# Top **URL:** https://discuss.elastic.co/top.md?page=1537&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1538 --- ## [How does winlogbeat handle different OS languages](https://discuss.elastic.co/t/how-does-winlogbeat-handle-different-os-languages/233437)
**Author:** [@hilo21](https://discuss.elastic.co/u/hilo21)\ **Replies:** 3\ **Last updated:** [June 18, 2020, 11:44pm UTC](https://discuss.elastic.co/t/how-does-winlogbeat-handle-different-os-languages/233437 "2020-06-18T23:44:07Z")
Hello, We use QRadar's wincollect for collecting windows event logs. During the process of windows server integration and since we might have different languages depend on the location (English, spanish or french) we en… --- ## [Aggregate count for the day](https://discuss.elastic.co/t/aggregate-count-for-the-day/229520)
**Author:** [@edvrfn](https://discuss.elastic.co/u/edvrfn)\ **Replies:** 3\ **Last updated:** [April 24, 2020, 3:38pm UTC](https://discuss.elastic.co/t/aggregate-count-for-the-day/229520 "2020-04-24T15:38:12Z")
I created a visualization which works fine for the time period set against KQL search bar. I want to display this visualization on the dashboard which has a refresh cycle of 30 minutes, but this visualization need to sho… --- ## [Missing geo.location](https://discuss.elastic.co/t/missing-geo-location/205595)
**Author:** [@Jan\_Kaspar](https://discuss.elastic.co/u/Jan_Kaspar)\ **Replies:** 3\ **Last updated:** [October 29, 2019, 5:23pm UTC](https://discuss.elastic.co/t/missing-geo-location/205595 "2019-10-29T17:23:06Z")
Hi all, I would like to ask for help. I am parsing data from our firewall and there are fields containing IP address. I would like to use Coordinates map to visualize accesses. Problem is that i am missing geo.location … --- ## [Logstash output index names are coming out incorrectly: %{\[@metadata\]\[beat\]}-%{\[@metadata\]\[version\]}-%{+YYYY.MM.dd}](https://discuss.elastic.co/t/logstash-output-index-names-are-coming-out-incorrectly-metadata-beat-metadata-version-yyyy-mm-dd/197974)
**Author:** [@bpnet](https://discuss.elastic.co/u/bpnet)\ **Replies:** 0\ **Last updated:** [September 4, 2019, 4:31am UTC](https://discuss.elastic.co/t/logstash-output-index-names-are-coming-out-incorrectly-metadata-beat-metadata-version-yyyy-mm-dd/197974 "2019-09-04T04:31:59Z")
ELK stack was on version 6.3 prior to upgrading to 6.8 and then 7.2. Just to preface, I'm not very good with using ELK (I took over a previous sysadmin who set this up), so I can't tell whether there's anything wrong wit… --- ## [Auditbeat and filebeat in same Index](https://discuss.elastic.co/t/auditbeat-and-filebeat-in-same-index/141736)
**Author:** [@Samau4ka](https://discuss.elastic.co/u/Samau4ka)\ **Replies:** 3\ **Last updated:** [July 26, 2018, 2:28pm UTC](https://discuss.elastic.co/t/auditbeat-and-filebeat-in-same-index/141736 "2018-07-26T14:28:23Z")
I want to send Auditbeat and filebeats logs in same index over Logstash. Filebeat is already successfully sending the data. But i dont know how i get Auditbeat logs in the same index because there is no output\_type tag.… --- ## [Document cloning and splitting in Ingest APIs](https://discuss.elastic.co/t/document-cloning-and-splitting-in-ingest-apis/86494)
**Author:** [@nileshgattani](https://discuss.elastic.co/u/nileshgattani)\ **Replies:** 3\ **Last updated:** [May 23, 2017, 7:53am UTC](https://discuss.elastic.co/t/document-cloning-and-splitting-in-ingest-apis/86494 "2017-05-23T07:53:57Z")
Hi there, Do ElasticSearch Ingest APIs support cloning and splitting a document into multiple documents? My usecase is as below - When I receive a document of a certain type, it may have an array field e.g. { " … --- ## [Fielddata: use or not to use](https://discuss.elastic.co/t/fielddata-use-or-not-to-use/71402)
