# Top **URL:** https://discuss.elastic.co/top.md?page=1678&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1679 --- ## [Infrastructure UI (kubernetes) - APM Traces Integration](https://discuss.elastic.co/t/infrastructure-ui-kubernetes-apm-traces-integration/207096)
**Author:** [@hendry.lim](https://discuss.elastic.co/u/hendry.lim)\ **Replies:** 6\ **Last updated:** [November 11, 2019, 10:15am UTC](https://discuss.elastic.co/t/infrastructure-ui-kubernetes-apm-traces-integration/207096 "2019-11-11T10:15:43Z")
Kibana version: 7.4.2 Elasticsearch version: 7.4.2 APM Server version: 7.4.2 APM Agent language and version: Java agent v1.10.0 Browser version: Chrome 79.0.3945.29 Original install method (e.g. download page, yum, … --- ## [How to get the best performance with index update](https://discuss.elastic.co/t/how-to-get-the-best-performance-with-index-update/193776)
**Author:** [@Henrique\_Brasileiro](https://discuss.elastic.co/u/Henrique_Brasileiro)\ **Replies:** 6\ **Last updated:** [August 6, 2019, 3:57pm UTC](https://discuss.elastic.co/t/how-to-get-the-best-performance-with-index-update/193776 "2019-08-06T15:57:56Z")
I have a index with length greater than 1 TB and I want to update a field but update by query is very slow, mor slow that delete all and insert all. How best alternative to mass update? --- ## [Running mutliple CONF file for logstash](https://discuss.elastic.co/t/running-mutliple-conf-file-for-logstash/47139)
**Author:** [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Replies:** 6\ **Last updated:** [April 13, 2016, 4:22am UTC](https://discuss.elastic.co/t/running-mutliple-conf-file-for-logstash/47139 "2016-04-13T04:22:11Z")
I have mutliple log files present under different folder. To make things simpler and easy to manage, based on the patterns I have created 5 different conf files. e,g. logstash-Exception.conf, logstash-eventsource.conf… --- ## [Running elasticsearch 1.4.2 and kibana 4 as service](https://discuss.elastic.co/t/running-elasticsearch-1-4-2-and-kibana-4-as-service/21376)
**Author:** [@Ram\_Maram](https://discuss.elastic.co/u/Ram_Maram)\ **Replies:** 6\ **Last updated:** [December 23, 2014, 10:55pm UTC](https://discuss.elastic.co/t/running-elasticsearch-1-4-2-and-kibana-4-as-service/21376 "2014-12-23T22:55:31Z")
Hi, Right now I am running kibana 3 and elasticsearch 1.3.2 for our ELK stack, I would like to use kibana 4 and elasticsearch 1.4.2. Can someone please let me know how to install kibana 4 and elasticsearch 1.4.… --- ## [ES 8.4.3: node disconnected after disk is full](https://discuss.elastic.co/t/es-8-4-3-node-disconnected-after-disk-is-full/321336)
**Author:** [@PengWang-SMARTM](https://discuss.elastic.co/u/PengWang-SMARTM)\ **Replies:** 5\ **Last updated:** [December 19, 2022, 10:41pm UTC](https://discuss.elastic.co/t/es-8-4-3-node-disconnected-after-disk-is-full/321336 "2022-12-19T22:41:18Z")
I followed the helm chart example, and created a 3-node elasticsearch 8.4.3 instance, and it was running OK until running out of the data volume space. The first issue I encountered was not able to open kibana. I XDELET… --- ## [Unable to index a file (Word document) greater than 45 MB](https://discuss.elastic.co/t/unable-to-index-a-file-word-document-greater-than-45-mb/272220)
**Author:** [@saqib619](https://discuss.elastic.co/u/saqib619)\ **Replies:** 5\ **Last updated:** [May 6, 2021, 6:59pm UTC](https://discuss.elastic.co/t/unable-to-index-a-file-word-document-greater-than-45-mb/272220 "2021-05-06T18:59:21Z")
We are trying to index a file (word document) which is \> 45 MB . It is failing throwing an exception as below: Maximum timeout reached while retrying request. Call: Status code unknown from: PUT /test\_index6/\_doc/16601?… --- ## [How to tuning terms aggregation performance](https://discuss.elastic.co/t/how-to-tuning-terms-aggregation-performance/184907)
