# Top

**URL:** https://discuss.elastic.co/top.md?page=205&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 206

---

## [ElasticSerach java client or ElasticSerach java plugin for enrich all document at index time?](https://discuss.elastic.co/t/elasticserach-java-client-or-elasticserach-java-plugin-for-enrich-all-document-at-index-time/14170)

<div class="topic-metadata">

**Author:** [@stefano\_ruggiero](https://discuss.elastic.co/u/stefano_ruggiero)\
**Replies:** 9\
**Last updated:** [February 11, 2016, 7:03am UTC](https://discuss.elastic.co/t/elasticserach-java-client-or-elasticserach-java-plugin-for-enrich-all-document-at-index-time/14170 "2016-02-11T07:03:15Z")

</div>

hi all, iam trying to create a new custom node or plugin that listen to all stream of data in ES cluster and then if a particular document satisfy my condition add a specific field or something similar. How is the…

---

## [Test the fault tolerant mechanism for ES cluster nodes](https://discuss.elastic.co/t/test-the-fault-tolerant-mechanism-for-es-cluster-nodes/214160)

<div class="topic-metadata">

**Author:** [@pyerunka](https://discuss.elastic.co/u/pyerunka)\
**Replies:** 15\
**Last updated:** [January 8, 2020, 11:51am UTC](https://discuss.elastic.co/t/test-the-fault-tolerant-mechanism-for-es-cluster-nodes/214160 "2020-01-08T11:51:14Z")

</div>

Hello, I have configured 3 node ES cluster. All 3 nodes are master eligible. So if one goes down other should be eligible to elect itself as a master node and will form a 2 node cluster. How i can check this with my c…

---

## [Elasticsearch-certutil in elastic cloud](https://discuss.elastic.co/t/elasticsearch-certutil-in-elastic-cloud/229566)

<div class="topic-metadata">

**Author:** [@Rajeev\_Bhat](https://discuss.elastic.co/u/Rajeev_Bhat)\
**Replies:** 10\
**Last updated:** [April 24, 2020, 5:04am UTC](https://discuss.elastic.co/t/elasticsearch-certutil-in-elastic-cloud/229566 "2020-04-24T05:04:22Z")

</div>

Hello, How do I use the following command in elastic cloud? https://www.elastic.co/guide/en/elasticsearch/reference/current/certutil.html Thanks, Rajeev

---

## [Snapshots are not auto created](https://discuss.elastic.co/t/snapshots-are-not-auto-created/257786)

<div class="topic-metadata">

**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\
**Replies:** 10\
**Last updated:** [December 10, 2020, 5:05am UTC](https://discuss.elastic.co/t/snapshots-are-not-auto-created/257786 "2020-12-10T05:05:36Z")

</div>

Hello I have configured SLM. it worked fine for a couple of months. I have updated the policy and made some changes to the cluster, resource-wise (disks, CPU, memory). Now the automatic snapshots are not working anymor…

---

## [Netflow\_module error](https://discuss.elastic.co/t/netflow-module-error/195723)

<div class="topic-metadata">

**Author:** [@Vikash\_Singh1](https://discuss.elastic.co/u/Vikash_Singh1)\
**Replies:** 15\
**Last updated:** [August 20, 2019, 9:05am UTC](https://discuss.elastic.co/t/netflow-module-error/195723 "2019-08-20T09:05:47Z")

</div>

Hi I am trying to use logstash netflow module but when I am executing "bin/logstash --modules netflow -M netflow.var.input.udp.port=2055" then I am getting error saying: "\[WARN \] 2019-08-19 16:26:18.548 \[Ruby-0-Thread-4…

---

## [Duplicate documents found in ES after indexing](https://discuss.elastic.co/t/duplicate-documents-found-in-es-after-indexing/209647)

<div class="topic-metadata">

**Author:** [@bibin](https://discuss.elastic.co/u/bibin)\
**Replies:** 12\
**Last updated:** [December 16, 2019, 4:17pm UTC](https://discuss.elastic.co/t/duplicate-documents-found-in-es-after-indexing/209647 "2019-12-16T16:17:22Z")

</div>

Hi friends, I am facing a serious issue of duplicate documents found in ES after indexing... log format // 10.8.1.90,23-11-2019 00:00:07,CURRENT,Broadband,Idea/Vodafone,Failure 10.8.1.90,23-11-2019 01:30:08,CURRENT,…

