# Top **URL:** https://discuss.elastic.co/top.md?page=1561&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1562 --- ## [Reindexing and error recovery](https://discuss.elastic.co/t/reindexing-and-error-recovery/4965)
**Author:** [@Ivan](https://discuss.elastic.co/u/Ivan)\ **Replies:** 2\ **Last updated:** [July 26, 2011, 2:40pm UTC](https://discuss.elastic.co/t/reindexing-and-error-recovery/4965 "2011-07-26T14:40:47Z")
Excuse me in advance for the long post. Up until now, I have avoided rebuilding from source but now is the time to finally dive in. Trying to determine reindexing best practices. Using aliases appears to be the sug… --- ## [Search Bar queries/functionalities](https://discuss.elastic.co/t/search-bar-queries-functionalities/22304)
**Author:** [@Ap1](https://discuss.elastic.co/u/Ap1)\ **Replies:** 0\ **Last updated:** [February 20, 2015, 10:12pm UTC](https://discuss.elastic.co/t/search-bar-queries-functionalities/22304 "2015-02-20T22:12:50Z")
I am building a new search for following components: 1. Names of various entities ( objects, people, things) 2. Documents belonging to those entities 3. Connections of those entities to other entities What querie… --- ## [Help me set up a multi-server environment](https://discuss.elastic.co/t/help-me-set-up-a-multi-server-environment/223292)
**Author:** [@jw.lee](https://discuss.elastic.co/u/jw.lee)\ **Replies:** 6\ **Last updated:** [March 19, 2020, 8:39am UTC](https://discuss.elastic.co/t/help-me-set-up-a-multi-server-environment/223292 "2020-03-19T08:39:41Z")
I want to connect 3 external PCs. Three internal devices tested have been connected correctly. I want to set it to communicate with an external PC. Testing Elasticsearch.yml on the internal network ------------------… --- ## [\\ELK was unexpected at this time](https://discuss.elastic.co/t/elk-was-unexpected-at-this-time/206541)
**Author:** [@lohit18](https://discuss.elastic.co/u/lohit18)\ **Replies:** 6\ **Last updated:** [November 5, 2019, 10:37am UTC](https://discuss.elastic.co/t/elk-was-unexpected-at-this-time/206541 "2019-11-05T10:37:27Z")
I am Getting Error while running application as elasticsearch from command prompt Error : \\ELK was unexpected at this time. Java -verison java version "1.8.0\_201" Java(TM) SE Runtime Environment (build 1.8.0\_201-b09… --- ## [Can the snmptrap input plugin for logstash receive snmp version 3 traps?](https://discuss.elastic.co/t/can-the-snmptrap-input-plugin-for-logstash-receive-snmp-version-3-traps/306659)
**Author:** [@selflabs](https://discuss.elastic.co/u/selflabs)\ **Replies:** 3\ **Last updated:** [June 13, 2022, 6:32am UTC](https://discuss.elastic.co/t/can-the-snmptrap-input-plugin-for-logstash-receive-snmp-version-3-traps/306659 "2022-06-13T06:32:16Z")
Hi Team, can we receive snmp v3 traps on logstash-input-smnptrap plugin. I have tried to get but getting errors. Below are my configuration and version details. logstash version : logstash 8.2.2 snmptrap plugin : logst… --- ## [How filebeat read the content of the file](https://discuss.elastic.co/t/how-filebeat-read-the-content-of-the-file/295674)
**Author:** [@sixsenseninja](https://discuss.elastic.co/u/sixsenseninja)\ **Replies:** 3\ **Last updated:** [February 9, 2022, 2:53am UTC](https://discuss.elastic.co/t/how-filebeat-read-the-content-of-the-file/295674 "2022-02-09T02:53:14Z")
Hi all, We are exporting a csv using cronjob and put it inside a a folder. A filebeat will process and read the file before for visualization in Kibana. (Filebeat and the folder are in the same host) The csv is a very … --- ## [Logstash에서 wildcard filter 적용 문의](https://discuss.elastic.co/t/logstash-wildcard-filter/160453)
