# Top **URL:** https://discuss.elastic.co/top.md?page=1667&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1668 --- ## [Alternative for sql join in elastic stack?](https://discuss.elastic.co/t/alternative-for-sql-join-in-elastic-stack/106211)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 1\ **Last updated:** [November 2, 2017, 3:59pm UTC](https://discuss.elastic.co/t/alternative-for-sql-join-in-elastic-stack/106211 "2017-11-02T15:59:45Z")
Hi, I need to trace and aggregate requests of user sessions. following fields I get on a login request: - timestamp - session id - function (login) - username - client version number Following fields I get on a get-d… --- ## [Anyone using execbeat?](https://discuss.elastic.co/t/anyone-using-execbeat/43071)
**Author:** [@allenmchan](https://discuss.elastic.co/u/allenmchan)\ **Replies:** 1\ **Last updated:** [March 1, 2016, 6:07am UTC](https://discuss.elastic.co/t/anyone-using-execbeat/43071 "2016-03-01T06:07:44Z")
Been testing execbeat but cannot get it to behave. It is running \[achan@lmc001.scl execbeat\]$ ps -ef | grep -i execbeat root 29786 15760 0 21:03 pts/0 00:00:00 sudo ./execbeat -c /etc/execbeat/execbeat.yml ro… --- ## [Updating repo.path dynamically?](https://discuss.elastic.co/t/updating-repo-path-dynamically/32043)
**Author:** [@paulkeogh](https://discuss.elastic.co/u/paulkeogh)\ **Replies:** 1\ **Last updated:** [October 12, 2015, 9:52pm UTC](https://discuss.elastic.co/t/updating-repo-path-dynamically/32043 "2015-10-12T21:52:39Z")
I am trying to update this setting dynamically using the JEST library and a request like; String source = "{\\n" + " \\"transient\\" : {\\n" + " \\"path.repo\\" : \[\\" C:\\\\temp \\" \]\\n" + … --- ## [Wildcard search on nested object in ElasticSearch](https://discuss.elastic.co/t/wildcard-search-on-nested-object-in-elasticsearch/19895)
**Author:** [@abraham\_polishchuk](https://discuss.elastic.co/u/abraham_polishchuk)\ **Replies:** 1\ **Last updated:** [September 21, 2014, 9:49am UTC](https://discuss.elastic.co/t/wildcard-search-on-nested-object-in-elasticsearch/19895 "2014-09-21T09:49:23Z")
Let's say we are storing objects of type vehicle which have a reference to a type owner in the following structure. Then Running the following request: \`POST: localhost:9200/15/vehicles/\_search' with the followin… --- ## [Search performance issues, non-cacheable cases](https://discuss.elastic.co/t/search-performance-issues-non-cacheable-cases/10281)
**Author:** [@Stefan\_Rietberger](https://discuss.elastic.co/u/Stefan_Rietberger)\ **Replies:** 7\ **Last updated:** [January 17, 2013, 2:14pm UTC](https://discuss.elastic.co/t/search-performance-issues-non-cacheable-cases/10281 "2013-01-17T14:14:41Z")
Hi all, We are experiencing unusually long response times (~500ms) for just one-term queries on our current setup (details below). In our use case, query caching is rarely ever going to help, as we generate query … --- ## [Index\_not\_found\_exception Root causes: index\_not\_found\_exception: no such index \[apm-\*\]](https://discuss.elastic.co/t/index-not-found-exception-root-causes-index-not-found-exception-no-such-index-apm/335463)
**Author:** [@zx8086](https://discuss.elastic.co/u/zx8086)\ **Replies:** 6\ **Last updated:** [June 8, 2023, 3:25pm UTC](https://discuss.elastic.co/t/index-not-found-exception-root-causes-index-not-found-exception-no-such-index-apm/335463 "2023-06-08T15:25:44Z")
I get this error in Kibana and cannot trace the root or find a simple resolution. Checked all the views.... thinking of just creating it, but would like to know where it is trying to be called. Using traces-apm-default f… --- ## [Configure es with logstash](https://discuss.elastic.co/t/configure-es-with-logstash/334604)
