# Top **URL:** https://discuss.elastic.co/top.md?page=1627&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1628 --- ## [Elasticsearch and openvpn](https://discuss.elastic.co/t/elasticsearch-and-openvpn/10891)
**Author:** [@courtenay](https://discuss.elastic.co/u/courtenay)\ **Replies:** 0\ **Last updated:** [February 25, 2013, 7:19pm UTC](https://discuss.elastic.co/t/elasticsearch-and-openvpn/10891 "2013-02-25T19:19:39Z")
Hey all, We recently had cause to run our elasticsearch cluster on two different security groups on AWS (security groups are like firewalled VPNs). I used openVPN and IPtables to get it all working, and wrote it a… --- ## [Data visualizer asks for licence](https://discuss.elastic.co/t/data-visualizer-asks-for-licence/193790)
**Author:** [@Mesmer](https://discuss.elastic.co/u/Mesmer)\ **Replies:** 1\ **Last updated:** [August 5, 2019, 4:14pm UTC](https://discuss.elastic.co/t/data-visualizer-asks-for-licence/193790 "2019-08-05T16:14:42Z")
Just upgraded Kibana from version 7.0 to 7.3 and i notice that now Data Visualizer asks for license. After choosing an index pattern i get the following message: You need permission to access Machine Learning You must … --- ## [JWT Support in Beats](https://discuss.elastic.co/t/jwt-support-in-beats/254825)
**Author:** [@cchandak](https://discuss.elastic.co/u/cchandak)\ **Replies:** 2\ **Last updated:** [November 12, 2020, 9:38pm UTC](https://discuss.elastic.co/t/jwt-support-in-beats/254825 "2020-11-12T21:38:32Z")
I would like to scrape logs using Beats (either Filebeat, Metricbeat, etc.) and send them to Logstash or Kafka depending on my use case. Currently, I am leveraging the SSL support, but I would like to use JSON Web Token … --- ## [Kibana in docker, issues with installation of plugins](https://discuss.elastic.co/t/kibana-in-docker-issues-with-installation-of-plugins/236866)
**Author:** [@twright8](https://discuss.elastic.co/u/twright8)\ **Replies:** 2\ **Last updated:** [July 27, 2020, 6:43am UTC](https://discuss.elastic.co/t/kibana-in-docker-issues-with-installation-of-plugins/236866 "2020-07-27T06:43:13Z")
Hey All - and thanks for any help in advance. Im trying to install this plugin into kibana in docker: https://github.com/dlumbrer/kbn\_network my version is 7.7.1 which should work based on the docs. After copying from … --- ## [Filebeat is not sending the data to logstash](https://discuss.elastic.co/t/filebeat-is-not-sending-the-data-to-logstash/188274)
**Author:** [@irobot678](https://discuss.elastic.co/u/irobot678)\ **Replies:** 2\ **Last updated:** [July 2, 2019, 10:12am UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-the-data-to-logstash/188274 "2019-07-02T10:12:17Z")
HI, i am using filebeat to get the logs from a file for filebeat ouput is logstash and using logstash to filter the logs for logstash output is elasticsearch while trying to print logs on a console the logstash is j… --- ## [GeoShape query with Java High Level Rest Client fails](https://discuss.elastic.co/t/geoshape-query-with-java-high-level-rest-client-fails/183396)
**Author:** [@Ganesh\_Kudva](https://discuss.elastic.co/u/Ganesh_Kudva)\ **Replies:** 2\ **Last updated:** [June 3, 2019, 3:57pm UTC](https://discuss.elastic.co/t/geoshape-query-with-java-high-level-rest-client-fails/183396 "2019-06-03T15:57:14Z")
I have the following mapping in AWS Elasticsearch index "Location": { "type": "geo\_shape", "tree": "quadtree" } The following geo\_shape query works perfectly fine on my Kibana console GET test/doc/\_search { … --- ## [Threshold Alert on days until expiry](https://discuss.elastic.co/t/threshold-alert-on-days-until-expiry/160329)