**Author:** [@teichae](https://discuss.elastic.co/u/teichae)\ **Replies:** 3\ **Last updated:** [December 13, 2018, 12:16am UTC](https://discuss.elastic.co/t/logstash-wildcard-filter/160453 "2018-12-13T00:16:34Z")
안녕하세요. logstash 관련해서 궁금한 점이 있어서 질문합니다! Kibana에서 a.php, b.php, c.php, /abc/abc.php, /bcd/bcd.php 같이 저희 서버에 존재하지 않는 파일들이 request field log에 남고 있습니다. logstash 상에서 filter를 이용해서 해당 로그들을 수집하지 않고 싶은데.. 다음과 같이 filter를 적용했는데 … --- ## [Extract domain from field](https://discuss.elastic.co/t/extract-domain-from-field/150541)
**Author:** [@elk2](https://discuss.elastic.co/u/elk2)\ **Replies:** 3\ **Last updated:** [October 5, 2018, 1:34pm UTC](https://discuss.elastic.co/t/extract-domain-from-field/150541 "2018-10-05T13:34:34Z")
I want to extract domain from email field that is like this: smtp.from\_mail : "news \" I would like to use grok or other useful plugin. --- ## [Vega: Map mode is not yet supported in Kibana Core](https://discuss.elastic.co/t/vega-map-mode-is-not-yet-supported-in-kibana-core/120805)
**Author:** [@emil.mirzayev](https://discuss.elastic.co/u/emil.mirzayev)\ **Replies:** 3\ **Last updated:** [February 22, 2018, 8:01am UTC](https://discuss.elastic.co/t/vega-map-mode-is-not-yet-supported-in-kibana-core/120805 "2018-02-22T08:01:35Z")
Hi there. I just updated my ELK stack with the newest version (6.2.2) today in order to use Vega viz. I am taking the sample code for logstash-\* index from Logstash mapping. However, I get the following error and do no… --- ## [Elasticsearch 5.6.x - Using \_version in a function score query](https://discuss.elastic.co/t/elasticsearch-5-6-x-using-version-in-a-function-score-query/119045)
**Author:** [@ng.software.dev](https://discuss.elastic.co/u/ng.software.dev)\ **Replies:** 3\ **Last updated:** [February 12, 2018, 1:36pm UTC](https://discuss.elastic.co/t/elasticsearch-5-6-x-using-version-in-a-function-score-query/119045 "2018-02-12T13:36:08Z")
I have a use case where I want to find the most popular shingles from a text corpus. I made a first implementation some time ago in Elasticsearch 2.3.1. I would extract shingles from the text and index them in Elasticse… --- ## [How to have provide value for @timestamp when using JSON?](https://discuss.elastic.co/t/how-to-have-provide-value-for-timestamp-when-using-json/119071)
**Author:** [@some7](https://discuss.elastic.co/u/some7)\ **Replies:** 3\ **Last updated:** [February 8, 2018, 8:09pm UTC](https://discuss.elastic.co/t/how-to-have-provide-value-for-timestamp-when-using-json/119071 "2018-02-08T20:09:37Z")
I send a JSON object string to logstash, and one of the keys of the JSON object is @timestamp with a timestamp I've generated, but when I put it into logstash I get @timestamp which is generated by logstash, and @\_timest… --- ## [/usr/share/elasticsearch/data isn't in-line with the FHS (filesystem hierarchy standard)?](https://discuss.elastic.co/t/usr-share-elasticsearch-data-isnt-in-line-with-the-fhs-filesystem-hierarchy-standard/104090)
**Author:** [@JPvRiel](https://discuss.elastic.co/u/JPvRiel)\ **Replies:** 3\ **Last updated:** [November 17, 2017, 6:39pm UTC](https://discuss.elastic.co/t/usr-share-elasticsearch-data-isnt-in-line-with-the-fhs-filesystem-hierarchy-standard/104090 "2017-11-17T18:39:18Z")
As per Filesystem Hierarchy Standard The /usr/share hierarchy is for all read-only architecture independent data files. The example from elasticsearch at Install Elasticsearch with Docker | Elasticsearch Guide \[8.11\]… --- ## [XML message in catalina log](https://discuss.elastic.co/t/xml-message-in-catalina-log/99175)
