# Top

**URL:** https://discuss.elastic.co/top.md?page=173&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 174

---

## [0.19.5 Released](https://discuss.elastic.co/t/0-19-5-released/8214)

<div class="topic-metadata">

**Author:** [@kimchy](https://discuss.elastic.co/u/kimchy)\
**Replies:** 26\
**Last updated:** [June 26, 2012, 12:25pm UTC](https://discuss.elastic.co/t/0-19-5-released/8214 "2012-06-26T12:25:55Z")

</div>

Heya, 0.19.5 has just been release, with important bug fixes, and two cool new features. More info here: http://www.elasticsearch.org/blog/2012/06/25/0.19.5-released.html. -shay.banon

---

## [Have a problem with my Suricata + ELK stack](https://discuss.elastic.co/t/have-a-problem-with-my-suricata-elk-stack/281364)

<div class="topic-metadata">

**Author:** [@Yves\_Silvere\_Randria](https://discuss.elastic.co/u/Yves_Silvere_Randria)\
**Replies:** 12\
**Last updated:** [August 24, 2021, 1:50pm UTC](https://discuss.elastic.co/t/have-a-problem-with-my-suricata-elk-stack/281364 "2021-08-24T13:50:11Z")

</div>

Hello, I have this error when I am setting up ELK servers + Suricata .

---

## [Decode JSON hex field before push to ES](https://discuss.elastic.co/t/decode-json-hex-field-before-push-to-es/253126)

<div class="topic-metadata">

**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\
**Replies:** 9\
**Last updated:** [October 24, 2020, 5:37pm UTC](https://discuss.elastic.co/t/decode-json-hex-field-before-push-to-es/253126 "2020-10-24T17:37:17Z")

</div>

Hi, I have input data such as: { "timestamp": "1603363180424", "layers": { \[.. some data ..\] }, "aaa": { \[.. some data ..\] }, "bbb": { \[.. so…

---

## [Data directory is still growing after initial index build](https://discuss.elastic.co/t/data-directory-is-still-growing-after-initial-index-build/116075)

<div class="topic-metadata">

**Author:** [@4b3l](https://discuss.elastic.co/u/4b3l)\
**Replies:** 17\
**Last updated:** [January 23, 2018, 3:03pm UTC](https://discuss.elastic.co/t/data-directory-is-still-growing-after-initial-index-build/116075 "2018-01-23T15:03:47Z")

</div>

Hi, I have a 3 Node ES Cluster. I have built an index in my new cluster. This took a while to complete. I've noticed that since the index being built, the data directory is still growing and I am not sure why or where …

---

## [Why is there a lot of "Waiting 30s" in the service log?](https://discuss.elastic.co/t/why-is-there-a-lot-of-waiting-30s-in-the-service-log/288722)

<div class="topic-metadata">

**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\
**Replies:** 11\
**Last updated:** [November 17, 2021, 1:24am UTC](https://discuss.elastic.co/t/why-is-there-a-lot-of-waiting-30s-in-the-service-log/288722 "2021-11-17T01:24:31Z")

</div>

Waiting 30s... Wait time is taken from max-age directive in Cache-Control header in APM Server's response. dbgIterationsCount: 37436. Waiting 30s... Wait time is taken from max-age directive in Cache-Control header in …

---

## [Logstash indices mixup in Kibana](https://discuss.elastic.co/t/logstash-indices-mixup-in-kibana/81454)

<div class="topic-metadata">

**Author:** [@Vivek\_Samaga](https://discuss.elastic.co/u/Vivek_Samaga)\
**Replies:** 11\
**Last updated:** [April 12, 2017, 1:25pm UTC](https://discuss.elastic.co/t/logstash-indices-mixup-in-kibana/81454 "2017-04-12T13:25:27Z")

</div>

Am using filebeat to get logs from remote app server and Logstash jdbc plugin to get logs from DB server but at Kibana when the log is flowing the indices are mixing up i,e logs from app server is showing in DB index and…

---

## [Basicライセンスが有効にならない件](https://discuss.elastic.co/t/basic/192550)

<div class="topic-metadata">

**Author:** [@yn2018](https://discuss.elastic.co/u/yn2018)\
**Replies:** 9\
**Last updated:** [August 5, 2019, 10:34am UTC](https://discuss.elastic.co/t/basic/192550 "2019-08-05T10:34:04Z")

