# Top

**URL:** https://discuss.elastic.co/top.md?page=1646&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1647

---

## [Kibana login page with 6.5.1 version](https://discuss.elastic.co/t/kibana-login-page-with-6-5-1-version/189720)

<div class="topic-metadata">

**Author:** [@Sou](https://discuss.elastic.co/u/Sou)\
**Replies:** 5\
**Last updated:** [July 21, 2019, 7:22pm UTC](https://discuss.elastic.co/t/kibana-login-page-with-6-5-1-version/189720 "2019-07-21T19:22:41Z")

</div>

Hi, I want to use Logstash, ElasticSearch and Kibana. To do so I installed Logstash, ElasticSearch and Kibana in my linux environment with 6.5.1 version. In elasticsearch 6.5.1 version xpack comes along with the instal…

---

## [Syslog messages into logstash](https://discuss.elastic.co/t/syslog-messages-into-logstash/129425)

<div class="topic-metadata">

**Author:** [@artem33region](https://discuss.elastic.co/u/artem33region)\
**Replies:** 5\
**Last updated:** [April 27, 2018, 8:08am UTC](https://discuss.elastic.co/t/syslog-messages-into-logstash/129425 "2018-04-27T08:08:46Z")

</div>

Hi all! I want to get syslog messages from servers. I have installed ELK stack on CentOS 7 server. There is "no default index pattern" How i understand i need to install and configure "filebeat" on client server side…

---

## [Heartbeat 7.2.0 Error: unknown flag: --index-management](https://discuss.elastic.co/t/heartbeat-7-2-0-error-unknown-flag-index-management/191670)

<div class="topic-metadata">

**Author:** [@Geo-S](https://discuss.elastic.co/u/Geo-S)\
**Replies:** 1\
**Last updated:** [July 22, 2019, 4:21pm UTC](https://discuss.elastic.co/t/heartbeat-7-2-0-error-unknown-flag-index-management/191670 "2019-07-22T16:21:13Z")

</div>

Trying to upgrade to ELK 7.2.0. and have some ansible that gets beats up and running. Ran into an issue with Heartbeat 7.2.0 where the new --index-management flag is unknown and the --template flag still works despite t…

---

## [Docker logging driver gelf not working](https://discuss.elastic.co/t/docker-logging-driver-gelf-not-working/162175)

<div class="topic-metadata">

**Author:** [@kommineni24](https://discuss.elastic.co/u/kommineni24)\
**Replies:** 1\
**Last updated:** [December 27, 2018, 2:22am UTC](https://discuss.elastic.co/t/docker-logging-driver-gelf-not-working/162175 "2018-12-27T02:22:35Z")

</div>

Hello guys, Trying to send docker logs by using GELF logging driver to Logstash. Have configured udp and other details in logstash conf file. How to validate whether we are sending logs to kibana.

---

## [Elasticsearch Python client - IncompleteRead error](https://discuss.elastic.co/t/elasticsearch-python-client-incompleteread-error/153745)

<div class="topic-metadata">

**Author:** [@SnirX](https://discuss.elastic.co/u/SnirX)\
**Replies:** 1\
**Last updated:** [October 24, 2018, 7:54am UTC](https://discuss.elastic.co/t/elasticsearch-python-client-incompleteread-error/153745 "2018-10-24T07:54:34Z")

</div>

Hi, I'm running an Elasticsearch cluster version 6.3.2. I'm using Python client to query the Elasticsearch. Python version - 2.7.5 Python Elasticsearch client version - 6.3.0 Suddenly I started to get this kind of e…

---

## [HTML log file / PARSE FAILURE](https://discuss.elastic.co/t/html-log-file-parse-failure/147264)

<div class="topic-metadata">

**Author:** [@robegome](https://discuss.elastic.co/u/robegome)\
**Replies:** 1\
**Last updated:** [September 5, 2018, 7:14pm UTC](https://discuss.elastic.co/t/html-log-file-parse-failure/147264 "2018-09-05T19:14:55Z")

</div>

Hello everyone! I am trying to get a dashboard in Kibana of several HTML LOG files... the patter of those logs are like this example: \<META http-equiv="Content-Type" content="text/html; charset=UTF-8"\> \<title\> …

---

## [Scripted Similarity - how to get average field length](https://discuss.elastic.co/t/scripted-similarity-how-to-get-average-field-length/146387)

