# Top

**URL:** https://discuss.elastic.co/top.md?page=1588&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1589

---

## [Logstash kafka output plugin not behaving according to documentation](https://discuss.elastic.co/t/logstash-kafka-output-plugin-not-behaving-according-to-documentation/185280)

<div class="topic-metadata">

**Author:** [@preddy75](https://discuss.elastic.co/u/preddy75)\
**Replies:** 1\
**Last updated:** [June 14, 2019, 3:49pm UTC](https://discuss.elastic.co/t/logstash-kafka-output-plugin-not-behaving-according-to-documentation/185280 "2019-06-14T15:49:09Z")

</div>

I cannot get logstash-kafka output plugin to work with basic auth. I am using below, but it will not let me do it because it insists on on a keyfile to be specified: logstash output config: output { if "kafka" in …

---

## [ES java invoked oom-killer](https://discuss.elastic.co/t/es-java-invoked-oom-killer/170829)

<div class="topic-metadata">

**Author:** [@essmart](https://discuss.elastic.co/u/essmart)\
**Replies:** 1\
**Last updated:** [March 25, 2019, 6:03am UTC](https://discuss.elastic.co/t/es-java-invoked-oom-killer/170829 "2019-03-25T06:03:56Z")

</div>

Hello! Elasticsearch version: 5.2.2 JVM version: 1.8.0\_144-b01 OS version: Ubuntu 16.04.1 LTS Kernel version: 4.10.0-32-generic #36~16.04.1-Ubuntu RAM: 64GB JVM heap min and max settings: 31GB Cluster Elasticsearc…

---

## [Error registering plugin {:pipeline\_id=\>".monitoring-logstash"](https://discuss.elastic.co/t/error-registering-plugin-pipeline-id-monitoring-logstash/128575)

<div class="topic-metadata">

**Author:** [@dchan08](https://discuss.elastic.co/u/dchan08)\
**Replies:** 1\
**Last updated:** [April 18, 2018, 4:15pm UTC](https://discuss.elastic.co/t/error-registering-plugin-pipeline-id-monitoring-logstash/128575 "2018-04-18T16:15:05Z")

</div>

\[2018-04-18T11:11:16,314\]\[INFO \]\[logstash.pipeline \] Starting pipeline {:pipeline\_id=\>".monitoring-logstash", "pipeline.workers"=\>1, "pipeline.batch.size"=\>2, "pipeline.batch.delay"=\>50} \[2018-04-18T11:11:16,321\]…

---

## [How logstash work?](https://discuss.elastic.co/t/how-logstash-work/124479)

<div class="topic-metadata">

**Author:** [@retxedue](https://discuss.elastic.co/u/retxedue)\
**Replies:** 7\
**Last updated:** [April 3, 2018, 10:55am UTC](https://discuss.elastic.co/t/how-logstash-work/124479 "2018-04-03T10:55:43Z")

</div>

I want to understand if i enabled logatash service via systemctl. How often does it read the logstash config i created? Is there a way i can increase frequency of reading the config file i made?

---

## [Separate Kibana index](https://discuss.elastic.co/t/separate-kibana-index/114086)

<div class="topic-metadata">

**Author:** [@Hassan\_Shaitou](https://discuss.elastic.co/u/Hassan_Shaitou)\
**Replies:** 1\
**Last updated:** [January 4, 2018, 4:12pm UTC](https://discuss.elastic.co/t/separate-kibana-index/114086 "2018-01-04T16:12:39Z")

</div>

I installed x-pack on kibna and elasticsearch, yet x-pack didn't accomplish dashboard separations. So, I am asking if there is a way to separate dashboards for different users.

---

## [Deleting index with curator not freeing the disk space](https://discuss.elastic.co/t/deleting-index-with-curator-not-freeing-the-disk-space/107909)

<div class="topic-metadata">

**Author:** [@carlosR](https://discuss.elastic.co/u/carlosR)\
**Replies:** 1\
**Last updated:** [November 16, 2017, 2:05pm UTC](https://discuss.elastic.co/t/deleting-index-with-curator-not-freeing-the-disk-space/107909 "2017-11-16T14:05:05Z")

</div>

Hello I have a job that deletes elastic indices per hour using the curator. It has been working fine, old shards and index are gone but when I check the amount of free space I have... it is less and less. Is there anyth…

---

## [Aggregation not working on Scripted field](https://discuss.elastic.co/t/aggregation-not-working-on-scripted-field/99430)