</div>

前提として、elasticsearch5.6系を利用しています。 kibanaのbasicライセンスでmonitoring機能を利用しておりました。 basicライセンスの有効期限が切れたので再発行して更新をしましたが、kibanaのmonitoring画面上では有効になりません。 # curl -XGET 'http://localhost:9200/\_xpack/license?pretty' { "license" …

---

## [ASA MAP geo\_point](https://discuss.elastic.co/t/asa-map-geo-point/72419)

<div class="topic-metadata">

**Author:** [@mmethe](https://discuss.elastic.co/u/mmethe)\
**Replies:** 10\
**Last updated:** [January 26, 2017, 7:06pm UTC](https://discuss.elastic.co/t/asa-map-geo-point/72419 "2017-01-26T19:06:49Z")

</div>

I am trying to create a tile map of a cisco-fw index. This is the error: This are the fields I can see (I think)

---

## [Upgrade Elastic Stack 7.15.1 to 7.17.10](https://discuss.elastic.co/t/upgrade-elastic-stack-7-15-1-to-7-17-10/339706)

<div class="topic-metadata">

**Author:** [@SAMY-ELK](https://discuss.elastic.co/u/SAMY-ELK)\
**Replies:** 24\
**Last updated:** [August 9, 2023, 12:50pm UTC](https://discuss.elastic.co/t/upgrade-elastic-stack-7-15-1-to-7-17-10/339706 "2023-08-09T12:50:14Z")

</div>

Hello Team, After Upgrade ELK from 7.15.1 to 7.17.10 : logstash-kibana-filebeat-Elastic search , i can't receive log IIS in KIBANA. when i check log logstash i get this error : " LogStash::PipelineAction::Create/pipel…

---

## [Logstash is not writing latest value in jdbc Sincedb](https://discuss.elastic.co/t/logstash-is-not-writing-latest-value-in-jdbc-sincedb/186306)

<div class="topic-metadata">

**Author:** [@Tabish0009](https://discuss.elastic.co/u/Tabish0009)\
**Replies:** 10\
**Last updated:** [July 23, 2019, 2:58pm UTC](https://discuss.elastic.co/t/logstash-is-not-writing-latest-value-in-jdbc-sincedb/186306 "2019-07-23T14:58:12Z")

</div>

I am using 5.x version of Logstash and 7.x version of Elasticsearch and Kibana, the issue I am facing is even after setting the path for the sincedb, logstash is not writing the timestamp till the point reading has been …

---

## [Elasticsearch wont run after adding Sintinl](https://discuss.elastic.co/t/elasticsearch-wont-run-after-adding-sintinl/156675)

<div class="topic-metadata">

**Author:** [@Ralph\_Lawrence](https://discuss.elastic.co/u/Ralph_Lawrence)\
**Replies:** 12\
**Last updated:** [November 15, 2018, 7:47am UTC](https://discuss.elastic.co/t/elasticsearch-wont-run-after-adding-sintinl/156675 "2018-11-15T07:47:47Z")

</div>

my elasticsearch wont completely start after adding plugin. The errors are related to the log4j2.properties file not finding something....... ● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/sys…

---

## [Grok filter is not working properly](https://discuss.elastic.co/t/grok-filter-is-not-working-properly/229073)

<div class="topic-metadata">

**Author:** [@Ankit-github-26](https://discuss.elastic.co/u/Ankit-github-26)\
**Replies:** 9\
**Last updated:** [April 21, 2020, 9:43pm UTC](https://discuss.elastic.co/t/grok-filter-is-not-working-properly/229073 "2020-04-21T21:43:39Z")

</div>

Hello Guys, I have Filebeat-7.1 installed in a Debian server, this Filebeat send data from files in this Debian server to server with Logstash 7.6 , here are the files config Filebeat.yml: #===========================…

---

## [Ingest problem with filebeat and logstash](https://discuss.elastic.co/t/ingest-problem-with-filebeat-and-logstash/109188)

<div class="topic-metadata">

**Author:** [@Rodolphe\_Redoute](https://discuss.elastic.co/u/Rodolphe_Redoute)\
**Replies:** 9\
**Last updated:** [November 27, 2017, 8:54pm UTC](https://discuss.elastic.co/t/ingest-problem-with-filebeat-and-logstash/109188 "2017-11-27T20:54:33Z")

</div>

Hi, I have an ingest problem with filebeat and logstash. I have machines with a configuration on it's own to get different type of log files. my first filebeat.yml file is like this : filebeat.prospectors: - document\_…

