# Top **URL:** https://discuss.elastic.co/top.md?page=1689&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1690 --- ## [Increase the number of splitting data on machine learning](https://discuss.elastic.co/t/increase-the-number-of-splitting-data-on-machine-learning/142371)
**Author:** [@Angelos](https://discuss.elastic.co/u/Angelos)\ **Replies:** 1\ **Last updated:** [July 31, 2018, 1:37pm UTC](https://discuss.elastic.co/t/increase-the-number-of-splitting-data-on-machine-learning/142371 "2018-07-31T13:37:10Z")
Hello, Is there any way to increase the result of splitting data in machine learning? Now, when you split the data in multi metric job, the result has a limit of 50 values(5, 10, 25, 50). Can we change that? Thank … --- ## [Data loss after network disconnect](https://discuss.elastic.co/t/data-loss-after-network-disconnect/19709)
**Author:** [@Israel\_Tsadok](https://discuss.elastic.co/u/Israel_Tsadok)\ **Replies:** 1\ **Last updated:** [September 12, 2014, 5:22pm UTC](https://discuss.elastic.co/t/data-loss-after-network-disconnect/19709 "2014-09-12T17:22:34Z")
A temporary network disconnect of the master node caused a torrent of RELOCATING shards, and then one shard remained UNASSIGNED and the cluster state was left red. looking inside the index directory for the shard on… --- ## [Timelion](https://discuss.elastic.co/t/timelion/241889)
**Author:** [@g\_k\_b](https://discuss.elastic.co/u/g_k_b)\ **Replies:** 6\ **Last updated:** [July 24, 2020, 8:03am UTC](https://discuss.elastic.co/t/timelion/241889 "2020-07-24T08:03:15Z")
Hi everyone, I'm using Timelion and wht I would love to do now is setting a different color for data with timestamp from 9pm to 7am. How can I write the query? I read about the syntax FROM...TO but the examples I foun… --- ## [Get timestamp from "embedded" syslog entry](https://discuss.elastic.co/t/get-timestamp-from-embedded-syslog-entry/169194)
**Author:** [@Hyllegaard](https://discuss.elastic.co/u/Hyllegaard)\ **Replies:** 6\ **Last updated:** [February 20, 2019, 10:01pm UTC](https://discuss.elastic.co/t/get-timestamp-from-embedded-syslog-entry/169194 "2019-02-20T22:01:15Z")
Hi. We have just started using the ELK stack, so please excuse the noobiness of these questions :slight\_smile: and we have a situation where we have to use syslog to forward the logs from a SOLR server. The format of … --- ## [Turning 1 node off kills whole cluster](https://discuss.elastic.co/t/turning-1-node-off-kills-whole-cluster/134253)
**Author:** [@kurtiskurtis](https://discuss.elastic.co/u/kurtiskurtis)\ **Replies:** 1\ **Last updated:** [June 2, 2018, 9:57am UTC](https://discuss.elastic.co/t/turning-1-node-off-kills-whole-cluster/134253 "2018-06-02T09:57:32Z")
While investigating an outage on our production cluster, I noticed that if I turn off one of the data nodes, it kills the entire cluster. The cluster immediately becomes operational when I turn it back on. What is going… --- ## [Shrink and split APIs](https://discuss.elastic.co/t/shrink-and-split-apis/308752)
**Author:** [@ewolfman](https://discuss.elastic.co/u/ewolfman)\ **Replies:** 4\ **Last updated:** [July 4, 2022, 9:42pm UTC](https://discuss.elastic.co/t/shrink-and-split-apis/308752 "2022-07-04T21:42:57Z")
Hi, I tried the shrink API on a 30GB index and shrinked from 15 shards to 5 shards. What I am not sure about is that this seemed to have happened instantaneously. I checked the \_cat/recovery endpoint and saw that ther… --- ## [Is it possible to search in random files with random texts in it with Elastic Search?](https://discuss.elastic.co/t/is-it-possible-to-search-in-random-files-with-random-texts-in-it-with-elastic-search/289863)
