# Top

**URL:** https://discuss.elastic.co/top.md?page=1665&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1666

---

## [ES 5.2 Histogram aggregration query issue with timestamp field as long type](https://discuss.elastic.co/t/es-5-2-histogram-aggregration-query-issue-with-timestamp-field-as-long-type/79354)

<div class="topic-metadata">

**Author:** [@nrmohta](https://discuss.elastic.co/u/nrmohta)\
**Replies:** 0\
**Last updated:** [March 21, 2017, 6:28am UTC](https://discuss.elastic.co/t/es-5-2-histogram-aggregration-query-issue-with-timestamp-field-as-long-type/79354 "2017-03-21T06:28:01Z")

</div>

Team, We are facing one issue related to histogram aggregation while upgrading from 2.2 to 5.2. We are storing timestamp field with "mapping": {"type": "long","store": "yes"} And using below histogram aggregation que…

---

## [EREG in input to apply in tags value](https://discuss.elastic.co/t/ereg-in-input-to-apply-in-tags-value/65328)

<div class="topic-metadata">

**Author:** [@mcortinas](https://discuss.elastic.co/u/mcortinas)\
**Replies:** 3\
**Last updated:** [November 10, 2016, 12:52pm UTC](https://discuss.elastic.co/t/ereg-in-input-to-apply-in-tags-value/65328 "2016-11-10T12:52:03Z")

</div>

Hi, I'm starting working with filebeat and I want add tag with the value of regular expression in path filebeat.prospectors: - paths: - /mnt/ssd/(.\*).log --\> EREG to obtain the application name tags: \[$app\]…

---

## [Elasticsearch, cluster health: yellow](https://discuss.elastic.co/t/elasticsearch-cluster-health-yellow/47797)

<div class="topic-metadata">

**Author:** [@emran](https://discuss.elastic.co/u/emran)\
**Replies:** 3\
**Last updated:** [April 19, 2016, 2:50pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-health-yellow/47797 "2016-04-19T14:50:20Z")

</div>

Hello Everyone, We have 2 servers which are replicas. 3 Days ago both were working fine. Today I found that 1 has stopped working and states unassigned and the cluster status has changed from green to yellow. Can yo…

---

## [Multiline Capture Group](https://discuss.elastic.co/t/multiline-capture-group/44083)

<div class="topic-metadata">

**Author:** [@Cole\_Shores](https://discuss.elastic.co/u/Cole_Shores)\
**Replies:** 3\
**Last updated:** [March 12, 2016, 11:36am UTC](https://discuss.elastic.co/t/multiline-capture-group/44083 "2016-03-12T11:36:14Z")

</div>

(^Mar\[\\s\\S\]?Caused) ... or more specifically (^%{MONTH}\[\\s\\S\]?Caused) doesn't work to capture a multiline log. Is there a way to capture a multiline log from a start and ending delimiter. Or is there a multiline filter…

---

## [Elasticsearch integration with Mongo db](https://discuss.elastic.co/t/elasticsearch-integration-with-mongo-db/40951)

<div class="topic-metadata">

**Author:** [@justnj](https://discuss.elastic.co/u/justnj)\
**Replies:** 3\
**Last updated:** [February 9, 2016, 8:30am UTC](https://discuss.elastic.co/t/elasticsearch-integration-with-mongo-db/40951 "2016-02-09T08:30:47Z")

</div>

Hi how can I integrate elasticsearch with mongo db step by step doc is available or not

---

## [Alerting Rule with link to Discover](https://discuss.elastic.co/t/alerting-rule-with-link-to-discover/361628)

<div class="topic-metadata">

**Author:** [@\_Thomas](https://discuss.elastic.co/u/_Thomas)\
**Replies:** 6\
**Last updated:** [June 18, 2024, 11:11am UTC](https://discuss.elastic.co/t/alerting-rule-with-link-to-discover/361628 "2024-06-18T11:11:15Z")

</div>

Hi Guys, I'm trying to get my head around the following: Is it possible to have a Discover Link included in the E-Mail Alert? The Use-Case is as following: Whenever I receive an Alert over the Mail Connector, I'd lik…

---

## [After sometime transaction are not generating only spans are coming](https://discuss.elastic.co/t/after-sometime-transaction-are-not-generating-only-spans-are-coming/199003)

