# Top **URL:** https://discuss.elastic.co/top.md?page=1536&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1537 --- ## [Logstash mutate not working after kv filter applied](https://discuss.elastic.co/t/logstash-mutate-not-working-after-kv-filter-applied/303849)
**Author:** [@splitmessage88](https://discuss.elastic.co/u/splitmessage88)\ **Replies:** 6\ **Last updated:** [May 4, 2022, 5:56am UTC](https://discuss.elastic.co/t/logstash-mutate-not-working-after-kv-filter-applied/303849 "2022-05-04T05:56:19Z")
Hi, I created a filter for cisco syslog, input source cisco FTD. All the fields are parsing correctly but I can't rename/remove fields with mutate after I used the kv {} filter. Is it possible to use mutate after kv … --- ## [TSVB timeseries broken?](https://discuss.elastic.co/t/tsvb-timeseries-broken/271548)
**Author:** [@wlbsxnlp22](https://discuss.elastic.co/u/wlbsxnlp22)\ **Replies:** 6\ **Last updated:** [April 29, 2021, 2:37pm UTC](https://discuss.elastic.co/t/tsvb-timeseries-broken/271548 "2021-04-29T14:37:13Z")
Hi The following is an attempt to display average response times across our different systems in one TSVB Timeseries. Each series has its own separate index pattern. (There is no index main index pattern in panel optio… --- ## [Cant send mail alert through watcher](https://discuss.elastic.co/t/cant-send-mail-alert-through-watcher/229011)
**Author:** [@rakeshraagu2](https://discuss.elastic.co/u/rakeshraagu2)\ **Replies:** 6\ **Last updated:** [May 5, 2020, 8:59pm UTC](https://discuss.elastic.co/t/cant-send-mail-alert-through-watcher/229011 "2020-05-05T20:59:35Z")
Hi, When I testing my mail alert using watcher it is showing an error that mail send failed. In my cluster log file I saw below given line. Can anyoone help. \]\[ERROR\]\[o.e.x.w.a.e.ExecutableEmailAction\] \[elk-master\] fa… --- ## [Reason: Setting "monitoring.enabled" doesn't exist](https://discuss.elastic.co/t/reason-setting-monitoring-enabled-doesnt-exist/347731)
**Author:** [@Vivi\_Allen](https://discuss.elastic.co/u/Vivi_Allen)\ **Replies:** 4\ **Last updated:** [November 23, 2023, 3:48am UTC](https://discuss.elastic.co/t/reason-setting-monitoring-enabled-doesnt-exist/347731 "2023-11-23T03:48:33Z")
I want to enable monitor for logstash with metricbeat. Following this guide Collect Logstash monitoring data with Metricbeat | Logstash Reference \[8.11\] | Elastic, I add monitoring.enabled: false to the logstash.yml. T… --- ## [Return JSON Array of Arrays from elastic](https://discuss.elastic.co/t/return-json-array-of-arrays-from-elastic/330971)
**Author:** [@Akaash\_Mukherjee](https://discuss.elastic.co/u/Akaash_Mukherjee)\ **Replies:** 4\ **Last updated:** [April 27, 2023, 3:23pm UTC](https://discuss.elastic.co/t/return-json-array-of-arrays-from-elastic/330971 "2023-04-27T15:23:10Z")
Hi, We've noticed that the overhead of the JSON object structure is creating some performance problems for us. One of the largest parts of this overhead is the repetitiveness of the object properties in each object. We'… --- ## [Failed to determine the health of the cluster](https://discuss.elastic.co/t/failed-to-determine-the-health-of-the-cluster/313117)
**Author:** [@rajvel](https://discuss.elastic.co/u/rajvel)\ **Replies:** 4\ **Last updated:** [August 29, 2022, 4:42am UTC](https://discuss.elastic.co/t/failed-to-determine-the-health-of-the-cluster/313117 "2022-08-29T04:42:26Z")
Hello Team, We used the CA to create a http.p12 file for elasticsearch secured configuration. If we use the own CA, the kibana error. Please help me to fix the issue. Server not yet ready. \[ERROR\]\[elasticsearch-serv… --- ## [ECE Fundamentals: "Not enough capacity to allocate instance(s)"](https://discuss.elastic.co/t/ece-fundamentals-not-enough-capacity-to-allocate-instance-s/309907)
