# Top **URL:** https://discuss.elastic.co/top.md?page=1564&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1565 --- ## [How to change the unique ID in the ID Field? (ES 7.0)](https://discuss.elastic.co/t/how-to-change-the-unique-id-in-the-id-field-es-7-0/177887)
**Author:** [@Matt\_Vasquez](https://discuss.elastic.co/u/Matt_Vasquez)\ **Replies:** 1\ **Last updated:** [April 23, 2019, 7:55pm UTC](https://discuss.elastic.co/t/how-to-change-the-unique-id-in-the-id-field-es-7-0/177887 "2019-04-23T19:55:19Z")
How do I change the value in the ID Field in Up Time? I'd like to replace this with a value such as ID NGINX Reverse Proxy Prod Application Portal Report Application Portal Prod Database Report Database etc. --- ## [POST /\_bulk: first path segment in URL cannot contain colon](https://discuss.elastic.co/t/post-bulk-first-path-segment-in-url-cannot-contain-colon/153242)
**Author:** [@wangqinghuan](https://discuss.elastic.co/u/wangqinghuan)\ **Replies:** 1\ **Last updated:** [October 25, 2018, 4:24pm UTC](https://discuss.elastic.co/t/post-bulk-first-path-segment-in-url-cannot-contain-colon/153242 "2018-10-25T16:24:51Z")
Hi I deploy a packetbeat-6.4 and obeserve some warning log as follows: 2018-10-17T13:12:01.528+0800 WARN http/http.go:505 Fail to parse HTTP parameters: parse {"index":{"\_index":"packetbeat-6.4.2-2018.10.17","\_type":"d… --- ## [%{host} %{message} error logstash](https://discuss.elastic.co/t/host-message-error-logstash/132040)
**Author:** [@Alok](https://discuss.elastic.co/u/Alok)\ **Replies:** 1\ **Last updated:** [May 16, 2018, 7:10am UTC](https://discuss.elastic.co/t/host-message-error-logstash/132040 "2018-05-16T07:10:31Z")
I am trying to put some data from protgres to Elasticsearch through jdbc. When I execute the command /bin/logstash -f \ the pipeline gets started , the execution reaches to the point where select query… --- ## [Java REST API - GET Request - Illegal Argument Exception](https://discuss.elastic.co/t/java-rest-api-get-request-illegal-argument-exception/77071)
**Author:** [@Manuel.Chacon](https://discuss.elastic.co/u/Manuel.Chacon)\ **Replies:** 1\ **Last updated:** [March 2, 2017, 6:51am UTC](https://discuss.elastic.co/t/java-rest-api-get-request-illegal-argument-exception/77071 "2017-03-02T06:51:55Z")
Hello, I'm new to elastic, and I have gone over the basic documentation available here. https://www.elastic.co/guide/en/elasticsearch/client/java-rest/current/\_example\_requests.html Unfortunately the example provi… --- ## [Failed to parse \[timestamp\] invalid formate](https://discuss.elastic.co/t/failed-to-parse-timestamp-invalid-formate/52926)
**Author:** [@Josh\_Reichardt](https://discuss.elastic.co/u/Josh_Reichardt)\ **Replies:** 1\ **Last updated:** [June 16, 2016, 12:48am UTC](https://discuss.elastic.co/t/failed-to-parse-timestamp-invalid-formate/52926 "2016-06-16T00:48:15Z")
I am attempting to parse some syslog messages and I'm seeing the following message in the Logstash logs whenever I try to match some parsed syslog field: :response=\>{"create"=\>{"\_index"=\>"logstash-2016.06.15", "\_type"… --- ## [Winlogbeat Installation - Getting Started](https://discuss.elastic.co/t/winlogbeat-installation-getting-started/43032)
**Author:** [@suzo](https://discuss.elastic.co/u/suzo)\ **Replies:** 1\ **Last updated:** [February 29, 2016, 6:49pm UTC](https://discuss.elastic.co/t/winlogbeat-installation-getting-started/43032 "2016-02-29T18:49:32Z")
Hi, I am new to ELK, Can any body please provide a link of how to configure Winlogbeat with logstash on windows 7. I have already configured ELK on ubuntu server. Thanks --- ## [Configure Elasticsearch to use SSO by OIDC - Groups claim is not mapped correctly](https://discuss.elastic.co/t/configure-elasticsearch-to-use-sso-by-oidc-groups-claim-is-not-mapped-correctly/285134)