---

## [Moving big indices around with two or more instances running in the same box, working separately](https://discuss.elastic.co/t/moving-big-indices-around-with-two-or-more-instances-running-in-the-same-box-working-separately/39689)

<div class="topic-metadata">

**Author:** [@fforbeck](https://discuss.elastic.co/u/fforbeck)\
**Replies:** 9\
**Last updated:** [January 22, 2016, 8:18am UTC](https://discuss.elastic.co/t/moving-big-indices-around-with-two-or-more-instances-running-in-the-same-box-working-separately/39689 "2016-01-22T08:18:55Z")

</div>

Hi there, I would like an opinion about this scenario: 4 ES instances, one node each, running in the same box but using different cluster names. So they won't be working together. But they all will store same type …

---

## [Enterprise-search not starting new install of 8.6.2](https://discuss.elastic.co/t/enterprise-search-not-starting-new-install-of-8-6-2/328394)

<div class="topic-metadata">

**Author:** [@Neil\_Maffitt](https://discuss.elastic.co/u/Neil_Maffitt)\
**Replies:** 13\
**Last updated:** [April 3, 2023, 2:11pm UTC](https://discuss.elastic.co/t/enterprise-search-not-starting-new-install-of-8-6-2/328394 "2023-04-03T14:11:00Z")

</div>

Elastic search is running no problem curl --cacert /etc/elasticsearch/certs/http\_ca.crt -u elastic:password https://127.0.0.1:9200 Response looks good. But when starting Enterprise Search get error see below. Elastic…

---

## [4 Data nodes, struggling with simultaneous multiple heavy aggregations.. How to scale?](https://discuss.elastic.co/t/4-data-nodes-struggling-with-simultaneous-multiple-heavy-aggregations-how-to-scale/43551)

<div class="topic-metadata">

**Author:** [@geebee](https://discuss.elastic.co/u/geebee)\
**Replies:** 9\
**Last updated:** [March 4, 2016, 9:38pm UTC](https://discuss.elastic.co/t/4-data-nodes-struggling-with-simultaneous-multiple-heavy-aggregations-how-to-scale/43551 "2016-03-04T21:38:45Z")

</div>

Hello, hoping someone can give me some more insight on my issue: I have an ES cluster with 4 data-only nodes (4 core/32GB RAM), under heavy aggregation scenarios (mostly large Kibana dashboards with multiple complex vi…

---

## [Elastic Search \> @SearchUI \> group with sort](https://discuss.elastic.co/t/elastic-search-searchui-group-with-sort/327154)

<div class="topic-metadata">

**Author:** [@parliament718](https://discuss.elastic.co/u/parliament718)\
**Replies:** 15\
**Last updated:** [March 8, 2023, 8:39am UTC](https://discuss.elastic.co/t/elastic-search-searchui-group-with-sort/327154 "2023-03-08T08:39:10Z")

</div>

I've been trying for days to get group+sort working with @search-ui, with either the app-search connector or the elasticsearch connector with limited success with both. Originally I used the app-search connector and set…

---

## [Elastic hard delete](https://discuss.elastic.co/t/elastic-hard-delete/156432)

<div class="topic-metadata">

**Author:** [@nileshsoor](https://discuss.elastic.co/u/nileshsoor)\
**Replies:** 12\
**Last updated:** [November 13, 2018, 11:23am UTC](https://discuss.elastic.co/t/elastic-hard-delete/156432 "2018-11-13T11:23:17Z")

</div>

Hello, I have created an Index of 200M docs and will be updated frequently. 50M docs will be updated in a month. In short, the Index is read/write heavy in nature. As Elastic/Lucene says it will not do an actual updat…

---

## [Elastic Cloud SAML SSO in 'trial' environment](https://discuss.elastic.co/t/elastic-cloud-saml-sso-in-trial-environment/325509)

<div class="topic-metadata">

**Author:** [@alongaks](https://discuss.elastic.co/u/alongaks)\
**Replies:** 14\
**Last updated:** [February 23, 2023, 1:07pm UTC](https://discuss.elastic.co/t/elastic-cloud-saml-sso-in-trial-environment/325509 "2023-02-23T13:07:40Z")

</div>

Hello, I'm looking for some insight with configuring SAML SSO in a trial Elastic Cloud environment. The deployment is on v8.6.1. Using Elasticsearch, Kibana, Enterprise Search. The idP provider is SAML 2.0. I have be…