**Author:** [@rcorfield](https://discuss.elastic.co/u/rcorfield)\ **Replies:** 4\ **Last updated:** [July 20, 2022, 8:15am UTC](https://discuss.elastic.co/t/ece-fundamentals-not-enough-capacity-to-allocate-instance-s/309907 "2022-07-20T08:15:01Z")
Hi, I'm trying the complete the "ECE Fundamentals" labs, but I've hit a problem when I trying to create a new deployment via the Cloud UI in Lab 3. I receive the following message: Latest change to Elasticsearch config… --- ## [Elastic Search to return different counts along with Search results](https://discuss.elastic.co/t/elastic-search-to-return-different-counts-along-with-search-results/305358)
**Author:** [@srikanthkadem](https://discuss.elastic.co/u/srikanthkadem)\ **Replies:** 4\ **Last updated:** [June 6, 2022, 5:18am UTC](https://discuss.elastic.co/t/elastic-search-to-return-different-counts-along-with-search-results/305358 "2022-06-06T05:18:45Z")
Hi , I have a requirement to get the differnt counts based on status field in my document for given search critiria. For e.g If I am searching with Comic keyword , I generally get 10 documents(default size) with TotalHi… --- ## [Different .kibana\_\* indices After upgrading](https://discuss.elastic.co/t/different-kibana-indices-after-upgrading/289912)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 4\ **Last updated:** [November 29, 2021, 9:42am UTC](https://discuss.elastic.co/t/different-kibana-indices-after-upgrading/289912 "2021-11-29T09:42:30Z")
Upgrade ELK stack from 7.13 to 7.15 I checked /\_cat/indices/.kibana?v\* health status index uuid pri rep docs.count docs.deleted store.size pri.store.size green open .kiban… --- ## [Value Lists as Exception in Threshold and Correlation type rules](https://discuss.elastic.co/t/value-lists-as-exception-in-threshold-and-correlation-type-rules/268353)
**Author:** [@tushar.bansal](https://discuss.elastic.co/u/tushar.bansal)\ **Replies:** 1\ **Last updated:** [April 13, 2021, 1:20am UTC](https://discuss.elastic.co/t/value-lists-as-exception-in-threshold-and-correlation-type-rules/268353 "2021-04-13T01:20:53Z")
Why Can't we add value list as exception for Threshold rules and correlation rules even in 7.12? --- ## [Getting started with managing users and how to control what data they can see](https://discuss.elastic.co/t/getting-started-with-managing-users-and-how-to-control-what-data-they-can-see/230607)
**Author:** [@ilovedonuts](https://discuss.elastic.co/u/ilovedonuts)\ **Replies:** 1\ **Last updated:** [April 30, 2020, 6:23pm UTC](https://discuss.elastic.co/t/getting-started-with-managing-users-and-how-to-control-what-data-they-can-see/230607 "2020-04-30T18:23:18Z")
Our team has the following requirements that I need to look into... Create and manage users when they access Kibana from their workspace Control what these users see in Kibana I need guidance on where to start with th… --- ## [A primary shard can store up to Integer.MAX\_VALUE -128 documents, how could es do if if the number of documents exceeds this value? thanks](https://discuss.elastic.co/t/a-primary-shard-can-store-up-to-integer-max-value-128-documents-how-could-es-do-if-if-the-number-of-documents-exceeds-this-value-thanks/161143)
**Author:** [@zcx](https://discuss.elastic.co/u/zcx)\ **Replies:** 4\ **Last updated:** [December 17, 2018, 12:46pm UTC](https://discuss.elastic.co/t/a-primary-shard-can-store-up-to-integer-max-value-128-documents-how-could-es-do-if-if-the-number-of-documents-exceeds-this-value-thanks/161143 "2018-12-17T12:46:51Z")
as above. thanks --- ## [Help with the grok processor](https://discuss.elastic.co/t/help-with-the-grok-processor/139661)