<div class="topic-metadata">

**Author:** [@shaktigupta200](https://discuss.elastic.co/u/shaktigupta200)\
**Replies:** 1\
**Last updated:** [September 6, 2017, 4:45pm UTC](https://discuss.elastic.co/t/aggregation-not-working-on-scripted-field/99430 "2017-09-06T16:45:09Z")

</div>

Hi Folks, I am trying to perform bucket aggregation on scripted field but getting empty result while search result are coming fine but not aggregation result. "aggregations": { "level": { "doc\_count\_error\_upp…

---

## [Logstash mssql config](https://discuss.elastic.co/t/logstash-mssql-config/90892)

<div class="topic-metadata">

**Author:** [@vanithapg](https://discuss.elastic.co/u/vanithapg)\
**Replies:** 1\
**Last updated:** [June 27, 2017, 5:41am UTC](https://discuss.elastic.co/t/logstash-mssql-config/90892 "2017-06-27T05:41:09Z")

</div>

This is the error im getting when i run this code C:\\elk\\logstash\\bin\>logstash -f ..\\conf\\mmsdb.conf Sending Logstash's logs to C:/elk/logstash/logs which is now configured via log4 j2.properties \[2017-06-26T19:21:42,…

---

## [Host static website with Elasticsearch autocomplete feature](https://discuss.elastic.co/t/host-static-website-with-elasticsearch-autocomplete-feature/84369)

<div class="topic-metadata">

**Author:** [@saintbiz](https://discuss.elastic.co/u/saintbiz)\
**Replies:** 1\
**Last updated:** [May 4, 2017, 10:52am UTC](https://discuss.elastic.co/t/host-static-website-with-elasticsearch-autocomplete-feature/84369 "2017-05-04T10:52:36Z")

</div>

Hi, Currently, I am building a website with Autocomplete plugin. The data is coming from a JSON file. This JSON file has millions of product information. Using the plugin is not feasible. I am thinking to convert the JS…

---

## [Custom Similarity in plugin](https://discuss.elastic.co/t/custom-similarity-in-plugin/50745)

<div class="topic-metadata">

**Author:** [@Aurelien\_3](https://discuss.elastic.co/u/Aurelien_3)\
**Replies:** 1\
**Last updated:** [May 23, 2016, 6:20pm UTC](https://discuss.elastic.co/t/custom-similarity-in-plugin/50745 "2016-05-23T18:20:59Z")

</div>

Hi, I tried to use a custom similarity in a plugin to score with payload. To do so I extended ClassicSimilarity and redefined scorePayload. Once the plugin is deployed, the score does not change with payload. Actually…

---

## [Query inside a filter?](https://discuss.elastic.co/t/query-inside-a-filter/45185)

<div class="topic-metadata">

**Author:** [@Vicente\_de\_Rivera\_II](https://discuss.elastic.co/u/Vicente_de_Rivera_II)\
**Replies:** 1\
**Last updated:** [March 24, 2016, 8:51am UTC](https://discuss.elastic.co/t/query-inside-a-filter/45185 "2016-03-24T08:51:37Z")

</div>

Below is the json passed into elasticsearch js client. Is the query\_string treated as query here? How do I declare it as a filter? How come this works given that my top element is filter? { "index": "inde…

---

## [Logstash forwarder with multiple log source types](https://discuss.elastic.co/t/logstash-forwarder-with-multiple-log-source-types/39801)

<div class="topic-metadata">

**Author:** [@dirtdiver512](https://discuss.elastic.co/u/dirtdiver512)\
**Replies:** 1\
**Last updated:** [January 21, 2016, 6:25pm UTC](https://discuss.elastic.co/t/logstash-forwarder-with-multiple-log-source-types/39801 "2016-01-21T18:25:09Z")

</div>

All, I have two log types I am trying to forward using the forwarder. One is a plain log and the other is a json fie. I need to be able to have ELK parse them differently but can not figure out how. For the json fil…

---

## [Ganglia Mapping conflict](https://discuss.elastic.co/t/ganglia-mapping-conflict/28553)

<div class="topic-metadata">

**Author:** [@JoelC](https://discuss.elastic.co/u/JoelC)\
**Replies:** 1\
**Last updated:** [September 3, 2015, 6:18am UTC](https://discuss.elastic.co/t/ganglia-mapping-conflict/28553 "2015-09-03T06:18:48Z")

</div>

I have successfully setup Ganglia and logstash to feed into elasticsearch. The issue I am having is that Ganglia data has multiple types (string, float,etc) for the 'value' field in Kibana. My assumption is that I should…