**Author:** [@mark.lawton2](https://discuss.elastic.co/u/mark.lawton2)\ **Replies:** 2\ **Last updated:** [December 13, 2018, 10:53am UTC](https://discuss.elastic.co/t/threshold-alert-on-days-until-expiry/160329 "2018-12-13T10:53:34Z")
Hello, fairly new to Elastic Stack and having a play with the Watcher to try and get some useful threshold alerts. One I'm struggling on is this scenario: We have heartbeat which is monitoring various https websites, o… --- ## [Winlogbeat Dashboard Problem - Visualize: "field" is a required parameter](https://discuss.elastic.co/t/winlogbeat-dashboard-problem-visualize-field-is-a-required-parameter/126995)
**Author:** [@George\_Jetson](https://discuss.elastic.co/u/George_Jetson)\ **Replies:** 2\ **Last updated:** [April 5, 2018, 9:36pm UTC](https://discuss.elastic.co/t/winlogbeat-dashboard-problem-visualize-field-is-a-required-parameter/126995 "2018-04-05T21:36:25Z")
New ELK 6.2.3 installation on Windows. I installed WLB on a Windows 2012R2 server and specified in the yml to setup dashboard. The index pattern and dashboard are there but I am getting the following error: \[image\] --- ## [Calculating what's needed for LSOF?](https://discuss.elastic.co/t/calculating-whats-needed-for-lsof/106780)
**Author:** [@Aldo\_Sarmiento1](https://discuss.elastic.co/u/Aldo_Sarmiento1)\ **Replies:** 2\ **Last updated:** [November 8, 2017, 10:20am UTC](https://discuss.elastic.co/t/calculating-whats-needed-for-lsof/106780 "2017-11-08T10:20:55Z")
I'm reading the documentation about elasticsearch setup and it says that the recommended file descriptors count should be 64k, but it doesn't say a lot about how this number is chosen. Is it based on total index size, do… --- ## [Elasticsearch replica shard distribution](https://discuss.elastic.co/t/elasticsearch-replica-shard-distribution/95371)
**Author:** [@monkegoist](https://discuss.elastic.co/u/monkegoist)\ **Replies:** 2\ **Last updated:** [August 3, 2017, 2:33pm UTC](https://discuss.elastic.co/t/elasticsearch-replica-shard-distribution/95371 "2017-08-03T14:33:35Z")
Hello, We recently came across an issue with users reporting their queries being slow. There are 5 nodes in a cluster, index has 10 shards, replication factor is 1. Upon investigation, I found out that each of the nodes… --- ## [Audit hostname?](https://discuss.elastic.co/t/audit-hostname/85105)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [June 5, 2017, 3:33pm UTC](https://discuss.elastic.co/t/audit-hostname/85105 "2017-06-05T15:33:59Z")
Hello, Just enabled auditing and noticed in the .security-audit index that the node\_host\_name is always the ip address of the node. Not sure, but isn't this supposed to be the hostname of the node? the node\_name also se… --- ## [Enrich-existing-elasticsearch-index-with-new-fields-from-logstash](https://discuss.elastic.co/t/enrich-existing-elasticsearch-index-with-new-fields-from-logstash/72750)
**Author:** [@Maher.Glenza](https://discuss.elastic.co/u/Maher.Glenza)\ **Replies:** 2\ **Last updated:** [January 25, 2017, 10:44am UTC](https://discuss.elastic.co/t/enrich-existing-elasticsearch-index-with-new-fields-from-logstash/72750 "2017-01-25T10:44:13Z")
hi , if any one know if i can and how to receive for the first time a log in logstash filter it then save it in ES , next step is to receive another type of logs filter it then add its fields to the first one saved in ES… --- ## [Multi field time-picker?](https://discuss.elastic.co/t/multi-field-time-picker/50907)
