# Top

**URL:** https://discuss.elastic.co/top.md?page=1522&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1523

---

## [How to apply elastic certified engineer badge](https://discuss.elastic.co/t/how-to-apply-elastic-certified-engineer-badge/194377)

<div class="topic-metadata">

**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\
**Replies:** 1\
**Last updated:** [August 8, 2019, 9:20am UTC](https://discuss.elastic.co/t/how-to-apply-elastic-certified-engineer-badge/194377 "2019-08-08T09:20:29Z")

</div>

Hello, I want to know How to apply elastic certified user badge on this discussion forum profile.

---

## [Question on the backup snapshot](https://discuss.elastic.co/t/question-on-the-backup-snapshot/141876)

<div class="topic-metadata">

**Author:** [@ahrtr](https://discuss.elastic.co/u/ahrtr)\
**Replies:** 7\
**Last updated:** [July 27, 2018, 9:07am UTC](https://discuss.elastic.co/t/question-on-the-backup-snapshot/141876 "2018-07-27T09:07:58Z")

</div>

Based on the following guide, only the first snapshot is a complete copy of data, and all subsequent snapshots will save the delta between the existing snapshots and the new data. https://www.elastic.co/guide/en/elastic…

---

## [Is it possible to show mysql query result in Data Table Visualization?](https://discuss.elastic.co/t/is-it-possible-to-show-mysql-query-result-in-data-table-visualization/107001)

<div class="topic-metadata">

**Author:** [@saafianihan](https://discuss.elastic.co/u/saafianihan)\
**Replies:** 1\
**Last updated:** [November 9, 2017, 9:51pm UTC](https://discuss.elastic.co/t/is-it-possible-to-show-mysql-query-result-in-data-table-visualization/107001 "2017-11-09T21:51:27Z")

</div>

I have to show mysql query result in kibana Data Table Visualization without changing or grouping the fields or columns. Data Table should be the replica of Query Result. Is it possible?

---

## [Where do these OLD Indexes come from?](https://discuss.elastic.co/t/where-do-these-old-indexes-come-from/77532)

<div class="topic-metadata">

**Author:** [@kopacko](https://discuss.elastic.co/u/kopacko)\
**Replies:** 7\
**Last updated:** [March 16, 2017, 8:25pm UTC](https://discuss.elastic.co/t/where-do-these-old-indexes-come-from/77532 "2017-03-16T20:25:08Z")

</div>

Looking at my cluster, I am seeing some clusters with dates back to (logstash-2007.02.26). How on earth did these get created? Is some sending devices data/time off?

---

## [Why does kibana use so much memory?](https://discuss.elastic.co/t/why-does-kibana-use-so-much-memory/44502)

<div class="topic-metadata">

**Author:** [@abcfy2](https://discuss.elastic.co/u/abcfy2)\
**Replies:** 1\
**Last updated:** [March 16, 2016, 6:39pm UTC](https://discuss.elastic.co/t/why-does-kibana-use-so-much-memory/44502 "2016-03-16T18:39:33Z")

</div>

I find kibana will use much more memory in my host. Here is the screenshot about htop: Kibana has been used for 46.8% memory, while elasticsearch just used 17%, and logstash used 12.4%. Here is the screenshot about …

---

## [Hi,may i install logstash in IBM Aix?](https://discuss.elastic.co/t/hi-may-i-install-logstash-in-ibm-aix/37215)

<div class="topic-metadata">

**Author:** [@jalen\_wang](https://discuss.elastic.co/u/jalen_wang)\
**Replies:** 1\
**Last updated:** [December 15, 2015, 9:46am UTC](https://discuss.elastic.co/t/hi-may-i-install-logstash-in-ibm-aix/37215 "2015-12-15T09:46:19Z")

</div>

I want to install logstash in aix,but i can't find any binary software ,anyone could help me ?

---

## [Send router logs to Logstash](https://discuss.elastic.co/t/send-router-logs-to-logstash/34974)

<div class="topic-metadata">

**Author:** [@Kaufusihm](https://discuss.elastic.co/u/Kaufusihm)\
**Replies:** 1\
**Last updated:** [November 18, 2015, 10:56pm UTC](https://discuss.elastic.co/t/send-router-logs-to-logstash/34974 "2015-11-18T22:56:31Z")

</div>

I'm trying to get logs from a switch (router) to Logstash, but I am having trouble figuring out how to do so. !) Do I need to use the UDP input? I am not sure...

