# Top

**URL:** https://discuss.elastic.co/top.md?page=1685&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1686

---

## [Pie Chart - Field name is not Visible](https://discuss.elastic.co/t/pie-chart-field-name-is-not-visible/295691)

<div class="topic-metadata">

**Author:** [@Susendiran](https://discuss.elastic.co/u/Susendiran)\
**Replies:** 4\
**Last updated:** [January 28, 2022, 12:47pm UTC](https://discuss.elastic.co/t/pie-chart-field-name-is-not-visible/295691 "2022-01-28T12:47:14Z")

</div>

Hello Team, We are facing one issue in Pie-chart visualization which is not showing a field named - "Hospitality". The amount/quantity is visible in pie-chart view but the field name alone not visible while viewing(not …

---

## [Restore KQL time filter on Kibana Dashboard](https://discuss.elastic.co/t/restore-kql-time-filter-on-kibana-dashboard/287975)

<div class="topic-metadata">

**Author:** [@pranay\_jain](https://discuss.elastic.co/u/pranay_jain)\
**Replies:** 4\
**Last updated:** [November 9, 2021, 9:42am UTC](https://discuss.elastic.co/t/restore-kql-time-filter-on-kibana-dashboard/287975 "2021-11-09T09:42:27Z")

</div>

Is there a way to restore time filter selection on Kibana dashboard. Use case : We have menu button on our web page from where we open Kibana dashboard by using tokens with the endpoint /internal/security/login for log…

---

## [Facing data too large exception frequently](https://discuss.elastic.co/t/facing-data-too-large-exception-frequently/255943)

<div class="topic-metadata">

**Author:** [@Divy\_Garg](https://discuss.elastic.co/u/Divy_Garg)\
**Replies:** 4\
**Last updated:** [November 26, 2020, 1:51pm UTC](https://discuss.elastic.co/t/facing-data-too-large-exception-frequently/255943 "2020-11-26T13:51:00Z")

</div>

CircuitBreakingException\[\[parent\] Data too large, data for \[internal:index/shard/recovery/start\_recovery\] would be \[7805417954/7.2gb\], which is larger than the limit of \[6941363404/6.4gb\], real usage: \[7805416568/7.2gb\],…

---

## [Static Kibana Dashboard URLs](https://discuss.elastic.co/t/static-kibana-dashboard-urls/235431)

<div class="topic-metadata">

**Author:** [@EricWS](https://discuss.elastic.co/u/EricWS)\
**Replies:** 4\
**Last updated:** [June 4, 2020, 12:15am UTC](https://discuss.elastic.co/t/static-kibana-dashboard-urls/235431 "2020-06-04T00:15:14Z")

</div>

Hi all, We have integrated a Kibana dashboard into a web app using and IFrame which works fine. However I have found an issue that if for example I edit or delete a visualisation from that dashboard the URL changes, wh…

---

## [Why do you write cluster.initial\_master\_node 3 or higher node when setting up a cluster?](https://discuss.elastic.co/t/why-do-you-write-cluster-initial-master-node-3-or-higher-node-when-setting-up-a-cluster/223884)

<div class="topic-metadata">

**Author:** [@cybang](https://discuss.elastic.co/u/cybang)\
**Replies:** 4\
**Last updated:** [March 18, 2020, 12:12am UTC](https://discuss.elastic.co/t/why-do-you-write-cluster-initial-master-node-3-or-higher-node-when-setting-up-a-cluster/223884 "2020-03-18T00:12:42Z")

</div>

hi. i have a question.. I apologize first if there is something I said rudely because I cant well english. Assuming that I wrote cluster.initial\_master\_node: master1,master2,master3 I need only two masters alive to m…

---

## [Issue with timelion regex label](https://discuss.elastic.co/t/issue-with-timelion-regex-label/209973)

<div class="topic-metadata">

**Author:** [@kristoflarcher](https://discuss.elastic.co/u/kristoflarcher)\
**Replies:** 4\
**Last updated:** [December 4, 2019, 7:40am UTC](https://discuss.elastic.co/t/issue-with-timelion-regex-label/209973 "2019-12-04T07:40:14Z")

</div>

I did the following search request in Discover on my ref\_rfnd index : msg: "\*Detected server" AND msg: "started" Search result extract: Time host.name msg application Nov 29, 2019 @ 12:49:29.023 s598lr2wsrf0…

---

## [Elasticsearch Issues with Content Manager 9.2](https://discuss.elastic.co/t/elasticsearch-issues-with-content-manager-9-2/139439)