---

## [More efficient date sorting](https://discuss.elastic.co/t/more-efficient-date-sorting/14553)

<div class="topic-metadata">

**Author:** [@Matthew\_Painter](https://discuss.elastic.co/u/Matthew_Painter)\
**Replies:** 13\
**Last updated:** [September 30, 2014, 4:07am UTC](https://discuss.elastic.co/t/more-efficient-date-sorting/14553 "2014-09-30T04:07:44Z")

</div>

Hi all, We have an index with ms precision dates stored as longs. To sort on this, if I understand correctly, we need to load all of the longs into memory in the field cache. However, if we know that all of th…

---

## [Benchmarking using ESRally](https://discuss.elastic.co/t/benchmarking-using-esrally/335735)

<div class="topic-metadata">

**Author:** [@Darshan\_J](https://discuss.elastic.co/u/Darshan_J)\
**Replies:** 10\
**Last updated:** [June 15, 2023, 7:17am UTC](https://discuss.elastic.co/t/benchmarking-using-esrally/335735 "2023-06-15T07:17:22Z")

</div>

Hey there, I'm new to ESRally and I would appreciate some assistance in running esrally with ES running on a remote server. The set-up: There is a remote server which I connect to it via ssh.. it has a single elastics…

---

## [Index not creating](https://discuss.elastic.co/t/index-not-creating/282345)

<div class="topic-metadata">

**Author:** [@jubin03](https://discuss.elastic.co/u/jubin03)\
**Replies:** 17\
**Last updated:** [August 26, 2021, 10:55am UTC](https://discuss.elastic.co/t/index-not-creating/282345 "2021-08-26T10:55:13Z")

</div>

After configuring filter.conf and logstash input index not showing in Kibana. Successfully tested logstash conf files. No errors. Below are the conf files Filter.conf filter { if \[type\] == "signinattempts" { j…

---

## [Getting timestamp field from XML attribute](https://discuss.elastic.co/t/getting-timestamp-field-from-xml-attribute/294625)

<div class="topic-metadata">

**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\
**Replies:** 10\
**Last updated:** [January 19, 2022, 6:41pm UTC](https://discuss.elastic.co/t/getting-timestamp-field-from-xml-attribute/294625 "2022-01-19T18:41:09Z")

</div>

I'm using the xml filter plugin in Logstash to parse a XML document, and am having success with the exception of the @timestamp value, which is found as an attribute value. Here is a snippet of the XML file: \<cdf:Benchm…

---

## [I have got replica for each indice and i am getting Red cluster in stack monitoring Please Help](https://discuss.elastic.co/t/i-have-got-replica-for-each-indice-and-i-am-getting-red-cluster-in-stack-monitoring-please-help/231101)

<div class="topic-metadata">

**Author:** [@Rohit\_Kumbhar](https://discuss.elastic.co/u/Rohit_Kumbhar)\
**Replies:** 10\
**Last updated:** [May 5, 2020, 10:35am UTC](https://discuss.elastic.co/t/i-have-got-replica-for-each-indice-and-i-am-getting-red-cluster-in-stack-monitoring-please-help/231101 "2020-05-05T10:35:13Z")

</div>

Its giving me High Security Alert and "Elasticsearch cluster status is red. Allocate missing primary shards and replica shards." this message

---

## [Logstash service keep on restarting](https://discuss.elastic.co/t/logstash-service-keep-on-restarting/322370)

<div class="topic-metadata">

**Author:** [@Shalinicts](https://discuss.elastic.co/u/Shalinicts)\
**Replies:** 12\
**Last updated:** [January 4, 2023, 3:27pm UTC](https://discuss.elastic.co/t/logstash-service-keep-on-restarting/322370 "2023-01-04T15:27:28Z")

</div>

Hi Team , Logstash service keeps on restarting and this is the message found in logs . Tried doing pqcheck and pqrepair, removed the problematic queue etc.. No issues related to user access , memory, disk Any suggest…

---

## [Balance Nodes by CPU Usage](https://discuss.elastic.co/t/balance-nodes-by-cpu-usage/336932)

<div class="topic-metadata">

**Author:** [@IsaacD](https://discuss.elastic.co/u/IsaacD)\
**Replies:** 10\
**Last updated:** [July 4, 2023, 8:06am UTC](https://discuss.elastic.co/t/balance-nodes-by-cpu-usage/336932 "2023-07-04T08:06:19Z")

