# Top **URL:** https://discuss.elastic.co/top.md?page=1553&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1554 --- ## [Performance issue on single node instance](https://discuss.elastic.co/t/performance-issue-on-single-node-instance/78998)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 1\ **Last updated:** [March 20, 2017, 9:31am UTC](https://discuss.elastic.co/t/performance-issue-on-single-node-instance/78998 "2017-03-20T09:31:36Z")
Hi, my kibana is quite slow. Coming from kibana 3, it seems to be faster than the new one. We have a single node instance, 9 CPU 24GB RAM. Running Logstash, ELK and Kibana on the same machine. sporadically but quite of… --- ## [Format Output of ElasticSearch](https://discuss.elastic.co/t/format-output-of-elasticsearch/78650)
**Author:** [@sam99](https://discuss.elastic.co/u/sam99)\ **Replies:** 1\ **Last updated:** [March 16, 2017, 7:55am UTC](https://discuss.elastic.co/t/format-output-of-elasticsearch/78650 "2017-03-16T07:55:32Z")
How can I tell ElasticSearch (ES) to return specific items in results? Consider the example below. I need only the fields object (in second part) and do not want to see all others (in first part) \_"total" : 2,\_ "max\_sc… --- ## [Can't configure multiple indices on which to run a benchmarkin RALLY](https://discuss.elastic.co/t/cant-configure-multiple-indices-on-which-to-run-a-benchmarkin-rally/70281)
**Author:** [@Thomas\_Louis](https://discuss.elastic.co/u/Thomas_Louis)\ **Replies:** 1\ **Last updated:** [January 3, 2017, 12:08pm UTC](https://discuss.elastic.co/t/cant-configure-multiple-indices-on-which-to-run-a-benchmarkin-rally/70281 "2017-01-03T12:08:02Z")
Hello, I try to create a track that works on one index but fails with several indices : "meta": { "short-description": "...", "description" : "..." }, "indices": \[ { "name": "sa\_2016\_01\_1", … --- ## [NEST documentation for .NET](https://discuss.elastic.co/t/nest-documentation-for-net/45242)
**Author:** [@Norman\_Daley](https://discuss.elastic.co/u/Norman_Daley)\ **Replies:** 1\ **Last updated:** [April 4, 2016, 8:30am UTC](https://discuss.elastic.co/t/nest-documentation-for-net/45242 "2016-04-04T08:30:03Z")
I'm attempting to learn the ElasticSearch API using NEST but I've discovered that there is no up-to-date documentation for the NEST (2.0?). The ConnectionSettings class for instance, appears to no longer have a construc… --- ## [Aggregation and sub-aggregation using an array of strings](https://discuss.elastic.co/t/aggregation-and-sub-aggregation-using-an-array-of-strings/33302)
**Author:** [@abierbaum](https://discuss.elastic.co/u/abierbaum)\ **Replies:** 1\ **Last updated:** [November 5, 2015, 5:10am UTC](https://discuss.elastic.co/t/aggregation-and-sub-aggregation-using-an-array-of-strings/33302 "2015-11-05T05:10:31Z")
I have a string field that is a dot separated name representing a hierarchy in my logging. ex ("top\_level.next\_level.more"). I would like to do a visualization where I can see the relative size of multiple parts of the… --- ## [How to start Fscrawler after downloading its Zip file](https://discuss.elastic.co/t/how-to-start-fscrawler-after-downloading-its-zip-file/240584)
**Author:** [@Deepika\_Rawat](https://discuss.elastic.co/u/Deepika_Rawat)\ **Replies:** 6\ **Last updated:** [July 10, 2020, 9:00am UTC](https://discuss.elastic.co/t/how-to-start-fscrawler-after-downloading-its-zip-file/240584 "2020-07-10T09:00:29Z")
I want to read a PDF file through Fscrawler but i just dont know how to start it after downloading it was written that start with bin command but when i explore the folder there was no bin folder List item spacesbeans… --- ## [Weakly repetitive pattern and real-time alert](https://discuss.elastic.co/t/weakly-repetitive-pattern-and-real-time-alert/129190)