<div class="topic-metadata">

**Author:** [@Kyles710](https://discuss.elastic.co/u/Kyles710)\
**Replies:** 4\
**Last updated:** [July 10, 2018, 10:45pm UTC](https://discuss.elastic.co/t/elasticsearch-issues-with-content-manager-9-2/139439 "2018-07-10T22:45:08Z")

</div>

Hi I have a customer trying to run Elasticsearch as the Document Content Indexer with Micro Focus' Content Manager 9.2 and they are having issues with Elasticsearch - time outs, garbage collection issues, JVM issues. …

---

## [Installation questions](https://discuss.elastic.co/t/installation-questions/83214)

<div class="topic-metadata">

**Author:** [@Diggy](https://discuss.elastic.co/u/Diggy)\
**Replies:** 4\
**Last updated:** [April 24, 2017, 1:07pm UTC](https://discuss.elastic.co/t/installation-questions/83214 "2017-04-24T13:07:41Z")

</div>

Hello, all. Apologies if this is the wrong place to post these questions, or if they're laughably stupid, but I need your help. Up to now, I've been running a single-node, version 2.x, ELK stack. While we have only a…

---

## [LS crashing when trying to read CSV with undefined method \`tv\_sec' error](https://discuss.elastic.co/t/ls-crashing-when-trying-to-read-csv-with-undefined-method-tv-sec-error/67079)

<div class="topic-metadata">

**Author:** [@fxiger](https://discuss.elastic.co/u/fxiger)\
**Replies:** 4\
**Last updated:** [December 1, 2016, 11:43am UTC](https://discuss.elastic.co/t/ls-crashing-when-trying-to-read-csv-with-undefined-method-tv-sec-error/67079 "2016-12-01T11:43:51Z")

</div>

Hi, i'm trying to read logifles (written on my own app) with csv format with logstash and output them to an ES index. i'm using: logstash 2.4.1 logstash-filter-csv (2.1.3) logstash-input-file (2.2.5) logstash-outpu…

---

## [From which version support for compression](https://discuss.elastic.co/t/from-which-version-support-for-compression/46214)

<div class="topic-metadata">

**Author:** [@Visva\_Ram](https://discuss.elastic.co/u/Visva_Ram)\
**Replies:** 4\
**Last updated:** [April 4, 2016, 9:13am UTC](https://discuss.elastic.co/t/from-which-version-support-for-compression/46214 "2016-04-04T09:13:14Z")

</div>

I am currently struggling of using new version elasticsearch with spring data elasticsearch. But spring data elasticsearch works with finde upto elasticsearch 1.7.4. is there possible to enable compression technique o…

---

## [Extracting fuzzy match terms](https://discuss.elastic.co/t/extracting-fuzzy-match-terms/23424)

<div class="topic-metadata">

**Author:** [@Graham\_Turner](https://discuss.elastic.co/u/Graham_Turner)\
**Replies:** 4\
**Last updated:** [April 29, 2015, 1:39pm UTC](https://discuss.elastic.co/t/extracting-fuzzy-match-terms/23424 "2015-04-29T13:39:24Z")

</div>

Hi, I'm working on a proof-of-concept for a client, replacing an existing legacy search system with an elastic based alternative. One of the requirements that comes from the existing system is that, when perfo…

---

## [Help with GC configuration](https://discuss.elastic.co/t/help-with-gc-configuration/13339)

<div class="topic-metadata">

**Author:** [@alucero](https://discuss.elastic.co/u/alucero)\
**Replies:** 4\
**Last updated:** [August 27, 2013, 7:09pm UTC](https://discuss.elastic.co/t/help-with-gc-configuration/13339 "2013-08-27T19:09:10Z")

</div>

Hello, we are experimenting some problems with GC configuration of ElasticSearch, we have elasticsearch 0.20.2 running in java 6.0.32 with 9 node with 32 gb and 16 gb assigned to the elastic, in this cluster, we hav…

---

## [Elastic Crawler Debugging](https://discuss.elastic.co/t/elastic-crawler-debugging/326628)

<div class="topic-metadata">

**Author:** [@alongaks](https://discuss.elastic.co/u/alongaks)\
**Replies:** 7\
**Last updated:** [March 1, 2023, 1:01pm UTC](https://discuss.elastic.co/t/elastic-crawler-debugging/326628 "2023-03-01T13:01:58Z")