<div class="topic-metadata">

**Author:** [@yelururao](https://discuss.elastic.co/u/yelururao)\
**Replies:** 6\
**Last updated:** [September 12, 2019, 12:35pm UTC](https://discuss.elastic.co/t/after-sometime-transaction-are-not-generating-only-spans-are-coming/199003 "2019-09-12T12:35:32Z")

</div>

Hi, i have create my local application with different endpoints (urls), and each endpoint have different different spans like database calls & external http calls. here the problem : after sometime transaction are not…

---

## [Elastalert2 reaalert every 5 minutes and group the number of hits](https://discuss.elastic.co/t/elastalert2-reaalert-every-5-minutes-and-group-the-number-of-hits/309710)

<div class="topic-metadata">

**Author:** [@navin1093](https://discuss.elastic.co/u/navin1093)\
**Replies:** 2\
**Last updated:** [July 15, 2022, 3:50pm UTC](https://discuss.elastic.co/t/elastalert2-reaalert-every-5-minutes-and-group-the-number-of-hits/309710 "2022-07-15T15:50:21Z")

</div>

Seeking your advice and help. Currently my Heartbeat will monitor system health for every 5 minutes. Then, it will save the data to Elasticsearch. My Elastalert2 will retrieve the date from Elasticsearch. I have 2 syst…

---

## [exception=\>#\<CSV::MalformedCSVError: Illegal quoting in line 1.\>](https://discuss.elastic.co/t/exception-csv-illegal-quoting-in-line-1/291437)

<div class="topic-metadata">

**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\
**Replies:** 2\
**Last updated:** [December 13, 2021, 4:06pm UTC](https://discuss.elastic.co/t/exception-csv-illegal-quoting-in-line-1/291437 "2021-12-13T16:06:49Z")

</div>

My config file is: { stdin{} } filter { if "box\_Firewall" not in \[program\] { if \[message\] =~ /{".\*":\\s".\*",/ { json { source =\> "message" } …

---

## [SSL Transport setup with Ansible](https://discuss.elastic.co/t/ssl-transport-setup-with-ansible/237993)

<div class="topic-metadata">

**Author:** [@biggtimber](https://discuss.elastic.co/u/biggtimber)\
**Replies:** 2\
**Last updated:** [June 29, 2020, 3:54am UTC](https://discuss.elastic.co/t/ssl-transport-setup-with-ansible/237993 "2020-06-29T03:54:06Z")

</div>

How do normal installations of the elasticstack work with SSL Transport/HTTP when using Ansible? I'm using the github ansible role setup. From the documentation, it shows the cert setup using elasticsearch-certutil to g…

---

## [Kibana Pie Chart missing top labels](https://discuss.elastic.co/t/kibana-pie-chart-missing-top-labels/236639)

<div class="topic-metadata">

**Author:** [@spaolik](https://discuss.elastic.co/u/spaolik)\
**Replies:** 2\
**Last updated:** [June 11, 2020, 3:01pm UTC](https://discuss.elastic.co/t/kibana-pie-chart-missing-top-labels/236639 "2020-06-11T15:01:16Z")

</div>

Hi there, I cannot manage to have on screen the 2 missing labels for my pie chart. Tryed all options of the graph, but cant find anything. Is this a bug? Why do I get only the 8 top values information label on screen,…

---

## [Kibana - Scripted Field TimeZone in Month](https://discuss.elastic.co/t/kibana-scripted-field-timezone-in-month/209314)

<div class="topic-metadata">

**Author:** [@Rafael\_Almeida1](https://discuss.elastic.co/u/Rafael_Almeida1)\
**Replies:** 2\
**Last updated:** [November 25, 2019, 6:43pm UTC](https://discuss.elastic.co/t/kibana-scripted-field-timezone-in-month/209314 "2019-11-25T18:43:32Z")

</div>

Hi, I'm trying use scripted fields to get day, month and year of a date field but get some trouble over month field. I have the following scenario: First Test: Timezone of Server : UTC-3 (America/Fortaleza) Timezone o…

---

## [New indices not appearing in kibana](https://discuss.elastic.co/t/new-indices-not-appearing-in-kibana/204678)

<div class="topic-metadata">

**Author:** [@Heidari](https://discuss.elastic.co/u/Heidari)\
**Replies:** 2\
**Last updated:** [October 22, 2019, 3:53pm UTC](https://discuss.elastic.co/t/new-indices-not-appearing-in-kibana/204678 "2019-10-22T15:53:26Z")