---

## [Json parse return filled with NULL](https://discuss.elastic.co/t/json-parse-return-filled-with-null/175175)

<div class="topic-metadata">

**Author:** [@ep4sh](https://discuss.elastic.co/u/ep4sh)\
**Replies:** 9\
**Last updated:** [April 3, 2019, 3:35pm UTC](https://discuss.elastic.co/t/json-parse-return-filled-with-null/175175 "2019-04-03T15:35:24Z")

</div>

I parse JSON, and even If JSON is invalid I want to save it. So I created an additional variable "invalid". If there is an exception, the method should return "saved" invalid var, but it doesn't - def jsonParse(str, ev…

---

## [Elastic-agent \> nginx \> logstash -- nginx proxy error](https://discuss.elastic.co/t/elastic-agent-nginx-logstash-nginx-proxy-error/358387)

<div class="topic-metadata">

**Author:** [@marlonws](https://discuss.elastic.co/u/marlonws)\
**Replies:** 22\
**Last updated:** [May 1, 2024, 7:15pm UTC](https://discuss.elastic.co/t/elastic-agent-nginx-logstash-nginx-proxy-error/358387 "2024-05-01T19:15:42Z")

</div>

I configured the fleet server perfectly, the policy that makes the elastic-agent output directly to elasticsearch works normally. I configured a logstash, without errors, it connects normally to elasticsearch. Logstash …

---

## [Logstash Pipelines for Parsing Questions - No fileset in output](https://discuss.elastic.co/t/logstash-pipelines-for-parsing-questions-no-fileset-in-output/228519)

<div class="topic-metadata">

**Author:** [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\
**Replies:** 10\
**Last updated:** [April 20, 2020, 11:48am UTC](https://discuss.elastic.co/t/logstash-pipelines-for-parsing-questions-no-fileset-in-output/228519 "2020-04-20T11:48:43Z")

</div>

I've tried following https://www.elastic.co/guide/en/logstash/7.6/logstash-config-for-filebeat-modules.html, and create logstash pipelines to parse the filebeat data. However, even the examples provided in that link don…

---

## [Update of the Geolite database](https://discuss.elastic.co/t/update-of-the-geolite-database/270801)

<div class="topic-metadata">

**Author:** [@Pacous](https://discuss.elastic.co/u/Pacous)\
**Replies:** 12\
**Last updated:** [April 22, 2021, 10:32am UTC](https://discuss.elastic.co/t/update-of-the-geolite-database/270801 "2021-04-22T10:32:58Z")

</div>

I configured the Geoip and the Geolite database in logstash. How often do you update the Geolite database? Regards,

---

## [Elasticsearch cluster kibana randomly slow on some requests](https://discuss.elastic.co/t/elasticsearch-cluster-kibana-randomly-slow-on-some-requests/273174)

<div class="topic-metadata">

**Author:** [@arvanMalian](https://discuss.elastic.co/u/arvanMalian)\
**Replies:** 10\
**Last updated:** [May 25, 2021, 10:57pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-kibana-randomly-slow-on-some-requests/273174 "2021-05-25T22:57:36Z")

</div>

Elasticsearch cluster kibana randomly slow on some requests Hi everyone, I have a perfomance issue when navigating on kibana admin interface. It takes a lot of time to display the contents: genearlly on items in SECURT…

---

## [How to custom score (score based on a date field)?](https://discuss.elastic.co/t/how-to-custom-score-score-based-on-a-date-field/2971)

<div class="topic-metadata">

**Author:** [@John\_Chang](https://discuss.elastic.co/u/John_Chang)\
**Replies:** 11\
**Last updated:** [June 4, 2010, 4:22pm UTC](https://discuss.elastic.co/t/how-to-custom-score-score-based-on-a-date-field/2971 "2010-06-04T16:22:06Z")

</div>

I'd like to have documents come back sorted by a date saved in my doc. So if I ask for the top 100 hits, I want the 100 most recent according to a doc field, not according to the time time of indexing. I did find the d…

---

## [LS -\> LS (Lumberjack) - documents not being indexed?](https://discuss.elastic.co/t/ls-ls-lumberjack-documents-not-being-indexed/144224)