</div>

Hello, I am looking for info if it is possible for the Elastic Crawler ( cloud deployment ) to enable a debug log, just for a crawl job. I am hitting 599 timeout errors during a crawl, and once this occurs the crawl is…

---

## [Combo box UI not rendering properly](https://discuss.elastic.co/t/combo-box-ui-not-rendering-properly/273204)

<div class="topic-metadata">

**Author:** [@praveer](https://discuss.elastic.co/u/praveer)\
**Replies:** 1\
**Last updated:** [May 17, 2021, 5:14pm UTC](https://discuss.elastic.co/t/combo-box-ui-not-rendering-properly/273204 "2021-05-17T17:14:35Z")

</div>

Hi Team, In my application I am using elastic UI. I have used EuiComboBox. When i click on combo box it shows options but there is a gap in between as shown below. When I inspected I found that 'top' css is getting…

---

## [Rapid7 InsightVM Nexpose integration missing in 7.11.0](https://discuss.elastic.co/t/rapid7-insightvm-nexpose-integration-missing-in-7-11-0/265238)

<div class="topic-metadata">

**Author:** [@florinsfetea](https://discuss.elastic.co/u/florinsfetea)\
**Replies:** 1\
**Last updated:** [March 7, 2021, 9:54pm UTC](https://discuss.elastic.co/t/rapid7-insightvm-nexpose-integration-missing-in-7-11-0/265238 "2021-03-07T21:54:22Z")

</div>

I had previously(7.9) configured a Fleet policy with Rapid7 Nexpose integration. Now after migrating to 7.11.0 my policy is there but the integration is failing. Also if I search for the integration itself I cannot…

---

## [Authentication not working and mixed docs over the web](https://discuss.elastic.co/t/authentication-not-working-and-mixed-docs-over-the-web/225053)

<div class="topic-metadata">

**Author:** [@Dean\_Hiller](https://discuss.elastic.co/u/Dean_Hiller)\
**Replies:** 1\
**Last updated:** [March 26, 2020, 6:26am UTC](https://discuss.elastic.co/t/authentication-not-working-and-mixed-docs-over-the-web/225053 "2020-03-26T06:26:50Z")

</div>

This was great for getting a key but it didn't show me how to use it at all in curl ... https://www.elastic.co/guide/en/beats/metricbeat/current/beats-api-keys.html Then I find this https://www.elastic.co/guide/en/ela…

---

## [\[GSOC\] 2020 Introduction](https://discuss.elastic.co/t/gsoc-2020-introduction/221946)

<div class="topic-metadata">

**Author:** [@prashant.globe](https://discuss.elastic.co/u/prashant.globe)\
**Replies:** 1\
**Last updated:** [March 4, 2020, 12:05am UTC](https://discuss.elastic.co/t/gsoc-2020-introduction/221946 "2020-03-04T00:05:59Z")

</div>

Hi all ! This is Prashant . I am a final year undergraduate student from BITS Pilani , India . I have prior experience working with React , Electron ,JS,PHP and TypeScript . I would like to contribute to the Toggle Syst…

---

## [Regex with query from string](https://discuss.elastic.co/t/regex-with-query-from-string/218312)

<div class="topic-metadata">

**Author:** [@ganchu](https://discuss.elastic.co/u/ganchu)\
**Replies:** 1\
**Last updated:** [February 7, 2020, 10:25am UTC](https://discuss.elastic.co/t/regex-with-query-from-string/218312 "2020-02-07T10:25:03Z")

</div>

First query can find events included this string "registry\_key\_path" : """HKCR\\mscfile\\shell\\open\\command\\(Default)""" GET \_search { "query": { "query\_string": { "query": "(registry\_key\_path:/.\*mscfile.\*/)" } } }…

---

## [Filtering/aggregating by a timezone field in each document instead of the same timezone for all documents](https://discuss.elastic.co/t/filtering-aggregating-by-a-timezone-field-in-each-document-instead-of-the-same-timezone-for-all-documents/193003)

<div class="topic-metadata">

**Author:** [@oeed](https://discuss.elastic.co/u/oeed)\
**Replies:** 1\
**Last updated:** [August 2, 2019, 8:21pm UTC](https://discuss.elastic.co/t/filtering-aggregating-by-a-timezone-field-in-each-document-instead-of-the-same-timezone-for-all-documents/193003 "2019-08-02T20:21:36Z")

</div>

I'm fairly new to Elasticsearch so I'm not 100% sure it's appropriate for our use case, so let me know if it isn't. We are performing some basic analytics for exposure time from specific locations. I want to be able to …

