# Top

**URL:** https://discuss.elastic.co/top.md?page=172&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 173

---

## [Problem with logstash DNS resolver plugin](https://discuss.elastic.co/t/problem-with-logstash-dns-resolver-plugin/198447)

<div class="topic-metadata">

**Author:** [@BeMoore](https://discuss.elastic.co/u/BeMoore)\
**Replies:** 10\
**Last updated:** [September 9, 2019, 2:42pm UTC](https://discuss.elastic.co/t/problem-with-logstash-dns-resolver-plugin/198447 "2019-09-09T14:42:26Z")

</div>

So i'm trying out ELK to see if it can compare to an existing product we're using internally and i've hit a problem i can't get around. I have a bunch of IP addresses that i've gotten from a csv file and stripped out ev…

---

## [Ann: ElasticSearch Hunspell Analysis plugin](https://discuss.elastic.co/t/ann-elasticsearch-hunspell-analysis-plugin/6253)

<div class="topic-metadata">

**Author:** [@jprante](https://discuss.elastic.co/u/jprante)\
**Replies:** 11\
**Last updated:** [January 26, 2012, 4:56pm UTC](https://discuss.elastic.co/t/ann-elasticsearch-hunspell-analysis-plugin/6253 "2012-01-26T16:56:56Z")

</div>

Hi, because all of you are eager to keep up with Lucene 3.5 features, I just wrote an ElasticSearch Hunspell Analysis plugin. Project URL: https://github.com/jprante/elasticsearch-analysis-hunspell For discus…

---

## [Mapping types \_type or type or both](https://discuss.elastic.co/t/mapping-types-type-or-type-or-both/166359)

<div class="topic-metadata">

**Author:** [@gormanst](https://discuss.elastic.co/u/gormanst)\
**Replies:** 10\
**Last updated:** [January 30, 2019, 3:28pm UTC](https://discuss.elastic.co/t/mapping-types-type-or-type-or-both/166359 "2019-01-30T15:28:15Z")

</div>

Is type, as used below, being removed from elasticsearch? PUT \_template/dogpound\_mpds { "index\_patterns": \["dogpound\_mpds\*"\], "mappings" : { "\_doc" : { "dynamic": "true", "properties": { "t…

---

## [Can't get the java client to connect to the ES server when both are on my computer](https://discuss.elastic.co/t/cant-get-the-java-client-to-connect-to-the-es-server-when-both-are-on-my-computer/6490)

<div class="topic-metadata">

**Author:** [@Ittai\_Zeidman](https://discuss.elastic.co/u/Ittai_Zeidman)\
**Replies:** 10\
**Last updated:** [January 26, 2012, 9:53am UTC](https://discuss.elastic.co/t/cant-get-the-java-client-to-connect-to-the-es-server-when-both-are-on-my-computer/6490 "2012-01-26T09:53:48Z")

</div>

Hi, I've started working with ES in order to implement search capabilities in my company's web-application. I have a problem connecting a client node (via the java api) to the only data node I'm running; They're bo…

---

## [Cannot find write index](https://discuss.elastic.co/t/cannot-find-write-index/334683)

<div class="topic-metadata">

**Author:** [@Shreyansh\_Narang](https://discuss.elastic.co/u/Shreyansh_Narang)\
**Replies:** 13\
**Last updated:** [June 2, 2023, 11:46am UTC](https://discuss.elastic.co/t/cannot-find-write-index/334683 "2023-06-02T11:46:41Z")

</div>

Getting below error policy \[ilm\_cedar\] for index \[cedar-00001\] failed on step \[{"phase":"hot","action":"rollover","name":"check-rollover-ready"}\]. Moving to ERROR step java.lang.IllegalArgumentException: rollover targe…

---

## [Kibana REST API for integrations setup](https://discuss.elastic.co/t/kibana-rest-api-for-integrations-setup/322151)

<div class="topic-metadata">

**Author:** [@OlLap](https://discuss.elastic.co/u/OlLap)\
**Replies:** 16\
**Last updated:** [January 16, 2023, 12:49pm UTC](https://discuss.elastic.co/t/kibana-rest-api-for-integrations-setup/322151 "2023-01-16T12:49:24Z")

</div>

Hello, I have installed Elastic stack using ECK (Elasticsearch, Kibana, Beats, APM Server + agents), and trying to automate setup moving manual configuration steps to Kubernetes jobs that use Elasticsearch REST API. Bu…