**Author:** [@Ismaeel\_Enjreny](https://discuss.elastic.co/u/Ismaeel_Enjreny)\ **Replies:** 2\ **Last updated:** [September 28, 2021, 10:51am UTC](https://discuss.elastic.co/t/configure-elasticsearch-to-use-sso-by-oidc-groups-claim-is-not-mapped-correctly/285134 "2021-09-28T10:51:49Z")
We are trying to configure Elasticsearch so uses can login using SSO feature based on oidc protocol, everything is working fine till we tried to map claims.groups. The Identity Provider send groups as JSON array but it … --- ## [Journalbeats stops immediately after starting (Openshift)](https://discuss.elastic.co/t/journalbeats-stops-immediately-after-starting-openshift/171475)
**Author:** [@llech](https://discuss.elastic.co/u/llech)\ **Replies:** 2\ **Last updated:** [March 11, 2019, 12:58pm UTC](https://discuss.elastic.co/t/journalbeats-stops-immediately-after-starting-openshift/171475 "2019-03-11T12:58:15Z")
Hello, When I start Journalbeats 6.6.1 on Openshift 3.9, it stops immediately after starting with following log lines: 2019-03-08T10:55:02.215Z WARN \[cfgwarn\] beater/journalbeat.go:49 EXPERIMENTAL: Journalbeat is exper… --- ## [Geo searching part of intro webinar is now broken](https://discuss.elastic.co/t/geo-searching-part-of-intro-webinar-is-now-broken/145964)
**Author:** [@tombusby](https://discuss.elastic.co/u/tombusby)\ **Replies:** 2\ **Last updated:** [September 11, 2018, 11:03am UTC](https://discuss.elastic.co/t/geo-searching-part-of-intro-webinar-is-now-broken/145964 "2018-09-11T11:03:30Z")
In the introductory webinar at https://www.elastic.co/webinars/getting-started-elasticsearch?storm=start-page&iesrc=ctr, the part where he explains how to do geo based search no longer works. (The commands he uses are h… --- ## [Running Logstash only 1 row affected to elasticsearch](https://discuss.elastic.co/t/running-logstash-only-1-row-affected-to-elasticsearch/141868)
**Author:** [@dedi\_mi](https://discuss.elastic.co/u/dedi_mi)\ **Replies:** 2\ **Last updated:** [July 27, 2018, 6:33am UTC](https://discuss.elastic.co/t/running-logstash-only-1-row-affected-to-elasticsearch/141868 "2018-07-27T06:33:07Z")
Hi, I run the logstash via command prompt : logstash -f logstash.conf input { jdbc { jdbc\_driver\_library =\> "C:\\ELASTIC\\sqljdbc\_6.0\\enu\\jre8\\sqljdbc42.jar" jdbc\_driver\_class =\> "com.microsoft.sqlserver.jdbc.SQLServ… --- ## [Logstash output mongodb plugin error](https://discuss.elastic.co/t/logstash-output-mongodb-plugin-error/123442)
**Author:** [@fafahei](https://discuss.elastic.co/u/fafahei)\ **Replies:** 2\ **Last updated:** [March 14, 2018, 5:18pm UTC](https://discuss.elastic.co/t/logstash-output-mongodb-plugin-error/123442 "2018-03-14T17:18:23Z")
when I use logstash to collect data from syslog to mongodb and filter is dissect or grok, logstash log show error and can't transfer data, below is error message: \[2018-03-12T02:16:59,739\]\[WARN \]\[logstash.outputs.mongod… --- ## [ElasticSearch 5.5.0 query regression?](https://discuss.elastic.co/t/elasticsearch-5-5-0-query-regression/95076)
**Author:** [@drippel](https://discuss.elastic.co/u/drippel)\ **Replies:** 2\ **Last updated:** [July 31, 2017, 8:08am UTC](https://discuss.elastic.co/t/elasticsearch-5-5-0-query-regression/95076 "2017-07-31T08:08:18Z")
I index the following document on ElasticSearch 5.5.0: { "\_index": "fts-english", "\_type": "Document", "\_id": "black1", "\_version": 1, "\_score": 1, "\_source": { "streamId": 1, "WordB": "Cat", "WordC": "Dog",… --- ## [Not able to install collate plugin](https://discuss.elastic.co/t/not-able-to-install-collate-plugin/86766)