---

## [Unable to parse json logs](https://discuss.elastic.co/t/unable-to-parse-json-logs/193143)

<div class="topic-metadata">

**Author:** [@Raghav\_Agrawal](https://discuss.elastic.co/u/Raghav_Agrawal)\
**Replies:** 1\
**Last updated:** [August 1, 2019, 12:28pm UTC](https://discuss.elastic.co/t/unable-to-parse-json-logs/193143 "2019-08-01T12:28:33Z")

</div>

2019-07-31T14:29:12.644Z DEBUG \[elasticsearch\] elasticsearch/client.go:507 Bulk item insert failed (i=12, status=500): {"type":"exception","reason":"java.lang.IllegalArgumentException: java.lang.IllegalArgumentException:…

---

## [Log level warning doesn't work](https://discuss.elastic.co/t/log-level-warning-doesnt-work/172709)

<div class="topic-metadata">

**Author:** [@Badb0y](https://discuss.elastic.co/u/Badb0y)\
**Replies:** 1\
**Last updated:** [March 18, 2019, 6:45pm UTC](https://discuss.elastic.co/t/log-level-warning-doesnt-work/172709 "2019-03-18T18:45:22Z")

</div>

I have this config file: filebeat.prospectors: - type: log enabled: true paths: - /var/log/messages - /var/log/secure - /var/log/audit/audit.log - /var/log/yum.log - /root/.bash\_history - /va…

---

## [\[SOLVED\] Parser-excel-elasticsearch - connection refused](https://discuss.elastic.co/t/solved-parser-excel-elasticsearch-connection-refused/116462)

<div class="topic-metadata">

**Author:** [@syiannop](https://discuss.elastic.co/u/syiannop)\
**Replies:** 1\
**Last updated:** [January 26, 2018, 12:58pm UTC](https://discuss.elastic.co/t/solved-parser-excel-elasticsearch-connection-refused/116462 "2018-01-26T12:58:28Z")

</div>

I was searching for a plugin to parse excel files into elasticsearch and I found this one. Running the application with the command written on github: java -Xmx1g -jar excelastic-1.2.3.jar \<filename\> \<index\> \<mapping\> …

---

## [How to access newly created custom events from logstash filter?](https://discuss.elastic.co/t/how-to-access-newly-created-custom-events-from-logstash-filter/27955)

<div class="topic-metadata">

**Author:** [@ankmathur14](https://discuss.elastic.co/u/ankmathur14)\
**Replies:** 1\
**Last updated:** [October 17, 2016, 3:17pm UTC](https://discuss.elastic.co/t/how-to-access-newly-created-custom-events-from-logstash-filter/27955 "2016-10-17T15:17:48Z")

</div>

Hi, I have created four custom events from a single original event in the ruby { } plugin of filter { }. I dropped the original event ( event.cancel ). I used yield LogStash::Event.new(data) to create new events…

---

## [\[ANNOUNCEMENT\] Burrowbeat released](https://discuss.elastic.co/t/announcement-burrowbeat-released/57249)

<div class="topic-metadata">

**Author:** [@bklise](https://discuss.elastic.co/u/bklise)\
**Replies:** 1\
**Last updated:** [August 4, 2016, 8:57pm UTC](https://discuss.elastic.co/t/announcement-burrowbeat-released/57249 "2016-08-04T20:57:54Z")

</div>

Burrowbeat, a beat that uses Burrow to monitor Kafka consumer lag, has been released. Burrowbeat is available at https://github.com/goomzee/burrowbeat

---

## [ElasticSearch 2.3.0 CORS](https://discuss.elastic.co/t/elasticsearch-2-3-0-cors/46701)

<div class="topic-metadata">

**Author:** [@Kleber\_Rocha](https://discuss.elastic.co/u/Kleber_Rocha)\
**Replies:** 1\
**Last updated:** [April 7, 2016, 2:44pm UTC](https://discuss.elastic.co/t/elasticsearch-2-3-0-cors/46701 "2016-04-07T14:44:35Z")

</div>

Hi, I'm trying configure CORS on ElasticSearch. But I have an error like this. \[2016-04-06 19:14:34,391\]\[WARN \]\[http.netty \] \[node\_1\_data\] Caught exception while handling client http traffic, closing co…

---

## [Basic Question : Can i convert unstructured Data into structured data for my analytical using logstash elasticsearch](https://discuss.elastic.co/t/basic-question-can-i-convert-unstructured-data-into-structured-data-for-my-analytical-using-logstash-elasticsearch/27306)