---

## [Getting an ElasticSearch Cluster to Green (Cluster Setup on OS X)](https://discuss.elastic.co/t/getting-an-elasticsearch-cluster-to-green-cluster-setup-on-os-x/8735)

<div class="topic-metadata">

**Author:** [@David\_James](https://discuss.elastic.co/u/David_James)\
**Replies:** 11\
**Last updated:** [August 14, 2012, 10:59pm UTC](https://discuss.elastic.co/t/getting-an-elasticsearch-cluster-to-green-cluster-setup-on-os-x/8735 "2012-08-14T22:59:02Z")

</div>

I would appreciate some help here or over on StackOverflow... Thanks! -David Getting an ElasticSearch Cluster to Green (Cluster Setup on OS X) http://stackoverflow.com/questions/11944915/getting-an-elasticsearch-clus…

---

## [I am unable to Start Auditbeat service](https://discuss.elastic.co/t/i-am-unable-to-start-auditbeat-service/257814)

<div class="topic-metadata">

**Author:** [@shaiksubhan](https://discuss.elastic.co/u/shaiksubhan)\
**Replies:** 19\
**Last updated:** [December 9, 2020, 9:37am UTC](https://discuss.elastic.co/t/i-am-unable-to-start-auditbeat-service/257814 "2020-12-09T09:37:33Z")

</div>

HI Team, I am unable to install Auditbeat In my Linux version. I am getting this error: Exiting: 2 errors: 1 error: failed to create audit client: failed to get audit status: operation not permitted; 1 error: unable t…

---

## [Follows twitter input](https://discuss.elastic.co/t/follows-twitter-input/54837)

<div class="topic-metadata">

**Author:** [@josefboukersi](https://discuss.elastic.co/u/josefboukersi)\
**Replies:** 9\
**Last updated:** [July 18, 2016, 7:48am UTC](https://discuss.elastic.co/t/follows-twitter-input/54837 "2016-07-18T07:48:23Z")

</div>

hey, i try to give a follows with logstash but i have this error Pipeline aborted due to error {:exception=\>#\<NoMethodError: undefined method proxy\_address= i need to use a proxy, i can't work without it. there…

---

## [Kibana 8.6.1 keeps Loading Elastic forever when using a JWT token](https://discuss.elastic.co/t/kibana-8-6-1-keeps-loading-elastic-forever-when-using-a-jwt-token/325282)

<div class="topic-metadata">

**Author:** [@frits](https://discuss.elastic.co/u/frits)\
**Replies:** 11\
**Last updated:** [February 22, 2023, 9:18am UTC](https://discuss.elastic.co/t/kibana-8-6-1-keeps-loading-elastic-forever-when-using-a-jwt-token/325282 "2023-02-22T09:18:50Z")

</div>

I've been trying to get a JWT token login to work for a few days now. I've made a couple of great steps, I think I've managed to authenticate against the JWT provider (Broadcom IDM). I think I've created a correct role a…

---

## [Logstash csv output plugins giving problem](https://discuss.elastic.co/t/logstash-csv-output-plugins-giving-problem/80969)

<div class="topic-metadata">

**Author:** [@Nikparab](https://discuss.elastic.co/u/Nikparab)\
**Replies:** 11\
**Last updated:** [April 7, 2017, 10:31am UTC](https://discuss.elastic.co/t/logstash-csv-output-plugins-giving-problem/80969 "2017-04-07T10:31:12Z")

</div>

I write output-csv.conf file and run it under bin folder of logstash. input { elasticsearch { hosts =\> \["localhost:9200"\] index =\> "mongo3" query =\> '{ "query": { "bool":{ "must":{ …

---

## [I wonder about logstash YYYY.MM.dd](https://discuss.elastic.co/t/i-wonder-about-logstash-yyyy-mm-dd/241073)

<div class="topic-metadata">

**Author:** [@111349](https://discuss.elastic.co/u/111349)\
**Replies:** 9\
**Last updated:** [July 15, 2020, 9:07pm UTC](https://discuss.elastic.co/t/i-wonder-about-logstash-yyyy-mm-dd/241073 "2020-07-15T21:07:22Z")

</div>

I am not sure what logstash YYYY.MM.dd is based on. I'm in asia/seoul area and I also sent a message at 1am. The 13th was 1:00 a.m. on the 14th, but there was no newly created 14-day index in elasticsearch. I searched …

---

## [Unable to start non-data nodes Elasticsearch after upgrading from 6.42 to 6.6.1](https://discuss.elastic.co/t/unable-to-start-non-data-nodes-elasticsearch-after-upgrading-from-6-42-to-6-6-1/169356)