<div class="topic-metadata">

**Author:** [@jjuppe](https://discuss.elastic.co/u/jjuppe)\
**Replies:** 1\
**Last updated:** [August 30, 2018, 4:05pm UTC](https://discuss.elastic.co/t/scripted-similarity-how-to-get-average-field-length/146387 "2018-08-30T16:05:54Z")

</div>

Hello, I am trying to reconstruct the Okapi BM25 default similarity in Elasticsearch. For my specific setting we do not need the inverse document frequency for score calculation. In my research I haven't found a flag t…

---

## [Java client : VersionConflictEngineException changed to ElasticsearchException?](https://discuss.elastic.co/t/java-client-versionconflictengineexception-changed-to-elasticsearchexception/132672)

<div class="topic-metadata">

**Author:** [@lionelgervaud](https://discuss.elastic.co/u/lionelgervaud)\
**Replies:** 1\
**Last updated:** [May 25, 2018, 9:16am UTC](https://discuss.elastic.co/t/java-client-versionconflictengineexception-changed-to-elasticsearchexception/132672 "2018-05-25T09:16:29Z")

</div>

Hi everyone ! We recently moved from version 2.x to 6.x and we noticed one unexcepted impact on our java code. We were catching a VersionConflictEngineException like this : BulkResponse bulkReponses = bulkRequest.exec…

---

## [Tcp.go WARN DNS lookup failure no such host](https://discuss.elastic.co/t/tcp-go-warn-dns-lookup-failure-no-such-host/121048)

<div class="topic-metadata">

**Author:** [@fabifrank](https://discuss.elastic.co/u/fabifrank)\
**Replies:** 1\
**Last updated:** [March 3, 2018, 11:54pm UTC](https://discuss.elastic.co/t/tcp-go-warn-dns-lookup-failure-no-such-host/121048 "2018-03-03T23:54:39Z")

</div>

Today I set up metricbeat on a kubernetes cluster and cant make it connect to the elastic search logging pod. I followed this example here: https://www.elastic.co/guide/en/beats/metricbeat/current/running-on-kubernetes.…

---

## [Access json fields from string](https://discuss.elastic.co/t/access-json-fields-from-string/103538)

<div class="topic-metadata">

**Author:** [@zuokuok](https://discuss.elastic.co/u/zuokuok)\
**Replies:** 1\
**Last updated:** [October 15, 2017, 7:49pm UTC](https://discuss.elastic.co/t/access-json-fields-from-string/103538 "2017-10-15T19:49:34Z")

</div>

I have a valid string within my initial message. I extract this string in a variable "payload" and remove the end of the string which is not part of the json. At this point, my string is a valid JSON. …

---

## [Speed limit for logstash to elasticsearch](https://discuss.elastic.co/t/speed-limit-for-logstash-to-elasticsearch/77703)

<div class="topic-metadata">

**Author:** [@robertchen117](https://discuss.elastic.co/u/robertchen117)\
**Replies:** 1\
**Last updated:** [March 9, 2017, 2:58pm UTC](https://discuss.elastic.co/t/speed-limit-for-logstash-to-elasticsearch/77703 "2017-03-09T14:58:58Z")

</div>

I have a slow network from logstash to elasticsearch cluster, anyone can share any ideas about how to do speed limit like \<5M/s ? or traffic control? Or please let me know how to do from filebeat to logstash? than…

---

## [Filebeat + Redis multi-hosts](https://discuss.elastic.co/t/filebeat-redis-multi-hosts/59499)

<div class="topic-metadata">

**Author:** [@Clement\_Ros](https://discuss.elastic.co/u/Clement_Ros)\
**Replies:** 1\
**Last updated:** [September 1, 2016, 11:41am UTC](https://discuss.elastic.co/t/filebeat-redis-multi-hosts/59499 "2016-09-01T11:41:53Z")

</div>

Hi, i currently using filebeat to communicate with Logstash directly, but my beat input in Logstash crash when the number of host is too important. I try an other solution to add new hosts logs in my cluster, with the…

---

## [Unable to drill into cluster in Marvel](https://discuss.elastic.co/t/unable-to-drill-into-cluster-in-marvel/34061)

<div class="topic-metadata">

**Author:** [@Danny830x](https://discuss.elastic.co/u/Danny830x)\
**Replies:** 1\
**Last updated:** [November 9, 2015, 5:34pm UTC](https://discuss.elastic.co/t/unable-to-drill-into-cluster-in-marvel/34061 "2015-11-09T17:34:15Z")