**Author:** [@Wayne\_Taylor](https://discuss.elastic.co/u/Wayne_Taylor)\ **Replies:** 3\ **Last updated:** [September 5, 2017, 3:34pm UTC](https://discuss.elastic.co/t/xml-message-in-catalina-log/99175 "2017-09-05T15:34:55Z")
Hi Team, I have my catalina.out parsed but once exception it misses XML over multi line. I need some help to get this working. Below is my config thus far: filebeat.prospectors: - document\_type: logs paths: - /Use… --- ## [Date type question : Get Documents by Year](https://discuss.elastic.co/t/date-type-question-get-documents-by-year/95274)
**Author:** [@abhikrbng](https://discuss.elastic.co/u/abhikrbng)\ **Replies:** 3\ **Last updated:** [August 1, 2017, 4:44am UTC](https://discuss.elastic.co/t/date-type-question-get-documents-by-year/95274 "2017-08-01T04:44:10Z")
I have a DATE field in an index with "type" : “date” & “format” : “strict\_date\_optional\_time||epoch\_millis” I need to get all the Documents in a mentioned year(say : return all documents whose date field has year… --- ## [Filebeat: If tcp write or read error then filebeat stops harvesting files until restart](https://discuss.elastic.co/t/filebeat-if-tcp-write-or-read-error-then-filebeat-stops-harvesting-files-until-restart/94590)
**Author:** [@Alexkl](https://discuss.elastic.co/u/Alexkl)\ **Replies:** 3\ **Last updated:** [July 27, 2017, 2:41pm UTC](https://discuss.elastic.co/t/filebeat-if-tcp-write-or-read-error-then-filebeat-stops-harvesting-files-until-restart/94590 "2017-07-27T14:41:30Z")
Hello I am currently using the elk stack in v5.5 and i have a quite big issue: Everytime i have a tcp write or read error i have to restart filebeat because it stops sending messages. 2017-07-25T11:14:46+02:00 ERR Fa… --- ## [Atomically create index with single alias](https://discuss.elastic.co/t/atomically-create-index-with-single-alias/18958)
**Author:** [@mhughes](https://discuss.elastic.co/u/mhughes)\ **Replies:** 3\ **Last updated:** [July 29, 2014, 7:06pm UTC](https://discuss.elastic.co/t/atomically-create-index-with-single-alias/18958 "2014-07-29T19:06:00Z")
I have a time-series index. I create a new version once a day using the format index-name-YYYY-mm-dd. When creating the index, I assign it a constant alias of 'index-name'. This way, clients can just refer to th… --- ## [Couchbase elasticsearch sync issue](https://discuss.elastic.co/t/couchbase-elasticsearch-sync-issue/9252)
**Author:** [@Amy](https://discuss.elastic.co/u/Amy)\ **Replies:** 3\ **Last updated:** [May 12, 2013, 4:31pm UTC](https://discuss.elastic.co/t/couchbase-elasticsearch-sync-issue/9252 "2013-05-12T16:31:52Z")
I've been investigating whether to use couchbase with elasticsearch. There's an excellent blogon how to set this up. I have one issue. If elasticsearch is down, and you send a document to couchbase, then bring back … --- ## [Using transforms and ingest pipelines on data that changes over time](https://discuss.elastic.co/t/using-transforms-and-ingest-pipelines-on-data-that-changes-over-time/347101)
**Author:** [@pulsy](https://discuss.elastic.co/u/pulsy)\ **Replies:** 5\ **Last updated:** [November 14, 2023, 1:55pm UTC](https://discuss.elastic.co/t/using-transforms-and-ingest-pipelines-on-data-that-changes-over-time/347101 "2023-11-14T13:55:36Z")
I'm thinking about using elastic transforms together with ingest pipelines to basically create views of mongodb collections that are spread over multiple database servers, so we can efficiently sort and filter by referen… --- ## [Elasticsearch OpenJDK process takes over every available TCP port](https://discuss.elastic.co/t/elasticsearch-openjdk-process-takes-over-every-available-tcp-port/261107)