</div>

Is there a way to balance the nodes by CPU instead of shard count? I'm constantly seeing 1-3 of our hot nodes sitting above 60% cpu usage where the other 6 hot nodes are around 10%. They all have the same amount of sha…

---

## [Question about the possibilities of Kibana and code development](https://discuss.elastic.co/t/question-about-the-possibilities-of-kibana-and-code-development/210693)

<div class="topic-metadata">

**Author:** [@ya-tmch](https://discuss.elastic.co/u/ya-tmch)\
**Replies:** 10\
**Last updated:** [December 11, 2019, 2:11pm UTC](https://discuss.elastic.co/t/question-about-the-possibilities-of-kibana-and-code-development/210693 "2019-12-11T14:11:39Z")

</div>

Hello! We have crm for our customers. In the kibana there is information about the orders of our customers. We want to display the embedded dashboard on a specific page in our crm so that each client sees the graphs o…

---

## [Delete\_by\_quey API deleted documents which didn't match search criteria](https://discuss.elastic.co/t/delete-by-quey-api-deleted-documents-which-didnt-match-search-criteria/103916)

<div class="topic-metadata">

**Author:** [@amruth](https://discuss.elastic.co/u/amruth)\
**Replies:** 10\
**Last updated:** [October 15, 2017, 3:53pm UTC](https://discuss.elastic.co/t/delete-by-quey-api-deleted-documents-which-didnt-match-search-criteria/103916 "2017-10-15T15:53:10Z")

</div>

Hi, Here is the query I used, POST twitter/\_delete\_by\_query { "query": { "match": { "source\_host": "server02.local" } } } But it deleted all the documents with source\_host:server01.local, source\_ho…

---

## [I want to convert my date format yyyymmdd into month name date and year like mmm dd yyy (Apr 30 2012)](https://discuss.elastic.co/t/i-want-to-convert-my-date-format-yyyymmdd-into-month-name-date-and-year-like-mmm-dd-yyy-apr-30-2012/255394)

<div class="topic-metadata">

**Author:** [@Lokesh\_Mayan](https://discuss.elastic.co/u/Lokesh_Mayan)\
**Replies:** 11\
**Last updated:** [November 14, 2020, 5:19pm UTC](https://discuss.elastic.co/t/i-want-to-convert-my-date-format-yyyymmdd-into-month-name-date-and-year-like-mmm-dd-yyy-apr-30-2012/255394 "2020-11-14T17:19:26Z")

</div>

Hi I am having a log like the below \<#\> 20200924 15:14:40.918 280018000 EV.INF \[ MVINB-LSL2.T1G1\_ATMTH\_SL main.main TSP1.T1G1\_ATMTH\_SL \] Process T1G1\_ATMTH\_SL starting in progress... in the …

---

## [Discover: Request Timout after 30000ms / mapping size is larger than 10MB Version 6.3.1](https://discuss.elastic.co/t/discover-request-timout-after-30000ms-mapping-size-is-larger-than-10mb-version-6-3-1/193863)

<div class="topic-metadata">

**Author:** [@Asa\_Zalles-Milner](https://discuss.elastic.co/u/Asa_Zalles-Milner)\
**Replies:** 11\
**Last updated:** [August 19, 2019, 2:35pm UTC](https://discuss.elastic.co/t/discover-request-timout-after-30000ms-mapping-size-is-larger-than-10mb-version-6-3-1/193863 "2019-08-19T14:35:36Z")

</div>

I am getting the request timeout anytime i do a across all fields search in kibana, this used to work fine, it is only at a 15 minute timespan, but can't figure out what is going on. It does seem maybe only my beats ind…

---

## [How to retrieve elasticsearch Data from Java application](https://discuss.elastic.co/t/how-to-retrieve-elasticsearch-data-from-java-application/10148)

<div class="topic-metadata">

**Author:** [@Janusz\_Dalecki](https://discuss.elastic.co/u/Janusz_Dalecki)\
**Replies:** 15\
**Last updated:** [March 11, 2013, 8:29am UTC](https://discuss.elastic.co/t/how-to-retrieve-elasticsearch-data-from-java-application/10148 "2013-03-11T08:29:28Z")

</div>

Hi Everybody, I am trying to use elasticsearch from Java. (I am running elasticsearch server locally on my laptop using java 6 in Windows 7 64 bits and the client under eclipse Indigo) First of all I have followed th…