**Author:** [@Marcin\_Kubica](https://discuss.elastic.co/u/Marcin_Kubica)\ **Replies:** 2\ **Last updated:** [June 3, 2016, 8:16am UTC](https://discuss.elastic.co/t/multi-field-time-picker/50907 "2016-06-03T08:16:37Z")
HI One of use cases I have here deals with a sessions log where I have start\_time and end\_time of a session. It's easy to get sessions vis for all start\_time ones. How can I also have a query with Kibana which wou… --- ## [Plugin development and test dependencies with elastic 5.0.0](https://discuss.elastic.co/t/plugin-development-and-test-dependencies-with-elastic-5-0-0/51482)
**Author:** [@David\_Causse](https://discuss.elastic.co/u/David_Causse)\ **Replies:** 2\ **Last updated:** [May 31, 2016, 8:58pm UTC](https://discuss.elastic.co/t/plugin-development-and-test-dependencies-with-elastic-5-0-0/51482 "2016-05-31T20:58:45Z")
Hi, I'm maintaining various plugins and one of them uses another plugin as a test dependency (e.g. analysis-icu). With the 2.x code base I could simply add: \ \org.elasticsearch.plugin\ **Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 2\ **Last updated:** [March 4, 2016, 2:22pm UTC](https://discuss.elastic.co/t/packetbeat-libpcap/43516 "2016-03-04T14:22:40Z") Hi, Is libpcap 0.8 still required for packet beat or is it now integrated into the distribution? Regards, David --- ## [Sending data from LS to ES - Looks like a local machine config issue](https://discuss.elastic.co/t/sending-data-from-ls-to-es-looks-like-a-local-machine-config-issue/28781)
**Author:** [@perkinsl](https://discuss.elastic.co/u/perkinsl)\ **Replies:** 2\ **Last updated:** [September 7, 2015, 2:30pm UTC](https://discuss.elastic.co/t/sending-data-from-ls-to-es-looks-like-a-local-machine-config-issue/28781 "2015-09-07T14:30:51Z")
Hi can anyone advise if there are any specific settings required on a machine to allow LS to talk to ES. I've got everything installed and they both appear to startup ok however when I run a log file through LS I get er… --- ## [Elastic agent and filebeat installation in windows PC](https://discuss.elastic.co/t/elastic-agent-and-filebeat-installation-in-windows-pc/317720)
**Author:** [@subash](https://discuss.elastic.co/u/subash)\ **Replies:** 1\ **Last updated:** [October 30, 2022, 9:54pm UTC](https://discuss.elastic.co/t/elastic-agent-and-filebeat-installation-in-windows-pc/317720 "2022-10-30T21:54:59Z")
Hello, We are using Elasticsearch 7.17.4. The objective is to collect the metrics and logs from Windows PC. Currently, using Elastic agents to send the logs and metrics to Elasticsearch. In one of the use cases, we ar… --- ## [\[esrally\] what cause difference of latency and service time?, what is proper way of custom parameter](https://discuss.elastic.co/t/esrally-what-cause-difference-of-latency-and-service-time-what-is-proper-way-of-custom-parameter/327317)
**Author:** [@dan\_kim](https://discuss.elastic.co/u/dan_kim)\ **Replies:** 4\ **Last updated:** [March 9, 2023, 6:15am UTC](https://discuss.elastic.co/t/esrally-what-cause-difference-of-latency-and-service-time-what-is-proper-way-of-custom-parameter/327317 "2023-03-09T06:15:47Z")
Hello. i just saw strange stuff when im trying to do single shard test. here is my metric it's error rate is 0.01% and its service time looks reasonable to service, but latency is really bad. the question is what ca… --- ## [Maps - how to add the terms aggregated right source to filters/tooltip?](https://discuss.elastic.co/t/maps-how-to-add-the-terms-aggregated-right-source-to-filters-tooltip/233559)
