# Top **URL:** https://discuss.elastic.co/top.md?page=1614&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1615 --- ## [Unable to map Filebeat in Kibana (5.4.0)](https://discuss.elastic.co/t/unable-to-map-filebeat-in-kibana-5-4-0/87742)
**Author:** [@BMV](https://discuss.elastic.co/u/BMV)\ **Replies:** 3\ **Last updated:** [June 1, 2017, 7:20am UTC](https://discuss.elastic.co/t/unable-to-map-filebeat-in-kibana-5-4-0/87742 "2017-06-01T07:20:43Z")
Hi there, I am having some trouble mapping Filebeat in Kibana after doing a clean install to 5.4.0. I have followed the Filebeat guide and have attempted to get it working for a while with no success. I have added a scr… --- ## [Creation of Elasticsearch respository using azure plugin?](https://discuss.elastic.co/t/creation-of-elasticsearch-respository-using-azure-plugin/81812)
**Author:** [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\ **Replies:** 3\ **Last updated:** [April 19, 2017, 5:34pm UTC](https://discuss.elastic.co/t/creation-of-elasticsearch-respository-using-azure-plugin/81812 "2017-04-19T17:34:58Z")
Hi, I have one azure storage account(xxx) and for that i had created two repositories like this: 1) PUT \_snapshot/sample\_backup { "type":"azure" } 2) PUT \_snapshot/ex\_backup { "type":… --- ## [Keep raw syslog event untampered](https://discuss.elastic.co/t/keep-raw-syslog-event-untampered/58053)
**Author:** [@jaykumar](https://discuss.elastic.co/u/jaykumar)\ **Replies:** 3\ **Last updated:** [August 16, 2016, 6:39am UTC](https://discuss.elastic.co/t/keep-raw-syslog-event-untampered/58053 "2016-08-16T06:39:23Z")
Hi There, I have Logstash config with few groks to rename fields, make values human readable, geoip, and few more stuffs. I would like to make two outputs: Raw compressed file with untampered, this means it must not… --- ## [Failing to search after removing docs](https://discuss.elastic.co/t/failing-to-search-after-removing-docs/42847)
**Author:** [@i5513](https://discuss.elastic.co/u/i5513)\ **Replies:** 3\ **Last updated:** [February 26, 2016, 10:05pm UTC](https://discuss.elastic.co/t/failing-to-search-after-removing-docs/42847 "2016-02-26T22:05:01Z")
Hello, I'm lost with this question. I'm playing with elasticsearch, I loaded apache logs from logstash, then I want to remove such logs and add it again, with a new logstash configuration. For remove all the logs docs… --- ## [Which part of EnterpriseSearch should I use for search bar on Drupal site?](https://discuss.elastic.co/t/which-part-of-enterprisesearch-should-i-use-for-search-bar-on-drupal-site/310332)
**Author:** [@tonyfam](https://discuss.elastic.co/u/tonyfam)\ **Replies:** 5\ **Last updated:** [August 10, 2022, 1:13am UTC](https://discuss.elastic.co/t/which-part-of-enterprisesearch-should-i-use-for-search-bar-on-drupal-site/310332 "2022-08-10T01:13:46Z")
Hello everyone, I have a completely basic question. I'm not sure which part of elastic makes sense for us. I've been all around the web reading articles and the elastic.co site and I think I'm missing something. So, w… --- ## [APM not collecting data for NodeJS applications which trigger services inside child processes. But correctly monitor in NodeJS express apps](https://discuss.elastic.co/t/apm-not-collecting-data-for-nodejs-applications-which-trigger-services-inside-child-processes-but-correctly-monitor-in-nodejs-express-apps/223056)