**Author:** [@vsk](https://discuss.elastic.co/u/vsk)\ **Replies:** 4\ **Last updated:** [July 12, 2018, 4:20am UTC](https://discuss.elastic.co/t/help-with-the-grok-processor/139661 "2018-07-12T04:20:19Z")
The below code works well with grok debugger.. However when adding via., pipeline it fails.. what is the issue here ? { "description": "Extract information", "processors":\[ { "grok": { "field":"descr", "index\_name… --- ## [Elasticsearch indices suddenly much larger](https://discuss.elastic.co/t/elasticsearch-indices-suddenly-much-larger/130908)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 4\ **Last updated:** [May 29, 2018, 9:24pm UTC](https://discuss.elastic.co/t/elasticsearch-indices-suddenly-much-larger/130908 "2018-05-29T21:24:59Z")
I'm trying to figure out why all of the sudden my index size has increase drastically. Nothing has changed about the type of document being imported and yet over the past 2 months, the index size is from 800mb to 1.4gb w… --- ## [Error while starting logstash](https://discuss.elastic.co/t/error-while-starting-logstash/354631)
**Author:** [@Dhia\_Said](https://discuss.elastic.co/u/Dhia_Said)\ **Replies:** 7\ **Last updated:** [March 5, 2024, 12:03pm UTC](https://discuss.elastic.co/t/error-while-starting-logstash/354631 "2024-03-05T12:03:26Z")
hello i am new to logstash and i had this error while launching logstash , i didn't know the cause of it, btw i am using it on windows : \[2024-03-04T12:04:49,450\]\[ERROR\]\[logstash.agent \] Failed to execute ac… --- ## [Reindex data stream](https://discuss.elastic.co/t/reindex-data-stream/337305)
**Author:** [@VirusProtect](https://discuss.elastic.co/u/VirusProtect)\ **Replies:** 1\ **Last updated:** [June 30, 2023, 12:34pm UTC](https://discuss.elastic.co/t/reindex-data-stream/337305 "2023-06-30T12:34:56Z")
Hello, There is conflicts with fields in the data stream backing indices. I would like to know the correct way to resolve this issue. While reindexing data is possible with regular indexes, I am unsure how to proceed wi… --- ## [Custom Plugins in Elasticsearch](https://discuss.elastic.co/t/custom-plugins-in-elasticsearch/328432)
**Author:** [@JAYAVARDHAN\_VEJENDLA](https://discuss.elastic.co/u/JAYAVARDHAN_VEJENDLA)\ **Replies:** 7\ **Last updated:** [March 27, 2023, 3:05pm UTC](https://discuss.elastic.co/t/custom-plugins-in-elasticsearch/328432 "2023-03-27T15:05:32Z")
Hello everyone! We are using Elasticsearch in the Legal and Investigation area. We need to perform Proximity and Wildcard Search in a single query-string query, and we found out that elasticsearch is not providing that f… --- ## [Can you recover deleted documents when you didnt take s snapshot?](https://discuss.elastic.co/t/can-you-recover-deleted-documents-when-you-didnt-take-s-snapshot/238531)
**Author:** [@chappers72](https://discuss.elastic.co/u/chappers72)\ **Replies:** 1\ **Last updated:** [June 25, 2020, 1:16am UTC](https://discuss.elastic.co/t/can-you-recover-deleted-documents-when-you-didnt-take-s-snapshot/238531 "2020-06-25T01:16:27Z")
I deleted some documents in a bulk process last night by mistake. I need to get them back, I have restores of my VM data directory but they do not appear there (as per docs). Can I get them back? --- ## [Elastic Search text field aggregations](https://discuss.elastic.co/t/elastic-search-text-field-aggregations/234244)
