# Top

**URL:** https://discuss.elastic.co/top.md?page=1605&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1606

---

## [Ship logs from appliances in form of syslog](https://discuss.elastic.co/t/ship-logs-from-appliances-in-form-of-syslog/48509)

<div class="topic-metadata">

**Author:** [@thyfere](https://discuss.elastic.co/u/thyfere)\
**Replies:** 4\
**Last updated:** [April 28, 2016, 7:21pm UTC](https://discuss.elastic.co/t/ship-logs-from-appliances-in-form-of-syslog/48509 "2016-04-28T19:21:32Z")

</div>

Hi, I am running ELK stack on a Windows box. We got a couple of load balancers appliances and they have the option to export logs in syslog format. How can I configure my Elasticsearch or Logstash to receive them? D…

---

## [Error with Windows log](https://discuss.elastic.co/t/error-with-windows-log/1693)

<div class="topic-metadata">

**Author:** [@Sdclmb](https://discuss.elastic.co/u/Sdclmb)\
**Replies:** 4\
**Last updated:** [June 9, 2015, 2:50pm UTC](https://discuss.elastic.co/t/error-with-windows-log/1693 "2015-06-09T14:50:57Z")

</div>

hello, Let me explain the situation : I'm using 2 different server, one for my Rsyslog server and an onther for the ELK stack. I collect logs from Windows servers/computer on my Rsyslog server using Event to syslog. An…

---

## [Kibana upgrade failed - Error: \[config validation of \[elasticsearch\].preserveHost\]: definition for this key is missing](https://discuss.elastic.co/t/kibana-upgrade-failed-error-config-validation-of-elasticsearch-preservehost-definition-for-this-key-is-missing/361032)

<div class="topic-metadata">

**Author:** [@padmavathi](https://discuss.elastic.co/u/padmavathi)\
**Replies:** 5\
**Last updated:** [June 13, 2024, 12:21pm UTC](https://discuss.elastic.co/t/kibana-upgrade-failed-error-config-validation-of-elasticsearch-preservehost-definition-for-this-key-is-missing/361032 "2024-06-13T12:21:05Z")

</div>

I have upgraded kibana from 7.17 to 8.0.1 .Im getting the below error . Error: \[config validation of \[elasticsearch\].preserveHost\]: definition for this key is missing Could you please help me ? Thanks

---

## [JVM for logstash](https://discuss.elastic.co/t/jvm-for-logstash/340424)

<div class="topic-metadata">

**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\
**Replies:** 5\
**Last updated:** [August 9, 2023, 12:48pm UTC](https://discuss.elastic.co/t/jvm-for-logstash/340424 "2023-08-09T12:48:48Z")

</div>

Hi there, just want to confirm, is there any limit for JVM for logstash? if the JVM limit for elastic is 30 - 32 GB, does it also apply for logstash? Thanks

---

## [Not able to search user with pending invitation](https://discuss.elastic.co/t/not-able-to-search-user-with-pending-invitation/274170)

<div class="topic-metadata">

**Author:** [@Prateek\_Yadav](https://discuss.elastic.co/u/Prateek_Yadav)\
**Replies:** 5\
**Last updated:** [June 14, 2021, 5:50am UTC](https://discuss.elastic.co/t/not-able-to-search-user-with-pending-invitation/274170 "2021-06-14T05:50:02Z")

</div>

Hi, I'm on 7.12 self hosted version of Workplace Search and have realised that users who haven't accepted email invitation are not visible anymore on UI. This has happened after update to 7.12 I believe. Now, if I add t…

---

## [How can we calculate day of year using Math Aggregation in Kibana 6.5?](https://discuss.elastic.co/t/how-can-we-calculate-day-of-year-using-math-aggregation-in-kibana-6-5/177102)

<div class="topic-metadata">

**Author:** [@Sonam\_Verma](https://discuss.elastic.co/u/Sonam_Verma)\
**Replies:** 5\
**Last updated:** [April 19, 2019, 4:03pm UTC](https://discuss.elastic.co/t/how-can-we-calculate-day-of-year-using-math-aggregation-in-kibana-6-5/177102 "2019-04-19T16:03:29Z")

</div>

Hi, I want the output of final metric to be displayed under Kibana Metric Visual Builder. I am stucked in calculating dayOfYear() using Math Aggregation in Kibana. Please let me know how can we use expressions like dayO…