**Author:** [@MiriamJu](https://discuss.elastic.co/u/MiriamJu)\ **Replies:** 5\ **Last updated:** [January 17, 2021, 12:42pm UTC](https://discuss.elastic.co/t/elasticsearch-openjdk-process-takes-over-every-available-tcp-port/261107 "2021-01-17T12:42:16Z")
Hi, I am facing an issue with Elastic Search: In one of our PCs, The ES Java process took over every available TCP port on the system and held them, so the system entered TCP starvation and failed to continue functionin… --- ## [Как посчитать какие ресурсы нужны для coordination node](https://discuss.elastic.co/t/coordination-node/222486)
**Author:** [@111229](https://discuss.elastic.co/u/111229)\ **Replies:** 5\ **Last updated:** [March 6, 2020, 7:48pm UTC](https://discuss.elastic.co/t/coordination-node/222486 "2020-03-06T19:48:33Z")
Коллеги, добрый день! У нас кластер из 10-дата нод, 3 мастера. Нагрузка порядка 5-30 тыс.записей в секунду. Мы хотим ввести координэйшен-ноду поскольку не хотим более нагружать напрямую дата-ноды пользовательскими запр… --- ## [Help guide a noob for optimizing elasticsearch in current cluster](https://discuss.elastic.co/t/help-guide-a-noob-for-optimizing-elasticsearch-in-current-cluster/154109)
**Author:** [@rbendik](https://discuss.elastic.co/u/rbendik)\ **Replies:** 5\ **Last updated:** [November 8, 2018, 8:33am UTC](https://discuss.elastic.co/t/help-guide-a-noob-for-optimizing-elasticsearch-in-current-cluster/154109 "2018-11-08T08:33:22Z")
Hi. I have been reading docs learning about elasticsearch. I would like definitive help and guidance to quickly assess and provide "actual" guidance for optimization. I am really hoping no one says "it depends" as I have… --- ## [Error: getsockopt: connection refused](https://discuss.elastic.co/t/error-getsockopt-connection-refused/309564)
**Author:** [@benjamin\_brightson](https://discuss.elastic.co/u/benjamin_brightson)\ **Replies:** 1\ **Last updated:** [July 15, 2022, 9:04am UTC](https://discuss.elastic.co/t/error-getsockopt-connection-refused/309564 "2022-07-15T09:04:29Z")
Hi Team, This is to inform you that am trying to setup the multiple beat config with logstash , so initially i started with the single beat config where am facing the " \[Error: getsockopt: connection refused\]" this erro… --- ## [Add transaction id, to incoming request, and log it in access log (Spring Boot with Tomcat)](https://discuss.elastic.co/t/add-transaction-id-to-incoming-request-and-log-it-in-access-log-spring-boot-with-tomcat/295482)
**Author:** [@Casper\_Thrane](https://discuss.elastic.co/u/Casper_Thrane)\ **Replies:** 1\ **Last updated:** [January 26, 2022, 6:10pm UTC](https://discuss.elastic.co/t/add-transaction-id-to-incoming-request-and-log-it-in-access-log-spring-boot-with-tomcat/295482 "2022-01-26T18:10:05Z")
Hi Is it possible to add a transaction/trace id to the incoming http request, and log it, in the access log. All other logs, we use log4j2, and here these ids is automatically logged. We would like to be able, to correl… --- ## [ElasticsearchError error=“400 - Rejected by Elasticsearch](https://discuss.elastic.co/t/elasticsearcherror-error-400-rejected-by-elasticsearch/270361)
**Author:** [@Julien\_BRUNET\_BTWIN](https://discuss.elastic.co/u/Julien_BRUNET_BTWIN)\ **Replies:** 1\ **Last updated:** [April 19, 2021, 11:34pm UTC](https://discuss.elastic.co/t/elasticsearcherror-error-400-rejected-by-elasticsearch/270361 "2021-04-19T23:34:33Z")
Hello i am using EFK stack in my GKE cluster and recently i observed below errors in my fluentd logs. 2021-04-15 14:39:25 +0000 \[warn\]: dump an error event: error\_class=Fluent::Plugin::ElasticsearchErrorHandler::Elasti… --- ## [X-ProxiedEntitiesChain - Has anyone used it in a heartbeat?](https://discuss.elastic.co/t/x-proxiedentitieschain-has-anyone-used-it-in-a-heartbeat/239159)