**Author:** [@Naveena1](https://discuss.elastic.co/u/Naveena1)\ **Replies:** 7\ **Last updated:** [June 8, 2020, 11:03am UTC](https://discuss.elastic.co/t/elastic-search-text-field-aggregations/234244 "2020-06-08T11:03:10Z")
Is there anyway possible to find min or max aggregation on text fields when we group by some fields --- ## [APM Agent Error on Websphere server](https://discuss.elastic.co/t/apm-agent-error-on-websphere-server/174316)
**Author:** [@Awais\_Haider](https://discuss.elastic.co/u/Awais_Haider)\ **Replies:** 1\ **Last updated:** [March 28, 2019, 11:23am UTC](https://discuss.elastic.co/t/apm-agent-error-on-websphere-server/174316 "2019-03-28T11:23:55Z")
If you are asking about a problem you are experiencing, please use the following template, as it will help us help you. If you have a different problem, please delete all of this text :slight\_smile: Kibana version: 6.6 … --- ## [Use grok to filter mysql slow-queries](https://discuss.elastic.co/t/use-grok-to-filter-mysql-slow-queries/169248)
**Author:** [@dank](https://discuss.elastic.co/u/dank)\ **Replies:** 1\ **Last updated:** [February 20, 2019, 4:17pm UTC](https://discuss.elastic.co/t/use-grok-to-filter-mysql-slow-queries/169248 "2019-02-20T16:17:50Z")
Hello all, I'm having a hard time to filter my MySQL slow-queries using logstash (version 6.6.1). I'm using the following grok filter : input { file { path =\> \["/tmp/testFile.txt"\] type =\> "mysql" codec =\> multili… --- ## [Migrate the machine learning job from one environment to other](https://discuss.elastic.co/t/migrate-the-machine-learning-job-from-one-environment-to-other/150070)
**Author:** [@chandra0651](https://discuss.elastic.co/u/chandra0651)\ **Replies:** 1\ **Last updated:** [September 27, 2018, 12:47pm UTC](https://discuss.elastic.co/t/migrate-the-machine-learning-job-from-one-environment-to-other/150070 "2018-09-27T12:47:34Z")
Hello I know there is a way to import and export the visualization , dashboards and saved searched from one environment to other, is there a way same where we can download a ML job from environment and same can be import… --- ## [Multiple Nodes of Elastic Search](https://discuss.elastic.co/t/multiple-nodes-of-elastic-search/138076)
**Author:** [@Ayushi\_Dalmia](https://discuss.elastic.co/u/Ayushi_Dalmia)\ **Replies:** 7\ **Last updated:** [July 1, 2018, 5:28pm UTC](https://discuss.elastic.co/t/multiple-nodes-of-elastic-search/138076 "2018-07-01T17:28:16Z")
I am using elasticsearch using docker-compose. This is how my docker-compose looks like: elasticsearch: image: elasticsearch:2.4 command: elasticsearch -Des.network.host=0.0.0.0 environment: - cluster.name=docker-cl… --- ## [Unable to create PreBuiltXPackTransportClient client x-pack](https://discuss.elastic.co/t/unable-to-create-prebuiltxpacktransportclient-client-x-pack/135384)
**Author:** [@ksuthar](https://discuss.elastic.co/u/ksuthar)\ **Replies:** 1\ **Last updated:** [June 20, 2018, 5:43pm UTC](https://discuss.elastic.co/t/unable-to-create-prebuiltxpacktransportclient-client-x-pack/135384 "2018-06-20T17:43:56Z")
I am working on x-pack watcher. I have added dependency of x-pack. org.elasticsearch.client x-pack-transport 5.3.3 org.apache.logging.log4j log4j-api 2.7 org.apache.logging.log4j lo… --- ## [X-pack plugin install optimize bundles](https://discuss.elastic.co/t/x-pack-plugin-install-optimize-bundles/90123)
**Author:** [@jhn134910](https://discuss.elastic.co/u/jhn134910)\ **Replies:** 1\ **Last updated:** [June 23, 2017, 3:05pm UTC](https://discuss.elastic.co/t/x-pack-plugin-install-optimize-bundles/90123 "2017-06-23T15:05:22Z")
Hello there, I'm using version 5.4.0 of x-pack. I forked kibana 5.4 branch and customized the menus to achieve a 'dashboard-only' view and re-built to generate a kibana.bundle.js file. All tested and appears to be worki… --- ## [Unable to fetch mapping because Kibana requests the wrong URL to ES](https://discuss.elastic.co/t/unable-to-fetch-mapping-because-kibana-requests-the-wrong-url-to-es/87305)