**Author:** [@rbeg](https://discuss.elastic.co/u/rbeg)\ **Replies:** 6\ **Last updated:** [April 24, 2018, 1:48am UTC](https://discuss.elastic.co/t/weakly-repetitive-pattern-and-real-time-alert/129190 "2018-04-24T01:48:01Z")
Hello, I have Weekly repetitive pattern. Each Monday, Tuesday, Wednesday, Thursday and Friday, pattern is sensibly the same : count data is growing at 8am, decrease at 12, growing at 2 pm and finally decrease at 6pm. d… --- ## [I use the SLM policy, and the start time of the snapshot is inconsistent with the scheduled time](https://discuss.elastic.co/t/i-use-the-slm-policy-and-the-start-time-of-the-snapshot-is-inconsistent-with-the-scheduled-time/325082)
**Author:** [@lijianzhi](https://discuss.elastic.co/u/lijianzhi)\ **Replies:** 8\ **Last updated:** [February 10, 2023, 8:59am UTC](https://discuss.elastic.co/t/i-use-the-slm-policy-and-the-start-time-of-the-snapshot-is-inconsistent-with-the-scheduled-time/325082 "2023-02-10T08:59:49Z")
I use slm policy to create a snapshot policy plan 0 0 \* \* \*?, The next plan is 12:00, but the actual start time of the snapshot is 11:59:59, one second ahead of schedule. Or 12:00:01, delay 1 second. There are three repl… --- ## [Dynamic mapping](https://discuss.elastic.co/t/dynamic-mapping/316475)
**Author:** [@cool999](https://discuss.elastic.co/u/cool999)\ **Replies:** 8\ **Last updated:** [October 17, 2022, 2:48pm UTC](https://discuss.elastic.co/t/dynamic-mapping/316475 "2022-10-17T14:48:04Z")
Hi Team, I am trying to understand if we can partially customize elasticsearch's dynamic mapping i.e for some of the fields we will set the data type explicitely and all the remaining fields (which are not mentioned exp… --- ## [Logstash Parsing File (Without Filebeat)](https://discuss.elastic.co/t/logstash-parsing-file-without-filebeat/216160)
**Author:** [@ellje](https://discuss.elastic.co/u/ellje)\ **Replies:** 8\ **Last updated:** [January 24, 2020, 12:34am UTC](https://discuss.elastic.co/t/logstash-parsing-file-without-filebeat/216160 "2020-01-24T00:34:22Z")
Trying to simply have logstash parse a file. I've checked that the file input path is correct, and when I tail the logtash log file, there is no update/activity. Is there anything else that I can check to ensure that it'… --- ## [Is it possible to use variables in indexed documents in elasticsearch?](https://discuss.elastic.co/t/is-it-possible-to-use-variables-in-indexed-documents-in-elasticsearch/135736)
**Author:** [@rs123](https://discuss.elastic.co/u/rs123)\ **Replies:** 8\ **Last updated:** [June 22, 2018, 5:38am UTC](https://discuss.elastic.co/t/is-it-possible-to-use-variables-in-indexed-documents-in-elasticsearch/135736 "2018-06-22T05:38:26Z")
Is it possible to use variables in indexed documents in elasticsearch? POST somki/\_doc/ { "suggest": { "input": \["my name is x"\] } } } I want to have x as variable so that when someone search so… --- ## [2 nodes instead of one](https://discuss.elastic.co/t/2-nodes-instead-of-one/17441)
**Author:** [@Patrick\_Proniewski](https://discuss.elastic.co/u/Patrick_Proniewski)\ **Replies:** 8\ **Last updated:** [May 10, 2014, 10:26am UTC](https://discuss.elastic.co/t/2-nodes-instead-of-one/17441 "2014-05-10T10:26:22Z")
Hello, I've noticed that my quite simple ES install (+ Logstash) has 2 nodes running, but I configured only one. Is this a normal behavior? And its health is "yellow", as a consequence I guess of this second uninvit… --- ## [.NET 6 APM with Serilog throws exception inside Elastic.CommonSchema.Serilog](https://discuss.elastic.co/t/net-6-apm-with-serilog-throws-exception-inside-elastic-commonschema-serilog/339410)
