# Top

**URL:** https://discuss.elastic.co/top.md?page=1619&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1620

---

## [Publishing the elasticsearch Search APIs to a API gateway](https://discuss.elastic.co/t/publishing-the-elasticsearch-search-apis-to-a-api-gateway/214836)

<div class="topic-metadata">

**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\
**Replies:** 4\
**Last updated:** [January 28, 2020, 7:57am UTC](https://discuss.elastic.co/t/publishing-the-elasticsearch-search-apis-to-a-api-gateway/214836 "2020-01-28T07:57:09Z")

</div>

Is it possible to publish the Elasticsearch Search APIs to a API gateway like axway.

---

## [Rolling Upgrade from 6.8.0 to 7.3.1 Failed to Join the Cluster](https://discuss.elastic.co/t/rolling-upgrade-from-6-8-0-to-7-3-1-failed-to-join-the-cluster/198604)

<div class="topic-metadata">

**Author:** [@Namrata\_Khobragade](https://discuss.elastic.co/u/Namrata_Khobragade)\
**Replies:** 4\
**Last updated:** [September 9, 2019, 6:31am UTC](https://discuss.elastic.co/t/rolling-upgrade-from-6-8-0-to-7-3-1-failed-to-join-the-cluster/198604 "2019-09-09T06:31:06Z")

</div>

Hello all, I am currently having an Elasticsearch 6.8 Cluster with one master and one slave node. I need to upgrade this Elasticsearch to current version 7.3.1. I am following the Rolling Upgrade Steps given in https…

---

## [Curl result of a time range query is 8 hours earlier which is not my timezone](https://discuss.elastic.co/t/curl-result-of-a-time-range-query-is-8-hours-earlier-which-is-not-my-timezone/188688)

<div class="topic-metadata">

**Author:** [@mmk1995](https://discuss.elastic.co/u/mmk1995)\
**Replies:** 4\
**Last updated:** [July 4, 2019, 2:04pm UTC](https://discuss.elastic.co/t/curl-result-of-a-time-range-query-is-8-hours-earlier-which-is-not-my-timezone/188688 "2019-07-04T14:04:48Z")

</div>

Hello all, I am trying with the below simple search query in Kibana: POST /esd-dhcplog\*/\_search { "query": { "bool": { "must": \[ { "range": { "rece…

---

## [Reading shipper files from sub directories](https://discuss.elastic.co/t/reading-shipper-files-from-sub-directories/49458)

<div class="topic-metadata">

**Author:** [@Muhasin\_Cm](https://discuss.elastic.co/u/Muhasin_Cm)\
**Replies:** 4\
**Last updated:** [May 9, 2016, 5:59am UTC](https://discuss.elastic.co/t/reading-shipper-files-from-sub-directories/49458 "2016-05-09T05:59:00Z")

</div>

Hi, How can i make logstash read shipper conf files inside the sub directories of /etc/logstash/conf.d/ I have copied the conf file inside /etc/logstash/conf.d/ on sub directories. I need this to be work on the log…

---

## [Logstash plugin installation error](https://discuss.elastic.co/t/logstash-plugin-installation-error/32132)

<div class="topic-metadata">

**Author:** [@Omkar\_Poudel](https://discuss.elastic.co/u/Omkar_Poudel)\
**Replies:** 4\
**Last updated:** [October 14, 2015, 8:38pm UTC](https://discuss.elastic.co/t/logstash-plugin-installation-error/32132 "2015-10-14T20:38:41Z")

</div>

Running plugin install logstash-input-jdbc returns Trying https://github.com/null/logstash-input-jdbc/archive/master.zip... Failed to install logstash-input-jdbc, reason: failed to download out of all possible locat…

---

## [Getting \[marvel.agent.exporter \] \[Tempest\] remote target didn't respond with 200 OK response code \[404 Not Found](https://discuss.elastic.co/t/getting-marvel-agent-exporter-tempest-remote-target-didnt-respond-with-200-ok-response-code-404-not-found/16482)

<div class="topic-metadata">

**Author:** [@Dennis\_Andersen](https://discuss.elastic.co/u/Dennis_Andersen)\
**Replies:** 4\
**Last updated:** [February 27, 2015, 7:08am UTC](https://discuss.elastic.co/t/getting-marvel-agent-exporter-tempest-remote-target-didnt-respond-with-200-ok-response-code-404-not-found/16482 "2015-02-27T07:08:11Z")