**Author:** [@unclezoot](https://discuss.elastic.co/u/unclezoot)\ **Replies:** 4\ **Last updated:** [May 22, 2020, 9:04am UTC](https://discuss.elastic.co/t/maps-how-to-add-the-terms-aggregated-right-source-to-filters-tooltip/233559 "2020-05-22T09:04:41Z")
Hi, I've created an index as a geometry look up table, containing the geojson for UK postcode districts (~3000 entires) I now want to overlay data from a raw data file (various text and values for each district but no … --- ## [Memory Setting for Elasticsearch Nodes](https://discuss.elastic.co/t/memory-setting-for-elasticsearch-nodes/92151)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 4\ **Last updated:** [July 7, 2017, 4:53am UTC](https://discuss.elastic.co/t/memory-setting-for-elasticsearch-nodes/92151 "2017-07-07T04:53:34Z")
What should be the ideal memory setting for 16GB elasticsearch nodes? We don't have the servers with 64GB to set the memory to less than 50%, say 30GB. Whether 8GB to 12GB is fine? --- ## [Filebeat and Logstash Installation](https://discuss.elastic.co/t/filebeat-and-logstash-installation/88359)
**Author:** [@richagautam](https://discuss.elastic.co/u/richagautam)\ **Replies:** 4\ **Last updated:** [June 7, 2017, 10:44am UTC](https://discuss.elastic.co/t/filebeat-and-logstash-installation/88359 "2017-06-07T10:44:57Z")
Hi all, We have to develop a solution in which we have to give more than 1000 log files of around 2 GB to Logstash for parsing the logs and giving the structured data. I am planning to use Filebeat to give the log… --- ## [Sauvergarder donnée entrante avant de les traiter avec Logstash](https://discuss.elastic.co/t/sauvergarder-donnee-entrante-avant-de-les-traiter-avec-logstash/85351)
**Author:** [@BrunoC](https://discuss.elastic.co/u/BrunoC)\ **Replies:** 4\ **Last updated:** [May 12, 2017, 7:56am UTC](https://discuss.elastic.co/t/sauvergarder-donnee-entrante-avant-de-les-traiter-avec-logstash/85351 "2017-05-12T07:56:51Z")
Bonjour, J'ai un serveur ELK avec Logstash qui reçoit des données par tcp et udp, j'aimerais savoir si il est possible de sauvegarder les données reçues avant de les traiter avec Logstash. --- ## [Extract data from Elastic search using pem cert](https://discuss.elastic.co/t/extract-data-from-elastic-search-using-pem-cert/302849)
**Author:** [@newelastic](https://discuss.elastic.co/u/newelastic)\ **Replies:** 8\ **Last updated:** [April 22, 2022, 7:59pm UTC](https://discuss.elastic.co/t/extract-data-from-elastic-search-using-pem-cert/302849 "2022-04-22T19:59:32Z")
Hello, I'm new to ELK stack and we are trying to extract data from ES via logstash pipeline from existing system. Below is the logstash input pipeline being used for extracting data and my output pipeline targeted to K… --- ## [MAPS in kibana](https://discuss.elastic.co/t/maps-in-kibana/219131)
**Author:** [@vinu89](https://discuss.elastic.co/u/vinu89)\ **Replies:** 8\ **Last updated:** [February 18, 2020, 5:37am UTC](https://discuss.elastic.co/t/maps-in-kibana/219131 "2020-02-18T05:37:58Z")
How to Use the Maps for the index created by us.I checked with the below link https://www.elastic.co/guide/en/kibana/current/maps-getting-started.html but in the above link they have provided on how to work on default … --- ## [Elasticsearch cluster on AWS. Article](https://discuss.elastic.co/t/elasticsearch-cluster-on-aws-article/19292)
**Author:** [@Pavel\_P](https://discuss.elastic.co/u/Pavel_P)\ **Replies:** 8\ **Last updated:** [August 15, 2014, 6:29pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-on-aws-article/19292 "2014-08-15T18:29:49Z")
Hi everyone, Below you can find one big article, summing up all my experience of building the cluster on AWS. When I started I had no information at all, but I found the needed pieces in different places, includi… --- ## [How to handle long running queries](https://discuss.elastic.co/t/how-to-handle-long-running-queries/136504)