<div class="topic-metadata">

**Author:** [@Hari\_Prasad](https://discuss.elastic.co/u/Hari_Prasad)\
**Replies:** 9\
**Last updated:** [February 25, 2019, 1:06pm UTC](https://discuss.elastic.co/t/unable-to-start-non-data-nodes-elasticsearch-after-upgrading-from-6-42-to-6-6-1/169356 "2019-02-25T13:06:10Z")

</div>

I upgraded my cluster based on the instructions from the link After upgrading none of the non-data nodes started. All of them had the below error \[2019-02-20T22:57:35,922\]\[WARN \]\[o.e.b.ElasticsearchUncaughtExceptionHa…

---

## [Java APM with Tomcat & Quartz](https://discuss.elastic.co/t/java-apm-with-tomcat-quartz/139589)

<div class="topic-metadata">

**Author:** [@chris\_krosk](https://discuss.elastic.co/u/chris_krosk)\
**Replies:** 9\
**Last updated:** [July 17, 2018, 2:35pm UTC](https://discuss.elastic.co/t/java-apm-with-tomcat-quartz/139589 "2018-07-17T14:35:41Z")

</div>

Hello Elastic Team, I would test APM java with Tomcat application. My code use Quartz Job scheduler with JDBC connection (MariadDB). I've configured elk java agent, adding export CATALINA\_OPTS="$CATALINA\_OPTS -javaag…

---

## [Missing result using scroll in java API](https://discuss.elastic.co/t/missing-result-using-scroll-in-java-api/127063)

<div class="topic-metadata">

**Author:** [@kchrusciel](https://discuss.elastic.co/u/kchrusciel)\
**Replies:** 9\
**Last updated:** [April 6, 2018, 11:52am UTC](https://discuss.elastic.co/t/missing-result-using-scroll-in-java-api/127063 "2018-04-06T11:52:31Z")

</div>

Hi, I use Java API to works with ES. When I start using scroll API like that: SearchResponse response = client.prepareSearch() .setIndices(indexName) .setTypes(ty…

---

## [:message=\>"The error reported is: \\n "](https://discuss.elastic.co/t/message-the-error-reported-is-n/32194)

<div class="topic-metadata">

**Author:** [@steve\_womack](https://discuss.elastic.co/u/steve_womack)\
**Replies:** 10\
**Last updated:** [October 14, 2015, 7:43pm UTC](https://discuss.elastic.co/t/message-the-error-reported-is-n/32194 "2015-10-14T19:43:32Z")

</div>

This isn't very helpful. Where can I go to find out the actual error? I have no idea where to even start with such a vague message.

---

## [JDBC River can not started](https://discuss.elastic.co/t/jdbc-river-can-not-started/8461)

<div class="topic-metadata">

**Author:** [@Arthur\_Pan](https://discuss.elastic.co/u/Arthur_Pan)\
**Replies:** 17\
**Last updated:** [August 3, 2012, 9:10pm UTC](https://discuss.elastic.co/t/jdbc-river-can-not-started/8461 "2012-08-03T21:10:47Z")

</div>

Hi, I installed JDBC River and restart the elasticsearch. when I create a new river, it cat not started. There are some error message in the elasticsearch.log. \[2012-07-19 11:10:34,390\]\[INFO \]\[river.jdbc …

---

## [Uppcase letters in request cause no results to be found?](https://discuss.elastic.co/t/uppcase-letters-in-request-cause-no-results-to-be-found/51004)

<div class="topic-metadata">

**Author:** [@Mike\_Wurtz](https://discuss.elastic.co/u/Mike_Wurtz)\
**Replies:** 10\
**Last updated:** [June 1, 2016, 7:02am UTC](https://discuss.elastic.co/t/uppcase-letters-in-request-cause-no-results-to-be-found/51004 "2016-06-01T07:02:40Z")

</div>

Elasticsearch v5 Alpha2 I'm noticing something bizarre while trying to search our cluster via API. It seems as if I include an uppercase character in my wildcard or regexp string, no results come back.. For example: …

---

## [Reference the count of a field name in metrics](https://discuss.elastic.co/t/reference-the-count-of-a-field-name-in-metrics/266061)

<div class="topic-metadata">

**Author:** [@kwoxer](https://discuss.elastic.co/u/kwoxer)\
**Replies:** 16\
**Last updated:** [March 16, 2021, 8:03am UTC](https://discuss.elastic.co/t/reference-the-count-of-a-field-name-in-metrics/266061 "2021-03-16T08:03:35Z")