**Author:** [@soooooobusy](https://discuss.elastic.co/u/soooooobusy)\ **Replies:** 1\ **Last updated:** [July 2, 2020, 3:08pm UTC](https://discuss.elastic.co/t/x-proxiedentitieschain-has-anyone-used-it-in-a-heartbeat/239159 "2020-07-02T15:08:41Z")
Hi, I'm trying to get a check.request to a RESTful endpoint, using GET and headers of Accept and X-ProxiedEntitiesChain, but I can't seem to pass across the Chain correctly to get authorisation. I'm using - Accept: 'a… --- ## [Filebeats 7.5.0 issue with s3 input with gzip files](https://discuss.elastic.co/t/filebeats-7-5-0-issue-with-s3-input-with-gzip-files/210800)
**Author:** [@Ronin](https://discuss.elastic.co/u/Ronin)\ **Replies:** 1\ **Last updated:** [December 6, 2019, 4:41pm UTC](https://discuss.elastic.co/t/filebeats-7-5-0-issue-with-s3-input-with-gzip-files/210800 "2019-12-06T16:41:24Z")
I have verified that the following issue works under 7.4.2 correctly. If a file is a gzip file it can not be decombressed under 7.5.0. The following log messages are provided: ERROR \[s3\] s3/input.go:259 handleS3Objects… --- ## [OpenLdap Log parsing? (strange errors)](https://discuss.elastic.co/t/openldap-log-parsing-strange-errors/204701)
**Author:** [@iukea](https://discuss.elastic.co/u/iukea)\ **Replies:** 1\ **Last updated:** [October 22, 2019, 6:05pm UTC](https://discuss.elastic.co/t/openldap-log-parsing-strange-errors/204701 "2019-10-22T18:05:16Z")
I am having a crazy hard time trying to parse logs coming from my LDAP servers. Sending data Vida filebeat to logstash. And found a nice example openldap.conf file someone was working on (it works okay but i have made… --- ## [Maximum number of data nodes per cluster](https://discuss.elastic.co/t/maximum-number-of-data-nodes-per-cluster/125982)
**Author:** [@mario12](https://discuss.elastic.co/u/mario12)\ **Replies:** 1\ **Last updated:** [March 28, 2018, 11:36pm UTC](https://discuss.elastic.co/t/maximum-number-of-data-nodes-per-cluster/125982 "2018-03-28T23:36:16Z")
We are running elasticsearch 2.4. One of our cluster has 123 data nodes and 5 master nodes. The cluster is provisioned on AWS and we use the i2.2xlarge instance type (8 vcpu's, 61 GB of RAM, Up to 10 Gigabit of network … --- ## [Status: Red on ES Cluster](https://discuss.elastic.co/t/status-red-on-es-cluster/123707)
**Author:** [@minidan](https://discuss.elastic.co/u/minidan)\ **Replies:** 7\ **Last updated:** [March 16, 2018, 1:42pm UTC](https://discuss.elastic.co/t/status-red-on-es-cluster/123707 "2018-03-16T13:42:50Z")
Hi, Maybe simple question but how do I tailor the commands to troubleshoot an linux elasticsearch cluster in RED on the command line? Nothing I type with localhost:9200 seems to work... --- ## [All shards of an index allocated to same node, despite space on other nodes](https://discuss.elastic.co/t/all-shards-of-an-index-allocated-to-same-node-despite-space-on-other-nodes/100361)
**Author:** [@lecko](https://discuss.elastic.co/u/lecko)\ **Replies:** 1\ **Last updated:** [September 13, 2017, 9:00pm UTC](https://discuss.elastic.co/t/all-shards-of-an-index-allocated-to-same-node-despite-space-on-other-nodes/100361 "2017-09-13T21:00:16Z")
Hello, I am new to this community. Hello, I have a cluster of 5 graylog nodes connected with 5 elasticsearch nodes, all with similar size disk , RAM, cpu, network. elastricsearch is version 2.3.4. The message traffi… --- ## [Kv filter's behavior when square brackets in log data](https://discuss.elastic.co/t/kv-filters-behavior-when-square-brackets-in-log-data/93358)
**Author:** [@Pranav1](https://discuss.elastic.co/u/Pranav1)\ **Replies:** 1\ **Last updated:** [July 21, 2017, 4:01pm UTC](https://discuss.elastic.co/t/kv-filters-behavior-when-square-brackets-in-log-data/93358 "2017-07-21T16:01:22Z")
In logstash I am using the following filter- filter { kv { field\_split =\> "\\t" } } So here I am using tab as field split and the value split I have kept default (i.e. '=') Now I am sending a log like this- ani… --- ## [Log rotations](https://discuss.elastic.co/t/log-rotations/27571)