**Author:** [@deeps123](https://discuss.elastic.co/u/deeps123)\ **Replies:** 2\ **Last updated:** [May 23, 2017, 7:32am UTC](https://discuss.elastic.co/t/not-able-to-install-collate-plugin/86766 "2017-05-23T07:32:06Z")
Hi, With 5.4.0 version of logstash I am not able to install collate plugin. I am getting below errors. Please help. bin/logstash-plugin install logstash-filter-collate Validating logstash-filter-collate Installing lo… --- ## [Can I provide name to a filter in kibana](https://discuss.elastic.co/t/can-i-provide-name-to-a-filter-in-kibana/42986)
**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\ **Replies:** 2\ **Last updated:** [March 1, 2016, 8:53am UTC](https://discuss.elastic.co/t/can-i-provide-name-to-a-filter-in-kibana/42986 "2016-03-01T08:53:43Z")
Hi Experts, I have a very basic requirement , right now I am using 3 filters to create a data table as shown below . Here I am using 3 filters , now I want to provide a name to these filters to make it more understan… --- ## [Kibana markdown not parsing parentheses properly](https://discuss.elastic.co/t/kibana-markdown-not-parsing-parentheses-properly/40916)
**Author:** [@treehouse](https://discuss.elastic.co/u/treehouse)\ **Replies:** 2\ **Last updated:** [February 10, 2016, 5:05am UTC](https://discuss.elastic.co/t/kibana-markdown-not-parsing-parentheses-properly/40916 "2016-02-10T05:05:06Z")
Hi all I reallize Kibana is using the github flavor of markdown. Even still, I'm noticing an inconsistency in creating links, when the urls contain nested parentheses. Kibana markdown widget parses the url up to the fi… --- ## [Using two analyzers stemmer and synonym at a same time](https://discuss.elastic.co/t/using-two-analyzers-stemmer-and-synonym-at-a-same-time/31982)
**Author:** [@adish\_katkar](https://discuss.elastic.co/u/adish_katkar)\ **Replies:** 2\ **Last updated:** [October 19, 2015, 7:09am UTC](https://discuss.elastic.co/t/using-two-analyzers-stemmer-and-synonym-at-a-same-time/31982 "2015-10-19T07:09:29Z")
I have created an index with analyzers stemmer and synonym. I have added a mapping for a field which contains these two analyzers. { "settings": { "index": { "analysis": { "analyzer": { "m… --- ## [Problems with custom\_score (resolved)](https://discuss.elastic.co/t/problems-with-custom-score-resolved/28054)
**Author:** [@djhohnstein](https://discuss.elastic.co/u/djhohnstein)\ **Replies:** 2\ **Last updated:** [August 26, 2015, 3:09pm UTC](https://discuss.elastic.co/t/problems-with-custom-score-resolved/28054 "2015-08-26T15:09:24Z")
Hey there! I'm trying to implement a custom scoring method for my query, and the query looks like this: http://pastebin.com/exLftKpS However, when I view the results of the query, the score attribute on things is None,… --- ## [Valeur dans discovery.zen.ping.unicast.hosts](https://discuss.elastic.co/t/valeur-dans-discovery-zen-ping-unicast-hosts/27379)
**Author:** [@Blured\_Derulb](https://discuss.elastic.co/u/Blured_Derulb)\ **Replies:** 2\ **Last updated:** [August 14, 2015, 8:37am UTC](https://discuss.elastic.co/t/valeur-dans-discovery-zen-ping-unicast-hosts/27379 "2015-08-14T08:37:26Z")
Bonjour, J'ai 2 machines Elastic et je souhaite utiliser de l'unicast. Faut il dans la propriété discovery.zen.ping.unicast.hosts de la première machine mettre le host de la 2ème ? et inversement ? Ou faut il que les… --- ## [Out of memory/heap](https://discuss.elastic.co/t/out-of-memory-heap/9342)
**Author:** [@courtenay](https://discuss.elastic.co/u/courtenay)\ **Replies:** 2\ **Last updated:** [October 16, 2012, 5:08pm UTC](https://discuss.elastic.co/t/out-of-memory-heap/9342 "2012-10-16T17:08:11Z")
Just got this out of memory error: \[08:45:38,311\]\[WARN \]\[http.netty \] \[Portal\] Caught exception while handling client http traffic, closing connection \[id: 0xbfe4192a, /IP-redacted:53149 =\> /IP-redac… --- ## [Aggregation Query filtering on results](https://discuss.elastic.co/t/aggregation-query-filtering-on-results/338343)