</div>

I would like to have calculation like you see in the image. How to solve that? I was trying: { "script" : { "lang": "painless", "inline": "\_value \* params.manualSeconds / params.correction / params.fa…

---

## [Ingest data with GCP Dataflow](https://discuss.elastic.co/t/ingest-data-with-gcp-dataflow/294046)

<div class="topic-metadata">

**Author:** [@gustafkisi](https://discuss.elastic.co/u/gustafkisi)\
**Replies:** 11\
**Last updated:** [February 9, 2022, 5:10pm UTC](https://discuss.elastic.co/t/ingest-data-with-gcp-dataflow/294046 "2022-02-09T17:10:29Z")

</div>

Hello. I'm trying to ingest data to ES with the use of GCP Dataflow and the template PubSub to Elasticsearch. So far I've tried a couple of different deployments which are all on GCP using the trial option over at elast…

---

## [Get Integer part of float number and round](https://discuss.elastic.co/t/get-integer-part-of-float-number-and-round/248245)

<div class="topic-metadata">

**Author:** [@nino](https://discuss.elastic.co/u/nino)\
**Replies:** 9\
**Last updated:** [September 16, 2020, 4:51pm UTC](https://discuss.elastic.co/t/get-integer-part-of-float-number-and-round/248245 "2020-09-16T16:51:03Z")

</div>

Hello all, how can extract integer part of a float field with logstash "field\_fload" =\> 1.4573624 i want to get 1, only the integer part of the float number. And how can round up the float? "field\_fload" =\> 0.923454 …

---

## [Timelion: why is max on integer showing digits behind decimal delimiter?](https://discuss.elastic.co/t/timelion-why-is-max-on-integer-showing-digits-behind-decimal-delimiter/75745)

<div class="topic-metadata">

**Author:** [@asp](https://discuss.elastic.co/u/asp)\
**Replies:** 9\
**Last updated:** [February 22, 2017, 12:40pm UTC](https://discuss.elastic.co/t/timelion-why-is-max-on-integer-showing-digits-behind-decimal-delimiter/75745 "2017-02-22T12:40:24Z")

</div>

Hi, I am visualizing an id with timelion. The id is a negative long value. I am interesting when the reaches the value 0. I bucket per day and want to show only the max value of the bucket. But why is timelion showi…

---

## [How to retrieve organizations IP address](https://discuss.elastic.co/t/how-to-retrieve-organizations-ip-address/251911)

<div class="topic-metadata">

**Author:** [@witcher](https://discuss.elastic.co/u/witcher)\
**Replies:** 15\
**Last updated:** [October 14, 2020, 12:56pm UTC](https://discuss.elastic.co/t/how-to-retrieve-organizations-ip-address/251911 "2020-10-14T12:56:33Z")

</div>

I am trying to create a visualization which shows the organization the IP address.

---

## [Unable to open apm index after closing all](https://discuss.elastic.co/t/unable-to-open-apm-index-after-closing-all/236589)

<div class="topic-metadata">

**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\
**Replies:** 12\
**Last updated:** [June 24, 2020, 6:25am UTC](https://discuss.elastic.co/t/unable-to-open-apm-index-after-closing-all/236589 "2020-06-24T06:25:16Z")

</div>

Kibana version : 7.6 Elasticsearch version : 7.6 APM Server version : 7.3.2 APM Agent language and version : java 1.9.0 Fresh install or upgraded from other version? fresh install Is there anything special in your s…

---

## [Getting 'Kibana server is not ready yet' after upgrade ELK stack](https://discuss.elastic.co/t/getting-kibana-server-is-not-ready-yet-after-upgrade-elk-stack/183630)

<div class="topic-metadata">

**Author:** [@Tom\_Chen](https://discuss.elastic.co/u/Tom_Chen)\
**Replies:** 10\
**Last updated:** [May 31, 2019, 4:40am UTC](https://discuss.elastic.co/t/getting-kibana-server-is-not-ready-yet-after-upgrade-elk-stack/183630 "2019-05-31T04:40:43Z")

</div>

I did a 'apt-get upgrade' on the ubuntu server hosting the ELK stack. After that my Kibana page stopped loading and keeps showing 'Kibana server is not ready yet' message. kibana, elasticsearch and logstash services are…