**Author:** [@Gamer](https://discuss.elastic.co/u/Gamer)\ **Replies:** 3\ **Last updated:** [January 17, 2017, 3:15pm UTC](https://discuss.elastic.co/t/fielddata-use-or-not-to-use/71402 "2017-01-17T15:15:50Z")
Hello! Firstly, I had a simple wish to enable the field sorting in Kibana. But as I was reading the docs and how-tos it proved to be a rather difficult choice. I learned that fielddata's needed to be turned on, on top… --- ## [Date AM/PM format - Logstash filter date parse error](https://discuss.elastic.co/t/date-am-pm-format-logstash-filter-date-parse-error/59856)
**Author:** [@hongguan\_chuah](https://discuss.elastic.co/u/hongguan_chuah)\ **Replies:** 0\ **Last updated:** [September 6, 2016, 9:04am UTC](https://discuss.elastic.co/t/date-am-pm-format-logstash-filter-date-parse-error/59856 "2016-09-06T09:04:27Z")
I am having trouble on getting the filter date pattern match with my log file date pattern. I want the date appears as EventDateTime attribute and date would be removed inside message field. Anyone can help me, having … --- ## [Kibana search not working against a specific index pattern](https://discuss.elastic.co/t/kibana-search-not-working-against-a-specific-index-pattern/52258)
**Author:** [@dkota](https://discuss.elastic.co/u/dkota)\ **Replies:** 3\ **Last updated:** [June 9, 2016, 10:45pm UTC](https://discuss.elastic.co/t/kibana-search-not-working-against-a-specific-index-pattern/52258 "2016-06-09T22:45:35Z")
I'm trying to query 'DestinationHostname:uvb\* OR DestinationHostname:cgb\*' . This works against the index pattern abc\* and doesn't work in the pattern adc-def\*. adc-def\* does contain the queried data. Is there a r… --- ## [Logstash 2.2.2 date filter returning wrong day](https://discuss.elastic.co/t/logstash-2-2-2-date-filter-returning-wrong-day/42957)
**Author:** [@Stuart\_Donovan](https://discuss.elastic.co/u/Stuart_Donovan)\ **Replies:** 3\ **Last updated:** [February 28, 2016, 7:01pm UTC](https://discuss.elastic.co/t/logstash-2-2-2-date-filter-returning-wrong-day/42957 "2016-02-28T19:01:17Z")
This works fine with logstash 1.5.6 but with logstash 2.2.2 it sets @timestamp to the previous day?? echo "Mon Feb 22 22:20:41.144" | /opt/logstash/bin/logstash -e ' input { stdin {codec =\> line} } filter { date { ma… --- ## [How to decrease terms\_memory footprint](https://discuss.elastic.co/t/how-to-decrease-terms-memory-footprint/35533)
**Author:** [@rusty](https://discuss.elastic.co/u/rusty)\ **Replies:** 0\ **Last updated:** [November 25, 2015, 9:49am UTC](https://discuss.elastic.co/t/how-to-decrease-terms-memory-footprint/35533 "2015-11-25T09:49:51Z")
Hi! I'm using ES 2.0 to index billions of docs a day (daily indexes for long term usage). The cluster is relatively small (10 data-nodes (heap 30Gb), 3 dedicated masters). Right now I can't increase data-nodes much and l… --- ## [Visualization vertical bar chart](https://discuss.elastic.co/t/visualization-vertical-bar-chart/27998)
**Author:** [@simonrisberg](https://discuss.elastic.co/u/simonrisberg)\ **Replies:** 3\ **Last updated:** [August 27, 2015, 5:53pm UTC](https://discuss.elastic.co/t/visualization-vertical-bar-chart/27998 "2015-08-27T17:53:53Z")
Hello! I was wondering if it's possible to get the count on the X-Axis and the terms on the Y-Axis when it comes to a vertical bar chart in kibana 4? Best regards. --- ## [Can I store the json without creating a mapping](https://discuss.elastic.co/t/can-i-store-the-json-without-creating-a-mapping/251746)