**Author:** [@lakhr034](https://discuss.elastic.co/u/lakhr034)\ **Replies:** 8\ **Last updated:** [July 14, 2023, 5:11pm UTC](https://discuss.elastic.co/t/aggregation-query-filtering-on-results/338343 "2023-07-14T17:11:12Z")
I have this query: GET user\_info,user\_auth\_cards\_info/\_search { "size": 0, "aggs": { "sorted\_user\_id": { "terms": { "field": "user\_id", "size": 15 }, "aggs": { "filtered… --- ## [How to transfer data to a host with a username and password](https://discuss.elastic.co/t/how-to-transfer-data-to-a-host-with-a-username-and-password/283161)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 8\ **Last updated:** [September 3, 2021, 11:05am UTC](https://discuss.elastic.co/t/how-to-transfer-data-to-a-host-with-a-username-and-password/283161 "2021-09-03T11:05:13Z")
Hello dear friends. I have a problem. I have been helped by this website in many ways before. First of all, thank you very much for all the help for helping me improve myself on elasticsearch. :slight\_smile: Current pro… --- ## [Defining fields for metricsets](https://discuss.elastic.co/t/defining-fields-for-metricsets/260720)
**Author:** [@efftee](https://discuss.elastic.co/u/efftee)\ **Replies:** 8\ **Last updated:** [January 12, 2021, 9:31pm UTC](https://discuss.elastic.co/t/defining-fields-for-metricsets/260720 "2021-01-12T21:31:29Z")
Hi there, Using a single metricbeat agent to finetune settings before a larger deployment to 3000+ hosts, and trying to contain the number of fields to only those required, I seem to hit a wall at the "metricsets" level… --- ## [Kibana Graph linking does not work with filters](https://discuss.elastic.co/t/kibana-graph-linking-does-not-work-with-filters/234865)
**Author:** [@katara](https://discuss.elastic.co/u/katara)\ **Replies:** 8\ **Last updated:** [June 4, 2020, 9:34am UTC](https://discuss.elastic.co/t/kibana-graph-linking-does-not-work-with-filters/234865 "2020-06-04T09:34:40Z")
Hi I have a Kibana Metric Chart to show the ongoing High proprity incidents. Here is the graph setup, Below is the filter value i provided. \` result.priority: 2 NOT result.state: closed NOT result.state: resolve… --- ## [Security\_exception: action \[cluster:monitor/main\] is unauthorized for user \[user.name\]](https://discuss.elastic.co/t/security-exception-action-cluster-monitor-main-is-unauthorized-for-user-user-name/189823)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 0\ **Last updated:** [July 10, 2019, 4:04pm UTC](https://discuss.elastic.co/t/security-exception-action-cluster-monitor-main-is-unauthorized-for-user-user-name/189823 "2019-07-10T16:04:31Z")
Hello World! I'm trying to authenticate against my cluster, yet running into following security exception: # curl -v --user user.name:password http://localhost:9200/?pretty \* Trying ::1... \* TCP\_NODELAY set \* connect… --- ## [Internal API to query against a shard](https://discuss.elastic.co/t/internal-api-to-query-against-a-shard/182303)
**Author:** [@cecoke](https://discuss.elastic.co/u/cecoke)\ **Replies:** 8\ **Last updated:** [May 24, 2019, 7:48pm UTC](https://discuss.elastic.co/t/internal-api-to-query-against-a-shard/182303 "2019-05-24T19:48:08Z")
Hi Elastic, I wonder if there is any internal API I can use to query against a local shard. My code might be a plugin with a query and the id of a local shard on the node. I want to execute the query on the specified sh… --- ## [Logstash with Jdbc input plugin error](https://discuss.elastic.co/t/logstash-with-jdbc-input-plugin-error/180633)