**Author:** [@Albert\_KP](https://discuss.elastic.co/u/Albert_KP)\ **Replies:** 5\ **Last updated:** [March 13, 2020, 7:39am UTC](https://discuss.elastic.co/t/apm-not-collecting-data-for-nodejs-applications-which-trigger-services-inside-child-processes-but-correctly-monitor-in-nodejs-express-apps/223056 "2020-03-13T07:39:00Z")
Hi, I'am using elastic APM to monitor some of the applications build using node. The APM correctly monitor NodeJS apps using express framework. But it is not monitoring some applications which are running services insid… --- ## [Existing mapping for \[postfix\] must be of type object but found \[boolean\]](https://discuss.elastic.co/t/existing-mapping-for-postfix-must-be-of-type-object-but-found-boolean/203479)
**Author:** [@beren](https://discuss.elastic.co/u/beren)\ **Replies:** 5\ **Last updated:** [October 15, 2019, 7:26am UTC](https://discuss.elastic.co/t/existing-mapping-for-postfix-must-be-of-type-object-but-found-boolean/203479 "2019-10-15T07:26:14Z")
Всем привет. Поднял с нуля ELK. Настроил его на мониторинг В /etc/logstash/conf.d/postfix.conf В /etc/logstash/patterns/postfix Но в логах logstash Blockquote \[2019-10-14T10:39:13,494\]\[WARN \]\[logstash.outputs.… --- ## [How delete document works?](https://discuss.elastic.co/t/how-delete-document-works/36977)
**Author:** [@Felipe\_Santos](https://discuss.elastic.co/u/Felipe_Santos)\ **Replies:** 5\ **Last updated:** [December 11, 2015, 2:06pm UTC](https://discuss.elastic.co/t/how-delete-document-works/36977 "2015-12-11T14:06:00Z")
I heard when we delete a document it remains on disks and next queries will filter deleted documents, is it true? --- ## [TTL in elastic search is not working](https://discuss.elastic.co/t/ttl-in-elastic-search-is-not-working/11968)
**Author:** [@aakashanuj](https://discuss.elastic.co/u/aakashanuj)\ **Replies:** 5\ **Last updated:** [May 15, 2013, 11:04am UTC](https://discuss.elastic.co/t/ttl-in-elastic-search-is-not-working/11968 "2013-05-15T11:04:11Z")
I am stuck in implementing the TTL in the case of elastic search. What I have done is this: I have created a folder mappings under the folder config. Under mappings, I have a folder \_default , under which I have… --- ## [How to set a custom logo in kibana 7.16](https://discuss.elastic.co/t/how-to-set-a-custom-logo-in-kibana-7-16/296422)
**Author:** [@Sunil\_Bhakar](https://discuss.elastic.co/u/Sunil_Bhakar)\ **Replies:** 1\ **Last updated:** [February 7, 2022, 9:34am UTC](https://discuss.elastic.co/t/how-to-set-a-custom-logo-in-kibana-7-16/296422 "2022-02-07T09:34:21Z")
Hello, I want to set a custom logo in kibana 7.16. Thanks in Advance for the help. --- ## [CircuitBreakingException: \[parent\] Data too large](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large/320152)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 6\ **Last updated:** [December 11, 2022, 8:39pm UTC](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large/320152 "2022-12-11T20:39:52Z")
Hi All, Today morning, I got an error while checking kibana discover stating that its unable to fetch the result. Then I checked Stack Monitoring and found the below error -- On further investigation, I found that ou… --- ## [When I add xpack to stack it is not working](https://discuss.elastic.co/t/when-i-add-xpack-to-stack-it-is-not-working/314522)
**Author:** [@txmrlevine](https://discuss.elastic.co/u/txmrlevine)\ **Replies:** 6\ **Last updated:** [October 6, 2022, 4:30pm UTC](https://discuss.elastic.co/t/when-i-add-xpack-to-stack-it-is-not-working/314522 "2022-10-06T16:30:58Z")
When trying to implement xpack on my stack I get an "error loading data" message in Cerebro and it does not let me login. when set to false all works - when set to true it does not. here is info on the stack { "nam… --- ## [How can rename logstash fields](https://discuss.elastic.co/t/how-can-rename-logstash-fields/254867)