---

## [Help restoring / recreating .security-7](https://discuss.elastic.co/t/help-restoring-recreating-security-7/334499)

<div class="topic-metadata">

**Author:** [@A.Hani](https://discuss.elastic.co/u/A.Hani)\
**Replies:** 12\
**Last updated:** [May 28, 2023, 2:31pm UTC](https://discuss.elastic.co/t/help-restoring-recreating-security-7/334499 "2023-05-28T14:31:39Z")

</div>

Hello, Faced an error where kibana failed to retrieve password hash for reserved user \[kibana\] at least one primary shard for the index .security-7 was missing. Followed the instructions provided here at https://discus…

---

## [Not able to create an indexes for files stored in S3](https://discuss.elastic.co/t/not-able-to-create-an-indexes-for-files-stored-in-s3/134759)

<div class="topic-metadata">

**Author:** [@PanneerSelvam](https://discuss.elastic.co/u/PanneerSelvam)\
**Replies:** 10\
**Last updated:** [June 12, 2018, 4:44am UTC](https://discuss.elastic.co/t/not-able-to-create-an-indexes-for-files-stored-in-s3/134759 "2018-06-12T04:44:58Z")

</div>

Hi Team, Able to execute and create an index in kibana if I keep the \*.csv in local machine but, I don't if I keep them in S3 bucket. Below are the config details. input { s3 { access\_key\_id =\> "Access KEY" secret\_a…

---

## [Error start elasticsearch in centos7](https://discuss.elastic.co/t/error-start-elasticsearch-in-centos7/278391)

<div class="topic-metadata">

**Author:** [@Rizky\_Hudha](https://discuss.elastic.co/u/Rizky_Hudha)\
**Replies:** 9\
**Last updated:** [July 14, 2021, 8:29am UTC](https://discuss.elastic.co/t/error-start-elasticsearch-in-centos7/278391 "2021-07-14T08:29:24Z")

</div>

hello i found a problem when starting elasticsearch, and an error like this : Jul 12 05:05:34 bigdata systemd-entrypoint\[22275\]: Likely root cause: java.nio.file.AccessDeniedException: /etc/elasticsearch/elasticsearch.k…

---

## [X-Pack Alerting](https://discuss.elastic.co/t/x-pack-alerting/98833)

<div class="topic-metadata">

**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\
**Replies:** 9\
**Last updated:** [September 8, 2017, 9:10am UTC](https://discuss.elastic.co/t/x-pack-alerting/98833 "2017-09-08T09:10:21Z")

</div>

In a multi node elastic cluster which node (master, hot and warm data nodes, client nodes) the following mail configuration needs to be entered for X-Pack alerting. xpack.notification.email.account: work: profile: gm…

---

## [Logstash slows down overtime](https://discuss.elastic.co/t/logstash-slows-down-overtime/184274)

<div class="topic-metadata">

**Author:** [@mmk1995](https://discuss.elastic.co/u/mmk1995)\
**Replies:** 14\
**Last updated:** [June 6, 2019, 10:21am UTC](https://discuss.elastic.co/t/logstash-slows-down-overtime/184274 "2019-06-06T10:21:22Z")

</div>

input { file { path =\> "/home/elk/logstash-6.5.4/input\_data/log-1000k.log" start\_position =\> "beginning" sincedb\_path =\> "/dev/null" } } filter { kv { field\_split =\> " " value\_split =\> "=" } ruby { init =\> …

---

## [Cisco Duo Integration not working](https://discuss.elastic.co/t/cisco-duo-integration-not-working/292746)

<div class="topic-metadata">

**Author:** [@bm11100](https://discuss.elastic.co/u/bm11100)\
**Replies:** 9\
**Last updated:** [December 30, 2021, 11:46am UTC](https://discuss.elastic.co/t/cisco-duo-integration-not-working/292746 "2021-12-30T11:46:24Z")

</div>

Hello, I'm looking to ingest Cisco Duo logs, I signed up for a trial of Duo to test this out, but when adding the information to the Fleet integration, no logs are coming through to Elastic. I've followed the instructio…

---

## [How to add password authorization](https://discuss.elastic.co/t/how-to-add-password-authorization/323713)

<div class="topic-metadata">

**Author:** [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\
**Replies:** 14\
**Last updated:** [January 31, 2023, 7:52am UTC](https://discuss.elastic.co/t/how-to-add-password-authorization/323713 "2023-01-31T07:52:15Z")

</div>

Hi I've setup elk stack version 8.6.0. I've disabled authorization initially because ive installed it using a ansible playbook. by any way can i setup authorization from front end after i access kibana from front end?