<div class="topic-metadata">

**Author:** [@if-meaton](https://discuss.elastic.co/u/if-meaton)\
**Replies:** 12\
**Last updated:** [August 14, 2018, 8:31pm UTC](https://discuss.elastic.co/t/ls-ls-lumberjack-documents-not-being-indexed/144224 "2018-08-14T20:31:49Z")

</div>

Hi Guys, LS 6.3.x ES 6.3.x I have two logstashs servers across 2 datacentres connected over the internet using the lumberjack protocol. I used https://www.elastic.co/guide/en/logstash/current/ls-to-ls.html as a refere…

---

## [Fscrawler index large file](https://discuss.elastic.co/t/fscrawler-index-large-file/128823)

<div class="topic-metadata">

**Author:** [@asmael](https://discuss.elastic.co/u/asmael)\
**Replies:** 10\
**Last updated:** [April 20, 2018, 5:15pm UTC](https://discuss.elastic.co/t/fscrawler-index-large-file/128823 "2018-04-20T17:15:08Z")

</div>

hello , I want to know how can I index a large file I want the whole content to be added , I already tried this : "\_indexed\_chars": "100%" but it dosen't work thank you

---

## [Not able to view Overview page ,Analytics page ,API logs page in AppSearch](https://discuss.elastic.co/t/not-able-to-view-overview-page-analytics-page-api-logs-page-in-appsearch/251081)

<div class="topic-metadata">

**Author:** [@Subhasis\_Dash](https://discuss.elastic.co/u/Subhasis_Dash)\
**Replies:** 9\
**Last updated:** [December 3, 2020, 1:50pm UTC](https://discuss.elastic.co/t/not-able-to-view-overview-page-analytics-page-api-logs-page-in-appsearch/251081 "2020-12-03T13:50:34Z")

</div>

Hi , While clicking on Overview Metrics or Analytics(similar error) page we get the following error logs: \[2020-10-06T07:01:44.151+00:00\]\[25\]\[2298\]\[action\_controller\]\[INFO\]: \[b5d5890cc0a1bcabb2e2a2fec1927002\] Processing…

---

## [Anonymous Access Unexpectedly Allowed](https://discuss.elastic.co/t/anonymous-access-unexpectedly-allowed/225765)

<div class="topic-metadata">

**Author:** [@diggitydug](https://discuss.elastic.co/u/diggitydug)\
**Replies:** 9\
**Last updated:** [March 31, 2020, 5:03am UTC](https://discuss.elastic.co/t/anonymous-access-unexpectedly-allowed/225765 "2020-03-31T05:03:22Z")

</div>

Hello - We deployed a trial version of an ElasticSearch 6.5.3 and Kibana stack from the Azure marketplace and everything was running fine. Everything was configured properly, and we were using a username & password to …

---

## [Unable to remove lines from message filed](https://discuss.elastic.co/t/unable-to-remove-lines-from-message-filed/301866)

<div class="topic-metadata">

**Author:** [@amsmzn](https://discuss.elastic.co/u/amsmzn)\
**Replies:** 11\
**Last updated:** [April 11, 2022, 12:31pm UTC](https://discuss.elastic.co/t/unable-to-remove-lines-from-message-filed/301866 "2022-04-11T12:31:27Z")

</div>

I am trying to remove the below lines from my jenkins build logs with mutate, gsub filter but unable to do so. Can anybody please help me in this. Downloaded from snapshots: https://abc.com/abc.pom 16:39:44 Progress (1)…

---

## [Generate multiple alerts from elastic query](https://discuss.elastic.co/t/generate-multiple-alerts-from-elastic-query/351113)

<div class="topic-metadata">

**Author:** [@umesh2020](https://discuss.elastic.co/u/umesh2020)\
**Replies:** 10\
**Last updated:** [January 18, 2024, 3:03pm UTC](https://discuss.elastic.co/t/generate-multiple-alerts-from-elastic-query/351113 "2024-01-18T15:03:19Z")

</div>

I want to generate an alert whenever a pod is restarted in kubernetes. I am planning to use kubernetes.container.status.restarts to identify whether pods are restarted or not. I would like to have a single elasticsear…

---

## [What would be the lowest-cost, highest-impact change I can make to decrease response times?](https://discuss.elastic.co/t/what-would-be-the-lowest-cost-highest-impact-change-i-can-make-to-decrease-response-times/29919)