**Author:** [@pkwenda](https://discuss.elastic.co/u/pkwenda)\ **Replies:** 1\ **Last updated:** [October 17, 2020, 1:16am UTC](https://discuss.elastic.co/t/can-i-store-the-json-without-creating-a-mapping/251746 "2020-10-17T01:16:54Z")
now , I save json use nested type , but create many mapping , I'm not going to use the json data for searching, is there a way to store the json without creating a mapping? The json I'm depositing is changing, so it's c… --- ## [Issue with systemd startup and keystore values](https://discuss.elastic.co/t/issue-with-systemd-startup-and-keystore-values/197520)
**Author:** [@stwilliams](https://discuss.elastic.co/u/stwilliams)\ **Replies:** 1\ **Last updated:** [August 30, 2019, 1:23pm UTC](https://discuss.elastic.co/t/issue-with-systemd-startup-and-keystore-values/197520 "2019-08-30T13:23:16Z")
We are rolling out a cluster with security high on the list of targets - so using SSL, authentication etc In our filebeat.yml, we have output.elasticsearch.username = "${ES\_USER}" output.elasticsearch.password = "${ES… --- ## [How do you block bots?](https://discuss.elastic.co/t/how-do-you-block-bots/169853)
**Author:** [@slhuber](https://discuss.elastic.co/u/slhuber)\ **Replies:** 1\ **Last updated:** [March 13, 2019, 8:45pm UTC](https://discuss.elastic.co/t/how-do-you-block-bots/169853 "2019-03-13T20:45:48Z")
We are starting to get a lot of bot hits in our Swiftype search and I was wondering if anyone else has had this issue and what you did to solve it? I don't see any captcha feature available and the volume of this bot tr… --- ## [Encrypting data at rest elastic search](https://discuss.elastic.co/t/encrypting-data-at-rest-elastic-search/133862)
**Author:** [@shaheryar](https://discuss.elastic.co/u/shaheryar)\ **Replies:** 1\ **Last updated:** [May 30, 2018, 1:22pm UTC](https://discuss.elastic.co/t/encrypting-data-at-rest-elastic-search/133862 "2018-05-30T13:22:46Z")
I want to encrypt data at rest. right now i am using elasticsearch-platinum docker image with security feature anabled on aws node. what step do i require to encrypt my data? I am mounting volumes to save my data and lo… --- ## [Es response with field name with dots to bind in hive](https://discuss.elastic.co/t/es-response-with-field-name-with-dots-to-bind-in-hive/127019)
**Author:** [@Suktae\_Choi](https://discuss.elastic.co/u/Suktae_Choi)\ **Replies:** 1\ **Last updated:** [April 6, 2018, 3:11pm UTC](https://discuss.elastic.co/t/es-response-with-field-name-with-dots-to-bind-in-hive/127019 "2018-04-06T15:11:19Z")
I tired to bind this response to hive and got failed. { "took":3068, "timed\_out":false, "\_shards":{ "total":348, "successful":348, "skipped":0, "failed":0 }, "hits":{ … --- ## [Index Sort And Range Queries](https://discuss.elastic.co/t/index-sort-and-range-queries/122136)
**Author:** [@panda2004](https://discuss.elastic.co/u/panda2004)\ **Replies:** 1\ **Last updated:** [March 4, 2018, 7:37am UTC](https://discuss.elastic.co/t/index-sort-and-range-queries/122136 "2018-03-04T07:37:19Z")
Hey there, I have one index for all my data. My document model is as follows: The index is called Products index. Each product document have nested documents (sub-documents) which contain its reviews. Each product ha… --- ## [Bool query x Script filter](https://discuss.elastic.co/t/bool-query-x-script-filter/97198)
**Author:** [@Paulo\_Silva](https://discuss.elastic.co/u/Paulo_Silva)\ **Replies:** 1\ **Last updated:** [August 16, 2017, 1:19pm UTC](https://discuss.elastic.co/t/bool-query-x-script-filter/97198 "2017-08-16T13:19:20Z")
Hi all, I’ve come across with this situation here in my project. By running the following query: GET /unittesttg1\_tg1\_fq1/\_search { "size": 0, "aggs": { "groupby": { "date\_histogram": { "field": "… --- ## [Custom query plugin](https://discuss.elastic.co/t/custom-query-plugin/87006)