---

## [Wildcarded query make elasticsearch cluster unresponsive](https://discuss.elastic.co/t/wildcarded-query-make-elasticsearch-cluster-unresponsive/119729)

<div class="topic-metadata">

**Author:** [@Sriram\_P](https://discuss.elastic.co/u/Sriram_P)\
**Replies:** 5\
**Last updated:** [February 14, 2018, 7:03pm UTC](https://discuss.elastic.co/t/wildcarded-query-make-elasticsearch-cluster-unresponsive/119729 "2018-02-14T19:03:18Z")

</div>

I run the query below on a large elastic search cluster. The cluster bcomes unresponsive { "size": 10000, "query": { "bool": { "must": \[ { "regexp": { "message": { …

---

## [Uptime 8.5 Not showing in Kibana](https://discuss.elastic.co/t/uptime-8-5-not-showing-in-kibana/318758)

<div class="topic-metadata">

**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\
**Replies:** 3\
**Last updated:** [November 17, 2022, 5:40am UTC](https://discuss.elastic.co/t/uptime-8-5-not-showing-in-kibana/318758 "2022-11-17T05:40:34Z")

</div>

Kibana and Elastic version 8.5. 8.4.x all monitors where showing in Uptime in Kibana. Updated to 8.5 and now all are missing on several clusters all on 8.5. Checking the indices data is still being sent to ES as expecte…

---

## [Filebeat 403 error to SQS](https://discuss.elastic.co/t/filebeat-403-error-to-sqs/269205)

<div class="topic-metadata">

**Author:** [@paano](https://discuss.elastic.co/u/paano)\
**Replies:** 3\
**Last updated:** [April 8, 2021, 12:16am UTC](https://discuss.elastic.co/t/filebeat-403-error-to-sqs/269205 "2021-04-08T00:16:20Z")

</div>

Following the document from elastic blog, S3 log to Elastic using filebeat and SQS, i keep getting error 2021-04-03T13:45:04.022Z ERROR \[input.aws-s3\] awss3/collector.go:101 SQS ReceiveMessageRequest failed: AccessDenie…

---

## [React Axios Elasticsearch](https://discuss.elastic.co/t/react-axios-elasticsearch/263645)

<div class="topic-metadata">

**Author:** [@ahmedch](https://discuss.elastic.co/u/ahmedch)\
**Replies:** 0\
**Last updated:** [February 8, 2021, 6:25pm UTC](https://discuss.elastic.co/t/react-axios-elasticsearch/263645 "2021-02-08T18:25:05Z")

</div>

Hello, I am working on a react app using elasticsearch , I have a problem for making post request with axios , the app is mainly based on react and Elasticsearch . This is the code working on node.js const axios = re…

---

## [Loading Custom Plugins in Kibana](https://discuss.elastic.co/t/loading-custom-plugins-in-kibana/241706)

<div class="topic-metadata">

**Author:** [@tinhn](https://discuss.elastic.co/u/tinhn)\
**Replies:** 3\
**Last updated:** [July 17, 2020, 10:00pm UTC](https://discuss.elastic.co/t/loading-custom-plugins-in-kibana/241706 "2020-07-17T22:00:15Z")

</div>

Hello, I'm new to ELK stack and am working on a Kibana plugin, a form that submits a request to some external api. I successfully got the plugin to set up and to work following the steps in the Kibana docs. The plugin w…

---

## [Java High Level Rest Client Cross cluster search](https://discuss.elastic.co/t/java-high-level-rest-client-cross-cluster-search/210053)

<div class="topic-metadata">

**Author:** [@Mahdi\_Davoodi](https://discuss.elastic.co/u/Mahdi_Davoodi)\
**Replies:** 3\
**Last updated:** [December 1, 2019, 5:30pm UTC](https://discuss.elastic.co/t/java-high-level-rest-client-cross-cluster-search/210053 "2019-12-01T17:30:09Z")

</div>

how to search in multi cluster (cross cluster search) by using java high level rest client?

---

## [Two allocators on the same hardware](https://discuss.elastic.co/t/two-allocators-on-the-same-hardware/209502)

<div class="topic-metadata">

**Author:** [@lovegronvall](https://discuss.elastic.co/u/lovegronvall)\
**Replies:** 3\
**Last updated:** [November 27, 2019, 4:23pm UTC](https://discuss.elastic.co/t/two-allocators-on-the-same-hardware/209502 "2019-11-27T16:23:29Z")

</div>

Did anyone successfully run more than one allocator on the same hardware? For example one using spinning disks and one on SSD?