**Author:** [@guisantos](https://discuss.elastic.co/u/guisantos)\ **Replies:** 2\ **Last updated:** [August 2, 2023, 9:29am UTC](https://discuss.elastic.co/t/net-6-apm-with-serilog-throws-exception-inside-elastic-commonschema-serilog/339410 "2023-08-02T09:29:19Z")
Kibana version: v8.9.0 Elasticsearch version: v8.9.0 APM Server version: v8.9.0 APM Agent language and version: .NET Core - Elastic.Apm.NetCoreAll v. 1.22.0 Original install method (e.g. download page, yum, deb, … --- ## [When outputting from logstash to elasticsearch, some data is missing](https://discuss.elastic.co/t/when-outputting-from-logstash-to-elasticsearch-some-data-is-missing/307820)
**Author:** [@sbyunnn](https://discuss.elastic.co/u/sbyunnn)\ **Replies:** 2\ **Last updated:** [June 23, 2022, 4:59am UTC](https://discuss.elastic.co/t/when-outputting-from-logstash-to-elasticsearch-some-data-is-missing/307820 "2022-06-23T04:59:21Z")
Hi, I am building ELK Stack The output of my logstash is Elasticsearch but, some data is missing in ES However, some data is missing from ES. After removing all indexes, I can see missed data. but, the other data mis… --- ## [Events coming into Log Stream but not Kibana Discover](https://discuss.elastic.co/t/events-coming-into-log-stream-but-not-kibana-discover/253082)
**Author:** [@allieg](https://discuss.elastic.co/u/allieg)\ **Replies:** 2\ **Last updated:** [October 23, 2020, 5:50pm UTC](https://discuss.elastic.co/t/events-coming-into-log-stream-but-not-kibana-discover/253082 "2020-10-23T17:50:52Z")
Hi, Basically what the title of this post says. I can see various events coming into the Log under the Observability tab: However, when I go to the Discover tab, nothing is showing up: Since we can assume Filebe… --- ## [Detections is adding 20-30 minutes to my @timestamp](https://discuss.elastic.co/t/detections-is-adding-20-30-minutes-to-my-timestamp/252401)
**Author:** [@Junebee](https://discuss.elastic.co/u/Junebee)\ **Replies:** 2\ **Last updated:** [October 22, 2020, 12:53pm UTC](https://discuss.elastic.co/t/detections-is-adding-20-30-minutes-to-my-timestamp/252401 "2020-10-22T12:53:01Z")
I am a long time user of ELK and recently switched to 7.9 to experiment with Security and SIEM functions. After much trouble shooting to get my test Detection to show up in the "Detection Alerts" area, I discovered by … --- ## [Is there any way to jump to the linked url when the data is clicked in vega-lite?](https://discuss.elastic.co/t/is-there-any-way-to-jump-to-the-linked-url-when-the-data-is-clicked-in-vega-lite/239605)
**Author:** [@c5101010](https://discuss.elastic.co/u/c5101010)\ **Replies:** 2\ **Last updated:** [July 12, 2020, 12:07am UTC](https://discuss.elastic.co/t/is-there-any-way-to-jump-to-the-linked-url-when-the-data-is-clicked-in-vega-lite/239605 "2020-07-12T00:07:38Z")
Hi, I want to do I wrote my vega code as follows. However, I can not jump to the linked URL when I clicked the scatter plot. I would appreciate it if you could give me a hint to solve this. { $schema: ht… --- ## [6.5.0 - Filters not showing new data](https://discuss.elastic.co/t/6-5-0-filters-not-showing-new-data/159630)
**Author:** [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Replies:** 2\ **Last updated:** [December 6, 2018, 11:38am UTC](https://discuss.elastic.co/t/6-5-0-filters-not-showing-new-data/159630 "2018-12-06T11:38:58Z")
Hi, I'm noticing that after ingesting new data, that data does not show up when I add any filters or some something like the drop down control viz. The data is ingested as it shows up in Discovery and manually adding t… --- ## [Filebeat sending multiple lines as one event](https://discuss.elastic.co/t/filebeat-sending-multiple-lines-as-one-event/153738)