---

## [Seperate interfaces for clustering and querying](https://discuss.elastic.co/t/seperate-interfaces-for-clustering-and-querying/7754)

<div class="topic-metadata">

**Author:** [@Jim\_Mitchener](https://discuss.elastic.co/u/Jim_Mitchener)\
**Replies:** 7\
**Last updated:** [June 13, 2012, 6:32pm UTC](https://discuss.elastic.co/t/seperate-interfaces-for-clustering-and-querying/7754 "2012-06-13T18:32:09Z")

</div>

I am trying to setup an elastic cluster with a different network.bind\_host and network.publish\_host interfaces. I cannot for the life of me get this to work with 2 real interfaces. If I set both to the same interface…

---

## [Create new or obtain default private-api-key](https://discuss.elastic.co/t/create-new-or-obtain-default-private-api-key/257789)

<div class="topic-metadata">

**Author:** [@ismarslomic](https://discuss.elastic.co/u/ismarslomic)\
**Replies:** 4\
**Last updated:** [December 7, 2020, 6:09pm UTC](https://discuss.elastic.co/t/create-new-or-obtain-default-private-api-key/257789 "2020-12-07T18:09:04Z")

</div>

Is it possible to automate creation of API Keys (private and search) without needing to do manually steps in Enterprise Search / App Search UI first? We have 4 environments and treats infrastructure and platforms-as-a-c…

---

## [MetricBeat Logstash Monitoring Error](https://discuss.elastic.co/t/metricbeat-logstash-monitoring-error/256048)

<div class="topic-metadata">

**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Replies:** 4\
**Last updated:** [November 20, 2020, 8:21pm UTC](https://discuss.elastic.co/t/metricbeat-logstash-monitoring-error/256048 "2020-11-20T20:21:15Z")

</div>

Running Elastic Stack 7.10.0 and am trying to modernize the monitoring by implementing Metricbeat. Elasticsearch and Kibana run on one server and logstash is running on a different server. I've got both Elasticsearch a…

---

## [Using s3 input plugin logstash file\_descriptors aren't closed leading to crash of system](https://discuss.elastic.co/t/using-s3-input-plugin-logstash-file-descriptors-arent-closed-leading-to-crash-of-system/254270)

<div class="topic-metadata">

**Author:** [@petersedivec](https://discuss.elastic.co/u/petersedivec)\
**Replies:** 4\
**Last updated:** [November 16, 2020, 8:03am UTC](https://discuss.elastic.co/t/using-s3-input-plugin-logstash-file-descriptors-arent-closed-leading-to-crash-of-system/254270 "2020-11-16T08:03:22Z")

</div>

Been trying to figure out our problem for the past week and haven't figured out a solution other than restart logstash multiple times when it runs out of resources. Looking for any help or suggestions on what we can try…

---

## [Which nodes to include in output.host in filebeat.yml?](https://discuss.elastic.co/t/which-nodes-to-include-in-output-host-in-filebeat-yml/227117)

<div class="topic-metadata">

**Author:** [@Daud\_Ahmed](https://discuss.elastic.co/u/Daud_Ahmed)\
**Replies:** 4\
**Last updated:** [April 8, 2020, 12:16pm UTC](https://discuss.elastic.co/t/which-nodes-to-include-in-output-host-in-filebeat-yml/227117 "2020-04-08T12:16:20Z")

</div>

I have like 5 elastic nodes in total. One node ingest and coordinating node while two are dedicated master nodes and the other two are dedicated data nodes. I have elasticsearch install on all my five nodes with respect…

---

## [New To Beats : Unable to build custom beat for cross-environment](https://discuss.elastic.co/t/new-to-beats-unable-to-build-custom-beat-for-cross-environment/78765)

<div class="topic-metadata">

**Author:** [@deepujain](https://discuss.elastic.co/u/deepujain)\
**Replies:** 4\
**Last updated:** [March 15, 2017, 11:03pm UTC](https://discuss.elastic.co/t/new-to-beats-unable-to-build-custom-beat-for-cross-environment/78765 "2017-03-15T23:03:08Z")

</div>

I was able to create a sample beat using developer guide (kudos to it). However when i make a beat in Mac am unable to run it on a linux x86 box. I provided "GOOS=linux GOARCH=386" in Makefile and then ran make. However…