</div>

I have a fresh install of ES 2.0 with the latest versions of Kibana and Marvel. I am able to hit Kibana and navigate without issue. I am able to use the new (page switcher?) to switch from Kibana to Marvel and I see my o…

---

## [Faield to start elastic search](https://discuss.elastic.co/t/faield-to-start-elastic-search/302608)

<div class="topic-metadata">

**Author:** [@Paritosh\_Pandey](https://discuss.elastic.co/u/Paritosh_Pandey)\
**Replies:** 2\
**Last updated:** [April 18, 2022, 4:37pm UTC](https://discuss.elastic.co/t/faield-to-start-elastic-search/302608 "2022-04-18T16:37:24Z")

</div>

I am unable to start Elasticsearch, it shows code exited \</\> Elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/Elasticsearch.service; enabled; vendor preset: disabled) Active: failed (Resu…

---

## [How can resume logstash pipeline after terminated or crashed?](https://discuss.elastic.co/t/how-can-resume-logstash-pipeline-after-terminated-or-crashed/267029)

<div class="topic-metadata">

**Author:** [@Sage](https://discuss.elastic.co/u/Sage)\
**Replies:** 2\
**Last updated:** [March 15, 2021, 7:22am UTC](https://discuss.elastic.co/t/how-can-resume-logstash-pipeline-after-terminated-or-crashed/267029 "2021-03-15T07:22:35Z")

</div>

I designed a pipeline with elasticsearch as a input plugin and s3 as a output plugin. In my case, pipeline started successfully and push the data on s3 bucket but in case of termination or crash it does not start from wh…

---

## [Date Long Overflow 7.9](https://discuss.elastic.co/t/date-long-overflow-7-9/248488)

<div class="topic-metadata">

**Author:** [@Escalus](https://discuss.elastic.co/u/Escalus)\
**Replies:** 2\
**Last updated:** [September 18, 2020, 9:00am UTC](https://discuss.elastic.co/t/date-long-overflow-7-9/248488 "2020-09-18T09:00:18Z")

</div>

Hello, I get a long overflow in my date fields if the time is pior to 1970. The epoch\_time is a negativ long value and throws an arithmetic\_exception on reindex { "index" : "xxx", "type" : "\_doc", "id" : "pub.10…

---

## [How not to overwrite duplicates? save old documents](https://discuss.elastic.co/t/how-not-to-overwrite-duplicates-save-old-documents/238656)

<div class="topic-metadata">

**Author:** [@lyubava](https://discuss.elastic.co/u/lyubava)\
**Replies:** 2\
**Last updated:** [June 25, 2020, 1:36pm UTC](https://discuss.elastic.co/t/how-not-to-overwrite-duplicates-save-old-documents/238656 "2020-06-25T13:36:20Z")

</div>

Hi all! I use this filter to prevent duplicates: fingerprint { source =\> "name" target =\> "\[@metadata\]\[fingerprint\]" method =\> "MURMUR3" } And it works. I don't see documents with the same 'name' field in …

---

## [Can i using 'Scroll API' to elasticsearch with vega in kibana?](https://discuss.elastic.co/t/can-i-using-scroll-api-to-elasticsearch-with-vega-in-kibana/165271)

<div class="topic-metadata">

**Author:** [@teemoGod](https://discuss.elastic.co/u/teemoGod)\
**Replies:** 2\
**Last updated:** [January 25, 2019, 7:43am UTC](https://discuss.elastic.co/t/can-i-using-scroll-api-to-elasticsearch-with-vega-in-kibana/165271 "2019-01-25T07:43:18Z")

</div>

hi. im using elasticsearch / kibana 6.4.1 im using built-in vega in kibana. im using deep sub-aggregation query. (almost 7 depth) but there are some performance issue. too slow to use multiple aggregation. so, i thin…

---

## [Why does es node auto down itself](https://discuss.elastic.co/t/why-does-es-node-auto-down-itself/163194)

<div class="topic-metadata">

**Author:** [@iamazy](https://discuss.elastic.co/u/iamazy)\
**Replies:** 2\
**Last updated:** [January 8, 2019, 10:39am UTC](https://discuss.elastic.co/t/why-does-es-node-auto-down-itself/163194 "2019-01-08T10:39:05Z")