**Author:** [@Sahin\_Kasap](https://discuss.elastic.co/u/Sahin_Kasap)\ **Replies:** 4\ **Last updated:** [November 23, 2021, 8:25am UTC](https://discuss.elastic.co/t/is-it-possible-to-search-in-random-files-with-random-texts-in-it-with-elastic-search/289863 "2021-11-23T08:25:48Z")
Hello, I am developing a backend and I have big pdf files(~20 MB), which I want to search words inside. I could upload the texts inside them to Sql or somewhere and search inside them, but this would be slow and pdf's h… --- ## [Appsearch support for large attachments](https://discuss.elastic.co/t/appsearch-support-for-large-attachments/287104)
**Author:** [@Michael\_Sor](https://discuss.elastic.co/u/Michael_Sor)\ **Replies:** 4\ **Last updated:** [October 22, 2021, 6:03pm UTC](https://discuss.elastic.co/t/appsearch-support-for-large-attachments/287104 "2021-10-22T18:03:00Z")
We are trying to figure the best solution for handling attachments with Appsearch. I saw a thread regarding a hard 10MB limit for file. To overcome Appsearch limitation is to build a custom intermediary solution to parse… --- ## [Percentage calculation in kibana using json Inputs](https://discuss.elastic.co/t/percentage-calculation-in-kibana-using-json-inputs/285234)
**Author:** [@Nijanthan](https://discuss.elastic.co/u/Nijanthan)\ **Replies:** 4\ **Last updated:** [October 12, 2021, 9:06am UTC](https://discuss.elastic.co/t/percentage-calculation-in-kibana-using-json-inputs/285234 "2021-10-12T09:06:49Z")
How to calculate the failure percentage in kibana using the json inputs ? Like the failure is NOT statusCode:200 and success is statusCode:200. I need to calculate (failure/total)\*100 --- ## [Display top value of counter rate of nested fields](https://discuss.elastic.co/t/display-top-value-of-counter-rate-of-nested-fields/283276)
**Author:** [@Benoti](https://discuss.elastic.co/u/Benoti)\ **Replies:** 4\ **Last updated:** [September 13, 2021, 11:40am UTC](https://discuss.elastic.co/t/display-top-value-of-counter-rate-of-nested-fields/283276 "2021-09-13T11:40:04Z")
Hello there, I an in the midle of adding some SNMP monitoring data to our Elastic stack and I cannot find a good way to display the data in Kibana's dashboard. I use logstash snmp input plugin and, thanks to this threa… --- ## [How to write query in Dev tools to find expired date of customers by comparing current date?](https://discuss.elastic.co/t/how-to-write-query-in-dev-tools-to-find-expired-date-of-customers-by-comparing-current-date/275663)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 4\ **Last updated:** [June 15, 2021, 9:32am UTC](https://discuss.elastic.co/t/how-to-write-query-in-dev-tools-to-find-expired-date-of-customers-by-comparing-current-date/275663 "2021-06-15T09:32:08Z")
I have a index that contains date field of customers that contains date of customers to be expired. Now my task is you to compare that date with current date(dynamically) changes as current date change gives result "expi… --- ## [Kibana Watcher action failed: specified foreach object was null](https://discuss.elastic.co/t/kibana-watcher-action-failed-specified-foreach-object-was-null/272817)
**Author:** [@pavank](https://discuss.elastic.co/u/pavank)\ **Replies:** 4\ **Last updated:** [May 18, 2021, 10:35am UTC](https://discuss.elastic.co/t/kibana-watcher-action-failed-specified-foreach-object-was-null/272817 "2021-05-18T10:35:27Z")
I'm using ELK 7.9. I have configured Watchers to trigger Webhook action. I'm trying to add a foreach function to trigger webhooks for each recorded application errors. I'm getting error when trying to execute. Watcher … --- ## [Is there a way to configure filebeat to send certain logs as quick as possible?](https://discuss.elastic.co/t/is-there-a-way-to-configure-filebeat-to-send-certain-logs-as-quick-as-possible/266979)