**Author:** [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)\ **Replies:** 6\ **Last updated:** [November 20, 2020, 1:17pm UTC](https://discuss.elastic.co/t/how-can-rename-logstash-fields/254867 "2020-11-20T13:17:26Z")
rename fields: Thanks --- ## [Logs on two lines](https://discuss.elastic.co/t/logs-on-two-lines/187915)
**Author:** [@kentatoi](https://discuss.elastic.co/u/kentatoi)\ **Replies:** 6\ **Last updated:** [June 28, 2019, 3:21pm UTC](https://discuss.elastic.co/t/logs-on-two-lines/187915 "2019-06-28T15:21:29Z")
Hi, I am trying to get logs whose are on two different lines : \[2019-06-18T06:57:32.032Z\] \[org.kie.api.internal.utils.tydhiks\] \[main\] \[141\] \[INFO \] Adding Service org.drools.core.concurrent.EEEeeF In my logstash I … --- ## [Fscrawler save binary , base64](https://discuss.elastic.co/t/fscrawler-save-binary-base64/124696)
**Author:** [@Yimjunhyeok](https://discuss.elastic.co/u/Yimjunhyeok)\ **Replies:** 6\ **Last updated:** [March 21, 2018, 4:24am UTC](https://discuss.elastic.co/t/fscrawler-save-binary-base64/124696 "2018-03-21T04:24:07Z")
Hello. I want to save file binary with fscrawler without extract file contents. But when i set the "indexed\_chars" : "1000", Can't save file binary fully (More than 70MB) it is also same when i set the "indexed\_char… --- ## [Active tagging of in-progress bugs](https://discuss.elastic.co/t/active-tagging-of-in-progress-bugs/66913)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 6\ **Last updated:** [November 23, 2016, 6:40pm UTC](https://discuss.elastic.co/t/active-tagging-of-in-progress-bugs/66913 "2016-11-23T18:40:59Z")
I'm trying to figure out a way to hide all logs displayed on Kibana that have already been seen and have already been started to be worked on. Another way to put it is, logs that I am dealing with, I don't want to displa… --- ## [How to get Elasticsearch boolean match working for multiple fields](https://discuss.elastic.co/t/how-to-get-elasticsearch-boolean-match-working-for-multiple-fields/23585)
**Author:** [@Dominic\_Nicholas](https://discuss.elastic.co/u/Dominic_Nicholas)\ **Replies:** 6\ **Last updated:** [May 9, 2015, 12:09am UTC](https://discuss.elastic.co/t/how-to-get-elasticsearch-boolean-match-working-for-multiple-fields/23585 "2015-05-09T00:09:48Z")
Hi, I need some expert guidance on trying to get a bool match working. I'd like the query to only return a successful search result if \*both\* 'message' matches 'Failed password for', \*and\* 'path' matches '/var/… --- ## [When one node goes down, memory usage jumps several gigabytes on other nodes](https://discuss.elastic.co/t/when-one-node-goes-down-memory-usage-jumps-several-gigabytes-on-other-nodes/3340)
**Author:** [@Grant\_Rodgers](https://discuss.elastic.co/u/Grant_Rodgers)\ **Replies:** 6\ **Last updated:** [September 24, 2010, 5:04pm UTC](https://discuss.elastic.co/t/when-one-node-goes-down-memory-usage-jumps-several-gigabytes-on-other-nodes/3340 "2010-09-24T17:04:25Z")
I'm seeing strange behavior with my cluster of 3 nodes. It seems like when one node drops out, the other nodes suddenly spike in cpu and memory usage after a short time. We are using ES 0.10.0 with a 7GB heap. We h… --- ## [Apply new ILM to managed index template FAILED](https://discuss.elastic.co/t/apply-new-ilm-to-managed-index-template-failed/325789)
**Author:** [@Anh\_Nguyen](https://discuss.elastic.co/u/Anh_Nguyen)\ **Replies:** 7\ **Last updated:** [February 28, 2023, 2:02am UTC](https://discuss.elastic.co/t/apply-new-ilm-to-managed-index-template-failed/325789 "2023-02-28T02:02:45Z")
I have a time series data stream, it has a managed index template and it was configured to "logs ILM" by default. I want to use another ILM and I changed the index template configure by "Edit" in Index Management and ad… --- ## [Ordering by percentile not working anymore](https://discuss.elastic.co/t/ordering-by-percentile-not-working-anymore/308995)