<div class="topic-metadata">

**Author:** [@gx14](https://discuss.elastic.co/u/gx14)\
**Replies:** 11\
**Last updated:** [October 3, 2015, 2:14pm UTC](https://discuss.elastic.co/t/what-would-be-the-lowest-cost-highest-impact-change-i-can-make-to-decrease-response-times/29919 "2015-10-03T14:14:10Z")

</div>

(Asked on SO but thought that this place is probably better) Unguided beginners in any field often find themselves barking up the wrong tree in trying to solve a problem — this question is asked in hoping that it'll ve…

---

## [Detections API cant work with Unicode characters](https://discuss.elastic.co/t/detections-api-cant-work-with-unicode-characters/351781)

<div class="topic-metadata">

**Author:** [@gbL2k](https://discuss.elastic.co/u/gbL2k)\
**Replies:** 24\
**Last updated:** [January 26, 2024, 2:29pm UTC](https://discuss.elastic.co/t/detections-api-cant-work-with-unicode-characters/351781 "2024-01-26T14:29:10Z")

</div>

Hello everyone! I would like to to create detections with unicode characters in the description but I cant seem to find a way to make the API work with unicode characters. Anyone had the same problem? Thanks in advanc…

---

## [Problem with Detections - Custom query rule](https://discuss.elastic.co/t/problem-with-detections-custom-query-rule/311543)

<div class="topic-metadata">

**Author:** [@Yuriy\_Tsarenko](https://discuss.elastic.co/u/Yuriy_Tsarenko)\
**Replies:** 9\
**Last updated:** [August 11, 2022, 12:24pm UTC](https://discuss.elastic.co/t/problem-with-detections-custom-query-rule/311543 "2022-08-11T12:24:47Z")

</div>

Good afternoon dear community. I turn to you with the following problem. The custom rule does not create security alerts, although it works without visible errors. Kibana Version: 8.3.1 Rule type: custom query. Rule …

---

## [Issue while using transport client](https://discuss.elastic.co/t/issue-while-using-transport-client/96583)

<div class="topic-metadata">

**Author:** [@Neetu](https://discuss.elastic.co/u/Neetu)\
**Replies:** 9\
**Last updated:** [August 18, 2017, 12:40pm UTC](https://discuss.elastic.co/t/issue-while-using-transport-client/96583 "2017-08-18T12:40:06Z")

</div>

HI , Iam using transport client 5.4.3 version with elastic search 5.4.3 version and java as 1.8 but iam unable to connect to the server with trasport client . TransportClient client = new PreBuiltTransportClient(Setti…

---

## [Anyone know the elastic\_apm\_application\_packages value for Jenkins?](https://discuss.elastic.co/t/anyone-know-the-elastic-apm-application-packages-value-for-jenkins/327786)

<div class="topic-metadata">

**Author:** [@trudesea](https://discuss.elastic.co/u/trudesea)\
**Replies:** 11\
**Last updated:** [March 17, 2023, 6:52pm UTC](https://discuss.elastic.co/t/anyone-know-the-elastic-apm-application-packages-value-for-jenkins/327786 "2023-03-17T18:52:50Z")

</div>

I have no idea where/how to find this value, I've exhausted my Google Fu capabilities. Thanks

---

## [Kibana Calculations Give Wrong Results](https://discuss.elastic.co/t/kibana-calculations-give-wrong-results/339778)

<div class="topic-metadata">

**Author:** [@Nabeel\_Ahmed\_NAK](https://discuss.elastic.co/u/Nabeel_Ahmed_NAK)\
**Replies:** 10\
**Last updated:** [August 2, 2023, 9:49am UTC](https://discuss.elastic.co/t/kibana-calculations-give-wrong-results/339778 "2023-08-02T09:49:42Z")

</div>

I'm Getting wrong counts in version 8.5.0 Time range is selected absolute values. The count of records are 102,118 hits When I create it's widget metrics of count it's same as expected: 102118 When I create unique co…

---

## [Continous Monitoring of Disk Allocation in Kibana Stack Monitoring](https://discuss.elastic.co/t/continous-monitoring-of-disk-allocation-in-kibana-stack-monitoring/352195)

<div class="topic-metadata">

**Author:** [@ibollman](https://discuss.elastic.co/u/ibollman)\
**Replies:** 12\
**Last updated:** [February 13, 2024, 7:26pm UTC](https://discuss.elastic.co/t/continous-monitoring-of-disk-allocation-in-kibana-stack-monitoring/352195 "2024-02-13T19:26:08Z")