**Author:** [@dpupor](https://discuss.elastic.co/u/dpupor)\ **Replies:** 1\ **Last updated:** [May 26, 2017, 7:48am UTC](https://discuss.elastic.co/t/custom-query-plugin/87006 "2017-05-26T07:48:41Z")
I'm upgrading an Elasticsearch plugin from version 2.4.0 to 5.4.0. This plugin implements a custom query but with the new changes on Elasticsearch Java Api I'm a little confused in how to register the new query. I search… --- ## [java.lang.IllegalArgumentException: is too restrictive](https://discuss.elastic.co/t/java-lang-illegalargumentexception-is-too-restrictive/84296)
**Author:** [@asaxty](https://discuss.elastic.co/u/asaxty)\ **Replies:** 1\ **Last updated:** [May 2, 2017, 5:05pm UTC](https://discuss.elastic.co/t/java-lang-illegalargumentexception-is-too-restrictive/84296 "2017-05-02T17:05:27Z")
Hi I am trying to set the following in the elasticsearch.yml file but keep running in what appear to be syntax issues on version 5.3.2 Here's the yml config: action.auto\_create\_index: +-deviceauth-,+-conversation-,+.se… --- ## [Customize kibana to use with node.js](https://discuss.elastic.co/t/customize-kibana-to-use-with-node-js/57793)
**Author:** [@swatisharma113](https://discuss.elastic.co/u/swatisharma113)\ **Replies:** 1\ **Last updated:** [August 11, 2016, 6:09pm UTC](https://discuss.elastic.co/t/customize-kibana-to-use-with-node-js/57793 "2016-08-11T18:09:32Z")
I'm trying to add and run kibana alongside node.js as I need to customize some modules in Kibana. I'm giving ES as datasource in the config file. I have created a node.js project and directly added the kibana source int… --- ## [What happen when logstash kafka input die?](https://discuss.elastic.co/t/what-happen-when-logstash-kafka-input-die/56056)
**Author:** [@xluffy](https://discuss.elastic.co/u/xluffy)\ **Replies:** 1\ **Last updated:** [August 3, 2016, 5:59pm UTC](https://discuss.elastic.co/t/what-happen-when-logstash-kafka-input-die/56056 "2016-08-03T17:59:23Z")
I use logstash for collecting log from Kafka and output to file. My logstash like a consumer. In document of Kafka, i see auto.commit.enable for detect position log when consumer fail. With logstash-input-kafka plugin, i… --- ## [Elasticsearch on YARN problem to identify GLOBAL URI](https://discuss.elastic.co/t/elasticsearch-on-yarn-problem-to-identify-global-uri/41375)
**Author:** [@gaetanofabiano](https://discuss.elastic.co/u/gaetanofabiano)\ **Replies:** 1\ **Last updated:** [February 21, 2016, 6:37pm UTC](https://discuss.elastic.co/t/elasticsearch-on-yarn-problem-to-identify-global-uri/41375 "2016-02-21T18:37:36Z")
Dear All, I'm new on elastic search, so I'm sorry in advance if I'm doing some concectual error. Following this guide https://www.elastic.co/guide/en/elasticsearch/hadoop/current/ey-usage.html I installed and configure… --- ## [Beat-xpack module doesn’t work on localhost 5066 port](https://discuss.elastic.co/t/beat-xpack-module-doesn-t-work-on-localhost-5066-port/334909)
**Author:** [@PodarcisMuralis](https://discuss.elastic.co/u/PodarcisMuralis)\ **Replies:** 6\ **Last updated:** [June 22, 2023, 11:41am UTC](https://discuss.elastic.co/t/beat-xpack-module-doesn-t-work-on-localhost-5066-port/334909 "2023-06-22T11:41:11Z")
Hello, I am trying to use Beat Module for monitoring Metricbeat on Kibana-Stack Monitoring. I am using this in metricbeat.yml - module: beat xpack.enabled: true period: 10s hosts: \[ "http://localhost:5066… --- ## [Question about ILM](https://discuss.elastic.co/t/question-about-ilm/249234)