**Author:** [@danish\_hyt](https://discuss.elastic.co/u/danish_hyt)\ **Replies:** 0\ **Last updated:** [May 11, 2019, 5:39am UTC](https://discuss.elastic.co/t/logstash-with-jdbc-input-plugin-error/180633 "2019-05-11T05:39:54Z")
I am tring to connect mysql workbench 6.3 CE with logstash via jdbc plugin but i am having error which i am unable to figure out research on it but found no fix so that is why i am posting it here. OS: Windows 10 Logst… --- ## [New Install - Security Error](https://discuss.elastic.co/t/new-install-security-error/307549)
**Author:** [@jhop](https://discuss.elastic.co/u/jhop)\ **Replies:** 5\ **Last updated:** [June 22, 2022, 2:11pm UTC](https://discuss.elastic.co/t/new-install-security-error/307549 "2022-06-22T14:11:09Z")
Hi I am new to Elastic. I have just installed Elasticsearch and Kibana. I am able to hit Elasticsearch on my browser. I configured it with basic security. I am now trying to connect with Kibana and I get "Kibana server i… --- ## [Java Agent not showing RMQ while using SimpleRabbitListenerContainerFactory](https://discuss.elastic.co/t/java-agent-not-showing-rmq-while-using-simplerabbitlistenercontainerfactory/270971)
**Author:** [@rainer-funk](https://discuss.elastic.co/u/rainer-funk)\ **Replies:** 5\ **Last updated:** [May 13, 2021, 11:56am UTC](https://discuss.elastic.co/t/java-agent-not-showing-rmq-while-using-simplerabbitlistenercontainerfactory/270971 "2021-05-13T11:56:59Z")
Kibana version: 7.9.3 Elasticsearch version: 7.9.3 APM Server version: 7.9.3 APM Agent language and version: Java 1.22 Browser version: - Original install method: Cloud ELK Description of the problem including expe… --- ## [Duplicate transactions count in elastic apm](https://discuss.elastic.co/t/duplicate-transactions-count-in-elastic-apm/250387)
**Author:** [@Alexey\_Kuplensky](https://discuss.elastic.co/u/Alexey_Kuplensky)\ **Replies:** 5\ **Last updated:** [September 30, 2020, 12:09pm UTC](https://discuss.elastic.co/t/duplicate-transactions-count-in-elastic-apm/250387 "2020-09-30T12:09:45Z")
Kibana version: 7.6.2 Elasticsearch version:7.6.1 APM Server version:7.6.1 APM Agent language and version:1.16.0, 1.17.0, java-agent Browser version: not relevant Original install method (e.g. download page, yum, de… --- ## [Elasticsearch with Java -: Use scroll API for queries written in JSON format](https://discuss.elastic.co/t/elasticsearch-with-java-use-scroll-api-for-queries-written-in-json-format/175363)
**Author:** [@Aditya\_Srivastava](https://discuss.elastic.co/u/Aditya_Srivastava)\ **Replies:** 5\ **Last updated:** [April 7, 2019, 1:15pm UTC](https://discuss.elastic.co/t/elasticsearch-with-java-use-scroll-api-for-queries-written-in-json-format/175363 "2019-04-07T13:15:17Z")
I have a query taken from kibana in JSON format. I have a java code where I am able to fire this same query using RestClient which is working fine. Now the data being fetched is huge and so I want to use the scroll API … --- ## [Access Control](https://discuss.elastic.co/t/access-control/153790)
**Author:** [@MiddlewareTeam](https://discuss.elastic.co/u/MiddlewareTeam)\ **Replies:** 5\ **Last updated:** [November 1, 2018, 6:08am UTC](https://discuss.elastic.co/t/access-control/153790 "2018-11-01T06:08:30Z")
Is it possible to give user based access control to KIBANA dashboard? Like some user is having access to view specific content only and ADMIN is having visibility to all data? Also is is possible to integrate the users… --- ## [Node constantly restarting due to running out of memory... in test environment?](https://discuss.elastic.co/t/node-constantly-restarting-due-to-running-out-of-memory-in-test-environment/76336)