**Author:** [@sujata\_g](https://discuss.elastic.co/u/sujata_g)\ **Replies:** 6\ **Last updated:** [June 4, 2023, 10:25am UTC](https://discuss.elastic.co/t/configure-es-with-logstash/334604 "2023-06-04T10:25:52Z")
input { s3 { access\_key\_id =\> "" secret\_access\_key =\> "" bucket =\> "dumpsampleperigon" region =\> "us-west-1" } } output { elasticsearch { hosts =\> \["http://elasticsearch:9200"\] index =\> "logs-%{+YYYY.MM.dd}" … --- ## [Unable to create Kibana index](https://discuss.elastic.co/t/unable-to-create-kibana-index/195465)
**Author:** [@DG13](https://discuss.elastic.co/u/DG13)\ **Replies:** 6\ **Last updated:** [August 21, 2019, 3:36am UTC](https://discuss.elastic.co/t/unable-to-create-kibana-index/195465 "2019-08-21T03:36:50Z")
Hi , I have ELK stack installed and imported the indexes , all these indexes are visible in Kibana under Saved object however I am unable to create new index . More details about ELK stack Elastic search - 7.1.0 Kiba… --- ## [Logstash error plugin-email](https://discuss.elastic.co/t/logstash-error-plugin-email/98815)
**Author:** [@yoyo](https://discuss.elastic.co/u/yoyo)\ **Replies:** 6\ **Last updated:** [August 31, 2017, 6:21am UTC](https://discuss.elastic.co/t/logstash-error-plugin-email/98815 "2017-08-31T06:21:17Z")
After running logstash to send emails , one of the messages has been blocked. So the logstash shows me this error \[2017-08-30T09:29:35,862\]\[ERROR\]\[logstash.shutdownwatcher \] The shutdown process appears to be stalled du… --- ## [What are the actual benefits of Elastic Agent?](https://discuss.elastic.co/t/what-are-the-actual-benefits-of-elastic-agent/360675)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 4\ **Last updated:** [June 10, 2024, 9:49pm UTC](https://discuss.elastic.co/t/what-are-the-actual-benefits-of-elastic-agent/360675 "2024-06-10T21:49:23Z")
I started writing this as a reply on this issue: Offer a lightweight Elastic Agent · Issue #3364 · elastic/elastic-agent · GitHub, but then it morphed into it's own thing and I decided it would be better off here. I rea… --- ## [Multiple Pipelines with condition](https://discuss.elastic.co/t/multiple-pipelines-with-condition/346405)
**Author:** [@Manasa4](https://discuss.elastic.co/u/Manasa4)\ **Replies:** 4\ **Last updated:** [November 6, 2023, 3:44pm UTC](https://discuss.elastic.co/t/multiple-pipelines-with-condition/346405 "2023-11-06T15:44:20Z")
Hi Team, I have been trying to add a condition on my multi processor pipeline. { "4modelprocessor\_peopleagg": { "processors": \[ { "pipeline": { "name": "ner\_pipeline\_peopleagg" } }, { "pipeline": { "name": "e… --- ## [OpenmapTiles in Vega During Offline Mode](https://discuss.elastic.co/t/openmaptiles-in-vega-during-offline-mode/260477)
**Author:** [@gerardo\_dutan](https://discuss.elastic.co/u/gerardo_dutan)\ **Replies:** 4\ **Last updated:** [January 11, 2021, 2:58pm UTC](https://discuss.elastic.co/t/openmaptiles-in-vega-during-offline-mode/260477 "2021-01-11T14:58:34Z")
Hello, I'm currently deploying the stack in an offline environment and am having issues with generating a map based visualization in vega. I'm using the standard config reference in the vega script to pull up a map, work… --- ## [Backup & restore Logs configuration](https://discuss.elastic.co/t/backup-restore-logs-configuration/248586)