</div>

there's the logs that the down node print \] \[10.10.2.221\_node2\] loaded plugin \[analysis-ik\] \[2019-01-07T19:22:25,406\]\[INFO \]\[o.e.d.DiscoveryModule \] \[10.10.2.221\_node2\] using discovery type \[zen\] \[2019-01-07T19:22:27…

---

## [Cannot load class org.elasticsearch.spark.sql.SparkSQLCompatibilityLevel](https://discuss.elastic.co/t/cannot-load-class-org-elasticsearch-spark-sql-sparksqlcompatibilitylevel/152517)

<div class="topic-metadata">

**Author:** [@SKing](https://discuss.elastic.co/u/SKing)\
**Replies:** 2\
**Last updated:** [October 24, 2018, 8:26am UTC](https://discuss.elastic.co/t/cannot-load-class-org-elasticsearch-spark-sql-sparksqlcompatibilitylevel/152517 "2018-10-24T08:26:39Z")

</div>

I am running a Java Spark application. I can run the application from inside the intellij IDE. However, if I try to run it using the application built as a jar I get the following error. Caused by: org.elasticsearch.h…

---

## [Metricbeat module monitoring self-signed SSL endpoint](https://discuss.elastic.co/t/metricbeat-module-monitoring-self-signed-ssl-endpoint/147779)

<div class="topic-metadata">

**Author:** [@tomaszp](https://discuss.elastic.co/u/tomaszp)\
**Replies:** 2\
**Last updated:** [September 25, 2018, 1:10pm UTC](https://discuss.elastic.co/t/metricbeat-module-monitoring-self-signed-ssl-endpoint/147779 "2018-09-25T13:10:18Z")

</div>

Hi, I'm trying to monitor an SSL endpoint signed with a self-signed certificate with either the dropwizard or jolokia module of Metricbeat. For example, a snipped of jolokia module config: - module: jolokia metricset…

---

## [Selectable data directory when deploying nodes](https://discuss.elastic.co/t/selectable-data-directory-when-deploying-nodes/68741)

<div class="topic-metadata">

**Author:** [@pemontto](https://discuss.elastic.co/u/pemontto)\
**Replies:** 2\
**Last updated:** [December 13, 2016, 12:28pm UTC](https://discuss.elastic.co/t/selectable-data-directory-when-deploying-nodes/68741 "2016-12-13T12:28:08Z")

</div>

I've run up an Elastic cloud environment and it's working well so far. Our hardware nodes have a mix of SSD and spinning disk and what I would like to be able to do is specify a data directory, or have a pre-configured d…

---

## [Dynamically appending a query (for data entitlements)](https://discuss.elastic.co/t/dynamically-appending-a-query-for-data-entitlements/21339)

<div class="topic-metadata">

**Author:** [@Lokesh\_Gupta](https://discuss.elastic.co/u/Lokesh_Gupta)\
**Replies:** 2\
**Last updated:** [December 21, 2014, 2:25am UTC](https://discuss.elastic.co/t/dynamically-appending-a-query-for-data-entitlements/21339 "2014-12-21T02:25:56Z")

</div>

I have a use case where for every query that is coming from the user to elasticsearch (ES), I want to add another query on ES server side before ES executes the query. The reason I need to dynamically add this oth…

---

## [Zip file pass through](https://discuss.elastic.co/t/zip-file-pass-through/171008)

<div class="topic-metadata">

**Author:** [@kharvey](https://discuss.elastic.co/u/kharvey)\
**Replies:** 0\
**Last updated:** [March 6, 2019, 12:37am UTC](https://discuss.elastic.co/t/zip-file-pass-through/171008 "2019-03-06T00:37:15Z")

</div>

This may be a strange request, but is there a way that I can use Filebeat / Logstash to do a straight pass through of a zip file? I have a site that has 10's of gigs of log files that I want to process a day, but they a…

---

## [Problem when reindex a 8G index](https://discuss.elastic.co/t/problem-when-reindex-a-8g-index/232592)

<div class="topic-metadata">

**Author:** [@lizhu](https://discuss.elastic.co/u/lizhu)\
**Replies:** 3\
**Last updated:** [May 14, 2020, 5:16pm UTC](https://discuss.elastic.co/t/problem-when-reindex-a-8g-index/232592 "2020-05-14T17:16:09Z")