</div>

My two clusters, currently default named, Tempest and Morg, appear to be working fine. The head plugin shows green and queries work. I have indices and documents added. When I added Marvel, restarted both nodes, I…

---

## [Metricbeat ILM enabled with OSS ES Cluster when using auto](https://discuss.elastic.co/t/metricbeat-ilm-enabled-with-oss-es-cluster-when-using-auto/235293)

<div class="topic-metadata">

**Author:** [@TheNom](https://discuss.elastic.co/u/TheNom)\
**Replies:** 1\
**Last updated:** [June 2, 2020, 3:23pm UTC](https://discuss.elastic.co/t/metricbeat-ilm-enabled-with-oss-es-cluster-when-using-auto/235293 "2020-06-02T15:23:22Z")

</div>

Hi, I have an issue with Metricbeat OSS v7.6.1 enabling the ILM feature when the output is an OSS\\OD cluster. Jun 01 10:44:38 ip-10-100-129-179.eu-west-1.compute.internal metricbeat\[3654\]: 2020-06-01T10:44:38.720Z …

---

## [Elasticsearch 7.3.2 plugin install could not find java Raspberry Pi4 Buster](https://discuss.elastic.co/t/elasticsearch-7-3-2-plugin-install-could-not-find-java-raspberry-pi4-buster/213265)

<div class="topic-metadata">

**Author:** [@xiaojunma](https://discuss.elastic.co/u/xiaojunma)\
**Replies:** 1\
**Last updated:** [January 2, 2020, 6:38pm UTC](https://discuss.elastic.co/t/elasticsearch-7-3-2-plugin-install-could-not-find-java-raspberry-pi4-buster/213265 "2020-01-02T18:38:02Z")

</div>

After installation of Elasticserach 7.3.2. on Raspberry Pi4 / Buster, sudo /usr/share/elasticsearch/bin/elasticsearch-plugin install ingest-attachment could not find java in JAVA\_HOME or bundled at /usr/share/elastics…

---

## [Pipeline with id \[xpack\_monitoring\_6\] does not exist](https://discuss.elastic.co/t/pipeline-with-id-xpack-monitoring-6-does-not-exist/210014)

<div class="topic-metadata">

**Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\
**Replies:** 1\
**Last updated:** [December 3, 2019, 5:44pm UTC](https://discuss.elastic.co/t/pipeline-with-id-xpack-monitoring-6-does-not-exist/210014 "2019-12-03T17:44:10Z")

</div>

I have a 5.5.1 ES cluster that I was looking to upgrade to 5.6.16. It is a 4 node cluster with 1 master node and 3 data nodes in TEST (non-prod) environment. In order to test my upgrade scripts, I added a new master node…

---

## [Elasticsearch Watcher - Publish notifications to Amazon SNS](https://discuss.elastic.co/t/elasticsearch-watcher-publish-notifications-to-amazon-sns/200297)

<div class="topic-metadata">

**Author:** [@chandra2037](https://discuss.elastic.co/u/chandra2037)\
**Replies:** 1\
**Last updated:** [September 20, 2019, 4:21pm UTC](https://discuss.elastic.co/t/elasticsearch-watcher-publish-notifications-to-amazon-sns/200297 "2019-09-20T16:21:47Z")

</div>

Has anyone tried publishing notifications to Amazon SNS from Elasticsearch Advanced Watchers? Is it even possible? If it is possible, should we use webhook action? What are the things that need to be configured? Any he…

---

## [Logstash JDBC plugin + Steaming filter + delta import when a child table has changed](https://discuss.elastic.co/t/logstash-jdbc-plugin-steaming-filter-delta-import-when-a-child-table-has-changed/173909)

<div class="topic-metadata">

**Author:** [@Fazolo](https://discuss.elastic.co/u/Fazolo)\
**Replies:** 1\
**Last updated:** [March 26, 2019, 11:13pm UTC](https://discuss.elastic.co/t/logstash-jdbc-plugin-steaming-filter-delta-import-when-a-child-table-has-changed/173909 "2019-03-26T23:13:18Z")

</div>

Hello, I'm using the JDBC input plugin with the streaming filter to enrich the base data with extra data found in an other tables: input { jdbc { jdbc\_connection\_string =\> "jdbc:mysql://mysql…

---

## [Multiline pattern & flush pattern in filebeat](https://discuss.elastic.co/t/multiline-pattern-flush-pattern-in-filebeat/159885)