---

## [No processor type exists with name \[attachment\]](https://discuss.elastic.co/t/no-processor-type-exists-with-name-attachment/285013)

<div class="topic-metadata">

**Author:** [@Jihad\_Abdulrazaq](https://discuss.elastic.co/u/Jihad_Abdulrazaq)\
**Replies:** 9\
**Last updated:** [September 24, 2021, 1:45am UTC](https://discuss.elastic.co/t/no-processor-type-exists-with-name-attachment/285013 "2021-09-24T01:45:31Z")

</div>

Hello Dears, I am getting below error, while trying to ingest pdf file: “No processor type exists with name \[attachment\]" $params = \[ 'id' =\> 'attachment', 'body' =\> \[ …

---

## [BM25 score of two indexed document in elasticsearch](https://discuss.elastic.co/t/bm25-score-of-two-indexed-document-in-elasticsearch/117289)

<div class="topic-metadata">

**Author:** [@Saeed\_Zhiany](https://discuss.elastic.co/u/Saeed_Zhiany)\
**Replies:** 9\
**Last updated:** [February 1, 2018, 2:25pm UTC](https://discuss.elastic.co/t/bm25-score-of-two-indexed-document-in-elasticsearch/117289 "2018-02-01T14:25:12Z")

</div>

I have an index with two type t1 and t2. a few documents has been index in each of them with following structure: { "mappings": { "t1": { "properties": { "body": { "type": "string" …

---

## [BUG: Alternating result set across every query](https://discuss.elastic.co/t/bug-alternating-result-set-across-every-query/8566)

<div class="topic-metadata">

**Author:** [@Antonio\_Lobato](https://discuss.elastic.co/u/Antonio_Lobato)\
**Replies:** 13\
**Last updated:** [October 5, 2016, 10:55am UTC](https://discuss.elastic.co/t/bug-alternating-result-set-across-every-query/8566 "2016-10-05T10:55:33Z")

</div>

Hi everyone! So we're implementing Elasticsearch in a few production systems, and we've run into this show stopper of a bug. Here's the setup: Cluster of 5 servers. ~500 gigs of data per server (n+1 redundancy for a…

---

## [Cant filter out events?](https://discuss.elastic.co/t/cant-filter-out-events/253174)

<div class="topic-metadata">

**Author:** [@jcor](https://discuss.elastic.co/u/jcor)\
**Replies:** 14\
**Last updated:** [October 27, 2020, 10:03am UTC](https://discuss.elastic.co/t/cant-filter-out-events/253174 "2020-10-27T10:03:07Z")

</div>

Hi all, We're trying to configure winlog beats to drop info level logs but seem to be missing something. Ive found a post that is trying to do the same thing as we are but their config isnt working. So I'm guessing my l…

---

## [Parse basic xml file](https://discuss.elastic.co/t/parse-basic-xml-file/305331)

<div class="topic-metadata">

**Author:** [@Ely\_96](https://discuss.elastic.co/u/Ely_96)\
**Replies:** 11\
**Last updated:** [May 21, 2022, 10:42pm UTC](https://discuss.elastic.co/t/parse-basic-xml-file/305331 "2022-05-21T22:42:01Z")

</div>

Hi All, Could you please help me? I'm in trouble on parsing a basic xml file. This is an example of my xml: \<hotel\>\<name\>Hotel 1\</name\>\<rooms\>22\</rooms\>\<kitchens\>1\</kitchens\>\<restaurants\>2\</restaurants\>\</hotel\> \<hotel\>…

---

## [APM Java Agent crashes with Springboot 2](https://discuss.elastic.co/t/apm-java-agent-crashes-with-springboot-2/197330)

<div class="topic-metadata">

**Author:** [@suikast42](https://discuss.elastic.co/u/suikast42)\
**Replies:** 11\
**Last updated:** [September 13, 2019, 11:05am UTC](https://discuss.elastic.co/t/apm-java-agent-crashes-with-springboot-2/197330 "2019-09-13T11:05:55Z")

</div>

The same project runs with APM 1.8 Javaclient but with 1.9.0 the JVM crashes without any information from program pom.xml \<?xml version="1.0" encoding="UTF-8"?\> \<project xmlns="http://maven.apache.org/POM/4.…