**Author:** [@kkd927](https://discuss.elastic.co/u/kkd927)\ **Replies:** 5\ **Last updated:** [June 10, 2019, 4:14pm UTC](https://discuss.elastic.co/t/how-to-tuning-terms-aggregation-performance/184907 "2019-06-10T16:14:19Z")
Hi there We have a problem with our ES terms aggregation query, it took 10-12s to execute. here is our cluster information we have 3 client nodes, 3 master nodes, 5 data nodes, 1 ingest node each node, its 20 cores(4… --- ## [Logstash output elasticsearch a day index but curent day index contain two days data (curent day and next day\_)](https://discuss.elastic.co/t/logstash-output-elasticsearch-a-day-index-but-curent-day-index-contain-two-days-data-curent-day-and-next-day-/83781)
**Author:** [@Champion\_Xie](https://discuss.elastic.co/u/Champion_Xie)\ **Replies:** 5\ **Last updated:** [April 27, 2017, 3:20am UTC](https://discuss.elastic.co/t/logstash-output-elasticsearch-a-day-index-but-curent-day-index-contain-two-days-data-curent-day-and-next-day-/83781 "2017-04-27T03:20:40Z")
below info is my logstash conf can i define index name timezone ?? filter { grok { match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:datatime} %{LOGLEVEL:loglevel} - %{IP:client} %{NUMBER:duration} %{WORD:qtype} %… --- ## [Upgrading to 5.0 Logstash - large number of beats to upgrade](https://discuss.elastic.co/t/upgrading-to-5-0-logstash-large-number-of-beats-to-upgrade/64171)
**Author:** [@djohnson](https://discuss.elastic.co/u/djohnson)\ **Replies:** 5\ **Last updated:** [October 31, 2016, 8:18pm UTC](https://discuss.elastic.co/t/upgrading-to-5-0-logstash-large-number-of-beats-to-upgrade/64171 "2016-10-31T20:18:18Z")
I'm planning the upgrade of my production system to 5.0. If I upgrade logstash before I upgrade my \*beats, will logstash continue to receive logs as I upgrade each beat? --- ## [Gorkparsefailure](https://discuss.elastic.co/t/gorkparsefailure/163147)
**Author:** [@Sripal](https://discuss.elastic.co/u/Sripal)\ **Replies:** 8\ **Last updated:** [January 7, 2019, 7:18am UTC](https://discuss.elastic.co/t/gorkparsefailure/163147 "2019-01-07T07:18:48Z")
Dear all, I am getting gorkparsefailure error for my log lines. Kindly help, 70% of my datas are not getting structured. Conf file file{ path =\> \["/my/path/files/13\_70/", "/my/path/files/13\_71/"\] exclude =\> "\*.gz" … --- ## [Don't understand WRONG\_VERSION\_NUMBER errors](https://discuss.elastic.co/t/dont-understand-wrong-version-number-errors/149177)
**Author:** [@pgiorda](https://discuss.elastic.co/u/pgiorda)\ **Replies:** 0\ **Last updated:** [September 19, 2018, 6:32pm UTC](https://discuss.elastic.co/t/dont-understand-wrong-version-number-errors/149177 "2018-09-19T18:32:52Z")
I'm receiving in my logstash output \[2018-09-19T13:21:01,280\]\[INFO \]\[org.logstash.beats.BeatsHandler\] \[local: 0.0.0.0:5044, remote: undefined\] Handling exception: javax.net.ssl.SSLHandshakeException: error:100000f7:SSL … --- ## [Filebeat output empty JSON array as "null" instead of "\[\]"](https://discuss.elastic.co/t/filebeat-output-empty-json-array-as-null-instead-of/276604)
**Author:** [@ijingo](https://discuss.elastic.co/u/ijingo)\ **Replies:** 1\ **Last updated:** [June 30, 2021, 7:49am UTC](https://discuss.elastic.co/t/filebeat-output-empty-json-array-as-null-instead-of/276604 "2021-06-30T07:49:23Z")
Filebeat output empty JSON array as "null" instead of \[ \]. The original line of JSON is as follows, in which "array\_field" is an empty array. {"body": {"array\_field": \[\]}} However, after output, the "array\_field" is c… --- ## [Using NEST Nest.RewriteMultiTerm.TopTermsBoostN](https://discuss.elastic.co/t/using-nest-nest-rewritemultiterm-toptermsboostn/75615)