**Author:** [@dmitryyankowski](https://discuss.elastic.co/u/dmitryyankowski)\ **Replies:** 4\ **Last updated:** [March 11, 2021, 6:45pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-configure-filebeat-to-send-certain-logs-as-quick-as-possible/266979 "2021-03-11T18:45:02Z")
I'm wondering if there is a way to get Filebeat to report specific logs as soon as possible.. rather than waiting for the minimum amount of events to send in a batch. For example: I have a security detection setup, t… --- ## [Does FSCRAWLER update rate include all documents or only those modified?](https://discuss.elastic.co/t/does-fscrawler-update-rate-include-all-documents-or-only-those-modified/233060)
**Author:** [@Denn](https://discuss.elastic.co/u/Denn)\ **Replies:** 4\ **Last updated:** [May 19, 2020, 11:59am UTC](https://discuss.elastic.co/t/does-fscrawler-update-rate-include-all-documents-or-only-those-modified/233060 "2020-05-19T11:59:56Z")
I have left the update rate to the default 15 in FSCRAWLER. name: "index" fs: update\_rate: "15m" Would like to know if the new scanning cycle after 15 min is for all documents or only for modified documents after the… --- ## [Aggregate. Merging two messages in different order](https://discuss.elastic.co/t/aggregate-merging-two-messages-in-different-order/226423)
**Author:** [@Ilya\_Kornienko](https://discuss.elastic.co/u/Ilya_Kornienko)\ **Replies:** 4\ **Last updated:** [April 6, 2020, 4:51pm UTC](https://discuss.elastic.co/t/aggregate-merging-two-messages-in-different-order/226423 "2020-04-06T16:51:29Z")
Hello everyone! Filebeat 7.6.1 -\> logstash 7.6.1 Filebeat reads logfiles, processes multiline and sends to logstesh. (all OK) But at the time of file rotation, the filebeat cuts the message into two parts, the first i… --- ## [Multiline codec not picking up custom patterns](https://discuss.elastic.co/t/multiline-codec-not-picking-up-custom-patterns/189426)
**Author:** [@Sous\_Lesquels](https://discuss.elastic.co/u/Sous_Lesquels)\ **Replies:** 4\ **Last updated:** [July 9, 2019, 4:18pm UTC](https://discuss.elastic.co/t/multiline-codec-not-picking-up-custom-patterns/189426 "2019-07-09T16:18:56Z")
With this config: input { file { codec =\> multiline { ... patterns\_dir =\> \[ '/path/to/patterns' \] ... } } } and the existing / readable file: /path/to/patter… --- ## [How my logs are stored in elasticsearch UTC or IST](https://discuss.elastic.co/t/how-my-logs-are-stored-in-elasticsearch-utc-or-ist/177292)
**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Replies:** 4\ **Last updated:** [May 6, 2019, 12:21pm UTC](https://discuss.elastic.co/t/how-my-logs-are-stored-in-elasticsearch-utc-or-ist/177292 "2019-05-06T12:21:10Z")
I want to know how my logs are stored in elasticsearch IST or UTC Regards --- ## [Log view does not refresh if no filters exists](https://discuss.elastic.co/t/log-view-does-not-refresh-if-no-filters-exists/169378)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 4\ **Last updated:** [February 22, 2019, 8:03pm UTC](https://discuss.elastic.co/t/log-view-does-not-refresh-if-no-filters-exists/169378 "2019-02-22T20:03:21Z")
Hello, We have encountered a problem in kibana 6.6.0. When want to see live stream on logview having collecting logs from multiple environments the logview does not refresh. While we can see new logs coming into the log… --- ## [Problem due to number of fields limitation in ES 5.5.2](https://discuss.elastic.co/t/problem-due-to-number-of-fields-limitation-in-es-5-5-2/97508)
**Author:** [@karthiga\_sivaraman](https://discuss.elastic.co/u/karthiga_sivaraman)\ **Replies:** 4\ **Last updated:** [August 28, 2017, 4:08am UTC](https://discuss.elastic.co/t/problem-due-to-number-of-fields-limitation-in-es-5-5-2/97508 "2017-08-28T04:08:27Z")
Currently in production environment we are using ES-2.4.1 with our own dynamic mapping ( our data in ES is Graph JSON ) . The max document count in Index as-if now is 4,29,890 with n-number of fields. Now we are plannin… --- ## [Non indexed fields are not selectable in the metrics section of the visualisation editor](https://discuss.elastic.co/t/non-indexed-fields-are-not-selectable-in-the-metrics-section-of-the-visualisation-editor/80700)
