# Top **URL:** https://discuss.elastic.co/top.md?page=1669&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1670 --- ## [Query with two aggregations](https://discuss.elastic.co/t/query-with-two-aggregations/128144)
**Author:** [@KibanaUse](https://discuss.elastic.co/u/KibanaUse)\ **Replies:** 6\ **Last updated:** [April 16, 2018, 12:26pm UTC](https://discuss.elastic.co/t/query-with-two-aggregations/128144 "2018-04-16T12:26:33Z")
Hello, I am tying to write a query to first get the last state value per customer, and then counting those up. So I have logs of customers with states. Each time a state of a customer changes, I write this to a log fil… --- ## [Changing simple type mapping](https://discuss.elastic.co/t/changing-simple-type-mapping/17698)
**Author:** [@Brian\_Lamb](https://discuss.elastic.co/u/Brian_Lamb)\ **Replies:** 6\ **Last updated:** [May 23, 2014, 9:34pm UTC](https://discuss.elastic.co/t/changing-simple-type-mapping/17698 "2014-05-23T21:34:13Z")
Hi all, I need to change the mapping on one of my fields. It is currently an integer and I need it to be a string. Ideally, I would be able to just change the type. But the documentation says that I cannot do t… --- ## [Creating processor \[set\_security\_user\] (tag \[null\]) on field \[\_security\] but authentication is not currently enabled](https://discuss.elastic.co/t/creating-processor-set-security-user-tag-null-on-field-security-but-authentication-is-not-currently-enabled/304020)
**Author:** [@elephant](https://discuss.elastic.co/u/elephant)\ **Replies:** 2\ **Last updated:** [May 5, 2022, 2:31pm UTC](https://discuss.elastic.co/t/creating-processor-set-security-user-tag-null-on-field-security-but-authentication-is-not-currently-enabled/304020 "2022-05-05T14:31:54Z")
Hi, I get this WARN in loop in our elastic logs. How can I disable them? We are inside dockers and don't want/need to enable authentication. {"@timestamp":"2022-05-05T10:24:53.093Z", "log.level": "WARN", "message":"Cre… --- ## [Filebeat Zeek module not reading all events with -once option](https://discuss.elastic.co/t/filebeat-zeek-module-not-reading-all-events-with-once-option/299459)
**Author:** [@dlohin](https://discuss.elastic.co/u/dlohin)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 1:50pm UTC](https://discuss.elastic.co/t/filebeat-zeek-module-not-reading-all-events-with-once-option/299459 "2022-03-11T13:50:15Z")
I am using Filebeat 8.0.1 inside of a container and trying to utilize it to read through a bunch of Zeek logs formatted in JSON and ending the process when finished. Ending nicely with an error code is critical because … --- ## [RUM Not reporting Data on Kibana](https://discuss.elastic.co/t/rum-not-reporting-data-on-kibana/293123)
**Author:** [@gauravraje](https://discuss.elastic.co/u/gauravraje)\ **Replies:** 2\ **Last updated:** [January 4, 2022, 5:03pm UTC](https://discuss.elastic.co/t/rum-not-reporting-data-on-kibana/293123 "2022-01-04T17:03:40Z")
Team, We have added the below options in the apm-server.rum section of the apm-server.yml config file to enable RUM Agent ,but its not reporting data back to the dashboard. apm-server.rum.enabled: true apm-server.auth… --- ## [Watcher - how to set the doc\_values condition for a query with a filter terms aggregation. (Detect lack of logs per hostname - use case)](https://discuss.elastic.co/t/watcher-how-to-set-the-doc-values-condition-for-a-query-with-a-filter-terms-aggregation-detect-lack-of-logs-per-hostname-use-case/286225)