---

## [Accessing doc score in a native (Java) script](https://discuss.elastic.co/t/accessing-doc-score-in-a-native-java-script/9853)

<div class="topic-metadata">

**Author:** [@Ryan\_Hill](https://discuss.elastic.co/u/Ryan_Hill)\
**Replies:** 7\
**Last updated:** [February 6, 2013, 9:11am UTC](https://discuss.elastic.co/t/accessing-doc-score-in-a-native-java-script/9853 "2013-02-06T09:11:46Z")

</div>

It seems that under normal search conditions, that calling doc().score() from a Java script will result in an uncaught exception (since the scorer is null). For instance, a simple query on the twitter example data…

---

## [Continuously get data from Elasticsearch, when new poll data comes in](https://discuss.elastic.co/t/continuously-get-data-from-elasticsearch-when-new-poll-data-comes-in/339254)

<div class="topic-metadata">

**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\
**Replies:** 3\
**Last updated:** [August 21, 2023, 8:22am UTC](https://discuss.elastic.co/t/continuously-get-data-from-elasticsearch-when-new-poll-data-comes-in/339254 "2023-08-21T08:22:56Z")

</div>

Hi, I am creating an external plugin in Kibana 8.1.1 using React. I am retrieving the data I have in ES using the data plugin. Is it possible to fetch and update the plugin state as and when data is inserted into the i…

---

## [How to get results from another results field value](https://discuss.elastic.co/t/how-to-get-results-from-another-results-field-value/300014)

<div class="topic-metadata">

**Author:** [@Shushil\_Shankar](https://discuss.elastic.co/u/Shushil_Shankar)\
**Replies:** 3\
**Last updated:** [March 25, 2022, 7:04am UTC](https://discuss.elastic.co/t/how-to-get-results-from-another-results-field-value/300014 "2022-03-25T07:04:41Z")

</div>

Hi Everyone, I need to implement a query when the results are returned, from that I need to take one field value then need to get another result from the field, From the above screenshot, I got some results based on …

---

## [Failed to start elastic search](https://discuss.elastic.co/t/failed-to-start-elastic-search/278899)

<div class="topic-metadata">

**Author:** [@Jedrick](https://discuss.elastic.co/u/Jedrick)\
**Replies:** 3\
**Last updated:** [July 18, 2021, 9:24am UTC](https://discuss.elastic.co/t/failed-to-start-elastic-search/278899 "2021-07-18T09:24:36Z")

</div>

Hi, Good day. Can you help me with my problem with elastic search? Currently, i am building a Wazuh siem that uses elastic search functions. As I checked, Filebeat, kibana services are running. But the elasticsearch …

---

## [Logstash経由でのレコード転送が不完全に繰り返される](https://discuss.elastic.co/t/logstash/226507)

<div class="topic-metadata">

**Author:** [@sogaoh](https://discuss.elastic.co/u/sogaoh)\
**Replies:** 3\
**Last updated:** [April 14, 2020, 4:12pm UTC](https://discuss.elastic.co/t/logstash/226507 "2020-04-14T16:12:22Z")

</div>

と同一の以下環境で Logstash経由での400万件のレコード転送が240万件程しかされない という状況となっており、打開策を模索しています。 logstash:7.6.1 ( Docker ) AWS RDS (MySQL 5.7.12) AWS Elasticsearch (7.1) 同様の状況にご経験がある、あるいは何か効果的な対策が浮かぶ、等あれば ご提示いただけると大変ありがたいと思い、投稿する次第です。 よ…

---

## [Shipping to Logstash vs Elasticsearch, and pipelines. Also modules?](https://discuss.elastic.co/t/shipping-to-logstash-vs-elasticsearch-and-pipelines-also-modules/203089)

<div class="topic-metadata">

**Author:** [@hueyg](https://discuss.elastic.co/u/hueyg)\
**Replies:** 3\
**Last updated:** [October 17, 2019, 3:53am UTC](https://discuss.elastic.co/t/shipping-to-logstash-vs-elasticsearch-and-pipelines-also-modules/203089 "2019-10-17T03:53:27Z")

</div>

Sorry for the rambling topic, but I am falling down a rabbit hole. Once I feel like a get a handle on ELK terminology and infrastructure the floor drops. I have never completely understood why you would ship a beat dir…

---

## [Monitoring Machine-Learning job with Nagios](https://discuss.elastic.co/t/monitoring-machine-learning-job-with-nagios/158741)