**Author:** [@imaad](https://discuss.elastic.co/u/imaad)\ **Replies:** 4\ **Last updated:** [March 31, 2017, 2:08pm UTC](https://discuss.elastic.co/t/non-indexed-fields-are-not-selectable-in-the-metrics-section-of-the-visualisation-editor/80700 "2017-03-31T14:08:53Z")
Hello, I'm working on time series database. I set the mapping of all my numeric fields to "index": "no" in order to reduce the size of my index, as I only want to perform aggregations on them. Filtering or searching is … --- ## [Is there some tests/articles to describe the relation between index performance/shard number and search performance/shard number under certain resource?](https://discuss.elastic.co/t/is-there-some-tests-articles-to-describe-the-relation-between-index-performance-shard-number-and-search-performance-shard-number-under-certain-resource/60254)
**Author:** [@makeyang](https://discuss.elastic.co/u/makeyang)\ **Replies:** 4\ **Last updated:** [September 12, 2016, 10:47am UTC](https://discuss.elastic.co/t/is-there-some-tests-articles-to-describe-the-relation-between-index-performance-shard-number-and-search-performance-shard-number-under-certain-resource/60254 "2016-09-12T10:47:22Z")
given certaion resource, what the index/search performnce when shard number are changed? --- ## [The value in this field is too long and cannot be searched or filtered](https://discuss.elastic.co/t/the-value-in-this-field-is-too-long-and-cannot-be-searched-or-filtered/360699)
**Author:** [@Subrahmanyam\_Veerank](https://discuss.elastic.co/u/Subrahmanyam_Veerank)\ **Replies:** 1\ **Last updated:** [July 12, 2024, 5:00pm UTC](https://discuss.elastic.co/t/the-value-in-this-field-is-too-long-and-cannot-be-searched-or-filtered/360699 "2024-07-12T17:00:44Z")
In the kibana discover the sql\_query field is there which is of type keyword and it is not displaying in the dashboard and when i checked in the discover it is showing as ignored value. How to resolve this issue? Kindly … --- ## [How to run logstash on WSL (Ubuntu 20.04.3 LTS)](https://discuss.elastic.co/t/how-to-run-logstash-on-wsl-ubuntu-20-04-3-lts/289414)
**Author:** [@Stephy\_Jacob](https://discuss.elastic.co/u/Stephy_Jacob)\ **Replies:** 1\ **Last updated:** [November 17, 2021, 9:43am UTC](https://discuss.elastic.co/t/how-to-run-logstash-on-wsl-ubuntu-20-04-3-lts/289414 "2021-11-17T09:43:39Z")
Hi, Could you please help with running logstash as a service in WSL (Ubuntu 20.04.3 LTS) As of now I get below error message sudo systemctl start logstash.service System has not been booted with systemd as init system… --- ## [Watcher using filter range with time does not fire](https://discuss.elastic.co/t/watcher-using-filter-range-with-time-does-not-fire/244998)
**Author:** [@ajazam](https://discuss.elastic.co/u/ajazam)\ **Replies:** 1\ **Last updated:** [August 21, 2020, 8:37am UTC](https://discuss.elastic.co/t/watcher-using-filter-range-with-time-does-not-fire/244998 "2020-08-21T08:37:53Z")
Hello. I have been trying to write a Watcher that looks for specific conditions in data and then send out an email, but it doesn't work. I have managed to shrink the Watcher down to a bare minimum and have found out that… --- ## [Accessing Kibana using hostname or IP address](https://discuss.elastic.co/t/accessing-kibana-using-hostname-or-ip-address/168497)