</div>

The issue is that Elastic nodes in my cluster are creating indexes with defined name, but created indices are not showing and Kibana dashboard as well. Kibana not fetching indices that are already in elasticsearch when…

---

## [Elastic ML Job Monitoring](https://discuss.elastic.co/t/elastic-ml-job-monitoring/202976)

<div class="topic-metadata">

**Author:** [@rajuleo](https://discuss.elastic.co/u/rajuleo)\
**Replies:** 2\
**Last updated:** [October 10, 2019, 12:58pm UTC](https://discuss.elastic.co/t/elastic-ml-job-monitoring/202976 "2019-10-10T12:58:13Z")

</div>

Team, Is there anyway to monitor the ML jobs running and send alerts?

---

## [Is Elastic Search suitable for searching text in all tables?](https://discuss.elastic.co/t/is-elastic-search-suitable-for-searching-text-in-all-tables/193492)

<div class="topic-metadata">

**Author:** [@Yasir\_Arafat](https://discuss.elastic.co/u/Yasir_Arafat)\
**Replies:** 2\
**Last updated:** [August 2, 2019, 10:41am UTC](https://discuss.elastic.co/t/is-elastic-search-suitable-for-searching-text-in-all-tables/193492 "2019-08-02T10:41:57Z")

</div>

I have question about Elastic Search is that I have Sql Server Database and i have to Search all tables for text for this purpose Elastic search feature is good enough or i have to go with other option.

---

## [Ruby set first day of next month?](https://discuss.elastic.co/t/ruby-set-first-day-of-next-month/189654)

<div class="topic-metadata">

**Author:** [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\
**Replies:** 2\
**Last updated:** [July 11, 2019, 11:35pm UTC](https://discuss.elastic.co/t/ruby-set-first-day-of-next-month/189654 "2019-07-11T23:35:01Z")

</div>

Hi, Is it possible to get the first day of the next month using ruby? I need to to update some documents with a future date in a format such as 2019/07/01. I tried using date and today but none of them seem to work. Lo…

---

## [Java stacktrace multiline](https://discuss.elastic.co/t/java-stacktrace-multiline/158430)

<div class="topic-metadata">

**Author:** [@bbking](https://discuss.elastic.co/u/bbking)\
**Replies:** 2\
**Last updated:** [December 1, 2018, 1:18am UTC](https://discuss.elastic.co/t/java-stacktrace-multiline/158430 "2018-12-01T01:18:24Z")

</div>

I'm trying to use multiline in Filebeat to parse Java stacktrace as shown below but still have a hard time extracting and grouping all needed data. \[Mon Nov 26 02:58:42 PST 2018\] HEARTBEAT count=1 rev=\*\*\* PRODUCT- URI:…

---

## [Logstash-filter-rest Client Error](https://discuss.elastic.co/t/logstash-filter-rest-client-error/150083)

<div class="topic-metadata">

**Author:** [@Sid\_Sathi](https://discuss.elastic.co/u/Sid_Sathi)\
**Replies:** 2\
**Last updated:** [September 27, 2018, 6:17am UTC](https://discuss.elastic.co/t/logstash-filter-rest-client-error/150083 "2018-09-27T06:17:40Z")

</div>

I installed logstash-filter-rest plugin in to make an post request to a webservice but I am getting the following error. \[ERROR\]\[logstash.filters.rest \] error in rest filter :client\_error=\>#\<Manticore::SocketExcept…

---

## [Issues with multiple winlogbeat parsing](https://discuss.elastic.co/t/issues-with-multiple-winlogbeat-parsing/144522)

<div class="topic-metadata">

**Author:** [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Replies:** 2\
**Last updated:** [August 15, 2018, 1:33pm UTC](https://discuss.elastic.co/t/issues-with-multiple-winlogbeat-parsing/144522 "2018-08-15T13:33:21Z")

</div>

Hello, I have attempted to add another winlogbeat agent to another box and this is the output to the logstash logs: \[2018-08-15T14:01:23,485\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index event to Elasticsearc…

---

## [Filebeat or Logstash at the application servers?](https://discuss.elastic.co/t/filebeat-or-logstash-at-the-application-servers/105536)