**Author:** [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Replies:** 6\ **Last updated:** [September 21, 2020, 9:17am UTC](https://discuss.elastic.co/t/question-about-ilm/249234 "2020-09-21T09:17:17Z")
Hi, I'm using a custom index in my filebeat so I had to disable ilm in elasticsearch. My question is if there is a automatic solution to delete indices older than 3 months when ilm is diabled? or maybe have a hot-cold … --- ## [Any way to maintain a long list of hearbeat.monitors.urls?](https://discuss.elastic.co/t/any-way-to-maintain-a-long-list-of-hearbeat-monitors-urls/236906)
**Author:** [@zongzw](https://discuss.elastic.co/u/zongzw)\ **Replies:** 6\ **Last updated:** [June 20, 2020, 2:32pm UTC](https://discuss.elastic.co/t/any-way-to-maintain-a-long-list-of-hearbeat-monitors-urls/236906 "2020-06-20T14:32:38Z")
Hi, My list in heartbeat.monitors.urls is long, is there any way to maintain it in a separate file. I mean I want to it to be: heartbeat.yml: # Configure monitors inline heartbeat.monitors: - type: http # List or … --- ## [Watcher for specific field in ML Job](https://discuss.elastic.co/t/watcher-for-specific-field-in-ml-job/231852)
**Author:** [@vdelcampo](https://discuss.elastic.co/u/vdelcampo)\ **Replies:** 6\ **Last updated:** [May 11, 2020, 8:44am UTC](https://discuss.elastic.co/t/watcher-for-specific-field-in-ml-job/231852 "2020-05-11T08:44:23Z")
Hi. Im monitoring all traffic that comes from my Big Ip F5 Load Balancer. I have an index with all this information and a ml job with a count function and a detector using two fields (virtual\_ip.keyword over http\_path.k… --- ## [Use logstash mapping for all future indicies](https://discuss.elastic.co/t/use-logstash-mapping-for-all-future-indicies/118533)
**Author:** [@motts](https://discuss.elastic.co/u/motts)\ **Replies:** 6\ **Last updated:** [February 7, 2018, 3:13pm UTC](https://discuss.elastic.co/t/use-logstash-mapping-for-all-future-indicies/118533 "2018-02-07T15:13:01Z")
Hello there, Is there a way to assign the mapping for the logstash index to all future indices created? I can create indices super easy, but having to define each field is a little time consuming, and so far, I have fou… --- ## [Inconsistent Aggs When Using Nested Docs](https://discuss.elastic.co/t/inconsistent-aggs-when-using-nested-docs/76519)
**Author:** [@neoform](https://discuss.elastic.co/u/neoform)\ **Replies:** 6\ **Last updated:** [March 1, 2017, 4:55am UTC](https://discuss.elastic.co/t/inconsistent-aggs-when-using-nested-docs/76519 "2017-03-01T04:55:38Z")
Elasticsearch version: 5.2.1 JVM version: 1.8.0\_121 OS version: Debian 8 I'm using a single shard index (no replicas). For some reason my query's aggs are giving me numbers that are either exactly correct, or gre… --- ## [Elasticsearch on-premise (docker) is not loading: "Can't reach this page"](https://discuss.elastic.co/t/elasticsearch-on-premise-docker-is-not-loading-cant-reach-this-page/360340)
**Author:** [@zbeedatm](https://discuss.elastic.co/u/zbeedatm)\ **Replies:** 4\ **Last updated:** [May 29, 2024, 1:29pm UTC](https://discuss.elastic.co/t/elasticsearch-on-premise-docker-is-not-loading-cant-reach-this-page/360340 "2024-05-29T13:29:06Z")
I'm trying to run elasticsearch locally, so I had installed docker then deployed elasticsearch image. But I'm getting" "Cannot reach this page" when loading it. (the docker itself is running, but the web interface is no… --- ## [Download Windows Agent from source artifacts.elastic.co](https://discuss.elastic.co/t/download-windows-agent-from-source-artifacts-elastic-co/348654)