**Author:** [@Lolo\_Bee](https://discuss.elastic.co/u/Lolo_Bee)\ **Replies:** 4\ **Last updated:** [September 23, 2020, 6:29am UTC](https://discuss.elastic.co/t/backup-restore-logs-configuration/248586 "2020-09-23T06:29:04Z")
Hi, I'm trying to backup & restore Log Streams configuration i.e. indexes and fields used to represent Log Streams in kibana, but I'm unable to find a way to do that. Is it possible by using an API endpoint? Kind regar… --- ## [Search across multiple indices](https://discuss.elastic.co/t/search-across-multiple-indices/199317)
**Author:** [@Junfeng](https://discuss.elastic.co/u/Junfeng)\ **Replies:** 4\ **Last updated:** [September 13, 2019, 2:59am UTC](https://discuss.elastic.co/t/search-across-multiple-indices/199317 "2019-09-13T02:59:33Z")
Hello, I am trying to search multiple indices, each with its own query. Is it possible for 2.x? I get the idea from here. Basically my composite query looks like this: POST /index1, index2/\_search { "query": { … --- ## [Lines joining in line graph - canvas](https://discuss.elastic.co/t/lines-joining-in-line-graph-canvas/194241)
**Author:** [@samgs](https://discuss.elastic.co/u/samgs)\ **Replies:** 4\ **Last updated:** [August 16, 2019, 10:23am UTC](https://discuss.elastic.co/t/lines-joining-in-line-graph-canvas/194241 "2019-08-16T10:23:13Z")
Hello, I seem to be getting some strange behaviour in canvas line graphs. When I do an elastic SQL for 30 days my chart looks like this: My sql looks like this: SELECT \* FROM index WHERE QUERY('name:Splinter') AND … --- ## [Processor not working in filebeat](https://discuss.elastic.co/t/processor-not-working-in-filebeat/178929)
**Author:** [@aarthinim](https://discuss.elastic.co/u/aarthinim)\ **Replies:** 4\ **Last updated:** [May 2, 2019, 5:21am UTC](https://discuss.elastic.co/t/processor-not-working-in-filebeat/178929 "2019-05-02T05:21:53Z")
HI, Need to get the ERROR message only from the log file using processors. --- ## [403 Error occur When Rally download track data](https://discuss.elastic.co/t/403-error-occur-when-rally-download-track-data/132026)
**Author:** [@8a98bb2968a03fe24acf](https://discuss.elastic.co/u/8a98bb2968a03fe24acf)\ **Replies:** 4\ **Last updated:** [May 16, 2018, 10:02am UTC](https://discuss.elastic.co/t/403-error-occur-when-rally-download-track-data/132026 "2018-05-16T10:02:43Z")
Hello. Here is an error I got. \[ERROR\] Cannot race. Error in track preparator Could not download \[http://benchmarks.elasticsearch.org.s3.amazonaws.com/corpora/geonames/documents-2.json.bz2\] to \[$MY\_PATH/.rally/… --- ## [After installed, es, kibana and configured with nginx](https://discuss.elastic.co/t/after-installed-es-kibana-and-configured-with-nginx/109131)
**Author:** [@muthhus](https://discuss.elastic.co/u/muthhus)\ **Replies:** 4\ **Last updated:** [November 26, 2017, 11:55am UTC](https://discuss.elastic.co/t/after-installed-es-kibana-and-configured-with-nginx/109131 "2017-11-26T11:55:53Z")
Hi All, Would you please assist me to solve my issue. i am getting empty/blank page for any menu item.(Devtools, dashboard etc). Thanks\[27\] --- ## [Superscript text in data](https://discuss.elastic.co/t/superscript-text-in-data/104303)
**Author:** [@Pratiksha\_Tewary](https://discuss.elastic.co/u/Pratiksha_Tewary)\ **Replies:** 4\ **Last updated:** [October 18, 2017, 4:31pm UTC](https://discuss.elastic.co/t/superscript-text-in-data/104303 "2017-10-18T16:31:19Z")
Hi, I was trying to parse data to Elasticsearch using Logstash and got the following error message: Received an event that has a different character encoding than you configured. {:text=\>"H\\\\tC\\\\tFCE5C9C1-CF1F-4593-9C2… --- ## [Playing with more interesting data, chapter 2](https://discuss.elastic.co/t/playing-with-more-interesting-data-chapter-2/94096)