<div class="topic-metadata">

**Author:** [@rkhapre](https://discuss.elastic.co/u/rkhapre)\
**Replies:** 1\
**Last updated:** [August 13, 2015, 8:29am UTC](https://discuss.elastic.co/t/basic-question-can-i-convert-unstructured-data-into-structured-data-for-my-analytical-using-logstash-elasticsearch/27306 "2015-08-13T08:29:23Z")

</div>

Hi All I have a very basic question, i have a column in my mysql database which hold records like this below Cashflow 250 rate 12% year 2 NPV -34 Like this i have data jumbled in whole column which is like a tex…

---

## [Sort by created\_at not working](https://discuss.elastic.co/t/sort-by-created-at-not-working/16949)

<div class="topic-metadata">

**Author:** [@Martin\_Stabenfeldt](https://discuss.elastic.co/u/Martin_Stabenfeldt)\
**Replies:** 1\
**Last updated:** [April 11, 2014, 8:57am UTC](https://discuss.elastic.co/t/sort-by-created-at-not-working/16949 "2014-04-11T08:57:57Z")

</div>

Hi, I'm trying to fetch all Ads that are active and sort them by created\_at, but the order is the same with and without the sort params. Same order when I flip order from asc to desc. What am I doing wrong? :-|…

---

## [Maven build problem](https://discuss.elastic.co/t/maven-build-problem/4130)

<div class="topic-metadata">

**Author:** [@jason](https://discuss.elastic.co/u/jason)\
**Replies:** 1\
**Last updated:** [March 19, 2011, 1:20am UTC](https://discuss.elastic.co/t/maven-build-problem/4130 "2011-03-19T01:20:59Z")

</div>

Hi everybody, I am not sure what is wrong with my pom.xml file, but I am getting the following error when I execute "mvn clean install" from the command line. Project ID: org.elasticsearch:elasticsearch R…

---

## [Logstash jdbc input mantain sql row order](https://discuss.elastic.co/t/logstash-jdbc-input-mantain-sql-row-order/324470)

<div class="topic-metadata">

**Author:** [@Ricardo\_Canuto](https://discuss.elastic.co/u/Ricardo_Canuto)\
**Replies:** 8\
**Last updated:** [February 3, 2023, 2:51pm UTC](https://discuss.elastic.co/t/logstash-jdbc-input-mantain-sql-row-order/324470 "2023-02-03T14:51:27Z")

</div>

Hi, I'm new to logstash and I'm trying to check if an sql job (and its steps) runs successfully. The query gets the step 0 (job output) and all the steps that have errors or warnings. I want to gather all the steps…

---

## [Continuous index policy targeting specific data](https://discuss.elastic.co/t/continuous-index-policy-targeting-specific-data/243561)

<div class="topic-metadata">

**Author:** [@nickgregz](https://discuss.elastic.co/u/nickgregz)\
**Replies:** 8\
**Last updated:** [August 3, 2020, 3:01pm UTC](https://discuss.elastic.co/t/continuous-index-policy-targeting-specific-data/243561 "2020-08-03T15:01:20Z")

</div>

Hello, is it possibly to create an index policy that will continuously delete index data that is older than a certain time frame. Something like the TTL which was deprecated but enabled individual documents to be delet…

---

## [Temporarily adding nodes or, can you scale down?](https://discuss.elastic.co/t/temporarily-adding-nodes-or-can-you-scale-down/9111)

<div class="topic-metadata">

**Author:** [@Mohamed\_Lrhazi](https://discuss.elastic.co/u/Mohamed_Lrhazi)\
**Replies:** 8\
**Last updated:** [September 24, 2012, 11:14pm UTC](https://discuss.elastic.co/t/temporarily-adding-nodes-or-can-you-scale-down/9111 "2012-09-24T23:14:42Z")

</div>

Hello, I have not used elasticsearch before, but am considering it for a project. One question I have is this: Can you start off with a big number of nodes, in order to speed up the indexing of legacy data, the…

---

## [How to see total number of real documents while using nested type](https://discuss.elastic.co/t/how-to-see-total-number-of-real-documents-while-using-nested-type/5916)

<div class="topic-metadata">

**Author:** [@vineeth\_mohan](https://discuss.elastic.co/u/vineeth_mohan)\
**Replies:** 8\
**Last updated:** [November 21, 2011, 6:45pm UTC](https://discuss.elastic.co/t/how-to-see-total-number-of-real-documents-while-using-nested-type/5916 "2011-11-21T18:45:16Z")