**Author:** [@Tybe\_sacha](https://discuss.elastic.co/u/Tybe_sacha)\ **Replies:** 4\ **Last updated:** [December 6, 2023, 2:00pm UTC](https://discuss.elastic.co/t/download-windows-agent-from-source-artifacts-elastic-co/348654 "2023-12-06T14:00:04Z")
Hi, I'm trying to install the Fleet Server and Windows Agent. Here is text I paste : $ProgressPreference = 'SilentlyContinue' Invoke-WebRequest -Uri https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-ag… --- ## [Index Date Math with seconds](https://discuss.elastic.co/t/index-date-math-with-seconds/276161)
**Author:** [@dimitris\_sb](https://discuss.elastic.co/u/dimitris_sb)\ **Replies:** 4\ **Last updated:** [June 17, 2021, 12:48pm UTC](https://discuss.elastic.co/t/index-date-math-with-seconds/276161 "2021-06-17T12:48:59Z")
Hi All, When I try to create an index using date math expression PUT /%3Cdata-index-%7Bnow%2Fm%7Byyyy-MM-dd-HH-mm-ss%7D%7D%3E which produces an index as data-index-2021-06-16-12-41-00 Why seconds are always 00 (if yo… --- ## [Same ES cluster for non prod environments (for both dev and qa)](https://discuss.elastic.co/t/same-es-cluster-for-non-prod-environments-for-both-dev-and-qa/253937)
**Author:** [@kcs08](https://discuss.elastic.co/u/kcs08)\ **Replies:** 4\ **Last updated:** [November 4, 2020, 5:33am UTC](https://discuss.elastic.co/t/same-es-cluster-for-non-prod-environments-for-both-dev-and-qa/253937 "2020-11-04T05:33:19Z")
Hello, I have setup Elasticsearch (ES) cluster and using it for dev environment with set of indexes. And wanted to use the same ES cluster for qa environment as well. I mean two different environments with same index na… --- ## [Types dans un index](https://discuss.elastic.co/t/types-dans-un-index/111800)
**Author:** [@lfourny](https://discuss.elastic.co/u/lfourny)\ **Replies:** 4\ **Last updated:** [December 14, 2017, 5:44pm UTC](https://discuss.elastic.co/t/types-dans-un-index/111800 "2017-12-14T17:44:45Z")
Bonjour, je vais prochainement indéxer des données de log venant de machine dans un index ES. je vais avoir 2 type de log : des logs d'erreurs des logs d'actvité Dans la logique Es je compte utiliser les types pour … --- ## [Parse custom Apache2 log](https://discuss.elastic.co/t/parse-custom-apache2-log/55736)
**Author:** [@massinissa](https://discuss.elastic.co/u/massinissa)\ **Replies:** 4\ **Last updated:** [July 18, 2016, 4:20pm UTC](https://discuss.elastic.co/t/parse-custom-apache2-log/55736 "2016-07-18T16:20:20Z")
Hello, i have an Apache log like this: 443 84.14.49.234 - - \[04/Jul/2016:10:11:32 +0200\] "GET /ws/1/kpi HTTP/1.1" 200 63 "-" "Mozilla/5.0 (iPhone; CPU \*\*iPhone OS 8\_1\_3\*\* like Mac OS X) AppleWebKit/600.1.4 (KHTML, like… --- ## [The Output Isolator Pattern: Inquiry regarding downstream pipeline failures](https://discuss.elastic.co/t/the-output-isolator-pattern-inquiry-regarding-downstream-pipeline-failures/347878)
**Author:** [@Kihyun\_Hwang](https://discuss.elastic.co/u/Kihyun_Hwang)\ **Replies:** 2\ **Last updated:** [November 23, 2023, 5:14pm UTC](https://discuss.elastic.co/t/the-output-isolator-pattern-inquiry-regarding-downstream-pipeline-failures/347878 "2023-11-23T17:14:12Z")
I have applied the Output Isolator pattern to send logs to two ES clusters. However, as mentioned in the reference: "If any of the persistent queues of the downstream pipelines (in the example above, buffered-es and bu… --- ## [Slow queries during users peak](https://discuss.elastic.co/t/slow-queries-during-users-peak/137127)