---

## [Logstash- extraction of data from a column in csv](https://discuss.elastic.co/t/logstash-extraction-of-data-from-a-column-in-csv/75284)

<div class="topic-metadata">

**Author:** [@nilanjana](https://discuss.elastic.co/u/nilanjana)\
**Replies:** 4\
**Last updated:** [February 16, 2017, 7:30am UTC](https://discuss.elastic.co/t/logstash-extraction-of-data-from-a-column-in-csv/75284 "2017-02-16T07:30:28Z")

</div>

Hi , I have a csv file with where the is a column called "description" which has got random lines and varies with each record in csv . For one of the record it looks like this : JOB RUN: 'AAL ATLAS ETL ATRMS Recipe' …

---

## [HTTP enabled is false for non data nodes?](https://discuss.elastic.co/t/http-enabled-is-false-for-non-data-nodes/2831)

<div class="topic-metadata">

**Author:** [@Lukas\_Vlcek1](https://discuss.elastic.co/u/Lukas_Vlcek1)\
**Replies:** 4\
**Last updated:** [February 26, 2010, 1:33am UTC](https://discuss.elastic.co/t/http-enabled-is-false-for-non-data-nodes/2831 "2010-02-26T01:33:20Z")

</div>

Hi, May be it is because it is almost midnight for me but I am not getting this: http://www.elasticsearch.com/docs/elasticsearch/modules/http/#Settings It reads: "The http module can be completely disabled and no…

---

## [Failed to retrieve password hash for reserved user \[elastic\]](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-elastic/303475)

<div class="topic-metadata">

**Author:** [@Balaji\_Arumugam](https://discuss.elastic.co/u/Balaji_Arumugam)\
**Replies:** 2\
**Last updated:** [April 28, 2022, 7:57am UTC](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-elastic/303475 "2022-04-28T07:57:41Z")

</div>

Hi Team, We have facing an issue while we start the Elasticsearch master node with the following errors \[2022-04-28T07:40:11,318\]\[INFO \]\[o.e.x.s.a.AuthenticationService\] \[master\] Authentication of \[elastic\] was termina…

---

## [Authentication settings for active directory: sAMAccountName instead of userPrincipalName](https://discuss.elastic.co/t/authentication-settings-for-active-directory-samaccountname-instead-of-userprincipalname/247105)

<div class="topic-metadata">

**Author:** [@Stanvv](https://discuss.elastic.co/u/Stanvv)\
**Replies:** 2\
**Last updated:** [September 2, 2020, 7:40am UTC](https://discuss.elastic.co/t/authentication-settings-for-active-directory-samaccountname-instead-of-userprincipalname/247105 "2020-09-02T07:40:16Z")

</div>

How can I configure logging in with sAMAccountName instead of userPrincipalName ? We used the LDAP realm before, but due to the lack of support on nested groups switched to active\_directory realm with the following set…

---

## [On embedding Kibana Iframe to a portal, Kibana don't ask for any credentials even after Basic license enabled](https://discuss.elastic.co/t/on-embedding-kibana-iframe-to-a-portal-kibana-dont-ask-for-any-credentials-even-after-basic-license-enabled/228647)

<div class="topic-metadata">

**Author:** [@Nitin\_Khatri](https://discuss.elastic.co/u/Nitin_Khatri)\
**Replies:** 2\
**Last updated:** [April 19, 2020, 8:16pm UTC](https://discuss.elastic.co/t/on-embedding-kibana-iframe-to-a-portal-kibana-dont-ask-for-any-credentials-even-after-basic-license-enabled/228647 "2020-04-19T20:16:55Z")

</div>

I have a Dashboard embedded to a portal, but kibana is not asking for any credentials. Dashboard aslo works fine and can be seen on portal directly, Why??

---

## [Elastic Search not accessible using public IP](https://discuss.elastic.co/t/elastic-search-not-accessible-using-public-ip/223714)

<div class="topic-metadata">

**Author:** [@Apurv\_Jain](https://discuss.elastic.co/u/Apurv_Jain)\
**Replies:** 2\
**Last updated:** [March 18, 2020, 9:13am UTC](https://discuss.elastic.co/t/elastic-search-not-accessible-using-public-ip/223714 "2020-03-18T09:13:26Z")

</div>

Hi, I have installed Elastic Search on RHEL 6.9. I am facing a weird issue, I am running elastic on port 17000. when I am trying to access ElasticSearch through IP address it says Connection Refused, from internal as we…