</div>

Hi , While using nested types , i have noticed that number of documents shown in head interface is not exactly the number of documents which are really indexed. Some of the documents are actually documents created …

---

## [Unable to execute "Terms Facet " query](https://discuss.elastic.co/t/unable-to-execute-terms-facet-query/3151)

<div class="topic-metadata">

**Author:** [@vishal\_ingle](https://discuss.elastic.co/u/vishal_ingle)\
**Replies:** 8\
**Last updated:** [July 26, 2010, 1:00pm UTC](https://discuss.elastic.co/t/unable-to-execute-terms-facet-query/3151 "2010-07-26T13:00:59Z")

</div>

Hi, I am facing a problem with "terms facet". The document contains "userscore" and "userid" fields. I m sorting them on "userscore" field . I want two things from one query .1) top score 2) score of given userid …

---

## [Kibana 7.17.24 and 8.12.0 Security Update (ESA-2024-20)](https://discuss.elastic.co/t/kibana-7-17-24-and-8-12-0-security-update-esa-2024-20/377712)

<div class="topic-metadata">

**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\
**Replies:** 0\
**Last updated:** [May 1, 2025, 11:34am UTC](https://discuss.elastic.co/t/kibana-7-17-24-and-8-12-0-security-update-esa-2024-20/377712 "2025-05-01T11:34:47Z")

</div>

Kibana Unrestricted Upload of File with Dangerous Type Can Lead to XSS (ESA-2024-20) Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via…

---

## [I am trying to execute bulk query using Postman but getting an Error](https://discuss.elastic.co/t/i-am-trying-to-execute-bulk-query-using-postman-but-getting-an-error/340332)

<div class="topic-metadata">

**Author:** [@Subrato1](https://discuss.elastic.co/u/Subrato1)\
**Replies:** 3\
**Last updated:** [August 8, 2023, 2:33pm UTC](https://discuss.elastic.co/t/i-am-trying-to-execute-bulk-query-using-postman-but-getting-an-error/340332 "2023-08-08T14:33:05Z")

</div>

PUT /library/\_bulk?refresh {"index":{"\_id": "Leviathan Wakes"}} {"name": "Leviathan Wakes", "author": "James S.A. Corey", "release\_date": "2011-06-02", "page\_count": 561} {"index":{"\_id": "Hyperion"}} {"name": "Hyperion"…

---

## [Fleet Agent - CEF Integration - Is there any way to listen on TCP?](https://discuss.elastic.co/t/fleet-agent-cef-integration-is-there-any-way-to-listen-on-tcp/318915)

<div class="topic-metadata">

**Author:** [@scanlan](https://discuss.elastic.co/u/scanlan)\
**Replies:** 3\
**Last updated:** [November 15, 2022, 7:57am UTC](https://discuss.elastic.co/t/fleet-agent-cef-integration-is-there-any-way-to-listen-on-tcp/318915 "2022-11-15T07:57:52Z")

</div>

I'm ingesting CEF based logs from another SIEM and utilizing the "Common Event Format (CEF)" integration. It is only able to receive CEF events via input file, or via UDP listener. There is no TCP listener option. A…

---

## [What is the best model to save data on elasticsearch?](https://discuss.elastic.co/t/what-is-the-best-model-to-save-data-on-elasticsearch/307560)

<div class="topic-metadata">

**Author:** [@hadii](https://discuss.elastic.co/u/hadii)\
**Replies:** 3\
**Last updated:** [June 20, 2022, 9:50pm UTC](https://discuss.elastic.co/t/what-is-the-best-model-to-save-data-on-elasticsearch/307560 "2022-06-20T21:50:20Z")

</div>

I have a rails application and use Elasticsearch as a search engine in my rails app. this app collects data from the mobile application and could collect from any kind of mobile app. mobile app sends two types of data us…

---

## [What is the correct way to support Global search across multiple document types?](https://discuss.elastic.co/t/what-is-the-correct-way-to-support-global-search-across-multiple-document-types/291388)

<div class="topic-metadata">

**Author:** [@abm\_a](https://discuss.elastic.co/u/abm_a)\
**Replies:** 3\
**Last updated:** [December 11, 2021, 9:23am UTC](https://discuss.elastic.co/t/what-is-the-correct-way-to-support-global-search-across-multiple-document-types/291388 "2021-12-11T09:23:36Z")