</div>

Hello, we are using Elastic Cloud Enterprise and we send all the Logs and Metrics of our Deployments to a Monitoring cluster we have created just for the cluster monitoring purposes - just as the best practices suggest. …

---

## [SSL rabbitmq input](https://discuss.elastic.co/t/ssl-rabbitmq-input/137850)

<div class="topic-metadata">

**Author:** [@kraymond](https://discuss.elastic.co/u/kraymond)\
**Replies:** 9\
**Last updated:** [July 2, 2018, 9:04pm UTC](https://discuss.elastic.co/t/ssl-rabbitmq-input/137850 "2018-07-02T21:04:33Z")

</div>

I have looked and seen different settings but when input any setting dealing with ssl other than ssl =\> true and verify\_ssl =\> true it states setting unkown. How does logstash know where the certs are if there are no op…

---

## [Filebeat for shipping the entire logfile as it is](https://discuss.elastic.co/t/filebeat-for-shipping-the-entire-logfile-as-it-is/178565)

<div class="topic-metadata">

**Author:** [@shub8050](https://discuss.elastic.co/u/shub8050)\
**Replies:** 10\
**Last updated:** [April 30, 2019, 10:58am UTC](https://discuss.elastic.co/t/filebeat-for-shipping-the-entire-logfile-as-it-is/178565 "2019-04-30T10:58:59Z")

</div>

I need to get the entire log file as it is in the elk stack. Consider I have this log: \<line1\> \<line2\> \<line3\>| If my pointer is placed on the line 3 i will get the entire log file except \<line3\> . If the cursor is in…

---

## [Logstash https plugin not working](https://discuss.elastic.co/t/logstash-https-plugin-not-working/242386)

<div class="topic-metadata">

**Author:** [@rajkumar.m](https://discuss.elastic.co/u/rajkumar.m)\
**Replies:** 9\
**Last updated:** [July 24, 2020, 5:45pm UTC](https://discuss.elastic.co/t/logstash-https-plugin-not-working/242386 "2020-07-24T17:45:29Z")

</div>

Hi Team, I am unable to send data with logstash plugin https, someone please help me. I can send data with http without security successfully, but when try to enable ssl, it is failing, please find the below command s…

---

## [Elasticsearch network configuration](https://discuss.elastic.co/t/elasticsearch-network-configuration/146714)

<div class="topic-metadata">

**Author:** [@arush\_khanna](https://discuss.elastic.co/u/arush_khanna)\
**Replies:** 9\
**Last updated:** [September 6, 2018, 10:43am UTC](https://discuss.elastic.co/t/elasticsearch-network-configuration/146714 "2018-09-06T10:43:53Z")

</div>

I'm new to elk stack trying to get my hands dirty. There are two machines - one with logstash where i want to ingest a csv file and store it on another machine where elasticsearch and kibana are installed. I tried ed…

---

## [Logstash config date filter - what am I doing wrong?](https://discuss.elastic.co/t/logstash-config-date-filter-what-am-i-doing-wrong/248186)

<div class="topic-metadata">

**Author:** [@ThePreMan](https://discuss.elastic.co/u/ThePreMan)\
**Replies:** 14\
**Last updated:** [September 21, 2020, 6:23pm UTC](https://discuss.elastic.co/t/logstash-config-date-filter-what-am-i-doing-wrong/248186 "2020-09-21T18:23:50Z")

</div>

Hi, I am new to the elastic stack. I am currently having trouble setting the timestamp within the logstash config. The date format to be read: 2019/06/19 10:05:37.000000 19046 2019/06/19 10:07:11.000000 3893143 075…

---

## [List all entries in an index + type](https://discuss.elastic.co/t/list-all-entries-in-an-index-type/3086)

<div class="topic-metadata">

**Author:** [@Franz\_Allan\_Valencia](https://discuss.elastic.co/u/Franz_Allan_Valencia)\
**Replies:** 13\
**Last updated:** [July 16, 2010, 11:18am UTC](https://discuss.elastic.co/t/list-all-entries-in-an-index-type/3086 "2010-07-16T11:18:21Z")

</div>

Currently, I can search for entries in an index + type. But if I wan to list it and paginate through it, how can I do that with ElasticSearch? Thanks, -- Franz Allan Valencia See | Java Software Engineer franz.se…