**Author:** [@VeraE](https://discuss.elastic.co/u/VeraE)\ **Replies:** 7\ **Last updated:** [August 3, 2022, 1:45pm UTC](https://discuss.elastic.co/t/ordering-by-percentile-not-working-anymore/308995 "2022-08-03T13:45:26Z")
Hi! I had a couple of Lens line graphs of some response times set up, ordered by the 95th percentile. In recent days I noticed they don't work anymore, although I didn't change anything (they were last changed in Januar… --- ## [Infinite extent for field "times": \[Infinity, -Infinity\] when data size set as 0 or larger than 10000](https://discuss.elastic.co/t/infinite-extent-for-field-times-infinity-infinity-when-data-size-set-as-0-or-larger-than-10000/291775)
**Author:** [@sunryan](https://discuss.elastic.co/u/sunryan)\ **Replies:** 1\ **Last updated:** [December 14, 2021, 10:25am UTC](https://discuss.elastic.co/t/infinite-extent-for-field-times-infinity-infinity-when-data-size-set-as-0-or-larger-than-10000/291775 "2021-12-14T10:25:25Z")
I am trying to use Vega to plot a scatter drawing, but always get a warning "Infinite extent for field "times": \[Infinity, -Infinity\]" when I set the data size as 0 or a number larger than 10000.Any help would be appreci… --- ## [Turn off Alert during night](https://discuss.elastic.co/t/turn-off-alert-during-night/281156)
**Author:** [@wlbsxnlp22](https://discuss.elastic.co/u/wlbsxnlp22)\ **Replies:** 1\ **Last updated:** [August 13, 2021, 10:21pm UTC](https://discuss.elastic.co/t/turn-off-alert-during-night/281156 "2021-08-13T22:21:22Z")
Hi, Is there a way to use the Elasticsearch Query Alert type to only run an alert during business hours? If so does anyone have an example script? Any help would be very appreciated. --- ## [How to run rally against an existing on-premise cluster](https://discuss.elastic.co/t/how-to-run-rally-against-an-existing-on-premise-cluster/270228)
**Author:** [@anoopkv](https://discuss.elastic.co/u/anoopkv)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 1:17pm UTC](https://discuss.elastic.co/t/how-to-run-rally-against-an-existing-on-premise-cluster/270228 "2021-04-15T13:17:11Z")
I am running my elasticsearch (version 7.11) cluster on an on-premise kubernetes cluster. security is enabled in the cluster. to run rally i have created a separate pod --chart.yaml-- apiVersion: v1 kind: Pod … --- ## [Strange behavior with date histogram aggregation in a field that is inside a nested object (Elasticsearch 7.10.0)](https://discuss.elastic.co/t/strange-behavior-with-date-histogram-aggregation-in-a-field-that-is-inside-a-nested-object-elasticsearch-7-10-0/256823)
**Author:** [@tberne](https://discuss.elastic.co/u/tberne)\ **Replies:** 7\ **Last updated:** [November 30, 2020, 6:11pm UTC](https://discuss.elastic.co/t/strange-behavior-with-date-histogram-aggregation-in-a-field-that-is-inside-a-nested-object-elasticsearch-7-10-0/256823 "2020-11-30T18:11:54Z")
Hi! I'm in the middle of an upgrade process to the 7.10.0 Elasticsearch (changing the client from TransportClient to JavaRestHighLevelClient also) and I've noticed a strange behavior of Date Histogram Aggregation when i… --- ## [Kibana-7.8.1-1. Csv separator doesn't work in the Discovery -\> Share -\> CSV Reports](https://discuss.elastic.co/t/kibana-7-8-1-1-csv-separator-doesnt-work-in-the-discovery-share-csv-reports/248996)
