)\ **Replies:** 6\ **Last updated:** [April 10, 2019, 6:33am UTC](https://discuss.elastic.co/t/elasticsearch-gmail-config-works-in-windows-fails-in-mac/175737 "2019-04-10T06:33:19Z")
I am new to ElasticSearch. My email configurations are working in Windows but same config fails on MAC (Or Ubuntu). My ElasticSearch.yml: xpack.license.self\_generated.type: basic xpack.security.enabled: false xpack.not… --- ## [What should i do to trigger a watch only when condition matches to a certain requirement](https://discuss.elastic.co/t/what-should-i-do-to-trigger-a-watch-only-when-condition-matches-to-a-certain-requirement/130750)
**Author:** [@addanuj](https://discuss.elastic.co/u/addanuj)\ **Replies:** 6\ **Last updated:** [May 9, 2018, 7:23pm UTC](https://discuss.elastic.co/t/what-should-i-do-to-trigger-a-watch-only-when-condition-matches-to-a-certain-requirement/130750 "2018-05-09T19:23:14Z")
Hi I am trying to create a watch which should alert our Team only when a certain condition matches, For example: "whenever a Failed Login Attempt Detected" RightNow it is sending me an email after each 1 hour with sam… --- ## [Wachter enabled on master](https://discuss.elastic.co/t/wachter-enabled-on-master/152532)
**Author:** [@pjanzen](https://discuss.elastic.co/u/pjanzen)\ **Replies:** 5\ **Last updated:** [October 16, 2018, 7:59am UTC](https://discuss.elastic.co/t/wachter-enabled-on-master/152532 "2018-10-16T07:59:18Z")
Hi All, In my (licensed) production cluster I have xpack.watcher.enabled: true And on my masters I want to disable that. If I set it to false and restart the masters I cannot delete or edit the watchers any more. Do … --- ## [Geo code in logstash](https://discuss.elastic.co/t/geo-code-in-logstash/92609)
**Author:** [@DILIP\_SHARMA](https://discuss.elastic.co/u/DILIP_SHARMA)\ **Replies:** 5\ **Last updated:** [July 11, 2017, 9:39am UTC](https://discuss.elastic.co/t/geo-code-in-logstash/92609 "2017-07-11T09:39:12Z")
Hi i am trying to load geo data to elasticsearch using logstash , my .csv file look like this - "col1","col2","col3","col4","col5" "dilip","2017-05-28","45.5","12.56789,72.23456","43" my .config file look like this -… --- ## [Include relative file to a log file, as a custom field](https://discuss.elastic.co/t/include-relative-file-to-a-log-file-as-a-custom-field/76593)
**Author:** [@PicoCreator](https://discuss.elastic.co/u/PicoCreator)\ **Replies:** 5\ **Last updated:** [March 6, 2017, 2:25pm UTC](https://discuss.elastic.co/t/include-relative-file-to-a-log-file-as-a-custom-field/76593 "2017-03-06T14:25:59Z")
Conceptual filebeat.yml configuration filebeat: prospectors: paths: "/var/lib/docker/containers/\*/\*-json.log" relativeFields: container\_name: "./hostname" The idea is not to do a heavy parsing, but c… --- ## [Create multiple dashboard from a dashboard template](https://discuss.elastic.co/t/create-multiple-dashboard-from-a-dashboard-template/311664)
**Author:** [@atony](https://discuss.elastic.co/u/atony)\ **Replies:** 4\ **Last updated:** [August 10, 2022, 4:29pm UTC](https://discuss.elastic.co/t/create-multiple-dashboard-from-a-dashboard-template/311664 "2022-08-10T16:29:05Z")
Hello guys, I would like to generate similar dashboards for values of a field. for each value of the field -\> generate dashboard is there any way to do it on Kibana? I did it manualy for some values, using filters, b… --- ## [Elasticsearch Topology Design](https://discuss.elastic.co/t/elasticsearch-topology-design/264638)
**Author:** [@InnerJoin](https://discuss.elastic.co/u/InnerJoin)\ **Replies:** 4\ **Last updated:** [February 18, 2021, 3:59am UTC](https://discuss.elastic.co/t/elasticsearch-topology-design/264638 "2021-02-18T03:59:50Z")
Hello Elasticsearch big-brain experts, I have been testing out Elasticsearch as a log vaulting, auditing tool, and SEIM for the last few months and my company has authorized the purchase of hardware to build a cluster. … --- ## [Parsing a varying length line with custom grok filter, only returns the first field](https://discuss.elastic.co/t/parsing-a-varying-length-line-with-custom-grok-filter-only-returns-the-first-field/209533)
**Author:** [@anar](https://discuss.elastic.co/u/anar)\ **Replies:** 4\ **Last updated:** [November 27, 2019, 11:52am UTC](https://discuss.elastic.co/t/parsing-a-varying-length-line-with-custom-grok-filter-only-returns-the-first-field/209533 "2019-11-27T11:52:43Z")
Hello, I'm trying to set up a custom grok filter for my data input, but when I test it in Kibana's Grok Debugger, I only get the value for the first field (field1). I'm using grok instead of the csv parser because after… [Previous page](https://discuss.elastic.co/top.md?page=1501&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1503&per_page=50&period=all)