---

## [Roundrobin kibana names](https://discuss.elastic.co/t/roundrobin-kibana-names/187857)

<div class="topic-metadata">

**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Replies:** 11\
**Last updated:** [July 9, 2019, 7:55pm UTC](https://discuss.elastic.co/t/roundrobin-kibana-names/187857 "2019-07-09T19:55:59Z")

</div>

I have three kibana server kib01, kib02, kib03 ( 10.x.x.1, 10.x.x.2, 10.x.x.3) I did setup dns for them kibglobal -\> 10.x.x.1 kibglobal -\> 10.x.x.2 kibglobal -\> 10.x.x.3 now when I do nslooking I get all this ip in…

---

## [Timestamp seems lost when I stop all the 3 logstash nodes then start them?](https://discuss.elastic.co/t/timestamp-seems-lost-when-i-stop-all-the-3-logstash-nodes-then-start-them/93360)

<div class="topic-metadata">

**Author:** [@KeithTt](https://discuss.elastic.co/u/KeithTt)\
**Replies:** 11\
**Last updated:** [July 27, 2017, 10:57am UTC](https://discuss.elastic.co/t/timestamp-seems-lost-when-i-stop-all-the-3-logstash-nodes-then-start-them/93360 "2017-07-27T10:57:05Z")

</div>

logstash version: 5.41 There are 3 logstash nodes in my ELK-STACK, I configure load-balancing in filebeat. I use BELK to collect and analysis nginx access log, and I change the log-format to json. Once, I stop all …

---

## [Kibana aws integration cloudtrail collect from s3 warning](https://discuss.elastic.co/t/kibana-aws-integration-cloudtrail-collect-from-s3-warning/345367)

<div class="topic-metadata">

**Author:** [@cLaYYs](https://discuss.elastic.co/u/cLaYYs)\
**Replies:** 10\
**Last updated:** [October 27, 2023, 11:08am UTC](https://discuss.elastic.co/t/kibana-aws-integration-cloudtrail-collect-from-s3-warning/345367 "2023-10-27T11:08:50Z")

</div>

Hi all, ELK version: 8.9 we tried to collect cloudtrail logs from s3 bucket by using kibana default aws integration. All information that integration wanted is set. But no logs shows up in kibana and no dataview show…

---

## [Secure elasticstack](https://discuss.elastic.co/t/secure-elasticstack/242752)

<div class="topic-metadata">

**Author:** [@elk6](https://discuss.elastic.co/u/elk6)\
**Replies:** 10\
**Last updated:** [July 28, 2020, 12:10pm UTC](https://discuss.elastic.co/t/secure-elasticstack/242752 "2020-07-28T12:10:23Z")

</div>

I have a small cluster that sits on one machine which pulls data from about 5 servers. Now, I was asked to secure the connection and set up a user for when entering Kibana. I read the latest documentation and it seems …

---

## [Cluster with 2 nodes changing shard type](https://discuss.elastic.co/t/cluster-with-2-nodes-changing-shard-type/200263)

<div class="topic-metadata">

**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\
**Replies:** 11\
**Last updated:** [September 20, 2019, 10:30am UTC](https://discuss.elastic.co/t/cluster-with-2-nodes-changing-shard-type/200263 "2019-09-20T10:30:12Z")

</div>

Hi, currently I have a cluster with just 2 nodes. every index is divided just in 1 shard (indices are very very small) and 1 replica. I know that a cluster with 2 nodes has several limits but this is the state of art. …

---

## [Filebeat can't keep up with single log file](https://discuss.elastic.co/t/filebeat-cant-keep-up-with-single-log-file/136979)

<div class="topic-metadata">

**Author:** [@JensVanDeynse](https://discuss.elastic.co/u/JensVanDeynse)\
**Replies:** 9\
**Last updated:** [June 25, 2018, 6:14am UTC](https://discuss.elastic.co/t/filebeat-cant-keep-up-with-single-log-file/136979 "2018-06-25T06:14:57Z")

</div>

Hello Logstash version: 6.2.4 Filebeat version: 6.2.4 We've setup an ELK stack in our company but recently we've been experiencing some issues during the morning ramp-up on our filebeats. The problem is as follows: F…