**Author:** [@dsv](https://discuss.elastic.co/u/dsv)\ **Replies:** 1\ **Last updated:** [September 22, 2020, 6:30am UTC](https://discuss.elastic.co/t/kibana-7-8-1-1-csv-separator-doesnt-work-in-the-discovery-share-csv-reports/248996 "2020-09-22T06:30:33Z")
In Advanced settings the "CSV separator" is set to "backquote". And it works in the Visualize -\> "Export: Formatted". When i trying to export search results in the Discovery -\> Share -\> CSV Reports the format of the… --- ## [Scripted field to display custom metrics in a table visualization](https://discuss.elastic.co/t/scripted-field-to-display-custom-metrics-in-a-table-visualization/135718)
**Author:** [@espogian](https://discuss.elastic.co/u/espogian)\ **Replies:** 1\ **Last updated:** [June 13, 2018, 1:19pm UTC](https://discuss.elastic.co/t/scripted-field-to-display-custom-metrics-in-a-table-visualization/135718 "2018-06-13T13:19:18Z")
Hi, I'm new to scripted fields in Kibana. I have created a really simple table visualization which has an Average as metric and other Terms as Buckets. Therefore the output is like this: Items Average --------------… --- ## [Connecting redis through proxy](https://discuss.elastic.co/t/connecting-redis-through-proxy/77771)
**Author:** [@Sandhya\_Rathinapandi](https://discuss.elastic.co/u/Sandhya_Rathinapandi)\ **Replies:** 1\ **Last updated:** [March 11, 2017, 12:13am UTC](https://discuss.elastic.co/t/connecting-redis-through-proxy/77771 "2017-03-11T00:13:13Z")
I have my filebeat connecting to redis where filebeat is in one server and redis in other server. I will have to connect to the redis through a proxy. Is there any way I can do this? --- ## [Can I merge duplicate record and show it as a one record or document](https://discuss.elastic.co/t/can-i-merge-duplicate-record-and-show-it-as-a-one-record-or-document/45995)
**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\ **Replies:** 1\ **Last updated:** [March 31, 2016, 9:09pm UTC](https://discuss.elastic.co/t/can-i-merge-duplicate-record-and-show-it-as-a-one-record-or-document/45995 "2016-03-31T21:09:50Z")
Hi Experts, I can see following in elasticsearch index ID Name Marks 1 vik 10 2 vik 10 3 vik 10 4 gop 20 5 fall 20 I want to have something like … --- ## [Clusterのstatusについて](https://discuss.elastic.co/t/cluster-status/28172)
**Author:** [@hama\_rex](https://discuss.elastic.co/u/hama_rex)\ **Replies:** 1\ **Last updated:** [August 27, 2015, 4:34pm UTC](https://discuss.elastic.co/t/cluster-status/28172 "2015-08-27T16:34:22Z")
こんにちは。 elasticsearch1.6.2を利用しています。 クラスターのステータスがredになったままなのですが、どのようにすればgreenになるのでしょうか？ ■環境 CentOS release 6.2 (Final) ■\_cluster/health { "cluster\_name": "elasticsearch", "status": "red", "timed\_out": false, … --- ## [OS upgrade removed my ES Install](https://discuss.elastic.co/t/os-upgrade-removed-my-es-install/270397)
**Author:** [@cis4life](https://discuss.elastic.co/u/cis4life)\ **Replies:** 4\ **Last updated:** [April 22, 2021, 2:58pm UTC](https://discuss.elastic.co/t/os-upgrade-removed-my-es-install/270397 "2021-04-22T14:58:41Z")
Good Day, We currently run ES 5.x ( we are in the process of upgrading ) but we were running our install on an Ubuntu 16.04 server. So the team went and upgraded the OS of the server to 18.04 and when it was said and d… --- ## [Monitoring/tasks consistently running task](https://discuss.elastic.co/t/monitoring-tasks-consistently-running-task/262754)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 1\ **Last updated:** [January 31, 2021, 4:25pm UTC](https://discuss.elastic.co/t/monitoring-tasks-consistently-running-task/262754 "2021-01-31T16:25:19Z")
Can anyone explain these lines in the cat/tasks? should we be worried about them? --- ## [Custrom aggregations for anomaly detection](https://discuss.elastic.co/t/custrom-aggregations-for-anomaly-detection/234565)