**Author:** [@Manu\_BS](https://discuss.elastic.co/u/Manu_BS)\ **Replies:** 2\ **Last updated:** [October 15, 2021, 3:19pm UTC](https://discuss.elastic.co/t/watcher-how-to-set-the-doc-values-condition-for-a-query-with-a-filter-terms-aggregation-detect-lack-of-logs-per-hostname-use-case/286225 "2021-10-15T15:19:44Z")
Hello friends, I wanted to create a few watchers that help us to detect when we are not receiving specific logs that are crucial for the monitoring chain. It means, to not be receiving logs from specific servers. For … --- ## [【Filebeat】s3のログ情報を取得する方法](https://discuss.elastic.co/t/filebeat-s3/208795)
**Author:** [@harue](https://discuss.elastic.co/u/harue)\ **Replies:** 2\ **Last updated:** [November 21, 2019, 7:08am UTC](https://discuss.elastic.co/t/filebeat-s3/208795 "2019-11-21T07:08:07Z")
お世話になります。 Filebeatのs3 inputについて質問です。 公式ドキュメント s3にログをアップロード後、s3→SQS→Filebeatの疎通を実施しています。 Filebeatのymlにて、ログがアップロードされたs3のバケット名、ファイル名を取得する方法があれば教えてください。 取得理由：バケット名、ファイル名によりindex名を振り分けたいため情報が必要です。 SQSに格納されているメッセージには以下の情… --- ## [Setting the best config in logstash.yml for my Environment](https://discuss.elastic.co/t/setting-the-best-config-in-logstash-yml-for-my-environment/207780)
**Author:** [@Thiago\_Paiva](https://discuss.elastic.co/u/Thiago_Paiva)\ **Replies:** 2\ **Last updated:** [November 15, 2019, 4:33am UTC](https://discuss.elastic.co/t/setting-the-best-config-in-logstash-yml-for-my-environment/207780 "2019-11-15T04:33:15Z")
Hi community. Recently in my environment, I'm feeling that a input data that a pipeline is too slow. Before explain how is mine solution ELK. Following info’s about my machine: OS: Linux version 4.1.12-124.25.1 Red Hat … --- ## [Avro SchemaParseError](https://discuss.elastic.co/t/avro-schemaparseerror/190757)
**Author:** [@DSPN](https://discuss.elastic.co/u/DSPN)\ **Replies:** 2\ **Last updated:** [August 4, 2019, 11:13pm UTC](https://discuss.elastic.co/t/avro-schemaparseerror/190757 "2019-08-04T23:13:57Z")
Hi, I'm using logstash to load logs from Kafka to Elastic. Running logstash on openshift. I'm receiving the below error when trying to read the logs from the kafka topic. Can anyone help me figure what I'm missing here. … --- ## [Split a csv fied into nested array](https://discuss.elastic.co/t/split-a-csv-fied-into-nested-array/143893)
**Author:** [@Orange](https://discuss.elastic.co/u/Orange)\ **Replies:** 2\ **Last updated:** [August 11, 2018, 2:13am UTC](https://discuss.elastic.co/t/split-a-csv-fied-into-nested-array/143893 "2018-08-11T02:13:39Z")
hello,I use logstash to import csv to elasticsearch, my question is that one of the fields contains the string formatted as \[{"level1":aa,"level2":bb},{"level1":aaa,"level2",bbb},...\],The field, is array.and i need to p… --- ## [X-pack-env.bat is missing?](https://discuss.elastic.co/t/x-pack-env-bat-is-missing/98033)
**Author:** [@MartinBr](https://discuss.elastic.co/u/MartinBr)\ **Replies:** 2\ **Last updated:** [August 24, 2017, 6:07am UTC](https://discuss.elastic.co/t/x-pack-env-bat-is-missing/98033 "2017-08-24T06:07:46Z")
Hello, While trying to setup an environment with Elastic 6.0.0 beta1. I am struggling with the new command setup-passwords that on my windows server seems to be missing a x-pack-env.bat file… Am I doing something wron… --- ## [Elastic Cloud Enterprise beta 2 released](https://discuss.elastic.co/t/elastic-cloud-enterprise-beta-2-released/82197)
**Author:** [@uricohen](https://discuss.elastic.co/u/uricohen)\ **Replies:** 2\ **Last updated:** [April 13, 2017, 8:30pm UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-beta-2-released/82197 "2017-04-13T20:30:20Z")
Hi all We're happy to announce the release of Elastic Cloud Enterprise beta2. It includes a few important changes on top of beta1: Improvements to how ECE collects and monitors data for your installation using File… --- ## [Logstash mutate and translate the same field](https://discuss.elastic.co/t/logstash-mutate-and-translate-the-same-field/77489)