---

## [Processing Custom Log Input from Filebeat in Logstash](https://discuss.elastic.co/t/processing-custom-log-input-from-filebeat-in-logstash/170656)

<div class="topic-metadata">

**Author:** [@luke14](https://discuss.elastic.co/u/luke14)\
**Replies:** 3\
**Last updated:** [March 4, 2019, 9:23am UTC](https://discuss.elastic.co/t/processing-custom-log-input-from-filebeat-in-logstash/170656 "2019-03-04T09:23:57Z")

</div>

Hi I have setup Filebeat on a server which I would like it to pass a custom application log to my logstash server. On my logstash server I currently have a beats\_input.conf which is listening for all my beats inputs. A…

---

## [Trying to start the bitbucket server, but throwing an error stating "BIND TRANSPORT EXCEPTION"](https://discuss.elastic.co/t/trying-to-start-the-bitbucket-server-but-throwing-an-error-stating-bind-transport-exception/168859)

<div class="topic-metadata">

**Author:** [@manoharreddy](https://discuss.elastic.co/u/manoharreddy)\
**Replies:** 3\
**Last updated:** [February 19, 2019, 9:09am UTC](https://discuss.elastic.co/t/trying-to-start-the-bitbucket-server-but-throwing-an-error-stating-bind-transport-exception/168859 "2019-02-19T09:09:41Z")

</div>

I'm getting below error. Kindly help me in resolving the same. \[2019-02-18T15:18:21,418\]\[ERROR\]\[o.e.b.Bootstrap \] \[bitbucket\_bundled\] Exception org.elasticsearch.transport.BindTransportException: Failed to bin…

---

## [Version field type shows as unknown in the index pattern](https://discuss.elastic.co/t/version-field-type-shows-as-unknown-in-the-index-pattern/265973)

<div class="topic-metadata">

**Author:** [@Dor\_Dadush](https://discuss.elastic.co/u/Dor_Dadush)\
**Replies:** 1\
**Last updated:** [March 2, 2021, 3:50pm UTC](https://discuss.elastic.co/t/version-field-type-shows-as-unknown-in-the-index-pattern/265973 "2021-03-02T15:50:11Z")

</div>

Hi everyone :slight\_smile: I have an index template which contains a mapping of the field agent.version to the type version (introduced in 7.10.X if I'm not mistaken) But, in the index pattern of the relevant index, I …

---

## [Failed to flush the buffer](https://discuss.elastic.co/t/failed-to-flush-the-buffer/351538)

<div class="topic-metadata">

**Author:** [@Music\_World](https://discuss.elastic.co/u/Music_World)\
**Replies:** 1\
**Last updated:** [January 23, 2024, 9:15am UTC](https://discuss.elastic.co/t/failed-to-flush-the-buffer/351538 "2024-01-23T09:15:24Z")

</div>

Hi @all I am using elasticsearch version: 7.16.2 and fluentd version: 1.14.4 on aws eks cluster and it's throwing bufferoverflow error like failed to flush the buffer. retry\_times=0 next\_retry\_time=2024-01-19 07:43:43 …

---

## [Elasticsearch maintenance procedure](https://discuss.elastic.co/t/elasticsearch-maintenance-procedure/250465)

<div class="topic-metadata">

**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\
**Replies:** 1\
**Last updated:** [September 30, 2020, 8:25am UTC](https://discuss.elastic.co/t/elasticsearch-maintenance-procedure/250465 "2020-09-30T08:25:08Z")

</div>

hi all, I'm starting to think about the correct procedure to apply security patches on the ES nodes (OS: CentOS). I have several clusters with different purpose but I focused on the most important; this cluster is comp…

---

## [How to change default file permission of log files in /var/log/logstash/](https://discuss.elastic.co/t/how-to-change-default-file-permission-of-log-files-in-var-log-logstash/241868)

<div class="topic-metadata">

**Author:** [@chitreshg](https://discuss.elastic.co/u/chitreshg)\
**Replies:** 1\
**Last updated:** [July 20, 2020, 5:07pm UTC](https://discuss.elastic.co/t/how-to-change-default-file-permission-of-log-files-in-var-log-logstash/241868 "2020-07-20T17:07:37Z")