---

## [Grok for data](https://discuss.elastic.co/t/grok-for-data/309093)

<div class="topic-metadata">

**Author:** [@INS](https://discuss.elastic.co/u/INS)\
**Replies:** 17\
**Last updated:** [July 13, 2022, 11:57am UTC](https://discuss.elastic.co/t/grok-for-data/309093 "2022-07-13T11:57:35Z")

</div>

Can anyone try to build grok for below data it's important that timestamp should be took from the first line of document 20220704061503 and interesting columns number: 0000080 data1:abort 0 type: onlist yes input of …

---

## [Retention lease background sync failed - help understand this log](https://discuss.elastic.co/t/retention-lease-background-sync-failed-help-understand-this-log/358334)

<div class="topic-metadata">

**Author:** [@Vikram\_R](https://discuss.elastic.co/u/Vikram_R)\
**Replies:** 10\
**Last updated:** [May 6, 2024, 7:32am UTC](https://discuss.elastic.co/t/retention-lease-background-sync-failed-help-understand-this-log/358334 "2024-05-06T07:32:10Z")

</div>

Hi Guys, New to this technology, I've tried to use elasticsearch self-managed for our application in our organization. I'm facing this "retention lease background sync failed" issue for quite some time. I tried to get…

---

## [\[apm\]The java-agent only provides the request information to the apm-service, and the dependency is empty](https://discuss.elastic.co/t/apm-the-java-agent-only-provides-the-request-information-to-the-apm-service-and-the-dependency-is-empty/322440)

<div class="topic-metadata">

**Author:** [@ntmxglrtayl03](https://discuss.elastic.co/u/ntmxglrtayl03)\
**Replies:** 11\
**Last updated:** [January 16, 2023, 9:29am UTC](https://discuss.elastic.co/t/apm-the-java-agent-only-provides-the-request-information-to-the-apm-service-and-the-dependency-is-empty/322440 "2023-01-16T09:29:48Z")

</div>

Kibana version: 7.17.8 Elasticsearch version: 7.17.8 APM Server version: 7.17.8 APM Agent language and version: java 1.35.0 What can I do to make them show?

---

## [Got this error "Error loading data" when we search for :,\<,\> in Discover page on kibana UI](https://discuss.elastic.co/t/got-this-error-error-loading-data-when-we-search-for-in-discover-page-on-kibana-ui/249953)

<div class="topic-metadata">

**Author:** [@prashant1](https://discuss.elastic.co/u/prashant1)\
**Replies:** 11\
**Last updated:** [November 6, 2020, 8:04am UTC](https://discuss.elastic.co/t/got-this-error-error-loading-data-when-we-search-for-in-discover-page-on-kibana-ui/249953 "2020-11-06T08:04:23Z")

</div>

In the discover tab when we try to search for :,\<,\> etc we got a error "Error loading data" on Kibana UI. Please refer to the attachment.

---

## [Modify the max bucket to report an error](https://discuss.elastic.co/t/modify-the-max-bucket-to-report-an-error/320414)

<div class="topic-metadata">

**Author:** [@Tonyhu\_T](https://discuss.elastic.co/u/Tonyhu_T)\
**Replies:** 12\
**Last updated:** [December 4, 2022, 12:51pm UTC](https://discuss.elastic.co/t/modify-the-max-bucket-to-report-an-error/320414 "2022-12-04T12:51:05Z")

</div>

I use the following command to modify max bucket: PUT \_cluster/settings { "persistent": { "search.max\_buckets": 500000 } } But received the following error message: { "error" : { "root\_cause" : \[ {…

---

## [Logs don't show up when trying to use logstash](https://discuss.elastic.co/t/logs-dont-show-up-when-trying-to-use-logstash/312937)

<div class="topic-metadata">

**Author:** [@mammodde](https://discuss.elastic.co/u/mammodde)\
**Replies:** 15\
**Last updated:** [September 5, 2022, 12:33pm UTC](https://discuss.elastic.co/t/logs-dont-show-up-when-trying-to-use-logstash/312937 "2022-09-05T12:33:34Z")

</div>

when trying to execute winlogbeat.exe from powershell i receive this kind of errors in logs {"log.level":"error","@timestamp":"xxx","log.logger":"publisher\_pipeline\_output","log.origin":{"file.name":"pipeline/client\_wor…

---

## [RPM names do not match their contents - recreating issue](https://discuss.elastic.co/t/rpm-names-do-not-match-their-contents-recreating-issue/203195)