**Author:** [@dips](https://discuss.elastic.co/u/dips)\ **Replies:** 1\ **Last updated:** [February 16, 2019, 2:38am UTC](https://discuss.elastic.co/t/accessing-kibana-using-hostname-or-ip-address/168497 "2019-02-16T02:38:36Z")
I have ELK stack setup on localhost. I recently installed apache web server on my Ubuntu and its working fine. I can access apache default page using my IP address. But I want to access Kibana using my IP address or host… --- ## [View surrounding documents in Dashboard](https://discuss.elastic.co/t/view-surrounding-documents-in-dashboard/138720)
**Author:** [@lokeshdotp](https://discuss.elastic.co/u/lokeshdotp)\ **Replies:** 1\ **Last updated:** [July 5, 2018, 2:26pm UTC](https://discuss.elastic.co/t/view-surrounding-documents-in-dashboard/138720 "2018-07-05T14:26:23Z")
Hi Forum Is there a way to add the "View surrounding documents" view to the Kibana Dashboard? If so, can anyone please point me to the details on how to do it? Thanks Lokesh --- ## [Beats\_input\_codec\_json\_applied in tags](https://discuss.elastic.co/t/beats-input-codec-json-applied-in-tags/58427)
**Author:** [@ShaneC-C-Y](https://discuss.elastic.co/u/ShaneC-C-Y)\ **Replies:** 1\ **Last updated:** [August 19, 2016, 7:12am UTC](https://discuss.elastic.co/t/beats-input-codec-json-applied-in-tags/58427 "2016-08-19T07:12:23Z")
This is the same issue here (https://github.com/logstash-plugins/logstash-input-beats/issues/58 ) Every event will be add a tag beats\_input\_codec\_json\_applied if I specify the codec in input config file. Is there any w… --- ## [GUI available for watcher?](https://discuss.elastic.co/t/gui-available-for-watcher/52044)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 1\ **Last updated:** [June 7, 2016, 9:57am UTC](https://discuss.elastic.co/t/gui-available-for-watcher/52044 "2016-06-07T09:57:07Z")
Hi, we are thinking about using watcher. Are the alerts needed to be configured / written by configuration files, or is a GUI available / included, which allows less experienced users to create them. Thanks in advanc… --- ## [Match Wildcard Fallback](https://discuss.elastic.co/t/match-wildcard-fallback/2554)
**Author:** [@CalEuanHopkins](https://discuss.elastic.co/u/CalEuanHopkins)\ **Replies:** 1\ **Last updated:** [June 12, 2015, 12:08pm UTC](https://discuss.elastic.co/t/match-wildcard-fallback/2554 "2015-06-12T12:08:10Z")
Does anyone know if it's possible to run a bool query with match conditions and if no results are found, run a new bool query but with wildcard conditions? Can I achieve this by adding wildcard conditions to the should b… --- ## [Titre : Erreur 500 lors de l'ouverture d'un job d'anomalie dans Elasticsearch : échec du lancement d'autodetect](https://discuss.elastic.co/t/titre-erreur-500-lors-de-louverture-dun-job-danomalie-dans-elasticsearch-echec-du-lancement-dautodetect/330375)
**Author:** [@LeS01ia](https://discuss.elastic.co/u/LeS01ia)\ **Replies:** 3\ **Last updated:** [April 20, 2023, 2:21pm UTC](https://discuss.elastic.co/t/titre-erreur-500-lors-de-louverture-dun-job-danomalie-dans-elasticsearch-echec-du-lancement-dautodetect/330375 "2023-04-20T14:21:10Z")
Contenu : Bonjour à tous, Je rencontre un problème avec Elasticsearch lorsque j'essaie d'ouvrir un job d'anomalie. Je reçois une erreur 500 avec le message suivant :\* "statusCode": 500, "error": "Internal Server Erro… --- ## [Confg \`setup.template.settings.index.lifecycle.name\` is not working](https://discuss.elastic.co/t/confg-setup-template-settings-index-lifecycle-name-is-not-working/166253)
**Author:** [@kimxogus](https://discuss.elastic.co/u/kimxogus)\ **Replies:** 3\ **Last updated:** [February 7, 2019, 5:31am UTC](https://discuss.elastic.co/t/confg-setup-template-settings-index-lifecycle-name-is-not-working/166253 "2019-02-07T05:31:57Z")
I'm using official filebeat and metricbeat docker image in kubernetes. I set setup.template.settings.index.lifecycle.name config as log-policy and checked that config is properly set in beat pods, but log shows 2019-01… --- ## [Error when providing AppState to an embeded visualization](https://discuss.elastic.co/t/error-when-providing-appstate-to-an-embeded-visualization/106231)