<div class="topic-metadata">

**Author:** [@GGA](https://discuss.elastic.co/u/GGA)\
**Replies:** 2\
**Last updated:** [October 27, 2017, 9:49am UTC](https://discuss.elastic.co/t/filebeat-or-logstash-at-the-application-servers/105536 "2017-10-27T09:49:58Z")

</div>

Hi, I'm thinking of implementing an ELK stack and I have a question about what to install on the application and apache servers to collect the logs. Both Logstash and Filebeat can read from log files. My initial idea …

---

## [Throttling processing of log backfill](https://discuss.elastic.co/t/throttling-processing-of-log-backfill/83734)

<div class="topic-metadata">

**Author:** [@gtorrance](https://discuss.elastic.co/u/gtorrance)\
**Replies:** 2\
**Last updated:** [April 26, 2017, 4:54pm UTC](https://discuss.elastic.co/t/throttling-processing-of-log-backfill/83734 "2017-04-26T16:54:30Z")

</div>

I've done my own research on this, but have not yet found a clear solution. Hoping someone can advise. We have a very simple single-node ELK server and a client with Filebeat (Filebeat -\> LS -\> ES). We don't anticipate…

---

## [ElasticSearch Cluster installation](https://discuss.elastic.co/t/elasticsearch-cluster-installation/40945)

<div class="topic-metadata">

**Author:** [@ven2286](https://discuss.elastic.co/u/ven2286)\
**Replies:** 2\
**Last updated:** [February 4, 2016, 12:42pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-installation/40945 "2016-02-04T12:42:58Z")

</div>

Can some body specify the cluster information. I want my 3 node cluster. each node should run in different mechins 192.168.1.100 node-1 192.168.1.101 node-2 192.168.1.102 node-3 i tried this set up , but nodes are not …

---

## [Jsonparsefailures parsing apache access logs](https://discuss.elastic.co/t/jsonparsefailures-parsing-apache-access-logs/32039)

<div class="topic-metadata">

**Author:** [@bluethundr](https://discuss.elastic.co/u/bluethundr)\
**Replies:** 2\
**Last updated:** [October 12, 2015, 9:00pm UTC](https://discuss.elastic.co/t/jsonparsefailures-parsing-apache-access-logs/32039 "2015-10-12T21:00:06Z")

</div>

Hey guys, I tried setting up json logging in apache, as demonstrated in the logstash book. Here's the custom access log definition I'm using: LogFormat "{ \\ \\"host\\":\\"beta.jokefire.com.jokefire.com\\", \\ \\"…

---

## [Getting an array inside a document sorted on the basis of some precondition](https://discuss.elastic.co/t/getting-an-array-inside-a-document-sorted-on-the-basis-of-some-precondition/9593)

<div class="topic-metadata">

**Author:** [@azitabh](https://discuss.elastic.co/u/azitabh)\
**Replies:** 2\
**Last updated:** [November 7, 2012, 3:15pm UTC](https://discuss.elastic.co/t/getting-an-array-inside-a-document-sorted-on-the-basis-of-some-precondition/9593 "2012-11-07T15:15:07Z")

</div>

Let's say this is the document indexed in elasticsearch: {:id=\>123,:a=\>10, :b=\>12, :c=\>\[{:x=\>A,:y=\>102,:z=\>92},{:x=\>B,:y=\>110,:z=\>96},{:x=\>C,:y=\>94,:z=\>106}\]} And I am firing some query to elasticsearch and it's gu…

---

## [Get output value of powershell script](https://discuss.elastic.co/t/get-output-value-of-powershell-script/297768)

<div class="topic-metadata">

**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\
**Replies:** 4\
**Last updated:** [February 23, 2022, 5:02pm UTC](https://discuss.elastic.co/t/get-output-value-of-powershell-script/297768 "2022-02-23T17:02:38Z")

</div>

Hi, In winlogbeat, I'm able to get the body of PowerShell script that is executed on device using: powershell.file.script\_block\_text: But is there a way to get the 'stdout' or return / output of the script? Regrdas,

---

## [Couldn't login to Kibana URL](https://discuss.elastic.co/t/couldnt-login-to-kibana-url/288217)

<div class="topic-metadata">

**Author:** [@orelevi](https://discuss.elastic.co/u/orelevi)\
**Replies:** 4\
**Last updated:** [November 2, 2021, 9:17pm UTC](https://discuss.elastic.co/t/couldnt-login-to-kibana-url/288217 "2021-11-02T21:17:38Z")