<div class="topic-metadata">

**Author:** [@vennila](https://discuss.elastic.co/u/vennila)\
**Replies:** 1\
**Last updated:** [December 11, 2018, 12:10pm UTC](https://discuss.elastic.co/t/multiline-pattern-flush-pattern-in-filebeat/159885 "2018-12-11T12:10:40Z")

</div>

Hi All, I am using multiline pattern within filebeat.yml to format the logs as follows, filebeat.inputs: document\_type: webapp enabled: true paths: /opt/sample/app.log multiline.pattern: '^., \[\[^\]\]+\]' multiline.…

---

## [Match long query text to short field](https://discuss.elastic.co/t/match-long-query-text-to-short-field/144584)

<div class="topic-metadata">

**Author:** [@dmill](https://discuss.elastic.co/u/dmill)\
**Replies:** 1\
**Last updated:** [August 16, 2018, 12:17am UTC](https://discuss.elastic.co/t/match-long-query-text-to-short-field/144584 "2018-08-16T00:17:37Z")

</div>

Standard match involves providing a small query term or phrase and matching it against a larger blob of text stored in a document. I want to do the reverse - my query will be a large blob of text, like a paragraph, and I…

---

## [Parallel document processing across nodes?](https://discuss.elastic.co/t/parallel-document-processing-across-nodes/128215)

<div class="topic-metadata">

**Author:** [@sdeck51](https://discuss.elastic.co/u/sdeck51)\
**Replies:** 1\
**Last updated:** [April 16, 2018, 8:32pm UTC](https://discuss.elastic.co/t/parallel-document-processing-across-nodes/128215 "2018-04-16T20:32:38Z")

</div>

Hi, I've been playing around with making an elastic search plugin and have added a few endpoints to do things that es doesn't currently do like text summary. I was wondering if there was an interface/design pattern for …

---

## [Spark Structured Streaming using ES as sink](https://discuss.elastic.co/t/spark-structured-streaming-using-es-as-sink/94351)

<div class="topic-metadata">

**Author:** [@Thomas\_Rouch](https://discuss.elastic.co/u/Thomas_Rouch)\
**Replies:** 1\
**Last updated:** [July 25, 2017, 5:38pm UTC](https://discuss.elastic.co/t/spark-structured-streaming-using-es-as-sink/94351 "2017-07-25T17:38:51Z")

</div>

Hello everybody,:wave: I know the question has already been asked in the same terms but I think it deserves an update. Indeed, the new Spark 2.2 release now provide the structured streams in GA status (general availabi…

---

## [Upgrading a single node](https://discuss.elastic.co/t/upgrading-a-single-node/67017)

<div class="topic-metadata">

**Author:** [@Alejandro\_Navarrete](https://discuss.elastic.co/u/Alejandro_Navarrete)\
**Replies:** 1\
**Last updated:** [November 24, 2016, 2:44am UTC](https://discuss.elastic.co/t/upgrading-a-single-node/67017 "2016-11-24T02:44:13Z")

</div>

I am currently trying to migrate from version 4.3 to version 5.0 (Elasticseach). I am following the guide "Full cluster restart upgrade" on the documentation. On step 3 "Shutdown and upgrade all nodes", I have a quest…

---

## [Gzipped input for logstash](https://discuss.elastic.co/t/gzipped-input-for-logstash/63448)

<div class="topic-metadata">

**Author:** [@soudipta](https://discuss.elastic.co/u/soudipta)\
**Replies:** 1\
**Last updated:** [October 23, 2016, 4:49pm UTC](https://discuss.elastic.co/t/gzipped-input-for-logstash/63448 "2016-10-23T16:49:57Z")

</div>

Hi, Is it possible to ingest tar.gz files into logstash. I tried the gzip-lines codec, but it did not work. can someone please suggest if there is alternatives to get zipped files ingested into logstash? Thanks, Soud…

---

## [How to do pipeline range aggregation on terms aggregation?](https://discuss.elastic.co/t/how-to-do-pipeline-range-aggregation-on-terms-aggregation/58265)

<div class="topic-metadata">

**Author:** [@phoenixgao](https://discuss.elastic.co/u/phoenixgao)\
**Replies:** 1\
**Last updated:** [September 23, 2016, 3:29pm UTC](https://discuss.elastic.co/t/how-to-do-pipeline-range-aggregation-on-terms-aggregation/58265 "2016-09-23T15:29:30Z")