**Author:** [@havidarou](https://discuss.elastic.co/u/havidarou)\ **Replies:** 3\ **Last updated:** [November 3, 2017, 11:25am UTC](https://discuss.elastic.co/t/error-when-providing-appstate-to-an-embeded-visualization/106231 "2017-11-03T11:25:39Z")
Hi, I am trying to provide an AppState to an embedded visualization: visualizeLoader.embedVisualizationWithId(visContainer, $scope.selectedVisualization, { timeRange: timeRange, appState: AppState }).then(han… --- ## [Send SQL script by filebeat](https://discuss.elastic.co/t/send-sql-script-by-filebeat/85387)
**Author:** [@emilio](https://discuss.elastic.co/u/emilio)\ **Replies:** 3\ **Last updated:** [May 16, 2017, 12:32pm UTC](https://discuss.elastic.co/t/send-sql-script-by-filebeat/85387 "2017-05-16T12:32:50Z")
Dear all, I need to send SQL script by filebeat to ES. How can i configure it through filebeat config? --- ## [My flux capacitor is broke - I.E. Elasticsearch index is in the future](https://discuss.elastic.co/t/my-flux-capacitor-is-broke-i-e-elasticsearch-index-is-in-the-future/24095)
**Author:** [@Don\_Pich](https://discuss.elastic.co/u/Don_Pich)\ **Replies:** 3\ **Last updated:** [June 22, 2015, 2:34pm UTC](https://discuss.elastic.co/t/my-flux-capacitor-is-broke-i-e-elasticsearch-index-is-in-the-future/24095 "2015-06-22T14:34:28Z")
My cluster has been suffering for a while. It will go through the rebuild process and then it will end up in a red state. In diagnosing the issue, I looked through the indexes. I was amazed to find a bunch of indexes … --- ## [\[Filebeat IIS\] lumberjack protocol error](https://discuss.elastic.co/t/filebeat-iis-lumberjack-protocol-error/175210)
**Author:** [@nyarlath](https://discuss.elastic.co/u/nyarlath)\ **Replies:** 2\ **Last updated:** [April 16, 2019, 7:28am UTC](https://discuss.elastic.co/t/filebeat-iis-lumberjack-protocol-error/175210 "2019-04-16T07:28:19Z")
Hello all, I have filebeat installed on two windows 2008R2 servers with IIS 7.5. My filebeat log file is polluted by this kind of entries: |INFO|log/input.go:138|Configured paths: \[C:\\inetpub\\logs\\LogFiles\\\*\\\*.log\]| … --- ## [LogsDB optimized routing](https://discuss.elastic.co/t/logsdb-optimized-routing/382278)
**Author:** [@lduvnjak](https://discuss.elastic.co/u/lduvnjak)\ **Replies:** 8\ **Last updated:** [October 13, 2025, 12:36pm UTC](https://discuss.elastic.co/t/logsdb-optimized-routing/382278 "2025-10-13T12:36:42Z")
Hi Everyone, I have a couple of questions regarding LogsDB, and more specifically optimized routing. It is generally recommended to use low cardinality fields for LogsDB index sorting, but there are no pointers on what… --- ## [Module for Hardware Monitoring - iDRAC and iLO](https://discuss.elastic.co/t/module-for-hardware-monitoring-idrac-and-ilo/275609)
**Author:** [@albertosoares](https://discuss.elastic.co/u/albertosoares)\ **Replies:** 0\ **Last updated:** [June 10, 2021, 6:23pm UTC](https://discuss.elastic.co/t/module-for-hardware-monitoring-idrac-and-ilo/275609 "2021-06-10T18:23:25Z")
Hello, I would like to collect data from iDRAC and iLO. My intention is to send Syslog messages to Elasticsearch, but before I do it, I would like to know if there are other ways to do it. For example, a module of logst… --- ## [How should I denormalize my data?](https://discuss.elastic.co/t/how-should-i-denormalize-my-data/186379)