**Author:** [@Mark\_van\_Rossum](https://discuss.elastic.co/u/Mark_van_Rossum)\ **Replies:** 1\ **Last updated:** [August 18, 2015, 11:32am UTC](https://discuss.elastic.co/t/log-rotations/27571 "2015-08-18T11:32:26Z")
I'm using logstash-forwarder 0.4, and have issues with it detecting spurious log rotations which is preventing it from importing some files, e.g. 2015/08/16 00:00:02.585975 File rename was detected: /usr/local/appinf/c… --- ## [Default to docvalues?](https://discuss.elastic.co/t/default-to-docvalues/1119)
**Author:** [@aochsner](https://discuss.elastic.co/u/aochsner)\ **Replies:** 1\ **Last updated:** [May 21, 2015, 10:17pm UTC](https://discuss.elastic.co/t/default-to-docvalues/1119 "2015-05-21T22:17:01Z")
We have a really tiny node (memory-wise) that runs our Marvel instance. We keep about a week's worth of Marvel data. Occasionally if people do enough aggregations across enough days then we hit fielddata circuit breake… --- ## [27 default Elastic Security rules contain definitions to non-existant indices and are broken](https://discuss.elastic.co/t/27-default-elastic-security-rules-contain-definitions-to-non-existant-indices-and-are-broken/303043)
**Author:** [@finbarr996](https://discuss.elastic.co/u/finbarr996)\ **Replies:** 4\ **Last updated:** [April 26, 2022, 3:10pm UTC](https://discuss.elastic.co/t/27-default-elastic-security-rules-contain-definitions-to-non-existant-indices-and-are-broken/303043 "2022-04-26T15:10:30Z")
Hi there, As an example, the Elastic supplied default 'Endpoint Security' rule contains a hard coded definition to the index pattern 'logs-endpoint.alerts-\*' however, this index pattern does not exist and so this rule g… --- ## [I need a ES Query equalent to sql count(if(somecondition))](https://discuss.elastic.co/t/i-need-a-es-query-equalent-to-sql-count-if-somecondition/288877)
**Author:** [@Brintha](https://discuss.elastic.co/u/Brintha)\ **Replies:** 4\ **Last updated:** [November 11, 2021, 7:23am UTC](https://discuss.elastic.co/t/i-need-a-es-query-equalent-to-sql-count-if-somecondition/288877 "2021-11-11T07:23:04Z")
Hello, My Question is How to frame Query for 'SELECT EMPLOYEE,COUNT(IF(COUNTRY IN US)) FROM ORG WHERE SOMECRITERIA' --- ## [SAML attributes.groups has multiple groups, role mapping does not work](https://discuss.elastic.co/t/saml-attributes-groups-has-multiple-groups-role-mapping-does-not-work/286151)
**Author:** [@iti](https://discuss.elastic.co/u/iti)\ **Replies:** 4\ **Last updated:** [October 12, 2021, 6:21am UTC](https://discuss.elastic.co/t/saml-attributes-groups-has-multiple-groups-role-mapping-does-not-work/286151 "2021-10-12T06:21:11Z")
I have the following saml response: \ \ \ **Author:** [@Miguel\_BA](https://discuss.elastic.co/u/Miguel_BA)\ **Replies:** 4\ **Last updated:** [August 14, 2020, 1:08pm UTC](https://discuss.elastic.co/t/elasticsearch-count-unique-value-with-a-condition/244983 "2020-08-14T13:08:20Z") I would like a query which it returns the number of times a field is repeated, according to the unique value of another field I have this json: "name" : james, "city" : "chicago" \<----------- same … --- ## [Resolution problems with kibana monitoring](https://discuss.elastic.co/t/resolution-problems-with-kibana-monitoring/209592)
**Author:** [@jmartori](https://discuss.elastic.co/u/jmartori)\ **Replies:** 4\ **Last updated:** [November 27, 2019, 4:47pm UTC](https://discuss.elastic.co/t/resolution-problems-with-kibana-monitoring/209592 "2019-11-27T16:47:14Z")
Hi there, we have noticed that unless we use the "Last 4 hours" resolution while using kibana's monitoring dashboards, we obtain some saw-like pattern. At the same time some other plots will just show 0's when the time… --- ## [Having troubles with XML Filtering](https://discuss.elastic.co/t/having-troubles-with-xml-filtering/173450)