</div>

For example, I have "events" indexed into elasticsearch, like, { "event": "visit", "user\_id": 123, "timestamp": "2016-08-16T00:02:03" } With bucket terms aggregation on field user\_i…

---

## [Retrieve \_parent field with spark](https://discuss.elastic.co/t/retrieve--parent-field-with-spark/53941)

<div class="topic-metadata">

**Author:** [@Pawel\_Chabierski](https://discuss.elastic.co/u/Pawel_Chabierski)\
**Replies:** 1\
**Last updated:** [July 2, 2016, 4:48pm UTC](https://discuss.elastic.co/t/retrieve--parent-field-with-spark/53941 "2016-07-02T16:48:14Z")

</div>

Hi, I have problem with retrieving \_parent field from elasticsearch using pyspark. Rdd does not contains \_parent field if I specify that field in fields. My Code: es\_query = { "fields": \["\_parent", "\_source"\] }…

---

## [Rest api](https://discuss.elastic.co/t/rest-api/49893)

<div class="topic-metadata">

**Author:** [@Serge\_Scevenels](https://discuss.elastic.co/u/Serge_Scevenels)\
**Replies:** 1\
**Last updated:** [May 12, 2016, 12:52pm UTC](https://discuss.elastic.co/t/rest-api/49893 "2016-05-12T12:52:58Z")

</div>

Hi, I am trying to use the REST API in order to generate graphs from python. It works fine :). However, with the documentation available, I don't see how i can request efficiently for a Big Graph, let's say with 1 m…

---

## [Kibana web service or API](https://discuss.elastic.co/t/kibana-web-service-or-api/47697)

<div class="topic-metadata">

**Author:** [@Ivy](https://discuss.elastic.co/u/Ivy)\
**Replies:** 1\
**Last updated:** [April 18, 2016, 8:37pm UTC](https://discuss.elastic.co/t/kibana-web-service-or-api/47697 "2016-04-18T20:37:31Z")

</div>

Hi, I am building a website and want to integrate the dashboard created by Kibana into my website. Does Kibana provide web service or API so that I can send the query to Kibana and update the dashboard on my website dy…

---

## [Logstash JDBC plugin question](https://discuss.elastic.co/t/logstash-jdbc-plugin-question/41586)

<div class="topic-metadata">

**Author:** [@jaminvp](https://discuss.elastic.co/u/jaminvp)\
**Replies:** 1\
**Last updated:** [February 14, 2016, 12:01pm UTC](https://discuss.elastic.co/t/logstash-jdbc-plugin-question/41586 "2016-02-14T12:01:34Z")

</div>

Greetings, Presume I have a database table containing status info about processing jobs. This table would have the following columns with an example rule: JobID - Jobname - RunDate - Status - StartTimestamp - EndTi…

---

## [Standalone ES configuration](https://discuss.elastic.co/t/standalone-es-configuration/22782)

<div class="topic-metadata">

**Author:** [@tbc](https://discuss.elastic.co/u/tbc)\
**Replies:** 1\
**Last updated:** [March 20, 2015, 6:19pm UTC](https://discuss.elastic.co/t/standalone-es-configuration/22782 "2015-03-20T18:19:53Z")

</div>

I want to run standalone. I understand that 'es.discovery.zen.ping.multicast.enabled: false' is the essential setting, but I'm confused by advice given in the logstash group. In a two year-old post \[1\], Untergeek a…

---

## [Compostable index templates](https://discuss.elastic.co/t/compostable-index-templates/273841)

<div class="topic-metadata">

**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Replies:** 0\
**Last updated:** [May 24, 2021, 3:05pm UTC](https://discuss.elastic.co/t/compostable-index-templates/273841 "2021-05-24T15:05:57Z")

</div>

Is there a 10,000 foot description of the new template changes somewhere?