**Author:** [@JorritvdLaan](https://discuss.elastic.co/u/JorritvdLaan)\ **Replies:** 4\ **Last updated:** [May 28, 2020, 1:10pm UTC](https://discuss.elastic.co/t/custrom-aggregations-for-anomaly-detection/234565 "2020-05-28T13:10:51Z")
Hello, We are trying to detect anomalies in electricity usage using Elastic's anomaly detection. To this end we would like to use pipeline aggregations such as derivative or serial differencing aggregations. Moreover,… --- ## [How to verify elasticsearch index store?](https://discuss.elastic.co/t/how-to-verify-elasticsearch-index-store/169802)
**Author:** [@azuresky11](https://discuss.elastic.co/u/azuresky11)\ **Replies:** 4\ **Last updated:** [February 25, 2019, 12:42pm UTC](https://discuss.elastic.co/t/how-to-verify-elasticsearch-index-store/169802 "2019-02-25T12:42:56Z")
Hi, All I use mmapfs to write data, but I want to change to niofs, need to rewrite the data? Then how to view index.store.type? --- ## [Why my packetbeat capture too much fields?](https://discuss.elastic.co/t/why-my-packetbeat-capture-too-much-fields/70017)
**Author:** [@shell.b2t](https://discuss.elastic.co/u/shell.b2t)\ **Replies:** 4\ **Last updated:** [December 27, 2016, 11:45am UTC](https://discuss.elastic.co/t/why-my-packetbeat-capture-too-much-fields/70017 "2016-12-27T11:45:45Z")
Hi: my env is packetbeat 5.5.1, in kibana management-index patterns,there is about 3000 fields,like this http.request.headers.hcxrwnivhh http.request.headers.ehzayscxyp http.request.headers.cqddzwwqrx http… --- ## [After upgrade to elastic search 1.2.1 getting org.elasticsearch.transport.RemoteTransportException: Failed to deserialize response of type \[org.elasticsearch.action.admin.cluster.node.info.NodesInfoResponse\]](https://discuss.elastic.co/t/after-upgrade-to-elastic-search-1-2-1-getting-org-elasticsearch-transport-remotetransportexception-failed-to-deserialize-response-of-type-org-elasticsearch-action-admin-cluster-node-info-nodesinforesponse/18051)
**Author:** [@Ritesh\_Adval](https://discuss.elastic.co/u/Ritesh_Adval)\ **Replies:** 4\ **Last updated:** [June 17, 2014, 8:38am UTC](https://discuss.elastic.co/t/after-upgrade-to-elastic-search-1-2-1-getting-org-elasticsearch-transport-remotetransportexception-failed-to-deserialize-response-of-type-org-elasticsearch-action-admin-cluster-node-info-nodesinforesponse/18051 "2014-06-17T08:38:58Z")
Hi We have upgraded our cluster to elastic search 1.2.1 from 0.90.1, its running using java 1.7.0.60 We upgraded clients to use 1.2.1 java library and when running it on a differnt box which has same java 1.7.0.60… --- ## [Would rolling restart cause continuous bulk data lost?](https://discuss.elastic.co/t/would-rolling-restart-cause-continuous-bulk-data-lost/232739)
**Author:** [@hackerwin7](https://discuss.elastic.co/u/hackerwin7)\ **Replies:** 8\ **Last updated:** [May 15, 2020, 2:09pm UTC](https://discuss.elastic.co/t/would-rolling-restart-cause-continuous-bulk-data-lost/232739 "2020-05-15T14:09:20Z")
Hi, According to this if default settings is only 1 primary shard is active, when rolling restart, the indexing write primary shard is down. primary have latest data, replicas haven't sync these latest data, when rolli… --- ## [Logstash showing error: connect timed out](https://discuss.elastic.co/t/logstash-showing-error-connect-timed-out/128455)
**Author:** [@sarang](https://discuss.elastic.co/u/sarang)\ **Replies:** 0\ **Last updated:** [April 18, 2018, 4:39am UTC](https://discuss.elastic.co/t/logstash-showing-error-connect-timed-out/128455 "2018-04-18T04:39:44Z")
Hi , I want data from table from servicenow(ITSM tool) into elasticsearch. So I am using http\_poller plugin to get the data from servicenow REST API. I am executing command logstash -f D:\\ELK\\Input\\http\_poller.conf: Af… --- ## [Lumberjack Client write error](https://discuss.elastic.co/t/lumberjack-client-write-error/37479)