**Author:** [@beginner99](https://discuss.elastic.co/u/beginner99)\ **Replies:** 0\ **Last updated:** [June 19, 2019, 6:04am UTC](https://discuss.elastic.co/t/how-should-i-denormalize-my-data/186379 "2019-06-19T06:04:57Z")
Hi all, I'm new to elasticsearch and having trouble to come up with a data model for the index (or maybe I shall create multiple indices?). My data is hierarchical as I have grandparent-parent-child-grandchildren. As a… --- ## [Problem with rounding value of avg calculation](https://discuss.elastic.co/t/problem-with-rounding-value-of-avg-calculation/79036)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 0\ **Last updated:** [March 17, 2017, 2:05pm UTC](https://discuss.elastic.co/t/problem-with-rounding-value-of-avg-calculation/79036 "2017-03-17T14:05:54Z")
Hi, I call elasticsearch api via curl from a shell script. Using following aggregation returns sometimes very little values like 8.058358080730823\*\*e-15\*\*. "aggs": { "1": { "avg": { "field": "… --- ## [Logstash file input plugin: missing first lines after log rotation](https://discuss.elastic.co/t/logstash-file-input-plugin-missing-first-lines-after-log-rotation/287112)
**Author:** [@adminunix](https://discuss.elastic.co/u/adminunix)\ **Replies:** 2\ **Last updated:** [October 25, 2021, 1:56pm UTC](https://discuss.elastic.co/t/logstash-file-input-plugin-missing-first-lines-after-log-rotation/287112 "2021-10-25T13:56:26Z")
Hello, I´m using logstash with a pipeline that collects logs with the file input plugin. Everything works fine, but when log files are rotated, logstash doesn´t collect some of the first few lines of the new log file. T… --- ## [Threshold detection not working with group by](https://discuss.elastic.co/t/threshold-detection-not-working-with-group-by/274362)
**Author:** [@Billz1026](https://discuss.elastic.co/u/Billz1026)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 3:57am UTC](https://discuss.elastic.co/t/threshold-detection-not-working-with-group-by/274362 "2021-05-31T03:57:27Z")
Hi All, I am using Elastic version 7.12. I want to create a detection rule based on the threshold. My requirements is as follows. Identify possible Bruteforce attack coming from same source IP. If there are more than … --- ## [How do I disable enterprise search in Kibana 7.10.2?](https://discuss.elastic.co/t/how-do-i-disable-enterprise-search-in-kibana-7-10-2/273147)
**Author:** [@ravi\_yadav2](https://discuss.elastic.co/u/ravi_yadav2)\ **Replies:** 2\ **Last updated:** [May 17, 2021, 5:44pm UTC](https://discuss.elastic.co/t/how-do-i-disable-enterprise-search-in-kibana-7-10-2/273147 "2021-05-17T17:44:49Z")
Are there configuration settings for kibana.yml that we can use to disable this feature? If Not how can I disable it? --- ## [Query does not return any information -- Problem with Kibana Query Language](https://discuss.elastic.co/t/query-does-not-return-any-information-problem-with-kibana-query-language/239476)
**Author:** [@cleared\_blue\_sky](https://discuss.elastic.co/u/cleared_blue_sky)\ **Replies:** 2\ **Last updated:** [July 1, 2020, 3:08pm UTC](https://discuss.elastic.co/t/query-does-not-return-any-information-problem-with-kibana-query-language/239476 "2020-07-01T15:08:28Z")
Hi all, I'm struggling with KQL recently. I have tried so many different styles of queries but I cannot, for some reason, get this query to match logs that do exist. I am trying to match all logs that contain the word … --- ## [Reindexing Error while changing the type for fields](https://discuss.elastic.co/t/reindexing-error-while-changing-the-type-for-fields/211848)
**Author:** [@kumar6](https://discuss.elastic.co/u/kumar6)\ **Replies:** 2\ **Last updated:** [December 18, 2019, 7:20pm UTC](https://discuss.elastic.co/t/reindexing-error-while-changing-the-type-for-fields/211848 "2019-12-18T19:20:14Z")
I changed the type to integer from string for some of the fields in td-agent(similar to logstash). I started seeing Mapping conflict in Kibana. Error in Kibana: 2 fields are defined as several types (string, integer, … --- ## [Metricbeat won't connect to Logstash over network](https://discuss.elastic.co/t/metricbeat-wont-connect-to-logstash-over-network/191239)