</div>

I know it's not the best practice but i want to check something, so i manually created opensearch service at AWS and i can't connect through the kibana url (timeout error) i really don't understand why, my security group…

---

## [Has error making http request: Get "http://npipe/state": been fixed yet for Elastic Agent 7.10.2?](https://discuss.elastic.co/t/has-error-making-http-request-get-http-npipe-state-been-fixed-yet-for-elastic-agent-7-10-2/266722)

<div class="topic-metadata">

**Author:** [@dvo](https://discuss.elastic.co/u/dvo)\
**Replies:** 4\
**Last updated:** [March 10, 2021, 2:25pm UTC](https://discuss.elastic.co/t/has-error-making-http-request-get-http-npipe-state-been-fixed-yet-for-elastic-agent-7-10-2/266722 "2021-03-10T14:25:05Z")

</div>

I'm testing a single Windows agent, and Kibana is littered with these errors, and it looks bad to the potential customer. I've got to get it cleaned up. error making http request: Get "http://npipe/state": open \\default…

---

## [Logstash log unable to complete log read and throws error](https://discuss.elastic.co/t/logstash-log-unable-to-complete-log-read-and-throws-error/256945)

<div class="topic-metadata">

**Author:** [@msk\_76](https://discuss.elastic.co/u/msk_76)\
**Replies:** 4\
**Last updated:** [November 30, 2020, 3:12pm UTC](https://discuss.elastic.co/t/logstash-log-unable-to-complete-log-read-and-throws-error/256945 "2020-11-30T15:12:41Z")

</div>

I have setup logstash to read log files generated by another application realtime. The input config is like this. it is throwing the below error in logstash log. I am unable to track if it has been able to read the finis…

---

## [How to preserve timestamp while re-indexing?](https://discuss.elastic.co/t/how-to-preserve-timestamp-while-re-indexing/251461)

<div class="topic-metadata">

**Author:** [@srbhklkrn](https://discuss.elastic.co/u/srbhklkrn)\
**Replies:** 4\
**Last updated:** [October 8, 2020, 2:51pm UTC](https://discuss.elastic.co/t/how-to-preserve-timestamp-while-re-indexing/251461 "2020-10-08T14:51:03Z")

</div>

I'm reindexing from 6.4 to 7.9 and while I got all documents as it is one thing I noticed timestamp is different, how do I preserve old timestamp in the document?

---

## [Kibana load time](https://discuss.elastic.co/t/kibana-load-time/231098)

<div class="topic-metadata">

**Author:** [@nityaraj06](https://discuss.elastic.co/u/nityaraj06)\
**Replies:** 4\
**Last updated:** [May 5, 2020, 2:49pm UTC](https://discuss.elastic.co/t/kibana-load-time/231098 "2020-05-05T14:49:09Z")

</div>

Hi, When the end user accesses Kibana 7.6 for the first time, it takes 15-20s to load, the search queries and other tabs within Kibana don’t take much time. Is there any particular reason for this? I checked through bro…

---

## [Elasticsearch 7.x consumes more space for indexes](https://discuss.elastic.co/t/elasticsearch-7-x-consumes-more-space-for-indexes/217406)

<div class="topic-metadata">

**Author:** [@mainameiz](https://discuss.elastic.co/u/mainameiz)\
**Replies:** 4\
**Last updated:** [February 4, 2020, 8:50am UTC](https://discuss.elastic.co/t/elasticsearch-7-x-consumes-more-space-for-indexes/217406 "2020-02-04T08:50:53Z")

</div>

Hello everyone! I have a question about index size of 7.5.2 version compared to 6.8.6. I have two identical set of data indexed in ES6 and in ES7. Both indexes are force merged. ES6 (index size - 91.2mb) green open d…

---

## [Extract specifc field from greedydata](https://discuss.elastic.co/t/extract-specifc-field-from-greedydata/183122)

<div class="topic-metadata">

**Author:** [@Nithani25](https://discuss.elastic.co/u/Nithani25)\
**Replies:** 4\
**Last updated:** [June 3, 2019, 12:04pm UTC](https://discuss.elastic.co/t/extract-specifc-field-from-greedydata/183122 "2019-06-03T12:04:11Z")