**Author:** [@CyberSeppi](https://discuss.elastic.co/u/CyberSeppi)\ **Replies:** 2\ **Last updated:** [October 24, 2018, 8:03am UTC](https://discuss.elastic.co/t/filebeat-sending-multiple-lines-as-one-event/153738 "2018-10-24T08:03:13Z")
Hi there, I´m sending apache access logs to elasticsearch using filebeat -\> logstash. The configuration is like that filebeat.yml filebeat.prospectors: filebeat.config.inputs: enabled: true path: conf.d/\*.yml re… --- ## [Curator problem](https://discuss.elastic.co/t/curator-problem/123276)
**Author:** [@jof300](https://discuss.elastic.co/u/jof300)\ **Replies:** 2\ **Last updated:** [March 15, 2018, 1:42pm UTC](https://discuss.elastic.co/t/curator-problem/123276 "2018-03-15T13:42:28Z")
Hello, I have just installed curator 5.4 (elasticsearch-curator-5.4.1-1.x86\_64.rpm) but I can't launch anything. I created simple config file below : Remember, leave a key empty if there is no value. None will be a s… --- ## [Drop out rate of an A/B test](https://discuss.elastic.co/t/drop-out-rate-of-an-a-b-test/53228)
**Author:** [@richard.kang](https://discuss.elastic.co/u/richard.kang)\ **Replies:** 2\ **Last updated:** [June 20, 2016, 7:07pm UTC](https://discuss.elastic.co/t/drop-out-rate-of-an-a-b-test/53228 "2016-06-20T19:07:11Z")
We are conducting an A/B testing of an web app, and in the logs we shows who is using the new page B, and who has decided to switch back to the old page A. How do I construct a search in Kibana to find out the drop out… --- ## [Lots of Blank Values](https://discuss.elastic.co/t/lots-of-blank-values/41027)
**Author:** [@gringo](https://discuss.elastic.co/u/gringo)\ **Replies:** 2\ **Last updated:** [February 11, 2016, 12:50am UTC](https://discuss.elastic.co/t/lots-of-blank-values/41027 "2016-02-11T00:50:19Z")
I have followed the steps in https://www.elastic.co/guide/en/beats/topbeat/current/topbeat-getting-started.html http://www.elastic.co/guide/en/beats/libbeat/1.1/getting-started.html#load-kibana-dashboards There seems … --- ## [Accéder aux données indexer dans elasticsearch](https://discuss.elastic.co/t/acceder-aux-donnees-indexer-dans-elasticsearch/1319)
**Author:** [@Sofi](https://discuss.elastic.co/u/Sofi)\ **Replies:** 2\ **Last updated:** [May 27, 2015, 9:53am UTC](https://discuss.elastic.co/t/acceder-aux-donnees-indexer-dans-elasticsearch/1319 "2015-05-27T09:53:38Z")
Bonjour, J'ai indexée des données à partir d'une base de données postgres dans elasticsearch et je souhaite maintenant afficher ces données dans une application web (au lieu de kibana) donc une application JEE, comment… --- ## [Average on keyword of a nested object in Kibana Lens?](https://discuss.elastic.co/t/average-on-keyword-of-a-nested-object-in-kibana-lens/324716)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 4\ **Last updated:** [February 5, 2023, 1:51am UTC](https://discuss.elastic.co/t/average-on-keyword-of-a-nested-object-in-kibana-lens/324716 "2023-02-05T01:51:57Z")
I'm working with Kibana Lens and I don't understand the results I'm getting. I started by running these commands in Dev Tools on a completely empty index called avg1 POST avg1/\_doc { "order\_items": \[ {"product":… --- ## [Log Flow/Stream](https://discuss.elastic.co/t/log-flow-stream/303605)
**Author:** [@Bo-Wyatt](https://discuss.elastic.co/u/Bo-Wyatt)\ **Replies:** 4\ **Last updated:** [May 6, 2022, 1:35pm UTC](https://discuss.elastic.co/t/log-flow-stream/303605 "2022-05-06T13:35:58Z")
Hello, I want to display a visualization of my log stream on my Dashboard. I only have a data view/index pattern matching my Index. I'm currently using a table but I can only show up to 1000 records (and it's represented… --- ## [Enterprise search takes forever in startup and rejects all the incoming requests](https://discuss.elastic.co/t/enterprise-search-takes-forever-in-startup-and-rejects-all-the-incoming-requests/282395)