**Author:** [@johnbchron](https://discuss.elastic.co/u/johnbchron)\ **Replies:** 2\ **Last updated:** [July 19, 2019, 5:38pm UTC](https://discuss.elastic.co/t/metricbeat-wont-connect-to-logstash-over-network/191239 "2019-07-19T17:38:42Z")
Hello all, I have set up a full installation of the elastic stack (full for me, filebeat-logstash-elasticsearch-kibana) on ubuntu 18.04, and it was working perfectly but I need metricbeat to send logs from a local windo… --- ## [Best way to export Index data(10 million) from elastic search to custom json format](https://discuss.elastic.co/t/best-way-to-export-index-data-10-million-from-elastic-search-to-custom-json-format/188265)
**Author:** [@SudevPK](https://discuss.elastic.co/u/SudevPK)\ **Replies:** 2\ **Last updated:** [July 1, 2019, 9:14am UTC](https://discuss.elastic.co/t/best-way-to-export-index-data-10-million-from-elastic-search-to-custom-json-format/188265 "2019-07-01T09:14:01Z")
Sample index data { "\_index" : "sampleindex", "\_type" : "\_doc", "\_id" : "196575730", "\_version" : 2, "\_seq\_no" : 2230396, "\_primary\_term" : 1, "found" : true, "\_source" : { "id" : 19657, "name" : "wer\_1212", … --- ## [How to iterate and convert numbers to million/billion in Kibana watcher?](https://discuss.elastic.co/t/how-to-iterate-and-convert-numbers-to-million-billion-in-kibana-watcher/170548)
**Author:** [@MrGetfit1234](https://discuss.elastic.co/u/MrGetfit1234)\ **Replies:** 2\ **Last updated:** [March 15, 2019, 3:37pm UTC](https://discuss.elastic.co/t/how-to-iterate-and-convert-numbers-to-million-billion-in-kibana-watcher/170548 "2019-03-15T15:37:05Z")
hi, I am writing a Kibana watcher which sends a daily email aggregating number of log events collected on a 24 hour period. In the body of the email it should give a summary of how many unique ip's contributed and how ma… --- ## [Logstash Plugin이 존재하지 않는 개인적인 로그 포맷을 ElasticSearch에 올리는 과정](https://discuss.elastic.co/t/logstash-plugin-elasticsearch/145647)
**Author:** [@wonki](https://discuss.elastic.co/u/wonki)\ **Replies:** 2\ **Last updated:** [August 23, 2018, 5:59am UTC](https://discuss.elastic.co/t/logstash-plugin-elasticsearch/145647 "2018-08-23T05:59:31Z")
안녕하세요. 개인적인 로그 포맷을 Logstash에서 파싱을 하여 ElasticSearch에 올리고자 하는데 질문이 있습니다. 우선 제 로그 포맷은 이렇습니다. 포맷: 시간 Level \[servername\] \[From, To, msgId, brand\] pid msg 예시: 2018-08-22 12:13:42.123 INFO \[SampleServer\] \[SampleServer,Sampl… --- ## [Not able to search a specific string](https://discuss.elastic.co/t/not-able-to-search-a-specific-string/106619)
**Author:** [@Telstra\_Aus](https://discuss.elastic.co/u/Telstra_Aus)\ **Replies:** 2\ **Last updated:** [November 8, 2017, 7:40am UTC](https://discuss.elastic.co/t/not-able-to-search-a-specific-string/106619 "2017-11-08T07:40:24Z")
Hi, My ELK has system logs but when i try to search for exception with its name its showing 0 results, I can see the exception name in the message. ------------message(in Kibana dashboard)------------- ####\ **Author:** [@ppuschmann](https://discuss.elastic.co/u/ppuschmann)\ **Replies:** 2\ **Last updated:** [May 30, 2016, 7:20am UTC](https://discuss.elastic.co/t/logstash-and-multiple-outputs-how-can-i-circumvent-unreliable-outputs/51159 "2016-05-30T07:20:18Z") Hi, in a test scenario (still using Logstash 1.5) we like to push logevents to two separate outputs. The first one is 'elasticsearch' the second one shall be 'redis'. Right now we experience errors in the whole Logst… [Previous page](https://discuss.elastic.co/top.md?page=1688&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1690&per_page=50&period=all)