---

## [Merge message with aggregate filter](https://discuss.elastic.co/t/merge-message-with-aggregate-filter/269115)

<div class="topic-metadata">

**Author:** [@MalfuncEddie](https://discuss.elastic.co/u/MalfuncEddie)\
**Replies:** 9\
**Last updated:** [April 14, 2021, 3:14pm UTC](https://discuss.elastic.co/t/merge-message-with-aggregate-filter/269115 "2021-04-14T15:14:14Z")

</div>

Hi, I am trying to merge 2 log lines with the aggregate filter and after a week browsing the internet and this forum I still cannot get this working. Below you have 2 loglines with an identifier ExchangeId. What I wan…

---

## [Elastic APM not running when documentation is followed](https://discuss.elastic.co/t/elastic-apm-not-running-when-documentation-is-followed/243875)

<div class="topic-metadata">

**Author:** [@Nikesh](https://discuss.elastic.co/u/Nikesh)\
**Replies:** 9\
**Last updated:** [August 10, 2020, 6:42am UTC](https://discuss.elastic.co/t/elastic-apm-not-running-when-documentation-is-followed/243875 "2020-08-10T06:42:07Z")

</div>

Hi, I have a cluster using the elasticsearch version 6.4.0 I want to configure Elastic APM for my Python agent using Flask. I have followed the process mentioned in this link Do I have to mention the version of my …

---

## [Change topic from :Bad logic for allocation shard due to data tier arch -\> case with node roles syntax in elastic \>8.0.0](https://discuss.elastic.co/t/change-topic-from-bad-logic-for-allocation-shard-due-to-data-tier-arch-case-with-node-roles-syntax-in-elastic-8-0-0/300168)

<div class="topic-metadata">

**Author:** [@INS](https://discuss.elastic.co/u/INS)\
**Replies:** 16\
**Last updated:** [April 21, 2022, 3:50pm UTC](https://discuss.elastic.co/t/change-topic-from-bad-logic-for-allocation-shard-due-to-data-tier-arch-case-with-node-roles-syntax-in-elastic-8-0-0/300168 "2022-04-21T15:50:23Z")

</div>

Hi Today I observed not expected logic for allocation shards. Under configuration I've data tier structure like coordinator nodes - are responsible for taking data traffic es\_data\_ssd\* nodes - are storing hot phase (…

---

## [Failure to elect master, v7.17](https://discuss.elastic.co/t/failure-to-elect-master-v7-17/340149)

<div class="topic-metadata">

**Author:** [@bobus](https://discuss.elastic.co/u/bobus)\
**Replies:** 19\
**Last updated:** [August 6, 2023, 3:28pm UTC](https://discuss.elastic.co/t/failure-to-elect-master-v7-17/340149 "2023-08-06T15:28:58Z")

</div>

I'm pulling my hair out trying to figure out why my three nodes, running as docker-compose containers on 3 separate Ubuntu 22.04LTS hosts, cannot start. The 3 nodes discover each other but fail to elect a master. When I…

---

## [Implementing opentracing bridge](https://discuss.elastic.co/t/implementing-opentracing-bridge/163485)

<div class="topic-metadata">

**Author:** [@jhoninck](https://discuss.elastic.co/u/jhoninck)\
**Replies:** 12\
**Last updated:** [January 11, 2019, 8:36am UTC](https://discuss.elastic.co/t/implementing-opentracing-bridge/163485 "2019-01-11T08:36:05Z")

</div>

Very slowly processing with some opentracing-bridge code in Java. My main issue is that I want to inject and extract transaction and span information inside separate processes. Have found this link talking a lot about …

---

## [Help with a logstash instance processing 4000 messages/s](https://discuss.elastic.co/t/help-with-a-logstash-instance-processing-4000-messages-s/73824)

<div class="topic-metadata">

**Author:** [@Laverio](https://discuss.elastic.co/u/Laverio)\
**Replies:** 12\
**Last updated:** [February 13, 2017, 8:26am UTC](https://discuss.elastic.co/t/help-with-a-logstash-instance-processing-4000-messages-s/73824 "2017-02-13T08:26:58Z")

</div>

Hi, I'm suffering a serious tuning issue processing messages from a kafka queue. The architecture is the following: ASA Firewall -\> logstash input -\> kafka queue (32 partitions) -\> logstash output (4 workers) -\> elas…

---

## [Timelion tutorial](https://discuss.elastic.co/t/timelion-tutorial/108689)

<div class="topic-metadata">

**Author:** [@Bruno\_Seznec](https://discuss.elastic.co/u/Bruno_Seznec)\
**Replies:** 10\
**Last updated:** [December 8, 2017, 2:27pm UTC](https://discuss.elastic.co/t/timelion-tutorial/108689 "2017-12-08T14:27:48Z")