**Author:** [@Diyal](https://discuss.elastic.co/u/Diyal)\ **Replies:** 2\ **Last updated:** [March 6, 2017, 4:03pm UTC](https://discuss.elastic.co/t/logstash-mutate-and-translate-the-same-field/77489 "2017-03-06T16:03:07Z")
Hello, I would like to make services translation like this: 21/tcp =\> ftp 80/tcp =\> http But the translation doesn't work. So, my services.yaml file is like this : "1/tcp": "tcpmux" "1/udp": "tcpmux" "5… --- ## [Target daily index in index\_payload action](https://discuss.elastic.co/t/target-daily-index-in-index-payload-action/68046)
**Author:** [@Chris\_Blackwell](https://discuss.elastic.co/u/Chris_Blackwell)\ **Replies:** 2\ **Last updated:** [December 5, 2016, 2:57pm UTC](https://discuss.elastic.co/t/target-daily-index-in-index-payload-action/68046 "2016-12-05T14:57:14Z")
Is there a way to target a daily index from Watcher's index\_payload action something like this "actions" : { "index\_payload" : { "transform": { ... }, "index" : { "index" : "my-index-{{year}}.{{mon… --- ## [Scaling up elastic search using virtual CPUs (vCPUs)](https://discuss.elastic.co/t/scaling-up-elastic-search-using-virtual-cpus-vcpus/54253)
**Author:** [@pulkits123](https://discuss.elastic.co/u/pulkits123)\ **Replies:** 2\ **Last updated:** [June 29, 2016, 11:47am UTC](https://discuss.elastic.co/t/scaling-up-elastic-search-using-virtual-cpus-vcpus/54253 "2016-06-29T11:47:38Z")
I am trying to index logdata using elastic search. I have been using a windows machine of 8gb ram. But now I want to scale it up and reduce the response time which comes in 10-20secs. So, I now want to run my elastic se… --- ## [Implementing ElasticSearch , Logstash , and Kibana ( ELK Stack) on Ubuntu 15.10](https://discuss.elastic.co/t/implementing-elasticsearch-logstash-and-kibana-elk-stack-on-ubuntu-15-10/44942)
**Author:** [@Joao\_Miguel](https://discuss.elastic.co/u/Joao_Miguel)\ **Replies:** 2\ **Last updated:** [March 21, 2016, 2:50pm UTC](https://discuss.elastic.co/t/implementing-elasticsearch-logstash-and-kibana-elk-stack-on-ubuntu-15-10/44942 "2016-03-21T14:50:11Z")
Hello I am implementing ElasticSearch , Logstash , and Kibana ( ELK Stack) on Ubuntu 15.10 but got to a step that is : Load Kibana Dashboards : beats - dashboards- cd \* ./load.sh after entering the command gives me… --- ## [Curator snapshot fails](https://discuss.elastic.co/t/curator-snapshot-fails/35198)
**Author:** [@bluethundr](https://discuss.elastic.co/u/bluethundr)\ **Replies:** 2\ **Last updated:** [November 21, 2015, 5:33pm UTC](https://discuss.elastic.co/t/curator-snapshot-fails/35198 "2015-11-21T17:33:51Z")
Hey all, Trying to backup my ES indexes using curator. I tried this approach, and failed: \[root@logs:~\] #curator --http\_auth "admin:$ES\_PASS" snapshot --repository jf\_backup --prefix jokefire- --ignore\_unavaila… --- ## [Geo search not working for current version of ElasticSearch (\< 0.11.0)](https://discuss.elastic.co/t/geo-search-not-working-for-current-version-of-elasticsearch-0-11-0/3887)
**Author:** [@digsmahler](https://discuss.elastic.co/u/digsmahler)\ **Replies:** 2\ **Last updated:** [February 7, 2011, 6:51pm UTC](https://discuss.elastic.co/t/geo-search-not-working-for-current-version-of-elasticsearch-0-11-0/3887 "2011-02-07T18:51:48Z")
I am very new to ElasticSearch, and trying to test the geo functionality. I've looked at the documentation and other posts and cobbled together a test that fails on 0.14.4. Going back through the older versions, the f… --- ## [Setting number\_of\_replicas on existing template](https://discuss.elastic.co/t/setting-number-of-replicas-on-existing-template/352672)