---

## [Problem with EQL sequence by with field containing reserved characters](https://discuss.elastic.co/t/problem-with-eql-sequence-by-with-field-containing-reserved-characters/358295)

<div class="topic-metadata">

**Author:** [@llafortezza](https://discuss.elastic.co/u/llafortezza)\
**Replies:** 4\
**Last updated:** [April 27, 2024, 12:16pm UTC](https://discuss.elastic.co/t/problem-with-eql-sequence-by-with-field-containing-reserved-characters/358295 "2024-04-27T12:16:59Z")

</div>

Hi, i have the following error line 1:56: mismatched input '.0' expecting {'with', '\[', '!\['} with this EQL query: sequence by azure.auditlogs.properties.target\_resources.0.id with maxspan=24h \[any where event.datas…

---

## [Exporting/Importing Saved Objects in Kibana 7.1](https://discuss.elastic.co/t/exporting-importing-saved-objects-in-kibana-7-1/262410)

<div class="topic-metadata">

**Author:** [@Colby\_Dozier](https://discuss.elastic.co/u/Colby_Dozier)\
**Replies:** 3\
**Last updated:** [January 27, 2021, 8:15pm UTC](https://discuss.elastic.co/t/exporting-importing-saved-objects-in-kibana-7-1/262410 "2021-01-27T20:15:59Z")

</div>

We are stuck with 7.1 being the newest version of Kibana we can use in our environment. I'm attempting to import multiple saved objects that was exported by hand in Kibana into a JSON file. This would be done during stan…

---

## ['unknown key \[actor\] for create index](https://discuss.elastic.co/t/unknown-key-actor-for-create-index/232344)

<div class="topic-metadata">

**Author:** [@Kevin\_Juliano](https://discuss.elastic.co/u/Kevin_Juliano)\
**Replies:** 0\
**Last updated:** [May 13, 2020, 2:58am UTC](https://discuss.elastic.co/t/unknown-key-actor-for-create-index/232344 "2020-05-13T02:58:29Z")

</div>

Hi Guys, I'm still familiarizing myself in Elasticsearch, Right now, I am experimenting on analyzers but when I finished the mapping and started the indexing, it gives me this error: type: 'parse\_exception'reason: 'unk…

---

## [Smart Search query](https://discuss.elastic.co/t/smart-search-query/230477)

<div class="topic-metadata">

**Author:** [@darkslayer](https://discuss.elastic.co/u/darkslayer)\
**Replies:** 0\
**Last updated:** [April 30, 2020, 6:59am UTC](https://discuss.elastic.co/t/smart-search-query/230477 "2020-04-30T06:59:02Z")

</div>

I want to write a query to be able to search across all fields in my Elasticsearch index. I used the bulk API to insert data to es and didn't choose any particular analyzer while indexing. By default my fields will be an…

---

## [Cluster High-Availability](https://discuss.elastic.co/t/cluster-high-availability/179915)

<div class="topic-metadata">

**Author:** [@fim](https://discuss.elastic.co/u/fim)\
**Replies:** 3\
**Last updated:** [May 7, 2019, 8:33am UTC](https://discuss.elastic.co/t/cluster-high-availability/179915 "2019-05-07T08:33:51Z")

</div>

I suppose to have a problem in my configuration that the master node is not switching properly. We operate a two node cluster (test environment), later it will be a three-node cluster (production environment). For testi…

---

## [Elastic Cloud with Filebeat](https://discuss.elastic.co/t/elastic-cloud-with-filebeat/150308)

<div class="topic-metadata">

**Author:** [@ratman](https://discuss.elastic.co/u/ratman)\
**Replies:** 3\
**Last updated:** [September 29, 2018, 9:32pm UTC](https://discuss.elastic.co/t/elastic-cloud-with-filebeat/150308 "2018-09-29T21:32:16Z")

</div>

Hello! We are developing a small project for which we have decided to use the Elastic Cloud service as a deployment for our product but we have a major doubt about data ingest. Currently we receive some data logs to ou…

---

## [2.3.1 transport client failed to get local cluster state](https://discuss.elastic.co/t/2-3-1-transport-client-failed-to-get-local-cluster-state/103041)

<div class="topic-metadata">

**Author:** [@Deb](https://discuss.elastic.co/u/Deb)\
**Replies:** 0\
**Last updated:** [October 6, 2017, 3:49pm UTC](https://discuss.elastic.co/t/2-3-1-transport-client-failed-to-get-local-cluster-state/103041 "2017-10-06T15:49:58Z")

</div>

In 2.3.1 I am seeing an exception similar to the one mentioned here. Below is the exception:-1: INFO \[2017-08-08 20:14:18,019\] \[U:3,129,F:822,T:3,950,M:3,950\] elasticsearch.client.transport:\[TransportClientNodesService…

---

## [Machine learning \_getting alert while creating a new job](https://discuss.elastic.co/t/machine-learning-getting-alert-while-creating-a-new-job/102665)