**Author:** [@treehouse](https://discuss.elastic.co/u/treehouse)\ **Replies:** 0\ **Last updated:** [December 17, 2015, 2:58pm UTC](https://discuss.elastic.co/t/lumberjack-client-write-error/37479 "2015-12-17T14:58:28Z")
hey guys my stack had been working fine until just recently... i have two logstash instances, one accepting courier input which uses the lumberjack output, and one accepting lumberjack input... the first logstash insta… --- ## [Проблема с multiline filter](https://discuss.elastic.co/t/multiline-filter/27770)
**Author:** [@y3g0r](https://discuss.elastic.co/u/y3g0r)\ **Replies:** 0\ **Last updated:** [August 20, 2015, 3:11pm UTC](https://discuss.elastic.co/t/multiline-filter/27770 "2015-08-20T15:11:07Z")
Всем привет. Мне нужно организовать сбор логов с продакшена и вопрос по оптимальной инфраструктуре ELK stack я задам в другом топике. Здесь про проблемы с многострочным фильтром. И сразу картинки: В целом систе… --- ## [What does "managed namespaces" mean exactly?](https://discuss.elastic.co/t/what-does-managed-namespaces-mean-exactly/334054)
**Author:** [@nahh](https://discuss.elastic.co/u/nahh)\ **Replies:** 2\ **Last updated:** [May 25, 2023, 2:55pm UTC](https://discuss.elastic.co/t/what-does-managed-namespaces-mean-exactly/334054 "2023-05-25T14:55:59Z")
I'm looking in to installing ECK in my Kubernetes clusters and I'm stuck on one issue: in the helm chart for ECK we're asked to specify a list of "managed namespaces". What does that mean? Specifically, what is being man… --- ## [Ansible kibana keystore elastic user fails](https://discuss.elastic.co/t/ansible-kibana-keystore-elastic-user-fails/173414)
**Author:** [@Kevin\_Comer](https://discuss.elastic.co/u/Kevin_Comer)\ **Replies:** 2\ **Last updated:** [March 29, 2019, 5:05pm UTC](https://discuss.elastic.co/t/ansible-kibana-keystore-elastic-user-fails/173414 "2019-03-29T17:05:56Z")
I'm trying to automate creation of the kibana user for elasticsearch which is stored in the kibana keystore. I am getting a failure when I do this on an initial create. The setting elasticsearch.username is getting crea… --- ## [Slow Bulk Updates on 6.2.3](https://discuss.elastic.co/t/slow-bulk-updates-on-6-2-3/125513)
**Author:** [@ctrix](https://discuss.elastic.co/u/ctrix)\ **Replies:** 2\ **Last updated:** [April 10, 2018, 12:57pm UTC](https://discuss.elastic.co/t/slow-bulk-updates-on-6-2-3/125513 "2018-04-10T12:57:24Z")
Hello all, i'm following up on this comment on github and the following suggestion. I have a cluster of 8 blades, 32G RAM and Xeon Processors. I receive, from a kafka topic, a lot of documents that need to be inserted… --- ## [Do proxy only runners consume a license?](https://discuss.elastic.co/t/do-proxy-only-runners-consume-a-license/110970)
**Author:** [@crickes](https://discuss.elastic.co/u/crickes)\ **Replies:** 2\ **Last updated:** [December 19, 2017, 5:16pm UTC](https://discuss.elastic.co/t/do-proxy-only-runners-consume-a-license/110970 "2017-12-19T17:16:16Z")
Hi, As the title says, does anyone know if a host which is running just the proxy role, counts as an instance that would consume an ECE license? Thanks, Steve --- ## [How to multiple events into one event in filebeat](https://discuss.elastic.co/t/how-to-multiple-events-into-one-event-in-filebeat/88108)
**Author:** [@pratheek\_k](https://discuss.elastic.co/u/pratheek_k)\ **Replies:** 2\ **Last updated:** [June 6, 2017, 9:53am UTC](https://discuss.elastic.co/t/how-to-multiple-events-into-one-event-in-filebeat/88108 "2017-06-06T09:53:12Z")
I would like to combine multiple events into one event in the filebeat based on a unique string. I have the below log: June 1st 2017, 11:51:26.992 12345ab AAAAA ClassName:methodName:99 \[DEBUG\] - Received request: June 1s… --- ## [Logstash - Pipeline main started not executing further](https://discuss.elastic.co/t/logstash-pipeline-main-started-not-executing-further/57954)