**Author:** [@parisila](https://discuss.elastic.co/u/parisila)\ **Replies:** 3\ **Last updated:** [February 6, 2024, 8:09pm UTC](https://discuss.elastic.co/t/setting-number-of-replicas-on-existing-template/352672 "2024-02-06T20:09:31Z")
Apologize for the screenshot but my elasticsearch instance is in a secure environment with only a jumphost browser that cannot copy anything out. Elastic Stack version 7.17.4 single node I am trying to update an index … --- ## ["Caused by: org.elasticsearch.common.breaker.CircuitBreakingException: \[parent\]](https://discuss.elastic.co/t/caused-by-org-elasticsearch-common-breaker-circuitbreakingexception-parent/256370)
**Author:** [@uttam.anand](https://discuss.elastic.co/u/uttam.anand)\ **Replies:** 3\ **Last updated:** [November 24, 2020, 4:24am UTC](https://discuss.elastic.co/t/caused-by-org-elasticsearch-common-breaker-circuitbreakingexception-parent/256370 "2020-11-24T04:24:39Z")
Hi Guys, I am facing the below issue since few days now -: "Caused by: org.elasticsearch.common.breaker.CircuitBreakingException: \[parent\] Data too large, data for \[\\] would be \[24876638648/23.1gb\], w… --- ## [Adding custom field to output](https://discuss.elastic.co/t/adding-custom-field-to-output/220497)
**Author:** [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\ **Replies:** 3\ **Last updated:** [February 24, 2020, 11:48am UTC](https://discuss.elastic.co/t/adding-custom-field-to-output/220497 "2020-02-24T11:48:28Z")
Im wondering if this is still accurate. Im attempting to add some fields to 'system.yml' (as a test) as follows: (note that indents are being lost) add\_fields: target: fields: name: myproject id: '574734885120952… --- ## [Heap Size for 256 GB RAM Machine](https://discuss.elastic.co/t/heap-size-for-256-gb-ram-machine/201337)
**Author:** [@Nitish\_Goyal](https://discuss.elastic.co/u/Nitish_Goyal)\ **Replies:** 3\ **Last updated:** [September 27, 2019, 10:15am UTC](https://discuss.elastic.co/t/heap-size-for-256-gb-ram-machine/201337 "2019-09-27T10:15:03Z")
Hi, We are running a 50 node cluster in production. Each node has the following configuration - Ram : 256 GB Disk : 5.6 \* 2 = 11.2 TB Cores : 80 vCPUs Heap : 29 GB GC algo : G1Gc We index roughly 2 billion documen… --- ## [Visual builder - Filter Ratio: repeated issues with "params.numerator != null && params.denominator != null"](https://discuss.elastic.co/t/visual-builder-filter-ratio-repeated-issues-with-params-numerator-null-params-denominator-null/163286)
**Author:** [@dygerati](https://discuss.elastic.co/u/dygerati)\ **Replies:** 3\ **Last updated:** [January 23, 2019, 6:03am UTC](https://discuss.elastic.co/t/visual-builder-filter-ratio-repeated-issues-with-params-numerator-null-params-denominator-null/163286 "2019-01-23T06:03:14Z")
I've been experimenting with the Visual Builder (experimental) in Kibana for a series of different charts and time series. I'm primarily trying to use the Filter Ratio aggregation, and I've repeatedly run across a specif… --- ## [Logstash will not start with netflow module](https://discuss.elastic.co/t/logstash-will-not-start-with-netflow-module/136151)
**Author:** [@jkevan](https://discuss.elastic.co/u/jkevan)\ **Replies:** 3\ **Last updated:** [June 21, 2018, 3:59pm UTC](https://discuss.elastic.co/t/logstash-will-not-start-with-netflow-module/136151 "2018-06-21T15:59:28Z")
I have Logstash installed as a service. It starts as root so i can bind privileged ports. i successfully ran the bin/logstash --modules netflow --setup -M "netflow.var.kibana.host=10.x.x.x:5601" -M "netflow.var.input.u… --- ## [Add Remote IP address in winlogbeat data](https://discuss.elastic.co/t/add-remote-ip-address-in-winlogbeat-data/126912)