**Author:** [@rkalhans](https://discuss.elastic.co/u/rkalhans)\ **Replies:** 1\ **Last updated:** [March 6, 2017, 5:49am UTC](https://discuss.elastic.co/t/using-nest-nest-rewritemultiterm-toptermsboostn/75615 "2017-03-06T05:49:20Z")
I am trying to invoke a wildcard query with a max rewrite clauses set to a number (say 100). We are using C#-NEST as the client. While trying to set the rewrite method to top\_term\_boost\_100 using the NEST api .Rewrite(… --- ## [MIgrating opensearch to elasticsearch using logstash is generating more docs on destination index than there are in source index](https://discuss.elastic.co/t/migrating-opensearch-to-elasticsearch-using-logstash-is-generating-more-docs-on-destination-index-than-there-are-in-source-index/361275)
**Author:** [@Mat\_Wojdyla](https://discuss.elastic.co/u/Mat_Wojdyla)\ **Replies:** 7\ **Last updated:** [June 12, 2024, 11:32pm UTC](https://discuss.elastic.co/t/migrating-opensearch-to-elasticsearch-using-logstash-is-generating-more-docs-on-destination-index-than-there-are-in-source-index/361275 "2024-06-12T23:32:42Z")
Hello, I am in the process of migrating our opensearch cluster running ES 7.9 as the backend version to an Elasticsearch cluster I built in EC2 that is also running 7.9.3 for the time being. I have the sync running just… --- ## [Enable Audit Logging IN Elasticsearch For a User](https://discuss.elastic.co/t/enable-audit-logging-in-elasticsearch-for-a-user/359227)
**Author:** [@Debasis\_Mallick](https://discuss.elastic.co/u/Debasis_Mallick)\ **Replies:** 7\ **Last updated:** [May 10, 2024, 1:16pm UTC](https://discuss.elastic.co/t/enable-audit-logging-in-elasticsearch-for-a-user/359227 "2024-05-10T13:16:19Z")
Hello Team, We require to enable an audit for a specific user, meaning that whenever the user logs in or performs any CRUD operations in Elasticsearch, it should be recorded. The user has reported intermittent connectiv… --- ## [Cloudflare logpush to http elastic agent](https://discuss.elastic.co/t/cloudflare-logpush-to-http-elastic-agent/344383)
**Author:** [@gyterpena](https://discuss.elastic.co/u/gyterpena)\ **Replies:** 1\ **Last updated:** [October 20, 2023, 9:44am UTC](https://discuss.elastic.co/t/cloudflare-logpush-to-http-elastic-agent/344383 "2023-10-20T09:44:03Z")
Hello I'm trying to set up logpush integration with CF. I have set up elastic agent per documentation and I'm trying to enable logpush on CF by API but I'm getting {"errors":\[{"code":1002,"message":"error validatin… --- ## [Interacting with Zipkin](https://discuss.elastic.co/t/interacting-with-zipkin/246159)
**Author:** [@Rietty](https://discuss.elastic.co/u/Rietty)\ **Replies:** 1\ **Last updated:** [August 25, 2020, 9:50am UTC](https://discuss.elastic.co/t/interacting-with-zipkin/246159 "2020-08-25T09:50:13Z")
Hi, I'd like to read Elasticsearch Tracing Data by utilizing Openshift Zipkin. Has anyone had experience with this or how I would proceed? --- ## [APM Indices growing endlessly despite ILM](https://discuss.elastic.co/t/apm-indices-growing-endlessly-despite-ilm/243846)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 7\ **Last updated:** [August 18, 2020, 8:55am UTC](https://discuss.elastic.co/t/apm-indices-growing-endlessly-despite-ilm/243846 "2020-08-18T08:55:27Z")
Our APM indices are growing without bound and extremely large despite a delete aftaer 30 days ILM policy. Each index has a policy attached which say "rollover every 7 days" (which seems to be working) and delete "delete… --- ## [Query doesn't have any hits with date condition](https://discuss.elastic.co/t/query-doesnt-have-any-hits-with-date-condition/212492)