</div>

I want to change the default file permission of logstash's log files as 600, currently it is 644. In logstash.yml file I found only the file path and log level related information but I didn't get any file permission re…

---

## [Ruby - Ruby exception occurred: invalid date: "2019-04-18+06:23:35.919"](https://discuss.elastic.co/t/ruby-ruby-exception-occurred-invalid-date-2019-04-18-0635-919/183044)

<div class="topic-metadata">

**Author:** [@Yoav\_Ben\_Moha](https://discuss.elastic.co/u/Yoav_Ben_Moha)\
**Replies:** 1\
**Last updated:** [May 28, 2019, 1:48pm UTC](https://discuss.elastic.co/t/ruby-ruby-exception-occurred-invalid-date-2019-04-18-0635-919/183044 "2019-05-28T13:48:44Z")

</div>

I am trying to find a diff betweentwo dates. I have wrote the following con file which use Ruby in order to caculate the date diff. I recived : ruby - Ruby exception occurred: invalid date: "2019-04-18+06:23:35.919" T…

---

## [Pipeline Foreach "\[processors\] required property is missing",](https://discuss.elastic.co/t/pipeline-foreach-processors-required-property-is-missing/178716)

<div class="topic-metadata">

**Author:** [@PeterPain](https://discuss.elastic.co/u/PeterPain)\
**Replies:** 1\
**Last updated:** [April 26, 2019, 11:50pm UTC](https://discuss.elastic.co/t/pipeline-foreach-processors-required-property-is-missing/178716 "2019-04-26T23:50:46Z")

</div>

Hey there I started with the Foreach processor for pipelines today. Went through the Documentation and i tried it out using the Console in Kibana Doc: https://www.elastic.co/guide/en/elasticsearch/reference/current/for…

---

## [Packet decode failed](https://discuss.elastic.co/t/packet-decode-failed/99590)

<div class="topic-metadata">

**Author:** [@stefansaye](https://discuss.elastic.co/u/stefansaye)\
**Replies:** 1\
**Last updated:** [September 7, 2017, 11:00am UTC](https://discuss.elastic.co/t/packet-decode-failed/99590 "2017-09-07T11:00:57Z")

</div>

Hi, On starting the packetbeat binary I get the following error. 2017-09-07T11:12:15+08:00 INFO Non-zero metrics in the last 30s: dns.unmatched\_requests=2801 dns.unmatched\_responses=2216 http.unmatched\_responses=508…

---

## [Is there a way to to use Beats (topbeat) to monitor Docker containers in an easy way?](https://discuss.elastic.co/t/is-there-a-way-to-to-use-beats-topbeat-to-monitor-docker-containers-in-an-easy-way/54325)

<div class="topic-metadata">

**Author:** [@marcopas](https://discuss.elastic.co/u/marcopas)\
**Replies:** 1\
**Last updated:** [June 30, 2016, 10:15am UTC](https://discuss.elastic.co/t/is-there-a-way-to-to-use-beats-topbeat-to-monitor-docker-containers-in-an-easy-way/54325 "2016-06-30T10:15:36Z")

</div>

Hi there, we are currently experimenting with Beats to monitor our docker containers. Currently we have a setup so that we need to install Beats in every Docker Container that we create. This gives overhead per container…

---

## [Index and metadata backup in HDFS and restore](https://discuss.elastic.co/t/index-and-metadata-backup-in-hdfs-and-restore/53036)

<div class="topic-metadata">

**Author:** [@rshaikh](https://discuss.elastic.co/u/rshaikh)\
**Replies:** 1\
**Last updated:** [June 17, 2016, 6:23am UTC](https://discuss.elastic.co/t/index-and-metadata-backup-in-hdfs-and-restore/53036 "2016-06-17T06:23:27Z")

</div>

Hi, I am seeking experts advice to achieve backup and restore process. We are using Elastic as our core storage for log analytics. Now, we would like to backup our indexes into HDFS on regular/incremental way. Also w…