**Author:** [@nodejsdev](https://discuss.elastic.co/u/nodejsdev)\ **Replies:** 1\ **Last updated:** [May 30, 2017, 4:11am UTC](https://discuss.elastic.co/t/unable-to-fetch-mapping-because-kibana-requests-the-wrong-url-to-es/87305 "2017-05-30T04:11:53Z")
Hello. I set up Kibana, Logstash and ES using docker-compose. Everything's working fine except that on the "Configure an index pattern" page Kibana can't find the logstash-\* indices. I looked at Kibana logs and noticed… --- ## [Logstash is not parsing simple-conf](https://discuss.elastic.co/t/logstash-is-not-parsing-simple-conf/65291)
**Author:** [@w0lverine](https://discuss.elastic.co/u/w0lverine)\ **Replies:** 1\ **Last updated:** [November 8, 2016, 6:35am UTC](https://discuss.elastic.co/t/logstash-is-not-parsing-simple-conf/65291 "2016-11-08T06:35:08Z")
Following the COMBINEDAPACHELOG example I am trying to get logstash output the apache log from a specific file location but logstash just runs and nothing is parsed. Commands: ./logstash -f modbus.conf --config.test… --- ## [How to parse nested json](https://discuss.elastic.co/t/how-to-parse-nested-json/57505)
**Author:** [@eladio](https://discuss.elastic.co/u/eladio)\ **Replies:** 1\ **Last updated:** [August 10, 2016, 5:51am UTC](https://discuss.elastic.co/t/how-to-parse-nested-json/57505 "2016-08-10T05:51:32Z")
this is my json {"objId":"5586560001","id":"48013895","ts":"2016-03-08 14:45:05.799888","type":"001","comp":"DVD","message":"{\\"id\_Ext\\":\\"5586560001\\",\\"id\\":\\"001099223100316 12\\",\\"entryContainerID\\":\\"1\\",\\"moveme… --- ## [\[SOLVED\] After several months, logstash input file stop working](https://discuss.elastic.co/t/solved-after-several-months-logstash-input-file-stop-working/31346)
**Author:** [@alexolivan](https://discuss.elastic.co/u/alexolivan)\ **Replies:** 1\ **Last updated:** [October 13, 2015, 3:07pm UTC](https://discuss.elastic.co/t/solved-after-several-months-logstash-input-file-stop-working/31346 "2015-10-13T15:07:21Z")
Hi forum... logstash is driving me nuts... My logstash servers are restarted every two ours, in order to keep the cluster up... but even so, there are some servers that can refuse to read some files for days... and the… --- ## [Alerting on forecast](https://discuss.elastic.co/t/alerting-on-forecast/254100)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 5\ **Last updated:** [November 4, 2020, 8:42am UTC](https://discuss.elastic.co/t/alerting-on-forecast/254100 "2020-11-04T08:42:12Z")
Hi, im trying to alert when the forecast prediction value is greater than 95, I need to get the hostname (partition\_value) and the time when the value surpass the treshold of 95, I currently can get the value and the pa… --- ## [Logstash: Replace @timestamp with time like this 2020-03-27T16:00:40.982652300+00:00](https://discuss.elastic.co/t/logstash-replace-timestamp-with-time-like-this-2020-03-27t1640-982652300-00-00/225938)
**Author:** [@Paul\_Offord](https://discuss.elastic.co/u/Paul_Offord)\ **Replies:** 5\ **Last updated:** [March 31, 2020, 11:06pm UTC](https://discuss.elastic.co/t/logstash-replace-timestamp-with-time-like-this-2020-03-27t1640-982652300-00-00/225938 "2020-03-31T23:06:44Z")
Hi, I need to replace the @timestamp value with a field value (called SystemTime) that looks like this: 2020-03-27T16:00:40.982652300+00:00 I have tried numerous variations of mutate gsub and the date filter but it's o… --- ## [Elasticsearch clustering process](https://discuss.elastic.co/t/elasticsearch-clustering-process/95646)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 5\ **Last updated:** [August 4, 2017, 10:46pm UTC](https://discuss.elastic.co/t/elasticsearch-clustering-process/95646 "2017-08-04T22:46:45Z")