**Author:** [@bingchuan](https://discuss.elastic.co/u/bingchuan)\ **Replies:** 7\ **Last updated:** [December 20, 2019, 7:41am UTC](https://discuss.elastic.co/t/query-doesnt-have-any-hits-with-date-condition/212492 "2019-12-20T07:41:38Z")
Hi everyone, I'm beginner and i have a question. I created a index which contains some documents. But there are no any hits when i search the documents with the below query. Then, I deleted the date condition,and t… --- ## [How to enable metric beat](https://discuss.elastic.co/t/how-to-enable-metric-beat/204299)
**Author:** [@anusree\_arun](https://discuss.elastic.co/u/anusree_arun)\ **Replies:** 7\ **Last updated:** [October 22, 2019, 4:53am UTC](https://discuss.elastic.co/t/how-to-enable-metric-beat/204299 "2019-10-22T04:53:44Z")
I have configured Metricbeat on kibana.When i take the kibana UI -Management\_central Management below page is shown.how to enable it --- ## [Is there a way to use APM in ASP.NET Framework 4.6.2](https://discuss.elastic.co/t/is-there-a-way-to-use-apm-in-asp-net-framework-4-6-2/195820)
**Author:** [@stuwilliams-clgx](https://discuss.elastic.co/u/stuwilliams-clgx)\ **Replies:** 1\ **Last updated:** [August 20, 2019, 4:54am UTC](https://discuss.elastic.co/t/is-there-a-way-to-use-apm-in-asp-net-framework-4-6-2/195820 "2019-08-20T04:54:13Z")
We have a lot of applications that run ASP.NET Framework ("classic") 4.6.2 in PCF 2.5. Log capture works great, we just bind a syslog service, but I can't figure out how to add APM to my app written in .NET Classic. It… --- ## [APM server 6.6.2 does not create indexes on ELK 6.5.4](https://discuss.elastic.co/t/apm-server-6-6-2-does-not-create-indexes-on-elk-6-5-4/171780)
**Author:** [@Komail100](https://discuss.elastic.co/u/Komail100)\ **Replies:** 7\ **Last updated:** [March 19, 2019, 3:35pm UTC](https://discuss.elastic.co/t/apm-server-6-6-2-does-not-create-indexes-on-elk-6-5-4/171780 "2019-03-19T15:35:07Z")
Hi, I am using ELK 6.5.4 and have a separate apm-server 6.6.1. When I am checking my Index management I only see the following indices: apm-6.6.1-metric-2019.03.11 apm-6.6.1-onboarding-2019.03.11 Any idea why the oth… --- ## [Get kibana chart in our web application](https://discuss.elastic.co/t/get-kibana-chart-in-our-web-application/132559)
**Author:** [@DILIP\_SHARMA](https://discuss.elastic.co/u/DILIP_SHARMA)\ **Replies:** 1\ **Last updated:** [May 21, 2018, 12:56pm UTC](https://discuss.elastic.co/t/get-kibana-chart-in-our-web-application/132559 "2018-05-21T12:56:27Z")
hi there is any way we can integrate kibana dashboard in our web application i know 2 approach - 1 - iframe ( but here i can apply filter in run time ) 2 - call ES API ( we did this and after getting aggregated dat… --- ## [Conditional mapping. if](https://discuss.elastic.co/t/conditional-mapping-if/99290)
**Author:** [@inpp](https://discuss.elastic.co/u/inpp)\ **Replies:** 1\ **Last updated:** [September 4, 2017, 6:43pm UTC](https://discuss.elastic.co/t/conditional-mapping-if/99290 "2017-09-04T18:43:23Z")
I want to use the analyzer differently depending on the value of another field in single field. As the code below "mappings": { "sample\_type": { "properties":{ "my\_text": { "if=l… --- ## [Indexing pdf document stored inside Documentum](https://discuss.elastic.co/t/indexing-pdf-document-stored-inside-documentum/23251)
**Author:** [@Pelle\_P](https://discuss.elastic.co/u/Pelle_P)\ **Replies:** 1\ **Last updated:** [May 4, 2017, 6:39pm UTC](https://discuss.elastic.co/t/indexing-pdf-document-stored-inside-documentum/23251 "2017-05-04T18:39:29Z")
Hello! First question here. I'm trying to find out how to index a document which is stored on a remote server, in my case inside Documentum. I have the url to the document. I want to avoid storing a local copy. … --- ## [Kibana Graph plugin - long terms cause rendering performance problems](https://discuss.elastic.co/t/kibana-graph-plugin-long-terms-cause-rendering-performance-problems/49915)