**Author:** [@alvaro13](https://discuss.elastic.co/u/alvaro13)\ **Replies:** 4\ **Last updated:** [August 8, 2017, 7:49am UTC](https://discuss.elastic.co/t/playing-with-more-interesting-data-chapter-2/94096 "2017-08-08T07:49:45Z")
I am with the second part of the manual: Playing with more interesting data. A Practical Introduction to Elasticsearch Ready to try Elasticsearch and see results? Copy and paste these requests to get started. Let’… --- ## [How to Increase Elasticsearch node configuration without Enterprise Cloud](https://discuss.elastic.co/t/how-to-increase-elasticsearch-node-configuration-without-enterprise-cloud/94890)
**Author:** [@Kranthi\_Dharani](https://discuss.elastic.co/u/Kranthi_Dharani)\ **Replies:** 4\ **Last updated:** [July 28, 2017, 3:55pm UTC](https://discuss.elastic.co/t/how-to-increase-elasticsearch-node-configuration-without-enterprise-cloud/94890 "2017-07-28T15:55:36Z")
Is there a way I can increase elasticsearch nodes using AWS CLI or using the ElasticSearch Rest endpoint by using a Rest Client ?. I can think of only with 2 options using AWS CLI or Rest Endpoint. I have 2 master node… --- ## [Logstash 2.1 : Multiple Instances per Host](https://discuss.elastic.co/t/logstash-2-1-multiple-instances-per-host/35548)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 4\ **Last updated:** [November 25, 2015, 2:03pm UTC](https://discuss.elastic.co/t/logstash-2-1-multiple-instances-per-host/35548 "2015-11-25T14:03:52Z")
Hi, I am trying to set up multiple logstash instances running on one host. I'm doing this by modifying the $name variable in the init script and modifying logfile output names and path to config etc. This works fine exce… --- ## [Question regarding to the \_score and \_explanation.value](https://discuss.elastic.co/t/question-regarding-to-the--score-and--explanation-value/13695)
**Author:** [@Evan\_2](https://discuss.elastic.co/u/Evan_2)\ **Replies:** 4\ **Last updated:** [October 29, 2013, 2:36pm UTC](https://discuss.elastic.co/t/question-regarding-to-the--score-and--explanation-value/13695 "2013-10-29T14:36:15Z")
I am doing some queries with explain: true but notice that sometimes the \_score is not the same as the \_explanation.value. Should the \_score for each match the same as the \_explanation.value? Or the \_score involves … --- ## [Combinig queries dilemma](https://discuss.elastic.co/t/combinig-queries-dilemma/12646)
**Author:** [@designermonkey](https://discuss.elastic.co/u/designermonkey)\ **Replies:** 0\ **Last updated:** [July 3, 2013, 3:07pm UTC](https://discuss.elastic.co/t/combinig-queries-dilemma/12646 "2013-07-03T15:07:38Z")
I am quite new to ES and have used some example code provided by someone else to get me to where I am at the moment. I'm using the Elastica PHP wrapper to produce the queries, just FYI although it has no bearing on … --- ## [Logstash output Elasticsearch - mapper\_parsing\_exception](https://discuss.elastic.co/t/logstash-output-elasticsearch-mapper-parsing-exception/226256)
**Author:** [@abrejuin](https://discuss.elastic.co/u/abrejuin)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 9:41am UTC](https://discuss.elastic.co/t/logstash-output-elasticsearch-mapper-parsing-exception/226256 "2020-04-03T09:41:04Z")
Hello, I upgraded Elastic from 5.3 to 6.0, I also upgraded Logstash from 5.6 to 6.8. Since then I have error messages on Logstash while trying to send logs to Elastic : \[WARN \] 2020-04-02 15:01:03.754 \[\[main\]\>worker0\]… --- ## [Elastic apm : can't find service name mentioned in elastic apm agent on kibana ui or in elastic index](https://discuss.elastic.co/t/elastic-apm-cant-find-service-name-mentioned-in-elastic-apm-agent-on-kibana-ui-or-in-elastic-index/215440)