**Author:** [@Nerijus\_Oftas](https://discuss.elastic.co/u/Nerijus_Oftas)\ **Replies:** 8\ **Last updated:** [June 29, 2018, 2:42pm UTC](https://discuss.elastic.co/t/slow-queries-during-users-peak/137127 "2018-06-29T14:42:10Z")
Hi, We have project with a lot of users in website. All site information we store in elaticsearch in AWS i3.8xlarge.elasticsearch 8 instances. We have one index and in this index 7 types. Total documents count is 80mill… --- ## [XML filter issue](https://discuss.elastic.co/t/xml-filter-issue/124012)
**Author:** [@arisbanach](https://discuss.elastic.co/u/arisbanach)\ **Replies:** 8\ **Last updated:** [March 15, 2018, 5:46pm UTC](https://discuss.elastic.co/t/xml-filter-issue/124012 "2018-03-15T17:46:09Z")
I am getting started with the XML filter plugin. Here is my config: filter { xml { source =\> "message" store\_xml =\> false } } Ideally I want to have Logstash just convert the XML to JSON (ie. convert all th… --- ## [Editing a managed policy can break Kibana](https://discuss.elastic.co/t/editing-a-managed-policy-can-break-kibana/347828)
**Author:** [@DaddyYusk](https://discuss.elastic.co/u/DaddyYusk)\ **Replies:** 2\ **Last updated:** [November 23, 2023, 1:19pm UTC](https://discuss.elastic.co/t/editing-a-managed-policy-can-break-kibana/347828 "2023-11-23T13:19:57Z")
Hi, After a successful Fleet Server and Elastic Agent deployment, I wanted to tweak the ILM called "logs" and "metrics" which are both "Managed". But when trying to do so, I encounter this well known warning : So af… --- ## [Convert DateTime to integer](https://discuss.elastic.co/t/convert-datetime-to-integer/257924)
**Author:** [@Treki](https://discuss.elastic.co/u/Treki)\ **Replies:** 2\ **Last updated:** [December 8, 2020, 2:15pm UTC](https://discuss.elastic.co/t/convert-datetime-to-integer/257924 "2020-12-08T14:15:05Z")
Hello, we have strings in the format "2020-11-10T12:43:58" saved in Kibana. When using ES SQL, we want to convert these strings into an integer or float so that the integer/float increases as the DateTime increases as … --- ## [Visualizing a metric on two unique counts](https://discuss.elastic.co/t/visualizing-a-metric-on-two-unique-counts/249562)
**Author:** [@jwetzel](https://discuss.elastic.co/u/jwetzel)\ **Replies:** 2\ **Last updated:** [September 23, 2020, 1:49pm UTC](https://discuss.elastic.co/t/visualizing-a-metric-on-two-unique-counts/249562 "2020-09-23T13:49:05Z")
I am collecting custom logs from a web server. I am trying to summarize what % of unique users encounter an error. I am having trouble finding a visualization that will do a % calculation on two unique (cardinatily) valu… --- ## [Add new field data using Regex](https://discuss.elastic.co/t/add-new-field-data-using-regex/231205)
**Author:** [@JeremyP](https://discuss.elastic.co/u/JeremyP)\ **Replies:** 2\ **Last updated:** [May 7, 2020, 1:26am UTC](https://discuss.elastic.co/t/add-new-field-data-using-regex/231205 "2020-05-07T01:26:54Z")
Hello, I'm trying to do something rather simple by extracting a Microsoft KB from a string (in my case, the summary field), and adding it to a new field called "patch". I have the regex, just not sure what filter to use… --- ## [Parse json with mapper\_parsing\_exception](https://discuss.elastic.co/t/parse-json-with-mapper-parsing-exception/196344)
**Author:** [@thwint](https://discuss.elastic.co/u/thwint)\ **Replies:** 2\ **Last updated:** [August 23, 2019, 9:26am UTC](https://discuss.elastic.co/t/parse-json-with-mapper-parsing-exception/196344 "2019-08-23T09:26:19Z")
Hello, We are indexing and parsing logfiles containing JSON requests (one per line). We have multiple, completely different request. Most of them can be indexed without any problems. But we have some requests which incl… --- ## [Logstash doesn't receive packetbeat logs](https://discuss.elastic.co/t/logstash-doesnt-receive-packetbeat-logs/179548)