</div>

Hi Team, I am working on specific set of logs and it follows simple grok structure as shown below. %{TIMESTAMP} %{LOGLEVEL} %{METHODNAME} %{GREEDYDATA:LOGMESSAGE} the "LOGMESSAGE" field does contain some user related …

---

## [Unable to create Region Map Visualization](https://discuss.elastic.co/t/unable-to-create-region-map-visualization/139815)

<div class="topic-metadata">

**Author:** [@APJ](https://discuss.elastic.co/u/APJ)\
**Replies:** 4\
**Last updated:** [July 12, 2018, 10:18pm UTC](https://discuss.elastic.co/t/unable-to-create-region-map-visualization/139815 "2018-07-12T22:18:32Z")

</div>

Hi all, I am trying to create a Region Map visualization on Kibana using the IP addresses present in the log. I downloaded a sample of apache access log from the following link Apache access log I was able to successfu…

---

## [Is a direct client-elasticsearch connection safe with X-Pack?](https://discuss.elastic.co/t/is-a-direct-client-elasticsearch-connection-safe-with-x-pack/123379)

<div class="topic-metadata">

**Author:** [@The5785alex](https://discuss.elastic.co/u/The5785alex)\
**Replies:** 4\
**Last updated:** [March 13, 2018, 10:39am UTC](https://discuss.elastic.co/t/is-a-direct-client-elasticsearch-connection-safe-with-x-pack/123379 "2018-03-13T10:39:43Z")

</div>

Hello everyone, I'm working on a personal-mobile application that needs search capabilities and, since I'm not enough confident to deploy/secure/maintain my own server, I'm really interested on elastic cloud and its fe…

---

## [Search based on FullText Meta Information](https://discuss.elastic.co/t/search-based-on-fulltext-meta-information/104069)

<div class="topic-metadata">

**Author:** [@PascalTurbo](https://discuss.elastic.co/u/PascalTurbo)\
**Replies:** 4\
**Last updated:** [October 23, 2017, 9:16am UTC](https://discuss.elastic.co/t/search-based-on-fulltext-meta-information/104069 "2017-10-23T09:16:48Z")

</div>

Hi There, we've written a plugin that adds some linguistic information to the fulltext index like Stem and POS. Now we wanna search based on this information. Example: Indexed Text: a) "The cars are driving around…

---

## [Building a project with elasticsearch](https://discuss.elastic.co/t/building-a-project-with-elasticsearch/96420)

<div class="topic-metadata">

**Author:** [@marwa](https://discuss.elastic.co/u/marwa)\
**Replies:** 4\
**Last updated:** [August 11, 2017, 8:32am UTC](https://discuss.elastic.co/t/building-a-project-with-elasticsearch/96420 "2017-08-11T08:32:46Z")

</div>

Hello, i am new in elasticsearch world , i wanna build a project with elastic stack but i don 't know what to use ! I need to perform calculation using multiple fields from multiple indexes then reuse those results in k…

---

## [Elastic node down unable to find reason?](https://discuss.elastic.co/t/elastic-node-down-unable-to-find-reason/77092)

<div class="topic-metadata">

**Author:** [@sandeep\_verma1](https://discuss.elastic.co/u/sandeep_verma1)\
**Replies:** 4\
**Last updated:** [March 2, 2017, 11:03am UTC](https://discuss.elastic.co/t/elastic-node-down-unable-to-find-reason/77092 "2017-03-02T11:03:15Z")

</div>

Elasticsearch node down but unable to find exact reason. Elasticserach Infra: 1 master 5 data node each has 28 gb ram ,550 gb storage, 8 core and attached screenshot of marvel of that time (9-10 am). I major part no…

---

## [Gsub with regex](https://discuss.elastic.co/t/gsub-with-regex/322756)

<div class="topic-metadata">

**Author:** [@searchtastic](https://discuss.elastic.co/u/searchtastic)\
**Replies:** 1\
**Last updated:** [January 10, 2023, 4:32pm UTC](https://discuss.elastic.co/t/gsub-with-regex/322756 "2023-01-10T16:32:26Z")

</div>

Hi, My regex is matching my condition on my ingest pipeline, however I am struggling to wrap my found string with quotes for the replacement. expression. "gsub": { "field": "message", "pattern": "\\b\[0-…