---

## [Execution\_duration ... in milliseconds?](https://discuss.elastic.co/t/execution-duration-in-milliseconds/32034)

<div class="topic-metadata">

**Author:** [@aochsner](https://discuss.elastic.co/u/aochsner)\
**Replies:** 1\
**Last updated:** [October 12, 2015, 8:25pm UTC](https://discuss.elastic.co/t/execution-duration-in-milliseconds/32034 "2015-10-12T20:25:15Z")

</div>

I think result.execution\_duration is in milliseconds, but I can't find anything definitive. Can someone please let me know? Thanks

---

## [See Who's changing signal detections](https://discuss.elastic.co/t/see-whos-changing-signal-detections/268545)

<div class="topic-metadata">

**Author:** [@Oliver2](https://discuss.elastic.co/u/Oliver2)\
**Replies:** 3\
**Last updated:** [March 28, 2021, 6:05pm UTC](https://discuss.elastic.co/t/see-whos-changing-signal-detections/268545 "2021-03-28T18:05:57Z")

</div>

Can you see which account have changed the signal.status field in elastic? if not can this be looked into I think it would be really useful to see which analyst is closing which detections

---

## [Get JAVA API by id with routing](https://discuss.elastic.co/t/get-java-api-by-id-with-routing/24453)

<div class="topic-metadata">

**Author:** [@SpinBoldak](https://discuss.elastic.co/u/SpinBoldak)\
**Replies:** 0\
**Last updated:** [June 26, 2015, 6:38pm UTC](https://discuss.elastic.co/t/get-java-api-by-id-with-routing/24453 "2015-06-26T18:38:08Z")

</div>

Hi, Is it possible to use the JAVA API to perform a get on a type that has required routing and you don't have the attribute from which the routing is performed ? For example, you have type A, which is parent of B,…

---

## [Elastic Connector cannot talk to ElasticSearch at 9200](https://discuss.elastic.co/t/elastic-connector-cannot-talk-to-elasticsearch-at-9200/368430)

<div class="topic-metadata">

**Author:** [@sami-obvio](https://discuss.elastic.co/u/sami-obvio)\
**Replies:** 2\
**Last updated:** [October 8, 2024, 10:48am UTC](https://discuss.elastic.co/t/elastic-connector-cannot-talk-to-elasticsearch-at-9200/368430 "2024-10-08T10:48:18Z")

</div>

I have an Elastic node running on https://localhost:9200 using Docker (using the tutorial on elastic's website here: Install Elasticsearch with Docker | Elasticsearch Guide \[8.15\] | Elastic) I can curl to it using a ca\_…

---

## [Elasticsearch cluster pricing calculation for on premise deployment](https://discuss.elastic.co/t/elasticsearch-cluster-pricing-calculation-for-on-premise-deployment/353760)

<div class="topic-metadata">

**Author:** [@RajuParipelly](https://discuss.elastic.co/u/RajuParipelly)\
**Replies:** 2\
**Last updated:** [February 21, 2024, 3:27pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-pricing-calculation-for-on-premise-deployment/353760 "2024-02-21T15:27:22Z")

</div>

Hi, How do we calculate elastic cluster license pricing for a on premise deployment?

---

## [Master not discovered, even though quorum is fulfilled](https://discuss.elastic.co/t/master-not-discovered-even-though-quorum-is-fulfilled/336079)

<div class="topic-metadata">

**Author:** [@kley](https://discuss.elastic.co/u/kley)\
**Replies:** 2\
**Last updated:** [June 15, 2023, 11:39am UTC](https://discuss.elastic.co/t/master-not-discovered-even-though-quorum-is-fulfilled/336079 "2023-06-15T11:39:13Z")

</div>

Hey! So, I have this 12 node cluster with elastic 7.17.5 running. During the upgrade process to this version the cluster had issues finding the master node: master not discovered or elected yet, an election requires at…

---

## [SSL error when using S3 compatible repository with letsencrypt certificate](https://discuss.elastic.co/t/ssl-error-when-using-s3-compatible-repository-with-letsencrypt-certificate/313791)

<div class="topic-metadata">

**Author:** [@albanm](https://discuss.elastic.co/u/albanm)\
**Replies:** 2\
**Last updated:** [September 13, 2022, 2:49pm UTC](https://discuss.elastic.co/t/ssl-error-when-using-s3-compatible-repository-with-letsencrypt-certificate/313791 "2022-09-13T14:49:06Z")