**Author:** [@suchand](https://discuss.elastic.co/u/suchand)\ **Replies:** 3\ **Last updated:** [April 7, 2018, 10:55am UTC](https://discuss.elastic.co/t/add-remote-ip-address-in-winlogbeat-data/126912 "2018-04-07T10:55:34Z")
Hi, I have added the below mutate filter for adding IP address in winlogbeat index. mutate{ add\_field =\> { "remote\_ip" =\> "%{\[@metadata\]\[ip\_address\]}" } } But it's not getting the output as expected. It's showing li… --- ## [Questions about custom tracks](https://discuss.elastic.co/t/questions-about-custom-tracks/118794)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 3\ **Last updated:** [February 7, 2018, 2:18pm UTC](https://discuss.elastic.co/t/questions-about-custom-tracks/118794 "2018-02-07T14:18:42Z")
Hi, last time I tried to upgrade my productive ES instance from 5.1.2 to 6.1.0 I got performance issues afterwards. Before running the next rollout, I would like to do some loadtests before to be sure that changes duri… --- ## [How hash URI is being used, and alternatives](https://discuss.elastic.co/t/how-hash-uri-is-being-used-and-alternatives/115816)
**Author:** [@dr\_dob](https://discuss.elastic.co/u/dr_dob)\ **Replies:** 3\ **Last updated:** [January 24, 2018, 7:44pm UTC](https://discuss.elastic.co/t/how-hash-uri-is-being-used-and-alternatives/115816 "2018-01-24T19:44:13Z")
How is the hash uri being used in Kibana, e.g. /app/kibana#/dashboard? also, is there an alternative e.g. is it also be accessible by combining the base URI with a query parameter (escaped\_fragment={fragment})? Thanks a… --- ## [Logstash filtering issue](https://discuss.elastic.co/t/logstash-filtering-issue/96436)
**Author:** [@himaz.m](https://discuss.elastic.co/u/himaz.m)\ **Replies:** 3\ **Last updated:** [August 9, 2017, 6:43pm UTC](https://discuss.elastic.co/t/logstash-filtering-issue/96436 "2017-08-09T18:43:45Z")
I'm using filebeat, logstash and kibana. I see an issue in Kibana which looks like the logstash grok pattern was not applied for some of the log lines. I don't see an issue in the log lines even, both filtered and unfil… --- ## [ThreadLocal,memory leak, Glassfish4.1](https://discuss.elastic.co/t/threadlocal-memory-leak-glassfish4-1/90191)
**Author:** [@luyuekai](https://discuss.elastic.co/u/luyuekai)\ **Replies:** 0\ **Last updated:** [June 21, 2017, 3:39am UTC](https://discuss.elastic.co/t/threadlocal-memory-leak-glassfish4-1/90191 "2017-06-21T03:39:03Z")
I use elasticsearch transportclient in my java web application. But when I undeploy the application , glassfish logs show about 20 messages , the content is this: \[my application\] created a ThreadLocal with key of type… --- ## [Multitype searching](https://discuss.elastic.co/t/multitype-searching/49205)
**Author:** [@maher](https://discuss.elastic.co/u/maher)\ **Replies:** 3\ **Last updated:** [May 5, 2016, 7:26am UTC](https://discuss.elastic.co/t/multitype-searching/49205 "2016-05-05T07:26:33Z")
Hi, I am trying to make a search on multitype idexe. -my index is "dashboard" wich contains 2 types : -"logs" that contains the data coming from logstash -"productPrices" that contains the data coming from M… --- ## [How to score result in elasticsearch?](https://discuss.elastic.co/t/how-to-score-result-in-elasticsearch/34230)
**Author:** [@NgocPham](https://discuss.elastic.co/u/NgocPham)\ **Replies:** 3\ **Last updated:** [November 30, 2015, 12:14pm UTC](https://discuss.elastic.co/t/how-to-score-result-in-elasticsearch/34230 "2015-11-30T12:14:57Z")
sorry for my newbie question, i dont know how elasticsearch score result \[:smile:\] i read in https://www.elastic.co/guide/en/elasticsearch/guide/current/scoring-theory.html it have : tf(t in d) = √frequency idf(t) … --- ## [Logstash pipeline for error logs?](https://discuss.elastic.co/t/logstash-pipeline-for-error-logs/307681)