**Author:** [@oats\_gal](https://discuss.elastic.co/u/oats_gal)\ **Replies:** 0\ **Last updated:** [June 19, 2018, 2:00pm UTC](https://discuss.elastic.co/t/how-to-handle-long-running-queries/136504 "2018-06-19T14:00:25Z")
I've found a few older posts regarding this, but not too much around long running queries on newer versions of Elasticsearch. Just a little background, I manage a 200+ node Elastic cluster for my company. We recently up… --- ## [Unencrypted private key needed in browser-kibana https communication?](https://discuss.elastic.co/t/unencrypted-private-key-needed-in-browser-kibana-https-communication/47417)
**Author:** [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\ **Replies:** 0\ **Last updated:** [April 14, 2016, 4:43pm UTC](https://discuss.elastic.co/t/unencrypted-private-key-needed-in-browser-kibana-https-communication/47417 "2016-04-14T16:43:19Z")
I followed the instructions at https://www.elastic.co/guide/en/kibana/current/production.html#enabling-ssl and got an error accessing Kibana through https: FATAL\[Error:error:0907B068:PEM routines:PEM\_READ\_BIO\_PRIVATEKE… --- ## [Elastic SIEM Detection Rules / Exception Containers / Exception Lists](https://discuss.elastic.co/t/elastic-siem-detection-rules-exception-containers-exception-lists/338390)
**Author:** [@tsigouris007](https://discuss.elastic.co/u/tsigouris007)\ **Replies:** 0\ **Last updated:** [July 14, 2023, 8:45am UTC](https://discuss.elastic.co/t/elastic-siem-detection-rules-exception-containers-exception-lists/338390 "2023-07-14T08:45:53Z")
Hello, I have created a Terraform Provider for the Elastic SIEM components. You can find the Git repo here: https://github.com/tsigouris007/terraform-provider-elastic-siem-detection The provider is also published to t… --- ## [Logstash + datastreams](https://discuss.elastic.co/t/logstash-datastreams/315210)
**Author:** [@Zdeno\_Liska](https://discuss.elastic.co/u/Zdeno_Liska)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 7:33pm UTC](https://discuss.elastic.co/t/logstash-datastreams/315210 "2022-09-26T19:33:46Z")
Hi, I have issue with configuration of Logstash and Datastreams with already defined ILM,index template here are details: Logstash pipeline config: elasticsearch { hosts =\> \["host1"\] data\_stream =\> "true" … --- ## [Winlogbeat does not properly handle CN's with comma(s) in name](https://discuss.elastic.co/t/winlogbeat-does-not-properly-handle-cns-with-comma-s-in-name/264362)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 0\ **Last updated:** [February 15, 2021, 9:15pm UTC](https://discuss.elastic.co/t/winlogbeat-does-not-properly-handle-cns-with-comma-s-in-name/264362 "2021-02-15T21:15:10Z")
Hi All, I was looking at some Winlogbeat events, and I noticed that it doesn't seem to be properly handling CN's with comma(s) in them. Example (backslashes present to show escapes): Have a user like so: Admin\\\\, user … --- ## [How to change permissions for fleet-managed Elastic Agents? \[security\_exception\]](https://discuss.elastic.co/t/how-to-change-permissions-for-fleet-managed-elastic-agents-security-exception/363780)
**Author:** [@B\_Grimm](https://discuss.elastic.co/u/B_Grimm)\ **Replies:** 6\ **Last updated:** [August 12, 2024, 1:45pm UTC](https://discuss.elastic.co/t/how-to-change-permissions-for-fleet-managed-elastic-agents-security-exception/363780 "2024-08-12T13:45:51Z")
Hello, I am reaching out to you with an issue that has been concerning me for quite some time now. Overview I have enrolled a fleet-managed Elastic Agent on a machine and created an ingest pipeline in the Elastic Clu… --- ## [A potential bug with Filebeat script processor](https://discuss.elastic.co/t/a-potential-bug-with-filebeat-script-processor/351914)