**Author:** [@rmoff](https://discuss.elastic.co/u/rmoff)\ **Replies:** 1\ **Last updated:** [May 12, 2016, 4:38pm UTC](https://discuss.elastic.co/t/kibana-graph-plugin-long-terms-cause-rendering-performance-problems/49915 "2016-05-12T16:38:16Z")
Due to some duff data, one of my terms retrieved in the graph was 1014 chars. The rendering (where all the vertices whizz around initially) was horrible - maybe 1-2 fps. Obviously I shouldn't have duff data, but maybe s… --- ## [Webhook URI encoding](https://discuss.elastic.co/t/webhook-uri-encoding/39310)
**Author:** [@kuula](https://discuss.elastic.co/u/kuula)\ **Replies:** 1\ **Last updated:** [January 21, 2016, 10:55am UTC](https://discuss.elastic.co/t/webhook-uri-encoding/39310 "2016-01-21T10:55:41Z")
I have a pre-encoded URI that I'm trying to call with the Webhook action. /v1/signal/arn%3Aopenstack%3Aheat%3A%3Afcaf9f... Webhook seems to re-encode the %'s in the URI. Resulting in %253A, which doesn't work. The par… --- ## [Stop shard balancing](https://discuss.elastic.co/t/stop-shard-balancing/345678)
**Author:** [@SleekPainter01](https://discuss.elastic.co/u/SleekPainter01)\ **Replies:** 2\ **Last updated:** [October 26, 2023, 7:21pm UTC](https://discuss.elastic.co/t/stop-shard-balancing/345678 "2023-10-26T19:21:13Z")
Good morning everything is fine? I have 3 clients receiving logs via filebeat. And I have 1 Elasticsearch node for each client. However, load balancing of fragments between nodes is taking place. How could this balan… --- ## [Can we have default filter?](https://discuss.elastic.co/t/can-we-have-default-filter/266205)
**Author:** [@Abhishek\_Vyas1](https://discuss.elastic.co/u/Abhishek_Vyas1)\ **Replies:** 2\ **Last updated:** [March 15, 2021, 3:33am UTC](https://discuss.elastic.co/t/can-we-have-default-filter/266205 "2021-03-15T03:33:40Z")
Is it possible to have a default filter that is hidden from dash board. Mainly the need is as follows :- we have key name area which have 4 different values (as A,B,C,D). So whenever user choose a given area in front e… --- ## [Pertaining missing data in an index](https://discuss.elastic.co/t/pertaining-missing-data-in-an-index/201841)
**Author:** [@orokusaki](https://discuss.elastic.co/u/orokusaki)\ **Replies:** 2\ **Last updated:** [October 1, 2019, 7:32pm UTC](https://discuss.elastic.co/t/pertaining-missing-data-in-an-index/201841 "2019-10-01T19:32:46Z")
I realize that, of course, Elasticsearch is not an ACID-compliant data store, but I have a question pertaining missing data. Out of 5 or so million documents of relatively small size (300 to 1,000 source bytes per), we'v… --- ## [Issue with ingest of haproxy logs into KIbana](https://discuss.elastic.co/t/issue-with-ingest-of-haproxy-logs-into-kibana/164719)
**Author:** [@aalvino](https://discuss.elastic.co/u/aalvino)\ **Replies:** 2\ **Last updated:** [January 18, 2019, 5:00pm UTC](https://discuss.elastic.co/t/issue-with-ingest-of-haproxy-logs-into-kibana/164719 "2019-01-18T17:00:55Z")
I have signed up today for the free trial of elasticsearch. I am mostly interested in using hosted Kibana with elastic search. I am attempting to import some of my companies production data from an haproxy configuration.… --- ## [Percolator in Elasticsearch 6](https://discuss.elastic.co/t/percolator-in-elasticsearch-6/150987)