</div>

I have a 8G 、336408 docs index which have 5 pri and 1 rep, and want to reindex it. my command is POST \<node\_ip\>:9200/\_reindex?scroll=120m&timeout=120m&requests\_per\_second=10 { "source": { "index": "pcom", "si…

---

## [ILM policy is not followed correctly and index is not getting rollover as per doc size or max age](https://discuss.elastic.co/t/ilm-policy-is-not-followed-correctly-and-index-is-not-getting-rollover-as-per-doc-size-or-max-age/312306)

<div class="topic-metadata">

**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\
**Replies:** 6\
**Last updated:** [August 23, 2022, 5:18am UTC](https://discuss.elastic.co/t/ilm-policy-is-not-followed-correctly-and-index-is-not-getting-rollover-as-per-doc-size-or-max-age/312306 "2022-08-23T05:18:42Z")

</div>

Hello All, I'm facing major challenges with regards to ILM policy for all my indexes. In ILM policy I'm using two phase HOT and DELETE. Hot Phase- It should have max 2mb of data or data should be there for 3 min then …

---

## [AWS integration CloudWatch tags filter](https://discuss.elastic.co/t/aws-integration-cloudwatch-tags-filter/303724)

<div class="topic-metadata">

**Author:** [@kalbusse](https://discuss.elastic.co/u/kalbusse)\
**Replies:** 6\
**Last updated:** [May 12, 2022, 10:33am UTC](https://discuss.elastic.co/t/aws-integration-cloudwatch-tags-filter/303724 "2022-05-12T10:33:59Z")

</div>

Hello, I am trying to collect metrics from only a subset of resources with the AWS CloudWatch integration. I used the following configuration: - namespace: AWS/ApplicationELB tags: - key: "Application" val…

---

## [Create index by aggregating existing index](https://discuss.elastic.co/t/create-index-by-aggregating-existing-index/207011)

<div class="topic-metadata">

**Author:** [@aasoft](https://discuss.elastic.co/u/aasoft)\
**Replies:** 6\
**Last updated:** [November 9, 2019, 10:22pm UTC](https://discuss.elastic.co/t/create-index-by-aggregating-existing-index/207011 "2019-11-09T22:22:55Z")

</div>

I created an index as below: "hits" : \[ { "\_index" : "family", "\_type" : "doc", "\_id" : "1", "\_score" : 1.0, "\_source" : { "fkm\_family" : "1", "pkm\_article" : "1001" } }, { "\_index" : "family", "\_type" : "d…

---

## [ELK Watcher Response correct?](https://discuss.elastic.co/t/elk-watcher-response-correct/194988)

<div class="topic-metadata">

**Author:** [@rj23495](https://discuss.elastic.co/u/rj23495)\
**Replies:** 6\
**Last updated:** [August 29, 2019, 7:54am UTC](https://discuss.elastic.co/t/elk-watcher-response-correct/194988 "2019-08-29T07:54:34Z")

</div>

{ "\_id" : "metric\_DashOperations\_getUser\_success\_latency\_8d38ec7e-62f1-4b53-8e01-baacab7dad47-2019-08-13T08:57:38.355Z", "watch\_record" : { "watch\_id" : "metric\_DashOperations\_getUser\_success\_latency", "node"…

---

## [elasticsearch cannot read certificate file](https://discuss.elastic.co/t/elasticsearch-cannot-read-certificate-file/355757)

<div class="topic-metadata">

**Author:** [@vivere-dally](https://discuss.elastic.co/u/vivere-dally)\
**Replies:** 1\
**Last updated:** [March 20, 2024, 5:10am UTC](https://discuss.elastic.co/t/elasticsearch-cannot-read-certificate-file/355757 "2024-03-20T05:10:00Z")

</div>

I generated a certificate file with certbot. It is placed in /etc/letsencrypt/.... I created a group called elk where I added the elasticsearch user, and I recursively set it as the owning group for /etc/letsencrypt and…

---

## [TSVB Data Formatter : Access data other than value](https://discuss.elastic.co/t/tsvb-data-formatter-access-data-other-than-value/270352)

<div class="topic-metadata">

**Author:** [@Dzious](https://discuss.elastic.co/u/Dzious)\
**Replies:** 4\
**Last updated:** [April 22, 2021, 2:01pm UTC](https://discuss.elastic.co/t/tsvb-data-formatter-access-data-other-than-value/270352 "2021-04-22T14:01:55Z")