---

## [Rollover error](https://discuss.elastic.co/t/rollover-error/252278)

<div class="topic-metadata">

**Author:** [@venku](https://discuss.elastic.co/u/venku)\
**Replies:** 10\
**Last updated:** [October 17, 2020, 2:28pm UTC](https://discuss.elastic.co/t/rollover-error/252278 "2020-10-17T14:28:11Z")

</div>

I am totally lost on how Rollover works. I keep ending up with an error. I deleted my indexes and started fresh but still the same error everytime. I am having following error and could not figure why this is happening.…

---

## [Activation du query cache](https://discuss.elastic.co/t/activation-du-query-cache/36144)

<div class="topic-metadata">

**Author:** [@Blured\_Derulb](https://discuss.elastic.co/u/Blured_Derulb)\
**Replies:** 9\
**Last updated:** [December 2, 2015, 3:27pm UTC](https://discuss.elastic.co/t/activation-du-query-cache/36144 "2015-12-02T15:27:55Z")

</div>

Bonjour, Sur une 1.7, je cherche à vérifier que le query cache est bien activé. Pour celà je regarde via cette url http://localhost:9200/\_nodes/stats/indices/query\_cache?pretty&human que les "query\_cache" bougent : …

---

## [Geo bounds aggregation as a sub aggregator?](https://discuss.elastic.co/t/geo-bounds-aggregation-as-a-sub-aggregator/18856)

<div class="topic-metadata">

**Author:** [@svartalf](https://discuss.elastic.co/u/svartalf)\
**Replies:** 9\
**Last updated:** [September 3, 2014, 2:32pm UTC](https://discuss.elastic.co/t/geo-bounds-aggregation-as-a-sub-aggregator/18856 "2014-09-03T14:32:44Z")

</div>

Is there any way to use geo\_bounds as a sub aggregator? I have a geohash\_grid aggregation, and it will be very useful to get bounds for each bucket of the data. Right now my ES 1.3.0 says that he "Could not find ag…

---

## [Problem Ingesting CSV with quoted description field](https://discuss.elastic.co/t/problem-ingesting-csv-with-quoted-description-field/137718)

<div class="topic-metadata">

**Author:** [@EmmaGS](https://discuss.elastic.co/u/EmmaGS)\
**Replies:** 10\
**Last updated:** [July 2, 2018, 8:01pm UTC](https://discuss.elastic.co/t/problem-ingesting-csv-with-quoted-description-field/137718 "2018-07-02T20:01:15Z")

</div>

Hello everyone I'm having problems with a csv file with information like this F18AP00207,,,SAI EXEMPT,83641.00,77059.00,160700,0.00,0.00,0.00,0.00,2018-05-29,2018-05-29,2021-06-30,014,DEPARTMENT OF THE INTERIOR (DOI),1…

---

## [ES 6.1.1 Server with small data goes into GC loop](https://discuss.elastic.co/t/es-6-1-1-server-with-small-data-goes-into-gc-loop/130340)

<div class="topic-metadata">

**Author:** [@reedzhao](https://discuss.elastic.co/u/reedzhao)\
**Replies:** 14\
**Last updated:** [May 9, 2018, 4:18pm UTC](https://discuss.elastic.co/t/es-6-1-1-server-with-small-data-goes-into-gc-loop/130340 "2018-05-09T16:18:48Z")

</div>

I have a small ES deployment that has been running fine for about 4 months. Today it suddenly start to use up all CPU. No change in query code, no change in traffic load. It just suddenly start to do a lot of GC. My d…

---

## [Synonms Analyzer/Filter does not work - Solved!](https://discuss.elastic.co/t/synonms-analyzer-filter-does-not-work-solved/140020)

<div class="topic-metadata">

**Author:** [@ArunANayagam](https://discuss.elastic.co/u/ArunANayagam)\
**Replies:** 9\
**Last updated:** [July 18, 2018, 4:05pm UTC](https://discuss.elastic.co/t/synonms-analyzer-filter-does-not-work-solved/140020 "2018-07-18T16:05:19Z")

</div>

Hi, I created a simple synonm analyzer/filter and I was able to apply to the index fine, at least it looks like its applied fine, here's the cluster state extract, "sports-2018.07.13": { "state": "…

[Previous page](https://discuss.elastic.co/top.md?page=172&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=174&per_page=50&period=all)