**Author:** [@Thomas\_Ardal](https://discuss.elastic.co/u/Thomas_Ardal)\ **Replies:** 2\ **Last updated:** [October 4, 2018, 9:14am UTC](https://discuss.elastic.co/t/percolator-in-elasticsearch-6/150987 "2018-10-04T09:14:51Z")
I'm currently upgrading some code using a very old version of the Elasticsearch percolator. I'm trying to understand percolators in Es6. I understand the percolator type and have read the documentation. What I'm having t… --- ## [Why would DeadLetterQueue fail like this?](https://discuss.elastic.co/t/why-would-deadletterqueue-fail-like-this/127664)
**Author:** [@smbullet](https://discuss.elastic.co/u/smbullet)\ **Replies:** 2\ **Last updated:** [April 16, 2018, 3:13pm UTC](https://discuss.elastic.co/t/why-would-deadletterqueue-fail-like-this/127664 "2018-04-16T15:13:09Z")
\[2018-04-11T10:37:31,479\]\[ERROR\]\[logstash.pipeline \] A plugin had an unrecoverable error. Will restart this plugin. Pipeline\_id:main Plugin: \"/home/logstash\_user/logsta… --- ## [Elasticsearch template query](https://discuss.elastic.co/t/elasticsearch-template-query/113121)
**Author:** [@jiangshigen](https://discuss.elastic.co/u/jiangshigen)\ **Replies:** 2\ **Last updated:** [January 18, 2018, 6:51am UTC](https://discuss.elastic.co/t/elasticsearch-template-query/113121 "2018-01-18T06:51:31Z")
I use QueryBuilders.templateQuery(template, map) to achieve some documents, howerer,the relevance scoring of each document is 1.I hope someone can help me. template example: { "query": { "bool": { "must": \[ { "que… --- ## [Why does hyphenation\_decompounder require word\_list?](https://discuss.elastic.co/t/why-does-hyphenation-decompounder-require-word-list/114567)
**Author:** [@hbruch](https://discuss.elastic.co/u/hbruch)\ **Replies:** 2\ **Last updated:** [January 13, 2018, 4:41pm UTC](https://discuss.elastic.co/t/why-does-hyphenation-decompounder-require-word-list/114567 "2018-01-13T16:41:56Z")
HyphenationCompoundWordTokenFilterFactory inherits from AbstractCompoundWordTokenFilterFactory , which performs a mandatory check for a supplied word\_list. As the underlying lucene HyphenationCompoundWordTokenFilter do… --- ## [Can't set file as target for log repository](https://discuss.elastic.co/t/cant-set-file-as-target-for-log-repository/95944)
**Author:** [@IvanBiv](https://discuss.elastic.co/u/IvanBiv)\ **Replies:** 2\ **Last updated:** [August 5, 2017, 7:18am UTC](https://discuss.elastic.co/t/cant-set-file-as-target-for-log-repository/95944 "2017-08-05T07:18:06Z")
I use field logging.dest in kibana.yml When I set logging.dest: stdout web UI is work If i try to set logging.dest: /home/ivan/Documents/kibana.log Directory is exist, end user have access. I see fail: ... kib… --- ## [Winlogbeat event\_data.param17 format change with MapperParsingException](https://discuss.elastic.co/t/winlogbeat-event-data-param17-format-change-with-mapperparsingexception/83742)
**Author:** [@Kim-Kruse-Hansen](https://discuss.elastic.co/u/Kim-Kruse-Hansen)\ **Replies:** 2\ **Last updated:** [April 26, 2017, 7:05pm UTC](https://discuss.elastic.co/t/winlogbeat-event-data-param17-format-change-with-mapperparsingexception/83742 "2017-04-26T19:05:31Z")
Hi I am using Winlogbeat 5.x to collect Windows Logs. Lately I have been having an issue with a particular field in the event\_data. Specically event\_data.param17. This field is used by various event sources to contain … --- ## [Regexp parsing\_exception for \\\[mytag\\\]. Why do regexp escapes for \[, \], (, ), break the parser?](https://discuss.elastic.co/t/regexp-parsing-exception-for-mytag-why-do-regexp-escapes-for-break-the-parser/76717)