**Author:** [@gpribi](https://discuss.elastic.co/u/gpribi)\ **Replies:** 4\ **Last updated:** [September 2, 2021, 10:23pm UTC](https://discuss.elastic.co/t/enterprise-search-takes-forever-in-startup-and-rejects-all-the-incoming-requests/282395 "2021-09-02T22:23:49Z")
Hello, I'm having a problem regarding my on-premise docker ELK stack of both elastic and enterprise search version 7.14.0. When I start up my containers, elasticsearch goes up quickly, but enterprise search takes foreve… --- ## [Elasticsearch watcher cannot to connect smtp host](https://discuss.elastic.co/t/elasticsearch-watcher-cannot-to-connect-smtp-host/173873)
**Author:** [@ZMMWMY](https://discuss.elastic.co/u/ZMMWMY)\ **Replies:** 4\ **Last updated:** [April 1, 2019, 7:11am UTC](https://discuss.elastic.co/t/elasticsearch-watcher-cannot-to-connect-smtp-host/173873 "2019-04-01T07:11:16Z")
i am using es 6.2.3 and i have configured watcher ,set up email configuration in elasticsearch.yml xpack.notification.email: default\_account: smtp\_account account: smtp\_account: profile: standard smtp: … --- ## [Elasticsearch v5.0.2 (master eligible) nodes as Docker container keeps on restarting](https://discuss.elastic.co/t/elasticsearch-v5-0-2-master-eligible-nodes-as-docker-container-keeps-on-restarting/126251)
**Author:** [@bintut](https://discuss.elastic.co/u/bintut)\ **Replies:** 4\ **Last updated:** [March 30, 2018, 3:48pm UTC](https://discuss.elastic.co/t/elasticsearch-v5-0-2-master-eligible-nodes-as-docker-container-keeps-on-restarting/126251 "2018-03-30T15:48:33Z")
Hi all, Pardon me if my issue has been answered somewhere or is not the right place to ask. This is my first post to this forum. I built a custom Docker image based on RHEL v7.x using the Elasticsearch v5.0.2 RPM from … --- ## [Periodically indexing SQL data to ES using Logstash](https://discuss.elastic.co/t/periodically-indexing-sql-data-to-es-using-logstash/103335)
**Author:** [@Mohammed\_Sanaulla](https://discuss.elastic.co/u/Mohammed_Sanaulla)\ **Replies:** 4\ **Last updated:** [October 11, 2017, 5:44am UTC](https://discuss.elastic.co/t/periodically-indexing-sql-data-to-es-using-logstash/103335 "2017-10-11T05:44:34Z")
We want to index data from SQL into ES using Logstash. The data indexed in ES will be a nested object and the nested object has to be constructed by combining data from multiple rows i.e grouping based on some common val… --- ## [Mappings are "not\_analyzed" Can it be set with manage\_template](https://discuss.elastic.co/t/mappings-are-not-analyzed-can-it-be-set-with-manage-template/60172)
**Author:** [@Tyler\_Siemers](https://discuss.elastic.co/u/Tyler_Siemers)\ **Replies:** 4\ **Last updated:** [September 12, 2016, 4:46pm UTC](https://discuss.elastic.co/t/mappings-are-not-analyzed-can-it-be-set-with-manage-template/60172 "2016-09-12T16:46:32Z")
I am importing logs from FireSight(cisco) into Logstash and outputting to Elasticsearch. Here is my conf file from Logstash. input { udp { port =\> 5545 type =\> "firesight" } } filter { grok { patterns\_dir =\> … --- ## [Bug found for kibana 4.5.0](https://discuss.elastic.co/t/bug-found-for-kibana-4-5-0/49732)
**Author:** [@macymin](https://discuss.elastic.co/u/macymin)\ **Replies:** 4\ **Last updated:** [May 11, 2016, 8:18am UTC](https://discuss.elastic.co/t/bug-found-for-kibana-4-5-0/49732 "2016-05-11T08:18:04Z")
when try to rename a visualization in settings --\> object, after saving only the visualization name is changed but not the link. And by using bug, I could have 2 visualizations have same name. --- ## [Getting a 403 when trying to download a GPG key / install filebeat](https://discuss.elastic.co/t/getting-a-403-when-trying-to-download-a-gpg-key-install-filebeat/325447)