</div>

Hello, I have installed a minio server protected by a certificate issued by letsencrypt to serve as a snapshot repository for my elasticsearch cluster (version 7.17.6). When I try to create the registry (curl -X PUT "lo…

---

## [Is there a way to write a query where x must be true AND y must be a + b, OR c + d?](https://discuss.elastic.co/t/is-there-a-way-to-write-a-query-where-x-must-be-true-and-y-must-be-a-b-or-c-d/311020)

<div class="topic-metadata">

**Author:** [@ccsisko](https://discuss.elastic.co/u/ccsisko)\
**Replies:** 2\
**Last updated:** [August 1, 2022, 6:00pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-write-a-query-where-x-must-be-true-and-y-must-be-a-b-or-c-d/311020 "2022-08-01T18:00:22Z")

</div>

Hello! We're writing a query where a couple fields must be true, while another field must equal something OR something else. More specifically, we're querying for a document that has a status of X, and the amount value …

---

## [How to add a field to the result of the aggregation](https://discuss.elastic.co/t/how-to-add-a-field-to-the-result-of-the-aggregation/279581)

<div class="topic-metadata">

**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\
**Replies:** 2\
**Last updated:** [July 26, 2021, 8:24am UTC](https://discuss.elastic.co/t/how-to-add-a-field-to-the-result-of-the-aggregation/279581 "2021-07-26T08:24:26Z")

</div>

I wrote an aggregation, and it meets my requirements, but I also need to add a field (trace.id) when the results are displayed. Trace.id does not need to be aggregated. How should dsl be written in this case? Can an…

---

## [How to remove "dotted border" from visualizations when imported to Canvas Workpads?](https://discuss.elastic.co/t/how-to-remove-dotted-border-from-visualizations-when-imported-to-canvas-workpads/276785)

<div class="topic-metadata">

**Author:** [@jamesraznor](https://discuss.elastic.co/u/jamesraznor)\
**Replies:** 2\
**Last updated:** [June 23, 2021, 1:39pm UTC](https://discuss.elastic.co/t/how-to-remove-dotted-border-from-visualizations-when-imported-to-canvas-workpads/276785 "2021-06-23T13:39:16Z")

</div>

Hi, After update to 7.13 all visualisations in Canvas Workpads are dotted around, there's a way to remove it?

---

## [When does Logstash update last\_run\_metadata\_path?](https://discuss.elastic.co/t/when-does-logstash-update-last-run-metadata-path/275833)

<div class="topic-metadata">

**Author:** [@chris\_ts24](https://discuss.elastic.co/u/chris_ts24)\
**Replies:** 2\
**Last updated:** [June 14, 2021, 1:21pm UTC](https://discuss.elastic.co/t/when-does-logstash-update-last-run-metadata-path/275833 "2021-06-14T13:21:07Z")

</div>

Hi all, I am working with Logstash 7.13.0 & ES 7.13.0 to populate and maintain an index with records from an Oracle DB. The maintenance is achieved by running an update Logstash service every minute. The condition to be…

---

## [Kibana Visualization - Gauge](https://discuss.elastic.co/t/kibana-visualization-gauge/250037)

<div class="topic-metadata">

**Author:** [@rkarthik.kr](https://discuss.elastic.co/u/rkarthik.kr)\
**Replies:** 2\
**Last updated:** [October 8, 2020, 6:20pm UTC](https://discuss.elastic.co/t/kibana-visualization-gauge/250037 "2020-10-08T18:20:36Z")

</div>

Hello All I am trying to build a visualization in Kibana using Gauge . Below is the data in my Index App\_Name Service\_Name Run\_Number Coverage Red A 4 90 Red B 4 …

---

## [How to set variables and iterate using Vega](https://discuss.elastic.co/t/how-to-set-variables-and-iterate-using-vega/223013)

<div class="topic-metadata">

**Author:** [@jmrozi1](https://discuss.elastic.co/u/jmrozi1)\
**Replies:** 2\
**Last updated:** [March 11, 2020, 5:13pm UTC](https://discuss.elastic.co/t/how-to-set-variables-and-iterate-using-vega/223013 "2020-03-11T17:13:05Z")

</div>

Just a disclaimer: I'm new to Vega, so chances are this is a dumb question. Please let me know if I'm on the wrong path :slightly\_smiling\_face: At any rate, the context is that I'm trying create a 3x4 grid of text field…

---

## [Find word position in large text](https://discuss.elastic.co/t/find-word-position-in-large-text/190370)

<div class="topic-metadata">

**Author:** [@josie\_kat](https://discuss.elastic.co/u/josie_kat)\
**Replies:** 2\
**Last updated:** [July 16, 2019, 11:44am UTC](https://discuss.elastic.co/t/find-word-position-in-large-text/190370 "2019-07-16T11:44:02Z")

</div>

is there a possibility to find the exact location of word or phrase found in large text field?