**Author:** [@Sandeep\_Kumar4](https://discuss.elastic.co/u/Sandeep_Kumar4)\ **Replies:** 1\ **Last updated:** [January 17, 2020, 12:20pm UTC](https://discuss.elastic.co/t/elastic-apm-cant-find-service-name-mentioned-in-elastic-apm-agent-on-kibana-ui-or-in-elastic-index/215440 "2020-01-17T12:20:01Z")
If you are asking about a problem you are experiencing, please use the following template, as it will help us help you. If you have a different problem, please delete all of this text :slight\_smile: Kibana version: 7.5.… --- ## [Filebeat failed to connect to logstash](https://discuss.elastic.co/t/filebeat-failed-to-connect-to-logstash/145842)
**Author:** [@lcui\_dxc](https://discuss.elastic.co/u/lcui_dxc)\ **Replies:** 1\ **Last updated:** [August 24, 2018, 5:45pm UTC](https://discuss.elastic.co/t/filebeat-failed-to-connect-to-logstash/145842 "2018-08-24T17:45:07Z")
Hello there, I 'm setting up filebeat to send logs to logstash, on filebeat, filebeat can not tcp to the logstash on port 5044... the conection reset by peer. Here is the filebeat log: 2018-08-24T05:52:44.501Z … --- ## [Logstash keeps crashing using the JDBC Plugin](https://discuss.elastic.co/t/logstash-keeps-crashing-using-the-jdbc-plugin/106146)
**Author:** [@bilpor](https://discuss.elastic.co/u/bilpor)\ **Replies:** 1\ **Last updated:** [November 2, 2017, 3:56pm UTC](https://discuss.elastic.co/t/logstash-keeps-crashing-using-the-jdbc-plugin/106146 "2017-11-02T15:56:21Z")
Hi All, I have created the following index: put newsindex { "settings" : { "number\_of\_shards":3, "number\_of\_replicas":2 }, "mappings" : { "news": { "properties": { "data": { "t… --- ## [Delete Index automaticly with curator](https://discuss.elastic.co/t/delete-index-automaticly-with-curator/92597)
**Author:** [@Sam67000](https://discuss.elastic.co/u/Sam67000)\ **Replies:** 1\ **Last updated:** [July 11, 2017, 5:28pm UTC](https://discuss.elastic.co/t/delete-index-automaticly-with-curator/92597 "2017-07-11T17:28:34Z")
Hello EveryOne, My curator action file is as follows : actions: 1: action: delete\_indices description: \>-Delete indices options: continue\_if\_exception: False filters: - filtertype: spac… --- ## [Hive - Is it possible to use external table on top of ES index for arbitrary FTS](https://discuss.elastic.co/t/hive-is-it-possible-to-use-external-table-on-top-of-es-index-for-arbitrary-fts/51367)
**Author:** [@igorkv](https://discuss.elastic.co/u/igorkv)\ **Replies:** 1\ **Last updated:** [June 1, 2016, 11:55am UTC](https://discuss.elastic.co/t/hive-is-it-possible-to-use-external-table-on-top-of-es-index-for-arbitrary-fts/51367 "2016-06-01T11:55:47Z")
I know that external table can be defined like this CREATE EXTERNAL TABLE artists ( id BIGINT, name STRING, links STRUCT) STORED BY 'org.elasticsearch.hadoop.hive.EsStorageHandler' TBLPROPERTIES('… --- ## [Taille index avec / sans mapping des champs](https://discuss.elastic.co/t/taille-index-avec-sans-mapping-des-champs/36442)
**Author:** [@sebondus](https://discuss.elastic.co/u/sebondus)\ **Replies:** 1\ **Last updated:** [December 6, 2015, 10:00pm UTC](https://discuss.elastic.co/t/taille-index-avec-sans-mapping-des-champs/36442 "2015-12-06T22:00:01Z")
Bonjour, Je viens vers vous à cause d'un soucis de taille d'index. Je suis un peu nouveau sur cette techno et ai mis en place un monitoring de log via Logstash / Elasticsearch / Kibana Voyant que tous mes champs étaien… --- ## [Kibana .NET?](https://discuss.elastic.co/t/kibana-net/28224)