**Author:** [@Robin020](https://discuss.elastic.co/u/Robin020)\ **Replies:** 2\ **Last updated:** [May 3, 2019, 3:47pm UTC](https://discuss.elastic.co/t/logstash-doesnt-receive-packetbeat-logs/179548 "2019-05-03T15:47:38Z")
Hello, I have the following set up: server1 is running packetbeat. In packetbeat.yml i have configure output to my logstash node. server2 is running logstash and elasticsearch. There is were I want to send all my dat… --- ## [Parsing nested JSON with dynamic key](https://discuss.elastic.co/t/parsing-nested-json-with-dynamic-key/173110)
**Author:** [@mdobrin](https://discuss.elastic.co/u/mdobrin)\ **Replies:** 2\ **Last updated:** [March 22, 2019, 2:11am UTC](https://discuss.elastic.co/t/parsing-nested-json-with-dynamic-key/173110 "2019-03-22T02:11:55Z")
Given the following JSON, I would like to be able to extract the genreId. However, I am not sure how to do so with nested dynamic keys (in the example below, "610015") { "b\_shopId": 502192, "body": { "delivery": { … --- ## [Ruby plugin remove \\ from a string](https://discuss.elastic.co/t/ruby-plugin-remove-from-a-string/104792)
**Author:** [@yoavsradware](https://discuss.elastic.co/u/yoavsradware)\ **Replies:** 2\ **Last updated:** [October 23, 2017, 8:11am UTC](https://discuss.elastic.co/t/ruby-plugin-remove-from-a-string/104792 "2017-10-23T08:11:29Z")
hey , I am using the logstash ruby plugin I am trying to create new json : ruby { init =\> "require 'json'" code =\> " bandwidth = event.get('bandwidth') puts bandwidth\[0\]\['count64'\] foo = … --- ## [Saving a value to a field of a different field type e.g. string to integer doesn't throw an exception?](https://discuss.elastic.co/t/saving-a-value-to-a-field-of-a-different-field-type-e-g-string-to-integer-doesnt-throw-an-exception/77051)
**Author:** [@troy](https://discuss.elastic.co/u/troy)\ **Replies:** 2\ **Last updated:** [March 2, 2017, 10:41am UTC](https://discuss.elastic.co/t/saving-a-value-to-a-field-of-a-different-field-type-e-g-string-to-integer-doesnt-throw-an-exception/77051 "2017-03-02T10:41:40Z")
If I configure a field to be a certain type, for example, an integer, I'm not sure why I can then save a string value to that field? I expect code like this to throw an error: curl -XPUT 'localhost:9200/my\_index?pretty… --- ## [How to create my own D3 chart in kibana v4.1](https://discuss.elastic.co/t/how-to-create-my-own-d3-chart-in-kibana-v4-1/54806)
**Author:** [@BendMoly](https://discuss.elastic.co/u/BendMoly)\ **Replies:** 2\ **Last updated:** [August 2, 2016, 3:45am UTC](https://discuss.elastic.co/t/how-to-create-my-own-d3-chart-in-kibana-v4-1/54806 "2016-08-02T03:45:47Z")
Hi everyone, I heard that users can use plug-ins to develop their own charts, so I would like to ask how to develop more charts in their own projects. I know some of the basic D3 syntax, but for how to use in the pro… --- ## [Reindex performence](https://discuss.elastic.co/t/reindex-performence/43846)
**Author:** [@lizhenmxcz](https://discuss.elastic.co/u/lizhenmxcz)\ **Replies:** 2\ **Last updated:** [March 9, 2016, 2:25am UTC](https://discuss.elastic.co/t/reindex-performence/43846 "2016-03-09T02:25:27Z")
hi, I changed the index mapping and need to reindex. There are about 7 billion records and 2T in disk. I try to use the elasticdump, but it is too slowly. Can i copy the old index data to the corresponding directory of … [Previous page](https://discuss.elastic.co/top.md?page=1536&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1538&per_page=50&period=all)