**Author:** [@MLsuper](https://discuss.elastic.co/u/MLsuper)\ **Replies:** 5\ **Last updated:** [June 20, 2022, 6:39pm UTC](https://discuss.elastic.co/t/logstash-pipeline-for-error-logs/307681 "2022-06-20T18:39:01Z")
How can I create a logstash pipeline for logstash error logs and put it in Elasticsearch?(So I can see it in discover and see the logs from kibana/discover and analytics? --- ## [I want to send this log in json without logstash](https://discuss.elastic.co/t/i-want-to-send-this-log-in-json-without-logstash/305188)
**Author:** [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\ **Replies:** 5\ **Last updated:** [May 20, 2022, 4:27am UTC](https://discuss.elastic.co/t/i-want-to-send-this-log-in-json-without-logstash/305188 "2022-05-20T04:27:59Z")
Hello Everyone I have following log sample data I want send this log as json in Elasticsearch without using logstash any one having Idea ? sample logs "TableName": "CouponProducts","SchemaName": "dbo","RowCounts": … --- ## [Is there a way to include external node module in my Kibana distributable?](https://discuss.elastic.co/t/is-there-a-way-to-include-external-node-module-in-my-kibana-distributable/298249)
**Author:** [@kyh119](https://discuss.elastic.co/u/kyh119)\ **Replies:** 5\ **Last updated:** [March 2, 2022, 12:38am UTC](https://discuss.elastic.co/t/is-there-a-way-to-include-external-node-module-in-my-kibana-distributable/298249 "2022-03-02T00:38:54Z")
Hi, I created my plugin, and it requires a module that I've installed using 'yarn add node-ssh'. I did: ' yarn add @types/ssh2 ' in kibana directory. ' yarn add node-ssh' also. in 'server/routes.ts', wrote import { N… --- ## [Конвертировать дату из формата ISO8601 в UNIXTIME](https://discuss.elastic.co/t/iso8601-unixtime/207345)
**Author:** [@111229](https://discuss.elastic.co/u/111229)\ **Replies:** 5\ **Last updated:** [November 11, 2019, 4:56pm UTC](https://discuss.elastic.co/t/iso8601-unixtime/207345 "2019-11-11T16:56:19Z")
Коллеги, добрый день! Подскажите, пожалуйста. Есть задача конвертироваться время из формата ISO8601 в UNIXTIME и сохранить его новом field в индексе. Как можно решить задачу? Заранее спасибо! --- ## [Ingest node message parsing issue](https://discuss.elastic.co/t/ingest-node-message-parsing-issue/147173)
**Author:** [@miki\_haiat](https://discuss.elastic.co/u/miki_haiat)\ **Replies:** 5\ **Last updated:** [September 5, 2018, 2:13pm UTC](https://discuss.elastic.co/t/ingest-node-message-parsing-issue/147173 "2018-09-05T14:13:11Z")
Hi , I have some share point log that that i want to use \_ingest in order to process them. its works perfect on the grok debugger but im unable to post it without parsing error this is the grok pattern (?\ **Author:** [@jhagen92](https://discuss.elastic.co/u/jhagen92)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 3:39pm UTC](https://discuss.elastic.co/t/what-does-include-related-object-mean-in-export/258151 "2020-12-09T15:39:13Z") Hi. I am trying to export my dashboard that uses multiple visualizations. When I export it, there is option called "include related objects". I am not sure what it means. I tried exporting with and without it and compar… --- ## [Winlogbeat missing winlog.event\_data.IpAddress](https://discuss.elastic.co/t/winlogbeat-missing-winlog-event-data-ipaddress/253745)
**Author:** [@mtudisco](https://discuss.elastic.co/u/mtudisco)\ **Replies:** 1\ **Last updated:** [October 30, 2020, 6:41pm UTC](https://discuss.elastic.co/t/winlogbeat-missing-winlog-event-data-ipaddress/253745 "2020-10-30T18:41:23Z")
Hi, I have a windows machine with Active Directory and winlogbeat (7.3) and in the generated info i have a field winlog.event\_data.IpAddress but on a differente scenario with winlogbeat (7.4.2) that field is not present… --- ## [How do I access term frequency in painless scripting?](https://discuss.elastic.co/t/how-do-i-access-term-frequency-in-painless-scripting/200976)