**Author:** [@dceder906](https://discuss.elastic.co/u/dceder906)\ **Replies:** 1\ **Last updated:** [August 29, 2015, 10:37pm UTC](https://discuss.elastic.co/t/kibana-net/28224 "2015-08-29T22:37:32Z")
Is there a NEST-like .NET API for Kibana, as there is for ElasticSearch? --- ## [Jaeger dropping spans with Elasticsearch backend in Kubernetes](https://discuss.elastic.co/t/jaeger-dropping-spans-with-elasticsearch-backend-in-kubernetes/294756)
**Author:** [@kashokan](https://discuss.elastic.co/u/kashokan)\ **Replies:** 2\ **Last updated:** [January 21, 2022, 10:07pm UTC](https://discuss.elastic.co/t/jaeger-dropping-spans-with-elasticsearch-backend-in-kubernetes/294756 "2022-01-21T22:07:33Z")
Hello, I have installed Jaeger with an Elasticsearch storage backend in Kubernetes (AWS EKS). I have 8 r5.4xlarge nodes and Elasticsearch version 7.16.2 (docker.elastic.co/elasticsearch/elasticsearch:7.16.2). The deploy… --- ## [Data Integration between Hadoop - Hive and Elastic Search](https://discuss.elastic.co/t/data-integration-between-hadoop-hive-and-elastic-search/294037)
**Author:** [@Kishanu\_Bhattacharya](https://discuss.elastic.co/u/Kishanu_Bhattacharya)\ **Replies:** 2\ **Last updated:** [January 13, 2022, 4:41am UTC](https://discuss.elastic.co/t/data-integration-between-hadoop-hive-and-elastic-search/294037 "2022-01-13T04:41:56Z")
There are a few questions about a use case in which I am presently working, This is related to establishing a data pipeline(Data Integration) from Hadoop to Elasticsearch. I did a few quick POCs by creating the indices … --- ## [Cannot reindex due to bad id field(s)](https://discuss.elastic.co/t/cannot-reindex-due-to-bad-id-field-s/280601)
**Author:** [@tasslehawf](https://discuss.elastic.co/u/tasslehawf)\ **Replies:** 2\ **Last updated:** [August 20, 2021, 6:45pm UTC](https://discuss.elastic.co/t/cannot-reindex-due-to-bad-id-field-s/280601 "2021-08-20T18:45:06Z")
I ran into an issue where we are trying to reindex in order to gain a copy\_to search field. "type": "action\_request\_validation\_exception", "reason": "Validation Failed: 1: id is too long, must be no longer than 512 … --- ## [Create Elastic index from Python script](https://discuss.elastic.co/t/create-elastic-index-from-python-script/255354)
**Author:** [@Jose\_Angel\_Morena\_Si](https://discuss.elastic.co/u/Jose_Angel_Morena_Si)\ **Replies:** 2\ **Last updated:** [November 16, 2020, 9:50am UTC](https://discuss.elastic.co/t/create-elastic-index-from-python-script/255354 "2020-11-16T09:50:41Z")
Hello, I am trying to create an index in ES 7.9.1 with python 3. In order to do so I am using elasticsearch python package. Script: doc\_id=hex(random.getrandbits(128))\[2:\] doc = { 'response\_time': … --- ## [How to increase a date by e.g. 1 day using Painless script?](https://discuss.elastic.co/t/how-to-increase-a-date-by-e-g-1-day-using-painless-script/216873)
**Author:** [@JohanP](https://discuss.elastic.co/u/JohanP)\ **Replies:** 2\ **Last updated:** [February 2, 2020, 7:24pm UTC](https://discuss.elastic.co/t/how-to-increase-a-date-by-e-g-1-day-using-painless-script/216873 "2020-02-02T19:24:34Z")
Just starting to use Painless as excercise before certification. Am wondering how to attack the problem of updating/increasing a date field by using a Painless script? I know how to for example increase a simple counte… --- ## [Can i search data on hadoop using elasticsearch?](https://discuss.elastic.co/t/can-i-search-data-on-hadoop-using-elasticsearch/197780)