**Author:** [@BlueIceAce](https://discuss.elastic.co/u/BlueIceAce)\ **Replies:** 1\ **Last updated:** [February 14, 2023, 8:56am UTC](https://discuss.elastic.co/t/getting-a-403-when-trying-to-download-a-gpg-key-install-filebeat/325447 "2023-02-14T08:56:00Z")
Hey, guys! I get a 403 error when I try to download the GPG key, as well as when installing filebeat through apt repository. Adding a GPG key via Ansible: "msg": "Failed to download key at https://artifacts.elastic.co… --- ## [Docker elastic-agent certificate signed by unknown authority](https://discuss.elastic.co/t/docker-elastic-agent-certificate-signed-by-unknown-authority/313024)
**Author:** [@orihomie](https://discuss.elastic.co/u/orihomie)\ **Replies:** 1\ **Last updated:** [August 29, 2022, 6:09am UTC](https://discuss.elastic.co/t/docker-elastic-agent-certificate-signed-by-unknown-authority/313024 "2022-08-29T06:09:57Z")
Hi. I'm trying to launch elastic-agent in a docker-compose way: elastic-agent: platform: linux/arm64 image: docker.elastic.co/beats/elastic-agent:8.2.3 container\_name: elastic-agent restart: always u… --- ## [Script Processor](https://discuss.elastic.co/t/script-processor/216552)
**Author:** [@Rithesh\_Subramanian](https://discuss.elastic.co/u/Rithesh_Subramanian)\ **Replies:** 1\ **Last updated:** [January 27, 2020, 10:08am UTC](https://discuss.elastic.co/t/script-processor/216552 "2020-01-27T10:08:25Z")
Hi, I am trying to add script processor after splitting the message with dissect processor. But i am not able to start the filebeat after adding the script processor. processors: - rename: fields: - fro… --- ## [Painless script condition in watcher](https://discuss.elastic.co/t/painless-script-condition-in-watcher/85496)
**Author:** [@higee](https://discuss.elastic.co/u/higee)\ **Replies:** 1\ **Last updated:** [May 15, 2017, 9:13pm UTC](https://discuss.elastic.co/t/painless-script-condition-in-watcher/85496 "2017-05-15T21:13:27Z")
Hi I'm trying to make an alert system that matches following condition. Each document has following fields. status # either 'incomplete' or 'complete' insert\_time # timestamp when the document has been inserted And t… --- ## [How to store only metadata in elasticsearch and indexes in the HDFS](https://discuss.elastic.co/t/how-to-store-only-metadata-in-elasticsearch-and-indexes-in-the-hdfs/75524)
**Author:** [@irri](https://discuss.elastic.co/u/irri)\ **Replies:** 1\ **Last updated:** [February 18, 2017, 10:14pm UTC](https://discuss.elastic.co/t/how-to-store-only-metadata-in-elasticsearch-and-indexes-in-the-hdfs/75524 "2017-02-18T22:14:27Z")
Huge amount of Data is residing in the hdfs . we have used hive storage handler to store the data in elastic search. Ultimate goal is to use kibana to visualize the data. Now due to storage and security concerns, WE want… --- ## [SSLHandshake Exception when trying to install license](https://discuss.elastic.co/t/sslhandshake-exception-when-trying-to-install-license/56552)
**Author:** [@mathal](https://discuss.elastic.co/u/mathal)\ **Replies:** 1\ **Last updated:** [July 30, 2016, 12:38am UTC](https://discuss.elastic.co/t/sslhandshake-exception-when-trying-to-install-license/56552 "2016-07-30T00:38:10Z")
Hi, I am getting the following exception while trying to install marvel using the online instructions, appreciate any help. Thanks! C:\\coding\\elasticsearch-2.3.3\\elasticsearch-2.3.3\\bin\>plugin install license --v erb… --- ## [Can't use geo\_shape index, elastic 2.1](https://discuss.elastic.co/t/cant-use-geo-shape-index-elastic-2-1/46903)