<div class="topic-metadata">

**Author:** [@akshatsharma](https://discuss.elastic.co/u/akshatsharma)\
**Replies:** 10\
**Last updated:** [January 18, 2020, 4:30pm UTC](https://discuss.elastic.co/t/rpm-names-do-not-match-their-contents-recreating-issue/203195 "2020-01-18T16:30:04Z")

</div>

Creating new issue as the previous issue(RPM names do not match their contents) was closed. Do we have any update on this? Best Regards, Akshat

---

## [Status Yellow](https://discuss.elastic.co/t/status-yellow/120646)

<div class="topic-metadata">

**Author:** [@atom](https://discuss.elastic.co/u/atom)\
**Replies:** 10\
**Last updated:** [February 22, 2018, 9:23am UTC](https://discuss.elastic.co/t/status-yellow/120646 "2018-02-22T09:23:00Z")

</div>

Hi, i have just did an upgrade of Elasticsearch and my server successfully started and is up for half an hour now. The status changed from red to yellow and stayed yellow for 25 minutes now. Should i be concerned about …

---

## [Request: Please Test the RPM](https://discuss.elastic.co/t/request-please-test-the-rpm/11544)

<div class="topic-metadata">

**Author:** [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Replies:** 17\
**Last updated:** [May 23, 2013, 3:19pm UTC](https://discuss.elastic.co/t/request-please-test-the-rpm/11544 "2013-05-23T15:19:27Z")

</div>

Hey folks, with the release of 0.90.0.RC2 we also released an official RPM package. You can download it at http://www.elasticsearch.org/downloads/0-90-0-rc2/ The initial thought was to provide one RPM for all dis…

---

## [How to round to 2 digits after comma scripted field parameter value](https://discuss.elastic.co/t/how-to-round-to-2-digits-after-comma-scripted-field-parameter-value/282032)

<div class="topic-metadata">

**Author:** [@arisxf](https://discuss.elastic.co/u/arisxf)\
**Replies:** 9\
**Last updated:** [September 23, 2021, 6:32pm UTC](https://discuss.elastic.co/t/how-to-round-to-2-digits-after-comma-scripted-field-parameter-value/282032 "2021-09-23T18:32:00Z")

</div>

Management/Index Patterns/{indexing}/scripted field Visualize Visualize please all help

---

## [How to split index by field value?](https://discuss.elastic.co/t/how-to-split-index-by-field-value/268055)

<div class="topic-metadata">

**Author:** [@Rahmat\_Agung\_W](https://discuss.elastic.co/u/Rahmat_Agung_W)\
**Replies:** 9\
**Last updated:** [March 25, 2021, 6:15pm UTC](https://discuss.elastic.co/t/how-to-split-index-by-field-value/268055 "2021-03-25T18:15:07Z")

</div>

I have a VM. There are 2 similiar apps (docker apps) inside it, staging and development. They use 1 filebeat to push log to logstash. On these log, I have field container.labels.com\_docker\_compose\_project. I want to crea…

---

## [Querying the distinct values from ES index](https://discuss.elastic.co/t/querying-the-distinct-values-from-es-index/162666)

<div class="topic-metadata">

**Author:** [@chetansk](https://discuss.elastic.co/u/chetansk)\
**Replies:** 9\
**Last updated:** [January 2, 2019, 6:28pm UTC](https://discuss.elastic.co/t/querying-the-distinct-values-from-es-index/162666 "2019-01-02T18:28:21Z")

</div>

Hi, I am using ES version 1.4.0. I would like to retrieve the unique values from a field in ES index which can be expressed in SQL format as follows: SELECT (DISTINCT UserName) FROM UsersTable; I have tried to use agg…

---

## [Logstash forwader and indexer](https://discuss.elastic.co/t/logstash-forwader-and-indexer/123844)

<div class="topic-metadata">

**Author:** [@Gaurav\_Agarwal](https://discuss.elastic.co/u/Gaurav_Agarwal)\
**Replies:** 16\
**Last updated:** [March 15, 2018, 2:17pm UTC](https://discuss.elastic.co/t/logstash-forwader-and-indexer/123844 "2018-03-15T14:17:53Z")

</div>

Hi Wanted to know if within the logstash output if I want to put another filter is it possible.

[Previous page](https://discuss.elastic.co/top.md?page=204&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=206&per_page=50&period=all)