---

## [Logstash email output plugin in windows7](https://discuss.elastic.co/t/logstash-email-output-plugin-in-windows7/86548)

<div class="topic-metadata">

**Author:** [@Ho\_Shin](https://discuss.elastic.co/u/Ho_Shin)\
**Replies:** 2\
**Last updated:** [May 21, 2017, 2:44am UTC](https://discuss.elastic.co/t/logstash-email-output-plugin-in-windows7/86548 "2017-05-21T02:44:18Z")

</div>

Hi there, I want to use email output plugin in windows7. It seems that there is no email output available. There is no email in the logstash-plugin list I copied CMD Line below. When I try to install email plugin li…

---

## [Cant access elasticsearch port from remote machine](https://discuss.elastic.co/t/cant-access-elasticsearch-port-from-remote-machine/83029)

<div class="topic-metadata">

**Author:** [@Pranil\_Ambule](https://discuss.elastic.co/u/Pranil_Ambule)\
**Replies:** 2\
**Last updated:** [May 1, 2017, 7:08am UTC](https://discuss.elastic.co/t/cant-access-elasticsearch-port-from-remote-machine/83029 "2017-05-01T07:08:00Z")

</div>

im using elasticsearch 5.1.2 hosted on microsoft server 2008 ip address-100.100.171.207 but im not able to connect to port 9200 using 100.100.171.207:9200 i have also added inbound as well as outbound rule in firewall A…

---

## [Converting elapsed time 00:00:00:XXXXXXX](https://discuss.elastic.co/t/converting-elapsed-time-00-00-00-xxxxxxx/74237)

<div class="topic-metadata">

**Author:** [@dsever](https://discuss.elastic.co/u/dsever)\
**Replies:** 2\
**Last updated:** [February 9, 2017, 8:20am UTC](https://discuss.elastic.co/t/converting-elapsed-time-00-00-00-xxxxxxx/74237 "2017-02-09T08:20:56Z")

</div>

Hi there, I have small problem with small problem with preparing elapsed time for executing db procedure. For instance using grok as %{TIME:elapsed} and it matches ok, but at eleastic it provides me value as string. f…

---

## [Mapping # in file using type\_table\_path](https://discuss.elastic.co/t/mapping-in-file-using-type-table-path/32875)

<div class="topic-metadata">

**Author:** [@marinoc](https://discuss.elastic.co/u/marinoc)\
**Replies:** 2\
**Last updated:** [October 23, 2015, 6:45pm UTC](https://discuss.elastic.co/t/mapping-in-file-using-type-table-path/32875 "2015-10-23T18:45:20Z")

</div>

I'm using the word\_delimiter filter and wanted to create a type\_table\_path file to store my mappings. Howerver, one of my mappings is for the hash sign (#). How can I prevent the parser from treating this line as a com…

---

## [On the fly field formatting in kibana 4.1](https://discuss.elastic.co/t/on-the-fly-field-formatting-in-kibana-4-1/29750)

<div class="topic-metadata">

**Author:** [@ankmathur14](https://discuss.elastic.co/u/ankmathur14)\
**Replies:** 2\
**Last updated:** [September 26, 2015, 10:20am UTC](https://discuss.elastic.co/t/on-the-fly-field-formatting-in-kibana-4-1/29750 "2015-09-26T10:20:09Z")

</div>

Is there any way in current version of kibana (or in any upcomimg releases) to format a field value from integer to string on the fly. Something like : My documents in Elastcsearch : {"OperatingSystem":1} {"OperatingS…

---

## [Testing for NaN with MVEL with custom script?](https://discuss.elastic.co/t/testing-for-nan-with-mvel-with-custom-script/11955)

<div class="topic-metadata">

**Author:** [@Justin\_Treher](https://discuss.elastic.co/u/Justin_Treher)\
**Replies:** 2\
**Last updated:** [May 15, 2013, 9:25am UTC](https://discuss.elastic.co/t/testing-for-nan-with-mvel-with-custom-script/11955 "2013-05-15T09:25:14Z")