---

## [The Elasticsearch class is not starting on an exisiting project, but working fine on a vanilla site?](https://discuss.elastic.co/t/the-elasticsearch-class-is-not-starting-on-an-exisiting-project-but-working-fine-on-a-vanilla-site/209069)

<div class="topic-metadata">

**Author:** [@truls1502](https://discuss.elastic.co/u/truls1502)\
**Replies:** 2\
**Last updated:** [November 22, 2019, 3:37pm UTC](https://discuss.elastic.co/t/the-elasticsearch-class-is-not-starting-on-an-exisiting-project-but-working-fine-on-a-vanilla-site/209069 "2019-11-22T15:37:38Z")

</div>

I am trying to use DDEV, a Local Development environment, and use elasticsearch 6.8 with Drupal 8 site. I started to use the example recipe. But since it is not working and missing some parameters, so I want to get it w…

---

## [Custom Beat - spool disk queue](https://discuss.elastic.co/t/custom-beat-spool-disk-queue/180622)

<div class="topic-metadata">

**Author:** [@sentient](https://discuss.elastic.co/u/sentient)\
**Replies:** 2\
**Last updated:** [May 14, 2019, 5:46pm UTC](https://discuss.elastic.co/t/custom-beat-spool-disk-queue/180622 "2019-05-14T17:46:07Z")

</div>

I have a simple community beat that sends messages received on a udp channel to elasticsearch. bt.client, err = b.Publisher.ConnectWith(beat.ClientConfig{ PublishMode: beat.GuaranteedSend, WaitClose: 10 \* time.Se…

---

## [Different number of documents between stats and count](https://discuss.elastic.co/t/different-number-of-documents-between-stats-and-count/174283)

<div class="topic-metadata">

**Author:** [@apiras](https://discuss.elastic.co/u/apiras)\
**Replies:** 2\
**Last updated:** [April 10, 2019, 2:51pm UTC](https://discuss.elastic.co/t/different-number-of-documents-between-stats-and-count/174283 "2019-04-10T14:51:13Z")

</div>

Hi all, I get a different number of documents stored in an index invoking the endpoints /\_stats and /\_count. The same difference with v.6.5.0 and 6.7.0. Let me an example. With: GET /index1/\_count I get: { "count":…

---

## [Elastic search create Index is failing](https://discuss.elastic.co/t/elastic-search-create-index-is-failing/163843)

<div class="topic-metadata">

**Author:** [@ganil.89](https://discuss.elastic.co/u/ganil.89)\
**Replies:** 2\
**Last updated:** [January 11, 2019, 7:59am UTC](https://discuss.elastic.co/t/elastic-search-create-index-is-failing/163843 "2019-01-11T07:59:37Z")

</div>

I am trying to create index with High Rest Client, version 6.5.0 CreateIndexRequest createIndexRequest = new CreateIndexRequest(); createIndexRequest.index(indexName); createIndexRequest.settings(source, XContentType.…

---

## [Unable to push data to elastic search and Kibana through Logstash](https://discuss.elastic.co/t/unable-to-push-data-to-elastic-search-and-kibana-through-logstash/147544)

<div class="topic-metadata">

**Author:** [@shaheelkhan59](https://discuss.elastic.co/u/shaheelkhan59)\
**Replies:** 2\
**Last updated:** [October 9, 2018, 12:01pm UTC](https://discuss.elastic.co/t/unable-to-push-data-to-elastic-search-and-kibana-through-logstash/147544 "2018-10-09T12:01:58Z")

</div>

Hi all, I'm new to ELK. I need to use ELK for log analysis. But for getting a hands on experiencing I've started with a small .csv file. I'm using Elasticsearch 6.4, Kibana 6.4 and Logstash 6.4. I'm using Windows 8. I'…

---

## [Filebeat skips fields for the first line in UTF8 with BOM encoding](https://discuss.elastic.co/t/filebeat-skips-fields-for-the-first-line-in-utf8-with-bom-encoding/143320)

<div class="topic-metadata">

**Author:** [@alatas](https://discuss.elastic.co/u/alatas)\
**Replies:** 2\
**Last updated:** [August 8, 2018, 8:11pm UTC](https://discuss.elastic.co/t/filebeat-skips-fields-for-the-first-line-in-utf8-with-bom-encoding/143320 "2018-08-08T20:11:06Z")