**Author:** [@keybloc](https://discuss.elastic.co/u/keybloc)\ **Replies:** 5\ **Last updated:** [February 25, 2017, 1:43am UTC](https://discuss.elastic.co/t/node-constantly-restarting-due-to-running-out-of-memory-in-test-environment/76336 "2017-02-25T01:43:22Z")
So my two node cluster is constantly restarting due to running out of memory, and its happening in a testing environment, with at most 10 users writing to and searching the database. And now the error reads that all s… --- ## [Possible to set an Alert for Dependency Transaction Failure Rate?](https://discuss.elastic.co/t/possible-to-set-an-alert-for-dependency-transaction-failure-rate/301197)
**Author:** [@Bevaldss](https://discuss.elastic.co/u/Bevaldss)\ **Replies:** 0\ **Last updated:** [March 31, 2022, 1:14pm UTC](https://discuss.elastic.co/t/possible-to-set-an-alert-for-dependency-transaction-failure-rate/301197 "2022-03-31T13:14:07Z")
Hi, We recently started to dig in to how to use Rules and Watcher for Alerts (Elastic Cloud v8.1 very soon, onprem 7.16.x today). Is it possible to set an Alert for Dependency Transaction Failure Rate ? I guess perhap… --- ## [Logstash queue + kafka](https://discuss.elastic.co/t/logstash-queue-kafka/173494)
**Author:** [@paniccontrol](https://discuss.elastic.co/u/paniccontrol)\ **Replies:** 0\ **Last updated:** [March 22, 2019, 1:25pm UTC](https://discuss.elastic.co/t/logstash-queue-kafka/173494 "2019-03-22T13:25:34Z")
Does it make sense to put persistent queue if i already have a kafka in front ? I have logstash consuming my kafka. On this logstash i set up a queue of 50go, and everytime the queue get full. I don't understand why ? … --- ## [Delete index automatically after particular days](https://discuss.elastic.co/t/delete-index-automatically-after-particular-days/287875)
**Author:** [@Divya\_Bansal](https://discuss.elastic.co/u/Divya_Bansal)\ **Replies:** 6\ **Last updated:** [October 28, 2021, 6:47am UTC](https://discuss.elastic.co/t/delete-index-automatically-after-particular-days/287875 "2021-10-28T06:47:39Z")
Hi, I am using Logstash to ingest log data to Elasticsearch, Indices are created daily, that every day's index has a unique name like index\_name-YYYY-MM-DD . So, after 30 days, there will be 30 indices. On day 31st, I w… --- ## ["Clip" extrenous data in the Y Axis](https://discuss.elastic.co/t/clip-extrenous-data-in-the-y-axis/95546)
**Author:** [@Ian\_J\_Plamondon](https://discuss.elastic.co/u/Ian_J_Plamondon)\ **Replies:** 6\ **Last updated:** [August 28, 2017, 9:02pm UTC](https://discuss.elastic.co/t/clip-extrenous-data-in-the-y-axis/95546 "2017-08-28T21:02:50Z")
Hello, I’m a bit new to Kibana 5, and I was hoping someone could help me out. Previously, in Kibana 3, we could clip externous data from the Y access due to recording errors, and “clean up” our graphs. I can’t seem to f… --- ## [Facets on child documents](https://discuss.elastic.co/t/facets-on-child-documents/12726)
**Author:** [@Abhishek\_Andhavarapu](https://discuss.elastic.co/u/Abhishek_Andhavarapu)\ **Replies:** 6\ **Last updated:** [July 9, 2013, 8:10pm UTC](https://discuss.elastic.co/t/facets-on-child-documents/12726 "2013-07-09T20:10:25Z")
Hi, I'm trying to move from nested relations to parent/child relationships as I have to blowup the entire document if I have to udpate the nested documents. I use lots of faceting in the nested documents. In paren… --- ## ['ScrInject' malware was detected](https://discuss.elastic.co/t/scrinject-malware-was-detected/370156)
**Author:** [@GKre](https://discuss.elastic.co/u/GKre)\ **Replies:** 4\ **Last updated:** [November 7, 2024, 8:19pm UTC](https://discuss.elastic.co/t/scrinject-malware-was-detected/370156 "2024-11-07T20:19:25Z")
I am receiving alerts in MS-Defender type " 'ScrInject' malware was detected". The context is elastic-endpoint.exe and some .ndjson files like elastic-agent-event-log-20241103-156.ndjson I made an exclusion as i think… --- ## [ILM policy created and applied but it's not deleting the data](https://discuss.elastic.co/t/ilm-policy-created-and-applied-but-its-not-deleting-the-data/330727)