</div>

Hi, I made a visualisation that allow me to see a per process Memory usage (see here) I've been able to reproduce kind of the same visualisation without using Lens but by using TSVB and it's looking like that : In …

---

## [How to filter date field by days and hours separately](https://discuss.elastic.co/t/how-to-filter-date-field-by-days-and-hours-separately/265046)

<div class="topic-metadata">

**Author:** [@Hi\_u\_Nguy\_n\_Dang](https://discuss.elastic.co/u/Hi_u_Nguy_n_Dang)\
**Replies:** 1\
**Last updated:** [February 22, 2021, 10:40am UTC](https://discuss.elastic.co/t/how-to-filter-date-field-by-days-and-hours-separately/265046 "2021-02-22T10:40:58Z")

</div>

Hi, I want to create a query that returns all the data from last 30 days and only between 09:00 AM - 18:00 PM. My date field contains both the date and the time of the day (For example "time" : "2021-02-06T06:40:55Z"). …

---

## [Custom Index for Functionbeat](https://discuss.elastic.co/t/custom-index-for-functionbeat/248664)

<div class="topic-metadata">

**Author:** [@sainath](https://discuss.elastic.co/u/sainath)\
**Replies:** 4\
**Last updated:** [October 28, 2020, 1:12pm UTC](https://discuss.elastic.co/t/custom-index-for-functionbeat/248664 "2020-10-28T13:12:24Z")

</div>

Hi Team, I am trying to deploy function beat to read AWS logs which i am succesfully able to do. However, i require different index to be created in Elasticsearch for different log groups.Below id the elasticsearch outp…

---

## [Understanding network under the hood with cross cluster search](https://discuss.elastic.co/t/understanding-network-under-the-hood-with-cross-cluster-search/185126)

<div class="topic-metadata">

**Author:** [@michal1](https://discuss.elastic.co/u/michal1)\
**Replies:** 4\
**Last updated:** [June 11, 2019, 9:42am UTC](https://discuss.elastic.co/t/understanding-network-under-the-hood-with-cross-cluster-search/185126 "2019-06-11T09:42:33Z")

</div>

Hi, i would like to understand - is the communication made from coordinator node to the remote clusters done the same way as communication between nodes in single cluster, in tcp? Or is there a http connection done ther…

---

## [Curator Delete indices based on environment variable](https://discuss.elastic.co/t/curator-delete-indices-based-on-environment-variable/136633)

<div class="topic-metadata">

**Author:** [@tweety](https://discuss.elastic.co/u/tweety)\
**Replies:** 4\
**Last updated:** [June 21, 2018, 4:59am UTC](https://discuss.elastic.co/t/curator-delete-indices-based-on-environment-variable/136633 "2018-06-21T04:59:45Z")

</div>

Hi I am trying to delete indices and want to pass unit\_count as a parameter so that we can dynamically decide the unit\_count. {filtertype: age, source: name, direction: older, timestring: '%Y\_%m\_%d', unit: days, unit\_c…

---

## [Logstash get field from elasticsearch message](https://discuss.elastic.co/t/logstash-get-field-from-elasticsearch-message/114325)

<div class="topic-metadata">

**Author:** [@faoc](https://discuss.elastic.co/u/faoc)\
**Replies:** 4\
**Last updated:** [January 8, 2018, 9:35am UTC](https://discuss.elastic.co/t/logstash-get-field-from-elasticsearch-message/114325 "2018-01-08T09:35:18Z")

</div>

Hi, I have this message on ElasticSearch { "\_index": "audit\_201712", "\_type": "ccc", "\_id": "AWAsoVnydQqBAYNwSrNi", "\_score": null, "\_source": { "resourceType": "AuditEvent", "id": "4306b213-65a2-4ae1-b7e6-d1221…

---

## [Logstash KV plugin working](https://discuss.elastic.co/t/logstash-kv-plugin-working/99338)

<div class="topic-metadata">

**Author:** [@shashwat](https://discuss.elastic.co/u/shashwat)\
**Replies:** 4\
**Last updated:** [September 12, 2017, 4:55pm UTC](https://discuss.elastic.co/t/logstash-kv-plugin-working/99338 "2017-09-12T16:55:50Z")

</div>

Hi, I am trying to use logstash’s KV plugin. I have following log format: time taken for transfer for all files in seconds=23 transfer start time= 201708030959 transfer end time = 201708030959 My .conf file has follow…