<div class="topic-metadata">

**Author:** [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\
**Replies:** 3\
**Last updated:** [October 4, 2017, 2:00pm UTC](https://discuss.elastic.co/t/machine-learning-getting-alert-while-creating-a-new-job/102665 "2017-10-04T14:00:18Z")

</div>

Hi All, Iam trying to create a job and am getting this message,am not sure why am getting this message \[image\] Please let me know what should I do this. Thanks, Raj

---

## [Specific node is working "harder" than the others on the cluster](https://discuss.elastic.co/t/specific-node-is-working-harder-than-the-others-on-the-cluster/72384)

<div class="topic-metadata">

**Author:** [@Itzhak](https://discuss.elastic.co/u/Itzhak)\
**Replies:** 3\
**Last updated:** [January 22, 2017, 4:19pm UTC](https://discuss.elastic.co/t/specific-node-is-working-harder-than-the-others-on-the-cluster/72384 "2017-01-22T16:19:43Z")

</div>

Hi, I have an Elasticsearch cluster (version 2.3.4) with a custom app pulling data and a couchbase cluster pushing data to it (once an hour). The cluster is based on Amazon EC2 machines with the same specs and settings…

---

## [How to get authorized with sAMAcount](https://discuss.elastic.co/t/how-to-get-authorized-with-samacount/67337)

<div class="topic-metadata">

**Author:** [@gilisade](https://discuss.elastic.co/u/gilisade)\
**Replies:** 3\
**Last updated:** [December 4, 2016, 5:31am UTC](https://discuss.elastic.co/t/how-to-get-authorized-with-samacount/67337 "2016-12-04T05:31:08Z")

</div>

Hi i'm trying to use x-pack - shield i've set up an active directory realm in my ES server then i mapped a domain user to a superuser role when i try to log in to the kibana with that domain user everything seems to w…

---

## [Clients sending invalid docs](https://discuss.elastic.co/t/clients-sending-invalid-docs/47261)

<div class="topic-metadata">

**Author:** [@mhughes](https://discuss.elastic.co/u/mhughes)\
**Replies:** 3\
**Last updated:** [April 14, 2016, 11:00pm UTC](https://discuss.elastic.co/t/clients-sending-invalid-docs/47261 "2016-04-14T23:00:13Z")

</div>

I have a bunch of clients that are sending documents directly to my ES cluster via bulkIndex. Those documents are valid for 1.x, but are now invalid with 2.x. Specifically, a lot of the documents had periods in field n…

---

## [Metricbeat events not indexed in Elasticsearch](https://discuss.elastic.co/t/metricbeat-events-not-indexed-in-elasticsearch/274998)

<div class="topic-metadata">

**Author:** [@Hugues\_Bernard](https://discuss.elastic.co/u/Hugues_Bernard)\
**Replies:** 2\
**Last updated:** [June 10, 2021, 11:36am UTC](https://discuss.elastic.co/t/metricbeat-events-not-indexed-in-elasticsearch/274998 "2021-06-10T11:36:14Z")

</div>

I configured metricbeat on one node of a 3 nodes elasticsearch cluster. Metricbeat output is set to a separate elasticsearch on a dedicated VM used for monitoring data only. Metricbeat is sending events every 10 secon…

---

## [How to create new fields and documents based on variable length log?](https://discuss.elastic.co/t/how-to-create-new-fields-and-documents-based-on-variable-length-log/232303)

<div class="topic-metadata">

**Author:** [@san\_sun](https://discuss.elastic.co/u/san_sun)\
**Replies:** 2\
**Last updated:** [May 13, 2020, 5:03am UTC](https://discuss.elastic.co/t/how-to-create-new-fields-and-documents-based-on-variable-length-log/232303 "2020-05-13T05:03:10Z")

</div>

I have a log message with a format like: status : name message ; status: name message ; status: name message ; status: name message..... I need to split based on the semicolon, and create separate Elasticsearch docu…

---

## [Metricbeat encrypt passwords in configuration file](https://discuss.elastic.co/t/metricbeat-encrypt-passwords-in-configuration-file/231889)

<div class="topic-metadata">

**Author:** [@mctj](https://discuss.elastic.co/u/mctj)\
**Replies:** 2\
**Last updated:** [May 11, 2020, 8:16am UTC](https://discuss.elastic.co/t/metricbeat-encrypt-passwords-in-configuration-file/231889 "2020-05-11T08:16:57Z")