**Author:** [@Calvin\_Li](https://discuss.elastic.co/u/Calvin_Li)\ **Replies:** 6\ **Last updated:** [February 2, 2024, 4:06am UTC](https://discuss.elastic.co/t/a-potential-bug-with-filebeat-script-processor/351914 "2024-02-02T04:06:42Z")
Hi team, thanks for your great work! I'm using filebeat 8.10.3, and seeing a potential bug with it. I'm using the script processor to do some caching & filtering of log messages. To be specific, I'm using a LRU cache to… --- ## [Tried making a runtime script to modify field, but now visualize with the index shows all empty fields](https://discuss.elastic.co/t/tried-making-a-runtime-script-to-modify-field-but-now-visualize-with-the-index-shows-all-empty-fields/338708)
**Author:** [@michael\_c\_michael](https://discuss.elastic.co/u/michael_c_michael)\ **Replies:** 6\ **Last updated:** [August 2, 2023, 1:35pm UTC](https://discuss.elastic.co/t/tried-making-a-runtime-script-to-modify-field-but-now-visualize-with-the-index-shows-all-empty-fields/338708 "2023-08-02T13:35:52Z")
I have an index with 130 fields. One field I would like to change ranges over longs: 0, 1, 2. In order to do this, I added a runtime field with the following description: def names = \['0': 'Other', '1':'Friendly', '2':… --- ## [How many shards are hit when using day-wise indices](https://discuss.elastic.co/t/how-many-shards-are-hit-when-using-day-wise-indices/159645)
**Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Replies:** 6\ **Last updated:** [December 6, 2018, 11:01pm UTC](https://discuss.elastic.co/t/how-many-shards-are-hit-when-using-day-wise-indices/159645 "2018-12-06T23:01:09Z")
Say, I'm using day-wise indices with 5 shards and 1 replica. In kibana dashboards, when I fire a dashboard for last 7-days which in turn fires a number of underlying visualisations in that dashboard, the queries - do the… --- ## [Can I search elastic keys with wildcard or substring](https://discuss.elastic.co/t/can-i-search-elastic-keys-with-wildcard-or-substring/324754)
**Author:** [@sarthik](https://discuss.elastic.co/u/sarthik)\ **Replies:** 1\ **Last updated:** [February 6, 2023, 6:32am UTC](https://discuss.elastic.co/t/can-i-search-elastic-keys-with-wildcard-or-substring/324754 "2023-02-06T06:32:15Z")
I have the following patterns as keys in my data stored in elk indexes: \* Name \* \_name \* preffered\_name \* first\_name \* last\_name I need to query these keys, but the key names are not fixed, so need to search keys based… --- ## [Matching yyyy-MM-dd HH:mm:ss.SSSZ in a logstash filter](https://discuss.elastic.co/t/matching-yyyy-mm-dd-hhss-sssz-in-a-logstash-filter/279643)
**Author:** [@mshwf](https://discuss.elastic.co/u/mshwf)\ **Replies:** 1\ **Last updated:** [July 26, 2021, 3:10pm UTC](https://discuss.elastic.co/t/matching-yyyy-mm-dd-hhss-sssz-in-a-logstash-filter/279643 "2021-07-26T15:10:26Z")
I'm trying to extract some fields from this log entry: 2021-07-26 16:45:59.4640|0|WARN|LoggerTestASP.Controllers.WeatherForecastController|NEW\_FROM\_NLOG: 67b9de16-47a1-4308-a163-263f5f06e841, Hola Pola, 11/26/2017 16:45… --- ## [Search as you type field, best practice](https://discuss.elastic.co/t/search-as-you-type-field-best-practice/248289)
**Author:** [@Daniele\_Renda](https://discuss.elastic.co/u/Daniele_Renda)\ **Replies:** 1\ **Last updated:** [September 11, 2020, 2:03pm UTC](https://discuss.elastic.co/t/search-as-you-type-field-best-practice/248289 "2020-09-11T14:03:34Z")
Hi, I made some tests with search as you type field: https://www.elastic.co/guide/en/elasticsearch/reference/7.x/search-as-you-type.html I've an index containing products. Each product(document) have many fields like: … --- ## [Geoip lookup fails](https://discuss.elastic.co/t/geoip-lookup-fails/142612)