**Author:** [@Vinit\_Pillai](https://discuss.elastic.co/u/Vinit_Pillai)\ **Replies:** 2\ **Last updated:** [September 3, 2019, 9:29am UTC](https://discuss.elastic.co/t/can-i-search-data-on-hadoop-using-elasticsearch/197780 "2019-09-03T09:29:54Z")
I am a noob in the es-Hadoop category. I have tried to read all the documents but am still confused regarding how es-hadoop works and do I need it. The question is simple. Can I search for data on Hadoop using elastics… --- ## [Filtering IPs with Grok](https://discuss.elastic.co/t/filtering-ips-with-grok/134296)
**Author:** [@nin77](https://discuss.elastic.co/u/nin77)\ **Replies:** 2\ **Last updated:** [June 3, 2018, 10:13pm UTC](https://discuss.elastic.co/t/filtering-ips-with-grok/134296 "2018-06-03T22:13:26Z")
Hello, I want to filter apache access logs before giving them to elastic search. I want to filter specific IPs and remove the lines where the IPs dont occur. But at the moment I am struggeling with the grok filter. I a… --- ## [EC2 discovery not working with Elasticsearch v6](https://discuss.elastic.co/t/ec2-discovery-not-working-with-elasticsearch-v6/119930)
**Author:** [@vikaslalwani](https://discuss.elastic.co/u/vikaslalwani)\ **Replies:** 2\ **Last updated:** [February 15, 2018, 8:07am UTC](https://discuss.elastic.co/t/ec2-discovery-not-working-with-elasticsearch-v6/119930 "2018-02-15T08:07:27Z")
This is my ES config for discovery. Not sure what I am doing wrong here. Tried uncommenting the aws region but that did not work as well. Any help would be appreciated. Thanks discovery.zen.hosts\_provider: ec2 discovery… --- ## [Delete: xpack.security.audit.index](https://discuss.elastic.co/t/delete-xpack-security-audit-index/103772)
**Author:** [@eramitsinha](https://discuss.elastic.co/u/eramitsinha)\ **Replies:** 2\ **Last updated:** [October 13, 2017, 5:09pm UTC](https://discuss.elastic.co/t/delete-xpack-security-audit-index/103772 "2017-10-13T17:09:50Z")
Hi, I am using Elastic Search 5.2.2, Kibana 5.2.2 and X-Pack 5.2.2 I have enabled auditing on my cluster, so this is working fine as I could see ".security\_audit\_log" index are getting generated. But would like … --- ## [How can I split fields](https://discuss.elastic.co/t/how-can-i-split-fields/98682)
**Author:** [@mikygee](https://discuss.elastic.co/u/mikygee)\ **Replies:** 2\ **Last updated:** [August 29, 2017, 3:52pm UTC](https://discuss.elastic.co/t/how-can-i-split-fields/98682 "2017-08-29T15:52:14Z")
Hello, I have a field that looks like that lists: list1 list2 The number of lists is not defined, here it’s 2 but it can be 3 or 4 I’d like to create new fields with new values lists1 =\> list1 lists2 =\> list2 Do y… --- ## [Restart cluster not working. ID "644057"](https://discuss.elastic.co/t/restart-cluster-not-working-id-644057/90914)
**Author:** [@shoya](https://discuss.elastic.co/u/shoya)\ **Replies:** 2\ **Last updated:** [June 27, 2017, 5:44am UTC](https://discuss.elastic.co/t/restart-cluster-not-working-id-644057/90914 "2017-06-27T05:44:21Z")
I'm waiting over an hour. What shall I do? --- ## [Logstash/Grok not processing part of a custom filter](https://discuss.elastic.co/t/logstash-grok-not-processing-part-of-a-custom-filter/66559)
**Author:** [@brian.jones](https://discuss.elastic.co/u/brian.jones)\ **Replies:** 2\ **Last updated:** [November 27, 2016, 8:01pm UTC](https://discuss.elastic.co/t/logstash-grok-not-processing-part-of-a-custom-filter/66559 "2016-11-27T20:01:32Z")
Not sure if I am missing something, or just going about this all wrong, but some of the syslog events from our ASA just don't seem to filter/parse correctly. Relevant syslog events: "message":"\<150\>Nov 18 2016 15:50:2… --- ## [Filebeat - send a full config file every time is modified?](https://discuss.elastic.co/t/filebeat-send-a-full-config-file-every-time-is-modified/61318)