</div>

When one search term started bombing, I discovered that one of my documents somehow must be returning an NaN for one of the custom score scripts fields. I was using the ternary operator already for emptiness: "scr…

---

## [Changing to Service type of LoadBalancer from ClusterIP on ECK Operator Breaks](https://discuss.elastic.co/t/changing-to-service-type-of-loadbalancer-from-clusterip-on-eck-operator-breaks/341276)

<div class="topic-metadata">

**Author:** [@bigjoe21](https://discuss.elastic.co/u/bigjoe21)\
**Replies:** 1\
**Last updated:** [August 21, 2023, 6:04pm UTC](https://discuss.elastic.co/t/changing-to-service-type-of-loadbalancer-from-clusterip-on-eck-operator-breaks/341276 "2023-08-21T18:04:29Z")

</div>

I went through the quickstart and successfully deployed elasticsearch and kibana on EKS using the ECK operator. I then followed the directions in the docs to allow public access. However, the ECK Operator keeps throwing…

---

## [Show search result based on keywords](https://discuss.elastic.co/t/show-search-result-based-on-keywords/305617)

<div class="topic-metadata">

**Author:** [@silvermanoj](https://discuss.elastic.co/u/silvermanoj)\
**Replies:** 7\
**Last updated:** [June 10, 2022, 8:48am UTC](https://discuss.elastic.co/t/show-search-result-based-on-keywords/305617 "2022-06-10T08:48:36Z")

</div>

I am using Elasticsearch version 8. When I try to query a combination of two words that are stored in two different attributes, I get the search result but the record match with post\_title are not coming first For examp…

---

## [Elastic Engineer - Lab 4.3 Transforming data - target index empty](https://discuss.elastic.co/t/elastic-engineer-lab-4-3-transforming-data-target-index-empty/287912)

<div class="topic-metadata">

**Author:** [@micw](https://discuss.elastic.co/u/micw)\
**Replies:** 7\
**Last updated:** [November 10, 2021, 6:48pm UTC](https://discuss.elastic.co/t/elastic-engineer-lab-4-3-transforming-data-target-index-empty/287912 "2021-11-10T18:48:13Z")

</div>

My traffic\_stats index created by creating the pivot chart transform is empty. I've tried deleting the transform and following the steps in the answers again both in the UI and pasting commands in to the Console but no d…

---

## [Combine 2 or more beats in one panel / visualization](https://discuss.elastic.co/t/combine-2-or-more-beats-in-one-panel-visualization/267596)

<div class="topic-metadata">

**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\
**Replies:** 7\
**Last updated:** [March 22, 2021, 9:54am UTC](https://discuss.elastic.co/t/combine-2-or-more-beats-in-one-panel-visualization/267596 "2021-03-22T09:54:55Z")

</div>

i have 2 beats. filebeat and auditbeat, can i combine that 2 index in 1 panel visualization.

---

## [How to reduce primary storage size](https://discuss.elastic.co/t/how-to-reduce-primary-storage-size/252518)

<div class="topic-metadata">

**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\
**Replies:** 7\
**Last updated:** [October 21, 2020, 12:50pm UTC](https://discuss.elastic.co/t/how-to-reduce-primary-storage-size/252518 "2020-10-21T12:50:56Z")

</div>

hi all, generally, when I use Logstash I like to remove the message field if the filter section doesn't contain any error. I do it to reduce the size of every document. since this time I will not use Logstash, is there…

---

## [Http filter for each array item](https://discuss.elastic.co/t/http-filter-for-each-array-item/212239)

<div class="topic-metadata">

**Author:** [@mdailey](https://discuss.elastic.co/u/mdailey)\
**Replies:** 1\
**Last updated:** [December 19, 2019, 6:38pm UTC](https://discuss.elastic.co/t/http-filter-for-each-array-item/212239 "2019-12-19T18:38:54Z")

</div>

I have a filter that I need to apply to each item of an array that I obtain from an earlier filter. It works fine for a single input like this: http { url =\> "http://my.api.com/api/v1/%{id}?verbose=false" header…

[Previous page](https://discuss.elastic.co/top.md?page=1604&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1606&per_page=50&period=all)