I am trying to understand how the elasticsearch clustering works. Whether it considers cluster name to form a cluster and will pickup the cluster state settings from discovery.zen.ping.unicast.hosts host names? I think i… --- ## [Collectd index name](https://discuss.elastic.co/t/collectd-index-name/65386)
**Author:** [@Kernel\_Panic](https://discuss.elastic.co/u/Kernel_Panic)\ **Replies:** 5\ **Last updated:** [November 8, 2016, 11:35pm UTC](https://discuss.elastic.co/t/collectd-index-name/65386 "2016-11-08T23:35:51Z")
Hi there guys I'm configuring collectd to gather info from my docker containers, so far so good, but I'd like the to have a descriptive index name, now it's called like bellow, which was created automatically, I'd li… --- ## [Cannot post new document to elasticsearch](https://discuss.elastic.co/t/cannot-post-new-document-to-elasticsearch/7144)
**Author:** [@Gaurav\_Vijayvargiya](https://discuss.elastic.co/u/Gaurav_Vijayvargiya)\ **Replies:** 5\ **Last updated:** [March 28, 2012, 5:15pm UTC](https://discuss.elastic.co/t/cannot-post-new-document-to-elasticsearch/7144 "2012-03-28T17:15:38Z")
Hi We had a 5 node cluster (5 data nodes and 1 non-date master). One of the data nodes went down. Now when we try to post anything to the cluster it just hangs for ever. There is nothing in the logs. $ curl -XGET… --- ## [Allow Kibana role to access all indices EXCEPT FOR a specific one](https://discuss.elastic.co/t/allow-kibana-role-to-access-all-indices-except-for-a-specific-one/336135)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 2\ **Last updated:** [June 16, 2023, 1:16pm UTC](https://discuss.elastic.co/t/allow-kibana-role-to-access-all-indices-except-for-a-specific-one/336135 "2023-06-16T13:16:49Z")
TL;DR How do I grant access to all indices matching a pattern, but deny access to one specific index that also matches the pattern (e.g., how do I ALLOW access to all logs, including logs-myapp.log-\*, but specifically DE… --- ## [Error: fail to communicate with updated API client hosts](https://discuss.elastic.co/t/error-fail-to-communicate-with-updated-api-client-hosts/313525)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 2\ **Last updated:** [September 6, 2022, 6:37am UTC](https://discuss.elastic.co/t/error-fail-to-communicate-with-updated-api-client-hosts/313525 "2022-09-06T06:37:41Z")
Hi All, I have a self managed fleet server with one local machine connecting perfectly and i can see logs. I've installed a new remote cloud machine, the installation was successful but I can't see logs coming. Checki… --- ## [Kibana Query Language documentation](https://discuss.elastic.co/t/kibana-query-language-documentation/213178)
**Author:** [@JY\_DT](https://discuss.elastic.co/u/JY_DT)\ **Replies:** 2\ **Last updated:** [December 27, 2019, 11:43am UTC](https://discuss.elastic.co/t/kibana-query-language-documentation/213178 "2019-12-27T11:43:46Z")
Hi, I'm using Kibana in a browser to query for some log data that has been fed into Elasticsearch. I'm not able to get enough help material on usage information for various fields. For example, what is "host" and what… --- ## [How to found empty field in elasticsearch](https://discuss.elastic.co/t/how-to-found-empty-field-in-elasticsearch/157898)