**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Replies:** 2\ **Last updated:** [September 23, 2016, 6:54am UTC](https://discuss.elastic.co/t/filebeat-send-a-full-config-file-every-time-is-modified/61318 "2016-09-23T06:54:08Z")
How can i configure filebeat prospector to send the full content of a config file every time is modified? Per example i want to send the full /etc/httpd/conf/httpd.conf file as a document everytime it is modified, not… --- ## [Folders for Dashboards](https://discuss.elastic.co/t/folders-for-dashboards/48099)
**Author:** [@Vivek\_Raj](https://discuss.elastic.co/u/Vivek_Raj)\ **Replies:** 2\ **Last updated:** [April 22, 2016, 2:36pm UTC](https://discuss.elastic.co/t/folders-for-dashboards/48099 "2016-04-22T14:36:31Z")
Would it be possible to have folders for dashboards? We have bunch of dashboards with different category can we Organize them in folders. so that it will be very easy to view. Thanks in ADVANCE --- ## [Load balancing the query nodes](https://discuss.elastic.co/t/load-balancing-the-query-nodes/44373)
**Author:** [@stecino](https://discuss.elastic.co/u/stecino)\ **Replies:** 2\ **Last updated:** [March 15, 2016, 6:26pm UTC](https://discuss.elastic.co/t/load-balancing-the-query-nodes/44373 "2016-03-15T18:26:04Z")
Hello, I have two query nodes and I want to put them behind F5 load balancer. Theoretically it should work, but I wanted to make sure nothing local to each server happens that make two nodes out of sync from each other… --- ## [Object mapping and "index" : "no" in ES 2.0](https://discuss.elastic.co/t/object-mapping-and-index-no-in-es-2-0/34345)
**Author:** [@cching](https://discuss.elastic.co/u/cching)\ **Replies:** 2\ **Last updated:** [November 11, 2015, 8:38pm UTC](https://discuss.elastic.co/t/object-mapping-and-index-no-in-es-2-0/34345 "2015-11-11T20:38:34Z")
ES 2.0, I'm working with a mapping that contains: "collectors" : { "type" : "object", "index" : "no" }, and I'm getting the following error: Mapping definition for \[collectors\] has unsupported parameters: \[… --- ## [Question on routing](https://discuss.elastic.co/t/question-on-routing/9651)
**Author:** [@Jae](https://discuss.elastic.co/u/Jae)\ **Replies:** 2\ **Last updated:** [November 9, 2012, 9:12pm UTC](https://discuss.elastic.co/t/question-on-routing/9651 "2012-11-09T21:12:09Z")
Now I am using elasticsearch as a realtime log analysis. Unfortunately, I am having performance issue. To resolve this issue, I'd like to try custom routing with timestamp because our realtime log analysis will be fo… --- ## [Threshold detection rule - limitation of group by fields](https://discuss.elastic.co/t/threshold-detection-rule-limitation-of-group-by-fields/338383)
**Author:** [@Poukim0m](https://discuss.elastic.co/u/Poukim0m)\ **Replies:** 3\ **Last updated:** [August 22, 2023, 1:51pm UTC](https://discuss.elastic.co/t/threshold-detection-rule-limitation-of-group-by-fields/338383 "2023-08-22T13:51:54Z")
Hello, I want to implement a threshold detection rule that aggregates more than 3 fields in the "Group by" section of rule definition. But there seems to be a limitation of 3 fields as i get an error message "Number of … [Previous page](https://discuss.elastic.co/top.md?page=1666&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1668&per_page=50&period=all)