</div>

Let's say in a Microservices architecture there are 100s of different entities and search needs to be supported that can look for matches in all those entities. I see a few ways of doing this. Create one index for each…

---

## [Benchmarck elastic cluster with rally](https://discuss.elastic.co/t/benchmarck-elastic-cluster-with-rally/279068)

<div class="topic-metadata">

**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\
**Replies:** 3\
**Last updated:** [August 1, 2021, 11:53pm UTC](https://discuss.elastic.co/t/benchmarck-elastic-cluster-with-rally/279068 "2021-08-01T23:53:04Z")

</div>

Hello, I am going to setup a Prod cluster, I receive 30GB of logs per day (Need to keep the data 1 month in Hot node and 11 months in warm node ) I did some maths, and I am going to use (3 hot nodes and 4 warm nodes ) …

---

## [Adding retry logic to java high level rest client](https://discuss.elastic.co/t/adding-retry-logic-to-java-high-level-rest-client/278950)

<div class="topic-metadata">

**Author:** [@Srinivasan\_Ramaswamy](https://discuss.elastic.co/u/Srinivasan_Ramaswamy)\
**Replies:** 0\
**Last updated:** [July 16, 2021, 11:51pm UTC](https://discuss.elastic.co/t/adding-retry-logic-to-java-high-level-rest-client/278950 "2021-07-16T23:51:05Z")

</div>

As requests over http can fail for various reasons, would it make sense to add some retry mechanism to high level rest client ? I see this : Retry Lifecycle Policy API | Java REST Client \[7.13\] | Elastic. Not sure about…

---

## [Shard Size is 50gb](https://discuss.elastic.co/t/shard-size-is-50gb/268441)

<div class="topic-metadata">

**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Replies:** 3\
**Last updated:** [March 27, 2021, 5:58am UTC](https://discuss.elastic.co/t/shard-size-is-50gb/268441 "2021-03-27T05:58:38Z")

</div>

I have an index called log-wlb-sysmon-2021.03.20-00002 and i am using ILM Policy for this index { "winlogbeat\_sysmon\_policy" : { "version" : 8, "modified\_date" : "2021-03-26T05:06:42.599Z", "policy" : { …

---

## [Kibana export API](https://discuss.elastic.co/t/kibana-export-api/253359)

<div class="topic-metadata">

**Author:** [@Carlos\_Fernando\_Palm](https://discuss.elastic.co/u/Carlos_Fernando_Palm)\
**Replies:** 3\
**Last updated:** [October 26, 2020, 9:42pm UTC](https://discuss.elastic.co/t/kibana-export-api/253359 "2020-10-26T21:42:35Z")

</div>

Hello, I am trying to export a canvas using this: Now the request requires a type, but when I set canvas it says {"statusCode":400,"error":"Bad Request","message":"Trying to export non-exportable type(s): \*"} Ther…

---

## [How to build a custom plugin for Kibana v7.9.0?](https://discuss.elastic.co/t/how-to-build-a-custom-plugin-for-kibana-v7-9-0/246060)

<div class="topic-metadata">

**Author:** [@trex](https://discuss.elastic.co/u/trex)\
**Replies:** 3\
**Last updated:** [August 24, 2020, 7:04pm UTC](https://discuss.elastic.co/t/how-to-build-a-custom-plugin-for-kibana-v7-9-0/246060 "2020-08-24T19:04:29Z")

</div>

I generated a new plugin using Kibana scripts node scripts/generate\_plugin.js aplugin. How to build a distributable .zip package for it? The one that can be installed like this ./bin/kibana-plugin install file:///plugi…

---

## [Not able to remove icon for Kibana 7.6.0](https://discuss.elastic.co/t/not-able-to-remove-icon-for-kibana-7-6-0/236279)

<div class="topic-metadata">

**Author:** [@richylyq](https://discuss.elastic.co/u/richylyq)\
**Replies:** 3\
**Last updated:** [June 9, 2020, 12:08pm UTC](https://discuss.elastic.co/t/not-able-to-remove-icon-for-kibana-7-6-0/236279 "2020-06-09T12:08:37Z")

</div>

Continuing the discussion from \[Guide\] Customize logo, text screen and loading in Kibana 7.x: Tried to use this example to remove the icon, but was not able to find the views folder here's what i am seeing in kibana/sr…