</div>

Hi, I'm using filebeat for providing logs to ELK stack. Log files are composed of json lines. I also added custom fields to output with filebeat. When I saved log files utf8 with bom signature, Filebeat doesn't add cust…

---

## [Customise log messages in Kibana](https://discuss.elastic.co/t/customise-log-messages-in-kibana/137602)

<div class="topic-metadata">

**Author:** [@emanzaman](https://discuss.elastic.co/u/emanzaman)\
**Replies:** 2\
**Last updated:** [June 28, 2018, 6:31am UTC](https://discuss.elastic.co/t/customise-log-messages-in-kibana/137602 "2018-06-28T06:31:46Z")

</div>

Our support team struggles with the way Kibana logs its messages in the log file. They find JSON messages overwhelming. Is there any way we can change the log messages pattern (even if it is in JSON)?? We are using Kiba…

---

## [Elasticsearch error for handler in mapping](https://discuss.elastic.co/t/elasticsearch-error-for-handler-in-mapping/87355)

<div class="topic-metadata">

**Author:** [@manik\_kang](https://discuss.elastic.co/u/manik_kang)\
**Replies:** 2\
**Last updated:** [May 28, 2017, 9:22am UTC](https://discuss.elastic.co/t/elasticsearch-error-for-handler-in-mapping/87355 "2017-05-28T09:22:27Z")

</div>

No handler for type \[multi\_field\] declared on field \[name\] Can anyone help me with this error

---

## [How to increase relevance of compound words when using dictionary\_decompounder filter](https://discuss.elastic.co/t/how-to-increase-relevance-of-compound-words-when-using-dictionary-decompounder-filter/40564)

<div class="topic-metadata">

**Author:** [@psilos](https://discuss.elastic.co/u/psilos)\
**Replies:** 2\
**Last updated:** [January 31, 2016, 8:51pm UTC](https://discuss.elastic.co/t/how-to-increase-relevance-of-compound-words-when-using-dictionary-decompounder-filter/40564 "2016-01-31T20:51:18Z")

</div>

Hi guys, I have an index with a bunch of products. Among them there are "...smart watch phone..." and "smartphone" products. I used a dictionary\_decompounder filter so that even when I search for "smart phone", produc…

---

## [Fail to join cluster for VMs created from virtual box](https://discuss.elastic.co/t/fail-to-join-cluster-for-vms-created-from-virtual-box/33637)

<div class="topic-metadata">

**Author:** [@michaelbpeng](https://discuss.elastic.co/u/michaelbpeng)\
**Replies:** 2\
**Last updated:** [November 4, 2015, 2:05am UTC](https://discuss.elastic.co/t/fail-to-join-cluster-for-vms-created-from-virtual-box/33637 "2015-11-04T02:05:37Z")

</div>

Just installed ES 2.0.0 on linux VMs(Ubuntu/Mint) created from VirtualBox, and setup network as bridge added FQDN to /etc/hosts and disabled firewall. I can ping/ssh to the IPs and FQDNs. updated yml file on all VMs(xx…

---

## [User and password for Indices](https://discuss.elastic.co/t/user-and-password-for-indices/27390)

<div class="topic-metadata">

**Author:** [@pramod](https://discuss.elastic.co/u/pramod)\
**Replies:** 2\
**Last updated:** [August 14, 2015, 11:57am UTC](https://discuss.elastic.co/t/user-and-password-for-indices/27390 "2015-08-14T11:57:13Z")

</div>

hello my question is I want to set up user name and password for the respective indices and for fields so the respeective person can only read the data not write . for some field only accessing . i used this site h…

---

## [\_mapping API throws IndexMissingException even with examples from ES site](https://discuss.elastic.co/t/-mapping-api-throws-indexmissingexception-even-with-examples-from-es-site/15494)

<div class="topic-metadata">

**Author:** [@pitty\_the\_fools](https://discuss.elastic.co/u/pitty_the_fools)\
**Replies:** 2\
**Last updated:** [February 4, 2014, 12:41pm UTC](https://discuss.elastic.co/t/-mapping-api-throws-indexmissingexception-even-with-examples-from-es-site/15494 "2014-02-04T12:41:49Z")

</div>

Hi guys and gals, I have come across a curious problem, possibly a bug while working with mappings this morning. It's been a few months since I have had to create any mapping but created series of PHP scripts to d…

---

## [Alerting - Search Threshold/ES Query Rule](https://discuss.elastic.co/t/alerting-search-threshold-es-query-rule/354553)