</div>

Hi trying to follow the timelion tutorial from an Elastic cloud instance I cannot succeed to load data from world bank :slight\_smile: .wbi(country=de, indicator=NY.GDP.MKTP.CD), .wbi(country=fr, indicator=NY.GDP.MK…

---

## [Another Cloudflare integration issue](https://discuss.elastic.co/t/another-cloudflare-integration-issue/320085)

<div class="topic-metadata">

**Author:** [@ethhack](https://discuss.elastic.co/u/ethhack)\
**Replies:** 12\
**Last updated:** [December 13, 2022, 1:41pm UTC](https://discuss.elastic.co/t/another-cloudflare-integration-issue/320085 "2022-12-13T13:41:03Z")

</div>

Similar to this post for which I see no resolution anywhere, I have an issue with the Cloudflare logpull integration erroring out about the 168h maximum: "message":"Error while processing http request: failed to execute…

---

## [How to search text using java elastic search](https://discuss.elastic.co/t/how-to-search-text-using-java-elastic-search/11092)

<div class="topic-metadata">

**Author:** [@Srikanth\_gone](https://discuss.elastic.co/u/Srikanth_gone)\
**Replies:** 25\
**Last updated:** [March 12, 2013, 12:08pm UTC](https://discuss.elastic.co/t/how-to-search-text-using-java-elastic-search/11092 "2013-03-12T12:08:09Z")

</div>

Hi All, This is my code.. Settings settings = ImmutableSettings.settingsBuilder() .put("http.enabled", "false") .put("transport.tcp.port", "9300-9400") .put("discovery.zen.ping.mult…

---

## [Not able to download dataset blogs.csv for offline pracitce](https://discuss.elastic.co/t/not-able-to-download-dataset-blogs-csv-for-offline-pracitce/238178)

<div class="topic-metadata">

**Author:** [@manojb1-in.ibm.com](https://discuss.elastic.co/u/manojb1-in.ibm.com)\
**Replies:** 11\
**Last updated:** [August 25, 2020, 9:39am UTC](https://discuss.elastic.co/t/not-able-to-download-dataset-blogs-csv-for-offline-pracitce/238178 "2020-08-25T09:39:57Z")

</div>

Hi, Could you please let me know, how I could download dataset , blogs.csv for offline practice? In elastic engineer1 , i did not see any link for downloading datasets. Please help

---

## [Autocompletion](https://discuss.elastic.co/t/autocompletion/7921)

<div class="topic-metadata">

**Author:** [@phoenix](https://discuss.elastic.co/u/phoenix)\
**Replies:** 17\
**Last updated:** [June 1, 2012, 8:04pm UTC](https://discuss.elastic.co/t/autocompletion/7921 "2012-06-01T20:04:11Z")

</div>

Hi everyone, I'm looking for a way to implement an autocomplete feature using elasticsearch. Does someone have tips about the way to achieve this ? Kimchy, the search bar on elasticsearch sitenis exactly what i'd li…

---

## [Kibana SIEM app performance](https://discuss.elastic.co/t/kibana-siem-app-performance/234358)

<div class="topic-metadata">

**Author:** [@j91321](https://discuss.elastic.co/u/j91321)\
**Replies:** 10\
**Last updated:** [May 29, 2020, 11:01am UTC](https://discuss.elastic.co/t/kibana-siem-app-performance/234358 "2020-05-29T11:01:43Z")

</div>

Hello, we are experiencing some performance issues in Kibana SIEM app especially loading the Detections tab. Making it very annoying to use. The queries report times ~8ms (Signal count) ~33ms (Inspect signals). But the…

---

## [Additional field for winlogbeat](https://discuss.elastic.co/t/additional-field-for-winlogbeat/94750)

<div class="topic-metadata">

**Author:** [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\
**Replies:** 10\
**Last updated:** [August 1, 2017, 1:33am UTC](https://discuss.elastic.co/t/additional-field-for-winlogbeat/94750 "2017-08-01T01:33:25Z")

</div>

Is there a way that I can append data or field in winlog? Let's say I have a csv file which consists of 5 data. Can I append this everytime windows logs are sent thru beats? TIA

---

## [I am getting a Error in kibana dashboard creation](https://discuss.elastic.co/t/i-am-getting-a-error-in-kibana-dashboard-creation/76449)