<div class="topic-metadata">

**Author:** [@Rohlik](https://discuss.elastic.co/u/Rohlik)\
**Replies:** 3\
**Last updated:** [November 30, 2018, 4:28pm UTC](https://discuss.elastic.co/t/monitoring-machine-learning-job-with-nagios/158741 "2018-11-30T16:28:48Z")

</div>

Hello dear community and Elastic staff :slight\_smile: Our use case: We want deploy real-time Machine Learning job and be notified if some non-standard peak occur. We are using Nagios software for alerting and we don't …

---

## [Behaviour of match phrase query on english analyzed fields with stopwords](https://discuss.elastic.co/t/behaviour-of-match-phrase-query-on-english-analyzed-fields-with-stopwords/155210)

<div class="topic-metadata">

**Author:** [@Jaspreet\_Singh](https://discuss.elastic.co/u/Jaspreet_Singh)\
**Replies:** 3\
**Last updated:** [November 21, 2018, 6:30pm UTC](https://discuss.elastic.co/t/behaviour-of-match-phrase-query-on-english-analyzed-fields-with-stopwords/155210 "2018-11-21T18:30:52Z")

</div>

Hi, I wanted to confirm a weird behaviour im observing when using match\_phrase query on english analyzed fields with stopwords. Assume my search string is analytics and prediction. Assume again, when searching against…

---

## [Elasticsearch 6.2.2 Docker containers isn't setting correct storage size](https://discuss.elastic.co/t/elasticsearch-6-2-2-docker-containers-isnt-setting-correct-storage-size/123940)

<div class="topic-metadata">

**Author:** [@whiranpat](https://discuss.elastic.co/u/whiranpat)\
**Replies:** 3\
**Last updated:** [March 16, 2018, 2:30pm UTC](https://discuss.elastic.co/t/elasticsearch-6-2-2-docker-containers-isnt-setting-correct-storage-size/123940 "2018-03-16T14:30:53Z")

</div>

Method of setting up the volume for elasticsearch for docker containers seems to change between version. We have a 128GB drive dedicated to the docker volume directory. We want to create presistant storage to the contain…

---

## [Role mapping and Custom Security realm](https://discuss.elastic.co/t/role-mapping-and-custom-security-realm/115491)

<div class="topic-metadata">

**Author:** [@gsu](https://discuss.elastic.co/u/gsu)\
**Replies:** 3\
**Last updated:** [January 22, 2018, 9:41am UTC](https://discuss.elastic.co/t/role-mapping-and-custom-security-realm/115491 "2018-01-22T09:41:58Z")

</div>

As I understand it the role mapping API allows me to create mappings that (currently?) only the LDAP and AD authentication realms use. If I want to implement my own custom authentication realm I have to do the role mapp…

---

## [Need help how to index with template in LogStash](https://discuss.elastic.co/t/need-help-how-to-index-with-template-in-logstash/87003)

<div class="topic-metadata">

**Author:** [@marcogoldin](https://discuss.elastic.co/u/marcogoldin)\
**Replies:** 3\
**Last updated:** [May 25, 2017, 12:17pm UTC](https://discuss.elastic.co/t/need-help-how-to-index-with-template-in-logstash/87003 "2017-05-25T12:17:07Z")

</div>

Hi, i'm new to LogStash and i'm trying to index from a csv. I really can't understand what is going on, tried many solutions but LogStash keep stopping the pipeline. here's my .conf input { file { path =\>…

---

## [How can i send the backup start time and end time to azure cloud storage table?](https://discuss.elastic.co/t/how-can-i-send-the-backup-start-time-and-end-time-to-azure-cloud-storage-table/84883)

<div class="topic-metadata">

**Author:** [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\
**Replies:** 3\
**Last updated:** [May 8, 2017, 5:34pm UTC](https://discuss.elastic.co/t/how-can-i-send-the-backup-start-time-and-end-time-to-azure-cloud-storage-table/84883 "2017-05-08T17:34:48Z")

</div>

Hi, To do my backup and restore i am using curator 4.2.6 and sending the all the snapshots to azure blob storage account through azure cloud plugin 2.4.1 but what i need is 1) I need to send the snapshot start time a…

---

## [Why is the GET API not holding to it's realtime promise?](https://discuss.elastic.co/t/why-is-the-get-api-not-holding-to-its-realtime-promise/70224)