**Author:** [@elasticlog](https://discuss.elastic.co/u/elasticlog)\ **Replies:** 4\ **Last updated:** [April 28, 2023, 8:27am UTC](https://discuss.elastic.co/t/ilm-policy-created-and-applied-but-its-not-deleting-the-data/330727 "2023-04-28T08:27:45Z")
Hello Experts, I have created the ILM policy and applied to the index . but still it is not deleting the old file. is there anythin i miss or need to add. Please guide me. PUT \_ilm/policy/delete-old-indices { "policy… --- ## [ES sort in server end when given fileds are equal](https://discuss.elastic.co/t/es-sort-in-server-end-when-given-fileds-are-equal/294517)
**Author:** [@LIU\_HAI](https://discuss.elastic.co/u/LIU_HAI)\ **Replies:** 4\ **Last updated:** [January 20, 2022, 11:04am UTC](https://discuss.elastic.co/t/es-sort-in-server-end-when-given-fileds-are-equal/294517 "2022-01-20T11:04:53Z")
Very simple case, I need to sort docs by one field, say, 'money'. What will the order be if the money of several docs are equal. I use filter to query cuz scores are not necessary. Here's my query example: GET /index/\_s… --- ## [After upgrade to Elastic 6.7, watcher execution fails to parse ctx.trigger.triggered\_time in watcher query](https://discuss.elastic.co/t/after-upgrade-to-elastic-6-7-watcher-execution-fails-to-parse-ctx-trigger-triggered-time-in-watcher-query/178094)
**Author:** [@naziyakhan](https://discuss.elastic.co/u/naziyakhan)\ **Replies:** 4\ **Last updated:** [April 24, 2019, 8:54pm UTC](https://discuss.elastic.co/t/after-upgrade-to-elastic-6-7-watcher-execution-fails-to-parse-ctx-trigger-triggered-time-in-watcher-query/178094 "2019-04-24T20:54:30Z")
We have a bunch of Watchers where the Query includes time calculation using ctx.trigger.triggered\_time in the following manner: "filter": \[ { "range": { "@timestam… --- ## [Unable to parse files to logstash](https://discuss.elastic.co/t/unable-to-parse-files-to-logstash/105514)
**Author:** [@Shaswata\_Bisi](https://discuss.elastic.co/u/Shaswata_Bisi)\ **Replies:** 4\ **Last updated:** [October 30, 2017, 7:12am UTC](https://discuss.elastic.co/t/unable-to-parse-files-to-logstash/105514 "2017-10-30T07:12:43Z")
hi. I am new to elastic search. I tried to send log files through file beat into the logstash but I am not getting any outcome in the console. my configuration file is as follows input { beats { host =\> "10.53.56.98" … --- ## [Too many lines on the Y-Axis of my Visualization](https://discuss.elastic.co/t/too-many-lines-on-the-y-axis-of-my-visualization/92580)
**Author:** [@Helix](https://discuss.elastic.co/u/Helix)\ **Replies:** 4\ **Last updated:** [July 14, 2017, 7:23am UTC](https://discuss.elastic.co/t/too-many-lines-on-the-y-axis-of-my-visualization/92580 "2017-07-14T07:23:38Z")
Hello, I already described my problem with the Dashboard Grid here. If it is not possible to make the grid thinner, can I at least set a maximum number of lines on the Y-Axis? My current range is from 0 to 25 GB and I … --- ## [Disable popups on Kibana visualizations](https://discuss.elastic.co/t/disable-popups-on-kibana-visualizations/271064)
**Author:** [@andrask](https://discuss.elastic.co/u/andrask)\ **Replies:** 3\ **Last updated:** [April 23, 2021, 1:18pm UTC](https://discuss.elastic.co/t/disable-popups-on-kibana-visualizations/271064 "2021-04-23T13:18:50Z")
Is there some way to disable the popups on visualizations? I have to be really careful with where I place my mouse pointer to avoid these panels showing up everywhere. They obstruct the view for all visualizations they c… --- ## [Filebeat K8S pod keeps restarting and Logs stop getting to Kibana](https://discuss.elastic.co/t/filebeat-k8s-pod-keeps-restarting-and-logs-stop-getting-to-kibana/263476)