<div class="topic-metadata">

**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\
**Replies:** 5\
**Last updated:** [March 8, 2024, 9:33pm UTC](https://discuss.elastic.co/t/alerting-search-threshold-es-query-rule/354553 "2024-03-08T21:33:00Z")

</div>

Hello, So I created a rule with filters to alert me if a specific document comes. This is working as expected. I was wondering since I am using {{context.hits}} to read through the documents. I was wondering how can I …

---

## [Security Onion - Kibana - Unable to load tooltip content in Maps](https://discuss.elastic.co/t/security-onion-kibana-unable-to-load-tooltip-content-in-maps/310535)

<div class="topic-metadata">

**Author:** [@DigitalDick](https://discuss.elastic.co/u/DigitalDick)\
**Replies:** 5\
**Last updated:** [July 26, 2022, 1:30pm UTC](https://discuss.elastic.co/t/security-onion-kibana-unable-to-load-tooltip-content-in-maps/310535 "2022-07-26T13:30:28Z")

</div>

Hi, New here and new to Kibana. Any help greatly appreciated. So I have setup Security Onion 2.3, I am using netflow to send logs from Meraki to Security Onion. I can see the logs, I can see the dots on the maps etc. Wh…

---

## [Can't connect to http-input of Logstash on Elastic Cloud](https://discuss.elastic.co/t/cant-connect-to-http-input-of-logstash-on-elastic-cloud/283822)

<div class="topic-metadata">

**Author:** [@Samuel\_Wehrli](https://discuss.elastic.co/u/Samuel_Wehrli)\
**Replies:** 5\
**Last updated:** [September 13, 2021, 12:44am UTC](https://discuss.elastic.co/t/cant-connect-to-http-input-of-logstash-on-elastic-cloud/283822 "2021-09-13T00:44:25Z")

</div>

Hi, i just deployed an elastic cloud instance on google cloud. I want to use the http input plugin of Logstash to receive sensor data (from "the things network") via webhook requests. I configured the Logstash pipeline o…

---

## [7.12.1 threshold rule, group by field within actions](https://discuss.elastic.co/t/7-12-1-threshold-rule-group-by-field-within-actions/272209)

<div class="topic-metadata">

**Author:** [@probson](https://discuss.elastic.co/u/probson)\
**Replies:** 5\
**Last updated:** [May 18, 2021, 2:43pm UTC](https://discuss.elastic.co/t/7-12-1-threshold-rule-group-by-field-within-actions/272209 "2021-05-18T14:43:09Z")

</div>

Hi, With 7.12.1 i can see our group by field appearing in the detection event, in this case it is host.name. I have tried pushing through within the actions but it is still empty. I am trying to access this data in se…

---

## [Beginner - metricbeat system dashboard with basic logstash output set](https://discuss.elastic.co/t/beginner-metricbeat-system-dashboard-with-basic-logstash-output-set/238635)

<div class="topic-metadata">

**Author:** [@NeitoFR](https://discuss.elastic.co/u/NeitoFR)\
**Replies:** 5\
**Last updated:** [June 26, 2020, 9:08am UTC](https://discuss.elastic.co/t/beginner-metricbeat-system-dashboard-with-basic-logstash-output-set/238635 "2020-06-26T09:08:29Z")

</div>

Hi everyone, I'm using ELK 7.5.2 with basic metricbeat modules (system, docker) I managed to load the Kibana dashboard to Kibana correctly. But now I'm making the logs pass through logstash (without any filter) and the …

---

## [Assigning an aggregated event timestamp to @timestamp](https://discuss.elastic.co/t/assigning-an-aggregated-event-timestamp-to-timestamp/229381)

<div class="topic-metadata">

**Author:** [@xyz2](https://discuss.elastic.co/u/xyz2)\
**Replies:** 5\
**Last updated:** [April 29, 2020, 9:57pm UTC](https://discuss.elastic.co/t/assigning-an-aggregated-event-timestamp-to-timestamp/229381 "2020-04-29T21:57:58Z")

</div>

HI, I am aggragating events for each session from log I fetch the log time from event in aggregate filter, i want to have a field startdatetime and assign session open time to this, set timeout\_timestamp\_field =\> "St…

---

## [Split output of fping properly with grok](https://discuss.elastic.co/t/split-output-of-fping-properly-with-grok/223621)