<div class="topic-metadata">

**Author:** [@BrianV](https://discuss.elastic.co/u/BrianV)\
**Replies:** 3\
**Last updated:** [December 30, 2016, 4:57pm UTC](https://discuss.elastic.co/t/why-is-the-get-api-not-holding-to-its-realtime-promise/70224 "2016-12-30T16:57:01Z")

</div>

Elasticsearch Version: 2.4 We have 3 master nodes and 2 data nodes. Our index has 8 shards and 1 replica. Our nodes are hosted on EC2. The below is from our (at the time mostly empty) staging deployment. Our production …

---

## [Analyze\_wildcard and allow\_leading\_wildcard for URI search](https://discuss.elastic.co/t/analyze-wildcard-and-allow-leading-wildcard-for-uri-search/25460)

<div class="topic-metadata">

**Author:** [@andimak](https://discuss.elastic.co/u/andimak)\
**Replies:** 0\
**Last updated:** [July 13, 2015, 4:01pm UTC](https://discuss.elastic.co/t/analyze-wildcard-and-allow-leading-wildcard-for-uri-search/25460 "2015-07-13T16:01:43Z")

</div>

Hi there, I don't understand how URI Search are mapped to query string. I read this two links: https://www.elastic.co/guide/en/elasticsearch/reference/1.6/query-dsl-query-string-query.html AND https://www.elastic.co/…

---

## [Indexing is freeze any time while indexing the 5 crore data](https://discuss.elastic.co/t/indexing-is-freeze-any-time-while-indexing-the-5-crore-data/172245)

<div class="topic-metadata">

**Author:** [@Sweta\_Singh](https://discuss.elastic.co/u/Sweta_Singh)\
**Replies:** 8\
**Last updated:** [March 15, 2019, 11:58am UTC](https://discuss.elastic.co/t/indexing-is-freeze-any-time-while-indexing-the-5-crore-data/172245 "2019-03-15T11:58:30Z")

</div>

Hi, Actually i am indexing 5 crore data into my vm ware elastic server from SQL server using log-stash ,creating the 9 index with 1 primary shard and 1 replica shard and running the Multipipeline in pipeline.yml file …

---

## [ES OutOfMemoryError while indexing a large number of attachments](https://discuss.elastic.co/t/es-outofmemoryerror-while-indexing-a-large-number-of-attachments/7182)

<div class="topic-metadata">

**Author:** [@Shane\_Witbeck](https://discuss.elastic.co/u/Shane_Witbeck)\
**Replies:** 8\
**Last updated:** [April 3, 2012, 4:09pm UTC](https://discuss.elastic.co/t/es-outofmemoryerror-while-indexing-a-large-number-of-attachments/7182 "2012-04-03T16:09:57Z")

</div>

I've been working to stabilze a process where I need to index ~16K attachments. The following is the latest result: https://gist.github.com/2252398 I'm running ES with ES\_HEAP\_SIZE=2g but still running into an is…

---

## [Must\_Not aggregation double counting items](https://discuss.elastic.co/t/must-not-aggregation-double-counting-items/209198)

<div class="topic-metadata">

**Author:** [@ad\_rip](https://discuss.elastic.co/u/ad_rip)\
**Replies:** 0\
**Last updated:** [November 24, 2019, 7:41pm UTC](https://discuss.elastic.co/t/must-not-aggregation-double-counting-items/209198 "2019-11-24T19:41:45Z")

</div>

I'm hoping this is the right place to ask this. I've been trying to use a must\_not filter to get a count of all the items that don't contain a contain a specific field, but unfortunately the count is much higher than t…

---

## [Elasticsearch for Apache Hadoop 2.3.0 and 2.2.1 released](https://discuss.elastic.co/t/elasticsearch-for-apache-hadoop-2-3-0-and-2-2-1-released/46842)

<div class="topic-metadata">

**Author:** [@costin](https://discuss.elastic.co/u/costin)\
**Replies:** 0\
**Last updated:** [April 8, 2016, 7:40pm UTC](https://discuss.elastic.co/t/elasticsearch-for-apache-hadoop-2-3-0-and-2-2-1-released/46842 "2016-04-08T19:40:15Z")

</div>

ES-Hadoop 2.3.0 has been released. All ES-Hadoop 2.0.x and 2.1.x users are recommended to upgrade to it. Additionally, ES-Hadoop 2.2.1 was released. Read more about these releases in this blog post

---

## [Connect to host error using php client - any ideas?](https://discuss.elastic.co/t/connect-to-host-error-using-php-client-any-ideas/27662)