**Author:** [@jmoffitt](https://discuss.elastic.co/u/jmoffitt)\ **Replies:** 1\ **Last updated:** [August 1, 2018, 3:51pm UTC](https://discuss.elastic.co/t/geoip-lookup-fails/142612 "2018-08-01T15:51:29Z")
As far as I can tell I've followed the directions, but all of my geoip lookups fail. What did I miss? input { udp { port =\> 11001 codec =\> netflow { versions =\> \[5, 9\] } t… --- ## [What I am wrong with this query?](https://discuss.elastic.co/t/what-i-am-wrong-with-this-query/141681)
**Author:** [@Moon](https://discuss.elastic.co/u/Moon)\ **Replies:** 1\ **Last updated:** [July 26, 2018, 4:04am UTC](https://discuss.elastic.co/t/what-i-am-wrong-with-this-query/141681 "2018-07-26T04:04:01Z")
I want to filter data =\> DataType : T bucket =\> Term : PLANT\_CD I wrote "query" : { "bool":{ "must" : \[{ "match" : { "DataType" : "T" } }\] }, "aggs": { "plants": { 'terms': {"field": "PLANT\_CD"} } } } Bu… --- ## [Percentage of documents that have a given field value](https://discuss.elastic.co/t/percentage-of-documents-that-have-a-given-field-value/132684)
**Author:** [@Badger](https://discuss.elastic.co/u/Badger)\ **Replies:** 1\ **Last updated:** [May 21, 2018, 5:17pm UTC](https://discuss.elastic.co/t/percentage-of-documents-that-have-a-given-field-value/132684 "2018-05-21T17:17:09Z")
I have documents that contain several boolean fields. For each of those fields I want to know what percentage of documents have it set to true. Can elasticsearch tell me? --- ## [Ideal settings for buffer\_size, chunk size, retry\_count, max\_snapshot\_bytes\_per\_sec for s3 backup](https://discuss.elastic.co/t/ideal-settings-for-buffer-size-chunk-size-retry-count-max-snapshot-bytes-per-sec-for-s3-backup/113628)
**Author:** [@akshaymaniyar](https://discuss.elastic.co/u/akshaymaniyar)\ **Replies:** 1\ **Last updated:** [January 4, 2018, 4:09pm UTC](https://discuss.elastic.co/t/ideal-settings-for-buffer-size-chunk-size-retry-count-max-snapshot-bytes-per-sec-for-s3-backup/113628 "2018-01-04T16:09:07Z")
Hi, We have around 150 nodes (Data size:14TB) in our elastic-search cluster and want to take snapshot of our data using an s3 compatible service. We want to restrict the overall bandwidth being used the by the cluster … --- ## [Elastic Index Using C# Error](https://discuss.elastic.co/t/elastic-index-using-c-error/92094)
**Author:** [@RAMESHKUMAR502](https://discuss.elastic.co/u/RAMESHKUMAR502)\ **Replies:** 1\ **Last updated:** [July 7, 2017, 12:22pm UTC](https://discuss.elastic.co/t/elastic-index-using-c-error/92094 "2017-07-07T12:22:27Z")
Hi, I have Created 14 day's Trail.The connection is Successful but . When we check is Index Exits.I got Below Error. Invalid NEST response built from a unsuccessful low level call on HEAD: /instance- Audit trail of… --- ## [Marvel docs not updating in Kibana](https://discuss.elastic.co/t/marvel-docs-not-updating-in-kibana/57668)
**Author:** [@esoes](https://discuss.elastic.co/u/esoes)\ **Replies:** 1\ **Last updated:** [August 16, 2016, 6:56pm UTC](https://discuss.elastic.co/t/marvel-docs-not-updating-in-kibana/57668 "2016-08-16T18:56:42Z")
Hello, Kibana sees all the indexes with mappings properly, test index and .marvel-es-1\*. After adding some docs to test index it works good, Kibana shows all docs after search, but marvel index remains empty. After execu… --- ## [Best approach to implement tag weights](https://discuss.elastic.co/t/best-approach-to-implement-tag-weights/53595)