**Author:** [@Matt\_Chambers](https://discuss.elastic.co/u/Matt_Chambers)\ **Replies:** 1\ **Last updated:** [April 12, 2016, 8:08am UTC](https://discuss.elastic.co/t/cant-use-geo-shape-index-elastic-2-1/46903 "2016-04-12T08:08:26Z")
Not sure what is going on, I'm putting the data in the exact format the docs are asking for. Mapping: "properties": { "annotations": { "type": "geo\_shape" } } Data: "annotations": {"type":"… --- ## [Need to add timezone field to my output](https://discuss.elastic.co/t/need-to-add-timezone-field-to-my-output/38628)
**Author:** [@miko370](https://discuss.elastic.co/u/miko370)\ **Replies:** 1\ **Last updated:** [January 7, 2016, 3:09pm UTC](https://discuss.elastic.co/t/need-to-add-timezone-field-to-my-output/38628 "2016-01-07T15:09:38Z")
Hi. I need to add an extra field that will include the timezone of the local (LogStash agent) machine. I have tried using add\_field =\> {"TZ" =\> "%{+z}"} but it always give the UTC time. Any way I can do that withou… --- ## [How to set the default application](https://discuss.elastic.co/t/how-to-set-the-default-application/32310)
**Author:** [@bier](https://discuss.elastic.co/u/bier)\ **Replies:** 1\ **Last updated:** [October 19, 2015, 3:57am UTC](https://discuss.elastic.co/t/how-to-set-the-default-application/32310 "2015-10-19T03:57:12Z")
I tried to change the kibana.defaultAppId to kibana.defaultAppId: "dashboard" or "dashboard/mysaveddashboard" but it doesnt seem to work, it always loads Discover. How do i change the default application? Using Kiba… --- ## [Decode\_xml not working](https://discuss.elastic.co/t/decode-xml-not-working/269763)
**Author:** [@witkacy](https://discuss.elastic.co/u/witkacy)\ **Replies:** 5\ **Last updated:** [April 26, 2021, 4:04pm UTC](https://discuss.elastic.co/t/decode-xml-not-working/269763 "2021-04-26T16:04:38Z")
Hello, I'm using winlogbeats version 7.12 and it works great but I have a question. In my windows log in message field I have an XML. What I would like to do is first check if in that XML in specific field there is a s… --- ## [How to check if a master node auto-election is enabled?](https://discuss.elastic.co/t/how-to-check-if-a-master-node-auto-election-is-enabled/265197)
**Author:** [@Manikandan\_Kbk](https://discuss.elastic.co/u/Manikandan_Kbk)\ **Replies:** 5\ **Last updated:** [February 23, 2021, 12:48pm UTC](https://discuss.elastic.co/t/how-to-check-if-a-master-node-auto-election-is-enabled/265197 "2021-02-23T12:48:27Z")
We have installed ES 6.2.4 and have 3 master node setup. Is there a way to check if auto-election of master node is enabled in case active master goes down? do elastic search always do auto-election (or) disabling auto… --- ## [Error restoring state from URL - Kibana Dashboard](https://discuss.elastic.co/t/error-restoring-state-from-url-kibana-dashboard/268573)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 3\ **Last updated:** [March 28, 2021, 4:16pm UTC](https://discuss.elastic.co/t/error-restoring-state-from-url-kibana-dashboard/268573 "2021-03-28T16:16:08Z")
Unable to completely restore the URL, be sure to use the share functionality. Error: Unable to completely restore the URL, be sure to use the share functionality. at throwUnableToRestoreUrlError (https://####.kb.eastus2… --- ## [Metric output to elasticsearch via filebeat](https://discuss.elastic.co/t/metric-output-to-elasticsearch-via-filebeat/262560)
**Author:** [@umesh2020](https://discuss.elastic.co/u/umesh2020)\ **Replies:** 3\ **Last updated:** [February 2, 2021, 4:58pm UTC](https://discuss.elastic.co/t/metric-output-to-elasticsearch-via-filebeat/262560 "2021-02-02T16:58:01Z")
I have a question related to metrics collection. The application writes metric data into a file. Can filebeat pickup this information say using log or filestream input and send it to elasticsearch ? What would be the d… --- ## [Elasticsearch cannot be started after an upgrade: Temporary file directory \[${ES\_TMPDIR}\] does not exist or is not accessible](https://discuss.elastic.co/t/elasticsearch-cannot-be-started-after-an-upgrade-temporary-file-directory-es-tmpdir-does-not-exist-or-is-not-accessible/217780)