<div class="topic-metadata">

**Author:** [@rsmarshall](https://discuss.elastic.co/u/rsmarshall)\
**Replies:** 0\
**Last updated:** [August 19, 2015, 10:02am UTC](https://discuss.elastic.co/t/connect-to-host-error-using-php-client-any-ideas/27662 "2015-08-19T10:02:18Z")

</div>

At what seems like random intervals I am seeing the following error in my application logs: RROR: exception 'Elasticsearch\\Common\\Exceptions\\Curl\\CouldNotConnectToHost' with message 'couldn't connect to host' It's in…

---

## [What is faster: index or update with doc\_as\_upsert and detect\_noop](https://discuss.elastic.co/t/what-is-faster-index-or-update-with-doc-as-upsert-and-detect-noop/241)

<div class="topic-metadata">

**Author:** [@Anton\_Bogdanovich](https://discuss.elastic.co/u/Anton_Bogdanovich)\
**Replies:** 0\
**Last updated:** [May 5, 2015, 5:24pm UTC](https://discuss.elastic.co/t/what-is-faster-index-or-update-with-doc-as-upsert-and-detect-noop/241 "2015-05-05T17:24:12Z")

</div>

I have a parent-child document mapping and parent document have only one id field. And I need to make sure that this parent document exists when I insert new child document. It may or may not be already existing. So …

---

## [How to show the values for destination port?](https://discuss.elastic.co/t/how-to-show-the-values-for-destination-port/284196)

<div class="topic-metadata">

**Author:** [@Wooden\_tree](https://discuss.elastic.co/u/Wooden_tree)\
**Replies:** 2\
**Last updated:** [September 20, 2021, 1:38pm UTC](https://discuss.elastic.co/t/how-to-show-the-values-for-destination-port/284196 "2021-09-20T13:38:24Z")

</div>

Hello, We examine our Firewall logs related to a vulnerability scanner and we’d like to have a stats on ports it uses (destination.port) to adjust the Firewall configuration. So we’d like to have a table showing us all …

---

## [Process multiple Dead Letter Queues with one pipeline](https://discuss.elastic.co/t/process-multiple-dead-letter-queues-with-one-pipeline/253430)

<div class="topic-metadata">

**Author:** [@michielw](https://discuss.elastic.co/u/michielw)\
**Replies:** 2\
**Last updated:** [October 28, 2020, 2:11pm UTC](https://discuss.elastic.co/t/process-multiple-dead-letter-queues-with-one-pipeline/253430 "2020-10-28T14:11:38Z")

</div>

In our Elastic environment we use multiple pipelines on a single Logstash instance. Also, we enabled the Dead Letter Queue on all these pipelines. On creating the pipeline to process events in the DLQs I noticed I need t…

---

## [What field are used to populate the entire SIEM APP](https://discuss.elastic.co/t/what-field-are-used-to-populate-the-entire-siem-app/209263)

<div class="topic-metadata">

**Author:** [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)\
**Replies:** 2\
**Last updated:** [December 3, 2019, 9:42am UTC](https://discuss.elastic.co/t/what-field-are-used-to-populate-the-entire-siem-app/209263 "2019-12-03T09:42:01Z")

</div>

Hii Everyone, I am trying to map the fields used in my index to the ECS fields so that it gets populated in the SIEM APP. I have mapped fields like username , hostname and event action with the ECS fields and its gettin…

---

## [Netflow data ingested but not showing under SIEM | Network](https://discuss.elastic.co/t/netflow-data-ingested-but-not-showing-under-siem-network/188897)

<div class="topic-metadata">

**Author:** [@involuntary-pretzel](https://discuss.elastic.co/u/involuntary-pretzel)\
**Replies:** 2\
**Last updated:** [July 4, 2019, 12:30pm UTC](https://discuss.elastic.co/t/netflow-data-ingested-but-not-showing-under-siem-network/188897 "2019-07-04T12:30:35Z")

</div>

Hi I have a fresh install of logstash 7.2 with netflow configure following the /home/tutorial/netflow tutorial, and its pushing data to elastic.cloud (7.2) sucessfully. The Dashboard Netflow: Overview work great and no …

---

## [Filebeat agent configuration for two different endpoint(logstash ,kafka clusters)](https://discuss.elastic.co/t/filebeat-agent-configuration-for-two-different-endpoint-logstash-kafka-clusters/168863)