**Author:** [@Ben\_Wilde](https://discuss.elastic.co/u/Ben_Wilde)\ **Replies:** 1\ **Last updated:** [October 4, 2019, 3:43am UTC](https://discuss.elastic.co/t/how-do-i-access-term-frequency-in-painless-scripting/200976 "2019-10-04T03:43:40Z")
I want to do an aggregation where I measure the average frequency of a given term. The only way I can see of doing this is via a painless script. But according to the docs, I only have doc available which has all the fie… --- ## [Sudden 100% CPU spike on a data node with Kibana becoming unresponsive](https://discuss.elastic.co/t/sudden-100-cpu-spike-on-a-data-node-with-kibana-becoming-unresponsive/107454)
**Author:** [@xgantan](https://discuss.elastic.co/u/xgantan)\ **Replies:** 1\ **Last updated:** [November 13, 2017, 7:51pm UTC](https://discuss.elastic.co/t/sudden-100-cpu-spike-on-a-data-node-with-kibana-becoming-unresponsive/107454 "2017-11-13T19:51:43Z")
Hello, We have an ElasticSearch cluster with 3 master nodes and 4 data nodes. Earlier today, one of the data nodes, 04, suddenly reached 100% CPU usage and stopped responding to any requests, including Kibana metrics re… --- ## [Multi\_match, too\_many\_clauses: maxClauseCount is set to 1024](https://discuss.elastic.co/t/multi-match-too-many-clauses-maxclausecount-is-set-to-1024/68061)
**Author:** [@Derrick](https://discuss.elastic.co/u/Derrick)\ **Replies:** 1\ **Last updated:** [December 6, 2016, 8:41am UTC](https://discuss.elastic.co/t/multi-match-too-many-clauses-maxclausecount-is-set-to-1024/68061 "2016-12-06T08:41:55Z")
Hi support, I run this query, but get error:too\_many\_clauses: maxClauseCount is set to 1024, anyone help? thanks {"query":{ "multi\_match" : { "query" : "e2", "fields" : \["id", "name" \], "type" : "phrase\_p… --- ## [Shield/ldap integration](https://discuss.elastic.co/t/shield-ldap-integration/66468)
**Author:** [@bishaka](https://discuss.elastic.co/u/bishaka)\ **Replies:** 1\ **Last updated:** [November 28, 2016, 4:34pm UTC](https://discuss.elastic.co/t/shield-ldap-integration/66468 "2016-11-28T16:34:40Z")
Hi, I have Kibana shielded with security plugin. I have used LDAP realm as well. Now when I try to login with my org id and password it doesn't work. All other credentials specified in the kibana.yml file is also fail… --- ## [Error sending from logstash to elasticsearch - geo\_point expected](https://discuss.elastic.co/t/error-sending-from-logstash-to-elasticsearch-geo-point-expected/66278)
**Author:** [@Nicolas\_Lopez\_Luna](https://discuss.elastic.co/u/Nicolas_Lopez_Luna)\ **Replies:** 1\ **Last updated:** [November 16, 2016, 5:46pm UTC](https://discuss.elastic.co/t/error-sending-from-logstash-to-elasticsearch-geo-point-expected/66278 "2016-11-16T17:46:27Z")
Hi there, I'm sending data from logstash to elasticsearch. Apparently there is an error on a field as the warning shows but the strange thing is that I'm sending the same data from another logstash and not errors appe… --- ## [Mutate gsub Email Address](https://discuss.elastic.co/t/mutate-gsub-email-address/53878)
**Author:** [@Pedro\_Lopes](https://discuss.elastic.co/u/Pedro_Lopes)\ **Replies:** 1\ **Last updated:** [June 24, 2016, 10:49am UTC](https://discuss.elastic.co/t/mutate-gsub-email-address/53878 "2016-06-24T10:49:48Z")
Hello guys, I'm using ELK for 2 days now, to parse a CSV and see it in Kibana. My doubt is about mutate. I have a field with a email address I can easily do this: mutate{ gsub=\> \["col2",".\*@","@"\] } In this c… --- ## [EsHadoopInvalidRequest: failed to parse timestamp \[2016-03-21 11:41:21,204\]](https://discuss.elastic.co/t/eshadoopinvalidrequest-failed-to-parse-timestamp-2016-03-21-11-41-21-204/45842)