**Author:** [@nelyanne-v](https://discuss.elastic.co/u/nelyanne-v)\ **Replies:** 0\ **Last updated:** [February 4, 2020, 11:13am UTC](https://discuss.elastic.co/t/elasticsearch-cannot-be-started-after-an-upgrade-temporary-file-directory-es-tmpdir-does-not-exist-or-is-not-accessible/217780 "2020-02-04T11:13:06Z")
Hi all, I am trying to upgrade my Elasticsearch cluster from 7.4.0 to 7.5.2. It is running on CentOS 7 with Java 1.8.0. I used the rpm files from https://www.elastic.co/downloads/elasticsearch. I successfully upgraded … --- ## [How to access and sort many documents using scripting fields?](https://discuss.elastic.co/t/how-to-access-and-sort-many-documents-using-scripting-fields/210310)
**Author:** [@white\_rabbit](https://discuss.elastic.co/u/white_rabbit)\ **Replies:** 3\ **Last updated:** [December 13, 2019, 3:05pm UTC](https://discuss.elastic.co/t/how-to-access-and-sort-many-documents-using-scripting-fields/210310 "2019-12-13T15:05:55Z")
In my Elasticsearch index I store multiple documents with fields like date, sequence etc. It looks like shown below. My goal is to find reordering. It means that I should sort all documents by date and check whether all … --- ## [Not getting near real time logs in kibana](https://discuss.elastic.co/t/not-getting-near-real-time-logs-in-kibana/167987)
**Author:** [@Iswarya](https://discuss.elastic.co/u/Iswarya)\ **Replies:** 3\ **Last updated:** [February 20, 2019, 12:52am UTC](https://discuss.elastic.co/t/not-getting-near-real-time-logs-in-kibana/167987 "2019-02-20T00:52:11Z")
Hi Team, We are not getting near real time production logs in Kibana UI.Please find the attached screenshot and below mentioned ELK Version filebeat-6.2.4 Logstash-5.6.4 Elasticsearch-5.6.4 Kibana-5.6.4 We have r… --- ## [How to compare two aggregations](https://discuss.elastic.co/t/how-to-compare-two-aggregations/165446)
**Author:** [@jurisn](https://discuss.elastic.co/u/jurisn)\ **Replies:** 3\ **Last updated:** [January 25, 2019, 8:21pm UTC](https://discuss.elastic.co/t/how-to-compare-two-aggregations/165446 "2019-01-25T20:21:13Z")
Hi, I have list for 24 hour period: PC1 PC2 PC3 PC4 I have list for 1 hour period: PC3 PC4 as result I will receive such list: PC1 PC2 Do someone know how to do this? --- ## [CentOS: elasticsearch dead but subsys locked](https://discuss.elastic.co/t/centos-elasticsearch-dead-but-subsys-locked/150530)
**Author:** [@ThomasSieber](https://discuss.elastic.co/u/ThomasSieber)\ **Replies:** 0\ **Last updated:** [October 1, 2018, 8:23am UTC](https://discuss.elastic.co/t/centos-elasticsearch-dead-but-subsys-locked/150530 "2018-10-01T08:23:56Z")
I installed elastic search on CentOS 6.10. After that i started it with service elasticsearch start But under localhost:9200 it is not reachable and under service --status-all it shows: elasticsearch dead but subsys… --- ## [How to capture "now" and "now-15m" in mail body?](https://discuss.elastic.co/t/how-to-capture-now-and-now-15m-in-mail-body/144905)
**Author:** [@Debashis\_Adak](https://discuss.elastic.co/u/Debashis_Adak)\ **Replies:** 3\ **Last updated:** [August 20, 2018, 10:10am UTC](https://discuss.elastic.co/t/how-to-capture-now-and-now-15m-in-mail-body/144905 "2018-08-20T10:10:43Z")
Hi All, I am trying to capture the time "now" and "now-15m" in my mail body of the kibana watcher. Can you help me with the syntax? Thanks & Regards, Debashis [Previous page](https://discuss.elastic.co/top.md?page=1552&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1554&per_page=50&period=all)