---

## [Analysis of search query VS hits? Identifying the missing terms?](https://discuss.elastic.co/t/analysis-of-search-query-vs-hits-identifying-the-missing-terms/84468)

<div class="topic-metadata">

**Author:** [@Will5639](https://discuss.elastic.co/u/Will5639)\
**Replies:** 4\
**Last updated:** [May 4, 2017, 9:21pm UTC](https://discuss.elastic.co/t/analysis-of-search-query-vs-hits-identifying-the-missing-terms/84468 "2017-05-04T21:21:07Z")

</div>

I've got a match query I allow for a minimum match of "1\<-1 6\<-2" so the user can search for say: "dark souls 3" they'll get document results for "dark souls" or "dark souls 2". Is there any way via the ES response that…

---

## [Reindex incompatible with elasticsearch 2.3.0](https://discuss.elastic.co/t/reindex-incompatible-with-elasticsearch-2-3-0/60785)

<div class="topic-metadata">

**Author:** [@ayushbij27](https://discuss.elastic.co/u/ayushbij27)\
**Replies:** 4\
**Last updated:** [September 20, 2016, 11:19am UTC](https://discuss.elastic.co/t/reindex-incompatible-with-elasticsearch-2-3-0/60785 "2016-09-20T11:19:22Z")

</div>

As soon as I run a scala program using sbt with elas4s dependencies ,it throws an error Plugin \[reindex\] is incompatible with Elasticsearch \[2.3.0\]. Was designed for version \[2.3.5\] even though i am using elasticsearch v…

---

## [Similar terms or ontology?](https://discuss.elastic.co/t/similar-terms-or-ontology/3320)

<div class="topic-metadata">

**Author:** [@David\_Jensen\_2](https://discuss.elastic.co/u/David_Jensen_2)\
**Replies:** 4\
**Last updated:** [September 10, 2010, 9:49pm UTC](https://discuss.elastic.co/t/similar-terms-or-ontology/3320 "2010-09-10T21:49:57Z")

</div>

Is there any way in ES that I can specify an ontology of terms that should match as being equivalent. For instance a search for "Dave" should match "David" and a search for "David" should match "Dave". David

---

## [Convert keyword field to date for range query](https://discuss.elastic.co/t/convert-keyword-field-to-date-for-range-query/365121)

<div class="topic-metadata">

**Author:** [@NEWBIENEET](https://discuss.elastic.co/u/NEWBIENEET)\
**Replies:** 2\
**Last updated:** [August 20, 2024, 6:46am UTC](https://discuss.elastic.co/t/convert-keyword-field-to-date-for-range-query/365121 "2024-08-20T06:46:22Z")

</div>

One of the fields in the ES that my team used is "TIME\_STAMP" which contains a timestamp data but in keyword format. I want to query data based on this value, is there any way to convert the keyword to date? I'm new to E…

---

## [Painless loop on geopoints array](https://discuss.elastic.co/t/painless-loop-on-geopoints-array/170037)

<div class="topic-metadata">

**Author:** [@daganm](https://discuss.elastic.co/u/daganm)\
**Replies:** 1\
**Last updated:** [February 27, 2019, 4:46pm UTC](https://discuss.elastic.co/t/painless-loop-on-geopoints-array/170037 "2019-02-27T16:46:05Z")

</div>

Hi there! I'm trying to loop over a geo\_point array in my painless script, but I can't find a way to make it work. My script is called in a script\_score stage. Here is the part of code not working : for (def i=0; i \< …

---

## [Getting \_grokparsefailure error while inserting a log](https://discuss.elastic.co/t/getting-grokparsefailure-error-while-inserting-a-log/151501)

<div class="topic-metadata">

**Author:** [@kunalwagh](https://discuss.elastic.co/u/kunalwagh)\
**Replies:** 1\
**Last updated:** [October 8, 2018, 7:04pm UTC](https://discuss.elastic.co/t/getting-grokparsefailure-error-while-inserting-a-log/151501 "2018-10-08T19:04:23Z")

</div>

pipeline.conf - input { file { path =&gt; "C:/ELK-Stack/logstash/event-data/test.log" start\_position =&gt; "beginning" } http { host =\> "localhost" port =\> 8088 } } filter { grok { match =\> { "mes…