**Author:** [@Srinivasan\_Ramaswamy](https://discuss.elastic.co/u/Srinivasan_Ramaswamy)\ **Replies:** 1\ **Last updated:** [June 24, 2016, 10:42pm UTC](https://discuss.elastic.co/t/best-approach-to-implement-tag-weights/53595 "2016-06-24T22:42:52Z")
I have documents with tags and i have weights for each tag. There are more than 40 million documents in the index. I would like to boost the documents according to the tag weight. I can think of two ways to implement thi… --- ## [Filebeat JSON input](https://discuss.elastic.co/t/filebeat-json-input/51475)
**Author:** [@mregmi](https://discuss.elastic.co/u/mregmi)\ **Replies:** 1\ **Last updated:** [May 31, 2016, 7:33pm UTC](https://discuss.elastic.co/t/filebeat-json-input/51475 "2016-05-31T19:33:22Z")
Does Filebeat support JSON input ? I want to use filebeat to monitor one of my state file that's in JSON format. Thank you for any input. --- ## [Data only available from one document type ( \_type )](https://discuss.elastic.co/t/data-only-available-from-one-document-type--type/32620)
**Author:** [@rick.rankin](https://discuss.elastic.co/u/rick.rankin)\ **Replies:** 1\ **Last updated:** [October 21, 2015, 12:00am UTC](https://discuss.elastic.co/t/data-only-available-from-one-document-type--type/32620 "2015-10-21T00:00:41Z")
We have 3 different document types in our index that we are using with Kibana. We can only search and get hits on documents from one of the document types. So if we search for say type:doctype\_a we get hits but not for t… --- ## [Logstash not showing field with null values](https://discuss.elastic.co/t/logstash-not-showing-field-with-null-values/338648)
**Author:** [@Mohit\_Gupta2](https://discuss.elastic.co/u/Mohit_Gupta2)\ **Replies:** 5\ **Last updated:** [July 18, 2023, 12:44pm UTC](https://discuss.elastic.co/t/logstash-not-showing-field-with-null-values/338648 "2023-07-18T12:44:26Z")
I am indexing elasticsearch via logstash but it is showing only document's fields with not null values. Earlier I used to do this through transporter and it returns the null values as well. Also the mapping in both case… --- ## [Collect logs from multiple machine, what needs to be installed?](https://discuss.elastic.co/t/collect-logs-from-multiple-machine-what-needs-to-be-installed/330833)
**Author:** [@Jay\_Timbadia](https://discuss.elastic.co/u/Jay_Timbadia)\ **Replies:** 5\ **Last updated:** [April 27, 2023, 1:53pm UTC](https://discuss.elastic.co/t/collect-logs-from-multiple-machine-what-needs-to-be-installed/330833 "2023-04-27T13:53:56Z")
Continuing the discussion from How to collect the logs from multiple machines to my server efficiently?: Hi @jsoriano, really followed the chat. Just one thing, I have logs placed in different machine, so should I insta… --- ## [Looking for new rollup feature samples](https://discuss.elastic.co/t/looking-for-new-rollup-feature-samples/141446)
**Author:** [@BicaLuv](https://discuss.elastic.co/u/BicaLuv)\ **Replies:** 5\ **Last updated:** [August 28, 2018, 3:39pm UTC](https://discuss.elastic.co/t/looking-for-new-rollup-feature-samples/141446 "2018-08-28T15:39:50Z")
Hi! I read about the new Rollup API coming with ES 6.3.1 here: https://www.elastic.co/guide/en/elasticsearch/reference/6.3/rollup-apis.html And I tried to understand it. But currently I'm not able to managed and unders… --- ## [Help with Date](https://discuss.elastic.co/t/help-with-date/66240)
**Author:** [@debarun](https://discuss.elastic.co/u/debarun)\ **Replies:** 5\ **Last updated:** [November 18, 2016, 11:07am UTC](https://discuss.elastic.co/t/help-with-date/66240 "2016-11-18T11:07:12Z")
Hi, I need to replace the time coming from the logs to timestamp field. But i keep getting a parse failure. The loglines look like Time Stamp 11/14/16 15:14:25 Event Number 2004 I am using the following filters:- … [Previous page](https://discuss.elastic.co/top.md?page=1626&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1628&per_page=50&period=all)