**Author:** [@foobarbaz](https://discuss.elastic.co/u/foobarbaz)\ **Replies:** 2\ **Last updated:** [March 23, 2017, 5:33pm UTC](https://discuss.elastic.co/t/regexp-parsing-exception-for-mytag-why-do-regexp-escapes-for-break-the-parser/76717 "2017-03-23T17:33:08Z")
Trying to use regexp to match a value in title that has surrounding \[\] or () characters however seeing an unexpected error when escaping these characters. Have tried both \\\[ and \\\\\[, looking for some guidance. '{ "… --- ## [Message "timeout notification from cluster service"](https://discuss.elastic.co/t/message-timeout-notification-from-cluster-service/79383)
**Author:** [@rghv](https://discuss.elastic.co/u/rghv)\ **Replies:** 2\ **Last updated:** [March 21, 2017, 9:37pm UTC](https://discuss.elastic.co/t/message-timeout-notification-from-cluster-service/79383 "2017-03-21T21:37:21Z")
One of our nodes (N1) has been very frequently reporting the message "timeout notification from cluster service". I referred to https://discuss.elastic.co/t/elasticsearch-observer-timeout-notification-from-cluster-servic… --- ## [C# Nest Serialization of GeoShapeBase](https://discuss.elastic.co/t/c-nest-serialization-of-geoshapebase/70307)
**Author:** [@MatthewHartz](https://discuss.elastic.co/u/MatthewHartz)\ **Replies:** 2\ **Last updated:** [January 5, 2017, 9:51am UTC](https://discuss.elastic.co/t/c-nest-serialization-of-geoshapebase/70307 "2017-01-05T09:51:35Z")
Hi, I'm trying to do a search and return the a object containing a geocircleshape across a service in Azure service fabric. I am receivine the error: "Type 'Nest.GeoShapeBase' cannot be serialized. Consider marking … --- ## [Logstash upstart service failed to start after logstash.log remove](https://discuss.elastic.co/t/logstash-upstart-service-failed-to-start-after-logstash-log-remove/59779)
**Author:** [@cazorla19](https://discuss.elastic.co/u/cazorla19)\ **Replies:** 2\ **Last updated:** [September 5, 2016, 8:27am UTC](https://discuss.elastic.co/t/logstash-upstart-service-failed-to-start-after-logstash-log-remove/59779 "2016-09-05T08:27:42Z")
The issue: facing with disk space deficiency, I remove in panic all stuffy log files. File logstash.log was there too. After further attempts to start service touching empty file logstash.log before. Service status becam… --- ## [Device with json log - how to import](https://discuss.elastic.co/t/device-with-json-log-how-to-import/42077)
**Author:** [@Bradly](https://discuss.elastic.co/u/Bradly)\ **Replies:** 2\ **Last updated:** [February 18, 2016, 1:52pm UTC](https://discuss.elastic.co/t/device-with-json-log-how-to-import/42077 "2016-02-18T13:52:43Z")
I have a device on my network that creates a json log file. Lets call this device device1. So if you curl https://device1/log.json you will get an output in json format. I want to be able to "pull" that data into elas… --- ## [Date Time filter for first tuesday of months](https://discuss.elastic.co/t/date-time-filter-for-first-tuesday-of-months/40420)
**Author:** [@pittoch](https://discuss.elastic.co/u/pittoch)\ **Replies:** 2\ **Last updated:** [January 29, 2016, 10:50pm UTC](https://discuss.elastic.co/t/date-time-filter-for-first-tuesday-of-months/40420 "2016-01-29T22:50:41Z")
Hello, I have a data set with the date and time , and for each time an average of CPU consumption. Is it possible to create a table with only the period 8:00AM to 8:00AM the first Tuesday months during 1 year ? Than… --- ## [Multicast](https://discuss.elastic.co/t/multicast/34067)
**Author:** [@aanm](https://discuss.elastic.co/u/aanm)\ **Replies:** 2\ **Last updated:** [November 9, 2015, 11:49pm UTC](https://discuss.elastic.co/t/multicast/34067 "2015-11-09T23:49:24Z")
Elasticsearch removed multicast on 2.0 I read some stuff and you guys advise to use something like discovery.zen.ping.unicast.hosts: \[ 192.168.1.2, 192.168.1.3 \] If I add 2 new nodes to the cluster, lets say 192.168.1.4… --- ## [Stats aggregation: value script broken due to Groovy scripting disabled](https://discuss.elastic.co/t/stats-aggregation-value-script-broken-due-to-groovy-scripting-disabled/22533)