**Author:** [@julsss](https://discuss.elastic.co/u/julsss)\ **Replies:** 4\ **Last updated:** [March 25, 2019, 2:21am UTC](https://discuss.elastic.co/t/having-troubles-with-xml-filtering/173450 "2019-03-25T02:21:55Z")
Good day everyone, I am new to this technology and I am trying to filter an xml file with the following elements. Now, when I checked kibana. The first event that I parsed always include the parent tag Due to thi… --- ## [Help with making a heatmap](https://discuss.elastic.co/t/help-with-making-a-heatmap/149928)
**Author:** [@exwizzard](https://discuss.elastic.co/u/exwizzard)\ **Replies:** 4\ **Last updated:** [September 27, 2018, 8:40pm UTC](https://discuss.elastic.co/t/help-with-making-a-heatmap/149928 "2018-09-27T20:40:58Z")
I want to make a heatmap that tracks the user sessions as described on this page: http://www.dartistics.com/example5.html I want to mimic the heatmap from that example. How exactly do I make a similar heatmap on Kiban… --- ## [JDBC Input Plugin - JOIN Query issue](https://discuss.elastic.co/t/jdbc-input-plugin-join-query-issue/134063)
**Author:** [@ysumit](https://discuss.elastic.co/u/ysumit)\ **Replies:** 4\ **Last updated:** [May 31, 2018, 2:59pm UTC](https://discuss.elastic.co/t/jdbc-input-plugin-join-query-issue/134063 "2018-05-31T14:59:38Z")
Hi Team I am unable to receive any input when I am using an INNER JOIN query in jdbc input plugin of Logstash. Need immediate assistance. Sumit --- ## [Multipercolation not working after 3 queries](https://discuss.elastic.co/t/multipercolation-not-working-after-3-queries/55728)
**Author:** [@Nisar\_Adappadathil](https://discuss.elastic.co/u/Nisar_Adappadathil)\ **Replies:** 4\ **Last updated:** [July 18, 2016, 1:37pm UTC](https://discuss.elastic.co/t/multipercolation-not-working-after-3-queries/55728 "2016-07-18T13:37:00Z")
I tried the below multi percolation query from postman. I was able to execute till 175 queries. If I try with more number of queries, it was crashing and the postman was getting closed. POST http://127.0.0.1:9200/xyz4… --- ## [Spark sql insert json dataframe into elastic search](https://discuss.elastic.co/t/spark-sql-insert-json-dataframe-into-elastic-search/93795)
**Author:** [@mackindo](https://discuss.elastic.co/u/mackindo)\ **Replies:** 0\ **Last updated:** [July 19, 2017, 3:04pm UTC](https://discuss.elastic.co/t/spark-sql-insert-json-dataframe-into-elastic-search/93795 "2017-07-19T15:04:05Z")
I've looked at the guide section for using spark SQL dataframe/dataset to insert json data into elastic search, but the section "Writing existing JSON to ElasticSearch" tells you to use sql load method, which gets data F… --- ## [Question related to sizing considerations for LS/ES and expectations of performance](https://discuss.elastic.co/t/question-related-to-sizing-considerations-for-ls-es-and-expectations-of-performance/49201)
**Author:** [@mnantel](https://discuss.elastic.co/u/mnantel)\ **Replies:** 1\ **Last updated:** [May 6, 2016, 12:25am UTC](https://discuss.elastic.co/t/question-related-to-sizing-considerations-for-ls-es-and-expectations-of-performance/49201 "2016-05-06T00:25:35Z")
Hello ES community, First of all, disclaimer: my communications in this forum are solely mine, and do not represent the views of my employer. This is my first post for what really has been significant research made o… --- ## [Unable to see APM agent data on Kibana UI](https://discuss.elastic.co/t/unable-to-see-apm-agent-data-on-kibana-ui/297236)