<div class="topic-metadata">

**Author:** [@hitman22](https://discuss.elastic.co/u/hitman22)\
**Replies:** 5\
**Last updated:** [March 16, 2020, 8:02pm UTC](https://discuss.elastic.co/t/split-output-of-fping-properly-with-grok/223621 "2020-03-16T20:02:46Z")

</div>

Hello, I am trying to Split a Output from fping with grok, but I am not sure how to do it properly. I have the following output from fping google.de : xmt/rcv/%loss = 16/16/0%, min/avg/max = 23.6/24.3/25.2 I only nee…

---

## [Additional tags while indexing local files using fscrawler](https://discuss.elastic.co/t/additional-tags-while-indexing-local-files-using-fscrawler/213072)

<div class="topic-metadata">

**Author:** [@Sam\_4](https://discuss.elastic.co/u/Sam_4)\
**Replies:** 5\
**Last updated:** [December 31, 2019, 2:12pm UTC](https://discuss.elastic.co/t/additional-tags-while-indexing-local-files-using-fscrawler/213072 "2019-12-31T14:12:26Z")

</div>

Hi I want to add additional tag while indexing local files using fscrawler. Using rest API Additional tags we can achieve above requirement but while indexing local file,can we archive this functionality. Thanks,

---

## [Kibana user privileges](https://discuss.elastic.co/t/kibana-user-privileges/206834)

<div class="topic-metadata">

**Author:** [@joseja](https://discuss.elastic.co/u/joseja)\
**Replies:** 5\
**Last updated:** [November 13, 2019, 12:46pm UTC](https://discuss.elastic.co/t/kibana-user-privileges/206834 "2019-11-13T12:46:13Z")

</div>

Hi, With Kibana spaces and user/role privileges, is there a way in which I can give users permission to create new visualizations/dashboards, but at the same time making sure that the user doesnt have right to delete an…

---

## [How to make Elasticsearch API calls in Magento 2](https://discuss.elastic.co/t/how-to-make-elasticsearch-api-calls-in-magento-2/220831)

<div class="topic-metadata">

**Author:** [@tajveez](https://discuss.elastic.co/u/tajveez)\
**Replies:** 0\
**Last updated:** [February 25, 2020, 10:55am UTC](https://discuss.elastic.co/t/how-to-make-elasticsearch-api-calls-in-magento-2/220831 "2020-02-25T10:55:19Z")

</div>

Hi, I have a custom search field from which I want to access elasticsearch results, for that, I am making API calls to URL: http://\<my\_url\>:9200/\_search with body { "query": { "bool": { …

---

## [Huge direct buffer pool usage with out of memory](https://discuss.elastic.co/t/huge-direct-buffer-pool-usage-with-out-of-memory/62381)

<div class="topic-metadata">

**Author:** [@ademeaulte](https://discuss.elastic.co/u/ademeaulte)\
**Replies:** 0\
**Last updated:** [October 6, 2016, 1:05pm UTC](https://discuss.elastic.co/t/huge-direct-buffer-pool-usage-with-out-of-memory/62381 "2016-10-06T13:05:22Z")

</div>

Hi, I'm using Elasticsearch 2.3.3 with Oracle Java 1.8.0\_91, and after weeks without restart, my cluster stops working because of direct buffer out of memory. In the mean time, I can see the direct buffer pool (which is…

---

## [MIB contains errors when smidump](https://discuss.elastic.co/t/mib-contains-errors-when-smidump/47463)

<div class="topic-metadata">

**Author:** [@stefansaye](https://discuss.elastic.co/u/stefansaye)\
**Replies:** 0\
**Last updated:** [April 15, 2016, 6:34am UTC](https://discuss.elastic.co/t/mib-contains-errors-when-smidump/47463 "2016-04-15T06:34:41Z")

</div>

Hi all, I got error when i using import.rb to convert a mib file as following: /opt/logstash/vendor/bundle/jruby/1.9/gems/snmp-1.2.0# ruby -d import.rb convermib/ Exception LoadError' at /usr/lib/ruby/2.1.0/rubygems.…

---

## [Custom kibana](https://discuss.elastic.co/t/custom-kibana/191939)

<div class="topic-metadata">

**Author:** [@Dania\_Ayu](https://discuss.elastic.co/u/Dania_Ayu)\
**Replies:** 6\
**Last updated:** [July 25, 2019, 5:27pm UTC](https://discuss.elastic.co/t/custom-kibana/191939 "2019-07-25T17:27:56Z")

</div>

i use kibana 7.1, i want to custom kibana ui for my project, what should i do?