<div class="topic-metadata">

**Author:** [@kmroz](https://discuss.elastic.co/u/kmroz)\
**Replies:** 9\
**Last updated:** [February 28, 2017, 6:56pm UTC](https://discuss.elastic.co/t/i-am-getting-a-error-in-kibana-dashboard-creation/76449 "2017-02-28T18:56:38Z")

</div>

Hello It seems i keep receiving this issue on both the newest version of ELK and also a previous version. Error: \[unsupported\_operation\_exception\] custom format isn't supported is the error. It only shows up when i try…

---

## [S3 backup configuration error](https://discuss.elastic.co/t/s3-backup-configuration-error/262795)

<div class="topic-metadata">

**Author:** [@Lior\_Yakobov](https://discuss.elastic.co/u/Lior_Yakobov)\
**Replies:** 12\
**Last updated:** [February 3, 2021, 2:42pm UTC](https://discuss.elastic.co/t/s3-backup-configuration-error/262795 "2021-02-03T14:42:39Z")

</div>

Hello, I'm trying to configure AWS S3 repository for backups but facing access issues to the S3 bucket. I did the following steps: Installed repository-s3 plugin on all cluster nodes restarted all nodes after the plu…

---

## [MONTH Interval conversion to use in DATE CLAUSE](https://discuss.elastic.co/t/month-interval-conversion-to-use-in-date-clause/233567)

<div class="topic-metadata">

**Author:** [@vaclav1](https://discuss.elastic.co/u/vaclav1)\
**Replies:** 10\
**Last updated:** [June 23, 2020, 8:13am UTC](https://discuss.elastic.co/t/month-interval-conversion-to-use-in-date-clause/233567 "2020-06-23T08:13:38Z")

</div>

Hello, I have tried to use following SQL in kibana internal index: SELECT dashboard.title FROM ".kibana\*" WHERE updated\_at \> TODAY() - INTERVAL CAST(MONTH\_OF\_YEAR(TODAY()) AS interval\_month) MONTHS Unfortunately I get…

---

## [Boostingを使ってるが片方の結果しか返ってこない](https://discuss.elastic.co/t/boosting/142026)

<div class="topic-metadata">

**Author:** [@Tarou\_Tanaka](https://discuss.elastic.co/u/Tarou_Tanaka)\
**Replies:** 10\
**Last updated:** [July 31, 2018, 6:22am UTC](https://discuss.elastic.co/t/boosting/142026 "2018-07-31T06:22:48Z")

</div>

boostingを使って２つの単語を検索しているのですが、片方しか結果が表示されません。 背景を説明させて頂きます。 私は今、複数の単語で既存のドキュメントに対して検索し、マッチした物をすべて表示するシステムを作っています。また、検索単語の一部は優先的に表示したいです。 そのためスコアーを上げて優劣をつける方法を考えました。 そこで調べると、boostingを使うと一方のクエリの検索結果に対してスコアーを上げそうでした。 そこ…

---

## [Vega Is Not Showing Anything Despite Code Passing Error-Free](https://discuss.elastic.co/t/vega-is-not-showing-anything-despite-code-passing-error-free/239142)

<div class="topic-metadata">

**Author:** [@Ethan777100](https://discuss.elastic.co/u/Ethan777100)\
**Replies:** 9\
**Last updated:** [July 1, 2020, 2:33pm UTC](https://discuss.elastic.co/t/vega-is-not-showing-anything-despite-code-passing-error-free/239142 "2020-07-01T14:33:14Z")

</div>

im unable to get my Vega to show smth? this the o/p using Vega-Lite 2.0 this is the o/p using Vega 4.0 { "$schema": "https://vega.github.io/schema/vega/v4.json", "data": { "url": { "%context%": true, "%t…

---

## [Pasrse data between repeated xml tags](https://discuss.elastic.co/t/pasrse-data-between-repeated-xml-tags/172270)

<div class="topic-metadata">

**Author:** [@sverma](https://discuss.elastic.co/u/sverma)\
**Replies:** 9\
**Last updated:** [March 23, 2019, 1:46am UTC](https://discuss.elastic.co/t/pasrse-data-between-repeated-xml-tags/172270 "2019-03-23T01:46:07Z")

</div>

I have a xml file that has repeated tags and i need to extract the fields between those tags , in below mentioned xml data I want to get the data between the job\_list tags: \<?xml version='1.0'?\> \<job\_info xmlns:xsd="ht…

---

## [Check if value is 'null' So it Can Be Used in a Fingerprint and Document \_id](https://discuss.elastic.co/t/check-if-value-is-null-so-it-can-be-used-in-a-fingerprint-and-document-id/326632)