**Author:** [@mhsankar](https://discuss.elastic.co/u/mhsankar)\ **Replies:** 2\ **Last updated:** [November 23, 2018, 7:30pm UTC](https://discuss.elastic.co/t/how-to-found-empty-field-in-elasticsearch/157898 "2018-11-23T19:30:09Z")
Hi we have a mistake when insert data. a field data type is text . we insert "" for data. i cant search zero length field . how can found like this record? --- ## [Hardware recommendation for fb + Logstash](https://discuss.elastic.co/t/hardware-recommendation-for-fb-logstash/150555)
**Author:** [@ratman](https://discuss.elastic.co/u/ratman)\ **Replies:** 2\ **Last updated:** [October 4, 2018, 6:42am UTC](https://discuss.elastic.co/t/hardware-recommendation-for-fb-logstash/150555 "2018-10-04T06:42:48Z")
Hello! I am mounting a server to run Filebeat + Logstahs which will send the output info to our Elastic Cloud Service. Currently, we are daily receiving around 500-600mb of logs and the processing they would go through … --- ## [Do I need to add new field manually in Elasticsearch?](https://discuss.elastic.co/t/do-i-need-to-add-new-field-manually-in-elasticsearch/112642)
**Author:** [@marsa099](https://discuss.elastic.co/u/marsa099)\ **Replies:** 2\ **Last updated:** [December 20, 2017, 4:53pm UTC](https://discuss.elastic.co/t/do-i-need-to-add-new-field-manually-in-elasticsearch/112642 "2017-12-20T16:53:33Z")
Hi! I'm using an ELK setup where I use Grok to filter data inside Logstash. I have defined my Grok filters inside of 02-filebeats-input.conf file like below and I wonder if I in some Elasticsearch way have to manually a… --- ## [curator.actions.IndexSettings missing in Curator python lib?](https://discuss.elastic.co/t/curator-actions-indexsettings-missing-in-curator-python-lib/98868)
**Author:** [@Cornoualis](https://discuss.elastic.co/u/Cornoualis)\ **Replies:** 2\ **Last updated:** [August 30, 2017, 4:21pm UTC](https://discuss.elastic.co/t/curator-actions-indexsettings-missing-in-curator-python-lib/98868 "2017-08-30T16:21:52Z")
I’m trying to use the IndexSettings action class in the curator python library: ilo = curator.IndexList(es) e= curator.actions.IndexSettings(ilo.all\_indices, index\_settings={"number\_of\_replicas": 1}) And I have this re… --- ## [Where is logstash.stdout for v5.2?](https://discuss.elastic.co/t/where-is-logstash-stdout-for-v5-2/78023)
**Author:** [@ZillaG](https://discuss.elastic.co/u/ZillaG)\ **Replies:** 2\ **Last updated:** [March 9, 2017, 8:05pm UTC](https://discuss.elastic.co/t/where-is-logstash-stdout-for-v5-2/78023 "2017-03-09T20:05:20Z")
I'm playing with v5.2, and have my output filter set to stdout using the rubydebug codec. However I don't see my events logged into /var/log/logstash/logstash.stdout. Did this location change? I looked in the /etc/logsta… --- ## [Aggregating the distinct result to a grouping](https://discuss.elastic.co/t/aggregating-the-distinct-result-to-a-grouping/56833)
**Author:** [@nicky\_501](https://discuss.elastic.co/u/nicky_501)\ **Replies:** 2\ **Last updated:** [August 1, 2016, 2:29am UTC](https://discuss.elastic.co/t/aggregating-the-distinct-result-to-a-grouping/56833 "2016-08-01T02:29:32Z")
Hi All, I am very new into this elasticsearch and I could not find any related discussion on this. Currently, I am using elasticsearch to perform analytic for our data. I migrated our data from the RDBMS to the elastic… --- ## [Problems with parsing multiline](https://discuss.elastic.co/t/problems-with-parsing-multiline/52176)
**Author:** [@SergeyParamoshkin](https://discuss.elastic.co/u/SergeyParamoshkin)\ **Replies:** 2\ **Last updated:** [June 12, 2016, 11:16am UTC](https://discuss.elastic.co/t/problems-with-parsing-multiline/52176 "2016-06-12T11:16:35Z")
Hi. I have a problem, I use a multiline parsing with this configuration. multiline: pattern: ^\\\[ negate: true match: after INFO 2016-06-08 10:11:08,241 Controller.py:265 - Heartbeat response… --- ## [Geo Vidualization: Circles in the water?](https://discuss.elastic.co/t/geo-vidualization-circles-in-the-water/32930)