---

## [Exact term count search help needed](https://discuss.elastic.co/t/exact-term-count-search-help-needed/171225)

<div class="topic-metadata">

**Author:** [@Teddis](https://discuss.elastic.co/u/Teddis)\
**Replies:** 6\
**Last updated:** [March 8, 2019, 12:34pm UTC](https://discuss.elastic.co/t/exact-term-count-search-help-needed/171225 "2019-03-08T12:34:05Z")

</div>

I need to be able to find exact text matches, not raw matches so I can take advantage of fuzzy matching. For example, consider these documents: doc1.name = "cheese pizza" doc2.name = "kid's cheese pizza" doc3.name = "…

---

## [ES 5.2, need proper production setup advice](https://discuss.elastic.co/t/es-5-2-need-proper-production-setup-advice/79999)

<div class="topic-metadata">

**Author:** [@Username1](https://discuss.elastic.co/u/Username1)\
**Replies:** 6\
**Last updated:** [March 25, 2017, 7:56pm UTC](https://discuss.elastic.co/t/es-5-2-need-proper-production-setup-advice/79999 "2017-03-25T19:56:22Z")

</div>

I have 3 separate web applications, for each of which I am planning to use Elasticsearch 5.2 as a full-text search engine. All apps are physically located on the same hardware. Hardware capabilities are the following: 21…

---

## [Should i use emit() when using runtime field](https://discuss.elastic.co/t/should-i-use-emit-when-using-runtime-field/317861)

<div class="topic-metadata">

**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\
**Replies:** 1\
**Last updated:** [November 1, 2022, 9:42am UTC](https://discuss.elastic.co/t/should-i-use-emit-when-using-runtime-field/317861 "2022-11-01T09:42:00Z")

</div>

Hello, i'm trying to sum 2 fields in index template using runtime field. Currently, my script is like this: doc\['a'\].value + doc\['b'\].value. Do i need to emit like this: emit(doc\['a'\].value + doc\['b'\].value) so that the …

---

## [Elasticsearch\_1 exited with code 1](https://discuss.elastic.co/t/elasticsearch-1-exited-with-code-1/313416)

<div class="topic-metadata">

**Author:** [@boot4root](https://discuss.elastic.co/u/boot4root)\
**Replies:** 1\
**Last updated:** [September 1, 2022, 7:43am UTC](https://discuss.elastic.co/t/elasticsearch-1-exited-with-code-1/313416 "2022-09-01T07:43:46Z")

</div>

Hello, when I try to run elasticsearch and kibana through docker-compose, I get the following error. Elasticsearch\_1 exited with code 1 Here is manual with this settings. Elastiflow I tried different versions, I also…

---

## [Remote Server is not ready to accept connections](https://discuss.elastic.co/t/remote-server-is-not-ready-to-accept-connections/305911)

<div class="topic-metadata">

**Author:** [@ttss15](https://discuss.elastic.co/u/ttss15)\
**Replies:** 1\
**Last updated:** [June 6, 2022, 1:23pm UTC](https://discuss.elastic.co/t/remote-server-is-not-ready-to-accept-connections/305911 "2022-06-06T13:23:47Z")

</div>

Hello, I am trying to set up fleet-managed agents on an air-gapped environment. The elastic package registry is up and running. Fleet server is also running and healthy. If I try to enroll an agent on a machine that is …

---

## [\[logstash.outputs.elasticsearch\]\[main\] Failed to install template](https://discuss.elastic.co/t/logstash-outputs-elasticsearch-main-failed-to-install-template/298835)

<div class="topic-metadata">

**Author:** [@Khaled\_Saidi](https://discuss.elastic.co/u/Khaled_Saidi)\
**Replies:** 1\
**Last updated:** [March 4, 2022, 10:36pm UTC](https://discuss.elastic.co/t/logstash-outputs-elasticsearch-main-failed-to-install-template/298835 "2022-03-04T22:36:05Z")

</div>

Hi everyone, After enabling SSL communication on my Elasticsearch server (v7.14.0), i noticed an error in my logstash logs: \[ERROR\]\[logstash.outputs.elasticsearch\]\[main\] Failed to install template {:message=\>"Got respo…

[Previous page](https://discuss.elastic.co/top.md?page=1521&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1523&per_page=50&period=all)