**Author:** [@kmk3173](https://discuss.elastic.co/u/kmk3173)\ **Replies:** 2\ **Last updated:** [August 14, 2016, 2:43pm UTC](https://discuss.elastic.co/t/logstash-pipeline-main-started-not-executing-further/57954 "2016-08-14T14:43:35Z")
Hi, I created a config file that runs but stalls after pipeline main started. I'm not sure if the issue relates to the fact that I have two config files in the config folder to read 2 different csv files and output it … --- ## [Want to log marvel watch (for high memory usage) results to an index](https://discuss.elastic.co/t/want-to-log-marvel-watch-for-high-memory-usage-results-to-an-index/57047)
**Author:** [@casieowen](https://discuss.elastic.co/u/casieowen)\ **Replies:** 2\ **Last updated:** [August 3, 2016, 3:54pm UTC](https://discuss.elastic.co/t/want-to-log-marvel-watch-for-high-memory-usage-results-to-an-index/57047 "2016-08-03T15:54:43Z")
Hi, I have watches pointing at our main (non marvel) cluster and logging results was watch\_records in an index we created for this purpose. Eventually we're going to hook this up to a webhook, but for now just want a … --- ## [Installing elasticsearch plugins from RPMs](https://discuss.elastic.co/t/installing-elasticsearch-plugins-from-rpms/45158)
**Author:** [@ravinaik1312](https://discuss.elastic.co/u/ravinaik1312)\ **Replies:** 2\ **Last updated:** [March 22, 2016, 9:21pm UTC](https://discuss.elastic.co/t/installing-elasticsearch-plugins-from-rpms/45158 "2016-03-22T21:21:23Z")
I am trying to install the HEAD plugin from an RPM, but it's failing because of the common error of 'ERROR: Could not find plugin descriptor 'plugin-descriptor.properties' in plugin zip', my rpm contains that file. Tr… --- ## [Kibana search](https://discuss.elastic.co/t/kibana-search/27479)
**Author:** [@varunu](https://discuss.elastic.co/u/varunu)\ **Replies:** 2\ **Last updated:** [August 17, 2015, 3:53pm UTC](https://discuss.elastic.co/t/kibana-search/27479 "2015-08-17T15:53:25Z")
I am using kibana4 for visualizing the elastic search results. The problem what i am facing is that i have a search query (drive OR exchange), which is resulting the matching hits correctly, but i am not sure how would i… --- ## [How to change the default date format?](https://discuss.elastic.co/t/how-to-change-the-default-date-format/2886)
**Author:** [@HubertChang](https://discuss.elastic.co/u/HubertChang)\ **Replies:** 2\ **Last updated:** [April 2, 2010, 10:06pm UTC](https://discuss.elastic.co/t/how-to-change-the-default-date-format/2886 "2010-04-02T22:06:42Z")
Now date format can be specified by mapping for specified type. Documents said "The parsing of dates uses Joda. The default date parsing used if no format is specified is ISODateTimeFormat.dateOptionalTimeParser.". … --- ## [Webhook with variables from Query DSL hits](https://discuss.elastic.co/t/webhook-with-variables-from-query-dsl-hits/318319)
**Author:** [@Alex\_Molina\_Bastos](https://discuss.elastic.co/u/Alex_Molina_Bastos)\ **Replies:** 3\ **Last updated:** [November 10, 2022, 4:22pm UTC](https://discuss.elastic.co/t/webhook-with-variables-from-query-dsl-hits/318319 "2022-11-10T16:22:35Z")
Hi, I am trying to create a rule that when triggered gets a variable, an IP in this case, from Query DSL and sends this variable through a webhook. I should be available to get an array of these variables if there are … [Previous page](https://discuss.elastic.co/top.md?page=1613&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1615&per_page=50&period=all)