**Author:** [@BradVido](https://discuss.elastic.co/u/BradVido)\ **Replies:** 2\ **Last updated:** [March 6, 2015, 2:11pm UTC](https://discuss.elastic.co/t/stats-aggregation-value-script-broken-due-to-groovy-scripting-disabled/22533 "2015-03-06T14:11:59Z")
I understand that Groovy dynamic scripting has been disabled by default in 1.4.4 and I should either use a different language or put the script in the config/scripts directory. However, when calling a script for t… --- ## [Error while loading shared libraries: libjli.so / Cannot Open Shared Object File](https://discuss.elastic.co/t/error-while-loading-shared-libraries-libjli-so-cannot-open-shared-object-file/194449)
**Author:** [@akshatsharma](https://discuss.elastic.co/u/akshatsharma)\ **Replies:** 0\ **Last updated:** [August 8, 2019, 2:32pm UTC](https://discuss.elastic.co/t/error-while-loading-shared-libraries-libjli-so-cannot-open-shared-object-file/194449 "2019-08-08T14:32:58Z")
Hi, I am building elasticsearch buildah image. I am installing elasticsearch rpm (elasticsearch-oss-7.0.1-x86\_64.rpm) in my buildah script. command: rpm --root $mnt\_container -Uvh https://elasticsearch/elasticsearch-os… --- ## [Inserting Custom Logs Into Siem](https://discuss.elastic.co/t/inserting-custom-logs-into-siem/190093)
**Author:** [@MrTrav](https://discuss.elastic.co/u/MrTrav)\ **Replies:** 3\ **Last updated:** [July 23, 2019, 11:00am UTC](https://discuss.elastic.co/t/inserting-custom-logs-into-siem/190093 "2019-07-23T11:00:12Z")
I am trying to understand the fields necessary to populate custom logs into the SIEM. I have the ability to use ECS and get logs to show up, however the hosts they are coming from are not populating the "Hosts" section.… --- ## [Issue with Elasticsearch service on FreeBSD](https://discuss.elastic.co/t/issue-with-elasticsearch-service-on-freebsd/179794)
**Author:** [@Andromedae93](https://discuss.elastic.co/u/Andromedae93)\ **Replies:** 0\ **Last updated:** [May 6, 2019, 3:12pm UTC](https://discuss.elastic.co/t/issue-with-elasticsearch-service-on-freebsd/179794 "2019-05-06T15:12:36Z")
Hello everybody, I'm coming here in order to post my question which could help users. I installed elasticsearch thanks to pkg, but I have issues when I try to launch daemon commands on FreeBSD. This is my environment: … --- ## [Working with brackets in regex](https://discuss.elastic.co/t/working-with-brackets-in-regex/146958)
**Author:** [@fishfox](https://discuss.elastic.co/u/fishfox)\ **Replies:** 3\ **Last updated:** [September 3, 2018, 8:37am UTC](https://discuss.elastic.co/t/working-with-brackets-in-regex/146958 "2018-09-03T08:37:33Z")
I have a regex if statement that includes brackets: if \[prog\] =~ /^openvpn\[\[0-9\]\*\]$/ { grok { match =\> \[ "message", "%{IP:remote\_ip}:%{POSINT:remote\_port} \\\[%{USERNAME:username}\\\] %{GREEDYDATA:event}"\] }… --- ## [Kibana saving visualizations twice](https://discuss.elastic.co/t/kibana-saving-visualizations-twice/111414)
**Author:** [@Wes\_F](https://discuss.elastic.co/u/Wes_F)\ **Replies:** 3\ **Last updated:** [December 13, 2017, 1:05pm UTC](https://discuss.elastic.co/t/kibana-saving-visualizations-twice/111414 "2017-12-13T13:05:27Z")
So I am having an issue with Kibana, when trying to create visualizations, it tells me that it timed out after 30k ms and then about 2-3 minutes later in the visualizations tab I see the visualization twice. Looking at … [Previous page](https://discuss.elastic.co/top.md?page=1677&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1679&per_page=50&period=all)