**Author:** [@yimengael](https://discuss.elastic.co/u/yimengael)\ **Replies:** 3\ **Last updated:** [February 9, 2021, 4:41pm UTC](https://discuss.elastic.co/t/filebeat-k8s-pod-keeps-restarting-and-logs-stop-getting-to-kibana/263476 "2021-02-09T16:41:37Z")
Hello, I have configured Filebeat on my Kubernetes cluster and it is running in a kubernetes pod. Sometimes I noticed that Filebeat stopped collecting logs and the pods where filebeat is installed keeps restarting. I i… --- ## [Count API with Group By field](https://discuss.elastic.co/t/count-api-with-group-by-field/187295)
**Author:** [@Gokul\_Raj](https://discuss.elastic.co/u/Gokul_Raj)\ **Replies:** 3\ **Last updated:** [June 27, 2019, 3:32pm UTC](https://discuss.elastic.co/t/count-api-with-group-by-field/187295 "2019-06-27T15:32:03Z")
For my application I'm using count API provided by elasticsearch for getting the aggregate value for my search queries in Java using RestHighLevel Client. However I'm facing a situation where I need to get the aggregate … --- ## [Traducir un group by dentro de otro group by para obtener averages](https://discuss.elastic.co/t/traducir-un-group-by-dentro-de-otro-group-by-para-obtener-averages/153305)
**Author:** [@enkil2003](https://discuss.elastic.co/u/enkil2003)\ **Replies:** 3\ **Last updated:** [October 23, 2018, 12:53pm UTC](https://discuss.elastic.co/t/traducir-un-group-by-dentro-de-otro-group-by-para-obtener-averages/153305 "2018-10-23T12:53:54Z")
No estoy pudiendo encontrar la solucion para algo que parece simple. Estoy traduciendo una busqueda de splunk que hace lo siguiente | bucket \_time span=1s | stats count by \_time marca operacion | stats min(count) as … --- ## [\[6.1.1\] Machine Learning Job: reanalyse datapoints / ignore last bucket](https://discuss.elastic.co/t/6-1-1-machine-learning-job-reanalyse-datapoints-ignore-last-bucket/149159)
**Author:** [@gmatheus](https://discuss.elastic.co/u/gmatheus)\ **Replies:** 3\ **Last updated:** [September 21, 2018, 1:01pm UTC](https://discuss.elastic.co/t/6-1-1-machine-learning-job-reanalyse-datapoints-ignore-last-bucket/149159 "2018-09-21T13:01:56Z")
Hi! I'm trying to configure my ML Job + Watcher in a specific ingestion scenario: Ingestions occurs once in a day and the events timestamps are aggregated in the beginning of the day. The daily ingestion updates the d… --- ## [Problem with Output section](https://discuss.elastic.co/t/problem-with-output-section/78786)
**Author:** [@GregMeadows](https://discuss.elastic.co/u/GregMeadows)\ **Replies:** 3\ **Last updated:** [March 16, 2017, 5:31am UTC](https://discuss.elastic.co/t/problem-with-output-section/78786 "2017-03-16T05:31:47Z")
I am building a conf file to use a template for all other csv ingestion to ES indexes I need. This conf was working (in a simpler) form and is based on a v2 dev logstash install. Question... Has the syntax changed when… --- ## [When i use analyzer default as type keyword then it not search uppercase data](https://discuss.elastic.co/t/when-i-use-analyzer-default-as-type-keyword-then-it-not-search-uppercase-data/53933)
**Author:** [@ajay\_rathod](https://discuss.elastic.co/u/ajay_rathod)\ **Replies:** 3\ **Last updated:** [June 27, 2016, 7:44am UTC](https://discuss.elastic.co/t/when-i-use-analyzer-default-as-type-keyword-then-it-not-search-uppercase-data/53933 "2016-06-27T07:44:09Z")
this is my index with settings and mapping PUT /demo?update\_all\_types=true { "settings": { "index": { "indices": { "fielddata": { "cache": { … [Previous page](https://discuss.elastic.co/top.md?page=1563&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1565&per_page=50&period=all)