<div class="topic-metadata">

**Author:** [@msina](https://discuss.elastic.co/u/msina)\
**Replies:** 2\
**Last updated:** [February 21, 2019, 4:09pm UTC](https://discuss.elastic.co/t/filebeat-agent-configuration-for-two-different-endpoint-logstash-kafka-clusters/168863 "2019-02-21T16:09:53Z")

</div>

Hi, I have one apache HTTPD server and filebeat is already installed there and sending few specific logs to our internal logstatsh server. currently it is sending logs to our internal logstash server are /var/log/htt…

---

## [“reason”: “action \[cluster:monitor/task/get\] is unauthorized for user \[X\]”](https://discuss.elastic.co/t/reason-action-cluster-monitor-task-get-is-unauthorized-for-user-x/147464)

<div class="topic-metadata">

**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\
**Replies:** 2\
**Last updated:** [September 6, 2018, 2:15pm UTC](https://discuss.elastic.co/t/reason-action-cluster-monitor-task-get-is-unauthorized-for-user-x/147464 "2018-09-06T14:15:37Z")

</div>

I'm using Elastic Stack 6.4.0 and while trying to look up status for current task via Dev Tools (in Kibana) with non-superadmin user, I'm getting following error: “reason”: “action \[cluster:monitor/task/get\] is unautho…

---

## [No consigo vizualizar los datos que llegan a ElasticSearch](https://discuss.elastic.co/t/no-consigo-vizualizar-los-datos-que-llegan-a-elasticsearch/136839)

<div class="topic-metadata">

**Author:** [@CNUNES](https://discuss.elastic.co/u/CNUNES)\
**Replies:** 2\
**Last updated:** [July 13, 2018, 6:24pm UTC](https://discuss.elastic.co/t/no-consigo-vizualizar-los-datos-que-llegan-a-elasticsearch/136839 "2018-07-13T18:24:47Z")

</div>

Hola, buenos dias, les escribo para comentarles un problema que tengo con ElasticSearch; es el siguiente; 1 mware: Kibana & ElasticSearch 2 mware: Netdata & PacketBeats ambas hablan entre si y con salida a internet; a…

---

## [Delta based on running total](https://discuss.elastic.co/t/delta-based-on-running-total/126169)

<div class="topic-metadata">

**Author:** [@danfranks](https://discuss.elastic.co/u/danfranks)\
**Replies:** 2\
**Last updated:** [March 30, 2018, 3:26am UTC](https://discuss.elastic.co/t/delta-based-on-running-total/126169 "2018-03-30T03:26:00Z")

</div>

Hello, I'm a bit new to elastic and am probably missing something simple. I'm trying to figure out how to display a range of dates with their associated numerical values plus one calculated field that takes the differe…

---

## [QueryBuilder serialization](https://discuss.elastic.co/t/querybuilder-serialization/59747)

<div class="topic-metadata">

**Author:** [@mahdi\_malaki](https://discuss.elastic.co/u/mahdi_malaki)\
**Replies:** 2\
**Last updated:** [September 4, 2016, 9:37pm UTC](https://discuss.elastic.co/t/querybuilder-serialization/59747 "2016-09-04T21:37:57Z")

</div>

I need to serialize QueryBuilder in my app. I am wondering why don't QueryBuilder implement Serializable? I am looking for a way to store/retrieve QueryBuilder Objects.

---

## [Import Dashboard](https://discuss.elastic.co/t/import-dashboard/49668)

<div class="topic-metadata">

**Author:** [@Christian16](https://discuss.elastic.co/u/Christian16)\
**Replies:** 2\
**Last updated:** [May 10, 2016, 8:41pm UTC](https://discuss.elastic.co/t/import-dashboard/49668 "2016-05-10T20:41:56Z")

</div>

Hello, I'm trying to import a Dashboard. But some visualization won't be import : Saved Objects: Could not locate that index-pattern-field Is this mandatory to have the index-pattern-field present in the index ? It's v…

---

## [Best way to load initial data to new node?](https://discuss.elastic.co/t/best-way-to-load-initial-data-to-new-node/44697)

<div class="topic-metadata">

**Author:** [@Xavier\_TROMP](https://discuss.elastic.co/u/Xavier_TROMP)\
**Replies:** 2\
**Last updated:** [March 18, 2016, 8:25am UTC](https://discuss.elastic.co/t/best-way-to-load-initial-data-to-new-node/44697 "2016-03-18T08:25:43Z")

</div>

Hello everyone, I am wondering how to correctly load initial data to a new node. Say I have 1 master node and I want to add 2 data nodes. My master node is continuously indexed, but I have a backup made with elastics…