**Author:** [@Neha\_goswami](https://discuss.elastic.co/u/Neha_goswami)\ **Replies:** 2\ **Last updated:** [February 16, 2022, 5:22am UTC](https://discuss.elastic.co/t/unable-to-see-apm-agent-data-on-kibana-ui/297236 "2022-02-16T05:22:25Z")
ES version : 7.16.2 APM Server version: 7.16.2 Java Agent Version : 1.28.4 (elastic-apm-agent-1.28.4.jar) We are trying to push data from APM Agent, The APM server shows data is getting published on Elasticsearch : {… --- ## [Include empty nested fields in aggregation](https://discuss.elastic.co/t/include-empty-nested-fields-in-aggregation/288003)
**Author:** [@Calin\_Blaga](https://discuss.elastic.co/u/Calin_Blaga)\ **Replies:** 2\ **Last updated:** [November 2, 2021, 11:37am UTC](https://discuss.elastic.co/t/include-empty-nested-fields-in-aggregation/288003 "2021-11-02T11:37:40Z")
I would like to do an aggregation on a nested field, and I would like to include empty occurrences too. What I tried: GET index/\_search { "size": 0, "aggs": { "language\_skills": { "nested": { "pat… --- ## [Email ElastAlert Not triggering on Average Aggregation query](https://discuss.elastic.co/t/email-elastalert-not-triggering-on-average-aggregation-query/252948)
**Author:** [@Chennai\_Cheetah](https://discuss.elastic.co/u/Chennai_Cheetah)\ **Replies:** 2\ **Last updated:** [October 22, 2020, 10:20am UTC](https://discuss.elastic.co/t/email-elastalert-not-triggering-on-average-aggregation-query/252948 "2020-10-22T10:20:41Z")
Mail is not triggering for my elast alert aggregator rule. I have a Elastic DSL Query which returns me an average Response time for the API for the last 15 mins. My objective is to fire email if the API average respons… --- ## [Debugging logstash indexing issue - trace output on index failure?](https://discuss.elastic.co/t/debugging-logstash-indexing-issue-trace-output-on-index-failure/248869)
**Author:** [@billkrauss3](https://discuss.elastic.co/u/billkrauss3)\ **Replies:** 2\ **Last updated:** [September 16, 2020, 5:53pm UTC](https://discuss.elastic.co/t/debugging-logstash-indexing-issue-trace-output-on-index-failure/248869 "2020-09-16T17:53:20Z")
I'm using logstash to forward events in JSON format to Elasticsearch to enable adhoc log analysis. I need to identify and review the events/log messages that fail to be indexed. ("Could not index event to Elasticsearch",… --- ## [How to visualize the result of lucene query](https://discuss.elastic.co/t/how-to-visualize-the-result-of-lucene-query/183199)
**Author:** [@JIYOUNG](https://discuss.elastic.co/u/JIYOUNG)\ **Replies:** 2\ **Last updated:** [May 30, 2019, 4:17am UTC](https://discuss.elastic.co/t/how-to-visualize-the-result-of-lucene-query/183199 "2019-05-30T04:17:53Z")
Hello, I am using Kibana 7. Using lucene query, I can see the result of data in "Dev Tool" in Kibana. I want to visualize these result like "Data Table" or "Discovery" format. There are any way to do this? Lucene Q… --- ## [How can we compile filbeat code in windows or linux?](https://discuss.elastic.co/t/how-can-we-compile-filbeat-code-in-windows-or-linux/159362)
**Author:** [@talbehat](https://discuss.elastic.co/u/talbehat)\ **Replies:** 2\ **Last updated:** [December 5, 2018, 8:49am UTC](https://discuss.elastic.co/t/how-can-we-compile-filbeat-code-in-windows-or-linux/159362 "2018-12-05T08:49:52Z")
Please help me ? Getting Error : PS C:\\Users\\shubham.jain\\Downloads\\beats-6.4.2\\beats-6.4.2\\filebeat\> go build main.go:23:2: cannot find package "github.com/elastic/beats/filebeat/cmd" in any of: C:\\Go\\src\\github.com\\… [Previous page](https://discuss.elastic.co/top.md?page=1560&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1562&per_page=50&period=all)