---

## [How can i send multiple json messages to logstash using http plugin?](https://discuss.elastic.co/t/how-can-i-send-multiple-json-messages-to-logstash-using-http-plugin/202592)

<div class="topic-metadata">

**Author:** [@rajkumar.m](https://discuss.elastic.co/u/rajkumar.m)\
**Replies:** 1\
**Last updated:** [October 9, 2019, 2:44pm UTC](https://discuss.elastic.co/t/how-can-i-send-multiple-json-messages-to-logstash-using-http-plugin/202592 "2019-10-09T14:44:01Z")

</div>

I am trying to send multiple json messages to logstash using http plugin, but i could see only the first message on kibana. please help. below is the my plugin. input { http { port =\> XXXX } } I am trying to pus…

---

## [Kibana's default index pattern get deleted automatically](https://discuss.elastic.co/t/kibanas-default-index-pattern-get-deleted-automatically/189577)

<div class="topic-metadata">

**Author:** [@tomeri](https://discuss.elastic.co/u/tomeri)\
**Replies:** 1\
**Last updated:** [July 9, 2019, 6:15pm UTC](https://discuss.elastic.co/t/kibanas-default-index-pattern-get-deleted-automatically/189577 "2019-07-09T18:15:05Z")

</div>

Hi, Kibana 6.7.1 I started to face a weird behavior with Kibana, for an unknown reason when logging in to Kibana it complains that there's no default index-pattern configured I then chose one of the index-pattern from…

---

## [GUI Suggestions](https://discuss.elastic.co/t/gui-suggestions/176456)

<div class="topic-metadata">

**Author:** [@Ben\_Frost](https://discuss.elastic.co/u/Ben_Frost)\
**Replies:** 1\
**Last updated:** [April 15, 2019, 8:58am UTC](https://discuss.elastic.co/t/gui-suggestions/176456 "2019-04-15T08:58:43Z")

</div>

It would be nice to be able to get the status page to fit on a single page versus scrolling or be able to list the errors before the monitor status. It would also be nice to be able to customize the columns to include f…

---

## [Remove date from syslog message](https://discuss.elastic.co/t/remove-date-from-syslog-message/170650)

<div class="topic-metadata">

**Author:** [@paulohperes](https://discuss.elastic.co/u/paulohperes)\
**Replies:** 1\
**Last updated:** [March 3, 2019, 8:09pm UTC](https://discuss.elastic.co/t/remove-date-from-syslog-message/170650 "2019-03-03T20:09:53Z")

</div>

Hello, I'm building a server logs, the server receive logs from network equipments (Juniper, Ericsson, Cisco, Huawei and Nokia). The server does forward the logs to logstash server on port 55514. Analyzing the logs, lo…

---

## [\[Kibana\]Visual Builderで未定義またはnull参照のプロパティ](https://discuss.elastic.co/t/kibana-visual-builder-null/164592)

<div class="topic-metadata">

**Author:** [@29sk](https://discuss.elastic.co/u/29sk)\
**Replies:** 1\
**Last updated:** [January 19, 2019, 4:39am UTC](https://discuss.elastic.co/t/kibana-visual-builder-null/164592 "2019-01-19T04:39:24Z")

</div>

Kibanaで、集計した2つのmetricsに対して四則演算を用いたく、visual builderの使用を考えています。 使い方を試したく、下記URLの四則演算サンプルのように入力したところ、aggregationにMathを入力すると「未定義またはnull参照のプロパティ"containsは"取得できません」というエラーがブラウザ上で表示されました。 何らかの値の受け渡しに失敗しているものと思いますが、原因の調べ方はありますでし…

---

## [Event.append() on Logstash 6](https://discuss.elastic.co/t/event-append-on-logstash-6/151927)

<div class="topic-metadata">

**Author:** [@decibel83](https://discuss.elastic.co/u/decibel83)\
**Replies:** 1\
**Last updated:** [October 10, 2018, 8:18pm UTC](https://discuss.elastic.co/t/event-append-on-logstash-6/151927 "2018-10-10T20:18:43Z")

</div>

I'm trying to use the Logstash aggregate filter on Postfix logs using a filter taken from https://github.com/topmedia/logstash-postfix/blob/master/etc/logstash/conf.d/51-filter-postfix-aggregate.conf. I modified the fil…