</div>

Hey, I'm using the new sql module in version 7.6 and I need to assign the username and the password of the db in the yaml config in the hosts key(src). If someone will read the yaml file or get it from anybody it means…

---

## [Access denied and failure when i change network.host](https://discuss.elastic.co/t/access-denied-and-failure-when-i-change-network-host/178110)

<div class="topic-metadata">

**Author:** [@Sabyo](https://discuss.elastic.co/u/Sabyo)\
**Replies:** 2\
**Last updated:** [April 24, 2019, 8:44am UTC](https://discuss.elastic.co/t/access-denied-and-failure-when-i-change-network-host/178110 "2019-04-24T08:44:22Z")

</div>

Hello, Fresh installation : ElasticSearch version : 7.0 Elastic Search works fines when it runs on localhost. But, when I modify elasticsearch.yml at network.host, and restart service I get an "access denied" and ES s…

---

## [Dynamic mapping strict and date data type (ES 6.4)](https://discuss.elastic.co/t/dynamic-mapping-strict-and-date-data-type-es-6-4/170667)

<div class="topic-metadata">

**Author:** [@nishant.saini](https://discuss.elastic.co/u/nishant.saini)\
**Replies:** 2\
**Last updated:** [March 4, 2019, 9:24am UTC](https://discuss.elastic.co/t/dynamic-mapping-strict-and-date-data-type-es-6-4/170667 "2019-03-04T09:24:10Z")

</div>

I have created an index with following mapping: { "mappings": { "\_doc": { "dynamic": "strict", "properties": { "created ": { "type": "date", "format": "yyyy/MM/dd HH:mm:ss||…

---

## [Getting rid of labels partially](https://discuss.elastic.co/t/getting-rid-of-labels-partially/138833)

<div class="topic-metadata">

**Author:** [@Sunil\_Khullar](https://discuss.elastic.co/u/Sunil_Khullar)\
**Replies:** 2\
**Last updated:** [July 6, 2018, 1:17pm UTC](https://discuss.elastic.co/t/getting-rid-of-labels-partially/138833 "2018-07-06T13:17:38Z")

</div>

How does one get rid of some of the labels and retain some. Below I want to retain the vertical labels and get rid of the horizontal ones (status : Descending ; where status is the name of a term)

---

## [org.locationtech.Spatial4j dependency missing in ES 6.3.0?](https://discuss.elastic.co/t/org-locationtech-spatial4j-dependency-missing-in-es-6-3-0/138718)

<div class="topic-metadata">

**Author:** [@pokaleshrey](https://discuss.elastic.co/u/pokaleshrey)\
**Replies:** 2\
**Last updated:** [July 5, 2018, 3:07pm UTC](https://discuss.elastic.co/t/org-locationtech-spatial4j-dependency-missing-in-es-6-3-0/138718 "2018-07-05T15:07:29Z")

</div>

I have upgraded from 6.1.3 to 6.3.0. Code by using 6.1.3: final CircleBuilder circleBuilder = ShapeBuilders.newCircleBuilder(); circleBuilder.radius(String.valueOf(radius)); circleBuilder.center(longitude, latitude); C…

---

## [Unable to see all fields in Kibana](https://discuss.elastic.co/t/unable-to-see-all-fields-in-kibana/119428)

<div class="topic-metadata">

**Author:** [@MaximeP](https://discuss.elastic.co/u/MaximeP)\
**Replies:** 2\
**Last updated:** [February 12, 2018, 7:00pm UTC](https://discuss.elastic.co/t/unable-to-see-all-fields-in-kibana/119428 "2018-02-12T19:00:43Z")

</div>

Hi, I use logstash to receive syslog data from my network devices but I can not see all the fields I want in the discover menu. I receive syslogs from a reverse proxy and I would like to see fields like "http\_host" or …

---

## [Issue with kafka input plugin](https://discuss.elastic.co/t/issue-with-kafka-input-plugin/97451)

<div class="topic-metadata">

**Author:** [@axelfelix](https://discuss.elastic.co/u/axelfelix)\
**Replies:** 2\
**Last updated:** [September 7, 2017, 10:12am UTC](https://discuss.elastic.co/t/issue-with-kafka-input-plugin/97451 "2017-09-07T10:12:47Z")