---

## [Combining Two Aggregations](https://discuss.elastic.co/t/combining-two-aggregations/211624)

<div class="topic-metadata">

**Author:** [@Calvin-J-Scott](https://discuss.elastic.co/u/Calvin-J-Scott)\
**Replies:** 0\
**Last updated:** [December 12, 2019, 10:53am UTC](https://discuss.elastic.co/t/combining-two-aggregations/211624 "2019-12-12T10:53:21Z")

</div>

Problem I am currently trying to combine two aggregations into a single aggregation response either directly in ElasticSearch if it allows or In Java using the elastic aggregations as a map. Elastic Approach Mapping "…

---

## [Can't get shape to render with correct color](https://discuss.elastic.co/t/cant-get-shape-to-render-with-correct-color/193552)

<div class="topic-metadata">

**Author:** [@rickardp](https://discuss.elastic.co/u/rickardp)\
**Replies:** 3\
**Last updated:** [August 5, 2019, 3:27pm UTC](https://discuss.elastic.co/t/cant-get-shape-to-render-with-correct-color/193552 "2019-08-05T15:27:06Z")

</div>

Just starting out with Canvas so bear with me :slight\_smile: I am trying to get a box colored based on status, and here's what I have so far filters | essql query="SELECT CASE WHEN LAST(\\"kubernetes.pod.status.phas…

---

## [1 minute initial 'load' with RUM/js agent 1.0 and APM server 6.4](https://discuss.elastic.co/t/1-minute-initial-load-with-rum-js-agent-1-0-and-apm-server-6-4/146124)

<div class="topic-metadata">

**Author:** [@peter.hanraets](https://discuss.elastic.co/u/peter.hanraets)\
**Replies:** 3\
**Last updated:** [August 30, 2018, 7:23am UTC](https://discuss.elastic.co/t/1-minute-initial-load-with-rum-js-agent-1-0-and-apm-server-6-4/146124 "2018-08-30T07:23:17Z")

</div>

I have setup a 6.4 APM server for testing RUM with the javascript code. I am testing this on an Atlassian Confluence instance using it's Custom HTML feature to load and initialize RUM. My apm-server.yml looks like this …

---

## [Why there're some decimals in kibana when I choose @timestamp per hour?](https://discuss.elastic.co/t/why-therere-some-decimals-in-kibana-when-i-choose-timestamp-per-hour/145481)

<div class="topic-metadata">

**Author:** [@Xiaomeng\_Bian](https://discuss.elastic.co/u/Xiaomeng_Bian)\
**Replies:** 3\
**Last updated:** [August 23, 2018, 3:31am UTC](https://discuss.elastic.co/t/why-therere-some-decimals-in-kibana-when-i-choose-timestamp-per-hour/145481 "2018-08-23T03:31:11Z")

</div>

:grinning:I have an index with about 10,000 csv data which contains timestamp, as I want to see the trend of count in one day, I choose @timestamp per hour in kibana, then I find that decimals appear in the histogram lik…

---

## [How to make a get request to retrieve the latest document of an index in the elasticsearch cluster?](https://discuss.elastic.co/t/how-to-make-a-get-request-to-retrieve-the-latest-document-of-an-index-in-the-elasticsearch-cluster/142828)

<div class="topic-metadata">

**Author:** [@APJ](https://discuss.elastic.co/u/APJ)\
**Replies:** 3\
**Last updated:** [August 3, 2018, 1:15am UTC](https://discuss.elastic.co/t/how-to-make-a-get-request-to-retrieve-the-latest-document-of-an-index-in-the-elasticsearch-cluster/142828 "2018-08-03T01:15:57Z")

</div>

I am developing a node.js application to get the latest value of an index from an elastic cluster. My logstash server pipes data to elasticsearch every second. So, the elasticsearch index gets updated every second. Eve…

---

## [Filebeat Client/Server Version Mismatch](https://discuss.elastic.co/t/filebeat-client-server-version-mismatch/134872)

<div class="topic-metadata">

**Author:** [@dieg0](https://discuss.elastic.co/u/dieg0)\
**Replies:** 3\
**Last updated:** [June 7, 2018, 2:08pm UTC](https://discuss.elastic.co/t/filebeat-client-server-version-mismatch/134872 "2018-06-07T14:08:49Z")

</div>

We have one server (A) running a docker cluster (Node.js and Elasticsearch) and a separate server (B) running ELK Stack. Logs should get shipped from Server A using filebet, it is installed independent from docker clust…

[Previous page](https://discuss.elastic.co/top.md?page=1684&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1686&per_page=50&period=all)