**Author:** [@Igor\_Gatis](https://discuss.elastic.co/u/Igor_Gatis)\ **Replies:** 2\ **Last updated:** [October 26, 2015, 3:53pm UTC](https://discuss.elastic.co/t/geo-vidualization-circles-in-the-water/32930 "2015-10-26T15:53:17Z")
The grid handling of geo data produces awkward graphs. The image below shows items in the atlantic ocean. It would be nice if circles were centered in a actual input data point. This would solve the problem in this ca… --- ## [Unable to create backup/snapshot to AWS S3](https://discuss.elastic.co/t/unable-to-create-backup-snapshot-to-aws-s3/29679)
**Author:** [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)\ **Replies:** 2\ **Last updated:** [September 21, 2015, 6:14pm UTC](https://discuss.elastic.co/t/unable-to-create-backup-snapshot-to-aws-s3/29679 "2015-09-21T18:14:05Z")
Hi All, I am trying to take a backup of my elasticsearch but somehow it isn't working. Versions Used:- ES:- 1.5.0 Cloud-AWS:- 2.5.0 Command used(using postman with PUT):- https://url/es/\_snapshot/backup/backup3 … --- ## [No results with term filter/query on unanalyzed field](https://discuss.elastic.co/t/no-results-with-term-filter-query-on-unanalyzed-field/1256)
**Author:** [@Vasco](https://discuss.elastic.co/u/Vasco)\ **Replies:** 2\ **Last updated:** [May 25, 2015, 1:56pm UTC](https://discuss.elastic.co/t/no-results-with-term-filter-query-on-unanalyzed-field/1256 "2015-05-25T13:56:59Z")
I have a non-analyzed field in my index. The field in question has mapping: "ean" : { "index" : "not\_analyzed", "type" : "string" } I verified the mappig is working, i.e., the field isn't analyzed. The record that… --- ## [Pagination using search type Query\_and\_fetch](https://discuss.elastic.co/t/pagination-using-search-type-query-and-fetch/22023)
**Author:** [@Hardik\_Dobariya](https://discuss.elastic.co/u/Hardik_Dobariya)\ **Replies:** 2\ **Last updated:** [February 11, 2015, 5:04am UTC](https://discuss.elastic.co/t/pagination-using-search-type-query-and-fetch/22023 "2015-02-11T05:04:06Z")
According to Elastic search if working with Query\_and\_fetch will return size times number of shards hits.Following this rule I implemented below query using Nest having 5 shards int from = 0; int siz… --- ## [Logstash Enrich and translate plugin use](https://discuss.elastic.co/t/logstash-enrich-and-translate-plugin-use/332897)
**Author:** [@gbandasha](https://discuss.elastic.co/u/gbandasha)\ **Replies:** 6\ **Last updated:** [May 31, 2023, 4:08pm UTC](https://discuss.elastic.co/t/logstash-enrich-and-translate-plugin-use/332897 "2023-05-31T16:08:27Z")
Hello Team, I am trying to enrich the data before it makes its way too elastic, I have tried the below methods but both are currently not working Using the elasticsearch plugin in filter input { kafka { … --- ## [Best way to delete old data from elastic search](https://discuss.elastic.co/t/best-way-to-delete-old-data-from-elastic-search/375958)
**Author:** [@prashanthtg](https://discuss.elastic.co/u/prashanthtg)\ **Replies:** 3\ **Last updated:** [March 16, 2025, 7:51am UTC](https://discuss.elastic.co/t/best-way-to-delete-old-data-from-elastic-search/375958 "2025-03-16T07:51:15Z")
I want to maintain the lifecycle management of an Elasticsearch doc over x days. \_delete\_by\_query api help with the job, however i understand this also comes with some performance impact on query/read on delete of large … [Previous page](https://discuss.elastic.co/top.md?page=1535&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1537&per_page=50&period=all)