---

## [Filebeat with LogstashXML parser](https://discuss.elastic.co/t/filebeat-with-logstashxml-parser/143872)

<div class="topic-metadata">

**Author:** [@leggrand](https://discuss.elastic.co/u/leggrand)\
**Replies:** 7\
**Last updated:** [August 14, 2018, 6:18pm UTC](https://discuss.elastic.co/t/filebeat-with-logstashxml-parser/143872 "2018-08-14T18:18:10Z")

</div>

I create a template, with field maps, but the fields is empty. My logstash config is: input { beats { port =\> 5044 client\_inactivity\_timeout =\> 900 } } filter { xml { source =\> "message" …

---

## [req.RequestURI filter](https://discuss.elastic.co/t/req-requesturi-filter/103712)

<div class="topic-metadata">

**Author:** [@nandhini](https://discuss.elastic.co/u/nandhini)\
**Replies:** 1\
**Last updated:** [October 12, 2017, 12:15pm UTC](https://discuss.elastic.co/t/req-requesturi-filter/103712 "2017-10-12T12:15:43Z")

</div>

Hi, In KIBANA, i am trying to monitor execution time and count of occurrence for my requests. I have set up a visualization for that. I have a request like req.requestURI 'https://aaa/bbb/ccc' and another request like…

---

## [Label for the the bucket](https://discuss.elastic.co/t/label-for-the-the-bucket/90733)

<div class="topic-metadata">

**Author:** [@garytam](https://discuss.elastic.co/u/garytam)\
**Replies:** 1\
**Last updated:** [June 26, 2017, 8:40pm UTC](https://discuss.elastic.co/t/label-for-the-the-bucket/90733 "2017-06-26T20:40:00Z")

</div>

Newbie to Kibana, trying to do a sub Aggregation with bucket that is not time based. How can I set the x-axis label for the buckets ? How can I set the labels "to: How to set to range?" to "-1 to 100", "101 - 200" etc.…

---

## [Empty Nodes?](https://discuss.elastic.co/t/empty-nodes/72494)

<div class="topic-metadata">

**Author:** [@Trynar](https://discuss.elastic.co/u/Trynar)\
**Replies:** 1\
**Last updated:** [January 23, 2017, 5:41pm UTC](https://discuss.elastic.co/t/empty-nodes/72494 "2017-01-23T17:41:19Z")

</div>

Hi, Just a simple question which i can't find any answer. If in an index, i use - 3 primary shards - 1 replica shards Then i start 8 nodes. Will only 6 nodes be busy ? And so, what can be a better configuration…

---

## [Scripted field return wrong value](https://discuss.elastic.co/t/scripted-field-return-wrong-value/38752)

<div class="topic-metadata">

**Author:** [@minh.hoang](https://discuss.elastic.co/u/minh.hoang)\
**Replies:** 1\
**Last updated:** [January 11, 2016, 6:17pm UTC](https://discuss.elastic.co/t/scripted-field-return-wrong-value/38752 "2016-01-11T18:17:08Z")

</div>

I'm trying to verify the CPU usage percentage for a box with topbeat with everything in default, only change I made is instead of output to elasticsearch, the output is logstash. This is the scripted field: script: d…

---

## [How to reference a script field value in another script](https://discuss.elastic.co/t/how-to-reference-a-script-field-value-in-another-script/37905)

<div class="topic-metadata">

**Author:** [@zaza](https://discuss.elastic.co/u/zaza)\
**Replies:** 1\
**Last updated:** [December 24, 2015, 5:46am UTC](https://discuss.elastic.co/t/how-to-reference-a-script-field-value-in-another-script/37905 "2015-12-24T05:46:26Z")

</div>

I calculate a script field (a little performance-expensive) when search, an then I want to reference the script field value in a script sort. I seems elasticsearch not support it now, I can only reference the doc field v…

---

## [Kibana is not getting up](https://discuss.elastic.co/t/kibana-is-not-getting-up/334317)

<div class="topic-metadata">

**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\
**Replies:** 3\
**Last updated:** [May 26, 2023, 2:38pm UTC](https://discuss.elastic.co/t/kibana-is-not-getting-up/334317 "2023-05-26T14:38:25Z")

</div>

Hello All, I am trying to connect my elasticsearch hosted in aws cloud with kibana(on premise host). My elastic comes up properly but kibana is not getting up. always same message: Logs: {"service":{"node":{"roles…

[Previous page](https://discuss.elastic.co/top.md?page=1645&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1647&per_page=50&period=all)