---

## [Regarding Coordinator Node Memory Usage](https://discuss.elastic.co/t/regarding-coordinator-node-memory-usage/147339)

<div class="topic-metadata">

**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\
**Replies:** 1\
**Last updated:** [September 7, 2018, 3:36pm UTC](https://discuss.elastic.co/t/regarding-coordinator-node-memory-usage/147339 "2018-09-07T15:36:35Z")

</div>

Hi, I'm running at 5.6.3 and have two coordinator nodes running 5.5GB HEAP in 8GB of RAM. I've started to see them being oom-killed when elasticsearch is the only service running on these VMs. Do coordinator nodes have…

---

## [How to change Count Y-axis to Ip address in Line Visualization](https://discuss.elastic.co/t/how-to-change-count-y-axis-to-ip-address-in-line-visualization/100837)

<div class="topic-metadata">

**Author:** [@baharudin\_yusuf](https://discuss.elastic.co/u/baharudin_yusuf)\
**Replies:** 1\
**Last updated:** [September 18, 2017, 7:18pm UTC](https://discuss.elastic.co/t/how-to-change-count-y-axis-to-ip-address-in-line-visualization/100837 "2017-09-18T19:18:27Z")

</div>

how to change Y-Axis to Ip address without count? as can be seen in the picture, on Y-Axis there is ip address and count. can i remove the count and just show the ip address data only! \[Screenshot from 2017-09-18 15-28-…

---

## [2.3.3 ESIntegTestCase](https://discuss.elastic.co/t/2-3-3-esintegtestcase/51604)

<div class="topic-metadata">

**Author:** [@ESDev17](https://discuss.elastic.co/u/ESDev17)\
**Replies:** 1\
**Last updated:** [June 1, 2016, 8:46pm UTC](https://discuss.elastic.co/t/2-3-3-esintegtestcase/51604 "2016-06-01T20:46:10Z")

</div>

I am currently trying to implement integration tests in Java for some sample data I have come up with to test a feature I just finished. Everything is going well and I am able to start a node, create the mapping, seed th…

---

## [Dockerizing TopBeat and get host Metrics](https://discuss.elastic.co/t/dockerizing-topbeat-and-get-host-metrics/45489)

<div class="topic-metadata">

**Author:** [@shanmuga\_karna](https://discuss.elastic.co/u/shanmuga_karna)\
**Replies:** 1\
**Last updated:** [March 25, 2016, 11:24pm UTC](https://discuss.elastic.co/t/dockerizing-topbeat-and-get-host-metrics/45489 "2016-03-25T23:24:12Z")

</div>

Hi All, I'm trying to dockerize all the beats, to make deployments ease, and still get Host specific data and not docker specific. FileBeat --\> I can mount files from the host machine PacketBeat --\> By running on th…

---

## [FSCrawler failure handling](https://discuss.elastic.co/t/fscrawler-failure-handling/284615)

<div class="topic-metadata">

**Author:** [@Francois\_Saab](https://discuss.elastic.co/u/Francois_Saab)\
**Replies:** 8\
**Last updated:** [September 20, 2021, 6:16pm UTC](https://discuss.elastic.co/t/fscrawler-failure-handling/284615 "2021-09-20T18:16:15Z")

</div>

Hello, We are considering the question: how FSCrawler manages failure? What happened if FSCrawler failed to upload a certain file because of a failure on the ElasticSearch side? Does FSCrawler implements an automatic f…

---

## [IndexData is returning an error 'The remote server returned an error: (404) Not Found'](https://discuss.elastic.co/t/indexdata-is-returning-an-error-the-remote-server-returned-an-error-404-not-found/86201)

<div class="topic-metadata">

**Author:** [@ajoealex](https://discuss.elastic.co/u/ajoealex)\
**Replies:** 0\
**Last updated:** [May 18, 2017, 6:25am UTC](https://discuss.elastic.co/t/indexdata-is-returning-an-error-the-remote-server-returned-an-error-404-not-found/86201 "2017-05-18T06:25:00Z")

</div>

I am using Elasticsearch5.4 and Nest5.4 for creating Index. Its showing an error while executing IndexData public bool IndexData\<T\>(T data, string indexName = null, string mappingType = null) where T : class, new…

[Previous page](https://discuss.elastic.co/top.md?page=1664&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1666&per_page=50&period=all)