---

## [\[ QUERY STRING \] Champs multiple & operator "AND"](https://discuss.elastic.co/t/query-string-champs-multiple-operator-and/27130)

<div class="topic-metadata">

**Author:** [@Tchinkatchuk](https://discuss.elastic.co/u/Tchinkatchuk)\
**Replies:** 2\
**Last updated:** [August 10, 2015, 4:42pm UTC](https://discuss.elastic.co/t/query-string-champs-multiple-operator-and/27130 "2015-08-10T16:42:47Z")

</div>

Bonjour à tous, Petite question surement toute simple. J'utilise une query de type QueryString sur plusieurs champs. Je voulais ajouter l'opérateur "AND" mais évidemment cela oblige tous les mots être présent dans le m…

---

## [Please help, detailed steps to upgrade from Kibana 3 to 4.1.1](https://discuss.elastic.co/t/please-help-detailed-steps-to-upgrade-from-kibana-3-to-4-1-1/25690)

<div class="topic-metadata">

**Author:** [@rthorntn](https://discuss.elastic.co/u/rthorntn)\
**Replies:** 2\
**Last updated:** [July 18, 2015, 4:12am UTC](https://discuss.elastic.co/t/please-help-detailed-steps-to-upgrade-from-kibana-3-to-4-1-1/25690 "2015-07-18T04:12:31Z")

</div>

Hi, I can't find any upgrade documents anywhere. So I have upgraded Logstash and ES using the deb and apt-get respectively. I have downloaded and extracted the kibana 4.1.1 tar.gz and now I am stuck. It looks lik…

---

## [Kibana Visualization Data To Python](https://discuss.elastic.co/t/kibana-visualization-data-to-python/319093)

<div class="topic-metadata">

**Author:** [@hi\_xavier](https://discuss.elastic.co/u/hi_xavier)\
**Replies:** 4\
**Last updated:** [December 5, 2022, 6:29pm UTC](https://discuss.elastic.co/t/kibana-visualization-data-to-python/319093 "2022-12-05T18:29:29Z")

</div>

Hello, We currently have a visualization (table) in Kibana that displays success rates. Is it possible to retrieve the data from this table using python?

---

## [Transition time old to new licence](https://discuss.elastic.co/t/transition-time-old-to-new-licence/305394)

<div class="topic-metadata">

**Author:** [@smm](https://discuss.elastic.co/u/smm)\
**Replies:** 1\
**Last updated:** [May 24, 2022, 12:46am UTC](https://discuss.elastic.co/t/transition-time-old-to-new-licence/305394 "2022-05-24T00:46:38Z")

</div>

Dear Elastic, I have a basic question: What does happen if a gold licence in an onpremises cluster runs out of time (and only e.g. a week later) the new license gets appied? What does not funtion in that 'transition we…

---

## [ElasticSearch completion suggester without respecting terms order when typing](https://discuss.elastic.co/t/elasticsearch-completion-suggester-without-respecting-terms-order-when-typing/193975)

<div class="topic-metadata">

**Author:** [@ahlem](https://discuss.elastic.co/u/ahlem)\
**Replies:** 4\
**Last updated:** [August 7, 2019, 11:07am UTC](https://discuss.elastic.co/t/elasticsearch-completion-suggester-without-respecting-terms-order-when-typing/193975 "2019-08-07T11:07:16Z")

</div>

I wanna make an autocomplete feature to search by full name(first name(s)+ last name) using Elastic Search completion suggester. when tapping, user can start with any term composing the full name. for example to look …

---

## [APM UI no loading data using kafka as apm server output](https://discuss.elastic.co/t/apm-ui-no-loading-data-using-kafka-as-apm-server-output/169446)

<div class="topic-metadata">

**Author:** [@cmcornejocrespo](https://discuss.elastic.co/u/cmcornejocrespo)\
**Replies:** 4\
**Last updated:** [February 28, 2019, 5:47pm UTC](https://discuss.elastic.co/t/apm-ui-no-loading-data-using-kafka-as-apm-server-output/169446 "2019-02-28T17:47:36Z")

</div>

Hi folks, Start off saying that my setup was working perfectly when I use elasticsearch as the apm server output. The problem I'm using apm version 6.6.0 and I'm trying to configure apm server to use kafka as output. …

[Previous page](https://discuss.elastic.co/top.md?page=1587&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1589&per_page=50&period=all)