</div>

Hi all, I am on my way to upgrade all my ELK cluster. The last point is the logtsash upgrade (before 2.3, future 5.5). Kafka version: 0.11.0.0 With logstash kafka input plugin version 2.0.6, I do not have any problem …

---

## [Parsing thread number in grok](https://discuss.elastic.co/t/parsing-thread-number-in-grok/87743)

<div class="topic-metadata">

**Author:** [@zanza54](https://discuss.elastic.co/u/zanza54)\
**Replies:** 2\
**Last updated:** [May 31, 2017, 1:27pm UTC](https://discuss.elastic.co/t/parsing-thread-number-in-grok/87743 "2017-05-31T13:27:46Z")

</div>

Hi I'm trying to parse a logline in grok but I can't get past the thread number in my log lines. Example logline: 428 31/05/2017 08:11:53.243 T\[63\] INFO Service.Internal.ReturnUserType INTERNAL\\test\_cf --+End of…

---

## [Multiple Aggregations, index\_out\_of\_bounds\_exception error](https://discuss.elastic.co/t/multiple-aggregations-index-out-of-bounds-exception-error/83565)

<div class="topic-metadata">

**Author:** [@vovo](https://discuss.elastic.co/u/vovo)\
**Replies:** 2\
**Last updated:** [April 25, 2017, 3:34pm UTC](https://discuss.elastic.co/t/multiple-aggregations-index-out-of-bounds-exception-error/83565 "2017-04-25T15:34:20Z")

</div>

Hi, I'm trying to develop an elastic search watcher that includes multiple aggregations. I want to group the documents based on the accounts and for each account check if a series of consecutive "failure" attempts in 15 …

---

## [I want to aggregate the JSON log events,How do i filter it in the logstash](https://discuss.elastic.co/t/i-want-to-aggregate-the-json-log-events-how-do-i-filter-it-in-the-logstash/81743)

<div class="topic-metadata">

**Author:** [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)\
**Replies:** 2\
**Last updated:** [April 11, 2017, 11:12am UTC](https://discuss.elastic.co/t/i-want-to-aggregate-the-json-log-events-how-do-i-filter-it-in-the-logstash/81743 "2017-04-11T11:12:37Z")

</div>

i want to aggregate the JSON log events,from the filebeats to logstash. i want to filter the warn ,error,info separately from the Log events How do i filter it in the logstash. Can anyone please guide me..

---

## [Getting a Filebeat server certificate verification fail](https://discuss.elastic.co/t/getting-a-filebeat-server-certificate-verification-fail/81527)

<div class="topic-metadata">

**Author:** [@wmstein](https://discuss.elastic.co/u/wmstein)\
**Replies:** 2\
**Last updated:** [April 7, 2017, 8:29pm UTC](https://discuss.elastic.co/t/getting-a-filebeat-server-certificate-verification-fail/81527 "2017-04-07T20:29:19Z")

</div>

I have filebeat working on a production server successfully and am now putting on a second production server using the exact same process. I copied over the same Logstash crt file and added it to the filebeat.yml file. …

---

## [Cartesian coordinate support in ES](https://discuss.elastic.co/t/cartesian-coordinate-support-in-es/80864)

<div class="topic-metadata">

**Author:** [@arsi](https://discuss.elastic.co/u/arsi)\
**Replies:** 2\
**Last updated:** [April 3, 2017, 10:26pm UTC](https://discuss.elastic.co/t/cartesian-coordinate-support-in-es/80864 "2017-04-03T22:26:52Z")

</div>

Hi. I'm new to ES and I was wondering if elastic search supports cartesian geometric data or if I have to do a custom implementation. Basically, I have points in a plane and I want to be able to do aggregates such as r…

---

## [Logstash s3 input](https://discuss.elastic.co/t/logstash-s3-input/54984)

<div class="topic-metadata">

**Author:** [@piyush](https://discuss.elastic.co/u/piyush)\
**Replies:** 2\
**Last updated:** [August 1, 2016, 6:36pm UTC](https://discuss.elastic.co/t/logstash-s3-input/54984 "2016-08-01T18:36:04Z")

</div>

Hi Team, I am trying to read cloud trail logs from a S3 bucket, i installed cloudtrail plugin too. I can download logs from s3 bucket using "s3 cp" command so there is no connectivity issue. (Though i can't download usi…

[Previous page](https://discuss.elastic.co/top.md?page=1618&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1620&per_page=50&period=all)