<div class="topic-metadata">

**Author:** [@iFamZ](https://discuss.elastic.co/u/iFamZ)\
**Replies:** 12\
**Last updated:** [March 1, 2023, 2:53am UTC](https://discuss.elastic.co/t/check-if-value-is-null-so-it-can-be-used-in-a-fingerprint-and-document-id/326632 "2023-03-01T02:53:21Z")

</div>

Hello, I am working to setup fingerprint on a field if it is not null. If it is null, I will fingerprint a different field (which is never null). Currently, my filebeat processors look like this: processors: - "de…

---

## [Stack trace parsing issue](https://discuss.elastic.co/t/stack-trace-parsing-issue/287573)

<div class="topic-metadata">

**Author:** [@Divya\_Bansal](https://discuss.elastic.co/u/Divya_Bansal)\
**Replies:** 9\
**Last updated:** [October 25, 2021, 2:15pm UTC](https://discuss.elastic.co/t/stack-trace-parsing-issue/287573 "2021-10-25T14:15:57Z")

</div>

I am having a json data in the following manne:- {"@timestamp":"2021-06-04T09:57:25.141Z","@metadata":{"beat":"filebeat","type":"\_doc","version":"7.6.3"},"log":{"offset":10413931,"file":{"path":""}},"message":"\[ERROR\] 2…

---

## [Restarting a cluster with existing data - Status Red?](https://discuss.elastic.co/t/restarting-a-cluster-with-existing-data-status-red/15562)

<div class="topic-metadata">

**Author:** [@Tony\_Su](https://discuss.elastic.co/u/Tony_Su)\
**Replies:** 9\
**Last updated:** [February 4, 2014, 5:30pm UTC](https://discuss.elastic.co/t/restarting-a-cluster-with-existing-data-status-red/15562 "2014-02-04T17:30:35Z")

</div>

I've noticed that if I restart a cluster \*with existing data\*, ES-HEAD and now also MARVEL reports the cluster status as "red" with only one node and a large number of what I think are supposed to be shards, far mor…

---

## [Add ZingChart-AngularJS into Kibana App - zingchart is not defined](https://discuss.elastic.co/t/add-zingchart-angularjs-into-kibana-app-zingchart-is-not-defined/146506)

<div class="topic-metadata">

**Author:** [@asallemi](https://discuss.elastic.co/u/asallemi)\
**Replies:** 11\
**Last updated:** [September 22, 2018, 5:32pm UTC](https://discuss.elastic.co/t/add-zingchart-angularjs-into-kibana-app-zingchart-is-not-defined/146506 "2018-09-22T17:32:43Z")

</div>

Hello, I'm building a plugin application for Kibana 6.2.4 and I would like to add a Chart. I injected this directive ZingChart-AngularJS. This is my app.js: import { uiModules } from 'ui/modules'; import uiRoutes from…

---

## [Indexing files with file system \_river in scrutmydocs won't read any files](https://discuss.elastic.co/t/indexing-files-with-file-system--river-in-scrutmydocs-wont-read-any-files/12351)

<div class="topic-metadata">

**Author:** [@Fatima\_Castiglione\_M](https://discuss.elastic.co/u/Fatima_Castiglione_M)\
**Replies:** 23\
**Last updated:** [June 25, 2013, 8:59am UTC](https://discuss.elastic.co/t/indexing-files-with-file-system--river-in-scrutmydocs-wont-read-any-files/12351 "2013-06-25T08:59:01Z")

</div>

Hi I was using a couchdb \_river but switched to using scrutmydocs using a file system river. Configured the river as in the attached pic, but it just won't find anything. If I manually add docs using the app but…

---

## [Rétention des logs différenciée (Développement, Intégration et exploitation)](https://discuss.elastic.co/t/retention-des-logs-differenciee-developpement-integration-et-exploitation/266912)

<div class="topic-metadata">

**Author:** [@matthias-evain](https://discuss.elastic.co/u/matthias-evain)\
**Replies:** 14\
**Last updated:** [March 12, 2021, 7:48am UTC](https://discuss.elastic.co/t/retention-des-logs-differenciee-developpement-integration-et-exploitation/266912 "2021-03-12T07:48:31Z")

</div>

Bonjour à tous, Je viens vers vous afin de m'assurer que ma demande est possible ou non. Actuellement, ma configuration en Hot-Warm me permet d'utiliser curator pour basculer tous mes logs d'un index unique vers une se…

[Previous page](https://discuss.elastic.co/top.md?page=171&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=173&per_page=50&period=all)