**Author:** [@DK\_3](https://discuss.elastic.co/u/DK_3)\ **Replies:** 1\ **Last updated:** [April 5, 2016, 2:55pm UTC](https://discuss.elastic.co/t/eshadoopinvalidrequest-failed-to-parse-timestamp-2016-03-21-11-41-21-204/45842 "2016-04-05T14:55:59Z")
I'm trying to save a DataFrame with a timestamp field but I'm hitting org.elasticsearch.hadoop.rest.EsHadoopInvalidRequest: failed to parse timestamp \[2016-03-21 11:41:21,204\] at org.elasticsearch.hadoop.rest.RestClie… --- ## [Problem extracting buckets](https://discuss.elastic.co/t/problem-extracting-buckets/43160)
**Author:** [@bwgriffith](https://discuss.elastic.co/u/bwgriffith)\ **Replies:** 1\ **Last updated:** [March 4, 2016, 9:04am UTC](https://discuss.elastic.co/t/problem-extracting-buckets/43160 "2016-03-04T09:04:00Z")
I've been using the excellent engineering blog posts on the atlas algorithm using watcher: https://www.elastic.co/blog/implementing-a-statistical-anomaly-detector-part-3 And I'm trying to implement something similar he… --- ## [Compare specific fields in two documents and show on dashboard if changed](https://discuss.elastic.co/t/compare-specific-fields-in-two-documents-and-show-on-dashboard-if-changed/26248)
**Author:** [@karolpivo](https://discuss.elastic.co/u/karolpivo)\ **Replies:** 1\ **Last updated:** [July 25, 2015, 2:14am UTC](https://discuss.elastic.co/t/compare-specific-fields-in-two-documents-and-show-on-dashboard-if-changed/26248 "2015-07-25T02:14:35Z")
I want to compare specific field of two documents in a single index. Based on my research the way to do this is to use scripting module. The script will evaluate if the fields are the same, something like this should do … --- ## [Groovy script to append integer value for partial update](https://discuss.elastic.co/t/groovy-script-to-append-integer-value-for-partial-update/24980)
**Author:** [@Hanish\_Bansal](https://discuss.elastic.co/u/Hanish_Bansal)\ **Replies:** 1\ **Last updated:** [July 7, 2015, 4:49pm UTC](https://discuss.elastic.co/t/groovy-script-to-append-integer-value-for-partial-update/24980 "2015-07-07T16:49:26Z")
Hi All, I am using groovy script to do partial updates in ElasticSearch. I have an integer field. I want to append value to that field on each update request. For example: "id" field has value 114561604. On each up… --- ## [Installation guide for Windows](https://discuss.elastic.co/t/installation-guide-for-windows/859)
**Author:** [@Stra](https://discuss.elastic.co/u/Stra)\ **Replies:** 8\ **Last updated:** [May 20, 2015, 5:10pm UTC](https://discuss.elastic.co/t/installation-guide-for-windows/859 "2015-05-20T17:10:00Z")
Hi, The installation guide provided is for Linux. Please i need an installation guide for Windows. Best regards --- ## [Elastic Search may have failed to start](https://discuss.elastic.co/t/elastic-search-may-have-failed-to-start/12139)
**Author:** [@irfan\_mir](https://discuss.elastic.co/u/irfan_mir)\ **Replies:** 8\ **Last updated:** [May 28, 2013, 7:21am UTC](https://discuss.elastic.co/t/elastic-search-may-have-failed-to-start/12139 "2013-05-28T07:21:24Z")
I am trying to run Elastic search as a service on my new server. It worked fine on my testing server, but the moment I moved it to this server I started getting issues when I try to start the service. The terminal… [Previous page](https://discuss.elastic.co/top.md?page=1668&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1670&per_page=50&period=all)